Merge 225a465eed into haskell-updates

Fixes build on darwin.
The binary is already signed by Google, so no need to sign again.

.github/workflows/build.yml

@@ -55,7 +55,7 @@ jobs:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
           target-as-trusted-at: ${{ inputs.targetSha }}
 
-      - uses: cachix/install-nix-action@448cde739abec1eaf0646249e3d25bb8d9bc7702 # v31.11.2
+      - uses: cachix/install-nix-action@75c75c31ebece974e48ebc36b4ad125bd97bd97b # v31.11.3
         with:
           # Sandbox is disabled on MacOS by default.
           extra_nix_config: sandbox = true

.github/workflows/check.yml

@@ -224,7 +224,7 @@ jobs:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
           target-as-trusted-at: ${{ inputs.targetSha }}
 
-      - uses: cachix/install-nix-action@448cde739abec1eaf0646249e3d25bb8d9bc7702 # v31.11.2
+      - uses: cachix/install-nix-action@75c75c31ebece974e48ebc36b4ad125bd97bd97b # v31.11.3
 
       - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
         continue-on-error: true

.github/workflows/eval.yml

@@ -142,7 +142,7 @@ jobs:
             core.info(`Found pinned.json commit: ${ciPinBumpCommit}`)
 
       - name: Install Nix
-        uses: cachix/install-nix-action@448cde739abec1eaf0646249e3d25bb8d9bc7702 # v31.11.2
+        uses: cachix/install-nix-action@75c75c31ebece974e48ebc36b4ad125bd97bd97b # v31.11.3
 
       - name: Load supported versions
         id: versions
@@ -186,7 +186,7 @@ jobs:
           target-as-trusted-at: ${{ inputs.targetSha }}
 
       - name: Install Nix
-        uses: cachix/install-nix-action@448cde739abec1eaf0646249e3d25bb8d9bc7702 # v31.11.2
+        uses: cachix/install-nix-action@75c75c31ebece974e48ebc36b4ad125bd97bd97b # v31.11.3
 
       - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
         continue-on-error: true
@@ -272,7 +272,7 @@ jobs:
           merge-multiple: true
 
       - name: Install Nix
-        uses: cachix/install-nix-action@448cde739abec1eaf0646249e3d25bb8d9bc7702 # v31.11.2
+        uses: cachix/install-nix-action@75c75c31ebece974e48ebc36b4ad125bd97bd97b # v31.11.3
 
       - name: Combine all output paths and eval stats
         run: |
@@ -478,7 +478,7 @@ jobs:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
 
       - name: Install Nix
-        uses: cachix/install-nix-action@448cde739abec1eaf0646249e3d25bb8d9bc7702 # v31.11.2
+        uses: cachix/install-nix-action@75c75c31ebece974e48ebc36b4ad125bd97bd97b # v31.11.3
 
       - name: Ensure flake outputs on all systems still evaluate
         run: nix flake check --all-systems --no-build './nixpkgs/untrusted?shallow=1'

.github/workflows/lint.yml

@@ -31,7 +31,7 @@ jobs:
         with:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
 
-      - uses: cachix/install-nix-action@448cde739abec1eaf0646249e3d25bb8d9bc7702 # v31.11.2
+      - uses: cachix/install-nix-action@75c75c31ebece974e48ebc36b4ad125bd97bd97b # v31.11.3
 
       # TODO: Figure out how to best enable caching for the treefmt job. Cachix won't work well,
       # because the cache would be invalidated on every commit - treefmt checks every file.
@@ -62,7 +62,7 @@ jobs:
         with:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
 
-      - uses: cachix/install-nix-action@448cde739abec1eaf0646249e3d25bb8d9bc7702 # v31.11.2
+      - uses: cachix/install-nix-action@75c75c31ebece974e48ebc36b4ad125bd97bd97b # v31.11.3
 
       - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
         continue-on-error: true
@@ -88,7 +88,7 @@ jobs:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
           target-as-trusted-at: ${{ inputs.targetSha }}
 
-      - uses: cachix/install-nix-action@448cde739abec1eaf0646249e3d25bb8d9bc7702 # v31.11.2
+      - uses: cachix/install-nix-action@75c75c31ebece974e48ebc36b4ad125bd97bd97b # v31.11.3
 
       - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
         continue-on-error: true

maintainers/scripts/haskell/eval-pkg-sets.sh

@@ -0,0 +1,39 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash
+#!nix-shell -p jq git
+# shellcheck shell=bash
+#
+# Usage: eval-pkg-sets.sh [extra flags for nix-* commands ...]
+#
+# Must be executed in a git checkout of Nixpkgs.
+
+set -euo pipefail
+
+NIXPKGS="$(git rev-parse --show-toplevel)"
+PKGSETS="$(nix-env --readonly-mode --json --drv-path -f "$NIXPKGS" -qaP -A haskell.compiler "$@" \
+  | jq -r 'to_entries | unique_by(.value.drvPath) .[] .key | sub("^haskell.compiler";"haskell.packages")')"
+
+trap 'exit 1' SIGINT SIGTERM
+
+set +e
+
+badsets=""
+for set in $PKGSETS; do
+  # Confirm an equivalent package set to haskell.compiler.$entry exists and is usable
+  if ! nix-instantiate --readonly-mode -A "$set.ghc" "$@" > /dev/null 2>&1; then
+    echo "Skipping $set... ($set.ghc does not evaluate)"
+  else
+    echo "Evaluating $set..."
+
+    if ! nix-env --readonly-mode -f "$NIXPKGS" -qaP --drv-path -A "$set" "$@" > /dev/null; then
+      badsets+="$set "
+    fi
+  fi
+done
+
+if [ -n "$badsets" ]; then
+  echo "Found potential eval issues in the following sets:" >&2
+  # shellcheck disable=SC2086
+  printf '%s\n' $badsets
+  exit 1
+fi

maintainers/scripts/haskell/unbreak.nu

@@ -6,7 +6,7 @@
 
 # Attention: For unknown reasons, the script can't be easily cancelled and needs to be killed manually if it shouldn't run to completion.
 
-use std log
+use std/log
 
 let broken_config = "pkgs/development/haskell-modules/configuration-hackage2nix/broken.yaml"
 

maintainers/scripts/haskell/update-stackage.sh

@@ -33,7 +33,7 @@ fi
 
 # Stackage solver to use, LTS or Nightly
 # (should be capitalized like the display name)
-SOLVER=LTS
+SOLVER=Nightly
 # Stackage solver version, if any. Use latest if empty
 VERSION=
 TMP_TEMPLATE=update-stackage.XXXXXXX
@@ -105,6 +105,7 @@ sed -r \
     -e '/ hledger-ui /d' \
     -e '/ hledger-web /d' \
     -e '/ spacecookie /d' \
+    -e '/ hnix-store-core /d' \
     < "${tmpfile_new}" >> $stackage_config
 # Explanations:
 # cabal2nix, distribution-nixpkgs, jailbreak-cabal, language-nix: These are our packages and we know what we are doing.

nixos/lib/test-driver/src/test_driver/__init__.py

@@ -191,7 +191,7 @@ def main() -> None:
                 history_filename=history_path,
             )
         else:
-            tic = time.time()
+            tic = time.monotonic()
             driver.run_tests()
-            toc = time.time()
+            toc = time.monotonic()
             logger.info(f"test script finished in {(toc - tic):.2f}s")

nixos/lib/test-driver/src/test_driver/logger.py

@@ -234,13 +234,15 @@ class CompositeLogger(AbstractLogger):
 
 class TerminalLogger(AbstractLogger):
     def __init__(self) -> None:
+        self._start_time = time.monotonic()
         self._print_serial_logs = True
         self._log_level = LogLevel.INFO
 
     def maybe_prefix(self, message: str, attributes: dict[str, str]) -> str:
+        elapsed = time.monotonic() - self._start_time
         if "machine" in attributes:
-            return f"{attributes['machine']}: {message}"
-        return message
+            message = f"{attributes['machine']}: {message}"
+        return f"[{elapsed:.2f}s] {message}"
 
     @staticmethod
     def _eprint(*args: object, **kwargs: Any) -> None:
@@ -263,9 +265,9 @@ class TerminalLogger(AbstractLogger):
             )
         )
 
-        tic = time.time()
+        tic = time.monotonic()
         yield
-        toc = time.time()
+        toc = time.monotonic()
         self.log(f"(finished: {message}, in {toc - tic:.2f} seconds)", attributes)
 
     def debug(self, *args, **kwargs) -> None:
@@ -392,11 +394,11 @@ class XMLLogger(AbstractLogger):
         self.xml.characters(message)
         self.xml.endElement("head")
 
-        tic = time.time()
+        tic = time.monotonic()
         self.drain_log_queue()
         yield
         self.drain_log_queue()
-        toc = time.time()
+        toc = time.monotonic()
         self.log(f"(finished: {message}, in {toc - tic:.2f} seconds)")
 
         self.xml.endElement("nest")

nixos/lib/test-driver/src/test_driver/machine/__init__.py

@@ -1353,7 +1353,7 @@ class QemuMachine(BaseMachine):
 
             assert self.shell
 
-            tic = time.time()
+            tic = time.monotonic()
 
             for _ in range(10):
                 if shell_ready(timeout=dt.timedelta(seconds=30)):
@@ -1374,7 +1374,7 @@ class QemuMachine(BaseMachine):
                 if b"Spawning backdoor root shell..." in chunk:
                     break
 
-            toc = time.time()
+            toc = time.monotonic()
 
             self.log("connected to guest root shell")
             self.log(f"(connecting took {toc - tic:.2f} seconds)")

nixos/modules/services/hardware/buffyboard.nix

@@ -55,7 +55,7 @@ in
           By default, this is generated from whatever you've set in `settings`.
           If specified manually, then `settings` is ignored.
 
-          For an example config file see [here](https://gitlab.postmarketos.org/postmarketOS/buffybox/-/blob/master/buffyboard/buffyboard.conf)
+          For an example config file see [here](https://gitlab.nura.eco/nura/buffybox/-/blob/main/buffyboard/buffyboard.conf)
         '';
       };
 

nixos/modules/services/monitoring/prometheus/exporters/fritz.nix

@@ -22,7 +22,7 @@ in
 
         options = {
           # Pull existing port option into config file.
-          port = mkOption {
+          exporter_port = mkOption {
             type = types.port;
             default = cfg.port;
             internal = true;

nixos/modules/services/networking/sunshine.nix

@@ -153,9 +153,10 @@ in
 
     services.avahi = {
       enable = mkDefault true;
-      publish = {
-        enable = mkDefault true;
-        userServices = mkDefault true;
+      settings.publish = {
+        disable-publishing = mkDefault false;
+        disable-user-service-publishing = mkDefault false;
+        publish-addresses = mkDefault true;
       };
     };
 

nixos/modules/system/boot/unl0kr.nix

@@ -27,7 +27,7 @@ in
 
         See `unl0kr.conf(5)` for supported values.
 
-        Alternatively, visit `https://gitlab.postmarketos.org/postmarketOS/buffybox/-/blob/3.2.0/unl0kr/unl0kr.conf`
+        Alternatively, visit `https://gitlab.nura.eco/nura/buffybox/-/blob/3.2.0/unl0kr/unl0kr.conf`
       '';
 
       example = lib.literalExpression ''

nixos/tests/incus/default.nix

@@ -23,8 +23,7 @@ in
   all = incusRunTest {
     name = "all";
     appArmor = true;
-    # https://github.com/lxc/incus/issues/4297
-    # feature.user = true;
+    feature.user = true;
 
     instances = {
       c1 = {

pkgs/applications/editors/android-studio/darwin.nix

@@ -57,7 +57,6 @@ let
 
       mkdir -p "$out/Applications/${appName}" "$out/bin"
       cp -R "''${apps[0]}/." "$out/Applications/${appName}"
-      /usr/bin/xattr -cr "$out/Applications/${appName}"
       makeWrapper \
         "$out/Applications/${appName}/Contents/MacOS/studio" \
         "$out/bin/studio"
@@ -145,8 +144,6 @@ let
         echo -n "$startScript" > "$appDir/MacOS/studio"
         chmod +x "$appDir/MacOS/studio"
         ln -s "../Applications/${appName}/Contents/MacOS/studio" "$out/bin/${pname}"
-
-        /usr/bin/codesign --force --sign - "$out/Applications/${appName}"
       '';
 in
 mkAndroidStudioWrapper { inherit androidStudio; }

pkgs/applications/editors/android-studio/default.nix

@@ -88,15 +88,15 @@ let
     };
   };
   betaVersion = {
-    version = "2026.2.1.7"; # "Android Studio Rabbit 1 | 2026.2.1 RC 2"
+    version = "2026.2.2.7"; # "Android Studio Rabbit 2 | 2026.2.2 RC 2"
     sources = {
       x86_64-linux = {
-        sha256Hash = "sha256-wI2hdMhYl2zPg8SU3+D413ygFqrBQfYMb1yjOsDQ1aA=";
-        url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2026.2.1.7/android-studio-rabbit1-rc2-linux.tar.gz";
+        sha256Hash = "sha256-DRwN9h4bMlxiQ68B7//FxWGEmsRGjBQXusmWnPakrG4=";
+        url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2026.2.2.7/android-studio-rabbit2-rc2-linux.tar.gz";
       };
       aarch64-darwin = {
-        sha256Hash = "sha256-j7ccJ6D+uWOEqpUVEuulv1jjnBqOj2OS/SAhjyVRdso=";
-        url = "https://edgedl.me.gvt1.com/android/studio/install/2026.2.1.7/android-studio-rabbit1-rc2-mac_arm.dmg";
+        sha256Hash = "sha256-pUimObRriMmlPqX/Vkl3ZdD25MYgvat9CVKEXqQ98yE=";
+        url = "https://edgedl.me.gvt1.com/android/studio/install/2026.2.2.7/android-studio-rabbit2-rc2-mac_arm.dmg";
       };
     };
   };

pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix

@@ -21,22 +21,22 @@ vscode-utils.buildVscodeMarketplaceExtension (finalAttrs: {
       sources = {
         "x86_64-linux" = {
           arch = "linux-x64";
-          hash = "sha256-q9I6MXnkHrsseNTx82wWR4JGAEe8aA58ju/Fcx7E3+k=";
+          hash = "sha256-vZfzIOXqmxrkNuKnicXBITaVBV59S2UbGrf3unrFXUE=";
         };
         "aarch64-linux" = {
           arch = "linux-arm64";
-          hash = "sha256-dHTsbAokrQQw4QJGuwwyvPamq2uogwCW27R7Pk715ks=";
+          hash = "sha256-RK/STFGNhLata3aQWrEXqLG85gx8D3oojCZtDmfKM/U=";
         };
         "aarch64-darwin" = {
           arch = "darwin-arm64";
-          hash = "sha256-uFHkOzW2NJh+95T73cdZp+6r1mIIhRGidvYGOlmDc9I=";
+          hash = "sha256-wQF+wDOeYLPrdixEl9ZEip0LPW0Muwn4YmS8IZ5z5vQ=";
         };
       };
     in
     {
       name = "claude-code";
       publisher = "anthropic";
-      version = "2.1.312";
+      version = "2.1.314";
     }
     // sources.${stdenvNoCC.hostPlatform.system}
       or (throw "Unsupported system ${stdenvNoCC.hostPlatform.system}");

pkgs/applications/editors/vscode/extensions/astral-sh.ty/default.nix

@@ -12,22 +12,22 @@ vscode-utils.buildVscodeMarketplaceExtension {
       sources = {
         "x86_64-linux" = {
           arch = "linux-x64";
-          hash = "sha256-jAqPR49NcmyM8/3juSRJ0DalC3eo2HZpEihfVqkQtoo=";
+          hash = "sha256-lNQb6rTEvCn/ngaSbFMATt5WeivLlIbgFP9+qSutnwc=";
         };
         "aarch64-linux" = {
           arch = "linux-arm64";
-          hash = "sha256-E+hEYxBJ+8WfqPegV5oV1AhljXJUYPbVVk0XJRkxwkY=";
+          hash = "sha256-nKPD3ZRB7D0D/WTQVHrAlSX0AY7pv4cGPleUde6pXY0=";
         };
         "aarch64-darwin" = {
           arch = "darwin-arm64";
-          hash = "sha256-imWomRRN1Co6idsQbOetFxM96ZZMKzE0W5nz3ULyk7Q=";
+          hash = "sha256-HdxTP3KL+BX5tQ63/eea7gNRP6YsSCv/Hnm0kC5c3bc=";
         };
       };
     in
     {
       name = "ty";
       publisher = "astral-sh";
-      version = "2026.78.0";
+      version = "2026.84.0";
     }
     // sources.${stdenvNoCC.hostPlatform.system}
       or (throw "Unsupported system ${stdenvNoCC.hostPlatform.system}");

pkgs/applications/editors/vscode/extensions/default.nix

@@ -2380,8 +2380,8 @@ let
         mktplcRef = {
           name = "vscode-vibrancy-continued";
           publisher = "illixion";
-          version = "1.4.0";
-          hash = "sha256-o0/aEgRIaiz5lDm6XY1g+koAP1s28mXUnbm60eu8h+c=";
+          version = "1.6.0";
+          hash = "sha256-UE7NtvKDSSF7kXzevg8NTlVj1JDtSdv9EItjaXeVhQY=";
         };
         meta = {
           downloadPage = "https://marketplace.visualstudio.com/items?itemName=illixion.vscode-vibrancy-continued";

pkgs/applications/editors/vscode/extensions/ms-python.vscode-pylance/default.nix

@@ -8,8 +8,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "vscode-pylance";
     publisher = "MS-python";
-    version = "2026.3.1";
-    hash = "sha256-Jl1fmAtc4wPV0cUE8nbIZdOr1Kk8pmHUq6ZCT6k0k64=";
+    version = "2026.4.1";
+    hash = "sha256-PmydC6DGaA5u8o0a9cbhOETjmoceVATL+qrttc0NjPs=";
   };
 
   buildInputs = [ pyright ];

pkgs/applications/editors/vscode/generic.nix

@@ -418,6 +418,13 @@ stdenv.mkDerivation (
           packed="resources/app/node_modules.asar"
           unpacked="resources/app/node_modules"
           asar extract "$packed" "$unpacked"
+
+          # FIXME: drop this when `asar extract` preserves the mode of unpacked files in
+          # the archives Microsoft ships, fixes https://github.com/NixOS/nixpkgs/issues/573021
+          if [ -d "$packed.unpacked" ]; then
+            cp -a "$packed.unpacked/." "$unpacked/"
+          fi
+
           substituteInPlace $unpacked/@vscode/sudo-prompt/index.js \
             --replace-fail "/usr/bin/pkexec" "/run/wrappers/bin/pkexec" \
             --replace-fail "/bin/bash" "${bash}/bin/bash"

pkgs/applications/networking/browsers/brave/packages/brave-origin.nix

@@ -1,21 +1,21 @@
 # Expression generated by update.py; do not edit it by hand!
 rec {
   pname = "brave-origin";
-  version = "1.98.60";
+  version = "1.98.62";
   flavor = "origin";
 
   archives = {
     aarch64-linux = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-origin_${version}_arm64.deb";
-      hash = "sha256-EM+0yOshDwFHYEZAj6ZlZfjEzD75yUShlRFu/QHZhmA=";
+      hash = "sha256-8H1A2oWUXvQ9Tzc+6PsKbFUBSOFa5+YjZEU8CwCCv9c=";
     };
     x86_64-linux = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-origin_${version}_amd64.deb";
-      hash = "sha256-VKBbHBK684D7dwqyhhwh87uQJfU3VQ9tNEHxre9S5jk=";
+      hash = "sha256-LiQKzhcdsHPb0OzL960BoAhwn0AcxcP1NYvu/p18Eis=";
     };
     aarch64-darwin = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/Brave-Origin-arm64.dmg";
-      hash = "sha256-vhE2VcBu1B+uHACtbVXp6heDyCgRWBzs5O55CCulWIQ=";
+      hash = "sha256-gVkaKNx9RIsORdyuu6TizhsNOOOP1pV0Tucd9e0upWY=";
     };
   };
 }

pkgs/applications/networking/browsers/brave/packages/brave.nix

@@ -1,20 +1,20 @@
 # Expression generated by update.py; do not edit it by hand!
 rec {
   pname = "brave";
-  version = "1.98.60";
+  version = "1.98.62";
 
   archives = {
     aarch64-linux = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_arm64.deb";
-      hash = "sha256-mqbdSwo0a/5+6WdBllhvfy1I2MonRcttDNj7GStLsEc=";
+      hash = "sha256-lXjpjKXD9QEuvAYNhp8OYmT/PW2WpfBO5zfre/ygdiQ=";
     };
     x86_64-linux = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-      hash = "sha256-gSoAHXYxtatJ5V3sYUigvC1Fnp/AMQbChile4D/QYvw=";
+      hash = "sha256-+ytsdncm2ytWLXZhmGGLwppZDpj4KZat4qOikVO1VcE=";
     };
     aarch64-darwin = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/Brave-Browser-arm64.dmg";
-      hash = "sha256-dQuVl3hnCnG3bGC6smZOvCnws7YJOs3IrPUYb0beu30=";
+      hash = "sha256-b1o57leoZSONZEG5gAzZXXC8yxsaGPRpMjBN2gTIX6w=";
     };
   };
 }

pkgs/applications/networking/browsers/chromium/info.json

@@ -1,10 +1,10 @@
 {
   "chromium": {
-    "version": "156.0.8078.73",
+    "version": "156.0.8078.79",
     "chromedriver": {
-      "version": "156.0.8078.74",
-      "hash_darwin": "sha256-ePPel8ZzVkRpyaRNnpaWnOUC/ff+kH9D/0ZxwUY4G3o=",
-      "hash_darwin_aarch64": "sha256-49uJavaXHG5+Y5551bl0BPZf7s/Kuwl+6NfoSyM1GzU="
+      "version": "156.0.8078.80",
+      "hash_darwin": "sha256-/YkAZPWbSB3VCIdNUmk7c2uwxcoIDXWqoj5o5Tsty6E=",
+      "hash_darwin_aarch64": "sha256-98N/tPUDDtEQ1o7hY2Xm35uDAznNfHKOq5DfgaBWgKE="
     },
     "deps": {
       "depot_tools": {
@@ -21,8 +21,8 @@
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "2f9a11097447f226133bc1a31c787291a5eeab98",
-        "hash": "sha256-thSoz/4ZXmx/R6E8d771aeTkumcsS1J9AmlA5aktmdw=",
+        "rev": "a21ce95c24ce3964416f09ae1862f53f319eb4d0",
+        "hash": "sha256-5KN7UQ76eSN6TxO6AWbpQTV5DPqHXxsUok3MTirhaxE=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {
@@ -132,8 +132,8 @@
       },
       "src/third_party/dawn": {
         "url": "https://dawn.googlesource.com/dawn.git",
-        "rev": "0caf3649477f7c3ffbd4b1ca4764a81b469b1582",
-        "hash": "sha256-tGTlSLvoPswtjxoUp+ZOUdxnFsselUp1JhTxNYbWYz4="
+        "rev": "8114a24a35eed1db88d1d897e8bd193a8c334712",
+        "hash": "sha256-dqhsoLcd9v5DEXxUll1c5/cNQMbk/EXhM5fR7T/ch3E="
       },
       "src/third_party/dawn/third_party/glfw3/src": {
         "url": "https://chromium.googlesource.com/external/github.com/glfw/glfw",
@@ -627,8 +627,8 @@
       },
       "src/third_party/pdfium": {
         "url": "https://pdfium.googlesource.com/pdfium.git",
-        "rev": "fa4d5f8fbd89ea07273529daf9fd24fe1c7f6b9a",
-        "hash": "sha256-dpAHjIkcg1fa0sgiopvNuEDgYrh4Z00sQu66nnFk+m0="
+        "rev": "c97f02a3519c99d5969514970fd8186318cdb2b0",
+        "hash": "sha256-DdoMSaiwAb+nyq1Wppyv24S1ooR2XBDl6ydfD4O0t/U="
       },
       "src/third_party/perfetto": {
         "url": "https://chromium.googlesource.com/external/github.com/google/perfetto.git",
@@ -682,8 +682,8 @@
       },
       "src/third_party/skia": {
         "url": "https://skia.googlesource.com/skia.git",
-        "rev": "a65b5cc03a5131808aec172085b7074fc66625b9",
-        "hash": "sha256-f7p89qrPgd3/OxxbIfR9TuUn4Zr8q+U1j2XOxRj1RVE="
+        "rev": "aa789d9bd566b9865add4070dc6777b3266c64e9",
+        "hash": "sha256-ynH8Q/2lx4HQTnQNXkaKFPpyiY3SNNiOtIr6TrUBWxA="
       },
       "src/third_party/smhasher/src": {
         "url": "https://chromium.googlesource.com/external/smhasher.git",
@@ -852,8 +852,8 @@
       },
       "src/v8": {
         "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "235050a0df6db2c9d92a419af2b72fbf3b2dd73b",
-        "hash": "sha256-84BgjMG6ZOFk4YBa6sKQ/4kqR7zjA2W8A3ZnD+k40Es="
+        "rev": "c9b3cfcab30ace06c21f9b48a0f0a34805e81e9d",
+        "hash": "sha256-3HhlZ6uCSq8T5a6N6TC7VkMBY3xkFoQUZbqpUUE4nro="
       },
       "src/agents/shared": {
         "url": "https://chromium.googlesource.com/chromium/agents.git",
@@ -863,7 +863,7 @@
     }
   },
   "ungoogled-chromium": {
-    "version": "156.0.8078.73",
+    "version": "156.0.8078.79",
     "deps": {
       "depot_tools": {
         "rev": "a07c06fe67a1a9d64ac4728df3a11c1ceb0cf73e",
@@ -875,16 +875,16 @@
         "hash": "sha256-hmbaR9MfMh5Wn9dARc+QeHmEdkG6WDtvT11IFD5vzJo="
       },
       "ungoogled-patches": {
-        "rev": "156.0.8078.73-1",
-        "hash": "sha256-hCXgamgbmCBJSfO94tgUSeQCq23Yvf2u4dhhgZkI41Y="
+        "rev": "156.0.8078.79-1",
+        "hash": "sha256-Kc3tInNYiORmFCJZMzGC9jypx7hoUjc8n9vJwb3qeoA="
       },
       "npmHash": "sha256-pF0JtwFpPC4/fodbhSJnQKkczA9WlDg4VqEAy9aDVLg="
     },
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "2f9a11097447f226133bc1a31c787291a5eeab98",
-        "hash": "sha256-thSoz/4ZXmx/R6E8d771aeTkumcsS1J9AmlA5aktmdw=",
+        "rev": "a21ce95c24ce3964416f09ae1862f53f319eb4d0",
+        "hash": "sha256-5KN7UQ76eSN6TxO6AWbpQTV5DPqHXxsUok3MTirhaxE=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {
@@ -994,8 +994,8 @@
       },
       "src/third_party/dawn": {
         "url": "https://dawn.googlesource.com/dawn.git",
-        "rev": "0caf3649477f7c3ffbd4b1ca4764a81b469b1582",
-        "hash": "sha256-tGTlSLvoPswtjxoUp+ZOUdxnFsselUp1JhTxNYbWYz4="
+        "rev": "8114a24a35eed1db88d1d897e8bd193a8c334712",
+        "hash": "sha256-dqhsoLcd9v5DEXxUll1c5/cNQMbk/EXhM5fR7T/ch3E="
       },
       "src/third_party/dawn/third_party/glfw3/src": {
         "url": "https://chromium.googlesource.com/external/github.com/glfw/glfw",
@@ -1489,8 +1489,8 @@
       },
       "src/third_party/pdfium": {
         "url": "https://pdfium.googlesource.com/pdfium.git",
-        "rev": "fa4d5f8fbd89ea07273529daf9fd24fe1c7f6b9a",
-        "hash": "sha256-dpAHjIkcg1fa0sgiopvNuEDgYrh4Z00sQu66nnFk+m0="
+        "rev": "c97f02a3519c99d5969514970fd8186318cdb2b0",
+        "hash": "sha256-DdoMSaiwAb+nyq1Wppyv24S1ooR2XBDl6ydfD4O0t/U="
       },
       "src/third_party/perfetto": {
         "url": "https://chromium.googlesource.com/external/github.com/google/perfetto.git",
@@ -1544,8 +1544,8 @@
       },
       "src/third_party/skia": {
         "url": "https://skia.googlesource.com/skia.git",
-        "rev": "a65b5cc03a5131808aec172085b7074fc66625b9",
-        "hash": "sha256-f7p89qrPgd3/OxxbIfR9TuUn4Zr8q+U1j2XOxRj1RVE="
+        "rev": "aa789d9bd566b9865add4070dc6777b3266c64e9",
+        "hash": "sha256-ynH8Q/2lx4HQTnQNXkaKFPpyiY3SNNiOtIr6TrUBWxA="
       },
       "src/third_party/smhasher/src": {
         "url": "https://chromium.googlesource.com/external/smhasher.git",
@@ -1714,8 +1714,8 @@
       },
       "src/v8": {
         "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "235050a0df6db2c9d92a419af2b72fbf3b2dd73b",
-        "hash": "sha256-84BgjMG6ZOFk4YBa6sKQ/4kqR7zjA2W8A3ZnD+k40Es="
+        "rev": "c9b3cfcab30ace06c21f9b48a0f0a34805e81e9d",
+        "hash": "sha256-3HhlZ6uCSq8T5a6N6TC7VkMBY3xkFoQUZbqpUUE4nro="
       },
       "src/agents/shared": {
         "url": "https://chromium.googlesource.com/chromium/agents.git",

pkgs/by-name/_8/_81voltd/package.nix

@@ -19,7 +19,7 @@ stdenv.mkDerivation (finalAttrs: {
   strictDeps = true;
 
   src = fetchFromGitLab {
-    domain = "gitlab.postmarketos.org";
+    domain = "gitlab.nura.eco";
     owner = "modem";
     repo = "81voltd";
     tag = "v${finalAttrs.version}";
@@ -43,7 +43,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Server-side implementation of the QMI IMS Data service";
-    homepage = "https://gitlab.postmarketos.org/modem/81voltd";
+    homepage = "https://gitlab.nura.eco/modem/81voltd";
     license = lib.licenses.gpl2Only;
     maintainers = with lib.maintainers; [ matthewcroughan ];
     mainProgram = "81voltd";

pkgs/by-name/af/afew/package.nix

@@ -25,6 +25,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     python3Packages.sphinxHook
   ];
 
+  sphinxRoot = "docs";
   sphinxBuilders = [
     "html"
     "man"
@@ -58,6 +59,12 @@ python3Packages.buildPythonApplication (finalAttrs: {
     "man"
   ];
 
+  # Workaround for upstream packaging paths, can be removed once #573479 is resolved
+  postInstall = ''
+    sphinx-build -b man docs docs/build/man
+    install -Dm644 docs/build/man/*.1 -t $man/share/man/man1/
+  '';
+
   meta = {
     homepage = "https://github.com/afewmail/afew";
     description = "Initial tagging script for notmuch mail";

pkgs/by-name/ai/aichat/package.nix

@@ -43,7 +43,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     description = "Use GPT-4(V), Gemini, LocalAI, Ollama and other LLMs in the terminal";
     homepage = "https://github.com/sigoden/aichat";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ mwdomino ];
+    maintainers = with lib.maintainers; [
+      mwdomino
+      VZstless
+    ];
     mainProgram = "aichat";
   };
 })

pkgs/by-name/ai/airtame/package.nix

@@ -71,11 +71,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "airtame-application";
-  version = "4.16.0";
+  version = "4.16.1";
 
   src = fetchurl {
     url = "https://downloads.airtame.com/app/latest/linux/Airtame-${finalAttrs.version}.deb";
-    hash = "sha256-wjWuPqXXonxbaobwl6dpYmUHA5W3+LXYskFJLUsjDf8=";
+    hash = "sha256-Kp0SUMuz8LX2/e4ZiOdKD6m5/Zk+Q6rziApm16QbG0E=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ap/api-linter/package.nix

@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "api-linter";
-  version = "2.4.0";
+  version = "2.4.1";
 
   src = fetchFromGitHub {
     owner = "googleapis";
     repo = "api-linter";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-r1OTgsLaEZPQd7P3E7BY0YYIr93Cmeo6gH4Z24LXP3Q=";
+    hash = "sha256-ov3CuG35j7BwgyaQ7Bh7btmpNdH0g/PPse2A8NtBL18=";
   };
 
-  vendorHash = "sha256-L1R0XvEn1pGy/EC/ivoUOGsyGrT5bRUkMLrGpI4VNyY=";
+  vendorHash = "sha256-NKhNc+2RxAhLplaJSgFinCBl+cPZbhGMdv4ZvNojD3o=";
 
   subPackages = [ "cmd/api-linter" ];
 

pkgs/by-name/ar/arity/package.nix

@@ -9,7 +9,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "arity";
-  version = "0.24.0";
+  version = "0.26.0";
 
   __structuredAttrs = true;
 
@@ -17,10 +17,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "jolars";
     repo = "arity";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-bAv3LWc5MlUv/qYwOhLqNSuZD9UCGw5r3qOkTZ4Ypfo=";
+    hash = "sha256-0hyt5/qvrqm8D+h5DfK4v98xYm9Ks47xd7AJHu/Jlrg=";
   };
 
-  cargoHash = "sha256-azzCBylXZlH+R7/ekuuxZVk7yO/nJ1n6+QLkc6U7nus=";
+  cargoHash = "sha256-CDU+2phtEKI098YfKVxUPAvN1/FxcW64ORlKbIEqSEo=";
 
   nativeBuildInputs = [
     installShellFiles

pkgs/by-name/as/async-profiler/package.nix

@@ -8,13 +8,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "async-profiler";
-  version = "4.5";
+  version = "4.6";
 
   src = fetchFromGitHub {
     owner = "async-profiler";
     repo = "async-profiler";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-H3NBWyCjyuQkQ7HZ+B8ycBGIvQWdQDkx2SpQr+0gL08=";
+    hash = "sha256-gD/VSX65RDs4dqTM0daKUYy7UbNX0DYrPz2N32Nf8Nc=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

pkgs/by-name/at/atuin/package.nix

@@ -19,16 +19,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "atuin";
-  version = "18.24.2";
+  version = "18.24.4";
 
   src = fetchFromGitHub {
     owner = "atuinsh";
     repo = "atuin";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-b6Uj3cPAu731lhrN8fOv4d0CpehT3bv7IOBmkbYrqfI=";
+    hash = "sha256-IyAR7TZqMrCuflkfs9Rgnfm5PrUDYVi0O8//WU8/KAI=";
   };
 
-  cargoHash = "sha256-HkYI2+Yvjnw9pKeRsteyZeLhHHErTa1mvJL16NQVF3g=";
+  cargoHash = "sha256-rwB3hdVygTRAxaSCIioFAjMWw9V5bkRUBXHyFrQ4MtI=";
 
   # atuin's default features include 'check-updates', which do not make sense
   # for distribution builds. List all other default features.
@@ -81,6 +81,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
     "--skip=multi_user_test"
     # needs a running Postgres server
     "--skip=postgres_authenticates_with_the_password_file"
+    "--skip=deleting_an_account_needs_its_password"
+    "--skip=operator_creates_resets_and_deletes_a_user"
     # timing-dependent: fails when the index reload is too fast to measure
     "--skip=end_history_is_not_starved_by_an_index_reload"
     # timing sensitive

pkgs/by-name/be/beekeeper-studio/package.nix

@@ -18,6 +18,7 @@
   cups,
   libdrm,
   gdk-pixbuf,
+  musl,
   nss,
   nspr,
   libxrandr,
@@ -40,7 +41,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "beekeeper-studio";
-  version = "6.1.4";
+  version = "6.2.0";
 
   src =
     let
@@ -54,9 +55,9 @@ stdenv.mkDerivation (finalAttrs: {
     fetchurl {
       url = "https://github.com/beekeeper-studio/beekeeper-studio/releases/download/v${finalAttrs.version}/${asset}";
       hash = selectSystem {
-        x86_64-linux = "sha256-8RWqYHAG2OkUPQjNwhSRfxsEbXjxsh0xA/EuUQxg/b4=";
-        aarch64-linux = "sha256-ivXtgZjlhoQ0hBIbdUx3VZJY/QUloh8War0OlN2gOfM=";
-        aarch64-darwin = "sha256-jPnGw4iDvfCMlim8ASAv5IdbpNsF6jaW2HsnqLvrCwY=";
+        x86_64-linux = "sha256-QoxEZBXhQEDHYWAlTMEAczMs17U6Wifvix5cyWOUdPY=";
+        aarch64-linux = "sha256-xUIycMYpiiG00m6cIV/L0AZRXWyMBJVzIk2xn+421VE=";
+        aarch64-darwin = "sha256-FyDkqAW9+A1mfDQSKqpxE76An7GladFrVnUU3POgBuA=";
       };
     };
 
@@ -90,6 +91,7 @@ stdenv.mkDerivation (finalAttrs: {
     cups
     libdrm
     gdk-pixbuf
+    musl
     nss
     nspr
     alsa-lib
@@ -159,8 +161,5 @@ stdenv.mkDerivation (finalAttrs: {
       "x86_64-linux"
       "aarch64-darwin"
     ];
-    knownVulnerabilities = [
-      "Uses Electron 39.8.10, which was EOL on March 13 2026, with several known CVEs"
-    ];
   };
 })

pkgs/by-name/bl/blackfire/package.nix

@@ -11,7 +11,7 @@
 
 stdenv.mkDerivation rec {
   pname = "blackfire";
-  version = "2026.10.0";
+  version = "2026.10.2";
 
   src =
     passthru.sources.${stdenv.hostPlatform.system}
@@ -60,19 +60,19 @@ stdenv.mkDerivation rec {
     sources = {
       "x86_64-linux" = fetchurl {
         url = "https://packages.blackfire.io/debian/pool/any/main/b/blackfire/blackfire_${version}_amd64.deb";
-        hash = "sha256-rcWSzQgQKeZAv7o16geuvVAmvVVsTq1vTjXWIEfiX4E=";
+        hash = "sha256-H65TuRMSYKDPylvS/feI4Jni1+/lkGvOQUtQZwzqd2s=";
       };
       "i686-linux" = fetchurl {
         url = "https://packages.blackfire.io/debian/pool/any/main/b/blackfire/blackfire_${version}_i386.deb";
-        hash = "sha256-ZhNtOZ6SCv7ibtebXJUuMYD8VzdfX09x7UAKLkOnwaM=";
+        hash = "sha256-AdctuLJ40RQlBxQ5thrY9vl5RPNrLnJH9spWXtnrIho=";
       };
       "aarch64-linux" = fetchurl {
         url = "https://packages.blackfire.io/debian/pool/any/main/b/blackfire/blackfire_${version}_arm64.deb";
-        hash = "sha256-VXHnmjN3W9M8wShHU4YkBv7DlWgOA/FXeOL4c3aEU1E=";
+        hash = "sha256-2v1LTSsJyHYeD28yju0sQsyFx1WxIA85oyPjSJsMKl8=";
       };
       "aarch64-darwin" = fetchurl {
         url = "https://packages.blackfire.io/blackfire/${version}/blackfire-darwin_arm64.pkg.tar.gz";
-        hash = "sha256-6/685RAzvEZNckIUG/iRoAZCRRODSoh9r/PzFB9WH2U=";
+        hash = "sha256-8XYmYKnE5AFf9l698kSEDhYTfFGyRoXVoaFBRl9BFgk=";
       };
     };
 

pkgs/by-name/bo/bootmac/package.nix

@@ -21,8 +21,8 @@ stdenv.mkDerivation (finalAttrs: {
   strictDeps = true;
 
   src = fetchFromGitLab {
-    domain = "gitlab.postmarketos.org";
-    owner = "postmarketOS";
+    domain = "gitlab.nura.eco";
+    owner = "nura";
     repo = "bootmac";
     rev = "v${finalAttrs.version}";
     hash = "sha256-GWvZUC8LKPpOWt1oCr93JHg5+W+0CCiYT63VhpSH1ko=";

pkgs/by-name/bu/buffybox/package.nix

@@ -19,8 +19,8 @@ stdenv.mkDerivation (finalAttrs: {
   version = "3.5.1";
 
   src = fetchFromGitLab {
-    domain = "gitlab.postmarketos.org";
-    owner = "postmarketOS";
+    domain = "gitlab.nura.eco";
+    owner = "nura";
     repo = "buffybox";
     fetchSubmodules = true; # to use its vendored lvgl
     tag = finalAttrs.version;
@@ -36,12 +36,12 @@ stdenv.mkDerivation (finalAttrs: {
       There's a close to zero chance that anyone with a 32-bit machine will be using BuffyBox.
       In the case that it happens, I expect no complaints whatsoever.
 
-      https://gitlab.postmarketos.org/postmarketOS/buffybox/-/merge_requests/87
+      https://gitlab.nura.eco/nura/buffybox/-/merge_requests/87
     */
 
     (fetchpatch {
       name = "fix-32-bit-build";
-      url = "https://gitlab.postmarketos.org/postmarketOS/buffybox/-/merge_requests/87.patch";
+      url = "https://gitlab.nura.eco/nura/buffybox/-/merge_requests/87.patch";
       hash = "sha256-GUk+YrG07hL+0w70qvymPzHGTmUXdfzG4Cy35gg/Asw=";
     })
   ];
@@ -72,8 +72,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Suite of graphical applications for the terminal";
-    homepage = "https://gitlab.postmarketos.org/postmarketOS/buffybox";
-    changelog = "https://gitlab.postmarketos.org/postmarketOS/buffybox/-/blob/main/CHANGELOG.md";
+    homepage = "https://gitlab.nura.eco/nura/buffybox";
+    changelog = "https://gitlab.nura.eco/nura/buffybox/-/blob/main/CHANGELOG.md";
     license = lib.licenses.gpl3Plus;
     maintainers = with lib.maintainers; [ colinsane ];
     platforms = lib.platforms.linux;

pkgs/by-name/ca/cashu-cdk/package.nix

@@ -0,0 +1,80 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  pkg-config,
+  protobuf,
+  openssl,
+  sqlite,
+  zlib,
+  cacert,
+  testers,
+  nix-update-script,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "cashu-cdk";
+  version = "0.18.3";
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "cashubtc";
+    repo = "cdk";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-TzMKmLZtuSnjL+tw/nEPMAIxIl3iGJT62fa0w9eG6Cw=";
+  };
+
+  cargoHash = "sha256-IkGOISP+/d3KMbZJJGmjn95yF8kHU5r+I3kNX0T1ppE=";
+
+  cargoBuildFlags = [
+    "--package=cdk-cli"
+    "--package=cdk-mintd"
+  ];
+  cargoTestFlags = finalAttrs.cargoBuildFlags;
+
+  nativeBuildInputs = [
+    pkg-config
+    protobuf
+  ];
+
+  buildInputs = [
+    openssl
+    sqlite
+    zlib
+  ];
+
+  nativeCheckInputs = [ cacert ];
+
+  env = {
+    LIBSQLITE3_SYS_USE_PKG_CONFIG = "1";
+    PROTOC = lib.getExe protobuf;
+    PROTOC_INCLUDE = "${protobuf}/include";
+  };
+
+  passthru = {
+    updateScript = nix-update-script { };
+    tests = {
+      cdk-cli = testers.testVersion {
+        package = finalAttrs.finalPackage;
+        command = "cdk-cli --version";
+      };
+      cdk-mintd = testers.testVersion {
+        package = finalAttrs.finalPackage;
+        command = "cdk-mintd --version";
+      };
+    };
+  };
+
+  meta = {
+    description = "Cashu wallet CLI and mint daemon";
+    homepage = "https://github.com/cashubtc/cdk";
+    changelog = "https://github.com/cashubtc/cdk/releases/tag/v${finalAttrs.version}";
+    license = with lib.licenses; [
+      asl20
+      mit
+    ];
+    maintainers = with lib.maintainers; [ prusnak ];
+    mainProgram = "cdk-cli";
+  };
+})

pkgs/by-name/ce/cedar/package.nix

@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cedar";
-  version = "4.13.0";
+  version = "4.14.0";
 
   src = fetchFromGitHub {
     owner = "cedar-policy";
     repo = "cedar";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-bZ2Ri8FVyg6gQAMJQ8BCaPKtvcZ54wNQiN7NqfHLYIs=";
+    hash = "sha256-Nt44iX6Oc/ZPQvAmFzP7jcHNurFa2hPGG4DdBU4n2Pg=";
   };
 
-  cargoHash = "sha256-54q+ERB9PNV68fPOh9v9nJtOKsVuI/Ld2knhYHYAeLA=";
+  cargoHash = "sha256-1gmLRfq/D1WYfswCKAPwUm60JZ/Zl32l3knKKvfqTNk=";
 
   cargoBuildFlags = [
     "--bin"

pkgs/by-name/cf/cfitsio/package.nix

@@ -2,6 +2,7 @@
   stdenv,
   lib,
   fetchFromGitHub,
+  fetchpatch,
   gitUpdater,
   cmake,
   bzip2,
@@ -20,6 +21,14 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-k05ylMYf+hsYur3BgNAweMeDc89rsBBtie+P7bd+7qg=";
   };
 
+  patches = [
+    # fix for CVE-2026-115504 can be removed with next release
+    (fetchpatch {
+      url = "https://github.com/heasarc/cfitsio/commit/113781d8aa442cf8d3c27295d9084674b8b039f2.patch";
+      hash = "sha256-Je+z9a0ySQ93vfgGSr/PuqtxY3qPsmuOwVwsTQ3nfyY=";
+    })
+  ];
+
   outputs = [
     "bin"
     "dev"

pkgs/by-name/ch/chess-tui/package.nix

@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "chess-tui";
-  version = "2.7.1";
+  version = "2.8.0";
 
   src = fetchFromGitHub {
     owner = "thomas-mauran";
     repo = "chess-tui";
     tag = finalAttrs.version;
-    hash = "sha256-B6CpUha5e2W82HnWOxV2arHAiqJCyL5bwkhELYQPxMg=";
+    hash = "sha256-KHFWg51m6duUGx4eo28OST5+s16WHI7y0Fbw++nOwVE=";
   };
 
-  cargoHash = "sha256-Vik4FceQSYnziDpAqz7r7gpabUp2JL5u40iT0r8fnAw=";
+  cargoHash = "sha256-xAOYxfk8SrTIKtc2l7sLINfOOg4P2vsrp2x0Fh7rqCg=";
 
   checkFlags = [
     # assertion failed: result.is_ok()

pkgs/by-name/cl/claude-code/manifest.zst.json

@@ -1,61 +1,60 @@
 {
-  "version": "2.1.312",
+  "version": "2.1.314",
   "manifestSignatureEnforcement": "flag",
-  "commit": "f375cd85d4f70920de17ce3a4ad646e18834e833",
-  "buildDate": "2026-10-27T17:17:45Z",
+  "commit": "5c99a5b6399766569a32979c715862fdb61c7efa",
+  "buildDate": "2026-10-29T23:01:46Z",
   "platforms": {
     "darwin-arm64": {
       "binary": "claude.zst",
-      "checksum": "7d759495d011057b6e8b8ee911c5be3cd36e9491c71a4ab194a425cdb1418073",
-      "size": 93329610,
+      "checksum": "a23ee5ca645a7e342f0960464c948baeb7c4218894ba25836da12c289ada56ca",
+      "size": 94571356,
       "bundle": {
-        "checksum": "1ff759dda10f393e0194f29a890c12798619bebbb471bf512ccae254eed6a186",
-        "size": 93329934
+        "checksum": "77aa04c73e1117a20a7d92ed72d911a189bd133b413f0bbc15d328d514310efe",
+        "size": 94578963
       }
     },
     "darwin-x64": {
       "binary": "claude.zst",
-      "checksum": "14e650c4383c00c23cdb2ff9e5b277d6248031adfbbaf1208876edb692b7dd3f",
-      "size": 98769361,
+      "checksum": "1ceb09cb91340b3b4de212c97b093ce39c9b05b92592402b7a6f180e968170ab",
+      "size": 100220791,
       "bundle": {
-        "checksum": "b2a050e9a9fc570ac0334cbad4dc7c46091b97a3a71bdeffdec83c91530aef84",
-        "size": 98760451
+        "checksum": "9ae05b0e79420e92d9358cae8487706e0c72ef26ca98113724a80c5f5f12f771",
+        "size": 100216724
       }
     },
     "linux-arm64": {
       "binary": "claude.zst",
-      "checksum": "863ee1d2a91a39ee22fa13322582e4c3fb45bfb4739b22ec7e396dde694d8581",
-      "size": 102731812
+      "checksum": "5ad42d08f44e02d56922ca82d88db6388e93564a8fc03fef02e4279b23204214",
+      "size": 105147380
     },
     "linux-x64": {
       "binary": "claude.zst",
-      "checksum": "6fb9e329947c003740be888f98db1aecaa238d6c7d9ceef8581eb71d5a59480b",
-      "size": 103703105
+      "checksum": "e8c6f963a5417a93eb19a8db70f4609c039d827426120971d2eff34e90c704b3",
+      "size": 107353846
     },
     "linux-arm64-musl": {
       "binary": "claude.zst",
-      "checksum": "5e8714a8944f6771325a8b2bd641bcdca7bcc632d60b4b965f8c716db989a6cc",
-      "size": 101059126
+      "checksum": "12dd7ef6e7e07bfe38f70d298931f85dfa1d763cca7389eb13b13f190bfa0ec3",
+      "size": 102121171
     },
     "linux-x64-musl": {
       "binary": "claude.zst",
-      "checksum": "122b51ddadc68c6afc8deb4d7bda82fcb5e1d49e5994c3eed750a5d6428ab6a4",
-      "size": 102078647
+      "checksum": "14238b2f775d6ae2f85ed6e958c603984fbb23119d670bec2963c48c6c779404",
+      "size": 103217626
     },
     "win32-x64": {
       "binary": "claude.exe.zst",
-      "checksum": "c5e376352bf2b0e56592358ba3b2943d3de7b351f750c2340f0675fe88148038",
-      "size": 106918151
+      "checksum": "dd9a764520cc9336dcd1580504b23de08f218a2a994dc04b39e9a38d922c81af",
+      "size": 108263820
     },
     "win32-arm64": {
       "binary": "claude.exe.zst",
-      "checksum": "dc3fd34fc9d523e6a94702e051998db52afd1d647132f61fd3daa246022ffcf9",
-      "size": 102110572
+      "checksum": "6ccba3912b025a5e7a848549785b1ef44885150faa599261bfb9217bb55bd203",
+      "size": 103400908
     }
   },
   "sdkCompat": {
     "testedWrapperVersions": [
-      "0.3.280",
       "0.3.281",
       "0.3.282",
       "0.3.283",

pkgs/by-name/cl/clion/version.json

@@ -1,18 +1,18 @@
 {
-  "version": "2026.2.0.1",
-  "buildNumber": "262.8665.321",
+  "version": "2026.2.4",
+  "buildNumber": "262.11879.74",
   "urls": {
     "x86_64-linux": {
-      "url": "https://download.jetbrains.com/cpp/CLion-2026.2.0.1.tar.gz",
-      "hash": "sha256-3/SNgt6bpr0aIQWmTJnvkgftdZE0M5wcE/LDS1Hk4R0="
+      "url": "https://download.jetbrains.com/cpp/CLion-2026.2.4.tar.gz",
+      "hash": "sha256-wdFCJFAUb7dJ8YwgGvJy7zSdy6eagZz09ycQ4jJPCUE="
     },
     "aarch64-linux": {
-      "url": "https://download.jetbrains.com/cpp/CLion-2026.2.0.1-aarch64.tar.gz",
-      "hash": "sha256-IG2U2v9mTk+GCbB9jJVoX5hKju37+DfqRiMtxu8b8bo="
+      "url": "https://download.jetbrains.com/cpp/CLion-2026.2.4-aarch64.tar.gz",
+      "hash": "sha256-vn99o3doOKNG6GsSVmEGQtvqa3p/yz1ZCk/d60atwks="
     },
     "aarch64-darwin": {
-      "url": "https://download.jetbrains.com/cpp/CLion-2026.2.0.1-aarch64.dmg",
-      "hash": "sha256-nkkJ80rc1bApEBMZT0ZjZQcnhkzAG3i1p9GhQUA4gT4="
+      "url": "https://download.jetbrains.com/cpp/CLion-2026.2.4-aarch64.dmg",
+      "hash": "sha256-wya4cZ6+3l69JIPGr0Yx4W1eG+4P1KyX0VaCyEzWWG8="
     }
   }
 }

pkgs/by-name/cl/cloudflare-speed-cli/package.nix

@@ -8,17 +8,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cloudflare-speed-cli";
-  version = "1.0.10";
+  version = "1.0.11";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "kavehtehrani";
     repo = "cloudflare-speed-cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-rIqHx6W4+vwgzyo5WMy6WZLeSzWlrWVgYWAP8uAaNt0=";
+    hash = "sha256-WQKEQEzdoZaxpxDrLQ9lCppUNQNL6EI1q5pr12AYW4o=";
   };
 
-  cargoHash = "sha256-s5pV1rctmnVTP2+POdh+TknRjoDzYPdwrxW6TG09YUA=";
+  cargoHash = "sha256-7gI5kmYVDSCl2SKSwrJRWF1N5Og1JpV9eUkqXkDogCw=";
 
   nativeInstallCheckInputs = [ versionCheckHook ];
   doInstallCheck = true;

pkgs/by-name/co/codex/package.nix

@@ -68,21 +68,21 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "codex";
-  version = "0.165.0";
+  version = "0.166.0";
 
   src = fetchFromGitHub {
     owner = "openai";
     repo = "codex";
     rev = finalAttrs.buildCommit;
-    hash = "sha256-b9PpwNQeZsJIN4wbGA3FLfWAKd2EDMN5E/zj/Y62/vk=";
+    hash = "sha256-4zxnVT9PxIj0+ULQ4LSA46GmvfyNTueZ+BsQ2SZwk1I=";
   };
 
   # Matching client/helper stamps; build_id() requires a full commit SHA.
-  buildCommit = "360319d8dee62d87e2d59fc0c21805d79519cfed";
+  buildCommit = "6ff1e1ca3b30fc8b914720681fcf5fe62e95f856";
 
   sourceRoot = "${finalAttrs.src.name}/codex-rs";
 
-  cargoHash = "sha256-KKC/uHE2RWq0U7FmXA+TKTlFf/d8vYe6/G8gl78bW+g=";
+  cargoHash = "sha256-3CHn33C1SSX+W0juZik3r8CVoYGoyNlk5mDICwVEcbY=";
   # Disable bundled Opus so OPUS_LIB_DIR selects nixpkgs' libopus.
   cargoDeps =
     (rustPlatform.fetchCargoVendor {

pkgs/by-name/co/codipack/package.nix

@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "codipack";
-  version = "3.1.2";
+  version = "3.1.3";
 
   src = fetchFromGitHub {
     owner = "SciCompKL";
     repo = "CoDiPack";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Kkr+bCusS3zfcFspWByjg1fgyHNQlDJZw4+8yDs1tXk=";
+    hash = "sha256-YOQQZG5HSNi+DlRXGL4EPLotp0FhN4qCesGmF8PwTCA=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/de/debcraft/package.nix

@@ -6,14 +6,14 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "debcraft";
-  version = "0.9.5";
+  version = "1.0.0";
 
   src = fetchFromGitLab {
     domain = "salsa.debian.org";
     owner = "debian";
     repo = "debcraft";
     tag = "debian/${finalAttrs.version}";
-    hash = "sha256-wuJ9khkVSnXoGkpxp+DaYCu/s+ciXG8afm7zluL/shA=";
+    hash = "sha256-msb7kxyLsskGLq9bQbeye+KpVdCGfARz2kDyrf43t6A=";
   };
 
   strictDeps = true;

pkgs/by-name/de/deepfilternet/package.nix

@@ -3,6 +3,7 @@
   stdenv,
   fetchFromGitHub,
   rustPlatform,
+  rust-jemalloc-sys,
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
@@ -27,6 +28,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   buildAndTestSubdir = "ladspa";
 
+  buildInputs = [
+    rust-jemalloc-sys
+  ];
+
   postInstall = ''
     mkdir $out/lib/ladspa
     mv $out/lib/libdeep_filter_ladspa${stdenv.hostPlatform.extensions.sharedLibrary} $out/lib/ladspa/

pkgs/by-name/de/depthcharge-tools/package.nix

@@ -17,8 +17,8 @@ python3Packages.buildPythonApplication (finalAttrs: {
   pname = "depthcharge-tools";
   version = "0.7.1";
   src = fetchFromGitLab {
-    domain = "gitlab.postmarketos.org";
-    owner = "postmarketOS";
+    domain = "gitlab.nura.eco";
+    owner = "nura";
     repo = "depthcharge-tools";
     tag = "v${finalAttrs.version}";
     hash = "sha256-kwtl/hUZ57quVQRSHLWHCzSuUmhH/uOfoGkcvqvF8rQ=";
@@ -58,7 +58,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
 
   meta = {
     description = "Tools to manage the Chrome OS bootloader";
-    homepage = "https://gitlab.postmarketos.org/postmarketOS/depthcharge-tools";
+    homepage = "https://gitlab.nura.eco/nura/depthcharge-tools";
     license = lib.licenses.gpl2Plus;
     platforms = lib.platforms.linux;
     maintainers = [ lib.maintainers.ninelore ];

pkgs/by-name/de/deskflow/package.nix

@@ -113,6 +113,8 @@ stdenv.mkDerivation (finalAttrs: {
   strictDeps = true;
 
   doCheck = true;
+  # LoggerTests and ComputerTests share tmp/test/Deskflow.conf: https://github.com/deskflow/deskflow/issues/10352
+  enableParallelChecking = false;
 
   nativeCheckInputs = [ writableTmpDirAsHomeHook ];
 

pkgs/by-name/di/difftastic/package.nix

@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "difftastic";
-  version = "0.71.0";
+  version = "0.72.0";
 
   src = fetchFromGitHub {
     owner = "wilfred";
     repo = "difftastic";
     tag = finalAttrs.version;
-    hash = "sha256-xJdR/t6O8PavCKBiKnueiLR01g7nWGUHp9bcjOuDDA8=";
+    hash = "sha256-3soIU2TmHlUDVznmDm77iK+io8QZnhQ9/BkH71x89io=";
   };
 
-  cargoHash = "sha256-HEX8njuArbgMQI8yDr66siRB8t+4P2Q7rxHuCeaD9Uw=";
+  cargoHash = "sha256-KRgJ+9Sjm3elkXS+lkW6NeKyymp/3crpsuBNEQKnkvY=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/di/diffyml/package.nix

@@ -8,7 +8,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "diffyml";
-  version = "1.8.2";
+  version = "1.8.3";
 
   __structuredAttrs = true;
 
@@ -18,7 +18,7 @@ buildGoModule (finalAttrs: {
     owner = "szhekpisov";
     repo = "diffyml";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ddPpq615/oRE//6CJ1C4UcXgWnfbeEd6aJcEDiPpvoU=";
+    hash = "sha256-sIZujFk6SH+4e5iBmQkEy8gmaN9LCSU6mnrkB6FHqYo=";
   };
 
   vendorHash = "sha256-vjGhS7nhjXlms1ZsRG6Qy/7ategUIgwiBwk943cz9Lk=";

pkgs/by-name/do/dotagents/package.nix

@@ -14,13 +14,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "dotagents";
-  version = "3.3.0";
+  version = "3.4.0";
 
   src = fetchFromGitHub {
     owner = "getsentry";
     repo = "dotagents";
     tag = finalAttrs.version;
-    hash = "sha256-EnVCH0tKCUEcKu+CvkOgc3y9QM0k3rPeJbJ6qcfXVhI=";
+    hash = "sha256-WJI6DMJarhlg1SdEGrxnuqV5YXUUvGtOnqRT6j9hSwE=";
   };
 
   strictDeps = true;
@@ -36,7 +36,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
       ;
     pnpm = pnpm_10;
     fetcherVersion = 4;
-    hash = "sha256-eDumJk2N7z5tvfvAkOWFUr1zZhaBQbA+yGtBf3OEKXg=";
+    hash = "sha256-/74jSkTm965aKcZ/p25Bs26KaJmZCSZAUQ43dFYWZmg=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/e5/e57inspector/package.nix

@@ -33,6 +33,13 @@ stdenv.mkDerivation (finalAttrs: {
       url = "https://github.com/nh2/e57inspector/commit/a5a899ee58952ffc2971d18b3734ea405e0020f3.patch";
       hash = "sha256-QRUv0CvX+OdH88CzI/6XjPXnAVIsf6N/Ix/qqCsSaRw=";
     })
+    # support newer gcc
+    # Remove with next release (see https://github.com/sisakat/e57inspector/pull/9)
+    (fetchpatch {
+      name = "e57inspector-support-gcc-15.patch";
+      url = "https://github.com/sisakat/e57inspector/commit/87a13fa08cd07bb91f2ee1e224f5bd4c58b27d04.patch";
+      hash = "sha256-ITGMt0ATnsIdh02DUkQXGA1XkxLtubjJTegK72ADFrE=";
+    })
   ];
 
   postPatch = ''

pkgs/by-name/es/espflash/package.nix

@@ -11,13 +11,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "espflash";
-  version = "4.6.0";
+  version = "4.7.0";
 
   src = fetchFromGitHub {
     owner = "esp-rs";
     repo = "espflash";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-qAIpco5UOH5DT/OkaEXZNBEErPbPt8hTtudDLXvhNEU=";
+    hash = "sha256-xGFsrmAK1NXMsYf+oSk6OLYFKcCUQd1CtvFCJrgGk8Q=";
   };
 
   nativeBuildInputs = [
@@ -30,7 +30,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   buildInputs = [ openssl ];
 
-  cargoHash = "sha256-1fyNa1/4Abf1gRizQWgleAywCqU38uAqGJYs3CDt21k=";
+  cargoHash = "sha256-ArwTVqUEOIztbohfTcrRm1y+4HrZFbe9jMYETRGSSjQ=";
 
   cargoBuildFlags = [
     "--exclude=xtask"

pkgs/by-name/es/esphome-device-builder/frontend.nix

@@ -14,7 +14,7 @@ let
 in
 buildPythonPackage (finalAttrs: {
   pname = "esphome-device-builder-frontend";
-  version = "0.1.371";
+  version = "0.1.373";
   pyproject = true;
 
   __structuredAttrs = true;
@@ -23,14 +23,14 @@ buildPythonPackage (finalAttrs: {
     owner = "esphome";
     repo = "device-builder-frontend";
     tag = finalAttrs.version;
-    hash = "sha256-0aZzvlkv8x+MBMJsvJ2uztFJSaq29qgE16d0M3s7igU=";
+    hash = "sha256-vroab1H3RsznC6CLf3DirOa6kufp3gBwNVW0FoR8vH4=";
   };
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname src;
     inherit pnpm;
     fetcherVersion = 4;
-    hash = "sha256-YuPZWBtDBoJ/Ha/A70zXsJoXUXh+IxIxMo6w1DT5fwQ=";
+    hash = "sha256-3hLkPDFCxG55AuixG5AQhDJyyBEWPhBmNF1HdNo8Lfk=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/es/esphome-device-builder/package.nix

@@ -34,14 +34,14 @@ let
 in
 pythonPackages.buildPythonApplication (finalAttrs: {
   pname = "esphome-device-builder";
-  version = "1.24.0";
+  version = "1.26.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "esphome";
     repo = "device-builder";
     tag = finalAttrs.version;
-    hash = "sha256-cXnEx3HNvTEsSz2Gz/W5gswmvQ3bxHMPGq0Y4MwIHjM=";
+    hash = "sha256-S1y0IXrCQV/EK9gQ7UdSKfdKJZK6UY6q7NdFEcy7yao=";
   };
 
   __structuredAttrs = true;

pkgs/by-name/ev/evtx/package.nix

@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "evtx";
-  version = "0.13.0";
+  version = "0.14.0";
 
   src = fetchFromGitHub {
     owner = "omerbenamram";
     repo = "evtx";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-sTTQb7Xa88gAFflPA0gD73CsaQne0gj0WwvRYwaYjjc=";
+    hash = "sha256-DBFt0nvbM8IK4TgveVBq5E38iO1GqtoLnZuP4GvqX9U=";
   };
 
-  cargoHash = "sha256-iELRXFvN/EkzoHGq6F/n85CVLD0vnZ0ideSyc572Y4U=";
+  cargoHash = "sha256-mOrgicTOwia1gZcz4vvtoIak0tqZAD8zWKoX85FazWU=";
 
   postPatch = ''
     # CLI tests will fail in the sandbox

pkgs/by-name/ex/example-robot-data/package.nix

@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "example-robot-data";
-  version = "5.0.0";
+  version = "6.0.0";
 
   src = fetchFromGitHub {
     owner = "Gepetto";
     repo = "example-robot-data";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-oQk6mJ1lOTcWrTWLViVQWk+R6DdcnLSigxKuXgpLhs0=";
+    hash = "sha256-6YVq++dOuyphEGrK/Oi+EIY7imTAw56b3pJCvyrRK8E=";
   };
 
   outputs = [

pkgs/by-name/ex/expresslrs-configurator/package.nix

@@ -12,7 +12,7 @@
 
 let
   pname = "expresslrs-configurator";
-  version = "1.8.3";
+  version = "1.8.4";
   installPath = "share/${pname}";
   resourcesPath = "${installPath}/resources";
 in
@@ -22,7 +22,7 @@ stdenv.mkDerivation {
   src = fetchzip {
     url = "https://github.com/ExpressLRS/ExpressLRS-Configurator/releases/download/v${version}/${pname}-${version}.zip";
     stripRoot = false;
-    hash = "sha256-KoT9YoeAkYrr9FIS7+Lm1CafTNwvV+jLTYYHziCVvrs=";
+    hash = "sha256-aP706aSHVdZlk+9tcIKrtmalQxDbobh4UFLXD3ItrEI=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/fi/firefox-mobile/package.nix

@@ -7,8 +7,8 @@
 
 let
   pkg = fetchFromGitLab {
-    domain = "gitlab.postmarketos.org";
-    owner = "postmarketOS";
+    domain = "gitlab.nura.eco";
+    owner = "nura";
     repo = "mobile-config-firefox";
     rev = "5.5.1";
     hash = "sha256-kIMeVKUI8/MdCJIkBlcYYEUnN7+ciDpKuReAeKkn8VY=";

pkgs/by-name/fo/folly/package.nix

@@ -8,6 +8,7 @@
   cmake,
   ninja,
   pkg-config,
+  buildPackages,
 
   double-conversion,
   fast-float,
@@ -106,7 +107,14 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.cmakeFeature "LIB_INSTALL_DIR" "${placeholder "out"}/lib")
     (lib.cmakeFeature "CMAKE_INSTALL_DIR" "${placeholder "dev"}/lib/cmake/folly")
     (lib.cmakeFeature "CMAKE_INSTALL_PREFIX" (placeholder "dev"))
-  ];
+  ]
+  ++
+    lib.optionals
+      (
+        !stdenv.buildPlatform.canExecute stdenv.hostPlatform
+        && stdenv.hostPlatform.emulatorAvailable buildPackages
+      )
+      [ (lib.cmakeFeature "CMAKE_CROSSCOMPILING_EMULATOR" (stdenv.hostPlatform.emulator buildPackages)) ];
 
   env.NIX_CFLAGS_COMPILE = lib.concatStringsSep " " (
     [

pkgs/by-name/fs/fstar/package.nix

@@ -6,6 +6,7 @@
   makeWrapper,
   nix-update-script,
   ocaml-ng,
+  python3,
   removeReferencesTo,
   util-linux,
   which,
@@ -16,16 +17,23 @@ let
   ocamlPackages = ocaml-ng.ocamlPackages_5_4;
 
   fstarZ3 = callPackage ./z3 { };
+
+  karamelSrc = fetchFromGitHub {
+    owner = "FStarLang";
+    repo = "karamel";
+    rev = "98ffca53b25c8ac50f303dae87c083de65cc1db8";
+    hash = "sha256-SINvlVvn3b0EsHQ92DEqzAiWL307C9RlglvtgysRt2Q=";
+  };
 in
 ocamlPackages.buildDunePackage (finalAttrs: {
   pname = "fstar";
-  version = "2026.03.24";
+  version = "2026.10.25";
 
   src = fetchFromGitHub {
     owner = "FStarLang";
     repo = "FStar";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-b+LQ6X1yHUdBlQp+bA9KbRu6vhB3CwipN7pAxWxR2Nk=";
+    hash = "sha256-AT7CVTGaosh7fdVpB0jgBeaHzz8z+MVi23rOYdltu7o=";
   };
 
   nativeBuildInputs = [
@@ -34,10 +42,14 @@ ocamlPackages.buildDunePackage (finalAttrs: {
     util-linux
     installShellFiles
     makeWrapper
+    python3
     removeReferencesTo
   ];
 
   prePatch = ''
+    cp -r ${karamelSrc}/. karamel
+    chmod -R u+w karamel
+    patchShebangs karamel
     patchShebangs .scripts/*.sh
     patchShebangs ulib/ml/app/ints/mk_int_file.sh
   '';
@@ -48,6 +60,9 @@ ocamlPackages.buildDunePackage (finalAttrs: {
 
   propagatedBuildInputs = with ocamlPackages; [
     batteries
+    ctypes
+    fix
+    num
     menhirLib
     pprint
     ppx_deriving
@@ -56,6 +71,9 @@ ocamlPackages.buildDunePackage (finalAttrs: {
     process
     sedlex
     stdint
+    uucp
+    visitors
+    wasm
     yojson
     zarith
     mtime
@@ -84,6 +102,7 @@ ocamlPackages.buildDunePackage (finalAttrs: {
     ln -s -t $OCAMLFIND_DESTDIR/ $out/lib/fstar
 
     remove-references-to -t '${ocamlPackages.ocaml}' $out/bin/fstar.exe
+    remove-references-to -t '${ocamlPackages.ocaml}' $out/bin/krml
 
     for binary in $out/bin/*; do
       wrapProgram "$binary" --prefix PATH : "${lib.makeBinPath [ fstarZ3 ]}"
@@ -99,6 +118,8 @@ ocamlPackages.buildDunePackage (finalAttrs: {
     runHook postInstall
   '';
 
+  env.GIT_REV = karamelSrc.rev;
+
   enableParallelBuilding = true;
 
   passthru = {

pkgs/by-name/fs/fstar/z3/4-8-5-typos.diff

@@ -1,26 +0,0 @@
-diff --git a/src/util/lp/lp_core_solver_base.h b/src/util/lp/lp_core_solver_base.h
-index 4c17df2..4c3c311 100644
---- a/src/util/lp/lp_core_solver_base.h
-+++ b/src/util/lp/lp_core_solver_base.h
-@@ -600,8 +600,6 @@ public:
-            out << " \n";
-     }
- 
--    bool column_is_free(unsigned j) const { return this->m_column_type[j] == free; }
--
-     bool column_has_upper_bound(unsigned j) const {
-         switch(m_column_types[j]) {
-         case column_type::free_column:
-diff --git a/src/util/lp/static_matrix_def.h b/src/util/lp/static_matrix_def.h
-index 7949573..2f1cb42 100644
---- a/src/util/lp/static_matrix_def.h
-+++ b/src/util/lp/static_matrix_def.h
-@@ -86,7 +86,7 @@ static_matrix<T, X>::static_matrix(static_matrix const &A, unsigned * /* basis *
-     init_row_columns(m, m);
-     while (m--) {
-         for (auto & col : A.m_columns[m]){
--            set(col.var(), m, A.get_value_of_column_cell(col));
-+            set(col.var(), m, A.get_column_cell(col));
-         }
-     }
- }

pkgs/by-name/fs/fstar/z3/4.13.3.patch

@@ -1,5 +1,3 @@
-diff --git a/z3.pc.cmake.in b/z3.pc.cmake.in
-index 436dd6208..dd1e179c7 100644
 --- a/z3.pc.cmake.in
 +++ b/z3.pc.cmake.in
 @@ -1,13 +1,10 @@

pkgs/by-name/fs/fstar/z3/4.15.3.patch

@@ -0,0 +1,19 @@
+--- a/z3.pc.cmake.in
++++ b/z3.pc.cmake.in
+@@ -1,13 +1,10 @@
+-prefix=@CMAKE_INSTALL_PREFIX@
+-exec_prefix=@CMAKE_INSTALL_PREFIX@
+-libdir=${exec_prefix}/@CMAKE_INSTALL_LIBDIR@
+-sharedlibdir=${exec_prefix}/@CMAKE_INSTALL_LIBDIR@
+-includedir=${prefix}/@CMAKE_INSTALL_INCLUDEDIR@
++libdir=@CMAKE_INSTALL_FULL_LIBDIR@
++includedir=@CMAKE_INSTALL_FULL_INCLUDEDIR@
+ 
+ Name: z3
+ Description: The Z3 Theorem Prover
+ Version: @Z3_VERSION@
+ 
+ Requires:
+-Libs: -L${libdir} -L${sharedlibdir} -lz3
++Libs: -L${libdir} -lz3
+ Cflags: -I${includedir}

pkgs/by-name/fs/fstar/z3/4.8.5.patch

@@ -0,0 +1,59 @@
+Build Z3 4.8.5 with current C++ compilers.
+
+The static_matrix.h change is backported from:
+https://github.com/Z3Prover/z3/commit/2ce89e5f491fa817d02d8fdce8c62798beab258b
+
+--- a/src/util/lp/static_matrix.h
++++ b/src/util/lp/static_matrix.h
+@@ -79,7 +79,7 @@
+         ref(static_matrix & m, unsigned row, unsigned col):m_matrix(m), m_row(row), m_col(col) {}
+         ref & operator=(T const & v) { m_matrix.set( m_row, m_col, v); return *this; }
+ 
+-        ref operator=(ref & v) { m_matrix.set(m_row, m_col, v.m_matrix.get(v.m_row, v.m_col)); return *this; }
++        ref operator=(ref & v) { m_matrix.set(m_row, m_col, v.m_matrix.get_elem(v.m_row, v.m_col)); return *this; }
+ 
+         operator T () const { return m_matrix.get_elem(m_row, m_col); }
+     };
+--- a/src/util/lp/column_info.h
++++ b/src/util/lp/column_info.h
+@@ -47,7 +47,7 @@ public:
+             m_lower_bound_is_strict == c.m_lower_bound_is_strict &&
+             m_upper_bound_is_set == c.m_upper_bound_is_set&&
+             m_upper_bound_is_strict == c.m_upper_bound_is_strict&&
+-            (!m_lower_bound_is_set || m_lower_bound == c.m_low_bound) &&
++            (!m_lower_bound_is_set || m_lower_bound == c.m_lower_bound) &&
+             (!m_upper_bound_is_set || m_upper_bound == c.m_upper_bound) &&
+             m_cost == c.m_cost &&
+             m_is_fixed == c.m_is_fixed &&
+--- a/src/util/lp/tail_matrix.h
++++ b/src/util/lp/tail_matrix.h
+@@ -43,7 +43,6 @@ public:
+         const tail_matrix & m_A;
+         unsigned m_row;
+         ref_row(const tail_matrix& m, unsigned row): m_A(m), m_row(row) {}
+-        T operator[](unsigned j) const { return m_A.get_elem(m_row, j);}
+     };
+     ref_row operator[](unsigned i) const { return ref_row(*this, i);}
+ };
+--- a/src/util/lp/lp_core_solver_base.h
++++ b/src/util/lp/lp_core_solver_base.h
+@@ -600,8 +600,6 @@ public:
+            out << " \n";
+     }
+ 
+-    bool column_is_free(unsigned j) const { return this->m_column_type[j] == free; }
+-
+     bool column_has_upper_bound(unsigned j) const {
+         switch(m_column_types[j]) {
+         case column_type::free_column:
+--- a/src/util/lp/static_matrix_def.h
++++ b/src/util/lp/static_matrix_def.h
+@@ -86,7 +86,7 @@ static_matrix<T, X>::static_matrix(static_matrix const &A, unsigned * /* basis *
+     init_row_columns(m, m);
+     while (m--) {
+         for (auto & col : A.m_columns[m]){
+-            set(col.var(), m, A.get_value_of_column_cell(col));
++            set(col.var(), m, A.get_column_cell(col));
+         }
+     }
+ }

pkgs/by-name/fs/fstar/z3/5.3.0.patch

@@ -0,0 +1,12 @@
+--- a/z3.pc.cmake.in
++++ b/z3.pc.cmake.in
+@@ -1,7 +1,7 @@
+ prefix=${pcfiledir}/@Z3_PKGCONFIG_PREFIX@
+ exec_prefix=${prefix}
+-libdir=${exec_prefix}/@CMAKE_INSTALL_LIBDIR@
+-includedir=${prefix}/@CMAKE_INSTALL_INCLUDEDIR@
++libdir=@CMAKE_INSTALL_FULL_LIBDIR@
++includedir=@CMAKE_INSTALL_FULL_INCLUDEDIR@
+ 
+ Name: z3
+ Description: The Z3 Theorem Prover

pkgs/by-name/fs/fstar/z3/default.nix

@@ -1,118 +1,70 @@
 {
   fetchFromGitHub,
-  fetchpatch,
   lib,
-  replaceVars,
   stdenvNoCC,
   z3,
 }:
 
 let
-  z3' = z3.override { useCmakeBuild = false; };
+  z3' = z3.override { pythonBindings = false; };
 
-  # fstar has a pretty hard dependency on certain z3 patch versions.
-  # https://github.com/FStarLang/FStar/issues/3689#issuecomment-2625073641
-  # We need to package all the Z3 versions it prefers here.
-  fstarNewZ3Version = "4.13.3";
-  fstarNewZ3 =
-    if z3'.version == fstarNewZ3Version then
-      z3'
-    else
-      z3'.overrideAttrs (final: rec {
-        version = fstarNewZ3Version;
-        src = fetchFromGitHub {
-          owner = "Z3Prover";
-          repo = "z3";
-          rev = "z3-${version}";
-          hash = "sha256-odwalnF00SI+sJGHdIIv4KapFcfVVKiQ22HFhXYtSvA=";
-        };
-      });
+  mkZ3 =
+    version: hash:
+    z3'.overrideAttrs {
+      inherit version;
+      patches = [ (./. + "/${version}.patch") ];
+      postPatch = "";
+      src = fetchFromGitHub {
+        owner = "Z3Prover";
+        repo = "z3";
+        rev = "z3-${version}";
+        inherit hash;
+      };
+    };
 
-  fstarOldZ3Version = "4.8.5";
-  fstarOldZ3 =
-    if z3'.version == fstarOldZ3Version then
-      z3'
-    else
-      z3'.overrideAttrs (prev: rec {
-        version = fstarOldZ3Version;
-        src = fetchFromGitHub {
-          owner = "Z3Prover";
-          repo = "z3";
-          rev = "Z3-${version}"; # caps matter
-          hash = "sha256-ytG5O9HczbIVJAiIGZfUXC/MuYH7d7yLApaeTRlKXoc=";
-        };
-        patches =
-          let
-            static-matrix-patch = fetchpatch {
-              # clang / gcc fixes. fixes typos in some member names
-              name = "gcc-15-fixes.patch";
-              url = "https://github.com/Z3Prover/z3/commit/2ce89e5f491fa817d02d8fdce8c62798beab258b.patch";
-              includes = [ "src/@dir@/lp/static_matrix.h" ];
-              stripLen = 3;
-              extraPrefix = "src/@dir@/";
-              hash = "sha256-+H1/VJPyI0yq4M/61ay8SRCa6OaoJ/5i+I3zVTAPUVo=";
-            };
+  withLegacyFixes =
+    solver:
+    solver.overrideAttrs (prev: {
+      # Older releases use an uppercase Z3 tag prefix.
+      src = prev.src.override { rev = "Z3-${prev.version}"; };
 
-            # replace @dir@ in the path of the given list of patches
-            fixupPatches = dir: map (patch: replaceVars patch { dir = dir; });
-          in
-          prev.patches or [ ]
-          ++ fixupPatches "util" [
-            ./lower-bound-typo.diff
-            static-matrix-patch
-            ./tail-matrix.diff
-          ]
-          ++ [
-            ./4-8-5-typos.diff
-            (fetchpatch {
-              url = "https://github.com/Z3Prover/z3/commit/40183d7b73fcc4020b4d4b2e658b24a8c4b648ee.patch";
-              hash = "sha256-+VpPYUBVAVB9BQIp+phmL6IAEc0RC+YoUVCIsIe5TSQ=";
-            })
-            (fetchpatch {
-              url = "https://github.com/Z3Prover/z3/commit/03ae6d86cb4db88c71d6b245e29400e9a44cb59f.patch";
-              hash = "sha256-nNjkQpaSCyAqnPEZcRtG+cMTPeA+CQfvmNUe5fAK93Q=";
-            })
-            (fetchpatch {
-              url = "https://github.com/Z3Prover/z3/commit/f6c9ead10c0cf904925d7495f5c08dae66643b7a.patch";
-              hash = "sha256-eUeFayyfdg9Q8s97H6khBXst9nLYWM7NSEoQ2btMHEE=";
-            })
-          ];
+      cmakeFlags = map (lib.replaceStrings [ "-DZ3_" ] [ "-D" ]) prev.cmakeFlags ++ [
+        (lib.cmakeFeature "CMAKE_POLICY_VERSION_MINIMUM" "3.5")
+      ];
 
-        postPatch =
-          let
-            python = lib.findFirst (pkg: lib.hasPrefix "python" pkg.pname) null prev.nativeBuildInputs;
-          in
+      # The API generator imports distutils even without Python bindings.
+      postPatch = (prev.postPatch or "") + ''
+        substituteInPlace scripts/mk_util.py \
+          --replace-fail "distutils.sysconfig.get_python_lib()" "sysconfig.get_path('purelib')" \
+          --replace-fail "distutils.sysconfig" "sysconfig"
+      '';
 
-          assert python != null;
+      meta = prev.meta // {
+        pkgConfigModules = [ ];
+      };
+    });
 
-          prev.postPatch or ""
-          +
-            lib.optionalString
-              ((lib.versionAtLeast python.version "3.12") && (lib.versionOlder version "4.8.14"))
-              ''
-                # See https://github.com/Z3Prover/z3/pull/5729. This is a specialization of this patch for 4.8.5.
-                for file in scripts/mk_util.py src/api/python/CMakeLists.txt; do
-                  substituteInPlace "$file" \
-                    --replace-fail "distutils.sysconfig.get_python_lib()" "sysconfig.get_path('purelib')" \
-                    --replace-fail "distutils.sysconfig" "sysconfig"
-                done
-              '';
-
-      });
+  # Keep the exact versions distributed with this F* release.
+  # https://github.com/NixOS/nixpkgs/pull/374917#issuecomment-2661497006
+  solvers = {
+    z3_4_8_5 = withLegacyFixes (mkZ3 "4.8.5" "sha256-ytG5O9HczbIVJAiIGZfUXC/MuYH7d7yLApaeTRlKXoc=");
+    z3_4_13_3 = mkZ3 "4.13.3" "sha256-odwalnF00SI+sJGHdIIv4KapFcfVVKiQ22HFhXYtSvA=";
+    z3_4_15_3 = mkZ3 "4.15.3" "sha256-Lw037Z0t0ySxkgMXkbjNW5CB4QQLRrrSEBsLJqiomZ4=";
+    z3_5_3_0 = mkZ3 "5.3.0" "sha256-K0KTI8ZpvvYCF9ITxVTbdtqlalFFjtYcyog/Sy1kRV8=";
+  };
 in
 stdenvNoCC.mkDerivation {
   name = "fstar-z3";
   dontUnpack = true;
 
   installPhase = ''
+    runHook preInstall
     mkdir -p $out/bin
-    ln -s ${lib.getExe fstarNewZ3} $out/bin/z3-${lib.escapeShellArg fstarNewZ3.version}
-    ln -s ${lib.getExe fstarOldZ3} $out/bin/z3-${lib.escapeShellArg fstarOldZ3.version}
+    ${lib.concatMapStringsSep "\n" (solver: ''
+      ln -s ${lib.getExe solver} $out/bin/z3-${solver.version}
+    '') (builtins.attrValues solvers)}
+    runHook postInstall
   '';
 
-  passthru = {
-    "z3_${lib.replaceStrings [ "." ] [ "_" ] fstarNewZ3.version}" = fstarNewZ3;
-
-    "z3_${lib.replaceStrings [ "." ] [ "_" ] fstarOldZ3.version}" = fstarOldZ3;
-  };
+  passthru = solvers;
 }

pkgs/by-name/fs/fstar/z3/lower-bound-typo.diff

@@ -1,13 +0,0 @@
-diff --git a/src/@dir@/lp/column_info.h b/src/@dir@/lp/column_info.h
-index 1dc0c60..9cbeea6 100644
---- a/src/@dir@/lp/column_info.h
-+++ b/src/@dir@/lp/column_info.h
-@@ -47,7 +47,7 @@ public:
-             m_lower_bound_is_strict == c.m_lower_bound_is_strict &&
-             m_upper_bound_is_set == c.m_upper_bound_is_set&&
-             m_upper_bound_is_strict == c.m_upper_bound_is_strict&&
--            (!m_lower_bound_is_set || m_lower_bound == c.m_low_bound) &&
-+            (!m_lower_bound_is_set || m_lower_bound == c.m_lower_bound) &&
-             (!m_upper_bound_is_set || m_upper_bound == c.m_upper_bound) &&
-             m_cost == c.m_cost &&
-             m_is_fixed == c.m_is_fixed &&

pkgs/by-name/fs/fstar/z3/tail-matrix.diff

@@ -1,12 +0,0 @@
-diff --git a/src/@dir@/lp/tail_matrix.h b/src/@dir@/lp/tail_matrix.h
-index 2047e8c..c84340e 100644
---- a/src/@dir@/lp/tail_matrix.h
-+++ b/src/@dir@/lp/tail_matrix.h
-@@ -43,7 +43,6 @@ public:
-         const tail_matrix & m_A;
-         unsigned m_row;
-         ref_row(const tail_matrix& m, unsigned row): m_A(m), m_row(row) {}
--        T operator[](unsigned j) const { return m_A.get_elem(m_row, j);}
-     };
-     ref_row operator[](unsigned i) const { return ref_row(*this, i);}
- };

pkgs/by-name/gi/gilt-rs/package.nix

@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "gilt-rs";
-  version = "0.3.7";
+  version = "0.4.0";
 
   src = fetchFromGitHub {
     owner = "simonhollingshead";
     repo = "gilt-rs";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-kGmHf+knEurVTz7K7MtDkDFWIDs8nIp4CrsBHwnjg6s=";
+    hash = "sha256-ulDP/av+WrAiJWs+DJWz3dEtSVeZBAEsJZ4Up0DbYmE=";
   };
 
-  cargoHash = "sha256-4YlfR2ft5D910IKSDx/3PxrwFLln2dqscdVg+OhnSYk=";
+  cargoHash = "sha256-jV4yeYnZW0qnw82PBChwarGxCpk7JzeH4ovPHFdBV7k=";
 
   __structuredAttrs = true;
 

pkgs/by-name/gi/git-pages-cli/package.nix

@@ -8,7 +8,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "git-pages-cli";
-  version = "1.11.2";
+  version = "1.12.1";
 
   __structuredAttrs = true;
 
@@ -16,7 +16,7 @@ buildGoModule (finalAttrs: {
     owner = "git-pages";
     repo = "git-pages-cli";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-E+O6WLZH5kzRakL/gM/bja149IHmB5r5u5yl16+/Bkc=";
+    hash = "sha256-63AHpYqZmpuZ6AzQpWY958J0gvJ0Uq5ggVNea8iRPqA=";
   };
 
   vendorHash = "sha256-0/UY95xWVqIbi/SMoF12CdVp7S36qVI+Q5s2LzEtutI=";

pkgs/by-name/go/go-arch-lint/package.nix

@@ -14,13 +14,13 @@
 
 buildGo127Module (finalAttrs: {
   pname = "go-arch-lint";
-  version = "1.19.0";
+  version = "1.19.1";
 
   src = fetchFromGitHub {
     owner = "fe3dback";
     repo = "go-arch-lint";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-eA+xM7WSOyzj3uhVUT/6dHGoHx1tsBCCKXPLOintimE=";
+    hash = "sha256-aeLM1pG81pmq+H7mmFYjvf8bXISBztuPPhKh9waS8qg=";
   };
 
   vendorHash = "sha256-USP8gFDd4ii8yO/dch3OHVrDsVUy4HgRxBvnFwAbHeU=";

pkgs/by-name/go/google-chat-linux/package.nix

@@ -10,16 +10,16 @@
 
 buildNpmPackage rec {
   pname = "google-chat-linux";
-  version = "5.39.28-1";
+  version = "5.39.29-2";
 
   src = fetchFromGitHub {
     owner = "squalou";
     repo = "google-chat-linux";
     tag = version;
-    hash = "sha256-NSWNqFNMmrgCKdTxAxqMl7oZS9YGAisvD2YpXCH4s0A=";
+    hash = "sha256-4qwFOSZ669ZMa+b+EYy7ZunzGlAOD4Gqf/Je7T2gS8Y=";
   };
 
-  npmDepsHash = "sha256-Lgo3pGmaRMawH4m264W0CwpIuiVZZbqhI5OHXOKau9c=";
+  npmDepsHash = "sha256-EktheZsjmBEOKuFm1RfXHsiRFHI+HICuC3ESglH/JA0=";
   dontNpmBuild = true;
 
   nativeBuildInputs = [

pkgs/by-name/go/google-cloud-sdk/data.nix

@@ -1,23 +1,23 @@
 # DO NOT EDIT! This file is generated automatically by update.sh
 { }:
 {
-  version = "583.0.0";
+  version = "591.0.0";
   googleCloudSdkPkgs = {
     x86_64-linux = {
-      url = "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-sdk-583.0.0-linux-x86_64.tar.gz";
-      sha256 = "0xxi4vs6cld358iqgcj44pm667f13vp0j5y7fhcmv6qsar1q4aqb";
+      url = "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-sdk-591.0.0-linux-x86_64.tar.gz";
+      sha256 = "09drh6yg5lwsc44bj4mf1hihi83vwnbkgxra0cigyscanq3na9im";
     };
     aarch64-linux = {
-      url = "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-sdk-583.0.0-linux-arm.tar.gz";
-      sha256 = "0clqkah2s2k62i628wc6zmqpns43r01clvfww5bdzibmzy6csgxp";
+      url = "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-sdk-591.0.0-linux-arm.tar.gz";
+      sha256 = "1jchgi1cyxnqvbmv7bjlxb7qa4i9fv195r2lrga8gvfwxz6sqj3d";
     };
     aarch64-darwin = {
-      url = "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-sdk-583.0.0-darwin-arm.tar.gz";
-      sha256 = "17z79g05zs5afcjzapj1kzn43c7asrjlf65qwb7vx7nm186y1z6j";
+      url = "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-sdk-591.0.0-darwin-arm.tar.gz";
+      sha256 = "09jwi19dn39p9mh17r4zqiskqi97cw8jgdx3ka910a7301x2fljm";
     };
     i686-linux = {
-      url = "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-sdk-583.0.0-linux-x86.tar.gz";
-      sha256 = "1x5avi90wq21h6sy38xpwv6nwfhxwxicwsngv2la5y94ym4rdvfr";
+      url = "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-sdk-591.0.0-linux-x86.tar.gz";
+      sha256 = "15wv63p9rxyzrkjn11b0a0gx1g8kxki5rih0hpjms1mm36fk2fjx";
     };
   };
 }

pkgs/by-name/go/google-java-format/package.nix

@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "google-java-format";
-  version = "1.37.0";
+  version = "2.0.0";
   __structuredAttrs = true;
 
   src = fetchurl {
-    sha256 = "sha256-g0sqDDjLd0lTMiqEtco/L0DdMVZlCzzUTTt0Q0WWL3o=";
+    sha256 = "sha256-x4/rSMVJ+nEUt+oR2ztFaAj3s3H/6E5mQ6RN0vlYhjk=";
     url = "https://github.com/google/google-java-format/releases/download/v${finalAttrs.version}/google-java-format-${finalAttrs.version}-all-deps.jar";
   };
 

pkgs/by-name/go/gotools/package.nix

@@ -9,17 +9,17 @@
 
 buildGoModule (finalAttrs: {
   pname = "gotools";
-  version = "0.44.0";
+  version = "0.52.0";
 
   # using GitHub instead of https://go.googlesource.com/tools because Gitiles UI is too basic to browse
   src = fetchFromGitHub {
     owner = "golang";
     repo = "tools";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-F9DyZAZdrKCrCIB6FZP0KrOwPNRLk0ZQoNMHGMHd0UY=";
+    hash = "sha256-invRApL81q9uIUCbBUhWGyS+14OKK6HZYdONzhHGKP4=";
   };
 
-  vendorHash = "sha256-HpWkPsRJ0vCqJi9LoZcVbzeoPQ2B9ftZwuS1r47W7Sc=";
+  vendorHash = "sha256-+1/eKOwN4yUvLCgGRJbW6MTleIEodfcIoEHCBRHd2MQ=";
 
   nativeBuildInputs = [ makeWrapper ];
 

pkgs/by-name/gp/gpu-screen-recorder-notification/package.nix

@@ -21,12 +21,12 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gpu-screen-recorder-notification";
-  version = "1.3.6";
+  version = "1.3.8";
 
   src = fetchgit {
     url = "https://repo.dec05eba.com/gpu-screen-recorder-notification";
     tag = finalAttrs.version;
-    hash = "sha256-UmK9aDVsWgMZx9dCA0LFLmY0NLmhwh3O2VgztUzvPOs=";
+    hash = "sha256-nojlYxNqoB9x8LBNYKERzQzp+l+cALkKYV+ORMZjBlo=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/gp/gpu-screen-recorder-ui/package.nix

@@ -34,12 +34,12 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gpu-screen-recorder-ui";
-  version = "1.14.0";
+  version = "1.15.0";
 
   src = fetchgit {
     url = "https://repo.dec05eba.com/gpu-screen-recorder-ui";
     tag = finalAttrs.version;
-    hash = "sha256-V7fRv1JjqCtYiSQVFBF0O1oFM6eVuj2nWIgNe7LgDfU=";
+    hash = "sha256-tFP2KsZJxmcyfFt8EKM7Rusl0uNvTGY9EIkklFJfUvA=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/gu/guesswidth/package.nix

@@ -10,16 +10,16 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "guesswidth";
-  version = "0.5.0";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "noborus";
     repo = "guesswidth";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-MbQBfwXdmcSU6F7M+Y70lGwBwhhJvRgtevco+UPt0Po=";
+    hash = "sha256-Mrnn4ecsK7mA+M3gn47qYk2YEKzdo38dD7AYjdkHptY=";
   };
 
-  vendorHash = "sha256-/R/KUKQq52CnukJoQybSA4OkcHq/v8ICxxUqSc4ynEQ=";
+  vendorHash = "sha256-pjGuBDiUPQpgxpCSnt0r2vueO7HzHrI0AvUKaL/fDUc=";
 
   ldflags = [
     "-X github.com/noborus/guesswidth.version=v${finalAttrs.version}"

pkgs/by-name/ha/halo/package.nix

@@ -8,10 +8,10 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "halo";
-  version = "2.27.0";
+  version = "2.27.1";
   src = fetchurl {
     url = "https://github.com/halo-dev/halo/releases/download/v${finalAttrs.version}/halo-${finalAttrs.version}.jar";
-    hash = "sha256-0xUeqXxLjR1FJRSUd1NaP1xscTk5vlkuF6Hcb5u9SJI=";
+    hash = "sha256-9iHNz7tm0YB5eEoch5ahcH2kXJpKeDl4xMyuMTP5o9M=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/he/headscale/package.nix

@@ -11,13 +11,13 @@
 }:
 buildGo127Module (finalAttrs: {
   pname = "headscale";
-  version = "0.29.6";
+  version = "0.29.7";
 
   src = fetchFromGitHub {
     owner = "juanfont";
     repo = "headscale";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-KWsoNZTbsv1MqmBKrClmk/QcU8Xll5a+AZvTApipX20=";
+    hash = "sha256-PmbCdLDqBfz8iqnGRU3XWQU7gvrQ/jeAdYc3mvvjWGk=";
   };
 
   postPatch = ''
@@ -26,7 +26,7 @@ buildGo127Module (finalAttrs: {
       --replace-fail 'Commit:    "unknown"' 'Commit: "${finalAttrs.src.tag}"'
   '';
 
-  vendorHash = "sha256-aDP2N3EUPeXZWAvlFHWxsGUZTtVGFtcT+Lul1PnGwT4=";
+  vendorHash = "sha256-ADl65VpgS3uKYX0dYkRPPKcOelD9sJdwlq+CA0eA7Nk=";
 
   subPackages = [ "cmd/headscale" ];
 

pkgs/by-name/hu/hunspell/dictionaries.nix

@@ -809,12 +809,12 @@ rec {
   uk_UA = uk-ua;
   uk-ua = mkDict rec {
     pname = "hunspell-dict-uk-ua";
-    version = "6.5.3";
-    _version = "1727974630";
+    version = "6.8.6";
+    _version = "1789839899";
 
     src = fetchurl {
       url = "https://extensions.libreoffice.org/assets/downloads/521/${_version}/dict-uk_UA-${version}.oxt";
-      hash = "sha256-c957WHJqaf/M2QrE2H3aIDAWGoQDnDl0na7sd+kUXNI=";
+      hash = "sha256-V6ACnfsQy4HfRuDe1XpuHfCywOvJBGjkH0vMW5/OEFM=";
     };
 
     dictFileName = "uk_UA";

pkgs/by-name/hy/hydralauncher/package.nix

@@ -6,10 +6,10 @@
 }:
 let
   pname = "hydralauncher";
-  version = "4.1.6";
+  version = "4.2.0";
   src = fetchurl {
     url = "https://github.com/hydralauncher/hydra/releases/download/v${version}/hydralauncher-${version}.AppImage";
-    hash = "sha256-yX4FsqFS3udMAlokRPk5YbzmmOjnkNIxfCs7en2cv8I=";
+    hash = "sha256-p/97sPEx00DWhXR2WfkoNxEkBC7FKl94l8apD7zv3gc=";
   };
 
   appimageContents = appimageTools.extract { inherit pname src version; };

pkgs/by-name/in/incus/package.nix

@@ -2,6 +2,18 @@ import ./generic.nix {
   hash = "sha256-JO6qZvsy3EcMYVXF3SjQljOSAEG1RlQTK+eiQIT9c1s=";
   version = "7.6.0";
   vendorHash = "sha256-3T3NXH3GVfn1K6dfObOji4GCkcYzio8yRfdV5nyOAtE=";
+  patches = fetchpatch: [
+    # client: Only probe Unix sockets when several exist
+    (fetchpatch {
+      url = "https://github.com/lxc/incus/commit/d34562e45efe62c8c31523f7c82a508d13f68219.patch";
+      hash = "sha256-HrnNuMb9vw5Na97UiZZujdHekTkUOsKnowiHyMBqp5Q=";
+    })
+    # incus-user: Serialize user setup across connections
+    (fetchpatch {
+      url = "https://github.com/lxc/incus/commit/ef9a103401c19d26a3def929c310eadfa376bfea.patch";
+      hash = "sha256-cTsf+FvG1inYfZDIZAfP61K1YJ3gmUZj5yfkyxL7D54=";
+    })
+  ];
   nixUpdateExtraArgs = [
     "--override-filename=pkgs/by-name/in/incus/package.nix"
   ];

pkgs/by-name/in/intel-llvm/ambiguous-ipc-put.patch

@@ -0,0 +1,47 @@
+From 46dfb68bae2ad5386763a08bd5c4a8ccde5fcf09 Mon Sep 17 00:00:00 2001
+From: Skye Soss <skye@soss.website>
+Date: Mon, 26 Oct 2026 11:28:19 -0500
+Subject: [PATCH] [SYCL] Fix ambiguous ipc put() calls with GCC 16 in C++20
+ mode
+
+With GCC 16 and -std=c++20, ipc_event.hpp and ipc_physical_memory.hpp
+fail to compile:
+
+  error: call of overloaded 'put(ipc::handle&, sycl::_V1::context&)' is ambiguous
+
+The friend declarations in ipc::handle make memory::put,
+physical_memory::put and event::put all visible through ADL. Qualify
+the calls, like ipc::memory::put already does.
+
+Assisted-By: LLM
+---
+ sycl/include/sycl/ext/oneapi/experimental/ipc_event.hpp         | 2 +-
+ .../sycl/ext/oneapi/experimental/ipc_physical_memory.hpp        | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sycl/include/sycl/ext/oneapi/experimental/ipc_event.hpp b/sycl/include/sycl/ext/oneapi/experimental/ipc_event.hpp
+index f84867fe7aea5..9e2181373e637 100644
+--- a/sycl/include/sycl/ext/oneapi/experimental/ipc_event.hpp
++++ b/sycl/include/sycl/ext/oneapi/experimental/ipc_event.hpp
+@@ -44,7 +44,7 @@ namespace ext::oneapi::experimental::ipc::event {
+ inline void put(handle &IpcHandle) {
+   sycl::device Dev;
+   sycl::context Ctx = Dev.get_platform().khr_get_default_context();
+-  return put(IpcHandle, Ctx);
++  return ipc::event::put(IpcHandle, Ctx);
+ }
+ 
+ inline sycl::event open(const ipc::handle_data_t &HandleData,
+diff --git a/sycl/include/sycl/ext/oneapi/experimental/ipc_physical_memory.hpp b/sycl/include/sycl/ext/oneapi/experimental/ipc_physical_memory.hpp
+index 9c2576231641d..b1c2269f096d2 100644
+--- a/sycl/include/sycl/ext/oneapi/experimental/ipc_physical_memory.hpp
++++ b/sycl/include/sycl/ext/oneapi/experimental/ipc_physical_memory.hpp
+@@ -43,7 +43,7 @@ __SYCL_EXPORT void put(handle &ipc_handle, const sycl::context &ctx);
+ inline void put(handle &ipc_handle) {
+   sycl::device Dev;
+   sycl::context Ctx = Dev.get_platform().khr_get_default_context();
+-  return put(ipc_handle, Ctx);
++  return ipc::physical_memory::put(ipc_handle, Ctx);
+ }
+ 
+ inline physical_mem open(const ipc::handle_data_t &HandleData,

pkgs/by-name/in/intel-llvm/gnu-install-dirs.patch

@@ -1,8 +1,8 @@
 diff --git a/bolt/CMakeLists.txt b/bolt/CMakeLists.txt
-index 5c7d51e1e398..9158552fa09b 100644
+index 8deb5cea0401..106372c4a56e 100644
 --- a/bolt/CMakeLists.txt
 +++ b/bolt/CMakeLists.txt
-@@ -55,9 +55,9 @@ if(BOLT_BUILT_STANDALONE)
+@@ -62,9 +62,9 @@ if(BOLT_BUILT_STANDALONE)
    include_directories(${LLVM_INCLUDE_DIRS})
    link_directories("${LLVM_LIBRARY_DIR}")
  
@@ -53,7 +53,7 @@ index c47c4ac3bb73..721eb2cfd302 100644
  
  set(LLVM_BUILTIN_TARGETS                    "${TOOLCHAIN_TARGET_TRIPLE}" CACHE STRING "")
 diff --git a/clang/cmake/modules/AddClang.cmake b/clang/cmake/modules/AddClang.cmake
-index 4059fc3e986c..2b2500ad655c 100644
+index e2112d7c326e..1ba00661cb03 100644
 --- a/clang/cmake/modules/AddClang.cmake
 +++ b/clang/cmake/modules/AddClang.cmake
 @@ -134,8 +134,8 @@ macro(add_clang_library name)
@@ -150,16 +150,6 @@ index ca233103ccdb..3e4dd9a58c5f 100644
          RUNTIME DESTINATION "${CMAKE_INSTALL_BINDIR}")
  
        if (NOT LLVM_ENABLE_IDE)
-diff --git a/libclc/libclc.pc.in b/libclc/libclc.pc.in
-index 3a9e58b3ef0c..60f8c0fdf75d 100644
---- a/libclc/libclc.pc.in
-+++ b/libclc/libclc.pc.in
-@@ -1,4 +1,4 @@
--libexecdir=@CMAKE_INSTALL_PREFIX@/@CMAKE_INSTALL_DATADIR@/clc
-+libexecdir=@CMAKE_INSTALL_FULL_DATAROOTDIR@/clc
- 
- Name: libclc
- Description: Library requirements of the OpenCL C programming language
 diff --git a/libcxx/test/configs/armv7m-picolibc-libc++.cfg.in b/libcxx/test/configs/armv7m-picolibc-libc++.cfg.in
 index f0782c28ce3e..32fc542db557 100644
 --- a/libcxx/test/configs/armv7m-picolibc-libc++.cfg.in
@@ -185,10 +175,10 @@ index e61efbb303fc..a73c58584567 100644
  config.substitutions.append(('%{flags}', '--sysroot=@CMAKE_INSTALL_PREFIX@'))
  
 diff --git a/libdevice/cmake/modules/SYCLLibdevice.cmake b/libdevice/cmake/modules/SYCLLibdevice.cmake
-index 4f7d06e668ba..7ecd77ebc002 100644
+index 648e4da85ca7..0e58c5e7b1d8 100644
 --- a/libdevice/cmake/modules/SYCLLibdevice.cmake
 +++ b/libdevice/cmake/modules/SYCLLibdevice.cmake
-@@ -6,15 +6,15 @@ else()
+@@ -8,15 +8,15 @@ else()
    set(devicelib_host_static_obj libsycl-devicelib-host.a)
  endif()
  set(bc-suffix bc)
@@ -235,10 +225,10 @@ index 37f73afa915f..1f70cfe4fc05 100644
  
      if (NOT CMAKE_CONFIGURATION_TYPES)
 diff --git a/lldb/cmake/modules/AddLLDB.cmake b/lldb/cmake/modules/AddLLDB.cmake
-index 6493df27f38d..e4fa0b72990e 100644
+index b6ad8d46380b..17d8ec124504 100644
 --- a/lldb/cmake/modules/AddLLDB.cmake
 +++ b/lldb/cmake/modules/AddLLDB.cmake
-@@ -106,7 +106,7 @@ function(add_lldb_library name)
+@@ -329,7 +329,7 @@ function(add_lldb_library name)
    endif()
  
    if(PARAM_SHARED)
@@ -272,10 +262,10 @@ index 814c59251611..7188084e8061 100644
  Name: LLVMSPIRVLib
  Description: LLVM/SPIR-V bi-directional translator
 diff --git a/llvm/CMakeLists.txt b/llvm/CMakeLists.txt
-index 4518d3e1264d..ee11de0a3a09 100644
+index a515a20418b5..dbb80d8c1f56 100644
 --- a/llvm/CMakeLists.txt
 +++ b/llvm/CMakeLists.txt
-@@ -1197,9 +1197,9 @@ if (NOT TENSORFLOW_AOT_PATH STREQUAL "")
+@@ -1271,9 +1271,9 @@ if (NOT TENSORFLOW_AOT_PATH STREQUAL "")
    add_subdirectory(${TENSORFLOW_AOT_PATH}/xla_aot_runtime_src
      ${CMAKE_ARCHIVE_OUTPUT_DIRECTORY}/tf_runtime)
    install(TARGETS tf_xla_runtime EXPORT LLVMExports
@@ -288,10 +278,10 @@ index 4518d3e1264d..ee11de0a3a09 100644
    # Once we add more modules, we should handle this more automatically.
    if (DEFINED LLVM_OVERRIDE_MODEL_HEADER_INLINERSIZEMODEL)
 diff --git a/llvm/cmake/modules/AddLLVM.cmake b/llvm/cmake/modules/AddLLVM.cmake
-index d938214f9d0d..dc39a292aa90 100644
+index a267166eb6c2..10b2a576ab44 100644
 --- a/llvm/cmake/modules/AddLLVM.cmake
 +++ b/llvm/cmake/modules/AddLLVM.cmake
-@@ -955,8 +955,8 @@ macro(add_llvm_library name)
+@@ -1065,8 +1065,8 @@ macro(add_llvm_library name)
        endif()
        install(TARGETS ${name}
                ${export_to_llvmexports}
@@ -302,7 +292,7 @@ index d938214f9d0d..dc39a292aa90 100644
                RUNTIME DESTINATION "${CMAKE_INSTALL_BINDIR}" COMPONENT ${name})
  
        if (NOT LLVM_ENABLE_IDE)
-@@ -2279,7 +2279,7 @@ function(llvm_install_library_symlink name dest type)
+@@ -2419,7 +2419,7 @@ function(llvm_install_library_symlink name dest type)
      set(LLVM_LINK_OR_COPY copy)
    endif()
  
@@ -311,7 +301,7 @@ index d938214f9d0d..dc39a292aa90 100644
    if((WIN32 OR CYGWIN) AND "${type}" STREQUAL "SHARED")
      set(output_dir "${CMAKE_INSTALL_BINDIR}")
    endif()
-@@ -2561,10 +2561,10 @@ function(llvm_setup_rpath name)
+@@ -2701,10 +2701,10 @@ function(llvm_setup_rpath name)
      # Since BUILD_SHARED_LIBS is only recommended for use by developers,
      # hardcode the rpath to build/install lib dir first in this mode.
      # FIXME: update this when there is better solution.
@@ -322,9 +312,9 @@ index d938214f9d0d..dc39a292aa90 100644
 -    set(_install_rpath "\$ORIGIN/../lib${LLVM_LIBDIR_SUFFIX}")
 +    set(_build_rpath "${CMAKE_INSTALL_FULL_LIBDIR}" ${extra_libdir})
 +    set(_install_rpath "${CMAKE_INSTALL_FULL_LIBDIR}")
-     if("${CMAKE_SYSTEM_NAME}" MATCHES "(FreeBSD|DragonFly)")
-       set_property(TARGET ${name} APPEND_STRING PROPERTY
-                    LINK_FLAGS " -Wl,-z,origin ")
+     if(LLVM_ENABLE_PER_TARGET_RUNTIME_DIR AND NOT APPLE)
+       list(APPEND _build_rpath "\$ORIGIN/../lib${LLVM_LIBDIR_SUFFIX}/${LLVM_DEFAULT_TARGET_TRIPLE}")
+       list(APPEND _install_rpath "\$ORIGIN/../lib${LLVM_LIBDIR_SUFFIX}/${LLVM_DEFAULT_TARGET_TRIPLE}")
 diff --git a/llvm/cmake/modules/AddOCaml.cmake b/llvm/cmake/modules/AddOCaml.cmake
 index 9a393ae3b747..23b22a99ed74 100644
 --- a/llvm/cmake/modules/AddOCaml.cmake
@@ -388,7 +378,7 @@ index e4e1d449bf4d..890e1f164d97 100644
  #define LLVM_INSTALL_PACKAGE_DIR "@LLVM_INSTALL_PACKAGE_DIR@"
  #define LLVM_TARGETS_BUILT "@LLVM_TARGETS_BUILT@"
 diff --git a/llvm/tools/llvm-config/llvm-config.cpp b/llvm/tools/llvm-config/llvm-config.cpp
-index 24ea264419af..26aaf93c4c71 100644
+index 76aa9f82eb0a..3d08cfa34373 100644
 --- a/llvm/tools/llvm-config/llvm-config.cpp
 +++ b/llvm/tools/llvm-config/llvm-config.cpp
 @@ -367,7 +367,7 @@ int main(int argc, char **argv) {
@@ -401,10 +391,10 @@ index 24ea264419af..26aaf93c4c71 100644
        SmallString<256> Path(LLVM_INSTALL_PACKAGE_DIR);
        sys::path::make_absolute(ActivePrefix, Path);
 diff --git a/mlir/cmake/modules/AddMLIR.cmake b/mlir/cmake/modules/AddMLIR.cmake
-index 6589458ab789..9bff1af30631 100644
+index d3f534a02f9d..3e825af5dbe0 100644
 --- a/mlir/cmake/modules/AddMLIR.cmake
 +++ b/mlir/cmake/modules/AddMLIR.cmake
-@@ -638,13 +638,13 @@ function(add_mlir_library_install name)
+@@ -629,13 +629,13 @@ function(add_mlir_library_install name)
      install(TARGETS ${name}
        COMPONENT ${name}
        ${export_to_mlirtargets}
@@ -422,10 +412,10 @@ index 6589458ab789..9bff1af30631 100644
  
      if (NOT LLVM_ENABLE_IDE)
 diff --git a/mlir/cmake/modules/AddMLIRPython.cmake b/mlir/cmake/modules/AddMLIRPython.cmake
-index 97873d0c07ab..1cdb8c4f9cc5 100644
+index 7d47fd0bca34..0f932b436f00 100644
 --- a/mlir/cmake/modules/AddMLIRPython.cmake
 +++ b/mlir/cmake/modules/AddMLIRPython.cmake
-@@ -688,7 +688,7 @@ function(mlir_python_setup_extension_rpath target)
+@@ -796,7 +796,7 @@ function(mlir_python_setup_extension_rpath target)
      set_property(TARGET ${target} APPEND PROPERTY
        BUILD_RPATH "${_real_lib_dir}")
      set_property(TARGET ${target} APPEND PROPERTY
@@ -435,27 +425,27 @@ index 97873d0c07ab..1cdb8c4f9cc5 100644
  endfunction()
  
 diff --git a/offload/liboffload/CMakeLists.txt b/offload/liboffload/CMakeLists.txt
-index 62480dad1cac..d6f0a0282c47 100644
+index 0f5a0109f4b8..354f7cf78a5a 100644
 --- a/offload/liboffload/CMakeLists.txt
 +++ b/offload/liboffload/CMakeLists.txt
-@@ -45,5 +45,5 @@ set_target_properties(LLVMOffload PROPERTIES
-                       BUILD_RPATH "$ORIGIN:${CMAKE_CURRENT_BINARY_DIR}/..")
- install(TARGETS LLVMOffload LIBRARY COMPONENT LLVMOffload DESTINATION "${OFFLOAD_INSTALL_LIBDIR}")
+@@ -63,5 +63,5 @@ if(MSVC)
+     OPTIONAL)
+ endif()
  
--install(FILES ${CMAKE_CURRENT_BINARY_DIR}/API/OffloadAPI.h DESTINATION ${CMAKE_INSTALL_PREFIX}/include/offload)
--install(FILES ${CMAKE_CURRENT_BINARY_DIR}/API/OffloadPrint.hpp DESTINATION ${CMAKE_INSTALL_PREFIX}/include/offload)
-+install(FILES ${CMAKE_CURRENT_BINARY_DIR}/API/OffloadAPI.h DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}/offload)
-+install(FILES ${CMAKE_CURRENT_BINARY_DIR}/API/OffloadPrint.hpp DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}/offload)
+-install(FILES ${CMAKE_CURRENT_BINARY_DIR}/API/OffloadAPI.h DESTINATION ${CMAKE_INSTALL_PREFIX}/include/offload COMPONENT offload)
+-install(FILES ${CMAKE_CURRENT_BINARY_DIR}/API/OffloadPrint.hpp DESTINATION ${CMAKE_INSTALL_PREFIX}/include/offload COMPONENT offload)
++install(FILES ${CMAKE_CURRENT_BINARY_DIR}/API/OffloadAPI.h DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}/offload COMPONENT offload)
++install(FILES ${CMAKE_CURRENT_BINARY_DIR}/API/OffloadPrint.hpp DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}/offload COMPONENT offload)
 diff --git a/openmp/libompd/gdb-plugin/CMakeLists.txt b/openmp/libompd/gdb-plugin/CMakeLists.txt
-index 20cb4680e4cb..66a77274f9c8 100644
+index d4fd03d2fad8..e40d05f2f818 100644
 --- a/openmp/libompd/gdb-plugin/CMakeLists.txt
 +++ b/openmp/libompd/gdb-plugin/CMakeLists.txt
-@@ -36,5 +36,5 @@ target_link_libraries (ompdModule ${CMAKE_DL_LIBS})
- set_target_properties (ompdModule PROPERTIES PREFIX "")
- set_target_properties (ompdModule PROPERTIES LIBRARY_OUTPUT_DIRECTORY "${CMAKE_CURRENT_BINARY_DIR}/python-module/ompd/")
+@@ -38,5 +38,5 @@ set_target_properties (ompdModule PROPERTIES LIBRARY_OUTPUT_DIRECTORY "${CMAKE_C
  
--install(DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}/python-module/ompd DESTINATION share/gdb/python/ PATTERN ompdModule.so PERMISSIONS OWNER_READ WORLD_READ GROUP_READ OWNER_EXECUTE GROUP_EXECUTE WORLD_EXECUTE)
-+install(DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}/python-module/ompd DESTINATION ${CMAKE_INSTALL_DATAROOTDIR}/gdb/python/ PATTERN ompdModule.so PERMISSIONS OWNER_READ WORLD_READ GROUP_READ OWNER_EXECUTE GROUP_EXECUTE WORLD_EXECUTE)
+ openmp_register_meta_dep(ompd_gdb_plugin ompdModule)
+ 
+-install(DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}/python-module/ompd DESTINATION share/gdb/python/ COMPONENT openmp PATTERN ompdModule.so PERMISSIONS OWNER_READ WORLD_READ GROUP_READ OWNER_EXECUTE GROUP_EXECUTE WORLD_EXECUTE)
++install(DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}/python-module/ompd DESTINATION ${CMAKE_INSTALL_DATAROOTDIR}/gdb/python/ COMPONENT openmp PATTERN ompdModule.so PERMISSIONS OWNER_READ WORLD_READ GROUP_READ OWNER_EXECUTE GROUP_EXECUTE WORLD_EXECUTE)
  
 diff --git a/polly/cmake/polly_macros.cmake b/polly/cmake/polly_macros.cmake
 index 9bd7b0b0ea59..1232f5f0d748 100644
@@ -473,10 +463,10 @@ index 9bd7b0b0ea59..1232f5f0d748 100644
        COMPONENT ${name})
    endif()
 diff --git a/sycl/CMakeLists.txt b/sycl/CMakeLists.txt
-index 9d11782674dd..2969893f4b4a 100644
+index c4d08a480867..e5f61bf67359 100644
 --- a/sycl/CMakeLists.txt
 +++ b/sycl/CMakeLists.txt
-@@ -295,7 +295,7 @@ add_custom_command(
+@@ -309,7 +309,7 @@ add_custom_command(
  install(DIRECTORY "${sycl_inc_dir}/sycl" DESTINATION ${SYCL_INCLUDE_DIR} COMPONENT sycl-headers)
  install(DIRECTORY "${sycl_inc_dir}/CL" DESTINATION ${SYCL_INCLUDE_DIR}/ COMPONENT sycl-headers)
  install(DIRECTORY "${sycl_inc_dir}/std" DESTINATION ${SYCL_INCLUDE_DIR} COMPONENT sycl-headers)
@@ -485,7 +475,7 @@ index 9d11782674dd..2969893f4b4a 100644
  
  if (WIN32)
    set(SYCL_RT_LIBS sycl${SYCL_MAJOR_VERSION})
-@@ -348,13 +348,13 @@ if (NOT WIN32)
+@@ -386,13 +386,13 @@ if (NOT WIN32)
    install(FILES
      "${CMAKE_CURRENT_SOURCE_DIR}/gdb/libsycl.so-gdb.py"
      RENAME "libsycl.so.${SYCL_VERSION_STRING}-gdb.py"
@@ -502,10 +492,10 @@ index 9d11782674dd..2969893f4b4a 100644
    endif()
  
 diff --git a/sycl/cmake/modules/BuildUnifiedRuntime.cmake b/sycl/cmake/modules/BuildUnifiedRuntime.cmake
-index 646ca364a10f..724569d6c9fe 100644
+index 9e4633b6be02..1a9a80e8bc44 100644
 --- a/sycl/cmake/modules/BuildUnifiedRuntime.cmake
 +++ b/sycl/cmake/modules/BuildUnifiedRuntime.cmake
-@@ -112,9 +112,9 @@ find_package(Threads REQUIRED)
+@@ -124,17 +124,17 @@ find_package(Threads REQUIRED)
  if(TARGET UnifiedRuntimeLoader)
    # Install the UR loader.
    install(TARGETS ur_loader
@@ -516,9 +506,19 @@ index 646ca364a10f..724569d6c9fe 100644
 +    ARCHIVE DESTINATION ${CMAKE_INSTALL_LIBDIR} COMPONENT unified-runtime-loader
 +    RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR} COMPONENT unified-runtime-loader
    )
- endif()
  
-@@ -124,8 +124,8 @@ function(add_sycl_ur_adapter NAME)
+   # The loader dlopen()s its shared layers from its own directory, so they have
+   # to be installed alongside it.
+   if(TARGET ur_sanitizer_layer)
+     install(TARGETS ur_sanitizer_layer
+-      LIBRARY DESTINATION "lib${LLVM_LIBDIR_SUFFIX}" COMPONENT unified-runtime-loader
+-      RUNTIME DESTINATION "bin" COMPONENT unified-runtime-loader
++      LIBRARY DESTINATION ${CMAKE_INSTALL_LIBDIR} COMPONENT unified-runtime-loader
++      RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR} COMPONENT unified-runtime-loader
+     )
+   endif()
+ endif()
+@@ -145,8 +145,8 @@ function(add_sycl_ur_adapter NAME)
    add_dependencies(UnifiedRuntimeAdapters ur_adapter_${NAME})
  
    install(TARGETS ur_adapter_${NAME}
@@ -527,20 +527,23 @@ index 646ca364a10f..724569d6c9fe 100644
 +    LIBRARY DESTINATION ${CMAKE_INSTALL_LIBDIR} COMPONENT ur_adapter_${NAME}
 +    RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR} COMPONENT ur_adapter_${NAME})
  
-   set(manifest_file
-     ${CMAKE_CURRENT_BINARY_DIR}/install_manifest_ur_adapter_${NAME}.txt)
-@@ -278,24 +278,24 @@ if(CMAKE_SYSTEM_NAME STREQUAL Windows)
-   # Add the debug UR runtime libraries to the parent install.
-   install(
-     FILES ${URD_INSTALL_DIR}/bin/ur_loaderd.dll
--    DESTINATION "bin" COMPONENT unified-runtime-loader)
-+    DESTINATION ${CMAKE_INSTALL_BINDIR} COMPONENT unified-runtime-loader)
-   foreach(adapter ${SYCL_ENABLE_BACKENDS})
+   set_property(GLOBAL APPEND PROPERTY
+     SYCL_TOOLCHAIN_INSTALL_COMPONENTS ur_adapter_${NAME})
+@@ -311,27 +311,27 @@ if(CMAKE_SYSTEM_NAME STREQUAL Windows)
+   if(NOT UR_STATIC_LOADER)
      install(
-       FILES ${URD_INSTALL_DIR}/bin/ur_adapter_${adapter}d.dll
--      DESTINATION "bin" COMPONENT ur_adapter_${adapter})
-+      DESTINATION ${CMAKE_INSTALL_BINDIR} COMPONENT ur_adapter_${adapter})
-     add_dependencies(install-sycl-ur-adapter-${adapter} unified-runtimed)
+       FILES ${URD_INSTALL_DIR}/bin/ur_loaderd.dll
+-      DESTINATION "bin" COMPONENT unified-runtime-loader)
++      DESTINATION ${CMAKE_INSTALL_BINDIR} COMPONENT unified-runtime-loader)
+   endif()
+   foreach(adapter ${SYCL_ENABLE_BACKENDS})
+     ur_adapter_is_static(${adapter} adapter_is_static)
+     if(NOT adapter_is_static)
+       install(
+         FILES ${URD_INSTALL_DIR}/bin/ur_adapter_${adapter}d.dll
+-        DESTINATION "bin" COMPONENT ur_adapter_${adapter})
++        DESTINATION ${CMAKE_INSTALL_BINDIR} COMPONENT ur_adapter_${adapter})
+     endif()
    endforeach()
    if(UMF_BUILD_SHARED_LIBRARY)
      # Also install umfd.dll
@@ -574,10 +577,10 @@ index f469b2604760..a8728bdfb5b1 100644
              COMPONENT ${ARG_TARGET_NAME}
              OPTIONAL)
 diff --git a/sycl/source/CMakeLists.txt b/sycl/source/CMakeLists.txt
-index 40327b594678..5f25cb498381 100644
+index 96b8cf2fb28a..4416d8ae666d 100644
 --- a/sycl/source/CMakeLists.txt
 +++ b/sycl/source/CMakeLists.txt
-@@ -198,7 +198,7 @@ function(add_sycl_rt_library LIB_NAME LIB_OBJ_NAME)
+@@ -212,7 +212,7 @@ function(add_sycl_rt_library LIB_NAME LIB_OBJ_NAME)
          COMMENT "Creating version-agnostic copy of the import library.")
        install(
          FILES ${CMAKE_LIBRARY_OUTPUT_DIRECTORY}/${ARG_IMPLIB_NAME}.lib
@@ -586,7 +589,7 @@ index 40327b594678..5f25cb498381 100644
      endif()
    endif()
  
-@@ -436,6 +436,6 @@ if (WIN32)
+@@ -455,6 +455,6 @@ if (WIN32)
  endif()
  
  install(TARGETS ${SYCL_RT_LIBS}
@@ -597,7 +600,7 @@ index 40327b594678..5f25cb498381 100644
 +  LIBRARY DESTINATION ${CMAKE_INSTALL_LIBDIR} COMPONENT sycl
 +  RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR} COMPONENT sycl)
 diff --git a/sycl/test/CMakeLists.txt b/sycl/test/CMakeLists.txt
-index 4e7607e74931..d400c6b11d89 100644
+index caeac5ed9a59..630da52c202f 100644
 --- a/sycl/test/CMakeLists.txt
 +++ b/sycl/test/CMakeLists.txt
 @@ -8,7 +8,7 @@ set(LLVM_BUILD_BINARY_DIRS "${LLVM_BINARY_DIR}/bin/")
@@ -650,10 +653,10 @@ index 740a764269ea..dc8b98f83098 100644
 +    RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR} COMPONENT ur_win_proxy_loader)
  endif()
 diff --git a/unified-runtime/CMakeLists.txt b/unified-runtime/CMakeLists.txt
-index 2248cfcb3db2..b6c102721858 100644
+index 28256344244a..afe878e9ed63 100644
 --- a/unified-runtime/CMakeLists.txt
 +++ b/unified-runtime/CMakeLists.txt
-@@ -363,7 +363,7 @@ target_include_directories(ur_headers INTERFACE
+@@ -365,7 +365,7 @@ target_include_directories(ur_headers INTERFACE
  # Add the include directory and the headers target to the install.
  install(
      DIRECTORY "${PROJECT_SOURCE_DIR}/include/"
@@ -662,32 +665,32 @@ index 2248cfcb3db2..b6c102721858 100644
  install(
      TARGETS ur_headers
      EXPORT ${PROJECT_NAME}-targets)
-@@ -386,7 +386,7 @@ install(
-     EXPORT ${PROJECT_NAME}-targets
-     FILE ${PROJECT_NAME}-targets.cmake
-     NAMESPACE ${PROJECT_NAME}::
--    DESTINATION lib/cmake/${PROJECT_NAME})
-+    DESTINATION ${CMAKE_INSTALL_LIBDIR}/cmake/${PROJECT_NAME})
+@@ -392,7 +392,7 @@ if(UR_STANDALONE_BUILD)
+         EXPORT ${PROJECT_NAME}-targets
+         FILE ${PROJECT_NAME}-targets.cmake
+         NAMESPACE ${PROJECT_NAME}::
+-        DESTINATION lib/cmake/${PROJECT_NAME})
++        DESTINATION ${CMAKE_INSTALL_LIBDIR}/cmake/${PROJECT_NAME})
  
- # Configure the package versions file for use in find_package when installed.
- write_basic_package_version_file(
-@@ -397,14 +397,14 @@ write_basic_package_version_file(
- configure_package_config_file(
-     ${PROJECT_SOURCE_DIR}/cmake/${PROJECT_NAME}-config.cmake.in
-     ${PROJECT_BINARY_DIR}/cmake/${PROJECT_NAME}-config.cmake
--    INSTALL_DESTINATION lib/cmake/${PROJECT_NAME})
-+    INSTALL_DESTINATION ${CMAKE_INSTALL_LIBDIR}/cmake/${PROJECT_NAME})
- 
- # Add the package files to the install.
- install(
-     FILES
+     # Configure the package versions file for use in find_package when installed.
+     write_basic_package_version_file(
+@@ -403,14 +403,14 @@ if(UR_STANDALONE_BUILD)
+     configure_package_config_file(
+         ${PROJECT_SOURCE_DIR}/cmake/${PROJECT_NAME}-config.cmake.in
          ${PROJECT_BINARY_DIR}/cmake/${PROJECT_NAME}-config.cmake
-         ${PROJECT_BINARY_DIR}/cmake/${PROJECT_NAME}-config-version.cmake
--    DESTINATION lib/cmake/${PROJECT_NAME})
-+    DESTINATION ${CMAKE_INSTALL_LIBDIR}/cmake/${PROJECT_NAME})
+-        INSTALL_DESTINATION lib/cmake/${PROJECT_NAME})
++        INSTALL_DESTINATION ${CMAKE_INSTALL_LIBDIR}/cmake/${PROJECT_NAME})
+ 
+     # Add the package files to the install.
+     install(
+         FILES
+             ${PROJECT_BINARY_DIR}/cmake/${PROJECT_NAME}-config.cmake
+             ${PROJECT_BINARY_DIR}/cmake/${PROJECT_NAME}-config-version.cmake
+-        DESTINATION lib/cmake/${PROJECT_NAME})
++        DESTINATION ${CMAKE_INSTALL_LIBDIR}/cmake/${PROJECT_NAME})
+ endif()
  
  set(API_JSON_FILE ${PROJECT_BINARY_DIR}/unified_runtime.json)
- 
 diff --git a/unified-runtime/source/loader/libur_loader.pc.in b/unified-runtime/source/loader/libur_loader.pc.in
 index d79c3a9da8bd..6aac2abcd9ea 100644
 --- a/unified-runtime/source/loader/libur_loader.pc.in
@@ -735,10 +738,10 @@ index 78549309cafe..29d29e005b1b 100644
  endif()
  
 diff --git a/xptifw/src/CMakeLists.txt b/xptifw/src/CMakeLists.txt
-index 5e865aa3714e..10e6bfc925e3 100644
+index d1f21e03beb3..0a957e94ed01 100644
 --- a/xptifw/src/CMakeLists.txt
 +++ b/xptifw/src/CMakeLists.txt
-@@ -93,9 +93,9 @@ function(add_xpti_library LIB_NAME)
+@@ -106,9 +106,9 @@ function(add_xpti_library LIB_NAME)
    include(GNUInstallDirs)
    install(TARGETS ${LIB_NAME}
      EXPORT xptifwTargets

pkgs/by-name/in/intel-llvm/package.nix

@@ -47,28 +47,28 @@ let
   scope = lib.makeScope newScope (self: {
     # == Parameters for overriding ==
 
-    llvmMajorVersion = "22";
+    llvmMajorVersion = "23";
 
-    version = "7.1.1";
+    version = "7.2.0";
 
     src = fetchFromGitHub {
       owner = "intel";
       repo = "llvm";
       tag = "v${self.version}";
-      hash = "sha256-XVfLWx7lsjS1m+w/T2x0kGg2k51r7jCmKX2ZcR2aAHg=";
+      hash = "sha256-3xhZL+iu68B/kUQ0I0EdVCaqcLlqYK3P0CrJz8X8d8A=";
     };
 
     # The commit date of the release tag above, kept in sync by `updateScript`.
     # If you override src, you'll probably also want to override this,
     # as some packages check for this date to decide what features the compiler supports.
-    commitDate = "20260915";
+    commitDate = "20261014";
 
     vc-intrinsics-src = fetchFromGitHub {
       owner = "intel";
       repo = "vc-intrinsics";
       # See LLVMGenXIntrinsics_GIT_TAG in llvm/lib/SYCLLowerIR/CMakeLists.txt
-      rev = "60cea7590bd022d95f5cf336ee765033bd114d69";
-      hash = "sha256-1K16UEa6DHoP2ukSx58OXJdtDWyUyHkq5Gd2DUj1644=";
+      rev = "4fc83e12979096db72c129bd432238d5ca397e4d";
+      hash = "sha256-2vPGb2phD351DNADFA/oRdnylxc0DBEq2YLk6cszu10=";
     };
 
     # ===============================

pkgs/by-name/in/intel-llvm/tests.nix

@@ -26,6 +26,12 @@ let
       name = "spir64";
       flags = [ ];
     }
+    # ...unless the new offload driver is used, which links them at compile
+    # time and errors out if they can't be found.
+    {
+      name = "spir64-new-offload-driver";
+      flags = [ "--offload-new-driver" ];
+    }
   ]
   ++ lib.optional (lib.elem "native_cpu" backends) {
     name = "native_cpu";

pkgs/by-name/in/intel-llvm/unwrapped.nix

@@ -11,7 +11,6 @@
   stdenv,
   cmake,
   ninja,
-  fetchpatch,
   python3,
   pkg-config,
   zstd,
@@ -21,7 +20,7 @@
   opencl-headers,
   libxml2,
   libedit,
-  llvmPackages_22,
+  llvmPackages_23,
   parallel-hashmap,
   spirv-headers,
   spirv-tools,
@@ -115,7 +114,7 @@ stdenv.mkDerivation (finalAttrs: {
     cmake
     ninja
     python3
-    llvmPackages_22.bintools # For lld
+    llvmPackages_23.bintools # For lld
     pkg-config
     zlib
   ]
@@ -163,13 +162,11 @@ stdenv.mkDerivation (finalAttrs: {
     # they cause cycles in the outputs and break the build,
     # so we simply exclude them.
     ./sycl-jit-exclude-cmake-files.patch
-
-    # Linux removed `linux/scc.h`, which breaks building compiler-rt. Upstream LLVM has fixed it in LLVM 22 and 23.
-    # The same patch is applied in d5b6cbf (llvmPackages_{18,19,20,21}.compiler-rt: backport santizier fix for Linux)
-    (fetchpatch {
-      url = "https://github.com/llvm/llvm-project/commit/3dc4fd6dd41100f051a63642f449b16324389c96.patch?full_index=1";
-      hash = "sha256-BJwFPeYCBO+PnUMMC/3GSYPgn0vczkkbdw5qcnURPbI=";
-    })
+    # These unqualified calls also find the other ipc::*::put overloads through
+    # the friend declarations on ipc::handle, which GCC rejects as ambiguous in
+    # C++20 mode, breaking any host code that includes <sycl/sycl.hpp>.
+    # Upstream PR: https://github.com/intel/llvm/pull/23628
+    ./ambiguous-ipc-put.patch
   ];
 
   postPatch = ''
@@ -182,6 +179,11 @@ stdenv.mkDerivation (finalAttrs: {
     substituteInPlace libdevice/cmake/modules/SYCLLibdevice.cmake \
       --replace-fail "\''${clang_exe}" "${ccWrapperStub}/bin/clang++"
 
+    # The driver links the SYCL runtime (libsycl.so, libsycl-devicelib-host.a)
+    # by absolute path from <bindir>/../lib, but they're installed into $lib.
+    substituteInPlace clang/lib/Driver/ToolChains/SYCL.cpp \
+      --replace-fail 'SYCLRTLibPath = DriverDir;' 'SYCLRTLibPath = "${placeholder "lib"}/lib";'
+
     # When running without this, their CMake code copies files from the Nix store.
     # As the Nix store is read-only and COPY copies permissions by default,
     # this will lead to the copied files also being read-only.
@@ -193,19 +195,16 @@ stdenv.mkDerivation (finalAttrs: {
     # See also: https://github.com/intel/llvm/issues/19635#issuecomment-3134830708
     sed -i '/file(COPY / { /NO_SOURCE_PERMISSIONS/! s/)\s*$/ NO_SOURCE_PERMISSIONS)/ }' \
       unified-runtime/cmake/FetchLevelZero.cmake \
-      sycl/CMakeLists.txt \
-      sycl/cmake/modules/FetchEmhash.cmake
+      sycl/CMakeLists.txt
   ''
-  # v7.0.0 half-applied an upstream rename of libclc's AMD target. Without this patch,
-  # The compiler builds and links fully, but the final compiler will lack the device libraries
-  # needed for compilating to AMD.
-  # Build `pkgsRocm.intel-llvm.tests.sycl-compile-amdgcn-amd-amdhsa` to check; it fails without this patch.
-  # TODO: It's likely that we can drop this on the next update.
+  # configure.py names the AMD libclc runtime target "amdgcn-amd-amdhsa-llvm", so libclc
+  # installs libspirv under lib/clang/N/lib/amdgcn-amd-amdhsa-llvm/, but the SYCL driver
+  # looks under the device triple (amdgcn-amd-amdhsa) and can't find it.
+  # Build `pkgsRocm.intel-llvm.tests.sycl-compile-amdgcn-amd-amdhsa` to check.
+  # https://github.com/intel/llvm/issues/23531
   + lib.optionalString rocmSupport ''
-    substituteInPlace libclc/CMakeLists.txt \
-      --replace-fail $'  amdgcn-amd-amdhsa\n' $'  amdgcn-amd-amdhsa\n  amdgcn--amdhsa\n' \
-      --replace-fail 'set( amdgcn-amd-amdhsa_devices none )' \
-        $'set( amdgcn-amd-amdhsa_devices none )\nset( amdgcn--amdhsa_devices none )'
+    substituteInPlace buildbot/configure.py \
+      --replace-fail '";amdgcn-amd-amdhsa-llvm"' '";amdgcn-amd-amdhsa"'
   ''
   # These libdevice compiles target sm_75 (since v7.0.0), which needs PTX >= 6.3.
   # clang picks the PTX ISA from the CUDA version it detects, if it detects nothing it falls back to `+ptx42`.
@@ -285,6 +284,8 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.cmakeBool "LLVM_BUILD_DOCS" enableManpages)
     (lib.cmakeBool "LLVM_ENABLE_SPHINX" enableManpages)
     (lib.cmakeBool "SPHINX_OUTPUT_MAN" enableManpages)
+    (lib.cmakeBool "SPHINX_OUTPUT_HTML" false)
+    (lib.cmakeBool "SPHINX_WARNINGS_AS_ERRORS" false)
 
     # The buildbot script always enables level-zero no matter what.
     # To allow disabling level-zero, we override its flag here,
@@ -295,9 +296,14 @@ stdenv.mkDerivation (finalAttrs: {
   ]
   ++ unified-runtime.cmakeFlags;
 
-  # This hardening option causes compilation errors when compiling for amdgcn, spirv and others
-  # Must be disabled during intel-llvm's own build (especially for libdevice)
-  hardeningDisable = [ "zerocallusedregs" ];
+  hardeningDisable = [
+    # This hardening option causes compilation errors when compiling for amdgcn, spirv and others
+    # Must be disabled during intel-llvm's own build (especially for libdevice)
+    "zerocallusedregs"
+    # LLVM_ENABLE_ASSERTIONS already defines _LIBCPP_HARDENING_MODE (as extensive),
+    # and the redefinition is an error in sycl-jit, which is built with -Werror
+    "libcxxhardeningfast"
+  ];
 
   requiredSystemFeatures = [ "big-parallel" ];
   enableParallelBuilding = true;
@@ -329,6 +335,15 @@ stdenv.mkDerivation (finalAttrs: {
     moveToOutput "lib/clang/${llvmMajorVersion}" "$lib"
     substituteInPlace "$dev/include/clang/Config/config.h" \
       --replace-fail "../lib/clang/${llvmMajorVersion}" "$lib/lib/clang/${llvmMajorVersion}"
+
+    # The SYCL driver only looks for its device libraries (libsycl-*.bc) under
+    # <bindir>/../lib/dpcpp-<major>/sycl, but they're installed into $lib.
+    # Without them it silently skips linking them, leaving unresolved calls
+    # (e.g. bf16 conversions, cmath) in device code.
+    mkdir -p $out/lib
+    for dir in $lib/lib/dpcpp-*; do
+      ln -s "$dir" "$out/lib/$(basename "$dir")"
+    done
   '';
 
   passthru = {
@@ -341,7 +356,7 @@ stdenv.mkDerivation (finalAttrs: {
     # This is for easily referencing version-compatible LLVM libraries
     # and tools that aren't built in this derivation,
     # as well as nix tooling, such as the stdenv.
-    baseLlvm = llvmPackages_22;
+    baseLlvm = llvmPackages_23;
 
     inherit llvmMajorVersion;
 

pkgs/by-name/io/iosevka/package.nix

@@ -59,16 +59,16 @@ assert (extraParameters != null) -> set != null;
 
 buildNpmPackage rec {
   pname = "Iosevka${toString set}";
-  version = "34.9.0";
+  version = "34.9.1";
 
   src = fetchFromGitHub {
     owner = "be5invis";
     repo = "iosevka";
     tag = "v${version}";
-    hash = "sha256-JJBsmUtWv8n4IO2AleO/Z1CI2Vbpc1JcwfwJMEUzkLU=";
+    hash = "sha256-JMWmgWLH2Hlq52Gw8IYUV3scV714ZvaAD9Jlhv6Hb38=";
   };
 
-  npmDepsHash = "sha256-KtmL12yQUwCUCjNL6MhClbjuB4oXvYSCqBqau1CO+ss=";
+  npmDepsHash = "sha256-GbMEJgQZrAfh/UrWXlrOBWjSu7zGqtgQL6YZ77qy9m8=";
   nodejs = nodejs_latest;
 
   nativeBuildInputs = [

pkgs/by-name/jd/jdt-language-server/package.nix

@@ -7,15 +7,15 @@
 }:
 
 let
-  timestamp = "202610131109";
+  timestamp = "202610191322";
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "jdt-language-server";
-  version = "1.62.0";
+  version = "1.63.0";
 
   src = fetchurl {
     url = "https://download.eclipse.org/jdtls/milestones/${finalAttrs.version}/jdt-language-server-${finalAttrs.version}-${timestamp}.tar.gz";
-    hash = "sha256-9Yfa/YQQYzwsK/AF6FOiu7A83e6Ikz1Jv+bZyxzwk0I=";
+    hash = "sha256-sfKr4LPMy0Ys9k+0pVh8fQnfYM+L53SLFSy9idAYvcQ=";
   };
 
   sourceRoot = ".";

pkgs/by-name/jf/jffi/package.nix

@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "jffi";
-  version = "1.4.1";
+  version = "1.4.4";
 
   src = fetchFromGitHub {
     owner = "jnr";
     repo = "jffi";
     rev = "jffi-${finalAttrs.version}";
-    hash = "sha256-KprkeSMHW/g5IoRnkNaSpBi5sPiBcRcyct+Z0zPWVGU=";
+    hash = "sha256-x8g9o2OHZCIWxsCE7jdF5JRdkpaGh3kBRscxGYGoyYA=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ke/ketesa/package.nix

@@ -17,18 +17,18 @@ assert lib.asserts.assertMsg (
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ketesa";
-  version = "1.5.1";
+  version = "1.5.2";
 
   src = fetchFromGitHub {
     owner = "etkecc";
     repo = "ketesa";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-LB+e19nyIlXJ4hQJnN+G/eN8khZjj7andVzbeFpAGCg=";
+    hash = "sha256-gG8B0y1Ek3NRd/JFQd7YxIzE1777wKVivWIL0LF5KEU=";
   };
 
   yarnOfflineCache = fetchYarnDeps {
     yarnLock = finalAttrs.src + "/yarn.lock";
-    hash = "sha256-KYDQiMGeY5jwnL4iQBoCHwvbI4bHoQo08/63r6i8K0Q=";
+    hash = "sha256-yv3etGl9Ydg2/eD8ufyGc6mJbLktLjlOeSyZfcWQHOM=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ke/keymapper/package.nix

@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "keymapper";
-  version = "5.7.3";
+  version = "5.8.1";
 
   src = fetchFromGitHub {
     owner = "houmain";
     repo = "keymapper";
     tag = finalAttrs.version;
-    hash = "sha256-GGVYlND3iNPpG74BY8ylVpuE6sXCmjEHSkmGas1nBX0=";
+    hash = "sha256-h0ckQHtqKnuKGTrucYSpLzUxkVJ6cI+WE+4RP8qYxRk=";
   };
 
   # all the following must be in nativeBuildInputs

pkgs/by-name/ko/koka/package.nix

@@ -68,7 +68,7 @@ haskellPackages.mkDerivation {
     hashable
     isocline
     lens
-    lsp_2_8_0_0
+    lsp
     mtl
     network
     network-simple

pkgs/by-name/ku/kubernetes/package.nix

@@ -23,13 +23,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "kubernetes";
-  version = "1.37.1";
+  version = "1.37.2";
 
   src = fetchFromGitHub {
     owner = "kubernetes";
     repo = "kubernetes";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-9p7t8EN6Iv3Q2ClJgCgSUJP1Qdp7B47fOe0roP5jZbg=";
+    hash = "sha256-Bbyu5hMQTSrvr/kDFHlRnfz5RIR7ecBfTFOGTCffn5c=";
   };
 
   vendorHash = null;

pkgs/by-name/la/lammps/package.nix

@@ -55,7 +55,7 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  version = "22Jul2025_update5";
+  version = "30Sep2026_update1";
   pname = "lammps";
 
   __structuredAttrs = true;
@@ -65,7 +65,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "lammps";
     repo = "lammps";
     tag = "stable_${finalAttrs.version}";
-    hash = "sha256-kI4CubDgXwnDDeXNan88RzG+iGMJMnsqfpfhWtJFhAI=";
+    hash = "sha256-7WSHwQm09YkVXs0bMNs7bvrcSDD1lAk9GWkMCRlqFQE=";
   };
   preConfigure = ''
     cd cmake