Merge staging-next into staging

2026-07-06 17:13:24 -05:00 · 2026-06-14 18:31:33 +00:00 · 2026-06-14 18:31:33 +00:00 · 813a4091b8
commit 813a4091b8
parent 450baffdb5 14b5616817
80 changed files with 619 additions and 490 deletions
--- a/nixos/modules/services/monitoring/prometheus/exporters.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters.nix
@ -114,7 +114,6 @@ let
        "restic"
        "rtl_433"
        "sabnzbd"
-        "scaphandre"
        "script"
        "shelly"
        "smartctl"
@ -521,26 +520,6 @@ in
                'services.prometheus.exporters.sql.configFile'
            '';
          }
-          {
-            assertion = cfg.scaphandre.enable -> (pkgs.stdenv.targetPlatform.isx86_64 == true);
-            message = ''
-              Scaphandre only support x86_64 architectures.
-            '';
-          }
-          {
-            assertion =
-              cfg.scaphandre.enable
-              -> ((lib.kernel.whenHelpers pkgs.linux.version).whenOlder "5.11" true).condition == false;
-            message = ''
-              Scaphandre requires a kernel version newer than '5.11', '${pkgs.linux.version}' given.
-            '';
-          }
-          {
-            assertion = cfg.scaphandre.enable -> (builtins.elem "intel_rapl_common" config.boot.kernelModules);
-            message = ''
-              Scaphandre needs 'intel_rapl_common' kernel module to be enabled. Please add it in 'boot.kernelModules'.
-            '';
-          }
          {
            assertion =
              cfg.idrac.enable -> ((cfg.idrac.configurationPath == null) != (cfg.idrac.configuration == null));
--- a/nixos/modules/services/monitoring/prometheus/exporters/scaphandre.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/scaphandre.nix
@ -1,36 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  options,
-  ...
-}:
-
-let
-  logPrefix = "services.prometheus.exporter.scaphandre";
-  cfg = config.services.prometheus.exporters.scaphandre;
-in
-{
-  port = 8080;
-  extraOpts = {
-    telemetryPath = lib.mkOption {
-      type = lib.types.str;
-      default = "/metrics";
-      description = ''
-        Path under which to expose metrics.
-      '';
-    };
-  };
-
-  serviceOpts = {
-    serviceConfig = {
-      ExecStart = ''
-        ${pkgs.scaphandre}/bin/scaphandre prometheus \
-          --address ${cfg.listenAddress} \
-          --port ${toString cfg.port} \
-          --suffix ${cfg.telemetryPath} \
-          ${lib.concatStringsSep " \\\n  " cfg.extraFlags}
-      '';
-    };
-  };
-}
--- a/nixos/modules/services/web-apps/plausible.nix
+++ b/nixos/modules/services/web-apps/plausible.nix
@ -330,9 +330,6 @@ in
    ];
  };

-  meta.maintainers = with lib.maintainers; [
-    e1mo
-    xanderio
-  ];
+  meta.maintainers = [ ];
  meta.doc = ./plausible.md;
 }
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -1493,7 +1493,6 @@ in
  sanoid = runTest ./sanoid.nix;
  saunafs = runTest ./saunafs.nix;
  scanservjs = runTest ./scanservjs.nix;
-  scaphandre = runTest ./scaphandre.nix;
  schleuder = runTest ./schleuder.nix;
  scion-freestanding-deployment = runTest ./scion/freestanding-deployment;
  scrutiny = runTest ./scrutiny.nix;
--- a/nixos/tests/plausible.nix
+++ b/nixos/tests/plausible.nix
@ -2,10 +2,7 @@
 {
  name = "plausible";
  meta = {
-    maintainers = with lib.maintainers; [
-      e1mo
-      xanderio
-    ];
+    maintainers = [ ];
  };

  nodes.machine =
--- a/nixos/tests/prometheus-exporters.nix
+++ b/nixos/tests/prometheus-exporters.nix
@ -21,6 +21,9 @@ let
    *  `nodeName` (optional)
    *    override an incompatible testnode name
    *
+    *  `testBackend` (optional)
+    *    whether to run in `containers` (default) or `nodes` scope
+    *
    *  Example:
    *    exporterTests.<exporterName> = {
    *      exporterConfig = {
@ -168,6 +171,7 @@ let
    blackbox =
      { pkgs, ... }:
      {
+        testBackend = "nodes";
        exporterConfig = {
          enable = true;
          configFile = pkgs.writeText "config.yml" (
@ -373,16 +377,23 @@ let
      };

    dovecot =
-      { ... }:
+      { pkgs, ... }:
      {
+        testBackend = "nodes";
        exporterConfig = {
          enable = true;
          scopes = [ "global" ];
-          socketPath = "/var/run/dovecot2/old-stats";
+          socketPath = "/var/run/dovecot2/stats-reader";
          user = "root"; # <- don't use user root in production
        };
        metricProvider = {
-          services.dovecot2.enable = true;
+          services.dovecot2 = {
+            enable = true;
+            settings = {
+              dovecot_config_version = pkgs.dovecot.version;
+              dovecot_storage_version = pkgs.dovecot.version;
+            };
+          };
        };
        exporterTest = ''
          wait_for_unit("prometheus-dovecot-exporter.service")
@ -423,6 +434,7 @@ let
    ebpf =
      { ... }:
      {
+        testBackend = "nodes";
        exporterConfig = {
          enable = true;
          names = [ "timers" ];
@ -447,7 +459,6 @@ let
          # `services.elasticsearch` is unmaintained; OpenSearch is the same
          # engine class and is explicitly supported by the exporter.
          services.opensearch.enable = true;
-          virtualisation.memorySize = 2048;
        };
        exporterTest = ''
          wait_for_unit("opensearch.service")
@ -463,6 +474,7 @@ let
    fail2ban =
      { ... }:
      {
+        testBackend = "nodes"; # setfacl
        exporterConfig = {
          enable = true;
          exitOnError = true;
@ -964,6 +976,7 @@ let
    modemmanager =
      { ... }:
      {
+        testBackend = "nodes";
        exporterConfig = {
          enable = true;
          refreshRate = "10s";
@ -1099,7 +1112,7 @@ let
          wait_for_unit("nginx.service")
          wait_for_unit("prometheus-nextcloud-exporter.service")
          wait_for_open_port(9205)
-          succeed("curl -sSf http://localhost:9205/metrics | grep 'nextcloud_up 1'")
+          wait_until_succeeds("curl -sSf http://localhost:9205/metrics | grep 'nextcloud_up 1'")
        '';
      };

@ -1658,24 +1671,6 @@ let
        '';
      };

-    scaphandre =
-      { ... }:
-      {
-        exporterConfig = {
-          enable = true;
-        };
-        metricProvider = {
-          boot.kernelModules = [ "intel_rapl_common" ];
-        };
-        exporterTest = ''
-          wait_for_unit("prometheus-scaphandre-exporter.service")
-          wait_for_open_port(8080)
-          wait_until_succeeds(
-              "curl -sSf 'localhost:8080/metrics'"
-          )
-        '';
-      };
-
    shelly =
      { pkgs, ... }:
      {
@ -2143,6 +2138,7 @@ let
    zfs =
      { ... }:
      {
+        testBackend = "nodes"; # zfs kmod
        exporterConfig = {
          enable = true;
        };
@ -2165,13 +2161,14 @@ lib.mapAttrs (
    { pkgs, lib, ... }:
    let
      testConfig = testConfigFun { inherit pkgs lib; };
-      nodeName = testConfig.nodeName or exporter;
+      testBackend = testConfig.testBackend or "containers";
+      nodeName = "machine";
    in
    {
      name = "prometheus-${exporter}-exporter";
      node.pkgsReadOnly = testConfig.pkgsReadOnly or true;

-      nodes.${nodeName} = lib.mkMerge [
+      ${testBackend}.${nodeName} = lib.mkMerge [
        {
          services.prometheus.exporters.${exporter} = testConfig.exporterConfig;
        }
@ -2196,7 +2193,6 @@ lib.mapAttrs (
              "${nodeName}.${line}"
          ) (lib.splitString "\n" (lib.removeSuffix "\n" testConfig.exporterTest))
        )}
-        ${nodeName}.shutdown()
      '';

      meta.maintainers = [ ];
--- a/nixos/tests/scaphandre.nix
+++ b/nixos/tests/scaphandre.nix
@ -1,18 +0,0 @@
-{
-  name = "scaphandre";
-
-  nodes.scaphandre =
-    { pkgs, ... }:
-    {
-      boot.kernelModules = [ "intel_rapl_common" ];
-
-      environment.systemPackages = [ pkgs.scaphandre ];
-    };
-
-  testScript = ''
-    scaphandre.start()
-    scaphandre.wait_until_succeeds(
-        "scaphandre stdout -t 4",
-    )
-  '';
-}
--- a/pkgs/applications/emulators/libretro/cores/beetle-psx.nix
+++ b/pkgs/applications/emulators/libretro/cores/beetle-psx.nix
@ -8,13 +8,13 @@
 }:
 mkLibretroCore {
  core = "mednafen-psx" + lib.optionalString withHw "-hw";
-  version = "0-unstable-2026-06-02";
+  version = "0-unstable-2026-06-14";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "beetle-psx-libretro";
-    rev = "ee042b73f8fe2aa9c8c73408b5bf200a3ce1a67b";
-    hash = "sha256-k1DvQHGQH/d6W7jTIAW9jIk0qVHUji3PeYAa8MuUP9w=";
+    rev = "d460f8342060526678e7fd8222048324c2a80d86";
+    hash = "sha256-QzlVlXfJmSwd+gp+fROMKrTj8AxCisYJN5WTff6eHLA=";
  };

  extraBuildInputs = lib.optionals withHw [
--- a/pkgs/by-name/al/albyhub/bark-ffi-go/default.nix
+++ b/pkgs/by-name/al/albyhub/bark-ffi-go/default.nix
@ -0,0 +1,47 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitLab,
+  protobuf,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "bark-ffi-go";
+  version = "0.2.3";
+
+  src = fetchFromGitLab {
+    owner = "ark-bitcoin";
+    repo = "bark-ffi-bindings";
+    rev = "3c626a43d7523c4d19e867bd453ec80c541780c7";
+    hash = "sha256-PbGTbVMO2L+gQpZQewkR0uo6fxqrVUjT/eAsnz2o/u4=";
+  };
+
+  sourceRoot = "${finalAttrs.src.name}/golang/rust";
+
+  cargoHash = "sha256-OED+NqNt71771UDZ1M8Ks/Yfx8YNjfL246FKMeLFfLg=";
+
+  cargoBuildFlags = [ "--lib" ];
+
+  doCheck = false;
+
+  nativeBuildInputs = [
+    protobuf
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm444 target/*/release/libbark_ffi_go.a \
+      $out/lib/libbark_ffi_go.a
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Go bindings static library for Bark";
+    homepage = "https://gitlab.com/ark-bitcoin/bark-ffi-bindings";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ bleetube ];
+  };
+})
--- a/pkgs/by-name/al/albyhub/ldk-node-go/default.nix
+++ b/pkgs/by-name/al/albyhub/ldk-node-go/default.nix
@ -7,13 +7,13 @@

 buildGoModule {
  pname = "ldk-node-go";
-  version = "0-unstable-2026-04-24";
+  version = "0-unstable-2026-06-08";

  src = fetchFromGitHub {
    owner = "getAlby";
    repo = "ldk-node-go";
-    rev = "3690cdb3031c75f0ee0a67222c2db3c69fea8f2c";
-    hash = "sha256-OlJGHhal5fkR0r0FtsVbG1aILZSTLsSRcqrZ84pIRLU=";
+    rev = "5ba22268f000c78baa5cf57329eb0b1c07bd91d7";
+    hash = "sha256-+fuCvc2SuxBLXiacfc+0oNzAsBgFjUJgZ0+5B4Sy4vs=";
  };

  vendorHash = null;
--- a/pkgs/by-name/al/albyhub/ldk-node/default.nix
+++ b/pkgs/by-name/al/albyhub/ldk-node/default.nix
@ -8,13 +8,13 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "ldk-node";
-  version = "0-unstable-2026-04-24";
+  version = "0-unstable-2026-06-08";

  src = fetchFromGitHub {
    owner = "getAlby";
    repo = "ldk-node";
-    rev = "6d5546ec5fff10d4e560188cfcff6f294944c16e";
-    hash = "sha256-k3AZ1k/hV4Bh+RfOqmpo22wRQ5sdDaFR4bcnw58iwNI=";
+    rev = "549107b4d731bc9af06b81fbcd65463e3055df16";
+    hash = "sha256-7S/+po+a6DkUCnfCrwBMfMnsHzbLcvSiPxEmQc2Hzr0=";
  };

  buildFeatures = [ "uniffi" ];
--- a/pkgs/by-name/al/albyhub/package.nix
+++ b/pkgs/by-name/al/albyhub/package.nix
@ -8,10 +8,12 @@
  yarn,
  stdenv,
  makeWrapper,
+  runCommand,
  callPackage,
 }:

 let
+  barkFfiGo = callPackage ./bark-ffi-go { };
  ldkNode = callPackage ./ldk-node { };
  ldkNodeGo = callPackage ./ldk-node-go {
    inherit ldkNode;
@ -21,18 +23,25 @@ in

 buildGoModule (finalAttrs: {
  pname = "albyhub";
-  version = "1.22.2";
+  version = "1.23.0";

  src = fetchFromGitHub {
    owner = "getAlby";
    repo = "hub";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-xP/J9zdh4sZ1x+JUpOf12ft8f2II2Mn1Q7/gnMuFzy8=";
+    hash = "sha256-1mdpsctrQN012+HAWSgorzlN2UBA5D4+sZIIVYCq8k8=";
  };

-  vendorHash = "sha256-nzdHXY14o4D8NrcXu2JvDagvIfemfVAaGU3IDifhyW0=";
+  vendorHash = "sha256-xQkQIWBrbrXzU9/5BMD3/+KKR847gh4XQrwj/CDoml0=";
  proxyVendor = true; # needed for secp256k1-zkp CGO bindings

+  postPatch = ''
+    cp -r ${barkFfiGo.src}/golang bark-ffi-bindings-golang
+    chmod -R u+w bark-ffi-bindings-golang
+    rm -r bark-ffi-bindings-golang/lib
+    go mod edit -replace gitlab.com/ark-bitcoin/bark-ffi-bindings/golang=./bark-ffi-bindings-golang
+  '';
+
  nativeBuildInputs = [
    fixup-yarn-lock
    nodejs
@ -41,16 +50,21 @@ buildGoModule (finalAttrs: {
  ];

  buildInputs = [
+    barkFfiGo
    ldkNodeGo
    (lib.getLib stdenv.cc.cc)
  ];

  frontendYarnOfflineCache = fetchYarnDeps {
    yarnLock = finalAttrs.src + "/frontend/yarn.lock";
-    hash = "sha256-BeuTBLJ/Iakd4jhIkI2+oHc4MFy6DSn8QcygTHEMmQo=";
+    hash = "sha256-VI4FRe1kzVMqqcZ68nZmZqmXW7FOQMbJ0z8QqZoLYEA=";
  };

  preBuild = ''
+    mkdir -p bark-ffi-bindings-golang/lib/linux_${stdenv.hostPlatform.go.GOARCH}
+    cp ${barkFfiGo}/lib/libbark_ffi_go.a \
+      bark-ffi-bindings-golang/lib/linux_${stdenv.hostPlatform.go.GOARCH}/libbark_ffi_go.a
+
    export HOME=$TMPDIR
    pushd frontend
      fixup-yarn-lock yarn.lock
@ -85,6 +99,41 @@ buildGoModule (finalAttrs: {
    } $out/bin/albyhub
  '';

+  passthru.tests.startup = runCommand "${finalAttrs.pname}-startup-test" { } ''
+    export HOME="$TMPDIR"
+    export AUTO_LINK_ALBY_ACCOUNT=false
+    export WORK_DIR="$TMPDIR/albyhub"
+    export DATABASE_URI="$WORK_DIR/nwc.db"
+    export PORT=8099
+    export LDK_LOG_LEVEL=2
+    export LOG_LEVEL=5
+
+    mkdir -p "$WORK_DIR"
+
+    ${lib.getExe finalAttrs.finalPackage} > "$TMPDIR/albyhub.log" 2>&1 &
+    pid=$!
+    trap 'kill "$pid" 2>/dev/null || true' EXIT
+
+    for _ in $(seq 1 30); do
+      if grep -q "http server started" "$TMPDIR/albyhub.log"; then
+        touch "$out"
+        exit 0
+      fi
+
+      if ! kill -0 "$pid" 2>/dev/null; then
+        echo "albyhub exited before startup" >&2
+        cat "$TMPDIR/albyhub.log" >&2
+        exit 1
+      fi
+
+      sleep 1
+    done
+
+    echo "timed out waiting for albyhub to start" >&2
+    cat "$TMPDIR/albyhub.log" >&2
+    exit 1
+  '';
+
  meta = {
    description = "Control lightning wallets over nostr";
    homepage = "https://github.com/getAlby/hub";
--- a/pkgs/by-name/am/amnezia-vpn-bin/package.nix
+++ b/pkgs/by-name/am/amnezia-vpn-bin/package.nix
@ -29,13 +29,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "amnezia-vpn-bin";
-  version = "4.8.16.0";
+  version = "4.8.18.0";

  __structuredAttrs = true;

  src = fetchzip {
    url = "https://github.com/amnezia-vpn/amnezia-client/releases/download/${finalAttrs.version}/AmneziaVPN_${finalAttrs.version}_linux_x64.tar";
-    hash = "sha256-0gffxBD0pNsyTvqAFdYdjI8rzCkyaXHOApSCu4waP7s=";
+    hash = "sha256-Mypzq/Lm+JI0HljRJ6/0ZDFlwOeVbZB+Lmuy33xE06M=";
  };

  strictDeps = true;
--- a/pkgs/by-name/au/autologin/package.nix
+++ b/pkgs/by-name/au/autologin/package.nix
@ -31,7 +31,7 @@ stdenv.mkDerivation (finalAttrs: {

  meta = {
    description = "Run a command inside of a new PAM user session";
-    homepage = "https://sr.ht/~kennylevinsen/autologin";
+    homepage = "https://git.sr.ht/~kennylevinsen/autologin";
    changelog = "https://git.sr.ht/~kennylevinsen/autologin/refs/${finalAttrs.version}";
    license = lib.licenses.gpl3Plus;
    platforms = lib.platforms.linux;
--- a/pkgs/by-name/ba/bazel_8/examples.nix
+++ b/pkgs/by-name/ba/bazel_8/examples.nix
@ -108,10 +108,10 @@ in
    bazelVendorDepsFOD = {
      outputHash =
        {
-          aarch64-darwin = "sha256-wjVwHQEtIoApY01s9AEVExmRhy+LLQv0/B2vAxmXz+o=";
-          aarch64-linux = "sha256-Z7Y8bBEaPgp9y6RZoC5Ewqvzi//vnamkpeHXGpoBFAQ=";
-          x86_64-darwin = "sha256-aUTfOrsa59zUE0Wb+u5TORQR0nAGQ/7MWSRHc2hcXoo=";
-          x86_64-linux = "sha256-yrXIJocCGq4NYW0jg5s2cMDEvknrtjtBQo6cZFbz8CE=";
+          aarch64-darwin = "sha256-50cAS1okGT1Mq3+TNLk2dk6OdBOAF2LdcskcYuVNOSY=";
+          aarch64-linux = "sha256-2Oia7+2nzLrWeo/bK/5L7du5Y30DY+S0jit6e1ixJXw=";
+          x86_64-darwin = "sha256-+vgvj3ABm+vvXT7U7JxjuzIMwVAiUh1gcWZnFNzcmY0=";
+          x86_64-linux = "sha256-kBnSlFRfYsotZTRMrTNhk8/106+BLzwuU6MIRXlD1jE=";
        }
        .${stdenv.hostPlatform.system};
      outputHashAlgo = "sha256";
--- a/pkgs/by-name/ba/bazel_8/package.nix
+++ b/pkgs/by-name/ba/bazel_8/package.nix
@ -31,7 +31,7 @@
  cctools,
  # Allow to independently override the jdks used to build and run respectively
  jdk_headless,
-  version ? "8.6.0",
+  version ? "8.7.0",
 }:

 let
@ -45,7 +45,7 @@ let

  src = fetchzip {
    url = "https://github.com/bazelbuild/bazel/releases/download/${version}/bazel-${version}-dist.zip";
-    hash = "sha256-W22eB0IzHNZe3xaF8AZOkUTDCic3NXkypdqSDY61Su0=";
+    hash = "sha256-bm+gkkrAVepJWZddDEV1+jX4jRdD+tZ1TH2YG9adIyk=";
    stripRoot = false;
  };

--- a/pkgs/by-name/cl/clojure/package.nix
+++ b/pkgs/by-name/cl/clojure/package.nix
@ -10,7 +10,9 @@
  rlwrap,
  makeWrapper,
  writeScript,
+  versionCheckHook,
 }:
+
 stdenv.mkDerivation (finalAttrs: {
  pname = "clojure";
  version = "1.12.5.1654";
@ -31,6 +33,7 @@ stdenv.mkDerivation (finalAttrs: {
  ];

  strictDeps = true;
+  __structuredAttrs = true;

  # See https://github.com/clojure/brew-install/blob/1.10.3/src/main/resources/clojure/install/linux-install.sh
  installPhase =
@ -69,11 +72,17 @@ stdenv.mkDerivation (finalAttrs: {

  doInstallCheck = true;

+  nativeInstallCheckInputs = [ versionCheckHook ];
+
  installCheckPhase = ''
+    runHook preInstallCheck
+
    CLJ_CONFIG=$TMPDIR CLJ_CACHE=$TMPDIR/.clj_cache $out/bin/clojure \
      -Spath \
      -Sverbose \
      -Scp $out/libexec/clojure-tools-${finalAttrs.version}.jar
+
+    runHook postInstallCheck
  '';

  passthru.updateScript = writeScript "update-clojure" ''
@ -99,6 +108,7 @@ stdenv.mkDerivation (finalAttrs: {
    homepage = "https://clojure.org/";
    sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
    license = lib.licenses.epl10;
+    mainProgram = "clojure";
    longDescription = ''
      Clojure is a dynamic programming language that targets the Java
      Virtual Machine. It is designed to be a general-purpose language,
--- a/pkgs/by-name/di/digidrie/package.nix
+++ b/pkgs/by-name/di/digidrie/package.nix
@ -0,0 +1,54 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  pkg-config,
+  libGL,
+  libx11,
+  libjack2,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "digidrie";
+  version = "0.3.1";
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  src = fetchFromGitHub {
+    owner = "magnetophon";
+    repo = "DigiDrie";
+    tag = "v${finalAttrs.version}";
+    fetchSubmodules = true;
+    hash = "sha256-bmytfZ6/V9eoEnj5xLq3Yzlhy0VGEK6utsfS9OCYWd0=";
+  };
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    libGL
+    libx11
+    libjack2
+  ];
+
+  sourceRoot = "${finalAttrs.src.name}/plugin/dpf";
+
+  postPatch = ''
+    patchShebangs generate-ttl.sh patch/apply.sh
+  '';
+
+  enableParallelBuilding = true;
+
+  makeFlags = [ "PREFIX=${placeholder "out"}" ];
+
+  meta = {
+    description = "Monophonic Faust synth with vector synthesis, CZ-style oscillators and macro morphing (DPF: JACK/LV2/VST2/VST3/CLAP)";
+    homepage = "https://github.com/magnetophon/DigiDrie";
+    license = lib.licenses.agpl3Only;
+    maintainers = [ lib.maintainers.magnetophon ];
+    platforms = [
+      "x86_64-linux"
+      "aarch64-linux"
+    ];
+    mainProgram = "DigiDrie";
+  };
+})
--- a/pkgs/by-name/dn/dnsmasq/CVE-2026-6507.patch
+++ b/pkgs/by-name/dn/dnsmasq/CVE-2026-6507.patch
@ -1,28 +0,0 @@
-From 9ad74926d4f7f34ff902e1db5235535aa813c33f Mon Sep 17 00:00:00 2001
-From: Simon Kelley <simon@thekelleys.org.uk>
-Date: Mon, 6 Apr 2026 22:22:43 +0100
-Subject: [PATCH] Fix 1-byte buffer overflow in relay_reply4()
-
-Potential SIGSEGV when using DHCPv4-relay.
-
-Thanks to Asim Viladi Oglu Manizada for finding this.
---
- src/rfc2131.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/src/rfc2131.c b/src/rfc2131.c
-index 7bdfefd..55aad03 100644
--- a/src/rfc2131.c
-+++ b/src/rfc2131.c
-@@ -3248,7 +3248,7 @@ unsigned int relay_reply4(struct dhcp_packet *mess, size_t sz, char *arrival_int
- 
- 	      /* delete agent info before return RFC 3046 para 2.1 */
- 	      *opt = OPTION_END;
-	      memset(opt + 1, 0, option_len(opt) + 2);
-+	      memset(opt + 1, 0, option_len(opt) + 1);
- 	    }
- 	}
-       else if (mess->giaddr.s_addr == relay->local.addr4.s_addr)
-- 
-2.20.1
-
--- a/pkgs/by-name/dn/dnsmasq/package.nix
+++ b/pkgs/by-name/dn/dnsmasq/package.nix
@ -30,18 +30,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "dnsmasq";
-  version = "2.92rel2";
+  version = "2.93";

  src = fetchurl {
    url = "https://www.thekelleys.org.uk/dnsmasq/dnsmasq-${finalAttrs.version}.tar.xz";
-    hash = "sha256-Q9crjBKb3zPRe6/tyYgj9j5GtQBRKAZr8NKkcqMs4Go=";
+    hash = "sha256-DADU5cl8gwbl+5MrNIs0JpycKaDn3w6OgpWLQHCSvBk=";
  };

-  patches = [
-    # https://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=patch;h=9ad74926d4f7f34ff902e1db5235535aa813c33f
-    ./CVE-2026-6507.patch
-  ];
-
  postPatch = lib.optionalString stdenv.hostPlatform.isLinux ''
    sed '1i#include <linux/sockios.h>' -i src/dhcp.c
  '';
--- a/pkgs/by-name/em/emhash/package.nix
+++ b/pkgs/by-name/em/emhash/package.nix
@ -7,13 +7,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "emhash";
-  version = "1.0.1";
+  version = "1.1.0";

  src = fetchFromGitHub {
    owner = "ktprime";
    repo = "emhash";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-dFj/QaGdTJYdcxKlS9tES6OHae8xPMnrG9ccRNM/hi8=";
+    hash = "sha256-+oJIJvtphPHXPbmRquHRV9KkI61qwuGjJw3O1hpzwIw=";
  };

  strictDeps = true;
--- a/pkgs/by-name/fa/fastfetch/package.nix
+++ b/pkgs/by-name/fa/fastfetch/package.nix
@ -54,7 +54,8 @@
  dbusSupport ? true,
  flashfetchSupport ? false,
  terminalSupport ? true,
-  enlightenmentSupport ? true,
+  # NOTE: disabled by default until lib dependency closure is minimal
+  enlightenmentSupport ? false,
  gnomeSupport ? true,
  imageSupport ? true,
  openclSupport ? true,
--- a/pkgs/by-name/gf/gforth/package.nix
+++ b/pkgs/by-name/gf/gforth/package.nix
@ -17,13 +17,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "gforth";
-  version = "0.7.9_20260513";
+  version = "0.7.9_20260610";

  src = fetchFromGitHub {
    owner = "forthy42";
    repo = "gforth";
    rev = finalAttrs.version;
-    hash = "sha256-hx1/CE18lepkyTnT6yymGwAAJtRM8u7DAhPsKTj0gdo=";
+    hash = "sha256-gaP3Mmcp0NueRfqh62XlvtWuHN6fAnMTa1uSm7Bj+Rk=";
  };

  patches = [ ./use-nproc-instead-of-fhs.patch ];
--- a/pkgs/by-name/gi/gif-for-cli/package.nix
+++ b/pkgs/by-name/gi/gif-for-cli/package.nix
@ -11,7 +11,7 @@
 python3Packages.buildPythonApplication {
  pname = "gif-for-cli";
  version = "1.1.2";
-  format = "setuptools";
+  pyproject = true;

  src = fetchFromGitHub {
    owner = "google";
@ -30,16 +30,22 @@ python3Packages.buildPythonApplication {
  ];

  # coverage is not needed to build and test this package
+  # The symlinking of third_party in setup.py doesn't work correctly with pyproject = true, so we copy instead
  postPatch = ''
    sed -i '/coverage>=/d' setup.py
+    cp -r third_party gif_for_cli
  '';

+  build-system = with python3Packages; [
+    setuptools
+  ];
+
  buildInputs = [
    zlib
    libjpeg
  ];

-  propagatedBuildInputs = with python3Packages; [
+  dependencies = with python3Packages; [
    ffmpeg
    pillow
    requests
@ -51,7 +57,7 @@ python3Packages.buildPythonApplication {
    longDescription = "Takes in a GIF, short video, or a query to the Tenor GIF API and converts it to animated ASCII art.";
    homepage = "https://github.com/google/gif-for-cli";
    license = lib.licenses.asl20;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ ambossmann ];
    mainProgram = "gif-for-cli";
  };
 }
--- a/pkgs/by-name/gi/gitkraken/package.nix
+++ b/pkgs/by-name/gi/gitkraken/package.nix
@ -56,24 +56,24 @@

 let
  pname = "gitkraken";
-  version = "12.1.2";
+  version = "12.2.0";

  throwSystem = throw "Unsupported system: ${stdenv.hostPlatform.system}";

  srcs = {
    x86_64-linux = fetchzip {
      url = "https://api.gitkraken.dev/releases/production/linux/x64/${version}/gitkraken-amd64.tar.gz";
-      hash = "sha256-uYEPOZ1OZwisiitByOWIjymzCayLCdN+cDzW/etktgM=";
+      hash = "sha256-ep4ZLSYxIEqzI7eubMk1H8iTOuOuLJnW1ZjdlOe54eU=";
    };

    x86_64-darwin = fetchzip {
      url = "https://api.gitkraken.dev/releases/production/darwin/x64/${version}/GitKraken-v${version}.zip";
-      hash = "sha256-BIeK1ICLmxciNbauWa23IITEUlbum/39e77D4ovNHCc=";
+      hash = "sha256-qGnoBTG7i7SjLgZ1MzGNTNkvxg6uOzSX4tUwjrk2Yvw=";
    };

    aarch64-darwin = fetchzip {
      url = "https://api.gitkraken.dev/releases/production/darwin/arm64/${version}/GitKraken-v${version}.zip";
-      hash = "sha256-1KTdxnpqNYpLKxX5G5QwY6mYP7j9GtDQoTeXwGfhv08=";
+      hash = "sha256-5t2PV2CY6izw+6k0rS0GwZMxDmfmSWGi7A/YBTVa4cc=";
    };
  };

--- a/pkgs/by-name/hy/hyprwhspr-rs/package.nix
+++ b/pkgs/by-name/hy/hyprwhspr-rs/package.nix
@ -16,16 +16,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "hyprwhspr-rs";
-  version = "0.3.29";
+  version = "0.3.30";

  src = fetchFromGitHub {
    owner = "better-slop";
    repo = "hyprwhspr-rs";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-vJYE5+4G68CK3hiW6KafO3htWgB6n+JcHVJ/3N8FjSw=";
+    hash = "sha256-cOjxjfiJyTUr7NgHS2BRI8WQ5EaYV0Ku5oyLuhWlKwY=";
  };

-  cargoHash = "sha256-ZL3l6ihBWx+y2ErqP13dJyb7lUMbBX7IYf+Di0p5byA=";
+  cargoHash = "sha256-5vviwzVJDONle7baSulxkmRYOlN6NEslgN1TfyiKR2o=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/by-name/in/inputplumber/package.nix
+++ b/pkgs/by-name/in/inputplumber/package.nix
@ -10,16 +10,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "inputplumber";
-  version = "0.77.3";
+  version = "0.77.5";

  src = fetchFromGitHub {
    owner = "ShadowBlip";
    repo = "InputPlumber";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-lcv61lzZ45vNDdFdlnJOQW/mIN8KdsAEAUsoNuuhLM0=";
+    hash = "sha256-L6Ebyh4K4l+7LlVlgDRym9o+XsQPExC7xH1EBPwyLB4=";
  };

-  cargoHash = "sha256-VrzePyiBWAWy+IC9QWi5vooAp2+SwuzT3n+SMG/Ntas=";
+  cargoHash = "sha256-avwKy2AvgzT2IfRw/aMwllaYa4RLx7DJPxrgjHwBY1I=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/by-name/it/itgmania/themes/digital-dance.nix
+++ b/pkgs/by-name/it/itgmania/themes/digital-dance.nix
@ -6,13 +6,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "digital-dance";
-  version = "1.1.3-unstable-2026-06-04";
+  version = "1.1.3-unstable-2026-06-12";

  src = fetchFromCodeberg {
    owner = "JNero";
    repo = "Digital-Dance-ITGMania";
-    rev = "827d963fdc5732f11781bf3db7343a8897a10196";
-    hash = "sha256-V3EmAg42BExodFiGd2u7brmTq4t3iVduWtxo5NjwGm8=";
+    rev = "d4456108422cb36e12dcc1bc227acc66b85d0395";
+    hash = "sha256-2bcI9Lh5xNfqtRbYxsmi+8LJMyQ6hUOw2OLuGQFBftE=";
  };

  postInstall = ''
--- a/pkgs/by-name/it/itgmania/themes/itg3encore.nix
+++ b/pkgs/by-name/it/itgmania/themes/itg3encore.nix
@ -6,13 +6,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "itg3encore";
-  version = "0-unstable-2026-06-05";
+  version = "0-unstable-2026-06-13";

  src = fetchFromGitHub {
    owner = "DarkBahamut162";
    repo = "itg3encore";
-    rev = "7aad94a63462efc85eb6e0e23bd0bd50be28137c";
-    hash = "sha256-oaj76RMD+Ibm8n8/EiUZYVBlyy5PefpBsWhFbWEjM08=";
+    rev = "409dc62c7c7a6c3ce3a713e84c81d95995eb20a6";
+    hash = "sha256-sJLkHRngmA9dPZoQPpUdOAz1nLCHTTOPG4i/SP6rl9A=";
  };

  postInstall = ''
--- a/pkgs/by-name/la/labymod-launcher/package.nix
+++ b/pkgs/by-name/la/labymod-launcher/package.nix
@ -6,12 +6,12 @@

 let
  pname = "labymod-launcher";
-  version = "3.0.1";
+  version = "3.0.10";

  src = fetchurl {
    name = "labymod-launcher";
    url = "https://releases.r2.labymod.net/launcher/linux/x64/LabyMod%20Launcher-${version}.AppImage";
-    hash = "sha256-E4yTsurnomuF72zye06Ycd0qXg4uTHj7Y+EW6lmanoA=";
+    hash = "sha256-etrP2kfhaWVyTgRAsw8MeBy3ndScTkKi3ogXiaQZ2g0=";
  };

  appimageContents = appimageTools.extract { inherit pname version src; };
--- a/pkgs/by-name/li/librewolf-unwrapped/package.nix
+++ b/pkgs/by-name/li/librewolf-unwrapped/package.nix
@ -40,6 +40,9 @@ in
    maxSilent = 14400; # 4h, double the default of 7200s (c.f. #129212, #129115)
    license = lib.licenses.mpl20;
    mainProgram = "librewolf";
+    knownVulnerabilities = [
+      "librewolf lacks an active committer in nixpkgs, consider using an alternative"
+    ];
  };
  tests = { inherit (nixosTests) librewolf; };
  updateScript = callPackage ./update.nix {
--- a/pkgs/by-name/li/libvgm/package.nix
+++ b/pkgs/by-name/li/libvgm/package.nix
@ -38,13 +38,13 @@ assert enableTools -> enableAudio && enableEmulation && enableLibplayer;

 stdenv.mkDerivation (finalAttrs: {
  pname = "libvgm";
-  version = "0-unstable-2026-04-06";
+  version = "0-unstable-2026-06-07";

  src = fetchFromGitHub {
    owner = "ValleyBell";
    repo = "libvgm";
-    rev = "d1151884997ba4769b070b7c7aaedeffc60a25fb";
-    hash = "sha256-SiOB2M7RNo4S5uIr8wXsZ1UtS2+2N8Tqm5iJ+Am3Ep4=";
+    rev = "08471963604c29353501439c4d6f97b57bf8b07b";
+    hash = "sha256-1ddlxs/iq993DkjfYbdyCESspqfhAnmkjErALczpmdI=";
  };

  outputs = [
--- a/pkgs/by-name/lx/lxmf/package.nix
+++ b/pkgs/by-name/lx/lxmf/package.nix
@ -0,0 +1,14 @@
+{
+  python3Packages,
+}:
+
+let
+  pythonPackages = python3Packages.overrideScope (
+    self: super: {
+      lxmf = super.lxmf.override {
+        propagateRns = true;
+      };
+    }
+  );
+in
+pythonPackages.toPythonApplication pythonPackages.lxmf
--- a/pkgs/by-name/mp/mpv/scripts/twitch-chat.nix
+++ b/pkgs/by-name/mp/mpv/scripts/twitch-chat.nix
@ -7,13 +7,13 @@
 }:
 buildLua {
  pname = "twitch-chat";
-  version = "0-unstable-2025-05-15";
+  version = "0-unstable-2026-06-13";

  src = fetchFromGitHub {
    owner = "CrendKing";
    repo = "mpv-twitch-chat";
-    rev = "4d88ac12c843da0e916b0ed1df4d087a3418501b";
-    hash = "sha256-owU0F976K4CX0kKYoRbdtz/sqCvd8kw2LqItEgY25gE=";
+    rev = "1e9d2dfcd8ab9c343cc6a3c55363994dbafe5b58";
+    hash = "sha256-vtv5YZO7qROhUL3TKCKaNfvv1uCjQv9kvfo7sno24BE=";

    postFetch = "rm $out/screenshot.webp";
  };
--- a/pkgs/by-name/mq/mqtt-exporter/package.nix
+++ b/pkgs/by-name/mq/mqtt-exporter/package.nix
@ -23,6 +23,8 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
    prometheus-client
  ];

+  pythonRelaxDeps = [ "prometheus-client" ];
+
  nativeCheckInputs = with python3.pkgs; [
    pytest-mock
    pytestCheckHook
--- a/pkgs/by-name/no/nomadnet/package.nix
+++ b/pkgs/by-name/no/nomadnet/package.nix
@ -0,0 +1,3 @@
+{ python3Packages }:
+
+python3Packages.toPythonApplication python3Packages.nomadnet
--- a/pkgs/by-name/op/openocd-rp2040/package.nix
+++ b/pkgs/by-name/op/openocd-rp2040/package.nix
@ -0,0 +1,33 @@
+{
+  openocd,
+  autoreconfHook,
+  lib,
+  fetchFromGitHub,
+}:
+
+openocd.overrideAttrs (
+  finalAttrs: old: {
+    pname = "openocd-rp2040";
+    version = "2.2.0";
+    src = fetchFromGitHub {
+      owner = "raspberrypi";
+      repo = "openocd";
+      tag = "sdk-${finalAttrs.version}";
+      hash = "sha256-ZfbZVFVncHa1MvNJb4jbnU66vnlwVLBaOXPdgLqAneM=";
+      # openocd disables the vendored libraries that use submodules and replaces them with nix versions.
+      # this works out as one of the submodule sources seems to be flakey.
+      fetchSubmodules = false;
+    };
+    nativeBuildInputs = old.nativeBuildInputs ++ [
+      autoreconfHook
+    ];
+    meta = openocd.meta // {
+      description = "Raspberry Pi's downstream fork of OpenOCD for use with Pico-series devices";
+      homepage = "https://github.com/raspberrypi/openocd";
+      maintainers = with lib.maintainers; [
+        aiyion
+        lu15w1r7h
+      ];
+    };
+  }
+)
--- a/pkgs/by-name/pl/plausible/package.nix
+++ b/pkgs/by-name/pl/plausible/package.nix
@ -185,10 +185,7 @@ beamPackages.mixRelease rec {
    changelog = "https://github.com/plausible/analytics/blob/${src.rev}/CHANGELOG.md";
    description = "Simple, open-source, lightweight (< 1 KB) and privacy-friendly web analytics alternative to Google Analytics";
    mainProgram = "plausible";
-    maintainers = with lib.maintainers; [
-      e1mo
-      xanderio
-    ];
+    maintainers = [ ];
    platforms = lib.platforms.unix;
  };
 }
--- a/pkgs/by-name/ra/radicale/package.nix
+++ b/pkgs/by-name/ra/radicale/package.nix
@ -7,14 +7,14 @@

 python3.pkgs.buildPythonApplication (finalAttrs: {
  pname = "radicale";
-  version = "3.7.4";
+  version = "3.7.5";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "Kozea";
    repo = "Radicale";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-VHSlrVcPbOFUqxPx6/4HR85i3lObQZcKJmomiLE273s=";
+    hash = "sha256-P9xm/2sTDLiX7PqJ+juaIVpwbJ4r/jyBEFE/QWtl9Yo=";
  };

  build-system = with python3.pkgs; [
--- a/pkgs/by-name/ra/rapidcsv/package.nix
+++ b/pkgs/by-name/ra/rapidcsv/package.nix
@ -6,13 +6,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "rapidcsv";
-  version = "8.97";
+  version = "8.99";

  src = fetchFromGitHub {
    owner = "d99kris";
    repo = "rapidcsv";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-A0YYstmJH2lit/odHfVXWmxGDHRKyGL5v7gHtEUJGqk=";
+    hash = "sha256-TJ4IpBt2G+zUf2AEUB9wwz8Zk1UEoqqoemTVJCB+8D0=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/rn/rns-proxy/package.nix
+++ b/pkgs/by-name/rn/rns-proxy/package.nix
@ -0,0 +1,46 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  pkg-config,
+  bzip2,
+  versionCheckHook,
+  nix-update-script,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "rns-proxy";
+  version = "0.1.0";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "mytecor";
+    repo = "rns-proxy";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-+nn6BjzG/SJr8plAVj3R9c459XqvbKSGSqAnNa+QGkY=";
+  };
+
+  cargoHash = "sha256-o+tMlsTuFR89lNwSl3+s+WOTVVReGCJc1xAAwK1zklg=";
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    bzip2
+  ];
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    changelog = "https://github.com/mytecor/rns-proxy/releases/tag/${finalAttrs.src.tag}";
+    description = "SOCKS5 tunnels over the Reticulum Network Stack";
+    homepage = "https://github.com/mytecor/rns-proxy";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ drupol ];
+    mainProgram = "rns-proxy";
+  };
+})
--- a/pkgs/by-name/ro/routedns/package.nix
+++ b/pkgs/by-name/ro/routedns/package.nix
@ -7,16 +7,16 @@

 buildGoModule (finalAttrs: {
  pname = "routedns";
-  version = "0.1.191";
+  version = "0.1.208";

  src = fetchFromGitHub {
    owner = "folbricht";
    repo = "routedns";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-Tr15MfF0GeaKUQRbkzqaWXJhTPVtZ/kpe5foq5MCemo=";
+    hash = "sha256-u1P+i8WXRDzoElvjnNr57ybuDGWBZ6qYF4wBPBYLv4I=";
  };

-  vendorHash = "sha256-a4KcKb75yWv7+1vIYCypS9nnrFJ3zogXIPzUVVA7AXs=";
+  vendorHash = "sha256-e19ZqeVA+WQOILZrju7xFDii/lxmZceXk30tWY74cmM=";

  subPackages = [ "./cmd/routedns" ];

--- a/pkgs/by-name/ru/run0-sudo-shim/package.nix
+++ b/pkgs/by-name/ru/run0-sudo-shim/package.nix
@ -0,0 +1,46 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  nix-update-script,
+  coreutils,
+  polkit-stdin-agent,
+}:
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "run0-sudo-shim";
+  version = "1.3.1";
+
+  src = fetchFromGitHub {
+    owner = "LordGrimmauld";
+    repo = "run0-sudo-shim";
+    tag = finalAttrs.version;
+    hash = "sha256-QkDoEBgcWh/eKX8jxctMNEy08Sf8kpxXFhWbsygTWz8=";
+  };
+
+  cargoHash = "sha256-ly2e2x1Z1XEXblGqWi+/r5q2FmvpekVfzGVGm+S1xio=";
+
+  __structuredAttrs = true;
+
+  env = {
+    POLKIT_STDIN_AGENT = lib.getExe polkit-stdin-agent;
+    TRUE = lib.getExe' coreutils "true";
+  };
+
+  postInstall = ''
+    ln -s $out/bin/run0-sudo-shim $out/bin/sudo
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Shim for the sudo command that utilizes run0";
+    changelog = "https://github.com/LordGrimmauld/run0-sudo-shim/releases/tag/${finalAttrs.version}";
+    mainProgram = "sudo";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [
+      zimward
+      kuflierl
+      grimmauld
+    ];
+  };
+})
--- a/pkgs/by-name/sc/scaphandre/package.nix
+++ b/pkgs/by-name/sc/scaphandre/package.nix
@ -1,79 +0,0 @@
-{
-  lib,
-  rustPlatform,
-  fetchFromGitHub,
-  pkg-config,
-  openssl,
-  nix-update-script,
-  runCommand,
-  dieHook,
-  nixosTests,
-  testers,
-  scaphandre,
-}:
-
-rustPlatform.buildRustPackage rec {
-  pname = "scaphandre";
-  version = "1.0.2";
-
-  src = fetchFromGitHub {
-    owner = "hubblo-org";
-    repo = "scaphandre";
-    rev = "v${version}";
-    hash = "sha256-I+cECdpLoIj4yuWXfirwHlcn0Hkm9NxPqo/EqFiBObw=";
-  };
-
-  cargoHash = "sha256-OIoQ2r/T0ZglF1pe25ND8xe/BEWgP9JbWytJp4k7yyg=";
-
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ openssl ];
-
-  checkPhase = ''
-    runHook preCheck
-
-    # Work around to pass test due to non existing path
-    # https://github.com/hubblo-org/scaphandre/blob/v1.0.2/src/sensors/powercap_rapl.rs#L29
-    export SCAPHANDRE_POWERCAP_PATH="$(mktemp -d)/scaphandre"
-
-    mkdir -p "$SCAPHANDRE_POWERCAP_PATH"
-
-    runHook postCheck
-  '';
-
-  passthru = {
-    updateScript = nix-update-script { };
-    tests = {
-      stdout =
-        self:
-        runCommand "${pname}-test"
-          {
-            buildInputs = [
-              self
-              dieHook
-            ];
-          }
-          ''
-            ${self}/bin/scaphandre stdout -t 4 > $out  || die "Scaphandre failed to measure consumption"
-            [ -s $out ]
-          '';
-      vm = nixosTests.scaphandre;
-      version = testers.testVersion {
-        inherit version;
-        package = scaphandre;
-        command = "scaphandre --version";
-      };
-    };
-  };
-
-  meta = {
-    description = "Electrical power consumption metrology agent";
-    homepage = "https://github.com/hubblo-org/scaphandre";
-    license = lib.licenses.asl20;
-    platforms = [ "x86_64-linux" ];
-    maintainers = [ ];
-    mainProgram = "scaphandre";
-    # Upstream needs to decide what to do about a broken dependency
-    # https://github.com/hubblo-org/scaphandre/issues/403
-    broken = true;
-  };
-}
--- a/pkgs/by-name/sh/shpool/package.nix
+++ b/pkgs/by-name/sh/shpool/package.nix
@ -10,13 +10,13 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "shpool";
-  version = "0.9.8";
+  version = "0.10.1";

  src = fetchFromGitHub {
    owner = "shell-pool";
    repo = "shpool";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-iN4ZPayOUhbP3WlQIIyIN73PxH3CFgsQELWt8prtTJo=";
+    hash = "sha256-RBWB1jpqA/f6qqFUqrsbZBvtFZNwgkW93EAvKzXzFNk=";
  };

  postPatch = lib.optionalString stdenv.hostPlatform.isLinux ''
@ -24,7 +24,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
      --replace-fail '/usr/bin/shpool' "$out/bin/shpool"
  '';

-  cargoHash = "sha256-bWA0UZLr/z9MWLrp0yxblFTZwSOEIheBhmx71Ftnbcg=";
+  cargoHash = "sha256-vKyk2aEat3jLlThd+iXVPOgv7xlHnX4/xpDz2b4FT3w=";

  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [ linux-pam ];

--- a/pkgs/by-name/si/sink-rotate/package.nix
+++ b/pkgs/by-name/si/sink-rotate/package.nix
@ -5,22 +5,20 @@
  pipewire,
  wireplumber,
  makeWrapper,
+  nix-update-script,
 }:
-let
-  version = "2.3.0";
-in
 rustPlatform.buildRustPackage {
  pname = "sink-rotate";
-  inherit version;
+  version = "2.3.0-unstable-2026-05-14";

  src = fetchFromGitHub {
    owner = "mightyiam";
    repo = "sink-rotate";
-    rev = "v${version}";
-    hash = "sha256-gGmnji7KqmCxUaeXOGMnHMI6b8AJ6Np+xVjibqgGSKM=";
+    rev = "8bf24a2ebad7151fe5a7e8dd4577effccbd6fa2a";
+    hash = "sha256-ftSu04fWCgZ9Beu4pMAF8KKe3nfe0km1F6ExVWbmoxQ=";
  };

-  cargoHash = "sha256-7/EyDBWANoL5m9mx93LKMKD8hgcc3VgvrcLD6oTBXN8=";
+  cargoHash = "sha256-qiHrntm6p3j5784Pzh0NxeyQMasTQpgsfXq+DyDqies=";

  nativeBuildInputs = [ makeWrapper ];

@ -30,6 +28,10 @@ rustPlatform.buildRustPackage {
      --prefix PATH : ${wireplumber}/bin/wpctl
  '';

+  passthru.updateScript = nix-update-script {
+    extraArgs = [ "--version=branch" ];
+  };
+
  meta = {
    description = "Command that rotates the default PipeWire audio sink";
    homepage = "https://github.com/mightyiam/sink-rotate";
--- a/pkgs/by-name/sp/spacetimedb/package.nix
+++ b/pkgs/by-name/sp/spacetimedb/package.nix
@ -15,16 +15,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "spacetimedb";
-  version = "2.4.0";
+  version = "2.5.0-hotfix1";

  src = fetchFromGitHub {
    owner = "clockworklabs";
    repo = "spacetimedb";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-JEehx4UnvpuGneI049fQel+05JhNoPSFO5ZI2WBSqC4=";
+    hash = "sha256-CXc/AKzK4aTVhKgzIzkA5cdInYqOu7sMdCUyeSwixbc=";
  };

-  cargoHash = "sha256-aX45e9oHFM4aiRVNKYi6WJztaSRSpmLnyYI9oD7Pa+w=";
+  cargoHash = "sha256-iO1TGctPVmQxn1h+Md6p3pbEkfXNX91n5NZhIDK5BLI=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/by-name/tr/trilium-server/package.nix
+++ b/pkgs/by-name/tr/trilium-server/package.nix
@ -55,7 +55,7 @@ stdenv.mkDerivation {

  meta = {
    description = "Hierarchical note taking application with focus on building large personal knowledge bases";
-    homepage = "https://github.com/TriliumNext/Notes";
+    homepage = "https://github.com/TriliumNext/Trilium";
    license = lib.licenses.agpl3Plus;
    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
    platforms = [
--- a/pkgs/by-name/vg/vgmplay-libvgm/package.nix
+++ b/pkgs/by-name/vg/vgmplay-libvgm/package.nix
@ -12,15 +12,23 @@

 stdenv.mkDerivation {
  pname = "vgmplay-libvgm";
-  version = "0.52.0-unstable-2026-01-31";
+  version = "0.52.0-unstable-2026-06-07";

  src = fetchFromGitHub {
    owner = "ValleyBell";
    repo = "vgmplay-libvgm";
-    rev = "2a8f3909bcfca4c595ca71c0f762ff495a29e130";
-    hash = "sha256-TJUhE4te/nZOsckgMksWcqawsWR8r3OInJoVrv+NVAQ=";
+    rev = "01f8136fd5602a0041504d8e2ea15d46fc71b4ba";
+    hash = "sha256-1fQgRgJC8wxON3ir8ru5wxVkcIIjMSMftYksHbRxln8=";
  };

+  # We don't want text files in bindir
+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail \
+        'install(FILES "''${SRC}" RENAME "''${DST}" DESTINATION "''${CMAKE_INSTALL_BINDIR}")' \
+        'install(FILES "''${SRC}" RENAME "''${DST}" DESTINATION "''${CMAKE_INSTALL_DATADIR}/vgmplay")'
+  '';
+
  nativeBuildInputs = [
    cmake
    pkg-config
@ -32,14 +40,6 @@ stdenv.mkDerivation {
    inih
  ];

-  # https://github.com/ValleyBell/vgmplay-libvgm/issues/9
-  # Leftover that's still in use, missing documentation & integration into CMake script rn
-  env.NIX_CFLAGS_COMPILE = "-DSHARE_PREFIX=\"${placeholder "out"}\"";
-
-  postInstall = ''
-    install -Dm644 ../VGMPlay.ini $out/share/vgmplay/VGMPlay.ini
-  '';
-
  passthru.updateScript = unstableGitUpdater {
    url = "https://github.com/ValleyBell/vgmplay-libvgm.git";
  };
--- a/pkgs/by-name/vi/vips/package.nix
+++ b/pkgs/by-name/vi/vips/package.nix
@ -58,7 +58,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "vips";
-  version = "8.18.2";
+  version = "8.18.3";

  outputs = [
    "bin"
@ -72,7 +72,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "libvips";
    repo = "libvips";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-w42igzcvnCBoGHAvyb27Z6IciSuGeHctgSsZY30TtWo=";
+    hash = "sha256-P8qjbCcpWNgKthZrXd+GykfPoU2x6avMNoYX1I+YE+k=";
    # Remove unicode file names which leads to different checksums on HFS+
    # vs. other filesystems because of unicode normalisation.
    postFetch = ''
--- a/pkgs/by-name/xa/xandikos/package.nix
+++ b/pkgs/by-name/xa/xandikos/package.nix
@ -7,14 +7,14 @@

 python3Packages.buildPythonApplication rec {
  pname = "xandikos";
-  version = "0.4.0";
+  version = "0.4.2";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "jelmer";
    repo = "xandikos";
    tag = "v${version}";
-    hash = "sha256-lVxbqgxBhHJHxG3QozX9xvCZAOPSa85ATSE88i3zayA=";
+    hash = "sha256-nK+od6mJRj6I6qFhQmwwf6x+0kfC07VRVNKY6fkbNjc=";
  };

  build-system = with python3Packages; [
--- a/pkgs/by-name/xf/xfr/package.nix
+++ b/pkgs/by-name/xf/xfr/package.nix
@ -9,16 +9,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "xfr";
-  version = "0.9.14";
+  version = "0.9.19";

  src = fetchFromGitHub {
    owner = "lance0";
    repo = "xfr";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-6+kjpa6zgCXjXK1s3VrOksXFyLAbnqkNOhD50r5zyMA=";
+    hash = "sha256-O6jfK3oHzimmOsUPX7eeZmm1dPNIl98RxLrg+yiEJlo=";
  };

-  cargoHash = "sha256-U/XOlUo/zHsZCPW6lG87BKaM7xSQgineO2rH+JBx6x4=";
+  cargoHash = "sha256-c6TYOGJN7HAzi+vibK30foBtDQN3EnBFt4YrvAnApoY=";

  nativeBuildInputs = [
    installShellFiles
--- a/pkgs/by-name/xq/xq/0000-update-onig.patch
+++ b/pkgs/by-name/xq/xq/0000-update-onig.patch
@ -1,39 +0,0 @@
-diff --git a/Cargo.lock b/Cargo.lock
-index 65e50c9..2fae299 100644
--- a/Cargo.lock
-+++ b/Cargo.lock
-@@ -1,6 +1,6 @@
- # This file is automatically @generated by Cargo.
- # It is not intended for manual editing.
-version = 3
-+version = 4
- 
- [[package]]
- name = "aho-corasick"
-@@ -880,11 +880,11 @@ checksum = "3fdb12b2476b595f9358c5161aa467c2438859caa136dec86c26fdd2efe17b92"
- 
- [[package]]
- name = "onig"
-version = "6.4.0"
-+version = "6.5.1"
- source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8c4b31c8722ad9171c6d77d3557db078cab2bd50afcc9d09c8b315c59df8ca4f"
-+checksum = "336b9c63443aceef14bea841b899035ae3abe89b7c486aaf4c5bd8aafedac3f0"
- dependencies = [
- "bitflags 1.3.2",
-+ "bitflags 2.6.0",
-  "libc",
-  "once_cell",
-  "onig_sys",
-@@ -892,9 +892,9 @@ dependencies = [
- 
- [[package]]
- name = "onig_sys"
-version = "69.8.1"
-+version = "69.9.1"
- source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7b829e3d7e9cc74c7e315ee8edb185bf4190da5acde74afd7fc59c35b1f086e7"
-+checksum = "c7f86c6eef3d6df15f23bcfb6af487cbd2fed4e5581d58d5bf1f5f8b7f6727dc"
- dependencies = [
-  "cc",
-  "pkg-config",
--- a/pkgs/by-name/xq/xq/package.nix
+++ b/pkgs/by-name/xq/xq/package.nix
@ -6,17 +6,14 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "xq";
-  version = "0.4.1";
+  version = "0.5.0";

  src = fetchCrate {
    inherit (finalAttrs) pname version;
-    hash = "sha256-Qe+crretlKJRoNPO2+aHxCmMO9MecqGjOuvdhr4a0NU=";
+    hash = "sha256-kgOwTQ+t5dhhb+MrilBZ5E7Ge3U6dllUpJ2I1fCX+jc=";
  };

-  cargoPatches = [
-    ./0000-update-onig.patch
-  ];
-  cargoHash = "sha256-ACWbgGkKIn/+wPHx0dP+B0r2KDuKI4hunPwQavl6Xdo=";
+  cargoHash = "sha256-xQ650Yx+lk+UKIHrad48eWUB/TUHeutL6tSrYwV0Eeg=";

  meta = {
    description = "Pure rust implementation of jq";
--- a/pkgs/by-name/zs/zsv/package.nix
+++ b/pkgs/by-name/zs/zsv/package.nix
@ -8,13 +8,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "zsv";
-  version = "1.4.2";
+  version = "1.4.3";

  src = fetchFromGitHub {
    owner = "liquidaty";
    repo = "zsv";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-CrZgf9ayAbkIFz7MC4WUwXba0heWDxxJpePg71CCw2A=";
+    hash = "sha256-O3L7GJqujzYpWvhrLb7qMPmiWF0ZyPFhDjvsUQXjhzQ=";
  };

  buildInputs = [ jq ];
--- a/pkgs/desktops/lomiri/services/lomiri-thumbnailer/default.nix
+++ b/pkgs/desktops/lomiri/services/lomiri-thumbnailer/default.nix
@ -37,13 +37,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "lomiri-thumbnailer";
-  version = "3.1.0";
+  version = "3.1.1";

  src = fetchFromGitLab {
    owner = "ubports";
    repo = "development/core/lomiri-thumbnailer";
    tag = finalAttrs.version;
-    hash = "sha256-lXvXK7UCLX5aoGID8sOoeHBEMhdle7RUMACLHiWpcEo=";
+    hash = "sha256-NEFwNofW0Ry9V0oUiUeuzs7q6+Ht2B0oCEGjmc3ywck=";
  };

  outputs = [
@ -66,27 +66,21 @@ stdenv.mkDerivation (finalAttrs: {

    substituteInPlace plugins/Lomiri/Thumbnailer*/CMakeLists.txt \
      --replace-fail "\''${CMAKE_INSTALL_LIBDIR}/qt\''${QT_VERSION_MAJOR}/qml" "\''${CMAKE_INSTALL_PREFIX}/${qtbase.qtQmlPrefix}"
-
-    # I think this variable fails to be populated because of our toolchain, while upstream uses Debian / Ubuntu where this works fine
-    # https://cmake.org/cmake/help/v3.26/variable/CMAKE_LIBRARY_ARCHITECTURE.html
-    # > If the <LANG> compiler passes to the linker an architecture-specific system library search directory such as
-    # > <prefix>/lib/<arch> this variable contains the <arch> name if/as detected by CMake.
+  ''
+  # I think this variable fails to be populated because of our toolchain, while upstream uses Debian / Ubuntu where this works fine
+  # https://cmake.org/cmake/help/v3.26/variable/CMAKE_LIBRARY_ARCHITECTURE.html
+  # > If the <LANG> compiler passes to the linker an architecture-specific system library search directory such as
+  # > <prefix>/lib/<arch> this variable contains the <arch> name if/as detected by CMake.
+  + ''
    substituteInPlace tests/qml/CMakeLists.txt \
      --replace-fail 'CMAKE_LIBRARY_ARCHITECTURE' 'CMAKE_SYSTEM_PROCESSOR' \
      --replace-fail 'powerpc-linux-gnu' 'ppc' \
      --replace-fail 's390x-linux-gnu' 's390x'
-
-    # Tests run in parallel to other builds, don't suck up cores
+  ''
+  # Tests run in parallel to other builds, don't suck up cores
+  + ''
    substituteInPlace tests/headers/compile_headers.py \
      --replace-fail 'max_workers=multiprocessing.cpu_count()' "max_workers=1"
-  ''
-  # https://gitlab.com/ubports/development/core/lomiri-thumbnailer/-/merge_requests/31
-  # Too simple to bother with fetchpatch
-  + ''
-    substituteInPlace CMakeLists.txt \
-      --replace-fail \
-        'find_package(Boost COMPONENTS filesystem iostreams regex system REQUIRED)' \
-        'find_package(Boost COMPONENTS filesystem iostreams regex REQUIRED)'
  '';

  strictDeps = true;
--- a/pkgs/development/haskell-modules/configuration-common.nix
+++ b/pkgs/development/haskell-modules/configuration-common.nix
@ -1547,6 +1547,10 @@ with haskellLib;
    revision = null;
  }) super.svgcairo;

+  # Support GHC >= 9.12.3 || >= 9.14.1
+  # Patch from https://github.com/gtk2hs/gtk2hs/pull/349
+  glib = appendPatches [ ./patches/glib-support-rts-at-least-9.12.3-and-9.14.patch ] super.glib;
+
  # Too strict upper bound on tasty-hedgehog (<1.5)
  # https://github.com/typeclasses/ascii-predicates/pull/1
  ascii-predicates = doJailbreak super.ascii-predicates;
--- a/pkgs/development/haskell-modules/patches/glib-support-rts-at-least-9.12.3-and-9.14.patch
+++ b/pkgs/development/haskell-modules/patches/glib-support-rts-at-least-9.12.3-and-9.14.patch
@ -0,0 +1,24 @@
+From 2e1ddf6f4a28819f42db45859a83f3dd7ed14c0e Mon Sep 17 00:00:00 2001
+From: Tuong Nguyen Manh <tuongnm88@gmail.com>
+Date: Sat, 14 Feb 2026 11:58:29 +0100
+Subject: [PATCH] Fix glib for RTS API change in GHC 9.12.3/9.14.1
+
+---
+ glib/System/Glib/hsgclosure.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/glib/System/Glib/hsgclosure.c b/glib/System/Glib/hsgclosure.c
+index 1610702b..6049827f 100644
+--- a/System/Glib/hsgclosure.c
+++ b/System/Glib/hsgclosure.c
+@@ -107,7 +107,9 @@ gtk2hs_closure_marshal(GClosure *closure,
+     WHEN_DEBUG(g_debug("gtk2hs_closure_marshal(%p): about to rts_evalIO", hc->callback));
+     
+     /* perform the call */
+-    #if __GLASGOW_HASKELL__>=704
+    #if (__GLASGOW_HASKELL__>=912 && __GLASGOW_HASKELL_PATCHLEVEL1__>=3) || __GLASGOW_HASKELL__>=914
+    rts_evalIO(&cap, rts_apply(CAP (HaskellObj)ghc_hs_iface->runIO_closure, call),&ret);
+    #elif __GLASGOW_HASKELL__>=704
+     rts_evalIO(&cap, rts_apply(CAP (HaskellObj)runIO_closure, call),&ret);
+     #else
+     cap=rts_evalIO(CAP rts_apply(CAP (HaskellObj)runIO_closure, call),&ret);
--- a/pkgs/development/libraries/libsigcxx/3.0.nix
+++ b/pkgs/development/libraries/libsigcxx/3.0.nix
@ -1,20 +1,22 @@
 {
  stdenv,
  lib,
-  fetchurl,
+  fetchFromGitHub,
  pkg-config,
  meson,
  ninja,
  gnome,
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "libsigc++";
-  version = "3.6.0";
+  version = "3.8.1";

-  src = fetchurl {
-    url = "mirror://gnome/sources/libsigc++/${lib.versions.majorMinor version}/libsigc++-${version}.tar.xz";
-    sha256 = "w9I7N9/W458uCfCRt3sVQfv6F8Twtr9cibrvcikIDhc=";
+  src = fetchFromGitHub {
+    owner = "libsigcplusplus";
+    repo = "libsigcplusplus";
+    tag = finalAttrs.version;
+    hash = "sha256-ZV1gcq/efFaf4MkkDZP9Z1isNqwnvUWWouVwtTnpyhc=";
  };

  outputs = [
@ -40,9 +42,10 @@ stdenv.mkDerivation rec {

  meta = {
    homepage = "https://libsigcplusplus.github.io/libsigcplusplus/";
+    changelog = "https://github.com/libsigcplusplus/libsigcplusplus/blob/${finalAttrs.src.tag}/NEWS";
    description = "Typesafe callback system for standard C++";
    license = lib.licenses.lgpl21Plus;
    teams = [ lib.teams.gnome ];
    platforms = lib.platforms.all;
  };
-}
+})
--- a/pkgs/development/ocaml-modules/aeneas/default.nix
+++ b/pkgs/development/ocaml-modules/aeneas/default.nix
@ -16,7 +16,7 @@

 buildDunePackage (finalAttrs: {
  pname = "aeneas";
-  version = "2026.06.12";
+  version = "2026.06.14";
  __structuredAttrs = true;

  minimalOCamlVersion = "5.1";
@ -25,7 +25,7 @@ buildDunePackage (finalAttrs: {
    owner = "AeneasVerif";
    repo = "aeneas";
    tag = "nightly-${finalAttrs.version}";
-    hash = "sha256-loTnCy4lNJki+dSShZ35jKyOWIh1XcPwN7oY7CyFa04=";
+    hash = "sha256-ef68sJtVdKlIr7IiZSehFlG87m1BjW5HSG8PYxbs3Lg=";
  };

  sourceRoot = "${finalAttrs.src.name}/src";
--- a/pkgs/development/ocaml-modules/charon/default.nix
+++ b/pkgs/development/ocaml-modules/charon/default.nix
@ -16,14 +16,14 @@

 buildDunePackage (finalAttrs: {
  pname = "charon";
-  version = "2026.06.12";
+  version = "2026.06.14";
  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "AeneasVerif";
    repo = "charon";
    tag = "nightly-${finalAttrs.version}";
-    hash = "sha256-XCNDFJ8HakRBQ68rWB29R5RF7zhmqmNMna098SvXDE0=";
+    hash = "sha256-EZ1Ueco4vK4mUKyOGXXHgToNLMp+1W7095HyU+1zQ2Q=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/octave-modules/dicom/default.nix
+++ b/pkgs/development/octave-modules/dicom/default.nix
@ -11,13 +11,13 @@

 buildOctavePackage rec {
  pname = "dicom";
-  version = "0.7.2";
+  version = "0.7.3";

  src = fetchFromGitHub {
    owner = "gnu-octave";
    repo = "octave-dicom";
    tag = "release-${version}";
-    sha256 = "sha256-6FcHxNUOTvSzYqknD89G3IyKVQs/dH+heoA/5Sx4lyg=";
+    sha256 = "sha256-jvqnL9b4o5SQdqlk04LAL/U898R8B+NxC8xyV144hx4=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/anyqt/default.nix
+++ b/pkgs/development/python-modules/anyqt/default.nix
@ -1,31 +1,42 @@
 {
  lib,
+  stdenv,
  buildPythonPackage,
  fetchFromGitHub,
  pyqt5,
  pytestCheckHook,
+  qt5,
+  setuptools,
+  writableTmpDirAsHomeHook,
  nix-update-script,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "anyqt";
  version = "0.2.1";
-  format = "setuptools";
+  pyproject = true;

  src = fetchFromGitHub {
    owner = "ales-erjavec";
    repo = "anyqt";
-    rev = version;
+    tag = finalAttrs.version;
    hash = "sha256-iDUgu+x9rnpxpHzO7Rf2rJFXsheivrK7HI3FUbomkTU=";
  };

+  build-system = [ setuptools ];
+
  nativeCheckInputs = [
    pyqt5
    pytestCheckHook
+    writableTmpDirAsHomeHook
  ];

-  # All of these fail because Qt modules cannot be imported
-  disabledTestPaths = [
+  preCheck = ''
+    export QT_PLUGIN_PATH="${lib.getBin qt5.qtbase}/${qt5.qtbase.qtPluginPrefix}"
+    export QT_QPA_PLATFORM=offscreen
+  '';
+
+  disabledTestPaths = lib.optionals stdenv.hostPlatform.isDarwin [
    "tests/test_qabstractitemview.py"
    "tests/test_qaction_set_menu.py"
    "tests/test_qactionevent_action.py"
@ -43,7 +54,8 @@ buildPythonPackage rec {
  meta = {
    description = "PyQt/PySide compatibility layer";
    homepage = "https://github.com/ales-erjavec/anyqt";
+    changelog = "https://github.com/ales-erjavec/anyqt/releases/tag/${finalAttrs.version}";
    license = [ lib.licenses.gpl3Only ];
    maintainers = [ lib.maintainers.lucasew ];
  };
-}
+})
--- a/pkgs/development/python-modules/bencode-py/default.nix
+++ b/pkgs/development/python-modules/bencode-py/default.nix
@ -2,23 +2,29 @@
  lib,
  buildPythonPackage,
  fetchPypi,
+  setuptools,
  pbr,
  pytestCheckHook,
 }:
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "beconde-py";
  version = "4.0.0";
-  format = "setuptools";
+  pyproject = true;
+
+  __structuredAttrs = true;

  src = fetchPypi {
-    inherit version;
+    inherit (finalAttrs) version;
    pname = "bencode.py";
    hash = "sha256-KiTM2hclpRplCJPQtjJgE4NZ6qKZu256CZYTUKKm4Fw=";
  };

-  pythonImportsCheck = [ "bencodepy" ];
+  build-system = [
+    setuptools
+    pbr
+  ];

-  nativeBuildInputs = [ pbr ];
+  pythonImportsCheck = [ "bencodepy" ];

  nativeCheckInputs = [ pytestCheckHook ];

@ -28,4 +34,4 @@ buildPythonPackage rec {
    license = lib.licenses.bitTorrent11;
    maintainers = with lib.maintainers; [ vamega ];
  };
-}
+})
--- a/pkgs/development/python-modules/brotli-asgi/default.nix
+++ b/pkgs/development/python-modules/brotli-asgi/default.nix
@ -2,6 +2,7 @@
  lib,
  buildPythonPackage,
  fetchFromGitHub,
+  setuptools,
  # build inputs
  starlette,
  brotli,
@ -11,22 +12,23 @@
  mypy,
  brotlipy,
 }:
-let
+buildPythonPackage (finalAttrs: {
  pname = "brotli-asgi";
  version = "1.6.0";
-in
-buildPythonPackage {
-  inherit pname version;
-  format = "setuptools";
+  pyproject = true;
+
+  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "fullonic";
    repo = "brotli-asgi";
-    rev = "v${version}";
+    tag = "v${finalAttrs.version}";
    hash = "sha256-cF7A3mnkQmvtc9DgHiwqYEQQ6QagjoBGTmcBzUm6vvs=";
  };

-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
    starlette
    brotli
  ];
@ -46,4 +48,4 @@ buildPythonPackage {
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ happysalada ];
  };
-}
+})
--- a/pkgs/development/python-modules/btrfsutil/default.nix
+++ b/pkgs/development/python-modules/btrfsutil/default.nix
@ -1,6 +1,7 @@
 {
  lib,
  buildPythonPackage,
+  setuptools,
  btrfs-progs,
  autoreconfHook,
  pkg-config,
@ -11,8 +12,11 @@
 buildPythonPackage {
  pname = "btrfsutil";
  inherit (btrfs-progs) version src;
-  format = "setuptools";
+  pyproject = true;

+  build-system = [
+    setuptools
+  ];
  buildInputs = [
    btrfs-progs
    e2fsprogs
@ -41,7 +45,7 @@ buildPythonPackage {

  meta = {
    description = "Library for managing Btrfs filesystems";
-    homepage = "https://btrfs.wiki.kernel.org/";
+    homepage = "https://btrfs.readthedocs.io/";
    license = lib.licenses.lgpl21Plus;
    maintainers = with lib.maintainers; [
      raskin
--- a/pkgs/development/python-modules/clickgen/default.nix
+++ b/pkgs/development/python-modules/clickgen/default.nix
@ -3,6 +3,7 @@
  stdenv,
  buildPythonPackage,
  fetchFromGitHub,
+  setuptools,
  attrs,
  pillow,
  toml,
@ -12,19 +13,21 @@
  pytestCheckHook,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "clickgen";
  version = "2.2.5";
-  format = "setuptools";
+  pyproject = true;

  src = fetchFromGitHub {
    owner = "ful1e5";
    repo = "clickgen";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
    hash = "sha256-yFEkE1VyeHBuebpsumc6CTvv2kpAw7XAWlyUlXibqz0=";
  };

-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
    attrs
    numpy
    pillow
@ -54,4 +57,4 @@ buildPythonPackage rec {
    # ld: unknown option: -zdefs
    broken = stdenv.hostPlatform.isDarwin;
  };
-}
+})
--- a/pkgs/development/python-modules/co2signal/default.nix
+++ b/pkgs/development/python-modules/co2signal/default.nix
@ -2,21 +2,26 @@
  lib,
  buildPythonPackage,
  fetchPypi,
+  setuptools,
  requests,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "co2signal";
  version = "0.4.2";
-  format = "setuptools";
+  pyproject = true;
+
+  __structuredAttrs = true;

  src = fetchPypi {
-    inherit version;
+    inherit (finalAttrs) version;
    pname = "CO2Signal";
    hash = "sha256-8YdYbknLICRrZloGUZuscv5e1LIDZBcCPKZs6EMaNuo=";
  };

-  propagatedBuildInputs = [ requests ];
+  build-system = [ setuptools ];
+
+  dependencies = [ requests ];
  # Modules has no tests
  doCheck = false;

@ -28,4 +33,4 @@ buildPythonPackage rec {
    license = lib.licenses.gpl3Only;
    maintainers = with lib.maintainers; [ plabadens ];
  };
-}
+})
--- a/pkgs/development/python-modules/entsoe-apy/default.nix
+++ b/pkgs/development/python-modules/entsoe-apy/default.nix
@ -12,13 +12,13 @@

 buildPythonPackage rec {
  pname = "entsoe-apy";
-  version = "0.9.2";
+  version = "1.1.0";

  src = fetchFromGitHub {
    owner = "berrij";
    repo = "entsoe-apy";
    tag = "v${version}";
-    hash = "sha256-szJ3UlYJjwNZMWHJ81Gp4AgdB7JQyDP0NL0MpmjTQGY=";
+    hash = "sha256-rMWpmgPmVmnA9L9pAywt39sUBadh/HL7dSwhKpEGaVI=";
  };

  pyproject = true;
--- a/pkgs/development/python-modules/frida-python/default.nix
+++ b/pkgs/development/python-modules/frida-python/default.nix
@ -5,7 +5,7 @@
  buildPythonPackage,
 }:
 let
-  version = "17.5.1";
+  version = "17.9.11";
  format = "wheel";
  inherit (stdenvNoCC.hostPlatform) system;

@ -13,19 +13,19 @@ let
  pypiMeta =
    {
      x86_64-linux = {
-        hash = "sha256-gUYHLjKLoUI/aXzB+aU5yvfmObcA9hctkBqLgZxHvi0=";
+        hash = "sha256-ovITi0zxPqJECChrx8cAeIw7m7NjGHa+cl1NomYL718=";
        platform = "manylinux1_x86_64";
      };
      aarch64-linux = {
-        hash = "sha256-zU9mmxU8WWs2dG3lHnSiY0oTDN2tUFTMolV22SHtBbc=";
+        hash = "sha256-kDSBWC+G2m3pZ6YWhMjkvtXfR6HMVq5zxsxZUmBprrM=";
        platform = "manylinux2014_aarch64";
      };
      x86_64-darwin = {
-        hash = "sha256-hgsUQHS/DCVXSMm8ViC4zd/UVvEqYH7uwedv4ag48Mc=";
+        hash = "sha256-op8QM6f5LKCoozKawTi8hYZRO5VJ1kzWjSk62urGJLQ=";
        platform = "macosx_10_13_x86_64";
      };
      aarch64-darwin = {
-        hash = "sha256-HgjAVeACzWis0WFgf/D40GAqMbqSmZ8XBilgID3Yk5A=";
+        hash = "sha256-9JmPcE4CxzHiNLg6jMpSt/CC0eGk0VyKr1uzUTyQRqI=";
        platform = "macosx_11_0_arm64";
      };
    }
--- a/pkgs/development/python-modules/ocrmypdf/default.nix
+++ b/pkgs/development/python-modules/ocrmypdf/default.nix
@ -32,7 +32,7 @@

 buildPythonPackage rec {
  pname = "ocrmypdf";
-  version = "17.5.0";
+  version = "17.6.0";
  pyproject = true;

  src = fetchFromGitHub {
@ -45,7 +45,7 @@ buildPythonPackage rec {
    postFetch = ''
      rm "$out/.git_archival.txt"
    '';
-    hash = "sha256-t8uczNeuGgFRMToXNn/aX/eXlfeDU5Hgq82gJl9zB1E=";
+    hash = "sha256-D8O1QJm+K1xksIn7lFSZagk8y9UHuY68MiLPYO8UqQw=";
  };

  patches = [
--- a/pkgs/development/python-modules/pyenvisalink/default.nix
+++ b/pkgs/development/python-modules/pyenvisalink/default.nix
@ -10,12 +10,12 @@

 buildPythonPackage (finalAttrs: {
  pname = "pyenvisalink";
-  version = "4.9";
+  version = "4.10";
  pyproject = true;

  src = fetchPypi {
    inherit (finalAttrs) pname version;
-    hash = "sha256-WtBopLUCArWM4JwA517bnYidfOwqU3v7ApZCbsMuY/o=";
+    hash = "sha256-V/Sr49e78CO4tBRKkKMQ1Z8bA6/YeEVHdoPx2KY7+mI=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/rf-protocols/default.nix
+++ b/pkgs/development/python-modules/rf-protocols/default.nix
@ -10,14 +10,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "rf-protocols";
-  version = "4.0.1";
+  version = "4.2.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "home-assistant-libs";
    repo = "rf-protocols";
    tag = finalAttrs.version;
-    hash = "sha256-kO53S3MCYD6MUpRwhgP8cD2S0j38WKR6Bik5CXSaq3w=";
+    hash = "sha256-F0pvEg+Cns3czK/yI6M0hpgRpk67jUgRKqgzCBYmgUY=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/symbolic/default.nix
+++ b/pkgs/development/python-modules/symbolic/default.nix
@ -14,7 +14,7 @@

 buildPythonPackage (finalAttrs: {
  pname = "symbolic";
-  version = "13.1.1";
+  version = "13.2.0";
  pyproject = true;

  src = fetchFromGitHub {
@ -23,12 +23,12 @@ buildPythonPackage (finalAttrs: {
    tag = finalAttrs.version;
    # the `py` directory is not included in the tarball, so we fetch the source via git instead
    forceFetchGit = true;
-    hash = "sha256-nrEWnjMyp4KKBcdcqN0uWHIV59RHN+rJWzvJLznvh20=";
+    hash = "sha256-Nks8CClNENRFBbEGgFP3yhi5sWR/iiaLOdTayPD7M9k=";
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
    inherit (finalAttrs) pname version src;
-    hash = "sha256-9yO+Y5Oxsfa/AM54TQTCEvnHr33L7/gh1q+hQq9iP3s=";
+    hash = "sha256-r+9mrGyr78UenC9BFpW1a+VjEAXgcamLOoI8V1N10Cg=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/victron-mqtt/default.nix
+++ b/pkgs/development/python-modules/victron-mqtt/default.nix
@ -12,14 +12,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "victron-mqtt";
-  version = "2026.6.1";
+  version = "2026.6.4";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "tomer-w";
    repo = "victron_mqtt";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-0RMXl9T9Mglmg1R4rdhfYp/dhgRh1JJPmMeLOtV2/9E=";
+    hash = "sha256-lKntAZF9SkSBnlLwcwMB9wZz9PviRbSbweTMzwwzExY=";
  };

  build-system = [
--- a/pkgs/development/python-modules/yoyo-migrations/default.nix
+++ b/pkgs/development/python-modules/yoyo-migrations/default.nix
@ -8,17 +8,21 @@
  tabulate,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "yoyo-migrations";
  version = "8.2.0";
-  format = "setuptools";
+  pyproject = true;
+
+  __structuredAttrs = true;

  src = fetchPypi {
-    inherit pname version;
+    inherit (finalAttrs) pname version;
    hash = "sha256-ggYGoD4mLPHNT1niVsKPpEZCUiTVuCo9EnX9eBeFI+Q=";
  };

-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
    importlib-metadata
    setuptools
    sqlparse
@ -35,4 +39,4 @@ buildPythonPackage rec {
    license = lib.licenses.asl20;
    maintainers = with lib.maintainers; [ prusnak ];
  };
-}
+})
--- a/pkgs/development/python-modules/yubico-client/default.nix
+++ b/pkgs/development/python-modules/yubico-client/default.nix
@ -2,27 +2,34 @@
  lib,
  buildPythonPackage,
  fetchPypi,
+  setuptools,
  requests,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "yubico-client";
  version = "1.13.0";
-  format = "setuptools";
+  pyproject = true;
+
+  __structuredAttrs = true;

  src = fetchPypi {
-    inherit pname version;
-    sha256 = "e3b86cd2a123105edfacad40551c7b26e9c1193d81ffe168ee704ebfd3d11162";
+    inherit (finalAttrs) pname version;
+    hash = "sha256-47hs0qEjEF7frK1AVRx7JunBGT2B/+Fo7nBOv9PREWI=";
  };

-  propagatedBuildInputs = [ requests ];
+  build-system = [ setuptools ];
+
+  dependencies = [ requests ];

  # pypi package missing test_utils and github releases is behind
  doCheck = false;

+  pythonImportsCheck = [ "yubico_client" ];
+
  meta = {
    description = "Verifying Yubico OTPs based on the validation protocol version 2.0";
    homepage = "https://github.com/Kami/python-yubico-client/";
    license = lib.licenses.bsd3;
  };
-}
+})
--- a/pkgs/development/tools/misc/gdbgui/default.nix
+++ b/pkgs/development/tools/misc/gdbgui/default.nix
@ -5,15 +5,29 @@
  gdb,
 }:

-python3Packages.buildPythonApplication rec {
+python3Packages.buildPythonApplication (finalAttrs: {
  pname = "gdbgui";
-
  version = "0.15.3.0";
-  format = "setuptools";
+  pyproject = true;
+
+  __structuredAttrs = true;
+
+  src = fetchPypi {
+    inherit (finalAttrs) pname version;
+    hash = "sha256-/HyFE0JnoN03CDyCQCo/Y9RyH4YOMoeB7khReIb8t7Y=";
+  };
+
+  postPatch = ''
+    echo ${finalAttrs.version} > gdbgui/VERSION.txt
+    # relax version requirements
+    sed -i 's/==.*$//' requirements.txt
+  '';
+
+  build-system = with python3Packages; [ setuptools ];

  buildInputs = [ gdb ];

-  propagatedBuildInputs = with python3Packages; [
+  dependencies = with python3Packages; [
    eventlet
    flask-compress
    flask-socketio
@ -21,17 +35,6 @@ python3Packages.buildPythonApplication rec {
    pygments
  ];

-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-/HyFE0JnoN03CDyCQCo/Y9RyH4YOMoeB7khReIb8t7Y=";
-  };
-
-  postPatch = ''
-    echo ${version} > gdbgui/VERSION.txt
-    # relax version requirements
-    sed -i 's/==.*$//' requirements.txt
-  '';
-
  postInstall = ''
    wrapProgram $out/bin/gdbgui \
      --prefix PATH : ${lib.makeBinPath [ gdb ]}
@ -51,4 +54,4 @@ python3Packages.buildPythonApplication rec {
      dump_stack
    ];
  };
-}
+})
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@ -1955,6 +1955,7 @@ mapAliases {
  ryujinx = throw "'ryujinx' has been replaced by 'ryubing' as the new upstream"; # Added 2025-07-30
  ryujinx-greemdev = throw "'ryujinx-greemdev' has been renamed to/replaced by 'ryubing'"; # Converted to throw 2025-10-27
  scantailor = throw "'scantailor' has been renamed to/replaced by 'scantailor-advanced'"; # Converted to throw 2025-10-27
+  scaphandra = throw "'scaphandra' was broken with no upstream progress since February 2025"; # Added 2026-06-14
  scitoken-cpp = throw "'scitoken-cpp' has been renamed to/replaced by 'scitokens-cpp'"; # Converted to throw 2025-10-27
  scudcloud = throw "'scudcloud' has been removed as it was archived by upstream"; # Added 2025-07-24
  SDL2_classic = throw "'SDL2_classic' has been removed. Consider upgrading to 'sdl2-compat', also available as 'SDL2'."; # Added 2025-05-20
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -5484,22 +5484,6 @@ with pkgs;

  openai-whisper = with python3.pkgs; toPythonApplication openai-whisper;

-  openocd-rp2040 = openocd.overrideAttrs (old: {
-    pname = "openocd-rp2040";
-    src = fetchFromGitHub {
-      owner = "raspberrypi";
-      repo = "openocd";
-      rev = "4d87f6dcae77d3cbcd8ac3f7dc887adf46ffa504";
-      hash = "sha256-bBqVoHsnNoaC2t8hqcduI8GGlO0VDMUovCB0HC+rxvc=";
-      # openocd disables the vendored libraries that use submodules and replaces them with nix versions.
-      # this works out as one of the submodule sources seems to be flakey.
-      fetchSubmodules = false;
-    };
-    nativeBuildInputs = old.nativeBuildInputs ++ [
-      autoreconfHook
-    ];
-  });
-
  oprofile = callPackage ../development/tools/profiling/oprofile {
    libiberty_static = libiberty.override { staticBuild = true; };
  };