Merge staging-next into staging

2026-07-06 17:13:24 -05:00 · 2026-05-13 00:41:04 +00:00 · 2026-05-13 00:41:04 +00:00 · 1cbc55c0aa
commit 1cbc55c0aa
parent 037d37f1c2 926b312a80
288 changed files with 4043 additions and 5170 deletions
--- a/doc/languages-frameworks/javascript.section.md
+++ b/doc/languages-frameworks/javascript.section.md
@ -305,7 +305,7 @@ This package puts the corepack wrappers for pnpm and yarn in your PATH, and they

 ### pnpm {#javascript-pnpm}

-pnpm is available as the top-level package `pnpm`. Additionally, there are variants pinned to certain major versions, like `pnpm_8`, `pnpm_9` and `pnpm_10`, which support different sets of lock file versions.
+pnpm is available as the top-level package `pnpm`. Additionally, there are variants pinned to certain major versions, like `pnpm_8`, `pnpm_9`, `pnpm_10`, `pnpm_10_29_2` and `pnpm_11`, which support different sets of lock file versions.

 When packaging an application that includes a `pnpm-lock.yaml`, you need to fetch the pnpm store for that project using a fixed-output-derivation. The function `fetchPnpmDeps` can create this pnpm store derivation. In conjunction, the setup hook `pnpmConfigHook` will prepare the build environment to install the pre-fetched dependencies store. Here is an example for a package that contains `package.json` and a `pnpm-lock.yaml` files using the fetcher and setup hook above:

@ -313,11 +313,18 @@ When packaging an application that includes a `pnpm-lock.yaml`, you need to fetc
 {
  fetchPnpmDeps,
  nodejs,
-  pnpm,
+  pnpm_11,
  pnpmConfigHook,
  stdenv,
 }:
-
+let
+  # It is recommended to pin pnpm to a major version, due to regular breaking changes in the store format
+  # The latest major version is always available under `pkgs.pnpm`
+  # Optionally override pnpm to use a custom nodejs version
+  # Make sure that the same nodejs version is referenced in nativeBuildInputs
+  # pnpm = pnpm_11.override { nodejs = nodejs_24; };
+  pnpm = pnpm_11;
+in
 stdenv.mkDerivation (finalAttrs: {
  pname = "foo";
  version = "0-unstable-1980-01-01";
@ -334,6 +341,7 @@ stdenv.mkDerivation (finalAttrs: {

  pnpmDeps = fetchPnpmDeps {
    inherit (finalAttrs) pname version src;
+    inherit pnpm;
    fetcherVersion = 3;
    hash = "...";
  };
--- a/doc/release-notes/rl-2605.section.md
+++ b/doc/release-notes/rl-2605.section.md
@ -290,6 +290,8 @@

 - `spacefm` was removed because it appeared to be unmaintained upstream.

+- `neofetch` has been removed because it was unmaintained upstream. Consider using the updated fork `neowofetch` provided by the `hyfetch` package or the alternative `fastfetch` instead.
+
 - `vimPlugins.nvim-treesitter` has been updated to `main` branch, which is a full and incompatible rewrite. If you can't or don't want to update, you should use `vimPlugins.nvim-treesitter-legacy`.

 - `services.taskchampion-sync-server` module have been added an option `services.taskchampion-sync-server.dynamicUser` to use systemd's DynamicUser feature. This is enabled by default when stateVersion is at least 26.05, and disabled otherwise. If you need this feature, you need to set `services.taskchampion-sync-server.dynamicUser` to `true` and migrate `/var/lib/taskchampion-sync-server` to `/var/lib/private/taskchampion-sync-server`.
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -2336,6 +2336,13 @@
    githubId = 14922630;
    name = "Richard Smith";
  };
+  artifycz = {
+    email = "richard@tichy.io";
+    github = "ArtifyCZ";
+    githubId = 57506608;
+    matrix = "@artify:artify.zone";
+    name = "Richard Tichy";
+  };
  artturin = {
    email = "artturin@artturin.com";
    matrix = "@artturin:matrix.org";
@ -12611,7 +12618,7 @@
  };
  jfly = {
    name = "Jeremy Fleischman";
-    email = "jeremyfleischman@gmail.com";
+    email = "me@jfly.fyi";
    github = "jfly";
    githubId = 277474;
    keys = [ { fingerprint = "F1F1 3395 8E8E 9CC4 D9FC  9647 1931 9CD8 416A 642B"; } ];
@ -24332,6 +24339,12 @@
    githubId = 12882091;
    name = "Sam L. Yes";
  };
+  samooyo = {
+    email = "samidarnaud@gmail.com";
+    github = "samooyo";
+    githubId = 46531012;
+    name = "Sami Darnaud";
+  };
  samrose = {
    email = "samuel.rose@gmail.com";
    github = "samrose";
--- a/maintainers/scripts/luarocks-packages.csv
+++ b/maintainers/scripts/luarocks-packages.csv
@ -123,6 +123,8 @@ magick,,,,,5.1,donovanglover
 markdown,,,,,,
 md5,,,,,,
 mediator_lua,,,,,,
+mega.cmdparse,,,,,,
+mega.logging,,,,,,
 middleclass,,,,,,
 mimetypes,,,,,,
 mini.test,,,,,,
--- a/nixos/modules/programs/regreet.nix
+++ b/nixos/modules/programs/regreet.nix
@ -152,6 +152,9 @@ in
      theme_name = cfg.theme.name;
    };

+    # Needed to fetch accounts
+    services.accounts-daemon.enable = true;
+
    services.greetd = {
      enable = lib.mkDefault true;
      settings.default_session.command = lib.mkDefault "${pkgs.dbus}/bin/dbus-run-session ${lib.getExe pkgs.cage} ${lib.escapeShellArgs cfg.cageArgs} -- ${lib.getExe cfg.package}";
--- a/nixos/modules/programs/starship.nix
+++ b/nixos/modules/programs/starship.nix
@ -116,7 +116,7 @@ in
        # config file.  starship appears to use a hardcoded config location
        # rather than one inside an XDG folder:
        # https://github.com/starship/starship/blob/686bda1706e5b409129e6694639477a0f8a3f01b/src/configure.rs#L651
-        if [[ ! -f "$HOME/.config/starship.toml" ]]; then
+        if [[ ! -f "$${STARSHIP_CONFIG:-$HOME/.config/starship.toml}" ]]; then
          export STARSHIP_CONFIG=${settingsFile}
        fi
        eval "$(${cfg.package}/bin/starship init bash --print-full-init)"
@ -129,7 +129,8 @@ in
        # config file.  starship appears to use a hardcoded config location
        # rather than one inside an XDG folder:
        # https://github.com/starship/starship/blob/686bda1706e5b409129e6694639477a0f8a3f01b/src/configure.rs#L651
-        if not test -f "$HOME/.config/starship.toml";
+        set -q STARSHIP_CONFIG; or set STARSHIP_CONFIG "$HOME/.config/starship.toml"
+        if not test -f "$STARSHIP_CONFIG"
          set -x STARSHIP_CONFIG ${settingsFile}
        end
        ${lib.optionalString (!isNull cfg.transientPrompt.left) ''
@ -153,7 +154,7 @@ in
        # config file.  starship appears to use a hardcoded config location
        # rather than one inside an XDG folder:
        # https://github.com/starship/starship/blob/686bda1706e5b409129e6694639477a0f8a3f01b/src/configure.rs#L651
-        if [[ ! -f "$HOME/.config/starship.toml" ]]; then
+        if [[ ! -f "$${STARSHIP_CONFIG:-$HOME/.config/starship.toml}" ]]; then
          export STARSHIP_CONFIG=${settingsFile}
        fi
        eval "$(${cfg.package}/bin/starship init zsh)"
@ -167,8 +168,11 @@ in
        # config file.  starship appears to use a hardcoded config location
        # rather than one inside an XDG folder:
        # https://github.com/starship/starship/blob/686bda1706e5b409129e6694639477a0f8a3f01b/src/configure.rs#L651
-        if not `$HOME/.config/starship.toml`:
+        import os as _os
+        _sc = _os.environ.get('STARSHIP_CONFIG', _os.path.join(_os.environ['HOME'], '.config/starship.toml'))
+        if not _os.path.isfile(_sc):
          $STARSHIP_CONFIG = ('${settingsFile}')
+        del _os, _sc
        execx($(${cfg.package}/bin/starship init xonsh))
    '';
  };
--- a/nixos/tests/caddy.nix
+++ b/nixos/tests/caddy.nix
@ -72,8 +72,8 @@
        specialisation.with-plugins.configuration = {
          services.caddy = {
            package = pkgs.caddy.withPlugins {
-              plugins = [ "github.com/caddyserver/replace-response@v0.0.0-20241211194404-3865845790a7" ];
-              hash = "sha256-Quib7+jFf2ElS4yvrJhuLiedX3lBNwxpEDskxxyVu+8=";
+              plugins = [ "github.com/caddyserver/replace-response@v0.0.0-20250618171559-80962887e4c6" ];
+              hash = "sha256-kKWXpxEAn23yud8tcgw7FFOaxLjoodZ/cuM1239TRoY=";
            };
            configFile = pkgs.writeText "Caddyfile" ''
              {
--- a/nixos/tests/spire.nix
+++ b/nixos/tests/spire.nix
@ -54,6 +54,66 @@ let
      };
      users.groups.workload = { };
    };
+
+  tpmAgent =
+    { pkgs, lib, ... }:
+    {
+      imports = [ agent ];
+      virtualisation = {
+        useEFIBoot = true;
+        tpm = {
+          enable = true;
+          # Provision the swtpm with an EK certificate signed by testCA so that
+          # the SPIRE server can verify the agent's identity.
+          provisioning = ''
+            export PATH=${
+              lib.makeBinPath [
+                pkgs.openssl
+                pkgs.tpm2-tools
+              ]
+            }:$PATH
+
+            tpm2_createek -G rsa -u ek.pub -c ek.ctx -f pem
+
+            openssl x509 \
+              -extfile ${ekSignConf} \
+              -new -days 365 \
+              -subj "/CN=swtpm-ekcert" \
+              -extensions tpm_policy \
+              -CA ${./tpm-ek/ca.crt} -CAkey ${./tpm-ek/ca.priv} \
+              -out ekcert.der -outform der \
+              -force_pubkey ek.pub
+
+            tpm2_nvdefine 0x01c00002 \
+              -C o \
+              -a "ownerread|policyread|policywrite|ownerwrite|authread|authwrite" \
+              -s "$(wc -c < ekcert.der)"
+
+            tpm2_nvwrite 0x01c00002 -C o -i ekcert.der
+          '';
+        };
+      };
+
+      environment.systemPackages = [ pkgs.spire-tpm-plugin ];
+
+      services.spire.agent = {
+        enable = true;
+        settings = {
+          agent = {
+            trust_domain = trustDomain;
+            server_address = "server.${trustDomain}";
+            trust_bundle_format = "pem";
+            trust_bundle_path = "$CREDENTIALS_DIRECTORY/spire.trust_bundle";
+          };
+          plugins = {
+            KeyManager.memory.plugin_data = { };
+            NodeAttestor.tpm.plugin_data = { };
+            WorkloadAttestor.systemd.plugin_data = { };
+            WorkloadAttestor.unix.plugin_data = { };
+          };
+        };
+      };
+    };
 in
 {
  name = "spire";
@ -108,65 +168,8 @@ in
      };
    };

-    tpmAgent =
-      { pkgs, lib, ... }:
-      {
-        imports = [ agent ];
-        virtualisation = {
-          useEFIBoot = true;
-          tpm = {
-            enable = true;
-            # Provision the swtpm with an EK certificate signed by testCA so that
-            # the SPIRE server can verify the agent's identity.
-            provisioning = ''
-              export PATH=${
-                lib.makeBinPath [
-                  pkgs.openssl
-                  pkgs.tpm2-tools
-                ]
-              }:$PATH
-
-              tpm2_createek -G rsa -u ek.pub -c ek.ctx -f pem
-
-              openssl x509 \
-                -extfile ${ekSignConf} \
-                -new -days 365 \
-                -subj "/CN=swtpm-ekcert" \
-                -extensions tpm_policy \
-                -CA ${./tpm-ek/ca.crt} -CAkey ${./tpm-ek/ca.priv} \
-                -out ekcert.der -outform der \
-                -force_pubkey ek.pub
-
-              tpm2_nvdefine 0x01c00002 \
-                -C o \
-                -a "ownerread|policyread|policywrite|ownerwrite|authread|authwrite" \
-                -s "$(wc -c < ekcert.der)"
-
-              tpm2_nvwrite 0x01c00002 -C o -i ekcert.der
-            '';
-          };
-        };
-
-        environment.systemPackages = [ pkgs.spire-tpm-plugin ];
-
-        services.spire.agent = {
-          enable = true;
-          settings = {
-            agent = {
-              trust_domain = trustDomain;
-              server_address = "server.${trustDomain}";
-              trust_bundle_format = "pem";
-              trust_bundle_path = "$CREDENTIALS_DIRECTORY/spire.trust_bundle";
-            };
-            plugins = {
-              KeyManager.memory.plugin_data = { };
-              NodeAttestor.tpm.plugin_data = { };
-              WorkloadAttestor.systemd.plugin_data = { };
-              WorkloadAttestor.unix.plugin_data = { };
-            };
-          };
-        };
-      };
+    tpmAgent = tpmAgent;
+    tpmSelectorAgent = tpmAgent;
  };

  testScript =
@ -175,8 +178,6 @@ in
      adminSocket = nodes.server.services.spire.server.settings.server.socket_path;
    in
    ''
-      spiffe_id = "spiffe://${trustDomain}/service/backdoor"
-
      def provision_trust_bundle(agent):
        # TODO: instead of trust bundle to talk to the spire-server, use an upstream CA?
        bundle = server.succeed("spire-server bundle show -socketPath ${adminSocket}")
@ -197,28 +198,34 @@ in
        return f"spiffe://${trustDomain}/spire/agent/tpm/{ek_hash}"


+      def provision_tpm_selector(agent):
+        agent.wait_for_unit("tpm2.target")
+        alias_id = "spiffe://${trustDomain}/aliased-agent/tpm-model"
+        register_entry("spiffe://${trustDomain}/spire/server", "tpm:model:ST33HTPHAHD4", alias_id)
+        return alias_id
+
+
      def register_entry(parent_id, selector, spiffe_id):
        server.succeed(f"spire-server entry create -socketPath ${adminSocket} -selector '{selector}' -parentID '{parent_id}' -spiffeID '{spiffe_id}'")


      def test_agent(name, agent_node, provision_fn):
+        workload_spiffe_id = f"spiffe://${trustDomain}/{name}/workload"
        with subtest(f"Setup SPIRE agent with {name} attestation"):
          provision_trust_bundle(agent_node)
          parent_id = provision_fn(agent_node)
-          register_entry(parent_id, "systemd:id:backdoor.service", spiffe_id)
-          register_entry(parent_id, "unix:user:workload", "spiffe://${trustDomain}/workload")
+          register_entry(parent_id, "unix:user:workload", workload_spiffe_id)
          agent_node.wait_for_unit("spire-agent.service")
          agent_node.wait_until_succeeds("spire-agent healthcheck -socketPath $SPIFFE_ENDPOINT_SOCKET", timeout=90)
-        with subtest(f"Test certificate authentication from {name} agent"):
-          agent_node.wait_until_succeeds("spire-agent api fetch x509 -socketPath $SPIFFE_ENDPOINT_SOCKET -write .")
-        with subtest(f"Workload running as non-root, non-spire-agent user can reach Workload API ({name})"):
-          # SPIRE's security model relies on workload attestation, not unix
-          # permissions on the socket. Verify an unrelated user can connect.
-          agent_node.wait_until_succeeds(
+        with subtest(f"Workload user receives the {name} workload SVID"):
+          # Each agent node is fresh, so fetch returns "no identity issued"
+          # (non-zero) until exactly this entry's SVID is cached — content-aware
+          # retry isn't needed.
+          output = agent_node.wait_until_succeeds(
            "su -s /bin/sh workload -c "
            "'spire-agent api fetch x509 -socketPath \"$SPIFFE_ENDPOINT_SOCKET\"'"
          )
-        # TODO: Add something to communicate with
+          t.assertIn(workload_spiffe_id, output)


      with subtest("SPIRE server startup and health checks"):
@ -228,6 +235,7 @@ in

      test_agent("join_token", agent, provision_join_token)
      test_agent("tpm", tpmAgent, provision_tpm)
+      test_agent("tpm-selector", tpmSelectorAgent, provision_tpm_selector)

    '';
 }
--- a/pkgs/applications/editors/vim/plugins/aliases.nix
+++ b/pkgs/applications/editors/vim/plugins/aliases.nix
@ -69,6 +69,7 @@ mapAliases (
    sparkup = throw "'vimPlugins.sparkup' was removed: the upstream repository got deleted"; # Added 2025-08-06
    syntax-tree-surfer = throw "'vimPlugins.syntax-tree-surfer' has been archived"; # Added 2025-12-18
    todo-nvim = throw "'vimPlugins.todo-nvim' has been removed: abandoned by upstream"; # Added 2023-08-23
+    vim-csharp = throw "'vimPlugins.vim-csharp' has been removed: repository deleted"; # Added 2026-05-12
    vim-sourcetrail = throw "'vimPlugins.vim-sourcetrail' has been removed: abandoned by upstream"; # Added 2022-08-14
    # keep-sorted end
  }
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
--- a/pkgs/applications/editors/vim/plugins/nvim-treesitter/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/nvim-treesitter/overrides.nix
@ -37,8 +37,8 @@ let
        }
        ''
          mkdir -p "$out/queries"
-          if [ -d "${super.nvim-treesitter.src}/runtime/queries/${language}" ]; then
-            ln -s "${super.nvim-treesitter.src}/runtime/queries/${language}" "$out/queries/${language}"
+          if [ -d "${self.nvim-treesitter}/runtime/queries/${language}" ]; then
+            ln -s "${self.nvim-treesitter}/runtime/queries/${language}" "$out/queries/${language}"
          else
            echo "Error: there are no queries for ${language}."
            exit 1
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@ -1352,6 +1352,7 @@ assertNoAdditions {
      # Pickers, can use telescope, fzf-lua, or snacks
      fzf-lua
      telescope-nvim
+      neotest
    ];
  };

--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@ -552,7 +552,7 @@ https://github.com/Darazaki/indent-o-matic/,,
 https://github.com/arsham/indent-tools.nvim/,,
 https://github.com/Yggdroot/indentLine/,,
 https://github.com/ciaranm/inkpot/,,
-https://github.com/MysticalDevil/inlay-hints/,,
+https://github.com/MysticalDevil/inlay-hints.nvim/,,
 https://github.com/jbyuki/instant.nvim/,,
 https://github.com/pta2002/intellitab.nvim/,,
 https://github.com/parsonsmatt/intero-neovim/,,
@ -1418,7 +1418,6 @@ https://github.com/octol/vim-cpp-enhanced-highlight/,,
 https://github.com/mhinz/vim-crates/,,
 https://github.com/vim-crystal/vim-crystal/,,
 https://github.com/rbong/vim-crystalline/,,
-https://github.com/OrangeT/vim-csharp/,,
 https://github.com/ap/vim-css-color/,,
 https://github.com/cue-lang/vim-cue/,,
 https://github.com/itchyny/vim-cursorword/,,
@ -1634,7 +1633,7 @@ https://github.com/justinj/vim-pico8-syntax/,,
 https://github.com/junegunn/vim-plug/,,
 https://github.com/powerman/vim-plugin-AnsiEsc/,,
 https://github.com/hasundue/vim-pluto/,,
-https://github.com/sheerun/vim-polyglot/,,
+https://github.com/vim-polyglot/vim-polyglot/,,
 https://github.com/jmcomets/vim-pony/,,
 https://github.com/haya14busa/vim-poweryank/,,
 https://github.com/prettier/vim-prettier/,,
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@ -2918,8 +2918,8 @@ let
        mktplcRef = {
          name = "marp-vscode";
          publisher = "marp-team";
-          version = "3.5.0";
-          hash = "sha256-BH+9HK08+G2hZTanOuBplxl/cYpGrIqrapFGjNIX4QA=";
+          version = "3.5.1";
+          hash = "sha256-t8ozV99HBHLiVMYMxh8bJ2QzMd/2PEeEDpzvqHavwPw=";
        };
        meta = {
          license = lib.licenses.mit;
--- a/pkgs/applications/editors/vscode/extensions/eamodio.gitlens/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/eamodio.gitlens/default.nix
@ -3,7 +3,7 @@
  pkgs,
  stdenv,
  fetchFromGitHub,
-  pnpm,
+  pnpm_10,
  fetchPnpmDeps,
  pnpmConfigHook,
  nodejs,
@ -12,6 +12,8 @@
 }:

 let
+  pnpm = pnpm_10;
+
  vsix = stdenv.mkDerivation (finalAttrs: {
    name = "gitlens-${finalAttrs.version}.vsix";
    pname = "gitlens-vsix";
@ -26,6 +28,7 @@ let

    pnpmDeps = fetchPnpmDeps {
      inherit (finalAttrs) pname version src;
+      inherit pnpm;
      fetcherVersion = 3;
      hash = "sha256-Yuxuqr1BiviSw+dGNHLs2jAy8ADlBvRks6Kmy7FmCMw=";
    };
--- a/pkgs/applications/editors/vscode/extensions/github.copilot-chat/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/github.copilot-chat/default.nix
@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
  mktplcRef = {
    publisher = "github";
    name = "copilot-chat";
-    version = "0.44.2";
-    hash = "sha256-kjLpbA6zUta4K86yEDiLNWvy3kJ3AvF2fncCO/JVl6I=";
+    version = "0.45.1";
+    hash = "sha256-xxJ+h0/XyT8otXUzIYW9/KMxKLk5zoEE/fiqj4SZK+A=";
  };

  meta = {
--- a/pkgs/applications/editors/vscode/extensions/gplane.wasm-language-tools/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/gplane.wasm-language-tools/default.nix
@ -14,8 +14,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
  mktplcRef = {
    publisher = "gplane";
    name = "wasm-language-tools";
-    version = "1.16.0";
-    hash = "sha256-H2exVPaF8tYdpXBcooFi5bysp85OLOwxbKrB3HJes0Y=";
+    version = "1.20.0";
+    hash = "sha256-AXLwEp6uospVZwd2NxLEfABsNQOt1uRJTQ4HMTXbrJc=";
  };

  buildPhase = ''
--- a/pkgs/applications/editors/vscode/extensions/rooveterinaryinc.roo-cline/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/rooveterinaryinc.roo-cline/default.nix
@ -2,7 +2,7 @@
  lib,
  stdenvNoCC,
  fetchFromGitHub,
-  pnpm,
+  pnpm_10,
  fetchPnpmDeps,
  pnpmConfigHook,
  nodejs,
@ -11,6 +11,8 @@
 }:

 let
+  pnpm = pnpm_10;
+
  vsix = stdenvNoCC.mkDerivation (finalAttrs: {
    name = "roo-code-${finalAttrs.version}.vsix";
    pname = "roo-code-vsix";
@ -25,6 +27,7 @@ let

    pnpmDeps = fetchPnpmDeps {
      inherit (finalAttrs) pname version src;
+      inherit pnpm;
      fetcherVersion = 3;
      hash = "sha256-t2sPuhn8xdk6hGfmViPGG+5TAhtBBOMYNoOb6DlPzws=";
    };
--- a/pkgs/applications/editors/vscode/extensions/tekumara.typos-vscode/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/tekumara.typos-vscode/default.nix
@ -31,7 +31,7 @@ let
    }
    .${system} or (throw "Unsupported system: ${system}");
 in
-vscode-utils.buildVscodeMarketplaceExtension {
+vscode-utils.buildVscodeMarketplaceExtension (finalAttrs: {
  mktplcRef = {
    name = "typos-vscode";
    publisher = "tekumara";
@ -57,7 +57,7 @@ vscode-utils.buildVscodeMarketplaceExtension {
  passthru.updateScript = vscode-extension-update-script { };

  meta = {
-    changelog = "https://marketplace.visualstudio.com/items/tekumara.typos-vscode/changelog";
+    changelog = "https://github.com/tekumara/typos-lsp/blob/v${finalAttrs.version}/CHANGELOG.md";
    description = "VSCode extension for providing a low false-positive source code spell checker";
    downloadPage = "https://marketplace.visualstudio.com/items?itemName=tekumara.typos-vscode";
    homepage = "https://github.com/tekumara/typos-lsp";
@ -70,4 +70,4 @@ vscode-utils.buildVscodeMarketplaceExtension {
    ];
    maintainers = [ ];
  };
-}
+})
--- a/pkgs/applications/editors/vscode/extensions/visualjj.visualjj/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/visualjj.visualjj/default.nix
@ -11,26 +11,26 @@ vscode-utils.buildVscodeMarketplaceExtension {
      sources = {
        "x86_64-linux" = {
          arch = "linux-x64";
-          hash = "sha256-xtbI0mqkjF21pL/0R0DReHVMlsf32ys2iprxp6AsTao=";
+          hash = "sha256-YHerrkqMlLLHvbuM1fT6g4nBgO1DIkRBC+5ncw9ZA+I=";
        };
        "x86_64-darwin" = {
          arch = "darwin-x64";
-          hash = "sha256-wpmx2RNAmGwwehBI/KpKNN3qxoWYFcESYKRRzc5pK/U=";
+          hash = "sha256-iXRw+07xkSi6Gxhx+iezBaGlAaZM2L0BmzZ5ZfFUEbc=";
        };
        "aarch64-linux" = {
          arch = "linux-arm64";
-          hash = "sha256-zp3V8o9BDV29PA8xSlZ/RglnYkuc1rd+N5CuXIqd4ME=";
+          hash = "sha256-WkDu27TW1C+0UvNvNpWGKUhvqWo9rHMTWI9ro/gOYHs=";
        };
        "aarch64-darwin" = {
          arch = "darwin-arm64";
-          hash = "sha256-7Scr8lumlZu5M1pGAWfQTMIpBXWU1/yp5kVE3LpFSVM=";
+          hash = "sha256-5RDH+TAfSkEYIleb2gb9vg+akWXp2JDcSUqyHZNJh/M=";
        };
      };
    in
    {
      name = "visualjj";
      publisher = "visualjj";
-      version = "0.28.1";
+      version = "0.28.3";
    }
    // sources.${stdenvNoCC.hostPlatform.system}
      or (throw "Unsupported system ${stdenvNoCC.hostPlatform.system}");
--- a/pkgs/applications/emulators/libretro/cores/fceumm.nix
+++ b/pkgs/applications/emulators/libretro/cores/fceumm.nix
@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "fceumm";
-  version = "0-unstable-2026-04-20";
+  version = "0-unstable-2026-05-06";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "libretro-fceumm";
-    rev = "448a231618186b2af0bb9d6e37aeca05467e112f";
-    hash = "sha256-Kr3DEAk8dsFnUT73pOp5qwkCbcDItQwrRMI8hobrCuI=";
+    rev = "3a84a6fd0ba20dd4877c06b1d58741172148395f";
+    hash = "sha256-4+kEoN0+SWl284n7tIR76aysf0GlLdxELDXfpEK6mi8=";
  };

  meta = {
--- a/pkgs/applications/emulators/libretro/cores/genesis-plus-gx.nix
+++ b/pkgs/applications/emulators/libretro/cores/genesis-plus-gx.nix
@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "genesis-plus-gx";
-  version = "0-unstable-2026-05-01";
+  version = "0-unstable-2026-05-08";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "Genesis-Plus-GX";
-    rev = "252694adb9ebf2abcc7a1340d4078dce53d8954f";
-    hash = "sha256-mFij3fLDMvyby3ata47YJN7YuBKGv4/xphFQDiFKY3A=";
+    rev = "fa993f040d7150bda672b3e3ebe36c9bd2ea8904";
+    hash = "sha256-4igo4uwpDwbP6oTtlF6pwDF7+WZ0FgeFCtmPVNpULBo=";
  };

  meta = {
--- a/pkgs/applications/emulators/libretro/cores/swanstation.nix
+++ b/pkgs/applications/emulators/libretro/cores/swanstation.nix
@ -6,13 +6,13 @@
 }:
 mkLibretroCore {
  core = "swanstation";
-  version = "0-unstable-2026-04-10";
+  version = "0-unstable-2026-05-11";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "swanstation";
-    rev = "0c263202fe29689113c3db63c8cd3fcacfc6ff37";
-    hash = "sha256-u+ZryM8CY4TTJ7YQdHMNREMbQ6gEd2Mz9h5s0CY4nEY=";
+    rev = "0f7757b3196ab472c3a8b279206b3ea19a3e5f2d";
+    hash = "sha256-5R+K0NpLdjajT6LV0os569vrgqRCtfXDqMnhM8z7dmk=";
  };

  extraNativeBuildInputs = [ cmake ];
--- a/pkgs/applications/emulators/libretro/cores/vba-next.nix
+++ b/pkgs/applications/emulators/libretro/cores/vba-next.nix
@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "vba-next";
-  version = "0-unstable-2026-04-20";
+  version = "0-unstable-2026-05-12";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "vba-next";
-    rev = "82119ba97ee57c738a2eb1dc3a45cd2122ad2232";
-    hash = "sha256-On2O4WBVLmuj5FJZyaYUtgCEl1mEZffqAvGZpKz+Or8=";
+    rev = "f56ea99799b51fb107a4d3afe2a97a1364e8d806";
+    hash = "sha256-gbBurV2N6evLnZqvcxAZ2xfKMsybVeu+Nml0p0APTRE=";
  };

  meta = {
--- a/pkgs/applications/graphics/gimp/2.0/default.nix
+++ b/pkgs/applications/graphics/gimp/2.0/default.nix
@ -149,6 +149,11 @@ stdenv.mkDerivation (finalAttrs: {
      url = "https://salsa.debian.org/gnome-team/gimp/-/raw/4cb293ec1a3b273281d5d9daf94b833c293797d7/debian/patches/CVE-2025-10934.patch";
      hash = "sha256-MmYdh74cky/dF3UTHC0xpDW6+aa8Vzh+4ADHCDtIDzo=";
    })
+    (fetchurl {
+      name = "c23.patch";
+      url = "https://gitlab.gnome.org/GNOME/gimp/-/commit/85bdad2b2ca7ba36a01bef945b1c4b193a2fa9d0.patch";
+      hash = "sha256-6g2Zhbx+WxX7lOCYAFII0yDbwILecExwFD22tZDED50=";
+    })
  ];

  # error: possibly undefined macro: AM_NLS
--- a/pkgs/applications/networking/browsers/chromium/info.json
+++ b/pkgs/applications/networking/browsers/chromium/info.json
@ -1,10 +1,10 @@
 {
  "chromium": {
-    "version": "148.0.7778.96",
+    "version": "148.0.7778.167",
    "chromedriver": {
-      "version": "147.0.7727.138",
-      "hash_darwin": "sha256-d2dEPcR2mlfkL6XGhzMsgH/OwAI+yLXdS0dF4luPRfM=",
-      "hash_darwin_aarch64": "sha256-6rguKqpJJd058DQbiLVKVd/t+E7yYe1FHHB6zlwD6bU="
+      "version": "148.0.7778.168",
+      "hash_darwin": "sha256-F24gaQI0JZkStM71KJDEn8EKBTw1UifMxYXDdUIVup4=",
+      "hash_darwin_aarch64": "sha256-WpAiIz3nXxJLkxAP5JSn6rSxDW0vvl7EHeJA5MD+nss="
    },
    "deps": {
      "depot_tools": {
@ -21,8 +21,8 @@
    "DEPS": {
      "src": {
        "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "8625e066febc721e015ea99842da12901eb7ed73",
-        "hash": "sha256-coeBYfNPtiRRPuqoBRaxkTQI/a2pYNLI1slUdU1dZAc=",
+        "rev": "65db666ac2cf205fcc36db8bb5b9cd87f94808ac",
+        "hash": "sha256-Vda6y35lHYP3xK9FT5FdsnfTtL0MiY2m/auSq6NyL0U=",
        "recompress": true
      },
      "src/third_party/clang-format/script": {
@ -92,8 +92,8 @@
      },
      "src/third_party/angle": {
        "url": "https://chromium.googlesource.com/angle/angle.git",
-        "rev": "cc0e3572e8789f4a184dd9714a04b3d98ae81015",
-        "hash": "sha256-3KVTEBcnQTn99ccdKzylzUvua2jlS4g8/nfIDdLk6ug="
+        "rev": "6c71c70ec7e838c5f1712974086c8bc33d07de14",
+        "hash": "sha256-35Zu8jSopO47pH1rNLtSq5I8QRsOkMMvTgtmD13Yw/Y="
      },
      "src/third_party/angle/third_party/glmark2/src": {
        "url": "https://chromium.googlesource.com/external/github.com/glmark2/glmark2",
@ -342,8 +342,8 @@
      },
      "src/third_party/harfbuzz/src": {
        "url": "https://chromium.googlesource.com/external/github.com/harfbuzz/harfbuzz.git",
-        "rev": "4fc96139259ebc35f40118e0382ac8037d928e5c",
-        "hash": "sha256-/RT2OPWFiVwFqmNS4o+gE0JrcVO1cQDkCkgrSEe7BzE="
+        "rev": "f027b8e9039f73bf803eae684fee2eb2d30e4180",
+        "hash": "sha256-HWb3QbPl+RE2oI/Jwv5BjKwv9UnJ8VcJvk+uGy9cAqM="
      },
      "src/third_party/ink/src": {
        "url": "https://chromium.googlesource.com/external/github.com/google/ink.git",
@ -662,8 +662,8 @@
      },
      "src/third_party/skia": {
        "url": "https://skia.googlesource.com/skia.git",
-        "rev": "afe8b760ada5128164f9826866b4381a3463df41",
-        "hash": "sha256-HsKHffZWTls362kjokxzdhaxb/xJD1g70VHGk9l6GVM="
+        "rev": "a2888b27a98e4ff30085d4d2dba8a1a99baf6dfb",
+        "hash": "sha256-eOjFuMmXr9YtZ0e4yDB8JMjTrNWEg5OlTkAMGuHZIWE="
      },
      "src/third_party/smhasher/src": {
        "url": "https://chromium.googlesource.com/external/smhasher.git",
@ -797,8 +797,8 @@
      },
      "src/third_party/webrtc": {
        "url": "https://webrtc.googlesource.com/src.git",
-        "rev": "9600e77d854090669817d22aa2fc941ee92aaacd",
-        "hash": "sha256-jTJv53qt971Va5q6MaULysYiChBVmsFYxG9fzkcE0ak="
+        "rev": "9a7f650bcd14f241d20f88f4e1ea3b7300de72ac",
+        "hash": "sha256-k5cHE4XURJQrPURmXk4MMNV5k8+ryKfjmsVTzARRro4="
      },
      "src/third_party/wuffs/src": {
        "url": "https://skia.googlesource.com/external/github.com/google/wuffs-mirror-release-c.git",
@ -822,8 +822,8 @@
      },
      "src/v8": {
        "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "ddc9a95905de5268332a8f0216dc2bc67d26e829",
-        "hash": "sha256-x2FGL3J+JaWO1m6jBrcayR7Vlz90fYEAuufm4PULYyM="
+        "rev": "e38030f4228c8d1405fe105fc5feaa5173559e25",
+        "hash": "sha256-VsJpsCfDGF6rlfYQXccgF+F/pBhY/ybUa9N5HnHJ2lU="
      }
    }
  },
--- a/pkgs/applications/networking/browsers/firefox-bin/release_sources.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/release_sources.nix
--- a/pkgs/applications/networking/browsers/firefox/packages/firefox.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages/firefox.nix
@ -9,10 +9,10 @@

 buildMozillaMach rec {
  pname = "firefox";
-  version = "150.0.2";
+  version = "150.0.3";
  src = fetchurl {
    url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "e22fc66f7faeb9bef4036d0a90af4c27dabc45a3dc59c7290536bfe46c7624d73388d29b36a8999e364065fa31a5fa167596632229b0af9bc1baf4135fa29a4d";
+    sha512 = "8452da61200f8ee66790d3fff230ca84b2ac9291af2b57e018486c50f938c53c6fb4943fe6cfe1e99b9783466fb00bf707fa006293753ac698618fc1e3b70a4a";
  };

  meta = {
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@ -27,13 +27,13 @@
    "vendorHash": null
  },
  "aiven_aiven": {
-    "hash": "sha256-0f+ZxjMoPyOL4qatcRVk8jjn9TAZkinUX7eYQ1hv+FQ=",
+    "hash": "sha256-ni4Y5MRnu6AL491wRD8UoQ4MJmnopumYoq59wGujSUQ=",
    "homepage": "https://registry.terraform.io/providers/aiven/aiven",
    "owner": "aiven",
    "repo": "terraform-provider-aiven",
-    "rev": "v4.55.2",
+    "rev": "v4.56.0",
    "spdx": "MIT",
-    "vendorHash": "sha256-toCbbqzi0h6hUeyKMClUBcWsh8+H00K0IjdkgZ5HmOs="
+    "vendorHash": "sha256-vSSgABGm1aHGVPIsNXylpan8E07eOQ/Nc8Lf1N3+P5c="
  },
  "akamai_akamai": {
    "hash": "sha256-/+IE06obx4Rxzz3uh5QbeS/FhGlK2qTJJFWGAlDWJaw=",
@ -580,13 +580,13 @@
    "vendorHash": "sha256-UoS4iIVHhCQ+Zk+SJmsMHJgJBKLMbfMVmtm4MDmzT68="
  },
  "hashicorp_google-beta": {
-    "hash": "sha256-ltqZ6nyl/leYsV2pBJVgOtcOYIyfDmDLsZLfHTPOyew=",
+    "hash": "sha256-/HxUOhDATteiUDIeA8zvGI9xQ5rOWJAhLN9PLHiBFfI=",
    "homepage": "https://registry.terraform.io/providers/hashicorp/google-beta",
    "owner": "hashicorp",
    "repo": "terraform-provider-google-beta",
-    "rev": "v7.30.0",
+    "rev": "v7.31.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-WMfT/gtjRDACXWDf1w3cUiEUdeFrGAnYvDQcuXiQNkk="
+    "vendorHash": "sha256-5PnJ87cGMCwEl7zEwjbzgU5kZO9IC4Ls47HX2SZ2h2w="
  },
  "hashicorp_helm": {
    "hash": "sha256-S4Fe65f+gEWWxRMC+/i93dwwe7QigPccx4wiqNBpcL8=",
@ -1265,11 +1265,11 @@
    "vendorHash": "sha256-9M1DsE/FPQK8TG7xCJWbU3HAJCK3p/7lxdzjO1oAfWs="
  },
  "sumologic_sumologic": {
-    "hash": "sha256-Hw3+tck9kQmZ3TmtGUR8hu36gfMOgEGPjCscqaen8EU=",
+    "hash": "sha256-5X/3oHaW+b9U8W1DPKAJltDwGJjV4Mx1XP/JCkQtpwA=",
    "homepage": "https://registry.terraform.io/providers/SumoLogic/sumologic",
    "owner": "SumoLogic",
    "repo": "terraform-provider-sumologic",
-    "rev": "v3.2.7",
+    "rev": "v3.2.8",
    "spdx": "MPL-2.0",
    "vendorHash": "sha256-R/+PS4cUtr8/twUXOPRiVweb5I9NNiD6mGOcAFr9IDs="
  },
--- a/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
+++ b/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
@ -73,8 +73,8 @@ rec {
  thunderbird = thunderbird-latest;

  thunderbird-latest = common {
-    version = "150.0.1";
-    sha512 = "bf3d33357965cd144decef7c8865b6c18043502aea8d090d93fe29555379b924e3925d58276411f38fdcdc87b54ab3ae7d6aa6619feec9b856f8f227225cb375";
+    version = "150.0.2";
+    sha512 = "3e52220ff34aa6cd1bf46a910dba1f30d0abf7d19ed7f501ffeeb8f5901b8d97fdc0adb0cceb434ef8e83c7f7b83f28024b872280237af72ff2da9d89fafe065";

    updateScript = callPackage ./update.nix {
      attrPath = "thunderbirdPackages.thunderbird-latest";
--- a/pkgs/build-support/node/fetch-pnpm-deps/default.nix
+++ b/pkgs/build-support/node/fetch-pnpm-deps/default.nix
@ -7,6 +7,7 @@
  cacert,
  makeSetupHook,
  pnpm,
+  pnpm-fixup-state-db,
  writableTmpDirAsHomeHook,
  yq,
  zstd,
@ -47,6 +48,14 @@ in
          };

      filterFlags = lib.map (package: "--filter=${package}") pnpmWorkspaces;
+
+      pnpm-fixup-state-db' =
+        if pnpm.nodejs or null != null then
+          pnpm-fixup-state-db.override {
+            inherit (pnpm) nodejs;
+          }
+        else
+          pnpm-fixup-state-db;
    in
    # pnpmWorkspace was deprecated, so throw if it's used.
    assert (lib.throwIf (args ? pnpmWorkspace)
@ -77,6 +86,8 @@ in
              jq
              moreutils
              pnpm # from args
+              pnpm-fixup-state-db'
+              writableTmpDirAsHomeHook
              yq
              zstd
            ]
@ -88,14 +99,17 @@ in
            installPhase = ''
              runHook preInstall

+              versionAtLeast () {
+                  local cur_version=$1 min_version=$2
+                  printf "%s\0%s" "$min_version" "$cur_version" | sort -zVC
+              }
+
              lockfileVersion="$(yq -r .lockfileVersion pnpm-lock.yaml)"
              if [[ ''${lockfileVersion:0:1} -gt ${lib.versions.major pnpm.version} ]]; then
                echo "ERROR: lockfileVersion $lockfileVersion in pnpm-lock.yaml is too new for the provided pnpm version ${lib.versions.major pnpm.version}!"
                exit 1
              fi

-              export HOME=$(mktemp -d)
-
              # For fetcherVersion < 3, the pnpm store files are placed directly into $out.
              # For fetcherVersion >= 3, it is bundled into a compressed tarball within $out,
              # without distributing the uncompressed store files.
@ -106,19 +120,29 @@ in
                storePath=$out
              fi

-              # If the packageManager field in package.json is set to a different pnpm version than what is in nixpkgs,
-              # any pnpm command would fail in that directory, the following disables this
-              pushd ..
-              pnpm config set manage-package-manager-versions false
+              pushd "$HOME"
+              pnpmVersion=$(pnpm --version)
+
+              if versionAtLeast "$pnpmVersion" "11"; then
+                # pnpm 11 uses a different mechanism to manage package manager versions
+                export pnpm_config_pm_on_fail=ignore
+
+                # Some packages produce platform dependent outputs. We do not want to cache those in the global store
+                export pnpm_config_side_effects_cache false
+
+                export pnpm_config_update_notifier false
+              else
+                pnpm config set manage-package-manager-versions false
+                pnpm config set side-effects-cache false
+                pnpm config set update-notifier false
+              fi
              popd

              pnpm config set store-dir $storePath
-              # Some packages produce platform dependent outputs. We do not want to cache those in the global store
-              pnpm config set side-effects-cache false
-              # As we pin pnpm versions, we don't really care about updates
-              pnpm config set update-notifier false
+
              # Run any additional pnpm configuration commands that users provide.
              ${prePnpmInstall}
+
              # pnpm is going to warn us about using --force
              # --force allows us to fetch all dependencies including ones that aren't meant for our host platform
              pnpm install \
@ -141,14 +165,18 @@ in
              runHook preFixup

              # Remove timestamp and sort the json files
-              rm -rf $storePath/{v3,v10}/tmp
+              rm -rf $storePath/{v3,v10,v11}/tmp
              for f in $(find $storePath -name "*.json"); do
                jq --sort-keys "del(.. | .checkedAt?)" $f | sponge $f
              done

+              if [ -f "$storePath/v11/index.db" ]; then
+                pnpm-fixup-state-db "$storePath/v11";
+              fi
+
              # This folder contains symlinks to /build/source which we don't need
              # since https://github.com/pnpm/pnpm/releases/tag/v10.27.0
-              rm -rf $storePath/{v3,v10}/projects
+              rm -rf $storePath/{v3,v10,v11}/projects

              # Ensure consistent permissions
              # NOTE: For reasons not yet fully understood, pnpm might create files with
--- a/pkgs/build-support/node/fetch-pnpm-deps/pnpm-config-hook.sh
+++ b/pkgs/build-support/node/fetch-pnpm-deps/pnpm-config-hook.sh
@ -1,5 +1,10 @@
 # shellcheck shell=bash

+versionAtLeast () {
+    local cur_version=$1 min_version=$2
+    printf "%s\0%s" "$min_version" "$cur_version" | sort -zVC
+}
+
 pnpmConfigHook() {
    echo "Executing pnpmConfigHook"

@ -17,13 +22,18 @@ pnpmConfigHook() {
      exit 1
    fi

-    # If the packageManager field in package.json is set to a different pnpm version than what is in nixpkgs,
-    # any pnpm command would fail in that directory, the following disables this
-    pushd $HOME
-    pnpm config set manage-package-manager-versions false
+    pushd "$HOME"
+    pnpmVersion=$(pnpm --version)
+
+    if versionAtLeast "$pnpmVersion" "11"; then
+      # pnpm 11 uses a different mechanism to manage package manager versions
+      export pnpm_config_pm_on_fail=ignore
+    else
+      pnpm config set manage-package-manager-versions false
+    fi
    popd

-    echo "Found 'pnpm' with version '$(pnpm --version)'"
+    echo "Found 'pnpm' with version '$pnpmVersion'"

    fetcherVersion=$(cat "${pnpmDeps}/.fetcher-version" || echo 1)

@ -33,7 +43,9 @@ pnpmConfigHook() {

    export STORE_PATH=$(mktemp -d)
    export npm_config_arch="@npmArch@"
+    export pnpm_config_arch="@npmArch@"
    export npm_config_platform="@npmPlatform@"
+    export pnpm_config_platform="@npmPlatform@"

    if [[ $fetcherVersion -ge 3 ]]; then
      tar --zstd -xf "$pnpmDeps/pnpm-store.tar.zst" -C "$STORE_PATH"
--- a/pkgs/build-support/node/fetch-pnpm-deps/serve.nix
+++ b/pkgs/build-support/node/fetch-pnpm-deps/serve.nix
@ -3,6 +3,7 @@
  pnpm,
  pnpmDeps,
  zstd,
+  lib,
 }:

 writeShellApplication {
@ -41,4 +42,8 @@ writeShellApplication {
    pnpm server start \
      --store-dir "$storePath"
  '';
+
+  meta = {
+    broken = lib.versionAtLeast pnpm.version "11";
+  };
 }
--- a/pkgs/build-support/writers/scripts.nix
+++ b/pkgs/build-support/writers/scripts.nix
@ -17,6 +17,7 @@ let
    last
    optionalString
    strings
+    toFunction
    types
    ;
 in
@ -751,7 +752,7 @@ rec {
    ## `pkgs.writers.writeHaskell` usage example

    ```nix
-    writeHaskell "missiles" { libraries = [ pkgs.haskellPackages.acme-missiles ]; } ''
+    writeHaskell "missiles" { libraries = hpkgs: [ hpkgs.acme-missiles ]; } ''
      import Acme.Missiles

      main = launchMissiles
@ -777,7 +778,7 @@ rec {
    makeBinWriter {
      compileScript = ''
        cp $contentPath tmp.hs
-        ${(ghc.withPackages (_: libraries))}/bin/ghc ${lib.escapeShellArgs ghcArgs'} tmp.hs
+        ${(ghc.withPackages (toFunction libraries))}/bin/ghc ${lib.escapeShellArgs ghcArgs'} tmp.hs
        mv tmp $out
      '';
      inherit makeWrapperArgs strip;
--- a/pkgs/by-name/ad/adslib/package.nix
+++ b/pkgs/by-name/ad/adslib/package.nix
@ -2,23 +2,33 @@
  lib,
  stdenv,
  fetchFromGitHub,
+  meson,
+  ninja,
+  pkg-config,
  unstableGitUpdater,
 }:

-stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
  pname = "adslib";
-  version = "0-unstable-2021-11-07";
+  version = "0-unstable-2026-04-27";

  src = fetchFromGitHub {
    owner = "stlehmann";
    repo = "ADS";
-    rev = "a894d4512a51f3ada026efbf9553e75ba9351e2e";
-    sha256 = "SEh4yneTM1dfbWRdWlb5gP/uSeoOeE3g7g/rJWSTba8=";
+    rev = "77953d58f2690436e82db9954e2e55878c5edaa4";
+    hash = "sha256-UDPuzqD1krEZa7436k1NvE0lJUmNYG4kiP5fstoRDMc=";
  };

-  installPhase = ''
-    mkdir -p $out/lib
-    cp adslib.so $out/lib/adslib.so
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+  ];
+
+  postInstall = ''
+    # Downstream consumers (e.g. pyads) load the shared library as
+    # `adslib.so` rather than the meson default `libadslib.so`.
+    ln -s libadslib.so $out/lib/adslib.so
  '';

  passthru.updateScript = unstableGitUpdater { };
@ -28,5 +38,6 @@ stdenv.mkDerivation {
    homepage = "https://github.com/stlehmann/ADS";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ jamiemagee ];
+    platforms = lib.platforms.linux;
  };
-}
+})
--- a/pkgs/by-name/ag/age-plugin-sss/package.nix
+++ b/pkgs/by-name/ag/age-plugin-sss/package.nix
@ -6,13 +6,13 @@

 buildGoModule (finalAttrs: {
  pname = "age-plugin-sss";
-  version = "0.3.1";
+  version = "0.4.0";

  src = fetchFromGitHub {
    owner = "olastor";
    repo = "age-plugin-sss";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-QNu2Sp0CxYYXuMzf7X0mMYI677ICu5emOM4F9HlKhHA=";
+    hash = "sha256-XXlnot+oevRJKl0F1uz2DHg3yrtGhlBSlEGOsx/hCMw=";
  };

  vendorHash = "sha256-Aw7dwro6adluhQXPlZ9RZVGBAmNw539Z3c+a8TmPTXU=";
--- a/pkgs/by-name/ag/agent-browser/package.nix
+++ b/pkgs/by-name/ag/agent-browser/package.nix
@ -5,7 +5,7 @@
  fetchPnpmDeps,
  rustPlatform,
  nodejs,
-  pnpm,
+  pnpm_10,
  pnpmConfigHook,
  geist-font,
  nix-update-script,
@ -14,6 +14,8 @@
 }:

 let
+  pnpm = pnpm_10;
+
  version = "0.27.0";

  src = fetchFromGitHub {
@ -39,7 +41,7 @@ let

    pnpmDeps = fetchPnpmDeps {
      pname = "agent-browser-dashboard";
-      inherit version src;
+      inherit version src pnpm;
      pnpmWorkspaces = [ "dashboard" ];
      fetcherVersion = 3;
      hash = "sha256-ldxmXpejqVN/xuWcdLYMwNPc1VZ1rdNwRrumy8Is3N4=";
--- a/pkgs/by-name/ap/apache-airflow/python-package.nix
+++ b/pkgs/by-name/ap/apache-airflow/python-package.nix
@ -7,7 +7,7 @@
  # javascript
  fetchPnpmDeps,
  nodejs,
-  pnpm,
+  pnpm_10,
  pnpmConfigHook,

  # python
@ -97,6 +97,8 @@ let
    hash = "sha256-jwWxH9fTTCFdLAaAN18/FUAbN0cTCPkkk9+0ZMYNXek=";
  };

+  pnpm = pnpm_10;
+
  airflowUi = stdenv.mkDerivation rec {
    pname = "airflow-ui-assets";
    inherit src version;
@ -110,7 +112,12 @@ let

    pnpmDeps = fetchPnpmDeps {
      pname = "airflow-ui";
-      inherit sourceRoot src version;
+      inherit
+        sourceRoot
+        src
+        version
+        pnpm
+        ;
      fetcherVersion = 3;
      hash = "sha256-OkSDQoWsHQ6w1vIoX5W9zXHghV0obvL6Wji0HYN6CSs=";
    };
--- a/pkgs/by-name/ap/apache-answer/package.nix
+++ b/pkgs/by-name/ap/apache-answer/package.nix
@ -4,11 +4,13 @@
  fetchFromGitHub,
  fetchPnpmDeps,
  pnpmConfigHook,
-  pnpm,
+  pnpm_10,
  nodejs,
  stdenv,
 }:
-
+let
+  pnpm = pnpm_10;
+in
 buildGoModule (finalAttrs: {
  pname = "apache-answer";
  version = "1.7.1";
@ -28,6 +30,7 @@ buildGoModule (finalAttrs: {

    pnpmDeps = fetchPnpmDeps {
      inherit (finalAttrs) src version pname;
+      inherit pnpm;
      sourceRoot = "${finalAttrs.src.name}/ui";
      fetcherVersion = 3;
      hash = "sha256-0Jqe0wig28Vb9y0/tZHDfE49MehNR7kJTpChz616tzU=";
--- a/pkgs/by-name/ap/apidog/package.nix
+++ b/pkgs/by-name/ap/apidog/package.nix
@ -7,11 +7,11 @@

 let
  pname = "apidog";
-  version = "2.8.26";
+  version = "2.8.27";

  src = fetchurl {
    url = "https://file-assets.apidog.com/download/${version}/Apidog-${version}.AppImage";
-    hash = "sha256-u+J5OKgqOKEE35IhMpL7LUB4UgaX2XZKfnUczfLhjoU=";
+    hash = "sha256-elZR7IhS+0PvcO/WowADjsPyjM0NB+5BCDz7PTA+Lr0=";
  };

  appimageContents = appimageTools.extract {
--- a/pkgs/by-name/as/asha-pipewire-sink/package.nix
+++ b/pkgs/by-name/as/asha-pipewire-sink/package.nix
@ -11,13 +11,13 @@

 stdenv.mkDerivation {
  pname = "asha-pipewire-sink";
-  version = "0-unstable-2024-10-22";
+  version = "0-unstable-2025-05-20";

  src = fetchFromGitHub {
    owner = "thewierdnut";
    repo = "asha_pipewire_sink";
-    rev = "bbf665b9a3b90fcdbaeb092799ea3c5ba4347e31";
-    hash = "sha256-PuJ6lBV7s5OqGe1X4wD7T+8LVMCFpgvM1pnMjXYr8gs=";
+    rev = "16a9c1cfba2d9aaa2cedbd86b4aa4f8e556736ae";
+    hash = "sha256-9nfcFB37rBvgu0usySxovbxwQLrGCKDg6dk5kBU50C4=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/au/authelia/package.nix
+++ b/pkgs/by-name/au/authelia/package.nix
@ -4,7 +4,7 @@
  nodejs,
  fetchPnpmDeps,
  pnpmConfigHook,
-  pnpm,
+  pnpm_10,
  fetchFromGitHub,
  buildGo125Module,
  installShellFiles,
@ -15,13 +15,15 @@
      nodejs
      fetchPnpmDeps
      pnpmConfigHook
-      pnpm
+      pnpm_10
      fetchFromGitHub
      ;
  },
 }:

 let
+  pnpm = pnpm_10;
+
  buildGoModule = buildGo125Module;

  inherit (import ./sources.nix { inherit fetchFromGitHub; })
--- a/pkgs/by-name/au/authelia/web.nix
+++ b/pkgs/by-name/au/authelia/web.nix
@ -3,11 +3,13 @@
  nodejs,
  fetchPnpmDeps,
  pnpmConfigHook,
-  pnpm,
+  pnpm_10,
  fetchFromGitHub,
 }:

 let
+  pnpm = pnpm_10;
+
  inherit (import ./sources.nix { inherit fetchFromGitHub; })
    pname
    version
--- a/pkgs/by-name/aw/aws-vault/package.nix
+++ b/pkgs/by-name/aw/aws-vault/package.nix
@ -10,17 +10,17 @@
 }:
 buildGoModule (finalAttrs: {
  pname = "aws-vault";
-  version = "7.10.4";
+  version = "7.10.7";

  src = fetchFromGitHub {
    owner = "ByteNess";
    repo = "aws-vault";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-Feb/GFi5bpfZQcBW7ydNgCXZJZHeu7Iv352i9UwVgE8=";
+    hash = "sha256-lpk19VhnhC+aKutThzHGUKq4bveFm+Jn64/eqL+/lrE=";
  };

  proxyVendor = true;
-  vendorHash = "sha256-ogAwkoOw/Toh1JtAjcZHxu2MzzDlv33tfoOYCeV0vN0=";
+  vendorHash = "sha256-Qxgi6wa5NZ8hseLSlFa52WWH1BiB04YZmoqk7KRdVuk=";

  nativeBuildInputs = [
    installShellFiles
--- a/pkgs/by-name/ay/ayugram-desktop/package.nix
+++ b/pkgs/by-name/ay/ayugram-desktop/package.nix
@ -1,7 +1,9 @@
 {
  lib,
  fetchFromGitHub,
+  fetchpatch2,
  nix-update-script,
+  stdenvNoCC,
  telegram-desktop,
  withWebkit ? true,
 }:
@ -22,6 +24,13 @@ telegram-desktop.override {
        fetchSubmodules = true;
      };

+      patches =
+        (previousAttrs.patches or [ ])
+        ++ (lib.optional stdenvNoCC.hostPlatform.isDarwin (fetchpatch2 {
+          url = "https://github.com/telegramdesktop/tdesktop/commit/923efd9e7ef8ff72d9b83973502e587682119e54.patch?full_index=1";
+          hash = "sha256-XcmH9SSI3K2SsFjHDEMnKA6YOyWF1kRVJJAWP2/vdf8=";
+        }));
+
      passthru.updateScript = nix-update-script { };

      meta = previousAttrs.meta // {
--- a/pkgs/by-name/ba/balatro-mod-manager/package.nix
+++ b/pkgs/by-name/ba/balatro-mod-manager/package.nix
@ -50,7 +50,12 @@ rustPlatform.buildRustPackage (finalAttrs: {

    outputHashMode = "recursive";
    outputHashAlgo = "sha256";
-    outputHash = "sha256-97O4DrnjZO2mhSrCQz9xbcRCSaxMNNa4NaLNPlmecJg=";
+    outputHash =
+      {
+        x86_64-linux = "sha256-97O4DrnjZO2mhSrCQz9xbcRCSaxMNNa4NaLNPlmecJg=";
+        aarch64-linux = "sha256-0H14Be8jhBwOBG2Ui8gYrnAcTtatLVsBxFVfTyzmutw=";
+      }
+      .${stdenv.hostPlatform.system} or (throw "Unsupported system ${stdenv.hostPlatform.system}");
  };

  cargoHash = "sha256-TPZf4jtv/3mIpe6ASzPkIusQC/iPFpYN51XiiH6pkZc=";
@ -92,13 +97,14 @@ rustPlatform.buildRustPackage (finalAttrs: {
  '';

  meta = {
-    # Rollup for ARM64 is broken with Node modules
-    broken = stdenv.hostPlatform.isAarch64;
    description = "A mod manager for the game Balatro";
    homepage = "https://balatro-mod-manager.dasguney.com/";
    license = lib.licenses.gpl3Plus;
-    platforms = lib.platforms.linux;
-    maintainers = with lib.maintainers; [ mhdask ];
+    platforms = lib.intersectLists lib.platforms.linux (lib.platforms.x86_64 ++ lib.platforms.aarch64);
+    maintainers = with lib.maintainers; [
+      mhdask
+      ryand56
+    ];
    mainProgram = "BMM";
  };
 })
--- a/pkgs/by-name/bo/bombono/package.nix
+++ b/pkgs/by-name/bo/bombono/package.nix
@ -49,7 +49,9 @@ stdenv.mkDerivation {

  postPatch = ''
    substituteInPlace src/mbase/SConscript \
-      --replace "lib_mbase_env['CPPDEFINES']" "list(lib_mbase_env['CPPDEFINES'])"
+      --replace-fail "lib_mbase_env['CPPDEFINES']" "list(lib_mbase_env['CPPDEFINES'])"
+    # adapt to recent C standards
+    substituteInPlace Autoconfig --replace-fail "void (*signal ()) ();" "void (*signal(int,  void (*)(int)))(int);"
  '';

  nativeBuildInputs = [
--- a/pkgs/by-name/bu/buildkite-agent/package.nix
+++ b/pkgs/by-name/bu/buildkite-agent/package.nix
@ -14,16 +14,16 @@
 }:
 buildGoModule (finalAttrs: {
  pname = "buildkite-agent";
-  version = "3.124.0";
+  version = "3.126.0";

  src = fetchFromGitHub {
    owner = "buildkite";
    repo = "agent";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-HdTMsCBvd3vN/OkpBpiJ7dXq50PXx165NWmKGGpikUQ=";
+    hash = "sha256-JkXWd8I66iQVx/L+qHH0MGcJ/1AtPRZ7bL7+/pqCky0=";
  };

-  vendorHash = "sha256-VE7YEBIrkDG1ERGXnib0LPjBWcrepGAqwY5yKzSQ6wg=";
+  vendorHash = "sha256-p8Xfm+jql2tFihiETlCjZBsx6o5S8DwpHkkjKk6yCV8=";

  postPatch = ''
    substituteInPlace clicommand/agent_start.go --replace /bin/bash ${bash}/bin/bash
--- a/pkgs/by-name/bu/bumpp/package.nix
+++ b/pkgs/by-name/bu/bumpp/package.nix
@ -5,11 +5,14 @@
  nodejs,
  fetchPnpmDeps,
  pnpmConfigHook,
-  pnpm,
+  pnpm_10,
  npmHooks,
  versionCheckHook,
  nix-update-script,
 }:
+let
+  pnpm = pnpm_10;
+in
 stdenv.mkDerivation (finalAttrs: {
  pname = "bumpp";
  version = "11.0.1";
@ -23,6 +26,7 @@ stdenv.mkDerivation (finalAttrs: {

  pnpmDeps = fetchPnpmDeps {
    inherit (finalAttrs) pname version src;
+    inherit pnpm;
    fetcherVersion = 3;
    hash = "sha256-nIj4S5BWTaw3RVNIxbla8Q31wvK67Of6psx5wX9ID+E=";
  };
--- a/pkgs/by-name/c3/c3c/package.nix
+++ b/pkgs/by-name/c3/c3c/package.nix
@ -19,13 +19,13 @@ in
 llvmPackages.stdenv.mkDerivation (finalAttrs: {

  pname = "c3c${optionalString debug "-debug"}";
-  version = "0.7.11";
+  version = "0.8.0";

  src = fetchFromGitHub {
    owner = "c3lang";
    repo = "c3c";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-M6lx7MHhR1ghR+stRGJB7NL2SwHoyFOfU2tKu9Hh2oU=";
+    hash = "sha256-dsg1pPkFiZKuwoT/XGu4ommH54jFXvGMVddi1bmxfnE=";
  };

  cmakeBuildType = if debug then "Debug" else "Release";
--- a/pkgs/by-name/ca/caddy/package.nix
+++ b/pkgs/by-name/ca/caddy/package.nix
@ -11,7 +11,7 @@
  versionCheckHook,
 }:
 let
-  version = "2.11.2";
+  version = "2.11.3";
  dist = fetchFromGitHub {
    owner = "caddyserver";
    repo = "dist";
@ -27,10 +27,10 @@ buildGoModule (finalAttrs: {
    owner = "caddyserver";
    repo = "caddy";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-QoGq8+lhaSQuC1VwIYE8h8N/ZC1ozfmIwmsIPk29Jos=";
+    hash = "sha256-7Hgmo7ldDtbwl/acEY/4RNhSGnK/NNcXn+eIm1I8HKg=";
  };

-  vendorHash = "sha256-zlwVgSEr01bbgV7N9szwqa9cPjBU34Cu7vqj4/MoSuU=";
+  vendorHash = "sha256-QiZZxYsYFUneZ52TfFKQWJ42lmBofvUTZrHmDBuN2O4=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/ch/changelogen/package.nix
+++ b/pkgs/by-name/ch/changelogen/package.nix
@ -5,10 +5,13 @@
  nodejs,
  fetchPnpmDeps,
  pnpmConfigHook,
-  pnpm,
+  pnpm_10,
  npmHooks,
  nix-update-script,
 }:
+let
+  pnpm = pnpm_10;
+in
 stdenv.mkDerivation (finalAttrs: {
  pname = "changelogen";
  version = "0.6.2";
@ -22,6 +25,7 @@ stdenv.mkDerivation (finalAttrs: {

  pnpmDeps = fetchPnpmDeps {
    inherit (finalAttrs) pname version src;
+    inherit pnpm;
    fetcherVersion = 3;
    hash = "sha256-S+GxeljcPj/MzBkleVNgaRa8D4kmHrKwwVqakmB5sAw=";
  };
--- a/pkgs/by-name/ch/checkov/package.nix
+++ b/pkgs/by-name/ch/checkov/package.nix
@ -35,14 +35,14 @@ let
 in
 python3.pkgs.buildPythonApplication (finalAttrs: {
  pname = "checkov";
-  version = "3.2.527";
+  version = "3.2.528";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "bridgecrewio";
    repo = "checkov";
    tag = finalAttrs.version;
-    hash = "sha256-PKG4WzXtocfE9rwg3E77BkWREs7RhAzmdv9mz5VsbLA=";
+    hash = "sha256-bbGB6h9jhd3laeOTaSwZ2o3yu62vLMuCmYhS/qQBkeA=";
  };

  pythonRelaxDeps = [
--- a/pkgs/by-name/cj/cjdns/package.nix
+++ b/pkgs/by-name/cj/cjdns/package.nix
@ -15,36 +15,22 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cjdns";
-  version = "22.1";
+  version = "22.3";

  src = fetchFromGitHub {
    owner = "cjdelisle";
    repo = "cjdns";
    tag = "cjdns-v${finalAttrs.version}";
-    hash = "sha256-0imQrkcvIA+2Eq/zlC65USMR7T3OUKwQxrB1KtVexyU=";
+    hash = "sha256-A5KPcjFrCIYhT/6W+J4Nvb1y23cAgv9M6PWcyN43st4=";
  };

  patches = [
    (replaceVars ./system-libsodium.patch {
      libsodium_include_dir = "${libsodium.dev}/include";
    })
-    # Remove mkpasswd since it is failing the build
-    (fetchpatch {
-      url = "https://github.com/cjdelisle/cjdns/commit/6391dba3f5fdab45df4b4b6b71dbe9620286ce32.patch";
-      hash = "sha256-XVA4tdTVMLrV6zuGoBCkOgQq6NXh0x7u8HgmaxFeoRI=";
-    })
-    (fetchpatch {
-      url = "https://github.com/cjdelisle/cjdns/commit/436d9a9784bae85734992c2561c778fbd2f5ac32.patch";
-      hash = "sha256-THcYNGVbMx/xf3/5UIxEhz3OlODE0qiYgDBOlHunhj8=";
-    })
-    # Fix build failure with Rust 1.89.0 (https://github.com/cjdelisle/cjdns/pull/1271)
-    (fetchpatch {
-      url = "https://github.com/cjdelisle/cjdns/commit/68b786aca5bfa427e5f58c029e4d9cc74969ef87.patch";
-      hash = "sha256-FmrooDzrIWUIAnzwZTVDXI+Cl8pMngPqxsJjUHVhry8=";
-    })
  ];

-  cargoHash = "sha256-f96y6ZW0HxC+73ts5re8GIo2aigQgK3gXyF7fMrcJ0o=";
+  cargoHash = "sha256-tob45/99svE0R1Kk7G1+H7waBWYmI9VKC8ffl3ZmdcU=";

  nativeBuildInputs = [
    which
--- a/pkgs/by-name/cl/claude-code-router/package.nix
+++ b/pkgs/by-name/cl/claude-code-router/package.nix
@ -4,12 +4,14 @@
  lib,
  makeBinaryWrapper,
  nodejs,
-  pnpm,
+  pnpm_10,
  fetchPnpmDeps,
  pnpmConfigHook,
  versionCheckHook,
 }:
-
+let
+  pnpm = pnpm_10;
+in
 buildNpmPackage (finalAttrs: {
  pname = "claude-code-router";
  version = "2.0.0";
--- a/pkgs/by-name/co/context7-mcp/package.nix
+++ b/pkgs/by-name/co/context7-mcp/package.nix
@ -7,12 +7,14 @@
  versionCheckHook,

  nodejs,
-  pnpm,
+  pnpm_10,
  pnpmConfigHook,
  fetchPnpmDeps,
 }:
 let
  tag-prefix = "@upstash/context7-mcp";
+
+  pnpm = pnpm_10;
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "context7-mcp";
@ -34,6 +36,7 @@ stdenv.mkDerivation (finalAttrs: {

  pnpmDeps = fetchPnpmDeps {
    inherit (finalAttrs) pname version src;
+    inherit pnpm;
    fetcherVersion = 3;
    hash = "sha256-f3PXpCdmKh2LPD5VyFsRdLR7CEvh+GozkQFSeeNuj2c=";
  };
--- a/pkgs/by-name/co/conventional-changelog-cli/package.nix
+++ b/pkgs/by-name/co/conventional-changelog-cli/package.nix
@ -5,12 +5,14 @@
  nodejs,
  fetchPnpmDeps,
  pnpmConfigHook,
-  pnpm,
+  pnpm_10,
  makeBinaryWrapper,
  versionCheckHook,
  nix-update-script,
 }:
-
+let
+  pnpm = pnpm_10;
+in
 stdenv.mkDerivation (finalAttrs: {
  pname = "conventional-changelog-cli";
  version = "7.2.0";
@ -24,6 +26,7 @@ stdenv.mkDerivation (finalAttrs: {

  pnpmDeps = fetchPnpmDeps {
    inherit (finalAttrs) pname version src;
+    inherit pnpm;
    fetcherVersion = 3;
    hash = "sha256-O91ypnycBwkfLSruezx9E5CrytguBdtmvgVhKFjUzvM=";
  };
--- a/pkgs/by-name/ct/ctx7/package.nix
+++ b/pkgs/by-name/ct/ctx7/package.nix
@ -7,10 +7,13 @@
  versionCheckHook,

  nodejs,
-  pnpm,
+  pnpm_10,
  pnpmConfigHook,
  fetchPnpmDeps,
 }:
+let
+  pnpm = pnpm_10;
+in
 stdenv.mkDerivation (finalAttrs: {
  pname = "ctx7";
  version = "0.3.9";
@ -31,6 +34,7 @@ stdenv.mkDerivation (finalAttrs: {

  pnpmDeps = fetchPnpmDeps {
    inherit (finalAttrs) pname version src;
+    inherit pnpm;
    fetcherVersion = 3;
    hash = "sha256-8RRHfCTZVC91T1Qx+ACCo2oG4ZwMNy5WYakCjmBhe3Q=";
  };
--- a/pkgs/by-name/da/dablin/package.nix
+++ b/pkgs/by-name/da/dablin/package.nix
@ -8,7 +8,6 @@
  SDL2,
  gtkmm3,
  faad2,
-  pcre,
 }:

 stdenv.mkDerivation (finalAttrs: {
@ -32,7 +31,6 @@ stdenv.mkDerivation (finalAttrs: {
    mpg123
    SDL2
    gtkmm3
-    pcre
  ];

  meta = {
--- a/pkgs/by-name/de/deno/package.nix
+++ b/pkgs/by-name/de/deno/package.nix
@ -14,7 +14,6 @@
  sqlite,
  lld,
  writableTmpDirAsHomeHook,
-  fetchpatch,

  # Test deps
  curl,
@ -22,6 +21,9 @@
  git,
  python3,
  esbuild,
+
+  # self for passthru
+  deno,
 }:

 let
@ -90,13 +92,14 @@ rustPlatform.buildRustPackage (finalAttrs: {
  # To avoid this we pre-download the file and export it via RUSTY_V8_ARCHIVE
  env.RUSTY_V8_ARCHIVE = librusty_v8;

-  # Many tests depend on prebuilt binaries being present at `./third_party/prebuilt`.
-  # We provide nixpkgs binaries for these for all platforms, but the test runner itself only handles
-  # these four arch+platform combinations.
-  doCheck =
-    stdenv.hostPlatform.isDarwin
-    || (stdenv.hostPlatform.isLinux && (stdenv.hostPlatform.isAarch64 || stdenv.hostPlatform.isx86_64));
-
+  # Don't run checks on hydra as they've been observed to be flakey for us and
+  # other distros CI: https://gitlab.alpinelinux.org/alpine/aports/-/blob/bec8b026686323b496365b825ad14fdf4473adf2/community/deno/APKBUILD#L79
+  # We haven't reproduced it on local machines, could be related to doing other
+  # builds simultaneously.
+  # A build with tests (+ librusty_v8 tests) is included in `deno.passhtru.tests`
+  doCheck = false;
+  # check related config is left in the main package so if someone uses
+  # `overrideAttrs` to always build with tests, it'll all work.
  preCheck =
    # Provide esbuild binary at `./third_party/prebuilt/` just like upstream:
    # https://github.com/denoland/deno_third_party/tree/master/prebuilt
@ -243,7 +246,20 @@ rustPlatform.buildRustPackage (finalAttrs: {

  passthru = {
    updateScript = ./update.sh;
-    tests = callPackage ./tests { };
+    tests = (callPackage ./tests { }) // {
+      build-with-unit-tests = deno.overrideAttrs (fa: {
+        # The tools test suite requires building the test server
+        dontBuild = false;
+        # Many tests depend on prebuilt binaries being present at `./third_party/prebuilt`.
+        # We provide nixpkgs binaries for these for all platforms, but the test runner itself only handles
+        # these four arch+platform combinations.
+        doCheck =
+          stdenv.hostPlatform.isDarwin
+          || (stdenv.hostPlatform.isLinux && (stdenv.hostPlatform.isAarch64 || stdenv.hostPlatform.isx86_64));
+      });
+      # Also include librusty_v8 tests
+      librusty_v8-tests = librusty_v8.passthru.tests;
+    };
    inherit librusty_v8;
  };

--- a/pkgs/by-name/de/deno/rusty-v8/default.nix
+++ b/pkgs/by-name/de/deno/rusty-v8/default.nix
@ -153,6 +153,14 @@ rustPlatform.buildRustPackage (finalAttrs: {
    "fortify3"
  ];

+  # Don't run checks on hydra as they've been observed to be flakey for us and
+  # other distros CI: https://gitlab.alpinelinux.org/alpine/aports/-/blob/bec8b026686323b496365b825ad14fdf4473adf2/community/deno/APKBUILD#L79
+  # We haven't reproduced it on local machines, could be related to doing other
+  # builds simultaneously.
+  # A build with tests is included as part of `deno.passhtru.tests` via `librusty_v8.passthru.tests`
+  doCheck = false;
+  # Check related config is left in the main package so if someone uses
+  # `overrideAttrs` to always build with tests, it'll all work.
  checkFlags = [
    # These tests probably fail due to a more recent rustc version (upstream: 1.89.0, here: 1.93.0)
    "--skip=ui"
@ -167,6 +175,14 @@ rustPlatform.buildRustPackage (finalAttrs: {
    runHook postInstall
  '';

+  passthru = {
+    tests = {
+      build-with-unit-tests = deno.passthru.librusty_v8.overrideAttrs (fa: {
+        doCheck = true;
+      });
+    };
+  };
+
  requiredSystemFeatures = [ "big-parallel" ];

  meta = {
--- a/pkgs/by-name/el/element-desktop/package.nix
+++ b/pkgs/by-name/el/element-desktop/package.nix
@ -15,7 +15,7 @@
  commandLineArgs ? "",
  fetchPnpmDeps,
  pnpmConfigHook,
-  pnpm,
+  pnpm_10,
  asar,
  copyDesktopItems,
  darwin,
@ -23,6 +23,7 @@
 }:

 let
+  pnpm = pnpm_10;
  electron = electron_41;
  seshat = callPackage ./seshat { };
 in
@ -43,6 +44,7 @@ stdenv.mkDerivation (finalAttrs: {
      version
      src
      ;
+    inherit pnpm;
    fetcherVersion = 3;
    hash = "sha256-0yqWObZtRntsH7gk+OB8pMuWsrvCQ4L9173Qv0o5abk=";
  };
--- a/pkgs/by-name/el/element-web-unwrapped/package.nix
+++ b/pkgs/by-name/el/element-web-unwrapped/package.nix
@ -6,12 +6,14 @@
  nodejs,
  jitsi-meet,
  fetchPnpmDeps,
-  pnpm,
+  pnpm_10,
  pnpmConfigHook,
  faketty,
 }:

 let
+  pnpm = pnpm_10;
+
  noPhoningHome = {
    disable_guests = true; # disable automatic guest account registration at matrix.org
  };
@ -36,6 +38,7 @@ stdenv.mkDerivation (finalAttrs: {
  pnpmDeps = fetchPnpmDeps {
    pname = "element";
    inherit (finalAttrs) version src;
+    inherit pnpm;
    fetcherVersion = 3;
    hash = "sha256-0yqWObZtRntsH7gk+OB8pMuWsrvCQ4L9173Qv0o5abk=";
  };
--- a/pkgs/by-name/er/ersatztv/nuget-deps.json
+++ b/pkgs/by-name/er/ersatztv/nuget-deps.json
@ -1,13 +1,13 @@
 [
  {
    "pname": "Acornima",
-    "version": "1.2.0",
-    "hash": "sha256-eDApwoJgsWOmCTGPn+o2xpfZEXupAw1+41nCBtAzTas="
+    "version": "1.4.0",
+    "hash": "sha256-7SCe3Bgcyzlv6nXQfTOy3UZLc7ilZ3YXxgl6mcTF82s="
  },
  {
    "pname": "AdvancedStringBuilder",
-    "version": "0.1.1",
-    "hash": "sha256-pLixGUct2lQnSeckSHVnIEoGfsvz3gkA914QSHdaheE="
+    "version": "0.2.0",
+    "hash": "sha256-66bPgNGU/wLpGs9mydkBBlTEJRpvfHDwWEysUsufZJY="
  },
  {
    "pname": "AngleSharp",
@ -46,8 +46,8 @@
  },
  {
    "pname": "BlazorSortable",
-    "version": "5.2.1",
-    "hash": "sha256-T+0zzQOq81NJUtER+9Ag5DQvn1v3+rbA5AOu/zqWFVg="
+    "version": "6.0.1",
+    "hash": "sha256-VrK9dW5ULwfTOwxKvZU+OiXLuFEldmOx2kju5OBxSu0="
  },
  {
    "pname": "Blurhash.Core",
@ -59,16 +59,6 @@
    "version": "2.0.0",
    "hash": "sha256-I22mdiA6Ltr0D2pyryUyS0z5YboBr5UY9LZFcer3FPs="
  },
-  {
-    "pname": "Bugsnag",
-    "version": "4.1.0",
-    "hash": "sha256-o30fm7J9tZouVRf0oZNR2hTukc2V8HpdRK30Uu5dZcc="
-  },
-  {
-    "pname": "Bugsnag.AspNet.Core",
-    "version": "4.1.0",
-    "hash": "sha256-L/aMCcmE7xLEtap5/H56VwCsDI4N/m8jgoj6SkxM7x8="
-  },
  {
    "pname": "Chronic.Core",
    "version": "0.4.0",
@ -76,18 +66,18 @@
  },
  {
    "pname": "CliWrap",
-    "version": "3.10.0",
-    "hash": "sha256-XMGTr0gkZxSOC72hrCjpIChpN0c0A19X3TqOAdBtgb4="
+    "version": "3.10.1",
+    "hash": "sha256-uH4SXiMkUIPw5RRyKtDTTCSkkr3BhBAPrxnC4O4ES4c="
  },
  {
    "pname": "Dapper",
-    "version": "2.1.66",
-    "hash": "sha256-e5n/wnAFGPDSe30oQQ0fanXrvFZYYa+qCDSTHtfQmPw="
+    "version": "2.1.72",
+    "hash": "sha256-9CKyz72/Vp5/GIoxJzl7RAXTj4MvKTgFi/7fGyhRqf4="
  },
  {
    "pname": "Destructurama.Attributed",
-    "version": "5.2.0",
-    "hash": "sha256-0WBuqkLizviaHA5xrbSbs8Z90MLy+fal+NPe4LyLP2k="
+    "version": "5.3.0",
+    "hash": "sha256-1hj6Y0MSgjNRCSP90fFoaC3md58pOO9VsZzTpXRWFy0="
  },
  {
    "pname": "EFCore.BulkExtensions",
@ -126,13 +116,18 @@
  },
  {
    "pname": "Elastic.Clients.Elasticsearch",
-    "version": "9.3.0",
-    "hash": "sha256-h2ExrklcO6tVFV2ecxnGXA4uY9D1tiQ3sqmmN7wrRoM="
+    "version": "9.3.6",
+    "hash": "sha256-vRFjnDERVzH3uk9i2j0M8ygs9qzq9fL8jWxhnUX0ins="
+  },
+  {
+    "pname": "Elastic.Esql",
+    "version": "0.11.0",
+    "hash": "sha256-o4OYz2vJq5jOjuOzs6YVIwO5nIQYV5pDyVYwFzU2oDM="
  },
  {
    "pname": "Elastic.Transport",
-    "version": "0.10.3",
-    "hash": "sha256-9AcJAN3uP3wywsm52caPg6Qgt4iZS0nhjIl2bb0hlx8="
+    "version": "0.17.0",
+    "hash": "sha256-XRz9obr31ShKHAmNM9vkh9UZ7+u8GfGFvtX/wOduINw="
  },
  {
    "pname": "ExtendedNumerics.BigDecimal",
@ -191,8 +186,8 @@
  },
  {
    "pname": "Heron.MudCalendar",
-    "version": "3.4.0",
-    "hash": "sha256-QVrlIlO35o2LElr+Ac3F6UZHlI9fosIjheucWBF+QZU="
+    "version": "4.0.0",
+    "hash": "sha256-B0XLRt7/V3pHxOwNNwDpua/R53wS8hN6TrA+iHw03Nk="
  },
  {
    "pname": "HtmlSanitizer",
@ -206,8 +201,8 @@
  },
  {
    "pname": "Humanizer.Core",
-    "version": "3.0.1",
-    "hash": "sha256-Wxqf1FRXtsQulLFtbfsfYu4oZmrCuOZAikMcY2i6Dww="
+    "version": "3.0.10",
+    "hash": "sha256-mflSENjDof1Av9M9RLGEQcl4V4keVfH3qIxy/uxJ6FE="
  },
  {
    "pname": "J2N",
@ -216,23 +211,23 @@
  },
  {
    "pname": "Jint",
-    "version": "4.5.0",
-    "hash": "sha256-1+cTMz+HMVl+AVYRdpd77wblEF+aVRL+tTMoI46H52c="
+    "version": "4.8.0",
+    "hash": "sha256-+K8NGiJ1SChiyMrjn4dJOiBdnWXP6UOfXSsNsJ5//tI="
  },
  {
    "pname": "Json.More.Net",
-    "version": "3.0.0",
-    "hash": "sha256-zlJb9Wi9ErFqN8FYphzog9paPxI3DBVnoTL0c12Bfks="
+    "version": "3.0.1",
+    "hash": "sha256-U4Ers0TkbNsrC8TBJsuQcm9IHirf2BRCOf+9uaOhQSs="
  },
  {
    "pname": "JsonPointer.Net",
-    "version": "7.0.0",
-    "hash": "sha256-/1GemlLhmYnz/HDQTpEEaGxaofoFkFUMNNPInKhAvM4="
+    "version": "7.0.1",
+    "hash": "sha256-KCU4NBKrNAJysKlew0IHN5TD+Euo83wfG9Pi1koAWEk="
  },
  {
    "pname": "JsonSchema.Net",
-    "version": "9.0.0",
-    "hash": "sha256-N5bp2OswdoQI5fe/ZaKmk7LwL9woJ5cV4D43IUeFJ3E="
+    "version": "9.2.0",
+    "hash": "sha256-vz2JWvZ7HM87NXgGc+MS2Nff2q4u+w1gns8GK41LOmw="
  },
  {
    "pname": "LanguageExt.Core",
@ -279,11 +274,6 @@
    "version": "4.8.0-beta00017",
    "hash": "sha256-hHL4liVC3k8+PZVIE8N8SdT8UQkEj55IocsY5QEX52s="
  },
-  {
-    "pname": "Markdig",
-    "version": "0.44.0",
-    "hash": "sha256-EVuUTv5l68t7bP2vJ2njypxuRzH52AztXyBF9LUJrrI="
-  },
  {
    "pname": "MedallionTopologicalSort",
    "version": "1.0.0",
@ -316,33 +306,33 @@
  },
  {
    "pname": "Microsoft.AspNetCore.Authentication.JwtBearer",
-    "version": "10.0.2",
-    "hash": "sha256-3M89gVZd6YdEKk+/VnNJoWgAkqPkFj8PC32ai3vwm+E="
+    "version": "10.0.7",
+    "hash": "sha256-Y1DM6+4ji/xoAxv9NLsJOj7YUkQA5ItrlTR3NL2XcrE="
  },
  {
    "pname": "Microsoft.AspNetCore.Authentication.OpenIdConnect",
-    "version": "10.0.2",
-    "hash": "sha256-Lkp2a7n4MSsk33irb5ByVQ/zFZS5WcoG6Q+rwV8B27Y="
+    "version": "10.0.7",
+    "hash": "sha256-hr1QgB9miQO2rXj5heibTX/fa3Tj/Nci8G/pDcrq11c="
  },
  {
    "pname": "Microsoft.AspNetCore.JsonPatch",
-    "version": "10.0.2",
-    "hash": "sha256-b1IIM+6HOht8cQsi82KM2epHJ/CvRn16UK57tyWRiU0="
+    "version": "10.0.7",
+    "hash": "sha256-sbF5N0U+OXZKRUXXPppPrvJXevmUGnvDl6LqPtpEsBY="
  },
  {
    "pname": "Microsoft.AspNetCore.Mvc.NewtonsoftJson",
-    "version": "10.0.2",
-    "hash": "sha256-KSRRa8gmn84qphEFNaLl0PwVmG/gQpgzMHc4FIct8E0="
+    "version": "10.0.7",
+    "hash": "sha256-nVAGFNglXbdJtuk099NVyC+qN/lgL3T0UdZ0GtJ1d1M="
  },
  {
    "pname": "Microsoft.AspNetCore.OpenApi",
-    "version": "10.0.2",
-    "hash": "sha256-FU57fPXL4NUDRqi+rLresi4yKttv1KcAnLuEdPCyTos="
+    "version": "10.0.7",
+    "hash": "sha256-WlAW49otxYzgrmuqHewUoBsjDcAZwhNz5WVbCT4EiIA="
  },
  {
    "pname": "Microsoft.AspNetCore.SpaServices.Extensions",
-    "version": "10.0.2",
-    "hash": "sha256-ZY0Aj8amA9XLD/SWu7+kc/2ROq8lwHa5cK7k0ec4j9k="
+    "version": "10.0.7",
+    "hash": "sha256-xDbi4sbKmyrNYw+L1EIQx3RrVrezxPWICuz250dsEjA="
  },
  {
    "pname": "Microsoft.Bcl.AsyncInterfaces",
@ -421,8 +411,8 @@
  },
  {
    "pname": "Microsoft.Data.Sqlite.Core",
-    "version": "9.0.12",
-    "hash": "sha256-rV9MvBeKDh3DBf9IqHTzCogLKHsAJ0TEfcfSboCI/o0="
+    "version": "9.0.15",
+    "hash": "sha256-4KjfN468fFj8sapfSv4FzYpuhTie89UJ5jg18Nm06zc="
  },
  {
    "pname": "Microsoft.Data.Sqlite.Core",
@ -436,23 +426,23 @@
  },
  {
    "pname": "Microsoft.EntityFrameworkCore",
-    "version": "9.0.12",
-    "hash": "sha256-TCGyEqqYfJ5nXiAi0xVZe8Bwx8TZ0xefLE7h87b40+Y="
+    "version": "9.0.15",
+    "hash": "sha256-Ou8paIss4D6SL2T4mUB3URVD9gkpK6YQ+mmvTuwmxzg="
  },
  {
    "pname": "Microsoft.EntityFrameworkCore.Abstractions",
-    "version": "9.0.12",
-    "hash": "sha256-52OUOGyGUXiwdjWHm7bXbdTmJ1hyphBrrXfFQebptOU="
+    "version": "9.0.15",
+    "hash": "sha256-JISfrDTChiNqsXiwIh9hMOjLTUJcdkakFPjUqC3IXb4="
  },
  {
    "pname": "Microsoft.EntityFrameworkCore.Analyzers",
-    "version": "9.0.12",
-    "hash": "sha256-RNwUiYCSp/DxNEw+cNO51jFbN1H6jRtTs4XQAcc629E="
+    "version": "9.0.15",
+    "hash": "sha256-8/WBMCzYsfpJXLzH70Z1Yz4RUjHWf6vWBBMVb3VwEjM="
  },
  {
    "pname": "Microsoft.EntityFrameworkCore.Design",
-    "version": "9.0.12",
-    "hash": "sha256-ulEXCCNkXc3tLSHKqd6tXhj5txfuRL1MTxZNS1tQHnc="
+    "version": "9.0.15",
+    "hash": "sha256-4SPaldOH+RASmKSfLGViFf9gzZ3OsAvpBrm5TReqcn4="
  },
  {
    "pname": "Microsoft.EntityFrameworkCore.Relational",
@ -466,8 +456,8 @@
  },
  {
    "pname": "Microsoft.EntityFrameworkCore.Relational",
-    "version": "9.0.12",
-    "hash": "sha256-PNNKkfu7qB1oZDTI3QvT9TUk5EyR1YRriEznha4Q6+M="
+    "version": "9.0.15",
+    "hash": "sha256-Z/HgAgCHY2nWaOOWh5AYDTn1CpEZyNQJDOFv1GNlvp4="
  },
  {
    "pname": "Microsoft.EntityFrameworkCore.Relational",
@ -476,13 +466,13 @@
  },
  {
    "pname": "Microsoft.EntityFrameworkCore.Sqlite",
-    "version": "9.0.12",
-    "hash": "sha256-CMrv+8yvKwUj3dHBkdARBfRAbk+lpngXaLeRKsT3Nck="
+    "version": "9.0.15",
+    "hash": "sha256-Ydym7NoDB8wADqoG5k5fTT81Dlcqe5yyfSCfknQxz1M="
  },
  {
    "pname": "Microsoft.EntityFrameworkCore.Sqlite.Core",
-    "version": "9.0.12",
-    "hash": "sha256-XyBi4Sf3r9xzgbWWhSaxXMq9L9l7jhl0Uouql/yLnAQ="
+    "version": "9.0.15",
+    "hash": "sha256-j8y6Iy2M+56wWXdLBo6ZDWk6UlA128kdrsAh9VBDnRg="
  },
  {
    "pname": "Microsoft.EntityFrameworkCore.Sqlite.Core",
@ -506,28 +496,28 @@
  },
  {
    "pname": "Microsoft.Extensions.ApiDescription.Server",
-    "version": "10.0.2",
-    "hash": "sha256-3xz0RLS2+2wI6MI58VLRC5/gnEI+WpTAvPA56AZlE4E="
+    "version": "10.0.7",
+    "hash": "sha256-tqh27mFfF2GzXLCSSeX0uEQ9yXVuhlOZDHo3rJVLwKw="
  },
  {
    "pname": "Microsoft.Extensions.Caching.Abstractions",
-    "version": "10.0.2",
-    "hash": "sha256-nKmQuZTt1g5/8gBajo7wdCV64kdCucdiQR8JTt7ZZb0="
+    "version": "10.0.7",
+    "hash": "sha256-u3pHlFaDPeY2v89jNYLiHUQ2aGMKpe5wpXZUt8hkgdE="
  },
  {
    "pname": "Microsoft.Extensions.Caching.Abstractions",
-    "version": "9.0.12",
-    "hash": "sha256-5InZVZkpQztuUmMWSFtzanp9zPKfN1gb8Id0kNuaops="
+    "version": "9.0.15",
+    "hash": "sha256-x10lmXDYMA3mUS71ujHYKvDJSToDGVp5ajvxV0QaHuE="
  },
  {
    "pname": "Microsoft.Extensions.Caching.Memory",
-    "version": "10.0.2",
-    "hash": "sha256-sRUF7DM0s1yzZnfjM/hF9A/IysE6Er23gZ6jST+RWh0="
+    "version": "10.0.7",
+    "hash": "sha256-8qXL1F5gE9OZUEp/9pNVT33hjRMVAPt4eovT1NesKoQ="
  },
  {
    "pname": "Microsoft.Extensions.Caching.Memory",
-    "version": "9.0.12",
-    "hash": "sha256-jRs6ObQ4MmhCt0JoCSqlMLLjmPPu1uKnUGUncTjfFvg="
+    "version": "9.0.15",
+    "hash": "sha256-nlXdfEfziMtU3cEyadBlwU2ev3d+KtKSt9Sskgejteg="
  },
  {
    "pname": "Microsoft.Extensions.Caching.Memory",
@ -541,13 +531,13 @@
  },
  {
    "pname": "Microsoft.Extensions.Configuration",
-    "version": "10.0.1",
-    "hash": "sha256-7xdHie4uHwoGZz5yUT4vWg2EWvkLvsSzItWCoqm4dTM="
+    "version": "10.0.2",
+    "hash": "sha256-dBJAKDyp/sm+ZSMQfH0+4OH8Jnv1s20aHlWS6HNnH+c="
  },
  {
    "pname": "Microsoft.Extensions.Configuration",
-    "version": "10.0.2",
-    "hash": "sha256-dBJAKDyp/sm+ZSMQfH0+4OH8Jnv1s20aHlWS6HNnH+c="
+    "version": "10.0.7",
+    "hash": "sha256-2RqDs7+dXtGY78E5jSd1qyKu+dMQkbzv+oMY09SEJm0="
  },
  {
    "pname": "Microsoft.Extensions.Configuration.Abstractions",
@ -556,13 +546,13 @@
  },
  {
    "pname": "Microsoft.Extensions.Configuration.Abstractions",
-    "version": "10.0.1",
-    "hash": "sha256-s4PDp+vtzdxKIxnOT3+dDRoTDopyl8kqmmw4KDnkOtQ="
+    "version": "10.0.2",
+    "hash": "sha256-P+0kaDGO+xB9KxF9eWHDJ4hzi05sUGM/uMNEX5NdBTE="
  },
  {
    "pname": "Microsoft.Extensions.Configuration.Abstractions",
-    "version": "10.0.2",
-    "hash": "sha256-P+0kaDGO+xB9KxF9eWHDJ4hzi05sUGM/uMNEX5NdBTE="
+    "version": "10.0.7",
+    "hash": "sha256-MnUJzZYnl089xuVi6kpt9kymBIvYun9U+Itd12dM5Co="
  },
  {
    "pname": "Microsoft.Extensions.Configuration.Abstractions",
@ -571,8 +561,8 @@
  },
  {
    "pname": "Microsoft.Extensions.Configuration.Abstractions",
-    "version": "9.0.12",
-    "hash": "sha256-FYIGDiv0aVApHCpoVQs4o9sWeFZhXb3XfK/zWXYlH1g="
+    "version": "9.0.15",
+    "hash": "sha256-oiFKtv9fTTQrlk4C/fMY0Jp0ZcxlbvN2WEsMVfPw9J8="
  },
  {
    "pname": "Microsoft.Extensions.Configuration.Abstractions",
@ -586,13 +576,13 @@
  },
  {
    "pname": "Microsoft.Extensions.Configuration.Binder",
-    "version": "10.0.1",
-    "hash": "sha256-fiqTHE6EfaUXICaVrWzQEU/K6GjQNac6yRNErig6wRk="
+    "version": "10.0.2",
+    "hash": "sha256-resI9gIxHh2cc+258/i+TjW8xxzKf4ZBTLIcWAMEYz0="
  },
  {
    "pname": "Microsoft.Extensions.Configuration.Binder",
-    "version": "10.0.2",
-    "hash": "sha256-resI9gIxHh2cc+258/i+TjW8xxzKf4ZBTLIcWAMEYz0="
+    "version": "10.0.7",
+    "hash": "sha256-lU4G801+Cy3ua+S2slY5UVHOPXdF0I7r3lYX38mQSPw="
  },
  {
    "pname": "Microsoft.Extensions.DependencyInjection",
@ -601,24 +591,24 @@
  },
  {
    "pname": "Microsoft.Extensions.DependencyInjection",
-    "version": "10.0.2",
-    "hash": "sha256-/9UWQRAI2eoocnJWWf1ktnAx/1Gt65c16fc0Xqr9+CQ="
+    "version": "10.0.7",
+    "hash": "sha256-dICogdaqa5mHqyvFA0lTomFa39Dqm4nn7Pit6qi6eQY="
  },
  {
    "pname": "Microsoft.Extensions.DependencyInjection",
-    "version": "9.0.12",
-    "hash": "sha256-pNKpg5UELjrn4Tm9s0aJigCX7qJ/JeqboU7TY3k+jUo="
-  },
-  {
-    "pname": "Microsoft.Extensions.DependencyInjection.Abstractions",
-    "version": "10.0.1",
-    "hash": "sha256-zNUpau51ds7iQTaSUTFtyTHIUoinYc129W50CnufMdQ="
+    "version": "9.0.15",
+    "hash": "sha256-9GklcF6RO6QPZTSLzCe/Vy7mPLJIq4lbHhQ9xg+Nvlo="
  },
  {
    "pname": "Microsoft.Extensions.DependencyInjection.Abstractions",
    "version": "10.0.2",
    "hash": "sha256-UF9T13V5SQxJy2msfLmyovLmitZrjJayf8gHH+uK2eg="
  },
+  {
+    "pname": "Microsoft.Extensions.DependencyInjection.Abstractions",
+    "version": "10.0.7",
+    "hash": "sha256-uQmTQarMn0fuZV03MyCb78Ex+96cuqFHNO5SyFOPkJk="
+  },
  {
    "pname": "Microsoft.Extensions.DependencyInjection.Abstractions",
    "version": "8.0.0",
@ -631,8 +621,8 @@
  },
  {
    "pname": "Microsoft.Extensions.DependencyInjection.Abstractions",
-    "version": "9.0.12",
-    "hash": "sha256-EZt7Vjl0dll6GZOVCTfC2cYxAG5IWtJHeOGlDJ7rHTg="
+    "version": "9.0.15",
+    "hash": "sha256-hszOr6dqOMuiuWPlIbBvqtay42oZfeWtwqX92rvM2MI="
  },
  {
    "pname": "Microsoft.Extensions.DependencyModel",
@ -641,23 +631,18 @@
  },
  {
    "pname": "Microsoft.Extensions.DependencyModel",
-    "version": "9.0.12",
-    "hash": "sha256-CMh5AhCkjIzS0BP+GKael2eIoDSpyXsipWo/M7pcT8g="
+    "version": "9.0.15",
+    "hash": "sha256-g8Fe7eV3NX5av6rRA9nlvuf8Pc+0ht7eiVQ8YLG+T2o="
  },
  {
    "pname": "Microsoft.Extensions.DependencyModel",
    "version": "9.0.9",
    "hash": "sha256-0ygY8JLOIKuYFwwdVCtDl8/8fV5IC9JgivfzXsjXXsI="
  },
-  {
-    "pname": "Microsoft.Extensions.DiagnosticAdapter",
-    "version": "3.1.32",
-    "hash": "sha256-moN7Vt47IZ0ZHRMjW+Y1Vbn/7ekvkj9GSm4yjIeAGnI="
-  },
  {
    "pname": "Microsoft.Extensions.Diagnostics",
-    "version": "10.0.2",
-    "hash": "sha256-Zb/qJA0cZYiPQO7I3AegZCcNT0aJlKTycUP11Mqbm6o="
+    "version": "10.0.7",
+    "hash": "sha256-Sd0ZsXgO7w/35vOKN1B0CZdcIcMJnf/Z/8POSikTyRk="
  },
  {
    "pname": "Microsoft.Extensions.Diagnostics.Abstractions",
@ -666,8 +651,8 @@
  },
  {
    "pname": "Microsoft.Extensions.Diagnostics.Abstractions",
-    "version": "10.0.2",
-    "hash": "sha256-Aob6wq51LdquE7SkkxtCzcuHBKWrJcb3Ebi/dU3aqA4="
+    "version": "10.0.7",
+    "hash": "sha256-ocntk68Qa3ccHGEnzmZuKdBWdQEnp4PgwJk63bSRjDA="
  },
  {
    "pname": "Microsoft.Extensions.FileProviders.Abstractions",
@ -676,8 +661,8 @@
  },
  {
    "pname": "Microsoft.Extensions.FileProviders.Abstractions",
-    "version": "10.0.2",
-    "hash": "sha256-tibCkkT9WliU2E/i0ufx7/Va6H6QZX4hR/1oUp8ecgQ="
+    "version": "10.0.7",
+    "hash": "sha256-ibxSdxibq1UKOo4Mz+zthbZd0UUFipnJNb0hPwvEXCA="
  },
  {
    "pname": "Microsoft.Extensions.Hosting.Abstractions",
@ -686,24 +671,19 @@
  },
  {
    "pname": "Microsoft.Extensions.Hosting.Abstractions",
-    "version": "10.0.2",
-    "hash": "sha256-mkeKUXepn4bfEdZFXdURmNEFdGiHQdpcxnm6joG+pUA="
+    "version": "10.0.7",
+    "hash": "sha256-S1WAgBHPi7H71uQUGyl2aG/IITgYfVNznyXsFrRe/kE="
  },
  {
    "pname": "Microsoft.Extensions.Http",
-    "version": "10.0.2",
-    "hash": "sha256-0q9E0HO4YIqUs9ceZpY+nMKtdqdtncTbOjyEOlYdWHs="
+    "version": "10.0.7",
+    "hash": "sha256-cbTDyODUPitTBOn88A5R5/QGPzOTCT7qeyP2gG6WOS0="
  },
  {
    "pname": "Microsoft.Extensions.Logging",
    "version": "10.0.0",
    "hash": "sha256-P+zPAadLL63k/GqK34/qChqQjY9aIRxZfxlB9lqsSrs="
  },
-  {
-    "pname": "Microsoft.Extensions.Logging",
-    "version": "10.0.1",
-    "hash": "sha256-zuLP3SIpCToMOlIPOEv3Kq8y/minecd8k8GSkxFo13E="
-  },
  {
    "pname": "Microsoft.Extensions.Logging",
    "version": "10.0.2",
@ -711,8 +691,13 @@
  },
  {
    "pname": "Microsoft.Extensions.Logging",
-    "version": "9.0.12",
-    "hash": "sha256-9QhfuxEeAiRoP6rYPs2TZY3N/BAd3AgHGwc1wEIcy6o="
+    "version": "10.0.7",
+    "hash": "sha256-AUOet0nWZHB132XCPuyUp5xTFNnWjHhoOtzooFcXHk4="
+  },
+  {
+    "pname": "Microsoft.Extensions.Logging",
+    "version": "9.0.15",
+    "hash": "sha256-V4ylLCMDJnQzmbR+20+NUlXXw6a3SpGn5VIZ1eCrjuU="
  },
  {
    "pname": "Microsoft.Extensions.Logging",
@ -726,13 +711,13 @@
  },
  {
    "pname": "Microsoft.Extensions.Logging.Abstractions",
-    "version": "10.0.1",
-    "hash": "sha256-NRk0feNE1fgi/hyO0AVDbSGJQRT+9yte6Lpm4Hz/2Bs="
+    "version": "10.0.2",
+    "hash": "sha256-ndKGzq8+2J/hvaIULwBui0L/jDyMQTAY24j+ohX5VX8="
  },
  {
    "pname": "Microsoft.Extensions.Logging.Abstractions",
-    "version": "10.0.2",
-    "hash": "sha256-ndKGzq8+2J/hvaIULwBui0L/jDyMQTAY24j+ohX5VX8="
+    "version": "10.0.7",
+    "hash": "sha256-/ITLUXgcs5tRDdeileNlmNB92V25CRd1FGBocChJj0g="
  },
  {
    "pname": "Microsoft.Extensions.Logging.Abstractions",
@ -746,34 +731,29 @@
  },
  {
    "pname": "Microsoft.Extensions.Logging.Abstractions",
-    "version": "9.0.12",
-    "hash": "sha256-pl+0ezSkx+GND5pH2gtvhdMiCPodD1YvNP7wl4gDQt4="
+    "version": "9.0.15",
+    "hash": "sha256-n8lNcXF+LGLOfYGn6eQ8iFO6eV+XyP2PjVknG73sQbM="
  },
  {
    "pname": "Microsoft.Extensions.Logging.Configuration",
-    "version": "10.0.1",
-    "hash": "sha256-/7ywcFsEmmQzWEcIvxoGAYHF0oDSXV/LTDAiW/MNQtg="
+    "version": "10.0.2",
+    "hash": "sha256-eSfmagvrcdRVmTXEdzfvWEDNBewB/YClOGSDq4gThk0="
  },
  {
    "pname": "Microsoft.Extensions.Logging.Console",
-    "version": "10.0.1",
-    "hash": "sha256-m/E02c5NSCYyH4THNKxpnsi3Kp8gqOi2aPrfXx7sQ9s="
+    "version": "10.0.2",
+    "hash": "sha256-mfaypUwMZxEIKBfnmzhnCScC/uPpZBRYN+/2SNcxcu4="
  },
  {
    "pname": "Microsoft.Extensions.Logging.TraceSource",
-    "version": "10.0.1",
-    "hash": "sha256-NS7P5jo7dtiH7DmyyipTIfaRf4ZwEJLU2UVG+4hlFSE="
+    "version": "10.0.2",
+    "hash": "sha256-iD2epXLjKr41et5vJJTzLTxm+GzVxbAUMrwRm9jmH1c="
  },
  {
    "pname": "Microsoft.Extensions.Options",
    "version": "10.0.0",
    "hash": "sha256-j5MOqZSKeUtxxzmZjzZMGy0vELHdvPraqwTQQQNVsYA="
  },
-  {
-    "pname": "Microsoft.Extensions.Options",
-    "version": "10.0.1",
-    "hash": "sha256-vBiSS1vqAC7eDrpJNT4H3A9qLikCSAepnNRbry0mKnk="
-  },
  {
    "pname": "Microsoft.Extensions.Options",
    "version": "10.0.2",
@ -781,19 +761,24 @@
  },
  {
    "pname": "Microsoft.Extensions.Options",
-    "version": "9.0.12",
-    "hash": "sha256-WuEpn1zvPWdS+TTu30s1Z3KMUt+4GpdwRpzqrhtfd60="
+    "version": "10.0.7",
+    "hash": "sha256-XtyfdZ26kjnuCF/YHbdGdsIeR/nxSW7yyQZ04sOa9RU="
  },
  {
-    "pname": "Microsoft.Extensions.Options.ConfigurationExtensions",
-    "version": "10.0.1",
-    "hash": "sha256-1CNSVXZ3RAH4vzbYDqcQHl9c/YBhuSfrFUXCLIx5/rY="
+    "pname": "Microsoft.Extensions.Options",
+    "version": "9.0.15",
+    "hash": "sha256-p1ilUJEqSUSAx3mlTmMm6Jh3A9QvjL+L5D34wugbWIc="
  },
  {
    "pname": "Microsoft.Extensions.Options.ConfigurationExtensions",
    "version": "10.0.2",
    "hash": "sha256-WJahsWyT5wYdLPEJufHKpb3l/dl7D2iw2SnMK0Jr53U="
  },
+  {
+    "pname": "Microsoft.Extensions.Options.ConfigurationExtensions",
+    "version": "10.0.7",
+    "hash": "sha256-6UBnB1ouWwRkVEGt5xLfXZvpYsCQQJijKvBlBCJOmmM="
+  },
  {
    "pname": "Microsoft.Extensions.Primitives",
    "version": "10.0.0",
@ -801,8 +786,8 @@
  },
  {
    "pname": "Microsoft.Extensions.Primitives",
-    "version": "10.0.2",
-    "hash": "sha256-8Ccrjjv9cFVf9RyCc7GS/Byt8+DXdSNea0UX3A5BEdA="
+    "version": "10.0.7",
+    "hash": "sha256-cQBhL1IkRl1lxaZImAZBVS39CfWkB+J6+hJVEVBE35I="
  },
  {
    "pname": "Microsoft.Extensions.Primitives",
@ -811,8 +796,8 @@
  },
  {
    "pname": "Microsoft.Extensions.Primitives",
-    "version": "9.0.12",
-    "hash": "sha256-aJBpI8kad6jm0Pno4WQWJZnbM2E3zayjfa8gvoMXI7I="
+    "version": "9.0.15",
+    "hash": "sha256-t5zLMH4Vkmuufk53RX0K/sHo7Yy16TuUd8fUd6de0N8="
  },
  {
    "pname": "Microsoft.Identity.Client",
@ -921,8 +906,8 @@
  },
  {
    "pname": "MudBlazor",
-    "version": "8.15.0",
-    "hash": "sha256-I6kJEvND0i3I/amZBhDF8LjYeGGWuMwoSLiev6BS3UM="
+    "version": "9.4.0",
+    "hash": "sha256-PsWZYhD35e+W0iBvRN0rv6PspDr615MNBrYGHNIfcNY="
  },
  {
    "pname": "MySqlConnector",
@ -936,13 +921,13 @@
  },
  {
    "pname": "NCalc.Core",
-    "version": "5.11.0",
-    "hash": "sha256-THgAix81mZxztHNMf5JlTPUGbcs1ZuRS3EVM7eFHseg="
+    "version": "5.12.0",
+    "hash": "sha256-TxeBjIq33bNgHGWgJRjdKmhnxr3lscEFmL59bBNG0UU="
  },
  {
    "pname": "NCalcSync",
-    "version": "5.11.0",
-    "hash": "sha256-Kui0K2WuLS0filTnpdcA3/H/XqqDOjtKms97WqbulEw="
+    "version": "5.12.0",
+    "hash": "sha256-Hraol6T5U8B8Z1DrincdjJZREjkt9ZbBPAH7wtZN4a4="
  },
  {
    "pname": "NETStandard.Library",
@ -1016,8 +1001,8 @@
  },
  {
    "pname": "Parlot",
-    "version": "1.5.6",
-    "hash": "sha256-Ffbs7IpgN0aOKScBe64PGySnzWxapVSuM73fQmt+2nU="
+    "version": "1.5.7",
+    "hash": "sha256-mvAu74ty4uRP3f+Yy4R/HuhJKApOx/6ASl8nJ1mzvqM="
  },
  {
    "pname": "Pomelo.EntityFrameworkCore.MySql",
@ -1026,23 +1011,23 @@
  },
  {
    "pname": "Refit",
-    "version": "9.0.2",
-    "hash": "sha256-FTq+jJLV9ow3hTrzTBEYwuAibxY6m0XgExNeIGoAAK4="
+    "version": "10.1.6",
+    "hash": "sha256-KC0PVsbqx5RHZxItYgJaBeUQBlPLQbTx643BzEhXIc0="
  },
  {
    "pname": "Refit.HttpClientFactory",
-    "version": "9.0.2",
-    "hash": "sha256-qxUm0NlJqoOPFRTu7ArdcSR696t5zCB+BniJv1+Xdkc="
+    "version": "10.1.6",
+    "hash": "sha256-/fkHB7cFXIRVUDnznQVJBgpwLS8KdhtiASF78xp4C8Q="
  },
  {
    "pname": "Refit.Newtonsoft.Json",
-    "version": "9.0.2",
-    "hash": "sha256-cxZtCv7gecMVIVzDrgjMBg81dEAq6DT9ccR10SKuFV4="
+    "version": "10.1.6",
+    "hash": "sha256-SJq065kLgo9cJn5sg64hK+7dMxezJbdQJdlp4U1M/1M="
  },
  {
    "pname": "Refit.Xml",
-    "version": "9.0.2",
-    "hash": "sha256-FNP7WAnsjncwdSvj4j7mxP2I+O3TNiYzlaTYVBlMWEo="
+    "version": "10.1.6",
+    "hash": "sha256-VgPvKHxAB+X5hkD+eapzDcgB8Z+0ZIeX/D14vGRhrCU="
  },
  {
    "pname": "RichTextKit.Stbear",
@ -1051,13 +1036,13 @@
  },
  {
    "pname": "Scalar.AspNetCore",
-    "version": "2.12.32",
-    "hash": "sha256-0EZAD43NpMpX3P8quuctTLSGBxwjxxbyfQodo0e+nII="
+    "version": "2.14.10",
+    "hash": "sha256-NojV2iMXKFbZTypeqLhgNdebb9hGLsFyDjkHrjSOryM="
  },
  {
    "pname": "Scriban.Signed",
-    "version": "6.5.2",
-    "hash": "sha256-rnhmugQoX+lI0sO+V3KIAsQ9kWs0ow7EpEriQLCYAQw="
+    "version": "7.1.0",
+    "hash": "sha256-bUADaUvCUz4uOx/zpiG5IaQKHlWRLiUmCg+90CTuJgI="
  },
  {
    "pname": "Serilog",
@ -1069,6 +1054,11 @@
    "version": "4.3.0",
    "hash": "sha256-jyIy4BjsyFXge3aO4GRFAdnX4/rz1MHfBkBDIpCDsTw="
  },
+  {
+    "pname": "Serilog",
+    "version": "4.3.1",
+    "hash": "sha256-TY+GaQYnyDfOGl0gi67xDyUMOuV/mjz8BU66/UsmStI="
+  },
  {
    "pname": "Serilog.AspNetCore",
    "version": "10.0.0",
@ -1131,8 +1121,8 @@
  },
  {
    "pname": "SkiaSharp",
-    "version": "3.119.1",
-    "hash": "sha256-TIVr52NpQ9cab5eJCcH/OYHjNOTKhwCqpClK2c8S4TM="
+    "version": "3.119.2",
+    "hash": "sha256-A9F397K5FfLeOsNZacKmUh4IU/WMK60B4Z6TEtS/oqo="
  },
  {
    "pname": "SkiaSharp.HarfBuzz",
@ -1146,18 +1136,18 @@
  },
  {
    "pname": "SkiaSharp.NativeAssets.Linux.NoDependencies",
-    "version": "3.119.1",
-    "hash": "sha256-SprThyApThbDoeTn/JaaS7TKdm9SkMoVO8V8HuCyppI="
+    "version": "3.119.2",
+    "hash": "sha256-79BCLZAYjfHP1DZKgB+hsyyBlhnyZQPi+Swvs0RYnng="
  },
  {
    "pname": "SkiaSharp.NativeAssets.macOS",
-    "version": "3.119.1",
-    "hash": "sha256-0QJGcO91MWLSeQpE4ZNn/KUVoHRcrPeDbKklxCVB00o="
+    "version": "3.119.2",
+    "hash": "sha256-KEeGqSiyAiMbzLgH/0JkwUz/pWcL49gYB1T1YLkMPaI="
  },
  {
    "pname": "SkiaSharp.NativeAssets.Win32",
-    "version": "3.119.1",
-    "hash": "sha256-ySPkn8SrShOqhihC33EJ4HJt9desDISC4gAI4FQBi2U="
+    "version": "3.119.2",
+    "hash": "sha256-CI6dg+MlxX8t+vbnkxtd5QE3xalMKkA8LUSudxg7TNU="
  },
  {
    "pname": "SQLitePCLRaw.bundle_e_sqlite3",
@ -1196,8 +1186,8 @@
  },
  {
    "pname": "System.CommandLine",
-    "version": "2.0.2",
-    "hash": "sha256-PK3wKHjY8FHkPV75Z4ouxKU67WcuVSiMFjAkBs+iSAo="
+    "version": "2.0.7",
+    "hash": "sha256-CGm46Hk7eZFvIySEynE+A0Hs5EXDs2FNKKhk/rU77jM="
  },
  {
    "pname": "System.Composition",
@ -1311,18 +1301,18 @@
  },
  {
    "pname": "Testably.Abstractions",
-    "version": "10.0.0",
-    "hash": "sha256-2rixQaYGhCM+NjmkxgOBNjJMFcNHr+3TPP+vsRUMj4w="
+    "version": "10.2.0",
+    "hash": "sha256-5qGJPTlon9GBIpXa8vmZOjjPGMTnbXIDzORY10FEl1w="
  },
  {
    "pname": "Testably.Abstractions.FileSystem.Interface",
-    "version": "10.0.0-pre.1",
-    "hash": "sha256-UO/Ly7Qd7AqYOIP52pS1YYoaQgOzzZ5745naHMqULZs="
+    "version": "10.2.0",
+    "hash": "sha256-4gUlDhO39+eBA/5xbraFpMztu4fcr0SzB+N4amLemQ4="
  },
  {
    "pname": "Testably.Abstractions.Interface",
-    "version": "10.0.0-pre.1",
-    "hash": "sha256-Te2+jj1jSleYGEJHlrmj9GYTht62mY14E5WCKDHx4pQ="
+    "version": "10.2.0",
+    "hash": "sha256-dNazu3BDDWJp/4O7+Rx2MTPDGypQa8p7LJ3fTAWaP7M="
  },
  {
    "pname": "TimeSpanParserUtil",
@ -1341,8 +1331,8 @@
  },
  {
    "pname": "WebMarkupMin.Core",
-    "version": "2.20.1",
-    "hash": "sha256-6ze4MOSfIKdvMJsroQRtESB8KG5XogO3xk4qOSkHpXQ="
+    "version": "2.21.0",
+    "hash": "sha256-k51tTFcdL9Bwsg3gA51ZswGxDtdBFb22BAj9wbyZu1E="
  },
  {
    "pname": "Winista.MimeDetect",
@ -1351,7 +1341,7 @@
  },
  {
    "pname": "YamlDotNet",
-    "version": "16.3.0",
-    "hash": "sha256-4Gi8wSQ8Rsi/3+LyegJr//A83nxn2fN8LN1wvSSp39Q="
+    "version": "17.1.0",
+    "hash": "sha256-Zdlw62rVud2U94BQKqrp5OFQiDcQ9rRrKeaVnNxREjY="
  }
 ]
--- a/pkgs/by-name/er/ersatztv/package.nix
+++ b/pkgs/by-name/er/ersatztv/package.nix
@ -9,13 +9,13 @@

 buildDotnetModule rec {
  pname = "ersatztv";
-  version = "26.3.0";
+  version = "26.5.1";

  src = fetchFromGitHub {
    owner = "ErsatzTV";
-    repo = "ErsatzTV";
+    repo = "legacy";
    rev = "v${version}";
-    sha256 = "sha256-yFGMkTI+IQs3WTOQzxhqj3ownENsIzLqrDr3nWurzfA=";
+    sha256 = "sha256-2w+4xppj3E8H6WXea/iuNfloUmBsFQKDBpTnUn3RWvE=";
  };
  postPatch = ''
    # Remove config of development tools that don't end up in
--- a/pkgs/by-name/er/ersatztv/update.sh
+++ b/pkgs/by-name/er/ersatztv/update.sh
@ -3,7 +3,7 @@

 set -euo pipefail

-latestVersion="$(curl -s ${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} "https://api.github.com/repos/ersatztv/ersatztv/releases?per_page=1" | jq -r ".[0].tag_name" | sed 's/^v//')"
+latestVersion="$(curl -s ${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} "https://api.github.com/repos/ersatztv/legacy/releases?per_page=1" | jq -r ".[0].tag_name" | sed 's/^v//')"
 currentVersion=$(nix-instantiate --eval -E "with import ./. {}; ersatztv.version or (lib.getVersion ersatztv)" | tr -d '"')

 if [[ "$currentVersion" == "$latestVersion" ]]; then
--- a/pkgs/by-name/fi/fish/package.nix
+++ b/pkgs/by-name/fi/fish/package.nix
@ -2,12 +2,14 @@
  stdenv,
  lib,
  fetchFromGitHub,
+  buildPackages,
  coreutils,
  darwin,
  glibcLocales,
  gnused,
  gnugrep,
  gawk,
+  fish,
  man-db,
  ninja,
  getent,
@ -281,12 +283,19 @@ stdenv.mkDerivation (finalAttrs: {
    pkg-config
    rustc
    rustPlatform.cargoSetupHook
-    (python3.withPackages (ps: [
+    (buildPackages.python3.withPackages (ps: [
      ps.pexpect
      ps.sphinx
    ]))
    # Avoid warnings when building the manpages about HOME not being writable
    writableTmpDirAsHomeHook
+  ]
+  ++ lib.optionals (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
+    # Building the docs ends up wanting to run fish_indent at build
+    # time, which obviously can't use a cross compiled fish_indent
+    # from this derivation. Pull in the build platform's fish to
+    # provide it.
+    fish
  ];

  buildInputs = [
--- a/pkgs/by-name/fl/flow/package.nix
+++ b/pkgs/by-name/fl/flow/package.nix
@ -16,13 +16,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "flow";
-  version = "0.312.0";
+  version = "0.313.0";

  src = fetchFromGitHub {
    owner = "facebook";
    repo = "flow";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-dZJ/WjCmwNIbo/kgFTuaSBOtK/fOg69L5D5PFdvSn/w=";
+    hash = "sha256-U2TC9IV414X71zhrRb47kCvQkVqOSxzeNnfuoBSeJQE=";
  };

  patches = [
--- a/pkgs/by-name/fo/forgejo/package.nix
+++ b/pkgs/by-name/fo/forgejo/package.nix
@ -1,8 +1,8 @@
 import ./generic.nix {
-  version = "15.0.1";
-  hash = "sha256-40hyQ6MPskyty/LsMVczuDpbu2q3Syoj3c00HUS+pVE=";
-  npmDepsHash = "sha256-xWbnSX11RkLjtJ62qG6rD+xQAOnUuI99r9uEHakkZPY=";
-  vendorHash = "sha256-JUBAcRYgflrvoAK0OvaU/Xr6/BakgaUtYwtvBF9vyk0=";
+  version = "15.0.2";
+  hash = "sha256-ba5jog6eXY4TTmBblhfVa2LSLPGE1/HPfslIb30b3kk=";
+  npmDepsHash = "sha256-70w39jbMWpuAsbzBC9oFHaUMwshtFDeTSEOXDgFNPmE=";
+  vendorHash = "sha256-I6bGvXBP2K3+Xx9E9DS/AyG6Ilqf/s8VjfBnCmLUHsk=";
  lts = true;
  nixUpdateExtraArgs = [
    "--override-filename"
--- a/pkgs/by-name/fo/foundry/package.nix
+++ b/pkgs/by-name/fo/foundry/package.nix
@ -5,6 +5,7 @@
  fetchFromGitHub,
  libusb1,
  nix-update-script,
+  perl,
  pkg-config,
  rustPlatform,
  versionCheckHook,
@ -12,18 +13,25 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "foundry";
-  version = "1.5.1";
+  version = "1.7.0";
+
+  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "foundry-rs";
    repo = "foundry";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-dMYuv5noIn86WuUJkUixnoNGLgByacung/TBU+EYhUw=";
+    hash = "sha256-UCaBo4hMStmh79UiyYu7vEO7UtrvwJshe4PTMkqZV0w=";
  };

-  cargoHash = "sha256-+5RLCkAQR8UepdUIsq1FnQmjKMg7YNC1Sxu0CVpWcnc=";
+  cargoHash = "sha256-iAWUEVgOgn2Zw9fINxyH9Bynh+flzCY40YFGoVLgG8k=";
+
+  strictDeps = true;

  nativeBuildInputs = [
+    # `sha3-asm`'s build script runs cryptogams perl scripts to generate
+    # Keccak assembly, so perl must be available at build time.
+    perl
    pkg-config
  ]
  ++ lib.optionals stdenv.hostPlatform.isDarwin [ darwin.DarwinTools ];
@ -43,6 +51,13 @@ rustPlatform.buildRustPackage (finalAttrs: {
  passthru.updateScript = nix-update-script { };

  env = {
+    # The build script in `crates/common/build.rs` uses vergen to embed
+    # `git describe` / SHA output, but the GitHub source tarball has no `.git`
+    # directory. Pre-set the values so vergen reuses them instead of shelling
+    # out to git.
+    VERGEN_GIT_SHA = finalAttrs.src.rev;
+    VERGEN_GIT_DESCRIBE = "v${finalAttrs.version}";
+
    SVM_RELEASES_LIST_JSON =
      if stdenv.hostPlatform.isDarwin then
        # Confusingly, these are universal binaries, not amd64.
@ -64,6 +79,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
      beeb
      mitchmindtree
      msanft
+      samooyo
    ];
    platforms = lib.platforms.unix;
  };
--- a/pkgs/by-name/fr/froide/package.nix
+++ b/pkgs/by-name/fr/froide/package.nix
@ -8,13 +8,14 @@
  geos,
  fetchPnpmDeps,
  pnpmConfigHook,
-  pnpm,
+  pnpm_10,
  nodejs,
  postgresql,
  postgresqlTestHook,
  playwright-driver,
 }:
 let
+  pnpm = pnpm_10;

  python = python3Packages.python.override {
    packageOverrides = self: super: {
@ -120,7 +121,12 @@ python.pkgs.buildPythonApplication rec {
  ];

  pnpmDeps = fetchPnpmDeps {
-    inherit pname version src;
+    inherit
+      pname
+      version
+      src
+      pnpm
+      ;
    fetcherVersion = 3;
    hash = "sha256-NbfCVD+gmtoxuYUCumTKj9P72utK787VdlnuU4lMMGc=";
  };
--- a/pkgs/by-name/gi/git-ls/package.nix
+++ b/pkgs/by-name/gi/git-ls/package.nix
@ -9,7 +9,7 @@

 buildGoModule (finalAttrs: {
  pname = "git-ls";
-  version = "6.0.0";
+  version = "6.1.0";

  __structuredAttrs = true;
  strictDeps = true;
@ -18,7 +18,7 @@ buildGoModule (finalAttrs: {
    owner = "llimllib";
    repo = "git-ls";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Is1bt1XLrzatxhMTrzClBeIWkTdepzDaDla1Ng+wrJ0=";
+    hash = "sha256-RSSddZRgYYQcHQA7ZVGLx/iZFx0crFiSY/EF2luWVjA=";
  };

  vendorHash = "sha256-Bk6IBG+BrqY4FNVIlbSSSnqqAeL+8SJUtRXuIp4e8f8=";
--- a/pkgs/by-name/gi/gitbutler/package.nix
+++ b/pkgs/by-name/gi/gitbutler/package.nix
@ -19,7 +19,7 @@
  pkg-config,
  fetchPnpmDeps,
  pnpmConfigHook,
-  pnpm,
+  pnpm_10,
  rust,
  rustPlatform,
  turbo,
@ -27,7 +27,9 @@
  wrapGAppsHook4,
  dart-sass,
 }:
-
+let
+  pnpm = pnpm_10;
+in
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "gitbutler";
  version = "0.19.7";
@ -58,6 +60,7 @@ rustPlatform.buildRustPackage (finalAttrs: {

  pnpmDeps = fetchPnpmDeps {
    inherit (finalAttrs) pname version src;
+    inherit pnpm;
    fetcherVersion = 3;
    hash = "sha256-eRiFA5lXpPHQwlyFmKMx1zmHH2zLCHB+3s708g6srg4=";
  };
--- a/pkgs/by-name/gi/gitea/package.nix
+++ b/pkgs/by-name/gi/gitea/package.nix
@ -13,19 +13,22 @@
  openssh,
  fetchPnpmDeps,
  pnpmConfigHook,
-  pnpm,
+  pnpm_10,
  stdenv,
  sqliteSupport ? true,
  nixosTests,
 }:

 let
+  pnpm = pnpm_10;
+
  frontend = stdenv.mkDerivation (finalAttrs: {
    pname = "gitea-frontend";
    inherit (gitea) src version;

    pnpmDeps = fetchPnpmDeps {
      inherit (finalAttrs) pname version src;
+      inherit pnpm;
      fetcherVersion = 3;
      hash = "sha256-dewYYPO2wmNyYiQadoEKWJ10cghm6Lv7UE1iVlyNiEY=";
    };
--- a/pkgs/by-name/go/goaway/package.nix
+++ b/pkgs/by-name/go/goaway/package.nix
@ -6,12 +6,14 @@
  makeWrapper,
  net-tools,
  nodejs,
-  pnpm,
+  pnpm_10,
  pnpmConfigHook,
  stdenvNoCC,
 }:

 let
+  pnpm = pnpm_10;
+
  version = "0.63.15";

  src = fetchFromGitHub {
@ -27,6 +29,7 @@ let

    pnpmDeps = fetchPnpmDeps {
      inherit (finalAttrs) pname version src;
+      inherit pnpm;
      sourceRoot = "${finalAttrs.src.name}/client";
      fetcherVersion = 3;
      hash = "sha256-GM86Os1OQaagD61BEIIsqhWJNVPFA9Z5RiYWyHlQlwY=";
--- a/pkgs/by-name/go/google-chrome/package.nix
+++ b/pkgs/by-name/go/google-chrome/package.nix
@ -184,11 +184,11 @@ let

  linux = stdenvNoCC.mkDerivation (finalAttrs: {
    inherit pname meta passthru;
-    version = "148.0.7778.96";
+    version = "148.0.7778.167";

    src = fetchurl {
      url = "https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-stable/google-chrome-stable_${finalAttrs.version}-1_amd64.deb";
-      hash = "sha256-Rmowgy0t/GJkiu28ZkXdzi5dzFxpFpzhcbZgsdFKl0c=";
+      hash = "sha256-1k9PrK1mpUJFJ6RbC3ZEN0CqOLX4JbGpmpXQrDpZTVU=";
    };

    # With strictDeps on, some shebangs were not being patched correctly
@ -302,11 +302,11 @@ let

  darwin = stdenvNoCC.mkDerivation (finalAttrs: {
    inherit pname meta passthru;
-    version = "148.0.7778.97";
+    version = "148.0.7778.168";

    src = fetchurl {
-      url = "http://dl.google.com/release2/chrome/fqffxmazeqztj7lx2lxedj2iwy_148.0.7778.97/GoogleChrome-148.0.7778.97.dmg";
-      hash = "sha256-lfmEmoovaTcgyvetQnXnlE9dOLI7FRvPu6f6Fcpc7JA=";
+      url = "http://dl.google.com/release2/chrome/l7nnht2cublegpab37bdleb52y_148.0.7778.168/GoogleChrome-148.0.7778.168.dmg";
+      hash = "sha256-HaextZ70Os3EN5mguSmKp0GD0LAy1kE4dWUYwOA+JOs=";
    };

    dontPatch = true;
--- a/pkgs/by-name/he/headplane/package.nix
+++ b/pkgs/by-name/he/headplane/package.nix
@ -80,6 +80,7 @@ stdenv.mkDerivation (finalAttrs: {

  pnpmDeps = fetchPnpmDeps {
    inherit (finalAttrs) pname version src;
+    pnpm = pnpm_10;
    hash = pnpmDepsHash;
    fetcherVersion = 3;
  };
--- a/pkgs/applications/window-managers/i3/auto-layout.nix
+++ b/pkgs/applications/window-managers/i3/auto-layout.nix
@ -12,7 +12,7 @@ rustPlatform.buildRustPackage {
    owner = "chmln";
    repo = "i3-auto-layout";
    rev = "9e41eb3891991c35b7d35c9558e788899519a983";
-    sha256 = "sha256-gpVYVyh+2y4Tttvw1SuCf7mx/nxR330Ob2R4UmHZSJs=";
+    hash = "sha256-gpVYVyh+2y4Tttvw1SuCf7mx/nxR330Ob2R4UmHZSJs=";
  };

  cargoHash = "sha256-oKpcYhD9QNW+8gFVybDEnz58cZ+2Bf4bwYuflXiJ1jc=";
--- a/pkgs/applications/window-managers/i3/balance-workspace.nix
+++ b/pkgs/applications/window-managers/i3/balance-workspace.nix
@ -1,21 +1,32 @@
 {
  lib,
-  buildPythonPackage,
+  python3Packages,
  fetchPypi,
-  i3ipc,
 }:

-buildPythonPackage (finalAttrs: {
+python3Packages.buildPythonPackage (finalAttrs: {
  pname = "i3-balance-workspace";
  version = "1.8.6";
-  format = "setuptools";
+  pyproject = true;

  src = fetchPypi {
    inherit (finalAttrs) pname version;
    hash = "sha256-zJdn/Q6r60FQgfehtQfeDkmN0Rz3ZaqgNhiWvjyQFy0=";
  };

-  propagatedBuildInputs = [ i3ipc ];
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail 'poetry.masonry.api' 'poetry.core.masonry.api' \
+      --replace-fail 'poetry>=' 'poetry-core>='
+  '';
+
+  build-system = [
+    python3Packages.poetry-core
+  ];
+
+  dependencies = [
+    python3Packages.i3ipc
+  ];

  doCheck = false; # project has no test
  pythonImportsCheck = [ "i3_balance_workspace" ];
--- a/pkgs/applications/window-managers/i3/cycle-focus.nix
+++ b/pkgs/applications/window-managers/i3/cycle-focus.nix
--- a/pkgs/applications/window-managers/i3/easyfocus.nix
+++ b/pkgs/applications/window-managers/i3/easyfocus.nix
@ -19,7 +19,7 @@ stdenv.mkDerivation {
    owner = "cornerman";
    repo = "i3-easyfocus";
    rev = "fffb468f7274f9d7c9b92867c8cb9314ec6cf81a";
-    sha256 = "1db23vzzmp0hnfss1fkd80za6d2pajx7hdwikw50pk95jq0w8wfm";
+    hash = "sha256-1XHEAZYlzQsKn5E3eLpUVzSjPkBtuqC1sxDc+v8eYrU=";
  };

  nativeBuildInputs = [ pkg-config ];
--- a/pkgs/applications/window-managers/i3/layout-manager.nix
+++ b/pkgs/applications/window-managers/i3/layout-manager.nix
@ -34,7 +34,7 @@ stdenv.mkDerivation {
    owner = "klaxalk";
    repo = "i3-layout-manager";
    rev = "df54826bba351d8bcd7ebeaf26c07c713af7912c";
-    sha256 = "0ccvr43yp26fnh5d82cw7jcfq2sbxzzmdx2cp15bmxr8ixr8knc3";
+    hash = "sha256-g9mJco8o97pKuEz0Vv/vSwvsmDycCdQKtM6I6wfJmzE=";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/applications/window-managers/i3/i3-ratiosplit.nix
+++ b/pkgs/applications/window-managers/i3/i3-ratiosplit.nix
@ -4,15 +4,15 @@
  fetchFromGitHub,
 }:

-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
  pname = "i3-ratiosplit";
  version = "0.1.0";

  src = fetchFromGitHub {
    owner = "333fred";
    repo = "i3-ratiosplit";
-    rev = "v${version}";
-    sha256 = "0yfmr5zk2c2il9d31yjjbr48sqgcq6hp4a99hl5mjm2ajyhy5bz3";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-46/ioZdKVFkLhSkpcqHB7GGNSF5S+jBaolEwMX/J1Xk=";
  };

  cargoHash = "sha256-no5fJ5nlwyS/PVi9J5Ek3c3Rp7A3MflpReo9kwJrj6U=";
@ -28,4 +28,4 @@ rustPlatform.buildRustPackage rec {
    maintainers = with lib.maintainers; [ svrana ];
    platforms = lib.platforms.linux;
  };
-}
+})
--- a/pkgs/applications/window-managers/i3/i3-resurrect.nix
+++ b/pkgs/applications/window-managers/i3/i3-resurrect.nix
@ -1,34 +1,33 @@
 {
  lib,
-  buildPythonApplication,
-  click,
-  i3ipc,
-  psutil,
-  natsort,
+  python3Packages,
  fetchPypi,
  xprop,
  xdotool,
-  importlib-metadata,
 }:

-buildPythonApplication rec {
+python3Packages.buildPythonApplication (finalAttrs: {
  pname = "i3-resurrect";
  version = "1.4.5";
-  format = "setuptools";
+  pyproject = true;

  src = fetchPypi {
-    inherit pname version;
+    inherit (finalAttrs) pname version;
    hash = "sha256-13FKRvEE4vHq5G51G1UyBnfNiWeS9Q/SYCG16E1Sn4c=";
  };

-  propagatedBuildInputs = [
-    click
-    psutil
+  build-system = [
+    python3Packages.setuptools
+  ];
+
+  dependencies = [
+    python3Packages.click
+    python3Packages.psutil
    xprop
-    natsort
-    i3ipc
+    python3Packages.natsort
+    python3Packages.i3ipc
    xdotool
-    importlib-metadata
+    python3Packages.importlib-metadata
  ];
  doCheck = false; # no tests

@ -40,4 +39,4 @@ buildPythonApplication rec {
    platforms = lib.platforms.linux;
    maintainers = with lib.maintainers; [ magnetophon ];
  };
-}
+})
--- a/pkgs/applications/window-managers/i3/rounded.nix
+++ b/pkgs/applications/window-managers/i3/rounded.nix
@ -13,7 +13,7 @@ i3.overrideAttrs (oldAttrs: {
    owner = "LinoBigatti";
    repo = "i3-rounded";
    rev = "524c9f7b50f8c540b2ae3480b242c30d8775f98e";
-    sha256 = "0y7m1s1y8f9vgkp7byi33js8n4rigiykd71s936i5d4rwlzrxiwm";
+    hash = "sha256-lceeP+WZtBLNSDqcNn18MROLtBwj+nXufDs55IMO9Xg=";
  };

  buildInputs = oldAttrs.buildInputs ++ [ pcre ];
--- a/pkgs/applications/window-managers/i3/swallow.nix
+++ b/pkgs/applications/window-managers/i3/swallow.nix
@ -1,14 +1,10 @@
 {
  lib,
-  buildPythonApplication,
+  python3Packages,
  fetchFromGitHub,
-  poetry-core,
-  i3ipc,
-  xlib,
-  six,
 }:

-buildPythonApplication {
+python3Packages.buildPythonApplication {
  pname = "i3-swallow";
  version = "unstable-2022-02-19";

@ -18,17 +14,17 @@ buildPythonApplication {
    owner = "jamesofarrell";
    repo = "i3-swallow";
    rev = "6fbc04645c483fe733de56b56743e453693d4c78";
-    sha256 = "1l3x8mixwq4n0lnyp0wz5vijgnypamq6lqjazcd2ywl2jv8d6fif";
+    hash = "sha256-LjrT0JaCci8a+0pianBV19sn4y6fg+stBZZg3mNFfdA=";
  };

  nativeBuildInputs = [
-    poetry-core
+    python3Packages.poetry-core
  ];

  propagatedBuildInputs = [
-    i3ipc
-    xlib
-    six
+    python3Packages.i3ipc
+    python3Packages.xlib
+    python3Packages.six
  ];

  # No tests available
--- a/pkgs/applications/window-managers/i3/wk-switch.nix
+++ b/pkgs/applications/window-managers/i3/wk-switch.nix
@ -13,7 +13,7 @@ python3Packages.buildPythonApplication {
    owner = "tmfink";
    repo = "i3-wk-switch";
    rev = "a618cb8f52120aa8d533bb7c0c8de3ff13b3dc06";
-    sha256 = "0ci0w5igjk5xa8x4rx17cpgmdkamwjmavxhp0vp6213cl93ybjhz";
+    hash = "sha256-H8rlR6JsBGHuBhf2rarkVc1W32Un9Ew6Ur1M+WLhIDI=";
  };

  propagatedBuildInputs = with python3Packages; [ i3ipc ];
--- a/pkgs/applications/window-managers/i3/default.nix
+++ b/pkgs/applications/window-managers/i3/default.nix
--- a/pkgs/applications/window-managers/i3/altlayout.nix
+++ b/pkgs/applications/window-managers/i3/altlayout.nix
@ -4,14 +4,14 @@
  fetchPypi,
 }:

-python3Packages.buildPythonApplication rec {
+python3Packages.buildPythonApplication (finalAttrs: {
  pname = "i3altlayout";
  version = "0.3";
  format = "setuptools";

  src = fetchPypi {
-    inherit pname version;
-    sha256 = "1h0phf3s6ljffxw0bs73k041wildaz01h37iv5mxhami41wrh4qf";
+    inherit (finalAttrs) pname version;
+    hash = "sha256-DhOYeSCxKthr2fEMGMBXjUYeCJjj6AV4d05So4eDF8A=";
  };

  pythonRemoveDeps = [ "enum-compat" ];
@ -33,4 +33,4 @@ python3Packages.buildPythonApplication rec {
    license = lib.licenses.gpl3Only;
    platforms = lib.platforms.linux;
  };
-}
+})
--- a/pkgs/applications/window-managers/i3/blocks-gaps.nix
+++ b/pkgs/applications/window-managers/i3/blocks-gaps.nix
@ -31,7 +31,7 @@ let
  contains_any = l1: l2: 0 < lib.length (lib.intersectLists l1 l2);

 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "i3blocks-gaps";
  version = "1.4";

@ -39,13 +39,13 @@ stdenv.mkDerivation rec {
    owner = "Airblader";
    repo = "i3blocks-gaps";
    rev = "4cfdf93c75f729a2c96d471004d31734e923812f";
-    sha256 = "0v9307ij8xzwdaxay3r75sd2cp453s3qb6q7dy9fks2p6wwqpazi";
+    hash = "sha256-8auLOTdX6OmSbwebhYcehVwmmi4nD6+6avx3JOMBI20=";
  };

  makeFlags = [ "all" ];
  installFlags = [
    "PREFIX=\${out}"
-    "VERSION=${version}"
+    "VERSION=${finalAttrs.version}"
  ];

  buildInputs = lib.optional (contains_any scripts perlscripts) perl;
@ -81,4 +81,4 @@ stdenv.mkDerivation rec {
    maintainers = with lib.maintainers; [ carlsverre ];
    platforms = lib.platforms.linux;
  };
-}
+})
--- a/pkgs/applications/window-managers/i3/blocks.nix
+++ b/pkgs/applications/window-managers/i3/blocks.nix
@ -15,7 +15,7 @@ stdenv.mkDerivation {
    owner = "vivien";
    repo = "i3blocks";
    rev = "3417602a2d8322bc866861297f535e1ef80b8cb0";
-    sha256 = "0v8mwnm8qzpv6xnqvrk43s4b9iyld4naqzbaxk4ldq1qkhai0wsv";
+    hash = "sha256-W3MQFZw44EbJ7Gp9rCxp1Me0iB5k5o1tN/t+jKrlFW0=";
  };

  patches = [
@ -23,7 +23,7 @@ stdenv.mkDerivation {
    (fetchpatch {
      # https://github.com/vivien/i3blocks/pull/405
      url = "https://github.com/edef1c/i3blocks/commit/d57b32f9a364aeaf36869efdd54240433c737e57.patch";
-      sha256 = "102xb0ax0hmg82dz2gzfag470dkckzf2yizai0izacvrz0d3ngj1";
+      hash = "sha256-QT47Gvh5M/UjiOpHL9yfbDZwyFPuP/GbQK9C0BVYXYA=";
    })
  ];

--- a/pkgs/applications/window-managers/i3/i3ipc-glib.nix
+++ b/pkgs/applications/window-managers/i3/i3ipc-glib.nix
@ -12,15 +12,15 @@
  gobject-introspection,
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "i3ipc-glib";
  version = "1.0.1";

  src = fetchFromGitHub {
    owner = "acrisci";
    repo = "i3ipc-glib";
-    rev = "v${version}";
-    sha256 = "01fzvrbnzcwx0vxw29igfpza9zwzp2s7msmzb92v01z0rz0y5m0p";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-F9Tiwc/gB7BFWr/qerS4n/+k/nUvJsH7Bp2zb1fe3wU=";
  };

  strictDeps = true;
@ -49,4 +49,4 @@ stdenv.mkDerivation rec {
    license = lib.licenses.gpl3;
    platforms = lib.platforms.linux;
  };
-}
+})
--- a/pkgs/applications/window-managers/i3/lock-blur.nix
+++ b/pkgs/applications/window-managers/i3/lock-blur.nix
@ -14,8 +14,8 @@ i3lock-color.overrideAttrs (oldAttrs: rec {
  src = fetchFromGitHub {
    owner = "karulont";
    repo = "i3lock-blur";
-    rev = version;
-    sha256 = "sha256-rBQHYVD9rurzTEXrgEnOziOP22D2EePC1+EV9Wi2pa0=";
+    tag = version;
+    hash = "sha256-rBQHYVD9rurzTEXrgEnOziOP22D2EePC1+EV9Wi2pa0=";
  };

  patches = [
@ -24,7 +24,7 @@ i3lock-color.overrideAttrs (oldAttrs: rec {
    (fetchpatch {
      name = "fno-common.patch";
      url = "https://github.com/karulont/i3lock-blur/commit/ec8fe0e7f7d78bf445602ed517efd5c324bb32f7.patch";
-      sha256 = "sha256-0hXUr+ZEB1tpI3xw80/hGzKyeGuna4CQmEvK6t0VBqU=";
+      hash = "sha256-0hXUr+ZEB1tpI3xw80/hGzKyeGuna4CQmEvK6t0VBqU=";
    })
  ];

--- a/pkgs/applications/window-managers/i3/lock-color.nix
+++ b/pkgs/applications/window-managers/i3/lock-color.nix
@ -18,15 +18,15 @@
  libxcb-util,
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  version = "2.13.c.5";
  pname = "i3lock-color";

  src = fetchFromGitHub {
    owner = "PandorasFox";
    repo = "i3lock-color";
-    rev = version;
-    sha256 = "sha256-fuLeglRif2bruyQRqiL3nm3q6qxoHcPdVdL+QjGBR/k=";
+    tag = finalAttrs.version;
+    hash = "sha256-fuLeglRif2bruyQRqiL3nm3q6qxoHcPdVdL+QjGBR/k=";
  };

  nativeBuildInputs = [
@ -94,4 +94,4 @@ stdenv.mkDerivation rec {
    platforms = lib.platforms.all;
    broken = stdenv.hostPlatform.isDarwin;
  };
-}
+})
--- a/pkgs/applications/window-managers/i3/lock-fancy-rapid.nix
+++ b/pkgs/applications/window-managers/i3/lock-fancy-rapid.nix
--- a/pkgs/applications/window-managers/i3/lock-fancy.nix
+++ b/pkgs/applications/window-managers/i3/lock-fancy.nix
--- a/pkgs/applications/window-managers/i3/lock.nix
+++ b/pkgs/applications/window-managers/i3/lock.nix
@ -12,21 +12,25 @@
  pam,
  libx11,
  libev,
-  cairo,
  libxkbcommon,
  libxkbfile,
  libxcb-util,
+  cairo,
 }:
-
-stdenv.mkDerivation rec {
+let
+  cairo' = cairo.override {
+    xcbSupport = true;
+  };
+in
+stdenv.mkDerivation (finalAttrs: {
  pname = "i3lock";
  version = "2.15";

  src = fetchFromGitHub {
    owner = "i3";
    repo = "i3lock";
-    rev = version;
-    sha256 = "sha256-OyV6GSLnNV3GUqrfs3OBnIaBvicH2PXgeY4acOk5dR4=";
+    tag = finalAttrs.version;
+    hash = "sha256-OyV6GSLnNV3GUqrfs3OBnIaBvicH2PXgeY4acOk5dR4=";
  };

  separateDebugInfo = true;
@ -43,7 +47,7 @@ stdenv.mkDerivation rec {
    pam
    libx11
    libev
-    cairo
+    cairo'
    libxkbcommon
    libxkbfile
    libxcb-util
@ -65,4 +69,4 @@ stdenv.mkDerivation rec {
    platforms = lib.platforms.all;
  };

-}
+})
--- a/pkgs/applications/window-managers/i3/status.nix
+++ b/pkgs/applications/window-managers/i3/status.nix
@ -17,13 +17,13 @@
  docbook_xsl,
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "i3status";
  version = "2.15";

  src = fetchurl {
-    url = "https://i3wm.org/i3status/i3status-${version}.tar.xz";
-    sha256 = "sha256-bGf1LK5PE533ZK0cxzZWK+D5d1B5G8IStT80wG6vIgU=";
+    url = "https://i3wm.org/i3status/i3status-${finalAttrs.version}.tar.xz";
+    hash = "sha256-bGf1LK5PE533ZK0cxzZWK+D5d1B5G8IStT80wG6vIgU=";
  };

  separateDebugInfo = true;
@ -54,4 +54,4 @@ stdenv.mkDerivation rec {
    mainProgram = "i3status";
  };

-}
+})
--- a/pkgs/applications/window-managers/i3/wsr.nix
+++ b/pkgs/applications/window-managers/i3/wsr.nix
@ -6,14 +6,14 @@
  python3,
 }:

-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
  pname = "i3wsr";
  version = "3.1.2";

  src = fetchFromGitHub {
    owner = "roosta";
    repo = "i3wsr";
-    rev = "v${version}";
+    tag = "v${finalAttrs.version}";
    hash = "sha256-8cQM2M9XjS4FSSX1/WHqmTP842Ahd1XoaqOWSGSEE0s=";
  };

@ -37,4 +37,4 @@ rustPlatform.buildRustPackage rec {
    license = lib.licenses.mit;
    maintainers = [ lib.maintainers.sebbadk ];
  };
-}
+})
--- a/pkgs/by-name/ii/iina/package.nix
+++ b/pkgs/by-name/ii/iina/package.nix
@ -8,11 +8,11 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "iina";
-  version = "1.4.1";
+  version = "1.4.2";

  src = fetchurl {
    url = "https://github.com/iina/iina/releases/download/v${finalAttrs.version}/IINA.v${finalAttrs.version}.dmg";
-    hash = "sha256-F3rUaeoSm+2VqCrFm1+1jQoGw1NC/KejfbohSogh+Eg=";
+    hash = "sha256-Lg/Yn7uhySpsEVFx5bUZBIg7tJf75ROmlh0ID7qwj/Y=";
  };

  nativeBuildInputs = [ undmg ];
--- a/Show more
+++ b/Show more