[Backport release-26.05] boringssl: 0.20260508.0 -> 0.20260526.0 (#527512)

Signed-off-by: Patrizio Bekerle <patrizio@bekerle.com>
(cherry picked from commit ae6296ca6e)

.github/workflows/backport.yml

@@ -36,7 +36,7 @@ jobs:
           permission-pull-requests: write
           permission-workflows: write
 
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           token: ${{ steps.app-token.outputs.token }}

.github/workflows/bot.yml

@@ -46,7 +46,7 @@ jobs:
       # https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
       FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout: |

.github/workflows/build.yml

@@ -52,7 +52,7 @@ jobs:
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 60
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout: .github/actions

.github/workflows/check.yml

@@ -43,7 +43,7 @@ jobs:
     runs-on: ubuntu-slim
     timeout-minutes: 3
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           path: trusted
@@ -95,7 +95,7 @@ jobs:
     runs-on: ubuntu-slim
     timeout-minutes: 3
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           path: trusted
@@ -137,7 +137,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout: .github/actions

.github/workflows/comment.yml

@@ -23,7 +23,7 @@ jobs:
     timeout-minutes: 2
     if: contains(github.event.comment.body, '@NixOS/nixpkgs-merge-bot merge')
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout: |

.github/workflows/eval.yml

@@ -47,7 +47,7 @@ jobs:
       ciPinBumpCommit: ${{ steps.find-pinned-commit.outputs.ciPinBumpCommit }}
       ciPinBumpCommitShort: ${{ steps.find-pinned-commit.outputs.ciPinBumpCommitShort }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           path: trusted
@@ -55,7 +55,7 @@ jobs:
             ci/supportedVersions.nix
 
       - name: Check out the PR at the test merge commit
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           ref: ${{ inputs.mergedSha }}
@@ -171,7 +171,7 @@ jobs:
           sudo mkswap /swap
           sudo swapon /swap
 
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout: .github/actions
@@ -256,7 +256,7 @@ jobs:
       statuses: write # creating 'Eval Summary' commit statuses
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout: .github/actions
@@ -471,7 +471,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout: .github/actions

.github/workflows/lint.yml

@@ -26,7 +26,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout: .github/actions
@@ -61,7 +61,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout: .github/actions
@@ -90,7 +90,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout: .github/actions
@@ -134,7 +134,7 @@ jobs:
     runs-on: ubuntu-slim
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: true # Needed to run git fetch for large PRs.
           path: trusted

.github/workflows/merge-group.yml

@@ -25,7 +25,7 @@ jobs:
       targetSha: ${{ steps.prepare.outputs.targetSha }}
       systems: ${{ steps.prepare.outputs.systems }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout: |

.github/workflows/periodic-merge.yml

@@ -34,7 +34,7 @@ jobs:
           permission-contents: write
           permission-pull-requests: write
 
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 

.github/workflows/pull-request-target.yml

@@ -36,7 +36,7 @@ jobs:
       systems: ${{ steps.prepare.outputs.systems }}
       touched: ${{ steps.prepare.outputs.touched }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout-cone-mode: true # default, for clarity

.github/workflows/review.yml

@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-slim
     timeout-minutes: 2
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout: |

.github/workflows/teams.yml

@@ -30,7 +30,7 @@ jobs:
           permission-pull-requests: write
 
       - name: Fetch source
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout: |

.github/workflows/test.yml

@@ -19,7 +19,7 @@ jobs:
       push: ${{ steps.files.outputs.push }}
       targetSha: ${{ steps.prepare.outputs.targetSha }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout-cone-mode: true # default, for clarity

pkgs/applications/science/molecular-dynamics/gromacs/default.nix

@@ -56,8 +56,8 @@ let
       }
     else
       {
-        version = "2026.1";
-        hash = "sha256-2VoxP1bbfgXuOiHlD1gv3uUXbC9guQC6skYf2Vxegb4=";
+        version = "2026.2";
+        hash = "sha256-0n5EVegkYXeVI2Z5hjGg2tny4fVnQApsuFShaNzAUN0=";
       };
 
 in

pkgs/by-name/bo/boringssl/package.nix

@@ -13,12 +13,12 @@
 # reference: https://boringssl.googlesource.com/boringssl/+/refs/tags/0.20250818.0/BUILDING.md
 stdenv.mkDerivation (finalAttrs: {
   pname = "boringssl";
-  version = "0.20260508.0";
+  version = "0.20260526.0";
 
   src = fetchgit {
     url = "https://boringssl.googlesource.com/boringssl";
     tag = finalAttrs.version;
-    hash = "sha256-7fW0OmOj+Hduq5YCc5xpcfICpC8qAc/05/UMgZ70jhM=";
+    hash = "sha256-SmyImyzGn7v2b5qGJbMmQZX5bODA9i6+8jy3uGwOawA=";
   };
 
   patches = [

pkgs/by-name/fe/feishin/package.nix

@@ -3,29 +3,30 @@
   stdenv,
   buildNpmPackage,
   fetchFromGitHub,
-  electron_40,
+  electron_41,
   dart-sass,
   mpv-unwrapped,
   fetchPnpmDeps,
   pnpmConfigHook,
   pnpm_10_29_2,
   darwin,
+  actool,
   copyDesktopItems,
   makeDesktopItem,
   nix-update-script,
 }:
 let
   pname = "feishin";
-  version = "1.11.0";
+  version = "1.13.0";
 
   src = fetchFromGitHub {
     owner = "jeffvli";
     repo = "feishin";
     tag = "v${version}";
-    hash = "sha256-TSjgjNHhPSZ4k7zZTH5e3FCkl6d7B/2w2WCt0S5OW0g=";
+    hash = "sha256-v6dWzEB1+IK4bHmDo8Rr5e0Xi3OWKcm+UPBmBiSfdZ0=";
   };
 
-  electron = electron_40;
+  electron = electron_41;
 in
 buildNpmPackage {
   inherit pname version;
@@ -43,7 +44,7 @@ buildNpmPackage {
       ;
     pnpm = pnpm_10_29_2;
     fetcherVersion = 3;
-    hash = "sha256-2fLqqCbbCIPoW/wGzsZOpZd5tnvyrLYlrVhbFWixlDM=";
+    hash = "sha256-zNOGJ24G0xcgsGK4DmbBm7d1PHTp7IJS+RTALGRtfDg=";
   };
 
   env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
@@ -52,17 +53,15 @@ buildNpmPackage {
     pnpm_10_29_2
   ]
   ++ lib.optionals (stdenv.hostPlatform.isLinux) [ copyDesktopItems ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [ darwin.autoSignDarwinBinariesHook ];
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    darwin.autoSignDarwinBinariesHook
+    actool
+  ];
 
   postPatch = ''
     # release/app dependencies are installed on preConfigure
     substituteInPlace package.json \
       --replace-fail '"postinstall": "electron-builder install-app-deps",' ""
-  ''
-  + lib.optionalString stdenv.hostPlatform.isLinux ''
-    # https://github.com/electron/electron/issues/31121
-    substituteInPlace src/main/index.ts \
-      --replace-fail "process.resourcesPath" "'$out/share/feishin/resources'"
   '';
 
   preBuild = ''

pkgs/by-name/gi/git/package.nix

@@ -212,6 +212,11 @@ stdenv.mkDerivation (finalAttrs: {
     libsecret
   ];
 
+  # This is required for building the rust build.rs script when cross compiling
+  depsBuildBuild = lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
+    buildPackages.stdenv.cc
+  ];
+
   env = {
     # required to support pthread_cancel()
     NIX_LDFLAGS =

pkgs/by-name/gr/grafana/package.nix

@@ -21,7 +21,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "grafana";
-  version = "13.0.1+security-01";
+  version = "13.0.2";
 
   subPackages = [
     "pkg/cmd/grafana"
@@ -33,7 +33,7 @@ buildGoModule (finalAttrs: {
     owner = "grafana";
     repo = "grafana";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-v/6a0Xlj11nZ0u8xtFzw5i674rB1YV21iLCuLc5af+I=";
+    hash = "sha256-knalINdJPFrvj6HNxWPV6wu6TSkrRvgkZjOnECOsWwU=";
   };
 
   patches = [
@@ -55,12 +55,12 @@ buildGoModule (finalAttrs: {
   # Since this is not a dependency attribute the buildPackages has to be specified.
   offlineCache = buildPackages.yarn-berry_4-fetcher.fetchYarnBerryDeps {
     inherit (finalAttrs) src missingHashes patches;
-    hash = "sha256-uOl9PemVZiKwGfhLUpAAByMvt5A8JyA5qyJ6Cdl6od4=";
+    hash = "sha256-NXDXmed2TsMQS99breDt0Ky6X2ZyuWkJ5KyKz5Apkt8=";
   };
 
   disallowedRequisites = [ finalAttrs.offlineCache ];
 
-  vendorHash = "sha256-PEGgrkTguHvqrclzvZDQ7yk6rwTKDLXdUSjeaQFnYtU=";
+  vendorHash = "sha256-rFGwtplr+n0qgIulycNQ5L/lh4ZFoHCrYeIfbb+e/h4=";
 
   # Grafana seems to just set it to the latest version available
   # nowadays.

pkgs/by-name/ho/hol_light/package.nix

@@ -4,17 +4,23 @@
   fetchFromGitHub,
   makeBinaryWrapper,
   writeText,
-  ocaml,
-  findlib,
-  zarith,
-  camlp5,
-  camlp-streams,
-  fmt,
-  pcre2,
+  ocamlPackages,
   ledit,
   bash,
 }:
 
+let
+  inherit (ocamlPackages)
+    ocaml
+    findlib
+    zarith
+    camlp5
+    camlp-streams
+    fmt
+    pcre2
+    ;
+in
+
 let
   ocamlPath = lib.makeSearchPath "/lib/ocaml/${ocaml.version}/site-lib" [
     camlp5

pkgs/by-name/lo/lockbook-desktop/package.nix

@@ -18,16 +18,16 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "lockbook-desktop";
-  version = "26.5.22";
+  version = "26.6.1";
 
   src = fetchFromGitHub {
     owner = "lockbook";
     repo = "lockbook";
     tag = finalAttrs.version;
-    hash = "sha256-KqqiaM0txuZsylbr1+7faTdJINy1sNttT9n/YUpqyCc=";
+    hash = "sha256-+r5WsaqQr6NlQNWDTQf/tvCh6P5LpFFyyLMTIZw9yis=";
   };
 
-  cargoHash = "sha256-d4yKch2c1w5gFBjyrYZQT/6lscRi3p05wKiJEIaXhjA=";
+  cargoHash = "sha256-ybAcG7sCEwZC6FxWx2KhHd1HkhK8wwkGeeLoI/KOXKU=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/by-name/lo/lockbook/package.nix

@@ -12,16 +12,16 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "lockbook";
-  version = "26.5.22";
+  version = "26.6.1";
 
   src = fetchFromGitHub {
     owner = "lockbook";
     repo = "lockbook";
     tag = finalAttrs.version;
-    hash = "sha256-KqqiaM0txuZsylbr1+7faTdJINy1sNttT9n/YUpqyCc=";
+    hash = "sha256-+r5WsaqQr6NlQNWDTQf/tvCh6P5LpFFyyLMTIZw9yis=";
   };
 
-  cargoHash = "sha256-d4yKch2c1w5gFBjyrYZQT/6lscRi3p05wKiJEIaXhjA=";
+  cargoHash = "sha256-ybAcG7sCEwZC6FxWx2KhHd1HkhK8wwkGeeLoI/KOXKU=";
 
   doCheck = false; # there are no cli tests
   cargoBuildFlags = [

pkgs/by-name/pr/prometheus-redis-exporter/package.nix

@@ -10,16 +10,16 @@
 
 buildGoModule rec {
   pname = "redis_exporter";
-  version = "1.84.0";
+  version = "1.85.0";
 
   src = fetchFromGitHub {
     owner = "oliver006";
     repo = "redis_exporter";
     rev = "v${version}";
-    sha256 = "sha256-0GxPPtZh7qJO1jQ5Q+ED8cJK0kbn/Q7DuXLihWd67gg=";
+    sha256 = "sha256-04LDNXHaVADvcH3CLVYnFXnLPvBPqjGIBls2KeHHdlY=";
   };
 
-  vendorHash = "sha256-O2koMGh9/1UWtV5arH3S/7b6q33P4Yv+xgPthTtZsLg=";
+  vendorHash = "sha256-muGgriK1DDkKk4DOWf7m+W6/qquwYwqgTOzyNGbjV+U=";
 
   ldflags = [
     "-X main.BuildVersion=${version}"

pkgs/by-name/pr/proton-authenticator/package.nix

@@ -11,11 +11,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "proton-authenticator";
-  version = "1.1.4";
+  version = "1.1.5";
 
   src = fetchurl {
     url = "https://proton.me/download/authenticator/linux/ProtonAuthenticator_${finalAttrs.version}_amd64.deb";
-    hash = "sha256-SoTeqnYDMgCoWLGaQZXaHiRKGreFn7FPSz5C0O88uWM=";
+    hash = "sha256-y6VXzytstYBXdmujDWASC8AShQPkr+tNtoynGk0l3hg=";
   };
 
   dontConfigure = true;
@@ -47,7 +47,10 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     description = "Two-factor authentication manager with optional sync";
     homepage = "https://proton.me/authenticator";
     license = lib.licenses.unfree; # source not yet published
-    maintainers = with lib.maintainers; [ felschr ];
+    maintainers = with lib.maintainers; [
+      felschr
+      pbek
+    ];
     platforms = [ "x86_64-linux" ];
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     mainProgram = "proton-authenticator";

pkgs/by-name/si/signal-desktop/dont-assert-unicode-17-emoji.patch

@@ -0,0 +1,12 @@
+diff --git a/scripts/generate-emoji-data.mjs b/scripts/generate-emoji-data.mjs
+index 85fd8d484..23ca0bb72 100644
+--- a/scripts/generate-emoji-data.mjs
++++ b/scripts/generate-emoji-data.mjs
+@@ -207,7 +207,6 @@ for (const emojiSrc of SRC_EMOJIS_SORTED) {
+   }
+ 
+   const emoji = encodeUnified(emojiSrc.unified);
+-  assert(isEmoji(emoji), 'Unexpected invalid emoji');
+ 
+   if (isDeprecated(emoji)) {
+     continue; // drop deprecated emoji

pkgs/by-name/si/signal-desktop/libsignal-node.nix

@@ -15,23 +15,23 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "libsignal-node";
-  version = "0.92.2";
+  version = "0.94.1";
 
   src = fetchFromGitHub {
     owner = "signalapp";
     repo = "libsignal";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-7VimtFjobM2EQl0cV0K1EIPeV015e+00ljfAfM4KNJI=";
+    hash = "sha256-re9IAC0R2QOIjyOLUjdaJw/TgDA4JT1nhtOskE5A0FQ=";
   };
 
-  cargoHash = "sha256-HBrg//iKNo5/TuVtf9NuVbAyrhul2VVXwC0an7jGEgs=";
+  cargoHash = "sha256-EVwIRUJ8SmajjocZj3dAHkTiR7Q78m/lf+4qls/oZAM=";
 
   npmRoot = "node";
   npmDeps = fetchNpmDeps {
     name = "${finalAttrs.pname}-npm-deps";
     inherit (finalAttrs) version src;
     sourceRoot = "${finalAttrs.src.name}/${finalAttrs.npmRoot}";
-    hash = "sha256-BV5E898u07LLoUVMVRJCHKhp4OJJl2fc5973n16T51k=";
+    hash = "sha256-bEQb+36IB+kXSbIkAFDpeIXWeHoQoIIiHo9q5AbaTio=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/si/signal-desktop/package.nix

@@ -40,13 +40,13 @@ let
   webrtc = callPackage ./webrtc.nix { };
   ringrtc = callPackage ./ringrtc.nix { inherit webrtc; };
 
-  version = "8.9.1";
+  version = "8.13.0";
 
   src = fetchFromGitHub {
     owner = "signalapp";
     repo = "Signal-Desktop";
     tag = "v${version}";
-    hash = "sha256-HXxIjCVGh3JFAj0UUEAvmVnm7jMZdxRqWDILRDFCGw4=";
+    hash = "sha256-gOYnjNCjI1eNVzcb7sx0XDXbhrAdvlgsZQaRuyBXpwI=";
     # Emoji font files will be added in `postFetch` if `withAppleEmojis` is enabled. They
     # are fetched separately below.
     postFetch = ''
@@ -114,16 +114,10 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   patches = [
-    # Custom fonts currently don't work on windows other than the main one,
-    # which causes some of the text to look messed up. We want to include
-    # this patch since we are overriding the emoji font by default.
-    # Upstream PR: https://github.com/signalapp/Signal-Desktop/pull/7864
-    # This patch can be removed after `v8.11.0`.
-    (fetchpatch {
-      url = "https://github.com/signalapp/Signal-Desktop/commit/52ecd0d931e6071da79b016d2af1f508167b2a98.patch";
-      hash = "sha256-dtc0bwv9aLz92j5Zfm/SREWtQ43ljXN9Vm2VkeDbAx8=";
-    })
     ./force-90-days-expiration.patch
+
+    # Drop once https://github.com/NixOS/nixpkgs/pull/520553 and https://github.com/NixOS/nixpkgs/pull/525241 land.
+    ./dont-assert-unicode-17-emoji.patch
   ]
   ++ lib.optional (!withAppleEmojis) (
     # Signal ships the Apple emoji set without a licence and upstream
@@ -180,13 +174,13 @@ stdenv.mkDerivation (finalAttrs: {
       ;
     inherit pnpm;
     fetcherVersion = 3;
-    hash = "sha256-ls7DYPI5Dq06KI7WCdEkKHPsHTMJ3kO0qJDZsHZQHBQ=";
+    hash = "sha256-3EEeHmtOAdcm2Q3eNUEl2RbTFRB4YBKcZLFtEmwbVOk=";
   };
 
   env = {
     ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
     SIGNAL_ENV = "production";
-    SOURCE_DATE_EPOCH = 1778260300;
+    SOURCE_DATE_EPOCH = 1780508208;
   }
   // lib.optionalAttrs stdenv.hostPlatform.isDarwin {
     # Disable code signing during local macOS builds.

pkgs/by-name/si/signal-desktop/replace-apple-emoji-with-noto-emoji.patch

@@ -37,7 +37,7 @@ index d9f558cd4..45a42ecd1 100644
  
  $largeEmojiFont: 'asset:///optional-fonts/emoji-large.woff2';
 diff --git a/stylesheets/components/fun/FunEmoji.scss b/stylesheets/components/fun/FunEmoji.scss
-index f96218420..612538cd3 100644
+index bb1464cd6..efbeca91e 100644
 --- a/stylesheets/components/fun/FunEmoji.scss
 +++ b/stylesheets/components/fun/FunEmoji.scss
 @@ -8,14 +8,12 @@
@@ -54,8 +54,8 @@ index f96218420..612538cd3 100644
 -  content-visibility: auto;
    vertical-align: top;
    letter-spacing: inherit;
- 
-@@ -24,15 +22,6 @@
+   font-style: normal;
+@@ -25,15 +23,6 @@
    color: hsl(from currentColor h s l / 100%);
  }
  
@@ -71,7 +71,7 @@ index f96218420..612538cd3 100644
  .FunStaticEmoji--Blot {
    display: inline-flex;
    margin-bottom: round(-0.4em + 3px, 1px);
-@@ -133,7 +122,6 @@ $inline-emoji-container-name: inline-emoji;
+@@ -134,7 +123,6 @@ $inline-emoji-container-name: inline-emoji;
  
  .FunInlineEmoji {
    z-index: 0;
@@ -79,20 +79,20 @@ index f96218420..612538cd3 100644
    container: $inline-emoji-container-name / inline-size;
    display: inline-block;
    flex: none;
-@@ -142,8 +130,7 @@ $inline-emoji-container-name: inline-emoji;
+@@ -143,8 +131,7 @@ $inline-emoji-container-name: inline-emoji;
    font-size: var(--fun-inline-emoji-size, round(1.4em, 1px));
    line-height: var(--fun-inline-emoji-size, round(1em, 1px));
    letter-spacing: inherit;
 -  content-visibility: auto;
 -  vertical-align: bottom;
 +  vertical-align: text-bottom;
+   font-style: normal;
+   color: hsl(from currentColor h s l / 100%);
  }
- 
- .FunInlineEmoji__Image {
-@@ -170,26 +157,6 @@ $inline-emoji-container-name: inline-emoji;
-   @container #{$inline-emoji-container-name} (width > 64px) {
-     display: none;
-   }
+@@ -169,26 +156,6 @@ $inline-emoji-container-name: inline-emoji;
+   // Inline-block so copying multiple emoji does not insert newlines around
+   // each one in the clipboard plain-text serialization.
+   display: inline-block;
 -
 -  // Emoji font images are slightly higher than optical center
 -  @container #{$inline-emoji-container-name} (width > 16px) {
@@ -117,18 +117,18 @@ index f96218420..612538cd3 100644
  
  .FunInlineEmoji__Jumbo {
 diff --git a/ts/components/fun/FunEmoji.dom.tsx b/ts/components/fun/FunEmoji.dom.tsx
-index 853f8b7cd..f4589f735 100644
+index dd022bbc6..d517f3cb4 100644
 --- a/ts/components/fun/FunEmoji.dom.tsx
 +++ b/ts/components/fun/FunEmoji.dom.tsx
-@@ -31,12 +31,6 @@ function getEmojiJumboUrl(
-   emoji: EmojiVariantData,
+@@ -21,12 +21,6 @@ function getEmojiJumboUrl(
+   emoji: Emoji.Variant,
    size: number | undefined
  ): string | null {
 -  if (size != null && size < MIN_JUMBOMOJI_SIZE) {
 -    return null;
 -  }
--  if (KNOWN_JUMBOMOJI.has(emoji.value)) {
--    return `emoji://jumbo?emoji=${encodeURIComponent(emoji.value)}`;
+-  if (KNOWN_JUMBOMOJI.has(emoji)) {
+-    return `emoji://jumbo?emoji=${encodeURIComponent(emoji)}`;
 -  }
    return null;
  }

pkgs/by-name/si/signal-desktop/ringrtc.nix

@@ -19,16 +19,16 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ringrtc";
-  version = "2.67.0";
+  version = "2.69.0";
 
   src = fetchFromGitHub {
     owner = "signalapp";
     repo = "ringrtc";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-jwLJVq3lkb7HtVigji/1ZKnyaIxyCj+fWCsKe9CjCCM=";
+    hash = "sha256-KQ/zAyj9caArZvl8SwMFfRcye1IzPoChjnYA0A8GcWw=";
   };
 
-  cargoHash = "sha256-X/y2923IBF+ajTyjM4SX9FvkAFiyCYSGnVRYHGKgHko=";
+  cargoHash = "sha256-DlRAPFluKdfU1YutDNQbAEF95aydd+duc6T2hqYWwGQ=";
 
   preConfigure = ''
     # Check for matching webrtc version

pkgs/by-name/si/signal-desktop/signal-sqlcipher.nix

@@ -15,13 +15,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "node-sqlcipher";
-  version = "3.2.1";
+  version = "3.3.5";
 
   src = fetchFromGitHub {
     owner = "signalapp";
     repo = "node-sqlcipher";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-lkSQXiplkY5sBpHsAhW4odWe+MCalAo100EL7h4VKbg=";
+    hash = "sha256-RzuyUx0WEG8j8HwV5cepVJIeqYzJpNemFNtB+9NETto=";
   };
 
   pnpmDeps = fetchPnpmDeps {
@@ -66,8 +66,10 @@ stdenv.mkDerivation (finalAttrs: {
   installPhase = ''
     runHook preInstall
 
+    mkdir $out
     cp -r dist $out
     cp -r prebuilds $out
+    cp package.json $out
 
     runHook postInstall
   '';

pkgs/by-name/si/signal-desktop/webrtc-sources.json

@@ -1,25 +1,25 @@
 {
     "src": {
         "args": {
-            "hash": "sha256-Q5o9fezL7E2J6rn3YxHTtrImCkMTFQL6H+T12d1QOik=",
+            "hash": "sha256-TsVGiR9qXq6AmvPETkCQP7BGgO21/SUwZJZrSXlj7p8=",
             "owner": "signalapp",
             "repo": "webrtc",
-            "tag": "7444h"
+            "tag": "7680g"
         },
         "fetcher": "fetchFromGitHub"
     },
     "src/build": {
         "args": {
-            "hash": "sha256-UHTiL6tMDu/rhSmfy89QQPwEEdU2kS0IaYBhWKKJ4Yo=",
-            "rev": "045565e91c7360951bddbd0618a20ea59cdd31f3",
+            "hash": "sha256-ZPEL0Oy07aAd/qtboCcbD7t55f4EzHiOnE3fiVkZE3Q=",
+            "rev": "a37e61dc22fd633ab32146e7000068a57a2864ff",
             "url": "https://chromium.googlesource.com/chromium/src/build"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/buildtools": {
         "args": {
-            "hash": "sha256-OOCCh0pSzUPpjlaceYIR2VGQ66eAqUAv8x7kgDfBD/0=",
-            "rev": "3e6e75d1961a90054ee0e3030ee66b6a04164c10",
+            "hash": "sha256-wR2qwqxiRmInKzQiVIiZ13SNKuY5k+aJ+dxKAWV1zdo=",
+            "rev": "6a18683f555b4ac8b05ac8395c29c84483ac9588",
             "url": "https://chromium.googlesource.com/chromium/src/buildtools"
         },
         "fetcher": "fetchFromGitiles"
@@ -35,40 +35,40 @@
     },
     "src/testing": {
         "args": {
-            "hash": "sha256-UT4DGNjd+F6liecGeXDwS5Zast4ZriOinbrXAqd96ks=",
-            "rev": "c030c132cbab406942fb208b7180f8846aa4abf1",
+            "hash": "sha256-cE8uCDkhkzFjrEJ3ccXq5H45WJ3wvmirLeeSymnR8bk=",
+            "rev": "b887106bc278bb2a49e21f3a0ab2019574e7e47a",
             "url": "https://chromium.googlesource.com/chromium/src/testing"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party": {
         "args": {
-            "hash": "sha256-qxIivQe2O9L6N5T5RpjtdSXvEFQ4CDZtMSounS8iixw=",
-            "rev": "de738129ebb915bbe34cdf06520c7050ef8aa9d9",
+            "hash": "sha256-fSsA88V0cv/hAJEZJ7p+RnrnkceLMZCa+XaP+1awo9M=",
+            "rev": "e43b96b7a65dd3f45f066983061e6f8b2f3a112d",
             "url": "https://chromium.googlesource.com/chromium/src/third_party"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party/boringssl/src": {
         "args": {
-            "hash": "sha256-yGBxpmWrFURe3gziO3en5ZKs9wAup8XEwHhzq+cKVu8=",
-            "rev": "db638238d29708a20b991af3b2488e45a8bbcf71",
+            "hash": "sha256-4eCoRVe47hZ6hc3gXgBS1gY64d+sPqeI08hNMh6JkUY=",
+            "rev": "305bcfce00b189f2297f53365b0454f96009927d",
             "url": "https://boringssl.googlesource.com/boringssl.git"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party/breakpad/breakpad": {
         "args": {
-            "hash": "sha256-jGdQyM3+p3qt+Hjt44Wpg7XKiUt7kz9Lv1xRG7vp+dM=",
-            "rev": "a1220f673dc44632e821bd1a217089e5a159a203",
+            "hash": "sha256-dtuBGcYwwaqSKiW7ASFveAeJqcdnFLeU97ip8D786/Q=",
+            "rev": "79099fdf668ae097c9eca7052fd5c4c5de6c9098",
             "url": "https://chromium.googlesource.com/breakpad/breakpad.git"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party/catapult": {
         "args": {
-            "hash": "sha256-Is8yDmTyNyseTBPIDwIlhRthqfkFPgQIvu3b6u5c0m0=",
-            "rev": "04c85a1d0e324464c6be4b3d193b47cb6177d03a",
+            "hash": "sha256-Buh+Ixx8CTqBb0vuu/Fnv6fx15lPMOatYGPAgQ0aWEI=",
+            "rev": "39805a224bb6c6e80e403a4ebe9a150c7ca0b4d1",
             "url": "https://chromium.googlesource.com/catapult.git"
         },
         "fetcher": "fetchFromGitiles"
@@ -83,8 +83,8 @@
     },
     "src/third_party/clang-format/script": {
         "args": {
-            "hash": "sha256-d9uweklBffiuCWEb03ti1eFLnMac2qRtvggzXY1n/RU=",
-            "rev": "37f6e68a107df43b7d7e044fd36a13cbae3413f2",
+            "hash": "sha256-f+BbQ6xIubloSzx/MhPSZ8ymCskmS+9+epDGtPjZqXc=",
+            "rev": "c2725e0622e1a86d55f14514f2177a39efea4a0e",
             "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/clang/tools/clang-format.git"
         },
         "fetcher": "fetchFromGitiles"
@@ -99,16 +99,16 @@
     },
     "src/third_party/compiler-rt/src": {
         "args": {
-            "hash": "sha256-MHamj1BEwae6pohqjrMULEp2hrh8+jGDxNgYbzqtGK0=",
-            "rev": "dbef1a89100395f128231024d0c07e4dcfe72140",
+            "hash": "sha256-7Jnb0tzi0SkS9vL7VurdTk6Igz5I8ol4H4nRqcZ2+O0=",
+            "rev": "d606e955eec3d4fb0bf831dea336c3b24cba2f27",
             "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/compiler-rt.git"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party/cpuinfo/src": {
         "args": {
-            "hash": "sha256-JW83AgI1cWv4TSpXNe9sv/hNYAA7MOdUeTHY8+0lHgc=",
-            "rev": "877328f188a3c7d1fa855871a278eb48d530c4c0",
+            "hash": "sha256-eXrfeFK0ADKAYoy/vESv7nQnH0oGpeZKlX8XEqPQspo=",
+            "rev": "84818a41e074779dbb00521a4731d3e14160ff15",
             "url": "https://chromium.googlesource.com/external/github.com/pytorch/cpuinfo.git"
         },
         "fetcher": "fetchFromGitiles"
@@ -123,24 +123,24 @@
     },
     "src/third_party/dav1d/libdav1d": {
         "args": {
-            "hash": "sha256-dPVDZ4SyrHWsRWERUl6UKbbdUG/5dC/UTte6sItMYxg=",
-            "rev": "af5cf2b1e7f03d6f6de84477e1ca8eed1f3eb03d",
+            "hash": "sha256-E3da/LJ8HNy1osExmupovqnL8JHgVNzPUCG5F8TJKXQ=",
+            "rev": "b546257f770768b2c88258c533da38b91a06f737",
             "url": "https://chromium.googlesource.com/external/github.com/videolan/dav1d.git"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party/depot_tools": {
         "args": {
-            "hash": "sha256-oL/WjK90HWqtyE0sJhDUp3UxlC8jr4dZfp+Q80xu3sM=",
-            "rev": "675a3a9ccd7cf9367bb4caa58c30f08b56d45ef5",
+            "hash": "sha256-RsmH8kxnmzOKsrfmDqULDeQsvRr1l+p8ZE1a4bPLVLs=",
+            "rev": "9fd48a305e18b9bbaf61734557ce2c46497192b3",
             "url": "https://chromium.googlesource.com/chromium/tools/depot_tools.git"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party/eigen3/src": {
         "args": {
-            "hash": "sha256-ZXDzAuvTu46YhieLIQ7MSQ0os+v2RF+KBtFuKU9fCWE=",
-            "rev": "430e35fbd15d3c946d2d2ba19ec41c16ba217cb3",
+            "hash": "sha256-GpuSoq887Z1qGKsc4+Vz8X+Sx40P6UnWhaQgrmigkdQ=",
+            "rev": "afb43805349cf1cbec0083d94256bb8f72cbc53b",
             "url": "https://chromium.googlesource.com/external/gitlab.com/libeigen/eigen.git"
         },
         "fetcher": "fetchFromGitiles"
@@ -155,24 +155,24 @@
     },
     "src/third_party/ffmpeg": {
         "args": {
-            "hash": "sha256-ZeFzrCE9LkDcp3VTMJkm5ypX29RGZCyZkp3tEr7yFKU=",
-            "rev": "9e751092c9498b84bbb77e2e0689ef9f50fe608f",
+            "hash": "sha256-LphjwzqsrvAOzd+O+lJ/gGfaWuX4h2/UrRC694ftwSs=",
+            "rev": "9e588ab02e16326026aa61cc3b6515da20520cec",
             "url": "https://chromium.googlesource.com/chromium/third_party/ffmpeg.git"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party/flatbuffers/src": {
         "args": {
-            "hash": "sha256-u5AVjbep3iWwGNXLrkPJUnF8SbmIXlHOYoy3NIlUl/E=",
-            "rev": "1c514626e83c20fffa8557e75641848e1e15cd5e",
+            "hash": "sha256-gV1hn1iHI7knFEXy3Oii97mLRZYJUBiBlTh6/sqOoXg=",
+            "rev": "a86afae9399bbe631d1ea0783f8816e780e236cc",
             "url": "https://chromium.googlesource.com/external/github.com/google/flatbuffers.git"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party/fontconfig/src": {
         "args": {
-            "hash": "sha256-2h0dWn7MxAX+4o2tMZLyjRFAES+FTMaGaf8M7ySkSV8=",
-            "rev": "f0ed9c3f43161d3555f6f7a5234b22fe7ca60727",
+            "hash": "sha256-Oo4ewK86dbEkO5EXyGWvdmsPHa8Wk1BHQah784vIem0=",
+            "rev": "d62c2ab268d1679335daa8fb0ea6970f35224a76",
             "url": "https://chromium.googlesource.com/external/fontconfig.git"
         },
         "fetcher": "fetchFromGitiles"
@@ -187,16 +187,16 @@
     },
     "src/third_party/freetype/src": {
         "args": {
-            "hash": "sha256-b74O5i4xhHq8y0qepP8Wup2nuj9LFzBX7ahMCCVhc98=",
-            "rev": "d3668e00da732654b50e4e81f982544ed6e26390",
+            "hash": "sha256-CorCyTiS2fumIF0jhqQgw7VjGkjGXNVD8efdmfZ2wUo=",
+            "rev": "e3a0652b6d706ee1ce77d4dda606b6597dd8b5c4",
             "url": "https://chromium.googlesource.com/chromium/src/third_party/freetype2.git"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party/fuzztest/src": {
         "args": {
-            "hash": "sha256-gMIDf/Alh9BCk0Gm0m+mmhHoKreHCiN7/WOomcMbS/k=",
-            "rev": "e101ca021a40733d0fa76a3bd9b49b5f76da4f8a",
+            "hash": "sha256-CqJJ1hj9nQkGONB+5tJgafg1xvrPgTuE3tM8RjO2RY0=",
+            "rev": "54dfec04d5c9ad1f22b08002ab6a5e2d0de77671",
             "url": "https://chromium.googlesource.com/external/github.com/google/fuzztest.git"
         },
         "fetcher": "fetchFromGitiles"
@@ -219,24 +219,24 @@
     },
     "src/third_party/google_benchmark/src": {
         "args": {
-            "hash": "sha256-cH8s1gP6kCcojAAfTt5iQCVqiAaSooNk4BdaILujM3w=",
-            "rev": "761305ec3b33abf30e08d50eb829e19a802581cc",
+            "hash": "sha256-GfqY2d+Nd7ovNrXxzTRm/AYWj7GuxIO6FawzUEzwOVA=",
+            "rev": "188e8278990a9069ffc84441cb5a024fd0bede37",
             "url": "https://chromium.googlesource.com/external/github.com/google/benchmark.git"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party/googletest/src": {
         "args": {
-            "hash": "sha256-A3kDQbt9ITaxCjl/tJtwySsPUyH+NNb8erdjBzq81o8=",
-            "rev": "244cec869d12e53378fa0efb610cd4c32a454ec8",
+            "hash": "sha256-gJhv3DQQSP5BQ6GmDobq42/Gkx4AbOg/ZS80bM0WpEw=",
+            "rev": "4fe3307fb2d9f86d19777c7eb0e4809e9694dde7",
             "url": "https://chromium.googlesource.com/external/github.com/google/googletest.git"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party/grpc/src": {
         "args": {
-            "hash": "sha256-JUws1tD5/4mfx/muCkx5FvQoh0Vb2mD5/bIacCAZVAg=",
-            "rev": "de6ce7f32b1bf254d2b4c04e8872b63284632fd3",
+            "hash": "sha256-GvzPndJkPZsVCp0LtaQ29rnORQ7xSZ76if/feEIhvkI=",
+            "rev": "f394c3f07b4c685b9f6948b36d65ca10a629f4fa",
             "url": "https://chromium.googlesource.com/external/github.com/grpc/grpc.git"
         },
         "fetcher": "fetchFromGitiles"
@@ -251,16 +251,16 @@
     },
     "src/third_party/harfbuzz-ng/src": {
         "args": {
-            "hash": "sha256-gUUXBd2/di6MYhUzo0QkGQvRY6KLcy7qdDlSClnmnL8=",
-            "rev": "7d936359a27abb2d7cb14ecc102463bb15c11843",
+            "hash": "sha256-pXAQYEotsqZmfaJSQFaJmZAQVzUiNrHw52z0vmbxQRQ=",
+            "rev": "fa2908bf16d2ccd6623f4d575455fea72a1a722b",
             "url": "https://chromium.googlesource.com/external/github.com/harfbuzz/harfbuzz.git"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party/icu": {
         "args": {
-            "hash": "sha256-k3z31DhDPoqjcZdUL4vjyUMVpUiNk44+7rCMTDVPH8Q=",
-            "rev": "1b2e3e8a421efae36141a7b932b41e315b089af8",
+            "hash": "sha256-zFxeAY6lEFRGNbCOOJij0CFjp3512WkyaN1Ld0+WADs=",
+            "rev": "a86a32e67b8d1384b33f8fa48c83a6079b86f8cd",
             "url": "https://chromium.googlesource.com/chromium/deps/icu.git"
         },
         "fetcher": "fetchFromGitiles"
@@ -291,40 +291,40 @@
     },
     "src/third_party/libaom/source/libaom": {
         "args": {
-            "hash": "sha256-s+fFufuRRGfItmd63IbHCR6ScANkJ49y+fsIGhTdwZE=",
-            "rev": "dcfc0bd1934130570d04597a3b75de0824dc434d",
+            "hash": "sha256-SE9nevzv+e2pVvRECQM0bg3dU1l7rE/4bLPuZDHFi18=",
+            "rev": "557586fde2fdc09dff9c3edf6943d6d54aa8914c",
             "url": "https://aomedia.googlesource.com/aom.git"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party/libc++/src": {
         "args": {
-            "hash": "sha256-IemCFOw1X+Kcna6cuj9e29FUhitqvVGn1DeMCShkbOs=",
-            "rev": "b77132b512d5411f8393fd3decb3abaeaf1d3ec8",
+            "hash": "sha256-7O/X2JW8ghkPTjmFZmT9cgG3Ui5zk3gUb436KlPww34=",
+            "rev": "7ab65651aed6802d2599dcb7a73b1f82d5179d05",
             "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxx.git"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party/libc++abi/src": {
         "args": {
-            "hash": "sha256-7TUY05CW5OCyd1C1oq69rptr1RkvOMS+1CAJc7yKRFQ=",
-            "rev": "864f61dc9253d56586ada34c388278565ef513f6",
+            "hash": "sha256-L5CUvhpOLS+NBNGssCv0pY9rsDFuAI0LlPjXQRfy62A=",
+            "rev": "8f11bb1d4438d0239d0dfc1bd9456a9f31629dda",
             "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxxabi.git"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party/libgav1/src": {
         "args": {
-            "hash": "sha256-BgTfWmbcMvJB1KewJpRcMtbOd2FVuJ+fi1zAXBXfkrg=",
-            "rev": "c05bf9be660cf170d7c26bd06bb42b3322180e58",
+            "hash": "sha256-gisU0p0HDL7Po/ZXIIZVOTnxnOuVvSE/FYo9DaEUFfo=",
+            "rev": "40f58ed32ff39071c3f2a51056dbc49a070af0dc",
             "url": "https://chromium.googlesource.com/codecs/libgav1.git"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party/libjpeg_turbo": {
         "args": {
-            "hash": "sha256-Ig+tmprZDvlf/M72/DTar2pbxat9ZElgSqdXdoM0lPs=",
-            "rev": "e14cbfaa85529d47f9f55b0f104a579c1061f9ad",
+            "hash": "sha256-FeSS7D3NietL34KgpaDFenBf/GcvapGSpkiKwgIOOHs=",
+            "rev": "6bb85251a8382b5e07f635a981ac685cc5ab5053",
             "url": "https://chromium.googlesource.com/chromium/deps/libjpeg_turbo.git"
         },
         "fetcher": "fetchFromGitiles"
@@ -347,56 +347,56 @@
     },
     "src/third_party/libunwind/src": {
         "args": {
-            "hash": "sha256-veSxr/ICnBsdP+3vWjCbPxduHiEzbT0DUdwfo0xcM30=",
-            "rev": "322be580a5a193a921c349a15747eeeb9a716ad1",
+            "hash": "sha256-iRfpzVN+QEpN6okwVs5oEtZqIJYzFGxsUO/IJY1c/W8=",
+            "rev": "ba19d93d6d4f467fba11ff20fe2fc7c056f79345",
             "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libunwind.git"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party/libvpx/source/libvpx": {
         "args": {
-            "hash": "sha256-44k28SJ7AbcABv1YV1tICtJ1II4AXTuvcAELSTUht6c=",
-            "rev": "8d00aca60b951444582b1373e4e47f0ca6e0871c",
+            "hash": "sha256-/FtYzbcOgOlaaWCoJfYns5oye7DoRZx1/xew3lN7tAM=",
+            "rev": "e83e25f791932202256479052f18bdd03a091147",
             "url": "https://chromium.googlesource.com/webm/libvpx.git"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party/libyuv": {
         "args": {
-            "hash": "sha256-9Qn1v9iUrk28bjW9HGepvzEM0wrpmCiA43+a/GPc9/s=",
-            "rev": "5b22f31cb5d39c1309a589f148678c2a217e75db",
+            "hash": "sha256-2lnobd22L9u+h6JGWJoWT/0gjhI5JImDsEjn+RRYzJg=",
+            "rev": "917276084a49be726c90292ff0a6b0a3d571a6af",
             "url": "https://chromium.googlesource.com/libyuv/libyuv.git"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party/llvm-libc/src": {
         "args": {
-            "hash": "sha256-U/ToyQwIzZlaPic6LAnR17ySrZ6eGhReJ6iKVFrIHPg=",
-            "rev": "0c61a55402c6a0d9d6ca2aeb3c6a2613a8bc8c55",
+            "hash": "sha256-ZPsVBO+5v1xR9lvzHi616unK4HEak07Sy/reMSYwiok=",
+            "rev": "d99c56d4b9f6663bff528c4fac5313bceb32e762",
             "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libc.git"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party/lss": {
         "args": {
-            "hash": "sha256-rhp4EcZYdgSfu9cqn+zxxGx6v2IW8uX8V+iA0UfZhFY=",
-            "rev": "ed31caa60f20a4f6569883b2d752ef7522de51e0",
+            "hash": "sha256-89CdA7vBYudbko0nAIyHcpHMXqFZHC05kwRIUmeEWGo=",
+            "rev": "29164a80da4d41134950d76d55199ea33fbb9613",
             "url": "https://chromium.googlesource.com/linux-syscall-support.git"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party/nasm": {
         "args": {
-            "hash": "sha256-TxzAcp+CoKnnM0lCGjm+L3h6M30vYHjM07vW6zUe/vY=",
-            "rev": "e2c93c34982b286b27ce8b56dd7159e0b90869a2",
+            "hash": "sha256-vH3OUzfLZbaPY4DMAvSW0jKYRJmOa7aE8EfIJtZ1/Xs=",
+            "rev": "af5eeeb054bebadfbb79c7bcd100a95e2ad4525f",
             "url": "https://chromium.googlesource.com/chromium/deps/nasm.git"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party/neon_2_sse/src": {
         "args": {
-            "hash": "sha256-AkDAHOPO5NdXXk0hETS5D67mzw0RVXwPDDKqM0XXo5g=",
-            "rev": "eb8b80b28f956275e291ea04a7beb5ed8289e872",
+            "hash": "sha256-4OzG4wIPwnKbFD9LG+stxHt5O4qB85ZIXVeSrNqDAyM=",
+            "rev": "662a85912e8f86ec808f9b15ce77f8715ba53316",
             "url": "https://chromium.googlesource.com/external/github.com/intel/ARM_NEON_2_x86_SSE.git"
         },
         "fetcher": "fetchFromGitiles"
@@ -411,8 +411,8 @@
     },
     "src/third_party/perfetto": {
         "args": {
-            "hash": "sha256-FfOCX3Z7aKGkMAf8hK5itt7+8N5kBRd9NJGjOLiUjQs=",
-            "rev": "d5bbee7afdf259af4212929ccbff467dd5349953",
+            "hash": "sha256-xOFm5u6uwzktkHCLuLmy3ryiuVN8B8Fo+ltHbFmilOY=",
+            "rev": "2074b65d22dd04b65c2688647b9386a63338f0b9",
             "url": "https://chromium.googlesource.com/external/github.com/google/perfetto.git"
         },
         "fetcher": "fetchFromGitiles"
@@ -427,48 +427,48 @@
     },
     "src/third_party/pthreadpool/src": {
         "args": {
-            "hash": "sha256-M9uMq/ZkvrWNep+CIFzx6xLfepLkfY8tjgL7ed2vjU0=",
-            "rev": "f5a07eddbf4be8f23e29e60a2ccf66b78b71f119",
+            "hash": "sha256-Es9QNblzo5b+x4K7myQJwIiUKvqyP16QExWPhGqqDO8=",
+            "rev": "9003ee6c137cea3b94161bd5c614fb43be523ee1",
             "url": "https://chromium.googlesource.com/external/github.com/google/pthreadpool.git"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party/re2/src": {
         "args": {
-            "hash": "sha256-e18aSNVEE42LNzCDMay/Fa3BNg36pBPeEtfNvWqlnWE=",
-            "rev": "6569a9a3df256f4c0c3813cb8ee2f8eef6e2c1fb",
+            "hash": "sha256-oEU+dz8ax1S36+f9OysjB0GnQj8mjZx1VsZ/UgckdDI=",
+            "rev": "972a15cedd008d846f1a39b2e88ce48d7f166cbd",
             "url": "https://chromium.googlesource.com/external/github.com/google/re2.git"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party/ruy/src": {
         "args": {
-            "hash": "sha256-fV0El2ZgjxLqstKVN35SL72+diHNK0FkBmG5UwVZFrk=",
-            "rev": "9940fbf1e0c0863907e77e0600b99bb3e2bc2b9f",
+            "hash": "sha256-zJ7EYxIoZvN2uOfPscKzWycBO057g4bMnTys2sUrp2M=",
+            "rev": "576e020f06334118994496b45f9796ed7fda3280",
             "url": "https://chromium.googlesource.com/external/github.com/google/ruy.git"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party/tflite/src": {
         "args": {
-            "hash": "sha256-9RWrxIDA2vvobr9Cg13SkwfScw+Lk/NCeaPVIXTCKmY=",
-            "rev": "313f58ae85278ced9ccc7f90ee630bdf8735c52f",
+            "hash": "sha256-pIhOSb9eLzel5oDPCpxCvI2XJ2jGLdLURCRkd1BbMkk=",
+            "rev": "01e030d23d3b904d98cbf908da74d63b3c186949",
             "url": "https://chromium.googlesource.com/external/github.com/tensorflow/tensorflow.git"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party/xnnpack/src": {
         "args": {
-            "hash": "sha256-oxpMzIFwJ3L5cYLkwcSL7a8XS1AGHXKQjwtHoe/2mZw=",
-            "rev": "4d098efeac50c44a7c03e6feb1794908db4c3158",
+            "hash": "sha256-OdrwYAazY0E3han/fpFjlAiguY4M/xnCMJjL3KAIhvw=",
+            "rev": "4574c4d9b00703c15f2218634ddf101597b22b18",
             "url": "https://chromium.googlesource.com/external/github.com/google/XNNPACK.git"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/tools": {
         "args": {
-            "hash": "sha256-a3sRfYOVGgroZu25lPS+jGN5Nf/lhfKvKhMl8WiAybs=",
-            "rev": "3b73a00861c1cc1d6308e20786f42045b77864cd",
+            "hash": "sha256-QKFYNmNwVcm7aAP3aeuSrY2ScbgMPs4/odf62dI0WJg=",
+            "rev": "f8f65faf07b1132c9d01932ef95846e9a82b8d54",
             "url": "https://chromium.googlesource.com/chromium/src/tools"
         },
         "fetcher": "fetchFromGitiles"

pkgs/by-name/si/signal-desktop/webrtc.nix

@@ -1,6 +1,7 @@
 {
   stdenv,
   lib,
+  fetchpatch,
   buildPackages,
   ninja,
   gn,
@@ -85,6 +86,19 @@ stdenv.mkDerivation (finalAttrs: {
     alsa-lib
   ];
 
+  patches = [
+    # https://github.com/NixOS/nixpkgs/blob/8e689a91c5b4e47b57dee488dd7e319cc704eb9d/pkgs/applications/networking/browsers/chromium/common.nix#L604-L612
+    # clang++: error: unknown argument: '-fsanitize-ignore-for-ubsan-feature=array-bounds'
+    (fetchpatch {
+      name = "chromium-146-revert-Update-fsanitizer=array-bounds-config.patch";
+      # https://chromium-review.googlesource.com/c/chromium/src/+/7539408
+      url = "https://chromium.googlesource.com/chromium/src/+/acb47d9a6b56c4889a2ed4216e9968cfc740086c^!?format=TEXT";
+      decode = "base64 -d";
+      revert = true;
+      hash = "sha256-WZsN2qm6lX121bDf7SoN75flXtCTmPPpwtHK0ayjkPc=";
+    })
+  ];
+
   postPatch = ''
     substituteInPlace build/toolchain/linux/BUILD.gn \
       --replace-fail 'toolprefix = "aarch64-linux-gnu-"' 'toolprefix = ""'

pkgs/by-name/to/tor-browser/package.nix

@@ -102,7 +102,7 @@ let
     ++ lib.optionals mediaSupport [ ffmpeg_7 ]
   );
 
-  version = "15.0.14";
+  version = "15.0.15";
 
   sources = {
     x86_64-linux = fetchurl {
@@ -112,7 +112,7 @@ let
         "https://tor.eff.org/dist/torbrowser/${version}/tor-browser-linux-x86_64-${version}.tar.xz"
         "https://tor.calyxinstitute.org/dist/torbrowser/${version}/tor-browser-linux-x86_64-${version}.tar.xz"
       ];
-      hash = "sha256-kxRtNraru8w/lAwwhAD2h6Q+CqFdS2DzV2FZHnNj9Q4=";
+      hash = "sha256-UlKf5YPGnPCKzCiFu1dxLg6kg3bJQAcZlwOKE9rTIgQ=";
     };
 
     i686-linux = fetchurl {
@@ -122,7 +122,7 @@ let
         "https://tor.eff.org/dist/torbrowser/${version}/tor-browser-linux-i686-${version}.tar.xz"
         "https://tor.calyxinstitute.org/dist/torbrowser/${version}/tor-browser-linux-i686-${version}.tar.xz"
       ];
-      hash = "sha256-GHLeAyMrnwD5lC4NnwM72nZQeRN7AjrlS/zlOqfmjtw=";
+      hash = "sha256-bIFw4QOIgEQBdcQqjYRKWmy/C0srG0eBBR5H5oteWlo=";
     };
   };
 

pkgs/servers/nextcloud/default.nix

@@ -53,14 +53,14 @@ let
 in
 {
   nextcloud32 = generic {
-    version = "32.0.10";
-    hash = "sha256-D/zIqDOIJezowzco7gzaTvjquI6Pu80Z9IsE4t0KNXo=";
+    version = "32.0.11";
+    hash = "sha256-vvIY5Yeczhy/0Q0gfVG1iiYPGQ1U/VcZkx7coMWdRiQ=";
     packages = nextcloud32Packages;
   };
 
   nextcloud33 = generic {
-    version = "33.0.4";
-    hash = "sha256-9LHNbdBSXGuoiPLMHw8fU3mdbRfLDXz2YFQuxMvNenI=";
+    version = "33.0.5";
+    hash = "sha256-7Ua5HY2k4fAjTQGIslvulEj6LzAYh+WygBPmtUfW3Mo=";
     packages = nextcloud33Packages;
   };
 

pkgs/top-level/all-packages.nix

@@ -11138,8 +11138,6 @@ with pkgs;
     enableUnfree = true;
   };
 
-  inherit (ocamlPackages) hol_light;
-
   isabelle-components = recurseIntoAttrs (callPackage ../by-name/is/isabelle/components { });
 
   lean3 = lean;

pkgs/top-level/ocaml-packages.nix

@@ -2336,8 +2336,6 @@ let
 
         google-drive-ocamlfuse = callPackage ../applications/networking/google-drive-ocamlfuse { };
 
-        hol_light = callPackage ../applications/science/logic/hol_light { };
-
         ### End ###
 
       }
@@ -2348,6 +2346,7 @@ let
         dune_2 = pkgs.dune_2; # Added 2025-12-08
         dune_3 = pkgs.dune_3; # Added 2025-12-08
         gd4o = throw "ocamlPackages.gd4o is not maintained, use ocamlPackages.gd instead";
+        hol_light = pkgs.hol_light; # Added 2026-06-02
         notty = throw "2026-05-05: notty is no longer maintained, use notty-community instead";
         ocaml-freestanding = throw "ocamlPackages.ocaml-freestanding has been removed due to being broken for more than a year; see RFC 180"; # Added 2026-02-05
         ocaml-vdom = throw "2023-10-09: ocamlPackages.ocaml-vdom was renamed to ocamlPackages.vdom";