Merge master into staging-nixos

buildVimPlugin always set its own installPhase, so one passed to it
never ran and the plugin silently got the whole source tree instead.
Use the caller's installPhase when set, like trivialBuild and
buildGoModule do, and keep the current one as the default. Plugins
that don't set installPhase are unchanged.

doc/release-notes/rl-2611.section.md

@@ -318,6 +318,9 @@
 
 - `typescript` 7.0.2 now uses the Golang implementation. The [announcement document](https://devblogs.microsoft.com/typescript/announcing-typescript-7-0/) has information on what was changed.
 
+- `macaulay2` no longer installs Emacs files.
+  Users can now get the files from an Emacs lisp package, like `emacs.pkgs.withPackages (epkgs: [ epkgs.m2 ])`.
+
 - `navidrome`'s plugin infrastructure has significantly changed. `buildNavidromePlugin` is renamed to `buildNavidromeGoPlugin` to allow for other language types. Plugins must now be sourced from `pkgsCross.wasi32.navidromePlugins.<name>`.
 
 - `navidromePlugins.apple-music` now uses a `bundleName` attribute which sets the plugin's name to match the plugin's documentation for easier use. You will need to update your Agent from `apple-music-plugin` to `apple-music` as noted in [their docs](https://github.com/navidrome/apple-music-plugin#installation).

maintainers/maintainer-list.nix

@@ -9520,6 +9520,12 @@
     github = "fkautz";
     githubId = 135706;
   };
+  fkokosinski = {
+    name = "Filip Kokosiński";
+    email = "filip@kokosinski.me";
+    github = "fkokosinski";
+    githubId = 19800410;
+  };
   fkomarek = {
     name = "Filip Komárek";
     github = "filip2cz";
@@ -13655,6 +13661,12 @@
     githubId = 474643;
     name = "José Miguel Martínez Carrasco";
   };
+  jm5905938 = {
+    email = "jm5905938@gmail.com";
+    github = "jm5905938";
+    githubId = 187073435;
+    name = "Aveline Noir";
+  };
   jmagnusj = {
     email = "jmagnusj@gmail.com";
     github = "magnusjonsson";
@@ -18773,6 +18785,13 @@
     github = "mfairley";
     githubId = 4374785;
   };
+  mfocko = {
+    name = "Matej Focko";
+    github = "mfocko";
+    githubId = 8149784;
+    email = "me@mfocko.xyz";
+    matrix = "@mfocko:fedora.im";
+  };
   mfossen = {
     email = "msfossen@gmail.com";
     github = "mfossen";
@@ -26017,6 +26036,12 @@
     githubId = 11632726;
     name = "Arijit Basu";
   };
+  saylesss88 = {
+    email = "saylesss87@proton.me";
+    github = "saylesss88";
+    githubId = 209646716;
+    name = "T. Sawyer";
+  };
   sb0 = {
     email = "sb@m-labs.hk";
     github = "sbourdeauducq";

nixos/modules/security/wrappers/default.nix

@@ -361,16 +361,19 @@ in
 
     ###### wrappers consistency checks
     system.checks = lib.singleton (
-      pkgs.runCommandLocal "ensure-all-wrappers-paths-exist"
+      pkgs.runCommandLocal "ensure-wrapper-integrity"
         {
-          nativeBuildInputs = [ pkgs.libcap-text-verifier ];
+          nativeBuildInputs = [
+            pkgs.libcap-text-verifier
+            pkgs.file
+          ];
           preferLocalBuild = true;
         }
         ''
           # make sure we produce output
           mkdir -p $out
 
-          echo -n "Checking that Nix store paths of all wrapped programs exist... "
+          echo -n "Checking that Nix store paths of all wrapped programs exist and are ELF executables... "
           ${lib.toShellVar "wrappers" (lib.mapAttrs (n: v: v.source) wrappers)}
           for name in "''${!wrappers[@]}"; do
             path="''${wrappers[$name]}"
@@ -382,6 +385,15 @@ in
               test -t 1 && echo -ne '\033[0m'
               exit 1
             fi
+            magic=$(file --mime --brief --dereference "$path")
+            if ! [[ "$magic" =~ application/x-executable || "$magic" =~ application/x-pie-executable ]]; then
+              test -t 1 && echo -ne '\033[1;31m'
+              echo "FAIL"
+              echo "The target executable $path is not an ELF! This is a security risk."
+              echo "Script wrappers (e.g. bash or python) are commonly susceptible to dangerous env var injections."
+              test -t 1 && echo -ne '\033[0m'
+              exit 1
+            fi
           done
           echo "OK"
 

nixos/modules/services/monitoring/telegraf.nix

@@ -11,6 +11,10 @@ let
   configFile = settingsFormat.generate "config.toml" cfg.extraConfig;
 in
 {
+  meta = {
+    inherit (pkgs.telegraf.meta) maintainers;
+  };
+
   ###### interface
   options = {
     services.telegraf = {

nixos/modules/services/networking/rpcbind.nix

@@ -5,8 +5,6 @@
   ...
 }:
 
-with lib;
-
 {
 
   ###### interface
@@ -15,8 +13,8 @@ with lib;
 
     services.rpcbind = {
 
-      enable = mkOption {
-        type = types.bool;
+      enable = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Whether to enable `rpcbind`, an ONC RPC directory service
@@ -32,29 +30,34 @@ with lib;
 
   ###### implementation
 
-  config = mkIf config.services.rpcbind.enable {
-    environment.systemPackages = [ pkgs.rpcbind ];
+  config = lib.mkMerge [
+    (lib.mkIf config.services.rpcbind.enable {
+      environment.systemPackages = [ pkgs.rpcbind ];
 
-    systemd.packages = [ pkgs.rpcbind ];
+      systemd.packages = [ pkgs.rpcbind ];
 
-    systemd.services.rpcbind = {
-      wantedBy = [ "multi-user.target" ];
-      # rpcbind performs a check for /var/run/rpcbind.lock at startup
-      # and will crash if /var/run isn't present. In the stock NixOS
-      # var.conf tmpfiles configuration file, /var/run is symlinked to
-      # /run, so rpcbind can enter a race condition in which /var/run
-      # isn't symlinked yet but tries to interact with the path, so
-      # controlling the order explicitly here ensures that rpcbind can
-      # start successfully. The `wants` instead of `requires` should
-      # avoid creating a strict/brittle dependency.
-      wants = [ "systemd-tmpfiles-setup.service" ];
-      after = [ "systemd-tmpfiles-setup.service" ];
-    };
+      systemd.services.rpcbind = {
+        wantedBy = [ "multi-user.target" ];
+        # rpcbind performs a check for /var/run/rpcbind.lock at startup
+        # and will crash if /var/run isn't present. In the stock NixOS
+        # var.conf tmpfiles configuration file, /var/run is symlinked to
+        # /run, so rpcbind can enter a race condition in which /var/run
+        # isn't symlinked yet but tries to interact with the path, so
+        # controlling the order explicitly here ensures that rpcbind can
+        # start successfully. The `wants` instead of `requires` should
+        # avoid creating a strict/brittle dependency.
+        wants = [ "systemd-tmpfiles-setup.service" ];
+        after = [ "systemd-tmpfiles-setup.service" ];
+      };
+    })
 
-    users.users.rpc = {
-      group = "nogroup";
-      uid = config.ids.uids.rpc;
-    };
-  };
+    {
+      users.users.rpc = {
+        enable = config.services.rpcbind.enable;
+        group = "nogroup";
+        uid = config.ids.uids.rpc;
+      };
+    }
+  ];
 
 }

nixos/modules/services/web-apps/akkoma.nix

@@ -1167,17 +1167,16 @@ in
   };
 
   config = mkIf cfg.enable {
-    assertions =
-      optionals
-        (
+    assertions = [
+      {
+        assertion =
           cfg.config.":pleroma".":media_proxy".enabled
-          && cfg.config.":pleroma".":media_proxy".base_url == null
-        )
-        [
-          ''
-            `services.akkoma.config.":pleroma".":media_proxy".base_url` must be set when the media proxy is enabled.
-          ''
-        ];
+          -> cfg.config.":pleroma".":media_proxy".base_url != null;
+        message = ''
+          `services.akkoma.config.":pleroma".":media_proxy".base_url` must be set to a URL with a different host component (domain name) than the web endpoint when the media proxy is enabled.
+        '';
+      }
+    ];
     warnings =
       optionals (with config.security; cfg.installWrapper && (!sudo.enable) && (!sudo-rs.enable))
         [

nixos/modules/system/boot/stratisroot.nix

@@ -34,6 +34,7 @@ in
           thin_repair = "${pkgs."thin-provisioning-tools"}/bin/thin_repair";
           thin_metadata_size = "${pkgs."thin-provisioning-tools"}/bin/thin_metadata_size";
           stratis-min = "${pkgs.stratisd}/bin/stratis-min";
+          cryptsetup = "${pkgs.cryptsetup}/bin/cryptsetup";
         };
         services = lib.attrsets.mapAttrs' (mountPoint: fileSystem: {
           name = "stratis-setup-${fileSystem.stratis.poolUuid}";

nixos/tests/installer.nix

@@ -1861,7 +1861,7 @@ in
     createPartitions = ''
       installer.succeed(
         "sgdisk --zap-all /dev/vda",
-        "sgdisk --new=1:0:+100M --typecode=0:ef00 /dev/vda", # /boot
+        "sgdisk --new=1:0:+200M --typecode=0:ef00 /dev/vda", # /boot
         "sgdisk --new=2:0:+1G --typecode=0:8200 /dev/vda", # swap
         "sgdisk --new=3:0:+5G --typecode=0:8300 /dev/vda", # /
         "udevadm settle",

nixos/tests/linux-builder-vz-store-gc.nix

@@ -1,12 +1,15 @@
-{ lib, ... }:
+{ hostPkgs, lib, ... }:
 
 {
   # Strictly speaking, this is not a precise test for VZ builder, but we don't
   # have vzvm backend for nixos tests, so we use qemu here, with config that
   # matches linux-builder-vz disk layout.
   name = "linux-builder-vz-store-gc";
+  meta.maintainers = hostPkgs.darwin.linux-builder-vz.meta.maintainers;
 
   nodes.machine = {
+    nix.enable = true;
+
     virtualisation = {
       # Match the vz-vm drive order: the read-only store image is /dev/vda,
       # followed by the writable data disk at /dev/vdb.

nixos/tests/telegraf.nix

@@ -1,8 +1,8 @@
 { pkgs, ... }:
 {
   name = "telegraf";
-  meta = with pkgs.lib.maintainers; {
-    maintainers = [ mic92 ];
+  meta = {
+    inherit (pkgs.telegraf.meta) maintainers;
   };
 
   containers.machine =

pkgs/applications/editors/emacs/elisp-packages/manual-packages/m2/package.nix

@@ -0,0 +1,31 @@
+{
+  lib,
+  melpaBuild,
+  fetchFromGitHub,
+  macaulay2,
+}:
+melpaBuild {
+  pname = "m2";
+  ename = "M2";
+
+  version = "1.26.6";
+
+  src = fetchFromGitHub {
+    owner = "Macaulay2";
+    repo = "M2-emacs";
+    rev = "ae882ab04da19f62c62462ef9604251a0b30a9f5";
+    hash = "sha256-8qnPzLR616Oypb6YGUm1cVj8jd1QDdeajHkVaTaEnX4=";
+  };
+
+  postPatch = ''
+    substituteInPlace M2.el \
+      --replace-fail 'defcustom M2-exe "M2"' 'defcustom M2-exe "${lib.getExe macaulay2}"'
+  '';
+
+  meta = {
+    inherit (macaulay2.meta) maintainers platforms;
+    description = "Major mode for editing Macaulay2 source code";
+    homepage = "https://github.com/Macaulay2/M2-emacs";
+    license = lib.licenses.gpl3Plus;
+  };
+}

pkgs/applications/editors/vim/plugins/aliases.nix

@@ -17,16 +17,8 @@ let
   # sets from building on Hydra.
   removeDistribute = alias: if lib.isDerivation alias then lib.dontDistribute alias else alias;
 
-  # Make sure that we are not shadowing something from
-  # all-packages.nix.
-  checkInPkgs =
-    n: alias: if builtins.hasAttr n prev then throw "Alias ${n} is still in vim-plugins" else alias;
-
   mapAliases =
-    aliases:
-    lib.mapAttrs (
-      n: alias: removeDistribute (removeRecurseForDerivations (checkInPkgs n alias))
-    ) aliases;
+    aliases: lib.mapAttrs (_: alias: removeDistribute (removeRecurseForDerivations alias)) aliases;
 
   deprecations = lib.mapAttrs (
     old: info:
@@ -64,7 +56,7 @@ mapAliases (
     playground = throw "'vimPlugins.playground' has been archived"; # Added 2025-12-18
     pure-lua = lib.warnOnInstantiate "Please replace 'vimPlugins.pure-lua' with 'vimPlugins.moonlight-nvim' as this name was an error" moonlight-nvim; # Added 2025-11-17
     registers-nvim = throw "'vimPlugins.registers-nvim' has been removed: the upstream repository got deleted"; # Added 2026-04-30
-    rust-tools-nvim = lib.warnOnInstantiate "'vimPlugins.rust-tools-nvim' is abandoned by upstream; you should use 'vimPlugins.rustaceanvim'" rust-tools-nvim; # Added 2026-02-04
+    rust-tools-nvim = throw "'vimPlugins.rust-tools-nvim' has been removed: abandoned by upstream. Use rustaceanvim"; # Added 2026-09-28
     Spacegray-vim = throw "'vimPlugins.Spacegray-vim' has been removed: abandoned by upstream"; # Added 2025-03-24
     SpaceVim = throw "'vimPlugins.SpaceVim' didn't work properly in vimPlugins, please use top-level 'spacevim' instead"; # Added 2024-11-27
     spacevim = throw "'vimPlugins.spacevim' was unmaintained for the last 6 years, please use top-level 'spacevim'"; # Added 2024-11-27

pkgs/applications/editors/vim/plugins/default.nix

@@ -55,7 +55,14 @@ let
     inherit llvmPackages;
   };
 
-  aliases = if config.allowAliases then (import ./aliases.nix lib) else final: prev: { };
+  aliases =
+    final: prev:
+    let
+      defined = import ./aliases.nix lib final prev;
+      shadowed = builtins.attrNames (builtins.intersectAttrs prev defined);
+    in
+    assert lib.assertMsg (shadowed == [ ]) "vimPlugins aliases shadow plugins: ${toString shadowed}";
+    lib.optionalAttrs config.allowAliases defined;
 in
 lib.pipe initialPackages [
   (extends plugins)

pkgs/applications/editors/vim/plugins/generated.nix

@@ -461,12 +461,12 @@ final: prev: {
 
   SchemaStore-nvim = buildVimPlugin {
     pname = "SchemaStore.nvim";
-    version = "0-unstable-2026-09-24";
+    version = "0-unstable-2026-09-28";
     src = fetchFromGitHub {
       owner = "b0o";
       repo = "SchemaStore.nvim";
-      rev = "12dd0de1f15d598db2cc0d075f4f0d13a3290d4d";
-      hash = "sha256-CwAbTCSjMb85sSNNEFu0Cm09qj55WzNsw/01Yi1itKo=";
+      rev = "411163b2be396495c76788a016cb1354f1e8acd0";
+      hash = "sha256-x+nym6jprfHZSUH8qT+1JHmV/nG66BAhwMENxTah2pI=";
     };
     meta.homepage = "https://github.com/b0o/SchemaStore.nvim/";
     meta.license = getLicenseFromSpdxId "Apache-2.0";
@@ -1653,12 +1653,12 @@ final: prev: {
 
   base46 = buildVimPlugin {
     pname = "base46";
-    version = "0-unstable-2026-09-18";
+    version = "0-unstable-2026-09-25";
     src = fetchFromGitHub {
       owner = "nvchad";
       repo = "base46";
-      rev = "91b29a33670e77b3705001804670511a17c0c1dc";
-      hash = "sha256-d3jSfJU0KS0MG0sm6aYJlqRxajwe3rMWlffufrGj1IE=";
+      rev = "7df2bd89295db00b649cbc49bdf6fe5a1cc5df3b";
+      hash = "sha256-LIYAurLRSHnGtDUvxUvIE0PJ1cZ6L0M4nQ+a1H2SgJg=";
     };
     meta.homepage = "https://github.com/nvchad/base46/";
     meta.license = unfree;
@@ -3513,12 +3513,12 @@ final: prev: {
 
   coc-nvim = buildVimPlugin {
     pname = "coc.nvim";
-    version = "0.0.82-unstable-2026-09-22";
+    version = "0.0.82-unstable-2026-09-28";
     src = fetchFromGitHub {
       owner = "neoclide";
       repo = "coc.nvim";
-      rev = "f5910295483bfbe8b58e6f2002e9ae280e5b700e";
-      hash = "sha256-fXxJRSEfj/o/43fd+iADJl7ARYOZd01iLbSYnFHG1Sc=";
+      rev = "eda4d09170fd9bd08dd9abbe300f1f5bcaae0a20";
+      hash = "sha256-4chqsnJIuNyjNN6r7ct48qjQhZfJQRPCKkaWIOOj3/Y=";
     };
     meta.homepage = "https://github.com/neoclide/coc.nvim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -3611,12 +3611,12 @@ final: prev: {
 
   codecompanion-nvim = buildVimPlugin {
     pname = "codecompanion.nvim";
-    version = "19.25.0";
+    version = "19.26.0";
     src = fetchFromGitHub {
       owner = "olimorris";
       repo = "codecompanion.nvim";
-      tag = "v19.25.0";
-      hash = "sha256-PTvllgZji45JdW1NW9YmRDJqiEvdmbpeB2QGvu10jbM=";
+      tag = "v19.26.0";
+      hash = "sha256-KS3F/h1UCYSsztWKy2RouS89I46+y7uB/qykHJ4lIf0=";
     };
     meta.homepage = "https://github.com/olimorris/codecompanion.nvim/";
     meta.license = getLicenseFromSpdxId "Apache-2.0";
@@ -5334,6 +5334,20 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  direnv-nvim = buildVimPlugin {
+    pname = "direnv.nvim";
+    version = "0-unstable-2026-06-28";
+    src = fetchFromGitHub {
+      owner = "NotAShelf";
+      repo = "direnv.nvim";
+      rev = "9258f9f10c4c729d8296fce0e3ecb12543daad06";
+      hash = "sha256-b5PpmkYWaDGLNcu+36tRR5ycATHYBjs9WrV8/jfmooQ=";
+    };
+    meta.homepage = "https://github.com/NotAShelf/direnv.nvim/";
+    meta.license = getLicenseFromSpdxId "MPL-2.0";
+    meta.hydraPlatforms = [ ];
+  };
+
   direnv-vim = buildVimPlugin {
     pname = "direnv.vim";
     version = "0-unstable-2023-12-02";
@@ -5448,12 +5462,12 @@ final: prev: {
 
   dropbar-nvim = buildVimPlugin {
     pname = "dropbar.nvim";
-    version = "14.2.1-unstable-2026-05-31";
+    version = "14.2.1-unstable-2026-09-25";
     src = fetchFromGitHub {
       owner = "Bekaboo";
       repo = "dropbar.nvim";
-      rev = "808ba31cde89aec8833e9789f5e04557cd31c9e1";
-      hash = "sha256-S9TD5PkHKHoo2jfjOXkQoNtyr/PNtR/eljXB+8PtGU8=";
+      rev = "f7c6fa21e2a7c32576e7a1791774a3736987f467";
+      hash = "sha256-bxlbejtkSwKUQ0+H/+6k83hqUeBq29iHanpVxv7+cZk=";
     };
     meta.homepage = "https://github.com/Bekaboo/dropbar.nvim/";
     meta.license = getLicenseFromSpdxId "GPL-3.0-only";
@@ -6220,12 +6234,12 @@ final: prev: {
 
   flutter-tools-nvim = buildVimPlugin {
     pname = "flutter-tools.nvim";
-    version = "3.0.1";
+    version = "3.1.0";
     src = fetchFromGitHub {
       owner = "nvim-flutter";
       repo = "flutter-tools.nvim";
-      tag = "v3.0.1";
-      hash = "sha256-rdwusVC1/1FTY3dTLkjZ6d1pjubt+fBgRZexih7ClsM=";
+      tag = "v3.1.0";
+      hash = "sha256-eJPZSO7ioKULD66n5A7Yb6lpKQft+p3R4h4AriybA0s=";
     };
     meta.homepage = "https://github.com/nvim-flutter/flutter-tools.nvim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -6473,12 +6487,12 @@ final: prev: {
 
   fzf-vim = buildVimPlugin {
     pname = "fzf.vim";
-    version = "0-unstable-2026-09-07";
+    version = "0-unstable-2026-09-26";
     src = fetchFromGitHub {
       owner = "junegunn";
       repo = "fzf.vim";
-      rev = "8a0068127ac9ee23d71dab2944ce995726bef462";
-      hash = "sha256-nv/C0UMpVLzu0mYODVnByMkWnNlILdoqkl4KkLGSfjk=";
+      rev = "a630ef91e1e050574e703f506cd0812b18d26939";
+      hash = "sha256-QgHHnwpchIyP3H8cP3aMHjXcOm6cCsVDwo/uOzYZAtQ=";
     };
     meta.homepage = "https://github.com/junegunn/fzf.vim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -8323,12 +8337,13 @@ final: prev: {
   jsonfly-nvim = buildVimPlugin {
     pname = "jsonfly.nvim";
     version = "0-unstable-2025-11-02";
-    src = fetchgit {
-      url = "https://git.myzel394.app/Myzel394/jsonfly.nvim";
+    src = fetchFromGitHub {
+      owner = "Myzel394";
+      repo = "jsonfly.nvim";
       rev = "3d58635cb195a5435743e7882c6ac7cff710204f";
-      hash = "sha256-bTh/6zmYQ+XqBsccKo8i149nU5bBfFv+8UKMayHIoo4=";
+      hash = "sha256-qTxLDQKqmsf/DrgzhfrmtY2LUVhPcGNFU/Iq4ew29lA=";
     };
-    meta.homepage = "https://git.myzel394.app/Myzel394/jsonfly.nvim";
+    meta.homepage = "https://github.com/Myzel394/jsonfly.nvim";
     meta.license = unfree;
     meta.hydraPlatforms = [ ];
   };
@@ -8783,11 +8798,11 @@ final: prev: {
 
   leap-nvim = buildVimPlugin {
     pname = "leap.nvim";
-    version = "0-unstable-2026-09-19";
+    version = "0-unstable-2026-09-27";
     src = fetchgit {
       url = "https://codeberg.org/andyg/leap.nvim/";
-      rev = "32bde2e932417e8a065f039f00f0cebdd0da4710";
-      hash = "sha256-SXtPDUdu5cju3CQW64Pi21Ry4Swlbki5Qjwb5bizJnA=";
+      rev = "277e04fad21e3af05a55cc414757b09a704f2a92";
+      hash = "sha256-Yd64QLzeKWcfJEWkvr9944aKPkgNmlsN/OpARVFRBes=";
     };
     meta.homepage = "https://codeberg.org/andyg/leap.nvim/";
     meta.license = unfree;
@@ -10714,12 +10729,12 @@ final: prev: {
 
   modus-themes-nvim = buildVimPlugin {
     pname = "modus-themes.nvim";
-    version = "1.4.4";
+    version = "1.6.0";
     src = fetchFromGitHub {
       owner = "miikanissi";
       repo = "modus-themes.nvim";
-      tag = "v1.4.4";
-      hash = "sha256-j10BCRHN6cTDx1+zBxgo6drtA9XoZAqaZg+1uTDQH4M=";
+      tag = "v1.6.0";
+      hash = "sha256-/HWmToZL9HnAYCjVNfpIu5IX21O+nuCzweqbah8pA/A=";
     };
     meta.homepage = "https://github.com/miikanissi/modus-themes.nvim/";
     meta.license = getLicenseFromSpdxId "GPL-3.0-only";
@@ -11218,12 +11233,12 @@ final: prev: {
 
   neoconf-nvim = buildVimPlugin {
     pname = "neoconf.nvim";
-    version = "1.4.0-unstable-2026-09-24";
+    version = "1.4.0-unstable-2026-09-28";
     src = fetchFromGitHub {
       owner = "folke";
       repo = "neoconf.nvim";
-      rev = "03fad132dfb3f8a61b55b4731ee62d6fa7db9f2f";
-      hash = "sha256-JVprbeJUCAIXMw8vS5CW5qz0jR2DL5G/Fc9nYEfdUcM=";
+      rev = "4b39a6d9f2d3d481225eedcf85d04506e2cb997e";
+      hash = "sha256-iTBInA4dtl6aMioAxY2paZqV97jPYyi8hXX1N7SVkYY=";
     };
     meta.homepage = "https://github.com/folke/neoconf.nvim/";
     meta.license = getLicenseFromSpdxId "Apache-2.0";
@@ -11302,12 +11317,12 @@ final: prev: {
 
   neogit = buildVimPlugin {
     pname = "neogit";
-    version = "3.0.0-unstable-2026-08-22";
+    version = "3.0.0-unstable-2026-09-28";
     src = fetchFromGitHub {
       owner = "NeogitOrg";
       repo = "neogit";
-      rev = "5adc81b26232954cd7a90f158aa7844c18fc3165";
-      hash = "sha256-s0yrtTweFrrUsxVjLjr+1uNHTlhcxGI7JUvOkrpt13g=";
+      rev = "c51a1dc7e0e0f40c4c396a2b1ceaa44b44e96032";
+      hash = "sha256-ZAchwF5J+ftB5pk2Z+gBaNpNWMmT6wh/cf+z51vO6g0=";
     };
     meta.homepage = "https://github.com/NeogitOrg/neogit/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -12102,12 +12117,12 @@ final: prev: {
 
   nfnl = buildVimPlugin {
     pname = "nfnl";
-    version = "1.4.0-unstable-2026-08-14";
+    version = "1.4.0-unstable-2026-09-25";
     src = fetchFromGitHub {
       owner = "Olical";
       repo = "nfnl";
-      rev = "a4c47a1e7e52aaf234b358f73135acf783054e35";
-      hash = "sha256-AVxppifATGlZqtyOTuD6Ral4DcvVisbu1MAjdMlaExs=";
+      rev = "abf41f588ee6e3612816ec70402a4b182ddbbd51";
+      hash = "sha256-kx2Gto4x5fvEEhJ/oRcyJxDzePyAe4mH0zGXu0Qbd6M=";
     };
     meta.homepage = "https://github.com/Olical/nfnl/";
     meta.license = getLicenseFromSpdxId "Unlicense";
@@ -12283,12 +12298,12 @@ final: prev: {
 
   no-neck-pain-nvim = buildVimPlugin {
     pname = "no-neck-pain.nvim";
-    version = "3.0.1";
+    version = "3.0.4";
     src = fetchFromGitHub {
       owner = "shortcuts";
       repo = "no-neck-pain.nvim";
-      tag = "v3.0.1";
-      hash = "sha256-RUCBdraqR1M9iYIXR8Rwp/9jj2gSPSzucAUJi5aYEUU=";
+      tag = "v3.0.4";
+      hash = "sha256-QR4gLwkv1/DLxhoOGiqXfAzeRrjNQDioUaKrGPy5ffY=";
     };
     meta.homepage = "https://github.com/shortcuts/no-neck-pain.nvim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -12437,12 +12452,12 @@ final: prev: {
 
   numb-nvim = buildVimPlugin {
     pname = "numb.nvim";
-    version = "1.2.1";
+    version = "1.3.0";
     src = fetchFromGitHub {
       owner = "nacro90";
       repo = "numb.nvim";
-      tag = "v1.2.1";
-      hash = "sha256-HlMAZhrM+HnMDwBqXhEjD26y0hkWq6orNDDuUMO0KGM=";
+      tag = "v1.3.0";
+      hash = "sha256-+3QZ4rjkDKdOGd1ck4U4oe4vHq2HTQyS7uuiqIlrrsA=";
     };
     meta.homepage = "https://github.com/nacro90/numb.nvim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -13327,12 +13342,12 @@ final: prev: {
 
   nvim-lsp-file-operations = buildVimPlugin {
     pname = "nvim-lsp-file-operations";
-    version = "1.0.0";
+    version = "1.1.0";
     src = fetchFromGitHub {
       owner = "antosha417";
       repo = "nvim-lsp-file-operations";
-      tag = "v1.0.0";
-      hash = "sha256-FObv42EGkIao2Rmq9CG+G4JsntO+00CFNaNIXc7IK7A=";
+      tag = "v1.1.0";
+      hash = "sha256-8wEIGdxMvnlXhQcqKBl0AwINGzfJr5DiLwaOggrQBR8=";
     };
     meta.homepage = "https://github.com/antosha417/nvim-lsp-file-operations/";
     meta.license = getLicenseFromSpdxId "Apache-2.0";
@@ -13971,12 +13986,12 @@ final: prev: {
 
   nvim-treesitter = buildVimPlugin {
     pname = "nvim-treesitter";
-    version = "0.10.0-unstable-2026-09-19";
+    version = "0.10.0-unstable-2026-09-27";
     src = fetchFromGitHub {
       owner = "nvim-treesitter";
       repo = "nvim-treesitter";
-      rev = "f603a2f4da48728f80257fb5fbb90145fd1dc173";
-      hash = "sha256-fXBJhWvjzBGivIiAys9oy2JB9h99CNIk+AdGkGgHgPg=";
+      rev = "728e031f6b11d03d1f0708b7dc4fb0f1d9c8a137";
+      hash = "sha256-z6e3Dvp8TQDjTRglfVq0B+7Ejozwnw/zSvpGuSy6rbY=";
     };
     meta.homepage = "https://github.com/nvim-treesitter/nvim-treesitter/";
     meta.license = getLicenseFromSpdxId "Apache-2.0";
@@ -14377,12 +14392,12 @@ final: prev: {
 
   obsidian-nvim = buildVimPlugin {
     pname = "obsidian.nvim";
-    version = "3.16.7";
+    version = "3.16.8";
     src = fetchFromGitHub {
       owner = "obsidian-nvim";
       repo = "obsidian.nvim";
-      tag = "v3.16.7";
-      hash = "sha256-aOq0cg86hHgK4M/D1YCCyPNVusmsifUtxfAT9avhu7w=";
+      tag = "v3.16.8";
+      hash = "sha256-VQBopv4Lwjie5KyGD/n16V5fKmfn/PPRNBhoQ9E8/vI=";
     };
     meta.homepage = "https://github.com/obsidian-nvim/obsidian.nvim/";
     meta.license = getLicenseFromSpdxId "Apache-2.0";
@@ -15807,12 +15822,12 @@ final: prev: {
 
   remember-nvim = buildVimPlugin {
     pname = "remember.nvim";
-    version = "1.5.1";
+    version = "1.5.2";
     src = fetchFromGitHub {
       owner = "vladdoster";
       repo = "remember.nvim";
-      tag = "v1.5.1";
-      hash = "sha256-kJABTjY6p+wFlNZ9VLmK5LvusHcbD/0aaZP6yOpR1Zc=";
+      tag = "v1.5.2";
+      hash = "sha256-qZnSzOr6ImGZ6uiV4GQCQGUPsSxYHdjHlAlAjMz83sE=";
     };
     meta.homepage = "https://github.com/vladdoster/remember.nvim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -16071,20 +16086,6 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
-  rust-tools-nvim = buildVimPlugin {
-    pname = "rust-tools.nvim";
-    version = "0-unstable-2024-01-03";
-    src = fetchFromGitHub {
-      owner = "simrat39";
-      repo = "rust-tools.nvim";
-      rev = "676187908a1ce35ffcd727c654ed68d851299d3e";
-      hash = "sha256-kFane5ze7VDiOzF7jdmXkr50XQsNvdb+a9HQtybEVE0=";
-    };
-    meta.homepage = "https://github.com/simrat39/rust-tools.nvim/";
-    meta.license = getLicenseFromSpdxId "MIT";
-    meta.hydraPlatforms = [ ];
-  };
-
   rust-vim = buildVimPlugin {
     pname = "rust.vim";
     version = "0-unstable-2022-11-27";
@@ -16564,12 +16565,12 @@ final: prev: {
 
   smear-cursor-nvim = buildVimPlugin {
     pname = "smear-cursor.nvim";
-    version = "0.6.1";
+    version = "0.6.2";
     src = fetchFromGitHub {
       owner = "sphamba";
       repo = "smear-cursor.nvim";
-      tag = "v0.6.1";
-      hash = "sha256-OVdgXkaj498iejXDuX00E9aAKCJuqb45oTUQh0+UOfU=";
+      tag = "v0.6.2";
+      hash = "sha256-PI83Zvgx90Fvd52Ng1pmB1kL7SGIkq7R/T1awCUqKdY=";
     };
     meta.homepage = "https://github.com/sphamba/smear-cursor.nvim/";
     meta.license = getLicenseFromSpdxId "GPL-3.0-only";
@@ -20857,12 +20858,12 @@ final: prev: {
 
   vim-emoji = buildVimPlugin {
     pname = "vim-emoji";
-    version = "0-unstable-2018-01-30";
+    version = "0-unstable-2026-09-26";
     src = fetchFromGitHub {
       owner = "junegunn";
       repo = "vim-emoji";
-      rev = "9ed6515401a6e20a9781ba508db7d67a5e4e231f";
-      hash = "sha256-3gdd2lFAMKJTqV9IV3CL7809RLkITa0Wi91dcMqvfC8=";
+      rev = "72c8bc4fe1a3a27e7a488a897b141599a6a7f385";
+      hash = "sha256-AMgSBJXk2PfRFoLH93Cpi73FzpMF7A7lTfDsQRToJtE=";
     };
     meta.homepage = "https://github.com/junegunn/vim-emoji/";
     meta.license = unfree;
@@ -24330,12 +24331,12 @@ final: prev: {
 
   vim-spirv = buildVimPlugin {
     pname = "vim-spirv";
-    version = "0.5.2-unstable-2026-09-19";
+    version = "0.5.2-unstable-2026-09-25";
     src = fetchFromGitHub {
       owner = "kbenzie";
       repo = "vim-spirv";
-      rev = "5b199dcd521795cf78f50574e8f5ec3b8bcc6c10";
-      hash = "sha256-9kdpolFI57NFcuHiX5FJvspDsUylO0YtXDewYPSsCCI=";
+      rev = "8543d5adb87eb173ec2dee6bb1ad6dbb011741c4";
+      hash = "sha256-AExOpjZ+aoGl8RxR+2mlPKjLJtpyKH8MrL1KIviMD1s=";
     };
     meta.homepage = "https://github.com/kbenzie/vim-spirv/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -26235,12 +26236,12 @@ final: prev: {
 
   yazi-nvim = buildVimPlugin {
     pname = "yazi.nvim";
-    version = "14.0.0";
+    version = "14.0.2";
     src = fetchFromGitHub {
       owner = "mikavilpas";
       repo = "yazi.nvim";
-      tag = "v14.0.0";
-      hash = "sha256-aCFCtSu7qD0HhNLS9o/W7vsh3EimQy6QcMtdXLPa5Zc=";
+      tag = "v14.0.2";
+      hash = "sha256-f+ymPNSEBkloZzgnpn6Zq3jkmuhzH8jPrGZB8tfxs78=";
       fetchSubmodules = true;
     };
     meta.homepage = "https://github.com/mikavilpas/yazi.nvim/";

pkgs/applications/editors/vim/plugins/non-generated/macaulay2/default.nix

@@ -0,0 +1,47 @@
+{
+  fetchFromGitHub,
+  lib,
+  vimUtils,
+  writableTmpDirAsHomeHook,
+  macaulay2,
+}:
+vimUtils.buildVimPlugin {
+  pname = "macaulay2";
+  inherit (macaulay2) version;
+
+  # we don't need the whole (rather large) repo
+  src = fetchFromGitHub {
+    inherit (macaulay2.src) repo owner tag;
+    rootDir = "M2/Macaulay2/editors/vim";
+    hash = "sha256-F/Vo8tOA/ZRczZJiUHY0Sr3ibRXHBLtqqSYIamqjk18=";
+  };
+
+  postPatch = ''
+    substituteInPlace "ftplugin/m2.vim" \
+      --replace-fail "'M2'" "'${lib.getExe macaulay2}'"
+  '';
+
+  nativeBuildInputs = [
+    writableTmpDirAsHomeHook
+  ];
+
+  buildPhase = ''
+    ${lib.getExe macaulay2} <<EOF
+      needsPackage "Style"
+      generateGrammar("dict/m2.vim.dict", demark_" ")
+      generateGrammar("syntax/m2.vim", demark_" ")
+    EOF
+  '';
+
+  meta = {
+    inherit (macaulay2.meta) maintainers platforms;
+    description = "Syntax highlighting and key mappings to send code to a running Macaulay2 session.";
+    homepage = "https://github.com/Macaulay2/M2/tree/stable/M2/Macaulay2/editors/vim";
+    license =
+      with lib.licenses;
+      OR [
+        publicDomain
+        gpl2Plus
+      ];
+  };
+}

pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix

@@ -786,12 +786,12 @@
     };
     fidl = buildGrammar {
       language = "fidl";
-      version = "0.0.0+rev=0a8910f";
+      version = "0.0.0+rev=3faeeae";
       src = fetchFromGitHub {
         owner = "google";
         repo = "tree-sitter-fidl";
-        rev = "0a8910f293268e27ff554357c229ba172b0eaed2";
-        hash = "sha256-QFAkxQo2w/+OR7nZn9ldBk2yHOd23kzciAcQvIZ5hrY=";
+        rev = "3faeeae0dbe66b54be0086daa0e0af4da44e7d68";
+        hash = "sha256-G2a0NGfMnY4e8WbH7QIiX4kaZ7G2Plzt2KO0HXf6vcQ=";
       };
       meta.homepage = "https://github.com/google/tree-sitter-fidl";
     };
@@ -1725,12 +1725,12 @@
     };
     ledger = buildGrammar {
       language = "ledger";
-      version = "0.0.0+rev=22a1ab8";
+      version = "0.0.0+rev=d5f3973";
       src = fetchFromGitHub {
         owner = "cbarrete";
         repo = "tree-sitter-ledger";
-        rev = "22a1ab8195c1f6e808679f803007756fe7638c6f";
-        hash = "sha256-62xgcEavI5RKi77sbEnx9f3hA4faFeUCw0/uec8Nx3k=";
+        rev = "d5f3973cfe2d42f98819336ce6334ada75b7696f";
+        hash = "sha256-+BgSLNGbtRsQZkw4gBe2K2pcGynDDv8bh9upN3lDPAg=";
       };
       meta.homepage = "https://github.com/cbarrete/tree-sitter-ledger";
     };
@@ -1769,12 +1769,12 @@
     };
     liquidsoap = buildGrammar {
       language = "liquidsoap";
-      version = "0.0.0+rev=301f669";
+      version = "0.0.0+rev=a094345";
       src = fetchFromGitHub {
         owner = "savonet";
         repo = "tree-sitter-liquidsoap";
-        rev = "301f66950622949f630fef9fa758ba69f66cf97a";
-        hash = "sha256-BPRaHi/TqU7s/XsrVz9+1aSfelmesOKr98ynELBgWM0=";
+        rev = "a094345ace46277b23dbcb81a5d8cd972df32183";
+        hash = "sha256-MtLdRTujZ/LOUkzcitgS0k8gIh08E14mWNFSFL61e/w=";
       };
       meta.homepage = "https://github.com/savonet/tree-sitter-liquidsoap";
     };
@@ -1931,12 +1931,12 @@
     };
     mlir = buildGrammar {
       language = "mlir";
-      version = "0.0.0+rev=eb0541b";
+      version = "0.0.0+rev=d93ac1b";
       src = fetchFromGitHub {
         owner = "artagnon";
         repo = "tree-sitter-mlir";
-        rev = "eb0541bba21c4ebb3661f02332d1f087d72dbc7c";
-        hash = "sha256-QQeii7jaaM0CtrFau50zMFkTsAxI4LhZRinvFYuy1ew=";
+        rev = "d93ac1b150580040d16e183ea8bf9daa7841bcc4";
+        hash = "sha256-yN+NJ1ZuoLKQHN/E9m59Ltv5BPqutxDFe2ZcJjVRwHE=";
       };
       generate = true;
       meta.homepage = "https://github.com/artagnon/tree-sitter-mlir";
@@ -2012,12 +2012,12 @@
     };
     nix = buildGrammar {
       language = "nix";
-      version = "0.0.0+rev=17f290c";
+      version = "0.0.0+rev=a2cd7f4";
       src = fetchFromGitHub {
         owner = "nix-community";
         repo = "tree-sitter-nix";
-        rev = "17f290c8b5104d9aba8a1ba7383a2ca83c3d14c4";
-        hash = "sha256-yWbf/Ms5y3x7qhpu2aGjX0R76Rzg3UH3nehHft2K87w=";
+        rev = "a2cd7f4011c6e5830c0c9af5aa35441b3ddd5fba";
+        hash = "sha256-IOanyzxBlLzlCOmLQa7hn+n1Yyc30upbmeuth7M4VcA=";
       };
       meta.homepage = "https://github.com/nix-community/tree-sitter-nix";
     };
@@ -2070,24 +2070,24 @@
     };
     ocaml = buildGrammar {
       language = "ocaml";
-      version = "0.0.0+rev=e3c9cf3";
+      version = "0.0.0+rev=3b2e14e";
       src = fetchFromGitHub {
         owner = "tree-sitter";
         repo = "tree-sitter-ocaml";
-        rev = "e3c9cf368f68bffd2f81188229aefa7b434eda65";
-        hash = "sha256-l2MTyECFscDh79fcCrz7WrJFok9WrXI2LgL+1Sc/pwk=";
+        rev = "3b2e14e0697d405c9aa0beddfa09b71f45abc504";
+        hash = "sha256-LCo26uRKZk0vnvkqXBpH1RofJXf16YfqMaBe0bfxyBY=";
       };
       location = "grammars/ocaml";
       meta.homepage = "https://github.com/tree-sitter/tree-sitter-ocaml";
     };
     ocaml_interface = buildGrammar {
       language = "ocaml_interface";
-      version = "0.0.0+rev=e3c9cf3";
+      version = "0.0.0+rev=3b2e14e";
       src = fetchFromGitHub {
         owner = "tree-sitter";
         repo = "tree-sitter-ocaml";
-        rev = "e3c9cf368f68bffd2f81188229aefa7b434eda65";
-        hash = "sha256-l2MTyECFscDh79fcCrz7WrJFok9WrXI2LgL+1Sc/pwk=";
+        rev = "3b2e14e0697d405c9aa0beddfa09b71f45abc504";
+        hash = "sha256-LCo26uRKZk0vnvkqXBpH1RofJXf16YfqMaBe0bfxyBY=";
       };
       location = "grammars/interface";
       passthru.requires = [
@@ -2097,12 +2097,12 @@
     };
     ocamllex = buildGrammar {
       language = "ocamllex";
-      version = "0.0.0+rev=33722b8";
+      version = "0.0.0+rev=64d543e";
       src = fetchFromGitHub {
         owner = "atom-ocaml";
         repo = "tree-sitter-ocamllex";
-        rev = "33722b8be73079946a7c6dd9598e3f57956ed36d";
-        hash = "sha256-mqp/qHr1zWMJinlMJ0HNAKuFUQ4NqQiLzKx0DoN4wGI=";
+        rev = "64d543e98b4092e2efe5d0c93d78ff4db9cbff39";
+        hash = "sha256-11fcvNtvz06HpkCe+Y37y8LhSgta9O5LSIB0sMKzOZg=";
       };
       generate = true;
       meta.homepage = "https://github.com/atom-ocaml/tree-sitter-ocamllex";
@@ -2165,12 +2165,12 @@
     };
     php = buildGrammar {
       language = "php";
-      version = "0.0.0+rev=3fda2fb";
+      version = "0.0.0+rev=92b5271";
       src = fetchFromGitHub {
         owner = "tree-sitter";
         repo = "tree-sitter-php";
-        rev = "3fda2fb9577166c6399834917f9844f30370beea";
-        hash = "sha256-JnDMQx4S3Z/BMuxa9Trv2pV9QQzpUoVLHzAGppuqbN4=";
+        rev = "92b5271b60bec77fb65b5e5bc41561e8dac81299";
+        hash = "sha256-EkKYb9jatSl0/o+7tO2O3vx44ufDmZ4YJ/6t4il/Yk0=";
       };
       location = "php";
       passthru.requires = [
@@ -2180,12 +2180,12 @@
     };
     php_only = buildGrammar {
       language = "php_only";
-      version = "0.0.0+rev=3fda2fb";
+      version = "0.0.0+rev=92b5271";
       src = fetchFromGitHub {
         owner = "tree-sitter";
         repo = "tree-sitter-php";
-        rev = "3fda2fb9577166c6399834917f9844f30370beea";
-        hash = "sha256-JnDMQx4S3Z/BMuxa9Trv2pV9QQzpUoVLHzAGppuqbN4=";
+        rev = "92b5271b60bec77fb65b5e5bc41561e8dac81299";
+        hash = "sha256-EkKYb9jatSl0/o+7tO2O3vx44ufDmZ4YJ/6t4il/Yk0=";
       };
       location = "php_only";
       meta.homepage = "https://github.com/tree-sitter/tree-sitter-php";
@@ -2214,12 +2214,12 @@
     };
     pkl = buildGrammar {
       language = "pkl";
-      version = "0.0.0+rev=9eaf196";
+      version = "0.0.0+rev=c95d828";
       src = fetchFromGitHub {
         owner = "apple";
         repo = "tree-sitter-pkl";
-        rev = "9eaf196bb1cb9ce862036ed28b188ab6664a2492";
-        hash = "sha256-BG7BLzUOepbhkCI30iCwpw126R7upNDX3wDWp+dvtvs=";
+        rev = "c95d8284940f5e1da2cd0d8f1ee45d7ef9ef75d1";
+        hash = "sha256-dnGqTZ7Kga1sIJkzRSbqkhvIrPJMxOEhHnDKJuLyudM=";
       };
       meta.homepage = "https://github.com/apple/tree-sitter-pkl";
     };
@@ -2325,12 +2325,12 @@
     };
     proto = buildGrammar {
       language = "proto";
-      version = "0.0.0+rev=6c878d1";
+      version = "0.0.0+rev=be5691c";
       src = fetchFromGitHub {
         owner = "coder3101";
         repo = "tree-sitter-proto";
-        rev = "6c878d18628ebbff3474479d2fdd6d8ba1954c3e";
-        hash = "sha256-N7GpIolkFkmVs1wLtx22HZ1+CmeXDSI2J1FmohtnY7M=";
+        rev = "be5691cf82ca284f83e68b9c8cdc4cac5d7fa208";
+        hash = "sha256-AdaEJPzekM5olFNrwqQXXnE1jvI/U2/zDgN8dyZbtnY=";
       };
       meta.homepage = "https://github.com/coder3101/tree-sitter-proto";
     };
@@ -2582,12 +2582,12 @@
     };
     rescript = buildGrammar {
       language = "rescript";
-      version = "0.0.0+rev=19ed8a8";
+      version = "0.0.0+rev=90643a6";
       src = fetchFromGitHub {
         owner = "rescript-lang";
         repo = "tree-sitter-rescript";
-        rev = "19ed8a8e6bcc844b71c37e9edaffc60c77f74d7c";
-        hash = "sha256-mQJSmb9Qy5pFS+nNz4+C7RPs1mpAoxxqbx7seYo8+JI=";
+        rev = "90643a6302057b969c51e1bf235b8ecf1da49232";
+        hash = "sha256-k510+GOLhputcgoo3l8JyoaI9IAtDw+aEKoPjMjRyWI=";
       };
       meta.homepage = "https://github.com/rescript-lang/tree-sitter-rescript";
     };
@@ -2725,12 +2725,12 @@
     };
     scheme = buildGrammar {
       language = "scheme";
-      version = "0.0.0+rev=c6cb7c7";
+      version = "0.0.0+rev=1b112d9";
       src = fetchFromGitHub {
         owner = "6cdh";
         repo = "tree-sitter-scheme";
-        rev = "c6cb7c7d7a04b3f5d999c28e2e9c0c31b2d50ece";
-        hash = "sha256-aFonUd15PJkQmz5lDJthtd1rU+8OXNknHDlgqH2s+OA=";
+        rev = "1b112d9571e4f62fb3d095d52a51f1da7756fb94";
+        hash = "sha256-7bMxrSeJpIIYkD8brP6oIW2F9ePYRsx1l2ZRfx6yGwM=";
       };
       meta.homepage = "https://github.com/6cdh/tree-sitter-scheme";
     };
@@ -2984,12 +2984,12 @@
     };
     superhtml = buildGrammar {
       language = "superhtml";
-      version = "0.0.0+rev=23ef2f4";
+      version = "0.0.0+rev=f0deee8";
       src = fetchFromGitHub {
         owner = "kristoff-it";
         repo = "superhtml";
-        rev = "23ef2f44ca0df2d2e05a0be3874370553c5b591d";
-        hash = "sha256-+M8eRsadeIQmW3pWTZ5WprJ1glQ18Pu8AgOeLvrLagY=";
+        rev = "f0deee80ae422938d5cdc43a5598c417670db38b";
+        hash = "sha256-xeM7uPqGVVuAHHwA94TOKrwpLbBH0Ruy2XnZsb35K54=";
       };
       location = "tree-sitter-superhtml";
       meta.homepage = "https://github.com/kristoff-it/superhtml";
@@ -3029,12 +3029,12 @@
     };
     swift = buildGrammar {
       language = "swift";
-      version = "0.0.0+rev=00bbb0a";
+      version = "0.0.0+rev=187fd4d";
       src = fetchFromGitHub {
         owner = "alex-pinkus";
         repo = "tree-sitter-swift";
-        rev = "00bbb0a2550f8bc0023a2a4992922d51ae045626";
-        hash = "sha256-1HZ6LNvBWUntNONR1aNxbN8zHsnLQisgh+k2Fp/XpXk=";
+        rev = "187fd4d3e55e2088da9cb31e414a2bac866292e8";
+        hash = "sha256-Qzl3rs1dOokT4gU14uaXCBG7RFgieoFWu24pEh8gPfU=";
       };
       generate = true;
       meta.homepage = "https://github.com/alex-pinkus/tree-sitter-swift";
@@ -3141,12 +3141,12 @@
     };
     tera = buildGrammar {
       language = "tera";
-      version = "0.0.0+rev=3a38c36";
+      version = "0.0.0+rev=54b3f8b";
       src = fetchFromGitHub {
         owner = "uncenter";
         repo = "tree-sitter-tera";
-        rev = "3a38c368e806268daac9923a27e72bcafbbc16bb";
-        hash = "sha256-JyH5iBaqW+qylqkZEN+JmG3NkMc5NKGwHp/xJ3NRR2Y=";
+        rev = "54b3f8b43aecdbcf12a7366920f0bc8274af1dd0";
+        hash = "sha256-lFNfLFLoRQwxzRfvnWaGSa1aUOgyIJcRBPkN60pZ8Kg=";
       };
       meta.homepage = "https://github.com/uncenter/tree-sitter-tera";
     };

pkgs/applications/editors/vim/plugins/overrides.nix

@@ -4144,10 +4144,6 @@ assertNoAdditions {
     };
   });
 
-  rust-tools-nvim = super.rust-tools-nvim.overrideAttrs {
-    dependencies = [ self.nvim-lspconfig ];
-  };
-
   rustaceanvim = super.rustaceanvim.overrideAttrs {
     checkInputs = [
       # Optional integration

pkgs/applications/editors/vim/plugins/utils/build-vim-plugin.nix

@@ -38,15 +38,16 @@
             postInstall
             ;
 
-          installPhase = ''
-            runHook preInstall
+          installPhase =
+            attrs.installPhase or ''
+              runHook preInstall
 
-            target=$out/${rtpPath}/${path}
-            mkdir -p $out/${rtpPath}
-            cp -r . $target
+              target=$out/${rtpPath}/${path}
+              mkdir -p $out/${rtpPath}
+              ${lib.optionalString (!(attrs.dontUnpack or false)) "cp -r . $target"}
 
-            runHook postInstall
-          '';
+              runHook postInstall
+            '';
 
           meta = {
             platforms = lib.platforms.all;

pkgs/applications/editors/vim/plugins/vim-plugin-names

@@ -379,6 +379,7 @@ https://github.com/barrettruth/diffs.nvim/,,
 https://github.com/dlyongemallo/diffview-plus.nvim/,,
 https://github.com/sindrets/diffview.nvim/,,
 https://github.com/elihunter173/dirbuf.nvim/,,
+https://github.com/NotAShelf/direnv.nvim/,,
 https://github.com/direnv/direnv.vim/,,
 https://github.com/chipsenkbeil/distant.nvim/,,
 https://github.com/doki-theme/doki-theme-vim/,,
@@ -592,7 +593,7 @@ https://github.com/HiPhish/jinja.vim/,,
 https://github.com/NicolasGB/jj.nvim/,,
 https://github.com/vito-c/jq.vim/,,
 https://github.com/neoclide/jsonc.vim/,,
-https://git.myzel394.app/Myzel394/jsonfly.nvim,,
+https://github.com/Myzel394/jsonfly.nvim/,,
 https://github.com/yannvanhalewyn/jujutsu.nvim/,,
 https://github.com/julelang/jule.nvim/,,
 https://github.com/JuliaEditorSupport/julia-vim/,,
@@ -1146,7 +1147,6 @@ https://github.com/keith/rspec.vim/,,
 https://github.com/ccarpita/rtorrent-syntax-file/,,
 https://codeberg.org/ssnoer/run.nvim,,
 https://github.com/TheLazyCat00/runner-nvim/,,
-https://github.com/simrat39/rust-tools.nvim/,,
 https://github.com/rust-lang/rust.vim/,,
 https://github.com/tris203/rzls.nvim/,,
 https://github.com/hauleth/sad.vim/,,

pkgs/applications/editors/vscode/extensions/default.nix

@@ -1776,8 +1776,8 @@ let
         mktplcRef = {
           name = "vscode-jest-runner";
           publisher = "firsttris";
-          version = "0.4.148";
-          hash = "sha256-bqyi1uk4Y1PMOjVv+io3WxJMrJb7UKy368xt6TiySPg=";
+          version = "0.4.149";
+          hash = "sha256-bGDU3/5Pysagt8aoEJJH6VVvR4Oy8IU12AmaAvnKnY8=";
         };
         meta = {
           description = "Simple way to run or debug a single (or multiple) tests from context-menu";
@@ -2047,8 +2047,8 @@ let
         mktplcRef = {
           name = "gitlab-workflow";
           publisher = "gitlab";
-          version = "6.90.3";
-          hash = "sha256-/6R/3FUXuvy836YeZSbw6HMrrIXdPbKqdNFBl4z36Y0=";
+          version = "6.92.0";
+          hash = "sha256-DR0g4aHAWePu46IHNPvxrFDBHoYmHMmiEm4z4AvB4mQ=";
         };
         meta = {
           description = "GitLab extension for Visual Studio Code";

pkgs/applications/editors/vscode/extensions/nomicfoundation.hardhat-solidity/default.nix

@@ -4,8 +4,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "hardhat-solidity";
     publisher = "nomicfoundation";
-    version = "0.9.1";
-    hash = "sha256-PlqYeUe6qbyP/ec2EwxG8Uxg6wmJhayUzt4HpInpLAg=";
+    version = "0.9.2";
+    hash = "sha256-iaTVu2IVPfprOf44OAhwFla5k6+WSYMFlagKkZCMhDw=";
   };
 
   meta = {

pkgs/applications/networking/browsers/chromium/info.json

@@ -1,10 +1,10 @@
 {
   "chromium": {
-    "version": "154.0.8037.57",
+    "version": "154.0.8037.92",
     "chromedriver": {
-      "version": "154.0.8037.58",
-      "hash_darwin": "sha256-oMomlVZiLv+QQGHNq0Ao5tq++wCt1wAQmmddj0ARUKU=",
-      "hash_darwin_aarch64": "sha256-9Yy5BKjSdTr44fZp15lHPgXV9nMynXjF6Srw6CoAlAY="
+      "version": "154.0.8037.93",
+      "hash_darwin": "sha256-98b3h7D4+HHaZ7sLsr8v4Uv0xc3TqJLI2DWd8jchMCY=",
+      "hash_darwin_aarch64": "sha256-RVAlxmcKbxi7VPYXOwJlup3CLwLE/YPpISWDlaYQdPI="
     },
     "deps": {
       "depot_tools": {
@@ -21,8 +21,8 @@
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "73c14f6228d7cd537c855007e8f88678969cc0eb",
-        "hash": "sha256-LqS0Up2B1g7YWGx9N85hwMDQ2SktPjvxlJDfo8gxFOg=",
+        "rev": "334b65d254ccc35df4fca82706d1753227b01039",
+        "hash": "sha256-UtjuCxGPAHukLFqtwvyW7QRlOah4N1xJ5bHAT1hYUVA=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {
@@ -92,8 +92,8 @@
       },
       "src/third_party/angle": {
         "url": "https://chromium.googlesource.com/angle/angle.git",
-        "rev": "1ff8799c596d4fc9acea28343610b1f33650a6fa",
-        "hash": "sha256-aNsNXGV9V3tE9Xj0eb80EdPGi4gYJzmgQk3BIo/wxmY="
+        "rev": "802a8704ca940b633b731493ee192e0661eb8cdd",
+        "hash": "sha256-HqMu7GkWXTyIj/a4SY6f8x1wS/ficMQYyI/g0zuTlvM="
       },
       "src/third_party/angle/third_party/glmark2/src": {
         "url": "https://chromium.googlesource.com/external/github.com/glmark2/glmark2",
@@ -132,8 +132,8 @@
       },
       "src/third_party/dawn": {
         "url": "https://dawn.googlesource.com/dawn.git",
-        "rev": "8597a1aaec546a7f19e8e662a49ebf03b2e91308",
-        "hash": "sha256-zCY7dE1C2PGb2pQ/H6oNGjpSHUhhRTfTFkAgdJm3efE="
+        "rev": "38bc7fb0b3a024d05212958ae843e4ddf8c44ff1",
+        "hash": "sha256-l1naz112kynSTtFsE0LrpLSzvdGLxJJ19UMNfHvUkmw="
       },
       "src/third_party/dawn/third_party/glfw3/src": {
         "url": "https://chromium.googlesource.com/external/github.com/glfw/glfw",
@@ -847,8 +847,8 @@
       },
       "src/v8": {
         "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "671f7c27ac0403ceb8074a8dfbcc02cdd7369c3f",
-        "hash": "sha256-0eEMZgbwW5edL4as79OibOVQidQL5rWYcGSdpq7ZPQo="
+        "rev": "31fac3bef58c3def36b0760e4ddc54ec77099596",
+        "hash": "sha256-hJfc8TsOIGi9pBXwDcxLoaO6RxczIn9mwYJAQoGBnI0="
       },
       "src/agents/shared": {
         "url": "https://chromium.googlesource.com/chromium/agents.git",

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -218,13 +218,13 @@
     "vendorHash": "sha256-scHNFyHn4VYm8wtuBdVCpgKCzwPhzrC3KBs1YHXPwos="
   },
   "cloudflare_cloudflare": {
-    "hash": "sha256-F/Qkcu9XHxWrVbGVqWw2/AB1CDcY4hKm5cGDDtnsxP8=",
+    "hash": "sha256-cazO/sszoutiwMYjM709aHNzKIpOzZbB/5nHDEgbm08=",
     "homepage": "https://registry.terraform.io/providers/cloudflare/cloudflare",
     "owner": "cloudflare",
     "repo": "terraform-provider-cloudflare",
-    "rev": "v5.25.0",
+    "rev": "v5.26.0",
     "spdx": "Apache-2.0",
-    "vendorHash": "sha256-FGt4e+WyF5Wx3jw+U+L2kdybOnnAW/AA+mBeVbRQI0Y="
+    "vendorHash": "sha256-9blJRFzwwOcdFAB93C109qqXsh2tYft1bTOldvW0a/Y="
   },
   "cloudfoundry-community_cloudfoundry": {
     "hash": "sha256-1nYncJLVU/f9WD6Quh9IieIXgixPzbPk4zbtI1zmf9g=",
@@ -661,13 +661,13 @@
     "vendorHash": "sha256-STiMgzJWnWfUz2Y+O/6QfTxZ3hClHOa+guJer33dEDg="
   },
   "hashicorp_random": {
-    "hash": "sha256-Y5p9/H3g85AYr/FVWO6zLaeHIGo7iGvMV6eHTGO0ehI=",
+    "hash": "sha256-wfRgzuV4UbP1lonqRcCreCqVje1YBt8lwoysMGH2yYg=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/random",
     "owner": "hashicorp",
     "repo": "terraform-provider-random",
-    "rev": "v3.9.0",
+    "rev": "v3.9.1",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-CwTlb0QTq0lpZK90IL6mBLoarFYFLsjiLYauGEaR1Rk="
+    "vendorHash": "sha256-J6zLLrX7/kKrkf00W2hDUYKpNmbrRzrziqb6aFRcO38="
   },
   "hashicorp_tfe": {
     "hash": "sha256-gEzX7Q/8OMNb3jOf7E9bph6qactFdZHmITr1l/I9kSc=",
@@ -914,13 +914,13 @@
     "vendorHash": "sha256-8Zj4nrEJ38Tz0LOYtghlMnJZJnD2zJjsqawVMTEX0Wk="
   },
   "metio_migadu": {
-    "hash": "sha256-C5zx1uf5VKZN/CBbcFe+GOYpso2L/ocztEBsDEL53mA=",
+    "hash": "sha256-3RCE2KCWgS8j30Ggh0HfX0D9ZPpgiTtgIk7+YmzYSfc=",
     "homepage": "https://registry.terraform.io/providers/metio/migadu",
     "owner": "metio",
     "repo": "terraform-provider-migadu",
-    "rev": "2026.9.17",
+    "rev": "2026.9.24",
     "spdx": "0BSD",
-    "vendorHash": "sha256-wQPGzn9g0HUvelcQb7Ai29Zcoif6hNGOAK3sdzINPCU="
+    "vendorHash": "sha256-b2YIkwpeYCGsENzXSAPD7nhvmZ1Phxfcm3S5xsiC2t0="
   },
   "mongey_kafka": {
     "hash": "sha256-rTa6c7jAMH027V7h/yUGVGz6TS0PDdObilxU0Vpr6FI=",
@@ -1148,13 +1148,13 @@
     "vendorHash": "sha256-6M6jTrukO0VhyZRdYbbICm22upbGyOkUSuHqMLTPcEM="
   },
   "rootlyhq_rootly": {
-    "hash": "sha256-bn5QMl+9okXzkfZDOdbYPpMs5x0JDL22cwW6AXFkE5A=",
+    "hash": "sha256-sWCG6mD7fYi2Yon5Wu/54+m+T8KcUYd38yDt8M3LS+E=",
     "homepage": "https://registry.terraform.io/providers/rootlyhq/rootly",
     "owner": "rootlyhq",
     "repo": "terraform-provider-rootly",
-    "rev": "v5.21.1",
+    "rev": "v5.23.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-2zHDQyIQQm9ySpPSjobQXTXFopT4290b1O0y+lvVD88="
+    "vendorHash": "sha256-Lusa+8VL8wQGIHYMiuiNTy4tqza4zO1A4ROpZ7X42KM="
   },
   "rundeck_rundeck": {
     "hash": "sha256-g8unbz8+UGLiAOJju6E2bLkygvZgHkv173PdMDefmrc=",

pkgs/applications/office/libreoffice/default.nix

@@ -429,6 +429,46 @@ stdenv.mkDerivation (finalAttrs: {
     })
 
     ./fix-unpack-collabora.patch
+
+    # Add missing climits includes
+    (fetchpatch2 {
+      url = "https://github.com/LibreOffice/core/commit/6ebc3c540f2aa13363e3dcb32a44bfa2c7f66a9f.patch";
+      hash = "sha256-5GCosJryorH1P1Z2Zjey7oEC3seLHN5kH/ar4U7E74E=";
+    })
+    (fetchpatch2 {
+      url = "https://github.com/LibreOffice/core/commit/0084c2b22ce26084df5a379135ba8ac174585ac0.patch";
+      hash = "sha256-zssmbzfaZX2sBdHbzm+aIC8ncidp3eupQoUloeGdPcQ=";
+    })
+    (fetchpatch2 {
+      url = "https://github.com/LibreOffice/core/commit/19c32b44fead600118377417012b111a4f238766.patch";
+      hash = "sha256-jO7oFEfoL7V1dj67vwDAEp2BwjQvfva4zV8sVAAc+2g=";
+    })
+
+    # Add missing limits.h include
+    (fetchpatch2 {
+      url = "https://github.com/LibreOffice/core/commit/a6325b777b7bb9e1c760a4f1a02d48ba0889a7b1.patch";
+      hash = "sha256-QECBAdJ+4Q8c2kbdadNxzgDEebLvPy9cvRb34O7m5bA=";
+    })
+
+    # Add missing cstdint includes
+    (fetchpatch2 {
+      url = "https://github.com/LibreOffice/core/commit/47cabcb187dfbccb36ee02513998fbfcee509d5e.patch";
+      hash = "sha256-q883AMTtLzXwbwNRytCk6qiFA1snzba4JUsr7IaUEvI=";
+    })
+    (fetchpatch2 {
+      url = "https://github.com/LibreOffice/core/commit/0fede06b020fa0327877f4a8722290d48a742a2c.patch";
+      hash = "sha256-8w89mtZuFvpZU0GVZoWPZVBM+UlgnbTYxoDJ8Ss64Bo=";
+    })
+    (fetchpatch2 {
+      url = "https://github.com/LibreOffice/core/commit/aa9a194a99cec1dbcee9226b703fdcf9b62962d7.patch";
+      hash = "sha256-Eztv186ke97u0ucdd3jQmJaxtrxnsiWWE/qVOBc2uGc=";
+    })
+
+    # Add missing stdint.h include
+    (fetchpatch2 {
+      url = "https://github.com/LibreOffice/core/commit/d0265596672d78ad6f3980ff6fb900535aefd11f.patch";
+      hash = "sha256-tp7MW+8ExivGKKWjLy60lxWNf2hXF+jCD0pajo+YbVo=";
+    })
   ]
   ++ lib.optionals (lib.versionAtLeast version "26.8" && lib.versionOlder version "26.8.999") [
     ./26.8-add-dir-prereq.patch

pkgs/by-name/_1/_1password-cli/update.sh

@@ -6,7 +6,7 @@ set -eu
 ROOT="$(dirname "$(readlink -f "$0")")"
 NIX_DRV="$ROOT/package.nix"
 if [ ! -f "$NIX_DRV" ]; then
-  echo "ERROR: cannot find default.nix in $ROOT"
+  echo "ERROR: cannot find package.nix in $ROOT"
   exit 1
 fi
 

pkgs/by-name/aa/aarch64-esr-decoder/package.nix

@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "aarch64-esr-decoder";
-  version = "0.2.4";
+  version = "0.2.5";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "aarch64-esr-decoder";
     tag = finalAttrs.version;
-    hash = "sha256-ZpSrz7iwwzNrK+bFTMn5MPx4Zjceao9NKhjAyjuPLWY=";
+    hash = "sha256-DO/MS/Mt5KBFEEQt9BuJHF1J9UWqDJ3eWKzsw3X75jc=";
   };
 
-  cargoHash = "sha256-xOBJ8QYiWu5vmkRpttN2CXCXi4bNj+qph31hSkDadjI=";
+  cargoHash = "sha256-pbBIvenBe0+tt3VPuoTtFTDFy6yO5bju0FS2hXJtGZU=";
 
   meta = {
     description = "Utility for decoding aarch64 ESR register values";

pkgs/by-name/ac/acme-sh/package.nix

@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "acme.sh";
-  version = "3.1.5";
+  version = "3.1.6";
 
   src = fetchFromGitHub {
     owner = "acmesh-official";
     repo = "acme.sh";
     tag = finalAttrs.version;
-    hash = "sha256-wybDNQ0shmRPvYpBkMWZA0UQjh866+yFclqyMAlNeiE=";
+    hash = "sha256-x7V4yIFODVH2H9cjH3xMi4dFrQUKeRJBM+ckpmnvD+0=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ag/agentaps/package.nix

@@ -0,0 +1,89 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  fetchpatch,
+  git,
+  pkg-config,
+  makeWrapper,
+  versionCheckHook,
+  fontconfig,
+  freetype,
+  libGL,
+  libxcb,
+  libxkbcommon,
+  vulkan-loader,
+  wayland,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "agentaps";
+  version = "0.3.1";
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "domenkozar";
+    repo = "agentaps";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-pHESE5ML5zeDylz07t8k1jJop/IGyIhTTffPN4dWrY0=";
+  };
+
+  cargoHash = "sha256-ko+ytnpQGLIA41+aurIcY5Rp0Aemf7Z4PFC5GdLFLvw=";
+
+  patches = [
+    # Add --version support until the next release.
+    (fetchpatch {
+      url = "https://github.com/domenkozar/agentaps/commit/1665c2792929226d675d427e0eef42cd3ede7a71.patch";
+      hash = "sha256-+wL5G6Ln9uuWxt2fRW2QPbD54Zif51hGxcNAC3Q3f84=";
+      includes = [ "src/main.rs" ];
+    })
+  ];
+
+  nativeBuildInputs = [
+    makeWrapper
+    pkg-config
+  ];
+
+  buildInputs = [
+    fontconfig
+    freetype
+    libGL
+    libxcb
+    libxkbcommon
+    vulkan-loader
+    wayland
+  ];
+
+  nativeCheckInputs = [ git ];
+
+  # The login shell test requires /bin/sh and /usr/bin/env, which are absent in the sandbox.
+  checkFlags = [ "--skip=shell_env::tests::reads_path_from_a_login_shell" ];
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
+
+  postFixup = ''
+    wrapProgram "$out/bin/agentaps" \
+      --suffix LD_LIBRARY_PATH : "${
+        lib.makeLibraryPath [
+          libGL
+          libxcb
+          libxkbcommon
+          vulkan-loader
+          wayland
+        ]
+      }"
+  '';
+
+  meta = {
+    description = "Desktop client for Agent Client Protocol agents";
+    homepage = "https://github.com/domenkozar/agentaps";
+    changelog = "https://github.com/domenkozar/agentaps/blob/v${finalAttrs.version}/CHANGELOG.md";
+    license = lib.licenses.asl20;
+    mainProgram = "agentaps";
+    maintainers = with lib.maintainers; [ domenkozar ];
+    platforms = lib.platforms.linux;
+  };
+})

pkgs/by-name/ag/agentsploit/package.nix

@@ -63,6 +63,8 @@ python3Packages.buildPythonApplication (finalAttrs: {
 
   passthru.updateScript = nix-update-script { };
 
+  __darwinAllowLocalNetworking = true;
+
   meta = {
     description = "Offensive security framework for AI agents and MCP servers";
     homepage = "https://github.com/agentsploit/agentsploit";

pkgs/by-name/an/ansible-navigator/package.nix

@@ -8,13 +8,13 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "ansible-navigator";
-  version = "26.8.0";
+  version = "26.9.0";
   pyproject = true;
 
   src = fetchPypi {
     inherit (finalAttrs) version;
     pname = "ansible_navigator";
-    hash = "sha256-V5UyoCrLr4iZvDeFQUIcXSxTWP1G3TmCJUdhWQIpn+Q=";
+    hash = "sha256-MLzoipI+LPjNmFAC56ITwr1iUuxJYmDaYlMUaw2hi5Y=";
   };
 
   build-system = with python3Packages; [

pkgs/by-name/as/aseprite/package.nix

@@ -34,21 +34,21 @@
 
 clangStdenv.mkDerivation (finalAttrs: {
   pname = "aseprite";
-  version = "1.3.18.5";
+  version = "1.3.18.6";
 
   src = fetchFromGitHub {
     owner = "aseprite";
     repo = "aseprite";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-8BLbAX+wif4vJySv11/NGzGrwRIsK3tvKhpkX2Zoci0=";
+    hash = "sha256-oeTO93T/BQcM0PkrFVMw+kLDG6w3uT2798Kzgua4gsE=";
   };
 
   asepriteStrings = fetchFromGitHub {
     owner = "aseprite";
     repo = "strings";
-    rev = "b43be33343efa40c1c4bda00f985b8cd83bddf2a";
-    hash = "sha256-JxNEtWnP3RtntXM3CmJLXyByW6dri98COp2O0A6ZwBA=";
+    rev = "c6a218e3629ab5c0924682425091be6dec87f489";
+    hash = "sha256-JAKKxkWXJGchPYyr504vQs7QqF4c2Q7RYqFJ/AhOw9A=";
   };
 
   # Translation files are copied without overwriting existing ones to preserve

pkgs/by-name/at/atmos/package.nix

@@ -7,13 +7,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "atmos";
-  version = "1.229.0";
+  version = "1.230.0";
 
   src = fetchFromGitHub {
     owner = "cloudposse";
     repo = "atmos";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-N/IFSgMg1w1uH7p7TBahBpIHjSww0MZSEf5mt3r6DzQ=";
+    hash = "sha256-2iyRkQQ+NKER60jBiGrcq+QKBO8+pt3nfHm9Tn3e+iU=";
   };
 
   vendorHash = "sha256-J5TNPXzEz4gaNi2mEqkQ+t1JzmocbRRLwUwzLgAZU40=";

pkgs/by-name/au/audiobookshelf/client.nix

@@ -0,0 +1,23 @@
+{
+  src,
+  version,
+
+  buildNpmPackage,
+  nodejs,
+}:
+buildNpmPackage {
+  pname = "audiobookshelf-client";
+  inherit version nodejs;
+
+  src = "${src}/client";
+
+  npmDepsHash = "sha256-Rvy/bULWyVkGthfpIGkTMO8Lv1miywwea7jLODfm54Y=";
+
+  env = {
+    # don't download the Cypress binary
+    CYPRESS_INSTALL_BINARY = 0;
+    NODE_OPTIONS = "--openssl-legacy-provider";
+  };
+
+  npmBuildScript = "generate";
+}

pkgs/by-name/au/audiobookshelf/package.nix

@@ -2,51 +2,21 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  runCommand,
   buildNpmPackage,
-  nodejs_22,
+  callPackage,
+  nodejs_24,
   ffmpeg_8-full,
   nunicode,
   util-linux,
   python3,
   getopt,
   nixosTests,
+  nix-update-script,
 }:
 
 let
   ffmpeg-full = ffmpeg_8-full;
-
-  source = {
-    version = "2.36.1";
-    hash = "sha256-HBaTTfZEbhR2n/XafScZB/gX29erTQHZ+IdErwhA11A=";
-    npmDepsHash = "sha256-kp0LbSKaHTBppeyfLAFrGYnSWS3V2trO5yaZWoxVPo8=";
-    clientNpmDepsHash = "sha256-g3Y/4UU2YH/CeU8Z/NNkLP0OTeBM+4/rQfL406uVdio=";
-  };
-
-  src = fetchFromGitHub {
-    owner = "advplyr";
-    repo = "audiobookshelf";
-    tag = "v${source.version}";
-    inherit (source) hash;
-  };
-
-  client = buildNpmPackage {
-    pname = "audiobookshelf-client";
-    inherit (source) version;
-
-    nodejs = nodejs_22;
-
-    src = runCommand "cp-source" { } ''
-      cp -r ${src}/client $out
-    '';
-
-    # don't download the Cypress binary
-    CYPRESS_INSTALL_BINARY = 0;
-    NODE_OPTIONS = "--openssl-legacy-provider";
-
-    npmBuildScript = "generate";
-    npmDepsHash = source.clientNpmDepsHash;
-  };
+  nodejs = nodejs_24;
 
   wrapper = import ./wrapper.nix {
     inherit
@@ -56,14 +26,21 @@ let
       getopt
       ;
   };
-
 in
-buildNpmPackage {
+buildNpmPackage (finalAttrs: {
   pname = "audiobookshelf";
+  version = "2.37.1";
 
-  inherit src;
-  inherit (source) npmDepsHash version;
-  nodejs = nodejs_22;
+  src = fetchFromGitHub {
+    owner = "advplyr";
+    repo = "audiobookshelf";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-rTn64PrGPSKwDbsQmzvdSRa7UQEV1f2xXaYGtcVfrpk=";
+  };
+
+  npmDepsHash = "sha256-xHjZ3E1DGeb5NueP67hEX3vHH0Qlk4LTeZkMEFBhGyE=";
+
+  inherit nodejs;
 
   buildInputs = [ util-linux ];
   nativeBuildInputs = [ python3 ];
@@ -71,16 +48,18 @@ buildNpmPackage {
   dontNpmBuild = true;
   npmInstallFlags = [ "--only-production" ];
 
+  client = callPackage ./client.nix { inherit (finalAttrs) src version nodejs; };
+
   installPhase = ''
     runHook preInstall
 
     mkdir -p $out/opt/client
     cp -r index.js server package* node_modules $out/opt/
-    cp -r ${client}/lib/node_modules/audiobookshelf-client/dist $out/opt/client/dist
+    cp -r ${finalAttrs.client}/lib/node_modules/audiobookshelf-client/dist $out/opt/client/dist
     mkdir $out/bin
 
     echo '${wrapper}' > $out/bin/audiobookshelf
-    echo "  exec ${nodejs_22}/bin/node $out/opt/index.js" >> $out/bin/audiobookshelf
+    echo "  exec ${finalAttrs.nodejs}/bin/node $out/opt/index.js" >> $out/bin/audiobookshelf
 
     chmod +x $out/bin/audiobookshelf
 
@@ -89,13 +68,13 @@ buildNpmPackage {
 
   passthru = {
     tests.basic = nixosTests.audiobookshelf;
-    updateScript = ./update.sh;
+    updateScript = nix-update-script { extraArgs = [ "--subpackage=client" ]; };
   };
 
   meta = {
     homepage = "https://www.audiobookshelf.org/";
     description = "Self-hosted audiobook and podcast server";
-    changelog = "https://github.com/advplyr/audiobookshelf/releases/tag/v${source.version}";
+    changelog = "https://github.com/advplyr/audiobookshelf/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.gpl3;
     maintainers = with lib.maintainers; [
       jvanbruegge
@@ -105,4 +84,4 @@ buildNpmPackage {
     platforms = lib.platforms.linux;
     mainProgram = "audiobookshelf";
   };
-}
+})

pkgs/by-name/au/audiobookshelf/update.sh

@@ -1,42 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i bash -p curl gnused nix-prefetch-git common-updater-scripts jq prefetch-npm-deps ripgrep
-
-set -euo pipefail
-
-ROOT="$(dirname "$(readlink -f "$0")")"
-NIX_DRV="$ROOT/package.nix"
-if [ ! -f "$NIX_DRV" ]; then
-  echo "ERROR: cannot find package.nix in $ROOT"
-  exit 1
-fi
-
-REPO="advplyr/audiobookshelf"
-
-NEW_VER=$(list-git-tags --url=https://github.com/$REPO | rg 'v[0-9\.]*$' | sed -e 's/^v//' | sort -V | tail -n 1)
-OLD_VER=$(nix-instantiate --eval --raw -A audiobookshelf.version)
-
-if [ "$NEW_VER" == "$OLD_VER" ]; then
-  echo "No update needed."
-  exit 0
-fi
-
-replace_hash() {
-  sed -i "s#$1 = \"sha256-.\{44\}\"#$1 = \"$2\"#" "$NIX_DRV"
-}
-
-get_npm_hash() {
-  pushd "$(mktemp -d)" >/dev/null
-  curl -s "https://raw.githubusercontent.com/$REPO/v$NEW_VER/$1" -o package-lock.json
-  prefetch-npm-deps package-lock.json
-  rm -f package-lock.json
-  popd >/dev/null
-}
-
-src_hash() {
-  nix-prefetch-git --url https://github.com/$REPO --rev "refs/tags/v${NEW_VER}" | jq --exit-status --raw-output .hash
-}
-
-sed -i "s/version = \".*\"/version = \"$NEW_VER\"/" "$NIX_DRV"
-replace_hash "hash" "$(src_hash)"
-replace_hash "npmDepsHash" "$(get_npm_hash "package-lock.json")"
-replace_hash "clientNpmDepsHash" "$(get_npm_hash "client/package-lock.json")"

pkgs/by-name/ba/babashka-unwrapped/package.nix

@@ -10,11 +10,11 @@
 
 buildGraalvmNativeImage (finalAttrs: {
   pname = "babashka-unwrapped";
-  version = "1.13.220";
+  version = "1.13.223";
 
   src = fetchurl {
     url = "https://github.com/babashka/babashka/releases/download/v${finalAttrs.version}/babashka-${finalAttrs.version}-standalone.jar";
-    sha256 = "sha256-0fpvbrEJU89mMo9A9IM7kAqiGCdnexrEslGtjt+iBxg=";
+    sha256 = "sha256-DaDYD5pCV05/UwRre5xRxc2dAZJqkc1snKzEOTmM+Rs=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ba/babashka/clojure-tools.nix

@@ -7,10 +7,10 @@
 }:
 clojure.overrideAttrs (previousAttrs: {
   pname = "babashka-clojure-tools";
-  version = "1.12.5.1664";
+  version = "1.12.6.1673";
 
   src = fetchurl {
     url = previousAttrs.src.url;
-    hash = "sha256-d91oaJSAdK3Mk+g6eW+OjxWhqSvLG5AC1xX9IhDkdvM=";
+    hash = "sha256-/pGUhY511a8TwuKv+S1xBnTVvFEF8rQvkKfZTYLsAjw=";
   };
 })

pkgs/by-name/ba/balena-compose-parser/package.nix

@@ -6,13 +6,13 @@
 buildGoModule rec {
   __structuredAttrs = true;
   pname = "balena-compose-parser";
-  version = "0.4.0";
+  version = "0.4.1";
 
   src = fetchFromGitHub {
     owner = "balena-io-modules";
     repo = "balena-compose-parser";
     rev = "v${version}";
-    hash = "sha256-fEvLu2xZlYoILM4DThiSQHG2gbGOB5IQVgmwcLKsKwo=";
+    hash = "sha256-agZQjtkXBVMk7UAcQXPa7cRBq/H2uyCE5AC9hEfSWDM=";
   };
 
   modRoot = "lib";

pkgs/by-name/ca/capa/package.nix

@@ -1 +1 @@
-{ python3Packages }: with python3Packages; toPythonApplication capa
+{ python3Packages }: with python3Packages; toPythonApplication flare-capa

pkgs/by-name/ca/castopod/update.sh

@@ -3,7 +3,7 @@
 set -euo pipefail
 
 nixpkgs="$(git rev-parse --show-toplevel)"
-castopod_nix="$nixpkgs/pkgs/applications/audio/castopod/default.nix"
+castopod_nix="$(dirname "$0")/package.nix"
 
 # https://www.meetup.com/api/guide/#p02-querying-section
 query='

pkgs/by-name/ce/certigo/package.nix

@@ -6,20 +6,21 @@
 
 buildGoModule (finalAttrs: {
   pname = "certigo";
-  version = "1.18.0";
+  version = "1.18.1";
 
   src = fetchFromGitHub {
     owner = "square";
     repo = "certigo";
-    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-U+VbtY34lxLBHWI1BjkPxzSS6q41R9DQkGvDvSDX9WY=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Y2m+uO/jxwWdutry859Y6IdNJpXjjkrlJ+LJrjS616Y=";
   };
 
-  vendorHash = "sha256-5DpgOb0YxZ/os23y+siCB73dUwutxXIW5RlCZqdbxao=";
+  vendorHash = "sha256-u10YSa2xFswJk/2iC7eyfQ51oTaa30/6JA5aLk5021k=";
 
   meta = {
     description = "Utility to examine and validate certificates in a variety of formats";
     homepage = "https://github.com/square/certigo";
+    changelog = "https://github.com/square/certigo/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.asl20;
     maintainers = [ ];
     mainProgram = "certigo";

pkgs/by-name/ch/cht-sh/package.nix

@@ -12,15 +12,15 @@
 
 stdenv.mkDerivation {
   pname = "cht.sh";
-  version = "0-unstable-2025-12-23";
+  version = "0-unstable-2026-09-22";
 
   nativeBuildInputs = [ makeWrapper ];
 
   src = fetchFromGitHub {
     owner = "chubin";
     repo = "cheat.sh";
-    rev = "031a5d3887f035aaa3bf1a3f83dff4fde2aac53d";
-    sha256 = "T6v58bmdA3EvC4QUgCR+FJLonN3QdHpkdvNGauq/i5Q=";
+    rev = "06af0000259bde1a347da368225c5962d7ffed3e";
+    sha256 = "v9NpTSBMAYIt14jSAQJQAUsBUvVjRQDo6VUc2p1lwBE=";
   };
 
   # Fix ".cht.sh-wrapped" in the help message

pkgs/by-name/ci/ciphey/package.nix

@@ -0,0 +1,66 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  nix-update-script,
+  oniguruma,
+  openssl,
+  pkg-config,
+  rustPlatform,
+  sqlite,
+  writableTmpDirAsHomeHook,
+  zstd,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "ciphey";
+  version = "0.12.1";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "bee-san";
+    repo = "Ciphey";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-jaI++uyAHXbx/o0qqbrDtVQbYjffecfKXAb4NCSXIRU=";
+  };
+
+  # cargo-nextest is only used as the upstream test runner. It is not needed
+  # by the test suite itself, and its nextest-runner dependency pulls in usdt,
+  # which fails to build on Darwin.
+  postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    substituteInPlace Cargo.toml \
+      --replace-fail 'cargo-nextest = "0.9.117"' ""
+  '';
+
+  cargoHash = "sha256-Kn2lHsw4SGV8kE6AxjryL+To9OMq5loUE7GCndVbyWI=";
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    oniguruma
+    openssl
+    sqlite
+    zstd
+  ];
+
+  env = {
+    LIBSQLITE3_SYS_USE_PKG_CONFIG = true;
+    RUSTONIG_SYSTEM_LIBONIG = true;
+    ZSTD_SYS_USE_PKG_CONFIG = true;
+  };
+
+  nativeCheckInputs = [ writableTmpDirAsHomeHook ];
+
+  passthru.updateScript = nix-update-script { };
+
+  __darwinAllowLocalNetworking = true;
+
+  meta = {
+    description = "Tool to automatically decrypt encryptions or hashes";
+    homepage = "https://github.com/bee-san/Ciphey";
+    changelog = "https://github.com/bee-san/Ciphey/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "ciphey";
+  };
+})

pkgs/by-name/ci/circup/package.nix

@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "circup";
-  version = "3.0.4";
+  version = "3.1.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "adafruit";
     repo = "circup";
     tag = finalAttrs.version;
-    hash = "sha256-sv+ixo5S9JRuVu8JkKt29Kpn1ioRIwGW4Ss/A77YiFU=";
+    hash = "sha256-+/1lL5mVeVPFFLitLYIGzSxmnoizNxjb6+MYWreSijw=";
   };
 
   pythonRelaxDeps = [ "semver" ];

pkgs/by-name/cl/cloudfoundry-cli/package.nix

@@ -4,6 +4,8 @@
   fetchFromGitHub,
   fetchurl,
   installShellFiles,
+  versionCheckHook,
+  writableTmpDirAsHomeHook,
 }:
 
 buildGoModule (finalAttrs: {
@@ -32,8 +34,9 @@ buildGoModule (finalAttrs: {
   ldflags = [
     "-s"
     "-w"
-    "-X code.cloudfoundry.org/cli/version.binaryBuildDate=1970-01-01"
-    "-X code.cloudfoundry.org/cli/version.binaryVersion=${finalAttrs.version}"
+    "-X code.cloudfoundry.org/cli/v8/version.binaryBuildDate=1970-01-01"
+    "-X code.cloudfoundry.org/cli/v8/version.binaryVersion=${finalAttrs.version}"
+    "-X code.cloudfoundry.org/cli/v8/version.binarySHA=${finalAttrs.src.rev}"
   ];
 
   postInstall = ''
@@ -41,6 +44,15 @@ buildGoModule (finalAttrs: {
     installShellCompletion --bash $bashCompletionScript
   '';
 
+  doInstallCheck = true;
+
+  versionCheckKeepEnvironment = [ "HOME" ];
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+    writableTmpDirAsHomeHook
+  ];
+
   meta = {
     description = "Official command line client for Cloud Foundry";
     homepage = "https://github.com/cloudfoundry/cli";

pkgs/by-name/co/codex/package.nix

@@ -29,18 +29,18 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "codex";
-  version = "0.158.0";
+  version = "0.159.1";
 
   src = fetchFromGitHub {
     owner = "openai";
     repo = "codex";
     tag = "rust-v${finalAttrs.version}";
-    hash = "sha256-6ogqs75pG4+hxG6RqwBwJPWd3wGks2wBID/epha9+Ds=";
+    hash = "sha256-74sN8GM4W+u8bMxOenSp9tmIDqAtrABCmU5J8IsqZWA=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/codex-rs";
 
-  cargoHash = "sha256-D8+caV6Q9H2JnZNhazV1kqgV0dePh3qQyXnRMgeSYak=";
+  cargoHash = "sha256-3X4gmzAZG10DDcI667k9Zf+r3IvzeAAWD1NbTdQZyGY=";
 
   __structuredAttrs = true;
 

pkgs/by-name/co/compress-pptx/package.nix

@@ -11,14 +11,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "compress-pptx";
-  version = "1.3.1";
+  version = "1.3.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "slhck";
     repo = "compress-pptx";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-+67EdAEWsRY11Pkie6AOz7Sl7MSTMGxZoQYS+M2x07Y=";
+    hash = "sha256-DTN/R8ioSp63txLB4ac8P0k3CXQN1ikr9qgYeP2dQSM=";
   };
 
   patches = [

pkgs/by-name/co/cook-cli/package.nix

@@ -11,16 +11,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cook-cli";
-  version = "0.36.0";
+  version = "0.37.0";
 
   src = fetchFromGitHub {
     owner = "cooklang";
     repo = "cookcli";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-ihsVvlyp//A4pNlt1+DlYWyz52enHVeU6uST7bxcwqw=";
+    hash = "sha256-tHPVKigUqHZo84E+2wnky21UQfE7bQ1ZB1vZZNPlm7E=";
   };
 
-  cargoHash = "sha256-e47x9XzABpXO+qvTydrBOPU9KTZTYJkbJvWvpUUh7Bo=";
+  cargoHash = "sha256-DOXHQMYWyuArVwS+odyjImGCfzS4flNZM7NRSnLkLfc=";
 
   # Build without the self-updating feature
   buildNoDefaultFeatures = true;

pkgs/by-name/co/copilot-language-server/package.nix

@@ -13,14 +13,14 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "copilot-language-server";
-  version = "1.547.0";
+  version = "1.551.2";
 
   strictDeps = true;
   __structuredAttrs = true;
 
   src = fetchzip {
     url = "https://github.com/github/copilot-language-server-release/releases/download/${finalAttrs.version}/copilot-language-server-js-${finalAttrs.version}.zip";
-    hash = "sha256-JFAv+Trz8XUuk9x9ZXWINdfrZ8Mglwjy8ay/EX0gOPo=";
+    hash = "sha256-wDV1F8rzO49sp2XxcZdvwyWKSzu+2CWahZ2kLoVoGRE=";
     stripRoot = false;
   };
 

pkgs/by-name/da/databricks-cli/package.nix

@@ -9,7 +9,7 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "databricks-cli";
-  version = "1.17.0";
+  version = "1.18.0";
 
   __structuredAttrs = true;
 
@@ -17,10 +17,10 @@ buildGoModule (finalAttrs: {
     owner = "databricks";
     repo = "cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-HWk3vw0DT8Jsjv9fM8jcQdJUDwEjjZEAYn7EP3V/OSQ=";
+    hash = "sha256-I0w62sVpL27gtnir8mZtGs6PbsNH8nwWc5JyCXfnlqI=";
   };
 
-  vendorHash = "sha256-eDFlN1dql+ojOSyP7huhzzyaH9o1tvdjHD4WxP//NwA=";
+  vendorHash = "sha256-6b++JxHIU6Zhv4357nEH4VHnCOty9KOMbwM6gVHU2qE=";
 
   subPackages = [ "." ];
 

pkgs/by-name/db/dbcsr/package.nix

@@ -1,41 +1,69 @@
 {
-  stdenv,
   lib,
+  stdenv,
   fetchFromGitHub,
+  fetchpatch,
+
+  # nativeBuildInputs
   cmake,
-  mpiCheckPhaseHook,
-  pkg-config,
   fypp,
   gfortran,
+  mpi,
+  pkg-config,
+  python3,
+
+  # buildInputs
   blas,
   lapack,
-  python3,
   libxsmm,
-  mpi,
+
+  # nativeCheckInputs
+  mpiCheckPhaseHook,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "dbcsr";
   version = "2.10.0";
 
+  __structuredAttrs = true;
+  strictDeps = true;
+
   src = fetchFromGitHub {
     owner = "cp2k";
     repo = "dbcsr";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-BgZmc81TzgU3ifv4RHh2pfjbkUyxMIIpBrHCtnLF3p0=";
   };
 
+  patches = [
+    # Explicitly export the C API symbols, otherwise hidden with GCC 16
+    # https://github.com/cp2k/dbcsr/pull/1027
+    (fetchpatch {
+      name = "expose-c-api-procedures.patch";
+      url = "https://github.com/cp2k/dbcsr/commit/a5d9bcfcd487e3181b981687334da1b89bc61dce.patch";
+      hash = "sha256-a4glOtMx1EUzYdoQb66bZaRnCgatVFWTqvcQlvU3oIc=";
+    })
+  ];
+
   postPatch = ''
     patchShebangs .
-
-    # Force build of shared library, otherwise just static.
+  ''
+  # Force build of shared library, otherwise just static.
+  + ''
     substituteInPlace src/CMakeLists.txt \
-      --replace 'add_library(dbcsr ''${DBCSR_SRCS})' 'add_library(dbcsr SHARED ''${DBCSR_SRCS})' \
-      --replace 'add_library(dbcsr_c ''${DBCSR_C_SRCS})' 'add_library(dbcsr_c SHARED ''${DBCSR_C_SRCS})'
-
-    # Avoid calling the fypp wrapper script with python again. The nix wrapper took care of that.
+      --replace-fail \
+        'add_library(dbcsr ''${DBCSR_SRCS})' \
+        'add_library(dbcsr SHARED ''${DBCSR_SRCS})' \
+      --replace-fail \
+        'add_library(dbcsr_c ''${DBCSR_C_SRCS})' \
+        'add_library(dbcsr_c SHARED ''${DBCSR_C_SRCS})'
+  ''
+  # Avoid calling the fypp wrapper script with python again. The nix wrapper took care of that.
+  + ''
     substituteInPlace cmake/fypp-sources.cmake \
-      --replace 'COMMAND ''${Python_EXECUTABLE} ''${FYPP_EXECUTABLE}' 'COMMAND ''${FYPP_EXECUTABLE}'
+      --replace-fail \
+        'COMMAND ''${Python_EXECUTABLE} ''${FYPP_EXECUTABLE}' \
+        'COMMAND ''${FYPP_EXECUTABLE}'
   '';
 
   outputs = [
@@ -44,11 +72,12 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   nativeBuildInputs = [
-    gfortran
-    python3
     cmake
-    pkg-config
     fypp
+    gfortran
+    mpi
+    pkg-config
+    python3
   ];
 
   buildInputs = [
@@ -60,17 +89,17 @@ stdenv.mkDerivation (finalAttrs: {
   propagatedBuildInputs = [ mpi ];
 
   cmakeFlags = [
-    "-DUSE_OPENMP=ON"
-    "-DUSE_SMM=libxsmm"
-    "-DWITH_C_API=ON"
-    "-DBUILD_TESTING=ON"
-    "-DTEST_OMP_THREADS=2"
-    "-DTEST_MPI_RANKS=2"
-    "-DENABLE_SHARED=ON"
-    "-DUSE_MPI=ON"
+    (lib.cmakeBool "USE_OPENMP" true)
+    (lib.cmakeFeature "USE_SMM" "libxsmm")
+    (lib.cmakeBool "WITH_C_API" true)
+    (lib.cmakeBool "BUILD_TESTING" true)
+    (lib.cmakeFeature "TEST_OMP_THREADS" "2")
+    (lib.cmakeFeature "TEST_MPI_RANKS" "2")
+    (lib.cmakeBool "ENABLE_SHARED" true)
+    (lib.cmakeBool "USE_MPI" true)
   ];
 
-  checkInputs = [
+  nativeCheckInputs = [
     mpiCheckPhaseHook
   ];
 
@@ -80,6 +109,7 @@ stdenv.mkDerivation (finalAttrs: {
     description = "Distributed Block Compressed Sparse Row matrix library";
     license = lib.licenses.gpl2Only;
     homepage = "https://github.com/cp2k/dbcsr";
+    changelog = "https://github.com/cp2k/dbcsr/releases/tag/${finalAttrs.src.tag}";
     maintainers = [ lib.maintainers.sheepforce ];
   };
 })

pkgs/by-name/db/dbeaver-bin/package.nix

@@ -19,7 +19,7 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "dbeaver-bin";
-  version = "26.2.0";
+  version = "26.2.1";
 
   src =
     let
@@ -31,9 +31,9 @@ stdenvNoCC.mkDerivation (finalAttrs: {
         aarch64-darwin = "macos-aarch64.dmg";
       };
       hash = selectSystem {
-        x86_64-linux = "sha256-9QTnCnR2OqAuC2PWhCuFymRSb2gr5Fez8w4zDMEHSO0=";
-        aarch64-linux = "sha256-atqAOjnAcvyPHHdwZpKY6So1AXRKbh/5GXlKDe35WWM=";
-        aarch64-darwin = "sha256-YqA6qIQp1O7zV2VQOXquddJXagEt7aDIPUtE9fvNSj8=";
+        x86_64-linux = "sha256-Fte9AehPjNj0bWl2rBJ/olZ47AEJU8m03OQZM68gZ+g=";
+        aarch64-linux = "sha256-dvrR2QZNDtra33rIEbM7Z17KeXoQjcRqjjgtoiOZzI4=";
+        aarch64-darwin = "sha256-K/9ehDV8pe4mY/SEI9o52zg9EZbAhvl6oiYYj0qiwKA=";
       };
     in
     fetchurl {

pkgs/by-name/de/deno/package.nix

@@ -36,7 +36,7 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "deno";
-  version = "2.9.6";
+  version = "2.9.7";
 
   __structuredAttrs = true;
 
@@ -51,10 +51,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     repo = "deno";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true; # required for tests
-    hash = "sha256-4X7IfQk9NJizhZKqH2EuDnSfk8axkKFyiZEv1FOfWTM=";
+    hash = "sha256-GOhud8uXlsDdyAN84WscakxK2qCFTEYSUwR5Wt2QPAs=";
   };
 
-  cargoHash = "sha256-EKRC+wqIos9O0GHaxjmb/ghyzV6oCi1qwhO2tjszWR4=";
+  cargoHash = "sha256-VSWkdTJiSX8O3+Kpu7RKnydxB3OcbwG9+NJCvLdFl68=";
 
   patches = [
     ./patches/0002-tests-replace-hardcoded-paths.patch

pkgs/by-name/do/doh-proxy-rust/package.nix

@@ -9,15 +9,15 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "doh-proxy-rust";
-  version = "0.9.16";
+  version = "0.10.0";
 
   src = fetchCrate {
     inherit (finalAttrs) version;
     crateName = "doh-proxy";
-    hash = "sha256-V/mWMKBsCStQovgvMtRP66+OsNF2TC0GarYY51C/Zik=";
+    hash = "sha256-dRff1YWDqSf9naRkwPAX5GeLYIwlUD481+/TWnsM/p4=";
   };
 
-  cargoHash = "sha256-daXXjD789tJBph00FPlm2C5gW3jwcTTAZ5TVeDJz8lU=";
+  cargoHash = "sha256-YtcfOr7RseVRTgyQq43tQ8GWhLpOW2pQeReCBD+Ez6c=";
 
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
     libiconv

pkgs/by-name/dt/dtop/package.nix

@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "dtop";
-  version = "0.9.3";
+  version = "0.9.4";
 
   src = fetchFromGitHub {
     owner = "amir20";
     repo = "dtop";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-7APbKhXiqJyb0xAhUou0PfkdZFJvUTb3Ek/94bah7Lg=";
+    hash = "sha256-Z1Kcb5s8UtvtFm0314PV8YZn/FiGDu8tfp8/HlVDeMs=";
   };
 
-  cargoHash = "sha256-NTFWtlFiHHQoiy3IdGZeVy7q75OvHeZ2LBbY7EKHru8=";
+  cargoHash = "sha256-8Lk0PdX39WCqjRSklQ+oM9qJ/IzhJUkbzCtJZGLZ/7E=";
 
   nativeInstallCheckInputs = [ versionCheckHook ];
   versionCheckProgramArg = "--version";

pkgs/by-name/du/duckdb-odbc/package.nix

@@ -12,13 +12,13 @@ stdenv.mkDerivation (finalAttrs: {
   __structuredAttrs = true;
 
   pname = "duckdb-odbc";
-  version = "1.5.5.0";
+  version = "1.5.6.0";
 
   src = fetchFromGitHub {
     owner = "duckdb";
     repo = "duckdb-odbc";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-uh4Jle/gbHyd4rUfoyW0u35fx9dcvEEzTg8QnuHdiwY=";
+    hash = "sha256-EaDwmQ0kb7oZLRm5le6sz63wT4RIMX2NW4lr0RARKRU=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/by-name/du/dusklight/package.nix

@@ -12,7 +12,7 @@
   freetype,
   libGL,
   libglvnd,
-  libjpeg_turbo,
+  libpng,
   libpulseaudio,
   libusb1,
   libx11,
@@ -34,6 +34,7 @@
   vulkan-loader,
   wayland,
   xxhash,
+  zlib,
   zstd,
 }:
 
@@ -41,18 +42,24 @@ let
   auroraSrc = fetchFromGitHub {
     owner = "encounter";
     repo = "aurora";
-    rev = "22351fb0b76a4f4f2c4a4dff95aa300101e861aa";
-    hash = "sha256-gDY09IKlTu1Pj7mKw4eQYVXFDJ7j/aTp0iT/Ke93s6s=";
+    rev = "08122911e8621acb7ded6563813b264bec1494b5";
+    hash = "sha256-vdeHq7b+RHEwHN60pGU/FEWW/CqYZMJ2MC86CnF3iMg=";
+  };
+  borealisSrc = fetchFromGitHub {
+    owner = "encounter";
+    repo = "borealis";
+    rev = "8a1c87eb89c8448183e8d9054bcb1efac380940c";
+    hash = "sha256-dwqUh1fhDAmc1JBv0D6c8TSCNdrsDulmfhUD7GEw8EA=";
   };
   dawnSrc = fetchzip (
     {
       x86_64-linux = {
-        url = "https://github.com/encounter/dawn-build/releases/download/v20260603.191052/dawn-linux-x86_64.tar.gz";
-        hash = "sha256-yTanM4TUIv6akgpt2tai/2W6q4RAt48CxKobRgxK8WU=";
+        url = "https://github.com/encounter/dawn/releases/download/v20260807.225922/dawn-linux-x86_64.tar.gz";
+        hash = "sha256-deRtiZ221q6PO9zejJBwa56fCM63KEh6y2p7nM+MOYU=";
       };
       aarch64-linux = {
-        url = "https://github.com/encounter/dawn-build/releases/download/v20260603.191052/dawn-linux-aarch64.tar.gz";
-        hash = "sha256-EiNj16S0sIOWzOByiecsl2bZScBA5MOK348sqyxDchc=";
+        url = "https://github.com/encounter/dawn/releases/download/v20260807.225922/dawn-linux-aarch64.tar.gz";
+        hash = "sha256-WUs7dDxNbQtt5x8AIDmVuFWhcZVgSyUUuRJvr5yrREo=";
       };
     }
     .${stdenv.hostPlatform.system}
@@ -71,19 +78,30 @@ let
     hash = "sha256-pNMR8zxaaqfAzQ0AQBOXMct4usdjey1Q0Gnitg06UhM=";
   };
   rmluiSrc = fetchzip {
-    url = "https://github.com/mikke89/RmlUi/archive/f9b8c9e2935d5df2c7dff2c190d3968e99b0c3dc.tar.gz";
-    hash = "sha256-g4O/JZUrrcseOz8o2QJRt+2CeuiLnVeuDJc906xvuIg=";
+    url = "https://github.com/encounter/RmlUi/archive/215513c51ee1b3b75fc794518dda0576c462279f.tar.gz";
+    hash = "sha256-erJDGImoTfgr6IeZDYTsqK2bOTgVRm3F3iQGXhch5YA=";
+  };
+  minizSrc = fetchzip {
+    url = "https://github.com/richgel999/miniz/releases/download/3.0.2/miniz-3.0.2.zip";
+    hash = "sha256-DXysXkQEmoDAMMg1F8KexkwpXNyiHNzLJqXR9SMEkxk=";
+    stripRoot = false;
+  };
+  picosha2Src = fetchFromGitHub {
+    owner = "okdshin";
+    repo = "PicoSHA2";
+    tag = "v1.0.1";
+    hash = "sha256-3psCzbrwR+vO9TyTKOx+gEaWuHDx6pSgLOQ3DqrJsnI=";
   };
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "dusklight";
-  version = "1.4.1";
+  version = "2.0.2";
 
   src = fetchFromGitHub {
     owner = "TwilitRealm";
     repo = "dusklight";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-wrbsgK9lAiO3+qfQcQ/o+6zEFS27CymJm76FAEanrdM=";
+    hash = "sha256-STM59AiwArcuVzZVyk4DsrM3aRfKdLCvd1zui/3cx5M=";
   };
 
   strictDeps = true;
@@ -106,7 +124,7 @@ stdenv.mkDerivation (finalAttrs: {
     freetype
     libGL
     libglvnd
-    libjpeg_turbo
+    libpng
     libpulseaudio
     libusb1
     libx11
@@ -120,28 +138,35 @@ stdenv.mkDerivation (finalAttrs: {
     nlohmann_json
     nodtool
     sdl3
-    tracy
     vulkan-loader
     wayland
     xxhash
+    zlib
     zstd
   ];
 
   postUnpack = ''
     chmod -R u+w "$sourceRoot"
-    mkdir -p "$sourceRoot/extern/aurora"
+    mkdir -p "$sourceRoot/extern/aurora" "$sourceRoot/extern/borealis"
     cp -rT --no-preserve=mode "${auroraSrc}" "$sourceRoot/extern/aurora"
+    cp -rT --no-preserve=mode "${borealisSrc}" "$sourceRoot/extern/borealis"
     sed -i '/add_subdirectory(tests)/d' "$sourceRoot/extern/aurora/CMakeLists.txt"
   '';
 
+  postPatch = ''
+    sed -i '1i #include <nlohmann/json.hpp>' src/dusk/imgui/ImGuiStateShare.cpp
+  '';
+
   cmakeBuildType = "RelWithDebInfo";
 
   cmakeFlags = [
-    (lib.cmakeFeature "DUSK_WC_DESCRIBE" "v${finalAttrs.version}")
+    (lib.cmakeFeature "BOREALIS_APP_DESCRIBE" "v${finalAttrs.version}")
     (lib.cmakeBool "CMAKE_DISABLE_FIND_PACKAGE_Git" true)
     (lib.cmakeBool "FETCHCONTENT_FULLY_DISCONNECTED" true)
     (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_CXXOPTS" cxxopts.src.outPath)
-    (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_JSON" nlohmann_json.src.outPath)
+    (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_NLOHMANN_JSON" nlohmann_json.src.outPath)
+    (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_MINIZ" minizSrc.outPath)
+    (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_PICOSHA2" picosha2Src.outPath)
     (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_DAWN_PREBUILT" dawnSrc.outPath)
     (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_XXHASH" xxhash.src.outPath)
     (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_FMT" fmt.src.outPath)
@@ -157,7 +182,8 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.cmakeFeature "CMAKE_CXX_FLAGS_INIT" "-include cstring")
     (lib.cmakeBool "BUILD_SHARED_LIBS" false)
     (lib.cmakeBool "CMAKE_CROSSCOMPILING" true)
-    (lib.cmakeBool "DUSK_ENABLE_SENTRY_NATIVE" false)
+    (lib.cmakeBool "DUSK_ENABLE_CODE_MODS" false)
+    (lib.cmakeFeature "BOREALIS_HTTP_BACKEND" "none")
   ];
 
   installPhase = ''

pkgs/by-name/el/elpa/package.nix

@@ -5,6 +5,7 @@
   autoreconfHook,
   mpiCheckPhaseHook,
   perl,
+  python3,
   mpi,
   blas,
   lapack,
@@ -43,11 +44,13 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   postPatch = ''
-    patchShebangs ./fdep/fortran_dependencies.pl
-    patchShebangs ./test-driver
+    patchShebangs --build ./fdep/fortran_dependencies.pl
 
     # Fix the test script generator
     substituteInPlace Makefile.am --replace '#!/bin/bash' '#!${stdenv.shell}'
+  ''
+  + lib.optionalString enableCuda ''
+    patchShebangs --build ./nvcc_wrap ./manual_cpp
   '';
 
   outputs = [
@@ -61,7 +64,11 @@ stdenv.mkDerivation (finalAttrs: {
     autoreconfHook
     perl
   ]
-  ++ lib.optionals enableCuda [ cudaPackages.cuda_nvcc ];
+  ++ lib.optionals enableCuda [
+    cudaPackages.cuda_nvcc
+    cudaPackages.libcusolver
+    python3
+  ];
 
   buildInputs = [
     mpi
@@ -74,26 +81,28 @@ stdenv.mkDerivation (finalAttrs: {
     cudaPackages.libcublas
   ];
 
-  preConfigure = ''
-    export FC="mpifort"
-    export CC="mpicc"
-    export CXX="mpicxx"
-    export CPP="cpp"
-
-    # These need to be set for configure to succeed
-    export FCFLAGS="${
-      lib.optionalString stdenv.hostPlatform.isx86_64 "-msse3 "
-      + lib.optionalString avxSupport "-mavx "
-      + lib.optionalString avx2Support "-mavx2 -mfma "
-      + lib.optionalString avx512Support "-mavx512"
-    }"
-
-    export CFLAGS=$FCFLAGS
-  '';
+  env =
+    let
+      optFlags =
+        lib.optionalString stdenv.hostPlatform.isx86_64 "-msse3 "
+        + lib.optionalString avxSupport "-mavx "
+        + lib.optionalString avx2Support "-mavx2 -mfma "
+        + lib.optionalString avx512Support "-mavx512";
+    in
+    {
+      FC = "mpifort";
+      CC = "mpicc";
+      CXX = "mpicxx";
+      CPP = "cpp";
+      FCFLAGS = optFlags;
+      CFLAGS = optFlags;
+    }
+    # elpa's CUDA support pulls in a custom compiler wrapper
+    # that does not distinguish gcc/g++
+    // lib.optionalAttrs enableCuda { LDFLAGS = "-lstdc++"; };
 
   configureFlags = [
     "--with-mpi"
-    "--enable-openmp"
     "--without-threading-support-check-during-build"
   ]
   ++ lib.optional blas.isILP64 "--enable-64bit-integer-math-support"
@@ -103,6 +112,7 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optional (!stdenv.hostPlatform.isx86_64) "--disable-sse"
   ++ lib.optional (!stdenv.hostPlatform.isx86_64) "--disable-sse-assembly"
   ++ lib.optional stdenv.hostPlatform.isx86_64 "--enable-sse-assembly"
+  ++ lib.optional (!enableCuda) "--enable-openmp"
   ++ lib.optionals enableCuda [
     "--enable-nvidia-gpu"
     "--with-NVIDIA-GPU-compute-capability=${nvidiaArch}"
@@ -114,8 +124,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeCheckInputs = [ mpiCheckPhaseHook ];
   preCheck = ''
-    #patchShebangs ./
-
     # Reduce test problem sizes
     export TEST_FLAGS="1500 50 16"
   '';

pkgs/by-name/ex/exoscale-cli/package.nix

@@ -7,13 +7,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "exoscale-cli";
-  version = "1.99.0";
+  version = "1.101.0";
 
   src = fetchFromGitHub {
     owner = "exoscale";
     repo = "cli";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-n7o15s2aqGGMqL6kyiIVxgJGeOUjM6WIVsEQAWOQ8b8=";
+    sha256 = "sha256-lJOwFqBtvjHLcPa+/az0x+okqOdP+WrsXbkEG1CMQbk=";
   };
 
   vendorHash = null;

pkgs/by-name/fl/flaresolverr/package.nix

@@ -31,13 +31,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "flaresolverr";
-  version = "3.5.0";
+  version = "3.5.2";
 
   src = fetchFromGitHub {
     owner = "FlareSolverr";
     repo = "FlareSolverr";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-gOrfxFGNlxZWScfYEw7zfy7oVWhYEygYgP7mkO4cs/w=";
+    hash = "sha256-iTFoixNcEjhTCWpfDAJoLclspiyozZnQrRfkevLzd2o=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

pkgs/by-name/fl/fleet/package.nix

@@ -12,12 +12,12 @@
 }:
 let
   pname = "fleet";
-  version = "4.90.1";
+  version = "4.92.1";
   src = fetchFromGitHub {
     owner = "fleetdm";
     repo = "fleet";
     tag = "fleet-v${version}";
-    hash = "sha256-yD1snjDI5AAnHmnbpAUhtRx7ayPyqn9Tqv84p5W3SV4=";
+    hash = "sha256-O6BXxILefLY8zAUGsiAGixcD35+mpm/631s6711A5RE=";
   };
 
   frontend = stdenvNoCC.mkDerivation {
@@ -32,7 +32,7 @@ let
 
     yarnOfflineCache = fetchYarnDeps {
       yarnLock = src + "/yarn.lock";
-      hash = "sha256-OVXnPUQOr8KQYNthE8RzPV9IoQH8pxXHqjgTy7ymW/k=";
+      hash = "sha256-ZhkCkaX6mzavOAfSyK81s6wVN59VvBkRVBfgIfw17vE=";
     };
 
     NODE_ENV = "production";
@@ -54,7 +54,7 @@ in
 buildGoModule (finalAttrs: {
   inherit pname version src;
 
-  vendorHash = "sha256-1IGhOxzrQAyZu9a4HUvdN0MV5x8WnWMcFQejwy5WF1c=";
+  vendorHash = "sha256-PdJ6oCLC5CNLAXCS5KSrCTxUNcSxYLrx4myZ1e1TR58=";
 
   subPackages = [
     "cmd/fleet"

pkgs/by-name/fl/flexget/package.nix

@@ -7,14 +7,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "flexget";
-  version = "3.21.0";
+  version = "3.21.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Flexget";
     repo = "Flexget";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Xf+nFDC1dNyFXeK8gZYWiE3kZKYNB4lCdBoI24+b/gA=";
+    hash = "sha256-Nl02DbyRj52OZz07tZ2Y8EVcgyELVI0LJ8GJbgm2mco=";
   };
 
   pythonRelaxDeps = true;

pkgs/by-name/fl/fluere/package.nix

@@ -0,0 +1,58 @@
+{
+  lib,
+  fetchFromGitHub,
+  libgit2,
+  libpcap,
+  nix-update-script,
+  openssl,
+  pkg-config,
+  rustPlatform,
+  versionCheckHook,
+  zlib,
+  zstd,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "fluere";
+  version = "0.8.1";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "SkuldNorniern";
+    repo = "fluere";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-311VCO+8xoWblt6zBOLd+7xmmBO7sE0KeUKO1Qwg9SI=";
+  };
+
+  cargoHash = "sha256-nMh4hO9kHCpE/+K1DNZT3UYe0iGUU6HRZUg00T6f+CM=";
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    libgit2
+    libpcap
+    openssl
+    zlib
+    zstd
+  ];
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  doInstallCheck = true;
+
+  env = {
+    LIBGIT2_NO_VENDOR = true;
+    ZSTD_SYS_USE_PKG_CONFIG = true;
+  };
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Tool designed for network monitoring and analysis";
+    homepage = "https://github.com/SkuldNorniern/fluere";
+    changelog = "https://github.com/SkuldNorniern/fluere/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "fluere";
+  };
+})

pkgs/by-name/fr/frigate/package.nix

@@ -141,7 +141,9 @@ python3Packages.buildPythonApplication (finalAttrs: {
       --replace-fail "/labelmap.txt" "${placeholder "out"}/share/frigate/labelmap.txt"
 
     substituteInPlace frigate/events/audio.py \
-      --replace-fail "/cpu_audio_model.tflite" "${frigate.models.tflite.yamnet_classification_v1.model}" \
+      --replace-fail "/cpu_audio_model.tflite" "${frigate.models.tflite.yamnet_classification_v1.model}"
+
+    substituteInPlace frigate/events/audio.py frigate/api/app.py \
       --replace-fail "/audio-labelmap.txt" "${placeholder "out"}/share/frigate/audio-labelmap.txt"
   '';
 

pkgs/by-name/ga/gallery-dl/package.nix

@@ -8,14 +8,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "gallery-dl";
-  version = "1.32.10";
+  version = "1.32.14";
   pyproject = true;
 
   src = fetchFromCodeberg {
     owner = "mikf";
     repo = "gallery-dl";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-va081Uqrtj6INE3YOa07jXcdvg5VyePYQ7E26tc+Fgk=";
+    hash = "sha256-nEzHp5LYklzEdNKcCJagphGA5U2LNR2/Vb3ZOoxNc68=";
   };
 
   build-system = [ python3Packages.setuptools ];

pkgs/by-name/gh/gh-dash/package.nix

@@ -1,23 +1,23 @@
 {
   lib,
   fetchFromGitHub,
-  buildGoModule,
+  buildGo127Module,
   versionCheckHook,
   writableTmpDirAsHomeHook,
 }:
 
-buildGoModule (finalAttrs: {
+buildGo127Module (finalAttrs: {
   pname = "gh-dash";
-  version = "4.25.2";
+  version = "4.26.0";
 
   src = fetchFromGitHub {
     owner = "dlvhdr";
     repo = "gh-dash";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-3iUBuMvA2Xh7UjTiFNEs3tuZMCnSt/bIhTSEDD92yCU=";
+    hash = "sha256-NWJEe6ocC1FdXNLLGgVAcWlzjWqtgrMLnpnJrgbR7U4=";
   };
 
-  vendorHash = "sha256-Teu+8jiZE2gZ+0ErKsunhotY9W4Hjg6PAeFkFLgESIk=";
+  vendorHash = "sha256-edFzZpM1DIwFnMLQlOuh5c8CFzYm3X2YheGFDgOLZ0I=";
 
   ldflags = [
     "-s"

pkgs/by-name/gh/ghosthound/package.nix

@@ -0,0 +1,52 @@
+{
+  lib,
+  fetchFromGitHub,
+  nix-update-script,
+  openssl,
+  pkg-config,
+  rustPlatform,
+  versionCheckHook,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "ghosthound";
+  version = "0.1.2";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "JVBotelho";
+    repo = "ghosthound";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-UI01b0oiIiH9dIQClgnagTqb6OJgvmhXqIifh1aelDM=";
+  };
+
+  cargoHash = "sha256-ut6qwKdLvQgL66G5PQ817QMBCMz72aWNHK7MLpz5ql0=";
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [ openssl ];
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  env = {
+    OPENSSL_NO_VENDOR = true;
+  };
+
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "BloodHound OpenGraph extension that surfaces Active Directory";
+    homepage = "https://github.com/JVBotelho/ghosthound";
+    changelog = "https://github.com/JVBotelho/ghosthound/releases/tag/${finalAttrs.src.tag}";
+    license =
+      with lib.licenses;
+      OR [
+        asl20
+        mit
+      ];
+    maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "ghosthound";
+  };
+})

pkgs/by-name/gi/git-interactive-rebase-tool/package.nix

@@ -25,7 +25,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     homepage = "https://github.com/MitMaro/git-interactive-rebase-tool";
     description = "Native cross platform full feature terminal based sequence editor for git interactive rebase";
     changelog = "https://github.com/MitMaro/git-interactive-rebase-tool/releases/tag/${finalAttrs.version}";
-    license = lib.licenses.mit;
+    license = lib.licenses.gpl3Only;
     maintainers = with lib.maintainers; [
       SuperSandro2000
       zowoq

pkgs/by-name/gi/git-privacy/package.nix

@@ -1,6 +1,7 @@
 {
   lib,
   fetchFromGitHub,
+  fetchpatch,
   git,
   python3,
 }:
@@ -17,6 +18,16 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
     hash = "sha256-b2RkRL8/mZwqc3xCs+oltzualhQtp/7F9POlLlT3UUU=";
   };
 
+  patches = [
+    # Fix: pkg_resources is deprecated
+    (fetchpatch {
+      name = "fix-pkg_resources-is-deprecated.patch";
+      url = "https://github.com/EMPRI-DEVOPS/git-privacy/commit/a54d7a8b9ce6a48db5383e09711059b5025bcb18.patch";
+      excludes = [ ".github/workflows/pytest.yml" ];
+      hash = "sha256-uorH+EomVS6wMoykwazSIstz43CCjU8tJLgxyINqxU4=";
+    })
+  ];
+
   build-system = with python3.pkgs; [
     setuptools
   ];

pkgs/by-name/gi/gitlab/package.nix

@@ -23,6 +23,9 @@
   rustc,
   rustPlatform,
 
+  # gitlab-glaz
+  buildPackages,
+
   # gpgme
   pkg-config,
 
@@ -67,46 +70,57 @@ let
         buildFlags = [ "--enable-system-libraries" ];
       };
 
-      gitlab-glaz = attrs: {
-        cargoDeps = rustPlatform.fetchCargoVendor {
-          src = stdenv.mkDerivation {
-            inherit (buildRubyGem { inherit (attrs) gemName version source; })
-              name
-              src
-              unpackPhase
-              nativeBuildInputs
-              ;
-            dontBuilt = true;
-            installPhase = ''
-              cp -R ext/glaz $out
-              cp Cargo.lock $out
-            '';
+      gitlab-glaz =
+        attrs:
+        {
+          cargoDeps = rustPlatform.fetchCargoVendor {
+            src = stdenv.mkDerivation {
+              inherit (buildRubyGem { inherit (attrs) gemName version source; })
+                name
+                src
+                unpackPhase
+                nativeBuildInputs
+                ;
+              dontBuilt = true;
+              installPhase = ''
+                cp -R ext/glaz $out
+                cp Cargo.lock $out
+              '';
+            };
+            hash = "sha256-5fGoW6TpkIQ8OIXjt2fLGzG9xhZ2TT+v2zLH1ecItII=";
           };
-          hash = "sha256-5fGoW6TpkIQ8OIXjt2fLGzG9xhZ2TT+v2zLH1ecItII=";
+
+          dontBuild = false;
+
+          nativeBuildInputs = [
+            cargo
+            rustc
+            rustPlatform.cargoSetupHook
+            rustPlatform.bindgenHook
+          ];
+
+          disallowedReferences = [
+            rustc.unwrapped
+          ];
+
+          preInstall = ''
+            export CARGO_HOME="$PWD/../.cargo/"
+          '';
+
+          postInstall = ''
+            find $out -type f -name .rustc_info.json -delete
+          '';
+        }
+        // lib.optionalAttrs stdenv.hostPlatform.isRiscV64 {
+          # protoc-bin-vendored ships no riscv64 protoc
+          postPatch = ''
+            substituteInPlace $cargoDepsCopy/source-*/glaz-proto-*/build.rs \
+              --replace-fail 'protoc_bin_vendored::protoc_bin_path()?' \
+                'std::path::PathBuf::from(std::env::var("PROTOC")?)'
+          '';
+          PROTOC = lib.getExe' buildPackages.protobuf "protoc";
         };
 
-        dontBuild = false;
-
-        nativeBuildInputs = [
-          cargo
-          rustc
-          rustPlatform.cargoSetupHook
-          rustPlatform.bindgenHook
-        ];
-
-        disallowedReferences = [
-          rustc.unwrapped
-        ];
-
-        preInstall = ''
-          export CARGO_HOME="$PWD/../.cargo/"
-        '';
-
-        postInstall = ''
-          find $out -type f -name .rustc_info.json -delete
-        '';
-      };
-
       gitlab-glfm-markdown = attrs: {
         cargoDeps = rustPlatform.fetchCargoVendor {
           src = stdenv.mkDerivation {

pkgs/by-name/go/gogh/package.nix

@@ -25,13 +25,13 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "gogh";
-  version = "1235";
+  version = "1247";
 
   src = fetchFromGitHub {
     owner = "Gogh-Co";
     repo = "Gogh";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-1AaV1nauYQUeV2VLIuWvCHc3c0H595yqHTcFuKsEbjw=";
+    hash = "sha256-OB41buqusd+4ki0K28wK4DFJbQp3LsJ7ZU8qJNHprWs=";
   };
 
   postPatch = ''

pkgs/by-name/go/golines/package.nix

@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "golines";
-  version = "0.15.0";
+  version = "0.16.0";
 
   src = fetchFromGitHub {
     owner = "golangci";
     repo = "golines";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-gjm76dGbFTisQdiM0GAQJRcAreQUWIBuqYbLU2ruCNk=";
+    sha256 = "sha256-NveivuTEy+lvgsu32YuBE9lHhV4aTcI04BkMlZiIEGw=";
   };
 
-  vendorHash = "sha256-cLzCpjifb0lc6UaDW2JZBQABixz98EJ4syLapX7I8y8=";
+  vendorHash = "sha256-bn4C1d7EdAfBJZkWJByOQns+ng7F15eUs8BgYExB/g8=";
 
   subPackages = [
     "."

pkgs/by-name/go/google-chrome/package.nix

@@ -180,7 +180,7 @@ let
 
   linux = stdenvNoCC.mkDerivation (finalAttrs: {
     inherit pname meta;
-    version = "154.0.8037.57";
+    version = "154.0.8037.92";
 
     src =
       let
@@ -195,8 +195,8 @@ let
         url = "https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-stable/google-chrome-stable_${finalAttrs.version}-1_${debArch}.deb";
         hash =
           {
-            amd64 = "sha256-ZsBkX2oZhxurKES4U3wRoNsufTvqjvhaHHy1KlTmWj4=";
-            arm64 = "sha256-dBi2+a2THLdOsNydZrXsf06fhoctNAOUVFtRUICCduc=";
+            amd64 = "sha256-aeP2rApIEfRonKI/H9XMWywBVQiBkos+GWqXExFlxKI=";
+            arm64 = "sha256-mGYQvLwfWO7t6UkhCGrbs8HfLm08tNo5WxoY5xt963c=";
           }
           .${debArch};
       };
@@ -306,11 +306,11 @@ let
 
   darwin = stdenvNoCC.mkDerivation (finalAttrs: {
     inherit pname meta;
-    version = "154.0.8037.58";
+    version = "154.0.8037.93";
 
     src = fetchurl {
-      url = "https://dl.google.com/release2/chrome/esexjcwror2yyct27xsikjz3bq_154.0.8037.58/GoogleChrome-154.0.8037.58.dmg";
-      hash = "sha256-LfRnubv1+pPio7WbeZBqjr2eNnfRthhX9snZnmLqy0M=";
+      url = "https://dl.google.com/release2/chrome/adufpe5jsoouz6tduwoz7auvmjhq_154.0.8037.93/GoogleChrome-154.0.8037.93.dmg";
+      hash = "sha256-qTZ7anig56Qt8DLyQRJ029rKsbQVol/oaLvDMa7Jm7w=";
     };
 
     dontPatch = true;

pkgs/by-name/gr/greenmask/package.nix

@@ -7,13 +7,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "greenmask";
-  version = "0.2.23";
+  version = "0.2.24";
 
   src = fetchFromGitHub {
     owner = "GreenmaskIO";
     repo = "greenmask";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-3ZY0Bj8Lest1CuyElR+Vh4+OVolcfXgvw0Xq/Wdjemg=";
+    hash = "sha256-nzhsbMQUSNW7iYsPYmhjELmjgq+2Vaa9vDmiMp2iEXg=";
   };
 
   vendorHash = "sha256-OelcviMjEEJAIYzCgGFj6uJB+GTnkf1rxqjtz8ppHjs=";

pkgs/by-name/he/hexora/package.nix

@@ -0,0 +1,62 @@
+{
+  lib,
+  cargo,
+  fetchFromGitHub,
+  nix-update-script,
+  pkg-config,
+  python3Packages,
+  rustc,
+  rustPlatform,
+  zstd,
+}:
+
+python3Packages.buildPythonApplication (finalAttrs: {
+  pname = "hexora";
+  version = "0.3.1";
+  pyproject = true;
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "rushter";
+    repo = "hexora";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-xBg8Rrtwgg8Obi7JOPwdRXwoQKL8skCY72vLJA/VPRk=";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit (finalAttrs) pname version src;
+    hash = "sha256-Xc6CcJ6s8X7T04W2SP7XT2rKGh2TatkaCxP2sSUC+2Y=";
+  };
+
+  build-system = [
+    cargo
+    pkg-config
+    python3Packages.setuptools
+    python3Packages.setuptools-rust
+    python3Packages.wheel
+    rustPlatform.cargoSetupHook
+    rustc
+  ];
+
+  buildInputs = [ zstd ];
+
+  # Project has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [ "hexora" ];
+
+  env = {
+    ZSTD_SYS_USE_PKG_CONFIG = true;
+  };
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Static analysis of malicious Python code";
+    homepage = "https://github.com/rushter/hexora";
+    changelog = "https://github.com/rushter/hexora/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "hexora";
+  };
+})

pkgs/by-name/ho/honggfuzz/package.nix

@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "honggfuzz";
-  version = "2.6-unstable-2026-06-19";
+  version = "2.6-unstable-2026-09-25";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "honggfuzz";
-    rev = "cf8b66a4d09f4d4d786d96e3c46d9141fb4e98e2";
-    hash = "sha256-cu7VLQvdmgYIbWhAiZjG5wkO/b5+FoBmXp/SlYmykF0=";
+    rev = "940b958dfeb6f9131fd846cae31fcc0fe996ae98";
+    hash = "sha256-cfCG1rGfiAs7Oq+dJ904kaW6NmvOPG3cfmSgQFW42FU=";
   };
 
   postPatch = ''

pkgs/by-name/ht/httplib/package.nix

@@ -9,13 +9,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "httplib";
-  version = "0.56.0";
+  version = "0.58.0";
 
   src = fetchFromGitHub {
     owner = "yhirose";
     repo = "cpp-httplib";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-m5APBj01htJNljiANt8T9gZ1nupOkgFatpQseSgCADU=";
+    hash = "sha256-FMWqkFolKr+piiu2kekFQlrddEWyunoyXYDWKn26jaw=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/im/immich/package.nix

@@ -110,7 +110,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "immich";
-  version = "3.2.2";
+  version = "3.2.4";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -119,7 +119,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "immich-app";
     repo = "immich";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-napG+EMZbbbeq7R8FtnuDsDwdpxItkwTVWztnw07DfA=";
+    hash = "sha256-/wWep6A/ryocuGMOElcD1lOEwT6tJDdwa5HAcCZUXSs=";
   };
 
   pnpmDeps = fetchPnpmDeps {

pkgs/by-name/ki/kitty/package.nix

@@ -52,21 +52,21 @@
 with python3Packages;
 buildPythonApplication rec {
   pname = "kitty";
-  version = "0.49.0";
+  version = "0.49.1";
   pyproject = false;
 
   src = fetchFromGitHub {
     owner = "kovidgoyal";
     repo = "kitty";
     tag = "v${version}";
-    hash = "sha256-C1roiJ+mAm8rEoG5VAQABYUq2FSFVuusNQ0PtLP0tPI=";
+    hash = "sha256-YVjTfJnsNEBjcHWQCq2nJBFPvLg7RqQcyWjgR4ijUqc=";
   };
 
   goModules =
     (buildGo126Module {
       pname = "kitty-go-modules";
       inherit src version;
-      vendorHash = "sha256-G+eaFOFMIIu2Qo5Mgr3ejwoYrYmNv3EIdEEraDPIdeY=";
+      vendorHash = "sha256-urQMf5lGYPgS65VjGw0pi/ZM6CETtGWfi/kvVDAkIoc=";
     }).goModules;
 
   buildInputs = [

pkgs/by-name/ku/kubescape/package.nix

@@ -9,18 +9,18 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "kubescape";
-  version = "4.0.14";
+  version = "4.0.15";
 
   src = fetchFromGitHub {
     owner = "kubescape";
     repo = "kubescape";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-QdWnwjvXsABcTsf+xzIYZ7GgwukzvyPQOppm7SDCK64=";
+    hash = "sha256-4WQvIdUPkiN4buqFDJRzY2CHe6EfJcOv1tT2/IETilE=";
     fetchSubmodules = true;
   };
 
   proxyVendor = true;
-  vendorHash = "sha256-y0iwBSUVh2pBEaiS1cGmW7F0/geGDuSdSHMmvhW5c9o=";
+  vendorHash = "sha256-dpci0KYQBuUTgGdQ95rQqahX4TtkycJ3ZcEmQXrCLu0=";
 
   subPackages = [ "." ];
 

pkgs/by-name/le/ledger-live-desktop/package.nix

@@ -8,11 +8,11 @@
 
 let
   pname = "ledger-live-desktop";
-  version = "4.19.1";
+  version = "4.21.1";
 
   src = fetchurl {
     url = "https://download.live.ledger.com/${pname}-${version}-linux-x86_64.AppImage";
-    hash = "sha256-zPaMkbU36HwcMUHy9nrocCOJfZ4k/CXj/3gd4BZUV0M=";
+    hash = "sha256-Em+VT8sDCyKgrJxrdrAIVpbdLdSPwqoBgIRXeEj1TXY=";
   };
 
   appimageContents = appimageTools.extract {

pkgs/by-name/le/lefthook/package.nix

@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "lefthook";
-  version = "2.1.14";
+  version = "2.1.15";
 
   src = fetchFromGitHub {
     owner = "evilmartians";
     repo = "lefthook";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-UknO4ka3fjldpsp9V+GPkPYvhmlF4e6nd6dW9Uwjc2o=";
+    hash = "sha256-gBgydS6E35Jd3r8Tp1hvCk3c6E39kcNE5Gu60RCtLw4=";
   };
 
-  vendorHash = "sha256-G+v6ZqnkcFdPDzXlN89oqD7mOnHfq1tvIkFxdoVnBNo=";
+  vendorHash = "sha256-61w4BJKInUbQOInbqjshWiwyrpGSM+/JziMRmK9pik4=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/li/libdeltachat/package.nix

@@ -20,13 +20,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libdeltachat";
-  version = "2.61.0";
+  version = "2.62.0";
 
   src = fetchFromGitHub {
     owner = "chatmail";
     repo = "core";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-lePHfmq4bUxb1reQe2BOMC0WUDdH7cZ33Fu8TLkb+xs=";
+    hash = "sha256-qjbxxcOvHkb8g4IMWXYXmnYhbEx3G5ptiysOvpTcCCI=";
   };
 
   patches = [
@@ -36,7 +36,7 @@ stdenv.mkDerivation (finalAttrs: {
   cargoDeps = rustPlatform.fetchCargoVendor {
     pname = "chatmail-core";
     inherit (finalAttrs) version src;
-    hash = "sha256-VZkrewx54/M1XXs9j9asLdLNEez+XIUvFfgAjo8w09c=";
+    hash = "sha256-ceXhO8/k3+dphPQ74S+ZgEZzUWjgqBm6wcePvTqxHrE=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/li/libretroPackages/cores/prboom.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "prboom";
-  version = "0-unstable-2026-09-15";
+  version = "0-unstable-2026-09-28";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "libretro-prboom";
-    rev = "d20300de2d32e5b8e8b0a0f15b1e1a889583d248";
-    hash = "sha256-56A6JEOoorKi2yitpVk+iXCzZLAkjzYM3jcxPqOtuXE=";
+    rev = "e5db549b6c85fc500b3a559efe2dc00870521c5d";
+    hash = "sha256-UodAMvRuHGIfAUHLi0DCXT2ZPe4UfI7t+0bv15pkpIs=";
   };
 
   makefile = "Makefile";

pkgs/by-name/li/libsecretspec-resolver/package.nix

@@ -11,7 +11,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libsecretspec-resolver";
-  version = "0.21.0";
+  version = "0.21.1";
   strictDeps = true;
   __structuredAttrs = true;
 
@@ -19,7 +19,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "cachix";
     repo = "secretspec";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-12jIhLZhtyQwkt2vKHqjGOuKSwwevcxzp8Ii02RTMLY=";
+    hash = "sha256-8OC1WS8VWTSwUJlT/qWx9CCPmO90G2OWJxEKZGUgXqM=";
   };
 
   cmakeDir = "../libsecretspec-resolver";

pkgs/by-name/li/libsecretspec/package.nix

@@ -13,17 +13,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "libsecretspec";
-  version = "0.21.0";
+  version = "0.21.1";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "cachix";
     repo = "secretspec";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-12jIhLZhtyQwkt2vKHqjGOuKSwwevcxzp8Ii02RTMLY=";
+    hash = "sha256-8OC1WS8VWTSwUJlT/qWx9CCPmO90G2OWJxEKZGUgXqM=";
   };
 
-  cargoHash = "sha256-yqBAhnHBwKbSyH8sEDo6y0xGUdKJgHd3Gsr1sTS/bRc=";
+  cargoHash = "sha256-48k3UKeT8qjRRLrf5yqmxULIynD6FgXiW063VEoTqmU=";
 
   nativeBuildInputs = [ cargo-c ];
 

pkgs/by-name/li/libslirp/package.nix

@@ -10,14 +10,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libslirp";
-  version = "4.9.3";
+  version = "4.9.5";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "slirp";
     repo = "libslirp";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Spr3dO5ehuUlzx3EnJi8najANWOirwQcTsWTVRVXYuY=";
+    hash = "sha256-iWu3/Klsm8e9MH147BJhn9Vqyneq5ROqPvll1cnieL0=";
   };
 
   separateDebugInfo = true;

pkgs/by-name/li/lint-staged/package.nix

@@ -8,16 +8,16 @@
 
 buildNpmPackage rec {
   pname = "lint-staged";
-  version = "17.5.1";
+  version = "17.6.0";
 
   src = fetchFromGitHub {
     owner = "lint-staged";
     repo = "lint-staged";
     rev = "v${version}";
-    hash = "sha256-9fx514c0ZblPZaJmAGdmb2QbIodsaDS9MOoveUXwA2Q=";
+    hash = "sha256-dUZMViPdT0mjqAs5boofuJs8qSH0QPZVts7PRJrIa6k=";
   };
 
-  npmDepsHash = "sha256-y8PSiJm3U9i5XaIkC06N/vjm/+OnqAHASRAMHlOVsGU=";
+  npmDepsHash = "sha256-Utc/SknTuV706dNjVUwE6ad85O3Ud4HRVDBiKblgdw0=";
 
   dontNpmBuild = true;
 

pkgs/by-name/li/liquidwar/package.nix

@@ -90,21 +90,13 @@ stdenv.mkDerivation (finalAttrs: {
 
   hardeningDisable = [ "format" ];
 
-  env.NIX_CFLAGS_COMPILE = toString (
-    lib.optionals (stdenv.cc.isGNU && lib.versionAtLeast stdenv.cc.version "12") [
-      # Needed with GCC 12 but problematic with some old GCCs
-      "-Wno-error=address"
-      "-Wno-error=use-after-free"
-      "-std=gnu17"
-      # Fix build w/ glibc-2.44
-      "-Wno-error=discarded-qualifiers"
-    ]
-    ++ [
-      "-Wno-error=deprecated-declarations"
-      # Avoid GL_GLEXT_VERSION double definition
-      " -DNO_SDL_GLEXT"
-    ]
-  );
+  env.NIX_CFLAGS_COMPILE = toString [
+    # gcc-12 and above generate many benign warnings
+    "-Wno-error"
+    "-std=gnu17"
+    # Avoid GL_GLEXT_VERSION double definition
+    "-DNO_SDL_GLEXT"
+  ];
 
   # To avoid problems finding SDL_types.h.
   configureFlags = [ "CFLAGS=-I${lib.getDev SDL}/include/SDL" ];

pkgs/by-name/ma/macaulay2/package.nix

@@ -17,7 +17,6 @@
   cohomcalg,
   csdp,
   eigen,
-  emacs-nox,
   fflas-ffpack,
   flex,
   flint,
@@ -70,8 +69,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "Macaulay2";
     repo = "M2";
     tag = "release-${finalAttrs.version}";
-    hash = "sha256-2e39qzBO63Ft+yw+tJChLsupeinalTkDwXp3WBF2wms=";
-    fetchSubmodules = true;
+    hash = "sha256-kYxqbMKW+7r6nI4i3o7vvJVf0TGRVLaDviZTFx3PTBI=";
   };
 
   docs = fetchurl {
@@ -122,13 +120,14 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [
     autoreconfHook
     bison
-    emacs-nox
     flex
+    flint
     gdbm
     getconf
     gfortran
     makeWrapper
     pkg-config
+    R
     texinfo
     which
 
@@ -152,10 +151,10 @@ stdenv.mkDerivation (finalAttrs: {
 
   postPatch = ''
     sed -i 's/AC_SUBST(REL,.*uname -r.*)/AC_SUBST(REL,"")/' configure.ac
-    substituteInPlace configure.ac \
-      --replace-fail "[\$gfan_version], [ge], [0.8]" "[\$gfan_version], [ge], [0.6]"
-    substituteInPlace Macaulay2/packages/gfanInterface.m2 \
-      --replace-fail 'MinimumVersion => ("0.8"' 'MinimumVersion => ("0.6"'
+    # remove editor stuff from Makefiles
+    substituteInPlace Macaulay2/Makefile.in \
+      --replace-fail "all-in-editors" "" \
+      --replace-fail "editors" ""
   '';
 
   preConfigure = ''
@@ -286,6 +285,7 @@ stdenv.mkDerivation (finalAttrs: {
       decomposition of ideals, integral closure of rings, and more.
     '';
     homepage = "https://macaulay2.com/";
+    changelog = "https://macaulay2.com/doc/Macaulay2/share/doc/Macaulay2/Macaulay2Doc/html/_changes_cm_sp${finalAttrs.version}.html";
     license = lib.licenses.gpl3Only;
     maintainers = with lib.maintainers; [ coolcuber ];
     platforms = lib.platforms.linux ++ lib.platforms.darwin;

pkgs/by-name/ma/markuplinkchecker/package.nix

@@ -6,7 +6,7 @@
   openssl,
 }:
 let
-  version = "1.2.0";
+  version = "1.2.2";
 in
 rustPlatform.buildRustPackage {
   pname = "markuplinkchecker";
@@ -16,10 +16,10 @@ rustPlatform.buildRustPackage {
     owner = "becheran";
     repo = "mlc";
     rev = "v${version}";
-    hash = "sha256-6v4tRCtoABbb0bwOagEGHk2QoUs3u/AnME5g7vhbkI4=";
+    hash = "sha256-abm44HA/S8F7BBQDFOedx5FmNujeuBzjLKZwvW///gk=";
   };
 
-  cargoHash = "sha256-W4aOrKnRDAvHC4c+7e/XYSOgB/wFExqQhimaPJNiJk8=";
+  cargoHash = "sha256-KsVLRAWS96/CixiaXRo09BrYIn+RIIUI6ldge30H7Ow=";
 
   nativeBuildInputs = [ pkg-config ];
 

pkgs/by-name/ma/matrix-conduit/package.nix

@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "matrix-conduit";
-  version = "0.10.13";
+  version = "0.10.14";
 
   src = fetchFromGitLab {
     owner = "famedly";
     repo = "conduit";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-1j3q/n6sC3bIVwbcZfegJQO9WaLPfJWqgibO/XNmj6s=";
+    hash = "sha256-A7Gryk1ZWDu751n3rBfv9HUTiokoGhBol/ve9mWwRjA=";
   };
 
-  cargoHash = "sha256-YfgvcY1yYwlQuoEl21XEAxDR/SDce+OHhZOzp6tkzR0=";
+  cargoHash = "sha256-afYD2cR6VyFSa1M33ktuNcg2/r/Ag3HNKSz95gRCwuE=";
 
   # Conduit enables rusqlite's bundled feature by default, but we'd rather use our copy of SQLite.
   preBuild = ''

pkgs/by-name/mc/mcp-searxng/package.nix

@@ -6,7 +6,7 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "mcp-searxng";
-  version = "2.4.0";
+  version = "2.5.0";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -15,10 +15,10 @@ buildNpmPackage (finalAttrs: {
     owner = "ihor-sokoliuk";
     repo = "mcp-searxng";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-1ZGo6150O8cn2b4pYLqPWs+l11L+SpeH+ATKE470Hwo=";
+    hash = "sha256-yfxnYD1onNw5J6yLq2RxqAtlNnH319DWD1Zu3JM8eq0=";
   };
 
-  npmDepsHash = "sha256-21mw8/qUgLuAhF9KYZU7N+K4af7OBVwBHGqnr7p6lDE=";
+  npmDepsHash = "sha256-QhUqB/+R3BGwx8gH0MDn+PiMEtira3vZdosJj8oMsaI=";
 
   meta = {
     description = "Private web search for AI assistants via SearXNG — supports Claude, Cursor, and any MCP client";

pkgs/by-name/md/mdbook-rss-feed/package.nix

@@ -38,6 +38,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [
       matthiasbeyer
+      saylesss88
       pinage404
     ];
     mainProgram = "mdbook-rss-feed";

pkgs/by-name/mi/microsoft-edge/update.sh

@@ -215,10 +215,11 @@ update_msedgedriver() {
     # msedgedriver/package.nix
     declare -A hashes=(
         [mac64_m1]=""
+        [mac64]=""
         [linux64]=""
     )
 
-    for driver_arch in mac64_m1 linux64; do
+    for driver_arch in mac64_m1 mac64 linux64; do
         url="https://msedgedriver.microsoft.com/${version}/edgedriver_${driver_arch}.zip"
 
         new_hash="$(
@@ -238,7 +239,7 @@ update_msedgedriver() {
         "/pname = \"msedgedriver\";/,/^  meta = {/s/version = \".*\"/version = \"$version\"/" \
         "$DRIVER_NIX"
 
-    for driver_arch in mac64_m1 linux64; do
+    for driver_arch in mac64_m1 mac64 linux64; do
         sed -i \
             "/pname = \"msedgedriver\";/,/^  meta = {/s|${driver_arch} = \".*\"|${driver_arch} = \"${hashes[$driver_arch]}\"|" \
             "$DRIVER_NIX"

pkgs/by-name/mi/mithril/package.nix

@@ -9,7 +9,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mithril";
-  version = "0.1.3";
+  version = "0.2.1";
   __structuredAttrs = true;
   strictDeps = true;
 
@@ -17,7 +17,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "nmatt0";
     repo = "mithril";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-GsJFTsW34e1W4b+zBmy9XfY2y/eGdsg0YANZAd733i4=";
+    hash = "sha256-j0bdYI08yv6QUgMoVI8fGiTkFPg1LMjFjCpUGfUnx5M=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/by-name/mo/moria/package.nix

@@ -13,7 +13,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "moria";
-  version = "0.1.0";
+  version = "0.2.1";
   __structuredAttrs = true;
   strictDeps = true;
 
@@ -21,7 +21,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "nmatt0";
     repo = "moria";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-tzBJEUl2AbzZh4exjlhw7yv4JsgTj80DYngoRofJjgY=";
+    hash = "sha256-okeAzE2qUO6i1a4kyp+IjsH7OOyBCAMQv+dzgBR73o8=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/by-name/mo/mosh/package.nix

@@ -9,10 +9,10 @@
   makeWrapper,
   perl,
   openssl,
+  autoconf-archive,
   autoreconfHook,
   openssh,
   bash-completion,
-  fetchpatch,
   withUtempter ? stdenv.hostPlatform.isLinux,
   libutempter,
   # build server binary only when set to false (useful for perlless systems)
@@ -31,6 +31,7 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   nativeBuildInputs = [
+    autoconf-archive
     autoreconfHook
     pkg-config
     makeWrapper
@@ -58,15 +59,15 @@ stdenv.mkDerivation (finalAttrs: {
     ./mosh-client_path.patch
     # Fix build with bash-completion 2.10
     ./bash_completion_datadir.patch
-
-    # Fixes build with protobuf3 23.x
-    (fetchpatch {
-      url = "https://github.com/mobile-shell/mosh/commit/eee1a8cf413051c2a9104e8158e699028ff56b26.patch";
-      hash = "sha256-CouLHWSsyfcgK3k7CvTK3FP/xjdb1pfsSXYYQj3NmCQ=";
-    })
   ];
 
+  # remove the m4 directory, as it contains only ancient versions of macros
+  # from autoconf-archive or pkg-config. instead, we fetch up-to-date versions
+  # from the packages which provide them. this allows selecting modern C++
+  # standard versions, which is important with e.g. GCC 16.
   postPatch = ''
+    rm -rf m4
+
     substituteInPlace scripts/mosh.pl \
       --subst-var-by ssh "${openssh}/bin/ssh" \
       --subst-var-by mosh-client "$out/bin/mosh-client"

pkgs/by-name/ms/msedgedriver/package.nix

@@ -19,6 +19,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
       driverArch =
         {
           aarch64-darwin = "mac64_m1";
+          x86_64-darwin = "mac64";
           x86_64-linux = "linux64";
         }
         .${stdenvNoCC.hostPlatform.system};
@@ -28,6 +29,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
       hash =
         {
           mac64_m1 = "sha256-6nwe/vRPh5MkQLTiZNXepfFsLtILwoK925mgLCUUVNg=";
+          mac64 = "sha256-p/cnNKQub6sSEWPz2fJ+FoU7rgzeoZQMkv3PphvvHLw=";
           linux64 = "sha256-XbOQl9FyckF3Qybb+40474ImJDKahBkekPoydf/TxV0=";
         }
         .${driverArch};

pkgs/by-name/mu/mullvad-browser/package.nix

@@ -97,7 +97,7 @@ let
     ++ lib.optionals mediaSupport [ ffmpeg_7 ]
   );
 
-  version = "15.0.23";
+  version = "15.0.24";
 
   sources = {
     x86_64-linux = fetchurl {
@@ -109,7 +109,7 @@ let
         "https://tor.eff.org/dist/mullvadbrowser/${version}/mullvad-browser-linux-x86_64-${version}.tar.xz"
         "https://tor.calyxinstitute.org/dist/mullvadbrowser/${version}/mullvad-browser-linux-x86_64-${version}.tar.xz"
       ];
-      hash = "sha256-Bzd0atOeqHFhmIlpN3cbGogkwg6SwpNhn5m4yscpIzo=";
+      hash = "sha256-vKVlZ2t9S66AZQ82fUw+csRQtMvOJLrJbbetS33Fb+o=";
     };
   };