Merge release-26.05 into staging-nixos-26.05

2026-07-06 17:13:24 -05:00 · 2026-07-01 00:54:50 +00:00 · 2026-07-01 00:54:50 +00:00 · 6457af6bdb
commit 6457af6bdb
parent ed176b12d5 36f2e6c0b6
44 changed files with 1520 additions and 810 deletions
--- a/nixos/modules/config/malloc.nix
+++ b/nixos/modules/config/malloc.nix
@ -142,10 +142,14 @@ in
        # so we can warn the user about the change.
        legacyOptionsUsed = lib.lists.filter (opt: lib.strings.hasInfix opt scudoOpts) legacyOptionNames;
      in
-      lib.optional (cfg.provider == "scudo" && legacyOptionsUsed != [ ]) ''
-        environment.variables.SCUDO_OPTIONS: ${lib.concatStringsSep ", " legacyOptionsUsed} is/are no longer valid Scudo options.
-        Use snake_case instead of CamelCase: https://llvm.org/docs/ScudoHardenedAllocator.html#options
-      '';
+      lib.optional
+        (
+          config.environment.variables ? SCUDO_OPTIONS && cfg.provider == "scudo" && legacyOptionsUsed != [ ]
+        )
+        ''
+          environment.variables.SCUDO_OPTIONS: ${lib.concatStringsSep ", " legacyOptionsUsed} is/are no longer valid Scudo options.
+          Use snake_case instead of CamelCase: https://llvm.org/docs/ScudoHardenedAllocator.html#options
+        '';

    environment.etc."ld-nix.so.preload".text = ''
      ${providerLibPath}
--- a/pkgs/applications/networking/browsers/firefox-bin/release_sources.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/release_sources.nix
--- a/pkgs/applications/networking/browsers/firefox/packages/firefox.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages/firefox.nix
@ -9,10 +9,10 @@

 buildMozillaMach rec {
  pname = "firefox";
-  version = "152.0.3";
+  version = "152.0.4";
  src = fetchurl {
    url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "f0b63f4a0d4bb0080761f1a7ecb949696b4f805a33fef322ceef3b59a492e1403ea4b8cfbc7f5d4b70cf5b3c5a66ddcc988654fa77fd3021b65f452ca190bf63";
+    sha512 = "0c5662aba8fb897902af95dbb2fd988b196d9cf9ae8b987ae89e0a6492ac753b8d4b8bb7b3274909c2eb200ab098df356e23cd6084556467f55e69127317f39a";
  };

  meta = {
--- a/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
+++ b/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
@ -77,8 +77,8 @@ rec {
  thunderbird = thunderbird-latest;

  thunderbird-latest = common {
-    version = "151.0.1";
-    sha512 = "a09c1e18faa8d7fdccf39e905542c21e817230e68c7cc6050beec048d0fec0f8eb92e51278d2ccd8d8cfa842762662235517e20238b555a4ad48ee5648dc3589";
+    version = "152.0";
+    sha512 = "51b950af634e7c7dfb7c043d69f925ed6d50d4c44341761e7e3ef02d5db28d2c539cd8d9286195e3facf84869f57b12a58760105b5195c449b4e1e4c9b6200d2";

    updateScript = callPackage ./update.nix {
      attrPath = "thunderbirdPackages.thunderbird-latest";
@ -91,8 +91,8 @@ rec {
  thunderbird-140 = common {
    applicationName = "Thunderbird ESR";

-    version = "140.11.1esr";
-    sha512 = "93dfdd26e6f4c7dd2f7dcc2e4994980d017868341c60c93775721467abd9192b815f2de63928e7d10c965fc045ed72ca5b49ed6502a61e50104ee5cd00941d1e";
+    version = "140.12.0esr";
+    sha512 = "ccbcc305d5cc10aa01aa5071f40a21b42de0300d9ad6763c4fc4ad71bf797566f2380c8fd84d46952e7c4eae0a35905173e6906b108192833660eae2ceea7b51";

    updateScript = callPackage ./update.nix {
      attrPath = "thunderbirdPackages.thunderbird-140";
--- a/pkgs/applications/networking/p2p/transmission/4.nix
+++ b/pkgs/applications/networking/p2p/transmission/4.nix
@ -64,13 +64,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "transmission";
-  version = "4.1.2";
+  version = "4.1.3";

  src = fetchFromGitHub {
    owner = "transmission";
    repo = "transmission";
    tag = finalAttrs.version;
-    hash = "sha256-FI/qH0VqhEjiN+31UCOiDLWkyucMKfH4i0bYW7lceQk=";
+    hash = "sha256-4349gc7+1k0y5CwHTQe8bLQsuNW5w7pckR0MCeulIEE=";
    fetchSubmodules = true;
  };

--- a/pkgs/build-support/teleport/default.nix
+++ b/pkgs/build-support/teleport/default.nix
@ -10,7 +10,7 @@
  nodejs,
  openssl,
  pkg-config,
-  pnpm_10_29_2,
+  pnpm_10,
  fetchPnpmDeps,
  pnpmConfigHook,
  rustc,
@ -81,7 +81,7 @@ let
        pname
        version
        ;
-      pnpm = pnpm_10_29_2;
+      pnpm = pnpm_10;
      fetcherVersion = 3;
      hash = pnpmHash;
    };
@ -91,7 +91,7 @@ let
      cargo
      nodejs
      pnpmConfigHook
-      pnpm_10_29_2
+      pnpm_10
      rustc
      rustc.llvmPackages.lld
      rustPlatform.cargoSetupHook
--- a/pkgs/by-name/el/element-call/package.nix
+++ b/pkgs/by-name/el/element-call/package.nix
@ -16,13 +16,13 @@ let
  # Keep this in sync with upstream locked version (likely a stable release, but not always latest)
  matrix-js-sdk = stdenv.mkDerivation (finalAttrs: {
    pname = "matrix-js-sdk";
-    version = "41.8.0-rc.0";
+    version = "41.8.0";

    src = fetchFromGitHub {
      owner = "matrix-org";
      repo = "matrix-js-sdk";
      tag = "v${finalAttrs.version}";
-      hash = "sha256-1e6nWeHNAhVynxv2R7GY5NRCBN0BriRjA3zLK0D5O9g=";
+      hash = "sha256-9OWB3Hz8EoDIu27jvA6Am4l1dH53IZGE9TStB2Viw6E=";
    };

    pnpmDeps = fetchPnpmDeps {
@ -58,13 +58,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "element-call";
-  version = "0.20.2";
+  version = "0.20.3";

  src = fetchFromGitHub {
    owner = "element-hq";
    repo = "element-call";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-paUcZhjcLbJOpQOR8gRpGe0LzSaKtWsTzE1svzQaVZY=";
+    hash = "sha256-H+In5fsX82eMDGk5kaS5ulqU1U5S67auEPc24rtCkuA=";
  };

  pnpmDeps = fetchPnpmDeps {
--- a/pkgs/by-name/fo/folo/package.nix
+++ b/pkgs/by-name/fo/folo/package.nix
@ -1,47 +1,52 @@
 {
  electron,
  fetchFromGitHub,
+  nix-update-script,
  imagemagick,
  lib,
  makeDesktopItem,
  makeWrapper,
  nodejs,
-  pnpm_10_29_2,
+  pnpm_11,
  fetchPnpmDeps,
  pnpmConfigHook,
  stdenv,
 }:
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "folo";

-  version = "0.6.3";
+  version = "1.10.0";

  src = fetchFromGitHub {
    owner = "RSSNext";
    repo = "Folo";
-    tag = "v${version}";
-    hash = "sha256-huVk5KcsepDwtdWMm9pvn31GE1felbH1pR3mGqlSWRs=";
+    tag = "desktop/v${finalAttrs.version}";
+    hash = "sha256-+k09Psuf6Bvjoc9Z1O0u2v44IIsaSQF1QbjJM6cWlUw=";
  };

  nativeBuildInputs = [
    nodejs
    pnpmConfigHook
-    pnpm_10_29_2
+    pnpm_11
    makeWrapper
    imagemagick
  ];

  pnpmDeps = fetchPnpmDeps {
-    inherit
+    inherit (finalAttrs)
      pname
      version
      src
+      pnpmInstallFlags
      ;
-    pnpm = pnpm_10_29_2;
+    pnpm = pnpm_11;
    fetcherVersion = 3;
-    hash = "sha256-EP7bpbJUcKmHm7KMlKc0Fz2u0niQ3jC7YN/9pp7vucE=";
+    hash = "sha256-dF0nnBBpJaFq6MYCZVMMt4D85EWDv8zsGEbVnyhP0kE=";
  };

+  __structuredAttrs = true;
+  strictDeps = true;
+
  env = {
    ELECTRON_SKIP_BINARY_DOWNLOAD = "1";

@ -67,6 +72,16 @@ stdenv.mkDerivation rec {

  dontCheckForBrokenSymlinks = true;

+  # Several build scripts import transitive dependencies directly (e.g.
+  # ast-kit from unplugin-ast).
+  pnpmInstallFlags = [ "--shamefully-hoist" ];
+
+  postPatch = ''
+    # pnpm 11 verifies node_modules before every `pnpm run` which conflicts
+    # with --shamefully-hoist
+    echo 'verifyDepsBeforeRun: false' >> pnpm-workspace.yaml
+  '';
+
  desktopItem = makeDesktopItem {
    name = "folo";
    desktopName = "Folo";
@ -77,7 +92,7 @@ stdenv.mkDerivation rec {
    mimeTypes = [ "x-scheme-handler/follow" ];
  };

-  icon = src + "/apps/desktop/resources/icon.png";
+  icon = finalAttrs.src + "/apps/desktop/resources/icon.png";

  buildPhase = ''
    runHook preBuild
@ -86,13 +101,13 @@ stdenv.mkDerivation rec {

    # Build desktop app.
    cd apps/desktop
-    pnpm --offline --no-inline-css build:electron-vite
+    pnpm run build:electron-vite
    cd ../..

    # Remove dev dependencies.
    CI=true pnpm --ignore-scripts prune --prod
    # Clean up broken symlinks left behind by `pnpm prune`
-    find node_modules/.bin -xtype l -delete
+    [ -d node_modules/.bin ] && find node_modules/.bin -xtype l -delete

    runHook postBuild
  '';
@ -109,24 +124,34 @@ stdenv.mkDerivation rec {
      --add-flags $out/share/follow/apps/desktop \
      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime=true}}"

-    install -m 444 -D "${desktopItem}/share/applications/"* \
+    install -m 444 -D "${finalAttrs.desktopItem}/share/applications/"* \
        -t $out/share/applications/

    for size in 16 24 32 48 64 128 256 512; do
      mkdir -p $out/share/icons/hicolor/"$size"x"$size"/apps
-      convert -background none -resize "$size"x"$size" ${icon} $out/share/icons/hicolor/"$size"x"$size"/apps/follow.png
+      convert -background none -resize "$size"x"$size" ${finalAttrs.icon} $out/share/icons/hicolor/"$size"x"$size"/apps/follow.png
    done

    runHook postInstall
  '';

+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--version-regex"
+      "^desktop/v([0-9]+\\.[0-9]+\\.[0-9]+)$"
+    ];
+  };
+
  meta = {
    description = "Next generation information browser";
    homepage = "https://github.com/RSSNext/Folo";
-    changelog = "https://github.com/RSSNext/Folo/releases/tag/${src.tag}";
+    changelog = "https://github.com/RSSNext/Folo/releases/tag/${finalAttrs.src.tag}";
    license = lib.licenses.gpl3Only;
-    maintainers = with lib.maintainers; [ iosmanthus ];
+    maintainers = with lib.maintainers; [
+      amadejkastelic
+      iosmanthus
+    ];
    platforms = [ "x86_64-linux" ];
    mainProgram = "follow";
  };
-}
+})
--- a/pkgs/by-name/js/jsonschema-cli/package.nix
+++ b/pkgs/by-name/js/jsonschema-cli/package.nix
@ -9,15 +9,15 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "jsonschema-cli";
-  version = "0.46.5";
+  version = "0.46.6";

  src = fetchCrate {
    pname = "jsonschema-cli";
    inherit (finalAttrs) version;
-    hash = "sha256-/0ADUfUoGB6i8L8FahjwafsjxXsRx0B0SnZH1FhUGxs=";
+    hash = "sha256-IMhobv10ru+7WBpdrv9Pt1s/E2oO8yxPv3oCRx3jov4=";
  };

-  cargoHash = "sha256-+V42oG6PYSmWKG6Dv2zllTxObeQqCABBcUOAvuLqAZ4=";
+  cargoHash = "sha256-MKSSvJQWwUGwJr0z6/QvWLXQDMVj/7iv+Szr/r+blkA=";

  preCheck = ''
    export SSL_CERT_FILE=${cacert}/etc/ssl/certs/ca-bundle.crt
--- a/pkgs/by-name/ke/kea/package.nix
+++ b/pkgs/by-name/ke/kea/package.nix
@ -25,6 +25,8 @@

  # tests
  nixosTests,
+  testers,
+  kea,
 }:

 stdenv.mkDerivation (finalAttrs: {
@ -63,6 +65,8 @@ stdenv.mkDerivation (finalAttrs: {
    (lib.mesonEnable "postgresql" withPostgresql)
    (lib.mesonOption "localstatedir" "/var")
    (lib.mesonOption "runstatedir" "/run")
+    (lib.mesonOption "python.platlibdir" "${placeholder "python"}/${python3.sitePackages}")
+    (lib.mesonOption "python.purelibdir" "${placeholder "python"}/${python3.sitePackages}")
  ];

  postConfigure = ''
@ -105,11 +109,6 @@ stdenv.mkDerivation (finalAttrs: {
    ninja doc
  '';

-  postFixup = ''
-    mkdir -p $python/lib
-    mv $out/lib/python* $python/lib/
-  '';
-
  passthru.tests = {
    kea = nixosTests.kea;
    prefix-delegation = nixosTests.systemd-networkd-ipv6-prefix-delegation;
@ -119,6 +118,12 @@ stdenv.mkDerivation (finalAttrs: {
    networking-networkd = lib.recurseIntoAttrs {
      inherit (nixosTests.networking.networkd) dhcpDefault dhcpSimple dhcpOneIf;
    };
+
+    version = testers.testVersion {
+      package = kea;
+      command = "kea-shell -v";
+      version = finalAttrs.version;
+    };
  };

  meta = {
--- a/pkgs/by-name/ko/komikku/package.nix
+++ b/pkgs/by-name/ko/komikku/package.nix
@ -24,14 +24,14 @@

 python3.pkgs.buildPythonApplication (finalAttrs: {
  pname = "komikku";
-  version = "50.4.0";
+  version = "50.8.0";
  pyproject = false;

  src = fetchFromCodeberg {
    owner = "valos";
    repo = "Komikku";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-u/OyWZJIntpeuVoJQmLrdsva3+xvwRX28N89aVZYc2o=";
+    hash = "sha256-u10O0+Ty73ad4vB8BgQPsV1W8NJYvzU3wyAhqHtW9v0=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/lu/lubelogger/deps.json
+++ b/pkgs/by-name/lu/lubelogger/deps.json
@ -19,25 +19,30 @@
    "version": "4.17.0",
    "hash": "sha256-LGruedMrHrI0AXHcXOFxsYP2awwPbrC9Q41AeQk4+9U="
  },
+  {
+    "pname": "Microsoft.Bcl.Cryptography",
+    "version": "10.0.2",
+    "hash": "sha256-+OYtcWsd1qZcEXadYeA4t6+pyADg1APQCxpKUtP002M="
+  },
  {
    "pname": "Microsoft.IdentityModel.Abstractions",
-    "version": "8.18.0",
-    "hash": "sha256-mkguJA4aXIVVQvSJ9Duq9mivbGXAIkLQp3a8PKy223A="
+    "version": "8.19.1",
+    "hash": "sha256-7Y4j3WTI5fIXnt5h7WNygm8jCWHTK4JbREumCc3SfnM="
  },
  {
    "pname": "Microsoft.IdentityModel.JsonWebTokens",
-    "version": "8.18.0",
-    "hash": "sha256-MdqY9CGRs+fTLb3HYYcSfuzqDFo4Dpho4McFWWferjA="
+    "version": "8.19.1",
+    "hash": "sha256-HQYkEF4YAqSxOBBXzSB++frSxvjwLUgpI4AuQsbFY4g="
  },
  {
    "pname": "Microsoft.IdentityModel.Logging",
-    "version": "8.18.0",
-    "hash": "sha256-09WyYskyL8gjjVDzoZBQAGXgsPmyagWftALSBCdt4gg="
+    "version": "8.19.1",
+    "hash": "sha256-zp+JxFS4feqSum93vDuckx/2P8ZhxWjtSryTGWudRc8="
  },
  {
    "pname": "Microsoft.IdentityModel.Tokens",
-    "version": "8.18.0",
-    "hash": "sha256-sFhonZW9G6H4ooQ6N/78fkZvADZ2Hf5WAS3FKd/ue1E="
+    "version": "8.19.1",
+    "hash": "sha256-kzZPJ0XvHCnKvxgxqhy5O4iJd2SbZPTXdA1czY/LNBc="
  },
  {
    "pname": "MimeKit",
--- a/pkgs/by-name/lu/lubelogger/package.nix
+++ b/pkgs/by-name/lu/lubelogger/package.nix
@ -8,13 +8,13 @@

 buildDotnetModule rec {
  pname = "lubelogger";
-  version = "1.6.7";
+  version = "1.6.8";

  src = fetchFromGitHub {
    owner = "hargata";
    repo = "lubelog";
    rev = "v${version}";
-    hash = "sha256-goj9xGHZaX6XMYqlvOpabTXTT3/GcuvcRjr6GwVTFA4=";
+    hash = "sha256-ePzR6TmByUBWGuOEg8WKMpvQT7qHGkZuBF8CkTwMtuY=";
  };

  projectFile = "CarCareTracker.sln";
--- a/pkgs/by-name/ma/matrix-tuwunel/package.nix
+++ b/pkgs/by-name/ma/matrix-tuwunel/package.nix
@ -150,6 +150,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
    libredirect.hook
  ];

+  # Make sure tuwunel doesn't try to write to arbitrary
+  # directories or have DNS timeouts during `cargo test`.
  preCheck =
    let
      fakeResolvConf = writeTextFile {
@ -163,8 +165,17 @@ rustPlatform.buildRustPackage (finalAttrs: {
      export NIX_REDIRECTS="/etc/resolv.conf=${fakeResolvConf}"
      export TUWUNEL_DATABASE_PATH="$(mktemp -d)/smoketest.db"
    '';
+
  doCheck = true;

+  # 2026-06-24: Tuwunel has 16 integration tests. Cargo turns each of these
+  # into a separate binary that links in all 110 MB worth of tuwunel.  Linking
+  # 16 big binaries like this takes a really long time and was causing Hydra
+  # to time out the build during `checkPhase`.  So, we run the checks in the
+  # "debug" profile.  This reduces the build+test time on my machine from
+  # 44min to 12min.
+  checkType = "debug";
+
  passthru = {
    rocksdb = rocksdb'; # make used rocksdb version available (e.g., for backup scripts)
    updateScript = nix-update-script { };
--- a/pkgs/by-name/mi/miniflux/package.nix
+++ b/pkgs/by-name/mi/miniflux/package.nix
@ -9,16 +9,16 @@

 buildGo126Module (finalAttrs: {
  pname = "miniflux";
-  version = "2.3.1";
+  version = "2.3.2";

  src = fetchFromGitHub {
    owner = "miniflux";
    repo = "v2";
    tag = finalAttrs.version;
-    hash = "sha256-cUCekYGFzvqdLql2Z0YoJ4Ug1bOYFMpvhBinD3sOaB0=";
+    hash = "sha256-gfudc11dJKzRtsT2gEazzgGFoUVaZNqgzdIATuGH29U=";
  };

-  vendorHash = "sha256-aTRc1SspNET3nki7dji0EKIBwSbplsNkKZWud8XJTNA=";
+  vendorHash = "sha256-JjZfZJyml6/ANilLNAKaounUJ35TWhj/wVWWiGEhxps=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/by-name/ne/neard/package.nix
+++ b/pkgs/by-name/ne/neard/package.nix
@ -13,9 +13,9 @@
  python3Packages,
 }:

-stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
  pname = "neard";
-  version = "0.19-unstable-2024-07-02";
+  version = "0.20";

  outputs = [
    "out"
@ -25,8 +25,8 @@ stdenv.mkDerivation {
  src = fetchFromGitHub {
    owner = "linux-nfc";
    repo = "neard";
-    rev = "a0a7d4d677800a39346f0c89d93d0fe43a95efad";
-    hash = "sha256-6BgX7cJwxX+1RX3wU+HY/PIBgzomzOKemnl0SDLJNro=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Ty2jXaSuaI+ZuRBSpdh36Yi3V5nd8jGI43Jc9cLkMW4=";
  };

  postPatch = ''
@ -50,7 +50,6 @@ stdenv.mkDerivation {
    "--enable-tools"
    "--with-sysconfdir=/etc"
    "--with-systemdsystemunitdir=${placeholder "out"}/lib/systemd/system"
-    "--with-systemduserunitdir=${placeholder "out"}/lib/systemd/user"
  ];

  buildInputs = [
@ -76,10 +75,11 @@ stdenv.mkDerivation {
  '';

  meta = {
+    changelog = "https://github.com/linux-nfc/neard/blob/${finalAttrs.src.tag}/ChangeLog";
    description = "Near Field Communication manager";
    homepage = "https://01.org/linux-nfc";
    license = lib.licenses.gpl2Only;
    maintainers = [ ];
    platforms = lib.platforms.unix;
  };
-}
+})
--- a/pkgs/by-name/op/open62541/package.nix
+++ b/pkgs/by-name/op/open62541/package.nix
@ -33,13 +33,13 @@ in

 stdenv.mkDerivation (finalAttrs: {
  pname = "open62541";
-  version = "1.4.16";
+  version = "1.4.17";

  src = fetchFromGitHub {
    owner = "open62541";
    repo = "open62541";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-PSY1GhaCaBkp1msjynOwHz0SzzoHliM5z5AWghG2ZU4=";
+    hash = "sha256-EUQ/wXv1dON7MzOKmnyNUY0mTC64qUEF1++YzPC2xIo=";
    fetchSubmodules = true;
  };

--- a/pkgs/by-name/or/organicmaps/force-vendored-protobuf.patch
+++ b/pkgs/by-name/or/organicmaps/force-vendored-protobuf.patch
@ -0,0 +1,24 @@
+diff --git a/3party/CMakeLists.txt b/3party/CMakeLists.txt
+index c802251db8..314f4d4543 100644
+--- a/3party/CMakeLists.txt
+++ b/3party/CMakeLists.txt
+@@ -33,9 +33,6 @@ if (NOT WITH_SYSTEM_PROVIDED_3PARTY)
+   # Add pugixml library.
+   add_subdirectory(pugixml)
+ 
+-  # Add protobuf library.
+-  add_subdirectory(protobuf)
+-
+   add_subdirectory(freetype)
+   add_subdirectory(icu)
+   add_subdirectory(harfbuzz)
+@@ -45,6 +42,9 @@ if (NOT WITH_SYSTEM_PROVIDED_3PARTY)
+   target_include_directories(utf8cpp SYSTEM INTERFACE "${OMIM_ROOT}/3party/utfcpp/source")
+ endif()
+ 
+# Add protobuf library.
+add_subdirectory(protobuf)
+
+ add_subdirectory(agg)
+ add_subdirectory(bsdiff-courgette)
+ add_subdirectory(glaze)
--- a/pkgs/by-name/or/organicmaps/package.nix
+++ b/pkgs/by-name/or/organicmaps/package.nix
@ -18,42 +18,32 @@
  libxrandr,
  libxinerama,
  libxcursor,
+  gflags,
+  expat,
+  jansson,
+  boost,
+  fast-float,
+  utf8cpp,
  nix-update-script,
 }:

-let
-  world_feed_integration_tests_data = fetchFromGitHub {
-    owner = "organicmaps";
-    repo = "world_feed_integration_tests_data";
-    rev = "30ecb0b3fe694a582edfacc2a7425b6f01f9fec6";
-    hash = "sha256-1FF658OhKg8a5kKX/7TVmsxZ9amimn4lB6bX9i7pnI4=";
-  };
-in
 stdenv.mkDerivation (finalAttrs: {
  pname = "organicmaps";
-  version = "2026.01.26-11";
+  version = "2026.05.27-11";

  src = fetchFromGitHub {
    owner = "organicmaps";
    repo = "organicmaps";
    tag = "${finalAttrs.version}-android";
-    hash = "sha256-EsVPzibUta0cmKA6bYLqCKKij5FWbwPHgMmIs2THpL0=";
+    hash = "sha256-zLNQk9CCCk3linmAyAT5qsS5GhrOrlSVOdDf5koBwrc=";
    fetchSubmodules = true;
  };

-  postPatch = ''
-    # Disable certificate check. It's dependent on time
-    echo "exit 0" > tools/unix/check_cert.sh
-
-    # crude fix for https://github.com/organicmaps/organicmaps/issues/1862
-    echo "echo ${lib.replaceStrings [ "." "-" ] [ "" "" ] finalAttrs.version}" > tools/unix/version.sh
-
-    # TODO use system boost instead, see https://github.com/organicmaps/organicmaps/issues/5345
-    patchShebangs 3party/boost/tools/build/src/engine/build.sh
-
-    # Prefetch test data, or the build system will try to fetch it with git.
-    ln -s ${world_feed_integration_tests_data} data/test_data/world_feed_integration_tests_data
-  '';
+  patches = [
+    # Needs the very old protobuf 3.3, so we use the vendored one
+    # https://github.com/organicmaps/organicmaps/pull/6310
+    ./force-vendored-protobuf.patch
+  ];

  nativeBuildInputs = [
    cmake
@ -65,7 +55,6 @@ stdenv.mkDerivation (finalAttrs: {
    qt6.wrapQtAppsHook
  ];

-  # Most dependencies are vendored
  buildInputs = [
    qt6.qtbase
    qt6.qtpositioning
@ -80,12 +69,21 @@ stdenv.mkDerivation (finalAttrs: {
    libxrandr
    libxinerama
    libxcursor
+    gflags
+    expat
+    jansson
+    boost
+    fast-float
+    utf8cpp
  ];

-  # Yes, this is PRE configure. The configure phase uses cmake
-  preConfigure = ''
-    bash ./configure.sh
-  '';
+  cmakeFlags = [
+    (lib.cmakeBool "WITH_SYSTEM_PROVIDED_3PARTY" true)
+    (lib.cmakeBool "SKIP_TESTS" true)
+    (lib.cmakeBool "SKIP_TOOLS" true)
+  ];
+
+  env.NIX_CFLAGS_COMPILE = "-I${lib.getDev utf8cpp}/include/utf8cpp";

  passthru = {
    updateScript = nix-update-script {
--- a/pkgs/by-name/pg/pgrok/package.nix
+++ b/pkgs/by-name/pg/pgrok/package.nix
@ -4,24 +4,21 @@
  fetchFromGitHub,
  nix-update-script,
  nodejs,
-  pnpm_9,
+  pnpm_11,
  fetchPnpmDeps,
  pnpmConfigHook,
 }:

-let
+buildGoModule (finalAttrs: {
  pname = "pgrok";
-  version = "1.5.0";
+  version = "1.7.0";
+
  src = fetchFromGitHub {
    owner = "pgrok";
    repo = "pgrok";
-    tag = "v${version}";
-    hash = "sha256-arPFccclBie3XOBt0q6UC96fPaPc7NmgQDMsd2H2bhI=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-uMHeVxAGmAEIOfCK9SEFsL7GZZIUNMYdoV8XeHjXmWc=";
  };
-in
-
-buildGoModule {
-  inherit pname version src;

  outputs = [
    "out"
@ -31,26 +28,38 @@ buildGoModule {
  nativeBuildInputs = [
    nodejs
    pnpmConfigHook
-    pnpm_9
+    pnpm_11
  ];

+  postPatch = ''
+    # Rename directories to avoid binary naming conflicts (both would be named "cli")
+    mv pgrok/cli pgrok/pgrok
+    mv pgrokd/cli pgrokd/pgrokd
+
+    # Update references in Go code and web app package.json to match renamed directory
+    substituteInPlace pgrokd/pgrokd/main.go \
+      --replace-fail "github.com/pgrok/pgrok/pgrokd/cli/internal/web" "github.com/pgrok/pgrok/pgrokd/pgrokd/internal/web"
+    substituteInPlace pgrokd/web/package.json \
+      --replace-fail "../cli/internal/web/dist" "../pgrokd/internal/web/dist"
+  '';
+
  env.pnpmDeps = fetchPnpmDeps {
-    inherit
+    inherit (finalAttrs)
      pname
      version
      src
      ;
-    pnpm = pnpm_9;
-    fetcherVersion = 3;
-    hash = "sha256-D8UZoN0ZnjB8CXQiHmBZwBEt57XGb5SDLg61xxSqNus=";
+    pnpm = pnpm_11;
+    fetcherVersion = 4;
+    hash = "sha256-8CLAtxqNgcVIUw4RKAy6jKlErmkgZYyVYFdrD+jyfAA=";
  };

-  vendorHash = "sha256-ob8s1jYL2+JGaqjCsM10jgirPiEyTY4U3IVVlHVdoGQ=";
+  vendorHash = "sha256-fhyyyXHUJsIWiCZbqtLZZRuIG9hb0LAkSo7lKW0i8Sk";

  ldflags = [
    "-s"
    "-w"
-    "-X main.version=${version}"
+    "-X main.version=${finalAttrs.version}"
    "-X main.commit=unknown"
    "-X main.date=unknown"
  ];
@ -66,10 +75,6 @@ buildGoModule {
    pnpm run build

    popd
-
-    # rename packages due to naming conflict
-    mv pgrok/cli/ pgrok/pgrok/
-    mv pgrokd/cli/ pgrokd/pgrokd/
  '';

  postInstall = ''
@ -85,4 +90,4 @@ buildGoModule {
    maintainers = with lib.maintainers; [ marie ];
    mainProgram = "pgrok";
  };
-}
+})
--- a/pkgs/by-name/py/pyright/package-lock.json
+++ b/pkgs/by-name/py/pyright/package-lock.json
@ -31,9 +31,9 @@
      }
    },
    "node_modules/brace-expansion": {
-      "version": "5.0.6",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz",
-      "integrity": "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==",
+      "version": "5.0.7",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.7.tgz",
+      "integrity": "sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
@ -131,9 +131,9 @@
      "license": "MIT"
    },
    "node_modules/lru-cache": {
-      "version": "11.5.0",
-      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-11.5.0.tgz",
-      "integrity": "sha512-5YgH9UJd7wVb9hIouI2adWpgqrrICkt070Dnj8EUY1+B4B2P9eRLPAkAAo6NICA7CEhOIeBHl46u9zSNpNu7zA==",
+      "version": "11.5.1",
+      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-11.5.1.tgz",
+      "integrity": "sha512-RPimw/7aMdv2oqRrxKwvZXcPfwBrn/JZ2xYcY9Hus/6LaS3VOAKVWKWgNLCFSiOm1ESXinjsDlidVU7JlnCN2A==",
      "dev": true,
      "license": "BlueOak-1.0.0",
      "engines": {
--- a/pkgs/by-name/py/pyright/package.nix
+++ b/pkgs/by-name/py/pyright/package.nix
@ -7,13 +7,13 @@
 }:

 let
-  version = "1.1.410";
+  version = "1.1.411";

  src = fetchFromGitHub {
    owner = "Microsoft";
    repo = "pyright";
    tag = version;
-    hash = "sha256-ouG+Lz08eljOU6ved1IoeeW/3GJWbFT7WzdhTilWqBs=";
+    hash = "sha256-MamU2Mx7BSH+NVXHnKEzCbXHmWmo7V8c7BPjz6+0pAY=";
  };

  patchedPackageJSON =
@ -32,7 +32,7 @@ let
    pname = "pyright-root";
    inherit version src;
    sourceRoot = "${src.name}"; # required for update.sh script
-    npmDepsHash = "sha256-Q7niMODoPmtn4zbou3OeJFAGEjRtt8j40qiw2NJvo8k=";
+    npmDepsHash = "sha256-EQlF3zBNnEvVGLC6btSkXGRPJHoR+Jz23ay2X9nYZSg=";
    dontNpmBuild = true;
    postPatch = ''
      cp ${patchedPackageJSON} ./package.json
@ -49,7 +49,7 @@ let
    pname = "pyright-internal";
    inherit version src;
    sourceRoot = "${src.name}/packages/pyright-internal";
-    npmDepsHash = "sha256-lzwDayoN2qmF33Slv7r+rv1bl81utjRGGeeXI6jCd0U=";
+    npmDepsHash = "sha256-h0ZPqVpMMnhfqP+471xzKVhWTgyuyMcfIAcrnBJZsr4=";
    dontNpmBuild = true;
    installPhase = ''
      runHook preInstall
@ -63,7 +63,7 @@ buildNpmPackage rec {
  inherit version src;

  sourceRoot = "${src.name}/packages/pyright";
-  npmDepsHash = "sha256-nCfoa+c6I8khFqXBRI5AAdFzn1tO3G03KT+LPqHY82U=";
+  npmDepsHash = "sha256-mVcK3FzHccBnWzUgrczhwTPhVxyR56E5i8l2GJGYlLo=";

  postPatch = ''
    chmod +w ../../
--- a/pkgs/by-name/ra/radicle-ci-broker/package.nix
+++ b/pkgs/by-name/ra/radicle-ci-broker/package.nix
@ -14,14 +14,14 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "radicle-ci-broker";
-  version = "0.28.1";
+  version = "0.29.0";

  src = fetchFromRadicle {
    seed = "seed.radicle.dev";
    repo = "zwTxygwuz5LDGBq255RA2CbNGrz8";
    node = "z6MkgEMYod7Hxfy9qCvDv5hYHkZ4ciWmLFgfvm3Wn1b2w2FV";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-6jCMphwVhRgtLpUWBLwsODgR41wl27hyzbMdDjMISfM=";
+    hash = "sha256-QivsYWg88dyS3dxeMvXojRbxFyDAEpKkHZzcY85Lwjo=";
    leaveDotGit = true;
    postFetch = ''
      git -C $out rev-parse --short HEAD > $out/.git_head
@ -29,7 +29,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    '';
  };

-  cargoHash = "sha256-fZwvjpTWWbHDSSI1tXF1JhyvZnIfP4p601GoVBJwR8k=";
+  cargoHash = "sha256-o2h+XDKt7611j8PtTIyio7lJyc2VioFINb69mW/sxEk=";

  postPatch = ''
    substituteInPlace build.rs \
--- a/pkgs/by-name/ru/rundeck/package.nix
+++ b/pkgs/by-name/ru/rundeck/package.nix
@ -12,11 +12,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "rundeck";
-  version = "5.20.1-20260518";
+  version = "6.0.0-20260629";

  src = fetchurl {
    url = "https://packagecloud.io/pagerduty/rundeck/packages/java/org.rundeck/rundeck-${finalAttrs.version}.war/artifacts/rundeck-${finalAttrs.version}.war/download?distro_version_id=167";
-    hash = "sha256-aicAKbJ5d729Mu1XMBsNK+M2h1o/V/a36aj1XdLOQXM=";
+    hash = "sha256-3pB2mLme62jzJy5CxMhp77CqqEQ8FM6BpxHcX2q6Y1w=";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/by-name/se/seaweedfs/package.nix
+++ b/pkgs/by-name/se/seaweedfs/package.nix
@ -1,17 +1,15 @@
 {
  buildGoModule,
  fetchFromGitHub,
-  iana-etc,
  installShellFiles,
  lib,
-  libredirect,
  nix-update-script,
  stdenv,
  versionCheckHook,
 }:
 buildGoModule (finalAttrs: {
  pname = "seaweedfs";
-  version = "4.19";
+  version = "4.36";

  src = fetchFromGitHub {
    owner = "seaweedfs";
@ -24,22 +22,12 @@ buildGoModule (finalAttrs: {
      find "$out" -name .git -print0 | xargs -0 rm -rf
      popd
    '';
-    hash = "sha256-xMfV3WE10iP8MqxYd5w8JRUL5O7vO6ATN1ZEHB8MRxg=";
+    hash = "sha256-y42opbGNVMxWU/k0j5g27RWLBF0PLcOPlXU9eVg0jwY=";
  };

-  postPatch = ''
-    # Remove unmaintained code that's not used and generates various issues.
-    rm -rf unmaintained
-  '';
+  vendorHash = "sha256-peRhKuZ1D+y8Uhw1+P8Ogc1HrOh1/kYVd29lR89+rIo=";

-  vendorHash = "sha256-mGiA91y6ebbbdAu0+ZDylUDuZb8vcNaqeGv70/IFx9k=";
-
-  nativeBuildInputs = [
-    installShellFiles
-  ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    libredirect.hook
-  ];
+  nativeBuildInputs = [ installShellFiles ];

  subPackages = [ "weed" ];

@ -55,11 +43,13 @@ buildGoModule (finalAttrs: {

  ldflags = [
    "-s"
+  ]
+  ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [
    "-extldflags=-static"
  ];

  env = {
-    CGO_ENABLED = 0;
+    CGO_ENABLED = if stdenv.hostPlatform.isDarwin then 1 else 0;
    GODEBUG = "http2client=0";
  };

@ -67,26 +57,11 @@ buildGoModule (finalAttrs: {
    ldflags+=" -X \"github.com/seaweedfs/seaweedfs/weed/util/version.COMMIT=$(<COMMIT)\""
  '';

-  preCheck = ''
-    # Test all targets.
-    unset subPackages
-
-    # Remove tests that require specialized environment or additional setup
-    # that's not possible to achieve inside a sandbox.
-    for i in test/{fuse_integration,kafka,s3,sftp,volume_server}; do
-      find "$i" -name '*_test.go' -delete
-    done
-
-    # Required for reusing build artifacts in tests.
-    export PATH="$PATH:$NIX_BUILD_TOP/go/bin"
-  ''
-  + lib.optionalString (finalAttrs.env.CGO_ENABLED == 0) ''
-    # Depends on CGO.
-    rm -rf weed/mq/offset/{benchmark,end_to_end,sql_storage}_test.go
-  ''
-  + lib.optionalString stdenv.hostPlatform.isDarwin ''
-    export NIX_REDIRECTS=/etc/protocols=${iana-etc}/etc/protocols:/etc/services=${iana-etc}/etc/services
-  '';
+  # Tests frequently break (mostly because of sandboxing) and keeping track of
+  # changes every release is becoming too much of a hassle resulting in Nixpkgs
+  # versions lagging behind which is not ideal for a package with a rapid
+  # release cycle.
+  doCheck = false;

  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
    for shell in bash fish zsh; do
@ -102,8 +77,6 @@ buildGoModule (finalAttrs: {

  passthru.updateScript = nix-update-script { };

-  __darwinAllowLocalNetworking = true;
-
  meta = {
    description = "Simple and highly scalable distributed file system";
    longDescription = ''
--- a/pkgs/by-name/se/servarr-ffmpeg/package.nix
+++ b/pkgs/by-name/se/servarr-ffmpeg/package.nix
@ -38,6 +38,8 @@ in
  withCudaLLVM = false;
  withCuvid = false;
  withDrm = false;
+  withGmp = false;
+  withNetwork = false;
  withNvcodec = false;
  withFontconfig = false;
  withFreetype = false;
--- a/pkgs/by-name/sp/splayer/electron-builder-26.8.2.patch
+++ b/pkgs/by-name/sp/splayer/electron-builder-26.8.2.patch
@ -0,0 +1,433 @@
+--- a/package.json	2026-06-29 23:54:36.363539465 +0800
+++ b/package.json	2026-06-29 23:51:54.726132777 +0800
+@@ -104,7 +104,7 @@
+     "ajv": "^8.20.0",
+     "crypto-js": "^4.2.0",
+     "electron": "^41.7.1",
+-    "electron-builder": "^26.8.1",
+    "electron-builder": "^26.8.2",
+     "electron-log": "^5.4.4",
+     "electron-vite": "^5.0.0",
+     "eslint": "^9.39.4",
+--- a/pnpm-lock.yaml	2026-06-29 23:54:36.384329555 +0800
+++ b/pnpm-lock.yaml	2026-06-29 23:51:45.849109557 +0800
+@@ -197,8 +197,8 @@
+         specifier: ^41.7.1
+         version: 41.7.1
+       electron-builder:
+-        specifier: ^26.8.1
+-        version: 26.8.1(electron-builder-squirrel-windows@26.0.12)
+        specifier: ^26.8.2
+        version: 26.8.2(electron-builder-squirrel-windows@26.0.12)
+       electron-log:
+         specifier: ^5.4.4
+         version: 5.4.4
+@@ -567,8 +567,8 @@
+     engines: {node: '>=12.13.0'}
+     hasBin: true
+ 
+-  '@electron/rebuild@4.0.4':
+-    resolution: {integrity: sha512-Rzc39XPdk/+/wBG8MfwAHohXflep0ITUfulb6Rgz3R0NeSB1noE+E9/M/cb8ftCAiyDD9PPhLuuWgE1GaInbKg==}
+  '@electron/rebuild@4.0.6':
+    resolution: {integrity: sha512-323ygp5Lz4DP2nVu54NLCx4n0TKsQ3OMDG3PPeOFjOTMDtSxGbCi7mQfWBc5C80pp+9awEsiHx9HR9DfAM/IEQ==}
+     engines: {node: '>=22.12.0'}
+     hasBin: true
+ 
+@@ -2700,8 +2700,8 @@
+       dmg-builder: 26.0.12
+       electron-builder-squirrel-windows: 26.0.12
+ 
+-  app-builder-lib@26.8.1:
+-    resolution: {integrity: sha512-p0Im/Dx5C4tmz8QEE1Yn4MkuPC8PrnlRneMhWJj7BBXQfNTJUshM/bp3lusdEsDbvvfJZpXWnYesgSLvwtM2Zw==}
+  app-builder-lib@26.8.2:
+    resolution: {integrity: sha512-z3ptLzJwNl35fyR0wxv4qWOfZuU36VysYHnbs8PDtf8S0QzIl2OWimdDFVmCxYMkIV1k/RT9CeTgcP7oUznFOw==}
+     engines: {node: '>=14.0.0'}
+     peerDependencies:
+       dmg-builder: 26.0.12
+@@ -3346,8 +3347,8 @@
+   electron-builder-squirrel-windows@26.0.12:
+     resolution: {integrity: sha512-kpwXM7c/ayRUbYVErQbsZ0nQZX4aLHQrPEG9C4h9vuJCXylwFH8a7Jgi2VpKIObzCXO7LKHiCw4KdioFLFOgqA==}
+ 
+-  electron-builder@26.8.1:
+-    resolution: {integrity: sha512-uWhx1r74NGpCagG0ULs/P9Nqv2nsoo+7eo4fLUOB8L8MdWltq9odW/uuLXMFCDGnPafknYLZgjNX0ZIFRzOQAw==}
+  electron-builder@26.8.2:
+    resolution: {integrity: sha512-ieiiXPdgH3qrG6lcvy2mtnI5iEmAopmLuVRMSJ5j40weU0tgpNx0OAk9J5X5nnO0j9+KIkxHzwFZVUDk1U3aGw==}
+     engines: {node: '>=14.0.0'}
+     hasBin: true
+ 
+@@ -3748,6 +3749,10 @@
+     resolution: {integrity: sha512-8RipRLol37bNs2bhoV67fiTEvdTrbMUYcFTiy3+wuuOnUog2QBHCZWXDRijWQfAkhBj2Uf5UnVaiWwA5vdd82w==}
+     engines: {node: '>= 6'}
+ 
+  form-data@4.0.6:
+    resolution: {integrity: sha512-vKatAh4SlVfgbv+YtmhiRjhEMJsYpsG1Y2rMQtR+SVSbytsSD1YGzDIcrAJmdFec88u/+VoGmxnl+80gL1tRCQ==}
+    engines: {node: '>= 6'}
+
+   forwarded@0.2.0:
+     resolution: {integrity: sha512-buRG0fpBtRHSTCOASe6hD258tEubFoRLb4ZNA6NxMVHNw2gOcwHo9wyablzMzOA5z9xA9L1KNjk/Nt6MT9aYow==}
+     engines: {node: '>= 0.6'}
+@@ -4185,6 +4190,10 @@
+     resolution: {integrity: sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==}
+     hasBin: true
+ 
+  js-yaml@4.3.0:
+    resolution: {integrity: sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==}
+    hasBin: true
+
+   jsesc@3.1.0:
+     resolution: {integrity: sha512-/sM3dO2FOzXjKQhJuo0Q173wf2KOo8t4I8vHy6lF9poUp7bKT0/NHE8fPX23PwfhnykfqnC2xRxOnVw5XuGIaA==}
+     engines: {node: '>=6'}
+@@ -4635,8 +4644,8 @@
+     resolution: {integrity: sha512-LarFH0+6VfriEhqMMcLX2F7SwSXeWwnEAJEsYm5QKWchiVYVvJyV9v7UDvUv+w5HO23ZpQTXDv/GxdDdMyOuoQ==}
+     engines: {node: '>= 6.13.0'}
+ 
+-  node-gyp@12.3.0:
+-    resolution: {integrity: sha512-QNcUWM+HgJplcPzBvFBZ9VXacyGZ4+VTOb80PwWR+TlVzoHbRKULNEzpRsnaoxG3Wzr7Qh7BYxGDU3CbKib2Yg==}
+  node-gyp@12.4.0:
+    resolution: {integrity: sha512-OMcPNvqTCFUnNaBlmdgq+lfNqY7gTiSmNRDjY3uAXRyudeKZEZxu3CLtjMQrx4zZxCX2b/mpNqTtwuCJgXhHkw==}
+     engines: {node: ^20.17.0 || >=22.9.0}
+     hasBin: true
+ 
+@@ -5200,6 +5209,11 @@
+     engines: {node: '>=10'}
+     hasBin: true
+ 
+  semver@7.8.5:
+    resolution: {integrity: sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA==}
+    engines: {node: '>=10'}
+    hasBin: true
+
+   send@0.19.2:
+     resolution: {integrity: sha512-VMbMxbDeehAxpOtWJXlcUS5E8iXh6QmN+BkRX1GARS3wRaXEEgzCcB10gTQazO42tpNIya8xIyNx8fll1OFPrg==}
+     engines: {node: '>= 0.8.0'}
+@@ -5449,8 +5463,8 @@
+     resolution: {integrity: sha512-DZ4yORTwrbTj/7MZYq2w+/ZFdI6OZ/f9SFHR+71gIVUZhOQPHzVCLpvRnPgyaMpfWxxk/4ONva3GQSyNIKRv6A==}
+     engines: {node: '>=10'}
+ 
+-  tar@7.5.16:
+-    resolution: {integrity: sha512-56adEpPMouktRlBLXiaYFFzZ/3+JXa8P9n7WbR+ibIjtviN55mEaOkiysCnPnWm+7kkui1Dn8J9l+g6zV8731w==}
+  tar@7.5.19:
+    resolution: {integrity: sha512-4LeEWl96twnS2Q7Bz4MGqgazLqO+hJN63GZxXoIqh1T3VweYD997gbU1ItNsQafqqXTXd5WFyFdReLtwvRBNiw==}
+     engines: {node: '>=18'}
+ 
+   temp-file@3.4.0:
+@@ -5586,8 +5600,8 @@
+   undici-types@7.18.2:
+     resolution: {integrity: sha512-AsuCzffGHJybSaRrmr5eHr81mwJU3kjw6M+uprWvCXiNeN9SOGwQ3Jn8jb8m3Z6izVgknn1R0FTCEAP2QrLY/w==}
+ 
+-  undici@6.26.0:
+-    resolution: {integrity: sha512-4yqz8a3n5HmGTlsbADNtr/dJlhkh/55Rq798G6ibiULcXbDtaLpTl1pvdqcbFfeoj3iSi52lePFM7h9H21cw/A==}
+  undici@6.27.0:
+    resolution: {integrity: sha512-YmfV3YnEDzXRC5lZ2jWtWWHKGUm1zIt8AhesR1tens+HTNv+YZlN/dp6G727LOvMJ8xjP9Be7Y2Sdr96LDm+pg==}
+     engines: {node: '>=18.17'}
+ 
+   undici@7.27.1:
+@@ -5995,8 +6009,8 @@
+     resolution: {integrity: sha512-aePbxDmcYW++PaqBsJ+HYUFwCdv4LVvdnhBy78E57PIor8/OVvhMrADFFEDh8DHDFRv/O9i3lPhsENjO7QX0+A==}
+     engines: {node: '>=8'}
+ 
+-  yargs@17.7.2:
+-    resolution: {integrity: sha512-7dSzzRQ++CKnNI/krKnYRV7JKKPUXMEh61soaHKg9mrWEhzFWhFnxPxGl+69cD1Ou63C13NUPCnmIcrvqCuM6w==}
+  yargs@17.7.3:
+    resolution: {integrity: sha512-GZtjxm/J/4TSxuL3FNYjCmLktBTnIw/rVmKSIyKeYAZpmJB2ig9VauCC5xsa82GNKVKDAqpOn3KVzNt0zmrU0g==}
+     engines: {node: '>=12'}
+ 
+   yargs@18.0.0:
+@@ -6348,7 +6362,7 @@
+       make-fetch-happen: 10.2.1
+       nopt: 6.0.0
+       proc-log: 2.0.1
+-      semver: 7.8.2
+      semver: 7.8.5
+       tar: 6.2.1
+       which: 2.0.2
+     transitivePeerDependencies:
+@@ -6398,20 +6412,20 @@
+       node-api-version: 0.2.1
+       ora: 5.4.1
+       read-binary-file-arch: 1.0.6
+-      semver: 7.8.2
+      semver: 7.8.5
+       tar: 6.2.1
+-      yargs: 17.7.2
+      yargs: 17.7.3
+     transitivePeerDependencies:
+       - bluebird
+       - supports-color
+ 
+-  '@electron/rebuild@4.0.4':
+  '@electron/rebuild@4.0.6':
+     dependencies:
+       '@malept/cross-spawn-promise': 2.0.0
+       debug: 4.4.3
+       node-abi: 4.31.0
+       node-api-version: 0.2.1
+-      node-gyp: 12.3.0
+      node-gyp: 12.4.0
+       read-binary-file-arch: 1.0.6
+     transitivePeerDependencies:
+       - supports-color
+@@ -7410,7 +7424,7 @@
+   '@npmcli/fs@2.1.2':
+     dependencies:
+       '@gar/promisify': 1.1.3
+-      semver: 7.8.2
+      semver: 7.8.5
+ 
+   '@npmcli/move-file@2.0.1':
+     dependencies:
+@@ -7931,7 +7945,7 @@
+       '@typescript-eslint/visitor-keys': 8.60.1
+       debug: 4.4.3
+       minimatch: 10.2.5
+-      semver: 7.8.2
+      semver: 7.8.5
+       tinyglobby: 0.2.17
+       ts-api-utils: 2.5.0(typescript@6.0.3)
+       typescript: 6.0.3
+@@ -8260,13 +8274,13 @@
+       hosted-git-info: 4.1.0
+       is-ci: 3.0.1
+       isbinaryfile: 5.0.7
+-      js-yaml: 4.2.0
+      js-yaml: 4.3.0
+       json5: 2.2.3
+       lazy-val: 1.0.5
+       minimatch: 10.2.5
+       plist: 3.1.0
+       resedit: 1.7.2
+-      semver: 7.8.2
+      semver: 7.8.5
+       tar: 6.2.1
+       temp-file: 3.4.0
+       tiny-async-pool: 1.3.0
+@@ -8274,7 +8288,7 @@
+       - bluebird
+       - supports-color
+ 
+-  app-builder-lib@26.8.1(dmg-builder@26.0.12)(electron-builder-squirrel-windows@26.0.12):
+  app-builder-lib@26.8.2(dmg-builder@26.0.12)(electron-builder-squirrel-windows@26.0.12):
+     dependencies:
+       '@develar/schema-utils': 2.6.5
+       '@electron/asar': 3.4.1
+@@ -8282,7 +8296,7 @@
+       '@electron/get': 3.1.0
+       '@electron/notarize': 2.5.0
+       '@electron/osx-sign': 1.3.3
+-      '@electron/rebuild': 4.0.4
+      '@electron/rebuild': 4.0.6
+       '@electron/universal': 2.0.3
+       '@malept/flatpak-bundler': 0.4.0
+       '@types/fs-extra': 9.0.13
+@@ -8302,7 +8316,7 @@
+       hosted-git-info: 4.1.0
+       isbinaryfile: 5.0.7
+       jiti: 2.7.0
+-      js-yaml: 4.2.0
+      js-yaml: 4.3.0
+       json5: 2.2.3
+       lazy-val: 1.0.5
+       minimatch: 10.2.5
+@@ -8310,7 +8324,7 @@
+       proper-lockfile: 4.1.2
+       resedit: 1.7.2
+       semver: 7.7.4
+-      tar: 7.5.16
+      tar: 7.5.19
+       temp-file: 3.4.0
+       tiny-async-pool: 1.3.0
+       which: 5.0.0
+@@ -8530,7 +8544,7 @@
+       http-proxy-agent: 7.0.2
+       https-proxy-agent: 7.0.6
+       is-ci: 3.0.1
+-      js-yaml: 4.2.0
+      js-yaml: 4.3.0
+       sanitize-filename: 1.6.4
+       source-map-support: 0.5.21
+       stat-mode: 1.0.0
+@@ -8551,7 +8565,7 @@
+       fs-extra: 10.1.0
+       http-proxy-agent: 7.0.2
+       https-proxy-agent: 7.0.6
+-      js-yaml: 4.2.0
+      js-yaml: 4.3.0
+       sanitize-filename: 1.6.4
+       source-map-support: 0.5.21
+       stat-mode: 1.0.0
+@@ -8951,7 +8965,7 @@
+       builder-util-runtime: 9.3.1
+       fs-extra: 10.1.0
+       iconv-lite: 0.6.3
+-      js-yaml: 4.2.0
+      js-yaml: 4.3.0
+     optionalDependencies:
+       dmg-license: 1.0.11
+     transitivePeerDependencies:
+@@ -9016,9 +9030,9 @@
+       - dmg-builder
+       - supports-color
+ 
+-  electron-builder@26.8.1(electron-builder-squirrel-windows@26.0.12):
+  electron-builder@26.8.2(electron-builder-squirrel-windows@26.0.12):
+     dependencies:
+-      app-builder-lib: 26.8.1(dmg-builder@26.0.12)(electron-builder-squirrel-windows@26.0.12)
+      app-builder-lib: 26.8.2(dmg-builder@26.0.12)(electron-builder-squirrel-windows@26.0.12)
+       builder-util: 26.8.1
+       builder-util-runtime: 9.5.1
+       chalk: 4.1.2
+@@ -9027,7 +9041,7 @@
+       fs-extra: 10.1.0
+       lazy-val: 1.0.5
+       simple-update-notifier: 2.0.0
+-      yargs: 17.7.2
+      yargs: 17.7.3
+     transitivePeerDependencies:
+       - bluebird
+       - electron-builder-squirrel-windows
+@@ -9041,7 +9055,7 @@
+       builder-util: 26.0.11
+       builder-util-runtime: 9.3.1
+       chalk: 4.1.2
+-      form-data: 4.0.5
+      form-data: 4.0.6
+       fs-extra: 10.1.0
+       lazy-val: 1.0.5
+       mime: 2.6.0
+@@ -9054,7 +9068,7 @@
+       builder-util: 26.8.1
+       builder-util-runtime: 9.5.1
+       chalk: 4.1.2
+-      form-data: 4.0.5
+      form-data: 4.0.6
+       fs-extra: 10.1.0
+       lazy-val: 1.0.5
+       mime: 2.6.0
+@@ -9635,6 +9649,14 @@
+       hasown: 2.0.4
+       mime-types: 2.1.35
+ 
+  form-data@4.0.6:
+    dependencies:
+      asynckit: 0.4.0
+      combined-stream: 1.0.8
+      es-set-tostringtag: 2.1.0
+      hasown: 2.0.4
+      mime-types: 2.1.35
+
+   forwarded@0.2.0: {}
+ 
+   fresh@0.5.2: {}
+@@ -10067,6 +10089,10 @@
+     dependencies:
+       argparse: 2.0.1
+ 
+  js-yaml@4.3.0:
+    dependencies:
+      argparse: 2.0.1
+
+   jsesc@3.1.0: {}
+ 
+   json-buffer@3.0.1: {}
+@@ -10545,7 +10571,7 @@
+ 
+   node-abi@3.92.0:
+     dependencies:
+-      semver: 7.8.2
+      semver: 7.8.5
+ 
+   node-abi@4.31.0:
+     dependencies:
+@@ -10563,7 +10589,7 @@
+ 
+   node-forge@1.4.0: {}
+ 
+-  node-gyp@12.3.0:
+  node-gyp@12.4.0:
+     dependencies:
+       env-paths: 2.2.1
+       exponential-backoff: 3.1.3
+@@ -10571,9 +10597,9 @@
+       nopt: 9.0.0
+       proc-log: 6.1.0
+       semver: 7.7.4
+-      tar: 7.5.16
+      tar: 7.5.19
+       tinyglobby: 0.2.17
+-      undici: 6.26.0
+      undici: 6.27.0
+       which: 6.0.1
+ 
+   node-releases@2.0.47: {}
+@@ -10581,7 +10607,7 @@
+   node-windows@1.0.0-beta.8:
+     dependencies:
+       xml: 1.0.1
+-      yargs: 17.7.2
+      yargs: 17.7.3
+ 
+   nopt@6.0.0:
+     dependencies:
+@@ -11156,6 +11182,8 @@
+ 
+   semver@7.8.2: {}
+ 
+  semver@7.8.5: {}
+
+   send@0.19.2:
+     dependencies:
+       debug: 2.6.9
+@@ -11223,7 +11251,7 @@
+     dependencies:
+       color: 4.2.3
+       detect-libc: 2.1.2
+-      semver: 7.8.2
+      semver: 7.8.5
+     optionalDependencies:
+       '@img/sharp-darwin-arm64': 0.33.5
+       '@img/sharp-darwin-x64': 0.33.5
+@@ -11308,7 +11336,7 @@
+ 
+   simple-update-notifier@2.0.0:
+     dependencies:
+-      semver: 7.8.2
+      semver: 7.8.5
+ 
+   sirv@3.0.2:
+     dependencies:
+@@ -11496,7 +11524,7 @@
+       mkdirp: 1.0.4
+       yallist: 4.0.0
+ 
+-  tar@7.5.16:
+  tar@7.5.19:
+     dependencies:
+       '@isaacs/fs-minipass': 4.0.1
+       chownr: 3.0.0
+@@ -11622,7 +11650,7 @@
+ 
+   undici-types@7.18.2: {}
+ 
+-  undici@6.26.0: {}
+  undici@6.27.0: {}
+ 
+   undici@7.27.1: {}
+ 
+@@ -12028,7 +12056,7 @@
+     dependencies:
+       ansi-styles: 6.2.3
+       string-width: 7.2.0
+-      strip-ansi: 7.1.2
+      strip-ansi: 7.2.0
+ 
+   wrappy@1.0.2: {}
+ 
+@@ -12087,7 +12115,7 @@
+       y18n: 4.0.3
+       yargs-parser: 18.1.3
+ 
+-  yargs@17.7.2:
+  yargs@17.7.3:
+     dependencies:
+       cliui: 8.0.1
+       escalade: 3.2.0
--- a/pkgs/by-name/sp/splayer/package.nix
+++ b/pkgs/by-name/sp/splayer/package.nix
@ -2,7 +2,7 @@
  lib,
  stdenv,
  fetchFromGitHub,
-  pnpm_10_29_2,
+  pnpm_10,
  fetchPnpmDeps,
  pnpmConfigHook,
  nodejs,
@ -21,7 +21,7 @@
 }:
 let
  electron = electron_41;
-  pnpm = pnpm_10_29_2;
+  pnpm = pnpm_10;
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "splayer";
@ -40,12 +40,16 @@ stdenv.mkDerivation (finalAttrs: {
      pname
      version
      src
+      patches
      ;
    inherit pnpm;
    fetcherVersion = 3;
-    hash = "sha256-zmLc+ExrZg/y2PEI5rH+no9WenE6I+2bLkdXcA/nOic=";
+    hash = "sha256-HCSuCtJXaRMLCCZIKQ4ElDkrlYXFUIsHfK1H3pUSQX4=";
  };

+  # When pnpm >= 10.29.3 and electron-builder < 26.8.2, it causes the package to fail at runtime; this patch will be removed once the upstream releases a version that includes the new version of electron-builder.
+  patches = [ ./electron-builder-26.8.2.patch ];
+
  cargoDeps = rustPlatform.fetchCargoVendor {
    inherit (finalAttrs)
      pname
--- a/pkgs/by-name/ta/tailwindcss_4/package.nix
+++ b/pkgs/by-name/ta/tailwindcss_4/package.nix
@ -7,7 +7,7 @@
  makeWrapper,
 }:
 let
-  version = "4.3.0";
+  version = "4.3.1";
  inherit (stdenv.hostPlatform) system;
  throwSystem = throw "tailwindcss has not been packaged for ${system} yet.";

@ -22,10 +22,10 @@ let

  hash =
    {
-      aarch64-darwin = "sha256-VrS7xi29xGFKeJMNnGmGQjouxj5OZAFEpZpdlckUMi4=";
-      aarch64-linux = "sha256-j0jctyvjs1HBBWPFMptGOLqFFoINw7OhYJYloWbofL0=";
-      x86_64-darwin = "sha256-K6JS93CBcJHm0NEqhODdUxvMKarRv9nZdqOv8aBxtno=";
-      x86_64-linux = "sha256-c/DlRZBU5c+qirbzuUDz++DxPMf9g7wk58ZVAzwgNAA=";
+      aarch64-darwin = "sha256-onxDYmGFlT7hm9rOGTnHYB5V2mVOCy/ERh4+KZV6pzk=";
+      aarch64-linux = "sha256-PWYjd6htccQ7VJ3Aa5DbRYa0rNQSv4J6MmjpUWYeWt8=";
+      x86_64-darwin = "sha256-6egwzrPnC34HdaPdee7o7ILGsxJw8I8vooV9AHcEWsM=";
+      x86_64-linux = "sha256-JSbQY7oDtx+aPqfVzuFPCuwUfxF/Ii1a3Jex1zbUWZk=";
    }
    .${system} or throwSystem;
 in
--- a/pkgs/by-name/te/teamspeak6-client/package.nix
+++ b/pkgs/by-name/te/teamspeak6-client/package.nix
@ -109,6 +109,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    makeWrapper $out/share/teamspeak6-client/TeamSpeak $out/bin/TeamSpeak \
      --prefix LD_LIBRARY_PATH : "${
        lib.makeLibraryPath [
+          gcc-unwrapped.lib
          udev
          libGL
          libpulseaudio
--- a/pkgs/by-name/te/texlyre/package.nix
+++ b/pkgs/by-name/te/texlyre/package.nix
@ -0,0 +1,107 @@
+{
+  lib,
+  xsel,
+  serve,
+  fetchzip,
+  stdenvNoCC,
+  makeWrapper,
+  buildNpmPackage,
+  fetchFromGitHub,
+
+  baseUrl ? "/",
+}:
+
+buildNpmPackage (finalAttrs: {
+  pname = "texlyre";
+  version = "0.9.0";
+
+  src = fetchFromGitHub {
+    owner = "TeXlyre";
+    repo = "texlyre";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-sUyQYtTuE5bNEqxDw9DYT0KRiww7PmGnQ7CYt60EbSc=";
+  };
+
+  npmDepsHash = "sha256-bOhK7kQWY3QYri9S+WoD8VyZXTGK5gcK/ixpGeeP4hg=";
+
+  postPatch = ''
+    sed -i 's/"version": ".*"/"version": "${finalAttrs.version}"/' package.json
+
+    substituteInPlace texlyre.config.ts \
+      --replace-fail "baseUrl: '/texlyre/'" "baseUrl: '${baseUrl}'"
+
+    # disable downloading assets
+    substituteInPlace scripts/setup-assets.cjs \
+      --replace-fail "await downloadCoreAssets();" ""
+  '';
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  __structuredAttrs = true;
+
+  preBuild = ''
+    # put core assets in place
+    mkdir -p public/core
+    cp -r ${finalAttrs.passthru.drawioEmbed}/drawio-embed public/core/drawio-embed
+    cp -r ${finalAttrs.passthru.busytexAssets} public/core/busytex
+
+    npm run generate:configs
+  '';
+
+  doCheck = true;
+  checkPhase = ''
+    runHook preCheck
+    npm run test:check
+    runHook postCheck
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    mv dist $out
+    runHook postInstall
+  '';
+
+  postFixup = ''
+    makeWrapper ${lib.getExe serve} $out/bin/texlyre \
+      --prefix PATH : ${lib.makeBinPath [ xsel ]} \
+      --chdir $out
+  '';
+
+  passthru = {
+    updateScript = ./update.sh;
+    drawioEmbed = stdenvNoCC.mkDerivation (finalAttrs: {
+      pname = "drawio-embed";
+      version = "30.2.2";
+      src = fetchFromGitHub {
+        owner = "TeXlyre";
+        repo = "drawio-embed-mirror";
+        tag = "v${finalAttrs.version}";
+        hash = "sha256-bdOhviJl0P/+GSJKaHMbGoPf+uEhoX5GeyY6bGBOpCg=";
+      };
+      dontBuild = true;
+      installPhase = "cp -a . $out";
+    });
+    busytexAssets = stdenvNoCC.mkDerivation (finalAttrs: {
+      pname = "busytex-assets";
+      version = "1.1.1";
+      src = fetchFromGitHub {
+        owner = "TeXlyre";
+        repo = "texlyre-busytex";
+        tag = "assets-v${finalAttrs.version}";
+        hash = "sha256-vlLoJw5EX6x3nTQvBC8hntDa5QKtY46eJSxJLJzs4EE=";
+      };
+      dontBuild = true;
+      installPhase = "cp -a . $out";
+    });
+  };
+
+  meta = {
+    changelog = "https://github.com/TeXlyre/texlyre/releases/tag/${finalAttrs.src.rev}";
+    description = "Local-first LaTeX & Typst web editor with real-time collaboration & offline support";
+    homepage = "https://github.com/TeXlyre/texlyre";
+    license = lib.licenses.agpl3Only;
+    platforms = lib.platforms.all;
+    mainProgram = "texlyre";
+    teams = with lib.teams; [ ngi ];
+  };
+})
--- a/pkgs/by-name/te/texlyre/update.sh
+++ b/pkgs/by-name/te/texlyre/update.sh
@ -0,0 +1,19 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p nix-update jq gitMinimal
+
+set -euo pipefail
+
+nix-update texlyre
+
+PKG_DIR=$(realpath "$(dirname "$0")")
+NIXPKGS_ROOT="$(git rev-parse --show-toplevel)"
+SRC_DIR=$(nix-build -E "(import \"$NIXPKGS_ROOT\" {}).texlyre.src" --no-out-link)
+ASSETS_SCRIPT="$SRC_DIR/scripts/download-core-assets.cjs"
+
+DRAWIO_VERSION=$(grep -A 2 "name: 'drawio-embed'" "$ASSETS_SCRIPT" | grep "version:" | cut -d "'" -f 2 | sed 's/^v//')
+BUSYTEX_VERSION=$(grep -A 2 "name: 'texlyre-busytex'" "$ASSETS_SCRIPT" | grep "version:" | cut -d "'" -f 2 | sed 's/^v//')
+
+echo "Updating: drawio-embed=$DRAWIO_VERSION, busytex=$BUSYTEX_VERSION"
+
+nix-update texlyre.passthru.drawioEmbed --version "$DRAWIO_VERSION"
+nix-update texlyre.passthru.busytexAssets --version "$BUSYTEX_VERSION"
--- a/pkgs/by-name/to/tor-browser/package.nix
+++ b/pkgs/by-name/to/tor-browser/package.nix
@ -102,7 +102,7 @@ let
    ++ lib.optionals mediaSupport [ ffmpeg_7 ]
  );

-  version = "15.0.16";
+  version = "15.0.17";

  sources = {
    x86_64-linux = fetchurl {
@ -112,7 +112,7 @@ let
        "https://tor.eff.org/dist/torbrowser/${version}/tor-browser-linux-x86_64-${version}.tar.xz"
        "https://tor.calyxinstitute.org/dist/torbrowser/${version}/tor-browser-linux-x86_64-${version}.tar.xz"
      ];
-      hash = "sha256-EVQMUSBKVErtMoXzjxWd+ga6tptS7GsnJvdw0e2s5Qc=";
+      hash = "sha256-WJFDd+DVj4oKHjv7py3yVrttrrCHFcHJbyvLNOwCjhs=";
    };

    i686-linux = fetchurl {
@ -122,7 +122,7 @@ let
        "https://tor.eff.org/dist/torbrowser/${version}/tor-browser-linux-i686-${version}.tar.xz"
        "https://tor.calyxinstitute.org/dist/torbrowser/${version}/tor-browser-linux-i686-${version}.tar.xz"
      ];
-      hash = "sha256-c4sA3uKZZdPSdSmIOs536s5fHUw39+y/l4vS6H4cYrI=";
+      hash = "sha256-pKmAKDWutSp7ptJ66PMiS59aV+pRs3Oz9pV64kRuebI=";
    };
  };

--- a/pkgs/by-name/ve/veloren/package.nix
+++ b/pkgs/by-name/ve/veloren/package.nix
@ -50,6 +50,13 @@ rustPlatform.buildRustPackage {
  cargoHash = "sha256-1qLE1UeP2i0xaOGLniZzdjIkBbme6rctGfcO9Kfoh5E=";

  postPatch = ''
+    # Fix hashbrown on rust ≥1.95
+    # (https://github.com/rust-lang/hashbrown/pull/662)
+    substituteInPlace "$cargoDepsCopy"/*/hashbrown-0.16.0/src/lib.rs \
+      --replace-fail 'strict_provenance_lints' 'strict_provenance_lints,trivial_clone'
+    substituteInPlace "$cargoDepsCopy"/*/hashbrown-0.16.0/src/raw/mod.rs \
+      --replace-fail 'T: Copy,' 'T: core::clone::TrivialClone,'
+
    # Force vek to build in unstable mode
    tee "$cargoDepsCopy"/*/vek-*/build.rs > /dev/null <<'EOF'
    fn main() {
--- a/pkgs/by-name/zi/zipline/package.nix
+++ b/pkgs/by-name/zi/zipline/package.nix
@ -36,13 +36,13 @@ in

 stdenv.mkDerivation (finalAttrs: {
  pname = "zipline";
-  version = "4.6.2";
+  version = "4.6.3";

  src = fetchFromGitHub {
    owner = "diced";
    repo = "zipline";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-U4Rl1WiOg9DVFEnghKOy/WabeXf3l3zpaxqAmjneil0=";
+    hash = "sha256-6nAWYVt81mjvA7ssIAhFD+oTkVkuoHeAMV9dQpFlyJc=";
    leaveDotGit = true;
    postFetch = ''
      git -C $out rev-parse --short HEAD > $out/.git_head
--- a/pkgs/development/beam-modules/hex/default.nix
+++ b/pkgs/development/beam-modules/hex/default.nix
@ -18,13 +18,13 @@ let
    self:
    stdenv.mkDerivation rec {
      pname = "hex";
-      version = "2.4.2";
+      version = "2.5.0";

      src = fetchFromGitHub {
        owner = "hexpm";
        repo = "hex";
        rev = "v${version}";
-        sha256 = "sha256-+deoFCHs2paABaZInyknwdQJafJ/DO0EnqscPUiL6rY=";
+        sha256 = "sha256-Lt+dpIKtowvt96MhMcYkt3f6h2KN1uyJDkRxOUEIYY4=";
      };

      setupHook = writeText "setupHook.sh" ''
--- a/pkgs/development/compilers/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/default.nix
@ -28,9 +28,9 @@ let
    "21.1.8".officialRelease.sha256 = "sha256-pgd8g9Yfvp7abjCCKSmIn1smAROjqtfZaJkaUkBSKW0=";
    "22.1.5".officialRelease.sha256 = "sha256-eunfMOH+HVpefZJ+CG7hXDoM+pi6iYvHpD3DoSAsjoE=";
    "23.0.0-git".gitRelease = {
-      rev = "d1744cf76fbea0c407c5e793a380ffca4e5829be";
-      rev-version = "23.0.0-unstable-2026-06-21";
-      sha256 = "sha256-gtfU3pO3xiZtxz/iRmkWnaEx/DEomkOi9r6jsCbLOgQ=";
+      rev = "4050d7a96903eec615c57e1d3d6f3c824096244c";
+      rev-version = "23.0.0-unstable-2026-06-28";
+      sha256 = "sha256-UAqDlH9F/GZ9O9VGiOyP5shuVTIC3SeSstyH5ZWDfAM=";
    };
  }
  // llvmVersions;
--- a/pkgs/development/ocaml-modules/cohttp/server-lwt-unix.nix
+++ b/pkgs/development/ocaml-modules/cohttp/server-lwt-unix.nix
@ -0,0 +1,24 @@
+{
+  buildDunePackage,
+  cohttp,
+  cohttp-lwt-unix,
+  http,
+  lwt,
+}:
+
+buildDunePackage (finalAttrs: {
+  pname = "cohttp-server-lwt-unix";
+  inherit (cohttp) version src;
+
+  propagatedBuildInputs = [
+    http
+    lwt
+  ];
+
+  checkInputs = [ cohttp-lwt-unix ];
+  doCheck = true;
+
+  meta = cohttp.meta // {
+    description = "Lightweight Cohttp + Lwt based HTTP server";
+  };
+})
--- a/pkgs/development/ocaml-modules/eliom/default.nix
+++ b/pkgs/development/ocaml-modules/eliom/default.nix
@ -1,7 +1,6 @@
 {
  buildDunePackage,
  lib,
-  ocaml,
  fetchFromGitHub,
  which,
  ocsigen_server,
--- a/pkgs/development/ocaml-modules/grace/default.nix
+++ b/pkgs/development/ocaml-modules/grace/default.nix
@ -0,0 +1,50 @@
+{
+  lib,
+  buildDunePackage,
+  fetchFromGitHub,
+  fmt,
+  iter,
+  uutf,
+  sexplib,
+  ppx_sexp_conv,
+  core,
+  ppx_jane,
+  dedent ? null,
+}:
+
+buildDunePackage (finalAttrs: {
+  pname = "grace";
+  version = "0.3.0";
+
+  minimalOCamlVersion = "4.14";
+
+  src = fetchFromGitHub {
+    owner = "johnyob";
+    repo = "grace";
+    tag = finalAttrs.version;
+    hash = "sha256-V5K9RGk47K/R+q4wS1FU02kMi1uWSCgdUjKHk7uXuGw=";
+  };
+
+  propagatedBuildInputs = [
+    fmt
+    iter
+    uutf
+    sexplib
+    ppx_sexp_conv
+  ];
+
+  checkInputs = [
+    core
+    ppx_jane
+    dedent
+  ];
+
+  doCheck = true;
+
+  meta = {
+    description = "A fancy diagnostics library that allows your compilers to exit with grace";
+    homepage = "https://github.com/johnyob/grace";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ otini ];
+  };
+})
--- a/pkgs/development/ocaml-modules/ocsigen-toolkit/default.nix
+++ b/pkgs/development/ocaml-modules/ocsigen-toolkit/default.nix
@ -51,6 +51,7 @@ stdenv.mkDerivation rec {
    license = lib.licenses.lgpl21;
    maintainers = [ lib.maintainers.gal_bolle ];
    inherit (ocaml.meta) platforms;
+    broken = true;
  };

 }
--- a/pkgs/development/tools/ocaml/js_of_ocaml/compiler.nix
+++ b/pkgs/development/tools/ocaml/js_of_ocaml/compiler.nix
@ -12,7 +12,7 @@
  sedlex,
  version ?
    if lib.versionAtLeast ocaml.version "4.13" then
-      "6.3.2"
+      "6.4.0"
    else if lib.versionAtLeast ocaml.version "4.11" then
      "6.0.1"
    else
@ -27,6 +27,7 @@ buildDunePackage {
    url = "https://github.com/ocsigen/js_of_ocaml/releases/download/${version}/js_of_ocaml-${version}.tbz";
    hash =
      {
+        "6.4.0" = "sha256-euIqflpsaqFKjiaV+mLGbzLLINsX8bRdwh6XAJNCFR8=";
        "6.3.2" = "sha256-qTr8llTsNGRwH7zg3M86i+uVCKyxLGBFd2vyzxBsq8A=";
        "6.2.0" = "sha256-fMZBd40bFyo1KogzPuDoxiE2WgrPzZuH44v9243Spdo=";
        "6.1.1" = "sha256-0x2kGq5hwCqqi01QTk6TcFIz0wPNgaB7tKxe7bA9YBQ=";
--- a/pkgs/tools/networking/iperf/2.nix
+++ b/pkgs/tools/networking/iperf/2.nix
@ -2,6 +2,7 @@
  lib,
  stdenv,
  fetchurl,
+  pkgsCross,
 }:

 stdenv.mkDerivation (finalAttrs: {
@ -15,16 +16,23 @@ stdenv.mkDerivation (finalAttrs: {

  configureFlags = [ "--enable-fastsampling" ];

+  makeFlags = [ "AR:=$(AR)" ];
+
  postInstall = ''
    mv $out/bin/iperf $out/bin/iperf2
    ln -s $out/bin/iperf2 $out/bin/iperf
  '';

+  passthru.tests = {
+    cross-aarch64 = pkgsCross.aarch64-multiplatform.iperf2;
+  };
+
  meta = {
    homepage = "https://sourceforge.net/projects/iperf/";
    description = "Tool to measure IP bandwidth using UDP or TCP";
    platforms = lib.platforms.unix;
    license = lib.licenses.mit;
+    mainProgram = "iperf2";
    maintainers = with lib.maintainers; [ randomizedcoder ];

    # prioritize iperf3
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@ -284,6 +284,8 @@ let

        cohttp-lwt-unix = callPackage ../development/ocaml-modules/cohttp/lwt-unix.nix { };

+        cohttp-server-lwt-unix = callPackage ../development/ocaml-modules/cohttp/server-lwt-unix.nix { };
+
        cohttp-top = callPackage ../development/ocaml-modules/cohttp/top.nix { };

        coin = callPackage ../development/ocaml-modules/coin { };
@ -762,6 +764,8 @@ let
          inherit (pkgs) gnuplot;
        };

+        grace = callPackage ../development/ocaml-modules/grace { };
+
        graphics =
          if lib.versionOlder "4.09" ocaml.version then
            callPackage ../development/ocaml-modules/graphics { }