Merge 08740d8811 into haskell-updates

2026-07-06 17:13:24 -05:00 · 2026-06-13 00:57:33 +00:00 · 2026-06-13 00:57:33 +00:00 · 0814616eaf
commit 0814616eaf
parent f70431ea67 08740d8811
278 changed files with 2772 additions and 1658 deletions
--- a/ci/pinned.json
+++ b/ci/pinned.json
@ -9,9 +9,9 @@
      },
      "branch": "nixpkgs-unstable",
      "submodules": false,
-      "revision": "cbb5cf358f50aa6acc9efd6113b7bcfbc352cd73",
-      "url": "https://github.com/NixOS/nixpkgs/archive/cbb5cf358f50aa6acc9efd6113b7bcfbc352cd73.tar.gz",
-      "hash": "sha256-IX7G1dlKrOqPOImfbo7ADDfV5yU1+j+MRChI3TL4tAA="
+      "revision": "8c91a71d13451abc40eb9dae8910f972f979852f",
+      "url": "https://github.com/NixOS/nixpkgs/archive/8c91a71d13451abc40eb9dae8910f972f979852f.tar.gz",
+      "hash": "sha256-fnzKKPvS+oieI/pTzotA5tkoM47EB1NpaBcgk4R97hE="
    },
    "treefmt-nix": {
      "type": "Git",
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -5103,12 +5103,6 @@
    githubId = 68112;
    name = "Simon";
  };
-  cirno-999 = {
-    email = "reverene@protonmail.com";
-    github = "cirno-999";
-    githubId = 73712874;
-    name = "cirno-999";
-  };
  citadelcore = {
    email = "alex@arctarus.co.uk";
    github = "RealityAnomaly";
@ -11906,12 +11900,6 @@
    github = "ivan-timokhin";
    githubId = 9802104;
  };
-  ivan-tkatchev = {
-    email = "tkatchev@gmail.com";
-    github = "ivan-tkatchev";
-    githubId = 650601;
-    name = "Ivan Tkatchev";
-  };
  ivan770 = {
    email = "ivan@ivan770.me";
    github = "ivan770";
--- a/nixos/doc/manual/release-notes/rl-2611.section.md
+++ b/nixos/doc/manual/release-notes/rl-2611.section.md
@ -24,6 +24,8 @@

 - Support for the legacy U‐Boot image format has been removed from the initrd generators, as it is deprecated upstream and no longer used by any platform in Nixpkgs.

+- Rustical migrates from `settings.http.host` and `settings.http.port` to `settings.http.bind` to support UNIX domain sockets as well as TCP sockets in one setting.
+
 - `services.llama-cpp` is now configured using structured `services.llama-cpp.settings` attribute.

 - Python 2 has been removed from the top-level package set, as it is long past end-of-life. The `python2`, `python27`, `python2Full`, `python27Full`, `python2Packages`, and `python27Packages` attributes, along with the legacy `python`, `pythonFull`, and `pythonPackages` aliases, now throw an error directing you to `python3`. The `isPy2` and `isPy27` package flags have been removed accordingly. The only remaining Python 2 interpreter is vendored inside the `resholve` package for its `oil` dependency and is not exposed for general use.
@ -34,6 +36,8 @@

 - `services.firezone.server.provision` has been removed due to it being unmaintanable. Remove all uses of provisioning and use the WebUI to configure firezone.

+- The `services.syncthing` module now updates the Syncthing REST API using partial updates (`PATCH`) instead of full replacements (`PUT`) for general settings. Updating these settings was broken and prone to errors after updates, see [#428808](https://github.com/NixOS/nixpkgs/issues/428808) and [#528889](https://github.com/NixOS/nixpkgs/issues/528889). As a result, settings modified manually through the Syncthing Web UI that are not explicitly defined in your Nix configuration will now persist across rebuilds.
+
 ## Other Notable Changes {#sec-release-26.11-notable-changes}

 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
--- a/nixos/modules/programs/wayland/hyprland.nix
+++ b/nixos/modules/programs/wayland/hyprland.nix
@ -107,9 +107,9 @@ in
        services.displayManager.sessionPackages = [ cfg.package ];

        systemd = lib.mkIf cfg.systemd.setPath.enable {
-          user.extraConfig = ''
-            DefaultEnvironment="PATH=/run/wrappers/bin:/etc/profiles/per-user/%u/bin:/nix/var/nix/profiles/default/bin:/run/current-system/sw/bin:$PATH"
-          '';
+          user.settings.Manager = {
+            DefaultEnvironment = "PATH=/run/wrappers/bin:/etc/profiles/per-user/%u/bin:/nix/var/nix/profiles/default/bin:/run/current-system/sw/bin:$PATH";
+          };
        };
      }

--- a/nixos/modules/services/misc/llama-cpp.nix
+++ b/nixos/modules/services/misc/llama-cpp.nix
@ -164,7 +164,7 @@ in
      };
    };

-    networking.firewall.allowedTCPPorts = lib.optional cfg.openFirewall cfg.port;
+    networking.firewall.allowedTCPPorts = lib.optional cfg.openFirewall cfg.settings.port;
  };

  meta.maintainers = with lib.maintainers; [
--- a/nixos/modules/services/networking/haproxy.nix
+++ b/nixos/modules/services/networking/haproxy.nix
@ -68,13 +68,10 @@ in
          # when the master process receives USR2, it reloads itself using exec(argv[0]),
          # so we create a symlink there and update it before reloading
          "${pkgs.coreutils}/bin/ln -sf ${lib.getExe cfg.package} /run/haproxy/haproxy"
-          # when running the config test, don't be quiet so we can see what goes wrong
-          "/run/haproxy/haproxy -c -f ${haproxyCfg}"
        ];
        ExecStart = "/run/haproxy/haproxy -Ws -f /etc/haproxy.cfg -p /run/haproxy/haproxy.pid";
        # support reloading
        ExecReload = [
-          "${lib.getExe cfg.package} -c -f ${haproxyCfg}"
          "${pkgs.coreutils}/bin/ln -sf ${lib.getExe cfg.package} /run/haproxy/haproxy"
          "${pkgs.coreutils}/bin/kill -USR2 $MAINPID"
        ];
--- a/nixos/modules/services/networking/syncthing.nix
+++ b/nixos/modules/services/networking/syncthing.nix
@ -6,15 +6,13 @@
  ...
 }:

-with lib;
-
 let
  cfg = config.services.syncthing;
  opt = options.services.syncthing;
  defaultUser = "syncthing";
  defaultGroup = defaultUser;
  settingsFormat = pkgs.formats.json { };
-  cleanedConfig = converge (filterAttrsRecursive (_: v: v != null && v != { })) cfg.settings;
+  cleanedConfig = lib.converge (lib.filterAttrsRecursive (_: v: v != null && v != { })) cfg.settings;

  isUnixGui = lib.strings.hasPrefix "unix://" cfg.guiAddress;

@ -35,7 +33,7 @@ let
    else
      "${cfg.guiAddress}${path}";

-  devices = mapAttrsToList (
+  devices = lib.mapAttrsToList (
    _: device:
    device
    // {
@ -45,31 +43,10 @@ let

  anyAutoAccept = builtins.any (dev: dev.autoAcceptFolders) devices;

-  folders = mapAttrsToList (
-    _: folder:
-    folder
-    //
-      throwIf (folder ? rescanInterval || folder ? watch || folder ? watchDelay)
-        ''
-          The options services.syncthing.settings.folders.<name>.{rescanInterval,watch,watchDelay}
-          were removed. Please use, respectively, {rescanIntervalS,fsWatcherEnabled,fsWatcherDelayS} instead.
-        ''
-        {
-          devices =
-            let
-              folderDevices = folder.devices;
-            in
-            map (
-              device:
-              if builtins.isString device then
-                { deviceId = cfg.settings.devices.${device}.id; }
-              else if builtins.isAttrs device then
-                { deviceId = cfg.settings.devices.${device.name}.id; } // device
-              else
-                throw "Invalid type for devices in folder '${folderName}'; expected list or attrset."
-            ) folderDevices;
-        }
-  ) (filterAttrs (_: folder: folder.enable) cfg.settings.folders);
+  folders = lib.pipe cfg.settings.folders [
+    (lib.filterAttrs (_: folder: folder.enable))
+    builtins.attrValues
+  ];

  jq = "${pkgs.jq}/bin/jq";
  grep = lib.getExe pkgs.gnugrep;
@ -179,7 +156,7 @@ let
        [
          # Now for each of these attributes, write the curl commands that are
          # identical to both folders and devices.
-          (mapAttrs (
+          (lib.mapAttrs (
            conf_type: s:
            # We iterate the `conf` list now, and run a curl -X POST command for each, that
            # should update that device/folder only.
@ -301,7 +278,7 @@ let
    +
      /*
        Now we update the other settings defined in cleanedConfig which are not
-        "folders", "devices", or "guiPasswordFile".
+        "folders", "devices", "guiPasswordFile", or "defaults".
      */
      (lib.pipe cleanedConfig [
        builtins.attrNames
@ -309,14 +286,35 @@ let
          "folders"
          "devices"
          "guiPasswordFile"
+          "defaults"
        ])
        (map (subOption: ''
-          curl -X PUT -d ${
+          curl -X PATCH -d ${
            lib.escapeShellArg (builtins.toJSON cleanedConfig.${subOption})
          } ${curlAddressArgs "/rest/config/${subOption}"}
        ''))
        (lib.concatStringsSep "\n")
      ])
+    +
+      # Handle the "defaults" option separately, as it has multiple sub-endpoints.
+      (lib.optionalString (cleanedConfig ? defaults) (
+        lib.pipe cleanedConfig.defaults [
+          builtins.attrNames
+          (map (
+            subOption:
+            let
+              # /rest/config/defaults/ignores only supports PUT
+              method = if subOption == "ignores" then "PUT" else "PATCH";
+            in
+            ''
+              curl -X ${method} -d ${
+                lib.escapeShellArg (builtins.toJSON cleanedConfig.defaults.${subOption})
+              } ${curlAddressArgs "/rest/config/defaults/${subOption}"}
+            ''
+          ))
+          (lib.concatStringsSep "\n")
+        ]
+      ))
    +
      # Now we hash the contents of guiPasswordFile and use the result to update the gui password
      (lib.optionalString (cfg.guiPasswordFile != null) ''
@ -337,10 +335,10 @@ in
  options = {
    services.syncthing = {

-      enable = mkEnableOption "Syncthing, a self-hosted open-source alternative to Dropbox and Bittorrent Sync";
+      enable = lib.mkEnableOption "Syncthing, a self-hosted open-source alternative to Dropbox and Bittorrent Sync";

-      cert = mkOption {
-        type = types.nullOr types.str;
+      cert = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
        default = null;
        description = ''
          Path to the `cert.pem` file, which will be copied into Syncthing's
@ -348,8 +346,8 @@ in
        '';
      };

-      key = mkOption {
-        type = types.nullOr types.str;
+      key = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
        default = null;
        description = ''
          Path to the `key.pem` file, which will be copied into Syncthing's
@ -357,16 +355,16 @@ in
        '';
      };

-      guiPasswordFile = mkOption {
-        type = types.nullOr types.str;
+      guiPasswordFile = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
        default = null;
        description = ''
          Path to file containing the plaintext password for Syncthing's GUI.
        '';
      };

-      overrideDevices = mkOption {
-        type = types.bool;
+      overrideDevices = lib.mkOption {
+        type = lib.types.bool;
        default = true;
        description = ''
          Whether to delete the devices which are not configured via the
@ -376,10 +374,10 @@ in
        '';
      };

-      overrideFolders = mkOption {
-        type = types.bool;
+      overrideFolders = lib.mkOption {
+        type = lib.types.bool;
        default = !anyAutoAccept;
-        defaultText = literalMD ''
+        defaultText = lib.literalMD ''
          `true` unless any device has the
          [autoAcceptFolders](#opt-services.syncthing.settings.devices._name_.autoAcceptFolders)
          option set to `true`.
@ -392,47 +390,47 @@ in
        '';
      };

-      settings = mkOption {
-        type = types.submodule {
+      settings = lib.mkOption {
+        type = lib.types.submodule {
          freeformType = settingsFormat.type;
          options = {
            # global options
-            options = mkOption {
+            options = lib.mkOption {
              default = { };
              description = ''
                The options element contains all other global configuration options
              '';
-              type = types.submodule (
-                { name, ... }:
+              type = lib.types.submodule (
+                { ... }:
                {
                  freeformType = settingsFormat.type;
                  options = {
-                    localAnnounceEnabled = mkOption {
-                      type = types.nullOr types.bool;
+                    localAnnounceEnabled = lib.mkOption {
+                      type = lib.types.nullOr lib.types.bool;
                      default = null;
                      description = ''
                        Whether to send announcements to the local LAN, also use such announcements to find other devices.
                      '';
                    };

-                    localAnnouncePort = mkOption {
-                      type = types.nullOr types.port;
+                    localAnnouncePort = lib.mkOption {
+                      type = lib.types.nullOr lib.types.port;
                      default = null;
                      description = ''
                        The port on which to listen and send IPv4 broadcast announcements to.
                      '';
                    };

-                    relaysEnabled = mkOption {
-                      type = types.nullOr types.bool;
+                    relaysEnabled = lib.mkOption {
+                      type = lib.types.nullOr lib.types.bool;
                      default = null;
                      description = ''
                        When true, relays will be connected to and potentially used for device to device connections.
                      '';
                    };

-                    urAccepted = mkOption {
-                      type = types.nullOr types.int;
+                    urAccepted = lib.mkOption {
+                      type = lib.types.nullOr lib.types.int;
                      default = null;
                      description = ''
                        Whether the user has accepted to submit anonymous usage data.
@ -441,16 +439,16 @@ in
                      '';
                    };

-                    limitBandwidthInLan = mkOption {
-                      type = types.nullOr types.bool;
+                    limitBandwidthInLan = lib.mkOption {
+                      type = lib.types.nullOr lib.types.bool;
                      default = null;
                      description = ''
                        Whether to apply bandwidth limits to devices in the same broadcast domain as the local device.
                      '';
                    };

-                    maxFolderConcurrency = mkOption {
-                      type = types.nullOr types.int;
+                    maxFolderConcurrency = lib.mkOption {
+                      type = lib.types.nullOr lib.types.int;
                      default = null;
                      description = ''
                        This option controls how many folders may concurrently be in I/O-intensive operations such as syncing or scanning.
@ -463,7 +461,7 @@ in
            };

            # device settings
-            devices = mkOption {
+            devices = lib.mkOption {
              default = { };
              description = ''
                Peers/devices which Syncthing should communicate with.
@ -478,30 +476,30 @@ in
                  addresses = [ "tcp://192.168.0.10:51820" ];
                };
              };
-              type = types.attrsOf (
-                types.submodule (
+              type = lib.types.attrsOf (
+                lib.types.submodule (
                  { name, ... }:
                  {
                    freeformType = settingsFormat.type;
                    options = {

-                      name = mkOption {
-                        type = types.str;
+                      name = lib.mkOption {
+                        type = lib.types.str;
                        default = name;
                        description = ''
                          The name of the device.
                        '';
                      };

-                      id = mkOption {
-                        type = types.str;
+                      id = lib.mkOption {
+                        type = lib.types.str;
                        description = ''
                          The device ID. See <https://docs.syncthing.net/dev/device-ids.html>.
                        '';
                      };

-                      autoAcceptFolders = mkOption {
-                        type = types.bool;
+                      autoAcceptFolders = lib.mkOption {
+                        type = lib.types.bool;
                        default = false;
                        description = ''
                          Automatically create or share folders that this device advertises at the default path.
@ -516,7 +514,7 @@ in
            };

            # folder settings
-            folders = mkOption {
+            folders = lib.mkOption {
              default = { };
              description = ''
                Folders which should be shared by Syncthing.
@ -525,7 +523,7 @@ in
                will be reverted on restart if [overrideFolders](#opt-services.syncthing.overrideFolders)
                is enabled.
              '';
-              example = literalExpression ''
+              example = lib.literalExpression ''
                {
                  "/home/user/sync" = {
                    id = "syncme";
@ -533,15 +531,15 @@ in
                  };
                }
              '';
-              type = types.attrsOf (
-                types.submodule (
+              type = lib.types.attrsOf (
+                lib.types.submodule (
                  { name, ... }:
                  {
                    freeformType = settingsFormat.type;
                    options = {

-                      enable = mkOption {
-                        type = types.bool;
+                      enable = lib.mkOption {
+                        type = lib.types.bool;
                        default = true;
                        description = ''
                          Whether to share this folder.
@ -550,12 +548,12 @@ in
                        '';
                      };

-                      path = mkOption {
+                      path = lib.mkOption {
                        # TODO for release 23.05: allow relative paths again and set
                        # working directory to cfg.dataDir
-                        type = types.str // {
-                          check = x: types.str.check x && (substring 0 1 x == "/" || substring 0 2 x == "~/");
-                          description = types.str.description + " starting with / or ~/";
+                        type = lib.types.str // {
+                          check = x: lib.types.str.check x && (lib.substring 0 1 x == "/" || lib.substring 0 2 x == "~/");
+                          description = lib.types.str.description + " starting with / or ~/";
                        };
                        default = name;
                        description = ''
@ -566,24 +564,24 @@ in
                        '';
                      };

-                      id = mkOption {
-                        type = types.str;
+                      id = lib.mkOption {
+                        type = lib.types.str;
                        default = name;
                        description = ''
                          The ID of the folder. Must be the same on all devices.
                        '';
                      };

-                      label = mkOption {
-                        type = types.str;
+                      label = lib.mkOption {
+                        type = lib.types.str;
                        default = name;
                        description = ''
                          The label of the folder.
                        '';
                      };

-                      type = mkOption {
-                        type = types.enum [
+                      type = lib.mkOption {
+                        type = lib.types.enum [
                          "sendreceive"
                          "sendonly"
                          "receiveonly"
@ -596,17 +594,17 @@ in
                        '';
                      };

-                      devices = mkOption {
-                        type = types.listOf (
-                          types.oneOf [
-                            types.str
-                            (types.submodule (
+                      devices = lib.mkOption {
+                        type = lib.types.listOf (
+                          lib.types.oneOf [
+                            lib.types.str
+                            (lib.types.submodule (
                              { ... }:
                              {
                                freeformType = settingsFormat.type;
                                options = {
-                                  name = mkOption {
-                                    type = types.str;
+                                  name = lib.mkOption {
+                                    type = lib.types.str;
                                    default = null;
                                    description = ''
                                      The name of a device defined in the
@ -614,8 +612,8 @@ in
                                      option.
                                    '';
                                  };
-                                  encryptionPasswordFile = mkOption {
-                                    type = types.nullOr types.externalPath;
+                                  encryptionPasswordFile = lib.mkOption {
+                                    type = lib.types.nullOr lib.types.externalPath;
                                    default = null;
                                    description = ''
                                      Path to encryption password. If set, the file will be read during
@ -637,14 +635,14 @@ in
                        '';
                      };

-                      versioning = mkOption {
+                      versioning = lib.mkOption {
                        default = null;
                        description = ''
                          How to keep changed/deleted files with Syncthing.
                          There are 4 different types of versioning with different parameters.
                          See <https://docs.syncthing.net/users/versioning.html>.
                        '';
-                        example = literalExpression ''
+                        example = lib.literalExpression ''
                          [
                            {
                              versioning = {
@ -680,13 +678,12 @@ in
                            }
                          ]
                        '';
-                        type =
-                          with types;
-                          nullOr (submodule {
+                        type = lib.types.nullOr (
+                          lib.types.submodule {
                            freeformType = settingsFormat.type;
                            options = {
-                              type = mkOption {
-                                type = enum [
+                              type = lib.mkOption {
+                                type = lib.types.enum [
                                  "external"
                                  "simple"
                                  "staggered"
@ -698,11 +695,12 @@ in
                                '';
                              };
                            };
-                          });
+                          }
+                        );
                      };

-                      copyOwnershipFromParent = mkOption {
-                        type = types.bool;
+                      copyOwnershipFromParent = lib.mkOption {
+                        type = lib.types.bool;
                        default = false;
                        description = ''
                          On Unix systems, tries to copy file/folder ownership from the parent directory (the directory it’s located in).
@ -710,8 +708,8 @@ in
                        '';
                      };

-                      ignorePatterns = mkOption {
-                        type = types.nullOr (types.listOf types.str);
+                      ignorePatterns = lib.mkOption {
+                        type = lib.types.nullOr (lib.types.listOf lib.types.str);
                        default = null;
                        description = ''
                          Syncthing can be configured to ignore certain files in a folder using ignore patterns.
@ -771,8 +769,8 @@ in
        };
      };

-      guiAddress = mkOption {
-        type = types.str;
+      guiAddress = lib.mkOption {
+        type = lib.types.str;
        default = "127.0.0.1:8384";
        apply = x: if lib.strings.hasPrefix "/" x then "unix://${x}" else x;
        description = ''
@ -780,16 +778,16 @@ in
        '';
      };

-      systemService = mkOption {
-        type = types.bool;
+      systemService = lib.mkOption {
+        type = lib.types.bool;
        default = true;
        description = ''
          Whether to auto-launch Syncthing as a system service.
        '';
      };

-      user = mkOption {
-        type = types.str;
+      user = lib.mkOption {
+        type = lib.types.str;
        default = defaultUser;
        example = "yourUser";
        description = ''
@ -799,8 +797,8 @@ in
        '';
      };

-      group = mkOption {
-        type = types.str;
+      group = lib.mkOption {
+        type = lib.types.str;
        default = defaultGroup;
        example = "yourGroup";
        description = ''
@ -809,8 +807,8 @@ in
        '';
      };

-      all_proxy = mkOption {
-        type = with types; nullOr str;
+      all_proxy = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
        default = null;
        example = "socks5://address.com:1234";
        description = ''
@ -821,8 +819,8 @@ in
        '';
      };

-      dataDir = mkOption {
-        type = types.path;
+      dataDir = lib.mkOption {
+        type = lib.types.path;
        default = "/var/lib/syncthing";
        example = "/home/yourUser";
        description = ''
@ -832,15 +830,15 @@ in

      configDir =
        let
-          cond = versionAtLeast config.system.stateVersion "19.03";
+          cond = lib.versionAtLeast config.system.stateVersion "19.03";
        in
-        mkOption {
-          type = types.path;
+        lib.mkOption {
+          type = lib.types.path;
          description = ''
            The path where the settings and keys will exist.
          '';
-          default = cfg.dataDir + optionalString cond "/.config/syncthing";
-          defaultText = literalMD ''
+          default = cfg.dataDir + lib.optionalString cond "/.config/syncthing";
+          defaultText = lib.literalMD ''
            * if `stateVersion >= 19.03`:

                  config.${opt.dataDir} + "/.config/syncthing"
@ -850,17 +848,17 @@ in
          '';
        };

-      databaseDir = mkOption {
-        type = types.path;
+      databaseDir = lib.mkOption {
+        type = lib.types.path;
        description = ''
          The directory containing the database and logs.
        '';
        default = cfg.configDir;
-        defaultText = literalExpression "config.${opt.configDir}";
+        defaultText = lib.literalExpression "config.${opt.configDir}";
      };

-      extraFlags = mkOption {
-        type = types.listOf types.str;
+      extraFlags = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
        default = [ ];
        example = [ "--reset-deltas" ];
        description = ''
@ -868,8 +866,8 @@ in
        '';
      };

-      openDefaultPorts = mkOption {
-        type = types.bool;
+      openDefaultPorts = lib.mkOption {
+        type = lib.types.bool;
        default = false;
        example = true;
        description = ''
@ -883,35 +881,37 @@ in
        '';
      };

-      package = mkPackageOption pkgs "syncthing" { };
+      package = lib.mkPackageOption pkgs "syncthing" { };
    };
  };

  imports = [
-    (mkRemovedOptionModule [ "services" "syncthing" "useInotify" ] ''
+    (lib.mkRemovedOptionModule [ "services" "syncthing" "useInotify" ] ''
      This option was removed because Syncthing now has the inotify functionality included under the name "fswatcher".
      It can be enabled on a per-folder basis through the web interface.
    '')
-    (mkRenamedOptionModule
+    (lib.mkRenamedOptionModule
      [ "services" "syncthing" "extraOptions" ]
      [ "services" "syncthing" "settings" ]
    )
-    (mkRenamedOptionModule
+    (lib.mkRenamedOptionModule
      [ "services" "syncthing" "folders" ]
      [ "services" "syncthing" "settings" "folders" ]
    )
-    (mkRenamedOptionModule
+    (lib.mkRenamedOptionModule
      [ "services" "syncthing" "devices" ]
      [ "services" "syncthing" "settings" "devices" ]
    )
-    (mkRenamedOptionModule
+    (lib.mkRenamedOptionModule
      [ "services" "syncthing" "options" ]
      [ "services" "syncthing" "settings" "options" ]
    )
  ]
  ++
    map
-      (o: mkRenamedOptionModule [ "services" "syncthing" "declarative" o ] [ "services" "syncthing" o ])
+      (
+        o: lib.mkRenamedOptionModule [ "services" "syncthing" "declarative" o ] [ "services" "syncthing" o ]
+      )
      [
        "cert"
        "key"
@ -924,7 +924,7 @@ in

  ###### implementation

-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
    assertions = [
      {
        assertion = !(cfg.overrideFolders && anyAutoAccept);
@ -941,7 +941,7 @@ in
      }
    ];

-    networking.firewall = mkIf cfg.openDefaultPorts {
+    networking.firewall = lib.mkIf cfg.openDefaultPorts {
      allowedTCPPorts = [ 22000 ];
      allowedUDPPorts = [
        21027
@ -952,7 +952,7 @@ in
    environment.systemPackages = [ cfg.package ];
    systemd.packages = [ cfg.package ];

-    users.users = mkIf (cfg.systemService && cfg.user == defaultUser) {
+    users.users = lib.mkIf (cfg.systemService && cfg.user == defaultUser) {
      ${defaultUser} = {
        group = cfg.group;
        home = cfg.dataDir;
@ -962,14 +962,14 @@ in
      };
    };

-    users.groups = mkIf (cfg.systemService && cfg.group == defaultGroup) {
+    users.groups = lib.mkIf (cfg.systemService && cfg.group == defaultGroup) {
      ${defaultGroup}.gid = config.ids.gids.syncthing;
    };

    systemd.services = {
      # upstream reference:
      # https://github.com/syncthing/syncthing/blob/main/etc/linux-systemd/system/syncthing%40.service
-      syncthing = mkIf cfg.systemService {
+      syncthing = lib.mkIf cfg.systemService {
        description = "Syncthing service";
        after = [ "network.target" ];
        environment = {
@ -986,13 +986,13 @@ in
          User = cfg.user;
          Group = cfg.group;
          ExecStartPre =
-            mkIf (cfg.cert != null || cfg.key != null)
+            lib.mkIf (cfg.cert != null || cfg.key != null)
              "+${pkgs.writers.writeBash "syncthing-copy-keys" ''
                install -dm700 -o ${cfg.user} -g ${cfg.group} ${cfg.configDir}
-                ${optionalString (cfg.cert != null) ''
+                ${lib.optionalString (cfg.cert != null) ''
                  install -Dm644 -o ${cfg.user} -g ${cfg.group} ${toString cfg.cert} ${cfg.configDir}/cert.pem
                ''}
-                ${optionalString (cfg.key != null) ''
+                ${lib.optionalString (cfg.key != null) ''
                  install -Dm600 -o ${cfg.user} -g ${cfg.group} ${toString cfg.key} ${cfg.configDir}/key.pem
                ''}
              ''}";
@ -1034,7 +1034,7 @@ in
          ];
        };
      };
-      syncthing-init = mkIf (cleanedConfig != { }) {
+      syncthing-init = lib.mkIf (cleanedConfig != { }) {
        description = "Syncthing configuration updater";
        requisite = [ "syncthing.service" ];
        after = [ "syncthing.service" ];
@ -1050,4 +1050,9 @@ in
      };
    };
  };
+
+  meta.maintainers = with lib.maintainers; [
+    doronbehar
+    seudonym
+  ];
 }
--- a/nixos/modules/services/web-apps/rustical.nix
+++ b/nixos/modules/services/web-apps/rustical.nix
@ -55,12 +55,12 @@ in
          };

          http = {
-            host = mkOption {
+            bind = mkOption {
              type = types.str;
-              default = "[::1]";
-              example = "[::]";
+              default = "unix:/run/rustical/sock";
+              example = "[::]:4000";
              description = ''
-                Host address to bind the HTTP service to.
+                Address and port or UNIX socket path to bind the HTTP service to.

                :::{.note}
                Rustical expects to be hosted behind a reverse proxy that
@ -69,14 +69,6 @@ in
                :::
              '';
            };
-
-            port = mkOption {
-              type = types.port;
-              default = 4000;
-              description = ''
-                Port to bind the HTTP service to.
-              '';
-            };
          };

          dav_push.enabled = mkOption {
@ -126,6 +118,19 @@ in
  };

  config = mkIf cfg.enable {
+    warnings = lib.optionals (cfg.settings.http ? host || cfg.settings.http ? port) [
+      ''
+        Rustical 0.13 deprecations
+
+        The following options are now deprecated and will be removed in a
+        future release:
+        - `services.rustical.settings.http.host`
+        - `services.rustical.settings.http.port`
+
+        Migrate to `services.rustical.settings.http.bind` instead.
+      ''
+    ];
+
    # install the config at a path where the cli will find it
    environment.etc."rustical/config.toml".source = configFile;

--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -1585,6 +1585,7 @@ in
  sx = runTest ./sx.nix;
  sympa = runTest ./sympa.nix;
  syncthing = runTest ./syncthing/main.nix;
+  syncthing-defaults = runTest ./syncthing/defaults.nix;
  syncthing-folders = runTest ./syncthing/folders.nix;
  syncthing-guiPassword = runTest ./syncthing/guiPassword.nix;
  syncthing-guiPasswordFile = runTest ./syncthing/guiPasswordFile.nix;
--- a/nixos/tests/firewall.nix
+++ b/nixos/tests/firewall.nix
@ -89,12 +89,17 @@
        else
          "nixos-firewall-tool open tcp 80";
      reset = if backend == "firewalld" then "firewall-cmd --reload" else "nixos-firewall-tool reset";
+      # https://github.com/firewalld/firewalld/issues/1571
+      waitForFirewalld = lib.optionalString (backend == "firewalld") ''
+        walled.wait_until_succeeds("firewall-cmd --state")
+      '';
    in
    ''
      start_all()

      walled.wait_for_unit("${unit}")
      walled.wait_for_unit("httpd")
+      ${waitForFirewalld}
      attacker.wait_for_unit("network.target")

      # Local connections should still work.
--- a/nixos/tests/firewalld.nix
+++ b/nixos/tests/firewalld.nix
@ -29,6 +29,8 @@

    walled.wait_for_unit("firewalld")
    walled.wait_for_unit("httpd")
+    # https://github.com/firewalld/firewalld/issues/1571
+    walled.wait_until_succeeds("firewall-cmd --state")

    open.wait_for_unit("network.target")

--- a/nixos/tests/syncthing/defaults.nix
+++ b/nixos/tests/syncthing/defaults.nix
@ -0,0 +1,42 @@
+{ lib, pkgs, ... }:
+let
+  expectedPath = "/tmp/syncthing-default";
+in
+{
+  name = "syncthing-defaults";
+  meta.maintainers = with pkgs.lib.maintainers; [ seudonym ];
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      environment.systemPackages = [
+        pkgs.libxml2
+        pkgs.curl
+      ];
+      services.syncthing = {
+        enable = true;
+        settings.defaults.folder.path = expectedPath;
+      };
+    };
+
+  testScript = ''
+    import json
+
+    machine.wait_for_unit("syncthing.service")
+    machine.wait_for_unit("syncthing-init.service")
+
+    # Get the API key by parsing the config.xml
+    api_key = machine.succeed(
+        "xmllint --xpath 'string(configuration/gui/apikey)' /var/lib/syncthing/.config/syncthing/config.xml"
+    ).strip()
+
+    # Query the defaults/folder endpoint via Syncthing's REST API
+    config = json.loads(machine.succeed(
+        f"curl -Ssf -H 'X-API-Key: {api_key}' http://127.0.0.1:8384/rest/config/defaults/folder"
+    ))
+
+    actual_path = config.get('path')
+    assert actual_path == "${expectedPath}", f"Default folder path is '{actual_path}', but expected '${expectedPath}'"
+    machine.log(f"Success: Default folder path is correctly set to '{actual_path}'")
+  '';
+}
--- a/nixos/tests/web-apps/rustical.nix
+++ b/nixos/tests/web-apps/rustical.nix
@ -3,28 +3,35 @@
  lib,
  ...
 }:
+
+let
+  port = "4000";
+in
+
 {
  name = "rustical";

  meta.maintainers = pkgs.rustical.meta.maintainers;

-  nodes.machine =
+  containers.machine =
    {
      pkgs,
      ...
    }:
    {
-      services.rustical.enable = true;
+      services.rustical = {
+        enable = true;
+        settings.http.bind = "[::]:${port}";
+      };
      environment.systemPackages = with pkgs; [ calendar-cli ];
    };

  testScript =
    {
-      nodes,
+      containers,
      ...
    }:
    let
-      port = toString nodes.machine.services.rustical.settings.http.port;
      url = "http://localhost:${toString port}";

      createPrincipalScript = pkgs.writeScript "rustical-create-principal" ''
--- a/pkgs/applications/editors/android-studio/default.nix
+++ b/pkgs/applications/editors/android-studio/default.nix
@ -26,9 +26,9 @@ let
    url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2026.1.1.7/android-studio-quail1-rc2-linux.tar.gz";
  };
  latestVersion = {
-    version = "2026.1.2.4"; # "Android Studio Quail 2 | 2026.1.2 Canary 4"
-    sha256Hash = "sha256-fnJYHZPy9bOZJ2leG2+Mr5JGH5HMc2HeMeYGHBUxJXo=";
-    url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2026.1.2.4/android-studio-quail2-canary4-linux.tar.gz";
+    version = "2026.1.2.7"; # "Android Studio Quail 2 | 2026.1.2 Canary 7"
+    sha256Hash = "sha256-LHszfAtM5ZLNbTZG0isb+aUW3uwp+zav/igHT4HDeEM=";
+    url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2026.1.2.7/android-studio-quail2-canary7-linux.tar.gz";
  };
 in
 {
--- a/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix
@ -21,26 +21,26 @@ vscode-utils.buildVscodeMarketplaceExtension (finalAttrs: {
      sources = {
        "x86_64-linux" = {
          arch = "linux-x64";
-          hash = "sha256-R3ab2IeY9QnDhZFk52/05pIv4A+sZU3kJ9Jn5uLRa4Y=";
+          hash = "sha256-XA4xSd/sg9vhOGqcCNliHzloBxPZsgXW/dSkKp/RzM0=";
        };
        "aarch64-linux" = {
          arch = "linux-arm64";
-          hash = "sha256-AE6zS8bJ4vec+P36NkxWYQ1tmcJG2WsFkv75+gRlrxA=";
+          hash = "sha256-l2NjDHBOMBzJT9Pis7sqSuFuG07eZPALximND+hVqDU=";
        };
        "x86_64-darwin" = {
          arch = "darwin-x64";
-          hash = "sha256-n1qV1Lrl65HSDthMc5/7hLppeNBO6067Z+Rf5+kxfnA=";
+          hash = "sha256-hE/1N28f9uAzg2fG3Hrc4z1kW21rdhtCRmF9SphqiFc=";
        };
        "aarch64-darwin" = {
          arch = "darwin-arm64";
-          hash = "sha256-g+lkUYym43o8cEFseWCrcSUUTx296u8DS9JvnU1dBLU=";
+          hash = "sha256-68CmDax385o0juoQWNX/NLx+tjIt9YytTHjRZkqAR98=";
        };
      };
    in
    {
      name = "claude-code";
      publisher = "anthropic";
-      version = "2.1.172";
+      version = "2.1.175";
    }
    // sources.${stdenvNoCC.hostPlatform.system}
      or (throw "Unsupported system ${stdenvNoCC.hostPlatform.system}");
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@ -320,8 +320,8 @@ let
        mktplcRef = {
          name = "vscode-apollo";
          publisher = "apollographql";
-          version = "2.6.5";
-          hash = "sha256-WOt0bY/hi9tLJEo0bTAPLQhgM+2A7JPp0pypX4EcYNo=";
+          version = "2.6.6";
+          hash = "sha256-rvLZoLY0P031ZAjeYXNqPVYwRNkCRYUvedosxM51opc=";
        };
        meta = {
          changelog = "https://marketplace.visualstudio.com/items/apollographql.vscode-apollo/changelog";
@ -2030,8 +2030,8 @@ let
        mktplcRef = {
          name = "Go";
          publisher = "golang";
-          version = "0.52.2";
-          hash = "sha256-8g+r4Mv06Bx1W3yAXWVbtz1B/gXPcRdmaV0tPkTP6Gk=";
+          version = "0.54.0";
+          hash = "sha256-o1SJjR6eQcGWN9BGoN5CBTdn6RsNG2a0+p/ZDcywzr0=";
        };
        meta = {
          changelog = "https://marketplace.visualstudio.com/items/golang.Go/changelog";
@ -3587,8 +3587,8 @@ let
        mktplcRef = {
          name = "vscode-just-syntax";
          publisher = "nefrob";
-          version = "0.10.1";
-          hash = "sha256-s/JxIALrYb/dew1CdvvM1UmnewyRcJPB/ETJ/Ai2QJA=";
+          version = "0.10.2";
+          hash = "sha256-F7H9f24TjB3JtWLVICYwRTjxa+GTOpYN7IzSlU1audo=";
        };
        meta = {
          changelog = "https://marketplace.visualstudio.com/items/nefrob.vscode-just-syntax/changelog";
@ -4130,8 +4130,8 @@ let
        mktplcRef = {
          name = "scala";
          publisher = "scala-lang";
-          version = "0.5.9";
-          hash = "sha256-zgCqKwnP7Fm655FPUkD5GL+/goaplST8507X890Tnhc=";
+          version = "0.5.10";
+          hash = "sha256-hGJbu/tRt1Du/OYuui7z/CINlMug/SlUQjPNy8Rvkxg=";
        };
        meta = {
          license = lib.licenses.mit;
@ -4222,8 +4222,8 @@ let
        mktplcRef = {
          publisher = "shd101wyy";
          name = "markdown-preview-enhanced";
-          version = "0.8.27";
-          hash = "sha256-v4CZul1uuNlMrIgfml9EjUy0I626GkBArNH7F+5Z/dA=";
+          version = "0.8.30";
+          hash = "sha256-wtI+W+ZNxXv8WonGDmSt1NxeF8WN8fqPCuMougERxDE=";
        };
        meta = {
          description = "Provides a live preview of markdown using either markdown-it or pandoc";
--- a/pkgs/applications/editors/vscode/extensions/ms-vscode-remote.remote-ssh/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/ms-vscode-remote.remote-ssh/default.nix
@ -84,8 +84,8 @@ buildVscodeMarketplaceExtension {
  mktplcRef = {
    name = "remote-ssh";
    publisher = "ms-vscode-remote";
-    version = "0.123.0";
-    hash = "sha256-/9NyRSNUCx65FOA6w86e2DvrynAHRleIULzDpneV25E=";
+    version = "0.124.0";
+    hash = "sha256-GokSJOEpHomkBbkPUBhVXWZCrGbi5oZTlw5PFV12ZBY=";
  };

  postPatch = ''
--- a/pkgs/applications/editors/vscode/extensions/redhat.vscode-xml/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/redhat.vscode-xml/default.nix
@ -11,22 +11,22 @@ vscode-utils.buildVscodeMarketplaceExtension {
      sources = {
        "x86_64-linux" = {
          arch = "linux-x64";
-          hash = "sha256-vm12qVJ6+KbyHdzB/Q4SrEZDUKVsKJufjbVn9OBGbns=";
+          hash = "sha256-cP/oFn19CZ/G3kjdHNZGqXvoDE1qUtg6xrg/2MO14Lo=";
        };
        "x86_64-darwin" = {
          arch = "darwin-x64";
-          hash = "sha256-1dunJX+7oL2RqsK2pCScKAe/O0b3ypfgsuHXoDvvChM=";
+          hash = "sha256-wtk8SasxXEQ3pCJpVTWR8wcY/bNaIZmImbAtrFWYWOo=";
        };
        "aarch64-darwin" = {
          arch = "darwin-arm64";
-          hash = "sha256-5IG0H3QIY6ll77aZ6/8uFeIpgjupjBx0GfFJaX7Wep4=";
+          hash = "sha256-XYdwVoDqK+88ZYUm6APyamFNx6XlYjy0R4CIhSMuRmU=";
        };
      };
    in
    {
      publisher = "redhat";
      name = "vscode-xml";
-      version = "0.29.2";
+      version = "0.29.3";
    }
    // sources.${stdenvNoCC.hostPlatform.system} or { };

--- a/pkgs/applications/editors/vscode/extensions/saoudrizwan.claude-dev/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/saoudrizwan.claude-dev/default.nix
@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
  mktplcRef = {
    name = "claude-dev";
    publisher = "saoudrizwan";
-    version = "3.86.2";
-    hash = "sha256-Peoja4AQUPlwAKeJMOziGjd/WU4wz5B8cplCTh20yTA=";
+    version = "3.89.2";
+    hash = "sha256-lDt/xn1PFs0UDg0rOOun8Bl/FTXSjvQ//ETkoHFypAM=";
  };

  meta = {
--- a/pkgs/applications/emulators/libretro/cores/mame2003.nix
+++ b/pkgs/applications/emulators/libretro/cores/mame2003.nix
@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "mame2003";
-  version = "0-unstable-2026-05-22";
+  version = "0-unstable-2026-06-05";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "mame2003-libretro";
-    rev = "099c2ef21c67c463a97b9ab19403e58b31c69740";
-    hash = "sha256-D3/d/TzTjK0t4bh6Il9CMfHTHdYgMsQNE52PxjrXeyE=";
+    rev = "299789ce642b34c2679cfd89d7ecf06b09851bc1";
+    hash = "sha256-FX+onEaaQUdcjAvgsrdW0m408oCSXJEJHQncrN2Uk/Y=";
  };

  # Fix build with GCC 14
--- a/pkgs/applications/networking/browsers/chromium/info.json
+++ b/pkgs/applications/networking/browsers/chromium/info.json
@ -1,10 +1,10 @@
 {
  "chromium": {
-    "version": "149.0.7827.102",
+    "version": "149.0.7827.114",
    "chromedriver": {
-      "version": "149.0.7827.103",
-      "hash_darwin": "sha256-3ws6RyF5SwjRcdo4IY+MzqcaZ6214dCVV3YB4YL+h6k=",
-      "hash_darwin_aarch64": "sha256-S8/dGAlipcYXzZIEJEGAnvsu3ilqjnBb8IdXUxGrp2o="
+      "version": "149.0.7827.115",
+      "hash_darwin": "sha256-DOhM1knKphvLNyrkf0uvb9NZ3kBwSuVN5hkQLqAZR1Y=",
+      "hash_darwin_aarch64": "sha256-HXWvAjMdMMbeF8DsgFKNM+S0ZEYr2M8Wj0uUZC7tmxY="
    },
    "deps": {
      "depot_tools": {
@ -21,8 +21,8 @@
    "DEPS": {
      "src": {
        "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "112f665d98a2fe84b156c74fbea2aed742f16c15",
-        "hash": "sha256-75PYsss5Qob493WCc28XHncjFIlvUr2HQx79w5UmK/k=",
+        "rev": "5be7af702aa73ed64f47858cecc86290e42f2a20",
+        "hash": "sha256-R2vnW3Wa+REar23OhyFWzOo44F8NN9IqH7GjWJ1g1lo=",
        "recompress": true
      },
      "src/third_party/clang-format/script": {
@ -823,7 +823,7 @@
    }
  },
  "ungoogled-chromium": {
-    "version": "149.0.7827.53",
+    "version": "149.0.7827.114",
    "deps": {
      "depot_tools": {
        "rev": "45dedc4c3b87c982fd846b3dc599b233ed3aff90",
@ -835,16 +835,16 @@
        "hash": "sha256-oFs7fZAZEs/gQ7X1A4uigo9+Y+iEN9sMMQYwAjEuD04="
      },
      "ungoogled-patches": {
-        "rev": "149.0.7827.53-1",
-        "hash": "sha256-j4maEZiU38tqs57cTmg8OhIAAQcT+liWU0fDA7GMZHM="
+        "rev": "149.0.7827.114-1",
+        "hash": "sha256-F0pIlZM/EBPLIZxD8jyLX7HWe0vFn2HXs2vkM5+Xplg="
      },
      "npmHash": "sha256-pF0JtwFpPC4/fodbhSJnQKkczA9WlDg4VqEAy9aDVLg="
    },
    "DEPS": {
      "src": {
        "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "9d2c8156a72129edca4785abb98866fad60ea338",
-        "hash": "sha256-RPFeHTWAeJUzbWU7QyRPmT3sqf3bAEuJ7/IJ3TP40pA=",
+        "rev": "5be7af702aa73ed64f47858cecc86290e42f2a20",
+        "hash": "sha256-R2vnW3Wa+REar23OhyFWzOo44F8NN9IqH7GjWJ1g1lo=",
        "recompress": true
      },
      "src/third_party/clang-format/script": {
@ -914,8 +914,8 @@
      },
      "src/third_party/angle": {
        "url": "https://chromium.googlesource.com/angle/angle.git",
-        "rev": "ded782bca9d5f165d1c4a70124cdc5384043a8b3",
-        "hash": "sha256-7+Hhx/V554hO3zzGuIZswkaRVDElz7ost7vbnf2wyZc="
+        "rev": "4b8c7f0f321952bba4f81056b4aa57d0d6428642",
+        "hash": "sha256-ADG0WfkeFRq4NF0m+s3a/N5+u3q4ApExuWUnV3m5uAI="
      },
      "src/third_party/angle/third_party/glmark2/src": {
        "url": "https://chromium.googlesource.com/external/github.com/glmark2/glmark2",
@ -954,8 +954,8 @@
      },
      "src/third_party/dawn": {
        "url": "https://dawn.googlesource.com/dawn.git",
-        "rev": "1815a06195d9c74ac737a96f87c05111926e04f8",
-        "hash": "sha256-71KbW0w60VB67+HM48WpOo18hrVId4/4QBDl+xl5pgo="
+        "rev": "c1179de12ec3ed8feb91e922f12a90ae33f4a8cf",
+        "hash": "sha256-VFEBqbSsn/3jqRGJgTM/r5DEtfhvTOIfS9fGIKzYo9I="
      },
      "src/third_party/dawn/third_party/glfw3/src": {
        "url": "https://chromium.googlesource.com/external/github.com/glfw/glfw",
@ -1374,8 +1374,8 @@
      },
      "src/third_party/libyuv": {
        "url": "https://chromium.googlesource.com/libyuv/libyuv.git",
-        "rev": "a7849e8a5e9c996bef2332efae897e7301055a20",
-        "hash": "sha256-ftOTwWULKNplqjQQ9oM9t+PU3S6/ySDOBoE5E/HWuHg="
+        "rev": "644251f252a84bf8ce91ff0aca86a9b16b069ab8",
+        "hash": "sha256-DsoOY8bg0sPOF8tF67Gk7fRqdQzG1hc9fVMlZVjKWU4="
      },
      "src/third_party/lss": {
        "url": "https://chromium.googlesource.com/linux-syscall-support.git",
@ -1429,8 +1429,8 @@
      },
      "src/third_party/perfetto": {
        "url": "https://chromium.googlesource.com/external/github.com/google/perfetto.git",
-        "rev": "846203c4b3b25f834a0bebc101fa8e1b8f9d0ca9",
-        "hash": "sha256-YOgOau9vNrOOqyUf6WylI/oQ2drCxoW7jnrHt7fAfQM="
+        "rev": "97c58a94bb6495c4e202467fb1c55eaa22b5670f",
+        "hash": "sha256-qtClkWAluLDRZn7yrHLU7qp9szP+/WsiG5JZZzRKd38="
      },
      "src/third_party/protobuf-javascript/src": {
        "url": "https://chromium.googlesource.com/external/github.com/protocolbuffers/protobuf-javascript",
@ -1474,8 +1474,8 @@
      },
      "src/third_party/skia": {
        "url": "https://skia.googlesource.com/skia.git",
-        "rev": "53348aa333da02b77c4b5797e2de722f5abde7d0",
-        "hash": "sha256-Qh0ytA45zP67VQE417iUtjPcJmJmDzcu4BAatyh6p0w="
+        "rev": "92a56ebeef43061f4878aa869aa1f2160265c24c",
+        "hash": "sha256-QEY9Wy2guRuS4CXeXHUhUNigCJWWndnNCbWQmaSYJ/A="
      },
      "src/third_party/smhasher/src": {
        "url": "https://chromium.googlesource.com/external/smhasher.git",
@ -1609,8 +1609,8 @@
      },
      "src/third_party/webrtc": {
        "url": "https://webrtc.googlesource.com/src.git",
-        "rev": "5a7e0ff57a52e12f834d64c57d040d1105ea17f2",
-        "hash": "sha256-V1accCSU6LV5Ixhd+HBOvqZ7GxT57ALsvaF8ABLIXxM="
+        "rev": "e8b4d4c5952a8fb7b35c2a6cba4e8c3de2ea2e1e",
+        "hash": "sha256-94U9URlFGLYe94KCFU0giY9bBbrHNDCBr9GEwbRbOK4="
      },
      "src/third_party/wuffs/src": {
        "url": "https://skia.googlesource.com/external/github.com/google/wuffs-mirror-release-c.git",
@ -1639,8 +1639,8 @@
      },
      "src/v8": {
        "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "5a39b146dd810a52812202fae891281d5dc4db7d",
-        "hash": "sha256-UbX88nE4VyWUm4PvFTOy3mC04MzSdgC006ZpQrEY8cQ="
+        "rev": "16ef80c1f5d3cfade812bd1743952a4cfd480a31",
+        "hash": "sha256-GI0NWA0XYGocxZp3+lPen6BkwaG7X3EDaEWM9rejgkI="
      }
    }
  }
--- a/pkgs/applications/networking/browsers/chromium/ungoogled-flags.toml
+++ b/pkgs/applications/networking/browsers/chromium/ungoogled-flags.toml
@ -16,4 +16,3 @@ treat_warnings_as_errors=false
 use_official_google_api_keys=false
 use_unofficial_version_number=false
 v8_drumbrake_bounds_checks=true
-v8_enable_drumbrake=true
--- a/pkgs/applications/networking/cluster/helm/default.nix
+++ b/pkgs/applications/networking/cluster/helm/default.nix
@ -72,15 +72,15 @@ buildGoModule (finalAttrs: {
  ''
  + lib.optionalString stdenv.hostPlatform.isDarwin ''
    # skipping as test fails in sandbox
-    substituteInPlace cmd/helm/dependency_build_test.go \
+    substituteInPlace pkg/cmd/dependency_build_test.go \
      --replace-fail "TestDependencyBuildCmd" "SkipDependencyBuildCmd"
-    substituteInPlace cmd/helm/dependency_update_test.go \
+    substituteInPlace pkg/cmd/dependency_update_test.go \
      --replace-fail "TestDependencyUpdateCmd" "SkipDependencyUpdateCmd"
    # skipping as test fails in sandbox
-    substituteInPlace cmd/helm/install_test.go \
+    substituteInPlace pkg/cmd/install_test.go \
      --replace-fail "TestInstall" "SkipInstall"
    # skipping as test fails in sandbox
-    substituteInPlace cmd/helm/pull_test.go \
+    substituteInPlace pkg/cmd/pull_test.go \
      --replace-fail "TestPullCmd" "SkipPullCmd" \
      --replace-fail "TestPullWithCredentialsCmd" "SkipPullWithCredentialsCmd"
  '';
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@ -110,13 +110,13 @@
    "vendorHash": null
  },
  "bpg_proxmox": {
-    "hash": "sha256-HQDXazrYuO4Sy2p5M3T+ic34GXaLuAt/oPlUPC6kHSk=",
+    "hash": "sha256-10cdMZSGJuhUx432/2NazA8T88zclcnbolcU31wfIEM=",
    "homepage": "https://registry.terraform.io/providers/bpg/proxmox",
    "owner": "bpg",
    "repo": "terraform-provider-proxmox",
-    "rev": "v0.108.0",
+    "rev": "v0.109.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-pk4FEx/GpI3pbRt1zXEnTwfEy2renn8gh0mVbBiwUE0="
+    "vendorHash": "sha256-Tx5DjRLZJXm0GjKRaogra7m55Opeu9LVvT25UW5q4D0="
  },
  "brightbox_brightbox": {
    "hash": "sha256-pwFbCP+qDL/4IUfbPRCkddkbsEEeAu7Wp12/mDL0ABA=",
@ -155,13 +155,13 @@
    "vendorHash": "sha256-SO3CX7pZ+q7ytz/55cxTPlW7ByY1zKhxkQxMiqAvm8o="
  },
  "checkly_checkly": {
-    "hash": "sha256-C85OWP4y5Kh4coaUwxW07bgQWrB6LntEKtXia3Xu7Bg=",
+    "hash": "sha256-9kcZXbrfl8ovrg1w3bWdta/ABnLtVIfseRptZn5NrgI=",
    "homepage": "https://registry.terraform.io/providers/checkly/checkly",
    "owner": "checkly",
    "repo": "terraform-provider-checkly",
-    "rev": "v1.24.0",
+    "rev": "v1.25.0",
    "spdx": null,
-    "vendorHash": "sha256-CkrDrGP20Gby2wWsl+un3hp3u5gAmWOpjzgs9HQytjg="
+    "vendorHash": "sha256-7XgTkzYBfkpF8Dd4YsgpB+YIfkANsg/60b3AyO8Y8FA="
  },
  "ciscodevnet_aci": {
    "hash": "sha256-Z3qat3S7dv5kGpc82RxAwlgp3hfscFbkokVsgGnBRHY=",
@ -851,13 +851,13 @@
    "vendorHash": "sha256-OgKOjLwDQxJiv+VWdOzjMcUDPu9LOuhyTRyLyM39vLM="
  },
  "linode_linode": {
-    "hash": "sha256-ZDU8rEmbq9tIXq9+jL30i5GnTIWM6lMJ+rljVJhBJis=",
+    "hash": "sha256-aOLto01ntce/l+1ZcQf5Rsdu6ptgpYWpf5JpJ0zRUNs=",
    "homepage": "https://registry.terraform.io/providers/linode/linode",
    "owner": "linode",
    "repo": "terraform-provider-linode",
-    "rev": "v3.14.0",
+    "rev": "v3.14.1",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-6wWNt0TDqqwtRFMCLH81WQ55XLEn4dHx+prM0DA+e4U="
+    "vendorHash": "sha256-dnvv6sSzEUZ4Hbrq/pAgi/O1RyxCx89omCVzvCe70S0="
  },
  "loafoe_htpasswd": {
    "hash": "sha256-1HCvAGWsYlcYCA8iOmBb/AawxHPLuoxxQWLzNy0x79M=",
@ -1202,13 +1202,13 @@
    "vendorHash": "sha256-MIO0VHofPtKPtynbvjvEukMNr5NXHgk7BqwIhbc9+u0="
  },
  "selectel_selectel": {
-    "hash": "sha256-1KHFXjYJIWgdZo5nAsckQI9ff+74yO0A5Q65symJjlw=",
+    "hash": "sha256-xoIwvrjeuY1T+7pyBQfoU8orWC4qMuQ9IgbLYIEzLIA=",
    "homepage": "https://registry.terraform.io/providers/selectel/selectel",
    "owner": "selectel",
    "repo": "terraform-provider-selectel",
-    "rev": "v8.0.1",
+    "rev": "v8.1.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-ICMbdEr2vGKZ1ETZLmmrW8h+bzPkpSQk9U3qF+LHPzk="
+    "vendorHash": "sha256-Y2oj1DIn80CCdJ7ZM/p6sGqT64dGIEFg/vXXSv6B+iE="
  },
  "siderolabs_talos": {
    "hash": "sha256-/NACmEpodBNx+Q2M9y3JnKpw9a3Y1eFDdTQ+48MXAc8=",
--- a/pkgs/applications/networking/cluster/terraform/default.nix
+++ b/pkgs/applications/networking/cluster/terraform/default.nix
@ -200,8 +200,8 @@ rec {
  mkTerraform = attrs: pluggable (generic attrs);

  terraform_1 = mkTerraform {
-    version = "1.15.5";
-    hash = "sha256-U3A+Zwe+oj107z635uxzt4y06hvbv9sfokknYdFIglE=";
+    version = "1.15.6";
+    hash = "sha256-FH5s0uyRESytv/1xloU3HXuH2ApjBC3FfEqFqIgBgFs=";
    vendorHash = "sha256-3y9+KCmvskJ24X4F6gSLglmsl4hUlvzBb/ep4kcbS8A=";
    patches = [ ./provider-path-0_15.patch ];
    passthru = {
--- a/pkgs/applications/office/libreoffice/default.nix
+++ b/pkgs/applications/office/libreoffice/default.nix
@ -111,6 +111,7 @@
  gpgmepp,
  libwebp,
  abseil-cpp,
+  libfreehand,
  libepubgen,
  libetonyek,
  libpng,
@ -518,6 +519,7 @@ stdenv.mkDerivation (finalAttrs: {
      libatomic_ops
      libcdr
      libcmis
+      libfreehand
      libe-book
      libepoxy
      libepubgen
@ -662,6 +664,7 @@ stdenv.mkDerivation (finalAttrs: {
    "--with-system-headers"
    "--with-system-libabw"
    "--with-system-libcmis"
+    "--with-system-libfreehand"
    "--with-system-libepubgen"
    "--with-system-libetonyek"
    "--with-system-liblangtag"
@ -679,7 +682,6 @@ stdenv.mkDerivation (finalAttrs: {
    # TODO: package these as system libraries
    "--without-system-altlinuxhyph"
    "--without-system-libeot"
-    "--without-system-libfreehand"
    "--without-system-libmspub"
    "--without-system-libnumbertext"
    "--without-system-libpagemaker"
--- a/pkgs/build-support/node/fetch-pnpm-deps/default.nix
+++ b/pkgs/build-support/node/fetch-pnpm-deps/default.nix
@ -52,19 +52,7 @@ in
      pnpm-fixup-state-db' =
        if pnpm.nodejs-slim or null != null then
          pnpm-fixup-state-db.override {
-            # FIXME: make npm-config-hook accept nodejs-slim
-            nodejs =
-              let
-                inherit (pnpm) nodejs-slim;
-              in
-              if nodejs-slim ? paths && builtins.isList nodejs-slim.paths then
-                # If nodejs-slim has a list `paths` attribute, it's likely a simlinkJoin
-                nodejs-slim
-              else
-                # Otherwise we need to recreate one by overriding the default one
-                pnpm-fixup-state-db.nodejs.override {
-                  inherit nodejs-slim;
-                };
+            inherit (pnpm) nodejs-slim;
          }
        else
          pnpm-fixup-state-db;
--- a/pkgs/build-support/src-only/default.nix
+++ b/pkgs/build-support/src-only/default.nix
@ -37,37 +37,44 @@

 attrs:
 let
-  argsToOverride = args: {
-    name = "${args.name or "${args.pname}-${args.version}"}-source";
+  argsToOverride =
+    args:
+    {
+      name = "${args.name or "${args.pname}-${args.version}"}-source";

-    outputs = [ "out" ];
+      outputs = [ "out" ];

-    phases = [
-      "unpackPhase"
-      "patchPhase"
-      "installPhase"
-    ];
-    separateDebugInfo = false;
+      phases = [
+        "unpackPhase"
+        "patchPhase"
+        "installPhase"
+      ];
+      separateDebugInfo = false;

-    dontUnpack = lib.warnIf (args.dontUnpack or false
-    ) "srcOnly: derivation has dontUnpack set, overriding" false;
+      dontUnpack = lib.warnIf (args.dontUnpack or false
+      ) "srcOnly: derivation has dontUnpack set, overriding" false;

-    dontInstall = false;
-    installPhase = "cp -pr --reflink=auto -- . $out";
+      dontInstall = false;
+      installPhase = "cp -pr --reflink=auto -- . $out";

-    # the original derivation might've set something like outputDev = "lib", but "lib" isn't an output anymore
-    # some things get confused and error if one of these is set to an output that doesn't exist
-    # ex: pkgs/build-support/setup-hooks/multiple-outputs.sh
-    outputDev = "out";
-    outputBin = "out";
-    outputInclude = "out";
-    outputLib = "out";
-    outputDoc = "out";
-    outputDevdoc = "out";
-    outputMan = "out";
-    outputDevman = "out";
-    outputInfo = "out";
-  };
+      # the original derivation might've set something like outputDev = "lib", but "lib" isn't an output anymore
+      # some things get confused and error if one of these is set to an output that doesn't exist
+      # ex: pkgs/build-support/setup-hooks/multiple-outputs.sh
+      outputDev = "out";
+      outputBin = "out";
+      outputInclude = "out";
+      outputLib = "out";
+      outputDoc = "out";
+      outputDevdoc = "out";
+      outputMan = "out";
+      outputDevman = "out";
+      outputInfo = "out";
+
+    }
+    // lib.optionalAttrs (lib.isAttrs args.outputChecks or null) {
+      # If the original derivation includes outputChecks for output we are removing, we need to reset it to an empty check.
+      outputChecks = { };
+    };
 in

 # If we are passed a derivation (based on stdenv*), we can use overrideAttrs to
--- a/pkgs/build-support/trivial-builders/default.nix
+++ b/pkgs/build-support/trivial-builders/default.nix
@ -893,7 +893,7 @@ rec {
  # Docs in doc/build-helpers/fetchers.chapter.md
  # See https://nixos.org/manual/nixpkgs/unstable/#requirefile
  requireFile = lib.extendMkDerivation {
-    constructDrv = stdenv.mkDerivation;
+    constructDrv = stdenvNoCC.mkDerivation;

    excludeDrvArgNames = [
      "hash"
--- a/pkgs/build-support/trivial-builders/test/default.nix
+++ b/pkgs/build-support/trivial-builders/test/default.nix
@ -25,6 +25,7 @@ recurseIntoAttrs {
  symlinkJoin = recurseIntoAttrs (callPackage ./symlink-join.nix { });
  overriding = callPackage ../test-overriding.nix { };
  inherit references;
+  requireFile = callPackage ./requireFile.nix { };
  writeCBin = callPackage ./writeCBin.nix { };
  writeClosure-union = callPackage ./writeClosure-union.nix {
    inherit (references) samples;
--- a/pkgs/build-support/trivial-builders/test/requireFile.nix
+++ b/pkgs/build-support/trivial-builders/test/requireFile.nix
@ -0,0 +1,22 @@
+{
+  pkgsStatic,
+  lib,
+  requireFile,
+  emptyFile,
+}:
+let
+  name = "this-is-a-test";
+  requireFileTest =
+    requireFile:
+    requireFile {
+      inherit name;
+      url = "this-is-a-test";
+      hash = lib.fakeHash;
+    };
+  requireFile-native = requireFileTest requireFile;
+  requireFile-static = requireFileTest pkgsStatic.requireFile;
+in
+assert lib.assertMsg (
+  requireFile-native.name == name && requireFile-static.name == name
+) "requireFile derivation name must be the same across different package sets";
+emptyFile
--- a/pkgs/by-name/ab/ab-av1/package.nix
+++ b/pkgs/by-name/ab/ab-av1/package.nix
@ -8,16 +8,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "ab-av1";
-  version = "0.11.2";
+  version = "0.11.3";

  src = fetchFromGitHub {
    owner = "alexheretic";
    repo = "ab-av1";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-kT0BJr4xoYigKObD6vZNRieslaJj/MWuqQmhYLWNwvs=";
+    hash = "sha256-lLZAECwF8V19Qx/FugbjLeVns7lhVlwWDTK9cdYb0xo=";
  };

-  cargoHash = "sha256-o64GrmHvwF2VUKw+nIRK0jesSuelxNo0TFnyKaP/YlQ=";
+  cargoHash = "sha256-AONJz1BoDi6weHT7W9DmzwoPW5khfgYjDqLNl7OM5bY=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/by-name/ac/acl2/libipasirglucose4/default.nix
+++ b/pkgs/by-name/ac/acl2/libipasirglucose4/default.nix
@ -6,18 +6,18 @@
  unzip,
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "libipasirglucose4";
  # This library has no version number AFAICT (beyond generally being based on
  # Glucose 4.x), but it was submitted to the 2017 SAT competition so let's use
  # that as the version number, I guess.
  version = "2017";

-  libname = pname + stdenv.hostPlatform.extensions.sharedLibrary;
+  libname = finalAttrs.pname + stdenv.hostPlatform.extensions.sharedLibrary;

  src = fetchurl {
    url = "https://baldur.iti.kit.edu/sat-competition-2017/solvers/incremental/glucose-ipasir.zip";
-    sha256 = "0xchgady9vwdh8frmc8swz6va53igp2wj1y9sshd0g7549n87wdj";
+    hash = "sha256-svGDbCLlPNCg1skHycV9cRS1zecasZodgo3v5Jt6kHU=";
  };
  nativeBuildInputs = [ unzip ];

@ -29,13 +29,13 @@ stdenv.mkDerivation rec {
  makeFlags = [ "CXX=${stdenv.cc.targetPrefix}c++" ];

  postBuild = ''
-    $CXX -shared -o ${libname} \
-        ${lib.optionalString (!stdenv.cc.isClang) "-Wl,-soname,${libname}"} \
+    $CXX -shared -o ${finalAttrs.libname} \
+        ${lib.optionalString (!stdenv.cc.isClang) "-Wl,-soname,${finalAttrs.libname}"} \
        ipasirglucoseglue.o libipasirglucose4.a
  '';

  installPhase = ''
-    install -D ${libname} $out/lib/${libname}
+    install -D ${finalAttrs.libname} $out/lib/${finalAttrs.libname}
  '';

  meta = {
@ -44,4 +44,4 @@ stdenv.mkDerivation rec {
    platforms = lib.platforms.unix;
    maintainers = with lib.maintainers; [ kini ];
  };
-}
+})
--- a/pkgs/by-name/ac/acl2/package.nix
+++ b/pkgs/by-name/ac/acl2/package.nix
@ -32,15 +32,15 @@ let
  '';

 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "acl2";
  version = "8.6";

  src = fetchFromGitHub {
    owner = "acl2-devel";
    repo = "acl2-devel";
-    rev = version;
-    sha256 = "sha256-fF9bbEacwCHP1m/eVgFrTD4Ne7L2mzq0K9vJ1tiy9go=";
+    tag = finalAttrs.version;
+    hash = "sha256-fF9bbEacwCHP1m/eVgFrTD4Ne7L2mzq0K9vJ1tiy9go=";
  };

  # You can swap this out with any other IPASIR implementation at
@ -58,7 +58,7 @@ stdenv.mkDerivation rec {
    })

    (replaceVars ./0001-path-changes-for-nix.patch {
-      libipasir = "${libipasir}/lib/${libipasir.libname}";
+      libipasir = "${finalAttrs.libipasir}/lib/${finalAttrs.libipasir.libname}";
      libssl = "${lib.getLib openssl}/lib/libssl${stdenv.hostPlatform.extensions.sharedLibrary}";
      libcrypto = "${lib.getLib openssl}/lib/libcrypto${stdenv.hostPlatform.extensions.sharedLibrary}";
    })
@ -92,7 +92,7 @@ stdenv.mkDerivation rec {
    glucose
    minisat
    abc-verifier
-    libipasir
+    finalAttrs.libipasir
    z3
    (python3.withPackages (ps: [ ps.z3-solver ]))
  ];
@ -115,10 +115,10 @@ stdenv.mkDerivation rec {
    # ACL2 and its books need to be built in place in the out directory because
    # the proof artifacts are not relocatable. Since ACL2 mostly expects
    # everything to exist in the original source tree layout, we put it in
-    # $out/share/${pname} and create symlinks in $out/bin as necessary.
-    mkdir -p $out/share/${pname}
-    cp -pR . $out/share/${pname}
-    cd $out/share/${pname}
+    # $out/share/acl2 and create symlinks in $out/bin as necessary.
+    mkdir -p $out/share/acl2
+    cp -pR . $out/share/acl2
+    cd $out/share/acl2
  '';

  preBuild = "mkdir -p $HOME";
@ -132,19 +132,19 @@ stdenv.mkDerivation rec {

  installPhase = ''
    mkdir -p $out/bin
-    ln -s $out/share/${pname}/saved_acl2           $out/bin/${pname}
+    ln -s $out/share/acl2/saved_acl2           $out/bin/acl2
  ''
  + lib.optionalString certifyBooks ''
-    ln -s $out/share/${pname}/books/build/cert.pl  $out/bin/${pname}-cert
-    ln -s $out/share/${pname}/books/build/clean.pl $out/bin/${pname}-clean
+    ln -s $out/share/acl2/books/build/cert.pl  $out/bin/acl2-cert
+    ln -s $out/share/acl2/books/build/clean.pl $out/bin/acl2-clean
  '';

  preDistPhases = [ (if certifyBooks then "certifyBooksPhase" else "removeBooksPhase") ];

  certifyBooksPhase = ''
    # Certify the community books
-    pushd $out/share/${pname}/books
-    makeFlags="ACL2=$out/share/${pname}/saved_acl2"
+    pushd $out/share/acl2/books
+    makeFlags="ACL2=$out/share/acl2/saved_acl2"
    buildFlags="all"
    buildPhase

@ -157,7 +157,7 @@ stdenv.mkDerivation rec {

  removeBooksPhase = ''
    # Delete the community books
-    rm -rf $out/share/${pname}/books
+    rm -rf $out/share/acl2/books
  '';

  meta = {
@ -172,9 +172,9 @@ stdenv.mkDerivation rec {
      ACL2 is part of the Boyer-Moore family of provers, for which its authors
      have received the 2005 ACM Software System Award.

-      This package installs the main ACL2 executable ${pname}, as well as the
-      build tools cert.pl and clean.pl, renamed to ${pname}-cert and
-      ${pname}-clean.
+      This package installs the main ACL2 executable acl2, as well as the
+      build tools cert.pl and clean.pl, renamed to acl2-cert and
+      acl2-clean.

    ''
    + (
@ -212,4 +212,4 @@ stdenv.mkDerivation rec {
    ];
    platforms = lib.platforms.all;
  };
-}
+})
--- a/pkgs/by-name/al/alglib/package.nix
+++ b/pkgs/by-name/al/alglib/package.nix
@ -8,11 +8,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "alglib3";
-  version = "4.07.0";
+  version = "4.08.0";

  src = fetchurl {
    url = "https://www.alglib.net/translator/re/alglib-${finalAttrs.version}.cpp.gpl.tgz";
-    sha256 = "sha256-y4mlU+4gKwqUFgUHKoVxAjdq5EsMzSJeT6Dg4Llwi/A=";
+    sha256 = "sha256-mKPtCE+wLFagvBVDida8oQCyO7N0klWkyHFjkip3aoY=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/al/alpaca-proxy/package.nix
+++ b/pkgs/by-name/al/alpaca-proxy/package.nix
@ -30,7 +30,7 @@ buildGoModule (finalAttrs: {
  meta = {
    description = "HTTP forward proxy with PAC and NTLM authentication support";
    homepage = "https://github.com/samuong/alpaca";
-    changelog = "https://github.com/samuong/alpaca/releases/tag/v${finalAttrs.src.rev}";
+    changelog = "https://github.com/samuong/alpaca/releases/tag/v${finalAttrs.version}";
    license = lib.licenses.asl20;
    platforms = lib.platforms.linux ++ lib.platforms.darwin;
    maintainers = with lib.maintainers; [ _1nv0k32 ];
--- a/pkgs/by-name/al/alsa-firmware/package.nix
+++ b/pkgs/by-name/al/alsa-firmware/package.nix
@ -53,11 +53,13 @@ stdenv.mkDerivation (finalAttrs: {
  };

  meta = {
-    homepage = "http://www.alsa-project.org/";
+    homepage = "https://www.alsa-project.org/";
    description = "Soundcard firmwares from the alsa project";
    license = lib.licenses.gpl2Plus;
    platforms = lib.platforms.linux;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [
+      nick-linux
+    ];
    sourceProvenance = with lib.sourceTypes; [
      binaryFirmware
      fromSource
--- a/pkgs/by-name/al/alsa-plugins/package.nix
+++ b/pkgs/by-name/al/alsa-plugins/package.nix
@ -38,7 +38,7 @@ stdenv.mkDerivation (finalAttrs: {

  meta = {
    description = "Various plugins for ALSA";
-    homepage = "http://alsa-project.org/";
+    homepage = "https://alsa-project.org/";

    license = with lib.licenses; [
      lgpl21Plus
@ -46,7 +46,9 @@ stdenv.mkDerivation (finalAttrs: {
      gpl2Plus # attributes.m4 & usb_stream.h
    ];

-    maintainers = [ ];
+    maintainers = with lib.maintainers; [
+      nick-linux
+    ];
    platforms = lib.platforms.linux;
  };
 })
--- a/pkgs/by-name/al/altermime/package.nix
+++ b/pkgs/by-name/al/altermime/package.nix
@ -4,13 +4,13 @@
  fetchurl,
 }:

-gccStdenv.mkDerivation rec {
+gccStdenv.mkDerivation (finalAttrs: {
  pname = "altermime";
  version = "0.3.11";

  src = fetchurl {
-    url = "https://pldaniels.com/altermime/altermime-${version}.tar.gz";
-    sha256 = "15zxg6spcmd35r6xbidq2fgcg2nzyv1sbbqds08lzll70mqx4pj7";
+    url = "https://pldaniels.com/altermime/altermime-${finalAttrs.version}.tar.gz";
+    hash = "sha256-R17ScQWH0k8R0A2vpcP234rHnhO4xdVNLqNVdrV5/Zc=";
  };

  env.NIX_CFLAGS_COMPILE = toString [
@ -36,4 +36,4 @@ gccStdenv.mkDerivation rec {
    downloadPage = "https://pldaniels.com/altermime/";
    mainProgram = "altermime";
  };
-}
+})
--- a/pkgs/by-name/am/aml/package.nix
+++ b/pkgs/by-name/am/aml/package.nix
@ -3,33 +3,34 @@
  stdenv,
  fetchFromGitHub,
  meson,
-  pkg-config,
  ninja,
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "aml";
-  version = "0.3.0";
+  version = "1.0.0";

  src = fetchFromGitHub {
    owner = "any1";
    repo = "aml";
    tag = "v${finalAttrs.version}";
-    sha256 = "sha256-BX+MRqvnwwLPhz22m0gfJ2EkW31KQEi/YTgOCMcQk2Q=";
+    hash = "sha256-10gm6YphZrpLShj3NUj/AG24dSVLZAZbbnXr7GiF4DI=";
  };

  nativeBuildInputs = [
    meson
-    pkg-config
    ninja
  ];

+  strictDeps = true;
+
+  __structuredAttrs = true;
+
  meta = {
-    description = "Another main loop";
-    inherit (finalAttrs.src.meta) homepage;
+    description = "Andri's Main Loop";
+    homepage = "https://github.com/any1/aml";
    license = lib.licenses.isc;
-    platforms = lib.platforms.unix;
-    maintainers = [ ];
-    broken = stdenv.hostPlatform.isDarwin;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ nickcao ];
  };
 })
--- a/pkgs/by-name/am/amnezia-vpn/package.nix
+++ b/pkgs/by-name/am/amnezia-vpn/package.nix
@ -81,7 +81,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "amnezia-vpn";
-  version = "4.8.15.4";
+  version = "4.8.18.0";

  __structuredAttrs = true;

@ -89,7 +89,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "amnezia-vpn";
    repo = "amnezia-client";
    tag = finalAttrs.version;
-    hash = "sha256-ZUWesEpXb+L7NzL/jkWpS3b4DGq4733T5zc+VXSw9Ic=";
+    hash = "sha256-/A1juZzNWjdShdg41M1nfO3pMukMFzyBjQaZvZjYaJs=";
    fetchSubmodules = true;
  };

--- a/pkgs/by-name/an/anki/addons/anki-quizlet-importer-extended/default.nix
+++ b/pkgs/by-name/an/anki/addons/anki-quizlet-importer-extended/default.nix
@ -5,12 +5,12 @@
 }:
 anki-utils.buildAnkiAddon (finalAttrs: {
  pname = "anki-quizlet-importer-extended";
-  version = "2026.01.17";
+  version = "2026.06.08";
  src = fetchFromGitHub {
    owner = "sviatoslav-lebediev";
    repo = "anki-quizlet-importer-extended";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-BTddZColXM193x8xFa1axHeiWukjxXvwkXGpHxsLtR0=";
+    hash = "sha256-f8Y2Tp3Wo41rKhz/YX602xhxvR7xWUOfvjIKuprt/bo=";
  };
  meta = {
    description = "Import Quizlet Decks into Anki";
--- a/pkgs/by-name/an/antigravity-cli/package.nix
+++ b/pkgs/by-name/an/antigravity-cli/package.nix
@ -6,7 +6,7 @@
  versionCheckHook,
 }:
 let
-  wholeVersion = "1.0.7-5858071034068992"; # unfortunately this has dumb versioning
+  wholeVersion = "1.0.8-6513509081677824"; # unfortunately this has dumb versioning
  version = builtins.head (lib.splitString "-" wholeVersion);

  throwSystem = throw "Unsupported system: ${stdenvNoCC.hostPlatform.system}";
@ -14,19 +14,19 @@ let
  sourceData = {
    x86_64-linux = fetchurl {
      url = "https://storage.googleapis.com/antigravity-public/antigravity-cli/${wholeVersion}/linux-x64/cli_linux_x64.tar.gz";
-      hash = "sha256-8kaHmc0XPAPuATHb4rrkMhUzBqaLqi7n1UQPFcRB4Go=";
+      hash = "sha256-/BxcglSN6NqZdEbq50MypFW4bv2bCN37L0PqcuYz+e4=";
    };
    aarch64-linux = fetchurl {
      url = "https://storage.googleapis.com/antigravity-public/antigravity-cli/${wholeVersion}/linux-arm/cli_linux_arm64.tar.gz";
-      hash = "sha256-3ylG6ZW/9AuKydzzyMLtqC1ec2NnixFG/CJih26S0K0=";
+      hash = "sha256-QWQevvVezRdubRbG3V64C/XMHunfDsdA1OM8yhHoCHA=";
    };
    aarch64-darwin = fetchurl {
      url = "https://storage.googleapis.com/antigravity-public/antigravity-cli/${wholeVersion}/darwin-arm/cli_mac_arm64.tar.gz";
-      hash = "sha256-e4VhL/9rUNgE2XyW8REz8QXEbzwsUFg41xNpUHfNLK0=";
+      hash = "sha256-j+/brIYCKjIOa0KSGZHt4Ic4tjTzOrfPtA4J8iY9tHE=";
    };
    x86_64-darwin = fetchurl {
      url = "https://storage.googleapis.com/antigravity-public/antigravity-cli/${wholeVersion}/darwin-x64/cli_mac_x64.tar.gz";
-      hash = "sha256-SECE7bAd0VneVeAvBs14Ortkcqg8CJy9xcq3ZnuqfKY=";
+      hash = "sha256-0Cp76whEYtBdZS6GOnC+qqICGoqexX+v3KCFJmfaFAU=";
    };
  };
 in
--- a/pkgs/by-name/ar/arpa2cm/package.nix
+++ b/pkgs/by-name/ar/arpa2cm/package.nix
@ -3,21 +3,27 @@
  stdenv,
  fetchFromGitLab,
  cmake,
+  nix-update-script,
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "arpa2cm";
-  version = "1.0.4";
+  version = "1.0.7";
+
+  __structuredAttrs = true;
+  strictDeps = true;

  src = fetchFromGitLab {
    owner = "arpa2";
    repo = "arpa2cm";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-2vb/7UL+uWGrQNh8yOZ3gih5G1/eOp064hF78SDsPGk=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-JkMZUXqmrVzURVi8BJRsHprD4Jz6l83qhPxnOfq4KE4=";
  };

  nativeBuildInputs = [ cmake ];

+  passthru.updateScript = nix-update-script { };
+
  meta = {
    description = "CMake Module library for the ARPA2 project";
    longDescription = ''
@ -33,8 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
    '';
    homepage = "https://gitlab.com/arpa2/arpa2cm";
    license = lib.licenses.bsd2;
-    maintainers = with lib.maintainers; [
-      fufexan
-    ];
+    maintainers = with lib.maintainers; [ fufexan ];
+    teams = [ lib.teams.ngi ];
  };
 })
--- a/pkgs/by-name/as/asymptote/package.nix
+++ b/pkgs/by-name/as/asymptote/package.nix
@ -30,10 +30,12 @@
  curl,
  texinfo,
  texliveSmall,
+  vulkan-headers,
+  glfw,
 }:

 stdenv.mkDerivation (finalAttrs: {
-  version = "3.11";
+  version = "3.12";
  pname = "asymptote";

  outputs = [
@ -46,7 +48,7 @@ stdenv.mkDerivation (finalAttrs: {

  src = fetchurl {
    url = "mirror://sourceforge/asymptote/${finalAttrs.version}/asymptote-${finalAttrs.version}.src.tgz";
-    hash = "sha256-U36fImIb+E8J7g1E3EVcTqkboZODDx12JKB9RxDX59E=";
+    hash = "sha256-6uwel0Y+8hOjk8OI1GanNHiwgY+UA8liuRJAZZybjxs=";
  };

  # override with TeX Live containers to avoid building sty, docs from source
@ -111,6 +113,8 @@ stdenv.mkDerivation (finalAttrs: {
        pyqt5
      ]
    ))
+    vulkan-headers
+    glfw
  ]
  ++ lib.optionals stdenv.hostPlatform.isLinux [ libtirpc ];

--- a/pkgs/by-name/at/attyx/package.nix
+++ b/pkgs/by-name/at/attyx/package.nix
@ -18,13 +18,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "attyx";
-  version = "0.4.3";
+  version = "0.4.5";

  src = fetchFromGitHub {
    owner = "semos-labs";
    repo = "attyx";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-DJe1HreijOwFaqDY+Ai1utiK4u66pUbBkEY6TOat27A=";
+    hash = "sha256-9/Zl6IrgrT8vHYllCKb977Ar5QRYQiXDmK/g+4YWcqM=";
  };

  deps = callPackage ./build.zig.zon.nix { };
--- a/pkgs/by-name/au/autoprefixer/package.nix
+++ b/pkgs/by-name/au/autoprefixer/package.nix
@ -2,7 +2,7 @@
  lib,
  stdenv,
  nodejs,
-  pnpm_9,
+  pnpm_10,
  fetchPnpmDeps,
  pnpmConfigHook,
  fetchFromGitHub,
@ -11,26 +11,26 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "autoprefixer";
-  version = "10.4.24";
+  version = "10.5.0";

  src = fetchFromGitHub {
    owner = "postcss";
    repo = "autoprefixer";
-    rev = finalAttrs.version;
-    hash = "sha256-9XZWkBDqkaBbIHq3wIbo4neToPM+NCxi9c1AyVqmnvc=";
+    tag = finalAttrs.version;
+    hash = "sha256-s152v9sIuQLvhfPsZvQa+O9UhoASgm/e8dnz0t4pP3A=";
  };

  nativeBuildInputs = [
    nodejs
    pnpmConfigHook
-    pnpm_9
+    pnpm_10
  ];

  pnpmDeps = fetchPnpmDeps {
    inherit (finalAttrs) pname version src;
-    pnpm = pnpm_9;
-    fetcherVersion = 3;
-    hash = "sha256-PPYyEsc0o5ufBexUdiX9EJLEsQZ0wX7saBzxJGsnseU=";
+    pnpm = pnpm_10;
+    fetcherVersion = 4;
+    hash = "sha256-Sxt4vtdlMdXxXqt22hfZJskj8mkB5t85IZ5BsbCoDF4=";
  };

  installPhase = ''
@ -60,9 +60,9 @@ stdenv.mkDerivation (finalAttrs: {
  meta = {
    description = "Parse CSS and add vendor prefixes to CSS rules using values from the Can I Use website";
    homepage = "https://github.com/postcss/autoprefixer";
-    changelog = "https://github.com/postcss/autoprefixer/releases/tag/${finalAttrs.version}";
+    changelog = "https://github.com/postcss/autoprefixer/releases/tag/${finalAttrs.src.tag}";
    license = lib.licenses.mit;
    mainProgram = "autoprefixer";
-    maintainers = [ ];
+    maintainers = [ lib.maintainers.skohtv ];
  };
 })
--- a/pkgs/by-name/az/azure-cli/extensions-manual.nix
+++ b/pkgs/by-name/az/azure-cli/extensions-manual.nix
@ -174,9 +174,9 @@

  confcom = mkAzExtension rec {
    pname = "confcom";
-    version = "2.0.1";
+    version = "2.1.0";
    url = "https://azcliprod.blob.core.windows.net/cli-extensions/confcom-${version}-py3-none-any.whl";
-    hash = "sha256-Nol3gbwgq76ijbmRyfV64kcArqeCk4/riBr4FxAeNtk=";
+    hash = "sha256-mcUYTxpjounvP2500nFgXF+WKERJdLuYXb6zt31v4NA=";
    description = "Microsoft Azure Command-Line Tools Confidential Container Security Policy Generator Extension";
    nativeBuildInputs = [ autoPatchelfHook ];
    buildInputs = [ openssl ];
--- a/pkgs/by-name/ba/bashunit/package.nix
+++ b/pkgs/by-name/ba/bashunit/package.nix
@ -17,13 +17,13 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "bashunit";
-  version = "0.36.0";
+  version = "0.39.1";

  src = fetchFromGitHub {
    owner = "TypedDevs";
    repo = "bashunit";
    tag = finalAttrs.version;
-    hash = "sha256-alhqJ7coRk5O4dYGx8m6u8/j7KMfr2m9Jeb5pn0wwiU=";
+    hash = "sha256-yMzi2SFEMSNNFztapWavMmbueWwVK0GWjyFR3cJZmTg=";
    forceFetchGit = true; # needed to include the tests directory for the check phase
  };

--- a/pkgs/by-name/bc/bcachefs-tools/package.nix
+++ b/pkgs/by-name/bc/bcachefs-tools/package.nix
@ -30,18 +30,18 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "bcachefs-tools";
-  version = "1.38.3";
+  version = "1.38.5";

  src = fetchFromGitHub {
    owner = "koverstreet";
    repo = "bcachefs-tools";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-DR/aGCfqXUOubVEVmeJYOiF71rMYRYq8k23EXqluh5k=";
+    hash = "sha256-EXd+BOTAFUddK/4Vwi7GqRqndi2x4bb5gs7IIkMX6HU=";
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
    inherit (finalAttrs) src;
-    hash = "sha256-aiLSgpK3wadrBvclrQrdCzCiSjLcxg58oeP6ijL+JbY=";
+    hash = "sha256-6uwvwOVPYtegXTPwz2SEeQPC6OrKoFWZrH4Nx+ZVa5A=";
  };

  postPatch = ''
--- a/pkgs/by-name/be/betula/package.nix
+++ b/pkgs/by-name/be/betula/package.nix
@ -5,13 +5,13 @@
 }:
 buildGoModule (finalAttrs: {
  pname = "betula";
-  version = "1.7.0";
+  version = "1.8.0";

  src = fetchFromSourcehut {
    owner = "~bouncepaw";
    repo = "betula";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-8iDWWAL8JDZyKl3o0IJsWml410jh3cTPC2AoonvqiTI=";
+    hash = "sha256-cZ7xMtJ6I1lvWllwdNSFzeUsvGXWJnUtUR4iPn3oosc=";
  };
  vendorHash = "sha256-HGjaS2Sqsjk/pilt8wtx5Ect8Y8S5638PWEpXCqeZ6w=";

--- a/pkgs/by-name/bo/bombsquad/package.nix
+++ b/pkgs/by-name/bo/bombsquad/package.nix
@ -25,7 +25,7 @@ let
    {
      x86_64-linux = {
        name = "BombSquad_Linux_x86_64";
-        hash = "sha256-Su7xEVzgFBl+Q2iFWdIRbyO8lRs8Xd4KabFhycZUVjs=";
+        hash = "sha256-zKZpRsyBCTYDJbTwjaP/HFXfYvD9zBhetUGzriB9754=";
      };
      aarch64-linux = {
        name = "BombSquad_Linux_Arm64";
@ -45,7 +45,7 @@ stdenv.mkDerivation (finalAttrs: {
  # Note: This version trails behind the latest version by one since the latest
  # version sometimes gets replaced for minor updates. The builds in /old/ are
  # stable.
-  version = "1.7.62";
+  version = "1.7.63";

  src = fetchurl {
    url = "https://files.ballistica.net/bombsquad/builds/old/${archive.name}_${finalAttrs.version}.tar.gz";
--- a/pkgs/by-name/bo/boost-build/package.nix
+++ b/pkgs/by-name/bo/boost-build/package.nix
@ -78,6 +78,6 @@ stdenv.mkDerivation {
    homepage = "https://www.boost.org/build/";
    license = lib.licenses.boost;
    platforms = lib.platforms.unix;
-    maintainers = with lib.maintainers; [ ivan-tkatchev ];
+    maintainers = [ ];
  };
 }
--- a/pkgs/by-name/bu/buildbox/package.nix
+++ b/pkgs/by-name/bu/buildbox/package.nix
@ -23,13 +23,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "buildbox";
-  version = "1.4.7";
+  version = "1.4.8";

  src = fetchFromGitLab {
    owner = "BuildGrid";
    repo = "buildbox/buildbox";
    tag = finalAttrs.version;
-    hash = "sha256-+OK9rmAGGLq/rJIHs++dbdyvh6WFu+Xhcp48TpnYV0w=";
+    hash = "sha256-P7CFgK5CkHAf5gddmm0SBGIkC/AAdCO5pkya/XNuby0=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/ca/cargo-rdme/package.nix
+++ b/pkgs/by-name/ca/cargo-rdme/package.nix
@ -6,14 +6,14 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cargo-rdme";
-  version = "1.5.0";
+  version = "1.5.1";

  src = fetchCrate {
    inherit (finalAttrs) pname version;
-    hash = "sha256-TmV6Fc5vlc4fm9w4+iuxmnonwsEbqoJ3jvpIyQOuxjg=";
+    hash = "sha256-d3WughXxh9cBzy33s3iB75paldZFokGGI1L9yTLGYoc=";
  };

-  cargoHash = "sha256-EjIvKf1XgHubvyWPOAjysNH4nD0xqOWYg1FeiPSYh4c=";
+  cargoHash = "sha256-26Poh5lUCYi+a+/E7pOYwilKX+eqRmbRNYRFdVfRSCw=";

  meta = {
    description = "Cargo command to create the README.md from your crate's documentation";
--- a/pkgs/by-name/cl/claude-code/manifest.json
+++ b/pkgs/by-name/cl/claude-code/manifest.json
@ -1,47 +1,47 @@
 {
-  "version": "2.1.172",
-  "commit": "1b719ca2781a2dccc4a769b66bc35b4a60509ad7",
-  "buildDate": "2026-06-10T16:38:17Z",
+  "version": "2.1.175",
+  "commit": "0b9163019454512fd2b2ed8e6bef5470f9259f35",
+  "buildDate": "2026-06-12T01:33:39Z",
  "platforms": {
    "darwin-arm64": {
      "binary": "claude",
-      "checksum": "3c31f345575bf6f261c7e19981f6491bb93eeb0ffb499e95033610a7184831ce",
-      "size": 223390752
+      "checksum": "6b75bf132c866ed409bf913c318ca32011e73ffb12d3cd67ecc37bc4ee9ec65d",
+      "size": 224216352
    },
    "darwin-x64": {
      "binary": "claude",
-      "checksum": "c507f98750c5230e4247f7eadff38e4db04c006904f85379e31c5d5e82e1c384",
-      "size": 225892528
+      "checksum": "3770f2cb42d3f776e62a59aa16230843dc7b8422b36be9b1532e02a6e92e7fa8",
+      "size": 226734640
    },
    "linux-arm64": {
      "binary": "claude",
-      "checksum": "4ef0d735bd4180c3bffc381f6dc38df979229a8637d294be751c6043d93d12e1",
-      "size": 248624776
+      "checksum": "360f1f6f43ec26d9bb6e20e487bf44b753d9b8407e89e74bfeeb79707399f435",
+      "size": 249476744
    },
    "linux-x64": {
      "binary": "claude",
-      "checksum": "c0915dd1691d569aeebc7978b12e029718323685ec0dd4b5c6a453108d6be1f7",
-      "size": 248743632
+      "checksum": "4fc72fa6090c9a03f1850e1b1ccb3d6806bf802b67e3cb9dc5f2ced4b7ed5ca1",
+      "size": 249566928
    },
    "linux-arm64-musl": {
      "binary": "claude",
-      "checksum": "6b10aad4270348175206bd2475f82ef3c56007dfb55d7b90f1950dfa8fb9eb40",
-      "size": 241479512
+      "checksum": "27234d99851b2e343184466924d8f5c9318d1cfc4156fc4198c99e26c8a8ab86",
+      "size": 242331480
    },
    "linux-x64-musl": {
      "binary": "claude",
-      "checksum": "58f2c60711f95e51d86d1af5b915cbdd0458710f1830b7c26d59b78f1ad1f861",
-      "size": 243153968
+      "checksum": "f40f977d2555f349e4d94f6efdc7deece3596c2cffa9d1a6a66b14ee30cfca54",
+      "size": 243977264
    },
    "win32-x64": {
      "binary": "claude.exe",
-      "checksum": "07132ca4bbef551c92c1ae6ca0220a5e523092c9fa9cf402f65f428450687455",
-      "size": 244181152
+      "checksum": "c1b5b0ae1b607c1f8623d222c9eb6005a35dd6873aa834910a6fb3e00450e096",
+      "size": 244979872
    },
    "win32-arm64": {
      "binary": "claude.exe",
-      "checksum": "1e3e165c03de2af83c1e3516b73890b56e9785a2382338adcc28f41918bf4d2f",
-      "size": 240146080
+      "checksum": "f01eea49c920e990a7c3d2c1071abbc7e79ab54a099380982c11a6f462ca7c4a",
+      "size": 240943776
    }
  }
 }
--- a/pkgs/by-name/cl/claude-code/package.nix
+++ b/pkgs/by-name/cl/claude-code/package.nix
@ -92,7 +92,7 @@ stdenv.mkDerivation (finalAttrs: {
    description = "Agentic coding tool that lives in your terminal, understands your codebase, and helps you code faster";
    homepage = "https://github.com/anthropics/claude-code";
    downloadPage = "https://claude.com/product/claude-code";
-    changelog = "https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md";
+    changelog = "https://github.com/anthropics/claude-code/blob/v${finalAttrs.version}/CHANGELOG.md";
    license = lib.licenses.unfree;
    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
    platforms = [
--- a/pkgs/by-name/co/cosmic-applets/package.nix
+++ b/pkgs/by-name/co/cosmic-applets/package.nix
@ -20,17 +20,17 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cosmic-applets";
-  version = "1.0.13";
+  version = "1.0.16";

  # nixpkgs-update: no auto update
  src = fetchFromGitHub {
    owner = "pop-os";
    repo = "cosmic-applets";
    tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-JeV29myWGiLagaFOGAtK1MAIJVxYINe5TuNiArfBq54=";
+    hash = "sha256-o+rEO+IA337fhpq6TsH+UZEN7kb/PqydlKo77NyCRcM=";
  };

-  cargoHash = "sha256-gA+dpodk6u8dv9VaKNi/xzI8ys39iztQdia+eGkzXs4=";
+  cargoHash = "sha256-tbGuyqdDTsKYpKxeAuachwbPHTPhmb9Sg3qzxHYosjo=";

  separateDebugInfo = true;
  __structuredAttrs = true;
--- a/pkgs/by-name/co/cosmic-applibrary/package.nix
+++ b/pkgs/by-name/co/cosmic-applibrary/package.nix
@ -11,17 +11,17 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cosmic-applibrary";
-  version = "1.0.13";
+  version = "1.0.16";

  # nixpkgs-update: no auto update
  src = fetchFromGitHub {
    owner = "pop-os";
    repo = "cosmic-applibrary";
    tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-IgRKdhs07FK8G4yRb+0d8JFKZv3Zkq/tp2pC4epkxaM=";
+    hash = "sha256-mzHSLZK6HienbPRPetSj+XbPWCnpihEvMx9W9lJWpbA=";
  };

-  cargoHash = "sha256-uR0wm2+zmcec3esfYwgq4pRqSHkZnd3O8XhgnANf/1Q=";
+  cargoHash = "sha256-qGx/3w78mgIMqRo1wJA+ULFHWdNW2LKe2Sej4f9KbVs=";

  separateDebugInfo = true;
  __structuredAttrs = true;
--- a/pkgs/by-name/co/cosmic-bg/package.nix
+++ b/pkgs/by-name/co/cosmic-bg/package.nix
@ -13,7 +13,7 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cosmic-bg";
-  version = "1.0.13";
+  version = "1.0.16";

  # nixpkgs-update: no auto update
  src = fetchFromGitHub {
--- a/pkgs/by-name/co/cosmic-comp/package.nix
+++ b/pkgs/by-name/co/cosmic-comp/package.nix
@ -20,17 +20,17 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cosmic-comp";
-  version = "1.0.13";
+  version = "1.0.16";

  # nixpkgs-update: no auto update
  src = fetchFromGitHub {
    owner = "pop-os";
    repo = "cosmic-comp";
    tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-sjWNWpwq3fWA7HQV6faP1VTFGfs/e0G0UgHuKk44Kak=";
+    hash = "sha256-3WPZk/o+cfq3wwKEuYejMh+pn2o823m98OO3crFaNX4=";
  };

-  cargoHash = "sha256-G2/nVy9I4iGZiG3+uVMnnqj82Wg2s5/SmNyQERqDhXY=";
+  cargoHash = "sha256-ki+unf58rXBCpj5PCpBcg/6FWo16+MdPQWae+w1YkJ8=";

  separateDebugInfo = true;

--- a/pkgs/by-name/co/cosmic-edit/package.nix
+++ b/pkgs/by-name/co/cosmic-edit/package.nix
@ -16,17 +16,17 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cosmic-edit";
-  version = "1.0.13";
+  version = "1.0.16";

  # nixpkgs-update: no auto update
  src = fetchFromGitHub {
    owner = "pop-os";
    repo = "cosmic-edit";
    tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-KqdAz5CG9Gdsw/yWHCDhLwXNvmcASyzA6jdpbfcy3pM=";
+    hash = "sha256-almnWrJSV5xZoBDEuk0pfMZ/c00e0xpDNTTbcq+NCYM=";
  };

-  cargoHash = "sha256-y7EpJrVq5dVP/t3UTsZrPbiHWGsFieLPo/DH0eM5OQE=";
+  cargoHash = "sha256-/qcpAR2nvC/MYa5QuCLiZFQgos5SlYtspZsNuMLJFHk=";

  separateDebugInfo = true;

--- a/pkgs/by-name/co/cosmic-ext-applet-sysinfo/package.nix
+++ b/pkgs/by-name/co/cosmic-ext-applet-sysinfo/package.nix
@ -9,16 +9,16 @@
 }:
 rustPlatform.buildRustPackage {
  pname = "cosmic-ext-applet-sysinfo";
-  version = "0-unstable-2026-05-29";
+  version = "0-unstable-2026-06-05";

  src = fetchFromGitHub {
    owner = "cosmic-utils";
    repo = "cosmic-ext-applet-sysinfo";
-    rev = "1dbaad78d7d06f0b2abaee92996c87adc65c6ba3";
-    hash = "sha256-rOgc5IHsCqUAepfbmsuGL8iJKiH4dkGHT65nXUlXxxI=";
+    rev = "681dfcf86009a84ae76573726d227f949930225b";
+    hash = "sha256-HZZxyAzAwEgGWjPUU6MUhO/yShx423FTpvpImhdjGpk=";
  };

-  cargoHash = "sha256-5+QtuxyKOIbzE5piVqeOk6woSm6BGhxFyVJ3xywyeJ0=";
+  cargoHash = "sha256-KVnvyiF2rXb9gio3o+dE9w/zZ5gcad1uEbWHMBC3yDc=";

  nativeBuildInputs = [
    libcosmicAppHook
--- a/pkgs/by-name/co/cosmic-ext-applet-weather/package.nix
+++ b/pkgs/by-name/co/cosmic-ext-applet-weather/package.nix
@ -9,13 +9,13 @@
 }:
 rustPlatform.buildRustPackage {
  pname = "cosmic-ext-applet-weather";
-  version = "0-unstable-2026-05-29";
+  version = "0-unstable-2026-06-05";

  src = fetchFromGitHub {
    owner = "cosmic-utils";
    repo = "cosmic-ext-applet-weather";
-    rev = "a93d0703a1b5129ceabc73292c91d6966b03f0b8";
-    hash = "sha256-qeiZD5HgzNxCn2AdNYAW8G0lvjADppm9JctShVHgJko=";
+    rev = "4571eeee76755cc202f11007c4641196ad8a2793";
+    hash = "sha256-D/uCIJL79AWRIabps8I82wc0yP9CrOimx0g9dEthd08=";
  };

  cargoHash = "sha256-AHz4gQGGbVMmr/bbUdkfNQq3zx88+kPenq6kDz8IxN8=";
--- a/pkgs/by-name/co/cosmic-files/package.nix
+++ b/pkgs/by-name/co/cosmic-files/package.nix
@ -12,17 +12,17 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cosmic-files";
-  version = "1.0.13";
+  version = "1.0.16";

  # nixpkgs-update: no auto update
  src = fetchFromGitHub {
    owner = "pop-os";
    repo = "cosmic-files";
    tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-/5PPDs2rDEGOMShclh+ZnX28zuF3MbQ7W+Rze1xIPu4=";
+    hash = "sha256-2vrk1hYL7E/vVWiLcOYY3O0cmYZyFG4bdkNDFuyA+cA=";
  };

-  cargoHash = "sha256-1sY/V+/hd4vzjiufdLR8BIG5FC0F2sLbe8M2VqbinEU=";
+  cargoHash = "sha256-QPFGsn1J0lp5K4gLdar/Z5MmZg+VOoCZd1U8LUuLXqM=";

  separateDebugInfo = true;
  __structuredAttrs = true;
--- a/pkgs/by-name/co/cosmic-greeter/package.nix
+++ b/pkgs/by-name/co/cosmic-greeter/package.nix
@ -19,14 +19,14 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cosmic-greeter";
-  version = "1.0.13";
+  version = "1.0.16";

  # nixpkgs-update: no auto update
  src = fetchFromGitHub {
    owner = "pop-os";
    repo = "cosmic-greeter";
    tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-+bxBm/IlOW4XKZhJDlr7Bp5h3sGIdVbTz1If5XWXkek=";
+    hash = "sha256-+6VOv6z61k48hURq4yRRMIFIE8ZrjYGapO5FybWKQTE=";
  };

  cargoHash = "sha256-mfY2hsMxBooRjmTB2jgUIKyKHBpGfZ9Qslwv+2aEQyg=";
--- a/pkgs/by-name/co/cosmic-icons/package.nix
+++ b/pkgs/by-name/co/cosmic-icons/package.nix
@ -9,7 +9,7 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "cosmic-icons";
-  version = "1.0.13";
+  version = "1.0.16";

  # nixpkgs-update: no auto update
  src = fetchFromGitHub {
--- a/pkgs/by-name/co/cosmic-idle/package.nix
+++ b/pkgs/by-name/co/cosmic-idle/package.nix
@ -16,7 +16,7 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cosmic-idle";
-  version = "1.0.13";
+  version = "1.0.16";

  # nixpkgs-update: no auto update
  src = fetchFromGitHub {
--- a/pkgs/by-name/co/cosmic-initial-setup/package.nix
+++ b/pkgs/by-name/co/cosmic-initial-setup/package.nix
@ -14,14 +14,14 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cosmic-initial-setup";
-  version = "1.0.13";
+  version = "1.0.16";

  # nixpkgs-update: no auto update
  src = fetchFromGitHub {
    owner = "pop-os";
    repo = "cosmic-initial-setup";
    tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-kAxGSXQ4w9rrcrFwtSPp22kZ5Uw6WhZ442i82v3ALRw=";
+    hash = "sha256-3nGPBWYDqPJN99WtzsAVERucwiVAFynuUk2gezZ/RJU=";
  };

  cargoHash = "sha256-DESnl5NjakU4++Ep6CHxDZzHn+o0Gi0eREpXk5BN5iY=";
--- a/pkgs/by-name/co/cosmic-launcher/package.nix
+++ b/pkgs/by-name/co/cosmic-launcher/package.nix
@ -11,17 +11,17 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cosmic-launcher";
-  version = "1.0.13";
+  version = "1.0.16";

  # nixpkgs-update: no auto update
  src = fetchFromGitHub {
    owner = "pop-os";
    repo = "cosmic-launcher";
    tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-dJxa11PCXpyN4m+bulcVGpqi6tphcVqNn7H2CgMHzPc=";
+    hash = "sha256-ZivzjufT2UlPi/En1AjGS8TfeFNdJDfDUd9cb2Begb8=";
  };

-  cargoHash = "sha256-wZgxlq9MVCeESH093MaQybVMyq50L7aYwj//2r/B0QM=";
+  cargoHash = "sha256-WnZAPQR8hGGNC5S7hPmcGSMs9HrOw4/wqJR151eIgHY=";

  separateDebugInfo = true;
  __structuredAttrs = true;
--- a/pkgs/by-name/co/cosmic-notifications/package.nix
+++ b/pkgs/by-name/co/cosmic-notifications/package.nix
@ -12,7 +12,7 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cosmic-notifications";
-  version = "1.0.13";
+  version = "1.0.16";

  # nixpkgs-update: no auto update
  src = fetchFromGitHub {
--- a/pkgs/by-name/co/cosmic-osd/deduplicate-cosmic-settings-crate.patch
+++ b/pkgs/by-name/co/cosmic-osd/deduplicate-cosmic-settings-crate.patch
@ -0,0 +1,31 @@
+diff --git a/Cargo.lock b/Cargo.lock
+index 8b6704e..64c1691 100644
+--- a/Cargo.lock
+++ b/Cargo.lock
+@@ -1104,7 +1104,7 @@ dependencies = [
+ [[package]]
+ name = "cosmic-settings-airplane-mode-subscription"
+ version = "1.0.7"
+-source = "git+https://github.com/pop-os/cosmic-settings#78644a32e3741f8f80e9b8ce65c3550c85f9c1f8"
+source = "git+https://github.com/pop-os/cosmic-settings#81912bed6cdebe2719e29e6bd1453e7b977acb0e"
+ dependencies = [
+  "futures",
+  "iced_futures",
+@@ -1150,7 +1150,7 @@ dependencies = [
+ [[package]]
+ name = "cosmic-settings-pulse-subscription"
+ version = "0.1.0"
+-source = "git+https://github.com/pop-os/cosmic-settings#78644a32e3741f8f80e9b8ce65c3550c85f9c1f8"
+source = "git+https://github.com/pop-os/cosmic-settings#81912bed6cdebe2719e29e6bd1453e7b977acb0e"
+ dependencies = [
+  "futures",
+  "iced_futures",
+@@ -1162,7 +1162,7 @@ dependencies = [
+ [[package]]
+ name = "cosmic-settings-upower-subscription"
+ version = "1.0.7"
+-source = "git+https://github.com/pop-os/cosmic-settings#78644a32e3741f8f80e9b8ce65c3550c85f9c1f8"
+source = "git+https://github.com/pop-os/cosmic-settings#81912bed6cdebe2719e29e6bd1453e7b977acb0e"
+ dependencies = [
+  "futures",
+  "iced_futures",
--- a/pkgs/by-name/co/cosmic-osd/package.nix
+++ b/pkgs/by-name/co/cosmic-osd/package.nix
@ -15,17 +15,24 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cosmic-osd";
-  version = "1.0.13";
+  version = "1.0.16";

  # nixpkgs-update: no auto update
  src = fetchFromGitHub {
    owner = "pop-os";
    repo = "cosmic-osd";
    tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-zQL4kr7QpGKHD8Jwqv5h/U+QrCiHW5MEYTz+2/Oo1zY=";
+    hash = "sha256-jv28hxhQUcUDLnOwU3xQJwCU+s52pwDNs8Gf4I5Hp9k=";
  };

-  cargoHash = "sha256-1YRWWI2qhCI0GrxBAAkGT/AbtkTHgdbYsG8obriZ+zg=";
+  cargoHash = "sha256-YwZXlhggrUddxour+/S1mSL3Fq1mzvFaOHArLSnfPvc=";
+
+  cargoPatches = [
+    # A different reference to the `cargo-settings` crate was added in:
+    # <https://github.com/pop-os/cosmic-osd/pull/204>
+    # Remove this patch once upstream fixes their lockfile.
+    ./deduplicate-cosmic-settings-crate.patch
+  ];

  separateDebugInfo = true;
  __structuredAttrs = true;
--- a/pkgs/by-name/co/cosmic-panel/package.nix
+++ b/pkgs/by-name/co/cosmic-panel/package.nix
@ -11,17 +11,17 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cosmic-panel";
-  version = "1.0.13";
+  version = "1.0.16";

  # nixpkgs-update: no auto update
  src = fetchFromGitHub {
    owner = "pop-os";
    repo = "cosmic-panel";
    tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-1yry1cA/friBzyE6LH3G6rd8ZzBPt5aTGWVzATO839Y=";
+    hash = "sha256-MNOS7HMlyvU4zCZVINthgZgBsUn+LI1hUAEcwSq+zaE=";
  };

-  cargoHash = "sha256-vU++jreNHCRjxyyoj53LB2Sa7cdVUWGAvECcqoDofF8=";
+  cargoHash = "sha256-6E+bAi1f6gOZh64wyvLMKZiZNlMexPV+ZzS3riOx9xM=";

  separateDebugInfo = true;
  __structuredAttrs = true;
--- a/pkgs/by-name/co/cosmic-player/package.nix
+++ b/pkgs/by-name/co/cosmic-player/package.nix
@ -18,17 +18,17 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cosmic-player";
-  version = "1.0.13";
+  version = "1.0.16";

  # nixpkgs-update: no auto update
  src = fetchFromGitHub {
    owner = "pop-os";
    repo = "cosmic-player";
    tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-UBZArnQqCtEHJAzfHKSdJaSmyuaAokqqIDad5vXYIZo=";
+    hash = "sha256-iDEyR+P+iXShH0YFtqxvPbbs9kgtYvAsuKchB6plnKI=";
  };

-  cargoHash = "sha256-g/czcqTn6SPPkpM5jk4RCUGCd5o99gnMjddU0fhsYVI=";
+  cargoHash = "sha256-YzT16Ej+AyLLj8uHuHxZvHWujcW8jLjVg/4MmPyorH4=";

  separateDebugInfo = true;
  __structuredAttrs = true;
--- a/pkgs/by-name/co/cosmic-randr/package.nix
+++ b/pkgs/by-name/co/cosmic-randr/package.nix
@ -12,7 +12,7 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cosmic-randr";
-  version = "1.0.13";
+  version = "1.0.16";

  # nixpkgs-update: no auto update
  src = fetchFromGitHub {
--- a/pkgs/by-name/co/cosmic-reader/package.nix
+++ b/pkgs/by-name/co/cosmic-reader/package.nix
@ -19,16 +19,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cosmic-reader";
-  version = "0-unstable-2026-05-20";
+  version = "0-unstable-2026-06-06";

  src = fetchFromGitHub {
    owner = "pop-os";
    repo = "cosmic-reader";
-    rev = "c29b3e82c0827133b24dcdb43e1f28a1c7df37a1";
-    hash = "sha256-YsRXWSf2l8RfIEXKxvJtYWxhma8N2Y+0/HZwhs7d5k8=";
+    rev = "31485419db10e12c2942029d673836343e4609dd";
+    hash = "sha256-XZ5A7Qi+sxlUel1Fpr9wy8o0MD9mtyqFIwBN4Rf7CcU=";
  };

-  cargoHash = "sha256-P9ZC7721MjC/h7sbf7x91WGfMbT4tA46HrYhDgCeiWE=";
+  cargoHash = "sha256-DPGpGWzAgdpHp3qzksLtLnfqk+DJsaukdT2ekFFiGaM=";

  separateDebugInfo = true;
  __structuredAttrs = true;
--- a/pkgs/by-name/co/cosmic-screenshot/package.nix
+++ b/pkgs/by-name/co/cosmic-screenshot/package.nix
@ -11,14 +11,14 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cosmic-screenshot";
-  version = "1.0.13";
+  version = "1.0.16";

  # nixpkgs-update: no auto update
  src = fetchFromGitHub {
    owner = "pop-os";
    repo = "cosmic-screenshot";
    tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-0vJ2vnmM9IiP7llil8BQN/YU/fmlLIOoJTQpp8o/OrA=";
+    hash = "sha256-DngKZDKfgVdSZLZAsPq+7p4r/go2Y6141LrCNGoxD1E=";
  };

  cargoHash = "sha256-q0RJST1yeqPBjU5MseNZIrZw+brfDtQLKiw7wyViflE=";
--- a/pkgs/by-name/co/cosmic-session/package.nix
+++ b/pkgs/by-name/co/cosmic-session/package.nix
@ -12,7 +12,7 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cosmic-session";
-  version = "1.0.13";
+  version = "1.0.16";

  # nixpkgs-update: no auto update
  src = fetchFromGitHub {
--- a/pkgs/by-name/co/cosmic-settings-daemon/package.nix
+++ b/pkgs/by-name/co/cosmic-settings-daemon/package.nix
@ -16,14 +16,14 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cosmic-settings-daemon";
-  version = "1.0.13";
+  version = "1.0.16";

  # nixpkgs-update: no auto update
  src = fetchFromGitHub {
    owner = "pop-os";
    repo = "cosmic-settings-daemon";
    tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-CKJcVYLuLJNqvmgDM+ugVojgzmG7WAVEAGmEkUyTs3c=";
+    hash = "sha256-A+nOAadFWU+KRW54dP2WW6P6fabIs4z1AqC37LSZjUI=";
  };

  postPatch = ''
@ -33,7 +33,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
      --replace-fail '/usr/share/themes/adw-gtk3' '${adw-gtk3}/share/themes/adw-gtk3'
  '';

-  cargoHash = "sha256-pvoCqFvMVqNTfdU5WidGijfFNsC9i2XNuNV33F8aKZw=";
+  cargoHash = "sha256-bz+JasI3WE30sKKgjofVO/42Ml4YY9Dw3JxnZmZVQk4=";

  separateDebugInfo = true;
  __structuredAttrs = true;
--- a/pkgs/by-name/co/cosmic-settings/package.nix
+++ b/pkgs/by-name/co/cosmic-settings/package.nix
@ -27,17 +27,17 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cosmic-settings";
-  version = "1.0.13";
+  version = "1.0.16";

  # nixpkgs-update: no auto update
  src = fetchFromGitHub {
    owner = "pop-os";
    repo = "cosmic-settings";
    tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-idENXrYf92iVuw2Gb+8725nXfSNKoFMraDRaC+KcE0o=";
+    hash = "sha256-knA3qpFeRRlUMV91+LleaWxb1fexX2IJlMRD81fl7l4=";
  };

-  cargoHash = "sha256-O6d47H+vcSn9G6EIMpSshfL+cBJWZMYXHHKsu2n/huk=";
+  cargoHash = "sha256-2ZHuOmtBzXQ/KSBMKus9LbojfByYzzCjIkbGY8C85bU=";

  separateDebugInfo = true;
  __structuredAttrs = true;
--- a/pkgs/by-name/co/cosmic-store/package.nix
+++ b/pkgs/by-name/co/cosmic-store/package.nix
@ -15,17 +15,17 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cosmic-store";
-  version = "1.0.13";
+  version = "1.0.16";

  # nixpkgs-update: no auto update
  src = fetchFromGitHub {
    owner = "pop-os";
    repo = "cosmic-store";
    tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-4jD9Rv4K0xaqNvepbWIJ7BP3XzMErda4wcafJkSilJ0=";
+    hash = "sha256-JE8LcFlhG4e3QqobzUNfCw3Eg10+FrlVuQu+J+96/es=";
  };

-  cargoHash = "sha256-uK9qXc6A1b1J/KOocUee2oVnVkubX0S7qtEwKcPwulI=";
+  cargoHash = "sha256-+lOt+mSTKKsSm3UzGXq43ZjbktiCCV8dnHdvnnx2vqA=";

  separateDebugInfo = true;
  __structuredAttrs = true;
--- a/pkgs/by-name/co/cosmic-term/package.nix
+++ b/pkgs/by-name/co/cosmic-term/package.nix
@ -15,17 +15,17 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cosmic-term";
-  version = "1.0.13";
+  version = "1.0.16";

  # nixpkgs-update: no auto update
  src = fetchFromGitHub {
    owner = "pop-os";
    repo = "cosmic-term";
    tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-AG/yQg9LNmbB2K0SWAl2DEIcphdihEVhMBeIx3i76tk=";
+    hash = "sha256-nDTDGtaGRW0JM48/tbWO/NK1WhGkPwlsqfWrDGvFE9A=";
  };

-  cargoHash = "sha256-AYByonKIZWfNdaRIWijAv/8KUcO114hbZRH7Dx/MId8=";
+  cargoHash = "sha256-0W1TU1NIcV9fx/vgKpPLqLO1fcdtbZX5Ds1uQWGJ2C8=";

  separateDebugInfo = true;
  __structuredAttrs = true;
--- a/pkgs/by-name/co/cosmic-wallpapers/package.nix
+++ b/pkgs/by-name/co/cosmic-wallpapers/package.nix
@ -7,7 +7,7 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "cosmic-wallpapers";
-  version = "1.0.13";
+  version = "1.0.16";

  # nixpkgs-update: no auto update
  src = fetchFromGitHub {
--- a/pkgs/by-name/co/cosmic-workspaces-epoch/package.nix
+++ b/pkgs/by-name/co/cosmic-workspaces-epoch/package.nix
@ -14,14 +14,14 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cosmic-workspaces-epoch";
-  version = "1.0.13";
+  version = "1.0.16";

  # nixpkgs-update: no auto update
  src = fetchFromGitHub {
    owner = "pop-os";
    repo = "cosmic-workspaces-epoch";
    tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-TdV/HeqUjaQcjAUDf5IP1GVwpc1gJEuOnu3Y0MlZoVs=";
+    hash = "sha256-u4p22qpxZPdBogzrJXGomqGGxgkpD0hdXf+3YNg2VIo=";
  };

  cargoHash = "sha256-Z5dC3W8QoDBZWBjHwRj9MC8EScDjQwUiUcOPTRDToDA=";
--- a/pkgs/by-name/cp/cproto/package.nix
+++ b/pkgs/by-name/cp/cproto/package.nix
@ -8,7 +8,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "cproto";
-  version = "4.7y";
+  version = "4.8";

  src = fetchurl {
    urls = [
@ -16,7 +16,7 @@ stdenv.mkDerivation (finalAttrs: {
      # No version listings and apparently no versioned tarball over http(s).
      "https://invisible-island.net/archives/cproto/cproto-${finalAttrs.version}.tgz"
    ];
-    sha256 = "sha256-C9HYvo/wpMpD+Uf5V1DTT2TtqTyeLKeRAP1gFAt8YzE=";
+    sha256 = "sha256-DMy5NEdoLH/bTwvb++BdUqgnMx4KGaUhXSw8uFrSklg=";
  };

  # patch made by Joe Khoobyar copied from gentoo bugs
--- a/pkgs/by-name/cr/crawley/package.nix
+++ b/pkgs/by-name/cr/crawley/package.nix
@ -7,18 +7,18 @@

 buildGoModule (finalAttrs: {
  pname = "crawley";
-  version = "1.7.19";
+  version = "1.7.20";

  src = fetchFromGitHub {
    owner = "s0rg";
    repo = "crawley";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-d854JL2/ZhEKQUG8tJ7TctDaicWnAKEFl0mJF6MIvls=";
+    hash = "sha256-paKlo/awxxji1TzCC4jEJT2r2svS6AiI6GiwOiBs4Ps=";
  };

  nativeBuildInputs = [ installShellFiles ];

-  vendorHash = "sha256-lptFxIt5b7d6hIXdAqakA1K78NGJ86u0p/XfbQMiTsc=";
+  vendorHash = "sha256-jqJtWLwLO0UsDa6Al2Jb0fc3nwSWMMNc/ikxtMOPpCE=";

  ldflags = [
    "-w"
--- a/pkgs/by-name/cs/csharp-ls/package.nix
+++ b/pkgs/by-name/cs/csharp-ls/package.nix
@ -11,9 +11,9 @@ in

 buildDotnetGlobalTool (finalAttrs: {
  pname = "csharp-ls";
-  version = "0.24.0";
+  version = "0.25.0";

-  nugetHash = "sha256-hpLTqgxwXiycfTaSd3nliS1quNB3VHLpSDBo+V18a9A=";
+  nugetHash = "sha256-w+zbCCR7ns8a5TqAOlwi5nE3AKWF9xhWG2jLmKbpzeI=";

  inherit dotnet-sdk;
  dotnet-runtime = dotnet-sdk;
--- a/pkgs/by-name/cu/cura-appimage/package.nix
+++ b/pkgs/by-name/cu/cura-appimage/package.nix
@ -13,7 +13,7 @@

 stdenvNoCC.mkDerivation rec {
  pname = "cura-appimage";
-  version = "5.12.1";
+  version = "5.13.0";

  # Give some good names so the intermediate packages are easy
  # to recognise by name in the Nix store.
@ -22,7 +22,7 @@ stdenvNoCC.mkDerivation rec {

  src = fetchurl {
    url = "https://github.com/Ultimaker/Cura/releases/download/${version}/Ultimaker-Cura-${version}-linux-X64.AppImage";
-    hash = "sha256-GBQvMZRaOqbOmBOOaIfduWKkwHbyZosr6AaFMty0Jfo=";
+    hash = "sha256-EA8GgSeyWYFn8Auk2w4Gmd7UWt+Xu6stIv8XGh4ezEA=";
  };

  appimageContents = appimageTools.extract {
--- a/pkgs/by-name/da/daktari/package.nix
+++ b/pkgs/by-name/da/daktari/package.nix
@ -7,7 +7,7 @@

 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "daktari";
-  version = "0.0.328";
+  version = "0.0.334";
  pyproject = true;
  __structuredAttrs = true;

@ -15,7 +15,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
    owner = "genio-learn";
    repo = "daktari";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-WTxZTfW4KVACxR3wS9+nDV/pYlCrCu8TBQRVulxqiRo=";
+    hash = "sha256-UmfR64zG7UHTCp1rh0LWoWNqPTaBqrT/eShggrmW2Yg=";
  };

  patches = [ ./optional-pyclip.patch ];
--- a/pkgs/by-name/de/deterministic-zip/package.nix
+++ b/pkgs/by-name/de/deterministic-zip/package.nix
@ -6,13 +6,13 @@
 }:
 buildGoModule (finalAttrs: {
  pname = "deterministic-zip";
-  version = "6.0.3";
+  version = "6.1.0";

  src = fetchFromGitHub {
    owner = "timo-reymann";
    repo = "deterministic-zip";
    tag = finalAttrs.version;
-    hash = "sha256-YQCJ2nAE9/wt+KiU2eXdGXVxFiHZzBMyNX+1sSPtxt4=";
+    hash = "sha256-zGIij65ziX/nB5wGj1plX0e8uj7EDHYFAAj2mPalibQ=";
  };

  vendorHash = "sha256-hEPZrS2D6YqlaaJXF8uyt+fJ38Adi3WvOq7v9dZuovI=";
--- a/pkgs/by-name/de/devin-cli/package.nix
+++ b/pkgs/by-name/de/devin-cli/package.nix
@ -32,8 +32,6 @@ let
      hash = "sha256-HtB5iCT3d3AprPM+1uNkPkX0v4wSerTJlEu5F4P6pp0=";
    };
  };
-
-  src = srcs.${stdenvNoCC.hostPlatform.system} or throwSystem;
 in

 stdenvNoCC.mkDerivation (finalAttrs: {
@ -49,18 +47,15 @@ stdenvNoCC.mkDerivation (finalAttrs: {
  strictDeps = true;
  __structuredAttrs = true;

-  inherit src;
+  src = srcs.${stdenvNoCC.hostPlatform.system} or throwSystem;

  sourceRoot = ".";

  nativeBuildInputs = [ installShellFiles ];

  dontConfigure = true;
-  dontStrip = true;
  dontBuild = true;

-  doCheck = true;
-
  installPhase = ''
    runHook preInstall

@ -83,7 +78,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    description = "Cognition's Devin Agent CLI";
    homepage = "https://devin.ai/cli";
    license = lib.licenses.unfree;
-    sourceProvenance = [ lib.sourceTypes.binaryBytecode ];
+    sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
    maintainers = with lib.maintainers; [
      ethancedwards8
      nhshah15
--- a/pkgs/by-name/de/dexter/package.nix
+++ b/pkgs/by-name/de/dexter/package.nix
@ -8,13 +8,13 @@

 buildGoModule (finalAttrs: {
  pname = "dexter";
-  version = "0.7.0";
+  version = "0.7.1";

  src = fetchFromGitHub {
    owner = "remoteoss";
    repo = "dexter";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-MQ8LxSI2amecFUiNK6vED/nJKHgs5sRT7rJVi6cLdkc=";
+    hash = "sha256-VrKLi92fCkAL6C5dvydXuwOCp3dYXsDJSGk9rkHv1t8=";
  };

  vendorHash = "sha256-1mJ4HdDCsZl/g8F+L+NrW2ACuiHe2aSheJO/1XfKAb4=";
--- a/pkgs/by-name/dn/dns-collector/package.nix
+++ b/pkgs/by-name/dn/dns-collector/package.nix
@ -8,13 +8,13 @@

 buildGoModule (finalAttrs: {
  pname = "dns-collector";
-  version = "2.2.3";
+  version = "2.3.0";

  src = fetchFromGitHub {
    owner = "dmachard";
    repo = "dns-collector";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-hqSfL3R0fp7uYBGoD1Wu0ZNLq1VnOvcN0n8zzfRXTfA=";
+    hash = "sha256-5SFdTDuXnVdMFGxoraUMbDV3o476sc9c7D9qWBoQXr4=";
  };

  subPackages = [ "." ];
@ -28,7 +28,7 @@ buildGoModule (finalAttrs: {
    "-X=github.com/prometheus/common/version.Version=${finalAttrs.version}"
  ];

-  vendorHash = "sha256-i1Ogo5zRYaEgiYMMTUjI2WiL2gABw2r31/WslXLzowI=";
+  vendorHash = "sha256-eoUsiRGtq1ucAIyeCRNEuro2Qj4iRe+3aE8DrqIcCWs=";

  passthru.updateScript = nix-update-script { };

@ -38,8 +38,8 @@ buildGoModule (finalAttrs: {
  versionCheckProgramArg = "-version";

  meta = {
-    changelog = "https://github.com/dmachart/dns-collector/releases/tag/v${finalAttrs.version}";
-    homepage = "https://github.com/dmachart/dns-collector";
+    changelog = "https://github.com/dmachard/dns-collector/releases/tag/v${finalAttrs.version}";
+    homepage = "https://github.com/dmachard/dns-collector";
    description = "Ingesting, pipelining, and enhancing your DNS logs with usage indicators, security analysis, and additional metadata";
    license = lib.licenses.mit;
    mainProgram = "go-dnscollector";
--- a/pkgs/by-name/do/dotenvx/package.nix
+++ b/pkgs/by-name/do/dotenvx/package.nix
@ -7,16 +7,16 @@

 buildNpmPackage (finalAttrs: {
  pname = "dotenvx";
-  version = "1.71.0";
+  version = "1.71.2";

  src = fetchFromGitHub {
    owner = "dotenvx";
    repo = "dotenvx";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-nnzjPyxqAu7r4rKkTEaQsHdORnVo6dqwG38ALjjmZMs=";
+    hash = "sha256-51mmOF03j+JpyE4fyoqmZdgHtAOPhdEQiUTTATPFujM=";
  };

-  npmDepsHash = "sha256-XMNpCgFVphdfdAWjclqjpGyhggbNm6A/RdIAy/Ga9po=";
+  npmDepsHash = "sha256-3+Dn4XE5BH3QfeHVILLP/3ZESmhbYuzfT6IAIOLCJkQ=";

  dontNpmBuild = true;

--- a/pkgs/by-name/el/electron-mail/package.nix
+++ b/pkgs/by-name/el/electron-mail/package.nix
@ -10,20 +10,20 @@

 let
  pname = "electron-mail";
-  version = "5.3.6";
+  version = "5.3.7";

  sources = {
    x86_64-linux = fetchurl {
      url = "https://github.com/vladimiry/ElectronMail/releases/download/v${version}/electron-mail-${version}-linux-x86_64.AppImage";
-      hash = "sha256-3BWrVMlSUMMmuj6EAmqVtlHGCcminuVHkyPnc3TvgpM=";
+      hash = "sha256-VJbCQ/4yIuBE4NPDFUbp8t2G/QjUclphH/MghvamDVo=";
    };
    aarch64-darwin = fetchurl {
      url = "https://github.com/vladimiry/ElectronMail/releases/download/v${version}/electron-mail-${version}-mac-arm64.dmg";
-      hash = "sha256-z7j5WrU1F+iX8UDLWS5sXLwHjobPKJZFKXTcHTOQ/Eo=";
+      hash = "sha256-ulB+dlp6ZBhcBJiLY4k+E/oEWy9XSIuIzd5rTzEq9+4=";
    };
    x86_64-darwin = fetchurl {
      url = "https://github.com/vladimiry/ElectronMail/releases/download/v${version}/electron-mail-${version}-mac-x64.dmg";
-      hash = "sha256-7i0p7mBkzViXGdUrHXTrDDGdIy81p2YIei5Qsk8G5GU=";
+      hash = "sha256-LbAqUj34m8qSq8sQ1xgCQj9+MfJHoFDRMq+/waMKtzM=";
    };
  };

--- a/pkgs/by-name/er/errbot/package.nix
+++ b/pkgs/by-name/er/errbot/package.nix
@ -6,7 +6,7 @@

 python3.pkgs.buildPythonApplication (finalAttrs: {
  pname = "errbot";
-  version = "6.2.0";
+  version = "6.2.1";

  pyproject = true;

@ -14,7 +14,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
    owner = "errbotio";
    repo = "errbot";
    rev = finalAttrs.version;
-    hash = "sha256-UdqzBrlcb9NkuVo8ChADJmaKevadoGLyZUrckStb5ko=";
+    hash = "sha256-ufJUcQUn+BbfnYRXqLlThis70sY5VLdsZlag6390wqs=";
  };

  build-system = with python3.pkgs; [
--- a/pkgs/by-name/ev/evtx/package.nix
+++ b/pkgs/by-name/ev/evtx/package.nix
@ -6,16 +6,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "evtx";
-  version = "0.11.2";
+  version = "0.12.1";

  src = fetchFromGitHub {
    owner = "omerbenamram";
    repo = "evtx";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-LVGw/u5xq+m96zSMPbQDpMnfMHq7FyQnzkmGMUMVgwM=";
+    hash = "sha256-zmXRUA2+x697AptONn5VUVySp4zz+VHwt8dqd6pJBGI=";
  };

-  cargoHash = "sha256-RnuWlfmzOZzOMfeKo8tv9I4elLQgpn9IbVa0EpYGnI0=";
+  cargoHash = "sha256-5Jw+zem0XLLvn3tELXk8vTnH2zvUr82qFx9QUYUwXyY=";

  postPatch = ''
    # CLI tests will fail in the sandbox
--- a/pkgs/by-name/fe/fex/package.nix
+++ b/pkgs/by-name/fe/fex/package.nix
@ -99,13 +99,13 @@ let
 in
 llvmPackages.stdenv.mkDerivation (finalAttrs: {
  pname = "fex";
-  version = "2604";
+  version = "2605";

  src = fetchFromGitHub {
    owner = "FEX-Emu";
    repo = "FEX";
    tag = "FEX-${finalAttrs.version}";
-    hash = "sha256-VPlw15vM3wowgba9Z95F/vRYJLaevtt8lJEgw4hYS8w=";
+    hash = "sha256-N4iiDa9DbET/8wzFmp9FoFQfm0ZmtUT76sipmi8LE/0=";

    leaveDotGit = true;
    postFetch = ''
@ -172,6 +172,7 @@ llvmPackages.stdenv.mkDerivation (finalAttrs: {

    # Temporarily disable failing tests. TODO: investigate the root cause of these failures
    rm \
+      unittests/ASM/FEX_bugs/SegmentAddressOverride.asm \
      unittests/ASM/Primary/Primary_63_2.asm \
      unittests/32Bit_ASM/Secondary/07_XX_04.asm \
      unittests/ASM/Secondary/07_XX_04.asm
--- a/pkgs/by-name/fi/filius/package.nix
+++ b/pkgs/by-name/fi/filius/package.nix
@ -10,16 +10,16 @@

 maven.buildMavenPackage rec {
  pname = "filius";
-  version = "2.11.0";
+  version = "2.12.1";

  src = fetchFromGitLab {
    owner = "filius1";
    repo = "filius";
    tag = "v${version}";
-    hash = "sha256-l90KnHfndGsEzgJpTNabW0ADJhTYr7z3243TZUJbxNw=";
+    hash = "sha256-sIcYjbWONg8Cq+dHpoBYj07cyHV7oX06Xh1zK0CHn64=";
  };

-  mvnHash = "sha256-R14EtImJJEC/DhKm7MKWzq9XEOqDGNPtLIaK3OKbyiQ=";
+  mvnHash = "sha256-/gA49V1Kjh4zJTzDCzFNwZF30ERwPk2lG6lw/jxM2Qo=";
  mvnParameters = "-Plinux";

  # tests want to create an X11 window which isn't often feasible
--- a/Show more
+++ b/Show more