Merge staging-next into staging

2026-07-06 17:13:24 -05:00 · 2026-06-04 00:54:51 +00:00 · 2026-06-04 00:54:51 +00:00 · 50d9dbad25
commit 50d9dbad25
parent 8144f7e783 52304a62fb
110 changed files with 1368 additions and 911 deletions
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -25770,6 +25770,7 @@
  };
  skyesoss = {
    name = "Skye Soss";
+    email = "skye@soss.website";
    matrix = "@skyesoss:matrix.org";
    github = "Skyb0rg007";
    githubId = 30806179;
--- a/nixos/modules/config/nix-channel.nix
+++ b/nixos/modules/config/nix-channel.nix
@ -6,12 +6,16 @@
  - ./nix.nix
  - ./nix-flakes.nix
 */
-{ config, lib, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 let
  inherit (lib)
    mkIf
    mkOption
-    stringAfter
    types
    ;

@ -98,8 +102,10 @@ in
      ''f /root/.nix-channels - - - - ${config.system.defaultChannel} nixos\n''
    ];

-    system.activationScripts.no-nix-channel = mkIf (!cfg.channel.enable) (
-      stringAfter [ "etc" "users" ] (builtins.readFile ./nix-channel/activation-check.sh)
+    system.preSwitchChecks.no-nix-channel = mkIf (!cfg.channel.enable) (
+      lib.replaceStrings [ "@getent@" ] [ (lib.getExe pkgs.getent) ] (
+        builtins.readFile ./nix-channel/pre-switch-check.sh
+      )
    );
  };
 }
--- a/nixos/modules/config/nix-channel/pre-switch-check.sh
+++ b/nixos/modules/config/nix-channel/pre-switch-check.sh
@ -1,4 +1,6 @@
-# shellcheck shell=bash
+warn() {
+    printf "\033[1;35mwarning:\033[0m %s\n" "$*" >&2
+}

 explainChannelWarning=0
 if [[ -e "/root/.nix-defexpr/channels" ]]; then
@ -11,11 +13,13 @@ if [[ -e "/nix/var/nix/profiles/per-user/root/channels" ]]; then
 fi
 while IFS=: read -r _ _ _ _ _ home _ ; do
    if [[ -n  "$home" && -e "$home/.nix-defexpr/channels" ]]; then
-        warn "$home/.nix-defexpr/channels exists, but channels have been disabled." 1>&2
+        warn "$home/.nix-defexpr/channels exists, but channels have been disabled."
        explainChannelWarning=1
    fi
-done < <(getent passwd)
+done < <(@getent@ passwd)
 if [[ $explainChannelWarning -eq 1 ]]; then
-    echo "Due to https://github.com/NixOS/nix/issues/9574, Nix may still use these channels when NIX_PATH is unset." 1>&2
-    echo "Delete the above directory or directories to prevent this." 1>&2
+    echo "Due to https://github.com/NixOS/nix/issues/9574, Nix may still use these channels when NIX_PATH is unset." >&2
+    echo "Delete the above directory or directories to prevent this." >&2
 fi
+# This check is informational only and must never block a switch.
+true
--- a/nixos/modules/config/nix-channel/test.nix
+++ b/nixos/modules/config/nix-channel/test.nix
@ -1,20 +0,0 @@
-# Run:
-#   nix-build -A nixosTests.nix-channel
-{ lib, testers }:
-let
-  inherit (lib) fileset;
-
-  runShellcheck = testers.shellcheck {
-    name = "activation-check";
-    src = fileset.toSource {
-      root = ./.;
-      fileset = fileset.unions [
-        ./activation-check.sh
-      ];
-    };
-  };
-
-in
-lib.recurseIntoAttrs {
-  inherit runShellcheck;
-}
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -1122,7 +1122,6 @@ in
  nimdow = runTest ./nimdow.nix;
  nipap = runTest ./web-apps/nipap.nix;
  nitter = runTest ./nitter.nix;
-  nix-channel = pkgs.callPackage ../modules/config/nix-channel/test.nix { };
  nix-config = runTest ./nix-config.nix;
  nix-daemon-firewall = runTest ./nix-daemon-firewall.nix;
  nix-daemon-unprivileged = runTest ./nix-daemon-unprivileged.nix;
--- a/pkgs/applications/editors/neovim/tests/default.nix
+++ b/pkgs/applications/editors/neovim/tests/default.nix
@ -9,6 +9,7 @@
 */
 {
  vimUtils,
+  neovimUtils,
  writeText,
  neovim,
  vimPlugins,
@ -491,4 +492,70 @@ pkgs.lib.recurseIntoAttrs rec {
      '';
      passthru.requiredLuaModules = [ luassert ];
    };
+
+  nvim_require_check_neovim_plugin =
+    let
+      luaPkg = neovim-unwrapped.lua.pkgs.buildLuarocksPackage {
+        pname = "neovim-require-check-fails";
+        version = "0.0.1-1";
+        src = runCommandLocal "neovim-require-check-fails-src" { } ''
+          mkdir -p "$out"
+          cat > "$out/neovim-require-check-fails-0.0.1-1.rockspec" <<'EOF'
+          package = "neovim-require-check-fails"
+          version = "0.0.1-1"
+          source = {
+            url = "."
+          }
+          build = {
+            type = "none"
+          }
+          EOF
+        '';
+      };
+    in
+    testers.testBuildFailure (
+      neovimUtils.buildNeovimPlugin {
+        luaAttr = luaPkg;
+        doCheck = true;
+        postInstall = ''
+          mkdir -p "$out/lua"
+          cat > "$out/lua/require_check_fails.lua" <<'EOF'
+          error("neovimRequireCheckHook required installed module")
+          EOF
+        '';
+      }
+    );
+
+  nvim_require_check_ignores_test_modules = vimUtils.buildVimPlugin {
+    pname = "neovim-require-check-ignores-test-modules";
+    version = "0";
+    src = runCommandLocal "neovim-require-check-ignores-test-modules-src" { } ''
+      mkdir -p \
+        "$out/lua/require-check-ignores"/{debug,script,scripts,test,tests,spec,_meta} \
+        "$out/lua/require-check-ignores"
+      cat > "$out/lua/require-check-ignores/init.lua" <<'EOF'
+      return {}
+      EOF
+      for dir in debug script scripts test tests spec _meta; do
+        cat > "$out/lua/require-check-ignores/$dir/failing.lua" <<EOF
+      error("excluded $dir directory was required")
+      EOF
+      done
+      cat > "$out/lua/require-check-ignores/failing_meta.lua" <<'EOF'
+      error("excluded _meta module was required")
+      EOF
+      cat > "$out/lua/require-check-ignores/failing_spec.lua" <<'EOF'
+      error("excluded _spec module was required")
+      EOF
+      cat > "$out/lua/require-check-ignores/failing.spec.lua" <<'EOF'
+      error("excluded .spec module was required")
+      EOF
+      cat > "$out/lua/require-check-ignores/failing.test.lua" <<'EOF'
+      error("excluded .test module was required")
+      EOF
+      cat > "$out/lua/require-check-ignores/meta.lua" <<'EOF'
+      error("excluded meta module was required")
+      EOF
+    '';
+  };
 }
--- a/pkgs/applications/editors/vim/plugins/hooks/neovim-require-check-hook.sh
+++ b/pkgs/applications/editors/vim/plugins/hooks/neovim-require-check-hook.sh
@ -4,17 +4,27 @@ echo "Sourcing neovim-require-check-hook.sh"

 # Discover modules automatically if nvimRequireCheck is not set
 discover_modules() {
-    echo "Running module discovery in source directory..."
+    echo "Running module discovery in output directory..."

    # Create unique lists so we can organize later
    modules=()

    while IFS= read -r lua_file; do
-        # Ignore certain infra directories
-        if [[ "$lua_file" =~ (^|/)(debug|script|scripts|test|tests|spec)(/|$) || "$lua_file" =~ .*\meta.lua ]]; then
-            continue
+        # Ignore infrastructure directories and non-runtime module files
+        case "/$lua_file/" in
+            */debug/* | */script/* | */scripts/* | */test/* | */tests/* | */spec/* | */_meta/*)
+                continue
+                ;;
+        esac
+
+        case "${lua_file##*/}" in
+            *meta.lua | *_spec.lua | *.spec.lua | *.test.lua)
+                continue
+                ;;
+        esac
+
        # Ignore optional telescope and lualine modules
-        elif [[ "$lua_file" =~ ^lua/telescope/_extensions/(.+)\.lua || "$lua_file" =~ ^lua/lualine/(.+)\.lua ]]; then
+        if [[ "$lua_file" =~ ^lua/telescope/_extensions/(.+)\.lua || "$lua_file" =~ ^lua/lualine/(.+)\.lua ]]; then
            continue
        # Grab main module names
        elif [[ "$lua_file" =~ ^lua/([^/]+)/init.lua$ ]]; then
@ -30,7 +40,7 @@ discover_modules() {
            echo "$lua_file"
            modules+=("${BASH_REMATCH[1]}")
        fi
-    done < <(find "$src" -name '*.lua' | xargs -n 1 realpath --relative-to="$src")
+    done < <(find "$out" -name '*.lua' -exec realpath --relative-to="$out" {} +)

    nvimRequireCheck=("${modules[@]}")
    echo "Discovered modules: ${nvimRequireCheck[*]}"
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@ -9,11 +9,11 @@
    "vendorHash": "sha256-RTfj2Omiqe92Ad0swEY/aGIMvcXb39bdQoObYKiekiw="
  },
  "a10networks_thunder": {
-    "hash": "sha256-RX3mP5btzyvuBjoMNiUL6ZeFLEo5SqmwwSK/eE0gWEw=",
+    "hash": "sha256-mqCXiBtVHzEOdLW0KudPWJO6kGi0SiGawN/NQvjAJdg=",
    "homepage": "https://registry.terraform.io/providers/a10networks/thunder",
    "owner": "a10networks",
    "repo": "terraform-provider-thunder",
-    "rev": "v1.5.0",
+    "rev": "v1.6.0",
    "spdx": "BSD-2-Clause",
    "vendorHash": null
  },
@ -517,13 +517,13 @@
    "vendorHash": "sha256-XnVGjEz4mxqkNFrvgpRQ4W9s+j03mk0NTgEx4p5Z6qk="
  },
  "hashicorp_awscc": {
-    "hash": "sha256-kpLC5NdlpBNXj2V0hR8ZvsJjyVgKCXFt7xK8Z7AOyoQ=",
+    "hash": "sha256-ywRxQKGrQ+kT08gNgNgdT5FmvsHYucT/W29+uyz1mwg=",
    "homepage": "https://registry.terraform.io/providers/hashicorp/awscc",
    "owner": "hashicorp",
    "repo": "terraform-provider-awscc",
-    "rev": "v1.85.0",
+    "rev": "v1.87.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-ryLMz2eh5LO0e6OLJJUoMbM+U53uDTq9sHNcnSuuWt4="
+    "vendorHash": "sha256-Bf2XnjX0G5iufWOi6E/imRQ+qgr8Yse73rrnY8CbSMg="
  },
  "hashicorp_azuread": {
    "hash": "sha256-BkQwLkGu8Xmb4laoXOLDbSPyya5v8HBBNIya5hUBlV8=",
@ -851,11 +851,11 @@
    "vendorHash": "sha256-OgKOjLwDQxJiv+VWdOzjMcUDPu9LOuhyTRyLyM39vLM="
  },
  "linode_linode": {
-    "hash": "sha256-FUOVV0gyUMb7VnZkK0ua92IHOUJ4wmnkbjh0fSQ9vGc=",
+    "hash": "sha256-ZDU8rEmbq9tIXq9+jL30i5GnTIWM6lMJ+rljVJhBJis=",
    "homepage": "https://registry.terraform.io/providers/linode/linode",
    "owner": "linode",
    "repo": "terraform-provider-linode",
-    "rev": "v3.13.0",
+    "rev": "v3.14.0",
    "spdx": "MPL-2.0",
    "vendorHash": "sha256-6wWNt0TDqqwtRFMCLH81WQ55XLEn4dHx+prM0DA+e4U="
  },
--- a/pkgs/applications/networking/p2p/transmission/0001-Skip-bundle-fixup.patch
+++ b/pkgs/applications/networking/p2p/transmission/0001-Skip-bundle-fixup.patch
@ -0,0 +1,61 @@
+From a8122a78c496f09711e81c669ca3ee44c8df79f9 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Stanis=C5=82aw=20Pitucha?= <stan.pitucha@envato.com>
+Date: Fri, 27 Mar 2026 08:58:08 +1100
+Subject: [PATCH] Skip fixup; it's unnecessary for nixpkgs
+
+---
+ cmake/TrMacros.cmake | 38 --------------------------------------
+ 1 file changed, 38 deletions(-)
+
+diff --git a/cmake/TrMacros.cmake b/cmake/TrMacros.cmake
+index 2efa8767c..cc17a47a5 100644
+--- a/cmake/TrMacros.cmake
+++ b/cmake/TrMacros.cmake
+@@ -376,44 +376,6 @@ function(tr_select_library LIBNAMES FUNCNAME DIRS OVAR)
+ endfunction()
+ 
+ function(tr_fixup_bundle_item BUNDLE_DIR BUNDLE_ITEMS DEP_DIRS)
+-    while(BUNDLE_ITEMS)
+-        list(GET BUNDLE_ITEMS 0 ITEM)
+-        list(REMOVE_AT BUNDLE_ITEMS 0)
+-
+-        set(ITEM_FULL_BUNDLE_PATH "${BUNDLE_DIR}/${ITEM}")
+-        get_filename_component(ITEM_FULL_BUNDLE_DIR "${ITEM_FULL_BUNDLE_PATH}" PATH)
+-
+-        unset(ITEM_DEPS)
+-        get_prerequisites("${ITEM_FULL_BUNDLE_PATH}" ITEM_DEPS 1 0 "${ITEM_FULL_BUNDLE_PATH}" "${DEP_DIRS}")
+-
+-        foreach(DEP IN LISTS ITEM_DEPS)
+-            gp_resolve_item("${ITEM_FULL_BUNDLE_PATH}" "${DEP}" "${ITEM_FULL_BUNDLE_DIR}" "${DEP_DIRS}" DEP_FULL_PATH)
+-
+-            if(DEP_FULL_PATH MATCHES "[.]dylib$")
+-                get_filename_component(DEP_NAME "${DEP_FULL_PATH}" NAME)
+-                file(COPY "${DEP_FULL_PATH}" DESTINATION "${BUNDLE_DIR}/Contents/MacOS/")
+-                set(DEP_BUNDLE_PATH "Contents/MacOS/${DEP_NAME}")
+-            elseif(DEP_FULL_PATH MATCHES "^(.+)/(([^/]+[.]framework)/.+)$")
+-                set(DEP_NAME "${CMAKE_MATCH_2}")
+-                file(
+-                    COPY "${CMAKE_MATCH_1}/${CMAKE_MATCH_3}"
+-                    DESTINATION "${BUNDLE_DIR}/Contents/Frameworks/"
+-                    PATTERN "Headers" EXCLUDE)
+-                set(DEP_BUNDLE_PATH "Contents/Frameworks/${DEP_NAME}")
+-            else()
+-                message(FATAL_ERROR "Don't know how to fixup '${DEP_FULL_PATH}'")
+-            endif()
+-
+-            execute_process(COMMAND install_name_tool -change "${DEP}" "@rpath/${DEP_NAME}" "${ITEM_FULL_BUNDLE_PATH}")
+-
+-            set(DEP_FULL_BUNDLE_PATH "${BUNDLE_DIR}/${DEP_BUNDLE_PATH}")
+-            execute_process(COMMAND chmod u+w "${DEP_FULL_BUNDLE_PATH}")
+-            execute_process(COMMAND install_name_tool -id "@rpath/${DEP_NAME}" "${DEP_FULL_BUNDLE_PATH}")
+-
+-            list(REMOVE_ITEM BUNDLE_ITEMS "${DEP_BUNDLE_PATH}")
+-            list(APPEND BUNDLE_ITEMS "${DEP_BUNDLE_PATH}")
+-        endforeach()
+-    endwhile()
+ endfunction()
+ 
+ function(tr_glib_compile_resources TGT NAME INPUT_DIR INPUT_FILE OUTPUT_FILE_BASE)
+-- 
+2.51.2
+
--- a/pkgs/applications/networking/p2p/transmission/4.nix
+++ b/pkgs/applications/networking/p2p/transmission/4.nix
@ -30,6 +30,7 @@
  wrapGAppsHook3,
  enableQt5 ? false,
  enableQt6 ? false,
+  enableMac ? false,
  qt5,
  qt6Packages,
  nixosTests,
@ -38,10 +39,14 @@
  enableCli ? true,
  installLib ? false,
  apparmorRulesFromClosure,
+  ibtool,
+  actool,
+  coreutils,
+  makeWrapper,
 }:

 let
-  inherit (lib) cmakeBool optionals;
+  inherit (lib) cmakeBool optionals optionalString;

  apparmorRules = apparmorRulesFromClosure { name = "transmission-daemon"; } (
    [
@ -71,16 +76,29 @@ stdenv.mkDerivation (finalAttrs: {
    fetchSubmodules = true;
  };

+  strictDeps = true;
+  __structuredAttrs = true;
+
+  patches = [
+    ./0001-Skip-bundle-fixup.patch
+  ];
+
  outputs = [
    "out"
+  ]
+  ++ optionals stdenv.hostPlatform.isLinux [
    "apparmor"
  ];

+  # Remove once https://github.com/NixOS/nixpkgs/pull/508307 lands
+  # Stop clang trying to write in $HOME
+  env.CLANG_MODULE_CACHE_PATH = "/tmp/clang_module_cache";
+
  cmakeFlags = [
    (cmakeBool "ENABLE_CLI" enableCli)
    (cmakeBool "ENABLE_DAEMON" enableDaemon)
    (cmakeBool "ENABLE_GTK" enableGTK3)
-    (cmakeBool "ENABLE_MAC" false) # requires xcodebuild
+    (cmakeBool "ENABLE_MAC" enableMac)
    (cmakeBool "ENABLE_QT" (enableQt5 || enableQt6))
    (cmakeBool "INSTALL_LIB" installLib)
    (cmakeBool "RUN_CLANG_TIDY" false)
@ -88,6 +106,9 @@ stdenv.mkDerivation (finalAttrs: {
  ++ optionals stdenv.hostPlatform.isDarwin [
    # Transmission sets this to 10.13 if not explicitly specified, see https://github.com/transmission/transmission/blob/0be7091eb12f4eb55f6690f313ef70a66795ee72/CMakeLists.txt#L7-L16.
    "-DCMAKE_OSX_DEPLOYMENT_TARGET=${stdenv.hostPlatform.darwinMinVersion}"
+    # we don't have a compatible-enough signing tool right now
+    "-DCODESIGN_EXECUTABLE=${lib.getExe' coreutils "true"}"
+    "-DACTOOL_EXECUTABLE=${lib.getExe actool}"
  ];

  postPatch = ''
@ -109,6 +130,12 @@ stdenv.mkDerivation (finalAttrs: {
    # Upstream uses different config file name.
    substituteInPlace CMakeLists.txt \
      --replace-fail 'find_package(UtfCpp)' 'find_package(utf8cpp)'
+  ''
+  + optionalString (stdenv.hostPlatform.isDarwin && (enableQt5 || enableQt6)) ''
+    substituteInPlace qt/CMakeLists.txt \
+      --replace-fail \
+        'transmission::qt_impl)' \
+        'transmission::qt_impl "-framework AppKit" "-framework CoreGraphics")'
  '';

  nativeBuildInputs = [
@ -118,7 +145,12 @@ stdenv.mkDerivation (finalAttrs: {
  ]
  ++ optionals enableGTK3 [ wrapGAppsHook3 ]
  ++ optionals enableQt5 [ qt5.wrapQtAppsHook ]
-  ++ optionals enableQt6 [ qt6Packages.wrapQtAppsHook ];
+  ++ optionals enableQt6 [ qt6Packages.wrapQtAppsHook ]
+  ++ optionals enableMac [
+    ibtool
+    actool
+    makeWrapper
+  ];

  buildInputs = [
    curl
@ -160,29 +192,33 @@ stdenv.mkDerivation (finalAttrs: {
  ++ optionals enableSystemd [ systemd ]
  ++ optionals stdenv.hostPlatform.isLinux [ inotify-tools ];

-  postInstall = ''
-    mkdir $apparmor
-    cat >$apparmor/bin.transmission-daemon <<EOF
-    abi <abi/4.0>,
-    include <tunables/global>
-    profile $out/bin/transmission-daemon {
-      include <abstractions/base>
-      include <abstractions/nameservice>
-      include <abstractions/ssl_certs>
-      include "${apparmorRules}"
-      @{PROC}/sys/kernel/random/uuid r,
-      @{PROC}/sys/vm/overcommit_memory r,
-      @{PROC}/@{pid}/environ r,
-      @{PROC}/@{pid}/mounts r,
-      /tmp/tr_session_id_* rwk,
+  postInstall =
+    optionalString stdenv.hostPlatform.isLinux ''
+      mkdir $apparmor
+      cat >$apparmor/bin.transmission-daemon <<EOF
+      abi <abi/4.0>,
+      include <tunables/global>
+      profile $out/bin/transmission-daemon {
+        include <abstractions/base>
+        include <abstractions/nameservice>
+        include <abstractions/ssl_certs>
+        include "${apparmorRules}"
+        @{PROC}/sys/kernel/random/uuid r,
+        @{PROC}/sys/vm/overcommit_memory r,
+        @{PROC}/@{pid}/environ r,
+        @{PROC}/@{pid}/mounts r,
+        /tmp/tr_session_id_* rwk,

-      $out/share/transmission/public_html/** r,
+        $out/share/transmission/public_html/** r,

-      include if exists <local/bin.transmission-daemon>
-    }
-    EOF
-    install -Dm0444 -t $out/share/icons ../icons/hicolor_apps_scalable_transmission.svg
-  '';
+        include if exists <local/bin.transmission-daemon>
+      }
+      EOF
+      install -Dm0444 -t $out/share/icons ../icons/hicolor_apps_scalable_transmission.svg
+    ''
+    + optionalString enableMac ''
+      makeWrapper $out/Applications/Transmission.app/Contents/MacOS/Transmission $out/bin/transmission-mac
+    '';

  passthru.tests = {
    apparmor = nixosTests.transmission_4; # starts the service with apparmor enabled
@ -196,6 +232,8 @@ stdenv.mkDerivation (finalAttrs: {
        "transmission-qt"
      else if enableGTK3 then
        "transmission-gtk"
+      else if enableMac then
+        "transmission-mac"
      else
        "transmission-cli";
    longDescription = ''
--- a/pkgs/build-support/setup-hooks/install-fonts.sh
+++ b/pkgs/build-support/setup-hooks/install-fonts.sh
@ -46,6 +46,7 @@ installFonts() {
  installFont 'bdf' "$out/share/fonts/misc"
  installFont 'pcf' "$out/share/fonts/misc"
  installFont 'otb' "$out/share/fonts/misc"
+  installFont 'pcf.gz' "$out/share/fonts/misc"
  installFont 'psf' "$out/share/consolefonts"
  installFont 'psfu' "$out/share/consolefonts"

--- a/pkgs/by-name/ab/abaddon/package.nix
+++ b/pkgs/by-name/ab/abaddon/package.nix
@ -21,14 +21,14 @@
  sqlite,
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "abaddon";
  version = "0.2.4";

  src = fetchFromGitHub {
    owner = "uowuo";
    repo = "abaddon";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
    hash = "sha256-fSNXMbyYmUOA4x911/an02fhhhWe6a4xlLVb2DIqIOE=";
    fetchSubmodules = true;
  };
@ -74,11 +74,11 @@ stdenv.mkDerivation rec {

  desktopItems = [
    (makeDesktopItem {
-      name = pname;
-      exec = pname;
+      name = finalAttrs.pname;
+      exec = finalAttrs.pname;
      desktopName = "Abaddon";
-      genericName = meta.description;
-      startupWMClass = pname;
+      genericName = finalAttrs.meta.description;
+      startupWMClass = finalAttrs.pname;
      categories = [
        "Network"
        "InstantMessaging"
@ -95,4 +95,4 @@ stdenv.mkDerivation rec {
    maintainers = with lib.maintainers; [ choco98 ];
    platforms = lib.platforms.linux;
  };
-}
+})
--- a/pkgs/by-name/ac/acpilight/package.nix
+++ b/pkgs/by-name/ac/acpilight/package.nix
@ -7,14 +7,14 @@
  udevCheckHook,
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "acpilight";
  version = "1.2";

  src = fetchgit {
    url = "https://gitlab.com/wavexx/acpilight.git";
-    tag = "v${version}";
-    sha256 = "1r0r3nx6x6vkpal6vci0zaa1n9dfacypldf6k8fxg7919vzxdn1w";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-PNjW/04hndcdmsY1ej1TriUblPogsm2ounObbrodGeQ=";
  };

  pyenv = python3.withPackages (
@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
    substituteInPlace Makefile --replace-fail udevadm true
  '';

-  buildInputs = [ pyenv ];
+  buildInputs = [ finalAttrs.pyenv ];

  makeFlags = [ "DESTDIR=$(out) prefix=" ];

@ -45,4 +45,4 @@ stdenv.mkDerivation rec {
    platforms = lib.platforms.linux;
    mainProgram = "xbacklight";
  };
-}
+})
--- a/pkgs/by-name/ad/adl/package.nix
+++ b/pkgs/by-name/ad/adl/package.nix
@ -11,7 +11,7 @@
  trackma,
  ueberzug,
 }:
-stdenvNoCC.mkDerivation rec {
+stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "adl";
  version = "3.2.8";

@ -41,7 +41,7 @@ stdenvNoCC.mkDerivation rec {
    mkdir -p $out/bin
    cp $src/adl $out/bin
    wrapProgram $out/bin/adl \
-      --prefix PATH : ${lib.makeBinPath buildInputs}
+      --prefix PATH : ${lib.makeBinPath finalAttrs.buildInputs}
  '';

  meta = {
@ -52,4 +52,4 @@ stdenvNoCC.mkDerivation rec {
    maintainers = with lib.maintainers; [ weathercold ];
    mainProgram = "adl";
  };
-}
+})
--- a/pkgs/by-name/ad/adr-tools/package.nix
+++ b/pkgs/by-name/ad/adr-tools/package.nix
@ -20,14 +20,14 @@
  runCommand,
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "adr-tools";
  version = "3.0.0";

  src = fetchFromGitHub {
    owner = "npryce";
    repo = "adr-tools";
-    tag = version;
+    tag = finalAttrs.version;
    hash = "sha256-JEwLn+SY6XcaQ9VhN8ARQaZc1zolgAJKfIqPggzV+sU=";
  };

@ -112,4 +112,4 @@ stdenv.mkDerivation rec {
    mainProgram = "adr";
    platforms = lib.platforms.all;
  };
-}
+})
--- a/pkgs/by-name/af/afsctool/package.nix
+++ b/pkgs/by-name/af/afsctool/package.nix
@ -9,14 +9,14 @@
  sparsehash,
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "afsctool";
  version = "1.7.3";

  src = fetchFromGitHub {
    owner = "RJVB";
    repo = "afsctool";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
    fetchSubmodules = true;
    gitConfigFile = builtins.toFile "gitconfig" ''
      [url "https://github.com/"]
@ -46,4 +46,4 @@ stdenv.mkDerivation rec {
    platforms = lib.platforms.darwin;
    homepage = "https://github.com/RJVB/afsctool";
  };
-}
+})
--- a/pkgs/by-name/ai/aixlog/package.nix
+++ b/pkgs/by-name/ai/aixlog/package.nix
@ -4,14 +4,14 @@
  fetchFromGitHub,
 }:

-stdenvNoCC.mkDerivation rec {
+stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "aixlog";
  version = "1.5.0";

  src = fetchFromGitHub {
    owner = "badaix";
    repo = "aixlog";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
    hash = "sha256-Xhle7SODRZlHT3798mYIzBi1Mqjz8ai74/UnbVWetiY=";
  };

@ -30,8 +30,8 @@ stdenvNoCC.mkDerivation rec {
  meta = {
    description = "Header-only C++ logging library";
    homepage = "https://github.com/badaix/aixlog";
-    changelog = "https://github.com/badaix/aixlog/releases/tag/${src.rev}";
+    changelog = "https://github.com/badaix/aixlog/releases/tag/${finalAttrs.src.rev}";
    license = lib.licenses.mit;
    maintainers = [ ];
  };
-}
+})
--- a/pkgs/by-name/as/astc-encoder/package.nix
+++ b/pkgs/by-name/as/astc-encoder/package.nix
@ -47,13 +47,13 @@ in

 stdenv.mkDerivation (finalAttrs: {
  pname = "astc-encoder";
-  version = "5.3.0";
+  version = "5.4.0";

  src = fetchFromGitHub {
    owner = "ARM-software";
    repo = "astc-encoder";
    tag = finalAttrs.version;
-    hash = "sha256-15fX+3wzDoVzvQAhneeGajMsFXqSwmYtlsi3qrNFNus=";
+    hash = "sha256-mpaLSf1K+SsxkQm/b+QIWU34TzHQ7CAkyDNczBrcmBo=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/by-name/au/auto-editor/package.nix
+++ b/pkgs/by-name/au/auto-editor/package.nix
@ -19,13 +19,13 @@

 buildNimPackage rec {
  pname = "auto-editor";
-  version = "30.3.0";
+  version = "30.4.0";

  src = fetchFromGitHub {
    owner = "WyattBlue";
    repo = "auto-editor";
    tag = version;
-    hash = "sha256-1DFTT6dyIYlB3EMPf5eleXvRr1d29jmtt7GQfRpOkUE=";
+    hash = "sha256-AzUTDOWzyhZLrwqO9HfZ/Ke72LElJAMzVoDydBfYKwg=";
  };

  lockFile = ./lock.json;
--- a/pkgs/by-name/ba/babelstone-han/package.nix
+++ b/pkgs/by-name/ba/babelstone-han/package.nix
@ -2,29 +2,19 @@
  lib,
  stdenvNoCC,
  fetchzip,
+  installFonts,
 }:

-let
-  version = "16.0.3";
-in
-
-stdenvNoCC.mkDerivation {
+stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "babelstone-han";
-  inherit version;
+  version = "16.0.3";

  src = fetchzip {
-    url = "https://babelstone.co.uk/Fonts/Download/BabelStoneHan-${version}.zip";
+    url = "https://babelstone.co.uk/Fonts/Download/BabelStoneHan-${finalAttrs.version}.zip";
    hash = "sha256-HmmRJLs51hoHoKQYdjbiivnJl+RhcBwzkng+5PoqX10=";
  };

-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p $out/share/fonts/truetype
-    cp *.ttf $out/share/fonts/truetype
-
-    runHook postInstall
-  '';
+  nativeBuildInputs = [ installFonts ];

  meta = {
    description = "Unicode CJK font with over 36000 Han characters";
@ -34,4 +24,4 @@ stdenvNoCC.mkDerivation {
    platforms = lib.platforms.all;
    maintainers = with lib.maintainers; [ emily ];
  };
-}
+})
--- a/pkgs/by-name/ca/catalyst/package.nix
+++ b/pkgs/by-name/ca/catalyst/package.nix
@ -19,14 +19,14 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "catalyst";
-  version = "2.0.0";
+  version = "2.1.0";

  src = fetchFromGitLab {
    domain = "gitlab.kitware.com";
    owner = "paraview";
    repo = "catalyst";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-uPb7vgJpKquZVmSMxeWDVMiNkUdYv3oVVKu7t4+zkbs=";
+    hash = "sha256-8pBQQE5/h9LKRgFJi/KHtQPQ9rm7JyxBRVgh6Uf0Q98=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/cd/cdncheck/package.nix
+++ b/pkgs/by-name/cd/cdncheck/package.nix
@ -6,16 +6,16 @@

 buildGoModule (finalAttrs: {
  pname = "cdncheck";
-  version = "1.2.37";
+  version = "1.2.38";

  src = fetchFromGitHub {
    owner = "projectdiscovery";
    repo = "cdncheck";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-gw3WhhuCXFTAaqO4Sp8TDZ1W6xTCvH91hK5R/GEgoY0=";
+    hash = "sha256-OZ+rCxcJCeo8kWoL0UT7+bsT+QWt/xtKFKb0oHogB7o=";
  };

-  vendorHash = "sha256-gCq1m+9XCo4HGL1sT5AEMP0M430sy+5aKeOHwUWlme4=";
+  vendorHash = "sha256-iJ1agL7sZ3ZKbW1wMA+qi8FgHdPa6gZLQ5BBPKJTNaQ=";

  subPackages = [ "cmd/cdncheck/" ];

--- a/pkgs/by-name/ch/chatbox/package.nix
+++ b/pkgs/by-name/ch/chatbox/package.nix
@ -1,49 +0,0 @@
-{
-  lib,
-  appimageTools,
-  fetchurl,
-  writeScript,
-}:
-let
-  pname = "chatbox";
-  version = "1.20.3";
-
-  src = fetchurl {
-    url = "https://download.chatboxai.app/releases/Chatbox-${version}-x86_64.AppImage";
-    hash = "sha256-m2nCVYa2OGd1vV685+0Z3K6g4LjkHL5edhJ43ENWAZM=";
-  };
-
-  appimageContents = appimageTools.extract { inherit pname version src; };
-in
-appimageTools.wrapType2 {
-  inherit pname version src;
-
-  extraInstallCommands = ''
-    install -m 444 -D ${appimageContents}/xyz.chatboxapp.app.desktop $out/share/applications/chatbox.desktop
-    install -m 444 -D ${appimageContents}/usr/share/icons/hicolor/512x512/apps/xyz.chatboxapp.app.png $out/share/icons/hicolor/512x512/apps/chatbox.png
-    substituteInPlace $out/share/applications/chatbox.desktop \
-      --replace-fail 'Exec=AppRun' 'Exec=chatbox' \
-      --replace-fail 'Icon=xyz.chatboxapp.app' 'Icon=chatbox'
-  '';
-
-  passthru.updateScript = writeScript "update-chatbox" ''
-    #!/usr/bin/env nix-shell
-    #!nix-shell -i bash -p curl gnugrep common-updater-scripts
-    version=$(curl -I -X GET https://chatboxai.app/install_chatbox/linux | grep -oP 'Chatbox-\K[0-9]+\.[0-9]+\.[0-9]+')
-    update-source-version chatbox $version
-  '';
-
-  meta = {
-    description = "AI client application and smart assistant";
-    homepage = "https://chatboxai.app";
-    downloadPage = "https://chatboxai.app/en#download";
-    changelog = "https://chatboxai.app/en/help-center/changelog";
-    license = lib.licenses.unfree;
-    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
-    maintainers = with lib.maintainers; [ c31io ];
-    mainProgram = "chatbox";
-
-    # Help porting to other platforms :)
-    platforms = [ "x86_64-linux" ];
-  };
-}
--- a/pkgs/by-name/cn/cnspec/package.nix
+++ b/pkgs/by-name/cn/cnspec/package.nix
@ -6,18 +6,18 @@

 buildGoModule (finalAttrs: {
  pname = "cnspec";
-  version = "13.11.0";
+  version = "13.21.0";

  src = fetchFromGitHub {
    owner = "mondoohq";
    repo = "cnspec";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-MhORGeHFIiNHCipbpCl18utmCVD09UyN5dwNravus0o=";
+    hash = "sha256-RQ7OmsGTibOPL1R9h9+2sRXQhgToI+zwmMfuupwcjQI=";
  };

  proxyVendor = true;

-  vendorHash = "sha256-4p8vsWUdeVVG6qy1QMbuyxJarA1l72euzoswmMDn7gM=";
+  vendorHash = "sha256-TMrDKXQC/l6859ygN8yjVE5vVoJWHLUh+bUpPirNp/Y=";

  subPackages = [ "apps/cnspec" ];

--- a/pkgs/by-name/co/conduit/package.nix
+++ b/pkgs/by-name/co/conduit/package.nix
@ -15,14 +15,14 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "conduit";
-  version = "0.9.5";
+  version = "0.9.7";

  src = fetchFromGitHub {
    owner = "LLNL";
    repo = "conduit";
    tag = "v${finalAttrs.version}";
    fetchSubmodules = true;
-    hash = "sha256-mX7/5C4wd70Kx1rQyo2BcZMwDRqvxo4fBdz3pq7PuvM=";
+    hash = "sha256-DmnHGj6Q/i+wVNIbaTGrFX9f0Kry2X5bC7zahXv29I4=";
  };

  nativeBuildInputs = [
@ -41,13 +41,24 @@ stdenv.mkDerivation (finalAttrs: {
    (lib.cmakeBool "ENABLE_MPI" mpiSupport)
  ];

-  installCheckPhase = ''
-    runHook preInstallCheck
+  installCheckPhase =
+    let
+      excludedTests = lib.optionals stdenv.hostPlatform.isDarwin [
+        # SIGTRAP***Exception
+        "t_conduit_fixed_size_vector"
+      ];

-    make test
+      excludedTestsString = lib.optionalString (
+        excludedTests != [ ]
+      ) "-E '^(${builtins.concatStringsSep "|" excludedTests})$'";
+    in
+    ''
+      runHook preInstallCheck

-    runHook postInstallCheck
-  '';
+      ctest --output-on-failure ${excludedTestsString}
+
+      runHook postInstallCheck
+    '';
  doInstallCheck = true;

  passthru = {
--- a/pkgs/by-name/da/dalfox/package.nix
+++ b/pkgs/by-name/da/dalfox/package.nix
@ -6,13 +6,13 @@

 buildGoModule (finalAttrs: {
  pname = "dalfox";
-  version = "3.0.0";
+  version = "3.0.2";

  src = fetchFromGitHub {
    owner = "hahwul";
    repo = "dalfox";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-EYX+nag7aaqm9Saa9w4fbuxyuHxx1TIIgIj/yTKfE98=";
+    hash = "sha256-IUCpDTTJJHZS+e/7ZR2ObZOxLIQhPD6MZvYp9opqUAI=";
  };

  vendorHash = null;
--- a/pkgs/by-name/em/embedxpl/package.nix
+++ b/pkgs/by-name/em/embedxpl/package.nix
@ -6,14 +6,14 @@

 python3.pkgs.buildPythonApplication (finalAttrs: {
  pname = "embedxpl";
-  version = "3.1.0";
+  version = "3.4.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "mrhenrike";
    repo = "EmbedXPL-Forge";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-C7BTFRvhIjUePXxVmUbZXN2EKi+D/nE220/6ms30yAs=";
+    hash = "sha256-UzlJFg/30xwUmWDoRBlTbHKgLvCudHOGeqyfBYQO2qQ=";
  };

  __structuredAttrs = true;
--- a/pkgs/by-name/en/envypn-font/package.nix
+++ b/pkgs/by-name/en/envypn-font/package.nix
@ -5,6 +5,7 @@
  libfaketime,
  mkfontscale,
  fonttosfnt,
+  installFonts,
 }:

 stdenv.mkDerivation (finalAttrs: {
@ -17,6 +18,7 @@ stdenv.mkDerivation (finalAttrs: {
  };

  nativeBuildInputs = [
+    installFonts
    libfaketime
    fonttosfnt
    mkfontscale
@ -38,13 +40,8 @@ stdenv.mkDerivation (finalAttrs: {
    runHook postBuild
  '';

-  installPhase = ''
-    runHook preInstall
-
-    install -D -m 644 -t "$out/share/fonts/misc" *.otb *.pcf.gz
+  postInstall = ''
    mkfontdir "$out/share/fonts/misc"
-
-    runHook postInstall
  '';

  meta = {
--- a/pkgs/by-name/fe/feishin/package.nix
+++ b/pkgs/by-name/fe/feishin/package.nix
@ -3,29 +3,30 @@
  stdenv,
  buildNpmPackage,
  fetchFromGitHub,
-  electron_40,
+  electron_41,
  dart-sass,
  mpv-unwrapped,
  fetchPnpmDeps,
  pnpmConfigHook,
  pnpm_10_29_2,
  darwin,
+  actool,
  copyDesktopItems,
  makeDesktopItem,
  nix-update-script,
 }:
 let
  pname = "feishin";
-  version = "1.11.0";
+  version = "1.13.0";

  src = fetchFromGitHub {
    owner = "jeffvli";
    repo = "feishin";
    tag = "v${version}";
-    hash = "sha256-TSjgjNHhPSZ4k7zZTH5e3FCkl6d7B/2w2WCt0S5OW0g=";
+    hash = "sha256-v6dWzEB1+IK4bHmDo8Rr5e0Xi3OWKcm+UPBmBiSfdZ0=";
  };

-  electron = electron_40;
+  electron = electron_41;
 in
 buildNpmPackage {
  inherit pname version;
@ -43,7 +44,7 @@ buildNpmPackage {
      ;
    pnpm = pnpm_10_29_2;
    fetcherVersion = 3;
-    hash = "sha256-2fLqqCbbCIPoW/wGzsZOpZd5tnvyrLYlrVhbFWixlDM=";
+    hash = "sha256-zNOGJ24G0xcgsGK4DmbBm7d1PHTp7IJS+RTALGRtfDg=";
  };

  env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
@ -52,17 +53,15 @@ buildNpmPackage {
    pnpm_10_29_2
  ]
  ++ lib.optionals (stdenv.hostPlatform.isLinux) [ copyDesktopItems ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [ darwin.autoSignDarwinBinariesHook ];
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    darwin.autoSignDarwinBinariesHook
+    actool
+  ];

  postPatch = ''
    # release/app dependencies are installed on preConfigure
    substituteInPlace package.json \
      --replace-fail '"postinstall": "electron-builder install-app-deps",' ""
-  ''
-  + lib.optionalString stdenv.hostPlatform.isLinux ''
-    # https://github.com/electron/electron/issues/31121
-    substituteInPlace src/main/index.ts \
-      --replace-fail "process.resourcesPath" "'$out/share/feishin/resources'"
  '';

  preBuild = ''
--- a/pkgs/by-name/gl/gleam/package.nix
+++ b/pkgs/by-name/gl/gleam/package.nix
@ -12,20 +12,21 @@
  deno,
  versionCheckHook,
  nix-update-script,
+  writableTmpDirAsHomeHook,
 }:

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "gleam";
-  version = "1.16.0";
+  version = "1.17.0";

  src = fetchFromGitHub {
    owner = "gleam-lang";
    repo = "gleam";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-/AYtZ/nd0PIAaf9z/Uk8tw9ziczczerQO8D3g7n5sJo=";
+    hash = "sha256-lW57+JvinIHWhXuKagDcrfNDOUurIC53TjAxqrHN11I=";
  };

-  cargoHash = "sha256-3B8RSow/aLzv0wl+eMCnS42+DnUa6NdG2TuR7aAJCA8=";
+  cargoHash = "sha256-Wbmi/GyoflpDEnFC+1FicxqFJgOa8O2iUHwB7JcDuyU=";

  nativeBuildInputs = [
    pkg-config
@ -42,6 +43,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
    nodejs
    bun
    deno
+
+    writableTmpDirAsHomeHook
  ];

  checkFlags = [
--- a/pkgs/by-name/go/goldendict-ng/package.nix
+++ b/pkgs/by-name/go/goldendict-ng/package.nix
@ -23,13 +23,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "goldendict-ng";
-  version = "26.3.0";
+  version = "26.5.6";

  src = fetchFromGitHub {
    owner = "xiaoyifang";
    repo = "goldendict-ng";
-    tag = "v${finalAttrs.version}-Release.fce2b872";
-    hash = "sha256-DLo3dVoeib/lIp6jKeMyeREN6pHufa3HhyNIxtu3Q94=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Y/I03WqEkgg1O8AP6lAcf6H6Uys4SL6zAqx+zxMuNEM=";
  };

  strictDeps = true;
--- a/pkgs/by-name/hp/hplip/package.nix
+++ b/pkgs/by-name/hp/hplip/package.nix
@ -35,16 +35,21 @@
 let

  pname = "hplip";
-  version = "3.25.2";
+  version = "3.26.4";

  src = fetchurl {
-    url = "mirror://sourceforge/hplip/${pname}-${version}.tar.gz";
-    hash = "sha256-6HL/KOslF3Balfbhg576HlCnejOq6JBSeN8r2CCRllM=";
+    url = "mirror://sourceforge/hplip/hplip-${version}.tar.gz";
+    hash = "sha256-ucYSUnVPNbSiNzlsqJYeez4MVtt21mpnEre/PjDmlGM=";
  };

  plugin = fetchurl {
-    url = "https://www.openprinting.org/download/printdriver/auxfiles/HP/plugins/${pname}-${version}-plugin.run";
-    hash = "sha256-miz41WYehGVI27tZUjGlRIpctjcpzJPfjR9lLf0WelQ=";
+    url = "https://developers.hp.com/sites/default/files/2026-05/hplip-${version}-plugin.run";
+    # HTTP 403 otherwise
+    curlOptsList = [
+      "--user-agent"
+      "Mozilla/5.0 Gecko/20100101 Firefox/150.0"
+    ];
+    hash = "sha256-GZ94+K9/NolNcYDpCQljziVQp17HAfikujdmWpdG/fA=";
  };

  hplipState = replaceVars ./hplip.state {
@ -85,7 +90,7 @@ python3Packages.buildPythonApplication {
    sh "$curSrc" --noexec --keep
  '';

-  sourceRoot = "${pname}-${version}";
+  sourceRoot = "hplip-${version}";

  buildInputs = [
    libjpeg
--- a/pkgs/by-name/jo/jol/package.nix
+++ b/pkgs/by-name/jo/jol/package.nix
@ -6,14 +6,14 @@
  makeWrapper,
  nix-update-script,
 }:
-maven.buildMavenPackage rec {
+maven.buildMavenPackage (finalAttrs: {
  pname = "jol";
  version = "0.17";

  src = fetchFromGitHub {
    owner = "OpenJDK";
    repo = "jol";
-    tag = version;
+    tag = finalAttrs.version;
    hash = "sha256-ZJFuY2QYB8eUS3y3VRMGGwklCS93HHVkNe/dhyIx0SY=";
  };

@ -46,7 +46,7 @@ maven.buildMavenPackage rec {
      This makes JOL much more accurate than other tools relying on heap dumps, specification assumptions, etc.
    '';
    homepage = "https://openjdk.org/projects/code-tools/jol/";
-    changelog = "https://github.com/openjdk/jol/releases/tag/${version}";
+    changelog = "https://github.com/openjdk/jol/releases/tag/${finalAttrs.version}";
    license = with lib.licenses; [
      gpl2Plus
      classpathException20
@ -62,4 +62,4 @@ maven.buildMavenPackage rec {
    ];
    inherit (jre_minimal.meta) platforms;
  };
-}
+})
--- a/pkgs/by-name/kt/ktfmt/deps.json
+++ b/pkgs/by-name/kt/ktfmt/deps.json
@ -92,6 +92,10 @@
   "module": "sha256-wDgW20RCyzvDuEg3XZte4z0cjjmZnT6e/eVHzq8U20A=",
   "pom": "sha256-9sHbW2XrT34FtcQu6/fXwzBtwn8gRkGreobv9+UCsWs="
  },
+  "com/fasterxml/jackson/module#jackson-module-jaxb-annotations/2.17.2": {
+   "module": "sha256-JR4jRcce8k2uUpe84BAk2ESa3L6IJimArNCt1fiTil4=",
+   "pom": "sha256-L4BbIPMNTBlqQV+9HljEE1p71xh9LhnFae9Eo2dKjTs="
+  },
  "com/fasterxml/jackson/module#jackson-module-kotlin/2.12.7": {
   "module": "sha256-KFgSNtUkPvn4QIbqYSnl+onOmomANlBHJ+tP0gthWN8=",
   "pom": "sha256-n3uQJAkenbt/rP6uXhDF1a2TvRMste4UFlRfn6+Rf24="
@ -108,6 +112,9 @@
  "com/fasterxml/jackson/module#jackson-modules-base/2.12.7": {
   "pom": "sha256-EhnfADQxBTWu+hl6YsSgr7gjqIIu1Ch9F3kDElMmoVw="
  },
+  "com/fasterxml/jackson/module#jackson-modules-base/2.17.2": {
+   "pom": "sha256-rrMBBVHhN9CeuDhPO4PCQSXcOSwqmHIexorT/4TlWSU="
+  },
  "com/fasterxml/woodstox#woodstox-core/7.1.0": {
   "jar": "sha256-gSZpIKHNxHMGqKK0cmyZ7Imz+/McJHDk9eR32dhXyp8=",
   "pom": "sha256-+ZXFCx0gl18KjW8OUyK8jRPHiuPcGCcXdoQUlypmzIU="
@ -185,6 +192,9 @@
  "com/sun/activation#all/1.2.0": {
   "pom": "sha256-HYUY46x1MqEE5Pe+d97zfJguUwcjxr2z1ncIzOKwwsQ="
  },
+  "com/sun/activation#all/1.2.1": {
+   "pom": "sha256-NgiDv2RIbs7xYbjygvZQNTbdGmcNU6Coccj7IBcOZ5U="
+  },
  "com/sun/istack#istack-commons-runtime/3.0.7": {
   "jar": "sha256-ZEPhC6LiWfuCHZtr7PENtTFihfwwxTzsnXsZo4d+f98=",
   "pom": "sha256-bXBORQqBakW86Aa6IsIv6D2Ojc96cVF2A95jChcmgJ8="
@ -277,12 +287,21 @@
  "io/undertow#undertow-parent/2.3.18.Final": {
   "pom": "sha256-qpkXz8Zt5AQHOZ5vE12MJRtohHwusR+LnMdQmIRRZsw="
  },
+  "jakarta/activation#jakarta.activation-api/1.2.1": {
+   "pom": "sha256-QlhcsH3afyOqBOteCUAGGUSiRqZ609FpQvvlaf8DzTE="
+  },
  "jakarta/platform#jakarta.jakartaee-bom/9.1.0": {
   "pom": "sha256-35jgJmIZ/buCVigm15o6IHdqi6Aqp4fw8HZaU4ZUyKQ="
  },
  "jakarta/platform#jakartaee-api-parent/9.1.0": {
   "pom": "sha256-p3AsSHAmgCeEtXl7YjMKi41lkr8PRzeyXGel6sgmWcA="
  },
+  "jakarta/xml/bind#jakarta.xml.bind-api-parent/2.3.2": {
+   "pom": "sha256-FaVbfVN8n5lwrq0o0q+XwFn2X/YQL3a70p8SR92Kbfs="
+  },
+  "jakarta/xml/bind#jakarta.xml.bind-api/2.3.2": {
+   "pom": "sha256-tTeziNurTMBpC50vsMdBJNZyUxc0VnrPblMTDqsTGtY="
+  },
  "javax/activation#javax.activation-api/1.2.0": {
   "jar": "sha256-Q/3vC1ts6zGwQksgi5MMdKtY+sLO63s/b9OuuLXKQ5M=",
   "pom": "sha256-2ikm88i+iYZDzBCs3sbeCwNRpX+yc1dw+gF3sGrecbk="
@ -399,6 +418,9 @@
   "jar": "sha256-phxI1VPvrXi8Af/8SsUovruuZMuuwXCypeOc9h61Gr4=",
   "pom": "sha256-TpAuxVb8ZZi0HClS7BVz7cgVA35zMOxJIuq2GUImhuI="
  },
+  "org/eclipse/ee4j#project/1.0.2": {
+   "pom": "sha256-dJWgenl+iOQ8O8GodCG9ix/FXjIpH6GOTjLYAx3chz8="
+  },
  "org/eclipse/ee4j#project/1.0.5": {
   "pom": "sha256-kWtHlNjYIgpZo/32pk2+eUrrIzleiIuBrjaptaLFkaY="
  },
@ -513,77 +535,71 @@
   "module": "sha256-VFW1pwpMpqldNFHGoh+QebqzFS8sSgTRU5rwBrnMulY=",
   "pom": "sha256-Z0Am3mN1U2SDXSRoRcFVSgRa57qLFCzL7Qx5yYWezZk="
  },
-  "org/jetbrains/kotlin#abi-tools-api/2.2.0": {
-   "jar": "sha256-hxeDiGZkLjvdR+yeAmC70wdujH6GvgXirahoMesq+Qo=",
-   "pom": "sha256-UwmmvuGytgrDtfXTXMS2zDiKFzOA17jeqgIJ6wgUnpA="
+  "org/jetbrains/kotlin#abi-tools-api/2.3.20": {
+   "jar": "sha256-U2hfV4OwSQaDiY11Wrrk1Bi26DugYTSFiv3ctZRYmek=",
+   "pom": "sha256-qIbJ/X8rlmlFf+wCHxnc8V8EY+DbS9rVOuGBJTZsxvk="
  },
-  "org/jetbrains/kotlin#fus-statistics-gradle-plugin/2.2.0": {
-   "module": "sha256-5d0u34ivdW30d1ra13xS0AkDUav1EZLPGdP+YsZnyrg=",
-   "pom": "sha256-Qejc6FcbX7TuAzURlYL+IoBQqP8ZPiRg1SmMX5Dj1nU="
+  "org/jetbrains/kotlin#fus-statistics-gradle-plugin/2.3.20": {
+   "module": "sha256-bNjWSw5lN3kE8wb2qFja/ZMcQTUkD4RMk9UpTumP6Dk=",
+   "pom": "sha256-SgpFTor25QOv5ngwoYVjubaA3u67GhcGoNe0S8UHQKE="
  },
-  "org/jetbrains/kotlin#fus-statistics-gradle-plugin/2.2.0/gradle813": {
-   "jar": "sha256-0M+f8jrTjCEO7QzCWlExWjhOYf3BWlP+uGwAvuaRqug="
+  "org/jetbrains/kotlin#fus-statistics-gradle-plugin/2.3.20/gradle813": {
+   "jar": "sha256-pPEKPw6l3dH1VaT3BuCep/VSs8hSK7EAY2HdMG4152o="
  },
-  "org/jetbrains/kotlin#kotlin-build-statistics/2.2.0": {
-   "jar": "sha256-klfy37x4iCf2AnUPrijX6UWTLq2QQVP3f09sTE2Y5RE=",
-   "pom": "sha256-8Uct+ZZDqe4VJrFEka0vaNz8Zunr9WywFuSFzaj69sI="
+  "org/jetbrains/kotlin#kotlin-build-statistics/2.3.20": {
+   "jar": "sha256-ptJ7PINhdlLdBlYG+Yz1nPviY/jCDr5OvVpvJonrDU8=",
+   "pom": "sha256-nQqNf/FyPV1y00ldVVc9jTxrd3TWHYBXlxT3nCQmX48="
  },
-  "org/jetbrains/kotlin#kotlin-build-tools-api/2.2.0": {
-   "jar": "sha256-HezZmyKUN3QfNqAIxnip2PrjBxbodyFRMI9W9owQ844=",
-   "pom": "sha256-I6QFgttMPijHq6X8fpZHvI1e/d+dAFWp5CyaCJbVzjM="
+  "org/jetbrains/kotlin#kotlin-build-tools-api/2.3.20": {
+   "jar": "sha256-IvGrIjhUuUkJn2slnO9UHVtYo2Q9+aScRXfGPEFuhDs=",
+   "pom": "sha256-G14LLDaQXcL1XgpLeBKuY+MSXe/PaG0sD0kPg7c9nV4="
  },
-  "org/jetbrains/kotlin#kotlin-compiler-runner/2.2.0": {
-   "jar": "sha256-kHBq6Gcd77oBQI3RxUG6MJEskHDN8d3aGMUero1nkwQ=",
-   "pom": "sha256-iQfZfcaLv0CgrmZ5RZAvDtwWYdvPdDuuDf2nw7mp1Mg="
+  "org/jetbrains/kotlin#kotlin-compiler-runner/2.3.20": {
+   "jar": "sha256-wGnzCkA75wyBUviqnyXsy6GI7q1UJjrgKvFEIUN6Igg=",
+   "pom": "sha256-jYTqDt1gs4vOpWLeUXgVKiZxqaAFPWcPkxRSs9sBMig="
  },
-  "org/jetbrains/kotlin#kotlin-daemon-client/2.2.0": {
-   "jar": "sha256-ISk9oBbkuhKhKKwm/ZIKdOi4f1dM+bxDxgo9LnZFp64=",
-   "pom": "sha256-HESKBvDKmGiVi+CHesnof8TgG8uTaHp8rBLTxNCd7uY="
+  "org/jetbrains/kotlin#kotlin-daemon-client/2.3.20": {
+   "jar": "sha256-xxp8G+j7/wTgr0XJ7oy3ph2JU7ymuL8iWlcZxyWpC0Q=",
+   "pom": "sha256-nnyLgHJBF/cqrOZfa+SNg224/Dl1OtlR8ruQhi1+cIA="
  },
-  "org/jetbrains/kotlin#kotlin-gradle-plugin-annotations/2.2.0": {
-   "jar": "sha256-nRsH2uVVnD/JwtzhW9hcNtwedt/zd/ExJIm9ZmDBZUQ=",
-   "pom": "sha256-uvxt1O1fRcLhvCgXfCxkDie/t8WQEZ6GW7nkCZOLrEA="
+  "org/jetbrains/kotlin#kotlin-gradle-plugin-annotations/2.3.20": {
+   "jar": "sha256-4WYu10cyK2P2HU+t2Zq3gQTEXq8JwRp4mGJBXoHBjcQ=",
+   "pom": "sha256-aP+Cf8E1DZPw1nM2jAZHm2K31eXDBlipWM+TBmgx6Nk="
  },
-  "org/jetbrains/kotlin#kotlin-gradle-plugin-api/2.2.0": {
-   "jar": "sha256-u6au4h0YX3LfiW80jw6nsRdcEc1mNzeZid+JnLSMl+E=",
-   "module": "sha256-AmOgtdQFEGmmFjJYOK5CGmxNAG3JsVWnpCkmYIiAC6c=",
-   "pom": "sha256-iG8sRJ+dvmQc0kPxk3FNegQlNrMCrEHHLVYOWmZmDIg="
+  "org/jetbrains/kotlin#kotlin-gradle-plugin-api/2.3.20": {
+   "module": "sha256-04UBEP9ajrcP7S1Xi0X7B+vESvaika5M88eUMMZRKLo=",
+   "pom": "sha256-AdVSITSRyFPVb4frdIEwON+e4dhekIaqN70GY7JJb4g="
  },
-  "org/jetbrains/kotlin#kotlin-gradle-plugin-api/2.2.0/gradle813": {
-   "jar": "sha256-u6au4h0YX3LfiW80jw6nsRdcEc1mNzeZid+JnLSMl+E="
+  "org/jetbrains/kotlin#kotlin-gradle-plugin-api/2.3.20/gradle813": {
+   "jar": "sha256-ybwX32m/OZB8WXweGb7EtHnHWqx1+/1jIeNEW0lxLog="
  },
-  "org/jetbrains/kotlin#kotlin-gradle-plugin-idea-proto/2.2.0": {
-   "jar": "sha256-QY4hdjJ20qlGFr6ZCCanRdWdTF2WY48LviERDSxWSTs=",
-   "pom": "sha256-w5AgQre9S2t3oY8+4f6ol9N7vroloD0Uqe7//hWCXn0="
+  "org/jetbrains/kotlin#kotlin-gradle-plugin-idea-proto/2.3.20": {
+   "jar": "sha256-5Cicv5/0lAfwQd3GM24bV3pspM8r4dKjEzgnHBPu0+0=",
+   "pom": "sha256-9veHObqf4nEunwyeW8T16TcZzP6pW0fC9JslC+F2NX4="
  },
-  "org/jetbrains/kotlin#kotlin-gradle-plugin-idea/2.2.0": {
-   "jar": "sha256-7JacXwsJn4I4RiMiOPm9ZPPTdB5i6pBQrS5DL6150KA=",
-   "module": "sha256-r+m2AUJwBIVJuyAySjGdYkoFoLnmtBfmm2kHldfPDUs=",
-   "pom": "sha256-/ewxpJDZDsNuf5qj12xVDgqVq9Otg3lTvUn6E9pwFQ0="
+  "org/jetbrains/kotlin#kotlin-gradle-plugin-idea/2.3.20": {
+   "jar": "sha256-lS5zlI4qINOYwmuHprtwzPZkGPuvFSfDUVsYjqnUvWA=",
+   "module": "sha256-b7XZcwCl5Vmv1Nn/msA1bE2Wb31pS2Yvrhaf2HQhUx4=",
+   "pom": "sha256-WROHIVGNgqND99wvCRK3BJjT7vM2PJ66wiCssPyTjsw="
  },
-  "org/jetbrains/kotlin#kotlin-gradle-plugin-model/2.2.0": {
-   "jar": "sha256-Z6FKxCSqGWo0ax3Jn0QqbVc0WCrXt+epzN8oqc0rIJs=",
-   "module": "sha256-LC4w2DDqdpq6iX9PlvGeHoLY1qI/UzaJugn0GTMASYY=",
-   "pom": "sha256-bBzMOzcGY8KHIUn12briW/fpLqcVFepzxSlwlzbKMYk="
+  "org/jetbrains/kotlin#kotlin-gradle-plugin/2.3.20": {
+   "module": "sha256-lVUmc7gbNXitmy86/xRUtjzoBsb9SrfGBJIx6GQKtHE=",
+   "pom": "sha256-EcMjwt2KgE6fWOBHwsAYZLKgHcDYEys2PApDEiFbwJs="
  },
-  "org/jetbrains/kotlin#kotlin-gradle-plugin/2.2.0": {
-   "module": "sha256-Y3w/yuVyOnQnAmwO2z3GeW3T/nmQ3CKG1PdJbt9dKYU=",
-   "pom": "sha256-E2FqOVx9n8Xc7iclKn9ocX2MaZTNEldL0dsxelGG1yE="
+  "org/jetbrains/kotlin#kotlin-gradle-plugin/2.3.20/gradle813": {
+   "jar": "sha256-RuFu4mWU9ID+y5LJbarjdTDoNQJreON+8yUelX8D9vs="
  },
-  "org/jetbrains/kotlin#kotlin-gradle-plugin/2.2.0/gradle813": {
-   "jar": "sha256-g1xNwYoHMl9XkwUMfy52XSNcWWdJVo5HtZe0Sdhnlo0="
+  "org/jetbrains/kotlin#kotlin-gradle-plugins-bom/2.3.20": {
+   "module": "sha256-+CvXZF0MPv609PZVIKPGWz6MMCsIMyIDegABuHsC6ZA=",
+   "pom": "sha256-3WuRkZfhMv5x3axw9vxdj65/Und6/YN7FN6HG4wKVAA="
  },
-  "org/jetbrains/kotlin#kotlin-gradle-plugins-bom/2.2.0": {
-   "module": "sha256-ur08SXopcd/GjlAlT/lwZak6Ixg+jto8OY+E9gzsErI=",
-   "pom": "sha256-2cRaL1cw6E6bhPpCxkoYdNy6ZmjyEsT+KXvqJdwAeHg="
+  "org/jetbrains/kotlin#kotlin-klib-commonizer-api/2.3.20": {
+   "jar": "sha256-vpN3SFQS0A8B54KZyzC+SAJZHCcwNCtuva/AiU91J0M=",
+   "pom": "sha256-IbFbpb1i0h1Ta7egyMtnQ1cfwPQwklSKQjWybyodIgs="
  },
-  "org/jetbrains/kotlin#kotlin-klib-commonizer-api/2.2.0": {
-   "jar": "sha256-8FcCw6bq725+hCNTvmT1jTMHGX4Vp/F5gE08VQcZ7mk=",
-   "pom": "sha256-6R0DUNf9G+4pyP9OP9bxcZBS7P6V98wXZtnVwnD3iQk="
-  },
-  "org/jetbrains/kotlin#kotlin-native-utils/2.2.0": {
-   "jar": "sha256-pOlvczba6EnznPK2NKU20CoqvfARS3M5Wty4yIGFDp4=",
-   "pom": "sha256-DafPXrsb0m4u/IkRhLzqM8tPKxwpNYEnr1MGHNataZY="
+  "org/jetbrains/kotlin#kotlin-native-utils/2.3.20": {
+   "jar": "sha256-QxnCdkeV773/K3julUVRV9evC5FVaYuqG6Uqar46vy0=",
+   "pom": "sha256-LAp+ADViCIXUN+fxJidEdbpYqiJC+1279D+R8gyvpwg="
  },
  "org/jetbrains/kotlin#kotlin-stdlib-common/2.0.21": {
   "module": "sha256-b134r2M2AKa5z7D8x2SvPVEZ83Zndne5G2rugWsdMKs=",
@ -605,24 +621,24 @@
   "module": "sha256-gf1tGBASSH7jJG7/TiustktYxG5bWqcpcaTd8b0VQe0=",
   "pom": "sha256-/LraTNLp85ZYKTVw72E3UjMdtp/R2tHKuqYFSEA+F9o="
  },
-  "org/jetbrains/kotlin#kotlin-tooling-core/2.2.0": {
-   "jar": "sha256-dAFOxPPveM59p+Pmlk8sUmoxIdXFj++MopeeXzRFgvQ=",
-   "pom": "sha256-Fiq+zmN9Egvzs1mfJIETV3zey68Q1bInq3cFLmYykpM="
+  "org/jetbrains/kotlin#kotlin-tooling-core/2.3.20": {
+   "jar": "sha256-NnFCeBKZvA+RIMHe7A5ik0oa+ep/AaqpxaU1TcXY19k=",
+   "pom": "sha256-R+Ou/SS1vmLYB7bLzXnFW4P5S1XP4Y79xuM84RvxkOQ="
  },
-  "org/jetbrains/kotlin#kotlin-util-io/2.2.0": {
-   "jar": "sha256-h//zwBlwqqkBGr3lZbtSoXmqbckDjFh4koHtK2jVji0=",
-   "pom": "sha256-NcfaTe0E3/GCIeDzgPo/NhIOvq2hOYOmEQtGWWaKbr0="
+  "org/jetbrains/kotlin#kotlin-util-io/2.3.20": {
+   "jar": "sha256-DnbnRx6RxT6mjS0k7x8p+1kqxfuw0dEPqpFkMO/z2so=",
+   "pom": "sha256-lcKKgo/B8eWeZWOCR6ZPdm2B2LWfbY3r7y0YoMwyH4k="
  },
-  "org/jetbrains/kotlin#kotlin-util-klib-metadata/2.2.0": {
-   "jar": "sha256-nOOw3gU8uf8HoPcXyhQvKQp05NGdkzLbImq+D+thyB4=",
-   "pom": "sha256-XVJ2wbYor7xCBZ80CoTe/Uv7XroYJm3zdDYH5XftX4c="
+  "org/jetbrains/kotlin#kotlin-util-klib-metadata/2.3.20": {
+   "jar": "sha256-qJlOC8poRt+xn0WMTMFdexN3nKGw2fNIgLX/LCorc7M=",
+   "pom": "sha256-jxApEHGu+rvY5m/5r3dDojiB1pxqryjhNhbMDpW9F7c="
  },
-  "org/jetbrains/kotlin#kotlin-util-klib/2.2.0": {
-   "jar": "sha256-FPB+vZrfvk6F+06/MSJSULL8P1Qo7OQ31O1j7D+prE0=",
-   "pom": "sha256-NU7YchvXXwfcCyQbiFg+7oLCTZIdN+lrctmNpi1ISEo="
+  "org/jetbrains/kotlin#kotlin-util-klib/2.3.20": {
+   "jar": "sha256-lWK407egS+uisUwFZx5xOFnqVLvAohB+ZbK88nP6hEg=",
+   "pom": "sha256-WlhMPMK6O0HR5c1+eiCDV2wbjDl6ebuBY2dtjvew6hc="
  },
-  "org/jetbrains/kotlin/jvm#org.jetbrains.kotlin.jvm.gradle.plugin/2.2.0": {
-   "pom": "sha256-kALsce2lmj+9LC/mUmCaz3lOCHEbETyXdeZHrzdyOqo="
+  "org/jetbrains/kotlin/jvm#org.jetbrains.kotlin.jvm.gradle.plugin/2.3.20": {
+   "pom": "sha256-OVGM+ut/cxup+D2UpCkwR/U6Th+1KpF1cFddfYzWs04="
  },
  "org/jetbrains/kotlinx#kotlinx-coroutines-bom/1.7.3": {
   "pom": "sha256-Tl0ZAOY3nvP1lw0EqPMFKa3IL4WejMEHwhzoFJ72ZsQ="
@ -1103,6 +1119,36 @@
   "jar": "sha256-15lSLVearAaxcGA/jwgPbjJI2twB+WUs3X6nvDGMIc4=",
   "pom": "sha256-1WEbRtjJqHPjFgh91raE3fabdoyAhDraiyKiOuvGIwE="
  },
+  "org/bouncycastle#bcpg-jdk18on/1.80": {
+   "jar": "sha256-N5mg1TURuGB4CvQ8RK6OBRmvq7JjGVr0AXT0YxLNWL0=",
+   "pom": "sha256-B6JGwq2vtih4OhroSsGNTfQCXfBq42NN/pOHq5T56nQ="
+  },
+  "org/bouncycastle#bcpkix-jdk18on/1.80": {
+   "jar": "sha256-T0umqSYX6hncGD8PpdtJLu5Cb93ioKLWyUd3/9GvZBM=",
+   "pom": "sha256-pKEiETRntyjhjyb7DP1X8LGg18SlO4Zxis5wv4uG7Uc="
+  },
+  "org/bouncycastle#bcprov-jdk18on/1.80.2": {
+   "jar": "sha256-szIn8H3OJk2vGqwueY7xCaSQHzGr7axTY1dG3ZNnnTs=",
+   "pom": "sha256-EqUFpxejvHZH99jt6ndzLJxty1PE32Kju1i3pUIooo8="
+  },
+  "org/bouncycastle#bcutil-jdk18on/1.80.2": {
+   "jar": "sha256-vHjTLX/7FB7ifk+3ffBCWdhCyJnn6Or5EvmQ1yU707Q=",
+   "pom": "sha256-Joi+GvSZ1SUJYRTML1HHp6TKI8PScxe3HhjByWvsA9E="
+  },
+  "org/bouncycastle/bcprov-jdk18on/maven-metadata": {
+   "xml": {
+    "groupId": "org.bouncycastle",
+    "lastUpdated": "20260515080931",
+    "release": "1.84"
+   }
+  },
+  "org/bouncycastle/bcutil-jdk18on/maven-metadata": {
+   "xml": {
+    "groupId": "org.bouncycastle",
+    "lastUpdated": "20260515080933",
+    "release": "1.84"
+   }
+  },
  "org/checkerframework#checker-compat-qual/2.5.5": {
   "jar": "sha256-EdE0skXpysxHRRTS1mtbhhj4A5oUZc3FW7wLNOAAi3o=",
   "pom": "sha256-QvIevZGDvgSe5a/IIrNFQDpdp2QDeHVzSgObDW4DU74="
@ -1176,45 +1222,65 @@
   "module": "sha256-iA7+arXz1MMGrsNVkBQ+5Bhujyuzw6yVKaxTZAVmetY=",
   "pom": "sha256-SWN/vvKBVW4wjx0Gz8EV00p2q5OvfpXkiSYnNHwov5E="
  },
-  "org/jetbrains/kotlin#abi-tools-api/2.2.0": {
-   "jar": "sha256-hxeDiGZkLjvdR+yeAmC70wdujH6GvgXirahoMesq+Qo=",
-   "pom": "sha256-UwmmvuGytgrDtfXTXMS2zDiKFzOA17jeqgIJ6wgUnpA="
+  "org/jetbrains/kotlin#abi-tools-api/2.3.20": {
+   "jar": "sha256-U2hfV4OwSQaDiY11Wrrk1Bi26DugYTSFiv3ctZRYmek=",
+   "pom": "sha256-qIbJ/X8rlmlFf+wCHxnc8V8EY+DbS9rVOuGBJTZsxvk="
  },
-  "org/jetbrains/kotlin#abi-tools/2.2.0": {
-   "jar": "sha256-Pngn8qdqgpa3vvfzyzrPxJJA1gtTNwidRHyJIfbgi00=",
-   "pom": "sha256-avzEJec8EEvnrSCQF1u1wgHGQWV1sdX1suMFEDl6o1c="
+  "org/jetbrains/kotlin#abi-tools/2.3.20": {
+   "jar": "sha256-R9fBgRPZhYUGWrUky6HEcLTDaTB2l8qdHIEOULk9C9E=",
+   "pom": "sha256-Pi8inRHuIgaFPTAL/l0R3dzpYFqJ5cmvrwa3Ij0Zh1c="
  },
-  "org/jetbrains/kotlin#kotlin-build-tools-api/2.2.0": {
-   "jar": "sha256-HezZmyKUN3QfNqAIxnip2PrjBxbodyFRMI9W9owQ844=",
-   "pom": "sha256-I6QFgttMPijHq6X8fpZHvI1e/d+dAFWp5CyaCJbVzjM="
+  "org/jetbrains/kotlin#kotlin-build-tools-api/2.3.20": {
+   "jar": "sha256-IvGrIjhUuUkJn2slnO9UHVtYo2Q9+aScRXfGPEFuhDs=",
+   "pom": "sha256-G14LLDaQXcL1XgpLeBKuY+MSXe/PaG0sD0kPg7c9nV4="
  },
-  "org/jetbrains/kotlin#kotlin-build-tools-impl/2.2.0": {
-   "jar": "sha256-SofzwCcvFyhdYOmGQ+whn1Ppta1aI/O8TFQ6hkT4bxc=",
-   "pom": "sha256-6DgEIFq2l7pyL0YiprG1GS70ejDL35ApdwFJQ3hQTv8="
+  "org/jetbrains/kotlin#kotlin-build-tools-compat/2.3.20": {
+   "jar": "sha256-RMMHtO3UysUflgqBNBEtZkyTB2cAzaXoZulNmkKWNA4=",
+   "pom": "sha256-rpC+JesEdhCNlo6+Mqjd9SXhQIhYj6BUc9sSgVoPG3Q="
+  },
+  "org/jetbrains/kotlin#kotlin-build-tools-cri-impl/2.3.20": {
+   "jar": "sha256-VOztYw8oEkzP4uRk5srMKB5SiopQqJclchVUyWk1SP4=",
+   "pom": "sha256-5zeMZYHvXw4stA46TOxR0rlj5iVkWpK2fqCVJa+XxMM="
+  },
+  "org/jetbrains/kotlin#kotlin-build-tools-impl/2.3.20": {
+   "jar": "sha256-loG8IWSovZ9t30wIXPSoNrktJ1BmZ9c7q59thVM2yRA=",
+   "pom": "sha256-gswavl5j0/5nV+eXKE8F25r9fq3D6D0ROcOlW2TUstU="
  },
  "org/jetbrains/kotlin#kotlin-compiler-embeddable/2.2.0": {
   "jar": "sha256-svdD6luhL2ng815djUYGnXTI4oYQh1SKfg4Up4S8TPE=",
   "pom": "sha256-FqFd0ZfPJBNJT3iMuWFE2aFGJnw9b38cFbejweBSNGo="
  },
-  "org/jetbrains/kotlin#kotlin-compiler-runner/2.2.0": {
-   "jar": "sha256-kHBq6Gcd77oBQI3RxUG6MJEskHDN8d3aGMUero1nkwQ=",
-   "pom": "sha256-iQfZfcaLv0CgrmZ5RZAvDtwWYdvPdDuuDf2nw7mp1Mg="
+  "org/jetbrains/kotlin#kotlin-compiler-embeddable/2.3.20": {
+   "jar": "sha256-l2+YnQtfXYDo6KitS3PaC/wn/dllufo4Nisr557MEzc=",
+   "pom": "sha256-DDWu7jcvB1FOvtN7lAe44RgdFCd1UTnlzudxnKBf5+g="
  },
-  "org/jetbrains/kotlin#kotlin-daemon-client/2.2.0": {
-   "jar": "sha256-ISk9oBbkuhKhKKwm/ZIKdOi4f1dM+bxDxgo9LnZFp64=",
-   "pom": "sha256-HESKBvDKmGiVi+CHesnof8TgG8uTaHp8rBLTxNCd7uY="
+  "org/jetbrains/kotlin#kotlin-compiler-runner/2.3.20": {
+   "jar": "sha256-wGnzCkA75wyBUviqnyXsy6GI7q1UJjrgKvFEIUN6Igg=",
+   "pom": "sha256-jYTqDt1gs4vOpWLeUXgVKiZxqaAFPWcPkxRSs9sBMig="
+  },
+  "org/jetbrains/kotlin#kotlin-daemon-client/2.3.20": {
+   "jar": "sha256-xxp8G+j7/wTgr0XJ7oy3ph2JU7ymuL8iWlcZxyWpC0Q=",
+   "pom": "sha256-nnyLgHJBF/cqrOZfa+SNg224/Dl1OtlR8ruQhi1+cIA="
  },
  "org/jetbrains/kotlin#kotlin-daemon-embeddable/2.2.0": {
   "jar": "sha256-omzI4thhkZfMTRFb6ndm6aqODx54duoETuG58wVlRgE=",
   "pom": "sha256-vSrk4skWBWVKilUn2nV/KyJ2WA0fXq6+q9M0OvjVxGc="
  },
-  "org/jetbrains/kotlin#kotlin-klib-commonizer-embeddable/2.2.0": {
-   "jar": "sha256-KEF+GZd6pJjcCJk6riAf/CG5Tp/0IvUiUi1gj2BrkgY=",
-   "pom": "sha256-DDfkh0Gs5zKbymh/4hRTg4vRn+ZhE1uE5o5dBkM7ZIE="
+  "org/jetbrains/kotlin#kotlin-daemon-embeddable/2.3.20": {
+   "jar": "sha256-iHC6uEC4CHyWxN3AYIi0rt9RMcQIrzZ0MGME8flq8/Q=",
+   "pom": "sha256-YVQOWzoywLEZYkSWZZJMbNdVTqmu4IVb2OT1t/YQoKs="
  },
-  "org/jetbrains/kotlin#kotlin-metadata-jvm/2.2.0": {
-   "jar": "sha256-UBIirn1jUn5V8uXmRfGNTv8sGQdMhbm8BVhm4+0rF78=",
-   "pom": "sha256-Vav6RtrO+hAxYMwE4MUeVgq6DKIyAD/bz7TtjN05m0U="
+  "org/jetbrains/kotlin#kotlin-klib-abi-reader/2.3.20": {
+   "jar": "sha256-XAo6pyBAjdL2PnYIdd0/Z9t+0Ws/AAKA4IgcYHDOT2M=",
+   "pom": "sha256-ui+7W5OjnlGraeWCJPGNdxYqDrYDkIbl9lVne8O3xno="
+  },
+  "org/jetbrains/kotlin#kotlin-klib-commonizer-embeddable/2.3.20": {
+   "jar": "sha256-4FeWYwUcbaKyPZX8LDpBKnYnnbg6eQHuhqfjrPbnHjQ=",
+   "pom": "sha256-shhlfghlbEa018djdux6BOoGAJpGLTpkcBFvr92OPss="
+  },
+  "org/jetbrains/kotlin#kotlin-metadata-jvm/2.3.20": {
+   "jar": "sha256-FyZLlpD+7TSqi459VW+y55UfaABGLxFyQ/upYgEBT30=",
+   "pom": "sha256-DF/7/5dG1Ca56GasBWviiSizGKJc3FaDkIHsRJspzZc="
  },
  "org/jetbrains/kotlin#kotlin-reflect/1.6.10": {
   "jar": "sha256-MnesECrheq0QpVq+x1/1aWyNEJeQOWQ0tJbnUIeFQgM=",
@ -1228,21 +1294,25 @@
   "jar": "sha256-Ttl/0eDJux0JSO1eY8yRRWMTpZUYKVuSssFRSu9VYVA=",
   "pom": "sha256-5QdIv0Z09lRgPnsbuDBjTsmevZwzDeukytzuwHZ8u1Y="
  },
-  "org/jetbrains/kotlin#kotlin-scripting-common/2.2.0": {
-   "jar": "sha256-fJrISZ+pGyAep4NlN8Yl3VKoJUnlfms/F1zAx56atgQ=",
-   "pom": "sha256-1M1vjH2tiOZ9iVzT23qNTH3I6N3Y6WeOH1619gHZsO0="
+  "org/jetbrains/kotlin#kotlin-script-runtime/2.3.20": {
+   "jar": "sha256-b8232m5lz4zEPlqrq5S9zEiCXnkzaG+KG/aU64j44A4=",
+   "pom": "sha256-ZgmWdnA6CB/ZrEMTlmWIPlwUUCC2QHWd4FOdiRb/JH8="
  },
-  "org/jetbrains/kotlin#kotlin-scripting-compiler-embeddable/2.2.0": {
-   "jar": "sha256-ksfW7HxfBdisAcN+dHrGd9iS6ZusDeXlFmg7jzZAdys=",
-   "pom": "sha256-VjapUSxI/NqPgm+ypKwXPCnW6zV0ZHE9VNJaTUbsbBM="
+  "org/jetbrains/kotlin#kotlin-scripting-common/2.3.20": {
+   "jar": "sha256-tMI52HsjvhgvBb9Xz16B+V1wv370qYnrmLczicbryJ8=",
+   "pom": "sha256-h+/vFa4RjxNDUmPrEJcAZGD7qDlph340uKcvDjPIOsk="
  },
-  "org/jetbrains/kotlin#kotlin-scripting-compiler-impl-embeddable/2.2.0": {
-   "jar": "sha256-HSbL3a7rb/1FgIU5bs6gsID8Io/gBtz4MD2ldxHzN0U=",
-   "pom": "sha256-oeMpM4wq8LRweB0ECGnpsZdS+KTesi9D9qiR68dPH4I="
+  "org/jetbrains/kotlin#kotlin-scripting-compiler-embeddable/2.3.20": {
+   "jar": "sha256-vVX49hvUHOxSllbC1HeEvLpawmDpT0FWwnLDFJZu71k=",
+   "pom": "sha256-1l8YaBd9zkuKkv+93bVrFzH5+66IyOcw7XvLcAy7soo="
  },
-  "org/jetbrains/kotlin#kotlin-scripting-jvm/2.2.0": {
-   "jar": "sha256-YKjHQtYfRPIxH73IqGt2fRcboJ2XvnLWukUNN/fj/b8=",
-   "pom": "sha256-dii0nV53BennadESYAZtmmlXPW2Av4Iw0FRvWo54yJ4="
+  "org/jetbrains/kotlin#kotlin-scripting-compiler-impl-embeddable/2.3.20": {
+   "jar": "sha256-gG/WOzvOxea17rGghD1qsJTVV4aoRl5HSiQ5KVocCiU=",
+   "pom": "sha256-xKkTo4XzTjKlbyBd8XoI3U4RfDBsV+XkfcXUlSPw6+E="
+  },
+  "org/jetbrains/kotlin#kotlin-scripting-jvm/2.3.20": {
+   "jar": "sha256-cEfOA1P0kSXDx0Z5LU92wyZde3L+YmlLfuwHW7oCUow=",
+   "pom": "sha256-B8Ba4tHs4K4e1mAQ7TGNnN3LNYcEbGM8GGvRTM8EYdU="
  },
  "org/jetbrains/kotlin#kotlin-stdlib-common/1.8.20": {
   "pom": "sha256-YFWRuJs3ISfmspxpMl+i9qjEb0aMRdCUEOeOtZ/IChc="
@ -1269,21 +1339,29 @@
   "module": "sha256-pbmP3NnbAX1ULhlyJdzuGNZYpW3h2yzEHhMZbWsXaaQ=",
   "pom": "sha256-jDyCEAfBNBFVhzm589U4LrgVUds4lc/7iVYeVsD03BY="
  },
-  "org/jetbrains/kotlin#kotlin-stdlib/2.2.0/all": {
-   "jar": "sha256-4jAPqlnJNSk9q7Chg9LmEIqbARxCcHbD97oQ0ktzugo="
+  "org/jetbrains/kotlin#kotlin-stdlib/2.3.20": {
+   "jar": "sha256-CuElBKUEDrrzdwOQhINCDRpWJN0dk/NXZl+Md8hIoB4=",
+   "module": "sha256-9Os0T8TR46KK4WwIbsPkL1I3O0ZtQwgYL7OG45LA76M=",
+   "pom": "sha256-yDwC2afi6VRzBJHDPC8dwDwnZi4ntWbsK0TS0Bhjm5g="
  },
-  "org/jetbrains/kotlin#kotlin-test-junit/2.2.0": {
-   "jar": "sha256-9F7TLnIdkB08voPs5/QcmFM7NBVRhjaKeb/cZn5DPc4=",
-   "module": "sha256-n6+SISVQscjI0TBYtXXn6nACioWDFxtKZI076Rn4TuM=",
-   "pom": "sha256-hc82imSEEI+R1zdgEJBuHO4AvDzhv3lzSVWGz8pqDf4="
+  "org/jetbrains/kotlin#kotlin-test-junit/2.3.20": {
+   "jar": "sha256-ocfwKcBEVT8dQl7FgQynmXMl6MGB/pLM4M8NSisL5yc=",
+   "module": "sha256-P4OnSuo3+9ZdUyNUqDjhhgGmXRgVodYDR7FJ/5bpmDo=",
+   "pom": "sha256-+u+Tgw4+2e1b1/EumqtCjuHpYoG6xH9PIkXmKrjRdew="
  },
  "org/jetbrains/kotlin#kotlin-test/2.2.0": {
   "jar": "sha256-jbF1o/Vs8Tnr34k28pPOWmSha1KgQIgE4OwHfohI6zI=",
   "module": "sha256-VKfhwH1Wew4MfZE5V563Qe0H4N5bWgx/86V6017mWjw=",
   "pom": "sha256-cBlAy7cIWLKmC6xeNyqmsKciVI0c3QrVtSU6RmH6R2M="
  },
-  "org/jetbrains/kotlin#kotlin-test/2.2.0/all": {
-   "jar": "sha256-ptjE3eggYYEtrAlyi75/forfL5KDNfM6wjPzS42iG2c="
+  "org/jetbrains/kotlin#kotlin-test/2.3.20": {
+   "jar": "sha256-1snM+C9n5s9/2vngzqQZ2sTfpYYgoWU9PbpF9USiiaw=",
+   "module": "sha256-HkVtJGsHORSGHhYzMNNvg4OhZLBnZ5ZqVJ7N5DfuBJY=",
+   "pom": "sha256-XU8LL1JZAqBG392bZlSk/ntsnsSct7hauDFcDv9bc7E="
+  },
+  "org/jetbrains/kotlin#kotlin-tooling-core/2.3.20": {
+   "jar": "sha256-NnFCeBKZvA+RIMHe7A5ik0oa+ep/AaqpxaU1TcXY19k=",
+   "pom": "sha256-R+Ou/SS1vmLYB7bLzXnFW4P5S1XP4Y79xuM84RvxkOQ="
  },
  "org/jetbrains/kotlinx#kotlinx-coroutines-bom/1.7.3": {
   "pom": "sha256-Tl0ZAOY3nvP1lw0EqPMFKa3IL4WejMEHwhzoFJ72ZsQ="
--- a/pkgs/by-name/kt/ktfmt/package.nix
+++ b/pkgs/by-name/kt/ktfmt/package.nix
@ -10,13 +10,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "ktfmt";
-  version = "0.61";
+  version = "0.63";

  src = fetchFromGitHub {
    owner = "facebook";
    repo = "ktfmt";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-WY3d25c8VLsgeNBV/lSlOL+C3XtM9lfRYqMz3Z0mT3s=";
+    hash = "sha256-wAnlUEPFyilAbEXN6DGXHXeYfZgx2tlp4vDENP4O2Hw=";
  };

  patches = ./remove-idea-plugin.patch;
--- a/pkgs/by-name/li/libkrunfw/package.nix
+++ b/pkgs/by-name/li/libkrunfw/package.nix
@ -10,6 +10,7 @@
  perl,
  elfutils,
  python3,
+  buildPackages,
  variant ? null,
 }:

@ -57,6 +58,7 @@ stdenv.mkDerivation (finalAttrs: {

  makeFlags = [
    "PREFIX=${placeholder "out"}"
+    "STRIP=${stdenv.cc.targetPrefix}strip"
  ]
  ++ lib.optionals (variant == "sev") [
    "SEV=1"
@ -65,9 +67,14 @@ stdenv.mkDerivation (finalAttrs: {
    "TDX=1"
  ];

+  depsBuildBuild = [
+    elfutils
+    buildPackages.stdenv.cc
+  ];
+
  # Fixes https://github.com/containers/libkrunfw/issues/55
  env = lib.optionalAttrs stdenv.targetPlatform.isAarch64 {
-    NIX_CFLAGS_COMPILE = "-march=armv8-a+crypto";
+    NIX_CFLAGS_COMPILE_FOR_TARGET = "-march=armv8-a+crypto";
  };

  enableParallelBuilding = true;
--- a/pkgs/by-name/li/lilex/package.nix
+++ b/pkgs/by-name/li/lilex/package.nix
@ -2,30 +2,29 @@
  lib,
  stdenvNoCC,
  fetchurl,
+  installFonts,
  unzip,
 }:
-stdenvNoCC.mkDerivation rec {
+stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "lilex";
  version = "2.700";

  src = fetchurl {
-    url = "https://github.com/mishamyrt/Lilex/releases/download/${version}/Lilex.zip";
+    url = "https://github.com/mishamyrt/Lilex/releases/download/${finalAttrs.version}/Lilex.zip";
    hash = "sha256-NDEO20unSfdy1CuI4+7EpjGFJ+dc7qqWz8VW7jU2b7w=";
  };

-  nativeBuildInputs = [ unzip ];
+  sourceRoot = ".";

-  unpackPhase = ''
-    runHook preUnpack
-    unzip $src
-    runHook postUnpack
-  '';
+  outputs = [
+    "out"
+    "webfont"
+  ];

-  installPhase = ''
-    runHook preInstall
-    find . -name '*.ttf' -exec install -m444 -Dt $out/share/fonts/truetype {} +
-    runHook postInstall
-  '';
+  nativeBuildInputs = [
+    installFonts
+    unzip
+  ];

  meta = {
    description = "Open source programming font";
@ -34,4 +33,4 @@ stdenvNoCC.mkDerivation rec {
    maintainers = with lib.maintainers; [ redyf ];
    platforms = lib.platforms.all;
  };
-}
+})
--- a/pkgs/by-name/li/line-awesome/package.nix
+++ b/pkgs/by-name/li/line-awesome/package.nix
@ -2,6 +2,7 @@
  lib,
  stdenv,
  fetchurl,
+  installFonts,
  unzip,
 }:

@ -14,18 +15,17 @@ stdenv.mkDerivation (finalAttrs: {
    sha256 = "07qkz8s1wjh5xwqlq1b4lpihr1zah3kh6bnqvfwvncld8l9wjqfk";
  };

-  nativeBuildInputs = [ unzip ];
-
  sourceRoot = "${finalAttrs.version}/fonts";

-  installPhase = ''
-    mkdir -p $out/share/fonts/truetype
-    mkdir -p $out/share/fonts/woff
-    mkdir -p $out/share/fonts/woff2
-    cp *.ttf $out/share/fonts/truetype
-    cp *.woff $out/share/fonts/woff
-    cp *.woff2 $out/share/fonts/woff2
-  '';
+  outputs = [
+    "out"
+    "webfont"
+  ];
+
+  nativeBuildInputs = [
+    unzip
+    installFonts
+  ];

  meta = {
    description = "Replace Font Awesome with modern line icons";
--- a/pkgs/by-name/ll/llama-cpp/package.nix
+++ b/pkgs/by-name/ll/llama-cpp/package.nix
@ -81,7 +81,7 @@ let
 in
 effectiveStdenv.mkDerivation (finalAttrs: {
  pname = "llama-cpp";
-  version = "9309";
+  version = "9484";

  outputs = [
    "out"
@ -92,7 +92,7 @@ effectiveStdenv.mkDerivation (finalAttrs: {
    owner = "ggml-org";
    repo = "llama.cpp";
    tag = "b${finalAttrs.version}";
-    hash = "sha256-RzxQjVRn6G8M+6N9ulWKIfkfFkD1gTee0L/JWTcOXY0=";
+    hash = "sha256-YPf563WfSLlV4qc9eQRjW1YPxCbqsRs9yN/x30C/IGA=";
    leaveDotGit = true;
    postFetch = ''
      git -C "$out" rev-parse --short HEAD > $out/COMMIT
--- a/pkgs/by-name/ma/mastodon/gemset.nix
+++ b/pkgs/by-name/ma/mastodon/gemset.nix
@ -807,10 +807,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1izp5vna86s7xivqzml4nviy01bv76arrd5is8wkncwp1by3zzbc";
+      sha256 = "1ha0bcz71z48ahdvc0dp71apnbqnnpgffq0dac2q65y68259hx7j";
      type = "gem";
    };
-    version = "1.21.1";
+    version = "1.22.0";
  };
  csv = {
    groups = [ "default" ];
@ -1127,10 +1127,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0rqfmrgp4ihwmnpi9ah0y6pah7rr7d3pid94z2cqd93bgc2m6vjn";
+      sha256 = "1ncmbdjf2bwmk0jf5cxywns9zbxyfiy4h4p3pzi7yddyjhv81qrq";
      type = "gem";
    };
-    version = "5.1.3";
+    version = "6.0.4";
  };
  erubi = {
    groups = [
@ -1207,10 +1207,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "077n5ss3z3ds4vj54w201kd12smai853dp9c9n7ii7g3q7nwwg54";
+      sha256 = "1b930ag8nh99v8n9645ac1wcah9fx0mclbp323q4i1ly9acvkk3k";
      type = "gem";
    };
-    version = "2.14.1";
+    version = "2.14.2";
  };
  faraday-follow_redirects = {
    dependencies = [ "faraday" ];
@ -1889,10 +1889,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1x64l31nkqjwfv51s2vsm0yqq4cwzrlnji12wvaq761myx3fxq9i";
+      sha256 = "115ll278g3zdvff7b05gfxqc9n74vw9xfzcc8jkv22bkphpkbng4";
      type = "gem";
    };
-    version = "2.10.2";
+    version = "2.10.3";
  };
  kaminari = {
    dependencies = [
--- a/pkgs/by-name/ma/mastodon/source.nix
+++ b/pkgs/by-name/ma/mastodon/source.nix
@ -5,14 +5,14 @@
  patches ? [ ],
 }:
 let
-  version = "4.5.10";
+  version = "4.5.11";
 in
 applyPatches {
  src = fetchFromGitHub {
    owner = "mastodon";
    repo = "mastodon";
    rev = "v${version}";
-    hash = "sha256-aW5WMmhfV+q/ddebSuEuCL5Mdwav+qocMPBnbvXFBk4=";
+    hash = "sha256-YAWlge8dShDFfMBhyRQHryZUs1yD5KNKzXOyCpRsy9w=";
    passthru = {
      inherit version;
      yarnHash = "sha256-OFPwe0OqvJhbJuY6gVuQJB5dGE8q6IPrsfW9NK8oVPM=";
--- a/pkgs/by-name/mo/mos/package.nix
+++ b/pkgs/by-name/mo/mos/package.nix
@ -7,11 +7,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "mos";
-  version = "4.0.2";
+  version = "4.2.0";

  src = fetchurl {
-    url = "https://github.com/Caldis/Mos/releases/download/${finalAttrs.version}/Mos.Versions.${finalAttrs.version}-20260308.2.zip";
-    hash = "sha256-1DBFRIRjR9Fcl5DtHeuwn3qZgQ+jWRujYFzjPqa3/dY=";
+    url = "https://github.com/Caldis/Mos/releases/download/${finalAttrs.version}/Mos.Versions.${finalAttrs.version}-20260505.1.zip";
+    hash = "sha256-SswAG7V+7LbAbPcHwS4Kr+0TFg6XWhYTEK7lVC3lYCQ=";
  };
  sourceRoot = ".";

@ -26,8 +26,6 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    runHook postInstall
  '';

-  passthru.updateScript = nix-update-script { };
-
  meta = {
    description = "Smooths scrolling and set mouse scroll directions independently on macOS";
    homepage = "https://mos.caldis.me/";
--- a/pkgs/by-name/nk/nkeys/package.nix
+++ b/pkgs/by-name/nk/nkeys/package.nix
@ -6,16 +6,16 @@

 buildGoModule (finalAttrs: {
  pname = "nkeys";
-  version = "0.4.15";
+  version = "0.4.16";

  src = fetchFromGitHub {
    owner = "nats-io";
    repo = "nkeys";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-hlVPfL3ecEmqXRsV3skiOD7B1s2a0ZZ5RX6LV6ISEWI=";
+    hash = "sha256-GR1OvyA8bjZRTPTn12izxQXjACIaXFbGsSquHucusRY=";
  };

-  vendorHash = "sha256-3gyWzCYpkXnEURKB05GtGJxDMk6oIzWS4u3U5OUd3p4=";
+  vendorHash = "sha256-WszCsYEK0xOuSNI3UxJJLWKus8viVREaNj4xVQY6eBM=";

  meta = {
    description = "Public-key signature system for NATS";
--- a/pkgs/by-name/no/nosql-workbench/package.nix
+++ b/pkgs/by-name/no/nosql-workbench/package.nix
@ -8,22 +8,22 @@
 }:
 let
  pname = "nosql-workbench";
-  version = "3.13.0";
+  version = "3.20.2";

  src =
    fetchurl
      {
        x86_64-darwin = {
          url = "https://s3.amazonaws.com/nosql-workbench/NoSQL%20Workbench-mac-x64-${version}.dmg";
-          hash = "sha256-Dof1F1LTD478wh7jTR5zwFmbrvyCOWVO/C1QXTebi3c=";
+          hash = "sha256-ewlaaaWxPHxaOdAMbkHChzbxAB5MNdZS/p8ROD/SvcQ=";
        };
        aarch64-darwin = {
          url = "https://s3.amazonaws.com/nosql-workbench/NoSQL%20Workbench-mac-arm64-${version}.dmg";
-          hash = "sha256-QD0F6onP3GhMRIzNifx/RZkxPIS/GMtnF4zro5ygucg=";
+          hash = "sha256-U6Gea89/cXY9Fd6JAWrUtf7Q4VfEXDPzbjCQcHMRjiE=";
        };
        x86_64-linux = {
          url = "https://s3.amazonaws.com/nosql-workbench/NoSQL%20Workbench-linux-${version}.AppImage";
-          hash = "sha256-ewlaaaWxPHxaOdAMbkHChzbxAB5MNdZS/p8ROD/SvcQ=";
+          hash = "sha256-O62JsVHJ5OE6HLt3Pg9XVrd3j1eoY3O+bjqroowGEOE=";
        };
      }
      .${stdenv.system} or (throw "Unsupported system: ${stdenv.system}");
--- a/pkgs/by-name/op/opendkim/package.nix
+++ b/pkgs/by-name/op/opendkim/package.nix
@ -2,6 +2,7 @@
  lib,
  stdenv,
  fetchFromGitHub,
+  fetchpatch,
  nix-update-script,
  autoreconfHook,
  pkg-config,
@ -24,6 +25,28 @@ stdenv.mkDerivation (finalAttrs: {
    hash = "sha256-/IqWB0s39t8BeqpRIa8MZn4HgXlIMuU2UbYbpZGNo1s=";
  };

+  # TODO: remove when is merge
+  patches = [
+    (fetchpatch {
+      # https://github.com/trusteddomainproject/OpenDKIM/pull/288
+      name = "CVE-2020-35766.patch";
+      url = "https://github.com/trusteddomainproject/OpenDKIM/commit/520338d25af68cf263b97ba63037e3f5856a10da.patch";
+      hash = "sha256-O4a4boa67tj0nqxee6V+u7rd3l3RGaiWE+Mu0ib4DWE=";
+    })
+    (fetchpatch {
+      # https://github.com/trusteddomainproject/OpenDKIM/pull/287
+      name = "CVE-2022-48521.patch";
+      url = "https://github.com/trusteddomainproject/OpenDKIM/commit/e67c33e1a08cca793470e6a6ff44082f73f6d222.patch";
+      hash = "sha256-QtxiRM+/NDlQhfGB8XNX1M1PtQyXXarawoF+8pTTMVo=";
+    })
+    (fetchpatch {
+      # https://github.com/trusteddomainproject/OpenDKIM/pull/261
+      name = "fix-old-style-dkimf_base64_encode_file.patch";
+      url = "https://github.com/trusteddomainproject/OpenDKIM/commit/3f0aa0a31c11b9924f826708535071b68c22b731.patch";
+      hash = "sha256-nQCBGef2kjs9ZyHwPreNPQYW6jBOBTDhVq9RyeGSN/Y=";
+    })
+  ];
+
  configureFlags = [
    "--with-milter=${libmilter}"
    "ac_cv_func_malloc_0_nonnull=yes"
@ -63,11 +86,6 @@ stdenv.mkDerivation (finalAttrs: {
    license = lib.licenses.bsd3;
    platforms = lib.platforms.unix;
    mainProgram = "opendkim";
-    knownVulnerabilities = [
-      "CVE-2020-35766: Privilege escalation in test suite"
-      "CVE-2022-48521: Specially crafted e-mails can bypass DKIM signature validation"
-      "Upstream OpenDKIM hasn't been updated in years, and is assumed to be unmaintained. Consider using an alternative such as rspamd."
-    ];
    maintainers = with lib.maintainers; [ maevii ];
  };
 })
--- a/pkgs/by-name/pe/penelope/package.nix
+++ b/pkgs/by-name/pe/penelope/package.nix
@ -6,14 +6,14 @@

 python3.pkgs.buildPythonApplication (finalAttrs: {
  pname = "penelope";
-  version = "0.19.1";
+  version = "0.20.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "brightio";
    repo = "penelope";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-72HFPByH4FBRIYaTeEWaZ2dW43Q1OjosT3qAOMiu5t4=";
+    hash = "sha256-mqdNPMKTwReIk2zUU+oZ21QOH+l3L12/TADB6YbcOzk=";
  };

  build-system = with python3.pkgs; [ setuptools ];
--- a/pkgs/by-name/pr/probe-rs-tools/package.nix
+++ b/pkgs/by-name/pr/probe-rs-tools/package.nix
@ -5,8 +5,10 @@
  fetchurl,
  cmake,
  pkg-config,
+  installShellFiles,
  libusb1,
  openssl,
+  stdenv,
 }:

 let
@ -36,6 +38,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    # https://github.com/rust-lang/libz-sys/issues/158
    cmake
    pkg-config
+    installShellFiles
  ];

  buildInputs = [
@ -45,6 +48,12 @@ rustPlatform.buildRustPackage (finalAttrs: {

  postInstall = ''
    install -D -m 444 ${udevRules} $out/etc/udev/rules.d/69-probe-rs.rules
+  ''
+  + lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    installShellCompletion --cmd probe-rs \
+      --bash <(SHELL=bash $out/bin/probe-rs complete install -m) \
+      --fish <(SHELL=fish $out/bin/probe-rs complete install -m) \
+      --zsh <(SHELL=zsh $out/bin/probe-rs complete install -m)
  '';

  checkFlags = [
--- a/pkgs/by-name/re/redumper/package.nix
+++ b/pkgs/by-name/re/redumper/package.nix
@ -2,43 +2,66 @@
  lib,
  fetchFromGitHub,
  cmake,
+  ctestCheckHook,
  ninja,
  llvmPackages,
+  gtest,
+  versionCheckHook,
+  nix-update-script,
 }:

 # redumper is using C++ modules, this requires latest C++20 compiler and build tools
 llvmPackages.libcxxStdenv.mkDerivation (finalAttrs: {
  pname = "redumper";
-  version = "709";
+  version = "720";

  src = fetchFromGitHub {
    owner = "superg";
    repo = "redumper";
    tag = "b${finalAttrs.version}";
-    hash = "sha256-3J+/v8Rhu5yT+MgAxcNBiHLAPAcNWc/YJXxFMgOZnPs=";
+    hash = "sha256-Gl+BJV9yWFGHk5HZudre+YUaaqCYcQpT50oeDcc39ds=";
  };

+  patches = [
+    ./remove-static-linking.patch
+  ];
+
+  __structuredAttrs = true;
+
+  strictDeps = true;
+
  nativeBuildInputs = [
    cmake
+    ctestCheckHook
    ninja
    llvmPackages.clang-tools
  ];

-  env.NIX_CFLAGS_COMPILE = "-isystem ${llvmPackages.libcxx.dev}/include/c++/v1";
-
  # https://github.com/superg/redumper/blob/main/.github/workflows/cmake.yml
  cmakeFlags = [
-    "-DCMAKE_BUILD_WITH_INSTALL_RPATH=ON"
-    "-DREDUMPER_VERSION_BUILD=${finalAttrs.version}"
-    "-DREDUMPER_CLANG_LINK_OPTIONS=" # overrides the '-static' default
+    (lib.cmakeFeature "REDUMPER_VERSION_BUILD" "${finalAttrs.src.tag}")
+    (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_GOOGLETEST" "${gtest.src}")
  ];

+  doCheck = true;
+
+  doInstallCheck = true;
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--version-regex"
+      "b(.*)"
+    ];
+  };
+
  meta = {
    homepage = "https://github.com/superg/redumper";
    description = "Low level CD dumper utility";
    license = lib.licenses.gpl3Plus;
    maintainers = with lib.maintainers; [ hughobrien ];
-    platforms = lib.platforms.linux;
+    platforms = lib.platforms.unix;
    mainProgram = "redumper";
  };
 })
--- a/pkgs/by-name/re/redumper/remove-static-linking.patch
+++ b/pkgs/by-name/re/redumper/remove-static-linking.patch
@ -0,0 +1,44 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 2f5d66a..e437573 100644
+--- a/CMakeLists.txt
+++ b/CMakeLists.txt
+@@ -221,39 +221,8 @@ endif()
+ 
+ target_link_libraries(redumper ${libs})
+ 
+-if(REDUMPER_TARGET_LINUX)
+-    target_link_options(redumper PRIVATE "-static")
+-endif()
+-
+ install(TARGETS redumper DESTINATION "bin")
+ 
+-# bundle LLVM libc++ for C++20 support (system libc++ is too old, static linking not allowed on macOS)
+-if(REDUMPER_TARGET_MACOS)
+-    set_target_properties(redumper PROPERTIES INSTALL_RPATH "@executable_path/../lib")
+-    
+-    install(FILES
+-        "${LLVM_LIB_PATH}/c++/libc++.1.0.dylib"
+-        "${LLVM_LIB_PATH}/c++/libc++.1.dylib"
+-        "${LLVM_LIB_PATH}/c++/libc++abi.1.0.dylib"
+-        "${LLVM_LIB_PATH}/c++/libc++abi.1.dylib"
+-        "${LLVM_LIB_PATH}/libunwind.1.0.dylib"
+-        "${LLVM_LIB_PATH}/libunwind.1.dylib"
+-        DESTINATION "lib"
+-    )
+-    
+-    # fix install names after files are copied & re-sign binaries after modification (install_name_tool invalidates signatures)
+-    install(CODE "
+-        execute_process(COMMAND install_name_tool -change ${LLVM_LIB_PATH}/c++/libc++.1.dylib @rpath/libc++.1.dylib \${CMAKE_INSTALL_PREFIX}/bin/redumper)
+-        execute_process(COMMAND install_name_tool -id @rpath/libc++.1.dylib \${CMAKE_INSTALL_PREFIX}/lib/libc++.1.0.dylib)
+-        execute_process(COMMAND install_name_tool -id @rpath/libc++abi.1.dylib \${CMAKE_INSTALL_PREFIX}/lib/libc++abi.1.0.dylib)
+-        execute_process(COMMAND install_name_tool -id @rpath/libunwind.1.dylib \${CMAKE_INSTALL_PREFIX}/lib/libunwind.1.0.dylib)
+-        execute_process(COMMAND codesign --force --sign - \${CMAKE_INSTALL_PREFIX}/bin/redumper)
+-        execute_process(COMMAND codesign --force --sign - \${CMAKE_INSTALL_PREFIX}/lib/libc++.1.0.dylib)
+-        execute_process(COMMAND codesign --force --sign - \${CMAKE_INSTALL_PREFIX}/lib/libc++abi.1.0.dylib)
+-        execute_process(COMMAND codesign --force --sign - \${CMAKE_INSTALL_PREFIX}/lib/libunwind.1.0.dylib)
+-    ")
+-endif()
+-
+ # Windows 7 requires administrative access in order to access the disc drive
+ if(MSVC AND CMAKE_SYSTEM_VERSION VERSION_EQUAL "6.1")
+     set_target_properties(redumper PROPERTIES LINK_FLAGS "/MANIFESTUAC:\"level='requireAdministrator' uiAccess='false'\"")
--- a/pkgs/by-name/re/render-cli/package.nix
+++ b/pkgs/by-name/re/render-cli/package.nix
@ -6,13 +6,13 @@

 buildGoModule rec {
  pname = "render-cli";
-  version = "2.18.0";
+  version = "2.19.0";

  src = fetchFromGitHub {
    owner = "render-oss";
    repo = "cli";
    rev = "v${version}";
-    hash = "sha256-S3XWxK40jIX5l1o4km5CJLcPqEp10hjKYb+iWZSNKck=";
+    hash = "sha256-v5kYPQtYO9YqsBbs57ypqMfwWMswdKcdbI2WfKyllHc=";
  };

  vendorHash = "sha256-0cOW8g9rhUbcBF/JfsYu8OJJhaDXAd37341GZeoCAVQ=";
--- a/pkgs/by-name/re/renderdoc/package.nix
+++ b/pkgs/by-name/re/renderdoc/package.nix
@ -12,9 +12,9 @@
  libpthread-stubs,
  makeWrapper,
  nix-update-script,
-  pcre,
+  pcre2,
  pkg-config,
-  python312Packages,
+  python3,
  qt5,
  stdenv,
  vulkan-loader,
@ -24,6 +24,9 @@
 }:

 let
+  # forked from swig v3 in 2017
+  # primarily to include https://github.com/swig/swig/pull/251
+  # (cherry-picked as https://github.com/swig/swig/commit/8d79491a329825ad24294509fc6a0b0a0b8947c4)
  custom_swig = fetchFromGitHub {
    owner = "baldurk";
    repo = "swig";
@ -58,16 +61,36 @@ stdenv.mkDerivation (finalAttrs: {
      revert = true;
    })
  ];
+  swig_patches = [
+    # use PCRE2 instead of PCRE
+    (fetchpatch {
+      name = "renderdoc-swig-pcre2-1.patch";
+      url = "https://src.fedoraproject.org/rpms/renderdoc/raw/19ce666d120a229e5c1ab62fc142610ab3b21b3c/f/renderdoc-swig-pcre2-1.patch";
+      hash = "sha256-xuqHu72vAbxFELNTfJT5SbQOsnG/ee++MZgpuEGLT/w=";
+    })
+    (fetchpatch {
+      name = "renderdoc-swig-pcre2-2.patch";
+      url = "https://src.fedoraproject.org/rpms/renderdoc/raw/19ce666d120a229e5c1ab62fc142610ab3b21b3c/f/renderdoc-swig-pcre2-2.patch";
+      hash = "sha256-LUm5Ekmccy4x+hR+iK49zJc75VxuhDhpNw8rkVnn4rc=";
+    })
+  ];
+  postPatch = ''
+    pushd ../swig
+    prePatch="" postPatch="" patches="$swig_patches" runPhase patchPhase
+    popd
+  '';

  buildInputs = [
    libxdmcp
    libpthread-stubs
-    python312Packages.pyside2
-    python312Packages.pyside2-tools
-    python312Packages.shiboken2
    qt5.qtbase
    qt5.qtsvg
    vulkan-loader
+    # TODO: make sure pyrenderdoc is installed properly
+    # TODO: unbreak shiboken2 on python>3.12
+    # python312Packages.pyside2
+    # python312Packages.pyside2-tools
+    # python312Packages.shiboken2
  ]
  ++ lib.optionals waylandSupport [
    wayland
@ -80,9 +103,9 @@ stdenv.mkDerivation (finalAttrs: {
    bison
    cmake
    makeWrapper
-    pcre
+    pcre2
    pkg-config
-    python312Packages.python
+    python3
    qt5.qtx11extras
    qt5.wrapQtAppsHook
  ];
@ -94,6 +117,10 @@ stdenv.mkDerivation (finalAttrs: {
    (lib.cmakeFeature "BUILD_VERSION_DIST_CONTACT" "https://github.com/NixOS/nixpkgs/")
    (lib.cmakeBool "BUILD_VERSION_STABLE" true)
    (lib.cmakeBool "ENABLE_UNSUPPORTED_EXPERIMENTAL_POSSIBLY_BROKEN_WAYLAND" waylandSupport)
+    # TODO: build python bindings
+    # https://github.com/NixOS/nixpkgs/issues/525939
+    (lib.cmakeBool "ENABLE_PYRENDERDOC" false)
+    (lib.cmakeBool "QRENDERDOC_ENABLE_PYSIDE2" false)
  ];

  dontWrapQtApps = true;
@ -101,7 +128,7 @@ stdenv.mkDerivation (finalAttrs: {
  strictDeps = true;

  postUnpack = ''
-    cp -r ${custom_swig} swig
+    cp -r ${finalAttrs.passthru.custom_swig} swig
    chmod -R +w swig
    patchShebangs swig/autogen.sh
  '';
@ -136,7 +163,10 @@ stdenv.mkDerivation (finalAttrs: {
    addDriverRunpath $out/lib/librenderdoc.so
  '';

-  passthru.updateScript = nix-update-script { };
+  passthru = {
+    inherit custom_swig;
+    updateScript = nix-update-script { };
+  };

  meta = {
    homepage = "https://renderdoc.org/";
--- a/pkgs/by-name/sa/saunafs/package.nix
+++ b/pkgs/by-name/sa/saunafs/package.nix
@ -23,13 +23,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "saunafs";
-  version = "5.9.0";
+  version = "5.10.0";

  src = fetchFromGitHub {
    owner = "leil-io";
    repo = "saunafs";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-OMUW5JJziW3C9R5gsnFTGnxwmVoXRTtu4aIlXfnVdME=";
+    hash = "sha256-5FeuzL7JiCuR2l7PjYTtsesXS0RaJmAMrTUKtCwKZxE=";
  };

  patches = [
--- a/pkgs/by-name/sh/showtime/package.nix
+++ b/pkgs/by-name/sh/showtime/package.nix
@ -69,13 +69,6 @@ python3Packages.buildPythonApplication (finalAttrs: {
    export HOME="$TEMPDIR"
  '';

-  # HACK: To get rid of unreproducible __pycache__ created by pythonImportsCheck.
-  # See https://github.com/NixOS/nixpkgs/issues/469081
-  deletePycachePhase = ''
-    find $out/lib -type d -name __pycache__ -prune -exec rm -vr {} \;
-  '';
-  postPhases = [ "deletePycachePhase" ];
-
  passthru = {
    updateScript = gnome.updateScript {
      packageName = "showtime";
--- a/pkgs/by-name/sp/spacetimedb/package.nix
+++ b/pkgs/by-name/sp/spacetimedb/package.nix
@ -15,16 +15,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "spacetimedb";
-  version = "2.2.0";
+  version = "2.4.0";

  src = fetchFromGitHub {
    owner = "clockworklabs";
    repo = "spacetimedb";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-KlMkgxfsUoLJ4h05td62eKfqWl9fYQ61FTsA1COkQrQ=";
+    hash = "sha256-JEehx4UnvpuGneI049fQel+05JhNoPSFO5ZI2WBSqC4=";
  };

-  cargoHash = "sha256-csiDZKGLcorwVemK0g8Vi0+/Zq+b2UtC047ROrC/nOI=";
+  cargoHash = "sha256-aX45e9oHFM4aiRVNKYi6WJztaSRSpmLnyYI9oD7Pa+w=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/by-name/sy/syswatch/package.nix
+++ b/pkgs/by-name/sy/syswatch/package.nix
@ -7,18 +7,18 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "syswatch";
-  version = "0.7.0";
+  version = "0.7.1";

  src = fetchFromGitHub {
    owner = "matthart1983";
    repo = "syswatch";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-93KSbhgobGqd29M+cwEr6b1NhrwKhM+nJbRWG/hnvag=";
+    hash = "sha256-9LEZ9DWp5H+ODiuE6A5Qzr/ozXQaXQ7TbDnJY8B8GD4=";
  };

  __structuredAttrs = true;

-  cargoHash = "sha256-BRmkznPCS8BTLxeHAVz4eBsJZoKdDsaPE2VWMiquMac=";
+  cargoHash = "sha256-dGobKfemSrZ+Y4haHrmLt7dqv9yOBDJ2k3XnZ9LkIlw=";

  nativeCheckInputs = [ versionCheckHook ];

--- a/pkgs/by-name/tm/tm/missing-string-header.patch
+++ b/pkgs/by-name/tm/tm/missing-string-header.patch
@ -1,24 +0,0 @@
-diff --git a/unix_client.c b/unix_client.c
-index 920910a..6d608fd 100644
--- a/unix_client.c
-+++ b/unix_client.c
-@@ -8,6 +8,7 @@
- #include <sys/socket.h>
- #include <unistd.h>
- #include <assert.h>
-+#include <string.h>
- 
- #include "main.h"
- #include "handlers.h"
-diff --git a/unix_server.c b/unix_server.c
-index 5cf93ed..d3c51c9 100644
--- a/unix_server.c
-+++ b/unix_server.c
-@@ -8,6 +8,7 @@
- #include <assert.h>
- #include <unistd.h>
- #include <stdio.h>
-+#include <string.h>
- #include <sys/un.h>
- #include <sys/socket.h>
- #include <sys/select.h>
--- a/pkgs/by-name/tm/tm/package.nix
+++ b/pkgs/by-name/tm/tm/package.nix
@ -1,35 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchurl,
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "tm";
-  version = "0.4.1";
-
-  src = fetchurl {
-    url = "https://vicerveza.homeunix.net/~viric/soft/tm/tm-${finalAttrs.version}.tar.gz";
-    hash = "sha256-OzibwDtpZK1f+lejRLiR/bz3ybJgSt2nI6hj+DZXxKA=";
-  };
-
-  makeFlags = [ "PREFIX=$(out)" ];
-
-  patches = [
-    # fix using strncpy and strlen without including string.h
-    ./missing-string-header.patch
-  ];
-
-  postPatch = ''
-    sed -i 's@/usr/bin/install@install@g ; s/gcc/cc/g' Makefile
-  '';
-
-  meta = {
-    description = "Terminal mixer - multiplexer for the i/o of terminal applications";
-    homepage = "http://vicerveza.homeunix.net/~viric/soft/tm";
-    license = lib.licenses.gpl2Plus;
-    maintainers = [ ];
-    platforms = lib.platforms.all;
-    mainProgram = "tm";
-  };
-})
--- a/pkgs/by-name/tr/triton-llvm/package.nix
+++ b/pkgs/by-name/tr/triton-llvm/package.nix
@ -68,7 +68,9 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "triton-llvm";
-  version = "22.0.0-unstable-2025-09-26"; # See https://github.com/llvm/llvm-project/blob/main/cmake/Modules/LLVMVersion.cmake
+  version = "23.0.0-unstable-2026-01-29"; # See https://github.com/llvm/llvm-project/blob/main/cmake/Modules/LLVMVersion.cmake
+
+  __structuredAttrs = true;

  outputs = [
    "out"
@ -84,8 +86,8 @@ stdenv.mkDerivation (finalAttrs: {
  src = fetchFromGitHub {
    owner = "llvm";
    repo = "llvm-project";
-    rev = "f6ded0be897e2878612dd903f7e8bb85448269e5";
-    hash = "sha256-T76zHZZ2bp3Ye9GTV+MgbKqMbtmMGElMFsWuCkiWqrM=";
+    rev = "ac5dc54d509169d387fcfd495d71853d81c46484";
+    hash = "sha256-tA1KcZqyPsgfxQs9tbNhX11oFcNGJefxWmfCpYqdI9M=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/vu/vulnix/package.nix
+++ b/pkgs/by-name/vu/vulnix/package.nix
@ -9,7 +9,7 @@
 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "vulnix";
  version = "1.12.4";
-  format = "setuptools";
+  pyproject = true;

  src = fetchFromGitHub {
    owner = "nix-community";
@ -33,6 +33,10 @@ python3Packages.buildPythonApplication (finalAttrs: {
    pytest-cov-stub
  ];

+  build-system = with python3Packages; [
+    setuptools
+  ];
+
  propagatedBuildInputs = [
    nix
  ]
@ -41,7 +45,6 @@ python3Packages.buildPythonApplication (finalAttrs: {
    colorama
    pyyaml
    requests
-    setuptools
    toml
    zodb
  ]);
--- a/pkgs/by-name/we/webdav/package.nix
+++ b/pkgs/by-name/we/webdav/package.nix
@ -6,16 +6,16 @@

 buildGoModule (finalAttrs: {
  pname = "webdav";
-  version = "5.11.9";
+  version = "5.11.10";

  src = fetchFromGitHub {
    owner = "hacdias";
    repo = "webdav";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-7+c8RcuXfEdbSD5+EbkTCEm8uFilkbBMGte+FIAygR0=";
+    hash = "sha256-OaaUROSjzgM99sQrnE8bSCdfGPYCJJ5frptogqsJMrM=";
  };

-  vendorHash = "sha256-HU3J5w1x4LyvEgTo+o307U1/dHivUpJbsX/VBOAkhhM=";
+  vendorHash = "sha256-/s93KMnfQ+eLFCXaE6GFU8rakCNNQv8cnfHF+teEDJQ=";

  __darwinAllowLocalNetworking = true;

--- a/pkgs/by-name/zk/zkfuse/package.nix
+++ b/pkgs/by-name/zk/zkfuse/package.nix
@ -40,6 +40,7 @@ stdenv.mkDerivation rec {
  '';

  meta = {
+    description = "Utility to mount a Zookeeper instance as a file-system";
    platforms = lib.platforms.linux;
    maintainers = with lib.maintainers; [ ztzg ];
    license = lib.licenses.asl20;
--- a/pkgs/development/interpreters/elixir/1.20.nix
+++ b/pkgs/development/interpreters/elixir/1.20.nix
@ -1,7 +1,7 @@
 import ./generic-builder.nix {
-  version = "1.20.0-rc.6";
-  hash = "sha256-U3zBeZ4U44jXwYJva2neb3Ll1dDpxvLSIR0Tg1HP33U=";
-  # https://hexdocs.pm/elixir/1.20.0-rc.6/compatibility-and-deprecations.html#between-elixir-and-erlang-otp
+  version = "1.20.0";
+  hash = "sha256-cTogrKyG2SkJFlnB43pwKiowf41eTHPTHbIS5f44b0Q=";
+  # https://hexdocs.pm/elixir/1.20.0/compatibility-and-deprecations.html#between-elixir-and-erlang-otp
  minimumOTPVersion = "27";
  maximumOTPVersion = "29";
 }
--- a/pkgs/development/python-modules/advantage-air/default.nix
+++ b/pkgs/development/python-modules/advantage-air/default.nix
@ -3,20 +3,23 @@
  aiohttp,
  buildPythonPackage,
  fetchPypi,
+  setuptools,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "advantage-air";
  version = "0.4.4";
-  format = "setuptools";
+  pyproject = true;

  src = fetchPypi {
    pname = "advantage_air";
-    inherit version;
+    inherit (finalAttrs) version;
    hash = "sha256-4rRR9IxzH5EiYfWzWYeyCwoLB2LetBVyH7L3nkvp+gA=";
  };

-  propagatedBuildInputs = [ aiohttp ];
+  build-system = [ setuptools ];
+
+  dependencies = [ aiohttp ];

  # No tests
  doCheck = false;
@ -29,4 +32,4 @@ buildPythonPackage rec {
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ jamiemagee ];
  };
-}
+})
--- a/pkgs/development/python-modules/aiodiscover/default.nix
+++ b/pkgs/development/python-modules/aiodiscover/default.nix
@ -5,6 +5,7 @@
  cached-ipaddress,
  fetchFromGitHub,
  ifaddr,
+  libredirect,
  netifaces,
  poetry-core,
  pyroute2,
@ -15,14 +16,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "aiodiscover";
-  version = "3.2.3";
+  version = "3.3.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "bdraco";
    repo = "aiodiscover";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-GivEYa0/i/ufudYSHWQwYRhTEpzmwhlOyPHWH/JpdfU=";
+    hash = "sha256-QQwEYxflOzNN+J0lCIp+LzwB7m000PgZH8MSsKTUEMw=";
  };

  build-system = [ poetry-core ];
@ -35,16 +36,19 @@ buildPythonPackage (finalAttrs: {
    pyroute2
  ];

+  pythonRelaxDeps = [ "aiodns" ];
+
  nativeCheckInputs = [
+    libredirect.hook
    pytest-asyncio
    pytest-cov-stub
    pytestCheckHook
  ];

-  disabledTests = [
-    # Tests require access to /etc/resolv.conf
-    "test_async_discover_hosts"
-  ];
+  preCheck = ''
+    echo "nameserver 127.0.0.1" > resolv.conf
+    export NIX_REDIRECTS=/etc/resolv.conf=$(realpath resolv.conf)
+  '';

  pythonImportsCheck = [ "aiodiscover" ];

--- a/pkgs/development/python-modules/asmog/default.nix
+++ b/pkgs/development/python-modules/asmog/default.nix
@ -4,19 +4,22 @@
  async-timeout,
  buildPythonPackage,
  fetchPypi,
+  setuptools,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "asmog";
  version = "0.0.6";
-  format = "setuptools";
+  pyproject = true;

  src = fetchPypi {
-    inherit pname version;
-    sha256 = "14b8hdxcks6qyrqpp4mm77fvzznbskqn7fw9qgwgcqx81pg45iwk";
+    inherit (finalAttrs) pname version;
+    hash = "sha256-k8dC3g2oY/b4w4m7Y/HUy/6/3Tm1kntx9tjoyXqDaJE=";
  };

-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
    aiohttp
    async-timeout
  ];
@ -33,4 +36,4 @@ buildPythonPackage rec {
    license = with lib.licenses; [ asl20 ];
    maintainers = with lib.maintainers; [ fab ];
  };
-}
+})
--- a/pkgs/development/python-modules/asyncio-throttle/default.nix
+++ b/pkgs/development/python-modules/asyncio-throttle/default.nix
@ -4,20 +4,23 @@
  fetchFromGitHub,
  pytestCheckHook,
  pytest-asyncio,
+  setuptools,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "asyncio-throttle";
  version = "1.0.2";
-  format = "setuptools";
+  pyproject = true;

  src = fetchFromGitHub {
    owner = "hallazzang";
    repo = "asyncio-throttle";
-    rev = "v${version}";
-    sha256 = "1hsjcymdcm0hf4l68scf9n8j7ba89azgh96xhxrnyvwxfs5acnmv";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-u1qminadb29zh90k+L5KSK0jkU2OaWQocRBU1qpnUsM=";
  };

+  build-system = [ setuptools ];
+
  nativeCheckInputs = [
    pytest-asyncio
    pytestCheckHook
@ -31,4 +34,4 @@ buildPythonPackage rec {
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ hexa ];
  };
-}
+})
--- a/pkgs/development/python-modules/atlassian-python-api/default.nix
+++ b/pkgs/development/python-modules/atlassian-python-api/default.nix
@ -13,20 +13,23 @@
  six,
  typing-extensions,
  pytestCheckHook,
+  setuptools,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "atlassian-python-api";
  version = "4.0.7";
-  format = "setuptools";
+  pyproject = true;

  src = fetchFromGitHub {
    owner = "atlassian-api";
    repo = "atlassian-python-api";
-    tag = version;
+    tag = finalAttrs.version;
    hash = "sha256-8zfM/3apGMo6sTPA5ESu2SkgVOJUA09Wz/pGR12fA7c=";
  };

+  build-system = [ setuptools ];
+
  dependencies = [
    beautifulsoup4
    deprecated
@ -47,8 +50,8 @@ buildPythonPackage rec {
  meta = {
    description = "Python Atlassian REST API Wrapper";
    homepage = "https://github.com/atlassian-api/atlassian-python-api";
-    changelog = "https://github.com/atlassian-api/atlassian-python-api/releases/tag/${src.tag}";
+    changelog = "https://github.com/atlassian-api/atlassian-python-api/releases/tag/${finalAttrs.src.tag}";
    license = lib.licenses.asl20;
    maintainers = [ ];
  };
-}
+})
--- a/pkgs/development/python-modules/augeas/default.nix
+++ b/pkgs/development/python-modules/augeas/default.nix
@ -7,19 +7,22 @@
  augeas,
  cffi,
  pkgs, # for libxml2
+  setuptools,
 }:
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "augeas";
  version = "1.2.0";
-  format = "setuptools";
+  pyproject = true;

  src = fetchFromGitHub {
    owner = "hercules-team";
    repo = "python-augeas";
-    rev = "v${version}";
+    tag = "v${finalAttrs.version}";
    hash = "sha256-Lq8ckra3sqN38zo1d5JsEq6U5TtLKRmqysoWNwR9J9A=";
  };

+  build-system = [ setuptools ];
+
  nativeBuildInputs = [ pkg-config ];

  buildInputs = [
@ -27,17 +30,17 @@ buildPythonPackage rec {
    pkgs.libxml2
  ];

-  propagatedBuildInputs = [ cffi ];
+  dependencies = [ cffi ];

  nativeCheckInputs = [ unittestCheckHook ];

  pythonImportsCheck = [ "augeas" ];

  meta = {
-    changelog = "https://github.com/hercules-team/python-augeas/releases/tag/v${version}";
+    changelog = "https://github.com/hercules-team/python-augeas/releases/tag/v${finalAttrs.version}";
    description = "Pure python bindings for augeas";
    homepage = "https://github.com/hercules-team/python-augeas";
    license = lib.licenses.lgpl2Plus;
    platforms = lib.platforms.unix;
  };
-}
+})
--- a/pkgs/development/python-modules/autograd-gamma/default.nix
+++ b/pkgs/development/python-modules/autograd-gamma/default.nix
@ -5,21 +5,24 @@
  pytestCheckHook,
  autograd,
  scipy,
+  setuptools,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "autograd-gamma";
  version = "0.4.3";
-  format = "setuptools";
+  pyproject = true;

  src = fetchFromGitHub {
    owner = "CamDavidsonPilon";
    repo = "autograd-gamma";
-    rev = "v${version}";
-    sha256 = "0v03gly5k3a1hzb54zpw6409m3riak49qd27hkq2f66ai42ivqz2";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-4uMdBYnKGCfwhEc0nMhUMY+aADH8flLWh0GNWTx9A2w=";
  };

-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
    autograd
    scipy
  ];
@ -34,4 +37,4 @@ buildPythonPackage rec {
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ swflint ];
  };
-}
+})
--- a/pkgs/development/python-modules/avion/default.nix
+++ b/pkgs/development/python-modules/avion/default.nix
@ -6,12 +6,13 @@
  fetchPypi,
  pycryptodome,
  requests,
+  setuptools,
 }:

 buildPythonPackage (finalAttrs: {
  pname = "avion";
  version = "0.10";
-  format = "setuptools";
+  pyproject = true;

  src = fetchPypi {
    inherit (finalAttrs) pname version;
@ -24,7 +25,9 @@ buildPythonPackage (finalAttrs: {
      --replace "bluepy>==1.1.4" "bluepy>=1.1.4"
  '';

-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
    bluepy
    csrmesh
    pycryptodome
--- a/pkgs/development/python-modules/bitsandbytes/default.nix
+++ b/pkgs/development/python-modules/bitsandbytes/default.nix
@ -9,6 +9,7 @@
  cmake,

  # build-system
+  ninja,
  scikit-build-core,
  setuptools,

@ -121,6 +122,7 @@ buildPythonPackage (finalAttrs: {
  ];

  build-system = [
+    ninja
    scikit-build-core
    setuptools
  ];
--- a/pkgs/development/python-modules/blebox-uniapi/default.nix
+++ b/pkgs/development/python-modules/blebox-uniapi/default.nix
@ -10,16 +10,16 @@
  pytestCheckHook,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "blebox-uniapi";
-  version = "2.5.3";
+  version = "2.5.4";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "blebox";
    repo = "blebox_uniapi";
-    tag = "v${version}";
-    hash = "sha256-DBkd8o2jOVCH3KqJ2FZ4qhJsSMb1UwqBO1ZXoTLsqEY=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-YiEOFxKqWVK7DzrSUvwzIvkyjSpTTFSuVh4pfz+lSg0=";
  };

  postPatch = ''
@ -43,10 +43,10 @@ buildPythonPackage rec {
  pythonImportsCheck = [ "blebox_uniapi" ];

  meta = {
-    changelog = "https://github.com/blebox/blebox_uniapi/blob/v${version}/HISTORY.rst";
+    changelog = "https://github.com/blebox/blebox_uniapi/blob/${finalAttrs.src.tag}/HISTORY.rst";
    description = "Python API for accessing BleBox smart home devices";
    homepage = "https://github.com/blebox/blebox_uniapi";
    license = lib.licenses.asl20;
    maintainers = with lib.maintainers; [ dotlambda ];
  };
-}
+})
--- a/pkgs/development/python-modules/boto3-stubs/default.nix
+++ b/pkgs/development/python-modules/boto3-stubs/default.nix
@ -358,13 +358,13 @@

 buildPythonPackage (finalAttrs: {
  pname = "boto3-stubs";
-  version = "1.43.19";
+  version = "1.43.21";
  pyproject = true;

  src = fetchPypi {
    pname = "boto3_stubs";
    inherit (finalAttrs) version;
-    hash = "sha256-0Wc9i9REkPu/OT6Gmo3cGPzYq0zrx/sq6/KYybtD+8s=";
+    hash = "sha256-PRmr3e6APfH3tDC2f2T80Llloe7reupzpzakya8ZqBw=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/cached-ipaddress/default.nix
+++ b/pkgs/development/python-modules/cached-ipaddress/default.nix
@ -11,16 +11,16 @@
  propcache,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "cached-ipaddress";
-  version = "1.1.1";
+  version = "1.1.2";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "bdraco";
    repo = "cached-ipaddress";
-    tag = "v${version}";
-    hash = "sha256-VIIcScaZwd5BAidgG30edYsAQaFnqxEQX+F/t+HR278=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-+A1kMD1L2K+dAWrZJ96qJpx0udRGMWbWApyWtMrE7lk=";
  };

  build-system = [
@ -42,8 +42,8 @@ buildPythonPackage rec {
  meta = {
    description = "Cache construction of ipaddress objects";
    homepage = "https://github.com/bdraco/cached-ipaddress";
-    changelog = "https://github.com/bdraco/cached-ipaddress/blob/${src.rev}/CHANGELOG.md";
+    changelog = "https://github.com/bdraco/cached-ipaddress/blob/${finalAttrs.src.tag}/CHANGELOG.md";
    license = lib.licenses.mit;
    maintainers = [ ];
  };
-}
+})
--- a/pkgs/development/python-modules/conduit/default.nix
+++ b/pkgs/development/python-modules/conduit/default.nix
@ -3,9 +3,18 @@
  stdenv,
  pkgs,
  buildPythonPackage,
-  setuptools,
-  numpy,
+
+  # build-system
+  cmake,
+  ninja,
  pip,
+  setuptools,
+
+  # nativeBuildInputs
+  openmpi,
+
+  # dependencies
+  numpy,

  mpiSupport ? false,
 }:
@ -17,32 +26,36 @@ buildPythonPackage {
    pname
    version
    src
-    nativeBuildInputs
+    # nativeBuildInputs
    buildInputs
    ;
  pyproject = true;
+  __structuredAttrs = true;

-  # Needed for cmake to find openmpi
-  strictDeps = false;
-
-  postPatch = ''
-    substituteInPlace setup.py \
+  postPatch = (conduit.postPatch or "") + ''
+    substituteInPlace pyproject.toml \
      --replace-fail \
-        "'-j2'" \
-        "f'-j{os.environ.get(\"NIX_BUILD_CORES\")}'"
+        "cmake<=3.30.0" \
+        "cmake"
  '';

-  dontUseCmakeConfigure = true;
-
  env.ENABLE_MPI = mpiSupport;

  build-system = [
+    cmake
+    ninja
+    pip
    setuptools
  ];
+  dontUseCmakeConfigure = true;
+
+  nativeBuildInputs = conduit.nativeBuildInputs ++ [
+    # openmpi needs to be in nativeBuildInputs, otherwise cmake can't find it
+    openmpi
+  ];

  dependencies = [
    numpy
-    pip
  ];

  pythonImportsCheck = [ "conduit" ];
--- a/pkgs/development/python-modules/deep-gemm/default.nix
+++ b/pkgs/development/python-modules/deep-gemm/default.nix
@ -2,6 +2,8 @@
  lib,
  buildPythonPackage,
  fetchFromGitHub,
+  replaceVars,
+  symlinkJoin,

  # build-system
  setuptools,
@ -47,6 +49,23 @@ buildPythonPackage.override { inherit (torch) stdenv; } (finalAttrs: {

  patches = [
    ./use-system-libraries.patch
+
+    # DeepGEMM does JIT compilation and needs to access the NVIDIA compiler and some libraries at
+    # runtime.
+    # Instead of letting it search for the cuda toolkit on the host, hardcode the path to a custom
+    # closure.
+    (replaceVars ./patch-runtime-cuda-home-path.patch {
+      cuda_home = symlinkJoin {
+        name = "cuda-toolkit";
+        paths = with cudaPackages; [
+          (lib.getBin cuda_nvcc) # bin/nvcc, bin/ptxas, nvvm/, nvcc.profile
+          (lib.getBin cutlass) # include/cute, include/cutlass
+          (lib.getInclude cuda_cccl) # include/cuda/std/* (libcu++)
+          (lib.getInclude cuda_cudart) # include/cuda_runtime.h, cuda_bf16.h, cuda_fp8.h
+          (lib.getInclude cuda_cuobjdump) # bin/cuobjdump
+        ];
+      };
+    })
  ];

  env = optionalAttrs cudaSupport {
--- a/pkgs/development/python-modules/deep-gemm/patch-runtime-cuda-home-path.patch
+++ b/pkgs/development/python-modules/deep-gemm/patch-runtime-cuda-home-path.patch
@ -0,0 +1,27 @@
+diff --git a/deep_gemm/__init__.py b/deep_gemm/__init__.py
+index a4633ae..6508865 100644
+--- a/deep_gemm/__init__.py
+++ b/deep_gemm/__init__.py
+@@ -62,21 +62,7 @@ from .utils import *
+ 
+ # Initialize CPP modules
+ def _find_cuda_home() -> str:
+-    # TODO: reuse PyTorch API later
+-    # For some PyTorch versions, the original `_find_cuda_home` will initialize CUDA, which is incompatible with process forks
+-    cuda_home = os.environ.get('CUDA_HOME') or os.environ.get('CUDA_PATH')
+-    if cuda_home is None:
+-        # noinspection PyBroadException
+-        try:
+-            with open(os.devnull, 'w') as devnull:
+-                nvcc = subprocess.check_output(['which', 'nvcc'], stderr=devnull).decode().rstrip('\r\n')
+-                cuda_home = os.path.dirname(os.path.dirname(nvcc))
+-        except Exception:
+-            cuda_home = '/usr/local/cuda'
+-            if not os.path.exists(cuda_home):
+-                cuda_home = None
+-    assert cuda_home is not None
+-    return cuda_home
+    return "@cuda_home@"
+ 
+ 
+ deep_gemm_cpp.init(
--- a/pkgs/development/python-modules/doit/default.nix
+++ b/pkgs/development/python-modules/doit/default.nix
@ -15,19 +15,20 @@
  pyflakes,
  configclass,
  mergedict,
+  setuptools,
 }:

 let
  doit = buildPythonPackage rec {
    pname = "doit";
-    version = "0.36.0";
-    format = "setuptools";
+    version = "0.37.0";
+    pyproject = true;

    disabled = !isPy3k;

    src = fetchPypi {
      inherit pname version;
-      hash = "sha256-cdB8zJUUyyL+WdmJmVd2ZeqrV+FvZE0EM2rgtLriNLw=";
+      hash = "sha256-08cuDkao+h3avqj4MHYkAt7gkMrzPDDCKVrHAQ248Jw=";
    };

    propagatedBuildInputs = [
@ -38,6 +39,10 @@ let
    ++ lib.optional stdenv.hostPlatform.isLinux pyinotify
    ++ lib.optional stdenv.hostPlatform.isDarwin macfsevents;

+    build-system = [
+      setuptools
+    ];
+
    nativeCheckInputs = [
      configclass
      doit-py
--- a/pkgs/development/python-modules/executorch/default.nix
+++ b/pkgs/development/python-modules/executorch/default.nix
@ -102,12 +102,6 @@ buildPythonPackage.override { inherit (torch) stdenv; } (finalAttrs: {

      sed -i "1i #include <cstdint>" backends/apple/coreml/runtime/inmemoryfs/memory_buffer.hpp
      sed -i "1i #include <cstdint>" extension/llm/tokenizers/third-party/sentencepiece/src/sentencepiece_processor.h
-    ''
-    + ''
-      substituteInPlace extension/llm/tokenizers/test/test_python_bindings.py \
-        --replace-fail \
-          'self.assertEqual(pytorch_tokenizers.__version__, "0.1.0")' \
-          'self.assertEqual(pytorch_tokenizers.__version__, "${pytorch-tokenizers.version}")'
    '';

  env = {
--- a/pkgs/development/python-modules/fjaraskupan/default.nix
+++ b/pkgs/development/python-modules/fjaraskupan/default.nix
@ -9,16 +9,16 @@
  setuptools,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "fjaraskupan";
-  version = "2.3.3";
+  version = "2.3.4";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "elupus";
    repo = "fjaraskupan";
-    tag = version;
-    hash = "sha256-xu5u3hvtD1gbN1f1UuxDQVIHF5pyCOWVwUq36vAgW/Y=";
+    tag = finalAttrs.version;
+    hash = "sha256-0rJoUQYexB+4ehOXKa1aca401E7opDtdoBmIW/2uOOE=";
  };

  build-system = [ setuptools ];
@ -38,8 +38,8 @@ buildPythonPackage rec {
  meta = {
    description = "Module for controlling Fjäråskupan kitchen fans";
    homepage = "https://github.com/elupus/fjaraskupan";
-    changelog = "https://github.com/elupus/fjaraskupan/releases/tag/${version}";
-    license = with lib.licenses; [ mit ];
+    changelog = "https://github.com/elupus/fjaraskupan/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ fab ];
  };
-}
+})
--- a/pkgs/development/python-modules/flash-attn-3/default.nix
+++ b/pkgs/development/python-modules/flash-attn-3/default.nix
@ -0,0 +1,107 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+
+  # build-system
+  ninja,
+  setuptools,
+  torch,
+
+  # dependencies
+  einops,
+
+  # tests
+  pytestCheckHook,
+}:
+
+let
+  inherit (torch) cudaCapabilities cudaPackages cudaSupport;
+in
+buildPythonPackage.override { inherit (torch) stdenv; } (finalAttrs: {
+  pname = "flash-attn-3";
+  version = "3.0.0-unstable-2026-06-02";
+  pyproject = true;
+  __structuredAttrs = true;
+
+  # We fetch the vendored CUTLASS submodule rather than relying on `cudaPackages.cutlass`.
+  # FA3 reaches deep into private cute/cutlass internals and is likely to be incompatible with
+  # whatever version of cutlass we currently package.
+  # Upstream pins a specific submodule SHA that is often an unreleased commit on master, strictly
+  # between two tagged versions, so neither the previous nor the next stable tag will compile.
+  # Using the vendored submodule is the only way to guarantee a matching set of headers.
+  src = fetchFromGitHub {
+    owner = "Dao-AILab";
+    repo = "flash-attention";
+    rev = "b02b07e1a10238fe12831b80a8937ed59b1353a5";
+    hash = "sha256-LALX4lYioJLYssoQ0rJCC5M2Ij28wtP7ucpGkKIzmmg=";
+    fetchSubmodules = true;
+  };
+
+  sourceRoot = "${finalAttrs.src.name}/hopper";
+
+  postPatch =
+    # The submodule is fetched by fetchFromGitHub, no need to update it at build time
+    ''
+      substituteInPlace setup.py \
+        --replace-fail \
+          'subprocess.run(["git", "submodule", "update", "--init", "../csrc/cutlass"])' \
+          'pass'
+    ''
+    # Prevent setup.py from downloading a custom NVCC version
+    + ''
+      substituteInPlace setup.py \
+        --replace-fail \
+          'if bare_metal_version >= Version("12.3") and bare_metal_version < Version("13.0") and bare_metal_version != Version("12.8"):' \
+          'if False:'
+    '';
+
+  preConfigure = ''
+    export MAX_JOBS="$NIX_BUILD_CORES"
+    export NVCC_THREADS=2
+  '';
+
+  env = {
+    FLASH_ATTENTION_FORCE_BUILD = "TRUE";
+    FLASH_ATTENTION_SKIP_CUDA_BUILD = "FALSE";
+
+    # 8.0;9.0;12.0
+    TORCH_CUDA_ARCH_LIST = lib.concatStringsSep ";" cudaCapabilities;
+  };
+
+  build-system = [
+    ninja
+    setuptools
+    torch
+  ];
+
+  nativeBuildInputs = [
+    cudaPackages.cuda_nvcc
+  ];
+
+  buildInputs = [
+    cudaPackages.cuda_cudart # cuda_runtime.h cuda_runtime_api.h
+  ];
+
+  dependencies = [
+    einops
+    torch
+  ];
+
+  pythonImportsCheck = [
+    "flash_attn_config"
+    "flash_attn_interface"
+  ];
+
+  # Tests require access to a physical GPU
+  doCheck = false;
+
+  meta = {
+    description = "Official implementation of FlashAttention-3";
+    homepage = "https://github.com/Dao-AILab/flash-attention/blob/main/hopper";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ GaetanLepage ];
+    # Upstream requires either CUDA or ROCm. ROCm support is not (yet) supported in nixpkgs
+    broken = !cudaSupport;
+  };
+})
--- a/pkgs/development/python-modules/hg-commitsigs/default.nix
+++ b/pkgs/development/python-modules/hg-commitsigs/default.nix
@ -1,42 +0,0 @@
-{
-  lib,
-  fetchhg,
-  stdenv,
-  python,
-}:
-
-stdenv.mkDerivation {
-  pname = "hg-commitsigs";
-  # Latest tag is 11 years old.
-  version = "unstable-2021-01-08";
-
-  src = fetchhg {
-    url = "https://foss.heptapod.net/mercurial/commitsigs";
-    rev = "b53eb6862bff";
-    sha256 = "sha256-PS1OhC9MiVFD7WYlIn6FavD5TyhM50WoV6YagI2pLxU=";
-  };
-
-  # Not sure how the tests are supposed to be run, and they 10 years old...
-  doCheck = false;
-  dontBuild = true;
-
-  installPhase = ''
-    mkdir -p $out/${python.sitePackages}/hgext3rd/
-    install -D $src/commitsigs.py \
-               $out/${python.sitePackages}/hgext3rd/
-  '';
-
-  meta = {
-    description = "Automatic signing of changeset hashes";
-    longDescription = ''
-      This packages provides a Mercurial extension that lets you sign
-      the changeset hash when you commit.  The signature is embedded
-      directly in the changeset itself; there wont be any extra
-      commits.  Either GnuPG or OpenSSL can be used to sign the hashes.
-    '';
-    homepage = "https://foss.heptapod.net/mercurial/commitsigs";
-    maintainers = with lib.maintainers; [ yoctocell ];
-    license = lib.licenses.gpl2Plus;
-    platforms = lib.platforms.unix; # same as Mercurial
-  };
-}
--- a/pkgs/development/python-modules/iamdata/default.nix
+++ b/pkgs/development/python-modules/iamdata/default.nix
@ -8,14 +8,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "iamdata";
-  version = "0.1.202606021";
+  version = "0.1.202606031";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "cloud-copilot";
    repo = "iam-data-python";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-/MZUx/BgpDBFBAdJw8xQmgrcQKxSwq5tt9PHw5XZHMQ=";
+    hash = "sha256-fJ0fKvg5wVeHBPKvTemYp44JOoxmdqaAigzbRlS7xD8=";
  };

  __darwinAllowLocalNetworking = true;
--- a/pkgs/development/python-modules/jianpu-ly/default.nix
+++ b/pkgs/development/python-modules/jianpu-ly/default.nix
@ -6,31 +6,31 @@
  lilypond,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "jianpu-ly";
-  version = "1.868";
+  version = "1.869";
  pyproject = true;

  src = fetchPypi {
-    inherit version;
+    inherit (finalAttrs) version;
    pname = "jianpu_ly";
-    hash = "sha256-Jm3r3c4o/rMdwiPlaIe33JEyb0S4yIr9kupxZal06eU=";
+    hash = "sha256-xTownx9NOAzQtXsuhgzzqqt+GvT2IYIxwCvZfDnIPeg=";
  };

-  dependencies = [ lilypond ];
-
  build-system = [ setuptools ];

+  dependencies = [ lilypond ];
+
  pythonImportsCheck = [ "jianpu_ly" ];

  # no tests in shipped with upstream
  doCheck = false;

  meta = {
-    homepage = "https://ssb22.user.srcf.net/mwrhome/jianpu-ly.html";
    description = "Assists with printing jianpu";
-    changelog = "https://github.com/ssb22/jianpu-ly/releases/tag/v${version}";
+    homepage = "https://ssb22.user.srcf.net/mwrhome/jianpu-ly.html";
+    changelog = "https://github.com/ssb22/jianpu-ly/releases/tag/v${finalAttrs.version}";
    license = lib.licenses.asl20;
    maintainers = with lib.maintainers; [ ifurther ];
  };
-}
+})
--- a/pkgs/development/python-modules/knx-frontend/default.nix
+++ b/pkgs/development/python-modules/knx-frontend/default.nix
@ -5,16 +5,16 @@
  setuptools,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "knx-frontend";
-  version = "2026.4.30.60856";
+  version = "2026.6.1.213802";
  pyproject = true;

  # TODO: source build, uses yarn.lock
  src = fetchPypi {
    pname = "knx_frontend";
-    inherit version;
-    hash = "sha256-ZviZoQY0ZlIgiiEKwsOpTRVoi8F1JPE1RqD8Nzozpr4=";
+    inherit (finalAttrs) version;
+    hash = "sha256-P3a2dPAaowvYzrUit0MAdNPjcTECkE8juMBAapLYtFs=";
  };

  build-system = [ setuptools ];
@ -25,10 +25,10 @@ buildPythonPackage rec {
  doCheck = false;

  meta = {
-    changelog = "https://github.com/XKNX/knx-frontend/releases/tag/${version}";
+    changelog = "https://github.com/XKNX/knx-frontend/releases/tag/${finalAttrs.version}";
    description = "Home Assistant Panel for managing the KNX integration";
    homepage = "https://github.com/XKNX/knx-frontend";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ hexa ];
  };
-}
+})
--- a/pkgs/development/python-modules/life360/default.nix
+++ b/pkgs/development/python-modules/life360/default.nix
@ -8,14 +8,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "life360";
-  version = "7.1.0";
+  version = "7.2.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "pnbruckner";
    repo = "life360";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-D7ZtC9WrGTuU7cOs37P+y9zqOrOlfa919FVicejy6n4=";
+    hash = "sha256-ySa84lUyx8D7Dgg/hdZ4o/+Znn3CR0O9rdeXBrj/k5U=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/mistral-common/default.nix
+++ b/pkgs/development/python-modules/mistral-common/default.nix
@ -38,14 +38,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "mistral-common";
-  version = "1.11.0";
+  version = "1.11.2";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "mistralai";
    repo = "mistral-common";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-DejbLY2i6Hp1J+spxMut5RKugj7rDyrZmp6v+5wqyWY=";
+    hash = "sha256-EXdZcBR61GNye8LqwIqRO8lP1lK6fqPJufWFO9XkkYQ=";
  };

  build-system = [
--- a/pkgs/development/python-modules/mypy-boto3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3/default.nix
@ -443,8 +443,8 @@ in
      "sha256-dXNkOcMonYrBh4yzeubd+v3mW42s9XpmpfvgbtgoJgY=";

  mypy-boto3-ec2 =
-    buildMypyBoto3Package "ec2" "1.43.14"
-      "sha256-4FPmtV6paCZOQ3rJW29d55RnB5TokCOzNhCgH03cIvo=";
+    buildMypyBoto3Package "ec2" "1.43.20"
+      "sha256-OGxCwLfDYlx43+HEuVHsrC59c67yTJ37ttOu4TWw3U0=";

  mypy-boto3-ec2-instance-connect =
    buildMypyBoto3Package "ec2-instance-connect" "1.43.0"
@ -475,8 +475,8 @@ in
      "sha256-duU3LIeW3FNiplVmduZsNXBoDK7vbO6ecrBt1Y7C9rU=";

  mypy-boto3-elasticache =
-    buildMypyBoto3Package "elasticache" "1.43.0"
-      "sha256-6NjmoXMu9RDobyrdRWYVNPc6Q8JDLP+TzAsy2z+ELgk=";
+    buildMypyBoto3Package "elasticache" "1.43.20"
+      "sha256-wXJzvzlQXgqrJfI/IV/KVmIQ5etRFuld69+mvgsK0Og=";

  mypy-boto3-elasticbeanstalk =
    buildMypyBoto3Package "elasticbeanstalk" "1.43.0"
@ -590,8 +590,8 @@ in
      "sha256-+DDeD9YWo98meLZU2Mzu5AE0S7HFg6kfxeUWUh9XcQA=";

  mypy-boto3-guardduty =
-    buildMypyBoto3Package "guardduty" "1.43.15"
-      "sha256-5/PHXiFoiGBM3uK6jm8g5L5Wrt3x0DoH1p+TAI4kC80=";
+    buildMypyBoto3Package "guardduty" "1.43.20"
+      "sha256-wTB+ajpXaGLWpM5vbMibB1q/PVejn3eK+v5Lfh57wqo=";

  mypy-boto3-health =
    buildMypyBoto3Package "health" "1.43.0"
@ -630,8 +630,8 @@ in
      "sha256-F+4rmr2/nI1TQCFnMY0dPxAXlgN3IBSfiQaDGup5HSw=";

  mypy-boto3-iot =
-    buildMypyBoto3Package "iot" "1.43.17"
-      "sha256-/hR8GtbwvoVnseF0BQTcb8Jv8JIXcR0atxIcElZv1K4=";
+    buildMypyBoto3Package "iot" "1.43.20"
+      "sha256-ZARIC6yQVEkQ1ZtbM8HmQb7mHLQC/3o1PSLCD/KuC4o=";

  mypy-boto3-iot-data =
    buildMypyBoto3Package "iot-data" "1.43.17"
@ -766,8 +766,8 @@ in
      "sha256-gYTCgaRwH3zKi6gg4MC8DUwXQT+jZO6lqc/vi+JUahU=";

  mypy-boto3-lambda =
-    buildMypyBoto3Package "lambda" "1.43.0"
-      "sha256-pY3ia1wTvlTeqzFyPumreqqSK+HfvQk9w6TKEsyFMVc=";
+    buildMypyBoto3Package "lambda" "1.43.20"
+      "sha256-wdYorfSAmlDVEFRlQxiujWu/OFbq6nKA2aZt1mv/isk=";

  mypy-boto3-lex-models =
    buildMypyBoto3Package "lex-models" "1.43.3"
@ -1170,8 +1170,8 @@ in
      "sha256-T+JIJpHxD7IzAwq8yxgq6zbVMj/btpbhKnylMyfFvvU=";

  mypy-boto3-sagemaker =
-    buildMypyBoto3Package "sagemaker" "1.43.16"
-      "sha256-Jp+FHUC9ATqf7+Lz+j532i4NveXiATVUywXY3PZHTPw=";
+    buildMypyBoto3Package "sagemaker" "1.43.20"
+      "sha256-EAuXDoQfGv/Fk/nQfcWNt4WSHir9y0cF8vRr0yPcNqM=";

  mypy-boto3-sagemaker-a2i-runtime =
    buildMypyBoto3Package "sagemaker-a2i-runtime" "1.43.0"
@ -1362,8 +1362,8 @@ in
      "sha256-fc0e8DEx/b6M3kPB4Y07qqqMayg2BGSQ69gkuhcrl9Y=";

  mypy-boto3-transcribe =
-    buildMypyBoto3Package "transcribe" "1.43.0"
-      "sha256-0hww0SSW03bUktNCr81f5C56U961ETH96Gn1VZwX1Iw=";
+    buildMypyBoto3Package "transcribe" "1.43.20"
+      "sha256-zk62JmlBT6nmRYoTZ3j7ThgbqjqTv0UOK3A+vZZlkRE=";

  mypy-boto3-transfer =
    buildMypyBoto3Package "transfer" "1.43.0"
--- a/pkgs/development/python-modules/plotnine/default.nix
+++ b/pkgs/development/python-modules/plotnine/default.nix
@ -23,7 +23,7 @@

 buildPythonPackage (finalAttrs: {
  pname = "plotnine";
-  version = "0.15.4";
+  version = "0.15.5";
  pyproject = true;
  __structuredAttrs = true;

@ -31,7 +31,7 @@ buildPythonPackage (finalAttrs: {
    owner = "has2k1";
    repo = "plotnine";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-xZ3M9bBY5kL8Z2Fa5D+oxnU2HMvxbVKALTvsxDAHMuQ=";
+    hash = "sha256-o2yCZeYMIKpmJ7ekH4dCFZXnxyw7uN5rhXYehCNOOWI=";
  };

  build-system = [ setuptools-scm ];
--- a/pkgs/development/python-modules/pyautogui/default.nix
+++ b/pkgs/development/python-modules/pyautogui/default.nix
@ -2,6 +2,7 @@
  lib,
  buildPythonPackage,
  fetchFromGitHub,
+  setuptools,
  mouseinfo,
  pygetwindow,
  pymsgbox,
@ -13,10 +14,10 @@
  xvfb-run,
  scrot,
 }:
-buildPythonPackage {
+buildPythonPackage (finalAttrs: {
  pname = "pyautogui";
  version = "0.9.53";
-  format = "setuptools";
+  pyproject = true;

  src = fetchFromGitHub {
    owner = "asweigart";
@ -25,22 +26,16 @@ buildPythonPackage {
    hash = "sha256-R9tcTqxUaqw63FLOGFRaO/Oz6kD7V6MPHdQ8A29NdXw=";
  };

-  nativeCheckInputs = [
-    xvfb-run
-    scrot
-  ];
-  checkPhase = ''
-    xvfb-run python -c 'import pyautogui'
-    # The tests depend on some specific things that xvfb cant provide, like keyboard and mouse
-    # xvfb-run python -m unittest tests.test_pyautogui
-  '';
-
  patches = [
    # https://github.com/asweigart/pyautogui/issues/598
    ./fix-locateOnWindow-and-xlib.patch
  ];

-  propagatedBuildInputs = [
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
    mouseinfo
    pygetwindow
    pymsgbox
@ -51,10 +46,22 @@ buildPythonPackage {
    pytweening
  ];

+  nativeCheckInputs = [
+    xvfb-run
+    scrot
+  ];
+
+  checkPhase = ''
+    xvfb-run python -c 'import pyautogui'
+    # The tests depend on some specific things that xvfb cant provide, like keyboard and mouse
+    # xvfb-run python -m unittest tests.test_pyautogui
+  '';
+
  meta = {
    description = "PyAutoGUI lets Python control the mouse and keyboard, and other GUI automation tasks";
    homepage = "https://github.com/asweigart/pyautogui";
+    changelog = "https://github.com/asweigart/pyautogui/blob/${finalAttrs.src.rev}/CHANGES.txt";
    license = lib.licenses.bsd3;
    maintainers = with lib.maintainers; [ lucasew ];
  };
-}
+})
--- a/pkgs/development/python-modules/python-qube-heatpump/default.nix
+++ b/pkgs/development/python-modules/python-qube-heatpump/default.nix
@ -11,14 +11,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "python-qube-heatpump";
-  version = "1.10.0";
+  version = "1.11.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "MattieGit";
    repo = "python-qube-heatpump";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-+voRl54hzKqtaps0HubOOQKuki4uIPlPPl31e6o6hXs=";
+    hash = "sha256-eHw1nlly95ne4XbMNB8su7TgbDEKMqUXYx9WQtUZo6Y=";
  };

  build-system = [ hatchling ];
--- a/pkgs/development/python-modules/torch/source/default.nix
+++ b/pkgs/development/python-modules/torch/source/default.nix
@ -3,7 +3,6 @@
  lib,
  fetchFromGitHub,
  fetchFromGitLab,
-  fetchpatch,
  git-unroll,
  buildPythonPackage,
  python,
@ -48,7 +47,6 @@
  llvmPackages,

  # dependencies
-  astunparse,
  binutils,
  expecttest,
  filelock,
@ -229,6 +227,9 @@ let
        rocm-smi
        clr.icd
        hipify
+        rocprofiler-sdk
+        rocprofiler-sdk.dev
+        amdsmi
      ]
      ++ lib.optionals (!vendorComposableKernel) [
        composable_kernel
@ -282,8 +283,9 @@ in
 buildPythonPackage.override { inherit stdenv; } (finalAttrs: {
  pname = "torch";
  # Don't forget to update torch-bin to the same version.
-  version = "2.11.0";
+  version = "2.12.0";
  pyproject = true;
+  __structuredAttrs = true;

  outputs = [
    "out" # output standard python package
@ -306,29 +308,6 @@ buildPythonPackage.override { inherit stdenv; } (finalAttrs: {

  patches = [
    ./clang19-template-warning.patch
-
-    # The GCC version upperbounds were wrong for cuda 12.8 and 12.9, which led downstream builds to
-    # illegitimately fail with:
-    #   RuntimeError: The current installed version of g++ (14.3.0) is greater than the maximum
-    #   required version by CUDA 12.9. Please make sure to use an adequate version of g++
-    #   (>=6.0.0, <14.0).
-    # TODO: remove at the next release
-    (fetchpatch {
-      name = "allow-gcc-14-with-cuda-12.8-9";
-      url = "https://github.com/pytorch/pytorch/commit/39565a7dcf8f93ea22cedeaa20088b24ff6d2634.patch";
-      hash = "sha256-Au5fVbs7i33d9c4Xj8koiBP7lGnsTGTaX4VlE2gAfy8=";
-    })
-
-    # pybind11 3.0.3 changes led to ambiguous deduction in some return types
-    # that used `py::make_tuple`, so the type is explicitly specified where
-    # needed.
-    # Merged pull request: https://github.com/pytorch/pytorch/pull/179277
-    # TODO: remove at the next release
-    (fetchpatch {
-      name = "pybind11-3.0.3-ambiguous-return-type.patch";
-      url = "https://github.com/pytorch/pytorch/commit/b248ebc17075c0c3ad2b2532970d2ada32b2cf94.patch";
-      hash = "sha256-HY5JFGNoroFsfuUOO5j6WNP6gMHWUcIJFmWLqV8PV94=";
-    })
  ]
  ++ lib.optionals cudaSupport [
    ./fix-cmake-cuda-toolkit.patch
@ -402,13 +381,6 @@ buildPythonPackage.override { inherit stdenv; } (finalAttrs: {
      --replace-fail "list(APPEND ATen_HIP_INCLUDE \''${CMAKE_CURRENT_SOURCE_DIR}/../../../third_party/composable_kernel/include)" "" \
      --replace-fail "list(APPEND ATen_HIP_INCLUDE \''${CMAKE_CURRENT_SOURCE_DIR}/../../../third_party/composable_kernel/library/include)" ""
  ''
-  # Detection of NCCL version doesn't work particularly well when using the static binary.
-  + lib.optionalString cudaSupport ''
-    substituteInPlace cmake/Modules/FindNCCL.cmake \
-      --replace-fail \
-        'message(FATAL_ERROR "Found NCCL header version and library version' \
-        'message(WARNING "Found NCCL header version and library version'
-  ''
  # Remove PyTorch's FindCUDAToolkit.cmake and use CMake's default.
  # NOTE: Parts of pytorch rely on unmaintained FindCUDA.cmake with custom patches to support e.g.
  # newer architectures (sm_90a). We do want to delete vendored patches, but have to keep them
@ -523,9 +495,9 @@ buildPythonPackage.override { inherit stdenv; } (finalAttrs: {
  cmakeFlags = [
    (lib.cmakeFeature "PYTHON_SIX_SOURCE_DIR" "${six.src}")
    # (lib.cmakeBool "CMAKE_FIND_DEBUG_MODE" true)
-    (lib.cmakeFeature "CUDAToolkit_VERSION" cudaPackages.cudaMajorMinorVersion)
  ]
  ++ lib.optionals cudaSupport [
+    (lib.cmakeFeature "CUDAToolkit_VERSION" cudaPackages.cudaMajorMinorVersion)
    # Unbreaks version discovery in enable_language(CUDA) when wrapping nvcc with ccache
    # Cf. https://gitlab.kitware.com/cmake/cmake/-/issues/26363
    (lib.cmakeFeature "CMAKE_CUDA_COMPILER_TOOLKIT_VERSION" cudaPackages.cudaMajorMinorVersion)
@ -622,14 +594,12 @@ buildPythonPackage.override { inherit stdenv; } (finalAttrs: {
    "sympy"
  ];
  dependencies = [
-    astunparse
    expecttest
    filelock
    fsspec
    hypothesis
    jinja2
    networkx
-    ninja
    packaging
    psutil
    pyyaml
--- a/pkgs/development/python-modules/torch/source/src.nix
+++ b/pkgs/development/python-modules/torch/source/src.nix
@ -4,7 +4,7 @@
  fetchFromGitHub,
  runCommand,
 }:
-assert version == "2.11.0";
+assert version == "2.12.0";
 rec {
  src_aiter = fetchFromGitHub {
    owner = "ROCm";
@ -43,6 +43,12 @@ rec {
    hash = "sha256-IDUIuAvgCzWaHoTJUZrH15bqoVcP8bZk+Gs1Ae6/CpY=";
  };
  src_composable_kernel = fetchFromGitHub {
+    owner = "ROCm";
+    repo = "composable_kernel";
+    rev = "f1746955fdaf80a3414de814bf32437686dac347";
+    hash = "sha256-B/xNuBPUdjL1b+0IzRnaSXT2FKUo5cYwYcKqfKqJ8Eg=";
+  };
+  src_composable_kernel_aiter = fetchFromGitHub {
    owner = "ROCm";
    repo = "composable_kernel";
    rev = "fcc9372c009c8e0a23fece77b582da83b04a654f";
@ -63,8 +69,8 @@ rec {
  src_cpp-httplib = fetchFromGitHub {
    owner = "yhirose";
    repo = "cpp-httplib";
-    rev = "bd95e67c234930cd6d6bb11309588c5462c63cec";
-    hash = "sha256-5q77ersAJnPPpVChvntnqEly1/ek2KfX2iukTPUbKHc=";
+    rev = "4d7c9a788de136071ccf0dd4e96239151e2adadb";
+    hash = "sha256-VXEhoxoQjGEuA2g/y6fDTA4LrPd4SggrS3aOjznDSvc=";
  };
  src_cpr = fetchFromGitHub {
    owner = "libcpr";
@ -87,14 +93,14 @@ rec {
  src_cudnn-frontend = fetchFromGitHub {
    owner = "NVIDIA";
    repo = "cudnn-frontend";
-    rev = "b8c0656e6f6c84fc194f4d57329b55d609eff596";
-    hash = "sha256-G1WYxRCsg67umzOZ9W+JwXV6hfl5n2wtsH9KxVUccTU=";
+    rev = "a91f0e04dcea10515f0f776fc5a89535e316a9c8";
+    hash = "sha256-OOKdkjsVnWgrtcI7IMPSRi2YxtqF2YNV4Fd2rD9I1K8=";
  };
  src_cutlass = fetchFromGitHub {
    owner = "NVIDIA";
    repo = "cutlass";
-    rev = "0d2b201e8c1c4a03efa6e9c468161916e2334725";
-    hash = "sha256-2xgdS2P2tEI/4qcZv9qjCYHFbAcVayMdCDeJfIiQN4U=";
+    rev = "da5e086dab31d63815acafdac9a9c5893b1c69e2";
+    hash = "sha256-0q9Ad0Z6E/rO2PdM4uQc8H0E0qs9uKc3reHepiHhjEc=";
  };
  src_cutlass_fbgemm = fetchFromGitHub {
    owner = "jwfromm";
@ -141,8 +147,8 @@ rec {
  src_flash-attention = fetchFromGitHub {
    owner = "Dao-AILab";
    repo = "flash-attention";
-    rev = "e2743ab5b3803bb672b16437ba98a3b1d4576c50";
-    hash = "sha256-ft3jPiKZDHzZvkGPI34l8/Hq9Rf2f6UjDPKGU2IYz+E=";
+    rev = "fec3a6a18460c1b40f097208d4c16fe8964a679d";
+    hash = "sha256-7yEFNM2lslkBA/9slblAbiK1PHKqKmo1MCFJYz2BOLk=";
  };
  src_flatbuffers = fetchFromGitHub {
    owner = "google";
@ -243,7 +249,7 @@ rec {
  src_ideep = fetchFromGitHub {
    owner = "intel";
    repo = "ideep";
-    rev = "8e7ddd65df95f13e41f0a40c820c5f35ae4a0ea3";
+    rev = "e539e0f9774e2018f0d56fe865da66581f692e3d";
    hash = "sha256-AVSsugGYiQ4QOWMVaHj1hzlPTZmg65yrGMmrWytvUuM=";
  };
  src_ittapi = fetchFromGitHub {
@ -273,8 +279,8 @@ rec {
  src_kineto = fetchFromGitHub {
    owner = "pytorch";
    repo = "kineto";
-    rev = "7a731b6ae01cfc2b1fc75d83a91f84e682e43fd7";
-    hash = "sha256-kKASzILEvFhXDWDqBiNh21VxhtdT506NYoEDVrtVcGU=";
+    rev = "b2103f78d13fde4937af010c0ef8e24313568bc5";
+    hash = "sha256-Ix5zulGaUPbLeVrrTm/EzcVWT4TkDYcBsQADAl4N7TA=";
  };
  src_kleidiai = fetchFromGitHub {
    owner = "ARM-software";
@ -303,8 +309,8 @@ rec {
  src_mkl-dnn = fetchFromGitHub {
    owner = "intel";
    repo = "mkl-dnn";
-    rev = "f1d471933dc852f956fd05389f9313c7148783d5";
-    hash = "sha256-/e57voLBNun/2koTF3sEb0Z/nDjCwq9NJVk7TaTSvMY=";
+    rev = "03c022d3ffdcee958cfacbe720048e725fdf644c";
+    hash = "sha256-xJTllrKs6mPNM85ZqyHTHWKpVOtOghmg4ZRFAvQZ4WU=";
  };
  src_MSLK = fetchFromGitHub {
    owner = "meta-pytorch";
@ -393,8 +399,8 @@ rec {
  src_pytorch = fetchFromGitHub {
    owner = "pytorch";
    repo = "pytorch";
-    rev = "v2.11.0";
-    hash = "sha256-eA/pRQiibLJCKDUkMvmGq4suhrz37i0x0Lc/sH3Ag8E=";
+    rev = "v2.12.0";
+    hash = "sha256-IyQs9CQbbpZYpd+8YhIj/ULjsIWu6gjkGrGSeMWqKvw=";
  };
  src_sleef = fetchFromGitHub {
    owner = "shibatch";
@ -423,7 +429,7 @@ rec {
  src_aiter_recursive = runCommand "aiter" { } ''
    cp -r ${src_aiter} $out
    chmod u+w $out/3rdparty/composable_kernel
-    cp -r ${src_composable_kernel_recursive}/* $out/3rdparty/composable_kernel
+    cp -r ${src_composable_kernel_aiter_recursive}/* $out/3rdparty/composable_kernel
  '';
  src_asmjit_recursive = src_asmjit;
  src_benchmark_recursive = src_benchmark;
@ -431,6 +437,7 @@ rec {
  src_civetweb_recursive = src_civetweb;
  src_clang-cindex-python3_recursive = src_clang-cindex-python3;
  src_composable_kernel_recursive = src_composable_kernel;
+  src_composable_kernel_aiter_recursive = src_composable_kernel_aiter;
  src_composable_kernel_fbgemm_MSLK_recursive = src_composable_kernel_fbgemm_MSLK;
  src_composable_kernel_flash-attention_recursive = src_composable_kernel_flash-attention;
  src_cpp-httplib_recursive = src_cpp-httplib;
--- a/pkgs/development/python-modules/torchcodec/default.nix
+++ b/pkgs/development/python-modules/torchcodec/default.nix
@ -26,14 +26,15 @@

 buildPythonPackage.override { inherit (torch) stdenv; } (finalAttrs: {
  pname = "torchcodec";
-  version = "0.11.1";
+  version = "0.14.0";
  pyproject = true;
+  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "meta-pytorch";
    repo = "torchcodec";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-aYQp9vEVQJgF1n/KsfnDvLQf5nD0/gsG+RAgVlhk7t8=";
+    hash = "sha256-eGof2Rk/dGYPlKVRSuJ+ZeeMh2u4K6/qXmROo187HTA=";
  };

  postPatch = ''
@ -60,6 +61,9 @@ buildPythonPackage.override { inherit (torch) stdenv; } (finalAttrs: {
  ]
  ++ lib.optionals cudaSupport [
    cudaPackages.cuda_nvcc
+  ]
+  ++ lib.optionals rocmSupport [
+    torch.rocmPackages.clr
  ];

  buildInputs = [
@ -110,7 +114,15 @@ buildPythonPackage.override { inherit (torch) stdenv; } (finalAttrs: {
  ];

  disabledTests =
-    lib.optionals (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64) [
+    lib.optionals rocmSupport [
+      # HSA runtime logs topology error in sandbox breaking test that asserts no output
+      "test_python_logger"
+    ]
+    ++ lib.optionals (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64) [
+      # Fails in the sandbox:
+      # Error in cpuinfo: failed to parse the list of possible processors in /sys/devices/system/cpu/possible
+      "test_python_logger"
+
      # AssertionError: index 0
      "test_get_frames_played_at"

--- a/pkgs/development/python-modules/torchdata/default.nix
+++ b/pkgs/development/python-modules/torchdata/default.nix
@ -56,18 +56,22 @@ buildPythonPackage (finalAttrs: {
    pytestCheckHook
  ];

-  disabledTests =
-    lib.optionals (pythonAtLeast "3.14") [
-      # _pickle.PicklingError: Can't pickle local object <...worker_set_affinity at 0x7ffbcfa1ba00>
-      "test_set_affinity_in_worker_init"
+  disabledTests = [
+    # Failing since torch 2.12.0 update
+    # AssertionError: Scalars are not equal! Expected 0 but got 1.
+    "test_get_worker_info"
+  ]
+  ++ lib.optionals (pythonAtLeast "3.14") [
+    # _pickle.PicklingError: Can't pickle local object <...worker_set_affinity at 0x7ffbcfa1ba00>
+    "test_set_affinity_in_worker_init"

-      # RuntimeError: DataLoader timed out after 5 seconds
-      "test_ind_worker_queue"
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      # RuntimeError: DataLoader timed out after 5 seconds
-      "test_ind_worker_queue"
-    ];
+    # RuntimeError: DataLoader timed out after 5 seconds
+    "test_ind_worker_queue"
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    # RuntimeError: DataLoader timed out after 5 seconds
+    "test_ind_worker_queue"
+  ];

  meta = {
    description = "Iterative enhancement to the PyTorch torch.utils.data.DataLoader and torch.utils.data.Dataset/IterableDataset";
--- a/pkgs/development/python-modules/torchvision/default.nix
+++ b/pkgs/development/python-modules/torchvision/default.nix
@ -28,14 +28,15 @@ let
 in
 buildPythonPackage.override { inherit (torch) stdenv; } (finalAttrs: {
  pname = "torchvision";
-  version = "0.26.0";
+  version = "0.27.0";
  pyproject = true;
+  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "pytorch";
    repo = "vision";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-FOdDGY3v8yWBhtNo9tZP79/xwrc7AoIY5Y1ZABzWe6g=";
+    hash = "sha256-HOTD45xY7Gye1GI1+AsF3KmMUTAp1QlzHOUeBHvzv0A=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/triton/0003-nvidia-cudart-a-systempath.patch
+++ b/pkgs/development/python-modules/triton/0003-nvidia-cudart-a-systempath.patch
@ -1,18 +1,18 @@
 diff --git a/third_party/nvidia/backend/driver.c b/third_party/nvidia/backend/driver.c
-index bff09d8c1..a5c341711 100644
+index f51d7b37c1..8971588282 100644
 --- a/third_party/nvidia/backend/driver.c
 +++ b/third_party/nvidia/backend/driver.c
@@ -1,4 +1,4 @@
 -#include "cuda.h"
 +#include <cuda.h>
 #include <dlfcn.h>
+ #include <stdalign.h>
 #include <stdbool.h>
- #include <stdlib.h>
 diff --git a/third_party/nvidia/backend/driver.py b/third_party/nvidia/backend/driver.py
-index 2b39fea29..3346eb954 100644
+index 21e9045b25..3660e32546 100644
 --- a/third_party/nvidia/backend/driver.py
 +++ b/third_party/nvidia/backend/driver.py
-@@ -12,7 +12,8 @@ from triton.backends.compiler import GPUTarget
+@@ -11,7 +11,8 @@ from triton.backends.compiler import GPUTarget
 from triton.backends.driver import GPUDriver
 
 dirname = os.path.dirname(os.path.realpath(__file__))
@ -20,14 +20,5 @@ index 2b39fea29..3346eb954 100644
 +import shlex
 +include_dirs = [*shlex.split("@cudaToolkitIncludeDirs@"), os.path.join(dirname, "include")]
 libdevice_dir = os.path.join(dirname, "lib")
- libraries = ['cuda']
+ libraries = ['libcuda.so.1']
 PyCUtensorMap = None
-@@ -265,7 +266,7 @@ def make_launcher(constants, signature, tensordesc_meta):
-     params.append("&global_scratch")
-     params.append("&profile_scratch")
-     src = f"""
-#include \"cuda.h\"
-+#include <cuda.h>
- #include <dlfcn.h>
- #include <stdbool.h>
- #include <stdlib.h>
--- a/pkgs/development/python-modules/triton/0005-add-gcn5-gfx906-target.patch
+++ b/pkgs/development/python-modules/triton/0005-add-gcn5-gfx906-target.patch
@ -1,131 +0,0 @@
-diff --git a/test/Conversion/amd/tritongpu_to_llvm.mlir b/test/Conversion/amd/tritongpu_to_llvm.mlir
-index 068e931a6..e651f7b0a 100644
--- a/test/Conversion/amd/tritongpu_to_llvm.mlir
-+++ b/test/Conversion/amd/tritongpu_to_llvm.mlir
-@@ -1,5 +1,6 @@
- // RUN: triton-opt %s -split-input-file --allocate-shared-memory --convert-triton-amdgpu-to-llvm=arch=gfx942 --convert-builtin-func-to-llvm | FileCheck %s
- // RUN: triton-opt %s -split-input-file --allocate-shared-memory --convert-triton-amdgpu-to-llvm=arch=gfx950 | FileCheck %s --check-prefix=GFX950
-+// RUN: triton-opt %s -split-input-file --allocate-shared-memory --convert-triton-amdgpu-to-llvm=arch=gfx906 | FileCheck %s --check-prefix=GFX906
- 
- module attributes {"ttg.num-ctas" = 1 : i32, "ttg.num-warps" = 4 : i32} {
-   // CHECK-LABEL: atomic_add_f32_scalar
-@@ -633,3 +634,27 @@ module attributes {"ttg.num-ctas" = 1 : i32, "ttg.num-warps" = 4 : i32, "ttg.thr
-     tt.return
-   }
- }
-+
-+// -----
-+
-+// GFX906-LABEL: v_dot_fp16_gfx906
-+#blocked = #ttg.blocked<{sizePerThread = [1, 1], threadsPerWarp = [8, 8], warpsPerCTA = [2, 2], order = [1, 0]}>
-+module attributes {"ttg.target" = "hip:gfx906", "ttg.num-ctas" = 1 : i32, "ttg.num-warps" = 4 : i32, "ttg.threads-per-warp" = 64 : i32} {
-+  tt.func @v_dot_fp16_gfx906(%arg0: tensor<16x16xf16, #ttg.dot_op<{opIdx = 0, parent = #blocked}>>, %arg1: tensor<16x16xf16, #ttg.dot_op<{opIdx = 1, parent = #blocked}>>, %arg2: tensor<16x16xf32, #blocked>) {
-+    // GFX906-COUNT-8: llvm.call_intrinsic "llvm.amdgcn.fdot2"
-+    %0 = tt.dot %arg0, %arg1, %arg2, inputPrecision = ieee : tensor<16x16xf16, #ttg.dot_op<{opIdx = 0, parent = #blocked}>> * tensor<16x16xf16, #ttg.dot_op<{opIdx = 1, parent = #blocked}>> -> tensor<16x16xf32, #blocked>
-+    tt.return
-+  }
-+}
-+
-+// -----
-+
-+// GFX906-LABEL: v_dot_i8_gfx906
-+#blocked = #ttg.blocked<{sizePerThread = [1, 1], threadsPerWarp = [8, 8], warpsPerCTA = [2, 2], order = [1, 0]}>
-+module attributes {"ttg.target" = "hip:gfx906", "ttg.num-ctas" = 1 : i32, "ttg.num-warps" = 4 : i32, "ttg.threads-per-warp" = 64 : i32} {
-+  tt.func @v_dot_i8_gfx906(%arg0: tensor<16x16xi8, #ttg.dot_op<{opIdx = 0, parent = #blocked}>>, %arg1: tensor<16x16xi8, #ttg.dot_op<{opIdx = 1, parent = #blocked}>>, %arg2: tensor<16x16xi32, #blocked>) {
-+    // GFX906-COUNT-4: llvm.call_intrinsic "llvm.amdgcn.sdot4"
-+    %0 = tt.dot %arg0, %arg1, %arg2, inputPrecision = ieee : tensor<16x16xi8, #ttg.dot_op<{opIdx = 0, parent = #blocked}>> * tensor<16x16xi8, #ttg.dot_op<{opIdx = 1, parent = #blocked}>> -> tensor<16x16xi32, #blocked>
-+    tt.return
-+  }
-+}
-diff --git a/third_party/amd/include/TritonAMDGPUToLLVM/TargetUtils.h b/third_party/amd/include/TritonAMDGPUToLLVM/TargetUtils.h
-index a689fe438..5d84110dc 100644
--- a/third_party/amd/include/TritonAMDGPUToLLVM/TargetUtils.h
-+++ b/third_party/amd/include/TritonAMDGPUToLLVM/TargetUtils.h
-@@ -8,6 +8,7 @@ namespace mlir::triton::AMD {
- // A list of ISA families we care about.
- enum class ISAFamily {
-   Unknown,
-+  GCN5_1,
-   CDNA1,
-   CDNA2,
-   CDNA3,
-diff --git a/third_party/amd/lib/TritonAMDGPUToLLVM/TargetInfo.cpp b/third_party/amd/lib/TritonAMDGPUToLLVM/TargetInfo.cpp
-index af7b4b1f7..01cacc9de 100644
--- a/third_party/amd/lib/TritonAMDGPUToLLVM/TargetInfo.cpp
-+++ b/third_party/amd/lib/TritonAMDGPUToLLVM/TargetInfo.cpp
-@@ -71,6 +71,7 @@ llvm::AMDGPU::GPUKind TargetInfo::getGPUKind() const {
- 
- int TargetInfo::getWarpSize() const {
-   switch (getISAFamily()) {
-+  case ISAFamily::GCN5_1:
-   case ISAFamily::CDNA1:
-   case ISAFamily::CDNA2:
-   case ISAFamily::CDNA3:
-@@ -335,10 +336,10 @@ bool TargetInfo::warpReduce(RewriterBase &rewriter, Location loc,
-     return true;
-   if (numLaneToReduce != getWarpSize())
-     return false;
-  if (isCDNA(getISAFamily()) && getISAFamily() == ISAFamily::CDNA1)
-    return false;
-  if (isRDNA(getISAFamily()) &&
-      llvm::is_contained({ISAFamily::RDNA1, ISAFamily::RDNA2}, getISAFamily()))
-+  // DPP warp reduce requires gfx90a+ (CDNA2+) or gfx11+ (RDNA3+).
-+  // Pre-CDNA2 GFX9 (gfx906/gfx908) and GFX10 (RDNA1/2) are excluded.
-+  auto v = getIsaVersion();
-+  if (!((v.Major == 9 && (v.Minor > 0 || v.Stepping >= 0xa)) || v.Major >= 11))
-     return false;
- 
-   Operation *reduxOp = op.getSingleCombiner();
-@@ -438,7 +439,7 @@ bool TargetInfo::warpReduce(RewriterBase &rewriter, Location loc,
-     buf = createDppReduxOpWithBoundCtrl(valType, buf, 1 + dppCtrlRowShr,
-                                         allRows, allBanks);
- 
-    if (isCDNA(getISAFamily())) {
-+    if (isCDNA(getISAFamily()) || getISAFamily() == ISAFamily::GCN5_1) {
-       // row_bcast:15 row_mask:0xa
-       buf = createDppReduxOpWithBoundCtrl(
-           valType, buf, static_cast<uint32_t>(DppCtrl::BCAST15), 0xa, allBanks);
-diff --git a/third_party/amd/lib/TritonAMDGPUToLLVM/TargetInfo.cpp.rej b/third_party/amd/lib/TritonAMDGPUToLLVM/TargetInfo.cpp.rej
-new file mode 100644
-index 000000000..b75ab8f11
--- /dev/null
-+++ b/third_party/amd/lib/TritonAMDGPUToLLVM/TargetInfo.cpp.rej
-@@ -0,0 +1,16 @@
-+diff a/third_party/amd/lib/TritonAMDGPUToLLVM/TargetInfo.cpp b/third_party/amd/lib/TritonAMDGPUToLLVM/TargetInfo.cpp	(rejected hunks)
-+@@ -395,10 +396,10 @@ bool TargetInfo::warpReduce(RewriterBase &rewriter, Location loc,
-+     return true;
-+   if (reduceLaneIdMask != (getWarpSize() - 1))
-+     return false;
-+-  if (isCDNA(getISAFamily()) && getISAFamily() == ISAFamily::CDNA1)
-+-    return false;
-+-  if (isRDNA(getISAFamily()) &&
-+-      llvm::is_contained({ISAFamily::RDNA1, ISAFamily::RDNA2}, getISAFamily()))
-++  // DPP warp reduce requires gfx90a+ (CDNA2+) or gfx11+ (RDNA3+).
-++  // Pre-CDNA2 GFX9 (gfx906/gfx908) and GFX10 (RDNA1/2) are excluded.
-++  auto v = getIsaVersion();
-++  if (!((v.Major == 9 && (v.Minor > 0 || v.Stepping >= 0xa)) || v.Major >= 11))
-+     return false;
-+
-+   Operation *reduxOp = op.getSingleCombiner();
-diff --git a/third_party/amd/lib/TritonAMDGPUToLLVM/TargetUtils.cpp b/third_party/amd/lib/TritonAMDGPUToLLVM/TargetUtils.cpp
-index b79841ab5..afb80d9fb 100644
--- a/third_party/amd/lib/TritonAMDGPUToLLVM/TargetUtils.cpp
-+++ b/third_party/amd/lib/TritonAMDGPUToLLVM/TargetUtils.cpp
-@@ -12,6 +12,9 @@ ISAFamily deduceISAFamily(llvm::StringRef arch) {
-   if (kind == llvm::AMDGPU::GK_GFX1250)
-     return ISAFamily::GFX1250;
- 
-+  if (kind == llvm::AMDGPU::GK_GFX906)
-+    return ISAFamily::GCN5_1;
-+
-   // CDNA ISA cases
-   switch (kind) {
-   case llvm::AMDGPU::GK_GFX950:
-@@ -41,6 +44,7 @@ ISAFamily deduceISAFamily(llvm::StringRef arch) {
- 
- bool supportsVDot(llvm::StringRef arch) {
-   switch (deduceISAFamily(arch)) {
-+  case AMD::ISAFamily::GCN5_1:
-   case AMD::ISAFamily::CDNA1:
-   case AMD::ISAFamily::CDNA2:
-   case AMD::ISAFamily::CDNA3:
--- a/pkgs/development/python-modules/triton/default.nix
+++ b/pkgs/development/python-modules/triton/default.nix
@ -42,17 +42,21 @@
  cudaSupport ? config.cudaSupport,
 }:

-buildPythonPackage (finalAttrs: {
+let
+  effectiveStdenv = if cudaSupport then cudaPackages.backendStdenv else stdenv;
+in
+buildPythonPackage.override { stdenv = effectiveStdenv; } (finalAttrs: {
  pname = "triton";
-  version = "3.6.0";
+  version = "3.7.0";
  pyproject = true;
+  __structuredAttrs = true;

  # Remember to bump triton-llvm as well!
  src = fetchFromGitHub {
    owner = "triton-lang";
    repo = "triton";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-JFSpQn+WsNnh7CAPlcpOcUp0nyKXNbJEANdXqmkt4Tc=";
+    hash = "sha256-FxbBY1lPq7765MqAPR7UljzPsmjOhKKbYExlKgeudew=";
  };

  patches = [
@ -63,8 +67,9 @@ buildPythonPackage (finalAttrs: {
      libcudaStubsDir =
        if cudaSupport then "${lib.getOutput "stubs" cudaPackages.cuda_cudart}/lib/stubs" else null;
    })
-    # Backport of https://github.com/triton-lang/triton/pull/9628 (does not apply cleanly)
-    ./0005-add-gcn5-gfx906-target.patch
+
+    # Use our `cmakeFlags` instead and avoid downloading dependencies.
+    ./inject-nix-cmakeFlags.patch
  ]
  ++ lib.optionals cudaSupport [
    (replaceVars ./0003-nvidia-cudart-a-systempath.patch {
@ -90,13 +95,6 @@ buildPythonPackage (finalAttrs: {
        --replace-fail 'yield ("triton.profiler", "third_party/proton/proton")' 'pass' \
        --replace-fail "curr_version.group(1) != version" "False"
    ''
-    # Use our `cmakeFlags` instead and avoid downloading dependencies
-    + ''
-      substituteInPlace setup.py \
-        --replace-fail \
-          "cmake_args.extend(thirdparty_cmake_args)" \
-          "cmake_args.extend(thirdparty_cmake_args + os.environ.get('cmakeFlags', \"\").split())"
-    ''
    # Don't fetch googletest
    + ''
      substituteInPlace cmake/AddTritonUnitTest.cmake \
@ -104,6 +102,15 @@ buildPythonPackage (finalAttrs: {
        --replace-fail "include(GoogleTest)" "find_package(GTest REQUIRED)"
    ''

+    # Hardcode the CC path so Triton's runtime JIT compilation doesn't break
+    # in environments without a compiler in PATH.
+    + ''
+      substituteInPlace python/triton/runtime/build.py \
+        --replace-fail \
+          'cc = os.environ.get("CC")' \
+          'cc = os.environ.get("CC", "${lib.getExe' effectiveStdenv.cc "cc"}")'
+    ''
+
    # triton will try dlopening libcublas.so at runtime
    + lib.optionalString cudaSupport ''
      substituteInPlace third_party/nvidia/include/cublas_instance.h \
@ -135,7 +142,7 @@ buildPythonPackage (finalAttrs: {
    # `find_package` is called with `NO_DEFAULT_PATH`
    # https://cmake.org/cmake/help/latest/command/find_package.html
    # https://github.com/triton-lang/triton/blob/c3c476f357f1e9768ea4e45aa5c17528449ab9ef/third_party/amd/CMakeLists.txt#L6
-    (lib.cmakeFeature "LLD_DIR" "${lib.getLib llvm}")
+    (lib.cmakeFeature "LLD_DIR" "${lib.getLib llvm}/lib/cmake/lld")
  ];

  buildInputs = [
@ -159,14 +166,19 @@ buildPythonPackage (finalAttrs: {
      export MAX_JOBS="$NIX_BUILD_CORES"
    '';

+  # `examples/plugins` (an MLIR example dialect plugin and a unit-test helper lib) is built
+  # unconditionally with the Python module and shipped into `triton/plugins/`.
+  # It is unused at runtime and keeps a forbidden RPATH reference to the build directory, which
+  # fails the fixup phase.
+  postInstall = ''
+    rm -rf "$out/${python.sitePackages}/triton/plugins"
+  '';
+
  env = {
    TRITON_BUILD_PROTON = "OFF";
    TRITON_OFFLINE_BUILD = true;
  }
  // lib.optionalAttrs cudaSupport {
-    CC = lib.getExe' cudaPackages.backendStdenv.cc "cc";
-    CXX = lib.getExe' cudaPackages.backendStdenv.cc "c++";
-
    NIX_CFLAGS_COMPILE = toString [
      # Pybind11 started generating strange errors since python 3.12. Observed only in the CUDA branch.
      # https://gist.github.com/SomeoneSerge/7d390b2b1313957c378e99ed57168219#file-gistfile0-txt-L1042
@ -206,7 +218,7 @@ buildPythonPackage (finalAttrs: {
  ];

  passthru = {
-    gpuCheck = stdenv.mkDerivation {
+    gpuCheck = effectiveStdenv.mkDerivation {
      pname = "triton-pytest";
      inherit (triton) version src;

@ -370,7 +382,7 @@ buildPythonPackage (finalAttrs: {
              if os.environ.get("HOME", None) == "/homeless-shelter":
                os.environ["HOME"] = os.environ.get("TMPDIR", "/tmp")
              if "CC" not in os.environ:
-                os.environ["CC"] = "${lib.getExe' cudaPackages.backendStdenv.cc "cc"}"
+                os.environ["CC"] = "${lib.getExe' effectiveStdenv.cc "cc"}"
              torch.manual_seed(0)
              size = 12345
              x = torch.rand(size, device='cuda')
--- a/pkgs/development/python-modules/triton/inject-nix-cmakeFlags.patch
+++ b/pkgs/development/python-modules/triton/inject-nix-cmakeFlags.patch
@ -0,0 +1,16 @@
+diff --git a/setup.py b/setup.py
+index d8e0860291..bc09dada5a 100644
+--- a/setup.py
+++ b/setup.py
+@@ -476,6 +476,11 @@ class CMakeBuild(build_ext):
+             cmake_args.append("-DLLVM_EXTERNAL_LIT=" + lit_dir)
+         cmake_args.extend(thirdparty_cmake_args)
+ 
+        import json
+
+        nix_attrs_json = json.load(open(os.environ["NIX_ATTRS_JSON_FILE"]))
+        cmake_args.extend(thirdparty_cmake_args + nix_attrs_json.get("cmakeFlags", []))
+
+         # configuration
+         cfg = get_build_type()
+         build_args = ["--config", cfg]
--- a/Show more
+++ b/Show more