Merge remote-tracking branch 'origin/master' into staging-next

2026-07-06 17:13:24 -05:00 · 2026-05-08 09:27:15 +03:00 · 2026-05-08 09:27:15 +03:00 · 7a535c8c93
commit 7a535c8c93
parent a8754b0b9a 0a8d309190
232 changed files with 2966 additions and 1132 deletions
--- a/lib/licenses/licenses.nix
+++ b/lib/licenses/licenses.nix
@ -527,6 +527,11 @@ lib.mapAttrs mkLicense (
      fullName = "DOC License";
    };

+    docBookDtd = {
+      spdxId = "DocBook-DTD";
+      fullName = "DocBook DTD License";
+    };
+
    drl10 = {
      spdxId = "DRL-1.0";
      fullName = "Detection Rule License 1.0";
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -4604,6 +4604,12 @@
    githubId = 9086315;
    name = "Connor Brewster";
  };
+  cbrxyz = {
+    email = "me@cbrxyz.com";
+    github = "cbrxyz";
+    githubId = 52760912;
+    name = "Cameron Brown";
+  };
  ccellado = {
    email = "annplague@gmail.com";
    github = "ccellado";
--- a/nixos/doc/manual/release-notes/rl-2605.section.md
+++ b/nixos/doc/manual/release-notes/rl-2605.section.md
@ -110,6 +110,8 @@

 - [dsearch](https://github.com/AvengeMedia/danksearch), a fast filesystem search service with fuzzy matching. Available as [programs.dsearch](#opt-programs.dsearch.enable).

+- [Rustical](https://github.com/lennart-k/rustical), a CalDav/CardDav server aiming to be simple, fast and passwordless. Available as [services.rustical](options.html#opt-services.rustical.enable).
+
 - [Elephant](https://github.com/abenz1267/elephant), a data provider service and backend for building custom application launchers. Available as [services.elephant](#opt-services.elephant.enable).

 - [Dunst](https://github.com/dunst-project/dunst), a lightweight and customizable notification daemon. Available as [services.dunst](#opt-services.dunst.enable).
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -1768,6 +1768,7 @@
  ./services/web-apps/rimgo.nix
  ./services/web-apps/rss-bridge.nix
  ./services/web-apps/rsshub.nix
+  ./services/web-apps/rustical.nix
  ./services/web-apps/rutorrent.nix
  ./services/web-apps/screego.nix
  ./services/web-apps/selfoss.nix
--- a/nixos/modules/services/networking/nbd.nix
+++ b/nixos/modules/services/networking/nbd.nix
@ -36,8 +36,6 @@ let
    generic = (
      cfg.server.extraOptions
      // {
-        user = "root";
-        group = "root";
        port = cfg.server.listenPort;
      }
      // (optionalAttrs (cfg.server.listenAddress != null) {
@ -155,8 +153,8 @@ in
      before = [ "multi-user.target" ];
      wantedBy = [ "multi-user.target" ];
      serviceConfig = {
-        ExecStart = "${pkgs.nbd}/bin/nbd-server -C ${serverConfig}";
-        Type = "forking";
+        ExecStart = "${pkgs.nbd}/bin/nbd-server -n -C ${serverConfig}";
+        Type = "simple";

        DeviceAllow = map (path: "${path} rw") allowedDevices;
        BindPaths = boundPaths;
--- a/nixos/modules/services/networking/reframe.nix
+++ b/nixos/modules/services/networking/reframe.nix
@ -9,7 +9,7 @@ let
  iniFmt = pkgs.formats.ini { };
 in
 {
-  options.programs.reframe = {
+  options.services.reframe = {
    enable = lib.mkEnableOption "DRM/KMS based remote desktop for Linux that supports Wayland/NVIDIA/headless/login…";
    package = lib.mkPackageOption pkgs "reframe" { };
    configs = lib.mkOption {
@ -113,7 +113,7 @@ in
                  "cpu"
                  "gpu"
                ];
-                default = true;
+                default = "cpu";
                description = ''
                  Set to `gpu` to use GPU damage region detection, which may be more efficiency but may cause artifacts depending on GPU vendors.
                  Set to `cpu` to use CPU damage region detection if you get bugs with `gpu`.
@ -173,7 +173,7 @@ in
      description = "ReFrame Remote Desktop";
    };
    users.groups.reframe = { };
-    environment.etc = builtins.mapAttrs' (
+    environment.etc = lib.mapAttrs' (
      name: value:
      lib.nameValuePair "reframe/${name}.conf" {
        mode = "0644";
--- a/nixos/modules/services/web-apps/rustical.nix
+++ b/nixos/modules/services/web-apps/rustical.nix
@ -0,0 +1,183 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  inherit (lib)
+    mkIf
+    mkEnableOption
+    mkOption
+    mkPackageOption
+    types
+    ;
+
+  cfg = config.services.rustical;
+
+  format = pkgs.formats.toml { };
+  configFile = format.generate "rustical.toml" cfg.settings;
+in
+
+{
+  options.services.rustical = {
+    enable = mkEnableOption "RustiCali CalDAV/CardDAV server";
+
+    package = mkPackageOption pkgs "rustical" { };
+
+    settings = mkOption {
+      description = ''
+        Your {file}`/etc/rustical/config.toml` as a Nix attribute set.
+
+        Possible options can be found in the [Config struct]. A default
+        configuration can be viewed by running `rustical gen-config`.
+
+        [Config struct]: https://lennart-k.github.io/rustical/_crate/rustical/config/struct.Config.html
+      '';
+      type = types.submodule {
+        freeformType = format.type;
+        options = {
+          data_store.sqlite = {
+            db_url = mkOption {
+              type = types.path;
+              default = "/var/lib/rustical/db.sqlite3";
+              description = ''
+                Path where the sqlite database is stored.
+              '';
+            };
+          };
+
+          frontend = {
+            enabled = mkEnableOption "the HTTP frontend" // {
+              default = true;
+            };
+          };
+
+          http = {
+            host = mkOption {
+              type = types.str;
+              default = "[::1]";
+              example = "[::]";
+              description = ''
+                Host address to bind the HTTP service to.
+
+                :::{.note}
+                Rustical expects to be hosted behind a reverse proxy that
+                provides HTTPS. Without HTTPS, the web frontend and some clients
+                (e.g. Apple Calendar) may not work.
+                :::
+              '';
+            };
+
+            port = mkOption {
+              type = types.port;
+              default = 4000;
+              description = ''
+                Port to bind the HTTP service to.
+              '';
+            };
+          };
+
+          dav_push.enabled = mkOption {
+            type = types.bool;
+            default = true;
+            description = ''
+              Whether to enable [WebDav Push] support.
+
+              This allows the server to notify clients about changed data.
+
+              [WebDav Push]: https://github.com/bitfireAT/webdav-push/
+            '';
+          };
+
+          nextcloud_login.enabled = mkOption {
+            type = types.bool;
+            default = true;
+            description = ''
+              Whether to emulate the Nextcloud login flow.
+
+              This is supported in [DAVx5] and enables automatic app token generation.
+
+              [DAVx5]: https://www.davx5.com/
+            '';
+          };
+        };
+      };
+    };
+
+    environmentFiles = mkOption {
+      type = with types; listOf path;
+      default = [ ];
+      example = [ "/run/keys/rustical.env" ];
+      description = ''
+        Environment files to load into the runtime environment.
+
+        Check the documentation for how to construct [environment variables].
+
+        :::{.tip}
+        Environment variables can substitute any config value and are useful for
+        hiding secrets.
+        :::
+
+        [environment variables]: https://lennart-k.github.io/rustical/installation/configuration/#environment-variables
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    # install the config at a path where the cli will find it
+    environment.etc."rustical/config.toml".source = configFile;
+
+    # provide the rustical cli
+    environment.systemPackages = [ cfg.package ];
+
+    systemd.services.rustical = {
+      description = "RustiCal CalDav/CardDav server";
+      documentation = [ "https://lennart-k.github.io/rustical/" ];
+      wantedBy = [ "multi-user.target" ];
+      restartTriggers = [ configFile ];
+
+      serviceConfig = {
+        DynamicUser = true;
+        ExecStart = lib.getExe cfg.package;
+        EnvironmentFile = cfg.environmentFiles;
+        Restart = "on-failure";
+        StateDirectory = "rustical";
+
+        CapabilityBoundingSet = "";
+        DevicePolicy = "closed";
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateTmp = true;
+        PrivateUsers = true;
+        ProcSubset = "pid";
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ProtectSystem = "strict";
+        RemoveIPC = true;
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+        ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged @resources"
+        ];
+        SystemCallErrorNumber = "EPERM";
+        UMask = "0077";
+      };
+    };
+  };
+}
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -1471,6 +1471,7 @@ in
  rtkit = runTest ./rtkit.nix;
  rtorrent = runTest ./rtorrent.nix;
  rush = runTest ./rush.nix;
+  rustical = runTest ./web-apps/rustical.nix;
  rustls-libssl = runTest ./rustls-libssl.nix;
  rxe = runTest ./rxe.nix;
  sabnzbd = runTest ./sabnzbd.nix;
--- a/nixos/tests/harmonia.nix
+++ b/nixos/tests/harmonia.nix
@ -35,7 +35,7 @@
    ''
      start_all()

-      harmonia.wait_for_unit("harmonia.service")
+      harmonia.wait_for_unit("harmonia.socket")

      client01.wait_until_succeeds("curl -f http://harmonia:5000/nix-cache-info | grep '${toString nodes.harmonia.services.harmonia.cache.settings.priority}' >&2")
      client01.succeed("curl -f http://harmonia:5000/version | grep '${nodes.harmonia.services.harmonia.package.version}' >&2")
--- a/nixos/tests/ncps-ha-pg-redis.nix
+++ b/nixos/tests/ncps-ha-pg-redis.nix
@ -180,7 +180,7 @@ in

      start_all()

-      harmonia.wait_for_unit("harmonia.service")
+      harmonia.wait_for_unit("harmonia.socket")

      ncps0.wait_for_unit("ncps.service")
      ncps1.wait_for_unit("ncps.service")
--- a/nixos/tests/ncps.nix
+++ b/nixos/tests/ncps.nix
@ -66,7 +66,7 @@
    ''
      start_all()

-      harmonia.wait_for_unit("harmonia.service")
+      harmonia.wait_for_unit("harmonia.socket")

      ncps.wait_for_unit("ncps.service")

--- a/nixos/tests/systemd-initrd-swraid.nix
+++ b/nixos/tests/systemd-initrd-swraid.nix
@ -23,12 +23,7 @@
        mdadm
        e2fsprogs
      ]; # for mdadm and mkfs.ext4
-      boot.swraid = {
-        enable = true;
-        mdadmConf = ''
-          ARRAY /dev/md0 devices=/dev/vdb,/dev/vdc
-        '';
-      };
+      boot.swraid.enable = true;
      environment.etc."mdadm.conf".text = ''
        MAILADDR test@example.com
      '';
@ -64,12 +59,12 @@
    assert "hello" in machine.succeed("cat /test")
    assert "md0" in machine.succeed("cat /proc/mdstat")

-    expected_config = """MAILADDR test@example.com
+    # Verify the RAID array was properly auto-detected and assembled
+    detail = machine.succeed("mdadm --detail /dev/md0")
+    assert "raid1" in detail, f"Expected raid1 in mdadm detail output: {detail}"
+    assert "/dev/vdb" in detail, f"Expected /dev/vdb in array: {detail}"
+    assert "/dev/vdc" in detail, f"Expected /dev/vdc in array: {detail}"

-    ARRAY /dev/md0 devices=/dev/vdb,/dev/vdc
-    """
-    got_config = machine.execute("cat /etc/mdadm.conf")[1]
-    assert expected_config == got_config, repr((expected_config, got_config))
    machine.wait_for_unit("mdmonitor.service")
  '';
 }
--- a/nixos/tests/web-apps/rustical.nix
+++ b/nixos/tests/web-apps/rustical.nix
@ -0,0 +1,72 @@
+{
+  pkgs,
+  lib,
+  ...
+}:
+{
+  name = "rustical";
+
+  meta.maintainers = pkgs.rustical.meta.maintainers;
+
+  nodes.machine =
+    {
+      pkgs,
+      ...
+    }:
+    {
+      services.rustical.enable = true;
+      environment.systemPackages = with pkgs; [ calendar-cli ];
+    };
+
+  testScript =
+    {
+      nodes,
+      ...
+    }:
+    let
+      port = toString nodes.machine.services.rustical.settings.http.port;
+      url = "http://localhost:${toString port}";
+
+      createPrincipalScript = pkgs.writeScript "rustical-create-principal" ''
+        #!${lib.getExe pkgs.expect}
+        spawn rustical principals create alice --password
+        expect "Enter your password:\r"
+        send "foobar\r"
+        expect eof
+      '';
+
+      calendarCliConfig = (pkgs.formats.json { }).generate "rustical-test-calendar-cli.json" {
+        default = {
+          caldav_user = "alice";
+          caldav_url = "${url}/caldav/";
+          calendar_url = "${url}/caldav/principal/alice";
+        };
+        testcal = {
+          inherits = "default";
+          calendar_url = "${url}/caldav/principal/alice/testcal";
+        };
+      };
+    in
+    # python
+    ''
+      machine.wait_for_unit("rustical.service")
+      machine.wait_for_open_port(${port})
+
+      with subtest("Smoketest"):
+        machine.succeed("curl --fail ${url}")
+
+      with subtest("Create principal"):
+        machine.succeed("${createPrincipalScript}")
+        machine.succeed("rustical principals list | grep alice")
+
+      with subtest("Generate token for principal"):
+        machine.succeed("curl -f -c cookies.txt -d 'username=alice&password=foobar' ${url}/frontend/login")
+        machine.succeed("curl -f -b cookies.txt -d 'name=mytoken' ${url}/frontend/user/alice/app_token > token.txt")
+
+      with subtest("Interact with caldav"):
+        machine.succeed('calendar-cli --config-file ${calendarCliConfig} --caldav-pass "$(cat token.txt)" calendar create testcal')
+        machine.succeed('calendar-cli --config-file ${calendarCliConfig} --config-section testcal --caldav-pass "$(cat token.txt)" calendar add 2013-10-01 testevent')
+
+      machine.log(machine.execute("systemd-analyze security rustical.service | grep -v ✓")[1])
+    '';
+}
--- a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/ghostel/package.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/ghostel/package.nix
@ -13,13 +13,13 @@ let

  pname = "ghostel";

-  version = "0.18.1-unstable-2026-04-24";
+  version = "0-unstable-2026-05-06";

  src = fetchFromGitHub {
    owner = "dakra";
    repo = "ghostel";
-    rev = "fdfb68f70ca6f43277ef8a0ba4103631857e4ad4";
-    hash = "sha256-u3zUj5uUHqFEP7mjmADNB6n6n/LmGR6ne0ylalop8WI=";
+    rev = "5bce751687f3b33978a4244a1611648bbedb7124";
+    hash = "sha256-MAV3iQeriZhE9SGwVEnKs2rwebbEnPP1LiHuCAjlGE8=";
  };

  module = stdenv.mkDerivation (finalAttrs: {
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@ -1760,8 +1760,8 @@ let
        mktplcRef = {
          name = "foam-vscode";
          publisher = "foam";
-          version = "0.39.0";
-          hash = "sha256-kOzr8YjwHdA3Tgo4JeEAWda4tBrXjMQNBITNhmy9cP4=";
+          version = "0.40.3";
+          hash = "sha256-NGC6uW1biseqQ04fD3K4mK4D4rcGVqt0LBlGFC1Exu8=";
        };
        meta = {
          changelog = "https://marketplace.visualstudio.com/items/foam.foam-vscode/changelog";
@ -4530,8 +4530,8 @@ let
        mktplcRef = {
          name = "svelte-vscode";
          publisher = "svelte";
-          version = "109.15.0";
-          hash = "sha256-/1we+6X3l7MCx96ELz7wg6oDDAcYCJBt7XJ4X0ihwx0=";
+          version = "110.0.0";
+          hash = "sha256-l5L0uqHpBR6nWzr8/edz3EU8+BP9yqRRFhpnngG0RGY=";
        };
        meta = {
          changelog = "https://github.com/sveltejs/language-tools/releases";
--- a/pkgs/applications/editors/vscode/extensions/eamodio.gitlens/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/eamodio.gitlens/default.nix
@ -26,8 +26,8 @@ let

    pnpmDeps = fetchPnpmDeps {
      inherit (finalAttrs) pname version src;
-      fetcherVersion = 2;
-      hash = "sha256-mr5GwwfuNoLhKM5bAhNAO3j0ow4FcyZhvQlVnAENoyg=";
+      fetcherVersion = 3;
+      hash = "sha256-Yuxuqr1BiviSw+dGNHLs2jAy8ADlBvRks6Kmy7FmCMw=";
    };

    postPatch = ''
--- a/pkgs/applications/editors/vscode/extensions/rooveterinaryinc.roo-cline/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/rooveterinaryinc.roo-cline/default.nix
@ -25,8 +25,8 @@ let

    pnpmDeps = fetchPnpmDeps {
      inherit (finalAttrs) pname version src;
-      fetcherVersion = 2;
-      hash = "sha256-kQjxcqHEClQtG6x2QM1/zixN6rvcEivX8vicNydDdOw=";
+      fetcherVersion = 3;
+      hash = "sha256-t2sPuhn8xdk6hGfmViPGG+5TAhtBBOMYNoOb6DlPzws=";
    };

    nativeBuildInputs = [
--- a/pkgs/applications/graphics/inkscape/default.nix
+++ b/pkgs/applications/graphics/inkscape/default.nix
@ -76,7 +76,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "inkscape";
-  version = "1.4.3";
+  version = "1.4.4";
  outputs = [
    "out"
    "man"
@ -84,7 +84,7 @@ stdenv.mkDerivation (finalAttrs: {

  src = fetchurl {
    url = "https://inkscape.org/release/inkscape-${finalAttrs.version}/source/archive/xz/dl/inkscape-${finalAttrs.version}.tar.xz";
-    sha256 = "sha256-6DosPbVwtsWh/w/M/nCYg3s/a9dLEzVnk3yKkXEO0dE=";
+    sha256 = "sha256-u85XU6Hgi4caXPFsZl6wYHAKqrmmo3ncY/TE2bO4hW4=";
  };

  # Inkscape hits the ARGMAX when linking on macOS. It appears to be
--- a/pkgs/applications/networking/browsers/chromium/info.json
+++ b/pkgs/applications/networking/browsers/chromium/info.json
@ -828,28 +828,28 @@
    }
  },
  "ungoogled-chromium": {
-    "version": "147.0.7727.137",
+    "version": "148.0.7778.96",
    "deps": {
      "depot_tools": {
-        "rev": "f2f7ec41f2c170d6f1899406f11a48411760a683",
-        "hash": "sha256-/4Zz169PVxRGFubknL+5hbUX9uRnOGArjt0dA8u0I88="
+        "rev": "41c40cfaec7ee3bf0423c59925d8b23982a601f1",
+        "hash": "sha256-s9uvmYHCJKWnNhztmOPb+OHj/HbGo30PupwT4mHWjnM="
      },
      "gn": {
-        "version": "0-unstable-2026-03-05",
-        "rev": "d8c2f07d653520568da7cace755a87dad241b72d",
-        "hash": "sha256-3AfExm7NL5GJXyC5JCPbGC70D59doRfIZIgpt6MLy9Y="
+        "version": "0-unstable-2026-04-01",
+        "rev": "6e8dcdebbadf4f8aa75e6a4b6e0bdf89dce1513a",
+        "hash": "sha256-BTPD8WM1pVAMkFDlHekMdWFGyf63KdhKkKwsqikqoBQ="
      },
      "ungoogled-patches": {
-        "rev": "147.0.7727.137-1",
-        "hash": "sha256-MtsTk7aV7qpeXYBTxfEauCJlcoWYxdsQFbtN9ockSME="
+        "rev": "148.0.7778.96-1",
+        "hash": "sha256-yuc51ursl3pNyqSuTT9391AAlytoTzEMeronxjsNM7g="
      },
-      "npmHash": "sha256-ByB1Ea5tduIJZXyydeBWsoS8OPABOgwHe+dNXRssdvc="
+      "npmHash": "sha256-JuVcY8iFRDWcPcP4Pg+qm5rnTXkiVfNsqSkXbDWqsE8="
    },
    "DEPS": {
      "src": {
        "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "68ba233a543d25e75c30f1228dd3bafa2da96937",
-        "hash": "sha256-ktIkQRYWcyKnZKEhvxFGssMZ///ctd/Ue3VIYPvQzuM=",
+        "rev": "8625e066febc721e015ea99842da12901eb7ed73",
+        "hash": "sha256-coeBYfNPtiRRPuqoBRaxkTQI/a2pYNLI1slUdU1dZAc=",
        "recompress": true
      },
      "src/third_party/clang-format/script": {
@ -859,8 +859,8 @@
      },
      "src/third_party/compiler-rt/src": {
        "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/compiler-rt.git",
-        "rev": "338a5c004c774a8927899b1f1c0c25a82d14510f",
-        "hash": "sha256-2lj4oF8IbJoPOBWwQ4ZfDQjPklxQyNyG5AcHazxEYcs="
+        "rev": "76287b5da8e155135536c8e3a67432d97d74fe3a",
+        "hash": "sha256-q6syHriTR8TCQSqTWbbAkVVK0a/i4wojdEGN7sWGxUY="
      },
      "src/third_party/libc++/src": {
        "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxx.git",
@ -874,13 +874,13 @@
      },
      "src/third_party/libunwind/src": {
        "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libunwind.git",
-        "rev": "78884e23fe39cf5cc6987ea188a9b802d65a21c9",
-        "hash": "sha256-G8CtxDHzo8WtJ6qrtghXBoYCWwnDvXcAueEGzLc6C14="
+        "rev": "6ca46ff28e3578c57cbead6f233969eb3dabc176",
+        "hash": "sha256-JW4kqpVTCFDN4WZE2S5gEkX1O7eDycl+adm3KGlUoTU="
      },
      "src/third_party/llvm-libc/src": {
        "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libc.git",
-        "rev": "c42ab4598a74eea2cf3efff9d44b22de155d41af",
-        "hash": "sha256-NJCdrmVyF80aQLtrdVgcWQadhj5w7nKrLShaZDen1GA="
+        "rev": "2a826f2fda3cf8d75b47cbc3bb1d9b244f13a6ab",
+        "hash": "sha256-OWe2lAT5XbADWuxHgg53lZiU0My/ys86FEXvn4zlVx0="
      },
      "src/chrome/test/data/perf/canvas_bench": {
        "url": "https://chromium.googlesource.com/chromium/canvas_bench.git",
@ -899,18 +899,18 @@
      },
      "src/docs/website": {
        "url": "https://chromium.googlesource.com/website.git",
-        "rev": "d3b3b620e65ebaf511c6c8399b98a081cd644a66",
-        "hash": "sha256-xTGvhQUKOgt007WdvzN4eDpue8nheEMSV+Cl3Tnwviw="
+        "rev": "44319eca109f9678595924a90547c1f6650d8664",
+        "hash": "sha256-Trkan7bzRaLFlTkRfNGh7ssoZ3QpMh+mxQacsSM+d2I="
      },
      "src/media/cdm/api": {
        "url": "https://chromium.googlesource.com/chromium/cdm.git",
-        "rev": "9920660ea0162f88c44a648de177e6f8cb976d07",
-        "hash": "sha256-rC/aV3vsFzXQ8BiOIK+OTXxTsgTLEEqC19KDAot1PTs="
+        "rev": "33c977516b3dfe5b065bc298aa74175e1999ab51",
+        "hash": "sha256-GsaRxLnsz1jrFZ3m5tv65d1dioG23uJnmfa+WD7XcFc="
      },
      "src/net/third_party/quiche/src": {
        "url": "https://quiche.googlesource.com/quiche.git",
-        "rev": "435c98c0d9ab7a2b60592c5297635b4791745191",
-        "hash": "sha256-dhsq9kLRcXPxv0Ih6CQhDvLAGjh3EgSCl28Cxjk2aos="
+        "rev": "21ffbe4c7b717d00d2d768c259b5b330fd754ac3",
+        "hash": "sha256-yKMmfdSBvbB3T042TJbZ1Mw+y0kyfHP0knQVFWAFPTg="
      },
      "src/testing/libfuzzer/fuzzers/wasm_corpus": {
        "url": "https://chromium.googlesource.com/v8/fuzzer_wasm_corpus.git",
@ -919,8 +919,8 @@
      },
      "src/third_party/angle": {
        "url": "https://chromium.googlesource.com/angle/angle.git",
-        "rev": "534e0d1c1d0fcb4b57fd6a3fb9284cd14eaa28cd",
-        "hash": "sha256-o3UV8X27G7wpaDiKDzgMZN64+d9JQrvcQXpSybxi/h4="
+        "rev": "cc0e3572e8789f4a184dd9714a04b3d98ae81015",
+        "hash": "sha256-3KVTEBcnQTn99ccdKzylzUvua2jlS4g8/nfIDdLk6ug="
      },
      "src/third_party/angle/third_party/glmark2/src": {
        "url": "https://chromium.googlesource.com/external/github.com/glmark2/glmark2",
@ -934,8 +934,8 @@
      },
      "src/third_party/angle/third_party/VK-GL-CTS/src": {
        "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/VK-GL-CTS",
-        "rev": "1cf4ed5bc0620ea514404609b1a2958c4518b86d",
-        "hash": "sha256-IZ5tVrld2+wDOWaYX93j2eLZJJs/EMW1+FtxhOeWi6w="
+        "rev": "f52e89f885064b9109501bca16c813bb29389993",
+        "hash": "sha256-3jx4QVR9nB3WggfrORGJGifmJQhAYVSPusa7RlR16qg="
      },
      "src/third_party/anonymous_tokens/src": {
        "url": "https://chromium.googlesource.com/external/github.com/google/anonymous-tokens.git",
@ -954,48 +954,53 @@
      },
      "src/third_party/dav1d/libdav1d": {
        "url": "https://chromium.googlesource.com/external/github.com/videolan/dav1d.git",
-        "rev": "b546257f770768b2c88258c533da38b91a06f737",
-        "hash": "sha256-E3da/LJ8HNy1osExmupovqnL8JHgVNzPUCG5F8TJKXQ="
+        "rev": "d69235dd804b24c04ed05639cffcc912cd6cfd75",
+        "hash": "sha256-iKq6TYscIBK4ydv+0msNV3tcs82Ljk5ZNr954Qv2lII="
      },
      "src/third_party/dawn": {
        "url": "https://dawn.googlesource.com/dawn.git",
-        "rev": "049880d58d6636a819168c00f44f8a4ed1e33e51",
-        "hash": "sha256-AHUos4ejvcsHTDdretkDHAeyLugtI6Jg14Hb9MbbPPs="
+        "rev": "19696dd088b8ed5804e2f02a8f83f5afdb3e99e3",
+        "hash": "sha256-ihnVPCk9412UzCmoABWVUhiGaIdIYxiYMkk43KDqpg8="
      },
-      "src/third_party/dawn/third_party/glfw": {
+      "src/third_party/dawn/third_party/glfw3/src": {
        "url": "https://chromium.googlesource.com/external/github.com/glfw/glfw",
-        "rev": "b35641f4a3c62aa86a0b3c983d163bc0fe36026d",
-        "hash": "sha256-E1zXIDiw87badrLOZTvV+Wh9NZHu51nb70ZK9vlAlqE="
+        "rev": "043378876a67b092f5d0d3d9748660121a336dd3",
+        "hash": "sha256-4QSD1/uxWfYZPMjShB0h639eqAfuBRXAVfOm6BbZCBs="
      },
      "src/third_party/dawn/third_party/dxc": {
        "url": "https://chromium.googlesource.com/external/github.com/microsoft/DirectXShaderCompiler",
-        "rev": "2888a8764a33693f5a351e0c4ec87f430ccb0f7a",
-        "hash": "sha256-xAe7SdcOeNiqNF6pYwMPMnd9/2yTWUlVdH1aCco/PEo="
+        "rev": "eb67a9085c758516d940e1ce3fed0acfb6518209",
+        "hash": "sha256-z+yIuVweIyLdOiZDRfSppjTRoYq8S93+JNUla4Umot8="
      },
      "src/third_party/dawn/third_party/dxheaders": {
        "url": "https://chromium.googlesource.com/external/github.com/microsoft/DirectX-Headers",
        "rev": "980971e835876dc0cde415e8f9bc646e64667bf7",
        "hash": "sha256-0Miw1Cy/jmOo7bLFBOHuTRDV04cSeyvUEyPkpVsX9DA="
      },
-      "src/third_party/dawn/third_party/khronos/OpenGL-Registry": {
+      "src/third_party/dawn/third_party/directx-headers/src": {
+        "url": "https://chromium.googlesource.com/external/github.com/microsoft/DirectX-Headers",
+        "rev": "980971e835876dc0cde415e8f9bc646e64667bf7",
+        "hash": "sha256-0Miw1Cy/jmOo7bLFBOHuTRDV04cSeyvUEyPkpVsX9DA="
+      },
+      "src/third_party/dawn/third_party/OpenGL-Registry/src": {
        "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/OpenGL-Registry",
        "rev": "5bae8738b23d06968e7c3a41308568120943ae77",
        "hash": "sha256-K3PcRIiD3AmnbiSm5TwaLs4Gu9hxaN8Y91WMKK8pOXE="
      },
-      "src/third_party/dawn/third_party/khronos/EGL-Registry": {
+      "src/third_party/dawn/third_party/EGL-Registry/src": {
        "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/EGL-Registry",
        "rev": "7dea2ed79187cd13f76183c4b9100159b9e3e071",
        "hash": "sha256-Z6DwLfgQ1wsJXz0KKJyVieOatnDmx3cs0qJ6IEgSq1A="
      },
      "src/third_party/dawn/third_party/webgpu-cts": {
        "url": "https://chromium.googlesource.com/external/github.com/gpuweb/cts",
-        "rev": "d213d4b8dba58ca7a0685e30cfaf1d29f4fc5d5b",
-        "hash": "sha256-6YGLG9BMQbF2pjV40su5ddHMqDW8/CEwM3RDEc/t2kM="
+        "rev": "09fdb847d90d0b5bfe57068ce2eb9283cb77fc7f",
+        "hash": "sha256-eTAwnTiAHq8rmbw7u9nAwSuAlS5adStUJKfITlYkcgU="
      },
      "src/third_party/dawn/third_party/webgpu-headers/src": {
        "url": "https://chromium.googlesource.com/external/github.com/webgpu-native/webgpu-headers",
-        "rev": "b2b04dde36a941434c88ccff7a730d7e464d638c",
-        "hash": "sha256-+/qXZNkm26p+becMVcyHNUPyEUCejSV+tyTGFE4ivak="
+        "rev": "7d3186c3dd2c708703524027b46b8703534ab3cc",
+        "hash": "sha256-yE3/mfhqc7YtVNg4f/nrUpuRUGRjOzdwl++vPvd+mvc="
      },
      "src/third_party/highway/src": {
        "url": "https://chromium.googlesource.com/external/github.com/google/highway.git",
@ -1009,13 +1014,13 @@
      },
      "src/third_party/libpfm4/src": {
        "url": "https://chromium.googlesource.com/external/git.code.sf.net/p/perfmon2/libpfm4.git",
-        "rev": "964baf9d35d5f88d8422f96d8a82c672042e7064",
-        "hash": "sha256-awpZ22rovLZWQkX/qog93vL4u2gJ+F3w5IGFNlZ0heQ="
+        "rev": "977a25bb3dfe45f653a6cee71ffaae9a92fc3095",
+        "hash": "sha256-t4LMG38GksMEM5DktyJ0qLUX1biXErQ57MaMtd7hoeo="
      },
      "src/third_party/boringssl/src": {
        "url": "https://boringssl.googlesource.com/boringssl.git",
-        "rev": "27bc28d7f03fb9e3752980dce01de1a529236532",
-        "hash": "sha256-u+yvIPrdb9fWzJXJeIidUQ1MkKUx6sKLs7vdW68QhYc="
+        "rev": "d8be2b4a71155bf82da092ef543176351eeb59ff",
+        "hash": "sha256-fZc95YrREDbf0YcO6zahIjdX6TcRJANcH9MrkLIIIHw="
      },
      "src/third_party/breakpad/breakpad": {
        "url": "https://chromium.googlesource.com/breakpad/breakpad.git",
@ -1029,13 +1034,13 @@
      },
      "src/third_party/catapult": {
        "url": "https://chromium.googlesource.com/catapult.git",
-        "rev": "e0ebf38a01214aba11f31daa1c743782def031d5",
-        "hash": "sha256-njtIcvzo2v9uDuP+AostVAZRTtH2vePsshF4cANHkxo="
+        "rev": "4f1d71f6841d210b3a06ab3ef2e2ed679af0ee56",
+        "hash": "sha256-aHlf8gw3KxbKoyyajP4w586iYybx7HSkcKtLcZIgiDE="
      },
      "src/third_party/catapult/third_party/webpagereplay": {
        "url": "https://chromium.googlesource.com/webpagereplay.git",
-        "rev": "22be07d7809409644d7e292d9495fa8a251d5f29",
-        "hash": "sha256-HR6iEDwmxFaiLi+h3MwsNfBOtBNbrKvmRNgMVog3A0Y="
+        "rev": "be48b5e3387780790ecc7723434b6ea6733bcc33",
+        "hash": "sha256-KcFUlQMltsMm4WlTVMLzZXfrvu67ffkKjmBcruwZye0="
      },
      "src/third_party/ced/src": {
        "url": "https://chromium.googlesource.com/external/github.com/google/compact_enc_det.git",
@ -1059,8 +1064,8 @@
      },
      "src/third_party/cpuinfo/src": {
        "url": "https://chromium.googlesource.com/external/github.com/pytorch/cpuinfo.git",
-        "rev": "7364b490b5f78d58efe23ea76e74210fd6c3c76f",
-        "hash": "sha256-lB6e5zcw5UiwTOf+a+B35apXP5t1bxI6yOMiEeFwIwY="
+        "rev": "7607ca500436b37ad23fb8d18614bec7796b68a7",
+        "hash": "sha256-LnLtCMMRg+DwB7MijBdt/tmCKD/zN5y2oTgXlYw3hTg="
      },
      "src/third_party/crc32c/src": {
        "url": "https://chromium.googlesource.com/external/github.com/google/crc32c.git",
@ -1069,28 +1074,28 @@
      },
      "src/third_party/cros_system_api": {
        "url": "https://chromium.googlesource.com/chromiumos/platform2/system_api.git",
-        "rev": "1fb70b2851b292e48b612482a6d4d1b4c343c862",
-        "hash": "sha256-YBN8ogJn5Yup9GYrsE9UW15KPCuXbhD6hdqXWWCPD20="
+        "rev": "c27a09148de373889e5d2bf616c4e85a68050ae2",
+        "hash": "sha256-a/mAa1+if6B1FHe9crO8PDpc3o8M+CeIuXjXT0lwZOY="
      },
      "src/third_party/crossbench": {
        "url": "https://chromium.googlesource.com/crossbench.git",
-        "rev": "19cee54825bc57215266f5b14a5874bfbbb57543",
-        "hash": "sha256-HVwX8E3/7yw7zUqZrptN1iSBWF4ls0FAzPObPagNYtM="
+        "rev": "c179f7919aade97c5cff64d14b9171736e7aaef9",
+        "hash": "sha256-Hxazf58z9imnGO1aj2NRtsQ+BYrfAuIuZscADpr1NVI="
      },
      "src/third_party/crossbench-web-tests": {
        "url": "https://chromium.googlesource.com/chromium/web-tests.git",
-        "rev": "909ad1733b50f28510c840ebad7b878a5ce07715",
-        "hash": "sha256-RYih9sn4rIBnFW/styZaUl5H0A1eEy3//DypZjY6n0M="
+        "rev": "b19e4e52c33fb8a105c3fc99598b0b9b4bc59752",
+        "hash": "sha256-7vCQw91L2c97dnVdrJ53zL8hi0KZffDJJjk7GaG3b/U="
      },
      "src/third_party/depot_tools": {
        "url": "https://chromium.googlesource.com/chromium/tools/depot_tools.git",
-        "rev": "4ce8ba39a3488397a2d1494f167020f21de502f3",
-        "hash": "sha256-WTzjmLFjh1yDDEvYE7Qfx8aBxMLdATx14+Jprwh8ZgQ="
+        "rev": "41c40cfaec7ee3bf0423c59925d8b23982a601f1",
+        "hash": "sha256-s9uvmYHCJKWnNhztmOPb+OHj/HbGo30PupwT4mHWjnM="
      },
      "src/third_party/devtools-frontend/src": {
        "url": "https://chromium.googlesource.com/devtools/devtools-frontend",
-        "rev": "854a02be78c7ffea104cb523636efa991bef5c5b",
-        "hash": "sha256-CzzUueh2QXX+ExGqh5+JpnDoWF8DiFDff7fWmC01xfg="
+        "rev": "6efd6eb1d85fd67fdcc2385c54fa56c524bec3f7",
+        "hash": "sha256-1pr3+RK519m+wtcacJB3PcDTL+qSHlOn1ctxpoLzTf8="
      },
      "src/third_party/dom_distiller_js/dist": {
        "url": "https://chromium.googlesource.com/chromium/dom-distiller/dist.git",
@ -1104,8 +1109,8 @@
      },
      "src/third_party/eigen3/src": {
        "url": "https://chromium.googlesource.com/external/gitlab.com/libeigen/eigen.git",
-        "rev": "54458cb39d1081d0cfe6b77ed8e085d457a4c921",
-        "hash": "sha256-WXxSe2AY3hSMXz7lHNeFefOHGGkdXoSQLC6FuOa6Exo="
+        "rev": "a3074053a614df7a3896cb4edbcba40222a5f549",
+        "hash": "sha256-9AHpSqemqdwXoMiP3hH1YuEd3+nrudeVGTpInw+8BU4="
      },
      "src/third_party/farmhash/src": {
        "url": "https://chromium.googlesource.com/external/github.com/google/farmhash.git",
@ -1119,13 +1124,13 @@
      },
      "src/third_party/federated_compute/src": {
        "url": "https://chromium.googlesource.com/external/github.com/google-parfait/federated-compute.git",
-        "rev": "271aa00f8aec5bc801f542710efe1b2f0b5f0ef9",
-        "hash": "sha256-6ZATBYkyIdGuhG0Ps2vr0DT9nq1LhW2XCWWAkiZh9Hc="
+        "rev": "eb170f645b270c7979edb863fd2cf8edab2b2fd1",
+        "hash": "sha256-Cp0WQBbqWvPdrKCMQhH4Z6zl6YlIPLjafWZEwdkYWlc="
      },
      "src/third_party/ffmpeg": {
        "url": "https://chromium.googlesource.com/chromium/third_party/ffmpeg.git",
-        "rev": "946d97db8d906277085e361892b7efda5152e2f1",
-        "hash": "sha256-UxrmVqfX6TvFy1yxWXIQbd3ABD3jEAtDesgfnbJGg1E="
+        "rev": "b5e18fb9da84e26ceef30d4e4886696bf59337c0",
+        "hash": "sha256-JHAicFKBvtkwmZPRBKYPT6JVqYqF8hyXxU0H7kfgCBs="
      },
      "src/third_party/flac": {
        "url": "https://chromium.googlesource.com/chromium/deps/flac.git",
@ -1154,18 +1159,18 @@
      },
      "src/third_party/freetype/src": {
        "url": "https://chromium.googlesource.com/chromium/src/third_party/freetype2.git",
-        "rev": "45556a19aab9502b91d6f30931e0cb5256f683f8",
-        "hash": "sha256-eMt2orPeG81o42O/HU+4B5b/G62TYAVIEeWwOmiML14="
+        "rev": "99b479dc34728936b006679a31e12b8cf432fc55",
+        "hash": "sha256-H5RzBFYWIp/QYKyeBM2wfuX7FvXHPbhCAp7qne5Zvhw="
      },
      "src/third_party/fxdiv/src": {
        "url": "https://chromium.googlesource.com/external/github.com/Maratyszcza/FXdiv.git",
        "rev": "63058eff77e11aa15bf531df5dd34395ec3017c8",
        "hash": "sha256-LjX5kivfHbqCIA5pF9qUvswG1gjOFo3CMpX0VR+Cn38="
      },
-      "src/third_party/harfbuzz-ng/src": {
+      "src/third_party/harfbuzz/src": {
        "url": "https://chromium.googlesource.com/external/github.com/harfbuzz/harfbuzz.git",
-        "rev": "5d4e96ad8d00fc871ffa17707b2ca08fa850e7d6",
-        "hash": "sha256-9ef1P2JVJc7ZiP7TObFOxJbccCLsEgjhj+Z/ooEAGiI="
+        "rev": "4fc96139259ebc35f40118e0382ac8037d928e5c",
+        "hash": "sha256-/RT2OPWFiVwFqmNS4o+gE0JrcVO1cQDkCkgrSEe7BzE="
      },
      "src/third_party/ink/src": {
        "url": "https://chromium.googlesource.com/external/github.com/google/ink.git",
@ -1174,13 +1179,13 @@
      },
      "src/third_party/ink_stroke_modeler/src": {
        "url": "https://chromium.googlesource.com/external/github.com/google/ink-stroke-modeler.git",
-        "rev": "3fa5129ed1ae6f8b2ec4e9b60fa5d08cc81e2d78",
-        "hash": "sha256-/TBxFsmLH1h3kfeE90LhR0RWJ3NrCTiLKklcaPbean8="
+        "rev": "da42d439389c90ec7574f0381ec53e7f5be0c2eb",
+        "hash": "sha256-W5HgVe0v9O/EuhpKMHp83PLq4p6cuBul3QUGLYdF6rY="
      },
      "src/third_party/instrumented_libs": {
        "url": "https://chromium.googlesource.com/chromium/third_party/instrumented_libraries.git",
-        "rev": "69015643b3f68dbd438c010439c59adc52cac808",
-        "hash": "sha256-8kokdsnn5jD9KgM/6g0NuITBbKkGXWEM4BMr1nCrfdU="
+        "rev": "e8cb570a9a2ee9128e2214c73417ad2a3c47780b",
+        "hash": "sha256-5cb9qhSEzb941pF5HH0Br+x9wEH7MiGwQttvErb2mZo="
      },
      "src/third_party/emoji-segmenter/src": {
        "url": "https://chromium.googlesource.com/external/github.com/google/emoji-segmenter.git",
@ -1214,8 +1219,8 @@
      },
      "src/third_party/icu": {
        "url": "https://chromium.googlesource.com/chromium/deps/icu.git",
-        "rev": "ee5f27adc28bd3f15b2c293f726d14d2e336cbd5",
-        "hash": "sha256-UQWSAekvYc1bTEAEQTPdeB406Uqb0mptpnGRZSaLewo="
+        "rev": "ff7995a708a10ab44db101358083c7f74752da9f",
+        "hash": "sha256-yQ55MGzqkVkp/arTlmKqySBvQFtaPaBk9UUAFE0imhE="
      },
      "src/third_party/nlohmann_json/src": {
        "url": "https://chromium.googlesource.com/external/github.com/nlohmann/json.git",
@ -1229,8 +1234,8 @@
      },
      "src/third_party/leveldatabase/src": {
        "url": "https://chromium.googlesource.com/external/leveldb.git",
-        "rev": "4ee78d7ea98330f7d7599c42576ca99e3c6ff9c5",
-        "hash": "sha256-ANtMVRZmW6iOjDVn2y15ak2fTagFTTaz1Se6flUHL8w="
+        "rev": "7ee830d02b623e8ffe0b95d59a74db1e58da04c5",
+        "hash": "sha256-a1fcVI9Vsm1qE17Fnx5UxwOy4ZFMMJ0OKwNs/gZHYQI="
      },
      "src/third_party/libFuzzer/src": {
        "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/compiler-rt/lib/fuzzer.git",
@ -1239,8 +1244,8 @@
      },
      "src/third_party/fuzztest/src": {
        "url": "https://chromium.googlesource.com/external/github.com/google/fuzztest.git",
-        "rev": "1f7726d61f7afa9aca1198a9395ede472ed70366",
-        "hash": "sha256-RhJ676e6Kr/muR0ZCfZOAcs3kfoK7CjG2cwOpYG/JCY="
+        "rev": "800c545cf9d6e9c01328a1974f93a7e6564a74fd",
+        "hash": "sha256-Pvz+CWTBcWE0N0yfNGZhXDgUrGeIaCNfEjP1jYmF6G0="
      },
      "src/third_party/domato/src": {
        "url": "https://chromium.googlesource.com/external/github.com/googleprojectzero/domato.git",
@ -1254,13 +1259,13 @@
      },
      "src/third_party/libaom/source/libaom": {
        "url": "https://aomedia.googlesource.com/aom.git",
-        "rev": "ab9876a5983227865ee26e91caac87c6b8750e27",
-        "hash": "sha256-V40GL7fKj1qratP0KcrhedEPDIsg0XVb3ha5nroM0ws="
+        "rev": "b63f30b6d30028a3d7d9c5223def8f3ad97dcc4c",
+        "hash": "sha256-LaBEcVcSB8WB9ZNRgPSiGaKdQL5f3wll2sPb9OhN5SE="
      },
      "src/third_party/crabbyavif/src": {
        "url": "https://chromium.googlesource.com/external/github.com/webmproject/CrabbyAvif.git",
-        "rev": "c05daf3e2e6d83f2a359ab97094ce042944020a9",
-        "hash": "sha256-vVKAgvPdba0Lt3BUStOQsILlhiHNJeIv1jS9691+a80="
+        "rev": "7466a44ac80893803d4a7168b98dc6cd02d1fe2d",
+        "hash": "sha256-x1MRNtGLmwlRNenoQKz2Bgm3J5eHlNiJZtzhT9lttmk="
      },
      "src/third_party/nearby/src": {
        "url": "https://chromium.googlesource.com/external/github.com/google/nearby-connections.git",
@ -1314,8 +1319,8 @@
      },
      "src/third_party/cros-components/src": {
        "url": "https://chromium.googlesource.com/external/google3/cros_components.git",
-        "rev": "ddb611c60142c72be3719e753a42fb434b6f2458",
-        "hash": "sha256-M/b7PKEu+mFxsEeedJeppkwl8aZnX/932zqWlrCx8Y4="
+        "rev": "fb512780dcc5ba4b5be9e8a3118919002077c760",
+        "hash": "sha256-7wx73HZ6aqXQvLxwX6XnJAPefi/t47gIhvDH3FRT1j4="
      },
      "src/third_party/libdrm/src": {
        "url": "https://chromium.googlesource.com/chromiumos/third_party/libdrm.git",
@ -1324,8 +1329,8 @@
      },
      "src/third_party/expat/src": {
        "url": "https://chromium.googlesource.com/external/github.com/libexpat/libexpat.git",
-        "rev": "69d6c054c1bd5258c2a13405a7f5628c72c177c2",
-        "hash": "sha256-qe8O7otL6YcDDBx2DS/+c5mWIS8Rf8RQXVtLFMIAeyk="
+        "rev": "f31adfd584b7f6c50bbf4d22eb928538ffc9145a",
+        "hash": "sha256-tLz4RejYQ/kFXhsWTduuGcinfUkqxYKPCpsou+WlvBc="
      },
      "src/third_party/libipp/libipp": {
        "url": "https://chromium.googlesource.com/chromiumos/platform2/libipp.git",
@ -1369,13 +1374,13 @@
      },
      "src/third_party/libvpx/source/libvpx": {
        "url": "https://chromium.googlesource.com/webm/libvpx.git",
-        "rev": "aec2a6f1cd6e3d9e8cf5d9682fcb8a442799bd22",
-        "hash": "sha256-PNreh1VisA46I0WZqq8wZRCjbQRiVMxbL5Gl2Bfzo3M="
+        "rev": "47ac1ec7f3de7d7cb3d070844c427c8f1fa9d6fc",
+        "hash": "sha256-RyYnkLYafiS6kQKeOmzohtxFRXudDzgEmQkG+qKHozc="
      },
      "src/third_party/libwebm/source": {
        "url": "https://chromium.googlesource.com/webm/libwebm.git",
-        "rev": "f2a982d748b80586ae53b89a2e6ebbc305848b8c",
-        "hash": "sha256-SxDGt7nPVkSxwRF/lMmcch1h+C2Dyh6GZUXoZjnXWb4="
+        "rev": "b7a1e4767fbb02ad467f45ba378e858e897028da",
+        "hash": "sha256-Lzfs15Us8MDDQYvLRVf6xKg9A76aXPnTukx/A8Mf7rw="
      },
      "src/third_party/libwebp/src": {
        "url": "https://chromium.googlesource.com/webm/libwebp.git",
@ -1404,8 +1409,8 @@
      },
      "src/third_party/nasm": {
        "url": "https://chromium.googlesource.com/chromium/deps/nasm.git",
-        "rev": "af5eeeb054bebadfbb79c7bcd100a95e2ad4525f",
-        "hash": "sha256-vH3OUzfLZbaPY4DMAvSW0jKYRJmOa7aE8EfIJtZ1/Xs="
+        "rev": "45252858722aad12e545819b2d0f370eb865431b",
+        "hash": "sha256-0KsHYi76IaVNwk0dBhem2AnUXd9PpeS+jUsY+zPmeJ8="
      },
      "src/third_party/neon_2_sse/src": {
        "url": "https://chromium.googlesource.com/external/github.com/intel/ARM_NEON_2_x86_SSE.git",
@ -1419,8 +1424,8 @@
      },
      "src/third_party/openscreen/src": {
        "url": "https://chromium.googlesource.com/openscreen",
-        "rev": "571620ad60afc9f317d77605c65335f5412aada2",
-        "hash": "sha256-ktR3EpmkjueEmEip2oUTcSclVkUlPi/7+qmhElG+Bzs="
+        "rev": "448a19d1f24e0f8ce85ad0c1c6a50cf370ae69d7",
+        "hash": "sha256-hRDFnoqAH4HoWZ3oTWlzNge2nwlxpUC/GEq0MQVzBw8="
      },
      "src/third_party/openscreen/src/buildtools": {
        "url": "https://chromium.googlesource.com/chromium/src/buildtools",
@ -1434,13 +1439,13 @@
      },
      "src/third_party/pdfium": {
        "url": "https://pdfium.googlesource.com/pdfium.git",
-        "rev": "e5bafd3be58c26673576fd5bb5cbf413b485de5b",
-        "hash": "sha256-umtG2n6kWYD0hT44GpmnwUVztkZ0RtQDV0h0+4CTC9w="
+        "rev": "a78c62d93a8f514ea2cd98a70bd1d21226be9d93",
+        "hash": "sha256-qd3Oa/JFzoI5hKDY2/OQAzdr2z9srUj0H6oKz0R516U="
      },
      "src/third_party/perfetto": {
        "url": "https://chromium.googlesource.com/external/github.com/google/perfetto.git",
-        "rev": "728eb5626a3bc701d044dd16d9cd289360ff47c3",
-        "hash": "sha256-LeGGkzSMfVXuioVJmRi/TjMYgG/0YrK7PckBJTejSHU="
+        "rev": "46432bb2a7a60e10fcee516f1692e6846d098a8d",
+        "hash": "sha256-jVih4xWota4SZQi4yEtaIP+4qgD03OsELt2aaulIXik="
      },
      "src/third_party/protobuf-javascript/src": {
        "url": "https://chromium.googlesource.com/external/github.com/protocolbuffers/protobuf-javascript",
@ -1454,8 +1459,8 @@
      },
      "src/third_party/pyelftools": {
        "url": "https://chromium.googlesource.com/chromiumos/third_party/pyelftools.git",
-        "rev": "19b3e610c86fcadb837d252c794cb5e8008826ae",
-        "hash": "sha256-I/7p3IEvfP/gkes4kx18PvWwhAKilQKb67GXoW4zFB4="
+        "rev": "8047437615d66d3267ac0134834b80e70639d572",
+        "hash": "sha256-rEnt08K90/Psfa+SQgTUG3YGrhp4/udXG9VKIwPM7pk="
      },
      "src/third_party/quic_trace/src": {
        "url": "https://chromium.googlesource.com/external/github.com/google/quic-trace.git",
@ -1484,8 +1489,8 @@
      },
      "src/third_party/skia": {
        "url": "https://skia.googlesource.com/skia.git",
-        "rev": "6e0fbe154ccaf018b2dd1f0e42eec285e7d79d00",
-        "hash": "sha256-oqfNOSQB+5sbAnw4tPBXn22rk6Ai5b2aZNLJUyM181k="
+        "rev": "afe8b760ada5128164f9826866b4381a3463df41",
+        "hash": "sha256-HsKHffZWTls362kjokxzdhaxb/xJD1g70VHGk9l6GVM="
      },
      "src/third_party/smhasher/src": {
        "url": "https://chromium.googlesource.com/external/smhasher.git",
@ -1499,13 +1504,13 @@
      },
      "src/third_party/sqlite/src": {
        "url": "https://chromium.googlesource.com/chromium/deps/sqlite.git",
-        "rev": "727f7c8991f7b622a8b5c833cff99871a8c2cd8e",
-        "hash": "sha256-L42hkqcsuyMkNUeornIul7AYNgachkYpfNFE8H/VeVc="
+        "rev": "508ab21dc25702ed6690c4dd77da209a6bcd1239",
+        "hash": "sha256-SfvLfBKdPjFvZ7CzUeFMcyoHdCzQgNRQwZyzb6MRtJg="
      },
      "src/third_party/swiftshader": {
        "url": "https://swiftshader.googlesource.com/SwiftShader.git",
-        "rev": "313545f85af72f954820e54f4110cda591a6cf7b",
-        "hash": "sha256-EGgC5nK68Wk0b466K9yvLlGMxBd/CeI+KTgyoE+x6DY="
+        "rev": "89556131bf9d48af3c5c9fbb9a3322e706da89a3",
+        "hash": "sha256-h0utcwCnzwhFufggkBNeA674x2Kqwu4sz3jQ/9eoQv0="
      },
      "src/third_party/text-fragments-polyfill/src": {
        "url": "https://chromium.googlesource.com/external/github.com/GoogleChromeLabs/text-fragments-polyfill.git",
@ -1514,23 +1519,23 @@
      },
      "src/third_party/tflite/src": {
        "url": "https://chromium.googlesource.com/external/github.com/tensorflow/tensorflow.git",
-        "rev": "b476481b77f6e939e813ac93df22a4a6e7a3dd57",
-        "hash": "sha256-oKLFjed5sbYjEX5kddkAEdhkVOwFf5ddEUlOS55zLWE="
+        "rev": "de8d7f65b6eb670e4dad0225d0d6f99bebaab559",
+        "hash": "sha256-r2b+/VBffxsh1sRM2xcFiBx9K6GD6FsaQXpfFMBFUag="
      },
      "src/third_party/litert/src": {
        "url": "https://chromium.googlesource.com/external/github.com/google-ai-edge/LiteRT.git",
-        "rev": "82bf3bef8a04a416bcb9d1cca5bdd51a6b3ab4ba",
-        "hash": "sha256-uMBuoGQIgRhmc8KJqLUnf13XK9tveuS0/OzzwKHKNUw="
+        "rev": "588075c77c6895cce6397d41d2890b1aa0a14372",
+        "hash": "sha256-rcEPZNSV0DiDrmoBCtJ07wFzzpmpM93jG4jYaEdNWvI="
      },
      "src/third_party/vulkan-deps": {
        "url": "https://chromium.googlesource.com/vulkan-deps",
-        "rev": "4a9f2cec3d5e7cb4810cf84716f597aff768ffa4",
-        "hash": "sha256-PyBxtzesZR/5jrWt96DxK7QwRoG8qhzWzbiE1fqdqkI="
+        "rev": "0ced1107c62836f439f684a5696c4bd69e09fce3",
+        "hash": "sha256-VOyN618wzyyO2Wh18gCnw+FCr/NbegX3A/54MClyhwc="
      },
      "src/third_party/glslang/src": {
        "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/glslang",
-        "rev": "b11b03839c940685b0201026bd2a4ffef1d5a4b8",
-        "hash": "sha256-FjUqETWBiI91hq5wGomPmCeW7K4k9kn5r74pUP0QFNo="
+        "rev": "715c8500e7cd67f2eba9e60e98852a1ed49d2f15",
+        "hash": "sha256-vSbMdTjlRVvYLi5ZvTVmfe76oAQ4AhqyD+ohvkvIYIs="
      },
      "src/third_party/spirv-cross/src": {
        "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/SPIRV-Cross",
@ -1539,38 +1544,38 @@
      },
      "src/third_party/spirv-headers/src": {
        "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/SPIRV-Headers",
-        "rev": "f88a2d766840fc825af1fc065977953ba1fa4a91",
-        "hash": "sha256-VhcGQ+Tr9sH0ZEIk0oJsXh8MvCo2qpA2W3i8YVCwKaE="
+        "rev": "6dd7ba990830f7c15ac1345ff3b43ef6ffdad216",
+        "hash": "sha256-UKBVs2s05hP+paPq1dZFaUEQQ9Kx9acHxYUyJVx22eY="
      },
      "src/third_party/spirv-tools/src": {
        "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/SPIRV-Tools",
-        "rev": "7d8d9e58c384949f1615c069d4c9346bf51b9738",
-        "hash": "sha256-AxS7vHw3RoXZLayWEDKBU7H0M1BZ9RMVdIsD/4rYap8="
+        "rev": "2d14d2e76aa7de72404b17078eda15c20a6a0389",
+        "hash": "sha256-8Xtzq8WOdFEw+uEJqMW39LLHt2m165K9OJsIFZuifoM="
      },
      "src/third_party/vulkan-headers/src": {
        "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Headers",
-        "rev": "74d8a6cb930c68ef617b202c3ff3c59d919e086b",
-        "hash": "sha256-bZKNFiZMVYDxa6RKb1c/GxIR+eEFQAyYNaEptzQW5TE="
+        "rev": "afe9eb980aa928a66d1c9c06f38c55dd59868720",
+        "hash": "sha256-/yolWlC7ruRiJ0gSdCoSlqL9+j2uJAh+o+H0OG37pq4="
      },
      "src/third_party/vulkan-loader/src": {
        "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Loader",
-        "rev": "363f465abadab0a8dcfc5c85d2c691e9b0b788d6",
-        "hash": "sha256-Zk2QyKu19g52vzGpNq5Qm+mlEgqk4jCFn/861eK8+64="
+        "rev": "df84d2be47457a8dfd7eb66f8c2b031683bd1ba5",
+        "hash": "sha256-8ParcURRRU3eS9Oej/vHTwOwvYy3HsVJsKh2wQLKUgM="
      },
      "src/third_party/vulkan-tools/src": {
        "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Tools",
-        "rev": "59f963ce1b1d16cc92137a241a0fe98d637d21f4",
-        "hash": "sha256-Hh0N4N4XN7p7PBKk2uCU5g9TO9vmxJbomC1Gvf5oDZc="
+        "rev": "90bf5bc4fd8bea0d300f6564af256a51a34124b8",
+        "hash": "sha256-tmTD/waVX/duaKXvj0FNUS+ncL1agM73kK7pEfHEsSA="
      },
      "src/third_party/vulkan-utility-libraries/src": {
        "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Utility-Libraries",
-        "rev": "20fb10eb1ec08ccd5cacec32b7df1b0e99e48a0c",
-        "hash": "sha256-4XsQN94JsQXFGwJKp3W2gdTCCxUZrpCKiRVXzxL+Qs0="
+        "rev": "48b1fd1a65e436bae806cb6180c9338846b9de97",
+        "hash": "sha256-B3GXmwJEvnGcER5DJt0FGrwqNi3t8iV6VgX8uOrExlU="
      },
      "src/third_party/vulkan-validation-layers/src": {
        "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-ValidationLayers",
-        "rev": "20948525099c0ea030ec5b149c809e48010be4ed",
-        "hash": "sha256-H05Ms2a770ApiCz5ERiIm8g893TJG9gRRuM9Qr4bj60="
+        "rev": "ac146eef210b6f52b842111c5d3419ab32a7293f",
+        "hash": "sha256-GqjVHxtda1a47+9G+nqh4qNMJmQaUdZNMUGQ8kAIIkk="
      },
      "src/third_party/vulkan_memory_allocator": {
        "url": "https://chromium.googlesource.com/external/github.com/GPUOpen-LibrariesAndSDKs/VulkanMemoryAllocator.git",
@ -1604,23 +1609,23 @@
      },
      "src/third_party/webgl/src": {
        "url": "https://chromium.googlesource.com/external/khronosgroup/webgl.git",
-        "rev": "8fc2a0dff53abfc0cf2c140d8420759b2036cc54",
-        "hash": "sha256-cU7kfmxgaem6rPHGW+VwjxfKe7c0u1tCc98MQjsp5l8="
+        "rev": "216b10fafd3f6a900c715a8c758a4c7f9883b030",
+        "hash": "sha256-Aax2hr/9Zq6Avk+TMU1OMBLGshUL6hyRTX6eoOQesqM="
      },
      "src/third_party/webgpu-cts/src": {
        "url": "https://chromium.googlesource.com/external/github.com/gpuweb/cts.git",
-        "rev": "54441b8d176b12a5e2b01b8db78191ace56d7f34",
-        "hash": "sha256-gGvvKMTUJGm4ZwM7C1xTY1DKskCmlrCpSl3HLgVZqoY="
+        "rev": "09fdb847d90d0b5bfe57068ce2eb9283cb77fc7f",
+        "hash": "sha256-eTAwnTiAHq8rmbw7u9nAwSuAlS5adStUJKfITlYkcgU="
      },
      "src/third_party/webpagereplay": {
        "url": "https://chromium.googlesource.com/webpagereplay.git",
-        "rev": "22be07d7809409644d7e292d9495fa8a251d5f29",
-        "hash": "sha256-HR6iEDwmxFaiLi+h3MwsNfBOtBNbrKvmRNgMVog3A0Y="
+        "rev": "be48b5e3387780790ecc7723434b6ea6733bcc33",
+        "hash": "sha256-KcFUlQMltsMm4WlTVMLzZXfrvu67ffkKjmBcruwZye0="
      },
      "src/third_party/webrtc": {
        "url": "https://webrtc.googlesource.com/src.git",
-        "rev": "28452dff1bf86fec881a47949d4dedd4a2fe1f09",
-        "hash": "sha256-KBz94jvdVgxWuTuSoeHKNdY7wEJDGqG3xVsSVB3ubRQ="
+        "rev": "9600e77d854090669817d22aa2fc941ee92aaacd",
+        "hash": "sha256-jTJv53qt971Va5q6MaULysYiChBVmsFYxG9fzkcE0ak="
      },
      "src/third_party/wuffs/src": {
        "url": "https://skia.googlesource.com/external/github.com/google/wuffs-mirror-release-c.git",
@ -1632,25 +1637,20 @@
        "rev": "b65be9e699847c975440108a42f05412cc7fddac",
        "hash": "sha256-PySen9syu0OshtlHAZw666FeSQXdnsV8nlW9RmxgapM="
      },
-      "src/third_party/xdg-utils": {
-        "url": "https://chromium.googlesource.com/chromium/deps/xdg-utils.git",
-        "rev": "cb54d9db2e535ee4ef13cc91b65a1e2741a94a44",
-        "hash": "sha256-WuQ9uDq+QD17Y20ACFGres4nbkeOiTE2y+tY1avAT5U="
-      },
      "src/third_party/xnnpack/src": {
        "url": "https://chromium.googlesource.com/external/github.com/google/XNNPACK.git",
-        "rev": "abd8e60edf09db5f5ba8e7fa2f1fcab0ae0807e1",
-        "hash": "sha256-VdrA2UwQ7/kHbnlIXBmga3ZjAqWaxCDQcDAssbLrh/M="
+        "rev": "1812bbe2928a32f26c5e48466712ba6460cf290c",
+        "hash": "sha256-xal21wjgeql3MjQXw6F1ezcRsnhVKod5jv0nYWroJ1o="
      },
      "src/third_party/zstd/src": {
        "url": "https://chromium.googlesource.com/external/github.com/facebook/zstd.git",
-        "rev": "1168da0e567960d50cba1b58c9b0ba047ece4733",
-        "hash": "sha256-T2CwRpL/XT/OsBrRfxC8kNIm43U4qPMBju8Ug13Qebo="
+        "rev": "3ae099b48dfcfe02b1b3ba81ab85457f8a922e9f",
+        "hash": "sha256-futF0sM6z9HAl6AMJwUULBRByN92FTBjRIzYb2vBFGg="
      },
      "src/v8": {
        "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "c152c31c55cd54fd239772532a86c802d95b4617",
-        "hash": "sha256-7qEPh9l94LqyaA9qW0ZfFmmFyMNTjTJaeunLgDhtFuM="
+        "rev": "ddc9a95905de5268332a8f0216dc2bc67d26e829",
+        "hash": "sha256-x2FGL3J+JaWO1m6jBrcayR7Vlz90fYEAuufm4PULYyM="
      }
    }
  }
--- a/pkgs/applications/networking/browsers/chromium/ungoogled-flags.toml
+++ b/pkgs/applications/networking/browsers/chromium/ungoogled-flags.toml
@ -1,4 +1,3 @@
-build_with_tflite_lib=false
 chrome_pgo_phase=0
 clang_use_chrome_plugins=false
 disable_fieldtrial_testing_config=true
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@ -328,13 +328,13 @@
    "vendorHash": "sha256-fP6brpY/wRI1Yjgapzi+FfOci65gxWeOZulXbGdilrE="
  },
  "dnsimple_dnsimple": {
-    "hash": "sha256-pbc7jLhIm+ogcpCBhi4CVsr2qM5vDzH0QuP3+cEVYLw=",
+    "hash": "sha256-j3O1gztyDCiq0Rchcx1lYktY2EhaNaa3t1yL+lH7IAg=",
    "homepage": "https://registry.terraform.io/providers/dnsimple/dnsimple",
    "owner": "dnsimple",
    "repo": "terraform-provider-dnsimple",
-    "rev": "v2.0.1",
+    "rev": "v2.1.1",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-DRMbcAR+DDrxrg1jNgnoWUg+OjlKm7wkqgIN6Hhkp3U="
+    "vendorHash": "sha256-1CpswocnTe6aj4TP7fMGy6mv0d/yX8FcYAKkAW5k7kk="
  },
  "dnsmadeeasy_dme": {
    "hash": "sha256-JH9YcM9Fvd1x0BJpLUZCm6a9hZZxySrkFVLP89FO3fU=",
@ -715,22 +715,22 @@
    "vendorHash": "sha256-fWnf2l9a7bzXtofA+Aow6F17K+slpMpXEYZPuqDNwfg="
  },
  "huaweicloud_huaweicloud": {
-    "hash": "sha256-Eg811AwJwuHZ/270+TNh6JskCGRUt0ikk6yShjtVtcU=",
+    "hash": "sha256-CtqPtXccE6I+yDj/7XbjbACMwCGMv+pSEIa5DVh+AGo=",
    "homepage": "https://registry.terraform.io/providers/huaweicloud/huaweicloud",
    "owner": "huaweicloud",
    "repo": "terraform-provider-huaweicloud",
-    "rev": "v1.90.0",
+    "rev": "v1.91.0",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
  "ibm-cloud_ibm": {
-    "hash": "sha256-FeH8XVy+xTal2bbylEfvVqqqoURvuNKNzcK1fv+Ng50=",
+    "hash": "sha256-sd7/8xjsNwP5ALFDMCbKy6L7zke2wxK2gylSbqpeD9o=",
    "homepage": "https://registry.terraform.io/providers/IBM-Cloud/ibm",
    "owner": "IBM-Cloud",
    "repo": "terraform-provider-ibm",
-    "rev": "v2.0.2",
+    "rev": "v2.1.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-HDZiRZoq3/2E8aK/whBBeLVPcWYXYZqTNPa4DvNG2aQ="
+    "vendorHash": "sha256-euaLEnXZ9xmee5nTymFqPeUU4cewE+Ij6ZKGksNy25o="
  },
  "icinga_icinga2": {
    "hash": "sha256-Y/Oq0aTzP+oSKPhHiHY9Leal4HJJm7TNDpcdqkUsCmk=",
--- a/pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/unwrapped.nix
+++ b/pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/unwrapped.nix
@ -45,14 +45,14 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "telegram-desktop-unwrapped";
-  version = "6.7.6";
+  version = "6.7.8";

  src = fetchFromGitHub {
    owner = "telegramdesktop";
    repo = "tdesktop";
    rev = "v${finalAttrs.version}";
    fetchSubmodules = true;
-    hash = "sha256-TGI1SLtzjjDaodQc+JIVRRiwCy9PCO3MuPfv2DpDFxo=";
+    hash = "sha256-lcIkkr9i/zVRNNQ3qi6O6xIgtpQgkVWOGIttHqmAQv8=";
  };

  nativeBuildInputs = [
--- a/pkgs/build-support/setup-hooks/install-fonts.sh
+++ b/pkgs/build-support/setup-hooks/install-fonts.sh
@ -52,6 +52,9 @@ installFonts() {
  if [ -n "${webfont-}" ]; then
    installFont 'woff' "$webfont/share/fonts/woff"
    installFont 'woff2' "$webfont/share/fonts/woff2"
+  elif [[ "${dontInstallWebfonts-}" != 1 && -n "$(find . \( -iname "*.woff" -o -iname "*.woff2" \) -print)" ]]; then
+    nixErrorLog "Consider adding \"webfont\" to outputs to install woff/woff2 files."
+    nixErrorLog "Alternatively, set dontInstallWebfonts to silence this."
+    exit 1
  fi
-
 }
--- a/pkgs/by-name/al/aliyun-cli/package.nix
+++ b/pkgs/by-name/al/aliyun-cli/package.nix
@ -8,13 +8,13 @@

 buildGoModule (finalAttrs: {
  pname = "aliyun-cli";
-  version = "3.3.11";
+  version = "3.3.12";

  src = fetchFromGitHub {
    owner = "aliyun";
    repo = "aliyun-cli";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-jksC63DFSbZcBjQvV7BBMSMbPMeSqUQMWN9HcIcFZSU=";
+    hash = "sha256-U6vEQwlj0jNYnkZyZmmelEf/WJIHmaffJ+Y1NRU0IiI=";
    fetchSubmodules = true;
  };

--- a/pkgs/by-name/an/andcli/package.nix
+++ b/pkgs/by-name/an/andcli/package.nix
@ -4,6 +4,7 @@
  buildGoModule,
  versionCheckHook,
  writableTmpDirAsHomeHook,
+  nix-update-script,
 }:

 buildGoModule (finalAttrs: {
@ -35,6 +36,8 @@ buildGoModule (finalAttrs: {
  versionCheckKeepEnvironment = [ "HOME" ];
  doInstallCheck = true;

+  passthru.updateScript = nix-update-script { };
+
  meta = {
    homepage = "https://github.com/tjblackheart/andcli";
    description = "2FA TUI for your shell";
--- a/pkgs/by-name/as/astartectl/package.nix
+++ b/pkgs/by-name/as/astartectl/package.nix
@ -7,16 +7,16 @@
 }:
 buildGoModule (finalAttrs: {
  pname = "astartectl";
-  version = "24.5.3";
+  version = "26.5.0";

  src = fetchFromGitHub {
    owner = "astarte-platform";
    repo = "astartectl";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-wziSP4mbUnAAPzmkl1qXbT95Ku/M9rMb63s/5ndCXrk=";
+    hash = "sha256-mRPy5nnj/1T3tnii+Z9QmL6kZba2Wom/jGncp+ZynFg=";
  };

-  vendorHash = "sha256-TZ0ua64DPVlGBrr4ZCexBoyuwvJzRr1t37BTJ2bLuQI=";
+  vendorHash = "sha256-Yz6Ph6TqyWlEXnkW/g1DDqxaqTM9DJrnO+QJgzqjVhw=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/by-name/as/astro-language-server/package.nix
+++ b/pkgs/by-name/as/astro-language-server/package.nix
@ -38,8 +38,8 @@ stdenv.mkDerivation (finalAttrs: {
      prePnpmInstall
      ;
    pnpm = pnpm_10;
-    fetcherVersion = 2;
-    hash = "sha256-DFoIq5+cKqnmWLJ6CHhfdQEAGjvpu72qb1CSWaExODI=";
+    fetcherVersion = 3;
+    hash = "sha256-1kdXt0Wc/ON//hwBYozRSMAyKQqEfSMfOI7XJyd9MBc=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/interpreters/babashka/completions/bb.bash
+++ b/pkgs/development/interpreters/babashka/completions/bb.bash
--- a/pkgs/development/interpreters/babashka/completions/bb.fish
+++ b/pkgs/development/interpreters/babashka/completions/bb.fish
--- a/pkgs/development/interpreters/babashka/completions/bb.zsh
+++ b/pkgs/development/interpreters/babashka/completions/bb.zsh
--- a/pkgs/development/interpreters/babashka/default.nix
+++ b/pkgs/development/interpreters/babashka/default.nix
@ -8,11 +8,11 @@

 buildGraalvmNativeImage (finalAttrs: {
  pname = "babashka-unwrapped";
-  version = "1.12.217";
+  version = "1.12.218";

  src = fetchurl {
    url = "https://github.com/babashka/babashka/releases/download/v${finalAttrs.version}/babashka-${finalAttrs.version}-standalone.jar";
-    sha256 = "sha256-5Nnzx2chre+h0SnM5spwiR9r4gjlyfc2FbgYa0spM34=";
+    sha256 = "sha256-CEApb2noPYfRYRDTo1RBLOZELvEuxGO4HW1CB//bky8=";
  };

  nativeBuildInputs = [ installShellFiles ];
@ -69,7 +69,7 @@ buildGraalvmNativeImage (finalAttrs: {
      | ${lib.getExe finalAttrs.finalPackage} -I -o -e "(or (some->> *input* (filter #(= '(def version) (take 2 %))) first last last last) (throw (ex-info \"Couldn't find expected '(def version ...)' form in 'borkdude/deps.clj'.\" {})))")

    update-source-version babashka.clojure-tools "$clojure_tools_version" \
-      --file="pkgs/development/interpreters/babashka/clojure-tools.nix"
+      --file="pkgs/by-name/ba/babashka/clojure-tools.nix"
  '';

  meta = {
--- a/pkgs/development/interpreters/babashka/clojure-tools.nix
+++ b/pkgs/development/interpreters/babashka/clojure-tools.nix
@ -1,16 +1,16 @@
 # This file tracks the Clojure tools version required by babashka.
 # See https://github.com/borkdude/deps.clj#deps_clj_tools_version for background.
-# The `updateScript` provided in default.nix takes care of keeping it in sync, as well.
+# The `updateScript` provided in babashka-unwrapped takes care of keeping it in sync, as well.
 {
  clojure,
  fetchurl,
 }:
 clojure.overrideAttrs (previousAttrs: {
  pname = "babashka-clojure-tools";
-  version = "1.12.4.1597";
+  version = "1.12.4.1618";

  src = fetchurl {
    url = previousAttrs.src.url;
-    hash = "sha256-DgEvXVExaexDTLoonh/fVS5nHjgekL6BlFYLM9X6wkM=";
+    hash = "sha256-E3adptY6mN6yAkN4rhpk5O4hGsEDU0DfynppRMQc3iE=";
  };
 })
--- a/pkgs/development/interpreters/babashka/wrapped.nix
+++ b/pkgs/development/interpreters/babashka/wrapped.nix
--- a/pkgs/by-name/bc/bcachefs-tools/package.nix
+++ b/pkgs/by-name/bc/bcachefs-tools/package.nix
@ -29,18 +29,18 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "bcachefs-tools";
-  version = "1.38.0";
+  version = "1.38.2";

  src = fetchFromGitHub {
    owner = "koverstreet";
    repo = "bcachefs-tools";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-ARSrlQozhefNV4K75aiaKxgfKIkE9mPrDksDhuvXfA4=";
+    hash = "sha256-zUrvqds6gkqZLV5BbwZDf+IsClNn8CwiC4VdAUO2CWY=";
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
    inherit (finalAttrs) src;
-    hash = "sha256-dtGRtJxsVvltjPdMl0KZMaAqnNppwGCtL/XnYbc1PyQ=";
+    hash = "sha256-vk5nI8CPYp9ux984yiFWRdOGWrabx/VWPNlgihuLCMM=";
  };

  postPatch = ''
--- a/pkgs/by-name/bi/bitlbee-steam/package.nix
+++ b/pkgs/by-name/bi/bitlbee-steam/package.nix
@ -15,10 +15,10 @@ stdenv.mkDerivation (finalAttrs: {
  pname = "bitlbee-steam";

  src = fetchFromGitHub {
-    rev = "v${finalAttrs.version}";
    owner = "bitlbee";
    repo = "bitlbee-steam";
-    sha256 = "121r92mgwv445wwxzh35n19fs5k81ihr0j19k256ia5502b1xxaq";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-WPUelgClqGiKmClIkGEMaBbtUrBlwN85L4Rs/qpIOYg=";
  };

  nativeBuildInputs = [
@ -37,6 +37,9 @@ stdenv.mkDerivation (finalAttrs: {
    ./autogen.sh
  '';

+  # Source uses `bool` as a variable name, reserved in C23.
+  env.NIX_CFLAGS_COMPILE = "-std=gnu17";
+
  meta = {
    description = "Steam protocol plugin for BitlBee";

--- a/pkgs/by-name/bo/boulder/package.nix
+++ b/pkgs/by-name/bo/boulder/package.nix
@ -9,7 +9,7 @@

 buildGoModule (finalAttrs: {
  pname = "boulder";
-  version = "0.20260428.0";
+  version = "0.20260504.0";

  src = fetchFromGitHub {
    owner = "letsencrypt";
@ -22,7 +22,7 @@ buildGoModule (finalAttrs: {
      find $out -name .git -print0 | xargs -0 rm -rf
      popd
    '';
-    hash = "sha256-ky6geY8pIBhnpwQ4bbzQN0+EQgOfwlo8EQ0rTZdtNIA=";
+    hash = "sha256-nqSBFaPhu+TRPY33Rh3El7IJbKDPI133qgsupVpx/Lg=";
  };

  vendorHash = null;
--- a/pkgs/by-name/bu/buf/package.nix
+++ b/pkgs/by-name/bu/buf/package.nix
@ -10,16 +10,16 @@

 buildGoModule (finalAttrs: {
  pname = "buf";
-  version = "1.68.4";
+  version = "1.69.0";

  src = fetchFromGitHub {
    owner = "bufbuild";
    repo = "buf";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-qxTRUYt2JKBE5WvfXlMsdXMJtrD9MLnMjy6+3PMkpvo=";
+    hash = "sha256-x8Dj4xl67Jq0ViWu+Tz+3lAnfIpE926dIr+oe4ul0gI=";
  };

-  vendorHash = "sha256-aQ4yWdHUmb0LaJ33T2vuVDS1UhYmBUYcwkbnkN7DOqQ=";
+  vendorHash = "sha256-zhXpWpYd/bim5f4EQJujVm072LPgBusjCFGYAwK10HE=";

  patches = [
    # Skip a test that requires networking to be available to work.
--- a/pkgs/by-name/bu/buf/skip_broken_tests.patch
+++ b/pkgs/by-name/bu/buf/skip_broken_tests.patch
@ -1,15 +1,15 @@
 diff --git a/private/buf/buftesting/buftesting.go b/private/buf/buftesting/buftesting.go
-index 1c650077..5422f703 100644
+index 1b5557d..cec5736 100644
 --- a/private/buf/buftesting/buftesting.go
 +++ b/private/buf/buftesting/buftesting.go
-@@ -106,6 +106,10 @@ func RunActualProtoc(
+@@ -100,6 +100,10 @@ func RunActualProtoc(
 
 // GetGoogleapisDirPath gets the path to a clone of googleapis.
- func GetGoogleapisDirPath(t *testing.T, buftestingDirPath string) string {
+ func GetGoogleapisDirPath(tb testing.TB, buftestingDirPath string) string {
 +	// Requires network access, which is not available during
 +	// the nixpkgs sandboxed build
-+	t.Skip()
+	tb.Skip()
 +
 	googleapisDirPath := filepath.Join(buftestingDirPath, testGoogleapisDirPath)
 	require.NoError(
- 		t,
+ 		tb,
--- a/pkgs/by-name/bu/buildkite-agent/package.nix
+++ b/pkgs/by-name/bu/buildkite-agent/package.nix
@ -14,16 +14,16 @@
 }:
 buildGoModule (finalAttrs: {
  pname = "buildkite-agent";
-  version = "3.121.0";
+  version = "3.124.0";

  src = fetchFromGitHub {
    owner = "buildkite";
    repo = "agent";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-QlslPoLpqzuX05bp58xz/3Vhj0imEqCleO1hhe1PPXM=";
+    hash = "sha256-HdTMsCBvd3vN/OkpBpiJ7dXq50PXx165NWmKGGpikUQ=";
  };

-  vendorHash = "sha256-rv5CqNpjmXhGcZ3KQBX0Z2428upWBUVkdRjEG4QWEoY=";
+  vendorHash = "sha256-VE7YEBIrkDG1ERGXnib0LPjBWcrepGAqwY5yKzSQ6wg=";

  postPatch = ''
    substituteInPlace clicommand/agent_start.go --replace /bin/bash ${bash}/bin/bash
@ -59,9 +59,6 @@ buildGoModule (finalAttrs: {

  passthru = {
    tests.smoke-test = nixosTests.buildkite-agents;
-    updateScript = gitUpdater {
-      rev-prefix = "v";
-    };
  };

  meta = {
@ -80,6 +77,7 @@ buildGoModule (finalAttrs: {
      zimbatm
      jsoo1
      techknowlogick
+      cbrxyz
    ];
    platforms = with lib.platforms; unix ++ darwin;
  };
--- a/pkgs/by-name/bu/bumpp/package.nix
+++ b/pkgs/by-name/bu/bumpp/package.nix
@ -23,8 +23,8 @@ stdenv.mkDerivation (finalAttrs: {

  pnpmDeps = fetchPnpmDeps {
    inherit (finalAttrs) pname version src;
-    fetcherVersion = 2;
-    hash = "sha256-rI0DhnncVWd4Wp5pvTnL8IerXbFDwJzkhC4uIe6WJto=";
+    fetcherVersion = 3;
+    hash = "sha256-nIj4S5BWTaw3RVNIxbla8Q31wvK67Of6psx5wX9ID+E=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/ca/castero/package.nix
+++ b/pkgs/by-name/ca/castero/package.nix
@ -54,6 +54,8 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
    # E  +  where '' = <castero.menus.episodemenu.EpisodeMenu object at 0x7ffff3acd0d0>.metadata
    # E  +  and   <MagicMock name='mock.metadata' id='140737279137104'> = episode1.metadata
    "test_menu_episode_metadata"
+    # flaky: segfaults on Hydra when a background DB reload thread races the test
+    "test_perspective_downloaded_draw_metadata"
  ];

  pythonImportsCheck = [
--- a/pkgs/by-name/cc/ccache/package.nix
+++ b/pkgs/by-name/cc/ccache/package.nix
@ -22,7 +22,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "ccache";
-  version = "4.13.5";
+  version = "4.13.6";

  src = fetchFromGitHub {
    owner = "ccache";
@ -41,7 +41,7 @@ stdenv.mkDerivation (finalAttrs: {
        exit 1
      fi
    '';
-    hash = "sha256-v8TgVoLIKhNgcmTLbgqAYuJLUHJEOh/yDVPig/LfPMk=";
+    hash = "sha256-A0n+DO6IznETsAFUNIpBkQI6A3UilgEUbuyP3sqKDTk=";
  };

  outputs = [
@ -99,7 +99,6 @@ stdenv.mkDerivation (finalAttrs: {
  ];

  disabledTests = [
-    "test.direct" # https://github.com/ccache/ccache/issues/1699
    "test.fileclone" # flaky on hydra, also seems to fail on zfs
    "test.trim_dir" # flaky on hydra (possibly filesystem-specific?)
  ]
--- a/pkgs/by-name/cd/cdxgen/package.nix
+++ b/pkgs/by-name/cd/cdxgen/package.nix
@ -37,8 +37,8 @@ stdenv.mkDerivation (finalAttrs: {
  pnpmDeps = fetchPnpmDeps {
    inherit (finalAttrs) pname version src;
    pnpm = pnpm_10;
-    fetcherVersion = 2;
-    hash = "sha256-o5pNgn+ZqaEfsWO97jXkRyPH+0pffR6TBZcF6nApWVg=";
+    fetcherVersion = 3;
+    hash = "sha256-o7u/ZZS/5PgOtWd07zO4a01mUWZowUTL+JDJ2442mGc=";
  };

  buildPhase = ''
--- a/pkgs/by-name/ch/changelogen/package.nix
+++ b/pkgs/by-name/ch/changelogen/package.nix
@ -22,8 +22,8 @@ stdenv.mkDerivation (finalAttrs: {

  pnpmDeps = fetchPnpmDeps {
    inherit (finalAttrs) pname version src;
-    fetcherVersion = 2;
-    hash = "sha256-UKSIfn2iR8Ydk9ViGCgWtspZr1FjTeW49UMwTcL57UA=";
+    fetcherVersion = 3;
+    hash = "sha256-S+GxeljcPj/MzBkleVNgaRa8D4kmHrKwwVqakmB5sAw=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/ch/chuck/package.nix
+++ b/pkgs/by-name/ch/chuck/package.nix
@ -14,14 +14,14 @@
 }:

 stdenv.mkDerivation (finalAttrs: {
-  version = "1.5.5.6";
+  version = "1.5.5.8";
  pname = "chuck";

  src = fetchFromGitHub {
    owner = "ccrma";
    repo = "chuck";
    tag = "chuck-${finalAttrs.version}";
-    hash = "sha256-KBmMpycNCjRZJPdRR3HG5nqHQhhVOENciRpiQ7buyok=";
+    hash = "sha256-GBgb7Bnq5R9Gs/chstjxO8qf+MfSXVftwCbgNW5qC5Y=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/cl/clever-tools/package.nix
+++ b/pkgs/by-name/cl/clever-tools/package.nix
@ -11,7 +11,7 @@
 buildNpmPackage rec {
  pname = "clever-tools";

-  version = "4.9.0";
+  version = "4.10.0";

  nodejs = nodejs_22;

@ -19,10 +19,10 @@ buildNpmPackage rec {
    owner = "CleverCloud";
    repo = "clever-tools";
    rev = version;
-    hash = "sha256-O/Uz+eG8FT3nsXGRqcRdREXNaGlTpyVgUBmNsH7tLJA=";
+    hash = "sha256-EgGjlZ6Awg7SEC3ljPqii3wpq2SlXN/gARUJBSFcX0k=";
  };

-  npmDepsHash = "sha256-aps8j9Vx1LZQAWHuWmnAusCJfAuzREM+GyKdybw+Hcc=";
+  npmDepsHash = "sha256-1v9c1525J7aS89PDdl6hWbYdn/DIM3G1BxFbpxu/F7E=";

  nativeBuildInputs = [
    installShellFiles
--- a/pkgs/by-name/co/coal/package.nix
+++ b/pkgs/by-name/co/coal/package.nix
@ -16,13 +16,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "coal";
-  version = "3.0.2";
+  version = "3.0.3";

  src = fetchFromGitHub {
    owner = "coal-library";
    repo = "coal";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-7Ww1vAzKaCccBpBQU1hzI7Jk+oXw73zhnH594Xn9gbw=";
+    hash = "sha256-2fmu2VZJ+Fd87q2RpnJU61v6Lj2C9r5iweFrr1HwQQI=";
  };

  strictDeps = true;
--- a/pkgs/by-name/co/coc-cmake/package.nix
+++ b/pkgs/by-name/co/coc-cmake/package.nix
@ -27,8 +27,8 @@ stdenv.mkDerivation (finalAttrs: {
      pnpmWorkspaces
      ;
    pnpm = pnpm_8;
-    fetcherVersion = 2;
-    hash = "sha256-wQ9dcqY7BVXc7wpsHlYNpc7utL1+MkdTCu77Wh8+QWc=";
+    fetcherVersion = 3;
+    hash = "sha256-h/ND/665MpcPaDIR1Bb5iPrHmoNysr9vuFk1I0fFP34=";
  };

  pnpmWorkspaces = [ "coc-cmake" ];
--- a/pkgs/by-name/co/cockpit-zfs/package.nix
+++ b/pkgs/by-name/co/cockpit-zfs/package.nix
@ -1,6 +1,7 @@
 {
  acl,
  bash,
+  buildPackages,
  cockpit,
  coreutils,
  fetchFromGitHub,
@ -13,6 +14,7 @@
  makeWrapper,
  mbuffer,
  msmtp,
+  nix-update-script,
  nodejs,
  openssh,
  samba,
@ -28,19 +30,20 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "cockpit-zfs";
-  version = "1.2.12-2";
+  version = "1.2.16";

  src = fetchFromGitHub {
    owner = "45Drives";
    repo = "cockpit-zfs";
    tag = "v${finalAttrs.version}";
    fetchSubmodules = true;
-    hash = "sha256-oeXSOxogfAazRsKfngq2+DOyo//wRJQSqm7gaCza4WY=";
+    hash = "sha256-d1wurTha4LIe01oogJZHfLdTvBnEsNG9sGO8CfyS+GE=";
  };

  missingHashes = ./missing-hashes.json;

-  offlineCache = yarn-berry.fetchYarnBerryDeps {
+  # Use buildPackages for cross-compilation support
+  offlineCache = buildPackages.yarn-berry.fetchYarnBerryDeps {
    inherit (finalAttrs) src missingHashes;
    hash = "sha256-YnR1SqBGnxEQaGUGMNTHHEGcOIhuGbWnqMdr4eRGXcA=";
  };
@ -50,9 +53,13 @@ stdenv.mkDerivation (finalAttrs: {
    nodejs
    jq
    yarn-berry
-    yarn-berry.yarnBerryConfigHook
+    buildPackages.yarn-berry.yarnBerryConfigHook
  ];

+  disallowedRequisites = [ finalAttrs.offlineCache ];
+
+  passthru.updateScript = nix-update-script { };
+
  passthru.cockpitPath = [
    acl
    bash
@ -82,7 +89,7 @@ stdenv.mkDerivation (finalAttrs: {
    ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
  };

-  patchPhase =
+  postPatch =
    let
      # houston-common-lib has @types/electron which pulls in electron.
      # Electron's postinstall downloads binaries, which fails in sandbox.
@ -91,8 +98,6 @@ stdenv.mkDerivation (finalAttrs: {
      houstonUiDir = "houston-common/houston-common-ui";
    in
    ''
-      runHook prePatch
-
      # Remove electron type dependency
      substituteInPlace ${houstonLibDir}/package.json \
        --replace-fail '"@types/electron": "^1.6.12",' ""
@ -116,8 +121,6 @@ stdenv.mkDerivation (finalAttrs: {
        --replace-fail "VueDevTools()," "" \
        --replace-fail "import dts from 'vite-plugin-dts'" ""
      sed -i '/dts({/,/})/d' ${houstonUiDir}/vite.config.ts
-
-      runHook postPatch
    '';

  buildPhase = ''
--- a/pkgs/by-name/co/conventional-changelog-cli/package.nix
+++ b/pkgs/by-name/co/conventional-changelog-cli/package.nix
@ -24,8 +24,8 @@ stdenv.mkDerivation (finalAttrs: {

  pnpmDeps = fetchPnpmDeps {
    inherit (finalAttrs) pname version src;
-    fetcherVersion = 2;
-    hash = "sha256-vOZnVCz5lFdVD2qmlHdTRxzuEjpR3W/rXfzvjvdOh9E=";
+    fetcherVersion = 3;
+    hash = "sha256-O91ypnycBwkfLSruezx9E5CrytguBdtmvgVhKFjUzvM=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/co/cosmic-ext-applet-sysinfo/package.nix
+++ b/pkgs/by-name/co/cosmic-ext-applet-sysinfo/package.nix
@ -9,16 +9,16 @@
 }:
 rustPlatform.buildRustPackage {
  pname = "cosmic-ext-applet-sysinfo";
-  version = "0-unstable-2026-04-16";
+  version = "0-unstable-2026-05-04";

  src = fetchFromGitHub {
    owner = "cosmic-utils";
    repo = "cosmic-ext-applet-sysinfo";
-    rev = "3a22684788b839ead634b8abb6ab2296296dba9d";
-    hash = "sha256-7gqf1m7jlsuzadsELDJL7XwYlpdmEhHYG5FEFsI3HRU=";
+    rev = "fd12d6b638d7033756250ce5cfd82313bdca4124";
+    hash = "sha256-DN/7N2I32PCC4RvmhvYn8iwVd/yk6nefhFBEZ8c6mRI=";
  };

-  cargoHash = "sha256-vD90KMBI1bQTwazVnEMFo3eKXmLLI9QswdIwz+XoDho=";
+  cargoHash = "sha256-ogFEENZxj4ifLbqKL+gimcAMX1REp2oEohY0MqM6Jsg=";

  nativeBuildInputs = [
    libcosmicAppHook
--- a/pkgs/by-name/cp/cpeditor/package.nix
+++ b/pkgs/by-name/cp/cpeditor/package.nix
@ -2,7 +2,8 @@
  lib,
  stdenv,
  fetchFromGitHub,
-  libsForQt5,
+  qt6,
+  kdePackages,
  pkg-config,
  cmake,
  ninja,
@ -12,13 +13,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "cpeditor";
-  version = "7.1.1";
+  version = "7.1.1-unstable-2026-04-07";

  src = fetchFromGitHub {
    owner = "cpeditor";
    repo = "cpeditor";
-    tag = finalAttrs.version;
-    hash = "sha256-zEK3137DjQmuc7Y4c/HF0n37bdokj9ci2/agSaG7nZE=";
+    rev = "912784abcbfb38d70911c45d15a308c339894cec";
+    hash = "sha256-udpDsYve1QIQTT75Xk8HHBV1lTTTjauDMyfJKbShgEs=";
    fetchSubmodules = true;
  };

@ -26,13 +27,15 @@ stdenv.mkDerivation (finalAttrs: {
    cmake
    ninja
    pkg-config
-    libsForQt5.wrapQtAppsHook
+    qt6.wrapQtAppsHook
    python3
  ];
+
  buildInputs = [
-    libsForQt5.qtbase
-    libsForQt5.qttools
-    libsForQt5.syntax-highlighting
+    qt6.qtbase
+    qt6.qttools
+    qt6.qt5compat
+    kdePackages.syntax-highlighting
  ];

  postPatch = ''
--- a/pkgs/by-name/cr/crd2pulumi/package.nix
+++ b/pkgs/by-name/cr/crd2pulumi/package.nix
@ -6,16 +6,16 @@

 buildGoModule (finalAttrs: {
  pname = "crd2pulumi";
-  version = "1.6.1";
+  version = "1.6.2";

  src = fetchFromGitHub {
    owner = "pulumi";
    repo = "crd2pulumi";
    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-0D5U3Ie9h5R0kTLb5YHshtYrwuoXxPX0fYAJGqUw35w=";
+    sha256 = "sha256-0BnDN1D1g/LdYqLw1It5a/jG2g6/kBb4F64NEI5xFeA=";
  };

-  vendorHash = "sha256-mO1DgyasJFYpRxeTd8Dinn1mcddCjTiUqs54WD31V/w=";
+  vendorHash = "sha256-cbJ0jZtJhVz3b1jdsLiwNBHqRUHk29haJ+YzShcTfJg=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/cr/cre2/missing-header-include-pr-34.patch
+++ b/pkgs/by-name/cr/cre2/missing-header-include-pr-34.patch
@ -0,0 +1,20 @@
+From 7c83c012b33a16b11e3547894118fc013ec23ca0 Mon Sep 17 00:00:00 2001
+From: Willy <jemand771@gmx.net>
+Date: Tue, 5 May 2026 13:50:44 +0200
+Subject: [PATCH] add missing cstring include
+
+fails on newer compilers/toolchains without
+---
+ src/cre2.cpp | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/src/cre2.cpp b/src/cre2.cpp
+index 5a63b93..3b1ec21 100644
+--- a/src/cre2.cpp
+++ b/src/cre2.cpp
+@@ -18,6 +18,7 @@
+ 
+ #include <cstdlib>
+ #include <cstdio>
+#include <cstring>
+ #include <vector>
--- a/pkgs/by-name/cr/cre2/package.nix
+++ b/pkgs/by-name/cr/cre2/package.nix
@ -20,6 +20,10 @@ stdenv.mkDerivation (finalAttrs: {
    sha256 = "1h9jwn6z8kjf4agla85b5xf7gfkdwncp0mfd8zwk98jkm8y2qx9q";
  };

+  patches = [
+    ./missing-header-include-pr-34.patch
+  ];
+
  nativeBuildInputs = [
    autoreconfHook
    libtool
--- a/pkgs/by-name/cr/croc/package.nix
+++ b/pkgs/by-name/cr/croc/package.nix
@ -11,16 +11,16 @@

 buildGoModule (finalAttrs: {
  pname = "croc";
-  version = "10.4.2";
+  version = "10.4.3";

  src = fetchFromGitHub {
    owner = "schollz";
    repo = "croc";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-JZV02QZAS4OhnFdEB/EKm2FL0o4VmNSJIWNBdmIIdrE=";
+    hash = "sha256-cQgGs4vv7RGa9reM3QoYDW6PdREx+rIzg4uXXrahPSg=";
  };

-  vendorHash = "sha256-/qPBHpCdEu1uBFFwE7uzmCcm4EL8TxUWdjiaFlUSxIU=";
+  vendorHash = "sha256-qS+jjchXysIj4ZcZoUWg8W0uyYTYPPy8DdhZEP/uZGg=";

  subPackages = [ "." ];

--- a/pkgs/by-name/cs/cspell/package.nix
+++ b/pkgs/by-name/cs/cspell/package.nix
@ -30,8 +30,8 @@ stdenv.mkDerivation (finalAttrs: {
      pnpmWorkspaces
      ;
    pnpm = pnpm_10;
-    fetcherVersion = 2;
-    hash = "sha256-EKnczZ/7O2ZMaSlIFfLk9WXyf/ubynhmecs+IyIoTHw=";
+    fetcherVersion = 3;
+    hash = "sha256-eQ9KiRSwWmfhCinYVP4ulQdAG6SOd9yyyOUWSwc5TV8=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/db/dbip-asn-lite/package.nix
+++ b/pkgs/by-name/db/dbip-asn-lite/package.nix
@ -5,11 +5,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "dbip-asn-lite";
-  version = "2026-04";
+  version = "2026-05";

  src = fetchurl {
    url = "https://download.db-ip.com/free/dbip-asn-lite-${finalAttrs.version}.mmdb.gz";
-    hash = "sha256-wJA6XqFbVxsWNEJ4AzwiKMOjsayJczVU/L3i98Y1x+I=";
+    hash = "sha256-14Gx6w1BzS+3+xz6CiJ3OMm3KgvU2pf+z9TOiydky4U=";
  };

  dontUnpack = true;
--- a/pkgs/by-name/db/dbip-city-lite/package.nix
+++ b/pkgs/by-name/db/dbip-city-lite/package.nix
@ -5,11 +5,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "dbip-city-lite";
-  version = "2026-04";
+  version = "2026-05";

  src = fetchurl {
    url = "https://download.db-ip.com/free/dbip-city-lite-${finalAttrs.version}.mmdb.gz";
-    hash = "sha256-sIb1DGVNmvV0B3ltTcT4yQkMMMiZt89X0eDIzT0U/r8=";
+    hash = "sha256-lSDMjGXcBMr8iGgqyJ26LPu8tfaG6QlKsCH88q4sAvA=";
  };

  dontUnpack = true;
--- a/pkgs/by-name/db/dbip-country-lite/package.nix
+++ b/pkgs/by-name/db/dbip-country-lite/package.nix
@ -5,11 +5,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "dbip-country-lite";
-  version = "2026-04";
+  version = "2026-05";

  src = fetchurl {
    url = "https://download.db-ip.com/free/dbip-country-lite-${finalAttrs.version}.mmdb.gz";
-    hash = "sha256-d+6Bq1l6XZHI+maW20SmpXjfP9O1a4FmhtfL3poEOfs=";
+    hash = "sha256-I0aw3Sk+hZf4n7nvTiy0GEKVkHIx/URgwkAgSW8o7fo=";
  };

  dontUnpack = true;
--- a/pkgs/by-name/de/deadlock-mod-manager/package.nix
+++ b/pkgs/by-name/de/deadlock-mod-manager/package.nix
@ -77,9 +77,9 @@ rustPlatform.buildRustPackage (finalAttrs: {
      src
      ;
    pnpm = pnpm_9;
-    fetcherVersion = 2;
+    fetcherVersion = 3;
    sourceRoot = "source";
-    hash = "sha256-fFcKyqAo/HpGBaEJMk6Lq0FafNXrGu9z9nHnav5d6Hg=";
+    hash = "sha256-6lMTvlkIeM9kkbFhHzS9jJsHk2bVZWZs6GPgn+X3Rss=";
  };

  patches = [
--- a/pkgs/by-name/de/deltachat-desktop/package.nix
+++ b/pkgs/by-name/de/deltachat-desktop/package.nix
@ -50,8 +50,8 @@ stdenv.mkDerivation (finalAttrs: {
  pnpmDeps = fetchPnpmDeps {
    inherit (finalAttrs) pname version src;
    pnpm = pnpm_9;
-    fetcherVersion = 2;
-    hash = "sha256-+Mxf/D66EoE/axKg5+TSaLFPSpUEDZNtSNH4zklxV5s=";
+    fetcherVersion = 3;
+    hash = "sha256-UZ6/OTUtIiOA1D5PanY4aS+VCBNj/AIbIGYe1eibGMQ=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/di/di-tui/package.nix
+++ b/pkgs/by-name/di/di-tui/package.nix
@ -6,13 +6,13 @@
 }:
 buildGoModule (finalAttrs: {
  pname = "di-tui";
-  version = "1.13.4";
+  version = "1.14.0";

  src = fetchFromGitHub {
    owner = "acaloiaro";
    repo = "di-tui";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-0PIKPprAqGbVFiGFxwzgmS4fYKTHfpdpWWUMuxK67tQ=";
+    hash = "sha256-P784Tf3XA/28PgKTr89yizKAX1MhAb4877gV7vVHBYE=";
  };

  vendorHash = "sha256-b7dG0nSjPQpjWUbOlIxWudPZWKqtq96sQaJxKvsQT9I=";
--- a/pkgs/by-name/dn/dnsenum/package.nix
+++ b/pkgs/by-name/dn/dnsenum/package.nix
@ -9,15 +9,19 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "dnsenum";
-  version = "1.2.4.2";
+  version = "1.3.2";

  src = fetchFromGitHub {
-    owner = "fwaeytens";
-    repo = "dnsenum";
-    rev = finalAttrs.version;
-    sha256 = "1bg1ljv6klic13wq4r53bg6inhc74kqwm3w210865b1v1n8wj60v";
+    owner = "SparrowOchon";
+    repo = "dnsenum2";
+    rev = "v${finalAttrs.version}";
+    sha256 = "sha256-I4I+HNQC7xqIF2P7NBy2Ophh3znl5qy9fSicJKIBUis=";
  };

+  patchPhase = ''
+    rm Makefile
+  '';
+
  propagatedBuildInputs = with perlPackages; [
    perl
    NetDNS
@ -35,11 +39,27 @@ stdenv.mkDerivation (finalAttrs: {
    install -vD dns.txt -t $out/share
  '';

+  postFixup = ''
+    wrapProgram $out/bin/dnsenum \
+      --prefix PERL5LIB : "${
+        with perlPackages;
+        makePerlPath [
+          NetIP
+          NetDNS
+          NetNetmask
+          StringRandom
+          XMLWriter
+          NetWhoisIP
+          WWWMechanize
+        ]
+      }"
+  '';
+
  meta = {
-    homepage = "https://github.com/fwaeytens/dnsenum";
+    homepage = "https://github.com/SparrowOchon/dnsenum2";
    description = "Tool to enumerate DNS information";
    mainProgram = "dnsenum";
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ tbutter ];
    license = lib.licenses.gpl2Plus;
    platforms = lib.platforms.all;
  };
--- a/pkgs/by-name/du/dublin-traceroute/package.nix
+++ b/pkgs/by-name/du/dublin-traceroute/package.nix
@ -23,10 +23,10 @@ stdenv.mkDerivation {
    hash = "sha256-UJeFPVi3423Jh72fVk8QbLX1tTNAQ504xYs9HwVCkZc=";
  };

-  # gtest requires C++17, while dublin-traceroute requires C++11
  postPatch = ''
    substituteInPlace CMakeLists.txt \
-      --replace-fail "ENABLE_TESTING()" ""
+      --replace-fail "ENABLE_TESTING()" "" \
+      --replace-fail "-std=c++11" "-std=c++17"
  '';

  nativeBuildInputs = [
--- a/pkgs/by-name/e-/e-search/package.nix
+++ b/pkgs/by-name/e-/e-search/package.nix
@ -71,8 +71,8 @@ stdenv.mkDerivation (finalAttrs: {
    inherit (finalAttrs) pname version src;
    nativeBuildInputs = [ gitMinimal ];
    pnpm = pnpm';
-    fetcherVersion = 2;
-    hash = "sha256-q0+6vkDZdcDXwsTxby2RuQUYTgEnxGx1CeXROSrG9lU=";
+    fetcherVersion = 3;
+    hash = "sha256-gP/0WeVp+Y8QgPmAmbFt+cInX6+4oxPIYlwFpSh2hPQ=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/ec/eccodes/package.nix
+++ b/pkgs/by-name/ec/eccodes/package.nix
@ -17,11 +17,11 @@
 }:
 gccStdenv.mkDerivation rec {
  pname = "eccodes";
-  version = "2.44.0";
+  version = "2.47.0";

  src = fetchurl {
    url = "https://confluence.ecmwf.int/download/attachments/45757960/eccodes-${version}-Source.tar.gz";
-    hash = "sha256-x1+x+Rt2W2uLR3RjKopvvOyWk02wFftjwq0lYK7dRDs=";
+    hash = "sha256-gtqBmqm1GDHcFLO/KRi/7lCxzVOgUIjQw/RJN1iq4JQ=";
  };

  postPatch = ''
--- a/pkgs/by-name/ec/ecos/package.nix
+++ b/pkgs/by-name/ec/ecos/package.nix
@ -15,6 +15,9 @@ stdenv.mkDerivation (finalAttrs: {
    hash = "sha256-WMgqDc+XAY3g2wwlefjJ0ATxR5r/jL971FZKtxsunnU=";
  };

+  # tests call no-arg-declared functions with args; pre-C23 allows it
+  env.NIX_CFLAGS_COMPILE = "-std=gnu17";
+
  buildPhase = ''
    runHook preBuild

--- a/pkgs/by-name/eg/eggdrop/package.nix
+++ b/pkgs/by-name/eg/eggdrop/package.nix
@ -2,19 +2,23 @@
  lib,
  stdenv,
  fetchurl,
+  openssl,
  tcl,
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "eggdrop";
-  version = "1.9.5";
+  version = "1.10.1";

  src = fetchurl {
    url = "https://ftp.eggheads.org/pub/eggdrop/source/${lib.versions.majorMinor finalAttrs.version}/eggdrop-${finalAttrs.version}.tar.gz";
-    hash = "sha256-4mkY6opk2YV1ecW2DGYaM38gdz7dgwhrNWUlvrWBc2o=";
+    hash = "sha256-pc33RE14HC/09dC+FCAvXQlx4AOHGBpJtyUFf+lTEtU=";
  };

-  buildInputs = [ tcl ];
+  buildInputs = [
+    openssl
+    tcl
+  ];

  hardeningDisable = [ "format" ];

@ -37,5 +41,6 @@ stdenv.mkDerivation (finalAttrs: {
    platforms = lib.platforms.unix;
    homepage = "https://www.eggheads.org";
    description = "Internet Relay Chat (IRC) bot";
+    maintainers = with lib.maintainers; [ EpicEric ];
  };
 })
--- a/pkgs/by-name/es/esphome/package.nix
+++ b/pkgs/by-name/es/esphome/package.nix
@ -33,14 +33,14 @@ let
 in
 python.pkgs.buildPythonApplication (finalAttrs: {
  pname = "esphome";
-  version = "2026.4.3";
+  version = "2026.4.5";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "esphome";
    repo = "esphome";
    tag = finalAttrs.version;
-    hash = "sha256-+esSczOBIT4dJEyzqmEv6YMU4wGkN4lFGmuZKRp5/bo=";
+    hash = "sha256-uMlkrHg4cZYsdSv8D8U57mEZnjwcRkJe2zKI8VFsTRk=";
  };

  patches = [
@ -186,6 +186,9 @@ python.pkgs.buildPythonApplication (finalAttrs: {
    # Expects a full git clone
    "test_clang_tidy_mode_full_scan"
    "test_clang_tidy_mode_targeted_scan"
+    # Patched to run platformio without the esphome wrapper
+    "test_run_platformio_cli_strips_win_long_path_prefix"
+    "test_run_platformio_cli_does_not_set_pythonexepath_without_strip"
  ];

  passthru = {
--- a/pkgs/by-name/es/esphome/platformio-binary-reference.patch
+++ b/pkgs/by-name/es/esphome/platformio-binary-reference.patch
@ -1,13 +1,13 @@
 diff --git a/esphome/platformio_api.py b/esphome/platformio_api.py
-index fc21977f..e5059f1d 100644
+index 81ff01306..2dfa523dd 100644
 --- a/esphome/platformio_api.py
 +++ b/esphome/platformio_api.py
-@@ -63,7 +63,7 @@ def run_platformio_cli(*args, **kwargs) -> str | int:
-     os.environ.setdefault("PYTHONWARNINGS", "ignore::SyntaxWarning")
-     # Increase uv retry count to handle transient network errors (default is 3)
-     os.environ.setdefault("UV_HTTP_RETRIES", "10")
-    cmd = [sys.executable, "-m", "esphome.platformio_runner"] + list(args)
+@@ -64,7 +64,7 @@ def run_platformio_cli(*args, **kwargs) -> str | int:
+         # a user-provided value (or the unmodified path on platforms that
+         # don't need the strip).
+         os.environ["PYTHONEXEPATH"] = python_exe
+-    cmd = [python_exe, "-m", "esphome.platformio_runner"] + list(args)
 +    cmd = ["platformio"] + list(args)
-
+ 
     return run_external_process(*cmd, **kwargs)
-
+ 
--- a/pkgs/by-name/ex/exegol/package.nix
+++ b/pkgs/by-name/ex/exegol/package.nix
@ -4,23 +4,25 @@
  python3Packages,
  xhost,
 }:
-python3Packages.buildPythonApplication rec {
+python3Packages.buildPythonApplication (finalAttrs: {
  pname = "exegol";
  version = "5.1.10";
  pyproject = true;
+  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "ThePorgs";
    repo = "Exegol";
-    tag = version;
+    tag = finalAttrs.version;
    hash = "sha256-iyzTBZHOzr6CfZDqHvycdWZply/BXH7kESaO5pDLBMY=";
  };

  build-system = with python3Packages; [ pdm-backend ];

  pythonRelaxDeps = [
-    "rich"
    "argcomplete"
+    "requests"
+    "rich"
    "supabase"
  ];

@ -41,7 +43,9 @@ python3Packages.buildPythonApplication rec {
    ]
    ++ pyjwt.optional-dependencies.crypto
    ++ [ xhost ]
-    ++ lib.optional (!stdenv.hostPlatform.isLinux) tzlocal;
+    ++ lib.optionals (!stdenv.hostPlatform.isLinux) [
+      tzlocal
+    ];

  doCheck = true;

@ -58,7 +62,7 @@ python3Packages.buildPythonApplication rec {
      stylish macOS users and corporate Windows pros to UNIX-like power users.
    '';
    homepage = "https://github.com/ThePorgs/Exegol";
-    changelog = "https://github.com/ThePorgs/Exegol/releases/tag/${src.tag}";
+    changelog = "https://github.com/ThePorgs/Exegol/releases/tag/${finalAttrs.src.tag}";
    license = with lib.licenses; [
      gpl3Only
      {
@ -76,4 +80,4 @@ python3Packages.buildPythonApplication rec {
      macbucheron
    ];
  };
-}
+})
--- a/pkgs/by-name/fe/fence/package.nix
+++ b/pkgs/by-name/fe/fence/package.nix
@ -14,13 +14,13 @@

 buildGoModule (finalAttrs: {
  pname = "fence";
-  version = "0.1.54";
+  version = "0.1.57";

  src = fetchFromGitHub {
    owner = "Use-Tusk";
    repo = "fence";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Um9nIg+lXNfp8vBeLlCUYlJNtPIemnyenz7+L9dfcjg=";
+    hash = "sha256-YX+DqD20hr/+hAXLVddEQjj0J7jybhNNdtQM3tlSPek=";
  };

  vendorHash = "sha256-Qct/M0zuggYzlN0gyO8nF58M5Av3HcYyMjrPab5Crr0=";
--- a/pkgs/by-name/fi/figurine/package.nix
+++ b/pkgs/by-name/fi/figurine/package.nix
@ -6,16 +6,16 @@

 buildGoModule (finalAttrs: {
  pname = "figurine";
-  version = "1.3.0";
+  version = "2.0.0";

  src = fetchFromGitHub {
    owner = "arsham";
    repo = "figurine";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-1q6Y7oEntd823nWosMcKXi6c3iWsBTxPnSH4tR6+XYs=";
+    hash = "sha256-U25nbXr8SuSgMq1Nqk/7Ci4tKoWAyccv8j4aTIEox3k=";
  };

-  vendorHash = "sha256-mLdAaYkQH2RHcZft27rDW1AoFCWKiUZhh2F0DpqZELw=";
+  vendorHash = "sha256-CdiHPN0zfOedsz2M6JWFMQpG70vxLbKj//WkKyN58AQ=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/fi/filebench/package.nix
+++ b/pkgs/by-name/fi/filebench/package.nix
@ -1,7 +1,9 @@
 {
  lib,
  stdenv,
-  fetchurl,
+  fetchFromGitHub,
+  fetchpatch,
+
  autoreconfHook,
  bison,
  flex,
@ -9,13 +11,23 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "filebench";
-  version = "1.4.9.1";
+  version = "1.5-alpha3-unstable-2020-02-20";

-  src = fetchurl {
-    url = "mirror://sourceforge/filebench/filebench-${finalAttrs.version}.tar.gz";
-    sha256 = "13hmx67lsz367sn8lrvz1780mfczlbiz8v80gig9kpkpf009yksc";
+  src = fetchFromGitHub {
+    owner = "filebench";
+    repo = "filebench";
+    rev = "22620e602cbbebad90c0bd041896ebccf70dbf5f";
+    hash = "sha256-IVQSEUZOC+X3C994tnk0n3NI7yu2yPAWlPA7zdSbvlg=";
  };

+  patches = [
+    (fetchpatch {
+      name = "gcc-15.patch";
+      url = "https://github.com/filebench/filebench/commit/82191902e44b7a136adb9285bcce3d4a52551b9e.patch?full_index=1";
+      hash = "sha256-Uf4DrHZl94m502C7MynMtYpon1886RLbXGKW6lYq1SI=";
+    })
+  ];
+
  nativeBuildInputs = [
    autoreconfHook
    bison
@ -24,9 +36,9 @@ stdenv.mkDerivation (finalAttrs: {

  meta = {
    description = "File system and storage benchmark that can generate both micro and macro workloads";
-    homepage = "https://sourceforge.net/projects/filebench/";
+    homepage = "https://github.com/filebench/filebench";
    license = lib.licenses.cddl;
-    maintainers = [ ];
+    maintainers = [ lib.maintainers.ryand56 ];
    platforms = lib.platforms.linux;
    mainProgram = "filebench";
  };
--- a/pkgs/by-name/fi/filebrowser/package.nix
+++ b/pkgs/by-name/fi/filebrowser/package.nix
@ -12,13 +12,13 @@
 }:

 let
-  version = "2.63.2";
+  version = "2.63.3";

  src = fetchFromGitHub {
    owner = "filebrowser";
    repo = "filebrowser";
    rev = "v${version}";
-    hash = "sha256-pAD7mEiDQyfmKmClO9oMLgPua0jOrcImiQrSGLvhCEA=";
+    hash = "sha256-v3cC8opClvt91MqUIKNZdvCv0hPeCvWPi0IlOMHlWbQ=";
  };

  frontend = buildNpmPackage rec {
@ -41,7 +41,7 @@ let
        ;
      fetcherVersion = 3;
      pnpm = pnpm_10;
-      hash = "sha256-0n2HxluqIcCzo1QA5D/YRCk5+mbTntLA8PFxZAC3YA8=";
+      hash = "sha256-g8BWDEymQNOkLYBws0ii4iLnpjB7X4EQl0OzR3GXeq0=";
    };

    installPhase = ''
@ -59,7 +59,7 @@ buildGoModule {
  pname = "filebrowser";
  inherit version src;

-  vendorHash = "sha256-YM/aIx1gDhFAKNNZmXvG3AVd4xSNC8AHIya4Gyeq9/Y=";
+  vendorHash = "sha256-ofeQkbvBfCpu2g1CLAwUZAZISyAOz+0smEZRx/koj/8=";

  excludedPackages = [ "tools" ];

--- a/pkgs/by-name/fz/fzf-zsh-plugin/package.nix
+++ b/pkgs/by-name/fz/fzf-zsh-plugin/package.nix
@ -3,18 +3,19 @@
  stdenv,
  lib,
  fetchFromGitHub,
+  unstableGitUpdater,
  zsh,
 }:

 stdenv.mkDerivation {
  pname = "fzf-zsh-plugin";
-  version = "1.0.0-unstable-2025-12-15";
+  version = "1.0.0-unstable-2026-03-03";

  src = fetchFromGitHub {
    owner = "unixorn";
    repo = "fzf-zsh-plugin";
-    rev = "cdd9d5cc3b41a3a390a0fb8605c40de652da6309";
-    hash = "sha256-i6qoaMWVofhD3K6/RaaNatzA2aokiNQ5ilqmahprJFU=";
+    rev = "d56d2387ce376f80e42c46654a9ee1f899a40b46";
+    hash = "sha256-twry9z9gDvRfH3AOWEV/a9HX4pnlMJDSw74Sm/MBwIk=";
  };

  strictDeps = true;
@ -33,6 +34,8 @@ stdenv.mkDerivation {
    runHook postInstall
  '';

+  passthru.updateScript = unstableGitUpdater { tagPrefix = "v"; };
+
  meta = {
    homepage = "https://github.com/unixorn/fzf-zsh-plugin";
    description = "ZSH plugin to enable fzf searches of a lot more stuff - docker, tmux, homebrew and more";
--- a/pkgs/by-name/ga/gale/package.nix
+++ b/pkgs/by-name/ga/gale/package.nix
@ -38,13 +38,13 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "gale";
-  version = "1.13.0";
+  version = "1.13.3";

  src = fetchFromGitHub {
    owner = "Kesomannen";
    repo = "gale";
    tag = finalAttrs.version;
-    hash = "sha256-q/DBgAOFyIqhagWffJ6z+F7TXAZd7otPOGJI4oid4vM=";
+    hash = "sha256-QmTv1T9ocC8gfOSOiiNZoCovtyqtUmBTWObVFf9pUGY=";
  };

  pnpmDeps = fetchPnpmDeps {
@ -70,7 +70,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
  cargoRoot = "src-tauri";
  buildAndTestSubdir = finalAttrs.cargoRoot;

-  cargoHash = "sha256-V8MKgicqHU9kEMTw17xeM2pzzkAlGBZJ2j4W5OEIit0=";
+  cargoHash = "sha256-GdVqVRh3tKuuyoWVpWqHcW9n9Erv35nzP9BumJfRIj8=";

  nativeBuildInputs = [
    jq
--- a/pkgs/by-name/ga/gammu/bashcomp-dir.patch
+++ b/pkgs/by-name/ga/gammu/bashcomp-dir.patch
@ -1,6 +1,8 @@
+diff --git a/contrib/CMakeLists.txt b/contrib/CMakeLists.txt
+index 1120c0309..62e6177ab 100644
 --- a/contrib/CMakeLists.txt
 +++ b/contrib/CMakeLists.txt
-@@ -85,7 +85,7 @@ endif (INSTALL_PHP_EXAMPLES)
+@@ -87,7 +87,7 @@ endif (INSTALL_PHP_EXAMPLES)
 if (INSTALL_BASH_COMPLETION)
     macro_optional_find_package (BashCompletion)
     if (NOT BASH_COMPLETION_FOUND)
--- a/pkgs/by-name/ga/gammu/gammu-config-dialog.patch
+++ b/pkgs/by-name/ga/gammu/gammu-config-dialog.patch
@ -1,14 +1,16 @@
+diff --git a/utils/gammu-config b/utils/gammu-config
+index abf278ada..fc12493cd 100755
 --- a/utils/gammu-config
 +++ b/utils/gammu-config
-@@ -59,16 +59,7 @@
+@@ -59,16 +59,7 @@ while [ "$#" -ge 1 ] ; do
     shift
 done
 
-if type dialog > /dev/null 2>&1 ; then
+-if command -v dialog > /dev/null 2>&1 ; then
 -    DIALOG=dialog
-elif type cdialog > /dev/null 2>&1 ; then
+-elif command -v cdialog > /dev/null 2>&1 ; then
 -    DIALOG=cdialog
-elif type whiptail > /dev/null 2>&1 ; then
+-elif command -v whiptail > /dev/null 2>&1 ; then
 -    DIALOG=whiptail
 -else
 -    echo "You need dialog, cdialog or whiptail installed to make this work"
--- a/pkgs/by-name/ga/gammu/package.nix
+++ b/pkgs/by-name/ga/gammu/package.nix
@ -24,13 +24,15 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "gammu";
-  version = "1.42.0";
+  version = "1.43.2";
+
+  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "gammu";
    repo = "gammu";
    rev = finalAttrs.version;
-    sha256 = "sha256-aeaGHVxOMiXRU6RHws+oAnzdO9RY1jw/X/xuGfSt76I=";
+    sha256 = "sha256-+mZBELwFUEL4S3IUIIa83TaNIYQxjQE1TvWhXTcIfYc=";
  };

  patches = [
--- a/pkgs/by-name/ga/garage-webui/package.nix
+++ b/pkgs/by-name/ga/garage-webui/package.nix
@ -33,8 +33,8 @@ buildGoModule (finalAttrs: {
    pnpmDeps = fetchPnpmDeps {
      inherit (finalAttrs') pname version src;
      pnpm = pnpm_9;
-      fetcherVersion = 2;
-      hash = "sha256-8eQhR/fuDFNL8W529Ev7piCaseVaFahgZJQk3AJA3ng=";
+      fetcherVersion = 3;
+      hash = "sha256-z/Y9q/SE2c/KYzIOAfATlprjr6NjmmUHQB+ZbO39OK4=";
    };

    buildPhase = ''
--- a/pkgs/by-name/gc/gcsfuse/package.nix
+++ b/pkgs/by-name/gc/gcsfuse/package.nix
@ -7,16 +7,16 @@

 buildGoModule (finalAttrs: {
  pname = "gcsfuse";
-  version = "3.8.0";
+  version = "3.9.0";

  src = fetchFromGitHub {
    owner = "googlecloudplatform";
    repo = "gcsfuse";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-JQgjLrAqpRdq20DhG26AxkMRdJkJCrrS4/7LrDvV6NI=";
+    hash = "sha256-jVuO73U9KKop9wpO/uLz1ergo3FygCeFHaQbNS46gF0=";
  };

-  vendorHash = "sha256-KDjSNJVsEuLGTgnAz9Ue+ZolxGzuqN3b/B+0LsgI9xY=";
+  vendorHash = "sha256-Hsx4FJ1DHnS8Nv8eNjbmLTTFlfuRNFP/7V63JefuKR0=";

  subPackages = [
    "."
--- a/pkgs/by-name/gd/gdu/package.nix
+++ b/pkgs/by-name/gd/gdu/package.nix
@ -47,6 +47,7 @@ buildGoModule (finalAttrs: {
      skippedTests = [
        "TestStoredAnalyzer" # https://github.com/dundee/gdu/issues/371
        "TestAnalyzePathWithIgnoring"
+        "TestTopDirFollowSymlink"
      ];
    in
    [ "-skip=^${builtins.concatStringsSep "$|^" skippedTests}$" ];
--- a/pkgs/by-name/gi/git-town/package.nix
+++ b/pkgs/by-name/gi/git-town/package.nix
@ -13,13 +13,13 @@

 buildGoModule (finalAttrs: {
  pname = "git-town";
-  version = "22.7.1";
+  version = "23.0.0";

  src = fetchFromGitHub {
    owner = "git-town";
    repo = "git-town";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-MGiWqFWA4PMyGL7QqgcDWrgM/Wo8us8GMhdsrXBgWmg=";
+    hash = "sha256-Bk3m9/AMo+1xxz97hNEd+wDdvCep/BwUA5Ps1VYIdfk=";
  };

  vendorHash = null;
--- a/pkgs/by-name/gi/gitbutler/package.nix
+++ b/pkgs/by-name/gi/gitbutler/package.nix
@ -58,8 +58,8 @@ rustPlatform.buildRustPackage (finalAttrs: {

  pnpmDeps = fetchPnpmDeps {
    inherit (finalAttrs) pname version src;
-    fetcherVersion = 2;
-    hash = "sha256-0WLgtidG8hqTkXY3heu+m3VoqQD/kGMlTmLb0qAS8sQ=";
+    fetcherVersion = 3;
+    hash = "sha256-eRiFA5lXpPHQwlyFmKMx1zmHH2zLCHB+3s708g6srg4=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/gi/gitify/package.nix
+++ b/pkgs/by-name/gi/gitify/package.nix
@ -36,8 +36,8 @@ stdenv.mkDerivation (finalAttrs: {
  pnpmDeps = fetchPnpmDeps {
    inherit (finalAttrs) pname version src;
    pnpm = pnpm_10_29_2;
-    fetcherVersion = 2;
-    hash = "sha256-uK3CNyPewUVAmqBJq1WMCrNeMP5I18BEBkZIBP0qPsI=";
+    fetcherVersion = 3;
+    hash = "sha256-0iTvrIe5PVj99ePWt8rn+laikdJ5TaNQ8GZGHyUTTQI=";
  };

  env.ELECTRON_SKIP_BINARY_DOWNLOAD = 1;
--- a/pkgs/by-name/gn/gnu-cim/package.nix
+++ b/pkgs/by-name/gn/gnu-cim/package.nix
@ -44,8 +44,7 @@ stdenv.mkDerivation (finalAttrs: {
    '';
    homepage = "https://www.gnu.org/software/cim/";
    license = lib.licenses.gpl2;
-    platforms = lib.platforms.all;
-    badPlatforms = [ "aarch64-darwin" ];
+    platforms = lib.platforms.linux;
    maintainers = with lib.maintainers; [ pbsds ];
  };
 })
--- a/pkgs/by-name/go/golazo/package.nix
+++ b/pkgs/by-name/go/golazo/package.nix
@ -8,13 +8,13 @@
 }:
 buildGoModule (finalAttrs: {
  pname = "golazo";
-  version = "0.23.0";
+  version = "0.24.0";

  src = fetchFromGitHub {
    owner = "0xjuanma";
    repo = "golazo";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-hrdiNccvIgX9v187l4Htc7viqOb1lGgxOkeLJgFyF4M=";
+    hash = "sha256-MSFH6IuSeMi98Ri/YVIxLFn7eYozodosfk8ZYz+Q2K0=";
  };

  vendorHash = "sha256-M2gfqU5rOfuiVSZnH/Dr8OVmDhyU2jYkgW7RuIUTd+E=";
--- a/pkgs/by-name/gq/gql/package.nix
+++ b/pkgs/by-name/gq/gql/package.nix
@ -6,6 +6,8 @@
  libgit2,
  zlib,
  cmake,
+  versionCheckHook,
+  nix-update-script,
 }:

 rustPlatform.buildRustPackage (finalAttrs: {
@ -15,7 +17,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
  src = fetchFromGitHub {
    owner = "AmrDeveloper";
    repo = "GQL";
-    rev = finalAttrs.version;
+    tag = finalAttrs.version;
    hash = "sha256-fTmCL8b9Yp0DwgatGd7ODpq3z9b3Rqg/skqvjQkZvOU=";
  };

@ -31,12 +33,17 @@ rustPlatform.buildRustPackage (finalAttrs: {
    zlib
  ];

+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  passthru.updateScript = nix-update-script { };
+
  meta = {
    description = "SQL like query language to perform queries on .git files";
    homepage = "https://github.com/AmrDeveloper/GQL";
-    changelog = "https://github.com/AmrDeveloper/GQL/releases/tag/${finalAttrs.src.rev}";
+    changelog = "https://github.com/AmrDeveloper/GQL/blob/${finalAttrs.version}/CHANGELOG.md";
    license = lib.licenses.mit;
-    maintainers = [ ];
+    maintainers = [ lib.maintainers.progrm_jarvis ];
    mainProgram = "gitql";
  };
 })
--- a/pkgs/by-name/gu/guitarix-vst/package.nix
+++ b/pkgs/by-name/gu/guitarix-vst/package.nix
@ -0,0 +1,76 @@
+{
+  alsa-lib,
+  avahi,
+  boost,
+  curl,
+  fetchFromGitHub,
+  fftwFloat,
+  freetype,
+  glib,
+  glibmm,
+  lib,
+  libsndfile,
+  libx11,
+  libxcursor,
+  libxext,
+  libxinerama,
+  libxrandr,
+  lilv,
+  ncurses,
+  pkg-config,
+  stdenv,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "guitarix-vst";
+  version = "0.5";
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  src = fetchFromGitHub {
+    owner = "brummer10";
+    repo = "guitarix.vst";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-SuKPTdYt9sFAZGFsf5P6nl4lzTOirOTOeRoCJEMH76w=";
+    fetchSubmodules = true;
+  };
+
+  postPatch = ''
+    substituteInPlace Builds/LinuxMakefile/Makefile \
+      --replace-fail '$(shell arch)' '${stdenv.hostPlatform.uname.processor}'
+  '';
+
+  nativeBuildInputs = [
+    pkg-config
+    ncurses
+  ];
+
+  buildInputs = [
+    alsa-lib
+    avahi
+    boost
+    curl
+    fftwFloat
+    freetype
+    glib
+    glibmm
+    libx11
+    libxcursor
+    libxext
+    libxinerama
+    libxrandr
+    lilv
+    libsndfile
+  ];
+
+  installFlags = [ "JUCE_VST3DESTDIR=${placeholder "out"}/lib/vst3" ];
+
+  meta = {
+    description = "Versatile (guitar) amplifier VST3 plugin";
+    homepage = "https://github.com/brummer10/guitarix.vst";
+    license = lib.licenses.gpl3Plus;
+    maintainers = [ lib.maintainers.eymeric ];
+    platforms = lib.platforms.linux;
+  };
+})
--- a/pkgs/by-name/ha/ha-mcp/package.nix
+++ b/pkgs/by-name/ha/ha-mcp/package.nix
@ -7,14 +7,14 @@

 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "ha-mcp";
-  version = "7.3.0";
+  version = "7.4.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "homeassistant-ai";
    repo = "ha-mcp";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-boWqv8lSN/UiqSRhVBgbucX+RC6q14Oa4WzkJPeZzVw=";
+    hash = "sha256-F13BoZinPnv+tlkiVnG7iAkr2JdEbFE0RIEgmHa/yq4=";
  };

  build-system = with python3Packages; [
--- a/pkgs/by-name/he/hexcurse/package.nix
+++ b/pkgs/by-name/he/hexcurse/package.nix
@ -3,6 +3,7 @@
  lib,
  fetchFromGitHub,
  fetchpatch,
+  fetchDebianPatch,
  ncurses,
 }:

@ -48,6 +49,15 @@ stdenv.mkDerivation (finalAttrs: {
      url = "https://github.com/LonnyGomes/hexcurse/commit/cb70d4a93a46102f488f471fad31a7cfc9fec025.patch";
      sha256 = "19674zhhp7gc097kl4bxvi0gblq6jzjy8cw8961svbq5y3hv1v5y";
    })
+
+    # Fix build with GCC 15 (old-style function definitions)
+    (fetchDebianPatch {
+      pname = "hexcurse";
+      version = "1.60.0";
+      debianRevision = "1";
+      patch = "gcc-15.patch";
+      hash = "sha256-nWwYjI18fsJ9LSby6OJoJ0QXENgyVbUY3LpEYWoCBkI=";
+    })
  ];

  meta = {
--- a/pkgs/by-name/ho/home-manager/package.nix
+++ b/pkgs/by-name/ho/home-manager/package.nix
@ -13,7 +13,6 @@
  ncurses,
  nixos-option,
  stdenvNoCC,
-  unixtools,
  unstableGitUpdater,
 }:

@ -94,7 +93,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    '';
    license = lib.licenses.mit;
    mainProgram = "home-manager";
-    maintainers = with lib.maintainers; [ bryango ];
+    maintainers = [ ];
    platforms = lib.platforms.unix;
  };
 })
--- a/pkgs/by-name/ht/htpdate/package.nix
+++ b/pkgs/by-name/ht/htpdate/package.nix
@ -5,14 +5,14 @@
 }:

 stdenv.mkDerivation (finalAttrs: {
-  version = "2.0.1";
+  version = "2.0.2";
  pname = "htpdate";

  src = fetchFromGitHub {
    owner = "twekkel";
    repo = "htpdate";
    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-dl3xlwk2q1DdGrIQsbKwdYDjyhGxpYwQGcd9k91LkxA=";
+    sha256 = "sha256-aDir0e/itYxo0wgKIyT2chEVyXgz6nd2JOuyo7Yq/js=";
  };

  makeFlags = [
--- a/pkgs/by-name/id/id3/fix-gcc15.patch
+++ b/pkgs/by-name/id/id3/fix-gcc15.patch
@ -0,0 +1,12 @@
+diff --git a/fileops.c b/fileops.c
+index 1e70af1..9017bd0 100644
+--- a/fileops.c
+++ b/fileops.c
+@@ -68,7 +68,6 @@ FILE *ftemp(char *templ, const char *mode)
+ #else
+     int fd = mkstemp(templ);
+     if(fd >= 0) {
+-        FILE* fdopen();                         /* in case -ansi is used */
+         if(f = fdopen(fd, mode)) return f;
+         close(fd);
+ #endif
--- a/pkgs/by-name/id/id3/package.nix
+++ b/pkgs/by-name/id/id3/package.nix
@ -16,6 +16,11 @@ stdenv.mkDerivation (finalAttrs: {
    hash = "sha256-+h1wwgTB7CpbjyUAK+9BNRhmy83D+1I+cZ70E1m3ENk=";
  };

+  patches = [
+    # https://github.com/squell/id3/pull/35
+    ./fix-gcc15.patch
+  ];
+
  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ libiconv ];

  makeFlags = [ "prefix=$(out)" ];
--- a/pkgs/by-name/im/immich-kiosk/package.nix
+++ b/pkgs/by-name/im/immich-kiosk/package.nix
@ -33,8 +33,8 @@ buildGoModule rec {
      ;
    pnpm = pnpm_9;
    sourceRoot = "${src.name}/frontend";
-    hash = "sha256-ELIbM+tWOGntv8XmNvRZ/Q2iSRq0g9Kv5LnkwLPisPM=";
-    fetcherVersion = 2;
+    hash = "sha256-8iKug4zsX3u0vS68osKRW6iOP+A3OdjI3yxNPIJaQqM=";
+    fetcherVersion = 3;
  };

  # Frontend is in a subdirectory
--- a/pkgs/by-name/in/inputplumber/package.nix
+++ b/pkgs/by-name/in/inputplumber/package.nix
@ -10,16 +10,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "inputplumber";
-  version = "0.76.1";
+  version = "0.77.0";

  src = fetchFromGitHub {
    owner = "ShadowBlip";
    repo = "InputPlumber";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-SkW79i1jutVwty18bWXJEUijDunHukF3Sxqm0VwzMz0=";
+    hash = "sha256-sSLazAjwkTu4Vns8Vs4Gx47WG8fYQYJX6zhk0p139q0=";
  };

-  cargoHash = "sha256-nHAdU/7JHPveOvUsXqdmUQtzET2Jv6T6PN83S7TwsIM=";
+  cargoHash = "sha256-OEpv09DipaGtmlUWmvl4+Hm3DyBvSRkZaGePDy14/OU=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/by-name/in/intercal/package.nix
+++ b/pkgs/by-name/in/intercal/package.nix
@ -3,37 +3,34 @@
  stdenv,
  fetchurl,
  fetchpatch,
-  pkg-config,
+  autoreconfHook,
  bison,
  flex,
  makeWrapper,
+  pkg-config,
 }:

 stdenv.mkDerivation rec {

  pname = "intercal";
-  version = "0.31";
+  version = "0.34";

  src = fetchurl {
    url = "http://catb.org/esr/intercal/intercal-${version}.tar.gz";
-    sha256 = "1z2gpa5rbqb7jscqlf258k0b0jc7d2zkyipb5csjpj6d3sw45n4k";
+    hash = "sha256-fvYUjDUd9mhGbi3L15UXci+RwzyqORWVcTfzgzcfjVU=";
  };

-  patches = [
-    # Pull patch pending upstream inclusion for -fno-common toolchains:
-    #   https://gitlab.com/esr/intercal/-/issues/4
-    (fetchpatch {
-      name = "fno-common.patch";
-      url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/dev-lang/c-intercal/files/c-intercal-31.0-no-common.patch?id=a110a98b4de6f280d770ba3cc92a4612326205a3";
-      sha256 = "03523fc40042r2ryq5val27prlim8pld4950qqpawpism4w3y1p2";
-    })
-  ];
+  postPatch = ''
+    # Workaround: https://gitlab.com/esr/intercal/-/work_items/9
+    substituteInPlace src/abcessh.in --replace-fail "#ifdef HAVE_STDARG_H" "#if 1"
+  '';

  nativeBuildInputs = [
-    pkg-config
+    autoreconfHook
    bison
    flex
    makeWrapper
+    pkg-config
  ];

  # Intercal invokes gcc, so we need an explicit PATH
--- a/Show more
+++ b/Show more