Merge staging-next into staging

2026-07-06 17:13:24 -05:00 · 2026-05-23 18:22:51 +00:00 · 2026-05-23 18:22:51 +00:00 · 217e47b25e
commit 217e47b25e
parent e00d6205ee be978ce805
139 changed files with 1647 additions and 830 deletions
--- a/ci/eval/compare/default.nix
+++ b/ci/eval/compare/default.nix
@ -172,6 +172,7 @@ let
      rebuildCountByKernel = lib.mapAttrs (
        kernel: kernelRebuilds: lib.length kernelRebuilds
      ) rebuildsByKernel;
+      rebuildNames = extractPackageNames diffAttrs.rebuilds;
    in
    writeText "changed-paths.json" (
      builtins.toJSON {
@ -188,7 +189,8 @@ let
            kernel: rebuilds: lib.nameValuePair "10.rebuild-${kernel}-stdenv" (lib.elem "stdenv" rebuilds)
          ) rebuildsByKernel
          // {
-            "10.rebuild-nixos-tests" = lib.elem "nixosTests.simple" (extractPackageNames diffAttrs.rebuilds);
+            "10.rebuild-nixos-tests" =
+              lib.elem "nixosTests.simple-container" rebuildNames || lib.elem "nixosTests.simple-vm" rebuildNames;
          };
      }
    );
--- a/ci/eval/outpaths.nix
+++ b/ci/eval/outpaths.nix
@ -108,6 +108,8 @@ in
 tweak (
  (removeAttrs nixpkgsJobs blacklist)
  // {
-    nixosTests = lib.filterAttrs (name: _: name == "simple") nixosJobs.tests;
+    nixosTests = lib.filterAttrs (
+      name: _: name == "simple-container" || name == "simple-vm"
+    ) nixosJobs.tests;
  }
 )
--- a/ci/github-script/check-target-branch.js
+++ b/ci/github-script/check-target-branch.js
@ -99,7 +99,8 @@ async function checkTargetBranch({ github, context, core, dry }) {
    ...Object.values(changed.rebuildCountByKernel),
  )
  const rebuildsAllTests =
-    changed.attrdiff.changed.includes('nixosTests.simple')
+    changed.attrdiff.changed.includes('nixosTests.simple-container') ||
+    changed.attrdiff.changed.includes('nixosTests.simple-vm')

  // https://github.com/NixOS/nixpkgs/pull/481205#issuecomment-3790123921
  // These should go to staging-nixos instead of master,
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -28117,12 +28117,6 @@
    githubId = 50843046;
    name = "tornax";
  };
-  toschmidt = {
-    email = "tobias.schmidt@in.tum.de";
-    github = "toschmidt";
-    githubId = 27586264;
-    name = "Tobias Schmidt";
-  };
  totalchaos = {
    email = "basil.keeler@outlook.com";
    github = "totalchaos05";
--- a/nixos/lib/test-driver/src/test_driver/machine/init.py
+++ b/nixos/lib/test-driver/src/test_driver/machine/init.py
@ -1475,7 +1475,6 @@ class NspawnMachine(BaseMachine):

        self.start_command = start_command
        self.process = None
-        self.pid = None

        self.machine_sock_path = self.tmp_dir / f"{self.name}-nspawn.sock"

@ -1486,14 +1485,13 @@ class NspawnMachine(BaseMachine):
        return f'ssh -o User=root -o ProxyCommand="{proxy_cmd}" bash'

    def release(self) -> None:
-        if self.pid is None:
+        if self.process is None:
            return

        if self.machine_sock:
            self.machine_sock.close()

-        self.logger.info(f"kill NspawnMachine (pid {self.pid})")
-        assert self.process is not None
+        self.logger.info(f"kill NspawnMachine (pid {self.process.pid})")
        self.process.terminate()
        # Wait for the wrapper to finish its context-manager cleanups
        # (veth/bridge/netns teardown) before returning, so the driver's
@ -1502,7 +1500,7 @@ class NspawnMachine(BaseMachine):
            self.process.wait(timeout=30)
        except subprocess.TimeoutExpired:
            self.logger.error(
-                f"NspawnMachine {self.name} (pid {self.pid}) did not exit after SIGTERM; sending SIGKILL"
+                f"NspawnMachine {self.name} (pid {self.process.pid}) did not exit after SIGTERM; sending SIGKILL"
            )
            self.process.kill()
            self.process.wait()
@ -1694,9 +1692,7 @@ class NspawnMachine(BaseMachine):
            stdout=subprocess.PIPE,
        )

-        self.pid = self.process.pid
-
-        self.log(f"systemd-nspawn running (pid {self.pid})")
+        self.log(f"systemd-nspawn running (pid {self.process.pid})")

        journal_thread = threading.Thread(target=self._stream_journal, daemon=True)
        journal_thread.start()
--- a/nixos/modules/services/desktops/seatd.nix
+++ b/nixos/modules/services/desktops/seatd.nix
@ -40,7 +40,6 @@ in
  config = lib.mkIf cfg.enable {
    environment.systemPackages = with pkgs; [
      seatd
-      sdnotify-wrapper
    ];
    users.groups.seat = lib.mkIf (cfg.group == "seat") { };

@ -55,7 +54,7 @@ in
        Type = "notify";
        NotifyAccess = "all";
        SyslogIdentifier = "seatd";
-        ExecStart = "${pkgs.sdnotify-wrapper}/bin/sdnotify-wrapper ${pkgs.seatd.bin}/bin/seatd -n 1 -u ${cfg.user} -g ${cfg.group} -l ${cfg.logLevel}";
+        ExecStart = "${lib.getExe' pkgs.s6 "s6-notify-socket-from-fd"} ${pkgs.seatd.bin}/bin/seatd -n 1 -u ${cfg.user} -g ${cfg.group} -l ${cfg.logLevel}";
        RestartSec = 1;
        Restart = "always";
      };
--- a/nixos/modules/services/display-managers/gdm.nix
+++ b/nixos/modules/services/display-managers/gdm.nix
@ -45,9 +45,19 @@ let

  setSessionScript = pkgs.callPackage ../x11/display-managers/account-service-util.nix { };

-  greeterEnvFile = pkgs.writeText "gdm-greeter-env" ''
-    DCONF_PROFILE=gdm
-  '';
+  greeterUsers = lib.genAttrs' [ null 1 2 3 4 ] (
+    i:
+    let
+      # adding 1 to create `gdm-greeter{-2,-3,-4,-5}`
+      suffix = lib.optionalString (i != null) "-${toString (i + 1)}";
+    in
+    lib.nameValuePair "gdm-greeter${suffix}" {
+      isSystemUser = true;
+      uid = 60578 + (if i == null then 0 else i);
+      group = "gdm";
+      home = "/run/gdm/home/gdm-greeter${suffix}";
+    }
+  );
 in

 {
@ -190,6 +200,8 @@ in

  config = lib.mkIf cfg.enable {

+    warnings = lib.optional config.services.pulseaudio.enable "Support for Pulseaudio + gdm will be removed in NixOS 26.11";
+
    services.xserver.displayManager.lightdm.enable = false;

    users.users = lib.mkMerge [
@ -200,24 +212,8 @@ in
          group = "gdm";
          description = "GDM user";
        };
-
-        gdm-greeter = {
-          isSystemUser = true;
-          uid = 60578;
-          group = "gdm";
-          home = "/run/gdm";
-        };
      }
-
-      (lib.genAttrs' [ 1 2 3 4 ] (
-        i:
-        lib.nameValuePair "gdm-greeter-${toString i}" {
-          isSystemUser = true;
-          uid = 60578 + i;
-          group = "gdm";
-          home = "/run/gdm-${toString i}";
-        }
-      ))
+      greeterUsers
    ];

    users.groups.gdm.gid = config.ids.gids.gdm;
@ -259,17 +255,20 @@ in
      };
    };

-    systemd.tmpfiles.rules = [
-      "d /run/gdm/.config 0711 gdm gdm"
-    ]
-    ++ lib.optionals config.services.pulseaudio.enable [
-      "d /run/gdm/.config/pulse 0711 gdm gdm"
-      "L+ /run/gdm/.config/pulse/${pulseConfig.name} - - - - ${pulseConfig}"
-    ]
-    ++ lib.optionals config.services.gnome.gnome-initial-setup.enable [
-      # Create stamp file for gnome-initial-setup to prevent it starting in GDM.
-      "f /run/gdm/.config/gnome-initial-setup-done 0711 gdm gdm - yes"
-    ];
+    systemd.tmpfiles.rules =
+      lib.optionals config.services.pulseaudio.enable (
+        lib.concatLists (
+          lib.mapAttrsToList (name: user: [
+            "d ${user.home}/.config 0711 ${name} gdm"
+            "d ${user.home}/.config/pulse 0711 ${name} gdm"
+            "L+ ${user.home}/.config/pulse/${pulseConfig.name} - - - - ${pulseConfig}"
+          ]) greeterUsers
+        )
+      )
+      ++ lib.optionals config.services.gnome.gnome-initial-setup.enable [
+        # Create stamp file for gnome-initial-setup to prevent it starting in GDM.
+        "f /run/gdm/gdm.ran-initial-setup 0711 gdm gdm - yes"
+      ];

    # Otherwise GDM will not be able to start correctly and display Wayland sessions
    systemd.packages = [
@ -456,12 +455,6 @@ in
              settings.conffile = "/etc/pam/environment";
              settings.readenv = 0;
            }
-            {
-              name = "env-greeter";
-              control = "required";
-              modulePath = "${config.security.pam.package}/lib/security/pam_env.so";
-              settings.envfile = greeterEnvFile;
-            }
            {
              name = "systemd";
              control = "optional";
--- a/nixos/modules/system/boot/systemd/initrd.nix
+++ b/nixos/modules/system/boot/systemd/initrd.nix
@ -7,9 +7,29 @@
  ...
 }:

-with lib;
-
 let
+  inherit (lib)
+    filter
+    elem
+    filterAttrs
+    concatLists
+    mapAttrsToList
+    getBin
+    concatStringsSep
+    mkEnableOption
+    mkOption
+    types
+    literalExpression
+    mkIf
+    any
+    isBool
+    isString
+    optionalAttrs
+    mapAttrs'
+    nameValuePair
+    listToAttrs
+    ;
+
  inherit (utils) systemdUtils escapeSystemdPath;
  inherit (systemdUtils.unitOptions) unitOption;
  inherit (systemdUtils.lib)
@ -27,6 +47,12 @@ let

  cfg = config.boot.initrd.systemd;

+  withKmod =
+    let
+      kconfig = config.system.build.kernel.config;
+    in
+    kconfig.isSet "MODULES" -> kconfig.isYes "MODULES";
+
  upstreamUnits = [
    "basic.target"
    "breakpoint-pre-udev.service"
@ -505,7 +531,7 @@ in
        pkgs.coreutils
        cfg.package
      ]
-      ++ lib.optional (config.system.build.kernel.config.isYes "MODULES") cfg.package.kmod
+      ++ lib.optional withKmod cfg.package.kmod
      ++ lib.optionals cfg.shell.enable [
        # bashInteractive is easier to use and also required by debug-shell.service
        pkgs.bashInteractive
@ -555,7 +581,7 @@ in
      // optionalAttrs (config.environment.etc ? "modprobe.d/nixos.conf") {
        "/etc/modprobe.d/nixos.conf".source = config.environment.etc."modprobe.d/nixos.conf".source;
      }
-      // optionalAttrs (with config.system.build.kernel.config; isSet "MODULES" -> isYes "MODULES") {
+      // optionalAttrs withKmod {
        "/lib".source = "${config.system.build.modulesClosure}/lib";

        "/etc/modules-load.d/nixos.conf".text = concatStringsSep "\n" config.boot.initrd.kernelModules;
@ -640,7 +666,7 @@ in
          ) cfg.automounts
        );

-      services."modprobe@" = lib.mkIf (config.system.build.kernel.config.isYes "MODULES") {
+      services."modprobe@" = lib.mkIf withKmod {
        serviceConfig.ExecSearchPath = lib.makeBinPath [ cfg.package.kmod ];
      };

--- a/nixos/modules/virtualisation/nixos-containers.nix
+++ b/nixos/modules/virtualisation/nixos-containers.nix
@ -524,6 +524,19 @@ let
    tmpfs = null;
  };

+  # Parses an IPv4 address with an optional prefix
+  ipv4FromString =
+    str:
+    let
+      segments = lib.splitString "/" str;
+      prefix = lib.elemAt segments 1;
+      hasPrefix = builtins.length segments == 2;
+    in
+    {
+      address = lib.head segments;
+      prefixLength = if hasPrefix then builtins.fromJSON prefix else 32;
+    };
+
 in

 {
@ -594,6 +607,14 @@ in
                                boot.isNspawnContainer = true;
                                networking.hostName = mkDefault name;
                                networking.useDHCP = false;
+                                networking.interfaces = lib.mkIf config.privateNetwork {
+                                  eth0.ipv4.addresses = lib.optional (config.localAddress != null) (
+                                    ipv4FromString config.localAddress
+                                  );
+                                  eth0.ipv6.addresses = lib.optional (config.localAddress6 != null) (
+                                    lib.network.ipv6.fromString config.localAddress6
+                                  );
+                                };
                                assertions = [
                                  {
                                    assertion =
--- a/nixos/release-combined.nix
+++ b/nixos/release-combined.nix
@ -202,7 +202,8 @@ rec {
        (onFullSupported "nixos.tests.proxy")
        (onFullSupported "nixos.tests.sddm.default")
        (onFullSupported "nixos.tests.shadow")
-        (onFullSupported "nixos.tests.simple")
+        (onFullSupported "nixos.tests.simple-container")
+        (onFullSupported "nixos.tests.simple-vm")
        (onFullSupported "nixos.tests.sway")
        (onFullSupported "nixos.tests.switchTest")
        (onFullSupported "nixos.tests.udisks2")
--- a/nixos/release-small.nix
+++ b/nixos/release-small.nix
@ -67,7 +67,8 @@ rec {
        php
        predictable-interface-names
        proxy
-        simple
+        simple-container
+        simple-vm
        ;
      latestKernel = {
        inherit (nixos'.tests.latestKernel)
@ -165,7 +166,8 @@ rec {
          "nixos.tests.predictable-interface-names.unpredictable"
          "nixos.tests.predictable-interface-names.unpredictableNetworkd"
          "nixos.tests.proxy"
-          "nixos.tests.simple"
+          "nixos.tests.simple-container"
+          "nixos.tests.simple-vm"
          "nixpkgs.jdk"
          "nixpkgs.tests.stdenv.tests-stdenv-gcc-stageCompare"
          "nixpkgs.opensshTest"
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -245,6 +245,7 @@ in
  authelia = runTest ./authelia.nix;
  auto-cpufreq = runTest ./auto-cpufreq.nix;
  autobrr = runTest ./autobrr.nix;
+  autopush-rs = runTest ./autopush-rs.nix;
  autosuspend = runTest ./autosuspend.nix;
  avahi = runTest {
    imports = [ ./avahi.nix ];
@ -386,6 +387,7 @@ in
  containers-custom-pkgs = runTest ./containers-custom-pkgs.nix;
  containers-ephemeral = runTest ./containers-ephemeral.nix;
  containers-extra_veth = runTest ./containers-extra_veth.nix;
+  containers-gateway = runTest ./containers-gateway.nix;
  containers-hosts = runTest ./containers-hosts.nix;
  containers-imperative = runTest ./containers-imperative.nix;
  containers-ip = runTest ./containers-ip.nix;
@ -1508,7 +1510,8 @@ in
  shoko = import ./shoko.nix { inherit runTest; };
  signal-desktop = runTest ./signal-desktop.nix;
  silverbullet = runTest ./silverbullet.nix;
-  simple = runTest ./simple.nix;
+  simple-container = runTest ./simple-container.nix;
+  simple-vm = runTest ./simple-vm.nix;
  sing-box = runTest ./sing-box.nix;
  sks = runTest ./sks.nix;
  slimserver = runTest ./slimserver.nix;
--- a/nixos/tests/autopush-rs.nix
+++ b/nixos/tests/autopush-rs.nix
@ -0,0 +1,60 @@
+{ lib, ... }:
+{
+  _class = "nixosTest";
+  name = "autopush-rs";
+
+  nodes = {
+    machine =
+      { pkgs, config, ... }:
+      {
+        environment.systemPackages = [
+          pkgs.curl
+        ];
+
+        services.redis.servers.autopush-rs = {
+          enable = true;
+          port = 6000;
+        };
+        system.services.autopush-autoconnect = {
+          imports = [
+            pkgs.autopush-rs.services.autoconnect
+          ];
+          autoconnect.settings = {
+            #do not use this key in production!!!
+            crypto_key = "[fZQX8jgdESUYFTYfWw3Dv5RRMuwYJPPaaPcbUgHM69Q=]";
+            db_dsn = "redis://localhost:${toString config.services.redis.servers.autopush-rs.port}";
+            port = 8000;
+          };
+        };
+        system.services.autopush-autoendpoint = {
+          imports = [
+            pkgs.autopush-rs.services.autoendpoint
+          ];
+          autoendpoint.settings = {
+            #do not use this key in production!!!
+            crypto_key = "[fZQX8jgdESUYFTYfWw3Dv5RRMuwYJPPaaPcbUgHM69Q=]";
+            db_dsn = "redis://localhost:${toString config.services.redis.servers.autopush-rs.port}";
+            port = 8080;
+          };
+        };
+
+        networking.firewall.allowedTCPPorts = [
+          8080
+          8000
+        ];
+      };
+  };
+
+  testScript = ''
+    start_all()
+    machine.wait_for_unit("multi-user.target")
+    machine.wait_for_unit("autopush-autoconnect.service")
+    machine.wait_for_unit("autopush-autoendpoint.service")
+    machine.wait_for_open_port(8080)
+    machine.wait_for_open_port(8000)
+    machine.succeed("curl -s -f http://localhost:8080/health")
+    machine.succeed("curl -s -f http://localhost:8000/health")
+  '';
+
+  meta.maintainers = with lib.maintainers; [ zimward ];
+}
--- a/nixos/tests/containers-gateway.nix
+++ b/nixos/tests/containers-gateway.nix
@ -0,0 +1,67 @@
+let
+  hostIp4 = "192.168.0.1";
+  containerIp4 = "192.168.0.100/24";
+  hostIp6 = "fc00::1";
+  containerIp6 = "fc00::2/7";
+in
+
+{ lib, ... }:
+{
+  name = "containers-gateway";
+  meta = {
+    maintainers = with lib.maintainers; [
+      rnhmjoj
+    ];
+  };
+
+  nodes.machine = {
+    networking.bridges = {
+      br0.interfaces = [ ];
+    };
+    networking.interfaces = {
+      br0.ipv4.addresses = [
+        {
+          address = hostIp4;
+          prefixLength = 24;
+        }
+      ];
+      br0.ipv6.addresses = [
+        {
+          address = hostIp6;
+          prefixLength = 7;
+        }
+      ];
+    };
+
+    containers.test = {
+      autoStart = true;
+      privateNetwork = true;
+      hostBridge = "br0";
+      localAddress = containerIp4;
+      localAddress6 = containerIp6;
+      config.networking = {
+        defaultGateway.address = hostIp4;
+        defaultGateway6.address = hostIp6;
+      };
+    };
+  };
+
+  testScript = ''
+    def container_succeed(command: str):
+        machine.succeed(f"nixos-container run test -- {command}")
+
+    machine.wait_for_unit("default.target")
+    assert "test" in machine.succeed("nixos-container list")
+
+    with subtest("Container has started"):
+        assert "up" in machine.succeed("nixos-container status test")
+
+    with subtest("Container can ping the host"):
+        container_succeed("ping -n -c 1 ${hostIp4}")
+        container_succeed("ping -n -c 1 ${hostIp6}")
+
+    with subtest("Container default gateways are set"):
+        container_succeed("ip -4 route show default | grep 'via ${hostIp4}'")
+        container_succeed("ip -6 route show default | grep 'via ${hostIp6}'")
+  '';
+}
--- a/nixos/tests/nixos-test-driver/skip-typecheck.nix
+++ b/nixos/tests/nixos-test-driver/skip-typecheck.nix
@ -1,5 +1,5 @@
 /**
-  nixosTests.simple, but with skipTypeCheck.
+  nixosTests.simple-vm, but with skipTypeCheck.
  This catches regressions in the wiring, e.g.
  https://github.com/NixOS/nixpkgs/pull/511225
 */
--- a/nixos/tests/simple-container.nix
+++ b/nixos/tests/simple-container.nix
@ -0,0 +1,11 @@
+{
+  name = "simple-container";
+
+  containers.machine = { };
+
+  testScript = ''
+    start_all()
+    machine.wait_for_unit("multi-user.target")
+    machine.shutdown()
+  '';
+}
--- a/nixos/tests/simple-vm.nix
+++ b/nixos/tests/simple-vm.nix
@ -1,5 +1,5 @@
 {
-  name = "simple";
+  name = "simple-vm";

  nodes.machine = { };

--- a/pkgs/applications/editors/vscode/extensions/ms-python.flake8/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/ms-python.flake8/default.nix
@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
  mktplcRef = {
    publisher = "ms-python";
    name = "flake8";
-    version = "2026.4.0";
-    hash = "sha256-2o6a0wPYVFa+XWQoKBxKcWxlH8IPOzKxtXNt7qUi9mM=";
+    version = "2026.6.0";
+    hash = "sha256-n++DEjZsNY3YkvldyWuk3dCYgFbIxqMOun42lWEHGog=";
  };

  meta = {
--- a/pkgs/applications/window-managers/hyprwm/hyprland-plugins/hypr-darkwindow.nix
+++ b/pkgs/applications/window-managers/hyprwm/hyprland-plugins/hypr-darkwindow.nix
@ -7,13 +7,13 @@

 mkHyprlandPlugin (finalAttrs: {
  pluginName = "hypr-darkwindow";
-  version = "0.54.3";
+  version = "0.55.2";

  src = fetchFromGitHub {
    owner = "micha4w";
    repo = "Hypr-DarkWindow";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-nbaNBxREqiqc6bwUkgfyuCah61O89atJyNTPYq4Xij8=";
+    hash = "sha256-8Ht9yhlwOtDWFvL6VYlryNxyRethFqc0iWtBetP0xws=";
  };

  installPhase = ''
--- a/pkgs/by-name/_4/_4th/package.nix
+++ b/pkgs/by-name/_4/_4th/package.nix
@ -20,6 +20,11 @@ stdenv.mkDerivation (finalAttrs: {

  dontConfigure = true;

+  preBuild = ''
+    cp sources/include${if stdenv.hostPlatform.is64bit then "64" else "32"}/* sources/
+    make -C sources clean
+  '';
+
  makeFlags = [
    "-C sources"
    "CC:=$(CC)"
--- a/pkgs/by-name/ap/apidog/package.nix
+++ b/pkgs/by-name/ap/apidog/package.nix
@ -7,11 +7,11 @@

 let
  pname = "apidog";
-  version = "2.8.28";
+  version = "2.8.30";

  src = fetchurl {
    url = "https://file-assets.apidog.com/download/${version}/Apidog-${version}.AppImage";
-    hash = "sha256-P338wk3YrNaeMwhMyMCKZOY2mIi2A6V+RG4f9qSHBhg=";
+    hash = "sha256-h5h/zhUbnYYtYVyWySLZk3QISd4VWs5Gl/JdhgMJKh8=";
  };

  appimageContents = appimageTools.extract {
--- a/pkgs/by-name/at/atlauncher/package.nix
+++ b/pkgs/by-name/at/atlauncher/package.nix
@ -36,6 +36,12 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    hash = "sha256-pRYXzFUbVXYwD7edhBoVcVo/QDo6QSJJQd58Hf3rBGo=";
  };

+  patches = [
+    # Launch4j does not publish the Linux workdir artifact selected on aarch64.
+    # Nixpkgs only needs the cross-platform jar, so remove the Windows exe task.
+    ./remove-launch4j.patch
+  ];
+
  nativeBuildInputs = [
    gradle
    makeWrapper
@ -52,8 +58,6 @@ stdenvNoCC.mkDerivation (finalAttrs: {

  gradleFlags = [
    "-Dorg.gradle.java.home=${jdk17_headless.home}"
-    "--exclude-task"
-    "createExe"
  ];

  installPhase =
--- a/pkgs/by-name/at/atlauncher/remove-launch4j.patch
+++ b/pkgs/by-name/at/atlauncher/remove-launch4j.patch
@ -0,0 +1,71 @@
+diff --git a/build.gradle b/build.gradle
+index 474c0c0..59fc2d2 100644
+--- a/build.gradle
+++ b/build.gradle
+@@ -24,7 +24,6 @@ plugins {
+     id 'org.cadixdev.licenser' version '0.6.1'
+     id 'com.adarshr.test-logger' version '4.0.0'
+     id 'edu.sc.seis.macAppBundle' version '2.3.0'
+-    id 'edu.sc.seis.launch4j' version '3.0.6'
+     id 'de.undercouch.download' version '5.6.0'
+     id 'com.github.johnrengelman.shadow' version '8.1.1'
+     id 'com.github.ben-manes.versions' version '0.52.0'
+@@ -282,34 +281,15 @@ def currentYear() {
+     return df.format(new Date())
+ }
+ 
+-launch4j {
+-    outfile = "ATLauncher-${project.version}.exe"
+-    jreMinVersion = "${project.targetCompatibility.toString()}"
+-    mainClassName = 'com.atlauncher.App'
+-    icon = "${projectDir}/src/main/resources/assets/image/icon.ico"
+-    version = "${project.version}"
+-    textVersion = "${project.version}"
+-    copyright = "2013-${currentYear()} ${project.name}"
+-    companyName = "${project.name}"
+-    bundledJrePath = "jre/;%JAVA_HOME%;%PATH%"
+-    jvmOptions = [
+-        "-Djna.nosys=true",
+-        "-Djava.net.preferIPv4Stack=true",
+-        "-Dawt.useSystemAAFontSettings=on",
+-        "-Dswing.aatext=true"
+-    ]
+-}
+ 
+ artifacts {
+     archives shadowJar
+-    archives file(project.tasks.jar.getArchivePath().getPath().replace('.jar', '.exe').replace('libs', 'launch4j'))
+     archives file(project.tasks.jar.getArchivePath().getPath().replace('.jar', '.zip').replace('libs', 'distributions'))
+ }
+ 
+ task copyArtifacts(type: Copy) {
+     dependsOn build
+     from shadowJar
+-    from file(project.tasks.jar.getArchivePath().getPath().replace('.jar', '.exe').replace('libs', 'launch4j'))
+     from file(project.tasks.jar.getArchivePath().getPath().replace('.jar', '.zip').replace('libs', 'distributions'))
+     into "${projectDir}/dist"
+ }
+@@ -368,14 +348,6 @@ clean.doFirst {
+     delete "${projectDir}/dist"
+ }
+ 
+-project.afterEvaluate {
+-    tasks.check {
+-        dependsOn -= tasks.find {
+-            it.name.equals("checkLicenses")
+-        }
+-    }
+-}
+-
+ def shouldIgnoreUpdate = { String version -> return ['ALPHA', 'BETA', 'RC', '-M'].any { it -> version.toUpperCase(Locale.ENGLISH).contains(it) } }
+ tasks.named("dependencyUpdates").configure {
+     rejectVersionIf {
+@@ -385,8 +357,6 @@ tasks.named("dependencyUpdates").configure {
+ 
+ build.finalizedBy copyArtifacts
+ shadowJar.dependsOn jar
+-build.dependsOn createExe, createMacApp
+ startScripts.dependsOn shadowJar
+-createExe.dependsOn shadowJar
+ createAppZip.dependsOn downloadNewerUniversalJavaApplicationStub
+ createDmg.dependsOn downloadNewerUniversalJavaApplicationStub
--- a/pkgs/by-name/au/autopush-rs/package.nix
+++ b/pkgs/by-name/au/autopush-rs/package.nix
@ -0,0 +1,136 @@
+{
+  lib,
+  pkgs,
+  nixosTests,
+  fetchFromGitHub,
+  rustPlatform,
+  stdenv,
+  pkg-config,
+  cmake,
+  openssl,
+  libffi,
+  grpc,
+  nix-update-script,
+  python3Packages,
+}:
+let
+  #script to generate the fernet key
+  fernetKey =
+    {
+      src,
+      version,
+    }:
+    python3Packages.buildPythonApplication {
+      pname = "fernet_key";
+      inherit version src;
+
+      __structuredAttrs = true;
+
+      format = "other";
+
+      # this would run the upstream docker makefile
+      dontBuild = true;
+
+      dependencies = [ python3Packages.cryptography ];
+
+      installPhase = ''
+        mkdir -p $out/bin
+        echo "#!/usr/bin/env python3" |  \
+        cat - $src/scripts/fernet_key.py > $out/bin/fernet_key
+        chmod +x $out/bin/fernet_key
+      '';
+
+      postFixup = ''
+        wrapPythonPrograms
+      '';
+    };
+in
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "autopush";
+  version = "1.81.3";
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  outputs = [
+    "out"
+    "fernet"
+  ];
+
+  src = fetchFromGitHub {
+    owner = "mozilla-services";
+    repo = "autopush-rs";
+    tag = finalAttrs.version;
+    hash = "sha256-DP02mcEMoQoJqi5rw5eSuep0i7zeJ0LLYsakikt9hho=";
+  };
+
+  cargoHash = "sha256-LqmuUtFF30TO6iw7LPFB7yJGrzrhh7R0OKCWMhe/OjU=";
+
+  nativeBuildInputs = [
+    pkg-config
+    rustPlatform.bindgenHook
+    cmake
+  ];
+
+  buildInputs = [
+    openssl
+    libffi
+    grpc
+  ];
+
+  # by default only google bigtable is supported as a db
+  buildNoDefaultFeatures = true;
+  buildFeatures = [
+    "postgres"
+    "redis"
+    "reliable_report"
+  ];
+
+  env = {
+    #needed for bingen to find libc
+    BINDGEN_EXTRA_CLANG_ARGS = "-I${stdenv.cc.libc.dev}/include";
+    CMAKE_POLICY_VERSION_MINIMUM = "3.5";
+  };
+
+  #check build fails
+  doCheck = false;
+
+  postInstall = ''
+    mkdir -p $fernet/bin
+    ln -s ${fernetKey { inherit (finalAttrs) src version; }}/bin/fernet_key $fernet/bin/fernet_key
+  '';
+
+  passthru = {
+    tests = nixosTests.autopush-rs;
+    services.autoconnect = {
+      imports = [
+        (lib.modules.importApply ./service-autoconnect.nix { inherit pkgs; })
+      ];
+      package = finalAttrs.finalPackage.out;
+    };
+    services.autoendpoint = {
+      imports = [
+        (lib.modules.importApply ./service-autoendpoint.nix { inherit pkgs; })
+      ];
+      package = finalAttrs.finalPackage.out;
+    };
+
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "Mozilla Push server and Push Endpoint";
+    homepage = "https://mozilla-services.github.io/autopush-rs/index.html";
+    changelog = "https://github.com/mozilla-services/autopush-rs/releases/tag/${finalAttrs.version}";
+    license = lib.licenses.mpl20;
+    platforms = lib.platforms.linux;
+    maintainers = [
+      lib.maintainers.zimward
+    ];
+    # install the fernet_key script in devshells as users will only use it once most likely
+    outputsToInstall = [
+      "out"
+      "fernet"
+    ];
+  };
+})
--- a/pkgs/by-name/au/autopush-rs/service-autoconnect.nix
+++ b/pkgs/by-name/au/autopush-rs/service-autoconnect.nix
@ -0,0 +1,96 @@
+#v Non-module dependencies (`importApply`)
+{ pkgs }:
+
+# Service module
+{
+  lib,
+  options,
+  config,
+  ...
+}:
+let
+  cfg = config.autoconnect;
+  tomlFmt = pkgs.formats.toml { };
+in
+{
+  _class = "service";
+  options = {
+    package = lib.mkPackageOption pkgs "autopush-rs.out" { };
+    autoconnect.settings = lib.mkOption {
+      type = lib.types.submodule {
+        freeformType = tomlFmt.type;
+        options = {
+          db_dsn = lib.mkOption {
+            description = "Endpoint of the database server.";
+            type = lib.types.str;
+            default = "";
+            example = lib.literalExpression "redis+socket://${config.services.redis.servers.autopush-rs.unixSocket}";
+          };
+        };
+      };
+      default = { };
+      description = "";
+    };
+  };
+  config =
+    let
+      configFile = tomlFmt.generate "autoconnect.toml" cfg.settings;
+    in
+    {
+      process.argv = [
+        "${config.package}/bin/autoconnect"
+        "-c"
+        (toString configFile)
+      ];
+    }
+    // lib.optionalAttrs (options ? systemd) {
+      systemd.service = {
+        after = [ "network.target" ];
+        wants = [ "network.target" ];
+        wantedBy = [ "multi-user.target" ];
+        serviceConfig = {
+          Restart = "on-failure";
+
+          #hardening
+          MemoryDenyWriteExecute = true;
+          StateDirectoryMode = 0700;
+          UMask = 077;
+          DynamicUser = true;
+          PrivateUsers = true;
+          PrivateTmp = true;
+          PrivateDevices = true;
+          ProtectSystem = "full";
+          ProtectHome = true;
+          NoNewPrivileges = true;
+          RuntimeDirectoryMode = 755;
+          ProtectHostname = true;
+          ProtectClock = true;
+          ProtectKernelTunables = true;
+          ProtectKernelModules = true;
+          ProtectKernelLogs = true;
+          ProtectControlGroups = true;
+          RestrictNamespaces = true;
+          LockPersonality = true;
+          RestrictRealtime = true;
+          RestrictSUIDSGID = true;
+          RemoveIPC = true;
+          SystemCallArchitectures = "native";
+
+          ProtectProc = "invisible";
+          ProcSubset = "pid";
+
+          SystemCallFilter = [
+            "~@clock"
+            "~@cpu-emulation"
+            "~@debug"
+            "~@module"
+            "~@mount"
+            "~@obsolete"
+            "~@raw-io"
+            "~@reboot"
+            "~@swap"
+          ];
+        };
+      };
+    };
+}
--- a/pkgs/by-name/au/autopush-rs/service-autoendpoint.nix
+++ b/pkgs/by-name/au/autopush-rs/service-autoendpoint.nix
@ -0,0 +1,98 @@
+# Non-module dependencies (`importApply`)
+{ pkgs }:
+
+# Service module
+{
+  lib,
+  config,
+  options,
+  ...
+}:
+let
+  cfg = config.autoendpoint;
+  tomlFmt = pkgs.formats.toml { };
+in
+{
+  _class = "service";
+  options = {
+    package = lib.mkPackageOption pkgs "autopush-rs.out" { };
+    autoendpoint = {
+      settings = lib.mkOption {
+        type = lib.types.submodule {
+          freeformType = tomlFmt.type;
+          options = {
+            db_dsn = lib.mkOption {
+              description = "Endpoint of the database server.";
+              type = lib.types.str;
+              default = "";
+              example = lib.literalExpression "redis+socket://${config.services.redis.servers.autopush-rs.unixSocket}";
+            };
+          };
+        };
+        default = { };
+        description = "";
+      };
+    };
+  };
+  config =
+    let
+      configFile = tomlFmt.generate "autoendpoint.toml" cfg.settings;
+    in
+    {
+      process.argv = [
+        "${config.package}/bin/autoendpoint"
+        "-c"
+        (toString configFile)
+      ];
+    }
+    // lib.optionalAttrs (options ? systemd) {
+      systemd.service = {
+        after = [ "network.target" ];
+        wants = [ "network.target" ];
+        wantedBy = [ "multi-user.target" ];
+        serviceConfig = {
+          Restart = "on-failure";
+
+          #hardening
+          MemoryDenyWriteExecute = true;
+          StateDirectoryMode = 0700;
+          UMask = 077;
+          DynamicUser = true;
+          PrivateUsers = true;
+          PrivateTmp = true;
+          PrivateDevices = true;
+          ProtectSystem = "full";
+          ProtectHome = true;
+          NoNewPrivileges = true;
+          RuntimeDirectoryMode = 755;
+          ProtectHostname = true;
+          ProtectClock = true;
+          ProtectKernelTunables = true;
+          ProtectKernelModules = true;
+          ProtectKernelLogs = true;
+          ProtectControlGroups = true;
+          RestrictNamespaces = true;
+          LockPersonality = true;
+          RestrictRealtime = true;
+          RestrictSUIDSGID = true;
+          RemoveIPC = true;
+          SystemCallArchitectures = "native";
+
+          ProtectProc = "invisible";
+          ProcSubset = "pid";
+
+          SystemCallFilter = [
+            "~@clock"
+            "~@cpu-emulation"
+            "~@debug"
+            "~@module"
+            "~@mount"
+            "~@obsolete"
+            "~@raw-io"
+            "~@reboot"
+            "~@swap"
+          ];
+        };
+      };
+    };
+}
--- a/pkgs/by-name/az/azure-cli/extensions-generated.json
+++ b/pkgs/by-name/az/azure-cli/extensions-generated.json
@ -22,9 +22,9 @@
  },
  "acrtransfer": {
    "pname": "acrtransfer",
-    "version": "1.1.1b1",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/acrtransfer-1.1.1b1-py3-none-any.whl",
-    "hash": "sha256-9rbBiFCxK0cInu5puF5y2kAYcQ7xFa/X3/va5n5i/J0=",
+    "version": "2.0.0",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/acrtransfer-2.0.0-py3-none-any.whl",
+    "hash": "sha256-nG+BxgBHoi4hCF/j4wLbpOlI2MIKB8JjdJoz2LRD+iE=",
    "description": "Microsoft Azure Command-Line Tools Acrtransfer Extension"
  },
  "ad": {
@ -50,9 +50,9 @@
  },
  "aks-preview": {
    "pname": "aks-preview",
-    "version": "20.0.0b1",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/aks_preview-20.0.0b1-py2.py3-none-any.whl",
-    "hash": "sha256-arH7mhRieuEn5s2G8dpZsqk/RKyuslEphOi62FviS7U=",
+    "version": "20.0.0b8",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/aks_preview-20.0.0b8-py2.py3-none-any.whl",
+    "hash": "sha256-ugLew461nhWWg73OZJW7g/xblclV5IfNHKm1it6j+Dc=",
    "description": "Provides a preview for upcoming AKS features"
  },
  "alb": {
@ -153,11 +153,18 @@
    "hash": "sha256-sdk0uNtQX6yBiEboywNE8FAreY1pBiimah0PdmCDRYg=",
    "description": "Microsoft Azure Command-Line Tools AutomationClient Extension"
  },
+  "azure-changesafety": {
+    "pname": "azure-changesafety",
+    "version": "1.0.0b1",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/azure_changesafety-1.0.0b1-py3-none-any.whl",
+    "hash": "sha256-ZR2Bm9U9C4rXrCfPVGRu65MBFjZ4iUtXS44l+ClJXsY=",
+    "description": "Microsoft Azure Command-Line Tools ChangeSafety Extension"
+  },
  "azure-firewall": {
    "pname": "azure-firewall",
-    "version": "2.1.1",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/azure_firewall-2.1.1-py2.py3-none-any.whl",
-    "hash": "sha256-gjt7/Ba38xrpdRyc4oybPbqmhOqZ8Ik/dNP8XRzm4Wc=",
+    "version": "2.2.0",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/azure_firewall-2.2.0-py2.py3-none-any.whl",
+    "hash": "sha256-f1ZxkLZVI4+kzUmwOnY8hMaR/nuxqnLM92xlLQG3rIw=",
    "description": "Manage Azure Firewall resources"
  },
  "azurelargeinstance": {
@ -202,6 +209,13 @@
    "hash": "sha256-w+HDLtCIAIhlFTpR4iUMEKPC2vInPWWmMTX0VT9q1lg=",
    "description": "Microsoft Azure Command-Line Tools Carbon Extension"
  },
+  "cdn": {
+    "pname": "cdn",
+    "version": "1.0.0b1",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/cdn-1.0.0b1-py2.py3-none-any.whl",
+    "hash": "sha256-YybIrCjZnZQ0IFgOZbm4JfMnXNC/Sah8YaZuss1M5B4=",
+    "description": "Microsoft Azure Command-Line Tools CDN and AFD Extension"
+  },
  "change-analysis": {
    "pname": "change-analysis",
    "version": "0.1.0",
@ -309,9 +323,9 @@
  },
  "databricks": {
    "pname": "databricks",
-    "version": "1.3.1",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/databricks-1.3.1-py3-none-any.whl",
-    "hash": "sha256-D6+Sbp49vxPP/IENPPn6TSL3qhwgBZyWBB3KjSgjdCc=",
+    "version": "1.3.2",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/databricks-1.3.2-py3-none-any.whl",
+    "hash": "sha256-iGI+Fk/kVT2/4CspDu/r2UlDrXimUWWx9IAknnNjqhg=",
    "description": "Microsoft Azure Command-Line Tools DatabricksClient Extension"
  },
  "datadog": {
@ -337,9 +351,9 @@
  },
  "dataprotection": {
    "pname": "dataprotection",
-    "version": "1.9.0",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/dataprotection-1.9.0-py3-none-any.whl",
-    "hash": "sha256-YGJlWG4VPvcyKJ2qOnkgt1JYXqPF9LTrnvdTkIZcF30=",
+    "version": "1.10.0",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/dataprotection-1.10.0-py3-none-any.whl",
+    "hash": "sha256-cssrKqmWbQv3qlr8A3GUNklnIGOQ9V2x3e+YWpXeCvQ=",
    "description": "Microsoft Azure Command-Line Tools DataProtectionClient Extension"
  },
  "datashare": {
@ -482,6 +496,13 @@
    "hash": "sha256-x1mbd/Y28BcYqEf+T1rZcOHT8wrq9VnWnCfw9rBnl80=",
    "description": "Microsoft Azure Command-Line Tools ExpressRouteCrossConnection Extension"
  },
+  "fileshares": {
+    "pname": "fileshares",
+    "version": "1.0.0b1",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/fileshares-1.0.0b1-py3-none-any.whl",
+    "hash": "sha256-IrJwPQaMuX9VItIEkJzK3cmANHzU50fIaWn2s32nDVk=",
+    "description": "Commands for managing Azure file shares, snapshots, and private endpoint connections"
+  },
  "firmwareanalysis": {
    "pname": "firmwareanalysis",
    "version": "2.0.1",
@ -491,9 +512,9 @@
  },
  "fleet": {
    "pname": "fleet",
-    "version": "1.9.0",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/fleet-1.9.0-py3-none-any.whl",
-    "hash": "sha256-5CsWYP0r2UfUTekKDsqWBNonDOPaR5TrhxZDF7hAtXI=",
+    "version": "1.10.0",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/fleet-1.10.0-py3-none-any.whl",
+    "hash": "sha256-hgAwdLExAvKR0G9Ey81rTSa2QLxeoMnUZ7KRaCYhfM8=",
    "description": "Microsoft Azure Command-Line Tools Fleet Extension"
  },
  "fluid-relay": {
@ -512,9 +533,9 @@
  },
  "front-door": {
    "pname": "front-door",
-    "version": "2.1.0",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/front_door-2.1.0-py3-none-any.whl",
-    "hash": "sha256-7aa9A+tq+qXzMuabG9McHkXpU3TRZVjQWDbmuHTTsFk=",
+    "version": "2.2.0",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/front_door-2.2.0-py3-none-any.whl",
+    "hash": "sha256-5vj/OzbfMmv/SI8qS659o+QiMfPofoBCJR/mQV3XZNE=",
    "description": "Manage networking Front Doors"
  },
  "fzf": {
@ -573,6 +594,13 @@
    "hash": "sha256-VTL1/L/UfORNWvyY0hvSJrvoz5zHabLPFX/sEdQaLhI=",
    "description": "Microsoft Azure Command-Line Tools HealthcareApisManagementClient Extension"
  },
+  "horizondb": {
+    "pname": "horizondb",
+    "version": "1.0.0b1",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/horizondb-1.0.0b1-py2.py3-none-any.whl",
+    "hash": "sha256-bvjD6FSGjkuMjnc1XYnglbzd2cLMDuwRiPW9+7n6efA=",
+    "description": "Microsoft Azure Command-Line Tools HorizonDB Extension"
+  },
  "hpc-cache": {
    "pname": "hpc-cache",
    "version": "0.1.6",
@ -680,9 +708,9 @@
  },
  "maintenance": {
    "pname": "maintenance",
-    "version": "1.7.0b2",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/maintenance-1.7.0b2-py3-none-any.whl",
-    "hash": "sha256-ebiJ8U5FyRLG9VHBGB75AqkjPVars8kGxWnjUCMiiCI=",
+    "version": "2.0.0b1",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/maintenance-2.0.0b1-py3-none-any.whl",
+    "hash": "sha256-ax3HeCaCq9p5fokc9W3y2XtVHsRYNTZQRkNfXqwpPGk=",
    "description": "Microsoft Azure Command-Line Tools MaintenanceManagementClient Extension"
  },
  "managedccfs": {
@ -694,10 +722,10 @@
  },
  "managednetworkfabric": {
    "pname": "managednetworkfabric",
-    "version": "9.1.1",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/managednetworkfabric-9.1.1-py3-none-any.whl",
-    "hash": "sha256-bLPE5Spy4Lhtv6ZEWx2E2nLRqkrZ/LfJVmDQWjqEZi0=",
-    "description": "Support for managednetworkfabric commands based on 2025-07-15 API version"
+    "version": "10.0.0b1",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/managednetworkfabric-10.0.0b1-py3-none-any.whl",
+    "hash": "sha256-7veSgSJp7isa+JwAiep+3dMTJFLohIAHNcF9UVIFaNc=",
+    "description": "Support for managednetworkfabric commands based on 2026-01-15-preview API version"
  },
  "managementpartner": {
    "pname": "managementpartner",
@ -757,9 +785,9 @@
  },
  "monitor-pipeline-group": {
    "pname": "monitor-pipeline-group",
-    "version": "1.0.0b2",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/monitor_pipeline_group-1.0.0b2-py3-none-any.whl",
-    "hash": "sha256-skfHQJ7vGnKZtaDmAGmjPLtuxNfyHE44pxi1Usl9X9s=",
+    "version": "1.0.0",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/monitor_pipeline_group-1.0.0-py3-none-any.whl",
+    "hash": "sha256-oVPbg8B2TMiHSNKMakl45zkfJenXX5el0tEjirIi9/k=",
    "description": "Microsoft Azure Command-Line Tools MonitorPipelineGroup Extension"
  },
  "multicloud-connector": {
@ -853,6 +881,13 @@
    "hash": "sha256-/k47qFwfZZZqBZKR5G6+t8lW8o2isVtUGwSSdltiOZI=",
    "description": "Microsoft Azure Command-Line Tools PeeringManagementClient Extension"
  },
+  "planetarycomputer": {
+    "pname": "planetarycomputer",
+    "version": "1.0.0b1",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/planetarycomputer-1.0.0b1-py3-none-any.whl",
+    "hash": "sha256-FPvUcZx5yHHB2du7F6ulDjoNsNCek2HtuVMJd6g0mBE=",
+    "description": "Microsoft Azure Command-Line Tools Planetary Computer Extension"
+  },
  "portal": {
    "pname": "portal",
    "version": "1.0.0b2",
@ -890,9 +925,9 @@
  },
  "quantum": {
    "pname": "quantum",
-    "version": "1.0.0b12",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/quantum-1.0.0b12-py3-none-any.whl",
-    "hash": "sha256-9tjBvpu1F2/2JYKUD2IbxUckYofUH0rEnimkpRXF2wY=",
+    "version": "1.0.0b13",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/quantum-1.0.0b13-py3-none-any.whl",
+    "hash": "sha256-zNyvYvtJY2AgASUoMvN/cCXWIOJ1d3JEQ7G/tuyV/o4=",
    "description": "Microsoft Azure Command-Line Tools Quantum Extension"
  },
  "qumulo": {
@ -909,6 +944,13 @@
    "hash": "sha256-i0w0dd8MNUTbzCjkh161sWPXK0Cv9CUKr9rZQYDD+ZU=",
    "description": "Microsoft Azure Command-Line Tools AzureQuotaExtensionAPI Extension"
  },
+  "relationship": {
+    "pname": "relationship",
+    "version": "1.0.0b1",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/relationship-1.0.0b1-py2.py3-none-any.whl",
+    "hash": "sha256-pEXG6+Gf/JlzjeQGw0VadoArnX+2yjhYVMxg78Qg06g=",
+    "description": "Microsoft Azure Command-Line Tools Relationship Extension"
+  },
  "reservation": {
    "pname": "reservation",
    "version": "0.3.1",
@ -965,11 +1007,18 @@
    "hash": "sha256-VRFUS040KwOkpCY2F8YD2HRCrVF5zp2MDR/RCRX5O3o=",
    "description": "Microsoft Azure Command-Line Tools Sentinel Extension"
  },
+  "servicegroup": {
+    "pname": "servicegroup",
+    "version": "1.0.0b1",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/servicegroup-1.0.0b1-py3-none-any.whl",
+    "hash": "sha256-6vOfQdjX+/4Sba1qswxVcDBy+xLCgNOEG01wLL10GvQ=",
+    "description": "Microsoft Azure Command-Line Tools ServiceGroup Extension"
+  },
  "sftp": {
    "pname": "sftp",
-    "version": "1.0.0b2",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/sftp-1.0.0b2-py3-none-any.whl",
-    "hash": "sha256-3ugWIeKK9U8vKgFMbQfMKXxbgW+zO9IB6lPYJFHZm/E=",
+    "version": "1.0.0b3",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/sftp-1.0.0b3-py3-none-any.whl",
+    "hash": "sha256-hCpM/ZAJjn4hLElyLzwZzthR4OF36tPDevC2UlR0q0U=",
    "description": "Secure access to Azure Storage blob data via SFTP with SSH certificates"
  },
  "site": {
@ -995,9 +1044,9 @@
  },
  "stack-hci-vm": {
    "pname": "stack-hci-vm",
-    "version": "1.13.0",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/stack_hci_vm-1.13.0-py3-none-any.whl",
-    "hash": "sha256-/GKJy7+iT33evnZ4UpNXB9GNBWtiLIOJXhk5VZowIos=",
+    "version": "1.14.5",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/stack_hci_vm-1.14.5-py3-none-any.whl",
+    "hash": "sha256-JE2Qq5OPy+AnTn4GxFeDhiyuCnUV3v1ciu7AqP2TwR4=",
    "description": "Microsoft Azure Command-Line Tools Stack-HCi-VM Extension"
  },
  "standbypool": {
@ -1051,9 +1100,9 @@
  },
  "stream-analytics": {
    "pname": "stream-analytics",
-    "version": "1.0.2",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/stream_analytics-1.0.2-py3-none-any.whl",
-    "hash": "sha256-HAkhteF4LaAO3YnOrWHvHJ+9K6Kd4ns9GCcnDXDJtLg=",
+    "version": "1.0.3",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/stream_analytics-1.0.3-py3-none-any.whl",
+    "hash": "sha256-FFRNCsg9Put3GcARODA6HpwGXbWfD1kb7qDvc+/TAkg=",
    "description": "Microsoft Azure Command-Line Tools StreamAnalyticsManagementClient Extension"
  },
  "subscription": {
--- a/pkgs/by-name/az/azure-cli/package.nix
+++ b/pkgs/by-name/az/azure-cli/package.nix
@ -26,14 +26,14 @@
 }:

 let
-  version = "2.85.0";
+  version = "2.86.0";

  src = fetchFromGitHub {
    name = "azure-cli-${version}-src";
    owner = "Azure";
    repo = "azure-cli";
    tag = "azure-cli-${version}";
-    hash = "sha256-fNch6QiiHffyHOHw30dlRoe5UFvGVIZkneULjNihGdU=";
+    hash = "sha256-3C39e9C3m9M0faGUgOEWo66fFGDytfGohgUYX55VN8g=";
  };

  # put packages that needs to be overridden in the py package scope
--- a/pkgs/by-name/ba/ballerburg/package.nix
+++ b/pkgs/by-name/ba/ballerburg/package.nix
@ -34,6 +34,16 @@ stdenv.mkDerivation (finalAttrs: {

  buildInputs = [ SDL ];

+  # CMake's default framework search order on Darwin finds Kernel.framework
+  # headers while detecting SDL 1.2, which makes standard includes like
+  # <string.h> resolve to the wrong SDK header and breaks the build.
+  # Keep this package on the old Nixpkgs search order without restoring it
+  # globally: https://github.com/NixOS/nixpkgs/pull/455592
+  # CMake docs: https://cmake.org/cmake/help/latest/variable/CMAKE_FIND_FRAMEWORK.html
+  cmakeFlags = lib.optionals stdenv.hostPlatform.isDarwin [
+    "-DCMAKE_FIND_FRAMEWORK=LAST"
+  ];
+
  desktopItems = [
    (makeDesktopItem {
      name = "Ballerburg";
--- a/pkgs/by-name/bi/bind/package.nix
+++ b/pkgs/by-name/bi/bind/package.nix
@ -29,11 +29,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "bind";
-  version = "9.20.22";
+  version = "9.20.23";

  src = fetchurl {
    url = "https://downloads.isc.org/isc/bind9/${finalAttrs.version}/bind-${finalAttrs.version}.tar.xz";
-    hash = "sha256-y6kv9jG5SWVfR1/ktUKQ9oYP0AcNOZ8iefZDfA04PsY=";
+    hash = "sha256-XUR1rtP55QDvVUsrFNlyvbg9M94hSps76SkY6kaQg3E=";
  };

  outputs = [
--- a/pkgs/by-name/bi/bite/package.nix
+++ b/pkgs/by-name/bi/bite/package.nix
@ -21,16 +21,18 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "bite";
-  version = "0.3";
+  version = "0.43";
+
+  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "WINSDK";
    repo = "bite";
-    rev = "V${finalAttrs.version}";
-    hash = "sha256-gio4J+V8achSuR2vQa2dnvOR/u4Zbb5z0UE0xP0gGCU=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-akwkTV1bZJ3GcEtObyF+qN5IkBRoXdztUSOghjQy7A0=";
  };

-  cargoHash = "sha256-ESGX1hnDnU2taKQXre4AQRzQxTC7W+0cEIoQPPC9Lfs=";
+  cargoHash = "sha256-OlxUHYTbljWGWdiceBmW3J0oB4w0/5izgNnwCafV6xY=";

  nativeBuildInputs = [
    pkg-config
@ -90,7 +92,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
    description = "Disassembler focused on comprehensive rust support";
    homepage = "https://github.com/WINSDK/bite";
    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ vinnymeller ];
+    maintainers = with lib.maintainers; [
+      vinnymeller
+      kybe236
+    ];
    mainProgram = "bite";
  };
 })
--- a/pkgs/by-name/bo/borgbackup/package.nix
+++ b/pkgs/by-name/bo/borgbackup/package.nix
@ -70,11 +70,15 @@ python.pkgs.buildPythonApplication (finalAttrs: {
    acl
  ];

-  dependencies = with python.pkgs; [
-    msgpack
-    packaging
-    (if stdenv.hostPlatform.isLinux then pyfuse3 else llfuse)
-  ];
+  dependencies =
+    with python.pkgs;
+    [
+      msgpack
+      packaging
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isLinux [
+      pyfuse3
+    ];

  makeWrapperArgs = [
    ''--prefix PATH ':' "${openssh}/bin"''
--- a/pkgs/by-name/ch/chess-tui/package.nix
+++ b/pkgs/by-name/ch/chess-tui/package.nix
@ -11,16 +11,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "chess-tui";
-  version = "2.5.1";
+  version = "2.7.0";

  src = fetchFromGitHub {
    owner = "thomas-mauran";
    repo = "chess-tui";
    tag = finalAttrs.version;
-    hash = "sha256-jO3pa4N7XNyKQCbPjFByYmLlOtrrdpzS5lkxU9giE+w=";
+    hash = "sha256-BGJOPsePE5S5ySrOg63cNKn9pT+7MmDLHZrW3YhUFz8=";
  };

-  cargoHash = "sha256-9LXg4zX/irLt2MCq7V0dQA3o1QRqGgfRcX4HneNGAns=";
+  cargoHash = "sha256-n9rjr5vUK619XIfuHIlf+lxUAeTbhTAzmdysliKNOFY=";

  checkFlags = [
    # assertion failed: result.is_ok()
--- a/pkgs/by-name/cp/cppitertools/package.nix
+++ b/pkgs/by-name/cp/cppitertools/package.nix
@ -9,13 +9,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "cppitertools";
-  version = "2.1";
+  version = "2.3";

  src = fetchFromGitHub {
    owner = "ryanhaining";
    repo = "cppitertools";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-mii4xjxF1YC3H/TuO/o4cEz8bx2ko6U0eufqNVw5LNA=";
+    hash = "sha256-1lHpy+9e17lP/58EEIzrmyBwbmMD665ypDJtkSFrN9E=";
  };

  __structuredAttrs = true;
@ -25,13 +25,6 @@ stdenv.mkDerivation (finalAttrs: {
  # tests. The CMake system defines tests and install targets, including a
  # cppitertools-config.cmake, which is really helpful for downstream consumers
  # to detect this package since it has no pkg-config.
-  # However the CMake system also specifies the entire source repo as an install
-  # target, including support files, the build directory, etc.
-  # We can't simply take cppitertools-config.cmake for ourselves because before
-  # install it's placed in non-specific private CMake subdirectory of the build
-  # directory.
-  # Therefore, we instead simply patch CMakeLists.txt to make the target that
-  # installs the entire directory non-default, and then install the headers manually.

  strictDeps = true;

@ -47,7 +40,6 @@ stdenv.mkDerivation (finalAttrs: {
  # files that are also in that repo.
  cmakeBuildDir = "cmake-build";

-  includeInstallDir = "${placeholder "out"}/include/cppitertools";
  cmakeInstallDir = "${placeholder "out"}/share/cmake";

  # This version of cppitertools considers itself as having used the default value,
@ -58,12 +50,7 @@ stdenv.mkDerivation (finalAttrs: {

  cmakeFlags = [ "-Dcppitertools_INSTALL_CMAKE_DIR=${finalAttrs.cmakeInstallDir}" ];

-  prePatch = ''
-    # Mark the `.` install target as non-default.
-    substituteInPlace CMakeLists.txt \
-      --replace-fail "  DIRECTORY ." "  DIRECTORY . EXCLUDE_FROM_ALL"
-  ''
-  + lib.optionalString finalAttrs.finalPackage.doCheck ''
+  prePatch = lib.optionalString finalAttrs.finalPackage.doCheck ''
    # Required for tests.
    cp ${lib.getDev catch2}/include/catch2/catch.hpp test/
  '';
@ -77,11 +64,7 @@ stdenv.mkDerivation (finalAttrs: {

  installPhase = ''
    runHook preInstall
-    # Install the -config.cmake files.
    cmake --install . "--prefix=$out"
-    # Install the headers.
-    mkdir -p "$includeInstallDir"
-    cp -r ../*.hpp ../internal "$includeInstallDir"
    runHook postInstall
  '';

--- a/pkgs/by-name/fo/fotema/cargo-lock-bump-ffmpeg-next.patch
+++ b/pkgs/by-name/fo/fotema/cargo-lock-bump-ffmpeg-next.patch
@ -0,0 +1,193 @@
+--- a/Cargo.lock
+++ b/Cargo.lock
+@@ -428,7 +428,7 @@
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "993776b509cfb49c750f11b8f07a46fa23e0a1386ffc01fb1e7d343efc387895"
+ dependencies = [
+- "bitflags 2.10.0",
+ "bitflags 2.11.1",
+  "cexpr",
+  "clang-sys",
+  "itertools 0.13.0",
+@@ -454,9 +454,9 @@
+ 
+ [[package]]
+ name = "bitflags"
+-version = "2.10.0"
+version = "2.11.1"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "812e12b5285cc515a9c72a5c1d3b6d46a19dac5acfef5265968c166106e31dd3"
+checksum = "c4512299f36f043ab09a583e57bceb5a5aab7a73db1805848e8fef3c9e8c78b3"
+ 
+ [[package]]
+ name = "bitreader"
+@@ -555,7 +555,7 @@
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "b01fe135c0bd16afe262b6dea349bd5ea30e6de50708cec639aae7c5c14cc7e4"
+ dependencies = [
+- "bitflags 2.10.0",
+ "bitflags 2.11.1",
+  "cairo-sys-rs",
+  "glib",
+  "libc",
+@@ -1132,20 +1132,20 @@
+ 
+ [[package]]
+ name = "ffmpeg-next"
+-version = "8.0.0"
+version = "8.1.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "d658424d233cbd993a972dd73a66ca733acd12a494c68995c9ac32ae1fe65b40"
+checksum = "f7c4bd5ab1ac61f29c634df1175d350ded29cf74c3c6d4f7030431a5ae3c7d5d"
+ dependencies = [
+- "bitflags 2.10.0",
+ "bitflags 2.11.1",
+  "ffmpeg-sys-next",
+  "libc",
+ ]
+ 
+ [[package]]
+ name = "ffmpeg-sys-next"
+-version = "8.0.1"
+version = "8.1.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "9bca20aa4ee774fe384c2490096c122b0b23cf524a9910add0686691003d797b"
+checksum = "a314bc0e022a33a99567ed4bd2576bd58ffd8fcff7891c29194cfecc26a62547"
+ dependencies = [
+  "bindgen",
+  "cc",
+@@ -1709,7 +1709,7 @@
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "16de123c2e6c90ce3b573b7330de19be649080ec612033d397d72da265f1bd8b"
+ dependencies = [
+- "bitflags 2.10.0",
+ "bitflags 2.11.1",
+  "futures-channel",
+  "futures-core",
+  "futures-executor",
+@@ -1796,7 +1796,7 @@
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "6e9b31c7fa5ccb9d91317c956e767daef59be9fee3ae9df30468470368678482"
+ dependencies = [
+- "bitflags 2.10.0",
+ "bitflags 2.11.1",
+  "gufo-common",
+  "half",
+  "memmap2",
+@@ -1816,7 +1816,7 @@
+ checksum = "7dfec0cd29d5ecfb1dd723868e22e2c49441020f35d5f14307018ff0a1679e2f"
+ dependencies = [
+  "async-lock",
+- "bitflags 2.10.0",
+ "bitflags 2.11.1",
+  "blocking",
+  "env_logger",
+  "futures-util",
+@@ -2819,7 +2819,7 @@
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "3d0b95e02c851351f877147b7deea7b1afb1df71b63aa5f8270716e0c5720616"
+ dependencies = [
+- "bitflags 2.10.0",
+ "bitflags 2.11.1",
+  "libc",
+ ]
+ 
+@@ -2829,7 +2829,7 @@
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "0e5310a2c5b6ffbc094b5f70a2ca7b79ed36ad90e6f90994b166489a1bce3fcc"
+ dependencies = [
+- "bitflags 2.10.0",
+ "bitflags 2.11.1",
+  "libc",
+  "libseccomp-sys",
+  "pkg-config",
+@@ -3190,7 +3190,7 @@
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "74523f3a35e05aba87a1d978330aef40f67b0304ac79c1c00b294c9830543db6"
+ dependencies = [
+- "bitflags 2.10.0",
+ "bitflags 2.11.1",
+  "cfg-if",
+  "cfg_aliases",
+  "libc",
+@@ -3422,7 +3422,7 @@
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "08838db121398ad17ab8531ce9de97b244589089e290a384c900cb9ff7434328"
+ dependencies = [
+- "bitflags 2.10.0",
+ "bitflags 2.11.1",
+  "cfg-if",
+  "foreign-types 0.3.2",
+  "libc",
+@@ -3631,7 +3631,7 @@
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "60769b8b31b2a9f263dae2776c37b1b28ae246943cf719eb6946a1db05128a61"
+ dependencies = [
+- "bitflags 2.10.0",
+ "bitflags 2.11.1",
+  "crc32fast",
+  "fdeflate",
+  "flate2",
+@@ -3996,7 +3996,7 @@
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "ed2bf2547551a7053d6fdfafda3f938979645c44812fbfcda098faae3f1a362d"
+ dependencies = [
+- "bitflags 2.10.0",
+ "bitflags 2.11.1",
+ ]
+ 
+ [[package]]
+@@ -4242,7 +4242,7 @@
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "165ca6e57b20e1351573e3729b958bc62f0e48025386970b6e4d29e7a7e71f3f"
+ dependencies = [
+- "bitflags 2.10.0",
+ "bitflags 2.11.1",
+  "chrono",
+  "fallible-iterator",
+  "fallible-streaming-iterator",
+@@ -4323,7 +4323,7 @@
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "146c9e247ccc180c1f61615433868c99f3de3ae256a30a43b49f67c2d9171f34"
+ dependencies = [
+- "bitflags 2.10.0",
+ "bitflags 2.11.1",
+  "errno",
+  "libc",
+  "linux-raw-sys",
+@@ -4465,7 +4465,7 @@
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "897b2245f0b511c87893af39b033e5ca9cce68824c4d7e7630b5a1d339658d02"
+ dependencies = [
+- "bitflags 2.10.0",
+ "bitflags 2.11.1",
+  "core-foundation 0.9.4",
+  "core-foundation-sys",
+  "libc",
+@@ -4478,7 +4478,7 @@
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "b3297343eaf830f66ede390ea39da1d462b6b0c1b000f420d0a83f898bbbe6ef"
+ dependencies = [
+- "bitflags 2.10.0",
+ "bitflags 2.11.1",
+  "core-foundation 0.10.1",
+  "core-foundation-sys",
+  "libc",
+@@ -4844,7 +4844,7 @@
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "a13f3d0daba03132c0aa9767f98351b3488edc2c100cda2d2ec2b04f3d8d3c8b"
+ dependencies = [
+- "bitflags 2.10.0",
+ "bitflags 2.11.1",
+  "core-foundation 0.9.4",
+  "system-configuration-sys 0.6.0",
+ ]
+@@ -5205,7 +5205,7 @@
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "d4e6559d53cc268e5031cd8429d05415bc4cb4aefc4aa5d6cc35fbf5b924a1f8"
+ dependencies = [
+- "bitflags 2.10.0",
+ "bitflags 2.11.1",
+  "bytes",
+  "futures-util",
+  "http 1.4.0",
--- a/pkgs/by-name/fo/fotema/package.nix
+++ b/pkgs/by-name/fo/fotema/package.nix
@ -1,5 +1,6 @@
 {
  lib,
+  applyPatches,
  clangStdenv,
  fetchFromGitHub,
  rustPlatform,
@ -40,9 +41,17 @@ clangStdenv.mkDerivation (finalAttrs: {
    hash = "sha256-g1CxgK8gaX24TFnlGUons3ve8Ow9YaiMh1kMwlcP/F8=";
  };

+  patches = [
+    # Bump ffmpeg-next 8.0.0 -> 8.1.0 in Cargo.lock for ffmpeg 8.1 compatibility.
+    ./cargo-lock-bump-ffmpeg-next.patch
+  ];
+
  cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit (finalAttrs) pname version src;
-    hash = "sha256-vA1vB2Lgyo5SfexDC4Ag85nM+/NzsYZNeIH4HmiESHc=";
+    inherit (finalAttrs) pname version;
+    src = applyPatches {
+      inherit (finalAttrs) src patches;
+    };
+    hash = "sha256-AEZY1QODq4F+CTrJce14qA6XSZjv29wSwIqUjZPWJo4=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/ho/hooky/package.nix
+++ b/pkgs/by-name/ho/hooky/package.nix
@ -20,6 +20,11 @@ haskellPackages.mkDerivation {
    hash = "sha256-w4sWD5dZTNKwrYhrJw9RcwGoeNxpJnm/6RRqYjiIiBg=";
  };

+  postPatch = ''
+    substituteInPlace src/Hooky/Config.hs \
+      --replace-fail 'KDL.text' 'KDL.string'
+  '';
+
  isLibrary = true;
  isExecutable = true;
  libraryHaskellDepends = with haskellPackages; [
--- a/pkgs/by-name/ho/hot-resize/package.nix
+++ b/pkgs/by-name/ho/hot-resize/package.nix
@ -15,16 +15,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "hot-resize";
-  version = "0.1.6";
+  version = "0.1.7";

  src = fetchFromGitHub {
    owner = "liberodark";
    repo = "hot-resize";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-8UA5Wv96PUerBRTwTwkSAv1iw6lt9nd4MXGdKUmxoz4=";
+    hash = "sha256-TMLtU2c5jkZEc14rII/+I1GtUzBnnZgPyPUgghqs7sM=";
  };

-  cargoHash = "sha256-uGMd9xZRYbCJyHkUZXvUnN3M5N1FTaROfoww+oODAHE=";
+  cargoHash = "sha256-z9jWAGhSjYFQ8EhK0V4JsxToLYbEB4TJvhJJfUTGZS0=";

  nativeBuildInputs = [
    makeWrapper
@ -43,6 +43,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
      }
  '';

+  __structuredAttrs = true;
+
  nativeInstallCheckInputs = [
    versionCheckHook
  ];
--- a/pkgs/by-name/ir/ironbar/package.nix
+++ b/pkgs/by-name/ir/ironbar/package.nix
@ -12,7 +12,6 @@
  gtk4-layer-shell,
  adwaita-icon-theme,
  libxkbcommon,
-  openssl,
  pkg-config,
  hicolor-icon-theme,
  rustPlatform,
@ -33,16 +32,16 @@ let
 in
 rustPlatform.buildRustPackage rec {
  pname = "ironbar";
-  version = "0.18.0";
+  version = "0.19.0";

  src = fetchFromGitHub {
    owner = "JakeStanger";
    repo = "ironbar";
    rev = "v${version}";
-    hash = "sha256-vhkNdvzY9xd8qmKgKtpVRTdvmS1QxnGKDFCpttqX1GE=";
+    hash = "sha256-9UPBSOgiyBOlUYZlx+xQN5PTPwDWCDdYKdCAhigzHwA=";
  };

-  cargoHash = "sha256-ptzq0407IaNrXXiksQKXDUbs2wPTz4GHtnCG49EbOcY=";
+  cargoHash = "sha256-ticVPKKfQnz21LpegKDwAtizi7bavIPEmpXsrZdRN48=";

  buildInputs = [
    gtk4
@ -58,7 +57,6 @@ rustPlatform.buildRustPackage rec {
    systemd
    dbus
  ]
-  ++ lib.optionals (hasFeature "http") [ openssl ]
  ++ lib.optionals (hasFeature "volume") [ libpulseaudio ]
  ++ lib.optionals (hasFeature "cairo") [ luajit ]
  ++ lib.optionals (hasFeature "keyboard") [
--- a/pkgs/by-name/la/labwc-tweaks-gtk/package.nix
+++ b/pkgs/by-name/la/labwc-tweaks-gtk/package.nix
@ -14,13 +14,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "labwc-tweaks-gtk";
-  version = "0-unstable-2026-05-09";
+  version = "0-unstable-2026-05-22";

  src = fetchFromGitHub {
    owner = "labwc";
    repo = "labwc-tweaks-gtk";
-    rev = "c84d78c601e9f9a6e863766e35f736635cfa52d0";
-    hash = "sha256-qyMgo9QB8wLzZiUlbz/NjTssYy8FB28A5RX7Hd05ays=";
+    rev = "ebe05bef2cf5966a45a42370371ae879c472cf6d";
+    hash = "sha256-5HqxB03yXksRBV/wZa3J5xLEIbv2oZvLp2YQ3FMgd1k=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/lt/lttv/package.nix
+++ b/pkgs/by-name/lt/lttv/package.nix
@ -1,52 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchurl,
-  fetchpatch,
-  pkg-config,
-  glib,
-  gtk2,
-  popt,
-  babeltrace,
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "lttv";
-  version = "1.5";
-
-  src = fetchurl {
-    url = "https://lttng.org/files/packages/lttv-${finalAttrs.version}.tar.bz2";
-    sha256 = "1faldxnh9dld5k0vxckwpqw241ya1r2zv286l6rpgqr500zqw7r1";
-  };
-
-  patches = [
-    # fix build with gcc14:
-    (fetchpatch {
-      name = "lttv-c99-compatibility-fix.patch";
-      url = "https://git.lttng.org/?p=lttv.git;a=patch;h=6b9d59fe4cc1dc943501ab6ede93856b2f06c3ce";
-      hash = "sha256-zcLHBri0i10NGkgiZT6QRZbixffYvkzLaFBeC/ESF/U=";
-    })
-  ];
-
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [
-    glib
-    gtk2
-    popt
-    babeltrace
-  ];
-
-  meta = {
-    description = "Graphical trace viewer for LTTng trace files";
-    homepage = "https://lttng.org/";
-    # liblttvtraceread (ltt/ directory) is distributed under the GNU LGPL v2.1.
-    # The rest of the LTTV package is distributed under the GNU GPL v2.
-    license = with lib.licenses; [
-      gpl2
-      lgpl21
-    ];
-    platforms = lib.platforms.linux;
-    maintainers = [ lib.maintainers.bjornfor ];
-  };
-
-})
--- a/pkgs/by-name/ma/macopix/package.nix
+++ b/pkgs/by-name/ma/macopix/package.nix
@ -36,7 +36,7 @@ stdenv.mkDerivation (finalAttrs: {
    # Workaround build failure on -fno-common toolchains:
    #   ld: dnd.o:src/main.h:136: multiple definition of
    #     `MENU_EXT'; main.o:src/main.h:136: first defined here
-    NIX_CFLAGS_COMPILE = "-fcommon";
+    NIX_CFLAGS_COMPILE = "-fcommon -std=gnu99";
    NIX_LDFLAGS = "-lX11";
  };

--- a/pkgs/by-name/ma/mailspring/package.nix
+++ b/pkgs/by-name/ma/mailspring/package.nix
@ -17,10 +17,7 @@ let
      Mailspring's sync engine runs locally, but its source is not open.
    '';
    mainProgram = "mailspring";
-    maintainers = with lib.maintainers; [
-      toschmidt
-      wrench-exile-legacy
-    ];
+    maintainers = with lib.maintainers; [ wrench-exile-legacy ];
    platforms = [
      "x86_64-linux"
      "aarch64-darwin"
--- a/pkgs/by-name/mi/mirrord/manifest.json
+++ b/pkgs/by-name/mi/mirrord/manifest.json
@ -1,21 +1,21 @@
 {
-  "version": "3.210.0",
+  "version": "3.211.0",
  "assets": {
    "x86_64-linux": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.210.0/mirrord_linux_x86_64",
-      "hash": "sha256-eg7eO97SHZQoju/wH/6IvyEmLi//HXLsDJ3AjeJyPA8="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.211.0/mirrord_linux_x86_64",
+      "hash": "sha256-5ke7ZXbqGAWcwUNW5ofrc0Ez7XS9oekHFuVagFeMwKA="
    },
    "aarch64-linux": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.210.0/mirrord_linux_aarch64",
-      "hash": "sha256-J+2jHv3/QhpxOHoCMTJMr1k8TTQfQVYjPGuZeZ0GufQ="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.211.0/mirrord_linux_aarch64",
+      "hash": "sha256-o9Hu5TqPzcOmbwAG40f6CDw5VE/3v3ggXJ6/2RPuReU="
    },
    "aarch64-darwin": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.210.0/mirrord_mac_universal",
-      "hash": "sha256-GctpfiYZOfkYqbAmTWV+VHxbg4IGc/xhZvacgBltJnU="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.211.0/mirrord_mac_universal",
+      "hash": "sha256-aOPjhsMAVP5Jn8pjxRyr/92HXlMB5nix9BwHoc2uf8A="
    },
    "x86_64-darwin": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.210.0/mirrord_mac_universal",
-      "hash": "sha256-GctpfiYZOfkYqbAmTWV+VHxbg4IGc/xhZvacgBltJnU="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.211.0/mirrord_mac_universal",
+      "hash": "sha256-aOPjhsMAVP5Jn8pjxRyr/92HXlMB5nix9BwHoc2uf8A="
    }
  }
 }
--- a/pkgs/by-name/na/nav/package.nix
+++ b/pkgs/by-name/na/nav/package.nix
@ -4,18 +4,21 @@
  fetchurl,
  autoPatchelfHook,
  libxcrypt-legacy,
+  zlib,
+  testers,
+  nav,
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "nav";
-  version = "1.5.0";
+  version = "1.5.2";

  src = fetchurl {
    url = "https://github.com/Jojo4GH/nav/releases/download/v${finalAttrs.version}/nav-${stdenv.hostPlatform.parsed.cpu.name}-unknown-linux-gnu.tar.gz";
    sha256 =
      {
-        x86_64-linux = "sha256-LQdw8/V1KFNM6TY1rFt/RiZuiRQXM+8HNGkJXDrE/mw=";
-        aarch64-linux = "sha256-SMcdnUxKbJ5GXB358WglIMiPHWsn1uVnjN9UiL3V6dk=";
+        x86_64-linux = "sha256-/A6IZRX8v8yKfcxYxo0gxbsZri2dgTs8YH7H2LauaBE=";
+        aarch64-linux = "sha256-YNS/P6TU7qLPn39X6GyUtjBw7GXOi2btd3AV+etpUhQ=";
      }
      .${stdenv.hostPlatform.system} or (throw "unsupported system ${stdenv.hostPlatform.system}");
  };
@ -26,6 +29,7 @@ stdenv.mkDerivation (finalAttrs: {
  buildInputs = [
    stdenv.cc.cc.lib
    libxcrypt-legacy
+    zlib
  ];

  installPhase = ''
@ -37,6 +41,12 @@ stdenv.mkDerivation (finalAttrs: {
    runHook postInstall
  '';

+  passthru.tests = {
+    version = testers.testVersion {
+      package = nav;
+    };
+  };
+
  passthru.updateScript = ./update.sh;

  meta = {
--- a/pkgs/by-name/ne/netbird/package.nix
+++ b/pkgs/by-name/ne/netbird/package.nix
@ -67,13 +67,13 @@ let
 in
 buildGoModule (finalAttrs: {
  pname = "netbird-${componentName}";
-  version = "0.71.3";
+  version = "0.71.4";

  src = fetchFromGitHub {
    owner = "netbirdio";
    repo = "netbird";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-1doOf/rgGbD/YtMY0+j1VM7933zR+G+Vyq6bF5fyuMg=";
+    hash = "sha256-e/fe4wEjz7apA5RZ4nGIaunp0+5NVH4yMHK/l/MfcWI=";
  };

  vendorHash = "sha256-NeZuj9o2yu5di+6jbNqCnAw0fI55GA5Otmr77c08QFc=";
--- a/pkgs/by-name/nw/nwg-panel/package.nix
+++ b/pkgs/by-name/nw/nwg-panel/package.nix
@ -23,14 +23,14 @@

 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "nwg-panel";
-  version = "0.10.13";
+  version = "0.10.15";
  format = "setuptools";

  src = fetchFromGitHub {
    owner = "nwg-piotr";
    repo = "nwg-panel";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-TfE2RjbCBoHcdp9st+HeVhSfTMahZdQaItOIuT8Sxcc=";
+    hash = "sha256-zRoOsVnwn2DQctB9ZP0pAAnf9Ragd2RZGHZGN1KnMsQ=";
  };

  # No tests
--- a/pkgs/by-name/on/onnxruntime/package.nix
+++ b/pkgs/by-name/on/onnxruntime/package.nix
@ -25,6 +25,7 @@
  cudaSupport ? config.cudaSupport,
  ncclSupport ? cudaSupport && cudaPackages.nccl.meta.available,
  rocmSupport ? config.rocmSupport,
+  coremlSupport ? stdenv.hostPlatform.isDarwin,
  withFullProtobuf ? false,
  cudaPackages ? { },
  rocmPackages,
@ -80,6 +81,30 @@ let
    hash = "sha256-YqgzCyNywixebpHGx16tUuczmFS5pjCz5WjR89mv9eI=";
  };

+  coremltools-src = fetchFromGitHub {
+    name = "coremltools-src";
+    owner = "apple";
+    repo = "coremltools";
+    tag = "7.1";
+    hash = "sha256-kajQFHpl+4UK6fp+rM8TP0GiqIFYXPVFc2x1p19rBSw=";
+  };
+
+  fp16-src = fetchFromGitHub {
+    name = "fp16-src";
+    owner = "Maratyszcza";
+    repo = "FP16";
+    rev = "0a92994d729ff76a58f692d3028ca1b64b145d91";
+    hash = "sha256-m2d9bqZoGWzuUPGkd29MsrdscnJRtuIkLIMp3fMmtRY=";
+  };
+
+  psimd-src = fetchFromGitHub {
+    name = "psimd-src";
+    owner = "Maratyszcza";
+    repo = "psimd";
+    rev = "072586a71b55b7f8c584153d223e95687148a900";
+    hash = "sha256-lV+VZi2b4SQlRYrhKx9Dxc6HlDEFz3newvcBjTekupo=";
+  };
+
  isCudaJetson = cudaSupport && cudaPackages.flags.isJetsonBuild;
 in
 effectiveStdenv.mkDerivation (finalAttrs: {
@ -263,6 +288,7 @@ effectiveStdenv.mkDerivation (finalAttrs: {
    (lib.cmakeBool "onnxruntime_USE_CUDA" cudaSupport)
    (lib.cmakeBool "onnxruntime_USE_NCCL" (cudaSupport && ncclSupport))
    (lib.cmakeBool "onnxruntime_USE_MIGRAPHX" rocmSupport)
+    (lib.cmakeBool "onnxruntime_USE_COREML" coremlSupport)
    (lib.cmakeBool "onnxruntime_ENABLE_LTO" (!cudaSupport || cudaPackages.cudaOlder "12.8"))
  ]
  ++ lib.optionals pythonSupport [
@ -284,6 +310,12 @@ effectiveStdenv.mkDerivation (finalAttrs: {
    # Incompatible with packaged version, far too slow to build vendored version
    (lib.cmakeBool "onnxruntime_USE_COMPOSABLE_KERNEL" false)
    (lib.cmakeBool "onnxruntime_USE_COMPOSABLE_KERNEL_CK_TILE" false)
+  ]
+  ++ lib.optionals coremlSupport [
+    (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_COREMLTOOLS" "${coremltools-src}")
+    (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_FP16" "${fp16-src}")
+    (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_PSIMD" "${psimd-src}")
+    (lib.cmakeFeature "CMAKE_POLICY_VERSION_MINIMUM" "3.5") # needed for psimd
  ];

  env =
@ -314,6 +346,7 @@ effectiveStdenv.mkDerivation (finalAttrs: {
    !(
      cudaSupport
      || rocmSupport
+      || coremlSupport
      # cross-compiled test binaries can't execute on the build platform
      || (effectiveStdenv.hostPlatform != effectiveStdenv.buildPlatform)
      || builtins.elem effectiveStdenv.buildPlatform.system [
@ -337,7 +370,8 @@ effectiveStdenv.mkDerivation (finalAttrs: {
    install -m644 -Dt $out/include \
      ../include/onnxruntime/core/framework/provider_options.h \
      ../include/onnxruntime/core/providers/cpu/cpu_provider_factory.h \
-      ../include/onnxruntime/core/session/onnxruntime_*.h
+      ../include/onnxruntime/core/session/onnxruntime_*.h \
+      ../include/onnxruntime/core/providers/coreml/coreml_provider_factory.h
  '';

  # See comments in `cudaPackages.nccl`
--- a/pkgs/by-name/po/pokefinder/package.nix
+++ b/pkgs/by-name/po/pokefinder/package.nix
@ -13,13 +13,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "pokefinder";
-  version = "4.3.1";
+  version = "4.3.2";

  src = fetchFromGitHub {
    owner = "Admiral-Fish";
    repo = "PokeFinder";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-tItPvA0f2HnY7SUSnb7A5jGwbRs7eQoS4vibBomZ9pw=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-viObYX9W1bUzwGyf7rI1gQeB9OHlLfj5Uny0js/1f6M=";
    fetchSubmodules = true;
  };

@ -27,6 +27,32 @@ stdenv.mkDerivation (finalAttrs: {
    ./set-desktop-file-name.patch
  ];

+  postPatch = ''
+        substituteInPlace CMakeLists.txt \
+          --replace-fail 'set(CMAKE_OSX_ARCHITECTURES "x86_64;arm64")' ""
+        substituteInPlace Core/CMakeLists.txt \
+          --replace-fail 'if (APPLE)' 'if (FALSE)'
+        substituteInPlace Core/RNG/SHA1.cpp \
+          --replace-fail '#include "SHA1.hpp"' '#include "SHA1.hpp"
+    #include <algorithm>'
+
+        mkdir -p Core/Resources/compression
+        touch Core/Resources/compression/__init__.py
+        cat <<EOF > Core/Resources/compression/zstd.py
+    import zstandard as zstd
+
+    def compress(data, level=3):
+        cctx = zstd.ZstdCompressor(level=level)
+        return cctx.compress(data)
+
+    def decompress(data):
+        dctx = zstd.ZstdDecompressor()
+        return dctx.decompress(data)
+    EOF
+  '';
+
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isAarch "-flax-vector-conversions";
+
  installPhase = ''
    runHook preInstall
  ''
--- a/pkgs/by-name/po/portablemc/package.nix
+++ b/pkgs/by-name/po/portablemc/package.nix
@ -1,96 +1,136 @@
 {
  lib,
  stdenv,
-  python3Packages,
  fetchFromGitHub,
-  installShellFiles,
-  jre,

+  rustPlatform,
+  pkg-config,
+  openssl,
+
+  makeWrapper,
+
+  addDriverRunpath,
+  alsa-lib,
+  glfw3-minecraft,
+  libGL,
+  libjack2,
+  libpulseaudio,
  libx11,
-  libxext,
  libxcursor,
+  libxext,
  libxrandr,
  libxxf86vm,
-  libpulseaudio,
-  libGL,
-  glfw,
  openal,
+  pipewire,
  udev,
+  vulkan-loader,

  textToSpeechSupport ? stdenv.hostPlatform.isLinux,
  flite,
+
+  pciutils,
+  xrandr,
+
+  jdk25,
+  jdk21,
+  jdk17,
+  jdk8,
+
+  # can be overriden to reduce the closure size
+  jvms ? [
+    jdk25
+    jdk21
+    jdk17
+    jdk8
+  ],
+
+  additionalLibs ? [ ],
+  additionalPrograms ? [ ],
 }:

 let
  # Copied from the `prismlauncher` package
  runtimeLibs = [
-    # lwjgl
-    libGL
-    glfw
-    openal
    (lib.getLib stdenv.cc.cc)
-  ]
-  ++ lib.optionals stdenv.hostPlatform.isLinux [
+    ## native versions
+    glfw3-minecraft
+    openal
+
+    ## openal
+    alsa-lib
+    libjack2
+    libpulseaudio
+    pipewire
+
+    ## glfw
+    libGL
    libx11
-    libxext
    libxcursor
+    libxext
    libxrandr
    libxxf86vm

-    # lwjgl
-    libpulseaudio
+    udev # oshi

-    # oshi
-    udev
+    vulkan-loader # VulkanMod's lwjgl
  ]
-  ++ lib.optional textToSpeechSupport flite;
+  ++ lib.optional textToSpeechSupport flite
+  ++ additionalLibs;
+
+  # Copied from the `prismlauncher` package
+  runtimePrograms = [
+    pciutils # need lspci
+    xrandr # needed for LWJGL [2.9.2, 3) https://github.com/LWJGL/lwjgl/issues/128
+  ]
+  ++ additionalPrograms;
+
 in
-python3Packages.buildPythonApplication (finalAttrs: {
+stdenv.mkDerivation (finalAttrs: {
  pname = "portablemc";
-  version = "4.4.1";
-  pyproject = true;
+  version = "5.0.3";

  src = fetchFromGitHub {
    owner = "theorzr";
    repo = "portablemc";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-KE1qf6aIcDjwKzrdKDUmriWfAt+vuriew6ixHKm0xs8=";
+    hash = "sha256-P/ah7pwOdbgRDgpvhEDcNA1RiDzG2nYZCR13vzljLd8=";
  };

-  patches = [
-    # Use the jre package provided by nixpkgs by default
-    ./use-builtin-java.patch
-  ];
+  dontUnpack = true;

-  nativeBuildInputs = [ installShellFiles ];
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit (finalAttrs) pname version src;
+    hash = "sha256-Ub9XVc6gcu6fEiOheew9Uh3LqdaSzVKITboDTK+MQUI=";
+  };

-  build-system = [ python3Packages.poetry-core ];
+  unwrapped = rustPlatform.buildRustPackage {
+    name = "portablemc-${finalAttrs.version}-unwrapped";
+    inherit (finalAttrs) src cargoDeps;

-  dependencies = [ python3Packages.certifi ];
+    nativeBuildInputs = [ pkg-config ];

-  # Note: Tests use networking, so we don't run them
+    buildInputs = [ openssl ];
+  };

-  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
-    installShellCompletion --cmd portablemc \
-        --bash <($out/bin/portablemc show completion bash) \
-        --zsh <($out/bin/portablemc show completion zsh)
-  '';
+  strictDeps = true;
+  nativeBuildInputs = [ makeWrapper ];

-  preFixup = ''
-    makeWrapperArgs+=(
-      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath runtimeLibs}
-      --prefix PATH : ${lib.makeBinPath [ jre ]}
-    )
+  installPhase = ''
+    runHook preInstall
+
+    makeWrapper "$unwrapped/bin/portablemc" "$out/bin/portablemc" \
+      ${lib.optionalString stdenv.hostPlatform.isLinux ''
+        --prefix LD_LIBRARY_PATH : "${addDriverRunpath.driverLink}/lib:${lib.makeLibraryPath runtimeLibs}" \
+        --prefix PATH : "${lib.makeBinPath runtimePrograms}" \
+      ''} \
+      --prefix PATH : ${lib.makeBinPath jvms}
+
+    runHook postInstall
  '';

  meta = {
    homepage = "https://github.com/theorzr/portablemc";
-    description = "Fast, reliable and cross-platform command-line Minecraft launcher and API for developers";
-    longDescription = ''
-      A fast, reliable and cross-platform command-line Minecraft launcher and API for developers.
-      Including fast and easy installation of common mod loaders such as Fabric, Forge, NeoForge and Quilt.
-      This launcher is compatible with the standard Minecraft directories.
-    '';
+    description = "Cross platform command line utility for launching Minecraft quickly and reliably with included support for Mojang versions and popular mod loaders";
    changelog = "https://github.com/theorzr/portablemc/releases/tag/${finalAttrs.src.tag}";
    license = lib.licenses.gpl3Only;
    mainProgram = "portablemc";
--- a/pkgs/by-name/po/portablemc/use-builtin-java.patch
+++ b/pkgs/by-name/po/portablemc/use-builtin-java.patch
@ -1,47 +0,0 @@
-diff --git a/portablemc/standard.py b/portablemc/standard.py
-index f59c55d..0f017e1 100644
--- a/portablemc/standard.py
-+++ b/portablemc/standard.py
-@@ -843,6 +843,8 @@ class Version:
-         if jvm_major_version is not None and not isinstance(jvm_major_version, int):
-             raise ValueError("metadata: /javaVersion/majorVersion must be an integer")
- 
-+        return self._resolve_builtin_jvm(watcher, JvmNotFoundError.UNSUPPORTED_ARCH, jvm_major_version)
-+
-         if platform.system() == "Linux" and platform.libc_ver()[0] != "glibc":
-             return self._resolve_builtin_jvm(watcher, JvmNotFoundError.UNSUPPORTED_LIBC, jvm_major_version)
- 
-@@ -926,31 +928,10 @@ class Version:
-         builtin_path = shutil.which(jvm_bin_filename)
-         if builtin_path is None:
-             raise JvmNotFoundError(reason)
-        
-        try:
-            
-            # Get version of the JVM.
-            process = Popen([builtin_path, "-version"], bufsize=1, stdout=PIPE, stderr=STDOUT, universal_newlines=True)
-            stdout, _stderr = process.communicate(timeout=1)
-
-            version_start = stdout.index(f"1.{major_version}" if major_version <= 8 else str(major_version))
-            version = None
-            
-            # Parse version by getting all character that are numeric or '.'.
-            for i, ch in enumerate(stdout[version_start:]):
-                if not ch.isnumeric() and ch not in (".", "_"):
-                    version = stdout[version_start:i]
-                    break
-            
-            if version is None:
-                raise ValueError()
-
-        except (TimeoutExpired, ValueError):
-            raise JvmNotFoundError(JvmNotFoundError.BUILTIN_INVALID_VERSION)
- 
-         self._jvm_path = Path(builtin_path)
-        self._jvm_version = version
-        watcher.handle(JvmLoadedEvent(version, JvmLoadedEvent.BUILTIN))
-+        self._jvm_version = "nixpkgs"
-+        watcher.handle(JvmLoadedEvent("nixpkgs", JvmLoadedEvent.BUILTIN))
- 
-     def _download(self, watcher: Watcher) -> None:
-         
--- a/pkgs/by-name/pr/praat/package.nix
+++ b/pkgs/by-name/pr/praat/package.nix
@ -13,13 +13,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "praat";
-  version = "6.4.63";
+  version = "6.4.65";

  src = fetchFromGitHub {
    owner = "praat";
    repo = "praat.github.io";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-96fw5WRk1/zex65hcRdmx0wq2FTVett3FRDPhmsZr6g=";
+    hash = "sha256-v4cAFLSJllrNgTm6ewR40HYvdi8a1bZcEBz/BTdFsxA=";
  };

  strictDeps = true;
@ -44,9 +44,7 @@ stdenv.mkDerivation (finalAttrs: {
  configurePhase = ''
    runHook preConfigure

-    cp makefiles/makefile.defs.linux.pulse-gcc.${
-      if stdenv.hostPlatform.isLittleEndian then "LE" else "BE"
-    } makefile.defs
+    cp makefiles/makefile.defs.linux.pulse-gcc makefile.defs

    runHook postConfigure
  '';
--- a/pkgs/by-name/qu/qui/package.nix
+++ b/pkgs/by-name/qu/qui/package.nix
@ -6,7 +6,7 @@
  nixosTests,
  nix-update-script,
  nodejs,
-  pnpm_9,
+  pnpm_11,
  fetchPnpmDeps,
  pnpmConfigHook,
  typescript,
@ -14,12 +14,12 @@
 }:
 buildGo126Module (finalAttrs: {
  pname = "qui";
-  version = "1.18.0";
+  version = "1.19.0";
  src = fetchFromGitHub {
    owner = "autobrr";
    repo = "qui";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Rdg8fcoUY7WrNXj+LZyMXx6hFo8+OGrCLjhE3JD1y4o=";
+    hash = "sha256-h6GmxwOxqh88Zy7tFD/GFQ8NrpBcanFPBXGUmfoIe3I=";
  };

  qui-web = stdenvNoCC.mkDerivation (finalAttrs': {
@ -29,7 +29,7 @@ buildGo126Module (finalAttrs: {
    nativeBuildInputs = [
      nodejs
      pnpmConfigHook
-      pnpm_9
+      pnpm_11
      typescript
    ];

@ -42,9 +42,9 @@ buildGo126Module (finalAttrs: {
        src
        sourceRoot
        ;
-      pnpm = pnpm_9;
+      pnpm = pnpm_11;
      fetcherVersion = 3;
-      hash = "sha256-hCiIbVroyMhl2xT0WAGbmLSXfUH6RJHlC1g3isMlUJs=";
+      hash = "sha256-OEr5uyMnwP1TkSxRFNaopB9AAx2OVE7lNEzGyQwF6kc=";
    };

    postBuild = ''
@ -56,7 +56,7 @@ buildGo126Module (finalAttrs: {
    '';
  });

-  vendorHash = "sha256-7MzKE3pBvoW/ajB6gHtBBS1M/NuQsRw3ZSNtCJzrEyI=";
+  vendorHash = "sha256-pkktl+0dBSbUuxZ1ycTV0HZl/wO79LtmNaamyZ+Z9lY=";

  preBuild = ''
    cp -r ${finalAttrs.qui-web}/* web/dist
--- a/pkgs/by-name/qw/qwen-code/package.nix
+++ b/pkgs/by-name/qw/qwen-code/package.nix
@ -14,17 +14,17 @@

 buildNpmPackage (finalAttrs: {
  pname = "qwen-code";
-  version = "0.15.11";
+  version = "0.16.0";

  src = fetchFromGitHub {
    owner = "QwenLM";
    repo = "qwen-code";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-6ArEbnJOAKexoSy7Epis5OC8XYmmQpZPILtUEv4E0k4=";
+    hash = "sha256-XWhQ5GlAGW0WAyiPwBULLz1yQps2IdjVkusQ0a88tCs=";
  };

  npmDepsFetcherVersion = 3;
-  npmDepsHash = "sha256-J/dvHeC38uiZKgB6mGAnlCbAKXdai/mMzdP1E1Pa6Yg=";
+  npmDepsHash = "sha256-dRc+hTk5ELw0rJhT71heFnLjTmjN1UpIOHUMXKt4YwU=";

  # npm 11 incompatible with fetchNpmDeps
  # https://github.com/NixOS/nixpkgs/issues/474535
--- a/pkgs/by-name/ro/roave-backward-compatibility-check/package.nix
+++ b/pkgs/by-name/ro/roave-backward-compatibility-check/package.nix
@ -7,16 +7,16 @@

 php.buildComposerProject2 (finalAttrs: {
  pname = "roave-backward-compatibility-check";
-  version = "8.20.0";
+  version = "8.21.0";

  src = fetchFromGitHub {
    owner = "Roave";
    repo = "BackwardCompatibilityCheck";
    tag = finalAttrs.version;
-    hash = "sha256-skLTpDak2mgltZpDrNLQXw00omLW/xW5hBPNuX/noSc=";
+    hash = "sha256-kCs9lDvbhUacOH4bEAZjm2LzHSvJnVMR9lzmt00GgTw=";
  };

-  vendorHash = "sha256-v8Wv5BK9r3zYst1P0AcpkYCcl0iBvWt+UL2+fEF8Ahw=";
+  vendorHash = "sha256-68KE/ieWYST/jQMaaK5lLqBLEmI4YhYPOE4XuXNMfqM=";

  nativeInstallCheckInputs = [
    versionCheckHook
--- a/pkgs/by-name/rt/rtk/package.nix
+++ b/pkgs/by-name/rt/rtk/package.nix
@ -12,17 +12,17 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "rtk";
-  version = "0.40.0";
+  version = "0.41.0";
  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "rtk-ai";
    repo = "rtk";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-xWHIOZRpSyyOPQe/db9dxoODcnheBlpXrnKET010vVg=";
+    hash = "sha256-C8ns53qLpBdb5osdX68UBGMqM2Rs5UJyfal/iDns6a4=";
  };

-  cargoHash = "sha256-DJazpSx1FCt9pjFjqsoL3MLEQLdFvLwEj3UsP0aYHmc=";
+  cargoHash = "sha256-gDkXAiW8ajEpsEBb7KT9MO5fPEWyUqS+2ak34cipPdc=";

  nativeBuildInputs = [
    makeWrapper
--- a/pkgs/by-name/ru/ruff/package.nix
+++ b/pkgs/by-name/ru/ruff/package.nix
@ -16,7 +16,7 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "ruff";
-  version = "0.15.13";
+  version = "0.15.14";

  __structuredAttrs = true;

@ -24,12 +24,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
    owner = "astral-sh";
    repo = "ruff";
    tag = finalAttrs.version;
-    hash = "sha256-Sr5eD5aZP+1/wbRHQjampWbWea+rXshcwOfCr4JCvxA=";
+    hash = "sha256-Z8UhVS+YbYAxVWodU/I+p3Ns5/EpmzBTChcbkvJwe6Y=";
  };

  cargoBuildFlags = [ "--package=ruff" ];

-  cargoHash = "sha256-3y7kqhAUXZ+Ui6quGEDSRXrh3ii9NJLoFWnGX/Mp0l4=";
+  cargoHash = "sha256-GnRC5jXySAna7uAKPDtpPQUJe8AKqVSU+ynmGKZtfTs=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/by-name/sa/samrewritten/package.nix
+++ b/pkgs/by-name/sa/samrewritten/package.nix
@ -15,16 +15,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "samrewritten";
-  version = "1.2.3";
+  version = "1.3.4";

  src = fetchFromGitHub {
    owner = "PaulCombal";
    repo = "SamRewritten";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-UHq09i0f7tLgAMIEA+GrLqKxzdsFmUrp3iIGAM+MXJ0=";
+    hash = "sha256-5SXek64kccyUs+vSyA8QCX+UpRSm0aDEZwULYZgmIUw=";
  };

-  cargoHash = "sha256-jPCF+wIb+DESph5dtF80NV7ydxWm09BQyf4eO2BKmNI=";
+  cargoHash = "sha256-sL6kIkYWnD7QKw/RGMDS9ZZK/LcKtYjFr5pQ6758IuQ=";

  # Tests require network access and a running Steam client. Skipping.
  doCheck = false;
--- a/pkgs/by-name/sh/sherpa-onnx/package.nix
+++ b/pkgs/by-name/sh/sherpa-onnx/package.nix
@ -191,6 +191,10 @@ stdenv.mkDerivation (finalAttrs: {

  doCheck = true;

+  preCheck = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    export DYLD_FALLBACK_LIBRARY_PATH=${lib.getLib onnxruntime}/lib
+  '';
+
  # Use ctest directly because the default `make check` target includes clang-tidy.
  checkPhase = ''
    runHook preCheck
@ -202,6 +206,10 @@ stdenv.mkDerivation (finalAttrs: {
    mkdir -p $python
    cp -r ../sherpa-onnx/python/sherpa_onnx $python/
    rm $out/lib/_sherpa_onnx*.so
+    ${lib.optionalString stdenv.hostPlatform.isDarwin ''
+      install_name_tool -add_rpath ${lib.getLib onnxruntime}/lib \
+        $python/sherpa_onnx/lib/_sherpa_onnx*.so
+    ''}
  '';

  passthru = {
--- a/pkgs/by-name/sn/sngrep/fix-sng_strncpy-declaration.patch
+++ b/pkgs/by-name/sn/sngrep/fix-sng_strncpy-declaration.patch
@ -0,0 +1,15 @@
+--- a/src/util.h
+++ b/src/util.h
+@@ -58,6 +58,12 @@
+ char *
+ sng_basename(const char *name);
+ 
+/**
+ * @brief Wrapper for strncpy
+ */
+char *
+sng_strncpy(char *dst, const char *src, size_t len);
+
+ /**
+  * @brief Compare two timeval structures
+  *
--- a/pkgs/by-name/sn/sngrep/package.nix
+++ b/pkgs/by-name/sn/sngrep/package.nix
@ -4,32 +4,35 @@
  autoconf,
  automake,
  fetchFromGitHub,
+  libgcrypt,
  libpcap,
  ncurses,
  openssl,
  pcre,
+  pkg-config,
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "sngrep";
-  version = "1.8.2";
+  version = "1.8.3";

  src = fetchFromGitHub {
    owner = "irontec";
    repo = "sngrep";
    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-nvuT//FWJAa6DzmjBsBW9s2p1M+6Zs4cVmpK4dVemnE=";
+    hash = "sha256-4DLbQ3OOMvJw37n3jVuztG49HlPbWrfxByi6g6AvELQ=";
  };

  nativeBuildInputs = [
    autoconf
    automake
+    pkg-config
  ];

  buildInputs = [
+    libgcrypt
    libpcap
    ncurses
-    ncurses
    openssl
    pcre
  ];
@ -42,6 +45,10 @@ stdenv.mkDerivation (finalAttrs: {
    "--with-openssl"
  ];

+  patches = [
+    ./fix-sng_strncpy-declaration.patch
+  ];
+
  preConfigure = ''
    ./bootstrap.sh
  '';
--- a/pkgs/by-name/so/solanum/package.nix
+++ b/pkgs/by-name/so/solanum/package.nix
@ -26,13 +26,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "solanum";
-  version = "0-unstable-2026-05-13";
+  version = "0-unstable-2026-05-23";

  src = fetchFromGitHub {
    owner = "solanum-ircd";
    repo = "solanum";
-    rev = "8cbf75cc728f99224fe0f2fa86689db07a317ea9";
-    hash = "sha256-6+EkYOgiQo6mD7O7Id74WTRJ4FtBie1/i+SBj+g7su8=";
+    rev = "dfe6757a577109d2180465da6270b5a6bc08f8d7";
+    hash = "sha256-ngg/0HPZeCYodIWt8p9zpCj6hQMiVoc9E2cm/87eE8k=";
  };

  postPatch = ''
--- a/pkgs/by-name/sp/speedify/package.nix
+++ b/pkgs/by-name/sp/speedify/package.nix
@ -3,17 +3,18 @@
  stdenv,
  dpkg,
  fetchurl,
-  procps,
-  net-tools,
+  libgcc,
+  libnetfilter_conntrack,
  autoPatchelfHook,
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "speedify";
-  version = "15.8.2-12611";
+  # Find latest version within https://apt.connectify.me/dists/speedify/main/binary-amd64/Packages.gz
+  version = "16.7.0-12928";

  src = fetchurl {
    url = "https://apt.connectify.me/pool/main/s/speedify/speedify_${finalAttrs.version}_amd64.deb";
-    hash = "sha256-61GQZkXBe3EQpOUODpL60SCHJO0FGqvpL9xFn+q+kPs=";
+    hash = "sha256-A77LYBGLAgoRFV64/ZmpTL76NQx6xHq0a7leDYi9Izg=";
  };

  nativeBuildInputs = [
@ -22,8 +23,8 @@ stdenv.mkDerivation (finalAttrs: {
  ];

  buildInputs = [
-    procps
-    net-tools
+    libgcc
+    libnetfilter_conntrack
  ];

  installPhase = ''
--- a/pkgs/by-name/st/starlark/package.nix
+++ b/pkgs/by-name/st/starlark/package.nix
@ -6,13 +6,13 @@
 }:
 buildGoModule {
  pname = "starlark";
-  version = "0-unstable-2026-03-26";
+  version = "0-unstable-2026-05-22";

  src = fetchFromGitHub {
    owner = "google";
    repo = "starlark-go";
-    rev = "fadfc96def35ea95e7f2bd9952256d4db1d80d91";
-    hash = "sha256-t+7QUORMlRCA1lLhekPrR3ag7hmX++DrSOBQunTMLFM=";
+    rev = "ec58d4b459e2866ed51124596d888ed7aa4f90b8";
+    hash = "sha256-9H0TIp2CIGo5Rqld9Xvsg/uQmfswiUzSsu7vwazjcho=";
  };

  vendorHash = "sha256-Ejw5f5ulEcLHm4WYKatwA7FZ9lfdqZTOE3SdkaK6jYE=";
--- a/pkgs/by-name/st/streamcontroller/package.nix
+++ b/pkgs/by-name/st/streamcontroller/package.nix
@ -18,19 +18,19 @@
 }:
 let
  # We have to hardcode revision because upstream often create multiple releases for the same version number.
-  # This is the commit hash that maps to 1.5.0-beta.13 released on 2025-12-30
-  rev = "359de976eb23120d6e6a2d31104e15b37d1edfeb";
+  # This is the commit hash that maps to 1.5.0-beta.14 released on 2026-5-21
+  rev = "12052dec15d0e0948032c7ec11eff2da0d109106";
 in
 stdenv.mkDerivation {
  pname = "streamcontroller";

-  version = "1.5.0-beta.13";
+  version = "1.5.0-beta.14";

  src = fetchFromGitHub {
    repo = "StreamController";
    owner = "StreamController";
    inherit rev;
-    hash = "sha256-b5tRhXEQGRhaJd1Q/hlmqUTO+0F+3+lziYSi8QpUa9c=";
+    hash = "sha256-JGJc7bj58oZwvtExSv+tv7Ug84RYdEkcMBI3ZmqpaKY=";
  };

  # The installation method documented upstream
@ -200,7 +200,7 @@ stdenv.mkDerivation {

  meta = {
    description = "Elegant Linux app for the Elgato Stream Deck with support for plugins";
-    homepage = "https://core447.com/";
+    homepage = "https://streamcontroller.core447.com/";
    license = lib.licenses.gpl3;
    mainProgram = "streamcontroller";
    maintainers = with lib.maintainers; [ sifmelcara ];
--- a/pkgs/by-name/up/updatecli/package.nix
+++ b/pkgs/by-name/up/updatecli/package.nix
@ -12,16 +12,17 @@

 buildGoModule (finalAttrs: {
  pname = "updatecli";
-  version = "0.116.3";
+  version = "0.117.0";

  src = fetchFromGitHub {
    owner = "updatecli";
    repo = "updatecli";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-5dJfbw0xoB34XuCym/TcqwdeUORZezfJNu7Plt82VPM=";
+    hash = "sha256-9nA+sOlcIm5Try0oag1Oz/ALPDaMag0jZKzHrS0Brf8=";
  };

-  vendorHash = "sha256-cMXepPUJoJGRlQSRSByA2/pjsQXfyH8Va320CywxxDw=";
+  proxyVendor = true;
+  vendorHash = "sha256-8WPwZjoDbRDi1IbjdZ40796JA5PRh8T75wRlWgTF7dI=";

  # tests require network access
  doCheck = false;
--- a/pkgs/by-name/uv/uv/package.nix
+++ b/pkgs/by-name/uv/uv/package.nix
@ -18,17 +18,17 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "uv";
-  version = "0.11.15";
+  version = "0.11.16";
  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "astral-sh";
    repo = "uv";
    tag = finalAttrs.version;
-    hash = "sha256-Nwf7DSxXG5F515LW19q+2VpXtdVLUWx2sMQr35lvsgk=";
+    hash = "sha256-5LJspcHj/RjOMv7eRB7n+tofX4s51M3kqHCPymCg90A=";
  };

-  cargoHash = "sha256-PWkDAl6jkpZBz19mz4ZQmiA/RvgFC0KOftXQtZ0SFdk=";
+  cargoHash = "sha256-2lg86WxPGVbJ91zi61lKrSqnzFgmmSrBrl+SfV5SJWU=";

  buildInputs = [
    rust-jemalloc-sys
--- a/pkgs/by-name/wc/wcslib/package.nix
+++ b/pkgs/by-name/wc/wcslib/package.nix
@ -7,11 +7,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "wcslib";
-  version = "8.7";
+  version = "8.8";

  src = fetchurl {
    url = "ftp://ftp.atnf.csiro.au/pub/software/wcslib/wcslib-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-eS/gXAlURDOppOpUgPrNvsLabSgFgnW16QBqHyjFZGU=";
+    hash = "sha256-3NW5UuaAFtDiRZ4fD5hmND54uTljXbZEKfz0eOHqS/w=";
  };

  # error: call to undeclared library function 'snprintf'
--- a/pkgs/by-name/wg/wgsl-analyzer/package.nix
+++ b/pkgs/by-name/wg/wgsl-analyzer/package.nix
@ -7,16 +7,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "wgsl-analyzer";
-  version = "2026-03-13";
+  version = "2026-04-26";

  src = fetchFromGitHub {
    owner = "wgsl-analyzer";
    repo = "wgsl-analyzer";
    tag = finalAttrs.version;
-    hash = "sha256-a1H/QJhLdBiwjqiG3icsKrSMz079yBjdBKffGANgdTQ=";
+    hash = "sha256-OmXuUqkoLYs4R6Bb0oguiC3oG0C+F0Vy3X8DTNnlFYU=";
  };

-  cargoHash = "sha256-UM8oEg8gpsq9lnoDpeArGTl36EE7Tn6YMHXEIagVGvI=";
+  cargoHash = "sha256-fWgpzuo9+VfG3/mf2Bpfc9ZuzpL9Cap0BkXLyuBaq+s=";

  checkFlags = [
    # Imports failures
--- a/pkgs/by-name/wh/whatsapp-for-mac/package.nix
+++ b/pkgs/by-name/wh/whatsapp-for-mac/package.nix
@ -10,13 +10,13 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "whatsapp-for-mac";
-  version = "2.26.10.18";
+  version = "2.26.19.17";

  src = fetchzip {
    extension = "zip";
    name = "WhatsApp.app";
    url = "https://web.whatsapp.com/desktop/mac_native/release/?version=${finalAttrs.version}&extension=zip&configuration=Release&branch=master";
-    hash = "sha256-cQB2AF/emNHtSpf1DrjCV+yds8kbD2Lv9UTkAo7CZlM=";
+    hash = "sha256-jR8Hi4IWSfPvCthe/zH6mACQYQsGLcBmj2m8vwXX8Do=";
  };

  dontConfigure = true;
--- a/pkgs/by-name/xq/xqilla/package.nix
+++ b/pkgs/by-name/xq/xqilla/package.nix
@ -12,7 +12,7 @@ stdenv.mkDerivation (finalAttrs: {

  src = fetchurl {
    url = "mirror://sourceforge/xqilla/XQilla-${finalAttrs.version}.tar.gz";
-    sha256 = "0m9z7diw7pdyb4qycbqyr2x55s13v8310xsi7yz0inpw27q4vzdd";
+    hash = "sha256-KSYxeRYx/i5+uXJzdzNQY6SPEmEdZB0Clml+DAdZAus=";
  };

  patches = [
@ -29,6 +29,8 @@ stdenv.mkDerivation (finalAttrs: {
    "CXXFLAGS=-std=c++14"
  ];

+  enableParallelBuilding = true;
+
  buildInputs = [
    xercesc
  ];
--- a/pkgs/development/octave-modules/datatypes/default.nix
+++ b/pkgs/development/octave-modules/datatypes/default.nix
@ -7,13 +7,13 @@

 buildOctavePackage rec {
  pname = "datatypes";
-  version = "1.2.2";
+  version = "1.2.3";

  src = fetchFromGitHub {
    owner = "pr0m1th3as";
    repo = "datatypes";
    tag = "release-${version}";
-    sha256 = "sha256-qgFYyRMrdWhbHBvOEsDAetpllr5yyhtoEB+7Ri6zbSI=";
+    sha256 = "sha256-WyuL1xDRw4QPouJbJ8op8mh2fLOBfPLUnp4syKmyYLE=";
  };

  passthru.updateScript = nix-update-script { extraArgs = [ "--version-regex=release-(.*)" ]; };
--- a/pkgs/development/python-modules/aiolyric/default.nix
+++ b/pkgs/development/python-modules/aiolyric/default.nix
@ -4,7 +4,7 @@
  aioresponses,
  buildPythonPackage,
  fetchFromGitHub,
-  incremental,
+  packaging,
  pytest-asyncio,
  pytestCheckHook,
  setuptools,
@ -12,24 +12,27 @@

 buildPythonPackage (finalAttrs: {
  pname = "aiolyric";
-  version = "2.1.0";
+  version = "2.1.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "timmo001";
    repo = "aiolyric";
    tag = finalAttrs.version;
-    hash = "sha256-kLsq1pBRWz49DZgX47k132OipDcfn+kby6/GYDL3pPc=";
+    hash = "sha256-+OYMe63sX5TtvJpNn6dzvnephlhS/MyFXmUerYZqF5A=";
  };

  build-system = [
-    incremental
    setuptools
  ];

+  pythonRelaxDeps = [
+    "packaging"
+  ];
+
  dependencies = [
    aiohttp
-    incremental
+    packaging
  ];

  nativeCheckInputs = [
--- a/pkgs/development/python-modules/ansible/core.nix
+++ b/pkgs/development/python-modules/ansible/core.nix
@ -32,7 +32,7 @@

 buildPythonPackage (finalAttrs: {
  pname = "ansible-core";
-  version = "2.20.5";
+  version = "2.21.0";
  pyproject = true;

  disabled = pythonOlder "3.12";
@ -41,7 +41,7 @@ buildPythonPackage (finalAttrs: {
    owner = "ansible";
    repo = "ansible";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-AU6LTKqtBMW2s+0a0HsMrkXDqaWbcEqbtG3dp/5bQOA=";
+    hash = "sha256-I0XEEGyTMQMpGTApbzVzHRuRAALl+C28GfpW4CeeTIA=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/azure-mgmt-cognitiveservices/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-cognitiveservices/default.nix
@ -12,13 +12,13 @@

 buildPythonPackage rec {
  pname = "azure-mgmt-cognitiveservices";
-  version = "14.1.0";
+  version = "15.0.0b1";
  pyproject = true;

  src = fetchPypi {
    pname = "azure_mgmt_cognitiveservices";
    inherit version;
-    hash = "sha256-kVGRN00K20Q4Y8IKrqLJ87nVWKhJrCt48VIkkmL9yvg=";
+    hash = "sha256-3ydbAI1IkiIuwnQbd6829kZv9IgFkqTFwG155l58JFQ=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/azure-mgmt-containerservice/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-containerservice/default.nix
@ -10,13 +10,13 @@

 buildPythonPackage rec {
  pname = "azure-mgmt-containerservice";
-  version = "41.0.0";
+  version = "41.1.0";
  pyproject = true;

  src = fetchPypi {
    pname = "azure_mgmt_containerservice";
    inherit version;
-    hash = "sha256-mDDQpCcwYJyXoTOpE+LK/70WPU0/8xWvw6dnKCIqP2E=";
+    hash = "sha256-fssuY+hzZgEv2nwT02uv9qKqWZ/GeSUqKWB2M+0YbKg=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/bayesian-optimization/default.nix
+++ b/pkgs/development/python-modules/bayesian-optimization/default.nix
@ -24,14 +24,14 @@

 buildPythonPackage rec {
  pname = "bayesian-optimization";
-  version = "3.2.1";
+  version = "3.2.2";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "bayesian-optimization";
    repo = "BayesianOptimization";
    tag = "v${version}";
-    hash = "sha256-pTtwuBQUdVsi98nndEyY9mawGiTwjgiD05EsQwQFiPo=";
+    hash = "sha256-w1L4W99OaNknFtdsdkjJXsdOCmjtYvOG7Iy9z9EXFf0=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/cadwyn/default.nix
+++ b/pkgs/development/python-modules/cadwyn/default.nix
@ -27,14 +27,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "cadwyn";
-  version = "6.2.0";
+  version = "6.2.2";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "zmievsa";
    repo = "cadwyn";
    tag = finalAttrs.version;
-    hash = "sha256-vkW3ZSIRuIDVQCHMsZrBEs+VBW55kn0dE2nMXqL5XmU=";
+    hash = "sha256-IM/7IF3zQHaJWlMmG3el9x4/BOFTXYUmJq4gRLP4gVs=";
  };

  disabled = pythonAtLeast "3.14";
--- a/pkgs/development/python-modules/clickhouse-cityhash/default.nix
+++ b/pkgs/development/python-modules/clickhouse-cityhash/default.nix
@ -32,6 +32,11 @@ buildPythonPackage rec {
    })
  ];

+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail "Cython>=3.0,<3.1" "Cython>=3.0"
+  '';
+
  doCheck = false;

  pythonImportsCheck = [ "clickhouse_cityhash" ];
@ -39,7 +44,7 @@ buildPythonPackage rec {
  meta = {
    description = "Python-bindings for CityHash, a fast non-cryptographic hash algorithm";
    homepage = "https://github.com/xzkostyan/python-cityhash";
-    license = lib.licenses.upl;
+    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ breakds ];
  };
 }
--- a/pkgs/development/python-modules/django-mailman3/default.nix
+++ b/pkgs/development/python-modules/django-mailman3/default.nix
@ -41,6 +41,18 @@ buildPythonPackage rec {
      ];
      hash = "sha256-gSFczuNLlMclqixOu6ElS0BewUTGyhP6RXtE/waLzyo=";
    })
+
+    (fetchpatch {
+      # Only needed so the next one applies.
+      name = "allauth-64-1.patch";
+      url = "https://gitlab.com/mailman/django-mailman3/-/commit/96f3f3bf0c718395ccd1b0d539a40d627522a9c4.patch";
+      hash = "sha256-xgQu70DkbPz+ULRFgKeJTbx/Tq2PLEyGgrncf26ChA4=";
+    })
+    (fetchpatch {
+      name = "allauth-64-2.patch";
+      url = "https://gitlab.com/mailman/django-mailman3/-/commit/cfdacb9195ce266e5ae23307b31304898369f696.patch";
+      hash = "sha256-6mwGSw31Q0+APwdGFe0JE0gBigdo453HZZ6JApqgtTE=";
+    })
  ];

  pythonRelaxDeps = [ "django-allauth" ];
@ -77,7 +89,6 @@ buildPythonPackage rec {
    homepage = "https://gitlab.com/mailman/django-mailman3";
    license = lib.licenses.gpl3Plus;
    maintainers = with lib.maintainers; [ qyliss ];
-    broken =
-      lib.versionAtLeast django-allauth.version "65.0.0" || lib.versionAtLeast django.version "5.3";
+    broken = lib.versionAtLeast django.version "5.3";
  };
 }
--- a/pkgs/development/python-modules/duct-py/default.nix
+++ b/pkgs/development/python-modules/duct-py/default.nix
@ -2,13 +2,15 @@
  lib,
  buildPythonPackage,
  fetchFromGitHub,
+  hatchling,
  pytestCheckHook,
+  ps,
 }:

 buildPythonPackage rec {
  pname = "duct-py";
  version = "1.0.1";
-  format = "setuptools";
+  pyproject = true;

  src = fetchFromGitHub {
    owner = "oconnor663";
@ -17,9 +19,14 @@ buildPythonPackage rec {
    hash = "sha256-i811nQB8CVJPYPR0Jdzpk64EXxrTMDIBpdDoUs9Xu/k=";
  };

+  build-system = [ hatchling ];
+
  pythonImportsCheck = [ "duct" ];

-  nativeCheckInputs = [ pytestCheckHook ];
+  nativeCheckInputs = [
+    pytestCheckHook
+    ps
+  ];

  disabledTests = [
    # This test completely empties the environment then tries to run a Python command.
--- a/pkgs/development/python-modules/flufl/lock.nix
+++ b/pkgs/development/python-modules/flufl/lock.nix
@ -12,13 +12,13 @@

 buildPythonPackage rec {
  pname = "flufl-lock";
-  version = "8.2.0";
+  version = "9.1.0";
  pyproject = true;

  src = fetchPypi {
    pname = "flufl_lock";
    inherit version;
-    hash = "sha256-FbMzw1+rGjayI4QAVyWK60zXnw+6+CwUTyPN9s8U1eM=";
+    hash = "sha256-jXPIjKt8mLeSZxApnBFivsfOJT+bnF8KLKgDf58kAjQ=";
  };

  build-system = [ hatchling ];
--- a/pkgs/development/python-modules/gguf/default.nix
+++ b/pkgs/development/python-modules/gguf/default.nix
@ -20,14 +20,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "gguf";
-  version = "9101";
+  version = "9222";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "ggml-org";
    repo = "llama.cpp";
    tag = "b${finalAttrs.version}";
-    hash = "sha256-dQ0KsUsiTYJXtWuU16yTbHiyWCspw5WofQVjvrY2OVc=";
+    hash = "sha256-LIGtXaO53Y3Ze0x6uevb2vzcKHbyj2o/8ZHvyZ22uo4=";
  };

  sourceRoot = "${finalAttrs.src.name}/gguf-py";
--- a/pkgs/development/python-modules/ha-garmin/default.nix
+++ b/pkgs/development/python-modules/ha-garmin/default.nix
@ -12,14 +12,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "ha-garmin";
-  version = "0.1.22";
+  version = "0.1.23";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "cyberjunky";
    repo = "ha-garmin";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-q5bNa6HT2GeqdElsSG7Rgk3a14GsjGyLkHWVrg3CTYs=";
+    hash = "sha256-0x7+pABt0i9QFty/i8IeU2CLmDUQiw16pYZ1Wr7CARI=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/jedi-language-server/default.nix
+++ b/pkgs/development/python-modules/jedi-language-server/default.nix
@ -37,6 +37,10 @@ buildPythonPackage rec {
    poetry-core
  ];

+  pythonRelaxDeps = [
+    "jedi"
+  ];
+
  dependencies = [
    docstring-to-markdown
    jedi
--- a/pkgs/development/python-modules/langgraph-checkpoint-mongodb/default.nix
+++ b/pkgs/development/python-modules/langgraph-checkpoint-mongodb/default.nix
@ -15,14 +15,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "langgraph-checkpoint-mongodb";
-  version = "0.3.1";
+  version = "0.4.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "langchain-ai";
    repo = "langchain-mongodb";
    tag = "libs/langgraph-checkpoint-mongodb/v${finalAttrs.version}";
-    hash = "sha256-vCiZ6Mp6aHmSEkLbeM6qTLJaxH0uoAdq80olTT5saX0=";
+    hash = "sha256-AdTAyMHNzkuvNB7DsbWxAxNKNqSxdgYwIB5UHBAAxZc=";
  };

  sourceRoot = "${finalAttrs.src.name}/libs/langgraph-checkpoint-mongodb";
--- a/pkgs/development/python-modules/langgraph-runtime-inmem/default.nix
+++ b/pkgs/development/python-modules/langgraph-runtime-inmem/default.nix
@ -14,14 +14,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "langgraph-runtime-inmem";
-  version = "0.28.0";
+  version = "0.28.1";
  pyproject = true;

  # Not available in any repository
  src = fetchPypi {
    pname = "langgraph_runtime_inmem";
    inherit (finalAttrs) version;
-    hash = "sha256-4CU2UItcFU8YokJAZjr3wjifQ8tPu6yZWicXtM/kDS8=";
+    hash = "sha256-lFfLJVVN9psEruTfnaEXLNH6e8nLWQqegH8vnkXsjr0=";
  };

  build-system = [ hatchling ];
--- a/pkgs/development/python-modules/langgraph-store-mongodb/default.nix
+++ b/pkgs/development/python-modules/langgraph-store-mongodb/default.nix
@ -14,14 +14,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "langgraph-store-mongodb";
-  version = "0.2.0";
+  version = "0.3.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "langchain-ai";
    repo = "langchain-mongodb";
    tag = "libs/langgraph-store-mongodb/v${finalAttrs.version}";
-    hash = "sha256-IXISxo3mC0/FkjGdHTmin6z/fk71ecto+L+VZ6VFdeE=";
+    hash = "sha256-uivrfCTUu7Pq/ncAGH6HUzgyOGRcOzsQ+SVN6wW33tQ=";
  };

  sourceRoot = "${finalAttrs.src.name}/libs/langgraph-store-mongodb";
--- a/pkgs/development/python-modules/llfuse/default.nix
+++ b/pkgs/development/python-modules/llfuse/default.nix
@ -1,67 +0,0 @@
-{
-  lib,
-  stdenv,
-  buildPythonPackage,
-  fetchFromGitHub,
-  cython,
-  fuse,
-  pkg-config,
-  pytestCheckHook,
-  python,
-  setuptools,
-  which,
-}:
-
-buildPythonPackage rec {
-  pname = "llfuse";
-  version = "1.5.2";
-
-  pyproject = true;
-
-  src = fetchFromGitHub {
-    owner = "python-llfuse";
-    repo = "python-llfuse";
-    tag = "release-${version}";
-    hash = "sha256-PFnY+gmm1tjZhptc27XTE9yxF0IaJ+U4Ng/OGhNDDPI=";
-  };
-
-  nativeBuildInputs = [
-    cython
-    pkg-config
-    setuptools
-  ];
-
-  buildInputs = [ fuse ];
-
-  preConfigure = ''
-    substituteInPlace setup.py \
-        --replace "'pkg-config'" "'${stdenv.cc.targetPrefix}pkg-config'"
-  '';
-
-  preBuild = ''
-    ${python.pythonOnBuildForHost.interpreter} setup.py build_cython
-  '';
-
-  # On Darwin, the test requires macFUSE to be installed outside of Nix.
-  doCheck = !stdenv.hostPlatform.isDarwin;
-  nativeCheckInputs = [
-    pytestCheckHook
-    which
-  ];
-
-  disabledTests = [
-    "test_listdir" # accesses /usr/bin
-  ];
-
-  meta = {
-    description = "Python bindings for the low-level FUSE API";
-    homepage = "https://github.com/python-llfuse/python-llfuse";
-    changelog = "https://github.com/python-llfuse/python-llfuse/raw/release-${src.tag}/Changes.rst";
-    license = lib.licenses.lgpl2Plus;
-    platforms = lib.platforms.unix;
-    maintainers = with lib.maintainers; [
-      bjornfor
-      dotlambda
-    ];
-  };
-}
--- a/pkgs/development/python-modules/nengo/default.nix
+++ b/pkgs/development/python-modules/nengo/default.nix
@ -10,21 +10,21 @@
  scikit-learn,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "nengo";
-  version = "4.0.0";
+  version = "4.1.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "nengo";
    repo = "nengo";
-    tag = "v${version}";
-    sha256 = "sha256-b9mPjKdewIqIeRrddV1/M3bghSyox7Lz6VbfSLCHZjA=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-yZDnttXU5qMmQwFESkhQb06BXcqPEiPYl54azS5b284=";
  };

-  nativeBuildInputs = [ setuptools ];
+  build-system = [ setuptools ];

-  propagatedBuildInputs = [
+  dependencies = [
    numpy
  ]
  ++ lib.optionals scipySupport [ scipy ]
@ -41,7 +41,7 @@ buildPythonPackage rec {
  meta = {
    description = "Python library for creating and simulating large-scale brain models";
    homepage = "https://nengo.ai/";
-    license = lib.licenses.unfreeRedistributable;
+    license = lib.licenses.gpl2Only;
    maintainers = [ ];
  };
-}
+})
--- a/pkgs/development/python-modules/nextcord/default.nix
+++ b/pkgs/development/python-modules/nextcord/default.nix
@ -21,7 +21,7 @@

 buildPythonPackage rec {
  pname = "nextcord";
-  version = "3.1.1";
+  version = "3.2.0";
  pyproject = true;

  disabled = pythonOlder "3.12";
@ -30,7 +30,7 @@ buildPythonPackage rec {
    owner = "nextcord";
    repo = "nextcord";
    tag = "v${version}";
-    hash = "sha256-ex6amnB51Jla5ia2HVaMOZsDOEtgJ8RB1eNTLpXNzSY=";
+    hash = "sha256-4/3RM32kEYt5J4bL7/SsPvKhnT1eGS3o0+9lNMqbSj8=";
  };

  patches = [
--- a/pkgs/development/python-modules/nodriver/default.nix
+++ b/pkgs/development/python-modules/nodriver/default.nix
@ -10,12 +10,12 @@

 buildPythonPackage rec {
  pname = "nodriver";
-  version = "0.48.1";
+  version = "0.50.3";
  pyproject = true;

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-SsjNiLavEzwm3BV/t49asXRipZtKDaMwTjrxK75LQ0M=";
+    hash = "sha256-JMpojYZG74/61cjOZYBOXnZxp3mtJqJNdvZGXVZmxjE=";
  };

  patches = [
--- a/pkgs/development/python-modules/pycyphal/default.nix
+++ b/pkgs/development/python-modules/pycyphal/default.nix
@ -95,6 +95,13 @@ buildPythonPackage rec {
    "pycyphal/application/register/_value.py"
  ];

+  disabledTests = lib.optionals (pythonAtLeast "3.14") [
+    # leaked tasks from prior doctest's event loop break doctest stdout capture, causing "Got nothing" on REPL-style assertions
+    "MonotonicClusteringSynchronizer"
+    "TransferIDSynchronizer"
+    "PythonCANMedia"
+  ];
+
  pythonImportsCheck = [ "pycyphal" ];

  meta = {
--- a/pkgs/development/python-modules/python-backoff/default.nix
+++ b/pkgs/development/python-modules/python-backoff/default.nix
@ -0,0 +1,42 @@
+{
+  buildPythonPackage,
+  fetchFromGitHub,
+  hatchling,
+  lib,
+  pytest-asyncio,
+  pytestCheckHook,
+  requests,
+  responses,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "python-backoff";
+  version = "2.3.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "python-backoff";
+    repo = "backoff";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Os20Gz+uWaEdUPPF9/tT7LNxbmN0W/tuzVZa3H+ZG2A=";
+  };
+
+  build-system = [ hatchling ];
+
+  pythonImportsCheck = [ "backoff" ];
+
+  nativeCheckInputs = [
+    pytest-asyncio
+    pytestCheckHook
+    requests
+    responses
+  ];
+
+  meta = {
+    changelog = "https://github.com/python-backoff/backoff/blob/${finalAttrs.src.tag}/CHANGELOG.md";
+    description = "Python library providing function decorators for configurable backoff and retry";
+    homepage = "https://github.com/python-backoff/backoff";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.dotlambda ];
+  };
+})
--- a/pkgs/development/python-modules/python-roborock/default.nix
+++ b/pkgs/development/python-modules/python-roborock/default.nix
@ -24,14 +24,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "python-roborock";
-  version = "5.5.1";
+  version = "5.12.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "Python-roborock";
    repo = "python-roborock";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-2ShXt2mtMhMugzqOHhY1GT7cQ0K78k/4/bPmmP/uheI=";
+    hash = "sha256-v4hONQ3EmpenjnAVKm8YMrynVyxtduefN5oqGW9MoE0=";
  };

  pythonRelaxDeps = [
--- a/pkgs/development/python-modules/renault-api/default.nix
+++ b/pkgs/development/python-modules/renault-api/default.nix
@ -19,14 +19,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "renault-api";
-  version = "0.5.8";
+  version = "0.5.10";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "hacf-fr";
    repo = "renault-api";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-/ZvMrEe3qgtMpg49OLZH1YTXQKSGR8e3yaShghnyMv4=";
+    hash = "sha256-1ym2xDJo8Ax76jC7rvVYI+EADKkdjGiKKvtiyE/rk/4=";
  };

  build-system = [ poetry-core ];
--- a/pkgs/development/python-modules/sigrok/default.nix
+++ b/pkgs/development/python-modules/sigrok/default.nix
@ -25,6 +25,14 @@ toPythonModule (
      ./python-install.patch
    ];

+    postPatch = ''
+      ${orig.postPatch or ""}
+
+      # %init block lands in SWIG_mod_exec (returns int) under swig >= 4.4.
+      substituteInPlace bindings/python/sigrok/core/classes.i \
+        --replace-fail 'return nullptr;' 'return -1;'
+    '';
+
    nativeBuildInputs =
      orig.nativeBuildInputs or [ ]
      ++ [
--- a/pkgs/development/python-modules/uncompyle6/default.nix
+++ b/pkgs/development/python-modules/uncompyle6/default.nix
@ -2,6 +2,7 @@
  lib,
  buildPythonPackage,
  fetchPypi,
+  fetchpatch,
  setuptools,
  spark-parser,
  xdis,
@ -20,6 +21,14 @@ buildPythonPackage rec {
    hash = "sha256-eLdk1MhDsEVfs5223rQhpI1dPruEZTe6ZESv4QfE68E=";
  };

+  patches = [
+    (fetchpatch {
+      name = "support-xdis-6.3-api.patch";
+      url = "https://github.com/rocky/python-uncompyle6/commit/62372825c62044428c29a9ce86b5afa81e93c5ae.patch";
+      hash = "sha256-z11AKF5RC4gibUbH3hI2Rsbn8VDg49SnKfqV4TuVnjc=";
+    })
+  ];
+
  build-system = [ setuptools ];

  dependencies = [
--- a/pkgs/development/python-modules/wled/default.nix
+++ b/pkgs/development/python-modules/wled/default.nix
@ -3,9 +3,7 @@
  aiohttp,
  aioresponses,
  awesomeversion,
-  backoff,
  buildPythonPackage,
-  cachetools,
  fetchFromGitHub,
  mashumaro,
  orjson,
@ -14,6 +12,7 @@
  pytest-cov-stub,
  pytest-xdist,
  pytestCheckHook,
+  python-backoff,
  syrupy,
  typer,
  yarl,
@ -22,14 +21,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "wled";
-  version = "0.22.0";
+  version = "0.23.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "frenck";
    repo = "python-wled";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-CUTuIQf6gj9teLicIOtu1FUsYiYXtKeLNuDbNh/21sc=";
+    hash = "sha256-1JLW3wze4W3Uva9xIeSAmYw8f9tDfGxe9rueixVedms=";
  };

  postPatch = ''
@ -43,10 +42,9 @@ buildPythonPackage (finalAttrs: {
  dependencies = [
    aiohttp
    awesomeversion
-    backoff
-    cachetools
    mashumaro
    orjson
+    python-backoff
    yarl
  ];

@ -70,6 +68,8 @@ buildPythonPackage (finalAttrs: {
  disabledTests = [
    # wled release table rendering is inconsistent
    "test_releases_command"
+    # outdated snapshots
+    "test_device_version_fixture"
  ];

  pythonImportsCheck = [ "wled" ];
--- a/pkgs/development/python-modules/xdis/default.nix
+++ b/pkgs/development/python-modules/xdis/default.nix
@ -3,6 +3,7 @@
  buildPythonPackage,
  click,
  fetchFromGitHub,
+  fetchpatch,
  pytestCheckHook,
  setuptools,
  six,
@ -10,16 +11,31 @@

 buildPythonPackage rec {
  pname = "xdis";
-  version = "6.1.8";
+  version = "6.3.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "rocky";
    repo = "python-xdis";
    tag = version;
-    hash = "sha256-sAL2D7Rg/iyob2nawXX/b5F/uOGCMsb1q0ZnPLIfh6o=";
+    hash = "sha256-k1SawlgbItbWe8J2pAxYOku/4CHyzWH3UR1j3kBZy1Q=";
  };

+  patches = [
+    (fetchpatch {
+      name = "python-3.13.13.patch";
+      url = "https://github.com/rocky/python-xdis/commit/f2c46c8c89898157c2345c0a026a2d31f14e7ea9.patch";
+      includes = [ "xdis/magics.py" ];
+      hash = "sha256-+k3mbiAmM69Pl7k0Wogx+qpib5+p3Gn/pSpnDn5e6pE=";
+    })
+    (fetchpatch {
+      name = "python-3.14.4.patch";
+      url = "https://github.com/rocky/python-xdis/commit/36a1a2442c224e3bfca776f727a5e262968855a4.patch";
+      includes = [ "xdis/magics.py" ];
+      hash = "sha256-q+MX737Xn+iUObuV5IirnT71/0W6JH0TgtmS1cqR0x4=";
+    })
+  ];
+
  build-system = [
    setuptools
  ];
--- a/Show more
+++ b/Show more