From ad73c80d33f7a556e52106f2cfd61bf4c7873470 Mon Sep 17 00:00:00 2001
From: Rylan Polster <rylan.polster@shopify.com>
Date: Tue, 12 May 2026 18:00:44 -0400
Subject: [PATCH 01/43] openresty: fix lib.optional misuse in configureFlags

---
 pkgs/servers/http/openresty/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/servers/http/openresty/default.nix b/pkgs/servers/http/openresty/default.nix
index f527e6a6adb3..8e60573f4a51 100644
--- a/pkgs/servers/http/openresty/default.nix
+++ b/pkgs/servers/http/openresty/default.nix
@@ -49,7 +49,7 @@ callPackage ../nginx/generic.nix args rec {
     patchShebangs configure bundle/
   '';
 
-  configureFlags = lib.optional withPostgres [ "--with-http_postgres_module" ];
+  configureFlags = lib.optionals withPostgres [ "--with-http_postgres_module" ];
 
   postInstall = ''
     ln -s $out/luajit/bin/luajit-2.1.ROLLING $out/bin/luajit-openresty

From e1fb35edd8467ff66083c9584bb9c69ec2c8380b Mon Sep 17 00:00:00 2001
From: Marcin Serwin <marcin@serwin.dev>
Date: Fri, 19 Jun 2026 21:39:25 +0200
Subject: [PATCH 02/43] maintainers: drop mikefaille

Signed-off-by: Marcin Serwin <marcin@serwin.dev>
---
 maintainers/maintainer-list.nix                      | 6 ------
 pkgs/by-name/kp/kpt/package.nix                      | 2 +-
 pkgs/by-name/ta/tanka/package.nix                    | 2 +-
 pkgs/development/python-modules/yamllint/default.nix | 2 +-
 4 files changed, 3 insertions(+), 9 deletions(-)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 387eb191a342..3a55893d1914 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -18066,12 +18066,6 @@
     githubId = 14096356;
     name = "Michael McLeod";
   };
-  mikefaille = {
-    email = "michael@faille.io";
-    github = "mikefaille";
-    githubId = 978196;
-    name = "Michaël Faille";
-  };
   mikehorn = {
     email = "mikehornproton@proton.me";
     github = "MikeHorn-git";
diff --git a/pkgs/by-name/kp/kpt/package.nix b/pkgs/by-name/kp/kpt/package.nix
index 810963745070..a4a30e4e3057 100644
--- a/pkgs/by-name/kp/kpt/package.nix
+++ b/pkgs/by-name/kp/kpt/package.nix
@@ -30,6 +30,6 @@ buildGoModule (finalAttrs: {
     mainProgram = "kpt";
     homepage = "https://github.com/kptdev/kpt";
     license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ mikefaille ];
+    maintainers = [ ];
   };
 })
diff --git a/pkgs/by-name/ta/tanka/package.nix b/pkgs/by-name/ta/tanka/package.nix
index 80f503d30b5e..544dbe836804 100644
--- a/pkgs/by-name/ta/tanka/package.nix
+++ b/pkgs/by-name/ta/tanka/package.nix
@@ -65,7 +65,7 @@ buildGoModule (finalAttrs: {
     description = "Flexible, reusable and concise configuration for Kubernetes";
     homepage = "https://tanka.dev";
     license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ mikefaille ];
+    maintainers = [ ];
     mainProgram = "tk";
   };
 })
diff --git a/pkgs/development/python-modules/yamllint/default.nix b/pkgs/development/python-modules/yamllint/default.nix
index 1f427196c9f8..89e05ca361b1 100644
--- a/pkgs/development/python-modules/yamllint/default.nix
+++ b/pkgs/development/python-modules/yamllint/default.nix
@@ -50,7 +50,7 @@ buildPythonPackage rec {
     homepage = "https://github.com/adrienverge/yamllint";
     changelog = "https://github.com/adrienverge/yamllint/blob/${src.tag}/CHANGELOG.rst";
     license = lib.licenses.gpl3Plus;
-    maintainers = with lib.maintainers; [ mikefaille ];
+    maintainers = [ ];
     mainProgram = "yamllint";
   };
 }

From de520665f651a49ac6c56c831c1ba9fc6255aa63 Mon Sep 17 00:00:00 2001
From: Hythera <87016780+Hythera@users.noreply.github.com>
Date: Sat, 20 Jun 2026 22:00:47 +0200
Subject: [PATCH 03/43] maintainers: remove hypersw

---
 maintainers/maintainer-list.nix   | 6 ------
 pkgs/by-name/fa/far2l/package.nix | 5 +----
 2 files changed, 1 insertion(+), 10 deletions(-)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 3b887d7d83a8..1c9153232716 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -11245,12 +11245,6 @@
     github = "hxtmdev";
     githubId = 7771007;
   };
-  hypersw = {
-    email = "baltic@hypersw.net";
-    github = "hypersw";
-    githubId = 2332070;
-    name = "Serge Baltic";
-  };
   hythera = {
     name = "Hythera";
     github = "Hythera";
diff --git a/pkgs/by-name/fa/far2l/package.nix b/pkgs/by-name/fa/far2l/package.nix
index ab3e3d2f5c9d..46f795747645 100644
--- a/pkgs/by-name/fa/far2l/package.nix
+++ b/pkgs/by-name/fa/far2l/package.nix
@@ -130,10 +130,7 @@ stdenv.mkDerivation rec {
     description = "Linux port of FAR Manager v2, a program for managing files and archives in Windows operating systems";
     homepage = "https://github.com/elfmz/far2l";
     license = lib.licenses.gpl2Only;
-    maintainers = with lib.maintainers; [
-      hypersw
-      smakarov
-    ];
+    maintainers = with lib.maintainers; [ smakarov ];
     platforms = lib.platforms.unix;
   };
 }

From 0d29f8773c9c9e6e64cd3aab6220d24671693ad2 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 20 Jun 2026 22:24:56 +0000
Subject: [PATCH 04/43] freelens-bin: 1.9.0 -> 1.10.1

---
 pkgs/by-name/fr/freelens-bin/package.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/fr/freelens-bin/package.nix b/pkgs/by-name/fr/freelens-bin/package.nix
index e35f6a48994a..19f61da6d001 100644
--- a/pkgs/by-name/fr/freelens-bin/package.nix
+++ b/pkgs/by-name/fr/freelens-bin/package.nix
@@ -16,24 +16,24 @@
 let
 
   pname = "freelens-bin";
-  version = "1.9.0";
+  version = "1.10.1";
 
   sources = {
     x86_64-linux = {
       url = "https://github.com/freelensapp/freelens/releases/download/v${version}/Freelens-${version}-linux-amd64.AppImage";
-      hash = "sha256-aM3sS87kpb9UhVMdG7cPeCp4j9KBW71H+MJR+oN4908=";
+      hash = "sha256-Hbu28vbgaSEjJTAVSfHJ3cZGd2PRU0ex7dNv0wo1SrI=";
     };
     aarch64-linux = {
       url = "https://github.com/freelensapp/freelens/releases/download/v${version}/Freelens-${version}-linux-arm64.AppImage";
-      hash = "sha256-/DUMuGAhVV0Ro4UbAF6lwjgB4/Wi1AY2UKn9ZuN7fDc=";
+      hash = "sha256-JrApeOjMXNNi/wCq6vY6rYpPGgMWti0H+2i7QNEXaTc=";
     };
     x86_64-darwin = {
       url = "https://github.com/freelensapp/freelens/releases/download/v${version}/Freelens-${version}-macos-amd64.dmg";
-      hash = "sha256-xKH/RBR2if37WiquCC+ZSxGyoFF32iIPvYdGNfDbDFw=";
+      hash = "sha256-BIBEaQFny/DvzrvsC38UPiIqBFaxUO/DOVQTIe2gL+Q=";
     };
     aarch64-darwin = {
       url = "https://github.com/freelensapp/freelens/releases/download/v${version}/Freelens-${version}-macos-arm64.dmg";
-      hash = "sha256-dp/kD6NHmK/CNZEF2BKh6NAChBTMgjZLY7eIwhyWgWk=";
+      hash = "sha256-5duswriuDmL92tXqLckBhH2RMPFDqFRG/WW9oYMClGY=";
     };
   };
 

From 863f7dcbf5bb42e29e2cad2872d36f837f2066e6 Mon Sep 17 00:00:00 2001
From: tgi74000 <tgi74@hotmail.fr>
Date: Mon, 22 Jun 2026 18:09:24 +0200
Subject: [PATCH 05/43] bellepoule: 5.5 -> 5.7

---
 pkgs/by-name/be/bellepoule/package.nix | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/be/bellepoule/package.nix b/pkgs/by-name/be/bellepoule/package.nix
index 5b8384bce711..61158f446e37 100644
--- a/pkgs/by-name/be/bellepoule/package.nix
+++ b/pkgs/by-name/be/bellepoule/package.nix
@@ -19,13 +19,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "bellepoule";
-  version = "5.5";
+  version = "5.7";
 
   src =
     (fetchgit {
       url = "https://git.launchpad.net/bellepoule";
-      rev = finalAttrs.version;
-      hash = "sha256-SNL6yaaKk/GU8+EvHki4ysMuCHEQxFjPd3iwVIdJtCs=";
+      # No tag available on launchpad for this version
+      rev = "06516d698fde9662d95cf6a8758eb1fbcc89e983";
+      hash = "sha256-9bbFzi9JPryJK2zv4O1TUDaeoB9GVV7LRNn6Xl8lajg=";
     }).overrideAttrs
       (oldAttrs: {
         env = oldAttrs.env or { } // {

From 7182dffae30e1fc8f1e96c673da61a3451116eb5 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 22 Jun 2026 17:02:15 +0000
Subject: [PATCH 06/43] unityhub: 3.18.2 -> 3.18.3

---
 pkgs/by-name/un/unityhub/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/un/unityhub/package.nix b/pkgs/by-name/un/unityhub/package.nix
index d183faafb7a6..ce2ce84f0844 100644
--- a/pkgs/by-name/un/unityhub/package.nix
+++ b/pkgs/by-name/un/unityhub/package.nix
@@ -11,11 +11,11 @@
 
 stdenv.mkDerivation rec {
   pname = "unityhub";
-  version = "3.18.2";
+  version = "3.18.3";
 
   src = fetchurl {
     url = "https://hub-dist.unity3d.com/artifactory/hub-debian-prod-local/pool/main/u/unity/unityhub_amd64/UnityHubSetup-${version}-amd64.deb";
-    hash = "sha256-4sluuD2g70X98N6Pk9lpC//IFpePpHZf/mowDbh0S8g=";
+    hash = "sha256-6Gjik6zIQMYoAr8jmMp3X6+Xu5fdcbh2Exd8eToSbto=";
   };
 
   nativeBuildInputs = [

From 47296edcc50d8d8bd1b7aca8eb5b8317f78272ff Mon Sep 17 00:00:00 2001
From: Gerhard Schwanzer <geri@sdf.org>
Date: Tue, 23 Jun 2026 09:54:40 +0200
Subject: [PATCH 07/43] helm: fix i686-linux build

Replace a glibc-internal __sigemptyset call in the bundled FLAC code with the public sigemptyset function.

Closes #534469

Assisted-by: pi coding agent / Mika (OpenAI GPT-5.5)
---
 pkgs/by-name/he/helm/package.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/by-name/he/helm/package.nix b/pkgs/by-name/he/helm/package.nix
index 1d71ea4ee24a..ddc4d6eb4d59 100644
--- a/pkgs/by-name/he/helm/package.nix
+++ b/pkgs/by-name/he/helm/package.nix
@@ -70,6 +70,9 @@ stdenv.mkDerivation (finalAttrs: {
 
     substituteInPlace src/common/load_save.cpp \
       --replace-fail "/usr/share/" "$out/share/"
+
+    substituteInPlace JUCE/modules/juce_audio_formats/codecs/flac/libFLAC/cpu.c \
+      --replace-fail "__sigemptyset(&sigill_sse.sa_mask);" "sigemptyset(&sigill_sse.sa_mask);"
   '';
 
   meta = {

From 89f91dbb1bbdc6f9c7c4c256b05c1c7797ebc6a8 Mon Sep 17 00:00:00 2001
From: DarkOnion0 <darkonion0@clapot.org>
Date: Tue, 23 Jun 2026 18:08:42 +0200
Subject: [PATCH 08/43] drawio: 30.0.4 -> 30.2.4

https://github.com/jgraph/drawio-desktop/releases/tag/v30.2.4
---
 pkgs/by-name/dr/drawio/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/dr/drawio/package.nix b/pkgs/by-name/dr/drawio/package.nix
index a494d80edfeb..268bff9dd8e7 100644
--- a/pkgs/by-name/dr/drawio/package.nix
+++ b/pkgs/by-name/dr/drawio/package.nix
@@ -14,14 +14,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "drawio";
-  version = "30.0.4";
+  version = "30.2.4";
 
   src = fetchFromGitHub {
     owner = "jgraph";
     repo = "drawio-desktop";
     rev = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-kkKiGRxztEVFo/wlcdBYcDlxadNarcTyL1MqwonfVY4=";
+    hash = "sha256-+Lmv9I+9dShnvdR5v8O8enj8G2iXBzWTd5ImkNkDioI=";
   };
 
   # `@electron/fuses` tries to run `codesign` and fails. Disable and use autoSignDarwinBinariesHook instead
@@ -32,7 +32,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   offlineCache = fetchNpmDeps {
     src = finalAttrs.src;
-    hash = "sha256-hv1LQwsSOsBR5l/joUmXq6foQsVilH+jw3Wje24ISCg=";
+    hash = "sha256-87Z+abu9tH/BUT9Rey5Je1YeSGdWaD0TXP7ZJGIv6hI=";
   };
 
   nativeBuildInputs = [

From 75e5bfc80916131e23901554a38518fd266ea2f1 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 24 Jun 2026 00:35:13 +0000
Subject: [PATCH 09/43] python3Packages.jupyterlite-core: 0.7.6 -> 0.8.0

---
 pkgs/development/python-modules/jupyterlite-core/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/jupyterlite-core/default.nix b/pkgs/development/python-modules/jupyterlite-core/default.nix
index 496717592b40..42ef3224589b 100644
--- a/pkgs/development/python-modules/jupyterlite-core/default.nix
+++ b/pkgs/development/python-modules/jupyterlite-core/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "jupyterlite-core";
-  version = "0.7.6";
+  version = "0.8.0";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -22,7 +22,7 @@ buildPythonPackage (finalAttrs: {
     owner = "jupyterlite";
     repo = "jupyterlite";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-TSy0GUI/7NLsLOayBwZ/raTtOtFgs/t4v1ByytVG960=";
+    hash = "sha256-LERWOeOvGdefbgQxbA8GAFZq1OD/Hhl2Q9hNVCS3Et4=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/py/jupyterlite-core";

From b8edfcbfc5bfb1155425d4c6d6f5b2344ae61a9e Mon Sep 17 00:00:00 2001
From: eljamm <fedi.jamoussi@protonmail.ch>
Date: Wed, 24 Jun 2026 07:21:13 +0200
Subject: [PATCH 10/43] python3Packages.jupyterlite-sphinx: relax
 jupyterlite-core

---
 .../development/python-modules/jupyterlite-sphinx/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/development/python-modules/jupyterlite-sphinx/default.nix b/pkgs/development/python-modules/jupyterlite-sphinx/default.nix
index a4a1c68fbe41..3e0951f57541 100644
--- a/pkgs/development/python-modules/jupyterlite-sphinx/default.nix
+++ b/pkgs/development/python-modules/jupyterlite-sphinx/default.nix
@@ -59,6 +59,10 @@ buildPythonPackage (finalAttrs: {
     ];
   };
 
+  pythonRelaxDeps = [
+    "jupyterlite-core"
+  ];
+
   # upstream has no tests
   doCheck = false;
 

From dd37c8dc248ce38c30cfb9956c50933939aa1fdb Mon Sep 17 00:00:00 2001
From: Timon <me@timon.zip>
Date: Wed, 24 Jun 2026 11:52:34 +0000
Subject: [PATCH 11/43] graphite: remove unused wasm-pack input

---
 pkgs/by-name/gr/graphite/package.nix | 2 --
 1 file changed, 2 deletions(-)

diff --git a/pkgs/by-name/gr/graphite/package.nix b/pkgs/by-name/gr/graphite/package.nix
index 2cac2d0bb464..9eabf26017e0 100644
--- a/pkgs/by-name/gr/graphite/package.nix
+++ b/pkgs/by-name/gr/graphite/package.nix
@@ -12,7 +12,6 @@
   lld,
   pkg-config,
   binaryen,
-  wasm-pack,
   cargo-about,
   nodejs,
   wasm-bindgen-cli_0_2_121,
@@ -97,7 +96,6 @@ stdenv.mkDerivation (finalAttrs: {
     npmHooks.npmConfigHook
     binaryen
     wasm-bindgen-cli_0_2_121
-    wasm-pack
     nodejs
     cargo-about
     removeReferencesTo

From 357f8ae389999a99e5ae66b89b515ccd6dc48bf9 Mon Sep 17 00:00:00 2001
From: Jiajie Chen <c@jia.je>
Date: Wed, 24 Jun 2026 23:00:45 +0800
Subject: [PATCH 12/43] cbmc: 6.9.0 -> 6.10.0

---
 pkgs/by-name/cb/cbmc/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/cb/cbmc/package.nix b/pkgs/by-name/cb/cbmc/package.nix
index ee3d677c0063..192a42a18d6d 100644
--- a/pkgs/by-name/cb/cbmc/package.nix
+++ b/pkgs/by-name/cb/cbmc/package.nix
@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "cbmc";
-  version = "6.9.0";
+  version = "6.10.0";
 
   src = fetchFromGitHub {
     owner = "diffblue";
     repo = "cbmc";
     tag = "cbmc-${finalAttrs.version}";
-    hash = "sha256-SMJBnzoyTwcwJa9L2X1iX2W4Z/Mwoirf8EXfoyG0dRI=";
+    hash = "sha256-GCagpb2TFhOEH+lzMth+PWiJxlEw0L+H1DYUEQoMF3g=";
   };
 
   srcglucose = fetchFromGitHub {

From abbbac8a62bb0d6f96e8ce4b7f1dc574335ff298 Mon Sep 17 00:00:00 2001
From: carschandler <92899389+carschandler@users.noreply.github.com>
Date: Wed, 24 Jun 2026 11:23:57 -0500
Subject: [PATCH 13/43] livekit-cli: 2.16.4 ->  2.16.6

---
 pkgs/by-name/li/livekit-cli/package.nix | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/li/livekit-cli/package.nix b/pkgs/by-name/li/livekit-cli/package.nix
index 5534cb60fce5..64f2e84af127 100644
--- a/pkgs/by-name/li/livekit-cli/package.nix
+++ b/pkgs/by-name/li/livekit-cli/package.nix
@@ -4,20 +4,28 @@
   fetchFromGitHub,
   nix-update-script,
   testers,
+  pkg-config,
+  portaudio,
 }:
 
 buildGoModule (finalAttrs: {
   pname = "livekit-cli";
-  version = "2.16.4";
+  version = "2.16.6";
 
   src = fetchFromGitHub {
     owner = "livekit";
     repo = "livekit-cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-D3moluv7tWi9BIvhHq4NDgDmCBNtWPEJPIbvpaAHtao=";
+    hash = "sha256-lsvbnc2YGPX2OYmdH6ZW0a6eNF+o3S8Y0eLuYsb4dUs=";
   };
 
-  vendorHash = "sha256-/vhISkzvfsPswsM0g4/RuyTZxqEEtfbtyAQV8YDRmu8=";
+  vendorHash = "sha256-BzEv2wpcXX7at6jJdgy9DtErbIU8ZPL+ollK1rlUWSA=";
+
+  # Use nixpkgs portaudio package + pkg-config rather than relying on a vendored
+  # git submodule, similar to the homebrew solution
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ portaudio ];
+  tags = [ "portaudio_system" ];
 
   subPackages = [ "cmd/lk" ];
 

From 8eb0f08e713ab2475993b37c35a88de951bc321c Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 24 Jun 2026 17:41:30 +0000
Subject: [PATCH 14/43] arnis: 2.8.0 -> 2.9.0

---
 pkgs/by-name/ar/arnis/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ar/arnis/package.nix b/pkgs/by-name/ar/arnis/package.nix
index 71ce5b416a5e..4a7e7621ccd3 100644
--- a/pkgs/by-name/ar/arnis/package.nix
+++ b/pkgs/by-name/ar/arnis/package.nix
@@ -12,16 +12,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "arnis";
-  version = "2.8.0";
+  version = "2.9.0";
 
   src = fetchFromGitHub {
     owner = "louis-e";
     repo = "arnis";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-hNVECK6+I3ML/knsBdvEx2Uz1w4jXHynanlQfgrM9oM=";
+    hash = "sha256-SJT1dSQ6P5UCglYP5Song/cvisYLVXepsHH6AC5kJK4=";
   };
 
-  cargoHash = "sha256-Kff+76lZ6hsSbssYhrupmE2xAt1gwia8sMZR15ReqgU=";
+  cargoHash = "sha256-h8DuDgRtI9ZUq3hPqso/DZQnGInnilFIuzTPf0qpsbo=";
 
   nativeBuildInputs = [
     cargo-tauri.hook

From d1d9fbc14a6facdd8de3ec7d4276b0e419c6631e Mon Sep 17 00:00:00 2001
From: Michael Wang <michael_wzq@icloud.com>
Date: Sat, 20 Jun 2026 11:21:49 +1000
Subject: [PATCH 15/43] maintainers: add zwang20

---
 maintainers/maintainer-list.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 457bacdcdee1..979bfbe161df 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -31159,6 +31159,12 @@
     github = "zuzuleinen";
     githubId = 944919;
   };
+  zwang20 = {
+    name = "Michael Wang";
+    github = "zwang20";
+    githubId = 41721295;
+    matrix = "@michael_wzq:matrix.org";
+  };
   zx2c4 = {
     email = "Jason@zx2c4.com";
     github = "zx2c4";

From c3a1f8a838106b2e191350256c88861d2287b4e5 Mon Sep 17 00:00:00 2001
From: Michael Wang <michael_wzq@icloud.com>
Date: Thu, 25 Jun 2026 14:26:18 +1000
Subject: [PATCH 16/43] rpcbind: 1.2.6 -> 1.2.9
 https://sourceforge.net/projects/rpcbind/files/rpcbind/1.2.9/

---
 pkgs/by-name/rp/rpcbind/package.nix | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/pkgs/by-name/rp/rpcbind/package.nix b/pkgs/by-name/rp/rpcbind/package.nix
index 4ecf858d9e16..2dcdc8577d40 100644
--- a/pkgs/by-name/rp/rpcbind/package.nix
+++ b/pkgs/by-name/rp/rpcbind/package.nix
@@ -10,14 +10,14 @@
   systemd,
 }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
   pname = "rpcbind";
-  version = "1.2.6";
+  version = "1.2.9";
 
   src = fetchgit {
     url = "git://git.linux-nfs.org/projects/steved/rpcbind.git";
-    rev = "c0c89b3bf2bdf304a5fe3cab626334e0cdaf1ef2";
-    hash = "sha256-aidETIZaQYzC3liDGM915wyBWpMrn4OudxEcFS/Iucw=";
+    rev = "refs/tags/rpcbind-${builtins.replaceStrings [ "." ] [ "_" ] finalAttrs.version}";
+    hash = "sha256-uiUGSCUkFTFl+hqzXgJEjl4WZCcMi+QxuAGmY0g+fs4=";
   };
 
   patches = [
@@ -48,9 +48,9 @@ stdenv.mkDerivation {
     license = lib.licenses.bsd3;
     platforms = lib.platforms.unix;
     homepage = "https://linux-nfs.org/";
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ zwang20 ];
     longDescription = ''
       Universal addresses to RPC program number mapper.
     '';
   };
-}
+})

From 35a7ab55b39b83fd52c471124fceab5108b44702 Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Thu, 25 Jun 2026 07:30:31 +0000
Subject: [PATCH 17/43] python3Packages.keras: 3.14.1 -> 3.15.0

Diff: https://github.com/keras-team/keras/compare/v3.14.1...v3.15.0

Changelog: https://github.com/keras-team/keras/releases/tag/v3.15.0
---
 pkgs/development/python-modules/keras/default.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/keras/default.nix b/pkgs/development/python-modules/keras/default.nix
index 111d658ee05c..9de28fa56d6d 100644
--- a/pkgs/development/python-modules/keras/default.nix
+++ b/pkgs/development/python-modules/keras/default.nix
@@ -37,7 +37,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "keras";
-  version = "3.14.1";
+  version = "3.15.0";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -45,7 +45,7 @@ buildPythonPackage (finalAttrs: {
     owner = "keras-team";
     repo = "keras";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-BaSD21mj7rPV53qFCOxGjGMm+rVzmfCooqcLcvQZa1U=";
+    hash = "sha256-EF61E7pwyuv9eKkTaPzJOWfbhK6rwkePIvmaVeriEDM=";
   };
 
   build-system = [
@@ -89,8 +89,8 @@ buildPythonPackage (finalAttrs: {
     # Require unpackaged `grain`
     "test_basics_grain"
     "test_fit_with_data_adapter_grain_dataloader"
-    "test_fit_with_data_adapter_grain_datast"
-    "test_fit_with_data_adapter_grain_datast_with_len"
+    "test_fit_with_data_adapter_grain_dataset"
+    "test_fit_with_data_adapter_grain_dataset_with_len"
     "test_image_dataset_from_directory_binary_grain"
     "test_image_dataset_from_directory_color_modes_grain"
     "test_image_dataset_from_directory_crop_to_aspect_ratio_grain"

From 4434b37238d02b208c6fd8636fd16470009d9611 Mon Sep 17 00:00:00 2001
From: Tom Oostveen <tomoostveen.06@gmail.com>
Date: Wed, 24 Jun 2026 11:41:19 +0200
Subject: [PATCH 18/43] github-desktop: 3.5.12 -> 3.6.1

---
 pkgs/by-name/gi/github-desktop/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/gi/github-desktop/package.nix b/pkgs/by-name/gi/github-desktop/package.nix
index 64a94973745f..03239cf812e0 100644
--- a/pkgs/by-name/gi/github-desktop/package.nix
+++ b/pkgs/by-name/gi/github-desktop/package.nix
@@ -29,19 +29,19 @@
 
 let
   inherit (stdenv.hostPlatform.node) arch platform;
-  cacheRootHash = "sha256-OJDxq1Yep3swLU87YyJz7WfpPzpxo5ISukB4pIwxJBA=";
-  cacheAppHash = "sha256-DYUlLNxWn4sn7PBir/miJUoDVAQ2/nbOVGWSGN+IPxw=";
+  cacheRootHash = "sha256-/3niIma45fx3cmplxZsSxmnuS+vGtzjF2wqqZ5DcuJI=";
+  cacheAppHash = "sha256-/hmUmaPNGoIaIY9qdlP5CG/IKn2nnKCpOqf9Wvj1AwM=";
 in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "github-desktop";
-  version = "3.5.12";
+  version = "3.6.1";
 
   src = fetchFromGitHub {
     owner = "desktop";
     repo = "desktop";
     tag = "release-${finalAttrs.version}";
-    hash = "sha256-/ehwjv1ipvxhmZYye1avkpz8uyO8YEWl0iM8U8n6pwE=";
+    hash = "sha256-S4lWh+6tOP3hw5nAgg6i6//Sd+gaI2aQnoRDQzHsxUg=";
     fetchSubmodules = true;
     postCheckout = "git -C $out rev-parse HEAD > $out/.gitrev";
   };

From 3affb524b14a8240effde96a0842bf5b2ab74e58 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 25 Jun 2026 23:29:25 +0000
Subject: [PATCH 19/43] joplin-desktop: 3.6.14 -> 3.6.15

---
 pkgs/by-name/jo/joplin-desktop/release-data.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/jo/joplin-desktop/release-data.json b/pkgs/by-name/jo/joplin-desktop/release-data.json
index 498b2075c049..5015e67861b0 100644
--- a/pkgs/by-name/jo/joplin-desktop/release-data.json
+++ b/pkgs/by-name/jo/joplin-desktop/release-data.json
@@ -1,6 +1,6 @@
 {
-  "version": "3.6.14",
-  "hash": "sha256-0mioVPCBhWmcXkVqCOku1KsPN29fGDp5jGhxnwD0MUk=",
+  "version": "3.6.15",
+  "hash": "sha256-uCF0nsHZowb9SuqBNni8/MWjGv9JyAUJs/gQprEoGjU=",
   "plugins": {
     "io.github.jackgruber.backup": {
       "name": "joplin-plugin-backup",

From 9f5adcafa9df04dd6a3f1c962a272a3dbaf7eebf Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 26 Jun 2026 00:46:02 +0000
Subject: [PATCH 20/43] haproxy: 3.4.0 -> 3.4.1

---
 pkgs/by-name/ha/haproxy/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ha/haproxy/package.nix b/pkgs/by-name/ha/haproxy/package.nix
index ccbdec377049..77945c05c7d6 100644
--- a/pkgs/by-name/ha/haproxy/package.nix
+++ b/pkgs/by-name/ha/haproxy/package.nix
@@ -33,11 +33,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "haproxy";
-  version = "3.4.0";
+  version = "3.4.1";
 
   src = fetchurl {
     url = "https://www.haproxy.org/download/${lib.versions.majorMinor finalAttrs.version}/src/haproxy-${finalAttrs.version}.tar.gz";
-    hash = "sha256-kpj1ZcKpuopOf4nFS+LF0/2WC1swTrVRXhXSnSwV1Pc=";
+    hash = "sha256-LmLEzk/XfTvHzxflhkMWY0VEVqB4t8hGW48BJbW8Ivg=";
   };
 
   buildInputs = [

From 7cf8a95375a94ed9f1cc7ec7297bdc4da7dfeb76 Mon Sep 17 00:00:00 2001
From: whispers <whispersofthedawn@duck.com>
Date: Thu, 25 Jun 2026 22:17:04 -0400
Subject: [PATCH 21/43] mpop: libidn -> libidn2

as per the changelog entry for version 1.4.0 at
https://git.marlam.de/gitweb/?p=mpop.git;a=blob;f=NEWS;h=8b8f2fd45a2109ba04c9720de7973a519bc4aeaf;hb=HEAD,
libidn2 is used instead of libidn where IDN support is needed, so we
migrate to that.
---
 pkgs/by-name/mp/mpop/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/mp/mpop/package.nix b/pkgs/by-name/mp/mpop/package.nix
index 2109293a91ea..85b9b73efb6c 100644
--- a/pkgs/by-name/mp/mpop/package.nix
+++ b/pkgs/by-name/mp/mpop/package.nix
@@ -5,7 +5,7 @@
   gnutls,
   openssl,
   gsasl,
-  libidn,
+  libidn2,
   pkg-config,
   nlsSupport ? true,
   idnSupport ? true,
@@ -33,7 +33,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs =
     lib.optional gsaslSupport gsasl
-    ++ lib.optional idnSupport libidn
+    ++ lib.optional idnSupport libidn2
     ++ lib.optional (sslLibrary == "gnutls") gnutls
     ++ lib.optional (sslLibrary == "openssl") openssl;
 

From 2faacc8a14553383e50c8b0067a654964f4d1331 Mon Sep 17 00:00:00 2001
From: chillcicada <2210227279@qq.com>
Date: Fri, 26 Jun 2026 11:58:52 +0800
Subject: [PATCH 22/43] ovito: 3.15.4 -> 3.15.5

---
 pkgs/by-name/ov/ovito/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ov/ovito/package.nix b/pkgs/by-name/ov/ovito/package.nix
index 4fbc6b64af3b..465250f171bd 100644
--- a/pkgs/by-name/ov/ovito/package.nix
+++ b/pkgs/by-name/ov/ovito/package.nix
@@ -23,13 +23,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ovito";
-  version = "3.15.4";
+  version = "3.15.5";
 
   src = fetchFromGitLab {
     owner = "stuko";
     repo = "ovito";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-9/aps/phWkWflEdC46QWK/psA5DpdwxBK+2NSMaB4I0=";
+    hash = "sha256-ySU9AW4p7u1/yR9uOSmS82vIwx5fh4pWrFEqBZOoEHA=";
     fetchSubmodules = true;
   };
 

From d107b05be09495d7e4dea83fb7f24d0c20befccb Mon Sep 17 00:00:00 2001
From: Anders Kaseorg <andersk@mit.edu>
Date: Thu, 25 Jun 2026 23:03:47 -0700
Subject: [PATCH 23/43] =?UTF-8?q?zulip:=205.12.3=20=E2=86=92=205.12.4?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Closes #526892; refs #521305.

Signed-off-by: Anders Kaseorg <andersk@mit.edu>
---
 pkgs/by-name/zu/zulip/package.nix | 24 +++++++++++++-----------
 1 file changed, 13 insertions(+), 11 deletions(-)

diff --git a/pkgs/by-name/zu/zulip/package.nix b/pkgs/by-name/zu/zulip/package.nix
index 14cd14a49b54..9d1fca11cf12 100644
--- a/pkgs/by-name/zu/zulip/package.nix
+++ b/pkgs/by-name/zu/zulip/package.nix
@@ -4,39 +4,40 @@
   fetchFromGitHub,
   fetchPnpmDeps,
   nodejs,
-  pnpm_10_29_2,
+  pnpm_11,
   pnpmConfigHook,
   python3,
-  electron_39,
+  electron_42,
   makeDesktopItem,
   makeBinaryWrapper,
   copyDesktopItems,
 }:
 
 let
-  electron = electron_39;
+  electron = electron_42;
+  pnpm = pnpm_11;
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "zulip";
-  version = "5.12.3";
+  version = "5.12.4";
 
   src = fetchFromGitHub {
     owner = "zulip";
     repo = "zulip-desktop";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-jRco2eyQrWf5jGvdWYn4mt8FD/xu1+FftQoB3wuF2Lw=";
+    hash = "sha256-0TQKQfjfA1Nn/xvtHF0t6i+whLkyu1kVwuZ62Z0AZgk=";
   };
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
-    pnpm = pnpm_10_29_2;
-    fetcherVersion = 3;
-    hash = "sha256-s/KllzT46L2o4SWS3z3Z7FDQD6FEEEAnPdM6tsfGRUo=";
+    inherit pnpm;
+    fetcherVersion = 4;
+    hash = "sha256-D9Ge0Ao1fnVA1hk+K1ScZ3iCnl1+iqUtZSG5ACO2H2M=";
   };
 
   nativeBuildInputs = [
     nodejs
-    pnpm_10_29_2
+    pnpm
     pnpmConfigHook
     makeBinaryWrapper
     copyDesktopItems
@@ -46,8 +47,9 @@ stdenv.mkDerivation (finalAttrs: {
   buildPhase = ''
     runHook preBuild
 
-    npm_config_nodedir=${electron.headers} \
-      node --run pack -- \
+    pnpm exec electron-vite build
+    npm_package_config_node_gyp_nodedir=${electron.headers} \
+      pnpm exec electron-builder --dir \
       -c.electronDist=${electron.dist} \
       -c.electronVersion=${electron.version}
 

From 0688e5615d2de212ae34ec8e9e4503c63ab91652 Mon Sep 17 00:00:00 2001
From: Lyn <me@fugi.dev>
Date: Fri, 26 Jun 2026 14:09:29 +0200
Subject: [PATCH 24/43] joplin-desktop: pin nodejs_22 to fix build on
 aarch64-darwin

---
 pkgs/by-name/jo/joplin-desktop/package.nix | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/jo/joplin-desktop/package.nix b/pkgs/by-name/jo/joplin-desktop/package.nix
index 444eecdda5cf..c1005e35295a 100644
--- a/pkgs/by-name/jo/joplin-desktop/package.nix
+++ b/pkgs/by-name/jo/joplin-desktop/package.nix
@@ -1,7 +1,7 @@
 {
   lib,
   stdenv,
-  nodejs,
+  nodejs_22,
   makeDesktopItem,
   copyDesktopItems,
   makeWrapper,
@@ -25,7 +25,9 @@
 }:
 
 let
-  yarn-berry = yarn-berry_4;
+  # nodejs pin should be obsolete once #522655 is in master
+  nodejs = nodejs_22;
+  yarn-berry = yarn-berry_4.override { inherit nodejs; };
 
   releaseData = lib.importJSON ./release-data.json;
 in

From 1f3eacd0c6acdc37a5fe8c1f739864979f5768c9 Mon Sep 17 00:00:00 2001
From: Sebastian Blunt <nix@sebastianblunt.com>
Date: Fri, 26 Jun 2026 05:11:07 -0700
Subject: [PATCH 25/43] cyberchef: 11.0.0 -> 11.2.0

They modified their release naming to include the hash of the git commit
that it's based on, so this adds a commit variable to support that.
---
 pkgs/by-name/cy/cyberchef/package.nix | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/cy/cyberchef/package.nix b/pkgs/by-name/cy/cyberchef/package.nix
index 515da83edae1..ecba96cf49f3 100644
--- a/pkgs/by-name/cy/cyberchef/package.nix
+++ b/pkgs/by-name/cy/cyberchef/package.nix
@@ -21,15 +21,16 @@ let
       categories = [ "Development" ];
     }
   );
-  version = "11.0.0";
+  version = "11.2.0";
+  commit = "d358d82cbcb269d764a2deb598a37043bd054f45";
 in
 stdenv.mkDerivation {
   pname = "cyberchef";
   inherit version;
 
   src = fetchzip {
-    url = "https://github.com/gchq/CyberChef/releases/download/v${version}/CyberChef_v${version}.zip";
-    hash = "sha256-Hom0YFel1GVdyx/1q7N93se6uLUVutp0Lu31WNhkPPA=";
+    url = "https://github.com/gchq/CyberChef/releases/download/v${version}/CyberChef_${commit}.zip";
+    hash = "sha256-3DXIrxCefiEYqZOPs8pO5jWdHFj7cPGgrwZcwE4ESPg=";
     stripRoot = false;
   };
 

From 4c4503b1fda76574963c3c14a630d38eee54c0e1 Mon Sep 17 00:00:00 2001
From: Henrique Oliveira <github@m0streng0.eu>
Date: Fri, 26 Jun 2026 14:43:41 +0200
Subject: [PATCH 26/43] caido-cli: 0.56.2 -> 0.57.0

---
 pkgs/by-name/ca/caido-cli/package.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/ca/caido-cli/package.nix b/pkgs/by-name/ca/caido-cli/package.nix
index f566af5e5cd4..4dd939bb2417 100644
--- a/pkgs/by-name/ca/caido-cli/package.nix
+++ b/pkgs/by-name/ca/caido-cli/package.nix
@@ -9,25 +9,25 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "caido-cli";
-  version = "0.56.2";
+  version = "0.57.0";
 
   src = fetchurl (
     {
       x86_64-linux = {
         url = "https://caido.download/releases/v${finalAttrs.version}/caido-cli-v${finalAttrs.version}-linux-x86_64.tar.gz";
-        hash = "sha256-SUkysiFdH4ilA6MKYMiSqC80NkYZ9YVO/7CT0hQY++Q=";
+        hash = "sha256-ujpGYERNceUPartkgx4o38xUfPwWvnmiEnjkvmEbybA=";
       };
       aarch64-linux = {
         url = "https://caido.download/releases/v${finalAttrs.version}/caido-cli-v${finalAttrs.version}-linux-aarch64.tar.gz";
-        hash = "sha256-rYRzo3iYjWAvRGm1+wBLGkr3eUoAGbi71+AX0qmoIXs=";
+        hash = "sha256-d1xzF0N6emShCQpotFiQEj1wV3hdt1DK7R+6Smlxrmg=";
       };
       x86_64-darwin = {
         url = "https://caido.download/releases/v${finalAttrs.version}/caido-cli-v${finalAttrs.version}-mac-x86_64.zip";
-        hash = "sha256-mMWivNwgAmMYitERwnP/lAzgzua/2UDDDffSbgZXlr4=";
+        hash = "sha256-xh6kaYPJ7dwDHM1CkDzxYBHM4cKUex+XPXceqvQgWX4=";
       };
       aarch64-darwin = {
         url = "https://caido.download/releases/v${finalAttrs.version}/caido-cli-v${finalAttrs.version}-mac-aarch64.zip";
-        hash = "sha256-19eEV79yk6PCHdl7oTw4Gqt10B7rYnZCJxBebDssFZc=";
+        hash = "sha256-FwbKLEwjiFzZWdBS6RgsDtc/EkI9AT2CBGwdmgEdDnw=";
       };
     }
     .${stdenv.hostPlatform.system}

From 47f1c61864568ef61f76c245d5003c0f08033f62 Mon Sep 17 00:00:00 2001
From: Henrique Oliveira <github@m0streng0.eu>
Date: Fri, 26 Jun 2026 14:43:53 +0200
Subject: [PATCH 27/43] caido-desktop: 0.56.2 -> 0.57.0

---
 pkgs/by-name/ca/caido-desktop/package.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/ca/caido-desktop/package.nix b/pkgs/by-name/ca/caido-desktop/package.nix
index 2b7b546ba6e2..3f9c146862d0 100644
--- a/pkgs/by-name/ca/caido-desktop/package.nix
+++ b/pkgs/by-name/ca/caido-desktop/package.nix
@@ -9,24 +9,24 @@
 
 let
   pname = "caido-desktop";
-  version = "0.56.2";
+  version = "0.57.0";
 
   sources = {
     x86_64-linux = {
       url = "https://caido.download/releases/v${version}/caido-desktop-v${version}-linux-x86_64.AppImage";
-      hash = "sha256-GW8prdvR9+WNO7bdz9ok27Aqra9+jgpZyBnYIM+G5Ys=";
+      hash = "sha256-a+WHhJ+TvwhOqHOxU7Y5LXeXAJ6T8hk71meFuTR+ra8=";
     };
     aarch64-linux = {
       url = "https://caido.download/releases/v${version}/caido-desktop-v${version}-linux-aarch64.AppImage";
-      hash = "sha256-mN5wf9RUllfbR/CfLTE6Ywzoj8wKmEG1clVCKRqPUtU=";
+      hash = "sha256-B7dw9uoG++AqT264ZlyHxGpv68fH5SlYzDKUaIM8c14=";
     };
     x86_64-darwin = {
       url = "https://caido.download/releases/v${version}/caido-desktop-v${version}-mac-x86_64.dmg";
-      hash = "sha256-4B3DQJL8M6otnLpFjr4haZA4EWHpgVADQW4DcwsDhIM=";
+      hash = "sha256-0VCLjl0Lpe+4Mgnrp6X8ApJWjAjuhkaZOxQ4P3C8MSM=";
     };
     aarch64-darwin = {
       url = "https://caido.download/releases/v${version}/caido-desktop-v${version}-mac-aarch64.dmg";
-      hash = "sha256-kZdfcZueMmgEHpNTIPANsN7X4lnVOfZXbKHxComaalM=";
+      hash = "sha256-GmpMnaGR7gYz1RvSO5xj9AA3xU1mn2IBInakmVkuG7A=";
     };
   };
 

From ac0755d316f30a64761c8877fd0cf93aa903766e Mon Sep 17 00:00:00 2001
From: Sergei Zimmerman <sergei@zimmerman.foo>
Date: Fri, 26 Jun 2026 19:38:03 +0300
Subject: [PATCH 28/43] sail-riscv: 0.8 -> 0.12; adopt

The patch was the best way I could figure out to nuke the weird
FetchContent that upstream does. I'll try to make this slightly less
annoying upstream.
---
 pkgs/by-name/sa/sail-riscv/package.nix        | 24 ++++++--
 .../by-name/sa/sail-riscv/unvendor-deps.patch | 57 +++++++++++++++++++
 2 files changed, 75 insertions(+), 6 deletions(-)
 create mode 100644 pkgs/by-name/sa/sail-riscv/unvendor-deps.patch

diff --git a/pkgs/by-name/sa/sail-riscv/package.nix b/pkgs/by-name/sa/sail-riscv/package.nix
index a27b9c4e0ca5..55d94609af37 100644
--- a/pkgs/by-name/sa/sail-riscv/package.nix
+++ b/pkgs/by-name/sa/sail-riscv/package.nix
@@ -10,19 +10,25 @@
   ocamlPackages,
 
   gmp,
+  cli11,
+  jsoncons,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "sail-riscv";
-  version = "0.8";
+  version = "0.12";
 
   src = fetchFromGitHub {
     owner = "riscv";
     repo = "sail-riscv";
-    rev = finalAttrs.version;
-    hash = "sha256-50ATe3DQcdyNOqP85mEMyEwxzpBOplzRN9ulaJNo9zo=";
+    tag = finalAttrs.version;
+    hash = "sha256-pi/XP6+NX/wNpBESmnEg2d5cppMpMwFripDPk9vTx9I=";
   };
 
+  patches = [
+    ./unvendor-deps.patch
+  ];
+
   nativeBuildInputs = [
     z3
     cmake
@@ -32,16 +38,22 @@ stdenv.mkDerivation (finalAttrs: {
   ];
   buildInputs = [
     gmp
+    # Header-only
+    jsoncons
+    cli11
   ];
   strictDeps = true;
 
-  # sail-riscv 0.8 fails to install without compressed_changelog
-  ninjaFlags = [ "compressed_changelog" ];
+  cmakeFlags = [
+    (lib.cmakeBool "ENABLE_LTO" true)
+  ];
 
   meta = {
     homepage = "https://github.com/riscv/sail-riscv";
     description = "Formal specification of the RISC-V architecture, written in Sail";
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [
+      xokdvium
+    ];
     license = lib.licenses.bsd2;
   };
 })
diff --git a/pkgs/by-name/sa/sail-riscv/unvendor-deps.patch b/pkgs/by-name/sa/sail-riscv/unvendor-deps.patch
new file mode 100644
index 000000000000..0b689e125f2e
--- /dev/null
+++ b/pkgs/by-name/sa/sail-riscv/unvendor-deps.patch
@@ -0,0 +1,57 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 2446abb8..8946820c 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -194,6 +194,8 @@ option(COVERAGE "Compile with Sail coverage collection enabled.")
+ include(GNUInstallDirs)
+ 
+ # Third party dependencies.
++find_package(CLI11 REQUIRED)
++find_package(jsoncons REQUIRED)
+ add_subdirectory("dependencies")
+ 
+ # Sail C runtime.
+diff --git a/c_emulator/CMakeLists.txt b/c_emulator/CMakeLists.txt
+index 349d2c68..3d121b75 100644
+--- a/c_emulator/CMakeLists.txt
++++ b/c_emulator/CMakeLists.txt
+@@ -60,7 +60,7 @@ target_include_directories(riscv_model
+ )
+ 
+ target_link_libraries(riscv_model
+-    PUBLIC elfio softfloat sail_runtime jsoncons default_config
++    PUBLIC elfio softfloat sail_runtime jsoncons::jsoncons default_config
+ )
+ 
+ add_dependencies(riscv_model generated_sail_riscv_model generated_config_schema)
+@@ -94,7 +94,7 @@ set_source_files_properties(
+ add_dependencies(sail_riscv_sim generated_sail_riscv_model)
+ 
+ target_link_libraries(sail_riscv_sim
+-    PRIVATE CLI11 riscv_model
++    PRIVATE CLI11::CLI11 riscv_model
+ )
+ 
+ # After the emulator is built, use it to validate the generated config files.
+diff --git a/c_emulator/riscv_sim.cpp b/c_emulator/riscv_sim.cpp
+index b50bb4cb..d8a59db1 100644
+--- a/c_emulator/riscv_sim.cpp
++++ b/c_emulator/riscv_sim.cpp
+@@ -18,7 +18,7 @@
+ #include <unistd.h>
+ #include <vector>
+ 
+-#include "CLI11.hpp"
++#include "CLI/CLI.hpp"
+ #include "elf_loader.h"
+ #include "jsoncons/config/version.hpp"
+ #include "jsoncons/json.hpp"
+diff --git a/dependencies/CMakeLists.txt b/dependencies/CMakeLists.txt
+index 95600694..66692022 100644
+--- a/dependencies/CMakeLists.txt
++++ b/dependencies/CMakeLists.txt
+@@ -1,4 +1,2 @@
+-add_subdirectory("CLI11")
+ add_subdirectory("elfio")
+ add_subdirectory("softfloat")
+-add_subdirectory("jsoncons")

From f1e050e9d4cbcc1f93b4f5eae204be402e964a9e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C2=B7=F0=90=91=91=F0=90=91=B4=F0=90=91=95=F0=90=91=91?=
 =?UTF-8?q?=F0=90=91=A9=F0=90=91=A4?= <toastal@posteo.net>
Date: Sat, 27 Jun 2026 03:08:00 +0700
Subject: [PATCH 29/43] =?UTF-8?q?nixtamal:=201.8.0=20=E2=86=92=201.8.2?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 pkgs/by-name/ni/nixtamal/package.nix | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/ni/nixtamal/package.nix b/pkgs/by-name/ni/nixtamal/package.nix
index adfbb59e507d..517a70f1e9a4 100644
--- a/pkgs/by-name/ni/nixtamal/package.nix
+++ b/pkgs/by-name/ni/nixtamal/package.nix
@@ -21,7 +21,7 @@
 
 ocamlPackages.buildDunePackage (finalAttrs: {
   pname = "nixtamal";
-  version = "1.8.0";
+  version = "1.8.2";
   release_year = 2026;
 
   minimalOCamlVersion = "5.3";
@@ -30,13 +30,15 @@ ocamlPackages.buildDunePackage (finalAttrs: {
     url = "https://darcs.toastal.in.th/nixtamal/stable/";
     mirrors = [ "https://smeder.ee/~toastal/nixtamal.darcs" ];
     rev = finalAttrs.version;
-    hash = "sha256-75p+4hZtgsiUeOxRhLpg3l/0G/XS2uCCPF58KbGTqJ8=";
+    hash = "sha256-WS3Au0V2AFUxRoINZvBLDJWvsTn/SyiN6jSLOWb+PQY=";
   };
 
   nativeBuildInputs = [
     makeBinaryWrapper
     removeReferencesTo
     installShellFiles
+    # Compile-time preprocessing
+    ocamlPackages.ppx_deriving
     # Completions
     ocamlPackages.cmdliner
     # For manpages
@@ -48,7 +50,6 @@ ocamlPackages.buildDunePackage (finalAttrs: {
   buildInputs = with ocamlPackages; [
     cmdliner
     fmt
-    ppx_deriving_qcheck
   ];
 
   propagatedBuildInputs = with ocamlPackages; [
@@ -62,8 +63,6 @@ ocamlPackages.buildDunePackage (finalAttrs: {
     })
     kdl
     logs
-    ppx_deriving
-    qcheck-core
     saturn
     stdint
     uri
@@ -72,8 +71,10 @@ ocamlPackages.buildDunePackage (finalAttrs: {
 
   checkInputs = with ocamlPackages; [
     alcotest
+    ppx_deriving_qcheck
     qcheck
     qcheck-alcotest
+    qcheck-core
   ];
 
   postPatch = ''

From aa378c0be68ca966cf5cf9c51fc81271b35b3e49 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 26 Jun 2026 22:13:40 -0700
Subject: [PATCH 30/43] pnpm_8: mark insecure

---
 pkgs/development/tools/pnpm/default.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/pkgs/development/tools/pnpm/default.nix b/pkgs/development/tools/pnpm/default.nix
index 4339c86d09cb..d89bd2034f84 100644
--- a/pkgs/development/tools/pnpm/default.nix
+++ b/pkgs/development/tools/pnpm/default.nix
@@ -9,6 +9,15 @@ let
     "8" = {
       version = "8.15.9";
       hash = "sha256-2qJ6C1QbxjUyP/lsLe2ZVGf/n+bWn/ZwIVWKqa2dzDY=";
+      knownVulnerabilities = [
+        "CVE-2026-48995"
+        "CVE-2026-50014"
+        "CVE-2026-50015"
+        "CVE-2026-50016"
+        "CVE-2026-50017"
+        "CVE-2026-50573"
+        "CVE-2026-55699"
+      ];
     };
     "9" = {
       version = "9.15.9";

From b0ed2e0e81db3459e16c7fdc9d1572092ac73573 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 26 Jun 2026 22:13:03 -0700
Subject: [PATCH 31/43] pnpm_9: mark insecure

---
 pkgs/development/tools/pnpm/default.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/pkgs/development/tools/pnpm/default.nix b/pkgs/development/tools/pnpm/default.nix
index d89bd2034f84..bd06623361bb 100644
--- a/pkgs/development/tools/pnpm/default.nix
+++ b/pkgs/development/tools/pnpm/default.nix
@@ -22,6 +22,15 @@ let
     "9" = {
       version = "9.15.9";
       hash = "sha256-z4anrXZEBjldQoam0J1zBxFyCsxtk+nc6ax6xNxKKKc=";
+      knownVulnerabilities = [
+        "CVE-2026-48995"
+        "CVE-2026-50014"
+        "CVE-2026-50015"
+        "CVE-2026-50016"
+        "CVE-2026-50017"
+        "CVE-2026-50573"
+        "CVE-2026-55699"
+      ];
     };
     # 10.29.3 made a breaking change: https://github.com/pnpm/pnpm/issues/10601.
     # Pnpm packages that depend on electron builder must be upgraded to 26.8.2 or newer

From fd30c265e510dd61da43b4695a22a02f5f94d207 Mon Sep 17 00:00:00 2001
From: Ryan Omasta <git@ryand.ca>
Date: Sun, 21 Jun 2026 17:29:21 -0600
Subject: [PATCH 32/43] kicad-unstable{,-small}: 2026-05-08 -> 2026-06-27

---
 pkgs/by-name/ki/kicad/versions.nix | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/pkgs/by-name/ki/kicad/versions.nix b/pkgs/by-name/ki/kicad/versions.nix
index db49d0a36608..1585e6514867 100644
--- a/pkgs/by-name/ki/kicad/versions.nix
+++ b/pkgs/by-name/ki/kicad/versions.nix
@@ -47,23 +47,23 @@
   };
   "kicad-unstable" = {
     kicadVersion = {
-      version = "2026-05-08";
+      version = "2026-06-27";
       src = {
-        rev = "76f8839fd232594f81180f644e3370c390025144";
-        sha256 = "0nbr3cmrz1ca4rcwbfxvlrnwxy091lscgsqd92pqyy9sjcvqdfjg";
+        rev = "26010f14414a39852891c13a5f37261691608bb6";
+        sha256 = "1jd7dc7vabi2zl38aci3xlg3qwyrnwj0j2jzlfln7zq9p8h3fnsc";
       };
     };
     libVersion = {
-      version = "2026-05-08";
+      version = "2026-06-27";
       libSources = {
-        symbols.rev = "5a41d2112853c72129a9128df01021278c1aec11";
-        symbols.sha256 = "05h8dbygch2kp4s5ikspxngwv999j7jwsiwm4pzwwcrir7dqzdfl";
+        symbols.rev = "c7e226a4946cbd123ac57131b79a73979891d82f";
+        symbols.sha256 = "0sj2kxr48wqz075fda6jiwk9ajdf6iirbiw92wlilq3w8i3xa431";
         templates.rev = "3ed4538b0f965d821df63a5fffc4441e723cfe7f";
         templates.sha256 = "0zs29zn8qjgxv0w1vyr8yxmj02m8752zagn4vcraqgik46dwg2id";
-        footprints.rev = "098da23b916d287a0c7913752df53e6bfdf640a2";
-        footprints.sha256 = "1h1v44qc5lvvqvmi1i7b79jhxsfq8snk0mcfl6r73hj6w0b25l84";
-        packages3d.rev = "394aeaa41d7be7f717715d9ba004d7d0d8b74b36";
-        packages3d.sha256 = "01nbjcs3890hyfmafc623ldmfi9n8sjr5m0wripz5fq5fjdnzqxl";
+        footprints.rev = "645402ed82e16096cf827fea7114fdbef4c46948";
+        footprints.sha256 = "0plw6h6vr3rj9y7i59wa9c9qx9l8lsvzgan48q2k87wbs4x1gwsl";
+        packages3d.rev = "0bc64e922178140eb6890377646efd45e15011bd";
+        packages3d.sha256 = "0mkc9km540n6ri5is4fjw5abv8afidwj9q7fmbs66l6kx1z3lxky";
       };
     };
   };

From 2f3e4c1013a58cdf3fc2afc3e5bd720e75e27d77 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Sat, 27 Jun 2026 15:56:11 +0200
Subject: [PATCH 33/43] 
 home-assistant-custom-lovelace-modules.custom-brand-icons: 2026.06.3 ->
 2026.06.4

Diff: https://github.com/elax46/custom-brand-icons/compare/2026.06.3...2026.06.4

Changelog: https://github.com/elax46/custom-brand-icons/releases/tag/2026.06.4
---
 .../custom-lovelace-modules/custom-brand-icons/package.nix    | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/home-assistant/custom-lovelace-modules/custom-brand-icons/package.nix b/pkgs/servers/home-assistant/custom-lovelace-modules/custom-brand-icons/package.nix
index fdddebbed451..0b09a638cb71 100644
--- a/pkgs/servers/home-assistant/custom-lovelace-modules/custom-brand-icons/package.nix
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/custom-brand-icons/package.nix
@@ -6,13 +6,13 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "custom-brand-icons";
-  version = "2026.06.3";
+  version = "2026.06.4";
 
   src = fetchFromGitHub {
     owner = "elax46";
     repo = "custom-brand-icons";
     tag = finalAttrs.version;
-    hash = "sha256-fZwffVMrO+b/r6yb2XsDhjeokyXSShiIYkc6zFZ8lwg=";
+    hash = "sha256-9wipxsj4KcwgPDo6nanMrSpuDAMAAM72EQISkTOczbs=";
   };
 
   npmDepsHash = "sha256-ZTl9+vXEBR3pvksaLWof8y1WnoL2tAL3KuPzZn7VjjE=";

From 9d04b9cc960309bf64ef05744ff26b4823b26a85 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Sat, 27 Jun 2026 16:12:51 +0200
Subject: [PATCH 34/43] home-assistant-custom-components.blueprints-updater:
 2.8.1 -> 2.9.0

Changelog: https://github.com/luuquangvu/blueprints-updater/releases/tag/2.9.0
Diff: https://github.com/luuquangvu/blueprints-updater/compare/2.8.1...2.9.0
---
 .../allow-symlinked-blueprints.diff           | 40 +++++++++----------
 .../blueprints-updater/package.nix            |  4 +-
 2 files changed, 22 insertions(+), 22 deletions(-)

diff --git a/pkgs/servers/home-assistant/custom-components/blueprints-updater/allow-symlinked-blueprints.diff b/pkgs/servers/home-assistant/custom-components/blueprints-updater/allow-symlinked-blueprints.diff
index 39fc706c1957..d7ac94e54b72 100644
--- a/pkgs/servers/home-assistant/custom-components/blueprints-updater/allow-symlinked-blueprints.diff
+++ b/pkgs/servers/home-assistant/custom-components/blueprints-updater/allow-symlinked-blueprints.diff
@@ -1,24 +1,24 @@
 diff --git a/custom_components/blueprints_updater/coordinator.py b/custom_components/blueprints_updater/coordinator.py
-index 441b870..54551d1 100644
+index dfc001c..5017b84 100644
 --- a/custom_components/blueprints_updater/coordinator.py
 +++ b/custom_components/blueprints_updater/coordinator.py
-@@ -3731,19 +3731,6 @@ def scan_blueprints(
+@@ -3752,19 +3752,6 @@ def _scan_single_blueprint_file(
+     ) -> BlueprintMetadata | None:
+         """Scan and process a single blueprint file."""
+         real_full_path = os.path.realpath(full_path)
+-        try:
+-            if (
+-                os.path.commonpath([real_full_path, context.real_blueprint_path])
+-                != context.real_blueprint_path
+-            ):
+-                _LOGGER.warning(
+-                    "Security alert: Ignoring blueprint symlink outside root: %s",
+-                    full_path,
+-                )
+-                return None
+-        except (ValueError, OSError):
+-            _LOGGER.warning("Skipping blueprint with invalid path: %s", full_path)
+-            return None
  
-                     full_path = os.path.join(root, file)
-                     real_full_path = os.path.realpath(full_path)
--                    try:
--                        if (
--                            os.path.commonpath([real_full_path, real_blueprint_path])
--                            != real_blueprint_path
--                        ):
--                            _LOGGER.warning(
--                                "Security alert: Ignoring blueprint symlink outside root: %s",
--                                full_path,
--                            )
--                            continue
--                    except (ValueError, OSError):
--                        _LOGGER.warning("Skipping blueprint with invalid path: %s", full_path)
--                        continue
- 
-                     if relative_path := get_blueprint_relative_path(hass, full_path):
-                         try:
+         relative_path = get_blueprint_relative_path(context.hass, full_path)
+         if not relative_path:
diff --git a/pkgs/servers/home-assistant/custom-components/blueprints-updater/package.nix b/pkgs/servers/home-assistant/custom-components/blueprints-updater/package.nix
index e2a9f33cc2ec..31d0bf0b2d4b 100644
--- a/pkgs/servers/home-assistant/custom-components/blueprints-updater/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/blueprints-updater/package.nix
@@ -13,13 +13,13 @@
 buildHomeAssistantComponent rec {
   owner = "luuquangvu";
   domain = "blueprints_updater";
-  version = "2.8.1";
+  version = "2.9.0";
 
   src = fetchFromGitHub {
     inherit owner;
     repo = "blueprints-updater";
     tag = version;
-    hash = "sha256-aqufiwH9yJmyr5Bd3Etwf5aK9dAfa7srXpBcmXDFAoY=";
+    hash = "sha256-zIkK7ZhUC8fPycWJqXP706XbOdhVlNAOwZBTYTII3dE=";
   };
 
   patches = [

From 4455b767142c8a1bb27d54ff9d7c529290969fbd Mon Sep 17 00:00:00 2001
From: Morgan Helton <mhelton@gmail.com>
Date: Sat, 27 Jun 2026 08:47:33 -0500
Subject: [PATCH 35/43] aws-sso-cli: 2.2.4 -> 2.3.1

---
 pkgs/by-name/aw/aws-sso-cli/package.nix | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/aw/aws-sso-cli/package.nix b/pkgs/by-name/aw/aws-sso-cli/package.nix
index d553183cd34d..b643b6cbe685 100644
--- a/pkgs/by-name/aw/aws-sso-cli/package.nix
+++ b/pkgs/by-name/aw/aws-sso-cli/package.nix
@@ -6,19 +6,20 @@
   lib,
   makeWrapper,
   stdenv,
+  writableTmpDirAsHomeHook,
   xdg-utils,
 }:
 buildGoModule (finalAttrs: {
   pname = "aws-sso-cli";
-  version = "2.2.4";
+  version = "2.3.1";
 
   src = fetchFromGitHub {
     owner = "synfinatic";
     repo = "aws-sso-cli";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-JkCHzIbIeFvmXrIkQaybjUtPDzmZ2XPv6tz3fA6ni44=";
+    hash = "sha256-JFaCTgvH6qzQ8gMt5QgqAPBal2m8FZEemTgbqyECFck=";
   };
-  vendorHash = "sha256-euqhgbyz8H/fQ1RAP0k4GMOjOu7gVeYzQv75tjCh5z0=";
+  vendorHash = "sha256-f9qSnEOUw8QWbc0rgStyzuL6lWtfy3UFhjqDAnJkKJA=";
 
   nativeBuildInputs = [
     makeWrapper
@@ -41,7 +42,14 @@ buildGoModule (finalAttrs: {
       --zsh <($out/bin/aws-sso setup completions --source --shell=zsh)
   '';
 
-  nativeCheckInputs = [ getent ];
+  nativeCheckInputs = [
+    getent
+    writableTmpDirAsHomeHook
+  ];
+
+  preCheck = ''
+    mkdir -p "$HOME/.config/aws-sso"
+  '';
 
   checkFlags =
     let
@@ -51,6 +59,7 @@ buildGoModule (finalAttrs: {
         "TestAWSConsoleUrlEU"
         "TestAWSConsoleUrlUSEast"
         "TestAWSConsoleUrlUSGov"
+        "TestGetScriptsAutoDetect"
       ]
       ++ lib.optionals stdenv.hostPlatform.isDarwin [ "TestDetectShellBash" ];
     in

From 3055643d37371660018202f8950bdd80addf20fb Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 27 Jun 2026 17:37:39 +0000
Subject: [PATCH 36/43] terraform-providers.terraform-lxd_lxd: 2.7.1 -> 3.0.1

---
 .../networking/cluster/terraform-providers/providers.json   | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index dcc45bb855cc..a507768133ea 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -1346,13 +1346,13 @@
     "vendorHash": "sha256-SF11E60OQiRdf+Pf6XyJg60yGRnGOcSzhrYccrWaeYE="
   },
   "terraform-lxd_lxd": {
-    "hash": "sha256-ovYvRpGY8tUiX5zYpTkb8uuQcKsW7o/bDgUPbkXnVnI=",
+    "hash": "sha256-vrrQxld9Ymu2RcSRlkUzknTIBJteVeb9Jqr19CV3XzM=",
     "homepage": "https://registry.terraform.io/providers/terraform-lxd/lxd",
     "owner": "terraform-lxd",
     "repo": "terraform-provider-lxd",
-    "rev": "v2.7.1",
+    "rev": "v3.0.1",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-vOip6KfD0hOQtNEc7U6DfMjitFGOleNlF88qKtbssng="
+    "vendorHash": "sha256-jOZw/va3dA0DYmnYSKbASHvyL7levjf1Bk6WelLga+Q="
   },
   "terraform-provider-openstack_openstack": {
     "hash": "sha256-6TcyPUacJNfGsaevg1DQ+WJrMFvGeo2mmsE2+P3RAZM=",

From 6097ea82e938a4348cd381f730c352fab472be11 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 27 Jun 2026 18:43:25 +0000
Subject: [PATCH 37/43] terraform-providers.metio_migadu: 2026.6.18 ->
 2026.6.25

---
 .../networking/cluster/terraform-providers/providers.json     | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index dcc45bb855cc..9a9054110244 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -905,11 +905,11 @@
     "vendorHash": "sha256-t4dbDJNjEQ6/u+/6zqk2Sdd3LVn/L2BCJujpiLdGc58="
   },
   "metio_migadu": {
-    "hash": "sha256-F/eTAR0Du0NeRwH9m8hHzjIkx31xv8aRGNWuVrntxjQ=",
+    "hash": "sha256-KDk/uSxycO9hiaiEKHq58ktwum88J9StpB52mNQYer4=",
     "homepage": "https://registry.terraform.io/providers/metio/migadu",
     "owner": "metio",
     "repo": "terraform-provider-migadu",
-    "rev": "2026.6.18",
+    "rev": "2026.6.25",
     "spdx": "0BSD",
     "vendorHash": "sha256-7/2iHstATnmeuvoIFIQw2Gi3QSIoXp5W69fnUYHipxc="
   },

From 530375c0ef1091284c41c75c26c5f302ca105db6 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 27 Jun 2026 14:16:08 +0000
Subject: [PATCH 38/43] freescout: 1.8.225 -> 1.8.226

https://github.com/freescout-help-desk/freescout/releases/tag/1.8.226

Fixes:
GHSA-gh3r-jh6q-wrvj, GHSA-gh3r-jh6q-wrvj, GHSA-w668-wq26-6c94,
GHSA-wqq7-4q7m-273v
---
 pkgs/by-name/fr/freescout/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/fr/freescout/package.nix b/pkgs/by-name/fr/freescout/package.nix
index 4b4b31d90954..440fad6b2a9a 100644
--- a/pkgs/by-name/fr/freescout/package.nix
+++ b/pkgs/by-name/fr/freescout/package.nix
@@ -7,13 +7,13 @@
 stdenv.mkDerivation (finalAttrs: {
   preferLocalBuild = true;
   pname = "freescout";
-  version = "1.8.225";
+  version = "1.8.226";
 
   src = fetchFromGitHub {
     owner = "freescout-help-desk";
     repo = "freescout";
     tag = finalAttrs.version;
-    hash = "sha256-kXZ6bjF36YO1p6q+KTugnBO+KxqQZci5O0RNM7lqecQ=";
+    hash = "sha256-9fojG6S6yb2+W94cHrLuYIRjRL8JWspsj4bNE4QKSuk=";
   };
 
   patches = [

From 33bd477c5dde1e6cb0741cbd1c86be54a199f4fa Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 27 Jun 2026 20:49:19 +0200
Subject: [PATCH 39/43] freescout: fix passthru tests

This must be a flat attribute set, not a nested one.
---
 pkgs/by-name/fr/freescout/package.nix | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/pkgs/by-name/fr/freescout/package.nix b/pkgs/by-name/fr/freescout/package.nix
index 440fad6b2a9a..3e025467f52c 100644
--- a/pkgs/by-name/fr/freescout/package.nix
+++ b/pkgs/by-name/fr/freescout/package.nix
@@ -46,9 +46,7 @@ stdenv.mkDerivation (finalAttrs: {
     runHook postInstall
   '';
 
-  passthru.tests = {
-    inherit (nixosTests) freescout;
-  };
+  passthru.tests = lib.attrValues nixosTests.freescout;
 
   # Because freescout is searching for some folders only relative to it's own source location, we need to have the symlinks to the actual locations in here
   dontCheckForBrokenSymlinks = true;

From 652ecb4d6f29c21d100d1289077b2b858f041748 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 27 Jun 2026 20:50:18 +0200
Subject: [PATCH 40/43] freescout: configure meta.changelog

---
 pkgs/by-name/fr/freescout/package.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/by-name/fr/freescout/package.nix b/pkgs/by-name/fr/freescout/package.nix
index 3e025467f52c..20a2a42f6bad 100644
--- a/pkgs/by-name/fr/freescout/package.nix
+++ b/pkgs/by-name/fr/freescout/package.nix
@@ -54,6 +54,7 @@ stdenv.mkDerivation (finalAttrs: {
   __structuredAttrs = true;
 
   meta = with lib; {
+    changelog = "https://github.com/freescout-help-desk/freescout/releases/tag/${finalAttrs.src.tag}";
     description = "Free self-hosted help desk & shared mailbox";
     license = licenses.agpl3Only;
     homepage = "https://freescout.net/";

From 9a14c9489a834e377682e76e8d6cd57acdc34c83 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 27 Jun 2026 20:51:50 +0000
Subject: [PATCH 41/43] terraform-providers.jianyuan_sentry: 0.15.2 -> 0.15.3

---
 .../networking/cluster/terraform-providers/providers.json   | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 1a49fccc3bbc..0be12e3d3314 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -787,13 +787,13 @@
     "vendorHash": "sha256-mnKXYT0GfIS+ODzBCS9l4rLF1ugadesmpgdOgj74nLg="
   },
   "jianyuan_sentry": {
-    "hash": "sha256-p1vaKwWrkNaaicQWFfnjgQ8O2P/194PvslzWdVwn6IE=",
+    "hash": "sha256-mJVuJJzNw/nkg1OoPG2iIE30RVsnj3YTQ3VAYITB6tE=",
     "homepage": "https://registry.terraform.io/providers/jianyuan/sentry",
     "owner": "jianyuan",
     "repo": "terraform-provider-sentry",
-    "rev": "v0.15.2",
+    "rev": "v0.15.3",
     "spdx": "MIT",
-    "vendorHash": "sha256-7O7/m4N7MDb+AU7w6dqQqzsqDO3jWGwOHnRX2OkJirM="
+    "vendorHash": "sha256-+LDSNV2Y5jDFyOu/PFtJhP7VgWAVvozC/yBXzTU7YXQ="
   },
   "joneshf_openwrt": {
     "hash": "sha256-z78IceF2VJtiQpVqC+rTUDsph73LZawIK+az3rEhljA=",

From 4b11716eb799be890928a73343ac0c0ef3faf2fe Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 27 Jun 2026 23:33:59 +0000
Subject: [PATCH 42/43] python3Packages.niquests: 3.19.1 -> 3.20.0

---
 pkgs/development/python-modules/niquests/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/niquests/default.nix b/pkgs/development/python-modules/niquests/default.nix
index be93ae9a06c9..1cad643d6c6d 100644
--- a/pkgs/development/python-modules/niquests/default.nix
+++ b/pkgs/development/python-modules/niquests/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage rec {
   pname = "niquests";
-  version = "3.19.1";
+  version = "3.20.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jawah";
     repo = "niquests";
     tag = "v${version}";
-    hash = "sha256-YADGkjNAG7k6peC0vaH/8OSLbaQSsxsKik3RWIqgc+w=";
+    hash = "sha256-9zBo59l/zDIMKnYX1jOMOCec+oRnCkqJjjJmjbAzoPM=";
   };
 
   build-system = [ hatchling ];

From f77ba8a01a98dba28853a87530ef88d368b94341 Mon Sep 17 00:00:00 2001
From: Colorman <foss@colorman.me>
Date: Sun, 14 Jun 2026 14:01:40 +0200
Subject: [PATCH 43/43] yafc-ce: add update script passthru attribute

The default update script used by r-ryantm does not fetch the updated .NET
dependencies, which means most updates won't get an r-ryantm PR. The
`nix-update-script` *does* fetch these deps, solving the issue.
---
 pkgs/by-name/ya/yafc-ce/package.nix | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/ya/yafc-ce/package.nix b/pkgs/by-name/ya/yafc-ce/package.nix
index 27363b0a98cb..693a70b2c767 100644
--- a/pkgs/by-name/ya/yafc-ce/package.nix
+++ b/pkgs/by-name/ya/yafc-ce/package.nix
@@ -1,11 +1,18 @@
 {
-  buildDotnetModule,
   lib,
+
+  # Build
+  buildDotnetModule,
   fetchFromGitHub,
   dotnetCorePackages,
+
+  # Runtime
   SDL2,
   SDL2_image,
   SDL2_ttf,
+
+  # Updates
+  nix-update-script,
 }:
 let
   dotnet = dotnetCorePackages.dotnet_8;
@@ -39,6 +46,8 @@ buildDotnetModule (finalAttrs: {
     SDL2_image
   ];
 
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     description = "Powerful Factorio calculator/analyser that works with mods, Community Edition";
     longDescription = ''