Merge staging-next into staging

2026-07-06 17:13:24 -05:00 · 2026-05-27 13:11:15 +00:00 · 2026-05-27 13:11:15 +00:00 · 2417edca23
commit 2417edca23
parent 7630f30ebb a90757c3af
82 changed files with 761 additions and 391 deletions
--- a/nixos/modules/services/desktops/seatd.nix
+++ b/nixos/modules/services/desktops/seatd.nix
@ -40,6 +40,7 @@ in
  config = lib.mkIf cfg.enable {
    environment.systemPackages = with pkgs; [
      seatd
+      sdnotify-wrapper
    ];
    users.groups.seat = lib.mkIf (cfg.group == "seat") { };

@ -54,7 +55,7 @@ in
        Type = "notify";
        NotifyAccess = "all";
        SyslogIdentifier = "seatd";
-        ExecStart = "${lib.getExe' pkgs.s6 "s6-notify-socket-from-fd"} ${pkgs.seatd.bin}/bin/seatd -n 1 -u ${cfg.user} -g ${cfg.group} -l ${cfg.logLevel}";
+        ExecStart = "${pkgs.sdnotify-wrapper}/bin/sdnotify-wrapper ${pkgs.seatd.bin}/bin/seatd -n 1 -u ${cfg.user} -g ${cfg.group} -l ${cfg.logLevel}";
        RestartSec = 1;
        Restart = "always";
      };
--- a/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix
@ -21,26 +21,26 @@ vscode-utils.buildVscodeMarketplaceExtension (finalAttrs: {
      sources = {
        "x86_64-linux" = {
          arch = "linux-x64";
-          hash = "sha256-wFerIcpbXDL0p7DGh19jXuOZyUvbwq2EzlmnLf1fv5M=";
+          hash = "sha256-D9fCOrdx2lzkafxPJENKc8tZnO+03c7CR3w/3LAQOa8=";
        };
        "aarch64-linux" = {
          arch = "linux-arm64";
-          hash = "sha256-ubMVyijSI5WWPSsq6wJCk9BABpli9Kgbgn5T+XP8aMA=";
+          hash = "sha256-E4VUFvsyp0sJ1I0dIRAgIfa09zyvZHzZvKCMq5H9sig=";
        };
        "x86_64-darwin" = {
          arch = "darwin-x64";
-          hash = "sha256-tEQTTcI7pFgJ6S4Lb2XTe5MXxHudyldzTsYpz5OWr5E=";
+          hash = "sha256-4k71rBIHOjmC9iJvaZlD6t36jqM6fclqM/yTWSoYrvs=";
        };
        "aarch64-darwin" = {
          arch = "darwin-arm64";
-          hash = "sha256-WskmpZBwQt2mSQpvchI5Ca9ZOyN9srVPGHeMULIGRs8=";
+          hash = "sha256-08QK3qOhE6f+LaSL2qVZgecfO6/Lqw3WVCD1wABluho=";
        };
      };
    in
    {
      name = "claude-code";
      publisher = "anthropic";
-      version = "2.1.148";
+      version = "2.1.152";
    }
    // sources.${stdenvNoCC.hostPlatform.system}
      or (throw "Unsupported system ${stdenvNoCC.hostPlatform.system}");
--- a/pkgs/applications/emulators/libretro/cores/beetle-psx.nix
+++ b/pkgs/applications/emulators/libretro/cores/beetle-psx.nix
@ -8,13 +8,13 @@
 }:
 mkLibretroCore {
  core = "mednafen-psx" + lib.optionalString withHw "-hw";
-  version = "0-unstable-2026-05-15";
+  version = "0-unstable-2026-05-23";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "beetle-psx-libretro";
-    rev = "c194d8c7d9cef77b653f688f1293746aa71a928e";
-    hash = "sha256-lIvVk0a+lwBF+BtX2KT2MwOUguTGm/pKi8s9IbZqwsU=";
+    rev = "ccd8ae3d8d8e43100e9f596a66214a5b2acb2da1";
+    hash = "sha256-zznSKLjpc0ovgqzkpxBqVOMV7UZyuTx1R/x4SCbSPdo=";
  };

  extraBuildInputs = lib.optionals withHw [
--- a/pkgs/applications/networking/browsers/firefox/wrapper.nix
+++ b/pkgs/applications/networking/browsers/firefox/wrapper.nix
@ -166,36 +166,34 @@ let
          ) (lib.optionals usesNixExtensions nixExtensions);

      enterprisePolicies = {
-        policies = {
-          DisableAppUpdate = true;
-        }
-        // lib.optionalAttrs usesNixExtensions {
-          ExtensionSettings = {
-            "*" = {
-              blocked_install_message = "You can't have manual extension mixed with nix extensions";
-              installation_mode = "blocked";
-            };
-          }
-          // lib.foldr (
-            e: ret:
-            ret
-            // {
-              "${e.extid}" = {
-                installation_mode = "allowed";
+        policies =
+          lib.optionalAttrs usesNixExtensions {
+            ExtensionSettings = {
+              "*" = {
+                blocked_install_message = "You can't have manual extension mixed with nix extensions";
+                installation_mode = "blocked";
              };
            }
-          ) { } extensions;
+            // lib.foldr (
+              e: ret:
+              ret
+              // {
+                "${e.extid}" = {
+                  installation_mode = "allowed";
+                };
+              }
+            ) { } extensions;

-          Extensions = {
-            Install = lib.foldr (e: ret: ret ++ [ "${e.outPath}/${e.extid}.xpi" ]) [ ] extensions;
-          };
-        }
-        // lib.optionalAttrs smartcardSupport {
-          SecurityDevices = {
-            "OpenSC PKCS#11 Module" = "opensc-pkcs11.so";
-          };
-        }
-        // extraPolicies;
+            Extensions = {
+              Install = lib.foldr (e: ret: ret ++ [ "${e.outPath}/${e.extid}.xpi" ]) [ ] extensions;
+            };
+          }
+          // lib.optionalAttrs smartcardSupport {
+            SecurityDevices = {
+              "OpenSC PKCS#11 Module" = "opensc-pkcs11.so";
+            };
+          }
+          // extraPolicies;
      };

      mozillaCfg = ''
@ -414,6 +412,9 @@ let
            ln -sfT "$target" "$out/$l"
          done

+          # Disable update checks
+          touch $out/${libDir}/is-packaged-app
+
          cd "$out"

        ''
--- a/pkgs/applications/office/activitywatch/default.nix
+++ b/pkgs/applications/office/activitywatch/default.nix
@ -14,6 +14,7 @@
  qtsvg,
  xdg-utils,
  replaceVars,
+  nodejs_22,
  buildNpmPackage,
 }:

@ -234,6 +235,7 @@ rec {

    src = "${sources}/aw-server-rust/aw-webui";

+    nodejs = nodejs_22;
    npmDepsHash = "sha256-fPk7UpKuO3nEN1w+cf9DIZIG1+XRUk6PJfVmtpC30XE=";

    makeCacheWritable = true;
--- a/pkgs/build-support/node/fetch-pnpm-deps/default.nix
+++ b/pkgs/build-support/node/fetch-pnpm-deps/default.nix
@ -146,6 +146,10 @@ in
              # Run any additional pnpm configuration commands that users provide.
              ${prePnpmInstall}

+              echo "Final pnpm config:"
+              pnpm config list
+              echo
+
              # pnpm is going to warn us about using --force
              # --force allows us to fetch all dependencies including ones that aren't meant for our host platform
              pnpm install \
--- a/pkgs/build-support/node/fetch-pnpm-deps/pnpm-config-hook.sh
+++ b/pkgs/build-support/node/fetch-pnpm-deps/pnpm-config-hook.sh
@ -28,6 +28,11 @@ pnpmConfigHook() {
    if versionAtLeast "$pnpmVersion" "11"; then
      # pnpm 11 uses a different mechanism to manage package manager versions
      export pnpm_config_pm_on_fail=ignore
+
+      # Disable lockfile verification against supply-chain policies. This is
+      # already done in fetchPnpmDeps, so if these checks failed there, we
+      # wouldn't be here in the first place
+      export pnpm_config_trust_lockfile=true
    else
      pnpm config set manage-package-manager-versions false
    fi
@ -84,6 +89,10 @@ pnpmConfigHook() {

    runHook prePnpmInstall

+    echo "Final pnpm config:"
+    pnpm config list
+    echo
+
    if ! pnpm install \
        --offline \
        --ignore-scripts \
--- a/pkgs/by-name/ap/appstream-glib/package.nix
+++ b/pkgs/by-name/ap/appstream-glib/package.nix
@ -26,7 +26,7 @@
 }:
 stdenv.mkDerivation rec {
  pname = "appstream-glib";
-  version = "0.8.2";
+  version = "0.8.3";

  outputs = [
    "out"
@ -39,8 +39,8 @@ stdenv.mkDerivation rec {
  src = fetchFromGitHub {
    owner = "hughsie";
    repo = "appstream-glib";
-    rev = "${lib.replaceStrings [ "-" ] [ "_" ] pname}_${lib.replaceStrings [ "." ] [ "_" ] version}";
-    sha256 = "sha256-3QFiOJ38talA0GGL++n+DaA/AN7l4LOZQ7BJV6o8ius=";
+    tag = "appstream_glib_${lib.replaceStrings [ "." ] [ "_" ] version}";
+    hash = "sha256-GjXrYV+EBduhG88LaxQWICKuUDJeeotcZgqgaG0/dqo=";
  };

  nativeBuildInputs = [
@ -81,7 +81,6 @@ stdenv.mkDerivation rec {

  mesonFlags = [
    "-Drpm=false"
-    "-Dstemmer=false"
    "-Ddep11=false"
  ];

@ -92,6 +91,7 @@ stdenv.mkDerivation rec {
  '';

  meta = {
+    changelog = "https://github.com/hughsie/appstream-glib/blob/${src.tag}/NEWS";
    description = "Objects and helper methods to read and write AppStream metadata";
    homepage = "https://people.freedesktop.org/~hughsient/appstream-glib/";
    license = lib.licenses.lgpl2Plus;
--- a/pkgs/by-name/ar/argc/package.nix
+++ b/pkgs/by-name/ar/argc/package.nix
@ -16,16 +16,16 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "argc";
-  version = "1.23.0";
+  version = "1.24.0";

  src = fetchFromGitHub {
    owner = "sigoden";
    repo = "argc";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-in2ymxiSZbs3wZwo/aKfu11x8SLx4OHOoa/tVxr3FyM=";
+    hash = "sha256-xgJIJUk9T7zUbr1MqN89mbt6IY4J4lG9uCzWrsmOW0Q=";
  };

-  cargoHash = "sha256-2UmI9CMa130T7ML9iVNQ8Zh/stiFg05eBtF1sprmwk8=";
+  cargoHash = "sha256-5en2517Xgn+4FYeTcpj6m2ZN/MTItiu2g9g/UEJAEiw=";

  nativeBuildInputs = [ installShellFiles ] ++ lib.optional (!canExecuteHost) buildPackages.argc;

--- a/pkgs/by-name/az/azure-cli/extensions-manual.nix
+++ b/pkgs/by-name/az/azure-cli/extensions-manual.nix
@ -125,9 +125,9 @@

  azure-devops = mkAzExtension rec {
    pname = "azure-devops";
-    version = "1.0.3";
+    version = "1.0.4";
    url = "https://github.com/Azure/azure-cli-extensions/releases/download/azure-devops-${version}/azure_devops-${version}-py2.py3-none-any.whl";
-    hash = "sha256-CbBskqfEktpW+ziRkdZO0kCW70FJ+vaBQjEn66nOCXM=";
+    hash = "sha256-MYW8CnDfBnBi/dfOgSsI+yT605M8uSxvfjEkEdqYVSo=";
    description = "Tools for managing Azure DevOps";
    propagatedBuildInputs = with python3Packages; [ distro ];
    meta.maintainers = with lib.maintainers; [ katexochen ];
--- a/pkgs/by-name/ch/chroma/package.nix
+++ b/pkgs/by-name/ch/chroma/package.nix
@ -6,16 +6,16 @@

 buildGoModule (finalAttrs: {
  pname = "chroma";
-  version = "2.24.1";
+  version = "2.25.0";

  src = fetchFromGitHub {
    owner = "alecthomas";
    repo = "chroma";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-AcXfyqwcDCVG3msdUOA8M5sRgKM6UjUsou9/zKEHnE8=";
+    hash = "sha256-K2r863R1ckroKVsxMXZanxfTnMrkFtch1ZFYLUb0mMc=";
  };

-  vendorHash = "sha256-Vq5k4Jz4r5iZs7Yy175Ubj92eSr4v1xCtbLYhfo3OAg=";
+  vendorHash = "sha256-lamMRKrGF0b5mfXMCsQid/UO6AyuKryJX7cKIRJho1c=";

  modRoot = "./cmd/chroma";

--- a/pkgs/by-name/cl/claude-code/manifest.json
+++ b/pkgs/by-name/cl/claude-code/manifest.json
@ -1,47 +1,47 @@
 {
-  "version": "2.1.148",
-  "commit": "650a3d6e4b17f2fd01a8432a7691d9fb147adf8d",
-  "buildDate": "2026-05-21T23:11:38Z",
+  "version": "2.1.152",
+  "commit": "228d8c605defcb10a183db2dbf364a2d6c490c8b",
+  "buildDate": "2026-05-26T19:31:46Z",
  "platforms": {
    "darwin-arm64": {
      "binary": "claude",
-      "checksum": "f4a1860d3d9b01653dde4183e2f1216ca9e0c1a404dd63caa4edf07c904102aa",
-      "size": 211584672
+      "checksum": "43cb9361f7bc48c39214d5f125003b8de0ebde5cd6a1173e6b74fcdd10966d46",
+      "size": 214210080
    },
    "darwin-x64": {
      "binary": "claude",
-      "checksum": "7c52d8419cc22b8355c6309d4542df32b3f245d1a7c3329a30797244ef3c4629",
-      "size": 214082320
+      "checksum": "e9ecf8da70518a4ff852baf36c9eac369762a4568ba3cd5078fa894303e39735",
+      "size": 216724240
    },
    "linux-arm64": {
      "binary": "claude",
-      "checksum": "b53c29b1fe003372636048c16d57a74f1ca2c57d8413dd5b14e2ca77710823ed",
-      "size": 236959368
+      "checksum": "35ef2685c4f679b5c4610ef56b30a680b6d595b958b4fa5ec0bfa2852195f345",
+      "size": 239515272
    },
    "linux-x64": {
      "binary": "claude",
-      "checksum": "3b38836a1801a6397f8431c6a62b127ce47e3e9d103c1a700fca7f9c8ab5f8ac",
-      "size": 237037264
+      "checksum": "5155bdca27f754aba0d2fe2f80336f5fd4793224561c234a723f0ccef654a8e8",
+      "size": 239650512
    },
    "linux-arm64-musl": {
      "binary": "claude",
-      "checksum": "06b54aef9989ea379933239c3f2dbee254034523ff67f9a0c8ed31ac6982c077",
-      "size": 229814104
+      "checksum": "b374ef7f8c59d10a04071f6c50ccd83008188b7db26589f4fb359ee435d49929",
+      "size": 232370008
    },
    "linux-x64-musl": {
      "binary": "claude",
-      "checksum": "ad0077c9ec67ec2eaeee8be7624cc2e55b9e012e1c19154e5b80ef0a47d0e360",
-      "size": 231431216
+      "checksum": "d4cd1951ceb25ef2bed74cd9e0dc6dec4f1219f086a35a1433eb988443096e48",
+      "size": 234044464
    },
    "win32-x64": {
      "binary": "claude.exe",
-      "checksum": "1bb46bdb06ef092b0af29cafbfec6ab73251ea34562cfe1d3a5bdf67fe3a5f93",
-      "size": 232827552
+      "checksum": "bbea6d550bdd765c3b9e3b1fa19a49d04dd16c1687e5b21f9e0974a18b867a73",
+      "size": 235329184
    },
    "win32-arm64": {
      "binary": "claude.exe",
-      "checksum": "d86eeb4d84a2bbee253913843a4a507192a37512a2d918a4c91e3f583cb310a5",
-      "size": 228792992
+      "checksum": "fd4711d17e9576fec0998c85a3726e43c26e7735e1f4552064310897acf1781b",
+      "size": 231294112
    }
  }
 }
--- a/pkgs/by-name/cl/clj-kondo/package.nix
+++ b/pkgs/by-name/cl/clj-kondo/package.nix
@ -6,11 +6,11 @@

 buildGraalvmNativeImage (finalAttrs: {
  pname = "clj-kondo";
-  version = "2026.01.19";
+  version = "2026.04.15";

  src = fetchurl {
    url = "https://github.com/clj-kondo/clj-kondo/releases/download/v${finalAttrs.version}/clj-kondo-${finalAttrs.version}-standalone.jar";
-    sha256 = "sha256-S4Fg165BkD1ufuH+8JmDmY/o1GzScZUirEEifGrnmLo=";
+    sha256 = "sha256-BJw4A5c9F6S6T5d3dP0VdfEaayqoLbHiXUyEyqKFP94=";
  };

  extraNativeImageBuildArgs = [
--- a/pkgs/by-name/co/codex/package.nix
+++ b/pkgs/by-name/co/codex/package.nix
@ -25,18 +25,18 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "codex";
-  version = "0.133.0";
+  version = "0.134.0";

  src = fetchFromGitHub {
    owner = "openai";
    repo = "codex";
    tag = "rust-v${finalAttrs.version}";
-    hash = "sha256-RTxhhZjZ/64N60pmbNVzLwcSBomn67pPDpOjkL6RPUw=";
+    hash = "sha256-eHe4bjUIvSK512ZTlFcOBqv5hhM+zfzkxcLfrzDA7L4=";
  };

  sourceRoot = "${finalAttrs.src.name}/codex-rs";

-  cargoHash = "sha256-J4wvPn4lSTSsJrTG56vkhJe2F2b+fUvJLEd+qKQ9LUg=";
+  cargoHash = "sha256-DjqTn6DWfOlwdQ387eWeT5fs6qIgaD2rAXjxNStKgrs=";

  # Match upstream's release build for the codex binary only.
  cargoBuildFlags = [
--- a/pkgs/by-name/fe/fence/package.nix
+++ b/pkgs/by-name/fe/fence/package.nix
@ -17,7 +17,7 @@ buildGoModule (finalAttrs: {
  version = "0.1.58";

  src = fetchFromGitHub {
-    owner = "Use-Tusk";
+    owner = "jy-tan";
    repo = "fence";
    tag = "v${finalAttrs.version}";
    hash = "sha256-ACe3N4bXYJW6QDQHtRChFWOTXTZTbEUbZ4d8cuFRqMY=";
@ -76,7 +76,8 @@ buildGoModule (finalAttrs: {

  meta = {
    description = "Lightweight, container-free sandbox for running commands with network and filesystem restrictions";
-    homepage = "https://github.com/Use-Tusk/fence";
+    homepage = "https://fencesandbox.com";
+    changelog = "https://github.com/jy-tan/fence/releases";
    license = lib.licenses.asl20;
    maintainers = with lib.maintainers; [ dwt ];
    mainProgram = "fence";
--- a/pkgs/by-name/fu/fulcio/package.nix
+++ b/pkgs/by-name/fu/fulcio/package.nix
@ -15,13 +15,13 @@

 buildGoModule (finalAttrs: {
  pname = "fulcio";
-  version = "1.8.5";
+  version = "1.8.6";

  src = fetchFromGitHub {
    owner = "sigstore";
    repo = "fulcio";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-YMM517FpQvx3+8g2EuMmUo7cHTxaXUmCcszqnn3xs+c=";
+    hash = "sha256-R0fqBbK3dpbjnLlB0IB5IsaJO/+PxjEphqzjXV/nmsA=";
    # populate values that require us to use git. By doing this in postFetch we
    # can delete .git afterwards and maintain better reproducibility of the src.
    leaveDotGit = true;
@ -33,7 +33,7 @@ buildGoModule (finalAttrs: {
      find "$out" -name .git -print0 | xargs -0 rm -rf
    '';
  };
-  vendorHash = "sha256-FmHT3qLl42LXeU8RA3E8P2QyZyTfxA5b+vHg0EfDHmM=";
+  vendorHash = "sha256-NLBorBTXNVxvvGKgekTOQuarMcoxZv8sVzKzPStGT74=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/by-name/go/gomplate/package.nix
+++ b/pkgs/by-name/go/gomplate/package.nix
@ -6,16 +6,16 @@

 buildGoModule (finalAttrs: {
  pname = "gomplate";
-  version = "5.0.0";
+  version = "5.1.0";

  src = fetchFromGitHub {
    owner = "hairyhenderson";
    repo = "gomplate";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-xzWPZk8eI3/4sPceFNELeVJ1Spbey5bWhhgez+PQpz4=";
+    hash = "sha256-wgRIwY3MqYbVU/k4BZWqdDcybSJwnCDFQZ6ybr2/tiM=";
  };

-  vendorHash = "sha256-Wix7ABkI2MnCd1qjfeTNLaXPgembjb9RY+spRqEp2cs=";
+  vendorHash = "sha256-QXaXOEGUW1Wo6kD16nrNOn3MoZuJw8YNuJtGh0ffCgQ=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/gp/gpu-burn/0001-Emit-compare.fatbin-and-make-arch-compute_X-conditio.patch
+++ b/pkgs/by-name/gp/gpu-burn/0001-Emit-compare.fatbin-and-make-arch-compute_X-conditio.patch
@ -1,121 +0,0 @@
-From b8dc3f753bd2aefb192f95688dc12797bc041627 Mon Sep 17 00:00:00 2001
-From: Connor Baker <ConnorBaker01@gmail.com>
-Date: Tue, 19 May 2026 20:16:28 -0700
-Subject: [PATCH] Emit compare.fatbin and make -arch=compute_X conditional
-
-cuModuleLoad accepts cubin/fatbin/PTX interchangeably, so the C++ side
-just needs the filename swap.  The benefit is that callers wanting to
-target multiple architectures (or to opt into architecture-conditional
-sm_90a / family-specific compute_100f features) can now append -gencode
-flags via NVCCFLAGS; -ptx output is a single-arch text format with no
-way to multiplex more than one architecture into one file.
-
-To let those callers fully control which architectures end up in the
-fatbin, guard the default -arch=compute_$(COMPUTE) entry behind a non-
-empty check.  'make COMPUTE=' now skips it; default 'make' and
-'make COMPUTE=86' behave exactly as before.
-
-Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
- Dockerfile       |  2 +-
- Makefile         | 10 ++++++----
- README.md        |  8 ++++++++
- gpu-burn.8       |  2 +-
- gpu_burn-drv.cpp |  2 +-
- 5 files changed, 17 insertions(+), 7 deletions(-)
-
-diff --git a/Dockerfile b/Dockerfile
-index 08e5202..1c46976 100644
--- a/Dockerfile
-+++ b/Dockerfile
-@@ -12,7 +12,7 @@ RUN make
- FROM nvidia/cuda:${CUDA_VERSION}-runtime-${IMAGE_DISTRO}
- 
- COPY --from=builder /build/gpu_burn /app/
-COPY --from=builder /build/compare.ptx /app/
-+COPY --from=builder /build/compare.fatbin /app/
- 
- WORKDIR /app
- 
-diff --git a/Makefile b/Makefile
-index ec54a19..d23425a 100644
--- a/Makefile
-+++ b/Makefile
-@@ -32,23 +32,25 @@ IMAGE_DISTRO ?= ubi8
- 
- override NVCCFLAGS ?=
- override NVCCFLAGS += -I${CUDAPATH}/include
-+ifneq ($(strip $(COMPUTE)),)
- override NVCCFLAGS += -arch=compute_$(subst .,,${COMPUTE})
-+endif
- 
- IMAGE_NAME ?= gpu-burn
- 
- .PHONY: clean
- 
-gpu_burn: gpu_burn-drv.o compare.ptx
-+gpu_burn: gpu_burn-drv.o compare.fatbin
- 	g++ -o $@ $< -O3 ${LDFLAGS}
- 
- %.o: %.cpp
- 	g++ ${CFLAGS} -c $<
- 
-%.ptx: %.cu
-	PATH="${PATH}:${CCPATH}:." ${NVCC} ${NVCCFLAGS} -ptx $< -o $@
-+%.fatbin: %.cu
-+	PATH="${PATH}:${CCPATH}:." ${NVCC} ${NVCCFLAGS} -fatbin $< -o $@
- 
- clean:
-	$(RM) *.ptx *.o gpu_burn
-+	$(RM) *.fatbin *.o gpu_burn
- 
- image:
- 	docker build --build-arg CUDA_VERSION=${CUDA_VERSION} --build-arg IMAGE_DISTRO=${IMAGE_DISTRO} -t ${IMAGE_NAME} .
-diff --git a/README.md b/README.md
-index ca95342..1b050bf 100644
--- a/README.md
-+++ b/README.md
-@@ -37,6 +37,14 @@ To override this with a different value:
- 
- `make COMPUTE=<compute capability value>`
- 
-+`COMPUTE` selects a single virtual architecture for the default `-arch`
-+flag.  For a fat binary targeting multiple architectures, or to opt into
-+architecture-conditional (`sm_90a`) or family-specific (`compute_100f`)
-+features, set `COMPUTE=` to suppress the default and drive the build
-+entirely from `-gencode` flags via `NVCCFLAGS`:
-+
-+`make COMPUTE= NVCCFLAGS='-gencode=arch=compute_86,code=sm_86 -gencode=arch=compute_90,code=sm_90'`
-+
- CFLAGS can be added when invoking make to add to the default
- list of compiler flags:
- 
-diff --git a/gpu-burn.8 b/gpu-burn.8
-index bf071a4..b1c46c4 100644
--- a/gpu-burn.8
-+++ b/gpu-burn.8
-@@ -19,7 +19,7 @@ GPU Burn
- .br
- \fB\-i\fR N    Execute only on GPU N
- .br
-\fB\-c\fR FILE Use FILE as compare kernel.  Default is compare.ptx
-+\fB\-c\fR FILE Use FILE as compare kernel.  Default is compare.fatbin
- .br
- \fB\-stts\fR T Set timeout threshold to T seconds for using SIGTERM to abort child processes before using SIGKILL.  Default is 30
- .br
-diff --git a/gpu_burn-drv.cpp b/gpu_burn-drv.cpp
-index eae3532..a66ec9a 100644
--- a/gpu_burn-drv.cpp
-+++ b/gpu_burn-drv.cpp
-@@ -30,7 +30,7 @@
- // Matrices are SIZE*SIZE..  POT should be efficiently implemented in CUBLAS
- #define SIZE 8192ul
- #define USEMEM 0.9 // Try to allocate 90% of memory
-#define COMPARE_KERNEL "compare.ptx"
-+#define COMPARE_KERNEL "compare.fatbin"
- 
- // Used to report op/s, measured through Visual Profiler, CUBLAS from CUDA 7.5
- // (Seems that they indeed take the naive dim^3 approach)
-- 
-2.43.0
-
--- a/pkgs/by-name/gp/gpu-burn/package.nix
+++ b/pkgs/by-name/gp/gpu-burn/package.nix
@ -21,20 +21,17 @@ let
 in
 backendStdenv.mkDerivation {
  pname = "gpu-burn";
-  version = "0-unstable-2025-11-04";
+  version = "0-unstable-2026-05-27";

  strictDeps = true;

  src = fetchFromGitHub {
    owner = "wilicc";
    repo = "gpu-burn";
-    rev = "671f4be92477ce01cd9b536bc534a006dbee058f";
-    hash = "sha256-zaGzwpdvF9dw3RypBO+g6FhjOFN8/F9+yI1+lLxLjgs=";
+    rev = "dfc30426a45613a36b5da53ef901a1e29d3db374";
+    hash = "sha256-/gDD6t3gGtPEZVageQyVRIb87gTa0yeygE45zmOVli4=";
  };

-  # TODO: drop once https://github.com/wilicc/gpu-burn/pull/148 lands.
-  patches = [ ./0001-Emit-compare.fatbin-and-make-arch-compute_X-conditio.patch ];
-
  postPatch = ''
    substituteInPlace gpu_burn-drv.cpp \
      --replace-fail \
--- a/pkgs/by-name/ha/halide/package.nix
+++ b/pkgs/by-name/ha/halide/package.nix
@ -3,6 +3,7 @@
  stdenv,
  llvmPackages,
  fetchFromGitHub,
+  fetchpatch2,
  cmake,
  flatbuffers,
  libffi,
@ -37,6 +38,19 @@ stdenv.mkDerivation (finalAttrs: {
    hash = "sha256-A5EnZgXc9+L+bzWHftaL74nHmP8Jf0rnT5KJAAWvKis=";
  };

+  patches = [
+    # Backport: properly initialize bf16 inputs in simd_op_check.
+    (fetchpatch2 {
+      url = "https://github.com/halide/Halide/commit/acb58504f0ce02e07b8b9008668c8779d3561ec8.patch?full_index=1";
+      hash = "sha256-n9avTYe8JFYQKeJQBQQV9xoOoYp0imXD2GQgifRym/A=";
+    })
+    # Backport: add Zen4/Zen5/AVXVNNI feature flags to simd_op_check's can_run_code.
+    (fetchpatch2 {
+      url = "https://github.com/halide/Halide/commit/1b9be55dfaa162fad6a3ed3c6e8d83f966ce8af1.patch?full_index=1";
+      hash = "sha256-5f6Q2Q1pvimlFV3lCcMzIHMIze6A8TmnMjVpQ8/ceyg=";
+    })
+  ];
+
  postPatch = ''
    substituteInPlace src/runtime/CMakeLists.txt --replace-fail \
        '-isystem "''${VulkanHeaders_INCLUDE_DIR}"' \
--- a/pkgs/by-name/ja/jackett/package.nix
+++ b/pkgs/by-name/ja/jackett/package.nix
@ -12,13 +12,13 @@

 buildDotnetModule (finalAttrs: {
  pname = "jackett";
-  version = "0.24.1879";
+  version = "0.24.1954";

  src = fetchFromGitHub {
    owner = "jackett";
    repo = "jackett";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-gtDN77TB1AKLfqtvFPoQ3tatXB63Ajax2j1gokgHX4s=";
+    hash = "sha256-HuMK8nW0PRBmRYUYAr3h/hDkVhUGgQIj+7v60ChuKRw=";
  };

  projectFile = "src/Jackett.Server/Jackett.Server.csproj";
--- a/pkgs/by-name/ja/jay/package.nix
+++ b/pkgs/by-name/ja/jay/package.nix
@ -19,16 +19,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "jay";
-  version = "1.12.0";
+  version = "1.13.0";

  src = fetchFromGitHub {
    owner = "mahkoh";
    repo = "jay";
    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-JOt3xEONGDmLovk72hX0d3De01zTd51d2/J4HziBE9I=";
+    sha256 = "sha256-tC2V1BgUGsUMpZsKXjFSS8Mp28LrNI/QNu761zpgAkc=";
  };

-  cargoHash = "sha256-wK9v3YwP067etFAu6Ca9Sts+QrD4uL48chbL6tZKFkk=";
+  cargoHash = "sha256-96vCkZR/8dgZH0hJPeKzP7jQZ41W7XTi9yMnxFaIhoY=";

  nativeBuildInputs = [
    autoPatchelfHook
@ -50,6 +50,15 @@ rustPlatform.buildRustPackage (finalAttrs: {
    vulkan-loader
  ];

+  checkFlags = [
+    # these 5 tests fail in the lix sandbox because they rely on io_uring
+    "--skip=cpu_worker::tests::cancel"
+    "--skip=cpu_worker::tests::complete"
+    "--skip=eventfd_cache::tests::test"
+    "--skip=io_uring::ops::read_write_no_cancel::tests::cancel_in_kernel"
+    "--skip=io_uring::ops::read_write_no_cancel::tests::cancel_in_userspace"
+  ];
+
  postInstall = ''
    install -D etc/jay.portal $out/share/xdg-desktop-portal/portals/jay.portal
    install -D etc/jay-portals.conf $out/share/xdg-desktop-portal/jay-portals.conf
@ -72,7 +81,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    homepage = "https://github.com/mahkoh/jay";
    license = lib.licenses.gpl3;
    platforms = lib.platforms.linux;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ uku3lig ];
    mainProgram = "jay";
  };
 })
--- a/pkgs/by-name/je/jetbrains-toolbox/package.nix
+++ b/pkgs/by-name/je/jetbrains-toolbox/package.nix
@ -10,7 +10,7 @@

 let
  pname = "jetbrains-toolbox";
-  version = "3.1.0.62320";
+  version = "3.4.3.81140";

  updateScript = ./update.sh;

@ -58,10 +58,10 @@ let
        aarch64 = "-arm64";
      };
      hash = selectSystem {
-        x86_64-linux = "sha256-Fmnj1mYMpsiBpnERiWPAwQaH7qLqkrTICn0mxX0h+2U=";
-        aarch64-linux = "sha256-ogLaPN9nxZFQ09qmIF2mEi5o9LVgjoGtmYclc6KmrNU=";
-        x86_64-darwin = "sha256-hO5J9I8ZrzsgGtb9dMg2SeI/PrxpkFRjDRUdrjqMnPw=";
-        aarch64-darwin = "sha256-xA0LbwDKR6/64K9uUJHvrPC+0mRLGM/axz8+Knc+X8A=";
+        x86_64-linux = "sha256-cDquMMb2gcRv6juEo2Ty4KgoKG5zBYtq+0mppnq4vyU=";
+        aarch64-linux = "sha256-jF9Evg6IZVEz6Nsl8XYb0nIyaO/yqdEEYOs+k2vZ8jo=";
+        x86_64-darwin = "sha256-AiaER3tqV1GXL3E1ImWdIjWt/iElt+kxNTHz7bpgeQw=";
+        aarch64-darwin = "sha256-UIh7HRx+ofdnxA8Bv6kI2L0pFmWW0UMApexffe+9bY0=";
      };
    in
    selectKernel {
--- a/pkgs/by-name/la/lazygit/package.nix
+++ b/pkgs/by-name/la/lazygit/package.nix
@ -8,13 +8,13 @@
 }:
 buildGoModule (finalAttrs: {
  pname = "lazygit";
-  version = "0.61.1";
+  version = "0.62.0";

  src = fetchFromGitHub {
    owner = "jesseduffield";
    repo = "lazygit";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-sFmOHsYs39i4mSH/CnetWFBQBviv5QsP0qfCSkaEJZE=";
+    hash = "sha256-D0Sg6FnbashNYTxM2HymJfRR8Ozric2c/IHnHKXuC+0=";
  };

  vendorHash = null;
--- a/pkgs/by-name/ld/ldeep/package.nix
+++ b/pkgs/by-name/ld/ldeep/package.nix
@ -6,14 +6,14 @@

 python3.pkgs.buildPythonApplication (finalAttrs: {
  pname = "ldeep";
-  version = "2.0.2";
+  version = "2.0.3";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "franc-pentest";
    repo = "ldeep";
    tag = finalAttrs.version;
-    hash = "sha256-YR8ywhC+t35utojlmqD6rryzPE1UzTIQek3VmbpUfQ8=";
+    hash = "sha256-VTgH/Wgk+0GY+jwZPEdMroQwKzliUjEzhrYU82lyOu0=";
  };

  pythonRelaxDeps = [
--- a/pkgs/by-name/lu/luigi/package.nix
+++ b/pkgs/by-name/lu/luigi/package.nix
@ -1,28 +1,33 @@
 {
  lib,
-  python3,
+  python3Packages,
  fetchPypi,
 }:

-python3.pkgs.buildPythonApplication (finalAttrs: {
+python3Packages.python.pkgs.buildPythonApplication (finalAttrs: {
  pname = "luigi";
-  version = "3.6.0";
+  version = "3.8.1";
  pyproject = true;

  src = fetchPypi {
-    inherit (finalAttrs) pname version;
-    hash = "sha256-QbFIUCI8YZ2QBrMKzacz51a4g/x+YIFCBVdmRxkMluM=";
+    pname = "luigi";
+    inherit (finalAttrs) version;
+    hash = "sha256-L6XrXTR05JXeCb2WT1ApNsCPix624PPKPIppEWw40MM=";
  };

-  build-system = [ python3.pkgs.setuptools ];
+  build-system = with python3Packages; [
+    hatchling
+    hatch-fancy-pypi-readme
+  ];

  pythonRelaxDeps = [ "tenacity" ];

-  dependencies = with python3.pkgs; [
+  dependencies = with python3Packages; [
    python-dateutil
    tornado
    python-daemon
    tenacity
+    typing-extensions
  ];

  pythonImportsCheck = [ "luigi" ];
--- a/pkgs/by-name/mo/monosat/package.nix
+++ b/pkgs/by-name/mo/monosat/package.nix
@ -116,7 +116,11 @@ let
      # the sourceRoot if it weren't for the patch.
      postPatch =
        commonPostPatch
+        # cython 3.1 dropped the python 2 `long` builtin
        + ''
+          substituteInPlace src/monosat/api/python/monosat/monosat_p.pyx \
+            --replace-fail '(int, long)' 'int' \
+            --replace-fail '(int,long)' 'int'
          cd src/monosat/api/python
        ''
        +
--- a/pkgs/by-name/mu/multica-cli/package.nix
+++ b/pkgs/by-name/mu/multica-cli/package.nix
@ -9,18 +9,18 @@ buildGoModule rec {
  __structuredAttrs = true;

  pname = "multica-cli";
-  version = "0.3.2";
+  version = "0.3.9";

  src = fetchFromGitHub {
    owner = "multica-ai";
    repo = "multica";
    rev = "v${version}";
-    hash = "sha256-1ioDiNieaB+PX/NTR7B5FQGjvKZCIM6PgkgO5jSjZyE=";
+    hash = "sha256-gfmmuk6OOxELjCBPz8O4nPddVFtgC3MhUX8cSK8JefU=";
  };

  sourceRoot = "${src.name}/server";

-  vendorHash = "sha256-1rifzInFK8od9XAYWEuHU16ni2+gaDhlDIHc7WeuLU4=";
+  vendorHash = "sha256-p3Pil/iebgt9/8MSvOAJveIAnKu98/v0QnQVXCI1G98=";

  subPackages = [ "cmd/multica" ];

--- a/pkgs/by-name/ne/neil/package.nix
+++ b/pkgs/by-name/ne/neil/package.nix
@ -8,13 +8,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "neil";
-  version = "0.3.69";
+  version = "0.3.70";

  src = fetchFromGitHub {
    owner = "babashka";
    repo = "neil";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-NRuWRZRh93lQjfi3C+gliixZYAZ/JZRMZJbcPv29YFI=";
+    hash = "sha256-fuVZrv85PZQBM6mb7EWvvIfY3uoPY3VicY2QE8T9I3U=";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/by-name/ne/nezha-agent/package.nix
+++ b/pkgs/by-name/ne/nezha-agent/package.nix
@ -8,16 +8,16 @@
 }:
 buildGoModule (finalAttrs: {
  pname = "nezha-agent";
-  version = "2.0.3";
+  version = "2.0.4";

  src = fetchFromGitHub {
    owner = "nezhahq";
    repo = "agent";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-pysEeqW/WCj+VlERl9m5pir0SfCRA92R6akIGmHTLdI=";
+    hash = "sha256-ftPJhbh3dnJotJ5J9rlTkYVpmppBb5UWvx5Qy5Y5zGA=";
  };

-  vendorHash = "sha256-GIdkbQzHAIgH7KVoxZ1DcbamWYaRdTuJKGTnOn8SPyk=";
+  vendorHash = "sha256-0dwrwUeHbPdI5O8KeX4PQP1jN6P+AwPznqX78kxSleM=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/op/opencode/package.nix
+++ b/pkgs/by-name/op/opencode/package.nix
@ -16,13 +16,13 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "opencode";
-  version = "1.15.10";
+  version = "1.15.11";

  src = fetchFromGitHub {
    owner = "anomalyco";
    repo = "opencode";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-qp67k8Z+VA81uukZYuu3yqqmg/L8pkxYZQrJBoE25tU=";
+    hash = "sha256-SIRE+x1YCSAX1L89237RN9owJkC4hgCIy1Q93Iy9GzM=";
  };

  node_modules = stdenvNoCC.mkDerivation {
@ -75,7 +75,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    # NOTE: Required else we get errors that our fixed-output derivation references store paths
    dontFixup = true;

-    outputHash = "sha256-r3S0HHNk4TeTHEd8vbvgF+AXl5lJAyrTq+u2T3W0PdA=";
+    outputHash = "sha256-eOzzfDcYrjeVMMdEKlHbUy7F6MTUY3jXrVkr3q0LZ4Q=";
    outputHashAlgo = "sha256";
    outputHashMode = "recursive";
  };
--- a/pkgs/by-name/ph/phpstan/package.nix
+++ b/pkgs/by-name/ph/phpstan/package.nix
@ -9,13 +9,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "phpstan";
-  version = "2.1.55";
+  version = "2.1.56";

  src = fetchFromGitHub {
    owner = "phpstan";
    repo = "phpstan";
    tag = finalAttrs.version;
-    hash = "sha256-Mh0pHxn+SyQ5qQiesljBtiDycLuarLBLrKSu9gF7oaM=";
+    hash = "sha256-Ffn6rJhTKjXEjwWZ1tnSaUBsmLyLeIp5EQnGZcvxba8=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/re/redis/package.nix
+++ b/pkgs/by-name/re/redis/package.nix
@ -27,13 +27,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "redis";
-  version = "8.6.3";
+  version = "8.8.0";

  src = fetchFromGitHub {
    owner = "redis";
    repo = "redis";
    tag = finalAttrs.version;
-    hash = "sha256-Zg2bghU4uExwI1SWplYIGCeGRhgRxdh3Oy9k1DZPado=";
+    hash = "sha256-D9rhe5GC0axhKHoRfeegUIGYXbrcEsa9m9vYJVxwtCk=";
  };

  patches = lib.optional useSystemJemalloc (fetchpatch2 {
@ -41,13 +41,7 @@ stdenv.mkDerivation (finalAttrs: {
    hash = "sha256-A9qp+PWQRuNy/xmv9KLM7/XAyL7Tzkyn0scpVCGngcc=";
  });

-  postPatch = ''
-    # Using `yes` seems to be an invalid value and causes the test to fail. See
-    # https://github.com/redis/redis/blob/bd3b38d41070b478c58bc8b72d2af89cbccd1a40/redis.conf#L674-L688
-    substituteInPlace tests/integration/replication.tcl \
-      --replace-fail 'repl-diskless-load yes' ' repl-diskless-load on-empty-db'
-  ''
-  + lib.optionalString stdenv.hostPlatform.isDarwin ''
+  postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
    # The path `/Library/...` isn't available in the build sandbox. The package `apple-sdk`
    # can provide that functionality for us.
    substituteInPlace src/modules/Makefile modules/vector-sets/Makefile tests/modules/Makefile \
--- a/pkgs/by-name/re/regolith/package.nix
+++ b/pkgs/by-name/re/regolith/package.nix
@ -7,19 +7,19 @@
 }:
 buildGoModule (finalAttrs: {
  pname = "regolith";
-  version = "1.7.0";
+  version = "1.8.0";

  src = fetchFromGitHub {
    owner = "Bedrock-OSS";
    repo = "regolith";
    tag = finalAttrs.version;
-    hash = "sha256-9mRfK93eHuCA19RSdLKhlhbnQ0UTmBS46Gp1cXstTIk=";
+    hash = "sha256-jaUpNPRh3mZPz2z9+1mG5337NHaakP+4HOWENCzIfTY=";
  };

  # Requires network access.
  doCheck = false;

-  vendorHash = "sha256-jQeIPJJyANS+U9NrjLSnXHAecCK4rHPZrP5JFsMwcm8=";
+  vendorHash = "sha256-qak4USPwOxPHJ2GriVKhjdGazW4YkM3OaoMlqKPbtag=";

  ldflags = [
    "-X main.buildSource=nix"
--- a/pkgs/by-name/sk/skopeo/package.nix
+++ b/pkgs/by-name/sk/skopeo/package.nix
@ -19,13 +19,13 @@

 buildGoModule rec {
  pname = "skopeo";
-  version = "1.22.2";
+  version = "1.23.0";

  src = fetchFromGitHub {
    rev = "v${version}";
    owner = "containers";
    repo = "skopeo";
-    hash = "sha256-TyLJvCZosRaoUVmpe+uxGzgLDIFi8QgpRecaLmRGTxU=";
+    hash = "sha256-crt6TYEOQaBdP1lIixtnrMPeWQ/GAyA6N6K3Il+ZA1E=";
  };

  outputs = [
--- a/pkgs/by-name/ss/sshwifty/package.nix
+++ b/pkgs/by-name/ss/sshwifty/package.nix
@ -11,13 +11,13 @@
 }:
 buildGoModule (finalAttrs: {
  pname = "sshwifty";
-  version = "0.4.5-beta-release";
+  version = "0.4.7-beta-release";

  src = fetchFromGitHub {
    owner = "nirui";
    repo = "sshwifty";
    tag = finalAttrs.version;
-    hash = "sha256-b6DgDhnaeIT8HnE2+TNzI2XPmERwPdnv6U8cu0ZZmAc=";
+    hash = "sha256-Da/sgfhmSkUim05mJDNgxMohiLtAFdt3jyzsT/4vjj0=";
  };

  nativeBuildInputs = [
@ -32,10 +32,10 @@ buildGoModule (finalAttrs: {

  npmDeps = fetchNpmDeps {
    inherit (finalAttrs) src;
-    hash = "sha256-xfnG5ONEVA58ZHmFoG6x9bYxwHuAjq7VsqxifEH2nQk=";
+    hash = "sha256-6E7QAJO4R9Iszc8olyPnLUUAmrvMLDFivV3QN11qa60=";
  };

-  vendorHash = "sha256-s9wjaxeuIBClyBwDSZvnSVxXh/RI6oOITU2cL3oNb5o=";
+  vendorHash = "sha256-lJv1mBwwd9CTbSFVdu7H3Y9jkAJStMEa2SRYKAGOQUI=";

  preBuild = ''
    # Generate static pages
--- a/pkgs/by-name/tr/trurl/package.nix
+++ b/pkgs/by-name/tr/trurl/package.nix
@ -26,6 +26,8 @@ stdenv.mkDerivation rec {
      url = "https://github.com/curl/trurl/commit/f22a2c45956f35702e437fb83ac05376f1956ec5.patch";
      hash = "sha256-7CkUs5tMk77WKc7SlgE2NslHtU5cViKSGhHj3IBlpWo=";
    })
+    # https://github.com/curl/trurl/pull/441
+    ./tests-uppercase-hex.patch
  ];

  postPatch = ''
--- a/pkgs/by-name/tr/trurl/tests-uppercase-hex.patch
+++ b/pkgs/by-name/tr/trurl/tests-uppercase-hex.patch
@ -0,0 +1,96 @@
+--- a/tests.json
+++ b/tests.json
+@@ -749,6 +749,7 @@
+                 "query=user=me"
+             ]
+         },
+        "excludes": ["uppercase-hex"],
+         "expected": {
+             "stdout": "https://curl.se/hello?user%3dme\n",
+             "stderr": "",
+@@ -761,6 +762,22 @@
+                 "--url",
+                 "https://curl.se/hello",
+                 "--set",
+                "query=user=me"
+            ]
+        },
+        "required": ["uppercase-hex"],
+        "expected": {
+            "stdout": "https://curl.se/hello?user%3Dme\n",
+            "stderr": "",
+            "returncode": 0
+        }
+    },
+    {
+        "input": {
+            "arguments": [
+                "--url",
+                "https://curl.se/hello",
+                "--set",
+                 "fragment= hello"
+             ]
+         },
+@@ -2132,6 +2149,7 @@
+                 "query:=a&b&a%26b"
+             ]
+         },
+        "excludes": ["uppercase-hex"],
+         "expected": {
+             "stdout": "http://localhost/ABC%5c%5c?a&b&a%26b\n",
+             "returncode": 0,
+@@ -2141,6 +2159,26 @@
+     {
+         "input": {
+             "arguments": [
+                "-s",
+                "scheme:=http",
+                "-s",
+                "host:=localhost",
+                "-s",
+                "path:=/ABC%5C%5C",
+                "-s",
+                "query:=a&b&a%26b"
+            ]
+        },
+        "required": ["uppercase-hex"],
+        "expected": {
+            "stdout": "http://localhost/ABC%5C%5C?a&b&a%26b\n",
+            "returncode": 0,
+            "stderr": ""
+        }
+    },
+    {
+        "input": {
+            "arguments": [
+                 "-g",
+                 "{query:b}\\t{query-all:a}\\n{:query:b}\\t{:query-all:a}",
+                 "https://example.org/foo?a=1&b=%23&a=%26#hello"
+@@ -2825,11 +2863,27 @@
+                 "path=%61"
+             ]
+         },
+        "excludes": ["uppercase-hex"],
+         "expected": {
+             "stdout": "https://example.com/one/tao/%2fB/%2561\n",
+             "stderr": "",
+             "returncode": 0
+         }
+    },
+    {
+        "input": {
+            "arguments": [
+                "https://example.com/one/t%61o/%2F%42/",
+                "--append",
+                "path=%61"
+            ]
+        },
+        "required": ["uppercase-hex"],
+        "expected": {
+            "stdout": "https://example.com/one/tao/%2FB/%2561\n",
+            "stderr": "",
+            "returncode": 0
+        }
+     },
+     {
+         "input": {
--- a/pkgs/by-name/wa/wasmtime/package.nix
+++ b/pkgs/by-name/wa/wasmtime/package.nix
@ -13,20 +13,20 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "wasmtime";
-  version = "44.0.1";
+  version = "45.0.0";

  src = fetchFromGitHub {
    owner = "bytecodealliance";
    repo = "wasmtime";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-nVE18URbDKIrZr7ImPf2Zx5Ftq/oT2mZU0CMuBh+EYE=";
+    hash = "sha256-oCIMfBGhWZiaNNfH7Pc9DCpbEXs8AU3w8tIE6o/vjLk=";
    fetchSubmodules = true;
  };

  # Disable cargo-auditable until https://github.com/rust-secure-code/cargo-auditable/issues/124 is solved.
  auditable = false;

-  cargoHash = "sha256-K2Y6atvbvqIuc7Upk4134fZW1y329DlG2gzm8VveyWA=";
+  cargoHash = "sha256-yAPs2o2ayxxh3jk5+T8DiP9uFjBGyPTLzgP/RXPSj2g=";
  cargoBuildFlags = [
    "--package"
    "wasmtime-cli"
--- a/pkgs/by-name/wq/wqy_zenhei/package.nix
+++ b/pkgs/by-name/wq/wqy_zenhei/package.nix
@ -2,22 +2,24 @@
  lib,
  stdenvNoCC,
  fetchurl,
+  installFonts,
 }:

-stdenvNoCC.mkDerivation rec {
+stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "wqy-zenhei";
  version = "0.9.45";

  src = fetchurl {
-    url = "mirror://sourceforge/wqy/wqy-zenhei-${version}.tar.gz";
+    url = "mirror://sourceforge/wqy/wqy-zenhei-${finalAttrs.version}.tar.gz";
    hash = "sha256-5LfjBkdb+UJ9F1dXjw5FKJMMhMROqj8WfUxC8RDuddY=";
  };

+  nativeBuildInputs = [ installFonts ];
+
+  dontBuild = true;
+
  installPhase = ''
    runHook preInstall
-
-    install -Dm644 *.ttc -t $out/share/fonts/
-
    runHook postInstall
  '';

@ -28,4 +30,4 @@ stdenvNoCC.mkDerivation rec {
    maintainers = [ lib.maintainers.pkmx ];
    platforms = lib.platforms.all;
  };
-}
+})
--- a/pkgs/by-name/za/zashboard/package.nix
+++ b/pkgs/by-name/za/zashboard/package.nix
@ -12,13 +12,13 @@ let
 in
 buildNpmPackage (finalAttrs: {
  pname = "zashboard";
-  version = "3.5.1";
+  version = "3.6.0";

  src = fetchFromGitHub {
    owner = "Zephyruso";
    repo = "zashboard";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-yTLkfNhfmhJ/2oopKQ+F6ycYYwUXpbyz4SSE3IIpTgc=";
+    hash = "sha256-BaAU19xFEhfWHX9jA8DgXc6Kya7v1KRDiE3SbGaJVCM=";
  };

  npmDeps = null;
@ -26,7 +26,7 @@ buildNpmPackage (finalAttrs: {
    inherit (finalAttrs) pname version src;
    inherit pnpm;
    fetcherVersion = 3;
-    hash = "sha256-DMR9vNgsWdBK0BbSGzxEZUBZpa4szF2NIFO/GePwIUw=";
+    hash = "sha256-reYRJgLBxz+/J1wwPG4sO953R4xN0L6JInRJauseFc8=";
  };

  nativeBuildInputs = [ pnpm ];
--- a/pkgs/desktops/gnome/extensions/gsconnect/default.nix
+++ b/pkgs/desktops/gnome/extensions/gsconnect/default.nix
@ -23,7 +23,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "gnome-shell-extension-gsconnect";
-  version = "71";
+  version = "72";

  outputs = [
    "out"
@ -33,14 +33,15 @@ stdenv.mkDerivation (finalAttrs: {
  src = fetchFromGitHub {
    owner = "GSConnect";
    repo = "gnome-shell-extension-gsconnect";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-OgASLH/mPmRmT8RcXOAZLzDhhidLnlZNcgpAQNbO30Q=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-w9MQVEUQUcO1lqftBi76w5xSTlryKuZJxE6Ogg1J+ho=";
  };

  patches = [
    # Make typelibs available in the extension
    (replaceVars ./fix-paths.patch {
      gapplication = "${glib.bin}/bin/gapplication";
+      gjs = "${gjs}/bin/gjs";
      # Replaced in postPatch
      typelibPath = null;
    })
@ -120,6 +121,7 @@ stdenv.mkDerivation (finalAttrs: {
  meta = {
    description = "KDE Connect implementation for Gnome Shell";
    homepage = "https://github.com/GSConnect/gnome-shell-extension-gsconnect/wiki";
+    changelog = "https://github.com/GSConnect/gnome-shell-extension-gsconnect/releases/tag/${finalAttrs.src.tag}";
    license = lib.licenses.gpl2Plus;
    maintainers = with lib.maintainers; [ doronbehar ];
    teams = [ lib.teams.gnome ];
--- a/pkgs/desktops/gnome/extensions/gsconnect/fix-paths.patch
+++ b/pkgs/desktops/gnome/extensions/gsconnect/fix-paths.patch
@ -13,14 +13,14 @@ index 3fb887c3..e8cbe1bd 100644
 Icon=org.gnome.Shell.Extensions.GSConnect
 diff --git a/src/__nix-prepend-search-paths.js b/src/__nix-prepend-search-paths.js
 new file mode 100644
-index 00000000..d009dfd9
+index 00000000..e664ad9b
 --- /dev/null
 +++ b/src/__nix-prepend-search-paths.js
@@ -0,0 +1,2 @@
 +import GIRepository from 'gi://GIRepository';
 +'@typelibPath@'.split(':').forEach(path => GIRepository.Repository.dup_default().prepend_search_path(path));
 diff --git a/src/extension.js b/src/extension.js
-index 53ecd5fc..78782357 100644
+index b82a9754..7303ee7a 100644
 --- a/src/extension.js
 +++ b/src/extension.js
@@ -2,6 +2,8 @@
@ -32,11 +32,22 @@ index 53ecd5fc..78782357 100644
 import Gio from 'gi://Gio';
 import GObject from 'gi://GObject';
 
-diff --git i/src/gsconnect-preferences w/src/gsconnect-preferences
-index b16ddc7d..263dfb04 100755
+diff --git a/src/gsconnect-preferences b/src/gsconnect-preferences
+index 652f6b2e..7122bed6 100755
 --- a/src/gsconnect-preferences
 +++ b/src/gsconnect-preferences
-@@ -6,6 +6,8 @@
+@@ -15,5 +15,5 @@ if [ ! -f "./gsconnect-preferences.js" ]; then
+     fi
+     cd "$extension_dir" || exit 1
+ fi
+-exec /usr/bin/env gjs -m gsconnect-preferences.js
+exec @gjs@ -m gsconnect-preferences.js
+
+diff --git a/src/gsconnect-preferences.js b/src/gsconnect-preferences.js
+index e2b1efe9..c2060e61 100644
+--- a/src/gsconnect-preferences.js
+++ b/src/gsconnect-preferences.js
+@@ -4,6 +4,8 @@
 
 // -*- mode: js; -*-
 
@ -46,7 +57,7 @@ index b16ddc7d..263dfb04 100755
 import 'gi://GdkPixbuf?version=2.0';
 import Gio from 'gi://Gio?version=2.0';
 diff --git a/src/prefs.js b/src/prefs.js
-index dd20fd20..5f82c53a 100644
+index e4d38f8c..e177810b 100644
 --- a/src/prefs.js
 +++ b/src/prefs.js
@@ -2,6 +2,8 @@
@ -58,3 +69,24 @@ index dd20fd20..5f82c53a 100644
 import Gio from 'gi://Gio';
 import GLib from 'gi://GLib';
 import Adw from 'gi://Adw';
+@@ -28,6 +30,6 @@ export default class GSConnectExtensionPreferences extends ExtensionPreferences
+ 
+         const _launcher = Gio.SubprocessLauncher.new({flags: Gio.SubprocessFlags.NONE});
+         _launcher.set_cwd(this.path);
+-        _launcher.spawnv(['gjs', '-m', 'gsconnect-preferences.js']);
+        _launcher.spawnv(['@gjs@', '-m', 'gsconnect-preferences.js']);
+     }
+ }
+diff --git a/src/service/daemon.js b/src/service/daemon.js
+index dda8b434..889c7d48 100755
+--- a/src/service/daemon.js
+++ b/src/service/daemon.js
+@@ -214,7 +214,7 @@ const Service = GObject.registerClass({
+             {flags: Gio.SubprocessFlags.NONE}
+         );
+         _launcher.set_cwd(Config.PACKAGE_DATADIR);
+-        _launcher.spawnv(['gjs', '-m', 'gsconnect-preferences.js']);
+        _launcher.spawnv(['@gjs@', '-m', 'gsconnect-preferences.js']);
+     }
+ 
+     /**
--- a/pkgs/development/ada-modules/gnatcoll/core.nix
+++ b/pkgs/development/ada-modules/gnatcoll/core.nix
@ -30,11 +30,11 @@ stdenv.mkDerivation rec {
  };

  patches = [
-    # Fix compilation with GNAT 12 https://github.com/AdaCore/gnatcoll-core/issues/88
+    # Fix compilation with GNAT 16
    (fetchpatch2 {
-      name = "gnatcoll-core-gnat-12.patch";
-      url = "https://github.com/AdaCore/gnatcoll-core/commit/515db1c9f1eea8095f2d9ff9570159a78c981ec6.patch";
-      sha256 = "1ghnkhp5fncb7qcmf59kyqvy0sd0pzf1phnr2z7b4ljwlkbmcp36";
+      name = "gnatcoll-core-gnat-16.patch";
+      url = "https://github.com/AdaCore/gnatcoll-core/commit/b266466e0a05b30615ec43d72782c345470455b9.patch?full_index=1";
+      hash = "sha256-rG0D1y2dbXA2M2Arnto+f7iAhg3yCfTPDbDRN+pMJKQ=";
    })
  ];

--- a/pkgs/development/ada-modules/gnatprove/default.nix
+++ b/pkgs/development/ada-modules/gnatprove/default.nix
@ -86,6 +86,9 @@ let
      patches = [
        # Disable Coq related targets which are missing in the fsf-15 branch
        ./0001-fix-install-fsf-15.patch
+
+        # Suppress warnings on aarch64: https://github.com/AdaCore/spark2014/issues/54
+        ./0002-mute-aarch64-warnings.patch
      ];
      commit_date = "2025-06-10";
    };
--- a/pkgs/development/ada-modules/gprbuild/boot.nix
+++ b/pkgs/development/ada-modules/gprbuild/boot.nix
@ -2,6 +2,7 @@
  stdenv,
  lib,
  fetchFromGitHub,
+  fetchpatch2,
  gnat,
  which,
  xmlada, # for src
@ -36,6 +37,20 @@ stdenv.mkDerivation {
    which
  ];

+  # Fix compilation with GNAT 16
+  patches = lib.optionals (lib.versionAtLeast gnat.version "16") [
+    # gpr-compilation-process.adb:44:29: error: operator for type "String" is not declared in "Env_Maps"
+    (fetchpatch2 {
+      url = "https://github.com/AdaCore/gprbuild/commit/6421e350274b3018a26bd058b1c90d033b053f71.patch?full_index=1";
+      hash = "sha256-u9bmr8abmthlyHoeqW5nS2CnaxXmbx6WVwhemxVtw+0=";
+    })
+    # gpr-compilation-protocol.adb:981:13: error: "time_t" is undefined
+    (fetchpatch2 {
+      url = "https://github.com/AdaCore/gprbuild/commit/6b6be939d69d534beb7faca17664d7a1ffa9c81e.patch?full_index=1";
+      hash = "sha256-YUjBvA4bBsrCB46o5WVHOZR6qOf2bkMg+A9qlystDbc=";
+    })
+  ];
+
  postPatch = ''
    # The Makefile uses gprbuild to build gprbuild which
    # we can't do at this point, delete it to prevent the
--- a/pkgs/development/ada-modules/gprbuild/default.nix
+++ b/pkgs/development/ada-modules/gprbuild/default.nix
@ -47,11 +47,13 @@ stdenv.mkDerivation {
    NIX_LDFLAGS = "-headerpad_max_install_names";
  };

-  # Fixes gprbuild being linked statically always. Based on the AUR's patch:
-  # https://aur.archlinux.org/cgit/aur.git/plain/0001-Makefile-build-relocatable-instead-of-static-binary.patch?h=gprbuild&id=bac524c76cd59c68fb91ef4dfcbe427357b9f850
-  patches = lib.optionals (!stdenv.hostPlatform.isStatic) [
-    ./gprbuild-relocatable-build.patch
-  ];
+  patches =
+    gprbuild-boot.patches
+    # Fixes gprbuild being linked statically always. Based on the AUR's patch:
+    # https://aur.archlinux.org/cgit/aur.git/plain/0001-Makefile-build-relocatable-instead-of-static-binary.patch?h=gprbuild&id=bac524c76cd59c68fb91ef4dfcbe427357b9f850
+    ++ lib.optionals (!stdenv.hostPlatform.isStatic) [
+      ./gprbuild-relocatable-build.patch
+    ];

  buildFlags = [
    "all"
--- a/pkgs/development/ocaml-modules/mirage-crypto/rng.nix
+++ b/pkgs/development/ocaml-modules/mirage-crypto/rng.nix
@ -1,4 +1,6 @@
 {
+  lib,
+  stdenv,
  buildDunePackage,
  mirage-crypto,
  ohex,
@ -24,6 +26,14 @@ buildDunePackage {
    randomconv
  ];

+  # test_entropy relies on timer jitter and is flaky on x86_64-darwin.
+  postPatch = lib.optionalString (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64) ''
+    substituteInPlace tests/dune \
+      --replace-fail \
+        '(enabled_if (and (<> %{architecture} "arm64") (<> %{architecture} "riscv")))' \
+        '(enabled_if false)'
+  '';
+
  buildInputs = [ dune-configurator ];
  propagatedBuildInputs = [
    digestif
--- a/pkgs/development/python-modules/appthreat-vulnerability-db/default.nix
+++ b/pkgs/development/python-modules/appthreat-vulnerability-db/default.nix
@ -23,14 +23,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "appthreat-vulnerability-db";
-  version = "6.6.2";
+  version = "6.7.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "AppThreat";
    repo = "vulnerability-db";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-p5mx6fvqLZZ+te8twTWHTKEcuUg9pUyT2raMFADiVCw=";
+    hash = "sha256-CIRl2bGGIIzDzYoWYmBySb7y/LxByel4DpEzD1y6hUs=";
  };

  pythonRelaxDeps = [
--- a/pkgs/development/python-modules/boto3-stubs/default.nix
+++ b/pkgs/development/python-modules/boto3-stubs/default.nix
@ -358,13 +358,13 @@

 buildPythonPackage (finalAttrs: {
  pname = "boto3-stubs";
-  version = "1.43.14";
+  version = "1.43.15";
  pyproject = true;

  src = fetchPypi {
    pname = "boto3_stubs";
    inherit (finalAttrs) version;
-    hash = "sha256-GPPUAs+BHWOMj8s82TXQ5Fl1PbXL+j03t9Jdff3iyyA=";
+    hash = "sha256-H+qjjxPVNreUAqW8SoxszniTSDqjHGXJ21gXxMX6owo=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/datashader/default.nix
+++ b/pkgs/development/python-modules/datashader/default.nix
@ -24,14 +24,14 @@

 buildPythonPackage rec {
  pname = "datashader";
-  version = "0.19.0";
+  version = "0.19.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "holoviz";
    repo = "datashader";
    tag = "v${version}";
-    hash = "sha256-Pc2mORxJA2JKioIzuBYU/LjUkij6ecqQh6tN/8z9ttI=";
+    hash = "sha256-jP6e7YmLyg3wd8QQZ4Vzr7vRFsRmttjIrEgIFqd6+hQ=";
  };

  build-system = [
--- a/pkgs/development/python-modules/iamdata/default.nix
+++ b/pkgs/development/python-modules/iamdata/default.nix
@ -8,14 +8,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "iamdata";
-  version = "0.1.202605261";
+  version = "0.1.202605271";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "cloud-copilot";
    repo = "iam-data-python";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-gUriLM9qiqKEh+ugMwTBM6+Mvhh54Sf12cLKzMzky7w=";
+    hash = "sha256-9SAUm7HVKFVNTVVA5/FTtpTAM/4Hv+G5TIuCWDIHC48=";
  };

  __darwinAllowLocalNetworking = true;
--- a/pkgs/development/python-modules/llama-index-embeddings-google-genai/default.nix
+++ b/pkgs/development/python-modules/llama-index-embeddings-google-genai/default.nix
@ -9,13 +9,13 @@

 buildPythonPackage (finalAttrs: {
  pname = "llama-index-embeddings-google-genai";
-  version = "0.5.0";
+  version = "0.5.1";
  pyproject = true;

  src = fetchPypi {
    pname = "llama_index_embeddings_google_genai";
    inherit (finalAttrs) version;
-    hash = "sha256-BR18oKleO8HQ8y9cwWfMoRnOQrxKUWyBF5NMWJyTsZ8=";
+    hash = "sha256-xA0J65uYGUnbWaNh0yJ0U8IumOnhjTXHK9Jklnvd2UQ=";
  };

  build-system = [ hatchling ];
--- a/pkgs/development/python-modules/mypy-boto3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3/default.nix
@ -155,16 +155,16 @@ in
      "sha256-imuX16TqfUAoPqzJTclvPMWiVnDSh6nJ8QbSksLEKps=";

  mypy-boto3-backup =
-    buildMypyBoto3Package "backup" "1.43.0"
-      "sha256-O3fCM33tfF8mxS34KUEQLz4OAV9rSkAtVEcYfd1MBJ8=";
+    buildMypyBoto3Package "backup" "1.43.15"
+      "sha256-MyUtN6c4ABRaB7mq1LS7ndGawcUb44sPrzsdvsAQ0Oc=";

  mypy-boto3-backup-gateway =
    buildMypyBoto3Package "backup-gateway" "1.43.0"
      "sha256-FZuhcgbPBohluThfTy99inR5nyG0r3q/AsxNEvtgJU4=";

  mypy-boto3-batch =
-    buildMypyBoto3Package "batch" "1.43.13"
-      "sha256-IKmXHaiMMKM3qwpD3Vwec8BO5C/K+LRfBsxBsYhQ8xo=";
+    buildMypyBoto3Package "batch" "1.43.15"
+      "sha256-q0lBBSuu3eAed8d5XaminRn8h9tZTLXaLlKMjZ+20SM=";

  mypy-boto3-billingconductor =
    buildMypyBoto3Package "billingconductor" "1.43.7"
@ -175,8 +175,8 @@ in
      "sha256-yVV4PXfWEkxmy2qlgQtcs3iIVo6mzwKY3i2j/OLsf9U=";

  mypy-boto3-budgets =
-    buildMypyBoto3Package "budgets" "1.43.0"
-      "sha256-KXhiiIB9ydHdwGClmYbaaT4t2sA7BdEXQG9HFpnuE1w=";
+    buildMypyBoto3Package "budgets" "1.43.15"
+      "sha256-7xusmV+Ub1MkH3mGGYNQFlI1pfg9v69OzN2FUN3+DzY=";

  mypy-boto3-ce =
    buildMypyBoto3Package "ce" "1.43.0"
@ -590,8 +590,8 @@ in
      "sha256-nTKK7qqa2apyNM4/U2AphLGvoSqemVKfpAciilJ0pRE=";

  mypy-boto3-guardduty =
-    buildMypyBoto3Package "guardduty" "1.43.11"
-      "sha256-P8QXa4Fcbyeh9mnFh+4OEby6aleplsSpotZzDCo/Pwc=";
+    buildMypyBoto3Package "guardduty" "1.43.15"
+      "sha256-5/PHXiFoiGBM3uK6jm8g5L5Wrt3x0DoH1p+TAI4kC80=";

  mypy-boto3-health =
    buildMypyBoto3Package "health" "1.43.0"
@ -1118,8 +1118,8 @@ in
      "sha256-cI7cDSHrRZj3RTYVHJ/6lYqz6qgYUPIlc4VUeSW7xIY=";

  mypy-boto3-resourcegroupstaggingapi =
-    buildMypyBoto3Package "resourcegroupstaggingapi" "1.43.0"
-      "sha256-3M5dYW3rS41I/BW6Km80r0uTEgG6Gv+1vcFHJF19i2g=";
+    buildMypyBoto3Package "resourcegroupstaggingapi" "1.43.15"
+      "sha256-8WMmFh5E1wdCmf9CIZscwj724oMIa3BNR+hwWHnC6TM=";

  mypy-boto3-robomaker =
    buildMypyBoto3Package "robomaker" "1.40.59"
--- a/pkgs/development/python-modules/nvidia-cutlass-dsl-libs-base/default.nix
+++ b/pkgs/development/python-modules/nvidia-cutlass-dsl-libs-base/default.nix
@ -81,10 +81,20 @@ buildPythonPackage (finalAttrs: {
    "libcuda.so.1"
  ];

-  # This wheel ships the `cutlass` module via `nvidia_cutlass_dsl.pth`.
-  # Python only processes `.pth` files in dirs that `site.py` registers as site-packages, not in
-  # PYTHONPATH entries so pythonImportsCheck (which uses PYTHONPATH) can't see `cutlass`.
-  dontUsePythonImportsCheck = true;
+  # This wheel ships the `cutlass` module nested under `nvidia_cutlass_dsl/python_packages/`,
+  # exposed at the top level via `nvidia_cutlass_dsl.pth`.
+  # Python only processes `.pth` files in directories registered as site dirs by `site.py`, not in
+  # PYTHONPATH entries.
+  # In nixpkgs, `buildPythonPackage` propagates dependencies via PYTHONPATH
+  # (see python's setup-hook), so any downstream consumer (e.g. flash-attn) would not see the
+  # `cutlass` module.
+  # `withPackages` envs work fine because they merge everything into a real site dir.
+  # Symlinking `cutlass` to the site-packages root makes it importable in both modes.
+  postFixup = ''
+    ln -s nvidia_cutlass_dsl/python_packages/cutlass $out/${python.sitePackages}/cutlass
+  '';
+
+  pythonImportsCheck = [ "cutlass" ];

  # No tests in the Pypi archive
  doCheck = false;
--- a/pkgs/development/python-modules/nvidia-cutlass-dsl/default.nix
+++ b/pkgs/development/python-modules/nvidia-cutlass-dsl/default.nix
@ -27,9 +27,7 @@ buildPythonPackage (finalAttrs: {
    nvidia-cutlass-dsl-libs-base
  ];

-  # The `cutlass` module is provided by `nvidia-cutlass-dsl-libs-base` via a `.pth` file.
-  # pythonImportsCheck uses PYTHONPATH, which Python's site.py doesn't scan for `.pth` files.
-  dontUsePythonImportsCheck = true;
+  pythonImportsCheck = [ "cutlass" ];

  # No tests in the Pypi archive
  doCheck = false;
--- a/pkgs/development/python-modules/pydocket/default.nix
+++ b/pkgs/development/python-modules/pydocket/default.nix
@ -25,7 +25,7 @@

 buildPythonPackage (finalAttrs: {
  pname = "pydocket";
-  version = "0.20.2";
+  version = "0.21.0";
  pyproject = true;
  __structuredAttrs = true;

@ -33,7 +33,7 @@ buildPythonPackage (finalAttrs: {
    owner = "chrisguidry";
    repo = "docket";
    tag = finalAttrs.version;
-    hash = "sha256-KEKk9/tewl46GkZ7DV6MixAzz9ZKMIqjwzj5kZ38AFk=";
+    hash = "sha256-kE7y65YEG5rLhCBiKSWkXGotK9DQQtn2eGVyukwgNWA=";
  };

  build-system = [
--- a/pkgs/development/python-modules/pyenphase/default.nix
+++ b/pkgs/development/python-modules/pyenphase/default.nix
@ -22,14 +22,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "pyenphase";
-  version = "2.4.8";
+  version = "2.4.9";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "pyenphase";
    repo = "pyenphase";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-wYPw+qLaKa7tk2mz/lKgLKmvVuS3tNOej2r86UJWnTU=";
+    hash = "sha256-owjJEIaaF6J4IukNtT9IGXGXINgK2c+yaOS9xYV5kRU=";
  };

  pythonRelaxDeps = [ "tenacity" ];
--- a/pkgs/development/python-modules/pyexploitdb/default.nix
+++ b/pkgs/development/python-modules/pyexploitdb/default.nix
@ -9,12 +9,12 @@

 buildPythonPackage (finalAttrs: {
  pname = "pyexploitdb";
-  version = "0.3.27";
+  version = "0.3.28";
  pyproject = true;

  src = fetchPypi {
    inherit (finalAttrs) pname version;
-    hash = "sha256-B4xd+wXaZC3gl+uyGlM+y3bahU20ny8v34USCkJJhlQ=";
+    hash = "sha256-09qyrlqoXPOBi7ZfapJM8sZm4s2F2MAoKKr3b39NNKs=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/pyglossary/default.nix
+++ b/pkgs/development/python-modules/pyglossary/default.nix
@ -12,7 +12,7 @@

  # nativeBuildInputs for GUI
  gobject-introspection,
-  wrapGAppsHook3,
+  wrapGAppsHook4,

  # dependencies (required for most functionality)
  pyicu,
@ -20,7 +20,7 @@
  enableGui ? false,
  # for GUI only
  pygobject3,
-  gtk3,
+  gtk4,
  enableCmd ? false,
  prompt-toolkit,
  tqdm,
@ -28,14 +28,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "pyglossary";
-  version = "5.3.0";
+  version = "5.4.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "ilius";
    repo = "pyglossary";
    tag = finalAttrs.version;
-    hash = "sha256-Gg2D2nWhG8j4+NtzSzgmsdKd5UK8PherM8Hi1b2GAqg=";
+    hash = "sha256-iSmpUvyYfWo3DRhSOzcYvhEX30ph0nZ0irDFQrNu4Xs=";
  };

  build-system = [
@ -43,7 +43,7 @@ buildPythonPackage (finalAttrs: {
  ]
  ++ lib.optionals enableGui [
    gobject-introspection
-    wrapGAppsHook3
+    wrapGAppsHook4
  ];

  dependencies = [
@ -59,7 +59,7 @@ buildPythonPackage (finalAttrs: {
  ];

  buildInputs = lib.optionals enableGui [
-    gtk3
+    gtk4
  ];

  # Many issues with the tests: They require `cd tests` in `preCheck`; Some of
--- a/pkgs/development/python-modules/pytest-notebook/default.nix
+++ b/pkgs/development/python-modules/pytest-notebook/default.nix
@ -38,6 +38,11 @@ buildPythonPackage rec {
    hash = "sha256-LoK0wb7rAbVbgyURCbSfckWvJDef3tPY+7V4YU1IBRU=";
  };

+  patches = [
+    # Rename pytest_collect_file hook parameter `path` -> `file_path` for pytest 9.
+    ./pytest9-collect-hook.patch
+  ];
+
  postPatch = ''
    # we disable the tests relying on coverage for unrelated reasons
    substituteInPlace tests/test_execution.py \
--- a/pkgs/development/python-modules/pytest-notebook/pytest9-collect-hook.patch
+++ b/pkgs/development/python-modules/pytest-notebook/pytest9-collect-hook.patch
@ -0,0 +1,31 @@
+--- a/pytest_notebook/plugin.py
+++ b/pytest_notebook/plugin.py
+@@ -11,6 +11,7 @@
+
+ """
+ import os
+from fnmatch import fnmatch
+ import shlex
+
+ import pytest
+@@ -263,16 +264,16 @@
+     return NBRegressionFixture(**kwargs)
+
+
+-def pytest_collect_file(path, parent):
+def pytest_collect_file(file_path, parent):
+     """Collect Jupyter notebooks using the specified pytest hook."""
+     kwargs, other_args = gather_config_options(parent.config)
+     if other_args.get("nb_test_files", False) and any(
+-        path.fnmatch(pat) for pat in other_args.get("nb_file_fnmatch", ["*.ipynb"])
+        fnmatch(file_path.name, pat) for pat in other_args.get("nb_file_fnmatch", ["*.ipynb"])
+     ):
+         try:
+-            return JupyterNbCollector.from_parent(parent, fspath=path)
+            return JupyterNbCollector.from_parent(parent, path=file_path)
+         except AttributeError:
+-            return JupyterNbCollector(path, parent)
+            return JupyterNbCollector(file_path, parent)
+
+
+ class JupyterNbCollector(pytest.File):
--- a/pkgs/development/python-modules/rawpy/default.nix
+++ b/pkgs/development/python-modules/rawpy/default.nix
@ -24,14 +24,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "rawpy";
-  version = "0.26.1";
+  version = "0.27.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "letmaik";
    repo = "rawpy";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-/pD3t6sP/SctjzjiOo2e937NEetvkcC5wB/RWi8UXI0=";
+    hash = "sha256-zM6S1oCOy6AWpaGgdgAqOUGW3rQ0Q9CxKMJoQTJPJIA=";
  };

  build-system = [
@ -56,6 +56,12 @@ buildPythonPackage (finalAttrs: {
    RAWPY_USE_SYSTEM_LIBRAW = 1;
  };

+  # cmake is only needed to build libraw when `RAWPY_USE_SYSTEM_LIBRAW` is disabled
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail '"cmake",' ""
+  '';
+
  pythonImportsCheck = [
    "rawpy"
    "rawpy._rawpy"
--- a/pkgs/development/python-modules/stim/default.nix
+++ b/pkgs/development/python-modules/stim/default.nix
@ -32,6 +32,11 @@ buildPythonPackage rec {
    hash = "sha256-Wls7dJkuV/RXnMizwrYOJOKopWEf1r21FKoKHjmpEQ0=";
  };

+  patches = [
+    # Fix measure_kickback lambda return type deduction under pybind11 3.0.
+    ./fix-measure-kickback-lambda-return-type.patch
+  ];
+
  postPatch = ''
    # asked to relax this in https://github.com/quantumlib/Stim/issues/623
    substituteInPlace pyproject.toml \
--- a/pkgs/development/python-modules/stim/fix-measure-kickback-lambda-return-type.patch
+++ b/pkgs/development/python-modules/stim/fix-measure-kickback-lambda-return-type.patch
@ -0,0 +1,11 @@
+--- a/src/stim/simulators/tableau_simulator.pybind.cc
+++ b/src/stim/simulators/tableau_simulator.pybind.cc
+@@ -2287,7 +2287,7 @@
+
+     c.def(
+         "measure_kickback",
+-        [](TableauSimulator<MAX_BITWORD_WIDTH> &self, uint32_t target) {
+        [](TableauSimulator<MAX_BITWORD_WIDTH> &self, uint32_t target) -> pybind11::tuple {
+             self.ensure_large_enough_for_qubits(target + 1);
+             auto result = self.measure_kickback_z({target});
+             if (result.second.num_qubits == 0) {
--- a/pkgs/development/python-modules/swh-core/default.nix
+++ b/pkgs/development/python-modules/swh-core/default.nix
@ -51,7 +51,7 @@

 buildPythonPackage (finalAttrs: {
  pname = "swh-core";
-  version = "4.6.1";
+  version = "4.6.2";
  pyproject = true;

  src = fetchFromGitLab {
@ -60,7 +60,7 @@ buildPythonPackage (finalAttrs: {
    owner = "devel";
    repo = "swh-core";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-5lL4/Hz8KbWurcDCOHqKh8eNqA1CkliSMCrdeYwqEHs=";
+    hash = "sha256-CMTdRP1S9m2d9TiZEr491fcN5zpJtJ3N4hfpVTHfrnY=";
  };

  build-system = [
--- a/pkgs/development/python-modules/swh-export/default.nix
+++ b/pkgs/development/python-modules/swh-export/default.nix
@ -6,6 +6,7 @@
  setuptools-scm,
  boto3,
  click,
+  luigi,
  tqdm,
  pyorc,
  plyvel,
@ -16,6 +17,7 @@
  swh-model,
  swh-storage,
  pytestCheckHook,
+  pytest-click,
  pytest-kafka,
  pytest-mock,
  tzdata,
@ -24,7 +26,7 @@

 buildPythonPackage (finalAttrs: {
  pname = "swh-export";
-  version = "1.8.0";
+  version = "1.11.7";
  pyproject = true;

  src = fetchFromGitLab {
@ -33,7 +35,7 @@ buildPythonPackage (finalAttrs: {
    owner = "devel";
    repo = "swh-export";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-n97MMYn7EmTrv411YSxUD1+zfbFB8KOSns44N3NqqV8=";
+    hash = "sha256-aDIGbkyRMNoQOdlXwqfLyRqDfK6jNFMVFJv67OY1SCg=";
  };

  build-system = [
@ -44,6 +46,7 @@ buildPythonPackage (finalAttrs: {
  dependencies = [
    boto3
    click
+    luigi
    tqdm
    pyorc
    plyvel
@ -63,6 +66,7 @@ buildPythonPackage (finalAttrs: {

  nativeCheckInputs = [
    pytestCheckHook
+    pytest-click
    pytest-kafka
    pytest-mock
    pkgs.zstd
--- a/pkgs/development/python-modules/swh-scheduler/default.nix
+++ b/pkgs/development/python-modules/swh-scheduler/default.nix
@ -31,7 +31,7 @@

 buildPythonPackage (finalAttrs: {
  pname = "swh-scheduler";
-  version = "3.3.0";
+  version = "3.3.1";
  pyproject = true;

  src = fetchFromGitLab {
@ -40,7 +40,7 @@ buildPythonPackage (finalAttrs: {
    owner = "devel";
    repo = "swh-scheduler";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Kv5QH3sj/InKOSjxGtwVxtoAluHx5eIxO5GqcbOs0NY=";
+    hash = "sha256-VsgF5zmrMPuXrRsxb4YBx+hXkFltxgbgskAe0b3k9bw=";
  };

  build-system = [
@ -48,11 +48,6 @@ buildPythonPackage (finalAttrs: {
    setuptools-scm
  ];

-  pythonRelaxDeps = [
-    # we patched click 8.2.1
-    "click"
-  ];
-
  dependencies = [
    celery
    flask
--- a/pkgs/development/python-modules/swh-storage/default.nix
+++ b/pkgs/development/python-modules/swh-storage/default.nix
@ -33,7 +33,7 @@

 buildPythonPackage (finalAttrs: {
  pname = "swh-storage";
-  version = "4.1.1";
+  version = "4.2.0";
  pyproject = true;

  src = fetchFromGitLab {
@ -42,7 +42,7 @@ buildPythonPackage (finalAttrs: {
    owner = "devel";
    repo = "swh-storage";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-AY2IcRJG19oSy2usI9JZTEKYLI3SEiLpNisqD7zus8A=";
+    hash = "sha256-l9ElZtpJBryFvBLtXQZ7NiYH6FvyarmoWzTkTg7E8gw=";
  };

  build-system = [
@ -50,11 +50,6 @@ buildPythonPackage (finalAttrs: {
    setuptools-scm
  ];

-  pythonRelaxDeps = [
-    # we patched click 8.2.1
-    "click"
-  ];
-
  dependencies = [
    backports-entry-points-selectable
    cassandra-driver
--- a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
+++ b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
@ -9,14 +9,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "tencentcloud-sdk-python";
-  version = "3.1.101";
+  version = "3.1.103";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "TencentCloud";
    repo = "tencentcloud-sdk-python";
    tag = finalAttrs.version;
-    hash = "sha256-dvtbn+IoedKulTCM+bEzeYgIxs9Abd+1qtoFVZBvucQ=";
+    hash = "sha256-xwimPyCZJrsBHJgRaojrI8peEnKWzflpX3OM2mPzmDw=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/victron-mqtt/default.nix
+++ b/pkgs/development/python-modules/victron-mqtt/default.nix
@ -12,14 +12,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "victron-mqtt";
-  version = "2026.5.5";
+  version = "2026.5.9";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "tomer-w";
    repo = "victron_mqtt";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-8tl158Pd7TkrQbKfAFePjQRBc5tmyAUsz9cEd06blDs=";
+    hash = "sha256-Q0qQrJgz1D+0THR1A4vyddC2CZK6i76DxcAU5J5lH6U=";
  };

  build-system = [
--- a/pkgs/development/python-modules/vilfo-api-client/default.nix
+++ b/pkgs/development/python-modules/vilfo-api-client/default.nix
@ -8,28 +8,32 @@
  semver,
  pytestCheckHook,
  responses,
+  setuptools,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "vilfo-api-client";
  version = "0.5.0";
-  format = "setuptools";
+  pyproject = true;

  src = fetchFromGitHub {
    owner = "ManneW";
    repo = "vilfo-api-client-python";
-    tag = version;
+    tag = finalAttrs.version;
    hash = "sha256-ZlmriBd+M+54ux/UNYa355mkz808/NxSz7IzmWouA0c=";
  };

+  build-system = [
+    setuptools
+    setuptools-scm
+  ];
+
  postPatch = ''
    substituteInPlace setup.cfg \
-      --replace "get-mac" "getmac"
+      --replace-fail "get-mac" "getmac"
  '';

-  nativeBuildInputs = [ setuptools-scm ];
-
-  propagatedBuildInputs = [
+  dependencies = [
    getmac
    requests
    semver
@ -45,7 +49,8 @@ buildPythonPackage rec {
  meta = {
    description = "Simple wrapper client for the Vilfo router API";
    homepage = "https://github.com/ManneW/vilfo-api-client-python";
+    changelog = "https://github.com/ManneW/vilfo-api-client-python/releases/tag/${finalAttrs.src.tag}";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ dotlambda ];
  };
-}
+})
--- a/pkgs/development/python-modules/vine/default.nix
+++ b/pkgs/development/python-modules/vine/default.nix
@ -3,18 +3,21 @@
  buildPythonPackage,
  fetchPypi,
  pytestCheckHook,
+  setuptools,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "vine";
  version = "5.1.0";
-  format = "setuptools";
+  pyproject = true;

  src = fetchPypi {
-    inherit pname version;
+    inherit (finalAttrs) pname version;
    hash = "sha256-i2LpgdNcQQSSEc9ioKEkLYwe6b0Vuxls44rv1nmeYeA=";
  };

+  build-system = [ setuptools ];
+
  nativeCheckInputs = [
    pytestCheckHook
  ];
@ -29,8 +32,8 @@ buildPythonPackage rec {
  meta = {
    description = "Python promises";
    homepage = "https://github.com/celery/vine";
-    changelog = "https://github.com/celery/vine/releases/tag/v${version}";
+    changelog = "https://github.com/celery/vine/releases/tag/v${finalAttrs.version}";
    license = lib.licenses.bsd3;
    maintainers = with lib.maintainers; [ fab ];
  };
-}
+})
--- a/pkgs/development/python-modules/wasmtime/default.nix
+++ b/pkgs/development/python-modules/wasmtime/default.nix
@ -18,14 +18,14 @@ let
 in
 buildPythonPackage (finalAttrs: {
  pname = "wasmtime";
-  version = "44.0.0";
+  version = "45.0.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "bytecodealliance";
    repo = "wasmtime-py";
    tag = finalAttrs.version;
-    hash = "sha256-7K0j4jMsRB7/wNIj0pXxFTy0y7aN37wgCD1XKM92Ayw=";
+    hash = "sha256-XlAWPJB34uE+hbEMGZ46Ll6kXP+/lZ2amTKdjslGrP4=";
  };

  postPatch = ''
@ -33,8 +33,9 @@ buildPythonPackage (finalAttrs: {
      --replace-fail "setuptools-git-versioning>=2.0,<3" "setuptools-git-versioning" \
      --replace-fail 'build-backend = "backend"' 'build-backend = "setuptools.build_meta"'

-    substituteInPlace ci/cbindgen.py \
-      --replace-fail "'-D__builtin_va_list=int'," "'-D__builtin_va_list=int', '-Dnullptr_t=void*',"
+    # `wasmtime/_{extern,types,value}.py` erroneously report unreachable statements
+    substituteInPlace mypy.ini \
+      --replace-fail "warn_unreachable = True" "warn_unreachable = False"

    # Don't run mypy via pytest-mypy (type checking breaks easily)
    substituteInPlace pytest.ini \
@ -66,15 +67,17 @@ buildPythonPackage (finalAttrs: {
    writableTmpDirAsHomeHook
  ];

-  disabledTestPaths = [
-    "ci/cbindgen.py"
-  ];
-
  pythonImportsCheck = [ "wasmtime" ];

  preCheck = ''
    # cbindgen.py checks bindings against C headers during test collection.
    ln -s ${lib.getDev pkgs.wasmtime}/include wasmtime/include
+
+    # hardening options interfere with pycparser's CC call
+    export NIX_HARDENING_ENABLE=""
+
+    # $out is first in path which causes "import file mismatch"
+    export PYTHONPATH="$PWD:$PYTHONPATH"
  '';

  meta = {
--- a/pkgs/development/skaware-packages/default.nix
+++ b/pkgs/development/skaware-packages/default.nix
@ -1,8 +1,4 @@
-{
-  lib,
-  pkgs,
-  config,
-}:
+{ lib, pkgs }:

 lib.makeScope pkgs.newScope (
  self:
@ -26,6 +22,7 @@ lib.makeScope pkgs.newScope (
    # libs
    skalibs = callPackage ./skalibs { };
    skalibs_2_10 = callPackage ./skalibs/2_10.nix { };
+    sdnotify-wrapper = callPackage ./sdnotify-wrapper { };

    # s6 tooling
    s6 = callPackage ./s6 { };
@ -43,7 +40,4 @@ lib.makeScope pkgs.newScope (
    s6-portable-utils-man-pages = self.s6-portable-utils.passthru.manpages;
    s6-rc-man-pages = self.s6-rc.passthru.manpages;
  }
-  // lib.optionalAttrs config.allowAliases {
-    sdnotify-wrapper = throw "sdnotify-wrapper has been removed in favour of s6-notify-socket-from-fd in the s6 package";
-  }
 )
--- a/pkgs/development/skaware-packages/sdnotify-wrapper/default.nix
+++ b/pkgs/development/skaware-packages/sdnotify-wrapper/default.nix
@ -0,0 +1,47 @@
+{
+  lib,
+  runCommandCC,
+  skalibs,
+}:
+
+let
+  # From https://skarnet.org/software/misc/sdnotify-wrapper.c,
+  # which is unversioned.
+  src = ./sdnotify-wrapper.c;
+
+in
+runCommandCC "sdnotify-wrapper"
+  {
+
+    outputs = [
+      "bin"
+      "doc"
+      "out"
+    ];
+
+    meta = {
+      homepage = "https://skarnet.org/software/misc/sdnotify-wrapper.c";
+      description = "Use systemd sd_notify without having to link against libsystemd";
+      mainProgram = "sdnotify-wrapper";
+      platforms = lib.platforms.linux;
+      license = lib.licenses.isc;
+      maintainers = with lib.maintainers; [ Profpatsch ];
+    };
+
+  }
+  ''
+    mkdir -p $bin/bin
+    mkdir $out
+
+    # the -lskarnet has to come at the end to support static builds
+    $CC \
+      -o $bin/bin/sdnotify-wrapper \
+      -I${skalibs.dev}/include \
+      -L${skalibs.lib}/lib \
+      ${src} \
+      -lskarnet
+
+    mkdir -p $doc/share/doc/sdnotify-wrapper
+    # copy the documentation comment
+    sed -ne '/Usage:/,/*\//p' ${src} > $doc/share/doc/sdnotify-wrapper/README
+  ''
--- a/pkgs/development/skaware-packages/sdnotify-wrapper/sdnotify-wrapper.c
+++ b/pkgs/development/skaware-packages/sdnotify-wrapper/sdnotify-wrapper.c
@ -0,0 +1,174 @@
+/*
+   Copyright: (C)2015-2020 Laurent Bercot.  http://skarnet.org/
+   ISC license. See http://opensource.org/licenses/ISC
+
+   Build-time requirements: skalibs.  https://skarnet.org/software/skalibs/
+   Run-time requirements: none, if you link skalibs statically.
+
+   Compilation:
+     gcc -o sdnotify-wrapper -L/usr/lib/skalibs sdnotify-wrapper.c -lskarnet
+   Use /usr/lib/skalibs/libskarnet.a instead of -lskarnet to link statically.
+   Adapt gcc's -I and -L options to your skalibs installation paths.
+
+   Usage: if a daemon would be launched by systemd as "foobard args...",
+   launch it as "sdnotify-wrapper foobard args..." instead, and you can now
+   tell systemd that this daemon supports readiness notification.
+
+   Instead of using sd_notify() and having to link against the systemd
+   library, the daemon notifies readiness by writing whatever it wants
+   to a file descriptor (by default: stdout), then a newline. (Then it
+   should close that file descriptor.) The simplest way is something like
+   int notify_readiness() { write(1, "\n", 1) ; close(1) ; }
+   This mechanism is understandable by any notification readiness framework.
+
+   Readiness notification occurs when the newline is written, not when
+   the descriptor is closed; but since sdnotify-wrapper stops reading
+   after the first newline and will exit, any subsequent writes will
+   fail and it's best to simply close the descriptor right away.
+
+   sdnotify-wrapper sees the notification when it occurs and sends it
+   to systemd using the sd_notify format.
+
+   Options:
+     -d fd: the daemon will write its notification on descriptor fd.
+     Default is 1.
+     -f: do not doublefork. Use if the daemon waits for children it does
+     not know it has (for instance, superservers do this). When in doubt,
+     do not use that option, or you may have a zombie hanging around.
+     -t timeout: if the daemon has not sent a notification after timeout
+     milliseconds, give up and exit; systemd will not be notified.
+     -k: keep the NOTIFY_SOCKET environment variable when execing into the
+     daemon. By default, the variable is unset: the daemon should not need it.
+
+   Notes:
+     sdnotify-wrapper does not change the daemon's pid. It runs as a
+     (grand)child of the daemon.
+     If the NOTIFY_SOCKET environment variable is not set, sdnotify-wrapper
+     does nothing - it only execs into the daemon.
+     sdnotify-wrapper is more liberal than sd_notify(). It will accept
+     a relative path in NOTIFY_SOCKET.
+*/
+
+
+#include <sys/types.h>
+#include <string.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <errno.h>
+#include <sys/socket.h>
+#include <sys/un.h>
+
+#include <skalibs/uint64.h>
+#include <skalibs/types.h>
+#include <skalibs/bytestr.h>
+#include <skalibs/sgetopt.h>
+#include <skalibs/strerr.h>
+#include <skalibs/allreadwrite.h>
+#include <skalibs/tai.h>
+#include <skalibs/iopause.h>
+#include <skalibs/djbunix.h>
+#include <skalibs/socket.h>
+#include <skalibs/exec.h>
+
+#define USAGE "sdnotify-wrapper [ -d fd ] [ -f ] [ -t timeout ] [ -k ] prog..."
+#define dieusage() strerr_dieusage(100, USAGE)
+
+#define VAR "NOTIFY_SOCKET"
+
+static inline int ipc_sendto (int fd, char const *s, size_t len, char const *path)
+{
+  struct sockaddr_un sa ;
+  size_t l = strlen(path) ;
+  if (l > IPCPATH_MAX) return (errno = ENAMETOOLONG, 0) ;
+  memset(&sa, 0, sizeof sa) ;
+  sa.sun_family = AF_UNIX ;
+  memcpy(sa.sun_path, path, l+1) ;
+  if (path[0] == '@') sa.sun_path[0] = 0 ;
+  return sendto(fd, s, len, MSG_NOSIGNAL, (struct sockaddr *)&sa, sizeof sa) >= 0 ;
+}
+
+static inline void notify_systemd (pid_t pid, char const *socketpath)
+{
+  size_t n = 16 ;
+  char fmt[16 + PID_FMT] = "READY=1\nMAINPID=" ;
+  int fd = ipc_datagram_b() ;
+  if (fd < 0) strerr_diefu1sys(111, "create socket") ;
+  n += pid_fmt(fmt + n, pid) ;
+  fmt[n++] = '\n' ;
+  if (!ipc_sendto(fd, fmt, n, socketpath))
+    strerr_diefu2sys(111, "send notification message to ", socketpath) ;
+  close(fd) ;
+}
+
+static inline int run_child (int fd, unsigned int timeout, pid_t pid, char const *s)
+{
+  char dummy[4096] ;
+  iopause_fd x = { .fd = fd, .events = IOPAUSE_READ } ;
+  tain deadline ;
+  tain_now_g() ;
+  if (timeout) tain_from_millisecs(&deadline, timeout) ;
+  else deadline = tain_infinite_relative ;
+  tain_add_g(&deadline, &deadline) ;
+  for (;;)
+  {
+    int r = iopause_g(&x, 1, &deadline) ;
+    if (r < 0) strerr_diefu1sys(111, "iopause") ;
+    if (!r) return 99 ;
+    r = sanitize_read(fd_read(fd, dummy, 4096)) ;
+    if (r < 0)
+      if (errno == EPIPE) return 1 ;
+      else strerr_diefu1sys(111, "read from parent") ;
+    else if (r && memchr(dummy, '\n', r)) break ;
+  }
+  close(fd) ;
+  notify_systemd(pid, s) ;
+  return 0 ;
+}
+
+int main (int argc, char const *const *argv)
+{
+  char const *s = getenv(VAR) ;
+  unsigned int fd = 1 ;
+  unsigned int timeout = 0 ;
+  int df = 1, keep = 0 ;
+  PROG = "sdnotify-wrapper" ;
+  {
+    subgetopt l = SUBGETOPT_ZERO ;
+    for (;;)
+    {
+      int opt = subgetopt_r(argc, argv, "d:ft:k", &l) ;
+      if (opt == -1) break ;
+      switch (opt)
+      {
+        case 'd' : if (!uint0_scan(l.arg, &fd)) dieusage() ; break ;
+        case 'f' : df = 0 ; break ;
+        case 't' : if (!uint0_scan(l.arg, &timeout)) dieusage() ; break ;
+        case 'k' : keep = 1 ; break ;
+        default : dieusage() ;
+      }
+    }
+    argc -= l.ind ; argv += l.ind ;
+  }
+  if (!argc) dieusage() ;
+
+  if (!s) xexec(argv) ;
+  else
+  {
+    pid_t parent = getpid() ;
+    pid_t child ;
+    int p[2] ;
+    if (pipe(p) < 0) strerr_diefu1sys(111, "pipe") ;
+    child = df ? doublefork() : fork() ;
+    if (child < 0) strerr_diefu1sys(111, df ? "doublefork" : "fork") ;
+    else if (!child)
+    {
+      PROG = "sdnotify-wrapper (child)" ;
+      close(p[1]) ;
+      return run_child(p[0], timeout, parent, s) ;
+    }
+    close(p[0]) ;
+    if (fd_move((int)fd, p[1]) < 0) strerr_diefu1sys(111, "move descriptor") ;
+    if (keep) xexec(argv) ;
+    else xmexec_m(argv, VAR, sizeof(VAR)) ;
+  }
+}
--- a/pkgs/development/tools/pnpm/default.nix
+++ b/pkgs/development/tools/pnpm/default.nix
@ -26,8 +26,8 @@ let
      hash = "sha256-jnDdxmSbGLw9iVzzqQjAKR6kw4A5rYcixH4Bja8enPw=";
    };
    "11" = {
-      version = "11.1.2";
-      hash = "sha256-v+TSssejIQVlu6YpKfnv5JPrXyRicgGhAupFFOroz4A=";
+      version = "11.3.0";
+      hash = "sha256-Wt4e9RzzZEH0oAkx6vkANlRonro2hJOfcNdXay37hHQ=";
    };
  };

--- a/pkgs/servers/home-assistant/custom-lovelace-modules/universal-remote-card/package.nix
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/universal-remote-card/package.nix
@ -6,16 +6,16 @@

 buildNpmPackage rec {
  pname = "universal-remote-card";
-  version = "4.11.0";
+  version = "4.11.1";

  src = fetchFromGitHub {
    owner = "Nerwyn";
    repo = "android-tv-card";
    rev = version;
-    hash = "sha256-EaZ85XPwsz+XPXc/bxep+sl7txp/K96tgsZouMOd3hg=";
+    hash = "sha256-qgwY8zoIkKymuG3yxu8oc4wGgbASBMchj+dqvX/xFAA=";
  };

-  npmDepsHash = "sha256-RtCUWxwYUqJLtYmpaNReMYDXrvQtOny5O+LjbRhfrsI=";
+  npmDepsHash = "sha256-m3m0GAmQtSGV4NfAwHqDiAwwFzf+HlEq7OsWOQL8zvQ=";

  installPhase = ''
    runHook preInstall
--- a/pkgs/tools/security/rekor/default.nix
+++ b/pkgs/tools/security/rekor/default.nix
@ -15,13 +15,13 @@ let
    }:
    buildGoModule rec {
      inherit pname;
-      version = "1.5.1";
+      version = "1.5.2";

      src = fetchFromGitHub {
        owner = "sigstore";
        repo = "rekor";
        rev = "v${version}";
-        hash = "sha256-ZaeacpzdBG3QBGPQ0rTW8cJyTe5S8ff6OIVv1/VcbL4=";
+        hash = "sha256-imtdI8nWII2l24FgWXVU0LKg4hYmZHi6DGzenoEfOgA=";
        # populate values that require us to use git. By doing this in postFetch we
        # can delete .git afterwards and maintain better reproducibility of the src.
        leaveDotGit = true;
@ -34,7 +34,7 @@ let
        '';
      };

-      vendorHash = "sha256-xrsiFrC8o4l1nPvxNzsXPY9nshKsy5sVei8yHAee46s=";
+      vendorHash = "sha256-QxIw3rGTntNpLNhLZq9G6OiuTd+UbjA5B60TYBqFiSY=";

      nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@ -1914,7 +1914,6 @@ mapAliases {
  SDL2_classic_image = throw "'SDL2_classic_image' has been removed as part of the deprecation of 'SDL2_classic'. Consider upgrading to 'SDL2_image' built with 'sdl2-compat'."; # Added 2025-05-20
  SDL2_classic_mixer = throw "'SDL2_classic_mixer' has been removed as part of the deprecation of 'SDL2_classic'. Consider upgrading to 'SDL2_mixer' built with 'sdl2-compat'."; # Added 2025-05-20
  SDL2_classic_ttf = throw "'SDL2_classic_ttf' has been removed as part of the deprecation of 'SDL2_classic'. Consider upgrading to 'SDL2_ttf' built with 'sdl2-compat'."; # Added 2025-05-20
-  sdnotify-wrapper = skawarePackages.sdnotify-wrapper;
  seafile-server = throw "'seafile-server' has been removed as it is unmaintained"; # Added 2025-08-21
  seahub = throw "'seahub' has been removed as it is unmaintained"; # Added 2025-08-21
  semantik = throw "'semantik' has been removed as it depended on EOL qt5 webengine"; # Added 2026-04-17
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -7213,6 +7213,7 @@ with pkgs;
    s6-portable-utils-man-pages
    s6-rc
    s6-rc-man-pages
+    sdnotify-wrapper
    skalibs
    skalibs_2_10
    tipidee