imagemagick: Generic GCC arch (#544129)

https://www.libssh.org/2026/07/21/libssh-0-12-1-and-0-11-5-security-releases/

Fixes:
CVE-2026-15370: Stack buffer overflow in SFTP server longname construction
CVE-2026-59842: Information disclosure via short GSSAPI Curve25519 public key
CVE-2026-59843: Denial of service via zero advertised channel packet size
CVE-2026-59844: Denial of service via oversized SFTP read length
CVE-2026-59845: Denial of service via unchecked ProxyCommand fork() failure
CVE-2026-59846: Information disclosure via ProxyCommand %r username expansion
CVE-2026-59847: Integrity downgrade via OpenSSL AES-GCM tag verification
CVE-2026-59848: Denial of service via SFTP responses with unknown request IDs
CVE-2026-59849: Denial of service via automatic certificate authentication loop
CVE-2026-59850: Use-after-free via data callbacks on closed channels
CVE-2026-59851: Authentication bypass via missing GSSAPI principal check

.github/workflows/bot.yml

@@ -41,6 +41,10 @@ jobs:
   run:
     runs-on: ubuntu-slim
     if: github.event_name != 'schedule' || github.repository_owner == 'NixOS'
+    env:
+      # TODO: Remove after 2026-03-04, when Node 24 becomes the default.
+      # https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
+      FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:

maintainers/maintainer-list.nix

@@ -1598,12 +1598,6 @@
     githubId = 153175;
     name = "Andrew Marshall";
   };
-  ambiso = {
-    email = "ambisotopy@gmail.com";
-    github = "ambiso";
-    githubId = 3750466;
-    name = "Robin Leander Schröder";
-  };
   ambossmann = {
     email = "timogottszky+git@gmail.com";
     github = "Ambossmann";
@@ -13272,6 +13266,12 @@
     githubId = 879272;
     name = "Julio Merino";
   };
+  jn-sena = {
+    email = "jn-sena@proton.me";
+    github = "jn-sena";
+    githubId = 45771313;
+    name = "Sena";
+  };
   jnsgruk = {
     email = "jon@sgrs.uk";
     github = "jnsgruk";

nixos/doc/manual/redirects.json

@@ -2306,9 +2306,6 @@
   "test-opt-meta.hydraPlatforms": [
     "index.html#test-opt-meta.hydraPlatforms"
   ],
-  "test-opt-meta.teams": [
-    "index.html#test-opt-meta.teams"
-  ],
   "test-opt-meta.timeout": [
     "index.html#test-opt-meta.timeout"
   ],

nixos/lib/testing/meta.nix

@@ -1,20 +1,6 @@
-{ lib, options, ... }:
+{ lib, ... }:
 let
   inherit (lib) types mkOption literalMD;
-
-  # Approximate position of meta.teams / meta.maintainers in nixos tests.
-  # Right now this assumes only one such position and ignores other definitions.
-  # FIXME allow having multiple `maintainersPosition` et al..
-  getPosition =
-    definitionsWithLocations:
-    if definitionsWithLocations == [ ] then
-      null
-    else
-      {
-        file = (lib.head definitionsWithLocations).file;
-        column = 0;
-        line = 1;
-      };
 in
 {
   options = {
@@ -26,7 +12,7 @@ in
       '';
       apply = lib.filterAttrs (k: v: v != null);
       type = types.submodule (
-        { options, config, ... }:
+        { config, ... }:
         {
           options = {
             maintainers = mkOption {
@@ -36,25 +22,6 @@ in
                 The [list of maintainers](https://nixos.org/manual/nixpkgs/stable/#var-meta-maintainers) for this test.
               '';
             };
-            maintainersPosition = mkOption {
-              internal = true;
-              readOnly = true;
-              type = types.nullOr types.attrs;
-              default = getPosition options.maintainers.definitionsWithLocations;
-            };
-            teams = mkOption {
-              type = types.listOf types.raw;
-              default = [ ];
-              description = ''
-                The [list of maintainer-teams](https://nixos.org/manual/nixpkgs/stable/#var-meta-teams) for this test.
-              '';
-            };
-            teamsPosition = mkOption {
-              internal = true;
-              readOnly = true;
-              type = types.nullOr types.attrs;
-              default = getPosition options.teams.definitionsWithLocations;
-            };
             timeout = mkOption {
               type = types.nullOr types.int;
               default = 3600; # 1 hour

nixos/modules/security/account-utils.nix

@@ -6,7 +6,6 @@
 }:
 let
   cfg = config.security.account-utils;
-  format = pkgs.formats.ini { };
 in
 {
   options.security.account-utils = {
@@ -26,16 +25,6 @@ in
         :::
       '';
     };
-    pwaccessd.settings = lib.mkOption {
-      description = ''
-        Options for pwaccessd.
-        See {manpage}`pwaccessd.conf(5)` for available options.
-      '';
-      type = lib.types.submodule {
-        freeformType = format.type;
-      };
-      default = { };
-    };
   };
 
   config = lib.mkIf cfg.enable {
@@ -55,8 +44,6 @@ in
     };
 
     environment.systemPackages = [ cfg.package ];
-    environment.etc."account-utils/pwaccessd.conf".source =
-      format.generate "pwaccessd.conf" cfg.pwaccessd.settings;
 
     security.pam.services = {
       pwupd-passwd = { };

nixos/modules/services/networking/tetrd.nix

@@ -5,19 +5,13 @@
   ...
 }:
 
-let
-  cfg = config.services.tetrd;
-in
 {
-  options.services.tetrd = {
-    enable = lib.mkEnableOption "tetrd";
-    package = lib.mkPackageOption pkgs "tetrd" { };
-  };
+  options.services.tetrd.enable = lib.mkEnableOption "tetrd";
 
-  config = lib.mkIf cfg.enable {
+  config = lib.mkIf config.services.tetrd.enable {
     environment = {
-      systemPackages = [ cfg.package ];
-      # etc."resolv.conf".source = "/etc/tetrd/resolv.conf"; # Disabled overwriting of resolve.conf since otherwise tetrd disables your dns when its not connected to a device.
+      systemPackages = [ pkgs.tetrd ];
+      etc."resolv.conf".source = "/etc/tetrd/resolv.conf";
     };
 
     # Our resolv.conf will override resolvconf's version.
@@ -27,11 +21,11 @@ in
       tmpfiles.rules = [ "f /etc/tetrd/resolv.conf - - -" ];
 
       services.tetrd = {
-        description = cfg.package.meta.description;
+        description = pkgs.tetrd.meta.description;
         wantedBy = [ "multi-user.target" ];
 
         serviceConfig = {
-          ExecStart = "${cfg.package}/opt/Tetrd/bin/tetrd";
+          ExecStart = "${pkgs.tetrd}/opt/Tetrd/bin/tetrd";
           Restart = "always";
           RuntimeDirectory = "tetrd";
           RootDirectory = "/run/tetrd";

nixos/modules/services/web-apps/bentopdf.nix

@@ -60,7 +60,7 @@ in
     services.nginx = lib.mkIf cfg.nginx.enable {
       enable = lib.mkDefault true;
       virtualHosts."${cfg.domain}" = lib.mkMerge [
-        (lib.mapAttrsRecursive (_: lib.mkDefault) cfg.nginx.virtualHost)
+        cfg.nginx.virtualHost
         {
           root = lib.mkForce "${cfg.package}";
 
@@ -82,7 +82,7 @@ in
     services.caddy = lib.mkIf cfg.caddy.enable {
       enable = lib.mkDefault true;
       virtualHosts."${cfg.domain}" = lib.mkMerge [
-        (lib.mapAttrsRecursive (_: lib.mkDefault) cfg.caddy.virtualHost)
+        cfg.caddy.virtualHost
         {
           hostName = lib.mkForce cfg.domain;
           extraConfig = ''

nixos/modules/services/web-apps/flarum.nix

@@ -10,23 +10,16 @@ with lib;
 let
   cfg = config.services.flarum;
 
-  # Only placeholders reach the world-readable Nix store; the install
-  # script substitutes the real secrets at runtime.
   flarumInstallConfig = pkgs.writeText "config.json" (
     builtins.toJSON {
       debug = false;
       offline = false;
 
       baseUrl = cfg.baseUrl;
-      databaseConfiguration =
-        cfg.database
-        // optionalAttrs (cfg.databasePasswordFile != null) {
-          password = "@databasePassword@";
-        };
+      databaseConfiguration = cfg.database;
       adminUser = {
         username = cfg.adminUser;
-        password =
-          if cfg.initialAdminPasswordFile != null then "@adminPassword@" else cfg.initialAdminPassword;
+        password = cfg.initialAdminPassword;
         email = cfg.adminEmail;
       };
       settings = {
@@ -76,26 +69,7 @@ in
     initialAdminPassword = mkOption {
       type = types.str;
       default = "flarum";
-      description = ''
-        Initial password for the adminUser.
-
-        WARNING: This is stored world-readable in the Nix store.
-        Use {option}`initialAdminPasswordFile` instead.
-      '';
-    };
-
-    initialAdminPasswordFile = mkOption {
-      type = types.nullOr types.path;
-      default = null;
-      example = "/run/secrets/flarum-admin-password";
-      description = ''
-        File containing the initial password for adminUser.
-        Must be readable by the flarum user.
-        Takes precedence over {option}`initialAdminPassword`.
-
-        The password must not contain `"` or `\` characters, as it is
-        substituted into a JSON installation config verbatim.
-      '';
+      description = "Initial password for the adminUser";
     };
 
     user = mkOption {
@@ -124,12 +98,7 @@ in
           bool
           int
         ]);
-      description = ''
-        MySQL database parameters.
-
-        WARNING: A `password` set here is stored world-readable in the
-        Nix store. Use {option}`databasePasswordFile` instead.
-      '';
+      description = "MySQL database parameters";
       default = {
         # the database driver; i.e. MySQL; MariaDB...
         driver = "mysql";
@@ -149,20 +118,6 @@ in
       };
     };
 
-    databasePasswordFile = mkOption {
-      type = types.nullOr types.path;
-      default = null;
-      example = "/run/secrets/flarum-db-password";
-      description = ''
-        File containing the database password.
-        Must be readable by the flarum user.
-        Takes precedence over `database.password`.
-
-        The password must not contain `"` or `\` characters, as it is
-        substituted into a JSON installation config verbatim.
-      '';
-    };
-
     createDatabaseLocally = mkOption {
       type = types.bool;
       default = false;
@@ -255,8 +210,6 @@ in
         Type = "oneshot";
         User = cfg.user;
         Group = cfg.group;
-        # The secret-filled install config is staged in /tmp
-        PrivateTmp = true;
       };
       path = [ config.services.phpfpm.phpPackage ];
       script = ''
@@ -269,18 +222,7 @@ in
       ''
       + optionalString (cfg.createDatabaseLocally && cfg.database.driver == "mysql") ''
         if [ ! -f config.php ]; then
-          install -m 0600 ${flarumInstallConfig} /tmp/flarum-install.json
-          ${optionalString (cfg.initialAdminPasswordFile != null) ''
-            ${pkgs.replace-secret}/bin/replace-secret '@adminPassword@' \
-              ${escapeShellArg cfg.initialAdminPasswordFile} /tmp/flarum-install.json
-          ''}
-          ${optionalString (cfg.databasePasswordFile != null) ''
-            ${pkgs.replace-secret}/bin/replace-secret '@databasePassword@' \
-              ${escapeShellArg cfg.databasePasswordFile} /tmp/flarum-install.json
-          ''}
-          php flarum install --file=/tmp/flarum-install.json
-          # config.php contains the database password; stateDir is world-readable
-          chmod 600 config.php
+          php flarum install --file=${flarumInstallConfig}
         fi
       ''
       + ''

nixos/modules/services/web-servers/caddy/default.nix

@@ -448,8 +448,8 @@ in
     '';
 
     # https://github.com/quic-go/quic-go/wiki/UDP-Buffer-Sizes
-    boot.kernel.sysctl."net.core.rmem_max" = mkDefault 7500000;
-    boot.kernel.sysctl."net.core.wmem_max" = mkDefault 7500000;
+    boot.kernel.sysctl."net.core.rmem_max" = mkDefault 2500000;
+    boot.kernel.sysctl."net.core.wmem_max" = mkDefault 2500000;
 
     systemd.packages = [ cfg.package ];
     systemd.services.caddy = {

nixos/tests/flarum.nix

@@ -10,7 +10,7 @@
   };
 
   nodes.machine =
-    { pkgs, ... }:
+    { ... }:
     {
       # Flarum installs and migrates the database on first boot and runs a
       # MariaDB server alongside PHP-FPM and nginx, so give the VM some headroom.
@@ -28,11 +28,8 @@
 
         adminUser = "admin";
         adminEmail = "admin@example.com";
-        # The trailing newline matches how secret managers typically write files.
-        initialAdminPasswordFile = "${pkgs.writeText "admin-pass" "flarum-admin-password\n"}";
-        # MariaDB authenticates via unix socket and never checks this password;
-        # setting it still exercises the substitution path.
-        databasePasswordFile = "${pkgs.writeText "db-pass" "flarum-db-password\n"}";
+        # Flarum rejects admin passwords shorter than 8 characters.
+        initialAdminPassword = "flarum-admin-password";
       };
     };
 
@@ -51,23 +48,5 @@
 
     # The admin API endpoint should respond, confirming the app booted cleanly.
     machine.succeed("curl -sf http://localhost/api -o /dev/null")
-
-    # Only the placeholders may appear in the install config in the Nix store.
-    machine.succeed("grep -q '@adminPassword@' /nix/store/*-config.json")
-    machine.succeed("grep -q '@databasePassword@' /nix/store/*-config.json")
-    machine.fail("grep -qe 'flarum-admin-password' -e 'flarum-db-password' /nix/store/*-config.json")
-
-    # A successful login proves the admin password was substituted intact.
-    machine.succeed(
-        "curl -sf http://localhost/api/token "
-        + "-H 'Content-Type: application/json' "
-        + "-d '{\"identification\": \"admin\", \"password\": \"flarum-admin-password\"}' "
-        + "| grep -F token"
-    )
-
-    # The database password must arrive intact in config.php, which must
-    # not be world-readable.
-    machine.succeed("grep -q 'flarum-db-password' /var/lib/flarum/config.php")
-    machine.succeed("[ $(stat -c %a /var/lib/flarum/config.php) = 600 ]")
   '';
 }

nixos/tests/geoclue2.nix

@@ -31,6 +31,6 @@
       assert ("Latitude:    12.345000°" in whereAmI), f"Incorrect latitude in:\n{whereAmI}"
       assert ("Longitude:   -67.890000°" in whereAmI), f"Incorrect longitude in:\n{whereAmI}"
       assert ("Altitude:    123.450000 meters" in whereAmI), f"Incorrect altitude in:\n{whereAmI}"
-      assert ("Accuracy:    1000.000000 meters" in whereAmI), f"Incorrect accuracy in:\n{whereAmI}"
+      assert ("Accuracy:    1000 meters" in whereAmI), f"Incorrect accuracy in:\n{whereAmI}"
     '';
 }

nixos/tests/login-nosuid.nix

@@ -11,12 +11,7 @@
     {
       security.enableWrappers = false;
       systemd.settings.Manager.NoNewPrivileges = true;
-      security.account-utils = {
-        enable = true;
-        pwaccessd.settings = {
-          ExpiredCheck.SpMin = true;
-        };
-      };
+      security.account-utils.enable = true;
       users.mutableUsers = true;
       security.account-utils.extraArgs = [
         "-v"
@@ -51,9 +46,6 @@
         print(f"passwd path is: {passwd_path}")
         assert "account-utils" in passwd_path
 
-    with subtest("config file exists"):
-        machine.succeed("ls /etc/account-utils/pwaccessd.conf")
-
     with subtest("create user"):
         machine.succeed("useradd -m alice")
         machine.succeed("(echo foobar; echo foobar) | passwd alice")

nixos/tests/systemd-boot.nix

@@ -460,19 +460,17 @@ in
       nodes.machine = common;
 
       testScript =
-        let
-          oldVersion = "222";
-        in
         # python
         ''
           machine.succeed("mount -o remount,rw /boot")
 
           def switch():
-              # Replace version inside sd-boot with something older. See magic[] string in systemd src/boot/efi/boot.c
+              # Replace version inside sd-boot with something older. See SD_MAGIC in systemd src/boot/boot.c
+              # Note: the sed replacement has to be length-preserving, because section length matters.
               machine.succeed(
-                """
+                r"""
                 find /boot -iname '*boot*.efi' -print0 | \
-                xargs -0 -I '{}' sed -i 's/#### LoaderInfo: systemd-boot .* ####/#### LoaderInfo: systemd-boot ${oldVersion} ####/' '{}'
+                xargs -0 -I '{}' sed -i 's/#### LoaderInfo: systemd-boot [0-9]\(.*\) ####/#### LoaderInfo: systemd-boot 0\1 ####/' '{}'
                 """
               )
               return machine.succeed("/run/current-system/bin/switch-to-configuration boot 2>&1")

pkgs/applications/editors/vscode/extensions/pkief.material-icon-theme/default.nix

@@ -6,8 +6,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "material-icon-theme";
     publisher = "PKief";
-    version = "5.37.0";
-    hash = "sha256-remt7+OQnOqSrtUoUN3QCXXR3Bti/lWIMfb7i4j3w84=";
+    version = "5.36.1";
+    hash = "sha256-1yxTjIsyj8o97VlvDlWqPCNIxd6XgbjpqF5qNbVtEwg=";
   };
   meta = {
     description = "Material Design Icons for Visual Studio Code";

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -119,13 +119,13 @@
     "vendorHash": "sha256-kvHI8cd/rl9kVKKzSwjrC0+Qikz3w2P9jgLvYa+T2DE="
   },
   "brightbox_brightbox": {
-    "hash": "sha256-bvwdtiwzXElhsXLmftXZQ567ExcC0E0L/5OeqIdp1SQ=",
+    "hash": "sha256-pwFbCP+qDL/4IUfbPRCkddkbsEEeAu7Wp12/mDL0ABA=",
     "homepage": "https://registry.terraform.io/providers/brightbox/brightbox",
     "owner": "brightbox",
     "repo": "terraform-provider-brightbox",
-    "rev": "v3.4.4",
+    "rev": "v3.4.3",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-TLNHhSyMw0rKFtd9EChg7zSGoxe57rh36nAPqu1j8w8="
+    "vendorHash": "sha256-/dOiXO2aPkuZaFiwv/6AXJdIADgx8T7eOwvJfBBoqg8="
   },
   "buildkite_buildkite": {
     "hash": "sha256-egeZCTQFyhKG0giyjNK9C/W+OGMOGv2l+65Vg3iTi2A=",
@@ -589,13 +589,13 @@
     "vendorHash": "sha256-moP2fqZnj8J6IFAhb0n6pikVYVg2Is22xd/xuuJ+zIQ="
   },
   "hashicorp_google-beta": {
-    "hash": "sha256-wf+pFYuDMqlFYvaTKTpgaeSSBoLgQlUAarobUAotLMo=",
+    "hash": "sha256-pEdNv1MViCsCb3wFoDghCeQ5q2FErtGrQL9noL5B11g=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/google-beta",
     "owner": "hashicorp",
     "repo": "terraform-provider-google-beta",
-    "rev": "v7.40.0",
+    "rev": "v7.39.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-7f0HZQXVsIq7m8CUApTnHIroOjKwT1GaP+GjCf4C6n0="
+    "vendorHash": "sha256-u4zldvOO/TtNHC8B+c63DWMbk7iEix+S+y/RLExchI8="
   },
   "hashicorp_helm": {
     "hash": "sha256-Dw6khnp0pronRKbBv2gx8ygtVvRV9uQIHCXj2BblZ6k=",
@@ -1274,11 +1274,11 @@
     "vendorHash": "sha256-9M1DsE/FPQK8TG7xCJWbU3HAJCK3p/7lxdzjO1oAfWs="
   },
   "sumologic_sumologic": {
-    "hash": "sha256-h4ipmgcEK8Cv9/gQwdOtQqbhfXO/QXJsrHHV6O1HtL8=",
+    "hash": "sha256-MraUjj18ooGYfOnsEJ0oCPIFQITagNRGMeAqZqEQWU4=",
     "homepage": "https://registry.terraform.io/providers/SumoLogic/sumologic",
     "owner": "SumoLogic",
     "repo": "terraform-provider-sumologic",
-    "rev": "v3.2.10",
+    "rev": "v3.2.9",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-nbiLH+J051XxTx+z8xGrp/DPYB7g9S4clFSWcZUKnAg="
   },

pkgs/by-name/ad/addchain/package.nix

@@ -1,44 +0,0 @@
-{
-  lib,
-  buildGoModule,
-  fetchFromGitHub,
-  nix-update-script,
-}:
-buildGoModule rec {
-  pname = "addchain";
-  version = "0.4.0";
-
-  src = fetchFromGitHub {
-    owner = "mmcloughlin";
-    repo = "addchain";
-    tag = "v${version}";
-    fetchSubmodules = false;
-    hash = "sha256-msuZgNYqN1QldrbXJJ4BFXYhUsllAPt8W0KRrr8p6TM=";
-  };
-
-  vendorHash = "sha256-qxlVGkbm95WFmH0+48XRXwrF7HRUWFxYHFzmFOaj4GA=";
-
-  ldflags = [
-    "-s"
-    "-w"
-    "-X github.com/mmcloughlin/addchain/meta.buildversion=${version}"
-  ];
-
-  passthru = {
-    updateScript = nix-update-script { };
-  };
-
-  subPackages = [ "cmd/addchain" ];
-
-  __structuredAttrs = true;
-
-  meta = {
-    description = "addchain generates short addition chains for exponents of cryptographic interest with results rivaling the best hand-optimized chains";
-    homepage = "https://github.com/mmcloughlin/addchain";
-    license = lib.licenses.bsd3;
-    maintainers = with lib.maintainers; [
-      ambiso
-    ];
-    mainProgram = "addchain";
-  };
-}

pkgs/by-name/ag/ags/package.nix

@@ -105,6 +105,7 @@ buildGoModule (finalAttrs: {
     changelog = "https://github.com/Aylur/ags/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.gpl3Plus;
     maintainers = with lib.maintainers; [
+      PerchunPak
       johnrtitor
     ];
     mainProgram = "ags";

pkgs/by-name/ai/air-formatter/package.nix

@@ -8,17 +8,17 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "air-formatter";
-  version = "0.11.0";
+  version = "0.10.0";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "posit-dev";
     repo = "air";
     tag = finalAttrs.version;
-    hash = "sha256-BWtQLgNFf/kULGvet33k3T1k2oL1hbDn2VPCj0JxrX4=";
+    hash = "sha256-u0icSo6aW6tLgY57RPAoVte5Awn16FLIvZEeeYNr5fk=";
   };
 
-  cargoHash = "sha256-xcNVioDbejCLrWMaUA06r9GK5KEIPq6w0W7G7290kOU=";
+  cargoHash = "sha256-51xkTVs6j7n0os5wHWxpFC/uLHm3tz+SiWUHsd+bNRw=";
 
   useNextest = true;
 

pkgs/by-name/an/anytype/package.nix

@@ -143,11 +143,6 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     substituteInPlace scripts/generate-protos.sh \
       --replace-fail "/usr/bin/env" "${coreutils}/bin/env"
 
-    substituteInPlace package.json \
-      --replace-fail \
-        '"build:nmh": "go build -o dist/nativeMessagingHost ./go/nativeMessagingHost.go"' \
-        '"build:nmh": "go build -trimpath -ldflags=-buildid= -o dist/nativeMessagingHost ./go/nativeMessagingHost.go"'
-
     cp -r ${anytype-heart}/lib dist/
     cp -r ${anytype-heart}/bin/anytypeHelper dist/
 
@@ -173,9 +168,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   # remove unnecessary files
   preInstall = ''
     chmod u+w -R dist node_modules
-    find dist node_modules -type f \( -name '*.ts' -o -name '*.map' \) -delete
-    rm -f node_modules/keytar/build/{Makefile,binding.Makefile,config.gypi,keytar.target.mk}
-    rm -rf node_modules/keytar/build/Release/{.deps,obj.target}
+    find -type f \( -name "*.ts" -o -name "*.map" \) -exec rm -rf {} +
   '';
 
   installPhase = ''

pkgs/by-name/at/at/package.nix

@@ -32,16 +32,17 @@ stdenv.mkDerivation (finalAttrs: {
   postPatch = ''
     # Remove chown commands and setuid bit
     substituteInPlace Makefile.in \
-      --replace-fail ' -o root ' ' ' \
-      --replace-fail ' -g root ' ' ' \
-      --replace-fail ' -o $(DAEMON_USERNAME) ' ' ' \
-      --replace-fail ' -g $(DAEMON_GROUPNAME) ' ' ' \
-      --replace-fail '$(DESTDIR)$(etcdir)' "$out/etc" \
-      --replace-fail '$(DESTDIR)$(ATJOB_DIR)' "$out/var/spool/atjobs" \
-      --replace-fail '$(DESTDIR)$(ATSPOOL_DIR)' "$out/var/spool/atspool" \
-      --replace-fail '$(DESTDIR)$(LFILE)' "$out/var/spool/atjobs/.SEQ" \
-      --replace-fail 'chown' '# skip chown' \
-      --replace-fail '6755' '0755'
+      --replace ' -o root ' ' ' \
+      --replace ' -g root ' ' ' \
+      --replace ' -o $(DAEMON_USERNAME) ' ' ' \
+      --replace ' -o $(DAEMON_GROUPNAME) ' ' ' \
+      --replace ' -g $(DAEMON_GROUPNAME) ' ' ' \
+      --replace '$(DESTDIR)$(etcdir)' "$out/etc" \
+      --replace '$(DESTDIR)$(ATJOB_DIR)' "$out/var/spool/atjobs" \
+      --replace '$(DESTDIR)$(ATSPOOL_DIR)' "$out/var/spool/atspool" \
+      --replace '$(DESTDIR)$(LFILE)' "$out/var/spool/atjobs/.SEQ" \
+      --replace 'chown' '# skip chown' \
+      --replace '6755' '0755'
   '';
 
   nativeBuildInputs = [
@@ -56,7 +57,7 @@ stdenv.mkDerivation (finalAttrs: {
     export SENDMAIL=${sendmailPath}
     # Purity: force atd.pid to be placed in /var/run regardless of
     # whether it exists now.
-    substituteInPlace ./configure --replace-fail "test -d /var/run" "true"
+    substituteInPlace ./configure --replace "test -d /var/run" "true"
   '';
 
   configureFlags = [

pkgs/by-name/aw/aws-vault/package.nix

@@ -10,17 +10,17 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "aws-vault";
-  version = "7.13.0";
+  version = "7.12.4";
 
   src = fetchFromGitHub {
     owner = "ByteNess";
     repo = "aws-vault";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-afmApbIydrouoXmu3inLE9EvwFqOJxVkNcVSDjZUcXY=";
+    hash = "sha256-0jPtqViGD0Xfn0yn2Buh4LwVAiSn7YvDMpNZYirHUmk=";
   };
 
   proxyVendor = true;
-  vendorHash = "sha256-I+yKJO+MOCd+wZn4uQt+Xg18b/PWYPm6qxzGEOsCACo=";
+  vendorHash = "sha256-pqD3j1I0zENctgM2lBaYiU3DRCqeq9XIX3jWB2p139I=";
 
   nativeBuildInputs = [
     installShellFiles

pkgs/by-name/ca/cacert/package.nix

@@ -20,7 +20,7 @@ let
     lib.concatStringsSep "\n\n" extraCertificateStrings
   );
 
-  version = "3.125";
+  version = "3.126";
   meta = {
     homepage = "https://firefox-source-docs.mozilla.org/security/nss/runbooks/rootstore.html#root-store-consumers";
     description = "Bundle of X.509 certificates of public Certificate Authorities (CA)";
@@ -52,7 +52,7 @@ stdenv.mkDerivation {
         "https://hg-edge.mozilla.org/projects/nss/raw-file/${tag}/${file}"
         "https://raw.githubusercontent.com/nss-dev/nss/refs/tags/${tag}/${file}"
       ];
-    hash = "sha256-5XkSgI2u97Kw+k3yzPF+R66vJsg5o4+Fx2AD66/YZr0=";
+    hash = "sha256-gbfyV2MzouNg5nP5Etewt6dl2DbHMQA+NIpGysXTcZg=";
   };
 
   unpackPhase = ''

pkgs/by-name/ca/cargo-seek/package.nix

@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-seek";
-  version = "0.2.0";
+  version = "0.1.0";
 
   src = fetchFromGitHub {
     owner = "tareqimbasher";
     repo = "cargo-seek";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-WL1S2oU3/T9pEI4rgzT2dJ/ZTiwS/BgraW1MmZ5MQl0=";
+    hash = "sha256-SDVAi4h+/ebGX+8M66Oyd0LfQn+J7/QhDW97ZBdoN14=";
   };
 
-  cargoHash = "sha256-cXZvuMcNGNWU61ll2dAFxPKWujJNzXpC8aP5vxDONkY=";
+  cargoHash = "sha256-DyXRbtvCJte7mCQKusipeikr981vMHPEVYcGSwVI5Kg=";
 
   nativeBuildInputs = [ pkg-config ];
 
@@ -40,7 +40,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     homepage = "https://github.com/tareqimbasher/cargo-seek";
     changelog = "https://github.com/tareqimbasher/cargo-seek/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ yvnth ];
+    maintainers = [ ];
     mainProgram = "cargo-seek";
   };
 })

pkgs/by-name/cl/clickhouse/generic.nix

@@ -165,17 +165,8 @@ llvmStdenv.mkDerivation (finalAttrs: {
       gitHash = rev;
     in
     ''
-      # Preserve VERSION_REVISION from the source tree, like ClickHouse CI
-      # does. It identifies the server release line to clients (exposed via
-      # the revision() SQL function)
-      versionRevision=$(sed -n 's/^SET(VERSION_REVISION \([0-9]\{1,\}\))$/\1/p' cmake/autogenerated_versions.txt)
-      if [[ -z "$versionRevision" ]]; then
-        echo "Could not extract VERSION_REVISION from cmake/autogenerated_versions.txt" >&2
-        exit 1
-      fi
-
-      cat <<EOF > cmake/autogenerated_versions.txt
-      SET(VERSION_REVISION $versionRevision)
+      cat <<'EOF' > cmake/autogenerated_versions.txt
+      SET(VERSION_REVISION 0)
       SET(VERSION_MAJOR ${major})
       SET(VERSION_MINOR ${minor})
       SET(VERSION_PATCH ${patch})

pkgs/by-name/ct/ctypes_sh/package.nix

@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ctypes.sh";
-  version = "1.3";
+  version = "1.2";
 
   src = fetchFromGitHub {
     owner = "taviso";
     repo = "ctypes.sh";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-ZYsjySJaxyLAiyGaNwngA7ef6vA+fUTCh9hi5g55v+g=";
+    sha256 = "1wafyfhwd7nf7xdici0djpwgykizaz7jlarn0r1b4spnpjx1zbx4";
   };
 
   nativeBuildInputs = [

pkgs/by-name/da/dart-sass/package.nix

@@ -23,13 +23,13 @@ let
 in
 buildDartApplication rec {
   pname = "dart-sass";
-  version = "1.101.2";
+  version = "1.101.0";
 
   src = fetchFromGitHub {
     owner = "sass";
     repo = "dart-sass";
     tag = version;
-    hash = "sha256-7q42Dv1HUWxeXa4j306ssKJrBsPKAFezqntx4mZXgw0=";
+    hash = "sha256-hs028qXBzRGrh9xZAQGaFw7iXtkQm9fixMuBohupjrI=";
   };
 
   pubspecLock = lib.importJSON ./pubspec.lock.json;

pkgs/by-name/da/dart-sass/pubspec.lock.json

@@ -4,21 +4,21 @@
       "dependency": "transitive",
       "description": {
         "name": "_fe_analyzer_shared",
-        "sha256": "1b0e6a07425a3e460666e88bf1c949ccc7bb0116ad562ce94a1eca60fe820725",
+        "sha256": "3b19a47f6ea7c2632760777c78174f47f6aec1e05f0cd611380d4593b8af1dbc",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "103.0.0"
+      "version": "96.0.0"
     },
     "analyzer": {
       "dependency": "direct dev",
       "description": {
         "name": "analyzer",
-        "sha256": "61c04d0c1bfed555c681ea079519933f071a5a026578ff73c4ff0df2d3462e5e",
+        "sha256": "0c516bc4ad36a1a75759e54d5047cb9d15cded4459df01aa35a0b5ec7db2c2a0",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "13.3.0"
+      "version": "10.2.0"
     },
     "archive": {
       "dependency": "direct dev",
@@ -94,11 +94,11 @@
       "dependency": "direct main",
       "description": {
         "name": "cli_pkg",
-        "sha256": "1b3915a8924e8a495ec24b8ee076c182211d0bd563699a2c8ed9af33bf296af8",
+        "sha256": "8343ec3b11f163ab105687d6bad5432ef49b95d15137ec44a28c8cef918b5150",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.15.2"
+      "version": "2.15.1"
     },
     "cli_repl": {
       "dependency": "direct main",
@@ -114,11 +114,11 @@
       "dependency": "direct dev",
       "description": {
         "name": "cli_util",
-        "sha256": "5909d2c6b66817222779e1eedc19e0e28b76d1df7bd9856a4792ccb9881df358",
+        "sha256": "ff6785f7e9e3c38ac98b2fb035701789de90154024a75b6cb926445e83197d1c",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.5.1"
+      "version": "0.4.2"
     },
     "collection": {
       "dependency": "direct main",
@@ -184,21 +184,21 @@
       "dependency": "transitive",
       "description": {
         "name": "dart_style",
-        "sha256": "3f88fc9c96c568d631356507355a2d1e983ee000c9ac008bdcb39b5bf53ce777",
+        "sha256": "29f7ecc274a86d32920b1d9cfc7502fa87220da41ec60b55f329559d5732e2b2",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "3.1.12"
+      "version": "3.1.7"
     },
     "dartdoc": {
       "dependency": "direct dev",
       "description": {
         "name": "dartdoc",
-        "sha256": "deb9e1d80cd0fd66139c5690315a5004150fd5c85a16d97459360531aa9e3702",
+        "sha256": "c60c01dc5aeb095a3b7b875150fe0e50b46330aec5d3417e7bae235ccd8a00ab",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "9.0.8"
+      "version": "9.0.4"
     },
     "ffi": {
       "dependency": "transitive",
@@ -254,11 +254,11 @@
       "dependency": "direct dev",
       "description": {
         "name": "grinder",
-        "sha256": "8c65fc6c0c0748c2d9080c1fb603d7a9640bf5a5eda29f35099bd351cc45093f",
+        "sha256": "e1996e485d2b56bb164a8585679758d488fbf567273f51c432c8733fee1f6188",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.10.0"
+      "version": "0.9.5"
     },
     "html": {
       "dependency": "transitive",
@@ -374,11 +374,11 @@
       "dependency": "direct main",
       "description": {
         "name": "meta",
-        "sha256": "307249ce4ff29d58a18e97f6345f539382eb9c9c29ecda628900f31de0443dd9",
+        "sha256": "c82594181e3312f3d0695fc95aaaf7758d75b8d4ae2bbecf223b9fd5109a059d",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.19.0"
+      "version": "1.18.3"
     },
     "mime": {
       "dependency": "transitive",
@@ -674,31 +674,31 @@
       "dependency": "direct dev",
       "description": {
         "name": "test",
-        "sha256": "0d5ba5602ec3baa28c8ce365e1efc5575969c765f45c554a3e167dc7945b9c30",
+        "sha256": "ca578dc12bb8b2f40b67b7d3bd2fac4f31c01a6ff7130a14e2597b919934507f",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.31.2"
+      "version": "1.31.1"
     },
     "test_api": {
       "dependency": "transitive",
       "description": {
         "name": "test_api",
-        "sha256": "475610b2aa23c19687cce2961e44b0cc57cafe220f67c2b80201231b2a07fbe7",
+        "sha256": "2a122cbe059f8b610d3a5415f42e255b6c17b1f21eee1d960f31080237fb4f11",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.7.13"
+      "version": "0.7.12"
     },
     "test_core": {
       "dependency": "transitive",
       "description": {
         "name": "test_core",
-        "sha256": "a39c204a4fc7a7ccb04a2b985e359fda3cc37e45e0b8ac61c3fb1a05aa832132",
+        "sha256": "d2e98ec12998368dc59ddd47ab709f2cd55acd6b66dc7db764455a44082f4bc5",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.6.19"
+      "version": "0.6.18"
     },
     "test_descriptor": {
       "dependency": "direct dev",
@@ -804,11 +804,11 @@
       "dependency": "transitive",
       "description": {
         "name": "xml",
-        "sha256": "67f0aff7be013d107995e9b75bf4e7f2c3ef2dfdb2c8e68024bba0a7fd5756a4",
+        "sha256": "971043b3a0d3da28727e40ed3e0b5d18b742fa5a68665cca88e74b7876d5e025",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "7.0.1"
+      "version": "6.6.1"
     },
     "yaml": {
       "dependency": "direct dev",
@@ -822,6 +822,6 @@
     }
   },
   "sdks": {
-    "dart": ">=3.11.0 <4.0.0"
+    "dart": ">=3.10.0 <4.0.0"
   }
 }

pkgs/by-name/di/diff-so-fancy/package.nix

@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "diff-so-fancy";
-  version = "1.4.12";
+  version = "1.4.10";
 
   src = fetchFromGitHub {
     owner = "so-fancy";
     repo = "diff-so-fancy";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-5laSG8UWsCXAK+Woiz1Opy3VViboCI7J2AsqoDiuq7k=";
+    sha256 = "sha256-mEVRwkfVK/qmOeU37hSxmO2t0z0TY4MWOjkt6hICQQ4=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/do/doctest/package.nix

@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "doctest";
-  version = "2.5.2";
+  version = "2.5.3";
 
   src = fetchFromGitHub {
     owner = "doctest";
     repo = "doctest";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-4jW6xPFCFxk1l47EkSUVojhycrtluPhOc5Adf/25R7M=";
+    hash = "sha256-+/IEISqN9HdaCJ0udLVUitOUziLvF/D3POecZMoXuho=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/by-name/dr/drone-runner-exec/package.nix

@@ -0,0 +1,28 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}:
+
+buildGoModule {
+  pname = "drone-runner-exec";
+  version = "unstable-2020-04-19";
+
+  src = fetchFromGitHub {
+    owner = "drone-runners";
+    repo = "drone-runner-exec";
+    rev = "c0a612ef2bdfdc6d261dfbbbb005c887a0c3668d";
+    sha256 = "sha256-0UIJwpC5Y2TQqyZf6C6neICYBZdLQBWAZ8/K1l6KVRs=";
+  };
+
+  vendorHash = "sha256-ypYuQKxRhRQGX1HtaWt6F6BD9vBpD8AJwx/4esLrJsw=";
+
+  meta = {
+    description = "Drone pipeline runner that executes builds directly on the host machine";
+    homepage = "https://github.com/drone-runners/drone-runner-exec";
+    # https://polyformproject.org/licenses/small-business/1.0.0/
+    license = lib.licenses.unfree;
+    maintainers = with lib.maintainers; [ mic92 ];
+    mainProgram = "drone-runner-exec";
+  };
+}

pkgs/by-name/dr/drone-runner-ssh/package.nix

@@ -6,7 +6,7 @@
 
 buildGoModule {
   pname = "drone-runner-ssh";
-  version = "1.0.1-unstable-2022-12-22";
+  version = "unstable-2022-12-22";
 
   src = fetchFromGitHub {
     owner = "drone-runners";

pkgs/by-name/dr/dropbear/package.nix

@@ -18,13 +18,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "dropbear";
-  version = "2026.93";
+  version = "2026.92";
 
   src = fetchFromGitHub {
     owner = "mkj";
     repo = "dropbear";
     tag = "DROPBEAR_${finalAttrs.version}";
-    hash = "sha256-Xs5LTVaNdfRKx0cFTQknaHXka6QhxBS2JNTQ8RoHG80=";
+    hash = "sha256-xXjKWj6tMW/Qlq4DttxKAqOwsER2QEeb1Qw3Gllu2QQ=";
   };
 
   patches = [

pkgs/by-name/dt/dtach/package.nix

@@ -1,26 +1,29 @@
 {
   lib,
   stdenv,
-  fetchFromGitHub,
+  fetchurl,
+  fetchpatch2,
 }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
   pname = "dtach";
-  version = "0.9-unstable-2025-06-20";
+  version = "0.9";
 
-  src = fetchFromGitHub {
-    owner = "crigler";
-    repo = "dtach";
-    rev = "b027c27b2439081064d07a86883c8e0b20a183c9";
-    hash = "sha256-ilxBbrqwGe+jpFbQ93nfyp3HuDY0D7NgIXkIkw9YXkI=";
+  src = fetchurl {
+    url = "mirror://sourceforge/project/dtach/dtach/${finalAttrs.version}/dtach-${finalAttrs.version}.tar.gz";
+    sha256 = "1wwj2hlngi8qn2pisvhyfxxs8gyqjlgrrv5lz91w8ly54dlzvs9j";
   };
 
+  patches = [
+    (fetchpatch2 {
+      url = "https://github.com/crigler/dtach/commit/6d80909a8c0fd19717010a3c76fec560f988ca48.patch?full_index=1";
+      hash = "sha256-v3vToJdSwihiPCSjXjEJghiaynHPTEql3F7URXRjCbM=";
+    })
+  ];
+
   installPhase = ''
-    runHook preInstall
-
-    install -D dtach $out/bin/dtach
-
-    runHook postInstall
+    mkdir -p $out/bin
+    cp dtach $out/bin/dtach
   '';
 
   meta = {
@@ -37,8 +40,9 @@ stdenv.mkDerivation {
     '';
 
     license = lib.licenses.gpl2Plus;
+
     platforms = lib.platforms.unix;
-    maintainers = [ lib.maintainers.jmbaur ];
+    maintainers = [ ];
     mainProgram = "dtach";
   };
-}
+})

pkgs/by-name/et/ethtool/package.nix

@@ -9,11 +9,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ethtool";
-  version = "7.0";
+  version = "7.1";
 
   src = fetchurl {
     url = "mirror://kernel/software/network/ethtool/ethtool-${finalAttrs.version}.tar.xz";
-    hash = "sha256-Zgv5clp4cTQ6DSMgaKdjT7z7abbC+O/0VYJ/rvsM0WI=";
+    hash = "sha256-TXjCbtwCVbyS9LmVtf1mEI11/5Zu1GlPYCWm03C8JJY=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ev/everforest-gtk-theme/package.nix

@@ -71,7 +71,7 @@ stdenvNoCC.mkDerivation {
     description = "Everforest colour palette for GTK";
     homepage = "https://github.com/Fausto-Korpsvart/Everforest-GTK-Theme";
     license = lib.licenses.gpl3Only;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ jn-sena ];
     platforms = lib.platforms.unix;
   };
 }

pkgs/by-name/fc/fcitx5-pinyin-moegirl/package.nix

@@ -6,11 +6,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "fcitx5-pinyin-moegirl";
-  version = "20260713";
+  version = "20260712";
 
   src = fetchurl {
     url = "https://github.com/outloudvi/mw2fcitx/releases/download/${finalAttrs.version}/moegirl.dict";
-    hash = "sha256-ZmpTcolKTjJBino+zkVK6hBv/+yllAiBiR6Jy4SBdVs=";
+    hash = "sha256-fCzh9pn+HWL60IvpPieaaZ+JjQZ1bbfYIyLEHDITK4U=";
   };
 
   dontUnpack = true;

pkgs/by-name/fl/fluidsynth/package.nix

@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fluidsynth";
-  version = "2.5.5";
+  version = "2.5.6";
 
   src = fetchFromGitHub {
     owner = "FluidSynth";
     repo = "fluidsynth";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-WEzOYHtPIUkPZu3v4dWcCh3dOJUyG1xRxDuoSXqiGbk=";
+    hash = "sha256-q4NdfemCprYEYCrKlHumeRM8TyNz8eJcFM18EsB0p0c=";
     fetchSubmodules = true;
   };
 
@@ -52,6 +52,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   meta = {
+    changelog = "https://github.com/FluidSynth/fluidsynth/blob/${finalAttrs.src.tag}/doc/wiki/ChangeLog.md";
     description = "Real-time software synthesizer based on the SoundFont 2 specifications";
     homepage = "https://www.fluidsynth.org";
     license = lib.licenses.lgpl21Plus;

pkgs/by-name/fl/fluux-messenger/package.nix

@@ -18,7 +18,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "fluux-messenger";
-  version = "0.17.2";
+  version = "0.17.1";
   __structuredAttrs = true;
   strictDeps = true;
 
@@ -27,16 +27,16 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "processone";
     repo = "fluux-messenger";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-APdzwVnDOGnngZJ3LjQMk2Y6KRbGqXaaFEb+NzhfkIo=";
+    hash = "sha256-aT7X11BOmksEcCLk5hkokfLx7Q8Jk2zTWskoN8aZha0=";
   };
 
   cargoRoot = "apps/fluux/src-tauri";
-  cargoHash = "sha256-pjx4tP89aRx1/m5eYjI2DPhTtSuMnFudongEFhiaigE=";
+  cargoHash = "sha256-fEHe7enJzdEauou1xWfM94WHL1uAP1sfY2JN1ZmZmEE=";
 
   npmDeps = fetchNpmDeps {
     name = "${finalAttrs.pname}-${finalAttrs.version}-npm-deps";
     inherit (finalAttrs) src;
-    hash = "sha256-rV5Q8WKcSmL1JSubFefsytOd3qiB5OandcwfZw9DJgE=";
+    hash = "sha256-4Op4jykCtc9oFBIn8vOUqxGr7/OloIhPD1JT+q4dX7Y=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/fu/fuc/package.nix

@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "fuc";
-  version = "3.2.0";
+  version = "3.1.7";
 
   src = fetchFromGitHub {
     owner = "SUPERCILEX";
     repo = "fuc";
     tag = finalAttrs.version;
-    hash = "sha256-EzT8Rq0vqcHiW6W0yLSzlWNEZzaKXvOL3o9WUj648gU=";
+    hash = "sha256-LtS2+iqu4+z6K/PZeggLdo4S/F+5AtV5j9Q6hDAcEiQ=";
   };
 
-  cargoHash = "sha256-sZGAQ+9u/2PpHkp5BcrrTU+48s6PT42+eEs/Cn0RsKk=";
+  cargoHash = "sha256-SSJg/Ns64+NgqrB4mJ5/xa40tZfGZ2VGdvNP7SSKv0E=";
 
   env.RUSTC_BOOTSTRAP = 1;
 

pkgs/by-name/fz/fzf-make/package.nix

@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "fzf-make";
-  version = "0.70.0";
+  version = "0.69.0";
 
   src = fetchFromGitHub {
     owner = "kyu08";
     repo = "fzf-make";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-LRLwHCHsXW0SZ8X+7719vaCBQDx9fjiMvF2oma8u41w=";
+    hash = "sha256-ezE7plWdPqfENprOWhl5YQnoXk9khXsDtsYf6Lifk3w=";
   };
 
-  cargoHash = "sha256-bNp4P/Hag4br28rrfeNIUFQqKNKa/Gin79gQR6sg8W8=";
+  cargoHash = "sha256-uF+oV0ZvGsRy20DkNrVowyb+RoYVtYN4R/gOZ6WzHQw=";
 
   nativeBuildInputs = [ makeBinaryWrapper ];
 

pkgs/by-name/ge/geoclue2/fix-sysusers_dir.patch

@@ -0,0 +1,13 @@
+diff --git a/data/meson.build b/data/meson.build
+index 2591e6a..dc1bd8d 100644
+--- a/data/meson.build
++++ b/data/meson.build
+@@ -69,7 +69,7 @@ if get_option('enable-backend')
+         if systemd.found()
+             sysusers_dir = systemd.get_variable(pkgconfig: 'sysusersdir')
+         else
+-            sysusers_dir = '/usr/lib/sysusers.d'
++            sysusers_dir = join_paths(get_option('prefix'), 'usr/lib/sysusers.d')
+         endif
+         configure_file(output: 'geoclue-sysusers.conf',
+                        input: 'geoclue-sysusers.conf.in',

pkgs/by-name/ge/geoclue2/package.nix

@@ -29,7 +29,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "geoclue";
-  version = "2.7.2";
+  version = "2.8.1";
 
   outputs = [
     "out"
@@ -42,11 +42,12 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "geoclue";
     repo = "geoclue";
     tag = finalAttrs.version;
-    hash = "sha256-LwL1WtCdHb/NwPr3/OLISwaAwplhJwiZT9vUdX29Bbs=";
+    hash = "sha256-CyZhUMAa2vMUi61sL+gGBZFxGo0lu7Cm68fTjcbblTg=";
   };
 
   patches = [
     ./add-option-for-installation-sysconfdir.patch
+    ./fix-sysusers_dir.patch
   ];
 
   separateDebugInfo = true;

pkgs/by-name/gn/gn/package.nix

@@ -11,11 +11,11 @@
   version ?
     # This is a workaround for update-source-version to be able to update this
     let
-      _version = "0-unstable-2026-04-01";
+      _version = "0-unstable-2026-05-27";
     in
     _version,
-  rev ? "6e8dcdebbadf4f8aa75e6a4b6e0bdf89dce1513a",
-  hash ? "sha256-BTPD8WM1pVAMkFDlHekMdWFGyf63KdhKkKwsqikqoBQ=",
+  rev ? "3357c4f51b1a9e676378c695dd9c7e9911c35ee6",
+  hash ? "sha256-/1A+DkzAQj2zGPe/A/G0Z3VrYJXUxq4Hd/+d/o5p3G8=",
 }:
 
 stdenv.mkDerivation {

pkgs/by-name/gr/graphviz/package.nix

@@ -40,13 +40,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "graphviz";
-  version = "14.1.2";
+  version = "15.1.0";
 
   src = fetchFromGitLab {
     owner = "graphviz";
     repo = "graphviz";
     tag = finalAttrs.version;
-    hash = "sha256-LkyiKl0ulS9ujEdVLfyeoc4CtjITd6CAc35IUtlHSfw=";
+    hash = "sha256-5v/ib8hwqHrJLs+jvDGvg0aJiKIt8ipXEd1EUzew7XU=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/gv/gvm-libs/package.nix

@@ -26,13 +26,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gvm-libs";
-  version = "23.9.0";
+  version = "23.8.0";
 
   src = fetchFromGitHub {
     owner = "greenbone";
     repo = "gvm-libs";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-oGV4Brb+LgxiflzAvv7HqQ0p9+Whe2J6du9wBKAkr5Q=";
+    hash = "sha256-+fd/f5bYjKaeDGj0cpe4vNqm6TvIcWxJ3pfy90oQkbI=";
   };
 
   postPatch = ''

pkgs/by-name/hd/hdrhistogram_c/package.nix

@@ -22,7 +22,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   # Fix build on i686 by not trying to build AVX2 code
   # Submitted upstream: https://github.com/HdrHistogram/HdrHistogram_c/pull/143
-  ${if stdenv.hostPlatform.isi686 then "patches" else null} = [
+  patches = [
     ./no-avx2-i386.patch
   ];
 

pkgs/by-name/im/imagemagick/package.nix

@@ -67,26 +67,6 @@
 assert libXtSupport -> libX11Support;
 assert libraqmSupport -> freetypeSupport;
 
-let
-  arch =
-    if stdenv.hostPlatform.system == "i686-linux" then
-      "i686"
-    else if
-      stdenv.hostPlatform.system == "x86_64-linux" || stdenv.hostPlatform.system == "x86_64-darwin"
-    then
-      "x86-64"
-    else if stdenv.hostPlatform.system == "armv7l-linux" then
-      "armv7l"
-    else if
-      stdenv.hostPlatform.system == "aarch64-linux" || stdenv.hostPlatform.system == "aarch64-darwin"
-    then
-      "aarch64"
-    else if stdenv.hostPlatform.system == "powerpc64le-linux" then
-      "ppc64le"
-    else
-      null;
-in
-
 stdenv.mkDerivation (finalAttrs: {
   pname = "imagemagick";
   version = "7.1.2-27";
@@ -113,7 +93,7 @@ stdenv.mkDerivation (finalAttrs: {
     "MVDelegate=${lib.getExe' coreutils "mv"}"
     "RMDelegate=${lib.getExe' coreutils "rm"}"
     "--with-frozenpaths"
-    (lib.withFeatureAs (arch != null) "gcc-arch" arch)
+    "--with-gcc-arch=generic"
     (lib.withFeature librsvgSupport "rsvg")
     (lib.withFeature librsvgSupport "pango")
     (lib.withFeature liblqr1Support "lqr")

pkgs/by-name/li/libapparmor/package.nix

@@ -32,13 +32,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "libapparmor";
-  version = "5.0.1";
+  version = "5.0.2";
 
   src = fetchFromGitLab {
     owner = "apparmor";
     repo = "apparmor";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-y5r8X7Cpwp7TSsKYXNoAeyy0MbgxLSW8gNtLsIvKP8c=";
+    hash = "sha256-Kuc5Nrz4iq5MC5AOcJL9Sb54DWNKlEk3b3DW0vpgSZg=";
   };
   sourceRoot = "${finalAttrs.src.name}/libraries/libapparmor";
 

pkgs/by-name/li/libbde/package.nix

@@ -2,9 +2,7 @@
   lib,
   stdenv,
   fetchurl,
-  fuse3,
-  macfuse-stubs,
-  pkg-config,
+  fuse,
   ncurses,
   python3,
   nix-update-script,
@@ -19,12 +17,10 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-La6rzBOfyBIXDn78vXb8GUt8jgQkzsqM38kRZ7t3Fp0=";
   };
 
-  nativeBuildInputs = [ pkg-config ];
-
   buildInputs = [
+    fuse
     ncurses
     python3
-    (if stdenv.hostPlatform.isDarwin then macfuse-stubs else fuse3)
   ];
 
   preInstall = ''

pkgs/by-name/li/libmysofa/package.nix

@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libmysofa";
-  version = "1.3.3";
+  version = "1.3.4";
 
   src = fetchFromGitHub {
     owner = "hoene";
     repo = "libmysofa";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-jvib1hGPJEY2w/KjlD7iTtRy1s8LFG+Qhb2d6xdpUyc=";
+    hash = "sha256-gP/RjKzMx8JIYcyiivBGvy3kIdwHMEKY6abssyVUKNQ=";
   };
 
   outputs = [

pkgs/by-name/li/libsodium/package.nix

@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libsodium";
-  version = "1.0.22-unstable-2026-04-16";
+  version = "1.0.22-unstable-2026-07-08";
 
   src = fetchFromGitHub {
     owner = "jedisct1";
     repo = "libsodium";
-    rev = "33cc75ab1565d9dcbe808354191bd572ad6b64d0";
-    hash = "sha256-8kS9FBoaFaJOjH7XZc8IG3GaQaUiYD/awQOhs7j0n1Y=";
+    rev = "77a422c85a3b8b487de50c811b38d18394831ba6";
+    hash = "sha256-Ahka2PnrmYvTLjZMzik5mFsxhDpMLRMKT/I5ftUb0Xc=";
   };
 
   outputs = [

pkgs/by-name/li/libssh/package.nix

@@ -19,11 +19,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libssh";
-  version = "0.12.0";
+  version = "0.12.1";
 
   src = fetchurl {
     url = "https://www.libssh.org/files/${lib.versions.majorMinor finalAttrs.version}/libssh-${finalAttrs.version}.tar.xz";
-    hash = "sha256-Gmr0JNgyfl7t705f5/W5JCJt1hesnz3oDyF9gqNqcSE=";
+    hash = "sha256-05Qa8KLXjV2C7Xo2mI6RM5lDEvA1uWWabkP42zloeEw=";
   };
 
   outputs = [

pkgs/by-name/li/libtiff/package.nix

@@ -37,13 +37,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libtiff";
-  version = "4.7.1";
+  version = "4.7.2";
 
   src = fetchFromGitLab {
     owner = "libtiff";
     repo = "libtiff";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-UiC6s86i7UavW86EKm74oPVlEacvoKmwW7KETjpnNaI=";
+    hash = "sha256-60Lpg5WRfWMzlOoOUA+C6KLlYIZ+3BjXidOVqv4M2GA=";
   };
 
   patches = [

pkgs/by-name/li/libuvc/package.nix

@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation {
   pname = "libuvc";
-  version = "0.0.7-unstable-2024-03-05";
+  version = "unstable-2020-11-29";
 
   src = fetchFromGitHub {
     owner = "libuvc";
     repo = "libuvc";
-    rev = "047920bcdfb1dac42424c90de5cc77dfc9fba04d";
-    hash = "sha256-Ds4N9ezdO44eBszushQVvK0SUVDwxGkUty386VGqbT0=";
+    rev = "5cddef71b17d41f7e98875a840c50d9704c3d2b2";
+    sha256 = "0kranb0x1k5qad8rwxnn1w9963sbfj2cfzdgpfmlivb04544m2j7";
   };
 
   # Upstream doesn't yet support CMake 4, remove once fixed

pkgs/by-name/ls/lstr/package.nix

@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "lstr";
-  version = "0.4.0";
+  version = "0.3.0";
 
   src = fetchFromGitHub {
     owner = "bgreenwell";
     repo = "lstr";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-uDwf6+By4z1TTkuyg0g5J8zzkM/UCsBMLAF9WfSEreE=";
+    hash = "sha256-lJ6BSvlJiyZUOoz0QuahIgZ6GZ9NDcmvvQ7MEd9c/7U=";
   };
 
-  cargoHash = "sha256-CGdQmjgOvcLAE88nocn/iA4qfS98CEsseoNn/0udd0s=";
+  cargoHash = "sha256-pRPcJwdhrQ+P70zaiuPCAI53lW+zEulqSrK5w8SCraQ=";
 
   nativeBuildInputs = [ pkg-config ];
 

pkgs/by-name/mb/mbedtls/4.nix

@@ -5,8 +5,8 @@
 }:
 
 callPackage ./generic.nix {
-  version = "4.1.0";
-  hash = "sha256-TA1uka13So8URttw+JJVdKIL+IonkhIQSc0IfraXpIM=";
+  version = "4.2.0";
+  hash = "sha256-Xz5W5zYPNlASPyc1/Sz2O1LONdxpUkg1hgzKdax/3ag=";
 
   patches = [
     # Fixes the build with GCC 14 on aarch64.

pkgs/by-name/mb/mbedtls/package.nix

@@ -6,8 +6,8 @@
 }:
 
 callPackage ./generic.nix {
-  version = "3.6.6";
-  hash = "sha256-+PW41/c8M/Yz0EVWM4Gt4HTNBMUTU5MayaKVZ+upLIo=";
+  version = "3.6.7";
+  hash = "sha256-t1ZPeFA3ftKaEIaXQ7RXZEsiOAYK4KSSm55SFr9g17A=";
 
   patches = [
     # Fixes the build with GCC 14 on aarch64.

pkgs/by-name/me/melonds/package.nix

@@ -29,13 +29,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "melonds";
-  version = "1.1-unstable-2026-07-19";
+  version = "1.1-unstable-2026-06-07";
 
   src = fetchFromGitHub {
     owner = "melonDS-emu";
     repo = "melonDS";
-    rev = "82fdbc78483f43b310e920e21acc47787cb43564";
-    hash = "sha256-2T8qzsqbULFw7jsNk0pTpLMIyS1XVnA5ojel8BmTPMw=";
+    rev = "10a173b5536fc75cd93f8a3868349dad963542ef";
+    hash = "sha256-YsVCU40BZgYoxyuscbD0Ab613eUIgYlXJkm0KJQg+yY=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/mu/murmure/package.nix

@@ -45,7 +45,7 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "murmure";
-  version = "1.10.1";
+  version = "1.10.0";
 
   __structuredAttrs = true;
 
@@ -53,7 +53,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "Kieirra";
     repo = "murmure";
     tag = finalAttrs.version;
-    hash = "sha256-YTfpIkGHD6GPEfuTV1AahC08y4hJ6GSWQ+9C/6bTsJU=";
+    hash = "sha256-zJ9OvpAfREyDWDISKYKCUyQSWdkQlVrSzX+wvwKk6Yk=";
   };
 
   # The libappindicator_sys crate loads these libraries at runtime
@@ -77,7 +77,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   cargoRoot = "src-tauri";
   buildAndTestSubdir = finalAttrs.cargoRoot;
 
-  cargoHash = "sha256-6G/ZHGjjv1U5MNLo+LAwXoM/nN2aCPOaSTJer7dUv9w=";
+  cargoHash = "sha256-wV0drkKgn58Yxjy+Mv2QLTQXTDwWk6/uEfk76HaMuow=";
 
   env.OPENSSL_NO_VENDOR = true;
 

pkgs/by-name/mx/mxt-app/package.nix

@@ -7,14 +7,14 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  version = "1.52";
+  version = "1.46";
   pname = "mxt-app";
 
   src = fetchFromGitHub {
     owner = "atmel-maxtouch";
     repo = "mxt-app";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-CW2iWkYuI0joTQJXt271XLO70Qq/Yg8eX9f56XnJht8=";
+    sha256 = "sha256-SeP48xdZ43dL28tg7mo8SmObUt3R+8oyETst6yKkhnU=";
   };
 
   nativeBuildInputs = [ autoreconfHook ];

pkgs/by-name/ne/nerva/package.nix

@@ -6,13 +6,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "nerva";
-  version = "1.42.6";
+  version = "1.40.2";
 
   src = fetchFromGitHub {
     owner = "praetorian-inc";
     repo = "nerva";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-TNl+/ikQWsS4hBU5m+zkfVg+KF5YwsZ6Ge3YNarbvmE=";
+    hash = "sha256-znkY0R3g8ueazxx+ljCAdsBMkY1FmKn8R9GLYYIY2cA=";
   };
 
   vendorHash = "sha256-Z0MSD+1/1VzrJ+pz5x0JvxrCxtJe59ckaTqHK/+TVN8=";

pkgs/by-name/ni/nixpkgs-hammering/package.nix

@@ -8,16 +8,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "nixpkgs-hammering";
-  version = "0-unstable-2026-07-20";
+  version = "0-unstable-2026-04-21";
 
   src = fetchFromGitHub {
     owner = "jtojnar";
     repo = "nixpkgs-hammering";
-    rev = "d131eb5c4d92c9b12001f8ff6ee79fcad4dc4f32";
-    hash = "sha256-rzmyA5s+7vlDazKCJSVy3bJH0ql/ekc7B2zsG+8YXLk=";
+    rev = "0ca8e718c6809e0c2b640b954bfe000b915634dc";
+    hash = "sha256-j/jqwdM466jE2Rf6aW3DfI6wQa44eN8W8/ii1aX8HDs=";
   };
 
-  cargoHash = "sha256-0xk/HIK9urjhjotQaNzEJ5CRj50jZlsNOsTCHbfCdy8=";
+  cargoHash = "sha256-Lmj9XWUUavlmZn/IK+CcXQhKUYfz3dKF6S2U3BMhoIc=";
 
   nativeBuildInputs = [ makeWrapper ];
   postInstall = ''

pkgs/by-name/ob/obs-cmd/package.nix

@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "obs-cmd";
-  version = "1.0.1";
+  version = "1.0.0";
 
   src = fetchFromGitHub {
     owner = "grigio";
     repo = "obs-cmd";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-yIS9P2ljyiT8tiJmieQXWQcSkKmP7p0/XErujQRxDCE=";
+    hash = "sha256-8lCqUN5FacDARZylR+s74l/mSP3Jy0GT5u03/WrUALM=";
   };
 
-  cargoHash = "sha256-jEGgTyqGprvtDkoWc5qihdeN91/4is3i7JBeqlm9KDw=";
+  cargoHash = "sha256-Fyyr2oMHsIb9/jiqnzb94H5eknoy/WmwU7sL1cOxuPQ=";
 
   meta = {
     description = "Minimal CLI to control OBS Studio via obs-websocket";

pkgs/by-name/oh/oh-my-fish/package.nix

@@ -5,18 +5,17 @@
   fish,
   runtimeShell,
   replaceVars,
-  nix-update-script,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "oh-my-fish";
-  version = "8";
+  version = "unstable-2022-03-27";
 
   src = fetchFromGitHub {
     owner = "oh-my-fish";
     repo = "oh-my-fish";
-    tag = "v${finalAttrs.version}";
-    hash = "sha256-2IDXRQUMuPHKHYsB+2kNWBc2WxgA6732oJbrPDjRdp0=";
+    rev = "d428b723c8c18fef3b2a00b8b8b731177f483ad8";
+    hash = "sha256-msItKEPe7uSUpDAfCfdYZjt5NyfM3KtOrLUTO9NGqlg=";
   };
 
   patches = [
@@ -55,8 +54,6 @@ stdenv.mkDerivation (finalAttrs: {
     runHook postInstall
   '';
 
-  passthru.updateScript = nix-update-script { };
-
   meta = {
     homepage = "https://github.com/oh-my-fish/oh-my-fish";
     description = "Fish Shell Framework";

pkgs/by-name/om/omnictl/package.nix

@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "omnictl";
-  version = "1.9.1";
+  version = "1.9.0";
 
   src = fetchFromGitHub {
     owner = "siderolabs";
     repo = "omni";
     rev = "v${version}";
-    hash = "sha256-k2z0QBkMJkLFtrr9ckWyS1a4jzGYkikREf8+aaMW3d0=";
+    hash = "sha256-xL1kZafjDQ9UkaBBs9n2u5t8jcL3CONv41hg3oA8x7s=";
   };
 
-  vendorHash = "sha256-ja+j9KSeNEHVTBjgSWYRMuB1qqbp8g3e32rDzlyzO1E=";
+  vendorHash = "sha256-D88+xYpZgawfMLa7qJOL+5MAtSswat4ITY7sjCrJMVg=";
 
   ldflags = [
     "-s"

pkgs/by-name/op/openttd-jgrpp/package.nix

@@ -7,13 +7,13 @@
 
 openttd.overrideAttrs (oldAttrs: rec {
   pname = "openttd-jgrpp";
-  version = "0.73.0";
+  version = "0.72.4";
 
   src = fetchFromGitHub {
     owner = "JGRennison";
     repo = "OpenTTD-patches";
     rev = "jgrpp-${version}";
-    hash = "sha256-eFUKJSpHLhyGXvKo/uSB01+5nGv5Y7yUTIU3U81Qx5U=";
+    hash = "sha256-qiTKoaCUdcm7dJKfxwTtYU8f5C8RYxj7XZL/TtOygtg=";
   };
   patches = [ ];
 

pkgs/by-name/pl/playball/package.nix

@@ -6,16 +6,16 @@
 
 buildNpmPackage rec {
   pname = "playball";
-  version = "3.5.0";
+  version = "3.4.0";
 
   src = fetchFromGitHub {
     owner = "paaatrick";
     repo = "playball";
     tag = "v${version}";
-    hash = "sha256-kahotL2cF2j8DHB1HkSyKwcmOUMcoDO/yS9DXwGcZc0=";
+    hash = "sha256-ldxYKLRtdNKU1xORT5HxgEMiMajUY7OwnkQ+jlsOIxY=";
   };
 
-  npmDepsHash = "sha256-joHk2xYSoipxd4IVgiwinYMacw8jlvtn4K03J8AdzY0=";
+  npmDepsHash = "sha256-9sbTK7nV8m4uaUZy6DL/0r+JUlBoTkIpgYy7sacf130=";
 
   env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
 

pkgs/by-name/po/pop/package.nix

@@ -4,8 +4,6 @@
   buildGoModule,
   installShellFiles,
   fetchFromGitHub,
-  versionCheckHook,
-  nix-update-script,
 }:
 
 buildGoModule (finalAttrs: {
@@ -42,13 +40,6 @@ buildGoModule (finalAttrs: {
       --zsh <($out/bin/pop completion zsh)
   '';
 
-  nativeInstallCheckInputs = [
-    versionCheckHook
-  ];
-  doInstallCheck = true;
-
-  passthru.updateScript = nix-update-script { };
-
   meta = {
     description = "Send emails from your terminal";
     homepage = "https://github.com/charmbracelet/pop";

pkgs/by-name/po/postman/package.nix

@@ -59,6 +59,7 @@ let
       Crafter
       evanjs
       johnrichardrinehart
+      tricktron
     ];
     platforms = [
       "aarch64-darwin"

pkgs/by-name/pr/prek/package.nix

@@ -13,16 +13,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "prek";
-  version = "0.4.4";
+  version = "0.4.10";
 
   src = fetchFromGitHub {
     owner = "j178";
     repo = "prek";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-PAEmRQ5Vro83fkegOWsdY59U7WAQxBPSEalzxZV6K4o=";
+    hash = "sha256-tTr/Aob6jP1YL+n5vGkUkByew73WdP3mqLW5Lci1gNM=";
   };
 
-  cargoHash = "sha256-EmlR6Lmt5XR0uS/y3FqY5yGNeVBSdtLtEGH9jZLcP2o=";
+  cargoHash = "sha256-He55uH7t7NI5sYgowujqCMK5yjhC2F+8ZLxKG6TLjYY=";
 
   nativeBuildInputs = [
     installShellFiles

pkgs/by-name/pr/prometheus-postfix-exporter/package.nix

@@ -10,16 +10,16 @@
 
 buildGoModule rec {
   pname = "postfix_exporter";
-  version = "0.20.4";
+  version = "0.20.0";
 
   src = fetchFromGitHub {
     owner = "Hsn723";
     repo = "postfix_exporter";
     tag = "v${version}";
-    sha256 = "sha256-LCjTw5nL8xP6ODwVJxj4Zg99CiFvqbzjb931fmhtk0M=";
+    sha256 = "sha256-tW86lnSLQdyZwvRiqTU1oExZ/zDIrZUraeoAOjs35yY=";
   };
 
-  vendorHash = "sha256-6lqUygsV1pPGKN9SOZIouPVSZWuSOlPhqFbm16HfzGk=";
+  vendorHash = "sha256-T8fTvrpBKm+wDqf+iBeBJh9H1HEebAf0lOnnuF0W5fI=";
 
   ldflags = [
     "-s"

pkgs/by-name/pr/prow/package.nix

@@ -8,15 +8,15 @@
 
 buildGoModule rec {
   pname = "prow";
-  version = "0-unstable-2026-07-14";
-  rev = "0633879af8026d056e1a5dbe1e29f5a98f6acec3";
+  version = "0-unstable-2026-07-09";
+  rev = "bcf4297e528a75b2aa580c5dce3e7b97e38f4553";
 
   src = fetchFromGitHub {
     inherit rev;
 
     owner = "kubernetes-sigs";
     repo = "prow";
-    hash = "sha256-tpIxZSqftGgA501zh4MyjTrBUvLOaLjkBO8nK/IDwhU=";
+    hash = "sha256-pPmkWcnEPWyWWCIlujvDvoAlZ67SrM1X8lP/WJFomyI=";
   };
 
   vendorHash = "sha256-iLJ2atYyHNMvflyuETpPnuhKD293k25vfZQU68Y7oN8=";

pkgs/by-name/ri/rime-moegirl/package.nix

@@ -5,10 +5,10 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "rime-moegirl";
-  version = "20260713";
+  version = "20260712";
   src = fetchurl {
     url = "https://github.com/outloudvi/mw2fcitx/releases/download/${finalAttrs.version}/moegirl.dict.yaml";
-    hash = "sha256-Fca5vWdmqaRnP6id4TqVGFsTxnynAoQTMgAWntF5eY0=";
+    hash = "sha256-d4I2xyyWh9vry7vMkE1E19G55w/uenqbTspymdy0dqw=";
   };
 
   dontUnpack = true;

pkgs/by-name/ri/ripgrep/package.nix

@@ -50,17 +50,15 @@ rustPlatform.buildRustPackage (finalAttrs: {
   '';
 
   doInstallCheck = true;
-  installCheckPhase = lib.optionalString canRunRg (
-    ''
-      file="$(mktemp)"
-      echo "abc\nbcd\ncde" > "$file"
-      ${rg} -N 'bcd' "$file"
-      ${rg} -N 'cd' "$file"
-    ''
-    + lib.optionalString withPCRE2 ''
-      echo '(a(aa)aa)' | ${rg} -P '\((a*|(?R))*\)'
-    ''
-  );
+  installCheckPhase = ''
+    file="$(mktemp)"
+    echo "abc\nbcd\ncde" > "$file"
+    ${rg} -N 'bcd' "$file"
+    ${rg} -N 'cd' "$file"
+  ''
+  + lib.optionalString withPCRE2 ''
+    echo '(a(aa)aa)' | ${rg} -P '\((a*|(?R))*\)'
+  '';
 
   meta = {
     description = "Utility that combines the usability of The Silver Searcher with the raw speed of grep";

pkgs/by-name/rm/rmtfs/package.nix

@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rmtfs";
-  version = "1.3";
+  version = "1.1.1";
 
   src = fetchFromGitHub {
     owner = "linux-msm";
     repo = "rmtfs";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-j92qz4x5KTYXjcvFGPp4YbmcM0pz2pUlV2tCsT8FV0I=";
+    hash = "sha256-ehd8SbKNOpyVoF9oc7e5uYmJOHI+Q6woLyvwO8hhKEc=";
   };
 
   buildInputs = [

pkgs/by-name/sa/samrewritten/package.nix

@@ -15,16 +15,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "samrewritten";
-  version = "1.4.5";
+  version = "1.4.4";
 
   src = fetchFromGitHub {
     owner = "PaulCombal";
     repo = "SamRewritten";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-sSZC7yN/WuMYkdcPmHyvasaWRFzppSxmlS1bYLZGvyM=";
+    hash = "sha256-WYwuYNbapD0cIifQALtfgMNqXs5KMvaCsQqUdifJwf8=";
   };
 
-  cargoHash = "sha256-YKiICPP6z9lZWqdoPOYRq+0mmz7jY3/eJd7XzN8Vmnk=";
+  cargoHash = "sha256-dh4WPk6rU/HsUVJTMrMPsqKXpOmb/0LUAsGTbmdI6Ts=";
 
   # Tests require network access and a running Steam client. Skipping.
   doCheck = false;

pkgs/by-name/sc/sc-controller/package.nix

@@ -1,6 +1,5 @@
 {
   lib,
-  python3,
   python3Packages,
   fetchFromGitHub,
   wrapGAppsHook3,
@@ -21,14 +20,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "sc-controller";
-  version = "0.6.2";
+  version = "0.5.5";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "C0rn3j";
     repo = "sc-controller";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-jQcp3c3S6G6GrU6j0m5Re9S28eLGJxmvD81dOuHFCz8=";
+    hash = "sha256-IQxHa0bR8FWad9v5DfvXHskwayCgzbJm5ekzf1sjfiQ=";
   };
 
   nativeBuildInputs = [
@@ -93,11 +92,6 @@ python3Packages.buildPythonApplication (finalAttrs: {
     )
   '';
 
-  preCheck = ''
-    # Fix for tests not finding native libraries
-    ln -s build/lib.*/*.so -t .
-  '';
-
   doInstallCheck = true;
 
   meta = {

pkgs/by-name/se/search-vulns/package.nix

@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "search-vulns";
-  version = "1.2.3";
+  version = "1.2.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ra1nb0rn";
     repo = "search_vulns";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-YSnBM0nTjQSNh7eDqAeu58J1DuyG7tRjOX+6zlUVH+I=";
+    hash = "sha256-w4kK0/bAbWPHK6Nllhb8vCReJwiBUL6EpX/Cnt3aplg=";
     fetchSubmodules = true;
   };
 

pkgs/by-name/si/signalbackup-tools/package.nix

@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "signalbackup-tools";
-  version = "20260718";
+  version = "20260712";
 
   src = fetchFromGitHub {
     owner = "bepaald";
     repo = "signalbackup-tools";
     tag = finalAttrs.version;
-    hash = "sha256-C/yAq2i8r9gk0LCOi6kaM/kusklu/jeJ61H45PnSWQY=";
+    hash = "sha256-X4I7eFUXty9LNI2nNyVUZXYhKQds+elor/Zs5FSg2iE=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/sp/spicedb-zed/package.nix

@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "zed";
-  version = "1.2.0";
+  version = "1.1.1";
 
   src = fetchFromGitHub {
     owner = "authzed";
     repo = "zed";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-wwD/PCnhCFzhq/Oe9+qU+w/ZlloZbezjOtBKMQkxI9E=";
+    hash = "sha256-rlTcC2+faNZKvzouGC9nJBBCsDabxozTE/SFbf8YKQ8=";
   };
 
-  vendorHash = "sha256-swlwje4XCzhRojPOaW28MDEaZQIvXGUoH7qjyz5+tUo=";
+  vendorHash = "sha256-/nnPVy+pjcgkgJW8630IycmGF4Qq4I01htEDlsWvZbM=";
 
   ldflags = [ "-X 'github.com/jzelinskie/cobrautil/v2.Version=${finalAttrs.src.tag}'" ];
 

pkgs/by-name/sp/spotify-player/package.nix

@@ -49,16 +49,16 @@ assert lib.assertOneOf "withAudioBackend" withAudioBackend [
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "spotify-player";
-  version = "0.24.1";
+  version = "0.24.0";
 
   src = fetchFromGitHub {
     owner = "aome510";
     repo = "spotify-player";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-+GADmRl4XMwV8TfYZjEeyKDDfda3bDPzeerhYryX6vA=";
+    hash = "sha256-SxzQdQOg+KS6jXJNifVkehR91g6gTHBYgyxfXx9WWI8=";
   };
 
-  cargoHash = "sha256-CSZ5sZ+d7Jhi43ipaWXKupYPFgWCbCx4RMTQN8emu9o=";
+  cargoHash = "sha256-TmGdJXKOsTL9HVyEEe3PtiLMSDJV/TRokRBVAUdHL7I=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/by-name/sr/srt/package.nix

@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "srt";
-  version = "1.5.5";
+  version = "1.5.6";
 
   src = fetchFromGitHub {
     owner = "Haivision";
     repo = "srt";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-hOkLlmtF9dKqXZTjAeBntkkg5WsmsZN6DKhyakoIF1k=";
+    sha256 = "sha256-fdgj6URuMaem+ZVy7D8Hnf2Ev1HindevdvX0xyxCL4M=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/by-name/ss/sshocker/package.nix

@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "sshocker";
-  version = "0.3.11";
+  version = "0.3.9";
 
   src = fetchFromGitHub {
     owner = "lima-vm";
     repo = "sshocker";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-VFUPRGC6NkBd75X21uAlqDMAYU4Tyo/RFgBsc5D4LMk=";
+    hash = "sha256-7s5jPMt6q7RUXxwA7rwVXhWGRrwfMc/EcEQxicwEHjs=";
   };
 
-  vendorHash = "sha256-75eziqi+lgKAA4MTBqVEdf4PEn5J8kk480xsa/2XtqQ=";
+  vendorHash = "sha256-FGaZTE8CCZ16ozsZr5MUFNkEy8+nkBYXH55n5TJG4Bg=";
 
   nativeInstallCheckInputs = [ versionCheckHook ];
 

pkgs/by-name/te/tetrd/package.nix

@@ -21,16 +21,15 @@
   libappindicator,
   udev,
   libgbm,
-  libGL,
 }:
 
 stdenv.mkDerivation rec {
   pname = "tetrd";
-  version = "1.3.1-1";
+  version = "1.0.4";
 
   src = fetchurl {
-    url = "https://web.archive.org/web/20260108185127/https://download.tetrd.app/files/tetrd.linux_amd64.pkg.tar.xz";
-    sha256 = "0mpixs20jrxkbxvd7nl0p664jgqfp3m6qf7kmsj7frkhky697fbm";
+    url = "https://web.archive.org/web/20211130190525/https://download.tetrd.app/files/tetrd.linux_amd64.pkg.tar.xz";
+    sha256 = "1bxp7rg2dm9nnvkgg48xd156d0jgdf35flaw0bwzkkh3zz9ysry2";
   };
 
   sourceRoot = ".";
@@ -43,7 +42,6 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    libGL
     c-ares
     ffmpeg
     libevent
@@ -73,9 +71,6 @@ stdenv.mkDerivation rec {
     wrapProgram $out/opt/Tetrd/tetrd \
       --prefix LD_LIBRARY_PATH ":" ${lib.makeLibraryPath buildInputs}
 
-    mkdir $out/bin
-    ln -s $out/opt/Tetrd/tetrd $out/bin/tetrd
-
     runHook postInstall
   '';
 
@@ -89,6 +84,5 @@ stdenv.mkDerivation rec {
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     license = lib.licenses.unfree;
     platforms = [ "x86_64-linux" ];
-    mainProgram = "tetrd";
   };
 }

pkgs/by-name/th/thruster/package.nix

@@ -7,16 +7,16 @@
 
 buildGo126Module (finalAttrs: {
   pname = "thruster";
-  version = "0.1.23";
+  version = "0.1.22";
 
   src = fetchFromGitHub {
     owner = "basecamp";
     repo = "thruster";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-R7JutM3tWkkkRsxxNgHIoz7VdYIfXNTmmvhSh8YHFuM=";
+    hash = "sha256-d+zdzzT+47y9WOFARlQ/wCrc9tnyS/4HsE0a6aQl/KA=";
   };
 
-  vendorHash = "sha256-V9KAr+/r5SGNSBamD3U7bvBiiXn5GTmopSxiNmFL6lQ=";
+  vendorHash = "sha256-veXgGs6+TauExVAaNnkIZwylQWZ4um3rrG8of/dYCv0=";
 
   subPackages = [ "cmd/thrust" ];
 

pkgs/by-name/ti/tiddit/package.nix

@@ -8,14 +8,14 @@
 }:
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "tiddit";
-  version = "3.9.7";
+  version = "3.9.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "SciLifeLab";
     repo = "TIDDIT";
     tag = "TIDDIT-${finalAttrs.version}";
-    hash = "sha256-B3vUxLEnOdX733iGOfMmueVaSEqMmlp6fN4M8oElNNQ=";
+    hash = "sha256-6uJZzetqRS0czX4qjjPgiSaPun7BkrPYllDdFWNK84k=";
   };
 
   build-system = with python3Packages; [

pkgs/by-name/to/todoist-cli/package.nix

@@ -7,16 +7,16 @@
 }:
 buildNpmPackage rec {
   pname = "todoist-cli";
-  version = "3.0.0";
+  version = "1.76.1";
 
   src = fetchFromGitHub {
     owner = "Doist";
     repo = "todoist-cli";
     rev = "v${version}";
-    sha256 = "sha256-5+FxpTQmxeoNF/lTjKvFxP1T7HYt7YaUflTvw0GcOac=";
+    sha256 = "sha256-3glrAc2yZJqP8gd28m5cjVPR+t7hM17etsxQWOs4J8k=";
   };
 
-  npmDepsHash = "sha256-IVabpRYKMI6ST/TumG7pMwDoUMIJBlhjUm35Eo7mSlE=";
+  npmDepsHash = "sha256-q50gIxHYdwW7cUO6FaUr3em1NX6kNw/+T8T+QLaB6Wk=";
 
   doCheck = true;
 

pkgs/by-name/to/tombi/package.nix

@@ -9,7 +9,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "tombi";
-  version = "1.2.4";
+  version = "1.2.2";
 
   __structuredAttrs = true;
 
@@ -17,7 +17,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "tombi-toml";
     repo = "tombi";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-XusEBLWK9yd1FLlfPY+lNPeBN1Q50RV5wrTMz+C6TZ8=";
+    hash = "sha256-F7YQy+p0nsC4rKBs8CUG39FrK7fI8JE71YhHV6RaFZg=";
   };
 
   # Tests relies on the presence of network

pkgs/by-name/tp/tpm2-tools/package.nix

@@ -17,11 +17,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "tpm2-tools";
-  version = "5.8";
+  version = "5.7";
 
   src = fetchurl {
     url = "https://github.com/tpm2-software/tpm2-tools/releases/download/${finalAttrs.version}/tpm2-tools-${finalAttrs.version}.tar.gz";
-    sha256 = "sha256-HLcxhcroFLThXHwtCyJkLWQPr0h3X0FWof2S7fhL73M=";
+    sha256 = "sha256-OBDTa1B5JW9PL3zlUuIiE9Q7EDHBMVON+KLbw8VwmDo=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/tz/tzdata/package.nix

@@ -8,16 +8,16 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "tzdata";
-  version = "2026b";
+  version = "2026c";
 
   srcs = [
     (fetchurl {
       url = "https://data.iana.org/time-zones/releases/tzdata${finalAttrs.version}.tar.gz";
-      hash = "sha256-EUVD2fGaa/61vKQ2hq6hc9OHVaPbHy7sESZHrpLG9UQ=";
+      hash = "sha256-5KF4pEd/PQ6nfMMYKP9yqjj+/41hqhPn6Z4ULp2QK+Q=";
     })
     (fetchurl {
       url = "https://data.iana.org/time-zones/releases/tzcode${finalAttrs.version}.tar.gz";
-      hash = "sha256-N+nthCf101IcIvxY4pPL+wQ9cO7fEAOHCzPzY/Yco0Q=";
+      hash = "sha256-sc/8Os5MTHzQ77ovet2G7D0LedpIvPA1gmcf08j+rOg=";
     })
   ];
 

pkgs/by-name/un/unpoller/package.nix

@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "unpoller";
-  version = "3.3.3";
+  version = "3.3.1";
 
   src = fetchFromGitHub {
     owner = "unpoller";
     repo = "unpoller";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-VWu2n5J7ZLC2PzHXFDum0HFAwq5MDczT0dzUxRBSN5A=";
+    hash = "sha256-MivEuI/XjRDlX+VjSAMLjRl0WlRVnhP18qVujbvwjeQ=";
   };
 
-  vendorHash = "sha256-QBvdR7pLKqeiZLIIxgTbAkyGLLR0nrK/NU9wSmyU5zU=";
+  vendorHash = "sha256-3DBUrKTvwRqaNuYtBlP5DlF1SNmU+ZNeH7ATVQjgLsA=";
 
   ldflags = [
     "-w"

pkgs/by-name/up/upscaler/package.nix

@@ -18,7 +18,7 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "upscaler";
-  version = "1.6.4";
+  version = "1.6.3";
 
   pyproject = false; # meson instead of pyproject
 
@@ -27,7 +27,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     owner = "World";
     repo = "Upscaler";
     rev = finalAttrs.version;
-    hash = "sha256-yhGRKPqkuM2iCnA90bXaEaB+RZGAw15fNSm208zQrGE=";
+    hash = "sha256-h+m5YOnsWFmQH0FxYrGbUzGMr38HhnkHegJl4daRXAs=";
   };
 
   passthru.updateScript = gitUpdater { };

pkgs/by-name/wi/winbox4/package.nix

@@ -5,7 +5,7 @@
 }:
 let
   pname = "winbox";
-  version = "4.3";
+  version = "4.2";
 
   metaCommon = {
     description = "Graphical configuration utility for RouterOS-based devices";
@@ -23,13 +23,13 @@ let
   x86_64-zip = callPackage ./build-from-zip.nix {
     inherit pname version metaCommon;
 
-    hash = "sha256-VzYArCTfOKegbqQxixJ1QkfuxLVMbJCwpXEA1nZ4ekw=";
+    hash = "sha256-htyVwuCsCRwvAwsdnbz+Z3E9Tk6kH8U0faGDo9CvyVo=";
   };
 
   x86_64-dmg = callPackage ./build-from-dmg.nix {
     inherit pname version metaCommon;
 
-    hash = "sha256-VoHQPjITOFiz3FQceMG644yzNVtf2YMmrHJeC9i6tXA=";
+    hash = "sha256-rEBdkLh9+7gzdlQ4uI/SdCAWwWnG2tBQPWTdGcETfsI=";
   };
 in
 (if stdenvNoCC.hostPlatform.isDarwin then x86_64-dmg else x86_64-zip).overrideAttrs (oldAttrs: {

pkgs/by-name/xs/xsimd/package.nix

@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "xsimd";
-  version = "14.2.0";
+  version = "14.3.0";
 
   src = fetchFromGitHub {
     owner = "xtensor-stack";
     repo = "xsimd";
     tag = finalAttrs.version;
-    hash = "sha256-BTiN4B3//wlB3nmOoluM/7bL7J7YIBp5afih9zUP1yw=";
+    hash = "sha256-0m9gUDCgGh58lf9uPp1Obw4rsqWEL1RffWYB6s315p0=";
   };
 
   # strictDeps raises the chance that xsimd will be able to be cross compiled

pkgs/by-name/xv/xvfb/package.nix

@@ -38,14 +38,7 @@
 stdenv.mkDerivation (finalAttrs: {
   pname = "xvfb";
 
-  # TODO: commented out for rebuild avoidance after xorg-server update. revert
-  # on staging.
-  # inherit (xorg-server) src version;
-  version = "21.1.23";
-  src = fetchurl {
-    url = "mirror://xorg/individual/xserver/xorg-server-${finalAttrs.version}.tar.xz";
-    hash = "sha256-45gy5WF9ra8HL9+fDhnl0uHCoTYHrCgLrBq6n4/hRjQ=";
-  };
+  inherit (xorg-server) src version;
 
   strictDeps = true;
 

pkgs/by-name/ya/yascreen/package.nix

@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "yascreen";
-  version = "2.13";
+  version = "2.11";
 
   src = fetchFromGitHub {
     owner = "bbonev";
     repo = "yascreen";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-641H0uR2rR9vVe7WF2bSzFs+6HXlPHWgD0jKH9MofqU=";
+    hash = "sha256-SkJPq1xeC2XU8zP9uPdXECotgvG4siKvvHfi7z0APio=";
   };
 
   nativeBuildInputs = [ go-md2man ];

pkgs/by-name/za/zapret/package.nix

@@ -13,7 +13,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "zapret";
-  version = "72.13";
+  version = "72.12";
 
   src = fetchFromGitHub {
     owner = "bol-van";
@@ -27,7 +27,7 @@ stdenv.mkDerivation (finalAttrs: {
     '';
 
     tag = "v${finalAttrs.version}";
-    hash = "sha256-jwhGhxqIhJfkmjT3Zzsy4injQWqSVRet8fZr9VA04sQ=";
+    hash = "sha256-UWkLi/wWihtdLyk77cQ90xZ31vho1PjPfFQ6bQWrIUs=";
   };
 
   buildInputs = [

pkgs/development/compilers/rust/1_97.nix

@@ -50,8 +50,8 @@ let
 in
 import ./default.nix
   {
-    rustcVersion = "1.97.0";
-    rustcSha256 = "sha256-HAhV2JgqD7HQMhtgVLVbcy07HRfIRoQet/0Ks3vydvg=";
+    rustcVersion = "1.97.1";
+    rustcSha256 = "sha256-YiwrQpxTy/3A3TpR0DVU6RzWPr7BkSwfVwlkDN/vGp0=";
 
     llvmSharedForBuild = llvmSharedFor pkgsBuildBuild;
     llvmSharedForHost = llvmSharedFor pkgsBuildHost;
@@ -65,27 +65,27 @@ import ./default.nix
     # Note: the version MUST be the same version that we are building. Upstream
     # ensures that each released compiler can compile itself:
     # https://github.com/NixOS/nixpkgs/pull/351028#issuecomment-2438244363
-    bootstrapVersion = "1.97.0";
+    bootstrapVersion = "1.97.1";
 
     # fetch hashes by running `print-hashes.sh ${bootstrapVersion}`
     bootstrapHashes = {
-      i686-unknown-linux-gnu = "d066e5dd59c15fc1c793173d53b41719162de4470b5c34041a8bc664542df375";
-      x86_64-unknown-linux-gnu = "eb89b20287153391c49ebcdb7fd91b683a12438d129bfb92eadcc495545af3a7";
-      x86_64-unknown-linux-musl = "675bb2d574efc64da0563a9cb70cc017560394c5938e04c92987cad383299e8d";
-      arm-unknown-linux-gnueabihf = "180e487a1f7abaeda374b942d369dd7faa4364b1267629d48552d9a17a5bc4ab";
-      armv7-unknown-linux-gnueabihf = "2f9dfd76694efcf391f6d4947e97be17d1f469c9e989ed194660ddd85877ca60";
-      aarch64-unknown-linux-gnu = "70fb01b4894d56fad34c260ce63aee647589be57a26ab33730110d8228cbcf02";
-      aarch64-unknown-linux-musl = "28efcf4ee31235eb5f7820dadba46400ab9dbbb030719e7a2ab284b02c8cbf82";
-      x86_64-apple-darwin = "3dc9ad8ec35a9f0acd2c5ae2c80c36baf5c7010423bf339ca55709fc995885d4";
-      aarch64-apple-darwin = "c2e6a5ef480f5715ae9874188c1fa749b6a6f90d8d911f5a3a5d768f0ac70427";
-      powerpc64-unknown-linux-gnu = "62c9f9b7887505fc4dcda40784469f23909657d245e53025a7a8124b016d6631";
-      powerpc64le-unknown-linux-gnu = "a8d3f487d07cebc48ce03ad66a970a5f5138a5c1e7c7cec12fb9b6e47a24bf1a";
-      powerpc64le-unknown-linux-musl = "09fee3b9ede1e94ff6c3bad3918dc231be909c74bb182e0acd583c03a9f1df5f";
-      riscv64gc-unknown-linux-gnu = "be239392f7112f6a81f20c9e715d5743319a8b773592e027ad800d73527d8fae";
-      s390x-unknown-linux-gnu = "fee699e31d0a0034f46669c473e61a88af6734f8c5902d77329ac236fcd9b538";
-      loongarch64-unknown-linux-gnu = "37ad9d55b98cc680a2d75c7184e6457b632ce82690a56be7a2044e32c91176ce";
-      loongarch64-unknown-linux-musl = "bfba202bae252ac372026171d9bc98e5eb80578d576546f56e8aee2e9d64ecf0";
-      x86_64-unknown-freebsd = "77101232e3769395e99c0e663d2c8beb3d4127857945cf7c812c1886ba823b8f";
+      i686-unknown-linux-gnu = "914c2702deada0b9cf1d64bb3495d76e55cb3eba07d508472dde8b55a93e3759";
+      x86_64-unknown-linux-gnu = "b4cdbc7cc6b0ee0a2666b1872769fdb2ad8393b28b63952f6493b4b400e4832b";
+      x86_64-unknown-linux-musl = "40dbea28193cf2b488cf3e4a89274ccfb60efa50883f19917a382f84fd05bdc4";
+      arm-unknown-linux-gnueabihf = "ba62fe07ad85b507907705a14adc1e8bc258de5f6177ba41d77bbff9f469a4ce";
+      armv7-unknown-linux-gnueabihf = "e89c5e33aaddc6ef56857000c9117875c2997e9a1a500bd7b16277c9874b002f";
+      aarch64-unknown-linux-gnu = "2f2496c70bd336a66a4c8baf2d303ba161f3552f192444c3639ba903c7c1e2c5";
+      aarch64-unknown-linux-musl = "c5f45b5c6eb7f8fdb277c54c08402b7c931516740fbd4eccc26ba148f7cd5d57";
+      x86_64-apple-darwin = "5f4c84d2bcce7983468642855a45fc4978fba1324cfdd1ea0b182face3ab4ffa";
+      aarch64-apple-darwin = "cbd14c36f039f6f11f38148a6295d8234d18ddf20bea53031c86f119423a8b26";
+      powerpc64-unknown-linux-gnu = "2b507d5eb9b5c4c041b50e93e069db56d094f02e6df103dc74c016155141bfae";
+      powerpc64le-unknown-linux-gnu = "ff524eef5a59d801df09ccad5cdaf9ea1f0a07d75cbed2a7e9f013a9eb76a3c1";
+      powerpc64le-unknown-linux-musl = "15630f33fbea2dd9661f8482b6c612da271549aba40401444aaa53650e646b9b";
+      riscv64gc-unknown-linux-gnu = "59bec35d8febb2ab918fa41cffbaa5b07146a63bdc33f029ff756d70a3151ece";
+      s390x-unknown-linux-gnu = "808268af9e880d41b8cb32b242e38c9bd3ea7aba6409b02fbffa0fbc5370c538";
+      loongarch64-unknown-linux-gnu = "d5a925962854730ae7641420d8337af93988ea4ff47b503a856ec53776c87841";
+      loongarch64-unknown-linux-musl = "3fb653299d228e3e0726afb179b07dd10a51a2ecc3cdfcd740011b1d8420ca97";
+      x86_64-unknown-freebsd = "77866a4c449bcccb40e9d6712bf3eb899d29018ed8e841fd9d8d59370751f152";
     };
 
     selectRustPackage = pkgs: pkgs.rust_1_97;

pkgs/development/libraries/astal/buildAstalModule.nix

@@ -65,6 +65,7 @@ let
         meta = {
           homepage = "https://aylur.github.io/astal/guide/libraries/${website-path}";
           license = lib.licenses.lgpl21;
+          maintainers = with lib.maintainers; [ PerchunPak ];
           platforms = [
             "aarch64-linux"
             "x86_64-linux"

pkgs/development/libraries/astal/source.nix

@@ -7,15 +7,15 @@ let
   originalDrv = fetchFromGitHub {
     owner = "Aylur";
     repo = "astal";
-    rev = "fd94e333c8bd45557291c805f1df79d5f787d590";
-    hash = "sha256-flVUft590tsDX9z97O4DzVFg6zvOOmGeYhPeDdaP1DI=";
+    rev = "04454c22094401cc8e682cfe1f8ecc3194cac5f9";
+    hash = "sha256-bXd034/ARs18ZQ7hWUAw9NwyfBmcKQws8DQHzwYp6jM=";
   };
 in
 originalDrv.overrideAttrs (
   final: prev: {
     name = "${final.pname}-${final.version}"; # fetchFromGitHub already defines name
     pname = "astal-source";
-    version = "0-unstable-2026-07-19";
+    version = "0-unstable-2026-07-03";
 
     meta = prev.meta // {
       description = "Building blocks for creating custom desktop shells (source)";