.github: Bump actions/checkout from 6.0.3 to 7.0.1

Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.3 to 7.0.1. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](df4cb1c069...3d3c42e5aa) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
2026-07-25 10:00:28 +00:00 · 2026-07-24 11:22:46 +00:00
249 changed files with 1493 additions and 1866 deletions
--- a/.github/workflows/backport.yml
+++ b/.github/workflows/backport.yml
@@ -36,7 +36,7 @@ jobs:
          permission-pull-requests: write
          permission-workflows: write

-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          token: ${{ steps.app-token.outputs.token }}
--- a/.github/workflows/bot.yml
+++ b/.github/workflows/bot.yml
@@ -42,7 +42,7 @@ jobs:
    runs-on: ubuntu-slim
    if: github.event_name != 'schedule' || github.repository_owner == 'NixOS'
    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          sparse-checkout: |
@@ -88,7 +88,7 @@ jobs:
          GH_TOKEN: ${{ steps.app-token.outputs.token || github.token }}
        run: gh api /rate_limit | jq

-      - uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13 # v7.0.0
+      - uses: actions/labeler@b8dd2d9be0f68b860e7dae5dae7d772984eacd6d # v6.2.0
        name: Labels from touched files
        if: |
          github.event_name == 'pull_request_target' &&
@@ -98,7 +98,7 @@ jobs:
          configuration-path: .github/labeler.yml # default
          sync-labels: true

-      - uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13 # v7.0.0
+      - uses: actions/labeler@b8dd2d9be0f68b860e7dae5dae7d772984eacd6d # v6.2.0
        name: Labels from touched files (no sync)
        if: |
          github.event_name == 'pull_request_target' &&
@@ -108,7 +108,7 @@ jobs:
          configuration-path: .github/labeler-no-sync.yml
          sync-labels: false

-      - uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13 # v7.0.0
+      - uses: actions/labeler@b8dd2d9be0f68b860e7dae5dae7d772984eacd6d # v6.2.0
        name: Labels from touched files (development branches)
        # Development branches like staging-next, haskell-updates and python-updates get special labels.
        # This is to avoid the mass of labels there, which is mostly useless - and really annoying for
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -49,7 +49,7 @@ jobs:
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 60
    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          sparse-checkout: .github/actions
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -43,7 +43,7 @@ jobs:
    runs-on: ubuntu-slim
    timeout-minutes: 3
    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          path: trusted
@@ -96,7 +96,7 @@ jobs:
    runs-on: ubuntu-24.04-arm
    timeout-minutes: 8
    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          path: trusted
@@ -138,7 +138,7 @@ jobs:
    runs-on: ubuntu-24.04-arm
    timeout-minutes: 5
    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          sparse-checkout: .github/actions
--- a/.github/workflows/comment.yml
+++ b/.github/workflows/comment.yml
@@ -23,7 +23,7 @@ jobs:
    timeout-minutes: 2
    if: contains(github.event.comment.body, '@NixOS/nixpkgs-merge-bot merge')
    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          sparse-checkout: |
--- a/.github/workflows/eval.yml
+++ b/.github/workflows/eval.yml
@@ -50,7 +50,7 @@ jobs:
      ciPinBumpCommit: ${{ steps.find-pinned-commit.outputs.ciPinBumpCommit }}
      ciPinBumpCommitShort: ${{ steps.find-pinned-commit.outputs.ciPinBumpCommitShort }}
    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          path: trusted
@@ -58,7 +58,7 @@ jobs:
            ci/supportedVersions.nix

      - name: Check out the PR at the test merge commit
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          ref: ${{ inputs.mergedSha }}
@@ -174,7 +174,7 @@ jobs:
          sudo mkswap /swap
          sudo swapon /swap

-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          sparse-checkout: .github/actions
@@ -259,7 +259,7 @@ jobs:
      statuses: write # creating 'Eval Summary' commit statuses
    timeout-minutes: 5
    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          sparse-checkout: .github/actions
@@ -476,7 +476,7 @@ jobs:
    runs-on: ubuntu-24.04-arm
    timeout-minutes: 10
    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          sparse-checkout: .github/actions
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -26,7 +26,7 @@ jobs:
    runs-on: ubuntu-24.04-arm
    timeout-minutes: 10
    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          sparse-checkout: .github/actions
@@ -61,7 +61,7 @@ jobs:
    runs-on: ubuntu-24.04-arm
    timeout-minutes: 10
    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          sparse-checkout: .github/actions
@@ -90,7 +90,7 @@ jobs:
    runs-on: ubuntu-24.04-arm
    timeout-minutes: 10
    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          sparse-checkout: .github/actions
@@ -134,7 +134,7 @@ jobs:
    runs-on: ubuntu-24.04-arm
    timeout-minutes: 8
    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: true # Needed to run git fetch for large PRs.
          path: trusted
--- a/.github/workflows/merge-group.yml
+++ b/.github/workflows/merge-group.yml
@@ -25,7 +25,7 @@ jobs:
      targetSha: ${{ steps.prepare.outputs.targetSha }}
      systems: ${{ steps.prepare.outputs.systems }}
    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          sparse-checkout: |
--- a/.github/workflows/periodic-merge.yml
+++ b/.github/workflows/periodic-merge.yml
@@ -34,7 +34,7 @@ jobs:
          permission-contents: write
          permission-pull-requests: write

-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

--- a/.github/workflows/pull-request-target.yml
+++ b/.github/workflows/pull-request-target.yml
@@ -36,7 +36,7 @@ jobs:
      systems: ${{ steps.prepare.outputs.systems }}
      touched: ${{ steps.prepare.outputs.touched }}
    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          sparse-checkout-cone-mode: true # default, for clarity
--- a/.github/workflows/review.yml
+++ b/.github/workflows/review.yml
@@ -20,7 +20,7 @@ jobs:
    runs-on: ubuntu-slim
    timeout-minutes: 2
    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          sparse-checkout: |
--- a/.github/workflows/teams.yml
+++ b/.github/workflows/teams.yml
@@ -30,7 +30,7 @@ jobs:
          permission-pull-requests: write

      - name: Fetch source
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          sparse-checkout: |
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -19,7 +19,7 @@ jobs:
      push: ${{ steps.files.outputs.push }}
      targetSha: ${{ steps.prepare.outputs.targetSha }}
    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          sparse-checkout-cone-mode: true # default, for clarity
--- a/ci/pinned.json
+++ b/ci/pinned.json
@@ -9,22 +9,9 @@
      },
      "branch": "nixpkgs-unstable",
      "submodules": false,
-      "revision": "7525d999cd850b9a488817abc89c75dc733acf17",
-      "url": "https://github.com/NixOS/nixpkgs/archive/7525d999cd850b9a488817abc89c75dc733acf17.tar.gz",
-      "hash": "sha256-4IHyyLgLBdKefkljdKod4IMn023pQiDXAWJA187cmdY="
-    },
-    "nixpkgs-26.05-darwin": {
-      "type": "Git",
-      "repository": {
-        "type": "GitHub",
-        "owner": "NixOS",
-        "repo": "nixpkgs"
-      },
-      "branch": "nixpkgs-26.05-darwin",
-      "submodules": false,
-      "revision": "51fe96f9107566e6b8eeb7fc4ba696c01e548b04",
-      "url": "https://github.com/NixOS/nixpkgs/archive/51fe96f9107566e6b8eeb7fc4ba696c01e548b04.tar.gz",
-      "hash": "sha256-yj0LPLnsmYoLmA3FGANjeTEwej0/DHjZBXWnDQDUuIs="
+      "revision": "421eebfd0ec7bccd4abe826ce62d7e6e83129493",
+      "url": "https://github.com/NixOS/nixpkgs/archive/421eebfd0ec7bccd4abe826ce62d7e6e83129493.tar.gz",
+      "hash": "sha256:1lxfhfgiv1sz2v7fg43gny57sa6wf59n98q7ldsyb2p06f4sal7w"
    }
  },
  "version": 8
--- a/doc/build-helpers/testers.chapter.md
+++ b/doc/build-helpers/testers.chapter.md
@@ -741,7 +741,7 @@ Notable attributes:

 Compliance suite for [modular service](https://nixos.org/manual/nixos/unstable/#modular-services) integrations.

-Tests that a service manager integration correctly handles the portable modular services contract: `process.argv`, `process.environment` (including `null` values that unset a variable), sub-services, assertions, and warnings.
+Tests that a service manager integration correctly handles the portable modular services contract: `process.argv`, sub-services, assertions, and warnings.

 ### Return value {#tester-modularServiceCompliance-return}

--- a/flake.nix
+++ b/flake.nix
@@ -199,8 +199,7 @@
        && system != "riscv64-linux"
        # Exclude x86_64-freebsd because "Package ‘go-1.22.12-freebsd-amd64-bootstrap’ in /nix/store/0yw40qnrar3lvc5hax5n49abl57apjbn-source/pkgs/development/compilers/go/binary.nix:50 is not available on the requested hostPlatform"
        && system != "x86_64-freebsd"
-        # TODO: revert to importing fmt.pkg directly from ./ci when support for 26.05 ends
-      ) (forAllSystems (system: (import ./shell.nix { inherit system; }).formatter));
+      ) (forAllSystems (system: (import ./ci { inherit system; }).fmt.pkg));

      /**
        A nested structure of [packages](https://nix.dev/manual/nix/latest/glossary#package-attribute-set) and other values.
--- a/lib/services/service.nix
+++ b/lib/services/service.nix
@@ -70,26 +70,6 @@ in
          Command used for reloading in the underlying service manager to reload.
        '';
      };
-
-      environment = lib.mkOption {
-        type = types.lazyAttrsOf (
-          types.nullOr (types.coercedTo (types.either types.path types.package) (x: "${x}") types.str)
-        );
-        default = { };
-        example = lib.literalExpression ''{ FOO = "bar"; PATH = null; }'';
-        description = ''
-          Environment variables passed verbatim to the service process by the
-          service manager. Entries set to `null` actively unset the variable
-          before the process starts -- backends without native unset support use
-          a wrapper (e.g. `execline`'s `unexport`) so the variable is absent
-          even when the service manager or a backend-specific override would
-          otherwise supply it.
-
-          Values appear in the rendered unit and may be world-readable. For
-          secrets, use a backend-specific mechanism such as
-          `systemd.service.serviceConfig.EnvironmentFile`.
-        '';
-      };
    };

    notificationProtocol = mkOption {
--- a/lib/services/test.nix
+++ b/lib/services/test.nix
@@ -48,10 +48,6 @@ let
            (dummyPkg "cowsay.sh")
            "world"
          ];
-          environment = {
-            FOO = "bar";
-            DROPPED = null;
-          };
        };
      };
      service3 = {
@@ -114,7 +110,6 @@ let
                "/usr/bin/echo"
                "hello"
              ];
-              environment = { };
            };
            services = { };
            assertions = [
@@ -133,10 +128,6 @@ let
                "${dummyPkg "cowsay.sh"}"
                "world"
              ];
-              environment = {
-                FOO = "bar";
-                DROPPED = null;
-              };
            };
            services = { };
            assertions = [ ];
@@ -145,7 +136,6 @@ let
          service3 = {
            process = {
              argv = [ "/bin/false" ];
-              environment = { };
            };
            services.exclacow = {
              process = {
@@ -153,7 +143,6 @@ let
                  "${dummyPkg "cowsay-ng"}/bin/cowsay"
                  "!"
                ];
-                environment = { };
              };
              services = { };
              assertions = [
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -3423,6 +3423,13 @@
    githubId = 32903896;
    keys = [ { fingerprint = "CB5C 7B3C 3E6F 2A59 A583  A90A 8A60 0376 7BE9 5976"; } ];
  };
+  benesim = {
+    name = "Benjamin Isbarn";
+    email = "benjamin.isbarn@gmail.com";
+    github = "BeneSim";
+    githubId = 29384538;
+    keys = [ { fingerprint = "D35E C9CE E631 638F F1D8  B401 6F0E 410D C3EE D02"; } ];
+  };
  bengsparks = {
    email = "benjamin.sparks@protonmail.com";
    github = "bengsparks";
@@ -13574,12 +13581,6 @@
    name = "Jonas Wunderlich";
    matrix = "@matrix:03j.de";
  };
-  jonascarpay = {
-    name = "Jonas Carpay";
-    email = "jonascarpay@gmail.com";
-    github = "jonascarpay";
-    githubId = 3593851;
-  };
  jonasfranke = {
    name = "Jonas Franke";
    email = "info@jonasfranke.xyz";
@@ -29698,13 +29699,6 @@
    githubId = 116078858;
    keys = [ { fingerprint = "CDEA 7E04 69E3 0885 A754  4B05 0104 BC05 F41B 77B8"; } ];
  };
-  vherrmann = {
-    name = "Valentin Herrmann";
-    email = "me@valentin-herrmann.de";
-    github = "vherrmann";
-    githubId = 50072577;
-    keys = [ { fingerprint = "309D A29B 4070 FDFD C01A  3AB4 9E60 CB44 5C4B BC4C"; } ];
-  };
  videl = {
    email = "thibaut.smith@mailbox.org";
    github = "videl";
--- a/nixos/README-modular-services.md
+++ b/nixos/README-modular-services.md
@@ -43,7 +43,7 @@ When reviewing a modular service, you should check the following. Details and ra
 ### NixOS VM test

 See the initial [Modular Services PR](https://github.com/NixOS/nixpkgs/pull/372170) for an [example](https://github.com/NixOS/nixpkgs/pull/372170/files#diff-e7fe16489cf3cd08ecc22b2c7896039d407a329b75691c046c95447423b3153f) of a NixOS VM test.
-Best practices: keep tests minimal and focused (boot a VM, enable the service, and assert a basic request succeeds). For general guidance, see the [NixOS Tests chapter](https://nixos.org/manual/nixos/unstable/#sec-nixos-tests).
+TBD: describe best practices here.

 ### `_class = "service"`

--- a/nixos/doc/manual/default.nix
+++ b/nixos/doc/manual/default.nix
@@ -152,16 +152,7 @@ let
  };

  systemdServiceOptions = buildPackages.nixosOptionsDoc {
-    inherit
-      (evalModules {
-        modules = [
-          (modules.importApply ../../modules/system/service/systemd/service.nix {
-            pkgs = throw "nixos docs / systemdServiceOptions: Do not reference pkgs in docs";
-          })
-        ];
-      })
-      options
-      ;
+    inherit (evalModules { modules = [ ../../modules/system/service/systemd/service.nix ]; }) options;
    # TODO: filter out options that are not systemd-specific, maybe also change option prefix to just `service-opt-`?
    inherit revision warningsAreErrors;
    transformOptions =
--- a/nixos/lib/test-driver/src/test_driver/init.py
+++ b/nixos/lib/test-driver/src/test_driver/init.py
@@ -89,11 +89,6 @@ def main() -> None:
        type=Path,
        required=True,
    )
-    arg_parser.add_argument(
-        "--test-script",
-        help="path to a test script to run, taking precedence over the one defined in the config file",
-        type=Path,
-    )
    arg_parser.add_argument(
        "--keep-vm-state",
        help=argparse.SUPPRESS,
@@ -168,12 +163,8 @@ def main() -> None:
    if args.debug_hook_attach is not None:
        debugger = Debug(logger, args.debug_hook_attach)

-    config = load_driver_configuration(args.config)
-    if args.test_script is not None:
-        config.test_script = args.test_script
-
    with Driver(
-        config=config,
+        config=load_driver_configuration(args.config),
        out_dir=output_directory,
        logger=logger,
        keep_machine_state=args.keep_machine_state,
--- a/nixos/modules/programs/regreet.nix
+++ b/nixos/modules/programs/regreet.nix
@@ -15,13 +15,14 @@ in
      description = ''
        Enable ReGreet, a clean and customizable greeter for greetd.

-        By default enables {option}`services.greetd` and configures a
-        {command}`default_session` to launch ReGreet using the
-        {command}`cage` compositor.
+        To use ReGreet, {option}`services.greetd` has to be enabled and
+        {option}`services.greetd.settings.default_session` should contain the
+        appropriate configuration to launch
+        {option}`config.programs.regreet.package`. For examples, see the
+        [ReGreet Readme](https://github.com/rharish101/ReGreet#set-as-default-session).

-        See the
-        [ReGreet Readme](https://github.com/rharish101/ReGreet#set-as-default-session)
-        for other examples.
+        A minimal configuration that launches ReGreet in {command}`cage` is
+        enabled by this module by default.
      '';
    };

@@ -47,8 +48,8 @@ in
        [ "-s" "-d" "-m" "last" ]
      '';
      description = ''
-        Arguments to be passed to [cage](https://github.com/cage-kiosk/cage)
-        when using it as the default compositor.
+        Additional arguments to be passed to
+        [cage](https://github.com/cage-kiosk/cage).
      '';
    };

--- a/nixos/modules/rename.nix
+++ b/nixos/modules/rename.nix
@@ -403,11 +403,6 @@ in
      as the underlying package isn't being maintained. Working alternatives are
      libinput and synaptics.
    '')
-    (mkRemovedOptionModule [ "services" "xserver" "windowManager" "afterstep" ] ''
-      The services.xserver.windowManager.afterstep module and the corresponding
-      package have been removed from Nixpkgs because they were unmaintained
-      upstream.
-    '')
    (mkRemovedOptionModule [ "services" "xserver" "windowManager" "ragnarwm" ] ''
      The services.xserver.windowManager.ragnarwm module has been removed
      because the corresponding package was removed from nixpkgs.
--- a/nixos/modules/security/pam.nix
+++ b/nixos/modules/security/pam.nix
@@ -1422,6 +1422,7 @@ let
                modulePath = config.security.pam.pam_unixModulePath;
                settings = {
                  nullok = true;
+                  yescrypt = lib.mkIf config.security.pam.enableLegacySettings true;
                };
              }
              {
--- a/nixos/modules/services/display-managers/gdm.nix
+++ b/nixos/modules/services/display-managers/gdm.nix
@@ -577,6 +577,7 @@ in
              control = "requisite";
              modulePath = config.security.pam.pam_unixModulePath;
              settings.nullok = true;
+              settings.yescrypt = true;
            }
          ];

--- a/nixos/modules/services/display-managers/greetd.nix
+++ b/nixos/modules/services/display-managers/greetd.nix
@@ -1,7 +1,6 @@
 {
  config,
  lib,
-  utils,
  pkgs,
  ...
 }:
@@ -77,37 +76,9 @@ in
    services.greetd.settings.default_session.user = lib.mkDefault "greeter";

    security.pam.services.greetd = {
-      useDefaultRules = false;
-      rules = {
-        auth = utils.pam.autoOrderRules [
-          {
-            name = "login";
-            control = "substack";
-            modulePath = "login";
-          }
-        ];
-        account = utils.pam.autoOrderRules [
-          {
-            name = "login";
-            control = "include";
-            modulePath = "login";
-          }
-        ];
-        password = utils.pam.autoOrderRules [
-          {
-            name = "login";
-            control = "substack";
-            modulePath = "login";
-          }
-        ];
-        session = utils.pam.autoOrderRules [
-          {
-            name = "login";
-            control = "include";
-            modulePath = "login";
-          }
-        ];
-      };
+      allowNullPassword = true;
+      startSession = true;
+      enableGnomeKeyring = lib.mkDefault config.services.gnome.gnome-keyring.enable;
    };

    # This prevents nixos-rebuild from killing greetd by activating getty again
--- a/nixos/modules/services/display-managers/ly.nix
+++ b/nixos/modules/services/display-managers/ly.nix
@@ -100,37 +100,9 @@ in

    security.pam.services = {
      ly = {
-        useDefaultRules = false;
-        rules = {
-          auth = utils.pam.autoOrderRules [
-            {
-              name = "login";
-              control = "substack";
-              modulePath = "login";
-            }
-          ];
-          account = utils.pam.autoOrderRules [
-            {
-              name = "login";
-              control = "include";
-              modulePath = "login";
-            }
-          ];
-          password = utils.pam.autoOrderRules [
-            {
-              name = "login";
-              control = "substack";
-              modulePath = "login";
-            }
-          ];
-          session = utils.pam.autoOrderRules [
-            {
-              name = "login";
-              control = "include";
-              modulePath = "login";
-            }
-          ];
-        };
+        startSession = true;
+        unixAuth = true;
+        enableGnomeKeyring = lib.mkDefault config.services.gnome.gnome-keyring.enable;
      };
    }
    // optionalAttrs dmcfg.autoLogin.enable {
--- a/nixos/modules/services/x11/display-managers/lightdm.nix
+++ b/nixos/modules/services/x11/display-managers/lightdm.nix
@@ -458,6 +458,7 @@ in
            control = "requisite";
            modulePath = config.security.pam.pam_unixModulePath;
            settings.nullok = true;
+            settings.yescrypt = true;
          }
        ];

--- a/nixos/modules/services/x11/window-managers/afterstep.nix
+++ b/nixos/modules/services/x11/window-managers/afterstep.nix
@@ -0,0 +1,30 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+with lib;
+
+let
+  cfg = config.services.xserver.windowManager.afterstep;
+in
+{
+  ###### interface
+  options = {
+    services.xserver.windowManager.afterstep.enable = mkEnableOption "afterstep";
+  };
+
+  ###### implementation
+  config = mkIf cfg.enable {
+    services.xserver.windowManager.session = singleton {
+      name = "afterstep";
+      start = ''
+        ${pkgs.afterstep}/bin/afterstep &
+        waitPID=$!
+      '';
+    };
+    environment.systemPackages = [ pkgs.afterstep ];
+  };
+}
--- a/nixos/modules/services/x11/window-managers/default.nix
+++ b/nixos/modules/services/x11/window-managers/default.nix
@@ -8,6 +8,7 @@ in
 {
  imports = [
    ./2bwm.nix
+    ./afterstep.nix
    ./berry.nix
    ./bspwm.nix
    ./cwm.nix
--- a/nixos/modules/system/boot/resolved.nix
+++ b/nixos/modules/system/boot/resolved.nix
@@ -30,9 +30,8 @@ let

  dnsmasqResolve = config.services.dnsmasq.enable && config.services.dnsmasq.resolveLocalQueries;

-  transformSettings =
-    settings:
-    lib.mapAttrs (
+  transformSettings = settings: {
+    Resolve = lib.mapAttrs (
      key: value:
      # concat lists for options that should result in space-separated values
      if
@@ -46,9 +45,10 @@ let
        concatStringsSep " " value
      else
        value
-    ) settings;
+    ) settings.Resolve;
+  };

-  resolvedConf = settingsToSections { Resolve = transformSettings cfg.settings.Resolve; };
+  resolvedConf = settingsToSections (transformSettings cfg.settings);
 in
 {
  imports = [
--- a/nixos/modules/system/service/systemd/service.nix
+++ b/nixos/modules/system/service/systemd/service.nix
@@ -1,9 +1,3 @@
-# Non-module arguments
-# These are separate from the module arguments to avoid implicit dependencies.
-# This makes service modules self-contained, allowing mixing of Nixpkgs versions.
-{ pkgs }:
-
-# The module
 {
  lib,
  config,
@@ -98,11 +92,6 @@ in
        to prevent systemd substitution. Set this option explicitly to enable
        systemd's substitution features.

-        When {option}`process.environment` contains keys set to `null`, the default
-        is automatically prefixed with `unexport KEY` invocations (from
-        `pkgs.execline`) so those variables are unset before the process starts,
-        regardless of what `Environment=` or inherited environment supplies.
-
        To extend {option}`process.argv` with systemd specifiers, you can append
        to the escaped arguments:

@@ -120,19 +109,8 @@ in
        for available specifiers like `%n`, `%i`, `%t`.
      '';
      type = types.str;
-      default =
-        let
-          nullEnvKeys = lib.attrNames (lib.filterAttrs (_: v: v == null) config.process.environment);
-        in
-        if nullEnvKeys == [ ] then
-          config.systemd.lib.escapeSystemdExecArgs config.process.argv
-        else
-          lib.concatMapStringsSep " " (
-            k: "${escapeSystemdExecArg "${pkgs.execline}/bin/unexport"} ${escapeSystemdExecArg k}"
-          ) nullEnvKeys
-          + " "
-          + config.systemd.lib.escapeSystemdExecArgs config.process.argv;
-      defaultText = lib.literalMD "The escaped `process.argv`, prefixed with `\"unexport\" \"KEY\"` (from `pkgs.execline`) for each key in `process.environment` set to `null`.";
+      default = config.systemd.lib.escapeSystemdExecArgs config.process.argv;
+      defaultText = lib.literalExpression "config.systemd.lib.escapeSystemdExecArgs config.process.argv";
    };

    systemd.mainExecReload = mkOption {
@@ -209,7 +187,7 @@ in
        types.submoduleWith {
          class = "service";
          modules = [
-            (lib.modules.importApply ./service.nix { inherit pkgs; })
+            ./service.nix
          ];
          specialArgs = {
            inherit systemdPackage;
@@ -229,9 +207,6 @@ in
    systemd.services."" = {
      # TODO description;
      wantedBy = lib.mkDefault [ "multi-user.target" ];
-      environment = lib.mapAttrs (_: lib.mkDefault) (
-        lib.filterAttrs (_: v: v != null) config.process.environment
-      );
      serviceConfig = {
        ExecReload = config.systemd.mainExecReload;
        Type = lib.mkDefault (if config.notificationProtocol.systemd then "notify" else "simple");
--- a/nixos/modules/system/service/systemd/system.nix
+++ b/nixos/modules/system/service/systemd/system.nix
@@ -63,7 +63,7 @@ let
  modularServiceConfiguration = portable-lib.configure {
    serviceManagerPkgs = pkgs;
    extraRootModules = [
-      (lib.modules.importApply ./service.nix { inherit pkgs; })
+      ./service.nix
      ./config-data-path.nix
    ];
    extraRootSpecialArgs = {
--- a/nixos/modules/system/service/systemd/test.nix
+++ b/nixos/modules/system/service/systemd/test.nix
@@ -76,40 +76,6 @@ let
        };
      };

-      # Test that `process.environment` becomes `Environment=` entries on the unit,
-      # that null values are dropped from `Environment=` and wrapped with unexport
-      # in `ExecStart`.
-      system.services.envvars = {
-        process = {
-          argv = [ hello' ];
-          environment = {
-            FOO = "bar";
-            BAZ = "qux";
-            DROPPED = null;
-          };
-        };
-      };
-
-      # Test that an explicit `systemd.service.environment` override wins over
-      # the portable default produced by `process.environment`.
-      system.services.envvars-override = {
-        process = {
-          argv = [ hello' ];
-          environment.FOO = "from-process";
-        };
-        systemd.service.environment.FOO = "from-systemd";
-      };
-
-      # Test that `process.environment` `null` unsets via wrapper even when the
-      # systemd layer sets the same key (true unset, not just "skip setting").
-      system.services.envvars-unset = {
-        process = {
-          argv = [ hello' ];
-          environment.FOO = null;
-        };
-        systemd.service.environment.FOO = "leaked";
-      };
-
      # Test extending process.argv with systemd specifiers
      system.services.argv-extended =
        { config, ... }:
@@ -171,22 +137,6 @@ runCommand "test-modular-service-systemd-units"
      # The base command should be escaped ($1 -> $$1, m%n -> m%%n), but the appended --systemd-unit %n should not be
      grep -F 'ExecStart="${hello}/bin/hello" "--greeting" "Fun $$1 fact, remainder is often expressed as m%%n" --systemd-unit %n' ${toplevel}/etc/systemd/system/argv-extended.service >/dev/null

-      # process.environment becomes Environment= entries; null values are dropped
-      # from Environment= and wrapped with unexport in ExecStart.
-      grep -F 'Environment="FOO=bar"' ${toplevel}/etc/systemd/system/envvars.service >/dev/null
-      grep -F 'Environment="BAZ=qux"' ${toplevel}/etc/systemd/system/envvars.service >/dev/null
-      ! grep -F 'Environment=.*DROPPED' ${toplevel}/etc/systemd/system/envvars.service
-      grep 'ExecStart=.*unexport.*DROPPED' ${toplevel}/etc/systemd/system/envvars.service >/dev/null
-
-      # systemd.service.environment override wins over process.environment.
-      grep -F 'Environment="FOO=from-systemd"' ${toplevel}/etc/systemd/system/envvars-override.service >/dev/null
-      ! grep -F 'FOO=from-process' ${toplevel}/etc/systemd/system/envvars-override.service
-
-      # process.environment null uses unexport wrapper for true unset, even when
-      # the systemd layer has an Environment= entry for the same key.
-      grep -F 'Environment="FOO=leaked"' ${toplevel}/etc/systemd/system/envvars-unset.service >/dev/null
-      grep 'ExecStart=.*unexport.*FOO' ${toplevel}/etc/systemd/system/envvars-unset.service >/dev/null
-
      [[ ! -e ${toplevel}/etc/systemd/system/foo.socket ]]
      [[ ! -e ${toplevel}/etc/systemd/system/bar.socket ]]
      [[ ! -e ${toplevel}/etc/systemd/system/bar-db.socket ]]
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -153,7 +153,6 @@ in
    console-log = runTest ./nixos-test-driver/console-log.nix;
    containers = runTest ./nixos-test-driver/containers.nix;
    nspawn-daemon-reexec-dbus = runTest ./nspawn-daemon-reexec-dbus.nix;
-    multi-arch-test = runTest ./nixos-test-driver/multi-arch-test.nix;
    skip-typecheck = runTest ./nixos-test-driver/skip-typecheck.nix;
    console-timeout = runTest ./nixos-test-driver/console-timeout.nix;
    options-doc-regression = import ./nixos-test-driver/options-doc-regression.nix { inherit pkgs; };
--- a/nixos/tests/login-nosuid.nix
+++ b/nixos/tests/login-nosuid.nix
@@ -57,7 +57,6 @@
    with subtest("create user"):
        machine.succeed("useradd -m alice")
        machine.succeed("(echo foobar; echo foobar) | passwd alice")
-        machine.succeed("grep -F 'alice:$y$' /etc/shadow")

    with subtest("Check whether switching VTs works"):
        machine.fail("pgrep -f 'agetty.*tty2'")
--- a/nixos/tests/login.nix
+++ b/nixos/tests/login.nix
@@ -28,7 +28,6 @@
    with subtest("create user"):
        machine.succeed("useradd -m alice")
        machine.succeed("(echo foobar; echo foobar) | passwd alice")
-        machine.succeed("grep -F 'alice:$y$' /etc/shadow")

    with subtest("Check whether switching VTs works"):
        machine.fail("pgrep -f 'agetty.*tty2'")
--- a/nixos/tests/nixos-test-driver/multi-arch-test.nix
+++ b/nixos/tests/nixos-test-driver/multi-arch-test.nix
@@ -1,55 +0,0 @@
-{ pkgs, lib, ... }:
-{
-  name = "multi-arch-test";
-  meta.maintainers = with pkgs.lib.maintainers; [ tfc ];
-
-  node.pkgsReadOnly = false;
-
-  nodes = {
-    # Setting build = host platform because such standard VM setups
-    # are well-cached by the multi-arch build infrastructure of the
-    # project.
-    vmIntel = {
-      nixpkgs.buildPlatform = "x86_64-linux";
-      nixpkgs.hostPlatform = "x86_64-linux";
-    };
-    vmArm = {
-      nixpkgs.buildPlatform = "aarch64-linux";
-      nixpkgs.hostPlatform = "aarch64-linux";
-    };
-  };
-
-  defaults = {
-    # not needed for this test and shrinks the closure
-    # because we dont' need qemu for all architectures
-    virtualisation.qemu.guestAgent.enable = false;
-
-    # the test is already very slow but we don't need DHCP anyway
-    networking.dhcpcd.enable = false;
-
-    # fix the network-online target, otherwise it doesn't work
-    # properly as a synchronization mechanism.
-    systemd.network.wait-online.enable = true;
-    systemd.network.wait-online.anyInterface = true;
-  };
-
-  # slow due to SW emulation but shouldn't be slower than that
-  globalTimeout = 5 * 60;
-
-  testScript = { nodes, ... }: /* python */ ''
-    start_all()
-
-    vmIntel.systemctl("start network-online.target")
-    vmArm.systemctl("start network-online.target")
-    vmIntel.wait_for_unit("network-online.target")
-    vmArm.wait_for_unit("network-online.target")
-
-    vmIntel.succeed("ping -c 1 vmArm")
-    vmArm.succeed("ping -c 1 vmIntel")
-
-    archIntel = vmIntel.succeed("uname -m")
-    t.assertIn("${nodes.vmIntel.nixpkgs.hostPlatform.qemuArch}", archIntel, "machine1 is an intel VM")
-    archArm = vmArm.succeed("uname -m")
-    t.assertIn("${nodes.vmArm.nixpkgs.hostPlatform.qemuArch}", archArm, "machine1 is an ARM VM")
-  '';
-}
--- a/nixos/tests/vaultwarden.nix
+++ b/nixos/tests/vaultwarden.nix
@@ -91,9 +91,6 @@ let

              click_when_unobstructed((By.XPATH, "//a[contains(., 'Skip to web app')]"))

-              # Skip the tour on first login
-              click_when_unobstructed((By.XPATH, "//button[contains(., 'Skip')]"))
-
              click_when_unobstructed((By.XPATH, "//button[contains(., 'New item')]"))

              driver.find_element(By.XPATH, '//input[@formcontrolname="name"]').send_keys(
--- a/pkgs/applications/editors/android-studio/default.nix
+++ b/pkgs/applications/editors/android-studio/default.nix
@@ -16,9 +16,9 @@ let
      inherit tiling_wm;
    };
  stableVersion = {
-    version = "2026.1.2.11"; # "Android Studio Quail 2 | 2026.1.2 Patch 1"
-    sha256Hash = "sha256-HMnNVPQA27DQeITw98DKtSTbXOCl73CyOu1v3TzURbk=";
-    url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2026.1.2.11/android-studio-quail2-patch1-linux.tar.gz";
+    version = "2026.1.2.10"; # "Android Studio Quail 2 | 2026.1.2"
+    sha256Hash = "sha256-ZERaVAkucFbG638aia0RbQ/uwu9flluOWU1iq9tYWQ8=";
+    url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2026.1.2.10/android-studio-quail2-linux.tar.gz";
  };
  betaVersion = {
    version = "2026.1.3.5"; # "Android Studio Quail 3 | 2026.1.3 RC 1"
--- a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/ghostel/package.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/ghostel/package.nix
@@ -12,46 +12,6 @@
 let
  zig = zig_0_15;

-  mkModule =
-    {
-      pname,
-      version,
-      src,
-      zigDeps,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      inherit
-        pname
-        version
-        src
-        zigDeps
-        ;
-
-      nativeBuildInputs = [ zig ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ xcbuild ];
-
-      env.EMACS_INCLUDE_DIR = "${emacs}/include";
-
-      dontSetZigDefaultFlags = true;
-
-      doCheck = true;
-
-      zigCheckFlags = [
-        "-Dcpu=baseline"
-        # See https://github.com/ghostty-org/ghostty/blob/main/PACKAGING.md#build-options
-        "-Doptimize=ReleaseFast"
-      ];
-
-      zigBuildFlags = finalAttrs.zigCheckFlags;
-
-      postConfigure = ''
-        cp -rLT ${finalAttrs.zigDeps} "$ZIG_GLOBAL_CACHE_DIR/p"
-        chmod -R u+w "$ZIG_GLOBAL_CACHE_DIR/p"
-      '';
-    });
-
-  libExt = stdenv.hostPlatform.extensions.sharedLibrary;
-in
-melpaBuild (finalAttrs: {
  pname = "ghostel";

  version = "0.44.0";
@@ -59,37 +19,59 @@ melpaBuild (finalAttrs: {
  src = fetchFromGitHub {
    owner = "dakra";
    repo = "ghostel";
-    tag = "v${finalAttrs.version}";
+    tag = "v${version}";
    hash = "sha256-vRGZoQtjsL42ga07fOfEjccKRidAhqgwHBoKs++62Ls=";
  };

-  # this can be put into mkModule, but we put it here to ease user overrideAttrs
-  zigDeps = zig.fetchDeps {
-    inherit (finalAttrs) src pname version;
-    fetchAll = true;
-    hash = "sha256-yrVgiofdmVjTGJ+PGPGRCc8gb/JcEca1uAzIoPgHHqU=";
-  };
+  module = stdenv.mkDerivation (finalAttrs: {
+    inherit pname version src;
+
+    deps = zig.fetchDeps {
+      inherit (finalAttrs) src pname version;
+      fetchAll = true;
+      hash = "sha256-yrVgiofdmVjTGJ+PGPGRCc8gb/JcEca1uAzIoPgHHqU=";
+    };
+
+    nativeBuildInputs = [ zig ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ xcbuild ];
+
+    env.EMACS_INCLUDE_DIR = "${emacs}/include";
+
+    dontSetZigDefaultFlags = true;
+
+    doCheck = true;
+
+    zigCheckFlags = [
+      "-Dcpu=baseline"
+      # See https://github.com/ghostty-org/ghostty/blob/main/PACKAGING.md#build-options
+      "-Doptimize=ReleaseFast"
+    ];
+
+    zigBuildFlags = finalAttrs.zigCheckFlags;
+
+    postConfigure = ''
+      cp -rLT ${finalAttrs.deps} "$ZIG_GLOBAL_CACHE_DIR/p"
+      chmod -R u+w "$ZIG_GLOBAL_CACHE_DIR/p"
+    '';
+  });
+
+  libExt = stdenv.hostPlatform.extensions.sharedLibrary;
+in
+melpaBuild {
+  inherit pname version src;

  files = ''
    (:defaults "etc" "ghostel-module${libExt}" "ghostel-module.version")
  '';

  preBuild = ''
-    install ${finalAttrs.finalPackage.module}/ghostel-module${libExt} ghostel-module${libExt}
-    install --mode=444 ${finalAttrs.finalPackage.module}/ghostel-module.version ghostel-module.version
+    install ${module}/ghostel-module${libExt} ghostel-module${libExt}
+    install --mode=444 ${module}/ghostel-module.version ghostel-module.version
  '';

  passthru = {
    updateScript = nix-update-script { };

-    module = mkModule {
-      pname = "${finalAttrs.pname}-module";
-      inherit (finalAttrs)
-        version
-        src
-        zigDeps
-        ;
-    };
+    inherit module;
  };

  meta = {
@@ -101,4 +83,4 @@ melpaBuild (finalAttrs: {
    ];
    license = lib.licenses.gpl3Plus;
  };
-})
+}
--- a/pkgs/applications/editors/emacs/sources.nix
+++ b/pkgs/applications/editors/emacs/sources.nix
@@ -107,10 +107,10 @@ in
 {
  emacs31 = import ./make-emacs.nix (mkArgs {
    pname = "emacs";
-    version = "31.0.91";
+    version = "31.0.90";
    variant = "mainline";
-    rev = "emacs-31.0.91";
-    hash = "sha256-3nvCiLiEtII1C57CLfDIbVqhiwadYViF9Nv32yDtLIQ=";
+    rev = "emacs-31.0.90";
+    hash = "sha256-Rzlnn+NKQ+jICXLNop27RnVInq79myn4hueJieDO2Ck=";
  });

  emacs30 = import ./make-emacs.nix (mkArgs {
--- a/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix
@@ -21,22 +21,22 @@ vscode-utils.buildVscodeMarketplaceExtension (finalAttrs: {
      sources = {
        "x86_64-linux" = {
          arch = "linux-x64";
-          hash = "sha256-Z/tQ+KV+3MdbknA/1kmiIpVfOsUM8NUu+0iHlPVbYV0=";
+          hash = "sha256-Y6MXjJBmhMzuQMwhkPLHK/vtciTdjsGvkEblH3ofju0=";
        };
        "aarch64-linux" = {
          arch = "linux-arm64";
-          hash = "sha256-d2GjWr0FHOoORI5KRdwUQvcFfBB8xV6j9wj5OS9VL9o=";
+          hash = "sha256-8VvDtb+8SoLTRC7pXwH40amRurxTQgCmhdi0u7e5AfU=";
        };
        "aarch64-darwin" = {
          arch = "darwin-arm64";
-          hash = "sha256-dlfGTxf2EoiNb0g9uqwjTNW8fi2d1tzubGdIDyp4xTw=";
+          hash = "sha256-bqjEgsjY+zyG1g/KtkRNxAlazIpc+HwGWvsMQNnPI2M=";
        };
      };
    in
    {
      name = "claude-code";
      publisher = "anthropic";
-      version = "2.1.219";
+      version = "2.1.218";
    }
    // sources.${stdenvNoCC.hostPlatform.system}
      or (throw "Unsupported system ${stdenvNoCC.hostPlatform.system}");
--- a/pkgs/applications/editors/vscode/extensions/dbaeumer.vscode-eslint/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/dbaeumer.vscode-eslint/default.nix
@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
  mktplcRef = {
    name = "vscode-eslint";
    publisher = "dbaeumer";
-    version = "3.0.34";
-    hash = "sha256-ynCPFzne4YS4WNjQSmGky+e2IaE3SLxj6FkjKyLPcAs=";
+    version = "3.0.24";
+    hash = "sha256-ZQVzpSSLf3tpO4QtLjbCOje3L5/EqzT9A9IOssl6e54=";
  };

  meta = {
--- a/pkgs/applications/networking/browsers/chromium/info.json
+++ b/pkgs/applications/networking/browsers/chromium/info.json
@@ -837,7 +837,7 @@
    }
  },
  "ungoogled-chromium": {
-    "version": "150.0.7871.186",
+    "version": "150.0.7871.181",
    "deps": {
      "depot_tools": {
        "rev": "f4fadaf6a5ba1bced9d3d9021060667b563bf583",
@@ -849,16 +849,16 @@
        "hash": "sha256-/1A+DkzAQj2zGPe/A/G0Z3VrYJXUxq4Hd/+d/o5p3G8="
      },
      "ungoogled-patches": {
-        "rev": "150.0.7871.186-1",
-        "hash": "sha256-kL9xE/w0W4Wf+z9qX5EFLGMYWQ3Hvyzhy7PtF59a/Sk="
+        "rev": "150.0.7871.181-1",
+        "hash": "sha256-ifqEnOcvi49cFOYan8ShiwteXYnFrLPclrIBZiE1rGY="
      },
      "npmHash": "sha256-pF0JtwFpPC4/fodbhSJnQKkczA9WlDg4VqEAy9aDVLg="
    },
    "DEPS": {
      "src": {
        "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "0fcdce5f4fdec8d442d7df760cb541f1ca6e446d",
-        "hash": "sha256-6coAYewN8RC5kx0PmmiV6mXQhLqWF3BZP320PmOcPvw=",
+        "rev": "24b04c927b23c39cf9c5227cc8dc6f64a744c8e9",
+        "hash": "sha256-F52wmxyNPEV26v8YgAz+MRhyEGyV7YUX+/wj95H4Lf0=",
        "recompress": true
      },
      "src/third_party/clang-format/script": {
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -45,11 +45,11 @@
    "vendorHash": "sha256-031RZo1EqWrt79NvdrrZ9FW/E+mfwkGmr7wyMYX4SHg="
  },
  "aliyun_alicloud": {
-    "hash": "sha256-es2ti8tSgShwUWYtZ7OEff88LLiAnK4B/Hq9PaNEEOc=",
+    "hash": "sha256-G52l+5WlcxSNflx0ioD0jEKI1GBWe5D4qW8VH8k6uTA=",
    "homepage": "https://registry.terraform.io/providers/aliyun/alicloud",
    "owner": "aliyun",
    "repo": "terraform-provider-alicloud",
-    "rev": "v1.286.0",
+    "rev": "v1.285.0",
    "spdx": "MPL-2.0",
    "vendorHash": "sha256-sZeXHTrMUUPllPzvpbFjwA5FjFJXnO1k5h9B5i8U+vs="
  },
@@ -445,13 +445,13 @@
    "vendorHash": "sha256-FcxAh8EOvnT8r1GHu0Oj2C5Jgbr2WPwD7/vY4/qIvTA="
  },
  "gitlabhq_gitlab": {
-    "hash": "sha256-eTtmEW3sdCkpojxshhdQq+8qNTYjzin5TmCGil/3F5E=",
+    "hash": "sha256-BMOFi/g0W6xo/Kfqw8oqsMeeU3aXyWAKSgF9lIS4AbA=",
    "homepage": "https://registry.terraform.io/providers/gitlabhq/gitlab",
    "owner": "gitlabhq",
    "repo": "terraform-provider-gitlab",
-    "rev": "v19.2.1",
+    "rev": "v19.1.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-uEXZEYlQZ24h4IffJQEmqqrmHbiRSKVGJ1OCv4k1zVQ="
+    "vendorHash": "sha256-9aoJGVTC9t76auYy8K3QSWGzSAq9aTxemKNc3aCLjRY="
  },
  "go-gandi_gandi": {
    "hash": "sha256-fsCtmwyxkXfOtiZG27VEb010jglK35yr4EynnUWlFog=",
@@ -905,13 +905,13 @@
    "vendorHash": "sha256-t4dbDJNjEQ6/u+/6zqk2Sdd3LVn/L2BCJujpiLdGc58="
  },
  "metio_migadu": {
-    "hash": "sha256-qeN2Zlx4qSrjb7qxjDf4v3uG1GR/faTiCNKD/HZkoyw=",
+    "hash": "sha256-Aef1H/L2EFeU9mhecOnlPAbJbt3XfBL0Wz67IqxCI10=",
    "homepage": "https://registry.terraform.io/providers/metio/migadu",
    "owner": "metio",
    "repo": "terraform-provider-migadu",
-    "rev": "2026.7.23",
+    "rev": "2026.7.2",
    "spdx": "0BSD",
-    "vendorHash": "sha256-rwIHdtVVWygfxadoJigGBIUV0xoQ6vqDsHJgjYQ2RBM="
+    "vendorHash": "sha256-wUX2smEhKUftBCRi7ANq8NpHXpB+EmlVshrhI2ltY2I="
  },
  "mongey_kafka": {
    "hash": "sha256-rTa6c7jAMH027V7h/yUGVGz6TS0PDdObilxU0Vpr6FI=",
--- a/pkgs/applications/networking/instant-messengers/pidgin/default.nix
+++ b/pkgs/applications/networking/instant-messengers/pidgin/default.nix
@@ -13,6 +13,7 @@
  gst_all_1,
  gtk2,
  gtk2-x11,
+  gtkspell2,
  intltool,
  lib,
  libice,
@@ -93,6 +94,7 @@ let
      ]
      ++ lib.optionals stdenv.hostPlatform.isLinux [
        gtk2
+        gtkspell2
        farstream
      ]
      ++ lib.optional stdenv.hostPlatform.isDarwin gtk2-x11;
@@ -124,14 +126,16 @@ let
      "--disable-nm"
      "--disable-tcl"
      "--disable-gevolution"
-      "--disable-gtkspell"
    ]
    ++ lib.optionals withCyrus_sasl [ "--enable-cyrus-sasl=yes" ]
    ++ lib.optionals withGnutls [
      "--enable-gnutls=yes"
      "--enable-nss=no"
    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [ "--disable-vv" ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      "--disable-gtkspell"
+      "--disable-vv"
+    ]
    ++ lib.optionals stdenv.cc.isClang [ "CFLAGS=-Wno-error=int-conversion" ];

    enableParallelBuilding = true;
--- a/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
+++ b/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
@@ -78,8 +78,8 @@ rec {
  thunderbird = thunderbird-latest;

  thunderbird-latest = common {
-    version = "153.0";
-    sha512 = "f77bde3dd0933dd35870a889386c41d55ff0cbe276ec3373b27e9885f7db7e35529e7ecc2fc149ae4f8c5ae53eddb3ad444e7499a850a59a82b8940c7a4c7747";
+    version = "152.0.1";
+    sha512 = "f66c87de4dd73c3c45e420a55d76c3cb6ac091a61794ccf58ba59d1a40cf8001dee19a6a7f4c6bef7d36ea94ed4e4f677449d3006b2004abbd3fab42ad1c9228";

    updateScript = callPackage ./update.nix {
      attrPath = "thunderbirdPackages.thunderbird-latest";
@@ -89,19 +89,6 @@ rec {
  # Eventually, switch to an updateScript without versionPrefix hardcoded...
  thunderbird-esr = thunderbird-140;

-  thunderbird-153 = common {
-    applicationName = "Thunderbird ESR";
-
-    version = "153.0.1esr";
-    sha512 = "3773b49b69341aea108a627faa0dd5b7cfb52cdb4c37e625fbb8cbaef7f9166f925ecbc199173302d5bef7994e6bff3b56cd56a3a4c38a9d702cc3e5aeafcf7c";
-
-    updateScript = callPackage ./update.nix {
-      attrPath = "thunderbirdPackages.thunderbird-153";
-      versionPrefix = "153";
-      versionSuffix = "esr";
-    };
-  };
-
  thunderbird-140 = common {
    applicationName = "Thunderbird ESR";

--- a/pkgs/applications/video/obs-studio/plugins/droidcam-obs/default.nix
+++ b/pkgs/applications/video/obs-studio/plugins/droidcam-obs/default.nix
@@ -12,13 +12,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "droidcam-obs";
-  version = "2.5.1";
+  version = "2.5.0";

  src = fetchFromGitHub {
    owner = "dev47apps";
    repo = "droidcam-obs-plugin";
    tag = finalAttrs.version;
-    hash = "sha256-T7CQrjQK5OV1bgqa2il9snsK7nScuVhV06NuX2SoIeI=";
+    hash = "sha256-JPAQoGZFzTIdBQ7GpCPaYUVPkkcBdCRFkVPU+nyRa7Q=";
  };

  preBuild = ''
--- a/pkgs/build-support/replace-vars/replace-vars-with.nix
+++ b/pkgs/build-support/replace-vars/replace-vars-with.nix
@@ -122,8 +122,7 @@ in

 stdenvNoCC.mkDerivation (
  {
-    name =
-      if (attrs ? pname && attrs ? version) then "${attrs.pname}-${attrs.version}" else baseNameOf src;
+    name = baseNameOf src;
  }
  // optionalAttrs
  // forcedAttrs
--- a/pkgs/build-support/testers/modular-service-compliance.nix
+++ b/pkgs/build-support/testers/modular-service-compliance.nix
@@ -29,10 +29,6 @@ let
    services = {
      svc = {
        process.argv = [ "${coreutils}/bin/true" ];
-        process.environment = {
-          FOO = "bar";
-          DROPPED = null;
-        };
        assertions = [
          {
            assertion = true;
@@ -74,19 +70,6 @@ let
        expected = [ "${coreutils}/bin/true" ];
      };

-      # A set environment variable round-trips through process.environment.
-      testProcessEnvironment = {
-        expr = c.process.environment.FOO;
-        expected = "bar";
-      };
-
-      # A null environment variable is preserved as null (unset request),
-      # rather than coerced to a string or dropped from the attrset.
-      testProcessEnvironmentNull = {
-        expr = c.process.environment.DROPPED;
-        expected = null;
-      };
-
      testAssertions = {
        expr = lib.elem {
          assertion = true;
@@ -203,9 +186,6 @@ let
    mkdir -p "$dir"
    echo "$$" > "$dir/pid"
    printf '%s\n' "$@" > "$dir/args"
-    # Record the process's own environment as received from the service
-    # manager (NUL-delimited, as the kernel stores it).
-    "${coreutils}/bin/cat" "/proc/$$/environ" > "$dir/environ"
    exec "${coreutils}/bin/sleep" infinity
  '';

@@ -258,31 +238,6 @@ let
        || { echo "${id}: expected arg ${lib.escapeShellArg arg} not found"; cat "${sharedDir}/${id}/args"; exit 1; }
    '') expectedArgs;

-  /**
-    Shell snippet: assert that the service's recorded environment contains
-    each `present` entry (an exact `KEY=value` string) and contains no
-    variable named in `absent`.
-  */
-  checkEnv =
-    id:
-    {
-      present ? [ ],
-      absent ? [ ],
-    }:
-    ''
-      # The recorded environ is NUL-delimited; render one entry per line.
-      tr '\0' '\n' < "${sharedDir}/${id}/environ" > "${sharedDir}/${id}/environ.lines"
-    ''
-    + lib.concatMapStrings (entry: ''
-      grep -qxF -- ${lib.escapeShellArg entry} "${sharedDir}/${id}/environ.lines" \
-        || { echo "${id}: expected env ${lib.escapeShellArg entry} not found"; cat "${sharedDir}/${id}/environ.lines"; exit 1; }
-    '') present
-    + lib.concatMapStrings (key: ''
-      if grep -qE ${lib.escapeShellArg "^${key}="} "${sharedDir}/${id}/environ.lines"; then
-        echo "${id}: env variable ${lib.escapeShellArg key} should be unset"; exit 1
-      fi
-    '') absent;
-
  mkTestScript =
    name: text:
    lib.getExe (writeShellApplication {
@@ -375,24 +330,6 @@ in
    );
  };

-  environment = mkTest {
-    name = "${namePrefix}-environment";
-    services.test = {
-      process.argv = mkArgv "env" [ ];
-      process.environment = {
-        FOO = "bar";
-        DROPPED = null;
-      };
-    };
-    testExe = mkTestScript "environment" (
-      waitAndCheck "env" [ ]
-      + checkEnv "env" {
-        present = [ "FOO=bar" ];
-        absent = [ "DROPPED" ];
-      }
-    );
-  };
-
  sub-services = mkTest {
    name = "${namePrefix}-sub-services";
    services.a = {
--- a/pkgs/by-name/af/afterstep/fix-build-with-c23.patch
+++ b/pkgs/by-name/af/afterstep/fix-build-with-c23.patch
@@ -0,0 +1,81 @@
+From 081d9c3284075c65b70837079bd67621c3b64da7 Mon Sep 17 00:00:00 2001
+From: Moraxyc <i@qaq.li>
+Date: Sun, 28 Dec 2025 00:39:49 +0800
+Subject: [PATCH] fix build with c23
+
+---
+ libAfterBase/fs.c       | 2 +-
+ src/ASDocGen/ASDocGen.c | 2 +-
+ src/Ident/Ident.c       | 2 +-
+ src/afterstep/dirtree.c | 2 +-
+ src/afterstep/menus.h   | 2 +-
+ 5 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/libAfterBase/fs.c b/libAfterBase/fs.c
+index 731bfd3..954bfd6 100644
+--- a/libAfterBase/fs.c
+++ b/libAfterBase/fs.c
+@@ -818,7 +818,7 @@ my_scandir (char *dirname, struct direntry *(*namelist[]),
+ 	}
+ 	/* Optionally sort the list */
+ 	if (dcomp)
+-		qsort (*namelist, n, sizeof (struct direntry *), (int (*)())dcomp);
+		qsort (*namelist, n, sizeof (struct direntry *), (int (*)(const void *, const void *))dcomp);
+ 
+ 	/* Return the count of the entries */
+ 	return n;
+diff --git a/src/ASDocGen/ASDocGen.c b/src/ASDocGen/ASDocGen.c
+index 31d7a70..9a86219 100644
+--- a/src/ASDocGen/ASDocGen.c
+++ b/src/ASDocGen/ASDocGen.c
+@@ -667,7 +667,7 @@ write_options_keywords(const char *source_dir, const char *syntax_dir, SyntaxDef
+ 	sorted_list = safecalloc( max_i, sizeof(TermDef*));
+ 	for (i = 0; i < max_i; i++)
+ 		sorted_list[i] = &(syntax->terms[i]) ; 
+-	qsort(sorted_list, max_i, sizeof(TermDef*), (int (*)())sort_terms_by_alpha );
+	qsort(sorted_list, max_i, sizeof(TermDef*), (int (*)(const void *, const void *))sort_terms_by_alpha );
+ 	for (i = 0; i < max_i; i++)
+ 	{	
+ 		SyntaxDef *sub_syntax = sorted_list[i]->sub_syntax ; 
+diff --git a/src/Ident/Ident.c b/src/Ident/Ident.c
+index 1497d06..d6ddad6 100644
+--- a/src/Ident/Ident.c
+++ b/src/Ident/Ident.c
+@@ -89,7 +89,7 @@ void HandleEvents();
+ void DispatchEvent (ASEvent * event);
+ void process_message (send_data_type type, send_data_type *body);
+ 
+-Window make_ident_window();
+Window make_ident_window(int width, int height);
+ void fill_window_data();
+ void display_window_data();
+ void add_property( const char *name, const char *value, unsigned long value_encoding, Bool span_cols );
+diff --git a/src/afterstep/dirtree.c b/src/afterstep/dirtree.c
+index 46ce782..48f7e30 100644
+--- a/src/afterstep/dirtree.c
+++ b/src/afterstep/dirtree.c
+@@ -675,7 +675,7 @@ void dirtree_sort (dirtree_t * tree)
+ 	list = (dirtree_t **) safemalloc (n * sizeof (dirtree_t *));
+ 	for (n = 0, t = tree->child; t != NULL; t = t->next, n++)
+ 		list[n] = t;
+-	qsort (list, n, sizeof (dirtree_t *), (int (*)())dirtree_compar);
+	qsort (list, n, sizeof (dirtree_t *), (int (*)(const void *, const void *))dirtree_compar);
+ 	tree->child = list[0];
+ 	for (i = 1; i < n; i++)
+ 		list[i - 1]->next = list[i];
+diff --git a/src/afterstep/menus.h b/src/afterstep/menus.h
+index 98b2ad3..bb2a5b1 100644
+--- a/src/afterstep/menus.h
+++ b/src/afterstep/menus.h
+@@ -95,7 +95,7 @@ MenuData* FindPopup( const char* name, int quiet );
+ 
+ void DeleteMenuItem( MenuDataItem* item );
+ 
+-MenuData *CreateMenuData();
+MenuData *CreateMenuData(char *name);
+ MenuData *NewMenuData (char *name);
+ void DeleteMenuData (MenuData * menu);
+ 
+-- 
+2.51.2
+
--- a/pkgs/by-name/af/afterstep/package.nix
+++ b/pkgs/by-name/af/afterstep/package.nix
@@ -0,0 +1,101 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  fetchpatch,
+  dbus,
+  fltk_1_3,
+  gtk2,
+  libice,
+  libsm,
+  libtiff,
+  pkg-config,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "afterstep";
+  version = "2.2.12";
+
+  src = fetchFromGitHub {
+    owner = "afterstep";
+    repo = "afterstep";
+    rev = finalAttrs.version;
+    hash = "sha256-j1ADTRZ3Mxv9VNZWhWCFMnM/CJfkphdrgbw9Ca3bBw0=";
+  };
+
+  patches = [
+    (fetchpatch {
+      url = "https://salsa.debian.org/debian/afterstep/raw/master/debian/patches/44-Fix-build-with-gcc-5.patch";
+      hash = "sha256-RNLB6PuFVA1PsYt2VwLyLyvY2OO3oIl1xk+0/6nwN+4=";
+    })
+
+    # Fix pending upstream inclusion for binutils-2.36 support:
+    #  https://github.com/afterstep/afterstep/pull/7
+    (fetchpatch {
+      name = "binutils-2.36.patch";
+      url = "https://github.com/afterstep/afterstep/commit/5e9e897cf8c455390dd6f5b27fec49707f6b9088.patch";
+      hash = "sha256-aGMTyojzXEHGjO9lMT6dwLl01Fd333BUuCIX0FU9ac4=";
+    })
+
+    # fix build with c23
+    #   fs.c:821:66: error: passing argument 4 of 'qsort' from incompatible pointer type [-Wincompatible-pointer-types]
+    #   Ident.c:326:1: error: conflicting types for 'make_ident_window'; have 'Window(int,  int)' {aka 'long unsigned int(int,  int)'}
+    #   menuitem.c:85:11: error: conflicting types for 'CreateMenuData'; have 'MenuData *(char *)'
+    ./fix-build-with-c23.patch
+  ];
+
+  postPatch = ''
+    # Causes fatal ldconfig cache generation attempt on non-NixOS Linux
+    for mkfile in autoconf/Makefile.common.lib.in libAfter{Base,Image}/Makefile.in; do
+      substituteInPlace $mkfile \
+        --replace-fail 'test -w /etc' 'false'
+    done
+  '';
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    dbus
+    fltk_1_3
+    gtk2
+    libice
+    libsm
+    libtiff
+  ];
+
+  outputs = [
+    "out"
+    "man"
+  ];
+
+  strictDeps = true;
+
+  preConfigure = ''
+    # A strange type of bug: dbus is not immediately found by pkg-config
+    export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE $(pkg-config dbus-1 --cflags)"
+  '';
+
+  # Parallel build fails due to missing dependencies between private libraries:
+  #   ld: cannot find ../libAfterConf/libAfterConf.a: No such file or directory
+  # Let's disable parallel builds until it's fixed upstream:
+  #   https://github.com/afterstep/afterstep/issues/8
+  enableParallelBuilding = false;
+
+  meta = {
+    homepage = "http://www.afterstep.org/";
+    description = "NEXTStep-inspired window manager";
+    longDescription = ''
+      AfterStep is a window manager for the Unix X Window System. Originally
+      based on the look and feel of the NeXTStep interface, it provides end
+      users with a consistent, clean, and elegant desktop. The goal of AfterStep
+      development is to provide for flexibility of desktop configuration,
+      improving aestetics, and efficient use of system resources.
+    '';
+    license = lib.licenses.gpl2Plus;
+    maintainers = [ ];
+    mainProgram = "afterstep";
+    platforms = lib.platforms.linux;
+  };
+})
--- a/pkgs/by-name/ai/airspyhf/package.nix
+++ b/pkgs/by-name/ai/airspyhf/package.nix
@@ -9,14 +9,12 @@

 stdenv.mkDerivation {
  pname = "airspyhf";
-  version = "1.8.1";
+  version = "1.6.8-unstable-2025-07-12";

  src = fetchFromGitHub {
    owner = "airspy";
    repo = "airspyhf";
-    # Not clear why upstream won't tag releases. See:
-    # https://github.com/airspy/airspyhf/commit/c0bb66dd8976651c53884ccec3d70a108f1e50e1#r193607536
-    rev = "c0bb66dd8976651c53884ccec3d70a108f1e50e1";
+    rev = "87cf12a30f3a0f10f313aab8e54999ca69b753af";
    hash = "sha256-7bXBv4YTOaWRFI6Svb9/lSBEAssUgJMqxKM5zHk1swM=";
  };

--- a/pkgs/by-name/al/all-the-package-names/package.nix
+++ b/pkgs/by-name/al/all-the-package-names/package.nix
@@ -7,16 +7,16 @@

 buildNpmPackage rec {
  pname = "all-the-package-names";
-  version = "2.0.2511";
+  version = "2.0.2503";

  src = fetchFromGitHub {
    owner = "nice-registry";
    repo = "all-the-package-names";
    tag = "v${version}";
-    hash = "sha256-KnEvFnPXQZ+XhNyweWIE0mjM4vqcqXcJKuus/dFq5f0=";
+    hash = "sha256-UtwbQXhX8dmmA6dVuVFcMQkM98kOt/U//OAVMGBImDU=";
  };

-  npmDepsHash = "sha256-Xw/SXRpQkPd+EcemeHO89tC9amDiVV/RD/1H0H8rax0=";
+  npmDepsHash = "sha256-V7MWSEJT2RtYE1iYJHj2ltrfzke+GO1PfT/wo+MqlZk=";

  passthru.updateScript = nix-update-script { };

--- a/pkgs/by-name/an/anubis/package.nix
+++ b/pkgs/by-name/an/anubis/package.nix
@@ -15,21 +15,21 @@

 buildGoModule (finalAttrs: {
  pname = "anubis";
-  version = "1.26.0";
+  version = "1.25.0";

  src = fetchFromGitHub {
    owner = "TecharoHQ";
    repo = "anubis";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-0ceF4Te0H5edBhvGJgGc/NLJxEAcDVGnnKlqHKnpW60=";
+    hash = "sha256-9/XIwSMEmnS3L/Wzg6ABso7R6W3TYkJomC8aFMycxZo=";
  };

-  vendorHash = "sha256-+NPwL4p0p/s74m1Ld0z2GEcsWk5FqhcLbHrTNP3yEzk=";
+  vendorHash = "sha256-9CMD8Rn4q8b+hyrph+BqqS32ijZyJRNsop6ML7z5Zuk=";

  npmDeps = fetchNpmDeps {
    name = "anubis-npm-deps";
    inherit (finalAttrs) src;
-    hash = "sha256-6sj9C8GHm+RzFl/X5HIPhIDl5l8muBzDSXSRCHumGBs=";
+    hash = "sha256-2U91Dt+ymspjYgTtgCjahCNr6fIs85TT/k+I8M2aC9s=";
  };

  nativeBuildInputs = [
@@ -75,8 +75,6 @@ buildGoModule (finalAttrs: {
    export DONT_USE_NETWORK=1
  '';

-  __darwinAllowLocalNetworking = true;
-
  passthru = {
    tests = { inherit (nixosTests) anubis; };
    updateScript = nix-update-script { extraArgs = [ "--version-regex=^v(\\d+\\.\\d+\\.\\d+)$" ]; };
--- a/pkgs/by-name/ap/apriltag/package.nix
+++ b/pkgs/by-name/ap/apriltag/package.nix
@@ -9,6 +9,7 @@

 let
  opencv4WithGtk = python3Packages.opencv4.override {
+    enableGtk2 = true; # For GTK2 support
    enableGtk3 = true; # For GTK3 support
  };
 in
--- a/pkgs/by-name/as/assh/package.nix
+++ b/pkgs/by-name/as/assh/package.nix
@@ -10,16 +10,16 @@

 buildGoModule (finalAttrs: {
  pname = "assh";
-  version = "2.17.3";
+  version = "2.17.2";

  src = fetchFromGitHub {
    repo = "assh";
    owner = "moul";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-CH6QM/dy5fKo7Tq2ekrc06iqjJDZl8JHMG7jalho7BI=";
+    hash = "sha256-/w4RluA7py6d75S04czNsgHpmR5rmAUZx8OnZfu9oNg=";
  };

-  vendorHash = "sha256-ENCJNgMLTZDlKL0DIt48F1G8TYo2blPdsFH6v8dNC8w=";
+  vendorHash = "sha256-EA39KqAN9SHPU362j6/j6okvT+eZb2R4unMA0bB+bVg=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/au/autoprefixer/package.nix
+++ b/pkgs/by-name/au/autoprefixer/package.nix
@@ -11,13 +11,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "autoprefixer";
-  version = "10.5.4";
+  version = "10.5.3";

  src = fetchFromGitHub {
    owner = "postcss";
    repo = "autoprefixer";
    tag = finalAttrs.version;
-    hash = "sha256-616VFB6qJiNfsDsaxR4Y+xoqKDrBOtKgWfGMeiaDeGQ=";
+    hash = "sha256-hjckcgWojItp2gseQI18zzxizjw/HxQPiTb/JegSCcs=";
  };

  nativeBuildInputs = [
@@ -30,7 +30,7 @@ stdenv.mkDerivation (finalAttrs: {
    inherit (finalAttrs) pname version src;
    pnpm = pnpm_10;
    fetcherVersion = 4;
-    hash = "sha256-+EPzrG2vt2FRIwcJqwwiYPevQFCNAbX7kgFlY+vLbqE=";
+    hash = "sha256-diOgX9lXKOwCx9V737mmmtrhqDg5beXJH/PjlJHFpto=";
  };

  installPhase = ''
--- a/pkgs/by-name/az/aztfexport/package.nix
+++ b/pkgs/by-name/az/aztfexport/package.nix
@@ -7,16 +7,16 @@
 }:
 buildGoModule (finalAttrs: {
  pname = "aztfexport";
-  version = "0.20.0";
+  version = "0.19.0";

  src = fetchFromGitHub {
    owner = "Azure";
    repo = "aztfexport";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-wHI/osu2Jq85zCgh1HfOTuO81mYtQJcSbvlDnXd7Duc=";
+    hash = "sha256-97lahgEsth2YUeqTe8J58brykpFV0lG6KwB7FJgODAE=";
  };

-  vendorHash = "sha256-QDpoOlu1qGNK0ennplusXBgeQWZP3EH7aSStllP8uzw=";
+  vendorHash = "sha256-4u40PdRT3E+BZ8bIrnIgRnJkpws6EPK5DRyXu9oY7hc=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/az/azurehound/package.nix
+++ b/pkgs/by-name/az/azurehound/package.nix
@@ -8,13 +8,13 @@

 buildGoModule (finalAttrs: {
  pname = "azurehound";
-  version = "3.0.0";
+  version = "2.12.2";

  src = fetchFromGitHub {
    owner = "SpecterOps";
    repo = "AzureHound";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-4uc4XSjvuMUSeCsJl9uHBFIaeG1KZ1xDaACXnXkp7v0=";
+    hash = "sha256-w8PmSt+QvU0HELkgdYLfIUgK3R5vCYzlPbMyrHztiPw=";
  };

  vendorHash = "sha256-WF46wXaNU/Em0KpF6hkuuJ+7K1IKLGqpNS/HxpxX5WY=";
--- a/pkgs/by-name/ba/bazel-remote/package.nix
+++ b/pkgs/by-name/ba/bazel-remote/package.nix
@@ -6,16 +6,16 @@

 buildGoModule (finalAttrs: {
  pname = "bazel-remote";
-  version = "2.6.2";
+  version = "2.6.1";

  src = fetchFromGitHub {
    owner = "buchgr";
    repo = "bazel-remote";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-wE0l1tBtj44l1Eamd4wCHzjnPhT7W5yZ5MkTA5cOUrg=";
+    hash = "sha256-9vPaTm/HTJ3ftlFg+AkcwXX7xyhmGTgKL3PXhtUHRDk=";
  };

-  vendorHash = "sha256-DGyGQLEAwy79ibWGxAWa7gmaXTajcW3jqGJou2Wnykc=";
+  vendorHash = "sha256-uh8ST1AQ8OsFMfXly23TMMcheNmhb1MknmPMjB76GIQ=";

  subPackages = [ "." ];

--- a/pkgs/by-name/bi/bitwarden-desktop/dont-auto-setup-biometrics.patch
+++ b/pkgs/by-name/bi/bitwarden-desktop/dont-auto-setup-biometrics.patch
@@ -1,8 +1,8 @@
-diff --git a/apps/desktop/src/key-management/biometrics/native-v2/os-biometrics-linux.service.ts b/apps/desktop/src/key-management/biometrics/native-v2/os-biometrics-linux.service.ts
-index 110db23ec79..dfaf600bcdf 100644
--- a/apps/desktop/src/key-management/biometrics/native-v2/os-biometrics-linux.service.ts
-+++ b/apps/desktop/src/key-management/biometrics/native-v2/os-biometrics-linux.service.ts
-@@ -83,7 +83,7 @@ export default class OsBiometricsServiceLinux implements OsBiometricService {
+diff --git a/apps/desktop/src/key-management/biometrics/os-biometrics-linux.service.ts b/apps/desktop/src/key-management/biometrics/os-biometrics-linux.service.ts
+index 791b4d6f88..dfee0bbf8d 100644
+--- a/apps/desktop/src/key-management/biometrics/os-biometrics-linux.service.ts
+++ b/apps/desktop/src/key-management/biometrics/os-biometrics-linux.service.ts
+@@ -115,7 +115,7 @@ export default class OsBiometricsServiceLinux implements OsBiometricService {
     // The user needs to manually set up the polkit policy outside of the sandbox
     // since we allow access to polkit via dbus for the sandboxed clients, the authentication works from
     // the sandbox, once the policy is set up outside of the sandbox.
@@ -10,4 +10,4 @@ index 110db23ec79..dfaf600bcdf 100644
 +    return false;
   }
 
-   async runSetup(): Promise<void> {
+   async osBiometricsSetup(): Promise<void> {
--- a/pkgs/by-name/bi/bitwarden-desktop/package.nix
+++ b/pkgs/by-name/bi/bitwarden-desktop/package.nix
@@ -5,14 +5,14 @@
  copyDesktopItems,
  dart-sass,
  darwin,
-  electron_41,
+  electron_39,
  fetchFromGitHub,
  gnome-keyring,
  jq,
  makeDesktopItem,
  makeWrapper,
  nix-update-script,
-  nodejs_24,
+  nodejs_22,
  pkg-config,
  rustc,
  rustPlatform,
@@ -22,17 +22,17 @@

 let
  icon = "bitwarden";
-  electron = electron_41;
+  electron = electron_39;
 in
 buildNpmPackage (finalAttrs: {
  pname = "bitwarden-desktop";
-  version = "2026.7.0";
+  version = "2026.6.1";

  src = fetchFromGitHub {
    owner = "bitwarden";
    repo = "clients";
    tag = "desktop-v${finalAttrs.version}";
-    hash = "sha256-E4glf4G70BuT0GYu1kEb5Z9B76ElIlDPe1rdGSdmCzo=";
+    hash = "sha256-ee+C58Y5pZWEmqbRO/w7rdY+e6gy4EL7Sn0S1AxGMXI=";
  };

  patches = [
@@ -64,7 +64,7 @@ buildNpmPackage (finalAttrs: {
    rm -r apps/cli
  '';

-  nodejs = nodejs_24;
+  nodejs = nodejs_22;

  makeCacheWritable = true;
  npmFlags = [
@@ -74,7 +74,7 @@ buildNpmPackage (finalAttrs: {

  npmWorkspace = "apps/desktop";
  npmDepsFetcherVersion = 3;
-  npmDepsHash = "sha256-8wjt5wnJG4S4EeGWGxbo6Bwt76GIqrSiwqwwwQ17Y5Y=";
+  npmDepsHash = "sha256-C5GLei/WWetd4qLv7obBJWbQR9LBy+Sqdbjko3/W7VY=";

  cargoDeps = rustPlatform.fetchCargoVendor {
    inherit (finalAttrs)
@@ -84,7 +84,7 @@ buildNpmPackage (finalAttrs: {
      cargoRoot
      patches
      ;
-    hash = "sha256-PLfR+yS+MtscRRuyLaK/qIWJVDoefhOobev1fpNeHNo=";
+    hash = "sha256-xyK3+z2yfCG9K5XAB6LNEeyqMRknONi6ZfY/3oko7Z8=";
  };
  cargoRoot = "apps/desktop/desktop_native";

@@ -197,7 +197,7 @@ buildNpmPackage (finalAttrs: {
    # Extract the polkit policy file from the multiline string in the source code.
    # This may break in the future but its better than copy-pasting it manually.
    mkdir -p $out/share/polkit-1/actions/
-    pushd apps/desktop/src/key-management/biometrics/native-v2
+    pushd apps/desktop/src/key-management/biometrics
    awk '/const polkitPolicy = `/{gsub(/^.*`/, ""); print; str=1; next} str{if (/`;/) str=0; gsub(/`;/, ""); print}' os-biometrics-linux.service.ts > $out/share/polkit-1/actions/com.bitwarden.Bitwarden.policy
    popd

--- a/pkgs/by-name/bo/bobgen/package.nix
+++ b/pkgs/by-name/bo/bobgen/package.nix
@@ -7,16 +7,16 @@

 buildGoModule (finalAttrs: {
  pname = "bobgen";
-  version = "0.49.0";
+  version = "0.48.0";

  src = fetchFromGitHub {
    owner = "stephenafamo";
    repo = "bob";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-5uwYw5CraOBUG55MIWa9I6GGIdJz/K+OXHIjOrjFuTQ=";
+    hash = "sha256-iD9GPYBt1s6xx4vNRlArERmv5AyBR6Q4mLLDNDWy1qY=";
  };

-  vendorHash = "sha256-fQmhAuxl23jRGJ4ysKh9QiiA8dtZlM37dE9aBXrYwao=";
+  vendorHash = "sha256-tL6f8XkAsBL76idEVxlAAcdYyzo9Rh9fEHy6ysfZWG8=";

  subPackages = [
    "gen/bobgen-sql"
--- a/pkgs/by-name/br/bruno/package.nix
+++ b/pkgs/by-name/br/bruno/package.nix
@@ -21,13 +21,13 @@

 buildNpmPackage rec {
  pname = "bruno";
-  version = "4.0.0";
+  version = "3.5.2";

  src = fetchFromGitHub {
    owner = "usebruno";
    repo = "bruno";
    tag = "v${version}";
-    hash = "sha256-M4oNx3nSe8hSAtZMVyXIW0qQIQkaOeQgpPsfjmmJ30E=";
+    hash = "sha256-Lll/ywDkHv0xvLk8iiBEySek7A3dBmfO4V/q2xaNtBQ=";

    postFetch = ''
      ${lib.getExe npm-lockfile-fix} $out/package-lock.json
@@ -36,7 +36,7 @@ buildNpmPackage rec {

  nodejs = nodejs_22;

-  npmDepsHash = "sha256-Jrlpztg1JxuPaLD4O9elOaU1eFH3dmr6oWwi4Ch9Zv8=";
+  npmDepsHash = "sha256-4VsSXiHj/INCu4ryZ+JxPbfDpsgIb5eYvOUYz+gbKEE=";
  npmFlags = [ "--legacy-peer-deps" ];

  nativeBuildInputs = [
@@ -77,10 +77,6 @@ buildNpmPackage rec {
    # fix version reported in sidebar and about page
    ${jq}/bin/jq '.version |= "${version}"' packages/bruno-electron/package.json | ${moreutils}/bin/sponge packages/bruno-electron/package.json
    ${jq}/bin/jq '.version |= "${version}"' packages/bruno-app/package.json | ${moreutils}/bin/sponge packages/bruno-app/package.json
-
-    # disable remote image download to prevent network calls to comply with build sandboxing
-    substituteInPlace packages/bruno-app/plugins/remote-images/loader.cjs \
-      --replace-fail 'const urls = findRemoteImageUrls(source, domains);' 'const urls = [];'
  '';

  postConfigure = ''
--- a/pkgs/by-name/bt/btrfs-progs/package.nix
+++ b/pkgs/by-name/bt/btrfs-progs/package.nix
@@ -21,11 +21,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "btrfs-progs";
-  version = "7.1";
+  version = "7.0";

  src = fetchurl {
    url = "mirror://kernel/linux/kernel/people/kdave/btrfs-progs/btrfs-progs-v${finalAttrs.version}.tar.xz";
-    hash = "sha256-0fVcwpcTmMkULqp50gPmPVhqO0uGf5VmZKHWgyLNTjQ=";
+    hash = "sha256-wobWh2y81yMnoLQX5M/SgDU+wj43tUn9vNeACoMtmpk=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/bu/bumpp/package.nix
+++ b/pkgs/by-name/bu/bumpp/package.nix
@@ -15,20 +15,20 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "bumpp";
-  version = "12.0.0";
+  version = "11.1.0";

  src = fetchFromGitHub {
    owner = "antfu-collective";
    repo = "bumpp";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-9o3eUZ4cCusvV+IwQbLqbEI4NhTKkcwgqv4Mqe/VxZ4=";
+    hash = "sha256-LzFusuzFpbqh/gNV0c0vhoKE17CzTPJUppdpdKaGOFs=";
  };

  pnpmDeps = fetchPnpmDeps {
    inherit (finalAttrs) pname version src;
    inherit pnpm;
    fetcherVersion = 3;
-    hash = "sha256-Em3HvH5nCiyxgaPQvenqAnOraYnvQNxLVdHQd1lz3+o=";
+    hash = "sha256-KYTz/SO4rV+c57G8dv4ExCZrunA0xvgCNk8Td4HbCig=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/ca/cargo-feature-combinations/package.nix
+++ b/pkgs/by-name/ca/cargo-feature-combinations/package.nix
@@ -9,16 +9,16 @@ rustPlatform.buildRustPackage (finalAttrs: {
  __structuredAttrs = true;

  pname = "cargo-feature-combinations";
-  version = "0.4.1";
+  version = "0.3.0";

  src = fetchFromGitHub {
    owner = "romnn";
    repo = "cargo-feature-combinations";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-0aPe0YmEpLHt3aZHDuNlov/TiRbLLpR7TLt0ULkjsVU=";
+    hash = "sha256-PneHMWX7IRoX4oSm8iePeI+pEPs8n3F2PW06ZWKDFcc=";
  };

-  cargoHash = "sha256-r09otRStFli5Bx0pfDOMu1LGDonDyCVGPEdY/KnjkmY=";
+  cargoHash = "sha256-DCfO2N6ml1a1P2hFs3gxRE9k+WYv8eqMzwL+cionwYE=";

  passthru.updateScript = nix-update-script { };

--- a/pkgs/by-name/ca/cargo-update/package.nix
+++ b/pkgs/by-name/ca/cargo-update/package.nix
@@ -16,14 +16,14 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cargo-update";
-  version = "22.1.0";
+  version = "22.0.0";

  src = fetchCrate {
    inherit (finalAttrs) pname version;
-    hash = "sha256-0iXO+cmW1vfKc9sPTnw132fZlqTMfInVCIgT8NLrhwM=";
+    hash = "sha256-7SjJ+v+6PzwV8dTXxSVxKrj4/yUlyGVJtt0A+WaWNc8=";
  };

-  cargoHash = "sha256-6yE4zdGosZhXhT3Q3mh/1h33OXqXrAWhZ0b18qaI1vs=";
+  cargoHash = "sha256-xRjPnZPewo/5pCDUem8+9Ko0XJ1p5HJtLLmErtZQb8w=";

  nativeBuildInputs = [
    cmake
--- a/pkgs/by-name/ca/caribou/package.nix
+++ b/pkgs/by-name/ca/caribou/package.nix
@@ -13,6 +13,7 @@
  libxml2,
  libxklavier,
  libxtst,
+  gtk2,
  intltool,
  libxslt,
  at-spi2-core,
@@ -81,6 +82,7 @@ stdenv.mkDerivation (finalAttrs: {
    pythonEnv
    python3.pkgs.pygobject3
    libxtst
+    gtk2
  ];

  propagatedBuildInputs = [
@@ -88,8 +90,6 @@ stdenv.mkDerivation (finalAttrs: {
    libxklavier
  ];

-  configureFlags = [ "--enable-gtk2-module=no" ];
-
  postPatch = ''
    patchShebangs .
    substituteInPlace libcaribou/Makefile.am --replace "--shared-library=libcaribou.so.0" "--shared-library=$out/lib/libcaribou.so.0"
--- a/pkgs/by-name/cc/ccusage/package.nix
+++ b/pkgs/by-name/cc/ccusage/package.nix
@@ -8,45 +8,40 @@
  apple-sdk_15,
  libiconv,
  versionCheckHook,
-  nix-update,
-  writeShellApplication,
-  curl,
+  nix-update-script,
  runCommand,
  jq,
 }:

 let
-  # ccusage embeds the LiteLLM model-pricing table at build time instead of
-  # downloading it (the Nix sandbox has no network). Upstream pins the exact
-  # data revision via its flake.lock and points CCUSAGE_PRICING_JSON_PATH at it;
-  # we mirror that revision here so the build is offline, reproducible, and
-  # byte-identical to what upstream ships.
-  #
-  # Both values below are kept in sync with the package version by
-  # passthru.updateScript — do not edit them by hand.
-  litellmPricingRev = "49ca04d8c3ddea336237ce6f3082dbc26d19e944";
-  litellmPricingHash = "sha256-rkUyugxdoD7WlPN//6BQpl4OJQuBbc20db7gt7exqpc=";
+  # ccusage embeds the LiteLLM model-pricing table at build time. Its build
+  # script otherwise downloads this file from the network, which fails in the
+  # sandbox. Upstream pins the data via a flake input and points
+  # CCUSAGE_PRICING_JSON_PATH at it; mirror that exact revision here so the
+  # build is offline and reproducible (see package.nix + flake.lock in the
+  # upstream repo at tag v20.0.6). Bump this revision together with the package
+  # version; nix-update only refreshes the src and cargo hashes.
  litellmPricing = fetchurl {
-    url = "https://raw.githubusercontent.com/BerriAI/litellm/${litellmPricingRev}/model_prices_and_context_window.json";
-    hash = litellmPricingHash;
+    url = "https://raw.githubusercontent.com/BerriAI/litellm/f27df8d516802ce4c1b32973992154fe83b851cf/model_prices_and_context_window.json";
+    hash = "sha256-zJa6H2EwP9s+hMVs78Y+hwo4UX1dHRtvX5J3MdGh5aI=";
  };
 in
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "ccusage";
-  version = "20.0.17";
+  version = "20.0.6";

  src = fetchFromGitHub {
    owner = "ccusage";
    repo = "ccusage";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-486iLPRqQVRnKVbVT93D08RTRzd6/h503ckB//24nho=";
+    hash = "sha256-uf/FlPprxx4jh74YwjmYMtoIHpTkKrWTLetbNoYiFv4=";
  };

  # The Cargo workspace lives in rust/, not at the repo root.
  cargoRoot = "rust";
  buildAndTestSubdir = "rust";

-  cargoHash = "sha256-23l/BCCGcZ1i5mFBC6Q+FE7sQRHnPLbU4QoQe7TfoiQ=";
+  cargoHash = "sha256-izA2Gs5nPmt0zn6/e1xM80vyyQHYKGEUDpUFRpyFiB8=";

  __structuredAttrs = true;
  strictDeps = true;
@@ -77,40 +72,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
  doInstallCheck = true;

  passthru = {
-    # Plain nix-update only refreshes version + src/cargo hashes; it can't know
-    # about the LiteLLM pricing pin above. This wrapper bumps the package as
-    # usual, then reads the litellm revision that ccusage locks at the new tag
-    # and rewrites litellmPricingRev/litellmPricingHash to match, so automated
-    # (r-ryantm) bumps stay complete instead of shipping stale pricing data.
-    updateScript = lib.getExe (writeShellApplication {
-      name = "ccusage-update";
-      runtimeInputs = [
-        curl
-        jq
-        nix-update
-      ];
-      text = ''
-        set -euo pipefail
-
-        attr="''${UPDATE_NIX_ATTR_PATH:-ccusage}"
-
-        nix-update "$attr"
-
-        version=$(nix-instantiate --eval --raw -A "$attr.version")
-        rev=$(curl --fail --silent --show-error --location \
-          "https://raw.githubusercontent.com/ccusage/ccusage/v''${version}/flake.lock" \
-          | jq --raw-output '.nodes.litellm.locked.rev')
-        hash=$(nix-prefetch-url --type sha256 \
-          "https://raw.githubusercontent.com/BerriAI/litellm/''${rev}/model_prices_and_context_window.json" \
-          | xargs nix --extra-experimental-features nix-command hash convert --hash-algo sha256 --to sri)
-
-        file=$(nix-instantiate --eval --raw -A "$attr.meta.position" | sed -re 's/:[0-9]+$//')
-        sed -i \
-          -e "s|litellmPricingRev = \"[0-9a-f]*\"|litellmPricingRev = \"''${rev}\"|" \
-          -e "s|litellmPricingHash = \"sha256-[^\"]*\"|litellmPricingHash = \"''${hash}\"|" \
-          "$file"
-      '';
-    });
+    updateScript = nix-update-script { };

    tests = {
      # With no agent data on disk, ccusage must still emit a valid, empty JSON
--- a/pkgs/by-name/cd/cdncheck/package.nix
+++ b/pkgs/by-name/cd/cdncheck/package.nix
@@ -6,13 +6,13 @@

 buildGoModule (finalAttrs: {
  pname = "cdncheck";
-  version = "1.2.45";
+  version = "1.2.44";

  src = fetchFromGitHub {
    owner = "projectdiscovery";
    repo = "cdncheck";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-TR7ogxaJ9Vee6bpqWKu75Yf8KWo8bPTBKwIecGkN68I=";
+    hash = "sha256-8Lte+arj2nqEU8WmaX4bf/WOJV6bdMLskm0BqSyBOuE=";
  };

  vendorHash = "sha256-iJ1agL7sZ3ZKbW1wMA+qi8FgHdPa6gZLQ5BBPKJTNaQ=";
--- a/pkgs/by-name/ci/cine/package.nix
+++ b/pkgs/by-name/ci/cine/package.nix
@@ -19,14 +19,14 @@

 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "cine";
-  version = "1.7.4";
+  version = "1.7.0";
  pyproject = false;

  src = fetchFromGitHub {
    owner = "diegopvlk";
    repo = "Cine";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-D25/wz9nsxi9Y1D8hnb3S1kNfdUfPM4ojyLovDkUEI4=";
+    hash = "sha256-WBzdBZ7WL6HAd26tJtTaw39jAtdNYNiNmYHhVr+JBtM=";
    fetchSubmodules = true;
  };

--- a/pkgs/by-name/ci/cinnamon/package.nix
+++ b/pkgs/by-name/ci/cinnamon/package.nix
@@ -75,13 +75,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "cinnamon";
-  version = "6.6.9";
+  version = "6.6.8";

  src = fetchFromGitHub {
    owner = "linuxmint";
    repo = "cinnamon";
    tag = finalAttrs.version;
-    hash = "sha256-RQsgfPvdt1xe7HhZamynAvATVlBeLLElatjpN1Tgt2M=";
+    hash = "sha256-ByPn2VV40y+3/FW/KPIsLt43FhVxQAQldCK26KNKdjw=";
  };

  patches = [
@@ -93,6 +93,12 @@ stdenv.mkDerivation (finalAttrs: {
      url = "https://github.com/linuxmint/cinnamon/commit/3a2d558aa575f0ea364c5b4e30d2eb3ee604ee58.patch";
      hash = "sha256-+uAGuQJ0VsIvMvPFafyoXmU4MiHfbbRXLzeW/n62ucw=";
    })
+
+    # cinnamon-calendar-server.py: Allow ICal 4.0
+    (fetchpatch {
+      url = "https://github.com/linuxmint/cinnamon/commit/dcf2d986c1ec167b0a8005ef2ca427317438c8d7.patch";
+      hash = "sha256-4sCZShUOXPaJoumiuEG558e0l8CIehH0P+C9OouG3vI=";
+    })
  ];

  buildInputs = [
--- a/pkgs/by-name/cl/claude-code/manifest.json
+++ b/pkgs/by-name/cl/claude-code/manifest.json
@@ -1,47 +1,47 @@
 {
-  "version": "2.1.219",
-  "commit": "7006c4c3acac98e554d3997baeda6a7fa4d1ff7c",
-  "buildDate": "2026-07-24T03:34:26Z",
+  "version": "2.1.218",
+  "commit": "bce61b433bc397ce68686368abd12f545b0a013a",
+  "buildDate": "2026-07-22T18:42:19Z",
  "platforms": {
    "darwin-arm64": {
      "binary": "claude",
-      "checksum": "a8e806faaefac53c7a0f26523d8a45c60dbef3407b14ef990c75765d08febc82",
-      "size": 256908272
+      "checksum": "71abaff59312c9a9b6a1d818365048b42e4e95cc521a823660eded3e0880d9b7",
+      "size": 255069680
    },
    "darwin-x64": {
      "binary": "claude",
-      "checksum": "03be9f988ed88391b4a5f08e4c5dc317ce2fffa4a9dc66c01106326e7698ee76",
-      "size": 266381200
+      "checksum": "9862b74a083e8a4ed572f99cbd4895185e0dd5a0a601affb0fb8e43d8d1f40e6",
+      "size": 264548368
    },
    "linux-arm64": {
      "binary": "claude",
-      "checksum": "1f834b322ba9d1291cc7ffeff16a6795a59145bda279dbd59cd7ecebc7b7f15a",
-      "size": 271825824
+      "checksum": "295fd30481bd03b38450fdec2a6e25bb6472c2074f04b0c4a566cd5988f230bf",
+      "size": 269990816
    },
    "linux-x64": {
      "binary": "claude",
-      "checksum": "22cfd6f5b3061c0391ba84e9cf8c9deaa37783aac18b004d42ec061e98f00691",
-      "size": 275004400
+      "checksum": "e12071751a9336b8af1012c103358ff04ac18f9aaff4a738cff7ba5cdfaf63f2",
+      "size": 273177584
    },
    "linux-arm64-musl": {
      "binary": "claude",
-      "checksum": "22b2c2e0f41ab0b7c7b8845be9c49fe6f27e4c344aab1bd174bdf84a4e6b0570",
-      "size": 265074024
+      "checksum": "efcaae48f8f537a0e9a47b4317a5f8c184706c99ddd8ca0a9a21391e2a766ef8",
+      "size": 263239016
    },
    "linux-x64-musl": {
      "binary": "claude",
-      "checksum": "487008769dd69599adb779205b6b371de27b4245f0ad2ad70f15baf4eac5f81e",
-      "size": 269627984
+      "checksum": "62986293277153f5db97404cf7e3e96de136f02c28f79ccd5c7bc99766224db4",
+      "size": 267801168
    },
    "win32-x64": {
      "binary": "claude.exe",
-      "checksum": "10f4c1f85b07f3cf6b8fff930fd26ecd475bd146a378acfafa559a6db9d89637",
-      "size": 265714848
+      "checksum": "81fcf59bb7abb558aedc6f2361f4723b3d757d28e799962d88b18b4520df66ca",
+      "size": 263931552
    },
    "win32-arm64": {
      "binary": "claude.exe",
-      "checksum": "6a1db10161b93e81ac55537feeae8a299f0bf67601c1c0f2016e79c850302baa",
-      "size": 260090016
+      "checksum": "a7959fd87feb9557d56f4e5752f7ed1ddf405f3bea91b2571bf93af636efd193",
+      "size": 258307232
    }
  },
  "sdkCompat": {
@@ -68,8 +68,7 @@
      "0.3.208",
      "0.3.209",
      "0.3.215",
-      "0.3.217",
-      "0.3.218"
+      "0.3.217"
    ],
    "harnessSchema": 1
  }
--- a/pkgs/by-name/cl/clouddrive2/package.nix
+++ b/pkgs/by-name/cl/clouddrive2/package.nix
@@ -11,15 +11,15 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "clouddrive2";
-  version = "1.0.12";
+  version = "1.0.11";

  src = fetchurl {
    url = "https://github.com/cloud-fs/cloud-fs.github.io/releases/download/v${finalAttrs.version}/clouddrive-2-${os}-${arch}-${finalAttrs.version}.tgz";
    hash =
      {
-        x86_64-linux = "sha256-Z1xAFMXlajdAAZGY7R7UJrOSLPzyMLXC6wbJnrOXtsc=";
-        aarch64-linux = "sha256-rgRBFCbH3QS/6Db2urDItj825QDFakknAvoIOWv9r0o=";
-        aarch64-darwin = "sha256-9E9xp4f6mFe+otFaAbetjk5agAH9IXLPkuRa669+AgY=";
+        x86_64-linux = "sha256-X5WAnHyXdAkWrN/AbkDE0eNH4mwdPcZ0Cs5Q21KB6/w=";
+        aarch64-linux = "sha256-somHyDBG94pGQB+IZd404H1tX0X2qC8LeIcXeihU6yA=";
+        aarch64-darwin = "sha256-GaL2bCwQdtI3bq2wkwza1OEHFvhppdZpUIq3QRQ0vN8=";
      }
      .${stdenv.hostPlatform.system} or (throw "unsupported system ${stdenv.hostPlatform.system}");
  };
--- a/pkgs/by-name/cl/cloudflared/package.nix
+++ b/pkgs/by-name/cl/cloudflared/package.nix
@@ -9,13 +9,13 @@

 buildGoModule (finalAttrs: {
  pname = "cloudflared";
-  version = "2026.7.3";
+  version = "2026.7.2";

  src = fetchFromGitHub {
    owner = "cloudflare";
    repo = "cloudflared";
    tag = finalAttrs.version;
-    hash = "sha256-hIDx9Nd7CKlM0vCKqkVHxBMj4QzvnnsYYMjhzOqcECU=";
+    hash = "sha256-fuJfvm5c63koMl46sJmZOiWuNKpOwH17MD20XD7q6s0=";
  };

  vendorHash = null;
--- a/pkgs/by-name/cu/cutemaze/package.nix
+++ b/pkgs/by-name/cu/cutemaze/package.nix
@@ -8,11 +8,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "cutemaze";
-  version = "1.3.7";
+  version = "1.3.6";

  src = fetchurl {
    url = "https://gottcode.org/cutemaze/cutemaze-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-iaT55oVw5j3ttAiWW5y6QlQDsoUKRppDtNSLKUBNr2E=";
+    hash = "sha256-Fl/fsKB04Kn4HwkNlpcuR3wTJFfn1gGgRGTwRUNDawY=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/dc/dcp/package.nix
+++ b/pkgs/by-name/dc/dcp/package.nix
@@ -15,16 +15,16 @@

 buildGoModule (finalAttrs: {
  pname = "dcp";
-  version = "0.25.9";
+  version = "0.25.5";

  src = fetchFromGitHub {
    owner = "microsoft";
    repo = "dcp";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-MjBnJRdlGF2efEH0TcJjM3JVEByRzeqAZ13sR9EL0Ik=";
+    hash = "sha256-umcrTAPWAInbjdZYhY0xEbI7heGwr+8FGMI7BIWSdD0=";
  };

-  vendorHash = "sha256-eJAMl1vGX2JANdYe8SWWLsNImd3raEEYvSfvwwfV4Xk=";
+  vendorHash = "sha256-hcuVUUr3kr3iBmSEhHy365LIWGGLFTYnBRa5jnt7kPw=";

  # This is required so we:
  # - Delete an inconsistent vendor directory from upstream
--- a/pkgs/by-name/dd/ddccontrol/package.nix
+++ b/pkgs/by-name/dd/ddccontrol/package.nix
@@ -2,51 +2,36 @@
  lib,
  stdenv,
  fetchFromGitHub,
-
-  # nativeBuildInputs
  autoreconfHook,
  intltool,
-  pkg-config,
-  rustPlatform,
-  cargo,
-  rustc,
-
-  # buildInputs
  libxml2,
  pciutils,
-  gtk3,
+  pkg-config,
+  gtk2,
  ddccontrol-db,
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "ddccontrol";
-  version = "3.2.0";
+  version = "1.0.3";

  src = fetchFromGitHub {
    owner = "ddccontrol";
    repo = "ddccontrol";
    tag = finalAttrs.version;
-    sha256 = "sha256-8VqnmWLXt6rXapAqvzvtDQ9XjQ7H6s7pLqPhQ6Zflc4=";
-  };
-
-  cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit (finalAttrs) pname version src;
-    hash = "sha256-UN308Tt9LCRLBSswem06UupjdIFntt6SqpTxteY5O78=";
+    sha256 = "sha256-qyD6i44yH3EufIW+LA/LBMW20Tejb49zvsDfv6YFD6c=";
  };

  nativeBuildInputs = [
    autoreconfHook
    intltool
    pkg-config
-    rustPlatform.cargoSetupHook
-    cargo
-    rustc
  ];

  buildInputs = [
    libxml2
    pciutils
-    gtk3
+    gtk2
    ddccontrol-db
  ];

@@ -55,14 +40,13 @@ stdenv.mkDerivation (finalAttrs: {
  ];

  prePatch = ''
-    substituteInPlace configure.ac \
-      --replace-fail \
-      "\$""{datadir}/ddccontrol-db" \
+    substituteInPlace configure.ac              \
+      --replace                                 \
+      "\$""{datadir}/ddccontrol-db"             \
      "${ddccontrol-db}/share/ddccontrol-db"
-    substituteInPlace src/lib/Makefile.am \
-      --replace-fail \
-      'DDCONTROL_DATADIR="$(datadir)/ddccontrol-db"' \
-      'DDCONTROL_DATADIR="${ddccontrol-db}/share/ddccontrol-db"'
+
+    substituteInPlace src/ddcpci/Makefile.am    \
+       --replace "chmod 4711" "chmod 0711"
  '';

  preConfigure = ''
@@ -72,7 +56,6 @@ stdenv.mkDerivation (finalAttrs: {
  meta = {
    description = "Program used to control monitor parameters by software";
    homepage = "https://github.com/ddccontrol/ddccontrol";
-    mainProgram = "ddccontrol";
    license = lib.licenses.gpl2Plus;
    platforms = lib.platforms.linux;
    maintainers = with lib.maintainers; [
--- a/pkgs/by-name/de/devin-desktop/info.json
+++ b/pkgs/by-name/de/devin-desktop/info.json
@@ -1,14 +1,14 @@
 {
  "aarch64-darwin": {
-    "version": "3.5.17",
+    "version": "3.4.27",
    "vscodeVersion": "1.110.1",
-    "url": "https://windsurf-stable.codeiumdata.com/darwin-arm64/stable/2c489dfc762456657db8662309c0d5e76e886397/Devin-darwin-arm64-3.5.17.zip",
-    "sha256": "bca8cc6154f99f5153cd5b508899d8db64be795a96856a14f1d052b7d8091edd"
+    "url": "https://windsurf-stable.codeiumdata.com/darwin-arm64/stable/0d4bf12ed4a7597cb8ae9016fe8474468aad98a2/Devin-darwin-arm64-3.4.27.zip",
+    "sha256": "c42b0671c246ef295807e822809cb82dfe65831d4879d68f25334f754babec8d"
  },
  "x86_64-linux": {
-    "version": "3.5.17",
+    "version": "3.4.27",
    "vscodeVersion": "1.110.1",
-    "url": "https://windsurf-stable.codeiumdata.com/linux-x64/stable/2c489dfc762456657db8662309c0d5e76e886397/Devin-linux-x64-3.5.17.tar.gz",
-    "sha256": "e7ce36c4baacc617a4d89b0e2fb4403f83b328fefd897aec1be5e31038be4e91"
+    "url": "https://windsurf-stable.codeiumdata.com/linux-x64/stable/0d4bf12ed4a7597cb8ae9016fe8474468aad98a2/Devin-linux-x64-3.4.27.tar.gz",
+    "sha256": "80850124b31331f63c24a201d1317bdacdfb438fb2bcc9b31c9b7a6391391619"
  }
 }
--- a/pkgs/by-name/de/devmem2/package.nix
+++ b/pkgs/by-name/de/devmem2/package.nix
@@ -0,0 +1,34 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+}:
+
+stdenv.mkDerivation {
+  pname = "devmem2";
+  version = "unstable-2004-08-05";
+
+  src = fetchurl {
+    urls = [
+      "http://lartmaker.nl/lartware/port/devmem2.c"
+      "https://raw.githubusercontent.com/hackndev/tools/7ed212230f8fbb1da3424a15ee88de3279bf96ec/devmem2.c"
+    ];
+    sha256 = "14f1k7v6i1yaxg4xcaaf5i4aqn0yabba857zjnbg9wiymy82qf7c";
+  };
+
+  hardeningDisable = [ "format" ]; # fix compile error
+
+  buildCommand = ''
+    $CC "$src" -o devmem2
+    install -D devmem2 "$out/bin/devmem2"
+  '';
+
+  meta = {
+    description = "Simple program to read/write from/to any location in memory";
+    mainProgram = "devmem2";
+    homepage = "http://lartmaker.nl/lartware/port/";
+    license = lib.licenses.gpl2Plus;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ bjornfor ];
+  };
+}
--- a/pkgs/by-name/di/dia/fix-build-with-poppler-26-06.patch
+++ b/pkgs/by-name/di/dia/fix-build-with-poppler-26-06.patch
@@ -1,33 +0,0 @@
-From 2373861a858fb6ee7d50870ae66a59f05c6cd4bd Mon Sep 17 00:00:00 2001
-From: Nadzeya Hutsko <nadzeya@ubuntu.com>
-Date: Wed, 22 Jul 2026 20:46:52 +0200
-Subject: [PATCH] Fix build with Poppler >= 26.06
-
-poppler 26.06 changed the Page box accessors to return a const reference
-instead of a pointer. Take the address of the result, guarded by a
-version check so older poppler still builds
---
- plug-ins/pdf/pdf-import.cpp | 5 +++++
- 1 file changed, 5 insertions(+)
-
-diff --git a/plug-ins/pdf/pdf-import.cpp b/plug-ins/pdf/pdf-import.cpp
-index 3af268646..35fc6d9e3 100644
--- a/plug-ins/pdf/pdf-import.cpp
-+++ b/plug-ins/pdf/pdf-import.cpp
-@@ -93,8 +93,13 @@ public :
-                       (Annot *annot, void *user_data) G_GNUC_UNUSED,
-                   void   *annotDisplayDecideCbkData   G_GNUC_UNUSED)
-   {
-+#if POPPLER_VERSION_MAJOR > 26 || (POPPLER_VERSION_MAJOR == 26 && POPPLER_VERSION_MINOR >= 6)
-+    const PDFRectangle *mediaBox = &page->getMediaBox();
-+    const PDFRectangle *clipBox = &page->getCropBox ();
-+#else
-     const PDFRectangle *mediaBox = page->getMediaBox();
-     const PDFRectangle *clipBox = page->getCropBox ();
-+#endif
- 
-     if (page->isOk()) {
-       real w1 = (clipBox->x2 - clipBox->x1);
-- 
-GitLab
-
--- a/pkgs/by-name/di/dia/package.nix
+++ b/pkgs/by-name/di/dia/package.nix
@@ -50,21 +50,16 @@ let
 in
 stdenv.mkDerivation {
  pname = "dia";
-  version = "0.97.2-unstable-2026-07-24";
+  version = "unstable-2025-10-26";

  src = fetchFromGitLab {
    domain = "gitlab.gnome.org";
    owner = "GNOME";
    repo = "dia";
-    rev = "ad68cc378b7a187706bc2648c48b44d16fb80819";
-    hash = "sha256-ejjSc9GGXD5GsbeRps1T20xifJuzWA1yq/G7jk797Cw=";
+    rev = "efdf829e8afdbbeb371820932769e35415ebe886";
+    hash = "sha256-VFFU5iJnVJdZ2tkNszZ2ooBD+GiCL6MqanzpEWIJerk=";
  };

-  patches = [
-    # https://gitlab.gnome.org/GNOME/dia/-/merge_requests/146
-    ./fix-build-with-poppler-26-06.patch
-  ];
-
  postPatch = ''
    # Fix build with poppler 25.10.0
    substituteInPlace plug-ins/pdf/pdf-import.cpp \
--- a/pkgs/by-name/di/diffnav/package.nix
+++ b/pkgs/by-name/di/diffnav/package.nix
@@ -10,21 +10,20 @@

 buildGoModule (finalAttrs: {
  pname = "diffnav";
-  version = "0.12.0";
+  version = "0.11.0";

  src = fetchFromGitHub {
    owner = "dlvhdr";
    repo = "diffnav";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-DrEbo9YYg4FCXQXuIkbPxO5Z3ZOPZJYeGoLoP/vT0Y0=";
+    hash = "sha256-6VtAQzZNLQrf8QYVXxLUgb3F6xguFDbwaE9kahPhbSE=";
  };

-  vendorHash = "sha256-2OzHyBPsylQVXhPlqk2owEhiibFi3H1UENvGGDdzGss=";
+  vendorHash = "sha256-gmmckzR0D1oFuTG5TAb6gLMoNbcZl9EsjbFjhPfJqnQ=";

  ldflags = [
    "-s"
    "-w"
-    "-X github.com/dlvhdr/diffnav/pkg/version.Version=${finalAttrs.version}"
  ];

  nativeBuildInputs = [
--- a/pkgs/by-name/di/diffyml/package.nix
+++ b/pkgs/by-name/di/diffyml/package.nix
@@ -8,17 +8,15 @@

 buildGoModule (finalAttrs: {
  pname = "diffyml";
-  version = "1.7.1";
+  version = "1.7.0";

  __structuredAttrs = true;

-  __darwinAllowLocalNetworking = true;
-
  src = fetchFromGitHub {
    owner = "szhekpisov";
    repo = "diffyml";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-bfFerbjpwQuTCnGKfqUj3ydf1xBdNoP+qH7UTmtZvTk=";
+    hash = "sha256-DIKHvFY/eW3CAF/ojW+D737vFCcZk0peRrSb8I/an9Q=";
  };

  vendorHash = "sha256-QE/EwVzMqUO24ZAl0WBibGx6x0kNo1AUTZtfnQvX50k=";
--- a/pkgs/by-name/ea/easyeffects/package.nix
+++ b/pkgs/by-name/ea/easyeffects/package.nix
@@ -61,13 +61,13 @@ in

 stdenv.mkDerivation (finalAttrs: {
  pname = "easyeffects";
-  version = "8.2.8";
+  version = "8.2.7";

  src = fetchFromGitHub {
    owner = "wwmm";
    repo = "easyeffects";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-gkUJxEmFfUAKUnr+Gs65y9l0bdNXXd0f8ql0keM2bVs=";
+    hash = "sha256-YYwVoqCRVAZVu8vCTN3ZSicy1Fzw3l+hQbooGAE/AEI=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/fa/fasmg/package.nix
+++ b/pkgs/by-name/fa/fasmg/package.nix
@@ -14,11 +14,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "fasmg";
-  version = "l8vn";
+  version = "l7xm";

  src = fetchzip {
    url = "https://flatassembler.net/fasmg.${finalAttrs.version}.zip";
-    sha256 = "sha256-/Izf7w7yofmPp1J85BgWbMLIGC4SGsCqXzhdecOo7CE=";
+    sha256 = "sha256-m/mLZLluvoxr0VsNVcBnHvv1LlagafkX6fwZSovtO9s=";
    stripRoot = false;
  };

--- a/pkgs/by-name/fo/forecast/package.nix
+++ b/pkgs/by-name/fo/forecast/package.nix
@@ -16,13 +16,13 @@

 rustPlatform.buildRustPackage {
  pname = "forecast";
-  version = "0-unstable-2026-07-17";
+  version = "0-unstable-2026-07-12";

  src = fetchFromGitHub {
    owner = "cosmic-utils";
    repo = "forecast";
-    rev = "22a7de05c4bdaa4a4fa33f51091eb681d021f90e";
-    hash = "sha256-z0WYytAEZ1PaO5yyh+iDbJOSPZmnKV503HUZTpQPUXw=";
+    rev = "0de1b7502979eb3704445c98ce8dbb7969e109da";
+    hash = "sha256-9IZDDIhZY+YC0SOie5z0Ed5UAvBcf+soZ0RRz8sr71w=";
  };

  cargoHash = "sha256-F5AlYm9bzJJUrDiY712dbwpCR3lzvQNFKXHzIDG+TVQ=";
--- a/pkgs/by-name/fr/freqle/package.nix
+++ b/pkgs/by-name/fr/freqle/package.nix
@@ -1,25 +0,0 @@
-{
-  lib,
-  rustPlatform,
-  fetchCrate,
-}:
-
-rustPlatform.buildRustPackage (finalAttrs: {
-  pname = "freqle";
-  version = "0.1.0";
-  __structuredAttrs = true;
-  src = fetchCrate {
-    inherit (finalAttrs) pname version;
-    hash = "sha256-1LL1C9jYPjboGgz0z7AdWeMZR7DApCDlQ8Cj7I+iADY=";
-  };
-  cargoHash = "sha256-VeI2jyq7EXpjIT4e6nuTXj8z5ANoZyfxd27k/4ZaY7k=";
-
-  meta = {
-    description = "Simple CLI frecency history";
-    homepage = "https://github.com/jonascarpay/freqle";
-    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ jonascarpay ];
-    mainProgram = "freqle";
-  };
-
-})
--- a/pkgs/by-name/fr/fromager/package.nix
+++ b/pkgs/by-name/fr/fromager/package.nix
@@ -1,55 +1,53 @@
 {
  lib,
+  stdenv,
+  python3,
  fetchFromGitHub,
-  python3Packages,
  writableTmpDirAsHomeHook,
 }:

-python3Packages.buildPythonApplication (finalAttrs: {
+python3.pkgs.buildPythonApplication (finalAttrs: {
  pname = "fromager";
-  version = "0.91.0";
+  version = "0.71.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "python-wheel-build";
    repo = "fromager";
    tag = finalAttrs.version;
-    hash = "sha256-N+4DbKNUpQdkJAfr0vwlfXJS8FLLBOXxuzkLoJblJM4=";
+    hash = "sha256-3zz37BZx8FcKNl8mSmClIrZxvL+2AS0hJDct6K7BhBE=";
  };

-  build-system = with python3Packages; [
+  build-system = with python3.pkgs; [
    hatchling
    hatch-vcs
  ];

-  dependencies = with python3Packages; [
+  dependencies = with python3.pkgs; [
    click
    elfdeps
-    license-expression
+    html5lib
    packaging
-    packageurl-python
+    pkginfo
    psutil
    pydantic
-    pypi-simple
    pyproject-hooks
    pyyaml
    requests
+    requests-mock
    resolvelib
    rich
-    starlette
+    setuptools
    stevedore
    tomlkit
    tqdm
    uv
-    uvicorn
    wheel
  ];

-  nativeCheckInputs = with python3Packages; [
+  nativeCheckInputs = with python3.pkgs; [
    pytestCheckHook
-    pytest-xdist
    requests-mock
-    spdx-tools
    twine
    uv
    writableTmpDirAsHomeHook
@@ -59,10 +57,21 @@ python3Packages.buildPythonApplication (finalAttrs: {
    "fromager"
  ];

-  # Upstream runs pytest with `--log-level DEBUG`, which this test suite
-  # relies on for caplog assertions against INFO records.
-  # Reported: https://github.com/python-wheel-build/fromager/issues/1274
-  pytestFlags = [ "--log-level=DEBUG" ];
+  disabledTestPaths = [
+    # Depends on wheel.cli module that is private since wheel 0.46.0
+    "tests/test_wheels.py"
+  ];
+
+  disabledTests = [
+    # Accessing pypi.org (not allowed in sandbox)
+    "test_get_build_backend_dependencies"
+    "test_get_build_sdist_dependencies"
+  ]
+  ++ lib.optionals (stdenv.hostPlatform.isAarch64 && stdenv.hostPlatform.isLinux) [
+    # Assumes platform.machine() returns 'arm64' on ARM64, which is not true for Linux.
+    # Re-enable once https://github.com/python-wheel-build/fromager/pull/849 is merged.
+    "test_add_constraint_conflict"
+  ];

  meta = {
    description = "Wheel maker";
--- a/pkgs/by-name/ga/gale/package.nix
+++ b/pkgs/by-name/ga/gale/package.nix
@@ -38,13 +38,13 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "gale";
-  version = "1.19.0";
+  version = "1.13.4";

  src = fetchFromGitHub {
    owner = "Kesomannen";
    repo = "gale";
    tag = finalAttrs.version;
-    hash = "sha256-VufV/Z1XODQKwbEpMrw0xNMdMl8D1t3bPIfdwRhQI9I=";
+    hash = "sha256-ZCHknOp6ll9q6OBW/5/mNcu0d0zZj1rkCjPiumjMVzk=";
  };

  pnpmDeps = fetchPnpmDeps {
@@ -56,7 +56,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
      ;
    pnpm = pnpm_10;
    fetcherVersion = 3;
-    hash = "sha256-/IR+34cdnCt9WpYdMaT92YIC/2JjEe/mZdeQewdWTek=";
+    hash = "sha256-bCGiYVmoWjpwneTQUwetna7u29BMIv48qWgZ2gd93hQ=";
  };

  postPatch = ''
@@ -70,11 +70,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
  cargoRoot = "src-tauri";
  buildAndTestSubdir = finalAttrs.cargoRoot;

-  cargoHash = "sha256-4WSWvMQIYPzfxjDyuQI37ymxJhMVGxmxYDVSoknIzmg=";
-
-  checkFlags = [
-    "--skip=config::bepinex::tests::check_from_string" # Fails a left == right check, even with left and right data being identical
-  ];
+  cargoHash = "sha256-kAPTiGHWO/eBapPcH8xItOFeZYC0URzLYdl2GMQ50Ls=";

  nativeBuildInputs = [
    jq
--- a/pkgs/by-name/gi/gitkraken/package.nix
+++ b/pkgs/by-name/gi/gitkraken/package.nix
@@ -56,19 +56,19 @@

 let
  pname = "gitkraken";
-  version = "12.3.1";
+  version = "12.2.1";

  throwSystem = throw "Unsupported system: ${stdenv.hostPlatform.system}";

  srcs = {
    x86_64-linux = fetchzip {
      url = "https://api.gitkraken.dev/releases/production/linux/x64/${version}/gitkraken-amd64.tar.gz";
-      hash = "sha256-VK96/i+7dXn6j/s2/PSzY4yQlawO0SmJ0F67gEcukNc=";
+      hash = "sha256-CX/NxvLrxia92vSIjWXzIiBdTfhZ8TW7a5g1hEt+Y/k=";
    };

    aarch64-darwin = fetchzip {
      url = "https://api.gitkraken.dev/releases/production/darwin/arm64/${version}/GitKraken-v${version}.zip";
-      hash = "sha256-WlMWIAoSTloqhYAhP/uifj7QpR843IL1oIQmZoXBPDE=";
+      hash = "sha256-JEgqJ6smqDG/2KFApRSYTuL1Ch1sIkhGDMjqVsgQUmc=";
    };
  };

--- a/pkgs/by-name/gs/gsender/package.nix
+++ b/pkgs/by-name/gs/gsender/package.nix
@@ -5,12 +5,12 @@
 }:

 let
-  version = "1.6.3";
+  version = "1.6.2";
  pname = "gsender";

  src = fetchurl {
    url = "https://github.com/Sienci-Labs/gsender/releases/download/v${version}/gSender-${version}-Linux-Intel-64Bit.AppImage";
-    hash = "sha256-xWsRSzJm5aA13qCBI2MRzauvPqoOBtxqtGb3gLAa3sI=";
+    hash = "sha256-DZBTnvbxh2n4KVhbbe7JG0/q+wNQVEkHN8w4+5RuQGw=";
  };

  appimageContents = appimageTools.extractType2 { inherit pname version src; };
--- a/pkgs/by-name/gt/gtkspell2/gettext-0.25.patch
+++ b/pkgs/by-name/gt/gtkspell2/gettext-0.25.patch
@@ -0,0 +1,15 @@
+diff --git a/configure.ac b/configure.ac
+index e926833..667a8e6 100644
+--- a/configure.ac
+++ b/configure.ac
+@@ -12,6 +12,10 @@ AC_CONFIG_SRCDIR(gtkspell/gtkspell.c)
+ AM_INIT_AUTOMAKE(AC_PACKAGE_NAME, AC_PACKAGE_VERSION)
+ AC_CONFIG_HEADERS([config.h])
+ 
+AC_CONFIG_MACRO_DIRS([m4])
+AM_GNU_GETTEXT_VERSION([0.25])
+AM_GNU_GETTEXT([external])
+
+ SPELLER_LIB=-lenchant
+       
+ AC_SUBST(SPELLER_LIB)
--- a/pkgs/by-name/gt/gtkspell2/package.nix
+++ b/pkgs/by-name/gt/gtkspell2/package.nix
@@ -0,0 +1,57 @@
+{
+  stdenv,
+  lib,
+  fetchurl,
+  fetchpatch,
+  autoreconfHook,
+  docbook_xsl,
+  gtk-doc,
+  intltool,
+  pkg-config,
+  aspell,
+  enchant,
+  gtk2,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "gtkspell";
+  version = "2.0.16";
+
+  src = fetchurl {
+    url = "mirror://sourceforge/gtkspell/gtkspell-${finalAttrs.version}.tar.gz";
+    sha256 = "00hdv28bp72kg1mq2jdz1sdw2b8mb9iclsp7jdqwpck705bdriwg";
+  };
+
+  patches = [
+    # Fix build with gettext 0.25
+    ./gettext-0.25.patch
+    # Build with enchant 2
+    # https://github.com/archlinux/svntogit-packages/tree/packages/gtkspell/trunk
+    (fetchpatch {
+      url = "https://github.com/archlinux/svntogit-packages/raw/17fb30b5196db378c18e7c115f28e97b962b95ff/trunk/enchant-2.diff";
+      sha256 = "0d9409bnapwzwhnfpz3dvl6qalskqa4lzmhrmciazsypbw3ry5rf";
+    })
+  ];
+
+  nativeBuildInputs = [
+    autoreconfHook
+    docbook_xsl
+    gtk2 # GLIB_GNU_GETTEXT
+    gtk-doc
+    intltool
+    pkg-config
+  ];
+
+  buildInputs = [
+    aspell
+    enchant
+    gtk2
+  ];
+
+  meta = {
+    description = "Word-processor-style highlighting and replacement of misspelled words";
+    homepage = "https://gtkspell.sourceforge.net";
+    platforms = lib.platforms.unix;
+    license = lib.licenses.gpl2;
+  };
+})
--- a/pkgs/by-name/i2/i2p/package.nix
+++ b/pkgs/by-name/i2/i2p/package.nix
@@ -32,7 +32,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "i2p";
-  version = "2.13.0";
+  version = "2.12.0";

  src = fetchzip {
    urls = [
@@ -43,7 +43,7 @@ stdenv.mkDerivation (finalAttrs: {
      "https://files.i2p-projekt.de/"
      "https://download.i2p2.no/releases/"
    ]);
-    hash = "sha256-fCtjCKbvad8Uk+1ir1suJ0MqV8JjAcmOKXJicbUtKls=";
+    hash = "sha256-gpxmCNtatF6wVvBBB5/LWzgL5e7i8c145dQ/yzldwwQ=";
  };

  strictDeps = true;
--- a/pkgs/by-name/il/iloader/package.nix
+++ b/pkgs/by-name/il/iloader/package.nix
@@ -22,13 +22,13 @@ rustPlatform.buildRustPackage (finalAttrs: {
  __structuredAttrs = true;

  pname = "iloader";
-  version = "2.2.7";
+  version = "2.2.6";

  src = fetchFromGitHub {
    owner = "nab138";
    repo = "iloader";
    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-DLs9jNnkykAdFSaDZCfLmUl+oYja7kxWlV5Db2TQQE8=";
+    sha256 = "sha256-zSl08bhJ/OrdcvvL1ciybxgnLqrg4IinmcGXrsPQYyQ=";
  };

  nodeModules = stdenv.mkDerivation {
@@ -71,7 +71,7 @@ rustPlatform.buildRustPackage (finalAttrs: {

  cargoRoot = "src-tauri";
  buildAndTestSubdir = "src-tauri";
-  cargoHash = "sha256-92C6xeEVLtjCSqkJBrCOaMjBJj7yIuRM3zRtkurnBT4=";
+  cargoHash = "sha256-6nDqIikItl5SuHN2o/iQREiOkY+bYkP7akShOEtY9JY=";

  doCheck = false;

--- a/Show More
+++ b/Show More