Merge staging-next into staging

2026-07-06 17:13:24 -05:00 · 2026-06-10 13:12:00 +00:00 · 2026-06-10 13:12:00 +00:00 · 5db68cfaa0
commit 5db68cfaa0
parent cf5101411e e04d96cefb
71 changed files with 753 additions and 396 deletions
--- a/nixos/modules/services/networking/wpa_supplicant.nix
+++ b/nixos/modules/services/networking/wpa_supplicant.nix
@ -128,7 +128,7 @@ let
          ]
          ++ lib.optionals cfg.userControlled [
            # set up client sockets directory
-            "+${pkgs.coreutils}/bin/mkdir /run/wpa_supplicant/client"
+            "+${pkgs.coreutils}/bin/mkdir -p /run/wpa_supplicant/client"
            "+${pkgs.coreutils}/bin/chown wpa_supplicant:wpa_supplicant /run/wpa_supplicant/client"
            "+${pkgs.coreutils}/bin/chmod g=u /run/wpa_supplicant/client"
          ];
--- a/nixos/modules/services/security/opensnitch.nix
+++ b/nixos/modules/services/security/opensnitch.nix
@ -13,6 +13,7 @@ let
      file = pkgs.writeText "rule" (builtins.toJSON cfg);
    }
  );
+  stateDir = lib.strings.match "/var/lib/([^/]+)/.+" cfg.settings.Rules.Path;
 in
 {
  options = {
@ -105,10 +106,9 @@ in
                "iptables"
                "nftables"
              ];
-              default = if config.networking.nftables.enable then "nftables" else "iptables";
-              defaultText = lib.literalExpression ''if config.networking.nftables.enable then "nftables" else "iptables"'';
+              default = "nftables";
              description = ''
-                Which firewall backend to use.
+                Which firewall backend to use. `nftables` ruleset can be used for `iptables` firewall too, if `iptables` is built with nftables compatibility.
              '';
            };
            Ebpf.ModulesPath = lib.mkOption {
@ -139,7 +139,10 @@ in
            };

            Rules.Path = lib.mkOption {
-              type = lib.types.path;
+              type = lib.types.pathWith {
+                inStore = false;
+                absolute = true;
+              };
              default = "/var/lib/opensnitch/rules";
              description = ''
                Path to the directory where firewall rules can be found and will
@ -158,6 +161,12 @@ in
  };

  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = stateDir != null;
+        message = "`config.services.opensnitch.settings.Rules.Path` must be a sub-directory of /var/lib/, currently is ${cfg.settings.Rules.Path}";
+      }
+    ];

    security.auditd = lib.mkIf (cfg.settings.ProcMonitorMethod == "audit") {
      enable = true;
@ -174,8 +183,14 @@ in
            ""
            "${lib.getExe' cfg.package "opensnitchd"} --config-file ${cfg.configFile}"
          ];
+          StateDirectory = builtins.head stateDir; # match produces a list. Null case covered by assertion.
        };
-        preStart = lib.mkIf (cfg.rules != { }) (
+        preStart = ''
+          # assert rules directory exists before service starts
+          # will be in StateDirectory due to assertion
+          mkdir -p ${cfg.settings.Rules.Path}
+        ''
+        + lib.optionalString (cfg.rules != { }) (
          let
            rules = lib.flip lib.mapAttrsToList predefinedRules (
              file: content: {
@ -205,13 +220,12 @@ in
          ''
        );
      };
-      tmpfiles.rules = [
-        "d ${cfg.settings.Rules.Path} 0750 root root - -"
-        "L+ /etc/opensnitchd/network_aliases.json - - - - ${cfg.package}/etc/opensnitchd/network_aliases.json"
-        "L+ /etc/opensnitchd/system-fw.json - - - - ${cfg.package}/etc/opensnitchd/system-fw.json"
-      ];
    };

+    environment.etc."opensnitchd/network_aliases.json".source =
+      "${cfg.package}/etc/opensnitchd/network_aliases.json";
+    environment.etc."opensnitchd/system-fw.json".source =
+      "${cfg.package}/etc/opensnitchd/system-fw.json";
  };

  meta.maintainers = with lib.maintainers; [
--- a/nixos/modules/services/web-apps/lauti.nix
+++ b/nixos/modules/services/web-apps/lauti.nix
@ -72,7 +72,7 @@ in
        ExecStart = lib.getExe pkgs.lauti;
        WorkingDirectory = cfg.dataDir;
        StateDirectory = default;
-        EnvironmentFile = [ cfg.secrets ];
+        EnvironmentFile = cfg.secrets;

        # hardening
        AmbientCapabilities = "";
--- a/nixos/modules/virtualisation/qemu-vm.nix
+++ b/nixos/modules/virtualisation/qemu-vm.nix
@ -1307,6 +1307,8 @@ in
      serviceConfig = {
        Type = "oneshot";
        RemainAfterExit = true;
+        User = lib.mkIf (config.nix.daemonUser != "root") config.nix.daemonUser;
+        Group = lib.mkIf (config.nix.daemonGroup != "root") config.nix.daemonGroup;
      };
      script = ''
        if [[ "$(cat /proc/cmdline)" =~ regInfo=([^ ]*) ]]; then
--- a/nixos/tests/opensnitch.nix
+++ b/nixos/tests/opensnitch.nix
@ -1,17 +1,23 @@
 { pkgs, lib, ... }:
 let
+  # opensnitch ebpf seems to handle non-x86 syscalls incorrectly
+  test_ebpf = pkgs.stdenv.hostPlatform.isx86;
+
  monitorMethods = [
-    "ebpf"
    "proc"
    "ftrace"
    "audit"
-  ];
+  ]
+  ++ lib.optional test_ebpf "ebpf";
 in
 {
  name = "opensnitch";

  meta = with pkgs.lib.maintainers; {
-    maintainers = [ onny ];
+    maintainers = [
+      onny
+      grimmauld
+    ];
  };

  nodes = {
@ -88,13 +94,13 @@ in
    lib.concatLines (
      map (m: ''
        client_blocked_${m}.wait_for_unit("opensnitchd.service")
-        client_blocked_${m}.fail("curl http://server")
+        client_blocked_${m}.fail("curl --connect-timeout 3 http://server")

        client_allowed_${m}.wait_for_unit("opensnitchd.service")
-        client_allowed_${m}.succeed("curl http://server")
+        client_allowed_${m}.succeed("curl --connect-timeout 3 http://server")
      '') monitorMethods
    )
-    + ''
+    + lib.optionalString test_ebpf ''
      # make sure the kernel modules were actually properly loaded
      client_blocked_ebpf.succeed(r"journalctl -u opensnitchd --grep '\[eBPF\] module loaded: /nix/store/.*/etc/opensnitchd/opensnitch\.o'")
      client_blocked_ebpf.succeed(r"journalctl -u opensnitchd --grep '\[eBPF\] module loaded: /nix/store/.*/etc/opensnitchd/opensnitch-procs\.o'")
--- a/nixos/tests/wpa_supplicant.nix
+++ b/nixos/tests/wpa_supplicant.nix
@ -283,18 +283,22 @@ in
        enable = lib.mkOverride 0 true;
        userControlled = true;
        allowAuxiliaryImperativeNetworks = true;
-        interfaces = [ "wlan1" ];
+        interfaces = [
+          "wlan0"
+          "wlan1"
+        ];
      };
    };

    testScript = ''
      wpa_cli = "sudo -u alice -g wpa_supplicant wpa_cli"

-      with subtest("Daemon is running and accepting connections"):
-          machine.wait_for_unit("wpa_supplicant-wlan1.service")
-          status = machine.wait_until_succeeds(f"{wpa_cli} -i wlan1 status")
-          assert "Failed to connect" not in status, \
-                 "Failed to connect to the daemon"
+      with subtest("Daemons are running and accepting connections"):
+          for iface in ["wlan0", "wlan1"]:
+            machine.wait_for_unit(f"wpa_supplicant-{iface}.service")
+            status = machine.wait_until_succeeds(f"{wpa_cli} -i {iface} status")
+            assert "Failed to connect" not in status, \
+                   f"Failed to connect to the daemon for {iface}"

      with subtest("Daemon can be configured imperatively"):
          machine.succeed(f"{wpa_cli} -i wlan1 add_network")
--- a/pkgs/applications/editors/jetbrains/ides/webstorm.nix
+++ b/pkgs/applications/editors/jetbrains/ides/webstorm.nix
@ -12,20 +12,20 @@ let
  # update-script-start: urls
  urls = {
    x86_64-linux = {
-      url = "https://download.jetbrains.com/webstorm/WebStorm-2026.1.2.tar.gz";
-      hash = "sha256-xoMOLYSuWqWUh5RLI1Q4OnAgGM6tqRDWd1VoULX17yE=";
+      url = "https://download.jetbrains.com/webstorm/WebStorm-2026.1.3.tar.gz";
+      hash = "sha256-lryIoVxoytyDyfgjnobQ3e94wIIohmIKL88fwf2I49w=";
    };
    aarch64-linux = {
-      url = "https://download.jetbrains.com/webstorm/WebStorm-2026.1.2-aarch64.tar.gz";
-      hash = "sha256-Qe9yclQj971jK8V2SL5GAlNpgUfTwP/PS2ILv2LyhuE=";
+      url = "https://download.jetbrains.com/webstorm/WebStorm-2026.1.3-aarch64.tar.gz";
+      hash = "sha256-oZQaxpVV0O4WlDE6Ia+KzHIF0SfWQBubBFIopSRMbvE=";
    };
    x86_64-darwin = {
-      url = "https://download.jetbrains.com/webstorm/WebStorm-2026.1.2.dmg";
-      hash = "sha256-DmsOaBjKnhbipSrIfbTqNd9+qcd2i3zkKfVvLK1GXbI=";
+      url = "https://download.jetbrains.com/webstorm/WebStorm-2026.1.3.dmg";
+      hash = "sha256-KUcQRWYUD/+4HHWnkGuqoltqL2an0WQkUEfUcttwjCI=";
    };
    aarch64-darwin = {
-      url = "https://download.jetbrains.com/webstorm/WebStorm-2026.1.2-aarch64.dmg";
-      hash = "sha256-2YyCHi7yPXnq5KWkqC+Uodnc4xj+DkTsL1vUNqLNmPg=";
+      url = "https://download.jetbrains.com/webstorm/WebStorm-2026.1.3-aarch64.dmg";
+      hash = "sha256-1N1RtN1QLvuJ1QL8jbN5TdbOHAHSN84W9XEK2PEPijI=";
    };
  };
  # update-script-end: urls
@ -39,8 +39,8 @@ mkJetBrainsProduct {
  product = "WebStorm";

  # update-script-start: version
-  version = "2026.1.2";
-  buildNumber = "261.24374.125";
+  version = "2026.1.3";
+  buildNumber = "261.25134.101";
  # update-script-end: version

  src = fetchurl (urls.${system} or (throw "Unsupported system: ${system}"));
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@ -45,11 +45,11 @@
    "vendorHash": "sha256-5IfYhOEhXRpdL7G3Op9a0Ep14el2gwcVmRMkGB7oWH4="
  },
  "aliyun_alicloud": {
-    "hash": "sha256-YmfHL9uCtbxKE1wdacn9gf4Jo85/ivCkxOtMuBQin0I=",
+    "hash": "sha256-dIMlk/ZKIJjrkAk0EGCz3UTZvjbEltWq879331EEMD0=",
    "homepage": "https://registry.terraform.io/providers/aliyun/alicloud",
    "owner": "aliyun",
    "repo": "terraform-provider-alicloud",
-    "rev": "v1.279.0",
+    "rev": "v1.281.0",
    "spdx": "MPL-2.0",
    "vendorHash": "sha256-lBD9ifRpUwg45V7zZG3grHvndG0V42oiX68zgcM7t74="
  },
--- a/pkgs/by-name/al/all-the-package-names/package.nix
+++ b/pkgs/by-name/al/all-the-package-names/package.nix
@ -7,16 +7,16 @@

 buildNpmPackage rec {
  pname = "all-the-package-names";
-  version = "2.0.2460";
+  version = "2.0.2469";

  src = fetchFromGitHub {
    owner = "nice-registry";
    repo = "all-the-package-names";
    tag = "v${version}";
-    hash = "sha256-Sp2I3rukIzvXibd00TqlvuqlZnRGdQNsCiDSv+e38Xc=";
+    hash = "sha256-niA8ruXOnYXrjJcciwtl1oYTuYze7ii78XxBviTJ4LE=";
  };

-  npmDepsHash = "sha256-IHpFhf09+477yvfvoSpzs9WAY8djEXThrM3yUhhNrBQ=";
+  npmDepsHash = "sha256-DXm6gsQltoqo7A2rRwRO6d7XtlHVf1hotAZ1BYvOqSA=";

  passthru.updateScript = nix-update-script { };

--- a/pkgs/by-name/au/audacious-bare/package.nix
+++ b/pkgs/by-name/au/audacious-bare/package.nix
@ -12,13 +12,13 @@

 stdenv.mkDerivation rec {
  pname = "audacious";
-  version = "4.6";
+  version = "4.6.1";

  src = fetchFromGitHub {
    owner = "audacious-media-player";
    repo = "audacious";
    rev = "${pname}-${version}";
-    hash = "sha256-TKzsAroCbeTI2dJdAWJYI/0ocroc1L8CC8ciepfEVMc=";
+    hash = "sha256-f1ugxM57dYDDq/G+16bXs6++KXnaLwT+mcPY0R371tY=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/au/autobrr/package.nix
+++ b/pkgs/by-name/au/autobrr/package.nix
@ -16,12 +16,12 @@

 let
  pname = "autobrr";
-  version = "1.79.0";
+  version = "1.80.0";
  src = fetchFromGitHub {
    owner = "autobrr";
    repo = "autobrr";
    tag = "v${version}";
-    hash = "sha256-grwXIDN+dYuWaArB76N3xJEVwYlrzopYZJQ+eXRwOY4=";
+    hash = "sha256-LWnax0/BNPDZeaH+KG1Fi8qrAvHhr1Oo8XNQWkO5pvM=";
  };

  autobrr-web = stdenvNoCC.mkDerivation {
--- a/pkgs/by-name/ba/basedpyright/package.nix
+++ b/pkgs/by-name/ba/basedpyright/package.nix
@ -18,16 +18,16 @@

 buildNpmPackage rec {
  pname = "basedpyright";
-  version = "1.39.3";
+  version = "1.39.7";

  src = fetchFromGitHub {
    owner = "detachhead";
    repo = "basedpyright";
    tag = "v${version}";
-    hash = "sha256-80RQO0UwDA9ZxIGQ0/8WaEj9QlqrQ4g7m9+WJDZrZbI=";
+    hash = "sha256-E4TR5deuPSf2YinrEzpP79Rq8zZHLJQUKiEsfUdMDOE=";
  };

-  npmDepsHash = "sha256-jut63CiYGTNIP27wYCPZnE/Ab90EWJnVkx58Oy3uo9o=";
+  npmDepsHash = "sha256-humpJB+fv3+PITcPCz3uY2jNANb3P7sXy0lFP8Eg58I=";
  npmWorkspace = "packages/pyright";

  preBuild = ''
--- a/pkgs/by-name/ca/cargo-fuzz/package.nix
+++ b/pkgs/by-name/ca/cargo-fuzz/package.nix
@ -6,16 +6,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cargo-fuzz";
-  version = "0.13.1";
+  version = "0.13.2";

  src = fetchFromGitHub {
    owner = "rust-fuzz";
    repo = "cargo-fuzz";
    tag = finalAttrs.version;
-    hash = "sha256-wOzzPhAuCaJfp7uRZ1kPpzMIr03couRaIbbrjL0EyYo=";
+    hash = "sha256-DIvbxyIkmrxcFOpH0iZJGxJB60Bh5sjZX+kYUxpp/iQ=";
  };

-  cargoHash = "sha256-7HCdWkjIycVKZty760ZnLBtLOZ3gwPhwseIqxqf8xPQ=";
+  cargoHash = "sha256-7P3bii0Y0hf3z9RCPIH6uClFIw/CTtUSzbTbaZNQkYQ=";

  doCheck = false;

--- a/pkgs/by-name/ca/cargo-update/package.nix
+++ b/pkgs/by-name/ca/cargo-update/package.nix
@ -16,14 +16,14 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cargo-update";
-  version = "20.0.0";
+  version = "20.0.1";

  src = fetchCrate {
    inherit (finalAttrs) pname version;
-    hash = "sha256-J/FujtsQF8WfHFoHJ3r2M+vv8WVh4cxDFw07JntnW2g=";
+    hash = "sha256-wV1R95TBPLXzCmE9sjztxJdvwvWxedEQPI5TxZEGUqA=";
  };

-  cargoHash = "sha256-bH8Mg7QQbbXlF7fxwWEFYmYQD1CmDM+g4GhFPZwLy/M=";
+  cargoHash = "sha256-LsqDwGboCPGrRmpFqy13anszrwE8+VoqRqfm5K3VgM8=";

  nativeBuildInputs = [
    cmake
--- a/pkgs/by-name/ch/chromium-xorg-conf/package.nix
+++ b/pkgs/by-name/ch/chromium-xorg-conf/package.nix
@ -1,8 +0,0 @@
-{ fetchFromGitiles }:
-
-fetchFromGitiles {
-  name = "chromium-xorg-conf";
-  url = "https://chromium.googlesource.com/chromiumos/platform/xorg-conf";
-  rev = "26fb9d57e195c7e467616b35b17e2b5d279c1514";
-  sha256 = "0643y3l3hjk4mv4lm3h9z56h990q6k11hcr10lcqppgsii0d3zcf";
-}
--- a/pkgs/by-name/co/conan/package.nix
+++ b/pkgs/by-name/co/conan/package.nix
@ -99,6 +99,8 @@ python3Packages.buildPythonApplication (finalAttrs: {
    "test_xcrun"
    "test_xcrun_in_required_by_tool_requires"
    "test_xcrun_in_tool_requires"
+    # Requires gcc to run
+    "test_qbsprofile_rcflags"
  ];

  disabledTestPaths = [
--- a/pkgs/by-name/de/decent-sampler/package.nix
+++ b/pkgs/by-name/de/decent-sampler/package.nix
@ -4,6 +4,7 @@
  fetchzip,
  fetchurl,
  makeDesktopItem,
+  autoPatchelfHook,
  copyDesktopItems,
  buildFHSEnv,
  alsa-lib,
@ -32,7 +33,15 @@ let
      hash = "sha256-wL9L4I2iw9r3r69TOr37XXEs3iECMuNGX9Ez63P/f8w=";
    };

-    nativeBuildInputs = [ copyDesktopItems ];
+    nativeBuildInputs = [
+      autoPatchelfHook
+      copyDesktopItems
+    ];
+
+    buildInputs = [
+      alsa-lib
+      expat
+    ];

    desktopItems = [
      (makeDesktopItem {
@ -67,13 +76,11 @@ buildFHSEnv {
  inherit (decent-sampler) pname version;

  targetPkgs = pkgs: [
-    alsa-lib
    alsa-plugins
    decent-sampler
    freetype
    nghttp2
    libx11
-    expat
  ];

  runScript = "decent-sampler";
--- a/pkgs/by-name/de/deltachat-desktop/package.nix
+++ b/pkgs/by-name/de/deltachat-desktop/package.nix
@ -22,38 +22,38 @@

 let
  deltachat-rpc-server' = deltachat-rpc-server.overrideAttrs rec {
-    version = "2.51.0";
+    version = "2.52.0";
    src = fetchFromGitHub {
      owner = "chatmail";
      repo = "core";
      tag = "v${version}";
-      hash = "sha256-OXazjp3w4NxbcTUNsyeU46erbdj27n1I7dvt+Io/AZ0=";
+      hash = "sha256-AQo27qnHPCK6q/3+Umk6ueqkOIVBA8n4q9S5iEZ7TkM=";
    };
    cargoDeps = rustPlatform.fetchCargoVendor {
      pname = "chatmail-core";
      inherit version src;
-      hash = "sha256-gt//65v9PF2nnX/zkZGU9hm73lfzOTmw36rbkWu9VX0=";
+      hash = "sha256-ni8iaVPHXWhxfiBvtVzGRyPcxkbV0HiqcQCHGmAqk7s=";
    };
  };
  electron = electron_41;
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "deltachat-desktop";
-  version = "2.51.0";
+  version = "2.52.0";
  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "deltachat";
    repo = "deltachat-desktop";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-ORp8lZcHzswrSCe30cGKpZdyqZCcvqLgu2hwvadMHN0=";
+    hash = "sha256-/FdGI6Dr9lz0+g/xSzHXbMdqWHf4TliHDXXiAQKKkOs=";
  };

  pnpmDeps = fetchPnpmDeps {
    inherit (finalAttrs) pname version src;
    pnpm = pnpm_10;
    fetcherVersion = 4;
-    hash = "sha256-BSDeOkT75usLmXdAY8QNO+9YxxchrJH2gjFpTzErPXo=";
+    hash = "sha256-0VvyZzWAdVGsuYb8CI36KqkqvjgRsTLJov1L44MxUHQ=";
  };

  strictDeps = true;
--- a/pkgs/by-name/de/deltachat-tauri/package.nix
+++ b/pkgs/by-name/de/deltachat-tauri/package.nix
@ -35,7 +35,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    ;
  __structuredAttrs = true;

-  cargoHash = "sha256-JhsoIQZrU4GVcs/TCIug6y/84gODyEWl0Bl2jRNxL5Y=";
+  cargoHash = "sha256-euRUA4LTmAdb9466DAMqKgAPX3N4KNXCh1ED9cL42lA=";

  postPatch = lib.optionalString stdenv.hostPlatform.isLinux ''
    substituteInPlace $cargoDepsCopy/*/libappindicator-sys-*/src/lib.rs \
--- a/pkgs/by-name/du/dusklight/package.nix
+++ b/pkgs/by-name/du/dusklight/package.nix
@ -26,6 +26,7 @@
  makeWrapper,
  ninja,
  nlohmann_json,
+  nodtool,
  pkg-config,
  python3,
  sdl3,
@ -40,19 +41,25 @@ let
  auroraSrc = fetchFromGitHub {
    owner = "encounter";
    repo = "aurora";
-    rev = "10006618ee493f248b8597e4dfa1d2871d76a1d9";
-    hash = "sha256-lY2xuVyB7aPJ9+2wwLRB3F5U/BuPSxdSpegdG+qNd9o=";
-  };
-  dawnSrc = fetchzip {
-    url = "https://github.com/encounter/dawn-build/releases/download/v20260423.175430/dawn-linux-x86_64.tar.gz";
-    hash = "sha256-HXfKTLHtMPwupnFnaflCARtXVPuS/0PoCePXidjE5xs=";
-    stripRoot = false;
-  };
-  nodSrc = fetchzip {
-    url = "https://github.com/encounter/nod/releases/download/v2.0.0-alpha.8/libnod-linux-x86_64.tar.gz";
-    hash = "sha256-mUqvLsbsqaZ+HAjMmHYPYO+MgtanGRTw7Gzn5uXR5rE=";
-    stripRoot = false;
+    rev = "cb2c340d6cde6827387f14c31ce19e5f28a40e09";
+    hash = "sha256-fiAe5DChCFeakI3pga/g0tXd27osnhQtMBQchuP2NwQ=";
  };
+  dawnSrc = fetchzip (
+    {
+      x86_64-linux = {
+        url = "https://github.com/encounter/dawn-build/releases/download/v20260523.201736/dawn-linux-x86_64.tar.gz";
+        hash = "sha256-KkdlSeiaw2gbQa+phZOpgbequshxQaFITzFdiuGBZvc=";
+      };
+      aarch64-linux = {
+        url = "https://github.com/encounter/dawn-build/releases/download/v20260523.201736/dawn-linux-aarch64.tar.gz";
+        hash = "sha256-accDTIBzgByQ8Rk2a1dAm85s8hj9SYI7NoHkih0vvAg=";
+      };
+    }
+    .${stdenv.hostPlatform.system}
+    // {
+      stripRoot = false;
+    }
+  );
  imguiSrc = fetchFromGitHub {
    owner = "ocornut";
    repo = "imgui";
@ -70,13 +77,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "dusklight";
-  version = "1.2.0";
+  version = "1.3.1";

  src = fetchFromGitHub {
    owner = "TwilitRealm";
    repo = "dusklight";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-a5nCri4XTpnotJY9qRrKTJ8cb9L6cfGKPXmvbbj/1fQ=";
+    hash = "sha256-TarPuCE6bjn4nGtHU54pE2gAo/dIgTyghWn7hjdFFgk=";
  };

  strictDeps = true;
@ -111,6 +118,7 @@ stdenv.mkDerivation (finalAttrs: {
    libxscrnsaver
    libxtst
    nlohmann_json
+    nodtool
    sdl3
    tracy
    vulkan-loader
@ -138,14 +146,14 @@ stdenv.mkDerivation (finalAttrs: {
    (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_XXHASH" xxhash.src.outPath)
    (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_FMT" fmt.src.outPath)
    (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_TRACY" tracy.src.outPath)
-    (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_NOD_PREBUILT" nodSrc.outPath)
    (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_FREETYPE" freetype.src.outPath)
    (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_ZSTD" zstd.src.outPath)
    (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_SQLITE3" sqliteSrc.outPath)
    (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_IMGUI" imguiSrc.outPath)
    (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_RMLUI" rmluiSrc.outPath)
    (lib.cmakeFeature "AURORA_SDL3_PROVIDER" "system")
-    (lib.cmakeFeature "AURORA_NOD_PROVIDER" "package")
+    (lib.cmakeFeature "AURORA_NOD_PROVIDER" "system")
+    (lib.cmakeFeature "AURORA_NOD_LINKAGE" "static")
    (lib.cmakeBool "CMAKE_CROSSCOMPILING" true)
    (lib.cmakeBool "DUSK_ENABLE_SENTRY_NATIVE" false)
  ];
@ -159,16 +167,13 @@ stdenv.mkDerivation (finalAttrs: {
    ln -s ../share/dusklight/dusklight   $out/bin/dusklight

    install -Dm644 \
-      ../platforms/freedesktop/dusklight.desktop \
-      $out/share/applications/dusklight.desktop
-
-    substituteInPlace $out/share/applications/dusklight.desktop \
-      --replace-fail "Icon=dusklight" "Icon=dev.twilitrealm.dusklight"
+      ../platforms/freedesktop/dev.twilitrealm.dusk.desktop \
+      $out/share/applications/dev.twilitrealm.dusk.desktop

    for size in 16x16 32x32 48x48 64x64 128x128 256x256 512x512 1024x1024; do
      install -Dm644 \
-        ../platforms/freedesktop/$size/apps/dusklight.png \
-        $out/share/icons/hicolor/$size/apps/dev.twilitrealm.dusklight.png
+        ../platforms/freedesktop/$size/apps/dev.twilitrealm.dusk.png \
+        $out/share/icons/hicolor/$size/apps/dev.twilitrealm.dusk.png
    done

    runHook postInstall
@ -193,7 +198,7 @@ stdenv.mkDerivation (finalAttrs: {
    changelog = "https://github.com/TwilitRealm/dusklight/releases/tag/v${finalAttrs.version}";
    license = lib.licenses.cc0;
    mainProgram = "dusklight";
-    platforms = [ "x86_64-linux" ];
+    platforms = lib.platforms.linux;
    maintainers = with lib.maintainers; [ liberodark ];
  };
 })
--- a/pkgs/by-name/et/ethercat/kernel-module.nix
+++ b/pkgs/by-name/et/ethercat/kernel-module.nix
@ -0,0 +1,70 @@
+ethercat:
+{
+  lib,
+  stdenv,
+  kernelModuleMakeFlags,
+  kernel,
+}:
+let
+  # Aside from a generic drivers there are special drivers for specific NICs
+  # (for example r8139, r8169, e100, e1000, e1000e) which are only available
+  # for these kernel versions
+  extraSupportedKernel = lib.elem (lib.versions.majorMinor kernel.version) [
+    "5.10"
+    "5.14"
+    "5.15"
+    "6.1"
+    "6.4"
+    "6.12"
+  ];
+in
+stdenv.mkDerivation {
+  pname = "ethercat";
+  version = "${kernel.version}-${ethercat.version}";
+
+  __structuredAttrs = true;
+
+  enableParallelBuilding = true;
+
+  inherit (ethercat) src;
+
+  nativeBuildInputs = kernel.moduleBuildDependencies ++ ethercat.nativeBuildInputs;
+
+  configureFlags = [
+    "--with-linux-dir=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+    "--enable-userlib=no"
+    "--enable-tool=no"
+    "--enable-kernel=yes"
+    "--enable-ccat=yes"
+  ]
+  ++ lib.optionals extraSupportedKernel [
+    "--enable-e100=yes"
+    "--enable-e1000=yes"
+    "--enable-e1000e=yes"
+    "--enable-r8169=yes"
+    "--enable-igb=yes"
+  ]
+  ++ lib.optionals (extraSupportedKernel && lib.versionAtLeast kernel.version "5.14") [
+    "--enable-igc=yes"
+  ];
+
+  makeFlags = kernelModuleMakeFlags ++ [
+    "INSTALL_MOD_PATH=${placeholder "out"}"
+  ];
+
+  buildFlags = [ "modules" ];
+
+  installTargets = [ "modules_install" ];
+
+  meta = {
+    description = ethercat.meta.description + " - kernel modules";
+
+    inherit (ethercat.meta)
+      homepage
+      changelog
+      license
+      maintainers
+      platforms
+      ;
+  };
+}
--- a/pkgs/by-name/et/ethercat/package.nix
+++ b/pkgs/by-name/et/ethercat/package.nix
@ -29,14 +29,23 @@ stdenv.mkDerivation (finalAttrs: {
    "--enable-kernel=no"
  ];

-  passthru.updateScript = gitUpdater { };
+  passthru = {
+    kernelModule = import ./kernel-module.nix finalAttrs.finalPackage;
+    updateScript = gitUpdater { };
+  };

  meta = {
    description = "IgH EtherCAT Master for Linux";
    homepage = "https://etherlab.org/ethercat";
    changelog = "https://gitlab.com/etherlab.org/ethercat/-/blob/${finalAttrs.version}/NEWS";
-    license = lib.licenses.gpl2Plus;
-    maintainers = with lib.maintainers; [ stv0g ];
+    license = with lib.licenses; [
+      gpl2Only
+      lgpl21Only
+    ];
+    maintainers = with lib.maintainers; [
+      ninelore
+      stv0g
+    ];
    platforms = [ "x86_64-linux" ];
  };
 })
--- a/pkgs/by-name/fl/fltrdr/package.nix
+++ b/pkgs/by-name/fl/fltrdr/package.nix
@ -3,19 +3,26 @@
  stdenv,
  fetchFromGitHub,
  cmake,
-  icu,
+  icu63,
  openssl,
 }:

-stdenv.mkDerivation rec {
+let
+  icu = icu63;
+in
+
+stdenv.mkDerivation (finalAttrs: {
  pname = "fltrdr";
  version = "0.3.1";

+  strictDeps = true;
+  __structuredAttrs = true;
+
  src = fetchFromGitHub {
    repo = "fltrdr";
    owner = "octobanana";
-    rev = version;
-    sha256 = "1vpci7vqzcpdd21zgigyz38k77r9fc81dmiwsvfr8w7gad5sg6sj";
+    tag = finalAttrs.version;
+    hash = "sha256-UpunS1PvcJTd1jzWFhBzKZ8z0fj+xfeDaO2yj/eJ7O4=";
  };

  nativeBuildInputs = [ cmake ];
@ -48,4 +55,4 @@ stdenv.mkDerivation rec {
    maintainers = [ lib.maintainers.matthiasbeyer ];
    mainProgram = "fltrdr";
  };
-}
+})
--- a/pkgs/by-name/fo/forgejo/package.nix
+++ b/pkgs/by-name/fo/forgejo/package.nix
@ -1,8 +1,8 @@
 import ./generic.nix {
-  version = "15.0.2";
-  hash = "sha256-ba5jog6eXY4TTmBblhfVa2LSLPGE1/HPfslIb30b3kk=";
-  npmDepsHash = "sha256-70w39jbMWpuAsbzBC9oFHaUMwshtFDeTSEOXDgFNPmE=";
-  vendorHash = "sha256-I6bGvXBP2K3+Xx9E9DS/AyG6Ilqf/s8VjfBnCmLUHsk=";
+  version = "15.0.3";
+  hash = "sha256-tGZ83TEG6iyZd5mfSuSvVkmUJINWLN661YpOk1+dgbM=";
+  npmDepsHash = "sha256-BZSYjEsjUqMYWu3EUP+K35hqSOniv8Y6ek5bEC2vTPg=";
+  vendorHash = "sha256-z3YTjt+SM9yPCsJdfSQbTpy3vRiXaFV2QMz1y6J6k/Q=";
  lts = true;
  nixUpdateExtraArgs = [
    "--override-filename"
--- a/pkgs/by-name/gh/ghqr/package.nix
+++ b/pkgs/by-name/gh/ghqr/package.nix
@ -10,14 +10,14 @@

 buildGoModule (finalAttrs: {
  pname = "ghqr";
-  version = "0.4.2";
+  version = "0.4.3";
  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "microsoft";
    repo = "ghqr";
    tag = "v.${finalAttrs.version}";
-    hash = "sha256-goxKU48fWdCQo0Vng0O3gvRFXsDbuWA/03UH1qUbqrw=";
+    hash = "sha256-KKuxl8odNdMom8l524Mac+sM/5ZdtpakLqazZDQcXJs=";
  };

  vendorHash = "sha256-la/yXEZzAIt9l0q0P7+N8yCW0BQie9sLmAhLFK1qyGE=";
--- a/pkgs/by-name/gi/git-town/package.nix
+++ b/pkgs/by-name/gi/git-town/package.nix
@ -13,13 +13,13 @@

 buildGoModule (finalAttrs: {
  pname = "git-town";
-  version = "23.0.1";
+  version = "23.0.2";

  src = fetchFromGitHub {
    owner = "git-town";
    repo = "git-town";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-kAAzfb0rg10k9PnUKYEqdSWYWi0JR6jiKDHUv/RSUSs=";
+    hash = "sha256-FwwyX/Ncl8zCR1+/A49VIugESU1YFgDcQYbO8w84Lm0=";
  };

  vendorHash = null;
--- a/pkgs/by-name/gp/gping/package.nix
+++ b/pkgs/by-name/gp/gping/package.nix
@ -3,6 +3,7 @@
  stdenv,
  rustPlatform,
  fetchFromGitHub,
+  fetchpatch,
  installShellFiles,
  iputils,
  versionCheckHook,
@ -22,6 +23,15 @@ rustPlatform.buildRustPackage (finalAttrs: {

  cargoHash = "sha256-F0QBL7tCCdjnavClqrw8yYxFrY8y4f8h/gcHSpEqBiM=";

+  patches = [
+    (fetchpatch {
+      name = "fix-ipv6-addrs-by-using-ping-dash-6.patch";
+      # https://github.com/orf/gping/pull/546
+      url = "https://github.com/orf/gping/commit/7ef8e1ddec847681c5ef3d4a010a0ad3a7aebab0.patch";
+      hash = "sha256-b3Nv+mobPUcgREaNvn7cXra24PgEUe60yE/kOPTQEos=";
+    })
+  ];
+
  nativeBuildInputs = [ installShellFiles ];

  nativeCheckInputs = lib.optionals stdenv.hostPlatform.isLinux [ iputils ];
--- a/pkgs/by-name/in/inxi/package.nix
+++ b/pkgs/by-name/in/inxi/package.nix
@ -109,7 +109,9 @@ stdenv.mkDerivation (finalAttrs: {
    changelog = "https://codeberg.org/smxi/inxi/src/tag/${finalAttrs.version}/inxi.changelog";
    license = lib.licenses.gpl3Plus;
    platforms = lib.platforms.unix;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [
+      nick-linux
+    ];
    mainProgram = "inxi";
  };
 })
--- a/pkgs/by-name/it/it-tools/package.nix
+++ b/pkgs/by-name/it/it-tools/package.nix
@ -3,36 +3,36 @@
  lib,
  fetchFromGitHub,
  nodejs,
-  pnpm_8,
+  pnpm_11,
  fetchPnpmDeps,
  pnpmConfigHook,
 }:
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "it-tools";
-  version = "2024.10.22-7ca5933";
+  version = "0-unstable-2026-02-12";

  src = fetchFromGitHub {
    owner = "CorentinTh";
    repo = "it-tools";
-    rev = "v${version}";
-    hash = "sha256-SQAZv+9tINRH10lewcuv8G2qwfulLOP8sGjX47LxeUk=";
+    rev = "d505845f918e946ec300af7b36efc107e2f66e9e";
+    hash = "sha256-dWVRiLbJ1X4yHT5yRcq+KaHmjjtc24yQg0jQvWTPNwU=";
  };

  nativeBuildInputs = [
    nodejs
    pnpmConfigHook
-    pnpm_8
+    pnpm_11
  ];

  pnpmDeps = fetchPnpmDeps {
-    inherit
+    inherit (finalAttrs)
      pname
      version
      src
      ;
-    pnpm = pnpm_8;
-    fetcherVersion = 3;
-    hash = "sha256-dsjf2TyLAqPzR8OXJgNcoOdDZj2t+H+tLfRhfPsu1G8=";
+    pnpm = pnpm_11;
+    fetcherVersion = 4;
+    hash = "sha256-ju8YO0IHIGJtCi5TnxvfLUXcTqKWnTBKAGFBhzQJTok=";
  };

  buildPhase = ''
@ -58,4 +58,4 @@ stdenv.mkDerivation rec {
    license = lib.licenses.gpl3Only;
    maintainers = with lib.maintainers; [ akotro ];
  };
-}
+})
--- a/pkgs/by-name/iv/ivpn-service/package.nix
+++ b/pkgs/by-name/iv/ivpn-service/package.nix
@ -13,13 +13,16 @@
  iptables,
  gawk,
  util-linux,
-  nix-update-script,
+  liboqs,
 }:
 buildGoModule (finalAttrs: {
  pname = "ivpn-service";
  version = "3.15.6";

-  buildInputs = [ wirelesstools ];
+  buildInputs = [
+    wirelesstools
+    (finalAttrs.passthru.liboqs)
+  ];
  nativeBuildInputs = [ makeWrapper ];

  src = fetchFromGitHub {
@ -62,7 +65,9 @@ buildGoModule (finalAttrs: {
      --replace-fail 'dnscryptproxyBinPath = path.Join(installDir, "dnscrypt-proxy/dnscrypt-proxy")' \
      'dnscryptproxyBinPath = "${dnscrypt-proxy}/bin/dnscrypt-proxy"' \
      --replace-fail 'v2rayBinaryPath = path.Join(installDir, "v2ray/v2ray")' \
-      'v2rayBinaryPath = "${v2ray}/bin/v2ray"'
+      'v2rayBinaryPath = "${v2ray}/bin/v2ray"' \
+      --replace-fail 'kemHelperBinaryPath = path.Join(installDir, "kem/kem-helper")' \
+      'kemHelperBinaryPath = "${placeholder "out"}/bin/kem-helper"'
  '';

  ldflags = [
@ -72,8 +77,17 @@ buildGoModule (finalAttrs: {
    "-X github.com/ivpn/desktop-app/daemon/version._time=1970-01-01"
  ];

+  postBuild = ''
+    $CC -O2 -pthread \
+        References/common/kem-helper/main.c \
+        References/common/kem-helper/base64.c \
+        -loqs -Wl,-z,stack-size=5242880 \
+        -o kem-helper
+  '';
+
  postInstall = ''
    mv $out/bin/{daemon,ivpn-service}
+    install -Dm755 kem-helper $out/bin/kem-helper
  '';

  postFixup = ''
@ -94,7 +108,34 @@ buildGoModule (finalAttrs: {
      }
  '';

-  passthru.updateScript = nix-update-script { };
+  # IVPN pins this to an older incompatible version, so we vendor it at that
+  # Lives in passthru so end-users can override it
+  passthru.liboqs = liboqs.overrideAttrs (
+    final: prev: {
+      version = "0.10.0";
+      src = fetchFromGitHub {
+        owner = "open-quantum-safe";
+        repo = "liboqs";
+        tag = "${final.version}";
+        hash = "sha256-BFDa5NUr02lFPcT4Hnb2rjGAi+2cXvh1SHLfqX/zLlI=";
+      };
+      # the main derivations patches don't apply onto the older version
+      patches = [ ];
+      # manually do what the main derivations pkg-config patch does (unbreak invalid path)
+      postPatch = ''
+        substituteInPlace src/liboqs.pc.in \
+          --replace-fail 'libdir=''${prefix}/@CMAKE_INSTALL_LIBDIR@' \
+          'libdir=@CMAKE_INSTALL_FULL_LIBDIR@' \
+          --replace-fail 'includedir=''${prefix}/@CMAKE_INSTALL_INCLUDEDIR@' \
+          'includedir=@CMAKE_INSTALL_FULL_INCLUDEDIR@'
+      '';
+      # This matches IVPNs build script at $src/daemon/References/common/kem-helper/build.sh
+      cmakeFlags = (prev.cmakeFlags or [ ]) ++ [
+        "-DOQS_USE_OPENSSL=OFF"
+        "-DOQS_MINIMAL_BUILD=KEM_kyber_1024;KEM_classic_mceliece_348864"
+      ];
+    }
+  );

  meta = {
    description = "Official IVPN Desktop app service daemon";
--- a/pkgs/by-name/la/ladybugdb/package.nix
+++ b/pkgs/by-name/la/ladybugdb/package.nix
@ -10,13 +10,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "ladybugdb";
-  version = "0.17.0";
+  version = "0.17.1";

  src = fetchFromGitHub {
    owner = "LadybugDB";
    repo = "ladybug";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-58Wx3QtDS1PSLjuyZ36u3Tq7kiQj+zFxfsMiCJyDUU4=";
+    hash = "sha256-3d0gsSLkO5Np6P4l8AEfEPvzMlkf2wYMCluAtDrwEDc=";
  };

  outputs = [
--- a/pkgs/by-name/la/lammps/package.nix
+++ b/pkgs/by-name/la/lammps/package.nix
@ -52,10 +52,13 @@ stdenv.mkDerivation (finalAttrs: {
  version = "22Jul2025_update4";
  pname = "lammps";

+  __structuredAttrs = true;
+  strictDeps = true;
+
  src = fetchFromGitHub {
    owner = "lammps";
    repo = "lammps";
-    rev = "stable_${finalAttrs.version}";
+    tag = "stable_${finalAttrs.version}";
    hash = "sha256-QH63nh7J3NjfdfpN7J96Q+9ZGqj8cA0YwEmgTuBbGmg=";
  };
  preConfigure = ''
@ -67,7 +70,8 @@ stdenv.mkDerivation (finalAttrs: {
    # Although not always needed, it is needed if cmakeFlags include
    # GPU_API=cuda, and it doesn't users that don't enable the GPU package.
    autoAddDriverRunpath
-  ];
+  ]
+  ++ lib.optionals packages.PYTHON [ python3 ];

  passthru = {
    inherit packages;
--- a/pkgs/by-name/mu/mullvad-vpn/package.nix
+++ b/pkgs/by-name/mu/mullvad-vpn/package.nix
@ -40,6 +40,7 @@
  makeWrapper,
  coreutils,
  gnugrep,
+  iproute2,

  versionCheckHook,
 }:
@ -119,6 +120,7 @@ stdenv.mkDerivation (finalAttrs: {

  runtimeDependencies = [
    (lib.getLib systemd)
+    iproute2
    libGL
    libnotify
    libappindicator
--- a/pkgs/by-name/my/mympd/package.nix
+++ b/pkgs/by-name/my/mympd/package.nix
@ -18,13 +18,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "mympd";
-  version = "25.1.0";
+  version = "25.1.1";

  src = fetchFromGitHub {
    owner = "jcorporation";
    repo = "myMPD";
    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-YX9nN4NxD/NrkTlVSxUrQ1ur67Rk2hfM9ZXDjnpoLGk=";
+    sha256 = "sha256-ckGFwnykpmA753bAoCX8ftUEZuxtFlyGTamn4cgK3+A=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/n8/n8n/package.nix
+++ b/pkgs/by-name/n8/n8n/package.nix
@ -26,20 +26,20 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "n8n";
-  version = "2.22.5";
+  version = "2.23.4";

  src = fetchFromGitHub {
    owner = "n8n-io";
    repo = "n8n";
    tag = "n8n@${finalAttrs.version}";
-    hash = "sha256-YF6VJLA+y8pcAE3RwTub1XjPVfeh8cR+3TQqb3VvV5U=";
+    hash = "sha256-0LROPZKLKEKHBgV0kWAfataZB2nMzdsmq1WImCA6bgA=";
  };

  pnpmDeps = fetchPnpmDeps {
    inherit (finalAttrs) pname version src;
    pnpm = pnpm_10;
    fetcherVersion = 3;
-    hash = "sha256-lAe3GuZRdzEwOXWmpBtF7YfGvA4XJumLf80uDYS6j30=";
+    hash = "sha256-oqnLywIOhAZr7nmeGvq6k0brcGjHRhR3pVvBQK3Fg0k=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/ni/nickel/package.nix
+++ b/pkgs/by-name/ni/nickel/package.nix
@ -14,16 +14,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "nickel";
-  version = "1.16.0";
+  version = "1.17.0";

  src = fetchFromGitHub {
    owner = "nickel-lang";
    repo = "nickel";
    tag = finalAttrs.version;
-    hash = "sha256-G+ik4tMr+WsDpiEFYv80ruBR/SpeEg9agUWqgXrq7UI=";
+    hash = "sha256-D+OI00Ouwm0v65igIYSCGPXKCl6/SZsOyz1wFM1VAF4=";
  };

-  cargoHash = "sha256-E3UBkLxd7AC/Pk1Zgy+KvHTPXgATqIr7lZXPB8vlSWs=";
+  cargoHash = "sha256-hIeTHajL+h6xhuje8TmfgkkM9R+tGwYFzlnSwaN3nK8=";

  cargoBuildFlags = [
    "--package"
--- a/pkgs/by-name/no/nodtool/package.nix
+++ b/pkgs/by-name/no/nodtool/package.nix
@ -0,0 +1,97 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  rustPlatform,
+  cmake,
+  git,
+  versionCheckHook,
+  nix-update-script,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "nodtool";
+  version = "2.0.0-alpha.9";
+
+  src = fetchFromGitHub {
+    owner = "encounter";
+    repo = "nod";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-beWw+OgF4zCepv/7NQiwXOA8qMwMb8Z3C6icywT+Jr0=";
+  };
+
+  cargoHash = "sha256-+B7mjiCtuxPQ/zSMy8Lw6r5aGB+PVxhRES6zJhD5NAE=";
+
+  nativeBuildInputs = [
+    cmake
+    git
+  ];
+
+  cargoBuildFlags = [
+    "-p"
+    "nodtool"
+    "-p"
+    "nod-ffi"
+  ];
+
+  cargoTestFlags = [
+    "-p"
+    "nodtool"
+    "-p"
+    "nod-ffi"
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    releaseDir="target/${stdenv.hostPlatform.config}/release"
+
+    install -Dm755 $releaseDir/nodtool -t $out/bin/
+    install -Dm755 $releaseDir/libnod${stdenv.hostPlatform.extensions.sharedLibrary} -t $out/lib/
+    install -Dm644 $releaseDir/libnod.a -t $out/lib/
+    install -Dm644 nod-ffi/include/nod.h -t $out/include/
+
+    cat > gen-cmake-config.cmake <<'EOF'
+    include(CMakePackageConfigHelpers)
+    set(CMAKE_INSTALL_LIBDIR lib)
+    set(CMAKE_INSTALL_INCLUDEDIR include)
+    set(CMAKE_INSTALL_BINDIR bin)
+    configure_package_config_file("''${NOD_SOURCE_DIR}/cmake/nodConfig.cmake.in" "''${CMAKE_INSTALL_PREFIX}/lib/cmake/nod/nodConfig.cmake" INSTALL_DESTINATION lib/cmake/nod)
+    write_basic_package_version_file("''${CMAKE_INSTALL_PREFIX}/lib/cmake/nod/nodConfigVersion.cmake" VERSION "''${NOD_VERSION}" COMPATIBILITY AnyNewerVersion)
+    EOF
+
+    cmake \
+      ${lib.cmakeFeature "NOD_SOURCE_DIR" "$PWD"} \
+      ${lib.cmakeFeature "CMAKE_INSTALL_PREFIX" "$out"} \
+      ${lib.cmakeFeature "NOD_VERSION" "2.0.0"} \
+      -P gen-cmake-config.cmake
+
+    runHook postInstall
+  '';
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
+
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "GameCube/Wii disc image CLI tool and C library";
+    homepage = "https://github.com/encounter/nod";
+    changelog = "https://github.com/encounter/nod/releases/tag/v${finalAttrs.version}";
+    license = with lib.licenses; [
+      asl20
+      mit
+    ];
+    maintainers = with lib.maintainers; [ liberodark ];
+    platforms = lib.platforms.linux;
+    mainProgram = "nodtool";
+  };
+})
--- a/pkgs/by-name/pl/playwright-mcp/package.nix
+++ b/pkgs/by-name/pl/playwright-mcp/package.nix
@ -2,40 +2,34 @@
  lib,
  buildNpmPackage,
  fetchFromGitHub,
+  makeWrapper,
  playwright-driver,
  playwright-test,
 }:
 buildNpmPackage rec {
  pname = "playwright-mcp";
-  version = "0.0.69";
+  version = "0.0.74";

  src = fetchFromGitHub {
    owner = "Microsoft";
    repo = "playwright-mcp";
    tag = "v${version}";
-    hash = "sha256-zX9RsHVInRib69N4LkG3R4TB5qjlBirpu9BBftcr92I=";
+    hash = "sha256-dGYZTBPNszVtxvYWTIF77dDm9elGvcLwbn+yG/lfR68=";
  };

-  npmDepsHash = "sha256-hc5AkUTGoXxXlDW9vPpiO23QOgANJp1lX4xoaySHoK4=";
+  npmDepsHash = "sha256-IgoflKLyY4plURB++N4YSzqfG4Y7aGSUvND+WiHYiQo=";

-  npmWorkspace = "packages/playwright-mcp";
+  nativeBuildInputs = [ makeWrapper ];

  # Codex MCP smoke test (after `codex mcp add playwright-nix --env DISPLAY=:0 -- $out/bin/playwright-mcp --headless --isolated`):
  # timeout 45s codex exec --dangerously-bypass-approvals-and-sandbox --skip-git-repo-check "Use only playwright-nix MCP tools. Navigate to https://example.com and return only the page title."
  postInstall = ''
-    pkg_dir="$out/lib/node_modules/playwright-mcp-internal"
+    pkg_dir="$out/lib/node_modules/@playwright/mcp"
    rm -rf "$pkg_dir/node_modules/playwright"
    rm -rf "$pkg_dir/node_modules/playwright-core"
    ln -s ${playwright-test}/lib/node_modules/playwright "$pkg_dir/node_modules/playwright"
    ln -s ${playwright-test}/lib/node_modules/playwright-core "$pkg_dir/node_modules/playwright-core"

-    # Workspace symlinks point to a packages/ tree that npmInstallHook does not
-    # ship; npm hoisted the workspace contents directly into playwright-mcp-internal.
-    rm "$pkg_dir/node_modules/@playwright/mcp"
-    rm "$pkg_dir/node_modules/@playwright/mcp-extension"
-    rm "$pkg_dir/node_modules/playwright-cli"
-    rm "$pkg_dir/node_modules/.bin/playwright-mcp"
-
    wrapProgram $out/bin/playwright-mcp \
      --set PLAYWRIGHT_BROWSERS_PATH ${playwright-driver.browsers} \
      --set-default PLAYWRIGHT_MCP_BROWSER chromium
--- a/pkgs/by-name/po/pocket-id/package.nix
+++ b/pkgs/by-name/po/pocket-id/package.nix
@ -13,18 +13,18 @@
 }:
 buildGo126Module (finalAttrs: {
  pname = "pocket-id";
-  version = "2.7.0";
+  version = "2.8.0";

  src = fetchFromGitHub {
    owner = "pocket-id";
    repo = "pocket-id";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-rWU1jldmdtXDcHrFty/Pmll1xFUQnLFF12j833M05rQ=";
+    hash = "sha256-mUBCX2FP/ieDCeqQwtAFmR3dKr8P5bGv8K3+f9ULhZM=";
  };

  sourceRoot = "${finalAttrs.src.name}/backend";

-  vendorHash = "sha256-nr9L7FVUQYzn+bLtvqKGsYydVCjW/fl53Od9lzRv8gk=";
+  vendorHash = "sha256-QJyy39v4+4+hJO14p6QjgUeHs3t5EXuqCHM/d91jKsM=";

  env.CGO_ENABLED = 0;
  ldflags = [
@ -65,7 +65,7 @@ buildGo126Module (finalAttrs: {
      inherit (finalAttrs) pname version src;
      pnpm = pnpm_10;
      fetcherVersion = 3;
-      hash = "sha256-DVNzFFHMMasKEx+adAhisE32qtirBhJlfMHKrOVl1dM=";
+      hash = "sha256-vohVXJWPQA/29ntx4hY1eTDHuTGx5UuYymQH02Ufd/Y=";
    };

    env.BUILD_OUTPUT_PATH = "dist";
--- a/pkgs/by-name/po/podofo/package.nix
+++ b/pkgs/by-name/po/podofo/package.nix
@ -16,13 +16,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "podofo";
-  version = "1.1.0";
+  version = "1.1.1";

  src = fetchFromGitHub {
    owner = "podofo";
    repo = "podofo";
    rev = finalAttrs.version;
-    hash = "sha256-gzkIMyGV3nmOrGX2PDLrA9NHbtAwk74vcyrQ+yc5TOw=";
+    hash = "sha256-y+3nOynd0xJRF14XA1oK2smL6irCfaFrJ8rvxJS6b8M=";
  };

  outputs = [
--- a/pkgs/by-name/po/poezio/package.nix
+++ b/pkgs/by-name/po/poezio/package.nix
@ -8,14 +8,14 @@

 python3.pkgs.buildPythonApplication (finalAttrs: {
  pname = "poezio";
-  version = "0.16";
+  version = "0.18";
  pyproject = true;

  src = fetchFromCodeberg {
    owner = "poezio";
    repo = "poezio";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-bpudgf9oZ+7w7izAuWYKFVO9CIHraHaGvRKLDuSIF7c=";
+    hash = "sha256-/QGxJrWK8Sl+t8SBsU8ZAMU/5pR+daf7Q43jczzENmw=";
  };

  nativeBuildInputs = [ pkg-config ];
--- a/pkgs/by-name/re/resterm/package.nix
+++ b/pkgs/by-name/re/resterm/package.nix
@ -8,13 +8,13 @@

 buildGoModule (finalAttrs: {
  pname = "resterm";
-  version = "0.41.1";
+  version = "0.42.1";

  src = fetchFromGitHub {
    owner = "unkn0wn-root";
    repo = "resterm";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-PSWgbq1aV+9AEhAXL3gZGKh6BzKc5CxufLTp80T0Tno=";
+    hash = "sha256-NyUSV5vsksr9LgwcN6f4f+1ol3304l0SalHzRI9R5mQ=";
  };

  vendorHash = "sha256-AjckKD6NScBa8w9nWMdVExuNadz3vHnK854XXg3nj84=";
--- a/pkgs/by-name/rs/rs-lxmf/package.nix
+++ b/pkgs/by-name/rs/rs-lxmf/package.nix
@ -0,0 +1,43 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  rs-reticulum,
+  versionCheckHook,
+  nix-update-script,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "rs-lxmf";
+  version = "0.9.2";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "ratspeak";
+    repo = "rsLXMF";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-jba/uiQQUO3MdmF2+6AOtdbUXYW43yqplRFUGujN0Oo=";
+  };
+
+  postPatch = ''
+    for crate in rns-crypto rns-wire rns-identity rns-link rns-protocol rns-transport rns-runtime rns-interface; do
+      substituteInPlace Cargo.toml \
+        --replace-fail "../rsReticulum/crates/$crate" "${rs-reticulum.src}/crates/$crate"
+    done
+  '';
+
+  cargoHash = "sha256-ReWw16r9cYIEzilzSsFXYap9ZGhk1mrUVl/bKkQMcVA=";
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Rust implementation of LXMF for Reticulum";
+    homepage = "https://github.com/ratspeak/rsLXMF";
+    license = lib.licenses.agpl3Only;
+    maintainers = with lib.maintainers; [ drupol ];
+    mainProgram = "lxmd-rs";
+  };
+})
--- a/pkgs/by-name/sq/sqlx-cli/package.nix
+++ b/pkgs/by-name/sq/sqlx-cli/package.nix
@ -2,7 +2,7 @@
  stdenv,
  lib,
  rustPlatform,
-  fetchFromGitHub,
+  fetchCrate,
  installShellFiles,
  pkg-config,
  openssl,
@ -14,16 +14,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "sqlx-cli";
-  version = "0.8.6";
+  version = "0.9.0";

-  src = fetchFromGitHub {
-    owner = "launchbadge";
-    repo = "sqlx";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-Trnyrc17KWhX8QizKyBvXhTM7HHEqtywWgNqvQNMOAY=";
+  # Upstream stopped shipping a Cargo.lock starting with the v0.9.0 release
+  # https://github.com/transact-rs/sqlx/blob/v0.9.0/CHANGELOG.md#cargolock-removed-from-tracking
+  src = fetchCrate {
+    inherit (finalAttrs) pname version;
+    hash = "sha256-XariusjsCgn0Qai0XWtr7EzSzDDTp1cCzjff1kJNO9Y=";
  };

-  cargoHash = "sha256-FxvzCe+dRfMUcPWA4lp4L6FJaSpMiXTqEyhzk+Dv1B8=";
+  cargoHash = "sha256-pHaMKuB9v3fjbgeVyLyRtfoQ9BkE6z+TjDfdBaVdbXM=";

  buildNoDefaultFeatures = true;
  buildFeatures = [
@ -32,11 +32,9 @@ rustPlatform.buildRustPackage (finalAttrs: {
    "sqlite"
    "mysql"
    "completions"
+    "sqlx-toml"
  ];

-  doCheck = false;
-  cargoBuildFlags = [ "--package sqlx-cli" ];
-
  nativeBuildInputs = [
    installShellFiles
    pkg-config
@ -66,7 +64,8 @@ rustPlatform.buildRustPackage (finalAttrs: {

  meta = {
    description = "CLI for managing databases, migrations, and enabling offline mode with `sqlx::query!()` and friends";
-    homepage = "https://github.com/launchbadge/sqlx";
+    homepage = "https://github.com/transact-rs/sqlx";
+    changelog = "https://github.com/transact-rs/sqlx/blob/v${finalAttrs.version}/CHANGELOG.md";
    license = lib.licenses.asl20;
    maintainers = with lib.maintainers; [
      greizgh
--- a/pkgs/by-name/st/step-cli/package.nix
+++ b/pkgs/by-name/st/step-cli/package.nix
@ -8,7 +8,7 @@
  unixtools,
 }:
 let
-  version = "0.30.2";
+  version = "0.30.4";
 in
 buildGoModule {
  pname = "step-cli";
@ -18,7 +18,7 @@ buildGoModule {
    owner = "smallstep";
    repo = "cli";
    tag = "v${version}";
-    hash = "sha256-xhkgPBPMxphlwTQiGPmvC8sQWCoepga3v6LVzHgh5zE=";
+    hash = "sha256-ToM+RzpioI+TlljlptYY0jnKGNdITzJ/xeWf4azhT/4=";
    # this file change depending on git branch status (via .gitattributes)
    # https://github.com/NixOS/nixpkgs/issues/84312
    postFetch = ''
@ -39,7 +39,7 @@ buildGoModule {
    patchShebangs integration/openssl-jwt.sh
  '';

-  vendorHash = "sha256-SnU2jkHZNhn8zS9S/2/MiZRtBV0sVy28n+BJY6RpCag=";
+  vendorHash = "sha256-DTFp9K5iiS50QuD2knN/8miYb2k/7O1d3GyEf79i69Q=";

  nativeBuildInputs = [ installShellFiles ];
  nativeCheckInputs = [
--- a/pkgs/by-name/vi/victoriametrics/package.nix
+++ b/pkgs/by-name/vi/victoriametrics/package.nix
@ -14,13 +14,13 @@

 buildGoModule (finalAttrs: {
  pname = "VictoriaMetrics";
-  version = "1.144.0";
+  version = "1.145.0";

  src = fetchFromGitHub {
    owner = "VictoriaMetrics";
    repo = "VictoriaMetrics";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-K8RCFHVL+E8w0webp6Bg3dma7I32iGXx9gCKnFp4d0g=";
+    hash = "sha256-nKG2ei1Gn1mU5TtD5YLYUHaJrM4fSxm/uUdY4tIGeVE=";
  };

  vendorHash = null;
--- a/pkgs/by-name/vt/vtsls/package.nix
+++ b/pkgs/by-name/vt/vtsls/package.nix
@ -5,23 +5,25 @@
  nodejs-slim_22,
  gitMinimal,
  gitSetupHook,
-  pnpm_8,
+  pnpm_11,
  fetchPnpmDeps,
  pnpmConfigHook,
  nix-update-script,
+  vtsls,
+  runCommand,
 }:
 let
-  pnpm' = pnpm_8.override { nodejs-slim = nodejs-slim_22; };
+  pnpm' = pnpm_11.override { nodejs-slim = nodejs-slim_22; };
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "vtsls";
-  version = "0.2.9";
+  version = "0.3.0";

  src = fetchFromGitHub {
    owner = "yioneko";
    repo = "vtsls";
    tag = "server-v${finalAttrs.version}";
-    hash = "sha256-vlw84nigvQqRB9OQBxOmrR9CClU9M4dNgF/nrvGN+sk=";
+    hash = "sha256-RuxaT3u9OOUMbDN6A2biIeUC+Z4leELF3OhKXxmCqbM=";
    fetchSubmodules = true;
  };

@ -36,7 +38,11 @@ stdenv.mkDerivation (finalAttrs: {

  buildInputs = [ nodejs-slim_22 ];

-  pnpmWorkspaces = [ "@vtsls/language-server" ];
+  pnpmWorkspaces = [
+    "@vtsls/language-server"
+    "@vtsls/language-service"
+    "@vtsls/vscode-fuzzy"
+  ];

  pnpmDeps = fetchPnpmDeps {
    inherit (finalAttrs)
@ -46,8 +52,8 @@ stdenv.mkDerivation (finalAttrs: {
      version
      ;
    pnpm = pnpm';
-    fetcherVersion = 3;
-    hash = "sha256-1P2ph8ZX6/KptkLP4wk0dZzuvnYCLOWorM1b9+otKsE=";
+    fetcherVersion = 4;
+    hash = "sha256-jYh79MtcfW/p6twuDM1JDwukSnn2/TJQYvHBlut0QnE=";
  };

  # Patches to get submodule sha from file instead of 'git submodule status'
@ -90,6 +96,25 @@ stdenv.mkDerivation (finalAttrs: {

  passthru = {
    updateScript = nix-update-script { };
+
+    tests.smoke =
+      runCommand "vtsls-smoke-test"
+        {
+        }
+        ''
+          INIT_REQUEST='{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"processId":null,"rootUri":"file:///tmp","workspaceFolders":[{"uri":"file:///tmp","name":"test"}],"capabilities":{}}}'
+          CONTENT_LENGTH=''${#INIT_REQUEST}
+
+          RESPONSE=$(
+            {
+              printf "Content-Length: %d\r\n\r\n%s" "$CONTENT_LENGTH" "$INIT_REQUEST"
+              sleep 1
+            } | timeout 3  ${lib.getExe vtsls} --stdio 2>&1 | head -c 1000
+          ) || true
+
+          echo "$RESPONSE" | grep -q '"capabilities"'
+          touch $out
+        '';
  };

  meta = {
--- a/pkgs/development/compilers/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/default.nix
@ -28,9 +28,9 @@ let
    "21.1.8".officialRelease.sha256 = "sha256-pgd8g9Yfvp7abjCCKSmIn1smAROjqtfZaJkaUkBSKW0=";
    "22.1.7".officialRelease.sha256 = "sha256-AmozlrL8AAlfr+F7OrJqr3ecd/KhBx5Bngj3SopPdyY=";
    "23.0.0-git".gitRelease = {
-      rev = "0ecf562dac85a29f3de1dd598e3ae0ecc34d1240";
-      rev-version = "23.0.0-unstable-2026-05-31";
-      sha256 = "sha256-9F/X7c3i+eyMhutmG5qvaoWaikOTBI20njDwn5TWCOU=";
+      rev = "47ef7495ad781b742a0c4435ca72590d297ba8bf";
+      rev-version = "23.0.0-unstable-2026-06-07";
+      sha256 = "sha256-5x3wvNti/OCmdam0tUmkiiq/ONn23m4mcTh491hWLVA=";
    };
  }
  // llvmVersions;
--- a/pkgs/development/python-modules/githubkit/default.nix
+++ b/pkgs/development/python-modules/githubkit/default.nix
@ -71,6 +71,7 @@ buildPythonPackage rec {
  ];

  meta = {
+    broken = true;
    description = "GitHub SDK for Python";
    homepage = "https://github.com/yanyongyu/githubkit";
    changelog = "https://github.com/yanyongyu/githubkit/releases/tag/${src.tag}";
--- a/pkgs/development/python-modules/gradient/default.nix
+++ b/pkgs/development/python-modules/gradient/default.nix
@ -1,83 +1,56 @@
 {
  lib,
-  attrs,
-  boto3,
  buildPythonPackage,
-  click-completion,
-  click-didyoumean,
-  click-help-colors,
-  colorama,
-  fetchPypi,
-  gradient-statsd,
-  gradient-utils,
-  gql,
-  halo,
-  marshmallow,
-  progressbar2,
-  pyopenssl,
-  pyyaml,
-  requests,
-  requests-toolbelt,
-  terminaltables,
-  websocket-client,
+  fetchFromGitHub,
+  hatchling,
+  hatch-fancy-pypi-readme,
+  httpx,
+  pydantic,
+  typing-extensions,
+  anyio,
+  distro,
+  sniffio,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "gradient";
  version = "3.10.1";
-  format = "setuptools";
+  pyproject = true;

-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-TL9Jbo9UvQhgG9aT3wjLD8DvTY48Os04DdaUfNAwcu4=";
+  src = fetchFromGitHub {
+    owner = "digitalocean";
+    repo = "gradient-python";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-Psre4HdF4/cgQ5CcM3H6PC+6asej4Is4+932Gvym774=";
  };

  postPatch = ''
-    substituteInPlace setup.py \
-      --replace 'attrs<=' 'attrs>=' \
-      --replace 'colorama==' 'colorama>=' \
-      --replace 'gql[requests]==3.0.0a6' 'gql' \
-      --replace 'PyYAML==5.*' 'PyYAML' \
-      --replace 'marshmallow<' 'marshmallow>=' \
-      --replace 'websocket-client==0.57.*' 'websocket-client'
+    substituteInPlace pyproject.toml \
+      --replace-fail "hatchling==1.26.3" "hatchling"
  '';

-  propagatedBuildInputs = [
-    attrs
-    boto3
-    click-completion
-    click-didyoumean
-    click-help-colors
-    colorama
-    gql
-    gradient-statsd
-    gradient-utils
-    halo
-    marshmallow
-    progressbar2
-    pyopenssl
-    pyyaml
-    requests
-    requests-toolbelt
-    terminaltables
-    websocket-client
+  nativeBuildInputs = [
+    hatchling
+    hatch-fancy-pypi-readme
  ];

-  # Tries to use /homeless-shelter to mimic container usage, etc
-  doCheck = false;
+  dependencies = [
+    httpx
+    pydantic
+    typing-extensions
+    anyio
+    distro
+    sniffio
+  ];

-  # marshmallow.exceptions.StringNotCollectionError: "only" should be a collection of strings.
-  # Support for marshmallow > 3
-  # pythonImportsCheck = [
-  #   "gradient"
-  # ];
+  pythonImportsCheck = [ "gradient" ];

  meta = {
-    description = "Command line interface for Gradient";
+    description = "Python API library for Gradient";
    mainProgram = "gradient";
-    homepage = "https://github.com/Paperspace/gradient-cli";
-    license = lib.licenses.isc;
+    homepage = "https://github.com/digitalocean/gradient-python";
+    license = lib.licenses.asl20;
    platforms = lib.platforms.unix;
    maintainers = with lib.maintainers; [ thoughtpolice ];
  };
-}
+})
--- a/pkgs/development/python-modules/langchain-perplexity/default.nix
+++ b/pkgs/development/python-modules/langchain-perplexity/default.nix
@ -9,6 +9,7 @@
  # dependencies
  langchain-core,
  openai,
+  perplexityai,

  # tests
  langchain-tests,
@ -23,14 +24,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "langchain-perplexity";
-  version = "1.1.0";
+  version = "1.3.2";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "langchain-ai";
    repo = "langchain";
    tag = "langchain-perplexity==${finalAttrs.version}";
-    hash = "sha256-bm7sIa62CIvsYNDdaN+XZKpRnCv5bg9kPZ1Ym8utFcM=";
+    hash = "sha256-XSfnoJaj2VRXSxHHVnRNBvr4Ko7GAqnFEDM90ohaufo=";
  };

  sourceRoot = "${finalAttrs.src.name}/libs/partners/perplexity";
@ -40,6 +41,7 @@ buildPythonPackage (finalAttrs: {
  dependencies = [
    langchain-core
    openai
+    perplexityai
  ];

  pythonRelaxDeps = [
--- a/pkgs/development/python-modules/molecule/plugins.nix
+++ b/pkgs/development/python-modules/molecule/plugins.nix
@ -1,7 +1,7 @@
 {
  lib,
  buildPythonPackage,
-  fetchPypi,
+  fetchFromGitHub,
  setuptools-scm,
  python-vagrant,
  docker,
@ -9,12 +9,14 @@

 buildPythonPackage rec {
  pname = "molecule-plugins";
-  version = "23.5.3";
+  version = "25.8.12";
  pyproject = true;

-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-orFDfVMtc24/vG23pp7FM+IzSyEV/5JFoLJ3LtlzjSM=";
+  src = fetchFromGitHub {
+    owner = "ansible-community";
+    repo = "molecule-plugins";
+    tag = "v${version}";
+    hash = "sha256-wTvJ+cjZMTOyaqqDZsA1wsKCpu2FEi69IBlSTxNs3/M=";
  };

  # reverse the dependency
--- a/pkgs/development/python-modules/moyopy/default.nix
+++ b/pkgs/development/python-modules/moyopy/default.nix
@ -16,7 +16,7 @@

 buildPythonPackage (finalAttrs: {
  pname = "moyopy";
-  version = "0.10.0";
+  version = "0.11.0";
  pyproject = true;
  __structuredAttrs = true;

@ -24,7 +24,7 @@ buildPythonPackage (finalAttrs: {
    owner = "spglib";
    repo = "moyo";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-C1260FQ/V/puPU41LQHxsvvQ3BAabxRKWBCVEm79gp0=";
+    hash = "sha256-PxKY/dhYKdvl2dfrDfsqg46TJ2EFx6Px27u8OddQjiI=";
  };

  sourceRoot = "${finalAttrs.src.name}/moyopy";
@ -47,7 +47,7 @@ buildPythonPackage (finalAttrs: {
      sourceRoot
      cargoRoot
      ;
-    hash = "sha256-M/AWtXfexXbnFHYd6DxxrRSTuejXdt0DVxU/XtT9iPQ=";
+    hash = "sha256-8GNHuRv3neE0xhfLyxw92DvZRUJFrYm7JCi0Bd2KROs=";
  };

  build-system = [
--- a/pkgs/development/python-modules/perplexityai/default.nix
+++ b/pkgs/development/python-modules/perplexityai/default.nix
@ -0,0 +1,102 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+
+  # build-system
+  hatch-fancy-pypi-readme,
+  hatchling,
+
+  # dependencies (incl. optional)
+  anyio,
+  distro,
+  httpx,
+  pydantic,
+  sniffio,
+  typing-extensions,
+  aiohttp,
+  httpx-aiohttp,
+
+  # tests
+  pyright,
+  mypy,
+  respx,
+  pytest,
+  pytest-asyncio,
+  ruff,
+  time-machine,
+  nox,
+  dirty-equals,
+  importlib-metadata,
+  rich,
+  pytest-xdist,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "perplexityai";
+  version = "0.38.0";
+  pyproject = true;
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "perplexityai";
+    repo = "perplexity-py";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Yp5A3aoKtAjWRPZ1Un2OYwezZohWirNm2JhAWLhd6uQ=";
+  };
+
+  # Can't use relaxPythonDeps as this is a version lock in the build system
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail '"hatchling==1.26.3"' '"hatchling"'
+  '';
+
+  build-system = [
+    hatch-fancy-pypi-readme
+    hatchling
+  ];
+
+  dependencies = [
+    anyio
+    distro
+    httpx
+    pydantic
+    sniffio
+    typing-extensions
+  ];
+
+  optional-dependencies = {
+    aiohttp = [
+      aiohttp
+      httpx-aiohttp
+    ];
+  };
+
+  nativeCheckInputs = [
+    pyright
+    mypy
+    respx
+    pytest
+    pytest-asyncio
+    ruff
+    time-machine
+    nox
+    dirty-equals
+    importlib-metadata
+    rich
+    pytest-xdist
+  ]
+  ++ finalAttrs.passthru.optional-dependencies.aiohttp;
+
+  pythonImportsCheck = [
+    "perplexity"
+  ];
+
+  meta = {
+    description = "API for Perplexity AI";
+    homepage = "https://github.com/perplexityai/perplexity-py";
+    changelog = "https://github.com/perplexityai/perplexity-py/blob/${finalAttrs.src.tag}/CHANGELOG.md";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ sarahec ];
+  };
+})
--- a/pkgs/development/python-modules/playwright/default.nix
+++ b/pkgs/development/python-modules/playwright/default.nix
@ -31,14 +31,14 @@ in
 buildPythonPackage (finalAttrs: {
  pname = "playwright";
  # run ./pkgs/development/web/playwright/update.sh to update
-  version = "1.59.0";
+  version = "1.60.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "microsoft";
    repo = "playwright-python";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-CbvVSx/KDaX+CZEJRlDd4GUwWejzjTKNyL4+FhgT6qE=";
+    hash = "sha256-gbPWUmELw77Fw5M236et2TjkkGisMVVOJzmgq61/bg0=";
  };

  patches = [
@ -54,11 +54,11 @@ buildPythonPackage (finalAttrs: {
  ];

  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace-fail ', "auditwheel==6.2.0"' "" \
-      --replace-fail "setuptools-scm==8.3.1" "setuptools-scm" \
-      --replace-fail "setuptools==80.9.0" "setuptools" \
-      --replace-fail "wheel==0.45.1" "wheel"
+    # Use sed with a regex instead of substituteInPlace so we don't have to
+    # bump pinned versions on every upstream release. grep -q precheck makes
+    # the build fail loudly if upstream restructures the requires list.
+    grep -q 'requires = \["setuptools==.*", "setuptools-scm==.*", "wheel==.*", "auditwheel==.*"\]' pyproject.toml
+    sed -i -e 's/requires = \["setuptools==.*", "setuptools-scm==.*", "wheel==.*", "auditwheel==.*"\]/requires = ["setuptools", "setuptools-scm", "wheel"]/' pyproject.toml

    # setup.py downloads and extracts the driver.
    # This is done manually in postInstall instead.
--- a/pkgs/development/python-modules/slixmpp/default.nix
+++ b/pkgs/development/python-modules/slixmpp/default.nix
@ -20,16 +20,16 @@
  setuptools-scm,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "slixmpp";
-  version = "1.13.2";
+  version = "1.16.0";
  pyproject = true;

  src = fetchFromCodeberg {
    owner = "poezio";
    repo = "slixmpp";
-    tag = "slix-${version}";
-    hash = "sha256-hjM1OIFYpHV5SSN32858pyuwOvaAA0tFZWCZI+5n9u4=";
+    tag = "slix-${finalAttrs.version}";
+    hash = "sha256-d0laQWaqZUoviF7NM/egENQ3ArQE12ER0TzfPBcnc7Q=";
  };

  patches = [
@ -71,7 +71,10 @@ buildPythonPackage rec {
    safer-xml-parsing = [ defusedxml ];
  };

-  nativeCheckInputs = [ pytestCheckHook ] ++ lib.concatAttrValues optional-dependencies;
+  nativeCheckInputs = [
+    pytestCheckHook
+  ]
+  ++ lib.concatAttrValues finalAttrs.passthru.optional-dependencies;

  preCheck = ''
    # don't test against pure python version in the source tree
@ -90,8 +93,8 @@ buildPythonPackage rec {
  meta = {
    description = "Python library for XMPP";
    homepage = "https://slixmpp.readthedocs.io/";
-    changelog = "https://codeberg.org/poezio/slixmpp/releases/tag/${src.tag}";
+    changelog = "https://codeberg.org/poezio/slixmpp/releases/tag/${finalAttrs.src.tag}";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ fab ];
  };
-}
+})
--- a/pkgs/development/python-modules/veryprettytable/default.nix
+++ b/pkgs/development/python-modules/veryprettytable/default.nix
@ -4,26 +4,31 @@
  fetchPypi,
  termcolor,
  colorama,
+  setuptools,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "veryprettytable";
  version = "0.8.1";
-  format = "setuptools";
+  pyproject = true;

  src = fetchPypi {
-    inherit pname version;
-    sha256 = "1k1rifz8x6qcicmx2is9vgxcj0qb2f5pvzrp7zhmvbmci3yack3f";
+    inherit (finalAttrs) pname version;
+    hash = "sha256-bkym/Iisrl3hPzf/fYsTCwPJ+ttJR9Eriwybjr6LOcw=";
  };

-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
    termcolor
    colorama
  ];

+  pythonImportsCheck = [ "veryprettytable" ];
+
  meta = {
    description = "Simple Python library for easily displaying tabular data in a visually appealing ASCII table format";
    homepage = "https://github.com/smeggingsmegger/VeryPrettyTable";
    license = lib.licenses.free;
  };
-}
+})
--- a/pkgs/development/web/playwright/browsers.json
+++ b/pkgs/development/web/playwright/browsers.json
@ -2,22 +2,22 @@
  "comment": "This file is kept up to date via update.sh",
  "browsers": {
    "chromium": {
-      "revision": "1217",
-      "browserVersion": "147.0.7727.15",
+      "revision": "1223",
+      "browserVersion": "148.0.7778.96",
      "title": "Chrome for Testing"
    },
    "chromium-headless-shell": {
-      "revision": "1217",
-      "browserVersion": "147.0.7727.15",
+      "revision": "1223",
+      "browserVersion": "148.0.7778.96",
      "title": "Chrome Headless Shell"
    },
    "firefox": {
-      "revision": "1511",
-      "browserVersion": "148.0.2",
+      "revision": "1522",
+      "browserVersion": "150.0.2",
      "title": "Firefox"
    },
    "webkit": {
-      "revision": "2272",
+      "revision": "2287",
      "revisionOverrides": {
        "mac14": "2251",
        "mac14-arm64": "2251",
--- a/pkgs/development/web/playwright/chromium-headless-shell.nix
+++ b/pkgs/development/web/playwright/chromium-headless-shell.nix
@ -36,8 +36,8 @@ let
      inherit (download) url stripRoot;
      hash =
        {
-          x86_64-linux = "sha256-kQCw0nQHHuUIfn8rGVcN7Ip6ZOk5c3Or+GG5RvSica4=";
-          aarch64-linux = "sha256-s2IIjSY5t9AtT05dUS0mp4fPlaixND9+Cg0+0S8Kkx8=";
+          x86_64-linux = "sha256-Nr0/uczFTBTqvRPR0c/wflIqG5relgKfC9XsMOdE9iE=";
+          aarch64-linux = "sha256-veEBmsivFDrG1bArQ780+gMbsoT1Zv4VLcIPpgn4M/I=";
        }
        .${system} or throwSystem;
    };
@ -72,8 +72,8 @@ let
    inherit (download) url stripRoot;
    hash =
      {
-        x86_64-darwin = "sha256-kzbLpzzMpBurQHyGaz561A0K46GzgWPP2JSQKRV6C+Y=";
-        aarch64-darwin = "sha256-67ekk37uq5ITq9ZvwPTZhhqEgQY17g/3KJ/vnqZz3h0=";
+        x86_64-darwin = "sha256-GEomMUuaIjhBEuWF/HyMohseJtwKOn5MCgh6kIB9ZeE=";
+        aarch64-darwin = "sha256-7laJtPAiy6pYAxCNBxRYk+FmriXemmLW8UYteEdVrd0=";
      }
      .${system} or throwSystem;
  };
--- a/pkgs/development/web/playwright/chromium.nix
+++ b/pkgs/development/web/playwright/chromium.nix
@ -63,8 +63,8 @@ let
      inherit (download) url stripRoot;
      hash =
        {
-          x86_64-linux = "sha256-GtaJk9Qr1bTbDfpB+noGlLcIDEIS2uzDiV5rb2DZhVQ=";
-          aarch64-linux = "sha256-jsesQ6juzMPQzmn0Ygb8hmpxCeLHJVBL89qto5yuh5s=";
+          x86_64-linux = "sha256-TnplS4C/PPcmyWrMCqWh7c1KrpevHJFKO0gfh46M3tk=";
+          aarch64-linux = "sha256-E7Nmz9fET0kXNf7ooaUBDHtDBWTGq4JDKKUbo/UfA+c=";
        }
        .${system} or throwSystem;
    };
@ -130,8 +130,8 @@ let
    inherit (download) url stripRoot;
    hash =
      {
-        x86_64-darwin = "sha256-CxnLSe+sZYskO7H5f3cA+BlWCZsFOPpp1gVG5s37r80=";
-        aarch64-darwin = "sha256-n3JLK+hJwzPihC2qSHrSCYPz3jonZNz7GMgXiPBLaS0=";
+        x86_64-darwin = "sha256-W6xH9iX81H+o689LZvJZO7tF79V0Gv7AksUwflPuQ8A=";
+        aarch64-darwin = "sha256-T0rVp4M/ymrJtNVtF0RDmIOT6kC3/tRkzPYrwvFbEQY=";
      }
      .${system} or throwSystem;
  };
--- a/pkgs/development/web/playwright/driver.nix
+++ b/pkgs/development/web/playwright/driver.nix
@ -19,64 +19,13 @@ let
  throwSystem = throw "Unsupported system: ${system}";
  browsersJSON = (lib.importJSON ./browsers.json).browsers;

-  version = "1.59.1";
+  version = "1.60.0";

  src = fetchFromGitHub {
    owner = "Microsoft";
    repo = "playwright";
    rev = "v${version}";
-    hash = "sha256-kiH1jDyt5xMWc5C2dytoDC9fi1b5tWXZG8S6KEpuotM=";
-  };
-
-  babel-bundle = buildNpmPackage {
-    pname = "babel-bundle";
-    inherit version src;
-    sourceRoot = "${src.name}/packages/playwright/bundles/babel";
-    npmDepsHash = "sha256-ByCy4go8PM0ksDg+2DcJPyoKG7Z0uIqKM647ZQwYwAE=";
-    dontNpmBuild = true;
-    installPhase = ''
-      cp -r . "$out"
-    '';
-  };
-  expect-bundle = buildNpmPackage {
-    pname = "expect-bundle";
-    inherit version src;
-    sourceRoot = "${src.name}/packages/playwright/bundles/expect";
-    npmDepsHash = "sha256-PbPCsMqRkfU2c/mCsLSagew84XTgeO6H5+isNZQl2ek=";
-    dontNpmBuild = true;
-    installPhase = ''
-      cp -r . "$out"
-    '';
-  };
-  utils-bundle = buildNpmPackage {
-    pname = "utils-bundle";
-    inherit version src;
-    sourceRoot = "${src.name}/packages/playwright/bundles/utils";
-    npmDepsHash = "sha256-BTaF1atpK+kG++ZJBUK4r3A7mbN2vv3xpDmb1NiNngE=";
-    dontNpmBuild = true;
-    installPhase = ''
-      cp -r . "$out"
-    '';
-  };
-  utils-bundle-core = buildNpmPackage {
-    pname = "utils-bundle-core";
-    inherit version src;
-    sourceRoot = "${src.name}/packages/playwright-core/bundles/utils";
-    npmDepsHash = "sha256-O8X80rTT10ht97towSocANnGwH4fH1f3nZMSl8TOc+Y=";
-    dontNpmBuild = true;
-    installPhase = ''
-      cp -r . "$out"
-    '';
-  };
-  zip-bundle = buildNpmPackage {
-    pname = "zip-bundle";
-    inherit version src;
-    sourceRoot = "${src.name}/packages/playwright-core/bundles/zip";
-    npmDepsHash = "sha256-5BHgCelIPh8ljIcdrO4AHafjqfLowDwJcpN+mD13Syw=";
-    dontNpmBuild = true;
-    installPhase = ''
-      cp -r . "$out"
-    '';
+    hash = "sha256-jtQHyphdZsS8hf7uhe9zrx16Uf+kgLLha6dTCsCTT/8=";
  };

  playwright = buildNpmPackage {
@ -84,7 +33,7 @@ let
    inherit version src;

    sourceRoot = "${src.name}"; # update.sh depends on sourceRoot presence
-    npmDepsHash = "sha256-H3kKFthmZH4fqFPQA34w7iw2rubpEKLlJ9jaW6mpuyo=";
+    npmDepsHash = "sha256-K1bCDURaq2+kaqGQcOL1tD6tQt/37pyDFWq2njUVNS4=";

    nativeBuildInputs = [
      cacert
@ -95,22 +44,10 @@ let

    postPatch = ''
      sed -i '/\/\/ Update test runner./,/^\s*$/{d}' utils/build/build.js
-      sed -i '/^\/\/ Update bundles\./,/^[[:space:]]*}$/d' utils/build/build.js
-      sed -i '/execSync/d' ./utils/generate_third_party_notice.js
      # The dlopen library check uses ldconfig which doesn't work under Nix.
      # These libraries are already provided via rpath by autoPatchelfHook and wrapProgram.
      substituteInPlace packages/playwright-core/src/server/registry/index.ts \
        --replace-fail "['libGLESv2.so.2', 'libx264.so']" "[]"
-      chmod +w packages/playwright/bundles/babel
-      ln -s ${babel-bundle}/node_modules packages/playwright/bundles/babel/node_modules
-      chmod +w packages/playwright/bundles/expect
-      ln -s ${expect-bundle}/node_modules packages/playwright/bundles/expect/node_modules
-      chmod +w packages/playwright/bundles/utils
-      ln -s ${utils-bundle}/node_modules packages/playwright/bundles/utils/node_modules
-      chmod +w packages/playwright-core/bundles/utils
-      ln -s ${utils-bundle-core}/node_modules packages/playwright-core/bundles/utils/node_modules
-      chmod +w packages/playwright-core/bundles/zip
-      ln -s ${zip-bundle}/node_modules packages/playwright-core/bundles/zip/node_modules
    '';

    installPhase = ''
--- a/pkgs/development/web/playwright/firefox.nix
+++ b/pkgs/development/web/playwright/firefox.nix
@ -19,8 +19,8 @@ let
      inherit (download) url stripRoot;
      hash =
        {
-          x86_64-linux = "sha256-kfXBssU8pJbBqEUQkgpUFXaskx95OyQEYXDhe6cteR8=";
-          aarch64-linux = "sha256-OMPpE0VUgZ65cPOZ7f3sfQMaI++lp6B/RBmhH0E7Y9k=";
+          x86_64-linux = "sha256-DXUCNHLzN8rdq/I7JRAHbSPtgK8pJy3sKNEx4xsbd0E=";
+          aarch64-linux = "sha256-Kl7Z9mE+1Vy6VEnnl0DOZY/jtYjhUTwjqfFe9UZu2UA=";
        }
        .${system} or throwSystem;
    };
@ -42,8 +42,8 @@ let
    inherit (download) url stripRoot;
    hash =
      {
-        x86_64-darwin = "sha256-OfNmamn82tJ8+eY6DC8a3AynmhObZ8E0GTegF8l7km4=";
-        aarch64-darwin = "sha256-WEYhmqGhGvO47i/OICJgXyqj64Wt52juJDEe7nD7HXU=";
+        x86_64-darwin = "sha256-eXS88URYKAbFP6/3pukb2qgrdqVBOR99VGyqKPFZ2Tw=";
+        aarch64-darwin = "sha256-lVNFp20v+zBC3Up9ElhWh8C8ptEUqCHEsfQiuPp3lVM=";
      }
      .${system} or throwSystem;
  };
--- a/pkgs/development/web/playwright/webkit.nix
+++ b/pkgs/development/web/playwright/webkit.nix
@ -23,6 +23,7 @@
  icu74,
  lcms,
  libavif,
+  libbacktrace,
  libdrm,
  libepoxy,
  libevent,
@ -120,8 +121,8 @@ let
      inherit (download) url stripRoot;
      hash =
        {
-          x86_64-linux = "sha256-BVIZxnnfhBvI737ojRZ+yUX8mcbQ6WOlNdYJ9t4R5yY=";
-          aarch64-linux = "sha256-t9kqUdyOgDXroKp7LWQsaiaRGZVZN3ZdfYLahl5GW2E=";
+          x86_64-linux = "sha256-hefWMElsTGTkPvSnovwR8P0kunnPLUGDR5Hvoa31SMM=";
+          aarch64-linux = "sha256-4leXyoebeqWPHxO9D2MomnVqza/9IEcJEuiRCf3/eUc=";
        }
        .${system} or throwSystem;
    };
@ -149,6 +150,7 @@ let
      icu74
      lcms
      libavif
+      libbacktrace
      libdrm
      libepoxy
      libevent
@ -193,8 +195,8 @@ let
    inherit (download) url stripRoot;
    hash =
      {
-        x86_64-darwin = "sha256-NjuRZrYzraE1FrPAmyMcQFAS2zWZXYe8cBQVbSU6zFw=";
-        aarch64-darwin = "sha256-9g7YHg+TQNmAE07K6jKSSRUJ7IENUQMp2q54Mk2BbaY=";
+        x86_64-darwin = "sha256-D9iZitRG3lPWQ/Zu/HAjx2gEehr/xr0d+j2jo7yjnoQ=";
+        aarch64-darwin = "sha256-383PHqwW+QoXL4qxXEE3ytbQVQ4rg2YDK+B+XvIfBmY=";
      }
      .${system} or throwSystem;
  };
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@ -796,6 +796,10 @@ let
      DEVTMPFS = yes;

      UNICODE = yes; # Casefolding support for filesystems
+    }
+    // lib.optionalAttrs stdenv.hostPlatform.isPower {
+      # Needed to use the installation iso image formatted for tbxi booting (ISO9660 w/ hybrid HFS+ partition).
+      HFSPLUS_FS = yes;
    };

    security = {
@ -1623,6 +1627,12 @@ let
        # > round to working out why.  The workaround is to build it in[…].
        # > (It won't do any harm on non-Mac systems.)
        I2C_POWERMAC = yes;
+      }
+      // lib.optionalAttrs stdenv.hostPlatform.isPower {
+        # Needed for booting PowerMacs from disc
+        # (the only nice way that doesn't involve messing around with internal drives or in Open Firmware)
+        ATA = yes;
+        PATA_MACIO = yes;
      };

    accel = {
--- a/pkgs/os-specific/linux/kernel/zen-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/zen-kernels.nix
@ -18,7 +18,7 @@ in
 buildLinux (
  args
  // rec {
-    version = "7.0.10";
+    version = "7.0.11";
    pname = "linux-zen";
    modDirVersion = lib.versions.pad 3 "${version}-${suffix}";
    isZen = true;
@ -27,7 +27,7 @@ buildLinux (
      owner = "zen-kernel";
      repo = "zen-kernel";
      rev = "v${version}-${suffix}";
-      sha256 = "1xh7bbis9v7yq2s1zwdnmsx54zz9kcmyn1cnrqqlsassk7fzl7nx";
+      sha256 = "03h6f1pa96xdszpxcnd846n5jgwqmc49gf9wbyq1gy8rlzpc59yr";
    };

    # This is based on the following source:
--- a/pkgs/pkgs-lib/formats.nix
+++ b/pkgs/pkgs-lib/formats.nix
@ -472,12 +472,14 @@ optionalAttrs allowAliases aliases
          runCommand name
            {
              nativeBuildInputs = [ json2x ];
-              inherit value;
+              value = builtins.toJSON value;
              preferLocalBuild = true;
              __structuredAttrs = true;
            }
            ''
-              json2x toml --unwrap value "$NIX_ATTRS_JSON_FILE" "$out"
+              valuePath="$TMPDIR/value"
+              printf "%s" "$value" > "$valuePath"
+              json2x toml "$valuePath" "$out"
            ''
        ) { };

--- a/pkgs/pkgs-lib/formats/json2x/src/main.rs
+++ b/pkgs/pkgs-lib/formats/json2x/src/main.rs
@ -10,9 +10,6 @@ use argh::{FromArgValue, FromArgs};
 /// Convert a JSON file to another format
 #[derive(FromArgs)]
 struct Args {
-    /// convert only value of this attribute
-    #[argh(option)]
-    unwrap: Option<String>,
    /// format of the output file, possible values: toml
    #[argh(positional)]
    format: Format,
@ -32,31 +29,16 @@ enum Format {
 fn main() -> anyhow::Result<()> {
    let args: Args = argh::from_env();

-    let json_text = read_to_string(&args.input)
+    let input = read_to_string(&args.input)
        .with_context(|| format!("failed to read {}", args.input.display()))?;
-    let parsed_json: serde_json::Value = serde_json::from_str(&json_text)
+    let input: serde_json::Value = serde_json::from_str(&input)
        .with_context(|| format!("failed to parse {}", args.input.display()))?;
-    let output_value = if let Some(unwrap_key) = args.unwrap {
-        parsed_json
-            .as_object()
-            .ok_or_else(|| anyhow::anyhow!("{} does not contain an object", args.input.display()))?
-            .get(&unwrap_key)
-            .ok_or_else(|| {
-                anyhow::anyhow!(
-                    "{} does not containt attribute '{unwrap_key}'",
-                    args.input.display()
-                )
-            })?
-    } else {
-        &parsed_json
-    };
    let mut output = File::create(&args.output)
        .with_context(|| format!("failed to create {}", args.output.display()))?;

    match args.format {
        Format::Toml => {
-            let content =
-                toml::to_string(output_value).context("failed to serialize value to toml")?;
+            let content = toml::to_string(&input).context("failed to serialize value to toml")?;
            output
                .write_all(content.as_bytes())
                .with_context(|| format!("failed to write to {}", args.output.display()))?;
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@ -481,6 +481,7 @@ mapAliases {
  ChowPhaser = throw "'ChowPhaser' has been renamed to/replaced by 'chow-phaser'"; # Converted to throw 2025-10-27
  CHOWTapeModel = throw "'CHOWTapeModel' has been renamed to/replaced by 'chow-tape-model'"; # Converted to throw 2025-10-27
  chrome-gnome-shell = throw "'chrome-gnome-shell' has been renamed to/replaced by 'gnome-browser-connector'"; # Converted to throw 2025-10-27
+  chromium-xorg-conf = throw "'chromium-xorg-conf' has been removed as it was only used by the 'cmt' NixOS module, which was removed"; # Added 2026-05-25
  ci-edit = throw "'ci-edit' has been removed due to lack of maintenance upstream"; # Added 2025-08-26
  cinnamon-common = cinnamon; # Added 2025-08-06
  ciopfs = throw "'ciopfs' has been removed due to lack of fuse 3 support."; # Added 2026-06-05
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -2153,10 +2153,6 @@ with pkgs;
    binutils = binutils-unwrapped;
  };

-  fltrdr = callPackage ../tools/misc/fltrdr {
-    icu = icu63;
-  };
-
  file = callPackage ../tools/misc/file {
    inherit (windows) libgnurx;
  };
--- a/pkgs/top-level/linux-kernels.nix
+++ b/pkgs/top-level/linux-kernels.nix
@ -332,6 +332,8 @@ in
          inherit kernel;
        };

+        ethercat = callPackage pkgs.ethercat.kernelModule { };
+
        evdi = callPackage ../os-specific/linux/evdi { };

        fanout = callPackage ../os-specific/linux/fanout { };
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@ -12579,6 +12579,8 @@ self: super: with self; {

  permissionedforms = callPackage ../development/python-modules/permissionedforms { };

+  perplexityai = callPackage ../development/python-modules/perplexityai { };
+
  persim = callPackage ../development/python-modules/persim { };

  persist-queue = callPackage ../development/python-modules/persist-queue { };