Merge staging-next into staging

2026-07-06 17:13:24 -05:00 · 2026-06-06 18:29:05 +00:00 · 2026-06-06 18:29:05 +00:00 · 7fa1388d2b
commit 7fa1388d2b
parent 0ff10a9001 fa883f75ec
87 changed files with 21792 additions and 15787 deletions
--- a/nixos/doc/manual/redirects.json
+++ b/nixos/doc/manual/redirects.json
@ -65,6 +65,42 @@
  "module-services-keycloak-unix-socket": [
    "index.html#module-services-keycloak-unix-socket"
  ],
+  "module-services-mautrix-discord": [
+    "index.html#module-services-mautrix-discord"
+  ],
+  "module-services-mautrix-discord-advanced": [
+    "index.html#module-services-mautrix-discord-advanced"
+  ],
+  "module-services-mautrix-discord-authentication": [
+    "index.html#module-services-mautrix-discord-authentication"
+  ],
+  "module-services-mautrix-discord-backfill": [
+    "index.html#module-services-mautrix-discord-backfill"
+  ],
+  "module-services-mautrix-discord-basic-example": [
+    "index.html#module-services-mautrix-discord-basic-example"
+  ],
+  "module-services-mautrix-discord-basic-usage": [
+    "index.html#module-services-mautrix-discord-basic-usage"
+  ],
+  "module-services-mautrix-discord-double-puppet": [
+    "index.html#module-services-mautrix-discord-double-puppet"
+  ],
+  "module-services-mautrix-discord-encryption": [
+    "index.html#module-services-mautrix-discord-encryption"
+  ],
+  "module-services-mautrix-discord-server-defaults": [
+    "index.html#module-services-mautrix-discord-server-defaults"
+  ],
+  "module-services-mautrix-discord-setup": [
+    "index.html#module-services-mautrix-discord-setup"
+  ],
+  "module-services-mautrix-discord-synapse": [
+    "index.html#module-services-mautrix-discord-synapse"
+  ],
+  "module-services-mautrix-discord-troubleshooting": [
+    "index.html#module-services-mautrix-discord-troubleshooting"
+  ],
  "module-services-tandoor-recipes-migrating-media-option-move": [
    "index.html#module-services-tandoor-recipes-migrating-media-option-move",
    "index.html#module-services-tandoor-recipes-migrating-media-option-1"
--- a/nixos/modules/services/desktop-managers/pantheon.nix
+++ b/nixos/modules/services/desktop-managers/pantheon.nix
@ -276,8 +276,7 @@ in
        ++ (with pkgs.pantheon; [
          elementary-files
          elementary-settings-daemon
-          # https://github.com/elementary/portals/issues/157
-          # xdg-desktop-portal-pantheon
+          xdg-desktop-portal-pantheon
        ])
      ) config.environment.pantheon.excludePackages;

--- a/nixos/modules/services/home-automation/matterjs-server.nix
+++ b/nixos/modules/services/home-automation/matterjs-server.nix
@ -123,5 +123,8 @@ in
    };
  };

-  meta.maintainers = with lib.maintainers; [ kranzes ];
+  meta.maintainers = with lib.maintainers; [
+    kranzes
+    marie
+  ];
 }
--- a/nixos/modules/services/matrix/mautrix-discord.md
+++ b/nixos/modules/services/matrix/mautrix-discord.md
@ -0,0 +1,156 @@
+# Mautrix-Discord {#module-services-mautrix-discord}
+
+*Source:* {file}`modules/services/matrix/mautrix-discord`
+
+*Upstream documentation:* <https://docs.mau.fi/bridges/go/discord/index.html>
+
+[Mautrix-Discord](https://github.com/mautrix/discord) is a Matrix-Discord bridge.
+
+## Basic Usage {#module-services-mautrix-discord-basic-usage}
+
+The common setup is to enable the bridge, point it at your homeserver, and set the permissions you want to allow:
+
+1. Set `services.mautrix-discord.enable` to `true`.
+2. Set `services.mautrix-discord.settings.homeserver.address` and `services.mautrix-discord.settings.homeserver.domain`.
+3. Override `services.mautrix-discord.settings.bridge.permissions` if the default relay permissions do not fit your deployment.
+
+The module provides sensible defaults for the appservice listener, registration tokens, and relay permissions.
+
+### Basic Example {#module-services-mautrix-discord-basic-example}
+
+```nix
+{
+  services.mautrix-discord = {
+    enable = true;
+    registerToSynapse = true;
+    settings = {
+      homeserver = {
+        address = "http://localhost:8008";
+        domain = "example.com";
+      };
+      bridge.permissions = {
+        "example.com" = "user";
+        "@admin:example.com" = "admin";
+      };
+    };
+  };
+}
+```
+
+### Server Defaults {#module-services-mautrix-discord-server-defaults}
+
+By default, the bridge listens on `http://localhost:29334` and generates its appservice tokens automatically.
+
+## Authentication {#module-services-mautrix-discord-authentication}
+
+If you want to store the bridge database outside the default SQLite file, set `settings.appservice.database` to use PostgreSQL instead of SQLite:
+
+```nix
+{
+  services.mautrix-discord.settings.appservice.database = {
+    type = "postgres";
+    uri = "postgresql:///mautrix-discord?host=/run/postgresql";
+  };
+}
+```
+
+If the connection needs a password, combine it with `services.mautrix-discord.environmentFile`:
+
+```nix
+{
+  services.mautrix-discord = {
+    environmentFile = "/run/secrets/mautrix-discord-env";
+    settings.appservice.database.uri = "postgresql://mautrix:$DB_PASSWORD@localhost/mautrix-discord";
+  };
+}
+```
+
+Use `services.mautrix-discord.environmentFile` for any secret you do not want in the Nix store.
+This includes database passwords, shared secrets, and similar values.
+
+Example:
+
+```nix
+{
+  services.mautrix-discord = {
+    environmentFile = "/run/secrets/mautrix-discord-env";
+    settings.bridge.login_shared_secret_map = {
+      "example.com" = "$SHARED_SECRET";
+    };
+  };
+}
+```
+
+## Bridge Setup {#module-services-mautrix-discord-setup}
+
+After the service starts, open a chat with `@discordbot:example.com`, send `login`, and follow the instructions to link your Discord account.
+
+For more detail, see the [Mautrix-Discord documentation](https://docs.mau.fi/bridges/go/discord/index.html).
+
+## Advanced Configuration {#module-services-mautrix-discord-advanced}
+
+The upstream default configuration is available at [example-config.yaml](https://github.com/mautrix/discord/blob/main/example-config.yaml). To print the generated default configuration from the package, run:
+
+```bash
+nix-shell -p mautrix-discord --run "mautrix-discord -e"
+```
+
+### Encryption {#module-services-mautrix-discord-encryption}
+
+```nix
+{
+  services.mautrix-discord.settings.bridge.encryption = {
+    allow = true;
+    default = true;
+    require = false;
+  };
+}
+```
+
+Encryption needs additional bridge-side setup. See the [bridge encryption documentation](https://docs.mau.fi/bridges/general/end-to-bridge-encryption.html) for details.
+
+### Backfill {#module-services-mautrix-discord-backfill}
+
+```nix
+{
+  services.mautrix-discord.settings.bridge.backfill.forward_limits.initial = {
+    dm = 50;
+    channel = 50;
+    thread = 50;
+  };
+}
+```
+
+### Double Puppeting {#module-services-mautrix-discord-double-puppet}
+
+```nix
+{
+  services.mautrix-discord = {
+    environmentFile = "/run/secrets/mautrix-discord-env";
+    settings.bridge.login_shared_secret_map = {
+      "example.com" = "$SHARED_SECRET";
+    };
+  };
+}
+```
+where  `/run/secrets/mautrix-discord-env` contains
+```
+SHARED_SECRET=aProtectedSecret
+```
+
+## Synapse Integration {#module-services-mautrix-discord-synapse}
+
+When `services.mautrix-discord.registerToSynapse` is `true`, the bridge writes its registration file automatically and Synapse picks it up.
+
+If Synapse is enabled, this option defaults to `true`.
+
+## Troubleshooting {#module-services-mautrix-discord-troubleshooting}
+
+- View logs with `journalctl -u mautrix-discord.service -f`.
+- Check `systemctl status mautrix-discord` if the bridge does not start.
+- Verify the homeserver can reach the configured appservice address.
+- Ensure the registration file exists and Synapse can read it.
+
+For more help, see the
+[Mautrix-Discord documentation](https://docs.mau.fi/bridges/go/discord/index.html)
+or the support room at [#discord:maunium.net](https://matrix.to/#/#discord:maunium.net).
--- a/nixos/modules/services/matrix/mautrix-discord.nix
+++ b/nixos/modules/services/matrix/mautrix-discord.nix
@ -5,15 +5,59 @@
  ...
 }:
 let
+  defaultDataDir = "/var/lib/mautrix-discord";
  cfg = config.services.mautrix-discord;
  dataDir = cfg.dataDir;
  format = pkgs.formats.yaml { };
+  serviceDependencies = [
+    "mautrix-discord-registration.service"
+  ]
+  ++ (lib.lists.optional config.services.matrix-synapse.enable config.services.matrix-synapse.serviceUnit)
+  ++ (lib.lists.optional config.services.matrix-conduit.enable "matrix-conduit.service")
+  ++ (lib.lists.optional config.services.dendrite.enable "dendrite.service");

  registrationFile = "${dataDir}/discord-registration.yaml";

  settingsFile = "${dataDir}/config.yaml";
  settingsFileUnformatted = format.generate "discord-config-unsubstituted.yaml" cfg.settings;
  default_token = "This value is generated when generating the registration";
+  settingsDefault = {
+    homeserver = {
+      address = "";
+      domain = "";
+    };
+
+    appservice = {
+      address = "http://localhost:29334";
+      hostname = "0.0.0.0";
+      port = 29334;
+      database = {
+        type = "sqlite3";
+        uri = "file:${defaultDataDir}/mautrix-discord.db?_txlock=immediate";
+      };
+      id = "discord";
+      bot = {
+        username = "discordbot";
+        displayname = "Discord bridge bot";
+        avatar = "mxc://maunium.net/nIdEykemnwdisvHbpxflpDlC";
+      };
+      as_token = default_token;
+      hs_token = default_token;
+    };
+
+    bridge.permissions."*" = "relay";
+
+    logging = {
+      min_level = "info";
+      writers = [
+        {
+          type = "stdout";
+          format = "pretty-colored";
+          time_format = " ";
+        }
+      ];
+    };
+  };
 in
 {
  options = {
@ -23,238 +67,14 @@ in
      package = lib.mkPackageOption pkgs "mautrix-discord" { };

      settings = lib.mkOption {
-        type = lib.types.submodule {
-          freeformType = format.type;
-
-          config = {
-            _module.args = { inherit cfg lib; };
-          };
-
-          options = {
-            homeserver = lib.mkOption {
-              type = lib.types.attrs;
-              default = {
-                software = "standard";
-                status_endpoint = null;
-                message_send_checkpoint_endpoint = null;
-                async_media = false;
-                websocket = false;
-                ping_interval_seconds = 0;
-              };
-              description = ''
-                fullDataDiration.
-                                See [example-config.yaml](https://github.com/mautrix/discord/blob/main/example-config.yaml)
-                                for more information.
-              '';
-            };
-
-            appservice = lib.mkOption {
-              type = lib.types.attrs;
-              default = {
-                address = "http://localhost:29334";
-                hostname = "0.0.0.0";
-                port = 29334;
-                database = {
-                  type = "sqlite3";
-                  uri = "file:/var/lib/mautrix-discord/mautrix-discord.db?_txlock=immediate";
-                  max_open_conns = 20;
-                  max_idle_conns = 2;
-                  max_conn_idle_time = null;
-                  max_conn_lifetime = null;
-                };
-                id = "discord";
-                bot = {
-                  username = "discordbot";
-                  displayname = "Discord bridge bot";
-                  avatar = "mxc://maunium.net/nIdEykemnwdisvHbpxflpDlC";
-                };
-                ephemeral_events = true;
-                async_transactions = false;
-                as_token = "This value is generated when generating the registration";
-                hs_token = "This value is generated when generating the registration";
-              };
-              defaultText = lib.literalExpression ''
-                {
-                  address = "http://localhost:29334";
-                  hostname = "0.0.0.0";
-                  port = 29334;
-                  database = {
-                    type = "sqlite3";
-                    uri = "file:''${config.services.mautrix-discord.dataDir}/mautrix-discord.db?_txlock=immediate";
-                    max_open_conns = 20;
-                    max_idle_conns = 2;
-                    max_conn_idle_time = null;
-                    max_conn_lifetime = null;
-                  };
-                  id = "discord";
-                  bot = {
-                    username = "discordbot";
-                    displayname = "Discord bridge bot";
-                    avatar = "mxc://maunium.net/nIdEykemnwdisvHbpxflpDlC";
-                  };
-                  ephemeral_events = true;
-                  async_transactions = false;
-                  as_token = "This value is generated when generating the registration";
-                  hs_token = "This value is generated when generating the registration";
-                }
-              '';
-              description = ''
-                Appservice configuration.
-                See [example-config.yaml](https://github.com/mautrix/discord/blob/main/example-config.yaml)
-                for more information.
-              '';
-            };
-
-            bridge = lib.mkOption {
-              type = lib.types.attrs;
-              default = {
-                username_template = "discord_{{.}}";
-                displayname_template = "{{if .Webhook}}Webhook{{else}}{{or .GlobalName .Username}}{{if .Bot}} (bot){{end}}{{end}}";
-                channel_name_template = "{{if or (eq .Type 3) (eq .Type 4)}}{{.Name}}{{else}}#{{.Name}}{{end}}";
-                guild_name_template = "{{.Name}}";
-                private_chat_portal_meta = "default";
-                public_address = null;
-                avatar_proxy_key = "generate";
-                portal_message_buffer = 128;
-                startup_private_channel_create_limit = 5;
-                delivery_receipts = false;
-                message_status_events = false;
-                message_error_notices = true;
-                restricted_rooms = true;
-                autojoin_thread_on_open = true;
-                embed_fields_as_tables = true;
-                mute_channels_on_create = false;
-                sync_direct_chat_list = false;
-                resend_bridge_info = false;
-                custom_emoji_reactions = true;
-                delete_portal_on_channel_delete = false;
-                delete_guild_on_leave = true;
-                federate_rooms = true;
-                prefix_webhook_messages = true;
-                enable_webhook_avatars = false;
-                use_discord_cdn_upload = true;
-                #proxy =
-                cache_media = "unencrypted";
-                direct_media = {
-                  enabled = false;
-                  #server_name = "discord-media.example.com";
-                  #well_known_response =
-                  allow_proxy = true;
-                  server_key = "generate";
-                };
-                animated_sticker = {
-                  target = "webp";
-                  args = {
-                    width = 320;
-                    height = 320;
-                    fps = 25;
-                  };
-                };
-                double_puppet_server_map = {
-                  #"example.com" = "https://example.com";
-                };
-                double_puppet_allow_discovery = false;
-                login_shared_secret_map = {
-                  #"example.com" = "foobar";
-                };
-                command_prefix = "!discord";
-                management_room_text = {
-                  welcome = "Hello, I'm a Discord bridge bot.";
-                  welcome_connected = "Use `help` for help.";
-                  welcome_unconnected = "Use `help` for help or `login` to log in.";
-                  additional_help = "";
-                };
-                backfill = {
-                  forward_limits = {
-                    initial = {
-                      dm = 0;
-                      channel = 0;
-                      thread = 0;
-                    };
-                    missed = {
-                      dm = 0;
-                      channel = 0;
-                      thread = 0;
-                    };
-                    max_guild_members = -1;
-                  };
-                };
-                encryption = {
-                  allow = false;
-                  default = false;
-                  appservice = false;
-                  msc4190 = false;
-                  require = false;
-                  allow_key_sharing = false;
-                  plaintext_mentions = false;
-                  delete_keys = {
-                    delete_outbound_on_ack = false;
-                    dont_store_outbound = false;
-                    ratchet_on_decrypt = false;
-                    delete_fully_used_on_decrypt = false;
-                    delete_prev_on_new_session = false;
-                    delete_on_device_delete = false;
-                    periodically_delete_expired = false;
-                    delete_outdated_inbound = false;
-                  };
-                  verification_levels = {
-                    receive = "unverified";
-                    send = "unverified";
-                    share = "cross-signed-tofu";
-                  };
-                  rotation = {
-                    enable_custom = false;
-                    milliseconds = 604800000;
-                    messages = 100;
-                    disable_device_change_key_rotation = false;
-                  };
-                };
-                provisioning = {
-                  prefix = "/_matrix/provision";
-                  shared_secret = "generate";
-                  debug_endpoints = false;
-                };
-                permissions = {
-                  "*" = "relay";
-                  #"example.com" = "user";
-                  #"@admin:example.com": "admin";
-                };
-              };
-              description = ''
-                Bridge configuration.
-                See [example-config.yaml](https://github.com/mautrix/discord/blob/main/example-config.yaml)
-                for more information.
-              '';
-            };
-            logging = lib.mkOption {
-              type = lib.types.attrs;
-              default = {
-                min_level = "info";
-                writers = lib.singleton {
-                  type = "stdout";
-                  format = "pretty-colored";
-                  time_format = " ";
-                };
-              };
-              description = ''
-                Logging configuration.
-                See [example-config.yaml](https://github.com/mautrix/discord/blob/main/example-config.yaml)
-                for more information.
-              '';
-            };
-          };
-        };
-        default = { };
+        apply = lib.recursiveUpdate settingsDefault;
+        type = format.type;
+        default = settingsDefault;
        example = lib.literalExpression ''
          {
            homeserver = {
              address = "http://localhost:8008";
-              domain = "public-domain.tld";
-            };
-
-            appservice.public = {
-              prefix = "/public";
-              external = "https://public-appservice-address/public";
+              domain = "example.com";
            };

            bridge.permissions = {
@ -265,8 +85,12 @@ in
        '';
        description = ''
          {file}`config.yaml` configuration as a Nix attribute set.
+
          Configuration options should match those described in
          [example-config.yaml](https://github.com/mautrix/discord/blob/main/example-config.yaml).
+
+          Secret tokens should be specified using {option}`environmentFile`
+          instead of this world-readable attribute set.
        '';
      };

@ -282,12 +106,9 @@ in

      dataDir = lib.mkOption {
        type = lib.types.path;
-        default = "/var/lib/mautrix-discord";
-        defaultText = "/var/lib/mautrix-discord";
-        description = ''
-          Directory to store the bridge's configuration and database files.
-          This directory will be created if it does not exist.
-        '';
+        default = defaultDataDir;
+        defaultText = defaultDataDir;
+        description = "Directory to store the bridge's data.";
      };

      # TODO: Get upstream to add an environment File option. Refer to https://github.com/NixOS/nixpkgs/pull/404871#issuecomment-2895663652 and https://github.com/mautrix/discord/issues/187
@ -295,92 +116,31 @@ in
        type = lib.types.nullOr lib.types.path;
        default = null;
        description = ''
-          File containing environment variables to substitute when copying the configuration
-          out of Nix store to the `services.mautrix-discord.dataDir`.
-          Can be used for storing the secrets without making them available in the Nix store.
-          For example, you can set `services.mautrix-discord.settings.appservice.as_token = "$MAUTRIX_DISCORD_APPSERVICE_AS_TOKEN"`
-          and then specify `MAUTRIX_DISCORD_APPSERVICE_AS_TOKEN="{token}"` in the environment file.
-          This value will get substituted into the configuration file as a token.
+          File containing environment variables for secret substitution.
+          Variables in the config like `$VARIABLE` will be replaced.
        '';
      };

-      serviceUnit = lib.mkOption {
-        type = lib.types.str;
-        readOnly = true;
-        default = "mautrix-discord.service";
-        description = ''
-          The systemd unit (a service or a target) for other services to depend on if they
-          need to be started after matrix-synapse.
-          This option is useful as the actual parent unit for all matrix-synapse processes
-          changes when configuring workers.
-        '';
-      };
-
-      registrationServiceUnit = lib.mkOption {
-        type = lib.types.str;
-        readOnly = true;
-        default = "mautrix-discord-registration.service";
-        description = ''
-          The registration service that generates the registration file.
-          Systemd unit (a service or a target) for other services to depend on if they
-          need to be started after mautrix-discord registration service.
-          This option is useful as the actual parent unit for all matrix-synapse processes
-          changes when configuring workers.
-        '';
-      };
-
-      serviceDependencies = lib.mkOption {
-        type = lib.types.listOf lib.types.str;
-        default = [
-          cfg.registrationServiceUnit
-        ]
-        ++ (lib.lists.optional config.services.matrix-synapse.enable config.services.matrix-synapse.serviceUnit)
-        ++ (lib.lists.optional config.services.matrix-conduit.enable "matrix-conduit.service")
-        ++ (lib.lists.optional config.services.dendrite.enable "dendrite.service");
-
-        defaultText = ''
-          [ cfg.registrationServiceUnit ] ++
-          (lib.lists.optional config.services.matrix-synapse.enable config.services.matrix-synapse.serviceUnit) ++
-          (lib.lists.optional config.services.matrix-conduit.enable "matrix-conduit.service") ++
-          (lib.lists.optional config.services.dendrite.enable "dendrite.service");
-        '';
-        description = ''
-          List of Systemd services to require and wait for when starting the application service.
-        '';
-      };
    };
  };
  config = lib.mkIf cfg.enable {
+
    assertions = [
      {
        assertion =
-          cfg.settings.homeserver.domain or "" != "" && cfg.settings.homeserver.address or "" != "";
-        message = ''
-          The options with information about the homeserver:
-          `services.mautrix-discord.settings.homeserver.domain` and
-          `services.mautrix-discord.settings.homeserver.address` have to be set.
-        '';
-      }
-      {
-        assertion = cfg.settings.bridge.permissions or { } != { };
-        message = ''
-          The option `services.mautrix-discord.settings.bridge.permissions` has to be set.
-        '';
+          cfg.settings.homeserver.address or "" != "" && cfg.settings.homeserver.domain or "" != "";
+        message = "services.mautrix-discord.settings.homeserver.{address,domain} must be set.";
      }
    ];

    users.users.mautrix-discord = {
      isSystemUser = true;
      group = "mautrix-discord";
-      extraGroups = [ "mautrix-discord-registration" ];
      home = dataDir;
      description = "Mautrix-Discord bridge user";
    };

    users.groups.mautrix-discord = { };
-    users.groups.mautrix-discord-registration = {
-      members = lib.lists.optional config.services.matrix-synapse.enable "matrix-synapse";
-    };

    services.matrix-synapse = lib.mkIf cfg.registerToSynapse {
      settings.app_service_config_files = [ registrationFile ];
@ -392,7 +152,9 @@ in

    systemd.services = {
      matrix-synapse = lib.mkIf cfg.registerToSynapse {
-        serviceConfig.SupplementaryGroups = [ "mautrix-discord-registration" ];
+        serviceConfig.SupplementaryGroups = [
+          "mautrix-discord"
+        ];
        # Make synapse depend on the registration service when auto-registering
        wants = [ "mautrix-discord-registration.service" ];
        after = [ "mautrix-discord-registration.service" ];
@ -471,15 +233,18 @@ in
            '${settingsFile}' '${registrationFile}' > '${registrationFile}.tmp'
          mv '${registrationFile}.tmp' '${registrationFile}'

+          # Application services should not be rate limited by default.
+          yq -Y '.rate_limited = false' '${registrationFile}' > '${registrationFile}.tmp'
+          mv '${registrationFile}.tmp' '${registrationFile}'
+
          umask $old_umask
-          chown :mautrix-discord-registration '${registrationFile}'
          chmod 640 '${registrationFile}'
        '';

        serviceConfig = {
          Type = "oneshot";
          RemainAfterExit = true;
-          UMask = 27;
+          UMask = "027";

          User = "mautrix-discord";
          Group = "mautrix-discord";
@ -501,8 +266,8 @@ in
        description = "Mautrix-Discord, a Matrix-Discord puppeting/relaybot bridge";

        wantedBy = [ "multi-user.target" ];
-        wants = [ "network-online.target" ] ++ cfg.serviceDependencies;
-        after = [ "network-online.target" ] ++ cfg.serviceDependencies;
+        wants = [ "network-online.target" ] ++ serviceDependencies;
+        after = [ "network-online.target" ] ++ serviceDependencies;
        path = [
          pkgs.lottieconverter
          pkgs.ffmpeg-headless
@ -536,6 +301,8 @@ in
          ProtectHostname = true;
          ProtectClock = true;

+          UMask = "027";
+
          SystemCallArchitectures = "native";
          SystemCallErrorNumber = "EPERM";
          SystemCallFilter = "@system-service";
@ -546,10 +313,12 @@ in
      };
    };

-    meta = {
-      maintainers = with lib.maintainers; [
-        mistyttm
-      ];
-    };
+  };
+
+  meta = {
+    maintainers = with lib.maintainers; [
+      mistyttm
+    ];
+    doc = ./mautrix-discord.md;
  };
 }
--- a/nixos/tests/matrix/mautrix-discord.nix
+++ b/nixos/tests/matrix/mautrix-discord.nix
@ -1,4 +1,4 @@
-{ pkgs, lib, ... }:
+{ pkgs, ... }:
 let
  homeserverUrl = "http://homeserver:8008";
 in
@ -53,6 +53,7 @@ in

            appservice = {
              address = "http://homeserver:8009";
+              hostname = "0.0.0.0";
              port = 8009;
              id = "discord";
              bot = {
@ -60,8 +61,6 @@ in
                displayname = "Discord bridge bot";
                avatar = "mxc://maunium.net/nIdEykemnwdisvHbpxflpDlC";
              };
-              # Don't override as_token/hs_token - let them use the default placeholder
-              # which will trigger automatic generation

              database = {
                type = "sqlite3";
@ -75,6 +74,17 @@ in
                "*" = "relay";
              };
            };
+
+            logging = {
+              min_level = "info";
+              writers = [
+                {
+                  type = "stdout";
+                  format = "pretty-colored";
+                  time_format = " ";
+                }
+              ];
+            };
          };
        };

@ -157,6 +167,57 @@ in
    with subtest("verify registration file was created"):
        homeserver.wait_until_succeeds("test -f /var/lib/mautrix-discord/discord-registration.yaml")

+        # Verify the module wrote the expected bridge configuration.
+        config_homeserver_address = homeserver.succeed("yq -r '.homeserver.address' /var/lib/mautrix-discord/config.yaml").strip()
+        config_homeserver_domain = homeserver.succeed("yq -r '.homeserver.domain' /var/lib/mautrix-discord/config.yaml").strip()
+        config_appservice_address = homeserver.succeed("yq -r '.appservice.address' /var/lib/mautrix-discord/config.yaml").strip()
+        config_appservice_hostname = homeserver.succeed("yq -r '.appservice.hostname' /var/lib/mautrix-discord/config.yaml").strip()
+        config_appservice_port = homeserver.succeed("yq -r '.appservice.port' /var/lib/mautrix-discord/config.yaml").strip()
+        config_appservice_id = homeserver.succeed("yq -r '.appservice.id' /var/lib/mautrix-discord/config.yaml").strip()
+        config_bot_username = homeserver.succeed("yq -r '.appservice.bot.username' /var/lib/mautrix-discord/config.yaml").strip()
+        config_bot_displayname = homeserver.succeed("yq -r '.appservice.bot.displayname' /var/lib/mautrix-discord/config.yaml").strip()
+        config_bot_avatar = homeserver.succeed("yq -r '.appservice.bot.avatar' /var/lib/mautrix-discord/config.yaml").strip()
+        config_database_type = homeserver.succeed("yq -r '.appservice.database.type' /var/lib/mautrix-discord/config.yaml").strip()
+        config_database_uri = homeserver.succeed("yq -r '.appservice.database.uri' /var/lib/mautrix-discord/config.yaml").strip()
+        config_permission = homeserver.succeed("yq -r '.bridge.permissions[\"*\"]' /var/lib/mautrix-discord/config.yaml").strip()
+        config_logging_min_level = homeserver.succeed("yq -r '.logging.min_level' /var/lib/mautrix-discord/config.yaml").strip()
+        config_logging_writer_type = homeserver.succeed("yq -r '.logging.writers[0].type' /var/lib/mautrix-discord/config.yaml").strip()
+        config_logging_writer_format = homeserver.succeed("yq -r '.logging.writers[0].format' /var/lib/mautrix-discord/config.yaml").strip()
+        reg_rate_limited = homeserver.succeed("yq -r '.rate_limited' /var/lib/mautrix-discord/discord-registration.yaml").strip()
+
+        assert config_homeserver_address == "http://homeserver:8008", \
+          f"Unexpected homeserver address: {config_homeserver_address}"
+        assert config_homeserver_domain == "homeserver", \
+          f"Unexpected homeserver domain: {config_homeserver_domain}"
+        assert config_appservice_address == "http://homeserver:8009", \
+          f"Unexpected appservice address: {config_appservice_address}"
+        assert config_appservice_hostname == "0.0.0.0", \
+          f"Unexpected appservice hostname: {config_appservice_hostname}"
+        assert config_appservice_port == "8009", \
+          f"Unexpected appservice port: {config_appservice_port}"
+        assert config_appservice_id == "discord", \
+          f"Unexpected appservice id: {config_appservice_id}"
+        assert config_bot_username == "discordbot", \
+          f"Unexpected bot username: {config_bot_username}"
+        assert config_bot_displayname == "Discord bridge bot", \
+          f"Unexpected bot displayname: {config_bot_displayname}"
+        assert config_bot_avatar == "mxc://maunium.net/nIdEykemnwdisvHbpxflpDlC", \
+          f"Unexpected bot avatar: {config_bot_avatar}"
+        assert config_database_type == "sqlite3-fk-wal", \
+          f"Unexpected database type: {config_database_type}"
+        assert config_database_uri == "file:/var/lib/mautrix-discord/mautrix-discord.db?_txlock=immediate", \
+          f"Unexpected database uri: {config_database_uri}"
+        assert config_permission == "relay", \
+          f"Unexpected default permission mapping: {config_permission}"
+        assert config_logging_min_level == "info", \
+          f"Unexpected logging min_level: {config_logging_min_level}"
+        assert config_logging_writer_type == "stdout", \
+          f"Unexpected logging writer type: {config_logging_writer_type}"
+        assert config_logging_writer_format == "pretty-colored", \
+          f"Unexpected logging writer format: {config_logging_writer_format}"
+        assert reg_rate_limited == "false", \
+          f"Registration file should disable rate limiting by default, got: {reg_rate_limited}"
+
        # Verify tokens were generated and are not default values
        config_as_token = homeserver.succeed("yq -r '.appservice.as_token' /var/lib/mautrix-discord/config.yaml").strip()
        config_hs_token = homeserver.succeed("yq -r '.appservice.hs_token' /var/lib/mautrix-discord/config.yaml").strip()
--- a/nixos/tests/qgis.nix
+++ b/nixos/tests/qgis.nix
@ -56,7 +56,7 @@ import ./make-test-python.nix (
              StandardError = "journal";
              StandardInput = "socket";
              Environment = [
-                "QT_QPA_PLATFORM_PLUGIN_PATH=${pkgs.libsForQt5.qt5.qtbase}/${pkgs.libsForQt5.qt5.qtbase.qtPluginPrefix}/platforms"
+                "QT_QPA_PLATFORM_PLUGIN_PATH=${pkgs.qt5.qtbase}/${pkgs.qt5.qtbase.qtPluginPrefix}/platforms"
                "QGIS_SERVER_LOG_LEVEL=0"
                "QGIS_SERVER_LOG_STDERR=1"
              ];
--- a/pkgs/applications/science/math/R/default.nix
+++ b/pkgs/applications/science/math/R/default.nix
@ -45,7 +45,7 @@ assert (!blas.isILP64) && (!lapack.isILP64);

 stdenv.mkDerivation (finalAttrs: {
  pname = "R";
-  version = "4.5.3";
+  version = "4.6.0";

  src =
    let
@ -53,7 +53,7 @@ stdenv.mkDerivation (finalAttrs: {
    in
    fetchurl {
      url = "https://cran.r-project.org/src/base/R-${lib.versions.major version}/${pname}-${version}.tar.gz";
-      hash = "sha256-qlwe1Ck8cnGsUT1lRnA1asDopq1eQr4BQ2XREVC1uPI=";
+      hash = "sha256-uNybRUNmDHtZa4eTjfUyOUNQNgl2Un00QijuDtEuRew=";
    };

  outputs = [
--- a/pkgs/applications/system/coolercontrol/coolercontrol-ui-data.nix
+++ b/pkgs/applications/system/coolercontrol/coolercontrol-ui-data.nix
@ -12,7 +12,7 @@ buildNpmPackage {
  sourceRoot = "${src.name}/coolercontrol-ui";

  npmDepsFetcherVersion = 2;
-  npmDepsHash = "sha256-fWsksBQCwHHWYE82NG0Vf/f+Hk02YMCUaGMHFGhGx2U=";
+  npmDepsHash = "sha256-zolbx5ROiFzNhPGcOnJjEiY3W2IXI24wLKPj3wRSLXU=";

  postBuild = ''
    cp -r dist $out
--- a/pkgs/applications/system/coolercontrol/coolercontrold.nix
+++ b/pkgs/applications/system/coolercontrol/coolercontrold.nix
@ -23,7 +23,7 @@ rustPlatform.buildRustPackage {
  inherit version src;
  sourceRoot = "${src.name}/coolercontrold";

-  cargoHash = "sha256-f0SsTwriUo2rD97L+Z/bq7UahOSLjYjH8bbXg/Hx5qE=";
+  cargoHash = "sha256-DE1m/odw90epyR8U9H1pxyJXariIHLXwk+mVYi8cu5A=";

  buildInputs = [
    hwdata
@ -37,6 +37,11 @@ rustPlatform.buildRustPackage {
    python3Packages.wrapPython
  ];

+  checkFlags = [
+    # This test has a build-machine dependency and will be removed from the normal test suite in the next release
+    "--skip=repositories::hwmon::hwmon_repo::coalescer_tests::fast_device_no_added_latency"
+  ];
+
  pythonPath = [ liquidctl ];

  postPatch = ''
--- a/pkgs/applications/system/coolercontrol/default.nix
+++ b/pkgs/applications/system/coolercontrol/default.nix
@ -5,13 +5,13 @@
 }:

 let
-  version = "4.3.0";
+  version = "4.3.1";

  src = fetchFromGitLab {
    owner = "coolercontrol";
    repo = "coolercontrol";
    tag = version;
-    hash = "sha256-hmxeqsCv0URBSe4sU637h4OYroLHQRcOtkFuyKoES7c=";
+    hash = "sha256-nFlaiQtc4r3FBmdhErUAucG3SQ1GWQX9ClnZXGVWjbc=";
  };

  meta = {
--- a/pkgs/by-name/an/animeko/package.nix
+++ b/pkgs/by-name/an/animeko/package.nix
@ -37,7 +37,7 @@
  libkate,
  librsvg,
  libxpm,
-  libsForQt5,
+  qt5,
  libupnp,
  aalib,
  libcaca,
@ -175,9 +175,9 @@ stdenv.mkDerivation (finalAttrs: {
    libkate
    librsvg
    libxpm
-    libsForQt5.qt5.qtsvg
-    libsForQt5.qt5.qtbase
-    libsForQt5.qt5.qtx11extras
+    qt5.qtsvg
+    qt5.qtbase
+    qt5.qtx11extras
    libupnp
    aalib
    libcaca
--- a/pkgs/by-name/an/ansel/package.nix
+++ b/pkgs/by-name/an/ansel/package.nix
@ -82,13 +82,13 @@ let
 in
 stdenv.mkDerivation {
  pname = "ansel";
-  version = "0-unstable-2026-05-26";
+  version = "0-unstable-2026-06-04";

  src = fetchFromGitHub {
    owner = "aurelienpierreeng";
    repo = "ansel";
-    rev = "8b076d84f00ac9aec09bbbeebc3c8bf888faab06";
-    hash = "sha256-UApU+O6HbOkMt3gCIjpD4weFa/koD7ZkcsnhsfL6mD8=";
+    rev = "05dc2ee4269f59143596f368acb83efd4c9da604";
+    hash = "sha256-1lR+xSBsq9N3R9gVJ+mvZxiPIQKFpFTybjQym/YJfqo=";
    fetchSubmodules = true;
  };

--- a/pkgs/by-name/ap/apm-cli/package.nix
+++ b/pkgs/by-name/ap/apm-cli/package.nix
@ -6,7 +6,7 @@

 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "apm-cli";
-  version = "0.15.0";
+  version = "0.18.0";
  pyproject = true;

  __structuredAttrs = true;
@ -15,7 +15,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
    owner = "microsoft";
    repo = "apm";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-xKY1ESX683uFqfiLqAK2ALpO+2NYs6ecqa4S639c1+k=";
+    hash = "sha256-mHu5r08y3OUTJjnl5Xvb23yhoJu9DupoZhkhL74K6UE=";
  };

  postPatch = ''
--- a/pkgs/by-name/ar/ardour/package.nix
+++ b/pkgs/by-name/ar/ardour/package.nix
@ -73,14 +73,14 @@ stdenv.mkDerivation (
  in
  {
    pname = "ardour";
-    version = "9.5";
+    version = "9.7";

    # We can't use `fetchFromGitea` here, as attempting to fetch release archives from git.ardour.org
    # result in an empty archive. See https://tracker.ardour.org/view.php?id=7328 for more info.
    src = fetchgit {
      url = "git://git.ardour.org/ardour/ardour.git";
      tag = finalAttrs.version;
-      hash = "sha256-Jaq1jgiGMmLeIw66RIXfZJxc+HCho2eGl5uEqAlNk6w=";
+      hash = "sha256-6gtlnk/oPXWJcN5tcb1r7dXyLpHPTSJwd8VfOjjFnWQ=";
    };

    bundledContent = fetchzip {
--- a/pkgs/by-name/as/asciidoctor-with-extensions/Gemfile
+++ b/pkgs/by-name/as/asciidoctor-with-extensions/Gemfile
@ -9,6 +9,7 @@ gem 'asciidoctor-pdf'
 gem 'asciidoctor-reducer'
 gem 'asciidoctor-revealjs'
 gem 'coderay'
+gem 'prawn-gmagick'
 gem 'pygments.rb'
 gem 'rouge'
 gem 'text-hyphen'
--- a/pkgs/by-name/as/asciidoctor-with-extensions/Gemfile.lock
+++ b/pkgs/by-name/as/asciidoctor-with-extensions/Gemfile.lock
@ -2,8 +2,8 @@ GEM
  remote: https://rubygems.org/
  specs:
    Ascii85 (2.0.1)
-    addressable (2.8.7)
-      public_suffix (>= 2.0.2, < 7.0)
+    addressable (2.9.0)
+      public_suffix (>= 2.0.2, < 8.0)
    afm (1.0.0)
    asciidoctor (2.0.26)
    asciidoctor-bibtex (0.9.0)
@ -12,7 +12,7 @@ GEM
      citeproc-ruby (~> 1)
      csl-styles (~> 1)
      latex-decode (~> 0.2)
-    asciidoctor-diagram (3.1.0)
+    asciidoctor-diagram (3.2.1)
      asciidoctor (>= 1.5.7, < 3.x)
      rexml
    asciidoctor-epub3 (2.3.0)
@ -55,33 +55,33 @@ GEM
      citeproc (~> 1.0, >= 1.0.9)
      csl (~> 1.6)
    coderay (1.1.3)
-    concurrent-ruby (1.3.5)
+    concurrent-ruby (1.3.6)
    csl (1.6.0)
      namae (~> 1.0)
      rexml
    csl-styles (1.0.1.11)
      csl (~> 1.0)
-    css_parser (1.21.1)
+    css_parser (1.22.0)
      addressable
-    date (3.5.0)
-    ffi (1.17.2)
-    forwardable (1.3.3)
+    date (3.5.1)
+    ffi (1.17.4)
+    forwardable (1.4.0)
    gepub (1.0.17)
      nokogiri (>= 1.8.2, < 2.0)
      rubyzip (> 1.1.1, < 2.4)
    hashery (2.1.2)
-    json (2.16.0)
-    latex-decode (0.4.0)
+    json (2.19.5)
+    latex-decode (0.4.2)
    logger (1.7.0)
    matrix (0.4.3)
    mime-types (3.7.0)
      logger
      mime-types-data (~> 3.2025, >= 3.2025.0507)
-    mime-types-data (3.2025.0924)
+    mime-types-data (3.2026.0414)
    mini_portile2 (2.8.9)
    namae (1.2.0)
      racc (~> 1.7)
-    nokogiri (1.18.10)
+    nokogiri (1.19.3)
      mini_portile2 (~> 2.8.2)
      racc (~> 1.4)
    observer (0.1.2)
@ -90,7 +90,7 @@ GEM
      time
      uri
    pdf-core (0.9.0)
-    pdf-reader (2.15.0)
+    pdf-reader (2.15.1)
      Ascii85 (>= 1.0, < 3.0, != 2.0.0)
      afm (>= 0.2.1, < 2)
      hashery (~> 2.0)
@ -100,6 +100,8 @@ GEM
    prawn (2.4.0)
      pdf-core (~> 0.9.0)
      ttfunk (~> 1.7)
+    prawn-gmagick (0.0.9)
+      prawn (>= 0.15, < 3.0)
    prawn-icon (3.0.0)
      prawn (>= 1.1.0, < 3.0.0)
    prawn-svg (0.34.2)
@ -112,14 +114,14 @@ GEM
    prawn-templates (0.1.2)
      pdf-reader (~> 2.0)
      prawn (~> 2.2)
-    public_suffix (6.0.2)
+    public_suffix (7.0.5)
    pygments.rb (4.0.0)
    racc (1.8.1)
    rb-fsevent (0.11.2)
    rb-inotify (0.11.1)
      ffi (~> 1.0)
    rexml (3.4.4)
-    rouge (4.6.1)
+    rouge (4.7.0)
    ruby-rc4 (0.1.5)
    rubyzip (2.3.2)
    sass (3.7.4)
@ -127,11 +129,11 @@ GEM
    sass-listen (4.0.0)
      rb-fsevent (~> 0.9, >= 0.9.4)
      rb-inotify (~> 0.9, >= 0.9.7)
-    stringio (3.1.8)
+    stringio (3.2.0)
    text-hyphen (1.5.0)
    thread_safe (0.3.6)
-    tilt (2.6.1)
-    time (0.4.1)
+    tilt (2.7.0)
+    time (0.4.2)
      date
    treetop (1.6.18)
      polyglot (~> 0.3)
@ -152,6 +154,7 @@ DEPENDENCIES
  asciidoctor-reducer
  asciidoctor-revealjs
  coderay
+  prawn-gmagick
  pygments.rb
  rouge
  text-hyphen
--- a/pkgs/by-name/as/asciidoctor-with-extensions/gemset.nix
+++ b/pkgs/by-name/as/asciidoctor-with-extensions/gemset.nix
@ -5,10 +5,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0cl2qpvwiffym62z991ynks7imsm87qmgxf0yfsmlwzkgi9qcaa6";
+      sha256 = "1by7h2lwziiblizpd5yx87jsq8ppdhzvwf08ga34wzqgcv1nmpvz";
      type = "gem";
    };
-    version = "2.8.7";
+    version = "2.9.0";
  };
  afm = {
    groups = [ "default" ];
@ -66,10 +66,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "15sc6yb4qyxy4v3bki26xn0j4k8rgjjiz3nwrxsprn6f0y6ysbp3";
+      sha256 = "113658j129myfg5y41zf94pkkfy8ysqvxdr2da2gf9x6y98x0cp4";
      type = "gem";
    };
-    version = "3.1.0";
+    version = "3.2.1";
  };
  asciidoctor-epub3 = {
    dependencies = [
@ -218,10 +218,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1ipbrgvf0pp6zxdk5ascp6i29aybz2bx9wdrlchjmpx6mhvkwfw1";
+      sha256 = "1aymcakhzl83k77g2f2krz07bg1cbafbcd2ghvwr4lky3rz86mkb";
      type = "gem";
    };
-    version = "1.3.5";
+    version = "1.3.6";
  };
  csl = {
    dependencies = [
@ -254,40 +254,40 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1izp5vna86s7xivqzml4nviy01bv76arrd5is8wkncwp1by3zzbc";
+      sha256 = "1ha0bcz71z48ahdvc0dp71apnbqnnpgffq0dac2q65y68259hx7j";
      type = "gem";
    };
-    version = "1.21.1";
+    version = "1.22.0";
  };
  date = {
    groups = [ "default" ];
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1rbfqkzr6i8b6538z16chvrkgywf5p5vafsgmnbmvrmh0ingsx2y";
+      sha256 = "1h0db8r2v5llxdbzkzyllkfniqw9gm092qn7cbaib73v9lw0c3bm";
      type = "gem";
    };
-    version = "3.5.0";
+    version = "3.5.1";
  };
  ffi = {
    groups = [ "default" ];
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "19kdyjg3kv7x0ad4xsd4swy5izsbb1vl1rpb6qqcqisr5s23awi9";
+      sha256 = "1kqasqvy8d7r09ri4n6bkdwbk63j7afd9ilsw34nzlgh0qp69ldw";
      type = "gem";
    };
-    version = "1.17.2";
+    version = "1.17.4";
  };
  forwardable = {
    groups = [ "default" ];
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1b5g1i3xdvmxxpq4qp0z4v78ivqnazz26w110fh4cvzsdayz8zgi";
+      sha256 = "0f78rjpnhm4lgp1qzadnr6kr02b6afh1lvy7w607k4qjk3641kgi";
      type = "gem";
    };
-    version = "1.3.3";
+    version = "1.4.0";
  };
  gepub = {
    dependencies = [
@ -318,20 +318,20 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "098m3q2jrx4xbf0knrbmflsynmmb5x9q9b0bzpmj7jmm1cr30mna";
+      sha256 = "0n9ch455pnvl9vxs2f3j77bpdmxg5g3mn3vyr9wxa0a87raii2i1";
      type = "gem";
    };
-    version = "2.16.0";
+    version = "2.19.5";
  };
  latex-decode = {
    groups = [ "default" ];
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1y5xn3zwghpqr6lvs4s0mn5knms8zw3zk7jb58zkkiagb386nq72";
+      sha256 = "14m5q817apv3kh2nc23b94i5mx0vxqfj7pm61j738piidr036mp8";
      type = "gem";
    };
-    version = "0.4.0";
+    version = "0.4.2";
  };
  logger = {
    groups = [ "default" ];
@ -372,10 +372,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0a27k4jcrx7pvb0p59fn1frh14iy087c2aygrdkmgwsrbshvqxpj";
+      sha256 = "1k28j6ww8rf43r5i8278jvm2cq3pnzsvqm7yqpb4p93kadjlq726";
      type = "gem";
    };
-    version = "3.2025.0924";
+    version = "3.2026.0414";
  };
  mini_portile2 = {
    groups = [ "default" ];
@ -407,10 +407,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1hcwwr2h8jnqqxmf8mfb52b0dchr7pm064ingflb78wa00qhgk6m";
+      sha256 = "1s30b7h7qpyim30m8060xs415mbr3ci7i5hdg09chh1aqfx2qcbq";
      type = "gem";
    };
-    version = "1.18.10";
+    version = "1.19.3";
  };
  observer = {
    groups = [ "default" ];
@ -459,10 +459,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "11h8dhhd2c8mxssibk9q6qn7ilj4p71crlfirw8pppn8pr85f0n5";
+      sha256 = "1kk8f1f5kkdwsbskv0vikcwx5xaivv19y9zl97x1fcaam23akihq";
      type = "gem";
    };
-    version = "2.15.0";
+    version = "2.15.1";
  };
  polyglot = {
    groups = [ "default" ];
@ -488,6 +488,17 @@
    };
    version = "2.4.0";
  };
+  prawn-gmagick = {
+    dependencies = [ "prawn" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0g7d9fm5hzswhdi3p0ms6vwpgnv7ip0hwgwifiaq9kb35xxc5vq9";
+      type = "gem";
+    };
+    version = "0.0.9";
+  };
  prawn-icon = {
    dependencies = [ "prawn" ];
    groups = [ "default" ];
@ -545,10 +556,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1543ap9w3ydhx39ljcd675cdz9cr948x9mp00ab8qvq6118wv9xz";
+      sha256 = "08znfv30pxmdkjyihvbjqbvv874dj3nybmmyscl958dy3f7v12qs";
      type = "gem";
    };
-    version = "6.0.2";
+    version = "7.0.5";
  };
  "pygments.rb" = {
    groups = [ "default" ];
@ -606,10 +617,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1pkp5icgm7s10b2n6b2pzbdsfiv0l5sxqyizx55qdmlpaxnk8xah";
+      sha256 = "0fd77qcz603mli4lyi97cjzkv02hsfk60m495qv5qcn02mkqk9fv";
      type = "gem";
    };
-    version = "4.6.1";
+    version = "4.7.0";
  };
  ruby-rc4 = {
    groups = [ "default" ];
@ -661,10 +672,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1v74k5yw7ndikr53wgbjn6j51p83qnzqbn9z4b53r102jcx3ri4r";
+      sha256 = "1q92y9627yisykyscv0bdsrrgyaajc2qr56dwlzx7ysgigjv4z63";
      type = "gem";
    };
-    version = "3.1.8";
+    version = "3.2.0";
  };
  text-hyphen = {
    groups = [ "default" ];
@ -691,10 +702,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0w27v04d7rnxjr3f65w1m7xyvr6ch6szjj2v5wv1wz6z5ax9pa9m";
+      sha256 = "1cvaikq1dcbfl008i16c1pi1gmdax7vfkvmhch64jdkakyk9nnqd";
      type = "gem";
    };
-    version = "2.6.1";
+    version = "2.7.0";
  };
  time = {
    dependencies = [ "date" ];
@ -702,10 +713,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0qgarmdyqypzsaanf4w9vqrd9axrcrjqilxwrfmxp954102kcpq3";
+      sha256 = "1arxpii25xgb3fkgqp5acyc0x6179j3qzld78lflgsdxqfcf897k";
      type = "gem";
    };
-    version = "0.4.1";
+    version = "0.4.2";
  };
  treetop = {
    dependencies = [ "polyglot" ];
--- a/pkgs/by-name/at/atril/package.nix
+++ b/pkgs/by-name/at/atril/package.nix
@ -33,14 +33,14 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "atril";
-  version = "1.28.5";
+  version = "1.28.6";

  src = fetchFromGitHub {
    owner = "mate-desktop";
    repo = "atril";
    tag = "v${finalAttrs.version}";
    fetchSubmodules = true;
-    hash = "sha256-iG+FFvxxL2/6HqGchoaIDqx8Gfo1wxqM4GW66ScZlao=";
+    hash = "sha256-d5wkMsO3iR3qudL6JXmybDWkdvRgc53FFuf9S6wPEtU=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/bi/bitbox/package.nix
+++ b/pkgs/by-name/bi/bitbox/package.nix
@ -6,7 +6,7 @@
  buildNpmPackage,
  clang,
  go,
-  libsForQt5,
+  qt5,
  qt6,
  udevCheckHook,
 }:
@ -16,7 +16,7 @@ let
  # it from Qt 5.
  rcc = runCommand "rcc" { } ''
    mkdir -p $out/bin
-    cp ${lib.getExe' libsForQt5.qt5.qtbase.dev "rcc"} $out/bin
+    cp ${lib.getExe' qt5.qtbase.dev "rcc"} $out/bin
  '';
 in
 stdenv.mkDerivation rec {
--- a/pkgs/by-name/bu/buildkite-agent/package.nix
+++ b/pkgs/by-name/bu/buildkite-agent/package.nix
@ -14,16 +14,16 @@
 }:
 buildGoModule (finalAttrs: {
  pname = "buildkite-agent";
-  version = "3.127.0";
+  version = "3.127.1";

  src = fetchFromGitHub {
    owner = "buildkite";
    repo = "agent";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-pFB36R3WESjljn1oeDvq+G6X26sFn6rbHR2Q0iLDzAc=";
+    hash = "sha256-nG7pvoQfVQrrF+s8Ghc4OITXtW1D0dPAuU3Ef7yDr7E=";
  };

-  vendorHash = "sha256-lS12eJhIIc0Vi8k4W+NmQFxXBbHSkO+gzcFA6yoYc3U=";
+  vendorHash = "sha256-Ow2nQAf0G4vsY167S0SbXhPnB6y1qRSf0+EFNPrC2CE=";

  postPatch = ''
    substituteInPlace clicommand/agent_start.go --replace /bin/bash ${bash}/bin/bash
--- a/pkgs/by-name/ca/caneda/package.nix
+++ b/pkgs/by-name/ca/caneda/package.nix
@ -27,7 +27,7 @@ stdenv.mkDerivation (finalAttrs: {

  nativeBuildInputs = [
    cmake
-    libsForQt5.qt5.wrapQtAppsHook
+    libsForQt5.wrapQtAppsHook
  ];

  buildInputs = [
--- a/pkgs/by-name/ch/chiri/package.nix
+++ b/pkgs/by-name/ch/chiri/package.nix
@ -7,9 +7,9 @@

  # build tools
  cargo-tauri,
-  nodejs_22,
+  nodejs_26,
  pnpmConfigHook,
-  pnpm_10,
+  pnpm_11,
  fetchPnpmDeps,
  pkg-config,
  makeBinaryWrapper,
@ -24,29 +24,29 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "chiri";
-  version = "0.8.1";
+  version = "0.9.0";

  src = fetchFromGitHub {
-    owner = "SapphoSys";
+    owner = "chiriapp";
    repo = "chiri";
    tag = "app-v${finalAttrs.version}";
-    hash = "sha256-45a1mmh8dxrWw+UQzJcbPAujFjCYC4ovsGhdAn39LkI=";
+    hash = "sha256-xlB7VqHXBljOjOOK96hK3HYENsuICMqRqfgJdtEnlUI=";
  };

-  cargoHash = "sha256-TLYiCdkF/uX3uIVwplI7L1b7Ta5LTRdKqFlmnvCxFFc=";
+  cargoHash = "sha256-MTPd8HqbU35wmYVCv8HtfAuooBPsZk+p5J2Y5HjHTsA=";

  pnpmDeps = fetchPnpmDeps {
    inherit (finalAttrs) pname version src;
-    pnpm = pnpm_10;
-    hash = "sha256-jDSljbGzEGDl0PsnjdmyhIGXX4fUPVeCndv5pUm/utE=";
+    pnpm = pnpm_11;
+    hash = "sha256-dxfoo5Ajjt7zUsdQojXhePHp0K2itpdjequvGqqnZ7k=";
    fetcherVersion = 3;
  };

  nativeBuildInputs = [
    cargo-tauri.hook
-    nodejs_22
+    nodejs_26
    pnpmConfigHook
-    pnpm_10
+    pnpm_11
    pkg-config
  ]
  ++ lib.optionals stdenv.hostPlatform.isLinux [
@ -98,8 +98,15 @@ rustPlatform.buildRustPackage (finalAttrs: {
    else
      ''
        mv $out/bin/Chiri $out/bin/chiri
-        substituteInPlace $out/share/applications/Chiri.desktop \
-          --replace-fail "Exec=Chiri" "Exec=chiri"
+        for desktopFile in \
+          $out/share/applications/Chiri.desktop \
+          $out/share/applications/garden.chiri.Chiri.desktop
+        do
+          if [ -f "$desktopFile" ]; then
+            substituteInPlace "$desktopFile" \
+              --replace-fail "Exec=Chiri" "Exec=chiri"
+          fi
+        done
      '';

  doCheck = false;
@ -108,8 +115,8 @@ rustPlatform.buildRustPackage (finalAttrs: {

  meta = {
    description = "Cross-platform CalDAV task management app";
-    homepage = "https://github.com/SapphoSys/chiri";
-    changelog = "https://github.com/SapphoSys/chiri/releases/tag/app-v${finalAttrs.version}";
+    homepage = "https://github.com/chiriapp/chiri";
+    changelog = "https://github.com/chiriapp/chiri/releases/tag/app-v${finalAttrs.version}";
    license = lib.licenses.zlib;
    maintainers = with lib.maintainers; [ SapphoSys ];
    mainProgram = "chiri";
--- a/pkgs/by-name/ds/dsremote/package.nix
+++ b/pkgs/by-name/ds/dsremote/package.nix
@ -2,7 +2,7 @@
  lib,
  stdenv,
  fetchFromGitLab,
-  libsForQt5,
+  qt5,
 }:
 stdenv.mkDerivation {
  pname = "dsremote";
@ -16,9 +16,9 @@ stdenv.mkDerivation {
  };

  nativeBuildInputs = [
-    libsForQt5.qmake
-    libsForQt5.qt5.wrapQtAppsHook
-    libsForQt5.qt5.qtbase
+    qt5.qmake
+    qt5.wrapQtAppsHook
+    qt5.qtbase
  ];

  hardeningDisable = [ "fortify" ];
--- a/pkgs/by-name/fo/forgejo-cli/package.nix
+++ b/pkgs/by-name/fo/forgejo-cli/package.nix
@ -10,11 +10,14 @@
  oniguruma,
  openssl,
  zlib,
+  versionCheckHook,
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "forgejo-cli";
  version = "0.5.0";

+  __structuredAttrs = true;
+
  src = fetchFromCodeberg {
    owner = "forgejo-contrib";
    repo = "forgejo-cli";
@ -49,6 +52,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
      --zsh <($out/bin/fj completion zsh)
  '';

+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "version";
+  doInstallCheck = true;
+
  meta = {
    description = "CLI application for interacting with Forgejo";
    homepage = "https://codeberg.org/forgejo-contrib/forgejo-cli";
--- a/pkgs/by-name/gl/glab/package.nix
+++ b/pkgs/by-name/gl/glab/package.nix
@ -13,13 +13,13 @@

 buildGoModule (finalAttrs: {
  pname = "glab";
-  version = "1.99.0";
+  version = "1.101.0";

  src = fetchFromGitLab {
    owner = "gitlab-org";
    repo = "cli";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-RDOBNZIbHTA1vuOvNVBSzKKxe8kvy6sx1oVGd7fdFuo=";
+    hash = "sha256-K8QL9Ff5FHmiXyBEdsUE8kwhSF0camSFh08LbfJb3wo=";
    leaveDotGit = true;
    postFetch = ''
      cd "$out"
@ -28,7 +28,7 @@ buildGoModule (finalAttrs: {
    '';
  };

-  vendorHash = "sha256-82BAOGylNXjGh1nOPqc4yNKoFHUgarTgjwlM31kih0I=";
+  vendorHash = "sha256-u1zvzMrQGyTVcl/lnIGK3dfisxGYRa2LGpDMBDq6rJk=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/gr/graphite/package.nix
+++ b/pkgs/by-name/gr/graphite/package.nix
@ -30,12 +30,12 @@
 }:

 let
-  version = "0-unstable-2026-05-25";
-  rev = "bbbe04903f28673a86203910b250bf12f3d38b55";
+  version = "0-unstable-2026-06-06";
+  rev = "2c29d2c40614a0ea51b8be113daba2f7f54c4209";

-  srcHash = "sha256-aEOH0NFUIt0iQNKNlAdKXobVPqbZbeQYB96lDzEsJ3U=";
+  srcHash = "sha256-0arLP1xUAZRUezNkTvxuVLn470Zl7EKlGecdBb5xw0Q=";
  shaderHash = "sha256-4lKBrGh1rfhTBczmCDvIF2KxLyEHzHdKVGgQ+jLd/Dw=";
-  cargoHash = "sha256-iW1hk67zexp/b7HO4q4le8/7ARIn+/VJIZ54RBau238=";
+  cargoHash = "sha256-LAb279Acwl57aY5ijJ70c9rRMrBLGpGJ7Q5gVnEcRT0=";
  npmHash = "sha256-AX5Jqk2E+WyQJyHbgvvq74MRsYmWUju4bOkabhYoeig=";

  brandingRev = "0d004aa61e6b48d316e8e5db6d59ccc4788f192d";
--- a/pkgs/by-name/hu/hubble/package.nix
+++ b/pkgs/by-name/hu/hubble/package.nix
@ -9,13 +9,13 @@

 buildGoModule rec {
  pname = "hubble";
-  version = "1.19.3";
+  version = "1.19.4";

  src = fetchFromGitHub {
    owner = "cilium";
    repo = "hubble";
    tag = "v${version}";
-    hash = "sha256-aqHFSb0q3WyBP8uPfA02vWKvMCiO9n4MYOL4o/twlIE=";
+    hash = "sha256-/O2w8AMEt5kKCpUKjknRIY2i/Do+i3gCCPOa384xgp8=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/id/ideamaker/package.nix
+++ b/pkgs/by-name/id/ideamaker/package.nix
@ -12,7 +12,7 @@
  lib,
  libGLU,
  libpsl,
-  libsForQt5,
+  qt5,
  libredirect,
  libx11,
  lz4,
@ -55,8 +55,8 @@ stdenv.mkDerivation {
    gtk3
    nghttp2
    libpsl
-    libsForQt5.qtbase
-    libsForQt5.qt5.qtwayland
+    qt5.qtbase
+    qt5.qtwayland
  ];

  installPhase = ''
--- a/pkgs/by-name/in/inspircd/package.nix
+++ b/pkgs/by-name/in/inspircd/package.nix
@ -151,13 +151,13 @@ in

 stdenv.mkDerivation (finalAttrs: {
  pname = "inspircd";
-  version = "4.10.1";
+  version = "4.11.0";

  src = fetchFromGitHub {
    owner = "inspircd";
    repo = "inspircd";
    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-5KQcVa/ktA3mil7fuBUj/98bAY5CsrJzSSqRB9Zk0Kk=";
+    sha256 = "sha256-YrPKjc5fWR4VyA+ahWwjSQvZXNfWP0++XujOsUQwTB0=";
  };

  outputs = [
--- a/pkgs/by-name/in/insync/package.nix
+++ b/pkgs/by-name/in/insync/package.nix
@ -12,7 +12,7 @@
  libgcrypt,
  xkeyboard_config,
  libthai,
-  libsForQt5,
+  qt5,
 }:

 let
@ -36,7 +36,7 @@ let
    nativeBuildInputs = [
      dpkg
      autoPatchelfHook
-      libsForQt5.qt5.wrapQtAppsHook
+      qt5.wrapQtAppsHook
    ];

    buildInputs = [
@ -46,7 +46,7 @@ let
      libgcrypt
      libthai
    ]
-    ++ (with libsForQt5; [ qt5.qtvirtualkeyboard ]);
+    ++ [ qt5.qtvirtualkeyboard ];

    installPhase = ''
      runHook preInstall
--- a/pkgs/by-name/ke/keep-sorted/package.nix
+++ b/pkgs/by-name/ke/keep-sorted/package.nix
@ -8,13 +8,13 @@

 buildGoModule (finalAttrs: {
  pname = "keep-sorted";
-  version = "0.8.0";
+  version = "0.9.0";

  src = fetchFromGitHub {
    owner = "google";
    repo = "keep-sorted";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-/j7gtjSTLDNPBlpcvRBlCyEx0cjBb9Iy7iCzMRM3TE4=";
+    hash = "sha256-mp8Zr5K+PFRurEbOT/t7wlsmvfF9xUYho7MlFOO3BSU=";
  };

  vendorHash = "sha256-yocIoS0MknQt7Zz347W9bv63L1xaPBgkZOcpf0lhXBg=";
--- a/pkgs/by-name/li/librewolf-unwrapped/librewolf.nix
+++ b/pkgs/by-name/li/librewolf-unwrapped/librewolf.nix
@ -1,4 +1,9 @@
-{ callPackage, runCommand }:
+{
+  callPackage,
+  runCommand,
+  lib,
+  stdenv,
+}:
 let
  src = callPackage ./src.nix { };
 in
@ -14,6 +19,8 @@ rec {
    # Flags based on discussion in https://github.com/NixOS/nixpkgs/issues/482250
    "--disable-debug"
    "--disable-debug-symbols"
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [
    "--enable-lto=thin,cross"
  ];

--- a/pkgs/by-name/lm/lmms/package.nix
+++ b/pkgs/by-name/lm/lmms/package.nix
@ -17,7 +17,6 @@
  libjack2,
  libogg,
  libpulseaudio,
-  libsForQt5,
  libsamplerate,
  libsoundio,
  libsndfile,
@ -73,16 +72,16 @@ stdenv.mkDerivation (finalAttrs: {

  nativeBuildInputs = [
    cmake
-    libsForQt5.qt5.qttools
+    qt5.qttools
    pkg-config
    qt5.wrapQtAppsHook
  ];

  buildInputs = [
    fftwFloat
-    libsForQt5.qt5.qtbase
-    libsForQt5.qt5.qtsvg
-    libsForQt5.qt5.qtx11extras
+    qt5.qtbase
+    qt5.qtsvg
+    qt5.qtx11extras
    libsamplerate
    libsndfile
  ]
--- a/pkgs/by-name/ma/magicq/package.nix
+++ b/pkgs/by-name/ma/magicq/package.nix
@ -12,7 +12,6 @@
  libGLU,
  libarchive,
  libgcc,
-  libsForQt5,
  qt5,
  libusb-compat-0_1,
  libusb1,
@ -45,8 +44,8 @@ stdenv.mkDerivation (finalAttrs: {
    libGLU
    libarchive
    libgcc
-    libsForQt5.qt5.qtbase
-    libsForQt5.qt5.qtmultimedia
+    qt5.qtbase
+    qt5.qtmultimedia
    qt5.qtbase
    libusb-compat-0_1
    libusb1
--- a/pkgs/by-name/ma/matrix-synapse-unwrapped/package.nix
+++ b/pkgs/by-name/ma/matrix-synapse-unwrapped/package.nix
@ -14,14 +14,14 @@

 python3Packages.buildPythonApplication rec {
  pname = "matrix-synapse";
-  version = "1.153.0";
+  version = "1.154.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "element-hq";
    repo = "synapse";
    rev = "v${version}";
-    hash = "sha256-2/KzRPUMfOOmI8j8WZsVU2ubNxidTb+FW0MZF+ktSSQ=";
+    hash = "sha256-4US6PPJAI0UUOmy12thjXKX3IRUCH9w/zkRD3ivQ9BE=";
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
--- a/pkgs/by-name/ma/matterjs-server/package.nix
+++ b/pkgs/by-name/ma/matterjs-server/package.nix
@ -72,7 +72,10 @@ buildNpmPackage (finalAttrs: {
    homepage = "https://github.com/matter-js/matterjs-server";
    changelog = "https://github.com/matter-js/matterjs-server/blob/${finalAttrs.src.rev}/CHANGELOG.md";
    license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ kranzes ];
+    maintainers = with lib.maintainers; [
+      kranzes
+      marie
+    ];
    mainProgram = "matterjs-server";
    platforms = lib.platforms.linux;
  };
--- a/pkgs/by-name/ne/netbird-dashboard/package.nix
+++ b/pkgs/by-name/ne/netbird-dashboard/package.nix
@ -6,13 +6,13 @@

 buildNpmPackage rec {
  pname = "netbird-dashboard";
-  version = "2.38.1";
+  version = "2.39.0";

  src = fetchFromGitHub {
    owner = "netbirdio";
    repo = "dashboard";
    rev = "v${version}";
-    hash = "sha256-YaBrFY8zOH3iAcs+JNISchDwAY9ts7UwPXX1QoMWSxU=";
+    hash = "sha256-9sSK9RBbe+u/sNt/5nsYJgS8QdBNdHMFUTrSggZiLos=";
  };

  npmDepsHash = "sha256-Ze+1r5Uh+wdm3MuVr93oS2itodx9Zdv+JYO6Uji1saw=";
--- a/pkgs/by-name/ne/netbird/package.nix
+++ b/pkgs/by-name/ne/netbird/package.nix
@ -73,16 +73,16 @@ let
 in
 buildGoModule (finalAttrs: {
  pname = "netbird-${componentName}";
-  version = "0.71.4";
+  version = "0.72.1";

  src = fetchFromGitHub {
    owner = "netbirdio";
    repo = "netbird";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-e/fe4wEjz7apA5RZ4nGIaunp0+5NVH4yMHK/l/MfcWI=";
+    hash = "sha256-f78zf6uihFyz4H8/ZXk2rfO8nln+HMNIV5/yQHRpdQI=";
  };

-  vendorHash = "sha256-NeZuj9o2yu5di+6jbNqCnAw0fI55GA5Otmr77c08QFc=";
+  vendorHash = "sha256-gxSf2X7IsZecvfM2xGE5Y1jZgvaKaRG780MRkZKFkHg=";

  nativeBuildInputs = [ installShellFiles ] ++ lib.optional (componentName == "ui") pkg-config;

--- a/pkgs/by-name/oc/oci-cli/package.nix
+++ b/pkgs/by-name/oc/oci-cli/package.nix
@ -31,14 +31,14 @@ in

 py.pkgs.buildPythonApplication (finalAttrs: {
  pname = "oci-cli";
-  version = "3.84.0";
+  version = "3.85.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "oracle";
    repo = "oci-cli";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-YIr0PX+qw+0bnBr8UcFlQ/m1u0yPDtX4nSRuGIjOdbY=";
+    hash = "sha256-10KIrd6ZI56YiqNzmo/f5jUEp5YZF5JUN6NPzbgnq9w=";
  };

  nativeBuildInputs = [ installShellFiles ];
--- a/pkgs/by-name/oc/ocs-url/package.nix
+++ b/pkgs/by-name/oc/ocs-url/package.nix
@ -2,7 +2,7 @@
  lib,
  stdenv,
  fetchgit,
-  libsForQt5,
+  qt5,
 }:

 let
@ -37,12 +37,12 @@ stdenv.mkDerivation {
    cp -r ${qtil_src.name}/* $sourceRoot/lib/qtil/
  '';

-  buildInputs = with libsForQt5.qt5; [
-    qtbase
-    qtsvg
-    qtquickcontrols
-    qmake
-    wrapQtAppsHook
+  buildInputs = [
+    qt5.qtbase
+    qt5.qtsvg
+    qt5.qtquickcontrols
+    qt5.qmake
+    qt5.wrapQtAppsHook
  ];

  meta = {
--- a/pkgs/by-name/op/openscad-unstable/package.nix
+++ b/pkgs/by-name/op/openscad-unstable/package.nix
@ -72,52 +72,49 @@ clangStdenv.mkDerivation rec {
    bison
    cmake
    flex
-    libsForQt5.qt5.wrapQtAppsHook
+    libsForQt5.wrapQtAppsHook
    llvmPackages.bintools
    wrapGAppsHook3
    ninja
    pkg-config
  ];
-  buildInputs =
-    with libsForQt5;
-    with qt5;
-    [
-      catch2_3
-      clipper2
-      glm
-      onetbb
-      mimalloc
-      boost
-      cairo
-      cgal
-      double-conversion
-      eigen
-      fontconfig
-      freetype
-      glib
-      gmp
-      opencsg
-      harfbuzz
-      hidapi
-      lib3mf
-      libspnav
-      libzip
-      manifold
-      mpfr
-      qscintilla
-      qtbase
-      qtmultimedia
-    ]
-    ++ lib.optionals clangStdenv.hostPlatform.isLinux [
-      libxdmcp
-      libice
-      libsm
-      wayland
-      wayland-protocols
-      qtwayland
-      libGLU
-    ]
-    ++ lib.optional clangStdenv.hostPlatform.isDarwin qtmacextras;
+  buildInputs = [
+    catch2_3
+    clipper2
+    glm
+    onetbb
+    mimalloc
+    boost
+    cairo
+    cgal
+    double-conversion
+    eigen
+    fontconfig
+    freetype
+    glib
+    gmp
+    opencsg
+    harfbuzz
+    hidapi
+    lib3mf
+    libspnav
+    libzip
+    manifold
+    mpfr
+    libsForQt5.qscintilla
+    libsForQt5.qtbase
+    libsForQt5.qtmultimedia
+  ]
+  ++ lib.optionals clangStdenv.hostPlatform.isLinux [
+    libxdmcp
+    libice
+    libsm
+    wayland
+    wayland-protocols
+    libsForQt5.qtwayland
+    libGLU
+  ]
+  ++ lib.optional clangStdenv.hostPlatform.isDarwin libsForQt5.qtmacextras;
  cmakeFlags = [
    "-DEXPERIMENTAL=ON" # enable experimental options
    "-DSNAPSHOT=ON" # nightly icons
--- a/pkgs/by-name/pa/palemoon-bin/package.nix
+++ b/pkgs/by-name/pa/palemoon-bin/package.nix
@ -5,7 +5,6 @@
  alsa-lib,
  autoPatchelfHook,
  copyDesktopItems,
-  dbus-glib,
  # ffmpeg 7 not supported yet, results in MP4 playback being unavailable
  # https://repo.palemoon.org/MoonchildProductions/UXP/issues/2523
  ffmpeg_6,
@ -23,7 +22,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "palemoon-bin";
-  version = "34.2.2";
+  version = "34.3.0";

  src = finalAttrs.passthru.sources."gtk${if withGTK3 then "3" else "2"}";

@ -39,7 +38,6 @@ stdenv.mkDerivation (finalAttrs: {

  buildInputs = [
    alsa-lib
-    dbus-glib
    gtk2-x11
    libxt
    (lib.getLib stdenv.cc.cc)
@ -173,11 +171,11 @@ stdenv.mkDerivation (finalAttrs: {
      {
        gtk3 = fetchzip {
          urls = urlRegionVariants "gtk3";
-          hash = "sha256-KUlok5T+gf1qgRdivCx2uLijyO0bfurLHfrIgELK//A=";
+          hash = "sha256-yoZqZJLxgDIxIeyrn6VW6c6iKpU84ZDsJbCz3yf4gdU=";
        };
        gtk2 = fetchzip {
          urls = urlRegionVariants "gtk2";
-          hash = "sha256-iSQDrlLkTxHNFFZC5X/OKMem2Zk213it1Ki7ADw+Opg=";
+          hash = "sha256-QhrW1ZD1ouPvWJLvnIEMHgTViGNBshFlT6Ax0l0xGv8=";
        };
      };

--- a/pkgs/by-name/ph/phpactor/package.nix
+++ b/pkgs/by-name/ph/phpactor/package.nix
@ -7,16 +7,16 @@
 }:
 php.buildComposerProject2 (finalAttrs: {
  pname = "phpactor";
-  version = "2025.12.21.1";
+  version = "2026.05.30.1";

  src = fetchFromGitHub {
    owner = "phpactor";
    repo = "phpactor";
    tag = finalAttrs.version;
-    hash = "sha256-9hkYU/Mhxl49tIZa3Vyj3kXftNIgZXUlH1T6/4obM7I=";
+    hash = "sha256-Harrs0SM00MVBicMfvs3bcLQf/PSTp6k7hcEExGELWE=";
  };

-  vendorHash = "sha256-XsybPL391WGHztWPaZAN1l2hWQMQ0tklZ9yjkKjGzsI=";
+  vendorHash = "sha256-PztP3qN6LL+1UshNyuJof0WT9Dg5MfXwfQr57kBG9hM=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/by-name/pi/pizauth/package.nix
+++ b/pkgs/by-name/pi/pizauth/package.nix
@ -2,7 +2,7 @@
  lib,
  rustPlatform,
  fetchFromGitHub,
-  installShellFiles,
+  stdenv,
  nix-update-script,
 }:

@ -19,18 +19,8 @@ rustPlatform.buildRustPackage (finalAttrs: {

  cargoHash = "sha256-9cDVbDCb8vY6KxreyiMX3gp13bXZpxTQOwYbk6TEVpc=";

-  nativeBuildInputs = [ installShellFiles ];
-
  postInstall = ''
-    installShellCompletion --cmd pizauth \
-      --bash share/bash/completion.bash \
-      --fish share/fish/pizauth.fish
-
-    installManPage pizauth.1 pizauth.conf.5
-
-    substituteInPlace lib/systemd/user/pizauth.service \
-      --replace-fail /usr/bin/pizauth "$out/bin/pizauth"
-    install -Dm444 lib/systemd/user/pizauth{,-*}.service -t $out/lib/systemd/user
+    make PREFIX=$out install ${lib.optionalString stdenv.hostPlatform.isLinux "install-systemd"}
  '';

  passthru.updateScript = nix-update-script { extraArgs = [ "--version-regex=pizauth-(.*)" ]; };
@ -43,7 +33,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
      asl20
      mit
    ];
-    maintainers = with lib.maintainers; [ moraxyc ];
+    maintainers = with lib.maintainers; [
+      moraxyc
+      doronbehar
+    ];
    mainProgram = "pizauth";
  };
 })
--- a/pkgs/by-name/pr/principia/package.nix
+++ b/pkgs/by-name/pr/principia/package.nix
@ -8,7 +8,6 @@

  curl,
  freetype,
-  glew,
  gtk3,
  libGL,
  libjpeg,
@ -22,13 +21,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "principia";
-  version = "2025.04.05";
+  version = "2026.06.06";

  src = fetchFromGitHub {
    owner = "Bithack";
    repo = "principia";
    rev = finalAttrs.version;
-    hash = "sha256-cXtc1E4iJf3//UyzZzhky/NV7zk4959xSwGLHdCeyk0=";
+    hash = "sha256-FLMEOpgESsGYvVejea59xbBcVWGUp7qgZLCDugolMXk=";
  };

  nativeBuildInputs = [
@ -40,7 +39,6 @@ stdenv.mkDerivation (finalAttrs: {
  buildInputs = [
    curl
    freetype
-    glew
    gtk3
    libGL
    libjpeg
--- a/pkgs/by-name/pt/pt2-clone/package.nix
+++ b/pkgs/by-name/pt/pt2-clone/package.nix
@ -10,13 +10,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "pt2-clone";
-  version = "1.88";
+  version = "1.89";

  src = fetchFromGitHub {
    owner = "8bitbubsy";
    repo = "pt2-clone";
    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-PdoncYnl7jD9iM0PDi0O92t9uAlhbrQciIr/+xk3igE=";
+    sha256 = "sha256-2fyuhg8Utj2EbV++4C8rAHMYQItXvxh0WTsp/NM+Xes=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/by-name/qb/qbit-manage/package.nix
+++ b/pkgs/by-name/qb/qbit-manage/package.nix
@ -6,15 +6,15 @@
  nix-update-script,
  qbit-manage,
 }:
-python3Packages.buildPythonApplication rec {
+python3Packages.buildPythonApplication (finalAttrs: {
  pname = "qbit-manage";
-  version = "4.7.1";
+  version = "4.8.0";

  src = fetchFromGitHub {
    owner = "StuffAnThings";
    repo = "qbit_manage";
-    tag = "v${version}";
-    hash = "sha256-+W28F8vI5OLqFd0S6nlqMW/IxJXB4Vl+bCOZAyLGNXY=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-ime1l/j1DGxtsW6BxEEWnes7hwjfsLd5VU2iIsE1eoU=";
  };

  pyproject = true;
@ -43,7 +43,7 @@ python3Packages.buildPythonApplication rec {
  pythonRelaxDeps = [
    "croniter"
    "fastapi"
-    "gitpython"
+    "qbittorrent-api"
    "requests"
    "uvicorn"
  ];
@ -66,4 +66,4 @@ python3Packages.buildPythonApplication rec {
    platforms = lib.platforms.all;
    mainProgram = "qbit-manage";
  };
-}
+})
--- a/pkgs/by-name/re/renode-dts2repl/package.nix
+++ b/pkgs/by-name/re/renode-dts2repl/package.nix
@ -7,14 +7,14 @@

 python3.pkgs.buildPythonApplication {
  pname = "renode-dts2repl";
-  version = "0-unstable-2026-05-19";
+  version = "0-unstable-2026-05-28";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "antmicro";
    repo = "dts2repl";
-    rev = "2e62d9b087daac8aa6e56c22ad0eaef72aaa8bf8";
-    hash = "sha256-+Pwk85cei9f7mvQKnZMIY1N7gjOc8UxicyTNQP3MPPI=";
+    rev = "7d7217df0f1c9a814043ae60184e7769337f9779";
+    hash = "sha256-9hStDQcewBFSj/OF9Yw0d3W+3zeO9ii0mjel5mQb5js=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/ru/rumdl/package.nix
+++ b/pkgs/by-name/ru/rumdl/package.nix
@ -11,16 +11,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "rumdl";
-  version = "0.2.2";
+  version = "0.2.8";

  src = fetchFromGitHub {
    owner = "rvben";
    repo = "rumdl";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-ID0PtTV+++baTbbaYoaB4lJvFxhW4m9gWeOB11xuY34=";
+    hash = "sha256-YdcFxMXs+7g0NJ17TsdZCX/ZedKvJ9QcxoZP3eTbesA=";
  };

-  cargoHash = "sha256-EUIpv4CaxYTfDdXCpb8BMBGGAI6o4lY2aqY30uJquFA=";
+  cargoHash = "sha256-I2mi/2w4Qica6jDyWipMl93LO3CljqKXNzCaCi03/a0=";

  cargoBuildFlags = [
    "--bin=rumdl"
--- a/pkgs/by-name/sh/shotwell/package.nix
+++ b/pkgs/by-name/sh/shotwell/package.nix
@ -23,7 +23,7 @@
  json-glib,
  gcr,
  libgee,
-  gexiv2,
+  gexiv2_0_16,
  gettext,
  desktop-file-utils,
  gdk-pixbuf,
@ -39,11 +39,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "shotwell";
-  version = "0.32.15";
+  version = "0.32.16";

  src = fetchurl {
    url = "mirror://gnome/sources/shotwell/${lib.versions.majorMinor finalAttrs.version}/shotwell-${finalAttrs.version}.tar.xz";
-    sha256 = "sha256-rBAmDzguGjGTu7DayBQxY/HKNVRvp2Ez1ULjkK90Lzo=";
+    sha256 = "sha256-tzpL4XQIGq8nR12+wIjPoeHzJ5AtwVgI12qk7e+dL4M=";
  };

  nativeBuildInputs = [
@ -72,7 +72,7 @@ stdenv.mkDerivation (finalAttrs: {
    gst_all_1.gst-plugins-good
    libgee
    libgudev
-    gexiv2
+    gexiv2_0_16
    gsettings-desktop-schemas
    libraw
    json-glib
--- a/pkgs/by-name/sq/sqlitestudio/package.nix
+++ b/pkgs/by-name/sq/sqlitestudio/package.nix
@ -2,7 +2,7 @@
  stdenv,
  lib,
  fetchFromGitHub,
-  libsForQt5,
+  qt5,
  readline,
  tcl,
  python3,
@ -25,24 +25,20 @@ stdenv.mkDerivation (finalAttrs: {

  nativeBuildInputs = [
    copyDesktopItems
-  ]
-  ++ (with libsForQt5.qt5; [
-    qmake
-    qttools
-    wrapQtAppsHook
-  ]);
+    qt5.qmake
+    qt5.qttools
+    qt5.wrapQtAppsHook
+  ];

  buildInputs = [
    readline
    tcl
    python3
-  ]
-  ++ (with libsForQt5.qt5; [
-    qtbase
-    qtsvg
-    qtdeclarative
-    qtscript
-  ]);
+    qt5.qtbase
+    qt5.qtsvg
+    qt5.qtdeclarative
+    qt5.qtscript
+  ];

  qmakeFlags = [
    "./SQLiteStudio3"
--- a/pkgs/by-name/sy/syncthingtray/package.nix
+++ b/pkgs/by-name/sy/syncthingtray/package.nix
@ -27,14 +27,14 @@
 }:

 stdenv.mkDerivation (finalAttrs: {
-  version = "2.1.1";
+  version = "2.1.2";
  pname = "syncthingtray";

  src = fetchFromGitHub {
    owner = "Martchus";
    repo = "syncthingtray";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-JaekoeY9owh9GNR2f26Po5BoNu+sTvLPfvn/O0VBEdM=";
+    hash = "sha256-VU47ncrgY00LJTrM4GKMDbhtFtBrcTwakhNCbcucoFo=";
  };

  buildInputs = [
--- a/pkgs/by-name/ts/tsduck/package.nix
+++ b/pkgs/by-name/ts/tsduck/package.nix
@ -3,7 +3,7 @@
  stdenv,
  fetchFromGitHub,
  # build and doc tooling
-  asciidoctor-with-extensions,
+  asciidoctor,
  doxygen,
  graphviz,
  python3,
@ -32,7 +32,7 @@ stdenv.mkDerivation (finalAttrs: {
  };

  nativeBuildInputs = [
-    asciidoctor-with-extensions
+    asciidoctor
    doxygen
    graphviz
    python3
--- a/pkgs/by-name/tt/ttfautohint/package.nix
+++ b/pkgs/by-name/tt/ttfautohint/package.nix
@ -7,7 +7,7 @@
  perl,
  freetype,
  harfbuzz,
-  libsForQt5,
+  qt5,
  enableGUI ? true,
 }:

@ -33,16 +33,16 @@ stdenv.mkDerivation (finalAttrs: {
    perl
  ]
  ++ lib.optionals stdenv.hostPlatform.isLinux [ autoreconfHook ]
-  ++ lib.optionals enableGUI [ libsForQt5.qt5.wrapQtAppsHook ];
+  ++ lib.optionals enableGUI [ qt5.wrapQtAppsHook ];

  buildInputs = [
    freetype
    harfbuzz
  ]
-  ++ lib.optionals enableGUI [ libsForQt5.qt5.qtbase ];
+  ++ lib.optionals enableGUI [ qt5.qtbase ];

  configureFlags = [
-    "--with-qt=${if enableGUI then "${libsForQt5.qt5.qtbase}/lib" else "no"}"
+    "--with-qt=${if enableGUI then "${qt5.qtbase}/lib" else "no"}"
  ]
  ++ lib.optionals (!enableGUI) [ "--without-doc" ];

--- a/pkgs/by-name/wp/wpsoffice/package.nix
+++ b/pkgs/by-name/wp/wpsoffice/package.nix
@ -19,7 +19,7 @@
  pango,
  runCommandLocal,
  curl,
-  libsForQt5,
+  qt5,
  coreutils,
  cacert,
  libjpeg,
@ -75,7 +75,7 @@ stdenv.mkDerivation rec {
    libtiff
    udev
    gtk3
-    libsForQt5.qt5.qtbase
+    qt5.qtbase
    libxdamage
    libxtst
    libxv
--- a/pkgs/by-name/xl/xlights/package.nix
+++ b/pkgs/by-name/xl/xlights/package.nix
@ -6,11 +6,11 @@

 appimageTools.wrapType2 rec {
  pname = "xlights";
-  version = "2026.08";
+  version = "2026.10";

  src = fetchurl {
    url = "https://github.com/smeighan/xLights/releases/download/${version}/xLights-${version}-x86_64.AppImage";
-    hash = "sha256-1Dq3Heij3MbHbgO3rM7BYDHiPDToiTZxrAqpN8Jj148=";
+    hash = "sha256-2yIiCY97Nlor9GhJYCnKwAjjjR9wQZt3q4ktvEeAef0=";
  };

  meta = {
--- a/pkgs/by-name/zl/zlequalizer/package.nix
+++ b/pkgs/by-name/zl/zlequalizer/package.nix
@ -2,6 +2,7 @@
  lib,
  clangStdenv,
  fetchFromGitHub,
+  nix-update-script,

  # nativeBuildInputs
  cmake,
@ -26,17 +27,33 @@
  libjack2,
  libxkbcommon,
  lv2,
+  # Highway is built static-dispatch only upstream (HWY_COMPILE_ONLY_STATIC is
+  # forced ON), so exactly one ISA is baked in -- there is no runtime dispatch.
+  # Default to the portable baseline so the cached binary runs everywhere nixpkgs
+  # targets. Override for a faster *local* build, e.g.
+  #   zlequalizer.override { simdTarget = "AVX2"; }
+  # SSE4/AVX2 map to -march=x86-64-v2/v3 and will SIGILL on CPUs lacking that ISA,
+  # which is why this must not be raised for the binary cache.
+  simdTarget ? (if clangStdenv.hostPlatform.isAarch64 then "NEON" else "SSE2"),
 }:
-
+assert lib.assertOneOf "simdTarget" simdTarget [
+  "SSE2"
+  "SSE4"
+  "AVX2"
+  "NEON"
+];
 clangStdenv.mkDerivation (finalAttrs: {
  pname = "zlequalizer";
-  version = "1.1.1";
+  version = "1.2.1";
+
+  __structuredAttrs = true;
+  strictDeps = true;

  src = fetchFromGitHub {
    owner = "ZL-Audio";
    repo = "ZLEqualizer";
    tag = finalAttrs.version;
-    hash = "sha256-H6j4e9V0Nf3kkm1ds9zSjLsHeDXU5PIHreJVRpjf/Ts=";
+    hash = "sha256-IFfJTd0jfTDbXqyqr34BQoflj3nyB4k/0BqeC6V2j4E=";
    fetchSubmodules = true;
  };

@ -91,12 +108,9 @@ clangStdenv.mkDerivation (finalAttrs: {
  };

  cmakeFlags = [
-    # see: https://github.com/ZL-Audio/ZLEqualizer#clone-and-build
-    (lib.cmakeFeature "KFR_ARCHS" (
-      if clangStdenv.hostPlatform.isAarch64 then "neon64" else "sse2;avx;avx2"
-    ))
+    (lib.cmakeFeature "ZL_HWY_STATIC_TARGET" simdTarget)
    (lib.cmakeBool "ZL_JUCE_COPY_PLUGIN" false)
-    # set the version for in the settings screen.
+    # set the version for the settings screen.
    (lib.cmakeFeature "FOOBAR_VERSION" "${finalAttrs.version}")
  ];

@ -119,9 +133,13 @@ clangStdenv.mkDerivation (finalAttrs: {
    runHook postInstall
  '';

+  passthru.updateScript = nix-update-script { };
+
  meta = {
    homepage = "https://zl-audio.github.io/plugins/zlequalizer2/";
+    changelog = "https://github.com/ZL-Audio/ZLEqualizer/releases/tag/${finalAttrs.version}";
    description = "Versatile equalizer plugin for VST3, LV2 and standalone";
+    mainProgram = "ZL Equalizer 2";
    license = lib.licenses.agpl3Plus;
    maintainers = with lib.maintainers; [
      magnetophon
--- a/pkgs/by-name/zw/zwave-js-ui/package.nix
+++ b/pkgs/by-name/zw/zwave-js-ui/package.nix
@ -7,15 +7,15 @@

 buildNpmPackage rec {
  pname = "zwave-js-ui";
-  version = "11.19.0";
+  version = "11.19.1";

  src = fetchFromGitHub {
    owner = "zwave-js";
    repo = "zwave-js-ui";
    tag = "v${version}";
-    hash = "sha256-hn5Y5ADAybwSK5hv3J7qlyjPztD6QRB4oq9JTuLg9Vk=";
+    hash = "sha256-9dqvQxlk+DdYcpCgoLR8EqtgwJwMA4Dvtwc8n1K8Cic=";
  };
-  npmDepsHash = "sha256-hHalQUYj2T6AnxU0/EcbobY5UxgwvaS2NAy95FASTCk=";
+  npmDepsHash = "sha256-dED08xcbgO3zfNRP9iNuTcL+73HnfBnwDrPCGY4TZBQ=";

  passthru.tests.zwave-js-ui = nixosTests.zwave-js-ui;

--- a/pkgs/desktops/pantheon/apps/elementary-screenshot/default.nix
+++ b/pkgs/desktops/pantheon/apps/elementary-screenshot/default.nix
@ -6,27 +6,24 @@
  ninja,
  pkg-config,
  vala,
-  wrapGAppsHook3,
+  wrapGAppsHook4,
  gdk-pixbuf,
  glib,
-  granite,
-  gtk3,
-  libhandy,
+  granite7,
+  gtk4,
+  libportal,
  nix-update-script,
 }:

 stdenv.mkDerivation rec {
  pname = "elementary-screenshot";
-  # nixpkgs-update: no auto update
-  # We disabled x-d-p-pantheon due to https://github.com/elementary/portals/issues/157
-  # so hold back this before the issue is fixed since later versions enforce using portals.
-  version = "8.0.0";
+  version = "8.0.4";

  src = fetchFromGitHub {
    owner = "elementary";
    repo = "screenshot";
    rev = version;
-    hash = "sha256-z7FP+OZYF/9YLXYCQF/ElihKjKHVfeHc38RHdPb2aIE=";
+    hash = "sha256-hVYzriIRvBDBdRRZRiXZwEazu9ZPhPaVY/pOfw95ZkU=";
  };

  nativeBuildInputs = [
@ -34,15 +31,15 @@ stdenv.mkDerivation rec {
    ninja
    pkg-config
    vala
-    wrapGAppsHook3
+    wrapGAppsHook4
  ];

  buildInputs = [
    gdk-pixbuf
    glib
-    granite
-    gtk3
-    libhandy
+    granite7
+    gtk4
+    libportal
  ];

  passthru = {
--- a/pkgs/development/interpreters/php/default.nix
+++ b/pkgs/development/interpreters/php/default.nix
@ -77,11 +77,11 @@ in
    hash = "sha256-5phrH9N+slQCEn/kpyeKPgO3+QJbt6S9KSonG9+TD7k=";
  };
  php84 = mkPhp {
-    version = "8.4.21";
-    hash = "sha256-XgvSh/O+Nb9XwhGwEFJ65eEKiBcPluZNM2BE61+u9DA=";
+    version = "8.4.22";
+    hash = "sha256-Sxbn4sOEziXgfSjrlJhVxLT+DRt7nsnI7r0F0M+pxTI=";
  };
  php85 = mkPhp {
-    version = "8.5.6";
-    hash = "sha256-RFckD2XwxZpiCSDWbNqxsSEApDHgOtn+vjixOhsllX8=";
+    version = "8.5.7";
+    hash = "sha256-Tvk1X3hNSzIBUes/McWUHA2ilwJe7bl/KDiyznPdWb8=";
  };
 }
--- a/pkgs/development/libraries/ldutils/default.nix
+++ b/pkgs/development/libraries/ldutils/default.nix
@ -2,7 +2,8 @@
  mkDerivation,
  lib,
  fetchFromGitLab,
-  libsForQt5,
+  qtcharts,
+  qtsvg,
  cmake,
 }:
 mkDerivation {
@ -17,7 +18,7 @@ mkDerivation {
    hash = "sha256-UMDayvz9RlcR4HVJNn7tN4FKbiKAFRSPaK0osA6OGTI=";
  };

-  buildInputs = with libsForQt5.qt5; [
+  buildInputs = [
    qtcharts
    qtsvg
  ];
--- a/pkgs/development/python-modules/fastapi-pagination/default.nix
+++ b/pkgs/development/python-modules/fastapi-pagination/default.nix
@ -14,7 +14,7 @@

 buildPythonPackage (finalAttrs: {
  pname = "fastapi-pagination";
-  version = "0.15.13";
+  version = "0.15.14";
  pyproject = true;
  __structuredAttrs = true;

@ -22,7 +22,7 @@ buildPythonPackage (finalAttrs: {
    owner = "uriyyo";
    repo = "fastapi-pagination";
    tag = finalAttrs.version;
-    hash = "sha256-c+bXtc4MQdd+UlsBHtVL6F2lBu46yry9OTKsMbu1Mhw=";
+    hash = "sha256-W3SgSne3GgRl2W6l3NWUguvzxigLCVgMLiT/fMIWSAE=";
  };

  build-system = [
--- a/pkgs/development/python-modules/rpy2/default.nix
+++ b/pkgs/development/python-modules/rpy2/default.nix
@ -10,14 +10,14 @@
 }:

 buildPythonPackage rec {
-  version = "3.6.4";
+  version = "3.6.7";
  pyproject = true;
  pname = "rpy2";

  disabled = isPyPy;
  src = fetchPypi {
    inherit version pname;
-    hash = "sha256-ok6N2lxf+MvSuOvRzPbxpaCldmI3AM+R4szpjUGnn9M=";
+    hash = "sha256-8ftGSc59FOk1EzCI3sl82ifrN858xxA4X4HcpVb+jJ8=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/unstructured/default.nix
+++ b/pkgs/development/python-modules/unstructured/default.nix
@ -2,6 +2,7 @@
  lib,
  buildPythonPackage,
  fetchFromGitHub,
+  symlinkJoin,

  # build-system
  setuptools,
@ -30,6 +31,7 @@
  joblib,
  # jsonpath-python,
  nltk,
+  nltk-data,
  olefile,
  orderly-set,
  python-dateutil,
@ -118,6 +120,18 @@
 }:
 let
  version = "0.18.31";
+
+  # unstructured downloads these NLTK corpora at import time unless they are already on
+  # nltk.data.path, which fails in offline or read-only builds. Bundle them and register
+  # the directory in postPatch. It must be named "nltk_data": unstructured's resolver
+  # uses paths ending in "nltk_data" as-is and appends "/nltk_data" to any others.
+  nltkData = symlinkJoin {
+    name = "nltk_data";
+    paths = with nltk-data; [
+      averaged-perceptron-tagger-eng
+      punkt-tab
+    ];
+  };
 in
 buildPythonPackage rec {
  pname = "unstructured";
@ -133,6 +147,11 @@ buildPythonPackage rec {

  build-system = [ setuptools ];

+  postPatch = ''
+    substituteInPlace unstructured/nlp/tokenize.py \
+      --replace-fail 'import nltk' 'import nltk; nltk.data.path.append("${nltkData}")'
+  '';
+
  dependencies = [
    # Base dependencies
    anyio
@ -257,10 +276,14 @@ buildPythonPackage rec {
    ];
  };

-  pythonImportsCheck = [ "unstructured" ];
+  pythonImportsCheck = [
+    "unstructured"
+    # exercises the bundled NLTK corpora lookup, so the build catches an attempted download
+    "unstructured.nlp.tokenize"
+  ];

-  # test try to download punkt from nltk
-  # figure out how to make it available to enable the tests
+  # the import-time NLTK download is handled via nltkData above, but the test suite has
+  # further offline/data requirements that are not yet verified, so keep it disabled.
  doCheck = false;

  nativeCheckInputs = [
--- a/pkgs/development/r-modules/bioc-annotation-packages.json
+++ b/pkgs/development/r-modules/bioc-annotation-packages.json
@ -1,6 +1,6 @@
 {
  "extraArgs": {
-    "biocVersion": "3.22"
+    "biocVersion": "3.23"
  },
  "packages": {
    "AHCytoBands": {
@ -737,8 +737,8 @@
    },
    "BioMartGOGeneSets": {
      "name": "BioMartGOGeneSets",
-      "version": "0.99.11",
-      "sha256": "1ack8v1q0zg15gs816n9f4pwrzrpsv4va6j0r8847pw0pvavwpiq",
+      "version": "0.99.12",
+      "sha256": "11x00v18vd5ppm9asg120dmhmqamzsacy64v3kmmxfn7rhxl25b2",
      "depends": ["GenomicRanges", "S4Vectors"]
    },
    "CENTREannotation": {
@ -749,8 +749,8 @@
    },
    "CTCF": {
      "name": "CTCF",
-      "version": "0.99.13",
-      "sha256": "097w2rad5fxyg2dkghz6ws93q1l7hlc6f9dnw1n30gs2bdv5hbyb",
+      "version": "0.99.14",
+      "sha256": "06nyz5758mq04hzvc7bl0ld2d173zabs9xyhva01y92b19yy8nfp",
      "depends": []
    },
    "ChemmineDrugs": {
@ -887,14 +887,14 @@
    },
    "GO_db": {
      "name": "GO.db",
-      "version": "3.22.0",
-      "sha256": "1liyl1ic2d08an0h6yxllggkv9n8vyp1bfjwvqzk5ana17lzmimf",
+      "version": "3.23.1",
+      "sha256": "0ays2n3jivigpr7m3y3rba8gjyqr7g3qxdslppww0z0zzm4m808z",
      "depends": ["AnnotationDbi"]
    },
    "GeneSummary": {
      "name": "GeneSummary",
-      "version": "0.99.6",
-      "sha256": "0h6afrjb00afrcw6mwslxp7cmwfzp4qfxh0aa4f41kfjd3cymmp5",
+      "version": "0.99.7",
+      "sha256": "0pl843r230cgq0nh5pwp19zz823dwdv789kfcgdhylijx3h2ymfk",
      "depends": []
    },
    "GenomeInfoDbData": {
@ -1241,8 +1241,8 @@
    },
    "Orthology_eg_db": {
      "name": "Orthology.eg.db",
-      "version": "3.22.0",
-      "sha256": "14wng7izmr7wx3yimjlvmk87vf1z3z0n88y2nghn8a2iqci1rl3s",
+      "version": "3.23.0",
+      "sha256": "0640jwylw67cw8sylmyfcqm8cak5i2bx9k925bwm0bjmayxl8yw3",
      "depends": ["AnnotationDbi"]
    },
    "PANTHER_db": {
@ -1673,8 +1673,8 @@
    },
    "UniProtKeywords": {
      "name": "UniProtKeywords",
-      "version": "0.99.7",
-      "sha256": "10id2lk2mbccay7p44pk58zhkiqc58x237qr76plivgpcc8xhjzq",
+      "version": "0.99.8",
+      "sha256": "1mhbhar70acwgjmlfkfrqc2hskqvbgsaf9xlzv8ph66x6gvbyqb7",
      "depends": []
    },
    "XtraSNPlocs_Hsapiens_dbSNP144_GRCh37": {
@ -2093,8 +2093,8 @@
    },
    "excluderanges": {
      "name": "excluderanges",
-      "version": "0.99.10",
-      "sha256": "0j9njpnbh731ffimr1sbvix3wsivnh9nwxg6sbrpwp8gl0pnl7r0",
+      "version": "0.99.11",
+      "sha256": "1czr9hr84hzwa7fyzm51425nphy0b9h5yfvgkij5v8qgq565w02a",
      "depends": ["GenomicRanges"]
    },
    "fitCons_UCSC_hg19": {
@ -2513,8 +2513,8 @@
    },
    "hpAnnot": {
      "name": "hpAnnot",
-      "version": "1.1.1",
-      "sha256": "0bkfcj9igi7ylhf3arszqnqzaxsxvfv2gn2smzx6ymzq5a8sc0yg",
+      "version": "1.1.3",
+      "sha256": "0gnir407flzzkkljxf2brqrw2kaycl8azi0wc5yn1fhl7x5zidq1",
      "depends": ["AnnotationHub"]
    },
    "hs25kresogen_db": {
@ -3749,20 +3749,20 @@
    },
    "org_Hs_eg_db": {
      "name": "org.Hs.eg.db",
-      "version": "3.22.0",
-      "sha256": "0bia1ppxnyjpw4p3rk19q1l8rrcraccpz4w69f3ja0q0im0xrgfi",
+      "version": "3.23.1",
+      "sha256": "1zlwsk1hq40xi8xd7wc974jp8gky6x7icc9788ch77glbik201j7",
      "depends": ["AnnotationDbi"]
    },
    "org_Mm_eg_db": {
      "name": "org.Mm.eg.db",
-      "version": "3.22.0",
-      "sha256": "16liabdbkfqzhna3rw1zgf777r3xm8knrbvy0181c2nsn2jkxsv3",
+      "version": "3.23.0",
+      "sha256": "0i252737v6wk0im41gnksz4qkzf286kwgfq60yqc1mfva77m8yjh",
      "depends": ["AnnotationDbi"]
    },
    "org_Mmu_eg_db": {
      "name": "org.Mmu.eg.db",
-      "version": "3.22.0",
-      "sha256": "0ga0c9635pkigmr0l9vazh3qdpyxki1y8l7mbgcp1y8sfkyjn33c",
+      "version": "3.23.0",
+      "sha256": "08l4bckvn42yjgpkcmq87c1c2z4g8cfjc9jm5ibb84v5ffjw92ij",
      "depends": ["AnnotationDbi"]
    },
    "org_Mxanthus_db": {
@ -3779,14 +3779,14 @@
    },
    "org_Pt_eg_db": {
      "name": "org.Pt.eg.db",
-      "version": "3.22.0",
-      "sha256": "1i67vccx3a6zak34nwdhrbhm7hkjz9qbai9jvwrlql6z8xc6n6q0",
+      "version": "3.23.0",
+      "sha256": "1hfvrv2n9gc0h4s6ql4lv8q8qjf75c4y5p2hlplhphzi38j54vhl",
      "depends": ["AnnotationDbi"]
    },
    "org_Rn_eg_db": {
      "name": "org.Rn.eg.db",
-      "version": "3.22.0",
-      "sha256": "0vqpmbivxd1yvapa5gz9mrxlk6ivrzak55dw2sfjm8sl308rmaj4",
+      "version": "3.23.0",
+      "sha256": "1j1gs8bk1a247shhs5z41s4pk6hw4ssy7405fv5q16m5ilpwgc1g",
      "depends": ["AnnotationDbi"]
    },
    "org_Sc_sgd_db": {
@ -3797,14 +3797,14 @@
    },
    "org_Ss_eg_db": {
      "name": "org.Ss.eg.db",
-      "version": "3.22.0",
-      "sha256": "03qlbkvxfmdgpl8dwx72msd9asx12izvq2vmidqfyipyr7r79cbm",
+      "version": "3.23.0",
+      "sha256": "0ijn7dfh485lww1d9bp8j40fcjr1lx8vdnlq6ydwq3ni4bifkzqp",
      "depends": ["AnnotationDbi"]
    },
    "org_Xl_eg_db": {
      "name": "org.Xl.eg.db",
-      "version": "3.22.0",
-      "sha256": "1h8jvdzhpp9d4zaaczhmg6hk32p77l63v3095ln58rhy9m18pg0f",
+      "version": "3.23.0",
+      "sha256": "1w856a5hkp9a5g41nd69xwvzaf1nmq7zqjsn7w5p1i2zsxv1i1k1",
      "depends": ["AnnotationDbi"]
    },
    "paeg1acdf": {
@ -5111,8 +5111,8 @@
    },
    "reactome_db": {
      "name": "reactome.db",
-      "version": "1.95.0",
-      "sha256": "1b87byr45cmqa7jyd5fw3askmrzfhdljjp2d7jcmm88baf45mfg6",
+      "version": "1.96.0",
+      "sha256": "0b43ri3clg6ynp197vy24936n762k0f43v9m51g1lar2w4qc2zhb",
      "depends": ["AnnotationDbi"]
    },
    "rgu34a_db": {
--- a/pkgs/development/r-modules/bioc-experiment-packages.json
+++ b/pkgs/development/r-modules/bioc-experiment-packages.json
--- a/pkgs/development/r-modules/bioc-packages.json
+++ b/pkgs/development/r-modules/bioc-packages.json
--- a/pkgs/development/r-modules/cran-packages.json
+++ b/pkgs/development/r-modules/cran-packages.json
--- a/pkgs/development/r-modules/default.nix
+++ b/pkgs/development/r-modules/default.nix
@ -765,7 +765,9 @@ let
    ];
    RGtk2 = [ pkgs.gtk2.dev ];
    rhdf5 = [ pkgs.zlib ];
-    Rhdf5lib = with pkgs; [ zlib.dev ];
+    Rhdf5lib = with pkgs; [
+      cmake
+    ];
    Rhpc = with pkgs; [
      zlib
      bzip2.dev
@ -821,7 +823,10 @@ let
    rpanel = [ pkgs.tclPackages.bwidget ];
    Rpoppler = [ pkgs.poppler ];
    RPostgreSQL = with pkgs; [ libpq.pg_config ];
-    RProtoBuf = [ pkgs.protobuf ];
+    RProtoBuf = with pkgs; [
+      protobuf
+      abseil-cpp.dev
+    ];
    rsamplr = with pkgs; [
      cargo
      rustc
@ -865,6 +870,10 @@ let
      cargo
      rustc
    ];
+    tinyimg = with pkgs; [
+      cargo
+      rustc
+    ];
    caugi = with pkgs; [
      cargo
      rustc
@ -966,6 +975,7 @@ let
      fontconfig.dev
      freetype.dev
    ];
+    rlas = [ pkgs.pkg-config ];
    TAQMNGR = [ pkgs.zlib.dev ];
    TDA = [ pkgs.gmp ];
    tesseract = with pkgs; [
@ -1227,10 +1237,16 @@ let
      xz.dev
      zlib.dev
    ];
+    fs = [ pkgs.libuv ];
    pgenlibr = [ pkgs.zlib.dev ];
    fftw = [ pkgs.pkg-config ];
    gdtools = [ pkgs.pkg-config ];
    archive = [ pkgs.libarchive ];
+    lpsymphony = with pkgs; [
+      symphony
+      cgl
+      clp
+    ];
    gdalcubes = with pkgs; [
      proj.dev
      gdal
@ -1251,6 +1267,10 @@ let
      fftw.dev
      pkg-config
    ];
+    Rhdf5lib = with pkgs; [
+      curl
+      zlib.dev
+    ];
    GRAB = [ pkgs.zlib.dev ];
    jqr = [ pkgs.jq.out ];
    kza = [ pkgs.pkg-config ];
@ -1541,7 +1561,13 @@ let
    redux = [ pkgs.hiredis ];
    RmecabKo = [ pkgs.mecab ];
    markets = [ pkgs.gsl ];
-    rlas = [ pkgs.boost ];
+    rlas = with pkgs; [
+      boost
+      gdal
+      proj
+      sqlite
+      geos
+    ];
    bgx = [ pkgs.boost ];
    PoissonBinomial = [ pkgs.fftw.dev ];
    poisbinom = [ pkgs.fftw.dev ];
@ -1947,6 +1973,10 @@ let
      postPatch = "patchShebangs configure";
    });

+    fixest = old.fixest.overrideAttrs (attrs: {
+      postPatch = "patchShebangs configure";
+    });
+
    arcgisplaces = old.arcgisplaces.overrideAttrs (attrs: {
      postPatch = "patchShebangs configure";
    });
@ -1979,6 +2009,10 @@ let
      postPatch = "patchShebangs configure";
    });

+    ramr = old.ramr.overrideAttrs (attrs: {
+      postPatch = "patchShebangs configure";
+    });
+
    roxigraph = old.roxigraph.overrideAttrs (attrs: {
      env = (attrs.env or { }) // {
        LIBCLANG_PATH = "${lib.getLib pkgs.libclang}/lib";
@ -2440,6 +2474,10 @@ let
      '';
    });

+    RProtoBuf = old.RProtoBuf.overrideAttrs (attrs: {
+      configureFlags = [ "ac_cv_prog_cxx_cxx11=" ];
+    });
+
    JavaGD = old.JavaGD.overrideAttrs (attrs: {
      preConfigure = ''
        export JAVA_CPPFLAGS=-I${pkgs.jdk}/include/
@ -2948,7 +2986,10 @@ let
    );

    lpsymphony = old.lpsymphony.overrideAttrs (attrs: {
-      preConfigure = ''
+      postPatch = ''
+        substituteInPlace configure \
+          --replace-fail '--libs SYMPHONY' '--libs symphony' \
+          --replace-fail '--cflags SYMPHONY' '--cflags symphony'
        patchShebangs configure
      '';
    });
@ -3108,7 +3149,13 @@ let

    Rhdf5lib =
      let
-        hdf5 = pkgs.hdf5_1_10;
+        hdf5 = pkgs.hdf5.overrideAttrs (attrs: {
+          cmakeFlags = attrs.cmakeFlags ++ [ "-DHDF5_ENABLE_ROS3_VFD:BOOL=TRUE" ];
+          buildInputs = attrs.buildInputs ++ [ pkgs.curl.dev ];
+          postInstall = attrs.postInstall or "" + ''
+            cp src/libhdf5.settings $dev/lib
+          '';
+        });
      in
      old.Rhdf5lib.overrideAttrs (attrs: {
        propagatedBuildInputs = attrs.propagatedBuildInputs ++ [
--- a/pkgs/development/r-modules/patches/Rhdf5lib.patch
+++ b/pkgs/development/r-modules/patches/Rhdf5lib.patch
@ -1,8 +1,8 @@
 diff --git a/R/zzz.R b/R/zzz.R
-index 97becd7..803ca39 100644
+index 2af2b3e..21ddc00 100644
 --- a/R/zzz.R
 +++ b/R/zzz.R
-@@ -20,7 +20,7 @@ pkgconfig <- function(opt = c("PKG_CXX_LIBS", "PKG_C_LIBS", "PKG_CXX_HL_LIBS", "
+@@ -22,7 +22,7 @@ pkgconfig <- function(opt = c("PKG_CXX_LIBS", "PKG_C_LIBS", "PKG_CXX_HL_LIBS", "
 
   path <- Sys.getenv(
     x = "RHDF5LIB_RPATH",
@ -10,70 +10,48 @@ index 97becd7..803ca39 100644
 +    unset = ""
   )
 
-   if (nzchar(.Platform$r_arch)) {
-@@ -59,7 +59,7 @@ pkgconfig <- function(opt = c("PKG_CXX_LIBS", "PKG_C_LIBS", "PKG_CXX_HL_LIBS", "
-                               sprintf('-L%s -lhdf5 %s',
+   sysname <- Sys.info()['sysname']
+@@ -47,7 +47,7 @@ pkgconfig <- function(opt = c("PKG_CXX_LIBS", "PKG_C_LIBS", "PKG_CXX_HL_LIBS", "
+                               sprintf('-L%s -lhdf5 %s', 
                                       patharch, winlibs)
                             }, {
 -                              sprintf('"%s/libhdf5.a"%s%s', 
-+                              sprintf('-lhdf5',
-                                       patharch, .getSzipLoc(patharch), .getDynamicLinks())
+                              sprintf('-lhdf5', 
+                                       patharch, .getSzipLoc(patharch), .getDynamicLinks(patharch))
                             }
                      )
-@@ -70,7 +70,7 @@ pkgconfig <- function(opt = c("PKG_CXX_LIBS", "PKG_C_LIBS", "PKG_CXX_HL_LIBS", "
-                               sprintf('-L%s -lhdf5_cpp -lhdf5 %s',
+@@ -58,7 +58,7 @@ pkgconfig <- function(opt = c("PKG_CXX_LIBS", "PKG_C_LIBS", "PKG_CXX_HL_LIBS", "
+                               sprintf('-L%s -lhdf5_cpp -lhdf5 %s', 
                                       patharch, winlibs)
                             }, {
 -                              sprintf('"%s/libhdf5_cpp.a" "%s/libhdf5.a"%s%s',
 +                              sprintf('-lhdf5_cpp -lhdf5',
-                                       patharch, patharch, .getSzipLoc(patharch), .getDynamicLinks())
+                                       patharch, patharch, .getSzipLoc(patharch), .getDynamicLinks(patharch))
                             }
                      )
-@@ -81,7 +81,7 @@ pkgconfig <- function(opt = c("PKG_CXX_LIBS", "PKG_C_LIBS", "PKG_CXX_HL_LIBS", "
-                               sprintf('-L%s -lhdf5_hl -lhdf5 %s',
+@@ -69,7 +69,7 @@ pkgconfig <- function(opt = c("PKG_CXX_LIBS", "PKG_C_LIBS", "PKG_CXX_HL_LIBS", "
+                               sprintf('-L%s -lhdf5_hl -lhdf5 %s', 
                                       patharch, winlibs)
                             }, {
 -                              sprintf('"%s/libhdf5_hl.a" "%s/libhdf5.a"%s%s', 
-+                              sprintf('-lhdf5_hl -lhdf5',
-                                       patharch, patharch, .getSzipLoc(patharch), .getDynamicLinks())
+                              sprintf('-lhdf5_hl -lhdf5', 
+                                       patharch, patharch, .getSzipLoc(patharch), .getDynamicLinks(patharch))
                             }
                      )
-@@ -92,7 +92,7 @@ pkgconfig <- function(opt = c("PKG_CXX_LIBS", "PKG_C_LIBS", "PKG_CXX_HL_LIBS", "
-                               sprintf('-L%s -lhdf5_hl_cpp -lhdf5_hl -lhdf5_cpp -lhdf5 %s',
+@@ -80,7 +80,7 @@ pkgconfig <- function(opt = c("PKG_CXX_LIBS", "PKG_C_LIBS", "PKG_CXX_HL_LIBS", "
+                               sprintf('-L%s -lhdf5_hl_cpp -lhdf5_hl -lhdf5_cpp -lhdf5 %s', 
                                       patharch, winlibs)
                             }, {
 -                              sprintf('"%s/libhdf5_hl_cpp.a" "%s/libhdf5_hl.a" "%s/libhdf5_cpp.a" "%s/libhdf5.a"%s%s',
 +                              sprintf('-lhdf5_hl_cpp -lhdf5_hl -lhdf5_cpp -lhdf5',
-                                       patharch, patharch, patharch, patharch, .getSzipLoc(patharch), .getDynamicLinks())
+                                       patharch, patharch, patharch, patharch, .getSzipLoc(patharch), .getDynamicLinks(patharch))
                             }
                      )
-@@ -124,6 +124,7 @@ getHdf5Version <- function() {
- #'
+@@ -113,6 +113,7 @@ getHdf5Version <- function() {
+ #' @noRd
 #' @keywords internal
- .getDynamicLinks <- function() {
+ .getDynamicLinks <- function(path) {
 +  return("")
-   sysname <- Sys.info()['sysname']
-   if(sysname == "Windows") {
-     links <- "-lz"
-diff --git a/src/Makevars.in b/src/Makevars.in
-index addb6a0..590784a 100644
--- a/src/Makevars.in
-+++ b/src/Makevars.in
-@@ -18,7 +18,7 @@ USER_LIB_DIR = ${R_PACKAGE_DIR}/lib${R_ARCH}/
- 
- PKG_CPPFLAGS = -I${USER_INCLUDE_DIR} ${ZLIB_INCLUDE}
- PKG_CFLAGS = ${ZLIB_LIB}
-PKG_LIBS = "${USER_LIB_DIR}libhdf5.a" @SZIP_LIB@ -lz
-+PKG_LIBS = -lhdf5 -lsz
- 
- 
- 
-@@ -26,7 +26,7 @@ all: $(SHLIB)
- 
- $(SHLIB): Rhdf5lib.o
- 
-Rhdf5lib.o: copy-hdf5 @COPY_SZIP@
-+Rhdf5lib.o:
- 
- copy-szip: copy-hdf5
- 	cp hdf5/libaec-1.0.4/build/szip/lib/libsz.a "${USER_LIB_DIR}"
+   settings_file <- file.path(path, "libhdf5.settings")
+   libhdf5_settings <- readLines(settings_file)
+   libstr <- grep("Extra libraries", x = libhdf5_settings, fixed = TRUE, value = TRUE) |> 
--- a/pkgs/development/r-modules/patches/rhdf5.patch
+++ b/pkgs/development/r-modules/patches/rhdf5.patch
@ -9,39 +9,3 @@ index 713b44c..704ac17 100644
 
 #PKG_CFLAGS = -Wall
 
-diff --git a/src/h5testLock.c b/src/h5testLock.c
-index b326444..5d58b4a 100644
--- a/src/h5testLock.c
-+++ b/src/h5testLock.c
-@@ -8,16 +8,16 @@ SEXP _h5fileLock(SEXP _file_name) {
-   int lk = -1;
- 
-   /* create the temporary file */
-  fd = HDopen(file_name, O_RDWR | O_CREAT | O_TRUNC, 0666);
-+  fd = open(file_name, O_RDWR | O_CREAT | O_TRUNC, 0666);
- 
-   /* try to lock file */
-  lk = HDflock(fd, LOCK_EX | LOCK_NB);
-+  lk = flock(fd, LOCK_EX | LOCK_NB);
-   
-   /* unlock so we can remove */
-  HDflock(fd, LOCK_UN);
-+  flock(fd, LOCK_UN);
-   
-   /* close */
-  HDclose(fd);
-+  close(fd);
-   
-   /* return value of lock attempt */
-   PROTECT(Rval = allocVector(INTSXP, 1));
-diff --git a/src/h5testLock.h b/src/h5testLock.h
-index 2c1c5e4..25914ff 100644
--- a/src/h5testLock.h
-+++ b/src/h5testLock.h
-@@ -1,5 +1,5 @@
- #include <fcntl.h>
-+#include <unistd.h>
- #include "myhdf5.h"
-#include <H5private.h>
- 
- SEXP _h5fileLock();
--- a/pkgs/development/ruby-modules/gem-config/default.nix
+++ b/pkgs/development/ruby-modules/gem-config/default.nix
@ -892,6 +892,11 @@ in
    buildFlags = [ "--without-imlib2-config" ];
  };

+  prawn-gmagick = attrs: {
+    buildInputs = [ graphicsmagick ];
+    nativeBuildInputs = [ pkg-config ];
+  };
+
  psych = attrs: {
    buildInputs = [ libyaml ];
  };
--- a/pkgs/servers/sql/postgresql/ext/plr.nix
+++ b/pkgs/servers/sql/postgresql/ext/plr.nix
@ -13,13 +13,13 @@

 postgresqlBuildExtension (finalAttrs: {
  pname = "plr";
-  version = "8.4.8";
+  version = "8.4.8.6";

  src = fetchFromGitHub {
    owner = "postgres-plr";
    repo = "plr";
    tag = "REL${lib.replaceString "." "_" finalAttrs.version}";
-    hash = "sha256-FLL61HsZ6WaWBP9NqrJjhMFSVyVBIpVO0wv+kXMuAaU=";
+    hash = "sha256-SBLv9GsyYmYdxrWmGiMIiFRGl5FA+j2RcSmKz9pMv2E=";
  };

  nativeBuildInputs = [ pkg-config ];
--- a/pkgs/stdenv/cross/default.nix
+++ b/pkgs/stdenv/cross/default.nix
@ -4,7 +4,7 @@
  crossSystem,
  config,
  overlays,
-  crossOverlays ? [ ],
+  crossOverlays,
 }:

 let
--- a/pkgs/stdenv/custom/default.nix
+++ b/pkgs/stdenv/custom/default.nix
@ -4,7 +4,6 @@
  crossSystem,
  config,
  overlays,
-  crossOverlays ? [ ],
 }:

 assert crossSystem == localSystem;
--- a/pkgs/stdenv/darwin/default.nix
+++ b/pkgs/stdenv/darwin/default.nix
@ -13,7 +13,6 @@
  crossSystem,
  config,
  overlays,
-  crossOverlays ? [ ],
  # Allow passing in bootstrap files directly so we can test the stdenv bootstrap process when changing the bootstrap tools
  bootstrapFiles ? (config.replaceBootstrapFiles or lib.id) (
    if localSystem.isAarch64 then
--- a/pkgs/stdenv/default.nix
+++ b/pkgs/stdenv/default.nix
@ -12,32 +12,41 @@
  crossSystem,
  config,
  overlays,
-  crossOverlays ? [ ],
-}@args:
+  crossOverlays,
+}:

 let
+  commonArgs = {
+    inherit
+      lib
+      localSystem
+      crossSystem
+      config
+      overlays
+      ;
+  };
  # The native (i.e., impure) build environment.  This one uses the
  # tools installed on the system outside of the Nix environment,
  # i.e., the stuff in /bin, /usr/bin, etc.  This environment should
  # be used with care, since many Nix packages will not build properly
  # with it (e.g., because they require GNU Make).
-  stagesNative = import ./native args;
+  stagesNative = import ./native commonArgs;

  # The Nix build environment.
-  stagesNix = import ./nix (args // { bootStages = stagesNative; });
+  stagesNix = import ./nix (commonArgs // { bootStages = stagesNative; });

-  stagesFreeBSD = import ./freebsd args;
+  stagesFreeBSD = import ./freebsd commonArgs;

  # On Linux systems, the standard build environment consists of Nix-built
  # instances glibc and the `standard' Unix tools, i.e., the Posix utilities,
  # the GNU C compiler, and so on.
-  stagesLinux = import ./linux args;
+  stagesLinux = import ./linux commonArgs;

-  stagesDarwin = import ./darwin args;
+  stagesDarwin = import ./darwin commonArgs;

-  stagesCross = import ./cross args;
+  stagesCross = import ./cross (commonArgs // { inherit crossOverlays; });

-  stagesCustom = import ./custom args;
+  stagesCustom = import ./custom commonArgs;

 in
 # Select the appropriate stages for the platform `system'.
--- a/pkgs/stdenv/freebsd/default.nix
+++ b/pkgs/stdenv/freebsd/default.nix
@ -6,7 +6,6 @@
  crossSystem,
  config,
  overlays,
-  crossOverlays ? [ ],
  bootstrapFiles ?
    let
      table = {
--- a/pkgs/stdenv/linux/default.nix
+++ b/pkgs/stdenv/linux/default.nix
@ -59,8 +59,6 @@
  crossSystem,
  config,
  overlays,
-  crossOverlays ? [ ],
-
  bootstrapFiles ?
    let
      table = {
--- a/pkgs/stdenv/native/default.nix
+++ b/pkgs/stdenv/native/default.nix
@ -4,7 +4,6 @@
  crossSystem,
  config,
  overlays,
-  crossOverlays ? [ ],
 }:

 assert crossSystem == localSystem;
--- a/pkgs/stdenv/nix/default.nix
+++ b/pkgs/stdenv/nix/default.nix
@ -1,11 +1,10 @@
 {
  lib,
-  crossSystem,
  localSystem,
+  crossSystem,
  config,
  overlays,
  bootStages,
-  ...
 }:

 assert crossSystem == localSystem;
--- a/pkgs/tools/misc/tdarr/common.nix
+++ b/pkgs/tools/misc/tdarr/common.nix
@ -100,7 +100,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  inherit pname;
-  version = "2.74.01";
+  version = "2.77.01";

  src = fetchzip {
    url = "https://storage.tdarr.io/versions/${finalAttrs.version}/${platform}/${componentName}.zip";
--- a/pkgs/tools/misc/tdarr/node.nix
+++ b/pkgs/tools/misc/tdarr/node.nix
@ -5,10 +5,10 @@ callPackage ./common.nix { } {
  component = "node";

  hashes = {
-    linux_x64 = "sha256-2dH6mZkQeF6ryzbqNqNt/2brCFBj5yuoSKjh7S3ZRwA=";
-    linux_arm64 = "sha256-mbMBufdR0WTPJaSD3PxUP5delX3AJP2ytLQVBK2RxlY=";
-    darwin_x64 = "sha256-/GCMEmK4eaN/lpOg90HkvNFOBZFrIdQYM3JX1MfEKMU=";
-    darwin_arm64 = "sha256-ikb+Dkhqi7Txzmh51VYG9lf2tmLvbo1K7ebX8oLfNoM=";
+    linux_x64 = "sha256-jdnR9qlw0sN+2IXRuu5wFe9yNXbh3Tfx2XlT6aPw4Pg=";
+    linux_arm64 = "sha256-xbfUm1SJjYzU9jIq52f2lNDPIZ6tN91G9LqLUOS4CjY=";
+    darwin_x64 = "sha256-plEwXsDChoAhbkIDXk+rsW9baSKs7XzkOE9JMgnrIWA=";
+    darwin_arm64 = "sha256-aIO03xEQkYcRtTYFO2MgGu2ZEMYs7XIJ2+gJ9Xq67vo=";
  };

  includeInPath = [ ccextractor ];
--- a/pkgs/tools/misc/tdarr/server.nix
+++ b/pkgs/tools/misc/tdarr/server.nix
@ -5,10 +5,10 @@ callPackage ./common.nix { } {
  component = "server";

  hashes = {
-    linux_x64 = "sha256-q69RkTtI8yrEm08JlSxBuE6BaCoQhkEt7v5ONeDLICA=";
-    linux_arm64 = "sha256-4S1Tu23Xd3MqsCKxzGVB+07nlulR2uuQVBMrni/sQUU=";
-    darwin_x64 = "sha256-0+4gHTpLJpP+3mraSOx6tGpwcxlt1cPt6Cnn+xQLOok=";
-    darwin_arm64 = "sha256-VQtzUAYyDjGJpjBAvragIOT7fcV61bIp6ESABTOoFHs=";
+    linux_x64 = "sha256-4G1wHHWmSsFveSWcooW/QN6YHgUnqID1D7z1G3xKYTk=";
+    linux_arm64 = "sha256-Sx06jR8kKQOwTmaaNCyiX0KyUtgXNrQJkMsZjAGhlAQ=";
+    darwin_x64 = "sha256-4W1q7YaLMOIyiuyZ1oIVGb1Fz2qwFHrgMb78Q7lmpbI=";
+    darwin_arm64 = "sha256-ziuaZZi1QZ10d+6lWdOzPFTbCe75bKDHPxxDdI1wsj8=";
  };

  includeInPath = [ ccextractor ];
--- a/pkgs/top-level/impure.nix
+++ b/pkgs/top-level/impure.nix
@ -44,8 +44,6 @@ in
  # fix-point made by Nixpkgs.
  overlays ? import ./impure-overlays.nix,

-  crossOverlays ? [ ],
-
  ...
 }@args:

--- a/pkgs/top-level/qt5-packages.nix
+++ b/pkgs/top-level/qt5-packages.nix
@ -54,10 +54,6 @@ makeScopeWithSplicing' {
      qt5
      // {

-        inherit
-          qt5
-          ;
-
        __internalKF5 = lib.dontRecurseIntoAttrs kdeFrameworks;

        ### LIBRARIES
@ -188,6 +184,7 @@ makeScopeWithSplicing' {
        timed = callPackage ../applications/system/timed { };
      }
      // lib.optionalAttrs config.allowAliases {
+        qt5 = throw "'libsForQt5.qt5.*' attributes were removed in favor of top-level 'qt5.*' attributes"; # Added 2026-06-05
        mlt = throw "'libsForQt5.mlt' was removed due to lack of upstream support since v7.36.0, use 'qt6Packages.mlt'."; # Added 2026-06-05
        futuresql = throw "libsForQt5.futuresql has been removed"; # Added 2026-05-01
        kdb = throw "libsForQt5.kdb has been removed"; # Added 2026-05-01