apache-orc: fix build (#563013)

This gets us `--print-errorlogs` and `--timeout-multiplier=0` for free.

Port of upstream [0] and [1].

[0]: e6da29ad6b
[1]: 52872026fb

Co-authored-by: Emily <hello@emily.moe>

.github/workflows/periodic-merge.yml

@@ -32,7 +32,7 @@ jobs:
           client-id: ${{ vars.NIXPKGS_CI_CLIENT_ID }}
           private-key: ${{ secrets.NIXPKGS_CI_APP_PRIVATE_KEY }}
           permission-contents: write
-          permission-pull-requests: write
+          permission-issues: write
 
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
@@ -66,4 +66,4 @@ jobs:
             Periodic merge from `${{ inputs.from }}` into [`${{ inputs.into }}`](https://github.com/NixOS/nixpkgs/tree/${{ inputs.into }}) has [failed](https://github.com/NixOS/nixpkgs/actions/runs/${{ github.run_id }}).
           GH_TOKEN: ${{ steps.app-token.outputs.token }}
         run: |
-          gh pr comment 105153 --body "$BODY_TEXT"
+          gh issue comment 562905 --body "$BODY_TEXT"

doc/release-notes/rl-2611.section.md

@@ -29,6 +29,10 @@
 
 - `moon` has been updated to `2.x` and needs manual migration. See the [migration guide](https://moonrepo.dev/docs/migrate/2.0) for instructions.
 
+- `yeswiki` has been updated from 4.4.2 to 4.6.7 and now requires PHP 8.3 or newer.
+  The release also removes legacy JSONP endpoints and changes several security-sensitive operations from GET to POST with CSRF tokens.
+  Review the upstream [4.6.7 release notes](https://github.com/YesWiki/yeswiki/releases/tag/v4.6.7) before upgrading custom themes or integrations.
+
 - `perlPackages.NetOAuth` has been updated from 0.28 to 0.33.
   Callers that verify messages must now set `allowed_signature_methods` per message or configure `@Net::OAuth::ALLOWED_SIGNATURE_METHODS`; `verify` otherwise throws an exception.
   See the [upstream changelog](https://metacpan.org/dist/Net-OAuth/changes) for details.
@@ -133,6 +137,9 @@
 
 - `davmail` no longer supports building with GTK 2, and the `preferGtk3` override flag has been removed as GTK 3 is always used.
 
+- `fetchurl` now always enables `strictDeps`.
+  This is a backwards incompatible change if inputs other than `nativeBuildInputs` were used.
+
 - Support for the legacy U‐Boot image format has been removed from the Linux kernel builders, as it is deprecated upstream and no longer used by any platform in Nixpkgs.
 
 - `etcd_3_4` package was dropped, as it's gone EOL. Please upgrade to either 3.5 or 3.6. See [migration notes](https://etcd.io/docs/v3.6/upgrades/upgrade_3_6/) for incompatibilities and upgrade procedure.

lib/tests/modules.sh

@@ -745,6 +745,9 @@ checkConfigOutput '^38|27$' options.submoduleLine38.declarationPositions.1.line
 # nested options work
 checkConfigOutput '^34$' options.nested.nestedLine34.declarationPositions.0.line ./declaration-positions.nix
 
+# types.pathWith in-module assertions
+checkConfigOutput '"ok"' config.assertionsResult ./pathWith.nix
+
 # types.pathWith { inStore = true; }
 checkConfigOutput '".*/store/0lz9p8xhf89kb1c1kk6jxrzskaiygnlh-bash-5.2-p15.drv"' config.pathInStore.ok1 ./pathWith.nix
 checkConfigOutput '".*/store/0fb3ykw9r5hpayd05sr0cizwadzq1d8q-bash-5.2-p15"' config.pathInStore.ok2 ./pathWith.nix

lib/tests/modules/pathWith.nix

@@ -1,4 +1,4 @@
-{ lib, ... }:
+{ config, lib, ... }:
 let
   inherit (builtins)
     storeDir
@@ -12,6 +12,8 @@ in
   imports = [
     {
       options = {
+        assertionsResult = mkOption { };
+
         pathInStore = mkOption { type = types.lazyAttrsOf (types.pathWith { inStore = true; }); };
         pathNotInStore = mkOption { type = types.lazyAttrsOf (types.pathWith { inStore = false; }); };
         anyPath = mkOption { type = types.lazyAttrsOf (types.pathWith { }); };
@@ -23,6 +25,13 @@ in
             }
           );
         };
+        absolutePath = mkOption {
+          type = types.lazyAttrsOf (
+            types.pathWith {
+              absolute = true;
+            }
+          );
+        };
 
         # This conflicts with `conflictingPathOptionType` below.
         conflictingPathOptionType = mkOption { type = types.pathWith { absolute = true; }; };
@@ -85,7 +94,21 @@ in
   absolutePathNotInStore.bad1 = "./this/is/relative";
   absolutePathNotInStore.bad2 = "${storeDir}/0fb3ykw9r5hpayd05sr0cizwadzq1d8q-bash-5.2-p15";
 
+  absolutePath.ok1 = "/var/lib/postgresql";
+  absolutePath.ok2 = {
+    type = "derivation";
+    outPath = abort "do not instantiate (via outPath)";
+    drvPath = abort "do not instantiate (via drvPath)";
+    meta.description = "just a test fixture";
+  };
+
   conflictingPathOptionType = "/foo/bar";
 
   impossiblePathOptionType = "/foo/bar";
+
+  assertionsResult =
+    assert config.absolutePath.ok1 == "/var/lib/postgresql";
+    assert config.absolutePath.ok2.type == "derivation";
+    assert config.absolutePath.ok2.meta.description == "just a test fixture";
+    "ok";
 }

lib/types.nix

@@ -695,7 +695,7 @@ rec {
               else
                 /. + builtins.unsafeDiscardStringContext x
             );
-            isAbsolute = substring 0 1 (toString x) == "/";
+            isAbsolute = x.type or null == "derivation" || substring 0 1 (toString x) == "/";
             isExpectedType = (
               if inStore == null || inStore then isStringLike x else isString x # Do not allow a true path, which could be copied to the store later on.
             );

nixos/doc/manual/release-notes/rl-2611.section.md

@@ -244,6 +244,8 @@
 
 - `services.plantuml-server.packages.jetty` now supports `jetty_12`, it no longer supports `jetty_11`.
 
+- `services.sickbeard` has been removed because all remaining compatible forks were removed from Nixpkgs due to security concerns. See [#560697](https://github.com/NixOS/nixpkgs/issues/560697) for details.
+
 - `services.komodo-periphery` has been updated to support version 2.0.0. Some options have been renamed to match the new configuration structure; compatibility aliases are provided for the renamed options. The `passkeys` and `outbound.onboardingKey` options have been removed; use `passkeyFiles`, `auth.privateKey`/`auth.corePublicKeys`, or `outbound.onboardingKeyFile` instead. New outbound mode configuration is available under `outbound.*`.
 
 - `services.pdfding` has been updated to support pdfding version 1.14.0. The automated backup functionality `services.pdfding.backup` option has been removed.

nixos/modules/misc/ids.nix

@@ -302,7 +302,7 @@ in
       # stanchion = 262; # unused, removed 2020-10-14
       # riak-cs = 263; # unused, removed 2020-10-14
       infinoted = 264;
-      sickbeard = 265;
+      # sickbeard = 265; # unused, removed 2026-09-13
       headphones = 266;
       # couchpotato = 267; # unused, removed 2022-01-01
       # gogs = 268; # unused, removed in 2024-10-12
@@ -629,7 +629,7 @@ in
       # stanchion = 262; # unused, removed 2020-10-14
       # riak-cs = 263; # unused, removed 2020-10-14
       infinoted = 264;
-      sickbeard = 265;
+      # sickbeard = 265; # unused, removed 2026-09-13
       headphones = 266;
       # couchpotato = 267; # unused, removed 2022-01-01
       # gogs = 268; # unused, removed in 2024-10-12

nixos/modules/module-list.nix

@@ -1002,7 +1002,6 @@
   ./services/misc/serviio.nix
   ./services/misc/shelfmark.nix
   ./services/misc/shoko.nix
-  ./services/misc/sickbeard.nix
   ./services/misc/snapper.nix
   ./services/misc/soft-serve.nix
   ./services/misc/spice-autorandr.nix

nixos/modules/services/misc/sickbeard.nix

@@ -1,94 +0,0 @@
-{
-  config,
-  lib,
-  options,
-  pkgs,
-  ...
-}:
-let
-
-  name = "sickbeard";
-
-  cfg = config.services.sickbeard;
-  opt = options.services.sickbeard;
-  sickbeard = cfg.package;
-
-in
-{
-
-  ###### interface
-
-  options = {
-    services.sickbeard = {
-      enable = lib.mkOption {
-        type = lib.types.bool;
-        default = false;
-        description = "Whether to enable the sickbeard server.";
-      };
-      package = lib.mkPackageOption pkgs "sickbeard" {
-        example = "sickrage";
-        extraDescription = ''
-          Enable `pkgs.sickrage` or `pkgs.sickgear`
-          as an alternative to SickBeard
-        '';
-      };
-      dataDir = lib.mkOption {
-        type = lib.types.path;
-        default = "/var/lib/${name}";
-        description = "Path where to store data files.";
-      };
-      configFile = lib.mkOption {
-        type = lib.types.path;
-        default = "${cfg.dataDir}/config.ini";
-        defaultText = lib.literalExpression ''"''${config.${opt.dataDir}}/config.ini"'';
-        description = "Path to config file.";
-      };
-      port = lib.mkOption {
-        type = lib.types.port;
-        default = 8081;
-        description = "Port to bind to.";
-      };
-      user = lib.mkOption {
-        type = lib.types.str;
-        default = name;
-        description = "User to run the service as";
-      };
-      group = lib.mkOption {
-        type = lib.types.str;
-        default = name;
-        description = "Group to run the service as";
-      };
-    };
-  };
-
-  ###### implementation
-
-  config = lib.mkIf cfg.enable {
-
-    users.users = lib.optionalAttrs (cfg.user == name) {
-      ${name} = {
-        uid = config.ids.uids.sickbeard;
-        group = cfg.group;
-        description = "sickbeard user";
-        home = cfg.dataDir;
-        createHome = true;
-      };
-    };
-
-    users.groups = lib.optionalAttrs (cfg.group == name) {
-      ${name}.gid = config.ids.gids.sickbeard;
-    };
-
-    systemd.services.sickbeard = {
-      description = "Sickbeard Server";
-      wantedBy = [ "multi-user.target" ];
-      after = [ "network.target" ];
-
-      serviceConfig = {
-        User = cfg.user;
-        Group = cfg.group;
-        ExecStart = "${sickbeard}/bin/${sickbeard.pname} --datadir ${cfg.dataDir} --config ${cfg.configFile} --port ${toString cfg.port}";
-      };
-    };
-  };
-}

nixos/modules/services/scheduling/prefect.nix

@@ -18,6 +18,47 @@ let
     port
     ;
 
+  # `host` is a bind address, and 0.0.0.0 means "every interface" to bind(2)
+  # but nothing at all to connect(2). Workers run beside the server, so they
+  # dial it directly rather than going back out through `baseUrl` - a reverse
+  # proxy that may terminate TLS, require auth, or simply not be up yet.
+  localHost = if cfg.host == "0.0.0.0" then "127.0.0.1" else cfg.host;
+
+  # Prefect builds the SQLAlchemy URL itself from these discrete settings, so
+  # the password never has to be interpolated into a string that would land in
+  # the store. It arrives separately as PREFECT_SERVER_DATABASE_PASSWORD, from
+  # `databasePasswordFile`.
+  postgresEnvironment = [
+    "PREFECT_SERVER_DATABASE_DRIVER=postgresql+asyncpg"
+    "PREFECT_SERVER_DATABASE_HOST=${cfg.databaseHost}"
+    "PREFECT_SERVER_DATABASE_PORT=${cfg.databasePort}"
+    "PREFECT_SERVER_DATABASE_NAME=${cfg.databaseName}"
+    "PREFECT_SERVER_DATABASE_USER=${cfg.databaseUser}"
+  ];
+
+  # Identical for the server and every worker, so it is written once.
+  hardening = {
+    DynamicUser = true;
+    ProtectSystem = "strict";
+    ProtectHome = true;
+    PrivateTmp = true;
+    NoNewPrivileges = true;
+    MemoryDenyWriteExecute = true;
+    LockPersonality = true;
+    CapabilityBoundingSet = [ ];
+    AmbientCapabilities = [ ];
+    RestrictSUIDSGID = true;
+    RestrictAddressFamilies = [
+      "AF_INET"
+      "AF_INET6"
+      "AF_UNIX"
+    ];
+    ProtectKernelTunables = true;
+    ProtectKernelModules = true;
+    ProtectKernelLogs = true;
+    ProtectControlGroups = true;
+    MemoryAccounting = true;
+  };
 in
 {
   options.services.prefect = {
@@ -46,7 +87,9 @@ in
       type = path;
       default = "/var/lib/prefect-server";
       description = ''
-        Specify the directory for Prefect.
+        Working directory for the server. Note that Prefect's own state -
+        including the SQLite database - lives in the unit's `StateDirectory`
+        rather than here, since the service runs as a `DynamicUser`.
       '';
     };
 
@@ -86,11 +129,19 @@ in
     databasePasswordFile = lib.mkOption {
       type = nullOr str;
       default = null;
+      example = "/run/secrets/prefect-database-password";
       description = ''
-        path to a file containing e.g.:
-          DBPASSWORD=supersecret
+        Path to a file containing the postgres password as an environment
+        variable assignment:
 
-        stored outside the nix store, read by systemd as EnvironmentFile.
+        ```
+        PREFECT_SERVER_DATABASE_PASSWORD=supersecret
+        ```
+
+        Stored outside the nix store, read by systemd as an `EnvironmentFile`.
+
+        Leave `null` when postgres authenticates the server some other way,
+        such as peer authentication over a unix socket.
       '';
     };
 
@@ -121,9 +172,15 @@ in
     };
 
     baseUrl = lib.mkOption {
-      type = nullOr str;
-      default = null;
-      description = "external url when served by a reverse proxy, e.g. `https://example.com/prefect`";
+      type = str;
+      default = "http://${localHost}:${toString cfg.port}";
+      defaultText = lib.literalExpression ''"http://''${host}:''${toString port}"'';
+      example = "https://example.com/prefect";
+      description = ''
+        External url the UI is reached at, when served by a reverse proxy.
+        Defaults to the address the server itself binds, which is what you
+        want when there is no proxy in front of it.
+      '';
     };
   };
 
@@ -135,44 +192,20 @@ in
         wantedBy = [ "multi-user.target" ];
         after = [ "network.target" ];
 
-        serviceConfig = {
-          DynamicUser = true;
+        serviceConfig = hardening // {
           StateDirectory = "prefect-server";
-          # TODO all my efforts to setup the database url
-          # have failed with some unable to open file
           Environment = [
             "PREFECT_HOME=%S/prefect-server"
             "PREFECT_UI_STATIC_DIRECTORY=%S/prefect-server"
             "PREFECT_SERVER_ANALYTICS_ENABLED=off"
             "PREFECT_UI_API_URL=${cfg.baseUrl}/api"
             "PREFECT_UI_URL=${cfg.baseUrl}"
-          ];
-          EnvironmentFile =
-            if cfg.database == "postgres" && cfg.databasePasswordFile != null then
-              [ cfg.databasePasswordFile ]
-            else
-              [ ];
+          ]
+          ++ lib.optionals (cfg.database == "postgres") postgresEnvironment;
 
-          # ReadWritePaths = [ cfg.dataDir ];
-          ProtectSystem = "strict";
-          ProtectHome = true;
-          PrivateTmp = true;
-          NoNewPrivileges = true;
-          MemoryDenyWriteExecute = true;
-          LockPersonality = true;
-          CapabilityBoundingSet = [ ];
-          AmbientCapabilities = [ ];
-          RestrictSUIDSGID = true;
-          RestrictAddressFamilies = [
-            "AF_INET"
-            "AF_INET6"
-            "AF_UNIX"
-          ];
-          ProtectKernelTunables = true;
-          ProtectKernelModules = true;
-          ProtectKernelLogs = true;
-          ProtectControlGroups = true;
-          MemoryAccounting = true;
+          EnvironmentFile = lib.optional (
+            cfg.database == "postgres" && cfg.databasePasswordFile != null
+          ) cfg.databasePasswordFile;
 
           ExecStart = "${lib.getExe cfg.package} server start --host ${cfg.host} --port ${toString cfg.port}";
           Restart = "always";
@@ -185,36 +218,21 @@ in
       "prefect-worker-${poolName}" = {
         description = "prefect worker for pool '${poolName}'";
         wantedBy = [ "multi-user.target" ];
-        after = [ "network.target" ];
+        after = [
+          "network.target"
+          "prefect-server.service"
+        ];
 
-        environment.systemPackages = cfg.package;
+        # A process worker shells out to prefect for every flow run it picks
+        # up, so the package has to be on its PATH and not merely in ExecStart.
+        path = [ cfg.package ];
 
-        serviceConfig = {
-          DynamicUser = true;
+        serviceConfig = hardening // {
           StateDirectory = "prefect-worker-${poolName}";
           Environment = [
             "PREFECT_HOME=%S/prefect-worker-${poolName}"
-            "PREFECT_API_URL=${cfg.baseUrl}/api"
+            "PREFECT_API_URL=http://${localHost}:${toString cfg.port}/api"
           ];
-          ProtectSystem = "strict";
-          ProtectHome = true;
-          PrivateTmp = true;
-          NoNewPrivileges = true;
-          MemoryDenyWriteExecute = true;
-          LockPersonality = true;
-          CapabilityBoundingSet = [ ];
-          AmbientCapabilities = [ ];
-          RestrictSUIDSGID = true;
-          RestrictAddressFamilies = [
-            "AF_INET"
-            "AF_INET6"
-            "AF_UNIX"
-          ];
-          ProtectKernelTunables = true;
-          ProtectKernelModules = true;
-          ProtectKernelLogs = true;
-          ProtectControlGroups = true;
-          MemoryAccounting = true;
           ExecStart = ''
             ${lib.getExe cfg.package} worker start \
               --pool ${poolName} \
@@ -226,4 +244,6 @@ in
       };
     }) cfg.workerPools;
   };
+
+  meta.maintainers = with lib.maintainers; [ happysalada ];
 }

nixos/modules/services/security/warpgate.nix

@@ -45,6 +45,17 @@ in
         default = null;
       };
 
+      databaseEncryptionKeysFile = mkOption {
+        description = ''
+          Path to file containing encryption key(s) to encrypt target credentials stored in database.
+          Should be a env-like file: `WARPGATE_ENCRYPTION_KEY=$(openssl rand -base64 32)`.
+          If you are rotating key, move the old key to `WARPGATE_ENCRYPTION_KEY_OLD`.
+          See [Encrypting credentials at rest](https://warpgate.null.page/encryption/).
+        '';
+        type = nullOr str;
+        default = null;
+      };
+
       settings = mkOption {
         description = "Warpgate configuration.";
         type = submodule {
@@ -120,18 +131,6 @@ in
                 ]
               '';
             };
-            recordings = {
-              enable = mkOption {
-                description = "Whether to enable session recording.";
-                default = true;
-                type = bool;
-              };
-              path = mkOption {
-                description = "Path to store session recordings.";
-                default = "/var/lib/warpgate/recordings";
-                type = str;
-              };
-            };
             external_host = mkOption {
               description = ''
                 Configure the domain name of this Warpgate instance.
@@ -160,6 +159,11 @@ in
                 default = "[::]:2222";
                 type = str;
               };
+              proxy_protocol = mkOption {
+                description = "Accept HAProxy PROXY protocol v1/v2 headers from upstream reverse proxy.";
+                default = false;
+                type = bool;
+              };
               external_host = mkOption {
                 description = "The SSH listener is reachable via this domain name externally.";
                 default = null;
@@ -201,6 +205,11 @@ in
                 default = "[::]:8888";
                 type = str;
               };
+              proxy_protocol = mkOption {
+                description = "Accept HAProxy PROXY protocol v1/v2 headers from upstream reverse proxy.";
+                default = false;
+                type = bool;
+              };
               external_host = mkOption {
                 description = "The HTTP listener is reachable via this domain name externally.";
                 default = null;
@@ -270,6 +279,88 @@ in
                 type = str;
               };
             };
+            rdp = {
+              enable = mkOption {
+                description = "Whether to enable RDP listener.";
+                default = false;
+                type = bool;
+              };
+              listen = mkOption {
+                description = "Listen endpoint of RDP listener.";
+                default = "[::]:3389";
+                type = str;
+              };
+              proxy_protocol = mkOption {
+                description = "Accept HAProxy PROXY protocol v1/v2 headers from the listener's peer.";
+                default = false;
+                type = bool;
+              };
+              external_host = mkOption {
+                description = "The RDP listener is reachable via this domain name externally.";
+                default = null;
+                type = nullOr str;
+              };
+              external_port = mkOption {
+                description = "The RDP listener is reachable via this port externally.";
+                default = null;
+                type = nullOr str;
+              };
+              certificate = mkOption {
+                description = "Path to RDP listener certificate.";
+                default = "/var/lib/warpgate/tls.certificate.pem";
+                type = str;
+              };
+              key = mkOption {
+                description = "Path to RDP listener private key.";
+                default = "/var/lib/warpgate/tls.key.pem";
+                type = str;
+              };
+            };
+            vnc = {
+              enable = mkOption {
+                description = "Whether to enable VNC listener.";
+                default = false;
+                type = bool;
+              };
+              listen = mkOption {
+                description = "Listen endpoint of VNC listener.";
+                default = "[::]:5900";
+                type = str;
+              };
+              proxy_protocol = mkOption {
+                description = "Accept HAProxy PROXY protocol v1/v2 headers from the listener's peer.";
+                default = false;
+                type = bool;
+              };
+              external_host = mkOption {
+                description = "The VNC listener is reachable via this domain name externally.";
+                default = null;
+                type = nullOr str;
+              };
+              external_port = mkOption {
+                description = "The VNC listener is reachable via this port externally.";
+                default = null;
+                type = nullOr str;
+              };
+              certificate = mkOption {
+                description = "Path to VNC listener certificate.";
+                default = "/var/lib/warpgate/tls.certificate.pem";
+                type = str;
+              };
+              key = mkOption {
+                description = "Path to VNC listener private key.";
+                default = "/var/lib/warpgate/tls.key.pem";
+                type = str;
+              };
+              enable_ard_auth = mkOption {
+                description = ''
+                  Enable Apple-DH (Apple Remote Desktop / type 30) auth, which is to ensure compatibility with Apple clients.
+                  However [connections from macOS built-in VNC client with ARD auth is not supported](https://github.com/warp-tech/warpgate/blob/47e676969a0b1e0b8456f9a5f1474d6c58648c4f/warpgate-protocol-vnc/src/server/rfb.rs#L8-L10).
+                '';
+                default = false;
+                type = bool;
+              };
+            };
             mysql = {
               enable = mkOption {
                 description = "Whether to enable MySQL listener.";
@@ -281,6 +372,11 @@ in
                 default = "[::]:33306";
                 type = str;
               };
+              proxy_protocol = mkOption {
+                description = "Accept HAProxy PROXY protocol v1/v2 headers from upstream reverse proxy.";
+                default = false;
+                type = bool;
+              };
               external_host = mkOption {
                 description = "The MySQL listener is reachable via this domain name externally.";
                 default = null;
@@ -301,6 +397,14 @@ in
                 default = "/var/lib/warpgate/tls.key.pem";
                 type = str;
               };
+              advertised_version = mkOption {
+                description = ''
+                  The server version advertised to clients during the handshake.
+                  Warpgate can't auto-match the target's version since the target is only known after the handshake, but Warpgate's clients use it to pick a protocol dialect.
+                '';
+                default = "8.0.3-Warpgate";
+                type = str;
+              };
             };
             postgres = {
               enable = mkOption {
@@ -313,6 +417,11 @@ in
                 default = "[::]:55432";
                 type = str;
               };
+              proxy_protocol = mkOption {
+                description = "Accept HAProxy PROXY protocol v1/v2 headers from upstream reverse proxy.";
+                default = false;
+                type = bool;
+              };
               external_host = mkOption {
                 description = "The PostgreSQL listener is reachable via this domain name externally.";
                 default = null;
@@ -345,6 +454,11 @@ in
                 default = "[::]:8443";
                 type = str;
               };
+              proxy_protocol = mkOption {
+                description = "Accept HAProxy PROXY protocol v1/v2 headers from upstream reverse proxy.";
+                default = false;
+                type = bool;
+              };
               external_host = mkOption {
                 description = "The Kubernetes listener is reachable via this domain name externally.";
                 default = null;
@@ -420,36 +534,45 @@ in
         any
         map
         head
+        optional
         reverseList
         ;
-      inherit (lib.strings) splitString toIntBase10;
+      inherit (lib.strings)
+        optionalString
+        splitString
+        toIntBase10
+        ;
 
-      preStartScript = pkgs.writers.writeBash "warpgate-init" ''
-        CFGFILE=/var/lib/warpgate/config.yaml
+      renderedYamlConfig = yaml.generate "warpgate-config" cfg.settings;
+
+      startupScript = pkgs.writeShellScript "warpgate-run" ''
+        CFGFILE=$STATE_DIRECTORY/config.yaml
         if [ ! -O $CFGFILE ] || [ ! -s $CFGFILE ]; then
           INITPWD=$(tr -dc 'A-Za-z0-9!?%=' </dev/urandom 2>/dev/null | head -c 16)
           ${lib.getExe cfg.package} \
             --config $CFGFILE unattended-setup \
-            --data-path /var/lib/warpgate \
+            --data-path $STATE_DIRECTORY \
             --http-port 8888 \
             --admin-password $INITPWD
         fi
-        ${
-          if cfg.databaseUrlFile != null then
-            ''
-              sed -e '/^database_url: null/d' ${yaml.generate "warpgate-config" cfg.settings} > $CFGFILE
-              cat /run/credentials/warpgate.service/databaseUrl >> $CFGFILE
-            ''
-          else
-            "cp --no-preserve=ownership ${yaml.generate "warpgate-config" cfg.settings} $CFGFILE"
-        }
+        cp --no-preserve=ownership ${renderedYamlConfig} $CFGFILE
+        ${optionalString (cfg.databaseUrlFile != null) ''
+          sed -e '/^database_url: null/d' ${renderedYamlConfig} > $CFGFILE
+          cat $CREDENTIALS_DIRECTORY/databaseUrl >> $CFGFILE
+        ''}
+        ${optionalString (cfg.databaseEncryptionKeysFile != null) ''
+          set -a
+          source $CREDENTIALS_DIRECTORY/dbEncryptionKeys
+          set +a
+        ''}
+        ${lib.getExe cfg.package} --config $CFGFILE run
       '';
       bindOnPrivilegedPorts = any (x: toIntBase10 x < 1025) (
         map (x: head (reverseList (splitString ":" x))) (
           [ cfg.settings.http.listen ]
-          ++ lib.optional cfg.settings.ssh.enable cfg.settings.ssh.listen
-          ++ lib.optional cfg.settings.mysql.enable cfg.settings.mysql.listen
-          ++ lib.optional cfg.settings.postgres.enable cfg.settings.postgres.listen
+          ++ optional cfg.settings.ssh.enable cfg.settings.ssh.listen
+          ++ optional cfg.settings.mysql.enable cfg.settings.mysql.listen
+          ++ optional cfg.settings.postgres.enable cfg.settings.postgres.listen
         )
       );
     in
@@ -467,6 +590,10 @@ in
           assertion = !(lib.hasAttr "config_provider" cfg.settings);
           message = "`services.warpgate.settings.config_provider` is a legacy option that has been removed since 0.14.0. Please do not set this option.";
         }
+        {
+          assertion = !(lib.hasAttr "recordings" cfg.settings);
+          message = "`services.warpgate.settings.recordings` has been deprecated by S3 recording storage support in 0.27.0. Please remove this section from your config and set it from admin UI.";
+        }
       ];
 
       environment.systemPackages = [ cfg.package ];
@@ -474,14 +601,16 @@ in
       systemd.services.warpgate = {
         description = "Warpgate smart bastion";
         wantedBy = [ "multi-user.target" ];
-        after = [ "network.target" ];
+        wants = [ "network-online.target" ];
+        after = [ "network-online.target" ];
         startLimitBurst = 5;
         serviceConfig = {
-          LoadCredential = "${
-            if cfg.databaseUrlFile != null then "databaseUrl:${cfg.databaseUrlFile}" else ""
-          }";
-          ExecStartPre = preStartScript;
-          ExecStart = "${lib.getExe cfg.package} --config /var/lib/warpgate/config.yaml run";
+          LoadCredential =
+            optional (cfg.databaseUrlFile != null) "databaseUrl:${cfg.databaseUrlFile}"
+            ++ optional (
+              cfg.databaseEncryptionKeysFile != null
+            ) "dbEncryptionKeys:${cfg.databaseEncryptionKeysFile}";
+          ExecStart = startupScript;
           DynamicUser = true;
           RestartSec = 3;
           Restart = "on-failure";

nixos/modules/services/web-servers/phpfpm/default.nix

@@ -47,12 +47,14 @@ let
     poolOpts:
     pkgs.runCommand "php.ini"
       {
-        inherit (poolOpts) phpPackage phpOptions;
+        inherit (poolOpts) phpOptions;
         preferLocalBuild = true;
-        passAsFile = [ "phpOptions" ];
+        __structuredAttrs = true;
       }
       ''
-        cat ${poolOpts.phpPackage}/etc/php.ini $phpOptionsPath > $out
+        ( cat ${poolOpts.phpPackage}/etc/php.ini
+          printf "%s" "$phpOptions"
+        ) > $out
       '';
 
   poolOpts =

nixos/tests/freshrss/none-auth.nix

@@ -15,6 +15,6 @@
     machine.wait_for_unit("multi-user.target")
     machine.wait_for_open_port(80)
     response = machine.succeed("curl --fail-with-body --silent http://localhost:80/i/")
-    assert '<title> · FreshRSS</title>' in response, "FreshRSS stream page didn't load successfully"
+    assert '<title>FreshRSS</title>' in response, "FreshRSS stream page didn't load successfully"
   '';
 }

nixos/tests/prefect.nix

@@ -1,28 +1,81 @@
 { lib, ... }:
 let
-  mainPort = "4200";
+  mainPort = 4200;
 in
 {
   name = "prefect";
 
   nodes = {
+    # No `baseUrl`: the module has to stand up on its defaults alone. It used
+    # to interpolate a null one into PREFECT_UI_API_URL and fail to evaluate.
     machine =
       { ... }:
       {
         services.prefect = {
           enable = true;
-          baseUrl = "http://127.0.0.1";
+          workerPools.default.installPolicy = "never";
         };
       };
+
+    postgres =
+      { pkgs, ... }:
+      {
+        services.prefect = {
+          enable = true;
+          database = "postgres";
+          databaseUser = "prefect";
+          databasePasswordFile = "/etc/prefect-db-password";
+        };
+
+        environment.etc."prefect-db-password".text = ''
+          PREFECT_SERVER_DATABASE_PASSWORD=hunter2
+        '';
+
+        services.postgresql = {
+          enable = true;
+          # Prefect owns the database, which since PostgreSQL 15 is also what
+          # gets it CREATE on the public schema - `ensureDatabases` would leave
+          # the database owned by postgres and prefect unable to migrate.
+          initialScript = pkgs.writeText "prefect-init.sql" ''
+            CREATE ROLE prefect LOGIN PASSWORD 'hunter2';
+            CREATE DATABASE prefect OWNER prefect;
+          '';
+        };
+
+        systemd.services.prefect-server.after = [ "postgresql.service" ];
+      };
   };
 
   testScript = ''
-    machine.start()
-    machine.wait_for_unit("prefect-server.service")
-    machine.wait_for_open_port(${mainPort})
+    import datetime as dt
+
+    start_all()
+
+    with subtest("server comes up on its default settings"):
+        machine.wait_for_unit("prefect-server.service")
+        machine.wait_for_open_port(${toString mainPort})
+        machine.succeed("curl -sSf http://127.0.0.1:${toString mainPort}/api/health")
+
+    with subtest("worker registers its pool against the local api"):
+        machine.wait_for_unit("prefect-worker-default.service")
+        machine.wait_until_succeeds(
+            "curl -sSf http://127.0.0.1:${toString mainPort}/api/work_pools/default",
+            timeout=dt.timedelta(seconds=60),
+        )
+
+    with subtest("server talks to postgres rather than falling back to sqlite"):
+        postgres.wait_for_unit("postgresql.service")
+        postgres.wait_for_unit("prefect-server.service")
+        postgres.wait_for_open_port(${toString mainPort})
+        postgres.succeed("curl -sSf http://127.0.0.1:${toString mainPort}/api/health")
+        # the sqlite database would live here if the postgres settings were ignored
+        postgres.fail("test -e /var/lib/prefect-server/prefect.db")
+        postgres.succeed(
+            "sudo -u postgres psql -d prefect -c '\\dt' | grep -q flow_run"
+        )
   '';
 
-  meta = with lib.maintainers; {
-    maintainers = [ happysalada ];
+  meta = {
+    maintainers = with lib.maintainers; [ happysalada ];
   };
 }

nixos/tests/prometheus-exporters.nix

@@ -1403,26 +1403,23 @@ let
           settings = {
             targets = [
               {
-                "localhost" = {
-                  alias = "local machine";
-                  env = "prod";
-                  type = "domain";
-                };
+                host = "localhost";
+                alias = "local machine";
+                env = "prod";
+                type = "domain";
               }
               {
-                "127.0.0.1" = {
-                  alias = "local machine";
-                  type = "v4";
-                };
+                host = "127.0.0.1";
+                alias = "local machine";
+                type = "v4";
               }
               {
-                "::1" = {
-                  alias = "local machine";
-                  type = "v6";
-                };
+                host = "::1";
+                alias = "local machine";
+                type = "v6";
               }
               {
-                "google.com" = { };
+                host = "google.com";
               }
             ];
             dns = { };

nixos/tests/spacecookie.nix

@@ -47,8 +47,10 @@ in
     # sanity check on the directory listing: we serve a directory and a file
     # via gopher, so the directory listing should have exactly two entries,
     # one with gopher file type 0 (file) and one with file type 1 (directory).
+    # note that the menu is CRLF-terminated and ends with a "." line
+    # which is not a directory entry, but the end of the response.
     dirResponse = ${gopherClient}.succeed("curl -f -s gopher://${gopherHost}")
-    dirEntries = [l[0] for l in dirResponse.split("\n") if len(l) > 0]
+    dirEntries = [l[0] for l in dirResponse.split("\r\n") if len(l) > 0 and l != "."]
     dirEntries.sort()
 
     if not (["0", "1"] == dirEntries):

nixos/tests/warpgate.nix

@@ -1,3 +1,4 @@
+{ pkgs, ... }:
 {
   name = "warpgate";
 
@@ -9,14 +10,29 @@
     };
 
     machine2 = {
-      environment.etc."warpgate-db-url".text = "database: sqlite:/var/lib/warpgate/db/";
+      environment.etc."warpgate-db-url".text =
+        "database_url: postgresql://warpgate:warpgate@localhost:5432/warpgate";
+      environment.etc."warpgate-db-enc".text =
+        "WARPGATE_ENCRYPTION_KEY=QVJBTkRPTTMyQ0hBUkFDVEVSU0VOQ1JZUFRJT05LRVk=";
       services.warpgate = {
         enable = true;
         databaseUrlFile = "/etc/warpgate-db-url";
+        databaseEncryptionKeysFile = "/etc/warpgate-db-enc";
         settings = {
           database_url = null;
         };
       };
+      services.postgresql = {
+        enable = true;
+        initialScript = pkgs.writeText "psql-init" ''
+          CREATE ROLE warpgate WITH LOGIN PASSWORD 'warpgate';
+          CREATE DATABASE warpgate WITH OWNER warpgate;
+        '';
+      };
+      systemd.services.warpgate = {
+        after = [ "postgresql.target" ];
+        requires = [ "postgresql.target" ];
+      };
     };
 
     machine3 = {
@@ -24,6 +40,12 @@
         enable = true;
         settings = {
           http.listen = "[::]:443";
+          ssh.enable = true;
+          rdp.enable = true;
+          vnc.enable = true;
+          mysql.enable = true;
+          postgres.enable = true;
+          kubernetes.enable = true;
         };
       };
     };
@@ -43,6 +65,12 @@
 
     machine3.wait_for_unit("warpgate.service")
     machine3.wait_for_open_port(443)
+    machine3.wait_for_open_port(2222)
+    machine3.wait_for_open_port(3389)
+    machine3.wait_for_open_port(5900)
+    machine3.wait_for_open_port(33306)
+    machine3.wait_for_open_port(55432)
+    machine3.wait_for_open_port(8443)
     machine3.succeed("curl -k --fail https://localhost/@warpgate")
     machine3.shutdown()
   '';

nixos/tests/wordpress.nix

@@ -87,9 +87,9 @@ rec {
       )
       { }
       [
-        "6_8"
         "6_9"
         "7_0"
+        "7_1"
       ];
 
   testScript = ''

pkgs/applications/editors/emacs/elisp-packages/manual-packages/ghostel/package.nix

@@ -58,13 +58,13 @@ in
 melpaBuild (finalAttrs: {
   pname = "ghostel";
 
-  version = "0.52.0";
+  version = "0.53.0";
 
   src = fetchFromGitHub {
     owner = "dakra";
     repo = "ghostel";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Z+MPF/2d3JMx1KCExQ3giE3fHD9zY3alFj2QcVbtpWk=";
+    hash = "sha256-ZzRf/3QoG499S2bJhA+wnphqX0KDiY+Pe7yENKh8AV4=";
   };
 
   # these can be put into mkModule, but we put them here to ease user overrideAttrs

pkgs/applications/editors/jetbrains/ides/goland.nix

@@ -14,16 +14,16 @@ let
   # update-script-start: urls
   urls = {
     x86_64-linux = {
-      url = "https://download.jetbrains.com/go/goland-2026.2.0.1.tar.gz";
-      hash = "sha256-nT/jmw0WFNwmtWR5be0KBUHJpM48phhYN7oUNOMCrok=";
+      url = "https://download.jetbrains.com/go/goland-2026.2.2.1.tar.gz";
+      hash = "sha256-ENJ699YXT798jpTQQVpFwTvlhvXbQlwQMQxE3zXxVHE=";
     };
     aarch64-linux = {
-      url = "https://download.jetbrains.com/go/goland-2026.2.0.1-aarch64.tar.gz";
-      hash = "sha256-t6vH7fxtysgprc1EHH3XiIdHD6oCMcY/a1hu5aiYMxE=";
+      url = "https://download.jetbrains.com/go/goland-2026.2.2.1-aarch64.tar.gz";
+      hash = "sha256-JxQLaXRb5nOKWQ/ZrpBoDotiauahIZy+VuuqZnxYfy0=";
     };
     aarch64-darwin = {
-      url = "https://download.jetbrains.com/go/goland-2026.2.0.1-aarch64.dmg";
-      hash = "sha256-zrQAsOOR4OhAXnebwnRk3da4h4Gi0t8f+SIaEAiwM0Q=";
+      url = "https://download.jetbrains.com/go/goland-2026.2.2.1-aarch64.dmg";
+      hash = "sha256-xTTNC4J1rRHtR+wZkZsDQX1x+BdYbhHb6ehOh/ToCMY=";
     };
   };
   # update-script-end: urls
@@ -37,8 +37,8 @@ in
   product = "Goland";
 
   # update-script-start: version
-  version = "2026.2.0.1";
-  buildNumber = "262.8665.336";
+  version = "2026.2.2.1";
+  buildNumber = "262.10315.160";
   # update-script-end: version
 
   src = fetchurl (urls.${system} or (throw "Unsupported system: ${system}"));

pkgs/applications/editors/jetbrains/ides/idea.nix

@@ -17,16 +17,16 @@ let
   # update-script-start: urls
   urls = {
     x86_64-linux = {
-      url = "https://download.jetbrains.com/idea/ideaIU-2026.2.0.1.tar.gz";
-      hash = "sha256-kU4x4xtOEoXVOM8/rlswCvCLz/NrwpisYgBQS74S8YA=";
+      url = "https://download.jetbrains.com/idea/ideaIU-2026.2.2.tar.gz";
+      hash = "sha256-8cxTKaet86s72IhnRBA/fTvPHKEuaZdi7Nm//lczX4s=";
     };
     aarch64-linux = {
-      url = "https://download.jetbrains.com/idea/ideaIU-2026.2.0.1-aarch64.tar.gz";
-      hash = "sha256-HkRhBq1vh1iRjshmX+D9cT1iSRZk/NEz6YkTwWhKl0g=";
+      url = "https://download.jetbrains.com/idea/ideaIU-2026.2.2-aarch64.tar.gz";
+      hash = "sha256-BLq6b7EDSuv7+G6LVRhsgYuT27vhMQEpdXGP9/cHQPU=";
     };
     aarch64-darwin = {
-      url = "https://download.jetbrains.com/idea/ideaIU-2026.2.0.1-aarch64.dmg";
-      hash = "sha256-vN2wVaM5V9H5Xnrjv9MIKT0PgSJQqrk5kWQWOqEYOZ8=";
+      url = "https://download.jetbrains.com/idea/ideaIU-2026.2.2-aarch64.dmg";
+      hash = "sha256-9KRfRRAIyGzk6TQtWTH9ichVP506tugBLadTPp/lwkk=";
     };
   };
   # update-script-end: urls
@@ -41,8 +41,8 @@ jetbrains.mkJetBrainsProduct {
   productShort = "IDEA";
 
   # update-script-start: version
-  version = "2026.2.0.1";
-  buildNumber = "262.8665.337";
+  version = "2026.2.2";
+  buildNumber = "262.10315.125";
   # update-script-end: version
 
   src = fetchurl (urls.${system} or (throw "Unsupported system: ${system}"));

pkgs/applications/editors/vim/plugins/generated.nix

@@ -5923,6 +5923,20 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  fcitx-nvim = buildVimPlugin {
+    pname = "fcitx.nvim";
+    version = "0-unstable-2026-08-28";
+    src = fetchFromGitHub {
+      owner = "h-hg";
+      repo = "fcitx.nvim";
+      rev = "72cf374c6011a7f2e0bc5f896adba4e62700e41c";
+      hash = "sha256-nv38gSq6X7Q0aPdAknGjwfh8Bn+AxTpgUYK9kNyKfM8=";
+    };
+    meta.homepage = "https://github.com/h-hg/fcitx.nvim/";
+    meta.license = getLicenseFromSpdxId "MIT";
+    meta.hydraPlatforms = [ ];
+  };
+
   fcitx-vim = buildVimPlugin {
     pname = "fcitx.vim";
     version = "1.2.6-unstable-2025-12-28";

pkgs/applications/editors/vim/plugins/non-generated/blink-pairs/default.nix

@@ -9,13 +9,13 @@
   nix-update-script,
 }:
 let
-  version = "0.7.0";
+  version = "0.7.1";
 
   src = fetchFromGitHub {
     owner = "Saghen";
     repo = "blink.pairs";
     tag = "v${version}";
-    hash = "sha256-h5qpbo/SPTstxPUu3/7iRB8Bx3P4TSzQYGbHqN6XwAM=";
+    hash = "sha256-HrBUKw1qWRmciiPgBkjTArDxmYayKXesQafJixvUpbc=";
   };
 
   blink-pairs-lib = rustPlatform.buildRustPackage {

pkgs/applications/editors/vim/plugins/vim-plugin-names

@@ -421,6 +421,7 @@ https://github.com/Chaitanyabsprip/fastaction.nvim/,,
 https://github.com/pteroctopus/faster.nvim/,,
 https://github.com/konfekt/fastfold/,,
 https://github.com/madskjeldgaard/faust-nvim/,,
+https://github.com/h-hg/fcitx.nvim/,,
 https://github.com/lilydjwg/fcitx.vim/,fcitx5,
 https://github.com/micampe/fennel.vim/,,
 https://github.com/wincent/ferret/,,

pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix

@@ -21,22 +21,22 @@ vscode-utils.buildVscodeMarketplaceExtension (finalAttrs: {
       sources = {
         "x86_64-linux" = {
           arch = "linux-x64";
-          hash = "sha256-f34zyvfUc5EyDaq6Nz+qVMk8DdiHZHVrGzVH1y8LfnM=";
+          hash = "sha256-4zsbiDEjApU4V7Cgn6ZdwT9y1Ycw5xEHOFomow3dhkA=";
         };
         "aarch64-linux" = {
           arch = "linux-arm64";
-          hash = "sha256-ypkHDYDgJnchSV6+PKMm4tjM0KhYYHAWZ70w0+AW99c=";
+          hash = "sha256-XBxsHACZV6nHsYEA9VzrDd2rbAIbeXyGBdtQf/pT814=";
         };
         "aarch64-darwin" = {
           arch = "darwin-arm64";
-          hash = "sha256-K8HuUbXcK9S9a/9hqxOMRpwK4m1TcFEfXhInWdr4SQQ=";
+          hash = "sha256-0dLJV/XDo7HffO3FzSBqRqm59V4fXjDlf3TpJK5NndQ=";
         };
       };
     in
     {
       name = "claude-code";
       publisher = "anthropic";
-      version = "2.1.268";
+      version = "2.1.270";
     }
     // sources.${stdenvNoCC.hostPlatform.system}
       or (throw "Unsupported system ${stdenvNoCC.hostPlatform.system}");

pkgs/applications/editors/vscode/extensions/default.nix

@@ -2148,8 +2148,8 @@ let
         mktplcRef = {
           name = "vscode-graphql-syntax";
           publisher = "GraphQL";
-          version = "1.3.10";
-          hash = "sha256-EY6BHl5ICcs3FuuenoadDXLLPSe8+2VAAydqo/YrtaE=";
+          version = "1.3.13";
+          hash = "sha256-hGiqdkR1INLf29KLrZmxbFUILO8bA0pgjALQzskbn2Q=";
         };
         meta = {
           description = "Adds full GraphQL syntax highlighting and language support such as bracket matching";

pkgs/applications/graphics/gimp/default.nix

@@ -197,7 +197,10 @@ stdenv.mkDerivation (finalAttrs: {
     # New file dialogue crashes with “Icon 'image-missing' not present in theme Symbolic” without an icon theme.
     adwaita-icon-theme
 
-    # for Lua plug-ins
+  ]
+  # for Lua plug-ins; LuaJIT is unavailable on riscv64
+  # https://github.com/LuaJIT/LuaJIT/issues/628
+  ++ lib.optionals (lib.meta.availableOn stdenv.hostPlatform luajit) [
     (luajit.withPackages (pp: [
       pp.lgi
     ]))

pkgs/applications/graphics/inkscape/default.nix

@@ -13,7 +13,7 @@
   gettext,
   ghostscript,
   glib,
-  glibmm,
+  glibmm_2_4,
   gobject-introspection,
   gsl,
   gspell,
@@ -153,7 +153,7 @@ stdenv.mkDerivation (finalAttrs: {
     boost
     gettext
     glib
-    glibmm
+    glibmm_2_4
     gsl
     gtkmm3
     gtksourceview4

pkgs/applications/networking/browsers/brave/make-brave.nix

@@ -310,7 +310,7 @@ stdenv.mkDerivation {
     $out/opt/brave.com/${optName}/brave --version
   '';
 
-  passthru.updateScript = ./update.sh;
+  passthru.updateScript = ./update.py;
 
   meta = {
     homepage = homepage;

pkgs/applications/networking/browsers/brave/packages/brave-origin.nix

@@ -1,21 +1,21 @@
 # Expression generated by update.py; do not edit it by hand!
 rec {
   pname = "brave-origin";
-  version = "1.94.121";
+  version = "1.95.101";
   flavor = "origin";
 
   archives = {
     aarch64-linux = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-origin_${version}_arm64.deb";
-      sha256 = "4e94a2f04d940fed80303f1e4a33c47961da79680586b1c2644a21339f9a64a3";
+      sha256 = "c8bccc15a7db38e260203ede15fe3e5bc3591b23f7f8bdfef1c18acc8ee8e540";
     };
     x86_64-linux = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-origin_${version}_amd64.deb";
-      sha256 = "0f76ec5f00413954355c19b0d6633b618ac4418afed333e14ece980c6b6b1495";
+      sha256 = "d0cf5a3ff164aec9fd3c8259d25cbfce44b010fe36c36096a67966e4b03d99b3";
     };
     aarch64-darwin = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/Brave-Origin-arm64.dmg";
-      sha256 = "471eb0ec7e7ee7cd28a23c2c0ee5eebee4b621854f8966b2b45cc28e88332ecb";
+      sha256 = "2861104b0926036980223a502fe7b84da2517608189605072bd10333bd7061cf";
     };
   };
 }

pkgs/applications/networking/browsers/brave/packages/brave.nix

@@ -1,20 +1,20 @@
 # Expression generated by update.py; do not edit it by hand!
 rec {
   pname = "brave";
-  version = "1.94.121";
+  version = "1.95.101";
 
   archives = {
     aarch64-linux = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_arm64.deb";
-      sha256 = "ec2a784860e912ccc3df6887a2fc7a54427321cdaa84f1e617450bd71ee0ec7b";
+      sha256 = "8260ff8796cc3fc8741324786cbb67ea56320f48f76700082c86c734dfd2df25";
     };
     x86_64-linux = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-      sha256 = "21d7ac36b64a408dc598bb6ec3db84b07b2cbca854d26b28055a2fb5b94a2e77";
+      sha256 = "7c41a55820117d93b821e55e55defb5f6cae8a86115c88f3a1026cd27f1c73cc";
     };
     aarch64-darwin = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/Brave-Browser-arm64.dmg";
-      sha256 = "fdb8af6099d91ec3813c93d9cc1bcb6e59ee1b9fde97e0a94283e4ed6c5db3b5";
+      sha256 = "2deaed060d24f0809bb87332a4d75c7dd140bd38d0915b9e63791917eee3898f";
     };
   };
 }

pkgs/applications/networking/cluster/helm/default.nix

@@ -10,16 +10,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "kubernetes-helm";
-  version = "4.2.4";
+  version = "4.3.0";
 
   src = fetchFromGitHub {
     owner = "helm";
     repo = "helm";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-Q9+0K65qwmebkXlsIByEX2zE4hSaZWYGTWGgwVkcJNs=";
+    hash = "sha256-E1xhKV3ahZ8ahCDalga2XSOiLea0UyC8b1t3Gd4P6xA=";
   };
 
-  vendorHash = "sha256-AFiniy+SM1svofkNWjowIE0BPmYa6TUcK9LPQahP+S4=";
+  vendorHash = "sha256-WxQMzzWcMJJATibiXXSBmCQz8YAlRu/MPGBkQaiHht8=";
 
   subPackages = [ "cmd/helm" ];
   ldflags = [

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -82,13 +82,13 @@
     "vendorHash": "sha256-LvTVRhhgzePYRR98t9pqvRRHcLrZ2lPHbtdzqoxtFYo="
   },
   "auth0_auth0": {
-    "hash": "sha256-t/AdooXhTpu4UXE8u6cvdVPL4HFUQQWOSAjw1RXFs8c=",
+    "hash": "sha256-FKDe46eyXenUHFbTSrJg28fEQfARRgVu0pNMybCC93g=",
     "homepage": "https://registry.terraform.io/providers/auth0/auth0",
     "owner": "auth0",
     "repo": "terraform-provider-auth0",
-    "rev": "v1.56.0",
+    "rev": "v1.57.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-ydki+y2A6g94xNGVr7xZkBB/grEbOOD4LRwYGAmzLsc="
+    "vendorHash": "sha256-q+s83I2N4+llosb3XnGoTB2tpBLWES4tzsV86wmWbpI="
   },
   "aviatrixsystems_aviatrix": {
     "hash": "sha256-46djOfAj/5kfeoKLQHbeKefzdGbmlBATR+uN/IaAn8I=",
@@ -490,13 +490,13 @@
     "vendorHash": "sha256-vEQ++yk7BYUsgejppHiRJeMGzG4QOLfdPixCTLz9sbI="
   },
   "grafana_grafana": {
-    "hash": "sha256-VYxpmqyXsvNjbyuDIxK2iEZzSM6hxvUr8K2oNNw4GgY=",
+    "hash": "sha256-rOIaQICjrMHGU4jjN46R2ZK+mnxx+DNHZgVCsi99ESA=",
     "homepage": "https://registry.terraform.io/providers/grafana/grafana",
     "owner": "grafana",
     "repo": "terraform-provider-grafana",
-    "rev": "v4.45.2",
+    "rev": "v4.46.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-B/XiioxXXK3dzlKTDH8y7QQMx0ztqQ7TaE1Cbt8Kj3M="
+    "vendorHash": "sha256-4jL0lmRrgo6UKIlHEhM+W2MzuRJ8x6GiLxWVzzvcDGY="
   },
   "gridscale_gridscale": {
     "hash": "sha256-FAKvQ/MEod5Ck0PG4ffQ+gQp6zZ0JDRXPOrOiDpWMls=",
@@ -526,13 +526,13 @@
     "vendorHash": "sha256-lrcDMPenGnTgKnrdL9oCk3Pg/WObKYqKxbLXqjWR7U4="
   },
   "hashicorp_awscc": {
-    "hash": "sha256-cVpZA8XK3d6RDjdo8KMbQ/J540ZRzUb79S2wq/Vzo6Y=",
+    "hash": "sha256-juctslCHuUr3pL9VTOET/s3P0SGbtlInZESmvgNL+7M=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/awscc",
     "owner": "hashicorp",
     "repo": "terraform-provider-awscc",
-    "rev": "v1.99.0",
+    "rev": "v1.101.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-NJE8XR2HbxVV8HtYoXxpKoQOK+gQfqApliPnueGsMgE="
+    "vendorHash": "sha256-YTTTjXGnWNBD4oA1mLdumXd8ZGZ03M5tXrW9OFao1pM="
   },
   "hashicorp_azuread": {
     "hash": "sha256-mEYEZIztDjyqWSJFoJPXtV0E9YikumtwGVtZA4Jfw3U=",
@@ -1049,13 +1049,13 @@
     "vendorHash": "sha256-ofzbDmivXgH1i1Gjhpyp0bk3FDs5SnxwoRuNAWyMqyI="
   },
   "opentelekomcloud_opentelekomcloud": {
-    "hash": "sha256-U5F5pcCMGsJqVfIOt6sYUnlr1CkNnwnhUm22F+YekRQ=",
+    "hash": "sha256-8YCFGtVOzXOvmZGoy3T43RTttgLM7ebWQ6z8ypLtr6A=",
     "homepage": "https://registry.terraform.io/providers/opentelekomcloud/opentelekomcloud",
     "owner": "opentelekomcloud",
     "repo": "terraform-provider-opentelekomcloud",
-    "rev": "v1.37.7",
+    "rev": "v1.37.8",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-5YKZqyNUDgyY5dC7tJie8IcrLCkeKV92PPJZ+DVLq4w="
+    "vendorHash": "sha256-UeCpP05dG2OISRx6u1gV4b9SMk2rlyTr1OxpAsx2gts="
   },
   "opsgenie_opsgenie": {
     "hash": "sha256-Y67kcg/ovvZc22l1CBz0Mqu7DAIit5F0jQNfQrl2EGI=",

pkgs/applications/networking/instant-messengers/pidgin/pidgin-plugins/purple-mm-sms/default.nix

@@ -1,7 +1,7 @@
 {
   lib,
   stdenv,
-  glibmm,
+  glibmm_2_4,
   pidgin,
   pkg-config,
   modemmanager,
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [
-    glibmm
+    glibmm_2_4
     pidgin
     modemmanager
   ];

pkgs/applications/science/logic/coq/default.nix

@@ -147,6 +147,7 @@ let
     ocamlPackages.ocaml
     ocamlPackages.findlib
   ]
+  ++ lib.optional (!coqAtLeast "8.10") ocamlPackages.camlp5
   ++ lib.optional (coqAtLeast "8.14") dune;
   ocamlBuildInputs = [
     ocamlPackages.findlib

pkgs/applications/video/kodi/addons/arteplussept/default.nix

@@ -12,11 +12,11 @@
 buildKodiAddon rec {
   pname = "arteplussept";
   namespace = "plugin.video.arteplussept";
-  version = "1.6.0";
+  version = "1.6.2";
 
   src = fetchzip {
     url = "https://mirrors.kodi.tv/addons/${lib.toLower rel}/${namespace}/${namespace}-${version}.zip";
-    hash = "sha256-5gGRYzRBFPrZKtTLUcwIF/Exq6fwkymP1W6iyGdo5nc=";
+    hash = "sha256-de33QOa6vDpZdTHDE1o/9L+ihPHZ6xg870CpUcYr3dU=";
   };
 
   propagatedBuildInputs = [

pkgs/build-support/fetchurl/builder.sh

@@ -1,5 +1,9 @@
 source "$NIX_ATTRS_SH_FILE"
-source $mirrorsFile
+
+# This file will bring variables of the form "_mirror_<mirrorname>" into scope.
+# DO NOT USE the "_mirror" prefix for variables in this script to avoid
+# accidentally clobbering them.
+source "$mirrorsListFile"
 
 # Normalize `curlOpts` as a string.
 # If defined as a list (deprecated), it would be a bash array.
@@ -41,11 +45,8 @@ if [[ -n "${netrcPhase-}" ]]; then
     curl+=(--netrc-file "$PWD/netrc")
 fi
 
-curl+=(
-    "${curlOptsList[@]}"
-    $curlOpts
-    $NIX_CURL_FLAGS
-)
+curl+=("${curlOptsList[@]}")
+concatTo curl curlOpts NIX_CURL_FLAGS
 
 downloadedFile="$out"
 if [ -n "$downloadToTemp" ]; then downloadedFile="$TMPDIR/file"; fi
@@ -60,7 +61,7 @@ tryDownload() {
     success=
 
     # if we get error code 18, resume partial download
-    while [ $curlexit -eq 18 ]; do
+    while [ "$curlexit" -eq 18 ]; do
        # keep this inside an if statement, since on failure it doesn't abort the script
        if "${curl[@]}" -C - --fail "$url" --output "$target" 2> >(tr '\r' '\n'); then
           success=1
@@ -77,8 +78,8 @@ finish() {
 
     set +o noglob
 
-    if [[ $executable == "1" ]]; then
-      chmod +x $downloadedFile
+    if [[ "$executable" == "1" ]]; then
+      chmod +x "$downloadedFile"
     fi
 
     if [ -z "$skipPostFetch" ]; then
@@ -90,12 +91,15 @@ finish() {
 
 
 tryHashedMirrors() {
+    # The hashed mirrors are stored in the mirrorsListFile,
+    # so we have to use the "_mirror_" prefix, the same as for any other mirror
     if test -n "$NIX_HASHED_MIRRORS"; then
-        hashedMirrors="$NIX_HASHED_MIRRORS"
+        IFS=' ' read -r -a _mirror_hashedMirrors <<< "$NIX_HASHED_MIRRORS"
     fi
 
-    for mirror in $hashedMirrors; do
-        url="$mirror/$outputHashAlgo/$outputHash"
+    local mirror
+    for mirror in "${_mirror_hashedMirrors[@]}"; do
+        local url="$mirror/$outputHashAlgo/$outputHash"
         if "${curl[@]}" --retry 0 --connect-timeout "${NIX_CONNECT_TIMEOUT:-15}" \
             --fail --silent --show-error --head "$url" \
             --write-out "%{http_code}" --output /dev/null > code 2> log; then
@@ -125,34 +129,62 @@ tryHashedMirrors() {
 set -o noglob
 
 resolvedUrls=()
-for url in "${urls[@]}"; do
-    if test "${url:0:9}" != "mirror://"; then
-        resolvedUrls+=("$url")
-    else
-        url2="${url:9}"; echo "${url2/\// }" > split; read site fileName < split
-        #varName="mirror_$site"
-        varName="$site" # !!! danger of name clash, fix this
-        if test -z "${!varName}"; then
-            echo "warning: unknown mirror:// site \`$site'"
-        else
-            mirrors=${!varName}
 
-            # Allow command-line override by setting NIX_MIRRORS_$site.
-            varName="NIX_MIRRORS_$site"
-            if test -n "${!varName}"; then mirrors="${!varName}"; fi
-
-            for url3 in $mirrors; do
-                resolvedUrls+=("$url3$fileName");
-            done
+_resolveUrls() {
+    local url
+    for url in "${urls[@]}"; do
+        # Direct URL: just add it and we're done
+        if test "${url:0:9}" != "mirror://"; then
+            resolvedUrls+=("${url}")
+            continue
         fi
-    fi
-done
+
+        # Try to get appropriate mirrors via the sourced mirrorsListFile or
+        # environment variable NIX_MIRROR_site
+        # Start by looking for mirror:// and splitting everything after that
+        # into a site and a path - the site part should lead us to an array
+        # with the URLs, or the appropriate env variable
+        if ! [[ "$url" =~ ^mirror://([^/ ]+)[/]([^ ]+)$ ]]; then
+          echo "error: fetchurl: $name: invalid mirror:// URL format: $url" >&2
+          exit 1
+        fi
+        local site="${BASH_REMATCH[1]}"
+        local filePath="${BASH_REMATCH[2]}"
+
+        # The name of the array containing mirrors for site
+        local varName="_mirror_${site}"
+        # Needed to iterate over the array using an indirect reference
+        local arrName="${varName}[@]"
+        # The environment variable that can potentially override the mirrors
+        local envVarName="NIX_MIRRORS_${site}"
+
+        local mirrorUrls
+        if test -v "${arrName}"; then
+            if test -n "${!envVarName}"; then
+                echo "resolving url via NIX_MIRRORS_${site}"
+                IFS=' ' read -r -a mirrorUrls <<< "${!envVarName}"
+            else
+                mirrorUrls=("${!arrName}")
+            fi
+        else
+            echo "warning: unknown mirror:// site \`${site}'"
+            continue
+        fi
+
+        local mirrorUrl
+        for mirrorUrl in "${mirrorUrls[@]}"; do
+            resolvedUrls+=("${mirrorUrl}${filePath}");
+        done
+    done
+}
+
+_resolveUrls
 
 # Restore globbing settings
 set +o noglob
 
 if test -n "$showURLs"; then
-    echo "${resolvedUrls[*]}" > $out
+    echo "${resolvedUrls[*]}" > "$out"
     exit 0
 fi
 
@@ -173,6 +205,8 @@ for url in "${resolvedUrls[@]}"; do
            https://gitlab.com/*/-/archive/*)
                echo "warning: archives from GitLab revisions should use fetchFromGitLab"
                ;;
+           *)
+               ;;
        esac
     fi
     tryDownload "$url" "$downloadedFile"

pkgs/build-support/fetchurl/default.nix

@@ -1,8 +1,5 @@
 {
   lib,
-  buildPackages ? {
-    inherit stdenvNoCC;
-  },
   stdenvNoCC,
   curl, # Note that `curl' may be `null', in case of the native stdenvNoCC.
   cacert ? null,
@@ -24,7 +21,11 @@ let
     isList
     isString
     length
+    mapAttrs'
     match
+    nameValuePair
+    toFile
+    toShellVars
     warn
     ;
   nixpkgsVersion = lib.trivial.release;
@@ -38,15 +39,12 @@ let
   # fetchurl instantiations via environment variables.  This makes the
   # resulting store derivations (.drv files) much smaller, which in
   # turn makes nix-env/nix-instantiate faster.
-  mirrorsFile = buildPackages.stdenvNoCC.mkDerivation (
-    {
-      name = "mirrors-list";
-      strictDeps = true;
-      builder = ./write-mirror-list.sh;
-      preferLocalBuild = true;
-    }
-    // mirrors
-  );
+  mirrorsListFile =
+    let
+      # Add a prefix to the names of the mirrors to avoid variable name clashes in the builder
+      mirrorsPrefixed = mapAttrs' (n: v: nameValuePair ("_mirror_" + n) v) mirrors;
+    in
+    toFile "mirrors-list" (toShellVars mirrorsPrefixed);
 
   # Names of the master sites that are mirrored (i.e., "sourceforge",
   # "gnu", etc.).
@@ -304,6 +302,8 @@ lib.extendMkDerivation {
 
       nativeBuildInputs = defaultNativeBuildInputs ++ nativeBuildInputs;
 
+      strictDeps = true;
+
       urls = urls_;
 
       # If set, prefer the content-addressable mirrors
@@ -331,19 +331,22 @@ lib.extendMkDerivation {
 
       # Disable TLS verification only when we know the hash and no credentials are
       # needed to access the resource
-      env.SSL_CERT_FILE =
-        if
-          (
-            hash_.outputHash == ""
-            || hash_.outputHash == fakeSha256
-            || hash_.outputHash == fakeSha512
-            || hash_.outputHash == fakeHash
-            || netrcPhase != null
-          )
-        then
-          "${cacert}/etc/ssl/certs/ca-bundle.crt"
-        else
-          "/no-cert-file.crt";
+      env = {
+        SSL_CERT_FILE =
+          if
+            (
+              hash_.outputHash == ""
+              || hash_.outputHash == fakeSha256
+              || hash_.outputHash == fakeSha512
+              || hash_.outputHash == fakeHash
+              || netrcPhase != null
+            )
+          then
+            "${cacert}/etc/ssl/certs/ca-bundle.crt"
+          else
+            "/no-cert-file.crt";
+      }
+      // (derivationArgs.env or { });
 
       outputHashMode = if (recursiveHash || executable) then "recursive" else "flat";
 
@@ -373,7 +376,7 @@ lib.extendMkDerivation {
         curlOptsList
         downloadToTemp
         executable
-        mirrorsFile
+        mirrorsListFile
         postFetch
         showURLs
         ;

pkgs/build-support/fetchurl/tests.nix

@@ -61,11 +61,13 @@ let
       );
 in
 {
+  # Tests that we can add curl flags via curlOpts (space separated)
   flag-appending-curlOpts = testFlagAppending {
     name = "test-fetchurl-flag-appending-curlOpts";
     curlOpts = "--foo --bar";
   };
 
+  # Tests that we can add curl flags via curlOptsList
   flag-appending-curlOptsList = testFlagAppending {
     name = "test-fetchurl-flag-appending-curlOptsList";
     curlOptsList = [
@@ -74,6 +76,13 @@ in
     ];
   };
 
+  # Tests that we can add curl flags via NIX_CURL_FLAGS (space separated)
+  flag-appending-curlOptsEnv = testFlagAppending {
+    name = "test-fetchurl-flag-appending-env";
+    derivationArgs.env.NIX_CURL_FLAGS = "--foo --bar";
+  };
+
+  # Tests that we can use the netrcPhase and add curl flags
   flag-appending-netrcPhase-curlOpts = testFlagAppending {
     name = "test-fetchurl-flag-appending-netrcPhase-curlOpts";
     netrcPhase = ''
@@ -82,6 +91,7 @@ in
     '';
   };
 
+  # Tests that we can use the netrcPhase and add curl flags
   flag-appending-netrcPhase-curlOptsList = testFlagAppending {
     name = "test-fetchurl-flag-appending-netrcPhase-curlOptsList";
     netrcPhase = ''
@@ -121,6 +131,47 @@ in
     ];
   };
 
+  # Tests that multiple hashedMirrors are handled correctly
+  multipleHashedMirrors =
+    let
+      fetchurlWithBrokenMirror = fetchurl.override (prevArgs: {
+        hashedMirrors = [ "http://brokenMirror" ] ++ prevArgs.hashedMirrors;
+      });
+    in
+    testers.invalidateFetcherByDrvHash fetchurlWithBrokenMirror {
+      # Make sure that we can only download from hashed mirrors
+      url = "http://broken";
+      # A file with this hash is definitely on tarballs.nixos.org
+      sha256 = "1j1y3cq6ys30m734axc0brdm2q9n2as4h32jws15r7w5fwr991km";
+
+      # No chance
+      curlOptsList = [
+        "--retry"
+        "0"
+      ];
+    };
+
+  # Tests that mirrors provided via NIX_HASHED_MIRRORS are handled correctly
+  # and that env.SSL_CERT_FILE is not clobbered
+  hashedMirrorsFromEnv =
+    let
+      fetchurlWithOnlyEnvMirrors = fetchurl.override { hashedMirrors = [ ]; };
+    in
+    testers.invalidateFetcherByDrvHash fetchurlWithOnlyEnvMirrors {
+      # Make sure that we can only download from hashed mirrors
+      url = "http://broken";
+      # A file with this hash is definitely on tarballs.nixos.org
+      sha256 = "1j1y3cq6ys30m734axc0brdm2q9n2as4h32jws15r7w5fwr991km";
+
+      derivationArgs.env.NIX_HASHED_MIRRORS = "http://brokenMirror https://tarballs.nixos.org";
+
+      # No chance
+      curlOptsList = [
+        "--retry"
+        "0"
+      ];
+    };
+
   # Tests that downloadToTemp works with hashedMirrors
   no-skipPostFetch = testers.invalidateFetcherByDrvHash fetchurl {
     # Make sure that we can only download from hashed mirrors
@@ -141,6 +192,7 @@ in
     # tarballs.nixos.org, which provides pre-built derivation outputs.
   };
 
+  # Tests that showURLs writes the expected URLs to $out
   showURLs-urls-mirrors = testers.invalidateFetcherByDrvHash fetchurl (finalAttrs: {
     name = "test-fetchurl-showURLs-urls-mirrors";
     showURLs = true;
@@ -159,6 +211,7 @@ in
       );
   });
 
+  # Tests that multiple URLs are tried until we find a working one
   urls-simple = testers.invalidateFetcherByDrvHash fetchurl {
     name = "test-fetchurl-urls-simple";
     urls = [
@@ -168,8 +221,9 @@ in
     hash = hello.src.outputHash;
   };
 
-  urls-mirrors = testers.invalidateFetcherByDrvHash fetchurl rec {
-    name = "test-fetchurl-urls-simple";
+  # Tests that build-time resolved URLs are the same as evaluation-resolved URLs
+  urls-mirrors = testers.invalidateFetcherByDrvHash fetchurl (finalAttrs: {
+    name = "test-fetchurl-urls-mirrors";
     urls = [
       "http://broken"
     ]
@@ -178,12 +232,43 @@ in
     postFetch = hello.postFetch or "" + ''
       if ! diff -u ${
         builtins.toFile "urls-resolved-by-eval" (
-          lib.concatStringsSep "\n" (lib.concatMap fetchurl.resolveUrl urls) + "\n"
+          lib.concatStringsSep "\n" (lib.concatMap fetchurl.resolveUrl finalAttrs.urls) + "\n"
         )
       } <(printf '%s\n' "''${resolvedUrls[@]}"); then
         echo "ERROR: fetchurl: build-time-resolved URLs \`urls' differ from the evaluation-resolved URLs." >&2
         exit 1
       fi
     '';
-  };
+  });
+
+  # Tests that alternative mirror URLs can be provided via the NIX_MIRRORS_* environment variables.
+  # NIX_MIRRORS_ variables for known mirrors are added to impureEnvVars.
+  urls-env-mirrors = testers.invalidateFetcherByDrvHash fetchurl (finalAttrs: {
+    name = "test-fetchurl-urls-env-mirrors";
+    inherit (hello.src) urls;
+    hash = hello.src.outputHash;
+    derivationArgs.env = {
+      # Two mirrors taken from the mirrors.nix file
+      NIX_MIRRORS_gnu = toString [
+        "https://ftp.nluug.nl/pub/gnu/"
+        "https://mirrors.kernel.org/gnu/"
+      ];
+    };
+
+    curlOptsList = [
+      "--retry"
+      "0"
+    ];
+
+    postFetch = hello.postFetch or "" + ''
+      if ! diff -u ${builtins.toFile "urls-resolved-by-hand" ''
+        https://ftp.nluug.nl/pub/gnu/hello/hello-${hello.version}.tar.gz
+        https://mirrors.kernel.org/gnu/hello/hello-${hello.version}.tar.gz
+      ''} <(printf '%s\n' "''${resolvedUrls[@]}"); then
+        echo "ERROR: fetchurl: build-time-resolved URLs \`urls' differ from the manually resolved URLs." >&2
+        exit 1
+      fi
+    '';
+  });
+
 }

pkgs/build-support/fetchurl/write-mirror-list.sh

@@ -1,2 +0,0 @@
-# !!! this is kinda hacky.
-set | grep -E '^[a-zA-Z]+=.*://' > $out

pkgs/build-support/go/module.nix

@@ -219,7 +219,6 @@ lib.extendMkDerivation {
       env = args.env or { } // {
         inherit (go) GOOS GOARCH;
 
-        GO111MODULE = "on";
         GOTOOLCHAIN = "local";
 
         CGO_ENABLED = args.env.CGO_ENABLED or go.CGO_ENABLED;

pkgs/build-support/rust/fetch-cargo-vendor.nix

@@ -105,6 +105,8 @@ let
       outputHash = hash;
       outputHashAlgo = if hash == "" then "sha256" else null;
       outputHashMode = "recursive";
+
+      __structuredAttrs = true;
     }
     // removeAttrs args removedArgs
   );
@@ -117,6 +119,8 @@ runCommand "${name}-vendor"
       cargo
       replaceWorkspaceValues
     ];
+    strictDeps = true;
+    __structuredAttrs = true;
   }
   ''
     fetch-cargo-vendor-util create-vendor "$vendorStaging" "$out"

pkgs/build-support/rust/hooks/default.nix

@@ -132,6 +132,9 @@
     substitutions = {
       libclang = (lib.getLib clang.cc);
       inherit clang;
+      targetFlag = lib.optionalString (
+        stdenv.targetPlatform != stdenv.hostPlatform
+      ) "--target=${stdenv.targetPlatform.config}";
     };
     meta.license = lib.licenses.mit;
   } ./rust-bindgen-hook.sh;

pkgs/build-support/rust/hooks/rust-bindgen-hook.sh

@@ -6,7 +6,7 @@
 
 populateBindgenEnv () {
     export LIBCLANG_PATH=@libclang@/lib
-    BINDGEN_EXTRA_CLANG_ARGS="$(< @clang@/nix-support/cc-cflags) $(< @clang@/nix-support/libc-cflags) $(< @clang@/nix-support/libcxx-cxxflags) $NIX_CFLAGS_COMPILE"
+    BINDGEN_EXTRA_CLANG_ARGS="@targetFlag@ $(< @clang@/nix-support/cc-cflags) $(< @clang@/nix-support/libc-cflags) $(< @clang@/nix-support/libcxx-cxxflags) $NIX_CFLAGS_COMPILE"
     export BINDGEN_EXTRA_CLANG_ARGS
 }
 

pkgs/build-support/rust/rustc-wrapper/default.nix

@@ -49,6 +49,8 @@ runCommand "${rustc-unwrapped.pname}-wrapper-${rustc-unwrapped.version}"
       unwrapped = rustc-unwrapped;
     };
 
+    __structuredAttrs = true;
+
     meta = rustc-unwrapped.meta // {
       description = "${rustc-unwrapped.meta.description} (wrapper script)";
       priority = 10;

pkgs/by-name/ab/abseil-cpp/package.nix

@@ -6,7 +6,7 @@
 # required LTS branch, leaving `abseil-cpp` as an alias.
 
 {
-  abseil-cpp_202601,
+  abseil-cpp_202608,
   cxxStandard ? null,
 }:
-abseil-cpp_202601.override { inherit cxxStandard; }
+abseil-cpp_202608.override { inherit cxxStandard; }

pkgs/by-name/ad/adguardhome/package.nix

@@ -9,15 +9,15 @@
 
 buildGoModule (finalAttrs: {
   pname = "adguardhome";
-  version = "0.107.78";
+  version = "0.107.79";
   src = fetchFromGitHub {
     owner = "AdguardTeam";
     repo = "AdGuardHome";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-u/fAvBgaoGph+BeTO/QzFtuFvJnnwaJRK3qmRhubj5w=";
+    hash = "sha256-2naPxr+ejMKjUz4SWP45XJ6sRd+Ju09+3kjufhRY1Xw=";
   };
 
-  vendorHash = "sha256-+LqNok2kaHQnVJA5cVX1MB31uLFfNxb952lzZk8V8Z8=";
+  vendorHash = "sha256-I0Zqo3s6s8UJ3IJJng32/27WUo/6zPy+jxj98Vh/ja8=";
 
   dashboard = buildNpmPackage {
     inherit (finalAttrs) src version;

pkgs/by-name/af/affine/package.nix

@@ -3,6 +3,7 @@
   stdenv,
   stdenvNoCC,
   fetchFromGitHub,
+  substitute,
   rustPlatform,
   electron,
   nodejs_22,
@@ -51,14 +52,24 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "toeverything";
     repo = "AFFiNE";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-gtdhWLNZRNY91j9wVVny1bRAjZAwIvNJr11ePQapWYQ=";
-  };
+    hash = "sha256-RotC2mNtMig3QKcKo8zr15myAqkPDuBopvV9wLlr2tQ=";
 
-  patches = [
-    # Remove after upstream updates to Yarn 4.14
-    # https://github.com/toeverything/AFFiNE/blob/canary/package.json#L96
-    ./yarn-4.14-support.patch
-  ];
+    # Remove when updating since upstream has updated Yarn
+    # https://github.com/toeverything/AFFiNE/commit/6375f5ab8c389831327284f4795d8397de085153
+    postFetch = ''
+      cd $out
+      patch -p1 < ${
+        (substitute {
+          src = ./yarn-fix.patch;
+          substitutions = [
+            "--replace-fail"
+            "YARN_LOCKFILE_VERSION_PLACEHOLDER"
+            yarn-berry.lockfileVersion
+          ];
+        })
+      }
+    '';
+  };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname version src;
@@ -68,7 +79,7 @@ stdenv.mkDerivation (finalAttrs: {
   # keep yarnOfflineCache same output style with offlineCache = yarn-berry.fetchYarnBerryDeps { inherit (finalAttrs) src missingHashes; hash = "" };
   yarnOfflineCache = stdenvNoCC.mkDerivation {
     name = "yarn-offline-cache";
-    inherit (finalAttrs) src patches;
+    inherit (finalAttrs) src;
     nativeBuildInputs = [
       yarn-berry
       cacert
@@ -112,7 +123,7 @@ stdenv.mkDerivation (finalAttrs: {
       '';
     dontInstall = true;
     outputHashMode = "recursive";
-    outputHash = "sha256-mNvvKbj9mUioh5Jw4CcRt0CpX1IcQC8JOxUnyy0Lw9c=";
+    outputHash = "sha256-gje8iTCiy3N/zYRuf/CGUVfGw0RSVXTPu4SjnE9+OY8=";
   };
 
   buildInputs = lib.optionals hostPlatform.isDarwin [

pkgs/by-name/af/affine/yarn-4.14-support.patch

@@ -1,23 +0,0 @@
-diff --git a/.yarnrc.yml b/.yarnrc.yml
---- a/.yarnrc.yml
-+++ b/.yarnrc.yml
-@@ -12,4 +12,7 @@ npmPublishAccess: public
- 
- npmRegistryServer: "https://registry.npmjs.org"
- 
--yarnPath: .yarn/releases/yarn-4.12.0.cjs
-+approvedGitRepositories:
-+  - "**"
-+
-+enableScripts: true
-diff --git a/yarn.lock b/yarn.lock
---- a/yarn.lock
-+++ b/yarn.lock
-@@ -2,6 +2,6 @@
- # Manual changes might be lost - proceed with caution!
- 
- __metadata:
--  version: 8
-+  version: 9
-   cacheKey: 10
- 

pkgs/by-name/af/affine/yarn-fix.patch

@@ -0,0 +1,58 @@
+diff --git a/.yarnrc.yml b/.yarnrc.yml
+--- a/.yarnrc.yml
++++ b/.yarnrc.yml
+@@ -12,4 +12,7 @@ npmPublishAccess: public
+ 
+ npmRegistryServer: "https://registry.npmjs.org"
+ 
+-yarnPath: .yarn/releases/yarn-4.12.0.cjs
++approvedGitRepositories:
++  - "**"
++
++enableScripts: true
+diff --git a/yarn.lock b/yarn.lock
+--- a/yarn.lock
++++ b/yarn.lock
+@@ -2,6 +2,6 @@
+ # Manual changes might be lost - proceed with caution!
+ 
+ __metadata:
+-  version: 8
++  version: YARN_LOCKFILE_VERSION_PLACEHOLDER
+   cacheKey: 10
+ 
+diff --git a/yarn.lock b/yarn.lock
+--- a/yarn.lock
++++ b/yarn.lock
+@@ -33250,27 +33250,27 @@ __metadata:
+ 
+ "resolve@patch:resolve@npm%3A^1.1.6#optional!builtin<compat/resolve>, resolve@patch:resolve@npm%3A^1.10.0#optional!builtin<compat/resolve>, resolve@patch:resolve@npm%3A^1.19.0#optional!builtin<compat/resolve>, resolve@patch:resolve@npm%3A^1.20.0#optional!builtin<compat/resolve>, resolve@patch:resolve@npm%3A^1.22.1#optional!builtin<compat/resolve>, resolve@patch:resolve@npm%3A^1.22.8#optional!builtin<compat/resolve>":
+   version: 1.22.11
+-  resolution: "resolve@patch:resolve@npm%3A1.22.11#optional!builtin<compat/resolve>::version=1.22.11&hash=c3c19d"
++  resolution: "resolve@patch:resolve@npm%3A1.22.11#optional!builtin<compat/resolve>::version=1.22.11&hash=9bd1a5"
+   dependencies:
+     is-core-module: "npm:^2.16.1"
+     path-parse: "npm:^1.0.7"
+     supports-preserve-symlinks-flag: "npm:^1.0.0"
+   bin:
+     resolve: bin/resolve
+-  checksum: 10/fd342cad25e52cd6f4f3d1716e189717f2522bfd6641109fe7aa372f32b5714a296ed7c238ddbe7ebb0c1ddfe0b7f71c9984171024c97cf1b2073e3e40ff71a8
++  checksum: 10/c990146fed81dd7792c56c1d62c170a8c8330bee86ef5d2524f0b1db79cfd9a6e2b4ad3cd4742b2685e51117b67be5d6f8cfd6ffa9c57bd64a1c8c8c9ff4c965
+   languageName: node
+   linkType: hard
+ 
+ "resolve@patch:resolve@npm%3A^2.0.0-next.5#optional!builtin<compat/resolve>":
+   version: 2.0.0-next.5
+-  resolution: "resolve@patch:resolve@npm%3A2.0.0-next.5#optional!builtin<compat/resolve>::version=2.0.0-next.5&hash=c3c19d"
++  resolution: "resolve@patch:resolve@npm%3A2.0.0-next.5#optional!builtin<compat/resolve>::version=2.0.0-next.5&hash=9bd1a5"
+   dependencies:
+     is-core-module: "npm:^2.13.0"
+     path-parse: "npm:^1.0.7"
+     supports-preserve-symlinks-flag: "npm:^1.0.0"
+   bin:
+     resolve: bin/resolve
+-  checksum: 10/05fa778de9d0347c8b889eb7a18f1f06bf0f801b0eb4610b4871a4b2f22e220900cf0ad525e94f990bb8d8921c07754ab2122c0c225ab4cdcea98f36e64fa4c2
++  checksum: 10/76c221deb1d986c0a80cd576373b0ee09f42871e0085a1f76beda84f73ce04e0d21bab28dffd326eb006a7af83bbc582404566b384aa3b0baa217f56cf7e8618
+   languageName: node
+   linkType: hard
+ 

pkgs/by-name/ag/agent-browser/package.nix

@@ -16,13 +16,13 @@
 let
   pnpm = pnpm_11;
 
-  version = "0.36.0";
+  version = "0.37.1";
 
   src = fetchFromGitHub {
     owner = "vercel-labs";
     repo = "agent-browser";
     tag = "v${version}";
-    hash = "sha256-HzX1M1Gdd9N0iYxiEGuWrV3fc7yNevGiOvc/0csttZA=";
+    hash = "sha256-AgpKazIBT3CKd4Q7yQsEGhoTW+7R0Pflma6aH+6UI/U=";
   };
 
   # The Rust CLI embeds the dashboard UI via RustEmbed at compile time.
@@ -83,7 +83,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   sourceRoot = "${finalAttrs.src.name}/cli";
 
-  cargoHash = "sha256-6xphNOYi+tJvFlprY8DCVw1XzVFapqFQfeIy0w2pyCs=";
+  cargoHash = "sha256-ziN4UMeEcgsD5BDXWjffreGjyew7oTUtq59b/Um8Dfk=";
 
   # Place the pre-built dashboard where RustEmbed expects it
   postUnpack = ''

pkgs/by-name/al/alan_2/package.nix

@@ -25,6 +25,8 @@ stdenv.mkDerivation {
     "-Wno-error=incompatible-pointer-types"
     # smScSema.c:183:10: error: implicit declaration of function 'read'; did you mean 'fread'? [-Wimplicit-function-declaration]
     "-Wno-error=implicit-function-declaration"
+    # Fix build with GCC 15 (defaults to C23) which rejects old-style unprototyped function declarations
+    "-std=gnu17"
   ];
 
   installPhase = ''

pkgs/by-name/an/andcli/package.nix

@@ -9,7 +9,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "andcli";
-  version = "2.9.0";
+  version = "2.9.1";
 
   __structuredAttrs = true;
 
@@ -19,7 +19,7 @@ buildGoModule (finalAttrs: {
     owner = "tjblackheart";
     repo = "andcli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ls/QWEAxxnsersk7L3AaRo5jo1Vsao61c2mgjt91sAQ=";
+    hash = "sha256-N/CKAtHLhUhAi6eSyS/tgADYGLeCPcw5BGLJKmqyWyc=";
   };
 
   vendorHash = "sha256-+qz2vIh4GTkdmhjGvYqJYZ9ZMI9f+yXObmyGHk/5Cyg=";

pkgs/by-name/an/anki/package.nix

@@ -24,6 +24,7 @@
   yarn,
   yarn-berry_4,
   runCommand,
+  substitute,
 
   wrapGAppsHook3,
 
@@ -42,7 +43,7 @@ let
 
   srcHash = "sha256-0sqtKiMqw7MLXVFSCT1sKX/VO7q5BY63pJP5OnCE2zo=";
   cargoHash = "sha256-LQ5uD86ZOKXy9vGbTqPBi3Q57PZEjwQkbHR94QAIVMg=";
-  yarnHash = "sha256-bOgiZImraPXR/gVk9MB3o9GScMGvLvdhc9mLAaCA4IE=";
+  yarnHash = "sha256-mpHGclmQxFqiIuZWFTOYBKQW24ugSVhQiYMTmyyk/n4=";
   pythonDeps =
     with python3Packages;
     [
@@ -155,9 +156,16 @@ python3Packages.buildPythonApplication (finalAttrs: {
     # Used in with-addons.nix
     ./patches/allow-setting-addons-folder.patch
 
-    # Remove after upstream updates to Yarn 4.14
-    # https://github.com/ankitects/anki/blob/main/package.json#L99
-    ./patches/yarn-4.14-support.patch
+    # Remove after upstream updates to Yarn 4.15
+    # https://github.com/ankitects/anki/blob/main/package.json#L103
+    (substitute {
+      src = ./patches/yarn-fix.patch;
+      substitutions = [
+        "--replace-fail"
+        "YARN_LOCKFILE_VERSION_PLACEHOLDER"
+        yarn-berry.lockfileVersion
+      ];
+    })
   ];
 
   inherit cargoDeps;

pkgs/by-name/an/anki/patches/yarn-fix.patch

@@ -14,6 +14,6 @@ diff --git a/yarn.lock b/yarn.lock
  
  __metadata:
 -  version: 8
-+  version: 9
++  version: YARN_LOCKFILE_VERSION_PLACEHOLDER
    cacheKey: 10c0
  

pkgs/by-name/ap/apache-orc/package.nix

@@ -75,7 +75,7 @@ stdenv.mkDerivation (finalAttrs: {
     GTEST_HOME = gtest.dev;
     LZ4_HOME = lz4;
     ORC_FORMAT_URL = orc-format;
-    PROTOBUF_HOME = protobuf;
+    PROTOBUF_HOME = protobuf.full; # Configure script expects to find both executables and headers at this path.
     SNAPPY_HOME = snappy.dev;
     ZLIB_HOME = zlib.dev;
     ZSTD_HOME = zstd.dev;

pkgs/by-name/ar/ardour/package.nix

@@ -21,7 +21,7 @@
   flac,
   fluidsynth,
   glibc,
-  glibmm,
+  glibmm_2_4,
   graphviz,
   harvid,
   hidapi,
@@ -142,7 +142,7 @@ let
       fftwSinglePrec
       flac
       fluidsynth
-      glibmm
+      glibmm_2_4
       hidapi
       itstool
       kissfft

pkgs/by-name/ar/ardour_8/package.nix

@@ -17,7 +17,7 @@
   flac,
   fluidsynth,
   glibc,
-  glibmm,
+  glibmm_2_4,
   graphviz,
   harvid,
   hidapi,
@@ -129,7 +129,7 @@ stdenv.mkDerivation (
       fftwSinglePrec
       flac
       fluidsynth
-      glibmm
+      glibmm_2_4
       hidapi
       itstool
       kissfft

pkgs/by-name/at/atkmm/package.nix

@@ -3,7 +3,7 @@
   stdenv,
   fetchurl,
   atk,
-  glibmm,
+  glibmm_2_4,
   pkg-config,
   gnome,
   meson,
@@ -27,7 +27,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   propagatedBuildInputs = [
     atk
-    glibmm
+    glibmm_2_4
   ];
 
   nativeBuildInputs = [

pkgs/by-name/av/avbroot/package.nix

@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "avbroot";
-  version = "3.33.0";
+  version = "3.34.0";
 
   src = fetchFromGitHub {
     owner = "chenxiaolong";
     repo = "avbroot";
     tag = "v${version}";
-    hash = "sha256-79Cu/JqD3bA25jBES8BXzTfmW2255iv58KL/omUUxKg=";
+    hash = "sha256-uukbK8RANF708tawY8k6u5RPqqt4XXv0joRD2vLVZ0Q=";
   };
 
-  cargoHash = "sha256-FQ/uuRtkjRPJrNQ3H4UDEJ2XC08ghIH6/vYUhz1j7aI=";
+  cargoHash = "sha256-Az4w1JNJsbl/vs+lpVcrXg4Yu1Cg2Lc50/X4Kqg/M1Q=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/by-name/aw/aws-cdk-cli/package.nix

@@ -50,7 +50,6 @@ stdenv.mkDerivation (finalAttrs: {
     NX_VERBOSE_LOGGING = "true";
     # Needed to properly embed version info
     CODEBUILD_RESOLVED_SOURCE_VERSION = finalAttrs.version;
-    YARN_LOCKFILE_VERSION_OVERRIDE = "8";
   };
 
   # Regular "build" is very heavy and does things we don't need.
@@ -64,13 +63,6 @@ stdenv.mkDerivation (finalAttrs: {
     in
     ''
       echo '${cliVersionJson}' > packages/@aws-cdk/cloud-assembly-schema/cli-version.json
-      cat >> .yarnrc.yml <<'EOF'
-      approvedGitRepositories:
-        - "**"
-      enableScripts: true
-      enableNetwork: false
-      enableHardenedMode: false
-      EOF
     '';
 
   preBuild = ''

pkgs/by-name/ba/bashly/Gemfile.lock

@@ -1,43 +1,48 @@
 GEM
   remote: https://rubygems.org/
   specs:
-    bashly (1.2.10)
-      colsole (>= 0.8.1, < 2)
-      completely (>= 0.6.1, < 0.8)
-      filewatcher (~> 2.0)
+    bashly (1.4.0)
+      colsole (~> 1.0)
+      completely (~> 0.8.0)
       gtx (~> 0.1.1)
-      logger (>= 1, < 3)
+      listen (~> 3.9)
       lp (~> 0.2.0)
-      mister_bin (~> 0.8.1)
-      ostruct (>= 0, < 2)
+      mister_bin (~> 0.9.0)
       requires (~> 1.1)
       tty-markdown (~> 0.7.2)
-    cgi (0.4.2)
-    colsole (1.0.0)
-    completely (0.7.0)
-      colsole (>= 0.8.1, < 2)
+    colsole (1.0.1)
+    completely (0.8.0)
+      colsole (~> 1.0.0)
+      erb
       mister_bin (~> 0.7)
     docopt_ng (0.7.1)
-    erb (4.0.4)
-      cgi (>= 0.3.3)
-    filewatcher (2.1.0)
-      module_methods (~> 0.1.0)
-    gtx (0.1.1)
-      erb (~> 4.0)
-    kramdown (2.5.1)
-      rexml (>= 3.3.9)
-    logger (1.6.6)
+    erb (6.0.7)
+    ffi (1.17.4)
+    gtx (0.1.2)
+      erb (>= 4.0, < 7)
+    io-console (0.9.2)
+    kramdown (2.5.2)
+      rexml (>= 3.4.4)
+    listen (3.10.0)
+      logger
+      rb-fsevent (~> 0.10, >= 0.10.3)
+      rb-inotify (~> 0.9, >= 0.9.10)
+    logger (1.7.0)
     lp (0.2.1)
-    mister_bin (0.8.1)
-      colsole (>= 0.8.1, < 2)
-      docopt_ng (~> 0.7, >= 0.7.1)
-    module_methods (0.1.0)
-    ostruct (0.6.1)
+    mister_bin (0.9.0)
+      colsole (~> 1.0.0)
+      docopt_ng (~> 0.7.1)
+      reline (~> 0.6)
     pastel (0.8.0)
       tty-color (~> 0.5)
+    rb-fsevent (0.11.2)
+    rb-inotify (0.11.1)
+      ffi (~> 1.0)
+    reline (0.7.0)
+      io-console (~> 0.5)
     requires (1.1.0)
-    rexml (3.4.1)
-    rouge (4.5.1)
+    rexml (3.4.4)
+    rouge (4.7.0)
     strings (0.2.1)
       strings-ansi (~> 0.2)
       unicode-display_width (>= 1.5, < 3.0)
@@ -62,4 +67,4 @@ DEPENDENCIES
   bashly
 
 BUNDLED WITH
-   2.6.2
+   2.7.2

pkgs/by-name/ba/bashly/gemset.nix

@@ -3,12 +3,10 @@
     dependencies = [
       "colsole"
       "completely"
-      "filewatcher"
       "gtx"
-      "logger"
+      "listen"
       "lp"
       "mister_bin"
-      "ostruct"
       "requires"
       "tty-markdown"
     ];
@@ -16,44 +14,35 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1dzvgrk5vqncvwi1dn7kk5gzfjcr58jmqb6cyqcspwj6mr6zp7sw";
+      sha256 = "1a5kqfwkknwd2j1dbdbqgyikm196ah22dfx9f34yq5xy15im19cs";
       type = "gem";
     };
-    version = "1.2.10";
-  };
-  cgi = {
-    groups = [ "default" ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "1rj7agrnd1a4282vg13qkpwky0379svdb2z2lc0wl8588q6ikjx3";
-      type = "gem";
-    };
-    version = "0.4.2";
+    version = "1.4.0";
   };
   colsole = {
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1fvf6dz2wsvjk7q24z0dm8lajq3p2l6i5ywf3mxj683rmhwq49bg";
+      sha256 = "00kvcnfnqiczrrdbfr0jwhvwym29d0y43zjg09y8gnz2mh0a6ckn";
       type = "gem";
     };
-    version = "1.0.0";
+    version = "1.0.1";
   };
   completely = {
     dependencies = [
       "colsole"
+      "erb"
       "mister_bin"
     ];
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1j3kpgmcvvs257m2zqhc3jlyrflhphcmy19lwgamv9p6xg100ak1";
+      sha256 = "0pkciknwlfkxjmdbww6nprim7wz5pzn7gwj1ga8lfpw0hifwv4z4";
       type = "gem";
     };
-    version = "0.7.0";
+    version = "0.8.0";
   };
   docopt_ng = {
     groups = [ "default" ];
@@ -66,26 +55,24 @@
     version = "0.7.1";
   };
   erb = {
-    dependencies = [ "cgi" ];
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "05wpc7pn1k6jik7i57vfrj6k5lda39hrny0q3706pi05c886w4fy";
+      sha256 = "14pfj6zn0p1hxj6s6s0r7d424wap8zl9zxf89nj79y8fbg16vjn5";
       type = "gem";
     };
-    version = "4.0.4";
+    version = "6.0.7";
   };
-  filewatcher = {
-    dependencies = [ "module_methods" ];
+  ffi = {
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "03f9v57c5zag09mi10yjhdx7y0vv2w5wrnwzbij9hhkwh43rk077";
+      sha256 = "1kqasqvy8d7r09ri4n6bkdwbk63j7afd9ilsw34nzlgh0qp69ldw";
       type = "gem";
     };
-    version = "2.1.0";
+    version = "1.17.4";
   };
   gtx = {
     dependencies = [ "erb" ];
@@ -93,10 +80,20 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1w0hbr9i6jpn9spbb13ipg2fajkwa51y56jw21ziwsddmv997274";
+      sha256 = "1fpknqc50vsgwylvx7xzj4b401gxrnd4wp6cy81l23qakb6192v6";
       type = "gem";
     };
-    version = "0.1.1";
+    version = "0.1.2";
+  };
+  io-console = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "026v93kja19bfslnwi9xfq2dj4r89kkwdprim4whjg6h3n4lz9zg";
+      type = "gem";
+    };
+    version = "0.9.2";
   };
   kramdown = {
     dependencies = [ "rexml" ];
@@ -104,20 +101,35 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "131nwypz8b4pq1hxs6gsz3k00i9b75y3cgpkq57vxknkv6mvdfw7";
+      sha256 = "1yh2gwpwhh0p4vc0aabzn0hb55av0wkcq3gh3w8zkdk69hh4598v";
       type = "gem";
     };
-    version = "2.5.1";
+    version = "2.5.2";
+  };
+  listen = {
+    dependencies = [
+      "logger"
+      "rb-fsevent"
+      "rb-inotify"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1ln9c0vx165hkfbn2817qw4m6i77xcxh6q0r5v6fqfhlcbdq5qf6";
+      type = "gem";
+    };
+    version = "3.10.0";
   };
   logger = {
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "05s008w9vy7is3njblmavrbdzyrwwc1fsziffdr58w9pwqj8sqfx";
+      sha256 = "00q2zznygpbls8asz5knjvvj2brr3ghmqxgr83xnrdj4rk3xwvhr";
       type = "gem";
     };
-    version = "1.6.6";
+    version = "1.7.0";
   };
   lp = {
     groups = [ "default" ];
@@ -133,35 +145,16 @@
     dependencies = [
       "colsole"
       "docopt_ng"
+      "reline"
     ];
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1zz3vpy6xrgzln2dpxgcnrq1bpzz0syl60whqc9zf8j29mayw1fy";
+      sha256 = "1lz7kc3nj4h0avk4zfkc7ahrfxl242ry05scx1w1kbsgvc0y8kv2";
       type = "gem";
     };
-    version = "0.8.1";
-  };
-  module_methods = {
-    groups = [ "default" ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "1886wjscfripgzlmyvcd0jmlzwr6hxvklm2a5rm32dw5bf7bvjki";
-      type = "gem";
-    };
-    version = "0.1.0";
-  };
-  ostruct = {
-    groups = [ "default" ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "05xqijcf80sza5pnlp1c8whdaay8x5dc13214ngh790zrizgp8q9";
-      type = "gem";
-    };
-    version = "0.6.1";
+    version = "0.9.0";
   };
   pastel = {
     dependencies = [ "tty-color" ];
@@ -174,6 +167,38 @@
     };
     version = "0.8.0";
   };
+  rb-fsevent = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1zmf31rnpm8553lqwibvv3kkx0v7majm1f341xbxc0bk5sbhp423";
+      type = "gem";
+    };
+    version = "0.11.2";
+  };
+  rb-inotify = {
+    dependencies = [ "ffi" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0vmy8xgahixcz6hzwy4zdcyn2y6d6ri8dqv5xccgzc1r292019x0";
+      type = "gem";
+    };
+    version = "0.11.1";
+  };
+  reline = {
+    dependencies = [ "io-console" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0gaq2lc463ap1srz7y5kh2p4dxazs7vjrpiby58d9yfvan72s0av";
+      type = "gem";
+    };
+    version = "0.7.0";
+  };
   requires = {
     groups = [ "default" ];
     platforms = [ ];
@@ -189,20 +214,20 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1jmbf6lf7pcyacpb939xjjpn1f84c3nw83dy3p1lwjx0l2ljfif7";
+      sha256 = "0hninnbvqd2pn40h863lbrn9p11gvdxp928izkag5ysx8b1s5q0r";
       type = "gem";
     };
-    version = "3.4.1";
+    version = "3.4.4";
   };
   rouge = {
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1pchwrkr0994v7mh054lcp0na3bk3mj2sk0dc33bn6bhxrnirj1a";
+      sha256 = "0fd77qcz603mli4lyi97cjzkv02hsfk60m495qv5qcn02mkqk9fv";
       type = "gem";
     };
-    version = "4.5.1";
+    version = "4.7.0";
   };
   strings = {
     dependencies = [

pkgs/by-name/bc/bcachefs-tools/package.nix

@@ -106,12 +106,6 @@ stdenv.mkDerivation (finalAttrs: {
     PKG_CONFIG_SYSTEMD_SYSTEMDSYSTEMGENERATORDIR = "${placeholder "out"}/lib/systemd/system-generators";
   };
 
-  # Workaround for RISCV cross-compilation issue
-  # https://github.com/koverstreet/bcachefs-tools/issues/850
-  preBuild = lib.optionalString stdenv.hostPlatform.isRiscV ''
-    export BINDGEN_EXTRA_CLANG_ARGS="$BINDGEN_EXTRA_CLANG_ARGS --target=riscv64-unknown-linux-gnu -march=rv64gc"
-  '';
-
   # FIXME: Try enabling this once the default linux kernel is at least 6.7
   doCheck = false; # needs bcachefs module loaded on builder
 

pkgs/by-name/be/beadwork/package.nix

@@ -9,13 +9,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "beadwork";
-  version = "0.13.2";
+  version = "0.13.3";
 
   src = fetchFromGitHub {
     owner = "jallum";
     repo = "beadwork";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-OVwr/AUIx6k5QF2rZf25BWD+3UHYqN8tziJTa8tgDYU=";
+    hash = "sha256-OtjWkdYtTDNmjfSWAUg0cFJ7B7pnH8lk0S+g42JvHbA=";
   };
 
   vendorHash = "sha256-LjqZSI7F3C8GyNrPK/BwG9QTmNg89hFAvhUuBjmbHTU=";

pkgs/by-name/bi/bitfocus-companion/missing-hashes.json

@@ -1,41 +1,91 @@
 {
-  "@esbuild/aix-ppc64@npm:0.27.4": "ba2c14b9cd901d9e7ea99b7de8ac259b146bf978c69866328d1765f277b11105cd16ed4df82107593b5c9b667bba5fbcde73cb7a9f511d98caca9e26778f64a5",
-  "@esbuild/android-arm64@npm:0.27.4": "d5a06758f91f0cf795d3a77198fc26fefbd78c3ddfce682df8d8ddb96b31ee65549ead1f6040a496dad2a1fc0fa345fab90692eff3410663bd0f39ed670ac727",
-  "@esbuild/android-arm@npm:0.27.4": "faeac957ba9eaff1c79871151dea2101d03691cb3772ffd5b4475551f54bf7962e1313346b6c06527e5dce09c63391b6b987b06070a544c4b8aaf91652ffbb84",
-  "@esbuild/android-x64@npm:0.27.4": "7e294ba0331704c4c455763a7132efff4484066b1a522d64c3068c9017749b9b2c59dbb04bfa6491d78fb65da826109af0ea6a7517b06c8a7d7a64e706390e59",
-  "@esbuild/darwin-arm64@npm:0.27.4": "57f495c8302bfb58852915195e3066166239de00ea84f91f4cc84b7f46dcd126bdbef0ceb22581e643d0c3a2ca34936dd72a96b40291362c2716d3edb6e051ee",
-  "@esbuild/darwin-x64@npm:0.27.4": "8b0af048b1b03a2145484fa02283b5c0c9b528fb857d510d9a02150854a2df3a08ee93a4ed269b7e1da54c9009273dac2ce75a419c32fd2f516550bfc534fe11",
-  "@esbuild/freebsd-arm64@npm:0.27.4": "67a551695f67acdbe7ada9dfa0d97d30ba9065cf79fa96d4e8b75c892200ea25ad8187fb108811b0af1e1ba559fb2b7d4ec572a002916bed70bca654e2888c14",
-  "@esbuild/freebsd-x64@npm:0.27.4": "a3b0ce4ce0f6e3614b49fded87a7c5989e34a4b81876450650f372cb119d835e627c325039c9ec93cb5fbb098a14dd0e8cfda8a24e8be670ec7900a27e9b90f3",
-  "@esbuild/linux-arm64@npm:0.27.4": "f3467a2e4f7db00b73df8e074d6c4d7b685d90965d7db8bf1a041460027b61cd9e9f258cca66dc26e0a1b5d8cb84263cd7bec81d7513e27f0ea9dc86253e69da",
-  "@esbuild/linux-arm@npm:0.27.4": "b30c834aca19a68de625214e912e3e5e2b040a32c82acba0c66a70af741b43f5a02ab07fd1e2f42f2bd7d336e0cf25333993dd070e23c70ea6470170a3ad90a1",
-  "@esbuild/linux-ia32@npm:0.27.4": "51d5d31a222490225f78802cda61d4ba618a3b5b35f3ea57675725f2cf7af32740c8be078fd5bb42952719b81de4e5b692ea1961d0618d827cbd5bc3b8298a94",
-  "@esbuild/linux-loong64@npm:0.27.4": "225d208ce874ec7bac4b9028933872aacc1b3d7be886f90741efa1cdf853ad51a064c176bd76ff24f0ce1b21946865b72c69a68bbabdf0653873d0f95398a4c8",
-  "@esbuild/linux-mips64el@npm:0.27.4": "ca438a7ada46810bc1b24ebfcccf0e2c2cc3098e0690b6d2f4dd031bf33160fb5dde07d5644d5a60bdf3768d89667da7c0df30debee684efc47f0ed5b876c6da",
-  "@esbuild/linux-ppc64@npm:0.27.4": "da0bb5332234921f746da98765b9a20421a5334bbca2abf8fa0f149929a94c5e1a42319b62aaf9711918d42bc0e397e7dbdbda7389ff64c63f843d451378eb0c",
-  "@esbuild/linux-riscv64@npm:0.27.4": "b6942603508353c956f804e8c037d9d7092b7885f78c88882753e21e978f5aace82c0aaa42a4100edf2fce3be76ce582ff4e550a7a87079446a4b6228918100c",
-  "@esbuild/linux-s390x@npm:0.27.4": "719d52323400ce16ee69314886ca17a97d7ed6a9886387b7e4e70fae7133721eecb65a44b521d79d9b6a4f9a3c5fd78bfe65a3b0c5315f11e68847d012344d97",
-  "@esbuild/linux-x64@npm:0.27.4": "2281d03477bd82fecd14fbbe2c6ee385bc196fef87a2dee9be9eae69429af9972b53f869741db3fdfd404d936f38f3aaf237194f506f8113b79aa9978c26ffba",
-  "@esbuild/netbsd-arm64@npm:0.27.4": "ca68d9ba6054eb15e7de67283073a82b6492871bec6d9b67cee0785c6d4b9a3391f7c286dfe093206a659a05bf27dc2b58c1e730c0d7ddcb997b7643684cd734",
-  "@esbuild/netbsd-x64@npm:0.27.4": "9ca4d720a2b681d1a01b50005bd00eb6ac182055585adc845fee4312ff87c55a678d19bbcbaad9f4211e9d409c7d03121748524978aa5404143e375e22d2f900",
-  "@esbuild/openbsd-arm64@npm:0.27.4": "1459bc44aabc838255cae80e33b32eb22fd375d924ca3eed9e0987e33a1ddae6e59ac61e529564ed9ab7ce9ad108db0f9eb4c5558eb8bc63b952d4ff3692f4a6",
-  "@esbuild/openbsd-x64@npm:0.27.4": "809917a83bb809d51d11d59ebc1bf9f44b6a94fb1f82bd5d52ac642a7dfaf55c90a71351d263d2c164b2d38700aa0dca69afec4840f929ce56daf90a696eadc9",
-  "@esbuild/openharmony-arm64@npm:0.27.4": "0f9f7dd181d505e0bedae25a73ac26ad9acd099f7b7c49e2ecf12998b59e49c64331616f22cba6b0da9bd7ea6f5b7fc59f7860014dda5e6673d25661042f4237",
-  "@esbuild/sunos-x64@npm:0.27.4": "16c38ba94b9b2ed6a2ce17e6b5071459f24e7f1df51e4b6555de7310ff1696743089462585c8c49103ea468b8b1b4ee47913d759c5b44b45c15963795c731150",
-  "@esbuild/win32-arm64@npm:0.27.4": "6e7361fc9a6d12896443f5b59897e5539d642514b9ba440a2d245f84d82b4589744905b6144d6d345a25cb5b1d80dcbc8a87109f4c9d9e88533919587d76c8bf",
-  "@esbuild/win32-ia32@npm:0.27.4": "36b0fdfeed7263f87a86c93a47d45c07b5e5502dd31c4a3244f058a0ccfa08c206c8d450eac1cc1e0ab98dc1edeb601b60d3b673cec28015d4ed2fd3a0592da5",
-  "@esbuild/win32-x64@npm:0.27.4": "70e6d04df925717d37f64cf9945a2ce9d5265169df6a9f5d75e60079023d8f0de7ca9f6ac8826a947c313116990562fc6f92c635f0a185bdb6d02e94e967fe77",
-  "@napi-rs/canvas-android-arm64@npm:0.1.97": "e36688d7201e7c2f60e3e1691aa4be52059a57d1a076b0fd922ebcb032665d0cfa522f17686d6fa619ab948f22ddf5c454b2695263edad66c0684f22373f22ef",
-  "@napi-rs/canvas-darwin-arm64@npm:0.1.97": "ec8ff5246e437209e4d2c6ef3cfcacba95cb1f73e1f54734ea3df26cd861761d724342072367b68e377ea5780646384a420f5654711b5afe97704bfde1dc7439",
-  "@napi-rs/canvas-darwin-x64@npm:0.1.97": "706510e1bbdb5d0d7cd90477714326f420788f6869bdbbf009e46061d23abb043d655ea64d71d6f1332c7fd267acf7250119d2356760743d6243ad0ed08e18fc",
-  "@napi-rs/canvas-linux-arm-gnueabihf@npm:0.1.97": "f0615e165f53f67aae5eb109763376647c80870d696e3d50a85396816e909088ec4f5a3d5c200a2d87514fb870700362f334034c2e629d1dd377c91f8d566f8a",
-  "@napi-rs/canvas-linux-arm64-gnu@npm:0.1.97": "972083576ede6a0bbd7698775cfa954bc109ca863cda19dc29b4c7b479ca3d6a8e6e3ff3c2fd25f4b9d5ac140885a469a5f99e9c5fe8ccb8d2f714360cb0522f",
-  "@napi-rs/canvas-linux-arm64-musl@npm:0.1.97": "ed6f85095031d58d649d094bd4de9d61b81bc33df753711eca284e2f01778eb9a0ffe9259a18e7e3245862ac6299425099a85823322caf691436a60c63396d3e",
-  "@napi-rs/canvas-linux-riscv64-gnu@npm:0.1.97": "cbe5940f9f0cbf88161aedef662791475b0d7abc43a6c0698a6e35ebc8c0d74630cabc491b484ffcd83f5bc3abea07876b781ca93d369d13acc277f1f5de379b",
-  "@napi-rs/canvas-linux-x64-gnu@npm:0.1.97": "a3484db20c9db146b16a17697e99929611edd973222ab6afff45f8d76bd56551942d9cf250e11206d9a708cfc14958a93941531eb63ed6a95b4925ae1902bff4",
-  "@napi-rs/canvas-linux-x64-musl@npm:0.1.97": "2ea96191a243930371271cc34d3ad53d12bc19718e6eeadd5f98e64e6a9c6cb682fc9cc76eacda8daf7a197d7edde56aa3a8171abfd1b47d2dbc358edac21b3f",
-  "@napi-rs/canvas-win32-arm64-msvc@npm:0.1.97": "67bf5d16e364ac882d3a626c426fb5a46147809ee78e4184839e2b600b72668a5c45143d79e712ae3c6662e54a9c9b2b4f36b03482086f5ac46c25c84dad8771",
-  "@napi-rs/canvas-win32-x64-msvc@npm:0.1.97": "3435d19347f23ec93eed8adecfbca6c14db368e916298edf1adbe80dfdd9e7679effe3f64ec9ad8c4f683b56528328508fa6e1fad46230c5ce96f2db704cf5c2",
+  "@esbuild/aix-ppc64@npm:0.28.1": "9b01eaa9c57542436436de762466b9a348b4596aa53dffa6e7034e4180691e1948d33fe34ec302239ab04c280e5166248880f24531011ff419fbec6986a265f3",
+  "@esbuild/android-arm64@npm:0.28.1": "7c977c8d4cea5126df4b298d5c31c3df8d14aa05d7477aa11c4147ec7baff17d25542234eea0134f279191b59cb1af18fee49c6916afda554484464129e4f9c3",
+  "@esbuild/android-arm@npm:0.28.1": "44baed9765216202f71b6aae8d9ddb930efa671d34f63f4220d980662b3df4da7972e965c0a0f12922147aa8428083686f6cb23cd9a4f140eaf922ae0b59c2a0",
+  "@esbuild/android-x64@npm:0.28.1": "1b8183640bef23f41a91598d898a04a6a8e3ca31d0100207c7e75928ee885878c04e3bcf31f27ed9c655d6d8a7c08e35e3afef035aee649488cb2d68e51abf1e",
+  "@esbuild/darwin-arm64@npm:0.28.1": "8ed80a99836df196c2b7996448eabb2d503ec8c71d0a8be59af4eed457b858fa5fd9292528b1967f0e106d2a045387e375207a2cc262cd45f89596681e94e7fd",
+  "@esbuild/darwin-x64@npm:0.28.1": "952b23f33c24aea13f5a78fd41731e06e8c7fa732e10995327fa1289115da6b4123899ca0cdb0cf0a56add29efcb9f7891ad6fda0bfb94541347275537a71e77",
+  "@esbuild/freebsd-arm64@npm:0.28.1": "cc2c4f1f13230607807c3f128680d789e85d4b93309501c4f8d84ed0674f4a2a3e60e279e3b997ee9f797047c1c5b906b25e4fe37de62d19634e4470bcb16f32",
+  "@esbuild/freebsd-x64@npm:0.28.1": "5b99b980599567ee931520a019beaeea4c7ae2874d0bfab79ee4bd6373a869251d2175946478c527490ce155d10a5bcc795e8c986dceb4a36fb6e813513fc54c",
+  "@esbuild/linux-arm64@npm:0.28.1": "9348c6bfc2d878e6213cffe482d4455d817b9e56b3c581a9f68b94aac720cddea5733d963dec57ca273039f3a7ca1714f1ac8e39e2e0f85f1af42f5d05e3ed00",
+  "@esbuild/linux-arm@npm:0.28.1": "654d7af59b4be40f585455e42ecb389657c6f11b1f2be2d5ab04caeac0514574d8b2a28b9f0f9805d92e266a44a5627c5acc8151b0d0379f75ac1490fecc013d",
+  "@esbuild/linux-ia32@npm:0.28.1": "cce27fbd8d74f34bb5507a5db8c0119aa377c7a070fd0be3881a8efddcdb8adeebe24dc97d55784d74a8bf4a60fb55b48899f41b5e931acaa3eb9f90ecc94a01",
+  "@esbuild/linux-loong64@npm:0.28.1": "47c3215d378f5da750300694b273b83db26d3e9ed36553696a1769da6d467e7557e289b46d211c93ab7a2978348b7415b66c7fec31658622f5bd356332b9d5b0",
+  "@esbuild/linux-mips64el@npm:0.28.1": "166d8888e731bdeba0c657382d429c0a979af2136100ee2491ec47b2e2ec55f6924fe2045880b48a6cdaeb3dcc44fc495f3f4b9a5aa3bb8c418d1f53f86b2ba1",
+  "@esbuild/linux-ppc64@npm:0.28.1": "a8eecb9e43a26dcb70a9805e685dec9f0caff0a8bac691b06a6db7c14ba0a69980ef0c01cb3fc1377ad63e2c4945f396fbbeaf008588bb232e9c0c37dcdb557b",
+  "@esbuild/linux-riscv64@npm:0.28.1": "cfde883f336e1811fee019a1df402000c7a8e6dc5a2b3577679fd0d9711d1a774c1faa194cc8954b18ca11f3a380ef32905ea90c241803831b61017d8a667c3b",
+  "@esbuild/linux-s390x@npm:0.28.1": "ea121d2fb6c8f6161312e0239258b584c431b4d23f320ace7cbc18da77034aac5ed383658d2a48fdfa32e38be07126a14aa26802b8e04d0e958e82646fb87f41",
+  "@esbuild/linux-x64@npm:0.28.1": "9b5458cf012247e31c6bf465e37553f2fc5aef3fccc6593bb30fee0c547958f9f00fbedd44e5bc076cf68d6791a4af2ce8714260fe341cb16843a78643773e3d",
+  "@esbuild/netbsd-arm64@npm:0.28.1": "86b5cf33fbad27ea5e7345601e711a26717bdf5ad119efa0b1bb9ad6a75f7cb2658c57ffb80f19491e3c7105f4698e76358ee2b6d57f48c9a230de9f588589c7",
+  "@esbuild/netbsd-x64@npm:0.28.1": "ff24c209715f7f122c711d3c51af099de27659837d3f7bd4cbea9a8868fa99a10b7af785058d18a1e32b2132989d1d1d82b8768df77ff25ab6cf19d58be3697d",
+  "@esbuild/openbsd-arm64@npm:0.28.1": "fe6590621116132baa0a2b9c2dc95c6342f146170ec1ffb343c29936580c369a69061676bef4e654ee27bad6491f531af3ba985aed7133eb16b758fffae6a445",
+  "@esbuild/openbsd-x64@npm:0.28.1": "2600c51c394945654f99b096fccba95e1d34fa3ecf4e78f40a7aee4573bf21dd955c274e0586768e9ebef3bff145ffe30231f1cb281ef5e679f7aa78dcc86687",
+  "@esbuild/openharmony-arm64@npm:0.28.1": "be9e1d1e4af478778ce847e28809fba0b754340a699e37ec03bc1a3cd4e84e4fde30ffea62099757877229b024d50331efd6270580492aa6be38eb2353ef5646",
+  "@esbuild/sunos-x64@npm:0.28.1": "349b9c7d879496456b2eb28f7bb3decc12a906007bb7fb24cb2b269f6b3e5138af109045b216bd0396762e63b802f0233408cc3dce802be5fcf242d4835b6bc8",
+  "@esbuild/win32-arm64@npm:0.28.1": "551ada5396e1f10e3d3592dd60a148a7257af1ab2317bba09e9ed18a6d7ee7e5961c68eb1fbaee4e8c1961b504807493e1b8f5c700dd1fb990f0cb36b240ad57",
+  "@esbuild/win32-ia32@npm:0.28.1": "2676ace6b4d63721da34873974152e869aed9fc8bd9fdff4b8df14a3a3e68b78a9b4566e643b90b948b4e85773cbf288a33a59d13979caaadd43b5adad68312c",
+  "@esbuild/win32-x64@npm:0.28.1": "8d658b74ed9b7494b3799093551d4c928a7916865ed42d00a135156cbd08612b53072e9e424f0687c10a93a444d30d6b0294b6a1d5fdba78078d706646ba558f",
+  "@napi-rs/canvas-android-arm64@npm:1.0.1": "1cc67a6e714b9e6cb194709b04a3994ec70679734608244b56aaf2cdd08a451cfc489957ffbaae6d11df2a3ffa9783d27704e14f479720b8ca0002d152f11098",
+  "@napi-rs/canvas-darwin-arm64@npm:1.0.1": "670bb1e83207a3b100f21c9e46a9539a8c7435264aa83faa7db47697dcefc52ae3c890a3f3f3df4f0e48ae2a0a684ab2e150a917977fa5291e7909bda485dc6e",
+  "@napi-rs/canvas-darwin-x64@npm:1.0.1": "ad09f3cd6a77b2fce80797ed25dd234906a523d7b7eb3e1a7f282b2d2a5778b2524166a9fb3964211869acb7bdf0bac664f9fb23e3e5301e37f7dc3eee445943",
+  "@napi-rs/canvas-linux-arm-gnueabihf@npm:1.0.1": "a204cc876f337011d1f04fdb7030af306c52612d8ed62e9fa2d9355f862de52fe56585c08a409b08e8d117200170c368cc6c9a60771f3763532c0ee900ec8e8f",
+  "@napi-rs/canvas-linux-arm64-gnu@npm:1.0.1": "84847d67398ba2a03b6eb77a3d71fa5ca17a0155483fbd8662a2fed106e3a5cfa7724149b571cc324beea3ebedfe1a5ba74c92254e2db1944c312750e9597349",
+  "@napi-rs/canvas-linux-arm64-musl@npm:1.0.1": "0f952496e5b22698580182862784ad4ab6afea1822a0398eea66e659f1c548e669a1fc9d805c9bc2e8e784d2ac1e8ca1fddf1584a0abc5abad9a017d5c2213f2",
+  "@napi-rs/canvas-linux-riscv64-gnu@npm:1.0.1": "2a10b4a1fc89e6dfa152f70de041e5c81ed4f7129ec5ab8ec54d155652540ffde5468b3b536f451c439e1b3b07c77bb3609c486cc9ad4a164267c781cad13a53",
+  "@napi-rs/canvas-linux-x64-gnu@npm:1.0.1": "41a577d9024e6c01fd47eb44f35514a558d63ce8f71384ad237857613911d667cd22caa3bea8ff470de771987cc293acf2433a5758307dfcfecafb4d2d1598ab",
+  "@napi-rs/canvas-linux-x64-musl@npm:1.0.1": "2c46a2475e59718f1562639bba501cef507cfbfbbeb15aa92dc5ca9839df781d698d152e3d5e56b258343aff03403b18d984e49a27f48df24013258f9ac9b554",
+  "@napi-rs/canvas-win32-arm64-msvc@npm:1.0.1": "8ef07e51204c8fb38b5bcd2e94f3dcb731b4456a8a56b3fb4eae3f7c92cc7020e1a7b94b0e566d6432783050d8a1737d40dfb37b06863d5064fdf1519aa11d15",
+  "@napi-rs/canvas-win32-x64-msvc@npm:1.0.1": "ee22f54b18f16ee09711b63ef67f2d2c6302574ea0140181664d1efcf508875d69c0d8948c2e5be0cc6078bd6f5781e0cb85c1af81e7443251a2983f7f030acd",
+  "@node-usb/usb-darwin-arm64@npm:3.0.1": "a47f20202b48f309a91aa726b0e5a8ccb3d19d8615988cc90b4e3ef3557f5bceb3da98a8495c6a59d22cd486db2faf78cec69cffc4d6285ac239392ed8be07d5",
+  "@node-usb/usb-darwin-x64@npm:3.0.1": "a6f0010a97bb3756956b2a14234350fe06cfea03feb087bffe0d9bb5f5b571e3ebe93c6ce0ad4a486bb4d0bb880eabf6fa50f1bc2d273f16e4811905b70e3313",
+  "@node-usb/usb-linux-arm-gnueabihf@npm:3.0.1": "3caf6677834fae131ed1566aab62eba1da1f9d12da17fb789bf48c142b5ab5fde7eb8fceef59a8b1543a73846bb8bf368a4029ca8bbf9b1c35d30e93cde3ccc8",
+  "@node-usb/usb-linux-arm64-gnu@npm:3.0.1": "194dbc3d0e594c023efee4c060c61d2523d96e686f74181f06df9747b9b6dd31daa2a757dc0bfa26ea819f68ab10edcd64e12faf052ead2af31ace1e1494a94d",
+  "@node-usb/usb-linux-arm64-musl@npm:3.0.1": "1bf85e9d653f3418f66e06d7df9da879fa8dc10ef11a1eedac66116d8f9eb459f59e83d033471886a556ea35805bb4bda07070b698d6fdbbb817929e8acd78a6",
+  "@node-usb/usb-linux-x64-gnu@npm:3.0.1": "0c2e117a42697717fa2c7a72865aabeb148a5c3f2b29d9b06d614282f3da2a536afef0151ea5fe6e826de3f4af4f0be745b30fbc614a82dc2a54ad5a087b14eb",
+  "@node-usb/usb-linux-x64-musl@npm:3.0.1": "fc8d8ca0efb54b88020ae9fba342f76ee6b5be4faa0ff4bf95b85f35ebaa3a7a52cbf98b9c432c18145a5a199c2a276793308276eb76c6177ba7bbe13545904a",
+  "@node-usb/usb-win32-arm64-msvc@npm:3.0.1": "0f793ce63cb210b8afe545acb61056941023694ab28c6f98a1153b7f82199efcabecfba5fbc5312e431f7473ef49ee0a2c32ef3e210edbda7e86503cd62f146a",
+  "@node-usb/usb-win32-ia32-msvc@npm:3.0.1": "2d8aae1e5694e046dfa2bbdcf18265c7b3ede1c17b71b1120efd7c43be30c187133289c6e2495d39c04ac5eb0cb37d8954339eea177024a8cd87ae2cff5557a1",
+  "@node-usb/usb-win32-x64-msvc@npm:3.0.1": "d3b0ec8570dcccc0e47eb5633bd8bad6276a98134fa1f1d87cfb35f66fb3a9cccbb54efad0842e8f1491d5d40b0620358ba87d247bcbdbdb4307db3d3a41168d",
+  "@oxc-parser/binding-android-arm-eabi@npm:0.127.0": "945e01f64f415992639081a3dc19aa5919f45e69c38298e20cda23c1e8bba26f79bad55e6dd6190a43866f363dd275970b71843ecf8a51a360cc8768f5900da0",
+  "@oxc-parser/binding-android-arm64@npm:0.127.0": "f28a90adca64bdabb7e5991941ace223559acaf5ec134fc6fd4f983979a660eafe97b1b03139c6608640e3b37d5a0225684fb49efc38b97486acaac2ebf9f3ef",
+  "@oxc-parser/binding-darwin-arm64@npm:0.127.0": "490d39689bb179a1f21b6e2230fe877fe6d62520e84d5a673f4d7c704c9a95bf63826bce15208ebacba172bdef0d5fd189b87eb5556de1b9fbf12944be183c8a",
+  "@oxc-parser/binding-darwin-x64@npm:0.127.0": "8e1ad7af46356aca1d43627e94c9a72d35328a5f66dc184a33bc3e28a086f4ad2b70bd44f097eff6a6b52ab94bafe0e15de396f6eed01d0beee7bd1a45e98541",
+  "@oxc-parser/binding-freebsd-x64@npm:0.127.0": "7eabf352fd03452bb8f853c7d92581705ddc207a31797b2649f364715b5818d3fb86512bca5a1dd6b3092f0690303f92c240d6ca1738b7a5e27992c08f648cfb",
+  "@oxc-parser/binding-linux-arm-gnueabihf@npm:0.127.0": "98edb854fd3c30e489237fec6cda7c1e46f0961d1b738369fec357b694989d95ff5ca20b576c835b7af7084ff703888751c877d46862e5745ccaf9e6ac226a0d",
+  "@oxc-parser/binding-linux-arm-musleabihf@npm:0.127.0": "d4a19c2d8f943c341e452e7ba8adf844998f87ed4ab501b473a05719fca52282bd133973f26e07fee28812963d39cd199702faf424a42300d4e317149079e84d",
+  "@oxc-parser/binding-linux-arm64-gnu@npm:0.127.0": "d818144ea9a661d54474001e750a501cb5e12460e22d4fb3f1c46506282ee9689a682761e07f4b925d2349fcee2734fa50b6655ca7f519c4ad9a055b0c4dac89",
+  "@oxc-parser/binding-linux-arm64-musl@npm:0.127.0": "f62825639af42d6be5e4c7a16576f1e23f4386b7db222dec59e320c0c2ccfdcb6efe45903a2969024f14c15f173b174d969473af9a0773cf25c07fdd3bfa4e31",
+  "@oxc-parser/binding-linux-ppc64-gnu@npm:0.127.0": "e635b0adb9e26bfce5209a87f2b55137ccb1e0d95208e1fd36bc1f0735fc3df95f8a99e11ad9d9ae621031ce21dffe583aa01c40080a9f57b466945306878e83",
+  "@oxc-parser/binding-linux-riscv64-gnu@npm:0.127.0": "bd16bb323eaf46ed519a583dba0a4b1a5984f65ba19d3773133476a7bec6985e6490efffcfd4d5f711c5acb7e201ffc5898b56ad7fa619cf884990514264bede",
+  "@oxc-parser/binding-linux-riscv64-musl@npm:0.127.0": "dc38d5b6c6ebe40c2f45ba59c1fa175f9bf148c274c41b0fea39311756e7390fbc25ad1f2399bbb9a2a12f1c2a8d4e284055a12042b6ec90b08d79e579afad33",
+  "@oxc-parser/binding-linux-s390x-gnu@npm:0.127.0": "a6e6f9c0de7b62087e3950a16b8c6f74b0995e0599a74eff0044b770dc1509e7f390c837f58ef349812036c2cec145cff5ff29800707123813688cbb632b3565",
+  "@oxc-parser/binding-linux-x64-gnu@npm:0.127.0": "2eea74fcd38d5c2cfdece401e9e8d2099f660266a2efd01603f85abd464aed1f28f77af8951655b2173bde8446da99a0657e7f531af93c941d6e2c851cef093f",
+  "@oxc-parser/binding-linux-x64-musl@npm:0.127.0": "e746466aaa1f7826130337d83e6b976736d780c59c12c43b5ca4710ad6a24439341e9d5aa58d705d6f6e0618296daf7f422f24e260b3e5c52f7cd0d916bd7ddb",
+  "@oxc-parser/binding-openharmony-arm64@npm:0.127.0": "5a00e6fcea62d4cfa3993e8d1f4a7f1bc2d70a80f8ac5bcff204eaf820124529194517e94937a3a6d0c28844cf713e7629c0a57cdddd87e0670c786c1890aa74",
+  "@oxc-parser/binding-wasm32-wasi@npm:0.127.0": "0679729f6bb75538acfda31258110ba0c7c60b195ebf8f0461c1f412fe8cf8a423c35eb107f184e67f3160c44efa32c705581a4014be050feac652a814eb9376",
+  "@oxc-parser/binding-win32-arm64-msvc@npm:0.127.0": "410ccb3fedde21efef8713198be39e7ba6526509d1328801b52c76e911af3412d1f214aea3609aa828bf30ec8a05e811c82e383da8e6cc3d670415cf17497db8",
+  "@oxc-parser/binding-win32-ia32-msvc@npm:0.127.0": "86b35f2feea4b23654bafe27b9bbe77194d4923f73f4254f813bcf14de5f12a09ce67e7fdb93b73944c9b859a0433128f3df2ef3fbc56f4c486e99d393508f0b",
+  "@oxc-parser/binding-win32-x64-msvc@npm:0.127.0": "6993c90d54ecfca7b5fd5a2a6f07909d53ce553b14e55dda739550e8dbc1a593c49f23792063cce95bf286bcae4f67624d0d9f014e28eaa700a31da185f2127b",
+  "@oxc-resolver/binding-android-arm-eabi@npm:11.19.1": "7fe35b00927acc6b1e9abd7cbf001cc4855f697b1a6604f245cf80ecb09628195d724545680b11ee58c462482247017e6d25d3b6074437ac61842ebb2200e925",
+  "@oxc-resolver/binding-android-arm64@npm:11.19.1": "2074f0f614aac0178d8c879f0a3897aebbe9cce66241bb8db8dd0400bf30db8a322fbcfb3dffd90e4a9f08eb52f32026155094c3515901f9e50f8c8115508bc2",
+  "@oxc-resolver/binding-darwin-arm64@npm:11.19.1": "43f0ebd467387f508dd13749b67a1b21b81902dfec7c7fdee24df1976942a78171e29e4ef09390dae88181dcdc4ccf08f43ade727c101572fff961b925f79834",
+  "@oxc-resolver/binding-darwin-x64@npm:11.19.1": "efad8b905d7cab94ddb749a7b486e7606d21a71ba3f2c8bb117e4a7648aa22499663c96819196e0f38830bb87885f147f517147f3117f805f908274086de01f9",
+  "@oxc-resolver/binding-freebsd-x64@npm:11.19.1": "750c57d8291f8ab8759f68f16b10aa5967879b7f6f432aed838d3e4b3ea25857c3f5dc1fd4677e79de890e79cc5bdf8bc845ab403bc7d9b7d7827c6af11404a3",
+  "@oxc-resolver/binding-linux-arm-gnueabihf@npm:11.19.1": "d1a71513000f2d7c300c45ac6b0900831e37759fd0df7c92a6cd2c66b87a724a303da7df94ed16fcbba72ccda45766923212c9711edd228b9f97dfa8da38e08a",
+  "@oxc-resolver/binding-linux-arm-musleabihf@npm:11.19.1": "4f1b757e8e86fbfdb7f8fd43e9684f3fe339e46606d836b509241c9217ae608397c5c4383b45ba9eabc3b6b4664842839037d41a9e49e726e4ef6e75d871904c",
+  "@oxc-resolver/binding-linux-arm64-gnu@npm:11.19.1": "6b1342772f5f347fe2a25582a8cd60f3814a7a6e4d2bc8e4a140355409df550858b961ce93932e3ce01fd440e7d4b2dd144978cd6372af325a6e2d85e496b4e8",
+  "@oxc-resolver/binding-linux-arm64-musl@npm:11.19.1": "40b99fcf1401d0f09a701572927bae4305a15705d2bb44003773ca5bb3ea8f28037e1e64fef5525eef314bd6ef348997b36cd521b4023053e0e0873b6700d52f",
+  "@oxc-resolver/binding-linux-ppc64-gnu@npm:11.19.1": "3581288514ce58eb79c927a03a43667e7e51b67b20be1f2c8343bce07f1fa848b9802f2d12990af73e8dae790d1ac6200611699c5350bd28a06abe3115a98002",
+  "@oxc-resolver/binding-linux-riscv64-gnu@npm:11.19.1": "1a8e43df91d8e7fec21c3cf816f20f98a0237b202e99d3768e1a9c49d9ddfbf0acea962991c4ae67dea936f3d2031d77bcacd3af615eecacf7828246be79becc",
+  "@oxc-resolver/binding-linux-riscv64-musl@npm:11.19.1": "a71fd4c5a13d7cb588d341318811d2728d64111878757988b15c2be3199d0e3f9dacb867ca990ec3cc38ff9eeaf9dfdee7aeb23738028031e6303903f0e501c4",
+  "@oxc-resolver/binding-linux-s390x-gnu@npm:11.19.1": "f4fc6a75967235ab88550b30891eb17a490e5bcfa8e9b2eaad33b3a4e7fd52ca60e6e0df3dbed5ab9bf4cab51bf05725e86e6d3172a46a1a95a928012a2d52bc",
+  "@oxc-resolver/binding-linux-x64-gnu@npm:11.19.1": "090f364639f4c6c021f345dc182c37c0d8370bc7b7ce5d93c546a49a3188d400a9c030106cba27a8c02dd7044384efc51187cee4f2e617109593e3c237a65509",
+  "@oxc-resolver/binding-linux-x64-musl@npm:11.19.1": "653779d9f6b78df664667e5f8693741727cd7c3e74831e0642a3ecd84fbfb36d302c1ae38a53cf33cc9516aef7d7f5ff66dacbb5f3701805baefc5785a5d7669",
+  "@oxc-resolver/binding-openharmony-arm64@npm:11.19.1": "4d88027b1ad55ab8b4820e8ee24c3a23b6ab6731c14da0da3c6b27394657bb54dd09d01085a64884e8f7219f719b48ea2221f0d7c8f10d2e7288c8a5e0b68287",
+  "@oxc-resolver/binding-wasm32-wasi@npm:11.19.1": "53be10977b68276a5e72be2a6b56361ff5548243aac269b93178a6058b0cf4dc14484a73ee5d0b68be1582982d96d434d97838515d1a9034a901080aef9d1b75",
+  "@oxc-resolver/binding-win32-arm64-msvc@npm:11.19.1": "f7671ed2e4f73d9f5ec386355fc9d93940c32bccdfbb7a7fb16bdc51e3cc42ed920cf9cd2f72d77c56e4a4a2c9357e53df3ae88b36106fcb363771e47f50e19e",
+  "@oxc-resolver/binding-win32-ia32-msvc@npm:11.19.1": "d60ccab0778023eb6977636c32d05c2369b54390aa8bdba4da1809323149548359bc546bccd9e5e717310c46e2a742ccd4dbc3f4750789aa97b5f9cef10ddcf7",
+  "@oxc-resolver/binding-win32-x64-msvc@npm:11.19.1": "bd84616bb214bd3f63531299f5576538f3f63411f95f1fb470fc8d7434c409fa1922bcbe535c4137673ceb3517e61b102e739a06b1963df600b717a954d22b16",
   "@parcel/watcher-android-arm64@npm:2.5.1": "f99d569e4f6cf78a1b0097fb9d4682cb201a74370ae440c531da4e1d5021e46141bfcdf8ef708b51a5b9cb1c30f78eea933ce75216d5eeb7b969a2ad27c68e4a",
   "@parcel/watcher-darwin-arm64@npm:2.5.1": "973c7ef3c94608da9cd1b20b18b9a7de2fb46fe44553731fe372b640de524491976150d0845f3d5953b74ed8ea469cb8d18a48651d0e5fb82f549a6b46b54f79",
   "@parcel/watcher-darwin-x64@npm:2.5.1": "848c5516aed9c36e14751200dbbf57e83c0bd46cdab0932df33db120e66b9596de18eeb98980e319efde84014f67d9e7924d7555383d8ffcefe35c501166b84b",
@@ -49,46 +99,21 @@
   "@parcel/watcher-win32-arm64@npm:2.5.1": "e015314d6b9b727cbe25eedf963ca8b23bf6d4e78d3c28008bd0d2657940ad54a271330486df3a93a5f1a30f2b8d052d14415b85cc7e7b747c6c73b5dc055628",
   "@parcel/watcher-win32-ia32@npm:2.5.1": "920b6ad6a2095aeb9c2d329c5118472a3c14669fa93eaa99aa8050c76c5c2d3d76d92677167ed748c2ac5487c568d5df16d5d94f4bc7c354094fccd8e0d6350c",
   "@parcel/watcher-win32-x64@npm:2.5.1": "8f1c8e41ec9f86e4dcd0d4db0a077742d5dcc853f15ea888387183e34e2efcff09fd1cc9ec46fc1121b9ad4ddc0e221283f2ffb23cfd7dbcbb8b03060b461963",
-  "@rolldown/binding-android-arm64@npm:1.0.0-rc.15": "0c78d6321d2dedc0c6ed4b5541328f6c04e8530a3c294b477cd9741e2af7c8377a51474f0171c85ecf63bff5c8bb31ee586f40f13fa265a869247ec3d6293204",
-  "@rolldown/binding-darwin-arm64@npm:1.0.0-rc.15": "598b8cb87d8ba8df4e880e0d6903f7f4f32b3e7b2804429cb3ccc47a69b8e7b852b2e3115a8c3a882d14979909f9464e8da55c2c52a52cb18a81df7e8a1aa654",
-  "@rolldown/binding-darwin-x64@npm:1.0.0-rc.15": "92fdfa58a8d9edaec4c1766c38c34f657715d2c8faec141590812d11ba6a6ce52530e55a6a2515fcd2ec6287e50187a458f06ca3c6813130cb9869a99c9f6f29",
-  "@rolldown/binding-freebsd-x64@npm:1.0.0-rc.15": "04e8288accf007c82e8bbe75af62d4ed570bddd7b25a178506fcf97daa0907cf6f85ea095be5826095242ac1a4923196059f53a9e8fdd0e3c34d9ed1c00d64ae",
-  "@rolldown/binding-linux-arm-gnueabihf@npm:1.0.0-rc.15": "4cd7452e4fe4433b730585bcbaf210efc50621bca5906204179ffe80748bea187398d4091dae64079f0c7ebfea1987f0b1c045ff60209ab0f60be9e04eccbef7",
-  "@rolldown/binding-linux-arm64-gnu@npm:1.0.0-rc.15": "fbddea791134b45a94aa5aea640a177d6feacd81a44f9ee3615da3daa824dc2a193ced6e8f2a0bb0676fca7b224525513b451cd8f78b379d7b1983fe6a0360ff",
-  "@rolldown/binding-linux-arm64-musl@npm:1.0.0-rc.15": "b325fa98753bf41100c5d95145f30ce92b5f69f6989973306344b1644fb21633454aa216f28355c74d0e7bd5885bb6d2c80d0f96dcc2b869ca7e63d8b22dbe91",
-  "@rolldown/binding-linux-ppc64-gnu@npm:1.0.0-rc.15": "0bff0d2724912079dcedfbc0a86dbad8e3e376d2d619cf36917964701b9ae5a39afa5ff49d3cb5b2c3e17437c559314cf8e17433ad3bfb4b64229d9c8bf1ebca",
-  "@rolldown/binding-linux-s390x-gnu@npm:1.0.0-rc.15": "6718fd91ead389f3bdefe22fd0344b490d3f9350697e4aa35a0fb55957aa1b127d26aaecf9bc2d49f1dfde62d9d4717cf5dfb7d93ce3b871372ef9c6cb7a1b1a",
-  "@rolldown/binding-linux-x64-gnu@npm:1.0.0-rc.15": "cb7628e1a7398ab5fd07dc79a38c73a27524d45adc989b5d906ea37e23b7692123d607d07fb9fda35485d6caba545ae41c561b9632aefa0bff76997208f83eae",
-  "@rolldown/binding-linux-x64-musl@npm:1.0.0-rc.15": "f59fb354b8cac55d123f6f3fe7bf8210402f97ed4be3f3a883c6c544ce1b825e36154f479d45f6e9f23c1fcd8861e9f3873dc24278631db871d263db3bea5580",
-  "@rolldown/binding-openharmony-arm64@npm:1.0.0-rc.15": "b6c220a48ace9c381d238dce2caaa8453da1d3fe9312bab7babf127a500bdec2bbe30bd381f9945af79c30fe9ca0185108b86ef311fc83ecb83ef24f7a587902",
-  "@rolldown/binding-wasm32-wasi@npm:1.0.0-rc.15": "9cd39e02ad5f43fc45901d074df10c0e3532d9077a6e334e431de60f90555c15e5445d1b5156c10df49d28839f9f15d5d808666bc8e70ab065bb9af3b8567e7a",
-  "@rolldown/binding-win32-arm64-msvc@npm:1.0.0-rc.15": "cfc32a72e8a3900f356b0b359520df3f18ac79379a273a4c53b00b1555123dcfd8204cf9976762664898b0c6c949c0edd4be850ae254d2e84a40fcb8352858eb",
-  "@rolldown/binding-win32-x64-msvc@npm:1.0.0-rc.15": "f0bd2876247f0834f135c1ae150b7d5626d54ff399b4a6193626dc46a0eca22374a43c64afdf3eff8e8e9cf1f20df826bcd9fd4219df3fece03972b8ae080e20",
-  "@rollup/rollup-android-arm-eabi@npm:4.60.0": "9a4292f59c64fadb8583a1cb20aa76ad07cb14213abcf705a25f21102f618d2c0c225caaa1730d77da3a472ba1660c987f709f364a60ceaf31199ecb2c7bd82e",
-  "@rollup/rollup-android-arm64@npm:4.60.0": "59f4cffa6b8245a3570479ac30834d18a63bc18d0eef706eec41800fa3256ccf3d5da1d9b0eecd360b8dff4df6c50adf7935b300e5443c72c2348f37307f828d",
-  "@rollup/rollup-darwin-arm64@npm:4.60.0": "5bdfee08ea0c0c49dd9877773c8a7361628b4274d7ae03925aa83e38dbda0f985d3bf128ee5bba99e50754034e109b8b3faddd47b776e503374fbebec6e98dd4",
-  "@rollup/rollup-darwin-x64@npm:4.60.0": "eb7bcb4655e1c31eca74ee96bc8c1de3ab3a511de3e5f433d59c14d4075ab6c32f6770722f5faded1cf8b6b64e3cf9378ac50b0722a928f972abb5e9e8b79096",
-  "@rollup/rollup-freebsd-arm64@npm:4.60.0": "510dc460350a81125c86db154c152af573e97fc77658924ddc126c98fae1b4e7e96274b1943d0c90f6246fc821aa0f90401f8982e18cdc06b5d0d62b0dd8791e",
-  "@rollup/rollup-freebsd-x64@npm:4.60.0": "5d8f2e66a1d62ddaec83fccce64a407e63174deb6fb4e492a8719c879f18e77baf2b1068b044f5fe0b67a41a80b72ac418f9aeb4baf5d9d9433c7701202d8a06",
-  "@rollup/rollup-linux-arm-gnueabihf@npm:4.60.0": "ab1f4fcc86f5d25867f84b00dc546f067f2a53ca631452407c03e70c341b554b03d2f77086533f55be20d36d9382a8ec339901bf789482c73dbe59d768adfdc8",
-  "@rollup/rollup-linux-arm-musleabihf@npm:4.60.0": "e08b56f8e3d7773e5b685100d22b4b0a8a562ea56524817528d214a6aff2319234da462e228d4842d04f5e1b711ceb77f4b041a4d2b69d446b959c1ce5cc603d",
-  "@rollup/rollup-linux-arm64-gnu@npm:4.60.0": "1cbf82bc9acca2ae204155d38c890faf88c4b02060b3ff4c96993379e48c08e6541aee3adf4e6a6dba986c0accc554eb21f9c23bbfb0257773e607a5d40eb6d1",
-  "@rollup/rollup-linux-arm64-musl@npm:4.60.0": "94fbd42c786baf0178adb6309c8d2c9fb5daa97cf2db8cd2cbcd88999c80b9de3089240e804f4287545eda3b509aaa67a41a8711ac5799f74261e11469d64dca",
-  "@rollup/rollup-linux-loong64-gnu@npm:4.60.0": "e840acd88f492be16732c7b365c680e03109702c7e6a33fdae04992abe333378180e713f9d536585348aac09e50dc11fad23d946df7338d13d95913010232bf9",
-  "@rollup/rollup-linux-loong64-musl@npm:4.60.0": "9775b8fbd12743f82230f4cb42f69c5fa2a96ca132a87d5a141115f8f879e96d37f8f9ee42fa5d9323a9c0e2ff7e5aba4e7ac99fab5aac044e0d47ed4e6dc2b4",
-  "@rollup/rollup-linux-ppc64-gnu@npm:4.60.0": "343870a783702e938933f8161c9a55abc5899cf52bc4bf44a97c0fe93ede9622f52488d56c33b67ccc18da1f3b369db984a6930d0a005de87221d8d997a827c7",
-  "@rollup/rollup-linux-ppc64-musl@npm:4.60.0": "3e8bcd82cc55f01a62e900877a56eb307824dc20edc22b0d51f3b21851f873f2da0dd146eaebf4423a7bf1d8ba377e58abf66194deb280d1fae54fb9de3b9d63",
-  "@rollup/rollup-linux-riscv64-gnu@npm:4.60.0": "3fdef46fa6ec90106db05d313048d970e86a80ed5ac6463b1f6060e1796a9f1c2287787ef47705032e0df704250046b271c9a52e691df727613421953bcb2bb8",
-  "@rollup/rollup-linux-riscv64-musl@npm:4.60.0": "50fe34aeb87c03f2c5a356884902242d4ddd3b0eec43b946c89ef1323dbab485a504638d024353f6b3aa7fdb1a4ddc979b8b034be22278ced4b0a9595d6ec7b6",
-  "@rollup/rollup-linux-s390x-gnu@npm:4.60.0": "af9d7f6f876af243960262868146f4f1ebaea0dbf9adeb14ea85b07c60df0e1d4241ddac1008509ee80ef47cac8b924f85099f7076f8c25e807cf87f048f435f",
-  "@rollup/rollup-linux-x64-gnu@npm:4.60.0": "3ce88bf8a93ab7f732139b3015249c5b8af5f0ceba8058e05f21c3e51144661be844b9a9ab20503b0f420579d930d37e55575dd544d303a0efcc09d979f537b8",
-  "@rollup/rollup-linux-x64-musl@npm:4.60.0": "893569365547e7fcea9fa83dc5f7824316ba959ee546606df70633576e6223fc5f33db3da89caf18815f2d671e87fd549886bbe7795facb68de9da941680c335",
-  "@rollup/rollup-openbsd-x64@npm:4.60.0": "ec522dccd3807237927afd6680ba7096041b477d4ebef6142e6a390fcc975fbd6d43d1a0d6e53cf8e97b6d90e528bb51a8ba1029383bbf086f5380fdf90ec6bd",
-  "@rollup/rollup-openharmony-arm64@npm:4.60.0": "aacd3b633618c1933f413e0ec2c588e75c3dd7830c34e2bc947915a307f97c570d08d103c5b4f30fd6b60a77dc6c81eb9ab4041205ba19414f55ed644a74f180",
-  "@rollup/rollup-win32-arm64-msvc@npm:4.60.0": "d8ecd24616112de473344717e07481081c0652f0a0d40dcc645ae2ac05e60fc962e2b0f86dcca7ab40b07625886050214403fd125e53297ba3003c877430f71a",
-  "@rollup/rollup-win32-ia32-msvc@npm:4.60.0": "0362713f7cfeb0b3deeedc11fabd551ec309cf21952735c2e2b76caf083331aef6701a11d2ad7a3824c439a9ff0d0c305aa12ef62f4f0a540eba2e952a18b00c",
-  "@rollup/rollup-win32-x64-gnu@npm:4.60.0": "1400b3aace00dc90638bfd39d68275bb5f16143d240b9c36eb70f242ed2080c26fe14192fd3375120308ff94a7da1e169a8e0e56efbe41483f59731602d3be84",
-  "@rollup/rollup-win32-x64-msvc@npm:4.60.0": "c948b3a8ed6e73f2382dc41ffab3e9928f95c4a0e3481272b26ad04a5f73084ca13fd5c253887f9077c37cb1c91bd8494b4a45a7764c874aa105684e8424289a",
+  "@rolldown/binding-android-arm64@npm:1.1.4": "d59f76669aaf18426811b5e35321cb5598e69bf57c1fe52c384ec157417c2cce95b34af5c41c085eb1098d92b3129ad3f5211df48efc759361ea8df5011efcbc",
+  "@rolldown/binding-darwin-arm64@npm:1.1.4": "0a1b74f273e25911b0110d289fe517f6273e39b5a08972231ccb74b76035d6229d51ca3a92eb1b0dc774e7377d373404d1c2736493271f576a266c0080a34206",
+  "@rolldown/binding-darwin-x64@npm:1.1.4": "736b7ee7d9ca8524466c329361c64929fcde7ca98ab99f279383b4e2e8df5824a1cce08bc5b6b0ff5c6753385bb4438b057c0afb7326b568d020848d950b2924",
+  "@rolldown/binding-freebsd-x64@npm:1.1.4": "d18f28b53889c03a99822f1666684533074329be5519ed79428d0f180d8748a21a1af00cb1de895a4a2e2c4981219d67ffbf894f37b5d45d287402644e4c6c3a",
+  "@rolldown/binding-linux-arm-gnueabihf@npm:1.1.4": "0229d25aafebcb76beb377ccfa2e4d55ff632563ad1ff8b061e71f5f98408924cd69c7b826265d957f8f392d77503d0acb7b297944915df44718a57ac83c7efb",
+  "@rolldown/binding-linux-arm64-gnu@npm:1.1.4": "0941dd2d18304ecb46cb08d8be7dfa22f34ed7a6c63632c6a274ff3035987fea4d672ade92d5a4ee5c31113ef66373978a3c9cab598c0b128ab1b2c9e5cee5e1",
+  "@rolldown/binding-linux-arm64-musl@npm:1.1.4": "a655f61bb3695a470deee665d3b1b6bf1d08e89b71d96e6362de6675dfa058352cb4ae360a4716aa1887cd97163b61411851780b84a2847ccf4cbdbf1dc36565",
+  "@rolldown/binding-linux-ppc64-gnu@npm:1.1.4": "7af64514357ba55256c6d2c62e1a2f0fc0a807f303353cd5b2703f64f04d1140f0edaa3eea9a94cfb120cb6e4c71a447c30041ecb86983e9a001455de5a1430d",
+  "@rolldown/binding-linux-s390x-gnu@npm:1.1.4": "abc61c30e8993fec98a17bba70398150b5b1a2a637e869ef767150906e43622ec2dd7cba4d5ec44f2f3aea193c95b75a9b67438e6cf2cb1f2b7e19569821fd80",
+  "@rolldown/binding-linux-x64-gnu@npm:1.1.4": "a7f99f45df86abb32d0d95023cae3e9923b47f04bad48e276355b9ceda9c9b9c0f70966557d48006bd0d673e7b4b622dd9af4ae3e605f2e7b717fc63f1c43878",
+  "@rolldown/binding-linux-x64-musl@npm:1.1.4": "1ac0921cfcd2ce3a5fbc70bb8bbc17e7a138a39413cce6a151a943be870d2c91b5679ad6a85ccadc383100f795f52d6fa47a47652a5c217a8bcb1302defddc91",
+  "@rolldown/binding-openharmony-arm64@npm:1.1.4": "f61e8562d59b91f4c238cfc815d5b43fa170f6a2795f0de6fd18425e155c8a75486f5a1ca53785bc81b4b9fc3b1967d7803b5be89fe50957e823746f6a35484e",
+  "@rolldown/binding-wasm32-wasi@npm:1.1.4": "e248421de5a5d30667deb15274101b73562e0ccb25de708eb7c1e463d825dfbf42e0a498f70093d8c22bf640d21f660c5d9e158001ecbb0e02c8c2be8db4009a",
+  "@rolldown/binding-win32-arm64-msvc@npm:1.1.4": "d2893af2319711c04eaab03e248d0f96b320942b7f843267b7d62d829eddd5c47808f0b2534fcce4c79db53da4d4cb57a7912f6ddc2e39ca72f09263d397d87a",
+  "@rolldown/binding-win32-x64-msvc@npm:1.1.4": "1566f653b56c576927cbe33d6c8aafccc82046ab04bfc6ac1907c58b48d902033610a6db23bfaa3376b2bdcbda1ef1c5c9437367b8bd3df4e247c9469e8beb1f",
   "@sentry/cli-darwin@npm:2.58.5": "8bb8a01ab9ba6862304d2efbb40a397cc52859665be38c238b75a3c82c0e6b795513a8e018c591da6b992e9531e8e485ba0ca46c60f2beca7690b0693ac5a771",
   "@sentry/cli-linux-arm64@npm:2.58.5": "1755aea6fe1808306fcc51e2d88f1c161118ea9f40d47f97570d121300da083fe405fb64b8fbbe753930c8ebaadb30da24c951e5e38ae5ed39bc97e02d712d73",
   "@sentry/cli-linux-arm@npm:2.58.5": "4fa8047b1bfa13969093ab25a643ae8b3e1f65fa3e1c6b2287efb1c6ca086b44e39ed8e7a5dfdac0d71efd7d985eaa12fa9034dfaa0b65e904d0ee082fca0e31",
@@ -107,18 +132,38 @@
   "@socketsecurity/socket-patch-win32-arm64@npm:2.0.0": "65418168f7f68cd2373000893d96251ea7ee8216a9730f0d51efe24402d67a5126f5255d6eb2d5ccfc4726e685a3ca17fcf7ed0b0d5feab631136902d5f959cc",
   "@socketsecurity/socket-patch-win32-ia32@npm:2.0.0": "b48b42604530d283c2e1230c5d7604fc5c87f97d0d50ca305a89ddc16c24eec6d833cba39a94fe4e6cc3bb85d3a5e1f47fe1013f1bcc0c0906563b823fc8405f",
   "@socketsecurity/socket-patch-win32-x64@npm:2.0.0": "8057bbfb19b4601bb1eb4af272fbab315af92c9b870731cdf8cfa7520bfe7b0e4b96c9ad6b1c1959490f97054bc64cc7e3c7dade054a46801b61ddb69e369253",
-  "@tailwindcss/oxide-android-arm64@npm:4.2.2": "11f6e9bd3c1eb998725a89210a74ec2253e7387e451fad4c9ac171d9299cfd4ca1ce24e687856ff7887a2fd60cfabb267f8bf77e392e3069b2ccb1d22007aac3",
-  "@tailwindcss/oxide-darwin-arm64@npm:4.2.2": "ddd2d7844ef9be81dfe043b393a4eb7d971d72c53eef241456c132f7c38d5acaf569311dd565d23a345484f0dcc16a3967eb3ed74ad08e672310919f1a0d8502",
-  "@tailwindcss/oxide-darwin-x64@npm:4.2.2": "29b54e88665e7cb6b08ec143336d56e7bc100f6c621a414ae1c96c5a913de43859d8b5fd197dc9b257c95530dc949d259d841f1b657cc7a037e74b61aee85de9",
-  "@tailwindcss/oxide-freebsd-x64@npm:4.2.2": "7e89193701c6239dd007eab2e48e4fca0b88337b50bdabd341bbab3660fdc5a151131ae28a24c5a9bb59ee491fd8acc4583018b93dd545e4889da28dc6a445f3",
-  "@tailwindcss/oxide-linux-arm-gnueabihf@npm:4.2.2": "6bc2f863e02da37c9ce2807ee2fe1f1d00f391d5608fd9092630faefc0902f3982917d9dfb6df38e6e2ae4e3e83d5587db02a178c78a4b896085f3dfe72fa931",
-  "@tailwindcss/oxide-linux-arm64-gnu@npm:4.2.2": "a8962da367468c8b28b4d0afec55e55dcff3c4c0f885b60ed4ad825b6f3b40c7c7350a646f72cfe502f247d5b3c4c0c1f03b56d96b3867c034e839379e91a78f",
-  "@tailwindcss/oxide-linux-arm64-musl@npm:4.2.2": "cbab9ca951ccf818c9ccdfa6a9450a18a022fe67ae86c75c30ad325fb2a3e0821362954dc76d188746d3d54cee93b0b1b286bdc3540d6e79a3d504aad8f135ce",
-  "@tailwindcss/oxide-linux-x64-gnu@npm:4.2.2": "0b6e47b461b9e1168033edb2c72b6405c24e944c5caf867858bd1e5dcdc68dcb5175edc8bbbffc472d00444dc1dfd45d510073fb619cad2887ebb996e485bcbd",
-  "@tailwindcss/oxide-linux-x64-musl@npm:4.2.2": "c1e258d6d954b0c3fa3c8214478c2b46e5581f60aa1049c11f60a1836668157b023325c691b8ddfabe39b36d8df9ff32e9237d06dc1e8e0beff103324730537d",
-  "@tailwindcss/oxide-wasm32-wasi@npm:4.2.2": "83ae560e1503cefc9854d5d54b9222d81287a8bd7fc29015f42d032c262cf0ba5ac88f6707219092bb0ec7d8f569a3440e585a9dc084aa07ef7dcfb4dba3defd",
-  "@tailwindcss/oxide-win32-arm64-msvc@npm:4.2.2": "674ba83bdf03338878cb7839d4a081934404f9fe8771df3c55f6c2f0c09cdf4ab871ec2e821f23eda245c7b0a9b9fdbe32c0d038f887e4958d97c37f9cfe5b3d",
-  "@tailwindcss/oxide-win32-x64-msvc@npm:4.2.2": "8fd2254df241f2d17417c8a3ecf9ddc51dc23f415a7cd1e7661930296de1a9f4128ae9f3912050f8e9dde4ea0f0f2b2452031b913451aecf12d453f131703c79",
+  "@tailwindcss/oxide-android-arm64@npm:4.3.2": "d71f84cf523d0b7e617640b2ef6930f8c78321076cca1d0266a531a12f0d1165a0f4b434a1527b3b43640dc19b2ed86c9db8b20de3e2adeb55a63dfbcfa096a8",
+  "@tailwindcss/oxide-darwin-arm64@npm:4.3.2": "57ee616c3c64a55da3e7a756e7ca82af89a3948646cf4b5117884ab60d922193cb003dc74837b11671f2c888ae28e6c3be69bba898fe7eecdb92cc5e8b6457a7",
+  "@tailwindcss/oxide-darwin-x64@npm:4.3.2": "30e477d48d3ee6c195583108f70ae861d47eebb35139dce00e57bcde5d58d387918b1ee4b1b1dd320f915a22965faa8caace579cde10707070ca25fdb754a9c3",
+  "@tailwindcss/oxide-freebsd-x64@npm:4.3.2": "c47f0a698c2e6f13780916468b70de9d13662851ddf085c3a4bc1b481335b4b01028e2446a0f88fe1846c9b325b7cf3c28844b4b5e6c399b768a3481e943637c",
+  "@tailwindcss/oxide-linux-arm-gnueabihf@npm:4.3.2": "79270082658f16b905cb1861070c87f02a2cf11f24f34b5a543d7da5197c7a7f117847a68f11cc8f39abe1d40a93cd7da9f605f828b2f45eb9fa75e294bbb91c",
+  "@tailwindcss/oxide-linux-arm64-gnu@npm:4.3.2": "a2a9a54d3a9204585e7af11b17b0f3748d4924364606276938a13a423ae27341dfea6317c35fbaadc436a493a60675851b45ce61c30021d7a4c2cd3c3c839e86",
+  "@tailwindcss/oxide-linux-arm64-musl@npm:4.3.2": "5abfb9e78a6946f90c1ca2e57b0ac1be87cd5f0dbabb34d9de2e2d652cbfce35d264cc9fd98d0560800f7e000495ab25c45c630916fd621aee7dd20fd3771de8",
+  "@tailwindcss/oxide-linux-x64-gnu@npm:4.3.2": "5cdd5aaa678665b024d16d557e344d564810e78525be3bde0b86b6b924bcff1e81e2b7e0da88c7f0868c26669955129960c215044a2fd47cb63d2002c6c7e96d",
+  "@tailwindcss/oxide-linux-x64-musl@npm:4.3.2": "61d39503d79726cae3c497432bf18840c170f198d7ee65b40108e546a24cd661d6f6587adf023254410f11bd6d143a88d09399342f43f4cbcfc017b0aa853d66",
+  "@tailwindcss/oxide-wasm32-wasi@npm:4.3.2": "6afddcfaf232ac6290ea3368ee3c878bddf8b3c842f3cb71583ef387009de12988067545e9dd4de423f3bca3f93498c4fa46ad105bd9c63582946fbef98e8628",
+  "@tailwindcss/oxide-win32-arm64-msvc@npm:4.3.2": "68130dff13d07c88b5a59ca1b27acfde384d2c246db910c5a4f98e3fe5ab27ce538e4aca31aa70a68bd5e5a59b50a1875fe9908aeba7b394289c377089753053",
+  "@tailwindcss/oxide-win32-x64-msvc@npm:4.3.2": "0240e7ab3cb5418d5f655a1b356eb21819c56be193a469b8670a3a89b1f9e66c8cda3120849cffd57c8167ad0098d0e0cfc69ff24577111d5689711f7a13879b",
+  "@typescript/typescript-aix-ppc64@npm:7.0.2": "6135266f6e9c5928a8efd220b2ec972ecd6fa8c771dea432d2b8ffcec606aedd57b949db98ccb2a216e3fb87d4c6d42fd449258e0ee4cbda3d5994c69c5e84d2",
+  "@typescript/typescript-darwin-arm64@npm:7.0.2": "c859259821baf9d7a8c1811bc1d0c0cb67b0d7fa9f99f1a3b50aa0e656a2df35c6142f77a9d2b1cd200874fd33bc3bf7ffb5cb5491d57be8e0522319ee3453f8",
+  "@typescript/typescript-darwin-x64@npm:7.0.2": "4c689effd4a83b881b993903901f58d13aded3c61b2a9b6a0f8f591eeab595dbfab82930b1b2af3b1595829ead0e86c9278ea7b7f8fad47c8c76dd6b0e7fec4c",
+  "@typescript/typescript-freebsd-arm64@npm:7.0.2": "3339e5cbf127f689cdd977133f903e9549afbf1c85fd12d2b61944bc8cb9cca2c18f45070066476273cb8af992591e340e9b661cbbe62c5bd4882615c2a62892",
+  "@typescript/typescript-freebsd-x64@npm:7.0.2": "52b1180545def7206ac4a944b3a4bf38809b22b3816e9b0f553e87a4ecbf8e61a6039bb6bcc3a353ad0c16f90195e7ff86f25874ada409dcbbf4c4a587e40c2d",
+  "@typescript/typescript-linux-arm64@npm:7.0.2": "b3873b9c64ff950230eb1d087eb2f46f7102cbf0f483b5280cb76221626833a1065e4e4dfdd99777151d03c0abde157fde73b605829343a022f3fcc6862490dc",
+  "@typescript/typescript-linux-arm@npm:7.0.2": "ff6a5f61931a97dd4555c2055001c4720cd0c44e3f102ecb79998799cdf156f39884c87f096036c7a57a09a132b4b545b3830c0ca952292661170a7c10c7ae73",
+  "@typescript/typescript-linux-loong64@npm:7.0.2": "7cdf90b48bf0792e6cd6f9c151bbfd1963980e50f20e73f75c27fa210ba8de65c8b69092b1dd4c6db5d86396cbe8fb5473ca2986ad45be0afc42e7dc863e5ac6",
+  "@typescript/typescript-linux-mips64el@npm:7.0.2": "6c669e865878a186249631ac720126ea9a71637170cf14cf6d0aef3dfa0f496cdf8fc1a71db1ed24064b1aa612e9b902c64e53689995a0671e6b6146cc68d156",
+  "@typescript/typescript-linux-ppc64@npm:7.0.2": "702ac3a57ed2e9932185b2b6a3aaeb12d50152d78b453ced55f936d442d9fd7669a5c8a81c76b44ec60201f96533aa38ad2ca80f70ea8b3e6dcbc5cc4a200208",
+  "@typescript/typescript-linux-riscv64@npm:7.0.2": "ea92265112cf9320f09fcaef847c8612421cc0a907b50bbc8aa928de1a6306cdf7f4d0c1426c3e475923c99f490dc4469042b2edab3c2eff3afef8c14456650d",
+  "@typescript/typescript-linux-s390x@npm:7.0.2": "dc6b678125ee4c1b81a91c64076490ec985b84e9dde9c017fbc50ec34808aefe45bf90e04c57bf9d0146ea453d71cd1543ac7c47f7a7ef77635758317d0b2173",
+  "@typescript/typescript-linux-x64@npm:7.0.2": "93d1142b9099dce38f9f2b25a7c4800289c72699e93e695aba5a6923f3661720b336cdd437f4cb3d49324226b7288c606f24f32a85c8e4be5f97c523f5b27b0a",
+  "@typescript/typescript-netbsd-arm64@npm:7.0.2": "b3274f1c526a20f4436b0f1167dc0e60dac5606f31491429c61439519a3f6a68fcee3a3f7f26f2fafb6557d918af75795b37d2fb6ede7b857bab772eb529140d",
+  "@typescript/typescript-netbsd-x64@npm:7.0.2": "d3c15af4176791e21927d35afe4935c8a98d21509db7ecb4dd7769a02c2f983500ef6d0f1646ad614a59a748269d517604af98cbd7c3c0450bb57a12cccd7270",
+  "@typescript/typescript-openbsd-arm64@npm:7.0.2": "09feda2dcbe2e3f9d31f2e98b09477158da1bb9509fe42dda2ce0b12a33b43bd31bb0caee24c6bde4c735c9d33662bcf65593ee762a2a5fee225798b5d674692",
+  "@typescript/typescript-openbsd-x64@npm:7.0.2": "e29ffc0538c2843b1e731b90626b5d2855345627fbb6b2ad7ee40b8f88ed1df6f91b03cf5c227645c4fc35a18fb6ff1612de98a9b449da25042f66478e671875",
+  "@typescript/typescript-sunos-x64@npm:7.0.2": "1647e487c452504c646c01e9e4a504e41c180bc09c9af7ccd2a6db23b6fedad436861de2681674793baccbbfc8970dccc85fce59a4da3d802dd67966774fc188",
+  "@typescript/typescript-win32-arm64@npm:7.0.2": "26cf8934a58378a2e8467914407f2d06028ca0e211bd68403994f9b27353439d8b0935ebeb7b9a03d8768a64e444285f87756a77ce72211efeecf5239af52bc5",
+  "@typescript/typescript-win32-x64@npm:7.0.2": "7f8408c4b3a58a2ef8851103c0575b97654e34c5aa0658e32be5584030f395f8a8e8a7fa87eb3afe2c794a01a0eb2e77db743c6025af57ed2915605b8e0a7c82",
   "dmg-license@npm:1.0.11": "feef35cfb45270a72daadcca9584be5cb840f924448b9d4e543fcd61f1b6d471151049f277c91de1d8b003fad6203d0176066a5f427a01df5fb073402cb8c8b7",
   "iconv-corefoundation@npm:1.1.7": "bc6f08ac421e5e92ed20f3825f123fd705e036612b2b6aa687958de753c06f32e54f0203ef55540869e3ee189eaea15e43a2757f3a90e555c4dd512c9422da43",
   "lightningcss-android-arm64@npm:1.32.0": "1cb326ad39dcb02cf9f45025c167b6900e3a04b08f5149d3c5ee26054b00d08db3736fb69183a6c3ed1cb32dddd148608c784b6631b4777623f7dd0c032c392d",
@@ -132,22 +177,22 @@
   "lightningcss-linux-x64-musl@npm:1.32.0": "a6f48ccc30a73d30563c7b61856d1fd6a8812ce62b1bee797f227e06612df70aab4ccd1908552952f77ca7ff2a51019f62d14ae5310ca67311635eeec55d3a9e",
   "lightningcss-win32-arm64-msvc@npm:1.32.0": "a919be7fb298c1102bccf18b6f83d54946adfac70ab2ac9c95e4ae38ded76d8f530215b0bcda4d38df4ffc40a70abe3afd91d01d35fd122e7d119ed0e46972d0",
   "lightningcss-win32-x64-msvc@npm:1.32.0": "5b8d3431aadbdc40a0a7eae32f2415e4f28b547af1a1cd5b35a35d67f772a89492c7fa03e9fc88ce804b14f5f88e412e49fff40d1b0aad67177de815c434207e",
-  "sass-embedded-all-unknown@npm:1.98.0": "36a9126decd90bb1e7cdb6e5a6ec9913ca644e1ba16748b179daf0b78c87bab1905647b3e4221dcd6dfb8bed9211830ed853d4fab257057f1678a557b4982ec7",
-  "sass-embedded-android-arm64@npm:1.98.0": "83bcb98adb64adcf01d1bfd0d5726cd28942e3a276b1cf2b8ed426fcb6de4345539b9cde44b6cc3593fd7643f6ac4138ccc5107bccc195438fefe63140f0cecf",
-  "sass-embedded-android-arm@npm:1.98.0": "7083ddf06fb3685351cef3d95c78044d25b6798f6c9db2898d75ac6f61a140344d591888f8760445e952dfdb6610934b97edab3c323431edc49655ef47d3d3a8",
-  "sass-embedded-android-riscv64@npm:1.98.0": "dedb467cf1b72c100409268889131ac85f08b517c76ba1fff2a05d829c1f38e14acde11a3081b4ae7063c8a7ee0fda5cdd880cde0d43c3f5bb616419209eb85e",
-  "sass-embedded-android-x64@npm:1.98.0": "9030281251fa16600de1c90ab8a8995d022fbbb2c7d7a6447ee262f3b3fcd4cbe772c1c9067b7296b8dd6a3311ef5655246ca9c03051b838b978cced82515896",
-  "sass-embedded-darwin-arm64@npm:1.98.0": "0955f52140dbcd6cc2a35592cbe147e271f988a8d9e2807e28e3c4ba49e950e8d9fbbca00e2187c36530d28de2916e9e79f3ad9ec5c0f214449e3f3d10b15a1b",
-  "sass-embedded-darwin-x64@npm:1.98.0": "aba47e0c1b61a64f9e0a3899bb84725dfb2b45fb4b3a38e7c2e5d767d0b0ca429ce49dba98699298a2491f4ef2e2e40f2dd32905bf268ec4ef7acaa1ca3730da",
-  "sass-embedded-linux-arm64@npm:1.98.0": "766a5f93c80ba64f3f1733dbf01ee71e0f0a5a56bf75227f0455bd5151ec0348b85501fb4ee09da6393655638b4c34cfcff420ea96645fb25ba7e6afe5a1a1f9",
-  "sass-embedded-linux-arm@npm:1.98.0": "109131a0d1173f6b34c987192607d148721f980396f8288df29bd407dbc160142e088320ac95a63fdfda464a07953e6092f00a5d3f1e56540cf2553ad21e2b68",
-  "sass-embedded-linux-musl-arm64@npm:1.98.0": "bcddf4d567b1e335bb5bdad25469d773d3a965cf9c9972e8c43cf943016d010a79ea441df0c1f47a7c67e7330f4f88fc2d13d07d4fe720138f44e8837f660468",
-  "sass-embedded-linux-musl-arm@npm:1.98.0": "e1572282ac95d9b20afe7053c9415b21490aebb49d276838d256189387df3cc5804f6ba21794ad43dce0531e925f89722a5bea139f327bd51ff4bcf754a84589",
-  "sass-embedded-linux-musl-riscv64@npm:1.98.0": "6f0f51d3daac10c8a6ca79f0627304f191ab0db1e9dc120084c23231cc7c60929b51e75d64b6afb77abf5054cea89c2d0b129e40ed552489bfb1662a152017e9",
-  "sass-embedded-linux-musl-x64@npm:1.98.0": "51e55184d36b60a8777dd89f84354fbc4e0e5c09d8b0a2bd842138bb6a766c7e42bf7817cab5784416541a8e31c5a872121b24ec8d945768ced9e0074e648c1f",
-  "sass-embedded-linux-riscv64@npm:1.98.0": "6dc8669e8e23f8079a1d29073b8c3947314b4dae7c88db86b7dc6642a86e3aebf1a4f7cf38903423552aa9388fa4aef5c137f332aba5fa37b8447ca11640dcd4",
-  "sass-embedded-linux-x64@npm:1.98.0": "67dc506dd51e139173539008c07e2a7a397a3d47c7192039a3bc1c9af578a8c19c91fa03768851af653002b850098340e401de7af9041fafc7bb49162848e63b",
-  "sass-embedded-unknown-all@npm:1.98.0": "c6bc5bc3828d9091e7b669379f7248771ff0b5bae78c5f52d4cc193a387ef0ff30b7a7f17ccb576fcf18502134727a2433ebc5470f67f0b6f5cababdda52a9e4",
-  "sass-embedded-win32-arm64@npm:1.98.0": "b799485e7afb87d08901bbbb419217ae94e57c60a38ab1ffa74c0f521b1e5f77cb30769807a8403dc0ee27003fbaec402cec2add8ce8bc8d625f48c7afbd5a0d",
-  "sass-embedded-win32-x64@npm:1.98.0": "c8cb13fafca66b403e829c166ddb57fbecbe7433f515b90841ad49deeb6641b5f8db2238fcfb11a03df094f16ff7e63c0454f4ecdba314a7d7cf7408abfd3658"
+  "sass-embedded-all-unknown@npm:1.100.0": "ed802ec849fb09307294e942382bd19d72c79f53dd348db51fd431f18354876f50e47bef586a27fa1546fe68c1df638e05d9eace5925074b3e117419f1bd486f",
+  "sass-embedded-android-arm64@npm:1.100.0": "0a219201304c6e3b37e7099092730e978e1e77bb5ab1b0ecb84d72bb4f78b4703552d7f2937ba29250fa67032a23b0417e47ddbe497ce3abd8386d492fbcbdfb",
+  "sass-embedded-android-arm@npm:1.100.0": "460f04093b37d7bb0a2b6b689622e084795a0c0b820327ce57b7905e6495de777d669b6ac663bf728fb9f62c99e1ad3a6dfe7cc15aca5005037a217130aeac95",
+  "sass-embedded-android-riscv64@npm:1.100.0": "5b84b0b8a00197571f7d82977af81c0d88053cda91cc1c283f80821a4d8e45532fc8bc974b2c53a3ff869f49f60b2c8f412c90694fb9fa1e5f7396fb3ca7dc8a",
+  "sass-embedded-android-x64@npm:1.100.0": "d225b29000a7ff1e0aa2a64e5d60ee63679630eaf717311b20e972326ac31711928c2deb2f78d6a5ad2d3b9ef0bfa918d40940dea01e75232db7146624e66323",
+  "sass-embedded-darwin-arm64@npm:1.100.0": "ae3b9b1ef84b5cc53f2c364295070b8ef8fe7c8cbde6ea278d34d3fa0e1636168f13abe074155549587300c1c91d90d07b2fba25f1f765f62aa26729a0f2d37c",
+  "sass-embedded-darwin-x64@npm:1.100.0": "85b6aecb66dfe00a3600eac244b1611c04e608f42fc64720519d0996a5a59692b619176ea726647aa031b496c6a147b3f1b2dc8aef43c61c9cecec63bfe1d138",
+  "sass-embedded-linux-arm64@npm:1.100.0": "9ea709b02c24242bcbae8cc299913b1b28ea85c95c3a4a14b645b59f7cebe283c199b2e823edf8cb76255216c160c5642b0ff02d63cd9649ed2fc67aec900adf",
+  "sass-embedded-linux-arm@npm:1.100.0": "1f673e52323446f60d069182dc3488e957df3b7e4b17a6973c39bd1922d073521e665371a64d76f527287a0b1c3e47825b4252c51de0817d02c069c4b3839252",
+  "sass-embedded-linux-musl-arm64@npm:1.100.0": "f87777a45b855531b990c2969b2a7c8dae02b5a3e80e712e093b61632384db5c176cb776507f886791cc378b504e936da30e4bf97d105454ee7d520f662c25d9",
+  "sass-embedded-linux-musl-arm@npm:1.100.0": "66887ed9ce2f552942a463f2276c4d93dc2ef6ad55797507e667580f8b1911c5b471a941c3a1a999516fd4802cc833a4f39a738d2e65bb2a2d76172bc56f280b",
+  "sass-embedded-linux-musl-riscv64@npm:1.100.0": "ceb308bd10e2176e6885303e8f64a414eec5d6db4badf1517069c744fedc4fd05f0d34abae2f71dfa9db4b73b2269e7f1d793a600ff4610f165abda35b06c4a2",
+  "sass-embedded-linux-musl-x64@npm:1.100.0": "64b02ea419edea470f485b87631f065b891adca5cb555b3089c6922200dc2cd6982ff51dcdf2bd44cb7aa3b6e81590346f672f1f64481609734176536cce6e47",
+  "sass-embedded-linux-riscv64@npm:1.100.0": "9f443b08cf057d1577b5178608b2fa34963a614e9fe06b132d77065650536f1013dc567f8754e3d059f036e39a4f58013c512cb94bd7497ca839f5d5febce25d",
+  "sass-embedded-linux-x64@npm:1.100.0": "85307c181232f792bf6b7ed3c4849d043802d4b0a2988cf589efcbf83e4c49099f0a599084d08dea160723ff21a931c5f4cb4eded7d300765c77dd13efd7f1ea",
+  "sass-embedded-unknown-all@npm:1.100.0": "576eea8f7e866bc5aee12995e219f65c2ddc9da3c848950740c2568e1dd4433a782be6a8b6a87e1c9fb27a03e6e06982efa3da04df8a2dec8cdb685f72f56a63",
+  "sass-embedded-win32-arm64@npm:1.100.0": "bfd7231a5965a4f9c31cf9778c664a6917ead537742beeacb7042c4e7f40301cc305c409620643bfa255a31efec69bad637ae359e8573376891b41ba9f4eb450",
+  "sass-embedded-win32-x64@npm:1.100.0": "d78da6f82e616e5ecfc8221648029343320ac2cff8357152ecb582ab5ac5dbd20a838cce78d29a8c9986310e2a097c263dbab93c105affc5c009c71fdb1de5fc"
 }

pkgs/by-name/bi/bitfocus-companion/package.nix

@@ -3,7 +3,7 @@
   lib,
   fetchFromGitHub,
   fetchurl,
-  nodejs,
+  nodejs_26,
   git,
   python3,
   udev,
@@ -20,8 +20,8 @@ let
 
   builtinSurfaces = {
     elgato-stream-deck = fetchurl {
-      url = "https://s4.bitfocus.io/developer-module-builds/surface/elgato-stream-deck/v1.4.3-70e2c01d15a0f58c52a8e80d7d6f4977f157d58e/elgato-stream-deck-v1.4.3.tgz";
-      hash = "sha256-bZnXvkyfllzHZTAJtH/hSYIv+J5ZOYWZycUHdz9srGI=";
+      url = "https://s4.bitfocus.io/developer-module-builds/surface/elgato-stream-deck/v1.4.6-c7ea9961c73fc6bf184b563d03c64b5607312d8d/elgato-stream-deck-v1.4.6.tgz";
+      hash = "sha256-0zYgn2ao2yhy3CSlHbdqfV9YWWwUiQ5kibDjT4uqOn8=";
     };
     xkeys = fetchurl {
       url = "https://s4.bitfocus.io/developer-module-builds/surface/xkeys/v1.0.2-876f00ee194faa57ec14468b7019bbaa516a9e6d/xkeys-v1.0.2.tgz";
@@ -41,7 +41,7 @@ in
 
 stdenv.mkDerivation rec {
   pname = "bitfocus-companion";
-  version = "4.3.4";
+  version = "5.0.5";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -50,7 +50,7 @@ stdenv.mkDerivation rec {
     owner = "bitfocus";
     repo = "companion";
     tag = "v${version}";
-    hash = "sha256-ojSXiWaRKFCjHmAMs/RtzNhgSNUy7RKTZ4CE/wCxEaI=";
+    hash = "sha256-Q5XQ/r4YYYqLk6YaSlBZqcqEH8nFmpqyzMf7/fMWX74=";
   };
 
   passthru.updateScript = nix-update-script { };
@@ -59,15 +59,10 @@ stdenv.mkDerivation rec {
     # patch out git calls to generate version strings.
     substituteInPlace tools/lib.mts --replace-fail "return await fcn()" "return \"v${version}\" as unknown as T"
 
-    # remove unsupported yarn config options (npmMinimalAgeGate, npmPreapprovedPackages removed in newer yarn)
-    # approvedGitRepositories and compressionLevel required by yarn >= 4.14 for lockfile version < 9
-    printf "nodeLinker: node-modules\nenableScripts: false\ncompressionLevel: 0\napprovedGitRepositories:\n  - '**'\n" > .yarnrc.yml
+    # remove yarn config options which require network access at install time
+    printf "nodeLinker: node-modules\nenableScripts: false\n" > .yarnrc.yml
 
     # remove the yarn install during the build, since there is no internet connection, and everything has already been installed by yarnBerryConfigHook
-    substituteInPlace tools/build/dist.mts \
-      --replace-fail 'await $`yarn --cwd node_modules/better-sqlite3 prebuild-install --arch=''${platformInfo.nodeArch} --platform=''${platformInfo.nodePlatform}`' "" \
-      --replace-fail 'await $`yarn --cwd node_modules/better-sqlite3 prebuild-install`' ""
-
     substituteInPlace tools/build/package.mts --replace-fail "await $\`yarn install --no-immutable\`" ""
 
     # remove node download, since we'll use the nix version
@@ -76,11 +71,16 @@ stdenv.mkDerivation rec {
       --replace-fail "await fs.createSymlink(latestRuntimeDir, path.join(runtimesDir, 'main'), 'dir')" ""
 
     substituteInPlace companion/lib/Instance/NodePath.ts \
-      --replace-fail "if (!(await fs.pathExists(nodePath))) return null" "return '${lib.getExe nodejs}'" \
+      --replace-fail "if (!(await fs.pathExists(nodePath))) return null" "return '${lib.getExe nodejs_26}'"
+
+    # allow all surface modules (builtin and user-downloaded) to find libudev, by adding
+    # LD_LIBRARY_PATH to the env whitelist companion uses when spawning module child processes
+    substituteInPlace companion/lib/Instance/Environment.ts \
+      --replace-fail "'DISABLE_IPV6'," "'DISABLE_IPV6', 'LD_LIBRARY_PATH',"
   '';
 
   nativeBuildInputs = [
-    nodejs
+    nodejs_26
     yarn-berry.yarnBerryConfigHook
     git
     python3
@@ -91,7 +91,7 @@ stdenv.mkDerivation rec {
   buildInputs = [
     libusb1
     dart-sass
-    nodejs
+    nodejs_26
     electron
     udev
   ];
@@ -100,15 +100,13 @@ stdenv.mkDerivation rec {
 
   offlineCache = yarn-berry.fetchYarnBerryDeps {
     inherit src missingHashes;
-    hash = "sha256-XDXxv+LSr9fYhVhwkcvmd56fAL6gY9FK6kiQlXxTWXo=";
+    hash = "sha256-Fuh/D3FVtm08h7pW+LHgrEiyN9vmCjy+WekfpIz/Xc4=";
   };
 
   env = {
     ELECTRON_SKIP_BINARY_DOWNLOAD = 1;
     SKIP_LAUNCH_CHECK = true;
     ELECTRON = 0;
-    # prevent yarn >= 4.14 from triggering a lockfile refresh for v8 lockfiles
-    YARN_LOCKFILE_VERSION_OVERRIDE = 8;
   };
 
   # with dontConfigure it doesn't seem to retrieve node_modules, so empty configurePhase instead
@@ -142,20 +140,13 @@ stdenv.mkDerivation rec {
     rm -rf dist/node-runtimes
   '';
 
-  postInstall = ''
-    # patch the env whitelist companion uses when spawning module child processes to include
-    # LD_LIBRARY_PATH, so all surface modules (builtin and user-downloaded) can find libudev
-    substituteInPlace $out/share/bitfocus-companion/dist/main.js \
-      --replace-fail '"DISABLE_IPV6"],t={}' '"DISABLE_IPV6","LD_LIBRARY_PATH"],t={}'
-  '';
-
   installPhase = ''
     runHook preInstall
 
     mkdir -p $out/share/bitfocus-companion
     cp -r * $out/share/bitfocus-companion/
 
-    makeWrapper ${lib.getExe nodejs} $out/bin/bitfocus-companion \
+    makeWrapper ${lib.getExe nodejs_26} $out/bin/bitfocus-companion \
       --add-flags $out/share/bitfocus-companion/dist/main.js \
       --set LD_LIBRARY_PATH "${
         lib.makeLibraryPath [

pkgs/by-name/bi/bitrise/package.nix

@@ -6,13 +6,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "bitrise";
-  version = "2.43.2";
+  version = "2.45.0";
 
   src = fetchFromGitHub {
     owner = "bitrise-io";
     repo = "bitrise";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-QRgOoqk+A79MSXkRX3N8oUHhzatxMm/nzXemKRJ4JHU=";
+    hash = "sha256-WqW0ryP29kmKtSk88bbZ2E+VwesJbqXwB3k+PM6iLb8=";
   };
 
   # many tests rely on writable $HOME/.bitrise and require network access

pkgs/by-name/bi/bitwig-studio6/package.nix

@@ -38,12 +38,12 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "bitwig-studio6";
-  version = "6.1";
+  version = "6.1.1";
 
   src = fetchurl {
     name = "bitwig-studio-${finalAttrs.version}.deb";
     url = "https://www.bitwig.com/dl/Bitwig%20Studio/${finalAttrs.version}/installer_linux";
-    hash = "sha256-dJbwn8JNHuSZ/lKQV4zoSbbthDdHl4J7hhmOZ5AdA2M=";
+    hash = "sha256-FBe0R6YW4IS1OPvCwWseQvJnn7OrPn1uZ0v/GKRIIYE=";
   };
 
   strictDeps = true;

pkgs/by-name/bi/bitwise/package.nix

@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "bitwise";
-  version = "0.50";
+  version = "0.70";
 
   src = fetchFromGitHub {
     owner = "mellowcandle";
     repo = "bitwise";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-x+ky1X0c0bQZnkNvNNuXN2BoMDtDSCt/8dBAG92jCCQ=";
+    sha256 = "sha256-UJHgW89VXMNuqxSncI7Di0GzrMShBLWGx2mDOVZkIxc=";
   };
 
   buildInputs = [

pkgs/by-name/bt/btfs/package.nix

@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "btfs";
-  version = "3.2";
+  version = "3.3";
 
   src = fetchFromGitHub {
     owner = "johang";
     repo = "btfs";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-g8ta5T17iKTpdR0wMQe1LU78LTIxwECmf86o4IlVF00=";
+    sha256 = "sha256-kl58bz+iozviWMmqjUNAcccxKcB3bg6iDAcWNezmN6g=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/bu/bully/package.nix

@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
   meta = {
     description = "Retrieve WPA/WPA2 passphrase from a WPS enabled access point";
     homepage = "https://github.com/kimocoder/bully";
-    license = lib.licenses.gpl3;
+    license = lib.licenses.gpl3Plus;
     maintainers = with lib.maintainers; [ edwtjo ];
     platforms = lib.platforms.linux;
     mainProgram = "bully";

pkgs/by-name/ca/cadabra2/package.nix

@@ -11,7 +11,7 @@
   nix-update-script,
 
   boost,
-  glibmm,
+  glibmm_2_4,
   gmpxx,
   gtkmm3,
   jsoncpp,
@@ -94,7 +94,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [
     boost
-    glibmm
+    glibmm_2_4
     gmpxx
     jsoncpp
     onetbb

pkgs/by-name/ca/caelestia-shell/package.nix

@@ -33,14 +33,14 @@
   withCli ? true,
 }:
 let
-  version = "2.3.0";
-  rev = "94d5eb9e6fe9c6b1f69e663d9ed410a441e2d67f";
+  version = "2.4.0";
+  rev = "24aa15eefdb146350d2548c0a015b04eddbd1008";
 
   m3shapes_src = fetchFromGitHub {
     owner = "soramanew";
     repo = "m3shapes";
-    rev = "bdc327b29f95394a732baf3c9b19658ba23755b6";
-    hash = "sha256-kfHyzZaPHgqZML48OA+5JwBOsLdQJ2ci/aGPShvUB4Y=";
+    rev = "32ad9ce328bb77ed349b40a3be10ee9ea610b8ab";
+    hash = "sha256-YZelgEZflFNwGutX4/tIzBdbOeghJgE2oDw0uWYGxns=";
   };
 
   runtimeDeps = [
@@ -73,11 +73,9 @@ let
     (lib.cmakeFeature "DISTRIBUTOR" "nixpkgs")
   ];
 
-  m3shapesFlag = lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_M3SHAPES_EXTERNAL" "${m3shapes_src}";
-
   shellSrc = fetchurl {
     url = "https://github.com/caelestia-dots/shell/releases/download/v${version}/caelestia-shell-v${version}.tar.gz";
-    hash = "sha256-EjPnMXxonYAewJW1/XKQUC5fbqIU7xSwI3XTW1VC544=";
+    hash = "sha256-r3SRcn/zBplpgVD598GGCJzNFxpQne8zK8uh3hyzF3E=";
   };
 
   extras = stdenv.mkDerivation {
@@ -130,7 +128,7 @@ let
   m3shapesModule = stdenv.mkDerivation {
     inherit cmakeBuildType;
     name = "caelestia-m3shapes";
-    src = shellSrc;
+    src = m3shapes_src;
 
     nativeBuildInputs = [
       cmake
@@ -139,15 +137,13 @@ let
     buildInputs = [
       qt6.qtbase
       qt6.qtdeclarative
+      qt6.qtshadertools
     ];
 
     dontWrapQtApps = true;
     cmakeFlags = [
-      (lib.cmakeFeature "ENABLE_MODULES" "m3shapes")
       (lib.cmakeFeature "INSTALL_QMLDIR" qt6.qtbase.qtQmlPrefix)
-      m3shapesFlag
-    ]
-    ++ cmakeVersionFlags;
+    ];
   };
 
 in

pkgs/by-name/ca/caelestia-shell/update.sh

@@ -15,8 +15,12 @@ TAR_URL="https://github.com/caelestia-dots/shell/releases/download/v${VERSION}/c
 SHELL_RAW="$(nix-prefetch-url "$TAR_URL" 2>/dev/null | tail -n 1)"
 SHELL_SRI="$(nix hash convert --to sri --hash-algo sha256 "$SHELL_RAW")"
 
-CMAKE_TXT="$(curl -sL ${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} "https://raw.githubusercontent.com/caelestia-dots/shell/$REV/CMakeLists.txt")"
-M3_REV="$(echo "$CMAKE_TXT" | grep "set(M3SHAPES_REV" | awk '{print $2}' | tr -d ')')"
+M3_REV="$(curl -sL ${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} "https://raw.githubusercontent.com/caelestia-dots/shell/$REV/flake.lock" | jq -r '.nodes.m3shapes.locked.rev // empty')"
+if [[ -z "$M3_REV" ]]; then
+  CMAKE_TXT="$(curl -sL ${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} "https://raw.githubusercontent.com/caelestia-dots/shell/$REV/CMakeLists.txt")"
+  M3_REV="$(echo "$CMAKE_TXT" | grep "set(M3SHAPES_REV" | awk '{print $2}' | tr -d ')' || true)"
+fi
+
 M3_RAW="$(nix-prefetch-url --unpack "https://github.com/soramanew/m3shapes/archive/$M3_REV.tar.gz" 2>/dev/null | tail -n 1)"
 M3_SRI="$(nix hash convert --to sri --hash-algo sha256 "$M3_RAW")"
 
@@ -29,10 +33,10 @@ with open("$PKG_NIX", "r") as f:
 content = re.sub(r'version\s*=\s*"[^"]+";', f'version = "$VERSION";', content, count=1)
 content = re.sub(r'rev\s*=\s*"[^"]+";', f'rev = "$REV";', content, count=1)
 
-m3_pattern = r'(m3shapes_src\s*=\s*fetchFromGitHub\s*\{[^}]*?rev\s*=\s*")[^"]+(";\s*hash\s*=\s*")[^"]+(";\s*\};)'
+m3_pattern = r'(m3shapes_src\s*=\s*fetchFromGitHub\s*\{.*?rev\s*=\s*")[^"]+(";\s*hash\s*=\s*")[^"]+(";\s*\};)'
 content = re.sub(m3_pattern, rf'\g<1>$M3_REV\g<2>$M3_SRI\g<3>', content, flags=re.DOTALL)
 
-shell_pattern = r'(shellSrc\s*=\s*fetchurl\s*\{[^}]*?hash\s*=\s*")[^"]+(";\s*\};)'
+shell_pattern = r'(shellSrc\s*=\s*fetchurl\s*\{.*?hash\s*=\s*")[^"]+(";\s*\};)'
 content = re.sub(shell_pattern, rf'\g<1>$SHELL_SRI\g<2>', content, flags=re.DOTALL)
 
 with open("$PKG_NIX", "w") as f:

pkgs/by-name/ca/calibre-web/package.nix

@@ -6,17 +6,17 @@
   nixosTests,
   python3Packages,
 }:
-python3Packages.buildPythonApplication rec {
+python3Packages.buildPythonApplication (finalAttrs: {
   pname = "calibre-web";
-  version = "0.6.26-unstable-2026-03-01";
+  version = "0.6.27";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "janeczku";
     repo = "calibre-web";
-    # remember changing this back (and changelog below) to tag after new release come out
-    rev = "6157f5027c979aa05f8d97a09f1388ceb3085ac5";
-    hash = "sha256-1ljMsf8Puvq4ELUSi8Vl3T7EHcd7MO3zGgT4j5PYsT0=";
+    tag = finalAttrs.version;
+    hash = "sha256-ULUEQ35R+jI0nCrwYkTvmaUqpi1a/Sjvs5kWHYfTTWY=";
   };
 
   patches = [
@@ -37,7 +37,7 @@ python3Packages.buildPythonApplication rec {
     mv cps src/calibreweb
 
     substituteInPlace pyproject.toml \
-      --replace-fail 'cps = "calibreweb:main"' 'calibre-web = "calibreweb:main"'
+      --replace-fail 'cps = "calibreweb.__main__:main"' 'calibre-web = "calibreweb.__main__:main"'
   '';
 
   build-system = [ python3Packages.setuptools ];
@@ -57,6 +57,7 @@ python3Packages.buildPythonApplication rec {
     iso-639
     lxml
     netifaces-plus
+    nh3
     pycountry
     pypdf
     python-magic
@@ -141,7 +142,7 @@ python3Packages.buildPythonApplication rec {
     "wand"
   ];
 
-  nativeCheckInputs = lib.concatAttrValues optional-dependencies;
+  nativeCheckInputs = lib.concatAttrValues finalAttrs.passthru.optional-dependencies;
 
   pythonImportsCheck = [ "calibreweb" ];
 
@@ -153,12 +154,10 @@ python3Packages.buildPythonApplication rec {
   meta = {
     description = "Web app for browsing, reading and downloading eBooks stored in a Calibre database";
     homepage = "https://github.com/janeczku/calibre-web";
-    # revert back to tag based changelog
-    # changelog = "https://github.com/janeczku/calibre-web/releases/tag/${src.tag}";
-    changelog = "https://github.com/janeczku/calibre-web/compare/0.6.26...${src.rev}";
+    changelog = "https://github.com/janeczku/calibre-web/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.gpl3Plus;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ juli0604 ];
     mainProgram = "calibre-web";
     platforms = lib.platforms.all;
   };
-}
+})

pkgs/by-name/ca/cardwire/package.nix

@@ -22,7 +22,7 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cardwire";
-  version = "0.12.1";
+  version = "0.12.2";
 
   __structuredAttrs = true;
 
@@ -30,9 +30,9 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "opengamingcollective";
     repo = "cardwire";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Jt8CxN99JSayN6UawAKEFrxU3wz5OiAFqYnBytLB1Xs=";
+    hash = "sha256-4f8owYjbvyZSChIOJW115EVIhmHFtZO6inCLzMQXGv4=";
   };
-  cargoHash = "sha256-3wgdr9R5eY3BwdhzZ7LjlxHkJFRd2imqXIMlAszKvQY=";
+  cargoHash = "sha256-yhBsiAZrT9nk5RcqylSfj30kmdtWOer4XIUXuDe5Xl0=";
 
   postPatch = ''
     # Workaround to build cardwire-ebpf, when RUSTC_BOOTSTRAP is set to 1

pkgs/by-name/ca/catch2_3/clang-20-disable-broken-test.patch

@@ -1,15 +0,0 @@
-diff --git a/tests/SelfTest/UsageTests/Misc.tests.cpp b/tests/SelfTest/UsageTests/Misc.tests.cpp
-index 3697f0695c..8c10aace7b 100644
---- a/tests/SelfTest/UsageTests/Misc.tests.cpp
-+++ b/tests/SelfTest/UsageTests/Misc.tests.cpp
-@@ -384,10 +384,6 @@
-     REQUIRE(x.size() > 0);
- }
- 
--TEMPLATE_PRODUCT_TEST_CASE("Product with differing arities", "[template][product]", std::tuple, (int, (int, double), (int, double, float))) {
--    REQUIRE(std::tuple_size<TestType>::value >= 1);
--}
--
- using MyTypes = std::tuple<int, char, float>;
- TEMPLATE_LIST_TEST_CASE("Template test case with test types specified inside std::tuple", "[template][list]", MyTypes)
- {

pkgs/by-name/ca/catch2_3/package.nix

@@ -7,23 +7,17 @@
   spdlog,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "catch2";
-  version = "3.15.3";
+  version = "3.16.0";
 
   src = fetchFromGitHub {
     owner = "catchorg";
     repo = "Catch2";
-    tag = "v${version}";
-    hash = "sha256-ZuH3tUWNklq0bKp0Yu9w3L5FNsQwUxe6lyGBv4M6U1E=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-vvPZTQzLNGIcdDbuo0w6sQvxzLdKFCl2LNwcHu0d5I8=";
   };
 
-  patches = lib.optionals stdenv.cc.isClang [
-    # This test fails to compile with Clang 20
-    # See: https://github.com/catchorg/Catch2/issues/2991
-    ./clang-20-disable-broken-test.patch
-  ];
-
   postPatch = ''
     substituteInPlace CMake/*.pc.in \
       --replace-fail "\''${prefix}/" ""
@@ -37,10 +31,10 @@ stdenv.mkDerivation rec {
 
   cmakeFlags = [
     "-DCATCH_DEVELOPMENT_BUILD=ON"
-    "-DCATCH_BUILD_TESTING=${if doCheck then "ON" else "OFF"}"
+    "-DCATCH_BUILD_TESTING=${if finalAttrs.doCheck then "ON" else "OFF"}"
     "-DCATCH_ENABLE_WERROR=OFF"
   ]
-  ++ lib.optionals (stdenv.cc.isClang && doCheck) [
+  ++ lib.optionals (stdenv.cc.isClang && finalAttrs.doCheck) [
     # test has a faulty path normalization technique that won't work in
     # our darwin/LLVM build environment https://github.com/catchorg/Catch2/issues/1691
     "-DCMAKE_CTEST_ARGUMENTS=-E;ApprovalTests"
@@ -69,9 +63,9 @@ stdenv.mkDerivation rec {
   meta = {
     description = "Modern, C++-native, test framework for unit-tests";
     homepage = "https://github.com/catchorg/Catch2";
-    changelog = "https://github.com/catchorg/Catch2/blob/${src.tag}/docs/release-notes.md";
+    changelog = "https://github.com/catchorg/Catch2/blob/${finalAttrs.src.tag}/docs/release-notes.md";
     license = lib.licenses.boost;
     maintainers = with lib.maintainers; [ dotlambda ];
     platforms = with lib.platforms; unix ++ windows;
   };
-}
+})

pkgs/by-name/cb/cbconvert/gui.nix

@@ -23,7 +23,10 @@ buildGoModule (finalAttrs: {
   ];
   buildInputs = cbconvert.buildInputs ++ [ gtk3 ];
 
-  vendorHash = "sha256-oMW5zfAw2VQSVaB+Z1pE51OtNIFr+PnRMM+oBYNLWxk=";
+  env.GOWORK = "off";
+
+  proxyVendor = true;
+  vendorHash = "sha256-jG8pQdY01MMCumNLBiHdgZ1pvp653WWaUCXD/gEuSpk=";
   modRoot = "cmd/cbconvert-gui";
 
   ldflags = [

pkgs/by-name/cb/cbconvert/package.nix

@@ -13,16 +13,18 @@
 
 buildGoModule (finalAttrs: {
   pname = "cbconvert";
-  version = "1.1.0";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "gen2brain";
     repo = "cbconvert";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-C2Eox6fpKS0fPB7KFgBn62HKbWYacSVMJK0CkT6+FBU=";
+    hash = "sha256-fLAVX3AlHUp2jmb8AiFeqB4IhVcWxYk0tkjvwWiKwPc=";
   };
 
-  vendorHash = "sha256-uV8aIUKy9HQdZvR3k8CTTrHsh9TyBw21gFTdjR1XJlg=";
+  env.GOWORK = "off";
+
+  vendorHash = "sha256-lR1ZbEDNjJ9+bl8ijdI5/ifC5uIB1rdbnXQh5D2T7NM=";
   modRoot = "cmd/cbconvert";
 
   # The extlib tag forces the github.com/gen2brain/go-unarr module to use external libraries instead of bundled ones.

pkgs/by-name/cd/cdncheck/package.nix

@@ -8,7 +8,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "cdncheck";
-  version = "1.2.51";
+  version = "1.3.1";
 
   __structuredAttrs = true;
 
@@ -16,10 +16,10 @@ buildGoModule (finalAttrs: {
     owner = "projectdiscovery";
     repo = "cdncheck";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-N3wIThhUejMSrsWl7WEw4yyxz3b1B/f3kacM2kPmiBY=";
+    hash = "sha256-lM+sw5AhM5gkrvcLqOZXwcKEtS3UBQYMmM5pPSS4xxQ=";
   };
 
-  vendorHash = "sha256-5+pQ2Harb4cLyD3y1qKuWbOTsl7nSuEwcIxaJteAVUo=";
+  vendorHash = "sha256-TYCYAKhytk249YJkRrgFrH8RWl0yrxr5z0dNONKBufU=";
 
   subPackages = [ "cmd/cdncheck/" ];
 

pkgs/by-name/ch/chatty/package.nix

@@ -11,7 +11,7 @@
   wrapGAppsHook4,
   evolution-data-server,
   feedbackd,
-  glibmm,
+  glibmm_2_4,
   libsecret,
   gnome-desktop,
   gspell,
@@ -53,7 +53,7 @@ stdenv.mkDerivation (finalAttrs: {
   buildInputs = [
     evolution-data-server
     feedbackd
-    glibmm
+    glibmm_2_4
     libsecret
     gnome-desktop
     gspell

pkgs/by-name/cl/claude-code/manifest.zst.json

@@ -1,62 +1,91 @@
 {
-  "version": "2.1.268",
+  "version": "2.1.270",
   "manifestSignatureEnforcement": "flag",
-  "commit": "8d19e585f3f1e02a7e31642695321906d38609a3",
-  "buildDate": "2026-09-10T17:39:52Z",
+  "commit": "97ecbf7abeb4170dcfd26c4d4b397afd9015030e",
+  "modsCommit": "536a2e23d9e28586f81f17b3535281b5f2995a70",
+  "buildDate": "2026-09-12T18:18:59Z",
   "platforms": {
     "darwin-arm64": {
       "binary": "claude.zst",
-      "checksum": "3e816cb773480b1c4aeadc1841be32a48fdcb3fec1ea56f59440bfb6faf457df",
-      "size": 67166011,
+      "checksum": "1b67468576dfe09f1975c5ddf2e10898e7632124995d68fb8b94545422cd8588",
+      "size": 68224840,
       "bundle": {
-        "checksum": "0f3074519ba4406a1c49349620b83ec7f5ac4fd478862df84e29ca6710661e99",
-        "size": 67167063
+        "checksum": "00e61c22a32dda2f56adcde562ea868e650abfd1b6af996a166d7a9896ec26ef",
+        "size": 68228599
       }
     },
     "darwin-x64": {
       "binary": "claude.zst",
-      "checksum": "ca8221fe78907f5d614f2bd17423ab25245d6a5c641a53ebdb7c9c9e53ffb86a",
-      "size": 71216486,
+      "checksum": "9e40f35e95a1abc6e4e42405bfd98cfceaab644488c69240b59b6955144115f5",
+      "size": 72355319,
       "bundle": {
-        "checksum": "2ad4c1df5a66acc116034232d335d305c42e38baedb737363a9d0f5e82b558be",
-        "size": 71218953
+        "checksum": "95daa6cb8a9612d9ef35f71891dc10330fc86fc1e83e4eb778b8e76609c79ca5",
+        "size": 72351007
       }
     },
     "linux-arm64": {
       "binary": "claude.zst",
-      "checksum": "d1ddeff370da9df19480e700b94c2ee0c298fa538607d5f6be01e025e9a233e0",
-      "size": 76373529
+      "checksum": "606c2f83c39682f6b4a6ff474b496de5911065951e5a72bcd951469e25dd811d",
+      "size": 77422861
     },
     "linux-x64": {
       "binary": "claude.zst",
-      "checksum": "9e2eca59e1ac7c7d9d9b8a031e4498de137e1da0a2fa3d8a69c00f071bd4495d",
-      "size": 76977785
+      "checksum": "59c056cd321c131eb211f6e90f4b9812dd24820357169f2ec9ca6a4b51d89d9c",
+      "size": 78038652
     },
     "linux-arm64-musl": {
       "binary": "claude.zst",
-      "checksum": "24a52891b9963d34b0fcb21f4a07228dc61e84a6f1c1d7475199fc004763143c",
-      "size": 74855137
+      "checksum": "040a816864ab8059ef75e6929464cb6ba15545a47f7ee7ed3f8d4a4618e17823",
+      "size": 75885941
     },
     "linux-x64-musl": {
       "binary": "claude.zst",
-      "checksum": "9574030b5f9c07b9d9b8d3ba55c0e12051df56faec14135aaa36ada7c226caf0",
-      "size": 75492207
+      "checksum": "953773d54d4e7381830104821e120967e0b96254e78f28315f672368b59505a7",
+      "size": 76529820
     },
     "win32-x64": {
       "binary": "claude.exe.zst",
-      "checksum": "02657300b90b53ab28bc478e1880b792c1650f3ad0b7bae6ffe461120e82d0f1",
-      "size": 79365973
+      "checksum": "2afb47ea1b1fe0bb224ddded3ddccf6303baac06f0f76c2921706c8bb9506d64",
+      "size": 80423657
     },
     "win32-arm64": {
       "binary": "claude.exe.zst",
-      "checksum": "8d32284fdb5255b158ae88755a717aa3b1521fde1235af57727bfdbb7b7642c0",
-      "size": 76145008
+      "checksum": "065bef2eb62e52e36ee80856ff03bcf542d71deac88a598c3fa10f5b46c9ba66",
+      "size": 77193327
     }
   },
   "sdkCompat": {
     "testedWrapperVersions": [
-      "0.3.226",
-      "0.3.227"
+      "0.3.229",
+      "0.3.231",
+      "0.3.232",
+      "0.3.233",
+      "0.3.234",
+      "0.3.235",
+      "0.3.236",
+      "0.3.237",
+      "0.3.238",
+      "0.3.239",
+      "0.3.240",
+      "0.3.241",
+      "0.3.242",
+      "0.3.243",
+      "0.3.245",
+      "0.3.246",
+      "0.3.247",
+      "0.3.248",
+      "0.3.250",
+      "0.3.251",
+      "0.3.252",
+      "0.3.258",
+      "0.3.259",
+      "0.3.260",
+      "0.3.261",
+      "0.3.263",
+      "0.3.266",
+      "0.3.267",
+      "0.3.268",
+      "0.3.269"
     ],
     "harnessSchema": 1
   }

pkgs/by-name/cl/clever-tools/package.nix

@@ -2,7 +2,7 @@
   lib,
   buildNpmPackage,
   fetchFromGitHub,
-  nodejs_22,
+  nodejs_24,
   installShellFiles,
   makeWrapper,
   stdenv,
@@ -11,18 +11,18 @@
 buildNpmPackage rec {
   pname = "clever-tools";
 
-  version = "4.11.0";
+  version = "5.0.0";
 
-  nodejs = nodejs_22;
+  nodejs = nodejs_24;
 
   src = fetchFromGitHub {
     owner = "CleverCloud";
     repo = "clever-tools";
     rev = version;
-    hash = "sha256-ma1EZL5xuUw8BrECFamSR1I8XJk8PERW7YJSj8JTp4w=";
+    hash = "sha256-9znQ7AsjYNQ70laoKyV42Avvt4JL3FgVdY/tEhX/nNY=";
   };
 
-  npmDepsHash = "sha256-9TPH+jRcM161MhabA9m0GcgAzc+yO1a1zh8vQHjZt7g=";
+  npmDepsHash = "sha256-q9CfE7ImYLSrDR7uApNmL3/T/IEuOGx4W4VJT9+KFs4=";
 
   nativeBuildInputs = [
     installShellFiles

pkgs/by-name/cl/cloudflare-dynamic-dns/package.nix

@@ -6,7 +6,7 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "cloudflare-dynamic-dns";
-  version = "4.5.7";
+  version = "4.5.9";
 
   __structuredAttrs = true;
 
@@ -14,10 +14,10 @@ buildGoModule (finalAttrs: {
     owner = "zebradil";
     repo = "cloudflare-dynamic-dns";
     tag = finalAttrs.version;
-    hash = "sha256-8rkQkPbFkz1XTMBRHFxoQx09eHFv2M91Q9RCyeD+ZbM=";
+    hash = "sha256-Z2NHq8iG6t+mlm8Sm0IecBwlFJQdE108/Sa0IXIg4J0=";
   };
 
-  vendorHash = "sha256-aYQsDAFck0qt675E+u1Aq9qKcsxMARrqRVpIxgM1yok=";
+  vendorHash = "sha256-U1UTZIqa6bPfU8iLDBAV0291+jbUD5Mqhuc/HtFxznk=";
 
   subPackages = ".";
 

pkgs/by-name/cm/cmake/add-nixpkgs-libc-paths.patch

@@ -1,8 +1,8 @@
 diff --git a/Modules/Platform/UnixPaths.cmake b/Modules/Platform/UnixPaths.cmake
-index e95da44ea4..bdf4155232 100644
+index 9aa659e4fd..ba9974c316 100644
 --- a/Modules/Platform/UnixPaths.cmake
 +++ b/Modules/Platform/UnixPaths.cmake
-@@ -71,28 +71,38 @@
+@@ -81,28 +81,38 @@ list(APPEND CMAKE_PLATFORM_IMPLICIT_LINK_DIRECTORIES
    /lib /lib32 /lib64 /usr/lib /usr/lib32 /usr/lib64
    )
  

pkgs/by-name/cm/cmake/darwin-binary-paths.patch

@@ -1,21 +1,21 @@
 diff --git a/Modules/Platform/Darwin-Initialize.cmake b/Modules/Platform/Darwin-Initialize.cmake
-index 196ab18b0b..31dd4346b1 100644
+index c9c88b36f5..0b1fda27d7 100644
 --- a/Modules/Platform/Darwin-Initialize.cmake
 +++ b/Modules/Platform/Darwin-Initialize.cmake
-@@ -16,7 +16,7 @@
- endif()
+@@ -290,7 +290,7 @@ endif()
+ # CMAKE_OSX_DEPLOYMENT_TARGET
  
  if(NOT CMAKE_CROSSCOMPILING)
 -  execute_process(COMMAND sw_vers -productVersion
 +  execute_process(COMMAND @sw_vers@ -productVersion
      OUTPUT_VARIABLE _CMAKE_HOST_OSX_VERSION
-     OUTPUT_STRIP_TRAILING_WHITESPACE)
- endif()
+     OUTPUT_STRIP_TRAILING_WHITESPACE
+     RESULT_VARIABLE _result)
 diff --git a/Source/kwsys/SystemInformation.cxx b/Source/kwsys/SystemInformation.cxx
-index c65587edbe..0a7cc380c3 100644
+index 743c224437..173ceb0a64 100644
 --- a/Source/kwsys/SystemInformation.cxx
 +++ b/Source/kwsys/SystemInformation.cxx
-@@ -3833,7 +3833,7 @@
+@@ -3835,7 +3835,7 @@ long long SystemInformationImplementation::GetHostMemoryUsed()
    }
    char const* names[3] = { "Pages wired down:", "Pages active:", nullptr };
    long long values[2] = { 0 };
@@ -24,7 +24,7 @@ index c65587edbe..0a7cc380c3 100644
    if (ierr) {
      return -1;
    }
-@@ -5586,7 +5586,7 @@
+@@ -5506,7 +5506,7 @@ int SystemInformationImplementation::CallSwVers(char const* arg,
  {
  #ifdef __APPLE__
    std::vector<char const*> args;
@@ -34,10 +34,10 @@ index c65587edbe..0a7cc380c3 100644
    args.push_back(nullptr);
    ver = this->RunProcess(args);
 diff --git a/Tests/CMakeLists.txt b/Tests/CMakeLists.txt
-index 15a1e2c0c3..33bb304cf7 100644
+index 8020d96833..d32e6a6693 100644
 --- a/Tests/CMakeLists.txt
 +++ b/Tests/CMakeLists.txt
-@@ -1958,7 +1958,7 @@
+@@ -1977,7 +1977,7 @@ if(BUILD_TESTING)
    if(CMake_TEST_XCODE_VERSION AND NOT CMake_TEST_XCODE_VERSION VERSION_LESS 5)
      if(NOT CMake_TEST_XCTest_DEPLOYMENT_TARGET)
        execute_process(
@@ -45,4 +45,4 @@ index 15a1e2c0c3..33bb304cf7 100644
 +        COMMAND @sw_vers@ -productVersion
          OUTPUT_VARIABLE OSX_VERSION
          OUTPUT_STRIP_TRAILING_WHITESPACE
-         )
+         RESULT_VARIABLE _sw_vers_result

pkgs/by-name/cm/cmake/darwin-bsd-binary-paths.patch

@@ -1,8 +1,8 @@
 diff --git a/Modules/CMakeDetermineSystem.cmake b/Modules/CMakeDetermineSystem.cmake
-index dc26258eac..dd8d30e3d9 100644
+index c70fea184d..10b18675b0 100644
 --- a/Modules/CMakeDetermineSystem.cmake
 +++ b/Modules/CMakeDetermineSystem.cmake
-@@ -68,7 +68,7 @@
+@@ -74,7 +74,7 @@ if(CMAKE_HOST_UNIX)
        endif()
        if(_CMAKE_APPLE_SILICON_PROCESSOR)
          if(";${_CMAKE_APPLE_SILICON_PROCESSOR};" MATCHES "^;(arm64|x86_64);$")
@@ -12,10 +12,10 @@ index dc26258eac..dd8d30e3d9 100644
              ERROR_VARIABLE _sysctl_stderr
              RESULT_VARIABLE _sysctl_result
 diff --git a/Modules/Platform/Darwin-Initialize.cmake b/Modules/Platform/Darwin-Initialize.cmake
-index 31dd4346b1..7c4f123a1d 100644
+index 0b1fda27d7..f5491ef048 100644
 --- a/Modules/Platform/Darwin-Initialize.cmake
 +++ b/Modules/Platform/Darwin-Initialize.cmake
-@@ -28,7 +28,7 @@
+@@ -22,7 +22,7 @@ set(CMAKE_OSX_ARCHITECTURES "$ENV{CMAKE_OSX_ARCHITECTURES}" CACHE STRING
  if(NOT CMAKE_CROSSCOMPILING AND
     CMAKE_SYSTEM_NAME STREQUAL "Darwin" AND
     CMAKE_HOST_SYSTEM_PROCESSOR MATCHES "^(arm64|x86_64)$")
@@ -25,10 +25,10 @@ index 31dd4346b1..7c4f123a1d 100644
      ERROR_VARIABLE _sysctl_stderr
      RESULT_VARIABLE _sysctl_result
 diff --git a/Modules/ProcessorCount.cmake b/Modules/ProcessorCount.cmake
-index 260b6631c0..ffb8fcd8d2 100644
+index b8fa1fabc0..7c3112b817 100644
 --- a/Modules/ProcessorCount.cmake
 +++ b/Modules/ProcessorCount.cmake
-@@ -87,8 +87,7 @@
+@@ -87,8 +87,7 @@ function(ProcessorCount var)
  
    if(NOT count)
      # Mac, FreeBSD, OpenBSD (systems with sysctl):
@@ -52,10 +52,10 @@ index 8c22b4e43a..6d9ccef5e7 100644
  #elif defined(__sun) && (defined(__SVR4) || defined(__svr4__)) /* Solaris */
  #  define KWSYSPE_PS_COMMAND "ps -e -o pid,ppid"
 diff --git a/Source/kwsys/SystemInformation.cxx b/Source/kwsys/SystemInformation.cxx
-index 0a7cc380c3..9923dc4ab9 100644
+index 173ceb0a64..7bddddf955 100644
 --- a/Source/kwsys/SystemInformation.cxx
 +++ b/Source/kwsys/SystemInformation.cxx
-@@ -3876,7 +3876,7 @@
+@@ -3878,7 +3878,7 @@ long long SystemInformationImplementation::GetProcMemoryUsed()
    long long memUsed = 0;
    pid_t pid = getpid();
    std::ostringstream oss;
@@ -65,10 +65,10 @@ index 0a7cc380c3..9923dc4ab9 100644
    if (!file) {
      return -1;
 diff --git a/Tests/CMakeLists.txt b/Tests/CMakeLists.txt
-index 33bb304cf7..7dbda40a81 100644
+index d32e6a6693..683e27ece7 100644
 --- a/Tests/CMakeLists.txt
 +++ b/Tests/CMakeLists.txt
-@@ -216,7 +216,7 @@
+@@ -249,7 +249,7 @@ if(BUILD_TESTING)
    endif()
  
    if(CMAKE_SYSTEM_NAME STREQUAL "Darwin" AND NOT DEFINED CMake_TEST_APPLE_SILICON)

pkgs/by-name/cm/cmake/nixpkgs-cmake-prefix-path.patch

@@ -1,8 +1,8 @@
 diff --git a/Source/cmFindBase.cxx b/Source/cmFindBase.cxx
-index b8d4765692..902c1e5290 100644
+index e9e8dfd4b9..d115cd1897 100644
 --- a/Source/cmFindBase.cxx
 +++ b/Source/cmFindBase.cxx
-@@ -312,6 +312,11 @@ void cmFindBase::FillCMakeEnvironmentPath()
+@@ -308,6 +308,11 @@ void cmFindBase::FillCMakeEnvironmentPath()
    // Add CMAKE_*_PATH environment variables
    std::string var = cmStrCat("CMAKE_", this->CMakePathName, "_PATH");
    paths.AddEnvPrefixPath("CMAKE_PREFIX_PATH");
@@ -15,10 +15,10 @@ index b8d4765692..902c1e5290 100644
  
    if (this->CMakePathName == "PROGRAM") {
 diff --git a/Source/cmFindPackageCommand.cxx b/Source/cmFindPackageCommand.cxx
-index 6201894fd1..9533862a2b 100644
+index 2f2c5c6662..4594afd0e7 100644
 --- a/Source/cmFindPackageCommand.cxx
 +++ b/Source/cmFindPackageCommand.cxx
-@@ -2467,6 +2467,7 @@ void cmFindPackageCommand::FillPrefixesCMakeEnvironment()
+@@ -2520,6 +2520,7 @@ void cmFindPackageCommand::FillPrefixesCMakeEnvironment()
  
    // And now the general CMake environment variables
    paths.AddEnvPath("CMAKE_PREFIX_PATH");

pkgs/by-name/cm/cmake/package.nix

@@ -52,11 +52,11 @@ stdenv.mkDerivation (finalAttrs: {
     + lib.optionalString isMinimalBuild "-minimal"
     + lib.optionalString cursesUI "-cursesUI"
     + lib.optionalString qt5UI "-qt5UI";
-  version = "4.4.2";
+  version = "4.4.3";
 
   src = fetchurl {
     url = "https://cmake.org/files/v${lib.versions.majorMinor finalAttrs.version}/cmake-${finalAttrs.version}.tar.gz";
-    hash = "sha256-HbnmHmC24IdMhjhjQLkQOC88XnW5+/tE0SIGMSmieJ0=";
+    hash = "sha256-xGQAYYtPHytDUH8k+yLzroMMNBbPI7d24W4dQTqokvA=";
   };
 
   patches = [

pkgs/by-name/cm/cmux/package.nix

@@ -9,14 +9,14 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "cmux";
-  version = "0.64.10";
+  version = "0.64.22";
 
   __structuredAttrs = true;
   strictDeps = true;
 
   src = fetchurl {
     url = "https://github.com/manaflow-ai/cmux/releases/download/v${finalAttrs.version}/cmux-macos.dmg";
-    hash = "sha256-+MKcMChZTFiDF482mVIh6mzeyKghDMV9gLA+6BjamXw=";
+    hash = "sha256-/RSNujUZ/n0wiEQInOTQYrF3ObpkViPwWPZ6ZHmM6iU=";
   };
 
   # -snld prevents "ERROR: Dangerous symbolic link path was ignored"

pkgs/by-name/co/cockpit-zfs/package.nix

@@ -1,7 +1,6 @@
 {
   acl,
   bash,
-  buildPackages,
   cockpit,
   coreutils,
   fetchFromGitHub,
@@ -15,7 +14,7 @@
   mbuffer,
   msmtp,
   nix-update-script,
-  nodejs_22,
+  nodejs,
   openssh,
   samba,
   shadow,
@@ -27,22 +26,6 @@
   yarn-berry,
   zfs,
 }:
-let
-  # Pin to Node <24.15.0: Yarn Berry's PnP linker breaks `require.cache` on
-  # newer Node, which crashes tailwindcss mid-build (and ESLint, per
-  # yarnpkg/berry#7106). See NixOS/nixpkgs#530137.
-  #
-  # `nodejs` is rebound here (rather than touched at every call site below)
-  # so the rest of this file is unaffected.
-  #
-  # yarn-berry's own `yarn` binary gets patchShebang'd against whatever
-  # `nodejs` *it* was built with, so overriding nativeBuildInputs alone does
-  # nothing - we have to rebuild yarn-berry itself against nodejs_22, for
-  # both the host and build-platform (cross-compilation) variants.
-  nodejs = nodejs_22;
-  yarnBerry = yarn-berry.override { inherit nodejs; };
-  yarnBerryForBuild = buildPackages.yarn-berry.override { nodejs = buildPackages.nodejs_22; };
-in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "cockpit-zfs";
@@ -59,17 +42,17 @@ stdenv.mkDerivation (finalAttrs: {
   missingHashes = ./missing-hashes.json;
 
   # Use buildPackages for cross-compilation support
-  offlineCache = yarnBerryForBuild.fetchYarnBerryDeps {
+  offlineCache = yarn-berry.fetchYarnBerryDeps {
     inherit (finalAttrs) src missingHashes;
     hash = "sha256-nm3iHf9Rm5JFKzH0HAvglkQPFIV6Fl1e9WvNdqevTug=";
   };
 
   nativeBuildInputs = [
     makeWrapper
-    nodejs_22
+    nodejs
     jq
-    yarnBerry
-    yarnBerryForBuild.yarnBerryConfigHook
+    yarn-berry
+    yarn-berry.yarnBerryConfigHook
   ];
 
   disallowedRequisites = [ finalAttrs.offlineCache ];
@@ -86,7 +69,7 @@ stdenv.mkDerivation (finalAttrs: {
     lsscsi
     mbuffer
     msmtp
-    nodejs_22
+    nodejs
     openssh
     samba
     shadow

pkgs/by-name/co/compare50/package.nix

@@ -20,9 +20,10 @@ python3Packages.buildPythonApplication (finalAttrs: {
   postPatch = ''
     substituteInPlace setup.py --replace-fail \
       'scripts=["bin/compare50"]' 'entry_points={"console_scripts": ["compare50=compare50.__main__:main"]}'
-    # auto included in current python version, no install needed
-    substituteInPlace setup.py --replace-fail \
-      'importlib' ' '
+
+    # Fix "AttributeError: module 'importlib' has no attribute 'resources'"
+    substituteInPlace compare50/passes.py \
+      --replace-fail "import importlib" "import importlib, importlib.resources"
   '';
 
   build-system = [
@@ -47,6 +48,11 @@ python3Packages.buildPythonApplication (finalAttrs: {
     "termcolor"
   ];
 
+  # Safely strip out the obsolete `importlib` PyPI package
+  pythonRemoveDeps = [
+    "importlib"
+  ];
+
   pythonImportsCheck = [ "compare50" ];
 
   nativeCheckInputs = [ versionCheckHook ];

pkgs/by-name/co/contact/package.nix

@@ -6,14 +6,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "contact";
-  version = "1.6.7";
+  version = "1.6.13";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pdxlocations";
     repo = "contact";
     tag = finalAttrs.version;
-    hash = "sha256-i+mWkHdDJAGiX0F4vTygU9oGqUeczSaziiOwRqAXa30=";
+    hash = "sha256-gKSGWckCbqp2FrK307k0yaox/lcElmIaNH6aUPUeys0=";
   };
 
   dependencies = [ python3Packages.meshtastic ];

pkgs/by-name/co/copyparty/package.nix

@@ -71,11 +71,11 @@ in
 
 python3Packages.buildPythonApplication rec {
   pname = "copyparty${nameSuffix}";
-  version = "1.20.21";
+  version = "1.20.23";
 
   src = fetchurl {
     url = "https://github.com/9001/copyparty/releases/download/v${version}/copyparty-${version}.tar.gz";
-    hash = "sha256-ZU70dVW7QC4n2JBckAyZ9Ut/HW24dKdJ7/35qyPPQiM=";
+    hash = "sha256-wJV84HewSUKSVBEWuUc/29oeZZe12RWLL8Rw2woYNN0=";
   };
 
   pyproject = true;

pkgs/by-name/co/cosmic-ext-applet-sysinfo/package.nix

@@ -9,16 +9,16 @@
 }:
 rustPlatform.buildRustPackage {
   pname = "cosmic-ext-applet-sysinfo";
-  version = "0-unstable-2026-08-10";
+  version = "0-unstable-2026-09-08";
 
   src = fetchFromGitHub {
     owner = "cosmic-utils";
     repo = "cosmic-ext-applet-sysinfo";
-    rev = "bf9d7473c6ebff0d0062837021640d55eb0b4154";
-    hash = "sha256-UZGILff2NqT9UtxVyDgCftuk+GkCEPHBO6tWZjzoxGU=";
+    rev = "74265699a6d2b9803707bd1be9a4241b192f78fe";
+    hash = "sha256-kSxBoRepJX0bw6xhFXNp6inzv5vMlp2c5SDHxLY4I0s=";
   };
 
-  cargoHash = "sha256-txUuPLwts10Qn8c9Ix48NaOe7/3k8cd27rwYbgGcRfE=";
+  cargoHash = "sha256-xCzrsLQb9k7VcNmt+pyHQk6UdxR0TjdhRz9wPZ4tsEY=";
 
   nativeBuildInputs = [
     libcosmicAppHook

pkgs/by-name/co/cosmic-ext-applet-weather/package.nix

@@ -9,16 +9,16 @@
 }:
 rustPlatform.buildRustPackage {
   pname = "cosmic-ext-applet-weather";
-  version = "0-unstable-2026-08-02";
+  version = "0-unstable-2026-09-03";
 
   src = fetchFromGitHub {
     owner = "cosmic-utils";
     repo = "cosmic-ext-applet-weather";
-    rev = "4f79ec8ccbf23307cd04c4876ad29d0828b96ca8";
-    hash = "sha256-nIQBIhXTUYf545/+xWMIqKc3BqdV+N9KNSgFS7xklec=";
+    rev = "52a9e3a4ac6de8d8476a3b609dcea32feae490a6";
+    hash = "sha256-O7CjexYM1AWS0P+cm1ibgZRannmKpJMIDi8oRLE2piM=";
   };
 
-  cargoHash = "sha256-mRCJ3INn9jEc4yWmnBpRthcn7VyL8ql+sQoghkmAnOU=";
+  cargoHash = "sha256-IzxjV+9Z3RNwF/6h1SGvsE8F5CgbqFTZzptgyi3jOZA=";
 
   nativeBuildInputs = [
     libcosmicAppHook