Merge master into staging-next

Diff: https://github.com/apache/iceberg-python/compare/pyiceberg-0.11.1...pyiceberg-0.12.0

Changelog: https://github.com/apache/iceberg-python/releases/tag/pyiceberg-0.12.0

.github/workflows/check.yml

@@ -122,7 +122,7 @@ jobs:
         with:
           github-token: ${{ steps.app-token.outputs.token || github.token }}
           script: |
-            const { default: checkManualFileEdits } = await import('${{ github.workspace }}/trusted/ci/github-script/manual-file-edits.js')
+            const { default: checkManualFileEdits } = await import('${{ github.workspace }}/trusted/ci/github-script/manual-file-edits.ts')
             await checkManualFileEdits({
               github,
               context,

.github/workflows/test.yml

@@ -84,6 +84,7 @@ jobs:
               'ci/github-script/commits.js',
               'ci/github-script/get-pr-commit-details.js',
               'ci/github-script/lint-commits.js',
+              'ci/github-script/manual-file-edits.ts',
               'ci/github-script/merge.js',
               'ci/github-script/package.json',
               'ci/github-script/package-lock.json',

ci/github-script/manual-file-edits.ts

@@ -2,21 +2,18 @@ import { getCommitDetailsForPR } from './get-pr-commit-details.js'
 import { dismissReviews, postReview } from './reviews.js'
 import { classify } from './supportedBranches.js'
 
-/**
- * @param {{
- *  github: InstanceType<typeof import('@actions/github/lib/utils').GitHub>,
- *  context: typeof import('@actions/github').context,
- *  core: typeof import('@actions/core'),
- *  repoPath?: string,
- *  dry: boolean,
- * }} CheckManualFileEditsProps
- */
 export default async function checkManualFileEdits({
   github,
   context,
   core,
   repoPath,
   dry,
+}: {
+  github: InstanceType<typeof import('@actions/github/lib/utils').GitHub>
+  context: typeof import('@actions/github').context
+  core: typeof import('@actions/core')
+  repoPath?: string
+  dry: boolean
 }) {
   const reviewKey = 'manual-file-edits'
 

ci/github-script/run

@@ -123,7 +123,7 @@ program
   .argument('<repo>', 'Name of the GitHub repository to run on (Example: nixpkgs)')
   .argument('<pr>', 'Number of the Pull Request to run on')
   .action(async (owner, repo, pr, options) => {
-    const checkManualFileEdits = (await import('./manual-file-edits.js')).default
+    const checkManualFileEdits = (await import('./manual-file-edits.ts')).default
     await run(checkManualFileEdits, owner, repo, pr, options)
   })
 

doc/release-notes/rl-2611.section.md

@@ -33,6 +33,9 @@
   The release also removes legacy JSONP endpoints and changes several security-sensitive operations from GET to POST with CSRF tokens.
   Review the upstream [4.6.7 release notes](https://github.com/YesWiki/yeswiki/releases/tag/v4.6.7) before upgrading custom themes or integrations.
 
+- `zabbix.<package>` now defaults to version 7.4. If you want to keep using Zabbix 6.0, use `pkgs.zabbix60.<package>`.
+  Note that Zabbix 6.0 is in limited support, and will be deprecated on February 28, 2027. Consider upgrading.
+
 - `perlPackages.NetOAuth` has been updated from 0.28 to 0.33.
   Callers that verify messages must now set `allowed_signature_methods` per message or configure `@Net::OAuth::ALLOWED_SIGNATURE_METHODS`; `verify` otherwise throws an exception.
   See the [upstream changelog](https://metacpan.org/dist/Net-OAuth/changes) for details.
@@ -77,6 +80,8 @@
 
 - `jmtpfs` has been removed due to lack of maintenance and fuse3 support.
 
+- `landrun` was updated to `0.1.17`, which included breaking changes, reference the [breaking changes](https://github.com/Zouuup/landrun/releases/tag/v0.1.17) section in the `landrun` release notes.
+
 - `libgdata` has been removed, as it was archived upstream and relied on the insecure libsoup 2.4.
 
 - `mcphost` has been removed, as it was archived upstream and declared unmaintained.

nixos/doc/manual/release-notes/rl-2611.section.md

@@ -191,6 +191,8 @@
 
 - `strongSwan` has been updated to 6.1.0, which defaults to only accepts IKEv2 connections as responder.
 
+- `wivrn` has dropped support for PulseAudio in 26.9. WiVRn now only supports audio through PipeWire.
+
 - The `extraArgs` and `check` arguments to `nixos/lib/eval-config.nix` (and therefore to `lib.nixosSystem`) have been removed after being deprecated with a warning since 2021. Passing them is now an evaluation error. Instead of `extraArgs`, set `config._module.args`; instead of `check = false`, set `config._module.check = false`. The `extraArgs` attribute on the resulting configuration has been removed as well.
 
 - Rustical migrates from `settings.http.host` and `settings.http.port` to `settings.http.bind` to support UNIX domain sockets as well as TCP sockets in one setting.
@@ -301,6 +303,8 @@
 
 - `programs.regreet` has been renamed to `services.displayManager.regreet`.
 
+- `services.harmonia` gained [`gc`](#opt-services.harmonia.gc.enable) options that run `harmonia-gc`, a faster reimplementation of `nix-collect-garbage`, either on demand via `harmonia-gc.service` or on a timer with `services.harmonia.gc.automatic` as an alternative to `nix.gc.automatic`.
+
 - `komodo` has been updated to the v2 release line (2.x). See the [upstream v1 → v2 upgrade guide](https://github.com/moghtech/komodo/releases/tag/v2.0.0).
 
 - `temporal` has been updated to the 1.31 release line. Always consult the [upstream upgrade

nixos/modules/services/networking/harmonia.nix

@@ -8,6 +8,7 @@ let
   cfg = config.services.harmonia;
   cacheCfg = cfg.cache;
   daemonCfg = cfg.daemon;
+  gcCfg = cfg.gc;
 
   format = pkgs.formats.toml { };
 
@@ -69,6 +70,105 @@ in
         };
       };
 
+      gc = {
+        enable = lib.mkEnableOption "harmonia-gc, a faster nix-collect-garbage";
+
+        automatic = lib.mkOption {
+          type = lib.types.bool;
+          default = false;
+          description = "Run garbage collection automatically on a schedule.";
+        };
+
+        dates = lib.mkOption {
+          type = with lib.types; either singleLineStr (listOf str);
+          apply = lib.toList;
+          default = [ "03:15" ];
+          example = "weekly";
+          description = ''
+            When to run garbage collection. Calendar event in the format
+            specified by {manpage}`systemd.time(7)`.
+          '';
+        };
+
+        randomizedDelaySec = lib.mkOption {
+          type = lib.types.singleLineStr;
+          default = "0";
+          example = "45min";
+          description = "Randomized delay before each run.";
+        };
+
+        persistent = lib.mkOption {
+          type = lib.types.bool;
+          default = true;
+          description = "Run on next boot if a scheduled run was missed.";
+        };
+
+        deleteOlderThan = lib.mkOption {
+          type = lib.types.nullOr lib.types.singleLineStr;
+          default = null;
+          example = "30d";
+          description = "Delete profile generations older than this.";
+        };
+
+        ensureFree = lib.mkOption {
+          type = lib.types.nullOr lib.types.singleLineStr;
+          default = null;
+          example = "50G";
+          description = ''
+            Free space until this much is available, then stop. Accepts an
+            absolute size like "50G" or a percentage of the store's filesystem
+            like "20%".
+          '';
+        };
+
+        keepRecent = lib.mkOption {
+          type = lib.types.nullOr lib.types.singleLineStr;
+          default = null;
+          example = "1d";
+          description = ''
+            Keep store paths registered within this time window. Avoids deleting
+            build dependencies fetched during a recent build.
+          '';
+        };
+
+        noVacuum = lib.mkOption {
+          type = lib.types.bool;
+          default = false;
+          description = ''
+            Skip the SQLite VACUUM after garbage collection. Enable on busy
+            builders, where concurrent nix-daemon readers prevent cleanup of
+            the database-sized WAL that VACUUM produces.
+          '';
+        };
+
+        chunkSize = lib.mkOption {
+          type = lib.types.nullOr lib.types.ints.positive;
+          default = null;
+          description = ''
+            Number of dead paths invalidated per database transaction. Lower
+            values keep the WAL (and its disk use) smaller during deletion at
+            the cost of more checkpoints; null uses the built-in default.
+          '';
+        };
+
+        gcRootsDirs = lib.mkOption {
+          type = lib.types.listOf lib.types.str;
+          default = [ ];
+          example = [ "/mnt/extra-roots" ];
+          description = ''
+            Extra directories to scan for GC roots, treated like the standard
+            gcroots directory. Nix only scans its own state directories; this
+            keeps roots that live elsewhere from being collected.
+          '';
+        };
+
+        extraArgs = lib.mkOption {
+          type = lib.types.listOf lib.types.str;
+          default = [ ];
+          description = "Extra arguments to pass to harmonia-gc.";
+        };
+      };
+
       daemon = {
         enable = lib.mkEnableOption "Harmonia daemon: Nix daemon protocol implementation";
 
@@ -194,6 +294,63 @@ in
       };
     })
 
+    (lib.mkIf gcCfg.enable {
+      assertions = [
+        {
+          assertion = gcCfg.automatic -> config.nix.enable;
+          message = "services.harmonia.gc.automatic requires nix.enable";
+        }
+      ];
+
+      warnings = lib.optional (gcCfg.automatic && config.nix.gc.automatic) ''
+        Both services.harmonia.gc.automatic and nix.gc.automatic are enabled.
+        Disable nix.gc.automatic to avoid running two garbage collectors.
+      '';
+
+      systemd.services.harmonia-gc = {
+        description = "Harmonia Nix Garbage Collector";
+        # `nix config show` for keep-derivations/keep-outputs.
+        path = [ config.nix.package ];
+        serviceConfig = {
+          Type = "oneshot";
+          ExecStart = lib.escapeShellArgs (
+            [ (lib.getExe' cfg.package "harmonia-gc") ]
+            ++ lib.optionals (gcCfg.deleteOlderThan != null) [
+              "--delete-older-than"
+              gcCfg.deleteOlderThan
+            ]
+            ++ lib.optionals (gcCfg.ensureFree != null) [
+              "--ensure-free"
+              gcCfg.ensureFree
+            ]
+            ++ lib.optionals (gcCfg.keepRecent != null) [
+              "--keep-recent"
+              gcCfg.keepRecent
+            ]
+            ++ lib.optional gcCfg.noVacuum "--no-vacuum"
+            ++ lib.optionals (gcCfg.chunkSize != null) [
+              "--chunk-size"
+              (toString gcCfg.chunkSize)
+            ]
+            ++ lib.concatMap (d: [
+              "--gc-roots-dir"
+              d
+            ]) gcCfg.gcRootsDirs
+            ++ gcCfg.extraArgs
+          );
+        };
+        startAt = lib.optionals gcCfg.automatic gcCfg.dates;
+        restartIfChanged = false;
+      };
+
+      systemd.timers.harmonia-gc = lib.mkIf gcCfg.automatic {
+        timerConfig = {
+          RandomizedDelaySec = gcCfg.randomizedDelaySec;
+          Persistent = gcCfg.persistent;
+        };
+      };
+    })
+
     (lib.mkIf daemonCfg.enable {
       systemd.services.harmonia-daemon =
         let

nixos/modules/services/networking/nordvpn.nix

@@ -166,8 +166,6 @@ in
 
   meta = {
     doc = ./nordvpn.md;
-    maintainers = with lib.maintainers; [
-      novalkun
-    ];
+    maintainers = pkgs.nordvpn.meta.maintainers;
   };
 }

nixos/modules/services/web-apps/weblate.nix

@@ -12,25 +12,35 @@ let
   cacheDir = "${dataDir}/cache";
   settingsDir = "${dataDir}/settings";
 
-  finalPackage = cfg.package.overridePythonAttrs (old: {
-    # We only support the PostgreSQL backend in this module
-    dependencies = old.dependencies ++ cfg.package.optional-dependencies.postgres;
-    # Use a settings module in dataDir, to avoid having to rebuild the package
-    # when user changes settings.
-    makeWrapperArgs = (old.makeWrapperArgs or [ ]) ++ [
-      "--set PYTHONPATH  \"${settingsDir}\""
-      "--set DJANGO_SETTINGS_MODULE \"settings\""
-    ];
-  });
-  inherit (finalPackage) python;
-
-  pythonEnv = python.buildEnv.override {
-    extraLibs = with python.pkgs; [
-      (toPythonModule finalPackage)
-      celery
-    ];
+  python = cfg.package.python.override {
+    self = python;
+    packageOverrides = _final: prev: {
+      gunicorn = prev.gunicorn.overridePythonAttrs (old: {
+        # Allows Gunicorn to set a meaningful process name
+        dependencies = (old.dependencies or [ ]) ++ old.optional-dependencies.setproctitle;
+      });
+      weblate = prev.toPythonModule (
+        (cfg.package.override { python3 = python; }).overridePythonAttrs (old: {
+          # We only support the PostgreSQL backend in this module
+          dependencies = old.dependencies ++ cfg.package.optional-dependencies.postgres;
+          # Use a settings module in dataDir, to avoid having to rebuild the package
+          # when user changes settings.
+          makeWrapperArgs = (old.makeWrapperArgs or [ ]) ++ [
+            "--set PYTHONPATH  \"${settingsDir}\""
+            "--set DJANGO_SETTINGS_MODULE \"settings\""
+          ];
+        })
+      );
+    };
   };
 
+  pythonEnv = python.withPackages (
+    ps: with ps; [
+      weblate
+      gunicorn
+    ]
+  );
+
   # This extends and overrides the weblate/settings_example.py code found in upstream.
   weblateConfig = ''
     # This was autogenerated by the NixOS module.
@@ -42,10 +52,8 @@ let
     SESSION_COOKIE_SECURE = ENABLE_HTTPS
     DATA_DIR = "${dataDir}"
     CACHE_DIR = f"{DATA_DIR}/cache"
-    STATIC_ROOT = "${finalPackage.static}"
+    STATIC_ROOT = "${python.pkgs.weblate.static}"
     MEDIA_ROOT = "/var/lib/weblate/media"
-    COMPRESS_ROOT = "${finalPackage.static}"
-    COMPRESS_OFFLINE = True
     DEBUG = False
 
     with open("${cfg.djangoSecretKeyFile}") as f:
@@ -119,7 +127,7 @@ let
       ''
         mkdir -p $out
         cat \
-          ${finalPackage}/${python.sitePackages}/weblate/settings_example.py \
+          ${python.pkgs.weblate}/${python.sitePackages}/weblate/settings_example.py \
           $weblateConfigPath \
           > $out/settings.py
       '';
@@ -127,8 +135,6 @@ let
   environment = {
     PYTHONPATH = "${settingsDir}:${pythonEnv}/${python.sitePackages}/";
     DJANGO_SETTINGS_MODULE = "settings";
-    # We run Weblate through gunicorn, so we can't utilise the env var set in the wrapper.
-    inherit (finalPackage) GI_TYPELIB_PATH;
   };
 
   # Packages needed at runtime
@@ -246,8 +252,8 @@ in
         enableACME = true;
 
         locations = {
-          "= /favicon.ico".alias = "${finalPackage}/${python.sitePackages}/weblate/static/favicon.ico";
-          "/static/".alias = "${finalPackage.static}/";
+          "= /favicon.ico".alias = "${python.pkgs.weblate}/${python.sitePackages}/weblate/static/favicon.ico";
+          "/static/".alias = "${python.pkgs.weblate.static}/";
           "/".proxyPass = "http://unix:///run/weblate.socket";
         };
       };
@@ -261,7 +267,7 @@ in
         User = "postgres";
         Group = "postgres";
         ExecStart = ''
-          ${config.services.postgresql.package}/bin/psql weblate -c "CREATE EXTENSION IF NOT EXISTS pg_trgm"
+          ${lib.getExe' config.services.postgresql.finalPackage "psql"} weblate -c "CREATE EXTENSION IF NOT EXISTS pg_trgm"
         '';
       };
     };
@@ -285,7 +291,7 @@ in
         StateDirectory = "weblate";
         User = "weblate";
         Group = "weblate";
-        ExecStart = "${finalPackage}/bin/weblate migrate --noinput";
+        ExecStart = "${lib.getExe' pythonEnv "weblate"} migrate --noinput";
       };
     };
 
@@ -310,7 +316,7 @@ in
           pidFile = "/run/celery/weblate-%%n.pid";
           nodes = "celery notify memory backup translate";
           cmd = verb: ''
-            ${pythonEnv}/bin/celery multi ${verb} \
+            ${lib.getExe' pythonEnv "celery"} multi ${verb} \
               ${nodes} \
               -A "weblate.utils" \
               --pidfile=${pidFile} \
@@ -334,14 +340,14 @@ in
           Type = "forking";
           User = "weblate";
           Group = "weblate";
-          WorkingDirectory = "${finalPackage}/${python.sitePackages}/weblate/";
+          WorkingDirectory = "${python.pkgs.weblate}/${python.sitePackages}/weblate/";
           RuntimeDirectory = "celery";
           RuntimeDirectoryPreserve = "restart";
           LogsDirectory = "celery";
           ExecStart = cmd "start";
           ExecReload = cmd "restart";
           ExecStop = ''
-            ${pythonEnv}/bin/celery multi stopwait \
+            ${lib.getExe' pythonEnv "celery"} multi stopwait \
               ${nodes} \
               --pidfile=${pidFile}
           '';
@@ -378,20 +384,13 @@ in
       serviceConfig = {
         Type = "notify";
         NotifyAccess = "all";
-        ExecStart =
-          let
-            gunicorn = python.pkgs.gunicorn.overridePythonAttrs (old: {
-              # Allows Gunicorn to set a meaningful process name
-              dependencies = (old.dependencies or [ ]) ++ old.optional-dependencies.setproctitle;
-            });
-          in
-          ''
-            ${lib.getExe gunicorn} \
-              --name=weblate \
-              --bind='unix:///run/weblate.socket' \
-              --preload \
-              weblate.wsgi
-          '';
+        ExecStart = ''
+          ${lib.getExe' pythonEnv "gunicorn"} \
+            --name=weblate \
+            --bind='unix:///run/weblate.socket' \
+            --preload \
+            weblate.wsgi
+        '';
         ExecReload = "${lib.getExe' pkgs.coreutils "kill"} -s HUP $MAINPID";
         KillMode = "mixed";
         PrivateTmp = true;
@@ -435,7 +434,7 @@ in
     users.users.weblate = {
       isSystemUser = true;
       group = "weblate";
-      packages = [ finalPackage ] ++ weblatePath;
+      packages = [ python.pkgs.weblate ] ++ weblatePath;
     };
 
     users.groups.weblate.members = [ config.services.nginx.user ];

nixos/modules/services/x11/desktop-managers/cinnamon.nix

@@ -277,6 +277,7 @@ in
           warpinator
 
           # cinnamon xapp
+          xepub
           xviewer
           xreader
           xed-editor

nixos/tests/all-tests.nix

@@ -833,6 +833,7 @@ in
   };
   haproxy = runTest ./haproxy.nix;
   harmonia = runTest ./harmonia.nix;
+  harmonia-gc = runTest ./harmonia-gc.nix;
   haste-server = runTest ./haste-server.nix;
   hbase2 = runTest {
     imports = [ ./hbase.nix ];

nixos/tests/coredns.nix

@@ -28,7 +28,7 @@
               position = "start-of-file";
             }
           ];
-          vendorHash = "sha256-cvgq/Djlxjiu0C5QjaxrlEeG7O2mB6mGAwV7/reYlpY=";
+          vendorHash = "sha256-1NEpLW5giadKYzB0JAYZugXJ0aO+vRuJzFHMP2jDszc=";
         };
       };
     };

nixos/tests/harmonia-gc.nix

@@ -0,0 +1,54 @@
+{ pkgs, ... }:
+{
+  name = "harmonia-gc";
+  meta.maintainers = [ pkgs.lib.maintainers.mic92 ];
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      services.harmonia.gc = {
+        enable = true;
+        automatic = true;
+        keepRecent = "1h";
+      };
+      nix.enable = true; # disabled by default. See all-tests.nix / tag(no-nix-by-default)
+      virtualisation.writableStore = true;
+      environment.systemPackages = [
+        pkgs.hello
+        pkgs.sqlite
+      ];
+    };
+
+  testScript = ''
+    machine.wait_for_unit("multi-user.target")
+    machine.succeed("systemctl is-active harmonia-gc.timer")
+
+    db = "/nix/var/nix/db/db.sqlite"
+
+    def gc() -> None:
+        machine.succeed("systemctl start harmonia-gc.service")
+
+    # load-db at boot sets registrationTime=now; stop keepRecent from pinning everything.
+    machine.succeed(f"sqlite3 {db} 'UPDATE ValidPaths SET registrationTime = 1'")
+
+    machine.succeed("echo dead > /tmp/dead", "echo rooted > /tmp/rooted")
+    dead = machine.succeed("nix-store --add /tmp/dead").strip()
+    rooted = machine.succeed("nix-store --add /tmp/rooted").strip()
+    machine.succeed(f"ln -s {rooted} /nix/var/nix/gcroots/rooted")
+    machine.succeed(
+        f"sqlite3 {db} \"UPDATE ValidPaths SET registrationTime = 1 WHERE path IN ('{dead}', '{rooted}')\""
+    )
+
+    gc()
+    machine.fail(f"test -e {dead}")
+    machine.succeed(f"test -e {rooted}")
+    # system profile is a root
+    machine.succeed("hello --version")
+
+    # keepRecent pins freshly registered paths
+    machine.succeed("echo recent > /tmp/recent")
+    recent = machine.succeed("nix-store --add /tmp/recent").strip()
+    gc()
+    machine.succeed(f"test -e {recent}")
+  '';
+}

nixos/tests/nordvpn.nix

@@ -1,7 +1,7 @@
-{ lib, ... }:
+{ lib, pkgs, ... }:
 {
   name = "nordvpn";
-  meta.maintainers = [ ];
+  meta.maintainers = pkgs.nordvpn.meta.maintainers;
   nodes =
     let
       commonConfig = user: {

pkgs/applications/editors/android-studio/default.nix

@@ -75,15 +75,15 @@ let
         }
     );
   stableVersion = {
-    version = "2026.1.4.7"; # "Android Studio Quail 4 | 2026.1.4"
+    version = "2026.1.4.8"; # "Android Studio Quail 4 | 2026.1.4 Patch 1"
     sources = {
       x86_64-linux = {
-        sha256Hash = "sha256-S+JACD31raKQl12H1g/CEqPTjU8lihJQmJiFqdvHmYA=";
-        url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2026.1.4.7/android-studio-quail4-linux.tar.gz";
+        sha256Hash = "sha256-Jcl8psa1BfKiC/+WLf0ocYMn9h4lsJqbyRXx2uex5TQ=";
+        url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2026.1.4.8/android-studio-quail4-patch1-linux.tar.gz";
       };
       aarch64-darwin = {
-        sha256Hash = "sha256-u9F+0KzGic+IAXCDd4U3Zg5KcUgIZ/3odWF/vaAqCuw=";
-        url = "https://edgedl.me.gvt1.com/android/studio/install/2026.1.4.7/android-studio-quail4-mac_arm.dmg";
+        sha256Hash = "sha256-GjOTMGAH+Qy/Luc+Rb64CasJqkBsL2Hun+gbTvURwGY=";
+        url = "https://edgedl.me.gvt1.com/android/studio/install/2026.1.4.8/android-studio-quail4-patch1-mac_arm.dmg";
       };
     };
   };

pkgs/applications/editors/emacs/elisp-packages/manual-packages/ebuild-mode/package.nix

@@ -6,11 +6,11 @@
 
 melpaBuild (finalAttrs: {
   pname = "ebuild-mode";
-  version = "1.84";
+  version = "1.85";
 
   src = fetchzip {
     url = "https://gitweb.gentoo.org/proj/ebuild-mode.git/snapshot/ebuild-mode-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-+WbKgOR0eCIvBgQrXzVOk8k2mV7INObY59vc46KvMYo=";
+    hash = "sha256-LSXDf4LHqk8+ga36BIQ+LHIaJQRpen293di1rNrMunE=";
   };
 
   meta = {

pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix

@@ -21,22 +21,22 @@ vscode-utils.buildVscodeMarketplaceExtension (finalAttrs: {
       sources = {
         "x86_64-linux" = {
           arch = "linux-x64";
-          hash = "sha256-XxTNjmmIXKK1pDSSqn/oHJDZupjQoqZZWfT7YR9C98k=";
+          hash = "sha256-EuHegVYyW8+IRcKrbMmW/xw6U2088yX+3j/5FOP7eEU=";
         };
         "aarch64-linux" = {
           arch = "linux-arm64";
-          hash = "sha256-ibCtMohLQcV9QjBBuAyZc4qipyqa7p29jkvolFsBXUs=";
+          hash = "sha256-mI6KrspZHYFnjLYgbmrYzCFVUbbo20OOv0nyaoxboSc=";
         };
         "aarch64-darwin" = {
           arch = "darwin-arm64";
-          hash = "sha256-0T/mvEeEUzSbIraZ2ps+k6tDoY5o3AIP4O8tm8R5YHI=";
+          hash = "sha256-bYpI2+ak7sW2RPwGmoHl8JwFFPR/hRl6XYbEbJwsL2M=";
         };
       };
     in
     {
       name = "claude-code";
       publisher = "anthropic";
-      version = "2.1.276";
+      version = "2.1.278";
     }
     // sources.${stdenvNoCC.hostPlatform.system}
       or (throw "Unsupported system ${stdenvNoCC.hostPlatform.system}");

pkgs/applications/editors/vscode/extensions/tombi-toml.tombi/default.nix

@@ -7,15 +7,15 @@
 let
   supported = {
     x86_64-linux = {
-      hash = "sha256-PdUKx/IOMI9xegw8NmOqcAh6WZzizwNOVcbq4XgJED4=";
+      hash = "sha256-gdyO/zg0NS8Md0o8WG96/0SrMw+VdJnRge6Io16l30Q=";
       arch = "linux-x64";
     };
     aarch64-linux = {
-      hash = "sha256-qBmWuA9hmJRGthMA38gHULPzjcf/JdR1XuXmUR3PWuY=";
+      hash = "sha256-MLj1xREDTZCrWVsTZGifSUNFKKMLGDtF3xV9kIR3umQ=";
       arch = "linux-arm64";
     };
     aarch64-darwin = {
-      hash = "sha256-N+kxQnaaCN+hIZ9WEaOuReEeiYa/N7Bd1/Z/NRL/gCQ=";
+      hash = "sha256-4fy778ogxyuN6irrAO9ZTHAMH9Va/QjF4PoHEZCBdFY=";
       arch = "darwin-arm64";
     };
   };
@@ -30,7 +30,7 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = base // {
     name = "tombi";
     publisher = "tombi-toml";
-    version = "1.5.2";
+    version = "1.5.5";
   };
   meta = {
     description = "TOML Language Server";

pkgs/by-name/an/andika/package.nix

@@ -2,6 +2,7 @@
   lib,
   stdenvNoCC,
   fetchzip,
+  installFonts,
 }:
 
 stdenvNoCC.mkDerivation (finalAttrs: {
@@ -13,10 +14,16 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     hash = "sha256-46kbzFxNEpSuqyUwpScnxxgZi1dJlwK+AUkdULcinok=";
   };
 
+  nativeBuildInputs = [ installFonts ];
+
+  outputs = [
+    "out"
+    "webfont"
+  ];
+
   installPhase = ''
     runHook preInstall
 
-    install -Dm644 *.ttf -t $out/share/fonts/truetype
     install -Dm644 OFL.txt OFL-FAQ.txt README.txt FONTLOG.txt -t $out/share/doc/andika-${finalAttrs.version}
 
     runHook postInstall

pkgs/by-name/aq/aquamarine/package.nix

@@ -23,13 +23,13 @@
 }:
 gcc16Stdenv.mkDerivation (finalAttrs: {
   pname = "aquamarine";
-  version = "0.15.0";
+  version = "0.15.1";
 
   src = fetchFromGitHub {
     owner = "hyprwm";
     repo = "aquamarine";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-RO90Fk+Rn2Yy+I8oL4ePTLLKLgOAr8hrTx7tlpwdLaA=";
+    hash = "sha256-jiUl3+k9K+BASO4hvKFhlCMUpHPPoy2q5uZMl3pzOF0=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/at/atlauncher/package.nix

@@ -27,13 +27,13 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "atlauncher";
-  version = "3.4.41.2";
+  version = "3.4.41.3";
 
   src = fetchFromGitHub {
     owner = "ATLauncher";
     repo = "ATLauncher";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-BI4kANjw9kQF4mnkDWKfyrVkXVmgqJZWr4ODkUMwR9w=";
+    hash = "sha256-tZ88mbpHmmoNLPN4lyWJqxkdVIhJuZBLQ0TO3jjWz0M=";
   };
 
   patches = [

pkgs/by-name/au/aurral/package.nix

@@ -16,7 +16,7 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "aurral";
-  version = "2.9.0";
+  version = "2.9.1";
 
   __structuredAttrs = true;
 
@@ -24,7 +24,7 @@ buildNpmPackage (finalAttrs: {
     owner = "lklynet";
     repo = "aurral";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-pwk+efWL0dfvKiobRmGXgPtvunpRDOVbtxohbJamVqY=";
+    hash = "sha256-HiOcDvp+ZZozWPEoou0UJFsZAoql89q2WVZaj7fgVrs=";
   };
 
   # Specifies files to package leveraging npm & nix hooks. Not used by upstream.

pkgs/by-name/ba/bam/package.nix

@@ -44,6 +44,6 @@ stdenv.mkDerivation (finalAttrs: {
     ];
     platforms = lib.platforms.linux;
     license = lib.licenses.zlib;
-    downloadPage = "http://matricks.github.com/bam/";
+    downloadPage = "https://matricks.github.io/bam/";
   };
 })

pkgs/by-name/bc/bcal/package.nix

@@ -5,12 +5,16 @@
   readline,
   bc,
   python3Packages,
+  versionCheckHook,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "bcal";
   version = "2.6";
 
+  strictDeps = true;
+  __structuredAttrs = true;
+
   src = fetchFromGitHub {
     owner = "jarun";
     repo = "bcal";
@@ -29,6 +33,9 @@ stdenv.mkDerivation (finalAttrs: {
     python3Packages.pytestCheckHook
   ];
 
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+
   enabledTestPaths = [ "test.py" ];
 
   meta = {

pkgs/by-name/be/beekeeper-studio/package.nix

@@ -40,7 +40,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "beekeeper-studio";
-  version = "6.0.5";
+  version = "6.1.1";
 
   src =
     let
@@ -54,9 +54,9 @@ stdenv.mkDerivation (finalAttrs: {
     fetchurl {
       url = "https://github.com/beekeeper-studio/beekeeper-studio/releases/download/v${finalAttrs.version}/${asset}";
       hash = selectSystem {
-        x86_64-linux = "sha256-AlimxfT2aMPXJQKU7NxSmhqhQApIWp1K5qd3wFRvo/w=";
-        aarch64-linux = "sha256-W+Avv/yKefGk64Wvz3rF7ehYkD73EbsMXqeQi/tXjtw=";
-        aarch64-darwin = "sha256-+NFFtfX4CxlzjBA8iAgexGIOx+5thEJ4iZR9ngkTsjI=";
+        x86_64-linux = "sha256-sYfAxxBHDV+D+9EcbHP24/n1Ua97e3eScqz/+DMuceg=";
+        aarch64-linux = "sha256-EGPJPQ+CUVni2wXtLJUkmNthOQnC+rQW5A4LyNPgmqY=";
+        aarch64-darwin = "sha256-LIEgs56Qszl9lZc4GJe8EOy9+eF2nOp1oGN/1D8o5b0=";
       };
     };
 
@@ -146,7 +146,7 @@ stdenv.mkDerivation (finalAttrs: {
     description = "Modern and easy to use SQL client for MySQL, Postgres, SQLite, SQL Server, and more";
     homepage = "https://www.beekeeperstudio.io";
     changelog = "https://github.com/beekeeper-studio/beekeeper-studio/releases/tag/v${finalAttrs.version}";
-    license = lib.licenses.gpl3Only;
+    license = lib.licenses.gpl3Plus;
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     mainProgram = "beekeeper-studio";
     maintainers = with lib.maintainers; [

pkgs/by-name/bi/bicep/0001-Pin-Grpc.Tools-To-2.68.1.patch

@@ -1,13 +0,0 @@
-diff --git a/src/Directory.Packages.props b/src/Directory.Packages.props
-index 97dddded5..4c9e3e35c 100644
---- a/src/Directory.Packages.props
-+++ b/src/Directory.Packages.props
-@@ -34,7 +34,7 @@
-     <PackageVersion Include="Grpc.AspNetCore.Server.Reflection" Version="2.71.0" />
-     <PackageVersion Include="Grpc.Core.Testing" Version="2.46.6" />
-     <PackageVersion Include="Grpc.Net.Client" Version="2.71.0" />
--    <PackageVersion Include="Grpc.Tools" Version="2.72.0" />
-+    <PackageVersion Include="Grpc.Tools" Version="2.68.1" />
-     <PackageVersion Include="JetBrains.Annotations" Version="2025.2.2" />
-     <PackageVersion Include="JsonDiffPatch.Net" Version="2.3.0" />
-     <PackageVersion Include="JsonPatch.Net" Version="3.3.0" />

pkgs/by-name/bi/bicep/package.nix

@@ -3,29 +3,21 @@
   buildDotnetModule,
   fetchFromGitHub,
   dotnetCorePackages,
-  jq,
 }:
 
 buildDotnetModule rec {
   pname = "bicep";
-  version = "0.39.26";
+  version = "0.47.16";
 
   src = fetchFromGitHub {
     owner = "Azure";
     repo = "bicep";
     rev = "v${version}";
-    hash = "sha256-CfoC9/Qe2OdPNnAa7e0BFgbPEbVrDfl9u3hM6y8msGQ=";
+    hash = "sha256-V8YpTc7GqP42a+Z/cKW/R4WrwbCyPY0+kYuotA4ec4E=";
   };
 
-  patches = [
-    ./0001-Pin-Grpc.Tools-To-2.68.1.patch
-  ];
-
   postPatch = ''
     substituteInPlace src/Directory.Build.props --replace-fail "<TreatWarningsAsErrors>true</TreatWarningsAsErrors>" ""
-    # Upstream uses rollForward = disable, which pins to an *exact* .NET SDK version.
-    jq '.sdk.rollForward = "latestMinor"' < global.json > global.json.tmp
-    mv global.json.tmp global.json
   '';
 
   projectFile = [
@@ -35,11 +27,12 @@ buildDotnetModule rec {
 
   nugetDeps = ./deps.json;
 
-  dotnet-sdk = dotnetCorePackages.sdk_8_0_4xx-bin;
+  dotnet-sdk = dotnetCorePackages.sdk_10_0_4xx-bin;
 
-  dotnet-runtime = dotnetCorePackages.runtime_8_0;
+  dotnet-runtime = dotnetCorePackages.runtime_10_0;
 
-  nativeBuildInputs = [ jq ];
+  # Compression in single-file bundles requires self-contained builds.
+  dotnetInstallFlags = [ "-p:EnableCompressionInSingleFile=false" ];
 
   doCheck = true;
 

pkgs/by-name/bi/bicep/updater.sh

@@ -1,11 +1,12 @@
 #!/usr/bin/env nix-shell
 #!nix-shell -I nixpkgs=./. -i bash -p curl jq common-updater-scripts
+# shellcheck shell=bash
 
 set -eo pipefail
 cd "$(dirname "${BASH_SOURCE[0]}")"
 
 deps_file="$(realpath "./deps.json")"
-new_version="$(curl -s "https://api.github.com/repos/azure/bicep/releases?per_page=1" | jq -r '.[0].name')"
+new_version="$(curl -s "https://api.github.com/repos/azure/bicep/releases?per_page=1" | jq -r '.[0].tag_name | ltrimstr("v")')"
 old_version="$(sed -nE 's/\s*version = "(.*)".*/\1/p' ./package.nix)"
 
 if [[ "$new_version" == "$old_version" ]]; then
@@ -14,5 +15,5 @@ if [[ "$new_version" == "$old_version" ]]; then
 fi
 
 cd ../../../..
-update-source-version bicep "${new_version//v/}"
+update-source-version bicep "$new_version"
 "$(nix-build . -A bicep.fetch-deps --no-out-link)" "$deps_file"

pkgs/by-name/bi/bitsnpicas/package.nix

@@ -13,13 +13,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "bitsnpicas";
-  version = "2.2";
+  version = "2.2.2";
 
   src = fetchFromGitHub {
     owner = "kreativekorp";
     repo = "bitsnpicas";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-TIpnefPLHgKXJfBhrYbYG+/kpHjWpk/VrJvu1LKHf4o=";
+    hash = "sha256-+LmAav7E5boKNVby4YusSqNGt4PSSnefxsF10O8/deo=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/bo/bookstack/package.nix

@@ -8,16 +8,16 @@
 
 php83.buildComposerProject2 (finalAttrs: {
   pname = "bookstack";
-  version = "26.05.4";
+  version = "26.05.5";
 
   src = fetchFromGitHub {
     owner = "bookstackapp";
     repo = "bookstack";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-DDjJZehRUf1GP19S+RqhqZSSGOMF/SzItt2GFXi4+1U=";
+    hash = "sha256-9E0hewzzN4prXUOrokIY6vDZUttv1HpPEd2/sLc0mhM=";
   };
 
-  vendorHash = "sha256-Ioth8Kp5fx4iwfy0p7N8xE0L41oWcp+ATfhmq3PUYyY=";
+  vendorHash = "sha256-usRZ70uiD54jlXkKcikvkNmFQbw7/r9F9Dg3QN/gdts=";
 
   passthru = {
     phpPackage = php83;

pkgs/by-name/bo/bootil/package.nix

@@ -47,7 +47,6 @@ stdenv.mkDerivation {
     license = lib.licenses.free;
     maintainers = with lib.maintainers; [ abigailbuccaneer ];
     # Build uses `-msse` and `-mfpmath=sse`
-    platforms = lib.platforms.all;
-    badPlatforms = [ "aarch64-linux" ];
+    platforms = lib.platforms.x86;
   };
 }

pkgs/by-name/bo/boxes/package.nix

@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "boxes";
-  version = "2.3.1";
+  version = "2.3.2";
 
   src = fetchFromGitHub {
     owner = "ascii-boxes";
     repo = "boxes";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-dvhb5KWBQt7g4n0ZTQMcJQljIfavV3g8i+P3PWB6Gwk=";
+    hash = "sha256-dkL5VYs6j9LzvhCLU4BEbiTDWJpW1vQrmLWQ40P3Yzo=";
   };
 
   # Building instructions:

pkgs/by-name/bu/butterfly/git-hashes.json

@@ -1,14 +1,15 @@
 {
   "dart_leap": "sha256-oO5851cIdrW/asgOePxvwUgjn1XchkH9CKJUruvlLYI=",
   "irondash_engine_context": "sha256-SaF2vZUEbamhLotu3XQhCGrDZDk9S/vQ8TGPkvJXVkw=",
-  "keybinder": "sha256-gJL+Om5lKg4jnUK26g1S6bOdL5DQrpUyVkTGdQUVn0I=",
-  "lw_file_system": "sha256-tg0j8YImwE4sBsG9sKgqgy3Qups/4PG90S0MKmYVc0A=",
-  "lw_file_system_api": "sha256-OeMNGl7IOqehoVl7Hl7D7pKayrt8dpEr/w/iqHLFHMI=",
-  "lw_sysapi": "sha256-jlAVgZ7OokfoxGqXNPSbVww7GsRsayzc7eYm7aIYrKE=",
-  "material_leap": "sha256-e9b5F1i7tiyKtE+2AgWG6eSA/OCc6HAHtC5CdxlRuIc=",
+  "keybinder": "sha256-fEKJ9tK8peI07ecxz1NWBjg7li8Db46LzL8wEHKL0a0=",
+  "lw_file_system": "sha256-sSoVMgOIWIS37r2gAX2g8PNkft84aoOmHeRWVN5lz2k=",
+  "lw_file_system_api": "sha256-AMnuK6jA40lmYpYy7XASyNsGfgAqfJsEZzDbQPNo6zk=",
+  "lw_sysapi": "sha256-CQglT1gUn8sA2Agrb0KdsqSJx492tV7sRjltmwtF/bs=",
+  "material_leap": "sha256-EuuueH4gyWX9L0jzExY7/ugaxmkJkWb0pO+9QMpu8T0=",
   "networker": "sha256-+mZjq6rdmc9e1TXY5N4g29bBLC2NFhB0NlRTBMcyBWU=",
   "networker_crypto": "sha256-GEQUfVl0ivG5jtIj/2i/+6VLEudpcOOR7iHfNPkrJx8=",
   "networker_socket": "sha256-GEQUfVl0ivG5jtIj/2i/+6VLEudpcOOR7iHfNPkrJx8=",
-  "super_native_extensions": "sha256-Bs83FAguu1qDnbSxXc5W2IMyAZ8pNUAh5wuu6amLKQ4=",
+  "phosphor_flutter": "sha256-Z5iikuoGDjRGE73Iig8WGORtedQf1EpVoxeD+B7S57c=",
+  "super_native_extensions": "sha256-HVT1s2TM9vmvuT9TxkJ24TGsUeNWnafBTD7EWJHEmos=",
   "swamp_api": "sha256-YZhRSevfGpyV7F2dL34waca7OyzG4a7BcQekz3uJa2Q="
 }

pkgs/by-name/bu/butterfly/package.nix

@@ -1,6 +1,6 @@
 {
   lib,
-  flutter341,
+  flutter344,
   fetchFromGitHub,
   runCommand,
   yq-go,
@@ -10,16 +10,16 @@
 }:
 
 let
-  version = "2.5.2";
+  version = "2.5.5";
 
   src = fetchFromGitHub {
     owner = "LinwoodDev";
     repo = "Butterfly";
     tag = "v${version}";
-    hash = "sha256-BJOLUFxXAbby5x7LllTSgHH5RGFc6bDtwaf13TcLXfs=";
+    hash = "sha256-TRIchx3BK+ImF+oORU922BeOnUKG8nvyOh8luLTpi5E=";
   };
 in
-flutter341.buildFlutterApplication {
+flutter344.buildFlutterApplication {
   pname = "butterfly";
   inherit version src;
 

pkgs/by-name/ca/caelestia-shell/package.nix

@@ -33,8 +33,8 @@
   withCli ? true,
 }:
 let
-  version = "2.4.0";
-  rev = "24aa15eefdb146350d2548c0a015b04eddbd1008";
+  version = "2.5.0";
+  rev = "d999d4878ee4cec134168e60d913714566a8cfa6";
 
   m3shapes_src = fetchFromGitHub {
     owner = "soramanew";
@@ -75,7 +75,7 @@ let
 
   shellSrc = fetchurl {
     url = "https://github.com/caelestia-dots/shell/releases/download/v${version}/caelestia-shell-v${version}.tar.gz";
-    hash = "sha256-r3SRcn/zBplpgVD598GGCJzNFxpQne8zK8uh3hyzF3E=";
+    hash = "sha256-a++f7/n5xq/rb98Lm7HPw8/X3/TCoCDoB51nIJdfO2o=";
   };
 
   extras = stdenv.mkDerivation {

pkgs/by-name/ca/candle/package.nix

@@ -37,11 +37,20 @@ stdenv.mkDerivation (finalAttrs: {
     qt5.qtserialport
   ];
 
-  installPhase = ''
-    runHook preInstall
-    install -Dm755 Candle $out/bin/candle
-    runHook postInstall
-  '';
+  installPhase =
+    if stdenv.hostPlatform.isDarwin then
+      ''
+        runHook preInstall
+        mkdir -p $out/Applications
+        cp -r Candle.app $out/Applications/
+        runHook postInstall
+      ''
+    else
+      ''
+        runHook preInstall
+        install -Dm755 Candle $out/bin/candle
+        runHook postInstall
+      '';
 
   doInstallCheck = true;
 

pkgs/by-name/ca/cargo-hakari/package.nix

@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-hakari";
-  version = "0.9.38";
+  version = "0.9.39";
 
   src = fetchFromGitHub {
     owner = "guppy-rs";
     repo = "guppy";
     tag = "cargo-hakari-${finalAttrs.version}";
-    hash = "sha256-joTDNEIlNDtRBFV6QL2yqM3VWbZ05nF235U3F8lekeE=";
+    hash = "sha256-ZOUmwfmgMxhzjY6IdCAs1DVOIvIvMPI5OFJ6rEmWbV4=";
   };
 
-  cargoHash = "sha256-JmRq6Hoss99tOymMQvrBZevrf56+nSS70AZb2XeqZSc=";
+  cargoHash = "sha256-0O6e+3ziHh0FUOFAghkz1T6caOAZp6kZoG6AIIuJq2c=";
 
   cargoBuildFlags = [
     "-p"

pkgs/by-name/ca/casadi/package.nix

@@ -10,6 +10,7 @@
   cplex,
   fatrop,
   fetchFromGitHub,
+  fetchpatch2,
   gurobi,
   highs,
   hpipm,
@@ -46,6 +47,16 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-GY7Dyt53QE3+/aPB5oDRfZzpRLqKTGrxrmvihq4YJ2o=";
   };
 
+  # fix python build
+  # ref. https://github.com/casadi/casadi/pull/4418 merged upstream
+  patches = lib.optionals pythonSupport [
+    (fetchpatch2 {
+      name = "add-missing-stub-guards.patch";
+      url = "https://github.com/casadi/casadi/commit/fc4b71177089c2fabbfc3a41dca8a6e40a0a81f4.patch?full_index=1";
+      hash = "sha256-/T9Fof36l/wEeKusI1teCcrax3Zg+fhpteBwnVjWr0o=";
+    })
+  ];
+
   postPatch = ''
     # fix case of hpipmConfig.cmake
     substituteInPlace CMakeLists.txt --replace-fail \

pkgs/by-name/cc/cc-switch-cli/package.nix

@@ -2,25 +2,39 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
+  fetchpatch2,
   versionCheckHook,
   stdenv,
   installShellFiles,
+  writableTmpDirAsHomeHook,
+  lsof,
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cc-switch-cli";
-  version = "5.0.1";
+  version = "5.10.5";
 
   src = fetchFromGitHub {
     owner = "SaladDay";
     repo = "cc-switch-cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-JwtgT8cP+i7hsaB13o0PTDZJWvC3os1zWagMqmbffXk=";
+    hash = "sha256-RreuW2hlJFH2ETQPwUOB/DE3CtyK8+sEqjbb5cWbR0g=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/src-tauri";
 
-  cargoHash = "sha256-m70IR0IFUj8C48WcHgdCCtPwW/8KOxeDIqgG1bIcOpo=";
+  cargoHash = "sha256-OiK0PN1ILtMzl9+QndPnYa1PdFM2Y3BmE7MYJjAWnDc=";
+
+  patches = [
+    (fetchpatch2 {
+      # already merged but not yet released
+      # https://github.com/SaladDay/cc-switch-cli/pull/463
+      name = "cc-switch-cli-skip-non-utf8-filename-test-on-macos";
+      url = "https://github.com/SaladDay/cc-switch-cli/commit/1ae36f7ac66e3a837c064c8c3fb1c56449f3f7c1.patch?full_index=1";
+      relative = "src-tauri";
+      hash = "sha256-qMwAnjBsZZk8xwdlrVx/GpRW7DT+JNbONKxdK583xU4=";
+    })
+  ];
 
   nativeBuildInputs = [ installShellFiles ];
   postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
@@ -36,13 +50,43 @@ rustPlatform.buildRustPackage (finalAttrs: {
   # rusqlite uses the "bundled" feature which compiles SQLite from source,
   # so no system sqlite dependency is needed.
 
+  nativeCheckInputs = [
+    writableTmpDirAsHomeHook # needs $HOME for many tests
+    lsof # used in some tests
+  ];
+
+  # upstream defines a highly optimized release profile.
+  # tests do not need the slow release build.
+  checkType = "debug";
+
+  # upstream runs tests single-threaded to prevent io race.
+  dontUseCargoParallelTests = true;
+
+  # needed for many tests in darwin's sandbox
+  __darwinAllowLocalNetworking = true;
+
+  cargoTestFlags = [
+    # easier to diagnose test failures:
+    "--no-fail-fast"
+
+    # match the test targets run by upstream's CI:
+    # https://github.com/SaladDay/cc-switch-cli/blob/main/.github/workflows/rust-ci.yml
+    "--lib"
+    "--bin=cc-switch"
+    "--test=proxy_claude_forwarder_alignment"
+    "--test=proxy_daemon"
+    "--test=proxy_database"
+  ];
+
   checkFlags = [
-    # Requires access to the system hostname, unavailable in the Nix build sandbox.
-    "--skip=detect_system_device_name_returns_some"
-    # Requires binding a network port, unavailable in the Nix build sandbox.
-    "--skip=reloading_app_state_does_not_recover_an_active_takeover_session"
-    # Invokes the install.sh script which downloads binaries from GitHub.
-    "--skip=install_script"
+    # flaky: many database locks during tests make this slow and fail:
+    "--skip=locked_main_database_degrades_within_the_overlay_busy_budget"
+
+    # sandbox: access /bin/cat, not available in the nix sandbox
+    "--skip=clipboard_command_writes_text_to_stdin_and_waits_for_success"
+
+    # flaky: concurrency bug depends on the builder cores
+    "--skip=parser_results_are_delivered_in_completion_order"
   ];
 
   meta = {

pkgs/by-name/ce/cegui/package.nix

@@ -60,6 +60,8 @@ stdenv.mkDerivation {
   };
 
   meta = {
+    # last successful hydra build on darwin was in 2025
+    broken = stdenv.hostPlatform.isDarwin;
     homepage = "http://cegui.org.uk/";
     description = "C++ Library for creating GUIs";
     mainProgram = "CEGUISampleFramework-0.9999";

pkgs/by-name/cf/cfv/case-insensitive-filesystem.patch

@@ -0,0 +1,28 @@
+diff --git a/test/test_caching.py b/test/test_caching.py
+index 7db575d4386d..92002e392a13 100644
+--- a/test/test_caching.py
++++ b/test/test_caching.py
+@@ -24,6 +24,7 @@ import tempfile
+ 
+ from cfv.caching import FileInfoCache
+ from cfvtest import TestCase
++from unittest import skip
+ 
+ 
+ class AbsTestCase(TestCase):
+@@ -130,6 +131,7 @@ class AbsPathKeyTest(AbsTestCase):
+ 
+ 
+ class RelPathKeyTest(RelTestCase):
++    @skip("case-insensitive filesystem behavior differs on Darwin")
+     def test_nocase_findfile(self):
+         cache = FileInfoCache()
+         a1 = self.mkfile('aAaA/AaA1', '1')
+@@ -149,6 +151,7 @@ class RelPathKeyTest(RelTestCase):
+             cache.nocase_findfile(self.mkpath('aaAA/aaa2'))
+         self.assertEqual(errno.EEXIST, cm.exception.errno)
+ 
++    @skip("case-insensitive filesystem behavior differs on Darwin")
+     def test_nocase_findfile_parent(self):
+         cache = FileInfoCache()
+         self.mkfile('aaaA/aaA1', '1')

pkgs/by-name/cf/cfv/package.nix

@@ -17,6 +17,13 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
     sha256 = "sha256-vKlnW6Z0Rg2bptU5fxIKDaOY2b+WY/fgaYZQu5tBU44=";
   };
 
+  # The upstream test suite assumes a case-sensitive filesystem and
+  # undecodable filenames on disk, which do not behave the same way on Darwin.
+  patches = lib.optionals pkgs.stdenv.hostPlatform.isDarwin [
+    ./undecodable-filenames.patch
+    ./case-insensitive-filesystem.patch
+  ];
+
   build-system = with python3.pkgs; [
     setuptools
   ];

pkgs/by-name/cf/cfv/undecodable-filenames.patch

@@ -0,0 +1,20 @@
+diff --git a/test/test.py b/test/test.py
+index 0acb642bdf1e..2b43e4d5dc28 100755
+--- a/test/test.py
++++ b/test/test.py
+@@ -795,10 +795,11 @@ def C_funkynames_test(t):
+             test_generic(cfvcmd + ' --encoding=raw -v -T -p %s -f %s' % (d3, dcfn), rcurry(cfv_all_test, files=cnum, ok=cnum))
+             test_generic(cfvcmd + ' --encoding=raw -v -u -T -p %s -f %s' % (d3, dcfn), rcurry(cfv_all_test, files=cnum, ok=cnum, unv=0))
+             # cfv -T, undecodable filenames on disk and in CF (same names), without raw, cferrors
+-            test_generic(cfvcmd + ' -v -T -p %s -f %s' % (d3, dcfn), rcurry(cfv_substatus_test, cferror=1))  # rcurry(cfv_all_test,ok=okcnum,cferror=numundecodable))
+-            test_generic(cfvcmd + ' -v -u -T -p %s -f %s' % (d3, dcfn), rcurry(cfv_substatus_test, cferror=1, unv=1))  # rcurry(cfv_all_test,ok=okcnum,cferror=numundecodable,unv=numundecodable))
+-            test_generic(cfvcmd + ' -v -m -T -p %s -f %s' % (d3, dcfn), rcurry(cfv_substatus_test, cferror=1))  # rcurry(cfv_all_test,ok=okcnum,cferror=numundecodable))
+-            test_generic(cfvcmd + ' -v -m -u -T -p %s -f %s' % (d3, dcfn), rcurry(cfv_substatus_test, cferror=1, unv=1))  # rcurry(cfv_all_test,ok=okcnum,cferror=numundecodable,unv=numundecodable))
++            if sys.platform != 'darwin':
++                test_generic(cfvcmd + ' -v -T -p %s -f %s' % (d3, dcfn), rcurry(cfv_substatus_test, cferror=1))  # rcurry(cfv_all_test,ok=okcnum,cferror=numundecodable))
++                test_generic(cfvcmd + ' -v -u -T -p %s -f %s' % (d3, dcfn), rcurry(cfv_substatus_test, cferror=1, unv=1))  # rcurry(cfv_all_test,ok=okcnum,cferror=numundecodable,unv=numundecodable))
++                test_generic(cfvcmd + ' -v -m -T -p %s -f %s' % (d3, dcfn), rcurry(cfv_substatus_test, cferror=1))  # rcurry(cfv_all_test,ok=okcnum,cferror=numundecodable))
++                test_generic(cfvcmd + ' -v -m -u -T -p %s -f %s' % (d3, dcfn), rcurry(cfv_substatus_test, cferror=1, unv=1))  # rcurry(cfv_all_test,ok=okcnum,cferror=numundecodable,unv=numundecodable))
+ 
+             # TODO: needs "deep" -s
+             if not deep:

pkgs/by-name/ci/cinny-desktop/package.nix

@@ -20,18 +20,18 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cinny-desktop";
-  version = "4.12.6";
+  version = "4.12.7";
 
   src = fetchFromGitHub {
     owner = "cinnyapp";
     repo = "cinny-desktop";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-XNbdTRm+oJjnuWEk1AT63HRmOV4OjSK7aj874z+15pE=";
+    hash = "sha256-mGlenx9Dl4YZyg+noNVC+5PYe87Dfi0MGYBpdPjLFH0=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/src-tauri";
 
-  cargoHash = "sha256-2jzsXj6iLf4TRUIgWe+VTEjBtYgnHJPBnZmlfvTlrXs=";
+  cargoHash = "sha256-14PevMGb0nI89uma0dK7JScn8xkefv2VDb/Sh1rt/qI=";
 
   postPatch =
     let

pkgs/by-name/ci/cinny-unwrapped/package.nix

@@ -7,17 +7,17 @@
 buildNpmPackage (finalAttrs: {
   pname = "cinny-unwrapped";
   # Remember to update cinny-desktop when bumping this version.
-  version = "4.12.6";
+  version = "4.12.7";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "cinnyapp";
     repo = "cinny";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-rxW26obe+9FJmWFAZijfEqVQxH8DYSaq5/faoypmV3I=";
+    hash = "sha256-H4a7HgadpuINie5NGQcHtLHW/MHc9Cc01GO4VPPMDr4=";
   };
 
-  npmDepsHash = "sha256-zzyc04GrmEtqzVo2LPMw6l9Hb24XZF3XVBReWY79Pxc=";
+  npmDepsHash = "sha256-L4QlQE6lzNSbRWgYyVV4Xy85KfSv6jDSnkiTQrxzIaQ=";
 
   # Skip rebuilding native modules since they're not needed for the web app
   npmRebuildFlags = [

pkgs/by-name/cl/claude-code/manifest.zst.json

@@ -1,63 +1,61 @@
 {
-  "version": "2.1.276",
+  "version": "2.1.278",
   "manifestSignatureEnforcement": "flag",
-  "commit": "bc0a4292e0472d227ceecb07d892ab1a777a4926",
-  "modsCommit": "68ac8bbf0245b615b41517bf8f2b2f35af1ae31d",
-  "buildDate": "2026-09-18T00:50:49Z",
+  "commit": "809c980662e3525645594dc8b74f78c38a348db1",
+  "modsCommit": "31a3b00bef145a0393d9dbf840a98674fec07712",
+  "buildDate": "2026-09-19T01:23:12Z",
   "platforms": {
     "darwin-arm64": {
       "binary": "claude.zst",
-      "checksum": "c152f199101ffb6a197fa79f3c1617f2e4ad72d9dd4ccef36559696bc6fbbf60",
-      "size": 71019331,
+      "checksum": "dba9162d25e74c59ad72c9df72f80cbc42ecc984137effc095d3efc6cdba5688",
+      "size": 71680385,
       "bundle": {
-        "checksum": "38d7c719597489b2b79069161d3b9e93b907f5e44b97cd44e479f0742a9eaa1e",
-        "size": 71024230
+        "checksum": "1d99d25dd40f9e4fa26d51f243d5537fe72ee105506bf7ab2473da247e81c383",
+        "size": 71682327
       }
     },
     "darwin-x64": {
       "binary": "claude.zst",
-      "checksum": "a7c803a21afc1f0e14aac3819de14a031cc259212de04ac14831c2ecac019f5b",
-      "size": 75199422,
+      "checksum": "b4b9893caa7e2a03603f957fcfeb796e44adfdb205e65e58600c096aedb92bc9",
+      "size": 75875517,
       "bundle": {
-        "checksum": "49e425e56529477345458b2ed194eeddb24f9af457ae48e0a5895669343a3b62",
-        "size": 75199821
+        "checksum": "35afa32d1b9bac1ff525a97666955450381cd0221d536d16cffcc9dd353f5012",
+        "size": 75883179
       }
     },
     "linux-arm64": {
       "binary": "claude.zst",
-      "checksum": "2e0040597f5723fdc0608d11f84674e734a3bae0a3b23b7a0712c99e0d5fb5d8",
-      "size": 80195460
+      "checksum": "4b758a132d4e52d5580ff13d127f3b21aac02c780cbf8803485ab2b5a14dff1b",
+      "size": 80854910
     },
     "linux-x64": {
       "binary": "claude.zst",
-      "checksum": "0b2e7bfc53a34b64d03af28509f7803623efb02a7be598509981f937fe2849a8",
-      "size": 80820724
+      "checksum": "5f5db204251b8457ac68b2004ed140a50c8feea62e5246cc28cde8d04ad760cb",
+      "size": 81468815
     },
     "linux-arm64-musl": {
       "binary": "claude.zst",
-      "checksum": "660a62b76eac08fcc1c86ac0450f9a3689c80af4d4da3ed762efde999db7b9c6",
-      "size": 78648975
+      "checksum": "d23b5988351582876f3b560b75db3f838af4361358e1268ea254b43eebd745af",
+      "size": 79306049
     },
     "linux-x64-musl": {
       "binary": "claude.zst",
-      "checksum": "48e9423690734c4f5718eba6fea0c516bceee0c53b7522ec374aed65556aa082",
-      "size": 79312653
+      "checksum": "c02648026dd185b43a34baa0c4668fdd1d8e4a8a7ebfcc1132ffce836b95e0b0",
+      "size": 79966866
     },
     "win32-x64": {
       "binary": "claude.exe.zst",
-      "checksum": "497143079a9c781ec15adf8ac682ac8cc4d8db80844ce7051c102c765308526c",
-      "size": 83217487
+      "checksum": "29d81b3f574221ca5e354186e31297923b412b06c6d93ff96b75dbd5fb3809e4",
+      "size": 83867525
     },
     "win32-arm64": {
       "binary": "claude.exe.zst",
-      "checksum": "d805fed8cbe7f1919b8f2b4bcb3718c426dda4ac1b5695555a69d0cc9a6a053a",
-      "size": 79954588
+      "checksum": "35b0714245e6a9f659af91725ea9e65fa215f87822ee7ec3520aabc6a0a28e45",
+      "size": 80611186
     }
   },
   "sdkCompat": {
     "testedWrapperVersions": [
-      "0.3.237",
-      "0.3.238",
       "0.3.239",
       "0.3.240",
       "0.3.241",
@@ -85,7 +83,9 @@
       "0.3.272",
       "0.3.273",
       "0.3.274",
-      "0.3.275"
+      "0.3.275",
+      "0.3.276",
+      "0.3.277"
     ],
     "harnessSchema": 1
   }

pkgs/by-name/cl/clickhouse/package.nix

@@ -1,6 +1,6 @@
 import ./generic.nix {
-  version = "26.8.2.7-lts";
-  rev = "c2930599c56702022276de06657ed51d83f31a05";
-  hash = "sha256-AKEzqbWWfi04Llhw7R4MCEuWPrcyym1z59LR14OluRI=";
+  version = "26.8.7.19-lts";
+  rev = "f29d27def7ee0adb10e7e2fff080ba204054dd4b";
+  hash = "sha256-IsMRloPsdFoDMmOh6lxFdvxEbuXV5XSU48kWFG5Sp/o=";
   lts = false;
 }

pkgs/by-name/co/codebase-memory-mcp/package.nix

@@ -10,13 +10,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "codebase-memory-mcp";
-  version = "0.10.8";
+  version = "0.11.0";
 
   src = fetchFromGitHub {
     owner = "DeusData";
     repo = "codebase-memory-mcp";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-lPuayLN6W31zQ45UTQehP+tmoo/UrQJuRsJzi1wZ9Tg=";
+    hash = "sha256-6CrxqkyxfsSENQBAuS7hwZFgQX+4Ocxx0CH6eIeqw3E=";
   };
 
   patches = [
@@ -33,7 +33,7 @@ stdenv.mkDerivation (finalAttrs: {
   npmDeps = fetchNpmDeps {
     inherit (finalAttrs) src;
     sourceRoot = "${finalAttrs.src.name}/${finalAttrs.npmRoot}";
-    hash = "sha256-cDwGJi8M/t7eTHVKu6TzW7L9OUAQgB+0c+fiTgPn7cE=";
+    hash = "sha256-W3cajM1XXy19EgGSJyXsd00KncAm7v4afnnnHXIqlhc=";
   };
 
   npmRoot = "graph-ui";

pkgs/by-name/co/codebase-memory-mcp/remove-install-update.diff

@@ -1,18 +1,20 @@
 diff --git a/src/main.c b/src/main.c
 --- a/src/main.c
 +++ b/src/main.c
-@@ -894,10 +894,6 @@ static void print_help(void) {
-     printf("  codebase-memory-mcp              Run MCP server on stdio\n");
-     printf("  codebase-memory-mcp cli [--progress] [--json] <tool> [args]\n");
+@@ -1077,12 +1077,6 @@ static void print_help(void) {
+     printf("  codebase-memory-mcp cli [--quiet] [--progress] [--verbose] [--json] <tool> "
+            "[args]\n");
      printf("                                      Run one tool locally, then exit\n");
 -    printf("  codebase-memory-mcp install [-y|-n] [--force] [--dry-run] "
 -           "[--dir=<path>] [--skip-config]\n");
+-    printf("                                      [--clients=<tokens>]  Run "
+-           "'install --clients' to list tokens\n");
 -    printf("  codebase-memory-mcp uninstall [-y|-n] [--dry-run]\n");
 -    printf("  codebase-memory-mcp update [-y|-n]\n");
      printf("  codebase-memory-mcp config <list|get|set|reset>\n");
      printf("  codebase-memory-mcp --version    Print version\n");
      printf("  codebase-memory-mcp --help       Print this help\n");
-@@ -1063,15 +1059,6 @@ static int handle_subcommand(int argc, char **argv, cbm_project_lock_manager_t
+@@ -1254,15 +1248,6 @@ static int handle_subcommand(int argc, char **argv, cbm_project_lock_manager_t *
              cbm_mem_init(cbm_mem_ram_fraction_for_total(cbm_system_info().total_ram));
              return cbm_cmd_hook_augment(argc - i - SKIP_ONE, argv + i + SKIP_ONE);
          }

pkgs/by-name/co/codespelunker/package.nix

@@ -6,13 +6,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "codespelunker";
-  version = "3.1.0";
+  version = "3.2.0";
 
   src = fetchFromGitHub {
     owner = "boyter";
     repo = "cs";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-cPaAuZJ/Flea4BZ2LTprE5BFtHqgVCuF+2VLShgkCrQ=";
+    hash = "sha256-yjzqy0YgpKUR1ZlRXpBW9GBoLmXZ1AjTfPfkxD9Ht/s=";
   };
 
   vendorHash = null;

pkgs/by-name/co/conda/package.nix

@@ -49,7 +49,7 @@
 # $ conda-shell
 # $ conda install spyder
 let
-  version = "26.1.1-1";
+  version = "26.7.1-1";
 
   src =
     let
@@ -63,10 +63,10 @@ let
       };
     in
     fetchurl {
-      url = "https://repo.anaconda.com/miniconda/Miniconda3-py313_${version}-Linux-${arch}.sh";
+      url = "https://repo.anaconda.com/miniconda/Miniconda3-py314_${version}-Linux-${arch}.sh";
       hash = selectSystem {
-        x86_64-linux = "sha256-9t+1tZYU/XspVrJAsldanVggPsf3qZ+FEoFYoP3Fwdc=";
-        aarch64-linux = "sha256-B8grWuwE1fDz5LJGg1tryF4QSCHLywoFnH6oDwKFA/Q=";
+        x86_64-linux = "sha256-6LJbkrJiSZFBxb1XqY08AIAkGF+pUUlLnNm22U5yM4s=";
+        aarch64-linux = "sha256-4xVFr9dGLTycM7FUx6EBxay14BtpOAtplGUa6taUKJM=";
       };
     };
 

pkgs/by-name/co/cook-cli/package.nix

@@ -11,16 +11,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cook-cli";
-  version = "0.35.0";
+  version = "0.36.0";
 
   src = fetchFromGitHub {
     owner = "cooklang";
     repo = "cookcli";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-d2sO25QtElhAATgUeyDQaYMN2ZC7r6Nj8IH9xe+pabs=";
+    hash = "sha256-ihsVvlyp//A4pNlt1+DlYWyz52enHVeU6uST7bxcwqw=";
   };
 
-  cargoHash = "sha256-i8vE4iMe8JfghR2k9pNP3CkZlXP+87eF3MZfCBLxhiM=";
+  cargoHash = "sha256-e47x9XzABpXO+qvTydrBOPU9KTZTYJkbJvWvpUUh7Bo=";
 
   # Build without the self-updating feature
   buildNoDefaultFeatures = true;
@@ -40,7 +40,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   npmDeps = fetchNpmDeps {
     inherit (finalAttrs) src;
-    hash = "sha256-ZSRd4tcAsR1tKZ8ZBcb95C1FWEaijsA0WQ5EME0cOfo=";
+    hash = "sha256-n/pxjcgDqhlUC09ynWExxClVT9WixahpPYRU3GAvzBc=";
   };
 
   preBuild = ''

pkgs/by-name/co/copilot-language-server/package.nix

@@ -13,14 +13,14 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "copilot-language-server";
-  version = "1.543.0";
+  version = "1.547.0";
 
   strictDeps = true;
   __structuredAttrs = true;
 
   src = fetchzip {
     url = "https://github.com/github/copilot-language-server-release/releases/download/${finalAttrs.version}/copilot-language-server-js-${finalAttrs.version}.zip";
-    hash = "sha256-hhGqlvg7QDmzykdHDtFjF/DAcRtRVS/djjN7zZGE9tg=";
+    hash = "sha256-JFAv+Trz8XUuk9x9ZXWINdfrZ8Mglwjy8ay/EX0gOPo=";
     stripRoot = false;
   };
 

pkgs/by-name/co/coredns/package.nix

@@ -6,7 +6,7 @@
   installShellFiles,
   nixosTests,
   externalPlugins ? [ ],
-  vendorHash ? "sha256-K7cHC6IVawJmlCLR45SKEowXw7SfURIePHzj1LvKS84=",
+  vendorHash ? "sha256-UWj9jDecEBLhuERrfhQHhdYHfKeKdbGSFZqhQn/vm10=",
 }:
 
 let
@@ -14,13 +14,13 @@ let
 in
 buildGoModule (finalAttrs: {
   pname = "coredns";
-  version = "1.14.6";
+  version = "1.14.7";
 
   src = fetchFromGitHub {
     owner = "coredns";
     repo = "coredns";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-3BKXmrsSsDWFl6MT6c5Q8wcQiApO1vG0KeUtJLm89jU=";
+    hash = "sha256-83GPahSGGCckvb9uqz7aWzMDSDNfHfr69Tihvu/OSpY=";
   };
 
   inherit vendorHash;

pkgs/by-name/cp/cp437/package.nix

@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  libiconv,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -11,10 +12,19 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "keaston";
     repo = "cp437";
-    rev = "v${finalAttrs.version}";
-    sha256 = "18f4mnfnyviqclbhmbhix80k823481ypkwbp26qfvhnxdgzbggcc";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-jL23/mvdwu2wEXfxeX1AZAg0AeoRrgoXZThub52txKE=";
   };
 
+  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
+    libiconv
+  ];
+
+  makeFlags = [
+    "CC=${stdenv.cc.targetPrefix}cc"
+    "SYSTEM=${stdenv.hostPlatform.uname.system}"
+  ];
+
   installPhase = ''
     install -Dm755 cp437 -t $out/bin
   '';
@@ -28,5 +38,6 @@ stdenv.mkDerivation (finalAttrs: {
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [ jb55 ];
     mainProgram = "cp437";
+    platforms = lib.platforms.unix;
   };
 })

pkgs/by-name/cp/cpond/package.nix

@@ -22,6 +22,7 @@ stdenv.mkDerivation {
 
   postPatch = ''
     substituteInPlace Makefile \
+      --replace-fail "gcc" "$CC" \
       --replace-fail '$(eflags)$(ncursesw_macros)' '$(eflags) $(ncursesw_macros)'
   ''
   + lib.optionalString stdenv.hostPlatform.isDarwin ''

pkgs/by-name/cr/croc/package.nix

@@ -1,6 +1,6 @@
 {
   lib,
-  buildGoModule,
+  buildGo127Module,
   fetchFromGitHub,
   callPackage,
   installShellFiles,
@@ -9,21 +9,25 @@
   versionCheckHook,
 }:
 
-buildGoModule (finalAttrs: {
+buildGo127Module (finalAttrs: {
   pname = "croc";
-  version = "11.1.0";
+  version = "11.5.2";
 
   src = fetchFromGitHub {
     owner = "schollz";
     repo = "croc";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-mALKcGn5N8O+kDS68KQUp8NOQ6tRfHBg/oRjdViajzc=";
+    hash = "sha256-1qUwvMazz3bvkaIEDuI/SeDazINsh1EQgg+vfj/R5kU=";
   };
 
-  vendorHash = "sha256-WzhdQzptHgnzKoBTS5tF0bAW4QKiJuIgJwBfKlO5rz8=";
+  vendorHash = "sha256-6B7KZd0Y/RvV9q9U8kHFnKqkDX7uA1tCW2vaFnfeQZ0=";
 
   subPackages = [ "." ];
 
+  # The root package's interrupt tests start a local relay, which needs to bind
+  # a port inside the Darwin sandbox.
+  __darwinAllowLocalNetworking = true;
+
   nativeBuildInputs = [
     installShellFiles
   ];

pkgs/by-name/d2/d2/package.nix

@@ -1,64 +1,48 @@
 {
   lib,
-  stdenv,
-  buildGoModule,
+  buildGo127Module,
   fetchFromGitHub,
   installShellFiles,
   git,
   testers,
   d2,
-  libdrm,
-  libgbm,
-  makeWrapper,
-  playwright-driver,
-  withImageSupport ? lib.meta.availableOn stdenv.hostPlatform libdrm,
 }:
 
-assert lib.assertMsg (
-  withImageSupport -> lib.meta.availableOn stdenv.hostPlatform libdrm
-) "d2: withImageSupport is not supported on ${stdenv.hostPlatform.system} (requires libdrm)";
-
-buildGoModule (finalAttrs: {
+buildGo127Module (finalAttrs: {
   pname = "d2";
-  version = "0.8.1";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner = "d2lang";
     repo = "d2";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-4RYKm8wq+KxzLQbd3sIEZLTy7xBtlWhJCHfggvkktXo=";
+    hash = "sha256-HhCktLU43Y/uje038axwO7tNqO353mV/JID223sBtd8=";
   };
 
-  vendorHash = "sha256-4IhAb3UeqSGX9jTdhWonf7lEBhUlUrrVt31NyfSoQF8=";
+  # d2renderers/d2raster's TestRasterPackageHasNoIOCapabilities shells out to
+  # `go list -mod=readonly -deps`, which bypasses the vendor directory and needs
+  # a populated module cache.
+  proxyVendor = true;
+  vendorHash = "sha256-6rrFjboeJ2Qln5TxbsJKmyTclIh1gz1X91g5IFjbMKo=";
 
-  excludedPackages = [ "./e2etests" ];
+  excludedPackages = [
+    "./ci"
+    "./e2etests"
+    "./e2etests-cli"
+  ];
 
   ldflags = [
     "-s"
     "-w"
-    "-X oss.terrastruct.com/d2/lib/version.Version=v${finalAttrs.version}"
+    "-X github.com/d2lang/d2/lib/version.Version=v${finalAttrs.version}"
   ];
 
-  nativeBuildInputs = [
-    installShellFiles
-    makeWrapper
-  ];
-
-  # playwright-drivers.browsers pulls down ~2GB+ for Webkit, Chrome, Firefox etc
-  buildInputs = lib.optionals withImageSupport [
-    libgbm
-    playwright-driver.browsers
-  ];
+  nativeBuildInputs = [ installShellFiles ];
 
   nativeCheckInputs = [ git ];
 
   postInstall = ''
     installManPage ci/release/template/man/d2.1
-  ''
-  # Wrap the d2 executable to set LD_LIBRARY_PATH for Playwright
-  + lib.optionalString withImageSupport ''
-    wrapProgram $out/bin/d2 \
-      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath finalAttrs.buildInputs}
   '';
 
   preCheck = ''

pkgs/by-name/db/db-rest/package.nix

@@ -5,6 +5,7 @@
   nodejs,
   nix-update-script,
   nixosTests,
+  stdenv, # for meta.broken
 }:
 buildNpmPackage rec {
   pname = "db-rest";
@@ -31,6 +32,8 @@ buildNpmPackage rec {
   };
 
   meta = {
+    # last successful hydra build on darwin was in 2025
+    broken = stdenv.hostPlatform.isDarwin;
     description = "Clean REST API wrapping around the Deutsche Bahn API";
     homepage = "https://v6.db.transport.rest/";
     license = lib.licenses.isc;

pkgs/by-name/de/deadpixi-sam-unstable/package.nix

@@ -48,6 +48,8 @@ stdenv.mkDerivation {
   '';
 
   meta = {
+    # last successful hydra build on darwin was in 2023
+    broken = stdenv.hostPlatform.isDarwin;
     homepage = "https://github.com/deadpixi/sam";
     description = "Updated version of the sam text editor";
     license = lib.licenses.lpl-102;

pkgs/by-name/de/deskew/package.nix

@@ -41,6 +41,8 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   meta = {
+    # last successful hydra build on darwin was in 2023
+    broken = stdenv.hostPlatform.isDarwin;
     description = "Command line tool for deskewing scanned text documents";
     homepage = "https://galfar.vevb.net/deskew";
     license = with lib.licenses; [

pkgs/by-name/de/devin-desktop/info.json

@@ -1,14 +1,14 @@
 {
   "aarch64-darwin": {
-    "version": "3.9.19",
+    "version": "3.10.31",
     "vscodeVersion": "1.126.0",
-    "url": "https://windsurf-stable.codeiumdata.com/darwin-arm64/stable/e2b252e21dd5cdfd88fce58f49477260e90294bc/Devin-darwin-arm64-3.9.19.zip",
-    "sha256": "105304e149890f3f7efe407725866362f689dbec2a026f1d58340257d810e119"
+    "url": "https://windsurf-stable.codeiumdata.com/darwin-arm64/stable/b98cc43128712ba73c60cca73876f58a710aaa27/Devin-darwin-arm64-3.10.31.zip",
+    "sha256": "beb08d1269b7b91d8d64a96b5bb270ebbd9f792217fe526934a9392d69fb5bb8"
   },
   "x86_64-linux": {
-    "version": "3.9.19",
+    "version": "3.10.31",
     "vscodeVersion": "1.126.0",
-    "url": "https://windsurf-stable.codeiumdata.com/linux-x64/stable/e2b252e21dd5cdfd88fce58f49477260e90294bc/Devin-linux-x64-3.9.19.tar.gz",
-    "sha256": "1c11c9acdb834936bc4e5ebac88e077dff1c100743fe3cbe47ba74e4da46aa46"
+    "url": "https://windsurf-stable.codeiumdata.com/linux-x64/stable/b98cc43128712ba73c60cca73876f58a710aaa27/Devin-linux-x64-3.10.31.tar.gz",
+    "sha256": "b3ddf1098c11255354d60a0778d7033989eaed85a37bbd55df90167f42eb5346"
   }
 }

pkgs/by-name/di/difftastic/package.nix

@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "difftastic";
-  version = "0.70.0";
+  version = "0.71.0";
 
   src = fetchFromGitHub {
     owner = "wilfred";
     repo = "difftastic";
     tag = finalAttrs.version;
-    hash = "sha256-AqdvPL5VL7H+h1RvGP7613pIHRIK3PEYdtHs1PTiPZw=";
+    hash = "sha256-xJdR/t6O8PavCKBiKnueiLR01g7nWGUHp9bcjOuDDA8=";
   };
 
-  cargoHash = "sha256-sF1/bITwmIE2VT769aUgSgVaB059pGspjnMi4Ksx7dY=";
+  cargoHash = "sha256-HEX8njuArbgMQI8yDr66siRB8t+4P2Q7rxHuCeaD9Uw=";
 
   buildInputs = [ rust-jemalloc-sys ];
 

pkgs/by-name/di/dino/package.nix

@@ -114,6 +114,8 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   meta = {
+    # last successful hydra build on darwin was in 2023
+    broken = stdenv.hostPlatform.isDarwin;
     description = "Modern Jabber/XMPP Client using GTK/Vala";
     mainProgram = "dino";
     homepage = "https://github.com/dino/dino";

pkgs/by-name/dl/dl-librescore/package.nix

@@ -52,6 +52,8 @@ buildNpmPackage (finalAttrs: {
   passthru.updateScript = nix-update-script { };
 
   meta = {
+    # last successful hydra build on darwin was in 2025
+    broken = stdenvNoCC.hostPlatform.isDarwin;
     description = "Download sheet music";
     homepage = "https://github.com/LibreScore/dl-librescore";
     license = lib.licenses.mit;

pkgs/by-name/dn/dnadd/package.nix

@@ -24,5 +24,6 @@ stdenv.mkDerivation (finalAttrs: {
     mainProgram = "dnadd";
     license = lib.licenses.gpl3Plus;
     maintainers = with lib.maintainers; [ joelancaster ];
+    platforms = lib.platforms.linux;
   };
 })

pkgs/by-name/dr/drawio/package.nix

@@ -9,20 +9,20 @@
   makeWrapper,
   darwin,
   nodejs,
-  electron,
+  electron_44,
   nix-update-script,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "drawio";
-  version = "31.3.2";
+  version = "31.4.5";
 
   src = fetchFromGitHub {
     owner = "jgraph";
     repo = "drawio-desktop";
     rev = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-qjc+fAC4+aoqp3mlgocgCY+Af5csy9v1IORM8ux3iPI=";
+    hash = "sha256-+AP9+kZCVIkg7WdokuMKbg8kOm4A4x3wruVi3nOxhh0=";
   };
 
   # `@electron/fuses` tries to run `codesign` and fails. Disable and use autoSignDarwinBinariesHook instead
@@ -33,7 +33,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   offlineCache = fetchNpmDeps {
     src = finalAttrs.src;
-    hash = "sha256-ET1BZBRrVYl7T9BVNxH91WU7J8RHWGw0MahGtRRUGU0=";
+    hash = "sha256-Qgzrh7CAPq5irrVUxAJ9635cajHS8Wr8rzWZGwy4wUw=";
   };
 
   nativeBuildInputs = [
@@ -66,7 +66,7 @@ stdenv.mkDerivation (finalAttrs: {
     runHook preBuild
 
     electron_dist="$(mktemp -d)"
-    cp -r ${electron.dist}/. "$electron_dist"
+    cp -r ${electron_44.dist}/. "$electron_dist"
     chmod -R u+w "$electron_dist"
 
     sed -i "/afterSign/d" electron-builder-linux-mac.json
@@ -75,7 +75,7 @@ stdenv.mkDerivation (finalAttrs: {
       --dir \
       --config electron-builder-linux-mac.json \
       -c.electronDist="$electron_dist" \
-      -c.electronVersion=${electron.version} \
+      -c.electronVersion=${electron_44.version} \
       -c.mac.identity=null
 
     runHook postBuild
@@ -98,7 +98,7 @@ stdenv.mkDerivation (finalAttrs: {
 
     install -Dm644 build/icon.svg "$out/share/icons/hicolor/scalable/apps/drawio.svg"
 
-    makeWrapper '${electron}/bin/electron' "$out/bin/drawio" \
+    makeWrapper '${electron_44}/bin/electron' "$out/bin/drawio" \
       --add-flags "$out/share/lib/drawio/resources/app.asar" \
       --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime=true}}" \
       --inherit-argv0

pkgs/by-name/dr/driftnet/package.nix

@@ -52,6 +52,8 @@ stdenv.mkDerivation (finalAttrs: {
   env.NIX_CFLAGS_COMPILE = "-Wno-error=int-conversion";
 
   meta = {
+    # last successful hydra build on darwin was in 2025
+    broken = stdenv.hostPlatform.isDarwin;
     description = "Watches network traffic, and picks out and displays JPEG and GIF images for display";
     homepage = "https://github.com/deiv/driftnet";
     changelog = "https://github.com/deiv/driftnet/releases/tag/v${finalAttrs.version}";

pkgs/by-name/ec/ec2stepshell/package.nix

@@ -41,7 +41,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
     description = "AWS post-exploitation tool";
     mainProgram = "ec2stepshell";
     homepage = "https://github.com/saw-your-packet/EC2StepShell";
-    changelog = "https://github.com/saw-your-packet/EC2StepShell/blob/${finalAttrs.version}/CHANGELOG.txt";
+    changelog = "https://github.com/saw-your-packet/EC2StepShell/blob/${finalAttrs.src.rev}/CHANGELOG.txt";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
   };

pkgs/by-name/ep/epgstation/package.nix

@@ -8,6 +8,7 @@
   bash,
   nodejs,
   python3,
+  stdenv, # for meta.broken
 }:
 
 buildNpmPackage rec {
@@ -127,6 +128,8 @@ buildNpmPackage rec {
     '';
 
   meta = {
+    # last successful hydra build on darwin was in 2025
+    broken = stdenv.hostPlatform.isDarwin;
     description = "DVR software compatible with Mirakurun";
     homepage = "https://github.com/l3tnun/EPGStation";
     license = lib.licenses.mit;

pkgs/by-name/es/esphome-device-builder/frontend.nix

@@ -14,7 +14,7 @@ let
 in
 buildPythonPackage (finalAttrs: {
   pname = "esphome-device-builder-frontend";
-  version = "0.1.311";
+  version = "0.1.329";
   pyproject = true;
 
   __structuredAttrs = true;
@@ -23,14 +23,14 @@ buildPythonPackage (finalAttrs: {
     owner = "esphome";
     repo = "device-builder-frontend";
     tag = finalAttrs.version;
-    hash = "sha256-mCzWCoxm3yIgBhuEF9N3+5dk5PxKNcPhw0b2zQH9Hc0=";
+    hash = "sha256-Zai2wwrexO9H+LCfEuckfRffuqyKOkG7p/42NeVGcsc=";
   };
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname src;
     inherit pnpm;
     fetcherVersion = 4;
-    hash = "sha256-91LytgWi+vHmsZjorw9QM1mcZAEvAOJXNz2rarAE4Vc=";
+    hash = "sha256-w18G+v511uGXJyhQxnVvBVKfRIfnxJmOP2BCd4mcveo=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/es/esphome-device-builder/package.nix

@@ -4,6 +4,7 @@
   python3Packages,
   fetchFromGitHub,
   gitMinimal,
+  coreutils,
   versionCheckHook,
   esptool,
   esphome,
@@ -32,14 +33,14 @@ let
 in
 pythonPackages.buildPythonApplication (finalAttrs: {
   pname = "esphome-device-builder";
-  version = "1.12.1";
+  version = "1.14.9";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "esphome";
     repo = "device-builder";
     tag = finalAttrs.version;
-    hash = "sha256-vPL2ynVoPIDu66NaWIgmOtOq8NlUl6xeeSezbva7Ztw=";
+    hash = "sha256-G2zY0ilXCAFiSkQvaSN7rdlSBH8WkjKXkkDQqvTfvI0=";
   };
 
   __structuredAttrs = true;
@@ -93,6 +94,9 @@ pythonPackages.buildPythonApplication (finalAttrs: {
       --replace-fail 'shutil.which("git")' '"${lib.getExe gitMinimal}"'
     substituteInPlace tests/test_editor_controller.py \
       --replace-fail 'controller._esphome_cmd = ["esphome"]' 'controller._esphome_cmd = ["${lib.getExe pythonPackages.esphome}"]'
+
+    substituteInPlace tests/helpers/test_orphan_reaper.py \
+      --replace-fail '/bin/sleep' '${lib.getExe' coreutils "sleep"}'
   '';
 
   # Needed for tests

pkgs/by-name/ex/excalidraw_export/package.nix

@@ -5,6 +5,7 @@
   cairo,
   pango,
   pkg-config,
+  stdenv, # for meta.broken
 }:
 
 buildNpmPackage {
@@ -35,6 +36,8 @@ buildNpmPackage {
   nativeBuildInputs = [ pkg-config ];
 
   meta = {
+    # last successful hydra build on darwin was in 2025
+    broken = stdenv.hostPlatform.isDarwin;
     description = "CLI to export Excalidraw drawings to SVG and PDF";
     homepage = "https://github.com/Timmmm/excalidraw_export";
     license = lib.licenses.mit;

pkgs/by-name/ex/exegol/package.nix

@@ -6,7 +6,7 @@
 }:
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "exegol";
-  version = "5.1.11";
+  version = "5.1.13";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -14,7 +14,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     owner = "ThePorgs";
     repo = "Exegol";
     tag = finalAttrs.version;
-    hash = "sha256-FI6lBJkJqmDexfxOWOa4tFe06tOFmUezy7OoDqXQN24=";
+    hash = "sha256-0nBXXWsFwfaVdHvwa+pjl8s/KLi4GPpNuHClTGdFVKY=";
   };
 
   build-system = with python3Packages; [ pdm-backend ];

pkgs/by-name/ex/exegol4/package.nix

@@ -18,6 +18,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
 
   pythonRelaxDeps = [
     "argcomplete"
+    "docker"
     "requests"
     "rich"
   ];

pkgs/by-name/fa/factoriolab/package.nix

@@ -7,6 +7,7 @@
   jq,
   makeWrapper,
   nix-update-script,
+  stdenv, # for meta.broken
 }:
 buildNpmPackage rec {
   pname = "factoriolab";
@@ -48,6 +49,8 @@ buildNpmPackage rec {
   passthru.updateScript = nix-update-script { };
 
   meta = {
+    # last successful hydra build on darwin was in 2025
+    broken = stdenv.hostPlatform.isDarwin;
     homepage = "https://github.com/factoriolab/factoriolab";
     changelog = "https://github.com/factoriolab/factoriolab/releases/tag/v${version}";
     description = "Angular-based calculator for factory games like Factorio and Dyson Sphere Program";

pkgs/by-name/fi/file/package.nix

@@ -4,7 +4,8 @@
   fetchurl,
   buildPackages,
   zlib,
-  libgnurx,
+  windows,
+  libgnurx ? windows.libgnurx,
   updateAutotoolsGnuConfigScriptsHook,
   testers,
 }:

pkgs/by-name/fl/fleng/package.nix

@@ -16,6 +16,8 @@ stdenv.mkDerivation (finalAttrs: {
   doCheck = true;
 
   meta = {
+    # last successful hydra build on darwin was in 2025
+    broken = stdenv.hostPlatform.isDarwin;
     homepage = "http://www.call-with-current-continuation.org/fleng/fleng.html";
     description = "Low level concurrent logic programming language descended from Prolog";
     license = lib.licenses.publicDomain;

pkgs/by-name/fl/flexget/package.nix

@@ -7,14 +7,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "flexget";
-  version = "3.20.11";
+  version = "3.21.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Flexget";
     repo = "Flexget";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-U7GwGbYaSz2X95We0X7RNvVNDlFeGKR099hn5WmgyQs=";
+    hash = "sha256-Xf+nFDC1dNyFXeK8gZYWiE3kZKYNB4lCdBoI24+b/gA=";
   };
 
   pythonRelaxDeps = true;

pkgs/by-name/fl/fluent-bit/package.nix

@@ -85,6 +85,10 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.cmakeBool "FLB_RELEASE" true)
     (lib.cmakeBool "FLB_PREFER_SYSTEM_LIBS" true)
   ]
+  ++ lib.optionals stdenv.hostPlatform.isRiscV64 [
+    # Auto would raise the baseline to rv64gcv_zba
+    (lib.cmakeFeature "FLB_SIMD" "Off")
+  ]
   ++ lib.optionals stdenv.cc.isClang [
     # `FLB_SECURITY` causes bad linker options for Clang to be set.
     (lib.cmakeBool "FLB_SECURITY" false)
@@ -122,6 +126,8 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   meta = {
+    # last successful hydra build on darwin was in 2025
+    broken = stdenv.hostPlatform.isDarwin;
     description = "Fast and lightweight logs and metrics processor for Linux, BSD, OSX and Windows";
     homepage = "https://fluentbit.io";
     license = lib.licenses.asl20;

pkgs/by-name/fy/fypp/package.nix

@@ -22,7 +22,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
     description = "Python powered Fortran preprocessor";
     mainProgram = "fypp";
     homepage = "https://github.com/aradi/fypp";
-    license = lib.licenses.gpl3Only;
+    license = lib.licenses.bsd2;
     maintainers = [ lib.maintainers.sheepforce ];
   };
 })

pkgs/by-name/ga/gam/package.nix

@@ -26,7 +26,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
     with python3.pkgs;
     [
       arrow
-      chardet
+      chardet_5
       cryptography
       filelock
       google-api-python-client

pkgs/by-name/gc/gcp-scanner/package.nix

@@ -49,7 +49,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
   meta = {
     description = "Comprehensive scanner for Google Cloud";
     homepage = "https://github.com/google/gcp_scanner";
-    changelog = "https://github.com/google/gcp_scanner/blob/${finalAttrs.version}/CHANGELOG.md";
+    changelog = "https://github.com/google/gcp_scanner/blob/v${finalAttrs.version}/CHANGELOG.md";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ fab ];
     mainProgram = "gcp-scanner";

pkgs/by-name/ge/gersemi/package.nix

@@ -9,14 +9,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "gersemi";
-  version = "0.28.1";
+  version = "0.29.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "BlankSpruce";
     repo = "gersemi";
     tag = finalAttrs.version;
-    hash = "sha256-eKaloLttIzBsLSNroTQLAN5WKvL5M/u0d6eSlw58oro=";
+    hash = "sha256-SEIg8jIB5mP0qdlOP99pCGD8MYAiUfOi4p5jg2/ZHbk=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {

pkgs/by-name/ge/getxbook/package.nix

@@ -27,6 +27,8 @@ stdenv.mkDerivation (finalAttrs: {
   makeFlags = [ "PREFIX=$(out)" ];
 
   meta = {
+    # last successful hydra build on darwin was in 2023
+    broken = stdenv.hostPlatform.isDarwin;
     description = "Collection of tools to download books from Google Books";
     homepage = "https://njw.me.uk/getxbook/";
     license = lib.licenses.isc;

pkgs/by-name/gi/gitlab-elasticsearch-indexer/package.nix

@@ -5,6 +5,7 @@
   fetchFromGitLab,
   pkg-config,
   icu,
+  stdenv, # for meta.broken
 }:
 let
   codeParserBindings = callPackage ./code-parser.nix { };
@@ -57,6 +58,8 @@ buildGoModule (finalAttrs: {
   };
 
   meta = {
+    # last successful hydra build on darwin was in 2025
+    broken = stdenv.hostPlatform.isDarwin;
     description = "Indexes Git repositories into Elasticsearch for GitLab";
     homepage = "https://gitlab.com/gitlab-org/gitlab-elasticsearch-indexer";
     mainProgram = "gitlab-elasticsearch-indexer";

pkgs/by-name/go/gogcli/package.nix

@@ -7,16 +7,16 @@
 
 buildGo127Module (finalAttrs: {
   pname = "gogcli";
-  version = "0.38.1";
+  version = "0.40.0";
 
   src = fetchFromGitHub {
     owner = "openclaw";
     repo = "gogcli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-AaChyDvbMnPkWkBCnpISQm8U2WjXvwBSCfuN6fuIHaY=";
+    hash = "sha256-JAIN0MaQegHkg1zBsIYf2YIh3VyeFvQdvyXe9U9AZjg=";
   };
 
-  vendorHash = "sha256-+Nbuwok3dY/82gUDKeGgrC0F1ZqXSW8IpV6Q1yzIPvo=";
+  vendorHash = "sha256-6+/8FVPtrRdE1Hn/MkneZWUiOD/fnQkGYG/T/KD8Du8=";
 
   subPackages = [ "cmd/gog" ];
 

pkgs/by-name/go/gomuks-desktop/gomuks-binary-path.patch

@@ -1,12 +0,0 @@
-diff --git a/forge.config.ts b/forge.config.ts
-index 198cdcc0..9997b4c8 100644
---- a/forge.config.ts
-+++ b/forge.config.ts
-@@ -87,6 +87,7 @@ const config: ForgeConfig = {
- 			}
- 		},
- 		packageAfterCopy: async (_forgeConfig, buildPath, _electronVersion, platform, _arch) => {
-+			return;
- 			const binaryName = platform === "win32" ? "gomuks.exe" : "gomuks"
- 			const resourcesDir = path.resolve(buildPath, "..")
- 			const dest = path.join(resourcesDir, binaryName)

pkgs/by-name/go/gomuks-desktop/package.nix

@@ -25,11 +25,11 @@ buildNpmPackage (finalAttrs: {
   npmBuildScript = "package";
 
   npmDepsFetcherVersion = 2;
-  npmDepsHash = "sha256-m3T9aPBuknyDIySa2fJagj0xeQmcJ/RgkzlDCsvfTKs=";
+  npmDepsHash = "sha256-nyf59B0QV5MjMCUwc12lZduZt6y761QKolmgM9mR4qQ=";
 
   patches = [
-    ./gomuks-binary-path.patch # fix location of gomuks-web binary at build-time
-    ./resources-path.patch # allow specifying location of icons
+    # allow specifying location of icons and gomuks-web binary at runtime
+    ./resources-path.patch
   ];
 
   nativeBuildInputs = [

pkgs/by-name/go/gomuks-desktop/resources-path.patch

@@ -1,5 +1,5 @@
 diff --git a/forge.config.ts b/forge.config.ts
-index 4fda2d92..16581c55 100644
+index 2d3be537..d7271ed0 100644
 --- a/forge.config.ts
 +++ b/forge.config.ts
 @@ -61,7 +61,7 @@ const config: ForgeConfig = {
@@ -11,11 +11,19 @@ index 4fda2d92..16581c55 100644
  	},
  	hooks: {
  		readPackageJson: async (_forgeConfig, packageJSON) => {
+@@ -87,6 +87,7 @@ const config: ForgeConfig = {
+ 			}
+ 		},
+ 		packageAfterCopy: async (_forgeConfig, buildPath, _electronVersion, platform) => {
++			return;
+ 			const binaryName = platform === "win32" ? "gomuks.exe" : "gomuks"
+ 			const resourcesDir = path.resolve(buildPath, "..")
+ 			const dest = path.join(resourcesDir, binaryName)
 diff --git a/src/mainwindow.ts b/src/mainwindow.ts
-index da649371..94b52173 100644
+index 0fba60fc..d297f665 100644
 --- a/src/mainwindow.ts
 +++ b/src/mainwindow.ts
-@@ -56,7 +56,7 @@ export class GomuksWindow {
+@@ -129,7 +129,7 @@ export class GomuksWindow {
  
  	createTray() {
  		const trayIconPath = path.join(
@@ -24,7 +32,7 @@ index da649371..94b52173 100644
  			process.platform === "darwin" ? "trayTemplate@2x.png" : "tray@2x.png",
  		)
  		this.tray = new Tray(nativeImage.createFromPath(trayIconPath))
-@@ -136,6 +136,7 @@ export class GomuksWindow {
+@@ -207,6 +207,7 @@ export class GomuksWindow {
  			width: 1280,
  			height: 720,
  			autoHideMenuBar: true,

pkgs/by-name/go/gomuks-web/package.nix

@@ -11,17 +11,17 @@
 
 buildGoModule (finalAttrs: {
   pname = "gomuks-web";
-  version = "26.08";
+  version = "26.09";
 
   src = fetchFromGitHub {
     owner = "gomuks";
     repo = "gomuks";
     tag = "v0.${lib.replaceStrings [ "." ] [ "" ] finalAttrs.version}.0";
-    hash = "sha256-2HjMHd6qUkRiF/XdP/iW7TT55tHnJHsLRCIakTf4DQc=";
+    hash = "sha256-s/xB4L5m0OuaZUG7ESOxPRGq9dSzlhfzppexvZD2fKc=";
   };
 
   proxyVendor = true;
-  vendorHash = "sha256-EAzCVLxxB5n3exq/NXY3ORMcrHRh6LqONAzXp1n3sgg=";
+  vendorHash = "sha256-8Ctgfpaz+feXhlZszrwZ/SUQLhOdMQkJVzxgywFrga8=";
 
   nativeBuildInputs = [
     nodejs
@@ -37,7 +37,7 @@ buildGoModule (finalAttrs: {
     npmRoot = "web";
     npmDeps = fetchNpmDeps {
       src = "${finalAttrs.src}/web";
-      hash = "sha256-2QXKaUXe15svQQia1sWwab42vI68He3pBN7xiOZ+UKE=";
+      hash = "sha256-t45wpiuBy9S2UaI/bQJqHOCWn11QWlcEuP7lNrgH90E=";
     };
   };
 

pkgs/by-name/go/google-chrome/package.nix

@@ -180,7 +180,7 @@ let
 
   linux = stdenvNoCC.mkDerivation (finalAttrs: {
     inherit pname meta;
-    version = "153.0.8010.47";
+    version = "153.0.8010.52";
 
     src =
       let
@@ -195,8 +195,8 @@ let
         url = "https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-stable/google-chrome-stable_${finalAttrs.version}-1_${debArch}.deb";
         hash =
           {
-            amd64 = "sha256-oybe/eVN4vHA1G2L9La18/dvDIl70wsgsCUJcTmgW94=";
-            arm64 = "sha256-DEyVf0gz2ab4HkwzXEEpwowPmHfh5SA2/XYuygrfTbI=";
+            amd64 = "sha256-KeDkta8BITkV/9t/TkmhGVbcX8WRFlyFr4aI3N/5B6w=";
+            arm64 = "sha256-5aHWRq9ZRWiUHjph57jt3Gk/dpt/Fmh0xx9yycuAYWU=";
           }
           .${debArch};
       };
@@ -306,11 +306,11 @@ let
 
   darwin = stdenvNoCC.mkDerivation (finalAttrs: {
     inherit pname meta;
-    version = "153.0.8010.48";
+    version = "153.0.8010.53";
 
     src = fetchurl {
-      url = "https://dl.google.com/release2/chrome/ad6l2piroiqtckdm7rwkc6givuyq_153.0.8010.48/GoogleChrome-153.0.8010.48.dmg";
-      hash = "sha256-FgoOxuBiUAFk3X9iBHxlWFsNcO/PU95ObKTTuWLPnpo=";
+      url = "https://dl.google.com/release2/chrome/advkfamzjrpin7rbc7pzjxz6wkuq_153.0.8010.53/GoogleChrome-153.0.8010.53.dmg";
+      hash = "sha256-Hi/sZoZ16hdmIdGlpbEQ7DmhmwqxblE9mzgkHLMgN2w=";
     };
 
     dontPatch = true;

pkgs/by-name/go/gossip/package.nix

@@ -128,6 +128,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
   passthru.updateScript = nix-update-script { };
 
   meta = {
+    # last successful hydra build on darwin was in 2025
+    broken = stdenv.hostPlatform.isDarwin;
     description = "Desktop client for nostr, an open social media protocol";
     downloadPage = "https://github.com/mikedilger/gossip/releases/tag/${finalAttrs.version}";
     homepage = "https://github.com/mikedilger/gossip";

pkgs/by-name/gp/gpauth/package.nix

@@ -2,10 +2,12 @@
   rustPlatform,
   lib,
   fetchFromGitHub,
+  glib-networking,
   openssl,
   pkg-config,
   perl,
   webkitgtk_4_1,
+  wrapGAppsHook3,
   stdenv,
   nix-update-script,
 }:
@@ -29,11 +31,15 @@ rustPlatform.buildRustPackage (finalAttrs: {
   nativeBuildInputs = [
     perl
     pkg-config
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [
+    wrapGAppsHook3
   ];
   buildInputs = [
     openssl
   ]
   ++ lib.optionals stdenv.hostPlatform.isLinux [
+    glib-networking
     webkitgtk_4_1
   ];