From 42d6d7792b7303b762697d04a61f04601cc5610d Mon Sep 17 00:00:00 2001
From: Edward Wawrzynski <edward.wawrzynski@protonmail.com>
Date: Sat, 28 Mar 2026 22:54:16 -0400
Subject: [PATCH 01/66] prismlauncher: add wrapGAppsHook3

This fixes file pickers on GNOME/GTK environments.

Co-authored-by: Seth Flynn <getchoo@tuta.io>
Signed-off-by: Sefa Eyeoglu <contact@scrumplex.net>
(cherry picked from commit 93eb82879196d61e775c817a403e95b0d733930b)
---
 pkgs/by-name/pr/prismlauncher/package.nix | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/pr/prismlauncher/package.nix b/pkgs/by-name/pr/prismlauncher/package.nix
index 16790a473abb..785832d4e178 100644
--- a/pkgs/by-name/pr/prismlauncher/package.nix
+++ b/pkgs/by-name/pr/prismlauncher/package.nix
@@ -27,6 +27,7 @@
   symlinkJoin,
   udev,
   vulkan-loader,
+  wrapGAppsHook3,
   xrandr,
 
   additionalLibs ? [ ],
@@ -61,7 +62,10 @@ symlinkJoin {
 
   paths = [ prismlauncher' ];
 
-  nativeBuildInputs = [ kdePackages.wrapQtAppsHook ];
+  nativeBuildInputs = [
+    kdePackages.wrapQtAppsHook
+    wrapGAppsHook3
+  ];
 
   buildInputs = [
     kdePackages.qtbase
@@ -71,6 +75,10 @@ symlinkJoin {
   ++ lib.optional stdenv.hostPlatform.isLinux kdePackages.qtwayland;
 
   postBuild = ''
+    # Required for org.gtk.Settings.FileChooser
+    gappsWrapperArgsHook
+    qtWrapperArgs+=("''${gappsWrapperArgs[@]}")
+
     wrapQtAppsHook
   '';
 

From 18277e3eed1c0653d5467bcb3130f3b4df88f24d Mon Sep 17 00:00:00 2001
From: Andrew Marshall <andrew@johnandrewmarshall.com>
Date: Fri, 12 Jun 2026 18:36:29 -0400
Subject: [PATCH 02/66] perlPackages.DBDCSV: backport fix for build on latest
 DBI

Need to vendor as need to elide the changelog diff from the commit as it
conflicts.

(cherry picked from commit e802c76a960a5688d8a6a127832ca342b81ea5a4)
---
 pkgs/top-level/perl-packages.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 7b40ff9c5d34..5c0f6b2fe4ac 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -9731,6 +9731,13 @@ with self;
       url = "mirror://cpan/authors/id/H/HM/HMBRAND/DBD-CSV-0.60.tgz";
       hash = "sha256-AYuDow95mXm8jDwwRMixyAAc32C9w+dGhIgYGVJUtOc=";
     };
+    patches = [
+      (fetchpatch2 {
+        url = "https://github.com/perl5-dbi/DBD-CSV/commit/ae091790398088a66b22fa572856bfeb4db4c78a.patch?full_index=1";
+        excludes = [ "ChangeLog" ];
+        hash = "sha256-eZdCNSi3YJrZdZcK/8nFx5Q4rB89b0ynKemupvKrfys=";
+      })
+    ];
     propagatedBuildInputs = [
       DBI
       SQLStatement

From 13da4a1a52cd6ce707e031cc2a26eec99b71329d Mon Sep 17 00:00:00 2001
From: Andrew Marshall <andrew@johnandrewmarshall.com>
Date: Fri, 12 Jun 2026 18:37:18 -0400
Subject: [PATCH 03/66] perlPackages.DBDCSV: 0.60 -> 0.62

(cherry picked from commit 6636d2bf3dc2ba4c3052a467f0c324a6368a3f1a)
---
 pkgs/top-level/perl-packages.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 5c0f6b2fe4ac..21606343572d 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -9726,10 +9726,10 @@ with self;
 
   DBDCSV = buildPerlPackage {
     pname = "DBD-CSV";
-    version = "0.60";
+    version = "0.62";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/H/HM/HMBRAND/DBD-CSV-0.60.tgz";
-      hash = "sha256-AYuDow95mXm8jDwwRMixyAAc32C9w+dGhIgYGVJUtOc=";
+      url = "mirror://cpan/authors/id/H/HM/HMBRAND/DBD-CSV-0.62.tgz";
+      hash = "sha256-0/EVD+IGfA49FJWHZeqNQZWDSY+WMTawQC2qkwvJMOM=";
     };
     patches = [
       (fetchpatch2 {

From c91b561e0a0ec620773588c78fc140eb4014dfa7 Mon Sep 17 00:00:00 2001
From: Thomas Butter <tbutter@gmail.com>
Date: Wed, 20 May 2026 06:02:34 +0000
Subject: [PATCH 04/66] gatus: 5.35.0 -> 5.36.0

(cherry picked from commit ad078de08a47462e727e8f47293fc6f696ed7511)

Reason: security upgrade (#530995)
---
 pkgs/by-name/ga/gatus/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ga/gatus/package.nix b/pkgs/by-name/ga/gatus/package.nix
index df40c24b23c7..dca8d87a73bf 100644
--- a/pkgs/by-name/ga/gatus/package.nix
+++ b/pkgs/by-name/ga/gatus/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "gatus";
-  version = "5.35.0";
+  version = "5.36.0";
 
   src = fetchFromGitHub {
     owner = "TwiN";
     repo = "gatus";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-I1HjeJ4/yLLgcoIEOQCv3WQDNrpIAFhzDvVpz24T7gU=";
+    hash = "sha256-YduXhHra6w7zo1f+brCjiusH7xCSdAzo5uF6aN5uv/A=";
   };
 
-  vendorHash = "sha256-PBy/0My0TdlolpagDSdt7r2dPPLJOVHEsU1xaV8RFjg=";
+  vendorHash = "sha256-RbFNtojZthf7bKMhGStH/jOkeIR6EHpw2vvAMLEFtKI=";
 
   subPackages = [ "." ];
 

From 4fcf16f9b26b88a2d7278f968edddbb582ac0e22 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 20 Jun 2026 21:17:26 +0000
Subject: [PATCH 05/66] filebrowser: 2.63.14 -> 2.63.15

(cherry picked from commit 4760cdbdf909cdd586303c18326c213e89e3aa50)
---
 pkgs/by-name/fi/filebrowser/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/fi/filebrowser/package.nix b/pkgs/by-name/fi/filebrowser/package.nix
index 996e8e1047a0..661c0613291a 100644
--- a/pkgs/by-name/fi/filebrowser/package.nix
+++ b/pkgs/by-name/fi/filebrowser/package.nix
@@ -12,13 +12,13 @@
 }:
 
 let
-  version = "2.63.14";
+  version = "2.63.15";
 
   src = fetchFromGitHub {
     owner = "filebrowser";
     repo = "filebrowser";
     rev = "v${version}";
-    hash = "sha256-9CXHoQWr1RpTwFR8JRR72oQZxHrndTrnxYa6/0Z3Mk0=";
+    hash = "sha256-O2USjwP1g+yDZpz0628YTRN2BUUnmjFvS+0qc6JU294=";
   };
 
   frontend = buildNpmPackage rec {
@@ -59,7 +59,7 @@ buildGoModule {
   pname = "filebrowser";
   inherit version src;
 
-  vendorHash = "sha256-ofeQkbvBfCpu2g1CLAwUZAZISyAOz+0smEZRx/koj/8=";
+  vendorHash = "sha256-WXbXD75acK4woS7UC0G73pY48aGmp1l0spDc3sGYXMg=";
 
   excludedPackages = [ "tools" ];
 

From 4d2781bbbe185c43f23e7bcc31a266e1041b86f7 Mon Sep 17 00:00:00 2001
From: Samuel Cobb <sjcobb2003@gmail.com>
Date: Sun, 21 Jun 2026 04:16:04 +0100
Subject: [PATCH 06/66] nixos/incus: remove named profile

(cherry picked from commit fe3a142521335e3ae593889ba7733713bcb29fcf)
---
 nixos/modules/virtualisation/incus.nix | 28 ++++++++++++++++----------
 1 file changed, 17 insertions(+), 11 deletions(-)

diff --git a/nixos/modules/virtualisation/incus.nix b/nixos/modules/virtualisation/incus.nix
index 83a5a731ccb7..466e359c3147 100644
--- a/nixos/modules/virtualisation/incus.nix
+++ b/nixos/modules/virtualisation/incus.nix
@@ -363,21 +363,27 @@ in
           include ${cfg.lxcPackage}/etc/apparmor.d/lxc-containers
         '';
         "incusd".profile = ''
-          # This profile allows everything and only exists to give the
-          # application a name instead of having the label "unconfined"
+          # incusd is deliberatly left unconfined, with NO named profile attached to the binary.
+          # Incus checks its own confinement at startup by reading /proc/self/attr/current
+          # (https://github.com/lxc/incus/blob/92b0cbbc5728ed45578fdeeec634606af8826404/internal/server/sys/apparmor.go).
+          # Anything other than "unconfined" makes Incus believe that the host process is
+          # itself confined, which sends every container down the "reuse my own profile" branch in
+          # https://github.com/lxc/incus/blob/92b0cbbc5728ed45578fdeeec634606af8826404/internal/server/instance/drivers/driver_lxc.go
+          # instead of generating a "proper" per-container profile. Furthermore,
+          # that branch only strips " (enforce)" suffix before handing the string to lxc.apparmor.profile
+          # (https://github.com/lxc/incus/blob/92b0cbbc5728ed45578fdeeec634606af8826404/internal/server/instance/drivers/driver_lxc.go#L96),
+          # so the named profile with flags=(unconfined) produces a literal string
+          # "incusd (unconfined)", which the kernel rejects at change_profile() time
+          # with "label not found", failing every `incus start` when AppArmor is enabled.
+          # This was not caught before as AppArmor was stifled by bpf.
+
+          # We keep this policy to pull in the per-container /
+          # per-archive profiles incusd generates at runtime so
+          # apparmor_parser loads them.
 
           abi <abi/4.0>,
           include <tunables/global>
 
-          profile incusd ${lib.getExe' config.virtualisation.incus.package "incusd"} flags=(unconfined) {
-            userns,
-
-            include "/var/lib/incus/security/apparmor/cache"
-
-            # Site-specific additions and overrides. See local/README for details.
-            include if exists <local/incusd>
-          }
-
           include "/var/lib/incus/security/apparmor/profiles"
         '';
       };

From 5724e9a69d65e1fbd0a6eee33816858ba0902fe6 Mon Sep 17 00:00:00 2001
From: Samuel Cobb <sjcobb2003@gmail.com>
Date: Fri, 19 Jun 2026 20:46:31 +0100
Subject: [PATCH 07/66] nixos/apparmor: load bpf last unconditionally

(cherry picked from commit bd022e3c5a54b5f05eeb92cd02a82d2fc76a65f2)
---
 nixos/modules/security/default.nix | 20 +++++++++++++++-----
 1 file changed, 15 insertions(+), 5 deletions(-)

diff --git a/nixos/modules/security/default.nix b/nixos/modules/security/default.nix
index 5170383d6f5e..c1a4f7cf34a1 100644
--- a/nixos/modules/security/default.nix
+++ b/nixos/modules/security/default.nix
@@ -1,4 +1,8 @@
-{ config, lib, ... }:
+{
+  config,
+  lib,
+  ...
+}:
 let
   cfg = config.security;
 in
@@ -16,10 +20,16 @@ in
   config = lib.mkMerge [
     {
       # We set the default LSM's here due to them not being present if set when enabling AppArmor.
-      security.lsm = [
-        "landlock"
-        "yama"
-        "bpf"
+      security.lsm = lib.mkMerge [
+        [
+          "landlock"
+          "yama"
+        ]
+        # Load BPF last unconditionally. See: https://github.com/NixOS/nixpkgs/pull/533428.
+        # Apparmor (and potentially other modules) will load incorrectly if they are not before BPF.
+        # It is believed that there was a regression between kernel 6.12 and 6.18 which caused the
+        # passthrough stub or LSM stacking of the BPF module to interact with other modules incorrectly.
+        (lib.mkAfter [ "bpf" ])
       ];
     }
     (lib.mkIf (lib.lists.length cfg.lsm > 0) {

From 518eeff3f186ec79ae2b3b53532d1eb4965a0afd Mon Sep 17 00:00:00 2001
From: Salva <salva.hg01@gmail.com>
Date: Wed, 24 Jun 2026 00:30:16 +0000
Subject: [PATCH 08/66] cosmic-wallpapers: 1.0.16 -> 1.1.0

(cherry picked from commit 4d0fbc77eb2ee35e6ba401293d5468d951733b66)
---
 pkgs/by-name/co/cosmic-wallpapers/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/co/cosmic-wallpapers/package.nix b/pkgs/by-name/co/cosmic-wallpapers/package.nix
index e7763090dc3c..a0ddd6e66db8 100644
--- a/pkgs/by-name/co/cosmic-wallpapers/package.nix
+++ b/pkgs/by-name/co/cosmic-wallpapers/package.nix
@@ -7,7 +7,7 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "cosmic-wallpapers";
-  version = "1.0.16";
+  version = "1.1.0";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {

From cd8bbcde5c2066449102336f0c89352acc515272 Mon Sep 17 00:00:00 2001
From: Salva <salva.hg01@gmail.com>
Date: Wed, 24 Jun 2026 00:30:31 +0000
Subject: [PATCH 09/66] cosmic-icons: 1.0.16 -> 1.1.0

(cherry picked from commit 3a55f81e4d43abc22e15fc27bea0471b00d0d55b)
---
 pkgs/by-name/co/cosmic-icons/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/co/cosmic-icons/package.nix b/pkgs/by-name/co/cosmic-icons/package.nix
index 6009c0bcfc18..6e680b83e8fa 100644
--- a/pkgs/by-name/co/cosmic-icons/package.nix
+++ b/pkgs/by-name/co/cosmic-icons/package.nix
@@ -9,14 +9,14 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "cosmic-icons";
-  version = "1.0.16";
+  version = "1.1.0";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-icons";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-3owl4M4vRyzjR4v74clyAxpNDu77rieSpYAVYfADHzY=";
+    hash = "sha256-QUTAYIQ6qAhjZK/9BZjJzTViECLUwO/MyaOqiRb1Ans=";
   };
 
   __structuredAttrs = true;

From 4b0181eb5808638b1090ec55ce3382b069ec5328 Mon Sep 17 00:00:00 2001
From: Salva <salva.hg01@gmail.com>
Date: Wed, 24 Jun 2026 00:30:41 +0000
Subject: [PATCH 10/66] cosmic-randr: 1.0.16 -> 1.1.0

(cherry picked from commit 71c1dc265be4bf105b28c63d4e89a5e3e2ce8da2)
---
 pkgs/by-name/co/cosmic-randr/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/co/cosmic-randr/package.nix b/pkgs/by-name/co/cosmic-randr/package.nix
index 4679dec4c858..f632be043c9b 100644
--- a/pkgs/by-name/co/cosmic-randr/package.nix
+++ b/pkgs/by-name/co/cosmic-randr/package.nix
@@ -12,7 +12,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-randr";
-  version = "1.0.16";
+  version = "1.1.0";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {

From 38804ba2f68da2aa8492165764f8df4f33ff3335 Mon Sep 17 00:00:00 2001
From: Salva <salva.hg01@gmail.com>
Date: Wed, 24 Jun 2026 00:31:16 +0000
Subject: [PATCH 11/66] cosmic-session: 1.0.16 -> 1.1.0

(cherry picked from commit 4a8e2282c328506d8270e2cf4ee3dbd19dbd1546)
---
 pkgs/by-name/co/cosmic-session/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/co/cosmic-session/package.nix b/pkgs/by-name/co/cosmic-session/package.nix
index b5507b5bd6af..cf4406a3cb21 100644
--- a/pkgs/by-name/co/cosmic-session/package.nix
+++ b/pkgs/by-name/co/cosmic-session/package.nix
@@ -12,7 +12,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-session";
-  version = "1.0.16";
+  version = "1.1.0";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {

From c87a744341212a2705f9c9513c84fdc7502b58ba Mon Sep 17 00:00:00 2001
From: Salva <salva.hg01@gmail.com>
Date: Wed, 24 Jun 2026 00:31:27 +0000
Subject: [PATCH 12/66] cosmic-settings-daemon: 1.0.16 -> 1.1.0

(cherry picked from commit 1ae9ccfacda41fc17e2f8aee4addb6ae22df179a)
---
 pkgs/by-name/co/cosmic-settings-daemon/package.nix | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/co/cosmic-settings-daemon/package.nix b/pkgs/by-name/co/cosmic-settings-daemon/package.nix
index 00c546752bc5..84aaa17fdf48 100644
--- a/pkgs/by-name/co/cosmic-settings-daemon/package.nix
+++ b/pkgs/by-name/co/cosmic-settings-daemon/package.nix
@@ -7,6 +7,7 @@
   adw-gtk3,
   pkg-config,
   libpulseaudio,
+  pipewire,
   libinput,
   udev,
   openssl,
@@ -16,14 +17,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-settings-daemon";
-  version = "1.0.16";
+  version = "1.1.0";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-settings-daemon";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-A+nOAadFWU+KRW54dP2WW6P6fabIs4z1AqC37LSZjUI=";
+    hash = "sha256-6MLZpGGvE1EnUlRv2T6+iXy8B0aqBTNNrqDtBbeABYs=";
   };
 
   postPatch = ''
@@ -33,18 +34,22 @@ rustPlatform.buildRustPackage (finalAttrs: {
       --replace-fail '/usr/share/themes/adw-gtk3' '${adw-gtk3}/share/themes/adw-gtk3'
   '';
 
-  cargoHash = "sha256-bz+JasI3WE30sKKgjofVO/42Ml4YY9Dw3JxnZmZVQk4=";
+  cargoHash = "sha256-rpyMdwmcddsrXuIOI5T6Kh9+cB28DdUxotiqpeGqvCc=";
 
   separateDebugInfo = true;
   __structuredAttrs = true;
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [
+    pkg-config
+    rustPlatform.bindgenHook
+  ];
 
   buildInputs = [
     libinput
     libpulseaudio
     openssl
     udev
+    pipewire
   ];
 
   makeFlags = [

From 9f40eba48a5c0ba09ec6d52a974a4e6c562e1ffd Mon Sep 17 00:00:00 2001
From: Salva <salva.hg01@gmail.com>
Date: Wed, 24 Jun 2026 00:31:27 +0000
Subject: [PATCH 13/66] cosmic-screenshot: 1.0.16 -> 1.1.0

(cherry picked from commit 1fa7a32bbe97e9e3642f51f3a3b578c9a674cbd1)
---
 pkgs/by-name/co/cosmic-screenshot/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/co/cosmic-screenshot/package.nix b/pkgs/by-name/co/cosmic-screenshot/package.nix
index b5aa22076ca3..a335b3e56fed 100644
--- a/pkgs/by-name/co/cosmic-screenshot/package.nix
+++ b/pkgs/by-name/co/cosmic-screenshot/package.nix
@@ -11,14 +11,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-screenshot";
-  version = "1.0.16";
+  version = "1.1.0";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-screenshot";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-DngKZDKfgVdSZLZAsPq+7p4r/go2Y6141LrCNGoxD1E=";
+    hash = "sha256-RYvc/3FoRnNkuYBVfCG75Bmfb8JWW1H4GKXyhq7CxaQ=";
   };
 
   cargoHash = "sha256-q0RJST1yeqPBjU5MseNZIrZw+brfDtQLKiw7wyViflE=";

From 6b12da5cde0708ecf22bf3d441f9712af4274187 Mon Sep 17 00:00:00 2001
From: Salva <salva.hg01@gmail.com>
Date: Wed, 24 Jun 2026 00:31:37 +0000
Subject: [PATCH 14/66] cosmic-panel: 1.0.16 -> 1.1.0

(cherry picked from commit aede6eecc8f2be8451243a4a7e0af4732fede02e)
---
 pkgs/by-name/co/cosmic-panel/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/co/cosmic-panel/package.nix b/pkgs/by-name/co/cosmic-panel/package.nix
index b003608effc0..08fbe6eaf82d 100644
--- a/pkgs/by-name/co/cosmic-panel/package.nix
+++ b/pkgs/by-name/co/cosmic-panel/package.nix
@@ -11,14 +11,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-panel";
-  version = "1.0.16";
+  version = "1.1.0";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-panel";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-MNOS7HMlyvU4zCZVINthgZgBsUn+LI1hUAEcwSq+zaE=";
+    hash = "sha256-DKwmZnTxsYCWAkLb9AXoHBa8m6Z5Gi1Jb7AuxZqq7RA=";
   };
 
   cargoHash = "sha256-6E+bAi1f6gOZh64wyvLMKZiZNlMexPV+ZzS3riOx9xM=";

From cae5de3ea19b9b1e48796f5f3549c64c2a19cae7 Mon Sep 17 00:00:00 2001
From: Salva <salva.hg01@gmail.com>
Date: Wed, 24 Jun 2026 00:31:43 +0000
Subject: [PATCH 15/66] cosmic-workspaces-epoch: 1.0.16 -> 1.1.0

(cherry picked from commit fbaa97d190e9383adfb93d48edaac5214e62044f)
---
 pkgs/by-name/co/cosmic-workspaces-epoch/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/co/cosmic-workspaces-epoch/package.nix b/pkgs/by-name/co/cosmic-workspaces-epoch/package.nix
index 24e5785fc668..92fa4090d020 100644
--- a/pkgs/by-name/co/cosmic-workspaces-epoch/package.nix
+++ b/pkgs/by-name/co/cosmic-workspaces-epoch/package.nix
@@ -14,14 +14,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-workspaces-epoch";
-  version = "1.0.16";
+  version = "1.1.0";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-workspaces-epoch";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-u4p22qpxZPdBogzrJXGomqGGxgkpD0hdXf+3YNg2VIo=";
+    hash = "sha256-riiveHFtRF3rtOhbbUtfYRoAlqc7TCRr8aer0dgBY7g=";
   };
 
   cargoHash = "sha256-Z5dC3W8QoDBZWBjHwRj9MC8EScDjQwUiUcOPTRDToDA=";

From 48c7c706c9d199ffda583639c44b5a1613544df5 Mon Sep 17 00:00:00 2001
From: Salva <salva.hg01@gmail.com>
Date: Wed, 24 Jun 2026 00:31:55 +0000
Subject: [PATCH 16/66] cosmic-initial-setup: 1.0.16 -> 1.1.0

(cherry picked from commit b7c671f3af5a92f763797729a83f9153a14ef6e1)
---
 pkgs/by-name/co/cosmic-initial-setup/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/co/cosmic-initial-setup/package.nix b/pkgs/by-name/co/cosmic-initial-setup/package.nix
index 9006fa7e152d..cf7d5a6b55f1 100644
--- a/pkgs/by-name/co/cosmic-initial-setup/package.nix
+++ b/pkgs/by-name/co/cosmic-initial-setup/package.nix
@@ -14,14 +14,14 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-initial-setup";
-  version = "1.0.16";
+  version = "1.1.0";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-initial-setup";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-3nGPBWYDqPJN99WtzsAVERucwiVAFynuUk2gezZ/RJU=";
+    hash = "sha256-UABqbmbwW2ZBOO7mq16/h0s55VCWRF2yyf/1TaubC88=";
   };
 
   cargoHash = "sha256-DESnl5NjakU4++Ep6CHxDZzHn+o0Gi0eREpXk5BN5iY=";

From 80a5c207f1fe74a54a98cc67a337477f15260821 Mon Sep 17 00:00:00 2001
From: Salva <salva.hg01@gmail.com>
Date: Wed, 24 Jun 2026 00:31:56 +0000
Subject: [PATCH 17/66] cosmic-idle: 1.0.16 -> 1.1.0

(cherry picked from commit dcaa6c86c06f354c4a8115faf36095b66f863bf0)
---
 pkgs/by-name/co/cosmic-idle/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/co/cosmic-idle/package.nix b/pkgs/by-name/co/cosmic-idle/package.nix
index ca17faa2ce2b..05c0e99f8ff1 100644
--- a/pkgs/by-name/co/cosmic-idle/package.nix
+++ b/pkgs/by-name/co/cosmic-idle/package.nix
@@ -16,7 +16,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-idle";
-  version = "1.0.16";
+  version = "1.1.0";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {

From fe74e6fada86d3197bd3f5561591fdc99cb58fed Mon Sep 17 00:00:00 2001
From: Salva <salva.hg01@gmail.com>
Date: Wed, 24 Jun 2026 00:32:10 +0000
Subject: [PATCH 18/66] cosmic-term: 1.0.16 -> 1.1.0

(cherry picked from commit 131cfc6841c63fe432d0cb9e5791b95d1064386c)
---
 pkgs/by-name/co/cosmic-term/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/co/cosmic-term/package.nix b/pkgs/by-name/co/cosmic-term/package.nix
index 168b9b41beeb..b99fcc991196 100644
--- a/pkgs/by-name/co/cosmic-term/package.nix
+++ b/pkgs/by-name/co/cosmic-term/package.nix
@@ -15,17 +15,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-term";
-  version = "1.0.16";
+  version = "1.1.0";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-term";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-nDTDGtaGRW0JM48/tbWO/NK1WhGkPwlsqfWrDGvFE9A=";
+    hash = "sha256-ocOPssCxm2p2HoAIHIAoAMh66cGcGXuGWDuAEtHFoPQ=";
   };
 
-  cargoHash = "sha256-0W1TU1NIcV9fx/vgKpPLqLO1fcdtbZX5Ds1uQWGJ2C8=";
+  cargoHash = "sha256-ezFCpU4ZNfANYRVTMrvPMC79j55XGUwYMMKeihekYds=";
 
   separateDebugInfo = true;
   __structuredAttrs = true;

From 2b799e676a8a9fbc544259f6e987073d87291493 Mon Sep 17 00:00:00 2001
From: Salva <salva.hg01@gmail.com>
Date: Wed, 24 Jun 2026 00:32:20 +0000
Subject: [PATCH 19/66] cosmic-bg: 1.0.16 -> 1.1.0

(cherry picked from commit fc3a1416b523f7917f143a349ad8e4fac197f904)
---
 pkgs/by-name/co/cosmic-bg/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/co/cosmic-bg/package.nix b/pkgs/by-name/co/cosmic-bg/package.nix
index e18cef8f3a4f..6a27f2f4a9dc 100644
--- a/pkgs/by-name/co/cosmic-bg/package.nix
+++ b/pkgs/by-name/co/cosmic-bg/package.nix
@@ -13,14 +13,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-bg";
-  version = "1.0.16";
+  version = "1.1.0";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-bg";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-E4OWxoGyRNFcMl7ni7PB6PE0Yl7dE+Wd4JGDMHO94Yw=";
+    hash = "sha256-bczUWa91l52P6Q46/lkX1j9eKasM154D82fBaLFHF1M=";
   };
 
   postPatch = ''
@@ -29,7 +29,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       "${cosmic-wallpapers}/share/backgrounds/cosmic/orion_nebula_nasa_heic0601a.jpg"
   '';
 
-  cargoHash = "sha256-xXq8Dckg3YOf2AT9uOZqVfq00FhZp/X5UU8hLmAln1U=";
+  cargoHash = "sha256-UDhXKg4lO6op/lfi3aZ4iclzUqcf5xQI85UWAHVTWig=";
 
   separateDebugInfo = true;
   __structuredAttrs = true;

From 9610727572350141b59fd7653e7b7a2192882c45 Mon Sep 17 00:00:00 2001
From: Salva <salva.hg01@gmail.com>
Date: Wed, 24 Jun 2026 00:33:06 +0000
Subject: [PATCH 20/66] cosmic-comp: 1.0.16 -> 1.1.0

(cherry picked from commit 8018ba27faac756bf8d0e6fc2235d6a4db598b1b)
---
 pkgs/by-name/co/cosmic-comp/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/co/cosmic-comp/package.nix b/pkgs/by-name/co/cosmic-comp/package.nix
index b57bf910e0ca..69552fdea6ad 100644
--- a/pkgs/by-name/co/cosmic-comp/package.nix
+++ b/pkgs/by-name/co/cosmic-comp/package.nix
@@ -20,14 +20,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-comp";
-  version = "1.0.16";
+  version = "1.1.0";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-comp";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-3WPZk/o+cfq3wwKEuYejMh+pn2o823m98OO3crFaNX4=";
+    hash = "sha256-fUuw7qwfojAmu/mkWMkWBhpcSgZNTIzdXmInjyKrZBI=";
   };
 
   cargoHash = "sha256-ki+unf58rXBCpj5PCpBcg/6FWo16+MdPQWae+w1YkJ8=";

From 33118a19826fba855f06a76473e50ddc4cece1ff Mon Sep 17 00:00:00 2001
From: Salva <salva.hg01@gmail.com>
Date: Wed, 24 Jun 2026 00:33:14 +0000
Subject: [PATCH 21/66] cosmic-applibrary: 1.0.16 -> 1.1.0

(cherry picked from commit 955aa2e3def49e4cb40b3030b8f42909e3981996)
---
 pkgs/by-name/co/cosmic-applibrary/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/co/cosmic-applibrary/package.nix b/pkgs/by-name/co/cosmic-applibrary/package.nix
index 19c352f99649..87e9e75cb8cb 100644
--- a/pkgs/by-name/co/cosmic-applibrary/package.nix
+++ b/pkgs/by-name/co/cosmic-applibrary/package.nix
@@ -11,14 +11,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-applibrary";
-  version = "1.0.16";
+  version = "1.1.0";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-applibrary";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-mzHSLZK6HienbPRPetSj+XbPWCnpihEvMx9W9lJWpbA=";
+    hash = "sha256-TZncRQer4lXunUwdQ2xDP3DmF5B7UmfhSQvEwVodc98=";
   };
 
   cargoHash = "sha256-qGx/3w78mgIMqRo1wJA+ULFHWdNW2LKe2Sej4f9KbVs=";

From 1dafc828e80de215078a30862f2e0e330760fcba Mon Sep 17 00:00:00 2001
From: Salva <salva.hg01@gmail.com>
Date: Wed, 24 Jun 2026 00:33:16 +0000
Subject: [PATCH 22/66] cosmic-notifications: 1.0.16 -> 1.1.0

(cherry picked from commit 7cc364bb80edd7ad26eae7366e04210d74b16d09)
---
 pkgs/by-name/co/cosmic-notifications/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/co/cosmic-notifications/package.nix b/pkgs/by-name/co/cosmic-notifications/package.nix
index f0ae84bd4110..401eb262ebe7 100644
--- a/pkgs/by-name/co/cosmic-notifications/package.nix
+++ b/pkgs/by-name/co/cosmic-notifications/package.nix
@@ -12,7 +12,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-notifications";
-  version = "1.0.16";
+  version = "1.1.0";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {

From 05db3e22ac8134ca86abff7093cc58eb77a38e28 Mon Sep 17 00:00:00 2001
From: Salva <salva.hg01@gmail.com>
Date: Wed, 24 Jun 2026 00:33:19 +0000
Subject: [PATCH 23/66] cosmic-store: 1.0.16 -> 1.1.0

(cherry picked from commit ae002664d0e5e8b0721e3b1a48aeb0423df5ddbf)
---
 pkgs/by-name/co/cosmic-store/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/co/cosmic-store/package.nix b/pkgs/by-name/co/cosmic-store/package.nix
index 25c9ad72ac4a..d29231e0e70d 100644
--- a/pkgs/by-name/co/cosmic-store/package.nix
+++ b/pkgs/by-name/co/cosmic-store/package.nix
@@ -15,17 +15,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-store";
-  version = "1.0.16";
+  version = "1.1.0";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-store";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-JE8LcFlhG4e3QqobzUNfCw3Eg10+FrlVuQu+J+96/es=";
+    hash = "sha256-pePtfOgeQtaD15dfWzrMQmXcINf/V5ovKWAG8kOPf+c=";
   };
 
-  cargoHash = "sha256-+lOt+mSTKKsSm3UzGXq43ZjbktiCCV8dnHdvnnx2vqA=";
+  cargoHash = "sha256-jECZ/6hxaDfz2pOOqLkbq5HfF3YnCVK2geFAC+n286A=";
 
   separateDebugInfo = true;
   __structuredAttrs = true;

From 08a4e89bc34788949ed1ece2562bcd4ec5b8c329 Mon Sep 17 00:00:00 2001
From: Salva <salva.hg01@gmail.com>
Date: Wed, 24 Jun 2026 00:33:20 +0000
Subject: [PATCH 24/66] cosmic-files: 1.0.16 -> 1.1.0

(cherry picked from commit 96d5bcc766b2f327ecfbf85e3cee241c97415093)
---
 pkgs/by-name/co/cosmic-files/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/co/cosmic-files/package.nix b/pkgs/by-name/co/cosmic-files/package.nix
index 149956ff852f..cc0d584fd744 100644
--- a/pkgs/by-name/co/cosmic-files/package.nix
+++ b/pkgs/by-name/co/cosmic-files/package.nix
@@ -12,17 +12,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-files";
-  version = "1.0.16";
+  version = "1.1.0";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-files";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-2vrk1hYL7E/vVWiLcOYY3O0cmYZyFG4bdkNDFuyA+cA=";
+    hash = "sha256-cRwZrmm/zOIV6VCyz2dTH+qn8h6LOnaOiHU5nENTK6o=";
   };
 
-  cargoHash = "sha256-QPFGsn1J0lp5K4gLdar/Z5MmZg+VOoCZd1U8LUuLXqM=";
+  cargoHash = "sha256-+21DCCTkNrbdxgxQi0YyuAxpl1IvwUz3ccUE+E0sZ4Y=";
 
   separateDebugInfo = true;
   __structuredAttrs = true;

From 0077ea81480fe7751fc02ec6ba1273d5b6d89868 Mon Sep 17 00:00:00 2001
From: Salva <salva.hg01@gmail.com>
Date: Wed, 24 Jun 2026 00:33:21 +0000
Subject: [PATCH 25/66] cosmic-greeter: 1.0.16 -> 1.1.0

(cherry picked from commit c5105b6df1d0699179d09d430df0426e8fdc1418)
---
 pkgs/by-name/co/cosmic-greeter/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/co/cosmic-greeter/package.nix b/pkgs/by-name/co/cosmic-greeter/package.nix
index 12e59cf25258..c9f04a86339b 100644
--- a/pkgs/by-name/co/cosmic-greeter/package.nix
+++ b/pkgs/by-name/co/cosmic-greeter/package.nix
@@ -19,14 +19,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-greeter";
-  version = "1.0.16";
+  version = "1.1.0";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-greeter";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-+6VOv6z61k48hURq4yRRMIFIE8ZrjYGapO5FybWKQTE=";
+    hash = "sha256-oxXCAvBISkZu76VpvQ9AliFRJ8r5Ay7mjWf4sEwV0Xs=";
   };
 
   cargoHash = "sha256-mfY2hsMxBooRjmTB2jgUIKyKHBpGfZ9Qslwv+2aEQyg=";

From 5de7e852e444272037056b9ca65bc76be15d02bb Mon Sep 17 00:00:00 2001
From: Salva <salva.hg01@gmail.com>
Date: Wed, 24 Jun 2026 00:33:22 +0000
Subject: [PATCH 26/66] cosmic-launcher: 1.0.16 -> 1.1.0

(cherry picked from commit 5234f0f173af1934a540399f255cfdffd6f4c9a2)
---
 pkgs/by-name/co/cosmic-launcher/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/co/cosmic-launcher/package.nix b/pkgs/by-name/co/cosmic-launcher/package.nix
index 8b3b14881b5e..2f790b30098d 100644
--- a/pkgs/by-name/co/cosmic-launcher/package.nix
+++ b/pkgs/by-name/co/cosmic-launcher/package.nix
@@ -11,14 +11,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-launcher";
-  version = "1.0.16";
+  version = "1.1.0";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-launcher";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-ZivzjufT2UlPi/En1AjGS8TfeFNdJDfDUd9cb2Begb8=";
+    hash = "sha256-9U64nSeI47bkc8BQU9ilXBlHQRGS2zC/FcBKc7Z17RY=";
   };
 
   cargoHash = "sha256-WnZAPQR8hGGNC5S7hPmcGSMs9HrOw4/wqJR151eIgHY=";

From 568f8945a47d6a79290e74bd3ef3e1ddfc1310eb Mon Sep 17 00:00:00 2001
From: Salva <salva.hg01@gmail.com>
Date: Wed, 24 Jun 2026 00:33:22 +0000
Subject: [PATCH 27/66] cosmic-player: 1.0.16 -> 1.1.0

(cherry picked from commit 18f1a1a3393e6c71bb7d26e406689a20cd95d715)
---
 pkgs/by-name/co/cosmic-player/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/co/cosmic-player/package.nix b/pkgs/by-name/co/cosmic-player/package.nix
index 549cdb52346d..b12ec673f447 100644
--- a/pkgs/by-name/co/cosmic-player/package.nix
+++ b/pkgs/by-name/co/cosmic-player/package.nix
@@ -18,17 +18,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-player";
-  version = "1.0.16";
+  version = "1.1.0";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-player";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-iDEyR+P+iXShH0YFtqxvPbbs9kgtYvAsuKchB6plnKI=";
+    hash = "sha256-aHQbwpNr8tsfUR0Dm4WTzz6XNXjgdqZ9/2AQRPPbnog=";
   };
 
-  cargoHash = "sha256-YzT16Ej+AyLLj8uHuHxZvHWujcW8jLjVg/4MmPyorH4=";
+  cargoHash = "sha256-KVaKTMrWijResBqzH62j/YqBR4TQ77x2sK/kN40UWjw=";
 
   separateDebugInfo = true;
   __structuredAttrs = true;

From 35cd91e83456e6b2ee15c5dbfad1606c90c43ac6 Mon Sep 17 00:00:00 2001
From: Salva <salva.hg01@gmail.com>
Date: Wed, 24 Jun 2026 00:33:24 +0000
Subject: [PATCH 28/66] cosmic-applets: 1.0.16 -> 1.1.0

(cherry picked from commit 27dcebc012d317a6f9e20e7c73b4c50a8043fb4f)
---
 pkgs/by-name/co/cosmic-applets/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/co/cosmic-applets/package.nix b/pkgs/by-name/co/cosmic-applets/package.nix
index 03ac8e1bb998..7539b7dcbae7 100644
--- a/pkgs/by-name/co/cosmic-applets/package.nix
+++ b/pkgs/by-name/co/cosmic-applets/package.nix
@@ -20,17 +20,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-applets";
-  version = "1.0.16";
+  version = "1.1.0";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-applets";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-o+rEO+IA337fhpq6TsH+UZEN7kb/PqydlKo77NyCRcM=";
+    hash = "sha256-A8Qk9u3Q83Q4AjzTrdptfS9UNoyKq39YihC4d/dNBYc=";
   };
 
-  cargoHash = "sha256-tbGuyqdDTsKYpKxeAuachwbPHTPhmb9Sg3qzxHYosjo=";
+  cargoHash = "sha256-81BFu13QmqOq43iN+ORQuktisEFYRrK+wd6diFfSufs=";
 
   separateDebugInfo = true;
   __structuredAttrs = true;

From 797aa9b25fd4fa543881476acad639661c1d36c0 Mon Sep 17 00:00:00 2001
From: Salva <salva.hg01@gmail.com>
Date: Wed, 24 Jun 2026 00:33:24 +0000
Subject: [PATCH 29/66] cosmic-edit: 1.0.16 -> 1.1.0

(cherry picked from commit 7ae24bd6786b7c4aa88e26287a504578292d1aa3)
---
 pkgs/by-name/co/cosmic-edit/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/co/cosmic-edit/package.nix b/pkgs/by-name/co/cosmic-edit/package.nix
index ac6085d05627..c6148a0cf930 100644
--- a/pkgs/by-name/co/cosmic-edit/package.nix
+++ b/pkgs/by-name/co/cosmic-edit/package.nix
@@ -16,17 +16,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-edit";
-  version = "1.0.16";
+  version = "1.1.0";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-edit";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-almnWrJSV5xZoBDEuk0pfMZ/c00e0xpDNTTbcq+NCYM=";
+    hash = "sha256-5DsnhaiJgmTakn+q9o2Q7IeuakAC/j0Ck3F3pfFx/EA=";
   };
 
-  cargoHash = "sha256-/qcpAR2nvC/MYa5QuCLiZFQgos5SlYtspZsNuMLJFHk=";
+  cargoHash = "sha256-2E+98uWtahyQufoZTzdUtkwbuISsUHwlqOmMSpyi1O8=";
 
   separateDebugInfo = true;
 

From d296a3384a3117e2befd604b618fdff5888e795c Mon Sep 17 00:00:00 2001
From: Salva <salva.hg01@gmail.com>
Date: Wed, 24 Jun 2026 00:33:25 +0000
Subject: [PATCH 30/66] xdg-desktop-portal-cosmic: 1.0.16 -> 1.1.0

(cherry picked from commit 3c567472d772100f70e13fa92d56da6c07fc6bf2)
---
 pkgs/by-name/xd/xdg-desktop-portal-cosmic/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/xd/xdg-desktop-portal-cosmic/package.nix b/pkgs/by-name/xd/xdg-desktop-portal-cosmic/package.nix
index 78c5edf0a4fa..711d80f4136d 100644
--- a/pkgs/by-name/xd/xdg-desktop-portal-cosmic/package.nix
+++ b/pkgs/by-name/xd/xdg-desktop-portal-cosmic/package.nix
@@ -17,14 +17,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "xdg-desktop-portal-cosmic";
-  version = "1.0.16";
+  version = "1.1.0";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "xdg-desktop-portal-cosmic";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-LwZqF3Yg4DMis21wtu1XMAoPTjJ39GPrf07K9Yc2YAg=";
+    hash = "sha256-yN7dUhB8eMW/CK9HTeuK/CAYFjvWvCLApQ7mb71VLps=";
   };
 
   cargoHash = "sha256-wSwXzaU872KqcRgAIKRuQFvG9f/q4z0OysysLyYMwdg=";

From dd922a6cd7e6580298ee9890ff086b4f1bcbc477 Mon Sep 17 00:00:00 2001
From: Salva <salva.hg01@gmail.com>
Date: Tue, 23 Jun 2026 18:40:37 -0600
Subject: [PATCH 31/66] Revert "cosmic-osd: deduplicate the dual sources for
 the cosmic-settings crate"

This reverts commit 1420532dfa5042235227552ec3e6cee53b86c30c.

(cherry picked from commit d8dbb158ca4fcd1f58719f95db4a96635e5f65b9)
---
 .../deduplicate-cosmic-settings-crate.patch   | 31 -------------------
 pkgs/by-name/co/cosmic-osd/package.nix        |  9 +-----
 2 files changed, 1 insertion(+), 39 deletions(-)
 delete mode 100644 pkgs/by-name/co/cosmic-osd/deduplicate-cosmic-settings-crate.patch

diff --git a/pkgs/by-name/co/cosmic-osd/deduplicate-cosmic-settings-crate.patch b/pkgs/by-name/co/cosmic-osd/deduplicate-cosmic-settings-crate.patch
deleted file mode 100644
index 9872e8d69f5f..000000000000
--- a/pkgs/by-name/co/cosmic-osd/deduplicate-cosmic-settings-crate.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-diff --git a/Cargo.lock b/Cargo.lock
-index 8b6704e..64c1691 100644
---- a/Cargo.lock
-+++ b/Cargo.lock
-@@ -1104,7 +1104,7 @@ dependencies = [
- [[package]]
- name = "cosmic-settings-airplane-mode-subscription"
- version = "1.0.7"
--source = "git+https://github.com/pop-os/cosmic-settings#78644a32e3741f8f80e9b8ce65c3550c85f9c1f8"
-+source = "git+https://github.com/pop-os/cosmic-settings#81912bed6cdebe2719e29e6bd1453e7b977acb0e"
- dependencies = [
-  "futures",
-  "iced_futures",
-@@ -1150,7 +1150,7 @@ dependencies = [
- [[package]]
- name = "cosmic-settings-pulse-subscription"
- version = "0.1.0"
--source = "git+https://github.com/pop-os/cosmic-settings#78644a32e3741f8f80e9b8ce65c3550c85f9c1f8"
-+source = "git+https://github.com/pop-os/cosmic-settings#81912bed6cdebe2719e29e6bd1453e7b977acb0e"
- dependencies = [
-  "futures",
-  "iced_futures",
-@@ -1162,7 +1162,7 @@ dependencies = [
- [[package]]
- name = "cosmic-settings-upower-subscription"
- version = "1.0.7"
--source = "git+https://github.com/pop-os/cosmic-settings#78644a32e3741f8f80e9b8ce65c3550c85f9c1f8"
-+source = "git+https://github.com/pop-os/cosmic-settings#81912bed6cdebe2719e29e6bd1453e7b977acb0e"
- dependencies = [
-  "futures",
-  "iced_futures",
diff --git a/pkgs/by-name/co/cosmic-osd/package.nix b/pkgs/by-name/co/cosmic-osd/package.nix
index 407e63972011..4ee4201421f6 100644
--- a/pkgs/by-name/co/cosmic-osd/package.nix
+++ b/pkgs/by-name/co/cosmic-osd/package.nix
@@ -25,14 +25,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     hash = "sha256-jv28hxhQUcUDLnOwU3xQJwCU+s52pwDNs8Gf4I5Hp9k=";
   };
 
-  cargoHash = "sha256-YwZXlhggrUddxour+/S1mSL3Fq1mzvFaOHArLSnfPvc=";
-
-  cargoPatches = [
-    # A different reference to the `cargo-settings` crate was added in:
-    # <https://github.com/pop-os/cosmic-osd/pull/204>
-    # Remove this patch once upstream fixes their lockfile.
-    ./deduplicate-cosmic-settings-crate.patch
-  ];
+  cargoHash = "sha256-BngWy8fSfmQYSLV+/3jBvDdI0lpTwqGUiwwHvDlqySw=";
 
   separateDebugInfo = true;
   __structuredAttrs = true;

From a825840621df4d465e0f87484c5468ef70e1c347 Mon Sep 17 00:00:00 2001
From: Salva <salva.hg01@gmail.com>
Date: Wed, 24 Jun 2026 00:47:07 +0000
Subject: [PATCH 32/66] cosmic-osd: 1.0.16 -> 1.1.0

(cherry picked from commit 322e662f7d23000965a5226c970839429bc79938)
---
 pkgs/by-name/co/cosmic-osd/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/co/cosmic-osd/package.nix b/pkgs/by-name/co/cosmic-osd/package.nix
index 4ee4201421f6..c3bdf6376f10 100644
--- a/pkgs/by-name/co/cosmic-osd/package.nix
+++ b/pkgs/by-name/co/cosmic-osd/package.nix
@@ -15,17 +15,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-osd";
-  version = "1.0.16";
+  version = "1.1.0";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-osd";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-jv28hxhQUcUDLnOwU3xQJwCU+s52pwDNs8Gf4I5Hp9k=";
+    hash = "sha256-veqkYF2CSwnc1nGIFeZXpfannCQ0RuacvqPVxVsiVDc=";
   };
 
-  cargoHash = "sha256-BngWy8fSfmQYSLV+/3jBvDdI0lpTwqGUiwwHvDlqySw=";
+  cargoHash = "sha256-aweq4E2bwqRpetakpR0OqTsIsoJK6h4eRzMdBhGuIoU=";
 
   separateDebugInfo = true;
   __structuredAttrs = true;

From cdc0c56367fe2791b4544071bbec83711219bb75 Mon Sep 17 00:00:00 2001
From: Salva <salva.hg01@gmail.com>
Date: Tue, 23 Jun 2026 19:42:49 -0600
Subject: [PATCH 33/66] cosmic-settings: 1.0.16 -> 1.1.0

(cherry picked from commit 86390cca25e1e23dd9e34bf626550044e153ec2a)
---
 pkgs/by-name/co/cosmic-settings/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/co/cosmic-settings/package.nix b/pkgs/by-name/co/cosmic-settings/package.nix
index 513089a3af67..0946a83cec7f 100644
--- a/pkgs/by-name/co/cosmic-settings/package.nix
+++ b/pkgs/by-name/co/cosmic-settings/package.nix
@@ -27,17 +27,17 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-settings";
-  version = "1.0.16";
+  version = "1.1.0";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-settings";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-knA3qpFeRRlUMV91+LleaWxb1fexX2IJlMRD81fl7l4=";
+    hash = "sha256-LfhFza0G85+fIuACMdwV50Okh5/46z8tLoJ9IvLqTgw=";
   };
 
-  cargoHash = "sha256-2ZHuOmtBzXQ/KSBMKus9LbojfByYzzCjIkbGY8C85bU=";
+  cargoHash = "sha256-rYjizOCcLJ4aq3UB5xEwWq5+KvrSi5PCUTIwUM/wegM=";
 
   separateDebugInfo = true;
   __structuredAttrs = true;

From 991d07d6ba63f5b6b1dbc89f04bdcc77c4aa6e82 Mon Sep 17 00:00:00 2001
From: Salva <salva.hg01@gmail.com>
Date: Tue, 23 Jun 2026 19:43:51 -0600
Subject: [PATCH 34/66] cosmic-settings: deduplicate multiple libcosmic sources

(cherry picked from commit f2490908f1255c9baf64eef7e82b58995b646250)
---
 .../co/cosmic-settings/dedup-libcosmic.patch  | 112 ++++++++++++++++++
 pkgs/by-name/co/cosmic-settings/package.nix   |   6 +
 2 files changed, 118 insertions(+)
 create mode 100644 pkgs/by-name/co/cosmic-settings/dedup-libcosmic.patch

diff --git a/pkgs/by-name/co/cosmic-settings/dedup-libcosmic.patch b/pkgs/by-name/co/cosmic-settings/dedup-libcosmic.patch
new file mode 100644
index 000000000000..00d00905de3b
--- /dev/null
+++ b/pkgs/by-name/co/cosmic-settings/dedup-libcosmic.patch
@@ -0,0 +1,112 @@
+diff --git a/Cargo.lock b/Cargo.lock
+index 46d491a..ea60cd9 100644
+--- a/Cargo.lock
++++ b/Cargo.lock
+@@ -1774,7 +1774,7 @@ dependencies = [
+ [[package]]
+ name = "cosmic-theme"
+ version = "1.0.0"
+-source = "git+https://github.com/pop-os/libcosmic#f0f68933f1552857e2165fc0fa953228107bddef"
++source = "git+https://github.com/pop-os/libcosmic#a991d7bb433f67016c1473e8e4a03691ededd75a"
+ dependencies = [
+  "almost",
+  "configparser",
+@@ -3158,7 +3158,7 @@ dependencies = [
+ [[package]]
+ name = "iced"
+ version = "0.14.0"
+-source = "git+https://github.com/pop-os/libcosmic#f0f68933f1552857e2165fc0fa953228107bddef"
++source = "git+https://github.com/pop-os/libcosmic#a991d7bb433f67016c1473e8e4a03691ededd75a"
+ dependencies = [
+  "dnd",
+  "iced_accessibility",
+@@ -3214,7 +3214,7 @@ dependencies = [
+ [[package]]
+ name = "iced_debug"
+ version = "0.14.0"
+-source = "git+https://github.com/pop-os/libcosmic#f0f68933f1552857e2165fc0fa953228107bddef"
++source = "git+https://github.com/pop-os/libcosmic#a991d7bb433f67016c1473e8e4a03691ededd75a"
+ dependencies = [
+  "iced_core",
+  "iced_futures",
+@@ -3238,7 +3238,7 @@ dependencies = [
+ [[package]]
+ name = "iced_graphics"
+ version = "0.14.0"
+-source = "git+https://github.com/pop-os/libcosmic#f0f68933f1552857e2165fc0fa953228107bddef"
++source = "git+https://github.com/pop-os/libcosmic#a991d7bb433f67016c1473e8e4a03691ededd75a"
+ dependencies = [
+  "bitflags 2.12.1",
+  "bytemuck",
+@@ -3259,7 +3259,7 @@ dependencies = [
+ [[package]]
+ name = "iced_program"
+ version = "0.14.0"
+-source = "git+https://github.com/pop-os/libcosmic#f0f68933f1552857e2165fc0fa953228107bddef"
++source = "git+https://github.com/pop-os/libcosmic#a991d7bb433f67016c1473e8e4a03691ededd75a"
+ dependencies = [
+  "iced_graphics",
+  "iced_runtime",
+@@ -3268,7 +3268,7 @@ dependencies = [
+ [[package]]
+ name = "iced_renderer"
+ version = "0.14.0"
+-source = "git+https://github.com/pop-os/libcosmic#f0f68933f1552857e2165fc0fa953228107bddef"
++source = "git+https://github.com/pop-os/libcosmic#a991d7bb433f67016c1473e8e4a03691ededd75a"
+ dependencies = [
+  "iced_graphics",
+  "iced_tiny_skia",
+@@ -3280,7 +3280,7 @@ dependencies = [
+ [[package]]
+ name = "iced_runtime"
+ version = "0.14.0"
+-source = "git+https://github.com/pop-os/libcosmic#f0f68933f1552857e2165fc0fa953228107bddef"
++source = "git+https://github.com/pop-os/libcosmic#a991d7bb433f67016c1473e8e4a03691ededd75a"
+ dependencies = [
+  "bytes",
+  "cosmic-client-toolkit",
+@@ -3296,7 +3296,7 @@ dependencies = [
+ [[package]]
+ name = "iced_tiny_skia"
+ version = "0.14.0"
+-source = "git+https://github.com/pop-os/libcosmic#f0f68933f1552857e2165fc0fa953228107bddef"
++source = "git+https://github.com/pop-os/libcosmic#a991d7bb433f67016c1473e8e4a03691ededd75a"
+ dependencies = [
+  "bytemuck",
+  "cosmic-text",
+@@ -3313,7 +3313,7 @@ dependencies = [
+ [[package]]
+ name = "iced_wgpu"
+ version = "0.14.0"
+-source = "git+https://github.com/pop-os/libcosmic#f0f68933f1552857e2165fc0fa953228107bddef"
++source = "git+https://github.com/pop-os/libcosmic#a991d7bb433f67016c1473e8e4a03691ededd75a"
+ dependencies = [
+  "as-raw-xcb-connection",
+  "bitflags 2.12.1",
+@@ -3344,7 +3344,7 @@ dependencies = [
+ [[package]]
+ name = "iced_widget"
+ version = "0.14.2"
+-source = "git+https://github.com/pop-os/libcosmic#f0f68933f1552857e2165fc0fa953228107bddef"
++source = "git+https://github.com/pop-os/libcosmic#a991d7bb433f67016c1473e8e4a03691ededd75a"
+ dependencies = [
+  "cosmic-client-toolkit",
+  "dnd",
+@@ -3364,7 +3364,7 @@ dependencies = [
+ [[package]]
+ name = "iced_winit"
+ version = "0.14.0"
+-source = "git+https://github.com/pop-os/libcosmic#f0f68933f1552857e2165fc0fa953228107bddef"
++source = "git+https://github.com/pop-os/libcosmic#a991d7bb433f67016c1473e8e4a03691ededd75a"
+ dependencies = [
+  "cosmic-client-toolkit",
+  "cursor-icon",
+@@ -4455,7 +4455,7 @@ checksum = "68ab91017fe16c622486840e4c83c9a37afeff978bd239b5293d61ece587de66"
+ [[package]]
+ name = "libcosmic"
+ version = "1.0.0"
+-source = "git+https://github.com/pop-os/libcosmic#f0f68933f1552857e2165fc0fa953228107bddef"
++source = "git+https://github.com/pop-os/libcosmic#a991d7bb433f67016c1473e8e4a03691ededd75a"
+ dependencies = [
+  "apply",
+  "ashpd 0.12.3",
diff --git a/pkgs/by-name/co/cosmic-settings/package.nix b/pkgs/by-name/co/cosmic-settings/package.nix
index 0946a83cec7f..5320de71ee47 100644
--- a/pkgs/by-name/co/cosmic-settings/package.nix
+++ b/pkgs/by-name/co/cosmic-settings/package.nix
@@ -37,6 +37,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
     hash = "sha256-LfhFza0G85+fIuACMdwV50Okh5/46z8tLoJ9IvLqTgw=";
   };
 
+  cargoPatches = [
+    # A different reference to the `libcosmic` crate was added
+    # Remove this patch once upstream fixes their lockfile.
+    ./dedup-libcosmic.patch
+  ];
+
   cargoHash = "sha256-rYjizOCcLJ4aq3UB5xEwWq5+KvrSi5PCUTIwUM/wegM=";
 
   separateDebugInfo = true;

From ee6ad27d22a687b9ecc29bcfbe949a7dc24dfc5d Mon Sep 17 00:00:00 2001
From: Salva <salva.hg01@gmail.com>
Date: Tue, 23 Jun 2026 20:24:17 -0600
Subject: [PATCH 35/66] cosmic-monitor: init at 1.1.0

(cherry picked from commit a0bc650cfb757b72f87324176b600640ae886678)
---
 pkgs/by-name/co/cosmic-monitor/package.nix | 73 ++++++++++++++++++++++
 1 file changed, 73 insertions(+)
 create mode 100644 pkgs/by-name/co/cosmic-monitor/package.nix

diff --git a/pkgs/by-name/co/cosmic-monitor/package.nix b/pkgs/by-name/co/cosmic-monitor/package.nix
new file mode 100644
index 000000000000..9b1bdd228583
--- /dev/null
+++ b/pkgs/by-name/co/cosmic-monitor/package.nix
@@ -0,0 +1,73 @@
+{
+  lib,
+  stdenv,
+  rustPlatform,
+  fetchFromGitHub,
+  just,
+  libcosmicAppHook,
+  nixosTests,
+  nix-update-script,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "cosmic-monitor";
+  version = "1.1.0";
+
+  # nixpkgs-update: no auto update
+  src = fetchFromGitHub {
+    owner = "pop-os";
+    repo = "cosmic-monitor";
+    tag = "epoch-${finalAttrs.version}";
+    hash = "sha256-CiJ9LeNcdOyC8yn0c7hCz0QEecxYK95KGvs1SWr9360=";
+  };
+
+  cargoHash = "sha256-OMhLPQ3GkV/wdeb9F7lsKY1Uzzg8+UlhOeakGZo6mYk=";
+
+  separateDebugInfo = true;
+  __structuredAttrs = true;
+
+  nativeBuildInputs = [
+    just
+    libcosmicAppHook
+    rustPlatform.bindgenHook
+  ];
+
+  dontUseJustBuild = true;
+  dontUseJustCheck = true;
+
+  justFlags = [
+    "--set"
+    "prefix"
+    (placeholder "out")
+    "--set"
+    "cargo-target-dir"
+    "target/${stdenv.hostPlatform.rust.cargoShortTarget}"
+  ];
+
+  passthru = {
+    tests = {
+      inherit (nixosTests)
+        cosmic
+        cosmic-autologin
+        cosmic-noxwayland
+        cosmic-autologin-noxwayland
+        ;
+    };
+
+    updateScript = nix-update-script {
+      extraArgs = [
+        "--version-regex"
+        "epoch-(.*)"
+      ];
+    };
+  };
+
+  meta = {
+    homepage = "https://github.com/pop-os/cosmic-monitor";
+    description = "COSMIC System Monitor";
+    mainProgram = "cosmic-monitor";
+    license = lib.licenses.gpl3Only;
+    teams = [ lib.teams.cosmic ];
+    platforms = lib.platforms.linux;
+  };
+})

From 4cf191665b0b92406a67d9024c7f9c7c786f68df Mon Sep 17 00:00:00 2001
From: Salva <salva.hg01@gmail.com>
Date: Wed, 24 Jun 2026 01:34:24 -0600
Subject: [PATCH 36/66] cosmic-applets: deduplicate cosmic-settings-daemon
 sources

(cherry picked from commit ebdad0a6b428f19ad1054c209693f1d195c80a32)
---
 .../dedup-cosmic-settings-daemon.patch              | 13 +++++++++++++
 pkgs/by-name/co/cosmic-applets/package.nix          |  6 ++++++
 2 files changed, 19 insertions(+)
 create mode 100644 pkgs/by-name/co/cosmic-applets/dedup-cosmic-settings-daemon.patch

diff --git a/pkgs/by-name/co/cosmic-applets/dedup-cosmic-settings-daemon.patch b/pkgs/by-name/co/cosmic-applets/dedup-cosmic-settings-daemon.patch
new file mode 100644
index 000000000000..d800685e4c23
--- /dev/null
+++ b/pkgs/by-name/co/cosmic-applets/dedup-cosmic-settings-daemon.patch
@@ -0,0 +1,13 @@
+diff --git a/Cargo.lock b/Cargo.lock
+index bdd37740..c1adcfad 100644
+--- a/Cargo.lock
++++ b/Cargo.lock
+@@ -1514,7 +1514,7 @@ dependencies = [
+ [[package]]
+ name = "cosmic-settings-config"
+ version = "0.1.0"
+-source = "git+https://github.com/pop-os/cosmic-settings-daemon#fa82bdf9fe7b5f5bd6008f32f393efd5e7a71c47"
++source = "git+https://github.com/pop-os/cosmic-settings-daemon#e7936f0d4f01c8c5a436908c7ee9f6ad43e6a7d8"
+ dependencies = [
+  "cosmic-config",
+  "ron 0.11.0",
diff --git a/pkgs/by-name/co/cosmic-applets/package.nix b/pkgs/by-name/co/cosmic-applets/package.nix
index 7539b7dcbae7..3bf2a2fbc3e2 100644
--- a/pkgs/by-name/co/cosmic-applets/package.nix
+++ b/pkgs/by-name/co/cosmic-applets/package.nix
@@ -30,6 +30,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
     hash = "sha256-A8Qk9u3Q83Q4AjzTrdptfS9UNoyKq39YihC4d/dNBYc=";
   };
 
+  cargoPatches = [
+    # A different reference to the `cosmic-settings-daemon` crate was added
+    # Remove this patch once upstream fixes their lockfile.
+    ./dedup-cosmic-settings-daemon.patch
+  ];
+
   cargoHash = "sha256-81BFu13QmqOq43iN+ORQuktisEFYRrK+wd6diFfSufs=";
 
   separateDebugInfo = true;

From c4363c36c5c28878d3c741f640332c5d4c805bd4 Mon Sep 17 00:00:00 2001
From: Tom Herbers <mail@tomherbers.de>
Date: Fri, 26 Jun 2026 08:31:12 +0200
Subject: [PATCH 37/66] incus: 7.1.0 -> 7.2.0

Changelog: https://github.com/lxc/incus/releases/tag/v7.2.0

Advisories:
- https://github.com/lxc/incus/security/advisories/GHSA-48q5-w887-33wv (Critical)
- https://github.com/lxc/incus/security/advisories/GHSA-73hr-m85f-64v9 (Critical)
- https://github.com/lxc/incus/security/advisories/GHSA-vxp5-584q-c479 (Critical)
- https://github.com/lxc/incus/security/advisories/GHSA-2q3f-q5pq-g8wv (Critical)
- https://github.com/lxc/incus/security/advisories/GHSA-v6mj-8pf4-hhw4 (Critical)
- https://github.com/lxc/incus/security/advisories/GHSA-f6m5-xw2g-xc4x (Critical)
- https://github.com/lxc/incus/security/advisories/GHSA-c9f5-j9c3-mhrg (High)
- https://github.com/lxc/incus/security/advisories/GHSA-64f3-v33m-w89f (High)

(cherry picked from commit 387d5d25f4210a01ef9e51a4cfa6bae4ebf96405)
---
 pkgs/by-name/in/incus/generic.nix |  1 +
 pkgs/by-name/in/incus/package.nix | 14 ++++----------
 2 files changed, 5 insertions(+), 10 deletions(-)

diff --git a/pkgs/by-name/in/incus/generic.nix b/pkgs/by-name/in/incus/generic.nix
index d65be430f557..827280a10bab 100644
--- a/pkgs/by-name/in/incus/generic.nix
+++ b/pkgs/by-name/in/incus/generic.nix
@@ -121,6 +121,7 @@ buildGoModule (finalAttrs: {
   '';
 
   postBuild = ''
+    export HOME=$(mktemp -d)
     # build docs
     mkdir -p .sphinx/deps
     ln -s ${buildPackages.python3.pkgs.swagger-ui-bundle.src} .sphinx/deps/swagger-ui
diff --git a/pkgs/by-name/in/incus/package.nix b/pkgs/by-name/in/incus/package.nix
index 8ffc9f825563..8493e9b65d56 100644
--- a/pkgs/by-name/in/incus/package.nix
+++ b/pkgs/by-name/in/incus/package.nix
@@ -1,14 +1,8 @@
 import ./generic.nix {
-  hash = "sha256-g0YnvPMwk7WpYCl5VbRtHKVYoLlrk6QYhRaRRqulVQM=";
-  version = "7.1.0";
-  vendorHash = "sha256-VqvDrjdBTblqEOY/HtoKXGRAdoTJpSWxkmgJNNPw6eQ=";
-  patches = fetchpatch2: [
-    (fetchpatch2 {
-      name = "lxc-fix-environment-quoting.patch";
-      url = "https://github.com/lxc/incus/commit/a1276cdb57297245496ac8c1db76b90d1fcebd3b.patch?full_index=1";
-      hash = "sha256-NqEMYcDYx18KbqShKxmaK1o08c8/X4O87zXclQ36Ors=";
-    })
-  ];
+  hash = "sha256-GVCC0nV5Ghd9BroVC4ysqiTIQ3AtXIJ+EG6VbJVQBB4=";
+  version = "7.2.0";
+  vendorHash = "sha256-0lBMQXQEf+oYlvyoFV2VTpJbY+reavCJZQkzt9UbnaI=";
+  patches = fetchpatch2: [ ];
   nixUpdateExtraArgs = [
     "--override-filename=pkgs/by-name/in/incus/package.nix"
   ];

From ae8998ae019dc03532b22183aa34592a54235042 Mon Sep 17 00:00:00 2001
From: Tom Herbers <mail@tomherbers.de>
Date: Fri, 26 Jun 2026 08:48:25 +0200
Subject: [PATCH 38/66] incus-lts: backport 7.2 security fixes

(cherry picked from commit f1f19a90e66c7829957216c805f02849790462d9)
---
 pkgs/by-name/in/incus/lts.nix | 50 +++++++++++++++++++++++++++++++++++
 1 file changed, 50 insertions(+)

diff --git a/pkgs/by-name/in/incus/lts.nix b/pkgs/by-name/in/incus/lts.nix
index 830273a7c26f..2b0318ca1a25 100644
--- a/pkgs/by-name/in/incus/lts.nix
+++ b/pkgs/by-name/in/incus/lts.nix
@@ -99,6 +99,56 @@ import ./generic.nix {
       url = "https://github.com/lxc/incus/commit/a6012422b45c86f3b1956788cff5d75c604ad838.patch?full_index=1";
       hash = "sha256-u3NLKE8Rh8i6HMbJ0KNhH7gbuwIpJ1SPqiyVoiuw9Sc=";
     })
+    (fetchpatch2 {
+      name = "incusd-instances_Check-source-instance-access-on-copy.patch";
+      url = "https://github.com/lxc/incus/commit/1e3ffc53a10950e55de62ac1e0d612be597b84eb.patch?full_index=1";
+      hash = "sha256-1foxIu1rWcK1QbpmAPoQ46Tl1mrPvoctPnDhKRTWbd0=";
+    })
+    (fetchpatch2 {
+      name = "incusd-storage_Check-source-volume-access-on-copy.patch";
+      url = "https://github.com/lxc/incus/commit/2e01078366e2653712719dec82318e51c6d21b28.patch?full_index=1";
+      hash = "sha256-FP9v/8V0ZFLgy1tODKLJlw5f/6qJ8AMP/yme2YhYSaA=";
+    })
+    (fetchpatch2 {
+      name = "incusd-images_Validate-fingerprint-on-direct-download.patch";
+      url = "https://github.com/lxc/incus/commit/46d6ef232186df5535c49ca9f3597cab381f9b86.patch?full_index=1";
+      hash = "sha256-R8gsvdmb7KVC6W1vFH1CojzhrGNgNiFOOTYbCrDAajg=";
+    })
+    (fetchpatch2 {
+      name = "shared-validate_Reject-compression-algorithm-arguments.patch";
+      url = "https://github.com/lxc/incus/commit/873a032a461df6b09b7586435b592873863a4e88.patch?full_index=1";
+      hash = "sha256-QvxGxwHvswUZFst71zA12ZdxNIErl1LkaNyQdcPiglI=";
+    })
+    (fetchpatch2 {
+      name = "incusd-instance_Confine-template-access-to-instance-root.patch";
+      url = "https://github.com/lxc/incus/commit/cbefa31ae0da8fd96361178aed3a3c631e098fef.patch?full_index=1";
+      hash = "sha256-ZOHqnlIG6LyIUO6WP76SZJKTeqoiw9qj2YByGxqGP+E=";
+    })
+    (fetchpatch2 {
+      name = "incusd-instance_Enforce-project-restrictions-on-snapshot-restore.patch";
+      url = "https://github.com/lxc/incus/commit/3fe3bc99891940fcd3e758d49f65a853104fcd6b.patch?full_index=1";
+      hash = "sha256-j+lTbDaUjnZRY0lmaOSH4oKNAeIe5GXTwd1oM50it+Y=";
+    })
+    (fetchpatch2 {
+      name = "incusd-exec_Reject-exec-output-symlink.patch";
+      url = "https://github.com/lxc/incus/commit/e109655d642c7cb7c9039b7c06323000407f76dd.patch?full_index=1";
+      hash = "sha256-v/H12n8u+aqm9+ZxrarBxQEQSMN1gpX13oyummGWXl8=";
+    })
+    (fetchpatch2 {
+      name = "incusd_Reject-rootfs-symlink-for-instances.patch";
+      url = "https://github.com/lxc/incus/commit/7e58425ca7ffeb21bb116869e71a0d002dae9e72.patch?full_index=1";
+      hash = "sha256-MU+Khx+DhYQWUVs71D05PnJGamrhRXxsahtdXZeSfvU=";
+    })
+    (fetchpatch2 {
+      name = "shared-logger_Add-WarnOnError-helper.patch";
+      url = "https://github.com/lxc/incus/commit/1bc4d3feb8cd3bd005b7406c0d44ad3ea59400bf.patch?full_index=1";
+      hash = "sha256-ima4IGl0CyL30yZVdQ2pmp9SukIzrdBftGkO/GUPB3g=";
+    })
+    (fetchpatch2 {
+      name = "incus-0001-incusd-daemon_images-Add-missing-import.patch";
+      url = "https://raw.githubusercontent.com/zabbly/incus/a7fd42d2f5115c4e6893b23e64209db511fff828/patches/incus-0001-incusd-daemon_images-Add-missing-import.patch";
+      hash = "sha256-xtuuASy9bck+BgXbea9goNhrMV8Yme9cmFp4WNrkIdI=";
+    })
   ];
   nixUpdateExtraArgs = [
     "--version-regex=^v(7\\.0\\.[0-9]+)$"

From 10736c2cd31375237cf0e531d1f06b3fcf497741 Mon Sep 17 00:00:00 2001
From: Vincent Laporte <Vincent.Laporte@gmail.com>
Date: Thu, 25 Jun 2026 22:04:34 +0200
Subject: [PATCH 39/66] =?UTF-8?q?ocamlPackages.batteries:=203.10.0=20?=
 =?UTF-8?q?=E2=86=92=203.11.0?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

(cherry picked from commit eb6d0e7a2cdc5331edc30580399c75fc10b86c66)
---
 pkgs/development/ocaml-modules/batteries/default.nix | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/ocaml-modules/batteries/default.nix b/pkgs/development/ocaml-modules/batteries/default.nix
index 707c855b4944..adf0cfd38fd5 100644
--- a/pkgs/development/ocaml-modules/batteries/default.nix
+++ b/pkgs/development/ocaml-modules/batteries/default.nix
@@ -2,26 +2,23 @@
   lib,
   fetchFromGitHub,
   buildDunePackage,
-  ocaml,
   ounit,
   qtest,
   qcheck,
   num,
   camlp-streams,
-  doCheck ? lib.versionAtLeast ocaml.version "4.08",
+  doCheck ? true,
 }:
 
 buildDunePackage (finalAttrs: {
   pname = "batteries";
-  version = "3.10.0";
-
-  minimalOCamlVersion = "4.05";
+  version = "3.11.0";
 
   src = fetchFromGitHub {
     owner = "ocaml-batteries-team";
     repo = "batteries-included";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-cD0O4kEDE58yCYnUuS83O1CJNHJuCGVhvKJSKQeQGkc=";
+    hash = "sha256-RFozhk/kGgBg/2WnTYCNwi+kZwJ+l5o7z0YVons5yyw=";
   };
 
   nativeCheckInputs = [ qtest ];

From cf002d5b5c93647314466717b53750c1ee3a2a77 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 26 Jun 2026 14:10:58 +0000
Subject: [PATCH 40/66] proton-ge-bin: GE-Proton10-34 -> GE-Proton11-1

(cherry picked from commit 7292b09f57835fe53762127ef20a926b4c720e0c)
---
 pkgs/by-name/pr/proton-ge-bin/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/pr/proton-ge-bin/package.nix b/pkgs/by-name/pr/proton-ge-bin/package.nix
index fff2f46e3030..ec4f37eb44d3 100644
--- a/pkgs/by-name/pr/proton-ge-bin/package.nix
+++ b/pkgs/by-name/pr/proton-ge-bin/package.nix
@@ -9,11 +9,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "proton-ge-bin";
-  version = "GE-Proton10-34";
+  version = "GE-Proton11-1";
 
   src = fetchzip {
     url = "https://github.com/GloriousEggroll/proton-ge-custom/releases/download/${finalAttrs.version}/${finalAttrs.version}.tar.gz";
-    hash = "sha256-lzPsYYcrp5NoT3B0WFj3o10Z7tXx7xva1wEP3edeuqM=";
+    hash = "sha256-I7SSvzQQ/NqdvwjpJ9IFFtAaTS+rgHUyXx0us1vIOnw=";
   };
 
   dontUnpack = true;

From e3451ba38c99baced976160035cdffac8fa95b92 Mon Sep 17 00:00:00 2001
From: Ryan Omasta <git@ryand.ca>
Date: Thu, 25 Jun 2026 17:49:44 -0600
Subject: [PATCH 41/66] vencord: 1.14.13 -> 1.14.15

Diff: https://github.com/Vendicated/Vencord/compare/v1.14.13...v1.14.15
(cherry picked from commit 1ffc0e639c74ea9f3254eb3ac753f6b94c94bd7b)
---
 pkgs/by-name/ve/vencord/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/ve/vencord/package.nix b/pkgs/by-name/ve/vencord/package.nix
index 866e5c01d1b3..bb443fed5f0e 100644
--- a/pkgs/by-name/ve/vencord/package.nix
+++ b/pkgs/by-name/ve/vencord/package.nix
@@ -22,13 +22,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "vencord";
-  version = "1.14.13";
+  version = "1.14.15";
 
   src = fetchFromGitHub {
     owner = "Vendicated";
     repo = "Vencord";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Xqk/akTa/NcHjSm6h77y6Fkvq7ayBcR0w0HG0Hwfkf8=";
+    hash = "sha256-jQeLZa1rpKDkzWSpAqOa8snGRKLpv9xf9cwJ6hUwMzA=";
   };
 
   patches = [ ./fix-deps.patch ];
@@ -46,8 +46,8 @@ stdenv.mkDerivation (finalAttrs: {
       postPatch
       ;
     inherit pnpm;
-    fetcherVersion = 3;
-    hash = "sha256-hk1rnNog5xvuIVI0M1ZJ5xrEuk0zcBiYsbROUycdi+A=";
+    fetcherVersion = 4;
+    hash = "sha256-pm5f6bGm07pzNCqpDHRyKFnuX2ZTE5w9BtJu5xXPHiI=";
   };
 
   nativeBuildInputs = [

From 54e0bdd99d86ad96f3fdb901280d0be8db028cd7 Mon Sep 17 00:00:00 2001
From: Brian McGillion <bmg.avoin@gmail.com>
Date: Mon, 2 Feb 2026 11:37:17 +0400
Subject: [PATCH 42/66] sbsigntool: Fix cross-compilation

```
> Running phase: configurePhase
       > substituteStream() in derivation sbsigntool-aarch64-unknown-linux-gnu-0.9.5: WARNING: '--replace' is deprecated, use --replace-{fail,warn,quiet}. (file 'configure.ac')
       > lib/ccan.git/tools/create-ccan-tree: line 21: getopt: command not found
       > Usage: create-ccan-tree [options] <outdir> <depends>...
       >
       > options:
       >   -a, --copy-all         copy all files in module tree (not just sources
       >                    required for build)
       >   -b, --build-type=TYPE  generate build infrastructure of TYPE
       >                          (one of 'make', 'make+config', 'automake', 'waf')
       For full logs, run:
```
is the error before the changes to address the cross-compilation issues.

(cherry picked from commit abfe15ab4e7c0bf90a071d5bf59c21fc03db310f)
---
 pkgs/by-name/sb/sbsigntool/package.nix | 25 +++++++++++++++----------
 1 file changed, 15 insertions(+), 10 deletions(-)

diff --git a/pkgs/by-name/sb/sbsigntool/package.nix b/pkgs/by-name/sb/sbsigntool/package.nix
index e0b8a4451fd7..4721ada70681 100644
--- a/pkgs/by-name/sb/sbsigntool/package.nix
+++ b/pkgs/by-name/sb/sbsigntool/package.nix
@@ -10,6 +10,11 @@
   libuuid,
   gnu-efi,
   libbfd,
+  util-linux,
+  buildPackages,
+  deterministic-host-uname,
+  # help2man runs host executables
+  withMan ? stdenv.buildPlatform.canExecute stdenv.hostPlatform,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -31,6 +36,8 @@ stdenv.mkDerivation (finalAttrs: {
     automake
     pkg-config
     help2man
+    util-linux # for getopt used by create-ccan-tree
+    deterministic-host-uname # build system incorrectly uses uname to determine host CPU
   ];
   buildInputs = [
     openssl
@@ -39,27 +46,25 @@ stdenv.mkDerivation (finalAttrs: {
     gnu-efi
   ];
 
-  configurePhase = ''
-    runHook preConfigure
+  preConfigure = ''
+    substituteInPlace configure.ac --replace-fail "@@NIX_GNUEFI@@" "${gnu-efi}"
 
-    substituteInPlace configure.ac --replace "@@NIX_GNUEFI@@" "${gnu-efi}"
-
-    lib/ccan.git/tools/create-ccan-tree --build-type=automake lib/ccan "talloc read_write_all build_assert array_size endian"
+    CC=${lib.getExe buildPackages.stdenv.cc} lib/ccan.git/tools/create-ccan-tree --build-type=automake lib/ccan "talloc read_write_all build_assert array_size endian"
     touch AUTHORS
     touch ChangeLog
 
-    echo "SUBDIRS = lib/ccan src docs" >> Makefile.am
+    echo "SUBDIRS = lib/ccan src ${lib.optionalString withMan "docs"}" > Makefile.am
 
     aclocal
     autoheader
     autoconf
     automake --add-missing -Wno-portability
-
-    ./configure --prefix=$out
-
-    runHook postConfigure
   '';
 
+  makeFlags = [
+    "AR=${stdenv.cc.targetPrefix}ar"
+  ];
+
   meta = {
     description = "Tools for maintaining UEFI signature databases";
     homepage = "http://jk.ozlabs.org/docs/sbkeysync-maintaing-uefi-key-databases";

From 7feb3143a6df8f0f54eb26594618bda4fc2db511 Mon Sep 17 00:00:00 2001
From: Brian McGillion <bmg.avoin@gmail.com>
Date: Mon, 2 Feb 2026 11:40:09 +0400
Subject: [PATCH 43/66] efitools: Fix cross-compilation

Failing to build in a cross-compiled setup. these changes address that.

(cherry picked from commit c7d0f5d1100c75cbdd7b6c5238f4b76263226c8f)
---
 pkgs/by-name/ef/efitools/cross.patch | 89 ++++++++++++++++++++++++++++
 pkgs/by-name/ef/efitools/package.nix | 33 ++++++++++-
 2 files changed, 121 insertions(+), 1 deletion(-)
 create mode 100644 pkgs/by-name/ef/efitools/cross.patch

diff --git a/pkgs/by-name/ef/efitools/cross.patch b/pkgs/by-name/ef/efitools/cross.patch
new file mode 100644
index 000000000000..e1d853800b46
--- /dev/null
+++ b/pkgs/by-name/ef/efitools/cross.patch
@@ -0,0 +1,89 @@
+--- a/Make.rules
++++ b/Make.rules
+@@ -68,35 +68,35 @@ endif
+ %.h: %.auth
+ 	./xxdi.pl $< > $@
+ 
+-%.hash: %.efi hash-to-efi-sig-list
+-	./hash-to-efi-sig-list $< $@
++%.hash: %.efi
++	hash-to-efi-sig-list $< $@
+ 
+-%-blacklist.esl: %.crt cert-to-efi-hash-list
+-	./cert-to-efi-sig-list $< $@
++%-blacklist.esl: %.crt
++	cert-to-efi-sig-list $< $@
+ 
+-%-hash-blacklist.esl: %.crt cert-to-efi-hash-list
+-	./cert-to-efi-hash-list $< $@
++%-hash-blacklist.esl: %.crt
++	cert-to-efi-hash-list $< $@
+ 
+-%.esl: %.crt cert-to-efi-sig-list
+-	./cert-to-efi-sig-list -g $(MYGUID) $< $@
++%.esl: %.crt
++	cert-to-efi-sig-list -g $(MYGUID) $< $@
+ 
+ getcert = $(shell if [ "$(1)" = "PK" -o "$(1)" = "KEK" ]; then echo "-c PK.crt -k PK.key"; else echo "-c KEK.crt -k KEK.key"; fi)
+ getvar = $(shell if [ "$(1)" = "PK" -o "$(1)" = "KEK" ]; then echo $(1); else echo db; fi)
+ 
+-%.auth: %.esl PK.crt KEK.crt sign-efi-sig-list
+-	./sign-efi-sig-list $(call getcert,$*) $(call getvar,$*) $< $@
++%.auth: %.esl PK.crt KEK.crt
++	sign-efi-sig-list $(call getcert,$*) $(call getvar,$*) $< $@
+ 
+-%-update.auth: %.esl PK.crt KEK.crt sign-efi-sig-list
+-	./sign-efi-sig-list -a $(call getcert,$*) $(call getvar,$*) $< $@
++%-update.auth: %.esl PK.crt KEK.crt
++	sign-efi-sig-list -a $(call getcert,$*) $(call getvar,$*) $< $@
+ 
+-%-pkupdate.auth: %.esl PK.crt sign-efi-sig-list
+-	./sign-efi-sig-list -a -c PK.crt -k PK.key $(call getvar,$*) $< $@
++%-pkupdate.auth: %.esl PK.crt
++	sign-efi-sig-list -a -c PK.crt -k PK.key $(call getvar,$*) $< $@
+ 
+-%-blacklist.auth: %-blacklist.esl KEK.crt sign-efi-sig-list
+-	./sign-efi-sig-list -a -c KEK.crt -k KEK.key dbx $< $@
++%-blacklist.auth: %-blacklist.esl KEK.crt
++	sign-efi-sig-list -a -c KEK.crt -k KEK.key dbx $< $@
+ 
+-%-pkblacklist.auth: %-blacklist.esl PK.crt sign-efi-sig-list
+-	./sign-efi-sig-list -a -c PK.crt -k PK.key dbx $< $@
++%-pkblacklist.auth: %-blacklist.esl PK.crt
++	sign-efi-sig-list -a -c PK.crt -k PK.key dbx $< $@
+ 
+ %.o: %.c
+ 	$(CC) $(INCDIR) $(CFLAGS) $(CPPFLAGS) -c $< -o $@
+--- a/Makefile
++++ b/Makefile
+@@ -27,13 +27,11 @@ include Make.rules
+ 
+ EFISIGNED = $(patsubst %.efi,%-signed.efi,$(EFIFILES))
+ 
+-all: $(EFISIGNED) $(BINARIES) $(MANPAGES) noPK.auth $(KEYAUTH) \
++all: $(EFISIGNED) $(BINARIES) noPK.auth $(KEYAUTH) \
+ 	$(KEYUPDATEAUTH) $(KEYBLACKLISTAUTH) $(KEYHASHBLACKLISTAUTH)
+ 
+ 
+ install: all
+-	$(INSTALL) -m 755 -d $(MANDIR)
+-	$(INSTALL) -m 644 $(MANPAGES) $(MANDIR)
+ 	$(INSTALL) -m 755 -d $(EFIDIR)
+ 	$(INSTALL) -m 755 $(EFIFILES) $(EFIDIR)
+ 	$(INSTALL) -m 755 -d $(BINDIR)
+@@ -65,11 +63,11 @@ DB.h: DB.auth
+ noPK.esl:
+ 	> noPK.esl
+ 
+-noPK.auth: noPK.esl PK.crt sign-efi-sig-list
+-	./sign-efi-sig-list -t "$(shell date --date='1 second' +'%Y-%m-%d %H:%M:%S')" -c PK.crt -k PK.key PK $< $@
++noPK.auth: noPK.esl PK.crt
++	sign-efi-sig-list -t "$(shell date --date='1 second' +'%Y-%m-%d %H:%M:%S')" -c PK.crt -k PK.key PK $< $@
+ 
+-ms-%.esl: ms-%.crt cert-to-efi-sig-list
+-	./cert-to-efi-sig-list -g $(MSGUID) $< $@
++ms-%.esl: ms-%.crt
++	cert-to-efi-sig-list -g $(MSGUID) $< $@
+ 
+ hashlist.h: HashTool.hash
+ 	cat $^ > /tmp/tmp.hash
diff --git a/pkgs/by-name/ef/efitools/package.nix b/pkgs/by-name/ef/efitools/package.nix
index 89787fdb0bee..f3cc209c7d1f 100644
--- a/pkgs/by-name/ef/efitools/package.nix
+++ b/pkgs/by-name/ef/efitools/package.nix
@@ -8,7 +8,13 @@
   perlPackages,
   help2man,
   fetchzip,
+  pkgsCross,
+  efitools,
+  buildPackages,
 }:
+let
+  isCross = !(stdenv.buildPlatform.canExecute stdenv.hostPlatform);
+in
 stdenv.mkDerivation (finalAttrs: {
   pname = "efitools";
   version = "1.9.2";
@@ -16,13 +22,17 @@ stdenv.mkDerivation (finalAttrs: {
   buildInputs = [
     gnu-efi
     openssl
-    sbsigntool
   ];
 
   nativeBuildInputs = [
     perl
     perlPackages.FileSlurp
     help2man
+    openssl
+    sbsigntool
+  ]
+  ++ lib.optionals isCross [
+    efitools
   ];
 
   src = fetchzip {
@@ -39,6 +49,10 @@ stdenv.mkDerivation (finalAttrs: {
 
     # https://bugs.debian.org/1122408
     ./objcopy-output-target.patch
+  ]
+  ++ lib.optionals isCross [
+    # Use builder's efitools to create sig lists for host
+    ./cross.patch
   ];
 
   postPatch = ''
@@ -47,9 +61,26 @@ stdenv.mkDerivation (finalAttrs: {
     sed -i -e 's#$(DESTDIR)/usr#$(out)#g' Make.rules
     sed -i '$asign-efi-sig-list.o flash-var.o: CFLAGS += -D_GNU_SOURCE' Makefile
     substituteInPlace lib/console.c --replace "EFI_WARN_UNKOWN_GLYPH" "EFI_WARN_UNKNOWN_GLYPH"
+    # Fix cross-compilation: use $(AR) and $(NM) variables instead of hardcoded commands
+    substituteInPlace Make.rules --replace-fail 'ar rcv' '$(AR) rcv'
+    substituteInPlace Make.rules --replace-fail 'nm -D' '$(NM) -D'
     patchShebangs .
   '';
 
+  makeFlags = [
+    "ARCH=${stdenv.hostPlatform.parsed.cpu.name}"
+    "AR=${stdenv.cc.targetPrefix}ar"
+    "NM=${stdenv.cc.targetPrefix}nm"
+    "OBJCOPY=${stdenv.cc.targetPrefix}objcopy"
+  ]
+  ++ lib.optionals isCross [
+    "MANPAGES="
+  ];
+
+  passthru.tests = {
+    cross-aarch64 = pkgsCross.aarch64-multiplatform.efitools;
+  };
+
   meta = {
     description = "Tools for manipulating UEFI secure boot platforms";
     homepage = "https://git.kernel.org/pub/scm/linux/kernel/git/jejb/efitools.git";

From 4aa1553fe586c8800134da476d8b3e811e593316 Mon Sep 17 00:00:00 2001
From: JuliusFreudenberger <julius+git@jfreudenberger.de>
Date: Wed, 10 Jun 2026 12:04:04 +0200
Subject: [PATCH 44/66] teleport_17: 17.7.24 -> 17.7.25

Changelog: https://github.com/gravitational/teleport/releases/tag/v17.7.25
Diff: https://github.com/gravitational/teleport/compare/v17.7.24...v17.7.25
(cherry picked from commit 447718ce2f5a6a7bcf3297a45c3fd505b5512c5e)
---
 pkgs/by-name/te/teleport_17/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/te/teleport_17/package.nix b/pkgs/by-name/te/teleport_17/package.nix
index e70b5709bfeb..2cb02d9f5f87 100644
--- a/pkgs/by-name/te/teleport_17/package.nix
+++ b/pkgs/by-name/te/teleport_17/package.nix
@@ -7,11 +7,11 @@
 }:
 
 buildTeleport {
-  version = "17.7.24";
-  hash = "sha256-45vaxznxRfa4X/V7hZsQKVIWvbVG8F2cEQN19xp4WQg=";
+  version = "17.7.25";
+  hash = "sha256-IrelrkTvOBcTkO7cHf572MU5KkOQq3we53dgFsDCSRo=";
   vendorHash = "sha256-ERwCdWdp230wkqsRUCnd1hbO4PqXo+gDPsoGbxQqt04=";
-  cargoHash = "sha256-cDcDfptq8z0pwjImuAovv/5XwoaPb/ostyxkyNEbkRM=";
-  pnpmHash = "sha256-hk9DI3GSBm2XttCYCi5kjhEhUMm5ToRQcbT+RYI+S2Q=";
+  cargoHash = "sha256-BE/TBZoOaB3Th14E+t3qJ+0Uww56TtRA1sRQ+usFo+Y=";
+  pnpmHash = "sha256-TARwHswSWbKk2eoyynuaOm7pvt2CwbjtklqnM+9/YXM=";
 
   wasm-bindgen-cli = wasm-bindgen-cli_0_2_95;
   inherit buildGoModule withRdpClient extPatches;

From fe447ad91fe2f4fd6fd7bfb4fce089e2746969dc Mon Sep 17 00:00:00 2001
From: JuliusFreudenberger <julius+git@jfreudenberger.de>
Date: Mon, 22 Jun 2026 18:26:06 +0200
Subject: [PATCH 45/66] teleport_18: 18.8.3 -> 18.9.1

Changelogs:
- https://github.com/gravitational/teleport/releases/tag/v18.9.0
- https://github.com/gravitational/teleport/releases/tag/v18.9.1
Diff: https://github.com/gravitational/teleport/compare/v18.8.3...v18.9.1

(cherry picked from commit 4deabafaf9102995cdc3df300c57fa33d12bb77e)
---
 pkgs/by-name/te/teleport_18/package.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/te/teleport_18/package.nix b/pkgs/by-name/te/teleport_18/package.nix
index 71fb509ee77e..bb5fb0572db2 100644
--- a/pkgs/by-name/te/teleport_18/package.nix
+++ b/pkgs/by-name/te/teleport_18/package.nix
@@ -7,11 +7,11 @@
 }:
 
 buildTeleport {
-  version = "18.8.3";
-  hash = "sha256-DHPOWIvzBCOT3GU0YHBtG46ctB0Nh8XwSmpl9vgCET8=";
-  vendorHash = "sha256-0+fIoprAQyoom9xBpXGiEgmE4dWktcqlZQOzkRXYlKo=";
-  pnpmHash = "sha256-8FlC9Sm12A5kfS9X0qYDNJOePZjeJU7LDTRlWUIEneA=";
-  cargoHash = "sha256-IX0HCeCosXCe/oTYa8PImemf9op2AeagSnl44uBnSbM=";
+  version = "18.9.1";
+  hash = "sha256-FIPExc8tMoPXfWc7pQjwQRkxmiQEOxdkYgWS0GejQuk=";
+  vendorHash = "sha256-BlQhypAoK85ID0pgmXbUboks88qjSg3p5E8qxyTIc9M=";
+  pnpmHash = "sha256-ZGbuBMPwC3u/2qDTVLH2InOGVc94Vq0i3AKHMsOwq3k=";
+  cargoHash = "sha256-KbmacTEOElmboHMK6YxWGC0brlDsX7kcvpaOOZmuops=";
 
   wasm-bindgen-cli = wasm-bindgen-cli_0_2_99;
   buildGoModule = buildGo125Module;

From ccfb602b885b3c752f81338dcabeae0e2eece464 Mon Sep 17 00:00:00 2001
From: Mathtician <mathtician@gmail.com>
Date: Thu, 11 Jun 2026 00:30:46 -0500
Subject: [PATCH 46/66] discord: recreate module symlinks on every launch

As of commit b49b623a ("discord: use distro layout for stable on Linux", PR #515876),
Discord's launch script runs a `discord-stage-modules` script defined in `linux.nix`,
which creates symlinks from `~/.config/discord/<version>/modules/<module_name>`
to the corresponding Nix store paths so Discord can find them.
It checks whether this has already been done by looking for `installed.json` in the same dir,
which it also creates, and skips link creation if so.
However, since the dir is indexed by Discord version number,
the links are not refreshed when opening a new build of Discord with the same version number as an older build.
If the old build is then GC'd, the links break and Discord fails to start
with an error such as `Cannot find module 'discord_desktop_core'`.
Deleting the module folder entirely allows for it to be recreated and for Discord to start without issue.
This problem and solution are attested on the wiki, albeit with less explanation:
https://wiki.nixos.org/wiki/Discord#Crash_on_start-up.
The package fix is to delete and recreate the `modules` folder on each launch,
as it is small and does not contain any data meant to persist between launches:
it has only the module links, `installed.json`, and a `pending/` download directory
recreated by Discord's updater on startup.
The fix ensures that the links always point to the Nix store of the build of Discord being run,
so they will not be broken by GC.

Assisted-by: Claude Fable 5 in Claude Code
(cherry picked from commit 8f5437cf20d11ed4da6d78e140c4ef303eadcc7e)
---
 .../instant-messengers/discord/linux.nix          | 15 +++++++--------
 1 file changed, 7 insertions(+), 8 deletions(-)

diff --git a/pkgs/applications/networking/instant-messengers/discord/linux.nix b/pkgs/applications/networking/instant-messengers/discord/linux.nix
index 51bdeadd412e..e6f62c4c729f 100644
--- a/pkgs/applications/networking/instant-messengers/discord/linux.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/linux.nix
@@ -152,14 +152,13 @@ let
   stageModules = writeShellScript "discord-stage-modules" ''
     store_modules="$1"
     modules_dir="''${XDG_CONFIG_HOME:-$HOME/.config}/${lib.toLower binaryName}/${version}/modules"
-    if [ ! -f "$modules_dir/installed.json" ]; then
-      mkdir -p "$modules_dir"
-      for m in ${lib.concatStringsSep " " (lib.attrNames moduleSrcs)}; do
-        ln -sfn "$store_modules/$m" "$modules_dir/$m"
-      done
-      echo '${builtins.toJSON (lib.mapAttrs (_: mod: { installedVersion = mod; }) moduleVersions)}' \
-        > "$modules_dir/installed.json"
-    fi
+    rm -rf "$modules_dir"
+    mkdir -p "$modules_dir"
+    for m in ${lib.concatStringsSep " " (lib.attrNames moduleSrcs)}; do
+      ln -sn "$store_modules/$m" "$modules_dir/$m"
+    done
+    echo '${builtins.toJSON (lib.mapAttrs (_: mod: { installedVersion = mod; }) moduleVersions)}' \
+      > "$modules_dir/installed.json"
   '';
 
   disableBreakingUpdates =

From 5db1641a3ddfb8a5788879dbc2698dbc1535f8da Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 26 Jun 2026 19:57:38 -0700
Subject: [PATCH 47/66] pnpm_10_29_2: mark insecure

(cherry picked from commit 2e0bb4a32507eaea76d2a1044337101ddbc4ee9c)
---
 pkgs/development/tools/pnpm/default.nix | 10 ++++++++++
 pkgs/development/tools/pnpm/generic.nix |  2 ++
 2 files changed, 12 insertions(+)

diff --git a/pkgs/development/tools/pnpm/default.nix b/pkgs/development/tools/pnpm/default.nix
index f81d2861f3eb..4339c86d09cb 100644
--- a/pkgs/development/tools/pnpm/default.nix
+++ b/pkgs/development/tools/pnpm/default.nix
@@ -20,6 +20,15 @@ let
     "10_29_2" = {
       version = "10.29.2";
       hash = "sha256-hAL2daH0zJ1PJ7v6s1wtSi4dfrATHfA9rQlhnoZnTQw=";
+      knownVulnerabilities = [
+        "CVE-2026-48995"
+        "CVE-2026-50014"
+        "CVE-2026-50015"
+        "CVE-2026-50016"
+        "CVE-2026-50017"
+        "CVE-2026-50573"
+        "CVE-2026-55699"
+      ];
     };
     "10" = {
       version = "10.34.0";
@@ -35,6 +44,7 @@ let
     variant:
     callPackage ./generic.nix {
       inherit (variant) version hash;
+      knownVulnerabilities = variant.knownVulnerabilities or [ ];
       #FIXME: remove this hack in a future version.
       nodejs = null; # Passing null to detect out-of-tree overrides
     };
diff --git a/pkgs/development/tools/pnpm/generic.nix b/pkgs/development/tools/pnpm/generic.nix
index 2e2a6ddffcb0..f3cdc920f26d 100644
--- a/pkgs/development/tools/pnpm/generic.nix
+++ b/pkgs/development/tools/pnpm/generic.nix
@@ -17,6 +17,7 @@
   withNode ? true,
   version,
   hash,
+  knownVulnerabilities,
 }:
 let
   majorVersion = lib.versions.major version;
@@ -170,5 +171,6 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     ];
     platforms = lib.platforms.all;
     mainProgram = "pnpm";
+    inherit knownVulnerabilities;
   };
 })

From 973fdacdd67c3defb1e6d56c715cc5f4e6fdd02a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 27 Jun 2026 02:59:57 +0000
Subject: [PATCH 48/66] calibre: 9.9.0 -> 9.10.0

(cherry picked from commit 7d1088918c897f20ea27b93832157662a107761d)
---
 pkgs/by-name/ca/calibre/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ca/calibre/package.nix b/pkgs/by-name/ca/calibre/package.nix
index 255cbfcf7484..a0e277f5221a 100644
--- a/pkgs/by-name/ca/calibre/package.nix
+++ b/pkgs/by-name/ca/calibre/package.nix
@@ -40,11 +40,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "calibre";
-  version = "9.9.0";
+  version = "9.10.0";
 
   src = fetchurl {
     url = "https://download.calibre-ebook.com/${finalAttrs.version}/calibre-${finalAttrs.version}.tar.xz";
-    hash = "sha256-ozwoRlJThVLiFmaR0fXdfxLDTEF4935rQGLZ+MzwXLk=";
+    hash = "sha256-U7iid8dm5sP7Xfsm+ikRn0oSm/j5qVS0I1qWPIowwwE=";
   };
 
   patches =

From d5d2b8a6ef08c1a043884e5364bcfee2f492a5c1 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 17 Jun 2026 22:37:26 +0000
Subject: [PATCH 49/66] glances: 4.5.4 -> 4.5.5

(cherry picked from commit fd0f657b01b5cb3b9841641b932bf9737149cd44)
---
 pkgs/by-name/gl/glances/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/gl/glances/package.nix b/pkgs/by-name/gl/glances/package.nix
index 8c01c74e54da..ff407aa954f0 100644
--- a/pkgs/by-name/gl/glances/package.nix
+++ b/pkgs/by-name/gl/glances/package.nix
@@ -11,7 +11,7 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "glances";
-  version = "4.5.4";
+  version = "4.5.5";
   pyproject = true;
 
   disabled = python3Packages.isPyPy;
@@ -20,7 +20,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     owner = "nicolargo";
     repo = "glances";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-oIuvVI1vXPrtJjWie/iDoCBM++Z7i4IQ5DPE6Yi3npA=";
+    hash = "sha256-RiAt797YS468lmwH68O9/KlbV46DAqd25O8J0wNIDsU=";
   };
 
   build-system = with python3Packages; [ setuptools ];

From fb60282eec1a262419e28a6070f6d2d1d1ea13aa Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 27 Jun 2026 02:28:52 +0000
Subject: [PATCH 50/66] gren: 0.6.5 -> 0.6.6

(cherry picked from commit a9c1e5762a19d40610038140f3a549c53cdfdce5)
---
 pkgs/by-name/gr/gren/generated-backend-package.nix | 8 ++++----
 pkgs/by-name/gr/gren/package.nix                   | 4 ++--
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/pkgs/by-name/gr/gren/generated-backend-package.nix b/pkgs/by-name/gr/gren/generated-backend-package.nix
index 6ff48bab9b53..a097c4ec8656 100644
--- a/pkgs/by-name/gr/gren/generated-backend-package.nix
+++ b/pkgs/by-name/gr/gren/generated-backend-package.nix
@@ -29,11 +29,11 @@
 }:
 mkDerivation {
   pname = "gren";
-  version = "0.6.5";
+  version = "0.6.6";
   src = fetchgit {
     url = "https://github.com/gren-lang/compiler.git";
-    sha256 = "1865x63y0kcp2ax49333i5512vwh845iiyq3b30jm31pr113csvr";
-    rev = "ba2a2153b78086d75fe01ba45bdd630d6f5fc2fc";
+    sha256 = "02hin22kyh2zgxn2fklnfa60iw3ppfr3xnv4z7r39vkf6c2q7fhq";
+    rev = "03c52374f82036e7a3276a94e345a4aa98738b9b";
     fetchSubmodules = true;
   };
   isLibrary = false;
@@ -83,6 +83,6 @@ mkDerivation {
   jailbreak = true;
   homepage = "https://gren-lang.org";
   description = "The `gren` command line interface";
-  license = lib.licensesSpdx."BSD-3-Clause";
+  license = lib.meta.getLicenseFromSpdxId "BSD-3-Clause";
   mainProgram = "gren";
 }
diff --git a/pkgs/by-name/gr/gren/package.nix b/pkgs/by-name/gr/gren/package.nix
index 84ad7637623c..69af8be0e155 100644
--- a/pkgs/by-name/gr/gren/package.nix
+++ b/pkgs/by-name/gr/gren/package.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gren";
-  version = "0.6.5";
+  version = "0.6.6";
 
   src = fetchFromGitHub {
     owner = "gren-lang";
     repo = "compiler";
     tag = finalAttrs.version;
-    hash = "sha256-eWs2Qsg3jCrBWAP7GAtBkG8RSoljjES6EpdN4IfpxaA=";
+    hash = "sha256-GLqDBTNu7jTy+WTbPrK7d/AIjHKWTidsf19AP4WwEQo=";
   };
 
   buildInputs = [ nodejs ];

From ff710ddefb8ed080effd887ee367fb2f30780787 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 26 Jun 2026 20:02:48 +0000
Subject: [PATCH 51/66] kicad-small: 10.0.3 -> 10.0.4

(cherry picked from commit d9f90851b8997ee51b72390b76bff09753c84f54)
---
 pkgs/by-name/ki/kicad/versions.nix | 22 +++++++++++-----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/pkgs/by-name/ki/kicad/versions.nix b/pkgs/by-name/ki/kicad/versions.nix
index 24a323e95c2c..0c88252975ea 100644
--- a/pkgs/by-name/ki/kicad/versions.nix
+++ b/pkgs/by-name/ki/kicad/versions.nix
@@ -3,23 +3,23 @@
 {
   "kicad" = {
     kicadVersion = {
-      version = "10.0.3";
+      version = "10.0.4";
       src = {
-        rev = "1d69e55fc60915f8f1569c9f6522d9b0fb5a0ba8";
-        sha256 = "0ldaj072x16452xw2wszbk20g932rz36zappjrxc4m6ygx298aa3";
+        rev = "314f59e84469aa2db16a36740c891781c8a09fd8";
+        sha256 = "1dp2rcblpz1i5hzrv5kb7cq91agha5msm2slhny3gf8x0gbzmawq";
       };
     };
     libVersion = {
-      version = "10.0.3";
+      version = "10.0.4";
       libSources = {
-        symbols.rev = "299c330ab364cfc3989d1ab6e82f1eabb9ddd915";
-        symbols.sha256 = "05h8dbygch2kp4s5ikspxngwv999j7jwsiwm4pzwwcrir7dqzdfl";
-        templates.rev = "a7e1a3ae6255d8d9aaff13e58adf3a0d78cb90c9";
+        symbols.rev = "5a6700bbb3f2a3b05d123a1a1af770cfbb5bc7d3";
+        symbols.sha256 = "1ns0lg360h3h55w2xv5lyj0qzy6nc1cr02vll95c0vma34rc1qwa";
+        templates.rev = "32bcda122df6ae76b221155c641de3656904e786";
         templates.sha256 = "0zs29zn8qjgxv0w1vyr8yxmj02m8752zagn4vcraqgik46dwg2id";
-        footprints.rev = "fe0ca39d34a10036f2b6ccb9749a39bc3fa7af95";
-        footprints.sha256 = "0wdzsn7z11wc5yskk576a4a6qfagsvw0y6r034inxrnfc32aiah9";
-        packages3d.rev = "c955b94c7bdeffd94b06bac86d94588a9be03afe";
-        packages3d.sha256 = "01nbjcs3890hyfmafc623ldmfi9n8sjr5m0wripz5fq5fjdnzqxl";
+        footprints.rev = "12095f926a3c5c37d9573ebab0c67c9eed71812f";
+        footprints.sha256 = "15cz4lh6dzqdl2cc9nqnpa8bd73h5p33vnvmc4l68js5wqlsyba1";
+        packages3d.rev = "9484cb1a4e193898c3f86e0cf69146bcc6e8053d";
+        packages3d.sha256 = "0mkc9km540n6ri5is4fjw5abv8afidwj9q7fmbs66l6kx1z3lxky";
       };
     };
   };

From ca7ea526c7ba7fc7a346f680a694979f9ac80627 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Gutyina=20Gerg=C5=91?= <gutyina.gergo.2@gmail.com>
Date: Fri, 26 Jun 2026 15:11:33 +0200
Subject: [PATCH 52/66] feishin: pnpm_10_29_2 -> pnpm_10

(cherry picked from commit 407aea00ffb74fe4e07eab4dd433c021a072ac3f)
---
 pkgs/by-name/fe/feishin/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/fe/feishin/package.nix b/pkgs/by-name/fe/feishin/package.nix
index 4e2f82063d42..f8a1a7ee214c 100644
--- a/pkgs/by-name/fe/feishin/package.nix
+++ b/pkgs/by-name/fe/feishin/package.nix
@@ -8,7 +8,7 @@
   mpv-unwrapped,
   fetchPnpmDeps,
   pnpmConfigHook,
-  pnpm_10_29_2,
+  pnpm_10,
   darwin,
   actool,
   copyDesktopItems,
@@ -42,7 +42,7 @@ buildNpmPackage {
       version
       src
       ;
-    pnpm = pnpm_10_29_2;
+    pnpm = pnpm_10;
     fetcherVersion = 3;
     hash = "sha256-zNOGJ24G0xcgsGK4DmbBm7d1PHTp7IJS+RTALGRtfDg=";
   };
@@ -50,7 +50,7 @@ buildNpmPackage {
   env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
 
   nativeBuildInputs = [
-    pnpm_10_29_2
+    pnpm_10
   ]
   ++ lib.optionals (stdenv.hostPlatform.isLinux) [ copyDesktopItems ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [

From 6438b08f33575458f12b4ccb23a74705d9a3e242 Mon Sep 17 00:00:00 2001
From: Jappie3 <jappie3+git@jappie.dev>
Date: Sat, 30 May 2026 20:14:57 +0200
Subject: [PATCH 53/66] nixos/dovecot: order non-attrs values first in rendered
 config

Co-authored-by: Katalin Rebhan <me@dblsaiko.net>
(cherry picked from commit baf28478fc0be6d3f5b9f12a1d4eaa60786bd434)
---
 nixos/modules/services/mail/dovecot.nix | 107 ++++++++++++++----------
 1 file changed, 61 insertions(+), 46 deletions(-)

diff --git a/nixos/modules/services/mail/dovecot.nix b/nixos/modules/services/mail/dovecot.nix
index 2c00b3ee6529..48b0795c53c1 100644
--- a/nixos/modules/services/mail/dovecot.nix
+++ b/nixos/modules/services/mail/dovecot.nix
@@ -7,7 +7,6 @@
 
 let
   inherit (lib)
-    all
     attrsToList
     concatMapStringsSep
     concatStringsSep
@@ -19,7 +18,6 @@ let
     isBool
     isDerivation
     isInt
-    isList
     isPath
     isString
     listToAttrs
@@ -98,53 +96,67 @@ let
     i: n: v:
     "${i}${toString n} = ${v}";
 
-  formatKeyValue =
-    indent: n: v:
-    if (v == null) then
-      ""
-    else if isInt v then
-      toOption indent n (toString v)
+  isPrimitive = v: !isAttrs v || isDerivation v;
+
+  formatPrimitive =
+    v:
+    if isInt v then
+      toString v
     else if isBool v then
-      toOption indent n (yesOrNo v)
+      yesOrNo v
     else if isString v then
-      toOption indent n v
-    else if isList v then
-      if all isString v then
-        toOption indent n (concatStringsSep " " v)
-      else
-        map (formatKeyValue indent n) v
+      v
     else if isPath v || isDerivation v then
       # paths -> copy to store
       # derivations -> just use output path instead of looping over the attrs
-      toOption indent n "${v}"
-    else if isAttrs v && v ? _section then
-      let
-        sectionType = v._section.type;
-        sectionName = v._section.name;
-        sectionTitle = concatStringsSep " " (
-          filter (s: s != null) [
-            sectionType
-            sectionName
-          ]
-        );
-      in
-      concatStringsSep "\n" (
-        [
-          "${indent}${sectionTitle} {"
-        ]
-        ++ (mapAttrsToList (formatKeyValue "${indent}  ") (removeAttrs v [ "_section" ]))
-        ++ [ "${indent}}" ]
-      )
-    else if isAttrs v then
-      concatStringsSep "\n" (
-        [
-          "${indent}${n} {"
-        ]
-        ++ (mapAttrsToList (formatKeyValue "${indent}  ") v)
-        ++ [ "${indent}}" ]
-      )
+      "${v}"
     else
-      throw (traceSeq v "services.dovecot2.settings: unexpected type");
+      throw (traceSeq v "services.dovecot2.settings: unexpected primitive type");
+
+  formatSection =
+    indent: n: v:
+    let
+      sectionTitle =
+        if v ? _section then
+          concatStringsSep " " (
+            filter (s: s != null) [
+              v._section.type
+              v._section.name
+            ]
+          )
+        else
+          n;
+      inner = removeAttrs v [ "_section" ];
+    in
+    concatStringsSep "\n" (
+      [ "${indent}${sectionTitle} {" ]
+      ++ flatten (mapAttrsToList (primitiveLinesFor "${indent}  ") inner)
+      ++ flatten (mapAttrsToList (sectionLinesFor "${indent}  ") inner)
+      ++ [ "${indent}}" ]
+    );
+
+  # emit lines for a k=v pair only when the value is a primitive
+  primitiveLinesFor =
+    indent: n: v:
+    let
+      primitives = filter isPrimitive (flatten [ v ]);
+      hasOnlySections = primitives == [ ] && v != [ ];
+    in
+    # Only emit an empty list if the original entry was also an empty list.
+    # This is so that values like k = [{ ... }] will not produce an output
+    # here, but k = [] will, even though they result in the same
+    # primitives = [].
+    optional (!hasOnlySections && v != null) (
+      toOption indent n (concatMapStringsSep " " formatPrimitive primitives)
+    );
+
+  # emit lines for a k=v pair only when the value is *not* a primitive
+  sectionLinesFor =
+    indent: n: v:
+    let
+      sections = filter (e: !isPrimitive e) (flatten [ v ]);
+    in
+    map (e: formatSection indent n e) sections;
 
   doveConf =
     let
@@ -156,10 +168,13 @@ let
       ];
     in
     concatStringsSep "\n" (
-      optional (configVersion != null) (formatKeyValue "" "dovecot_config_version" configVersion)
-      ++ optional (storageVersion != null) (formatKeyValue "" "dovecot_storage_version" storageVersion)
+      optionals (configVersion != null) (primitiveLinesFor "" "dovecot_config_version" configVersion)
+      ++ optionals (storageVersion != null) (
+        primitiveLinesFor "" "dovecot_storage_version" storageVersion
+      )
       ++ optionals (cfg.includeFiles != [ ]) (map (f: "!include ${f}") cfg.includeFiles)
-      ++ flatten (mapAttrsToList (formatKeyValue "") remainingSettings)
+      ++ flatten (mapAttrsToList (primitiveLinesFor "") remainingSettings)
+      ++ flatten (mapAttrsToList (sectionLinesFor "") remainingSettings)
     );
 
   isPre24 = versionOlder cfg.package.version "2.4";

From 113d57e664c407cbd24ec7e54571aea97943f504 Mon Sep 17 00:00:00 2001
From: kuflierl <41301536+kuflierl@users.noreply.github.com>
Date: Wed, 27 May 2026 15:43:19 +0200
Subject: [PATCH 54/66] memos: finalAttrs

(cherry picked from commit 0e4d6b540198500724fe55adcf11067dcd7241d5)
---
 pkgs/by-name/me/memos/package.nix | 28 +++++++++++-----------------
 1 file changed, 11 insertions(+), 17 deletions(-)

diff --git a/pkgs/by-name/me/memos/package.nix b/pkgs/by-name/me/memos/package.nix
index bd2ee2ad634d..c049708ddf03 100644
--- a/pkgs/by-name/me/memos/package.nix
+++ b/pkgs/by-name/me/memos/package.nix
@@ -11,22 +11,24 @@
 }:
 let
   pnpm = pnpm_10;
-
+in
+buildGoModule (finalAttrs: {
+  pname = "memos";
   version = "0.25.3";
   src = fetchFromGitHub {
     owner = "usememos";
     repo = "memos";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
     hash = "sha256-lAKzPteGjGa7fnbB0Pm3oWId5DJekbVWI9dnPEGbiBo=";
   };
 
-  memos-web = stdenvNoCC.mkDerivation (finalAttrs: {
+  memos-web = stdenvNoCC.mkDerivation (finalWebAttrs: {
     pname = "memos-web";
-    inherit version src;
+    inherit (finalAttrs) version src;
     pnpmDeps = fetchPnpmDeps {
-      inherit (finalAttrs) pname version src;
+      inherit (finalWebAttrs) pname version src;
       inherit pnpm;
-      sourceRoot = "${finalAttrs.src.name}/web";
+      sourceRoot = "${finalWebAttrs.src.name}/web";
       fetcherVersion = 3;
       hash = "sha256-xEOnxCgBD4uLypcZzCO+31S4r0sSfz8PpgEmZASeRZ4=";
     };
@@ -47,20 +49,12 @@ let
       runHook postInstall
     '';
   });
-in
-buildGoModule {
-  pname = "memos";
-  inherit
-    version
-    src
-    memos-web
-    ;
 
   vendorHash = "sha256-BoJxFpfKS/LByvK4AlTNc4gA/aNIvgLzoFOgyal+aF8=";
 
   preBuild = ''
     rm -rf server/router/frontend/dist
-    cp -r ${memos-web} server/router/frontend/dist
+    cp -r ${finalAttrs.memos-web} server/router/frontend/dist
   '';
 
   passthru.updateScript = nix-update-script {
@@ -73,7 +67,7 @@ buildGoModule {
   meta = {
     homepage = "https://usememos.com";
     description = "Lightweight, self-hosted memo hub";
-    changelog = "https://github.com/usememos/memos/releases/tag/${src.rev}";
+    changelog = "https://github.com/usememos/memos/releases/tag/${finalAttrs.src.rev}";
     maintainers = with lib.maintainers; [
       indexyz
       kuflierl
@@ -81,4 +75,4 @@ buildGoModule {
     license = lib.licenses.mit;
     mainProgram = "memos";
   };
-}
+})

From f7b833a5ccc89af37bbc6cf9425748b98d2126b4 Mon Sep 17 00:00:00 2001
From: uku <hi@uku.moe>
Date: Sat, 13 Jun 2026 20:04:15 +0200
Subject: [PATCH 55/66] memos: set version in go code

This fixes apps like Moe Memos which rely on the server properly
advertising its version (via the /api/v1/instance/profile endpoint)

(cherry picked from commit 82ba60cac5a8cc84d3d45a5ef3df243fd6b58da0)
---
 pkgs/by-name/me/memos/package.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/by-name/me/memos/package.nix b/pkgs/by-name/me/memos/package.nix
index c049708ddf03..f772102b70a4 100644
--- a/pkgs/by-name/me/memos/package.nix
+++ b/pkgs/by-name/me/memos/package.nix
@@ -52,6 +52,10 @@ buildGoModule (finalAttrs: {
 
   vendorHash = "sha256-BoJxFpfKS/LByvK4AlTNc4gA/aNIvgLzoFOgyal+aF8=";
 
+  ldflags = [
+    "-X github.com/usememos/memos/internal/version.Version=${finalAttrs.version}"
+  ];
+
   preBuild = ''
     rm -rf server/router/frontend/dist
     cp -r ${finalAttrs.memos-web} server/router/frontend/dist

From 17fd66ced4bcd7e0f8f202b5af208c4221e3ad9f Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 27 Jun 2026 10:46:10 +0000
Subject: [PATCH 56/66] protoc-gen-grpc-java: 1.81.0 -> 1.82.1

(cherry picked from commit 8d8350a77bfeef2d6915648c438ffd96a7bc6aa5)
---
 pkgs/by-name/pr/protoc-gen-grpc-java/data.nix | 20 +++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/pkgs/by-name/pr/protoc-gen-grpc-java/data.nix b/pkgs/by-name/pr/protoc-gen-grpc-java/data.nix
index 0274f88a3c0a..694bd75a468d 100644
--- a/pkgs/by-name/pr/protoc-gen-grpc-java/data.nix
+++ b/pkgs/by-name/pr/protoc-gen-grpc-java/data.nix
@@ -1,14 +1,14 @@
 {
-  version = "1.81.0";
+  version = "1.82.1";
   hashes = {
-    linux-aarch_64 = "sha256-BhO92wlj0L3M8H4CGuB4NRZkjN9zPuFM/E2NAkn6d1o=";
-    linux-ppcle_64 = "sha256-Y1YC+C/AxdYiB7gcaerVhE383+8rPOiEI8+r/BxkeXk=";
-    linux-s390_64 = "sha256-cVjZl+ju8e+yroYOttrgIBGSBWDPw1jz1dOLdr58Bmc=";
-    linux-x86_32 = "sha256-I10buzyicR0aVI3BKDvtly6NwfjSP2hLOD1eY5NJFZc=";
-    linux-x86_64 = "sha256-T3WWxgoTdSS1TysR2Vb6IA8/6XZ43hzd2CfRCVQlD30=";
-    osx-aarch_64 = "sha256-c359UvEa+J85KV6KFOXMuUWCYmyB5VkTfmLfj8J81qQ=";
-    osx-x86_64 = "sha256-c359UvEa+J85KV6KFOXMuUWCYmyB5VkTfmLfj8J81qQ=";
-    windows-x86_32 = "sha256-mMRY0dLrPpLcQUeK5GqeOrBFqlghBC7FgqqoRWHdjYs=";
-    windows-x86_64 = "sha256-18mnbuYxoqnQLYHPWC2m2+TW5pJmX/O2OkQLG5xyND0=";
+    linux-aarch_64 = "sha256-VTDKjBMzFj5CocdqK1EEIOBsdTIckXMrNGOlRyByCc8=";
+    linux-ppcle_64 = "sha256-/NCzmrhbTDaYhJBntW6n6yA5tvtsvdVldMlK7WfV6RY=";
+    linux-s390_64 = "sha256-Bk83rw8iGsniyNcivgQRjx/GOWB0kv4Wo01b4YTG0Pk=";
+    linux-x86_32 = "sha256-Ai7h2w1ZGWlS/tAdiT/dpd6wt3VM4rpPiQuv5rDbfCY=";
+    linux-x86_64 = "sha256-OnXRqIuP5E9KHVy48ixz+PzI1WOu2QV/9epISyLNry8=";
+    osx-aarch_64 = "sha256-hm3WySlSQu/J5rg8pWlpOStcPnODqn1b7pKL1N5CkSQ=";
+    osx-x86_64 = "sha256-hm3WySlSQu/J5rg8pWlpOStcPnODqn1b7pKL1N5CkSQ=";
+    windows-x86_32 = "sha256-CWZAubE98Aftf7Mjd2caROxsWSxS+JQGf4YB+FEwiwo=";
+    windows-x86_64 = "sha256-XmhjMhJ/djRizOkSh+i7PtZn2RL9jVV5PcBkgwpYw0o=";
   };
 }

From 2e542f016565ab8013e1f4a3193940fcc8fb3501 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Sat, 27 Jun 2026 11:45:19 +0200
Subject: [PATCH 57/66] perlPackages.BytesRandomSecureTiny: add patch for
 CVE-2026-11702

(cherry picked from commit 78581b87cd0b96d2cd1a36aa5d20aad57b9a1d4e)
---
 pkgs/top-level/perl-packages.nix | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 56b1538124da..bc8b10a2ddd0 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -2907,6 +2907,17 @@ with self;
       url = "mirror://cpan/authors/id/D/DA/DAVIDO/Bytes-Random-Secure-Tiny-1.011.tar.gz";
       hash = "sha256-A9lntfgoRpCRN9WrmYSsVwrBCkQB4MYC89IgjEZayYI=";
     };
+    patches = [
+      (fetchpatch {
+        name = "CVE-2026-11702.patch";
+        url = "https://security.metacpan.org/patches/B/Bytes-Random-Secure-Tiny/1.011/CVE-2026-11702-r1.patch";
+        hash = "sha256-81wvVdtQsF5YeRhjAeaOFa7aE1cgdCni+G28LA7ZLqM=";
+      })
+    ];
+    preCheck = ''
+      # Remove test that CVE patch breaks: "Attempt to access disallowed key '_rng' in a restricted hash"
+      rm t/35-mrie-cover.t
+    '';
     meta = {
       description = "Tiny Perl extension to generate cryptographically-secure random bytes";
       license = with lib.licenses; [

From 98143898b6a630bd7433afabfb6386523f08e054 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Sat, 27 Jun 2026 11:59:49 +0200
Subject: [PATCH 58/66] perlPackages.BytesRandomSecure: add patch for
 CVE-2026-11625

(cherry picked from commit f74dae849727a177dafb8686c1d573b945ff69ff)
---
 pkgs/top-level/perl-packages.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index bc8b10a2ddd0..510cf11aab10 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -2886,6 +2886,13 @@ with self;
       url = "mirror://cpan/authors/id/D/DA/DAVIDO/Bytes-Random-Secure-0.29.tar.gz";
       hash = "sha256-U7vTOeahHvygfGGaYVx8GIpouyvoSaHLfvw91Nmuha4=";
     };
+    patches = [
+      (fetchpatch {
+        name = "CVE-2026-11625.patch";
+        url = "https://security.metacpan.org/patches/B/Bytes-Random-Secure/0.29/CVE-2026-11625-r1.patch";
+        hash = "sha256-EDPFvFjqGtN5/TiJlarqKMrtH6kEQD6rOA7B2moBkiA=";
+      })
+    ];
     propagatedBuildInputs = [
       CryptRandomSeed
       MathRandomISAAC

From bc937b84a74bf72de8e1d8de8970002d5ae2bf26 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 21 Jun 2026 21:08:44 +0000
Subject: [PATCH 59/66] python3Packages.flash-linear-attention: 0.5.0 -> 0.5.1

(cherry picked from commit de48634a6e7a6212ce13cd52c8429029b2f1ff07)
---
 .../python-modules/flash-linear-attention/default.nix         | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/flash-linear-attention/default.nix b/pkgs/development/python-modules/flash-linear-attention/default.nix
index 9cce12efe716..14fd32763b38 100644
--- a/pkgs/development/python-modules/flash-linear-attention/default.nix
+++ b/pkgs/development/python-modules/flash-linear-attention/default.nix
@@ -21,7 +21,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "flash-linear-attention";
-  version = "0.5.0";
+  version = "0.5.1";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -30,7 +30,7 @@ buildPythonPackage (finalAttrs: {
     owner = "fla-org";
     repo = "flash-linear-attention";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-g66yGHaBwEyjb+of76tKTtV/7as/2xQuqcjbGs4E3rU=";
+    hash = "sha256-vxNbZ+FkxJh2E0TF09Z7ghkm8eas7Q96heeSXwgV4uU=";
   };
 
   build-system = [ setuptools ];

From 69dabba80d79adce0a3945fc6f20a34bf0a2aa11 Mon Sep 17 00:00:00 2001
From: BatteredBunny <ayes2022@protonmail.com>
Date: Sat, 27 Jun 2026 14:10:47 +0300
Subject: [PATCH 60/66] tabbyapi: unstable-2026-06-13 -> unstable-2026-06-27

(cherry picked from commit a05d7f9e123495a8394c30b3ea96ffc7c82fba41)
---
 pkgs/by-name/ta/tabbyapi/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ta/tabbyapi/package.nix b/pkgs/by-name/ta/tabbyapi/package.nix
index d4027e187c8d..cac9ebfe2c59 100644
--- a/pkgs/by-name/ta/tabbyapi/package.nix
+++ b/pkgs/by-name/ta/tabbyapi/package.nix
@@ -7,14 +7,14 @@
 }:
 python3Packages.buildPythonApplication {
   pname = "tabbyapi";
-  version = "0-unstable-2026-06-13";
+  version = "0-unstable-2026-06-27";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "theroyallab";
     repo = "tabbyAPI";
-    rev = "54850882315d509c984f9fe07fb8f5d04a0b4ba9";
-    hash = "sha256-rIpI3pCJtfU1AEHBwQCIwuOh4c14N/z8VlX0hdxOC60=";
+    rev = "3cf468c28362c28be1c8fc731ce1ccaf7b2206d0";
+    hash = "sha256-s97YFyij2/oYlClmV2laDrCkkoK4uVZgRsn5WwftLag=";
   };
 
   build-system = with python3Packages; [

From 0e951b589f89d4b4260adc148f5b382e4e814b0f Mon Sep 17 00:00:00 2001
From: BatteredBunny <ayes2022@protonmail.com>
Date: Sat, 27 Jun 2026 14:11:47 +0300
Subject: [PATCH 61/66] nixos/tabbyapi: add writable HOME and cache

(cherry picked from commit d384512ee80dbd84755962da3cb02105d8225ef3)
---
 nixos/modules/services/web-apps/tabbyapi.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/nixos/modules/services/web-apps/tabbyapi.nix b/nixos/modules/services/web-apps/tabbyapi.nix
index 0340e69775a7..bd937b0d5685 100644
--- a/nixos/modules/services/web-apps/tabbyapi.nix
+++ b/nixos/modules/services/web-apps/tabbyapi.nix
@@ -167,6 +167,13 @@ in
       wantedBy = [ "multi-user.target" ];
       description = "TabbyAPI - OAI compatible server for Exllama";
 
+      # Triton & huggingface downloader need writable cache folders
+      environment = {
+        HOME = "/var/lib/tabbyapi";
+        XDG_CACHE_HOME = "/var/lib/tabbyapi/.cache";
+        TRITON_CACHE_DIR = "/tmp/triton";
+      };
+
       serviceConfig = {
         ExecStart = "${lib.getExe cfg.package} --config=${configFile}";
         Restart = "on-failure";

From 8e12631d6a5429307e9664317c21c5cc02eb9b0e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 27 Jun 2026 10:36:51 +0000
Subject: [PATCH 62/66] shaperglot-cli: 1.2.0 -> 1.2.1

(cherry picked from commit 42308f570774f0f3fe9e2def1e6bc483c287ef02)
---
 pkgs/by-name/sh/shaperglot-cli/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/sh/shaperglot-cli/package.nix b/pkgs/by-name/sh/shaperglot-cli/package.nix
index dbefda1670f8..fc1a9f10ac01 100644
--- a/pkgs/by-name/sh/shaperglot-cli/package.nix
+++ b/pkgs/by-name/sh/shaperglot-cli/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "shaperglot-cli";
-  version = "1.2.0";
+  version = "1.2.1";
 
   src = fetchFromGitHub {
     owner = "googlefonts";
     repo = "shaperglot";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Jh2/Rr7bIPFiblUZFS8KiQtMwmtMuOGCSV2w7LMCbq8=";
+    hash = "sha256-g8f8Q2DvYNvm8i6S+9K/jhhUiuGw366dht0Khx3/INg=";
   };
 
-  cargoHash = "sha256-3cHUSRvrvywfiYA/WpUrCIJV+hEQQwRNTPvSmCN50ho=";
+  cargoHash = "sha256-ivl3Zq0HRn4yP9JKfbjSaaERjbQ3SAEWhHk6toFp8dE=";
 
   cargoBuildFlags = [
     "--package=shaperglot-cli"

From 5a51a8d58c9f65ab8352a6248c160c0bb150d50a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 27 Jun 2026 12:09:15 +0000
Subject: [PATCH 63/66] sdl_gamecontrollerdb: 0-unstable-2026-06-12 ->
 0-unstable-2026-06-26

(cherry picked from commit 9302bd5507628bc5acf8dd96d71532b84245717c)
---
 pkgs/by-name/sd/sdl_gamecontrollerdb/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/sd/sdl_gamecontrollerdb/package.nix b/pkgs/by-name/sd/sdl_gamecontrollerdb/package.nix
index a0e88a3b31dd..4a7ec7a46f7c 100644
--- a/pkgs/by-name/sd/sdl_gamecontrollerdb/package.nix
+++ b/pkgs/by-name/sd/sdl_gamecontrollerdb/package.nix
@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "sdl_gamecontrollerdb";
-  version = "0-unstable-2026-06-12";
+  version = "0-unstable-2026-06-26";
 
   src = fetchFromGitHub {
     owner = "mdqinc";
     repo = "SDL_GameControllerDB";
-    rev = "998d5b08b5b33bdf3a63b2ef8f2ac4ccc664e2f6";
-    hash = "sha256-OdamCeHnPH0zc5Uac6KMpltIIEQMAfQwcopzg5ytUy8=";
+    rev = "513c72e34569e0f471dde7aa26eecb23946c3ef7";
+    hash = "sha256-IZ6BYtxFRu8Kt+Ege3xf+E9dlMBHXFWvdvYdKEFAIM8=";
   };
 
   dontBuild = true;

From 88491d663de349742aeb527b698ace6ea5814095 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 14 Jun 2026 00:59:32 +0000
Subject: [PATCH 64/66] unityhub: 3.18.0 -> 3.18.2

(cherry picked from commit 37bca776d61047071f3c895bd085548b271dfedf)
---
 pkgs/by-name/un/unityhub/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/un/unityhub/package.nix b/pkgs/by-name/un/unityhub/package.nix
index 6f4b55e58262..d183faafb7a6 100644
--- a/pkgs/by-name/un/unityhub/package.nix
+++ b/pkgs/by-name/un/unityhub/package.nix
@@ -11,11 +11,11 @@
 
 stdenv.mkDerivation rec {
   pname = "unityhub";
-  version = "3.18.0";
+  version = "3.18.2";
 
   src = fetchurl {
     url = "https://hub-dist.unity3d.com/artifactory/hub-debian-prod-local/pool/main/u/unity/unityhub_amd64/UnityHubSetup-${version}-amd64.deb";
-    hash = "sha256-JDkmF8ANvW0j5L+92prUcVFqDbUGXkxxUZPjtOqwDlk=";
+    hash = "sha256-4sluuD2g70X98N6Pk9lpC//IFpePpHZf/mowDbh0S8g=";
   };
 
   nativeBuildInputs = [

From 06798c3775238fdd56b88fae05179705a1d17101 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 22 Jun 2026 17:02:15 +0000
Subject: [PATCH 65/66] unityhub: 3.18.2 -> 3.18.3

(cherry picked from commit 7182dffae30e1fc8f1e96c673da61a3451116eb5)
---
 pkgs/by-name/un/unityhub/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/un/unityhub/package.nix b/pkgs/by-name/un/unityhub/package.nix
index d183faafb7a6..ce2ce84f0844 100644
--- a/pkgs/by-name/un/unityhub/package.nix
+++ b/pkgs/by-name/un/unityhub/package.nix
@@ -11,11 +11,11 @@
 
 stdenv.mkDerivation rec {
   pname = "unityhub";
-  version = "3.18.2";
+  version = "3.18.3";
 
   src = fetchurl {
     url = "https://hub-dist.unity3d.com/artifactory/hub-debian-prod-local/pool/main/u/unity/unityhub_amd64/UnityHubSetup-${version}-amd64.deb";
-    hash = "sha256-4sluuD2g70X98N6Pk9lpC//IFpePpHZf/mowDbh0S8g=";
+    hash = "sha256-6Gjik6zIQMYoAr8jmMp3X6+Xu5fdcbh2Exd8eToSbto=";
   };
 
   nativeBuildInputs = [

From 0939631e1362c0c7acd024b81c023b9c757be904 Mon Sep 17 00:00:00 2001
From: Rylan Polster <rylan.polster@shopify.com>
Date: Tue, 12 May 2026 18:00:44 -0400
Subject: [PATCH 66/66] openresty: fix lib.optional misuse in configureFlags

(cherry picked from commit ad73c80d33f7a556e52106f2cfd61bf4c7873470)
---
 pkgs/servers/http/openresty/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/servers/http/openresty/default.nix b/pkgs/servers/http/openresty/default.nix
index f527e6a6adb3..8e60573f4a51 100644
--- a/pkgs/servers/http/openresty/default.nix
+++ b/pkgs/servers/http/openresty/default.nix
@@ -49,7 +49,7 @@ callPackage ../nginx/generic.nix args rec {
     patchShebangs configure bundle/
   '';
 
-  configureFlags = lib.optional withPostgres [ "--with-http_postgres_module" ];
+  configureFlags = lib.optionals withPostgres [ "--with-http_postgres_module" ];
 
   postInstall = ''
     ln -s $out/luajit/bin/luajit-2.1.ROLLING $out/bin/luajit-openresty