Merge staging-next into staging

2026-07-06 17:13:24 -05:00 · 2026-05-27 18:48:39 +00:00 · 2026-05-27 18:48:39 +00:00 · 2391366a06
commit 2391366a06
parent b1cbd6ae06 400425f0d3
110 changed files with 948 additions and 664 deletions
--- a/doc/redirects.json
+++ b/doc/redirects.json
@ -926,6 +926,9 @@
  "var-go-buildTestBinaries": [
    "index.html#var-go-buildTestBinaries"
  ],
+  "var-meta-donationPage": [
+    "index.html#var-meta-donationPage"
+  ],
  "var-meta-identifiers-cpe": [
    "index.html#var-meta-identifiers-cpe"
  ],
--- a/doc/stdenv/meta.chapter.md
+++ b/doc/stdenv/meta.chapter.md
@ -61,6 +61,12 @@ Release branch. Used to specify that a package is not going to receive updates t

 The package’s homepage. Example: `https://www.gnu.org/software/hello/manual/`

+### `donationPage` {#var-meta-donationPage}
+
+The package or project's donation page, if it exists. Example: `https://neovim.io/sponsors/`
+
+Authoritative project URLs are preferred.
+
 ### `downloadPage` {#var-meta-downloadPage}

 The page where a link to the current version can be found. Example: `https://ftp.gnu.org/gnu/hello/`
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -710,6 +710,12 @@
    githubId = 25004152;
    name = "Adrian Gunnar Lauterer";
  };
+  adrielvelazquez = {
+    email = "AdrielVelazquez@gmail.com";
+    github = "AdrielVelazquez";
+    githubId = 3443378;
+    name = "Adriel Velazquez";
+  };
  AdrienLemaire = {
    email = "lemaire.adrien@gmail.com";
    github = "AdrienLemaire";
--- a/nixos/modules/programs/gamescope.nix
+++ b/nixos/modules/programs/gamescope.nix
@ -26,6 +26,8 @@ in

    package = lib.mkPackageOption pkgs "gamescope" { };

+    enableWsi = lib.mkEnableOption "gamescope-wsi, the Vulkan WSI layer, alongside gamescope";
+
    capSysNice = lib.mkOption {
      type = lib.types.bool;
      default = false;
@ -76,6 +78,11 @@ in
    };

    environment.systemPackages = lib.mkIf (!cfg.capSysNice) [ gamescope ];
+
+    hardware.graphics = lib.optionalAttrs cfg.enableWsi {
+      extraPackages = with pkgs; [ gamescope-wsi ];
+      extraPackages32 = with pkgs; [ pkgsi686Linux.gamescope-wsi ];
+    };
  };

  meta.maintainers = [ ];
--- a/nixos/modules/services/networking/fastnetmon-advanced.nix
+++ b/nixos/modules/services/networking/fastnetmon-advanced.nix
@ -207,6 +207,10 @@ in
          AmbientCapabilities = "cap_net_bind_service";
        };
      };
+
+      services.fastnetmon-advanced.hostgroups = {
+        global = { };
+      };
    })

    (lib.mkIf (cfg.enable && cfg.enableAdvancedTrafficPersistence) {
--- a/nixos/tests/fastnetmon-advanced.nix
+++ b/nixos/tests/fastnetmon-advanced.nix
@ -62,7 +62,7 @@
      bird.wait_for_unit("bird.service")

      fnm.wait_until_succeeds('journalctl -eu fastnetmon.service | grep "BGP daemon restarted correctly"')
-      fnm.wait_until_succeeds("journalctl -eu gobgp.service | grep BGP_FSM_OPENCONFIRM")
+      fnm.wait_until_succeeds('journalctl -eu gobgp.service | grep "Peer Up"')
      bird.wait_until_succeeds("birdc show protocol fnm | grep Estab")
      fnm.wait_until_succeeds('journalctl -eu fastnetmon.service | grep "API server listening"')
      fnm.succeed("fcli set blackhole 172.23.42.123")
--- a/nixos/tests/seatd.nix
+++ b/nixos/tests/seatd.nix
@ -50,6 +50,7 @@ in
    };

  testScript = ''
+    machine.wait_for_unit("seatd.service")
    machine.wait_for_file("/tmp/foot_started")
    machine.succeed("test $(seatd-client-pid) = $(pgrep dwl)")
  '';
--- a/pkgs/applications/networking/instant-messengers/ferdium/default.nix
+++ b/pkgs/applications/networking/instant-messengers/ferdium/default.nix
@ -4,26 +4,35 @@
  fetchurl,
  libxshmfence,
  stdenv,
+  writeShellScript,
+  nix-update,
+  jq,
+  nix,
+  common-updater-scripts,
 }:

 let
+  inherit (stdenv.hostPlatform) system;
+  throwSystem = throw "ferdium: arch ${system} not supported";
+
  arch =
    {
      x86_64-linux = "amd64";
      aarch64-linux = "arm64";
    }
-    ."${stdenv.hostPlatform.system}" or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
+    .${system} or throwSystem;
+
  hash =
    {
-      amd64-linux_hash = "sha256-1jXo8MMk2EEkLo0n4ICmGJteKProLYKkMF//g63frHs=";
-      arm64-linux_hash = "sha256-jYDGVZhL0bswowm1H/4aa35lNJalil6ymV34NQM5Gfc=";
+      x86_64-linux = "sha256-ODQKFjBa2riJY26aPaAfLzuCyLYkB5oYSxIE28nMmwY=";
+      aarch64-linux = "sha256-CYHoTw6JUyU63iTd9tAbfWVnb48WcZgGtjthqnlAD8I=";
    }
-    ."${arch}-linux_hash";
+    .${system} or throwSystem;
 in
 mkFranzDerivation rec {
  pname = "ferdium";
  name = "Ferdium";
-  version = "7.1.1";
+  version = "7.1.2";
  src = fetchurl {
    url = "https://github.com/ferdium/ferdium-app/releases/download/v${version}/Ferdium-linux-${version}-${arch}.deb";
    inherit hash;
@ -31,9 +40,21 @@ mkFranzDerivation rec {

  extraBuildInputs = [ libxshmfence ];

-  passthru = {
-    updateScript = ./update.sh;
-  };
+  passthru.updateScript = writeShellScript "update-ferdium" ''
+    ${lib.getExe nix-update} ferdium --no-src --override-filename pkgs/applications/networking/instant-messengers/ferdium/default.nix
+    latestVersion=$(nix eval --raw --file . ferdium.version)
+    if [[ "$latestVersion" == "$UPDATE_NIX_OLD_VERSION" ]]; then
+      exit 0
+    fi
+    for system in x86_64-linux aarch64-linux; do
+      hash=$(${lib.getExe nix} store prefetch-file --json \
+        "$(nix eval --raw --file . ferdium.src.url --argstr system "$system")" \
+        | ${lib.getExe jq} --raw-output .hash)
+      ${lib.getExe' common-updater-scripts "update-source-version"} \
+        ferdium "$latestVersion" "$hash" --system="$system" \
+        --ignore-same-version --ignore-same-hash
+    done
+  '';

  meta = {
    description = "All your services in one place built by the community";
--- a/pkgs/applications/networking/instant-messengers/ferdium/update.sh
+++ b/pkgs/applications/networking/instant-messengers/ferdium/update.sh
@ -1,12 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i bash -p git bash curl jq nix-update
-
-set -xe
-
-dirname="$(dirname "$0")"
-
-latestTag=$(curl https://api.github.com/repos/ferdium/ferdium-app/releases/latest | jq -r ".tag_name")
-latestVersion="$(expr $latestTag : 'v\(.*\)')"
-
-nix-update --version "$latestVersion" --system aarch64-linux --override-filename "$dirname/default.nix" ferdium
-nix-update --version skip --system x86_64-linux --override-filename "$dirname/default.nix" ferdium
--- a/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
+++ b/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
@ -32,11 +32,14 @@ let
      # FIXME: let's hope that upstream will fix this soon and we can drop this hack again.
      # https://bugzilla.mozilla.org/show_bug.cgi?id=2040877
      extraPostPatch =
-        lib.optionalString (lib.versionAtLeast version "151" && lib.versionOlder version "152")
-          ''
-            echo https://hg.mozilla.org/releases/comm-release/rev/becfb8fb2c70f1603882a2787e2170d5d8013949 >> sourcestamp.txt
-            echo https://hg.mozilla.org/releases/mozilla-release/rev/fc12dc911f904307729760a817deb829cbf8feb4 >> sourcestamp.txt
-          '';
+        lib.optionalString (lib.versionAtLeast version "151" && lib.versionOlder version "152") ''
+          echo https://hg.mozilla.org/releases/comm-release/rev/becfb8fb2c70f1603882a2787e2170d5d8013949 >> sourcestamp.txt
+          echo https://hg.mozilla.org/releases/mozilla-release/rev/fc12dc911f904307729760a817deb829cbf8feb4 >> sourcestamp.txt
+        ''
+        # https://bugzilla.mozilla.org/show_bug.cgi?id=2006630
+        + lib.optionalString (lib.versionAtLeast version "140.8" && lib.versionOlder version "151") ''
+          find . -name .cargo-checksum.json | xargs sed 's/"[^"]*\.gitmodules":"[a-z0-9]*",//g' -i
+        '';

      meta = {
        changelog = "https://www.thunderbird.net/en-US/thunderbird/${version}/releasenotes/";
@ -88,8 +91,8 @@ rec {
  thunderbird-140 = common {
    applicationName = "Thunderbird ESR";

-    version = "140.7.2esr";
-    sha512 = "513bcaa496f987d0f3906aeb6fe3ea651331470646b0c58479c91bb2c8eb52e389bc8aa646437a03b611ab78bda1df7252545960ffe38086d1fc462e65421819";
+    version = "140.11.1esr";
+    sha512 = "93dfdd26e6f4c7dd2f7dcc2e4994980d017868341c60c93775721467abd9192b815f2de63928e7d10c965fc045ed72ca5b49ed6502a61e50104ee5cd00941d1e";

    updateScript = callPackage ./update.nix {
      attrPath = "thunderbirdPackages.thunderbird-140";
--- a/pkgs/build-support/build-mozilla-mach/140-bindgen-string-view.patch
+++ b/pkgs/build-support/build-mozilla-mach/140-bindgen-string-view.patch
@ -0,0 +1,15 @@
+diff --git a/tools/profiler/rust-api/build.rs b/tools/profiler/rust-api/build.rs
+index 9bb27eb83e5e..3f09f7f01bcb 100644
+--- a/tools/profiler/rust-api/build.rs
+++ b/tools/profiler/rust-api/build.rs
+@@ -88,6 +88,10 @@ fn generate_bindings() {
+         // successfully. Otherwise, it fails to build because MarkerSchema has
+         // some std::strings as its fields.
+         .opaque_type("std::string")
+        .blocklist_type(".*basic_string_view.*")
+        .opaque_type(".*basic_string_view.*")
+        .blocklist_type(".*basic_string___self_view.*")
+        .opaque_type(".*basic_string___self_view.*")
+         // std::vector needs to be converted to an opaque type because, if it's
+         // not an opaque type, bindgen can't find its size properly and
+         // MarkerSchema's total size reduces. That causes a heap buffer overflow.
--- a/pkgs/build-support/build-mozilla-mach/default.nix
+++ b/pkgs/build-support/build-mozilla-mach/default.nix
@ -332,6 +332,14 @@ buildStdenv.mkDerivation {
      # https://hg-edge.mozilla.org/mozilla-central/rev/aa8a29bd1fb9
      ./139-wayland-drag-animation.patch
    ]
+    ++ lib.optionals (lib.versionAtLeast version "140" && lib.versionOlder version "144") [
+      # Versions before 144 vendor bindgen 0.69. On Darwin, libc++ 21 changed
+      # basic_string::__self_view from a typedef to an attributed using alias;
+      # bindgen then emits it without its template parameter, producing invalid
+      # Rust. Vendored bindgen was updated in:
+      # https://bugzilla.mozilla.org/show_bug.cgi?id=1985509
+      ./140-bindgen-string-view.patch
+    ]
    ++ extraPatches;

  postPatch = ''
--- a/pkgs/by-name/an/antigravity-cli/package.nix
+++ b/pkgs/by-name/an/antigravity-cli/package.nix
@ -8,27 +8,34 @@

 let
  # Version and platform-specific data retrieved from Google's manifests
-  version = "1.0.2";
+  version = "1.0.3";

-  sources = {
+  sourceData = {
    "x86_64-linux" = {
-      url = "https://storage.googleapis.com/antigravity-public/antigravity-cli/1.0.2-6109799369277440/linux-x64/cli_linux_x64.tar.gz";
-      hash = "sha256-XAq2oHWaAe2AoAgDBb1/NvABfkodg3xYTDmTY5H9RD0=";
+      url = "https://storage.googleapis.com/antigravity-public/antigravity-cli/1.0.3-6459114696605696/linux-x64/cli_linux_x64.tar.gz";
+      hash = "sha256-UM/b3TuXROHHx0dKMU0KtENNREmY+VAYKmxRWewu/ic=";
    };
    "aarch64-linux" = {
-      url = "https://storage.googleapis.com/antigravity-public/antigravity-cli/1.0.2-6109799369277440/linux-arm/cli_linux_arm64.tar.gz";
-      hash = "sha256-7pj7TMHg+Z7DyWVmXOMqoM9kQkw5FxXTF+P4hGYc2hE=";
+      url = "https://storage.googleapis.com/antigravity-public/antigravity-cli/1.0.3-6459114696605696/linux-arm/cli_linux_arm64.tar.gz";
+      hash = "sha256-Cp44KTj1wP85y6Z6oCOd1ylL2nTg1mDx7aJuv/Q7nBE=";
    };
    "aarch64-darwin" = {
-      url = "https://storage.googleapis.com/antigravity-public/antigravity-cli/1.0.2-6109799369277440/darwin-arm/cli_mac_arm64.tar.gz";
-      hash = "sha256-stu8KZDa5id5wVImTgyedkIKJPdkBTagRCphoYLWUoI=";
+      url = "https://storage.googleapis.com/antigravity-public/antigravity-cli/1.0.3-6459114696605696/darwin-arm/cli_mac_arm64.tar.gz";
+      hash = "sha256-lbf6dCJ7QhDNomfpi10Dhk9VShxAxTC0zsFIFpGlbtA=";
    };
    "x86_64-darwin" = {
-      url = "https://storage.googleapis.com/antigravity-public/antigravity-cli/1.0.2-6109799369277440/darwin-x64/cli_mac_x64.tar.gz";
-      hash = "sha256-KDOEEgFhvpO9bifljSuhRKpb+J6c+q4TWmnrNAAS3A0=";
+      url = "https://storage.googleapis.com/antigravity-public/antigravity-cli/1.0.3-6459114696605696/darwin-x64/cli_mac_x64.tar.gz";
+      hash = "sha256-B1zPkt4h3JN7ZWhin0iTQMCe+NhVvBGKWCLfKnBrZnw=";
    };
  };

+  sources = lib.mapAttrs (
+    _system: source:
+    fetchzip {
+      inherit (source) url hash;
+    }
+  ) sourceData;
+
  source =
    sources.${stdenv.hostPlatform.system}
      or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
@ -37,9 +44,7 @@ stdenv.mkDerivation (finalAttrs: {
  pname = "antigravity-cli";
  inherit version;

-  src = fetchzip {
-    inherit (source) url hash;
-  };
+  src = source;

  strictDeps = true;
  __structuredAttrs = true;
@ -61,15 +66,27 @@ stdenv.mkDerivation (finalAttrs: {
  doInstallCheck = true;

  passthru = {
-    updateScript = ./update.py;
+    inherit sources;
+    updateScript = [
+      ./update.sh
+      version
+    ]
+    ++ lib.concatMap (system: [
+      system
+      sourceData.${system}.url
+    ]) (lib.attrNames sourceData);
  };

  meta = {
    description = "Google's Go-based terminal user interface (TUI) agent client";
    homepage = "https://antigravity.google";
+    changelog = "https://antigravity.google/changelog";
    license = lib.licenses.unfree;
-    maintainers = with lib.maintainers; [ u3kkasha ];
-    platforms = lib.attrNames sources;
+    maintainers = with lib.maintainers; [
+      adrielvelazquez
+      u3kkasha
+    ];
+    platforms = lib.attrNames sourceData;
    mainProgram = "agy";
    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
  };
--- a/pkgs/by-name/an/antigravity-cli/update.py
+++ b/pkgs/by-name/an/antigravity-cli/update.py
@ -1,131 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i python3 -p python3 nix jq
-
-import re
-import urllib.request
-import json
-import subprocess
-import sys
-import os
-import tempfile
-
-MANIFEST_BASE = (
-    "https://antigravity-cli-auto-updater-974169037036.us-central1.run.app/manifests"
-)
-PLATFORMS = {
-    "x86_64-linux": "linux_amd64",
-    "aarch64-linux": "linux_arm64",
-    "x86_64-darwin": "darwin_amd64",
-    "aarch64-darwin": "darwin_arm64",
-}
-
-
-def fetch_json(url):
-    req = urllib.request.Request(
-        url, headers={"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)"}
-    )
-    with urllib.request.urlopen(req) as response:
-        return json.loads(response.read().decode("utf-8"))
-
-
-def get_nix_hash(url):
-    """Downloads, unpacks, and returns the SRI hash of the directory content."""
-    with tempfile.TemporaryDirectory() as tmpdir:
-        archive_path = os.path.join(tmpdir, "archive.tar.gz")
-        unpack_path = os.path.join(tmpdir, "unpack")
-        os.makedirs(unpack_path)
-
-        # Download
-        req = urllib.request.Request(url, headers={"User-Agent": "Mozilla/5.0"})
-        with (
-            urllib.request.urlopen(req) as response,
-            open(archive_path, "wb") as out_file,
-        ):
-            out_file.write(response.read())
-
-        # Unpack
-        subprocess.run(["tar", "-xzf", archive_path, "-C", unpack_path], check=True)
-
-        # Hash
-        result = subprocess.run(
-            ["nix", "hash", "path", "--type", "sha256", unpack_path],
-            capture_output=True,
-            text=True,
-            check=True,
-        )
-        return result.stdout.strip()
-
-
-def main():
-    # Change directory to the script's directory so paths are relative
-    script_dir = os.path.dirname(os.path.abspath(__file__))
-    os.chdir(script_dir)
-
-    print("Checking for updates from Google Antigravity release API...")
-
-    # 1. Fetch the latest version from the linux_amd64 manifest
-    try:
-        manifest = fetch_json(f"{MANIFEST_BASE}/linux_amd64.json")
-    except Exception as e:
-        print(f"Error fetching manifest: {e}", file=sys.stderr)
-        sys.exit(1)
-
-    latest_version = manifest["version"]
-
-    # Read the current package.nix
-    package_file = "package.nix"
-    if not os.path.exists(package_file):
-        print(f"Error: Could not find package.nix in {script_dir}", file=sys.stderr)
-        sys.exit(1)
-
-    with open(package_file, "r") as f:
-        content = f.read()
-
-    # Extract current version
-    version_match = re.search(r'version\s*=\s*"([^"]*)"', content)
-    if not version_match:
-        print(
-            "Error: Could not parse current version from package.nix", file=sys.stderr
-        )
-        sys.exit(1)
-
-    current_version = version_match.group(1)
-
-    if current_version == latest_version:
-        print(f"Already up to date (current version {current_version} is the latest).")
-        sys.exit(0)
-
-    print(f"New version found! Updating: {current_version} -> {latest_version}")
-
-    # 2. Update the version string in content
-    content = re.sub(
-        r'(version\s*=\s*")[^"]*(";)', f"\\g<1>{latest_version}\\g<2>", content
-    )
-
-    # 3. For each platform, fetch url and hash, and update sources
-    for platform, manifest_name in PLATFORMS.items():
-        print(f"Fetching manifest for {platform}...")
-        try:
-            m = fetch_json(f"{MANIFEST_BASE}/{manifest_name}.json")
-        except Exception as e:
-            print(f"Error fetching manifest for {platform}: {e}", file=sys.stderr)
-            sys.exit(1)
-
-        url = m["url"]
-        sri_hash = get_nix_hash(url)
-
-        # Regex to locate and replace URL and hash for this specific platform in package.nix
-        pattern = rf'("{platform}"\s*=\s*\{{[^}}]+url\s*=\s*")[^"]*(";[^}}]+hash\s*=\s*")[^"]*(";)'
-        replacement = f"\\g<1>{url}\\g<2>{sri_hash}\\g<3>"
-
-        content = re.sub(pattern, replacement, content)
-
-    # Write the updated content back
-    with open(package_file, "w") as f:
-        f.write(content)
-
-    print(f"Successfully updated package.nix to version {latest_version}!")
-
-
-if __name__ == "__main__":
-    main()
--- a/pkgs/by-name/an/antigravity-cli/update.sh
+++ b/pkgs/by-name/an/antigravity-cli/update.sh
@ -0,0 +1,60 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p bash common-updater-scripts coreutils curl gnutar nix
+# shellcheck shell=bash
+set -euo pipefail
+
+script_dir="$(cd -- "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+nixpkgs_root="$(realpath "$script_dir/../../../..")"
+package_file="$script_dir/package.nix"
+tmpdir="$(mktemp -d)"
+trap 'rm -rf "$tmpdir"' EXIT
+
+cd -- "$nixpkgs_root"
+
+if (( $# < 3 || ($# - 1) % 2 != 0 )); then
+  echo "Usage: $0 <version> [<system> <url>]..." >&2
+  exit 1
+fi
+
+version="$1"
+shift
+
+export NIXPKGS_ALLOW_UNFREE=1
+
+hash_url() {
+  local system="$1"
+  local url="$2"
+  local archive="$tmpdir/$system.tar.gz"
+  local unpack_dir="$tmpdir/$system-unpack"
+
+  mkdir -p "$unpack_dir"
+  curl -fsSL "$url" -o "$archive" || return
+  tar -xzf "$archive" -C "$unpack_dir" || return
+
+  if [[ ! -x "$unpack_dir/antigravity" ]]; then
+    echo "Expected executable 'antigravity' in $url" >&2
+    exit 1
+  fi
+
+  nix hash path --type sha256 "$unpack_dir"
+}
+
+while (( $# > 0 )); do
+  system="$1"
+  url="$2"
+  shift 2
+
+  if [[ "$url" != *"/antigravity-cli/$version-"* ]]; then
+    echo "URL for $system does not match package version $version: $url" >&2
+    exit 1
+  fi
+
+  echo "Hashing $system from $url"
+  hash="$(hash_url "$system" "$url")"
+  update-source-version antigravity-cli "$version" "$hash" \
+    --file="$package_file" \
+    --ignore-same-hash \
+    --ignore-same-version \
+    --source-key="sources.$system" \
+    --system="$system"
+done
--- a/pkgs/by-name/ap/apm-cli/package.nix
+++ b/pkgs/by-name/ap/apm-cli/package.nix
@ -0,0 +1,77 @@
+{
+  lib,
+  python3Packages,
+  fetchFromGitHub,
+}:
+
+python3Packages.buildPythonApplication (finalAttrs: {
+  pname = "apm-cli";
+  version = "0.15.0";
+  pyproject = true;
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "microsoft";
+    repo = "apm";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-xKY1ESX683uFqfiLqAK2ALpO+2NYs6ecqa4S639c1+k=";
+  };
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail '"llm-github-models>=0.1.0",' ""
+  '';
+
+  build-system = with python3Packages; [
+    setuptools
+  ];
+
+  dependencies = with python3Packages; [
+    click
+    colorama
+    filelock
+    gitpython
+    llm
+    # Not in nixpkgs and the game is not worth the candle for this package.
+    # llm-github-models
+    python-frontmatter
+    pyyaml
+    requests
+    rich
+    rich-click
+    ruamel-yaml
+    toml
+    tomli
+    watchdog
+  ];
+
+  optional-dependencies = with python3Packages; {
+    build = [
+      pyinstaller
+    ];
+    dev = [
+      jsonschema
+      mypy
+      pylint
+      pytest
+      pytest-cov
+      pytest-split
+      pytest-xdist
+      ruff
+    ];
+  };
+
+  pythonImportsCheck = [
+    "apm_cli"
+  ];
+
+  meta = {
+    description = "Agent Package Manager";
+    homepage = "https://github.com/microsoft/apm";
+    changelog = "https://github.com/microsoft/apm/blob/${finalAttrs.src.rev}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ drupol ];
+    mainProgram = "apm-cli";
+  };
+})
--- a/pkgs/by-name/au/authelia/package.nix
+++ b/pkgs/by-name/au/authelia/package.nix
@ -4,9 +4,9 @@
  nodejs,
  fetchPnpmDeps,
  pnpmConfigHook,
-  pnpm_10,
+  pnpm_11,
  fetchFromGitHub,
-  buildGo125Module,
+  buildGo126Module,
  installShellFiles,
  callPackage,
  nixosTests,
@ -15,16 +15,16 @@
      nodejs
      fetchPnpmDeps
      pnpmConfigHook
-      pnpm_10
+      pnpm_11
      fetchFromGitHub
      ;
  },
 }:

 let
-  pnpm = pnpm_10;
+  pnpm = pnpm_11;

-  buildGoModule = buildGo125Module;
+  buildGoModule = buildGo126Module;

  inherit (import ./sources.nix { inherit fetchFromGitHub; })
    pname
@ -66,11 +66,6 @@ buildGoModule (finalAttrs: {
      "-X ${p}.BuildExtra=nixpkgs"
    ];

-  # It is required to set this to avoid a change in the
-  # handling of sync map in go 1.24+
-  # Upstream issue: https://github.com/authelia/authelia/issues/8980
-  env.GOEXPERIMENT = "nosynchashtriemap";
-
  # several tests with networking and several that want chromium
  doCheck = false;

--- a/pkgs/by-name/au/authelia/sources.nix
+++ b/pkgs/by-name/au/authelia/sources.nix
@ -1,14 +1,14 @@
 { fetchFromGitHub }:
 rec {
  pname = "authelia";
-  version = "4.39.19";
+  version = "4.39.20";

  src = fetchFromGitHub {
    owner = "authelia";
    repo = "authelia";
    rev = "v${version}";
-    hash = "sha256-wMOurdgdjykFekn0Pej3meM6WSzq9tJ+kZV9sVDvRwM=";
+    hash = "sha256-JjpfNQsqtmSKXj14fQUJsiTgfkAlSHDfqUC/x+bE+fc=";
  };
-  vendorHash = "sha256-ZDsLRMip2B8PPZu8VxW+91FVvwC2rXzohhAZFifT26g=";
-  pnpmDepsHash = "sha256-HMrC5V+Ak2dF1uPtbh8kgFc8kZI2FPMmZHJciWRYx9w=";
+  vendorHash = "sha256-dZjsYqw/ABEn1y6tZgSjbmqamO4U20Ljj/dQMFruVjU=";
+  pnpmDepsHash = "sha256-syfPg62JrTh496xi39xW/CnIwpJYo+iU5sCPP3bD2Ys=";
 }
--- a/pkgs/by-name/au/authelia/web.nix
+++ b/pkgs/by-name/au/authelia/web.nix
@ -3,12 +3,12 @@
  nodejs,
  fetchPnpmDeps,
  pnpmConfigHook,
-  pnpm_10,
+  pnpm_11,
  fetchFromGitHub,
 }:

 let
-  pnpm = pnpm_10;
+  pnpm = pnpm_11;

  inherit (import ./sources.nix { inherit fetchFromGitHub; })
    pname
--- a/pkgs/by-name/ba/babl/package.nix
+++ b/pkgs/by-name/ba/babl/package.nix
@ -13,7 +13,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "babl";
-  version = "0.1.124";
+  version = "0.1.126";

  outputs = [
    "out"
@ -23,7 +23,7 @@ stdenv.mkDerivation (finalAttrs: {

  src = fetchurl {
    url = "https://download.gimp.org/pub/babl/${lib.versions.majorMinor finalAttrs.version}/babl-${finalAttrs.version}.tar.xz";
-    hash = "sha256-Gw1USrb0CfKxtfZ3ImJy0ejG03Py9FPuhwv8fl3U8bE=";
+    hash = "sha256-PwkPSyph/s98jcYKWAS7x3zv2Nd4ry3tBZ8ONnpSkw4=";
  };

  patches = [
@ -48,7 +48,7 @@ stdenv.mkDerivation (finalAttrs: {
    "-Dprefix-dev=${placeholder "dev"}"
    # On Linux, this would be disabled by default but we have -Dauto_features=enabled.
    # Disable it on other platforms too, since I cannot test it there.
-    "-Drelocatable=disabled"
+    "-Drelocatable-bundle=no"
  ]
  ++ lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
    # Docs are opt-out in native but opt-in in cross builds.
--- a/pkgs/by-name/ba/bambu-studio/package.nix
+++ b/pkgs/by-name/ba/bambu-studio/package.nix
@ -1,13 +1,13 @@
 {
  stdenv,
  lib,
-  binutils,
  fetchFromGitHub,
  cmake,
  ninja,
  pkg-config,
  wrapGAppsHook3,
  boost183,
+  cacert,
  cereal,
  cgal_5,
  curl,
@ -15,7 +15,6 @@
  eigen,
  expat,
  ffmpeg,
-  gcc-unwrapped,
  glew,
  glfw,
  glib,
@ -26,19 +25,24 @@
  gtk3,
  hicolor-icon-theme,
  libpng,
+  libsecret,
+  makeFontsConf,
  mpfr,
+  nanum,
  nlopt,
  opencascade-occt_7_6,
  openvdb,
  openexr,
  opencv,
-  pcre,
  systemd,
  onetbb,
  webkitgtk_4_1,
  wxwidgets_3_1,
  libx11,
  withSystemd ? stdenv.hostPlatform.isLinux,
+  # 3D viewport blank on NVIDIA proprietary GL; routes through Mesa + zink.
+  # https://github.com/NixOS/nixpkgs/issues/498311
+  withNvidiaGLWorkaround ? false,
 }:
 let
  wxGTK' =
@ -48,11 +52,17 @@ let
      withWebKit = true;
    }).overrideAttrs
      (old: {
+        buildInputs = old.buildInputs ++ [ libsecret ];
        configureFlags = old.configureFlags ++ [
          # Disable noisy debug dialogs
          "--enable-debug=no"
+          "--enable-secretstore"
        ];
      });
+
+  fontsConf = makeFontsConf { fontDirectories = [ nanum ]; };
+
+  caBundle = "${cacert}/etc/ssl/certs/ca-bundle.crt";
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "bambu-studio";
@ -73,7 +83,6 @@ stdenv.mkDerivation (finalAttrs: {
  ];

  buildInputs = [
-    binutils
    boost183
    cereal
    cgal_5
@ -82,7 +91,6 @@ stdenv.mkDerivation (finalAttrs: {
    eigen
    expat
    ffmpeg
-    gcc-unwrapped
    glew
    glfw
    glib
@ -95,12 +103,12 @@ stdenv.mkDerivation (finalAttrs: {
    gtk3
    hicolor-icon-theme
    libpng
+    libsecret
    mpfr
    nlopt
    opencascade-occt_7_6
    openexr
    openvdb
-    pcre
    onetbb
    webkitgtk_4_1
    wxGTK'
@ -156,19 +164,19 @@ stdenv.mkDerivation (finalAttrs: {
  '';

  cmakeFlags = [
-    "-DSLIC3R_STATIC=0"
-    "-DSLIC3R_FHS=1"
-    "-DSLIC3R_GTK=3"
+    (lib.cmakeBool "SLIC3R_STATIC" false)
+    (lib.cmakeBool "SLIC3R_FHS" true)
+    (lib.cmakeFeature "SLIC3R_GTK" "3")

    # Skips installing ffmpeg, since we BYO.
-    "-DFLATPAK=1"
+    (lib.cmakeBool "FLATPAK" true)

-    # BambuStudio-specific
-    "-DBBL_RELEASE_TO_PUBLIC=1"
-    "-DBBL_INTERNAL_TESTING=0"
-    "-DDEP_WX_GTK3=ON"
-    "-DSLIC3R_BUILD_TESTS=0"
-    "-DCMAKE_CXX_FLAGS=-DBOOST_LOG_DYN_LINK"
+    # Substituted into `#define BBL_x @value@`; must be integer literals.
+    (lib.cmakeFeature "BBL_RELEASE_TO_PUBLIC" "1")
+    (lib.cmakeFeature "BBL_INTERNAL_TESTING" "0")
+    (lib.cmakeBool "DEP_WX_GTK3" true)
+    (lib.cmakeBool "SLIC3R_BUILD_TESTS" false)
+    (lib.cmakeFeature "CMAKE_CXX_FLAGS" "-DBOOST_LOG_DYN_LINK")
  ];

  preFixup = ''
@ -178,6 +186,25 @@ stdenv.mkDerivation (finalAttrs: {
      # Fixes intermittent crash
      # The upstream setup links in glew statically
      --prefix LD_PRELOAD : "${glew.out}/lib/libGLEW.so"
+
+      # plugin libcurl + main HTTPS need explicit CA bundle.
+      # https://github.com/NixOS/nixpkgs/issues/498307
+      --set-default SSL_CERT_FILE ${caBundle}
+      --set-default CURL_CA_BUNDLE ${caBundle}
+
+      # WebKit OAuth callback fails with DMA-BUF compositing.
+      # https://github.com/NixOS/nixpkgs/issues/498307
+      --set WEBKIT_DISABLE_COMPOSITING_MODE 1
+      --set WEBKIT_DISABLE_DMABUF_RENDERER 1
+
+      --set FONTCONFIG_FILE "${fontsConf}"
+
+      ${lib.optionalString withNvidiaGLWorkaround ''
+        --set __GLX_VENDOR_LIBRARY_NAME mesa
+        --set __EGL_VENDOR_LIBRARY_FILENAMES /run/opengl-driver/share/glvnd/egl_vendor.d/50_mesa.json
+        --set MESA_LOADER_DRIVER_OVERRIDE zink
+        --set GALLIUM_DRIVER zink
+      ''}
    )
  '';

@ -192,7 +219,15 @@ stdenv.mkDerivation (finalAttrs: {
    description = "PC Software for BambuLab's 3D printers";
    homepage = "https://github.com/bambulab/BambuStudio";
    changelog = "https://github.com/bambulab/BambuStudio/releases/tag/v${finalAttrs.version}";
-    license = lib.licenses.agpl3Plus;
+    license = with lib.licenses; [
+      agpl3Plus
+      # Bambu Studio downloads and dlopens a proprietary networking library
+      # at first launch whose corresponding source is not provided. SFC ruled
+      # this an ongoing AGPLv3 violation; see:
+      # https://github.com/NixOS/nixpkgs/issues/415821
+      # https://sfconservancy.org/news/2026/may/18/bambu-studio-3d-printer-agpl-violation-response/
+      unfree
+    ];
    maintainers = with lib.maintainers; [
      zhaofengli
      dsluijk
--- a/pkgs/by-name/be/beon/package.nix
+++ b/pkgs/by-name/be/beon/package.nix
@ -4,12 +4,18 @@
  fetchFromGitHub,
  mkfontdir,
  mkfontscale,
+  installFonts,
 }:

 stdenvNoCC.mkDerivation {
  pname = "beon";
  version = "2024-02-26";

+  outputs = [
+    "out"
+    "webfont"
+  ];
+
  src = fetchFromGitHub {
    owner = "noirblancrouge";
    repo = "Beon";
@ -17,22 +23,25 @@ stdenvNoCC.mkDerivation {
    hash = "sha256-jBLVVykHFJamOVF6GSRnQqYixqOrw5K1oV1B3sl4Zoc=";
  };

+  dontBuild = true;
+
  nativeBuildInputs = [
    mkfontscale
    mkfontdir
+    installFonts
  ];

  installPhase = ''
    runHook preInstall
-
-    install -D -v fonts/ttf/Beon-Regular.ttf $out/share/fonts/truetype/Beon-Regular.ttf
-    cd $out/share/fonts
-    mkfontdir
-    mkfontscale
-
    runHook postInstall
  '';

+  preInstall = "rm -r docs/proof";
+  postInstall = ''
+    mkfontdir $out/share/fonts
+    mkfontscale $out/share/fonts
+  '';
+
  meta = {
    description = "Neon stencil typeface";
    homepage = "https://noirblancrouge.com/fonts/beon-display";
--- a/pkgs/by-name/bl/blocky/package.nix
+++ b/pkgs/by-name/bl/blocky/package.nix
@ -7,20 +7,20 @@

 buildGoModule (finalAttrs: {
  pname = "blocky";
-  version = "0.29.0";
+  version = "0.30.0";

  src = fetchFromGitHub {
    owner = "0xERR0R";
    repo = "blocky";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-8eFLmgTqK+WqJCPwLJXJqz2XCcP/1JDWfQQfzme9ELw=";
+    hash = "sha256-SZpAPX+MIQA0HRUUmjXi7g+DEJ+jyub4rlyc0RLclew=";
  };

  # needs network connection and fails at
  # https://github.com/0xERR0R/blocky/blob/development/resolver/upstream_resolver_test.go
  doCheck = false;

-  vendorHash = "sha256-H8AaK1jcdv10218ftMOrjfHd0XfaN9q3I0z4pGFirWA=";
+  vendorHash = "sha256-DahHFf0w0ksQniuVByX45/fLcqpAga23qMjAGnZTjjY=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/ca/cantarell-fonts/package.nix
+++ b/pkgs/by-name/ca/cantarell-fonts/package.nix
@ -33,12 +33,6 @@ stdenv.mkDerivation rec {
    appstream-glib
  ];

-  # ad-hoc fix for https://github.com/NixOS/nixpkgs/issues/50855
-  # until we fix gettext's envHook
-  preBuild = ''
-    export GETTEXTDATADIRS="$GETTEXTDATADIRS_FOR_BUILD"
-  '';
-
  outputHashAlgo = "sha256";
  outputHashMode = "recursive";
  outputHash = "sha256-OjHj4h3n+/ozbrLaiH4bGppQ+2LA2RB/sZQVO9EPOEw=";
--- a/pkgs/by-name/ca/cargo-nextest/package.nix
+++ b/pkgs/by-name/ca/cargo-nextest/package.nix
@ -8,13 +8,13 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cargo-nextest";
-  version = "0.9.136";
+  version = "0.9.137";

  src = fetchFromGitHub {
    owner = "nextest-rs";
    repo = "nextest";
    tag = "cargo-nextest-${finalAttrs.version}";
-    hash = "sha256-SXpRSmCduZqF9HHvAd3NkgUtokZpxxu3f6IZEnLwA0g=";
+    hash = "sha256-Ad5QXVkPwJk2wMHbCbYVwgua0DfmUwBLmfG9bSt1dbA=";
  };

  # FIXME: we don't support dtrace probe generation on macOS until we have a dtrace build: https://github.com/NixOS/nixpkgs/pull/392918
@ -22,7 +22,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    ./no-dtrace-macos.patch
  ];

-  cargoHash = "sha256-RWg1NcqlajN3GTOuMQ3WWWx5pa59YBZO3yKEm58qSu8=";
+  cargoHash = "sha256-7ISzQ9jt/ekrO7Z4B09YbNLZkNDwS13ljl2tpEQdthU=";

  cargoBuildFlags = [
    "-p"
--- a/pkgs/by-name/cc/ccsymbols/package.nix
+++ b/pkgs/by-name/cc/ccsymbols/package.nix
@ -2,31 +2,32 @@
  lib,
  stdenvNoCC,
  fetchurl,
+  installFonts,
  unzip,
 }:

-stdenvNoCC.mkDerivation rec {
+stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "ccsymbols";
  version = "2020-04-19";

  src = fetchurl {
-    url = "https://www.ctrl.blog/file/${version}_cc-symbols.zip";
+    url = "https://www.ctrl.blog/file/${finalAttrs.version}_cc-symbols.zip";
    hash = "sha256-hkARhb8T6VgGAybYkVuPuebjhuk1dwiBJ1bZMwvYpMY=";
  };

  sourceRoot = ".";

-  nativeBuildInputs = [ unzip ];
+  outputs = [
+    "out"
+    "webfont"
+  ];

-  installPhase = ''
-    runHook preInstall
+  nativeBuildInputs = [
+    installFonts
+    unzip
+  ];

-    install -Dm644 CCSymbols.* -t $out/share/fonts/ccsymbols
-
-    runHook postInstall
-  '';
-
-  passthru = { inherit pname version; };
+  passthru = { inherit (finalAttrs) pname version; };

  meta = {
    description = "Creative Commons symbol font";
@ -35,4 +36,4 @@ stdenvNoCC.mkDerivation rec {
    license = lib.licenses.publicDomain;
    platforms = lib.platforms.all;
  };
-}
+})
--- a/pkgs/by-name/cl/clouddrive2/package.nix
+++ b/pkgs/by-name/cl/clouddrive2/package.nix
@ -11,16 +11,16 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "clouddrive2";
-  version = "1.0.7";
+  version = "1.0.8";

  src = fetchurl {
    url = "https://github.com/cloud-fs/cloud-fs.github.io/releases/download/v${finalAttrs.version}/clouddrive-2-${os}-${arch}-${finalAttrs.version}.tgz";
    hash =
      {
-        x86_64-linux = "sha256-wVbCEluFyanoMy1wir87ahRdop7C4lILIn2jB5B29+M=";
-        aarch64-linux = "sha256-HzFg9LXdYO1bGpah5pg/xmv+/7cuVCnNsrin28Yc/OQ=";
-        x86_64-darwin = "sha256-Uqo6hVan4+F3DPxoHjIg53wDV9naT9h6+EiEkCJBb7o=";
-        aarch64-darwin = "sha256-jzCZeGq0fDnsCTGSNG0nOBGIUDBAn/D/TD2Iz5K8O3w=";
+        x86_64-linux = "sha256-LB2G5g5Bj+kFmrY/kgQEGsXmrmrGQbH7pdshr8lfank=";
+        aarch64-linux = "sha256-XYjHiB9JDkfoKS1uzzvJ0o79+YipABedY56JnmCyInE=";
+        x86_64-darwin = "sha256-avzB7gUiVPKuRha+Ls7huNfrPtDKmyFPc6gFfuWOBPw=";
+        aarch64-darwin = "sha256-frldCUG6aGfXDoPzvG8QYMTL4SxTEd2hPLy0+7YWtIE=";
      }
      .${stdenv.hostPlatform.system} or (throw "unsupported system ${stdenv.hostPlatform.system}");
  };
--- a/pkgs/by-name/di/directx-shader-compiler/package.nix
+++ b/pkgs/by-name/di/directx-shader-compiler/package.nix
@ -10,7 +10,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "directx-shader-compiler";
-  version = "1.10.2605.2";
+  version = "1.10.2605.24";

  # Put headers in dev, there are lot of them which aren't necessary for
  # using the compiler binary.
@ -23,7 +23,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "microsoft";
    repo = "DirectXShaderCompiler";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-FzfXxfhAyJw7rouWJEyeVdikG5TBM81yC+9iRg5tK3c=";
+    hash = "sha256-vZDP4xnqEdswjvlLTO1jYKtQS1UAA0vGdP2ovB8HMaM=";
    fetchSubmodules = true;
  };

--- a/pkgs/by-name/en/enca/package.nix
+++ b/pkgs/by-name/en/enca/package.nix
@ -1,18 +1,20 @@
 {
  lib,
  stdenv,
-  fetchurl,
+  fetchFromGitHub,
  libiconv,
  recode,
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "enca";
-  version = "1.19";
+  version = "1.22";

-  src = fetchurl {
-    url = "https://dl.cihar.com/enca/enca-${finalAttrs.version}.tar.xz";
-    sha256 = "1f78jmrggv3jymql8imm5m9yc8nqjw5l99mpwki2245l8357wj1s";
+  src = fetchFromGitHub {
+    owner = "Project-OSS-Revival";
+    repo = "enca";
+    tag = finalAttrs.version;
+    hash = "sha256-TMWAGT3iY/ND8pB4THU4PbBGpb8EfT6z+peT8T6mp4o=";
  };

  buildInputs = [
@ -21,8 +23,9 @@ stdenv.mkDerivation (finalAttrs: {
  ];

  meta = {
+    changelog = "https://github.com/Project-OSS-Revival/enca/blob/${finalAttrs.src.tag}/ChangeLog";
    description = "Detects the encoding of text files and reencodes them";
-
+    homepage = "https://cihar.com/software/enca/";
    longDescription = ''
      Enca detects the encoding of text files, on the basis of knowledge
      of their language. It can also convert them to other encodings,
--- a/pkgs/by-name/ex/exploitdb/package.nix
+++ b/pkgs/by-name/ex/exploitdb/package.nix
@ -6,13 +6,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "exploitdb";
-  version = "2026-05-22";
+  version = "2026-05-27";

  src = fetchFromGitLab {
    owner = "exploit-database";
    repo = "exploitdb";
    tag = finalAttrs.version;
-    hash = "sha256-DzTgrRjonZgvkLfXpt7oxlmxYD+y3lALTpyAsTv9Y0A=";
+    hash = "sha256-nLn9QpHEF5TCMP0wKBSemQV9VA/viwYzjNlsGSpQf4Q=";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/by-name/fa/fastnetmon-advanced/package.nix
+++ b/pkgs/by-name/fa/fastnetmon-advanced/package.nix
@ -9,11 +9,11 @@

 stdenv.mkDerivation rec {
  pname = "fastnetmon-advanced";
-  version = "2.0.372";
+  version = "2.0.380";

  src = fetchurl {
-    url = "https://repo.fastnetmon.com/fastnetmon_ubuntu_jammy/pool/fastnetmon/f/fastnetmon/fastnetmon_${version}_amd64.deb";
-    hash = "sha256-FwYAbTBkk+AciDVxTIimswsB0M3gbzKX+03PD0fLMsY=";
+    url = "https://repo.fastnetmon.com/fastnetmon_ubuntu_noble/pool/fastnetmon/f/fastnetmon/fastnetmon_${version}_amd64.deb";
+    hash = "sha256-4hCrDaFat0kEbyzKg6nHdV+LlqCBYYJEojyvXyPYKD0=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/ff/ffmpeg-normalize/package.nix
+++ b/pkgs/by-name/ff/ffmpeg-normalize/package.nix
@ -7,13 +7,13 @@

 python3Packages.buildPythonApplication rec {
  pname = "ffmpeg-normalize";
-  version = "1.37.7";
+  version = "1.37.8";
  pyproject = true;

  src = fetchPypi {
    inherit version;
    pname = "ffmpeg_normalize";
-    hash = "sha256-8V9C5auAvrmvq5aeaRjCy9y2/c7wm4/7Yb73dBgvj5s=";
+    hash = "sha256-9pSVrYTTaxjGCty2pHPtaaSSwCkGDLoNK2wltTwOL3c=";
  };

  build-system = with python3Packages; [ uv-build ];
--- a/pkgs/by-name/fo/forgejo-runner/package.nix
+++ b/pkgs/by-name/fo/forgejo-runner/package.nix
@ -52,17 +52,17 @@ let
 in
 buildGoModule (finalAttrs: {
  pname = "forgejo-runner";
-  version = "12.10.1";
+  version = "12.10.2";

  src = fetchFromGitea {
    domain = "code.forgejo.org";
    owner = "forgejo";
    repo = "runner";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-OBMduRaGSVPojSAr6DKPbAdUyuw1MSCpipRv+EA5OGw=";
+    hash = "sha256-Uo+x02HgpfOY+KXug7cmnW4d85AlX6wqz+nYGF/JrHk=";
  };

-  vendorHash = "sha256-V9dEHNp80oS7NfsGIlKgFyHD1PmMm2bCqydVADpphuA=";
+  vendorHash = "sha256-0gOftkxkBPziU0Tm8lIiD72rXcMMY5M57G9/Bt/mneI=";

  nativeBuildInputs = [ makeWrapper ];

--- a/pkgs/by-name/gi/github-desktop/package.nix
+++ b/pkgs/by-name/gi/github-desktop/package.nix
@ -35,13 +35,13 @@ in

 stdenv.mkDerivation (finalAttrs: {
  pname = "github-desktop";
-  version = "3.5.10";
+  version = "3.5.11";

  src = fetchFromGitHub {
    owner = "desktop";
    repo = "desktop";
    tag = "release-${finalAttrs.version}";
-    hash = "sha256-AG5YiX8Jyi3ebgPSU4he2UamEdxgTjEYjezh2WkZjC8=";
+    hash = "sha256-nW+yq330lQRfo1RtxUtbkQ336WeE8BjC9jYAIibfdXo=";
    fetchSubmodules = true;
    postCheckout = "git -C $out rev-parse HEAD > $out/.gitrev";
  };
--- a/pkgs/by-name/gl/glfw3/package.nix
+++ b/pkgs/by-name/gl/glfw3/package.nix
@ -34,6 +34,11 @@ stdenv.mkDerivation {
  pname = "glfw${lib.optionalString withMinecraftPatch "-minecraft"}";
  inherit version;

+  outputs = [
+    "out"
+    "dev"
+  ];
+
  src = fetchFromGitHub {
    owner = "glfw";
    repo = "GLFW";
--- a/pkgs/by-name/go/goshs/package.nix
+++ b/pkgs/by-name/go/goshs/package.nix
@ -8,16 +8,16 @@

 buildGoModule (finalAttrs: {
  pname = "goshs";
-  version = "2.0.8";
+  version = "2.0.9";

  src = fetchFromGitHub {
    owner = "patrickhener";
    repo = "goshs";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-xGV9Sr+IAkGrDv6Qz2mgDS6vL9oBj9l7AuZ13SW91FE=";
+    hash = "sha256-NAq3fBjhiGIP9zA/s6wYaQ0nDju6hZu/g2RPIIEO41g=";
  };

-  vendorHash = "sha256-3+MGBaFWmMf2gDiZhYUxHFNmEfD/Xr1lNddlA5FQLUE=";
+  vendorHash = "sha256-nVg+ALvvZYG+9JFiNGaT/EQO8IdZK3EO8UQoAp29KNQ=";

  ldflags = [ "-s" ];

--- a/pkgs/by-name/ht/html2pdf/package.nix
+++ b/pkgs/by-name/ht/html2pdf/package.nix
@ -6,6 +6,7 @@
  makeWrapper,
  chromium,
  withChromium ? (lib.meta.availableOn stdenv.hostPlatform chromium),
+  versionCheckHook,
  nix-update-script,
 }:

@ -41,6 +42,11 @@ rustPlatform.buildRustPackage (finalAttrs: {
    ''
  );

+  doInstallCheck = true;
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+
  passthru.updateScript = nix-update-script { };

  meta = {
--- a/pkgs/by-name/jm/jmol/package.nix
+++ b/pkgs/by-name/jm/jmol/package.nix
@ -31,7 +31,7 @@ let
  };
 in
 stdenv.mkDerivation (finalAttrs: {
-  version = "16.3.49";
+  version = "16.4.1";
  pname = "jmol";

  src =
@ -40,7 +40,7 @@ stdenv.mkDerivation (finalAttrs: {
    in
    fetchurl {
      url = "mirror://sourceforge/jmol/Jmol/Version%20${baseVersion}/Jmol%20${finalAttrs.version}/Jmol-${finalAttrs.version}-binary.tar.gz";
-      hash = "sha256-OOHqRgkgG51o8mxo7lDAEQeCFoBSxdwdX72CUYdmRKw=";
+      hash = "sha256-n7Ql/pK/N6maG2EjrgdRz+HUvn+JwkZpvRQyuElKrHI=";
    };

  patchPhase = ''
--- a/pkgs/by-name/kn/knope/package.nix
+++ b/pkgs/by-name/kn/knope/package.nix
@ -11,16 +11,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "knope";
-  version = "0.22.4";
+  version = "0.23.0";

  src = fetchFromGitHub {
    owner = "knope-dev";
    repo = "knope";
    tag = "knope/v${finalAttrs.version}";
-    hash = "sha256-2lZhetmctKSfLXd7jvepm1+Vc0db1teryx6tehEHCJM=";
+    hash = "sha256-Brr/MnJwgyGRjBrY6H2uUnVXFYWdUAHzLolFBgszkp0=";
  };

-  cargoHash = "sha256-L7IT7nWinyWiuIwlBmGmHDyKB+o3LJBanHVFRQpWB+c=";
+  cargoHash = "sha256-vjjwoBHgmjzMVDyscfde/fRwm7QWFTuD9EX1+OowUm8=";

  nativeBuildInputs = [ pkg-config ];

--- a/pkgs/by-name/li/libnatspec/package.nix
+++ b/pkgs/by-name/li/libnatspec/package.nix
@ -1,7 +1,7 @@
 {
  lib,
  stdenv,
-  fetchurl,
+  fetchFromGitHub,
  autoreconfHook,
  popt,
  libiconv,
@ -9,11 +9,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "libnatspec";
-  version = "0.3.0";
+  version = "0.3.3";

-  src = fetchurl {
-    url = "mirror://sourceforge/natspec/libnatspec-${finalAttrs.version}.tar.bz2";
-    sha256 = "0wffxjlc8svilwmrcg3crddpfrpv35mzzjgchf8ygqsvwbrbb3b7";
+  src = fetchFromGitHub {
+    owner = "Etersoft";
+    repo = "libnatspec";
+    rev = "0.3.3-alt1";
+    hash = "sha256-lg3kjrvv7G+nX6xlR7TQKvXqQJFcQTHarSpD0qYLZsw=";
  };

  nativeBuildInputs = [ autoreconfHook ];
@ -27,7 +29,7 @@ stdenv.mkDerivation (finalAttrs: {
  propagatedBuildInputs = [ libiconv ];

  meta = {
-    homepage = "https://natspec.sourceforge.net/";
+    homepage = "https://github.com/Etersoft/libnatspec";
    description = "Library intended to smooth national specificities in using of programs";
    mainProgram = "natspec";
    platforms = lib.platforms.unix;
--- a/pkgs/by-name/mi/microsoft-edge/package.nix
+++ b/pkgs/by-name/mi/microsoft-edge/package.nix
@ -292,7 +292,6 @@ stdenvNoCC.mkDerivation (finalAttrs: {
      ulrikstrid
      maeve-oake
      leleuvilela
-      bricklou
      jonhermansen
      iedame
    ];
--- a/pkgs/by-name/mi/minio-cpp/package.nix
+++ b/pkgs/by-name/mi/minio-cpp/package.nix
@ -15,13 +15,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "minio-cpp";
-  version = "0.3.0";
+  version = "0.4.0";

  src = fetchFromGitHub {
    owner = "minio";
    repo = "minio-cpp";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-JKC9SYgb5+nQ3M5C6j6QLfltM+U18oaFrep4gOKPlCI=";
+    hash = "sha256-4XQapUPNacgwXOm64efxOJnhqBgeJt2pSoWKBzp7obc=";
  };

  postPatch = ''
--- a/pkgs/by-name/mi/mitmproxy2swagger/package.nix
+++ b/pkgs/by-name/mi/mitmproxy2swagger/package.nix
@ -6,14 +6,14 @@

 python3.pkgs.buildPythonApplication (finalAttrs: {
  pname = "mitmproxy2swagger";
-  version = "0.14.0";
+  version = "0.15.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "alufers";
    repo = "mitmproxy2swagger";
    tag = finalAttrs.version;
-    hash = "sha256-bQ9zjRsMrC/B118iP2hevj2hhSFD7FTnsCe6lUMwYSI=";
+    hash = "sha256-J5vuT0p+mc1XXEl7GnXbT/J4mTjzva66o3cUizBWMko=";
  };

  pythonRelaxDeps = [
@ -21,7 +21,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
    "ruamel.yaml"
  ];

-  build-system = with python3.pkgs; [ poetry-core ];
+  build-system = with python3.pkgs; [ hatchling ];

  dependencies = with python3.pkgs; [
    json-stream
--- a/pkgs/by-name/ne/neovim-unwrapped/package.nix
+++ b/pkgs/by-name/ne/neovim-unwrapped/package.nix
@ -287,6 +287,7 @@ stdenv.mkDerivation (
      '';
      homepage = "https://neovim.io";
      changelog = "https://github.com/neovim/neovim/releases/tag/${finalAttrs.src.tag}";
+      donationPage = "https://neovim.io/sponsors/";
      mainProgram = "nvim";
      # "Contributions committed before b17d96 by authors who did not sign the
      # Contributor License Agreement (CLA) remain under the Vim license.
--- a/pkgs/by-name/nv/nvidia-mig-parted/package.nix
+++ b/pkgs/by-name/nv/nvidia-mig-parted/package.nix
@ -6,13 +6,13 @@

 buildGoModule (finalAttrs: {
  pname = "nvidia-mig-parted";
-  version = "0.14.1";
+  version = "0.14.2";

  src = fetchFromGitHub {
    owner = "NVIDIA";
    repo = "mig-parted";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-05WbIEvHN/CAvd5ex4I8FZx0NreIg5QDOgXmAda/mzc=";
+    hash = "sha256-M6XgYh3qrNcSc0WF9uDFk+MOfaTxkoyUK0SJTQAEiVY=";
  };

  vendorHash = null;
--- a/pkgs/by-name/ob/obs-cmd/package.nix
+++ b/pkgs/by-name/ob/obs-cmd/package.nix
@ -6,16 +6,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "obs-cmd";
-  version = "0.31.3";
+  version = "1.0.0";

  src = fetchFromGitHub {
    owner = "grigio";
    repo = "obs-cmd";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-YJgZ9AhQkr5/AyqJ35czGPi5kdUM9V7o32pmx89r1bc=";
+    hash = "sha256-8lCqUN5FacDARZylR+s74l/mSP3Jy0GT5u03/WrUALM=";
  };

-  cargoHash = "sha256-cjoNIAHhk9VCW/MWwBTA2pMOuS47gk+qVkIXNUcEWxs=";
+  cargoHash = "sha256-Fyyr2oMHsIb9/jiqnzb94H5eknoy/WmwU7sL1cOxuPQ=";

  meta = {
    description = "Minimal CLI to control OBS Studio via obs-websocket";
--- a/pkgs/by-name/pe/penpot-desktop/package.nix
+++ b/pkgs/by-name/pe/penpot-desktop/package.nix
@ -2,7 +2,7 @@
  lib,
  buildNpmPackage,
  copyDesktopItems,
-  electron_39,
+  electron_41,
  fetchFromGitHub,
  jq,
  makeDesktopItem,
@ -15,17 +15,17 @@ let
  description = "Unofficial desktop application for the open-source design tool, Penpot";
  icon = "penpot";
  nodejs = nodejs_24;
-  electron = electron_39;
+  electron = electron_41;
 in
 buildNpmPackage rec {
  pname = "penpot-desktop";
-  version = "0.23.0";
+  version = "0.23.1";

  src = fetchFromGitHub {
    owner = "author-more";
    repo = "penpot-desktop";
    tag = "v${version}";
-    hash = "sha256-2thLD8ECfHZMD3Yw/lQgnCqqEGxCE1AXsHGP9JKof+Q=";
+    hash = "sha256-/vRF5eqtjdmd2Qmb+OAgKfLJmh78S0WrLWA94SeOJQA=";
  };

  makeCacheWritable = true;
@ -33,7 +33,7 @@ buildNpmPackage rec {
    "--engine-strict"
    "--legacy-peer-deps"
  ];
-  npmDepsHash = "sha256-uyt9gmmytDwSCnXk9HUBwJoPMcqMt2wLwHHmY2Kx0yk=";
+  npmDepsHash = "sha256-hu2v2Dw2SRs4Egmsi5hb81vgnZDjQahLXyAYm/uaMao=";
  # Do not run the default build script as it leads to errors caused by the electron-builder configuration
  dontNpmBuild = true;

--- a/pkgs/by-name/ph/phoenixd/package.nix
+++ b/pkgs/by-name/ph/phoenixd/package.nix
@ -11,7 +11,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "phoenixd";
-  version = "0.7.3";
+  version = "0.8.0";

  src =
    let
@ -28,10 +28,10 @@ stdenv.mkDerivation (finalAttrs: {
    fetchurl {
      url = "https://github.com/ACINQ/phoenixd/releases/download/v${finalAttrs.version}/phoenixd-${finalAttrs.version}-${suffix}.zip";
      hash = selectSystem {
-        aarch64-darwin = "sha256-tKTn6w2F6qKsn6ieob+gENL4/kF8CZU346KbjgYIXWU=";
-        x86_64-darwin = "sha256-9F5jngwx/O9Qklpzxlfd5SN94ds80cZzopRrXyPY+pQ=";
-        x86_64-linux = "sha256-MCYElD6mG5PNKcns5ZYsrCoEmS1JPySqFgDhuX2O6os=";
-        aarch64-linux = "sha256-xMiSxY7Q2witH0GR7lI2V6HU8noY8u4zYInhjM3y0wU=";
+        aarch64-darwin = "sha256-eVrwJGjXZNl9e2QGtVVEHjptCMPQgGaxljDEqr7LE7s=";
+        x86_64-darwin = "sha256-vHu+9GwN0jWvjH/bKceZHDPRidVLFLzzMen2Zc+L1ck=";
+        x86_64-linux = "sha256-n/yvAisqpnbHs3XV0sHq0sUpq0+mqXmG+3LXRNmrLpI=";
+        aarch64-linux = "sha256-mfhLpPXFvkO0mz4okdOXALIk8MR2CQQ8mZ6aI+QgNZs=";
      };
    };

--- a/pkgs/by-name/pi/picoshare/package.nix
+++ b/pkgs/by-name/pi/picoshare/package.nix
@ -9,16 +9,16 @@

 buildGoModule (finalAttrs: {
  pname = "picoshare";
-  version = "1.5.1";
+  version = "1.5.2";

  src = fetchFromGitHub {
    owner = "mtlynch";
    repo = "picoshare";
    tag = finalAttrs.version;
-    hash = "sha256-8mgrwnY0Y1CggAtc7BrAqC32+Wu82FQNhoK0ijM1RKw=";
+    hash = "sha256-iKLO0m9zPYGQB3aJxyYCs9sHSheihnKn8QWec4D+a4g=";
  };

-  vendorHash = "sha256-Wf0qKs/9XKnO2nx2KmTGPdqI0iFih30AGvOi94RPEjw=";
+  vendorHash = "sha256-X2vrEhgEnKKNXRyLCtT+wBbunFHgkcyWZh6DMpQieQ0=";

  ldflags = [
    # make sure build time is always set to 0 to make the build reproducible
--- a/pkgs/by-name/sa/sandhole/package.nix
+++ b/pkgs/by-name/sa/sandhole/package.nix
@ -10,21 +10,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "sandhole";
-  version = "0.9.4";
+  version = "0.9.5";

  src = fetchFromGitHub {
    owner = "EpicEric";
    repo = "sandhole";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-nACjMd1GGfopXTqkkJP3zOnFGqB4TeuJCoQWZXSnBiA=";
+    hash = "sha256-l+9DcqAxrrjLxs/7KxY6QlfIAlwMVjQztt4lgJJMsyI=";
  };

-  cargoHash = "sha256-n3VoLQP6jmYJvo/6GRXaB/u9XfewlOOt/zKD9YbCQzU=";
-
-  # All integration tests require networking.
-  postPatch = ''
-    echo "fn main() {}" > tests/integration/main.rs
-  '';
+  cargoHash = "sha256-euWvpEjSW2JeDysBul5eR4M27LwkRSZDlsp57lMBpAE=";

  nativeBuildInputs = [
    cmake
@ -34,11 +29,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
  strictDeps = true;

  useNextest = true;
-  checkFlags = [
-    # Some unit tests require networking.
-    "--skip"
-    "login"
-  ];
+  # Skip tests that require networking.
+  cargoTestFlags = [ "--profile=no-network" ];

  doInstallCheck = true;
  nativeInstallCheckInputs = [ versionCheckHook ];
@ -54,6 +46,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
    license = lib.licenses.mit;
    mainProgram = "sandhole";
    maintainers = with lib.maintainers; [ EpicEric ];
-    platforms = lib.platforms.linux ++ lib.platforms.darwin;
+    platforms = lib.platforms.all;
  };
 })
--- a/pkgs/by-name/sh/shopware-cli/package.nix
+++ b/pkgs/by-name/sh/shopware-cli/package.nix
@ -11,12 +11,12 @@

 buildGoModule (finalAttrs: {
  pname = "shopware-cli";
-  version = "0.14.8";
+  version = "0.15.2";
  src = fetchFromGitHub {
    repo = "shopware-cli";
    owner = "shopware";
    tag = finalAttrs.version;
-    hash = "sha256-yN6yuGnZv6BsXoERUdA3aBGEmri1hqmPsbIYsX7HE5Q=";
+    hash = "sha256-HWIfumFTBBLMjXa+2AHzXS1UR8Z91C6/x9pHXQcO6WE=";
  };

  nativeBuildInputs = [
@ -28,7 +28,7 @@ buildGoModule (finalAttrs: {
    dart-sass
  ];

-  vendorHash = "sha256-itrSY18wZnY0j4wq2mJ+2ugM0A2SKORENJ0iwWg+s+U=";
+  vendorHash = "sha256-KQDPTyw24BqjetYSJfMeSrgO9mgHxIBuKgp0/0H76R0=";

  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
    installShellCompletion --cmd shopware-cli \
--- a/pkgs/by-name/sp/speed-cloudflare-cli/package.nix
+++ b/pkgs/by-name/sp/speed-cloudflare-cli/package.nix
@ -1,32 +1,52 @@
 {
  lib,
+  buildNpmPackage,
  fetchFromGitHub,
-  stdenv,
+  applyPatches,
+  fetchpatch,
  nodejs,
 }:
-stdenv.mkDerivation {
+buildNpmPackage {
  pname = "speed-cloudflare-cli";
-  version = "2.0.3-unstable-2024-05-15";
+  version = "2.0.3-unstable-2025-07-31";

-  src = fetchFromGitHub {
-    owner = "KNawm";
-    repo = "speed-cloudflare-cli";
-    rev = "dd301195e7def359a39cceeba16b1c0bedac8f5d";
-    sha256 = "sha256-kxLeQUdJbkmApf5Af3Mgd3WvS3GhXXOIvA4gNB55TGM=";
+  src = applyPatches {
+    src = fetchFromGitHub {
+      owner = "KNawm";
+      repo = "speed-cloudflare-cli";
+      rev = "8eb34f4bd4f63493fbd93b1659389b9a1e5e4a36";
+      sha256 = "sha256-kJ//zXBW2IQ5V5dJfAm8iGxf9QILH0uloNYiwG3pTe4=";
+    };
+
+    # Applies the follwing PR:
+    # https://github.com/KNawm/speed-cloudflare-cli/pull/38
+    patches = [
+      # fix: handle non-array response from /locations and format
+      (fetchpatch {
+        url = "https://github.com/KNawm/speed-cloudflare-cli/commit/2682f167a1776de2f0c8085b591b06319a2aac7d.patch";
+        hash = "sha256-pkGNg7NwSP9QrBI2e0q44ZyJ8ckp0Pw/brpDkZkevdk=";
+      })
+      # docs: add logging for API errors as suggested by code review
+      (fetchpatch {
+        url = "https://github.com/KNawm/speed-cloudflare-cli/commit/2cb89f9b9af0f43c75ed2ea8f6c0a8519766b7c8.patch";
+        hash = "sha256-tLkyfXYd1s4FaMOwffyyObXZyIFlkvWvy7YkqBxU1SU=";
+      })
+    ];
  };

-  nativeBuildInputs = [ nodejs ];
+  postInstall = ''
+    mkdir -p "$out/bin"

-  installPhase = ''
-    mkdir -p $out/bin
-
-    install -Dm755 $src/cli.js $out/bin/speed-cloudflare-cli
-    install -Dm644 $src/chalk.js $out/bin/chalk.js
-    install -Dm644 $src/stats.js $out/bin/stats.js
-
-    patchShebangs $out/bin/speed-cloudflare-cli
+    # Create an executable wrapper
+    makeWrapper ${lib.getExe nodejs} "$out/bin/speed-cloudflare-cli" \
+      --add-flags "$out/lib/node_modules/speed-cloudflare-cli/cli.js"
  '';

+  npmDepsHash = "sha256-CoirJgdpF9WEgbaXQbq5QlRO9wstZbNxIW2L1cJ+nXg=";
+
+  dontBuild = true;
+  dontNpmBuild = true;
+
  meta = {
    description = "Measure the speed and consistency of your internet connection using speed.cloudflare.com";
    homepage = "https://github.com/KNawm/speed-cloudflare-cli";
--- a/pkgs/by-name/ve/velocity/package.nix
+++ b/pkgs/by-name/ve/velocity/package.nix
@ -34,13 +34,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "velocity";
-  version = "3.5.0-unstable-2026-05-09";
+  version = "3.5.0-unstable-2026-05-24";

  src = fetchFromGitHub {
    owner = "PaperMC";
    repo = "Velocity";
-    rev = "9c0c9b02187c20bb767ce16ac7685580430d9b10";
-    hash = "sha256-SPsI/bAlO3aQOT+84tJJZ0+UjbR4REXzaiFr6952/sI=";
+    rev = "25fbd833cd847a76f1e46ce15b70e077e41b72e2";
+    hash = "sha256-sCAD4Altk6aZyP4eR7+QnkGlo8Rubcd1EzBCbz92ycg=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/vl/vlc/package.nix
+++ b/pkgs/by-name/vl/vlc/package.nix
@ -314,6 +314,7 @@ stdenv.mkDerivation (finalAttrs: {
  meta = {
    description = "Cross-platform media player and streaming server";
    homepage = "https://www.videolan.org/vlc/";
+    donationPage = "https://www.videolan.org/contribute.html#money";
    license = lib.licenses.lgpl21Plus;
    maintainers = [ ];
    platforms = lib.platforms.linux;
--- a/pkgs/by-name/wa/wapiti/package.nix
+++ b/pkgs/by-name/wa/wapiti/package.nix
@ -11,14 +11,14 @@

 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "wapiti";
-  version = "3.2.10";
+  version = "3.3.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "wapiti-scanner";
    repo = "wapiti";
    tag = finalAttrs.version;
-    hash = "sha256-/w5t/BcMPewl0Wp6vx9kZamqHArb7+fnfktfEIUDL8Y=";
+    hash = "sha256-hUkEwyIzYhlip6vtwO8EYcUsL5B/ZVnbJKpTR6osVuc=";
  };

  pythonRelaxDeps = true;
@ -87,11 +87,15 @@ python3Packages.buildPythonApplication (finalAttrs: {
    "test_explorer_extract_links"
    "test_explorer_filtering"
    "test_false"
+    "test_fetch_source_files_typo3"
+    "test_fetch_source_files"
    "test_frame"
    "test_headers_detection"
    "test_html_detection"
    "test_implies_detection"
    "test_inclusion_detection"
+    "test_magento_multi_version_detected"
+    "test_magento_version_detected"
    "test_merge_with_and_without_redirection"
    "test_meta_detection"
    "test_multi_detection"
--- a/pkgs/by-name/xp/xp-pen-g430-driver/package.nix
+++ b/pkgs/by-name/xp/xp-pen-g430-driver/package.nix
@ -1,51 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchzip,
-  autoPatchelfHook,
-  libusb1,
-  libx11,
-  libxtst,
-  qt5,
-  libglvnd,
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "xp-pen-g430-driver";
-  version = "1.2.13.1";
-
-  src = fetchzip {
-    url = "https://archive.org/download/linux-pentablet-v-1.2.13.1.tar.gz-20200428/Linux_Pentablet_V1.2.13.1.tar.gz%2820200428%29.zip/Linux_Pentablet_V1.2.13.1.tar.gz";
-    name = "xp-pen-g430-driver-${finalAttrs.version}.tar.gz";
-    hash = "sha256-Wavf4EAzR/NX3GOfdAEdFX08gkD03FVvAkIl37Zmipc=";
-  };
-
-  nativeBuildInputs = [
-    autoPatchelfHook
-    qt5.wrapQtAppsHook
-  ];
-
-  buildInputs = [
-    libusb1
-    libx11
-    libxtst
-    qt5.qtbase
-    libglvnd
-    (lib.getLib stdenv.cc.cc)
-  ];
-
-  installPhase = ''
-    mkdir -p $out/bin
-    cp Pentablet_Driver $out/bin/pentablet-driver
-    cp config.xml $out/bin/config.xml
-  '';
-
-  meta = {
-    homepage = "https://www.xp-pen.com/download-46.html";
-    description = "Driver for XP-PEN Pentablet drawing tablets";
-    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
-    license = lib.licenses.unfree;
-    platforms = [ "x86_64-linux" ];
-    maintainers = [ ];
-  };
-})
--- a/pkgs/desktops/enlightenment/evisum/default.nix
+++ b/pkgs/desktops/enlightenment/evisum/default.nix
@ -11,11 +11,11 @@

 stdenv.mkDerivation rec {
  pname = "evisum";
-  version = "2.0.9";
+  version = "2.0.10";

  src = fetchurl {
    url = "https://download.enlightenment.org/rel/apps/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "iTmeXrNqltpALEnJRz4oiNzikGLJzprmeZH7/3RmEkk=";
+    sha256 = "ipp0Yv6uOcEnymkq6A534/pch8Eb2v7E38BgT99XNB4=";
  };

  nativeBuildInputs = [
@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
  meta = {
    description = "System and process monitor written with EFL";
    mainProgram = "evisum";
-    homepage = "https://www.enlightenment.org";
+    homepage = "https://git.enlightenment.org/enlightenment/evisum";
    license = with lib.licenses; [ isc ];
    platforms = lib.platforms.linux;
    teams = [ lib.teams.enlightenment ];
--- a/pkgs/development/interpreters/erlang/27.nix
+++ b/pkgs/development/interpreters/erlang/27.nix
@ -1,6 +1,6 @@
 genericBuilder:

 genericBuilder {
-  version = "27.3.4.11";
-  hash = "sha256-yOgsaeUv6GwFX6qPVb28zet6Hli5vg/PZCKW2s2/JEA=";
+  version = "27.3.4.12";
+  hash = "sha256-RnCBGuqEEJ+3kkbiVNLSb8sAh2i9SNyH9ixkqtAbjsk=";
 }
--- a/pkgs/development/interpreters/erlang/28.nix
+++ b/pkgs/development/interpreters/erlang/28.nix
@ -1,6 +1,6 @@
 genericBuilder:

 genericBuilder {
-  version = "28.5";
-  hash = "sha256-A4gIjfWsrfZR89xNWyynTAdJtGj6ZWth3xIQBMLqcpc=";
+  version = "28.5.0.1";
+  hash = "sha256-tZQQCBDpDcrN9QX8Qwz6HqNVATck1+emGVOviEhqsLc=";
 }
--- a/pkgs/development/interpreters/erlang/29.nix
+++ b/pkgs/development/interpreters/erlang/29.nix
@ -1,6 +1,6 @@
 genericBuilder:

 genericBuilder {
-  version = "29.0";
-  hash = "sha256-AUt/Mlp84cVEypqDsyD5VbywYEGda0eikMDmSnzlKUI=";
+  version = "29.0.1";
+  hash = "sha256-0I82VBCgA8KfdNYkNWyqcH+f0Kc6al11BAErtxfVDZo=";
 }
--- a/pkgs/development/libraries/ffmpeg/generic.nix
+++ b/pkgs/development/libraries/ffmpeg/generic.nix
@ -1063,6 +1063,7 @@ stdenv.mkDerivation (
        No matter if they were designed by some standards committee, the community or
        a corporation.
      '';
+      donationPage = "https://ffmpeg.org/donations.html";
      license =
        with lib.licenses;
        [ lgpl21Plus ]
--- a/pkgs/development/ocaml-modules/lua-ml/default.nix
+++ b/pkgs/development/ocaml-modules/lua-ml/default.nix
@ -2,23 +2,24 @@
  lib,
  fetchFromGitHub,
  buildDunePackage,
+  menhir,
 }:
 buildDunePackage (finalAttrs: {
  pname = "lua-ml";
-  version = "0.9.4";
-
-  minimalOCamlVersion = "4.07";
+  version = "0.9.5";

  src = fetchFromGitHub {
    owner = "lindig";
    repo = "lua-ml";
    tag = finalAttrs.version;
-    hash = "sha256-kMBTHzmlrRWNpWwG321jYcM61rE1J3YQkygSrfnZ6Wc=";
+    hash = "sha256-+kg/hwcmRoM6sSL2GXOC2GrnJRu52BR5UiNu3nl5Lnk=";
  };

+  nativeBuildInputs = [ menhir ];
+
  meta = {
    description = "Embeddable Lua 2.5 interpreter implemented in OCaml";
-    inherit (finalAttrs.src.meta) homepage;
+    homepage = "https://github.com/lindig/lua-ml";
    license = lib.licenses.bsd2;
    maintainers = [ lib.maintainers.vbgl ];
  };
--- a/pkgs/development/ocaml-modules/tar/default.nix
+++ b/pkgs/development/ocaml-modules/tar/default.nix
@ -2,22 +2,18 @@
  lib,
  fetchurl,
  buildDunePackage,
-  camlp-streams,
  decompress,
 }:

-buildDunePackage rec {
+buildDunePackage (finalAttrs: {
  pname = "tar";
-  version = "3.3.0";
+  version = "3.5.0";
  src = fetchurl {
-    url = "https://github.com/mirage/ocaml-tar/releases/download/v${version}/tar-${version}.tbz";
-    hash = "sha256-89aw1nf9QP0euAvMxgu2EyIDWL5Y9mxfqL8CV/Pl65Y=";
+    url = "https://github.com/mirage/ocaml-tar/releases/download/v${finalAttrs.version}/tar-${finalAttrs.version}.tbz";
+    hash = "sha256-haKmHTDu+B5L+B4LQp0hPOtd1urtzWDJeeHLuRFJ+Qw=";
  };

-  minimalOCamlVersion = "4.08";
-
  propagatedBuildInputs = [
-    camlp-streams
    decompress
  ];

@ -29,4 +25,4 @@ buildDunePackage rec {
    license = lib.licenses.mit;
    maintainers = [ lib.maintainers.ulrikstrid ];
  };
-}
+})
--- a/pkgs/development/ocaml-modules/tar/eio.nix
+++ b/pkgs/development/ocaml-modules/tar/eio.nix
@ -2,7 +2,8 @@
  buildDunePackage,
  tar,
  eio,
-  git,
+  alcotest,
+  eio_main,
 }:

 buildDunePackage {
@ -16,8 +17,9 @@ buildDunePackage {
    eio
  ];

-  nativeCheckInputs = [
-    git
+  checkInputs = [
+    alcotest
+    eio_main
  ];

  meta = tar.meta // {
--- a/pkgs/development/ocaml-modules/tar/unix.nix
+++ b/pkgs/development/ocaml-modules/tar/unix.nix
@ -1,6 +1,8 @@
 {
  buildDunePackage,
  tar,
+  fpath,
+  logs,
  lwt,
  git,
 }:
@ -11,6 +13,8 @@ buildDunePackage {

  propagatedBuildInputs = [
    tar
+    fpath
+    logs
    lwt
  ];

--- a/pkgs/development/python-modules/azure-mgmt-policyinsights/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-policyinsights/default.nix
@ -1,42 +1,44 @@
 {
  lib,
-  buildPythonPackage,
-  fetchPypi,
-  msrest,
-  msrestazure,
  azure-common,
  azure-mgmt-core,
-  azure-mgmt-nspkg,
-  isPy3k,
+  buildPythonPackage,
+  fetchPypi,
+  isodate,
+  setuptools,
+  typing-extensions,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "azure-mgmt-policyinsights";
-  version = "1.0.0";
-  format = "setuptools";
+  version = "1.0.1";
+  pyproject = true;

  src = fetchPypi {
-    inherit pname version;
-    extension = "zip";
-    sha256 = "75103fb4541aeae30bb687dee1fedd9ca65530e6b97b2d9ea87f74816905202a";
+    pname = "azure_mgmt_policyinsights";
+    inherit (finalAttrs) version;
+    hash = "sha256-rsmIKwVcRrWUxDjJf1Cj4YczEooRUwRpzgl6fFmaDl0=";
  };

-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
    azure-common
    azure-mgmt-core
-    msrest
-    msrestazure
-  ]
-  ++ lib.optionals (!isPy3k) [ azure-mgmt-nspkg ];
+    isodate
+    typing-extensions
+  ];

  # has no tests
  doCheck = false;
+
  pythonImportsCheck = [ "azure.mgmt.policyinsights" ];

  meta = {
-    description = "This is the Microsoft Azure Policy Insights Client Library";
-    homepage = "https://github.com/Azure/azure-sdk-for-python";
+    description = "Microsoft Azure Policy Insights Client Library";
+    homepage = "https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/policyinsights/azure-mgmt-policyinsights";
+    changelog = "https://github.com/Azure/azure-sdk-for-python/blob/azure-mgmt-policyinsights_${finalAttrs.version}/sdk/policyinsights/azure-mgmt-policyinsights/CHANGELOG.md";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ maxwilson ];
  };
-}
+})
--- a/pkgs/development/python-modules/blocksat-cli/default.nix
+++ b/pkgs/development/python-modules/blocksat-cli/default.nix
@ -16,14 +16,14 @@

 buildPythonPackage rec {
  pname = "blocksat-cli";
-  version = "2.5.1";
+  version = "2.5.2";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "Blockstream";
    repo = "satellite";
    tag = "v${version}";
-    hash = "sha256-SH1MZx/ZkhhWhxhREqFCGoob58J2XMZSpe+q7UgiyF4=";
+    hash = "sha256-KwLUE8+/SJ178az/j9WONwwrTsos1vrsP2hpeczNt4Y=";
  };

  # Upstream setup.py installs both the CLI and GUI versions.
--- a/pkgs/development/python-modules/cynthion/default.nix
+++ b/pkgs/development/python-modules/cynthion/default.nix
@ -51,6 +51,8 @@ buildPythonPackage rec {
    setuptools
  ];

+  pythonRelaxDeps = [ "pygreat" ];
+
  pythonRemoveDeps = [ "future" ];

  dependencies = [
--- a/pkgs/development/python-modules/diffusers/default.nix
+++ b/pkgs/development/python-modules/diffusers/default.nix
@ -45,18 +45,22 @@

 buildPythonPackage rec {
  pname = "diffusers";
-  version = "0.36.0";
+  version = "0.38.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "huggingface";
    repo = "diffusers";
    tag = "v${version}";
-    hash = "sha256-bDGiY1PR3JilEzkynUGE5IwDA+bgVQWW1jpGEfftI3U=";
+    hash = "sha256-FyXQJh4i/m9lAD2Sz45YWc+KIFMA+xQLb3ErudO9voY=";
  };

  build-system = [ setuptools ];

+  pythonRelaxDeps = [
+    "safetensors"
+  ];
+
  dependencies = [
    filelock
    huggingface-hub
--- a/pkgs/development/python-modules/genai-prices/default.nix
+++ b/pkgs/development/python-modules/genai-prices/default.nix
@ -7,20 +7,20 @@
  uv-build,

  # dependencies
-  httpx,
+  httpx2,
  pydantic,
 }:

 buildPythonPackage (finalAttrs: {
  pname = "genai-prices";
-  version = "0.0.61";
+  version = "0.0.62";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "pydantic";
    repo = "genai-prices";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-3w3V6uIeRBTpc2rtkVRVsLlWGzHHksklv3YyCw6/VEI=";
+    hash = "sha256-VUhJwv15cHqIsZc103aoTX1D8kzt+cy/jdHUi++0+/w=";
  };

  sourceRoot = "${finalAttrs.src.name}/packages/python";
@ -30,7 +30,7 @@ buildPythonPackage (finalAttrs: {
  ];

  dependencies = [
-    httpx
+    httpx2
    pydantic
  ];

--- a/pkgs/development/python-modules/http-sf/default.nix
+++ b/pkgs/development/python-modules/http-sf/default.nix
@ -8,14 +8,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "http-sf";
-  version = "1.2.1";
+  version = "1.3.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "mnot";
    repo = "http-sf";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-uA/LosjGuRd8h/xU663peP1eSrz46W79uPohrm75irc=";
+    hash = "sha256-sqLYD/JIRvKl6ciVDfSWNAUhhSHhdw7UFnDyHiV5sZg=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/httpcore2/default.nix
+++ b/pkgs/development/python-modules/httpcore2/default.nix
@ -0,0 +1,95 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+
+  # build-system
+  hatchling,
+  hatch-fancy-pypi-readme,
+  uv-dynamic-versioning,
+
+  # dependencies
+  certifi,
+  h11,
+
+  # optional dependencies
+  h2,
+  socksio,
+  trio,
+  anyio,
+
+  # tests
+  pytestCheckHook,
+  pytest-httpbin,
+  pytest-trio,
+
+  # reverse deps
+  httpx2,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "httpcore2";
+  version = "2.2.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "pydantic";
+    repo = "httpx2";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-RdoMDF5XVOkb4JCmytdF0JmBfTUcHuM1N+SD8r+RNiU=";
+  };
+
+  postPatch = ''
+    pushd src/httpcore2
+  '';
+
+  build-system = [
+    hatchling
+    hatch-fancy-pypi-readme
+    uv-dynamic-versioning
+  ];
+
+  dependencies = [
+    certifi
+    h11
+  ];
+
+  optional-dependencies = {
+    asyncio = [ anyio ];
+    http2 = [ h2 ];
+    socks = [ socksio ];
+    trio = [ trio ];
+  };
+
+  pythonImportsCheck = [
+    "httpcore2"
+  ];
+
+  preCheck = ''
+    popd
+  '';
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    pytest-httpbin
+    pytest-trio
+  ]
+  ++ lib.concatAttrValues finalAttrs.passthru.optional-dependencies;
+
+  pytestFlags = [ "tests/httpcore2" ];
+
+  passthru.tests = {
+    inherit httpx2;
+  };
+
+  __darwinAllowLocalNetworking = true;
+  __structuredAttrs = true;
+
+  meta = {
+    description = "A next generation HTTP client for Python";
+    homepage = "https://github.com/pydantic/httpx2";
+    changelog = "https://github.com/pydantic/httpx2/blob/${finalAttrs.src.tag}/src/httpcore2/CHANGELOG.md";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ hexa ];
+  };
+})
--- a/pkgs/development/python-modules/httpx2/default.nix
+++ b/pkgs/development/python-modules/httpx2/default.nix
@ -0,0 +1,122 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  isPyPy,
+  pythonOlder,
+
+  # build-system
+  hatchling,
+  hatch-fancy-pypi-readme,
+  uv-dynamic-versioning,
+
+  # dependencies
+  anyio,
+  certifi,
+  httpcore2,
+  idna,
+
+  # optional dependencies
+  brotli,
+  brotlicffi,
+  click,
+  h2,
+  pygments,
+  rich,
+  socksio,
+  zstandard,
+
+  # tests
+  chardet,
+  pytestCheckHook,
+  pytest-httpbin,
+  pytest-trio,
+  trustme,
+  uvicorn,
+
+  # reverse deps
+  httpx2,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "httpx2";
+  version = "2.2.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "pydantic";
+    repo = "httpx2";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-RdoMDF5XVOkb4JCmytdF0JmBfTUcHuM1N+SD8r+RNiU=";
+  };
+
+  postPatch = ''
+    pushd src/httpx2
+  '';
+
+  build-system = [
+    hatchling
+    hatch-fancy-pypi-readme
+    uv-dynamic-versioning
+  ];
+
+  dependencies = [
+    anyio
+    certifi
+    httpcore2
+    idna
+  ];
+
+  optional-dependencies = {
+    brotli = if isPyPy then [ brotlicffi ] else [ brotli ];
+    cli = [
+      click
+      pygments
+      rich
+    ];
+    http2 = [ h2 ];
+    socks = [ socksio ];
+    zstd = lib.optionals (pythonOlder "3.14") [ zstandard ];
+  };
+
+  pythonImportsCheck = [
+    "httpx2"
+  ];
+
+  preCheck = ''
+    popd
+  '';
+
+  nativeCheckInputs = [
+    chardet
+    pytestCheckHook
+    # pytest-httpbin
+    pytest-trio
+    trustme
+    uvicorn
+  ]
+  ++ lib.concatAttrValues finalAttrs.passthru.optional-dependencies;
+
+  pytestFlags = [ "tests/httpx2" ];
+
+  disabledTests = [
+    # network access
+    "test_async_proxy_close"
+    "test_sync_proxy_close"
+  ];
+
+  passthru.tests = {
+    inherit httpx2;
+  };
+
+  __darwinAllowLocalNetworking = true;
+  __structuredAttrs = true;
+
+  meta = {
+    description = "A next generation HTTP client for Python";
+    homepage = "https://github.com/pydantic/httpx2";
+    changelog = "https://github.com/pydantic/httpx2/blob/${finalAttrs.src.tag}/src/httpx2/CHANGELOG.md";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ hexa ];
+  };
+})
--- a/pkgs/development/python-modules/iocx/default.nix
+++ b/pkgs/development/python-modules/iocx/default.nix
@ -11,14 +11,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "iocx";
-  version = "0.7.3";
+  version = "0.7.4";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "iocx-dev";
    repo = "iocx";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-cCgpkUSlXQm/F8nvpybwt27cicuDAeoHk5t4dYIAsXY=";
+    hash = "sha256-z/l6i+RKYfEC02OxFHEXvo38VYty2FVt48pP+HBLJco=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/labgrid/default.nix
+++ b/pkgs/development/python-modules/labgrid/default.nix
@ -15,6 +15,7 @@
  pexpect,
  psutil,
  pyserial,
+  pytest,
  pytestCheckHook,
  pytest-benchmark,
  pytest-dependency,
@ -78,6 +79,7 @@ buildPythonPackage rec {
    pyudev
    pyusb
    pyyaml
+    pytest
    requests
    xmodem
  ];
--- a/pkgs/development/python-modules/led-ble/default.nix
+++ b/pkgs/development/python-modules/led-ble/default.nix
@ -12,14 +12,14 @@

 buildPythonPackage rec {
  pname = "led-ble";
-  version = "1.1.8";
+  version = "1.1.11";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "Bluetooth-Devices";
    repo = "led-ble";
    tag = "v${version}";
-    hash = "sha256-98nAtv2p6WNxg6wwlGviVRzaKGCWGZNqPG4k3jwQpjw=";
+    hash = "sha256-YPOjbmHR6WpmAEpYFl/ajzojgiIYEk+6H5LFjl1yo1c=";
  };

  build-system = [ poetry-core ];
--- a/pkgs/development/python-modules/mitogen/default.nix
+++ b/pkgs/development/python-modules/mitogen/default.nix
@ -7,14 +7,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "mitogen";
-  version = "0.3.47";
+  version = "0.3.48";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "mitogen-hq";
    repo = "mitogen";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-vCfGig2Sc4NpDl2lEM5FkFAsA/+EFd8Sv643onkMWqQ=";
+    hash = "sha256-RptIeE2XvVOzeYaRGiggesfZGJ+flkcFSDz1l23JxdE=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/msgraph-sdk/default.nix
+++ b/pkgs/development/python-modules/msgraph-sdk/default.nix
@ -16,14 +16,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "msgraph-sdk";
-  version = "1.56.0";
+  version = "1.58.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "microsoftgraph";
    repo = "msgraph-sdk-python";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Y2PX07IzHO3wjVEYUw1o6vb1cr1pa8BJIR9Uliho3lQ=";
+    hash = "sha256-YF5cDivU3VVnIuCCyQsNY1gvCU5aazRJ6Hok97Af3nE=";
  };

  build-system = [ flit-core ];
--- a/pkgs/development/python-modules/neo4j/default.nix
+++ b/pkgs/development/python-modules/neo4j/default.nix
@ -11,19 +11,19 @@

 buildPythonPackage (finalAttrs: {
  pname = "neo4j";
-  version = "6.1.0";
+  version = "6.2.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "neo4j";
    repo = "neo4j-python-driver";
    tag = finalAttrs.version;
-    hash = "sha256-1Ef9SMJid0q+tI8hceriNu2vsLAyW4Jxt53ifcmi5VA=";
+    hash = "sha256-M1bBZJOo4GS71Gt4vfRYfLduh/X8XFABgycQNVPsWSs=";
  };

  postPatch = ''
    substituteInPlace pyproject.toml \
-      --replace-fail "setuptools ==" "setuptools >=" \
+      --replace-fail "setuptools == 82.0.1" "setuptools" \
      --replace-fail 'dynamic = ["version"]' 'version = "${finalAttrs.version}"'
  '';

--- a/pkgs/development/python-modules/pulumi/default.nix
+++ b/pkgs/development/python-modules/pulumi/default.nix
@ -94,7 +94,6 @@ buildPythonPackage {
    homepage = "https://www.pulumi.com";
    license = lib.licenses.asl20;
    maintainers = with lib.maintainers; [
-      teto
      tie
    ];
  };
--- a/pkgs/development/python-modules/pydantic-ai-slim/default.nix
+++ b/pkgs/development/python-modules/pydantic-ai-slim/default.nix
@ -20,14 +20,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "pydantic-ai-slim";
-  version = "1.102.0";
+  version = "1.103.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "pydantic";
    repo = "pydantic-ai";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-5mX4o/LqiLAUmn1WXV6RVf2KwDYJ5pxFPtF2meVFp1o=";
+    hash = "sha256-eWusMERC1yZ/BltZPcYkrBGpbdG0EyWZVwYDqMLD/kY=";
  };

  sourceRoot = "${finalAttrs.src.name}/pydantic_ai_slim";
--- a/pkgs/development/python-modules/pydantic-graph/default.nix
+++ b/pkgs/development/python-modules/pydantic-graph/default.nix
@ -16,14 +16,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "pydantic-graph";
-  version = "1.102.0";
+  version = "1.103.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "pydantic";
    repo = "pydantic-ai";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-5mX4o/LqiLAUmn1WXV6RVf2KwDYJ5pxFPtF2meVFp1o=";
+    hash = "sha256-eWusMERC1yZ/BltZPcYkrBGpbdG0EyWZVwYDqMLD/kY=";
  };

  sourceRoot = "${finalAttrs.src.name}/pydantic_graph";
--- a/pkgs/development/python-modules/pygreat/default.nix
+++ b/pkgs/development/python-modules/pygreat/default.nix
@ -8,14 +8,14 @@

 buildPythonPackage rec {
  pname = "pygreat";
-  version = "2024.0.5";
+  version = "2026.0.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "greatscottgadgets";
    repo = "libgreat";
    tag = "v${version}";
-    hash = "sha256-2PFeCG7m8qiK3eBX2838P6ZsLoQxcJBG+/TppUMT6dE=";
+    hash = "sha256-m+s2TAJK7UhKWbuSd5ec1O40WeMXxJyTD9yqPOr0LEM=";
  };

  sourceRoot = "${src.name}/host";
@ -26,8 +26,6 @@ buildPythonPackage rec {
      --replace-fail 'dynamic = ["version"]' 'version = "${version}"'
  '';

-  pythonRemoveDeps = [ "backports.functools_lru_cache" ];
-
  build-system = [ setuptools ];

  dependencies = [ pyusb ];
--- a/pkgs/development/python-modules/pyoverkiz/default.nix
+++ b/pkgs/development/python-modules/pyoverkiz/default.nix
@ -15,14 +15,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "pyoverkiz";
-  version = "1.20.3";
+  version = "1.20.6";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "iMicknl";
    repo = "python-overkiz-api";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-pl7SL0lE/+eWTv6jmoilDVtaI2TB42YSpIbrY0fcptk=";
+    hash = "sha256-Zbz4l5bPvFQaek6/Nbn+PzAzLS3l2PyetuxOBVsuLPk=";
  };

  build-system = [ hatchling ];
--- a/pkgs/development/python-modules/safety/default.nix
+++ b/pkgs/development/python-modules/safety/default.nix
@ -3,9 +3,7 @@
  buildPythonPackage,
  fetchFromGitHub,
  hatchling,
-  setuptools,
  click,
-  requests,
  packaging,
  dparse,
  ruamel-yaml,
@ -18,26 +16,26 @@
  safety-schemas,
  typing-extensions,
  filelock,
-  psutil,
  httpx,
  tenacity,
  tomlkit,
+  truststore,
  git,
  pytestCheckHook,
  tomli,
  writableTmpDirAsHomeHook,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "safety";
-  version = "3.7.0";
+  version = "3.8.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "pyupio";
    repo = "safety";
-    tag = version;
-    hash = "sha256-BPLK/V7YQBCGopfRFAWdra8ve8Ww5KN1+oZKyoEPiFc=";
+    tag = finalAttrs.version;
+    hash = "sha256-/iLxcVku8ogVZyhQI0/U+m1RyECDYWxLix+S83HHrS4=";
  };

  patches = [
@ -47,16 +45,11 @@ buildPythonPackage rec {
  build-system = [ hatchling ];

  pythonRelaxDeps = [
-    "filelock"
-    "pydantic"
-    "psutil"
    "safety-schemas"
  ];

  dependencies = [
-    setuptools
    click
-    requests
    packaging
    dparse
    ruamel-yaml
@ -69,10 +62,10 @@ buildPythonPackage rec {
    safety-schemas
    typing-extensions
    filelock
-    psutil
    httpx
    tenacity
    tomlkit
+    truststore
  ];

  nativeCheckInputs = [
@ -82,28 +75,21 @@ buildPythonPackage rec {
    writableTmpDirAsHomeHook
  ];

-  disabledTests = [
-    # Disable tests depending on online services
-    "test_announcements_if_is_not_tty"
-    "test_check_live"
-    "test_debug_flag"
-    "test_get_packages_licenses_without_api_key"
-    "test_init_project"
-    "test_validate_with_basic_policy_file"
+  disabledTestPaths = [
+    # Failed to initialize SafetyPlatformClient: [Errno -3] Temporary failure in name resolution
+    "tests/firewall/test_command.py"
+    "tests/test_cli.py"
  ];

-  # ImportError: cannot import name 'get_command_for' from partially initialized module 'safety.cli_util' (most likely due to a circular import)
-  disabledTestPaths = [ "tests/alerts/test_utils.py" ];
-
  meta = {
    description = "Checks installed dependencies for known vulnerabilities";
    mainProgram = "safety";
    homepage = "https://github.com/pyupio/safety";
-    changelog = "https://github.com/pyupio/safety/blob/${src.tag}/CHANGELOG.md";
+    changelog = "https://github.com/pyupio/safety/blob/${finalAttrs.src.tag}/CHANGELOG.md";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [
      thomasdesr
      dotlambda
    ];
  };
-}
+})
--- a/pkgs/development/python-modules/safety/disable-telemetry.patch
+++ b/pkgs/development/python-modules/safety/disable-telemetry.patch
@ -1,8 +1,8 @@
 diff --git a/safety/cli.py b/safety/cli.py
-index 4d1f0c5..db4d930 100644
+index 14ec46a..3297928 100644
 --- a/safety/cli.py
 +++ b/safety/cli.py
-@@ -228,7 +228,7 @@ def configure_logger(ctx, param, debug):
+@@ -170,7 +170,7 @@ def configure_logger(ctx, param, debug):
 @proxy_options
 @click.option(
     "--disable-optional-telemetry",
@ -12,41 +12,81 @@ index 4d1f0c5..db4d930 100644
     show_default=True,
     help=CLI_DISABLE_OPTIONAL_TELEMETRY_DATA_HELP,
 diff --git a/safety/safety.py b/safety/safety.py
-index e41f5ae..7d29a50 100644
+index a86c167..ad7fc94 100644
 --- a/safety/safety.py
 +++ b/safety/safety.py
-@@ -143,7 +143,7 @@ def fetch_database_url(
+@@ -228,7 +228,7 @@ def fetch_database_url(
     mirror: str,
     db_name: str,
     cached: int,
 -    telemetry: bool = True,
 +    telemetry: bool = False,
     ecosystem: Ecosystem = Ecosystem.PYTHON,
-     from_cache: bool = True
+     from_cache: bool = True,
+     is_open_mirror: bool = False,
+@@ -368,7 +368,7 @@ def fetch_database(
+     full: bool = False,
+     db: Union[Optional[str], bool] = False,
+     cached: int = 0,
+-    telemetry: bool = True,
+    telemetry: bool = False,
+     ecosystem: Optional[Ecosystem] = None,
+     from_cache: bool = True,
 ) -> Dict[str, Any]:
+@@ -696,7 +696,7 @@ def check(
+     proxy: Optional[Dict[str, Any]] = None,
+     include_ignored: bool = False,
+     is_env_scan: bool = True,
+-    telemetry: bool = True,
+    telemetry: bool = False,
+     params: Optional[Dict[str, Any]] = None,
+     project: Optional[str] = None,
+ ) -> tuple:
+@@ -1686,7 +1686,7 @@ def get_licenses(
+     auth: "Auth",
+     db_mirror: Union[Optional[str], bool] = False,
+     cached: int = 0,
+-    telemetry: bool = True,
+    telemetry: bool = False,
+ ) -> Dict[str, Any]:
+     """
+     Retrieves the licenses from the database.
+@@ -1785,7 +1785,7 @@ def add_local_notifications(
+ 
+ 
+ def get_announcements(
+-    auth: "Auth", telemetry: bool = True, with_telemetry: Any = None
+    auth: "Auth", telemetry: bool = False, with_telemetry: Any = None
+ ) -> List[Dict[str, str]]:
+     """
+     Retrieves announcements from the server.
 diff --git a/safety/scan/finder/handlers.py b/safety/scan/finder/handlers.py
-index 80a3db6..61a10cc 100644
+index 5f8e734..1f55f73 100644
 --- a/safety/scan/finder/handlers.py
 +++ b/safety/scan/finder/handlers.py
-@@ -91,11 +91,11 @@ class PythonFileHandler(FileHandler):
- 
-         # Fetch both the full and partial Safety databases
-         fetch_database(session=session, full=False, db=db, cached=True,
-                       telemetry=True, ecosystem=Ecosystem.PYTHON,
-+                       telemetry=False, ecosystem=Ecosystem.PYTHON,
-                        from_cache=False)
- 
-         fetch_database(session=session, full=True, db=db, cached=True,
-                                telemetry=True, ecosystem=Ecosystem.PYTHON,
-+                                telemetry=False, ecosystem=Ecosystem.PYTHON,
-                                 from_cache=False)
- 
- 
+@@ -102,7 +102,7 @@ class PythonFileHandler(FileHandler):
+             full=False,
+             db=db,
+             cached=True,
+-            telemetry=True,
+            telemetry=False,
+             ecosystem=Ecosystem.PYTHON,
+             from_cache=False,
+         )
+@@ -112,7 +112,7 @@ class PythonFileHandler(FileHandler):
+             full=True,
+             db=db,
+             cached=True,
+-            telemetry=True,
+            telemetry=False,
+             ecosystem=Ecosystem.PYTHON,
+             from_cache=False,
+         )
 diff --git a/safety/util.py b/safety/util.py
-index 2a02236..5feef8d 100644
+index 89ad11d..ba9983d 100644
 --- a/safety/util.py
 +++ b/safety/util.py
-@@ -351,7 +351,7 @@ def filter_announcements(
+@@ -319,7 +319,7 @@ def filter_announcements(
 
 
 def build_telemetry_data(
--- a/pkgs/development/python-modules/securesystemslib/default.nix
+++ b/pkgs/development/python-modules/securesystemslib/default.nix
@ -30,19 +30,19 @@

 buildPythonPackage (finalAttrs: {
  pname = "securesystemslib";
-  version = "1.3.1";
+  version = "1.4.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "secure-systems-lab";
    repo = "securesystemslib";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-ERFRLNHD3OhbMEGBEnDLkRYGv4f+bYg9MStS5IarcPA=";
+    hash = "sha256-XOE690DKeAMP2KycW+fdYs/KGWqwZCZz/9PiAa6tJbw=";
  };

  postPatch = ''
    substituteInPlace pyproject.toml \
-      --replace-fail '"hatchling==1.27.0"' '"hatchling"'
+      --replace-fail '"hatchling==1.29.0"' '"hatchling"'
  '';

  build-system = [ hatchling ];
--- a/pkgs/development/python-modules/socid-extractor/default.nix
+++ b/pkgs/development/python-modules/socid-extractor/default.nix
@ -10,14 +10,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "socid-extractor";
-  version = "0.0.28";
+  version = "0.1.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "soxoj";
    repo = "socid-extractor";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-eLdJw2teMG/DlG8F8p3nm+L2+iY1zD2QbNHjWAyjtPY=";
+    hash = "sha256-ZYLoHFyRnSHP3Od/cMOx690KFbJoEYK3cICjzbSfLm0=";
  };

  pythonRelaxDeps = [ "beautifulsoup4" ];
--- a/pkgs/development/python-modules/tensorboard/default.nix
+++ b/pkgs/development/python-modules/tensorboard/default.nix
@ -78,5 +78,6 @@ buildPythonPackage rec {
    license = lib.licenses.asl20;
    mainProgram = "tensorboard";
    maintainers = [ ];
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
  };
 }
--- a/pkgs/development/python-modules/tinygrad/default.nix
+++ b/pkgs/development/python-modules/tinygrad/default.nix
@ -308,6 +308,15 @@ buildPythonPackage (finalAttrs: {
    gpuCheck = tinygrad.overridePythonAttrs (old: {
      requiredSystemFeatures = [ "cuda" ];

+      disabledTests = (old.disabledTests or [ ]) ++ [
+        # Require internet access
+        "TestWhisper"
+        "test_hevc_decode"
+
+        # AssertionError: Not equal to tolerance
+        "test_svd_general"
+      ];
+
      pytestFlags = (old.pytestFlags or [ ]) ++ [
        # When running in parallel, with GPU support, some tests become flaky:
        # RuntimeError: Wait timeout: 30000 ms! (the signal is not set to 153, but 151)
--- a/pkgs/development/python-modules/ufo2ft/default.nix
+++ b/pkgs/development/python-modules/ufo2ft/default.nix
@ -18,14 +18,14 @@

 buildPythonPackage rec {
  pname = "ufo2ft";
-  version = "3.7.0";
+  version = "3.7.2";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "googlefonts";
    repo = "ufo2ft";
    tag = "v${version}";
-    hash = "sha256-PHd4l3kbWdJmtZMF9gKbz5DtdaaO3C/Rldw3pdMJJC0=";
+    hash = "sha256-g8nPtIGUiUVV0exddKGBRbLhO/XW+5bBNlYXRDlkIZM=";
  };

  build-system = [
--- a/pkgs/development/python-modules/wapiti-arsenic/default.nix
+++ b/pkgs/development/python-modules/wapiti-arsenic/default.nix
@ -11,17 +11,19 @@
  packaging,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "wapiti-arsenic";
  version = "28.5";
  pyproject = true;

  src = fetchPypi {
    pname = "wapiti_arsenic";
-    inherit version;
+    inherit (finalAttrs) version;
    hash = "sha256-snIKEdrBOIfPeHkVLv0X5lsBzDbOtDrbOj4m8UNCj60=";
  };

+  pythonRelaxDeps = [ "packaging" ];
+
  postPatch = ''
    substituteInPlace pyproject.toml \
      --replace-fail "poetry>=2.1.3" "poetry-core" \
@ -43,8 +45,8 @@ buildPythonPackage rec {
  meta = {
    description = "Asynchronous WebDriver client";
    homepage = "https://github.com/wapiti-scanner/arsenic";
-    changelog = "https://github.com/wapiti-scanner/arsenic/blob/${version}/CHANGELOG.md";
+    changelog = "https://github.com/wapiti-scanner/arsenic/blob/${finalAttrs.version}/CHANGELOG.md";
    license = lib.licenses.asl20;
    maintainers = with lib.maintainers; [ GaetanLepage ];
  };
-}
+})
--- a/pkgs/development/python-modules/webdriver-manager/default.nix
+++ b/pkgs/development/python-modules/webdriver-manager/default.nix
@ -4,6 +4,7 @@
  fetchFromGitHub,
  packaging,
  pybrowsers,
+  pytest-cov-stub,
  pytestCheckHook,
  python-dotenv,
  requests,
@ -11,16 +12,16 @@
  setuptools,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "webdriver-manager";
-  version = "4.0.2";
+  version = "4.1.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "SergeyPirogov";
    repo = "webdriver_manager";
-    tag = "v${version}";
-    hash = "sha256-ZmrQa/2vPwYgSvY3ZUvilg4RizVXpu5hvJJBQVXkK8E=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-MqLM1mSfoirBaJYKkikNuS2XPWPTM2MQNgEwhtp+2ek=";
  };

  __darwinAllowLocalNetworking = true;
@ -35,6 +36,7 @@ buildPythonPackage rec {

  nativeCheckInputs = [
    pybrowsers
+    pytest-cov-stub
    pytestCheckHook
    selenium
  ];
@ -62,9 +64,9 @@ buildPythonPackage rec {
  meta = {
    description = "Module to manage the binary drivers for different browsers";
    homepage = "https://github.com/SergeyPirogov/webdriver_manager/";
-    changelog = "https://github.com/SergeyPirogov/webdriver_manager/blob/${version}/CHANGELOG.md";
+    changelog = "https://github.com/SergeyPirogov/webdriver_manager/blob/${finalAttrs.src.tag}/CHANGELOG.md";
    license = lib.licenses.asl20;
    maintainers = with lib.maintainers; [ fab ];
    platforms = lib.platforms.linux;
  };
-}
+})
--- a/pkgs/development/python-modules/wsgidav/default.nix
+++ b/pkgs/development/python-modules/wsgidav/default.nix
@ -1,5 +1,6 @@
 {
  lib,
+  bcrypt,
  buildPythonPackage,
  cheroot,
  defusedxml,
@ -7,6 +8,7 @@
  jinja2,
  json5,
  lxml,
+  passlib,
  pytestCheckHook,
  python-pam,
  pyyaml,
@ -15,28 +17,32 @@
  webtest,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "wsgidav";
-  version = "4.3.3";
+  version = "4.3.4";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "mar10";
    repo = "wsgidav";
-    tag = "v${version}";
-    hash = "sha256-vUqNC7ixpta0s7wRC5ROSKMa/MsgEBu5rr0XNu69FRw=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-2Pn5kMioMr4COpcIDEhlfolG0/5hpv8zMO0X7l6fSwY=";
  };

+  pythonRelaxDeps = [ "bcrypt" ];
+
  __darwinAllowLocalNetworking = true;

  build-system = [ setuptools ];

  dependencies = [
+    bcrypt
    defusedxml
    jinja2
    json5
    cheroot
    lxml
+    passlib
    pyyaml
  ];

@ -55,9 +61,9 @@ buildPythonPackage rec {
  meta = {
    description = "Generic and extendable WebDAV server based on WSGI";
    homepage = "https://wsgidav.readthedocs.io/";
-    changelog = "https://github.com/mar10/wsgidav/blob/v${version}/CHANGELOG.md";
-    license = with lib.licenses; [ mit ];
+    changelog = "https://github.com/mar10/wsgidav/blob/${finalAttrs.src.tag}/CHANGELOG.md";
+    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ fab ];
    mainProgram = "wsgidav";
  };
-}
+})
--- a/pkgs/development/rocq-modules/rocq-elpi/default.nix
+++ b/pkgs/development/rocq-modules/rocq-elpi/default.nix
@ -17,7 +17,7 @@ let
      in
      with lib.versions;
      lib.switch rocq-core.rocq-version [
-        (case (range "9.0" "9.2") "3.6.2")
+        (case (range "9.0" "9.2") "3.7.1")
        (case (range "9.0" "9.1") "3.4.5")
        (case (range "9.0" "9.1") "2.0.7")
      ] rocq-core.ocamlPackages.elpi.version;
@ -37,11 +37,12 @@ let
      in
      with lib.versions;
      lib.switch rocq-core.rocq-version [
-        (case (range "9.0" "9.2") "3.3.0")
+        (case (range "9.0" "9.2") "3.4.0")
        (case (range "9.0" "9.1") "3.2.0")
        (case (range "9.0" "9.1") "2.6.0")
        (case "9.0" "2.5.2")
      ] null;
+    release."3.4.0".sha256 = "sha256-8x2Sa/+pUpXEqB+NdyfOyw6Yyzp6Q1k5LnhrjG/qJNM=";
    release."3.3.0".sha256 = "sha256-wcsUpw7S+H9CaXuz+W3g22IFWO2cLllJ4xm2qLTG0nM=";
    release."3.2.0".sha256 = "sha256-FyYG/8lEyt1L/paMez8jYAnnUE+sxIp4Da5MztmwJ/c=";
    release."3.1.0".sha256 = "sha256-ytGPGwJv+jmRT6uN0sg6q+xh8ND0PMIZ9ULB0Uwca1w=";
--- a/pkgs/development/tools/ocaml/camlp5/default.nix
+++ b/pkgs/development/tools/ocaml/camlp5/default.nix
@ -21,7 +21,7 @@ stdenv.mkDerivation (
  in
  {

-    version = if lib.versionAtLeast ocaml.version "4.12" && !legacy then "8.05.00" else "7.14";
+    version = if lib.versionAtLeast ocaml.version "4.12" && !legacy then "8.05.01" else "7.14";

    pname = "ocaml${ocaml.version}-camlp5";

@ -35,7 +35,7 @@ stdenv.mkDerivation (
          "rel${builtins.replaceStrings [ "." ] [ "" ] finalAttrs.version}";
      hash =
        {
-          "8.05.00" = "sha256-Y7d72gAxtyAQOIvLGua6Pib+FCoeMlbRYa9vzc+9hRo=";
+          "8.05.01" = "sha256-ym1cZIoAIwMnkGiygZf+TZxjhyO6WHYItWRXobdcKm0=";
          "8.03.2" = "sha256-nz+VfGR/6FdBvMzPPpVpviAXXBWNqM3Ora96Yzx964o=";
          "7.14" = "sha256-/ORtS0uc/GN+g3y6N5ftjL4OBSqV6iswLRbfpeNCprU=";
        }
@ -80,8 +80,7 @@ stdenv.mkDerivation (
    dontStrip = true;

    meta = {
-      broken =
-        lib.versionAtLeast ocaml.version "5.04" && !lib.versionAtLeast finalAttrs.version "8.05.00";
+      broken = lib.versionAtLeast ocaml.version "5.4" && !lib.versionAtLeast finalAttrs.version "8.04.00";
      description = "Preprocessor-pretty-printer for OCaml";
      longDescription = ''
        Camlp5 is a preprocessor and pretty-printer for OCaml programs.
--- a/pkgs/kde/lib/mk-kde-derivation.nix
+++ b/pkgs/kde/lib/mk-kde-derivation.nix
@ -189,6 +189,7 @@ let
  meta = {
    description = projectInfo.${pname}.description;
    homepage = "https://invent.kde.org/${projectInfo.${pname}.repo_path}";
+    donationPage = "https://kde.org/donate/";
    license = lib.filter (l: l != null) (map (l: licensesBySpdxId.${l}) licenseInfo.${pname});
    teams = [ lib.teams.qt-kde ];
    # Platforms are currently limited to what upstream tests in CI, but can be extended if there's interest.
--- a/pkgs/os-specific/linux/xp-pen-drivers/deco-01-v2/default.nix
+++ b/pkgs/os-specific/linux/xp-pen-drivers/deco-01-v2/default.nix
@ -1,82 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchzip,
-  libusb1,
-  glibc,
-  libGL,
-  makeWrapper,
-  qtx11extras,
-  wrapQtAppsHook,
-  autoPatchelfHook,
-  libx11,
-  libxtst,
-  libxi,
-  libxrandr,
-  libxinerama,
-}:
-
-let
-  dataDir = "var/lib/xppend1v2";
-in
-stdenv.mkDerivation rec {
-  pname = "xp-pen-deco-01-v2-driver";
-  version = "3.4.9-231023";
-
-  src = fetchzip {
-    url = "https://www.xp-pen.com/download/file/id/1936/pid/440/ext/gz.html#.tar.gz";
-    name = "xp-pen-deco-01-v2-driver-${version}.tar.gz";
-    sha256 = "sha256-A/dv6DpelH0NHjlGj32tKv37S+9q3F8cYByiYlMuqLg=";
-  };
-
-  nativeBuildInputs = [
-    wrapQtAppsHook
-    autoPatchelfHook
-    makeWrapper
-  ];
-
-  dontBuild = true;
-
-  dontWrapQtApps = true; # this is done manually
-
-  buildInputs = [
-    libusb1
-    libx11
-    libxtst
-    libxi
-    libxrandr
-    libxinerama
-    glibc
-    libGL
-    (lib.getLib stdenv.cc.cc)
-    qtx11extras
-  ];
-
-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p $out/{opt,bin}
-    cp -r App/usr/lib/pentablet/{PenTablet,resource.rcc,conf} $out/opt
-    chmod +x $out/opt/PenTablet
-    cp -r App/lib $out/lib
-    sed -i 's#usr/lib/pentablet#${dataDir}#g' $out/opt/PenTablet
-
-    runHook postInstall
-  '';
-
-  postFixup = ''
-    makeWrapper $out/opt/PenTablet $out/bin/xp-pen-deco-01-v2-driver \
-      "''${qtWrapperArgs[@]}" \
-      --run 'if [ "$EUID" -ne 0 ]; then echo "Please run as root."; exit 1; fi' \
-      --run 'if [ ! -d /${dataDir} ]; then mkdir -p /${dataDir}; cp -r '$out'/opt/conf /${dataDir}; chmod u+w -R /${dataDir}; fi'
-  '';
-
-  meta = {
-    homepage = "https://www.xp-pen.com/product/461.html";
-    description = "Drivers for the XP-PEN Deco 01 v2 drawing tablet";
-    platforms = [ "x86_64-linux" ];
-    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
-    maintainers = with lib.maintainers; [ virchau13 ];
-    license = lib.licenses.unfree;
-  };
-}
--- a/pkgs/servers/home-assistant/custom-components/smartthinq-sensors/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/smartthinq-sensors/package.nix
@ -10,13 +10,13 @@
 buildHomeAssistantComponent rec {
  owner = "ollo69";
  domain = "smartthinq_sensors";
-  version = "0.42.2";
+  version = "0.43.0";

  src = fetchFromGitHub {
    inherit owner;
    repo = "ha-smartthinq-sensors";
    rev = "v${version}";
-    hash = "sha256-y8MGGTcOrr4IZUefBgq7wVG3H5UFAB7L2FkwoVsygb0=";
+    hash = "sha256-QD7p6yldjqgcZTRjztuLsHTBh+PDOQjLq5BGjw5yg8o=";
  };

  dependencies = [
--- a/pkgs/servers/home-assistant/custom-lovelace-modules/material-you-utilities/package.nix
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/material-you-utilities/package.nix
@ -6,16 +6,16 @@

 buildNpmPackage rec {
  pname = "material-you-utilities";
-  version = "2.1.11";
+  version = "2.1.12";

  src = fetchFromGitHub {
    owner = "Nerwyn";
    repo = "material-you-utilities";
    tag = version;
-    hash = "sha256-nT6UAoa3VBBxanxl6c0ree0RKgG4ozY58fSofVxgZYw=";
+    hash = "sha256-ieeWn2o2lTPe15HqWi6wKe7rqNXl4oIjp09ucIGIxvg=";
  };

-  npmDepsHash = "sha256-HdPqj1E8NtB7oeomPtDkbnHHYuSNKG/SvvZ8g2l0Fms=";
+  npmDepsHash = "sha256-ERIQgNWjIayz2Gh74Ha2NUv3TyK5TcLV2YrPexf52Hk=";

  installPhase = ''
    runHook preInstall
--- a/Show more
+++ b/Show more