Merge master into staging

2026-07-06 17:13:24 -05:00 · 2026-06-23 14:31:15 +02:00 · 2026-06-23 14:31:15 +02:00 · 0a85052339
commit 0a85052339
parent 91eba77467 1ddca366d0
94 changed files with 4075 additions and 491 deletions
--- a/doc/style.css
+++ b/doc/style.css
@ -34,7 +34,7 @@ body {
  }
 }

-.book .list-of-examples {
+.list-of-examples {
  display: none;
 }

@ -392,8 +392,7 @@ div.appendix .toc dt {
  margin-top: 0;
 }

-div.book .list-of-examples dt,
-div.appendix .list-of-examples dt {
+.list-of-examples dt {
  margin-top: 0;
 }

@ -450,6 +449,7 @@ div.appendix .variablelist .term {
 }

 :root {
+  --sidebar-width: 20rem;
  --background: #fff;
  --main-text-color: #000;
  --link-color: #405d99;
@ -496,3 +496,68 @@ div.appendix .variablelist .term {
 .chapter {
  content-visibility: auto;
 }
+
+.navheader {
+  position: sticky;
+  top: 0;
+  z-index: 1;
+  background-color: var(--background);
+}
+
+nav.toc-sidebar {
+  height: 100%;
+  overflow-y: none;
+  padding: 0 1rem 2rem;
+  border-bottom: 0.0625rem solid #d8d8d8;
+}
+
+nav.toc-sidebar .toc {
+  margin-bottom: 0;
+}
+
+nav.toc-sidebar .toc dl {
+  margin: 0;
+}
+
+nav.toc-sidebar .toc dd {
+  margin-left: 1em;
+}
+
+@media screen and (min-width: 768px) {
+  body {
+    height: 100vh;
+    min-height: 0;
+    display: grid;
+    grid-template-columns: minmax(0, 1fr);
+    grid-template-rows: auto minmax(0, 1fr);
+  }
+
+  body:has(> nav.toc-sidebar) {
+    grid-template-columns: var(--sidebar-width) minmax(0, 1fr);
+  }
+
+  .navheader {
+    grid-column: 1 / -1;
+    grid-row: 1;
+  }
+
+  nav.toc-sidebar {
+    grid-column: 1;
+    grid-row: 2;
+    max-height: none;
+    overflow-y: auto;
+    border-bottom: none;
+    border-right: 0.0625rem solid #d8d8d8;
+  }
+
+  main.content {
+    grid-column: 1 / -1;
+    grid-row: 2;
+    overflow-y: auto;
+    padding: 0 1rem;
+  }
+
+  body:has(> nav.toc-sidebar) main.content {
+    grid-column: 2;
+  }
+}
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -22355,6 +22355,12 @@
    githubId = 406946;
    name = "Valentin Lorentz";
  };
+  proitheus = {
+    email = "me@mail.proitheus.top";
+    github = "proitheus";
+    githubId = 50539150;
+    name = "proitheus";
+  };
  projectinitiative = {
    name = "ProjectInitiative";
    github = "ProjectInitiative";
--- a/nixos/doc/manual/release-notes/rl-2611.section.md
+++ b/nixos/doc/manual/release-notes/rl-2611.section.md
@ -58,6 +58,8 @@

 - `security.run0.enableSudoAlias` now uses the `run0-sudo-shim` instead of a shell-script to improve compatibility.

+- `security.run0.persistentAuth` options have been added to support persistent Authentication of session. Timeout configurable via `security.polkit.settings.Polkitd.ExpirationSeconds`.
+
 - `boot.loader.systemd-boot` gained support for [Automatic Boot Assessment](https://systemd.io/AUTOMATIC_BOOT_ASSESSMENT/) via the new [`boot.loader.systemd-boot.bootCounting`](#opt-boot.loader.systemd-boot.bootCounting.enable) options, allowing automatic detection of and recovery from bad NixOS generations. As part of this change, boot loader entries on the ESP/XBOOTLDR partition are now named `nixos-<content-hash>.conf` instead of `nixos-generation-<n>.conf`; existing entries are migrated automatically on the next `nixos-rebuild boot`/`switch`.

 - `security.polkit.settings` added for RFC42 style configuration of the polkitd daemon.
--- a/nixos/modules/security/run0.nix
+++ b/nixos/modules/security/run0.nix
@ -13,6 +13,7 @@ let
    mkOption
    mkPackageOption
    mkAliasOptionModule
+    optionalString
    ;

  cfg = config.security.run0;
@ -21,6 +22,12 @@ in
  options.security.run0 = {
    enable = mkEnableOption "support for run0";

+    persistentAuth.enable = mkEnableOption ''
+      persistent authentication for sessions.
+      Timeout configurable via {option}`security.polkit.settings.Polkitd.ExpirationSeconds`
+    '';
+    persistentAuth.enableRemote = mkEnableOption "persistent authentication for remote sessions";
+
    wheelNeedsPassword = mkOption {
      type = lib.types.bool;
      default = true;
@ -67,13 +74,24 @@ in

      security.polkit = {
        enable = true;
-        extraConfig = mkIf (!cfg.wheelNeedsPassword) ''
-          polkit.addRule(function(action, subject) {
-            if (action.id == "org.freedesktop.systemd1.manage-units" && subject.isInGroup("wheel")) {
-              return polkit.Result.YES;
-            }
-          });
-        '';
+        extraConfig = lib.concatLines [
+          (optionalString (!cfg.wheelNeedsPassword) ''
+            polkit.addRule(function(action, subject) {
+              if (action.id == "org.freedesktop.systemd1.manage-units" && subject.isInGroup("wheel")) {
+                return polkit.Result.YES;
+              }
+            });
+          '')
+          (optionalString cfg.persistentAuth.enable ''
+            polkit.addRule(function(action, subject) {
+              if (action.id == "org.freedesktop.systemd1.manage-units" && subject.active ${
+                optionalString (!cfg.persistentAuth.enableRemote) "&& subject.local"
+              }) {
+                return polkit.Result.AUTH_ADMIN_KEEP;
+              }
+            });
+          '')
+        ];
      };

      environment.systemPackages = lib.optional cfg.sudo-shim.enable cfg.sudo-shim.package;
--- a/nixos/modules/services/matrix/tuwunel.nix
+++ b/nixos/modules/services/matrix/tuwunel.nix
@ -62,6 +62,19 @@ in
      };
    };

+    environmentFile = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
+      default = null;
+      example = "/run/secrets/matrix-tuwunel.env";
+      description = ''
+        Path to a file containing sensitive environment variables as described in {manpage}`systemd.exec(5).
+
+        Refer to
+        <https://matrix-construct.github.io/tuwunel/configuration.html#environment-variables>
+        for specifying options as environment variables.
+      '';
+    };
+
    settings = lib.mkOption {
      type = lib.types.submodule {
        freeformType = format.type;
@ -255,6 +268,7 @@ in
        ExecStart = lib.getExe cfg.package;
        Restart = "on-failure";
        RestartSec = 10;
+        EnvironmentFile = lib.mkIf (cfg.environmentFile != null) cfg.environmentFile;
      };
    };
  };
--- a/nixos/modules/tasks/network-interfaces.nix
+++ b/nixos/modules/tasks/network-interfaces.nix
@ -1693,8 +1693,7 @@ in
      type = types.bool;
      description = ''
        Whether we should use networkd as the network configuration backend or
-        the legacy script based system. Note that this option is experimental,
-        enable at your own risk.
+        the legacy script based system.
      '';
    };

--- a/nixos/tests/php/fpm-modular.nix
+++ b/nixos/tests/php/fpm-modular.nix
@ -7,7 +7,7 @@
    aanderse
  ];

-  nodes.machine =
+  containers.machine =
    { config, pkgs, ... }:
    {
      environment.systemPackages = [ php ];
@ -56,14 +56,14 @@
      };
    };
  testScript =
-    { ... }:
+    # python
    ''
      machine.wait_for_unit("nginx.service")
      machine.wait_for_unit("php-fpm.service")

      # Check so we get an evaluated PHP back
-      response = machine.succeed("curl -fvvv -s http://127.0.0.1:80/")
-      assert "PHP Version ${php.version}" in response, "PHP version not detected"
+      response = machine.wait_until_succeeds("curl -fvvv -s http://127.0.0.1:80/")
+      t.assertIn("PHP Version ${php.version}", response, "PHP version not detected")

      # Check so we have database and some other extensions loaded
      for ext in ["json", "opcache", "pdo_mysql", "pdo_pgsql", "pdo_sqlite", "apcu"]:
--- a/nixos/tests/php/fpm.nix
+++ b/nixos/tests/php/fpm.nix
@ -3,7 +3,7 @@
  name = "php-${php.version}-fpm-nginx-test";
  meta.maintainers = lib.teams.php.members;

-  nodes.machine =
+  containers.machine =
    { config, pkgs, ... }:
    {
      environment.systemPackages = [ php ];
@ -47,14 +47,14 @@
      };
    };
  testScript =
-    { ... }:
+    # python
    ''
      machine.wait_for_unit("nginx.service")
      machine.wait_for_unit("phpfpm-foobar.service")

      # Check so we get an evaluated PHP back
-      response = machine.succeed("curl -fvvv -s http://127.0.0.1:80/")
-      assert "PHP Version ${php.version}" in response, "PHP version not detected"
+      response = machine.wait_until_succeeds("curl -fvvv -s http://127.0.0.1:80/")
+      t.assertIn("PHP Version ${php.version}", response, "PHP version not detected")

      # Check so we have database and some other extensions loaded
      for ext in ["json", "opcache", "pdo_mysql", "pdo_pgsql", "pdo_sqlite", "apcu"]:
--- a/nixos/tests/php/httpd.nix
+++ b/nixos/tests/php/httpd.nix
@ -7,7 +7,7 @@
  name = "php-${php.version}-httpd-test";
  meta.maintainers = lib.teams.php.members;

-  nodes.machine =
+  containers.machine =
    {
      config,
      pkgs,
@ -32,13 +32,13 @@
      };
    };
  testScript =
-    { ... }:
+    # python
    ''
      machine.wait_for_unit("httpd.service")

      # Check so we get an evaluated PHP back
-      response = machine.succeed("curl -fvvv -s http://127.0.0.1:80/")
-      assert "PHP Version ${php.version}" in response, "PHP version not detected"
+      response = machine.wait_until_succeeds("curl -fvvv -s http://127.0.0.1:80/")
+      t.assertIn("PHP Version ${php.version}", response, "PHP version not detected")

      # Check so we have database and some other extensions loaded
      for ext in ["json", "opcache", "pdo_mysql", "pdo_pgsql", "pdo_sqlite"]:
--- a/nixos/tests/php/pcre.nix
+++ b/nixos/tests/php/pcre.nix
@ -11,7 +11,7 @@ in
  name = "php-${php.version}-httpd-pcre-jit-test";
  meta.maintainers = lib.teams.php.members;

-  nodes.machine =
+  containers.machine =
    { pkgs, ... }:
    {
      time.timeZone = "UTC";
@ -50,12 +50,13 @@ in
        pcntl_wait($pid);
      '';
    in
+    # python
    ''
      machine.wait_for_unit("httpd.service")
      # Ensure php evaluation by matching on the var_dump syntax
-      response = machine.succeed("curl -fvvv -s http://127.0.0.1:80/index.php")
+      response = machine.wait_until_succeeds("curl -fvvv -s http://127.0.0.1:80/index.php")
      expected = 'string(${toString (builtins.stringLength testString)}) "${testString}"'
-      assert expected in response, "Does not appear to be able to use subgroups."
-      machine.succeed("${php}/bin/php -f ${pcreJitSeallocForkIssue}")
+      t.assertIn(expected, response, "Does not appear to be able to use subgroups.")
+      machine.succeed("${lib.getExe php} -f ${pcreJitSeallocForkIssue}")
    '';
 }
--- a/nixos/tests/systemd-boot.nix
+++ b/nixos/tests/systemd-boot.nix
@ -460,6 +460,9 @@ in
      nodes.machine = common;

      testScript =
+        let
+          oldVersion = "222";
+        in
        # python
        ''
          machine.succeed("mount -o remount,rw /boot")
@ -469,13 +472,13 @@ in
              machine.succeed(
                """
                find /boot -iname '*boot*.efi' -print0 | \
-                xargs -0 -I '{}' sed -i 's/#### LoaderInfo: systemd-boot .* ####/#### LoaderInfo: systemd-boot 000.0-1-notnixos ####/' '{}'
+                xargs -0 -I '{}' sed -i 's/#### LoaderInfo: systemd-boot .* ####/#### LoaderInfo: systemd-boot ${oldVersion} ####/' '{}'
                """
              )
              return machine.succeed("/run/current-system/bin/switch-to-configuration boot 2>&1")

          output = switch()
-          assert "updating systemd-boot from 000.0-1-notnixos to " in output, "Couldn't find systemd-boot update message"
+          assert "updating systemd-boot from ${oldVersion} to " in output, "Couldn't find systemd-boot update message"
          assert 'to "/boot/EFI/systemd/systemd-bootx64.efi"' in output, "systemd-boot not copied to to /boot/EFI/systemd/systemd-bootx64.efi"
          assert 'to "/boot/EFI/BOOT/BOOTX64.EFI"' in output, "systemd-boot not copied to to /boot/EFI/BOOT/BOOTX64.EFI"

@ -486,7 +489,7 @@ in
                  "mv /boot/EFI/BOOT/bootx64.efi.new /boot/EFI/BOOT/bootx64.efi",
              )
              output = switch()
-              assert "updating systemd-boot from 000.0-1-notnixos to " in output, "Couldn't find systemd-boot update message"
+              assert "updating systemd-boot from ${oldVersion} to " in output, "Couldn't find systemd-boot update message"
              assert 'to "/boot/EFI/systemd/systemd-bootx64.efi"' in output, "systemd-boot not copied to to /boot/EFI/systemd/systemd-bootx64.efi"
              assert 'to "/boot/EFI/BOOT/BOOTX64.EFI"' in output, "systemd-boot not copied to to /boot/EFI/BOOT/BOOTX64.EFI"
        '';
--- a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/copilot/package.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/copilot/package.nix
@ -12,13 +12,13 @@
 }:
 melpaBuild (finalAttrs: {
  pname = "copilot";
-  version = "0.5.0";
+  version = "0.6.0";

  src = fetchFromGitHub {
    owner = "copilot-emacs";
    repo = "copilot.el";
    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-1uHPtz0F0pim7KlotB1+pmls1i7H3hRhZ0DX1h53cPc=";
+    sha256 = "sha256-l4TR3mk72j2VRN8s6DmlT+I5Ii2FgPEG62KKHql40L8=";
  };

  files = ''(:defaults "dist")'';
--- a/pkgs/applications/editors/vscode/extensions/kilocode.kilo-code/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/kilocode.kilo-code/default.nix
@ -12,26 +12,26 @@ vscode-utils.buildVscodeMarketplaceExtension {
      sources = {
        "x86_64-linux" = {
          arch = "linux-x64";
-          hash = "sha256-YeF6LyQzVAXgZ5Iqr6YvNcACfiUukUsq7cybeCQdSYc=";
+          hash = "sha256-uPmJyEq7X6uJzE1M5Xywax1mrnTcg6jOb9MlpKZ0WRk=";
        };
        "x86_64-darwin" = {
          arch = "darwin-x64";
-          hash = "sha256-SjirNvI83eh3Gt5rGsaiLT6TJMH6LRQAasOFNy9OMCY=";
+          hash = "sha256-oEVt3VbRUPD4tfQs0EU7RX6671fCJiMi38wF+76RzZI=";
        };
        "aarch64-linux" = {
          arch = "linux-arm64";
-          hash = "sha256-FjE3xTp5Mj1584bepVc4nZr3rxCR3CV+jplmA45VF44=";
+          hash = "sha256-b46f0f99rjBivewC9jUbAFiKK+DS1XKv+AynUlKHliw=";
        };
        "aarch64-darwin" = {
          arch = "darwin-arm64";
-          hash = "sha256-SAf3+0QSFUDq09AZQnw78ps55RM/RwoAeQuVly7vn10=";
+          hash = "sha256-yBJjt53eOazV9FB8qimerwXTX4vCIPC+lyXtau/3FyI=";
        };
      };
    in
    {
      publisher = "kilocode";
      name = "Kilo-Code";
-      version = "7.2.20";
+      version = "7.3.53";
    }
    // sources.${stdenv.hostPlatform.system}
      or (throw "Unsupported system ${stdenv.hostPlatform.system}");
--- a/pkgs/applications/editors/vscode/extensions/myriad-dreamin.tinymist/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/myriad-dreamin.tinymist/default.nix
@ -11,7 +11,7 @@ vscode-utils.buildVscodeMarketplaceExtension {
    name = "tinymist";
    publisher = "myriad-dreamin";
    inherit (tinymist) version;
-    hash = "sha256-7kpW5EYOFsnib5i5xVcywgM82I0Ey/2mjC/LAjFy8qM=";
+    hash = "sha256-FLWUeRPoqzHjwBrf0OOejaAVY+KBOpNBb9OJMdfLr04=";
  };

  __structuredAttrs = true;
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@ -1058,11 +1058,11 @@
    "vendorHash": null
  },
  "oracle_oci": {
-    "hash": "sha256-SFs0BYaYgB4J/HbaYFx1Sh1raVWhRJdW/3KMWdyvX+I=",
+    "hash": "sha256-ByAuY0y7tpzeaHmf1VTpvVUzRFxhuS49g57XqJ4Mnuk=",
    "homepage": "https://registry.terraform.io/providers/oracle/oci",
    "owner": "oracle",
    "repo": "terraform-provider-oci",
-    "rev": "v8.18.0",
+    "rev": "v8.19.0",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
@ -1436,13 +1436,13 @@
    "vendorHash": "sha256-lWBMihP6oX7qPpTuPQQwQS3IDwdyb/rEYqtBsTozb7Q="
  },
  "venafi_venafi": {
-    "hash": "sha256-WOCZRVAYVR9uzsyyAvCQvYReaas6YmZsbRgxxxhDF/k=",
+    "hash": "sha256-oEyrnKMe+cMLSajI2wxkjXfHySM198NviiSqX0hGduk=",
    "homepage": "https://registry.terraform.io/providers/Venafi/venafi",
    "owner": "Venafi",
    "repo": "terraform-provider-venafi",
-    "rev": "v0.23.2",
+    "rev": "v0.24.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-rqDzBez3HvhG+xvEyQ6foq/m0sFyyqrioquY9mcuWOU="
+    "vendorHash": "sha256-UnC3dob6idNgitHo4uGs1BPb3T7UQTR8wAJ2faYVvhE="
  },
  "vinyldns_vinyldns": {
    "hash": "sha256-/M+HFMDeKpIzzdn04TkMxriVeE6vvORRiqonxF38B9Q=",
--- a/pkgs/by-name/am/amp-cli/package.nix
+++ b/pkgs/by-name/am/amp-cli/package.nix
@ -27,7 +27,7 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "amp-cli";
-  version = "0.0.1781370323-g977781";
+  version = "0.0.1782120930-g64087b";

  src = finalAttrs.passthru.sources.${stdenvNoCC.hostPlatform.system};

@ -78,10 +78,10 @@ stdenvNoCC.mkDerivation (finalAttrs: {
        url = "https://static.ampcode.com/cli/${finalAttrs.version}/amp-${platform}.gz";
        hash =
          {
-            x86_64-linux = "sha256-taXa0AE0re6IoUxr/Sa7Os/pt/u0Zm+eCxRbRW019fA=";
-            aarch64-linux = "sha256-gFfgGlFB+HpV+KAitpOtXu2ij7hQYmxzm8gzy+l79us=";
-            x86_64-darwin = "sha256-1L+J9i/y5fg2rySOfAZySnBbqgmxpM7+7h9CoREI14s=";
-            aarch64-darwin = "sha256-1I7roExnTQFjByVDDr6ym3X+70Ba9IVE9vxBHVlJQIY=";
+            x86_64-linux = "sha256-Ye1ch/mmhFelSv77Yy+fbpiBUlXzInACp2Hux+CLQzk=";
+            aarch64-linux = "sha256-cGV6tqiaHDjSCjhlSgAf0wIcOXY0Y78G2IT0ZQ5uuNk=";
+            x86_64-darwin = "sha256-5UmALYPSfUceumD4puKbMY+VwUsmAojHuu3pNXxVOr4=";
+            aarch64-darwin = "sha256-zzpPWKfYHAEXLNvAucVOwm0HE8Ui3Ai31XMs+utlXF4=";
          }
          .${system'};
      }
--- a/pkgs/by-name/bl/blocky/package.nix
+++ b/pkgs/by-name/bl/blocky/package.nix
@ -7,20 +7,20 @@

 buildGoModule (finalAttrs: {
  pname = "blocky";
-  version = "0.31.0";
+  version = "0.32.1";

  src = fetchFromGitHub {
    owner = "0xERR0R";
    repo = "blocky";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-qFGJaShWplvZo/uKRjizWWeb/OzLJCoL9YTRsKWTriY=";
+    hash = "sha256-/gkEP7UylJQ079W1n7QaAF8EngWTSF8YbzPN3L+Ru5U=";
  };

  # needs network connection and fails at
  # https://github.com/0xERR0R/blocky/blob/development/resolver/upstream_resolver_test.go
  doCheck = false;

-  vendorHash = "sha256-EsGaY3U6bHjQTj+rLRtjiQJoNP5WnP7/gZ2NrRX53b0=";
+  vendorHash = "sha256-atsq9nSfuchtyeX9P7dV3wmEj8k9G9aZQSZxieX7mx0";

  ldflags = [
    "-s"
--- a/pkgs/by-name/br/breaktimer/disable-auto-update.patch
+++ b/pkgs/by-name/br/breaktimer/disable-auto-update.patch
@ -0,0 +1,89 @@
+diff --git a/app/main/index.ts b/app/main/index.ts
+index 96921cb..f6ce034 100644
+--- a/app/main/index.ts
+++ b/app/main/index.ts
+@@ -1,11 +1,9 @@
+-import { app, shell } from "electron";
+import { app } from "electron";
+ import electronDebug from "electron-debug";
+ import log from "electron-log";
+-import { autoUpdater } from "electron-updater";
+ import { setAutoLauch } from "./lib/auto-launch";
+ import { initBreaks } from "./lib/breaks";
+ import "./lib/ipc";
+-import { showNotification } from "./lib/notifications";
+ import { getAppInitialized } from "./lib/store";
+ import { initTray } from "./lib/tray";
+ import { createSettingsWindow, createSoundsWindow } from "./lib/windows";
+@@ -29,62 +27,6 @@ if (!gotTheLock) {
+   app.exit();
+ }
+ 
+-function getDownloadUrl(): string {
+-  switch (process.platform) {
+-    case "win32":
+-      return "https://github.com/tom-james-watson/breaktimer-app/releases/latest/download/BreakTimer.exe";
+-    case "linux":
+-      return "https://github.com/tom-james-watson/breaktimer-app/releases/latest";
+-    default:
+-      throw new Error("Download URL should not be called for macOS");
+-  }
+-}
+-
+-function shouldAutoInstall(): boolean {
+-  const isMac = process.platform === "darwin";
+-  const isLinux = process.platform === "linux";
+-
+-  return isMac || isLinux;
+-}
+-
+-function checkForUpdates(): void {
+-  log.info("Checking for updates...");
+-  autoUpdater.logger = log;
+-
+-  autoUpdater.on("error", (error) => {
+-    log.error(`Auto updater error: ${error}`);
+-  });
+-
+-  if (shouldAutoInstall()) {
+-    autoUpdater.checkForUpdatesAndNotify().catch((error) => {
+-      log.error(`Unable to run auto updater: ${error}`);
+-    });
+-  } else {
+-    autoUpdater.autoDownload = false;
+-
+-    autoUpdater.on("update-available", (info) => {
+-      log.info("Update available:", info);
+-
+-      const downloadUrl = getDownloadUrl();
+-
+-      showNotification(
+-        "Update Available",
+-        "A new version of BreakTimer is available. Click to download.",
+-        () => {
+-          shell.openExternal(downloadUrl).catch((error) => {
+-            log.error(`Failed to open download URL: ${error}`);
+-          });
+-        },
+-        false,
+-      );
+-    });
+-
+-    autoUpdater.checkForUpdates().catch((error) => {
+-      log.error(`Unable to check for updates: ${error}`);
+-    });
+-  }
+-}
+-
+ if (process.env.NODE_ENV === "production") {
+   const sourceMapSupport = require("source-map-support");
+   sourceMapSupport.install();
+@@ -146,8 +88,4 @@ app.on("ready", async () => {
+   initBreaks();
+   initTray();
+   createSoundsWindow();
+-
+-  if (process.env.NODE_ENV !== "development") {
+-    checkForUpdates();
+-  }
+ });
--- a/pkgs/by-name/br/breaktimer/package.nix
+++ b/pkgs/by-name/br/breaktimer/package.nix
@ -0,0 +1,140 @@
+{
+  lib,
+  stdenv,
+  buildNpmPackage,
+  copyDesktopItems,
+  electron_40,
+  fetchFromGitHub,
+  jq,
+  makeDesktopItem,
+  makeWrapper,
+  nix-update-script,
+  nodejs_24,
+}:
+
+let
+  electron = electron_40;
+  nodejs = nodejs_24;
+  description = "Cross-platform desktop app for managing periodic breaks";
+in
+buildNpmPackage rec {
+  pname = "breaktimer";
+  version = "2.1.0";
+
+  src = fetchFromGitHub {
+    owner = "tom-james-watson";
+    repo = "breaktimer-app";
+    tag = "v${version}";
+    hash = "sha256-STDb6+brlVk/ZPUbw3cQOpe2r03WlFKEBgVLqJrsrHI=";
+  };
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  # electron-updater's auto-install path tries to download a new release
+  # from GitHub and overwrite the nix-store binary, which is read-only.
+  # Updates come via nix instead.
+  patches = [ ./disable-auto-update.patch ];
+
+  # The package ships a lockfile (package-lock.json) but the default
+  # `npm run build` is run via `concurrently`; we drive the build manually.
+  dontNpmBuild = true;
+
+  env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
+
+  npmDepsHash = "sha256-UL8e0UKZKhHHC+JvRpmcdBvFHlCdn3YknceVJ+knMgg=";
+
+  nativeBuildInputs = [
+    jq
+    nodejs
+    makeWrapper
+    copyDesktopItems
+  ];
+
+  preBuild = ''
+    if [[ $(jq --raw-output '.devDependencies.electron' < package.json | grep -E --only-matching '\^[0-9]+' | sed -e 's/\^//') != ${lib.escapeShellArg (lib.versions.major electron.version)} ]]; then
+      echo 'ERROR: electron version mismatch'
+      exit 1
+    fi
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+
+    npm run build
+
+    # electron-builder needs to mutate the copied Electron.app, which is
+    # read-only in the nix store. Copy it to a writable location first.
+    cp -r ${electron.dist} electron-dist
+    chmod -R u+w electron-dist
+
+    # Produce an unpacked Electron app without code-signing / notarisation.
+    npm exec electron-builder -- \
+      --dir \
+      --c.electronDist=electron-dist \
+      --c.electronVersion=${electron.version} \
+      --c.mac.identity=null \
+      --c.mac.notarize=false
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+  ''
+  + lib.optionalString stdenv.hostPlatform.isLinux ''
+    unpacked="release/linux-${lib.optionalString stdenv.hostPlatform.isAarch64 "arm64-"}unpacked"
+
+    mkdir -p "$out/share/lib/breaktimer"
+    cp -r "$unpacked"/{locales,resources{,.pak}} "$out/share/lib/breaktimer"
+
+    makeWrapper '${lib.getExe electron}' "$out/bin/breaktimer" \
+      --add-flags "$out/share/lib/breaktimer/resources/app.asar" \
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=UseOzonePlatform,WaylandWindowDecorations,WebRTCPipeWireCapturer}}" \
+      --set-default ELECTRON_IS_DEV 0 \
+      --inherit-argv0
+
+    install -Dm644 resources/icon.png \
+      "$out/share/icons/hicolor/512x512/apps/breaktimer.png"
+  ''
+  + lib.optionalString stdenv.hostPlatform.isDarwin ''
+    mkdir -p "$out/Applications"
+    cp -R release/mac-*/BreakTimer.app "$out/Applications/"
+
+    mkdir -p "$out/bin"
+    makeWrapper \
+      "$out/Applications/BreakTimer.app/Contents/MacOS/BreakTimer" \
+      "$out/bin/breaktimer" \
+      --set-default ELECTRON_IS_DEV 0
+  ''
+  + ''
+    runHook postInstall
+  '';
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "breaktimer";
+      exec = "breaktimer";
+      icon = "breaktimer";
+      comment = description;
+      desktopName = "BreakTimer";
+      genericName = "Break Reminder";
+      categories = [
+        "Utility"
+        "Office"
+      ];
+    })
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    inherit description;
+    homepage = "https://github.com/tom-james-watson/breaktimer-app";
+    changelog = "https://github.com/tom-james-watson/breaktimer-app/releases/tag/v${version}";
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ proitheus ];
+    mainProgram = "breaktimer";
+    platforms = electron.meta.platforms;
+  };
+}
--- a/pkgs/by-name/co/convertx/package.nix
+++ b/pkgs/by-name/co/convertx/package.nix
@ -1,5 +1,5 @@
 {
-  stdenv,
+  stdenvNoCC,
  lib,
  fetchFromGitHub,

@ -43,11 +43,12 @@ let
    hash = pin.srcHash;
  };

-  node_modules = stdenv.mkDerivation (finalAttrs: {
+  node_modules = stdenvNoCC.mkDerivation (finalAttrs: {
    pname = "${pname}-node_modules";
    inherit version src;

    dontConfigure = true;
+    dontFixup = true;

    nativeBuildInputs = [
      bun
@ -70,11 +71,11 @@ let
      cp package.json $out/lib
    '';

-    outputHash = pin."${stdenv.system}";
+    outputHash = pin."${stdenvNoCC.system}";
    outputHashMode = "recursive";
  });
 in
-stdenv.mkDerivation {
+stdenvNoCC.mkDerivation {
  inherit pname version src;

  nativeBuildInputs = [
--- a/pkgs/by-name/co/convertx/pin.json
+++ b/pkgs/by-name/co/convertx/pin.json
@ -1,6 +1,6 @@
 {
-  "version": "0.17.0",
-  "srcHash": "sha256-1W7M9BfAh89ntmJW7tNwydwPCkVy5CoddWb2aPPUFds=",
-  "x86_64-linux": "sha256-7B4ZGGew6isFnz7EoaLyJgO6a66V9ZTKsKxXwVSsnfs=",
-  "aarch64-linux": "sha256-IoQP9UBd64qecOwmI8oQREgiYCL2pXGjfVx1Ylvd/WA="
+  "version": "0.18.0",
+  "srcHash": "sha256-S8oUU21VOy+4MiWvnEBOSUBuMysYq9H4tQIcEOvLjKw=",
+  "x86_64-linux": "sha256-rAZROhjbvGg/7aRPlh6yGmPDmbEsYjDHJEVaWXejxts=",
+  "aarch64-linux": "sha256-yJbwexqwe95XIZ51gbjwpg6cRm5ssJl1qrIS+Vrd+vo="
 }
--- a/pkgs/by-name/cp/cpcm-x/cmake-config-find-numsa.patch
+++ b/pkgs/by-name/cp/cpcm-x/cmake-config-find-numsa.patch
@ -0,0 +1,15 @@
+diff --git a/config/config.cmake.in b/config/config.cmake.in
+index e5e4f6b..d41c070 100644
+--- a/config/config.cmake.in
+++ b/config/config.cmake.in
+@@ -23,6 +23,10 @@ if(NOT TARGET "@PROJECT_NAME@::@PROJECT_NAME@")
+ 
+   include(CMakeFindDependencyMacro)
+ 
+  if(NOT TARGET "numsa::numsa")
+    find_dependency("numsa" REQUIRED)
+  endif()
+
+   if(NOT TARGET "mctc-lib::mctc-lib")
+     find_dependency("mctc-lib" REQUIRED)
+   endif()
--- a/pkgs/by-name/cp/cpcm-x/package.nix
+++ b/pkgs/by-name/cp/cpcm-x/package.nix
@ -0,0 +1,107 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+
+  buildType ? "meson",
+
+  gfortran,
+  pkg-config,
+  python3,
+  meson,
+  ninja,
+  cmake,
+
+  # buildInputs
+  blas,
+  lapack,
+  test-drive,
+
+  # propagatedBuildInputs
+  mctc-lib,
+  numsa,
+  toml-f,
+
+  nix-update-script,
+}:
+
+assert (
+  builtins.elem buildType [
+    "meson"
+    "cmake"
+  ]
+);
+stdenv.mkDerivation (finalAttrs: {
+  pname = "cpcm-x";
+  version = "1.1.0";
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  src = fetchFromGitHub {
+    owner = "grimme-lab";
+    repo = "CPCM-X";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-FyPUECbcqUHoGq1LASvPF4qSUKQ5N/y1itq8e2wGliE=";
+  };
+
+  patches = [
+    # The installed CMake package config links numsa::numsa transitively but
+    # never re-discovers it, so consumers fail with "target numsa::numsa not
+    # found". Add the missing find_dependency call.
+    ./cmake-config-find-numsa.patch
+  ];
+
+  postPatch = ''
+    substituteInPlace config/install-mod.py \
+      --replace-fail "/usr/bin/env python" "${lib.getExe python3}"
+  '';
+
+  outputs = [
+    "out"
+    "dev"
+  ];
+
+  nativeBuildInputs = [
+    gfortran
+    pkg-config
+    python3
+  ]
+  ++ lib.optionals (buildType == "meson") [
+    meson
+    ninja
+  ]
+  ++ lib.optionals (buildType == "cmake") [
+    cmake
+  ];
+
+  buildInputs = [
+    blas
+    lapack
+    # only needed to build the bundled test suite
+    test-drive
+  ];
+
+  propagatedBuildInputs = [
+    mctc-lib
+    numsa
+    toml-f
+  ];
+
+  doCheck = true;
+
+  preCheck = ''
+    export OMP_NUM_THREADS=2
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Extended conductor-like polarizable continuum solvation model";
+    homepage = "https://github.com/grimme-lab/CPCM-X";
+    changelog = "https://github.com/grimme-lab/CPCM-X/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.lgpl3;
+    maintainers = with lib.maintainers; [ GaetanLepage ];
+    mainProgram = "cpx";
+    platforms = lib.platforms.linux;
+  };
+})
--- a/pkgs/by-name/da/dalfox/package.nix
+++ b/pkgs/by-name/da/dalfox/package.nix
@ -6,13 +6,13 @@

 buildGoModule (finalAttrs: {
  pname = "dalfox";
-  version = "3.1.0";
+  version = "3.1.1";

  src = fetchFromGitHub {
    owner = "hahwul";
    repo = "dalfox";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-QV2+eKTMuvt//krGrPrjViIsLiog5i4bzhgq8lgHvR0=";
+    hash = "sha256-V+5/+UYj9Pd727olIOwXij/XUh2NMzGHQDuupTO9DMk=";
  };

  vendorHash = null;
--- a/pkgs/by-name/df/dftd4/package.nix
+++ b/pkgs/by-name/df/dftd4/package.nix
@ -27,11 +27,13 @@ assert (
 stdenv.mkDerivation (finalAttrs: {
  pname = "dftd4";
  version = "4.2.0";
+  __structuredAttrs = true;
+  strictDeps = true;

  src = fetchFromGitHub {
    owner = "dftd4";
    repo = "dftd4";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
    hash = "sha256-uKjNOIza3/I0oREp88oFESoNqEdumo1AztIjcrVb1O8=";
  };

@ -85,6 +87,7 @@ stdenv.mkDerivation (finalAttrs: {

  meta = {
    description = "Generally Applicable Atomic-Charge Dependent London Dispersion Correction";
+    changelog = "https://github.com/dftd4/dftd4/releases/tag/${finalAttrs.src.tag}";
    mainProgram = "dftd4";
    license = with lib.licenses; [
      lgpl3Plus
--- a/pkgs/by-name/fe/fence/package.nix
+++ b/pkgs/by-name/fe/fence/package.nix
@ -14,16 +14,16 @@

 buildGoModule (finalAttrs: {
  pname = "fence";
-  version = "0.1.60";
+  version = "0.1.61";

  src = fetchFromGitHub {
    owner = "fencesandbox";
    repo = "fence";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-4yRfU6fCTGOcA9IeFs9Sk9n1PqXi7E++reVDPlCwS1k=";
+    hash = "sha256-/IVxTPgAzl+mX85M1IyD+21O8j/tIxt2a18TLtQz/zk=";
  };

-  vendorHash = "sha256-rZ+ArTdr5GbW+nRzglNgxzsXjuTlTA0uInNWXgAVurM=";
+  vendorHash = "sha256-aMxay3dow6mDKyv396R0j1GOKDmhkX4ebGmhca1B4WE=";

  __structuredAttrs = true;

--- a/pkgs/by-name/fi/firewalld/package.nix
+++ b/pkgs/by-name/fi/firewalld/package.nix
@ -80,6 +80,7 @@ stdenv.mkDerivation (finalAttrs: {
    docbook_xml_dtd_42
    docbook-xsl-nons
    glib
+    gobject-introspection
    intltool
    libxml2
    libxslt
@ -94,7 +95,6 @@ stdenv.mkDerivation (finalAttrs: {

  buildInputs = [
    glib
-    gobject-introspection
    ipset
    iptables
    kmod
--- a/pkgs/by-name/gl/globalping-cli/package.nix
+++ b/pkgs/by-name/gl/globalping-cli/package.nix
@ -9,16 +9,16 @@

 buildGoModule (finalAttrs: {
  pname = "globalping-cli";
-  version = "1.5.1";
+  version = "1.5.2";

  src = fetchFromGitHub {
    owner = "jsdelivr";
    repo = "globalping-cli";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-muWhiKqPdNVhy7c7MSRHACGzOn5pIVRdqSdfdCJw2CA=";
+    hash = "sha256-MaqBaR177gcgoqEpsER1+8oYZmiGeySfL/O9r6CxqCY=";
  };

-  vendorHash = "sha256-dJAuN5srL5EvMaRg8rHaTsurjYrdH45p965DeubpB0E=";
+  vendorHash = "sha256-7fhcQptMyq8IuRaqx3Znc9QFLaV0t6HpM4eCtdimupA=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/by-name/go/gogcli/package.nix
+++ b/pkgs/by-name/go/gogcli/package.nix
@ -7,16 +7,16 @@

 buildGoModule (finalAttrs: {
  pname = "gogcli";
-  version = "0.11.0";
+  version = "0.29.0";

  src = fetchFromGitHub {
    owner = "steipete";
    repo = "gogcli";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-hJU40ysjRx4p9SWGmbhhpToYCpk3DcMAWCnKqxHRmh0=";
+    hash = "sha256-JunPpEzbNp00uEiJ7AzouXyzFwyNLehLU7mwL3eh4bM=";
  };

-  vendorHash = "sha256-WGRlv3UsK3SVBQySD7uZ8+FiRl03p0rzjBm9Se1iITs=";
+  vendorHash = "sha256-JrRIUYpw2lAD0ezi0HTZvS42OS7vP8DAHU3m0u3eCbM=";

  subPackages = [ "cmd/gog" ];

--- a/pkgs/by-name/jj/jj-vine/package.nix
+++ b/pkgs/by-name/jj/jj-vine/package.nix
@ -12,16 +12,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "jj-vine";
-  version = "0.5.0";
+  version = "0.5.3";

  src = fetchFromCodeberg {
    owner = "abrenneke";
    repo = "jj-vine";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-uvnSv+4ijVdBoHrOklDRY+JDLsVOTRu+laOcFMjkYaA=";
+    hash = "sha256-dUamfoMtdDNz9xmXeg1O1j5UHW6uF/1WznHSsG+eVjs=";
  };

-  cargoHash = "sha256-TsyFWcvr8ksiC1vStWs+mH88lw1/JGRg8IQ7XFnZ5qg=";
+  cargoHash = "sha256-nuj0cugeK5oc+sZmm1f5dvGEjML0qkle5uO66e54VIY=";

  nativeCheckInputs = [
    jujutsu
--- a/pkgs/by-name/ju/just/package.nix
+++ b/pkgs/by-name/ju/just/package.nix
@ -17,7 +17,7 @@
  withDocumentation ? stdenv.buildPlatform.canExecute stdenv.hostPlatform,
 }:
 let
-  version = "1.53.0";
+  version = "1.54.0";
 in
 rustPlatform.buildRustPackage {
  inherit version;
@ -36,10 +36,10 @@ rustPlatform.buildRustPackage {
    owner = "casey";
    repo = "just";
    tag = version;
-    hash = "sha256-+/G5fIPBl9NoDL0i9y67tjccte75yMT84pqsCWropws=";
+    hash = "sha256-sWEelwKEuxJUTh2Ejwr7e29j5EFVCSiQJoLCEH60PxI=";
  };

-  cargoHash = "sha256-Rwv10c487qOf6nH/Nj8rcfMLHRm8RaA5OYOh5p27rtM=";
+  cargoHash = "sha256-+eUi0g+ObJhlXhRLmWfRmTlnoxHHVdzTtXdX8LNloIc=";

  nativeBuildInputs =
    lib.optionals (installShellCompletions || installManPages) [ installShellFiles ]
--- a/pkgs/by-name/ko/kopia-ui/package.nix
+++ b/pkgs/by-name/ko/kopia-ui/package.nix
@ -10,12 +10,12 @@
  kopia,
 }:
 let
-  version = "0.23.0";
+  version = "0.23.1";
  src = fetchFromGitHub {
    owner = "kopia";
    repo = "kopia";
    tag = "v${version}";
-    hash = "sha256-9xvgm+A8h2pAX3oHtiFSa2xNab5BDkEBEtXQZz3Fd5A=";
+    hash = "sha256-yjeLV7N/U88oVdP4iJYgSM/QJLAMREaB/2jBcbTDWkA=";
  };
 in
 buildNpmPackage {
@ -24,7 +24,7 @@ buildNpmPackage {

  sourceRoot = "${src.name}/app";

-  npmDepsHash = "sha256-Ctp41vNZPVbycwIzWiTh+1ej3NpCf1WJCqnJsyoyxlc=";
+  npmDepsHash = "sha256-yj5+qiLfy6CjAOXIzT9OMu860Pefwn+HuJNoBAizb/0=";
  makeCacheWritable = true;

  nativeBuildInputs = [
--- a/pkgs/by-name/ku/kubectl-gadget/package.nix
+++ b/pkgs/by-name/ku/kubectl-gadget/package.nix
@ -6,16 +6,16 @@

 buildGoModule (finalAttrs: {
  pname = "kubectl-gadget";
-  version = "0.52.0";
+  version = "0.53.2";

  src = fetchFromGitHub {
    owner = "inspektor-gadget";
    repo = "inspektor-gadget";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-WcIPubDzj3LPf1KUWfmxdlBGnG2x68hax/ZQKwSNifc=";
+    hash = "sha256-Mfj2Slgeo5v5NNg3qj8v0eFg35jishtk5bEt+IxA1xc=";
  };

-  vendorHash = "sha256-aEzzXcsM3D+Sp6LBms5+RzWirdC5iFvN2IiwbOXCrEw=";
+  vendorHash = "sha256-u4kEi/H8vdIV6bS/R76H09m7dh1YR8pUD8ZOQ23VhHU=";

  env.CGO_ENABLED = 0;

--- a/pkgs/by-name/ku/kubevirt/package.nix
+++ b/pkgs/by-name/ku/kubevirt/package.nix
@ -10,13 +10,13 @@

 buildGoModule (finalAttrs: {
  pname = "kubevirt";
-  version = "1.8.2";
+  version = "1.8.4";

  src = fetchFromGitHub {
    owner = "kubevirt";
    repo = "kubevirt";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-YSrMJz0L0Ybw5G6p42YAMMa1D1xc9G8sBLdxjxz3axg=";
+    hash = "sha256-4MQtONb8opLDBLtGr+5oDrOQkkK1q4RlMXDcqyilarM=";
  };

  vendorHash = null;
--- a/pkgs/by-name/li/linux-firmware/package.nix
+++ b/pkgs/by-name/li/linux-firmware/package.nix
@ -23,13 +23,13 @@ let
 in
 stdenvNoCC.mkDerivation rec {
  pname = "linux-firmware";
-  version = "20260519";
+  version = "20260622";

  src = fetchFromGitLab {
    owner = "kernel-firmware";
    repo = "linux-firmware";
    tag = version;
-    hash = "sha256-vyrnHNnyNko7m/fZ3fXgLvvasYyJ/pzs5be/Ele+6vY=";
+    hash = "sha256-nSoJhgI4hAxtNmnj5M6ticzuBSt9uNAYcmc1VR/yXxE=";
  };

  postUnpack = ''
--- a/pkgs/by-name/mu/mujoco/mujoco-system-deps-dont-fetch.patch
+++ b/pkgs/by-name/mu/mujoco/mujoco-system-deps-dont-fetch.patch
@ -84,6 +84,15 @@ index d2404bc1..5c7ddaf6 100644
   TARGETS
   ccd
   EXCLUDE_FROM_ALL
+@@ -256,8 +256,6 @@ set(BUILD_TESTS OFF)
+ set(BUILD_TESTS OFF)
+ fetchpackage(
+   PACKAGE_NAME  miniz
+-  GIT_REPO      https://github.com/richgel999/miniz.git
+-  GIT_TAG       ${MUJOCO_DEP_VERSION_miniz}
+   TARGETS       miniz
+ )
+ if(_BUILD_TESTS_WAS_DEFINED)
@@ -261,10 +241,6 @@ if(MUJOCO_BUILD_TESTS OR MUJOCO_BUILD_STUDIO OR MUJOCO_USE_FILAMENT)
     absl
     LIBRARY_NAME
--- a/pkgs/by-name/mu/mujoco/package.nix
+++ b/pkgs/by-name/mu/mujoco/package.nix
@ -20,14 +20,14 @@ let
    abseil-cpp = fetchFromGitHub {
      owner = "abseil";
      repo = "abseil-cpp";
-      rev = "255c84dadd029fd8ad25c5efb5933e47beaa00c7";
-      hash = "sha256-TJT2Kzc64zI42FAbbGWP3Sshh1dU/D/AtEpgZrrhebg=";
+      rev = "5650e9cf76d3be4318d5fa3af38ee483ddfd5e4a";
+      hash = "sha256-O9ClnGm4WSTX3g1Q2VYTMhUtGG52XBwxzgHtWW9WSG0=";
    };
    benchmark = fetchFromGitHub {
      owner = "google";
      repo = "benchmark";
-      rev = "5c55f5d4f45a1b09c5d98aa63a671993ebd42c69";
-      hash = "sha256-CChXn58cqam3d6Q61ZJMr5NFq1Ezc5uywA7FSPhk4GI=";
+      rev = "834a61fc65e8b7885fcf177f1230ae4b897118fa";
+      hash = "sha256-V5pVCG5QdFlgBIVKMv4jyTTB22BWfTHD3HolVPDFpgQ=";
    };
    ccd = fetchFromGitHub {
      owner = "danfis";
@ -38,8 +38,8 @@ let
    eigen3 = fetchFromGitLab {
      owner = "libeigen";
      repo = "eigen";
-      rev = "75bcd155c40cb48e647c87c3f29052360255bc9e";
-      hash = "sha256-ZBm3ac6Kt7gOqNip6PeNNMiOF0fwG+7PJYA47KT0ogI=";
+      rev = "ea13a98decd497a8c5588fb5de71b57bcf10d864";
+      hash = "sha256-v9bNWc9yfK3vG8hYhQ7vkc7DHaoPF6RAKfX9kC0Gw8c=";
    };
    googletest = fetchFromGitHub {
      owner = "google";
@ -53,11 +53,17 @@ let
      rev = "17d08dd26cac4d63f43af217ebd70318bfb8189c";
      hash = "sha256-vnw52G0lY68471dzH7NXc++bTbLRsITSxGYXOTicA5w=";
    };
+    miniz = fetchFromGitHub {
+      owner = "richgel999";
+      repo = "miniz";
+      rev = "d10b03cc73475af673df40f06e5cefd1d5f940d9";
+      hash = "sha256-hRB/0TVVQjr4VwjozfRnYKUJfeqO+1PNfdvP/rrOCR4=";
+    };
    qhull = fetchFromGitHub {
      owner = "qhull";
      repo = "qhull";
-      rev = "62ccc56af071eaa478bef6ed41fd7a55d3bb2d80";
-      hash = "sha256-kIxHtE0L/axV9WKnQzyFN0mxoIFAI33Z+MP0P/MtQPw=";
+      rev = "d1c2fc0caa5f644f3a0f220290d4a868c68ed4f6";
+      hash = "sha256-enwzl4td3lgYwQ4PXfcONKQrxChnJcvf8ehnJ6vf0yg=";
    };
    tinyobjloader = fetchFromGitHub {
      owner = "tinyobjloader";
@ -82,7 +88,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "mujoco";
-  version = "3.8.1";
+  version = "3.10.0";

  __structuredAttrs = true;
  strictDeps = true;
@ -93,7 +99,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "google-deepmind";
    repo = "mujoco";
    tag = finalAttrs.version;
-    hash = "sha256-eoZblIIH+tUNKPdVERGh1dE0KoWwMpP0LA6FgcJCiNU=";
+    hash = "sha256-wNsTTq5z+wKE0rSw2cyY1tJxP5i7LGu05DR7KfZEBtE=";
  };

  patches = [
@ -128,9 +134,14 @@ stdenv.mkDerivation (finalAttrs: {
  # Move things into place so that cmake doesn't try downloading dependencies.
  preConfigure = ''
    mkdir -p build/_deps
-    ln -s ${pin.abseil-cpp} build/_deps/abseil-cpp-src
    ln -s ${pin.benchmark} build/_deps/benchmark-src
  ''
+  # mujoco applies a patch on top of abseil-cpp's sources
+  # https://github.com/google-deepmind/mujoco/blob/3.10.0/cmake/MujocoDependencies.cmake#L299-L300
+  + ''
+    cp -r ${pin.abseil-cpp} build/_deps/abseil-cpp-src
+    chmod -R +w build/_deps/abseil-cpp-src
+  ''
  # cccd is patched by mujoco's cmake and thus needs to be writable
  # https://github.com/google-deepmind/mujoco/blob/3.4.0/cmake/MujocoDependencies.cmake#L232-L235
  + ''
@ -141,6 +152,7 @@ stdenv.mkDerivation (finalAttrs: {
    ln -s ${pin.eigen3} build/_deps/eigen3-src
    ln -s ${pin.googletest} build/_deps/googletest-src
    ln -s ${pin.lodepng} build/_deps/lodepng-src
+    ln -s ${pin.miniz} build/_deps/miniz-src
  ''
  # qhull is patched by mujoco's cmake and thus needs to be writable
  # https://github.com/google-deepmind/mujoco/blob/3.4.0/cmake/MujocoDependencies.cmake#L132-L135
--- a/pkgs/by-name/mu/multica-cli/package.nix
+++ b/pkgs/by-name/mu/multica-cli/package.nix
@ -9,13 +9,13 @@ buildGoModule rec {
  __structuredAttrs = true;

  pname = "multica-cli";
-  version = "0.3.21";
+  version = "0.3.27";

  src = fetchFromGitHub {
    owner = "multica-ai";
    repo = "multica";
    rev = "v${version}";
-    hash = "sha256-qsQ2ycr+MU1A+U8LIbxnfaYtSHoMnLNO3P9ACJ6ThD4=";
+    hash = "sha256-zHjyITvFG7dTk8mFQ62f8JY9wLbKeOvlo0pjF6hQxcI=";
  };

  sourceRoot = "${src.name}/server";
--- a/pkgs/by-name/mu/multicharge/package.nix
+++ b/pkgs/by-name/mu/multicharge/package.nix
@ -26,11 +26,13 @@ assert (
 stdenv.mkDerivation (finalAttrs: {
  pname = "multicharge";
  version = "0.5.0";
+  __structuredAttrs = true;
+  strictDeps = true;

  src = fetchFromGitHub {
    owner = "grimme-lab";
    repo = "multicharge";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
    hash = "sha256-hswqC+fvC6tuxDpuUgowyqm72ubVikzpR4EzXtTM5cs=";
  };

@ -48,7 +50,9 @@ stdenv.mkDerivation (finalAttrs: {
    meson
    ninja
  ]
-  ++ lib.optional (buildType == "cmake") cmake;
+  ++ lib.optionals (buildType == "cmake") [
+    cmake
+  ];

  buildInputs = [
    blas
@ -85,6 +89,7 @@ stdenv.mkDerivation (finalAttrs: {
    mainProgram = "multicharge";
    license = lib.licenses.asl20;
    homepage = "https://github.com/grimme-lab/multicharge";
+    changelog = "https://github.com/grimme-lab/multicharge/releases/tag/${finalAttrs.src.tag}";
    platforms = lib.platforms.linux;
    maintainers = [ lib.maintainers.sheepforce ];
  };
--- a/pkgs/by-name/ne/neovim-unwrapped/package.nix
+++ b/pkgs/by-name/ne/neovim-unwrapped/package.nix
@ -11,6 +11,7 @@
  unibilium,
  utf8proc,
  tree-sitter,
+  wasmtime_36,
  fetchurl,
  buildPackages,
  treesitter-parsers ? import ./treesitter-parsers.nix { inherit fetchurl; },
@ -20,6 +21,7 @@
  versionCheckHook,
  nix-update-script,
  writableTmpDirAsHomeHook,
+  wasmSupport ? false,

  # now defaults to false because some tests can be flaky (clipboard etc), see
  # also: https://github.com/neovim/neovim/issues/16233
@ -30,6 +32,9 @@

 let
  lua = if lib.meta.availableOn stdenv.hostPlatform luajit then luajit else lua5_1;
+  treeSitterForNeovim = tree-sitter.override {
+    inherit wasmSupport;
+  };
 in

 stdenv.mkDerivation (
@ -161,10 +166,13 @@ stdenv.mkDerivation (
      # and it's definition at: pkgs/development/lua-modules/overrides.nix
      lua.pkgs.libluv
      neovimLuaEnv
-      tree-sitter
+      treeSitterForNeovim
      unibilium
      utf8proc
    ]
+    ++ lib.optionals wasmSupport [
+      wasmtime_36
+    ]
    ++ lib.optionals (stdenv.hostPlatform.libc != "glibc") [
      # Provide libintl for non-glibc platforms
      gettext
@ -202,13 +210,20 @@ stdenv.mkDerivation (
        pyEnv # for src/clint.py
      ];

-    # nvim --version output retains compilation flags and references to build tools
-    postPatch = lib.optionalString (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
-      sed -i runtime/CMakeLists.txt \
-        -e "s|\".*/bin/nvim|\${stdenv.hostPlatform.emulator buildPackages} &|g"
-      sed -i src/nvim/po/CMakeLists.txt \
-        -e "s|\$<TARGET_FILE:nvim|\${stdenv.hostPlatform.emulator buildPackages} &|g"
-    '';
+    postPatch =
+      lib.optionalString wasmSupport ''
+        substituteInPlace src/nvim/CMakeLists.txt \
+          --replace-fail \
+            'find_package(Wasmtime 36.0.6 EXACT REQUIRED)' \
+            'find_package(Wasmtime REQUIRED)'
+      ''
+      # nvim --version output retains compilation flags and references to build tools
+      + lib.optionalString (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+        sed -i runtime/CMakeLists.txt \
+          -e "s|\".*/bin/nvim|\${stdenv.hostPlatform.emulator buildPackages} &|g"
+        sed -i src/nvim/po/CMakeLists.txt \
+          -e "s|\$<TARGET_FILE:nvim|\${stdenv.hostPlatform.emulator buildPackages} &|g"
+      '';
    # check that the above patching actually works
    disallowedRequisites = [
      stdenv.cc
@ -229,6 +244,12 @@ stdenv.mkDerivation (
      (lib.cmakeBool "ENABLE_TRANSLATIONS" true)
      (lib.cmakeBool "USE_BUNDLED_BUSTED" false)
    ]
+    ++ lib.optionals wasmSupport [
+      # FindWasmtime has no pkg-config fallback.
+      (lib.cmakeBool "ENABLE_WASMTIME" true)
+      (lib.cmakeFeature "WASMTIME_INCLUDE_DIR" "${lib.getDev wasmtime_36}/include")
+      (lib.cmakeFeature "WASMTIME_LIBRARY" "${lib.getLib wasmtime_36}/lib/libwasmtime${stdenv.hostPlatform.extensions.sharedLibrary}")
+    ]
    ++ (
      if lua.pkgs.isLuaJIT then
        [
--- a/pkgs/by-name/ne/newelle/package.nix
+++ b/pkgs/by-name/ne/newelle/package.nix
@ -20,7 +20,7 @@
 }:

 let
-  version = "1.3.7";
+  version = "1.4.5";
 in
 python3Packages.buildPythonApplication {
  pname = "newelle";
@ -31,7 +31,7 @@ python3Packages.buildPythonApplication {
    owner = "qwersyk";
    repo = "Newelle";
    tag = version;
-    hash = "sha256-Qa1f6lNfKt1hh1gWJ45n9rwjO5lSO2d0tMII27glU/E=";
+    hash = "sha256-GcNAwrk5y6F0BgRy69nRePkX4WoYviWsB+8X/+N5QwE=";
  };

  postPatch = ''
--- a/pkgs/by-name/ni/nixos-render-docs/src/nixos_render_docs/manual.py
+++ b/pkgs/by-name/ni/nixos-render-docs/src/nixos_render_docs/manual.py
@ -307,7 +307,7 @@ class ManualHTMLRenderer(RendererMixin, HTMLRenderer):

        toc = TocEntry.of(tokens[0])
        return "\n".join([
-            self._file_header(toc),
+            self._file_header(toc, sidebar=self._build_toc(tokens, 0)),
            ' <div class="book">',
            '  <div class="titlepage">',
            '   <div>',
@ -316,13 +316,12 @@ class ManualHTMLRenderer(RendererMixin, HTMLRenderer):
            '   </div>',
            "   <hr />",
            '  </div>',
-            self._build_toc(tokens, 0),
            super(HTMLRenderer, self).render(tokens[6:]),
            ' </div>',
            self._file_footer(toc),
        ])

-    def _file_header(self, toc: TocEntry) -> str:
+    def _file_header(self, toc: TocEntry, sidebar: str = "") -> str:
        prev_link, up_link, next_link = "", "", ""
        prev_a, next_a, parent_title = "", "", "&nbsp;"
        nav_html = ""
@ -384,6 +383,8 @@ class ManualHTMLRenderer(RendererMixin, HTMLRenderer):
            ' </head>',
            ' <body>',
            nav_html,
+            f'  <nav class="toc-sidebar">{sidebar}</nav>' if sidebar else "",
+            '  <main class="content">',
        ])

    def _file_footer(self, toc: TocEntry) -> str:
@ -424,6 +425,7 @@ class ManualHTMLRenderer(RendererMixin, HTMLRenderer):
            ])
        return "\n".join([
            nav_html,
+            '  </main>',
            ' </body>',
            '</html>',
        ])
--- a/pkgs/by-name/ni/nixpkgs-review/package.nix
+++ b/pkgs/by-name/ni/nixpkgs-review/package.nix
@ -23,7 +23,7 @@

 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "nixpkgs-review";
-  version = "3.8.0";
+  version = "3.9.0";
  pyproject = true;

  __structuredAttrs = true;
@ -32,7 +32,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
    owner = "Mic92";
    repo = "nixpkgs-review";
    tag = finalAttrs.version;
-    hash = "sha256-Z8pOct9DtuRo4LERqhVpDxX9uoLNQGgqPFUh0Fn3MrI=";
+    hash = "sha256-u0DbEwe28csVWKbu8x9v9/Ah0ZUUgqXtZU2Rr5IJpWI=";
  };

  build-system = [
--- a/pkgs/by-name/nu/numsa/package.nix
+++ b/pkgs/by-name/nu/numsa/package.nix
@ -0,0 +1,107 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+
+  buildType ? "meson",
+
+  # nativeBuildInputs
+  asciidoctor,
+  gfortran,
+  pkg-config,
+  python3,
+  # meson:
+  meson,
+  ninja,
+  # cmake:
+  cmake,
+
+  # buildInputs
+  mstore,
+  test-drive,
+  blas,
+  lapack,
+
+  # propagatedBuildInputs
+  mctc-lib,
+
+  # passthru
+  nix-update-script,
+}:
+
+assert (
+  builtins.elem buildType [
+    "meson"
+    "cmake"
+  ]
+);
+stdenv.mkDerivation (finalAttrs: {
+  pname = "numsa";
+  version = "0.2.0";
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  src = fetchFromGitHub {
+    owner = "grimme-lab";
+    repo = "numsa";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-PAzxeYyg/9P/3YFxKzM4ZFm2xT0AGap6q8/ei8jD/3M=";
+  };
+
+  outputs = [
+    "out"
+    "dev"
+  ];
+
+  patches = [
+    # Use nixpkgs' mstore instead of building it from source
+    ./use-external-mstore.patch
+  ];
+
+  postPatch = ''
+    substituteInPlace config/install-mod.py \
+      --replace-fail "/usr/bin/env python" "${lib.getExe python3}"
+  '';
+
+  nativeBuildInputs = [
+    asciidoctor
+    gfortran
+    pkg-config
+    python3
+  ]
+  ++ lib.optionals (buildType == "meson") [
+    meson
+    ninja
+  ]
+  ++ lib.optionals (buildType == "cmake") [
+    cmake
+  ];
+
+  buildInputs = [
+    blas
+    lapack
+    mstore # only needed to build the bundled test suite
+    test-drive
+  ];
+
+  propagatedBuildInputs = [
+    mctc-lib
+  ];
+
+  doCheck = true;
+
+  preCheck = ''
+    export OMP_NUM_THREADS=2
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Solvent accessible surface area calculation";
+    homepage = "https://github.com/grimme-lab/numsa";
+    changelog = "https://github.com/grimme-lab/numsa/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ GaetanLepage ];
+    platforms = lib.platforms.linux;
+  };
+})
--- a/pkgs/by-name/nu/numsa/use-external-mstore.patch
+++ b/pkgs/by-name/nu/numsa/use-external-mstore.patch
@ -0,0 +1,30 @@
+diff --git a/test/meson.build b/test/meson.build
+index c60e4a4..7da0216 100644
+--- a/test/meson.build
+++ b/test/meson.build
+@@ -14,20 +14,21 @@
+ # You should have received a copy of the GNU Lesser General Public License
+ # along with numsa.  If not, see <https://www.gnu.org/licenses/>.
+ 
+-# Create mstore as subproject for testing
+-mstore_prj = subproject(
+# Find the molecular structure store, preferring an external installation
+# (e.g. via pkg-config) and falling back to building it as a subproject
+mstore_dep = dependency(
+   'mstore',
+   version: '>=0.1',
+  fallback: ['mstore', 'mstore_dep'],
+   required: not meson.is_subproject(),
+   default_options: [
+     'default_library=static',
+   ],
+ )
+ # If we do not find mstore and are a subproject, we just skip testing
+-if not mstore_prj.found()
+if not mstore_dep.found()
+    subdir_done()
+ endif
+-mstore_dep = mstore_prj.get_variable('mstore_dep')
+ 
+ tests = [
+   'surface',
--- a/pkgs/by-name/os/osmium/package.nix
+++ b/pkgs/by-name/os/osmium/package.nix
@ -29,11 +29,11 @@

 stdenv.mkDerivation rec {
  pname = "osmium";
-  version = "0.0.29-alpha";
+  version = "0.0.30-alpha";

  src = fetchurl {
    url = "https://updater.osmium.chat/Osmium-${version}-x64.tar.gz";
-    hash = "sha256-UbYnT/9bkMCii4rkAlkUBQcHc6DyAkOa8rQl+9e3NZU=";
+    hash = "sha256-NF7RF8odDQfh4zhk5B4md4OqDgh538exFNsRZzSJwBM=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/pa/pacman/dont-create-empty-dirs.patch
+++ b/pkgs/by-name/pa/pacman/dont-create-empty-dirs.patch
@ -1,8 +1,17 @@
 diff --git a/meson.build b/meson.build
-index c8ee42fd..610401ca 100644
+index 1e8bd8f8..86e68a75 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -414,15 +414,6 @@ install_data(
+@@ -433,8 +433,6 @@ configure_file(
+   configuration : substs,
+   install_dir : join_paths(SYSCONFDIR, 'makepkg.conf.d/'))
+ 
+-install_emptydir(join_paths(SYSCONFDIR, 'makepkg.d/'))
+-
+ configure_file(
+   input : 'etc/pacman.conf.in',
+   output : 'pacman.conf',
+@@ -448,15 +446,6 @@ install_data(
   'proto/proto.install',
   install_dir : join_paths(DATAROOTDIR, 'pacman'))
 
--- a/pkgs/by-name/pa/pacman/package.nix
+++ b/pkgs/by-name/pa/pacman/package.nix
@ -34,6 +34,9 @@
  gnugrep,
  gnupg,

+  # makepkg requires compgen to work
+  bashInteractive,
+
  # Tells pacman where to find ALPM hooks provided by packages.
  # This path is very likely to be used in an Arch-like root.
  sysHookDir ? "/usr/share/libalpm/hooks/",
@ -41,20 +44,21 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "pacman";
-  version = "7.0.0";
+  version = "7.1.0";

  src = fetchFromGitLab {
    domain = "gitlab.archlinux.org";
    owner = "pacman";
    repo = "pacman";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-ejOBxN2HjV4dZwFA7zvPz3JUJa0xiJ/jZ+evEQYG1Mc=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-bGg2ZrIsEYJYZCLsIh4FZROhpyLSBO0Lar1mSoz66wI=";
  };

  strictDeps = true;

  nativeBuildInputs = [
    asciidoc
+    bashInteractive
    gettext
    installShellFiles
    libarchive
@ -101,10 +105,6 @@ stdenv.mkDerivation (finalAttrs: {
        --replace-fail "/bin/true" "${coreutils}/bin/true"
      substituteInPlace scripts/repo-add.sh.in \
        --replace-fail bsdtar "${libarchive}/bin/bsdtar"
-
-      # Fix https://gitlab.archlinux.org/pacman/pacman/-/issues/171
-      substituteInPlace scripts/libmakepkg/source/git.sh.in \
-        --replace-warn "---mirror" "--mirror"
    '';

  mesonFlags = [
--- a/pkgs/by-name/pa/paru/package.nix
+++ b/pkgs/by-name/pa/paru/package.nix
@ -12,16 +12,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "paru";
-  version = "2.1.0";
+  version = "2.1.0-unstable-2026-01-09";

  src = fetchFromGitHub {
    owner = "Morganamilo";
    repo = "paru";
-    tag = "v${finalAttrs.version}";
-    hash = "sha256-i99f2ngYhfVCKpImJ8L7u2T2FgOt7Chp8DHDbrNh1kw=";
+    rev = "9ac3578807a87858651e81a02586ceb947686e7c";
+    hash = "sha256-TJbhxVnP5UhlCmwxKjXq/XaqPGtzHoN5S+lizm3Bmvs=";
  };

-  cargoHash = "sha256-USIceRh24WGV0TIrpuyHs4thjaghpxqZmk2uVKBxlm4=";
+  cargoHash = "sha256-Shp/2jQtO3pulT2gmsAcsEVPpv76nbEiGol+kYD7kr8=";

  nativeBuildInputs = [
    gettext
--- a/pkgs/by-name/pg/pgrok/package.nix
+++ b/pkgs/by-name/pg/pgrok/package.nix
@ -11,12 +11,12 @@

 let
  pname = "pgrok";
-  version = "1.5.0";
+  version = "1.7.0";
  src = fetchFromGitHub {
    owner = "pgrok";
    repo = "pgrok";
    tag = "v${version}";
-    hash = "sha256-arPFccclBie3XOBt0q6UC96fPaPc7NmgQDMsd2H2bhI=";
+    hash = "sha256-uMHeVxAGmAEIOfCK9SEFsL7GZZIUNMYdoV8XeHjXmWc=";
  };
 in

@ -34,6 +34,18 @@ buildGoModule {
    pnpm_9
  ];

+  postPatch = ''
+    # Rename directories to avoid binary naming conflicts (both would be named "cli")
+    mv pgrok/cli pgrok/pgrok
+    mv pgrokd/cli pgrokd/pgrokd
+
+    # Update references in Go code and web app package.json to match renamed directory
+    substituteInPlace pgrokd/pgrokd/main.go \
+      --replace-fail "github.com/pgrok/pgrok/pgrokd/cli/internal/web" "github.com/pgrok/pgrok/pgrokd/pgrokd/internal/web"
+    substituteInPlace pgrokd/web/package.json \
+      --replace-fail "../cli/internal/web/dist" "../pgrokd/internal/web/dist"
+  '';
+
  env.pnpmDeps = fetchPnpmDeps {
    inherit
      pname
@ -42,10 +54,10 @@ buildGoModule {
      ;
    pnpm = pnpm_9;
    fetcherVersion = 3;
-    hash = "sha256-D8UZoN0ZnjB8CXQiHmBZwBEt57XGb5SDLg61xxSqNus=";
+    hash = "sha256-O3bDxnxeRO20FsRNpgXfz4UweYJmeU6zgrrPJ05fgWo=";
  };

-  vendorHash = "sha256-ob8s1jYL2+JGaqjCsM10jgirPiEyTY4U3IVVlHVdoGQ=";
+  vendorHash = "sha256-fhyyyXHUJsIWiCZbqtLZZRuIG9hb0LAkSo7lKW0i8Sk";

  ldflags = [
    "-s"
@ -66,10 +78,6 @@ buildGoModule {
    pnpm run build

    popd
-
-    # rename packages due to naming conflict
-    mv pgrok/cli/ pgrok/pgrok/
-    mv pgrokd/cli/ pgrokd/pgrokd/
  '';

  postInstall = ''
--- a/pkgs/by-name/po/polybar/package.nix
+++ b/pkgs/by-name/po/polybar/package.nix
@ -8,7 +8,6 @@
  libxdmcp,
  libpthread-stubs,
  libxcb,
-  pcre,
  pkg-config,
  python3,
  python3Packages, # sphinx-build
@ -68,7 +67,6 @@ stdenv.mkDerivation (finalAttrs: {
    libxdmcp
    libpthread-stubs
    libxcb
-    pcre
    python3
    xcbproto
    libxcb-util
--- a/pkgs/by-name/pr/prl-tools/package.nix
+++ b/pkgs/by-name/pr/prl-tools/package.nix
@ -45,13 +45,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "prl-tools";
-  version = "26.3.3-57507";
+  version = "26.4.0-57513";

  # We download the full distribution to extract prl-tools-lin.iso from
  # => ${dmg}/Parallels\ Desktop.app/Contents/Resources/Tools/prl-tools-lin.iso
  src = fetchurl {
    url = "https://download.parallels.com/desktop/v${lib.versions.major finalAttrs.version}/${finalAttrs.version}/ParallelsDesktop-${finalAttrs.version}.dmg";
-    hash = "sha256-QXrzdQ6eY3ikgwMD11/zEkYau/X0mmm2uk6O92r8w1o=";
+    hash = "sha256-Qkul+hZh0J7g8+D+T7RLmfrtK2i90+wlsrfm5tNaYug=";
  };

  hardeningDisable = [
--- a/pkgs/by-name/re/rerun/package.nix
+++ b/pkgs/by-name/re/rerun/package.nix
@ -35,7 +35,7 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "rerun";
-  version = "0.33.0";
+  version = "0.33.1";

  __structuredAttrs = true;
  strictDeps = true;
@ -49,7 +49,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    owner = "rerun-io";
    repo = "rerun";
    tag = finalAttrs.version;
-    hash = "sha256-1jlZ+8jx1dNsWWrkQSyFAIK/VQNSotcyTknz0WhIaIc=";
+    hash = "sha256-GCIrvNNktW9h2/s90tTxFOmiIRAbWQWOS3Ti03EZ/GM=";
  };

  # The path in `build.rs` is wrong for some reason, so we patch it to make the passthru tests work
@ -58,7 +58,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
      --replace-fail '"rerun_sdk/rerun_cli/rerun"' '"rerun_sdk/rerun"'
  '';

-  cargoHash = "sha256-3erI/kWTJ5Exl9QpGidsIizi0UWbudzMSzoscoSTmP8=";
+  cargoHash = "sha256-wCJKerOgOUWNn3wBeHEKn92qzGdICX6P52B2FT5wcZE=";

  cargoBuildFlags = [
    "--package"
--- a/pkgs/by-name/ru/runme/package.nix
+++ b/pkgs/by-name/ru/runme/package.nix
@ -13,16 +13,16 @@

 buildGoModule (finalAttrs: {
  pname = "runme";
-  version = "3.16.11";
+  version = "3.16.15";

  src = fetchFromGitHub {
    owner = "runmedev";
    repo = "runme";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-c01mVr8JW+qghj7q5W3B1NsuH9hQUEq3hVHLT+9VM20=";
+    hash = "sha256-mU8U/aak0FrQEFanVksM/32bsGx5damuf6BxshTk/M0=";
  };

-  vendorHash = "sha256-7F33MmGWIY1z2aw2mJ83XhcOrhT+olGwNmvdgGdxyME=";
+  vendorHash = "sha256-q+NVyzTCKgyOW94O/YWbmgvgUVh9xlnBOMLWCp/0jrM=";

  nativeBuildInputs = [
    installShellFiles
--- a/pkgs/by-name/ti/tinymist/package.nix
+++ b/pkgs/by-name/ti/tinymist/package.nix
@ -15,7 +15,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
  pname = "tinymist";
  # Please update the corresponding vscode extension when updating
  # this derivation.
-  version = "0.15.0";
+  version = "0.15.2";

  __structuredAttrs = true;

@ -23,10 +23,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
    owner = "Myriad-Dreamin";
    repo = "tinymist";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-SfkyyszTmleWHa19jMgHjiOUvBOniVybDr9GBmtMVDw=";
+    hash = "sha256-wNSMjfU3upsqKQQUYx76iFGC+5ghcErlxy65ZJ/LvHk=";
  };

-  cargoHash = "sha256-ztJb2Br0Ph2qSeo9MGm9OdU66YPkep+9lBCrL2TimB4=";
+  cargoHash = "sha256-NEvINvHMD9tVG9kyj84AC8DEAbR0ndjkCHpwR4OD6YA=";

  nativeBuildInputs = [
    installShellFiles
--- a/pkgs/by-name/to/toml-f/package.nix
+++ b/pkgs/by-name/to/toml-f/package.nix
@ -21,11 +21,13 @@ assert (
 stdenv.mkDerivation (finalAttrs: {
  pname = "toml-f";
  version = "0.5.1";
+  __structuredAttrs = true;
+  strictDeps = true;

  src = fetchFromGitHub {
    owner = "toml-f";
    repo = "toml-f";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
    hash = "sha256-lReez2rSAJVnLFngjUYgGkm+HUDH8VsCC2m9zYOOr4A=";
  };

@ -42,7 +44,9 @@ stdenv.mkDerivation (finalAttrs: {
    meson
    ninja
  ]
-  ++ lib.optional (buildType == "cmake") cmake;
+  ++ lib.optionals (buildType == "cmake") [
+    cmake
+  ];

  buildInputs = [ test-drive ];

@ -65,6 +69,7 @@ stdenv.mkDerivation (finalAttrs: {
      mit
    ];
    homepage = "https://github.com/toml-f/toml-f";
+    changelog = "https://github.com/toml-f/toml-f/releases/tag/${finalAttrs.src.tag}";
    platforms = lib.platforms.linux;
    maintainers = [ lib.maintainers.sheepforce ];
  };
--- a/pkgs/by-name/tr/tree-sitter/package.nix
+++ b/pkgs/by-name/tr/tree-sitter/package.nix
@ -18,8 +18,11 @@
  substitute,
  installShellFiles,
  buildPackages,
+  cmake,
+  wasmtime_36,
  enableShared ? !stdenv.hostPlatform.isStatic,
  enableStatic ? stdenv.hostPlatform.isStatic,
+  wasmSupport ? false,
  webUISupport ? false,
 }:

@ -124,9 +127,14 @@ rustPlatform.buildRustPackage (finalAttrs: {

  cargoHash = "sha256-9FeWnWWPUWmMF15Psmul8GxGv2JceHWc2WZPmOr81gw=";

+  cargoBuildFeatures = lib.optionals wasmSupport [ "wasm" ];
+
  buildInputs = [
    installShellFiles
  ]
+  ++ lib.optionals wasmSupport [
+    wasmtime_36
+  ]
  ++ lib.optionals webUISupport [
    openssl
  ];
@ -134,6 +142,9 @@ rustPlatform.buildRustPackage (finalAttrs: {
    rustPlatform.bindgenHook
    which
  ]
+  ++ lib.optionals wasmSupport [
+    cmake
+  ]
  ++ lib.optionals webUISupport [
    emscripten
    pkg-config
@ -164,6 +175,15 @@ rustPlatform.buildRustPackage (finalAttrs: {
      sed -i '/^install:/,/^[^[:space:]]/ { /$(SOEXT/d; }' ./Makefile
    '';

+  # The Makefile install can't enable the wasm feature.
+  cmakeFlags = lib.optionals wasmSupport [
+    (lib.cmakeBool "TREE_SITTER_FEATURE_WASM" true)
+    (lib.cmakeFeature "WASMTIME_INCLUDE_DIR" "${lib.getDev wasmtime_36}/include")
+    (lib.cmakeFeature "WASMTIME_LIBRARY" "${lib.getLib wasmtime_36}/lib/libwasmtime${stdenv.hostPlatform.extensions.sharedLibrary}")
+    (lib.cmakeFeature "CMAKE_INSTALL_INCLUDEDIR" "include")
+    (lib.cmakeFeature "CMAKE_INSTALL_LIBDIR" "lib")
+  ];
+
  # Compile web assembly with emscripten. The --debug flag prevents us from
  # minifying the JavaScript; passing it allows us to side-step more Node
  # JS dependencies for installation.
@ -175,6 +195,11 @@ rustPlatform.buildRustPackage (finalAttrs: {

  postInstall = ''
    PREFIX=$out make install
+  ''
+  + lib.optionalString wasmSupport ''
+    cmake --install $cmakeBuildDir
+  ''
+  + ''
    ${lib.optionalString (!enableShared) "rm -f $out/lib/*.so{,.*}"}
    ${lib.optionalString (!enableStatic) "rm -f $out/lib/*.a"}

@ -196,6 +221,16 @@ rustPlatform.buildRustPackage (finalAttrs: {
  # test result: FAILED. 120 passed; 13 failed; 0 ignored; 0 measured; 0 filtered out
  doCheck = false;

+  # CMake builds libtree-sitter with wasm support; cargo still builds the CLI.
+  ${if wasmSupport then "configurePhase" else null} = ''
+    cmakeConfigurePhase
+    cd ..
+  '';
+
+  ${if wasmSupport then "postBuild" else null} = ''
+    cmake --build $cmakeBuildDir
+  '';
+
  passthru = {
    inherit
      grammars
--- a/pkgs/by-name/va/vault-bin/package.nix
+++ b/pkgs/by-name/va/vault-bin/package.nix
@ -6,7 +6,7 @@

 stdenv.mkDerivation rec {
  pname = "vault-bin";
-  version = "2.0.0";
+  version = "2.0.3";

  src =
    let
@ -20,11 +20,11 @@ stdenv.mkDerivation rec {
        aarch64-darwin = "darwin_arm64";
      };
      hash = selectSystem {
-        x86_64-linux = "sha256-Zp/rbxNa9gDFHclb0Mb2jYfav6jVGfSYvpybEFOaQ+U=";
-        aarch64-linux = "sha256-qenfLCdDrIsJZMzv2CO3VDcI9TwzRfh/KbFvojFwGhQ=";
-        i686-linux = "sha256-hGqJUlK92XO3APCUeJTiLnVHNh6r1MfskEbtYMjDg7I=";
-        x86_64-darwin = "sha256-WJFs/8Lq2VBVMF2wls5EHFfe4ClLJOoxO91+5oGl6Ko=";
-        aarch64-darwin = "sha256-3wfrn05JeYho9+F6lmgT8cZdlogV+7IhJ/kwj09OeOA=";
+        x86_64-linux = "sha256-THVYezhV7TmChy8IKsE8Agx6ks4wFctuk+GevXhwRv8=";
+        aarch64-linux = "sha256-Wmlpw9gzbdCvgCwf3Nh9JPjjmDKS2P0TNYaRvKqO4fg=";
+        i686-linux = "sha256-Fdxq1r1G17kiCl7b9OBrWwkyo+VoKOvrUPf0p4wZlcs=";
+        x86_64-darwin = "sha256-tyQzmycXo4kSvo1X4afFU2aWuXyvyvw0mb81eiH3WjE=";
+        aarch64-darwin = "sha256-+zor3j+7saG6AnuIlkJSAsCkMHYuhm0Abmt6TTu8bZI=";
      };
    in
    fetchzip {
--- a/pkgs/by-name/wa/wasmtime/package.nix
+++ b/pkgs/by-name/wa/wasmtime/package.nix
@ -10,23 +10,40 @@
  nix-update-script,
  enableShared ? !stdenv.hostPlatform.isStatic,
  enableStatic ? stdenv.hostPlatform.isStatic,
+  majorVersion ? "45",
 }:
+let
+  sources = {
+    "36" = {
+      version = "36.0.11";
+      hash = "sha256-rrSI2dSOA8/1CL7JhW0eQ7LaeS5EqTVnyn2HTI+/x20=";
+      cargoHash = "sha256-S67/fv7179uDy4PpwycyXSWAknIC/7ZzvzWPOd6MD+8=";
+    };
+    "45" = {
+
+      version = "45.0.2";
+      hash = "sha256-LEQitwz+UDSX4mrjEecmoO/ZPgRnYTZ3DsD1pu8Jybs=";
+      cargoHash = "sha256-uTgEW2w0RSMetd2W1ucGiVMEEvz2A7CQ79SEsE8/+BM=";
+    };
+  };
+  source = sources.${majorVersion};
+in
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "wasmtime";
-  version = "45.0.2";
+  version = source.version;

  src = fetchFromGitHub {
    owner = "bytecodealliance";
    repo = "wasmtime";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-LEQitwz+UDSX4mrjEecmoO/ZPgRnYTZ3DsD1pu8Jybs=";
+    hash = source.hash;
    fetchSubmodules = true;
  };

  # Disable cargo-auditable until https://github.com/rust-secure-code/cargo-auditable/issues/124 is solved.
  auditable = false;

-  cargoHash = "sha256-uTgEW2w0RSMetd2W1ucGiVMEEvz2A7CQ79SEsE8/+BM=";
+  cargoHash = source.cargoHash;
  cargoBuildFlags = [
    "--package"
    "wasmtime-cli"
--- a/pkgs/by-name/wa/wasmtime_36/package.nix
+++ b/pkgs/by-name/wa/wasmtime_36/package.nix
@ -0,0 +1,18 @@
+{
+  nix-update-script,
+  wasmtime,
+}:
+
+# NOTE: LTS Version EOL August 20 2027
+(wasmtime.override { majorVersion = "36"; }).overrideAttrs (old: {
+  __structuredAttrs = true;
+
+  passthru = old.passthru // {
+    updateScript = nix-update-script {
+      extraArgs = [
+        "--version-regex"
+        "^v(36\\.\\d+\\.\\d+)$"
+      ];
+    };
+  };
+})
--- a/pkgs/by-name/wa/wastebin/package.nix
+++ b/pkgs/by-name/wa/wastebin/package.nix
@ -10,16 +10,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "wastebin";
-  version = "3.6.2";
+  version = "3.7.0";

  src = fetchFromGitHub {
    owner = "matze";
    repo = "wastebin";
    rev = finalAttrs.version;
-    hash = "sha256-pORShre3lLgI8UE9iZ7gicQbGbZM06IgYnKLLwOYm/s=";
+    hash = "sha256-uWr2xJjWcm0WmOB6eD2pdzUch7HSk9KdHV31FoYHr0E=";
  };

-  cargoHash = "sha256-fpEG0J+l/kRq5s6G0rzDsshbKM44fZfVeURFPhFeV7s=";
+  cargoHash = "sha256-m5cO3J4LryO+pS991DkS+4J6dw8ltP9sJR88FVGdsdw=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/by-name/xh/xh/package.nix
+++ b/pkgs/by-name/xh/xh/package.nix
@ -13,16 +13,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "xh";
-  version = "0.25.3";
+  version = "0.26.1";

  src = fetchFromGitHub {
    owner = "ducaale";
    repo = "xh";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-WRYClBIjw67lVrzvnIMqVHd6toi5yU7nClViqfXahKA=";
+    hash = "sha256-Y8T/r7DaKha0cjWewJPzq4jo6Lab18cDrAj8Ek1D5Bg=";
  };

-  cargoHash = "sha256-T2ZaijWXyH8ZJKFTTngGtQsdRWL9re4i3nKHp8srWSI=";
+  cargoHash = "sha256-JjXv4QMmOF0xsRloaKqbdJ8ztHtEg80QRJmnTW1/3Lc=";

  buildFeatures = lib.optional withNativeTls "native-tls";

--- a/pkgs/by-name/xt/xtb/package.nix
+++ b/pkgs/by-name/xt/xtb/package.nix
@ -0,0 +1,112 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+
+  # nativeBuildInputs
+  gfortran,
+  meson,
+  ninja,
+  pkg-config,
+
+  # buildInputs
+  blas,
+  lapack,
+  cpcm-x,
+  dftd4,
+  mctc-lib,
+  multicharge,
+  numsa,
+  simple-dftd3,
+  tblite,
+  test-drive,
+  toml-f,
+
+  # passthru
+  nix-update-script,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "xtb";
+  # No tagged release supports the tblite 0.6 / dftd4 4.2 API; the latest tag (6.7.1) targets
+  # tblite 0.3. Track master, which builds against the current grimme-lab stack packaged in nixpkgs
+  version = "6.7.1-unstable-2026-05-16";
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  src = fetchFromGitHub {
+    owner = "grimme-lab";
+    repo = "xtb";
+    rev = "2b5cd4829290775e575807daee21560f851ff7e1";
+    hash = "sha256-dnpmbjLG6xKSLXEUdwndsA0ADTEyaTY9fJiOSXI7jD4=";
+  };
+
+  # The `solve`/`solve4` eigensolvers size the DSYGVD workspace from a `LWORK = -1` query.
+  # OpenBLAS leaves `aux(1)` as a denormal/garbage value on that query, so `int(aux(1))` falls
+  # below DSYGVD's documented minimum and the real call aborts with `DSYGVD parameter number 11 had
+  # an illegal value` (it works against reference LAPACK, which fills the query correctly).
+  # This surfaces as failures in the `gfn0` and `peeq` unit tests. Clamp the workspace sizes to the
+  # LAPACK minima so the query result can only ever grow them.
+  postPatch = ''
+    substituteInPlace src/scc_core.f90 \
+      --replace-fail "lwork=int(aux(1))"  "lwork=max(int(aux(1)),1+6*ndim+2*ndim**2)" \
+      --replace-fail "lwork=int(aux4(1))" "lwork=max(int(aux4(1)),1+6*ndim+2*ndim**2)" \
+      --replace-fail "liwork=iwork(1)"    "liwork=max(iwork(1),3+5*ndim)"
+  '';
+
+  nativeBuildInputs = [
+    gfortran
+    meson
+    ninja
+    pkg-config
+  ];
+
+  mesonFlags = [
+    # Require the optional backends rather than letting the `auto` features
+    # silently disable themselves if a dependency is not found.
+    (lib.mesonEnable "tblite" true)
+    (lib.mesonEnable "cpcmx" true)
+  ];
+
+  # Serialize the build: ninja otherwise compiles xtb's program/library objects before the
+  # library's Fortran modules are generated.
+  # `enableParallel` only controls the explicit -j flag and ninja parallelizes regardless, so the
+  # race has to be killed with an explicit -j1.
+  ninjaFlags = [ "-j1" ];
+
+  buildInputs = [
+    blas
+    cpcm-x
+    dftd4
+    lapack
+    mctc-lib
+    multicharge
+    numsa
+    simple-dftd3
+    tblite
+    test-drive
+    toml-f
+  ];
+
+  doCheck = true;
+  preCheck = ''
+    export OMP_NUM_THREADS=2
+  '';
+
+  passthru.updateScript = nix-update-script {
+    extraArgs = [ "--version=branch" ];
+  };
+
+  meta = {
+    description = "Semiempirical Extended Tight-Binding Program Package";
+    homepage = "https://github.com/grimme-lab/xtb";
+    # changelog = "https://github.com/grimme-lab/xtb/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [
+      GaetanLepage
+      sheepforce
+    ];
+    mainProgram = "xtb";
+    platforms = lib.platforms.linux;
+  };
+})
--- a/pkgs/by-name/za/zashboard/package.nix
+++ b/pkgs/by-name/za/zashboard/package.nix
@ -12,13 +12,13 @@ let
 in
 buildNpmPackage (finalAttrs: {
  pname = "zashboard";
-  version = "3.9.0";
+  version = "3.10.1";

  src = fetchFromGitHub {
    owner = "Zephyruso";
    repo = "zashboard";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-QUu1HNGjxcT/oNO6XEiUpQ6TfMwLv9MQIsAtff+hYsY=";
+    hash = "sha256-unk/QO2V5BzuY8TL8Z1K/EPPMB6JwW15OQICix8Mukk=";
  };

  npmDeps = null;
@ -26,7 +26,7 @@ buildNpmPackage (finalAttrs: {
    inherit (finalAttrs) pname version src;
    inherit pnpm;
    fetcherVersion = 3;
-    hash = "sha256-reYRJgLBxz+/J1wwPG4sO953R4xN0L6JInRJauseFc8=";
+    hash = "sha256-7bjsqBQssirsrIbegm5G/J/v3+yzfomq/gxCbxKEb6g=";
  };

  nativeBuildInputs = [ pnpm ];
--- a/pkgs/development/compilers/openjdk/11/patches/fix-oopdesc-ptr-alignment-ub.patch
+++ b/pkgs/development/compilers/openjdk/11/patches/fix-oopdesc-ptr-alignment-ub.patch
--- a/pkgs/development/compilers/openjdk/generic.nix
+++ b/pkgs/development/compilers/openjdk/generic.nix
@ -234,6 +234,9 @@ stdenv.mkDerivation (finalAttrs: {
      else
        ./8/patches/swing-use-gtk-jdk8.patch
    )
+  ]
+  ++ lib.optionals (featureVersion == "11") [
+    ./11/patches/fix-oopdesc-ptr-alignment-ub.patch
  ];

  strictDeps = true;
--- a/pkgs/development/libraries/science/chemistry/tblite/default.nix
+++ b/pkgs/development/libraries/science/chemistry/tblite/default.nix
@ -27,14 +27,16 @@ assert (
  ]
 );

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "tblite";
  version = "0.6.0";
+  __structuredAttrs = true;
+  strictDeps = true;

  src = fetchFromGitHub {
    owner = "tblite";
    repo = "tblite";
-    rev = "v${version}";
+    tag = "v${finalAttrs.version}";
    hash = "sha256-z0g+bf6APqNLB9mDE49FelitQ9ptZXdFQuYeXIT0NIw=";
  };

@ -86,7 +88,9 @@ stdenv.mkDerivation rec {
    "dev"
  ];

-  checkInputs = [
+  nativeCheckInputs = [
+    # Runs python test drivers (test/*/tester.py) during checkPhase, so it must be available on the
+    # build host (strictDeps)
    python3
  ];

@ -108,7 +112,8 @@ stdenv.mkDerivation rec {
      lgpl3Plus
    ];
    homepage = "https://github.com/tblite/tblite";
+    changelog = "https://github.com/tblite/tblite/releases/tag/${finalAttrs.src.tag}";
    platforms = lib.platforms.linux;
    maintainers = [ lib.maintainers.sheepforce ];
  };
-}
+})
--- a/pkgs/development/ocaml-modules/aeneas/default.nix
+++ b/pkgs/development/ocaml-modules/aeneas/default.nix
@ -8,6 +8,7 @@
  core_unix,
  domainslib,
  ocamlgraph,
+  ppx_deriving_yojson,
  progress,
  visitors,

@ -16,7 +17,7 @@

 buildDunePackage (finalAttrs: {
  pname = "aeneas";
-  version = "2026.06.14";
+  version = "2026.06.22";
  __structuredAttrs = true;

  minimalOCamlVersion = "5.1";
@ -25,7 +26,7 @@ buildDunePackage (finalAttrs: {
    owner = "AeneasVerif";
    repo = "aeneas";
    tag = "nightly-${finalAttrs.version}";
-    hash = "sha256-ef68sJtVdKlIr7IiZSehFlG87m1BjW5HSG8PYxbs3Lg=";
+    hash = "sha256-T/wiTajDKCG4lFcHtdQvO0AhEzX9F+vT6ij2VBBnvdU=";
  };

  sourceRoot = "${finalAttrs.src.name}/src";
@ -35,6 +36,7 @@ buildDunePackage (finalAttrs: {
    core_unix
    domainslib
    ocamlgraph
+    ppx_deriving_yojson
    progress
    visitors
  ];
--- a/pkgs/development/ocaml-modules/ca-certs-nss/default.nix
+++ b/pkgs/development/ocaml-modules/ca-certs-nss/default.nix
@ -14,13 +14,13 @@

 buildDunePackage (finalAttrs: {
  pname = "ca-certs-nss";
-  version = "3.121";
+  version = "3.125";

  minimalOCamlVersion = "4.13";

  src = fetchurl {
    url = "https://github.com/mirage/ca-certs-nss/releases/download/v${finalAttrs.version}/ca-certs-nss-${finalAttrs.version}.tbz";
-    hash = "sha256-KLFr7n9DORIkRHXud/xe61DkxKAKPZ1TopGCeK5h45w=";
+    hash = "sha256-mF0XgW/8YiZjDSaAjloI6cIEGJbEuclYitZ6kAmyWWQ=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/ocaml-modules/charon/default.nix
+++ b/pkgs/development/ocaml-modules/charon/default.nix
@ -16,14 +16,14 @@

 buildDunePackage (finalAttrs: {
  pname = "charon";
-  version = "2026.06.14";
+  version = "2026.06.22";
  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "AeneasVerif";
    repo = "charon";
    tag = "nightly-${finalAttrs.version}";
-    hash = "sha256-EZ1Ueco4vK4mUKyOGXXHgToNLMp+1W7095HyU+1zQ2Q=";
+    hash = "sha256-Wz2iVkHZLHwgIycHTNCmST5gizupU3xGTo0scfdq8T0=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/ocaml-modules/windtrap/default.nix
+++ b/pkgs/development/ocaml-modules/windtrap/default.nix
@ -0,0 +1,31 @@
+{
+  lib,
+  fetchurl,
+  buildDunePackage,
+}:
+
+buildDunePackage {
+  pname = "windtrap";
+  version = "0.1.0";
+  minimalOCamlVersion = "5.0";
+
+  src = fetchurl {
+    url = "https://github.com/invariant-hq/windtrap/releases/download/0.1.0/windtrap-0.1.0.tbz";
+    hash = "sha256-IkGylLJO1dVuqLg00pbm+rxdvdkkqJ9RwUsA2mbFCiU=";
+  };
+
+  doCheck = true;
+
+  # this force to skip "collapse_home" tests, because $HOME != getpwuid in the
+  # sandbox
+  preCheck = ''
+    unset HOME
+  '';
+
+  meta = {
+    description = "Unit tests, property-based tests, snapshot tests, and expect tests in a single package with one API.";
+    homepage = "https://ocaml.org/p/windtrap";
+    license = lib.licenses.isc;
+    maintainers = [ lib.maintainers.joblade ];
+  };
+}
--- a/pkgs/development/python-modules/badsecrets/default.nix
+++ b/pkgs/development/python-modules/badsecrets/default.nix
@ -1,49 +1,48 @@
 {
  lib,
+  blasthttp,
  buildPythonPackage,
  colorama,
  django,
  fetchFromGitHub,
  flask-unsign,
-  poetry-core,
-  poetry-dynamic-versioning,
+  hatchling,
  pycryptodome,
  pyjwt,
  requests,
-  viewstate,
+  yara-python,
 }:

 buildPythonPackage (finalAttrs: {
  pname = "badsecrets";
-  version = "0.13.47";
+  version = "1.2.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "blacklanternsecurity";
    repo = "badsecrets";
-    tag = "v${finalAttrs.version}";
-    hash = "sha256-Yvd9AGbVDOfXep8y+XzwYP2EpTvy+rwyz5hRIe7v4oc=";
+    tag = finalAttrs.version;
+    hash = "sha256-fhRQvVb+JUP1DyTMAV7leIAKD/L4kRhGFYtD78cYABI=";
  };

  pythonRelaxDeps = [
    "django"
-    "viewstate"
+    "pyjwt"
  ];

-  build-system = [
-    poetry-core
-    poetry-dynamic-versioning
-  ];
+  build-system = [ hatchling ];

  dependencies = [
+    blasthttp
    colorama
    django
    flask-unsign
    pycryptodome
    pyjwt
    requests
-    viewstate
-  ];
+    yara-python
+  ]
+  ++ pyjwt.optional-dependencies.crypto;

  pythonImportsCheck = [ "badsecrets" ];

--- a/pkgs/development/python-modules/blasthttp/default.nix
+++ b/pkgs/development/python-modules/blasthttp/default.nix
@ -0,0 +1,80 @@
+{
+  lib,
+  stdenv,
+  buildPythonPackage,
+  cargo,
+  fetchPypi,
+  nix-update-script,
+  openssl,
+  pkg-config,
+  pytest-asyncio,
+  pytestCheckHook,
+  rustc,
+  rustPlatform,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "blasthttp";
+  version = "0.9.0";
+  pyproject = true;
+
+  __structuredAttrs = true;
+
+  src = fetchPypi {
+    inherit (finalAttrs) pname version;
+    hash = "sha256-JuoGy+QdBsVPMtD0T4Y/NSoeJcO7dwg3HmpqHxTxCIc=";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit (finalAttrs) pname version src;
+    hash = "sha256-1+OFAD9n8JntZSV+PZbYLPRM/XDlFwgrEMFGv/LzTN8=";
+  };
+
+  postPatch = ''
+    # The bundled .cargo/config.toml sets OPENSSL_DIR to a relative path
+    rm .cargo/config.toml
+  '';
+
+  __darwinAllowLocalNetworking = true;
+
+  env = {
+    OPENSSL_NO_VENDOR = "1";
+  };
+
+  build-system = [
+    cargo
+    pkg-config
+    rustPlatform.cargoSetupHook
+    rustPlatform.maturinBuildHook
+    rustc
+  ];
+
+  buildInputs = [ openssl ];
+
+  nativeCheckInputs = [
+    openssl
+    pytest-asyncio
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [ "blasthttp" ];
+
+  disabledTestPaths = lib.optionals stdenv.hostPlatform.isDarwin [
+    "tests/python/test_ssl_verify.py"
+    "tests/python/test_response_api.py"
+  ];
+
+  disabledTests = lib.optionals stdenv.hostPlatform.isDarwin [
+    "test_redirect_onto_proxied_host_reevaluates_no_proxy"
+    "test_redirect_onto_no_proxy_host_reevaluates_to_direct"
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Offensive-first HTTP library";
+    homepage = "https://pypi.org/project/blasthttp";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+})
--- a/pkgs/development/python-modules/brax/default.nix
+++ b/pkgs/development/python-modules/brax/default.nix
@ -54,13 +54,21 @@ buildPythonPackage (finalAttrs: {
    ./dont-use-device_put_replicated-compat.patch
  ];

-  # TypeError: clip() got an unexpected keyword argument 'a_min'
-  postPatch = ''
-    substituteInPlace brax/fluid.py \
-      --replace-fail \
-        "box = 6.0 * jp.clip(jp.sum(diag_inertia_v, axis=-1), a_min=1e-12)" \
-        "box = 6.0 * jp.clip(jp.sum(diag_inertia_v, axis=-1), min=1e-12)"
-  '';
+  postPatch =
+    # TypeError: clip() got an unexpected keyword argument 'a_min'
+    ''
+      substituteInPlace brax/fluid.py \
+        --replace-fail \
+          "box = 6.0 * jp.clip(jp.sum(diag_inertia_v, axis=-1), a_min=1e-12)" \
+          "box = 6.0 * jp.clip(jp.sum(diag_inertia_v, axis=-1), min=1e-12)"
+    ''
+    # mujoco >= 3.10 changed mj_fullM's signature from (m, dst, qM) to (m, d, dst).
+    + ''
+      substituteInPlace brax/generalized/mass_test.py \
+        --replace-fail \
+          "mujoco.mj_fullM(model, mj_mass_mx, mj_next.qM)" \
+          "mujoco.mj_fullM(model, mj_next, mj_mass_mx)"
+    '';

  build-system = [
    hatchling
--- a/pkgs/development/python-modules/devito/default.nix
+++ b/pkgs/development/python-modules/devito/default.nix
@ -32,14 +32,15 @@

 buildPythonPackage (finalAttrs: {
  pname = "devito";
-  version = "4.8.21";
+  version = "4.8.22";
  pyproject = true;
+  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "devitocodes";
    repo = "devito";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-nD1bUFv24lnonajUG6m5yhGUAC0pVtSKTX69JwSt69E=";
+    hash = "sha256-7bHMMZKm+n+wSVGUSSoYQjXklxzdTeyCkjMuK0Z8qTI=";
  };

  patches = [
--- a/pkgs/development/python-modules/dm-control/default.nix
+++ b/pkgs/development/python-modules/dm-control/default.nix
@ -29,7 +29,7 @@

 buildPythonPackage (finalAttrs: {
  pname = "dm-control";
-  version = "1.0.41";
+  version = "1.0.43";
  pyproject = true;
  __structuredAttrs = true;

@ -37,7 +37,7 @@ buildPythonPackage (finalAttrs: {
    owner = "google-deepmind";
    repo = "dm_control";
    tag = finalAttrs.version;
-    hash = "sha256-AxyxI9sRF822oNLk/zVUnGVRGSQ3BHCBQJ9HtD8aL/M=";
+    hash = "sha256-6c67sOcKsygtjdn3NOjfK0K3IsZIOZHDMXr5qMp+W5A=";
  };

  build-system = [
--- a/pkgs/development/python-modules/funsor/default.nix
+++ b/pkgs/development/python-modules/funsor/default.nix
@ -14,7 +14,7 @@
  opt-einsum,
  typing-extensions,

-  # checks
+  # tests
  pyro-ppl,
  torch,
  pandas,
@ -25,20 +25,19 @@
  requests,
  scipy,
  torchvision,
-
-  stdenv,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "funsor";
-  version = "0.4.6";
+  version = "0.4.7";
  pyproject = true;
+  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "pyro-ppl";
    repo = "funsor";
-    tag = version;
-    hash = "sha256-Prj1saT0yoPAP8rDE0ipBEpR3QMk4PS12VSJlxc22p8=";
+    tag = finalAttrs.version;
+    hash = "sha256-0STJv1OOliJaHdmYUXdnOnocH3hVXceH/Uw5nILvT+U=";
  };

  patches = [
@ -49,13 +48,6 @@ buildPythonPackage rec {
    })
  ];

-  # TypeError: clip() got an unexpected keyword argument 'a_max'
-  postPatch = ''
-    substituteInPlace funsor/jax/ops.py \
-      --replace-fail "a_max=" "max=" \
-      --replace-fail "a_min=" "min="
-  '';
-
  build-system = [ setuptools ];

  dependencies = [
@ -87,24 +79,11 @@ buildPythonPackage rec {

  pythonImportsCheck = [ "funsor" ];

-  disabledTests = [
-    # `test_torch_save` got broken by the update of torch (2.3.1 -> 2.4.0):
-    # FutureWarning: You are using `torch.load` with `weights_only=False`...
-    # TODO: Try to re-enable this test at next release
-    "test_torch_save"
-  ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    # Failures related to JIT
-    # RuntimeError: required keyword attribute 'Subgraph' has the wrong type
-    "test_local_param_ok"
-    "test_plate_ok"
-  ];
-
  meta = {
    description = "Functional tensors for probabilistic programming";
    homepage = "https://funsor.pyro.ai";
-    changelog = "https://github.com/pyro-ppl/funsor/releases/tag/${version}";
+    changelog = "https://github.com/pyro-ppl/funsor/releases/tag/${finalAttrs.src.tag}";
    license = lib.licenses.asl20;
    maintainers = with lib.maintainers; [ GaetanLepage ];
  };
-}
+})
--- a/pkgs/development/python-modules/iamdata/default.nix
+++ b/pkgs/development/python-modules/iamdata/default.nix
@ -8,14 +8,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "iamdata";
-  version = "0.1.202606221";
+  version = "0.1.202606231";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "cloud-copilot";
    repo = "iam-data-python";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-qJJGLgkqvDTqozTCb+1sTLcbWwsVh1JVyOEirNpBGlc=";
+    hash = "sha256-IQWbG1aPrQ8mgzCa8XFMiZDPeMStIy/L9WubtMKpCbI=";
  };

  __darwinAllowLocalNetworking = true;
--- a/pkgs/development/python-modules/mujoco/default.nix
+++ b/pkgs/development/python-modules/mujoco/default.nix
@ -31,6 +31,7 @@ buildPythonPackage (finalAttrs: {
  inherit (mujoco) version;

  pyproject = true;
+  __structuredAttrs = true;

  # We do not fetch from the repository because the PyPi tarball is
  # impurely build via
@ -38,7 +39,7 @@ buildPythonPackage (finalAttrs: {
  # in the project's CI.
  src = fetchPypi {
    inherit (finalAttrs) pname version;
-    hash = "sha256-AZoLNAaJK8mEVOr1XL0n+F0Wd1iteF93xgimHzo0rRc=";
+    hash = "sha256-yejV2H2CIE7VvMyH2EPApT51qvOB3ik47EbQTxrG4k4=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/development/python-modules/opower/default.nix
+++ b/pkgs/development/python-modules/opower/default.nix
@ -15,14 +15,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "opower";
-  version = "0.18.5";
+  version = "0.18.6";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "tronikos";
    repo = "opower";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-s6nacD6k9OgByt2ZdBrZsHtAhdUto7gngqqQWI3henY=";
+    hash = "sha256-lOmd/eyU0XDPbAjW2ur9lSlq5ECv80/1FZXjLaZ92e4=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/osc-lib/default.nix
+++ b/pkgs/development/python-modules/osc-lib/default.nix
@ -25,7 +25,7 @@ buildPythonPackage rec {
    owner = "openstack";
    repo = "osc-lib";
    tag = version;
-    hash = "sha256-HYRm3GdgGUZqi7sqe2wmni2t0t7Ox3qJAukGABKPoyY=";
+    hash = "sha256-XwOJSd3k/74FvSZGveSTjH+KGLlQ2jNbk8GrTzFhbL0=";
  };

  patches = [
--- a/pkgs/development/python-modules/pydocket/default.nix
+++ b/pkgs/development/python-modules/pydocket/default.nix
@ -25,7 +25,7 @@

 buildPythonPackage (finalAttrs: {
  pname = "pydocket";
-  version = "0.21.1";
+  version = "0.22.0";
  pyproject = true;
  __structuredAttrs = true;

@ -33,7 +33,7 @@ buildPythonPackage (finalAttrs: {
    owner = "chrisguidry";
    repo = "docket";
    tag = finalAttrs.version;
-    hash = "sha256-2YBX/PaR0ebQBkx/Z72TSxlTzY8MWBJu+0mEanLfvnU=";
+    hash = "sha256-WbOXUB6nYeD248K3pE5s1NIf+73dZcuqchQ/Nfw9AbA=";
  };

  build-system = [
--- a/pkgs/development/python-modules/python-openstackclient/default.nix
+++ b/pkgs/development/python-modules/python-openstackclient/default.nix
@ -82,11 +82,6 @@ buildPythonPackage (finalAttrs: {
    stestrCheckHook
  ];

-  disabledTestsRegex = [
-    "openstackclient.tests.unit.common.test_module.TestModuleList*"
-    "openstackclient.tests.unit.common.test_clientmanager.TestClientManager*"
-  ];
-
  pythonImportsCheck = [
    "openstackclient"
    "openstackclient.api"
--- a/pkgs/development/python-modules/rerun-notebook/default.nix
+++ b/pkgs/development/python-modules/rerun-notebook/default.nix
@ -22,7 +22,7 @@ buildPythonPackage (finalAttrs: {
    inherit (finalAttrs) version;
    format = "wheel";
    python = "py2.py3";
-    hash = "sha256-GDgqFShq40hcptQPie9pwyZFed/9kBmvke5/OwfHl6M=";
+    hash = "sha256-PiZOxfVyqTwK0oSQ57TLpDIzuZUSecSEDmJtfdqqCGo=";
  };

  pythonRelaxDeps = [
--- a/pkgs/development/python-modules/stanza/default.nix
+++ b/pkgs/development/python-modules/stanza/default.nix
@ -6,6 +6,7 @@
  setuptools,
  # dependencies
  emoji,
+  huggingface-hub,
  networkx,
  numpy,
  peft,
@ -20,20 +21,21 @@

 buildPythonPackage (finalAttrs: {
  pname = "stanza";
-  version = "1.12.2";
+  version = "1.13.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "stanfordnlp";
    repo = "stanza";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-hUI8sZDwBK8ZRS9asyDiTqpoIGnGbHeH/Q9i/gasut0=";
+    hash = "sha256-+quLNaxaGCUpsg3PH11nEMeKjIoHsKaBqK4FdIHlaMM=";
  };

  build-system = [ setuptools ];

  dependencies = [
    emoji
+    huggingface-hub
    networkx
    numpy
    peft
--- a/pkgs/development/python-modules/symbolic/default.nix
+++ b/pkgs/development/python-modules/symbolic/default.nix
@ -14,7 +14,7 @@

 buildPythonPackage (finalAttrs: {
  pname = "symbolic";
-  version = "13.2.0";
+  version = "13.3.1";
  pyproject = true;

  src = fetchFromGitHub {
@ -23,12 +23,12 @@ buildPythonPackage (finalAttrs: {
    tag = finalAttrs.version;
    # the `py` directory is not included in the tarball, so we fetch the source via git instead
    forceFetchGit = true;
-    hash = "sha256-Nks8CClNENRFBbEGgFP3yhi5sWR/iiaLOdTayPD7M9k=";
+    hash = "sha256-w2suCkNxuHGLnf8+RsXwyZWYKGT/41rrckVUWQgT1bg=";
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
    inherit (finalAttrs) pname version src;
-    hash = "sha256-r+9mrGyr78UenC9BFpW1a+VjEAXgcamLOoI8V1N10Cg=";
+    hash = "sha256-6AnNOTdiUvJbmB4TJdEipKoTLXHlJb5WPX51GtJy+II=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
+++ b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
@ -9,14 +9,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "tencentcloud-sdk-python";
-  version = "3.1.119";
+  version = "3.1.120";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "TencentCloud";
    repo = "tencentcloud-sdk-python";
    tag = finalAttrs.version;
-    hash = "sha256-6uPKhXonPxWIwyXYlURSukwDg0WJnUkA4wCcNxWimlY=";
+    hash = "sha256-VJnFj/NeGKT223boJWMZZC/LxHdu+pqNexd+ezuq/js=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/typst/default.nix
+++ b/pkgs/development/python-modules/typst/default.nix
@ -12,19 +12,19 @@

 buildPythonPackage (finalAttrs: {
  pname = "typst";
-  version = "0.14.9";
+  version = "0.15.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "messense";
    repo = "typst-py";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-BiheOVvXPoLGtOzObZte38RkMVkUMOsFURn5DU1cw+o=";
+    hash = "sha256-9wHUikOf/WULPaGkCOXa0aXcSme+xbweC6IDwaJnwRk=";
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
    inherit (finalAttrs) pname version src;
-    hash = "sha256-PM0WntALVI/ks7N/Uk5tjcb0XBr2PSUY+O1nalFg2JQ=";
+    hash = "sha256-TyLKnJUVbodCHQXhpjIr1numNDmeUkvpsKH1o5tWFCM=";
  };

  build-system = [
--- a/pkgs/development/python-modules/victron-mqtt/default.nix
+++ b/pkgs/development/python-modules/victron-mqtt/default.nix
@ -12,14 +12,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "victron-mqtt";
-  version = "2026.6.4";
+  version = "2026.6.7";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "tomer-w";
    repo = "victron_mqtt";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-lKntAZF9SkSBnlLwcwMB9wZz9PviRbSbweTMzwwzExY=";
+    hash = "sha256-06+vn0HKvml3VRvPnQHz832OQnbvjd8tJEcnE6TIer8=";
  };

  build-system = [
--- a/pkgs/development/python-modules/xknx/default.nix
+++ b/pkgs/development/python-modules/xknx/default.nix
@ -12,14 +12,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "xknx";
-  version = "3.15.0";
+  version = "3.16.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "XKNX";
    repo = "xknx";
    tag = finalAttrs.version;
-    hash = "sha256-EA6F4Wkji495uVfFyN1M+jZsXFkKbfK7POie3qbuqBY=";
+    hash = "sha256-884iWQynTRBauJR10CzgkveoD9//Dq+mpvywtSnmT+c=";
  };

  build-system = [ setuptools ];
--- a/pkgs/kde/generated/sources/plasma.json
+++ b/pkgs/kde/generated/sources/plasma.json
@ -1,377 +1,377 @@
 {
  "aurorae": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/aurorae-6.7.0.tar.xz",
-    "hash": "sha256-U4Ij6+dSEwXSmHPCePheeRDreBCjHSppaY7edqXA2jw="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/aurorae-6.7.1.tar.xz",
+    "hash": "sha256-q++RuE02QRSkXyi8TLCHzPJCZQ53NzCB8qouJdAPEaQ="
  },
  "bluedevil": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/bluedevil-6.7.0.tar.xz",
-    "hash": "sha256-P9q0pyS6JGoQ8mNwdspTMniP/1w8YZPM806wMeiXPp0="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/bluedevil-6.7.1.tar.xz",
+    "hash": "sha256-HR6ao2cFBVtrHlMiO2B3dXy7okJeYmk8HjEtSU/4rPs="
  },
  "breeze": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/breeze-6.7.0.tar.xz",
-    "hash": "sha256-zzdbuqpF9bobPfA2vwxAt+39eJ6yb25G+d0dMldpy9U="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/breeze-6.7.1.tar.xz",
+    "hash": "sha256-BXoVTUYZ7/aI+OSJ+6EW43Q7dj0y3rERuwCCqRk8n5M="
  },
  "breeze-grub": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/breeze-grub-6.7.0.tar.xz",
-    "hash": "sha256-x+atJoKHKWS9cJucyrD8uTKKz1YpQHwji3XvfYA8+iE="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/breeze-grub-6.7.1.tar.xz",
+    "hash": "sha256-WEFkMVfYE8JBztribmlVNktiTfWLcKNzeVQNqKOhvSk="
  },
  "breeze-gtk": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/breeze-gtk-6.7.0.tar.xz",
-    "hash": "sha256-KFmeF3tBZqezMvg0pyaWz4gs+fap7hknCKJ/R0wQJ8A="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/breeze-gtk-6.7.1.tar.xz",
+    "hash": "sha256-fMJ8F0QXyJvv5HFVI6vDrGqA0xj8Lw4YSULzShe+y24="
  },
  "breeze-plymouth": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/breeze-plymouth-6.7.0.tar.xz",
-    "hash": "sha256-2gNHVU33S38RsXA71s3eF2kXQuMqXMzfyTJaGzJhBqU="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/breeze-plymouth-6.7.1.tar.xz",
+    "hash": "sha256-SBfQKH6/NW8DD9waChoGmrvfy99I1f5KES8wKRm2rcM="
  },
  "discover": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/discover-6.7.0.tar.xz",
-    "hash": "sha256-A9SisXVxdla/7pB/T7lBILhs3MhmPZTnkkrG8nelWyc="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/discover-6.7.1.tar.xz",
+    "hash": "sha256-JXpcSoOhlBYZeNQHzGbOFIG1hIsfp38fn7sn0hFrQfk="
  },
  "drkonqi": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/drkonqi-6.7.0.tar.xz",
-    "hash": "sha256-VeZibrxQCJmKInVcjNJx8jNYcqUM3fZfFY/dXNI319M="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/drkonqi-6.7.1.tar.xz",
+    "hash": "sha256-Ng8NlmwcUTxp7TCw3nFKovX6lTnPqf2J1VWTv4/kkVQ="
  },
  "flatpak-kcm": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/flatpak-kcm-6.7.0.tar.xz",
-    "hash": "sha256-SmSQaW60yGQ4sE6X3BY75QsM17t+rPuyBGkglP9gt2s="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/flatpak-kcm-6.7.1.tar.xz",
+    "hash": "sha256-AruzSZV2MuKyJHc5zSNG2/TQ/3hu2+Sk/tW3zlWLxhg="
  },
  "kactivitymanagerd": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/kactivitymanagerd-6.7.0.tar.xz",
-    "hash": "sha256-7QZcLXbIXPjhDdcv+PiechNvxMhVYabJheuX3FGERqE="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/kactivitymanagerd-6.7.1.tar.xz",
+    "hash": "sha256-SAvTuiozFbQTCE3J9gxVJS8r+euinz3FebfhUOaAWws="
  },
  "kde-cli-tools": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/kde-cli-tools-6.7.0.tar.xz",
-    "hash": "sha256-JyD/fvv5e+9GmwL1RInz2bKguYyHGu25Fazbr5nzGZg="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/kde-cli-tools-6.7.1.tar.xz",
+    "hash": "sha256-KH5A1A9uVVs28MQ7ZnEceghmMCSoEGxLAuxM/215FBs="
  },
  "kde-gtk-config": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/kde-gtk-config-6.7.0.tar.xz",
-    "hash": "sha256-2W5YIUxmMrSR0yyqSusVrihPg+inXTu5SFl49Cr0q9k="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/kde-gtk-config-6.7.1.tar.xz",
+    "hash": "sha256-OLT5jVmIFpTFYmMJczULM853/aYsy85QZ8a7gPRjRtE="
  },
  "kdecoration": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/kdecoration-6.7.0.tar.xz",
-    "hash": "sha256-rP5WV9iJvw3VuLUBMrvpxi9ItQdPy6gmWhy4TWwie10="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/kdecoration-6.7.1.tar.xz",
+    "hash": "sha256-Ol2PV7q0Uuq9Gq3EUIi5WmaalRYmx+YB9qDvNgMGhL8="
  },
  "kdeplasma-addons": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/kdeplasma-addons-6.7.0.tar.xz",
-    "hash": "sha256-i4awt5sK8toJfYHc4JmRPUNXTgjEQop5JYcGkheLQpg="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/kdeplasma-addons-6.7.1.tar.xz",
+    "hash": "sha256-nQ5x7xgIUGMIdRtfmydMlty9PTAsPCSVrW1R6zt+pP8="
  },
  "kgamma": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/kgamma-6.7.0.tar.xz",
-    "hash": "sha256-6MM9ukfaPqD4kFPpQCmCqx+9tpwlm/CLEEegUEsH3ZI="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/kgamma-6.7.1.tar.xz",
+    "hash": "sha256-3msXvkXDuvEUe0OXGNF+AQv3odG/cMUU3deDTOfI/tc="
  },
  "kglobalacceld": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/kglobalacceld-6.7.0.tar.xz",
-    "hash": "sha256-/1423Ly4GC8baVBimTqeosxz0mdTay9ZJt4Dn6dzLGU="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/kglobalacceld-6.7.1.tar.xz",
+    "hash": "sha256-DycS/x9aTEQ+Lh33A/sHTi112lXx/gOaDuw4pYcI56c="
  },
  "kinfocenter": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/kinfocenter-6.7.0.tar.xz",
-    "hash": "sha256-303tKcuH12W31fSxYcKaQlWGOES+5kJH5vDT8Miz5aM="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/kinfocenter-6.7.1.tar.xz",
+    "hash": "sha256-lXhBKL3ZZ5w5xmjiv3om1eB9ahP2osmjdhWJ+2x1LP0="
  },
  "kmenuedit": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/kmenuedit-6.7.0.tar.xz",
-    "hash": "sha256-8n/tXImJrQCtxxS8fzd638qXQsTM06//lHjVAu6v/6s="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/kmenuedit-6.7.1.tar.xz",
+    "hash": "sha256-4nIVMiJyewt19Uq3y8vhFW1DRzwga1pz1n5a6jbfhEk="
  },
  "knighttime": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/knighttime-6.7.0.tar.xz",
-    "hash": "sha256-wvx1Kc7zs6gL5HFShtAn/IkI7w/oBArqEGgxpSZfwRM="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/knighttime-6.7.1.tar.xz",
+    "hash": "sha256-1MYNnr6xO59NDMq/BUWkgtm4mTM6tKhst4sWWs9Z7UM="
  },
  "kpipewire": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/kpipewire-6.7.0.tar.xz",
-    "hash": "sha256-2/g5t3nFCMICC9+dZCdiOHy6hQWSkd6rOOigwVIjuts="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/kpipewire-6.7.1.tar.xz",
+    "hash": "sha256-j40qF3SPKWQl5sQGgjQKaV3/fNkz7ZdHTU6sK/6UJ8E="
  },
  "krdp": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/krdp-6.7.0.tar.xz",
-    "hash": "sha256-5lylbPL5ZplFENzOzVOJKSLiYa19upkR0vN0BgKTxts="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/krdp-6.7.1.tar.xz",
+    "hash": "sha256-bYe6Be/Sn4SnMKFcdIEJJTV+h12+31vL9pJqVFLrf3k="
  },
  "kscreen": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/kscreen-6.7.0.tar.xz",
-    "hash": "sha256-rVekMmpkl5poqlBopxUXAtmwLbByBnDkvj4XiQW+2lY="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/kscreen-6.7.1.tar.xz",
+    "hash": "sha256-95xfFg04duXfLxfhBPOjf6Q6QLa5Z9o8687p4nKs9H8="
  },
  "kscreenlocker": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/kscreenlocker-6.7.0.tar.xz",
-    "hash": "sha256-wxVLaKiF7VXUzVd/gT9VU+oLMdvdMbMrN0SQVVD+w9E="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/kscreenlocker-6.7.1.tar.xz",
+    "hash": "sha256-m6zNFheLULYPmYuBKmHgdAV08T1Zlcohk5xeFgaOPJ4="
  },
  "ksshaskpass": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/ksshaskpass-6.7.0.tar.xz",
-    "hash": "sha256-TY7lYdv64xjil4QR2z1/3wkmY/XUXTafHjqSNNhyzuA="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/ksshaskpass-6.7.1.tar.xz",
+    "hash": "sha256-Y4FB/SY5UAW13R99BFS6n+p9JkupNDeYHzRVNVKi1Aw="
  },
  "ksystemstats": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/ksystemstats-6.7.0.tar.xz",
-    "hash": "sha256-IiTOQeQudYRaqIbhkueDPOY4uGqjHKDk48sx7zbkBms="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/ksystemstats-6.7.1.tar.xz",
+    "hash": "sha256-I7Fqk76ua+2xkl4MItBfKtX5/73ZfA+nUzX+K+Lrsx8="
  },
  "kwallet-pam": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/kwallet-pam-6.7.0.tar.xz",
-    "hash": "sha256-cdvV1qtSQ+eMUjzjgtU70Uw1cxrwlJf76Sm8pBtprtk="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/kwallet-pam-6.7.1.tar.xz",
+    "hash": "sha256-Lzce3Y5DR9W4rw4qaH9eNTd7/diWxwXJO4Ps4EOenEU="
  },
  "kwayland": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/kwayland-6.7.0.tar.xz",
-    "hash": "sha256-hiHRfpEAvmDqNAI1II0ET9ApMdvvdqMtmkd94xyOM/Q="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/kwayland-6.7.1.tar.xz",
+    "hash": "sha256-NPLbzil/W/zlv/ujyS8XTZp3SszSjSxnfnhscMnt5L8="
  },
  "kwayland-integration": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/kwayland-integration-6.7.0.tar.xz",
-    "hash": "sha256-IRld2c69WlxzhmOybw4dFaspj1ncqvkkNethi540JcM="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/kwayland-integration-6.7.1.tar.xz",
+    "hash": "sha256-Cc13B7KLXBnSB/3gdOmkwBLZROK66iPFmVqUAV6hwt4="
  },
  "kwin": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/kwin-6.7.0.tar.xz",
-    "hash": "sha256-0gt5gJSp9Y5X3lXso9WLHNy32yk564v3ORjE+rbZrsU="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/kwin-6.7.1.tar.xz",
+    "hash": "sha256-NSv7NO+tFDUHGWDvTNOSsRChjhwWjR/cXM5rQzMdCHU="
  },
  "kwin-x11": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/kwin-x11-6.7.0.tar.xz",
-    "hash": "sha256-msC4W1kBbfuRWH+MGXD71cbyFdEsmkGazQv30PBJNgY="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/kwin-x11-6.7.1.tar.xz",
+    "hash": "sha256-C7QDHIcHM7oDrN6/uxmcqklF0ZFKFnAEXfqNO1O04F8="
  },
  "kwrited": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/kwrited-6.7.0.tar.xz",
-    "hash": "sha256-dUOaklYfbDMoBNHSfa4VvFdVuMmvKNp50WwDLVCQOxA="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/kwrited-6.7.1.tar.xz",
+    "hash": "sha256-QVjROFluLdUtr8h8370JcPUMmOQkB23XKaosbAkjYlE="
  },
  "layer-shell-qt": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/layer-shell-qt-6.7.0.tar.xz",
-    "hash": "sha256-5vSLbr4sPKqjwu9thHBVCQTQMK00lrwQpUCYddstqrA="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/layer-shell-qt-6.7.1.tar.xz",
+    "hash": "sha256-Ayo/VDPxkTKRpZXjPKCKCkx+IuLXzjf19ygkdpbGEYg="
  },
  "libkscreen": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/libkscreen-6.7.0.tar.xz",
-    "hash": "sha256-bvulgFeiY12m8YVbprCOV+Y2yXZCG6Xj9fZn5qV7DOE="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/libkscreen-6.7.1.tar.xz",
+    "hash": "sha256-xrE6dh5u6GXx0KtysSazL782D3ToAqFDFeWix+G35R4="
  },
  "libksysguard": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/libksysguard-6.7.0.tar.xz",
-    "hash": "sha256-40wBQ4OZ/CMJDN5NRyJbzY9giZ0TjsrpnMWZZZU2rOM="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/libksysguard-6.7.1.tar.xz",
+    "hash": "sha256-P7orFd6RPrN2JMROw/O9iHNNCkIqvvb6goT2cmDnE/M="
  },
  "libplasma": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/libplasma-6.7.0.tar.xz",
-    "hash": "sha256-ioXkyessPAC1aDzOOqLJSdBrlWyIeJwbHBELarriAxI="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/libplasma-6.7.1.tar.xz",
+    "hash": "sha256-+sljROkeIvGsrCn5BQ+NzNSXplhzVzPP+Q5HnNob1bM="
  },
  "milou": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/milou-6.7.0.tar.xz",
-    "hash": "sha256-jJSkw875vGJbVByz1MLwqVv6E9MfPBgGM/fvnScB2x4="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/milou-6.7.1.tar.xz",
+    "hash": "sha256-fB+LXOhQ9ZkIAEIvUwEw3RT942QsfJFhAFFv1oNqzp8="
  },
  "ocean-sound-theme": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/ocean-sound-theme-6.7.0.tar.xz",
-    "hash": "sha256-ELK6ypKrcZirzCDVjdrTGRDIxr7uRxH8KkohUFRG8TU="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/ocean-sound-theme-6.7.1.tar.xz",
+    "hash": "sha256-f/G3Nx/GPqqbmEdQlZGAMKlDiq5n0yxm7gy01yNy1iU="
  },
  "oxygen": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/oxygen-6.7.0.tar.xz",
-    "hash": "sha256-ER+2K8PZ86lZ53/TX+VWLKNK14PLzcDBZFh/Vklc/ww="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/oxygen-6.7.1.tar.xz",
+    "hash": "sha256-Yh9N4kv4lh9NUaKhPgid5TqZtmL9LEGs1sWy8v7DHeg="
  },
  "oxygen-sounds": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/oxygen-sounds-6.7.0.tar.xz",
-    "hash": "sha256-YqPdeoilcNacNwpxomHI3QTZLa+QJQyiqdI8KeZ+HIo="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/oxygen-sounds-6.7.1.tar.xz",
+    "hash": "sha256-v/Fr9p+ddlcjfGfg7DLCEYjNyW8AQVfAx/PbuNOciJQ="
  },
  "plasma-activities": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/plasma-activities-6.7.0.tar.xz",
-    "hash": "sha256-OP+VeZagnBUjbpOwNboSNICliv90iUtht98QIOxEK1k="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/plasma-activities-6.7.1.tar.xz",
+    "hash": "sha256-2eOO+moKuLUMIIwIrKx7/iPJ6PfK/MGAoWRyStaBmAQ="
  },
  "plasma-activities-stats": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/plasma-activities-stats-6.7.0.tar.xz",
-    "hash": "sha256-K0qu2cRoW8LAVqDLqE1CfvLx63pPhB1Yd9A0e1sRzBM="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/plasma-activities-stats-6.7.1.tar.xz",
+    "hash": "sha256-YvS4CWXw1hblC5XX7s/OSruStCYZD4znbZKblBBsOPU="
  },
  "plasma-bigscreen": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/plasma-bigscreen-6.7.0.tar.xz",
-    "hash": "sha256-IS6811bk2oY4UsvKj9qPE+h/6IDSKSy9S+iPJs8k9IY="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/plasma-bigscreen-6.7.1.tar.xz",
+    "hash": "sha256-LaM+OvpKt+oZ24J/WTJUpSHf0XVohQmum39CIQQxMLE="
  },
  "plasma-browser-integration": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/plasma-browser-integration-6.7.0.tar.xz",
-    "hash": "sha256-zVtIPuKJHea7Bi3q62r+DAop6VHgclEMASwVtJsblUs="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/plasma-browser-integration-6.7.1.tar.xz",
+    "hash": "sha256-5/m1qzdFlLFWNNvhKbpGdDG1M3tk7PL/21BPo80fjRM="
  },
  "plasma-desktop": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/plasma-desktop-6.7.0.tar.xz",
-    "hash": "sha256-Y1E7VPb2CzzX7DXKLwlivfJWaXKTiOhRWsHTuIme5H8="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/plasma-desktop-6.7.1.tar.xz",
+    "hash": "sha256-8EUNwmcG/C1xmrKOMQIUnPv2py6BzTEMk2uFwIq7by8="
  },
  "plasma-dialer": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/plasma-dialer-6.7.0.tar.xz",
-    "hash": "sha256-CKULmVTY8yxCgJknsUz7Kg/GaKc1XhdWGbsNL86izUc="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/plasma-dialer-6.7.1.tar.xz",
+    "hash": "sha256-1BpinydZ/NviXuLQ21rU1Y3xZXuA791aV8K5NnCq3yg="
  },
  "plasma-disks": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/plasma-disks-6.7.0.tar.xz",
-    "hash": "sha256-mYiOJyaPD1q9+9hd42KxjxymxnDps5LnbaMPUafVzc8="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/plasma-disks-6.7.1.tar.xz",
+    "hash": "sha256-gMxmv+uvhInLgA09FfDifwEQegzzbKFlkAxhwOv+470="
  },
  "plasma-firewall": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/plasma-firewall-6.7.0.tar.xz",
-    "hash": "sha256-eHwVBebooyw/hVu2X0YVY3fuItbcMhpyB5sWB68N8n0="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/plasma-firewall-6.7.1.tar.xz",
+    "hash": "sha256-tb2giZ3X4ygv6ibXH0gk5oFcoOHiHSAXlLfxMb9BcYE="
  },
  "plasma-integration": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/plasma-integration-6.7.0.tar.xz",
-    "hash": "sha256-U3sFzUurGwcG+zH5gj+GZt9yleZH51YU8Ctr8UWO/x0="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/plasma-integration-6.7.1.tar.xz",
+    "hash": "sha256-GqsFgdC/2Taec/mWdIL0WTxZDPBYw0ofC8kREV0MWPw="
  },
  "plasma-keyboard": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/plasma-keyboard-6.7.0.tar.xz",
-    "hash": "sha256-gxGV8wjQgRuNeLTIRYFdyhZIuz/sg8nsY30b4ltTq3Q="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/plasma-keyboard-6.7.1.tar.xz",
+    "hash": "sha256-rPNqjTYVDGoOzuLusPcMTxImyuP+30fzjgbXZbY4gEc="
  },
  "plasma-login-manager": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/plasma-login-manager-6.7.0.tar.xz",
-    "hash": "sha256-A8WFlhQcwSYsKxxXSdm2TW5yJclyjUIcblr7ZJNWbuE="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/plasma-login-manager-6.7.1.tar.xz",
+    "hash": "sha256-cZU/NZ8MIsI1HjliCFasSNse/e6bvExB0Wg9j8+EOdY="
  },
  "plasma-mobile": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/plasma-mobile-6.7.0.tar.xz",
-    "hash": "sha256-NCaqC2KblFsHbqzhMMSrvG//b2xd0cK/9/8Ney1HfkI="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/plasma-mobile-6.7.1.tar.xz",
+    "hash": "sha256-PineHwZCOzNky3VQ3jet92YhSX3xOmq6+JpmR8uPS/4="
  },
  "plasma-nano": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/plasma-nano-6.7.0.tar.xz",
-    "hash": "sha256-xOL0nSQVfO62vCWYHi1xYA3SEXJJ6CsMwE+klAEZMYE="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/plasma-nano-6.7.1.tar.xz",
+    "hash": "sha256-C3cS0WA1Zci2/WKALspPB5GagqWzJ6vfTpk3vkpuzPQ="
  },
  "plasma-nm": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/plasma-nm-6.7.0.tar.xz",
-    "hash": "sha256-spaAzBfEu+UuO5iNW+Q37EtSS1VPoYDq0TvIkQFEz5g="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/plasma-nm-6.7.1.tar.xz",
+    "hash": "sha256-xDSWduN13o2YM+/3GCthlwxJHZmLKbtiYupVykW0dNo="
  },
  "plasma-pa": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/plasma-pa-6.7.0.tar.xz",
-    "hash": "sha256-utzogREH7ldyBxYnWsX8EhFmibw0zkk8q+cijhtlj1E="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/plasma-pa-6.7.1.tar.xz",
+    "hash": "sha256-cOnkdSfzi5FZ+UHciJWoSYKLP24xPjOznhHbQyA/Fwk="
  },
  "plasma-sdk": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/plasma-sdk-6.7.0.tar.xz",
-    "hash": "sha256-1G1SKRVGImSuXUl7rBb3U7DQtrW1uZtG/fiCP0xWLtM="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/plasma-sdk-6.7.1.tar.xz",
+    "hash": "sha256-RAoThwkoj+iTUCjsKLHebR3wjKCY+s17i4YpkCssZMU="
  },
  "plasma-setup": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/plasma-setup-6.7.0.tar.xz",
-    "hash": "sha256-3I+l3XRXBW3hwtAEPw83zTBhAg/s0hmMq/83i9XJVx4="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/plasma-setup-6.7.1.tar.xz",
+    "hash": "sha256-D520I44I2sk5ABkSQqcu5FVMsAfaDYs3axfwsOTyy6M="
  },
  "plasma-systemmonitor": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/plasma-systemmonitor-6.7.0.tar.xz",
-    "hash": "sha256-9lthyXWIbtxXSZVnAKWkxAWeeRXEl4aFeI/oGKFxS0I="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/plasma-systemmonitor-6.7.1.tar.xz",
+    "hash": "sha256-u4duK34ulFDkIHQ40lZCgtKFFNSLnh8WU0CZgh87cvs="
  },
  "plasma-thunderbolt": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/plasma-thunderbolt-6.7.0.tar.xz",
-    "hash": "sha256-Pepo91aAHJVHM2ykFVJnLDaTCRwpu/iWjuAf8pKHk6A="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/plasma-thunderbolt-6.7.1.tar.xz",
+    "hash": "sha256-Mra0QYXPAj/g909PXjNxGiJTZFftuNLXNcbE7AFP3OQ="
  },
  "plasma-vault": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/plasma-vault-6.7.0.tar.xz",
-    "hash": "sha256-i9cLPTeHidOWpm5pOoCd1rIe3EgWYnWTL399AgdPzhw="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/plasma-vault-6.7.1.tar.xz",
+    "hash": "sha256-5RfE/MK+NzFtrVfHDBrooQ30Z4FHm1mLoes+I2Z/34I="
  },
  "plasma-welcome": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/plasma-welcome-6.7.0.tar.xz",
-    "hash": "sha256-SD8WkxtswsVmaPVCBBjnsvja1XarqgG8dVRsE2HyGQM="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/plasma-welcome-6.7.1.tar.xz",
+    "hash": "sha256-/QOm4pkS55WQTJ/7ODX6iB9ZGTUZStcdJFAUMt6WurA="
  },
  "plasma-workspace": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/plasma-workspace-6.7.0.tar.xz",
-    "hash": "sha256-mn8qBOikS/JNpNKUu6JwmEoJDvF6CCzR6yXLgYJlHTw="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/plasma-workspace-6.7.1.tar.xz",
+    "hash": "sha256-o/Jn78KTkmnCZSNEmteqzK4GsBryBzYklHzOxF17wjw="
  },
  "plasma-workspace-wallpapers": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/plasma-workspace-wallpapers-6.7.0.tar.xz",
-    "hash": "sha256-DpIiDArgt8QmROvtb+FZ+wCXqJLmQMsSQgR8kpkx6go="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/plasma-workspace-wallpapers-6.7.1.tar.xz",
+    "hash": "sha256-s8u3+qZqOE8TfDT5OE7vBRTzMlQhtEmxh7V7XgZdaZo="
  },
  "plasma5support": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/plasma5support-6.7.0.tar.xz",
-    "hash": "sha256-5g4eR6Pe6TUYZH1mOTwh4kBvd3np6eQ4LXzqaM67+3s="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/plasma5support-6.7.1.tar.xz",
+    "hash": "sha256-BnC/QpkCc/vmBJ0Tbb1g/WU2UJ1SlVw4BImSRLgmOOM="
  },
  "plymouth-kcm": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/plymouth-kcm-6.7.0.tar.xz",
-    "hash": "sha256-KrVY7wsm/U4C+iZ4ZBL28be8UHZAe7nuR6fByffgJUc="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/plymouth-kcm-6.7.1.tar.xz",
+    "hash": "sha256-JL/chn4wxcVMr2Rvrwj4Z48o+znyIZK0G5Mh947eK4Q="
  },
  "polkit-kde-agent-1": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/polkit-kde-agent-1-6.7.0.tar.xz",
-    "hash": "sha256-Dyf/KqNhBBhiDEKAS5w9wi9peeXAOCL5OXnUT77R2r8="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/polkit-kde-agent-1-6.7.1.tar.xz",
+    "hash": "sha256-GvLysrM+GDhOsSDHQi9tKP88eFWzOpiOF3fe5ILWeKc="
  },
  "powerdevil": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/powerdevil-6.7.0.tar.xz",
-    "hash": "sha256-djXv/9UD542SvMAwM9VoHlFXfskrxtpy8qsoKLsKNNs="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/powerdevil-6.7.1.tar.xz",
+    "hash": "sha256-+oJiQSf5Umf2lGdhClfDy6Vi+gZzBSsv9/nbfwU9nlo="
  },
  "print-manager": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/print-manager-6.7.0.tar.xz",
-    "hash": "sha256-v3tqkw7cG4Ped65YV0O9pOGjpYKt5tICovuiYWrcpbM="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/print-manager-6.7.1.tar.xz",
+    "hash": "sha256-Y7vr7t7UX96tDDtw/IFm+zrSHderKpfNzTeo2qO0xCk="
  },
  "qqc2-breeze-style": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/qqc2-breeze-style-6.7.0.tar.xz",
-    "hash": "sha256-gfsPQ/4VwrzRxi50LKuoTWCk65OAwLzsRHtbdyjin7s="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/qqc2-breeze-style-6.7.1.tar.xz",
+    "hash": "sha256-C9N/SlZblK7HwuZ3kjpwVRuVNXj1tQwUvW9Em3SawhI="
  },
  "sddm-kcm": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/sddm-kcm-6.7.0.tar.xz",
-    "hash": "sha256-A7Heo6c4BIoGRjO57bgCcWAE9GMLP2p/Bo/QdNcZ700="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/sddm-kcm-6.7.1.tar.xz",
+    "hash": "sha256-vwpEdfaE59XMOQ4AX+PRvyXbwP+ko0gUtqnhdIWWxx4="
  },
  "spacebar": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/spacebar-6.7.0.tar.xz",
-    "hash": "sha256-XwtcSkDFHaPKxaXWg6uDq/2KNX5FkXYmjs7RWPAxSIU="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/spacebar-6.7.1.tar.xz",
+    "hash": "sha256-A+UTHgSbS8PKMxTAQ38esjscDWZBHtjdNtM+Q+Dl3uo="
  },
  "spectacle": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/spectacle-6.7.0.tar.xz",
-    "hash": "sha256-Sw5J3iGyGP9fEwLQzebgZyC8RSQ5bIUA02zWRMnVDGQ="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/spectacle-6.7.1.tar.xz",
+    "hash": "sha256-gp9kCwn5VJkpqymaUOgt4QldcQ6bjGdFU1zmp56qJG0="
  },
  "systemsettings": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/systemsettings-6.7.0.tar.xz",
-    "hash": "sha256-WfJKRQRrZp0awW+A7ngyPrbxchMKusMcbWXPYfBfp58="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/systemsettings-6.7.1.tar.xz",
+    "hash": "sha256-6ZlBGNFnAL8jO6/Le4LxKfiI9BZJjajKowysjX7oG0I="
  },
  "union": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/union-6.7.0.tar.xz",
-    "hash": "sha256-0JJd9wpnQiRuadl3btE508UuPDzNtoaT66vKLE6M9Fk="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/union-6.7.1.tar.xz",
+    "hash": "sha256-sAJVMeS9e2qF3xSmebS4N8DhGzxZv0yNCqwxp9ipdTM="
  },
  "wacomtablet": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/wacomtablet-6.7.0.tar.xz",
-    "hash": "sha256-4lBGcIom7JKbkTYcPYZAgu3m/toDgrcSntOKl1SiwKw="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/wacomtablet-6.7.1.tar.xz",
+    "hash": "sha256-Fy6qVwNjDX93fYNKBU8fBeMS8LJwNrcIwnT/f194D5A="
  },
  "xdg-desktop-portal-kde": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/xdg-desktop-portal-kde-6.7.0.tar.xz",
-    "hash": "sha256-9a/Ab5SLc7KgED2e5uV3RKmISj8uCBCAd3bsS/cQKto="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/xdg-desktop-portal-kde-6.7.1.tar.xz",
+    "hash": "sha256-C5BKsknt9HkaPfXICqQhVVE1eNqMoslQLfqp3sHoSos="
  }
 }
--- a/pkgs/kde/plasma/plasma-login-manager/kwin-path.patch
+++ b/pkgs/kde/plasma/plasma-login-manager/kwin-path.patch
@ -4,6 +4,7 @@
 PartOf=graphical-session.target
 
 [Service]
+ Environment="KWIN_USE_OVERLAYS=0"
 -ExecStart=@CMAKE_INSTALL_FULL_BINDIR@/kwin_wayland --no-lockscreen --no-global-shortcuts --no-kactivities --inputmethod plasma-keyboard --locale1
 +ExecStart=@kwin_wayland@ --no-lockscreen --no-global-shortcuts --no-kactivities --inputmethod plasma-keyboard --locale1
 SuccessExitStatus=15
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@ -2261,6 +2261,8 @@ let

        webmachine = callPackage ../development/ocaml-modules/webmachine { };

+        windtrap = callPackage ../development/ocaml-modules/windtrap { };
+
        wtf8 = callPackage ../development/ocaml-modules/wtf8 { };

        ### X ###
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@ -2148,6 +2148,8 @@ self: super: with self; {

  blake3 = callPackage ../development/python-modules/blake3 { };

+  blasthttp = callPackage ../development/python-modules/blasthttp { };
+
  ble-serial = callPackage ../development/python-modules/ble-serial { };

  bleach = callPackage ../development/python-modules/bleach { };