Merge master into staging-next

Redirect Citrix's /usr/bin/fusermount3 calls to the NixOS security
wrapper when it is executable. Preserve the original path on other
systems and document programs.fuse.enable for FUSE-based file transfer.

doc/packages/citrix.section.md

@@ -6,6 +6,26 @@ The [Citrix Workspace App](https://www.citrix.com/products/workspace-app/) is a
 
 The tarball archive needs to be downloaded manually, as the license agreements of the vendor for [Citrix Workspace](https://www.citrix.com/downloads/workspace-app/linux/workspace-app-for-linux-latest.html) needs to be accepted first. Then run `nix-prefetch-url file://$PWD/linuxx64-$version.tar.gz`. With the archive available in the store, the package can be built and installed with Nix.
 
+The package includes the `ctxcwalogd.service` user unit required by Citrix's logging tools.
+To enable it on NixOS:
+
+```nix
+{
+  systemd.packages = [ pkgs.citrix-workspace ];
+  systemd.user.services.ctxcwalogd.wantedBy = [ "default.target" ];
+}
+```
+
+For FUSE-based file transfer, enable the privileged helper on NixOS:
+
+```nix
+{
+  programs.fuse.enable = true;
+}
+```
+
+The package uses `/run/wrappers/bin/fusermount3` when it is available.
+
 ## Citrix Self-service {#sec-citrix-selfservice}
 
 The [self-service](https://support.citrix.com/article/CTX200337) is an application for managing Citrix desktops and applications. Please note that this feature only works with at least `citrix_workspace_20_06_0` and later versions.

maintainers/maintainer-list.nix

@@ -3146,6 +3146,12 @@
     githubId = 2806307;
     keys = [ { fingerprint = "00F4 21C4 C537 7BA3 9820 E13F 6B95 E13D E469 CC5D"; } ];
   };
+  badheuristic = {
+    email = "steveoncaffeine@gmail.com";
+    github = "badheuristic";
+    githubId = 233336560;
+    name = "Stephen Adebambo";
+  };
   badmutex = {
     email = "github@badi.sh";
     github = "badmutex";
@@ -10473,6 +10479,12 @@
     githubId = 104317939;
     name = "gilice";
   };
+  gimura = {
+    email = "gimura0001@gmail.com";
+    github = "gimura2022";
+    githubId = 109300813;
+    name = "gimura";
+  };
   gin66 = {
     email = "jochen@kiemes.de";
     github = "gin66";

nixos/doc/manual/configuration/configuration.md

@@ -1,5 +1,5 @@
-# Configuration {#ch-configuration}
+# Guides {#ch-configuration}
 
-This chapter describes how to configure various aspects of a NixOS machine through the configuration file {file}`/etc/nixos/configuration.nix`. As described in [](#sec-changing-config), changes to this file only take effect after you run {command}`nixos-rebuild`.
+These guides describe how to configure various aspects of a NixOS machine through the configuration file {file}`/etc/nixos/configuration.nix`. As described in [](#sec-changing-config), changes to this file only take effect after you run {command}`nixos-rebuild`.
 
 <!-- Apache; libvirtd virtualisation -->

nixos/doc/manual/default.nix

@@ -24,6 +24,7 @@ let
     mkOption
     escapeShellArg
     concatMapStringsSep
+    sortOn
     sourceFilesBySuffices
     ;
 
@@ -103,15 +104,16 @@ let
 
     cp -r ${../../../doc/release-notes} ./release-notes-nixpkgs
 
-    cp ${./nav.json} nav.json
+    cp --no-preserve=all ${./nav.json} nav.json
 
     substituteInPlace ./manual.md \
       --replace-fail '@NIXOS_VERSION@' "${version}"
+    # Module chapters sorted by filename
     substituteInPlace ./nav.json \
       --replace-fail \
           '"@MODULE_CHAPTERS@"' \
           ${escapeShellArg (
-            concatMapStringsSep ",\n" (p: ''{ "file": "${p.value}" }'') config.meta.doc
+            concatMapStringsSep ",\n" (p: ''{ "file": "${p.value}" }'') (sortOn (p: p.file) config.meta.doc)
           )}
     substituteInPlace ./nixos-options.md \
       --replace-fail \
@@ -204,7 +206,7 @@ rec {
           --script ./highlightjs/loader.js \
           --script ./anchor.min.js \
           --script ./anchor-use.js \
-          --sidebar-depth 3 \
+          --sidebar-depth 4 \
           --header ${./header.html}\
           --no-navheader \
           --experimental-config nav.json \

nixos/doc/manual/development/development.md

@@ -1,3 +1,3 @@
-# Development {#ch-development}
+# Contributing {#ch-development}
 
-This chapter describes how you can modify and extend NixOS.
+These chapters describe how you can modify and extend NixOS.

nixos/doc/manual/development/meta-attributes.section.md

@@ -40,7 +40,7 @@ file.
       https://nixos.org/manual/nixpkgs/unstable/#sec-contributing-markup
     ) file containing the module
     documentation. Its contents is automatically added to
-    [](#ch-configuration). Changes to a module documentation have to
+    [](#ch-services). Changes to a module documentation have to
     be checked to not break building the NixOS manual:
 
     ```ShellSession

nixos/doc/manual/installation/installation.md

@@ -1,3 +1,3 @@
-# Installation {#ch-installation}
+# Getting started {#ch-installation}
 
 This section describes how to obtain, install, and configure NixOS for first-time use.

nixos/doc/manual/nav.json

@@ -5,7 +5,7 @@
       "file": "preface.md"
     },
     {
-      "label": "Installation",
+      "label": "Getting started",
       "id": "ch-installation",
       "children": [
         {
@@ -46,20 +46,11 @@
         },
         {
           "file": "installation/upgrading.chapter.md"
-        },
-        {
-          "file": "installation/building-nixos.chapter.md"
-        },
-        {
-          "file": "installation/building-images-via-nixos-rebuild-build-image.chapter.md"
-        },
-        {
-          "file": "installation/building-images-via-systemd-repart.chapter.md"
         }
       ]
     },
     {
-      "label": "Configuration",
+      "label": "Guides",
       "id": "ch-configuration",
       "children": [
         {
@@ -91,19 +82,13 @@
               "file": "configuration/package-mgmt.chapter.md"
             },
             {
-              "label": "Declarative Package Management",
-              "id": "sec-declarative-package-mgmt",
-              "children": [
-                {
-                  "file": "configuration/declarative-packages.section.md"
-                },
-                {
-                  "file": "configuration/customizing-packages.section.md"
-                },
-                {
-                  "file": "configuration/adding-custom-packages.section.md"
-                }
-              ]
+              "file": "configuration/declarative-packages.section.md"
+            },
+            {
+              "file": "configuration/customizing-packages.section.md"
+            },
+            {
+              "file": "configuration/adding-custom-packages.section.md"
             },
             {
               "file": "configuration/ad-hoc-packages.section.md"
@@ -134,18 +119,6 @@
             }
           ]
         },
-        {
-          "file": "configuration/x-windows.chapter.md"
-        },
-        {
-          "file": "configuration/wayland.chapter.md"
-        },
-        {
-          "file": "configuration/gpu-accel.chapter.md"
-        },
-        {
-          "file": "configuration/xfce.chapter.md"
-        },
         {
           "label": "Networking",
           "id": "sec-networking",
@@ -180,104 +153,61 @@
           ]
         },
         {
-          "file": "configuration/linux-kernel.chapter.md"
-        },
-        {
-          "file": "configuration/subversion.chapter.md"
-        },
-        "@MODULE_CHAPTERS@",
-        {
-          "label": "Profiles",
-          "id": "ch-profiles",
+          "label": "Graphical Desktops",
+          "id": "sec-x11",
           "children": [
             {
-              "file": "configuration/profiles.chapter.md"
+              "file": "configuration/x-windows.chapter.md"
             },
             {
-              "file": "configuration/profiles/all-hardware.section.md"
+              "file": "configuration/wayland.chapter.md"
             },
             {
-              "file": "configuration/profiles/base.section.md"
+              "file": "configuration/gpu-accel.chapter.md"
             },
             {
-              "file": "configuration/profiles/clone-config.section.md"
-            },
-            {
-              "file": "configuration/profiles/demo.section.md"
-            },
-            {
-              "file": "configuration/profiles/docker-container.section.md"
-            },
-            {
-              "file": "configuration/profiles/graphical.section.md"
-            },
-            {
-              "file": "configuration/profiles/headless.section.md"
-            },
-            {
-              "file": "configuration/profiles/installation-device.section.md"
-            },
-            {
-              "file": "configuration/profiles/perlless.section.md"
-            },
-            {
-              "file": "configuration/profiles/minimal.section.md"
-            },
-            {
-              "file": "configuration/profiles/qemu-guest.section.md"
+              "file": "configuration/xfce.chapter.md"
             }
           ]
         },
         {
-          "file": "configuration/mattermost.chapter.md"
-        },
-        {
-          "file": "configuration/kubernetes.chapter.md"
-        }
-      ]
-    },
-    {
-      "label": "Administration",
-      "id": "ch-running",
-      "children": [
-        {
-          "file": "administration/running.md"
-        },
-        {
-          "file": "administration/service-mgmt.chapter.md"
-        },
-        {
-          "file": "administration/rebooting.chapter.md"
-        },
-        {
-          "file": "administration/user-sessions.chapter.md"
-        },
-        {
-          "file": "administration/control-groups.chapter.md"
-        },
-        {
-          "file": "administration/logging.chapter.md"
-        },
-        {
-          "label": "Necessary system state",
-          "id": "ch-system-state",
+          "label": "Building Images",
+          "id": "sec-building-image",
           "children": [
             {
-              "file": "administration/system-state.chapter.md"
+              "file": "installation/building-nixos.chapter.md"
             },
             {
-              "file": "administration/nixos-state.section.md"
+              "file": "installation/building-images-via-nixos-rebuild-build-image.chapter.md"
             },
             {
-              "file": "administration/systemd-state.section.md"
-            },
-            {
-              "file": "administration/zfs-state.section.md"
+              "file": "installation/building-images-via-systemd-repart.chapter.md"
             }
           ]
         },
         {
-          "file": "administration/cleaning-store.chapter.md"
+          "label": "Administration",
+          "id": "ch-running",
+          "children": [
+            {
+              "file": "administration/running.md"
+            },
+            {
+              "file": "administration/service-mgmt.chapter.md"
+            },
+            {
+              "file": "administration/rebooting.chapter.md"
+            },
+            {
+              "file": "administration/user-sessions.chapter.md"
+            },
+            {
+              "file": "administration/logging.chapter.md"
+            },
+            {
+              "file": "administration/cleaning-store.chapter.md"
+            }
+          ]
         },
         {
           "label": "Container Management",
@@ -324,7 +254,128 @@
       ]
     },
     {
-      "label": "Development",
+      "label": "Services and Programs",
+      "id": "ch-services",
+      "children": [
+        {
+          "file": "services.md"
+        },
+        "@MODULE_CHAPTERS@",
+        {
+          "file": "configuration/subversion.chapter.md"
+        },
+        {
+          "file": "configuration/mattermost.chapter.md"
+        },
+        {
+          "file": "configuration/kubernetes.chapter.md"
+        }
+      ]
+    },
+    {
+      "label": "Reference",
+      "id": "ch-reference",
+      "children": [
+        {
+          "file": "reference.md"
+        },
+        {
+          "label": "Profiles",
+          "id": "ch-profiles",
+          "children": [
+            {
+              "file": "configuration/profiles.chapter.md"
+            },
+            {
+              "file": "configuration/profiles/all-hardware.section.md"
+            },
+            {
+              "file": "configuration/profiles/base.section.md"
+            },
+            {
+              "file": "configuration/profiles/clone-config.section.md"
+            },
+            {
+              "file": "configuration/profiles/demo.section.md"
+            },
+            {
+              "file": "configuration/profiles/docker-container.section.md"
+            },
+            {
+              "file": "configuration/profiles/graphical.section.md"
+            },
+            {
+              "file": "configuration/profiles/headless.section.md"
+            },
+            {
+              "file": "configuration/profiles/installation-device.section.md"
+            },
+            {
+              "file": "configuration/profiles/perlless.section.md"
+            },
+            {
+              "file": "configuration/profiles/minimal.section.md"
+            },
+            {
+              "file": "configuration/profiles/qemu-guest.section.md"
+            }
+          ]
+        },
+        {
+          "file": "configuration/linux-kernel.chapter.md"
+        },
+        {
+          "label": "Necessary system state",
+          "id": "ch-system-state",
+          "children": [
+            {
+              "file": "administration/system-state.chapter.md"
+            },
+            {
+              "file": "administration/nixos-state.section.md"
+            },
+            {
+              "file": "administration/systemd-state.section.md"
+            },
+            {
+              "file": "administration/zfs-state.section.md"
+            }
+          ]
+        },
+        {
+          "label": "What happens during a system switch?",
+          "id": "sec-switching-systems",
+          "children": [
+            {
+              "file": "development/what-happens-during-a-system-switch.chapter.md"
+            },
+            {
+              "file": "development/unit-handling.section.md"
+            },
+            {
+              "file": "development/activation-script.section.md"
+            },
+            {
+              "file": "development/non-switchable-systems.section.md"
+            },
+            {
+              "file": "development/etc-overlay.section.md"
+            }
+          ]
+        },
+        {
+          "file": "administration/control-groups.chapter.md"
+        },
+        {
+          "file": "development/bootspec.chapter.md"
+        },
+        {
+          "file": "development/modular-services.md"
+        }
+      ]
+    },
+    {
+      "label": "Contributing",
       "id": "ch-development",
       "children": [
         {
@@ -372,36 +423,6 @@
             }
           ]
         },
-        {
-          "file": "development/building-parts.chapter.md"
-        },
-        {
-          "file": "development/bootspec.chapter.md"
-        },
-        {
-          "label": "What happens during a system switch?",
-          "id": "sec-switching-systems",
-          "children": [
-            {
-              "file": "development/what-happens-during-a-system-switch.chapter.md"
-            },
-            {
-              "file": "development/unit-handling.section.md"
-            },
-            {
-              "file": "development/activation-script.section.md"
-            },
-            {
-              "file": "development/non-switchable-systems.section.md"
-            },
-            {
-              "file": "development/etc-overlay.section.md"
-            }
-          ]
-        },
-        {
-          "file": "development/writing-documentation.chapter.md"
-        },
         {
           "label": "NixOS Tests",
           "id": "sec-nixos-tests",
@@ -426,6 +447,9 @@
             }
           ]
         },
+        {
+          "file": "development/building-parts.chapter.md"
+        },
         {
           "file": "development/developing-the-test-driver.chapter.md"
         },
@@ -433,12 +457,12 @@
           "file": "development/testing-installer.chapter.md"
         },
         {
-          "file": "development/modular-services.md"
+          "file": "development/writing-documentation.chapter.md"
+        },
+        {
+          "file": "contributing-to-this-manual.chapter.md"
         }
       ]
-    },
-    {
-      "file": "contributing-to-this-manual.chapter.md"
     }
   ]
 }

nixos/doc/manual/redirects.json

@@ -2946,5 +2946,11 @@
   ],
   "sec-release-13.10": [
     "release-notes.html#sec-release-13.10"
+  ],
+  "ch-services": [
+    "index.html#ch-services"
+  ],
+  "ch-reference": [
+    "index.html#ch-reference"
   ]
 }

nixos/doc/manual/reference.md

@@ -0,0 +1 @@
+# Reference {#ch-reference}

nixos/doc/manual/services.md

@@ -0,0 +1 @@
+# Services and Programs {#ch-services}

nixos/lib/testing/run.nix

@@ -195,6 +195,7 @@ in
 
     # useful for inspection (debugging / exploration)
     passthru.config = config;
+    passthru.options = options;
 
     /**
       For discoverTests only. Deprecated. Will be removed when discoverTests can be removed from NixOS all-tests.nix.

nixos/modules/services/desktop-managers/cosmic.nix

@@ -151,17 +151,8 @@ in
     # Required for screen locker
     security.pam.services.cosmic-greeter = { };
 
-    # geoclue2 stuff
-    services.geoclue2.enable = true;
-    # We _do_ use the demo agent in the `cosmic-settings-daemon` package,
-    # but this option also creates a systemd service that conflicts with the
-    # `cosmic-settings-daemon` package's geoclue2 agent. Therefore, disable it.
-    services.geoclue2.enableDemoAgent = false;
-    # As mentioned above, we do use the demo agent. And it needs to be
-    # whitelisted, otherwise it doesn't run.
-    services.geoclue2.whitelistedAgents = [ "geoclue-demo-agent" ]; # whitelist our own geoclue2 agent o
-
     # Good to have defaults
+    services.geoclue2.enable = lib.mkDefault true;
     hardware.bluetooth.enable = lib.mkDefault true;
     networking.networkmanager.enable = lib.mkDefault true;
     services.acpid.enable = lib.mkDefault true;

nixos/modules/services/display-managers/noctalia-greeter.nix

@@ -10,9 +10,11 @@ let
   format = pkgs.formats.toml { };
 
   inherit (lib)
+    all
     escapeShellArgs
     getExe'
     maintainers
+    mkAfter
     mkDefault
     mkEnableOption
     mkIf
@@ -38,6 +40,18 @@ in
       default = [ ];
     };
 
+    passwordlessSyncUsers = mkOption {
+      type = listOf str;
+      default = [ ];
+      description = ''
+        Local users allowed to apply the constrained appearance-only sync through
+        Polkit without authentication. The constrained sync operation never accepts
+        session command configuration. Leave empty to require administrator
+        authentication for every sync.
+      '';
+      example = [ "alice" ];
+    };
+
     settings = mkOption {
       description = ''
         Settings for noctalia-greeter written to greeter.toml.
@@ -91,6 +105,10 @@ in
           assertion = (config.users.users.${user} or { }) != { };
           message = "noctalia-greeter: user ${user} does not exist. Please create it before referencing it.";
         }
+        {
+          assertion = all (name: builtins.hasAttr name config.users.users) cfg.passwordlessSyncUsers;
+          message = "noctalia-greeter: every passwordless sync user must be a configured user.";
+        }
       ];
 
       services.displayManager.noctalia-greeter.settings.cursor = mkIf (cfg.cursorTheme.package != null) {
@@ -119,8 +137,24 @@ in
         settings.default_session.command = mkDefault "${getExe' cfg.package "noctalia-greeter-session"} ${escapeShellArgs cfg.extraArgs}";
       };
 
-      security.polkit.enable = mkDefault true;
       services.accounts-daemon.enable = mkDefault true;
+
+      security.polkit = {
+        enable = mkDefault true;
+        enablePkexecWrapper = mkDefault true;
+        extraConfig = mkIf (cfg.passwordlessSyncUsers != [ ]) (mkAfter ''
+          polkit.addRule(function(action, subject) {
+            var allowedUsers = ${builtins.toJSON cfg.passwordlessSyncUsers};
+            if (action.id == "org.noctalia.greeter.sync-appearance" &&
+                action.lookup("program") == "${getExe' cfg.package "noctalia-greeter-apply-appearance"}" &&
+                action.lookup("user") == "root" &&
+                subject.local && subject.active &&
+                allowedUsers.indexOf(subject.user) >= 0) {
+              return polkit.Result.YES;
+            }
+          });
+        '');
+      };
     };
 
   meta.maintainers = with maintainers; [

pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix

@@ -21,22 +21,22 @@ vscode-utils.buildVscodeMarketplaceExtension (finalAttrs: {
       sources = {
         "x86_64-linux" = {
           arch = "linux-x64";
-          hash = "sha256-+fqh4S2ftZaBSXKVX1wUmxdzms2FeBci8q7VfpTgH2o=";
+          hash = "sha256-XxTNjmmIXKK1pDSSqn/oHJDZupjQoqZZWfT7YR9C98k=";
         };
         "aarch64-linux" = {
           arch = "linux-arm64";
-          hash = "sha256-X4QDi/auFzznwckBTLKNn2RdYbGYn9HZt9lko+SQLsc=";
+          hash = "sha256-ibCtMohLQcV9QjBBuAyZc4qipyqa7p29jkvolFsBXUs=";
         };
         "aarch64-darwin" = {
           arch = "darwin-arm64";
-          hash = "sha256-rP6ibc6O3y0CNshxOQ1/PWcq11vVLUNSv8PXQSP18vM=";
+          hash = "sha256-0T/mvEeEUzSbIraZ2ps+k6tDoY5o3AIP4O8tm8R5YHI=";
         };
       };
     in
     {
       name = "claude-code";
       publisher = "anthropic";
-      version = "2.1.272";
+      version = "2.1.276";
     }
     // sources.${stdenvNoCC.hostPlatform.system}
       or (throw "Unsupported system ${stdenvNoCC.hostPlatform.system}");

pkgs/applications/editors/vscode/extensions/charliermarsh.ruff/default.nix

@@ -12,22 +12,22 @@ vscode-utils.buildVscodeMarketplaceExtension {
       sources = {
         "x86_64-linux" = {
           arch = "linux-x64";
-          hash = "sha256-0Sfnhxgcws/Nk57lF1UV7DQh2pq5OJlFpRaPHhSSAlg=";
+          hash = "sha256-sZ9dwKsCNHIQQDnHRLF7U/sq3tt3MECDjpEwO4emn6I=";
         };
         "aarch64-linux" = {
           arch = "linux-arm64";
-          hash = "sha256-Vu38YBqcpYbzFUE5D63/1A9+hoAmQ88VenQ4jeq1XWU=";
+          hash = "sha256-sUjRLPUM8gc1ddBajfd+C0HQsY87mzQ+/BcXxOS6a0I=";
         };
         "aarch64-darwin" = {
           arch = "darwin-arm64";
-          hash = "sha256-Vi+ClxIVz+Ko34mRGMk11xTL88t3EkZ346RciMTL9es=";
+          hash = "sha256-ifxVrJmXZPdOvfS0Dnl/ns/qtP1UP4RbZhLWs10AweU=";
         };
       };
     in
     {
       name = "ruff";
       publisher = "charliermarsh";
-      version = "2026.78.0";
+      version = "2026.82.0";
     }
     // sources.${stdenvNoCC.hostPlatform.system}
       or (throw "Unsupported system ${stdenvNoCC.hostPlatform.system}");

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -54,13 +54,13 @@
     "vendorHash": "sha256-bJcVf4Yj70VwKn0p6RN+/dc5J+K6xFJcifVei9dK2bA="
   },
   "aminueza_minio": {
-    "hash": "sha256-pw8QgjdU0c4w6ZUJLCy3zTEk0UTML1Mymh+UsmBAdrQ=",
+    "hash": "sha256-MOc2DaH1uTb92emRNe/aS+Jsit8K+ZrldHBIMyYgeFU=",
     "homepage": "https://registry.terraform.io/providers/aminueza/minio",
     "owner": "aminueza",
     "repo": "terraform-provider-minio",
-    "rev": "v3.41.1",
+    "rev": "v3.43.0",
     "spdx": "AGPL-3.0",
-    "vendorHash": "sha256-V9yH/dGXZJ85XVQAksL4QCRbhS9yrXy2tY8Jr+kKQdk="
+    "vendorHash": "sha256-Sl2FaER384LiXNTBBEO96X65QHM204CC2ME2hYWLeX0="
   },
   "archessmn_powerdns": {
     "hash": "sha256-1bjQFu3k0ERBga94pQ8HZjbfu3qlxnMQLjSkDU6Vp/I=",
@@ -209,13 +209,13 @@
     "vendorHash": "sha256-AB6VVC/I5E+CoHvdww38gXlHJ9yh4t5jV6ZrvDDTQeE="
   },
   "cloudamqp_cloudamqp": {
-    "hash": "sha256-GMfBdLUqw/3WEtZfP6ShCEwheHeUa/1EDMzIuYGalvA=",
+    "hash": "sha256-WD4ZIUTg8xGfxa4oqA7EGVwcggBzJK/MRchxdldypqU=",
     "homepage": "https://registry.terraform.io/providers/cloudamqp/cloudamqp",
     "owner": "cloudamqp",
     "repo": "terraform-provider-cloudamqp",
-    "rev": "v1.48.0",
+    "rev": "v1.49.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-hgi4CyYMNBmxAUc93uFc4J13nlgVOQNLYyLYz+rnWlM="
+    "vendorHash": "sha256-scHNFyHn4VYm8wtuBdVCpgKCzwPhzrC3KBs1YHXPwos="
   },
   "cloudflare_cloudflare": {
     "hash": "sha256-o+p2QDCwzmhDJx1sUlFZVmZuvo0TiEM9JuLMxg6/B8Y=",
@@ -292,13 +292,13 @@
     "vendorHash": "sha256-3o6YRDrq4rQhNAFyqiGJrAoxuAykWw85OExRGSE3kGI="
   },
   "datadog_datadog": {
-    "hash": "sha256-Sq3gP01DrTm41fLTZvavNTNhMy7AfMcbxe+ac8omJIQ=",
+    "hash": "sha256-a84guU5oeG+BwmPoPCyGZRBOB/dzaPCLwxKH3BYSj6A=",
     "homepage": "https://registry.terraform.io/providers/DataDog/datadog",
     "owner": "DataDog",
     "repo": "terraform-provider-datadog",
-    "rev": "v4.20.0",
+    "rev": "v4.21.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-PoM4C03Q8bAz1hqasx0SWYWEVW7dS7tCcI+tLE2MHLE="
+    "vendorHash": "sha256-KBzkbWlFM0SB+YzVU4YIaJxvQlMHalPeKPvvHh4L2kw="
   },
   "datadrivers_nexus": {
     "hash": "sha256-t9hpZ4COmMPvs4TgcZLeuOA23oD5vvHw8UVK7SpzI0Y=",
@@ -517,13 +517,13 @@
     "vendorHash": "sha256-ikBqIxD5aTOcwNHCMN6EaOwSHCAP5n/SULuqQXPLpOc="
   },
   "hashicorp_aws": {
-    "hash": "sha256-qSGvtJqiViBdBZD6gMZSaUXbZNZmCBBb1kkKUjCK0YM=",
+    "hash": "sha256-eawrzzPTN2ZmhH2pWWTf7LsxWleIFHaN5Lqr/tA76xk=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/aws",
     "owner": "hashicorp",
     "repo": "terraform-provider-aws",
-    "rev": "v6.63.0",
+    "rev": "v6.65.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-lrcDMPenGnTgKnrdL9oCk3Pg/WObKYqKxbLXqjWR7U4="
+    "vendorHash": "sha256-qRX2liR1MQy8JuOuUknV70dibU4mgih3nJOy7/raBug="
   },
   "hashicorp_awscc": {
     "hash": "sha256-juctslCHuUr3pL9VTOET/s3P0SGbtlInZESmvgNL+7M=",
@@ -724,13 +724,13 @@
     "vendorHash": null
   },
   "hetznercloud_hcloud": {
-    "hash": "sha256-DekwCc3S4/rA15PnnP+FoU/SeOjb6PXVH+msLMcrzXQ=",
+    "hash": "sha256-1NTtacz18YBa9WEpdkOHfkAe2K3ScVD7PtISlRtsPW0=",
     "homepage": "https://registry.terraform.io/providers/hetznercloud/hcloud",
     "owner": "hetznercloud",
     "repo": "terraform-provider-hcloud",
-    "rev": "v1.68.0",
+    "rev": "v1.69.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-s9tdthUzIdisP0XB9V+HGlWgZCXnOodz9Atu/XyDKf4="
+    "vendorHash": "sha256-mUyCVzwl7YXfwu1NBMq91tAd9+wnHfwqgAqfzvOKjK8="
   },
   "huaweicloud_huaweicloud": {
     "hash": "sha256-r4SwNOQ2P9IdxAvPnIuJEolXfhI/GKSPUZ+yjBS7pKA=",
@@ -1328,11 +1328,11 @@
     "vendorHash": "sha256-t799EW0oXtzzHVjbOv5dPQ5V070wg7Y8MZohQ1O70Pk="
   },
   "tencentcloudstack_tencentcloud": {
-    "hash": "sha256-nuzKpMtJT0y4OuSvYTKbAs1+FYTpnXnWYI9oEzdt1BM=",
+    "hash": "sha256-tsqcbnHL1U6zJE+hyFV1ycJIN2+i9zD2EKGms5kAuoQ=",
     "homepage": "https://registry.terraform.io/providers/tencentcloudstack/tencentcloud",
     "owner": "tencentcloudstack",
     "repo": "terraform-provider-tencentcloud",
-    "rev": "v1.83.29",
+    "rev": "v1.83.32",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },

pkgs/applications/virtualization/singularity/packages.nix

@@ -9,14 +9,14 @@ let
     callPackage
       (import ./generic.nix rec {
         pname = "apptainer";
-        version = "1.5.0";
+        version = "1.5.1";
         projectName = "apptainer";
 
         src = fetchFromGitHub {
           owner = "apptainer";
           repo = "apptainer";
           tag = "v${version}";
-          hash = "sha256-zx3NPuwz3ZNJeYw4CG1/q8uwbGpA7G1/hvw6VmoCNkg=";
+          hash = "sha256-Urohgxo9Wbh8GieJOfstRHr4CEmepPbMJKndEFsT50Y=";
         };
 
         # Override vendorHash with overrideAttrs.

pkgs/by-name/ae/aerion-creds/package.nix

@@ -5,7 +5,7 @@
 }:
 
 let
-  version = "0.3.3";
+  version = "0.3.4";
 
   archMap = {
     "x86_64-linux" = "x86_64";
@@ -16,7 +16,7 @@ let
       or (throw "Unsupported architecture: ${stdenv.hostPlatform.system}");
 
   shimHashes = {
-    "x86_64" = "sha256-8WvuQgWTJNe4UpmS6uSYDYm46sIqxJbwVZ/J3CRz0OI=";
+    "x86_64" = "sha256-7PLMiY2Aqx33IsdMMtZd2WLsErWLZTAYV+5TcED0pUU=";
     "aarch64" = "sha256-4RvFbxJGwM70huziY2ELoCouTrtMasgoqFUncBeBFvU=";
   };
 in

pkgs/by-name/ap/aptakube/package.nix

@@ -23,11 +23,11 @@ stdenvNoCC.mkDerivation (
     sources = {
       aarch64-darwin = {
         name = "Aptakube_${finalAttrs.version}_universal.dmg";
-        hash = "sha256-HMLxQnZsXRUjR/O0OEVfvKVTZyy9X9/3OZ6j1yWyIKA=";
+        hash = "sha256-wDfb2B5KMIkQcwO9JkX2b5FpgzJaUSKZTFQCqRkfLls=";
       };
       x86_64-linux = {
         name = "aptakube_${finalAttrs.version}_amd64.deb";
-        hash = "sha256-IFLft9ee9jxTq4xzvFVX45u2x5QCLxAtKfLgbIOMsF8=";
+        hash = "sha256-HDbRWTNFX2V0kgeFIZPLNLRTRxx/eETQiyLD1Yf6YYg=";
       };
     };
 
@@ -42,7 +42,7 @@ stdenvNoCC.mkDerivation (
   in
   {
     pname = "aptakube";
-    version = "1.19.6";
+    version = "1.20.4";
 
     __structuredAttrs = true;
     strictDeps = true;

pkgs/by-name/ar/artisan/package.nix

@@ -6,11 +6,11 @@
 }:
 let
   pname = "artisan";
-  version = "4.0.2";
+  version = "4.2.0";
 
   src = fetchurl {
     url = "https://github.com/artisan-roaster-scope/artisan/releases/download/v${version}/${pname}-linux-${version}.AppImage";
-    hash = "sha256-KmjqM3gYpxxjEBaXjF5zvL8bgfgD8IKvAX0xYf29J48=";
+    hash = "sha256-4vhdx97Y8ntj4HU2T/pHq/ZgioeY0yi+ydVcDFrHRrQ=";
   };
 
   appimageContents = appimageTools.extract {
@@ -26,7 +26,7 @@ appimageTools.wrapType2 {
   '';
 
   passthru.updateScript = nix-update-script {
-    extraArgs = [ "--version-regex=v([\\d.]+)" ];
+    extraArgs = [ "--version-regex=v([\\d.]+)$" ];
   };
 
   meta = {

pkgs/by-name/bl/blesh/package.nix

@@ -10,14 +10,14 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "blesh";
-  version = "0.4.0-devel3-unstable-2026-09-05";
+  version = "0.4.0-devel3-unstable-2026-09-08";
 
   src = fetchFromGitHub {
     owner = "akinomyoga";
     repo = "ble.sh";
-    rev = "69ee0587208881d18adc8a63028f714ab81ad94f";
+    rev = "d81fd54feb0d996fdff20dca27eaf0201f7015cc";
     fetchSubmodules = true;
-    hash = "sha256-Hmh/gBPtJEAuUq5K5EYK+QrH4gTr+Y1MNsVmS/IraRY=";
+    hash = "sha256-meKnNtepyOXfVGq351AoCML/vcgML79R3HW2Tf9rIuk=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ca/camunda-modeler/package.nix

@@ -10,11 +10,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "camunda-modeler";
-  version = "5.51.0";
+  version = "5.51.1";
 
   src = fetchurl {
     url = "https://github.com/camunda/camunda-modeler/releases/download/v${version}/camunda-modeler-${version}-linux-x64.tar.gz";
-    hash = "sha256-Gofx/Spa9zZf9805uCvWOKVMBNb29sXGl+iYsEfNhH8=";
+    hash = "sha256-JzrLhC6zQhKNRgMQYcyrt7vdrt7QQtCCg/8GoqV1hco=";
   };
   sourceRoot = "camunda-modeler-${version}-linux-x64";
 

pkgs/by-name/ch/chroncal/package.nix

@@ -9,17 +9,17 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "chroncal";
-  version = "0.9.1";
+  version = "0.10.0";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "DouglasdeMoura";
     repo = "chroncal";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-NQe73JFIp2rWPPKzyloIJGsZ2m6kaGEaqPaO5Z+vUmY=";
+    hash = "sha256-2ra4P5wo1wlB1+7IK8z7bZ4mkI949dV3ADKWWDzbpII=";
   };
 
-  vendorHash = "sha256-kWFZOjqpNH9VEOCFdRVXd47wpn/EMUVIZwFJFtICRlE=";
+  vendorHash = "sha256-6i48BSXh1gRvrU9Hd0myPDLf783Rl4k3n6DwcAO1Y2Y=";
 
   nativeBuildInputs = [
     writableTmpDirAsHomeHook # multiple tests need a writable $HOME for the database

pkgs/by-name/ci/citrix-workspace/package.nix

@@ -111,17 +111,17 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "citrix-workspace";
-  version = "26.04.0.105";
+  version = "26.08.0.153";
 
   src = requireFile rec {
     name = "linuxx64-${finalAttrs.version}.tar.gz";
-    sha256 = "1kl6b1ldjd9gb6cmvhxf6ggvc3amq1kz0qwjlb1fp6dxx0pivwm8";
+    sha256 = "17f0nlg18bz2b6qq86i04igm551b54nym41zi13m81906fzgi4h7";
 
     message = ''
       In order to use Citrix Workspace, you need to comply with the Citrix EULA and download
       the 64-bit binaries, .tar.gz from:
 
-      https://www.citrix.com/downloads/workspace-app/betas-and-tech-previews/workspace-app-tp-gcc11-for-linux.html
+      https://www.citrix.com/downloads/workspace-app/betas-and-tech-previews/workspace-app-tp-for-linux.html
 
       (if you do not find version ${finalAttrs.version} there, try at
       https://www.citrix.com/downloads/workspace-app/)
@@ -230,11 +230,22 @@ stdenv.mkDerivation (finalAttrs: {
       isSelfservice = program: (builtins.match "selfservice(.*)" program) != null;
       isWfica = program: (builtins.match "wfica(.*)" program) != null;
 
+      # These helpers read ICAROOT without accepting the generic -icaroot flag.
+      isEnvOnly =
+        program:
+        builtins.elem program [
+          "util/logmgr"
+          "util/nfcui"
+          "util/sendfeedback"
+          "util/setlog"
+          "util/storebrowse"
+        ];
+
       icaFlag =
         program:
         if isSelfservice program then
           "--icaroot"
-        else if isWfica program then
+        else if isWfica program || isEnvOnly program then
           null
         else
           "-icaroot";
@@ -252,6 +263,15 @@ stdenv.mkDerivation (finalAttrs: {
           ]
         );
 
+      runtimeSetup = ''
+        export NIX_REDIRECTS="/usr/share/zoneinfo=${tzdata}/share/zoneinfo:/etc/zoneinfo=${tzdata}/share/zoneinfo:/etc/timezone=$ICAROOT/timezone"
+
+        # Citrix invokes the FHS helper path; NixOS supplies the privileged wrapper here.
+        if [ -x /run/wrappers/bin/fusermount3 ]; then
+          NIX_REDIRECTS="$NIX_REDIRECTS:/usr/bin/fusermount3=/run/wrappers/bin/fusermount3"
+        fi
+      '';
+
       # Only the ICA engine needs the top-level client directory on the library
       # path. Leaving it enabled for UI helpers exposes Citrix's session-only
       # libproxy.so to the embedded web stack, which then fails to resolve CGP
@@ -263,10 +283,10 @@ stdenv.mkDerivation (finalAttrs: {
           ++ [
             ''--set ICAROOT "$ICAInstDir"''
             ''--prefix GIO_EXTRA_MODULES : "${glib-networking}/lib/gio/modules"''
-            ''--prefix GST_PLUGIN_SYSTEM_PATH_1_0 : "${gstPluginPath}"''
+            ''--prefix GST_PLUGIN_SYSTEM_PATH_1_0 : "$ICAInstDir/gst-plugins:${gstPluginPath}"''
             ''--prefix LD_LIBRARY_PATH : "${ldLibraryPath program}"''
             ''--set LD_PRELOAD "${libredirect}/lib/libredirect.so ${lib.getLib pcsclite}/lib/libpcsclite.so"''
-            ''--set NIX_REDIRECTS "/usr/share/zoneinfo=${tzdata}/share/zoneinfo:/etc/zoneinfo=${tzdata}/share/zoneinfo:/etc/timezone=$ICAInstDir/timezone"''
+            "--run ${lib.escapeShellArg runtimeSetup}"
           ]
           ++ lib.optionals (isWfica program) [
             # wfica is an X11 client (it runs under XWayland). On a Wayland
@@ -280,7 +300,7 @@ stdenv.mkDerivation (finalAttrs: {
         );
 
       wrap = program: ''
-        wrapProgram $out/opt/citrix-icaclient/${program} \
+        wrapProgramShell $out/opt/citrix-icaclient/${program} \
           ${wrapperArgs program}
       '';
 
@@ -290,7 +310,7 @@ stdenv.mkDerivation (finalAttrs: {
       '';
 
       makeBinWrapper = program: wrapperName: ''
-        makeWrapper $out/opt/citrix-icaclient/${program} $out/bin/${wrapperName} \
+        makeShellWrapper $out/opt/citrix-icaclient/${program} $out/bin/${wrapperName} \
           ${wrapperArgs program}
       '';
 
@@ -307,6 +327,7 @@ stdenv.mkDerivation (finalAttrs: {
         "util/conncenter"
         "util/ctx_rehash"
         "util/ctxwebhelper"
+        "util/storebrowse"
       ];
     in
     ''
@@ -332,23 +353,30 @@ stdenv.mkDerivation (finalAttrs: {
       # the tarball still contains the legacy WebKitGTK 4.0 bundle.
       rm -rf "$ICAInstDir/Webkit2gtk4.0"
 
+      # hinst installs this user unit outside the package for non-root installs.
+      mkdir -p $out/lib/systemd/user
+      sed \
+        -e '/^#/d' \
+        -e "s,###ICAROOT###,$ICAInstDir,g" \
+        -e 's,###USER###,default,' \
+        linuxx64/linuxx64.cor/ctxcwalogd.service > $out/lib/systemd/user/ctxcwalogd.service
+
       # FHS launcher hinst generates even for non-root installs; it hardcodes
       # store paths without any of the wrapper environment.
       rm -f "$ICAInstDir/wfica.sh"
-      if [ -f "$ICAInstDir/util/setlog" ]; then
-        chmod +x "$ICAInstDir/util/setlog"
-        ln -sf "$ICAInstDir/util/setlog" "$out/bin/citrix-setlog"
-      fi
+      chmod +x "$ICAInstDir/util/setlog"
       ${mkWrappers wrapLink toWrap}
       ${makeBinWrapper "wfica" "wfica"}
+      ${makeBinWrapper "util/setlog" "citrix-setlog"}
       ${mkWrappers wrap [
         "PrimaryAuthManager"
         "ServiceRecord"
         "AuthManagerDaemon"
+        "util/logmgr"
+        "util/nfcui"
+        "util/sendfeedback"
       ]}
 
-      ln -sf $ICAInstDir/util/storebrowse $out/bin/storebrowse
-
       # As explained in https://wiki.archlinux.org/index.php/Citrix#Security_Certificates
       echo "Expanding certificates..."
       pushd "$ICAInstDir/keystore/cacerts"
@@ -362,9 +390,16 @@ stdenv.mkDerivation (finalAttrs: {
       rm $ICAInstDir/util/{gst_aud_{play,read},gst_*0.10,libgstflatstm0.10.so} || true
       ln -sf $ICAInstDir/util/gst_play1.0 $ICAInstDir/util/gst_play
       ln -sf $ICAInstDir/util/gst_read1.0 $ICAInstDir/util/gst_read
+
+      # hinst links this plugin into FHS directories; expose it through the wrapper instead.
+      mkdir -p "$ICAInstDir/gst-plugins"
+      ln -s "$ICAInstDir/util/libgstflatstm1.0.so" \
+        "$ICAInstDir/gst-plugins/libgstflatstm.so"
+
       # `hinst` disables multimedia when it cannot link into FHS plugin
       # directories. In Nix we provide the plugin path via wrappers instead.
       sed -i 's/^MultiMedia=Off$/MultiMedia=On/' "$ICAInstDir/config/module.ini"
+      grep -Fxq 'MultiMedia=On' "$ICAInstDir/config/module.ini"
 
       echo "We arbitrarily set the timezone to UTC. No known consequences at this point."
       echo UTC > "$ICAInstDir/timezone"
@@ -433,6 +468,6 @@ stdenv.mkDerivation (finalAttrs: {
       khaneliman
       flacks
     ];
-    homepage = "https://www.citrix.com/downloads/workspace-app/betas-and-tech-previews/workspace-app-tp-gcc11-for-linux.html";
+    homepage = "https://www.citrix.com/downloads/workspace-app/betas-and-tech-previews/workspace-app-tp-for-linux.html";
   };
 })

pkgs/by-name/cl/claude-code/manifest.zst.json

@@ -1,66 +1,61 @@
 {
-  "version": "2.1.272",
+  "version": "2.1.276",
   "manifestSignatureEnforcement": "flag",
-  "commit": "013cad548b76e5d315ae72da82dce47cd7c99678",
-  "modsCommit": "f4ceeecabff13e814dc4302620e2da1a688e47f8",
-  "buildDate": "2026-09-14T23:04:39Z",
+  "commit": "bc0a4292e0472d227ceecb07d892ab1a777a4926",
+  "modsCommit": "68ac8bbf0245b615b41517bf8f2b2f35af1ae31d",
+  "buildDate": "2026-09-18T00:50:49Z",
   "platforms": {
     "darwin-arm64": {
       "binary": "claude.zst",
-      "checksum": "9bc86af289b3acd06d88ecdc6fab53e2c3590467984639d251aa28ca1d589f66",
-      "size": 69282560,
+      "checksum": "c152f199101ffb6a197fa79f3c1617f2e4ad72d9dd4ccef36559696bc6fbbf60",
+      "size": 71019331,
       "bundle": {
-        "checksum": "0f1472f473c0b0397efcb71906931bf14aac14d1487290c8dcfeeb4380123d1b",
-        "size": 69289478
+        "checksum": "38d7c719597489b2b79069161d3b9e93b907f5e44b97cd44e479f0742a9eaa1e",
+        "size": 71024230
       }
     },
     "darwin-x64": {
       "binary": "claude.zst",
-      "checksum": "ceaee8ea1f6e3c7f468cd6e486367f6b129a1b76899b086b83ad7ccb1608b0b8",
-      "size": 73437901,
+      "checksum": "a7c803a21afc1f0e14aac3819de14a031cc259212de04ac14831c2ecac019f5b",
+      "size": 75199422,
       "bundle": {
-        "checksum": "6aecf0d1b0668278f0027d07bb5ce190aac1da74c1417113f87961f49584b28e",
-        "size": 73438431
+        "checksum": "49e425e56529477345458b2ed194eeddb24f9af457ae48e0a5895669343a3b62",
+        "size": 75199821
       }
     },
     "linux-arm64": {
       "binary": "claude.zst",
-      "checksum": "cc54fca24f7dec6ed921996121ae65e435cadbb50d256850e1cc70f3ae8b02e2",
-      "size": 78477860
+      "checksum": "2e0040597f5723fdc0608d11f84674e734a3bae0a3b23b7a0712c99e0d5fb5d8",
+      "size": 80195460
     },
     "linux-x64": {
       "binary": "claude.zst",
-      "checksum": "ef2c2de4f3464443e55e91b8552d67459e92f98b691198d1888de3bd49baaf4d",
-      "size": 79104422
+      "checksum": "0b2e7bfc53a34b64d03af28509f7803623efb02a7be598509981f937fe2849a8",
+      "size": 80820724
     },
     "linux-arm64-musl": {
       "binary": "claude.zst",
-      "checksum": "4c704bfab338332a6ea08b34fd57d2a961db55a16513252abfa6058160bb8bda",
-      "size": 76932867
+      "checksum": "660a62b76eac08fcc1c86ac0450f9a3689c80af4d4da3ed762efde999db7b9c6",
+      "size": 78648975
     },
     "linux-x64-musl": {
       "binary": "claude.zst",
-      "checksum": "9bc829d18b604f36764f53436ce3c5340de26e657f7c38367074cf28da41f159",
-      "size": 77594510
+      "checksum": "48e9423690734c4f5718eba6fea0c516bceee0c53b7522ec374aed65556aa082",
+      "size": 79312653
     },
     "win32-x64": {
       "binary": "claude.exe.zst",
-      "checksum": "f6b1c5f9c3a457d2aad026084ad459d8695a3d546be8b6ca972140b2ed7c0e31",
-      "size": 81487963
+      "checksum": "497143079a9c781ec15adf8ac682ac8cc4d8db80844ce7051c102c765308526c",
+      "size": 83217487
     },
     "win32-arm64": {
       "binary": "claude.exe.zst",
-      "checksum": "bb01dee14a4084375e712bdcb467c591b7dfa9674b905bbcf66b5cd3d8c69376",
-      "size": 78223647
+      "checksum": "d805fed8cbe7f1919b8f2b4bcb3718c426dda4ac1b5695555a69d0cc9a6a053a",
+      "size": 79954588
     }
   },
   "sdkCompat": {
     "testedWrapperVersions": [
-      "0.3.232",
-      "0.3.233",
-      "0.3.234",
-      "0.3.235",
-      "0.3.236",
       "0.3.237",
       "0.3.238",
       "0.3.239",
@@ -75,6 +70,7 @@
       "0.3.250",
       "0.3.251",
       "0.3.252",
+      "0.3.257",
       "0.3.258",
       "0.3.259",
       "0.3.260",
@@ -85,7 +81,11 @@
       "0.3.268",
       "0.3.269",
       "0.3.270",
-      "0.3.271"
+      "0.3.271",
+      "0.3.272",
+      "0.3.273",
+      "0.3.274",
+      "0.3.275"
     ],
     "harnessSchema": 1
   }

pkgs/by-name/cm/cmctl/package.nix

@@ -9,16 +9,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "cmctl";
-  version = "2.5.0";
+  version = "2.6.1";
 
   src = fetchFromGitHub {
     owner = "cert-manager";
     repo = "cmctl";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-TFVGyb09+QDcRy1y6ilQ0A2IJ13ZQOZJ+X+habgAG6U=";
+    hash = "sha256-a7KC7asTQT+HaK5FXjK4FAvTBIHn6+5upWM1yjelaJ4=";
   };
 
-  vendorHash = "sha256-u7r+RIYleY7Ymtc/ZnQSkGADxBmjqHdQV2M0myV+UUg=";
+  vendorHash = "sha256-d8otp7/dyc8GR9hwwSd53JCUEFc5V47TKWEM3bTOC1A=";
 
   ldflags = [
     "-s"

pkgs/by-name/co/cocoon/package.nix

@@ -8,13 +8,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "cocoon";
-  version = "0.11.1";
+  version = "0.11.3";
 
   src = fetchFromGitHub {
     owner = "haileyok";
     repo = "cocoon";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Iq+BLljHbJFKVNYkLN1emTvMSPR660iysptFeMqKfEI=";
+    hash = "sha256-+Qpv8cZmAkhIZFM4fCT4oXBYHlXzqFDRMRErjjZG67A=";
   };
 
   ldflags = [
@@ -23,7 +23,7 @@ buildGoModule (finalAttrs: {
     "-X main.Version=${finalAttrs.version}"
   ];
 
-  vendorHash = "sha256-Vkf5XyJA/Vdufa1OpCzgIGSQa5pVsFCTfaAVI7l947E=";
+  vendorHash = "sha256-BFnZlUT4/jVdTC7bccKXLa9KiHaUM11J76DcFuBI7Ts=";
 
   passthru = {
     tests = lib.optionalAttrs stdenvNoCC.hostPlatform.isLinux { inherit (nixosTests) cocoon; };

pkgs/by-name/co/code-cursor/sources.json

@@ -1,18 +1,18 @@
 {
-  "version": "3.19.13",
+  "version": "3.21.9",
   "vscodeVersion": "1.128.0",
   "sources": {
     "x86_64-linux": {
-      "url": "https://downloads.cursor.com/production/dd066f332fcea7382764400fde902f61920648d5/linux/x64/Cursor-3.19.13-x86_64.AppImage",
-      "hash": "sha256-B9kDP/TsvE2OmhYEq77ZyiQttho3FQlRa4Ux1RDptQg="
+      "url": "https://downloads.cursor.com/production/9998796a6096ce83d83a9332bfe7473b985db750/linux/x64/Cursor-3.21.9-x86_64.AppImage",
+      "hash": "sha256-+CwdR4EHuDyHq3UwHs54iY9xuQ9coG6gWopURYFfppg="
     },
     "aarch64-linux": {
-      "url": "https://downloads.cursor.com/production/dd066f332fcea7382764400fde902f61920648d5/linux/arm64/Cursor-3.19.13-aarch64.AppImage",
-      "hash": "sha256-ASbYwBEL9hA6dggqzPdif8qlaX9qxWPM/hhfLVwUtp4="
+      "url": "https://downloads.cursor.com/production/9998796a6096ce83d83a9332bfe7473b985db750/linux/arm64/Cursor-3.21.9-aarch64.AppImage",
+      "hash": "sha256-33HIt8qjYaUTFkXCkpW6odZhfkDeWwfLjL3HqJRYWWA="
     },
     "aarch64-darwin": {
-      "url": "https://downloads.cursor.com/production/dd066f332fcea7382764400fde902f61920648d5/darwin/arm64/Cursor-darwin-arm64.dmg",
-      "hash": "sha256-kDroiBbBXD/eOfdlSjeDt5ObSiLRaLmrpJOKstKvxE8="
+      "url": "https://downloads.cursor.com/production/9998796a6096ce83d83a9332bfe7473b985db750/darwin/arm64/Cursor-darwin-arm64.dmg",
+      "hash": "sha256-xil/4NSrOME8oCRYsyjT3BVS5F7t5bDjdastsikEI3w="
     }
   }
 }

pkgs/by-name/co/containeryard/package.nix

@@ -7,17 +7,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "containeryard";
-  version = "0.3.12";
+  version = "0.3.13";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "mcmah309";
     repo = "containeryard";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-jXjr8y8QorpFamLIFVb3vJMH0FUrk2jZraxKtgdLev4=";
+    hash = "sha256-aj9nFw+EXvBc3+tzy87UN2KBPaUQaOUbslnEE6rCGB0=";
   };
 
-  cargoHash = "sha256-VbIY7SF8imVTEGbQT2QI+lbPtkbfbGXJZVukVQvHX+E=";
+  cargoHash = "sha256-H1gIhQ0V1//2QVFNg9VqIkVgDI9Dm5N/6Dho+lrU1Mg=";
 
   nativeInstallCheckInputs = [
     versionCheckHook

pkgs/by-name/cp/cpak/package.nix

@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "cpak";
-  version = "2.12.7";
+  version = "2.13.3";
 
   src = fetchFromGitHub {
     owner = "Containerpak";
     repo = "cpak";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-bISKyH1+Yr1EBzZYIK0xpe0jmBiWtCnByz4Ng01QJCI=";
+    hash = "sha256-hGDiywyYZV0o8nUZgw6YqUmN33uFzXHIxkDvlY+tiyU=";
   };
 
   vendorHash = "sha256-cgqb2AY06Ru+JJIK7vyaLSPyjJqiLvNytvSQCgDOASc=";

pkgs/by-name/cs/csol/package.nix

@@ -0,0 +1,52 @@
+{
+  stdenv,
+  lib,
+  cmake,
+  ncurses,
+  fetchFromGitHub,
+  makeWrapper,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "csol";
+  version = "1.6.0";
+
+  src = fetchFromGitHub {
+    owner = "nielssp";
+    repo = "csol";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-EWQL63xE6Z7npXH5ht5KYtQaPrDwuPe2ZhmHrvYIAu8=";
+  };
+
+  __structuredAttrs = true;
+
+  strictDeps = true;
+
+  patches = [ ./replace-etc-path.patch ];
+
+  nativeBuildInputs = [
+    cmake
+    makeWrapper
+  ];
+  buildInputs = [ ncurses ];
+
+  postFixup = ''
+    wrapProgram $out/bin/csol \
+      --add-flags "-c $out/etc/xdg/csol/csolrc"
+  '';
+
+  cmakeFlags = [
+    "-DCMAKE_POLICY_VERSION_MINIMUM=3.5"
+  ];
+
+  hardeningDisable = [ "format" ];
+
+  meta = {
+    description = "A small collection of solitaire/patience games (Klondike, FreeCell, Spider, Yukon, etc.) to play in the terminal";
+    license = lib.licenses.mit;
+    homepage = "https://nielssp.dk/csol";
+    changelog = "https://github.com/nielssp/csol/releases/tag/v${finalAttrs.version}";
+    maintainers = with lib.maintainers; [ gimura ];
+    mainProgram = "csol";
+  };
+})

pkgs/by-name/cs/csol/replace-etc-path.patch

@@ -0,0 +1,15 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 6c17703..70896f7 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -21,7 +21,7 @@ add_executable(csol ${SRC_LIST} csolrc)
+ target_link_libraries(csol ${CURSES_LIBRARIES})
+ 
+ install(TARGETS csol DESTINATION bin COMPONENT binaries)
+-install(FILES "${CMAKE_BINARY_DIR}/csolrc" DESTINATION /etc/xdg/csol COMPONENT config)
+-install(DIRECTORY "${CMAKE_BINARY_DIR}/themes" DESTINATION /etc/xdg/csol COMPONENT config)
+-install(DIRECTORY "${CMAKE_BINARY_DIR}/games" DESTINATION /etc/xdg/csol COMPONENT config)
++install(FILES "${CMAKE_BINARY_DIR}/csolrc" DESTINATION etc/xdg/csol COMPONENT config)
++install(DIRECTORY "${CMAKE_BINARY_DIR}/themes" DESTINATION etc/xdg/csol COMPONENT config)
++install(DIRECTORY "${CMAKE_BINARY_DIR}/games" DESTINATION etc/xdg/csol COMPONENT config)
+ install(FILES "${PROJECT_SOURCE_DIR}/doc/csol.6" DESTINATION ${CMAKE_INSTALL_PREFIX}/share/man/man6)

pkgs/by-name/ct/ctx7/package.nix

@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  installAgentSkills,
   makeWrapper,
   nix-update-script,
   versionCheckHook,
@@ -33,8 +34,12 @@ stdenv.mkDerivation (finalAttrs: {
     pnpm
     pnpmConfigHook
     makeWrapper
+    installAgentSkills
   ];
 
+  # the monorepo vendors the same skills for many agents and packages
+  dontInstallAgentSkills = true;
+
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
     inherit pnpm;
@@ -64,7 +69,9 @@ stdenv.mkDerivation (finalAttrs: {
     makeWrapper ${nodejs}/bin/node $out/bin/ctx7 \
       --add-flags "$out/lib/ctx7/dist/index.js"
 
-    cp -R $src/{plugins,rules,skills} $out
+    cp -R $src/{plugins,rules} $out
+    installSkill skills/context7-cli
+    installSkill skills/find-docs
 
     runHook postInstall
   '';

pkgs/by-name/cv/cvc5/package.nix

@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "cvc5";
-  version = "1.3.4";
+  version = "1.4.0";
 
   src = fetchFromGitHub {
     owner = "cvc5";
     repo = "cvc5";
     tag = "cvc5-${finalAttrs.version}";
-    hash = "sha256-PZcOArSTyJzyd2DKT8K0aFC4RlVXgTCnkoU0f08KPfY=";
+    hash = "sha256-QBDOGWGPoVEaf0j4Ug4jdqntUKpHCObLxKGX7KZR9VI=";
   };
 
   __structuredAttrs = true;

pkgs/by-name/de/deezer-desktop/package.nix

@@ -8,15 +8,15 @@
 }:
 
 let
-  version = "7.1.320";
+  version = "7.1.330";
   srcs = {
     x86_64-linux = fetchurl {
       url = "https://github.com/aunetx/deezer-linux/releases/download/v${version}/deezer-desktop-${version}-x64.tar.xz";
-      hash = "sha256-qCi7Yi2phMtN4IWo8eR0SFIe90TpOk2jqJKj3URSeNQ=";
+      hash = "sha256-DZ5BjNJYS0Ke7Cgc0xCjojbUWpMfOR5lKOMyN4gOhIA=";
     };
     aarch64-linux = fetchurl {
       url = "https://github.com/aunetx/deezer-linux/releases/download/v${version}/deezer-desktop-${version}-arm64.tar.xz";
-      hash = "sha256-xgpdmrM3+v9o0sKyYv09MxdD6xoTNff3hPgD+loyhNE=";
+      hash = "sha256-oKDwECjatV/dT/cnGN6Sk6RTIVDiKI8R0AAYmRvVlmo=";
     };
   };
 

pkgs/by-name/de/devin-cli/package.nix

@@ -7,24 +7,24 @@
 }:
 
 let
-  version = "3000.6.14";
+  version = "3000.10.31";
 
   throwSystem = throw "Unsupported system: ${stdenvNoCC.hostPlatform.system}";
 
   srcs = {
     x86_64-linux = fetchurl {
       url = "https://static.devin.ai/cli/${version}/devin-${version}-x86_64-unknown-linux.tar.gz";
-      hash = "sha256-KM9kwd+fWMzQY/t+b9bpORBzxYW3M0STcUheHvij5ts=";
+      hash = "sha256-QyGNgO5JV29PhKH/1KTOx1XFRbXKmMWybvzlNAgk8zE=";
     };
 
     aarch64-linux = fetchurl {
       url = "https://static.devin.ai/cli/${version}/devin-${version}-aarch64-unknown-linux.tar.gz";
-      hash = "sha256-VM9YRcGq5c6zRXC6N7rObRWzPrAXXg8vHsZLrAOKlfA=";
+      hash = "sha256-balrnIwjN4ksDa0KEseqp+Vov+91crv1TnoOyIkWujM=";
     };
 
     aarch64-darwin = fetchurl {
       url = "https://static.devin.ai/cli/${version}/devin-${version}-aarch64-apple-darwin.tar.gz";
-      hash = "sha256-YAW8LBlE8BQ0Vld9c6akzIDVcX3PJgbc02GolYxHISY=";
+      hash = "sha256-BR388p4PXLXwoHx1edyXJV/ufwLOTG/qzH1AZc52tb0=";
     };
   };
 in

pkgs/by-name/do/dotenvx/package.nix

@@ -7,16 +7,16 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "dotenvx";
-  version = "2.23.0";
+  version = "2.28.0";
 
   src = fetchFromGitHub {
     owner = "dotenvx";
     repo = "dotenvx";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-cvIblWPNhJPah8nWrJqHAwawQ9C8EueB0leF+miOIH0=";
+    hash = "sha256-fp5sse5KN4uitPjEqdkGpajpZbvRsUAIhCo/R59OBRI=";
   };
 
-  npmDepsHash = "sha256-5dhLX6yWdQlS5XHF3Evbk5xbD87HJEiMRDdHTstzfWw=";
+  npmDepsHash = "sha256-Cv75DDlilwa9PtgA7ZbdPfa0LfKGclfr5BsHT4+oqT0=";
 
   dontNpmBuild = true;
 

pkgs/by-name/fl/flying-carpet/package.nix

@@ -19,16 +19,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "flying-carpet";
-  version = "10.0.4";
+  version = "10.0.5";
 
   src = fetchFromGitHub {
     owner = "spieglt";
     repo = "FlyingCarpet";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-v7W3rHmEmxR/YpmrSBMmFSkHwrlxwnutHyNju6Jsqh0=";
+    hash = "sha256-A+OxZ2e2JNV1iH6m6pDtPFL4ESnwajvGp4ReDlK3S04=";
   };
 
-  cargoHash = "sha256-WZ93Gk2n8GJox7I4o/McC0AgrBh6CZAJFcXWvALk9TM=";
+  cargoHash = "sha256-F+fJb1S221qRNcxXJD6ZLGfeq8cMkIRf/SiaO3V/YGM=";
 
   nativeBuildInputs = [
     cargo-tauri.hook

pkgs/by-name/fo/foomatic-db-engine/package.nix

@@ -31,32 +31,34 @@ perlPackages.buildPerlPackage rec {
 
   outputs = [ "out" ];
 
+  strictDeps = true;
+  __structuredAttrs = true;
+
   propagatedBuildInputs = [
     perlPackages.Clone
     perlPackages.DBI
     perlPackages.XMLLibXML
   ];
 
-  buildInputs = [
-    curl
-  ]
-  # provide some "cups-*" commands to `foomatic-{configure,printjob}`
-  # so that they can manage a local cups server (add queues, add jobs...)
-  ++ lib.optionals withCupsAccess [
-    cups
-    cups-filters
-  ]
-  # the commands `foomatic-{configure,getpjloptions}` need
-  # netcat if they are used to query or alter a network
-  # printer via AppSocket/HP JetDirect protocol
-  ++ lib.optional withSocketAccess netcat-gnu
-  # `foomatic-configure` can be used to access printers that are
-  # shared via the SMB protocol, but it needs the `smbclient` binary
-  ++ lib.optional withSMBAccess samba;
+  buildInputs =
+    # provide some "cups-*" commands to `foomatic-{configure,printjob}`
+    # so that they can manage a local cups server (add queues, add jobs...)
+    lib.optionals withCupsAccess [
+      cups
+      cups-filters
+    ]
+    # the commands `foomatic-{configure,getpjloptions}` need
+    # netcat if they are used to query or alter a network
+    # printer via AppSocket/HP JetDirect protocol
+    ++ lib.optional withSocketAccess netcat-gnu
+    # `foomatic-configure` can be used to access printers that are
+    # shared via the SMB protocol, but it needs the `smbclient` binary
+    ++ lib.optional withSMBAccess samba;
 
   nativeBuildInputs = [
     autoconf
     automake
+    curl
     file
     makeWrapper
   ];

pkgs/by-name/fo/foomatic-db-nonfree/package.nix

@@ -20,6 +20,9 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-cRZH0CXg03FEqUJdxaNnPVXjf8+ct86PjhL59WQbw60=";
   };
 
+  strictDeps = true;
+  __structuredAttrs = true;
+
   nativeBuildInputs = [
     autoconf
     automake

pkgs/by-name/fo/foomatic-db-ppds/package.nix

@@ -5,6 +5,7 @@
   buildEnv,
   foomatic-db-engine,
   stdenv,
+  coreutils,
   cups-filters,
   ghostscript,
   netpbm,
@@ -51,7 +52,11 @@ stdenv.mkDerivation {
     lib.lists.head
   ];
 
+  strictDeps = true;
+  __structuredAttrs = true;
+
   buildInputs = [
+    coreutils
     cups-filters
     ghostscript
     netpbm
@@ -76,8 +81,8 @@ stdenv.mkDerivation {
 
   # Comments indicate the respective
   # package the command is contained in.
-  ppdFileCommands = [
-    "cat"
+  env.ppdFileCommands = lib.join " " [
+    "cat" # coreutils
     "echo" # coreutils
     "foomatic-rip" # cups-filters or foomatic-filters
     "gs" # ghostscript

pkgs/by-name/fo/foomatic-db/package.nix

@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  coreutils,
   cups,
   cups-filters,
   ghostscript,
@@ -14,18 +15,22 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "foomatic-db";
-  version = "0-unstable-2026-02-09";
+  version = "0-unstable-2026-09-04";
 
   src = fetchFromGitHub {
     # there is also a daily snapshot at the `downloadPage`,
     # but it gets deleted quickly and would provoke 404 errors
     owner = "OpenPrinting";
     repo = "foomatic-db";
-    rev = "57e546cb7774c7b03e7090ced65fb1ffd552f33d";
-    hash = "sha256-mQEOV+NJId5h/hYOL+2JrEHjqM77qRExDNeqZ0IyA08=";
+    rev = "76dd1e31354c189b2edd9ae8201285d622c89395";
+    hash = "sha256-rTowiKV4alVAw9qrqSARVL2Fl+soIzhwQYlANiRXI74=";
   };
 
+  strictDeps = true;
+  __structuredAttrs = true;
+
   buildInputs = [
+    coreutils
     cups
     cups-filters
     ghostscript
@@ -74,8 +79,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   # Comments indicate the respective
   # package the command is contained in.
-  ppdFileCommands = [
-    "cat"
+  env.ppdFileCommands = lib.join " " [
+    "cat" # coreutils
     "date"
     "printf" # coreutils
     "rastertohp" # cups

pkgs/by-name/ft/ft2-clone/package.nix

@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ft2-clone";
-  version = "2.23";
+  version = "2.24";
 
   src = fetchFromGitHub {
     owner = "8bitbubsy";
     repo = "ft2-clone";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-I/aF4t3lajEuqR0NZpxPsuYIZRUjWzCof08STSM3x+Q=";
+    hash = "sha256-/13WSHF8HyOhF5mYfaHSX0+2dzKAgVClxhtuNZJwX34=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/by-name/gd/gdal/package.nix

@@ -92,6 +92,11 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-8rTCv0Nsb+BhRypwXDY5SWP7Bo1vqJBlm7y6YCOMa2M=";
   };
 
+  patches = [
+    # https://github.com/OSGeo/gdal/pull/15259
+    ./proj-9.9.0-compat.patch
+  ];
+
   nativeBuildInputs = [
     bison
     cmake

pkgs/by-name/gd/gdal/proj-9.9.0-compat.patch

@@ -0,0 +1,29 @@
+diff --git a/autotest/utilities/test_gdalalg_mdim_info.py b/autotest/utilities/test_gdalalg_mdim_info.py
+index 33b87f60fc..63c283b350 100755
+--- a/autotest/utilities/test_gdalalg_mdim_info.py
++++ b/autotest/utilities/test_gdalalg_mdim_info.py
+@@ -180,7 +180,14 @@ def test_gdalalg_mdim_info_all_options():
+ def test_gdalalg_mdim_info_binary(gdal_path):
+ 
+     out = gdaltest.runexternal(f"{gdal_path} mdim info ../gdrivers/data/netcdf/byte.nc")
+-    assert json.loads(out) == {
++
++    info = json.loads(out)
++
++    # make PROJ 9.9.0 output equivalent to previous versions (#15250)
++    srs = info["arrays"]["Band1"]["srs"]
++    srs["wkt"] = srs["wkt"].replace("(E)", "easting").replace("(N)", "northing")
++
++    expected = {
+         "arrays": {
+             "Band1": {
+                 "attributes": {
+@@ -313,6 +320,8 @@ def test_gdalalg_mdim_info_binary(gdal_path):
+         "type": "group",
+     }
+ 
++    assert info == expected
++
+ 
+ def test_gdalalg_mdim_info_completion_array_invalid_ds(gdal_path):
+ 

pkgs/by-name/gi/gitte/package.nix

@@ -22,7 +22,7 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "gitte";
-  version = "0.10.0";
+  version = "0.10.1";
 
   __structuredAttrs = true;
 
@@ -30,12 +30,12 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "ckruse";
     repo = "Gitte";
     tag = finalAttrs.version;
-    hash = "sha256-AT9dTlme7n/pWwNE2q8mubz6gc1+k7gg10KposjLD6M=";
+    hash = "sha256-f2Vn2q/VJQbBJj4WwvLbjhQWZdZqx3lBhUMJnzvOIII=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-EwYPJ+ospD9qK/iSmhmQ/fo3ftJi2xA/UZ+rA0F6TCQ=";
+    hash = "sha256-xOuBp+gs7ffcqCEYGRkWQJ8aCwNsSJn9FquHKfmR4GI=";
   };
 
   strictDeps = true;

pkgs/by-name/gp/gpu-screen-recorder/package.nix

@@ -30,12 +30,12 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gpu-screen-recorder";
-  version = "6.1.1";
+  version = "6.1.2";
 
   src = fetchgit {
     url = "https://repo.dec05eba.com/gpu-screen-recorder";
     tag = finalAttrs.version;
-    hash = "sha256-I5q2bvCjoXkXue/rr6IhwwhdQkxMmf1MgaKEjh+IZP8=";
+    hash = "sha256-9B5LPcztv6Lpn7v/+5+nXyG3O3BKqnMenAl3USdRgrE=";
   };
 
   postPatch = ''

pkgs/by-name/gp/gpxsee/package.nix

@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gpxsee";
-  version = "16.14";
+  version = "16.15";
 
   src = fetchFromGitHub {
     owner = "tumic0";
     repo = "GPXSee";
     tag = finalAttrs.version;
-    hash = "sha256-/uIlNr3VaIXGwjC5vSozdIUjfo59VIddyBrPW7iOKa8=";
+    hash = "sha256-qxhjd5CSxGYo9BUIcdGbTOnjHqzB1MLouS9BZcj1abM=";
   };
 
   buildInputs = [

pkgs/by-name/gr/graff/manifest.json

@@ -1,21 +1,21 @@
 {
-  "version": "0.0.298",
+  "version": "0.0.299",
   "assets": {
     "x86_64-linux": {
-      "url": "https://github.com/justrach/codegraff/releases/download/v0.0.298/graff-x86_64-linux.tar.gz",
-      "hash": "sha256-VqLHMFpOP7TTqux9uGZ4QKgvbT0qAu+jvEYP7hJ0QDI="
+      "url": "https://github.com/justrach/codegraff/releases/download/v0.0.299/graff-x86_64-linux.tar.gz",
+      "hash": "sha256-qVS6Q3ccVgaJMaCnRX44JRZulQciS02R+D3+rmt73wI="
     },
     "aarch64-linux": {
-      "url": "https://github.com/justrach/codegraff/releases/download/v0.0.298/graff-aarch64-linux.tar.gz",
-      "hash": "sha256-W/9RoQ/9nlFHopcOU33IHEmR+daRTtRUMEfDwFnY+8c="
+      "url": "https://github.com/justrach/codegraff/releases/download/v0.0.299/graff-aarch64-linux.tar.gz",
+      "hash": "sha256-GHGgCopNQMNKiRv/LElYbRVYif8L9TLUoUsku0uEPfU="
     },
     "aarch64-darwin": {
-      "url": "https://github.com/justrach/codegraff/releases/download/v0.0.298/graff-aarch64-macos.tar.gz",
-      "hash": "sha256-pgKz3vcCguzbMGbHVNdMVB3xawwzAxwkvcKwuuXtIGk="
+      "url": "https://github.com/justrach/codegraff/releases/download/v0.0.299/graff-aarch64-macos.tar.gz",
+      "hash": "sha256-gyGFMTS8wH9cFGRBnCJtq0GtvxCg4VzNoVTnET+ELQ4="
     },
     "x86_64-darwin": {
-      "url": "https://github.com/justrach/codegraff/releases/download/v0.0.298/graff-x86_64-macos.tar.gz",
-      "hash": "sha256-RRX+342BEk9DJALxWd6wcrVE+C1ZRJfxlJT/SPlp26U="
+      "url": "https://github.com/justrach/codegraff/releases/download/v0.0.299/graff-x86_64-macos.tar.gz",
+      "hash": "sha256-akWs/kk/iptGnzDzzerdQbZoFF9k/HcguQvpvdnoSPs="
     }
   }
 }

pkgs/by-name/gr/grok-build/package.nix

@@ -10,7 +10,7 @@
   grok-build,
 }:
 let
-  version = "1.0.13";
+  version = "1.0.34";
 
   throwSystem = throw "Unsupported system: ${stdenvNoCC.hostPlatform.system}";
 
@@ -26,9 +26,9 @@ let
       url = "https://x.ai/cli/grok-${version}-${upstreamPlatform}";
       hash =
         {
-          x86_64-linux = "sha256-7feVIVgbtea5Wr74SEkaanQuhg2j4jfr6GooDTDc5ME=";
-          aarch64-linux = "sha256-uSb8Uwg3Q5biYOfvvWEHIxqNrhPAhN2vD+ibfrs+3SU=";
-          aarch64-darwin = "sha256-hmng/a3O7CW4wVnDVfQn/72CWDUl13S2qxUiGX6oO4A=";
+          x86_64-linux = "sha256-vlkF4QfSuLXzwULSHs/kyP0yqRPS/VUbeIcHkwxNyA0=";
+          aarch64-linux = "sha256-OauHZmh31k7zpAqmD74MO2pqzXABt4/mDix2u2z8SpQ=";
+          aarch64-darwin = "sha256-nNJrV5hA8PXJFIqAWa1lGQTAi0G38u8LTsBLm6iYhE4=";
         }
         .${system};
     }

pkgs/by-name/gt/gtkwave/package.nix

@@ -20,12 +20,16 @@ stdenv.mkDerivation (finalAttrs: {
   pname = "gtkwave";
   version = "3.3.128";
 
+  strictDeps = true;
+  __structuredAttrs = true;
+
   src = fetchurl {
     url = "mirror://sourceforge/gtkwave/gtkwave-gtk3-${finalAttrs.version}.tar.gz";
     sha256 = "sha256-gX4Zf8GAj4qsNUPCwvloPLATaMkRkrjq5a9YBw7x0fg=";
   };
 
   nativeBuildInputs = [
+    gperf
     pkg-config
     wrapGAppsHook3
   ]
@@ -35,7 +39,6 @@ stdenv.mkDerivation (finalAttrs: {
   buildInputs = [
     bzip2
     glib
-    gperf
     gtk3
     judy
     tcl

pkgs/by-name/in/infrastructure-agent/package.nix

@@ -6,16 +6,16 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "infrastructure-agent";
-  version = "1.80.0";
+  version = "1.80.3";
 
   src = fetchFromGitHub {
     owner = "newrelic";
     repo = "infrastructure-agent";
     rev = finalAttrs.version;
-    hash = "sha256-8FRt46TztwUYVgknJHJDcuwadnoOnJj6nm1y7jtieuU=";
+    hash = "sha256-P/xfFstMs/6l82JKZCauFeTsM516YyyP55mBVMRNP+U=";
   };
 
-  vendorHash = "sha256-X6CKfGgSSg8uAfGrlnc2oPeVKHHc2bkxtFukYXUkKMA=";
+  vendorHash = "sha256-eAPW4hTYwyINrOlc+q2cFuGuU6xph34qx/TARazPnXg=";
 
   ldflags = [
     "-s"

pkgs/by-name/je/jellyfin-desktop/package.nix

@@ -63,8 +63,6 @@ stdenv.mkDerivation (finalAttrs: {
   qtWrapperArgs = [
     "--set QT_STYLE_OVERRIDE Fusion"
     "--set NIX_SSL_CERT_FILE ${cacert}/etc/ssl/certs/ca-bundle.crt"
-    # Disable hardware acceleration to fix severe flickering in video playback.
-    "--set-default QTWEBENGINE_FORCE_USE_GBM 0"
   ];
 
   postInstall = lib.optionalString stdenv.hostPlatform.isDarwin ''

pkgs/by-name/je/jellyfin-web/package.nix

@@ -13,7 +13,7 @@
 }:
 buildNpmPackage (finalAttrs: {
   pname = "jellyfin-web";
-  version = "12.0";
+  version = "12.1";
 
   src =
     assert finalAttrs.version == jellyfin.version;
@@ -21,7 +21,7 @@ buildNpmPackage (finalAttrs: {
       owner = "jellyfin";
       repo = "jellyfin-web";
       tag = "v${finalAttrs.version}";
-      hash = "sha256-LwFjfG+OLgQDP7GqD4/wQhmym4N5QWe/qITQN+hxHh8=";
+      hash = "sha256-WR62ZkhLVn0+cbY0FEDvKcmCGb78tIiK2wIc5Y6rUn8=";
     };
 
   nodejs = nodejs_24;
@@ -31,7 +31,7 @@ buildNpmPackage (finalAttrs: {
       --replace-fail "git describe --always --dirty" "echo ${finalAttrs.src.rev}"
   '';
 
-  npmDepsHash = "sha256-1s9PWqakzZMiZokOqnKfwaj9s7yWm6e/xh4R5OmTNMc=";
+  npmDepsHash = "sha256-xsDGITy7W/CTER/c3qa3aD0L297s5OflePPgfRIV+Y8=";
 
   preBuild = ''
     # using sass-embedded fails at executing node_modules/sass-embedded-linux-x64/dart-sass/src/dart

pkgs/by-name/je/jellyfin/package.nix

@@ -15,13 +15,13 @@
 
 buildDotnetModule (finalAttrs: {
   pname = "jellyfin";
-  version = "12.0"; # ensure that jellyfin-web has matching version
+  version = "12.1"; # ensure that jellyfin-web has matching version
 
   src = fetchFromGitHub {
     owner = "jellyfin";
     repo = "jellyfin";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-z40crHV4vH27vDQBFcM58tQ5JW8wtIW3w981Rpp5h1E=";
+    hash = "sha256-WB/miD5uwoCY9DcTRRtxxOu9G+jojNGp5FZ0HHDqhys=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/kb/kbdd/package.nix

@@ -10,7 +10,7 @@
 
 stdenv.mkDerivation {
   pname = "kbdd";
-  version = "unstable-2025-08-10";
+  version = "0.7.1-unstable-2025-08-10";
 
   src = fetchFromGitHub {
     owner = "qnikst";

pkgs/by-name/ko/komga/package.nix

@@ -10,11 +10,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "komga";
-  version = "1.26.3";
+  version = "1.27.0";
 
   src = fetchurl {
     url = "https://github.com/gotson/${pname}/releases/download/${version}/${pname}-${version}.jar";
-    sha256 = "sha256-FjyxwUU8xwuNfLFES20aVRWIbhz0k7sSfvZ+VNbzeSc=";
+    sha256 = "sha256-B5NyJJD9aY7R/VYzd90TGck0OkTK/fRZUAik0zJFbJs=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/kr/krep/package.nix

@@ -7,7 +7,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "krep";
-  version = "3.0.2";
+  version = "3.1.0";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -16,7 +16,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "davidesantangelo";
     repo = "krep";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Nmu4wL0g5hTRACwn7Roi31uGDA+oBlY+0P/SCWLcVtc=";
+    hash = "sha256-Aswyc1TDHRfFYutFpKnIbs/1puYeztVgowqbi+D4J0Q=";
   };
 
   makeFlags = [

pkgs/by-name/ku/ku/package.nix

@@ -8,14 +8,14 @@
 
 buildGo126Module (finalAttrs: {
   pname = "ku";
-  version = "0.11.0";
+  version = "0.12.0";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "bjarneo";
     repo = "ku";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-UO390xbjUVhlDN8NzvRl2BXMQCYngfU5cXu+tNiVvoA=";
+    hash = "sha256-pdwfNP9RnD4LQKYJ315wrhiRdQN9i/KZ/13jMNlKzvw=";
   };
 
   vendorHash = "sha256-x7O2/uKnIIFDr8WK0ej3FJiIGxN5Fq5Czqrv4OJ5A44=";

pkgs/by-name/ku/kubernix/package.nix

@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "kubernix";
-  version = "0.3.6";
+  version = "0.3.7";
 
   src = fetchFromGitHub {
     owner = "saschagrunert";
     repo = "kubernix";
     tag = "v${finalAttrs.version}";
-    sha256 = "sha256-YdnqD/4A3+Ob1cMyQvnHe8MzUfHQNdB3ltrXvQXNRmg=";
+    sha256 = "sha256-d+W7V/9TiEqG4q0MIq3Tan5XH/w7vJl5vpCax5Qf7r0=";
   };
 
-  cargoHash = "sha256-qUzC1FMkeD04RbOdSstINvOj92gdfpTq1kjT4Xb/2J4=";
+  cargoHash = "sha256-83dfQnZ3/6k8fJIr5jyleX2ztevhttnSSfaHLJEWwks=";
 
   # Tests require network access
   doCheck = false;

pkgs/by-name/la/lazyworktree/package.nix

@@ -10,16 +10,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "lazyworktree";
-  version = "1.49.0";
+  version = "1.50.0";
 
   src = fetchFromGitHub {
     owner = "chmouel";
     repo = "lazyworktree";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-lxh6N1SY1FoEyfDeFTqDdiDMNASwn2QyiyUwve56Dn0=";
+    hash = "sha256-UZ6sentKl0XkqdWOQhj/3sb6ArFfoboBD/vjGb9mVro=";
   };
 
-  vendorHash = "sha256-I0MIfk2/ZtjHBzovxijFw5N4siEUdjXEIs5WbNdAzu8=";
+  vendorHash = "sha256-1k0BBXmWeP4trSKhSmz2m25H1qmYlusj1evrK+4qLrQ=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/le/leftwm/package.nix

@@ -15,16 +15,16 @@ in
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "leftwm";
-  version = "0.5.4";
+  version = "0.5.5";
 
   src = fetchFromGitHub {
     owner = "leftwm";
     repo = "leftwm";
     tag = finalAttrs.version;
-    hash = "sha256-eH7HuGZnWlXigTaUAc4S00+uOIEVftnBOD8x03KJLaE=";
+    hash = "sha256-Ox4eOE+RmyKfReSjeMGSYZCEC67/HIE+uY830gm4G94=";
   };
 
-  cargoHash = "sha256-nFyhpCp8xsYjRl+2bqPfWzq31pM/yYcDuxkWEjjcqwA=";
+  cargoHash = "sha256-Y/ts0WOhxPDv8B3/kk6+PwS6Tjpf0gjjnjzLDrp3Vk0=";
 
   buildInputs = rpathLibs;
 

pkgs/by-name/li/libcerf/package.nix

@@ -10,14 +10,15 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libcerf";
-  version = "3.6";
+  version = "3.8";
 
   src = fetchFromGitLab {
     domain = "jugit.fz-juelich.de";
-    owner = "mlz";
-    repo = "libcerf";
+    group = "mlz";
+    owner = "lib";
+    repo = "cerf";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-JLkZmKaB1TMM2nVg640QLY7xmUQU/Fl4MOSM+OLlMLs=";
+    hash = "sha256-G0a79i9EqUSoVq2ngdNqqCodTh3AG4apR3t8lqRP4lk=";
   };
 
   nativeBuildInputs = [
@@ -25,6 +26,8 @@ stdenv.mkDerivation (finalAttrs: {
     perl
   ];
 
+  doCheck = true;
+
   passthru = {
     tests = {
       inherit gnuplot;
@@ -33,8 +36,9 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   meta = {
+    changelog = "https://jugit.fz-juelich.de/mlz/lib/cerf/-/blob/${finalAttrs.src.tag}/CHANGELOG";
     description = "Complex error (erf), Dawson, Faddeeva, and Voigt function library";
-    homepage = "https://jugit.fz-juelich.de/mlz/libcerf";
+    homepage = "https://jugit.fz-juelich.de/mlz/lib/cerf";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ hythera ];
     platforms = lib.platforms.all;

pkgs/by-name/li/libsignal-ffi/package.nix

@@ -13,14 +13,14 @@ rustPlatform.buildRustPackage (finalAttrs: {
   pname = "libsignal-ffi";
   # must match the version used in mautrix-signal
   # see https://github.com/mautrix/signal/issues/401
-  version = "0.100.0";
+  version = "0.102.2";
 
   src = fetchFromGitHub {
     fetchSubmodules = true;
     owner = "signalapp";
     repo = "libsignal";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ATK0wnTbT3b8lFAwXSm5j31LXywCh70iOTgUL6Pfd+Q=";
+    hash = "sha256-p9qdH56xV6mNECf0SwseQKU87BC4VYTwx3mKf7JnBio=";
   };
 
   postPatch =
@@ -46,7 +46,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     NIX_LDFLAGS = if stdenv.hostPlatform.isDarwin then "-lc++" else "-lstdc++";
   };
 
-  cargoHash = "sha256-OuJdAi2TbtpQlXSr7PpLuBqeHYx0l2ax5byoEZ5PGj8=";
+  cargoHash = "sha256-LVreSerqA0ztg4os7qZzprw97HFl4Uydsmz6k2rO0fc=";
 
   cargoBuildFlags = [
     "-p"

pkgs/by-name/li/libvncserver/package.nix

@@ -7,7 +7,6 @@
   libjpeg,
   openssl,
   zlib,
-  libgcrypt,
   libpng,
   withSystemd ? lib.meta.availableOn stdenv.hostPlatform systemd,
   systemd,
@@ -77,7 +76,6 @@ stdenv.mkDerivation (finalAttrs: {
   buildInputs = [
     libjpeg
     openssl
-    libgcrypt
     libpng
   ]
   ++ lib.optionals withSystemd [

pkgs/by-name/li/libxmp/package.nix

@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libxmp";
-  version = "4.7.2";
+  version = "4.7.3";
 
   src = fetchFromGitHub {
     owner = "libxmp";
     repo = "libxmp";
     tag = "libxmp-${finalAttrs.version}";
-    hash = "sha256-0no+WT5cLDDtoRO5GKlsx9BLrv4n2JvDr9Dky0yNOsk=";
+    hash = "sha256-wc3+4J//GjkmzawcXuSwfQRIdRRScijrSwPmpaZggL8=";
   };
 
   outputs = [

pkgs/by-name/li/linenoise/package.nix

@@ -3,9 +3,12 @@
   stdenv,
   fetchFromGitHub,
   validatePkgConfig,
-  fixDarwinDylibNames,
 }:
 
+let
+  inherit (stdenv.hostPlatform) isStatic isDarwin extensions;
+  libName = "liblinenoise${if isStatic then ".a" else extensions.sharedLibrary}";
+in
 stdenv.mkDerivation (finalAttrs: {
   pname = "linenoise";
   version = "2.0";
@@ -19,15 +22,20 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [
     validatePkgConfig
-  ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [ fixDarwinDylibNames ];
+  ];
 
   buildPhase = ''
     runHook preBuild
 
     $CC -c -o linenoise.o linenoise.c
-    $CC -shared -o liblinenoise.so linenoise.o
-    $AR rcs liblinenoise.a linenoise.o
+    ${
+      if isStatic then
+        "$AR rcs"
+      else
+        "$CC ${
+          if isDarwin then "-dynamiclib -install_name $out/lib/" else "-shared -Wl,-soname,"
+        }${libName} -o"
+    } ${libName} linenoise.o
 
     runHook postBuild
   '';
@@ -35,10 +43,9 @@ stdenv.mkDerivation (finalAttrs: {
   installPhase = ''
     runHook preInstall
 
-    install -d $out/lib/pkgconfig $out/include
-    install -m644 linenoise.h     $out/include/
-    install -m644 liblinenoise.a  $out/lib/
-    install -m644 liblinenoise.so $out/lib/
+    install -d $out/lib/pkgconfig
+    install -Dm644 linenoise.h -t $out/include
+    install -Dm${if isStatic then "644" else "755"} ${libName} -t $out/lib
     substituteAll ${./linenoise.pc.in} $out/lib/pkgconfig/linenoise.pc
 
     runHook postInstall

pkgs/by-name/li/lint-staged/package.nix

@@ -8,16 +8,16 @@
 
 buildNpmPackage rec {
   pname = "lint-staged";
-  version = "17.5.0";
+  version = "17.5.1";
 
   src = fetchFromGitHub {
     owner = "lint-staged";
     repo = "lint-staged";
     rev = "v${version}";
-    hash = "sha256-kRQDWJyyRFNxrdndOs2YYWetihwu+skTOCZ/dw5TzLs=";
+    hash = "sha256-9fx514c0ZblPZaJmAGdmb2QbIodsaDS9MOoveUXwA2Q=";
   };
 
-  npmDepsHash = "sha256-4yMbJFVgcVoo9AWEfJI+OfBoE4Y35rUnjFKuZ9g56/o=";
+  npmDepsHash = "sha256-y8PSiJm3U9i5XaIkC06N/vjm/+OnqAHASRAMHlOVsGU=";
 
   dontNpmBuild = true;
 

pkgs/by-name/lm/lmstudio/update.sh

@@ -3,17 +3,31 @@
 
 set -euo pipefail
 
-for system in "aarch64-darwin darwin/arm64" "x86_64-linux linux/x64" "aarch64-linux linux/arm64"; do
+SUPPORTED_SYSTEMS=(
+  "aarch64-darwin darwin/arm64"
+  "x86_64-linux linux/x64"
+  "aarch64-linux linux/arm64"
+)
+
+for system in "${SUPPORTED_SYSTEMS[@]}"; do
   # shellcheck disable=SC2086
   set -- ${system} # split string into variables $1 and $2
 
   arch="${1}"
   platform="${2}"
 
-  url=$(curl -ILs -o /dev/null -w %{url_effective} "https://lmstudio.ai/download/latest/${platform}")
+  url=$(curl -fILs -o /dev/null -w '%{url_effective}' "https://lmstudio.ai/download/latest/${platform}")
   version="$(echo "${url}" | cut -d/ -f6)"
+
+  # compare versions before fetching, the installers are ~1 GB each
+  currentVersion=$(nix-instantiate --eval --raw --argstr system "${arch}" -A lmstudio.version)
+  if [[ "${currentVersion}" == "${version}" ]]; then
+    echo "lmstudio (${arch}) is up-to-date: ${version}"
+    continue
+  fi
+
   hash=$(nix --extra-experimental-features nix-command hash convert --hash-algo sha256 "$(nix-prefetch-url "${url}")")
 
-  update-source-version lmstudio "${version}" "${hash}" --system="${arch}" --version-key="version_${arch}" \
-    2> >(tee /dev/stderr) | grep -q "nothing to do" && exit
+  # any failure propagates via set -e
+  update-source-version lmstudio "${version}" "${hash}" --system="${arch}" --version-key="version_${arch}"
 done

pkgs/by-name/lu/luau/package.nix

@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "luau";
-  version = "0.737";
+  version = "0.738";
 
   src = fetchFromGitHub {
     owner = "luau-lang";
     repo = "luau";
     tag = finalAttrs.version;
-    hash = "sha256-+vcYzvCSJcZsvqK4EaA03hdj3VXND2V+Jh9d8+2Prss=";
+    hash = "sha256-l7Cy1xngaE4sYNty2de4a9dG4WHzORI/uwhLqUNCuI0=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/by-name/lu/lux-cli/package.nix

@@ -19,18 +19,18 @@
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "lux-cli";
 
-  version = "0.43.5";
+  version = "0.45.2";
 
   src = fetchFromGitHub {
     owner = "lumen-oss";
     repo = "lux";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Uo180nB7/7lcYeaOCcOODtWJaqf4eQeMPKHN2OIVP70=";
+    hash = "sha256-pcja7xJX2ONZUG9VbmeAJfmvg9VAZ51xrZDNz0IMe18=";
   };
 
   buildAndTestSubdir = "lux-cli";
 
-  cargoHash = "sha256-fQoKFzMhvwlEXLmJQGiarPp2gtAJjodjQK7DjnY7reM=";
+  cargoHash = "sha256-DUbbV7pyGxmnQ1I/KuiUQ0oUf5JJ1pPzo+6rApe0TLo=";
 
   nativeInstallCheckInputs = [
     versionCheckHook

pkgs/by-name/ma/mago/package.nix

@@ -11,17 +11,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "mago";
-  version = "1.47.6";
+  version = "1.49.0";
 
   src = fetchFromGitHub {
     owner = "carthage-software";
     repo = "mago";
     tag = finalAttrs.version;
-    hash = "sha256-stb+grYjtflzM90qCK8S/uIQVnOuenhIsQlN+zBhm0g=";
+    hash = "sha256-1DTVDv87OBtOEU6U53IWrTw7i2JN8TZJYAQepwc2ek8=";
     forceFetchGit = true; # Does not download all files otherwise
   };
 
-  cargoHash = "sha256-f+EjMcImL5hwN06/hUn0Y3jlk1vxcxqqNwyrpGxL3T8=";
+  cargoHash = "sha256-yhMghVhY7TxFUYwbGVC5QwFyTAqakbYMq7jPSk88PIM=";
 
   env = {
     # Get openssl-sys to use pkg-config

pkgs/by-name/ma/matrix-tuwunel/package.nix

@@ -13,7 +13,6 @@
   matrix-tuwunel,
   # upstream tuwunel enables jemalloc by default, so we follow suit
   enableJemalloc ? true,
-  rust-jemalloc-sys,
   enableLiburing ? stdenv.hostPlatform.isLinux,
   enableLdap ? true,
   liburing,
@@ -23,18 +22,19 @@
   cacert,
 }:
 let
-  rust-jemalloc-sys' = rust-jemalloc-sys.override {
-    unprefixed = !stdenv.hostPlatform.isDarwin;
-  };
   # tuwunel uses a modified version of rocksdb.  The following overrides take a lot from the
   # official flake:
   # https://github.com/matrix-construct/tuwunel/blob/main/flake.nix#L54
   rocksdb' =
     (rocksdb.override {
       inherit enableLiburing;
-      # rocksdb does not support prefixed jemalloc, which is required on darwin
-      enableJemalloc = enableJemalloc && !stdenv.hostPlatform.isDarwin;
-      jemalloc = rust-jemalloc-sys';
+
+      # RocksDB's C++ allocations reach jemalloc by symbol interposition
+      # from the unprefixed allocator the Rust build links, so it needs
+      # none of its own. A second jemalloc here would serve only the
+      # opt-in nodump allocator and malloc-stats, out of a separate heap,
+      # and tuwunel uses neither.
+      enableJemalloc = false;
     }).overrideAttrs
       (
         final: old: {
@@ -44,8 +44,8 @@ let
             # The commit on the rocksdb fork, tuwunel-changes branch referenced by the upstream
             # tuwunel flake.lock:
             # https://github.com/matrix-construct/tuwunel/blob/main/flake.lock#L557C17-L557C57
-            rev = "eb79ddeff0ea32ebb8f8b69dd1df95c557328e85";
-            hash = "sha256-7hiKaIssPpqB8UTAR4ZE19pZTp09sVGOMht7sAitZAs=";
+            rev = "d8a89161c6a53e79d61694289d2b78be36e6ca12";
+            hash = "sha256-rNSA2RalASKbbXNQi86eEmIUC8W5YELKUOy0vhEn6Rc=";
           };
           version = "tuwunel-changes";
           patches = [ ];
@@ -89,16 +89,22 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "matrix-tuwunel";
-  version = "1.9.0";
+  version = "1.9.1";
 
   src = fetchFromGitHub {
     owner = "matrix-construct";
     repo = "tuwunel";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-F9zmYanxCZjXBCh3GvSBiPQC6OFyugThq88MLvhLOyA=";
+    hash = "sha256-MBHChIMNLrP7u8ECRroGiniRGtZGArrpRPfAdkOaOXg=";
   };
 
-  cargoHash = "sha256-TT+dGr3DD9aPWYDxLTYPK0aZpQu64Ja8z+dJJmZQho8=";
+  # Integration tests require networking. Only run the unit tests.
+  cargoTestFlags = [
+    "--lib"
+    "--bins"
+  ];
+
+  cargoHash = "sha256-NDjFv0iKDfkKwOQ3RZ4gO9eQufGf/dmFaGLTcFWH5uw=";
 
   nativeBuildInputs = [
     pkg-config
@@ -115,7 +121,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
     bzip2
     zstd
   ]
-  ++ lib.optional enableJemalloc rust-jemalloc-sys'
   ++ lib.optional enableLiburing liburing;
 
   env = {
@@ -168,15 +173,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
       export TUWUNEL_DATABASE_PATH="$(mktemp -d)/smoketest.db"
     '';
 
-  doCheck = true;
-
-  # 2026-06-24: Tuwunel has 16 integration tests. Cargo turns each of these
-  # into a separate binary that links in all 110 MB worth of tuwunel.  Linking
-  # 16 big binaries like this takes a really long time and was causing Hydra
-  # to time out the build during `checkPhase`.  So, we run the checks in the
-  # "debug" profile.  This reduces the build+test time on my machine from
-  # 44min to 12min.
-  checkType = "debug";
+  # The check phase reaches /etc/resolv.conf through libredirect, which works
+  # by LD_PRELOAD and is therefore inert in a statically linked binary. A
+  # static build would run the tests with no resolver configuration at all and
+  # fail before reaching them, so it packages without checking; the unit and
+  # integ jobs cover that code on the dynamic path.
+  doCheck = !stdenv.hostPlatform.isStatic;
 
   passthru = {
     rocksdb = rocksdb'; # make used rocksdb version available (e.g., for backup scripts)

pkgs/by-name/ma/mattermost/package.nix

@@ -27,10 +27,13 @@
     #
     # Ensure you also check ../mattermostLatest/package.nix.
     regex = "^v(11\\.7\\.[0-9]+)$";
-    version = "11.7.8";
-    srcHash = "sha256-HH+LioMTxu0+VLr6+fpa/O9YduChIF0ieSgMBaS91uc=";
-    vendorHash = "sha256-FytvnZcPStztvUJLEnC3DUeyhmYWKP+/8xqv4suDZNE=";
-    npmDepsHash = "sha256-d1X33SV0c1l0e9fCIWEx7opeWByyovj0zNs+aGddRJc=";
+    version = "11.7.11";
+    srcHash = "sha256-C0t/PITQ1R4VRHQk+bQE8GPfdy5GjxLsHtRgYq6qgSw=";
+    vendorHash = "sha256-V63mY8za59WOI7dk8wMuHxWs2cs2rfZ9Ubpm5O+KMYU=";
+    npmDepsHash = "sha256-mK5wrX9dWDC+8dn/J7E1EOiwHekAzt5yQCJ8xqfKa3g=";
+    lockfileOverlay = ''
+      .packages["node_modules/rollup"] |= (del(.resolved, .integrity) | .version = "2.80.0")
+    '';
   },
   ...
 }:
@@ -257,7 +260,7 @@ buildMattermost rec {
       # See: https://github.com/tcoopman/image-webpack-loader#deprecated
       postPatch = ''
         substituteInPlace channels/webpack.config.js \
-          --replace-fail 'options: {}' 'options: { disable: true }'
+          --replace-quiet 'options: {}' 'options: { disable: true }'
       '';
 
       inherit nodejs;

pkgs/by-name/ma/mattermostLatest/package.nix

@@ -15,10 +15,10 @@ mattermost.override (
       # and make sure the version regex is up to date here.
       # Ensure you also check ../mattermost/package.nix for ESR releases.
       regex = "^v(11\\.[0-9]+\\.[0-9]+)$";
-      version = "11.8.3";
-      srcHash = "sha256-OWHW6UifUljL+yyWtc5XD/spbn7Yu1FqZ8gQAs073gY=";
-      vendorHash = "sha256-F2QMrLbio7812ZTGQZZPTqHWtIXbwbDmjUhtvv0DJ9s=";
-      npmDepsHash = "sha256-C8L5g+HY5aArLJzPbw3fESvA+U4JK1OQFWA4wwaan1M=";
+      version = "11.10.2";
+      srcHash = "sha256-d4sOH9L2vawyiRLXIhZLzEqExiYbrdy/h0v4GZW7DNc=";
+      vendorHash = "sha256-k3JPDzrZzLeKb20o2aLZR/TX7dN7nhpQs6UZ5olvV94=";
+      npmDepsHash = "sha256-jDGUbBwxjZ50bbbnUJVMCzKJMlHYhUKy7Be9zsWjMqg=";
       autoUpdate = ./package.nix;
     };
   }

pkgs/by-name/ma/mautrix-signal/package.nix

@@ -20,14 +20,14 @@ let
 in
 buildGoModule rec {
   pname = "mautrix-signal";
-  version = "26.08";
-  tag = "v0.2608.0";
+  version = "26.09";
+  tag = "v0.2609.0";
 
   src = fetchFromGitHub {
     owner = "mautrix";
     repo = "signal";
     inherit tag;
-    hash = "sha256-B06szaP9QbdVy6rmnGAVkavzgzFrJXeWCN1iIvUzbzc=";
+    hash = "sha256-xHxY+cx/6uKt37MV6dqmtXQF5oqiRxag6ZxuCSWyUsM=";
   };
 
   buildInputs =
@@ -46,7 +46,7 @@ buildGoModule rec {
     CGO_LDFLAGS = toString [ cppStdLib ];
   };
 
-  vendorHash = "sha256-KoFLr5As31/YyusfA3bxTnI1V73F6KGWLSZPg0LZa78=";
+  vendorHash = "sha256-/dHtn1QTQb2kf/scULECU6NquyNdMwgmF4gyeuMiHgg=";
 
   ldflags = [
     "-X"

pkgs/by-name/ma/mautrix-whatsapp/package.nix

@@ -14,20 +14,20 @@
 
 buildGoModule rec {
   pname = "mautrix-whatsapp";
-  version = "26.08";
-  tag = "v0.2608.0";
+  version = "26.09";
+  tag = "v0.2609.0";
 
   src = fetchFromGitHub {
     owner = "mautrix";
     repo = "whatsapp";
     inherit tag;
-    hash = "sha256-gB+XIS8b1W9wOcKnSlLgctjaD1mBvkNrS3ak9Xq39wg=";
+    hash = "sha256-u+Ck8ckCbFu+Q7pVM7T05InqDq7NknqYOAb0wis93OU=";
   };
 
   buildInputs = lib.optional (!withGoolm) olm;
   tags = lib.optional withGoolm "goolm";
 
-  vendorHash = "sha256-02XiudW2yxseGWyNegNUIfA8RBJCyjhhgeKncLy6nQg=";
+  vendorHash = "sha256-Kpireqd1Cll0XZvnouUJV4BJYJRWPlhQRDhLekujg60=";
 
   ldflags = [
     "-s"

pkgs/by-name/me/metals/package.nix

@@ -12,7 +12,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "metals";
-  version = "1.6.8";
+  version = "1.6.9";
 
   nativeBuildInputs = [
     makeWrapper
@@ -76,7 +76,7 @@ stdenv.mkDerivation (finalAttrs: {
     '';
     outputHashMode = "recursive";
     outputHashAlgo = "sha256";
-    outputHash = "sha256-LdZ6I7zOUTHgS/TTo0T6Dh+Kb3YpgJg8gK0UngsA7Gs=";
+    outputHash = "sha256-8Btwvg8HJ1SrDbZblCB3d9s97XcOUmhfGyBnek9IEBc=";
   };
 
   meta = {

pkgs/by-name/mo/mongosh/package.nix

@@ -6,16 +6,16 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "mongosh";
-  version = "2.10.0";
+  version = "2.11.1";
 
   src = fetchFromGitHub {
     owner = "mongodb-js";
     repo = "mongosh";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-SJkDBo/rtbh3rh5oPjjS5zXG6eye+PCY3pI1FN281Ps=";
+    hash = "sha256-h1OUm4fPYdDpU1K1a65Q5xeBHEryA1O05k0wr/x/yUQ=";
   };
 
-  npmDepsHash = "sha256-xmjlvncUVVp7Y+qCBpJNiuvc5n2IBKqXk715EOmWo/U=";
+  npmDepsHash = "sha256-/pHYIFybLfpj5B88T+B1stDnwMEOBIhIRX83ipSIAvo=";
 
   postPatch = ''
     # Disable telemetry by default; users can still opt in via enableTelemetry().

pkgs/by-name/ne/nezha/package.nix

@@ -49,13 +49,13 @@ let
 in
 buildGoModule (finalAttrs: {
   pname = "nezha";
-  version = "2.3.8";
+  version = "2.3.12";
 
   src = fetchFromGitHub {
     owner = "nezhahq";
     repo = "nezha";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-MW3DgW9bdWiucwiVQdVojlZ0Sl4Pd+l8SWkMGf929pQ=";
+    hash = "sha256-XgTbDpfGYbpiFseJjwraDg3svyT0EpgvoY2dvLbtZtQ=";
   };
 
   proxyVendor = true;

pkgs/by-name/ni/nikto/nix-wrapper-fix.patch

@@ -10,7 +10,7 @@ index 2cb07f9..323e666 100755
  
      # Guess user's home directory -- to support Windows
      foreach my $var (split(/ /, "HOME USERPROFILE")) {
-@@ -280,8 +281,8 @@
+@@ -303,7 +304,7 @@
      # Priority: --config option > local configs > user home > system-wide
      push(@CF, "$VARIABLES{'configfile'}")
        if defined $VARIABLES{'configfile'} && $VARIABLES{'configfile'} ne "";
@@ -18,5 +18,4 @@ index 2cb07f9..323e666 100755
 -    push(@CF, File::Spec->catfile($NIKTODIR, "nikto.conf.default")) if defined $NIKTODIR;
 +    push(@CF, File::Spec->catfile($NIKTODIR, "etc", "nikto.conf"))         if defined $NIKTODIR;
 +    push(@CF, File::Spec->catfile($NIKTODIR, "etc", "nikto.conf.default")) if defined $NIKTODIR;
-     push(@CF, "nikto.conf");
      push(@CF, File::Spec->catfile($home, "nikto.conf")) if defined $home;

pkgs/by-name/ni/nikto/package.nix

@@ -7,18 +7,15 @@
   installShellFiles,
 }:
 
-let
-  version = "2.6.0";
-in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "nikto";
-  inherit version;
+  version = "2.6.1";
 
   src = fetchFromGitHub {
     owner = "sullo";
     repo = "nikto";
-    rev = version;
-    sha256 = "sha256-iHOdMlfcKhvQCsCjWge6K+0h8kkgXa0Uii9o3YRQP5w=";
+    tag = finalAttrs.version;
+    hash = "sha256-jMbVJ35f1uPNQ7xmBnOhBMmh+u4Ewpd5GJFMg8ZKIxw=";
   };
 
   # Nikto searches its configuration file based on its current path
@@ -55,7 +52,7 @@ stdenv.mkDerivation rec {
     install -Dm 755 "program/nikto.pl" "$out/bin/nikto"
     install -Dm 644 program/nikto.conf.default "$out/etc/nikto.conf"
     installManPage documentation/nikto.1
-    install -Dm 644 README.md "$out/share/doc/${pname}/README"
+    install -Dm 644 README.md "$out/share/doc/${finalAttrs.pname}/README"
     runHook postInstall
   '';
 
@@ -66,11 +63,11 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "Web server scanner";
-    mainProgram = "nikto";
-    license = lib.licenses.gpl2Plus;
     homepage = "https://cirt.net/Nikto2";
-    changelog = "https://github.com/sullo/nikto/releases/tag/${version}";
+    changelog = "https://github.com/sullo/nikto/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.gpl2Plus;
     maintainers = with lib.maintainers; [ tbutter ];
+    mainProgram = "nikto";
     platforms = lib.platforms.unix;
   };
-}
+})

pkgs/by-name/nu/nuget-to-json/package.nix

@@ -35,5 +35,6 @@ replaceVarsWith {
   meta = {
     description = "Convert a nuget packages directory to a lockfile for buildDotnetModule";
     mainProgram = "nuget-to-json";
+    license = lib.licenses.mit;
   };
 }

pkgs/by-name/ol/olivetin/3k.nix

@@ -16,18 +16,18 @@
 
 buildGoModule (finalAttrs: {
   pname = "olivetin";
-  version = "3000.19.0";
+  version = "3000.20.0";
 
   src = fetchFromGitHub {
     owner = "OliveTin";
     repo = "OliveTin";
     tag = finalAttrs.version;
-    hash = "sha256-Uz0D5e20Zn7LXZo1g1dL08fJIY4EwTLQAbIrHo+ndQA=";
+    hash = "sha256-nZ8ougqnMWz1ZStaUdstz0qWqqaoNDOetTgWlAsBMNw=";
   };
 
   modRoot = "service";
 
-  vendorHash = "sha256-QslY0UIdr0EXYxYfWe7URfEYroLEZ+Dm26Q4hpLxkJI=";
+  vendorHash = "sha256-vJuektBJSYcOYXD+s9bX41ML1f+n+aYM3qwSFfe183w=";
 
   subPackages = [ "." ];
 
@@ -82,7 +82,7 @@ buildGoModule (finalAttrs: {
     pname = "olivetin-webui";
     inherit (finalAttrs) version src;
 
-    npmDepsHash = "sha256-lXadtme9uFBnbV6aoCkCgC30OW8C3uoce0TGs1EpxKA=";
+    npmDepsHash = "sha256-a+n6rXj09plIYZ9dyirSyioxWk2D0rDRoSZq8FivwhA=";
 
     sourceRoot = "${finalAttrs.src.name}/frontend";
 

pkgs/by-name/op/opencode/package.nix

@@ -77,14 +77,14 @@ let
       # NOTE: Required else we get errors that our fixed-output derivation references store paths
       dontFixup = true;
 
-      outputHash = "sha256-38HGR+n9I7QrE4i+CmRViX4/3TEQjLgU81LbEDBzj7Y=";
+      outputHash = "sha256-qWZuOpolZAr7EZlAgfVx8nw8axoOMauoXwcqiJUGu24=";
       outputHashAlgo = "sha256";
       outputHashMode = "recursive";
     };
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "opencode";
-  version = "1.18.30";
+  version = "1.18.31";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -93,7 +93,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "anomalyco";
     repo = "opencode";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-G4qRDwJ6i5SpsiHoej31HRPLOHpkLc66B+UmdzOY1+o=";
+    hash = "sha256-Q0DYH5GHQGZ6ICyMR5rWq86DvfWpQERGZeLYTJb7cj0=";
   };
 
   postPatch =
@@ -110,6 +110,11 @@ stdenv.mkDerivation (finalAttrs: {
         --replace-fail \
         'if (item.os === process.platform && item.arch === process.arch && !item.abi)' \
         'if (false)'
+    ''
+    # Bun 1.4.x regressed compiled executable code splitting.
+    + ''
+      substituteInPlace packages/opencode/script/build.ts \
+        --replace-fail 'splitting: true,' 'splitting: false,'
     '';
 
   nativeBuildInputs = [

pkgs/by-name/pe/pedantix/package.nix

@@ -8,17 +8,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "pedantix";
-  version = "1.2.1";
+  version = "1.2.2";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "Swarsel";
     repo = "pedantix";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-WqCiIOFaVZ6+pVBF+fIZlOEb4N+cHCJZBPQ8Rj2OEh0=";
+    hash = "sha256-nDAJ7Th/e08LPseucE9lBfcNgZUURdlrI9IShm86WZM=";
   };
 
-  cargoHash = "sha256-ay4rANqOby+/VM+JWbXcd0JQCcZuv8TjZv3d9vcFgfI=";
+  cargoHash = "sha256-u9Fn1GphndiUlIWRBHMKVP/9N0CYOPAQUwLvpAVysrM=";
 
   doInstallCheck = true;
   nativeInstallCheckInputs = [ versionCheckHook ];

pkgs/by-name/pe/perfetto/package.nix

@@ -3,9 +3,11 @@
   stdenv,
   cctools,
   cmake,
+  expat,
   fetchFromGitHub,
   fetchpatch2,
   gn,
+  linenoise,
   ninja,
   nix-update-script,
   pkg-config,
@@ -24,13 +26,19 @@ let
   inherit (stdenv.hostPlatform) isStatic isDarwin extensions;
   libName = "libperfetto${if isStatic then ".a" else extensions.sharedLibrary}";
 
-  buildInputs = [
+  # Required for both the SDK and tools output:
+  sdkPropagatedBuildInputs = [
     protobuf
     re2
-    sqlite
     zlib
     zstd
   ];
+  # Required for tools output only:
+  toolsInputs = [
+    expat
+    linenoise
+    sqlite
+  ];
 
   # pkg-config module name -> perfetto_use_system_* GN arg suffix
   systemLibs = builtins.listToAttrs (
@@ -42,10 +50,21 @@ let
           drv.pname
       }";
       value = drv.pname;
-    }) buildInputs
+    }) sdkPropagatedBuildInputs
   );
   systemModules = toString (lib.attrNames systemLibs);
 
+  executablesToInstall = [
+    "perfetto"
+    "traced_probes"
+    "traced"
+  ];
+  toolsToInstall = [
+    "trace_processor_shell"
+    "tracebox"
+    "traceconv"
+  ];
+
   # Serialize Nix values into GN values, cf.
   # https://gn.googlesource.com/gn/+/main/docs/language.md
   toGnValue =
@@ -84,6 +103,11 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-73aE+qoHOkdD2Br3NmUE48BM6uE6uIBdug0+ZR2nn94=";
   };
 
+  outputs = [
+    "out"
+    "tools"
+  ];
+
   patches = [
     # TODO: remove once included in a next release
     (fetchpatch2 {
@@ -94,6 +118,18 @@ stdenv.mkDerivation (finalAttrs: {
       url = "https://github.com/google/perfetto/commit/5739344741e4b881952a2786f67355eefe0a2c8d.patch?full_index=1";
       hash = "sha256-AplecRNDDLGpbYC6zg2Ie0LrX+0MBxodTC72SP6SSl8=";
     })
+    (fetchpatch2 {
+      url = "https://github.com/google/perfetto/commit/25f6c94bf1321f61e63c7cd8d50b3b997b176ccb.patch?full_index=1";
+      hash = "sha256-AJLof+TbpGxNUedW2dzKmwS2j9XpnJqI+vEy4d4Qf1Q=";
+    })
+    (fetchpatch2 {
+      url = "https://github.com/google/perfetto/commit/38a4e881bec05dbf51a3defb66d7b201c2fd1ea1.patch?full_index=1";
+      hash = "sha256-j/X8GbioV2pNrTUvtaTf1YRaxX6/XhbPTwmJ+9f4bUY=";
+    })
+    (fetchpatch2 {
+      url = "https://github.com/google/perfetto/commit/782904b123a369e8c16b91c6eeab093fd3b9343e.patch?full_index=1";
+      hash = "sha256-lHEvJEigMtYXmHPx2cwQ+Wh5rdh7IQVdnNHUJN6I1Zg=";
+    })
   ];
   # Upstream includes its own tooling to download its deps, we have to disable it to make it use the ones from the PATH.
   postPatch = ''
@@ -115,27 +151,34 @@ stdenv.mkDerivation (finalAttrs: {
   ]
   ++ lib.optional isDarwin cctools.libtool;
 
-  inherit buildInputs;
+  buildInputs = sdkPropagatedBuildInputs ++ toolsInputs;
 
   gnFlags = toGnFlags (
     commonGnFlags
+    // (builtins.listToAttrs (
+      builtins.map (drv: {
+        name = "perfetto_use_system_${drv.pname}";
+        value = true;
+      }) toolsInputs
+    ))
+    // {
+      enable_perfetto_etm_importer = false;
+      enable_perfetto_llvm_demangle = false;
+      enable_perfetto_trace_processor_percentile = false;
+    }
     // (lib.optionalAttrs (!isStatic) {
       extra_ldflags = "-Wl,-rpath,${placeholder "out"}/lib";
     })
   );
 
-  ninjaFlags = [
-    "tracebox"
-    "traced"
-    "traced_probes"
-    "perfetto"
-  ];
+  ninjaFlags = executablesToInstall ++ toolsToInstall;
 
   dontUseNinjaInstall = true;
   installPhase = ''
     runHook preInstall
 
-    install -Dt $out/bin perfetto traced traced_probes tracebox
+    install -Dt $out/bin ${builtins.toString executablesToInstall}
+    install -Dt $tools/bin ${builtins.toString toolsToInstall}
     ${lib.optionalString (!isStatic) "install -Dt $out/lib ${libName}"}
 
     runHook postInstall
@@ -145,6 +188,15 @@ stdenv.mkDerivation (finalAttrs: {
     versionCheckHook
   ];
   doInstallCheck = true;
+  installCheckPhase = ''
+    runHook preInstallCheck
+
+    $tools/bin/trace_processor_shell \
+      -Q "select percentile(x, 50), median(x) from (select 1 x union all select 3)" /dev/null \
+    | grep -F '2.0'
+
+    runHook postInstallCheck
+  '';
 
   passthru = {
     updateScript = nix-update-script { };
@@ -159,7 +211,7 @@ stdenv.mkDerivation (finalAttrs: {
           postPatch
           nativeBuildInputs
           ;
-        propagatedBuildInputs = buildInputs;
+        propagatedBuildInputs = sdkPropagatedBuildInputs;
 
         __structuredAttrs = true;
         strictDeps = true;
@@ -350,7 +402,7 @@ stdenv.mkDerivation (finalAttrs: {
     changelog = "https://github.com/google/perfetto/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ aduh95 ];
-    mainProgram = "perfetto";
+    mainProgram = lib.head executablesToInstall;
     platforms = lib.platforms.unix;
   };
 })

pkgs/by-name/pg/pgdog/package.nix

@@ -14,16 +14,16 @@ let
 in
 rustPlatform.buildRustPackage.override { inherit stdenv; } (finalAttrs: {
   pname = "pgdog";
-  version = "0.1.58";
+  version = "0.1.59";
 
   src = fetchFromGitHub {
     owner = "pgdogdev";
     repo = "pgdog";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Hw9U2WHMJEiC0gQGJmUr8/xehsYe9jr8cxFnbdgTWKw=";
+    hash = "sha256-eFoWTm0fRnWvyANslTqLG5fw5NU+nrpevATWC747hgg=";
   };
 
-  cargoHash = "sha256-znrpe09PhC3Vn5iUP39/TBwCeYseBE5cLTxhrb02qps=";
+  cargoHash = "sha256-DGdkYGIyTyD7aNP5nr9cMsuHJR7U8QMa+ML/R/wHnnU=";
 
   # Hardcoded paths for C compiler and linker
   postPatch = ''

pkgs/by-name/pl/plantuml/deps.json

@@ -14,23 +14,23 @@
    "module": "sha256-odP1Wo5FZ29u3RbZV+PJZhFwMbBowcX6bVoOjgYFj/E=",
    "pom": "sha256-g3hMiCuNZ54y7T9KjrFNLyxQWYBKd0oCKqOICrWJE1Q="
   },
-  "org/graalvm/buildtools#graalvm-reachability-metadata/1.1.10": {
-   "jar": "sha256-r2Cqh6Toa7ZDKlzBRGl4zds6NGnrbDIaZ7iqAsIohvM=",
-   "module": "sha256-o0enOSRAd4oMYqJId1pjUrJbH6qNbeKxh4KB1/O5HqY=",
-   "pom": "sha256-kNVmNJ2Ma3p7IN9GNMSBiAQ8niEqXmTtL+eI8j0IRcM="
+  "org/graalvm/buildtools#graalvm-reachability-metadata/1.1.11": {
+   "jar": "sha256-aCpHXQmzrBFSZysvcGyI9UtgSPbIijOmll973yTagEo=",
+   "module": "sha256-TZyn3emExcbljYcXb0y0/ViEukxQv4iaehTUATRXtjQ=",
+   "pom": "sha256-EGVg6LcZ2x+He6IgFj0ztWQayvPnhc0WQhYIeroDkao="
   },
-  "org/graalvm/buildtools#native-gradle-plugin/1.1.10": {
-   "jar": "sha256-d8YzLkb7Pqz/z789BPr2IzTQJOhTclqnxvsRUBrVEKA=",
-   "module": "sha256-lHdacyaLgcn2XfuNYWfIk3qkhH9Qcz9e4oOXmfuezGQ=",
-   "pom": "sha256-oeJ5zA2iDyV1flL6XnYSfyqUvW+y2VDcUj1NI3usrlA="
+  "org/graalvm/buildtools#native-gradle-plugin/1.1.11": {
+   "jar": "sha256-0D8gE1vLU3hrCnYR1r8bhDaYoLNOhnaTDFUcSP5irIA=",
+   "module": "sha256-bTb2k/WSHkAXflY6qWXHDqewFDtR0rDCPjUoML3NI6w=",
+   "pom": "sha256-wFyquUzYZ/zpJdQBRxT1Qj2+SQKC1xYPRaE+5mKhYaU="
   },
-  "org/graalvm/buildtools#utils/1.1.10": {
-   "jar": "sha256-yl0lGQl7QphgoVY+tCLalv1SiEFcH3SgmL/Xqgoq3pU=",
-   "module": "sha256-f7UetY5MvIDm35FMmSlwsCXk0VvbpVIIbuND8X1waNw=",
-   "pom": "sha256-BqNtT3qOcublDG+7a8lKjpyHGpGKa4ShSgpRJsIjqjE="
+  "org/graalvm/buildtools#utils/1.1.11": {
+   "jar": "sha256-B2/Nsnf/6wvCuSH1IRAsJI+g2S0WPrZtOKwyC6TLlIw=",
+   "module": "sha256-Wr0VvYGBGQGGMiC91saZ+z5PCiphidDtDX7e/b1vdXY=",
+   "pom": "sha256-qhxjlIeK63nmf9w+guNrUad9ZwNwFaV+CVOvAVoSBMY="
   },
-  "org/graalvm/buildtools/native#org.graalvm.buildtools.native.gradle.plugin/1.1.10": {
-   "pom": "sha256-4+QPF3sPb7LsyO+x7g8fe0ajVF+q7QXw3e1dSeSbkIw="
+  "org/graalvm/buildtools/native#org.graalvm.buildtools.native.gradle.plugin/1.1.11": {
+   "pom": "sha256-sY8piGRlNQc+c7Cu7b12Ayhigr5xvA+Yq4oV5baaWJs="
   },
   "org/teavm#org.teavm.gradle.plugin/0.14.1": {
    "pom": "sha256-YVfRIq/uwUBl8UtUIyZGL+4dAABSMDrwgEQa5Yh+FJo="
@@ -155,12 +155,12 @@
    "jar": "sha256-KnDGAkuxC2GStLkdi7WB3iS3dqeZow71uHdI5UrKIUQ=",
    "pom": "sha256-taT+ZEgeTRD7mpnuLQ9XSb0P2WQM5+jFTvjeuuk7R6Q="
   },
-  "com/google/errorprone#error_prone_annotations/2.50.0": {
-   "jar": "sha256-RmdySHfx03pokgLaGR4j76dlfGLu+TzNrEBuzP5c3Qo=",
-   "pom": "sha256-caBoDSdzJLq0a+xLAPbxEcG3lKkx0NjNp5vLkkaYL5I="
+  "com/google/errorprone#error_prone_annotations/2.47.0": {
+   "jar": "sha256-U2S8byLnLpgZXkBqWNO6HAn/oR3qBylZLLhw3C3kBW0=",
+   "pom": "sha256-2AyImkpvcR9pRfvueeBewkexeKVn6dWr9Y6ybr8KB1I="
   },
-  "com/google/errorprone#error_prone_parent/2.50.0": {
-   "pom": "sha256-q/RaAZ2xJbUP9VE07Cr5SuNRl2EDit8KYLm9e0uLYlQ="
+  "com/google/errorprone#error_prone_parent/2.47.0": {
+   "pom": "sha256-I2ipkMemMJXh0NREWdWkCS8Osx+FYr0SzfDhyHe2poU="
   },
   "com/google/guava#failureaccess/1.0.3": {
    "jar": "sha256-y/w5BrGbj1XdfP1t/gqkUy6DQlDX8IC9jSEaPiRrWcs=",
@@ -172,25 +172,18 @@
   "com/google/guava#guava-parent/33.4.0-android": {
    "pom": "sha256-ciDt5hAmWW+8cg7kuTJG+i0U8ygFhTK1nvBT3jl8fYM="
   },
-  "com/google/guava#guava-parent/33.7.1-jre": {
-   "pom": "sha256-QBXmFaVnR1XIjYES2LvXY+iv3lYb52xnkGme211WCPU="
+  "com/google/guava#guava-parent/33.6.0-jre": {
+   "pom": "sha256-N0vTH2Gxz2Er7pqy5NcLvfd92FpJtDH4CdT73JAfLdQ="
   },
-  "com/google/guava#guava/33.7.1-jre": {
-   "jar": "sha256-eW2OKKxk6DpHxMWTWo/sxGgmUKBLverXOO8PWjoObEY=",
-   "module": "sha256-wBLsy/seEqDAbtIxdczNGcig3LQ/GhaUdxWDqQbZXlY=",
-   "pom": "sha256-tbOA2yMtjZVkV/Ekpf+O00lY4HTc0gZRQEtSKYau/tw="
+  "com/google/guava#guava/33.6.0-jre": {
+   "jar": "sha256-3Fc+H8pP1UVPSl/T19ot8DACh2pBdbr8FKlZgN13E7M=",
+   "module": "sha256-K69zzoOa5I5LngCD4law5Y/Dv4/Hj8P755e7yJARIW4=",
+   "pom": "sha256-tFt4lEKABUMRxT2pJwgJ+0Dcq8QIzmbOVXMAmbT1fTI="
   },
   "com/google/guava#listenablefuture/9999.0-empty-to-avoid-conflict-with-guava": {
    "jar": "sha256-s3KgN9QjCqV/vv/e8w/WEj+cDC24XQrO0AyRuXTzP5k=",
    "pom": "sha256-GNSx2yYVPU5VB5zh92ux/gXNuGLvmVSojLzE/zi4Z5s="
   },
-  "com/google/guava/guava/maven-metadata": {
-   "xml": {
-    "groupId": "com.google.guava",
-    "lastUpdated": "20260818035315",
-    "release": "33.7.1-jre"
-   }
-  },
   "com/google/j2objc#j2objc-annotations/3.1": {
    "jar": "sha256-hNOhUFGEhfgUDqmbiphWVnSWKfZDPJK4DHWzaro7CZs=",
    "pom": "sha256-FFcIOFAANPwbR8ggXOHJ1rJVwczdLRr9zcv3XomySjM="
@@ -258,28 +251,28 @@
    "module": "sha256-4IAoExN1s1fR0oc06aT7QhbahLJAZByz7358fWKCI/w=",
    "pom": "sha256-MjVQgdEJCVw9XTdNWkO09MG3XVSemD71ByPidy5TAqA="
   },
-  "org/eclipse/elk#org.eclipse.elk.alg.common/0.10.0": {
-   "jar": "sha256-UPvIemw4zd0+b9awU7wvpEsXY42x/1Yjl2rVRffeMTY=",
-   "pom": "sha256-VjZ2YA4U587qBGUIv1jqQnCLYg241zOyjbYQngM1xRM="
+  "org/eclipse/elk#org.eclipse.elk.alg.common/0.12.0": {
+   "jar": "sha256-5/6d2DjyqzOzDk2mObpxDETIc06cJbBtcVqRp4gOYXI=",
+   "pom": "sha256-eE8F459zQ3PBNSPtn8/WytsDBZTcA+1BJybO4wJqlEI="
   },
-  "org/eclipse/elk#org.eclipse.elk.alg.layered/0.10.0": {
-   "jar": "sha256-61T3leUeToT8GYEvnkXKbKTHG5/v/PpzMNDN38YKOY0=",
-   "pom": "sha256-Rapu5gJVGFrcWGWDIoUTSg4zmEZPqO7Zav4giR+vpwU="
+  "org/eclipse/elk#org.eclipse.elk.alg.layered/0.12.0": {
+   "jar": "sha256-EXdNduSFXxgTNbphwmjpt0NPLd9ca4foLdHcUdbmgh0=",
+   "pom": "sha256-BD8P64N/egUNwl+24mRhhGWjhSjX5gvbH/jlANDqNY8="
   },
-  "org/eclipse/elk#org.eclipse.elk.alg.mrtree/0.10.0": {
-   "jar": "sha256-Nmlyk3vNF1YS87DPcSpR54j4vcRzmWnJOOGP891rGWA=",
-   "pom": "sha256-6lLFBBaT45tTG+/uPGdc3/Ob/hgCqdsQYYlLnym/Ho0="
+  "org/eclipse/elk#org.eclipse.elk.alg.mrtree/0.12.0": {
+   "jar": "sha256-CckcE3b1L3IEQIkaprJ1wSyEQ4sBOodl4g1ECd1kXhM=",
+   "pom": "sha256-xUK24feTildCR2ydZ7phrqWXhdC5wtrtW5376TgjH1U="
   },
-  "org/eclipse/elk#org.eclipse.elk.core/0.10.0": {
-   "jar": "sha256-dNiknPUQblw5uT6bgKwyIDzEPaYDFtHfKG35jGNQkFc=",
-   "pom": "sha256-cJk6q6FiRXxO6sjz1xK6T266NXYOjfBma8GEEhjkbHQ="
+  "org/eclipse/elk#org.eclipse.elk.core/0.12.0": {
+   "jar": "sha256-1W3DzGUMHzRmdfIYDmTv7UWNJkriIexnfmD27cdSZQI=",
+   "pom": "sha256-PGiiXJgjgZHTGRP1Xd49FrXO8WK/rEuVwHKtt710acs="
   },
-  "org/eclipse/elk#org.eclipse.elk.graph/0.10.0": {
-   "jar": "sha256-05IN04dfWS3lTSgXNogRg89HPzX0H0px632FJaMeefA=",
-   "pom": "sha256-BM8GSd1Oir2YiCvL+0Z+SnVviqvA/X0LRnLdYfqNVWM="
+  "org/eclipse/elk#org.eclipse.elk.graph/0.12.0": {
+   "jar": "sha256-RLAmPWIGq5wtapbo21lqick08SI/q9LyCa2htzACIus=",
+   "pom": "sha256-F7hLCvEEyeXHRit9DgTUTHcTFyc9RHyt7fmkVLIFBZ4="
   },
-  "org/eclipse/elk#parent/0.10.0": {
-   "pom": "sha256-9q7xB2C6UW/8BvlPwGAKc/NOv6mAAsUXJRv7UDHuxUA="
+  "org/eclipse/elk#parent/0.12.0": {
+   "pom": "sha256-6Yw9cxkU0Co72sfqMbsAydGFKxyFwFvH/EjV/Oq/xwQ="
   },
   "org/eclipse/emf#org.eclipse.emf.common/2.12.0": {
    "jar": "sha256-gLnd0BdLvFYjdn7Z9MlrF66Y/677jtvMeA1ZsNfv74M=",
@@ -379,6 +372,16 @@
    "jar": "sha256-+neXEssiFXEWQRl5/VWT0g+ds+J/qQiOHygsmu9KVYQ=",
    "pom": "sha256-UtzJY5STMa6Ng6MVWocsOTdxmNM/29rO/+Ip2EcvcKk="
   },
+  "org/eclipse/xtext#org.eclipse.xtext.xbase.lib/2.44.0": {
+   "jar": "sha256-xsK4WTzTnCeedOcFXL0UbTncbxYBGWG0kouSco0y0A0=",
+   "pom": "sha256-gTvyj/c88XOaFbMkM1WOJWPl4sScCT/FHksjg+/zWQU="
+  },
+  "org/eclipse/xtext#xtext-dev-bom/2.44.0": {
+   "pom": "sha256-0NOTSKEPgb+7uNm0Kr0ybF97CH2LnfoTZvFc9UCxnzM="
+  },
+  "org/eclipse/xtext#xtext-parent/2.44.0": {
+   "pom": "sha256-idNo7tD2y1HNzvtC7RtnX5whJX6CgqAhD5eGGsFp4kM="
+  },
   "org/infinispan#infinispan-bom/11.0.19.Final": {
    "pom": "sha256-OmBv0rX3f991rPM15brdRnxCQFsR8mjnPBfrkkM+WhE="
   },
@@ -408,14 +411,10 @@
    "pom": "sha256-AA3WFimK69IanVcxh03wg9cphCS5HgN7c8vdB+vIPg4="
   },
   "org/jspecify#jspecify/1.0.0": {
+   "jar": "sha256-H61ua+dVd4Hk0zcp1Jrhzcj92m/kd7sMxozjUer9+6s=",
    "module": "sha256-0wfKd6VOGKwe8artTlu+AUvS9J8p4dL4E+R8J4KDGVs=",
    "pom": "sha256-zauSmjuVIR9D0gkMXi0N/oRllg43i8MrNYQdqzJEM6Y="
   },
-  "org/jspecify#jspecify/1.0.1": {
-   "jar": "sha256-Bw118mH+TFuCAlCDZnFffy1GYPiMjvfm01deSMloO2Y=",
-   "module": "sha256-aDXWrHYqmchebDumyUK+LGmXquyY8H3t/pkX2uIr2pY=",
-   "pom": "sha256-VbOL8aex2OpRjPL0866aqiNuYbvwtr0x/7SXU6BZ3V4="
-  },
   "org/junit#junit-bom/5.10.2": {
    "module": "sha256-3iOxFLPkEZqP5usXvtWjhSgWaYus5nBxV51tkn67CAo=",
    "pom": "sha256-Fp3ZBKSw9lIM/+ZYzGIpK/6fPBSpifqSEgckzeQ6mWg="

pkgs/by-name/pl/plantuml/package.nix

@@ -14,13 +14,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "plantuml";
-  version = "1.2026.7";
+  version = "1.2026.8";
 
   src = fetchFromGitHub {
     owner = "plantuml";
     repo = "plantuml";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-kvaHpE9IgqkpAUv5t70K74h02qBA09kqNR/jCLB7+7I=";
+    hash = "sha256-J/9kD96oumfqr8LQpJZ512HjIUctJtbkMj/D7NzGQmU=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/po/policycoreutils/package.nix

@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchurl,
+  fetchpatch,
   gettext,
   libsepol,
   libselinux,
@@ -20,6 +21,16 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-BU5B7AOXMaXua3l6jguNbjRu4dCpusLyUttIwj+aixs=";
   };
 
+  patches = [
+    # https://nvd.nist.gov/vuln/detail/CVE-2026-19079
+    (fetchpatch {
+      name = "CVE-2026-19079.patch";
+      url = "https://github.com/SELinuxProject/selinux/commit/a556538c2d5d2583273e025b45c02651fef47679.patch";
+      stripLen = 1;
+      hash = "sha256-na/4xfW1R5VwvwHTUHXSs23pOD8Z/ClbBET+oxJe+uA=";
+    })
+  ];
+
   postPatch = ''
     # Fix install references
     substituteInPlace po/Makefile \

pkgs/by-name/pp/pplatex/package.nix

@@ -1,48 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  cmake,
-  pkg-config,
-  pcre,
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "pplatex";
-  version = "1.0-unstable-2025-05-07";
-
-  src = fetchFromGitHub {
-    owner = "stefanhepp";
-    repo = "pplatex";
-    rev = "9f6cfb23c3b578f14ad2664cd754cb4a66dc790e";
-    sha256 = "sha256-vI7CujOn2J4qWiykTQj8wyRmfeTDvR0eiFKB2ElTNUk=";
-  };
-
-  nativeBuildInputs = [
-    cmake
-    pkg-config
-  ];
-  cmakeFlags = [
-    # https://github.com/NixOS/nixpkgs/issues/445447
-    (lib.cmakeFeature "CMAKE_POLICY_VERSION_MINIMUM" "3.5")
-  ];
-
-  buildInputs = [
-    pcre
-  ];
-
-  installPhase = ''
-    runHook preInstall
-    install -Dm555 src/pplatex "$out"/bin/pplatex
-    runHook postInstall
-  '';
-
-  meta = {
-    description = "Tool to reformat the output of latex and friends into readable messages";
-    mainProgram = "pplatex";
-    homepage = "https://github.com/stefanhepp/pplatex";
-    license = lib.licenses.gpl3Plus;
-    maintainers = [ lib.maintainers.doronbehar ];
-    platforms = lib.platforms.unix;
-  };
-})

pkgs/by-name/pr/proggyfonts/package.nix

@@ -3,6 +3,7 @@
   stdenv,
   fetchurl,
   mkfontscale,
+  installFonts,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -14,29 +15,30 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-SsLzZdR5icVJNbr5rcCPbagPPtWghbqs2Jxmrtufsa4=";
   };
 
-  nativeBuildInputs = [ mkfontscale ];
+  nativeBuildInputs = [
+    mkfontscale
+    installFonts
+  ];
 
   dontConfigure = true;
   dontBuild = true;
 
-  installPhase = ''
-    runHook preInstall
+  preInstall = ''
+    rm Speedy.pcf # duplicated as Speedy11.pcf
 
     # compress pcf fonts
-    mkdir -p $out/share/fonts/misc
-    rm Speedy.pcf # duplicated as Speedy11.pcf
     for f in *.pcf; do
-      gzip -n -9 -c "$f" > $out/share/fonts/misc/"$f".gz
+      gzip -n -9 -c "$f" > "$f".gz
     done
 
-    install -D -m 644 *.bdf -t "$out/share/fonts/misc"
-    install -D -m 644 *.ttf -t "$out/share/fonts/truetype"
+    rm *.pcf
+  '';
+
+  postInstall = ''
     install -D -m 644 Licence.txt -t "$out/share/doc/$name"
 
     mkfontscale "$out/share/fonts/truetype"
     mkfontdir   "$out/share/fonts/misc"
-
-    runHook postInstall
   '';
 
   meta = {

pkgs/by-name/pr/proj/package.nix

@@ -18,7 +18,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "proj";
-  version = "9.8.1";
+  version = "9.9.0";
   __structuredAttrs = true;
   strictDeps = true;
 
@@ -26,7 +26,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "OSGeo";
     repo = "PROJ";
     tag = finalAttrs.version;
-    hash = "sha256-sOAxWihgU1TAMWcju5LN4cPenHHoGgd4oYJ4HA3F/Ks=";
+    hash = "sha256-3WJCqH+8MCs/UOmnCqIehLEnkoLCBRCReO05UP2A02A=";
   };
 
   patches = [

pkgs/by-name/pr/prometheus-redis-exporter/package.nix

@@ -12,7 +12,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "redis_exporter";
-  version = "1.91.0";
+  version = "1.91.1";
 
   __structuredAttrs = true;
 
@@ -20,10 +20,10 @@ buildGoModule (finalAttrs: {
     owner = "oliver006";
     repo = "redis_exporter";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-BECFx4sHL9zEEk5wKSZ9U1IEK6l2C9M8zdNrVJwc8LY=";
+    hash = "sha256-0rX46q2tTobrE+TnecT4j0WenkwMOyrhmxkINL+4hxA=";
   };
 
-  vendorHash = "sha256-+g1HSv+AxXsNzVr6QHpm2EJnRR80rPCtBnPgwq6aq5I=";
+  vendorHash = "sha256-N6GqUzrThX4uQ0S5RSNMya1WROGR7/kTFQJT0YNsf2Q=";
 
   ldflags = [
     "-X main.BuildVersion=${finalAttrs.version}"

pkgs/by-name/qd/qdl/package.nix

@@ -2,12 +2,13 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchpatch2,
   meson,
   pkg-config,
   libxml2,
   libusb1,
   libzip,
+  nbdkit,
+  zip,
   cmocka,
   ninja,
   versionCheckHook,
@@ -16,50 +17,46 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "qdl";
-  version = "2.7.1";
+  version = "2.8";
 
   __structuredAttrs = true;
+
   strictDeps = true;
 
   src = fetchFromGitHub {
     owner = "linux-msm";
     repo = "qdl";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-r7DVfuTjuhkhLCXJdgzLuh34nIsoEroGzIaFQJ3oHAA=";
+    hash = "sha256-ysL9tO1GKvzphxezMspGMW8kkUNGHHspA1YU+v5HA/A=";
   };
 
-  patches = [
-    # allow VERSION to be overridden, will land in 2.8
-    (fetchpatch2 {
-      url = "https://github.com/linux-msm/qdl/commit/6f8700ed81b3614baa12786a9845c9abeab1e178.patch";
-      hash = "sha256-fDC34Wq4MadDDLHVQ5zuRKE2zD2dOMTU8EGINcJTYuI=";
-    })
-  ];
-
   nativeBuildInputs = [
     meson
     pkg-config
-    cmocka
     ninja
   ];
   buildInputs = [
     libxml2
     libusb1
     libzip
+    nbdkit
+  ];
+  checkInputs = [
+    cmocka
+  ];
+  nativeCheckInputs = [
+    zip
   ];
 
   mesonFlags = [
     "--prefix=${placeholder "out"}"
-    "-DVERSION=${finalAttrs.src.rev}"
-
-    # Tests currently fail to link but seem rather new
-    # https://github.com/linux-msm/qdl/issues/260
-    # test_contents_selectors.c:(.text+0x234e): undefined reference to `firehose_alloc_op'
-    "-Dtests=disabled"
+    "-DVERSION=${finalAttrs.version}"
   ];
 
   enableParallelBuilding = true;
 
+  doCheck = true;
+
   nativeInstallCheckInputs = [ versionCheckHook ];
   doInstallCheck = true;
 

pkgs/by-name/ra/radicle-artifact/package.nix

@@ -9,7 +9,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "radicle-artifact";
-  version = "0.18.0";
+  version = "0.19.0";
 
   __structuredAttrs = true;
 
@@ -17,10 +17,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     seed = "radicle.norman.life";
     repo = "z4VYyJ9KuwMNkXGQnmKuGPGKw3inv";
     tag = "releases/${finalAttrs.version}";
-    hash = "sha256-KMu0d8+Nu7wJcaJWFzQXN7nfp+Z6np84JQL8RKbWkIQ=";
+    hash = "sha256-b+yi/Kqmtn1Lpnc7Vt1Od0DAx6cOahrru0+Lb6hbM10=";
   };
 
-  cargoHash = "sha256-MRUeVIl9ZNNTs2T7/uKIyLm0KBgsXHYTI19uXOFWypk=";
+  cargoHash = "sha256-EPDkr9qT5X8n3FO3v8RSpTl1Alz1zndu5RExN7gPXxk=";
 
   nativeCheckInputs = [ gitMinimal ];
 

pkgs/by-name/ru/rufin/package.nix

@@ -20,7 +20,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rufin";
-  version = "0.15.3";
+  version = "0.15.4";
 
   __structuredAttrs = true;
 
@@ -28,12 +28,12 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "screwys";
     repo = "Rufin";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-XBLQjf1YpoOd4SsMVI9Th4Amfgaqb1wbjXtxwY7dC0Q=";
+    hash = "sha256-a9F0UIFpPaDQS5reV4ISzF3TAxNuRBLE5MPLveABYbo=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-jRYkBcCA0P2wCsCmpg9vCJF0qy/YTa9XW1WJtPtOGhw=";
+    hash = "sha256-puijPhfe548I/RD4wtlBnbS6OWabQlTv4yBRyRsCEvQ=";
   };
 
   strictDeps = true;