Merge branch 'staging-next' into staging

2026-07-06 17:13:24 -05:00 · 2026-05-31 20:44:27 -04:00 · 2026-05-31 20:44:27 -04:00 · 61fdedcce5
commit 61fdedcce5
parent 77de9ce475 0074e9d3c1
219 changed files with 4622 additions and 2128 deletions
--- a/ci/OWNERS
+++ b/ci/OWNERS
@ -56,6 +56,12 @@
 /pkgs/top-level/splice.nix                       @Ericson2314
 /pkgs/top-level/release-cross.nix                @Ericson2314
 /pkgs/top-level/by-name-overlay.nix              @infinisil @philiptaron
+/pkgs/top-level/config.nix                       @jopejoe1
+/pkgs/top-level/make-tarball.nix                 @jopejoe1
+/pkgs/top-level/packages-config.nix              @jopejoe1
+/pkgs/top-level/packages-info.nix                @jopejoe1
+/pkgs/top-level/release-lib.nix                  @jopejoe1
+/pkgs/top-level/release.nix                      @jopejoe1
 /pkgs/stdenv                                     @philiptaron @NixOS/stdenv
 /pkgs/stdenv/generic                             @Ericson2314 @NixOS/stdenv
 /pkgs/stdenv/generic/problems.nix                @infinisil
--- a/doc/languages-frameworks/python.section.md
+++ b/doc/languages-frameworks/python.section.md
@ -48,7 +48,6 @@ Based on the packages defined in `pkgs/top-level/python-packages.nix` an
 attribute set is created for each available Python interpreter. The available
 sets are

-* `pkgs.python27Packages`
 * `pkgs.python3Packages`
 * `pkgs.python311Packages`
 * `pkgs.python312Packages`
@ -60,9 +59,7 @@ sets are

 and the aliases

-* `pkgs.python2Packages` pointing to `pkgs.python27Packages`
 * `pkgs.python3Packages` pointing to `pkgs.python313Packages`
-* `pkgs.pythonPackages` pointing to `pkgs.python2Packages`
 * `pkgs.pypy2Packages` pointing to `pkgs.pypy27Packages`
 * `pkgs.pypy3Packages` pointing to `pkgs.pypy310Packages`
 * `pkgs.pypyPackages` pointing to `pkgs.pypy2Packages`
@ -573,9 +570,6 @@ In contrast to [`python.buildEnv`](#python.buildenv-function), [`python.withPack
 more advanced options such as `ignoreCollisions = true` or `postBuild`. If you
 need them, you have to use [`python.buildEnv`](#python.buildenv-function).

-Python 2 namespace packages may provide `__init__.py` that collide. In that case
-[`python.buildEnv`](#python.buildenv-function) should be used with `ignoreCollisions = true`.
-
 #### Setup hooks {#setup-hooks}

 The following are setup hooks specifically for Python packages. Most of these
@ -627,10 +621,9 @@ buildPythonPackage.override { stdenv = customStdenv; } {

 Several versions of the Python interpreter are available on Nix, as well as a
 high amount of packages. The attribute `python3` refers to the default
-interpreter, which is currently CPython 3.13. The attribute `python` refers to
-CPython 2.7 for backwards compatibility. It is also possible to refer to
-specific versions, e.g., `python313` refers to CPython 3.13, and `pypy` refers to
-the default PyPy interpreter.
+interpreter, which is currently CPython 3.13. It is also possible to refer to
+specific versions, e.g., `python313` refers to CPython 3.13, and `pypy` refers
+to the default PyPy interpreter.

 Python is used a lot, and in different ways. This affects also how it is
 packaged. In the case of Python on Nix, an important distinction is made between
@ -1910,9 +1903,8 @@ pkgs.mkShell rec {
 }
 ```

-In case the supplied venvShellHook is insufficient, or when Python 2 support is
-needed, you can define your own shell hook and adapt to your needs like in the
-following example:
+In case the supplied venvShellHook is insufficient, you can define your own
+shell hook and adapt to your needs like in the following example:

 ```nix
 with import <nixpkgs> { };
@ -1925,8 +1917,6 @@ pkgs.mkShell rec {
  name = "impurePythonEnv";
  buildInputs = [
    pythonPackages.python
-    # Needed when using python 2.7
-    # pythonPackages.virtualenv
    # ...
  ];

@ -1939,8 +1929,6 @@ pkgs.mkShell rec {
      echo "Skipping venv creation, '${venvDir}' already exists"
    else
      echo "Creating new venv environment in path: '${venvDir}'"
-      # Note that the module venv was only introduced in python 3, so for 2.7
-      # this needs to be replaced with a call to virtualenv
      ${pythonPackages.python.interpreter} -m venv "${venvDir}"
    fi

--- a/maintainers/github-teams.json
+++ b/maintainers/github-teams.json
@ -309,8 +309,7 @@
    "members": {
      "AndersonTorres": 5954806,
      "adisbladis": 63286,
-      "panchoh": 471059,
-      "ttuegel": 563054
+      "panchoh": 471059
    },
    "name": "emacs"
  },
@ -407,12 +406,13 @@
  "gnome": {
    "description": "Maintain GNOME desktop environment and platform.",
    "id": 3806133,
-    "maintainers": {},
+    "maintainers": {
+      "jtojnar": 705123
+    },
    "members": {
      "bobby285271": 20080233,
      "dasj19": 7589338,
-      "hedning": 71978,
-      "jtojnar": 705123
+      "hedning": 71978
    },
    "name": "GNOME"
  },
@ -702,6 +702,7 @@
      "Mic92": 96200,
      "Radvendii": 1239929,
      "edolstra": 1148549,
+      "lisanna-dettwyler": 72424138,
      "lovesegfault": 7243783,
      "xokdvium": 145775305
    },
@ -819,14 +820,13 @@
    "description": "Maintain the Qt framework, KDE application suite, Plasma desktop environment and related projects",
    "id": 4341481,
    "maintainers": {
-      "ttuegel": 563054
+      "K900": 386765,
+      "NickCao": 15247171,
+      "SuperSandro2000": 7258858
    },
    "members": {
      "FRidh": 2129135,
-      "K900": 386765,
      "LunNova": 782440,
-      "NickCao": 15247171,
-      "SuperSandro2000": 7258858,
      "bkchr": 5718007,
      "ilya-fedin": 17829319,
      "mjm": 1181,
@ -896,8 +896,7 @@
    "id": 7304571,
    "maintainers": {
      "Mic92": 96200,
-      "winterqt": 78392041,
-      "zowoq": 59103226
+      "winterqt": 78392041
    },
    "members": {},
    "name": "rust"
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -16483,6 +16483,12 @@
    githubId = 8094643;
    keys = [ { fingerprint = "BAA9 7711 58CA D457 B4AE  8B06 8188 423D 2FA2 0A65"; } ];
  };
+  m4r1vs = {
+    email = "marius.niveri@gmail.com";
+    name = "Marius Niveri";
+    github = "m4r1vs";
+    githubId = 26097311;
+  };
  m7medvision = {
    name = "Mohammed";
    github = "m7medVision";
@ -23416,6 +23422,13 @@
    githubId = 61013287;
    name = "Ricardo Steijn";
  };
+  ricardomaps = {
+    email = "ricardomapurungajunior@gmail.com";
+    github = "ricardomaps";
+    githubId = 49507078;
+    name = "Ricardo Mapurunga Junior";
+    matrix = "@ricmaps:matrix.org";
+  };
  richar = {
    github = "ri-char";
    githubId = 17962023;
@ -26124,6 +26137,12 @@
    name = "sportshead";
    keys = [ { fingerprint = "A6B6 D031 782E BDF7 631A  8E7E A874 DB2C BFD3 CFD0"; } ];
  };
+  spotdemo4 = {
+    email = "me@trev.xyz";
+    github = "spotdemo4";
+    githubId = 3732640;
+    name = "spotdemo4";
+  };
  spreetin = {
    email = "spreetin@protonmail.com";
    name = "David Falk";
@ -29658,6 +29677,11 @@
      }
    ];
  };
+  wilaz = {
+    name = "Wilaz";
+    github = "Wilaz";
+    githubId = 98198668;
+  };
  wildsebastian = {
    name = "Sebastian Wild";
    email = "sebastian@wild-siena.com";
--- a/nixos/doc/manual/release-notes/rl-2611.section.md
+++ b/nixos/doc/manual/release-notes/rl-2611.section.md
@ -18,6 +18,8 @@

 - `boot.vesa` has been removed. It was deprecated in 2020 because Xorg now works better with kernel modesetting. If you still need the legacy VESA 800x600 fallback, set `boot.kernelParams = [ "vga=0x317" "nomodeset" ];` directly.

+- Python 2 has been removed from the top-level package set, as it is long past end-of-life. The `python2`, `python27`, `python2Full`, `python27Full`, `python2Packages`, and `python27Packages` attributes, along with the legacy `python`, `pythonFull`, and `pythonPackages` aliases, now throw an error directing you to `python3`. The `isPy2` and `isPy27` package flags have been removed accordingly. The only remaining Python 2 interpreter is vendored inside the `resholve` package for its `oil` dependency and is not exposed for general use.
+
 ## Other Notable Changes {#sec-release-26.11-notable-changes}

 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
--- a/nixos/modules/services/development/gemstash.nix
+++ b/nixos/modules/services/development/gemstash.nix
@ -36,6 +36,8 @@ in
      '';
    };

+    package = lib.mkPackageOption pkgs "gemstash" { };
+
    settings = lib.mkOption {
      default = { };
      description = ''
@ -96,7 +98,7 @@ in
      after = [ "network.target" ];
      serviceConfig = lib.mkMerge [
        {
-          ExecStart = "${pkgs.gemstash}/bin/gemstash start --no-daemonize --config-file ${settingsFormat.generate "gemstash.yaml" (prefixColon cfg.settings)}";
+          ExecStart = "${lib.getExe cfg.package} start --no-daemonize --config-file ${settingsFormat.generate "gemstash.yaml" (prefixColon cfg.settings)}";
          NoNewPrivileges = true;
          User = "gemstash";
          Group = "gemstash";
--- a/nixos/modules/services/home-automation/home-assistant.nix
+++ b/nixos/modules/services/home-automation/home-assistant.nix
@ -30,7 +30,6 @@ let
    mapAttrsToList
    mergeAttrsList
    mkEnableOption
-    mkDefault
    mkIf
    mkMerge
    mkOption
--- a/nixos/modules/services/ttys/kmscon.nix
+++ b/nixos/modules/services/ttys/kmscon.nix
@ -2,6 +2,7 @@
  config,
  pkgs,
  lib,
+  utils,
  ...
 }:
 let
@ -10,8 +11,6 @@ let
    mkEnableOption
    mkOption
    mkPackageOption
-    optional
-    optionals
    types
    ;

@ -22,7 +21,12 @@ let
  configDir = pkgs.writeTextFile {
    name = "kmscon-config";
    destination = "/kmscon.conf";
-    text = cfg.extraConfig;
+    text =
+      let
+        mkKeyValue =
+          k: v: if lib.isBool v then (lib.optionalString (!v) "no-") + k else "${k}=${toString v}";
+      in
+      lib.generators.toKeyValue { inherit mkKeyValue; } (lib.filterAttrs (_: v: v != null) cfg.config);
  };

  baseLoginOptions = "-p";
@ -55,58 +59,68 @@ in

      Check `services.getty.autologinUser` instead.
    '')
+    (lib.mkRemovedOptionModule [ "services" "kmscon" "fonts" ] ''
+      `services.kmscon.fonts` is removed.
+
+      Add your font to `fonts.packages` and configure it with
+      `services.kmscon.config.font-name` instead.
+    '')
+    (lib.mkRemovedOptionModule [ "services" "kmscon" "extraConfig" ] ''
+      `services.kmscon.extraConfig` is removed.
+
+      Add your configurations to the new `services.kmscon.config` instead.
+    '')
+    (lib.mkRenamedOptionModule [ "services" "kmscon" "term" ] [ "services" "kmscon" "config" "term" ])
+    (lib.mkRenamedOptionModule
+      [ "services" "kmscon" "hwRender" ]
+      [ "services" "kmscon" "config" "hwaccel" ]
+    )
  ];

  options = {
    services.kmscon = {
      enable = mkEnableOption ''
-        Use kmscon instead of autovt.
+        use kmscon instead of autovt.

        Kmscon is a simple terminal emulator based on linux kernel mode setting (KMS).
-        It is an attempt to replace the in-kernel VT implementation with a userspace console.
+        It is an attempt to replace the in-kernel VT implementation with a userspace console
      '';

      package = mkPackageOption pkgs "kmscon" { };

-      hwRender = mkEnableOption "3D hardware acceleration to render the console";
+      useXkbConfig = mkEnableOption ''
+        configure keymap from xserver keyboard settings.

-      fonts = mkOption {
-        description = "Fonts used by kmscon, in order of priority.";
-        default = null;
-        example = lib.literalExpression ''[ { name = "Source Code Pro"; package = pkgs.source-code-pro; } ]'';
-        type =
-          with types;
-          let
-            fontType = submodule {
-              options = {
-                name = mkOption {
-                  type = str;
-                  description = "Font name, as used by fontconfig.";
-                };
-                package = mkOption {
-                  type = package;
-                  description = "Package providing the font.";
-                };
-              };
+        If enabled, configurations under `services.xserver.xkb` will be injected into kmscon's configuration
+      '';
+
+      config = mkOption {
+        description = ''
+          Configuration for kmscon. See {manpage}`kmscon.conf(5)`
+          for available options.
+        '';
+        default = { };
+        type = types.submodule {
+          freeformType =
+            with types;
+            attrsOf (oneOf [
+              bool
+              int
+              str
+            ]);
+          options = {
+            hwaccel = mkEnableOption "use hardware acceleration for rendering";
+            libseat = mkOption {
+              type = types.bool;
+              default = true;
+              description = ''
+                Whether to use libseat for session management.
+                This is the default for kmscon newer than 10.0.0 and prevents
+                launching another GUI from kmscon by `kmscon-launch-gui`.
+              '';
            };
-          in
-          nullOr (nonEmptyListOf fontType);
-      };
-
-      useXkbConfig = mkEnableOption "configure keymap from xserver keyboard settings.";
-
-      term = mkOption {
-        description = "Value for the TERM environment variable.";
-        type = types.nullOr types.str;
-        default = null;
-        example = "xterm-256color";
-      };
-
-      extraConfig = mkOption {
-        description = "Extra contents of the kmscon.conf file.";
-        type = types.lines;
-        default = "";
-        example = "font-size=14";
+          };
+        };
      };

      extraOptions = mkOption {
@ -124,30 +138,54 @@ in
        assertion = gettyCfg.loginOptions == null;
        message = "services.getty.loginOptions is not supported when services.kmscon is enabled.";
      }
+      {
+        assertion = (cfg.config ? font-name) -> config.fonts.fontconfig.enable;
+        message = "Font configuration for kmscon requires fontconfig to be enabled.";
+      }
+      {
+        assertion = cfg.config.hwaccel -> config.hardware.graphics.enable;
+        message = "Hardware acceleration for kmscon requires `hardware.graphics.enable` to be true.";
+      }
    ];

+    services.kmscon.config = lib.mkIf cfg.useXkbConfig (
+      lib.mapAttrs (_: lib.mkDefault) (
+        lib.filterAttrs (_: v: v != "") {
+          xkb-layout = config.services.xserver.xkb.layout;
+          xkb-model = config.services.xserver.xkb.model;
+          xkb-options = config.services.xserver.xkb.options;
+          xkb-variant = config.services.xserver.xkb.variant;
+        }
+      )
+    );
+
    environment.systemPackages = [ cfg.package ];
    systemd.packages = [ cfg.package ];

    systemd.services."kmsconvt@" = {
-      serviceConfig.ExecStart = [
-        "" # override upstream default with an empty ExecStart
-        (builtins.concatStringsSep " " (
-          [
-            "${cfg.package}/bin/kmscon"
-            "--configdir"
-            configDir
-            "--vt=%I"
-            "--no-switchvt"
-            "--login"
-          ]
-          ++ lib.optional (cfg.extraOptions != "") cfg.extraOptions
-          ++ [
-            "--"
-            loginScript
-          ]
-        ))
-      ];
+      serviceConfig = {
+        User = lib.mkIf (!cfg.config.libseat) "";
+        PAMName = lib.mkIf (!cfg.config.libseat) "";
+        Environment = [ "XKB_CONFIG_ROOT=${config.services.xserver.xkb.dir}" ];
+        ExecStart = [
+          "" # override upstream default with an empty ExecStart
+          (builtins.concatStringsSep " " (
+            [
+              "${cfg.package}/bin/kmscon"
+              "--configdir"
+              configDir
+              "--vt=%I"
+              "--no-switchvt"
+              "--login"
+            ]
+            ++ lib.optional (cfg.extraOptions != "") cfg.extraOptions
+            ++ [
+              "--"
+              loginScript
+            ]
+          ))
+        ];
+      };

      restartIfChanged = false;
      # logind spawns autovt@ttyN.service on VT switch; point it at kmscon
@ -156,40 +194,55 @@ in

    # tty1 is special: logind does not spawn autovt@tty1, it expects a static
    # pull-in via getty.target. With getty@ suppressed, we must replace it.
-    systemd.services."getty.target".wants = lib.mkIf (!config.services.displayManager.enable) [
+    systemd.targets.getty.wants = lib.mkIf (!config.services.displayManager.enable) [
      "kmsconvt@tty1.service"
    ];

    systemd.suppressedSystemUnits = [ "getty@.service" ];

-    services.kmscon.extraConfig = lib.concatLines (
-      optionals cfg.useXkbConfig (
-        lib.mapAttrsToList (n: v: "xkb-${n}=${v}") (
-          lib.filterAttrs (
-            n: v:
-            builtins.elem n [
-              "layout"
-              "model"
-              "options"
-              "variant"
-            ]
-            && v != ""
-          ) config.services.xserver.xkb
-        )
-      )
-      ++ optionals cfg.hwRender [
-        "drm"
-        "hwaccel"
-      ]
-      ++ optional (cfg.fonts != null) "font-name=${lib.concatMapStringsSep ", " (f: f.name) cfg.fonts}"
-      ++ optional (cfg.term != null) "term=${cfg.term}"
-    );
-
-    hardware.graphics.enable = mkIf cfg.hwRender true;
-
-    fonts = mkIf (cfg.fonts != null) {
-      fontconfig.enable = true;
-      packages = map (f: f.package) cfg.fonts;
+    security.pam.services.kmscon = lib.mkIf cfg.config.libseat {
+      useDefaultRules = false;
+      rules = {
+        auth = utils.pam.autoOrderRules [
+          {
+            name = "permit";
+            control = "required";
+            modulePath = "${config.security.pam.package}/lib/security/pam_permit.so";
+          }
+        ];
+        account = utils.pam.autoOrderRules [
+          {
+            name = "unix";
+            control = "required";
+            modulePath = "${config.security.pam.package}/lib/security/pam_unix.so";
+          }
+        ];
+        session = utils.pam.autoOrderRules [
+          {
+            name = "env";
+            control = "required";
+            modulePath = "${config.security.pam.package}/lib/security/pam_env.so";
+            settings = {
+              conffile = "/etc/pam/environment";
+              readenv = 0;
+            };
+          }
+          {
+            name = "unix";
+            control = "required";
+            modulePath = "${config.security.pam.package}/lib/security/pam_unix.so";
+          }
+          {
+            name = "systemd";
+            control = "optional";
+            modulePath = "${config.systemd.package}/lib/security/pam_systemd.so";
+            settings = {
+              type = "tty";
+              class = "greeter";
+            };
+          }
+        ];
+      };
    };
  };

--- a/nixos/modules/services/web-apps/immich.nix
+++ b/nixos/modules/services/web-apps/immich.nix
@ -380,8 +380,6 @@ in
      MACHINE_LEARNING_WORKERS = "1";
      MACHINE_LEARNING_WORKER_TIMEOUT = "120";
      MACHINE_LEARNING_CACHE_FOLDER = "/var/cache/immich";
-      # TODO: drop when insightface no longer unconditionally imports matplotlib
-      MPLCONFIGDIR = "/var/cache/immich";
      XDG_CACHE_HOME = "/var/cache/immich";
      IMMICH_HOST = "localhost";
      IMMICH_PORT = "3003";
--- a/nixos/tests/kmscon.nix
+++ b/nixos/tests/kmscon.nix
@ -14,17 +14,21 @@

      services.getty.autologinUser = "alice";

+      hardware.graphics.enable = true;
+
+      fonts = {
+        fontconfig.enable = true;
+        packages = [ pkgs.nerd-fonts.jetbrains-mono ];
+      };
+
      services.kmscon = {
        enable = true;
-        hwRender = true;
-        fonts = [
-          {
-            name = "JetBrainsMono Nerd Font";
-            package = pkgs.nerd-fonts.jetbrains-mono;
-          }
-        ];
-        term = "xterm-256color";
        package = pkgs.kmscon;
+        config = {
+          font-name = "JetBrainsMono Nerd Font";
+          hwaccel = true;
+          term = "kmscon";
+        };
      };
    };

@ -39,7 +43,7 @@
      machine.send_chars("echo $TERM | tee /tmp/term.txt\n")
      machine.wait_until_succeeds("test -s /tmp/term.txt")
      term = machine.succeed("cat /tmp/term.txt").strip()
-      assert term == "xterm-256color", f"Unexpected TERM value: {term!r}"
+      assert term == "kmscon", f"Unexpected TERM value: {term!r}"

      machine.screenshot("tty.png")
  '';
--- a/pkgs/applications/misc/zathura/core/default.nix
+++ b/pkgs/applications/misc/zathura/core/default.nix
@ -28,12 +28,16 @@
  librsvg,
  gtk-mac-integration,
  webp-pixbuf-loader,
+  versionCheckHook,
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "zathura";
  version = "2026.05.20";

+  strictDeps = true;
+  __structuredAttrs = true;
+
  src = fetchFromGitHub {
    owner = "pwmt";
    repo = "zathura";
@ -102,6 +106,9 @@ stdenv.mkDerivation (finalAttrs: {

  doCheck = !stdenv.hostPlatform.isDarwin;

+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+
  passthru.updateScript = gitUpdater { };

  meta = {
@ -110,5 +117,6 @@ stdenv.mkDerivation (finalAttrs: {
    license = lib.licenses.zlib;
    platforms = lib.platforms.unix;
    maintainers = with lib.maintainers; [ mithicspirit ];
+    mainProgram = "zathura";
  };
 })
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@ -1013,13 +1013,13 @@
    "vendorHash": "sha256-/4mktOn7qjWIkpyqeEW4vzY0w0pG+0qx7KRYBkE1IkQ="
  },
  "okta_okta": {
-    "hash": "sha256-Skp7GSfQSTBLOFoGlU3/TmzMqyZ8j7qYzlyuBYzBiB4=",
+    "hash": "sha256-3zuD+R1fUAFJ3pvzzHmN92RGGiWLYpnGOJXSsv89Les=",
    "homepage": "https://registry.terraform.io/providers/okta/okta",
    "owner": "okta",
    "repo": "terraform-provider-okta",
-    "rev": "v6.10.0",
+    "rev": "v6.11.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-0NaqVCibwiK7WY6hIFGd2kB/okyh6ZsZ+BAe5mGP38A="
+    "vendorHash": "sha256-/IbzilmyVTZh7qWogtXd+/Y7UJdjsQaf7Yjhi1fU1Vc="
  },
  "oktadeveloper_oktaasa": {
    "hash": "sha256-2LhxgowqKvDDDOwdznusL52p2DKP+UiXALHcs9ZQd0U=",
--- a/pkgs/applications/video/mplayer/default.nix
+++ b/pkgs/applications/video/mplayer/default.nix
@ -66,6 +66,7 @@
  libjpeg,
  useUnfreeCodecs ? false,
  buildPackages,
+  versionCheckHook,
 }:

 assert xineramaSupport -> x11Support;
@ -117,7 +118,7 @@ let

 in

-stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
  pname = "mplayer";
  version = "1.5-unstable-2024-12-21";

@ -128,6 +129,7 @@ stdenv.mkDerivation {
  };

  prePatch = ''
+    echo "${finalAttrs.version}" > VERSION
    sed -i /^_install_strip/d configure

    rm -rf ffmpeg
@ -137,6 +139,9 @@ stdenv.mkDerivation {
  nativeBuildInputs = [
    pkg-config
    yasm
+  ]
+  ++ lib.optionals cacaSupport [
+    libcaca # caca-config
  ];
  buildInputs = [
    freetype
@ -176,46 +181,46 @@ stdenv.mkDerivation {
  ++ lib.optional bs2bSupport libbs2b
  ++ lib.optional v4lSupport libv4l;

+  strictDeps = true;
+
  configurePlatforms = [ ];
  configureFlags = [
-    "--enable-freetype"
-    (if fontconfigSupport then "--enable-fontconfig" else "--disable-fontconfig")
-    (if x11Support then "--enable-x11 --enable-gl" else "--disable-x11 --disable-gl")
-    (if xineramaSupport then "--enable-xinerama" else "--disable-xinerama")
-    (if xvSupport then "--enable-xv" else "--disable-xv")
-    (if alsaSupport then "--enable-alsa" else "--disable-alsa")
-    (if screenSaverSupport then "--enable-xss" else "--disable-xss")
-    (if vdpauSupport then "--enable-vdpau" else "--disable-vdpau")
-    (if cddaSupport then "--enable-cdparanoia" else "--disable-cdparanoia")
-    (if dvdnavSupport then "--enable-dvdnav" else "--disable-dvdnav")
-    (if bluraySupport then "--enable-bluray" else "--disable-bluray")
-    (if amrSupport then "--enable-libopencore_amrnb" else "--disable-libopencore_amrnb")
-    (if cacaSupport then "--enable-caca" else "--disable-caca")
-    (
-      if lameSupport then
-        "--enable-mp3lame --disable-mp3lame-lavc"
-      else
-        "--disable-mp3lame --enable-mp3lame-lavc"
-    )
-    (if speexSupport then "--enable-speex" else "--disable-speex")
-    (if theoraSupport then "--enable-theora" else "--disable-theora")
-    (if x264Support then "--enable-x264 --disable-x264-lavc" else "--disable-x264 --enable-x264-lavc")
-    (if jackaudioSupport then "" else "--disable-jack")
-    (if pulseSupport then "--enable-pulse" else "--disable-pulse")
-    (
-      if v4lSupport then
-        "--enable-v4l2 --enable-tv-v4l2 --enable-radio --enable-radio-v4l2 --enable-radio-capture"
-      else
-        "--disable-v4l2 --disable-tv-v4l2 --disable-radio --disable-radio-v4l2 --disable-radio-capture"
-    )
-    "--disable-xanim"
-    "--disable-xvid --disable-xvid-lavc"
-    "--disable-ossaudio"
-    "--disable-ffmpeg_a"
+    (lib.enableFeature true "freetype")
+    (lib.enableFeature fontconfigSupport "fontconfig")
+    (lib.enableFeature x11Support "x11")
+    (lib.enableFeature x11Support "gl")
+    (lib.enableFeature xineramaSupport "xinerama")
+    (lib.enableFeature xvSupport "xv")
+    (lib.enableFeature alsaSupport "alsa")
+    (lib.enableFeature screenSaverSupport "xss")
+    (lib.enableFeature vdpauSupport "vdpau")
+    (lib.enableFeature cddaSupport "cdparanoia")
+    (lib.enableFeature dvdnavSupport "dvdnav")
+    (lib.enableFeature bluraySupport "bluray")
+    (lib.enableFeature amrSupport "libopencore_amrnb")
+    (lib.enableFeature cacaSupport "caca")
+    (lib.enableFeature lameSupport "mp3lame")
+    (lib.enableFeature (!lameSupport) "mp3lame-lavc")
+    (lib.enableFeature speexSupport "speex")
+    (lib.enableFeature theoraSupport "theora")
+    (lib.enableFeature x264Support "x264")
+    (lib.enableFeature (!x264Support) "x264-lavc")
+    (lib.enableFeature pulseSupport "pulse")
+    (lib.enableFeature v4lSupport "v4l2")
+    (lib.enableFeature v4lSupport "tv-v4l2")
+    (lib.enableFeature v4lSupport "radio")
+    (lib.enableFeature v4lSupport "radio-v4l2")
+    (lib.enableFeature v4lSupport "radio-capture")
+    (lib.enableFeature false "xanim")
+    (lib.enableFeature false "xvid")
+    (lib.enableFeature false "xvid-lavc")
+    (lib.enableFeature false "ossaudio")
+    (lib.enableFeature false "ffmpeg_a")
    "--yasm=${buildPackages.yasm}/bin/yasm"
    # Note, the `target` vs `host` confusion is intentional.
    "--target=${stdenv.hostPlatform.config}"
  ]
+  ++ lib.optional (!jackaudioSupport) "--disable-jack"
  ++ lib.optional (useUnfreeCodecs && codecs != null && !crossBuild) "--codecsdir=${codecs}"
  ++ lib.optional (stdenv.hostPlatform.isx86 && !crossBuild) "--enable-runtime-cpudetection"
  ++ lib.optional fribidiSupport "--enable-fribidi"
@ -280,6 +285,12 @@ stdenv.mkDerivation {
    fi
  '';

+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "--help";
+  doInstallCheck = true;
+
+  __structuredAttrs = true;
+
  meta = {
    description = "Movie player that supports many video formats";
    homepage = "http://mplayerhq.hu";
@ -294,4 +305,4 @@ stdenv.mkDerivation {
      "aarch64-linux"
    ];
  };
-}
+})
--- a/pkgs/by-name/ad/adguardian/package.nix
+++ b/pkgs/by-name/ad/adguardian/package.nix
@ -6,16 +6,17 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "adguardian";
-  version = "1.6.0";
+  version = "1.6.1";
+  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "Lissy93";
    repo = "AdGuardian-Term";
    tag = finalAttrs.version;
-    hash = "sha256-WxrSmCwLnXXs5g/hN3xWE66P5n0RD/L9MJpf5N2iNtY=";
+    hash = "sha256-jqjdYkB48ggLsmKlwiehkGHZ6EJhJYXGuVmZH7R0MlE=";
  };

-  cargoHash = "sha256-yPDysaslL/7N60eZ/hqZl5ZXIsof/pvlgHYfW1mIWtI=";
+  cargoHash = "sha256-ON3txhOQVuI3Th8FZ7yC4sd7L1fpYCD6XyIHbH5/Q4k=";

  meta = {
    description = "Terminal-based, real-time traffic monitoring and statistics for your AdGuard Home instance";
--- a/pkgs/by-name/af/afsctool/package.nix
+++ b/pkgs/by-name/af/afsctool/package.nix
@ -17,7 +17,12 @@ stdenv.mkDerivation rec {
    owner = "RJVB";
    repo = "afsctool";
    tag = "v${version}";
-    hash = "sha256-cZ0P9cygj+5GgkDRpQk7P9z8zh087fpVfrYXMRRVUAI=";
+    fetchSubmodules = true;
+    gitConfigFile = builtins.toFile "gitconfig" ''
+      [url "https://github.com/"]
+      insteadOf = "git://github.com/"
+    '';
+    hash = "sha256-irWPQnnV5mHZS7pw9PAWp6MO/3MahKaOIZCr6awcwEg=";
  };

  cmakeFlags = [
--- a/pkgs/by-name/ba/babl/package.nix
+++ b/pkgs/by-name/ba/babl/package.nix
@ -31,6 +31,10 @@ stdenv.mkDerivation (finalAttrs: {
    ./dev-prefix.patch
  ];

+  depsBuildBuild = [
+    pkg-config
+  ];
+
  nativeBuildInputs = [
    meson
    ninja
@ -44,6 +48,8 @@ stdenv.mkDerivation (finalAttrs: {
    lcms2
  ];

+  strictDeps = true;
+
  mesonFlags = [
    "-Dprefix-dev=${placeholder "dev"}"
    # On Linux, this would be disabled by default but we have -Dauto_features=enabled.
@ -61,6 +67,8 @@ stdenv.mkDerivation (finalAttrs: {
    moveToOutput "share/doc" "$devdoc"
  '';

+  __structuredAttrs = true;
+
  meta = {
    description = "Image pixel format conversion library";
    mainProgram = "babl";
--- a/pkgs/by-name/bi/bitwarden-cli/package.nix
+++ b/pkgs/by-name/bi/bitwarden-cli/package.nix
@ -14,13 +14,13 @@

 buildNpmPackage (finalAttrs: {
  pname = "bitwarden-cli";
-  version = "2026.4.2";
+  version = "2026.5.0";

  src = fetchFromGitHub {
    owner = "bitwarden";
    repo = "clients";
    tag = "cli-v${finalAttrs.version}";
-    hash = "sha256-8UDzW93O+AvMGXcVHe1PTvYvmXewl/bXsxIdjoGRtcQ=";
+    hash = "sha256-R00wt5W4kKmFIODEaGoUqDwfGyHH/2PpiRaC8Gq3d88=";
  };

  postPatch = ''
@ -38,7 +38,7 @@ buildNpmPackage (finalAttrs: {
  nodejs = nodejs_22;
  npmDepsFetcherVersion = 2;

-  npmDepsHash = "sha256-3RQ0HRsLQlXMeJIHAPKbZsGi6I/70pSIg8NM/3uJvUo=";
+  npmDepsHash = "sha256-SU4HjfNshjRwa8mXPnmG2xVIwYkbQ7g8j3NZ43Ap76k=";

  nativeBuildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
    perl
--- a/pkgs/by-name/bo/bobgen/package.nix
+++ b/pkgs/by-name/bo/bobgen/package.nix
@ -0,0 +1,40 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  nix-update-script,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "bobgen";
+  version = "0.42.0";
+
+  src = fetchFromGitHub {
+    owner = "stephenafamo";
+    repo = "bob";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-reTvQDUqsRmdl0RyCWoUoF8dc/ZrSZxR8x8++VC4H3A=";
+  };
+
+  vendorHash = "sha256-Jqlah37+tfNqsgeL/MnbVUmSfU2JWMJDb9AQrEqXnXU=";
+
+  subPackages = [
+    "gen/bobgen-sql"
+    "gen/bobgen-psql"
+    "gen/bobgen-mysql"
+    "gen/bobgen-sqlite"
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "SQL query builder and ORM/Factory generator for Go";
+    homepage = "https://github.com/stephenafamo/bob";
+    changelog = "https://github.com/stephenafamo/bob/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [
+      spotdemo4
+    ];
+    platforms = lib.platforms.all;
+  };
+})
--- a/pkgs/by-name/ch/chameleonultragui/git_hashes.json
+++ b/pkgs/by-name/ch/chameleonultragui/git_hashes.json
@ -0,0 +1,5 @@
+{
+    "file_saver": "sha256-3T4UVDkhjTmLakQqJ0/WCP9NOQlONHAzeK+y5gY7qa8=",
+    "flutter_libserialport": "sha256-Ksj5U94kCoe5FQ85m4Ui0t+Z4ME94E6TcDq45Xms0dE=",
+    "usb_serial": "sha256-sqGd5ECWVkqsW5ZGlnCV1veHsp0p7inBX2240Xe6NiU="
+}
--- a/pkgs/by-name/ch/chameleonultragui/package.nix
+++ b/pkgs/by-name/ch/chameleonultragui/package.nix
@ -0,0 +1,56 @@
+{
+  lib,
+  flutter335,
+  fetchFromGitHub,
+  autoPatchelfHook,
+  zenity,
+  ninja,
+}:
+
+flutter335.buildFlutterApplication rec {
+  pname = "chameleonultragui";
+  version = "1.3";
+
+  src = fetchFromGitHub {
+    owner = "GameTec-live";
+    repo = "ChameleonUltraGUI";
+    tag = version;
+    hash = "sha256-9Hwjx1nt/QD520eLMAB5xyFjOGfjZSwS83ARNn8GsFo=";
+  };
+
+  sourceRoot = "${src.name}/chameleonultragui";
+
+  # curl https://raw.githubusercontent.com/GameTec-live/ChameleonUltraGUI/main/chameleonultragui/pubspec.lock | yq > pubspec.lock.json
+  pubspecLock = lib.importJSON ./pubspec.lock.json;
+  gitHashes = lib.importJSON ./git_hashes.json;
+
+  nativeBuildInputs = [
+    autoPatchelfHook
+  ];
+
+  buildInputs = [
+    zenity
+    ninja
+  ];
+
+  postPatch = ''
+    substituteInPlace linux/main.cc \
+      --replace-fail '"../shared", "librecovery.so"' '"lib", "librecovery.so"'
+  '';
+
+  postInstall = ''
+    install -Dm0644 aur/chameleonultragui.desktop $out/share/applications/chameleonultragui.desktop
+    install -Dm0644 aur/chameleonultragui.png $out/share/pixmaps/chameleonultragui.png
+    install -Dm0644 build/linux/*/release/shared/librecovery.so $out/app/chameleonultragui/lib
+  '';
+
+  meta = {
+    description = "Cross platform GUI for the Chameleon Ultra written in flutter";
+    homepage = "https://github.com/GameTec-live/ChameleonUltraGUI";
+    changelog = "https://github.com/GameTec-live/ChameleonUltraGUI/releases/${version}";
+    license = lib.licenses.gpl3Only;
+    platforms = lib.platforms.linux;
+    mainProgram = "chameleonultragui";
+    maintainers = with lib.maintainers; [ wilaz ];
+  };
+}
--- a/pkgs/by-name/ch/chameleonultragui/pubspec.lock.json
+++ b/pkgs/by-name/ch/chameleonultragui/pubspec.lock.json
--- a/pkgs/by-name/cl/clippy-copy/package.nix
+++ b/pkgs/by-name/cl/clippy-copy/package.nix
@ -0,0 +1,49 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  versionCheckHook,
+  nix-update-script,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "clippy-copy";
+  version = "1.6.9";
+
+  src = fetchFromGitHub {
+    owner = "neilberkman";
+    repo = "clippy";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-8OdT+R4dvJCLhelIAsAgVoWGGwmWueTsiJFpCm1uQEc=";
+  };
+
+  vendorHash = "sha256-7do+KgoiIocS+mq2hsgv3NOd+TjMl2I9ew2Emx3/Bbg=";
+
+  ldflags = [
+    "-s"
+    "-X=github.com/neilberkman/clippy/cmd/internal/common.Version=${finalAttrs.version}"
+    "-X=github.com/neilberkman/clippy/cmd/internal/common.Commit=${finalAttrs.src.tag}"
+    "-X=github.com/neilberkman/clippy/cmd/internal/common.Date=1970-01-01T00:00:00Z"
+  ];
+
+  # Tests require access to the system clipboard (unavailable in sandbox)
+  doCheck = false;
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "--version";
+
+  passthru.updateScript = nix-update-script { };
+
+  __structuredAttrs = true;
+
+  meta = {
+    description = "Clipboard tool supporting both text and binary files";
+    homepage = "https://github.com/neilberkman/clippy";
+    changelog = "https://github.com/neilberkman/clippy/blob/${finalAttrs.src.tag}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ m4r1vs ];
+    mainProgram = "clippy";
+    platforms = lib.platforms.darwin;
+  };
+})
--- a/pkgs/by-name/cr/crush/package.nix
+++ b/pkgs/by-name/cr/crush/package.nix
@ -11,16 +11,16 @@

 buildGo126Module (finalAttrs: {
  pname = "crush";
-  version = "0.70.0";
+  version = "0.74.1";

  src = fetchFromGitHub {
    owner = "charmbracelet";
    repo = "crush";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-rLLgGes902mZvya2rcTCNji0FR2AlMzA4vdYieHZIoc=";
+    hash = "sha256-JnELv8Q2GlOKhYbBRUDY8m8XuyyoD71Tw5qbnpbNxVY=";
  };

-  vendorHash = "sha256-3fYDFzBN5lDDnc2rziHOc7SMvesdAevsxIY2xUU3hms=";
+  vendorHash = "sha256-D2GJ3ORyJy5Dn0MZJWgB3Wv1FyDoAWqLI3W0yU1q5Lw=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/do/doggo/package.nix
+++ b/pkgs/by-name/do/doggo/package.nix
@ -9,13 +9,13 @@

 buildGoModule (finalAttrs: {
  pname = "doggo";
-  version = "1.1.6";
+  version = "1.1.7";

  src = fetchFromGitHub {
    owner = "mr-karan";
    repo = "doggo";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-NPbBQ11QuNKDtNnh8OoVpSsnC62078HYtE4E6esf6Hs=";
+    hash = "sha256-Q4a859MoVSZ4hjXwaIekL1En6xpd4bZPQ9NGAkxSPto=";
  };

  vendorHash = "sha256-JMyGYG3cLOZmH9EcLPe+5+ViHv7Z7brLj5uqJrPYm7A=";
--- a/pkgs/by-name/dw/dwproton-bin/package.nix
+++ b/pkgs/by-name/dw/dwproton-bin/package.nix
@ -11,11 +11,11 @@ proton-ge-bin.overrideAttrs (
    inherit steamDisplayName;

    pname = "dwproton-bin";
-    version = "dwproton-11.0-2";
+    version = "dwproton-11.0-3";

    src = fetchzip {
      url = "https://dawn.wine/dawn-winery/dwproton/releases/download/${finalAttrs.version}/${finalAttrs.version}-x86_64.tar.xz";
-      hash = "sha256-3AxBr8fQh4bbAsdSSZuyQR2GOz78vdhC6jJbLmiYEXY=";
+      hash = "sha256-e/YzKvwe30KveLHRUsntKDwzdEbr7a3Wfkqe/pu93WE=";
    };

    preFixup = ''
--- a/pkgs/by-name/es/eslint/package-lock.json
+++ b/pkgs/by-name/es/eslint/package-lock.json
--- a/pkgs/by-name/es/eslint/package.nix
+++ b/pkgs/by-name/es/eslint/package.nix
@ -6,13 +6,13 @@
 }:
 buildNpmPackage (finalAttrs: {
  pname = "eslint";
-  version = "10.3.0";
+  version = "10.4.0";

  src = fetchFromGitHub {
    owner = "eslint";
    repo = "eslint";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-b0Gv7soMPTsbMOZLqMe5vMCPwInk9AFusepf2jJH/Ng=";
+    hash = "sha256-8CG4oeqZPhVoG/Q8jTA5GBSzOwrQoBSNIYHnGcqbjsc=";
  };

  # NOTE: Generating lock-file
@ -24,7 +24,7 @@ buildNpmPackage (finalAttrs: {
    cp ${./package-lock.json} package-lock.json
  '';

-  npmDepsHash = "sha256-gi/aiWEzbf91LNTB2kMx9Iq4PoVORLs3mBjSSt2mFiQ=";
+  npmDepsHash = "sha256-UGx3wR+PUxUvabGLxf5Phg+RzETZnbcO0IXLr+jHzUI=";
  npmInstallFlags = [ "--omit=dev" ];

  dontNpmBuild = true;
--- a/pkgs/by-name/fa/fahclient/package.nix
+++ b/pkgs/by-name/fa/fahclient/package.nix
@ -6,7 +6,7 @@
  openssl,
  re2,
  libevent,
-  git,
+  gitMinimal,
  versionCheckHook,
  zlib,
  expat,
@ -16,30 +16,32 @@
 }:
 let
  pname = "fah-client";
-  version = "8.5.3";
+  version = "8.5.6";

  cbangSrc = fetchFromGitHub {
    owner = "cauldrondevelopmentllc";
    repo = "cbang";
    tag = "bastet-v${version}";
-    hash = "sha256-RU13qT9UQ1uNsRNBaEGSWTgNmE3f72veabl2OmKK6Z0=";
+    hash = "sha256-oh3q/gmAKx8BHoaw6Dxkd0GoxYyJ6is8uCKcivQVv2g=";
  };

  fah-client = stdenv.mkDerivation {
    inherit pname version;
+    __structuredAttrs = true;
+    strictDeps = true;

    src = fetchFromGitHub {
      owner = "FoldingAtHome";
      repo = "fah-client-bastet";
      tag = "v${version}";
-      hash = "sha256-PBguylWnYU5iTzrjWA1B5Iwb57JpoWGPSpjgNJP3aoI=";
+      hash = "sha256-B5h2eXSCvYG5juNkBRBh+KUsm26O9JTI1S7yKkHgZ7c=";
    };

    nativeBuildInputs = [
-      scons
-      re2
+      gitMinimal
      libevent
-      git
+      re2
+      scons
    ];

    buildInputs = [ openssl ];
--- a/pkgs/by-name/fi/findent/package.nix
+++ b/pkgs/by-name/fi/findent/package.nix
@ -6,11 +6,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "findent";
-  version = "4.3.6";
+  version = "4.3.7";

  src = fetchurl {
    url = "mirror://sourceforge/findent/findent-${finalAttrs.version}.tar.gz";
-    hash = "sha256-ctg02P8P3R27lCpv3tILSZ5ikn2Va25jHOWIuRfIONQ=";
+    hash = "sha256-4tqLjAwZYbK8nc5MbKp5ytCSRdNjiL6h/ALE7B/YuZg=";
  };

  enableParallelBuilding = true;
--- a/pkgs/by-name/fw/fwupd/0001-Install-fwupdplugin-to-out.patch
+++ b/pkgs/by-name/fw/fwupd/0001-Install-fwupdplugin-to-out.patch
@ -8,10 +8,10 @@ Subject: [PATCH] Install fwupdplugin to out
 1 file changed, 1 insertion(+), 1 deletion(-)

 diff --git a/meson.build b/meson.build
-index 1a56d3308..c7bf2c9aa 100644
+index 0d756bc0e748ba1c7be64bb9357f28fe8c5342e6..0cfca8e45b7ed6cc63be470ac0df916639ef52c4 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -734,7 +734,7 @@ if build_standalone
+@@ -719,7 +719,7 @@ if build_standalone
   if host_machine.system() == 'windows'
     libdir_pkg = bindir
   else
--- a/pkgs/by-name/fw/fwupd/0002-Add-output-for-installed-tests.patch
+++ b/pkgs/by-name/fw/fwupd/0002-Add-output-for-installed-tests.patch
@ -11,7 +11,7 @@ Subject: [PATCH] Add output for installed tests
 4 files changed, 10 insertions(+), 4 deletions(-)

 diff --git a/data/tests/meson.build b/data/tests/meson.build
-index e15cab2fa..bad033dbf 100644
+index 377ba2ccaa5e13a87443cbe65406eb5a9a3af79b..2dfb5f251383464c38e2f3202c9dfb1107ac7798 100644
 --- a/data/tests/meson.build
 +++ b/data/tests/meson.build
@@ -139,7 +139,7 @@ configure_file(
@ -22,12 +22,12 @@ index e15cab2fa..bad033dbf 100644
 +  install_dir: join_paths(get_option('installed_test_prefix'), 'etc', 'fwupd', 'remotes.d'),
 )
 
- if umockdev_integration_tests.allowed()
+ if umockdev.found()
 diff --git a/meson.build b/meson.build
-index c7bf2c9aa..bf77bf6d6 100644
+index 0cfca8e45b7ed6cc63be470ac0df916639ef52c4..1561d1837a73425d9dda510d0ba25d16f92ed7f7 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -241,8 +241,8 @@ else
+@@ -243,8 +243,8 @@ else
   includedir = join_paths(prefix, get_option('includedir'))
   sysconfdir = join_paths(prefix, get_option('sysconfdir'))
   localstatedir = join_paths(prefix, get_option('localstatedir'))
@ -38,7 +38,7 @@ index c7bf2c9aa..bf77bf6d6 100644
   daemon_dir = join_paths(libexecdir, 'fwupd')
 endif
 mandir = join_paths(prefix, get_option('mandir'))
-@@ -722,6 +722,7 @@ gnome = import('gnome')
+@@ -707,6 +707,7 @@ gnome = import('gnome')
 i18n = import('i18n')
 
 conf.set_quoted('FWUPD_PREFIX', prefix)
@ -47,10 +47,10 @@ index c7bf2c9aa..bf77bf6d6 100644
 conf.set_quoted('FWUPD_LIBDIR', libdir)
 conf.set_quoted('FWUPD_LIBEXECDIR', libexecdir)
 diff --git a/meson_options.txt b/meson_options.txt
-index eb57391eb..420997355 100644
+index 6fe15e8beb8a85acdaca15f212bd3a917990ced2..b89ba371cee9dccf8457414f316ca697ef33216a 100644
 --- a/meson_options.txt
 +++ b/meson_options.txt
-@@ -198,6 +198,11 @@ option(
+@@ -193,6 +193,11 @@ option(
   value: 'fwupd-refresh',
   description: 'User account to use for fwupd-refresh.service (empty for DynamicUser)',
 )
@ -63,7 +63,7 @@ index eb57391eb..420997355 100644
   'tests',
   type: 'boolean',
 diff --git a/src/tests/host-emulate/meson.build b/src/tests/host-emulate/meson.build
-index c36da65cd..f0b70d4d6 100644
+index c36da65cd67e6081a758ed2ab7327276fb82d804..f0b70d4d68de6f534f1c1ecd37e51619ad1d85e7 100644
 --- a/src/tests/host-emulate/meson.build
 +++ b/src/tests/host-emulate/meson.build
@@ -9,7 +9,7 @@ if build_standalone
--- a/pkgs/by-name/fw/fwupd/0003-Add-option-for-installation-sysconfdir.patch
+++ b/pkgs/by-name/fw/fwupd/0003-Add-option-for-installation-sysconfdir.patch
@ -7,15 +7,15 @@ Subject: [PATCH] Add option for installation sysconfdir
 data/bios-settings.d/meson.build |  2 +-
 data/meson.build                 |  2 +-
 data/pki/meson.build             |  4 ++--
- data/remotes.d/meson.build       |  8 ++++----
+ data/remotes.d/meson.build       | 10 +++++-----
 docs/meson.build                 | 16 ++++++++--------
 meson.build                      |  6 ++++++
 meson_options.txt                |  6 ++++++
 plugins/uefi-capsule/meson.build |  4 ++--
- 8 files changed, 30 insertions(+), 18 deletions(-)
+ 8 files changed, 31 insertions(+), 19 deletions(-)

 diff --git a/data/bios-settings.d/meson.build b/data/bios-settings.d/meson.build
-index 2a2a07016..99df55afb 100644
+index 2a2a0701612e54a838d4d72f2bb00a793a31e0a3..99df55afb7636b090e2f57a5033bec6fe0017c15 100644
 --- a/data/bios-settings.d/meson.build
 +++ b/data/bios-settings.d/meson.build
@@ -2,6 +2,6 @@ if build_standalone and host_machine.system() == 'linux'
@ -27,7 +27,7 @@ index 2a2a07016..99df55afb 100644
   )
 endif
 diff --git a/data/meson.build b/data/meson.build
-index 70d08c55e..5a5d8bf46 100644
+index 74a9104c333330ce2aacaa7cac45c87d6c5c8e53..3d9cc87b443078888c6e72075095d644a9258dab 100644
 --- a/data/meson.build
 +++ b/data/meson.build
@@ -29,7 +29,7 @@ if build_standalone
@ -38,27 +38,26 @@ index 70d08c55e..5a5d8bf46 100644
 +    install_dir: join_paths(sysconfdir_install, 'fwupd'),
     install_mode: 'rw-r-----',
   )
-   plugin_quirks += files('cfi.quirk', 'ds20.quirk', 'power.quirk', 'vendors.quirk')
+   plugin_quirks += files(
 diff --git a/data/pki/meson.build b/data/pki/meson.build
-index b87068405..21f59753a 100644
+index 7574aebc60617d8d8456c210bb19fcaf25263e74..05e6642454123e715e2f80501cf1919f96905fde 100644
 --- a/data/pki/meson.build
 +++ b/data/pki/meson.build
-@@ -8,11 +8,11 @@ if supported_pkcs7
-   install_data(
-     ['LVFS-CA.pem', 'LVFS-CA-2025PQ.pem'],
-     install_tag: 'runtime',
-    install_dir: join_paths(sysconfdir, 'pki', 'fwupd'),
-+    install_dir: join_paths(sysconfdir_install, 'pki', 'fwupd'),
-   )
-   install_data(
-     ['LVFS-CA.pem', 'LVFS-CA-2025PQ.pem'],
-     install_tag: 'runtime',
-    install_dir: join_paths(sysconfdir, 'pki', 'fwupd-metadata'),
-+    install_dir: join_paths(sysconfdir_install, 'pki', 'fwupd-metadata'),
-   )
- endif
+@@ -1,10 +1,10 @@
+ install_data(
+   ['LVFS-CA.pem', 'LVFS-CA-2025PQ.pem'],
+   install_tag: 'runtime',
+-  install_dir: join_paths(sysconfdir, 'pki', 'fwupd'),
+  install_dir: join_paths(sysconfdir_install, 'pki', 'fwupd'),
+ )
+ install_data(
+   ['LVFS-CA.pem', 'LVFS-CA-2025PQ.pem'],
+   install_tag: 'runtime',
+-  install_dir: join_paths(sysconfdir, 'pki', 'fwupd-metadata'),
+  install_dir: join_paths(sysconfdir_install, 'pki', 'fwupd-metadata'),
+ )
 diff --git a/data/remotes.d/meson.build b/data/remotes.d/meson.build
-index b8d24c267..0dd4ad32a 100644
+index c0b4862ce6e13861da967cc2b8442849f63f0520..8bd00e9dbefd0ff386ad61f08ec861e7ad005090 100644
 --- a/data/remotes.d/meson.build
 +++ b/data/remotes.d/meson.build
@@ -12,7 +12,7 @@ if build_standalone and get_option('lvfs') != 'false'
@ -75,11 +74,20 @@ index b8d24c267..0dd4ad32a 100644
     install: true,
     install_tag: 'runtime',
 -    install_dir: join_paths(sysconfdir, 'fwupd', 'remotes.d'),
+    install_dir: join_paths(sysconfdir_install, 'fwupd', 'remotes.d'),
+   )
+   configure_file(
+     input: 'lvfs-embargo.conf',
+@@ -28,7 +28,7 @@ if build_standalone and get_option('lvfs') != 'false'
+     configuration: con3,
+     install: true,
+     install_tag: 'runtime',
+-    install_dir: join_paths(sysconfdir, 'fwupd', 'remotes.d'),
 +    install_dir: join_paths(sysconfdir_install, 'fwupd', 'remotes.d'),
   )
   i18n.merge_file(
     input: 'lvfs.metainfo.xml',
-@@ -59,7 +59,7 @@ configure_file(
+@@ -67,7 +67,7 @@ configure_file(
   configuration: con2,
   install: get_option('vendor_metadata'),
   install_tag: 'runtime',
@ -88,7 +96,7 @@ index b8d24c267..0dd4ad32a 100644
 )
 configure_file(
   input: 'vendor-directory.conf',
-@@ -67,5 +67,5 @@ configure_file(
+@@ -75,5 +75,5 @@ configure_file(
   configuration: con2,
   install: true,
   install_tag: 'runtime',
@ -96,7 +104,7 @@ index b8d24c267..0dd4ad32a 100644
 +  install_dir: join_paths(sysconfdir_install, 'fwupd', 'remotes.d'),
 )
 diff --git a/docs/meson.build b/docs/meson.build
-index b4d48b086..8a1f8fc8c 100644
+index b4d48b086baf03a2f713ab9c7cb17e60b2a9d12b..8a1f8fc8ca9fc21f278575233348ca918635c161 100644
 --- a/docs/meson.build
 +++ b/docs/meson.build
@@ -196,7 +196,7 @@ if build_docs
@ -161,10 +169,10 @@ index b4d48b086..8a1f8fc8c 100644
   )
 endif
 diff --git a/meson.build b/meson.build
-index bf77bf6d6..f1f51e841 100644
+index 1561d1837a73425d9dda510d0ba25d16f92ed7f7..917770b38abb86056d6c42fa9c99dedf27ebe999 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -248,6 +248,12 @@ endif
+@@ -250,6 +250,12 @@ endif
 mandir = join_paths(prefix, get_option('mandir'))
 localedir = join_paths(prefix, get_option('localedir'))
 
@ -178,7 +186,7 @@ index bf77bf6d6..f1f51e841 100644
 gio = dependency(
   'gio-2.0',
 diff --git a/meson_options.txt b/meson_options.txt
-index 420997355..67b3058d5 100644
+index b89ba371cee9dccf8457414f316ca697ef33216a..0dc66c4ec1ecb1547a21c4ec673ac1032462d91e 100644
 --- a/meson_options.txt
 +++ b/meson_options.txt
@@ -14,6 +14,12 @@ option(
@ -195,7 +203,7 @@ index 420997355..67b3058d5 100644
   'build',
   type: 'combo',
 diff --git a/plugins/uefi-capsule/meson.build b/plugins/uefi-capsule/meson.build
-index f104f36d7..30356ea53 100644
+index c2eb3b4300437d0d6b87d934441e69c306ba99a8..5c90240170c11ad3c75840ab6913018b6f7de85f 100644
 --- a/plugins/uefi-capsule/meson.build
 +++ b/plugins/uefi-capsule/meson.build
@@ -23,7 +23,7 @@ if host_machine.system() == 'linux'
--- a/pkgs/by-name/fw/fwupd/0004-Get-the-efi-app-from-fwupd-efi.patch
+++ b/pkgs/by-name/fw/fwupd/0004-Get-the-efi-app-from-fwupd-efi.patch
@ -8,10 +8,10 @@ Subject: [PATCH] Get the efi app from fwupd-efi
 1 file changed, 1 insertion(+), 1 deletion(-)

 diff --git a/meson.build b/meson.build
-index f1f51e841..aaefe55d9 100644
+index 917770b38abb86056d6c42fa9c99dedf27ebe999..f52f3ec12dd9def0a68ea1645f7d508acbb731b9 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -646,7 +646,7 @@ endif
+@@ -651,7 +651,7 @@ endif
 
 # EFI
 if build_standalone
--- a/pkgs/by-name/fw/fwupd/package.nix
+++ b/pkgs/by-name/fw/fwupd/package.nix
@ -3,7 +3,6 @@
 {
  lib,
  stdenv,
-  fetchpatch,

  # runPythonCommand
  runCommand,
@ -37,7 +36,6 @@
  fwupd-efi,
  gnutls,
  gusb,
-  libcbor,
  libdrm,
  libgudev,
  libjcat,
@ -55,7 +53,6 @@
  tpm2-tss,
  valgrind,
  xz, # for liblzma
-  flashrom,

  # mesonFlags
  hwdata,
@ -76,16 +73,12 @@
  nixosTests,
  nix-update-script,

-  enableFlashrom ? false,
  enablePassim ? false,
 }:

 let
  isx86 = stdenv.hostPlatform.isx86;

-  # Experimental
-  haveFlashrom = isx86 && enableFlashrom;
-
  runPythonCommand =
    name: buildCommandPython:

@ -129,7 +122,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "fwupd";
-  version = "2.1.1";
+  version = "2.1.4";

  # libfwupd goes to lib
  # daemon, plug-ins and libfwupdplugin go to out
@ -147,7 +140,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "fwupd";
    repo = "fwupd";
    tag = finalAttrs.version;
-    hash = "sha256-pb5BBA+3KTeZZ8WyNDaY9EKNTxp4MT/3G/MEgQ+Nysk=";
+    hash = "sha256-bKBEZR7Wzi9nZYH+KAzh1q+sh2t2Gl3puQmeogNdIsE=";
  };

  patches = [
@ -168,18 +161,6 @@ stdenv.mkDerivation (finalAttrs: {

    # EFI capsule is located in fwupd-efi now.
    ./0004-Get-the-efi-app-from-fwupd-efi.patch
-
-    # FIXME: remove patches that fix CI on aarch64 after next release
-    (fetchpatch {
-      url = "https://github.com/fwupd/fwupd/commit/b3d721360faa4de7dd6960d8f9f8f13aa310715f.patch";
-      sha256 = "sha256-x37QCK7XBzUUjUj1m3jaNe1qvaqtszB9DGFyF8gC3Ig=";
-      name = "fix-mtdram-test-for-missing-kernel-module.patch";
-    })
-    (fetchpatch {
-      url = "https://github.com/fwupd/fwupd/commit/9ad8b76dc6c5af005a2c712ae3a6f352b51e9eea.patch";
-      sha256 = "sha256-h9zLTHeJbfDoamdfICKc0ohQ51yJC4I/CK0SQ4H6rRk=";
-      name = "fix-test_get_devices-on-non-x86-architectures.patch";
-    })
  ];

  postPatch = ''
@ -207,7 +188,9 @@ stdenv.mkDerivation (finalAttrs: {
    ensureNewerSourcesForZipFilesHook # required for firmware zipping
    gettext
    gi-docgen
+    gnutls.bin
    gobject-introspection
+    libjcat.bin
    libxml2
    meson
    ninja
@ -230,7 +213,6 @@ stdenv.mkDerivation (finalAttrs: {
    fwupd-efi
    gnutls
    gusb
-    libcbor
    libdrm
    libgudev
    libjcat
@ -247,13 +229,9 @@ stdenv.mkDerivation (finalAttrs: {
    tpm2-tss
    valgrind
    xz # for liblzma
-  ]
-  ++ lib.optionals haveFlashrom [
-    flashrom
  ];

  mesonFlags = [
-    (lib.mesonEnable "docs" true)
    # We are building the official releases.
    (lib.mesonEnable "supported_build" true)
    (lib.mesonOption "systemd_root_prefix" "${placeholder "out"}")
@ -262,7 +240,6 @@ stdenv.mkDerivation (finalAttrs: {
    "--sysconfdir=/etc"
    (lib.mesonOption "sysconfdir_install" "${placeholder "out"}/etc")
    (lib.mesonOption "efi_os_dir" "nixos")
-    (lib.mesonEnable "plugin_modem_manager" true)
    # HSI is auto-disabled on non-x86 upstream; auto_features=enabled overrides
    # that, breaking the fwupdtool installed test which expects rc=1 on non-x86.
    (lib.mesonEnable "hsi" isx86)
@ -276,9 +253,6 @@ stdenv.mkDerivation (finalAttrs: {
  ]
  ++ lib.optionals (!enablePassim) [
    (lib.mesonEnable "passim" false)
-  ]
-  ++ lib.optionals (!haveFlashrom) [
-    (lib.mesonEnable "plugin_flashrom" false)
  ];

  # TODO: wrapGAppsHook3 wraps efi capsule even though it is not ELF
@ -356,6 +330,7 @@ stdenv.mkDerivation (finalAttrs: {
    updateScript = nix-update-script { };
    filesInstalledToEtc = [
      "fwupd/fwupd.conf"
+      "fwupd/remotes.d/lvfs-embargo.conf"
      "fwupd/remotes.d/lvfs-testing.conf"
      "fwupd/remotes.d/lvfs.conf"
      "fwupd/remotes.d/vendor.conf"
--- a/pkgs/by-name/gh/gh-gonest/package.nix
+++ b/pkgs/by-name/gh/gh-gonest/package.nix
@ -0,0 +1,71 @@
+{
+  lib,
+  fetchFromGitHub,
+  stdenvNoCC,
+  makeWrapper,
+  bashInteractive,
+  gh,
+  jq,
+  nix-update-script,
+}:
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "gh-gonest";
+  version = "0-unstable-2025-12-17";
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "emmanuel-ferdman";
+    repo = "gh-gonest";
+    rev = "4be041b29e6e102b04b00f98619c818780060a60";
+    hash = "sha256-NTqq7y/6Gw1CXgmEpj7an2bT7d5ZFjjlV4zyBthC5yw=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  buildInputs = [ bashInteractive ];
+
+  # runtimeInputs is not used by mkDerivation directly, but defining it means
+  # the packages on the path at runtime can be more easily inspected and
+  # overridden.
+  runtimeInputs = [
+    gh
+    jq
+  ];
+
+  dontConfigure = true;
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    install -D -m755 gh-gonest "$out"/bin/gh-gonest
+
+    runHook postInstall
+  '';
+
+  # Use --suffix to ensure that, if the user has a `gh` executable (e.g.
+  # because they've set `programs.gh.package` in Home Manager), then that gets
+  # picked up first.
+  postFixup = ''
+    wrapProgram "$out"/bin/gh-gonest \
+      --suffix PATH : ${lib.makeBinPath finalAttrs.runtimeInputs}
+  '';
+
+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--version"
+      "branch"
+    ];
+  };
+
+  meta = {
+    homepage = "https://github.com/emmanuel-ferdman/gh-gonest";
+    description = "GitHub CLI extension for cleaning up ghost notifications";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.me-and ];
+    mainProgram = "gh-gonest";
+  };
+})
--- a/pkgs/by-name/ha/handy/package.nix
+++ b/pkgs/by-name/ha/handy/package.nix
@ -0,0 +1,275 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  rustPlatform,
+  pkg-config,
+  cmake,
+  bun,
+  nodejs,
+  cctools,
+  cargo-tauri,
+  jq,
+  writableTmpDirAsHomeHook,
+  makeBinaryWrapper,
+  swift,
+  apple-sdk_26,
+  symlinkJoin,
+
+  # Linux-only
+  webkitgtk_4_1,
+  gtk3,
+  glib,
+  libsoup_3,
+  alsa-lib,
+  libayatana-appindicator,
+  libevdev,
+  libxtst,
+  gtk-layer-shell,
+  vulkan-loader,
+  vulkan-headers,
+  shaderc,
+  gst_all_1,
+  glib-networking,
+  libx11,
+  pipewire,
+  alsa-plugins,
+  wrapGAppsHook4,
+
+  # Cross-platform
+  onnxruntime,
+  openssl,
+}:
+let
+  gstPlugins = lib.optionals stdenv.hostPlatform.isLinux (
+    with gst_all_1;
+    [
+      gstreamer
+      gst-plugins-base
+      gst-plugins-good
+      gst-plugins-bad
+      gst-plugins-ugly
+    ]
+  );
+in
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "handy";
+  version = "0.8.3";
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "cjpais";
+    repo = "Handy";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-sCCtp6UAxmCAcYeOM9+RW2czATh4Geqf1H8wXNMniYc=";
+  };
+
+  cargoRoot = "src-tauri";
+  cargoHash = "sha256-mvOThNqfE24iMkVBM2zYexJkQxpMMgE4PPNXKy39hSg=";
+
+  nativeInstallInputs = [ jq ];
+
+  postPatch = ''
+    patch_json() {
+      local file=$1 filter=$2
+      jq "$filter" "$file" > "$file.tmp" && mv "$file.tmp" "$file"
+    }
+
+    # De-structuring the Tauri build process
+    # So we can:
+    # - Handle the frontend building in a fixed way.
+    # - Not worry about signing
+    # - And avoid the auto-updater
+    patch_json "src-tauri/tauri.conf.json" '
+      del(.build.beforeBuildCommand) |
+      .bundle.createUpdaterArtifacts = false |
+      .bundle.macOS += { signingIdentity: null, hardenedRuntime: false }
+    '
+
+    # Strip cbindgen build steps
+    find "$cargoDepsCopy" -path "*/ferrous-opencc-*/build.rs" \
+      -exec sed -i -e '/cbindgen::Builder::new/{:l;/write_to_file/!{N;bl};d}' {} +
+  ''
+  + lib.optionalString stdenv.hostPlatform.isLinux ''
+    substituteInPlace "$cargoDepsCopy"/source-registry-0/libappindicator-sys-*/src/lib.rs \
+      --replace-fail 'libayatana-appindicator3.so.1' '${libayatana-appindicator}/lib/libayatana-appindicator3.so.1'
+  '';
+
+  nativeBuildInputs = [
+    pkg-config
+    cmake
+    bun
+    nodejs
+    cargo-tauri.hook
+    jq
+    writableTmpDirAsHomeHook
+    rustPlatform.bindgenHook
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [
+    wrapGAppsHook4
+    shaderc
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    makeBinaryWrapper
+    cctools
+    swift
+    apple-sdk_26
+  ];
+
+  buildInputs = [
+    onnxruntime
+    openssl
+  ]
+  ++ gstPlugins
+  ++ lib.optionals stdenv.hostPlatform.isLinux [
+    webkitgtk_4_1
+    gtk3
+    glib
+    libsoup_3
+    alsa-lib
+    libayatana-appindicator
+    libevdev
+    libxtst
+    gtk-layer-shell
+    vulkan-loader
+    vulkan-headers
+    glib-networking
+    libx11
+  ];
+
+  ortLibLocation = "${lib.getLib onnxruntime}/lib";
+
+  # Handy relies on onnx and gstreamer being available at runtime, picked up by wrapGapps.
+  env = {
+    ORT_LIB_LOCATION = "${lib.getLib onnxruntime}/lib";
+    ORT_PREFER_DYNAMIC_LINK = "1";
+
+    # Normally GST plugins will live in their own folder. This conjoins them into one as the application expects.
+    GST_PLUGIN_SYSTEM_PATH_1_0 = lib.optionalString stdenv.hostPlatform.isLinux (
+      lib.makeSearchPathOutput "lib" "lib/gstreamer-1.0" gstPlugins
+    );
+  }
+  // lib.optionalAttrs stdenv.hostPlatform.isDarwin {
+    SWIFTC = lib.getExe' swift "swiftc"; # Explicit so the Handy build system can avoid xcrun
+  };
+
+  preBuild = ''
+    cp -R ${finalAttrs.passthru.frontendDeps}/node_modules .
+    chmod -R u+w node_modules
+    patchShebangs node_modules
+    bun run build
+  '';
+
+  # If removed, the binary is produced, but not the app bundle for any platform.
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out
+  ''
+  + lib.optionalString stdenv.hostPlatform.isLinux ''
+    mv target/${stdenv.hostPlatform.rust.rustcTarget}/release/bundle/deb/*/data/usr/* $out/
+  ''
+  + lib.optionalString stdenv.hostPlatform.isDarwin ''
+    mkdir -p $out/Applications $out/bin
+    mv target/${stdenv.hostPlatform.rust.rustcTarget}/release/bundle/macos/Handy.app \
+      $out/Applications/
+    ln -s "$out/Applications/Handy.app/Contents/MacOS/handy" "$out/bin/handy"
+  ''
+  + ''
+    runHook postInstall
+  '';
+
+  preFixup = lib.optionalString stdenv.hostPlatform.isLinux ''
+    gappsWrapperArgs+=(
+      --set WEBKIT_DISABLE_DMABUF_RENDERER 1
+      --set ALSA_PLUGIN_DIR "${finalAttrs.passthru.alsaPluginDirectory}"
+    )
+  '';
+
+  postFixup = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    install_name_tool -add_rpath "${finalAttrs.env.ORT_LIB_LOCATION}" \
+      "$out/Applications/Handy.app/Contents/MacOS/handy"
+  '';
+
+  preCheck = ''
+    cd ${finalAttrs.cargoRoot}
+  ''
+  + lib.optionalString stdenv.hostPlatform.isDarwin ''
+    export DYLD_LIBRARY_PATH="${finalAttrs.env.ORT_LIB_LOCATION}''${DYLD_LIBRARY_PATH:+:''${DYLD_LIBRARY_PATH}}"
+  '';
+
+  # Skip broken tests, mirroring CI configuration (https://github.com/cjpais/Handy/blob/main/.github/workflows/test.yml)
+  checkFlags = [
+    "--skip=helpers::clamshell::tests::test_is_laptop"
+    "--skip=helpers::clamshell::tests::test_clamshell_check"
+  ];
+
+  passthru = {
+    # The hook and deps fetcher in https://github.com/NixOS/nixpkgs/pull/376299 should simplify this dramatically.
+    frontendDeps = stdenv.mkDerivation {
+      pname = "handy-frontend-deps";
+      version = "0.8.3";
+      inherit (finalAttrs) src;
+
+      nativeBuildInputs = [
+        bun
+        writableTmpDirAsHomeHook
+      ];
+
+      dontConfigure = true;
+
+      buildPhase = ''
+        runHook preBuild
+        export BUN_INSTALL_CACHE_DIR=$(mktemp -d)
+        bun install --linker=isolated --force --frozen-lockfile \
+          --ignore-scripts --no-progress
+        bun --bun "$PWD/.nix/scripts/normalize-install.ts"
+        runHook postBuild
+      '';
+
+      installPhase = ''
+        runHook preInstall
+        mkdir -p $out
+        cp -R node_modules $out/
+        runHook postInstall
+      '';
+
+      dontFixup = true;
+
+      outputHash =
+        {
+          "x86_64-linux" = "sha256-tJ6LK99dELOiR0BcsTRTt/vLyNamntujLxhBy5Xl/lc=";
+          "aarch64-linux" = "sha256-S+dX6ZVgv9dexxIHoa5PxP7e0nxf/d7cKUGty5eEi8A=";
+          "aarch64-darwin" = "sha256-DQbogNBQ9izK5GPmoOudqiB2lJvct1vZI2U5lp3WFy8=";
+        }
+        .${stdenv.hostPlatform.system};
+
+      outputHashMode = "recursive";
+    };
+
+    alsaPluginDirectory = symlinkJoin {
+      name = "combined-alsaPlugins";
+      paths = [
+        "${pipewire}/lib/alsa-lib"
+        "${alsa-plugins}/lib/alsa-lib"
+      ];
+    };
+  };
+
+  meta = {
+    description = "Free, open source, offline speech-to-text application";
+    longDescription = ''
+      Handy is a cross-platform desktop application providing simple,
+      privacy-focused speech transcription. Press a shortcut, speak, and
+      have your words appear in any text field — entirely on your own
+      computer, with no audio sent to the cloud.
+    '';
+    homepage = "https://handy.computer";
+    changelog = "https://github.com/cjpais/Handy/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.mit;
+    mainProgram = "handy";
+    maintainers = with lib.maintainers; [ philocalyst ];
+    platforms = with lib.platforms; linux ++ darwin;
+    badPlatforms = [ "x86_64-darwin" ]; # We weren't able to get hashes here
+  };
+})
--- a/pkgs/by-name/ht/httpfs2/package.nix
+++ b/pkgs/by-name/ht/httpfs2/package.nix
@ -1,54 +0,0 @@
-{
-  fetchurl,
-  lib,
-  stdenv,
-  pkg-config,
-  fuse,
-  openssl,
-  asciidoc,
-  docbook_xml_dtd_45,
-  docbook_xsl,
-  libxml2,
-  libxslt,
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "httpfs2";
-  version = "0.1.5";
-
-  src = fetchurl {
-    url = "mirror://sourceforge/httpfs/httpfs2/httpfs2-${finalAttrs.version}.tar.gz";
-    sha256 = "1h8ggvhw30n2r6w11n1s458ypggdqx6ldwd61ma4yd7binrlpjq1";
-  };
-
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [
-    fuse
-    openssl
-    asciidoc
-    docbook_xml_dtd_45
-    docbook_xsl
-    libxml2
-    libxslt
-  ];
-
-  installPhase = ''
-    mkdir -p "$out/bin"
-    cp -v httpfs2 "$out/bin"
-
-    mkdir -p "$out/share/man/man1"
-    cp -v *.1 "$out/share/man/man1"
-  '';
-
-  meta = {
-    description = "FUSE-based HTTP filesystem for Linux";
-    mainProgram = "httpfs2";
-
-    homepage = "https://httpfs.sourceforge.net/";
-
-    license = lib.licenses.gpl2Plus;
-
-    platforms = lib.platforms.unix;
-    maintainers = [ ];
-  };
-})
--- a/pkgs/by-name/hu/hushboard/package.nix
+++ b/pkgs/by-name/hu/hushboard/package.nix
@ -85,6 +85,6 @@ python3Packages.buildPythonApplication {
    description = "Mute your microphone while typing";
    mainProgram = "hushboard";
    platforms = lib.platforms.linux;
-    maintainers = with lib.maintainers; [ keysmashes ];
+    maintainers = [ ];
  };
 }
--- a/pkgs/by-name/im/immich-machine-learning/package.nix
+++ b/pkgs/by-name/im/immich-machine-learning/package.nix
@ -18,6 +18,7 @@ python.pkgs.buildPythonApplication rec {

  pythonRelaxDeps = [
    "huggingface-hub"
+    "insightface"
    "numpy"
    "pillow"
    "pydantic-settings"
--- a/pkgs/by-name/je/jextract-21/package.nix
+++ b/pkgs/by-name/je/jextract-21/package.nix
@ -1,54 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  makeBinaryWrapper,
-  gradle,
-  jdk21,
-  llvmPackages,
-}:
-
-stdenv.mkDerivation {
-  pname = "jextract";
-  version = "unstable-2023-11-27";
-
-  src = fetchFromGitHub {
-    owner = "openjdk";
-    repo = "jextract";
-    rev = "8730fcf05c229d035b0db52ee6bd82622e9d03e9"; # Update jextract 21 with latest fixes
-    hash = "sha256-Wct/yx5C0EjDtDyXNYDH5LRmrfq7islXbPVIGBR6x5Y=";
-  };
-
-  nativeBuildInputs = [
-    gradle
-    makeBinaryWrapper
-  ];
-
-  gradleFlags = [
-    "-Pllvm_home=${lib.getLib llvmPackages.libclang}"
-    "-Pjdk21_home=${jdk21}"
-  ];
-
-  doCheck = true;
-
-  gradleCheckTask = "verify";
-
-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p $out/opt/
-    cp -r ./build/jextract $out/opt/jextract
-    makeBinaryWrapper "$out/opt/jextract/bin/jextract" "$out/bin/jextract"
-
-    runHook postInstall
-  '';
-
-  meta = {
-    description = "Tool which mechanically generates Java bindings from a native library headers";
-    mainProgram = "jextract";
-    homepage = "https://github.com/openjdk/jextract";
-    platforms = jdk21.meta.platforms;
-    license = lib.licenses.gpl2Only;
-    maintainers = with lib.maintainers; [ sharzy ];
-  };
-}
--- a/pkgs/by-name/je/jextract/copy_lib_clang.patch
+++ b/pkgs/by-name/je/jextract/copy_lib_clang.patch
@ -1,13 +1,13 @@
 diff --git a/build.gradle b/build.gradle
-index 9ce544a..0c77609 100644
+index 9ce544a..9445e97 100644
 --- a/build.gradle
 +++ b/build.gradle
-@@ -79,7 +79,7 @@ task copyLibClang(type: Sync) {
-             "libclang.so.${clang_version}" : "*clang*"
+@@ -76,7 +76,7 @@ task copyLibClang(type: Sync) {
+     // make sure we only pick up the "real" shared library file from LLVM installation
+     // (e.g. exclude symlinks on Linux)
+     def clang_path_include = (Os.isFamily(Os.FAMILY_UNIX) && !Os.isFamily(Os.FAMILY_MAC)) ?
+-            "libclang.so.${clang_version}" : "*clang*"
+            "libclang.so*" : "*clang*"
 
     from("${libclang_dir}") {
-        include(clang_path_include)
-+        include("libclang.so*")
-         include("libLLVM.*")
-         exclude("clang.exe")
-         into("libs")
+         include(clang_path_include)
--- a/pkgs/by-name/js/jspecify/deps.json
+++ b/pkgs/by-name/js/jspecify/deps.json
@ -0,0 +1,469 @@
+{
+ "!comment": "This is a nixpkgs Gradle dependency lockfile. For more details, refer to the Gradle section in the nixpkgs manual.",
+ "!version": 1,
+ "https://plugins.gradle.org/m2": {
+  "biz/aQute/bnd#biz.aQute.bnd.embedded-repo/7.0.0": {
+   "jar": "sha256-pCxnvPjZxR9NzYYlTWKYdjWpaXzRDGSRtXSYOLqr6+A=",
+   "pom": "sha256-3Prn96stJjHK9pLazzn6yGK3GNEdCwu294+aW6gCjLo="
+  },
+  "biz/aQute/bnd#biz.aQute.bnd.gradle/7.0.0": {
+   "jar": "sha256-LMWmnBybMoqsR38mKt0K2MW8K355tbw5OWNCCl4EQhE=",
+   "pom": "sha256-x2EBfWRP4nI9Gxxlx38fGYKXT0RtqEBoianDvjp07B0="
+  },
+  "biz/aQute/bnd#biz.aQute.bnd.util/7.0.0": {
+   "jar": "sha256-OVddFQJJliqcbUbM5+Zy53fIqGIKHS0iDH8sCnmediM=",
+   "pom": "sha256-+dgDJLl2Hp3ipFoP6naPWZRH9AxuQZ8gje2MrxIYAMU="
+  },
+  "biz/aQute/bnd#biz.aQute.bndlib/7.0.0": {
+   "jar": "sha256-gKVp0AbzLpJc7kzor5Jrfm/aqqtcy/1f5MnN/5xN0t8=",
+   "pom": "sha256-mOuywO2iBtxb79bFJsjCAneApDvymekXyzwDXwOYp9I="
+  },
+  "biz/aQute/bnd#biz.aQute.repository/7.0.0": {
+   "jar": "sha256-ggIaWyICKD8J9XpW0zsh+rxvemSFC5FnNdaiZI8nYzc=",
+   "pom": "sha256-f1ar8LnsiL40/ZCDaYYdnlQwxnu6FROItbf0shvwOTU="
+  },
+  "biz/aQute/bnd#biz.aQute.resolve/7.0.0": {
+   "jar": "sha256-nVjTmv0Y/d2LTSHnC4Ui+KUmiH4UUH2UDcfK/p8NCZo=",
+   "pom": "sha256-UVIg7ZyoHFkzGz/zyuQfkUGMmn0Atavq0nEYS8rNp1Y="
+  },
+  "biz/aQute/bnd/builder#biz.aQute.bnd.builder.gradle.plugin/7.0.0": {
+   "pom": "sha256-gzK8DdCVA5r6+Tb/l4L6A3jKPvJNV+6Q++QsA3pVa9c="
+  },
+  "com/diffplug/durian#durian-collect/1.2.0": {
+   "jar": "sha256-sZTAuIAhzBFsIcHcdvScLB/hda9by3TIume527+aSMw=",
+   "pom": "sha256-i7diCGoKT9KmRzu/kFx0R2OvodWaVjD3O7BLeHLAn/M="
+  },
+  "com/diffplug/durian#durian-core/1.2.0": {
+   "jar": "sha256-F+0KrLOjwWMjMyFou96thpTzKACytH1p1KTEmxFNXa4=",
+   "pom": "sha256-hwMg6QdVNxsBeW/oG6Ul/R3ui3A0b1VFUe7dQonwtmI="
+  },
+  "com/diffplug/durian#durian-io/1.2.0": {
+   "jar": "sha256-CV/R3HeIjAc/C+OaAYFW7lJnInmLCd6eKF7yE14W6sQ=",
+   "pom": "sha256-NQkZQkMk4nUKPdwvobzmqQrIziklaYpgqbTR1uSSL/4="
+  },
+  "com/diffplug/durian#durian-swt.os/4.2.2": {
+   "jar": "sha256-a1Mca0vlgaizLq2GHdwVwsk7IMZl+00z4DgUg8JERfQ=",
+   "module": "sha256-rVlQLGknZu48M0vkliigDctNka4aSPJjLitxUStDXPk=",
+   "pom": "sha256-GzxJFP1eLM4pZq1wdWY5ZBFFwdNCB3CTV4Py3yY2kIU="
+  },
+  "com/diffplug/spotless#com.diffplug.spotless.gradle.plugin/6.25.0": {
+   "pom": "sha256-9FyCsS+qzYWs1HTrppkyL6XeqIQIskfQ5L3pQSkIIjo="
+  },
+  "com/diffplug/spotless#spotless-lib-extra/2.45.0": {
+   "jar": "sha256-YCy7zTgo7pz7LjCn+bMDNcaScTB3FBTUzdKU0h/ly2c=",
+   "module": "sha256-9pnkNfTlzgPbYJpHaO6wNj1uB8ZfvPrx/GKcTnbuf7A=",
+   "pom": "sha256-5x2LkRDdSNLn9KVLi/uozlWpbmteu9T0OpJGZJz1b7A="
+  },
+  "com/diffplug/spotless#spotless-lib/2.45.0": {
+   "jar": "sha256-sllply4dmAKAyirlKRl+2bMWCq5ItQbPGTXwG9Exhmc=",
+   "module": "sha256-+x+8+TUAczrHWcp99E8P9mVTEze0LaAS4on/CINNiQ8=",
+   "pom": "sha256-WKd8IsQLIc8m29tCEwFu9HrM9bBwchfHkyqQ9D+PMNw="
+  },
+  "com/diffplug/spotless#spotless-plugin-gradle/6.25.0": {
+   "jar": "sha256-9euQikxdpGKZ51Q/qtoEAtLEt31Yx7Qy1Lblk0mygKM=",
+   "module": "sha256-RoHRe/PJIF2DeOynBcAAywzJjcx40DATy2iJjGvSx0Q=",
+   "pom": "sha256-q1ZuPYS2w/rHqPySXy279TzZdZywOvPAfQ3EN9OXqNo="
+  },
+  "com/fasterxml#oss-parent/48": {
+   "pom": "sha256-EbuiLYYxgW4JtiOiAHR0U9ZJGmbqyPXAicc9ordJAU8="
+  },
+  "com/fasterxml/jackson#jackson-base/2.14.2": {
+   "pom": "sha256-OuJFud+VEnMh8fkF9wO9MndP5VcVip06nlB9grK8TtQ="
+  },
+  "com/fasterxml/jackson#jackson-bom/2.14.2": {
+   "pom": "sha256-mqIJuzI5HL9fG9Pn+hGQFnYWms0ZDZiWtcHod8mZ/rw="
+  },
+  "com/fasterxml/jackson#jackson-parent/2.14": {
+   "pom": "sha256-CQat2FWuOfkjV9Y/SFiJsI/KTEOl/kM1ItdTROB1exk="
+  },
+  "com/fasterxml/jackson/core#jackson-annotations/2.14.2": {
+   "jar": "sha256-LGhp1QXPYNwGZzS31QM5+XW9OtxjXianirtxrLRHPA0=",
+   "module": "sha256-sBSmTMGESUn4JNNGcSk1Qfq3IyI6yLgyIrV3IRO97Bc=",
+   "pom": "sha256-hK4DQYN9dpamEEPYCeQyYKXrB3Iy0dyqRkyNpUnNnqA="
+  },
+  "com/fasterxml/jackson/core#jackson-core/2.14.2": {
+   "jar": "sha256-tdN6d8iCd7l+NZPIdAklIWwG345BcrveBYUo3wStPno=",
+   "module": "sha256-knOeO8vgmyZJ4YfrftJawlK1h3B82SKrlbrc3orqEtw=",
+   "pom": "sha256-9EzGPWEvA7Hb/IKJLc2zL9t1vxYEn9hZVWHnx6M7xFE="
+  },
+  "com/fasterxml/jackson/core#jackson-databind/2.14.2": {
+   "jar": "sha256-UB06vOTRjcw4EFjsWTxblEd5Brum77rBTa5ApkL3dCQ=",
+   "module": "sha256-YTDKm5VwfM1PgPYlhWmZCnzkADmqNTxGNckA02vuxwU=",
+   "pom": "sha256-IoCOu0t12MQDfZzuEgitxlvHgqmIVzIjSjG3tXTF2Qw="
+  },
+  "com/github/node-gradle#gradle-node-plugin/7.0.2": {
+   "jar": "sha256-v9jLZEWT5/a2txkBH9rKSvDAJIXigXaQRHDzAOSKGeI=",
+   "module": "sha256-G2LnH/Ks/cHhFyJH+Fe+Z3h025jTNvTWKefkVcBLM8A=",
+   "pom": "sha256-fd8NZzuvE+4XBkng91ll/M40v8Hd01UQ5iyY2MUH3Us="
+  },
+  "com/github/node-gradle/node#com.github.node-gradle.node.gradle.plugin/7.0.2": {
+   "pom": "sha256-4s4LCFDNobq3v3EBMrGDXFMlfynXzXDr5fSNsGiUuBw="
+  },
+  "com/google/code/gson#gson-parent/2.10.1": {
+   "pom": "sha256-QkjgiCQmxhUYI4XWCGw+8yYudplXGJ4pMGKAuFSCuDM="
+  },
+  "com/google/code/gson#gson/2.10.1": {
+   "jar": "sha256-QkHBSncnw0/uplB+yAExij1KkPBw5FJWgQefuU7kxZM=",
+   "pom": "sha256-0rEVY09cCF20ucn/wmWOieIx/b++IkISGhzZXU2Ujdc="
+  },
+  "com/googlecode/concurrent-trees#concurrent-trees/2.6.1": {
+   "jar": "sha256-BONySYTipcv1VgbPo3KlvT08XSohUzpwBOPN5Tl2H6U=",
+   "pom": "sha256-Q8K5sULnBV0fKlgn8QlEkl0idH2XVrMlDAeqtHU4qXE="
+  },
+  "com/googlecode/javaewah#JavaEWAH/1.2.3": {
+   "jar": "sha256-1lImlJcTxMYaeE9BxRFn57Axb5N2Q5jrup5DNrPZVMI=",
+   "pom": "sha256-5O1sZpYgNm+ZOSBln+CsfLyD11PbwNwOseUplzr5byM="
+  },
+  "com/squareup/okhttp3#okhttp/4.12.0": {
+   "jar": "sha256-sQUAgbFLt6On5VpNPvAbXc+rxFO0VzpPwBl2cZHV9OA=",
+   "module": "sha256-YH4iD/ghW5Kdgpu/VPMyiU8UWbTXlZea6vy8wc6lTPM=",
+   "pom": "sha256-fHNwQKlBlSLnxQzAJ0FqcP58dinlKyGZNa3mtBGcfTg="
+  },
+  "com/squareup/okio#okio-jvm/3.6.0": {
+   "jar": "sha256-Z1Q/Bzb8QirpJ+0OUEuYvF4mn9oNNQBXkzfLcT2ihBI=",
+   "module": "sha256-scIZnhwMyWnvYcu+SvLsr5sGQRvd4By69vyRNN/gToo=",
+   "pom": "sha256-YbTXxRWgiU/62SX9cFJiDBQlqGQz/TURO1+rDeiQpX8="
+  },
+  "com/squareup/okio#okio/3.6.0": {
+   "module": "sha256-akesUDZOZZhFlAH7hvm2z832N7mzowRbHMM8v0xAghg=",
+   "pom": "sha256-rrO3CiTBA+0MVFQfNfXFEdJ85gyuN2pZbX1lNpf4zJU="
+  },
+  "commons-codec#commons-codec/1.16.0": {
+   "jar": "sha256-VllfsgsLhbyR0NUD2tULt/G5r8Du1d/6bLslkpAASE0=",
+   "pom": "sha256-bLWVeBnfOTlW/TEaOgw/XuwevEm6Wy0J8/ROYWf6PnQ="
+  },
+  "dev/equo/ide#solstice/1.7.5": {
+   "jar": "sha256-BuFLxDrMMx2ra16iAfxnNk7RI/mCyF+lEx8IF+1lrk8=",
+   "module": "sha256-eYp7cGdyE27iijLt2GOx6fgWE6NJhAXXS+ilyb6/9U8=",
+   "pom": "sha256-20U7urXn2opDE5sNzTuuZykzIfKcTZH1p5XZ/2xS3d8="
+  },
+  "io/github/gradle-nexus#publish-plugin/1.3.0": {
+   "jar": "sha256-wU5VY3a6Rpie4AZ1lOwkJlb53YSt1g0OJUxI/luWy0g=",
+   "module": "sha256-klkymGly24u3D0EsRvQyAsuYIaYTC5pjcN16SDgBmyE=",
+   "pom": "sha256-cXyUDliFlWFRQyRayjL9Wy00qDlm1lXvnWoHVEhU55I="
+  },
+  "io/github/gradle-nexus/publish-plugin#io.github.gradle-nexus.publish-plugin.gradle.plugin/1.3.0": {
+   "pom": "sha256-UWNK9md64JmtzpKZnDBz7y18u0mDOio/W13RuQiVN4o="
+  },
+  "net/ltgt/errorprone#net.ltgt.errorprone.gradle.plugin/3.0.1": {
+   "pom": "sha256-9kCBE12Jn+VplFrNuCjimjaqAykdtUVEECbn99wpitI="
+  },
+  "net/ltgt/gradle#gradle-errorprone-plugin/3.0.1": {
+   "jar": "sha256-FJItCrBiuDCP2pBWImaSfP4ThX0iQOy6DgZ062U0eOg=",
+   "module": "sha256-27VuKSZyVE5474ij6hmWqwb4sIavldYbSTjvjzprGRs=",
+   "pom": "sha256-vfktmirDLDtija5V54qy7C/oYgpLtuda3p+Y+eSPGh8="
+  },
+  "org/apache#apache/29": {
+   "pom": "sha256-PkkDcXSCC70N9jQgqXclWIY5iVTCoGKR+mH3J6w1s3c="
+  },
+  "org/apache/commons#commons-parent/58": {
+   "pom": "sha256-LUsS4YiZBjq9fHUni1+pejcp2Ah4zuy2pA2UbpwNVZA="
+  },
+  "org/eclipse/jgit#org.eclipse.jgit-parent/6.7.0.202309050840-r": {
+   "pom": "sha256-u56FQW2Y0HMfx2f41w6EaAQWAdZnKuItsqx5n3qjkR8="
+  },
+  "org/eclipse/jgit#org.eclipse.jgit/6.7.0.202309050840-r": {
+   "jar": "sha256-tWRHfQkiQaqrUMhKxd0aw3XAGCBE1+VlnTpgqQ4ugBo=",
+   "pom": "sha256-BNB83b8ZjfpuRIuan7lA94HAEq2T2eqCBv4KTTplwZI="
+  },
+  "org/eclipse/platform#org.eclipse.osgi/3.18.300": {
+   "jar": "sha256-urlD5Y7dFzCSOGctunpFrsni2svd24GKjPF3I+oT+iI=",
+   "pom": "sha256-4nl2N1mZxUJ/y8//PzvCD77a+tiqRRArN59cL5fI/rQ="
+  },
+  "org/gradle/toolchains#foojay-resolver/0.8.0": {
+   "jar": "sha256-+Q5pNRY46QueyYSOdZ0hhjWQfAklQRkRUAN7CyLlFAw=",
+   "module": "sha256-jDzPVNoHLGSkDgaIKqplIzbLKe7C6iMPBtaEOrs4TVE=",
+   "pom": "sha256-pxZyrK0MCu4576V1P1yU+aSjWh2sBl4ii8rDQt6nxUg="
+  },
+  "org/gradle/toolchains/foojay-resolver-convention#org.gradle.toolchains.foojay-resolver-convention.gradle.plugin/0.8.0": {
+   "pom": "sha256-O2ciN72cwejoyobvWnkgpnj2nQTS9L+9DFouedRcXLU="
+  },
+  "org/jetbrains#annotations/13.0": {
+   "jar": "sha256-rOKhDcji1f00kl7KwD5JiLLA+FFlDJS4zvSbob0RFHg=",
+   "pom": "sha256-llrrK+3/NpgZvd4b96CzuJuCR91pyIuGN112Fju4w5c="
+  },
+  "org/jetbrains/kotlin#kotlin-stdlib-common/1.9.10": {
+   "jar": "sha256-zeM0G6GKK6JisLfPbFWyDJDo1DTkLJoT5qP3cNuWWog=",
+   "pom": "sha256-fUtwVHkQZ2s738iSWojztr+yRYLJeEVCgFVEzu9JCpI="
+  },
+  "org/jetbrains/kotlin#kotlin-stdlib-jdk7/1.8.21": {
+   "pom": "sha256-m7EH1dXjkwvFl38AekPNILfSTZGxweUo6m7g8kjxTTY="
+  },
+  "org/jetbrains/kotlin#kotlin-stdlib-jdk7/1.9.10": {
+   "jar": "sha256-rGNhv5rR7TgsIQPZcSxHzewWYjK0kD7VluiHawaBybc=",
+   "pom": "sha256-x/pnx5YTILidhaPKWaLhjCxlhQhFWV3K5LRq9pRe3NU="
+  },
+  "org/jetbrains/kotlin#kotlin-stdlib-jdk8/1.8.21": {
+   "pom": "sha256-ODnXKNfDCaXDaLAnC0S08ceHj/XKXTKpogT6o0kUWdg="
+  },
+  "org/jetbrains/kotlin#kotlin-stdlib-jdk8/1.9.10": {
+   "jar": "sha256-pMdNlNZM4avlN2D+A4ndlB9vxVjQ2rNeR8CFoR7IDyg=",
+   "pom": "sha256-X0uU3TBlp3ZMN/oV3irW2B9A1Z+Msz8X0YHGOE+3py4="
+  },
+  "org/jetbrains/kotlin#kotlin-stdlib/1.8.21": {
+   "pom": "sha256-/gzZ4yGT5FMzP9Kx9XfmYvtavGkHECu5Z4F7wTEoD9c="
+  },
+  "org/jetbrains/kotlin#kotlin-stdlib/1.9.10": {
+   "jar": "sha256-VemJxRK4CQd5n4VDCfO8d4LFs9E5MkQtA3nVxHJxFQQ=",
+   "pom": "sha256-fin79z/fceBnnT3ufmgP1XNGT6AWRKT1irgZ0sCI09I="
+  },
+  "org/junit#junit-bom/5.9.3": {
+   "module": "sha256-tAH9JZAeWCpSSqU0PEs54ovFbiSWHBBpvytLv87ka5M=",
+   "pom": "sha256-TQMpzZ5y8kIOXKFXJMv+b/puX9KIg2FRYnEZD9w0Ltc="
+  },
+  "org/osgi#org.osgi.dto/1.0.0": {
+   "jar": "sha256-y3Xzx+SOWjGjHfIuJoczRvW/ZZ4tyrI2ngMeSFDS/0M=",
+   "pom": "sha256-XDHfk5LAR5tfgS9/hIDPsvcrbUmu8oVLfZFuBrCxDKw="
+  },
+  "org/osgi#org.osgi.framework/1.8.0": {
+   "jar": "sha256-7BlLeHGvJ2gXFv8FJZMZpcPJuXJ+gADp6DJJm5NIS04=",
+   "pom": "sha256-Z9tZJwa+xs7fS932a6ZJrVEkDN8SnjSQXm78j5AhCTM="
+  },
+  "org/osgi#org.osgi.resource/1.0.0": {
+   "jar": "sha256-gfxQ8fHTikryjhMZB9Sv4hMkmqsFBgSE7coOYMSvm0o=",
+   "pom": "sha256-g6zfIl/7mkp7xYL1OkFFofLDvbtCjgM8AJZvY8YQ6CA="
+  },
+  "org/osgi#org.osgi.service.coordinator/1.0.2": {
+   "jar": "sha256-sA3LUHuCQ/vlTubn+FNEmoRa+OfYQxPH1JdJSf2qsis=",
+   "pom": "sha256-DR2KkKB+CBsBIewegopVu51NRK7SK9qUKZEqIQFGi2o="
+  },
+  "org/osgi#org.osgi.service.log/1.3.0": {
+   "jar": "sha256-/2cQxIVtMmhM8+vcRSSPQQNv9zTysDu8CMRgmmH+z6A=",
+   "pom": "sha256-IcKVDBCS/bOOwIRYa471pU5dHQSV9UqCR+Auuu1EMos="
+  },
+  "org/osgi#org.osgi.service.repository/1.1.0": {
+   "jar": "sha256-xVU+lbRZUpGSQzSG1MTMIv9FourkloSE+fcXMZJkpTI=",
+   "pom": "sha256-QGb8pxWqwy/jzgvHv4Epe/1xMOu2CQzJZSrfeyqAfxk="
+  },
+  "org/osgi#org.osgi.service.resolver/1.1.1": {
+   "jar": "sha256-0hLyvLRc++yQcxDXj1MNmJjeDM97B5Os8Ys4bwPH3jk=",
+   "pom": "sha256-uPMUllLomdnRY/zyBKSD1Cq79OoT/+zI2aMyLIF84cI="
+  },
+  "org/osgi#org.osgi.util.function/1.2.0": {
+   "jar": "sha256-IIgZx8cWkMFaa7ixh0dOf50BR5RraAGCpiufIirgFOw=",
+   "pom": "sha256-9O3YQYEVfUNoGNRlZdSAN5wbBwAdXLEwtAZxlykRXqg="
+  },
+  "org/osgi#org.osgi.util.promise/1.2.0": {
+   "jar": "sha256-/vhuZPWE0BKhagMGFgdk9heWY7kJiKImxGQbkg86SzY=",
+   "pom": "sha256-m6aVb+n6Frge8Q6O8UED4WwEuKACQVC20DKfkX7y4hY="
+  },
+  "org/osgi#org.osgi.util.tracker/1.5.4": {
+   "jar": "sha256-fXjCzJvLZCHCTxeqCXhmzo2RFcIZpPjWzHU7xN+5fvo=",
+   "pom": "sha256-L3oSGrysdT5csPguP+4NpHlZV5hp4wTYwvtuh2PkMSk="
+  },
+  "org/osgi#osgi.annotation/8.0.1": {
+   "jar": "sha256-oOikw2K9NgCBLzew6kX7qWbHvASdAf7Vagnsx0CCdZ4=",
+   "pom": "sha256-iC0Hao4lypIH95ywk4DEcvazxBUIFivSuqBpF74d7XM="
+  },
+  "org/slf4j#slf4j-api/1.7.36": {
+   "jar": "sha256-0+9XXj5JeWeNwBvx3M5RAhSTtNEft/G+itmCh3wWocA=",
+   "pom": "sha256-+wRqnCKUN5KLsRwtJ8i113PriiXmDL0lPZhSEN7cJoQ="
+  },
+  "org/slf4j#slf4j-parent/1.7.36": {
+   "pom": "sha256-uziNN/vN083mTDzt4hg4aTIY3EUfBAQMXfNgp47X6BI="
+  },
+  "org/sonatype/oss#oss-parent/5": {
+   "pom": "sha256-FnjUEgpYXYpjATGu7ExSTZKDmFg7fqthbufVqH9SDT0="
+  },
+  "org/sonatype/oss#oss-parent/7": {
+   "pom": "sha256-tR+IZ8kranIkmVV/w6H96ne9+e9XRyL+kM5DailVlFQ="
+  },
+  "org/tukaani#xz/1.9": {
+   "jar": "sha256-IRswbPxE+Plt86Cj3a91uoxSie7XfWDXL4ibuFX1NeU=",
+   "pom": "sha256-CTvhsDMxvOKTLWglw36YJy12Ieap6fuTKJoAJRi43Vo="
+  }
+ },
+ "https://repo.maven.apache.org/maven2": {
+  "aopalliance#aopalliance/1.0": {
+   "jar": "sha256-Ct3sZw/tzT8RPFyAkdeDKA0j9146y4QbYanNsHk3agg=",
+   "pom": "sha256-JugjMBV9a4RLZ6gGSUXiBlgedyl3GD4+Mf7GBYqppZs="
+  },
+  "com/github/ben-manes/caffeine#caffeine/3.0.5": {
+   "jar": "sha256-iptU01BqO5LuRrIXvO55GWshym1S3ClnxoaiBfsvnBU=",
+   "module": "sha256-MNqUAgRzgsSZ0djzcgH8Ead8mTTSxYa8WkKvrEr6wrI=",
+   "pom": "sha256-vM/bJH7Xa1K7sUMMIoLEO61BjtPGl7TiqVrQmbvyXPg="
+  },
+  "com/github/kevinstern#software-and-algorithms/1.0": {
+   "jar": "sha256-YauCQ5zvNzQ7FPUxVMRhYZN1NzpWuTOOiVcJ+1Tghkw=",
+   "pom": "sha256-7ZcfAJNU5owJQUyWT74aLIXCyLvUYBIrdJenuMXU84g="
+  },
+  "com/google#google/5": {
+   "pom": "sha256-4J00XnPKP7yn8+BfMN63Tp053Wt5qT/ujFEfI0F7aCg="
+  },
+  "com/google/auto#auto-common/1.2.1": {
+   "jar": "sha256-9D8p/ipuuvBLJZjN7sMqTjRtSalATpkPX8GcGfOijQ4=",
+   "pom": "sha256-E7S1AGKUn4sTQ5J8WBU207sFG4r+pQmqb5AvTeKLwbI="
+  },
+  "com/google/auto/service#auto-service-aggregator/1.0.1": {
+   "pom": "sha256-BIFGDbWZAzYrJvq9O9zV7CAHUPk5G7tlAv48fcLfPkw="
+  },
+  "com/google/auto/service#auto-service-annotations/1.0.1": {
+   "jar": "sha256-x77FS3tViLWWfocDQQkcVpEYHZVM8gOfG/Cm7rg3Rzs=",
+   "pom": "sha256-6bvxs9ZsoYAEpqB6INv6EMos6DZzSPdB3i/o/vzmjMI="
+  },
+  "com/google/auto/value#auto-value-annotations/1.9": {
+   "jar": "sha256-+lRp9MRO5Zii2PAzqwqdy8ZJigxeDJmN+gwq31E1gEQ=",
+   "pom": "sha256-kiCj2r51x5M08GGw5A34M0SGZrrCiouCO8Ho/VL4yYo="
+  },
+  "com/google/auto/value#auto-value-parent/1.9": {
+   "pom": "sha256-Lj2d/2OWAcq4gdfhcIBry9jgMffr/yWcu0W+V7TL14c="
+  },
+  "com/google/code/findbugs#jsr305/3.0.2": {
+   "jar": "sha256-dmrSoHg/JoeWLIrXTO7MOKKLn3Ki0IXuQ4t4E+ko0Mc=",
+   "pom": "sha256-GYidvfGyVLJgGl7mRbgUepdGRIgil2hMeYr+XWPXjf4="
+  },
+  "com/google/errorprone#error_prone_annotation/2.20.0": {
+   "jar": "sha256-vxzaySKIajd7p3JCooEo9+tADXxzyQXff7p26qw1fmc=",
+   "pom": "sha256-IiHmp48/e26RUynjfoKk1oKEKxWuKM9yukunHMBoKTE="
+  },
+  "com/google/errorprone#error_prone_annotations/2.20.0": {
+   "jar": "sha256-oTbT3OZxaNiHURFfoiO+yA6ubMBiqi+Bc+g0SpgjXsQ=",
+   "pom": "sha256-lPUGU69lm+HRoNeF+Xy6doVx95TS5lX8PSLk7uZRKzk="
+  },
+  "com/google/errorprone#error_prone_check_api/2.20.0": {
+   "jar": "sha256-thTVZZmyzoi8lmEdiUO3RlchSjJV3r5euDoLldal+Zc=",
+   "pom": "sha256-BbHZZjPswo4T2Wjcco+CO9MCyuEoeOQxiOSe3fGP9bo="
+  },
+  "com/google/errorprone#error_prone_core/2.20.0": {
+   "jar": "sha256-noHXvKX6GDtUBZ/Kx0+949/u3kY5Dn46F+4Lxm2ERxM=",
+   "pom": "sha256-yoqZNJJyasGFAEokY9RSdOJk9VxtcUEaw30yc9sTFeE="
+  },
+  "com/google/errorprone#error_prone_parent/2.20.0": {
+   "pom": "sha256-4Li8d/x5TSLVCqSFGJbYICphZhAWGxPL/yoUj/HhAsI="
+  },
+  "com/google/errorprone#error_prone_type_annotations/2.20.0": {
+   "jar": "sha256-MNugplH9X7qPyugfkpOMWQIwMA+SZeqEn0MUlPf5LBY=",
+   "pom": "sha256-1r8/bVHn1ynBmTMkZtVp3Gay7yHuwSnD0aC4kSDYzz8="
+  },
+  "com/google/errorprone#javac/9+181-r4173-1": {
+   "jar": "sha256-HY00eg4VefP8hqwE0ZdOSJr8ZjV/AAmsmASnrDCRLtY=",
+   "pom": "sha256-FWnAgfqDWKBhZDcvn1Qbig6l7Alkkx9fdOrTb/UrQBU="
+  },
+  "com/google/guava#failureaccess/1.0.1": {
+   "jar": "sha256-oXHuTHNN0tqDfksWvp30Zhr6typBra8x64Tf2vk2yiY=",
+   "pom": "sha256-6WBCznj+y6DaK+lkUilHyHtAopG1/TzWcqQ0kkEDxLk="
+  },
+  "com/google/guava#guava-parent/26.0-android": {
+   "pom": "sha256-+GmKtGypls6InBr8jKTyXrisawNNyJjUWDdCNgAWzAQ="
+  },
+  "com/google/guava#guava-parent/31.1-jre": {
+   "pom": "sha256-RDliZ4O0StJe8F/wdiHdS7eWzE608pZqSkYf6kEw4Pw="
+  },
+  "com/google/guava#guava/31.1-jre": {
+   "jar": "sha256-pC7cnKt5Ljn+ObuU8/ymVe0Vf/h6iveOHWulsHxKAKs=",
+   "pom": "sha256-kZPQe/T2YBCNc1jliyfSG0TjToDWc06Y4hkWN28nDeI="
+  },
+  "com/google/guava#listenablefuture/9999.0-empty-to-avoid-conflict-with-guava": {
+   "jar": "sha256-s3KgN9QjCqV/vv/e8w/WEj+cDC24XQrO0AyRuXTzP5k=",
+   "pom": "sha256-GNSx2yYVPU5VB5zh92ux/gXNuGLvmVSojLzE/zi4Z5s="
+  },
+  "com/google/inject#guice-parent/5.1.0": {
+   "pom": "sha256-Y9XAxkF5feumwFHEfV9pI/OhA+9x5OvDqF0Bw+h4WWw="
+  },
+  "com/google/inject#guice/5.1.0": {
+   "jar": "sha256-QTDlC/rEgJnIYPDZA7kYYMgaJJyQ84JF+P7Vj8gXvCY=",
+   "pom": "sha256-s7jcZSE9Yj+3DteVjb3WFjJCVrqDajFlJWDDiJmf2c0="
+  },
+  "com/google/j2objc#j2objc-annotations/1.3": {
+   "jar": "sha256-Ia8wySJnvWEiwOC00gzMtmQaN+r5VsZUDsRx1YTmSns=",
+   "pom": "sha256-X6yoJLoRW+5FhzAzff2y/OpGui/XdNQwTtvzD6aj8FU="
+  },
+  "com/google/protobuf#protobuf-bom/3.19.6": {
+   "pom": "sha256-8tqbt1IIO0yJDV69ZjFMRyb1M67+dvbCQn6dcfKIIxE="
+  },
+  "com/google/protobuf#protobuf-java/3.19.6": {
+   "jar": "sha256-apot/5Hc9x+FvnGulx9hZLWmMdzTS/8I8GGFNcpErQI=",
+   "pom": "sha256-0QlO6w21FqBQC7C+xZATbmBoqD0P94K3wcdxqeidHaQ="
+  },
+  "com/google/protobuf#protobuf-parent/3.19.6": {
+   "pom": "sha256-rM3kgjBu27qah3rfuxBoD+pME2tueX5TupuEaeolqlw="
+  },
+  "io/github/eisop#dataflow-errorprone/3.34.0-eisop1": {
+   "jar": "sha256-ibT10r1QWfBnxZgqDlmIuH38ioI0eV1oxvMXiEbeMxk=",
+   "pom": "sha256-JaaDYJh6NnhrrYk/EEAXAM1iVkRhR0wdosukpTmpzgY="
+  },
+  "io/github/java-diff-utils#java-diff-utils/4.0": {
+   "jar": "sha256-gQIyN052qVSUnw4hhc19lRWt25GM89o0gfd+B8NWtJo=",
+   "pom": "sha256-ujdnHK74ki0M+eDt8437+8a8ztiRbD1XWzdYp+wog0c="
+  },
+  "javax/inject#javax.inject/1": {
+   "jar": "sha256-kcdwRKUMSBY2wy2Rb9ickRinIZU5BFLIEGUID5V95/8=",
+   "pom": "sha256-lD4SsQBieARjj6KFgFoKt4imgCZlMeZQkh6/5GIai/o="
+  },
+  "org/apiguardian#apiguardian-api/1.1.0": {
+   "pom": "sha256-qUW5y1zZt3sscRhE5lnEPsBw71nZ9Qn6n0wYYbSGJxE="
+  },
+  "org/apiguardian#apiguardian-api/1.1.2": {
+   "jar": "sha256-tQlEisUG1gcxnxglN/CzXXEAdYLsdBgyofER5bW3Czg=",
+   "module": "sha256-4IAoExN1s1fR0oc06aT7QhbahLJAZByz7358fWKCI/w=",
+   "pom": "sha256-MjVQgdEJCVw9XTdNWkO09MG3XVSemD71ByPidy5TAqA="
+  },
+  "org/checkerframework#checker-qual/3.12.0": {
+   "module": "sha256-0EeUnBuBCRwsORN3H6wvMqL6VJuj1dVIzIwLbfpJN3c=",
+   "pom": "sha256-d1t6425iggs7htwao5rzfArEuF/0j3/khakionkPRrk="
+  },
+  "org/checkerframework#checker-qual/3.19.0": {
+   "jar": "sha256-qCfEkYPzpjInfSegpGc2hss0FQdEe51XAmEJS9dIqmg=",
+   "module": "sha256-U+GJnd48UTyh79N2q/+sDmkH6OhKvV+WYkJjTJXk0Vc=",
+   "pom": "sha256-KbqcXOGpS3AL2CPE7WEvWCe1kPGaSXdf1+uPmX+Ko3E="
+  },
+  "org/eclipse/jgit#org.eclipse.jgit-parent/4.4.1.201607150455-r": {
+   "pom": "sha256-p3SkgFVcUSpqo47j/00FmVTUeLvh6QB9zRFdz4CaGKM="
+  },
+  "org/eclipse/jgit#org.eclipse.jgit/4.4.1.201607150455-r": {
+   "jar": "sha256-CyRHsyToY1HjXgjgkUNhlKhG1GnXnpdkQ5hTPHPQH+A=",
+   "pom": "sha256-SCeAj6Q/+4NN512OpzT0ImVPlFwxtM/+P7xdWjepUIk="
+  },
+  "org/junit#junit-bom/5.7.0": {
+   "module": "sha256-Jd5FSzrdZ2VNZpG1PedZO1ApZ7X/VJVHsQTXlh8aUr0=",
+   "pom": "sha256-NfsV+NC+4rWQCiKDJ2I2ZVL5o0nFbO1guhI85Hc4/wA="
+  },
+  "org/junit#junit-bom/5.9.3": {
+   "module": "sha256-tAH9JZAeWCpSSqU0PEs54ovFbiSWHBBpvytLv87ka5M=",
+   "pom": "sha256-TQMpzZ5y8kIOXKFXJMv+b/puX9KIg2FRYnEZD9w0Ltc="
+  },
+  "org/junit/jupiter#junit-jupiter-api/5.9.3": {
+   "jar": "sha256-2JXj7t9PobEN4xqRvlWjAbswe/GO8yWz+l2z+A7pLRw=",
+   "module": "sha256-ba7jABTiBFWh7MbW0LOsYERECtE+9CA5jikZCYDpuHo=",
+   "pom": "sha256-f3KVZWK+1JEdMhf5DeCw0kDdklb4V99aJLvrAVS0FBs="
+  },
+  "org/junit/jupiter#junit-jupiter-engine/5.9.3": {
+   "jar": "sha256-tV4wSxzS6PEWwat3pdw+yoxNm0amnghLY6ylHN61Xw8=",
+   "module": "sha256-lY9TIPRbNNCmZ24W/1ScsBDhQm3KUs/bEFh2vM9Pdog=",
+   "pom": "sha256-D1/XZ2n95tJHMI+Dbf8TTItS9lpC5UuNCtoEFvMKc3o="
+  },
+  "org/junit/platform#junit-platform-commons/1.9.3": {
+   "jar": "sha256-hRkVffgTwhDoX8FBS3QQnj2F9D1wklY+1wTEPEjw1eY=",
+   "module": "sha256-eWpB8nJB+2dgjwGazPTBw2cVe3MjinavhvbeuuNZnrQ=",
+   "pom": "sha256-4Xof3keC8vwjtC3sp1wLBWbVwphQ0DBr5lxdpzuAIXg="
+  },
+  "org/junit/platform#junit-platform-engine/1.9.3": {
+   "jar": "sha256-DDlVPZoDUQdXIn9aHGzGUwKHsaMh7WJYRQZkh0qioWo=",
+   "module": "sha256-nQVThnLcRrITlxJjbv3B8Xg9Q5qhwktp0Ckrgci36o8=",
+   "pom": "sha256-HFq3/OvjpgEYOXm6r78vQOVUOIKnyiPp+etxkZWnR9U="
+  },
+  "org/junit/platform#junit-platform-launcher/1.7.0": {
+   "module": "sha256-zpTSugJQT8kavcC3lzUOUlKHGdBJ7swEOCh+yVuWS6Q=",
+   "pom": "sha256-JNBcKPWp6tLAZ4/REnnqgfHLfvnUY0QdkQT60VADgpo="
+  },
+  "org/junit/platform#junit-platform-launcher/1.9.3": {
+   "jar": "sha256-hRXpGAignIya9eNZGFtZkbXna4rc8YW5o9q07I5bqP8=",
+   "module": "sha256-RbWyPx6RsuZm2Z8Mk1V7bdL2ffBiftKaZpKws4hfGa0=",
+   "pom": "sha256-C3zLRCXoIJoDNc+D1jzDZyv42REMaWbv55d9EWZkjyc="
+  },
+  "org/opentest4j#opentest4j/1.2.0": {
+   "jar": "sha256-WIEt5giY2Xb7ge87YtoFxmBMGP1KJJ9QRCgkefwoavI=",
+   "pom": "sha256-qW5nGBbB/4gDvex0ySQfAlvfsnfaXStO4CJmQFk2+ZQ="
+  },
+  "org/pcollections#pcollections/3.1.4": {
+   "jar": "sha256-NPV5ugdcjaLIoP7dDwTiHqwvtsZg2Q0Pq7Vz6LTcaRg=",
+   "pom": "sha256-umQabIK+0ira2CImO960nS1/iE1NQg2hXAPEJMajjB8="
+  },
+  "org/sonatype/oss#oss-parent/7": {
+   "pom": "sha256-tR+IZ8kranIkmVV/w6H96ne9+e9XRyL+kM5DailVlFQ="
+  },
+  "org/sonatype/oss#oss-parent/9": {
+   "pom": "sha256-+0AmX5glSCEv+C42LllzKyGH7G8NgBgohcFO8fmCgno="
+  }
+ }
+}
--- a/pkgs/by-name/js/jspecify/package.nix
+++ b/pkgs/by-name/js/jspecify/package.nix
@ -1,34 +1,63 @@
 {
  lib,
-  stdenvNoCC,
-  fetchMavenArtifact,
+  stdenv,
+  fetchFromGitHub,
+  writeShellScript,
+  nix-update,
+  gradle,
+  jdk21,
  jre_minimal,
 }:

-stdenvNoCC.mkDerivation (finalAttrs: {
+stdenv.mkDerivation (finalAttrs: {
  pname = "jspecify";
  version = "1.0.0";

-  src = fetchMavenArtifact {
-    groupId = "org.jspecify";
-    artifactId = "jspecify";
-    version = finalAttrs.version;
-    hash = "sha256-H61ua+dVd4Hk0zcp1Jrhzcj92m/kd7sMxozjUer9+6s=";
+  src = fetchFromGitHub {
+    owner = "jspecify";
+    repo = "jspecify";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-WgVRaGm9lYhMeMM6QWUezXtUsXkaK/iPt1gj2koWNu8=";
  };

+  nativeBuildInputs = [
+    gradle
+    jdk21
+  ];
+
+  mitmCache = gradle.fetchDeps {
+    inherit (finalAttrs) pname;
+    data = ./deps.json;
+  };
+
+  # JSpecify's build.gradle reads JAVA_VERSION (defaults to 11). Pin it so Gradle's
+  # toolchain machinery resolves to the JDK we provide instead of trying
+  # to auto-download one.
+  env.JAVA_VERSION = lib.versions.major jdk21.version;
+
+  gradleBuildTask = "assemble";
+
+  doCheck = true;
+
  installPhase = ''
    runHook preInstall

-    install -Dm444 ${finalAttrs.src.jar} $out/share/java/${finalAttrs.pname}-${finalAttrs.version}.jar
+    install -Dm644 build/libs/jspecify-${finalAttrs.version}.jar \
+      $out/share/java/jspecify-${finalAttrs.version}.jar

    runHook postInstall
  '';

+  passthru.updateScript = writeShellScript "update-jspecify" ''
+    ${lib.getExe nix-update} jspecify
+    $(nix-build -A jspecify.mitmCache.updateScript)
+  '';
+
  meta = {
    homepage = "https://jspecify.dev";
    description = "Standard Annotations for Java Static Analysis";
    license = lib.licenses.asl20;
-    sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
+    sourceProvenance = with lib.sourceTypes; [ fromSource ];
    inherit (jre_minimal.meta) platforms;
    maintainers = with lib.maintainers; [ msgilligan ];
  };
--- a/pkgs/by-name/kl/kloak/package.nix
+++ b/pkgs/by-name/kl/kloak/package.nix
@ -17,13 +17,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "kloak";
-  version = "0.8.3-1";
+  version = "0.8.5-1";

  src = fetchFromGitHub {
    owner = "Whonix";
    repo = "kloak";
    tag = finalAttrs.version;
-    hash = "sha256-s+ZntlsEuS9Wv8govXtgyBfHwruTvZJzQP++eR6z9V0=";
+    hash = "sha256-fDmqA00b5ESS9LW2QIeEx3wWb0lhgkqoBYcw1XYDI7k=";
  };

  strictDeps = true;
--- a/pkgs/by-name/km/kmscon/package.nix
+++ b/pkgs/by-name/km/kmscon/package.nix
@ -16,8 +16,11 @@
  pkg-config,
  docbook_xsl,
  docbook_xml_dtd_42,
+  python3,
+  ncurses,
  libxslt,
  libgbm,
+  seatd,
  ninja,
  check,
  bash,
@ -29,13 +32,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "kmscon";
-  version = "9.3.5";
+  version = "10.0.0";

  src = fetchFromGitHub {
    owner = "kmscon";
    repo = "kmscon";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-QBN1rSDmwVg7cgljhe6kVIg/xLoolmOPqS8JXZuQiXs=";
+    hash = "sha256-M3830e1GzzLT2fhheWwNRkURzYkHv4k8uEMoCqKkjJY=";
  };

  strictDeps = true;
@ -57,6 +60,7 @@ stdenv.mkDerivation (finalAttrs: {
    pango
    systemdLibs
    libgbm
+    seatd
    check
    # Needed for autoPatchShebangs when strictDeps = true
    bash
@ -69,6 +73,8 @@ stdenv.mkDerivation (finalAttrs: {
    pkg-config
    libxslt # xsltproc
    docbook_xml_dtd_42
+    python3
+    ncurses
  ];

  outputs = [
@ -76,9 +82,14 @@ stdenv.mkDerivation (finalAttrs: {
    "man"
  ];

-  patches = [
-    ./sandbox.patch # Generate system units where they should be (nix store) instead of /etc/systemd/system
-  ];
+  env = {
+    PKG_CONFIG_SYSTEMD_SYSTEMDSYSTEMUNITDIR = "${placeholder "out"}/lib/systemd/system";
+    DESTDIR = "/";
+  };
+
+  postPatch = ''
+    patchShebangs scripts/terminfo
+  '';

  postFixup = ''
    substituteInPlace $out/bin/kmscon \
--- a/pkgs/by-name/km/kmscon/sandbox.patch
+++ b/pkgs/by-name/km/kmscon/sandbox.patch
@ -1,13 +0,0 @@
-diff --git a/meson.build b/meson.build
-index de29a32..e731bbd 100644
--- a/meson.build
-+++ b/meson.build
-@@ -39,7 +39,7 @@ mandir = get_option('mandir')
- moduledir = get_option('libdir') / meson.project_name()
- 
- systemd_deps = dependency('systemd', required: false)
-systemdsystemunitdir = systemd_deps.get_variable('systemdsystemunitdir', default_value: 'lib/systemd/system')
-+systemdsystemunitdir = get_option('libdir') / 'systemd' / 'system'
- 
- #
- # Required dependencies
--- a/pkgs/by-name/la/ladybird/package.nix
+++ b/pkgs/by-name/la/ladybird/package.nix
@ -19,6 +19,7 @@
  libxcrypt,
  mimalloc,
  openssl,
+  perl,
  python3,
  qt6Packages,
  woff2,
@ -58,6 +59,10 @@ stdenv.mkDerivation (finalAttrs: {
  postPatch = ''
    sed -i '/iconutil/d' UI/CMakeLists.txt

+    perl -0pi -e \
+      's/find_package\(ICU 78\.[0-9]+ EXACT REQUIRED COMPONENTS data i18n uc\)/find_package(ICU ${icu78.version} EXACT REQUIRED COMPONENTS data i18n uc)/ or die "ICU dependency not found\n"' \
+      Meta/CMake/check_for_dependencies.cmake
+
    # Don't set absolute paths in RPATH
    substituteInPlace Meta/CMake/lagom_install_options.cmake \
      --replace-fail "\''${CMAKE_INSTALL_BINDIR}" "bin" \
@ -86,6 +91,7 @@ stdenv.mkDerivation (finalAttrs: {
    cargo
    cmake
    ninja
+    perl
    pkg-config
    python3
    rustPlatform.cargoSetupHook
@ -179,6 +185,7 @@ stdenv.mkDerivation (finalAttrs: {
    maintainers = with lib.maintainers; [
      fgaz
      jk
+      schembriaiden
    ];
    platforms = [
      "x86_64-linux"
--- a/pkgs/by-name/le/leet-helix/package.nix
+++ b/pkgs/by-name/le/leet-helix/package.nix
@ -0,0 +1,49 @@
+{
+  lib,
+  fetchFromGitHub,
+  python3Packages,
+  nix-update-script,
+}:
+
+python3Packages.buildPythonApplication {
+  pname = "leet-helix";
+  version = "0.2.3-unstable-2026-02-24";
+
+  src = fetchFromGitHub {
+    owner = "Jarrlist";
+    repo = "LeetHelix";
+    rev = "d6e07920242ce852453d3d3b47d9418fda8baa8a";
+    hash = "sha256-29RMI66tvSJxh1P2osRCJLvIXbwPy2lPPqtEsKQIWe4=";
+  };
+
+  pyproject = true;
+
+  dependencies = with python3Packages; [
+    typer
+    rich
+    sqlmodel
+    sqlite-utils
+  ];
+
+  build-system = [ python3Packages.hatchling ];
+
+  # necessary for tests which require a writable home
+  preBuild = ''
+    export HOME=$(mktemp -d)
+  '';
+
+  doCheck = true;
+
+  nativeCheckInputs = [ python3Packages.pytestCheckHook ];
+
+  passthru.updateScript = nix-update-script { extraArgs = [ "--version=branch=HEAD" ]; };
+
+  meta = {
+    description = "Game to practice your Helix editor skills with code challenges";
+    license = lib.licenses.mit;
+    homepage = "https://github.com/Jarrlist/LeetHelix";
+    maintainers = [ lib.maintainers.ricardomaps ];
+    platforms = lib.platforms.all;
+    mainProgram = "leet";
+  };
+}
--- a/pkgs/applications/window-managers/lemonbar/xft.nix
+++ b/pkgs/applications/window-managers/lemonbar/xft.nix
--- a/pkgs/applications/window-managers/lemonbar/default.nix
+++ b/pkgs/applications/window-managers/lemonbar/default.nix
--- a/pkgs/by-name/mi/mieru/package.nix
+++ b/pkgs/by-name/mi/mieru/package.nix
@ -6,13 +6,13 @@

 buildGoModule (finalAttrs: {
  pname = "mieru";
-  version = "3.31.0";
+  version = "3.33.0";

  src = fetchFromGitHub {
    owner = "enfein";
    repo = "mieru";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-jiu0q8S7Ab73S8adE6GgoCvkBhimGmF3wPQZj9L6dV8=";
+    hash = "sha256-26BT/OsA4T6S9xqlux/segQXtqWGR+IgCRG/PwuxquU=";
  };

  vendorHash = "sha256-pKcdvP38fZ2KFYNDx6I4TfmnnvWKzFDvz80xMkUojqM=";
--- a/pkgs/by-name/mi/minizip-ng-compat/package.nix
+++ b/pkgs/by-name/mi/minizip-ng-compat/package.nix
@ -0,0 +1,6 @@
+{
+  minizip-ng,
+}:
+minizip-ng.override {
+  enableCompat = true;
+}
--- a/pkgs/by-name/mi/minizip-ng/package.nix
+++ b/pkgs/by-name/mi/minizip-ng/package.nix
@ -10,23 +10,25 @@
  xz,
  zstd,
  openssl,
+  enableCompat ? false,
 }:

 stdenv.mkDerivation (finalAttrs: {
-  pname = "minizip-ng";
-  version = "4.1.0";
+  pname = "minizip-ng" + lib.optionalString enableCompat "-compat";
+  version = "4.2.1";

  src = fetchFromGitHub {
    owner = "zlib-ng";
    repo = "minizip-ng";
    rev = finalAttrs.version;
-    hash = "sha256-H6ttsVBs437lWMBsq5baVDb9e5I6Fh+xggFre/hxGKU=";
+    hash = "sha256-gpjM8Cqoe4kafXgl2wXhhCRx39WC94qJ1DIDyd2n0G8=";
  };

  nativeBuildInputs = [
    cmake
    pkg-config
  ];
+
  buildInputs = [
    zlib
    bzip2
@ -36,45 +38,35 @@ stdenv.mkDerivation (finalAttrs: {
  ];

  cmakeFlags = [
-    "-DBUILD_SHARED_LIBS=${if stdenv.hostPlatform.isStatic then "OFF" else "ON"}"
-    "-DMZ_OPENSSL=ON"
-    "-DMZ_BUILD_TESTS=${if finalAttrs.finalPackage.doCheck then "ON" else "OFF"}"
-    "-DMZ_BUILD_UNIT_TESTS=${if finalAttrs.finalPackage.doCheck then "ON" else "OFF"}"
-    "-DMZ_LIB_SUFFIX='-ng'"
+    (lib.cmakeBool "BUILD_SHARED_LIBS" (!stdenv.hostPlatform.isStatic))
+    (lib.cmakeBool "MZ_OPENSSL" true)
+    (lib.cmakeBool "MZ_PPMD" false) # PPMD support requres internet access to make a git clone
+    (lib.cmakeBool "MZ_LIBCOMP" false) # builds only on Darwin by default where it fails due to mising headers
+    (lib.cmakeBool "MZ_BUILD_TESTS" finalAttrs.doCheck)
+    (lib.cmakeBool "MZ_BUILD_UNIT_TESTS" finalAttrs.doCheck)
+    (lib.cmakeBool "MZ_COMPAT" enableCompat)
  ]
  ++ lib.optionals stdenv.hostPlatform.isi686 [
    # tests fail
-    "-DMZ_PKCRYPT=OFF"
-  ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    # missing header file
-    "-DMZ_LIBCOMP=OFF"
+    (lib.cmakeBool "MZ_PKCRYPT" false)
  ];

  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isDarwin "-Wno-register";

-  postInstall = ''
-    # make lib findable as libminizip-ng even if compat is enabled
-    for ext in so dylib a ; do
-      if [ -e $out/lib/libminizip.$ext ] && [ ! -e $out/lib/libminizip-ng.$ext ]; then
-        ln -s $out/lib/libminizip.$ext $out/lib/libminizip-ng.$ext
-      fi
-    done
-    if [ ! -e $out/include/minizip-ng ]; then
-      ln -s $out/include $out/include/minizip-ng
-    fi
-  '';
-
  doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
-  nativeCheckInputs = [ gtest ];
+  checkInputs = [ gtest ];
  enableParallelChecking = false;

+  strictDeps = true;
+  __structuredAttrs = true;
+
  meta = {
    description = "Fork of the popular zip manipulation library found in the zlib distribution";
    homepage = "https://github.com/zlib-ng/minizip-ng";
    license = lib.licenses.zlib;
    maintainers = with lib.maintainers; [
      ris
+      kuflierl
    ];
    platforms = lib.platforms.unix;
  };
--- a/pkgs/by-name/mu/mudlet/package.nix
+++ b/pkgs/by-name/mu/mudlet/package.nix
@ -7,161 +7,99 @@
  git,
  pkg-config,
  which,
+  assimp,
  boost,
+  discord-rpc,
  hunspell,
  libGLU,
-  libsForQt5,
  libsecret,
  libzip,
  lua5_1,
-  pcre,
+  pipewire,
  pugixml,
-  discord-rpc,
+  qt6Packages,
  yajl,
  withDiscordRpc ? false,
 }:

 let
-  overrideLua =
-    let
-      packageOverrides = self: super: {
-        # luasql-sqlite3 master branch broke compatibility with lua 5.1. Pin to
-        # an earlier commit.
-        # https://github.com/lunarmodules/luasql/issues/147
-        luasql-sqlite3 = super.luaLib.overrideLuarocks super.luasql-sqlite3 (drv: {
-          version = "2.6.0-1-custom";
-          src = fetchFromGitHub {
-            owner = "lunarmodules";
-            repo = "luasql";
-            rev = "8c58fd6ee32faf750daf6e99af015a31402578d1";
-            hash = "sha256-XlTB5O81yWCrx56m0cXQp7EFzeOyfNeqGbuiYqMrTUk=";
-          };
-        });
-      };
-    in
-    lua5_1.override { inherit packageOverrides; };
-
-  luaEnv = overrideLua.withPackages (
+  luaEnv = lua5_1.withPackages (
    ps: with ps; [
-      luazip
-      luafilesystem
-      lrexlib-pcre
-      luasql-sqlite3
+      lpeg
+      lrexlib-pcre2
      lua-yajl
+      luafilesystem
+      luasql-sqlite3
      luautf8
+      luazip
    ]
  );
+  libPathVar = if stdenv.hostPlatform.isDarwin then "DYLD_LIBRARY_PATH" else "LD_LIBRARY_PATH";
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "mudlet";
-  version = "4.19.1";
+  version = "4.20.1";
+
+  __structuredAttrs = true;
+  strictDeps = true;

  src = fetchFromGitHub {
    owner = "Mudlet";
    repo = "Mudlet";
    rev = "Mudlet-${finalAttrs.version}";
    fetchSubmodules = true;
-    hash = "sha256-I4RRIfHw9kZwxMlc9pvdtwPpq9EvNJU69WpGgZ+0uiw=";
+    hash = "sha256-o3f2ChQ7COql+WEe2diATx7wIR0fOlxkXcGWlL1AYkE=";
  };

-  patches = [
-    (fetchpatch {
-      name = "cmake4-fix.patch";
-      url = "https://github.com/Mudlet/Mudlet/commit/933f2551fe3084f0fad6d8b971c6176fe154d8d7.patch?full_index=1";
-      hash = "sha256-MElSRhTaT1a5r/Pz3e7MTrzq0krjdspgW0woAB2C8jc=";
-    })
-  ];
-
  nativeBuildInputs = [
    cmake
    git
    luaEnv
    pkg-config
-    libsForQt5.qttools
+    qt6Packages.qttools
+    qt6Packages.wrapQtAppsHook
    which
-    libsForQt5.wrapQtAppsHook
  ];

  buildInputs = [
+    assimp
    boost
    hunspell
    libGLU
-    libsForQt5.qtkeychain
    libsecret
    libzip
    luaEnv
-    pcre
    pugixml
-    libsForQt5.qtbase
-    libsForQt5.qtmultimedia
+    qt6Packages.qtbase
+    qt6Packages.qt5compat
+    qt6Packages.qtkeychain
+    qt6Packages.qtmultimedia
    yajl
  ]
  ++ lib.optional withDiscordRpc discord-rpc;

  cmakeFlags = [
    # RPATH of binary /nix/store/.../bin/... contains a forbidden reference to /build/
-    "-DCMAKE_SKIP_BUILD_RPATH=ON"
+    (lib.cmakeBool "CMAKE_SKIP_BUILD_RPATH" true)
+    (lib.cmakeBool "USE_FONTS" false)
+    (lib.cmakeBool "USE_OWN_QTKEYCHAIN" false)
+    (lib.cmakeBool "USE_UPDATER" false)
  ];

-  env = {
-    WITH_FONTS = "NO";
-    WITH_UPDATER = "NO";
-  };
-
-  installPhase = ''
-    runHook preInstall
-
-    mkdir -pv $out/lib
-    cp 3rdparty/edbee-lib/edbee-lib/qslog/lib/libQsLog${stdenv.hostPlatform.extensions.sharedLibrary} $out/lib
-    mkdir -pv $out/share/mudlet
-    cp -r ../src/mudlet-lua/lua $out/share/mudlet/
-
-    mkdir -pv $out/share/pixmaps
-    cp -r ../mudlet.png $out/share/pixmaps/
-
-    cp -r ../translations $out/share/
-
-  ''
-  + lib.optionalString stdenv.hostPlatform.isDarwin ''
+  installPhase = lib.optionalString stdenv.hostPlatform.isDarwin ''
    mkdir -p $out/Applications
    cp -r src/mudlet.app/ $out/Applications/mudlet.app
-    mv $out/Applications/mudlet.app/Contents/MacOS/mudlet $out/Applications/mudlet.app/Contents/MacOS/mudlet-unwrapped
-    makeQtWrapper $out/Applications/Mudlet.app/Contents/MacOS/mudlet-unwrapped $out/Applications/Mudlet.app/Contents/MacOS/mudlet \
-      --set LUA_CPATH "${luaEnv}/lib/lua/${lua5_1.luaversion}/?.so" \
-      --prefix LUA_PATH : "$NIX_LUA_PATH" \
-      --prefix DYLD_LIBRARY_PATH : "${
-        lib.makeLibraryPath (
-          [
-            libsForQt5.qtkeychain
-          ]
-          ++ lib.optional withDiscordRpc discord-rpc
-        )
-      }:$out/lib" \
-      --chdir "$out";
+  '';

-  ''
-  + lib.optionalString (!stdenv.hostPlatform.isDarwin) ''
-    mkdir -pv $out/bin
-    cp src/mudlet $out/bin/mudlet-unwrapped
-    makeQtWrapper $out/bin/mudlet-unwrapped $out/bin/mudlet \
-      --set LUA_CPATH "${luaEnv}/lib/lua/${lua5_1.luaversion}/?.so" \
-      --prefix LUA_PATH : "$NIX_LUA_PATH" \
-      --prefix LD_LIBRARY_PATH : "${
-        lib.makeLibraryPath (
-          [
-            libsForQt5.qtkeychain
-          ]
-          ++ lib.optional withDiscordRpc discord-rpc
-        )
-      }" \
-      --chdir "$out";
-
-    mkdir -pv $out/share/applications
-    cp ../mudlet.desktop $out/share/applications/
-
-  ''
-  + ''
-    runHook postInstall
+  preFixup = ''
+    qtWrapperArgs+=(--set LUA_CPATH "${luaEnv}/lib/lua/${lua5_1.luaversion}/?.so")
+    qtWrapperArgs+=(--prefix LUA_PATH : "$NIX_LUA_PATH")
+    qtWrapperArgs+=(--prefix ${libPathVar} : "${
+      lib.makeLibraryPath (
+        lib.optional stdenv.hostPlatform.isLinux pipewire ++ lib.optional withDiscordRpc discord-rpc
+      )
+    }")
+    qtWrapperArgs+=(--chdir "$out")
  '';

  meta = {
@ -173,7 +111,6 @@ stdenv.mkDerivation (finalAttrs: {
      felixalbrigtsen
    ];
    platforms = with lib.platforms; linux ++ darwin;
-    broken = stdenv.hostPlatform.isDarwin;
    license = lib.licenses.gpl2Plus;
    mainProgram = "mudlet";
  };
--- a/pkgs/by-name/na/nakama/package.nix
+++ b/pkgs/by-name/na/nakama/package.nix
@ -6,13 +6,13 @@

 buildGoModule (finalAttrs: {
  pname = "nakama";
-  version = "3.38.0";
+  version = "3.39.0";

  src = fetchFromGitHub {
    owner = "heroiclabs";
    repo = "nakama";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-sI+uTjP/ONLhYC3kqVlKNEqbrI8fABOHckrz0pg7Hi0=";
+    hash = "sha256-+yHQ2KxH/Kzv8s3hPsOh3IQZvSPeAwWHYHHHh3NR8VA=";
  };

  vendorHash = null;
--- a/pkgs/by-name/no/notesnook/package.nix
+++ b/pkgs/by-name/no/notesnook/package.nix
@ -53,9 +53,7 @@ let
    '';
    homepage = "https://notesnook.com";
    license = lib.licenses.gpl3Only;
-    maintainers = with lib.maintainers; [
-      keysmashes
-    ];
+    maintainers = [ ];
    platforms = [
      "x86_64-linux"
      "aarch64-linux"
--- a/pkgs/by-name/ob/obsidian/package.nix
+++ b/pkgs/by-name/ob/obsidian/package.nix
@ -6,6 +6,7 @@
  electron_40, # see https://github.com/NixOS/nixpkgs/pull/521495
  makeDesktopItem,
  imagemagick,
+  asar,
  autoPatchelfHook,
  writeScript,
  _7zz,
@ -87,10 +88,20 @@ let
      autoPatchelfHook
      makeWrapper
      imagemagick
+      asar
    ];
    installPhase = ''
      runHook preInstall
      mkdir -p $out/bin
+
+      # Mark Obsidian's app:// scheme `corsEnabled` to fix the internal PDF
+      # viewer; see https://github.com/NixOS/nixpkgs/pull/525772 for details.
+      # Remove once upstream registers the scheme with `corsEnabled`.
+      asar extract resources/app.asar app-src
+      substituteInPlace app-src/main.js \
+        --replace-fail "supportFetchAPI: true," "supportFetchAPI: true, corsEnabled: true,"
+      asar pack app-src resources/app.asar
+
      makeWrapper ${electron_40}/bin/electron $out/bin/obsidian \
        --add-flags $out/share/obsidian/app.asar \
        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform=wayland --enable-wayland-ime=true --wayland-text-input-version=3}}" \
--- a/pkgs/by-name/pm/pmtiles/darwin-sandbox-fix.patch
+++ b/pkgs/by-name/pm/pmtiles/darwin-sandbox-fix.patch
@ -1,20 +0,0 @@
--- vendor/modernc.org/libc/honnef.co/go/netdb/netdb.go
-+++ vendor/modernc.org/libc/honnef.co/go/netdb/netdb.go
-@@ -696,7 +696,7 @@ func init() {
- 	// Load protocols
- 	data, err := ioutil.ReadFile("/etc/protocols")
- 	if err != nil {
-		if !os.IsNotExist(err) {
-+		if !os.IsNotExist(err) && !os.IsPermission(err) {
- 			panic(err)
- 		}
- 
-@@ -732,7 +732,7 @@ func init() {
- 	// Load services
- 	data, err = ioutil.ReadFile("/etc/services")
- 	if err != nil {
-		if !os.IsNotExist(err) {
-+		if !os.IsNotExist(err) && !os.IsPermission(err) {
- 			panic(err)
- 		}
- 
--- a/pkgs/by-name/pm/pmtiles/package.nix
+++ b/pkgs/by-name/pm/pmtiles/package.nix
@ -5,23 +5,16 @@
 }:
 buildGoModule (finalAttrs: {
  pname = "pmtiles";
-  version = "1.30.0";
+  version = "1.30.3";

  src = fetchFromGitHub {
    owner = "protomaps";
    repo = "go-pmtiles";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-7Xkkna85ls5kRelar2DMf+U/4tCa9up/H+uuDJTXJr8=";
+    hash = "sha256-SFuW/TKKxBGOeyYdHLm7J2w3n8xPjLzSJTIi322WTk0=";
  };

-  vendorHash = "sha256-UzpyvWsfbzYTngMdWU+fgZj/yQvSfJzhFWpFRsD24GE=";
-
-  overrideModAttrs = old: {
-    # https://gitlab.com/cznic/libc/-/merge_requests/10
-    postBuild = ''
-      patch -p0 < ${./darwin-sandbox-fix.patch}
-    '';
-  };
+  vendorHash = "sha256-0u/04mpqhpRideIf8eOzgC7ZWNp4P2c2ssQvyWlcD4M=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/pr/prusa-slicer/package.nix
+++ b/pkgs/by-name/pr/prusa-slicer/package.nix
@ -19,6 +19,7 @@
  gmp,
  gtk3,
  hicolor-icon-theme,
+  hidapi,
  libpng,
  mpfr,
  nanosvg,
@ -61,14 +62,14 @@ let
 in
 clangStdenv.mkDerivation (finalAttrs: {
  pname = "prusa-slicer";
-  version = "2.9.4";
+  version = "2.9.5";
  # Build with clang even on Linux, because GCC uses absolutely obscene amounts of memory
  # on this particular code base (OOM with 32GB memory and --cores 16 on GCC, succeeds
  # with --cores 32 on clang).
  src = fetchFromGitHub {
    owner = "prusa3d";
    repo = "PrusaSlicer";
-    hash = "sha256-1ilgr9RaIoWvj0TDVc20XjjUUcNtnicR7KlE0ii3GQE=";
+    hash = "sha256-tVC/hIykg0flc9HgB4ddJqUEVolZ4Lu/Cx5I10Z2eCI=";
    rev = "version_${finalAttrs.version}";
  };

@ -132,6 +133,7 @@ clangStdenv.mkDerivation (finalAttrs: {
    gmp
    gtk3
    hicolor-icon-theme
+    hidapi
    libpng
    mpfr
    nanosvg-fltk
--- a/pkgs/by-name/re/replacement/package.nix
+++ b/pkgs/by-name/re/replacement/package.nix
@ -9,8 +9,6 @@ python3Packages.buildPythonApplication (finalAttrs: {
  version = "0.4.4";
  pyproject = true;

-  disabled = python3Packages.isPy27;
-
  src = fetchFromGitHub {
    owner = "siriobalmelli";
    repo = "replacement";
--- a/pkgs/by-name/rs/rsonpath/package.nix
+++ b/pkgs/by-name/rs/rsonpath/package.nix
@ -8,16 +8,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "rsonpath";
-  version = "0.10.0";
+  version = "0.10.1";

  src = fetchFromGitHub {
    owner = "rsonquery";
    repo = "rsonpath";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Lh58U5A4EeD+tQ3CZNE7YabwGIJ14Cv5dqbJ64JYNDk=";
+    hash = "sha256-pgKqVDDaJ8vcDOp0FuuuBkShQDFP3x6BVS7x8ZZawAY=";
  };

-  cargoHash = "sha256-w1AODL95+O0jhzXvNrL9I+i2+jcZX3SvJDKrLWkI7c8=";
+  cargoHash = "sha256-PC35k3vwKP55VKZt1txKVajhfrJpFiEgJYA4lNe/U7U=";

  cargoBuildFlags = [ "-p=rsonpath" ];
  cargoTestFlags = finalAttrs.cargoBuildFlags;
--- a/pkgs/by-name/sd/sdl_gamecontrollerdb/package.nix
+++ b/pkgs/by-name/sd/sdl_gamecontrollerdb/package.nix
@ -7,13 +7,13 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "sdl_gamecontrollerdb";
-  version = "0-unstable-2026-05-12";
+  version = "0-unstable-2026-05-28";

  src = fetchFromGitHub {
    owner = "mdqinc";
    repo = "SDL_GameControllerDB";
-    rev = "7988b5e84c31616200ee2ffd2347386c6b3165a8";
-    hash = "sha256-Jwa+YJcEy+6Ye0ILttv5iAmJ9t0mIk8e5XXEuA1nFjE=";
+    rev = "cbdb3678270cf5bf14a127934fd7ab332ecd3cbc";
+    hash = "sha256-bjsss+ifkCqJKzirqbBS5PtD80fG9JPY6yPiHsf9DO8=";
  };

  dontBuild = true;
--- a/pkgs/by-name/se/servo/package.nix
+++ b/pkgs/by-name/se/servo/package.nix
@ -69,13 +69,13 @@ in

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "servo";
-  version = "0.1.0";
+  version = "0.2.0";

  src = fetchFromGitHub {
    owner = "servo";
    repo = "servo";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-DnjtKizYwadBYDqafFDuE/DRIjCqnK/L95zV0Fv0Xhc=";
+    hash = "sha256-zZitnAiexoroKx3TMu3sB0KDvIsBcT7Krwa6lJqY4yw=";
    # Breaks reproducibility depending on whether the picked commit
    # has other ref-names or not, which may change over time, i.e. with
    # "ref-names: HEAD -> main" as long this commit is the branch HEAD
@ -85,7 +85,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    '';
  };

-  cargoHash = "sha256-TJXWscTnsXxaWTfn7BugVMPamXOsyHXQhJskX04X7Zw=";
+  cargoHash = "sha256-hZBI3Vte/FvN7qJy2VGF0LVQIFSWa931BFFbaUfN814=";

  # set `HOME` to a temp dir for write access
  # Fix invalid option errors during linking (https://github.com/mozilla/nixpkgs-mozilla/commit/c72ff151a3e25f14182569679ed4cd22ef352328)
@ -171,6 +171,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
  meta = {
    # undefined libmozjs_sys symbols during linking
    broken = stdenv.hostPlatform.isDarwin;
+    changelog = "https://github.com/servo/servo/releases/tag/${finalAttrs.src.tag}";
    description = "Embeddable, independent, memory-safe, modular, parallel web rendering engine";
    homepage = "https://servo.org";
    license = lib.licenses.mpl20;
--- a/pkgs/by-name/sp/spice-up/package.nix
+++ b/pkgs/by-name/sp/spice-up/package.nix
@ -15,19 +15,18 @@
  libevdev,
  libgee,
  libgudev,
-  libsoup_2_4,
  pantheon,
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "spice-up";
  version = "1.9.1";

  src = fetchFromGitHub {
    owner = "Philip-Scott";
    repo = "Spice-up";
-    rev = version;
-    sha256 = "sha256-FI6YMbqZfaU19k8pS2eoNCnX8O8F99SHHOxMwHC5fTc=";
+    tag = finalAttrs.version;
+    hash = "sha256-FI6YMbqZfaU19k8pS2eoNCnX8O8F99SHHOxMwHC5fTc=";
  };

  nativeBuildInputs = [
@ -46,11 +45,16 @@ stdenv.mkDerivation rec {
    libevdev
    libgee
    libgudev
-    libsoup_2_4
    pantheon.granite
  ];

+  # Drop dependency on libsoup 2.4, which is insecure. It's no longer actually
+  # used upstream, so this is harmless.
+  # https://github.com/Philip-Scott/Spice-up/issues/328
  postPatch = ''
+    substituteInPlace meson.build --replace-fail "soup_dep = dependency('libsoup-2.4')" ""
+    substituteInPlace src/meson.build --replace-fail "soup_dep," ""
+
    chmod +x meson/post_install.py
    patchShebangs meson/post_install.py
  '';
@ -72,4 +76,4 @@ stdenv.mkDerivation rec {
    license = lib.licenses.gpl3Plus;
    mainProgram = "com.github.philip_scott.spice-up";
  };
-}
+})
--- a/pkgs/by-name/su/sunshine/package.nix
+++ b/pkgs/by-name/su/sunshine/package.nix
@ -29,7 +29,6 @@
  libcap,
  libgbm,
  curl,
-  pcre,
  pcre2,
  python3,
  libuuid,
@ -166,7 +165,6 @@ stdenv'.mkDerivation (finalAttrs: {
    libevdev
    libcap
    libdrm
-    pcre
    pcre2
    libuuid
    libselinux
--- a/pkgs/by-name/th/thunderkittens/package.nix
+++ b/pkgs/by-name/th/thunderkittens/package.nix
@ -7,7 +7,7 @@

 stdenvNoCC.mkDerivation {
  pname = "thunderkittens";
-  version = "0-unstable-2026-05-22";
+  version = "0-unstable-2026-05-27";

  __structuredAttrs = true;
  strictDeps = true;
@ -15,8 +15,8 @@ stdenvNoCC.mkDerivation {
  src = fetchFromGitHub {
    owner = "HazyResearch";
    repo = "ThunderKittens";
-    rev = "f05decc66ddc209f80d7746d110961901012f8b0";
-    hash = "sha256-LPsfnAYZw+jIACH1LUP7CRTFFC4P0G2w905eHGr5gRo=";
+    rev = "34b15f7e7012de25ae162c8d9dc85296dd342676";
+    hash = "sha256-VN6AACu6LqOuCCvpNOeGGdYkQblxyWolBnCNeSxgiL4=";
  };

  dontBuild = true;
--- a/pkgs/by-name/up/uptime-kuma/package.nix
+++ b/pkgs/by-name/up/uptime-kuma/package.nix
@ -9,16 +9,16 @@

 buildNpmPackage (finalAttrs: {
  pname = "uptime-kuma";
-  version = "2.3.2";
+  version = "2.4.0";

  src = fetchFromGitHub {
    owner = "louislam";
    repo = "uptime-kuma";
    tag = finalAttrs.version;
-    hash = "sha256-TJCpmUT/E7Il9h7UM1rs2s8l2Vey+X3PZToFLTgxFdA=";
+    hash = "sha256-iqkf9/UAQOnSA+nncK/fmjbqZpIQeUmigI/78m5qKrM=";
  };

-  npmDepsHash = "sha256-FnUjHi0l/WDBX0T65bomElcEG+mRc81n/s22npeHnlM=";
+  npmDepsHash = "sha256-chvykBfnARLto+Il9gumm6UTRSTPPBjg5pj4yGFiOcg=";

  patches = [
    # Fixes the permissions of the database being not set correctly
--- a/pkgs/by-name/ur/uriparser/package.nix
+++ b/pkgs/by-name/ur/uriparser/package.nix
@ -26,7 +26,9 @@ stdenv.mkDerivation (finalAttrs: {

  doCheck = true;

-  nativeCheckInputs = [ gtest ];
+  checkInputs = [ gtest ];
+
+  strictDeps = true;

  meta = {
    changelog = "https://github.com/uriparser/uriparser/blob/uriparser-${finalAttrs.version}/ChangeLog";
--- a/pkgs/by-name/ve/verapdf-gui/package.nix
+++ b/pkgs/by-name/ve/verapdf-gui/package.nix
@ -0,0 +1,5 @@
+{ verapdf }:
+verapdf.override {
+  withCli = false;
+  withGui = true;
+}
--- a/pkgs/by-name/ve/verapdf/package.nix
+++ b/pkgs/by-name/ve/verapdf/package.nix
@ -7,10 +7,14 @@
  makeDesktopItem,
  copyDesktopItems,
  jre,
+  versionCheckHook,
+  withCli ? true,
+  withGui ? false,
 }:
 maven.buildMavenPackage rec {
-  pname = "verapdf";
-  version = "1.28.2";
+  pname = "verapdf" + lib.optionalString (withGui && !withCli) "-gui";
+  version = "1.30.1";
+  __structuredAttrs = true;

  mvnParameters =
    "-pl '!installer' -Dverapdf.timestamp=1980-01-01T00:00:02Z -Dproject.build.outputTimestamp=1980-01-01T00:00:02Z "
@ -27,13 +31,15 @@ maven.buildMavenPackage rec {
  src = fetchFromGitHub {
    owner = "veraPDF";
    repo = "veraPDF-apps";
-    rev = "v${version}";
-    hash = "sha256-tv5iffIQkyjHyulnmagcJuSGbc4tXRYTwB3hSEGLQrc=";
+    tag = "v${version}";
+    hash = "sha256-IoQbAYEUJuK5FxGSxiLfcn5X1KOJca70hu4cMaYXfmw=";
  };

  patches = [ ./stable-maven-plugins.patch ];

-  mvnHash = "sha256-CrpiomKsAyD7SyVzwbjVXy8BoVnkejQVcim+kwVP5Ng=";
+  mvnHash = "sha256-hY+zPuSujMr3RntuLOZVEN8GN4n8201+S5OYvwB1+j4=";
+
+  strictDeps = true;

  nativeBuildInputs = [
    makeWrapper
@ -45,18 +51,22 @@ maven.buildMavenPackage rec {
    runHook preInstall

    mkdir -p $out/bin $out/share
-
-    install -Dm644 greenfield-apps/target/greenfield-apps-${lib.versions.majorMinor version}.0.jar $out/share/verapdf.jar
-
-    makeWrapper ${jre}/bin/java $out/bin/verapdf-gui --add-flags "-jar $out/share/verapdf.jar"
-    makeWrapper ${jre}/bin/java $out/bin/verapdf --add-flags "-cp $out/share/verapdf.jar org.verapdf.apps.GreenfieldCliWrapper"
+  ''
+  + lib.optionalString withCli ''
+    install -Dm644 cli/target/cli-${lib.versions.majorMinor version}.0.jar $out/share/verapdf.jar
+    makeWrapper ${lib.getExe jre} $out/bin/verapdf --add-flags "-jar $out/share/verapdf.jar"
+  ''
+  + lib.optionalString withGui ''
+    install -Dm644 gui/target/gui-${lib.versions.majorMinor version}.0.jar $out/share/verapdf-gui.jar
+    makeWrapper ${lib.getExe jre} $out/bin/verapdf-gui --add-flags "-jar $out/share/verapdf-gui.jar"

    install -Dm644 gui/src/main/resources/org/verapdf/gui/images/icon.png $out/share/icons/hicolor/256x256/apps/verapdf.png
-
+  ''
+  + ''
    runHook postInstall
  '';

-  desktopItems = [
+  desktopItems = lib.optionals withGui [
    (makeDesktopItem {
      name = "veraPDF";
      comment = meta.description;
@ -73,7 +83,21 @@ maven.buildMavenPackage rec {
    })
  ];

+  # GUI has no --version flag
+  doInstallCheck = withCli;
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+
+  versionCheckProgram = "${placeholder "out"}/bin/verapdf";
+
+  preVersionCheck = ''
+    version=${lib.versions.majorMinor version}.0
+  '';
+
  meta = {
+    changelog = "https://github.com/veraPDF/veraPDF-library/blob/${src.tag}/RELEASENOTES.md";
    description = "Command line and GUI industry supported PDF/A and PDF/UA Validation";
    homepage = "https://github.com/veraPDF/veraPDF-apps";
    license = [
@ -81,10 +105,15 @@ maven.buildMavenPackage rec {
      # or
      lib.licenses.mpl20
    ];
-    mainProgram = "verapdf-gui";
    maintainers = [
      lib.maintainers.mohe2015
      lib.maintainers.kilianar
    ];
+  }
+  // lib.optionalAttrs (withCli && !withGui) {
+    mainProgram = "verapdf";
+  }
+  // lib.optionalAttrs (withGui && !withCli) {
+    mainProgram = "verapdf-gui";
  };
 }
--- a/pkgs/by-name/yo/youki/package.nix
+++ b/pkgs/by-name/yo/youki/package.nix
@ -57,8 +57,8 @@ rustPlatform.buildRustPackage (finalAttrs: {

  meta = {
    description = "Container runtime written in Rust";
-    homepage = "https://containers.github.io/youki/";
-    changelog = "https://github.com/containers/youki/releases/tag/v${finalAttrs.version}";
+    homepage = "https://youki-dev.github.io/youki/";
+    changelog = "https://github.com/youki-dev/youki/releases/tag/v${finalAttrs.version}";
    license = lib.licenses.asl20;
    maintainers = with lib.maintainers; [ builditluc ];
    platforms = lib.platforms.linux;
--- a/pkgs/by-name/zm/zmap/package.nix
+++ b/pkgs/by-name/zm/zmap/package.nix
@ -17,13 +17,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "zmap";
-  version = "4.3.4";
+  version = "4.4.0";

  src = fetchFromGitHub {
    owner = "zmap";
    repo = "zmap";
    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-fHCVo8OwQUzpdDq7dMBxvK15Ojth5UmNoPTVuTGUP58=";
+    sha256 = "sha256-Mym0pyd43pcbnZzPW3P+N5syjTJBuMsH2ZsjOJmqZgA=";
  };

  cmakeFlags = [ "-DRESPECT_INSTALL_PREFIX_CONFIG=ON" ];
--- a/pkgs/desktops/enlightenment/efl/default.nix
+++ b/pkgs/desktops/enlightenment/efl/default.nix
@ -70,14 +70,19 @@
  zlib,
  directoryListingUpdater,
 }:
-
-stdenv.mkDerivation rec {
+let
+  inherit (lib)
+    mesonBool
+    mesonOption
+    ;
+in
+stdenv.mkDerivation (finalAttrs: {
  pname = "efl";
  version = "1.28.1";

  src = fetchurl {
-    url = "https://download.enlightenment.org/rel/libs/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-hM9hRfnMgr//aQAFviQ5LI88UvjgD/BNjuo3FCnAlCQ=";
+    url = "https://download.enlightenment.org/rel/libs/efl/efl-${finalAttrs.version}.tar.xz";
+    hash = "sha256-hM9hRfnMgr//aQAFviQ5LI88UvjgD/BNjuo3FCnAlCQ=";
  };

  nativeBuildInputs = [
@ -159,6 +164,8 @@ stdenv.mkDerivation rec {
    libxcb
  ];

+  strictDeps = true;
+
  dontDropIconThemeCache = true;

  # Fix build with gcc15 (-std=gnu23)
@ -166,17 +173,17 @@ stdenv.mkDerivation rec {

  mesonFlags = [
    "--buildtype=release"
-    "-D build-tests=false" # disable build tests, which are not working
-    "-D ecore-imf-loaders-disabler=ibus,scim" # ibus is disabled by default, scim is not available in nixpkgs
-    "-D embedded-lz4=false"
-    "-D fb=true"
-    "-D network-backend=connman"
-    "-D sdl=true"
-    "-D elua=true"
-    "-D bindings=lua,cxx"
+    (mesonBool "build-tests" false) # disable build tests, which are not working
+    (mesonOption "ecore-imf-loaders-disabler" "ibus,scim") # ibus is disabled by default, scim is not available in nixpkgs
+    (mesonBool "embedded-lz4" false)
+    (mesonBool "fb" true)
+    (mesonOption "network-backend" "connman")
+    (mesonBool "sdl" true)
+    (mesonBool "elua" true)
+    (mesonOption "bindings" "lua,cxx")
    # for wayland client support
-    "-D wl=true"
-    "-D drm=true"
+    (mesonBool "wl" true)
+    (mesonBool "drm" true)
  ];

  patches = [
@ -187,8 +194,8 @@ stdenv.mkDerivation rec {
    patchShebangs src/lib/elementary/config_embed

    # fix destination of systemd unit and dbus service
-    substituteInPlace systemd-services/meson.build --replace "sys_dep.get_pkgconfig_variable('systemduserunitdir')" "'$out/systemd/user'"
-    substituteInPlace dbus-services/meson.build --replace "dep.get_pkgconfig_variable('session_bus_services_dir')" "'$out/share/dbus-1/services'"
+    substituteInPlace systemd-services/meson.build --replace-fail "sys_dep.get_pkgconfig_variable('systemduserunitdir')" "'$out/systemd/user'"
+    substituteInPlace dbus-services/meson.build --replace-fail "dep.get_pkgconfig_variable('session_bus_services_dir')" "'$out/share/dbus-1/services'"
  '';

  # bin/edje_cc creates $HOME/.run, which would break build of reverse dependencies.
@ -205,14 +212,14 @@ stdenv.mkDerivation rec {

  postInstall = ''
    # fix use of $out variable
-    substituteInPlace "$out/share/elua/core/util.lua" --replace '$out' "$out"
+    substituteInPlace "$out/share/elua/core/util.lua" --replace-fail '$out' "$out"
    rm "$out/share/elua/core/util.lua.orig"

    # add all module include dirs to the Cflags field in efl.pc
    modules=$(for i in "$out/include/"*/; do printf ' -I''${includedir}/'`basename $i`; done)
    substituteInPlace "$out/lib/pkgconfig/efl.pc" \
-      --replace 'Cflags: -I''${includedir}/efl-1' \
-                'Cflags: -I''${includedir}/eina-1/eina'"$modules"
+      --replace-fail 'Cflags: -I''${includedir}/efl-1' \
+                     'Cflags: -I''${includedir}/eina-1/eina'"$modules"

    # build icon cache
    gtk-update-icon-cache "$out"/share/icons/Enlightenment-X
@ -227,6 +234,8 @@ stdenv.mkDerivation rec {

  passthru.updateScript = directoryListingUpdater { };

+  __structuredAttrs = true;
+
  meta = {
    description = "Enlightenment foundation libraries";
    homepage = "https://enlightenment.org/";
@ -242,4 +251,4 @@ stdenv.mkDerivation rec {
    ];
    teams = [ lib.teams.enlightenment ];
  };
-}
+})
--- a/pkgs/development/compilers/temurin-bin/generate-sources.py
+++ b/pkgs/development/compilers/temurin-bin/generate-sources.py
@ -2,11 +2,11 @@
 #!nix-shell --pure -i python3 -p "python3.withPackages (ps: with ps; [ requests ])"

 import json
-import re
+import os
 import requests
 import sys

-feature_versions = (8, 11, 17, 21, 25)
+all_feature_versions = (8, 11, 17, 21, 25, 26)
 oses = ("mac", "linux", "alpine-linux")
 types = ("jre", "jdk")
 impls = ("hotspot",)
@ -57,7 +57,30 @@ def generate_sources(assets, feature_version, out):
    return out


-out = {}
+# Parse optional version arguments; default to all known versions.
+# This is especially helpful when adding a new version without updating everything..
+if len(sys.argv) > 1:
+    try:
+        feature_versions = tuple(int(v) for v in sys.argv[1:])
+    except ValueError:
+        print(f"usage: {sys.argv[0]} [version ...]", file=sys.stderr)
+        print(f"  version: one or more feature version numbers, e.g. 21 25", file=sys.stderr)
+        sys.exit(1)
+    unknown = [v for v in feature_versions if v not in all_feature_versions]
+    if unknown:
+        print(f"warning: unknown feature version(s): {', '.join(str(v) for v in unknown)}", file=sys.stderr)
+else:
+    feature_versions = all_feature_versions
+
+sources_path = os.path.join(os.path.dirname(__file__), "sources.json")
+
+# Load existing sources so unrelated versions are preserved during partial updates.
+try:
+    with open(sources_path) as f:
+        out = json.load(f)
+except FileNotFoundError:
+    out = {}
+
 for feature_version in feature_versions:
    # Default user-agent is blocked by Azure WAF.
    headers = {'user-agent': 'nixpkgs-temurin-generate-sources/1.0.0'}
@ -68,6 +91,6 @@ for feature_version in feature_versions:
        sys.exit(1)
    generate_sources(resp.json(), f"openjdk{feature_version}", out)

-with open("sources.json", "w") as f:
+with open(sources_path, "w") as f:
    json.dump(out, f, indent=2, sort_keys=True)
    f.write('\n')
--- a/pkgs/development/compilers/temurin-bin/jdk-darwin.nix
+++ b/pkgs/development/compilers/temurin-bin/jdk-darwin.nix
@ -3,6 +3,12 @@
 let
  sources = (lib.importJSON ./sources.json).hotspot.mac;
  common = opts: callPackage (import ./jdk-darwin-base.nix opts) { };
+  withModernDrvAttrs =
+    drv:
+    drv.overrideAttrs (_: {
+      __structuredAttrs = true;
+      strictDeps = true;
+    });

 in
 # EOL = [ "This JDK version has reached End of Life." ];
@ -21,4 +27,11 @@ in

  jdk-25 = common { sourcePerArch = sources.jdk.openjdk25; };
  jre-25 = common { sourcePerArch = sources.jre.openjdk25; };
+
+  jdk-26 = withModernDrvAttrs (common {
+    sourcePerArch = sources.jdk.openjdk26;
+  });
+  jre-26 = withModernDrvAttrs (common {
+    sourcePerArch = sources.jre.openjdk26;
+  });
 }
--- a/pkgs/development/compilers/temurin-bin/jdk-linux.nix
+++ b/pkgs/development/compilers/temurin-bin/jdk-linux.nix
@ -8,6 +8,12 @@ let
  variant = if stdenv.hostPlatform.isMusl then "alpine-linux" else "linux";
  sources = (lib.importJSON ./sources.json).hotspot.${variant};
  common = opts: callPackage (import ./jdk-linux-base.nix opts) { };
+  withModernDrvAttrs =
+    drv:
+    drv.overrideAttrs (_: {
+      __structuredAttrs = true;
+      strictDeps = true;
+    });

 in
 # EOL = [ "This JDK version has reached End of Life." ];
@ -26,4 +32,11 @@ in

  jdk-25 = common { sourcePerArch = sources.jdk.openjdk25; };
  jre-25 = common { sourcePerArch = sources.jre.openjdk25; };
+
+  jdk-26 = withModernDrvAttrs (common {
+    sourcePerArch = sources.jdk.openjdk26;
+  });
+  jre-26 = withModernDrvAttrs (common {
+    sourcePerArch = sources.jre.openjdk26;
+  });
 }
--- a/pkgs/development/compilers/temurin-bin/sources.json
+++ b/pkgs/development/compilers/temurin-bin/sources.json
@ -54,6 +54,22 @@
            "version": "25.0.3"
          }
        },
+        "openjdk26": {
+          "aarch64": {
+            "build": "8",
+            "sha256": "7e32b89349385f10d7805197c7696b46556717d041e681017b12590bae6692ca",
+            "url": "https://github.com/adoptium/temurin26-binaries/releases/download/jdk-26.0.1%2B8/OpenJDK26U-jdk_aarch64_alpine-linux_hotspot_26.0.1_8.tar.gz",
+            "version": "26.0.1"
+          },
+          "packageType": "jdk",
+          "vmType": "hotspot",
+          "x86_64": {
+            "build": "8",
+            "sha256": "0c97fe7e503fb6daf36a5e86e8d083b97cc2354cda4d11288e6c3b8ec0818afc",
+            "url": "https://github.com/adoptium/temurin26-binaries/releases/download/jdk-26.0.1%2B8/OpenJDK26U-jdk_x64_alpine-linux_hotspot_26.0.1_8.tar.gz",
+            "version": "26.0.1"
+          }
+        },
        "openjdk8": {
          "packageType": "jdk",
          "vmType": "hotspot",
@ -118,6 +134,22 @@
            "version": "25.0.3"
          }
        },
+        "openjdk26": {
+          "aarch64": {
+            "build": "8",
+            "sha256": "3106f091aad558977d890b0f6639beacd2815ea051a75a23733b3b16fee6ca55",
+            "url": "https://github.com/adoptium/temurin26-binaries/releases/download/jdk-26.0.1%2B8/OpenJDK26U-jre_aarch64_alpine-linux_hotspot_26.0.1_8.tar.gz",
+            "version": "26.0.1"
+          },
+          "packageType": "jre",
+          "vmType": "hotspot",
+          "x86_64": {
+            "build": "8",
+            "sha256": "d218b359f735122cadeb9cbb226c4ddff8746c46a8d5b833809aedff85bd48a6",
+            "url": "https://github.com/adoptium/temurin26-binaries/releases/download/jdk-26.0.1%2B8/OpenJDK26U-jre_x64_alpine-linux_hotspot_26.0.1_8.tar.gz",
+            "version": "26.0.1"
+          }
+        },
        "openjdk8": {
          "packageType": "jre",
          "vmType": "hotspot",
@ -262,6 +294,34 @@
            "version": "25.0.3"
          }
        },
+        "openjdk26": {
+          "aarch64": {
+            "build": "8",
+            "sha256": "613f9b2861dea937b24d5eca745ef8567733b377d0bb612195acaad0e3f61360",
+            "url": "https://github.com/adoptium/temurin26-binaries/releases/download/jdk-26.0.1%2B8/OpenJDK26U-jdk_aarch64_linux_hotspot_26.0.1_8.tar.gz",
+            "version": "26.0.1"
+          },
+          "packageType": "jdk",
+          "powerpc64le": {
+            "build": "8",
+            "sha256": "60e016faf4177840430035d948f83f2887d556fe512b78c1d43b320322fe6685",
+            "url": "https://github.com/adoptium/temurin26-binaries/releases/download/jdk-26.0.1%2B8/OpenJDK26U-jdk_ppc64le_linux_hotspot_26.0.1_8.tar.gz",
+            "version": "26.0.1"
+          },
+          "riscv64": {
+            "build": "8",
+            "sha256": "f1b762d6d86599627983df200f215bc970444a697159ca3fae93208756b44715",
+            "url": "https://github.com/adoptium/temurin26-binaries/releases/download/jdk-26.0.1%2B8/OpenJDK26U-jdk_riscv64_linux_hotspot_26.0.1_8.tar.gz",
+            "version": "26.0.1"
+          },
+          "vmType": "hotspot",
+          "x86_64": {
+            "build": "8",
+            "sha256": "8e512f13e575a43655fc92319436c94890c137b9035cc6bd6f9cf24239704d3a",
+            "url": "https://github.com/adoptium/temurin26-binaries/releases/download/jdk-26.0.1%2B8/OpenJDK26U-jdk_x64_linux_hotspot_26.0.1_8.tar.gz",
+            "version": "26.0.1"
+          }
+        },
        "openjdk8": {
          "aarch64": {
            "build": "9",
@ -428,6 +488,34 @@
            "version": "25.0.3"
          }
        },
+        "openjdk26": {
+          "aarch64": {
+            "build": "8",
+            "sha256": "bf5f733066599065de5e720edda550b39d85876f5bf23a94fee2cb6a8379cb36",
+            "url": "https://github.com/adoptium/temurin26-binaries/releases/download/jdk-26.0.1%2B8/OpenJDK26U-jre_aarch64_linux_hotspot_26.0.1_8.tar.gz",
+            "version": "26.0.1"
+          },
+          "packageType": "jre",
+          "powerpc64le": {
+            "build": "8",
+            "sha256": "d8f66903603c3661c0d8c03de41b76459260ed2e295ba874bb7b3f37a012c026",
+            "url": "https://github.com/adoptium/temurin26-binaries/releases/download/jdk-26.0.1%2B8/OpenJDK26U-jre_ppc64le_linux_hotspot_26.0.1_8.tar.gz",
+            "version": "26.0.1"
+          },
+          "riscv64": {
+            "build": "8",
+            "sha256": "277d00ea87cf0ec0ede6736007b2fb44432fac754613df4649e61f385beb55f0",
+            "url": "https://github.com/adoptium/temurin26-binaries/releases/download/jdk-26.0.1%2B8/OpenJDK26U-jre_riscv64_linux_hotspot_26.0.1_8.tar.gz",
+            "version": "26.0.1"
+          },
+          "vmType": "hotspot",
+          "x86_64": {
+            "build": "8",
+            "sha256": "2e90cf68d31b28553fb2c8202d5a4c3a5e99a60285e125dc28c94ba5fb2ac1ef",
+            "url": "https://github.com/adoptium/temurin26-binaries/releases/download/jdk-26.0.1%2B8/OpenJDK26U-jre_x64_linux_hotspot_26.0.1_8.tar.gz",
+            "version": "26.0.1"
+          }
+        },
        "openjdk8": {
          "aarch64": {
            "build": "9",
@ -530,6 +618,22 @@
            "version": "25.0.3"
          }
        },
+        "openjdk26": {
+          "aarch64": {
+            "build": "8",
+            "sha256": "10c436258e24693ce8baf13dbffce98b77275797455e8b72510967547f13234a",
+            "url": "https://github.com/adoptium/temurin26-binaries/releases/download/jdk-26.0.1%2B8/OpenJDK26U-jdk_aarch64_mac_hotspot_26.0.1_8.tar.gz",
+            "version": "26.0.1"
+          },
+          "packageType": "jdk",
+          "vmType": "hotspot",
+          "x86_64": {
+            "build": "8",
+            "sha256": "032df492c8749864ee8b135e3d0ea5a17ef5c847309d5fdf8f1dd55e246b8319",
+            "url": "https://github.com/adoptium/temurin26-binaries/releases/download/jdk-26.0.1%2B8/OpenJDK26U-jdk_x64_mac_hotspot_26.0.1_8.tar.gz",
+            "version": "26.0.1"
+          }
+        },
        "openjdk8": {
          "packageType": "jdk",
          "vmType": "hotspot",
@ -606,6 +710,22 @@
            "version": "25.0.3"
          }
        },
+        "openjdk26": {
+          "aarch64": {
+            "build": "8",
+            "sha256": "ae27bc97ad353fe910df1b50ca989146561260c00762d65a797682068275dec9",
+            "url": "https://github.com/adoptium/temurin26-binaries/releases/download/jdk-26.0.1%2B8/OpenJDK26U-jre_aarch64_mac_hotspot_26.0.1_8.tar.gz",
+            "version": "26.0.1"
+          },
+          "packageType": "jre",
+          "vmType": "hotspot",
+          "x86_64": {
+            "build": "8",
+            "sha256": "c717204061632d41439e5197a36f26cbfe7695fe1161bcf12d613394cafdae3a",
+            "url": "https://github.com/adoptium/temurin26-binaries/releases/download/jdk-26.0.1%2B8/OpenJDK26U-jre_x64_mac_hotspot_26.0.1_8.tar.gz",
+            "version": "26.0.1"
+          }
+        },
        "openjdk8": {
          "packageType": "jre",
          "vmType": "hotspot",
--- a/pkgs/development/gnuradio-modules/fosphor/default.nix
+++ b/pkgs/development/gnuradio-modules/fosphor/default.nix
@ -37,6 +37,12 @@ mkDerivation {
  };
  disabled = gnuradioOlder "3.9" || gnuradioAtLeast "3.11";

+  # Boost 1.89 removed the boost_system stub library.
+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail 'COMPONENTS system chrono thread' 'COMPONENTS chrono thread'
+  '';
+
  nativeBuildInputs = [
    cmake
    pkg-config
--- a/pkgs/development/interpreters/python/cpython/docs/2.7-html.nix
+++ b/pkgs/development/interpreters/python/cpython/docs/2.7-html.nix
@ -1,24 +0,0 @@
-# This file was generated and will be overwritten by ./generate.sh
-
-{
-  stdenv,
-  lib,
-  fetchurl,
-}:
-
-stdenv.mkDerivation {
-  pname = "python27-docs-html";
-  version = "2.7.18";
-
-  src = fetchurl {
-    url = "https://www.python.org/ftp/python/doc/2.7.18/python-2.7.18-docs-html.tar.bz2";
-    sha256 = "03igxwpqc2lvzspnj78zz1prnmfwwj00jbvh1wsxvb0wayd5wi10";
-  };
-  installPhase = ''
-    mkdir -p $out/share/doc/python27
-    cp -R ./ $out/share/doc/python27/html
-  '';
-  meta = {
-    maintainers = [ ];
-  };
-}
--- a/pkgs/development/interpreters/python/cpython/docs/2.7-pdf-a4.nix
+++ b/pkgs/development/interpreters/python/cpython/docs/2.7-pdf-a4.nix
@ -1,24 +0,0 @@
-# This file was generated and will be overwritten by ./generate.sh
-
-{
-  stdenv,
-  lib,
-  fetchurl,
-}:
-
-stdenv.mkDerivation {
-  pname = "python27-docs-pdf-a4";
-  version = "2.7.18";
-
-  src = fetchurl {
-    url = "https://www.python.org/ftp/python/doc/2.7.18/python-2.7.18-docs-pdf-a4.tar.bz2";
-    sha256 = "0rxb2fpxwivjpk5wi2pl1fqibr4khf9s0yq6a49k9b4awi9nkb6v";
-  };
-  installPhase = ''
-    mkdir -p $out/share/doc/python27
-    cp -R ./ $out/share/doc/python27/pdf-a4
-  '';
-  meta = {
-    maintainers = [ ];
-  };
-}
--- a/pkgs/development/interpreters/python/cpython/docs/2.7-pdf-letter.nix
+++ b/pkgs/development/interpreters/python/cpython/docs/2.7-pdf-letter.nix
@ -1,24 +0,0 @@
-# This file was generated and will be overwritten by ./generate.sh
-
-{
-  stdenv,
-  lib,
-  fetchurl,
-}:
-
-stdenv.mkDerivation {
-  pname = "python27-docs-pdf-letter";
-  version = "2.7.18";
-
-  src = fetchurl {
-    url = "https://www.python.org/ftp/python/doc/2.7.18/python-2.7.18-docs-pdf-letter.tar.bz2";
-    sha256 = "07hbqvrdlq01cb95r1574bxqqhiqbkj4f92wzlq4d6dq1l272nan";
-  };
-  installPhase = ''
-    mkdir -p $out/share/doc/python27
-    cp -R ./ $out/share/doc/python27/pdf-letter
-  '';
-  meta = {
-    maintainers = [ ];
-  };
-}
--- a/pkgs/development/interpreters/python/cpython/docs/2.7-text.nix
+++ b/pkgs/development/interpreters/python/cpython/docs/2.7-text.nix
@ -1,24 +0,0 @@
-# This file was generated and will be overwritten by ./generate.sh
-
-{
-  stdenv,
-  lib,
-  fetchurl,
-}:
-
-stdenv.mkDerivation {
-  pname = "python27-docs-text";
-  version = "2.7.18";
-
-  src = fetchurl {
-    url = "https://www.python.org/ftp/python/doc/2.7.18/python-2.7.18-docs-text.tar.bz2";
-    sha256 = "1wj7mxs52kp5lmn5mvv574sygkfnk00kbz9ya9c03yfq5dd5nvy8";
-  };
-  installPhase = ''
-    mkdir -p $out/share/doc/python27
-    cp -R ./ $out/share/doc/python27/text
-  '';
-  meta = {
-    maintainers = [ ];
-  };
-}
--- a/pkgs/development/interpreters/python/cpython/docs/default.nix
+++ b/pkgs/development/interpreters/python/cpython/docs/default.nix
@ -8,36 +8,24 @@ let
  pythonDocs = {
    html = {
      recurseForDerivations = true;
-      python27 = import ./2.7-html.nix {
-        inherit stdenv fetchurl lib;
-      };
      python310 = import ./3.10-html.nix {
        inherit stdenv fetchurl lib;
      };
    };
    pdf_a4 = {
      recurseForDerivations = true;
-      python27 = import ./2.7-pdf-a4.nix {
-        inherit stdenv fetchurl lib;
-      };
      python310 = import ./3.10-pdf-a4.nix {
        inherit stdenv fetchurl lib;
      };
    };
    pdf_letter = {
      recurseForDerivations = true;
-      python27 = import ./2.7-pdf-letter.nix {
-        inherit stdenv fetchurl lib;
-      };
      python310 = import ./3.10-pdf-letter.nix {
        inherit stdenv fetchurl lib;
      };
    };
    text = {
      recurseForDerivations = true;
-      python27 = import ./2.7-text.nix {
-        inherit stdenv fetchurl lib;
-      };
      python310 = import ./3.10-text.nix {
        inherit stdenv fetchurl lib;
      };
--- a/pkgs/development/interpreters/python/default.nix
+++ b/pkgs/development/interpreters/python/default.nix
@ -30,18 +30,6 @@
  in
  {

-    python27 = callPackage ./cpython/2.7 {
-      self = __splicedPackages.python27;
-      sourceVersion = {
-        major = "2";
-        minor = "7";
-        patch = "18";
-        suffix = ".12"; # ActiveState's Python 2 extended support
-      };
-      hash = "sha256-RuEgfpags9wJm9Xe0daotqUx4knABEUc7DvtgnQXEfE=";
-      inherit passthruFun;
-    };
-
    python311 = callPackage ./cpython {
      self = __splicedPackages.python311;
      sourceVersion = {
--- a/pkgs/development/interpreters/python/passthrufun.nix
+++ b/pkgs/development/interpreters/python/passthrufun.nix
@ -79,7 +79,7 @@ let
            keep = self: hooks self { };
            optionalExtensions = cond: as: lib.optionals cond as;
            pythonExtension = import ../../../top-level/python-packages.nix;
-            python2Extension = import ../../../top-level/python2-packages.nix;
+            python2Extension = import ../../misc/resholve/python2-packages.nix;
            extensions = lib.composeManyExtensions (
              [
                hooks
@ -109,12 +109,10 @@ let
    );
 in
 rec {
-  isPy27 = pythonVersion == "2.7";
  isPy311 = pythonVersion == "3.11";
  isPy312 = pythonVersion == "3.12";
  isPy313 = pythonVersion == "3.13";
  isPy314 = pythonVersion == "3.14";
-  isPy2 = lib.strings.substring 0 1 pythonVersion == "2";
  isPy3 = lib.strings.substring 0 1 pythonVersion == "3";
  isPy3k = isPy3;
  isPyPy = lib.hasInfix "pypy" interpreter;
--- a/pkgs/development/interpreters/python/python-packages-base.nix
+++ b/pkgs/development/interpreters/python/python-packages-base.nix
@ -102,7 +102,11 @@ let
    );

  mkPythonDerivation =
-    if python.isPy3k then ./mk-python-derivation.nix else ./python2/mk-python-derivation.nix;
+    if python.isPy3k then
+      ./mk-python-derivation.nix
+    else
+      # Python 2 build infrastructure lives with its only consumers (resholve, pypy27).
+      ../../misc/resholve/python2/mk-python-derivation.nix;

  buildPythonPackage = makeOverridablePythonPackage (
    overrideStdenvCompat (
@ -186,7 +190,6 @@ in
 {
  inherit lib pkgs stdenv;
  inherit (python.passthru)
-    isPy27
    isPy311
    isPy312
    isPy313
--- a/pkgs/development/interpreters/python/cpython/2.7/2.5.2-ctypes-util-find_library.patch
+++ b/pkgs/development/interpreters/python/cpython/2.7/2.5.2-ctypes-util-find_library.patch
--- a/pkgs/development/interpreters/python/cpython/2.7/2.5.2-tkinter-x11.patch
+++ b/pkgs/development/interpreters/python/cpython/2.7/2.5.2-tkinter-x11.patch
--- a/pkgs/development/interpreters/python/cpython/2.7/2.6.2-ssl-threads.patch
+++ b/pkgs/development/interpreters/python/cpython/2.7/2.6.2-ssl-threads.patch
--- a/pkgs/development/interpreters/python/cpython/2.7/2.6.5-FD_SETSIZE.patch
+++ b/pkgs/development/interpreters/python/cpython/2.7/2.6.5-FD_SETSIZE.patch
--- a/pkgs/development/interpreters/python/cpython/2.7/2.6.5-export-PySignal_SetWakeupFd.patch
+++ b/pkgs/development/interpreters/python/cpython/2.7/2.6.5-export-PySignal_SetWakeupFd.patch
--- a/pkgs/development/interpreters/python/cpython/2.7/2.6.5-ncurses-abi6.patch
+++ b/pkgs/development/interpreters/python/cpython/2.7/2.6.5-ncurses-abi6.patch
--- a/pkgs/development/interpreters/python/cpython/2.7/2.7.3-dbm.patch
+++ b/pkgs/development/interpreters/python/cpython/2.7/2.7.3-dbm.patch
--- a/pkgs/development/interpreters/python/cpython/2.7/2.7.3-dylib.patch
+++ b/pkgs/development/interpreters/python/cpython/2.7/2.7.3-dylib.patch
--- a/pkgs/development/interpreters/python/cpython/2.7/2.7.3-getpath-exe-extension.patch
+++ b/pkgs/development/interpreters/python/cpython/2.7/2.7.3-getpath-exe-extension.patch
--- a/pkgs/development/interpreters/python/cpython/2.7/2.7.3-no-libm.patch
+++ b/pkgs/development/interpreters/python/cpython/2.7/2.7.3-no-libm.patch
--- a/pkgs/development/interpreters/python/cpython/2.7/atomic_pyc.patch
+++ b/pkgs/development/interpreters/python/cpython/2.7/atomic_pyc.patch
--- a/pkgs/development/interpreters/python/cpython/2.7/cross-compile.patch
+++ b/pkgs/development/interpreters/python/cpython/2.7/cross-compile.patch
--- a/pkgs/development/interpreters/python/cpython/2.7/default.nix
+++ b/pkgs/development/interpreters/python/cpython/2.7/default.nix
@ -146,7 +146,7 @@ let
    # It does break aarch64-darwin, which we do support. See:
    # * https://bugs.python.org/issue35523
    # * https://github.com/python/cpython/commit/e6b247c8e524
-    ../3.7/no-win64-workaround.patch
+    ./no-win64-workaround.patch

    # fix openssl detection by reverting irrelevant change for us, to enable hashlib which is required by pip
    (fetchpatch {
@ -378,7 +378,7 @@ stdenv.mkDerivation (

    postFixup = ''
      # Include a sitecustomize.py file. Note it causes an error when it's in postInstall with 2.7.
-      cp ${../../sitecustomize.py} $out/${sitePackages}/sitecustomize.py
+      cp ${../../../interpreters/python/sitecustomize.py} $out/${sitePackages}/sitecustomize.py
    ''
    + lib.optionalString strip2to3 ''
      rm -R $out/bin/2to3 $out/lib/python*/lib2to3
--- a/Show more
+++ b/Show more