Merge master into staging-next

2026-09-19 22:30:23 +00:00 · 2026-09-17 00:23:56 +00:00
parent 5faab3a1b7 6ae8874057
commit ff0f454fa6
195 changed files with 4773 additions and 22028 deletions
--- a/doc/release-notes/rl-2611.section.md
+++ b/doc/release-notes/rl-2611.section.md
@@ -102,6 +102,8 @@

 - `bosun` has been removed as it is no longer maintained upstream. the corresponding monitoring options has been removed.

+- `python3Packages.starlette-admin` v1.0.0 has released, which mainly refactors internals and adds a large set of new features. The high-level API is mostly unchanged, but users migrating from v0.17 may want to view [the migration guide](https://jowilf.github.io/starlette-admin/migration/#from-017x-to-100).
+
 - `uhttpmock` providing 0.0 ABI was removed. `uhttpmock_1_0` providing 1.0 ABI was renamed to `uhttpmock` and `uhttpmock_1_0` was kept as an alias.

 - `himalaya` has been updated from `v1.2.0` to `v2.0.0`, which introduces breaking changes. See the [release notes](https://github.com/pimalaya/himalaya/releases/tag/v2.0.0) and the [migration guide](https://github.com/pimalaya/himalaya/blob/master/MIGRATION.md).
--- a/nixos/doc/manual/release-notes/rl-2611.section.md
+++ b/nixos/doc/manual/release-notes/rl-2611.section.md
@@ -211,6 +211,8 @@

 - `security.polkit.enablePkexecWrapper` has been introduced, making the `pkexec` setuid wrapper opt-in.

+- `services.pghero` has been removed because the `pghero` package was unmaintained and thus dropped from Nixpkgs.
+
 - Apache Kafka has dropped support for ZooKeeper mode. The `apacheKafka_3_9` and `apacheKafka_4_0` packages have been removed, as every remaining packaged version is KRaft-only. The `services.apache-kafka.zookeeper` option (previously an alias for `services.apache-kafka.settings."zookeeper.connect"`) has been removed; migrate your cluster to [KRaft](#module-services-apache-kafka-kraft) mode instead.

 - `virtualisation.containers.registries.block` / `insecure` / `search` were deprecated,
@@ -293,6 +295,8 @@

 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->

+- `services.k3s` and `services.rke2` now expose the images declared in `images` through a `/nix/store` directory symlinked into `/var/lib/rancher/${name}/agent/images/nixos/`. The directory's store path changes whenever any image derivation changes, which makes k3s/rke2 detect and re-import the new archives, while `/var/lib/rancher/${name}/agent/images/` itself remains a normal directory that can still be used for manually added images. Previously, each image was linked with a fixed file name directly in that directory, so the cluster would not notice image updates and old symlinks could become dangling. After upgrading, you may want to remove those dangling symlinks (that was the case already when you wanted to stop deploying an image).
+
 - `programs.regreet` has been renamed to `services.displayManager.regreet`.

 - `komodo` has been updated to the v2 release line (2.x). See the [upstream v1 → v2 upgrade guide](https://github.com/moghtech/komodo/releases/tag/v2.0.0).
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -967,7 +967,6 @@
  ./services/misc/paisa.nix
  ./services/misc/paperless.nix
  ./services/misc/persistent-evdev.nix
-  ./services/misc/pghero.nix
  ./services/misc/pinchflat.nix
  ./services/misc/pinnwand.nix
  ./services/misc/plex.nix
--- a/nixos/modules/rename.nix
+++ b/nixos/modules/rename.nix
@@ -520,6 +520,9 @@ in
    (mkRemovedOptionModule [ "services" "filesender" ] ''
      services.filesender has been removed since it depends on simplesamlphp which was severely unmaintained.
    '')
+    (mkRemovedOptionModule [ "services" "pghero" ] ''
+      services.pghero has been removed because the (unmaintained) package was removed from Nixpkgs.
+    '')
    (mkRemovedOptionModule [ "services" "postfixadmin" ] ''
      services.postfixadmin has been removed since it was unmaintained in nixpkgs and the version
      available only supported PHP 8.1 which is EOL.
--- a/nixos/modules/services/cluster/rancher/default.nix
+++ b/nixos/modules/services/cluster/rancher/default.nix
@@ -849,13 +849,22 @@ let
                "L+".argument = "${manifest.source}";
              };
            };
-            # Make a systemd-tmpfiles rule for a container image
-            mkImageRule = image: {
-              name = "${imageDir}/${image.name}";
-              value = {
-                "L+".argument = "${image}";
-              };
-            };
+            # Build a single store directory containing symlinks to all
+            # container images declared in the NixOS configuration. The
+            # directory's store path changes whenever any image changes, so
+            # k3s/rke2 re-imports images on every generation switch. It is
+            # exposed under ${imageDir}/nixos so that ${imageDir} itself
+            # remains a normal directory that users can still populate manually.
+            agentImagesDir = pkgs.linkFarm "${name}-agent-images" (
+              map (image: {
+                # The store-path hash is included in the link name so that two
+                # different images with the same tarball base name do not
+                # collide. The context is discarded because tmpfiles link names
+                # must not carry store-path references.
+                name = builtins.unsafeDiscardStringContext (builtins.baseNameOf image);
+                path = image;
+              }) cfg.images
+            );
            # Merge charts with charts contained in enabled auto deploying charts
            helmCharts =
              (lib.concatMapAttrs (n: v: { ${n} = v.package; }) (
@@ -873,7 +882,11 @@ let
            };
          in
          (lib.mapAttrs' (_: v: mkManifestRule v) enabledManifests)
-          // (builtins.listToAttrs (map mkImageRule cfg.images))
+          // (lib.optionalAttrs (cfg.images != [ ]) {
+            "${imageDir}/nixos" = {
+              "L+".argument = "${agentImagesDir}";
+            };
+          })
          // (lib.optionalAttrs (cfg.containerdConfigTemplate != null) {
            ${containerdConfigTemplateFile} = {
              "L+".argument = "${pkgs.writeText "config.toml.tmpl" cfg.containerdConfigTemplate}";
--- a/nixos/modules/services/cluster/rancher/k3s.nix
+++ b/nixos/modules/services/cluster/rancher/k3s.nix
@@ -74,7 +74,7 @@ in
      '';
      description = ''
        List of derivations that provide container images.
-        All images are linked to {file}`${baseModule.paths.imageDir}` before k3s starts and are consequently imported
+        All images are linked into {file}`${baseModule.paths.imageDir}/nixos/` before k3s starts and are consequently imported
        by the k3s agent. Consider importing the k3s airgap images archive of the k3s package in
        use, if you want to pre-provision this node with all k3s container images. This option
        only makes sense on nodes with an enabled agent.
--- a/nixos/modules/services/cluster/rancher/rke2.nix
+++ b/nixos/modules/services/cluster/rancher/rke2.nix
@@ -72,7 +72,7 @@ in
      '';
      description = ''
        List of derivations that provide container images.
-        All images are linked to {file}`${baseModule.paths.imageDir}` before rke2 starts and are consequently imported
+        All images are linked into {file}`${baseModule.paths.imageDir}/nixos/` before rke2 starts and are consequently imported
        by the rke2 agent. Consider importing the rke2 core and CNI image archives of the rke2 package in
        use, if you want to pre-provision this node with all rke2 container images. For a full list of available airgap images, check the
        [source](https://github.com/NixOS/nixpkgs/blob/c8a1939887ee6e5f5aae29ce97321c0d83165f7d/pkgs/applications/networking/cluster/rke2/1_32/images-versions.json).
--- a/nixos/modules/services/misc/pghero.nix
+++ b/nixos/modules/services/misc/pghero.nix
@@ -1,159 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  utils,
-  ...
-}:
-let
-  cfg = config.services.pghero;
-  settingsFormat = pkgs.formats.yaml { };
-  settingsFile = settingsFormat.generate "pghero.yaml" cfg.settings;
-in
-{
-  options.services.pghero = {
-    enable = lib.mkEnableOption "PgHero service";
-    package = lib.mkPackageOption pkgs "pghero" { };
-
-    listenAddress = lib.mkOption {
-      type = lib.types.str;
-      example = "[::1]:3000";
-      description = ''
-        `hostname:port` to listen for HTTP traffic.
-
-        This is bound using the systemd socket activation.
-      '';
-    };
-
-    extraArgs = lib.mkOption {
-      type = lib.types.listOf lib.types.str;
-      default = [ ];
-      description = ''
-        Additional command-line arguments for the systemd service.
-
-        Refer to the [Puma web server documentation] for available arguments.
-
-        [Puma web server documentation]: https://puma.io/puma#configuration
-      '';
-    };
-
-    settings = lib.mkOption {
-      type = settingsFormat.type;
-      default = { };
-      example = {
-        databases = {
-          primary = {
-            url = "<%= ENV['PRIMARY_DATABASE_URL'] %>";
-          };
-        };
-      };
-      description = ''
-        PgHero configuration. Refer to the [PgHero documentation] for more
-        details.
-
-        [PgHero documentation]: https://github.com/ankane/pghero/blob/master/guides/Linux.md#multiple-databases
-      '';
-    };
-
-    environment = lib.mkOption {
-      type = lib.types.attrsOf lib.types.str;
-      default = { };
-      description = ''
-        Environment variables to set for the service. Secrets should be
-        specified using {option}`environmentFile`.
-      '';
-    };
-
-    environmentFiles = lib.mkOption {
-      type = lib.types.listOf lib.types.path;
-      default = [ ];
-      description = ''
-        File to load environment variables from. Loaded variables override
-        values set in {option}`environment`.
-      '';
-    };
-
-    extraGroups = lib.mkOption {
-      type = lib.types.listOf lib.types.str;
-      default = [ ];
-      example = [ "tlskeys" ];
-      description = ''
-        Additional groups for the systemd service.
-      '';
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    systemd.sockets.pghero = {
-      unitConfig.Description = "PgHero HTTP socket";
-      wantedBy = [ "sockets.target" ];
-      listenStreams = [ cfg.listenAddress ];
-    };
-
-    systemd.services.pghero = {
-      description = "PgHero performance dashboard for PostgreSQL";
-      wantedBy = [ "multi-user.target" ];
-      requires = [ "pghero.socket" ];
-      after = [
-        "pghero.socket"
-        "network.target"
-      ];
-
-      environment = {
-        RAILS_ENV = "production";
-        PGHERO_CONFIG_PATH = settingsFile;
-      }
-      // cfg.environment;
-
-      serviceConfig = {
-        Type = "notify";
-        WatchdogSec = "10";
-
-        ExecStart = utils.escapeSystemdExecArgs (
-          [
-            (lib.getExe cfg.package)
-            "--bind-to-activated-sockets"
-            "only"
-          ]
-          ++ cfg.extraArgs
-        );
-        Restart = "always";
-
-        WorkingDirectory = "${cfg.package}/share/pghero";
-
-        EnvironmentFile = cfg.environmentFiles;
-        SupplementaryGroups = cfg.extraGroups;
-
-        DynamicUser = true;
-        UMask = "0077";
-
-        ProtectHome = true;
-        ProtectProc = "invisible";
-        ProcSubset = "pid";
-        ProtectClock = true;
-        ProtectHostname = true;
-        ProtectControlGroups = true;
-        ProtectKernelLogs = true;
-        ProtectKernelModules = true;
-        ProtectKernelTunables = true;
-        PrivateUsers = true;
-        PrivateDevices = true;
-        RestrictRealtime = true;
-        RestrictNamespaces = true;
-        RestrictAddressFamilies = [
-          "AF_INET"
-          "AF_INET6"
-          "AF_UNIX"
-        ];
-        DeviceAllow = [ "" ];
-        DevicePolicy = "closed";
-        CapabilityBoundingSet = [ "" ];
-        MemoryDenyWriteExecute = true;
-        LockPersonality = true;
-        SystemCallArchitectures = "native";
-        SystemCallErrorNumber = "EPERM";
-        SystemCallFilter = [ "@system-service" ];
-      };
-    };
-  };
-}
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -1462,7 +1462,6 @@ in
  pgadmin4 = runTest ./pgadmin4.nix;
  pgbackrest = import ./pgbackrest { inherit runTest; };
  pgbouncer = runTest ./pgbouncer.nix;
-  pghero = runTest ./pghero.nix;
  pgmanage = runTest ./pgmanage.nix;
  pgweb = runTest ./pgweb.nix;
  phosh = runTest ./phosh.nix;
--- a/nixos/tests/lomiri.nix
+++ b/nixos/tests/lomiri.nix
@@ -88,6 +88,7 @@ let

  sharedTestFunctions = lib: ''
    from collections.abc import Callable
+    import datetime
    import tempfile
    import subprocess

@@ -140,7 +141,7 @@ let
      with machine.nested("Waiting for the screen to have terminalTextColor {} on it:".format(terminalTextColor)):
        retry(check_for_color(terminalTextColor))
      with machine.nested("Ensuring terminalTextColor {} stays present on the screen:".format(terminalTextColor)):
-        retry(fn=check_for_color_continued_presence(terminalTextColor), timeout_seconds=5)
+        retry(fn=check_for_color_continued_presence(terminalTextColor), timeout=datetime.timedelta(seconds=5))

    def change_tty_back_forth(ttynumMain: int, ttynumDiff: int) -> None:
      """
@@ -148,9 +149,9 @@ let
      """

      machine.send_key(f"ctrl-alt-f{ttynumDiff}")
-      machine.sleep(10)
+      machine.sleep(datetime.timedelta(seconds=10))
      machine.send_key(f"ctrl-alt-f{ttynumMain}")
-      machine.sleep(10)
+      machine.sleep(datetime.timedelta(seconds=10))

    def ensure_greeter_launched() -> None:
      """
@@ -189,7 +190,7 @@ let
      with machine.nested("Waiting for the screen to have launcherColor {} on it:".format(launcherColor)):
        retry(check_for_color(launcherColor))
      with machine.nested("Ensuring launcherColor {} stays present on the screen:".format(launcherColor)):
-        retry(fn=check_for_color_continued_presence(launcherColor), timeout_seconds=30)
+        retry(fn=check_for_color_continued_presence(launcherColor), timeout=datetime.timedelta(seconds=30))

      # Display "hangs" since qtmir bump? Not sure why. Switch to a different tty and back, and ensure that launcher button is still shown
      change_tty_back_forth(ttynumMain, ttynumDiff)
@@ -198,7 +199,7 @@ let

      # First input seems to get dropped while Mir registers the new input device. Send a key that does nothing, to get that out of the way, and sleep a tiny bit for registration to finish.
      machine.send_key("left")
-      machine.sleep(3)
+      machine.sleep(datetime.timedelta(seconds=3))

      machine.screenshot("lomiri_launched")

@@ -207,7 +208,7 @@ let
      Wait for on-screen text, and try to optimise retry count for slow hardware.
      """

-      machine.sleep(30)
+      machine.sleep(datetime.timedelta(seconds=30))
      machine.wait_for_text(text)

    def toggle_maximise() -> None:
@@ -220,9 +221,9 @@ let
      # For some reason, Lomiri in these VM tests very frequently opens the starter menu a few seconds after sending the above.
      # Because this isn't 100% reproducible all the time, and there is no command to await when OCR doesn't pick up some text,
      # the best we can do is send some Escape input after waiting some arbitrary time and hope that it works out fine.
-      machine.sleep(5)
+      machine.sleep(datetime.timedelta(seconds=5))
      machine.send_key("esc")
-      machine.sleep(5)
+      machine.sleep(datetime.timedelta(seconds=5))

    def mouse_click(xpos, ypos) -> None:
      """
@@ -231,11 +232,11 @@ let

      # Move
      machine.execute(f"ydotool mousemove --absolute -- {xpos} {ypos}")
-      machine.sleep(2)
+      machine.sleep(datetime.timedelta(seconds=2))

      # Click (C0 - left button: down & up)
      machine.execute("ydotool click 0xC0")
-      machine.sleep(2)
+      machine.sleep(datetime.timedelta(seconds=2))

    def open_starter() -> None:
      """
@@ -672,10 +673,10 @@ in
                  machine.send_chars("run0 touch /tmp/polkit-test\n")
                  # There's an authentication notification here that gains focus, but we struggle with OCRing it
                  # Just hope that it's up after a short wait
-                  machine.sleep(10)
+                  machine.sleep(datetime.timedelta(seconds=10))
                  machine.screenshot("polkit_agent")
                  machine.send_chars("${password}")
-                  machine.sleep(2) # Hopefully enough delay to make sure all the password characters have been registered? Maybe just placebo
+                  machine.sleep(datetime.timedelta(seconds=2)) # Hopefully enough delay to make sure all the password characters have been registered? Maybe just placebo
                  machine.send_chars("\n")
                  machine.wait_for_file("/tmp/polkit-test", 10)

@@ -732,7 +733,7 @@ in
              machine.send_key("tab")
              machine.send_key("ret")

-              machine.sleep(2) # sleep a tiny bit so gallery can close & the focus can return to LSS
+              machine.sleep(datetime.timedelta(seconds=2)) # sleep a tiny bit so gallery can close & the focus can return to LSS
              machine.send_key("alt-f4")
        '';
    }
@@ -824,9 +825,9 @@ in
                machine.wait_for_console_text('SET KEYMAP "us"')

                # Handle keybind fallout
-                machine.sleep(10) # wait for everything to settle
+                machine.sleep(datetime.timedelta(seconds=10)) # wait for everything to settle
                machine.send_key("esc") # close launcher in case it was opened
-                machine.sleep(2) # wait for animation to finish
+                machine.sleep(datetime.timedelta(seconds=2)) # wait for animation to finish
                # Make sure input leaks are gone
                machine.send_key("backspace")
                machine.send_key("backspace")
--- a/nixos/tests/pghero.nix
+++ b/nixos/tests/pghero.nix
@@ -1,68 +0,0 @@
-let
-  pgheroPort = 1337;
-  pgheroUser = "pghero";
-  pgheroPass = "pghero";
-in
-{ lib, ... }:
-{
-  name = "pghero";
-  meta.maintainers = [ lib.maintainers.tie ];
-
-  nodes.machine =
-    { config, ... }:
-    {
-      services.postgresql = {
-        enable = true;
-        # This test uses default peer authentication (socket and its directory is
-        # world-readably by default), so we essentially test that we can connect
-        # with DynamicUser= set.
-        ensureUsers = [
-          {
-            name = "pghero";
-            ensureClauses.superuser = true;
-          }
-        ];
-      };
-      services.pghero = {
-        enable = true;
-        listenAddress = "[::]:${toString pgheroPort}";
-        settings = {
-          databases = {
-            postgres.url = "<%= ENV['POSTGRES_DATABASE_URL'] %>";
-            nulldb.url = "nulldb:///";
-          };
-        };
-        environment = {
-          PGHERO_USERNAME = pgheroUser;
-          PGHERO_PASSWORD = pgheroPass;
-          POSTGRES_DATABASE_URL = "postgresql:///postgres?host=/run/postgresql";
-        };
-      };
-    };
-
-  testScript = ''
-    pgheroPort = ${toString pgheroPort}
-    pgheroUser = "${pgheroUser}"
-    pgheroPass = "${pgheroPass}"
-
-    pgheroUnauthorizedURL = f"http://localhost:{pgheroPort}"
-    pgheroBaseURL = f"http://{pgheroUser}:{pgheroPass}@localhost:{pgheroPort}"
-
-    def expect_http_code(node, code, url):
-        http_code = node.succeed(f"curl -s -o /dev/null -w '%{{http_code}}' '{url}'")
-        assert http_code.split("\n")[-1].strip() == code, \
-          f"expected HTTP status code {code} but got {http_code}"
-
-    machine.wait_for_unit("postgresql.target")
-    machine.wait_for_unit("pghero.service")
-
-    with subtest("requires HTTP Basic Auth credentials"):
-      expect_http_code(machine, "401", pgheroUnauthorizedURL)
-
-    with subtest("works with some databases being unavailable"):
-      expect_http_code(machine, "500", pgheroBaseURL + "/nulldb")
-
-    with subtest("connects to the PostgreSQL database"):
-      expect_http_code(machine, "200", pgheroBaseURL + "/postgres")
-  '';
-}
--- a/nixos/tests/rancher/default.nix
+++ b/nixos/tests/rancher/default.nix
@@ -99,6 +99,7 @@ let
      auto-deploy = mkTests ./auto-deploy.nix;
      configuration = mkTests ./configuration.nix;
      etcd = mkTests ./etcd.nix;
+      image-upgrade = mkTests ./image-upgrade.nix;
      multi-node = mkTests ./multi-node.nix;
      single-node = mkTests ./single-node.nix;
    };
--- a/nixos/tests/rancher/image-upgrade.nix
+++ b/nixos/tests/rancher/image-upgrade.nix
@@ -0,0 +1,118 @@
+# Tests that a container image whose contents change (same name and tag)
+# is detected and re-imported by the cluster.
+# It only declares the image change (via a NixOS specialisation) and checks
+# the end result (the pod output); it never inspects how the image is linked.
+{
+  pkgs,
+  lib,
+  rancherDistro,
+  rancherPackage,
+  serviceName,
+  disabledComponents,
+  coreImages,
+  vmResources,
+  ...
+}:
+let
+  containerdSocket =
+    {
+      k3s = "/run/k3s/containerd/containerd.sock";
+      rke2 = "/run/rke2/containerd/containerd.sock";
+    }
+    .${rancherDistro};
+
+  # Build a Docker image with a fixed name but an auto-generated tag based on
+  # the derivation hash. Two derivations with different contents produce
+  # different tags, so the cluster treats them as distinct images.
+  mkTestImage =
+    commandOutput:
+    pkgs.dockerTools.buildImage {
+      name = "test.local/test";
+      compressor = "zstd";
+      copyToRoot = pkgs.busybox;
+      config = {
+        Entrypoint = [ "sh" ];
+        Cmd = [
+          "-c"
+          "echo '${commandOutput}'"
+        ];
+      };
+    };
+
+  testImageV1 = mkTestImage "image v1 deployed";
+  testImageV2 = mkTestImage "image v2 deployed";
+in
+{
+  name = "${rancherPackage.name}-image-upgrade";
+  interactive.sshBackdoor.enable = true;
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      imports = [ ../../modules/profiles/base.nix ];
+
+      environment.systemPackages = with pkgs; [
+        kubectl
+        cri-tools
+      ];
+      environment.sessionVariables.KUBECONFIG = "/etc/rancher/${rancherDistro}/${rancherDistro}.yaml";
+
+      virtualisation = vmResources;
+
+      services.${rancherDistro} = {
+        enable = true;
+        role = "server";
+        package = rancherPackage;
+        disable =
+          {
+            k3s = lib.remove "traefik" disabledComponents;
+            rke2 = lib.remove "rke2-ingress-nginx" disabledComponents;
+          }
+          .${rancherDistro};
+        images =
+          coreImages ++ lib.optional (rancherDistro == "k3s") rancherPackage.airgap-images ++ [ testImageV1 ];
+      };
+
+      # A declaration that swaps the image for one with the same name but a
+      # different auto-generated tag and different contents. Switching to this
+      # specialisation is the only thing the test does to trigger a re-import.
+      specialisation.image-v2 = {
+        inheritParentConfig = true;
+        configuration =
+          { lib, ... }:
+          {
+            services.${rancherDistro}.images = lib.mkForce (
+              coreImages ++ lib.optional (rancherDistro == "k3s") rancherPackage.airgap-images ++ [ testImageV2 ]
+            );
+          };
+      };
+    };
+
+  testScript =
+    { nodes, ... }:
+    ''
+      def switch_to_v2():
+          toplevel = "${nodes.machine.system.build.toplevel}"
+          machine.succeed(f"{toplevel}/specialisation/image-v2/bin/switch-to-configuration switch")
+
+      machine.wait_for_unit("${serviceName}")
+
+      with subtest("v1 image is imported and runs"):
+          machine.wait_until_succeeds("crictl -r ${containerdSocket} img | grep 'test\\.local/test'")
+          machine.wait_until_succeeds("kubectl get sa default")
+          machine.succeed("kubectl create job test-job --image=${testImageV1.imageName}:${testImageV1.imageTag}")
+          machine.wait_until_succeeds("kubectl wait --for=condition=complete job/test-job --timeout=180s")
+          v1_output = machine.succeed("kubectl logs -l batch.kubernetes.io/job-name=test-job --tail=-1").rstrip()
+          t.assertEqual(v1_output, "image v1 deployed", f"unexpected v1 output: {v1_output!r}")
+
+      with subtest("Same-name image with different auto-generated tag is re-imported"):
+          machine.succeed("kubectl delete job test-job --ignore-not-found=true")
+          switch_to_v2()
+          machine.succeed("kubectl create job test-job --image=${testImageV2.imageName}:${testImageV2.imageTag}")
+          machine.wait_until_succeeds("kubectl wait --for=condition=complete job/test-job --timeout=240s")
+          v2_output = machine.succeed("kubectl logs -l batch.kubernetes.io/job-name=test-job --tail=-1").rstrip()
+          t.assertEqual(v2_output, "image v2 deployed", f"unexpected v2 output: {v2_output!r}")
+    '';
+
+  meta.maintainers = lib.teams.k3s.members ++ pkgs.rke2.meta.maintainers;
+}
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -1391,8 +1391,8 @@ let
        mktplcRef = {
          name = "competitive-programming-helper";
          publisher = "DivyanshuAgrawal";
-          version = "2026.8.1785865132";
-          hash = "sha256-/JVuIOoTgeENtbvYFri1/RtiZ6PCabOrwC1mzHoaML4=";
+          version = "2026.9.1789051951";
+          hash = "sha256-Et8v+Yl51tKTGoKx8rOMW3VscFkfIKwwqcLyw9fmI90=";
        };
        meta = {
          changelog = "https://marketplace.visualstudio.com/items/DivyanshuAgrawal.competitive-programming-helper/changelog";
--- a/pkgs/applications/editors/vscode/extensions/quarto.quarto/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/quarto.quarto/default.nix
@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
  mktplcRef = {
    name = "quarto";
    publisher = "quarto";
-    version = "1.137.0";
-    hash = "sha256-huXW4duf8MbilHPlYMyMPxMd+s0Gv9BejE20PxcYsjo=";
+    version = "1.138.0";
+    hash = "sha256-xwqs28ihgYnk7lPLjGQGwnG7ig2HLT9ZyCg1jiHpmR8=";
  };
  meta = {
    changelog = "https://marketplace.visualstudio.com/items/quarto.quarto/changelog";
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -598,13 +598,13 @@
    "vendorHash": "sha256-EikYOTTTkj5E82xza6nYvd1AWFg8fzo1ka2umc+25/k="
  },
  "hashicorp_google-beta": {
-    "hash": "sha256-S1fCXg59/+f/QH181Ii8Z4kjYP+qsDYCMiTYYF6J810=",
+    "hash": "sha256-EvcjgQupjAPKkbPObTTXNUsyyo7Udwc6rriD4/K7UhE=",
    "homepage": "https://registry.terraform.io/providers/hashicorp/google-beta",
    "owner": "hashicorp",
    "repo": "terraform-provider-google-beta",
-    "rev": "v8.1.0",
+    "rev": "v8.3.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-zskGz3bL89H3df4QmwX2JXhHv2K34nHxOLiExeZ7lUY="
+    "vendorHash": "sha256-t3lzDRh0v6vMbw8qLXTOjKNUtaBlXOZkqNO+mJyP9NQ="
  },
  "hashicorp_helm": {
    "hash": "sha256-O3QcQf+TBmSB/mY5wybk/8BUG5RTjLhJYU+9jOOUqBI=",
@@ -851,11 +851,11 @@
    "vendorHash": "sha256-BFhxDYfbHNY4omovikg01UDqt2oxCtg9Q85DPuHSUeE="
  },
  "launchdarkly_launchdarkly": {
-    "hash": "sha256-bcZ2DGQMCRR5fLn0ixuSk1ghw7xT4GGgEjcqx6zwri8=",
+    "hash": "sha256-DVpsm3adZEwWzgvIFu8pXUGVTch18oW4UdXPQ8XZZb0=",
    "homepage": "https://registry.terraform.io/providers/launchdarkly/launchdarkly",
    "owner": "launchdarkly",
    "repo": "terraform-provider-launchdarkly",
-    "rev": "v3.1.4",
+    "rev": "v3.1.5",
    "spdx": "MPL-2.0",
    "vendorHash": "sha256-d8RQfuLRNGTUzA2Ygy3QEis5j5Ape5kmcnZSs77c84M="
  },
--- a/pkgs/by-name/al/alsa-tools/package.nix
+++ b/pkgs/by-name/al/alsa-tools/package.nix
@@ -15,6 +15,9 @@ stdenv.mkDerivation (finalAttrs: {
  pname = "alsa-tools";
  version = "1.2.15";

+  strictDeps = true;
+  __structuredAttrs = true;
+
  src = fetchurl {
    url = "mirror://alsa/tools/alsa-tools-${finalAttrs.version}.tar.bz2";
    hash = "sha256-gASY01IzZy72f0v3TMbh034f5wwFQOLS4GLyMZ57Xfc=";
@@ -23,11 +26,11 @@ stdenv.mkDerivation (finalAttrs: {
  nativeBuildInputs = [
    makeWrapper
    pkg-config
+    fltk_1_3
  ];

  buildInputs = [
    alsa-lib
-    fltk_1_3
    gtk3
    gtk4
    psmisc
--- a/pkgs/by-name/an/anda/package.nix
+++ b/pkgs/by-name/an/anda/package.nix
@@ -11,16 +11,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "anda";
-  version = "0.8.9";
+  version = "0.8.10";

  src = fetchFromGitHub {
    owner = "FyraLabs";
    repo = "anda";
    tag = finalAttrs.version;
-    hash = "sha256-QPB5wLuvCf/bLkqZqsPkvfCeOmiHUtxzbIa3lWMjWoo=";
+    hash = "sha256-Uch/QFHmqgxtv1tDwBK5lEPYGf8fS1h3hcKzSNITFHg=";
  };

-  cargoHash = "sha256-Qh4tVzMU7VI//+3AsK9r7+WlxBAGzG/QnBsvrMxgudM=";
+  cargoHash = "sha256-VaP4eAgg8cLMOX6b1a5/QTHF+K9a+jD+FmgUZScjFtI=";

  __structuredAttrs = true;

--- a/pkgs/by-name/au/ausaxs/cmake-no-fetchcontent.patch
+++ b/pkgs/by-name/au/ausaxs/cmake-no-fetchcontent.patch
@@ -1,36 +1,36 @@
 --- a/CMakeLists.txt
 +++ b/CMakeLists.txt
-@@ -110,7 +110,7 @@
- 	set(DLIB_USE_MKL_FFT OFF)
- 	set(DLIB_USE_FFMPEG OFF)
- 	set(CMAKE_CXX_STANDARD 17) # dlib must be compiled with C++17
-	FetchContent_MakeAvailable(dlib)
-+	add_subdirectory(dlib)
- 	set(CMAKE_CXX_STANDARD 20) # continue with C++20	
+@@ -75,7 +75,7 @@
+ 		set(DLIB_USE_MKL_FFT OFF)
+ 		set(DLIB_USE_FFMPEG OFF)
+ 		set(CMAKE_CXX_STANDARD 17) # dlib must be compiled with C++17
+-		FetchContent_MakeAvailable(dlib)
+		add_subdirectory(dlib)
+ 		set(CMAKE_CXX_STANDARD 20) # continue with C++20
+ 	endif()
 	add_compile_definitions("DLIB_AVAILABLE")
- endif()
-@@ -141,7 +141,6 @@
+@@ -106,7 +106,6 @@
 		thread_pool
 		GIT_REPOSITORY https://github.com/bshoshany/thread-pool
 	)
 -	FetchContent_MakeAvailable(thread_pool)
+ 	set(BS_THREAD_POOL_INCLUDE_DIR ${thread_pool_SOURCE_DIR}/include)
 endif()
 
- if(USE_SYSTEM_GCEM)
-@@ -151,7 +150,6 @@
+@@ -121,7 +120,6 @@
 		gcem
 		GIT_REPOSITORY https://github.com/klytje/gcem
 	)
 -	FetchContent_MakeAvailable(GCEM)
+ 	set(GCEM_INCLUDE_DIR ${gcem_SOURCE_DIR}/include)
 endif()
 
- set_property(
-@@ -160,7 +158,9 @@
+@@ -131,7 +129,9 @@
 )
 unset(compile_options)
 
-include_directories(${thread_pool_SOURCE_DIR}/include ${gcem_SOURCE_DIR}/include ${backward_SOURCE_DIR})
-+include_directories(${backward_SOURCE_DIR})
+-include_directories(${BS_THREAD_POOL_INCLUDE_DIR} ${GCEM_INCLUDE_DIR} ${BACKWARD_INCLUDE_DIR})
+include_directories(${BACKWARD_INCLUDE_DIR})
 +add_subdirectory(gcem)
 +include_directories(thread_pool/include gcem/include)
 
--- a/pkgs/by-name/au/ausaxs/package.nix
+++ b/pkgs/by-name/au/ausaxs/package.nix
@@ -68,13 +68,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "ausaxs";
-  version = "1.2.8";
+  version = "1.3.0";

  src = fetchFromGitHub {
    owner = "AUSAXS";
    repo = "AUSAXS";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-elzkFzLyECiDuA8TokA8/wUYBZisKY1IRxQmikMn2f4=";
+    hash = "sha256-H3lozYImLNwQ7FYz3idgBX/o3miSyUxdZ+ZlJQP2Xms=";
  };

  patches = [ ./cmake-no-fetchcontent.patch ];
--- a/pkgs/by-name/av/avbroot/package.nix
+++ b/pkgs/by-name/av/avbroot/package.nix
@@ -10,16 +10,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "avbroot";
-  version = "3.34.0";
+  version = "3.34.1";

  src = fetchFromGitHub {
    owner = "chenxiaolong";
    repo = "avbroot";
    tag = "v${version}";
-    hash = "sha256-uukbK8RANF708tawY8k6u5RPqqt4XXv0joRD2vLVZ0Q=";
+    hash = "sha256-iw06eQOSbWQBIBqmmQ/07stGLIDv41odD3yf7ODoLBU=";
  };

-  cargoHash = "sha256-Az4w1JNJsbl/vs+lpVcrXg4Yu1Cg2Lc50/X4Kqg/M1Q=";
+  cargoHash = "sha256-63fmeZMazvSRjXqdO0l+go98DIWER60U3bDSp9jc+kQ=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/by-name/be/beads/package.nix
+++ b/pkgs/by-name/be/beads/package.nix
@@ -15,16 +15,16 @@

 buildGoModule (finalAttrs: {
  pname = "beads";
-  version = "1.2.2";
+  version = "1.3.0";

  src = fetchFromGitHub {
    owner = "gastownhall";
    repo = "beads";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-HSZ1z4WaHQDPomW6nNs8iUnld36BuHnOVaODD5mxY00=";
+    hash = "sha256-QryUnK04c9Wm9/VgWoaOJW9M2HoZVZzSDMSMBtjKiyc=";
  };

-  vendorHash = "sha256-WWEwGpCwMPD7jaz02zN745RQQqYTQttehbcT3J9hayM=";
+  vendorHash = "sha256-DFS9dSZX3v3q3Yk6+bfnoEN1uIULs2h8t/P9W2tk6l8=";

  subPackages = [ "cmd/bd" ];

--- a/pkgs/by-name/bi/bichon/package.nix
+++ b/pkgs/by-name/bi/bichon/package.nix
@@ -3,7 +3,7 @@
  fetchFromGitHub,
  rustPlatform,
  fetchPnpmDeps,
-  pnpm,
+  pnpm_11,
  pnpmConfigHook,
  nodejs,
  openssl,
@@ -11,6 +11,9 @@
  versionCheckHook,
  nix-update-script,
 }:
+let
+  pnpm = pnpm_11;
+in
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "bichon";
  version = "2.0.3";
@@ -27,6 +30,7 @@ rustPlatform.buildRustPackage (finalAttrs: {

  pnpmDeps = fetchPnpmDeps {
    inherit (finalAttrs) pname version src;
+    inherit pnpm;
    sourceRoot = "${finalAttrs.src.name}/web";
    fetcherVersion = 4;
    hash = "sha256-Ax8z1sjt8v6XOenhw7eRuEEo0huPv9fbcfzqc8RxJEc=";
--- a/pkgs/by-name/bi/bisq2/package.nix
+++ b/pkgs/by-name/bi/bisq2/package.nix
@@ -26,7 +26,7 @@
 }:

 let
-  version = "2.1.12";
+  version = "2.1.13";

  jdk = zulu25.override { enableJavaFX = true; };

@@ -77,7 +77,7 @@ stdenv.mkDerivation (finalAttrs: {
  # nixpkgs-update: no auto update
  src = fetchurl {
    url = "https://github.com/bisq-network/bisq2/releases/download/v${version}/Bisq-${version}.deb";
-    hash = "sha256-oLNvCc52lkp/efh7ehnV/0JjkY5+oKv0A2Dj0xtBK7Y=";
+    hash = "sha256-B708w9aC5ERXCE1QnIMPkvl8clJbhyKW7+GC7Fdkyno=";

    # Verify the upstream Debian package prior to extraction.
    # See https://bisq.wiki/Bisq_2#Installation
@@ -102,7 +102,7 @@ stdenv.mkDerivation (finalAttrs: {

  signature = fetchurl {
    url = "https://github.com/bisq-network/bisq2/releases/download/v${version}/Bisq-${version}.deb.asc";
-    hash = "sha256-dydNfzk8EMUPGP9W6GI5H0iZA+SCP9PHw+RbWCmMlTM=";
+    hash = "sha256-8FQ/HVWYENCbqtG4MD40QF6eQp3iUyqPNfZkRMAUc2A=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/bl/blender/package.nix
+++ b/pkgs/by-name/bl/blender/package.nix
@@ -119,12 +119,12 @@ in

 stdenv'.mkDerivation (finalAttrs: {
  pname = "blender";
-  version = "5.2.1";
+  version = "5.2.2";

  src = fetchzip {
    name = "source";
    url = "https://download.blender.org/source/blender-${finalAttrs.version}.tar.xz";
-    hash = "sha256-LXdJZDJoO9/yjkxn6qT42jv0YRpiwCiIWWGKubs3VLI=";
+    hash = "sha256-r4XT6ZoVwMXieauP5jOC0DdfNOilTmkGu8JPMAFjuDs=";
  };

  patches = [
--- a/pkgs/by-name/br/brlcad/package.nix
+++ b/pkgs/by-name/br/brlcad/package.nix
@@ -29,7 +29,7 @@
  qt6,
  stepcode,
  tcl,
-  tinygltf,
+  tinygltf_2,
  tk,
  zlib,

@@ -187,12 +187,21 @@ stdenv.mkDerivation (finalAttrs: {
        build/bext/tktable/tktable/CMake/FindTCL.cmake \
        build/bext/tkhtml/tkhtml/CMake/FindTCL.cmake
    ''
-    # remove a failing test
+    # remove failing tests
    + lib.optionalString stdenv.hostPlatform.isAarch64 ''
      substituteInPlace src/libbu/tests/CMakeLists.txt \
        --replace-fail \
          "brlcad_add_test(NAME bu_color_to_rgb_floats_1 COMMAND bu_test test_color 4 192,78,214)" \
          ""
+    ''
+    # This test opens 16k mapped files from every CPU, each open being a linear scan
+    # under one global semaphore, so its runtime explodes on many-core machines and
+    # blows past ctest's 1500s default timeout on our 80-core aarch64 builders.
+    + lib.optionalString stdenv.hostPlatform.isAarch64 ''
+      substituteInPlace src/libbu/tests/CMakeLists.txt \
+        --replace-fail \
+          "brlcad_add_test(NAME bu_mappedfile_parallel_16384 COMMAND bu_test test_mappedfile 2 16384)" \
+          ""
    '';

  nativeBuildInputs = [
@@ -224,7 +233,7 @@ stdenv.mkDerivation (finalAttrs: {
    pugixml
    stepcode
    tcl
-    tinygltf
+    tinygltf_2
    tk
    zlib
  ]
--- a/pkgs/by-name/ch/chezmoi/package.nix
+++ b/pkgs/by-name/ch/chezmoi/package.nix
@@ -8,16 +8,16 @@

 buildGoModule (finalAttrs: {
  pname = "chezmoi";
-  version = "2.72.1";
+  version = "2.72.2";

  src = fetchFromGitHub {
    owner = "twpayne";
    repo = "chezmoi";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-L476KnX6L/Q36kS3rLr2FfE7dgcVda1pQqh0+GIU12E=";
+    hash = "sha256-Ne64WoPZ+pICSG78jI63NjxaR9cTveFQFlA42VOHxzw=";
  };

-  vendorHash = "sha256-LGWpCF29WDTNO/U3m07sVxxwePfAqkgYiENfJyjL39Q=";
+  vendorHash = "sha256-xp5wzXAEF6qaxdCU2NGlD36ltGsTnxlfrneBAtTN+g4=";

  nativeBuildInputs = [
    installShellFiles
--- a/pkgs/by-name/co/coroot-node-agent/package.nix
+++ b/pkgs/by-name/co/coroot-node-agent/package.nix
@@ -7,13 +7,13 @@

 buildGoModule (finalAttrs: {
  pname = "coroot-node-agent";
-  version = "1.35.8";
+  version = "1.35.10";

  src = fetchFromGitHub {
    owner = "coroot";
    repo = "coroot-node-agent";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-JRivRViw3FJfHU6beGfH9bhGwYE9ODMi4BRNJylf+ak=";
+    hash = "sha256-J55PuBQHvprl5cIYy0vYa5meNohbNQu386M3vRGzQbg=";
  };

  vendorHash = "sha256-KZ+CkBJSx/4PjemMycyEuOHGg6hatsGirQWoYnfFyKo=";
--- a/pkgs/by-name/co/coroot/package.nix
+++ b/pkgs/by-name/co/coroot/package.nix
@@ -11,13 +11,13 @@

 buildGoModule (finalAttrs: {
  pname = "coroot";
-  version = "1.26.1";
+  version = "1.26.3";

  src = fetchFromGitHub {
    owner = "coroot";
    repo = "coroot";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-BN76EkYw8YIz+BRio1GPzO071EAkum3QIqrsmgmG5kk=";
+    hash = "sha256-FRrtfbDS1qygHZp6tP7VnNob4V3IMJ9acG1HM27uxPY=";
  };

  vendorHash = "sha256-qKqfPRmp9hdlug9O90R5zRgslHOANcxGBoEzFipf7+w=";
--- a/pkgs/by-name/d-/d-seams/cxxopts-cstdint.patch
+++ b/pkgs/by-name/d-/d-seams/cxxopts-cstdint.patch
@@ -1,11 +0,0 @@
-diff --git a/src/include/external/cxxopts.hpp b/src/include/external/cxxopts.hpp
--- a/src/include/external/cxxopts.hpp
-+++ b/src/include/external/cxxopts.hpp
-@@ -26,6 +26,7 @@ THE SOFTWARE.
- #define CXXOPTS_HPP_INCLUDED
-
- #include <cctype>
-+#include <cstdint>
- #include <cstring>
- #include <exception>
- #include <iostream>
--- a/pkgs/by-name/d-/d-seams/package.nix
+++ b/pkgs/by-name/d-/d-seams/package.nix
@@ -1,78 +1,57 @@
 {
-  clangStdenv,
-  fetchFromGitHub,
-  fetchpatch,
-  catch2,
-  rang,
-  fmt,
-  yaml-cpp,
-  cmake,
-  eigen,
-  lua,
-  luaPackages,
-  liblapack,
-  blas,
  lib,
-  boost,
-  gsl,
+  stdenv,
+  fetchFromGitHub,
+  meson,
+  ninja,
+  pkg-config,
+  eigen,
+  blas,
+  lapack,
+  catch2_3,
 }:

-clangStdenv.mkDerivation rec {
-  version = "1.0.1";
-  pname = "d-SEAMS";
-
-  strictDeps = false;
+stdenv.mkDerivation (finalAttrs: {
+  pname = "d-seams";
+  version = "2.10.0";

  src = fetchFromGitHub {
    owner = "d-SEAMS";
    repo = "seams-core";
-    rev = "v${version}";
-    sha256 = "03zhhl9vhi3rhc3qz1g3zb89jksgpdlrk15fcr8xcz8pkj6r5b1i";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-gtDD0Nc3pC+7eLtH8h+c7j1E9OSGwUWip+Nu0LTOEmw=";
  };

-  patches = [
-    (fetchpatch {
-      name = "use_newer_cxxopts_which_builds_with_clang11.patch";
-      url = "https://github.com/d-SEAMS/seams-core/commit/f6156057e43d0aa1a0df9de67d8859da9c30302d.patch";
-      hash = "sha256-PLbT1lqdw+69lIHH96MPcGRjfIeZyb88vc875QLYyqw=";
-    })
-    # Add missing <cstdint> include for uint8_t in vendored cxxopts.
-    ./cxxopts-cstdint.patch
-  ];
-  postPatch = ''
-    substituteInPlace CMakeLists.txt \
-      --replace-fail "cmake_minimum_required(VERSION 3.0 FATAL_ERROR)" "cmake_minimum_required(VERSION 3.10)"
-  '';
+  doCheck = true;
+  strictDeps = true;
+  __structuredAttrs = true;
+
  nativeBuildInputs = [
-    cmake
-    lua
-    luaPackages.luafilesystem
+    meson
+    ninja
+    pkg-config
  ];
+
  buildInputs = [
-    fmt
-    rang
-    yaml-cpp
    eigen
-    catch2
-    boost
-    gsl
-    liblapack
    blas
+    lapack
+    catch2_3
+  ];
+
+  mesonFlags = [
+    "-Dwith_gpulite=disabled"
+    "-Dwith_ira=disabled"
+    "-Dwith_sphericart=disabled"
+    "-Dwith_nauty=disabled"
  ];

  meta = {
    description = "Deferred Structural Elucidation Analysis for Molecular Simulations";
-    mainProgram = "yodaStruct";
-    longDescription = ''
-      d-SEAMS, is a free and open-source postprocessing engine for the analysis
-      of molecular dynamics trajectories, which is specifically able to
-      qualitatively classify ice structures in both strong-confinement and bulk
-      systems. The engine is in C++, with extensions via the Lua scripting
-      interface.
-    '';
    homepage = "https://dseams.info";
-    license = lib.licenses.gpl3Plus;
-    platforms = [ "x86_64-linux" ];
-    maintainers = [ ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ iedame ];
+    platforms = lib.platforms.linux;
+    mainProgram = "seams";
  };
-}
+})
--- a/pkgs/by-name/dn/dnscontrol/package.nix
+++ b/pkgs/by-name/dn/dnscontrol/package.nix
@@ -9,16 +9,16 @@

 buildGo127Module (finalAttrs: {
  pname = "dnscontrol";
-  version = "5.0.4";
+  version = "5.1.0";

  src = fetchFromGitHub {
    owner = "DNSControl";
    repo = "dnscontrol";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-ihcFAsIrNX3pK6TyWcHaaYlqWj8geJvtdNoDa0z3rnI=";
+    hash = "sha256-StdVGROKsXJa5F7CEno3T516lVJbXToBxLx6AqKz9+I=";
  };

-  vendorHash = "sha256-1MtLq6DWvjvTyLoOARju5ZlW/Q9J24L+Lcy0BdsW40k=";
+  vendorHash = "sha256-qIb/hUn/ROWBaSAnEleeLDWQlCvFapBwKcZjdHlNpF8=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/by-name/do/dorion/package.nix
+++ b/pkgs/by-name/do/dorion/package.nix
@@ -35,19 +35,19 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "dorion";
-  version = "6.13.0";
+  version = "6.13.1";

  src = fetchFromGitHub {
    owner = "SpikeHD";
    repo = "Dorion";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-3AQX1q3qpu/QKqigmCvLKQJzQpsTnYgwT+1VWA+gIz0=";
+    hash = "sha256-YyNDzxr+cHC3PL47mblhGH/syCUfxhVUB92rb1GsEbU=";
  };

  cargoRoot = "src-tauri";
  buildAndTestSubdir = finalAttrs.cargoRoot;

-  cargoHash = "sha256-p/mj3BL61HlLpN3nqNkVExu0mWaMawg9I2+dKeFUOJ8=";
+  cargoHash = "sha256-OsoDyaSCrun2hJHNhiqQ9wq1ydE9Zdx9bN9784aEYrw=";

  pnpmDeps = fetchPnpmDeps {
    inherit (finalAttrs) pname version src;
--- a/pkgs/by-name/ed/edhm-ui/package.nix
+++ b/pkgs/by-name/ed/edhm-ui/package.nix
@@ -113,7 +113,7 @@ stdenv.mkDerivation (finalAttrs: {
    description = "HUD modification manager for Elite Dangerous";
    homepage = "https://github.com/BlueMystical/EDHM_UI";
    license = [
-      lib.licenses.gpl3Only
+      lib.licenses.gpl3Plus
      {
        shortName = "edhm-custom";
        fullName = "EDHM Custom Restrictive License - Non-redistributable";
--- a/pkgs/by-name/es/esphome-device-builder/frontend.nix
+++ b/pkgs/by-name/es/esphome-device-builder/frontend.nix
@@ -4,12 +4,14 @@
  nodejs,
  fetchPnpmDeps,
  pnpmConfigHook,
-  pnpm,
+  pnpm_11,
  pyprojectVersionPatchHook,
  setuptools,
  meta,
 }:
-
+let
+  pnpm = pnpm_11;
+in
 buildPythonPackage (finalAttrs: {
  pname = "esphome-device-builder-frontend";
  version = "0.1.311";
--- a/pkgs/by-name/fa/faiss/package.nix
+++ b/pkgs/by-name/fa/faiss/package.nix
@@ -42,7 +42,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "faiss";
-  version = "1.15.0";
+  version = "1.15.1";

  __structuredAttrs = true;
  strictDeps = true;
@@ -53,7 +53,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "facebookresearch";
    repo = "faiss";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-cP13HRNa17KL5ZE6if8QmoyKQBLf8ckAa0bOaioEOgE=";
+    hash = "sha256-uqP/dygyFGUEXCIYpvUGWC35kPyn7ZsDkNTPU5hwxSk=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/fc/fcitx5-pinyin-moegirl/package.nix
+++ b/pkgs/by-name/fc/fcitx5-pinyin-moegirl/package.nix
@@ -6,11 +6,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "fcitx5-pinyin-moegirl";
-  version = "20260812";
+  version = "20260911";

  src = fetchurl {
    url = "https://github.com/outloudvi/mw2fcitx/releases/download/${finalAttrs.version}/moegirl.dict";
-    hash = "sha256-JN3PJAS2x2Fsvx2iQZ+K0MYOR4esHGHOsTVl+6dZZVE=";
+    hash = "sha256-FZGi1+t6RLQ7B068IFLsSkkvyyfrYy8hXBmP7MuYFtA=";
  };

  dontUnpack = true;
--- a/pkgs/by-name/fe/feh/package.nix
+++ b/pkgs/by-name/fe/feh/package.nix
@@ -18,13 +18,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "feh";
-  version = "3.12.4";
+  version = "3.13";

  src = fetchFromGitHub {
    owner = "derf";
    repo = "feh";
    rev = finalAttrs.version;
-    hash = "sha256-ri8Ij/i+mayPtM4rLNhwlt8DfcLeID911flQG/TPH0Q=";
+    hash = "sha256-J/BK/jno8RUPqq+Ty2vaMGZb7I+RK7lh8tyQaKB8q7k=";
  };

  outputs = [
--- a/pkgs/by-name/fl/fluux-messenger/package.nix
+++ b/pkgs/by-name/fl/fluux-messenger/package.nix
@@ -18,7 +18,7 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "fluux-messenger";
-  version = "0.17.3";
+  version = "0.17.4";
  __structuredAttrs = true;
  strictDeps = true;

@@ -27,18 +27,18 @@ rustPlatform.buildRustPackage (finalAttrs: {
    owner = "processone";
    repo = "fluux-messenger";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-RXu5eir1VhezblHCBsdJiZHjJyzxiqIUNs962lezdxE=";
+    hash = "sha256-HHXdWdKXf0qLKNJQEA1oPPpv4kxpfNuPH2uXEMo3DHg=";
  };

-  cargoRoot = "apps/fluux/src-tauri";
-  cargoHash = "sha256-EirsNTfAMm0xCrN5JKokbtCCdUBWBprs8OzOiHL1zq4=";
-
  npmDeps = fetchNpmDeps {
    name = "${finalAttrs.pname}-${finalAttrs.version}-npm-deps";
    inherit (finalAttrs) src;
-    hash = "sha256-/iwHjfsLB1c/QOo/I9oymDsYfhOfn7iJm0IhSIA4xNI=";
+    hash = "sha256-Gy1zXHsclHo0FNfZh8v0GLfSKel4boSAKBKIYxGfSW0=";
  };

+  cargoRoot = "apps/fluux/src-tauri";
+  cargoHash = "sha256-/Gx4fu9fBL8IEZqMP+ePpv5hvTwLrl2Nywf76g0d/Fw=";
+
  nativeBuildInputs = [
    cargo-tauri.hook
    nodejs
--- a/pkgs/by-name/fl/flycast/package.nix
+++ b/pkgs/by-name/fl/flycast/package.nix
@@ -55,7 +55,12 @@ stdenv.mkDerivation (finalAttrs: {
  ]
  ++ lib.optionals stdenv.hostPlatform.isDarwin [ moltenvk ];

-  postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
+  postPatch = ''
+    substituteInPlace core/version.h.in --replace-fail \
+      '@GIT_VERSION@' \
+      '${finalAttrs.version}'
+  ''
+  + lib.optionalString stdenv.hostPlatform.isDarwin ''
    substituteInPlace CMakeLists.txt \
      --replace-fail \
        '"$ENV{VULKAN_SDK}/lib/libMoltenVK.dylib"' \
--- a/pkgs/by-name/gi/gi-crystal/package.nix
+++ b/pkgs/by-name/gi/gi-crystal/package.nix
@@ -44,5 +44,6 @@ crystal.buildCrystalPackage rec {
    homepage = "https://github.com/hugopl/gi-crystal";
    mainProgram = "gi-crystal";
    maintainers = with lib.maintainers; [ sund3RRR ];
+    license = lib.licenses.bsd3;
  };
 }
--- a/pkgs/by-name/gi/github-desktop/package.nix
+++ b/pkgs/by-name/gi/github-desktop/package.nix
@@ -35,13 +35,13 @@ in

 stdenv.mkDerivation (finalAttrs: {
  pname = "github-desktop";
-  version = "3.6.5";
+  version = "3.6.6";

  src = fetchFromGitHub {
    owner = "desktop";
    repo = "desktop";
    tag = "release-${finalAttrs.version}";
-    hash = "sha256-oAv+hcIVxRtNdiP027IXyBOiL3LRQS8QZZtfenqU3Eo=";
+    hash = "sha256-qdfa8+v0JSdqiR7NhcQIany51Lv0l7v4MtLXUJY0o+4=";
    fetchSubmodules = true;
    postCheckout = "git -C $out rev-parse HEAD > $out/.gitrev";
  };
--- a/pkgs/by-name/gi/gitify/package.nix
+++ b/pkgs/by-name/gi/gitify/package.nix
@@ -5,8 +5,8 @@
  pnpm_11,
  fetchPnpmDeps,
  pnpmConfigHook,
-  nodejs,
-  electron_43,
+  nodejs_24,
+  electron_44,
  makeDesktopItem,
  copyDesktopItems,
  imagemagick,
@@ -16,17 +16,18 @@
 }:
 let
  pnpm = pnpm_11;
-  electron = electron_43;
+  nodejs = nodejs_24;
+  electron = electron_44;
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "gitify";
-  version = "7.7.0";
+  version = "7.8.0";

  src = fetchFromGitHub {
    owner = "gitify-app";
    repo = "gitify";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-GsRru4BPtvitWj6ewKQviYf1TKi+tLYM/PikKytTX9I=";
+    hash = "sha256-f/4EXNMtlh/8oHtKPtot3+fwlb7yx2tRtWcBSneImfI=";
  };

  nativeBuildInputs = [
@@ -46,7 +47,7 @@ stdenv.mkDerivation (finalAttrs: {
    inherit (finalAttrs) pname version src;
    inherit pnpm;
    fetcherVersion = 4;
-    hash = "sha256-EVZ6UgL5u4mGdsxPO3EB9u+spBt2z6Kp66hN/kjrzTc=";
+    hash = "sha256-E11bKKjN9axHkK8I1NVeetgPhl/1lqb79cPMBi5iDAc=";
  };

  env.ELECTRON_SKIP_BINARY_DOWNLOAD = 1;
--- a/pkgs/by-name/go/go-dnscollector/package.nix
+++ b/pkgs/by-name/go/go-dnscollector/package.nix
@@ -6,16 +6,16 @@

 buildGoModule (finalAttrs: {
  pname = "go-dnscollector";
-  version = "3.0.0";
+  version = "3.1.0";

  src = fetchFromGitHub {
    owner = "dmachard";
    repo = "DNS-collector";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-DUpNgnvCKTGU01Qh3L/foVUDHgXHICtOl6wFpNi1KaA=";
+    hash = "sha256-W0fCI/1aiSbKiFQ/DwNuc2+NSGs+QwN+Gv9OUu5rLOY=";
  };

-  vendorHash = "sha256-DRb/l8sXqugl8zh+QHO7a0KYF/JS4yDQ11L6MJPipd4=";
+  vendorHash = "sha256-6GMoyJy9HtuGjur1VwtgP3G9CXBKiJZlK/4YNPxhIgo=";

  subPackages = [ "." ];

--- a/pkgs/by-name/gr/graphify/package.nix
+++ b/pkgs/by-name/gr/graphify/package.nix
@@ -8,14 +8,14 @@
 python3Packages.buildPythonApplication rec {
  __structuredAttrs = true;
  pname = "graphify";
-  version = "0.9.53";
+  version = "0.9.61";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "Graphify-Labs";
    repo = "graphify";
    tag = "v${version}";
-    hash = "sha256-1G8PuSxYM70nMf8glJARA9vVMI8Ue7zqfAxgXi18lPM=";
+    hash = "sha256-9AEbHmqqZv/fBioUMNv60KAb/FpvWpwC6QhGSdBxISs=";
  };

  build-system = [
--- a/pkgs/by-name/ha/harlequin/package.nix
+++ b/pkgs/by-name/ha/harlequin/package.nix
@@ -13,7 +13,7 @@

 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "harlequin";
-  version = "2.14.0";
+  version = "2.15.0";
  pyproject = true;
  __structuredAttrs = true;

@@ -21,7 +21,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
    owner = "tconbeer";
    repo = "harlequin";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-sInr0zOw2efjbcr5+clzNodODCnzwVH36vOD+LJY0IM=";
+    hash = "sha256-lxLETZ8lL13D5qWDDUIXl0UBEq0RHz16V8JVO1qOggc=";
  };

  postPatch =
--- a/pkgs/by-name/i3/i3lock-fancy-rapid/package.nix
+++ b/pkgs/by-name/i3/i3lock-fancy-rapid/package.nix
@@ -8,7 +8,10 @@

 stdenv.mkDerivation {
  pname = "i3lock-fancy-rapid";
-  version = "unstable-2021-04-21";
+  version = "0-unstable-2021-04-21";
+
+  strictDeps = true;
+  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "yvbbrjdr";
--- a/pkgs/by-name/in/inav-blackbox-tools/package.nix
+++ b/pkgs/by-name/in/inav-blackbox-tools/package.nix
@@ -6,18 +6,32 @@
  cairo,
 }:

-stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
  pname = "inav-blackbox-tools";
-  version = "unstable-2021-04-22";
+  version = "9.0.0";
+
+  strictDeps = true;
+  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "iNavFlight";
    repo = "blackbox-tools";
-    rev = "0109e2fb9b44d593e60bca4cef4098d83c55c373";
-    sha256 = "1rdlw74dqq0hahnka2w2pgvs172vway2x6v8byxl2s773l22k4ln";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-DAHSYK/r4Cwgg1X/4HofDu1Z0+xxGHgWFtUcjMqhV5g=";
  };

-  nativeBuildInputs = [ pkg-config ];
+  postPatch = ''
+    substituteInPlace Makefile \
+      --replace-fail '$(shell git diff --shortstat)' '1'
+  '';
+
+  makeFlags = [
+    "BLACKBOX_COMMIT=1918a75"
+  ];
+
+  nativeBuildInputs = [
+    pkg-config
+  ];

  buildInputs = [ cairo ];

@@ -38,4 +52,4 @@ stdenv.mkDerivation {
    platforms = lib.platforms.all;
    broken = stdenv.hostPlatform.isDarwin; # never built on Hydra https://hydra.nixos.org/job/nixpkgs/trunk/inav-blackbox-tools.x86_64-darwin
  };
-}
+})
--- a/pkgs/by-name/je/jellyfin-ffmpeg/package.nix
+++ b/pkgs/by-name/je/jellyfin-ffmpeg/package.nix
@@ -5,7 +5,7 @@
 }:

 let
-  version = "8.1.2-4";
+  version = "8.1.2-5";
 in

 (ffmpeg_8-full.override {
@@ -14,7 +14,7 @@ in
    owner = "jellyfin";
    repo = "jellyfin-ffmpeg";
    tag = "v${version}";
-    hash = "sha256-+xUjwhVX/HyS/+Gmv8iQfUwHax7xjX3SSOjs34IDHHs=";
+    hash = "sha256-fU/w3Bh0hFidmbcNmA6KCxrmxlzf6Awh4Qlthyks9Aw=";
  };
  buildFfplay = false; # requires SDL2 which gets disabled
  buildFfprobe = true; # required by various programs like Immich
--- a/pkgs/by-name/ke/keycloak/package.nix
+++ b/pkgs/by-name/ke/keycloak/package.nix
@@ -24,11 +24,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "keycloak";
-  version = "26.7.3";
+  version = "26.7.4";

  src = fetchzip {
    url = "https://github.com/keycloak/keycloak/releases/download/${finalAttrs.version}/keycloak-${finalAttrs.version}.zip";
-    hash = "sha256-SmzyvfVPaaUSbyH7/+XjCzwsz+YT5m6rpnLKJULSR/4=";
+    hash = "sha256-Rk9ofYspK2L68tam9S+P198rh7ojZCDBXDYgKx1cSoo=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/lm/lmath/package.nix
+++ b/pkgs/by-name/lm/lmath/package.nix
@@ -7,10 +7,10 @@
 }:
 let
  pname = "lmath";
-  version = "1.11.1";
+  version = "1.11.2";
  src = fetchurl {
    url = "https://github.com/lehtoroni/lmath-issues/releases/download/v${version}/LMath_Linux_r${version}-release.AppImage";
-    hash = "sha256-GkEE+rrrCiX1gBDB7HpWZ2pYPA3YGVTt5zZdbw3u+S4=";
+    hash = "sha256-NHfNnBYxKXRk4IQonQTjYtIIk3apZs45BbWGIvLfl3w=";
  };

  appimageContents = appimageTools.extract {
--- a/pkgs/by-name/lo/logica/package.nix
+++ b/pkgs/by-name/lo/logica/package.nix
@@ -0,0 +1 @@
+{ python3Packages }: with python3Packages; toPythonApplication logica
--- a/pkgs/by-name/ma/matrix-authentication-service/package.nix
+++ b/pkgs/by-name/ma/matrix-authentication-service/package.nix
@@ -3,7 +3,7 @@
  rustPlatform,
  fetchFromGitHub,
  fetchPnpmDeps,
-  pnpm,
+  pnpm_11,
  pnpmConfigHook,
  nodejs,
  python3,
@@ -18,7 +18,9 @@
  buildPackages,
  nixosTests,
 }:
-
+let
+  pnpm = pnpm_11;
+in
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "matrix-authentication-service";
  version = "1.24.0";
@@ -34,6 +36,7 @@ rustPlatform.buildRustPackage (finalAttrs: {

  pnpmDeps = fetchPnpmDeps {
    inherit (finalAttrs) pname version src;
+    inherit pnpm;
    fetcherVersion = 4;
    hash = "sha256-DxEjMhYqZGbnobQ/F0WFXq7qaxSkWDcoZ0kmWJsdxEQ=";
  };
--- a/pkgs/by-name/me/meteor/package.nix
+++ b/pkgs/by-name/me/meteor/package.nix
@@ -11,18 +11,18 @@
 }:

 let
-  version = "3.4";
+  version = "3.5.2";

  inherit (stdenv.hostPlatform) system;

  srcs = {
    x86_64-linux = fetchurl {
      url = "https://static.meteor.com/packages-bootstrap/${version}/meteor-bootstrap-os.linux.x86_64.tar.gz";
-      hash = "sha256-tzzRN9UAH7+BM3fs76U5H20vD0LGMpdrMDDiJtchgEg=";
+      hash = "sha256-4YwcHrFmD9BU2ebeSHHt+LDMXTW1DnFHs8j1SltInAg=";
    };
    aarch64-darwin = fetchurl {
      url = "https://static.meteor.com/packages-bootstrap/${version}/meteor-bootstrap-os.osx.arm64.tar.gz";
-      hash = "sha256-AT7njZTgf/WTHlvLEbF3dXKNoqyqHy8KloBQ4gsbPuM=";
+      hash = "sha256-5utHDLdIaNQlnWg/gH4IZc1kBctnsu8KJYkRa/9NTSM=";
    };
  };
 in
@@ -123,6 +123,7 @@ stdenv.mkDerivation {
  passthru.updateScript = ./update.sh;

  meta = {
+    changelog = "https://github.com/meteor/meteor/releases/tag/release%2FMETEOR%40${version}";
    description = "Complete open source platform for building web and mobile apps in pure JavaScript";
    homepage = "https://www.meteor.com/";
    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
--- a/pkgs/by-name/me/meteor/update.sh
+++ b/pkgs/by-name/me/meteor/update.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p bash common-updater-scripts curl nix-update
+#!nix-shell -i bash -p bash common-updater-scripts curl jq nix-update

 releaseInfo=$(curl https://install.meteor.com)
 latestVersion=$(grep <<<"$releaseInfo" -oP 'RELEASE="\K[^"]+')
@@ -13,6 +13,8 @@ if [[ "$latestVersion" == "$currentVersion" ]]; then
   exit 0
 fi

+update-source-version meteor $latestVersion
+
 systems=$(nix eval --json -f . meteor.meta.platforms | jq --raw-output '.[]')
 for system in $systems; do
  hash=$(nix --extra-experimental-features nix-command hash convert --to sri --hash-algo sha256 $(nix-prefetch-url $(nix eval --raw -f . meteor.src.url --system "$system")))
--- a/pkgs/by-name/mi/mistral-vibe/package.nix
+++ b/pkgs/by-name/mi/mistral-vibe/package.nix
@@ -151,6 +151,9 @@ python3Packages.buildPythonApplication (finalAttrs: {
  versionCheckKeepEnvironment = [ "HOME" ];

  disabledTests = [
+    # The finite stdio input closes before all responses are flushed in the sandbox.
+    "test_stdio_server_uses_the_same_json_rpc_lifecycle"
+
    # AssertionError: assert <MCPSourceStatus.UNAVAILABLE: 'unavailable'> is <MCPSourceStatus.ENABLED: 'enabled'>
    "test_mcp_catalog_read_refresh_toggle_remove_and_compatibility_aliases"

@@ -159,9 +162,6 @@ python3Packages.buildPythonApplication (finalAttrs: {
    "test_aclose_terminates_real_subprocess"
    "test_persists_real_subprocess_state_across_calls"

-    # AssertionError: assert '32:2617357:1782120467963161870:7' != '32:2617357:1782120467963161870:7'
-    "test_changes_when_file_changes"
-
    # vibe.core.llm.exceptions.BackendError: LLM backend error [mock-provider]
    # reason: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Missing Authority Key Identifier (_ssl.c:1032)
    "test_generic_backend_streaming_uses_ssl_cert_file"
@@ -188,10 +188,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
  ];

  disabledTestPaths = [
-    # This tests the install_script and fails. This is not relevant for nixpkgs.
-    "tests/test_install_script.py"
-
-    # All snapshot tests fail with AssertionError
+    # All snapshot tests use syrupy 4.8.0, which is not packaged here.
    "tests/snapshots/"

    # These tests invoke uv run and fail to import the packaged pydantic extension.
--- a/pkgs/by-name/mu/multica-cli/package.nix
+++ b/pkgs/by-name/mu/multica-cli/package.nix
@@ -3,10 +3,12 @@
  buildGoModule,
  fetchFromGitHub,
  installShellFiles,
+  versionCheckHook,
 }:

-buildGoModule rec {
+buildGoModule (finalAttrs: {
  __structuredAttrs = true;
+  __darwinAllowLocalNetworking = true;

  pname = "multica-cli";
  version = "0.4.43";
@@ -14,11 +16,11 @@ buildGoModule rec {
  src = fetchFromGitHub {
    owner = "multica-ai";
    repo = "multica";
-    rev = "v${version}";
+    tag = "v${finalAttrs.version}";
    hash = "sha256-M/Zc9Bc/IKK2Dwc9TbNGz3OCDARmQQOXRTLPYw9iLZs=";
  };

-  sourceRoot = "${src.name}/server";
+  sourceRoot = "${finalAttrs.src.name}/server";

  vendorHash = "sha256-a3khoppmpS5o+ZJqWjcFwLKpUSXfTG9P5/4lLdBr+tY=";

@@ -28,8 +30,7 @@ buildGoModule rec {

  ldflags = [
    "-s"
-    "-w"
-    "-X main.version=${version}"
+    "-X main.version=${finalAttrs.version}"
    "-X main.commit=nixpkg"
    "-X main.date=1970-01-01T00:00:00Z"
  ];
@@ -43,12 +44,15 @@ buildGoModule rec {
      --fish <($out/bin/multica completion fish)
  '';

+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+
  meta = {
    description = "CLI for the Multica managed agents platform";
    homepage = "https://github.com/multica-ai/multica";
-    changelog = "https://github.com/multica-ai/multica/releases/tag/v${version}";
+    changelog = "https://github.com/multica-ai/multica/releases/tag/v${finalAttrs.version}";
    license = lib.licenses.asl20;
    maintainers = with lib.maintainers; [ akosseres ];
    mainProgram = "multica";
  };
-}
+})
--- a/pkgs/by-name/mu/murmure/package.nix
+++ b/pkgs/by-name/mu/murmure/package.nix
@@ -13,7 +13,7 @@
  cargo-tauri,
  nodejs,
  pkg-config,
-  pnpm,
+  pnpm_11,
  pnpmConfigHook,

  # buildInputs
@@ -38,6 +38,8 @@
 }:

 let
+  pnpm = pnpm_11;
+
  parakeet-model = fetchzip {
    url = "https://github.com/Kieirra/murmure-model/releases/download/1.0.0/parakeet-tdt-0.6b-v3-int8.zip";
    hash = "sha256-rlV7mi5Y6qu/9jRWRPNBlABW8GxsvVAMCM6Ye2tVb2s=";
@@ -70,6 +72,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
      version
      src
      ;
+    inherit pnpm;
    fetcherVersion = 4;
    hash = "sha256-ixBGVKYAk1FYcAayvKKJMT5v3JLjSK17ds0mrBEj850=";
  };
--- a/pkgs/by-name/mu/musicfree-desktop/bump-deps.patch
+++ b/pkgs/by-name/mu/musicfree-desktop/bump-deps.patch
--- a/pkgs/by-name/mu/musicfree-desktop/package.nix
+++ b/pkgs/by-name/mu/musicfree-desktop/package.nix
@@ -7,7 +7,7 @@
  copyDesktopItems,
  makeWrapper,
  nix-update-script,
-  electron_41,
+  electron,
  python3,
  nodejs,
  vips,
@@ -16,9 +16,7 @@
  xcodebuild,
  zip,
 }:
-let
-  electron = electron_41;
-in
+
 buildNpmPackage (finalAttrs: {
  pname = "musicfree-desktop";
  version = "0.0.8";
@@ -60,7 +58,7 @@ buildNpmPackage (finalAttrs: {
  ]
  ++ lib.optionals stdenv.hostPlatform.isDarwin [ xcodebuild ]; # Used by better-sqlite3

-  npmDepsHash = "sha256-pEpU3JuxeMl0Oo/ZnmzH9/WdJ/3O2RUGofm7KXrKcAo=";
+  npmDepsHash = "sha256-8NI4aFL8D3SO71DnknjbkBqSEgNIhHrMSgFWn8Jesfs=";

  postConfigure = ''
    # use Electron's headers to make node-gyp compile against the Electron ABI
--- a/pkgs/by-name/n8/n8n-task-runner-launcher/package.nix
+++ b/pkgs/by-name/n8/n8n-task-runner-launcher/package.nix
@@ -6,16 +6,16 @@
 }:
 buildGoModule (finalAttrs: {
  pname = "n8n-task-runner-launcher";
-  version = "1.4.7";
+  version = "1.5.0";

  src = fetchFromGitHub {
    owner = "n8n-io";
    repo = "task-runner-launcher";
    tag = finalAttrs.version;
-    hash = "sha256-URIFMc/VSMuuI4Hi7jB9eFlP4/GjEvDRhoTAjEhT988=";
+    hash = "sha256-mAttwzQFzfth4UlxcpCbQsPw/ruOZXZuuW+JzVtzNlc=";
  };

-  vendorHash = "sha256-5dcIELsNFGB5qTmfpY/YRWeN2z9GdanysGw4Lqpfsi0=";
+  vendorHash = "sha256-bape7CPvVImmNdj5jso/BfHs17TDIfENTmCvMAT70Es=";

  postInstall = ''
    mv $out/bin/launcher $out/bin/n8n-task-runner-launcher
--- a/pkgs/by-name/ne/nest-cli/package.nix
+++ b/pkgs/by-name/ne/nest-cli/package.nix
@@ -9,16 +9,16 @@

 buildNpmPackage (finalAttrs: {
  pname = "nest-cli";
-  version = "12.0.0";
+  version = "12.0.3";

  src = fetchFromGitHub {
    owner = "nestjs";
    repo = "nest-cli";
    tag = finalAttrs.version;
-    hash = "sha256-jMdqq1vQAN9ftOIycldiRkGFqzuJha7rp/KtSmdruEQ=";
+    hash = "sha256-cy1fXc0ZUtIRlFRJfsK2Sols9CPQIJ39Kf+1wgIJH+Q=";
  };

-  npmDepsHash = "sha256-g7f4cNfYMD7v1bTeokYvAlupd9/v527Z8jLc4aUeqTE=";
+  npmDepsHash = "sha256-gyRquPh4lOicS73J9WkWZ1NTbDndaU4yYDgpiDqkKug=";
  npmFlags = [ "--legacy-peer-deps" ];

  env = {
--- a/pkgs/by-name/ne/netbox/plugins/netbox-peering-manager/package.nix
+++ b/pkgs/by-name/ne/netbox/plugins/netbox-peering-manager/package.nix
@@ -0,0 +1,57 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  httpx,
+  tenacity,
+  netbox,
+  python,
+}:
+let
+  inherit (netbox.plugins) netbox-routing;
+in
+buildPythonPackage (finalAttrs: {
+  pname = "netbox-peering-manager";
+  version = "0.3.1";
+  pyproject = true;
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "jsenecal";
+    repo = "netbox-peering-manager";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-+sgQo2ahFHNNfSK8MTT75BbFTgf4GqFRxF9DZtBu2yI=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    netbox-routing
+    tenacity
+    httpx
+  ];
+
+  pythonRelaxDeps = [ "netbox-routing" ];
+
+  nativeCheckInputs = [ netbox ];
+
+  preFixup = ''
+    export PYTHONPATH=${netbox}/opt/netbox/netbox:$PYTHONPATH
+  '';
+
+  dontUsePythonImportsCheck = python.pythonVersion != netbox.python.pythonVersion;
+
+  pythonImportsCheck = [ "netbox_peering_manager" ];
+
+  passthru.pluginName = "netbox_peering_manager";
+
+  meta = {
+    description = "NetBox plugin for BGP Peering and related objects documentation";
+    homepage = "https://jsenecal.github.io/netbox-peering-manager/";
+    changelog = "https://github.com/jsenecal/netbox-peering-manager/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ felbinger ];
+    platforms = lib.platforms.linux;
+  };
+})
--- a/pkgs/by-name/no/nocturne/package.nix
+++ b/pkgs/by-name/no/nocturne/package.nix
@@ -33,13 +33,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "nocturne";
-  version = "1.5.1";
+  version = "1.5.2";

  src = fetchFromGitHub {
    owner = "Jeffser";
    repo = "Nocturne";
    tag = finalAttrs.version;
-    hash = "sha256-83RvrMFUmBUmeObz2u+ScNrT8hb9y02xxWiFqYGnAEU=";
+    hash = "sha256-wFLsbBXbKo6z0DGxv427Vi8WkQiIE9k49ftIsVZYq5c=";
  };

  __structuredAttrs = true;
--- a/pkgs/by-name/np/npb/package.nix
+++ b/pkgs/by-name/np/npb/package.nix
@@ -24,7 +24,7 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "npb";
-  version = "1.1.0";
+  version = "1.1.3";

  __structuredAttrs = true;
  strictDeps = true;
@@ -33,10 +33,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
    owner = "samestep";
    repo = "npb";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-CL8jRHuJtXFcSh+r8DBtSz9s5xZzU4jwlZygGHeBR6I=";
+    hash = "sha256-8GsMAmwRGTZ9ZvDXfPmVDoOCSHJuQd/1EwIP7hmTDGo=";
  };

-  cargoHash = "sha256-LxWhP6NM+lUsUf13x5troFx0k5QHDz2tHOs/3vLGY48=";
+  cargoHash = "sha256-apnM5aLI0bXp86yvTgkUL6LnHHCEDeVD9ltovmsQ0ak=";

  nativeBuildInputs = lib.optional buildCanExecuteHost installShellFiles;

--- a/pkgs/by-name/nt/ntpsec/package.nix
+++ b/pkgs/by-name/nt/ntpsec/package.nix
@@ -0,0 +1,125 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  asciidoctor,
+  bison,
+  directoryListingUpdater,
+  iana-etc,
+  libcap,
+  libseccomp,
+  openssl,
+  pkg-config,
+  pps-tools,
+  python3,
+  versionCheckHook,
+  wafHook,
+  withDocs ? true,
+  withSeccomp ? stdenv.hostPlatform.isLinux,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "ntpsec";
+  version = "1.2.5";
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  src = fetchurl {
+    url = "https://ftp.ntpsec.org/pub/releases/ntpsec-${finalAttrs.version}.tar.gz";
+    hash = "sha256-b7GRzdr2B+d1Sx9pFaGmHcQBiz5O7z0v+s7JYcloKUk=";
+  };
+
+  outputs = [
+    "out"
+  ]
+  ++ lib.optionals withDocs [
+    "doc"
+    "man"
+  ];
+
+  nativeBuildInputs = [
+    bison
+    pkg-config
+    python3
+    python3.pkgs.wrapPython
+    wafHook
+  ]
+  ++ lib.optionals withDocs [ asciidoctor ];
+
+  buildInputs = [
+    libcap
+    openssl
+    pps-tools
+  ]
+  ++ lib.optionals withSeccomp [ libseccomp ];
+
+  wafConfigureFlags = [
+    "--pyshebang=${python3.interpreter}"
+    "--refclock=all"
+  ]
+  ++ (
+    if withDocs then
+      [
+        "--enable-doc"
+        "--enable-manpage"
+      ]
+    else
+      [
+        "--disable-doc"
+        "--disable-manpage"
+      ]
+  )
+  ++ lib.optionals withSeccomp [ "--enable-seccomp" ];
+
+  wafBuildFlags = [ "--notests" ];
+
+  wafInstallFlags = [ "--destdir=/" ];
+
+  postFixup = ''
+    wrapPythonPrograms
+  '';
+
+  doCheck = true;
+
+  nativeCheckInputs = [ iana-etc ];
+
+  checkPhase = ''
+    runHook preCheck
+
+    ./waf check
+
+    runHook postCheck
+  '';
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+
+  doInstallCheck = true;
+
+  passthru.updateScript = directoryListingUpdater { ignoredVersions = "-rc"; };
+
+  meta = {
+    description = "Secure, hardened, and improved implementation of Network Time Protocol";
+    homepage = "https://www.ntpsec.org/";
+    downloadPage = "https://ftp.ntpsec.org/pub/releases/";
+    changelog = "https://gitlab.com/NTPsec/ntpsec/-/blob/NTPsec_${
+      lib.replaceStrings [ "." ] [ "_" ] finalAttrs.version
+    }/NEWS.adoc";
+    license = with lib.licenses; [
+      asl20
+      beerware
+      bsd2
+      bsd3
+      bsdOriginal
+      cc-by-40
+      isc
+      mit
+      ntp
+    ];
+    maintainers = with lib.maintainers; [ liberodark ];
+    platforms = lib.platforms.linux;
+    mainProgram = "ntpd";
+  };
+})
--- a/pkgs/by-name/nu/nuclei-templates/package.nix
+++ b/pkgs/by-name/nu/nuclei-templates/package.nix
@@ -6,13 +6,13 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "nuclei-templates";
-  version = "10.4.8";
+  version = "10.4.9";

  src = fetchFromGitHub {
    owner = "projectdiscovery";
    repo = "nuclei-templates";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-9PkgU7k+Xy9Bj7pfKjgrIpHLoso0yV8vqPbScVIYUJ0=";
+    hash = "sha256-4nqQegY7/C7aSgyHvQCpySWbZPqKkRoiqVulO9po5H4=";
  };

  installPhase = ''
--- a/pkgs/by-name/nv/nvs/package.nix
+++ b/pkgs/by-name/nv/nvs/package.nix
@@ -9,16 +9,16 @@
 }:
 buildGoModule (finalAttrs: {
  pname = "nvs";
-  version = "1.14.1";
+  version = "1.15.0";

  src = fetchFromGitHub {
    owner = "y3owk1n";
    repo = "nvs";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Mz5ScSWC0vAavWS2ZKn58b+k4IxlMLxhaxI1B9v76jg=";
+    hash = "sha256-8koivXbheErauqlquLeEo+7/Iz4HkblblzBY/nojCUg=";
  };

-  vendorHash = "sha256-KQVszK0LLMvi+5aWUVmTTGdUsqJrTWRLe2meb2qV2G0=";
+  vendorHash = "sha256-PGwT0PKzBKNbeUilU8GEPEBgaYvR6k5JZ8StXMzjv7M=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/ov/ovhcloud-cli/package.nix
+++ b/pkgs/by-name/ov/ovhcloud-cli/package.nix
@@ -8,13 +8,13 @@

 buildGo126Module (finalAttrs: {
  pname = "ovhcloud-cli";
-  version = "0.14.0";
+  version = "0.15.0";

  src = fetchFromGitHub {
    owner = "ovh";
    repo = "ovhcloud-cli";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-34mN+jxxo7T7gIQmDlFho9gOpjMxlh0oDa/+J1xJRz4=";
+    hash = "sha256-XP2wvmPj5LzyMSofC8Wz3Q7pXXXz3U+7/1m+39nQHjI=";
  };

  vendorHash = "sha256-x5tYdKFBznd1jnFgHlDojD8aSuWWCi0CY4YoOpwvNz4=";
--- a/pkgs/by-name/pa/passff-host/package.nix
+++ b/pkgs/by-name/pa/passff-host/package.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation (finalAttrs: {
  makeFlags = [ "VERSION=${finalAttrs.version}" ];

  postPatch = ''
-    sed -i 's#COMMAND = "pass"#COMMAND = "${pass}/bin/pass"#' src/passff.py
+    sed -i 's#COMMAND = "pass"#COMMAND = "${lib.getExe pass}"#' src/passff.py
  '';

  installPhase = ''
--- a/pkgs/by-name/pa/patch2pr/package.nix
+++ b/pkgs/by-name/pa/patch2pr/package.nix
@@ -8,16 +8,16 @@

 buildGoModule (finalAttrs: {
  pname = "patch2pr";
-  version = "0.47.0";
+  version = "0.48.0";

  src = fetchFromGitHub {
    owner = "bluekeyes";
    repo = "patch2pr";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-+f7GhaRzSaFR/vFsbaizqKVcaIz6fAjFhVopnjvqblI=";
+    hash = "sha256-qncP6Ug/5dNKw6B/yGrS/zRCaKOnw38Rld/s9giu7gQ=";
  };

-  vendorHash = "sha256-EpJdG8Xy2077zjqgwae5Fr89y7MQYYNOfAjuZxS0wjA=";
+  vendorHash = "sha256-sSjvqW+4KoHP9jSTJxYk0DeJ0VQNQIKaXyYYE4haQoA=";

  ldflags = [
    "-X main.version=${finalAttrs.version}"
--- a/pkgs/by-name/pg/pghero/Gemfile
+++ b/pkgs/by-name/pg/pghero/Gemfile
@@ -1,14 +0,0 @@
-source "https://rubygems.org"
-
-gem "rails", "~> 7.0.0"
-gem "propshaft"
-gem "puma"
-gem "pg"
-gem "activerecord-nulldb-adapter", require: false
-
-# See also https://github.com/ankane/pghero/blob/v3.3.4/guides/Rails.md
-gem "pghero"
-gem "pg_query"
-gem "aws-sdk-cloudwatch"
-gem "google-apis-monitoring_v3"
-gem "azure_mgmt_monitor"
--- a/pkgs/by-name/pg/pghero/Gemfile.lock
+++ b/pkgs/by-name/pg/pghero/Gemfile.lock
@@ -1,278 +0,0 @@
-GEM
-  remote: https://rubygems.org/
-  specs:
-    actioncable (7.0.8.6)
-      actionpack (= 7.0.8.6)
-      activesupport (= 7.0.8.6)
-      nio4r (~> 2.0)
-      websocket-driver (>= 0.6.1)
-    actionmailbox (7.0.8.6)
-      actionpack (= 7.0.8.6)
-      activejob (= 7.0.8.6)
-      activerecord (= 7.0.8.6)
-      activestorage (= 7.0.8.6)
-      activesupport (= 7.0.8.6)
-      mail (>= 2.7.1)
-      net-imap
-      net-pop
-      net-smtp
-    actionmailer (7.0.8.6)
-      actionpack (= 7.0.8.6)
-      actionview (= 7.0.8.6)
-      activejob (= 7.0.8.6)
-      activesupport (= 7.0.8.6)
-      mail (~> 2.5, >= 2.5.4)
-      net-imap
-      net-pop
-      net-smtp
-      rails-dom-testing (~> 2.0)
-    actionpack (7.0.8.6)
-      actionview (= 7.0.8.6)
-      activesupport (= 7.0.8.6)
-      rack (~> 2.0, >= 2.2.4)
-      rack-test (>= 0.6.3)
-      rails-dom-testing (~> 2.0)
-      rails-html-sanitizer (~> 1.0, >= 1.2.0)
-    actiontext (7.0.8.6)
-      actionpack (= 7.0.8.6)
-      activerecord (= 7.0.8.6)
-      activestorage (= 7.0.8.6)
-      activesupport (= 7.0.8.6)
-      globalid (>= 0.6.0)
-      nokogiri (>= 1.8.5)
-    actionview (7.0.8.6)
-      activesupport (= 7.0.8.6)
-      builder (~> 3.1)
-      erubi (~> 1.4)
-      rails-dom-testing (~> 2.0)
-      rails-html-sanitizer (~> 1.1, >= 1.2.0)
-    activejob (7.0.8.6)
-      activesupport (= 7.0.8.6)
-      globalid (>= 0.3.6)
-    activemodel (7.0.8.6)
-      activesupport (= 7.0.8.6)
-    activerecord (7.0.8.6)
-      activemodel (= 7.0.8.6)
-      activesupport (= 7.0.8.6)
-    activerecord-nulldb-adapter (1.0.1)
-      activerecord (>= 5.2.0, < 7.2)
-    activestorage (7.0.8.6)
-      actionpack (= 7.0.8.6)
-      activejob (= 7.0.8.6)
-      activerecord (= 7.0.8.6)
-      activesupport (= 7.0.8.6)
-      marcel (~> 1.0)
-      mini_mime (>= 1.1.0)
-    activesupport (7.0.8.6)
-      concurrent-ruby (~> 1.0, >= 1.0.2)
-      i18n (>= 1.6, < 2)
-      minitest (>= 5.1)
-      tzinfo (~> 2.0)
-    addressable (2.8.7)
-      public_suffix (>= 2.0.2, < 7.0)
-    aws-eventstream (1.3.0)
-    aws-partitions (1.999.0)
-    aws-sdk-cloudwatch (1.104.0)
-      aws-sdk-core (~> 3, >= 3.210.0)
-      aws-sigv4 (~> 1.5)
-    aws-sdk-core (3.211.0)
-      aws-eventstream (~> 1, >= 1.3.0)
-      aws-partitions (~> 1, >= 1.992.0)
-      aws-sigv4 (~> 1.9)
-      jmespath (~> 1, >= 1.6.1)
-    aws-sigv4 (1.10.1)
-      aws-eventstream (~> 1, >= 1.0.2)
-    azure_mgmt_monitor (0.19.0)
-      ms_rest_azure (~> 0.12.0)
-    base64 (0.2.0)
-    bigdecimal (3.1.8)
-    builder (3.3.0)
-    concurrent-ruby (1.3.4)
-    crass (1.0.6)
-    date (3.3.4)
-    declarative (0.0.20)
-    domain_name (0.6.20240107)
-    erubi (1.13.0)
-    faraday (1.10.4)
-      faraday-em_http (~> 1.0)
-      faraday-em_synchrony (~> 1.0)
-      faraday-excon (~> 1.1)
-      faraday-httpclient (~> 1.0)
-      faraday-multipart (~> 1.0)
-      faraday-net_http (~> 1.0)
-      faraday-net_http_persistent (~> 1.0)
-      faraday-patron (~> 1.0)
-      faraday-rack (~> 1.0)
-      faraday-retry (~> 1.0)
-      ruby2_keywords (>= 0.0.4)
-    faraday-cookie_jar (0.0.7)
-      faraday (>= 0.8.0)
-      http-cookie (~> 1.0.0)
-    faraday-em_http (1.0.0)
-    faraday-em_synchrony (1.0.0)
-    faraday-excon (1.1.0)
-    faraday-httpclient (1.0.1)
-    faraday-multipart (1.0.4)
-      multipart-post (~> 2)
-    faraday-net_http (1.0.2)
-    faraday-net_http_persistent (1.2.0)
-    faraday-patron (1.0.0)
-    faraday-rack (1.0.0)
-    faraday-retry (1.0.3)
-    globalid (1.2.1)
-      activesupport (>= 6.1)
-    google-apis-core (0.15.1)
-      addressable (~> 2.5, >= 2.5.1)
-      googleauth (~> 1.9)
-      httpclient (>= 2.8.3, < 3.a)
-      mini_mime (~> 1.0)
-      mutex_m
-      representable (~> 3.0)
-      retriable (>= 2.0, < 4.a)
-    google-apis-monitoring_v3 (0.71.0)
-      google-apis-core (>= 0.15.0, < 2.a)
-    google-cloud-env (2.2.1)
-      faraday (>= 1.0, < 3.a)
-    google-protobuf (4.28.3)
-      bigdecimal
-      rake (>= 13)
-    googleauth (1.11.2)
-      faraday (>= 1.0, < 3.a)
-      google-cloud-env (~> 2.1)
-      jwt (>= 1.4, < 3.0)
-      multi_json (~> 1.11)
-      os (>= 0.9, < 2.0)
-      signet (>= 0.16, < 2.a)
-    http-cookie (1.0.7)
-      domain_name (~> 0.5)
-    httpclient (2.8.3)
-    i18n (1.14.6)
-      concurrent-ruby (~> 1.0)
-    jmespath (1.6.2)
-    jwt (2.9.3)
-      base64
-    loofah (2.23.1)
-      crass (~> 1.0.2)
-      nokogiri (>= 1.12.0)
-    mail (2.8.1)
-      mini_mime (>= 0.1.1)
-      net-imap
-      net-pop
-      net-smtp
-    marcel (1.0.4)
-    method_source (1.1.0)
-    mini_mime (1.1.5)
-    mini_portile2 (2.8.7)
-    minitest (5.25.1)
-    ms_rest (0.7.6)
-      concurrent-ruby (~> 1.0)
-      faraday (>= 0.9, < 2.0.0)
-      timeliness (~> 0.3.10)
-    ms_rest_azure (0.12.0)
-      concurrent-ruby (~> 1.0)
-      faraday (>= 0.9, < 2.0.0)
-      faraday-cookie_jar (~> 0.0.6)
-      ms_rest (~> 0.7.6)
-    multi_json (1.15.0)
-    multipart-post (2.4.1)
-    mutex_m (0.2.0)
-    net-imap (0.5.0)
-      date
-      net-protocol
-    net-pop (0.1.2)
-      net-protocol
-    net-protocol (0.2.2)
-      timeout
-    net-smtp (0.5.0)
-      net-protocol
-    nio4r (2.7.4)
-    nokogiri (1.16.7)
-      mini_portile2 (~> 2.8.2)
-      racc (~> 1.4)
-    os (1.1.4)
-    pg (1.5.9)
-    pg_query (5.1.0)
-      google-protobuf (>= 3.22.3)
-    pghero (3.6.1)
-      activerecord (>= 6.1)
-    propshaft (1.1.0)
-      actionpack (>= 7.0.0)
-      activesupport (>= 7.0.0)
-      rack
-      railties (>= 7.0.0)
-    public_suffix (6.0.1)
-    puma (6.4.3)
-      nio4r (~> 2.0)
-    racc (1.8.1)
-    rack (2.2.10)
-    rack-test (2.1.0)
-      rack (>= 1.3)
-    rails (7.0.8.6)
-      actioncable (= 7.0.8.6)
-      actionmailbox (= 7.0.8.6)
-      actionmailer (= 7.0.8.6)
-      actionpack (= 7.0.8.6)
-      actiontext (= 7.0.8.6)
-      actionview (= 7.0.8.6)
-      activejob (= 7.0.8.6)
-      activemodel (= 7.0.8.6)
-      activerecord (= 7.0.8.6)
-      activestorage (= 7.0.8.6)
-      activesupport (= 7.0.8.6)
-      bundler (>= 1.15.0)
-      railties (= 7.0.8.6)
-    rails-dom-testing (2.2.0)
-      activesupport (>= 5.0.0)
-      minitest
-      nokogiri (>= 1.6)
-    rails-html-sanitizer (1.6.0)
-      loofah (~> 2.21)
-      nokogiri (~> 1.14)
-    railties (7.0.8.6)
-      actionpack (= 7.0.8.6)
-      activesupport (= 7.0.8.6)
-      method_source
-      rake (>= 12.2)
-      thor (~> 1.0)
-      zeitwerk (~> 2.5)
-    rake (13.2.1)
-    representable (3.2.0)
-      declarative (< 0.1.0)
-      trailblazer-option (>= 0.1.1, < 0.2.0)
-      uber (< 0.2.0)
-    retriable (3.1.2)
-    ruby2_keywords (0.0.5)
-    signet (0.19.0)
-      addressable (~> 2.8)
-      faraday (>= 0.17.5, < 3.a)
-      jwt (>= 1.5, < 3.0)
-      multi_json (~> 1.10)
-    thor (1.3.2)
-    timeliness (0.3.10)
-    timeout (0.4.1)
-    trailblazer-option (0.1.2)
-    tzinfo (2.0.6)
-      concurrent-ruby (~> 1.0)
-    uber (0.1.0)
-    websocket-driver (0.7.6)
-      websocket-extensions (>= 0.1.0)
-    websocket-extensions (0.1.5)
-    zeitwerk (2.7.1)
-
-PLATFORMS
-  ruby
-
-DEPENDENCIES
-  activerecord-nulldb-adapter
-  aws-sdk-cloudwatch
-  azure_mgmt_monitor
-  google-apis-monitoring_v3
-  pg
-  pg_query
-  pghero
-  propshaft
-  puma
-  rails (~> 7.0.0)
-
-BUNDLED WITH
-   2.5.16
--- a/pkgs/by-name/pg/pghero/gemset.nix
+++ b/pkgs/by-name/pg/pghero/gemset.nix
--- a/pkgs/by-name/pg/pghero/package.nix
+++ b/pkgs/by-name/pg/pghero/package.nix
@@ -1,81 +0,0 @@
-{
-  lib,
-  stdenv,
-  bundlerEnv,
-  buildPackages,
-  fetchFromGitHub,
-  makeBinaryWrapper,
-  nixosTests,
-  callPackage,
-}:
-stdenv.mkDerivation (
-  finalAttrs:
-  let
-    # Use bundlerEnvArgs from passthru to allow overriding bundlerEnv arguments.
-    rubyEnv = bundlerEnv finalAttrs.passthru.bundlerEnvArgs;
-    # We also need a separate nativeRubyEnv to precompile assets on the build
-    # host. If possible, reuse existing rubyEnv derivation.
-    nativeRubyEnv =
-      if stdenv.buildPlatform.canExecute stdenv.hostPlatform then
-        rubyEnv
-      else
-        buildPackages.bundlerEnv finalAttrs.passthru.bundlerEnvArgs;
-
-    bundlerEnvArgs = {
-      name = "${finalAttrs.pname}-${finalAttrs.version}-gems";
-      gemdir = ./.;
-    };
-  in
-  {
-    pname = "pghero";
-    version = "3.6.1";
-
-    src = fetchFromGitHub {
-      owner = "pghero";
-      repo = "pghero";
-      rev = "v${finalAttrs.version}";
-      hash = "sha256-kABdQRwV5Y/jB9P8kYVmwmntOK0CF/JJYmaINNv26fA=";
-    };
-
-    strictDeps = true;
-    nativeBuildInputs = [
-      nativeRubyEnv
-      makeBinaryWrapper
-    ];
-
-    inherit rubyEnv;
-
-    buildPhase = ''
-      runHook preBuild
-      DATABASE_URL=nulldb:/// RAILS_ENV=production rake assets:precompile
-      runHook postBuild
-    '';
-
-    installPhase = ''
-      runHook preInstall
-      mkdir -p -- "$out"/{share,bin}
-      cp -a -- . "$out"/share/pghero
-      makeWrapper "$rubyEnv"/bin/puma "$out"/bin/pghero \
-        --add-flags -C \
-        --add-flags config/puma.rb \
-        --chdir "$out"/share/pghero
-      runHook postInstall
-    '';
-
-    passthru = {
-      inherit bundlerEnvArgs;
-      updateScript = callPackage ./update.nix { };
-      tests = {
-        inherit (nixosTests) pghero;
-      };
-    };
-
-    meta = {
-      homepage = "https://github.com/ankane/pghero";
-      description = "Performance dashboard for Postgres";
-      mainProgram = "pghero";
-      license = lib.licenses.mit;
-      maintainers = [ lib.maintainers.tie ];
-    };
-  }
-)
--- a/pkgs/by-name/pg/pghero/update.nix
+++ b/pkgs/by-name/pg/pghero/update.nix
@@ -1,62 +0,0 @@
-{
-  lib,
-  writeShellScript,
-  git,
-  nix,
-  bundler,
-  bundix,
-  coreutils,
-  common-updater-scripts,
-}:
-writeShellScript "update-script" ''
-  set -eu
-  PATH=${
-    lib.makeBinPath [
-      git
-      nix
-      bundler
-      bundix
-      coreutils
-      common-updater-scripts
-    ]
-  }
-  nix() {
-    command nix --extra-experimental-features nix-command "$@"
-  }
-  bundle() {
-    BUNDLE_FORCE_RUBY_PLATFORM=1 command bundle "$@"
-  }
-
-  attrPath=''${UPDATE_NIX_ATTR_PATH:-pghero}
-
-  toplevel=$(git rev-parse --show-toplevel)
-  position=$(nix eval --file "$toplevel" --raw "$attrPath.meta.position")
-  gemdir=$(dirname "$position")
-
-  cd "$gemdir"
-
-  tempdir=$(mktemp -d)
-  cleanup() {
-    rc=$?
-    rm -r -- "$tempdir" || true
-    exit $rc
-  }
-  trap cleanup EXIT
-
-  cp gemset.nix "$tempdir"
-
-  bundle lock --update --lockfile="$tempdir"/Gemfile.lock
-  bundix --lockfile="$tempdir"/Gemfile.lock --gemset="$tempdir"/gemset.nix
-
-  oldVersion=''${UPDATE_NIX_OLD_VERSION-}
-  newVersion=$(nix eval --file "$tempdir"/gemset.nix --raw pghero.version)
-
-  if [ "$oldVersion" = "$newVersion" ]; then
-    exit
-  fi
-
-  cp "$tempdir"/{Gemfile.lock,gemset.nix} .
-
-  cd "$toplevel"
-  update-source-version "$attrPath" "$newVersion" --file="$gemdir"/package.nix --ignore-same-hash
-''
--- a/pkgs/by-name/pi/pioneer/package.nix
+++ b/pkgs/by-name/pi/pioneer/package.nix
@@ -16,28 +16,22 @@
  libx11,
  lua5_2,
  libgbm,
+  openal-soft,
  SDL2,
  SDL2_image,
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "pioneer";
-  version = "20260203";
+  version = "20260907";

  src = fetchFromGitHub {
    owner = "pioneerspacesim";
    repo = "pioneer";
    rev = finalAttrs.version;
-    hash = "sha256-rffm5i8yHy8WXij8PGbBegA6uJ5B3ACpT7Wf9cWHfs4=";
+    hash = "sha256-2r8D2TbbxCiBN6CmBTT64C1Dc+/NhcZfSW7W1BfxUSE=";
  };

-  postPatch = ''
-    substituteInPlace contrib/lz4/CMakeLists.txt \
-      --replace-fail 'cmake_minimum_required(VERSION 3.5)' 'cmake_minimum_required(VERSION 3.13)'
-    substituteInPlace contrib/nanosockets/CMakeLists.txt \
-      --replace-fail 'cmake_minimum_required(VERSION 3.5)' 'cmake_minimum_required(VERSION 3.13)'
-  '';
-
  nativeBuildInputs = [
    cmake
    pkg-config
@@ -55,6 +49,7 @@ stdenv.mkDerivation (finalAttrs: {
    libx11
    lua5_2
    libgbm
+    openal-soft
    SDL2
    SDL2_image
  ];
--- a/pkgs/by-name/pl/plink2/package.nix
+++ b/pkgs/by-name/pl/plink2/package.nix
@@ -0,0 +1,78 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  blas,
+  lapack,
+  zlib,
+  zstd,
+  versionCheckHook,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "plink2";
+  version = "2.0.0-a.7.6";
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  src = fetchFromGitHub {
+    owner = "chrchang";
+    repo = "plink-ng";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-IxyoC8oHZN7JLoOJGKI8F61JX0C0OwpbmQ8rJQQ38wU=";
+  };
+
+  sourceRoot = "${finalAttrs.src.name}/2.0/build_dynamic";
+
+  buildInputs = [
+    zlib
+    zstd
+  ]
+  ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [
+    blas
+    lapack
+  ];
+
+  makeFlags = [
+    "CC=${stdenv.cc.targetPrefix}cc"
+    "CXX=${stdenv.cc.targetPrefix}c++"
+    # Use the zstd from nixpkgs instead of the vendored copy.
+    "STATIC_ZSTD="
+    # Without this, the makefile appends a literal `""` to the target names.
+    "SFX="
+  ]
+  # On Darwin, the makefile defaults to the Accelerate framework.
+  ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [
+    "BLASFLAGS=-llapacke -llapack -lcblas -lblas"
+  ];
+
+  buildFlags = [ "plink2" ];
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm755 plink2 -t $out/bin
+
+    runHook postInstall
+  '';
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  doInstallCheck = true;
+
+  meta = {
+    description = "Whole genome association analysis toolset";
+    homepage = "https://www.cog-genomics.org/plink/2.0/";
+    downloadPage = "https://github.com/chrchang/plink-ng";
+    changelog = "https://github.com/chrchang/plink-ng/releases/tag/${finalAttrs.src.tag}";
+    license = with lib.licenses; [
+      gpl3Plus
+      lgpl3Plus
+    ];
+    mainProgram = "plink2";
+    maintainers = with lib.maintainers; [ GaetanLepage ];
+    platforms = lib.platforms.unix;
+  };
+})
--- a/pkgs/by-name/po/pocket-casts/package.nix
+++ b/pkgs/by-name/po/pocket-casts/package.nix
@@ -12,16 +12,16 @@ let
 in
 buildNpmPackage rec {
  pname = "pocket-casts";
-  version = "0.13.0";
+  version = "0.14.0";

  src = fetchFromGitHub {
    owner = "felicianotech";
    repo = "pocket-casts-desktop-app";
    rev = "v${version}";
-    hash = "sha256-v5R83h+AHpGbh3pXehalEjuD+s5grAowgGfvr7FsJKU=";
+    hash = "sha256-UjSwIRN8dM/KYAm0jBXnDCX6Qb4I+vbPA5AA8JO3ODo=";
  };

-  npmDepsHash = "sha256-335PYsGbYwYtMoLi1UkwdX3mPA0DOs79Lm1Kg7V83ZM=";
+  npmDepsHash = "sha256-uEKU/7BXl54XxLheCewFsSWsatd7bJriD+1+4EKQAlc=";

  env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";

--- a/pkgs/by-name/po/pokego/package.nix
+++ b/pkgs/by-name/po/pokego/package.nix
@@ -10,17 +10,17 @@

 buildGo127Module (finalAttrs: {
  pname = "pokego";
-  version = "0.5.8";
+  version = "0.5.9";
  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "rubiin";
    repo = "pokego";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-pZGxE58Jfi7oRkYph36XEFXBsxctJ3wAD8YvjEp6l18=";
+    hash = "sha256-0FMntKhy3HIXY8dHgQtGw1s3EEBX1DM6mPeb8caqTso=";
  };

-  vendorHash = "sha256-Ip2GuQDOolMyDvfmXcJRlY2rMp1amS8owkqcNMOR1+Y=";
+  vendorHash = "sha256-Sa3fqzEYRT6oU7Uw8FTCG2ZQDbe2xRcray/Js1iEz3s=";

  doCheck = false;

--- a/pkgs/by-name/pr/prettier/package.nix
+++ b/pkgs/by-name/pr/prettier/package.nix
@@ -6,13 +6,15 @@
  makeBinaryWrapper,
  nodejs,
  pnpmConfigHook,
-  pnpm,
+  pnpm_11,
  stdenv,
  versionCheckHook,
  yarn-berry,
  plugins ? [ ],
 }:
 let
+  pnpm = pnpm_11;
+
  ## Blame NodeJS
  exportRelativePathOf =
    let
--- a/pkgs/by-name/pr/prometheus-speedtest-exporter/package.nix
+++ b/pkgs/by-name/pr/prometheus-speedtest-exporter/package.nix
@@ -7,16 +7,16 @@
 buildGoModule (finalAttrs: {
  __structuredAttrs = true;
  pname = "prometheus-speedtest-exporter";
-  version = "1.1.0";
+  version = "1.2.0";

  src = fetchFromGitHub {
    owner = "podocarp";
    repo = "speedtest_exporter";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-xXTyxwECGlYv9bBco09zvlOpF4GcHeT3yZMNUQTPPoo=";
+    hash = "sha256-ZYdQWEEn+zYp0kA6h34fdy1KxQ1PxqWpt0RpXBrd7pE=";
  };

-  vendorHash = "sha256-HBg44D0CUc4HYCBwGrswnrqG5o5ltA6UT8L0oWetlIc=";
+  vendorHash = "sha256-42xxNgYeRXGCyRpz6D4E68l2mm+gE2RSyOeLHOIQrjI=";

  meta = {
    description = "Speedtest.net Exporter for the Prometheus monitoring system";
--- a/pkgs/by-name/ra/rasm/package.nix
+++ b/pkgs/by-name/ra/rasm/package.nix
@@ -7,7 +7,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "rasm";
-  version = "3.2.7";
+  version = "3.3";

  __structuredAttrs = true;
  strictDeps = true;
@@ -16,7 +16,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "EdouardBERGE";
    repo = "rasm";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-8Efo7B1q0pNKSkUR3UUhAxvItgt7bxSSbw4uTllShTk=";
+    hash = "sha256-a7nWWO1kxgEBvavGVNY9xsTPznvQNreWSI1zBBrB2ZE=";
  };

  nativeBuildInputs = [ installShellFiles ];
--- a/pkgs/by-name/re/restate/package.nix
+++ b/pkgs/by-name/re/restate/package.nix
@@ -26,16 +26,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "restate";
-  version = "1.7.9";
+  version = "1.7.10";

  src = fetchFromGitHub {
    owner = "restatedev";
    repo = "restate";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-MAUJl0vzr2daWbpTYI5t5scvfujKdLFvuSze6h1knYo=";
+    hash = "sha256-LVzgyaY7v44tzzcRcAdWFEa7DZfzYnZvI8k4tiDHB3Q=";
  };

-  cargoHash = "sha256-SZOByNnSerZo9KWbaNFo1yJ314JCfIcge6gbNgkSL6w=";
+  cargoHash = "sha256-b1xwzpqef9WHhcXIgzb/eIhNrsXuNskQAIRti8wdgMQ=";

  env = {
    PROTOC = lib.getExe protobuf;
--- a/pkgs/by-name/ri/ricochet-refresh/package.nix
+++ b/pkgs/by-name/ri/ricochet-refresh/package.nix
@@ -4,6 +4,7 @@
  fetchFromGitHub,
  qt5,
  openssl,
+  tor,
  # https://github.com/blueprint-freespeech/ricochet-refresh/issues/178
  protobuf_21,
  pkg-config,
@@ -12,14 +13,14 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "ricochet-refresh";
-  version = "3.0.39";
+  version = "3.0.45";

  src = fetchFromGitHub {
    owner = "blueprint-freespeech";
    repo = "ricochet-refresh";
    tag = "v${finalAttrs.version}-release";
    fetchSubmodules = true;
-    hash = "sha256-bKleUuR3dnvZETnMx7FSpVflPB8rcijMhJbuH/MuTWE=";
+    hash = "sha256-zfQF7DT+RSpD/uquknywaogq51i/lCXfmyDaKE9HjRk=";
  };

  sourceRoot = "${finalAttrs.src.name}/src";
@@ -46,6 +47,9 @@ stdenv.mkDerivation (finalAttrs: {
    qt5.wrapQtAppsHook
  ];

+  # Ricochet Refresh expects the Tor executable to be available in PATH.
+  qtWrapperArgs = [ "--prefix PATH : ${lib.makeBinPath [ tor ]}" ];
+
  enableParallelBuilding = true;

  cmakeBuildType = "MinSizeRel";
--- a/pkgs/by-name/ri/river-filtile/package.nix
+++ b/pkgs/by-name/ri/river-filtile/package.nix
@@ -28,5 +28,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
    license = lib.licenses.gpl3Only;
    maintainers = with lib.maintainers; [ pkulak ];
    mainProgram = "filtile";
+    platforms = lib.platforms.linux;
  };
 })
--- a/pkgs/by-name/rl/rlottie/package.nix
+++ b/pkgs/by-name/rl/rlottie/package.nix
@@ -11,13 +11,13 @@

 stdenv.mkDerivation {
  pname = "rlottie";
-  version = "0.2-unstable-2026-09-01";
+  version = "0.2-unstable-2026-09-11";

  src = fetchFromGitHub {
    owner = "Samsung";
    repo = "rlottie";
-    rev = "25648aef19187b3f87f4d9420b8d761453ad4630";
-    hash = "sha256-sLjunpnQh1HCy5VLB8EpCTaGuBRPGCLhDovTzAAjAK0=";
+    rev = "683bbaa39dd0d366cf6b4bc300b4dfbee677ea6b";
+    hash = "sha256-4XP/bqMWgJW/XbR0rb8N3U5YMpXhwaQ6oQG9+7Jw5bs=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/ru/rustfs/package.nix
+++ b/pkgs/by-name/ru/rustfs/package.nix
@@ -3,7 +3,7 @@
  stdenv,
  fetchFromGitHub,
  fetchPnpmDeps,
-  pnpm,
+  pnpm_11,
  pnpmConfigHook,
  nodejs,
  rustPlatform,
@@ -16,6 +16,8 @@
 }:

 let
+  pnpm = pnpm_11;
+
  console = stdenv.mkDerivation (finalAttrs: {
    pname = "rustfs-console";
    version = "0.1.26";
@@ -31,6 +33,7 @@ let

    pnpmDeps = fetchPnpmDeps {
      inherit (finalAttrs) pname version src;
+      inherit pnpm;
      fetcherVersion = 4;
      hash = "sha256-wfaUMWTa8eFkzY/wCD5o7+G2OiSTWCqm+py3sgqDI04=";
    };
--- a/pkgs/by-name/sa/sabiql/package.nix
+++ b/pkgs/by-name/sa/sabiql/package.nix
@@ -14,16 +14,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "sabiql";
-  version = "2.0.1";
+  version = "3.0.1";

  src = fetchFromGitHub {
    owner = "riii111";
    repo = "sabiql";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-QKc53tMxz9/+5fnDdBvxAj/CPB/UE4uWQ3Kh1haTyAk=";
+    hash = "sha256-Jn96Wbrju1NXu9DN0e6GVgS2p4v1F/mXO03Ug2TOVuw=";
  };

-  cargoHash = "sha256-ujT547EFdBxHWY6l1DDrTnMGAek26p3csGouJEk1Mwo=";
+  cargoHash = "sha256-CFrITQthY+PI08lA0ivFP8JcT4Y0HsotOsJmIwQVI90=";

  # Upstream use latest rust version need to patch use nixpkgs version
  postPatch = ''
--- a/pkgs/by-name/se/sessiond-hooks/package.nix
+++ b/pkgs/by-name/se/sessiond-hooks/package.nix
@@ -0,0 +1,27 @@
+{
+  lib,
+  fetchgit,
+  rustPlatform,
+}:
+rustPlatform.buildRustPackage (finalAttrs: {
+  __structuredAttrs = true;
+  pname = "sessiond-hooks";
+  version = "0.1.0";
+
+  cargoHash = "sha256-XD2g3nkV4iz9ZQlb0+0YDuJl+8XdMOdwbMcCnCjKGT8=";
+
+  src = fetchgit {
+    url = "https://tangled.org/did:plc:ujej26vte653yzllxk3q2dtf";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-zVEHxDNjF0xRydp2Y+oqM6O5KqM4zZTv0IqlHGXCgsA=";
+  };
+
+  meta = {
+    description = "Launch and supervise per-user session hooks with sessiond";
+    homepage = "https://tangled.org/did:plc:ujej26vte653yzllxk3q2dtf";
+    license = lib.licenses.gpl3Only;
+    maintainers = builtins.attrValues { inherit (lib.maintainers) r0chd; };
+    platforms = lib.platforms.linux;
+    mainProgram = "sessiond-hooks";
+  };
+})
--- a/pkgs/by-name/si/siglo/package.nix
+++ b/pkgs/by-name/si/siglo/package.nix
@@ -53,6 +53,7 @@ stdenv.mkDerivation (finalAttrs: {
    gatt
    pybluez
    requests
+    distutils
  ];

  preFixup = ''
--- a/pkgs/by-name/si/sillytavern/package.nix
+++ b/pkgs/by-name/si/sillytavern/package.nix
@@ -5,18 +5,23 @@
 }:
 buildNpmPackage (finalAttrs: {
  pname = "sillytavern";
-  version = "1.18.0";
+  version = "1.19.0";

  src = fetchFromGitHub {
    owner = "SillyTavern";
    repo = "SillyTavern";
    tag = finalAttrs.version;
-    hash = "sha256-1FDqbV+t9JF93aTgy7Hnwe4lCJZHooHw0J3zOsCZWDA=";
+    hash = "sha256-qBlR/4OnIyJeX9JWpzlrhGp/M+KeYqJDpAzI803jUqc=";
  };
-  npmDepsHash = "sha256-jDySPn354gh1gFI8I2apGmXDxOz4d4STfJX+iFVFhdg=";
+  npmDepsHash = "sha256-wAVmQuchjDXh7sTj8Q7+bJJoYCi7JdvlEeC5G9VtjMU=";

  dontNpmBuild = true;

+  postPatch = ''
+    # `.npmrc` breaks `npm pack`.
+    rm .npmrc
+  '';
+
  # These dirs are not installed automatically.
  # And if they were not in place, the app would try to create them at runtime, which is of course impossible to achieve.
  postInstall = ''
--- a/pkgs/by-name/si/silo/package.nix
+++ b/pkgs/by-name/si/silo/package.nix
@@ -36,16 +36,16 @@ buildGo127Module (finalAttrs: {
  __structuredAttrs = true;

  pname = "silo";
-  version = "2026-09-03T13-18-01Z";
+  version = "2026-09-16T00-00-00Z";

  src = fetchFromGitHub {
    owner = "pgsty";
    repo = "silo";
    tag = "RELEASE.${finalAttrs.version}";
-    hash = "sha256-VweJo3kHv/wdViNlh/B11qxevpOktkj/knkudHr7qQg=";
+    hash = "sha256-M9sBb2pFY00kYCUBk2ctWEM4xraEXdGcaEgvzQna+9w=";
  };

-  vendorHash = "sha256-YaZzqV6OL+kft8DcUxhxWlH02nF/Od1l0kdiJSrF8as=";
+  vendorHash = "sha256-STpltATG8UVhJMuUn3NeNOpHLv3jBdtyheB0jQ28qjY=";

  subPackages = [ "." ];

--- a/pkgs/by-name/sk/skopeo/package.nix
+++ b/pkgs/by-name/sk/skopeo/package.nix
@@ -19,13 +19,13 @@

 buildGoModule rec {
  pname = "skopeo";
-  version = "1.24.0";
+  version = "1.24.1";

  src = fetchFromGitHub {
    rev = "v${version}";
    owner = "podman-container-tools";
    repo = "skopeo";
-    hash = "sha256-RAK6fGy6qCHuJogUeWNoUVOccS7IfRJRozYVrcftQhU=";
+    hash = "sha256-jLKbo6+xgHaMkMimbGIni5iZcVyeMF8wHTI594UkHQI=";
  };

  outputs = [
--- a/pkgs/by-name/sl/slang-server/package.nix
+++ b/pkgs/by-name/sl/slang-server/package.nix
@@ -25,7 +25,7 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "slang-server";
-  version = "0.2.10";
+  version = "0.3.0";

  strictDeps = true;
  __structuredAttrs = true;
@@ -36,7 +36,7 @@ stdenv.mkDerivation (finalAttrs: {
    tag = "v${finalAttrs.version}";
    # slang-server vendors its dependencies via submodules
    fetchSubmodules = true;
-    hash = "sha256-hyKiEtUpLkXYbwh9KKDc26EgZbC1bvf0hV5tM8p5vVU=";
+    hash = "sha256-dXoZnlU0iuexMswvevQ+0554y0G342W1otzBN8pxVac=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/sn/snmalloc/package.nix
+++ b/pkgs/by-name/sn/snmalloc/package.nix
@@ -1,6 +1,5 @@
 {
  lib,
-  stdenv,
  clangStdenv,
  fetchFromGitHub,
  cmake,
--- a/pkgs/by-name/sp/sparkle/package.nix
+++ b/pkgs/by-name/sp/sparkle/package.nix
@@ -4,7 +4,7 @@
  buildGoModule,
  buildNpmPackage,
  fetchFromGitHub,
-  pnpm,
+  pnpm_11,
  fetchPnpmDeps,
  pnpmConfigHook,
  makeWrapper,
@@ -22,6 +22,8 @@
 }:

 let
+  pnpm = pnpm_11;
+
  sparkle-service = buildGoModule {
    pname = "sparkle-service";
    version = "0-unstable-2026-08-02";
--- a/pkgs/by-name/ss/sstorytime/package.nix
+++ b/pkgs/by-name/ss/sstorytime/package.nix
@@ -12,15 +12,15 @@

 buildGoModule (finalAttrs: {
  pname = "sstorytime";
-  version = "1.0-beta-unstable-2026-08-20";
+  version = "1.0-beta-unstable-2026-09-15";

  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "markburgess";
    repo = "SSTorytime";
-    rev = "a9b34d5197cb0a9fb586bc4722eb8153dffaf044";
-    hash = "sha256-NYMIxUlx5jf2weTdMxziMhZ7dMxPc5L330wRFzhDmFw=";
+    rev = "f56e7b01b098dff89422c15a56414dd8dec80b03";
+    hash = "sha256-2qIbn4OX4bDYIuEx3fP6lVzDFbLFcqLSpZ6Dqf8+hO8=";
  };

  vendorHash = "sha256-lei5IG02QYSigHmLArlE7huDFVGoVMkw8DTEQeJWFX0=";
--- a/pkgs/by-name/su/subxt/package.nix
+++ b/pkgs/by-name/su/subxt/package.nix
@@ -6,16 +6,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "subxt";
-  version = "0.50.3";
+  version = "0.51.0";

  src = fetchFromGitHub {
    owner = "paritytech";
    repo = "subxt";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-ctViZ1veorf+fmalmaZkqVGJYZTGYYcPeM23UGxRNRg=";
+    hash = "sha256-1ErnM5UjD5PQIyGE6tUa1vQZmwAmdtUjmITBqSqAbRE=";
  };

-  cargoHash = "sha256-QM6tmLygNjrqqE5ptEjYGAEQDBs08Ix2nYrbujtPv7Q=";
+  cargoHash = "sha256-Uar3JeKOX84y2EHzqG5JVx2rhaluMHA5FKdKK7wI4mg=";

  # Only build the command line client
  cargoBuildFlags = [
--- a/pkgs/by-name/su/sus-compiler/Cargo.lock
+++ b/pkgs/by-name/su/sus-compiler/Cargo.lock
@@ -4,9 +4,9 @@ version = 4

 [[package]]
 name = "aho-corasick"
-version = "1.1.4"
+version = "1.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ddd31a130427c27518df266943a5308ed92d4b226cc639f5a8f1002816174301"
+checksum = "c982642fa9e8606056828ee9a8505737230110bb1099153c79efe865c59d12ba"
 dependencies = [
 "memchr",
 ]
@@ -19,9 +19,9 @@ checksum = "250f629c0161ad8107cf89319e990051fae62832fd343083bea452d93e2205fd"

 [[package]]
 name = "android_system_properties"
-version = "0.1.5"
+version = "0.1.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "819e7219dbd41043ac279b19830f2efc897156490d7fd6ea916720117ee66311"
+checksum = "ae221649c9976a6f6c56ae1facf410f3ddb33cc661c4b7b61020a912d4237fbc"
 dependencies = [
 "libc",
 ]
@@ -100,9 +100,9 @@ checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"

 [[package]]
 name = "bitflags"
-version = "2.13.0"
+version = "2.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b4388bee8683e3d04af747c73422af53102d2bd24d9eadb6cbc100baef4b43f8"
+checksum = "b588b76d00fde79687d7646a9b5bdf3cc0f655e0bbd080335a95d7e96f3587da"

 [[package]]
 name = "bumpalo"
@@ -112,9 +112,9 @@ checksum = "72f5acc6cb2ba439de613abc23857ec3d78374d8ed5ac84e9d11336e87da8649"

 [[package]]
 name = "cc"
-version = "1.2.65"
+version = "1.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e228eec9be7c17ccb640b59b36a5cd805ea2a564a4c5e162c2f659fea30d3b96"
+checksum = "509591b7bcd67f4ef775afad7662703b4935daaa6ec0e5605cfb1090b32a2b6d"
 dependencies = [
 "find-msvc-tools",
 "shlex",
@@ -128,9 +128,9 @@ checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"

 [[package]]
 name = "chacha20"
-version = "0.10.0"
+version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6f8d983286843e49675a4b7a2d174efe136dc93a18d69130dd18198a6c167601"
+checksum = "d524456ba66e72eb8b115ff89e01e497f8e6d11d78b70b1aa13c0fbd97540a81"
 dependencies = [
 "cfg-if",
 "cpufeatures",
@@ -152,15 +152,15 @@ dependencies = [

 [[package]]
 name = "circular-buffer"
-version = "1.2.0"
+version = "1.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "14c638459986b83c2b885179bd4ea6a2cbb05697b001501a56adb3a3d230803b"
+checksum = "a77b57ca5f8cc834a94656d3186a8c515a7ba9026af03cf7694c29908b169205"

 [[package]]
 name = "clap"
-version = "4.6.1"
+version = "4.6.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ddb117e43bbf7dacf0a4190fef4d345b9bad68dfc649cb349e7d17d28428e51"
+checksum = "473c7e07f409a8d772161724aa8db6a765a2532a70f9667eeb7b49d3d02fbdca"
 dependencies = [
 "clap_builder",
 "clap_derive",
@@ -168,9 +168,9 @@ dependencies = [

 [[package]]
 name = "clap_builder"
-version = "4.6.0"
+version = "4.6.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "714a53001bf66416adb0e2ef5ac857140e7dc3a0c48fb28b2f10762fc4b5069f"
+checksum = "7b48fea5a88e9ae728a2dcbedbfc0e730f7d60da42e1cb049a83c9fb8b789889"
 dependencies = [
 "anstream",
 "anstyle",
@@ -181,14 +181,14 @@ dependencies = [

 [[package]]
 name = "clap_derive"
-version = "4.6.1"
+version = "4.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2ce8604710f6733aa641a2b3731eaa1e8b3d9973d5e3565da11800813f997a9"
+checksum = "d012d2b9d65aca7f18f4d9878a045bc17899bba951561ba5ec3c2ba1eed9a061"
 dependencies = [
 "heck 0.5.0",
 "proc-macro2",
 "quote",
- "syn",
+ "syn 3.0.3",
 ]

 [[package]]
@@ -229,18 +229,18 @@ dependencies = [

 [[package]]
 name = "crossbeam-channel"
-version = "0.5.15"
+version = "0.5.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "82b8f8f868b36967f9606790d1903570de9ceaf870a7bf9fbbd3016d636a2cb2"
+checksum = "d85363c37faeca707aef026efa9f3b34d077bce547e48f770770625c6013679e"
 dependencies = [
 "crossbeam-utils",
 ]

 [[package]]
 name = "crossbeam-utils"
-version = "0.8.21"
+version = "0.8.22"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d0a5c400df2834b80a4c3327b3aad3a4c4cd4de0629063962b03235697506a28"
+checksum = "61803da095bee82a81bb1a452ecc25d3b2f1416d1897eb86430c6159ef717c17"

 [[package]]
 name = "dirs"
@@ -271,18 +271,19 @@ checksum = "4c3cf4824e2d5f025c7b531afcb2325364084a16806f6d47fbc1f5fbd9960590"

 [[package]]
 name = "env_filter"
-version = "1.0.1"
+version = "2.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32e90c2accc4b07a8456ea0debdc2e7587bdd890680d71173a15d4ae604f6eef"
+checksum = "900d271a03799a1ee8d1ca9b19893b48ca674a9284fefcfb85f05e74ed314217"
 dependencies = [
 "log",
+ "regex",
 ]

 [[package]]
 name = "env_logger"
-version = "0.11.10"
+version = "0.11.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0621c04f2196ac3f488dd583365b9c09be011a4ab8b9f37248ffcc8f6198b56a"
+checksum = "de671bd27a75a797dc9ae289ba1e77276e75e2026408aab65185384e2d5cd3f6"
 dependencies = [
 "anstream",
 "anstyle",
@@ -308,9 +309,9 @@ dependencies = [

 [[package]]
 name = "find-msvc-tools"
-version = "0.1.9"
+version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582"
+checksum = "d45db016d36b838f563236e9193d0ee6ce38f3f68b6c94e914b4929c96bbb890"

 [[package]]
 name = "fluent-uri"
@@ -323,21 +324,21 @@ dependencies = [

 [[package]]
 name = "futures-core"
-version = "0.3.32"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7e3450815272ef58cec6d564423f6e755e25379b217b0bc688e295ba24df6b1d"
+checksum = "92d699e522242e69e3003b94ecc1f960f3a5e015aa7c5d7486e65ad01dd94f5e"

 [[package]]
 name = "futures-task"
-version = "0.3.32"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "037711b3d59c33004d3856fbdc83b99d4ff37a24768fa1be9ce3538a1cde4393"
+checksum = "cd417de3d1d015fc3bfd2b1ea46dfc7bab72ef86f1cc7cc9c78e728b34a6d1fd"

 [[package]]
 name = "futures-util"
-version = "0.3.32"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "389ca41296e6190b48053de0321d02a77f32f8a5d2461dd38762c0593805c6d6"
+checksum = "0d50a92467f8ba5dd6e3ee5d4bd04d73ab2e4e1c44474a0674821dfce14b79bc"
 dependencies = [
 "futures-core",
 "futures-task",
@@ -444,9 +445,9 @@ checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"

 [[package]]
 name = "js-sys"
-version = "0.3.102"
+version = "0.3.104"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "03d04c30968dffe80775bd4d7fb676131cd04a1fb46d2686dbffbaec2d9dfd31"
+checksum = "0e0c1080212aad755ea003d18543e8768dd432c48819efd73a7bf1e39b7a5a3a"
 dependencies = [
 "cfg-if",
 "futures-util",
@@ -455,15 +456,15 @@ dependencies = [

 [[package]]
 name = "libc"
-version = "0.2.186"
+version = "0.2.189"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "68ab91017fe16c622486840e4c83c9a37afeff978bd239b5293d61ece587de66"
+checksum = "3eaf3ede3fee6db1a4c2ee091bf8a8b4dccdc6d17f656fb07896ee72867612f2"

 [[package]]
 name = "libredox"
-version = "0.1.17"
+version = "0.1.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f02ab6bace2054fb888a3c16f990117b579d14a3088e472d63c6011fa185c9d3"
+checksum = "28d0a00925a9f930d679b6789b721e3a7f9ed110f41b86d2497caa780c3a070a"
 dependencies = [
 "libc",
 ]
@@ -508,9 +509,9 @@ dependencies = [

 [[package]]
 name = "memchr"
-version = "2.8.2"
+version = "2.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "88904434abc2901f197fe8cc55f0445e7ded921dba5911dad2e2b39b48e663c4"
+checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"

 [[package]]
 name = "num-traits"
@@ -569,7 +570,7 @@ dependencies = [
 "proc-macro2",
 "proc-macro2-diagnostics",
 "quote",
- "syn",
+ "syn 2.0.119",
 ]

 [[package]]
@@ -580,9 +581,9 @@ checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"

 [[package]]
 name = "proc-macro2"
-version = "1.0.106"
+version = "1.0.107"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934"
+checksum = "985e7ec9bb745e6ce6535b544d84d6cd6f7ad8bd711c398938ae983b91a766d9"
 dependencies = [
 "unicode-ident",
 ]
@@ -595,7 +596,7 @@ checksum = "af066a9c399a26e020ada66a034357a868728e72cd426f3adcd35f80d88d88c8"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn",
+ "syn 2.0.119",
 "version_check",
 "yansi",
 ]
@@ -606,7 +607,7 @@ version = "0.13.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e9f068eba8e7071c5f9511831b44f32c740d5adf574e990f946ddb53db2f314e"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
 "memchr",
 "pulldown-cmark-escape",
 "unicase",
@@ -620,9 +621,9 @@ checksum = "007d8adb5ddab6f8e3f491ac63566a7d5002cc7ed73901f72057943fa71ae1ae"

 [[package]]
 name = "quote"
-version = "1.0.46"
+version = "1.0.47"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dfbc457d0c7a0759a614551b11a6409e5951f6c7537be1f1b7682b9ae9230368"
+checksum = "1fbf4db142a473a8d80c26bbf18454ed458bf8d26c8219c331daecfdbd079001"
 dependencies = [
 "proc-macro2",
 ]
@@ -635,9 +636,9 @@ checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"

 [[package]]
 name = "rand"
-version = "0.10.1"
+version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d2e8e8bcc7961af1fdac401278c6a831614941f6164ee3bf4ce61b7edb162207"
+checksum = "c7f5fa3a058cd35567ef9bfa5e75732bee0f9e4c55fa90477bef2dfcdbc4be80"
 dependencies = [
 "chacha20",
 "getrandom 0.4.3",
@@ -663,9 +664,9 @@ dependencies = [

 [[package]]
 name = "regex"
-version = "1.12.4"
+version = "1.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1292b7759ae1cb9ec195452d1390a074f0cd8541ab7a5a8c31cd6db45d4a6ba"
+checksum = "f020237b6c8eed93db2e2cb53c00c60a8e1bc73da7d073199a1180401450218d"
 dependencies = [
 "aho-corasick",
 "memchr",
@@ -675,9 +676,9 @@ dependencies = [

 [[package]]
 name = "regex-automata"
-version = "0.4.14"
+version = "0.4.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6e1dd4122fc1595e8162618945476892eefca7b88c52820e74af6262213cae8f"
+checksum = "ad8553b9b26413251cbf30e620595c7a41b3887f03da04579c0e6b0d6a06b4b2"
 dependencies = [
 "aho-corasick",
 "memchr",
@@ -702,7 +703,7 @@ version = "1.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b6fe4565b9518b83ef4f91bb47ce29620ca828bd32cb7e408f0062e9930ba190"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
 "errno",
 "libc",
 "linux-raw-sys",
@@ -711,9 +712,9 @@ dependencies = [

 [[package]]
 name = "rustversion"
-version = "1.0.22"
+version = "1.0.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d"
+checksum = "cf54715a573b99ac80df0bc206da022bcd442c974952c7b9720069370852e21f"

 [[package]]
 name = "same-file"
@@ -726,9 +727,9 @@ dependencies = [

 [[package]]
 name = "serde"
-version = "1.0.228"
+version = "1.0.229"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e"
+checksum = "4148590afebada386688f18773da617792bf2ef03ffc1e4cbd2b1d45b023e0ba"
 dependencies = [
 "serde_core",
 "serde_derive",
@@ -736,29 +737,29 @@ dependencies = [

 [[package]]
 name = "serde_core"
-version = "1.0.228"
+version = "1.0.229"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad"
+checksum = "67dca2c9c51e58a4791a4b1ed58308b39c64224d349a935ab5039aa360942a48"
 dependencies = [
 "serde_derive",
 ]

 [[package]]
 name = "serde_derive"
-version = "1.0.228"
+version = "1.0.229"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
+checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn",
+ "syn 3.0.3",
 ]

 [[package]]
 name = "serde_json"
-version = "1.0.150"
+version = "1.0.151"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e8014e44b4736ed0538adeecded0fce2a272f22dc9578a7eb6b2d9993c74cfb9"
+checksum = "c841b55ecdae098c80dcae9cf767f6f8a0c2cdb3416bbef72181df4d0fe73f14"
 dependencies = [
 "indexmap",
 "itoa",
@@ -770,13 +771,13 @@ dependencies = [

 [[package]]
 name = "serde_repr"
-version = "0.1.20"
+version = "0.1.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "175ee3e80ae9982737ca543e96133087cbd9a485eecc3bc4de9c1a37b47ea59c"
+checksum = "8d3b1629de253c70a0508c3899572da79ca359fdab27c7920ff00406df418906"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn",
+ "syn 3.0.3",
 ]

 [[package]]
@@ -811,18 +812,18 @@ checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"

 [[package]]
 name = "sus-proc-macro"
-version = "0.4.0"
+version = "0.5.0"
 dependencies = [
 "quote",
 "regex",
- "syn",
+ "syn 2.0.119",
 "tree-sitter",
 "tree-sitter-sus",
 ]

 [[package]]
 name = "sus_compiler"
-version = "0.4.0"
+version = "0.5.0"
 dependencies = [
 "ariadne",
 "chrono",
@@ -854,9 +855,20 @@ dependencies = [

 [[package]]
 name = "syn"
-version = "2.0.118"
+version = "2.0.119"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1b9ae57f904213ebb649ce6895b8a66c66f0203b9319718f69a5612a065b1422"
+checksum = "872831b642d1a07999a962a351ed35b955ea2cfc8f3862091e2a240a84f17297"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "syn"
+version = "3.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "53e9bae58849f64dfa4f5d5ae372c8341f7305f82a3868709269343628b659a3"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -875,29 +887,29 @@ dependencies = [

 [[package]]
 name = "thiserror"
-version = "2.0.18"
+version = "2.0.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4288b5bcbc7920c07a1149a35cf9590a2aa808e0bc1eafaade0b80947865fbc4"
+checksum = "ec86235f5fcc2a73650310756d2ac5b138a5780bbbdfae3eeccec992c435ba4f"
 dependencies = [
 "thiserror-impl",
 ]

 [[package]]
 name = "thiserror-impl"
-version = "2.0.18"
+version = "2.0.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ebc4ee7f67670e9b64d05fa4253e753e016c6c95ff35b89b7941d6b856dec1d5"
+checksum = "bc04cd3e1236dd4a98afca4569f2deb3f120e5422a4023be2cb683f8486292af"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn",
+ "syn 3.0.3",
 ]

 [[package]]
 name = "tree-sitter"
-version = "0.26.9"
+version = "0.26.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4dab76d0b724ba557954125188cf0633a1ca43199ced82d95c7b9c32cc3de1f3"
+checksum = "83c567a8e18ae93f20982c90370b16fd24023aeaf52f6052b96957ab253a0fec"
 dependencies = [
 "cc",
 "regex",
@@ -915,7 +927,7 @@ checksum = "009994f150cc0cd50ff54917d5bc8bffe8cad10ca10d81c34da2ec421ae61782"

 [[package]]
 name = "tree-sitter-sus"
-version = "0.4.0"
+version = "0.5.0"
 dependencies = [
 "cc",
 "tree-sitter",
@@ -971,9 +983,9 @@ checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"

 [[package]]
 name = "wasm-bindgen"
-version = "0.2.125"
+version = "0.2.127"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ddb3f79143bced6de84270411622a2699cee572fc0875aeaf1e7867cf9fca1a"
+checksum = "1b70935747edd64d89de3efa29d73789b806c15798f8e7dca4d8ac356b50ce70"
 dependencies = [
 "cfg-if",
 "once_cell",
@@ -984,9 +996,9 @@ dependencies = [

 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.125"
+version = "0.2.127"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4e21a184b13fb19e157296e2c46056aec9092264fab83e4ba59e68c61b323c3d"
+checksum = "77775f8f3f7217702089053b94958f8f54061a3f663417df76e19cbdcca29bc1"
 dependencies = [
 "quote",
 "wasm-bindgen-macro-support",
@@ -994,22 +1006,22 @@ dependencies = [

 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.125"
+version = "0.2.127"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fecefd9c35bd935a20fc3fc344b5f29138961e4f47fb03297d88f2587afb5ebd"
+checksum = "e11d33f857dc2fb11b8bc75aee111aa9cbeb12cd9f25efd3d4c2a3dd4e235284"
 dependencies = [
 "bumpalo",
 "proc-macro2",
 "quote",
- "syn",
+ "syn 2.0.119",
 "wasm-bindgen-shared",
 ]

 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.125"
+version = "0.2.127"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "23939e44bb9a5d7576fa2b563dc2e136628f1224e88a8deed09e04858b77871f"
+checksum = "7ef64dbcc55df09c7e5a46182d181c2cfa3e925f3da937ea764728b4bbb9dcbf"
 dependencies = [
 "unicode-ident",
 ]
@@ -1044,7 +1056,7 @@ checksum = "053e2e040ab57b9dc951b72c264860db7eb3b0200ba345b4e4c3b14f67855ddf"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn",
+ "syn 2.0.119",
 ]

 [[package]]
@@ -1055,7 +1067,7 @@ checksum = "3f316c4a2570ba26bbec722032c4099d8c8bc095efccdc15688708623367e358"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn",
+ "syn 2.0.119",
 ]

 [[package]]
@@ -1099,6 +1111,6 @@ checksum = "cfe53a6657fd280eaa890a3bc59152892ffa3e30101319d168b781ed6529b049"

 [[package]]
 name = "zmij"
-version = "1.0.21"
+version = "1.0.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b8848ee67ecc8aedbaf3e4122217aff892639231befc6a1b58d29fff4c2cabaa"
+checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"
--- a/Show More
+++ b/Show More
				`@@ -0,0 +1 @@`
				`{ python3Packages }: with python3Packages; toPythonApplication logica`