Merge staging-next into staging

2026-07-06 17:13:24 -05:00 · 2026-06-29 13:30:45 +00:00 · 2026-06-29 13:30:45 +00:00 · 5499574b39
commit 5499574b39
parent 67e5f7660c 77e66ec830
89 changed files with 1671 additions and 376 deletions
--- a/ci/OWNERS
+++ b/ci/OWNERS
@ -321,6 +321,11 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
 /nixos/tests/kea.nix @mweinelt
 /nixos/tests/knot.nix @mweinelt

+# Web servers
+/doc/packages/nginx.section.md @leona-ya @Ma27
+/pkgs/servers/http/nginx/ @helsinki-Jo @leona-ya @Ma27
+/nixos/modules/services/web-servers/nginx/ @leona-ya @Ma27
+
 # D
 /pkgs/build-support/dlang @jtbx @TomaSajt

--- a/doc/release-notes/rl-2605.section.md
+++ b/doc/release-notes/rl-2605.section.md
@ -380,6 +380,8 @@

 - `collabora-desktop` The desktop version of Collabora Office is now available, package version `25.05.9.2-2`.

+- The `services.geoserver` NixOS module has been added to allow running [Geoserver](https://geoserver.org/) as a service.
+
 - `fetchPnpmDeps` and `pnpmConfigHook` were added as top-level attributes, replacing the now deprecated `pnpm.fetchDeps` and `pnpm.configHook` attributes.

 - `fetchPnpmDeps`' `fetcherVersion = 1` and `fetcherVersion = 2` are deprecated
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -1907,6 +1907,12 @@
    githubId = 81317317;
    name = "Anna Aurora";
  };
+  anned20 = {
+    email = "annedouwe@bouma.tech";
+    github = "anned20";
+    githubId = 6921250;
+    name = "Anne Douwe Bouma";
+  };
  anninzy = {
    github = "anninzy";
    githubId = 143312793;
@ -3945,6 +3951,12 @@
    githubId = 140968250;
    keys = [ { fingerprint = "8321 ED3A 8DB9 99A5 1F3B  F80F F268 2914 EA42 DE26"; } ];
  };
+  bpmct = {
+    name = "Ben Potter";
+    email = "ben@coder.com";
+    github = "bpmct";
+    githubId = 22407953;
+  };
  Br1ght0ne = {
    name = "Oleksii Filonenko";
    email = "nixpkgs@brightone.cloud";
@ -6807,6 +6819,12 @@
    github = "developer-guy";
    githubId = 16693043;
  };
+  developmentcats = {
+    name = "Christofer";
+    email = "christofer@coder.com";
+    github = "DevelopmentCats";
+    githubId = 176868952;
+  };
  devhell = {
    email = ''"^"@regexmail.net'';
    github = "devhell";
@ -6849,6 +6867,12 @@
    github = "dfithian";
    githubId = 8409320;
  };
+  dfjay = {
+    email = "github@dfjay.com";
+    name = "Pavel Yozhikov";
+    github = "dfjay";
+    githubId = 41841630;
+  };
  dflores = {
    email = "dflores.country455@passinbox.com";
    name = "David Flores";
@ -7915,6 +7939,11 @@
    githubId = 183738665;
    name = "Marcell Tóth";
  };
+  ELHart05 = {
+    name = "Okba Allaoua";
+    github = "ELHart05";
+    githubId = 96151694;
+  };
  eliandoran = {
    email = "contact@eliandoran.me";
    name = "Elian Doran";
@ -8710,6 +8739,12 @@
    name = "Fábio Batista";
    keys = [ { fingerprint = "D2D8 69D8 5EEC 30AD D327  B4A5 6CD5 5257 DB01 8B72"; } ];
  };
+  FabricSoul = {
+    name = "FabricSoul";
+    github = "FabricSoul";
+    githubId = 114606360;
+    email = "fabric.soul7@gmail.com";
+  };
  fallenbagel = {
    name = "fallenbagel";
    github = "fallenbagel";
@ -12826,6 +12861,11 @@
    name = "Jonathan Hult";
    keys = [ { fingerprint = "DEE7 054C 5D43 ABEA C0F9  8BE4 3512 C8F8 2E2F 2A16"; } ];
  };
+  jiamingc = {
+    name = "Jiaming Chen";
+    github = "jiamingc";
+    githubId = 21327067;
+  };
  jiegec = {
    name = "Jiajie Chen";
    email = "c@jia.je";
@ -14407,6 +14447,12 @@
    githubId = 691290;
    name = "Keshav Kini";
  };
+  kinnrai = {
+    email = "me@kinnrai.com";
+    github = "kinnrai";
+    githubId = 72676584;
+    name = "kinnrai";
+  };
  kintrix = {
    email = "kintrix007@proton.me";
    github = "kintrix007";
@ -21744,6 +21790,12 @@
    githubId = 2997905;
    name = "Petr Hodina";
  };
+  phorcys420 = {
+    name = "Adele";
+    email = "adele@coder.com";
+    github = "phorcys420";
+    githubId = 57866459;
+  };
  photex = {
    email = "photex@gmail.com";
    github = "photex";
@ -29936,6 +29988,12 @@
    name = "Edward";
    keys = [ { fingerprint = "0BC2F3C6AE5D73DAE870CB0E8AE4DE0EFB6CC443"; } ];
  };
+  WiredMic = {
+    name = "Rasmus Enevoldsen";
+    github = "WiredMic";
+    githubId = 111731519;
+    email = "rasmus@enev.dk";
+  };
  wirew0rm = {
    email = "alex@wirew0rm.de";
    github = "wirew0rm";
@ -30996,6 +31054,11 @@
    githubId = 25164338;
    keys = [ { fingerprint = "065A 0A98 FE61 E1C1 41B0  AFE7 64FA BC62 F457 2875"; } ];
  };
+  zehuajun = {
+    github = "zehuajun";
+    githubId = 87254340;
+    name = "zehuajun";
+  };
  zelkourban = {
    name = "zelkourban";
    email = "zelo.urban@gmail.com";
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -1668,6 +1668,7 @@
  ./services/web-apps/froide-govplan.nix
  ./services/web-apps/galene.nix
  ./services/web-apps/gancio.nix
+  ./services/web-apps/geoserver.nix
  ./services/web-apps/gerrit.nix
  ./services/web-apps/glance.nix
  ./services/web-apps/glitchtip.nix
--- a/nixos/modules/services/misc/ntfy-sh.nix
+++ b/nixos/modules/services/misc/ntfy-sh.nix
@ -103,6 +103,7 @@ in
          ExecStart = "${cfg.package}/bin/ntfy serve -c ${configuration}";
          User = cfg.user;
          StateDirectory = "ntfy-sh";
+          RuntimeDirectory = "ntfy-sh";

          DynamicUser = true;
          AmbientCapabilities = "CAP_NET_BIND_SERVICE";
--- a/nixos/modules/services/networking/epmd.nix
+++ b/nixos/modules/services/networking/epmd.nix
@ -21,7 +21,7 @@ in
        Erlang computations.
      '';
    };
-    package = lib.mkPackageOption pkgs "erlang" { };
+    package = lib.mkPackageOption pkgs [ "beamPackages" "erlang" ] { };
    listenStream = lib.mkOption {
      type = oneOf [
        str
--- a/nixos/modules/services/web-apps/geoserver.nix
+++ b/nixos/modules/services/web-apps/geoserver.nix
@ -0,0 +1,81 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+with lib;
+
+let
+
+  cfg = config.services.geoserver;
+
+in
+{
+  options = {
+    services.geoserver = {
+      enable = mkEnableOption "Geoserver service";
+
+      package = lib.mkPackageOption pkgs "geoserver" { };
+
+      user = mkOption {
+        type = types.str;
+        default = "geoserver";
+        description = "The (system) user that will run the service.";
+      };
+
+      group = mkOption {
+        type = types.str;
+        default = "geoserver";
+        description = "The user's group.";
+      };
+
+      jvmOpts = mkOption {
+        type = types.lines;
+        default = "";
+        description = "Any options passed to the JVM via the `JAVA_OPTS` environment variable. See [startup.sh](https://github.com/geoserver/geoserver/blob/main/src/release/bin/startup.sh) for details.";
+      };
+
+      jettyOpts = mkOption {
+        type = types.lines;
+        default = "";
+        example = "jetty.http.port=1234";
+        description = "Any options passed to the Jetty web server via the `JETTY_OPTS` environment variable. See [startup.sh](https://github.com/geoserver/geoserver/blob/main/src/release/bin/startup.sh) for details.";
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+
+    users.users."${cfg.user}" = {
+      group = cfg.group;
+      isSystemUser = true;
+    };
+    users.groups."${cfg.group}" = { };
+
+    systemd.services.geoserver = {
+      description = "Geoserver";
+
+      wantedBy = [ "multi-user.target" ];
+
+      environment = {
+        GEOSERVER_HOME = "${cfg.package}/share/geoserver";
+        GEOSERVER_DATA_DIR = "/var/lib/geoserver";
+        JAVA_OPTS = "${cfg.jvmOpts}";
+        JETTY_OPTS = "${cfg.jettyOpts}";
+      };
+
+      serviceConfig = {
+        ExecStart = "${cfg.package}/bin/geoserver-startup";
+        User = cfg.user;
+        Group = cfg.group;
+        NoNewPrivileges = true;
+        ProtectHome = true; # true=deny access to /home, /root, /run/user
+        StateDirectory = "geoserver";
+      };
+    };
+  };
+
+  meta.teams = [ lib.teams.geospatial ];
+}
--- a/nixos/modules/services/web-servers/nginx/default.nix
+++ b/nixos/modules/services/web-servers/nginx/default.nix
@ -1757,4 +1757,8 @@ in
      postrotate = "[ ! -f /var/run/nginx/nginx.pid ] || kill -USR1 `cat /var/run/nginx/nginx.pid`";
    };
  };
+  meta.maintainers = [
+    lib.maintainers.leona
+    lib.maintainers.ma27
+  ];
 }
--- a/nixos/tests/geoserver.nix
+++ b/nixos/tests/geoserver.nix
@ -28,59 +28,86 @@ in
      {
        virtualisation.diskSize = 2 * 1024;

+        # The VM has several Geoserver package installations. They can't be run
+        # in parallel but are launched sequentially during the test run.
+        # Context managers (see below) are used to start/stop them selectively.
        environment.systemPackages = [
          geoserver
-          geoserverWithImporterExtension
          geoserverWithAllExtensions
        ];
+
+        services.geoserver = {
+          enable = true;
+          jettyOpts = "jetty.http.port=8090";
+          package = geoserverWithImporterExtension;
+        };
+        systemd.services.geoserver.wantedBy = lib.mkForce [ ]; # do not start the service at boot
      };
  };

  testScript = ''
    from contextlib import contextmanager

-    curl_cmd = "curl --fail --connect-timeout 2"
-    curl_cmd_rest = f"{curl_cmd} -u admin:geoserver -X GET"
-    base_url = "http://localhost:8080/geoserver"
+    CURL_CMD = "curl --fail --connect-timeout 2"
+    CURL_CMD_REST = f"{CURL_CMD} -u admin:geoserver -X GET"
+    BASE_URL_PKG = "http://localhost:8080/geoserver"
+    BASE_URL_SERVICE = "http://localhost:8090/geoserver"
    log_file = "./log.txt"

    @contextmanager
-    def running_geoserver(pkg):
+    def running_geoserver_pkg(pkg):
      try:
        print(f"Launching geoserver from {pkg}...")
        machine.execute(f"{pkg}/bin/geoserver-startup > {log_file} 2>&1 &")
-        machine.wait_until_succeeds(f"{curl_cmd} {base_url} 2>&1", timeout=60)
+        machine.wait_until_succeeds(f"{CURL_CMD} {BASE_URL_PKG} 2>&1", timeout=60)
        yield
      finally:
        # We need to wait a little bit to make sure the server is properly
        # shutdown before launching a new instance.
        machine.execute(f"{pkg}/bin/geoserver-shutdown; sleep 1")

+    @contextmanager
+    def running_geoserver_service():
+      service_name = "geoserver"
+      try:
+        print(f"Launching service {service_name}...")
+        machine.execute(f"systemctl start {service_name} > tee {log_file} 2>&1")
+        machine.wait_until_succeeds(f"{CURL_CMD} {BASE_URL_SERVICE} 2>&1", timeout=60)
+        yield
+      finally:
+        # We need to wait a little bit to make sure the server is properly
+        # shutdown before launching a new instance.
+        machine.execute(f"systemctl stop {service_name}; sleep 1")
+
    start_all()

-    with running_geoserver("${geoserver}"):
-      machine.succeed(f"{curl_cmd} {base_url}/ows?service=WMS&version=1.3.0&request=GetCapabilities")
+    with subtest("A standalone Geoserver installation without extensions can be started."):
+      with running_geoserver_pkg("${geoserver}"):
+        machine.succeed(f"{CURL_CMD} {BASE_URL_PKG}/ows?service=WMS&version=1.3.0&request=GetCapabilities")

-      # No extensions yet.
-      machine.fail(f"{curl_cmd_rest} {base_url}/rest/imports")
-      machine.fail(f"{curl_cmd_rest} {base_url}/rest/monitor/requests.csv")
+        # No extensions yet.
+        machine.fail(f"{CURL_CMD_REST} {BASE_URL_PKG}/rest/imports")
+        machine.fail(f"{CURL_CMD_REST} {BASE_URL_PKG}/rest/monitor/requests.csv")

+    with subtest("A standalone Geoserver installation with numerous extensions can be started."):
+      with running_geoserver_pkg("${geoserverWithAllExtensions}"):
+        machine.succeed(f"{CURL_CMD_REST} {BASE_URL_PKG}/rest/imports")
+        machine.succeed(f"{CURL_CMD_REST} {BASE_URL_PKG}/rest/monitor/requests.csv")
+        _, stdout = machine.execute(f"cat {log_file}")
+        print(stdout.replace("\\n", "\n"))
+        assert "GDAL Native Library loaded" in stdout, "gdal"
+        assert "org.geotools.imageio.netcdf.utilities.NetCDFUtilities" in stdout, "netcdf"
+        assert "Unable to load library 'netcdf'" not in stdout, "netcdf"

-    with running_geoserver("${geoserverWithImporterExtension}"):
-      machine.succeed(f"{curl_cmd_rest} {base_url}/rest/imports")
-      machine.fail(f"{curl_cmd_rest} {base_url}/rest/monitor/requests.csv")
+        # libjpeg-turbo is disabled as of 2.28.1.
+        # assert "The turbo jpeg encoder is available for usage" in stdout, "libjpeg-turbo"

-    with running_geoserver("${geoserverWithAllExtensions}"):
-      machine.succeed(f"{curl_cmd_rest} {base_url}/rest/imports")
-      machine.succeed(f"{curl_cmd_rest} {base_url}/rest/monitor/requests.csv")
-      _, stdout = machine.execute(f"cat {log_file}")
-      print(stdout.replace("\\n", "\n"))
-      assert "GDAL Native Library loaded" in stdout, "gdal"
-      assert "org.geotools.imageio.netcdf.utilities.NetCDFUtilities" in stdout, "netcdf"
-      assert "Unable to load library 'netcdf'" not in stdout, "netcdf"
+    with subtest("Geoserver can be run as a service. Some Extensions are available."):
+      with running_geoserver_service():
+        # Only the importer extension is available.
+        machine.succeed(f"{CURL_CMD_REST} {BASE_URL_SERVICE}/rest/imports")
+        machine.fail(f"{CURL_CMD_REST} {BASE_URL_SERVICE}/rest/monitor/requests.csv")

-      # libjpeg-turbo is disabled as of 2.28.1.
-      # assert "The turbo jpeg encoder is available for usage" in stdout, "libjpeg-turbo"

  '';
 }
--- a/pkgs/applications/editors/vscode/extensions/asciidoctor.asciidoctor-vscode/commands-abspath.patch
+++ b/pkgs/applications/editors/vscode/extensions/asciidoctor.asciidoctor-vscode/commands-abspath.patch
@ -1,13 +1,11 @@
-diff --git a/package.json b/package.json
-index 7ab70e8..2ebe541 100644
 --- a/package.json
 +++ b/package.json
@@ -437,7 +437,7 @@
- 					},
- 					"asciidoc.asciidoctorpdf_command": {
- 						"type": "string",
-						"default": "asciidoctor-pdf",
-+						"default": "@ASCIIDOCTOR_PDF_BIN@",
- 						"markdownDescription": "%asciidoc.asciidoctorpdf_command.desc%",
- 						"markdownDeprecationMessage": "%asciidoc.asciidoctorpdf_command.deprecationMessage%",
- 						"scope": "resource"
+           },
+           "asciidoc.asciidoctorpdf_command": {
+             "type": "string",
+-            "default": "asciidoctor-pdf",
+            "default": "@ASCIIDOCTOR_PDF_BIN@",
+             "markdownDescription": "%asciidoc.asciidoctorpdf_command.desc%",
+             "markdownDeprecationMessage": "%asciidoc.asciidoctorpdf_command.deprecationMessage%",
+             "scope": "resource"
--- a/pkgs/applications/editors/vscode/extensions/asciidoctor.asciidoctor-vscode/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/asciidoctor.asciidoctor-vscode/default.nix
@ -8,8 +8,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
  mktplcRef = {
    name = "asciidoctor-vscode";
    publisher = "asciidoctor";
-    version = "3.4.2";
-    hash = "sha256-HG3y7999xeE1erQZCnBgUPj/aC0Kwyn20PEZR9gKrxY=";
+    version = "3.4.5";
+    hash = "sha256-X7njFSqfb45l6ZTr7GDS3At6DMHyvBT41JoghOeVjwI=";
  };

  patches = [
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@ -4811,6 +4811,22 @@ let
        };
      };

+      tomblind.local-lua-debugger-vscode = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "local-lua-debugger-vscode";
+          publisher = "tomblind";
+          version = "0.3.3";
+          hash = "sha256-7uZHbhOa/GT9F7+xikaxuQXIGzre1q1uWTWaTJhi2UA=";
+        };
+        meta = {
+          changelog = "https://github.com/tomblind/local-lua-debugger-vscode/blob/master/CHANGELOG.md";
+          description = "Simple Lua debugger for Visual Studio Code which requires no additional dependencies";
+          downloadPage = "https://marketplace.visualstudio.com/items?itemName=tomblind.local-lua-debugger-vscode";
+          homepage = "https://github.com/tomblind/local-lua-debugger-vscode";
+          license = lib.licenses.mit;
+        };
+      };
+
      tsandall.opa = buildVscodeMarketplaceExtension {
        mktplcRef = {
          name = "opa";
--- a/pkgs/applications/emulators/libretro/cores/beetle-pce-fast.nix
+++ b/pkgs/applications/emulators/libretro/cores/beetle-pce-fast.nix
@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "mednafen-pce-fast";
-  version = "0-unstable-2026-05-22";
+  version = "0-unstable-2026-06-26";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "beetle-pce-fast-libretro";
-    rev = "b4de121a733a57ce825a7fd7543206ca96af8a18";
-    hash = "sha256-0V6w9F2T2ROkPvH6K5mKltblogn9mAtvb/JGrWMk4CQ=";
+    rev = "4727b96c10f50405167d98d364844469307fcc41";
+    hash = "sha256-1eA4uBm7BHOQioTQqdglEtosPNZ24qI58FcJ+J7TC+o=";
  };

  makefile = "Makefile";
--- a/pkgs/applications/networking/instant-messengers/gajim/default.nix
+++ b/pkgs/applications/networking/instant-messengers/gajim/default.nix
@ -25,7 +25,6 @@
  gst-libav,
  gst-plugins-good,
  libnice,
-  enableE2E ? true,
  enableSecrets ? true,
  libsecret,
  enableRST ? true,
@ -43,14 +42,14 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "gajim";
-  version = "2.4.6";
+  version = "2.4.7";

  src = fetchFromGitLab {
    domain = "dev.gajim.org";
    owner = "gajim";
    repo = "gajim";
    tag = version;
-    hash = "sha256-QHfJ52uMDlE/rqqy7y2JIQLMOPaTp7eh4DEsPLBx6p8=";
+    hash = "sha256-tZ1+DRVCzwaWeur9mwc/zE34H2xdqk96upqWfqNTl3g=";
  };

  pyproject = true;
@ -115,12 +114,9 @@ python3.pkgs.buildPythonApplication rec {
      httpx
      h2
      truststore
+      pysequoia
    ]
    ++ httpx.optional-dependencies.socks
-    ++ lib.optionals enableE2E [
-      pycrypto
-      python-gnupg
-    ]
    ++ lib.optional enableRST docutils
    ++ extraPythonPackages python3.pkgs;

--- a/pkgs/by-name/au/authentik/package.nix
+++ b/pkgs/by-name/au/authentik/package.nix
@ -190,7 +190,7 @@ let
    outputHash =
      {
        "aarch64-linux" = "sha256-41xZEfLul92vJATZqyVnd7Pp++NzLL/u8NeJJPHpXrw=";
-        "x86_64-linux" = "sha256-FpfOl6wNCgXLg86+vbjnYkcOnpaOZBCNxJiFDRT5W3s=";
+        "x86_64-linux" = "sha256-p6xjAinU2Isl/uYgoJuacqHN7jBnbWam40J6AQudbtQ=";
      }
      .${stdenvNoCC.hostPlatform.system} or (throw "authentik-webui-deps: unsupported host platform");
    outputHashMode = "recursive";
--- a/pkgs/by-name/az/azure-cli/extensions-manual.nix
+++ b/pkgs/by-name/az/azure-cli/extensions-manual.nix
@ -125,9 +125,9 @@

  azure-devops = mkAzExtension rec {
    pname = "azure-devops";
-    version = "1.0.4";
+    version = "1.0.5";
    url = "https://github.com/Azure/azure-cli-extensions/releases/download/azure-devops-${version}/azure_devops-${version}-py2.py3-none-any.whl";
-    hash = "sha256-MYW8CnDfBnBi/dfOgSsI+yT605M8uSxvfjEkEdqYVSo=";
+    hash = "sha256-uzgGU9/EJ7eaQ3HYajEuKRKGcMGW/jQPxGSt/Zgo2rQ=";
    description = "Tools for managing Azure DevOps";
    propagatedBuildInputs = with python3Packages; [ distro ];
    meta.maintainers = with lib.maintainers; [ katexochen ];
--- a/pkgs/by-name/bi/bitbox/package.nix
+++ b/pkgs/by-name/bi/bitbox/package.nix
@ -21,14 +21,14 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "bitbox";
-  version = "4.50.1";
+  version = "4.51.0";

  src = fetchFromGitHub {
    owner = "BitBoxSwiss";
    repo = "bitbox-wallet-app";
    tag = "v${version}";
    fetchSubmodules = true;
-    hash = "sha256-ZK1US/RF67QPyV0xRVIw4mecNZM/82GhWvjhJ47rKHU=";
+    hash = "sha256-/S+UIYSntUb0fyR6T/Egj6LX9TCI1l0h8gPHMntiTYU=";
  };

  postPatch = ''
--- a/pkgs/by-name/bo/boat-cli/package.nix
+++ b/pkgs/by-name/bo/boat-cli/package.nix
@ -0,0 +1,43 @@
+{
+  lib,
+  fetchFromGitHub,
+  writableTmpDirAsHomeHook,
+  rustPlatform,
+  sqlite,
+  nix-update-script,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "boat-cli";
+  version = "0.9.1";
+
+  src = fetchFromGitHub {
+    owner = "coko7";
+    repo = "boat-cli";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-+QhW7QWBoDzSNzkHotNLg/dnolSd3uK/IcDPnzVKBbI=";
+  };
+
+  cargoHash = "sha256-rfZbOeOoBWMp232vXVeKtQz3LP5IloIBZS0OWkN8Fys=";
+
+  nativeBuildInputs = [
+    writableTmpDirAsHomeHook
+  ];
+
+  buildInputs = [
+    sqlite
+  ];
+
+  __structuredAttrs = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Basic Opinionated Activity Tracker, a command line interface inspired by bartib.";
+    homepage = "https://github.com/coko7/boat-cli";
+    changelog = "https://github.com/coko7/boat-cli/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ tgi74 ];
+    mainProgram = "boat";
+  };
+})
--- a/pkgs/by-name/ce/censor/package.nix
+++ b/pkgs/by-name/ce/censor/package.nix
@ -13,14 +13,14 @@

 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "censor";
-  version = "0.7.1";
+  version = "0.7.2";
  pyproject = false;

  src = fetchFromCodeberg {
    owner = "censor";
    repo = "Censor";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-wimLSoejojVBdHnuzLxOW4QssJZpK0GTp64oIvtSqBk=";
+    hash = "sha256-444EGJCNnRRkuTzm4HdapUvwphx9EavxeyAI0Sxh8G8=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/co/coder/package.nix
+++ b/pkgs/by-name/co/coder/package.nix
@ -102,8 +102,11 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    license = lib.licenses.agpl3Only;
    mainProgram = "coder";
    maintainers = with lib.maintainers; [
+      bpmct
+      developmentcats
      ghuntley
      kylecarbs
+      phorcys420
    ];
  };

--- a/pkgs/by-name/cp/cpat/format-security.patch
+++ b/pkgs/by-name/cp/cpat/format-security.patch
@ -0,0 +1,44 @@
+diff --git a/src/cpat.c b/src/cpat.c
+index 4bb5dec..6aeeca3 100644
+--- a/src/cpat.c
+++ b/src/cpat.c
+@@ -126,10 +126,10 @@ pager(char *title,char* text,int num_phrases, char **phrases)
+ 
+     /* Add title and header lines */
+     wattron(outer,A_UNDERLINE);
+-    mvwprintw(outer,2,4,title);
+    mvwprintw(outer,2,4,"%s",title);
+     xtermtitle(title);
+     wattroff(outer,A_UNDERLINE);
+-    for (i = 0;i < num_phrases;i++) mvwprintw(outer,4+i,4,phrases[i]);
+    for (i = 0;i < num_phrases;i++) mvwprintw(outer,4+i,4,"%s",phrases[i]);
+     wrefresh(outer);
+ 
+     /* Values for inner window */
+@@ -244,10 +244,10 @@ d                    Scroll forward half a page\n\
+ q                    Exit pager",-1,NULL);
+                     box(outer,0,0);
+                     wattron(outer,A_UNDERLINE);
+-                    mvwprintw(outer,2,4,title);
+                    mvwprintw(outer,2,4,"%s",title);
+                     xtermtitle(title);
+                     wattroff(outer,A_UNDERLINE);
+-                    for (i = 0;i < num_phrases;i++) mvwprintw(outer,4+i,4,phrases[i]);
+                    for (i = 0;i < num_phrases;i++) mvwprintw(outer,4+i,4,"%s",phrases[i]);
+                     wrefresh(outer);
+                     prev_line = -1; /* force page refresh */
+                     break;
+@@ -354,11 +354,11 @@ menu(char *title,char **queries,int num_queries,
+     box(outer, 0, 0);
+ 
+     wattron(outer,A_UNDERLINE);
+-    mvwprintw(outer,title_y,4,title);
+    mvwprintw(outer,title_y,4,"%s",title);
+     xtermtitle(title);
+     wattroff(outer,A_UNDERLINE);
+     for (i = 0;i < num_phrases;i++) 
+-        mvwprintw(outer,phrases_y+i,6,phrases[i]);
+        mvwprintw(outer,phrases_y+i,6,"%s",phrases[i]);
+     wrefresh(outer);
+ 
+     input = newwin(inner_h,inner_w,inner_y,inner_x);
--- a/pkgs/by-name/cp/cpat/package.nix
+++ b/pkgs/by-name/cp/cpat/package.nix
@ -0,0 +1,32 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  ncurses,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "cpat";
+  version = "1.4.2";
+
+  src = fetchurl {
+    url = "https://downloads.sourceforge.net/project/cpat/v1.4.2/cpat-${finalAttrs.version}.tar.gz";
+    hash = "sha256-viVbaU21tI4lU+0WoSzRW81aUPzCIkJKjJR/BPEFO2c=";
+  };
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  patches = [ ./format-security.patch ];
+
+  buildInputs = [ ncurses ];
+
+  meta = {
+    description = "A curses based card games application";
+    homepage = "https://sourceforge.net/projects/cpat/";
+    mainProgram = "cpat";
+    license = lib.licenses.gpl3Only;
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [ castorNova2 ];
+  };
+})
--- a/pkgs/by-name/ct/ctranslate2/package.nix
+++ b/pkgs/by-name/ct/ctranslate2/package.nix
@ -51,6 +51,13 @@ stdenv'.mkDerivation (finalAttrs: {
        'CMAKE_MINIMUM_REQUIRED(VERSION 3.10 FATAL_ERROR)'

    sed -e '1i #include <cstdint>' -i third_party/cxxopts/include/cxxopts.hpp
+
+    # Prevent setting the default nvcc arch flags, which can be
+    # ones that don't work with the current CUDA version
+    substituteInPlace CMakeLists.txt \
+      --replace-fail \
+        'list(APPEND CUDA_NVCC_FLAGS ''${ARCH_FLAGS})' \
+        ""
  '';

  nativeBuildInputs = [
--- a/pkgs/by-name/cu/cup-docker-noserver/package.nix
+++ b/pkgs/by-name/cu/cup-docker-noserver/package.nix
@ -1,7 +0,0 @@
-{
-  cup-docker,
-}:
-
-cup-docker.override {
-  withServer = false;
-}
--- a/pkgs/by-name/cu/cup-docker/package.nix
+++ b/pkgs/by-name/cu/cup-docker/package.nix
@ -1,91 +0,0 @@
-{
-  rustPlatform,
-  fetchFromGitHub,
-  lib,
-  stdenvNoCC,
-  bun,
-  nodejs-slim_latest,
-  nix-update-script,
-  withServer ? true,
-}:
-rustPlatform.buildRustPackage (finalAttrs: {
-  pname = "cup-docker";
-  version = "3.5.1";
-
-  src = fetchFromGitHub {
-    owner = "sergi0g";
-    repo = "cup";
-    tag = "v${finalAttrs.version}";
-    hash = "sha256-l7TQwCzQNwrsM+xRcRcQaxIsnd8SVzrqEMwIoZGVBR0=";
-  };
-
-  web = stdenvNoCC.mkDerivation (finalAttrsWeb: {
-    pname = "cup-docker-web";
-    inherit (finalAttrs) version src;
-    impureEnvVars = lib.fetchers.proxyImpureEnvVars ++ [
-      "GIT_PROXY_COMMAND"
-      "SOCKS_SERVER"
-    ];
-    sourceRoot = "${finalAttrsWeb.src.name}/web";
-    nativeBuildInputs = [
-      bun
-      nodejs-slim_latest
-    ];
-    configurePhase = ''
-      runHook preConfigure
-      bun install --no-progress --frozen-lockfile
-      substituteInPlace node_modules/.bin/{vite,tsc} \
-        --replace-fail "/usr/bin/env node" "${nodejs-slim_latest}/bin/node"
-      runHook postConfigure
-    '';
-    buildPhase = ''
-      runHook preBuild
-      bun run build
-      runHook postBuild
-    '';
-    installPhase = ''
-      runHook preInstall
-      mkdir -p $out/dist
-      cp -R ./dist $out
-      runHook postInstall
-    '';
-    outputHash = "sha256-uLsWppRabaI7JSHYf3YsEvf0Y36kU/iuNXnDXd+6AXY=";
-    outputHashAlgo = "sha256";
-    outputHashMode = "recursive";
-  });
-
-  cargoHash = "sha256-1VSbv6lDRRLZIu7hYrAqzQmvxcuhnPU0rcWfg7Upcm4=";
-
-  buildNoDefaultFeatures = true;
-  buildFeatures = [
-    "cli"
-  ]
-  ++ lib.optional withServer [
-    "server"
-  ];
-
-  preConfigure = lib.optionalString withServer ''
-    cp -r ${finalAttrs.web}/dist src/static
-  '';
-
-  passthru = {
-    updateScript = nix-update-script {
-      extraArgs = [
-        "--subpackage"
-        "web"
-      ];
-    };
-  };
-
-  meta = {
-    description = "Lightweight way to check for container image updates. written in Rust";
-    homepage = "https://cup.sergi0g.dev";
-    license = lib.licenses.agpl3Only;
-    platforms = lib.platforms.all;
-    changelog = "https://github.com/sergi0g/cup/releases";
-    mainProgram = "cup";
-    maintainers = with lib.maintainers; [
-      kuflierl
-    ];
-  };
-})
--- a/pkgs/by-name/cu/curlconverter/package.nix
+++ b/pkgs/by-name/cu/curlconverter/package.nix
@ -0,0 +1,31 @@
+{
+  lib,
+  buildNpmPackage,
+  fetchFromGitHub,
+}:
+buildNpmPackage (final: {
+  pname = "curlconverter";
+  version = "4.12.0";
+
+  src = fetchFromGitHub {
+    owner = "curlconverter";
+    repo = "curlconverter";
+    tag = "v${final.version}";
+    hash = "sha256-eJ8D5HkYSkWqQt/4UTv6/X6coLwcODde6xGEPQXgJRo=";
+  };
+
+  npmDepsHash = "sha256-UIbMvw8hkZxtSGInV2+Fjm4DZahrdGtSxi0Unhb5lh8=";
+
+  # Prevent the dependency tree-sitter-cli from running its install script, which has an impure network request: https://github.com/tree-sitter/tree-sitter/blob/fd77bda97a0ca05d124590833312e4103f985543/crates/cli/npm/install.js#L63
+  npmFlags = [ "--ignore-scripts" ];
+
+  npmBuildScript = "compile";
+
+  meta = {
+    description = "Convert curl commands to Python, JavaScript and more";
+    homepage = "https://curlconverter.com/";
+    license = lib.licenses.mit;
+    mainProgram = "curlconverter";
+    maintainers = with lib.maintainers; [ jiamingc ];
+  };
+})
--- a/pkgs/by-name/db/dbcsr/package.nix
+++ b/pkgs/by-name/db/dbcsr/package.nix
@ -16,13 +16,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "dbcsr";
-  version = "2.9.1";
+  version = "2.10.0";

  src = fetchFromGitHub {
    owner = "cp2k";
    repo = "dbcsr";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-F6EvpsPAJJvmEZQKJDW2Mk4Yo8VsQCD4CE2IqxpjyN8=";
+    hash = "sha256-BgZmc81TzgU3ifv4RHh2pfjbkUyxMIIpBrHCtnLF3p0=";
  };

  postPatch = ''
--- a/pkgs/by-name/fa/fable/package.nix
+++ b/pkgs/by-name/fa/fable/package.nix
@ -23,7 +23,7 @@ buildDotnetGlobalTool (finalAttrs: {
    homepage = "https://github.com/fable-compiler/fable";
    changelog = "https://github.com/fable-compiler/fable/releases/tag/v${finalAttrs.version}";
    license = lib.licenses.mit;
-    platforms = lib.platforms.linux;
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
    maintainers = with lib.maintainers; [
      anpin
      mdarocha
--- a/pkgs/by-name/fa/fakeroot/package.nix
+++ b/pkgs/by-name/fa/fakeroot/package.nix
@ -1,27 +1,29 @@
 {
  lib,
-  coreutils,
  stdenv,
  fetchFromGitLab,
-  fetchpatch,
-  getopt,
-  libcap,
-  gnused,
-  nixosTests,
-  testers,
  autoreconfHook,
  po4a,
+  libcap,
+  getopt,
+  gnused,
+  coreutils,
+  versionCheckHook,
+  nixosTests,
 }:

 stdenv.mkDerivation (finalAttrs: {
  version = "1.38.1";
  pname = "fakeroot";

+  strictDeps = true;
+  __structuredAttrs = true;
+
  src = fetchFromGitLab {
+    domain = "salsa.debian.org";
    owner = "clint";
    repo = "fakeroot";
-    rev = "upstream/${finalAttrs.version}";
-    domain = "salsa.debian.org";
+    tag = "upstream/${finalAttrs.version}";
    hash = "sha256-sAzXeONjDT753lbu7amQY6yXpaTNCa4wFOzB01SRbCs=";
  };

@ -34,7 +36,7 @@ stdenv.mkDerivation (finalAttrs: {
    autoreconfHook
    po4a
  ];
-  buildInputs = lib.optional stdenv.hostPlatform.isLinux libcap;
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [ libcap ];

  postUnpack = ''
    sed -i \
@ -52,11 +54,11 @@ stdenv.mkDerivation (finalAttrs: {
    popd
  '';

+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+
  passthru = {
    tests = {
-      version = testers.testVersion {
-        package = finalAttrs.finalPackage;
-      };
      # A lightweight *unit* test that exercises fakeroot and fakechroot together:
      nixos-etc = nixosTests.etc.test-etc-fakeroot;
    };
--- a/pkgs/by-name/gf/gfan/gfan-0.7-macos.patch
+++ b/pkgs/by-name/gf/gfan/gfan-0.7-macos.patch
@ -0,0 +1,139 @@
+diff --git a/src/app_components.cpp b/src/app_components.cpp
+index 407c23e..8fc0d86 100644
+--- a/src/app_components.cpp
+++ b/src/app_components.cpp
+@@ -162,7 +162,6 @@ void connectedComponentsOfSlices(PostComplex<mvtyp>& pc, bool saveNoncomets, boo
+   */
+   if (potentialsOutputAndStop) {
+     std::for_each(
+-		  std::execution::seq, 
+ 		  potentials.begin(),
+ 		  potentials.end(),
+ 		  [](Rational p)
+@@ -180,7 +179,6 @@ void connectedComponentsOfSlices(PostComplex<mvtyp>& pc, bool saveNoncomets, boo
+ 		  });
+   } else {
+     std::for_each(
+-		  std::execution::par,//fails to trigger parallelism
+ 		  potentials.begin(),
+ 		  potentials.end(),
+ 		  [pc,minConePotential,maxConePotential,saveNoncomets](Rational p)
+diff --git a/src/gfanlib_circuittableint.h b/src/gfanlib_circuittableint.h
+index 2b5ced4..d53fbec 100644
+--- a/src/gfanlib_circuittableint.h
+++ b/src/gfanlib_circuittableint.h
+@@ -25,6 +25,7 @@ namespace gfan{
+   template<typename> struct MyMakeUnsigned;
+   template <> struct MyMakeUnsigned<int>{typedef unsigned int type;};
+   template <> struct MyMakeUnsigned<long int>{typedef unsigned long int type;};
+  template <> struct MyMakeUnsigned<long long int>{typedef unsigned long long int type;};
+   template <> struct MyMakeUnsigned<__int128>{typedef unsigned __int128 type;};
+
+   class MVMachineIntegerOverflow: public std::exception
+@@ -92,6 +93,15 @@ static std::string toStr(__uint32_t b)
+        return s.str();
+ }
+
+#ifndef _64BITLONGINT
+static std::string toStr(long int b)
+{
+       std::stringstream s;
+       s<<b;
+       return s.str();
+}
+#endif
+
+ class my256s{
+ public:
+        __int128_t lo,hi;
+@@ -213,6 +221,10 @@ static __int128_t extMul(long int a, long int b)
+ {
+        return ((__int128_t)a)*((__int128_t)b);
+ }
+static __int128_t extMul(long long int a, long long int b)
+{
+       return ((__int128_t)a)*((__int128_t)b);
+}
+
+ static __uint128_t unsignedProd64(uint64_t x,uint64_t y)
+ {
+diff --git a/src/gfanlib_memoryresource.cpp b/src/gfanlib_memoryresource.cpp
+index 238a9f8..515f116 100644
+--- a/src/gfanlib_memoryresource.cpp
+++ b/src/gfanlib_memoryresource.cpp
+@@ -10,7 +10,7 @@
+ StackResource stackResource(10160000);
+ StackResource stackResource2(10160000);
+ 
+-std::string memoryResourceToString(const std::experimental::pmr::memory_resource *mr)
+std::string memoryResourceToString(const std::pmr::memory_resource *mr)
+ {
+ 	if(get_default_resource()==mr)
+ 	{
+diff --git a/src/gfanlib_memoryresource.h b/src/gfanlib_memoryresource.h
+index 3eb9e2c..74a5c64 100644
+--- a/src/gfanlib_memoryresource.h
+++ b/src/gfanlib_memoryresource.h
+@@ -6,9 +6,9 @@
+  *      Author: anders
+  */
+ 
+-#include <experimental/memory_resource>
+#include <memory_resource>
+ #include <iostream>
+-#include <experimental/vector>
+#include <vector>
+ #include <assert.h>
+ 
+ 
+@@ -42,9 +42,9 @@ void test() {
+ 
+ template<typename a>
+ //using std::experimental::pmr pmr;
+-using pmrvector=std::experimental::pmr::vector<a>;
+-typedef std::experimental::pmr::memory_resource MR; //Maybe this should be polymorphic_allocator<byte> instead - at least for the constructors using these
+-using std::experimental::pmr::get_default_resource;
+using pmrvector=std::pmr::vector<a>;
+typedef std::pmr::memory_resource MR; //Maybe this should be polymorphic_allocator<byte> instead - at least for the constructors using these
+using std::pmr::get_default_resource;
+ 
+ //DELETE
+ class ResourceWrapper: public MR{
+@@ -76,7 +76,7 @@ public:
+ 	}
+ };
+ 
+-class StackResource: public std::experimental::pmr::memory_resource{
+class StackResource: public std::pmr::memory_resource{
+   /*
+    *
+    * Layout of memory
+@@ -98,7 +98,7 @@ class StackResource: public std::experimental::pmr::memory_resource{
+ 	The header is 4 byte aligned, while the alignment of each block is specified at allocation.
+    */
+ public:
+-  std::experimental::pmr::vector<char> mem;
+  std::pmr::vector<char> mem;
+   int topHeader;
+   int nbytes;
+   memory_resource* parentResource;
+@@ -124,8 +124,8 @@ public:
+ 	  return (firstPossible+((align-1)|(minimumAlignment-1)))& ~((align-1)|(minimumAlignment-1));
+   }
+   StackResource(int nbytes_,
+-		memory_resource* parentResource_=std::experimental::pmr::new_delete_resource(),
+-		memory_resource* fallBackResource_=std::experimental::pmr::null_memory_resource()):
+		memory_resource* parentResource_=std::pmr::new_delete_resource(),
+		memory_resource* fallBackResource_=std::pmr::null_memory_resource()):
+ 	topHeader(0),
+     nbytes(nbytes_),
+     mem(nbytes_,parentResource_),
+@@ -254,7 +254,7 @@ public:
+ };
+ 
+ 
+-std::string memoryResourceToString(const std::experimental::pmr::memory_resource *mr);
+std::string memoryResourceToString(const std::pmr::memory_resource *mr);
+ 
+ // DELETE?
+ class ResourceInvariant
--- a/pkgs/by-name/gf/gfan/package.nix
+++ b/pkgs/by-name/gf/gfan/package.nix
@ -9,22 +9,19 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "gfan";
-  version = "0.6.2";
+  version = "0.7";

  src = fetchurl {
    url = "https://home.math.au.dk/jensen/software/gfan/gfan${finalAttrs.version}.tar.gz";
-    sha256 = "02pihqb1lb76a0xbfwjzs1cd6ay3ldfxsm8dvsbl6qs3vkjxax56";
+    sha256 = "sha256-q4M3V+Hk1KmGYvSqaROUAT6poib2QWuPhWU1bW/MmJ4=";
  };

  patches = [
    ./gfan-0.6.2-cddlib-prefix.patch
    (fetchpatch {
-      # removes dead code with invalid member reference in gfanlib
-      name = "clang-19.patch";
-      url = "https://github.com/Singular/Singular/commit/d3f73432d73ac0dd041af83cb35301498e9b57d9.patch";
-      stripLen = 2;
-      extraPrefix = "src/";
-      hash = "sha256-jPGMYx/GOFV7Tk3CqaRWeX/UHkzjeL57eZj4r40s8/g=";
+      name = "cstdint.patch";
+      url = "https://salsa.debian.org/math-team/gfan/-/raw/6bb6bc3dd517b3c26fbcb76bfdc47f04d1978007/debian/patches/cstdint.patch";
+      hash = "sha256-ALD8Exe2SW8TZg0hIfhvUuiEbbT3Sk7v+oLnNsYA8hs=";
    })
  ]
  ++ lib.optionals (stdenv.cc.isClang) [
@ -33,17 +30,17 @@ stdenv.mkDerivation (finalAttrs: {
      url = "https://raw.githubusercontent.com/sagemath/sage/eea1f59394a5066e9acd8ae39a90302820914ee3/build/pkgs/gfan/patches/nodel.patch";
      sha256 = "sha256-RrncSgFyrBIk/Bwe3accxiJ2rpOSJKQ84cV/uBvQsDc=";
    })
+  ]
+  ++ lib.optionals (stdenv.hostPlatform.isDarwin) [
+    # On MacOS, we need to adress differences in int64_t types and remove the
+    # "experimental/" library and namespace prefixes as well as references to
+    # std::execution.
+    ./gfan-0.7-macos.patch
  ];

-  # This test assumes that our implementation of sort behaves identically to the
-  # one used during development, which is not necessarily the case; update the
-  # expected result to be sorted using our copy of sort.
-  postPatch = ''
-    sort testsuite/0008PolynomialSetUnion/output -o testsuite/0008PolynomialSetUnion/output
-    sort testsuite/0008PolynomialSetUnion/outputNew -o testsuite/0008PolynomialSetUnion/outputNew
-  ''
-  + lib.optionalString stdenv.cc.isClang ''
-    substituteInPlace Makefile --replace "-fno-guess-branch-probability" ""
+  postPatch = lib.optionalString stdenv.cc.isClang ''
+    substituteInPlace Makefile --replace-fail "-fno-guess-branch-probability" "" \
+      --replace-fail "-finline-limit=1000" ""

    for f in $(find -name "*.h" -or -name "*.cpp"); do
        substituteInPlace "$f" --replace-quiet "log2" "_log2"
@ -60,6 +57,7 @@ stdenv.mkDerivation (finalAttrs: {
    mpir
    cddlib
  ];
+  enableParallelBuilding = true;
  hardeningDisable = [ "libcxxhardeningfast" ];

  doCheck = true;
@ -72,7 +70,12 @@ stdenv.mkDerivation (finalAttrs: {

  meta = {
    description = "Software package for computing Gröbner fans and tropical varieties";
-    license = lib.licenses.gpl2;
+    license =
+      with lib.licenses;
+      OR [
+        gpl2
+        gpl3
+      ];
    maintainers = [ lib.maintainers.raskin ];
    platforms = lib.platforms.unix;
    homepage = "http://home.math.au.dk/jensen/software/gfan/gfan.html";
--- a/pkgs/by-name/gh/ghorg/package.nix
+++ b/pkgs/by-name/gh/ghorg/package.nix
@ -8,13 +8,13 @@

 buildGoModule (finalAttrs: {
  pname = "ghorg";
-  version = "1.11.10";
+  version = "1.11.12";

  src = fetchFromGitHub {
    owner = "gabrie30";
    repo = "ghorg";
    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-LgbvCXmyiNBGTY+IYBWNGThtc00AC2rXelYG8PAFdOg=";
+    sha256 = "sha256-KOXUbjaw1TL6Q/fRXTU5fFkxgs1jJ5GcKbn7VVbAipY=";
  };

  doCheck = false;
--- a/pkgs/by-name/gi/giph/package.nix
+++ b/pkgs/by-name/gi/giph/package.nix
@ -2,7 +2,7 @@
  stdenvNoCC,
  lib,
  fetchFromGitHub,
-  ffmpeg,
+  ffmpeg-full,
  xdotool,
  slop,
  libnotify,
@ -33,7 +33,7 @@ stdenvNoCC.mkDerivation rec {
    wrapProgram $out/bin/giph \
      --prefix PATH : ${
        lib.makeBinPath [
-          ffmpeg
+          ffmpeg-full
          xdotool
          libnotify
          slop
--- a/pkgs/by-name/go/gogup/package.nix
+++ b/pkgs/by-name/go/gogup/package.nix
@ -6,16 +6,16 @@

 buildGoModule (finalAttrs: {
  pname = "gogup";
-  version = "1.3.0";
+  version = "1.7.1";

  src = fetchFromGitHub {
    owner = "nao1215";
    repo = "gup";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-h7hozN4ggDqEqu2KlQpBEttT7j8JKW+4J4NyM+ftK2M=";
+    hash = "sha256-XRwYvXrg6sF15mvRpldru+mNBu1qKzntoLnhx5+CtOk=";
  };

-  vendorHash = "sha256-GbeyuZNpT3wqy52sk0B/9wrab906/E4ds06vQ5tHK7c=";
+  vendorHash = "sha256-uvyt/JVHX/R44NOZ8Hl0Jwzge9v3bph/Jy9kX4vNReQ=";
  doCheck = false;

  ldflags = [
--- a/pkgs/by-name/go/goldendict-ng/package.nix
+++ b/pkgs/by-name/go/goldendict-ng/package.nix
@ -23,13 +23,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "goldendict-ng";
-  version = "26.6.0";
+  version = "26.6.1";

  src = fetchFromGitHub {
    owner = "xiaoyifang";
    repo = "goldendict-ng";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-gV1nDKKRCN8p+B9dZ28uzzvYEbKDB58h+fMyQ44nOXU=";
+    hash = "sha256-iWKgOgTTkvrnphPhoWxY8ij+ClVVy3G84V+e+XcsoME=";
  };

  strictDeps = true;
--- a/pkgs/by-name/gq/gqlgen/package.nix
+++ b/pkgs/by-name/gq/gqlgen/package.nix
@ -6,7 +6,7 @@
 }:

 let
-  version = "0.17.91";
+  version = "0.17.93";
 in
 buildGoModule {
  pname = "gqlgen";
@ -16,10 +16,10 @@ buildGoModule {
    owner = "99designs";
    repo = "gqlgen";
    tag = "v${version}";
-    hash = "sha256-z4VCso3IxV8R9ov9qeyO9UH7DqExe1ybJF6eTaV7odI=";
+    hash = "sha256-F2tbigASufl+Zqq0mKP6S9pFHyia2IADjofI8KAit5s=";
  };

-  vendorHash = "sha256-jOwBUeDPOctjeJGIEH7TxcNWX4jF/j1DyNk+FKrLQMQ=";
+  vendorHash = "sha256-6tU6aHbEI91u+s3/QoOdxu0zoYD3UefvV+NGgBAuBxE=";

  subPackages = [ "." ];

--- a/pkgs/by-name/ha/hasciicam/package.nix
+++ b/pkgs/by-name/ha/hasciicam/package.nix
@ -0,0 +1,63 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  pkg-config,
+  SDL2,
+  libx11,
+  ncurses,
+  nix-update-script,
+  enableSDL ? true,
+  enableGUI ? true,
+  enableX11 ? stdenv.hostPlatform.isLinux,
+  enableCurses ? true,
+  enableTests ? true,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "hasciicam";
+  version = "2.5.0";
+
+  src = fetchFromGitHub {
+    owner = "dyne";
+    repo = "hasciicam";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-agwNuIxO+o4HHkjd3TikYuVNgO0vlDPikcZoLDVLCUc=";
+  };
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+  ];
+
+  buildInputs =
+    lib.optionals enableSDL [ SDL2 ]
+    ++ lib.optionals enableX11 [ libx11 ]
+    ++ lib.optionals enableCurses [ ncurses ];
+
+  cmakeFlags = [
+    (lib.cmakeBool "HASCIICAM_ENABLE_TESTS" enableTests)
+    (lib.cmakeBool "HASCIICAM_ENABLE_SDL" enableSDL)
+    (lib.cmakeBool "HASCIICAM_ENABLE_GUI" enableGUI)
+    (lib.cmakeBool "HASCIICAM_ENABLE_X11" enableX11)
+    (lib.cmakeBool "HASCIICAM_ENABLE_CURSES" enableCurses)
+  ];
+
+  doCheck = enableTests;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "ASCII art webcam and video viewer";
+    homepage = "https://github.com/dyne/hasciicam";
+    changelog = "https://github.com/dyne/hasciicam/releases/tag/v${finalAttrs.version}";
+    mainProgram = "hasciicam";
+    platforms = lib.platforms.unix;
+    license = lib.licenses.gpl2Plus;
+    maintainers = with lib.maintainers; [ castorNova2 ];
+  };
+})
--- a/pkgs/by-name/he/herdr/package.nix
+++ b/pkgs/by-name/he/herdr/package.nix
@ -8,7 +8,7 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "herdr";
-  version = "0.7.0";
+  version = "0.7.1";

  __structuredAttrs = true;

@ -16,10 +16,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
    owner = "ogulcancelik";
    repo = "herdr";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-DjCSwhRMBRE9lSvjpX6m8IpoEgUbOP1jcmeXMlQlSQY=";
+    hash = "sha256-/WnsUO1DuSmBfVo8LCFaDJEZvSrYnJZPyRNqASbPzV8=";
  };

-  cargoHash = "sha256-NHVSdXlGsqhI/Mij28TvdW0f6IKOglNgpBNb2sFXocI=";
+  cargoHash = "sha256-enVFwIGTM7oBg3teWC6MO/bdT/jDIKbaxKq4jE9E0aw=";

  zigDeps = zig_0_15.fetchDeps {
    inherit (finalAttrs) pname version;
--- a/pkgs/by-name/ho/homepage-dashboard/package.nix
+++ b/pkgs/by-name/ho/homepage-dashboard/package.nix
@ -31,13 +31,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "homepage-dashboard";
-  version = "1.13.1";
+  version = "1.13.2";

  src = fetchFromGitHub {
    owner = "gethomepage";
    repo = "homepage";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-RKvBzHtxK/VNdSRoJSUiVmckG7jTTH75SEe6aX2xq1E=";
+    hash = "sha256-d6NNtaThDfVErGx7fFdqLdjx4UZXMN6CZUBpMZFZYhQ=";
  };

  pnpmDeps = fetchPnpmDeps {
@ -48,7 +48,7 @@ stdenv.mkDerivation (finalAttrs: {
      ;
    pnpm = pnpm_10;
    fetcherVersion = 3;
-    hash = "sha256-xd7F39WBSAy3ozJjI12XB+oGvijSGHIMYwQhdpaO/l8=";
+    hash = "sha256-jAcAbi++Wbyi07YdPuIhDAeNT4fJVAIxp51boD30x3k=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/in/instant-space-switcher/package.nix
+++ b/pkgs/by-name/in/instant-space-switcher/package.nix
@ -0,0 +1,50 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchurl,
+  undmg,
+  nix-update-script,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "instant-space-switcher";
+  version = "2.0";
+
+  src = fetchurl {
+    url = "https://github.com/jurplel/InstantSpaceSwitcher/releases/download/v${finalAttrs.version}/InstantSpaceSwitcher-${finalAttrs.version}.dmg";
+    hash = "sha256-48DH2Hu/XhLPr8jP2ArmLJLFbJmIupkrlqlFOsNnL7g=";
+  };
+
+  nativeBuildInputs = [ undmg ];
+
+  sourceRoot = ".";
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p "$out/Applications" "$out/bin"
+    cp -R InstantSpaceSwitcher.app "$out/Applications/"
+    ln -s "$out/Applications/InstantSpaceSwitcher.app/Contents/MacOS/ISSCli" "$out/bin/isscli"
+
+    runHook postInstall
+  '';
+
+  dontBuild = true;
+  dontFixup = true;
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Native instant workspace switching on macOS. No more waiting for animations";
+    homepage = "https://github.com/jurplel/InstantSpaceSwitcher";
+    changelog = "https://github.com/jurplel/InstantSpaceSwitcher/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.mit;
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+    platforms = lib.platforms.darwin;
+    mainProgram = "isscli";
+    maintainers = with lib.maintainers; [ myzel394 ];
+  };
+})
--- a/pkgs/by-name/ja/jan/package.nix
+++ b/pkgs/by-name/ja/jan/package.nix
@ -12,16 +12,16 @@

 let
  pname = "Jan";
-  version = "0.7.9";
+  version = "0.8.2";

  darwin-src = fetchzip {
    url = "https://github.com/janhq/jan/releases/download/v${version}/jan-mac-universal-${version}.zip";
-    hash = "sha256-3SN/yZr40Zp6Oa3rDUnum1m7dwK8jbe6Bxx9iSHDM9U=";
+    hash = "sha256-DUyPMsy9POcxY5OyQu1IBAijTbUZACQB87j0CQDrw8A=";
  };

  linux-src = fetchurl {
    url = "https://github.com/janhq/jan/releases/download/v${version}/jan_${version}_amd64.AppImage";
-    hash = "sha256-SMcjig6J/HCpLthT8dHC6yED6uuHyaTG/xLnUIlZHP8=";
+    hash = "sha256-OWg8P4g2g+LVJU+SnjajG2cqWnzl5X2fjqTGkIC3kAY=";
  };

  appimageContents = appimageTools.extractType2 {
@ -35,7 +35,7 @@ let
    homepage = "https://github.com/janhq/jan";
    license = lib.licenses.asl20;
    mainProgram = "Jan";
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ dfjay ];
    platforms =
      lib.platforms.darwin
      ++ (with lib.systems.inspect; patternLogicalAnd patterns.isLinux patterns.isx86_64);
--- a/pkgs/by-name/ke/kermit/package.nix
+++ b/pkgs/by-name/ke/kermit/package.nix
@ -39,7 +39,8 @@ stdenv.mkDerivation {
    make -f makefile install
  '';

-  env.NIX_CFLAGS_COMPILE = "-Wno-implicit-function-declaration -Wno-implicit-int";
+  # Old K&R C sources fail under GCC 14+ default C standard (e.g. dosexp prototypes).
+  env.NIX_CFLAGS_COMPILE = "-std=gnu89 -Wno-implicit-function-declaration -Wno-implicit-int";

  meta = {
    homepage = "https://www.kermitproject.org/ck90.html";
--- a/pkgs/by-name/ko/koodo-reader/package.nix
+++ b/pkgs/by-name/ko/koodo-reader/package.nix
@ -70,6 +70,12 @@ stdenv.mkDerivation (finalAttrs: {
    export npm_config_nodedir=${nodejs-slim}
    npm rebuild --verbose cpu-features

+    # register-scheme is an optional dependency of discord-rpc that fails to compile on modern macOS/Electron
+    # and is not required for the application's core functionality.
+    ${lib.optionalString stdenv.hostPlatform.isDarwin ''
+      rm -rf node_modules/register-scheme
+    ''}
+
    export npm_config_nodedir=${electron.headers}
    # Explicitly set identity to null to avoid signing on darwin
    yarn --offline run electron-builder --dir \
--- a/pkgs/by-name/la/lark-cli/package.nix
+++ b/pkgs/by-name/la/lark-cli/package.nix
@ -0,0 +1,74 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  fetchurl,
+  runCommand,
+  jq,
+  testers,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "lark-cli";
+  version = "1.0.58";
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "larksuite";
+    repo = "cli";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-MqaxcmzX/79vM2EI8wD4ZAFsUfqWvPAovlpmuDP1IWU=";
+  };
+
+  vendorHash = "sha256-M0/Y62Y+M/P1B/YIDjX5bEyB/GKihCWQakTWVd7zvBg=";
+
+  subPackages = [ "." ];
+
+  postPatch =
+    let
+      metaDataRaw = fetchurl {
+        name = "meta_dataraw.json";
+        url = "https://web.archive.org/web/20260626061256/https://open.feishu.cn/api/tools/open/api_definition?protocol=meta&client_version=v${finalAttrs.version}";
+        hash = "sha256-W6KOtDW6gkZIqGa0A5QL0rVjVkRjM+gwW4S3AddPN1M=";
+      };
+
+      metaData =
+        runCommand "meta_data.json"
+          {
+            nativeBuildInputs = [ jq ];
+          }
+          ''
+            jq '.data' ${metaDataRaw} > $out
+          '';
+    in
+    ''
+      cp ${metaData} internal/registry/meta_data.json
+    '';
+
+  postInstall = ''
+    mv $out/bin/cli $out/bin/lark-cli
+  '';
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/larksuite/cli/internal/build.Version=v${finalAttrs.version}"
+    "-X github.com/larksuite/cli/internal/build.Date=2026-06-01"
+  ];
+
+  passthru.tests.version = testers.testVersion {
+    package = finalAttrs.finalPackage;
+    command = "lark-cli --version";
+    version = "v${finalAttrs.version}";
+  };
+
+  meta = {
+    description = "The official CLI for Lark/Feishu open platform";
+    homepage = "https://github.com/larksuite/cli";
+    changelog = "https://github.com/larksuite/cli/releases/tag/v${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ zehuajun ];
+    mainProgram = "lark-cli";
+  };
+})
--- a/pkgs/by-name/li/libreswan/package.nix
+++ b/pkgs/by-name/li/libreswan/package.nix
@ -51,11 +51,11 @@ in

 stdenv.mkDerivation rec {
  pname = "libreswan";
-  version = "5.3";
+  version = "5.3.1";

  src = fetchurl {
    url = "https://download.libreswan.org/libreswan-${version}.tar.gz";
-    hash = "sha256-wdNQw/Mpb9IbnbB5TiPT8xmykviAv4F4uC71xjkcYMA=";
+    hash = "sha256-4/DlHYtkK/aTpqjMbx5ip2TP9BgKAjvzx+QtQ6Yt/p4=";
  };

  strictDeps = true;
--- a/pkgs/by-name/li/liquidsoap/package.nix
+++ b/pkgs/by-name/li/liquidsoap/package.nix
@ -32,7 +32,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "savonet";
    repo = "liquidsoap";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-aNsN65phkfFM7OD4oCMl0wP3quvUquHR325DDVIqs/M=";
+    hash = "sha256-9H0+si3JRw+NIBMWREHm4zzm4D4Asjoi6JbsJqJEpN0=";
  };

  postPatch = ''
--- a/pkgs/by-name/ne/nezha-theme-nazhua/package.nix
+++ b/pkgs/by-name/ne/nezha-theme-nazhua/package.nix
@ -1,38 +1,22 @@
 {
  lib,
-  stdenvNoCC,
+  buildNpmPackage,
  fetchFromGitHub,
-  yarnConfigHook,
-  yarnBuildHook,
-  yarnInstallHook,
-  fetchYarnDeps,
-  nodejs,
  nix-update-script,
 }:

-stdenvNoCC.mkDerivation (finalAttrs: {
+buildNpmPackage (finalAttrs: {
  pname = "nezha-theme-nazhua";
-  version = "0.8.0";
+  version = "1.2.0";

  src = fetchFromGitHub {
    owner = "hi2shark";
    repo = "nazhua";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-kXiFvVSwOXn/MDwQIBmN+1wp8wO4P9hw1zcYcTBHmXA=";
+    hash = "sha256-lyrkWJDMMMellM8lIaZMvxXJT54gjjP4gnwxMcytrdA=";
  };

-  yarnOfflineCache = fetchYarnDeps {
-    yarnLock = finalAttrs.src + "/yarn.lock";
-    hash = "sha256-/CQsG3iQdPyKHdApeMzq4w90NsMBdLXUP2lya8vtK5Q=";
-  };
-
-  nativeBuildInputs = [
-    yarnConfigHook
-    yarnBuildHook
-    yarnInstallHook
-    # Needed for executing package.json scripts
-    nodejs
-  ];
+  npmDepsHash = "sha256-V+fdXp2QevPRYQQ4j5w9OQro6w3qnyi7imhgzGdUiVs=";

  # Copied from .github/workflows/release.yml
  env = {
--- a/pkgs/by-name/pg/pgrok/package.nix
+++ b/pkgs/by-name/pg/pgrok/package.nix
@ -4,24 +4,21 @@
  fetchFromGitHub,
  nix-update-script,
  nodejs,
-  pnpm_9,
+  pnpm_11,
  fetchPnpmDeps,
  pnpmConfigHook,
 }:

-let
+buildGoModule (finalAttrs: {
  pname = "pgrok";
  version = "1.7.0";
+
  src = fetchFromGitHub {
    owner = "pgrok";
    repo = "pgrok";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
    hash = "sha256-uMHeVxAGmAEIOfCK9SEFsL7GZZIUNMYdoV8XeHjXmWc=";
  };
-in
-
-buildGoModule {
-  inherit pname version src;

  outputs = [
    "out"
@ -31,7 +28,7 @@ buildGoModule {
  nativeBuildInputs = [
    nodejs
    pnpmConfigHook
-    pnpm_9
+    pnpm_11
  ];

  postPatch = ''
@ -47,14 +44,14 @@ buildGoModule {
  '';

  env.pnpmDeps = fetchPnpmDeps {
-    inherit
+    inherit (finalAttrs)
      pname
      version
      src
      ;
-    pnpm = pnpm_9;
-    fetcherVersion = 3;
-    hash = "sha256-O3bDxnxeRO20FsRNpgXfz4UweYJmeU6zgrrPJ05fgWo=";
+    pnpm = pnpm_11;
+    fetcherVersion = 4;
+    hash = "sha256-8CLAtxqNgcVIUw4RKAy6jKlErmkgZYyVYFdrD+jyfAA=";
  };

  vendorHash = "sha256-fhyyyXHUJsIWiCZbqtLZZRuIG9hb0LAkSo7lKW0i8Sk";
@ -62,7 +59,7 @@ buildGoModule {
  ldflags = [
    "-s"
    "-w"
-    "-X main.version=${version}"
+    "-X main.version=${finalAttrs.version}"
    "-X main.commit=unknown"
    "-X main.date=unknown"
  ];
@ -93,4 +90,4 @@ buildGoModule {
    maintainers = with lib.maintainers; [ tbutter ];
    mainProgram = "pgrok";
  };
-}
+})
--- a/pkgs/by-name/pi/pika-backup/package.nix
+++ b/pkgs/by-name/pi/pika-backup/package.nix
@ -24,19 +24,19 @@

 stdenv.mkDerivation rec {
  pname = "pika-backup";
-  version = "0.8.2";
+  version = "0.8.3";

  src = fetchFromGitLab {
    domain = "gitlab.gnome.org";
    owner = "World";
    repo = "pika-backup";
    tag = version;
-    hash = "sha256-02ChjIXjTos3jm6UR37tFWhRlUvyh/1r6zLsd6fQsyc=";
+    hash = "sha256-oM59t0oJzW7EyvcGoEwrokhxk+inxMLznf4Z2IEg3ig=";
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
    inherit pname version src;
-    hash = "sha256-e6hep/aTpC5HDI/UoSJONGZRP3rjA2eVh9G4DE3HJpE=";
+    hash = "sha256-CWyZYnurIWiGzfUpa7OgmLU/CVRiAGbgFM0+frRfi9c=";
  };

  patches = [
--- a/pkgs/by-name/po/positron-bin/package.nix
+++ b/pkgs/by-name/po/positron-bin/package.nix
@ -22,29 +22,32 @@
  libxcomposite,
  libx11,
  libxkbfile,
+  libsecret,
+  webkitgtk_4_1,
 }:
 let
  pname = "positron-bin";
-  version = "2026.02.1-5";
+  version = "2026.06.0-211";
 in
 stdenv.mkDerivation {
+  dontFixup = stdenv.hostPlatform.isDarwin;
  inherit version pname;

  src =
    if stdenv.hostPlatform.isDarwin then
      fetchurl {
        url = "https://cdn.posit.co/positron/releases/mac/arm64/Positron-${version}-arm64.dmg";
-        hash = "sha256-wQ/ctA9q8i5hyi86VKF8cC/mDHVU1DRt1vnFBKdAAJI=";
+        hash = "sha256-XzkYclZtF7oyYtdKeTqiAAcQInVEsuP8uL6TAq+rlpg=";
      }
    else if stdenv.hostPlatform.system == "aarch64-linux" then
      fetchurl {
        url = "https://cdn.posit.co/positron/releases/deb/arm64/Positron-${version}-arm64.deb";
-        hash = "sha256-AW4jueFtdvrmIAm+d5/qjyViaSpue51dbyU4NYs3vaE=";
+        hash = "sha256-dH8kcXUuT3RKSNIjbIu/cFAUsv289gbjMmG8JDTSoj0=";
      }
    else
      fetchurl {
        url = "https://cdn.posit.co/positron/releases/deb/x86_64/Positron-${version}-x64.deb";
-        hash = "sha256-aTVzJCsMARXciasGv7l/syFb3V81Ii6gVl6sBrEPFzM=";
+        hash = "sha256-YvnweVTKAvxZTR5/FY1VWt03Gx4LFa2faL+Z0AYCtpY=";
      };

  buildInputs = [
@ -64,6 +67,8 @@ stdenv.mkDerivation {
    libxcomposite
    libxdamage
    libxkbfile
+    libsecret
+    webkitgtk_4_1
  ]
  ++ lib.optionals stdenv.hostPlatform.isDarwin [
    blas
@ -89,15 +94,14 @@ stdenv.mkDerivation {
    if stdenv.hostPlatform.isDarwin then
      ''
        runHook preInstall
-        mkdir -p "$out/Applications" "$out/bin"
-        cp -r . "$out/Applications/Positron.app"
+        mkdir -p "$out/Applications/Positron.app" "$out/bin"
+        cp -r Positron.app/. "$out/Applications/Positron.app"

        # Positron will use the system version of BLAS if we don't provide the nix version.
-        wrapProgram "$out/Applications/Positron.app/Contents/Resources/app/bin/code" \
+        makeShellWrapper "$out/Applications/Positron.app/Contents/Resources/app/bin/code" "$out/bin/positron" \
          --prefix DYLD_INSERT_LIBRARIES : "${lib.makeLibraryPath [ blas ]}/libblas.dylib" \
          --add-flags "--disable-updates"

-        ln -s "$out/Applications/Positron.app/Contents/Resources/app/bin/code" "$out/bin/positron"
        runHook postInstall
      ''
    else
--- a/pkgs/by-name/pv/pvzge/package.nix
+++ b/pkgs/by-name/pv/pvzge/package.nix
@ -14,13 +14,13 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "pvzge";
-  version = "0.9.3";
+  version = "0.10.0";

  src = fetchFromGitHub {
    owner = "Gzh0821";
    repo = "pvzge_web";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-QFHWTTwvhtVzcApehPfYCpFHjLXmq9SZcbBSc0eSkpM=";
+    hash = "sha256-sirarRJyQUHk8Fx3B9uXJjCqgRXX+SYqxpj+/N8v7y8=";
  };

  iconSrc = fetchurl {
--- a/pkgs/by-name/qe/qemu/package.nix
+++ b/pkgs/by-name/qe/qemu/package.nix
@ -32,6 +32,7 @@
  libslirp,
  libcbor,
  darwin,
+  apple-sdk_15,
  guestAgentSupport ?
    (with stdenv.hostPlatform; isLinux || isNetBSD || isOpenBSD || isSunOS || isWindows) && !minimal,
  numaSupport ? stdenv.hostPlatform.isLinux && !stdenv.hostPlatform.isAarch32 && !minimal,
@ -251,7 +252,8 @@ stdenv.mkDerivation (finalAttrs: {
  ++ lib.optionals canokeySupport [ canokey-qemu ]
  ++ lib.optionals u2fEmuSupport [ libu2f-emu ]
  ++ lib.optionals capstoneSupport [ capstone ]
-  ++ lib.optionals valgrindSupport [ valgrind-light ];
+  ++ lib.optionals valgrindSupport [ valgrind-light ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [ apple-sdk_15 ];

  dontUseMesonConfigure = true; # meson's configurePhase isn't compatible with qemu build
  dontAddStaticConfigureFlags = true;
--- a/pkgs/by-name/rn/rnmon/package.nix
+++ b/pkgs/by-name/rn/rnmon/package.nix
@ -0,0 +1,47 @@
+{
+  lib,
+  python3Packages,
+  fetchFromGitHub,
+  nix-update-script,
+}:
+
+python3Packages.buildPythonApplication (finalAttrs: {
+  pname = "rnmon";
+  version = "0.3.4";
+  pyproject = true;
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "lbatalha";
+    repo = "rnmon";
+    tag = finalAttrs.version;
+    hash = "sha256-3ou2F8ePKzh6g63X0l9iX1fTSVe9misGBkPlCUEWpiU=";
+  };
+
+  build-system = [
+    python3Packages.hatchling
+  ];
+
+  dependencies = with python3Packages; [
+    pyyaml
+    requests
+    rns
+  ];
+
+  pythonImportsCheck = [
+    "rnmon"
+  ];
+
+  # No tests in the repository
+  doCheck = false;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "RNS Monitoring Agent";
+    homepage = "https://github.com/lbatalha/rnmon";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ drupol ];
+    mainProgram = "rnmon";
+  };
+})
--- a/pkgs/by-name/sd/sdl3-shadercross/package.nix
+++ b/pkgs/by-name/sd/sdl3-shadercross/package.nix
@ -13,7 +13,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "sdl3-shadercross";
-  version = "0-unstable-2026-06-15";
+  version = "0-unstable-2026-06-26";

  outputs = [
    "out"
@ -24,7 +24,7 @@ stdenv.mkDerivation (finalAttrs: {
  src = fetchFromGitHub {
    owner = "libsdl-org";
    repo = "SDL_shadercross";
-    rev = "9a461644308366b50f0c364069d762be8e3b3443";
+    rev = "e55cf5e31ced6f3d1be5cc6d0c50e99384f9f4ba";
    hash = "sha256-oKetmnMb+SeRlscWmzGln6nR1M7fBkgybFlB1bh1Cos=";
  };

--- a/pkgs/by-name/sp/spellchecker-cli/package.nix
+++ b/pkgs/by-name/sp/spellchecker-cli/package.nix
@ -0,0 +1,49 @@
+{
+  stdenv,
+  lib,
+  fetchFromGitHub,
+  fetchYarnDeps,
+  yarnConfigHook,
+  yarnBuildHook,
+  yarnInstallHook,
+  nodejs,
+  nix-update-script,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "spellchecker-cli";
+  version = "7.0.3";
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "tbroadley";
+    repo = "spellchecker-cli";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-4rKUxXsZKsRDhMV0HL39yQyVNI0negCg97KsI+77oI4=";
+  };
+
+  yarnOfflineCache = fetchYarnDeps {
+    yarnLock = finalAttrs.src + "/yarn.lock";
+    hash = "sha256-GWIjk8eV2yYwsAfe7IY2mjO/dk9mb4vXEOvp68y4eMk=";
+  };
+
+  nativeBuildInputs = [
+    yarnConfigHook
+    yarnBuildHook
+    yarnInstallHook
+    nodejs
+  ];
+
+  yarnBuildScript = "prepack";
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "A command-line tool for spellchecking files";
+    homepage = "https://www.npmjs.com/package/spellchecker-cli";
+    mainProgram = "spellchecker";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ WiredMic ];
+  };
+})
--- a/pkgs/by-name/st/statix/package.nix
+++ b/pkgs/by-name/st/statix/package.nix
@ -8,16 +8,17 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "statix";
-  version = "0.5.8-unstable-2026-06-22";
+  version = "0.5.8-unstable-2026-06-28";
+  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "molybdenumsoftware";
    repo = "statix";
-    rev = "5d23643fcb0aea7372f7b598b3edb3e2bd8adf83";
-    hash = "sha256-woMMDcjiFgcbRt3Ywb5cOPv2P8S4+NqC6W6i8q1j4rU=";
+    rev = "964eee9bd0ef445838e32d38d097be0f0d4a2273";
+    hash = "sha256-V3AacP6DHq9WIZJZvFCPSqe0/VjwKFROUNblJxxPXxI=";
  };

-  cargoHash = "sha256-p3A88MMt3GkcC1shCNC8DmiXQCMXrWd+hA36D7VRZOE=";
+  cargoHash = "sha256-8iV21qkzXgzCfq9P+VVsuNC3M5MtIkflr6PtCu3FkoQ=";

  buildFeatures = lib.optional withJson "json";

--- a/pkgs/by-name/sw/swipeaerospace/package.nix
+++ b/pkgs/by-name/sw/swipeaerospace/package.nix
@ -0,0 +1,174 @@
+{
+  actool,
+  darwin,
+  fetchFromGitHub,
+  lib,
+  nix-update-script,
+  swiftPackages,
+}:
+
+let
+  inherit (swiftPackages) stdenv swift;
+
+  blueSocket = stdenv.mkDerivation (finalAttrs: {
+    pname = "blue-socket";
+    version = "2.0.4";
+
+    strictDeps = true;
+    __structuredAttrs = true;
+
+    src = fetchFromGitHub {
+      owner = "Kitura";
+      repo = "BlueSocket";
+      tag = finalAttrs.version;
+      hash = "sha256-Bru14uTGvmAeRLjbFYhWKfRjQcj5cZzp9jzyg5o7EHs=";
+    };
+
+    nativeBuildInputs = [
+      swift
+      darwin.autoSignDarwinBinariesHook
+    ];
+
+    dontConfigure = true;
+
+    buildPhase = ''
+      runHook preBuild
+
+      buildDir="$PWD/build"
+      mkdir -p "$buildDir"
+
+      swiftc \
+        -O \
+        -swift-version 5 \
+        -emit-library \
+        -emit-module \
+        -module-name Socket \
+        -emit-module-path "$buildDir/Socket.swiftmodule" \
+        -Xlinker -install_name -Xlinker "$out/lib/swift/libSocket.dylib" \
+        Sources/Socket/*.swift \
+        -o "$buildDir/libSocket.dylib"
+
+      runHook postBuild
+    '';
+
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p "$out/lib/swift"
+      cp build/libSocket.dylib "$out/lib/swift/"
+      cp build/Socket.* "$out/lib/swift/"
+
+      runHook postInstall
+    '';
+  });
+
+  infoPlist =
+    version:
+    lib.generators.toPlist { escape = true; } {
+      CFBundleDevelopmentRegion = "en";
+      CFBundleDisplayName = "SwipeAeroSpace";
+      CFBundleExecutable = "SwipeAeroSpace";
+      CFBundleIconFile = "AppIcon";
+      CFBundleIconName = "AppIcon";
+      CFBundleIdentifier = "club.mediosz.SwipeAeroSpace";
+      CFBundleInfoDictionaryVersion = "6.0";
+      CFBundleName = "SwipeAeroSpace";
+      CFBundlePackageType = "APPL";
+      CFBundleShortVersionString = version;
+      CFBundleSupportedPlatforms = [ "MacOSX" ];
+      CFBundleVersion = "18";
+      LSApplicationCategoryType = "public.app-category.developer-tools";
+      LSMinimumSystemVersion = "13.5";
+      LSUIElement = true;
+      NSHumanReadableCopyright = "©Tricster";
+    };
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "swipeaerospace";
+  version = "0.3.1";
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "MediosZ";
+    repo = "SwipeAeroSpace";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-468QGWjbRtA9Fml6jjeJZBTCUEp227cQPckqwyLK0dM=";
+  };
+
+  # Keep SettingsView unchanged, but open it through a regular WindowGroup.
+  # @Environment(\.openSettings) does not compile with nixpkgs' SwiftUI SDK.
+  patches = [ ./settings-window.patch ];
+
+  nativeBuildInputs = [
+    swift
+    actool
+    darwin.autoSignDarwinBinariesHook
+  ];
+
+  buildInputs = [ blueSocket ];
+
+  dontConfigure = true;
+
+  buildPhase = ''
+    runHook preBuild
+
+    buildDir="$PWD/build"
+    mkdir -p "$buildDir"
+
+    swiftFiles=()
+    while IFS= read -r -d "" f; do
+      swiftFiles+=("$f")
+    done < <(find SwipeAeroSpace -name '*.swift' -print0)
+
+    swiftc \
+      -O \
+      -swift-version 5 \
+      -parse-as-library \
+      -module-name SwipeAeroSpace \
+      -Xlinker -platform_version -Xlinker macos -Xlinker 13.5 -Xlinker 26.0 \
+      -framework AppKit \
+      -framework Cocoa \
+      -framework SwiftUI \
+      -framework ServiceManagement \
+      -lSocket \
+      "''${swiftFiles[@]}" \
+      -o "$buildDir/SwipeAeroSpace"
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    app="$out/Applications/SwipeAeroSpace.app"
+    mkdir -p "$app/Contents/"{MacOS,Resources}
+
+    cp build/SwipeAeroSpace "$app/Contents/MacOS/SwipeAeroSpace"
+    printf '%s' ${lib.escapeShellArg (infoPlist finalAttrs.version)} > "$app/Contents/Info.plist"
+    printf 'APPL????' > "$app/Contents/PkgInfo"
+
+    actool --compile "$app/Contents/Resources" \
+      --platform macosx \
+      --minimum-deployment-target 13.5 \
+      --app-icon AppIcon \
+      --output-partial-info-plist /dev/null \
+      SwipeAeroSpace/Assets.xcassets
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Switch AeroSpace workspaces by swiping";
+    homepage = "https://github.com/MediosZ/SwipeAeroSpace";
+    license = with lib.licenses; [
+      asl20
+      mit
+    ];
+    maintainers = with lib.maintainers; [ kinnrai ];
+    platforms = lib.platforms.darwin;
+  };
+})
--- a/pkgs/by-name/sw/swipeaerospace/settings-window.patch
+++ b/pkgs/by-name/sw/swipeaerospace/settings-window.patch
@ -0,0 +1,36 @@
+--- a/SwipeAeroSpace/SwipeAeroSpaceApp.swift
+++ b/SwipeAeroSpace/SwipeAeroSpaceApp.swift
+@@ -10,10 +10,0 @@ import SwiftUI
+-@available(macOS 14.0, *)
+-struct SettingsButton: View {
+-    @Environment(\.openSettings) private var openSettings
+-
+-    var body: some View {
+-        Button("Settings") {
+-            openSettings()
+-        }
+-    }
+-}
+@@ -64,16 +54,4 @@ struct SwipeAeroSpaceApp: App {
+-            if #available(macOS 14.0, *) {
+-                SettingsButton()
+-            } else {
+-                Button(
+-                    action: {
+-                        NSApp.sendAction(
+-                            Selector(("showSettingsWindow:")),
+-                            to: nil,
+-                            from: nil
+-                        )
+-                    },
+-                    label: {
+-                        Text("Settings")
+-                    }
+-                )
+            Button("Settings") {
+                NSApp.activate(ignoringOtherApps: true)
+                openWindow(id: "settings")
+             }
+@@ -92 +70 @@ struct SwipeAeroSpaceApp: App {
+-        Settings {
+        WindowGroup(id: "settings") {
--- a/pkgs/by-name/sy/syncpack/package.nix
+++ b/pkgs/by-name/sy/syncpack/package.nix
@ -0,0 +1,41 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  versionCheckHook,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "syncpack";
+  version = "15.3.2";
+
+  src = fetchFromGitHub {
+    owner = "JamieMason";
+    repo = "syncpack";
+    tag = finalAttrs.version;
+    hash = "sha256-hpTVubKPuRtVxjaWetpFaK71UJXMAfOvWCZ4SqgOi0Y=";
+  };
+
+  cargoHash = "sha256-sjHyifhKU7FxwxrrAPuMwcUEw0lDGV83mOxXzLZul88=";
+
+  __structuredAttrs = true;
+
+  # This test asserts that a nested .gitignore excludes a build directory, but
+  # the `ignore` crate only applies gitignore rules inside a real git repository.
+  # The sandbox builds from a source tarball with no .git, so it is skipped here.
+  checkFlags = [
+    "--skip=issue_334_nested_gitignore_excludes_build_directory"
+  ];
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  meta = {
+    description = "Consistent dependency versions in large JavaScript monorepos";
+    homepage = "https://syncpack.dev";
+    changelog = "https://github.com/JamieMason/syncpack/releases/tag/${finalAttrs.version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ ELHart05 ];
+    mainProgram = "syncpack";
+  };
+})
--- a/pkgs/by-name/ta/talosctl/package.nix
+++ b/pkgs/by-name/ta/talosctl/package.nix
@ -9,16 +9,16 @@

 buildGoModule (finalAttrs: {
  pname = "talosctl";
-  version = "1.13.4";
+  version = "1.13.5";

  src = fetchFromGitHub {
    owner = "siderolabs";
    repo = "talos";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-jcBRAixpdfbzOfCc7BjyDScWPsrW9Mc7A8vGLyN1f68=";
+    hash = "sha256-woMLG4m7snKD3naTZWYEu78zC/eK5lDxd+uLyXdkzMo=";
  };

-  vendorHash = "sha256-dbuPRXAz+YOxmhEdd1R3R5rOAiNn9TOEeDavL+40MV4=";
+  vendorHash = "sha256-98jQJ7M/3ki5L6YQAxtk3bBnixfXhLX4WXY7DN4hsQ4=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/te/teamtype/package.nix
+++ b/pkgs/by-name/te/teamtype/package.nix
@ -5,6 +5,8 @@
  versionCheckHook,
  installShellFiles,
  nix-update-script,
+  pkg-config,
+  libgit2,
 }:

 rustPlatform.buildRustPackage (finalAttrs: {
@ -22,7 +24,18 @@ rustPlatform.buildRustPackage (finalAttrs: {

  cargoHash = "sha256-OIOffnCC9PlT/SXPOuTnKx3feZnkHP+jzbQIJWX0tzk=";

-  nativeBuildInputs = [ installShellFiles ];
+  nativeBuildInputs = [
+    installShellFiles
+    pkg-config
+  ];
+
+  buildInputs = [
+    libgit2
+  ];
+
+  env = {
+    LIBGIT2_NO_VENDOR = 1;
+  };

  postInstall = ''
    installManPage \
@ -50,8 +63,9 @@ rustPlatform.buildRustPackage (finalAttrs: {
    mainProgram = "teamtype";
    teams = [ lib.teams.ngi ];
    maintainers = with lib.maintainers; [
-      prince213
+      alerque
      ethancedwards8
+      prince213
    ];
  };
 })
--- a/pkgs/by-name/te/texlyre/package.nix
+++ b/pkgs/by-name/te/texlyre/package.nix
@ -0,0 +1,107 @@
+{
+  lib,
+  xsel,
+  serve,
+  fetchzip,
+  stdenvNoCC,
+  makeWrapper,
+  buildNpmPackage,
+  fetchFromGitHub,
+
+  baseUrl ? "/",
+}:
+
+buildNpmPackage (finalAttrs: {
+  pname = "texlyre";
+  version = "0.9.0";
+
+  src = fetchFromGitHub {
+    owner = "TeXlyre";
+    repo = "texlyre";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-sUyQYtTuE5bNEqxDw9DYT0KRiww7PmGnQ7CYt60EbSc=";
+  };
+
+  npmDepsHash = "sha256-bOhK7kQWY3QYri9S+WoD8VyZXTGK5gcK/ixpGeeP4hg=";
+
+  postPatch = ''
+    sed -i 's/"version": ".*"/"version": "${finalAttrs.version}"/' package.json
+
+    substituteInPlace texlyre.config.ts \
+      --replace-fail "baseUrl: '/texlyre/'" "baseUrl: '${baseUrl}'"
+
+    # disable downloading assets
+    substituteInPlace scripts/setup-assets.cjs \
+      --replace-fail "await downloadCoreAssets();" ""
+  '';
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  __structuredAttrs = true;
+
+  preBuild = ''
+    # put core assets in place
+    mkdir -p public/core
+    cp -r ${finalAttrs.passthru.drawioEmbed}/drawio-embed public/core/drawio-embed
+    cp -r ${finalAttrs.passthru.busytexAssets} public/core/busytex
+
+    npm run generate:configs
+  '';
+
+  doCheck = true;
+  checkPhase = ''
+    runHook preCheck
+    npm run test:check
+    runHook postCheck
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    mv dist $out
+    runHook postInstall
+  '';
+
+  postFixup = ''
+    makeWrapper ${lib.getExe serve} $out/bin/texlyre \
+      --prefix PATH : ${lib.makeBinPath [ xsel ]} \
+      --chdir $out
+  '';
+
+  passthru = {
+    updateScript = ./update.sh;
+    drawioEmbed = stdenvNoCC.mkDerivation (finalAttrs: {
+      pname = "drawio-embed";
+      version = "30.2.2";
+      src = fetchFromGitHub {
+        owner = "TeXlyre";
+        repo = "drawio-embed-mirror";
+        tag = "v${finalAttrs.version}";
+        hash = "sha256-bdOhviJl0P/+GSJKaHMbGoPf+uEhoX5GeyY6bGBOpCg=";
+      };
+      dontBuild = true;
+      installPhase = "cp -a . $out";
+    });
+    busytexAssets = stdenvNoCC.mkDerivation (finalAttrs: {
+      pname = "busytex-assets";
+      version = "1.1.1";
+      src = fetchFromGitHub {
+        owner = "TeXlyre";
+        repo = "texlyre-busytex";
+        tag = "assets-v${finalAttrs.version}";
+        hash = "sha256-vlLoJw5EX6x3nTQvBC8hntDa5QKtY46eJSxJLJzs4EE=";
+      };
+      dontBuild = true;
+      installPhase = "cp -a . $out";
+    });
+  };
+
+  meta = {
+    changelog = "https://github.com/TeXlyre/texlyre/releases/tag/${finalAttrs.src.rev}";
+    description = "Local-first LaTeX & Typst web editor with real-time collaboration & offline support";
+    homepage = "https://github.com/TeXlyre/texlyre";
+    license = lib.licenses.agpl3Only;
+    platforms = lib.platforms.all;
+    mainProgram = "texlyre";
+    teams = with lib.teams; [ ngi ];
+  };
+})
--- a/pkgs/by-name/te/texlyre/update.sh
+++ b/pkgs/by-name/te/texlyre/update.sh
@ -0,0 +1,19 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p nix-update jq gitMinimal
+
+set -euo pipefail
+
+nix-update texlyre
+
+PKG_DIR=$(realpath "$(dirname "$0")")
+NIXPKGS_ROOT="$(git rev-parse --show-toplevel)"
+SRC_DIR=$(nix-build -E "(import \"$NIXPKGS_ROOT\" {}).texlyre.src" --no-out-link)
+ASSETS_SCRIPT="$SRC_DIR/scripts/download-core-assets.cjs"
+
+DRAWIO_VERSION=$(grep -A 2 "name: 'drawio-embed'" "$ASSETS_SCRIPT" | grep "version:" | cut -d "'" -f 2 | sed 's/^v//')
+BUSYTEX_VERSION=$(grep -A 2 "name: 'texlyre-busytex'" "$ASSETS_SCRIPT" | grep "version:" | cut -d "'" -f 2 | sed 's/^v//')
+
+echo "Updating: drawio-embed=$DRAWIO_VERSION, busytex=$BUSYTEX_VERSION"
+
+nix-update texlyre.passthru.drawioEmbed --version "$DRAWIO_VERSION"
+nix-update texlyre.passthru.busytexAssets --version "$BUSYTEX_VERSION"
--- a/pkgs/by-name/tm/tmux/package.nix
+++ b/pkgs/by-name/tm/tmux/package.nix
@ -2,7 +2,6 @@
  lib,
  stdenv,
  fetchFromGitHub,
-  fetchpatch,
  autoreconfHook,
  bison,
  libevent,
@ -18,12 +17,15 @@
  libutempter,
  withSixel ? true,
  versionCheckHook,
-  nix-update-script,
+  common-updater-scripts,
+  writeShellScript,
+  curl,
+  jq,
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "tmux";
-  version = "3.6a";
+  version = "3.7";

  outputs = [
    "out"
@ -34,20 +36,9 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "tmux";
    repo = "tmux";
    tag = finalAttrs.version;
-    hash = "sha256-VwOyR9YYhA/uyVRJbspNrKkJWJGYFFktwPnnwnIJ97s=";
+    hash = "sha256-dgqI1jZjnluN/F/AjngzcaMy3TgudmkvDT336YlhGZM=";
  };

-  patches = [
-    # Fix NULL pointer dereference in control_write() when a control-mode
-    # client is notified before control_state has been allocated.
-    # https://github.com/tmux/tmux/issues/4980
-    (fetchpatch {
-      name = "tmux-control-notify-uninitialized.patch";
-      url = "https://github.com/tmux/tmux/commit/e5a2a25fafb8ee107c230d8acad694f6b635f8bb.patch";
-      hash = "sha256-UPbhMNnH1WJwTH/LVwjVonTqvNhyuniUrYm7iLVkCfg=";
-    })
-  ];
-
  nativeBuildInputs = [
    pkg-config
    autoreconfHook
@ -99,7 +90,10 @@ stdenv.mkDerivation (finalAttrs: {
          ln -sv ${ncurses}/share/terminfo/t/{tmux,tmux-256color,tmux-direct} $out/share/terminfo/t
        ''
    );
-    updateScript = nix-update-script { };
+    updateScript = writeShellScript "update-tmux" ''
+      latest=$(${lib.getExe curl} --silent ''${GITHUB_TOKEN:+--header "Authorization: Bearer $GITHUB_TOKEN"} https://api.github.com/repos/tmux/tmux/releases/latest | ${lib.getExe jq} -r .tag_name)
+      ${lib.getExe' common-updater-scripts "update-source-version"} tmux "$latest"
+    '';
  };

  meta = {
--- a/pkgs/by-name/vi/vimhjkl/package.nix
+++ b/pkgs/by-name/vi/vimhjkl/package.nix
@ -0,0 +1,44 @@
+{
+  lib,
+  python3Packages,
+  fetchFromGitHub,
+  nix-update-script,
+}:
+
+python3Packages.buildPythonApplication (finalAttrs: {
+  pname = "vimhjkl";
+  version = "0.5.1";
+  pyproject = true;
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "S-Sigdel";
+    repo = "vimhjkl";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-1Hh6bXuuK3udixgU32yFWkBa9NA3Z7kqI50ynSGCZ+o=";
+  };
+
+  build-system = [
+    python3Packages.uv-build
+  ];
+
+  pythonImportsCheck = [
+    "vimhjkl"
+  ];
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail "uv_build>=0.11,<0.12" "uv_build"
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Learn vim from your terminal with spaced repetition";
+    homepage = "https://github.com/S-Sigdel/vimhjkl";
+    changelog = "https://github.com/S-Sigdel/vimhjkl/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ MoritzBoehme ];
+    mainProgram = "vimhjkl";
+  };
+})
--- a/pkgs/by-name/we/wealthfolio/package.nix
+++ b/pkgs/by-name/we/wealthfolio/package.nix
@ -19,20 +19,20 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "wealthfolio";
-  version = "3.5.2";
+  version = "3.5.3";

  src = fetchFromGitHub {
    owner = "afadil";
    repo = "wealthfolio";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-WU87VmnbzUno1CmIVwBLYjmTZybM4qSuRmBH/2n/Tfo=";
+    hash = "sha256-9dE0IQtDUcveZk2eWu9+UDpAYPgk/LbY+jsTNH3N9hg=";
  };

  pnpmDeps = fetchPnpmDeps {
    inherit (finalAttrs) src pname version;
    pnpm = pnpm_10;
    fetcherVersion = 4;
-    hash = "sha256-EDnHlaW3Ad32N8wl38ryo6pYvKU2T1OH6IkOuTLI7Vs=";
+    hash = "sha256-ELOwrrRHmHAMZg6K+5MWXdUj/gyNNBgMl6OY11zxbB4=";
  };

  cargoRoot = ".";
@ -45,7 +45,7 @@ stdenv.mkDerivation (finalAttrs: {
      src
      cargoRoot
      ;
-    hash = "sha256-KoS2EouZ0Uf3cijUUOpwYBYEjEB5VxIArU1CuCji2+I=";
+    hash = "sha256-P93AAivBXWBLik8M/DNUWyKXVsq7ttvX3DpiXwaDL2I=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/wi/wiimms-iso-tools/package.nix
+++ b/pkgs/by-name/wi/wiimms-iso-tools/package.nix
@ -5,7 +5,8 @@
  fetchpatch,
  zlib,
  ncurses,
-  fuse,
+  fuse3,
+  versionCheckHook,
 }:

 stdenv.mkDerivation (finalAttrs: {
@ -20,7 +21,7 @@ stdenv.mkDerivation (finalAttrs: {
  buildInputs = [
    zlib
    ncurses
-    fuse
+    fuse3
  ];

  patches = [
@ -50,6 +51,12 @@ stdenv.mkDerivation (finalAttrs: {
    ./install.sh --no-sudo
  '';

+  doInstallCheck = true;
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  versionCheckProgram = "${placeholder "out"}/bin/wit";
+
  meta = {
    homepage = "https://wit.wiimm.de";
    description = "Set of command line tools to manipulate Wii and GameCube ISO images and WBFS containers";
--- a/pkgs/by-name/xa/xadrian/package.nix
+++ b/pkgs/by-name/xa/xadrian/package.nix
@ -0,0 +1,111 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchurl,
+  jdk8,
+  makeWrapper,
+  makeBinaryWrapper,
+  makeDesktopItem,
+  copyDesktopItems,
+  unzip,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "xadrian";
+  version = "1.5.1";
+
+  # The source release (tag xadrian-1.5.1) cannot be built: it depends on
+  # de.ailis:oneinstance, which was only published to nexus.ailis.de (now
+  # offline) and is not on Maven Central. The upstream release instead ships
+  # prebuilt, self-contained artifacts, which we repackage here.
+  src =
+    if stdenvNoCC.hostPlatform.isDarwin then
+      fetchurl {
+        url = "https://github.com/kayahr/xadrian/releases/download/xadrian-${finalAttrs.version}/xadrian-${finalAttrs.version}-macosx.zip";
+        hash = "sha256-nCkhlC/nrTxCMd2jO+avkFlXD98a+rFvD6uoCfcZ3PU=";
+      }
+    else
+      fetchurl {
+        url = "https://github.com/kayahr/xadrian/releases/download/xadrian-${finalAttrs.version}/xadrian-${finalAttrs.version}-unix.tar.bz2";
+        hash = "sha256-MVWvYbI9V9s0CbmM6DXmWZEu0kdn9ZIpNcnJZhkDsjU=";
+      };
+
+  sourceRoot = if stdenvNoCC.hostPlatform.isDarwin then "." else "xadrian-${finalAttrs.version}";
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  # Xadrian must run on a Java 8 runtime: it uses javax.xml.bind (JAXB), which
+  # was bundled in the JDK only through Java 8 and removed in Java 11+.
+  nativeBuildInputs = [
+    unzip
+  ]
+  # A macOS .app's CFBundleExecutable must be a real binary, so use
+  # makeBinaryWrapper on Darwin; makeWrapper's shell script is fine elsewhere.
+  ++ lib.optionals stdenvNoCC.hostPlatform.isDarwin [ makeBinaryWrapper ]
+  ++ lib.optionals (!stdenvNoCC.hostPlatform.isDarwin) [
+    makeWrapper
+    copyDesktopItems
+  ];
+
+  desktopItems = lib.optionals (!stdenvNoCC.hostPlatform.isDarwin) [
+    (makeDesktopItem {
+      name = "xadrian";
+      desktopName = "Xadrian";
+      exec = "xadrian";
+      icon = "xadrian";
+      comment = finalAttrs.meta.description;
+      categories = [ "Game" ];
+      startupWMClass = "Xadrian";
+    })
+  ];
+
+  installPhase = ''
+    runHook preInstall
+  ''
+  + (
+    if stdenvNoCC.hostPlatform.isDarwin then
+      ''
+        mkdir -p $out/Applications
+        cp -R Xadrian.app $out/Applications/
+        appdir=$out/Applications/Xadrian.app
+        chmod -R u+w "$appdir"
+
+        # The bundled JavaApplicationStub is Apple's long-removed Java 6
+        # launcher (no arm64, broken on modern macOS); replace it with a JRE
+        # wrapper so the .app actually launches.
+        rm -f "$appdir/Contents/MacOS/JavaApplicationStub"
+        makeWrapper ${jdk8}/bin/java "$appdir/Contents/MacOS/JavaApplicationStub" \
+          --add-flags "-jar $appdir/Contents/Resources/Java/xadrian.jar"
+
+        makeWrapper ${jdk8}/bin/java $out/bin/xadrian \
+          --add-flags "-jar $appdir/Contents/Resources/Java/xadrian.jar"
+      ''
+    else
+      ''
+        # Keep the jars co-located so xadrian.jar's relative Class-Path resolves.
+        install -Dm644 -t $out/share/xadrian lib/*.jar
+
+        # The application icon is embedded in the jar.
+        unzip -p $out/share/xadrian/xadrian.jar de/ailis/xadrian/images/xadrian-64.png \
+          > xadrian.png
+        install -Dm644 xadrian.png $out/share/icons/hicolor/64x64/apps/xadrian.png
+
+        makeWrapper ${jdk8}/bin/java $out/bin/xadrian \
+          --add-flags "-jar $out/share/xadrian/xadrian.jar"
+      ''
+  )
+  + ''
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Factory complex calculator for X3: Terran Conflict and X3: Albion Prelude";
+    homepage = "https://github.com/kayahr/xadrian";
+    license = lib.licenses.mit;
+    sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
+    maintainers = with lib.maintainers; [ FabricSoul ];
+    mainProgram = "xadrian";
+    platforms = jdk8.meta.platforms;
+  };
+})
--- a/pkgs/by-name/ze/zed-editor/package.nix
+++ b/pkgs/by-name/ze/zed-editor/package.nix
@ -98,7 +98,7 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "zed-editor";
-  version = "1.7.2";
+  version = "1.8.2";

  outputs = [
    "out"
@ -111,7 +111,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    owner = "zed-industries";
    repo = "zed";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-f4CxfUsOEZQIIf0+v+3nXH4zlM3mPy/eZyzXG1ayiVc=";
+    hash = "sha256-j8CwQnVBHvc//4O2N55+4AAAhcARNHGEcccUoSHK8d4=";
  };

  postPatch = ''
@ -134,7 +134,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
      --replace-fail 'builder.include(&glib_path_config);' 'builder.include("${lib.getLib glib}/lib/glib-2.0/include");'
  '';

-  cargoHash = "sha256-QTnDiNFrBl8E6BgFL1HjoJhGfMBUzOoMimkyKdwUcks=";
+  cargoHash = "sha256-zTAIGL5cmswjRqaBgEN+aiyAXMMY9OYZ2bfd6sd1c4Y=";

  __structuredAttrs = true;

--- a/pkgs/by-name/zi/zigdoc/package.nix
+++ b/pkgs/by-name/zi/zigdoc/package.nix
@ -0,0 +1,37 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  zig_0_16,
+}:
+
+let
+  zig = zig_0_16;
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "zigdoc";
+  version = "0.5.1";
+
+  src = fetchFromGitHub {
+    owner = "rockorager";
+    repo = "zigdoc";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-OC84SxB0N+QbyXGAfdHDSWde16IwdCkIPbU699wnvY0=";
+  };
+
+  nativeBuildInputs = [ zig.hook ];
+
+  strictDeps = true;
+
+  __structuredAttrs = true;
+
+  meta = {
+    homepage = "https://github.com/rockorager/zigdoc";
+    description = "CLI tool to view documentation for zig library symbols";
+    changelog = "https://github.com/rockorager/zigdoc/releases";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ ddogfoodd ];
+    mainProgram = "zigdoc";
+    inherit (zig.meta) platforms;
+  };
+})
--- a/pkgs/development/compilers/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/default.nix
@ -28,9 +28,9 @@ let
    "21.1.8".officialRelease.sha256 = "sha256-pgd8g9Yfvp7abjCCKSmIn1smAROjqtfZaJkaUkBSKW0=";
    "22.1.8".officialRelease.sha256 = "sha256-SF7wFuh4kXZTytpdgX7vUZItKtRobnVICm+ixze4iG0=";
    "23.0.0-git".gitRelease = {
-      rev = "d1744cf76fbea0c407c5e793a380ffca4e5829be";
-      rev-version = "23.0.0-unstable-2026-06-21";
-      sha256 = "sha256-gtfU3pO3xiZtxz/iRmkWnaEx/DEomkOi9r6jsCbLOgQ=";
+      rev = "4050d7a96903eec615c57e1d3d6f3c824096244c";
+      rev-version = "23.0.0-unstable-2026-06-28";
+      sha256 = "sha256-UAqDlH9F/GZ9O9VGiOyP5shuVTIC3SeSstyH5ZWDfAM=";
    };
  }
  // llvmVersions;
--- a/pkgs/development/python-modules/airos/default.nix
+++ b/pkgs/development/python-modules/airos/default.nix
@ -14,7 +14,7 @@

 buildPythonPackage (finalAttrs: {
  pname = "airos";
-  version = "0.6.8";
+  version = "0.6.9";
  pyproject = true;

  disabled = pythonOlder "3.13";
@ -23,7 +23,7 @@ buildPythonPackage (finalAttrs: {
    owner = "CoMPaTech";
    repo = "python-airos";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-TTEhZ0KJaWM7eyD3Kk646X5rEMIquLte41XqnTeO3lI=";
+    hash = "sha256-/A9bP7wc+N0Jz/jJLvKHqVPjF3ddHjVKWlSN8tqGHIw=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/ocrmypdf/default.nix
+++ b/pkgs/development/python-modules/ocrmypdf/default.nix
@ -32,7 +32,7 @@

 buildPythonPackage rec {
  pname = "ocrmypdf";
-  version = "17.7.0";
+  version = "17.7.1";
  pyproject = true;

  src = fetchFromGitHub {
@ -45,7 +45,7 @@ buildPythonPackage rec {
    postFetch = ''
      rm "$out/.git_archival.txt"
    '';
-    hash = "sha256-3WBqXrt1u7Xl1JJAKUHC3C5arCfCEsrYglIOfMrUx9g=";
+    hash = "sha256-LHNaWpnx11EGKvmudicMFCQJzTQMB2+Rz5JgHJN7lFk=";
  };

  patches = [
--- a/pkgs/development/python-modules/ocrmypdf/use-pillow-heif.patch
+++ b/pkgs/development/python-modules/ocrmypdf/use-pillow-heif.patch
@ -1,22 +1,22 @@
 diff --git a/pyproject.toml b/pyproject.toml
-index 2caa0e75..f6fcf60a 100644
+index 7be62275..0b70ad88 100644
 --- a/pyproject.toml
 +++ b/pyproject.toml
-@@ -16,7 +16,7 @@ dependencies = [
+@@ -17,7 +17,7 @@ dependencies = [
   "img2pdf>=0.5",
   "packaging>=20",
-   "pdfminer.six>=20220319",
+   "pdfminer.six>=20260107",  # fixes parsing of tokens split across the read buffer/streams (gh #1361)
 -  "pi-heif",                # Heif image format - maintainers: if this is removed, it will NOT break
 +  "pillow-heif",                # Heif image format - maintainers: if this is removed, it will NOT break
   "pikepdf>=10",
   "Pillow>=10.0.1",
   "pluggy>=1",
 diff --git a/src/ocrmypdf/_pipeline.py b/src/ocrmypdf/_pipeline.py
-index 90524d58..0be5a0f8 100644
+index 161d77df..1ec03a12 100644
 --- a/src/ocrmypdf/_pipeline.py
 +++ b/src/ocrmypdf/_pipeline.py
-@@ -42,7 +42,7 @@ from ocrmypdf.pdfinfo import Colorspace, Encoding, PageInfo, PdfInfo
- from ocrmypdf.pluginspec import OrientationConfidence
+@@ -49,7 +49,7 @@ from ocrmypdf.pdfinfo import Colorspace, Encoding, FloatRect, Ink, PageInfo, Pdf
+ from ocrmypdf.pluginspec import GhostscriptRasterDevice, OrientationConfidence
 
 try:
 -    from pi_heif import register_heif_opener
--- a/pkgs/development/python-modules/pybase62/default.nix
+++ b/pkgs/development/python-modules/pybase62/default.nix
@ -18,7 +18,7 @@ buildPythonPackage (finalAttrs: {
    owner = "suminb";
    repo = "base62";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-/H16MT3mKCdXItoeOn1LWTHlgWmtwJdQHUaCp18eMz0=";
+    hash = "sha256-7N/SGJAVwJOy1ObijA2s9XMrqMMb2SUMJaN72ITUrOM=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/python-jsonpath/default.nix
+++ b/pkgs/development/python-modules/python-jsonpath/default.nix
@ -7,17 +7,17 @@
  regex,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "python-jsonpath";
-  version = "2.0.2";
+  version = "2.1.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "jg-rp";
    repo = "python-jsonpath";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
    fetchSubmodules = true;
-    hash = "sha256-eVypnFeqFW2WJfCinWXJulVtxaFpNomK2tZNbmxsxrY=";
+    hash = "sha256-2AV+X3Vs+pYi3Iv7zy9/nXna5PgrofHmrH0xyaumZWk=";
  };

  build-system = [ hatchling ];
@ -34,13 +34,13 @@ buildPythonPackage rec {
  nativeCheckInputs = [
    pytestCheckHook
  ]
-  ++ optional-dependencies.strict;
+  ++ finalAttrs.passthru.optional-dependencies.strict;

  meta = {
-    changelog = "https://github.com/jg-rp/python-jsonpath/blob/${src.tag}/CHANGELOG.md";
+    changelog = "https://github.com/jg-rp/python-jsonpath/blob/${finalAttrs.src.tag}/CHANGELOG.md";
    description = "Flexible JSONPath engine for Python with JSON Pointer and JSON Patch";
    homepage = "https://github.com/jg-rp/python-jsonpath";
    license = lib.licenses.mit;
    maintainers = [ lib.maintainers.dotlambda ];
  };
-}
+})
--- a/pkgs/development/python-modules/scipy/default.nix
+++ b/pkgs/development/python-modules/scipy/default.nix
@ -101,7 +101,17 @@ buildPythonPackage (finalAttrs: {
  ];

  disabledTests =
-    lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64) [
+    [
+      # precision issues on at least some x86_64 and aarch64
+      # see: https://github.com/scipy/scipy/issues/25488
+      "test_nyquist"
+    ]
+    ++ lib.optionals (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64) [
+      # more flakiness
+      # see: https://github.com/scipy/scipy/issues/25522
+      "test_convergence"
+    ]
+    ++ lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64) [
      # The following tests are broken on aarch64-darwin with newer compilers and library versions.
      # See https://github.com/scipy/scipy/issues/18308
      "test_a_b_neg_int_after_euler_hypergeometric_transformation"
--- a/pkgs/development/tools/analysis/tflint-plugins/tflint-ruleset-aws.nix
+++ b/pkgs/development/tools/analysis/tflint-plugins/tflint-ruleset-aws.nix
@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "tflint-ruleset-aws";
-  version = "0.47.0";
+  version = "0.48.0";

  src = fetchFromGitHub {
    owner = "terraform-linters";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-QHAa8kbTZRSS5qLpX5zk4Fcal2Ah6yXv6satwfNFVLo=";
+    hash = "sha256-mcFsjn/lj2pkecI1BVaUwv8Zv11OSN+EIDYGuxrtfrQ=";
  };

-  vendorHash = "sha256-+FxNOrC5iYVb+PPIPTClXmnPTrm7hqT+VLrgcBHWWD4=";
+  vendorHash = "sha256-VWZkNtvlOqF6DX2duFih4nFGrxBAfeIIbtc+9hTiUJo=";

  postPatch = ''
    # some automation for creating new releases on GitHub, which we don't need
--- a/pkgs/misc/tmux-plugins/default.nix
+++ b/pkgs/misc/tmux-plugins/default.nix
@ -1363,6 +1363,25 @@ in
    };
  };

+  tmux-tpad = mkTmuxPlugin {
+    pluginName = "tmux-tpad";
+    rtpFilePath = "tpad.tmux";
+    version = "0.3.0";
+    src = fetchFromGitHub {
+      owner = "Subbeh";
+      repo = "tmux-tpad";
+      rev = "v0.3.0";
+      hash = "sha256-w1eNg6n5JEWcKT7hCr3nFPe01kW3PwGBx8sdtfFojvk=";
+    };
+    meta = {
+      homepage = "https://github.com/Subbeh/tmux-tpad";
+      description = "Tmux scratchpad plugin";
+      license = lib.licenses.mit;
+      platforms = lib.platforms.unix;
+      maintainers = with lib.maintainers; [ anned20 ];
+    };
+  };
+
  tmux-window-name = mkTmuxPlugin {
    pluginName = "tmux-window-name";
    version = "2024-03-08";
--- a/pkgs/servers/home-assistant/custom-components/gtfs-realtime/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/gtfs-realtime/package.nix
@ -12,13 +12,13 @@
 buildHomeAssistantComponent rec {
  owner = "bcpearce";
  domain = "gtfs_realtime";
-  version = "0.4.7";
+  version = "0.4.8";

  src = fetchFromGitHub {
    owner = "bcpearce";
    repo = "homeassistant-gtfs-realtime";
    tag = version;
-    hash = "sha256-swqq2KY12EuDUnhnZ0zU8uIla7jvKLzvySnXU+vg/Jg=";
+    hash = "sha256-rf11yej0IsB3Og5D4n4iAsehWODJcjC930RzcGCsIT4=";
  };

  dependencies = [ gtfs-station-stop ];
--- a/pkgs/servers/home-assistant/custom-components/indego/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/indego/package.nix
@ -8,13 +8,13 @@
 buildHomeAssistantComponent rec {
  owner = "sander1988";
  domain = "indego";
-  version = "5.8.0";
+  version = "6.0.0";

  src = fetchFromGitHub {
    owner = "sander1988";
    repo = "Indego";
    tag = version;
-    hash = "sha256-yVzKHmxRWCsCcYu/HHwnEh3u9BDi3CngPk85sc/vIJo=";
+    hash = "sha256-pjkrodMFv8ZiSxmAK/JXuQbj6dfdkBf0FmhSMchTjsI=";
  };

  dependencies = [ pyindego ];
--- a/pkgs/servers/http/nginx/generic.nix
+++ b/pkgs/servers/http/nginx/generic.nix
@ -315,9 +315,9 @@ stdenv.mkDerivation {
        broken = lib.any (m: m.meta.broken or false) modules;
        platforms = lib.platforms.all;
        maintainers = with lib.maintainers; [
-          das_j
-          fpletz
          helsinki-Jo
+          ma27
+          leona
        ];
      };
 }
--- a/pkgs/servers/nextcloud/packages/32.json
+++ b/pkgs/servers/nextcloud/packages/32.json
@ -40,9 +40,9 @@
    ]
  },
  "contacts": {
-    "hash": "sha256-F2FomaYzrpOBvD2sxKjV7prGN+INKP8eJO2t/Z0J9YE=",
-    "url": "https://github.com/nextcloud-releases/contacts/releases/download/v8.3.13/contacts-v8.3.13.tar.gz",
-    "version": "8.3.13",
+    "hash": "sha256-+13qOi3veMZ+QUN8G78a073u8MDgMfaR3HBu6eiEWYQ=",
+    "url": "https://github.com/nextcloud-releases/contacts/releases/download/v8.3.14/contacts-v8.3.14.tar.gz",
+    "version": "8.3.14",
    "description": "The Nextcloud contacts app is a user interface for Nextcloud's CardDAV server. Easily sync contacts from various devices with your Nextcloud and edit them online.\n\n* 🚀 **Integration with other Nextcloud apps!** Currently Mail and Calendar – more to come.\n* 🎉 **Never forget a birthday!** You can sync birthdays and other recurring events with your Nextcloud Calendar.\n* 👥 **Sharing of Adressbooks!** You want to share your contacts with your friends or coworkers? No problem!\n* 🙈 **We’re not reinventing the wheel!** Based on the great and open SabreDAV library.",
    "homepage": "https://github.com/nextcloud/contacts#readme",
    "licenses": [
@ -70,9 +70,9 @@
    ]
  },
  "dav_push": {
-    "hash": "sha256-tSLsSgPHdpfcKPzJubwchBqQykLf9WV/mXfKKM2CSxs=",
-    "url": "https://github.com/bitfireAT/nc_ext_dav_push/releases/download/v1.0.1/dav_push.tar.gz",
-    "version": "1.0.1",
+    "hash": "sha256-OafUgG58+LsxibS/9aZjiOkdQcBV34xE6cmO9IkHMUo=",
+    "url": "https://github.com/bitfireAT/nc_ext_dav_push/releases/download/v1.0.2/dav_push.tar.gz",
+    "version": "1.0.2",
    "description": "In proprietary environments, changes in events and contacts are nowadays usually pushed to other clients so that they can update their views almost in real-time.\n\nWebDAV however (and in this context, especially CalDAV and CardDAV) doesn't currently support push notifications of clients when a collection has changed. So clients have to periodically ask the server for changes. This causes unnecessary delays and battery usage.\n\nThe WebDAV-Push standard, which is currently in development, wants to solve this problem with an open protocol, too.\n\nThis is the server part of these efforts to draft a standard and provide a working implementation (server + client) in order to demonstrate it.\n\n\nThe current WebDAV-Push draft is provided by [@bitfireAT](https://github.com/bitfireAT).\n          \nThis Nextcloud extension has been developed by [@verdigado](https://github.com/verdigado).",
    "homepage": "",
    "licenses": [
@ -260,9 +260,9 @@
    ]
  },
  "notes": {
-    "hash": "sha256-Rdq91a2xH7JGzjBYj6D08j8EjaPndJKug7KY5Qki3UY=",
-    "url": "https://github.com/nextcloud-releases/notes/releases/download/v5.0.1/notes-v5.0.1.tar.gz",
-    "version": "5.0.1",
+    "hash": "sha256-G/npepK65ZAaF8k2ZsSsDzbd/mjGnKpdI2ixi+avf9w=",
+    "url": "https://github.com/nextcloud-releases/notes/releases/download/v5.0.2/notes-v5.0.2.tar.gz",
+    "version": "5.0.2",
    "description": "The Notes app is a distraction free notes taking app for [Nextcloud](https://www.nextcloud.com/). It provides categories for better organization and supports formatting using [Markdown](https://en.wikipedia.org/wiki/Markdown) syntax. Notes are saved as files in your Nextcloud, so you can view and edit them with every Nextcloud client. Furthermore, a separate [REST API](https://github.com/nextcloud/notes/blob/master/docs/api/README.md) allows for an easy integration into apps ([Android](https://github.com/nextcloud/notes-android), [iOS](https://github.com/nextcloud/notes-ios), as well as [3rd-party apps](https://github.com/nextcloud/notes/wiki#3rd-party-clients) which allow convenient access to your Nextcloud notes). Further features include marking notes as favorites.",
    "homepage": "https://github.com/nextcloud/notes",
    "licenses": [
@ -320,9 +320,9 @@
    ]
  },
  "previewgenerator": {
-    "hash": "sha256-i2Z/kOEi1e3SoNj5zs3CyDHeRTAGYpuCzH5zybDQ38A=",
-    "url": "https://github.com/nextcloud-releases/previewgenerator/releases/download/v5.13.0/previewgenerator-v5.13.0.tar.gz",
-    "version": "5.13.0",
+    "hash": "sha256-ip4gqIP2ciT45zlHr7R22YCb15kawM2S1/r87b5lyoc=",
+    "url": "https://github.com/nextcloud-releases/previewgenerator/releases/download/v5.14.0/previewgenerator-v5.14.0.tar.gz",
+    "version": "5.14.0",
    "description": "The Preview Generator app allows admins to pre-generate previews. The app listens to edit events and stores this information. Once a cron job is triggered it will generate start preview generation. This means that you can better utilize your system by pre-generating previews when your system is normally idle and thus putting less load on your machine when the requests are actually served.\n\nThe app does not replace on demand preview generation so if a preview is requested before it is pre-generated it will still be shown.\nThe first time you install this app, before using a cron job, you properly want to generate all previews via:\n**occ preview:generate-all -vvv**\n\nThe preview queue will be processed automatically by a background job if the system cron background job mode is configured in Nextcloud. Additionally, you may run **occ preview:pre-generate -vvv** to a process the queue of pending previews immediately.",
    "homepage": "https://github.com/nextcloud/previewgenerator",
    "licenses": [
@ -390,9 +390,9 @@
    ]
  },
  "spreed": {
-    "hash": "sha256-BQFS9Dq3nk+7a2HT85tIXwaEaKXEmIuycM3JEeXuSTE=",
-    "url": "https://github.com/nextcloud-releases/spreed/releases/download/v22.0.13/spreed-v22.0.13.tar.gz",
-    "version": "22.0.13",
+    "hash": "sha256-uBvz8qpJ/PDseSDLp4aWAmTlDIOtoGWAXRouYdqU3Yc=",
+    "url": "https://github.com/nextcloud-releases/spreed/releases/download/v22.0.14/spreed-v22.0.14.tar.gz",
+    "version": "22.0.14",
    "description": "Chat, video & audio-conferencing using WebRTC\n\n* 💬 **Chat** Nextcloud Talk comes with a simple text chat, allowing you to share or upload files from your Nextcloud Files app or local device and mention other participants.\n* 👥 **Private, group, public and password protected calls!** Invite someone, a whole group or send a public link to invite to a call.\n* 🌐 **Federated chats** Chat with other Nextcloud users on their servers\n* 💻 **Screen sharing!** Share your screen with the participants of your call.\n* 🚀 **Integration with other Nextcloud apps** like Files, Calendar, User status, Dashboard, Flow, Maps, Smart picker, Contacts, Deck, and many more.\n* 🌉 **Sync with other chat solutions** With [Matterbridge](https://github.com/42wim/matterbridge/) being integrated in Talk, you can easily sync a lot of other chat solutions to Nextcloud Talk and vice-versa.",
    "homepage": "https://github.com/nextcloud/spreed",
    "licenses": [
--- a/pkgs/servers/nextcloud/packages/33.json
+++ b/pkgs/servers/nextcloud/packages/33.json
@ -40,9 +40,9 @@
    ]
  },
  "contacts": {
-    "hash": "sha256-XrXzGAJe+Zu3pon7sDbBbV73u2fKKD4fdfN24X6QdIM=",
-    "url": "https://github.com/nextcloud-releases/contacts/releases/download/v8.7.1/contacts-v8.7.1.tar.gz",
-    "version": "8.7.1",
+    "hash": "sha256-L0ro4VoU1GDMcs1m7qGns+S8y5+n1Q0oQ5EO1ojdLr0=",
+    "url": "https://github.com/nextcloud-releases/contacts/releases/download/v8.7.2/contacts-v8.7.2.tar.gz",
+    "version": "8.7.2",
    "description": "The Nextcloud contacts app is a user interface for Nextcloud's CardDAV server. Easily sync contacts from various devices with your Nextcloud and edit them online.\n\n* 🚀 **Integration with other Nextcloud apps!** Currently Mail and Calendar – more to come.\n* 🎉 **Never forget a birthday!** You can sync birthdays and other recurring events with your Nextcloud Calendar.\n* 👥 **Sharing of Adressbooks!** You want to share your contacts with your friends or coworkers? No problem!\n* 🙈 **We’re not reinventing the wheel!** Based on the great and open SabreDAV library.",
    "homepage": "https://github.com/nextcloud/contacts#readme",
    "licenses": [
@ -70,9 +70,9 @@
    ]
  },
  "dav_push": {
-    "hash": "sha256-tSLsSgPHdpfcKPzJubwchBqQykLf9WV/mXfKKM2CSxs=",
-    "url": "https://github.com/bitfireAT/nc_ext_dav_push/releases/download/v1.0.1/dav_push.tar.gz",
-    "version": "1.0.1",
+    "hash": "sha256-OafUgG58+LsxibS/9aZjiOkdQcBV34xE6cmO9IkHMUo=",
+    "url": "https://github.com/bitfireAT/nc_ext_dav_push/releases/download/v1.0.2/dav_push.tar.gz",
+    "version": "1.0.2",
    "description": "In proprietary environments, changes in events and contacts are nowadays usually pushed to other clients so that they can update their views almost in real-time.\n\nWebDAV however (and in this context, especially CalDAV and CardDAV) doesn't currently support push notifications of clients when a collection has changed. So clients have to periodically ask the server for changes. This causes unnecessary delays and battery usage.\n\nThe WebDAV-Push standard, which is currently in development, wants to solve this problem with an open protocol, too.\n\nThis is the server part of these efforts to draft a standard and provide a working implementation (server + client) in order to demonstrate it.\n\n\nThe current WebDAV-Push draft is provided by [@bitfireAT](https://github.com/bitfireAT).\n          \nThis Nextcloud extension has been developed by [@verdigado](https://github.com/verdigado).",
    "homepage": "",
    "licenses": [
@ -260,9 +260,9 @@
    ]
  },
  "notes": {
-    "hash": "sha256-xiAXy7CenYNVxgu9KvVTH3XCJjLpRqqxXv+YUsOab90=",
-    "url": "https://github.com/nextcloud-releases/notes/releases/download/v6.0.0/notes-v6.0.0.tar.gz",
-    "version": "6.0.0",
+    "hash": "sha256-/54d/UfkYLSPt8Coi4/zcheZx8mKXW34CIrvFEfYFLI=",
+    "url": "https://github.com/nextcloud-releases/notes/releases/download/v6.0.1/notes-v6.0.1.tar.gz",
+    "version": "6.0.1",
    "description": "The Notes app is a distraction free notes taking app for [Nextcloud](https://www.nextcloud.com/). It provides categories for better organization and supports formatting using [Markdown](https://en.wikipedia.org/wiki/Markdown) syntax. Notes are saved as files in your Nextcloud, so you can view and edit them with every Nextcloud client. Furthermore, a separate [REST API](https://github.com/nextcloud/notes/blob/master/docs/api/README.md) allows for an easy integration into apps ([Android](https://github.com/nextcloud/notes-android), [iOS](https://github.com/nextcloud/notes-ios), as well as [3rd-party apps](https://github.com/nextcloud/notes/wiki#3rd-party-clients) which allow convenient access to your Nextcloud notes). Further features include marking notes as favorites.",
    "homepage": "https://github.com/nextcloud/notes",
    "licenses": [
@ -320,9 +320,9 @@
    ]
  },
  "previewgenerator": {
-    "hash": "sha256-i2Z/kOEi1e3SoNj5zs3CyDHeRTAGYpuCzH5zybDQ38A=",
-    "url": "https://github.com/nextcloud-releases/previewgenerator/releases/download/v5.13.0/previewgenerator-v5.13.0.tar.gz",
-    "version": "5.13.0",
+    "hash": "sha256-ip4gqIP2ciT45zlHr7R22YCb15kawM2S1/r87b5lyoc=",
+    "url": "https://github.com/nextcloud-releases/previewgenerator/releases/download/v5.14.0/previewgenerator-v5.14.0.tar.gz",
+    "version": "5.14.0",
    "description": "The Preview Generator app allows admins to pre-generate previews. The app listens to edit events and stores this information. Once a cron job is triggered it will generate start preview generation. This means that you can better utilize your system by pre-generating previews when your system is normally idle and thus putting less load on your machine when the requests are actually served.\n\nThe app does not replace on demand preview generation so if a preview is requested before it is pre-generated it will still be shown.\nThe first time you install this app, before using a cron job, you properly want to generate all previews via:\n**occ preview:generate-all -vvv**\n\nThe preview queue will be processed automatically by a background job if the system cron background job mode is configured in Nextcloud. Additionally, you may run **occ preview:pre-generate -vvv** to a process the queue of pending previews immediately.",
    "homepage": "https://github.com/nextcloud/previewgenerator",
    "licenses": [
@ -390,9 +390,9 @@
    ]
  },
  "spreed": {
-    "hash": "sha256-D/S4OCkpWm9DqGZlTSfWGnVIsAWfcdlFX8mCQ6M6qjk=",
-    "url": "https://github.com/nextcloud-releases/spreed/releases/download/v23.0.6/spreed-v23.0.6.tar.gz",
-    "version": "23.0.6",
+    "hash": "sha256-1oIezD9c7DPPGlFXfKrt/+3ohQpcD+JiKKArRXiDRYM=",
+    "url": "https://github.com/nextcloud-releases/spreed/releases/download/v23.0.7/spreed-v23.0.7.tar.gz",
+    "version": "23.0.7",
    "description": "Chat, video & audio-conferencing using WebRTC\n\n* 💬 **Chat** Nextcloud Talk comes with a simple text chat, allowing you to share or upload files from your Nextcloud Files app or local device and mention other participants.\n* 👥 **Private, group, public and password protected calls!** Invite someone, a whole group or send a public link to invite to a call.\n* 🌐 **Federated chats** Chat with other Nextcloud users on their servers\n* 💻 **Screen sharing!** Share your screen with the participants of your call.\n* 🚀 **Integration with other Nextcloud apps** like Files, Calendar, User status, Dashboard, Flow, Maps, Smart picker, Contacts, Deck, and many more.\n* 🌉 **Sync with other chat solutions** With [Matterbridge](https://github.com/42wim/matterbridge/) being integrated in Talk, you can easily sync a lot of other chat solutions to Nextcloud Talk and vice-versa.",
    "homepage": "https://github.com/nextcloud/spreed",
    "licenses": [
--- a/pkgs/tools/misc/coreboot-utils/default.nix
+++ b/pkgs/tools/misc/coreboot-utils/default.nix
@ -17,7 +17,7 @@
 }:

 let
-  version = "26.03";
+  version = "26.06";

  commonMeta = {
    description = "Various coreboot-related tools";
@ -47,7 +47,7 @@ let
        src = fetchgit {
          url = "https://review.coreboot.org/coreboot";
          rev = finalAttrs.version;
-          hash = "sha256-gaJ9AP7g0KxOzZfg1dyNatC8/pl83pypeq5Lg+Qp1ys=";
+          hash = "sha256-rL9txaDXUzjkC2ioYmunoNq2+9rz9wpEJ7z3GZrqOH4=";
        };

        enableParallelBuilding = true;
--- a/pkgs/tools/misc/tdarr/common.nix
+++ b/pkgs/tools/misc/tdarr/common.nix
@ -6,7 +6,7 @@
  makeWrapper,
  copyDesktopItems,
  makeDesktopItem,
-  ffmpeg,
+  jellyfin-ffmpeg,
  handbrake,
  mkvtoolnix,
  ccextractor,
@ -24,6 +24,7 @@
  tesseract4,
  perl,
  apprise,
+  openssl,
 }:
 {
  pname,
@ -51,7 +52,7 @@ let

  binPath = lib.makeBinPath (
    [
-      ffmpeg
+      jellyfin-ffmpeg
      mkvtoolnix
    ]
    ++ includeInPath
@ -77,10 +78,10 @@ let
      ''_cfg="$rootDataPath/configs/${componentName}_Config.json"; if [ -f "$_cfg" ]; then grep -q ffprobePath "$_cfg" || sed -i '1s/{/{"ffprobePath":"",/' "$_cfg"; else printf '{"ffprobePath":""}' > "$_cfg"; fi''
      "--set-default"
      "ffmpegPath"
-      "${ffmpeg}/bin/ffmpeg"
+      "${jellyfin-ffmpeg}/bin/ffmpeg"
      "--set-default"
      "ffprobePath"
-      "${ffmpeg}/bin/ffprobe"
+      "${jellyfin-ffmpeg}/bin/ffprobe"
      "--set-default"
      "mkvpropeditPath"
      "${mkvtoolnix}/bin/mkvpropedit"
@ -100,7 +101,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  inherit pname;
-  version = "2.78.01";
+  version = "2.81.01";

  src = fetchzip {
    url = "https://storage.tdarr.io/versions/${finalAttrs.version}/${platform}/${componentName}.zip";
@ -129,6 +130,7 @@ stdenv.mkDerivation (finalAttrs: {
    libxcursor
    libxfixes
    apprise
+    openssl
  ];

  postPatch = ''
--- a/pkgs/tools/misc/tdarr/node.nix
+++ b/pkgs/tools/misc/tdarr/node.nix
@ -5,10 +5,10 @@ callPackage ./common.nix { } {
  component = "node";

  hashes = {
-    linux_x64 = "sha256-5wxf5E1M1bBXrv8/cBUZ7Edg90TnxY6UeXZpmkyJC0U=";
-    linux_arm64 = "sha256-jnrXHv5/u9YaMCwKy5QzcilRdEE60PQtTTMhoVsMGKw=";
-    darwin_x64 = "sha256-Ri4lop0XyE2oFUn74ZIx1UMhf/wVILnlwlRlIHzwr/A=";
-    darwin_arm64 = "sha256-ZSMsngeJM6QX0Z0J0ARH8Jo7NcH3CMwn9/Rk11VU3k8=";
+    linux_x64 = "sha256-hF4W72VEWAryCoLZecrwdT98iN3sARaPWJnEApFeHCw=";
+    linux_arm64 = "sha256-wJ3fZLJKUHama1P6YTslTb3fiYI4qjGm5VdHKGcG8k4=";
+    darwin_x64 = "sha256-cL6REyGqwFemXLMkgAXy9PTS0j7maT1lBNzckTL4Ez0=";
+    darwin_arm64 = "sha256-0LFTw4fbdFXcEYGVk1C1UOVRAh/MfGctFzfKB/mr6lM=";
  };

  includeInPath = [ ccextractor ];
--- a/pkgs/tools/misc/tdarr/server.nix
+++ b/pkgs/tools/misc/tdarr/server.nix
@ -5,10 +5,10 @@ callPackage ./common.nix { } {
  component = "server";

  hashes = {
-    linux_x64 = "sha256-biFiDQNDbPtqWHMi0JkuYGaX+Y9aNoXdYd+WwILJ3lo=";
-    linux_arm64 = "sha256-KmG2hHiR7aKDS2qJ/fN8T3pppt6wNaVp4ZGaanxqPYU=";
-    darwin_x64 = "sha256-buDJ2OnjjYSZi/vwPL35TYTYdJq7Xg9VckCP/DSpNEU=";
-    darwin_arm64 = "sha256-CDuajhnC/KdyCqtHmqV1oXmXmqU6RksQc/VVJtc0p10=";
+    linux_x64 = "sha256-iTxbPJ1XmmGInpCz4cbwnW8u5uV3DpMyXGMuKmGXOlc=";
+    linux_arm64 = "sha256-G3jK5pqKMKiciajaMku9S/q7upWcxmfXwZQ1tWhGaDg=";
+    darwin_x64 = "sha256-xnOI47sMZlTJNkTFrQCsioLQsjeOCVu1RZLgpoiRhTU=";
+    darwin_arm64 = "sha256-wRuTyUmRWYEMMCgScr+yTbsU1VSXypz9T8WhgyZE2TM=";
  };

  includeInPath = [ ccextractor ];
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@ -611,6 +611,8 @@ mapAliases {
  cudaPackages_12_3 = throw "CUDA 12.3 has been removed from Nixpkgs, as it is unmaintained upstream and depends on unsupported compilers"; # Added 2025-08-08
  cudaPackages_12_4 = throw "CUDA 12.4 has been removed from Nixpkgs, as it is unmaintained upstream and depends on unsupported compilers"; # Added 2025-08-08
  cudaPackages_12_5 = throw "CUDA 12.5 has been removed from Nixpkgs, as it is unmaintained upstream and depends on unsupported compilers"; # Added 2025-08-08
+  cup-docker = throw "'cup-docker' has been removed, due to being orphaned and packaged in an unreproducible manner"; # Added 2026-06-27
+  cup-docker-noserver = throw "'cup-docker-noserver' has been removed, due to being orphaned and packaged in an unreproducible manner"; # Added 2026-06-27
  cups-kyodialog3 = throw "'cups-kyodialog3' has been renamed to/replaced by 'cups-kyodialog'"; # Converted to throw 2025-10-27
  cura = throw "'cura' has been removed, as it was unmaintained in nixpkgs"; # Added 2026-05-22
  curaengine = throw "'curaengine' has been removed, as it was unmaintained in nixpkgs"; # Added 2026-05-22