Merge dccba7b9f2 into haskell-updates

2026-07-06 17:13:24 -05:00 · 2026-06-21 00:59:34 +00:00 · 2026-06-21 00:59:34 +00:00 · b52ea84a40
commit b52ea84a40
parent ad66699b02 dccba7b9f2
256 changed files with 5866 additions and 5345 deletions
--- a/ci/OWNERS
+++ b/ci/OWNERS
@ -39,6 +39,7 @@
 /lib/derivations.nix        @NixOS/stdenv
 /lib/fetchers.nix           @alyssais @NixOS/stdenv
 /lib/meta.nix               @alyssais @NixOS/stdenv
+/lib/meta-types.nix         @infinisil @adisbladis @NixOS/stdenv
 /lib/source-types.nix       @alyssais @NixOS/stdenv
 /lib/systems                @alyssais @NixOS/stdenv
 ## Libraries / Module system
@ -67,7 +68,6 @@
 /pkgs/stdenv/generic/problems.nix                @infinisil
 /pkgs/test/problems                              @infinisil
 /pkgs/stdenv/generic/check-meta.nix              @infinisil @Ericson2314 @adisbladis @NixOS/stdenv
-/pkgs/stdenv/generic/meta-types.nix              @infinisil @adisbladis @NixOS/stdenv
 /pkgs/stdenv/cross                               @Ericson2314 @NixOS/stdenv
 /pkgs/build-support                              @philiptaron
 /pkgs/build-support/cc-wrapper                   @Ericson2314
--- a/ci/default.nix
+++ b/ci/default.nix
@ -26,11 +26,7 @@ let

  fmt =
    let
-      treefmtNixSrc = fetchTarball {
-        inherit (pinned.treefmt-nix) url;
-        sha256 = pinned.treefmt-nix.hash;
-      };
-      treefmtEval = (import treefmtNixSrc).evalModule pkgs ./treefmt.nix;
+      treefmt = pkgs.treefmt.withConfig ./treefmt.nix;
      fs = pkgs.lib.fileset;
      nixFilesSrc = fs.toSource {
        root = ../.;
@ -38,9 +34,8 @@ let
      };
    in
    {
-      shell = treefmtEval.config.build.devShell;
-      pkg = treefmtEval.config.build.wrapper;
-      check = treefmtEval.config.build.check nixFilesSrc;
+      pkg = treefmt;
+      check = treefmt.check nixFilesSrc;
    };

 in
--- a/ci/pinned.json
+++ b/ci/pinned.json
@ -12,19 +12,6 @@
      "revision": "8c91a71d13451abc40eb9dae8910f972f979852f",
      "url": "https://github.com/NixOS/nixpkgs/archive/8c91a71d13451abc40eb9dae8910f972f979852f.tar.gz",
      "hash": "sha256-fnzKKPvS+oieI/pTzotA5tkoM47EB1NpaBcgk4R97hE="
-    },
-    "treefmt-nix": {
-      "type": "Git",
-      "repository": {
-        "type": "GitHub",
-        "owner": "numtide",
-        "repo": "treefmt-nix"
-      },
-      "branch": "main",
-      "submodules": false,
-      "revision": "db947814a175b7ca6ded66e21383d938df01c227",
-      "url": "https://github.com/numtide/treefmt-nix/archive/db947814a175b7ca6ded66e21383d938df01c227.tar.gz",
-      "hash": "sha256-eynAfOmbmxJnkp7YewvCEbShNnnYJ9gLLqkzsYtBPeM="
    }
  },
  "version": 8
--- a/ci/treefmt.nix
+++ b/ci/treefmt.nix
@ -1,122 +1,172 @@
-{ pkgs, ... }: {
-  # Important: The auto-rebase script uses `git filter-branch --tree-filter`,
-  # which creates trees within the Git repository under `.git-rewrite/t`,
-  # notably without having a `.git` themselves.
-  # So if this projectRootFile were the default `.git/config`,
-  # having the auto-rebase script use treefmt on such a tree would make it
-  # format all files in the _parent_ Git tree as well.
-  projectRootFile = ".git-blame-ignore-revs";
-
-  # Be a bit more verbose by default, so we can see progress happening
-  settings.verbose = 1;
-
-  # By default it's info, which is too noisy since we have many unmatched files
-  settings.on-unmatched = "debug";
-
-  programs.actionlint.enable = true;
-
-  programs.biome = {
-    enable = true;
-    # Disable settings validation because its inputs are liable to hash mismatch
-    validate.enable = false;
-    settings.formatter = {
-      useEditorconfig = true;
-    };
-    settings.javascript.formatter = {
-      quoteStyle = "single";
-      semicolons = "asNeeded";
-    };
-    settings.json.formatter.enabled = false;
-  };
-  settings.formatter.biome.excludes = [
-    "*.min.js"
-    "pkgs/*"
-  ];
-
-  programs.keep-sorted.enable = true;
-
-  # This uses nixfmt underneath, the default formatter for Nix code.
-  # See https://github.com/NixOS/nixfmt
-  programs.nixfmt = {
-    enable = true;
-    package = pkgs.nixfmt;
-  };
-
-  programs.yamlfmt = {
-    enable = true;
-    settings.formatter = {
-      retain_line_breaks = true;
-    };
-  };
-  settings.formatter.yamlfmt.excludes = [
-    # Aligns comments with whitespace
-    "pkgs/development/haskell-modules/configuration-hackage2nix/main.yaml"
-    # TODO: Fix formatting for auto-generated file
-    "pkgs/development/haskell-modules/configuration-hackage2nix/transitive-broken.yaml"
-  ];
-
-  programs.nixf-diagnose = {
-    enable = true;
-    ignore = [
-      # Rule names can currently be looked up here:
-      # https://github.com/nix-community/nixd/blob/main/libnixf/src/Basic/diagnostic.py
-      # TODO: Remove the following and fix things.
-      "sema-unused-def-lambda-noarg-formal"
-      "sema-unused-def-lambda-witharg-arg"
-      "sema-unused-def-lambda-witharg-formal"
-      "sema-unused-def-let"
-      # Keep this rule, because we have `lib.or`.
-      "or-identifier"
-      # TODO: remove after outstanding prelude diagnostics issues are fixed:
-      # https://github.com/nix-community/nixd/issues/761
-      # https://github.com/nix-community/nixd/issues/762
-      "sema-primop-removed-prefix"
-      "sema-primop-overridden"
-      "sema-constant-overridden"
-      "sema-primop-unknown"
-    ];
-  };
-  settings.formatter.nixf-diagnose = {
-    # Ensure nixfmt cleans up after nixf-diagnose.
-    priority = -1;
+{
+  lib,
+  pkgs,
+  ...
+}:
+{
+  settings = {
+    # numtide/treefmt-nix defaults
    excludes = [
-      # Auto-generated; violates sema-extra-with
-      # Can only sensibly be removed when --auto-fix supports multiple fixes at once:
-      # https://github.com/inclyc/nixf-diagnose/issues/13
-      "pkgs/servers/home-assistant/component-packages.nix"
-      # https://github.com/nix-community/nixd/issues/708
-      "nixos/maintainers/scripts/azure-new/examples/basic/system.nix"
+      "*.lock"
+      "*.patch"
+      "*.diff"
+      "package-lock.json"
+      "go.mod"
+      "go.sum"
+      ".gitattributes"
+      ".gitignore"
+      ".gitmodules"
+      "COPYING"
+      "LICENSE"
    ];
-  };

-  settings.formatter.editorconfig-checker = {
-    command = "${pkgs.lib.getExe pkgs.editorconfig-checker}";
-    options = [
-      "-disable-indent-size"
-      # TODO: Remove this once this upstream issue is fixed:
-      #   https://github.com/editorconfig-checker/editorconfig-checker/issues/505
-      "-disable-charset"
-    ];
-    includes = [ "*" ];
-    priority = 1;
-  };
+    # Be a bit more verbose by default, so we can see progress happening
+    verbose = 1;

-  # TODO: Upstream this into treefmt-nix eventually:
-  #   https://github.com/numtide/treefmt-nix/issues/387
-  settings.formatter.markdown-code-runner = {
-    command = pkgs.lib.getExe pkgs.markdown-code-runner;
-    options =
-      let
-        config = pkgs.writers.writeTOML "markdown-code-runner-config" {
-          presets.nixfmt = {
-            language = "nix";
-            command = [ (pkgs.lib.getExe pkgs.nixfmt) ];
-          };
-        };
-      in
-      [ "--config=${config}" ];
-    includes = [ "*.md" ];
-  };
+    # By default it's info, which is too noisy since we have many unmatched files
+    on-unmatched = "debug";

-  programs.zizmor.enable = true;
+    formatter = {
+      # keep-sorted start block=yes newline_separated=yes
+      actionlint = {
+        command = lib.getExe pkgs.actionlint;
+        includes = [
+          ".github/workflows/*.yml"
+          ".github/workflows/*.yaml"
+        ];
+      };
+
+      biome = {
+        command = lib.getExe pkgs.biome;
+        excludes = [
+          "*.min.js"
+          "pkgs/*"
+        ];
+        includes = [
+          "*.js"
+          "*.ts"
+          "*.mjs"
+          "*.mts"
+          "*.cjs"
+          "*.cts"
+          "*.jsx"
+          "*.tsx"
+          "*.d.ts"
+          "*.d.cts"
+          "*.d.mts"
+          "*.css"
+        ];
+        options = [
+          "check"
+          "--write"
+          "--no-errors-on-unmatched"
+          "--use-editorconfig=true"
+          "--javascript-formatter-quote-style=single"
+          "--semicolons=as-needed"
+        ];
+      };
+
+      editorconfig-checker = {
+        command = lib.getExe pkgs.editorconfig-checker;
+        options = [
+          "-disable-indent-size"
+          # TODO: Remove this once this upstream issue is fixed:
+          #   https://github.com/editorconfig-checker/editorconfig-checker/issues/505
+          "-disable-charset"
+        ];
+        includes = [ "*" ];
+        priority = 1;
+      };
+
+      keep-sorted = {
+        command = lib.getExe pkgs.keep-sorted;
+        includes = [ "*" ];
+      };
+
+      markdown-code-runner = {
+        command = lib.getExe pkgs.markdown-code-runner;
+        options =
+          let
+            config = pkgs.writers.writeTOML "markdown-code-runner-config" {
+              presets.nixfmt = {
+                language = "nix";
+                command = [ (lib.getExe pkgs.nixfmt) ];
+              };
+            };
+          in
+          [ "--config=${config}" ];
+        includes = [ "*.md" ];
+      };
+
+      nixf-diagnose = {
+        command = lib.getExe pkgs.nixf-diagnose;
+        excludes = [
+          # Auto-generated; violates sema-extra-with
+          # Can only sensibly be removed when --auto-fix supports multiple fixes at once:
+          # https://github.com/inclyc/nixf-diagnose/issues/13
+          "pkgs/servers/home-assistant/component-packages.nix"
+          # https://github.com/nix-community/nixd/issues/708
+          "nixos/maintainers/scripts/azure-new/examples/basic/system.nix"
+        ];
+        includes = [ "*.nix" ];
+        options = [
+          "--auto-fix"
+          # Rule names can currently be looked up here:
+          # https://github.com/nix-community/nixd/blob/main/libnixf/src/Basic/diagnostic.py
+          # TODO: Remove the following and fix things.
+          "--ignore=sema-unused-def-lambda-noarg-formal"
+          "--ignore=sema-unused-def-lambda-witharg-arg"
+          "--ignore=sema-unused-def-lambda-witharg-formal"
+          "--ignore=sema-unused-def-let"
+          # Keep this rule, because we have `lib.or`.
+          "--ignore=or-identifier"
+          # TODO: remove after outstanding prelude diagnostics issues are fixed:
+          # https://github.com/nix-community/nixd/issues/761
+          # https://github.com/nix-community/nixd/issues/762
+          "--ignore=sema-primop-removed-prefix"
+          "--ignore=sema-primop-overridden"
+          "--ignore=sema-constant-overridden"
+          "--ignore=sema-primop-unknown"
+        ];
+        # Ensure nixfmt cleans up after nixf-diagnose.
+        priority = -1;
+      };
+
+      # This uses nixfmt underneath, the default formatter for Nix code.
+      # See https://github.com/NixOS/nixfmt
+      nixfmt = {
+        command = lib.getExe pkgs.nixfmt;
+        includes = [ "*.nix" ];
+      };
+
+      yamlfmt = {
+        command = lib.getExe pkgs.yamlfmt;
+        excludes = [
+          # Aligns comments with whitespace
+          "pkgs/development/haskell-modules/configuration-hackage2nix/main.yaml"
+          # TODO: Fix formatting for auto-generated file
+          "pkgs/development/haskell-modules/configuration-hackage2nix/transitive-broken.yaml"
+        ];
+        includes = [
+          "*.yaml"
+          "*.yml"
+        ];
+        options = [
+          "-formatter"
+          "retain_line_breaks=true"
+        ];
+      };
+
+      zizmor = {
+        command = lib.getExe pkgs.zizmor;
+        includes = [
+          ".github/workflows/*.yml"
+          ".github/workflows/*.yaml"
+          ".github/actions/**/*.yml"
+          ".github/actions/**/*.yaml"
+        ];
+      };
+      # keep-sorted end
+    };
+  };
 }
--- a/lib/attrsets.nix
+++ b/lib/attrsets.nix
@ -1800,22 +1800,28 @@ rec {
    :::
  */
  matchAttrs =
-    pattern: attrs:
+    let
+      recurse =
+        pattern: attrs:
+        all (
+          # Compare equality between `pattern` & `attrs`.
+          attr:
+          # Missing attr, not equal.
+          attrs ? ${attr}
+          && (
+            let
+              lhs = pattern.${attr};
+              rhs = attrs.${attr};
+            in
+            # Simple equality check is primarily for non-attrsets, but we run it
+            # on attrsets too, since it may let us avoid recursing
+            lhs == rhs || isAttrs lhs && isAttrs rhs && recurse lhs rhs
+          )
+        ) (attrNames pattern);
+    in
+    pattern:
    assert isAttrs pattern;
-    all (
-      # Compare equality between `pattern` & `attrs`.
-      attr:
-      # Missing attr, not equal.
-      attrs ? ${attr}
-      && (
-        let
-          lhs = pattern.${attr};
-          rhs = attrs.${attr};
-        in
-        # If attrset check recursively
-        if isAttrs lhs then isAttrs rhs && matchAttrs lhs rhs else lhs == rhs
-      )
-    ) (attrNames pattern);
+    recurse pattern;

  /**
    Override only the attributes that are already present in the old set
--- a/pkgs/stdenv/generic/meta-types.nix
+++ b/pkgs/stdenv/generic/meta-types.nix
@ -1,6 +1,7 @@
 { lib }:
 # Simple internal type checks for meta.
-# This file is not a stable interface and may be changed arbitrarily.
+# This file is only intended for internal nixpkgs use.
+# It is not a stable interface and may be changed arbitrarily.
 #
 # TODO: add a method to the module system types
 #       see https://github.com/NixOS/nixpkgs/pull/273935#issuecomment-1854173100
@ -172,10 +173,10 @@ lib.fix (self: {

  enum =
    values:
-    assert isList values && all isString values;
+    assert isList values;
    {
-      name = "enum<${concatStringsSep "," values}>";
-      verify = v: isString v && elem v values;
+      name = if all isString values then "enum<${concatStringsSep "," values}>" else "enum";
+      verify = v: elem v values;
    };

  record =
--- a/lib/systems/doubles.nix
+++ b/lib/systems/doubles.nix
@ -1,7 +1,15 @@
 { lib }:
 let
-  inherit (lib) lists;
+  inherit (lib)
+    lists
+    splitString
+    ;
  inherit (lib.systems) parse;
+  inherit (parse)
+    mkSystemFromSkeleton
+    mkSkeletonFromList
+    doubleFromSystem
+    ;
  inherit (lib.systems.inspect) predicates;
  inherit (lib.attrsets) matchAttrs;

@ -117,9 +125,17 @@ let
    "x86_64-uefi"
  ];

-  allParsed = map parse.mkSystemFromString all;
+  uncheckedSystemFromString =
+    let
+      systemType = {
+        _type = "system";
+      };
+    in
+    s: mkSystemFromSkeleton (mkSkeletonFromList (splitString "-" s)) // systemType;

-  filterDoubles = f: map parse.doubleFromSystem (lists.filter f allParsed);
+  allParsed = map uncheckedSystemFromString all;
+
+  filterDoubles = f: map doubleFromSystem (lists.filter f allParsed);

 in
 {
--- a/lib/systems/inspect.nix
+++ b/lib/systems/inspect.nix
@ -2,14 +2,17 @@

 let
  inherit (lib)
+    all
    any
+    attrNames
    attrValues
    concatMap
    filter
+    flip
    hasPrefix
+    isAttrs
    isList
    mapAttrs
-    matchAttrs
    recursiveUpdateUntil
    toList
    ;
@ -24,19 +27,49 @@ let
    execFormats
    ;

-  abis = mapAttrs (_: abi: removeAttrs abi [ "assertions" ]) lib.systems.parse.abis;
+  # Based on lib.attrsets.matchAttrs, but with:
+  # - the initial isAttrs assertion removed, since this function is only ever
+  # called with attrsets
+  # - isAttrs only performed on one side when recursing, since our input data
+  # will always share a structure
+  matchAttrsUnchecked =
+    pattern: attrs:
+    all (
+      # Compare equality between `pattern` & `attrs`.
+      attr:
+      # Missing attr, not equal.
+      attrs ? ${attr}
+      && (
+        let
+          lhs = pattern.${attr};
+          rhs = attrs.${attr};
+        in
+        # Simple equality check is primarily for non-attrsets, but we run it
+        # on attrsets too, since it may let us avoid recursing
+        lhs == rhs || isAttrs lhs && matchAttrsUnchecked lhs rhs
+      )
+    ) (attrNames pattern);
+
+  removeAssertions = flip removeAttrs [ "assertions" ];
+  abis = mapAttrs (
+    _: abi: if abi ? assertions then removeAssertions abi else abi
+  ) lib.systems.parse.abis;
 in

 rec {
  # these patterns are to be matched against {host,build,target}Platform.parsed
+  #
+  # Note: All toplevel attributes within a pattern are expected to be attrsets.
+  # matchAttrsUnchecked should be changed if a pattern is ever added that
+  # doesn't follow this axiom
  patterns = rec {
    # The patterns below are lists in sum-of-products form.
    #
    # Each attribute is list of product conditions; non-list values are treated
    # as a singleton list.  If *any* product condition in the list matches then
    # the predicate matches.  Each product condition is tested by
-    # `lib.attrsets.matchAttrs`, which requires a match on *all* attributes of
-    # the product.
+    # `matchAttrsUnchecked`, which requires a match on *all* attributes of the
+    # product.

    isi686 = {
      cpu = cpuTypes.i686;
@ -489,14 +522,40 @@ rec {
      ) pat2
    ) pat1;

-  matchAnyAttrs =
-    patterns:
-    if isList patterns then
-      attrs: any (pattern: matchAttrs pattern attrs) patterns
-    else
-      matchAttrs patterns;
+  matchAnyPattern =
+    let
+      # same as matchAttrsUnchecked definition at the top of the file, but:
+      # - pattern names are cached and reused for multiple attrset calls
+      # - avoid running isAttrs since all patterns are nested attrsets
+      matchPattern =
+        pattern:
+        let
+          names = attrNames pattern;
+        in
+        attrs:
+        all (
+          attr:
+          attrs ? ${attr}
+          && (
+            let
+              lhs = pattern.${attr};
+              rhs = attrs.${attr};
+            in
+            lhs == rhs || matchAttrsUnchecked lhs rhs
+          )
+        ) names;

-  predicates = mapAttrs (_: matchAnyAttrs) patterns;
+    in
+    pattern:
+    if isList pattern then
+      let
+        cachedPatterns = map matchPattern pattern;
+      in
+      attrs: any (pattern: pattern attrs) cachedPatterns
+    else
+      matchPattern pattern;
+
+  predicates = mapAttrs (_: matchAnyPattern) patterns;

  # these patterns are to be matched against the entire
  # {host,build,target}Platform structure; they include a `parsed={}` marker so
--- a/lib/systems/parse.nix
+++ b/lib/systems/parse.nix
@ -17,6 +17,9 @@
 { lib }:

 let
+  inherit (import ../meta-types.nix { inherit lib; })
+    enum
+    ;
  inherit (lib)
    all
    any
@ -28,7 +31,6 @@ let
    id
    length
    mapAttrs
-    mergeOneOption
    optionalString
    splitString
    versionAtLeast
@ -46,20 +48,19 @@ let
    isCygwin
    ;

-  inherit (lib.types)
-    enum
-    isType
-    mkOptionType
-    setType
-    ;
-
  setTypes =
    type:
-    mapAttrs (
-      name: value:
-      assert type.check value;
-      setType type.name ({ inherit name; } // value)
-    );
+    if type ? verify then
+      let
+        inherit (type) verify;
+      in
+      mapAttrs (
+        name: value:
+        assert verify value;
+        { inherit name; } // value
+      )
+    else
+      mapAttrs (name: value: { inherit name; } // value);

  # gnu-config will ignore the portion of a triple matching the
  # regex `e?abi.*$` when determining the validity of a triple.  In
@ -76,11 +77,9 @@ in
 rec {

  ################################################################################
-
-  types.openSignificantByte = mkOptionType {
+  types.openSignificantByte = {
    name = "significant-byte";
    description = "Endianness";
-    merge = mergeOneOption;
  };

  types.significantByte = enum (attrValues significantBytes);
@ -103,21 +102,24 @@ rec {

  ################################################################################

-  types.openCpuType = mkOptionType {
+  types.openCpuType = {
    name = "cpu-type";
    description = "instruction set architecture name and information";
-    merge = mergeOneOption;
-    check =
-      x:
-      types.bitWidth.check x.bits
-      && (if 8 < x.bits then types.significantByte.check x.significantByte else !(x ? significantByte));
+    verify =
+      let
+        verifyBitWidth = types.bitWidth.verify;
+        verifySignificantByte = types.significantByte.verify;
+      in
+      v:
+      verifyBitWidth v.bits
+      && (if 8 < v.bits then verifySignificantByte v.significantByte else !(v ? significantByte));
  };

  types.cpuType = enum (attrValues cpuTypes);

  cpuTypes =
    let
-      inherit (significantBytes) bigEndian littleEndian;
+      inherit (significantBytes) littleEndian bigEndian;
    in
    setTypes types.openCpuType {
      arm = {
@ -487,10 +489,9 @@ rec {

  ################################################################################

-  types.openVendor = mkOptionType {
+  types.openVendor = {
    name = "vendor";
    description = "vendor for the platform";
-    merge = mergeOneOption;
  };

  types.vendor = enum (attrValues vendors);
@ -499,23 +500,19 @@ rec {
    apple = { };
    pc = { };
    knuth = { };
-
    # Actually matters, unlocking some MinGW-w64-specific options in GCC. See
    # bottom of https://sourceforge.net/p/mingw-w64/wiki2/Unicode%20apps/
    w64 = { };
-
    none = { };
    unknown = { };
  };

  ################################################################################

-  types.openExecFormat = mkOptionType {
+  types.openExecFormat = {
    name = "exec-format";
    description = "executable container used by the kernel";
-    merge = mergeOneOption;
  };
-
  types.execFormat = enum (attrValues execFormats);

  execFormats = setTypes types.openExecFormat {
@ -524,16 +521,14 @@ rec {
    macho = { };
    pe = { };
    wasm = { };
-
    unknown = { };
  };

  ################################################################################

-  types.openKernelFamily = mkOptionType {
+  types.openKernelFamily = {
    name = "exec-format";
    description = "executable container used by the kernel";
-    merge = mergeOneOption;
  };

  types.kernelFamily = enum (attrValues kernelFamilies);
@ -545,12 +540,15 @@ rec {

  ################################################################################

-  types.openKernel = mkOptionType {
-    name = "kernel";
+  types.openKernel = {
+    name = "open-kernel";
    description = "kernel name and information";
-    merge = mergeOneOption;
-    check =
-      x: types.execFormat.check x.execFormat && all types.kernelFamily.check (attrValues x.families);
+    verify =
+      let
+        verifyExecFormat = types.execFormat.verify;
+        verifyKernelFamily = types.kernelFamily.verify;
+      in
+      v: verifyExecFormat v.execFormat && all verifyKernelFamily (attrValues v.families);
  };

  types.kernel = enum (attrValues kernels);
@ -647,10 +645,9 @@ rec {

  ################################################################################

-  types.openAbi = mkOptionType {
+  types.openAbi = {
    name = "abi";
    description = "binary interface for compiled code and syscalls";
-    merge = mergeOneOption;
  };

  types.abi = enum (attrValues abis);
@ -760,119 +757,138 @@ rec {

  ################################################################################

-  types.parsedPlatform = mkOptionType {
+  types.parsedPlatform = {
    name = "system";
    description = "fully parsed representation of llvm- or nix-style platform tuple";
-    merge = mergeOneOption;
-    check =
+    verify =
+      let
+        verifyCpu = types.cpuType.verify;
+        verifyVendor = types.vendor.verify;
+        verifyKernel = types.kernel.verify;
+        verifyAbi = types.abi.verify;
+      in
      {
        cpu,
        vendor,
        kernel,
        abi,
      }:
-      types.cpuType.check cpu
-      && types.vendor.check vendor
-      && types.kernel.check kernel
-      && types.abi.check abi;
+      verifyCpu cpu && verifyVendor vendor && verifyKernel kernel && verifyAbi abi;
  };

-  isSystem = isType "system";
+  isSystem = v: v._type or null == "system";

  mkSystem =
+    let
+      inherit (types.parsedPlatform) verify;
+    in
    components:
-    assert types.parsedPlatform.check components;
-    setType "system" components;
+    assert verify components;
+    components
+    // {
+      _type = "system";
+    };

  mkSkeletonFromList =
+    let
+      linuxComponents = [
+        "eabi"
+        "eabihf"
+        "elf"
+        "gnu"
+      ];
+      appleComponents = [
+        "redox"
+        "mmixware"
+        "ghcjs"
+        "mingw32"
+        "uefi"
+      ];
+    in
    l:
    {
      "1" =
-        if head l == "avr" then
+        let
+          firstComponent = head l;
+        in
+        if firstComponent == "avr" then
          {
-            cpu = head l;
+            cpu = firstComponent;
            kernel = "none";
            abi = "unknown";
          }
        else
          throw "system string '${lib.concatStringsSep "-" l}' with 1 component is ambiguous";
      "2" = # We only do 2-part hacks for things Nix already supports
-        if elemAt l 1 == "cygwin" then
+        let
+          secondComponent = elemAt l 1;
+        in
+        if secondComponent == "cygwin" then
          mkSkeletonFromList [
            (head l)
            "pc"
-            "cygwin"
+            secondComponent
          ]
        # MSVC ought to be the default ABI so this case isn't needed. But then it
        # becomes difficult to handle the gnu* variants for Aarch32 correctly for
        # minGW. So it's easier to make gnu* the default for the MinGW, but
        # hack-in MSVC for the non-MinGW case right here.
-        else if elemAt l 1 == "windows" then
+        else if secondComponent == "windows" then
          {
            cpu = head l;
-            kernel = "windows";
+            kernel = secondComponent;
            abi = "msvc";
          }
-        else if (elemAt l 1) == "elf" then
+        else if secondComponent == "elf" then
          {
            cpu = head l;
            vendor = "unknown";
            kernel = "none";
-            abi = elemAt l 1;
+            abi = secondComponent;
          }
        else
          {
            cpu = head l;
-            kernel = elemAt l 1;
+            kernel = secondComponent;
          };
      "3" =
+        let
+          secondComponent = elemAt l 1;
+          thirdComponent = elemAt l 2;
+        in
        # cpu-kernel-environment
-        if
-          elemAt l 1 == "linux"
-          || elem (elemAt l 2) [
-            "eabi"
-            "eabihf"
-            "elf"
-            "gnu"
-          ]
-        then
+        if secondComponent == "linux" || elem thirdComponent linuxComponents then
          {
            cpu = head l;
-            kernel = elemAt l 1;
-            abi = elemAt l 2;
+            kernel = secondComponent;
+            abi = thirdComponent;
            vendor = "unknown";
          }
        # cpu-vendor-os
        else if
-          elemAt l 1 == "apple"
-          || elem (elemAt l 2) [
-            "redox"
-            "mmixware"
-            "ghcjs"
-            "mingw32"
-            "uefi"
-          ]
-          || hasPrefix "freebsd" (elemAt l 2)
-          || hasPrefix "netbsd" (elemAt l 2)
-          || hasPrefix "openbsd" (elemAt l 2)
-          || hasPrefix "genode" (elemAt l 2)
-          || hasPrefix "wasm32" (elemAt l 0)
+          secondComponent == "apple"
+          || elem thirdComponent appleComponents
+          || hasPrefix "freebsd" thirdComponent
+          || hasPrefix "netbsd" thirdComponent
+          || hasPrefix "openbsd" thirdComponent
+          || hasPrefix "genode" thirdComponent
+          || hasPrefix "wasm32" (head l)
        then
          {
            cpu = head l;
-            vendor = elemAt l 1;
+            vendor = secondComponent;
            kernel =
-              if elemAt l 2 == "mingw32" then
+              if thirdComponent == "mingw32" then
                "windows" # autotools breaks on -gnu for window
              else
-                elemAt l 2;
+                thirdComponent;
          }
        # lots of tools expect a triplet for Cygwin, even though the vendor is just "pc"
-        else if elemAt l 2 == "cygwin" then
+        else if thirdComponent == "cygwin" then
          {
            cpu = head l;
-            vendor = elemAt l 1;
-            kernel = "cygwin";
+            vendor = secondComponent;
+            kernel = thirdComponent;
          }
        else
          throw "system string '${lib.concatStringsSep "-" l}' with 3 components is ambiguous";
@ -887,7 +903,17 @@ rec {
    or (throw "system string '${lib.concatStringsSep "-" l}' has invalid number of hyphen-separated components");

  # This should revert the job done by config.guess from the gcc compiler.
+  # Note: this does _not_ verify that the system is valid
+  # `mkSystemFromString` is recommended for external use
  mkSystemFromSkeleton =
+    let
+      getCpu = name: cpuTypes.${name} or (throw "Unknown CPU type: ${name}");
+      getVendor = name: vendors.${name} or (throw "Unknown vendor: ${name}");
+      getKernel = name: kernels.${name} or (throw "Unknown kernel: ${name}");
+      getAbi = name: abis.${name} or (throw "Unknown ABI: ${name}");
+      hasDarwinPrefix = hasPrefix "darwin";
+      hasBsdPrefix = hasPrefix "netbsd";
+    in
    {
      cpu,
      # Optional, but fallback too complex for here.
@ -902,11 +928,6 @@ rec {
        null,
    }@args:
    let
-      getCpu = name: cpuTypes.${name} or (throw "Unknown CPU type: ${name}");
-      getVendor = name: vendors.${name} or (throw "Unknown vendor: ${name}");
-      getKernel = name: kernels.${name} or (throw "Unknown kernel: ${name}");
-      getAbi = name: abis.${name} or (throw "Unknown ABI: ${name}");
-
      parsed = {
        cpu = getCpu args.cpu;
        vendor =
@ -919,10 +940,10 @@ rec {
          else
            vendors.unknown;
        kernel =
-          if hasPrefix "darwin" args.kernel then
-            getKernel "darwin"
-          else if hasPrefix "netbsd" args.kernel then
-            getKernel "netbsd"
+          if hasDarwinPrefix args.kernel then
+            kernels.darwin
+          else if hasBsdPrefix args.kernel then
+            kernels.netbsd
          else
            getKernel (removeAbiSuffix args.kernel);
        abi =
@ -941,11 +962,12 @@ rec {
      };

    in
-    mkSystem parsed;
+    parsed;

-  mkSystemFromString = s: mkSystemFromSkeleton (mkSkeletonFromList (splitString "-" s));
+  mkSystemFromString = s: mkSystem (mkSystemFromSkeleton (mkSkeletonFromList (splitString "-" s)));

-  kernelName = kernel: kernel.name + toString (kernel.version or "");
+  kernelName =
+    kernel: if kernel ? version then kernel.name + toString kernel.version else kernel.name;

  darwinArch = cpu: if cpu.name == "aarch64" then "arm64" else cpu.name;

--- a/lib/tests/systems.nix
+++ b/lib/tests/systems.nix
@ -215,6 +215,22 @@ lib.runTests (
  })

  // {
+    test_platforms_pass_typecheck = {
+      # To improve performance, the result of parsing all 70+ systems in
+      # `lib.platforms` into their attrset representations aren't typechecked.
+      # The results are expected to be constant, and avoiding the slow
+      # validation gives a meaningful improvement to evaluation speed. We ensure
+      # that all systems pass validation here
+      expr = builtins.filter (
+        system:
+        let
+          evalResult = builtins.tryEval (lib.systems.parse.mkSystemFromString system);
+        in
+        evalResult.success == false
+      ) lib.platforms.all;
+
+      expected = [ ];
+    };
    test_equals_example_x86_64-linux = {
      expr = lib.systems.equals (lib.systems.elaborate "x86_64-linux") (
        lib.systems.elaborate "x86_64-linux"
--- a/maintainers/github-teams.json
+++ b/maintainers/github-teams.json
@ -43,12 +43,9 @@
    "id": 5468470,
    "maintainers": {},
    "members": {
-      "aherrmann": 732652,
      "avdv": 3471749,
-      "ethercrow": 222467,
      "groodt": 343415,
-      "kalbasit": 87115,
-      "mboes": 51356
+      "kalbasit": 87115
    },
    "name": "Bazel"
  },
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -3101,6 +3101,12 @@
    githubId = 75235;
    name = "Michael Walker";
  };
+  barsikus007 = {
+    name = "barsikus007";
+    email = "barsikus07@gmail.com";
+    github = "barsikus007";
+    githubId = 37113583;
+  };
  bartoostveen = {
    name = "Bart Oostveen";
    github = "bartoostveen";
@ -3135,7 +3141,10 @@
    email = "bastian@asmussen.tech";
    github = "BastianAsmussen";
    githubId = 76102128;
-    keys = [ { fingerprint = "3B11 7469 0893 85E7 16C2  7CD9 0FE5 A355 DBC9 2568"; } ];
+    keys = [
+      { fingerprint = "3B11 7469 0893 85E7 16C2  7CD9 0FE5 A355 DBC9 2568"; }
+      { fingerprint = "220D 68EC DF94 20EE 1E6C  B215 D92D 668B 77A2 9897"; }
+    ];
  };
  basvandijk = {
    email = "v.dijk.bas@gmail.com";
@ -14591,6 +14600,12 @@
    github = "svelterust";
    githubId = 85593302;
  };
+  knightfemale = {
+    email = "2067834160@qq.com";
+    github = "knightfemale";
+    githubId = 124773040;
+    name = "骑士姬";
+  };
  knightpp = {
    email = "knightpp@proton.me";
    github = "knightpp";
@ -15133,6 +15148,11 @@
    githubId = 27364685;
    name = "Lorenzo Pasqui";
  };
+  l1n = {
+    github = "l1n";
+    githubId = 1367322;
+    name = "Nova DasSarma";
+  };
  l1npengtul = {
    email = "l1npengtul@l1npengtul.lol";
    github = "l1npengtul";
@ -17200,6 +17220,12 @@
    github = "matrss";
    githubId = 9308656;
  };
+  matshch = {
+    name = "Artem Leshchev";
+    github = "matshch";
+    githubId = 2412121;
+    email = "matshch@gmail.com";
+  };
  matt-snider = {
    email = "matt.snider@protonmail.com";
    github = "matt-snider";
@ -23017,12 +23043,6 @@
    githubId = 1246959;
    name = "Raquel García";
  };
-  rardiol = {
-    email = "ricardo.ardissone@gmail.com";
-    github = "rardiol";
-    githubId = 11351304;
-    name = "Ricardo Ardissone";
-  };
  raskin = {
    email = "7c6f434c@mail.ru";
    github = "7c6f434c";
@ -29601,6 +29621,14 @@
    github = "weitzj";
    githubId = 829277;
  };
+  Wekuz = {
+    name = "Wekuz";
+    github = "Wekuz";
+    githubId = 89638089;
+    email = "wekuz@duck.com";
+    matrix = "@wekuz:matrix.org";
+    keys = [ { fingerprint = "0CCE 1200 AB5E 7B05 9A22  B0D8 2E50 2F2A ABD3 2DF9"; } ];
+  };
  wellmannmathis = {
    email = "wellmannmathis@gmail.com";
    github = "MathisWellmann";
--- a/maintainers/team-list.nix
+++ b/maintainers/team-list.nix
@ -688,6 +688,10 @@ with lib.maintainers;
    github = "radicle";
  };

+  redis = {
+    github = "redis";
+  };
+
  rocm = {
    github = "rocm";
  };
--- a/nixos/doc/manual/release-notes/rl-2605.section.md
+++ b/nixos/doc/manual/release-notes/rl-2605.section.md
@ -174,6 +174,8 @@

 - [LogiOps](https://github.com/PixlOne/logiops), an unofficial userspace driver for HID++ Logitech devices. Available as [services.logiops](#opt-services.logiops.enable).

+- [Unpackerr](https://unpackerr.zip), extracts downloads for Radarr, Sonarr, Lidarr, Readarr, and/or a Watch folder. Available as [services.unpackerr](#opt-services.unpackerr.enable).
+
 ## Backward Incompatibilities {#sec-release-26.05-incompatibilities}

 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -997,6 +997,7 @@
  ./services/misc/tuxclocker.nix
  ./services/misc/tzupdate.nix
  ./services/misc/uhub.nix
+  ./services/misc/unpackerr.nix
  ./services/misc/wastebin.nix
  ./services/misc/weechat.nix
  ./services/misc/workout-tracker.nix
--- a/nixos/modules/services/databases/redis.nix
+++ b/nixos/modules/services/databases/redis.nix
@ -30,6 +30,8 @@ let

 in
 {
+  meta.teams = [ lib.teams.redis ];
+
  imports = [
    (lib.mkRemovedOptionModule [
      "services"
--- a/nixos/modules/services/home-automation/zigbee2mqtt.nix
+++ b/nixos/modules/services/home-automation/zigbee2mqtt.nix
@ -113,6 +113,7 @@ in
          "AF_INET"
          "AF_INET6"
          "AF_NETLINK"
+          "AF_UNIX"
        ];
        RestrictNamespaces = true;
        RestrictRealtime = true;
--- a/nixos/modules/services/misc/unpackerr.nix
+++ b/nixos/modules/services/misc/unpackerr.nix
@ -0,0 +1,102 @@
+{
+  config,
+  pkgs,
+  lib,
+  utils,
+  ...
+}:
+
+let
+  cfg = config.services.unpackerr;
+  configFormat = pkgs.formats.toml { };
+  configFile = configFormat.generate "unpackerr.conf" cfg.settings;
+  inherit (lib)
+    mkEnableOption
+    mkOption
+    mkPackageOption
+    mkIf
+    getExe
+    types
+    ;
+in
+{
+  options = {
+    services.unpackerr = {
+      enable = mkEnableOption "Unpackerr";
+
+      settings = mkOption {
+        type = configFormat.type;
+        default = { };
+        example = {
+          radarr = [
+            {
+              url = "http://127.0.0.1:8989";
+              api_key = "0123456789abcdef0123456789abcdef";
+            }
+          ];
+          sonarr = [
+            {
+              url = "http://127.0.0.1:7878";
+              api_key = "0123456789abcdef0123456789abcdef";
+            }
+          ];
+        };
+        description = ''
+          Unpackerr TOML configuration as a Nix attribute set.
+          Refer to [Unpackerr docs](https://unpackerr.zip/docs/install/configuration) for details.
+          For setting secrets refer to this [section](https://unpackerr.zip/docs/install/configuration/#secrets-and-passwords).
+        '';
+      };
+
+      user = mkOption {
+        type = types.str;
+        default = "unpackerr";
+        description = "User account under which Unpackerr runs.";
+      };
+
+      group = mkOption {
+        type = types.str;
+        default = "unpackerr";
+        description = "Group under which Unpackerr runs.";
+      };
+
+      package = mkPackageOption pkgs "unpackerr" { };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    # Upstream service: https://github.com/Unpackerr/unpackerr/blob/main/init/systemd/unpackerr.service
+    systemd = {
+      services.unpackerr = {
+        description = "Unpackerr - archive extraction daemon";
+        wants = [ "network.target" ];
+        after = [ "network.target" ];
+        wantedBy = [ "multi-user.target" ];
+        serviceConfig = {
+          Type = "exec";
+          User = cfg.user;
+          Group = cfg.group;
+          ExecStart = utils.escapeSystemdExecArgs [
+            (getExe cfg.package)
+            "--config=${configFile}"
+          ];
+          Restart = "always";
+          RestartSec = 10;
+        };
+      };
+    };
+
+    users.users = mkIf (cfg.user == "unpackerr") {
+      unpackerr = {
+        inherit (cfg) group;
+        isSystemUser = true;
+      };
+    };
+
+    users.groups = mkIf (cfg.group == "unpackerr") {
+      unpackerr = { };
+    };
+  };
+
+  meta.maintainers = with lib.maintainers; [ Wekuz ];
+}
--- a/nixos/modules/services/networking/searx.nix
+++ b/nixos/modules/services/networking/searx.nix
@ -5,44 +5,50 @@
  pkgs,
  ...
 }:
-
-with lib;
-
 let
+  inherit (lib)
+    literalExpression
+    mkDefault
+    mkIf
+    mkOption
+    mkPackageOption
+    mkRenamedOptionModule
+    optionalAttrs
+    types
+    ;
+
  runDir = "/run/searx";

  cfg = config.services.searx;
+  yamlFormat = pkgs.formats.yaml { };
+  tomlFormat = pkgs.formats.toml { };

-  settingsFile = pkgs.writeText "settings.yml" (
-    builtins.toJSON (removeAttrs cfg.settings [ "redis" ])
-  );
+  settingsFile = yamlFormat.generate "settings.yml" (builtins.removeAttrs cfg.settings [ "redis" ]);

-  faviconsSettingsFile = (pkgs.formats.toml { }).generate "favicons.toml" cfg.faviconsSettings;
-  limiterSettingsFile = (pkgs.formats.toml { }).generate "limiter.toml" cfg.limiterSettings;
+  faviconsSettingsFile = tomlFormat.generate "favicons.toml" cfg.faviconsSettings;
+  limiterSettingsFile = tomlFormat.generate "limiter.toml" cfg.limiterSettings;

  generateConfig = ''
    cd ${runDir}

-    # write NixOS settings as JSON
+    # write NixOS settings
    (
      umask 077
-      ${pkgs.envsubst}/bin/envsubst < ${settingsFile} > settings.yml
+      ${lib.getExe pkgs.envsubst} < ${settingsFile} > settings.yml
+      ${
+        if (cfg.faviconsSettings != { }) then
+          "ln -sf ${faviconsSettingsFile} favicons.toml"
+        else
+          "rm -f favicons.toml"
+      }
+      ${
+        if (cfg.limiterSettings != { }) then
+          "ln -sf ${limiterSettingsFile} limiter.toml"
+        else
+          "rm -f limiter.toml"
+      }
    )
  '';
-
-  settingType =
-    with types;
-    (oneOf [
-      bool
-      int
-      float
-      str
-      (listOf settingType)
-      (attrsOf settingType)
-    ])
-    // {
-      description = "JSON value";
-    };
 in
 {
  options = {
@ -107,7 +113,7 @@ in
              lib.warn "Obsolete option `services.searx.settings.redis' is used. It was renamed to `services.searx.settings.valkey'" config.redis
            );

-            freeformType = settingType;
+            freeformType = yamlFormat.type;
          }
        );
        default = { };
@ -136,25 +142,25 @@ in
        '';
      };

-      settingsFile = mkOption {
+      settingsPath = mkOption {
        type = types.path;
-        default = "${runDir}/settings.yml";
+        default = runDir;
        description = ''
-          The path of the Searx server settings.yml file.
-          If no file is specified, a default file is used (default config file has debug mode enabled).
+          The path of the SearXNG settings directory or the settings.yml file.
+          If no path is specified, a default one is used (default config file has debug mode enabled).

          ::: {.note}
          Setting this options overrides [](#opt-services.searx.settings).
          :::

          ::: {.warning}
-          This file, along with any secret key it contains, will be copied into the world-readable Nix store.
+          This path, along with any secret keys it contains, will be copied into the world-readable Nix store.
          :::
        '';
      };

      faviconsSettings = mkOption {
-        type = types.attrsOf settingType;
+        type = types.attrsOf tomlFormat.type;
        default = { };
        example = literalExpression ''
          {
@ -182,18 +188,23 @@ in
      };

      limiterSettings = mkOption {
-        type = types.attrsOf settingType;
+        type = types.attrsOf tomlFormat.type;
        default = { };
        example = literalExpression ''
          {
-            real_ip = {
-              x_for = 1;
+            botdetection = {
              ipv4_prefix = 32;
              ipv6_prefix = 56;
-            }
-            botdetection.ip_lists.block_ip = [
-              # "93.184.216.34" # example.org
-            ];
+
+              trusted_proxies = [
+                "127.0.0.0/8"
+                "::1"
+              ];
+
+              ip_lists.block_ip = [
+                # "93.184.216.34" # example.org
+              ];
+            };
          }
        '';
        description = ''
@ -252,6 +263,7 @@ in
  };

  imports = [
+    (mkRenamedOptionModule [ "services" "searx" "settingsFile" ] [ "services" "searx" "settingsPath" ])
    (mkRenamedOptionModule [ "services" "searx" "configFile" ] [ "services" "searx" "settingsFile" ])
    (mkRenamedOptionModule [ "services" "searx" "runInUwsgi" ] [ "services" "searx" "configureUwsgi" ])
  ];
@ -264,17 +276,7 @@ in
      }
    ];

-    environment = {
-      etc = {
-        "searxng/favicons.toml" = lib.mkIf (cfg.faviconsSettings != { }) {
-          source = faviconsSettingsFile;
-        };
-        "searxng/limiter.toml" = lib.mkIf (cfg.limiterSettings != { }) {
-          source = limiterSettingsFile;
-        };
-      };
-      systemPackages = [ cfg.package ];
-    };
+    environment.systemPackages = [ cfg.package ];

    services = {
      nginx = lib.mkIf cfg.configureNginx {
@ -338,7 +340,7 @@ in
          enable-threads = true;
          module = "searx.webapp";
          env = [
-            "SEARXNG_SETTINGS_PATH=${cfg.settingsFile}"
+            "SEARXNG_SETTINGS_PATH=${cfg.settingsPath}"
          ];
          buffer-size = 32768;
          pythonPackages = _: [ cfg.package ];
@ -379,17 +381,60 @@ in
        after = [
          "searx-init.service"
          "network.target"
-        ];
+        ]
+        ++ lib.optionals cfg.redisCreateLocally [ "redis-searx.service" ];
        serviceConfig = {
          User = "searx";
+          DynamicUser = true;
          Group = "searx";
          ExecStart = lib.getExe cfg.package;
+
+          CacheDirectory = "searx";
+          CacheDirectoryMode = "0700";
+
+          ReadOnlyPaths = [ cfg.settingsPath ];
+          ReadWritePaths = lib.optional cfg.redisCreateLocally config.services.redis.servers.searx.unixSocket;
+
+          CapabilityBoundingSet = null;
+          DevicePolicy = "closed";
+          LockPersonality = true;
+          MemoryDenyWriteExecute = true;
+          NoNewPrivileges = true;
+          ProtectClock = true;
+          ProtectControlGroups = true;
+          ProtectHome = true;
+          ProtectHostname = true;
+          ProtectKernelLogs = true;
+          ProtectKernelModules = true;
+          ProtectKernelTunables = true;
+          ProtectProc = "invisible";
+          ProtectSystem = "strict";
+          PrivateDevices = true;
+          PrivateMounts = true;
+          PrivateTmp = true;
+          PrivateUsers = true;
+          PrivateIPC = true;
+          RemoveIPC = true;
+          RestrictAddressFamilies = [
+            "AF_INET"
+            "AF_INET6"
+            "AF_UNIX"
+          ];
+          RestrictNamespaces = true;
+          RestrictRealtime = true;
+          SystemCallArchitectures = "native";
+          SystemCallErrorNumber = "EPERM";
+          SystemCallFilter = [
+            "@system-service"
+            "~@privileged @resources"
+          ];
+          UMask = "0077";
        }
        // optionalAttrs (cfg.environmentFile != null) {
          EnvironmentFile = cfg.environmentFile;
        };
        environment = {
-          SEARXNG_SETTINGS_PATH = cfg.settingsFile;
+          SEARXNG_SETTINGS_PATH = cfg.settingsPath;
        };
      };

@ -398,7 +443,7 @@ in
        after = [ "searx-init.service" ];
        restartTriggers = [
          cfg.package
-          cfg.settingsFile
+          cfg.settingsPath
        ]
        ++ lib.optional (cfg.environmentFile != null) cfg.environmentFile;
      };
@ -416,7 +461,7 @@ in
    networking.firewall = lib.mkIf cfg.openFirewall { allowedTCPPorts = [ cfg.settings.server.port ]; };
  };

-  meta.maintainers = with maintainers; [
+  meta.maintainers = with lib.maintainers; [
    SuperSandro2000
    _999eagle
  ];
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -1768,6 +1768,7 @@ in
  unifi = runTest ./unifi.nix;
  unit-perl = runTest ./web-servers/unit-perl.nix;
  unit-php = runTest ./web-servers/unit-php.nix;
+  unpackerr = runTest ./unpackerr.nix;
  upnp.iptables = handleTest ./upnp.nix { useNftables = false; };
  upnp.nftables = handleTest ./upnp.nix { useNftables = true; };
  uptermd = runTest ./uptermd.nix;
--- a/nixos/tests/redis.nix
+++ b/nixos/tests/redis.nix
@ -19,11 +19,7 @@ let
    }:
    makeTest {
      inherit name;
-      meta.maintainers = [
-        lib.maintainers.das_j
-        lib.maintainers.flokli
-        lib.maintainers.helsinki-Jo
-      ];
+      meta.maintainers = lib.teams.redis.members;

      nodes = {
        machine =
--- a/nixos/tests/unpackerr.nix
+++ b/nixos/tests/unpackerr.nix
@ -0,0 +1,39 @@
+{ lib, ... }:
+
+{
+  name = "unpackerr";
+  meta.maintainers = with lib.maintainers; [ Wekuz ];
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      environment.systemPackages = with pkgs; [ zip ];
+
+      systemd.tmpfiles.settings."10-unpackerr"."/srv/unpackerr".d = {
+        mode = "0775";
+        user = "unpackerr";
+        group = "users";
+      };
+
+      services.unpackerr = {
+        enable = true;
+        group = "users";
+        settings = {
+          start_delay = "15s";
+          folder = [
+            {
+              path = "/srv/unpackerr";
+            }
+          ];
+        };
+      };
+    };
+
+  testScript = ''
+    machine.wait_for_unit("unpackerr.service")
+    machine.wait_until_succeeds("journalctl -u unpackerr.service --grep '\\[Folder\\] Watching \\(fsnotify\\)'", timeout=60)
+    machine.succeed("echo unpackerr-test > /tmp/file.txt && cd /tmp && zip /srv/unpackerr/test.zip ./file.txt && rm ./file.txt")
+    machine.wait_until_succeeds("[[ -d /srv/unpackerr/test ]]", timeout=120)
+    machine.succeed("""[[ 'unpackerr-test' == "$(< /srv/unpackerr/test/file.txt)" ]]""")
+  '';
+}
--- a/nixos/tests/victoriatraces/otlp-ingestion.nix
+++ b/nixos/tests/victoriatraces/otlp-ingestion.nix
@ -82,7 +82,7 @@ in
    machine.wait_until_succeeds("""
      curl -s 'http://localhost:10428/select/jaeger/api/services' | \
      jq -e '.data[] | select(. == "test-service")'
-    """, timeout=10)
+    """, timeout=20)

    # Query for traces from our test service
    machine.wait_until_succeeds("""
--- a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/ghostel/package.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/ghostel/package.nix
@ -13,13 +13,13 @@ let

  pname = "ghostel";

-  version = "0.34.0-unstable-2026-06-08";
+  version = "0.35.4-unstable-2026-06-19";

  src = fetchFromGitHub {
    owner = "dakra";
    repo = "ghostel";
-    rev = "f7800f6430b6ab85dbfc2db2129625e8a28ac17e";
-    hash = "sha256-o9EQFA6xunwt/chdA5z8bqadr9V3COBPjRqiAY3jkp0=";
+    rev = "adb010b7fec943405006fcd1fac280e74ffa9e30";
+    hash = "sha256-OI82g4uMTzlucH9DHNeDl7ppYzpNTjnhZ1SzlRe70Fw=";
  };

  module = stdenv.mkDerivation (finalAttrs: {
--- a/pkgs/applications/editors/emacs/sources.nix
+++ b/pkgs/applications/editors/emacs/sources.nix
@ -146,14 +146,9 @@ in
    pname = "emacs-mac";
    version = "30.2.50";
    variant = "macport";
-    rev = "emacs-mac-30.2";
-    hash = "sha256-i/W2Xa6Vk1+T1fs6fa4wJVMLLB6BK8QAPcdmPrU8NwM=";
+    rev = "emacs-mac-30.2.1";
+    hash = "sha256-KFgQZBW0QRX0k4k8gkVuGhNTfxArOH1+rwUzsmyEuss=";
    patches = fetchpatch: [
-      (fetchpatch {
-        name = "fix-off-by-one-mistake-80851-CVE-2026-6861.patch";
-        url = "https://cgit.git.savannah.gnu.org/cgit/emacs.git/patch/?id=8f535370b9efbc91673b20c6987a5cae4f6dc562";
-        hash = "sha256-ny44eIi8DUa9pQhVGzhGz4H6FXU4+ki86SITLXhkwpw=";
-      })
      (fetchpatch {
        # tree-sitter 0.26 compatibility fix, see https://bugs.gentoo.org/970856
        url = "https://gitweb.gentoo.org/proj/emacs-patches.git/plain/emacs/30.2/01_all_treesit-0.26.patch?id=d0f47979806d9be5a190fdb4ffa1bde439b2d616";
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@ -760,6 +760,7 @@ https://github.com/leafo/moonscript-vim/,,
 https://github.com/yegappan/mru/,,
 https://github.com/jake-stewart/multicursor.nvim/,,
 https://github.com/smoka7/multicursors.nvim/,,
+https://github.com/brenton-leighton/multiple-cursors.nvim/,main,
 https://github.com/AckslD/muren.nvim/,,
 https://github.com/jbyuki/nabla.nvim/,,
 https://github.com/ncm2/ncm2/,,
--- a/pkgs/applications/editors/vscode/extensions/oxc.oxc-vscode/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/oxc.oxc-vscode/default.nix
@ -10,8 +10,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
  mktplcRef = {
    publisher = "oxc";
    name = "oxc-vscode";
-    version = "1.57.0";
-    hash = "sha256-kz4YqPcDjBX7hT3O7odPQgYmGMO34VGw16d6mpzXq7c=";
+    version = "1.58.0";
+    hash = "sha256-30dFeguNbY8WM3fLym6aUMkHYH5wA5scSNn04Ukbj9U=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/emulators/libretro/cores/beetle-vb.nix
+++ b/pkgs/applications/emulators/libretro/cores/beetle-vb.nix
@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "mednafen-vb";
-  version = "0-unstable-2026-04-20";
+  version = "0-unstable-2026-06-14";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "beetle-vb-libretro";
-    rev = "1275bd7bddf2166be5a10e45c26c5c2a61370658";
-    hash = "sha256-3JTcAITogWP9yQ4sLZl8YlUHzu9LvWor9liQRIwf2b8=";
+    rev = "38e7a0ec9ac7079ca1c1e3dd9aaf5b56f527efca";
+    hash = "sha256-+57qsfH2wygKdD66yauzKD9XDf01q4LeiWdIeYbVUmc=";
  };

  makefile = "Makefile";
--- a/pkgs/applications/emulators/libretro/cores/np2kai.nix
+++ b/pkgs/applications/emulators/libretro/cores/np2kai.nix
@ -5,13 +5,13 @@
 }:
 mkLibretroCore rec {
  core = "np2kai";
-  version = "0-unstable-2026-05-09";
+  version = "0-unstable-2026-06-19";

  src = fetchFromGitHub {
    owner = "AZO234";
    repo = "NP2kai";
-    rev = "eebb95c060f82df45a5615be676c3fa4b7bb7ae0";
-    hash = "sha256-KBvxqxCeYyIKCTHdcczwpgHBIZds6xMfHt6LblRRoFc=";
+    rev = "e2dc9046aa5c786fcfbfb87e883457e421026e31";
+    hash = "sha256-35LWLk4U1B1NjXN94QN5nsMMXCmo+VKOVWhzFdZ79oc=";
    fetchSubmodules = true;
  };

--- a/pkgs/applications/emulators/libretro/cores/pcsx-rearmed.nix
+++ b/pkgs/applications/emulators/libretro/cores/pcsx-rearmed.nix
@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "pcsx-rearmed";
-  version = "0-unstable-2026-05-15";
+  version = "0-unstable-2026-06-13";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "pcsx_rearmed";
-    rev = "c88070df8e0e84106ecc4b6394860a413a7bc046";
-    hash = "sha256-ZngYExWmL4NlmSfaRbTpSthNY1QRwKXtSiSX8zS/teo=";
+    rev = "d26eaee5c8fb47c1832b8bf32c1358d625da8a02";
+    hash = "sha256-p8sPQDnxIBMuFD9nCtdFp1DEJwRuifgUrOFYdY1EfME=";
  };

  dontConfigure = true;
--- a/pkgs/applications/emulators/libretro/cores/snes9x.nix
+++ b/pkgs/applications/emulators/libretro/cores/snes9x.nix
@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "snes9x";
-  version = "0-unstable-2026-05-20";
+  version = "0-unstable-2026-06-16";

  src = fetchFromGitHub {
    owner = "snes9xgit";
    repo = "snes9x";
-    rev = "f8aff9cbd0ab3ee92679f039298d57b55f9d790e";
-    hash = "sha256-4tOXpK2OBY6u5NnuIq5NWT3haOp2y+4BtBlHVAzEuRE=";
+    rev = "9df418161bd030d59a0ab0c7b656df68dea11007";
+    hash = "sha256-1NZ0ESAunxYOIuk/X+41HELKdxq1U6VG5EG+or+VLkk=";
  };

  makefile = "Makefile";
--- a/pkgs/applications/emulators/libretro/cores/stella.nix
+++ b/pkgs/applications/emulators/libretro/cores/stella.nix
@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "stella";
-  version = "0-unstable-2026-06-09";
+  version = "0-unstable-2026-06-19";

  src = fetchFromGitHub {
    owner = "stella-emu";
    repo = "stella";
-    rev = "3e3061809913e59a4378737127ce0ae95b36e889";
-    hash = "sha256-fKivb4sFR4F0ub1NLpazLg3i3M9LOely08M8kBEczmo=";
+    rev = "65fc7d66abfc8dfba5033d88523437b83664ea2b";
+    hash = "sha256-hYYZyHtWjo3BgX73Vxj8JG/2vQ7JtqT+4jPWLN+zZHw=";
  };

  makefile = "Makefile";
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@ -128,11 +128,11 @@
    "vendorHash": "sha256-/dOiXO2aPkuZaFiwv/6AXJdIADgx8T7eOwvJfBBoqg8="
  },
  "buildkite_buildkite": {
-    "hash": "sha256-MoucQgeikKMh4P8nRWIJ5SkLFGeVfDutsSBUSowz6VM=",
+    "hash": "sha256-CfipoNGW0VofHfgXlbfcjIGYpkuE0UXewDM6UCutg9g=",
    "homepage": "https://registry.terraform.io/providers/buildkite/buildkite",
    "owner": "buildkite",
    "repo": "terraform-provider-buildkite",
-    "rev": "v1.34.0",
+    "rev": "v1.34.2",
    "spdx": "MIT",
    "vendorHash": "sha256-uYyj6GSV5bWEfRTOODMuReEHe9wnF4cVoHM9rBMpgmM="
  },
@ -409,13 +409,13 @@
    "vendorHash": null
  },
  "fastly_fastly": {
-    "hash": "sha256-S6VIwqwTPr276TTqgEFTxhE5c97lCd8/5dJnDGori4s=",
+    "hash": "sha256-I1a2wus61as24DMBZEZsl2C6YJ5B0CaIST/FM+8KMLc=",
    "homepage": "https://registry.terraform.io/providers/fastly/fastly",
    "owner": "fastly",
    "repo": "terraform-provider-fastly",
-    "rev": "v9.2.1",
+    "rev": "v9.3.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-8QF9gOuvuZwAoFWePjti4h6VzmA+TGiFaC/ShuEAZqA="
+    "vendorHash": "sha256-TDU8T91em1+Y+0LN6FQSGEKJ4T9dIUxyuOTvx6HBYjg="
  },
  "flexibleenginecloud_flexibleengine": {
    "hash": "sha256-yEZ9JiUSqFFbfqzOOD59ZBv4yFCeUBBKlp6aiUqDqiM=",
@ -724,11 +724,11 @@
    "vendorHash": "sha256-f49amYWzWSG9tzY6wvpxtTFiyJ8zC/Lc1hIQtzdgJRs="
  },
  "huaweicloud_huaweicloud": {
-    "hash": "sha256-4KRJhLnpKZwmL5aQqva8JZGDCYBzlGepE7zP6hwP+KY=",
+    "hash": "sha256-Ao3CkaQBe172Ookcgl+ugeHH5ClbyOsSpLb4+j9DAZQ=",
    "homepage": "https://registry.terraform.io/providers/huaweicloud/huaweicloud",
    "owner": "huaweicloud",
    "repo": "terraform-provider-huaweicloud",
-    "rev": "v1.92.0",
+    "rev": "v1.93.0",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
@ -1247,11 +1247,11 @@
    "vendorHash": "sha256-C8TE7uxMf6LOTS6v22mXwUdk2eqQRinwrCH4ZVUCx4k="
  },
  "splunk-terraform_signalfx": {
-    "hash": "sha256-bX6CtNP7uB50kk3ddu52YfKE04PsEJw6DXl6yQxOeVI=",
+    "hash": "sha256-zwq7jCST2EkNk+UlKgLY2r3rCm5D009HYMru9KSVmuc=",
    "homepage": "https://registry.terraform.io/providers/splunk-terraform/signalfx",
    "owner": "splunk-terraform",
    "repo": "terraform-provider-signalfx",
-    "rev": "v9.30.1",
+    "rev": "v9.30.2",
    "spdx": "MPL-2.0",
    "vendorHash": "sha256-27mA2OAApUtPawZZk7Wxme9TfQY19TraIJSqHh8MFZg="
  },
--- a/pkgs/build-support/make-startupitem/default.nix
+++ b/pkgs/build-support/make-startupitem/default.nix
@ -32,7 +32,7 @@ stdenv.mkDerivation {
      target=${name}.desktop
      cp ${package}/share/applications/${srcPrefix}${name}.desktop $target
      ${lib.optionalString (prependExtraArgs != [ ] || appendExtraArgs != [ ]) ''
-        sed -i -r "s/(Exec=)([^ \n]*) *(.*)/\1\2 ${prependArgs}\3${appendArgs}/" $target
+        sed -i -r "s/^(Exec=)([^ \n]*) *(.*)/\1\2 ${prependArgs}\3${appendArgs}/" $target
      ''}
      chmod +rw $target
      echo "X-KDE-autostart-phase=${phase}" >> $target
--- a/pkgs/build-support/writers/scripts.nix
+++ b/pkgs/build-support/writers/scripts.nix
@ -6,6 +6,7 @@
  makeBinaryWrapper,
  mkNugetDeps,
  mkNugetSource,
+  nginx-config-formatter,
  pkgs,
  stdenv,
 }:
@ -1101,11 +1102,14 @@ rec {
      {
        inherit text;
        __structuredAttrs = true;
-        nativeBuildInputs = [ gixy ];
+        nativeBuildInputs = [
+          gixy
+          nginx-config-formatter
+        ];
      } # sh
      ''
-        printf "%s" "$text" | ${lib.getExe pkgs.nginx-config-formatter} --max-empty-lines 0 - > $out
-        ${lib.getExe pkgs.gnused} -i 's/ ;/;/g' $out
+        printf "%s" "$text" | nginxfmt --max-empty-lines 0 - > $out
+        sed -i 's/ ;/;/g' $out
        gixy $out || (echo "\n\nThis can be caused by combining multiple incompatible services on the same hostname.\n\nFull merged config:\n\n"; cat $out; exit 1)
      '';

--- a/pkgs/by-name/ad/adminneo/package.nix
+++ b/pkgs/by-name/ad/adminneo/package.nix
@ -8,13 +8,13 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "adminneo";
-  version = "5.3.0";
+  version = "5.4.1";

  src = fetchFromGitHub {
    owner = "adminneo-org";
    repo = "adminneo";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-hJwqI8zT2ZAapJMpUZ+izJo3DF5I5NlO5HhPyxoM9b0=";
+    hash = "sha256-vnvLRPMiVuSEAQJSPBGM63LppQ7pZv6ZaQnUTpUw9W0=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/am/amule-cmd/package.nix
+++ b/pkgs/by-name/am/amule-cmd/package.nix
@ -0,0 +1,13 @@
+{
+  amule,
+  ...
+}@args:
+
+amule.override (
+  {
+    monolithic = false;
+    textClient = true;
+    mainProgram = "amulecmd";
+  }
+  // removeAttrs args [ "amule" ]
+)
--- a/pkgs/by-name/am/amule/package.nix
+++ b/pkgs/by-name/am/amule/package.nix
@ -3,94 +3,144 @@
  enableDaemon ? false, # build amule daemon
  httpServer ? false, # build web interface for the daemon
  client ? false, # build amule remote gui
+  textClient ? false, # build amule remote command line client
  mainProgram ? "amule",
  fetchFromGitHub,
-  fetchpatch,
  stdenv,
  lib,
  cmake,
  zlib,
  wxwidgets_3_2,
-  perl,
+  curl,
  cryptopp,
  libupnp,
-  boost186, # Not using boost leads to crashes with gtk3
+  boost,
  gettext,
+  glib,
+  libintl,
+  gtk3,
+  libayatana-appindicator,
+  libsysprof-capture,
  libpng,
  pkg-config,
-  makeWrapper,
+  readline,
+  nix-update-script,
+  writeShellScript,
+  xcbuild,
  libx11,
 }:

-# daemon and client are not build monolithic
-assert monolithic || (!monolithic && (enableDaemon || client || httpServer));
+let
+  # MacOS's plutil lives under /usr/bin, which the build sandbox blocks
+  # so we use `xcbuild`'s pure reimplementation instead.
+  # CMake generates the bundle plist read-only, so we make i
+  # writable before plutil rewrites it in place.
+  plutil = writeShellScript "amule-plutil" ''
+    for plist; do :; done
+    chmod u+w "$plist"
+    exec ${lib.getExe' xcbuild "plutil"} "$@"
+  '';
+in
+
+# daemon, clients and web interface are not built monolithic
+assert monolithic || (!monolithic && (enableDaemon || client || textClient || httpServer));

 stdenv.mkDerivation (finalAttrs: {
  pname =
    "amule"
    + lib.optionalString httpServer "-web"
    + lib.optionalString enableDaemon "-daemon"
-    + lib.optionalString client "-gui";
-  version = "2.3.3";
+    + lib.optionalString client "-gui"
+    + lib.optionalString textClient "-cmd";
+  version = "3.0.0";

  src = fetchFromGitHub {
-    owner = "amule-project";
+    owner = "amule-org";
    repo = "amule";
    tag = finalAttrs.version;
-    sha256 = "1nm4vxgmisn1b6l3drmz0q04x067j2i8lw5rnf0acaapwlp8qwvi";
+    hash = "sha256-2qQof2/JFTfOmqd25+YVWBpZgCDCOwf3NBo1aHcMPds=";
  };

-  patches = [
-    (fetchpatch {
-      url = "https://sources.debian.org/data/main/a/amule/1%3A2.3.3-3/debian/patches/wx3.2.patch";
-      hash = "sha256-OX5Ef80bL+dQqHo2OBLZvzMUrU6aOHfsF7AtoE1r7rs=";
-    })
-  ];
+  __structuredAttrs = true;
+  strictDeps = true;

  nativeBuildInputs = [
    cmake
    gettext
-    makeWrapper
    pkg-config
  ];

+  postPatch =
+    lib.optionalString (stdenv.hostPlatform.isDarwin && (monolithic || client)) ''
+      substituteInPlace src/CMakeLists.txt \
+        --replace-fail "/usr/bin/plutil" "${plutil}"
+    ''
+    # The __WXMAC__ branch casts to the pre-libedit-3.0 `Function` typedef,
+    # which neither the modern SDK libedit headers nor GNU readline 8.3
+    # provide; both declare rl_completion_entry_function with the typedef
+    # used here.
+    + lib.optionalString (stdenv.hostPlatform.isDarwin && (textClient || httpServer)) ''
+      substituteInPlace src/ExternalConnector.cpp \
+        --replace-fail "(Function *)&command_completion" "(rl_compentry_func_t *)&command_completion"
+    '';
+
  buildInputs = [
    zlib
    wxwidgets_3_2
-    perl
    cryptopp.dev
    libupnp
-    boost186
+    boost
+  ]
+  # the GUI and daemon bind the Wayland app_id/X11 WM_CLASS via g_set_prgname();
+  # libsysprof-capture satisfies glib-2.0.pc's Requires.private so the
+  # pkg-config checks resolve cleanly
+  ++ lib.optionals (stdenv.hostPlatform.isLinux && (monolithic || enableDaemon || client)) [
+    glib
+    libsysprof-capture
+  ]
+  # CURLOPT tuning (NOSIGNAL/CONNECTTIMEOUT) on wxWebRequest's curl backend
+  ++ lib.optional stdenv.hostPlatform.isLinux curl
+  # StatusNotifierItem tray icon; without it aMule falls back to the legacy
+  # GtkStatusIcon, invisible on modern GNOME/wlroots. gtk3 brings the
+  # gtk+-3.0.pc that ayatana-appindicator3-0.1.pc requires
+  ++ lib.optionals (stdenv.hostPlatform.isLinux && monolithic) [
+    gtk3
+    libayatana-appindicator
  ]
  ++ lib.optional httpServer libpng
+  # gettext runtime for NLS; on glibc libintl is part of libc
+  ++ lib.optional (!stdenv.hostPlatform.isGnu) libintl
+  # line editing in the interactive consoles of amulecmd and amuleweb
+  ++ lib.optional (textClient || httpServer) readline
  ++ lib.optional client libx11;

  cmakeFlags = [
-    "-DBUILD_MONOLITHIC=${if monolithic then "ON" else "OFF"}"
-    "-DBUILD_DAEMON=${if enableDaemon then "ON" else "OFF"}"
-    "-DBUILD_REMOTEGUI=${if client then "ON" else "OFF"}"
-    "-DBUILD_WEBSERVER=${if httpServer then "ON" else "OFF"}"
-    # building only the daemon fails when these are not set... this is
-    # due to mistakes in the Amule cmake code, but it does not cause
-    # extra code to be built...
-    "-Dwx_NEED_GUI=ON"
-    "-Dwx_NEED_ADV=ON"
-    "-Dwx_NEED_NET=ON"
+    (lib.cmakeBool "BUILD_MONOLITHIC" monolithic)
+    (lib.cmakeBool "BUILD_DAEMON" enableDaemon)
+    (lib.cmakeBool "BUILD_REMOTEGUI" client)
+    (lib.cmakeBool "BUILD_AMULECMD" textClient)
+    (lib.cmakeBool "BUILD_WEBSERVER" httpServer)
+    # with strictDeps FindwxWidgets cannot find wx-config in PATH
+    # the script runs on the build machine even when wxwidgets is a host dependency
+    (lib.cmakeFeature "wxWidgets_CONFIG_EXECUTABLE" (
+      lib.getExe' (lib.getDev wxwidgets_3_2) "wx-config"
+    ))
  ];

-  postPatch = ''
-    echo "find_package(Threads)" >> cmake/options.cmake
-
-    substituteInPlace src/libs/ec/abstracts/CMakeLists.txt \
-      --replace-fail "CMAKE_MINIMUM_REQUIRED (VERSION 2.8)" "CMAKE_MINIMUM_REQUIRED (VERSION 3.10)"
+  # On darwin the GUIs are installed as app bundles in $out
+  # move them to $out/Applications and expose the inner binaries in $out/bin
+  postInstall = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    for app in "$out"/*.app; do
+      [ -e "$app" ] || continue
+      mkdir -p "$out/Applications" "$out/bin"
+      mv "$app" "$out/Applications/"
+      name=$(basename "$app" .app)
+      ln -s "$out/Applications/$name.app/Contents/MacOS/$name" \
+        "$out/bin/$(echo "$name" | tr '[:upper:]' '[:lower:]')"
+    done
  '';

-  # aMule will try to `dlopen' libupnp and libixml, so help it
-  # find them.
-  postInstall = lib.optionalString monolithic ''
-    wrapProgram $out/bin/amule \
-      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ libupnp ]}
-  '';
+  passthru.updateScript = nix-update-script { };

  meta = {
    description = "Peer-to-peer client for the eD2K and Kademlia networks";
@ -104,12 +154,11 @@ stdenv.mkDerivation (finalAttrs: {
      no adware or spyware as is often found in proprietary P2P
      applications.
    '';
-    homepage = "https://github.com/amule-project/amule";
+    homepage = "https://amule-org.github.io/";
+    changelog = "https://github.com/amule-org/amule/releases/tag/${finalAttrs.version}";
    license = lib.licenses.gpl2Plus;
    maintainers = with lib.maintainers; [ aciceri ];
    inherit mainProgram;
    platforms = lib.platforms.unix;
-    # Undefined symbols for architecture arm64: "_FSFindFolder"
-    broken = stdenv.hostPlatform.isDarwin;
  };
 })
--- a/pkgs/by-name/ap/apidog/package.nix
+++ b/pkgs/by-name/ap/apidog/package.nix
@ -7,11 +7,11 @@

 let
  pname = "apidog";
-  version = "2.8.33";
+  version = "2.8.35";

  src = fetchurl {
    url = "https://file-assets.apidog.com/download/${version}/Apidog-${version}.AppImage";
-    hash = "sha256-RimlzPkIAFmsTgtSBocZy4g2S3eCvGq/r993u0Gjj/4=";
+    hash = "sha256-g5+fMP8xveHzcbUx2eoYk3Rpd7NlQwirSgwf6n4r6Mw=";
  };

  appimageContents = appimageTools.extract {
--- a/pkgs/by-name/ap/app2unit/package.nix
+++ b/pkgs/by-name/ap/app2unit/package.nix
@ -11,13 +11,13 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "app2unit";
-  version = "1.4.1";
+  version = "1.4.2";

  src = fetchFromGitHub {
    owner = "Vladimir-csp";
    repo = "app2unit";
    tag = "v${finalAttrs.version}";
-    sha256 = "sha256-upYW+aTJ6LCHrI0+IOYnA98uDLKPxu/wCi7uUWe/Geg=";
+    sha256 = "sha256-jUAjcpR4IszvmqWAIjZo0rWZt9yydCe3xH4X+mJ5O8k=";
  };

  passthru.updateScript = nix-update-script { };
--- a/pkgs/by-name/at/attic-client/package.nix
+++ b/pkgs/by-name/at/attic-client/package.nix
@ -21,13 +21,13 @@ in

 rustPlatform.buildRustPackage {
  pname = "attic";
-  version = "0-unstable-2025-09-24";
+  version = "0-unstable-2026-06-14";

  src = fetchFromGitHub {
    owner = "zhaofengli";
    repo = "attic";
-    rev = "12cbeca141f46e1ade76728bce8adc447f2166c6";
-    hash = "sha256-0nZlCCDC5PfndsQJXXtcyrtrfW49I3KadGMDlutzaGU=";
+    rev = "6b22d76ca351c5a07a5e5a60b95bc23320f7e791";
+    hash = "sha256-sboz+gG8z0KX+q0kkvLloNcogXYLwiY5iw2xwN36rFo=";
  };

  nativeBuildInputs = [
@ -38,7 +38,7 @@ rustPlatform.buildRustPackage {
  buildInputs = lib.optional needNixInclude nix ++ [ boost ];

  cargoBuildFlags = lib.concatMapStrings (c: "-p ${c} ") crates;
-  cargoHash = "sha256-h041o0s+bciXnvSuk4j+/uCY/sRRQWDVf+WEb9GEYeY=";
+  cargoHash = "sha256-LqE4jOIasxIG4DAhgZJMlTSyt/a900QR06wBFtRNRO8=";

  env = {
    ATTIC_DISTRIBUTOR = "nixpkgs";
--- a/pkgs/by-name/ay/ayatana-indicator-power/package.nix
+++ b/pkgs/by-name/ay/ayatana-indicator-power/package.nix
@ -22,13 +22,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "ayatana-indicator-power";
-  version = "24.5.2";
+  version = "26.6.0";

  src = fetchFromGitHub {
    owner = "AyatanaIndicators";
    repo = "ayatana-indicator-power";
    tag = finalAttrs.version;
-    hash = "sha256-A9Kbs+qH01rkuLt8GINdPI2vCu0bCO+/g4kZhDj8GsY=";
+    hash = "sha256-3Jw3MrKHiyGw511GucAtV790UP43EuAC89Q1TMfytyY=";
  };

  postPatch = ''
--- a/pkgs/by-name/ay/ayatana-indicator-session/package.nix
+++ b/pkgs/by-name/ay/ayatana-indicator-session/package.nix
@ -22,13 +22,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "ayatana-indicator-session";
-  version = "24.5.1";
+  version = "26.6.1";

  src = fetchFromGitHub {
    owner = "AyatanaIndicators";
    repo = "ayatana-indicator-session";
    tag = finalAttrs.version;
-    hash = "sha256-jqcgQTsC4VBit3wwtKKTdEG71CUPJpeMtpzikE4IGhE=";
+    hash = "sha256-rrjtLiZ+qaqB1QowGqp3SfWsgzqIYHYEzEzAERiLLBs=";
  };

  postPatch = ''
--- a/pkgs/by-name/ay/ayatana-indicator-sound/package.nix
+++ b/pkgs/by-name/ay/ayatana-indicator-sound/package.nix
@ -28,13 +28,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "ayatana-indicator-sound";
-  version = "24.5.2";
+  version = "24.5.3";

  src = fetchFromGitHub {
    owner = "AyatanaIndicators";
    repo = "ayatana-indicator-sound";
    tag = finalAttrs.version;
-    hash = "sha256-qdvte+Mm64O/JhI0luJAGAWoCgukKCbPrp5k8SIDuwM=";
+    hash = "sha256-6KrBlAh8do6O7CGb3mO25y1188w2cVwRxplQe8TBlQ4=";
  };

  postPatch = ''
--- a/pkgs/by-name/bc/bcompare/package.nix
+++ b/pkgs/by-name/bc/bcompare/package.nix
@ -4,10 +4,13 @@
  bzip2,
  fetchurl,
  glibc,
+  gobject-introspection,
  kdePackages,
+  python3,
  stdenv,
  runtimeShell,
  unzip,
+  wrapGAppsHook3,
 }:

 let
@ -32,53 +35,68 @@ let

  src = srcs.${stdenv.hostPlatform.system} or throwSystem;

-  linux = stdenv.mkDerivation {
-    inherit
-      pname
-      version
-      src
-      meta
-      ;
-    unpackPhase = ''
-      ar x $src
-      tar xfz data.tar.gz
-    '';
+  linux =
+    let
+      python = python3.withPackages (
+        pp: with pp; [
+          pygobject3
+        ]
+      );
+    in
+    stdenv.mkDerivation {
+      inherit
+        pname
+        version
+        src
+        meta
+        ;
+      unpackPhase = ''
+        ar x $src
+        tar xfz data.tar.gz
+      '';

-    installPhase = ''
-      mkdir -p $out/{bin,lib,share}
+      installPhase = ''
+        mkdir -p $out/{bin,lib,share}

-      cp -R usr/{bin,lib,share} $out/
+        cp -R usr/{bin,lib,share} $out/

-      # Remove library that refuses to be autoPatchelf'ed
-      #  - bcompare_ext_kde.amd64.so is linked with Qt4
-      #  - bcompare_ext_kde5.amd64.so is linked with Qt5
-      rm $out/lib/beyondcompare/ext/bcompare_ext_kde.amd64.so
-      rm $out/lib/beyondcompare/ext/bcompare_ext_kde5.amd64.so
+        # Remove library that refuses to be autoPatchelf'ed
+        #  - bcompare_ext_kde.amd64.so is linked with Qt4
+        #  - bcompare_ext_kde5.amd64.so is linked with Qt5
+        rm $out/lib/beyondcompare/ext/bcompare_ext_kde.amd64.so
+        rm $out/lib/beyondcompare/ext/bcompare_ext_kde5.amd64.so

-      substituteInPlace $out/bin/bcompare \
-        --replace "/usr/lib/beyondcompare" "$out/lib/beyondcompare" \
-        --replace "ldd" "${glibc.bin}/bin/ldd" \
-        --replace "/bin/bash" "${runtimeShell}"
-    '';
+        substituteInPlace $out/bin/bcompare \
+          --replace-fail "/usr/lib/beyondcompare" "$out/lib/beyondcompare" \
+          --replace-fail "ldd" "${glibc.bin}/bin/ldd" \
+          --replace-fail "/bin/bash" "${runtimeShell}"

-    nativeBuildInputs = [ autoPatchelfHook ];
+        substituteInPlace $out/lib/beyondcompare/bcmount.sh \
+          --replace-fail "python3" "${python.interpreter}"
+      '';

-    buildInputs = [
-      (lib.getLib stdenv.cc.cc)
-      kdePackages.kio
-      kdePackages.kservice
-      kdePackages.ki18n
-      kdePackages.kcoreaddons
-      bzip2
-    ];
+      nativeBuildInputs = [
+        autoPatchelfHook
+        gobject-introspection
+        wrapGAppsHook3
+      ];

-    dontBuild = true;
-    dontConfigure = true;
-    dontWrapQtApps = true;
+      buildInputs = [
+        (lib.getLib stdenv.cc.cc)
+        kdePackages.kio
+        kdePackages.kservice
+        kdePackages.ki18n
+        kdePackages.kcoreaddons
+        bzip2
+      ];

-    __structuredAttrs = true;
-    strictDeps = true;
-  };
+      dontBuild = true;
+      dontConfigure = true;
+      dontWrapQtApps = true;
+
+      __structuredAttrs = true;
+      strictDeps = true;
+    };

  darwin = stdenv.mkDerivation {
    inherit
@ -111,6 +129,7 @@ let
    maintainers = with lib.maintainers; [
      ktor
      arkivm
+      barsikus007
    ];
    platforms = builtins.attrNames srcs;
    mainProgram = "bcompare";
--- a/pkgs/by-name/bo/bottom/package.nix
+++ b/pkgs/by-name/bo/bottom/package.nix
@ -12,16 +12,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "bottom";
-  version = "0.12.3";
+  version = "0.13.0";

  src = fetchFromGitHub {
    owner = "ClementTsang";
    repo = "bottom";
    tag = finalAttrs.version;
-    hash = "sha256-arbVp0UjapM8SQ99XQCP7c+iGInyuxxx6LMEONRVl6o=";
+    hash = "sha256-UlkdYrfIjZU6N9W3KSZj4Au333DdejQG3TPRu5CjuBE=";
  };

-  cargoHash = "sha256-miSMcqy4OFZFhAs9M+zdv4OzYgFxN2/uBo6V/kJql90=";
+  cargoHash = "sha256-bQOhLlnMHFq5O5OUPWGmt00miKJTycBdhDUnfuUWPVk=";

  nativeBuildInputs = [
    autoAddDriverRunpath
--- a/pkgs/by-name/ca/capacities/package.nix
+++ b/pkgs/by-name/ca/capacities/package.nix
@ -7,11 +7,11 @@
 }:
 let
  pname = "capacities";
-  version = "1.64.6";
+  version = "1.65.13";

  src = fetchurl {
-    url = "https://web.archive.org/web/20260518194627/https://2vks4.upcloudobjects.com/capacities-desktop-app/Capacities-1.64.6.AppImage";
-    hash = "sha256-RCWzvoOhX14FRoPpoAJXMgMjmIevISDzzieiwGnX7uc=";
+    url = "https://web.archive.org/web/20260518194627/https://2vks4.upcloudobjects.com/capacities-desktop-app/Capacities-1.65.13.AppImage";
+    hash = "sha256-ATiX1h9hXmKMFtY6OEyZEoJ/SxJGgbj5/QZwFF1sfFQ=";
  };

  appimageContents = appimageTools.extractType2 {
--- a/pkgs/by-name/ci/cinnamon/package.nix
+++ b/pkgs/by-name/ci/cinnamon/package.nix
@ -10,6 +10,7 @@
  cjs,
  evolution-data-server,
  fetchFromGitHub,
+  fetchpatch,
  gcr,
  gdk-pixbuf,
  gettext,
@ -86,6 +87,18 @@ stdenv.mkDerivation (finalAttrs: {
  patches = [
    ./use-sane-install-dir.patch
    ./libdir.patch
+
+    # util.js: Adapt to GIR 2.0
+    (fetchpatch {
+      url = "https://github.com/linuxmint/cinnamon/commit/3a2d558aa575f0ea364c5b4e30d2eb3ee604ee58.patch";
+      hash = "sha256-+uAGuQJ0VsIvMvPFafyoXmU4MiHfbbRXLzeW/n62ucw=";
+    })
+
+    # cinnamon-calendar-server.py: Allow ICal 4.0
+    (fetchpatch {
+      url = "https://github.com/linuxmint/cinnamon/commit/dcf2d986c1ec167b0a8005ef2ca427317438c8d7.patch";
+      hash = "sha256-4sCZShUOXPaJoumiuEG558e0l8CIehH0P+C9OouG3vI=";
+    })
  ];

  buildInputs = [
--- a/pkgs/by-name/cp/cp2k/package.nix
+++ b/pkgs/by-name/cp/cp2k/package.nix
@ -26,7 +26,7 @@
  pkg-config,
  plumed,
  zlib,
-  hdf5-fortran,
+  hdf5-fortran-mpi,
  sirius,
  libvdwxc,
  spla,
@ -131,13 +131,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "cp2k";
-  version = "2025.2";
+  version = "2026.1-unstable-2026-06-16";

  src = fetchFromGitHub {
    owner = "cp2k";
    repo = "cp2k";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-vfl5rCoFeGtYuZ7LcsVsESjKxFbN5IYDvBSzOqsd64w=";
+    rev = "c28f603b5956aa638ef130b21b091da4e3a17639";
+    hash = "sha256-LIghR2gCYbJDux4bFfeKCi+a+VDVbjcZfcVpYwjPkEg=";
    fetchSubmodules = true;
  };

@ -175,7 +175,7 @@ stdenv.mkDerivation (finalAttrs: {
    dbcsr
    plumed
    zlib
-    hdf5-fortran
+    hdf5-fortran-mpi
    spla
    spfft
    libvdwxc
@ -207,9 +207,6 @@ stdenv.mkDerivation (finalAttrs: {

  postPatch = ''
    patchShebangs tools exts/dbcsr/tools/build_utils exts/dbcsr/.cp2k
-    substituteInPlace exts/build_dbcsr/Makefile \
-      --replace '/usr/bin/env python3' '${python3}/bin/python' \
-      --replace 'SHELL = /bin/sh' 'SHELL = bash'
  '';

  cmakeFlags = [
--- a/pkgs/by-name/cu/cubeb/package.nix
+++ b/pkgs/by-name/cu/cubeb/package.nix
@ -24,13 +24,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "cubeb";
-  version = "0-unstable-2026-06-09";
+  version = "0-unstable-2026-06-15";

  src = fetchFromGitHub {
    owner = "mozilla";
    repo = "cubeb";
-    rev = "b18d6992feeb7d4c4a0992257c85d96d761e68d2";
-    hash = "sha256-H5ehdZ3PmH8VcBns7h8KsmsAjRVJqS7TSTeUwW/ucTM=";
+    rev = "cdb54bbf405e5d75d42d21947cc717b35b0ccbf4";
+    hash = "sha256-PIzIEFTp+F5fC8aGgwjARhvlxktn60BlgGcRb56ZjIk=";
  };

  outputs = [
--- a/pkgs/by-name/cu/cudatext/deps.json
+++ b/pkgs/by-name/cu/cudatext/deps.json
@ -16,8 +16,8 @@
  },
  "ATSynEdit": {
    "owner": "Alexey-T",
-    "rev": "2026.05.20",
-    "hash": "sha256-r3DARtsBEXxkC9wBGuIuY6qU9GQcXPeakQsK2P8zXI0="
+    "rev": "2026.06.12",
+    "hash": "sha256-JTUxakTv9MVbMQArJJC995kSCD37Xs1rvLmDoyQhHf4="
  },
  "ATSynEdit_Cmp": {
    "owner": "Alexey-T",
@ -31,8 +31,8 @@
  },
  "ATSynEdit_Ex": {
    "owner": "Alexey-T",
-    "rev": "2026.01.19",
-    "hash": "sha256-gfx+2HbssaB1frc8QQh3ua+Z4lEM2JnQtSPNZVusaTM="
+    "rev": "2026.06.10",
+    "hash": "sha256-WZnGdl0lt8nOKKZsqPIcSRTVXYEixGKDHtMPveOvE5E="
  },
  "Python-for-Lazarus": {
    "owner": "Alexey-T",
--- a/pkgs/by-name/cu/cudatext/package.nix
+++ b/pkgs/by-name/cu/cudatext/package.nix
@ -42,13 +42,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "cudatext";
-  version = "1.234.4.0";
+  version = "1.234.4.1";

  src = fetchFromGitHub {
    owner = "Alexey-T";
    repo = "CudaText";
    tag = finalAttrs.version;
-    hash = "sha256-eVdV02R1YZ3mdoucEoyp7iKhA30+QJNAqdbnOz2Xjy4=";
+    hash = "sha256-/2OXF0ggbBvgAlQTeQcjxITd8UbdOc9Hruml112XoEU=";
  };

  patches = [ ./proc_globdata.patch ];
--- a/pkgs/by-name/da/dart-sass/package.nix
+++ b/pkgs/by-name/da/dart-sass/package.nix
@ -23,13 +23,13 @@ let
 in
 buildDartApplication rec {
  pname = "dart-sass";
-  version = "1.100.0";
+  version = "1.101.0";

  src = fetchFromGitHub {
    owner = "sass";
    repo = "dart-sass";
    tag = version;
-    hash = "sha256-yjI89EgFHMitdVVkjutTAiV/bND/eGTNCrLyZp/As4w=";
+    hash = "sha256-hs028qXBzRGrh9xZAQGaFw7iXtkQm9fixMuBohupjrI=";
  };

  pubspecLock = lib.importJSON ./pubspec.lock.json;
--- a/pkgs/by-name/da/dart-sass/pubspec.lock.json
+++ b/pkgs/by-name/da/dart-sass/pubspec.lock.json
@ -144,11 +144,11 @@
      "dependency": "transitive",
      "description": {
        "name": "coverage",
-        "sha256": "5da775aa218eaf2151c721b16c01c7676fbfdd99cebba2bf64e8b807a28ff94d",
+        "sha256": "956a3de0725ca232ad353565a8290d3357592bf4250f6f298a185e2d949c5d3d",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "1.15.0"
+      "version": "1.15.1"
    },
    "crypto": {
      "dependency": "direct dev",
@ -374,11 +374,11 @@
      "dependency": "direct main",
      "description": {
        "name": "meta",
-        "sha256": "df0c643f44ad098eb37988027a8e2b2b5a031fd3977f06bbfd3a76637e8df739",
+        "sha256": "c82594181e3312f3d0695fc95aaaf7758d75b8d4ae2bbecf223b9fd5109a059d",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "1.18.2"
+      "version": "1.18.3"
    },
    "mime": {
      "dependency": "transitive",
--- a/pkgs/by-name/de/desync/package.nix
+++ b/pkgs/by-name/de/desync/package.nix
@ -62,6 +62,9 @@ buildGoModule (finalAttrs: {
    homepage = "https://github.com/folbricht/desync";
    changelog = "https://github.com/folbricht/desync/releases/tag/v${finalAttrs.version}";
    license = lib.licenses.bsd3;
-    maintainers = with lib.maintainers; [ chaduffy ];
+    maintainers = with lib.maintainers; [
+      chaduffy
+      matshch
+    ];
  };
 })
--- a/pkgs/by-name/df/dftd4/fortran-module-dir.patch
+++ b/pkgs/by-name/df/dftd4/fortran-module-dir.patch
@ -1,5 +1,5 @@
 diff --git a/CMakeLists.txt b/CMakeLists.txt
-index f222aab..262b505 100644
+index 3db5442..64fa14a 100644
 --- a/CMakeLists.txt
 +++ b/CMakeLists.txt
@@ -89,7 +89,6 @@ target_include_directories(
@ -20,29 +20,38 @@ index f222aab..262b505 100644
 if(WITH_API)
   enable_language("C")
 diff --git a/config/template.cmake b/config/template.cmake
-index 8b5141d..8f94d66 100644
+index 8b5141d..76654d1 100644
 --- a/config/template.cmake
 +++ b/config/template.cmake
-@@ -6,7 +6,6 @@ set("@PROJECT_NAME@_WITH_OpenMP" @WITH_OpenMP@)
+@@ -5,8 +5,7 @@ set("@PROJECT_NAME@_WITH_API_V2" @WITH_API_V2@)
+ set("@PROJECT_NAME@_WITH_OpenMP" @WITH_OpenMP@)
 set(
   "@PROJECT_NAME@_INCLUDE_DIRS"
-   "@CMAKE_INSTALL_PREFIX@/@CMAKE_INSTALL_INCLUDEDIR@"
+-  "@CMAKE_INSTALL_PREFIX@/@CMAKE_INSTALL_INCLUDEDIR@"
 -  "@CMAKE_INSTALL_PREFIX@/@CMAKE_INSTALL_INCLUDEDIR@/@module-dir@"
+  "@CMAKE_INSTALL_FULL_INCLUDEDIR@"
 )
 list(APPEND CMAKE_MODULE_PATH "${CMAKE_CURRENT_LIST_DIR}")
 
 diff --git a/config/template.pc b/config/template.pc
-index 3d6efbb..fea69e4 100644
+index 3d6efbb..55b899f 100644
 --- a/config/template.pc
 +++ b/config/template.pc
-@@ -6,4 +6,4 @@ Name: @PROJECT_NAME@
+@@ -1,9 +1,9 @@
+ prefix=@CMAKE_INSTALL_PREFIX@
+-libdir=${prefix}/@CMAKE_INSTALL_LIBDIR@
+-includedir=${prefix}/@CMAKE_INSTALL_INCLUDEDIR@
+libdir=@CMAKE_INSTALL_FULL_LIBDIR@
+includedir=@CMAKE_INSTALL_FULL_INCLUDEDIR@
+ 
+ Name: @PROJECT_NAME@
 Description: @PROJECT_DESCRIPTION@
 Version: @PROJECT_VERSION@
 Libs: -L${libdir} -l@PROJECT_NAME@
 -Cflags: -I${includedir} -I${includedir}/@module-dir@
 +Cflags: -I${includedir} -I${includedir}/
 diff --git a/meson.build b/meson.build
-index c9e9c58..ac8f0bd 100644
+index 7de7d61..81b8a7d 100644
 --- a/meson.build
 +++ b/meson.build
@@ -83,7 +83,7 @@ if install
--- a/pkgs/by-name/df/dftd4/cmake.patch
+++ b/pkgs/by-name/df/dftd4/cmake.patch
@ -1,13 +0,0 @@
-diff --git a/config/template.pc b/config/template.pc
-index 3d6efbb..e338a42 100644
--- a/config/template.pc
-+++ b/config/template.pc
-@@ -1,6 +1,6 @@
- prefix=@CMAKE_INSTALL_PREFIX@
-libdir=${prefix}/@CMAKE_INSTALL_LIBDIR@
-includedir=${prefix}/@CMAKE_INSTALL_INCLUDEDIR@
-+libdir=@CMAKE_INSTALL_FULL_LIBDIR@
-+includedir=@CMAKE_INSTALL_FULL_INCLUDEDIR@
- 
- Name: @PROJECT_NAME@
- Description: @PROJECT_DESCRIPTION@
--- a/pkgs/by-name/df/dftd4/package.nix
+++ b/pkgs/by-name/df/dftd4/package.nix
@ -26,21 +26,18 @@ assert (

 stdenv.mkDerivation (finalAttrs: {
  pname = "dftd4";
-  version = "3.7.0";
+  version = "4.2.0";

  src = fetchFromGitHub {
    owner = "dftd4";
    repo = "dftd4";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-dixPCLH5dWkE2/7ghGEXJmX2/g1DN30dB4jX2d7fmio=";
+    hash = "sha256-uKjNOIza3/I0oREp88oFESoNqEdumo1AztIjcrVb1O8=";
  };

  patches = [
-    # Make sure fortran headers are installed directly in /include
-    ./fortran-module-dir.patch
-
-    # Fix wrong generation of package config include paths
-    ./cmake.patch
+    # Fix pkg-config, meson and cmake paths for include and lib dirs
+    ./build-paths.patch
  ];

  nativeBuildInputs = [
--- a/pkgs/by-name/di/diffoscope/package.nix
+++ b/pkgs/by-name/di/diffoscope/package.nix
@ -232,6 +232,7 @@ python.pkgs.buildPythonApplication rec {
        mono
        ocaml
        odt2txt
+        oggvideotools
        openssh
        pdftk
        perl
@ -255,8 +256,6 @@ python.pkgs.buildPythonApplication rec {
        r2pipe
        # docx2txt, nixpkgs packages another project named the same, which does not work
      ])
-      # oggvideotools is broken on Darwin, please put it back when it will be fixed?
-      ++ lib.optionals stdenv.hostPlatform.isLinux [ oggvideotools ]
      # Causes an eval failure
      # See https://github.com/NixOS/nixpkgs/issues/463873
      ++ lib.optionals (!stdenv.hostPlatform.isLinux && !stdenv.hostPlatform.isAarch64) [
--- a/pkgs/by-name/dn/dnscontrol/package.nix
+++ b/pkgs/by-name/dn/dnscontrol/package.nix
@ -9,16 +9,16 @@

 buildGoModule (finalAttrs: {
  pname = "dnscontrol";
-  version = "4.41.0";
+  version = "4.42.0";

  src = fetchFromGitHub {
    owner = "DNSControl";
    repo = "dnscontrol";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-oz4hF3W6QKjPda/6AZ7djeZr32oFMqdMD34gWLMnFRQ=";
+    hash = "sha256-iB2PFPvcASRwpBkFJQ3Vi2r89H3a9BBbC1moAymWDOI=";
  };

-  vendorHash = "sha256-DQmfwSPdUnoSmVDiKlwrHifKR59KuMe+0DGJtavpmLc=";
+  vendorHash = "sha256-8rL5v/0Vb+gxmbDaEB57UsQEnKCJtbZh0lFUyKYMZgs=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/by-name/eo/eom/package.nix
+++ b/pkgs/by-name/eo/eom/package.nix
@ -23,6 +23,11 @@
  wrapGAppsHook3,
  yelp-tools,
  gitUpdater,
+  gnome,
+  libavif,
+  libheif,
+  libjxl,
+  webp-pixbuf-loader,
 }:

 stdenv.mkDerivation (finalAttrs: {
@ -64,6 +69,21 @@ stdenv.mkDerivation (finalAttrs: {

  enableParallelBuilding = true;

+  postInstall = ''
+    # In postInstall to run before gappsWrapperArgsHook.
+    export GDK_PIXBUF_MODULE_FILE="${
+      gnome._gdkPixbufCacheBuilder_DO_NOT_USE {
+        extraLoaders = [
+          libavif
+          libheif.lib
+          libjxl
+          librsvg
+          webp-pixbuf-loader
+        ];
+      }
+    }"
+  '';
+
  passthru.updateScript = gitUpdater {
    odd-unstable = true;
    rev-prefix = "v";
--- a/pkgs/by-name/fa/fast-float/package.nix
+++ b/pkgs/by-name/fa/fast-float/package.nix
@ -7,13 +7,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "fast-float";
-  version = "8.2.8";
+  version = "8.2.10";

  src = fetchFromGitHub {
    owner = "fastfloat";
    repo = "fast_float";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-wnWZyQJzg6vzaRi3hbNHCAZre+NrI7KMoJwJp94fy70=";
+    hash = "sha256-DOwDLnMwlXAP5SfDJuxhkmLmcBZ1wBvXEJr5RuHepp4=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/by-name/fa/faugus-launcher/package.nix
+++ b/pkgs/by-name/fa/faugus-launcher/package.nix
@ -19,14 +19,14 @@

 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "faugus-launcher";
-  version = "1.20.4";
+  version = "1.22.4";
  pyproject = false;

  src = fetchFromGitHub {
    owner = "Faugus";
    repo = "faugus-launcher";
    tag = finalAttrs.version;
-    hash = "sha256-Kt6ZZ5yivbRzlgV+ovWiZVolxjmquAifJ/0lk1oL4fA=";
+    hash = "sha256-Npfoqa6A1YSNSxV3zcIQL6prlht47dVaZYpq9+Dx9LY=";
  };

  nativeBuildInputs = [
@ -53,15 +53,10 @@ python3Packages.buildPythonApplication (finalAttrs: {
    substituteInPlace faugus-launcher \
      --replace-fail "/usr/bin/python3" "${python3Packages.python.interpreter}"

-    substituteInPlace faugus/launcher.py \
-      --replace-fail "PathManager.user_data('faugus-launcher/umu-run')" "'${lib.getExe umu-launcher}'" \
-      --replace-fail "/usr/lib/extensions/vulkan/lsfgvk/lib/liblsfg-vk.so" "${lsfg-vk}/lib/liblsfg-vk.so" \
-      --replace-fail "/usr/lib/liblsfg-vk.so" "${lsfg-vk}/lib/liblsfg-vk.so"
-
-    substituteInPlace faugus/runner.py \
+    substituteInPlace faugus/path_manager.py \
      --replace-fail "PathManager.user_data('faugus-launcher/umu-run')" "'${lib.getExe umu-launcher}'"

-    substituteInPlace faugus/shortcut.py \
+    substituteInPlace faugus/launcher.py faugus/shortcut.py \
      --replace-fail "/usr/lib/extensions/vulkan/lsfgvk/lib/liblsfg-vk.so" "${lsfg-vk}/lib/liblsfg-vk.so" \
      --replace-fail "/usr/lib/liblsfg-vk.so" "${lsfg-vk}/lib/liblsfg-vk.so"
  '';
--- a/pkgs/by-name/fc/fcitx5-chewing/package.nix
+++ b/pkgs/by-name/fc/fcitx5-chewing/package.nix
@ -12,13 +12,13 @@

 stdenv.mkDerivation rec {
  pname = "fcitx5-chewing";
-  version = "5.1.11";
+  version = "5.1.12";

  src = fetchFromGitHub {
    owner = "fcitx";
    repo = pname;
    rev = version;
-    hash = "sha256-zOaXQUIW9+kOae2hajtnKLNmtlhZLuFAb+nts9gmivQ=";
+    hash = "sha256-WBCaknT1woPRmnxQP8WhJUodM5jTXYg3QP6trFw37gg=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/fc/fcitx5-hangul/package.nix
+++ b/pkgs/by-name/fc/fcitx5-hangul/package.nix
@ -13,13 +13,13 @@

 stdenv.mkDerivation rec {
  pname = "fcitx5-hangul";
-  version = "5.1.9";
+  version = "5.1.10";

  src = fetchFromGitHub {
    owner = "fcitx";
    repo = pname;
    rev = version;
-    hash = "sha256-zxq/nINxLvhZCcndNyAUAOY74npFXcYUR78TlZVyRUk=";
+    hash = "sha256-ZeBTJ9SllLSVHt7kJOQL+q2SGjQkyYqD5SCXWj1QojE=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/fi/finamp/git-hashes.json
+++ b/pkgs/by-name/fi/finamp/git-hashes.json
@ -1,13 +1,14 @@
 {
  "balanced_text": "sha256-U+gtC9AaUFp3gVkUzYMWAUSuUV7kYB8ZE2BsclnxwkA=",
+  "flutter_carplay": "sha256-0lewLQFVx+0rW2aAxWSePz/9bhNmb/mWt4RBJ++BCuM=",
  "flutter_user_certificates_android": "sha256-HL1Qd0D3CLYJysWLX2jqWt1FJRGm/BE8EjVFPztOIPo=",
  "isar": "sha256-Wg1m/HM7UnK+aC1DOyY41Bo4HuLrEaAxCtQw12ZrnN0=",
-  "isar_flutter_libs": "sha256-Z5IdfiaZ7348XwYSQb81z0YZEoIHWmsSZr6mYqqz4Oo=",
+  "isar_flutter_libs": "sha256-abfMKRRVJgrG5orGvXJbIJNTx8Fx0XTlvZZ9W+LcsP0=",
  "isar_generator": "sha256-fM8ygT6il7TdjmeTdmk8o4exc3Z/F1tYF878eoDK37E=",
  "just_audio": "sha256-I+HTDx3IpaQw3VBVO7KGzl0vDcFrNZhN5455i7TNxxs=",
-  "just_audio_media_kit": "sha256-dSlZETFqNQs7jxNN+8MWQzval31zA7zCs+7WiPPPZMw=",
+  "just_audio_media_kit": "sha256-ZdSX86xeqXZZrdHpdg8W240qtSnUTfZLN9XrM05rVTI=",
  "media_kit_libs_windows_audio": "sha256-XAObjn7wcN4qA7MW+hKqjNZv/L2Ec8t/cTF+d2ZoZ+k=",
  "palette_generator": "sha256-mnRJf3asu1mm9HYU8U0di+qRk3SpNFwN3S5QxChpIA0=",
  "smtc_windows": "sha256-ESR6qw8ciJvo1YG3wNK7Uy/N0zzl6OX6q40Dmgsvx6A=",
  "split_view": "sha256-unTJQDXUUPVDudlk0ReOPNYrsyEpbd/UMg1tHZsmg+k="
-}
+}
--- a/pkgs/by-name/fi/finamp/package.nix
+++ b/pkgs/by-name/fi/finamp/package.nix
@ -15,7 +15,7 @@
  dart,
 }:
 let
-  version = "0.9.23-beta";
+  version = "0.9.24-beta";
 in
 flutter341.buildFlutterApplication {
  inherit version;
@ -24,7 +24,7 @@ flutter341.buildFlutterApplication {
    owner = "UnicornsOnLSD";
    repo = "finamp";
    rev = version;
-    hash = "sha256-N1+6rB16geFMYMbfiF7eppnXfXC/pqv90I9aY/57lKI=";
+    hash = "sha256-o7q7Yr47maTrt4CG3PiV9Fdhy77ToboVdd8olZFfFts=";
  };

  pubspecLock = lib.importJSON ./pubspec.lock.json;
--- a/pkgs/by-name/fi/finamp/pubspec.lock.json
+++ b/pkgs/by-name/fi/finamp/pubspec.lock.json
--- a/pkgs/by-name/fi/fish-lsp/package.nix
+++ b/pkgs/by-name/fi/fish-lsp/package.nix
@ -16,18 +16,18 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "fish-lsp";
-  version = "1.1.3";
+  version = "1.1.4";

  src = fetchFromGitHub {
    owner = "ndonfris";
    repo = "fish-lsp";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-G0RaDXn3UNkdrlnjNH75ftvcLgAuiY09aXY3MXjaLEE=";
+    hash = "sha256-kPGbEi0KCq/BsEq2RkFb5zfARncMIvXHniOUglNYk1s=";
  };

  yarnOfflineCache = fetchYarnDeps {
    yarnLock = finalAttrs.src + "/yarn.lock";
-    hash = "sha256-uLrdja3G/OwHZXkQbKXsPmGRIs08b3sCPtxtP1a52fg=";
+    hash = "sha256-WrH56oWTTDG1P/OHC5WjLCkZM3j6HEirAvhF+6Xd76I=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/gc/gcan/package.nix
+++ b/pkgs/by-name/gc/gcan/package.nix
@ -0,0 +1,34 @@
+{
+  lib,
+  fetchFromGitHub,
+  rustPlatform,
+  versionCheckHook,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "gcan";
+  version = "1.1.1";
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "applicative-systems";
+    repo = "gcan";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-BZfdc3ddAa9CPC3GOH9G3QJbECbSRY7ymzIMtYl076M=";
+  };
+
+  cargoHash = "sha256-5oE69FYTAV6JiTAN4A79+ndI0vHrbAi1JeEJcD+eY2c=";
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  meta = {
+    description = "Analyze, filter, and prune Nix GC roots";
+    homepage = "https://github.com/applicative-systems/gcan";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.tfc ];
+    mainProgram = "gcan";
+    platforms = lib.platforms.unix;
+  };
+})
--- a/pkgs/by-name/ge/gelly/package.nix
+++ b/pkgs/by-name/ge/gelly/package.nix
@ -18,16 +18,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "gelly";
-  version = "1.4.0";
+  version = "1.6.2";

  src = fetchFromGitHub {
    owner = "Fingel";
    repo = "gelly";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-3RXAipo8QzRu8OVJqrh2AHVXgvgbEYC7GJ4ho4rbNnI=";
+    hash = "sha256-yAbItAKzvn2mxNPqg+iuiI5GvFAYXw1721DaVzS0axI=";
  };

-  cargoHash = "sha256-yiW0neFnNPb9go7Yef+DLoUCZ32E3DLe1a0onbte+Xc=";
+  cargoHash = "sha256-nKWpawdvBdu57O/Fs+cumrfbYrPUouD3uL0YKWOZY+I=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/by-name/gh/gh-gei/package.nix
+++ b/pkgs/by-name/gh/gh-gei/package.nix
@ -7,13 +7,13 @@

 buildDotnetModule rec {
  pname = "gh-gei";
-  version = "1.30.1";
+  version = "1.30.2";

  src = fetchFromGitHub {
    owner = "github";
    repo = "gh-gei";
    rev = "v${version}";
-    hash = "sha256-eccHFngmP0uUsbtlFSIT1agRMx3OCNyqPMHG8/mj5P8=";
+    hash = "sha256-z3eBORwrccIgTijdHcK7en4DvRY0fE3807Amn0MCuA8=";
  };

  dotnet-sdk = dotnetCorePackages.sdk_8_0_4xx;
--- a/pkgs/by-name/gh/ghr-cli/package.nix
+++ b/pkgs/by-name/gh/ghr-cli/package.nix
@ -8,7 +8,7 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "ghr-cli";
-  version = "0.8.1";
+  version = "0.8.2";

  __structuredAttrs = true;

@ -16,10 +16,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
    owner = "chenyukang";
    repo = "ghr";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-lo8a5EhLslqjnUG/xM8XFU1x1Eam47lFD8KRMzuCSD4=";
+    hash = "sha256-ELYWoGUP6s2Trtnk9zgDLlT7MtaiHzfsFbzH+LmsKDE=";
  };

-  cargoHash = "sha256-PtnQVdW9yC2309047PFt/HXV1QyqNttZ0zJ8hocLRAo=";
+  cargoHash = "sha256-siMxS08K+7L8f9A32gEWwQF9PAQh5UPMA+xTkTlz13o=";

  passthru.updateScript = nix-update-script { };

--- a/pkgs/by-name/go/golds/package.nix
+++ b/pkgs/by-name/go/golds/package.nix
@ -8,13 +8,13 @@

 buildGoModule (finalAttrs: {
  pname = "golds";
-  version = "0.8.3";
+  version = "0.8.4";

  src = fetchFromGitHub {
    owner = "go101";
    repo = "golds";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-s4vzQ+ntty1XLe65sEBxxN+Amp162k40LmJ7AT2/26U=";
+    hash = "sha256-Jt0Q6Ie1HSqRs4+zlmNOXlSMXfWu0nSIOjglduq4FUE=";
  };

  # nixpkgs is not using the go distpack archive and missing a VERSION file in the source
--- a/pkgs/by-name/gr/grafana-image-renderer/package.nix
+++ b/pkgs/by-name/gr/grafana-image-renderer/package.nix
@ -6,19 +6,19 @@

 buildGoModule (finalAttrs: {
  pname = "grafana-image-renderer";
-  version = "5.7.3";
+  version = "5.8.11";

  src = fetchFromGitHub {
    owner = "grafana";
    repo = "grafana-image-renderer";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-CrJkBx2BMGlFtqXR174A5CVTH2GIZHTVxxwJjCi68pg=";
+    hash = "sha256-qNi268XHyKQ2kvT24ovhzUEREaYMXWlGHfcuyRHjRYQ=";
  };

-  vendorHash = "sha256-3nd0m0PltTiJX5e1tbQ7LSgUmDRXC8nRktOVAIgHOCU=";
+  vendorHash = "sha256-QiseTdsFOBg3aDYpdmLHfXL9eFll6iJo4wSKwXvdGnM=";

  postPatch = ''
-    substituteInPlace go.mod --replace-fail 'go 1.26.1' 'go 1.25.7'
+    substituteInPlace go.mod --replace-fail 'go 1.26.4' 'go 1.26.3'
  '';

  subPackages = [ "." ];
--- a/pkgs/by-name/gt/gtree/package.nix
+++ b/pkgs/by-name/gt/gtree/package.nix
@ -11,16 +11,16 @@
 # it's updated.
 buildGo126Module (finalAttrs: {
  pname = "gtree";
-  version = "1.13.6";
+  version = "1.14.2";

  src = fetchFromGitHub {
    owner = "ddddddO";
    repo = "gtree";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-E3Nri8kFMh6NYp29vFFNAlJxdfOvLR1inbD+KALXZms=";
+    hash = "sha256-LMVXC22fTrPt4S5HkErMrpZwwanN5blY/TPUE8bg95s=";
  };

-  vendorHash = "sha256-Pkc2UV/77YdKm5ZWKCSKE0dljUzC5dw1f08T+3MvFTE=";
+  vendorHash = "sha256-Vd5VKKl79Qu5R7jOYS1CTtQuAis9vWUbpBWnEI7sgpk=";

  subPackages = [
    "cmd/gtree"
--- a/pkgs/by-name/hi/hiredis/package.nix
+++ b/pkgs/by-name/hi/hiredis/package.nix
@ -29,7 +29,7 @@ stdenv.mkDerivation (finalAttrs: {
    homepage = "https://github.com/redis/hiredis";
    description = "Minimalistic C client for Redis >= 1.2";
    license = lib.licenses.bsd3;
-    maintainers = with lib.maintainers; [ hythera ];
    platforms = lib.platforms.all;
+    teams = [ lib.teams.redis ];
  };
 })
--- a/pkgs/by-name/hy/hyperrogue/package.nix
+++ b/pkgs/by-name/hy/hyperrogue/package.nix
@ -113,7 +113,7 @@ stdenv.mkDerivation (finalAttrs: {
    homepage = "https://www.roguetemple.com/z/hyper/";
    changelog = "https://github.com/zenorogue/hyperrogue/releases/tag/v${finalAttrs.version}";
    mainProgram = "hyperrogue";
-    maintainers = with lib.maintainers; [ rardiol ];
+    maintainers = [ ];
    license = lib.licenses.gpl2Plus;
    platforms = lib.platforms.all;
  };
--- a/pkgs/by-name/im/imhex/package.nix
+++ b/pkgs/by-name/im/imhex/package.nix
@ -98,6 +98,9 @@ stdenv.mkDerivation (finalAttrs: {
    (lib.cmakeBool "USE_SYSTEM_NLOHMANN_JSON" true)
    (lib.cmakeBool "USE_SYSTEM_YARA" true)
    (lib.cmakeFeature "CMAKE_POLICY_VERSION_MINIMUM" "3.5")
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    (lib.cmakeFeature "CMAKE_INSTALL_NAME_DIR" "@executable_path/../Frameworks")
  ];

  env.NIX_CFLAGS_COMPILE = "-Wno-error=deprecated-declarations";
@ -122,10 +125,6 @@ stdenv.mkDerivation (finalAttrs: {
      ''
        mkdir -p $out/Applications
        mv $out/imhex.app $out/Applications
-        install_name_tool \
-          -change "$out/lib/libimhex.${finalAttrs.version}${stdenv.hostPlatform.extensions.sharedLibrary}" \
-          "@executable_path/../Frameworks/libimhex.${finalAttrs.version}${stdenv.hostPlatform.extensions.sharedLibrary}" \
-          "$out/Applications/imhex.app/Contents/MacOS/imhex"
        makeWrapper "$out/Applications/imhex.app/Contents/MacOS/imhex" "$out/bin/imhex"
      ''
    else
--- a/pkgs/by-name/jo/jonquil/package.nix
+++ b/pkgs/by-name/jo/jonquil/package.nix
@ -21,13 +21,13 @@ assert (

 stdenv.mkDerivation (finalAttrs: {
  pname = "jonquil";
-  version = "0.3.0";
+  version = "0.3.1";

  src = fetchFromGitHub {
    owner = "toml-f";
    repo = "jonquil";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-2JCTHA0nyA7xE0IA+LNrEAulHU2eIbNRvFGQ7YSQMRE=";
+    hash = "sha256-xKL3EWZaHdMAuUK7pL2vjfRk8Fq2uNL65TrGUyFQ5cc=";
  };

  patches = [
--- a/pkgs/by-name/ju/just-lsp/package.nix
+++ b/pkgs/by-name/ju/just-lsp/package.nix
@ -8,7 +8,7 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "just-lsp";
-  version = "0.4.6";
+  version = "0.4.7";

  __structuredAttrs = true;

@ -16,10 +16,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
    owner = "terror";
    repo = "just-lsp";
    tag = finalAttrs.version;
-    hash = "sha256-x58iZ1TSwMZSPQsxlXeMgBxBMezCLJkbGFMWE4gV2PE=";
+    hash = "sha256-Z35pRJDDUdyjz9Tw66wgBYjYicJCO87EI/J3Nux8udE=";
  };

-  cargoHash = "sha256-XSXzCTbacnxuK9rjuRhnNu9uglK+H1Ixfm00A+6O5MM=";
+  cargoHash = "sha256-qAeUk+1WmQ5TPdfJcoM+mrFVOfhhdVZnyBhxfzyh1Tc=";

  nativeInstallCheckInputs = [
    versionCheckHook
--- a/pkgs/by-name/ka/kanban/package.nix
+++ b/pkgs/by-name/ka/kanban/package.nix
@ -7,18 +7,18 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "kanban";
-  version = "0.6.0";
+  version = "0.7.2";

  src = fetchFromGitHub {
    owner = "fulsomenko";
    repo = "kanban";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-6L+f4+A9mRZch7/D1koCMHrkciusKcoZhYJICEDU4b8=";
+    hash = "sha256-4wvSVnVck3AJ4pv6whxFiwsmoWl4f5Q0a2lSFeMGdZs=";
  };

  env.GIT_COMMIT_HASH = finalAttrs.src.rev;

-  cargoHash = "sha256-NMFZW+LC5YYqbXCmgbmUyAx8O+M7o1TKigOC978k0/o=";
+  cargoHash = "sha256-Qmma0UkuuAhnD3zUUS5iCX2rUGvtO6U5zNFpg3Din7U=";

  passthru.updateScript = nix-update-script { };

--- a/pkgs/by-name/lc/lcevcdec/package.nix
+++ b/pkgs/by-name/lc/lcevcdec/package.nix
@ -14,7 +14,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "lcevcdec";
-  version = "4.1.0";
+  version = "4.2.0";

  outputs = [
    "out"
@ -26,7 +26,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "v-novaltd";
    repo = "LCEVCdec";
    tag = finalAttrs.version;
-    hash = "sha256-QzejWq0XGPLu+YVNetfbzczNuZ6Gp5QJP5G2RZUan6M=";
+    hash = "sha256-EVp+ucydbBWlMMXbldkwDEbFlM88UIts8f/PspIqqSY=";
  };

  postPatch = ''
--- a/pkgs/by-name/li/liberal-crime-squad/package.nix
+++ b/pkgs/by-name/li/liberal-crime-squad/package.nix
@ -36,7 +36,7 @@ stdenv.mkDerivation {
      Welcome to Liberal Crime Squad! The Conservatives have taken the Executive, Legislative, and Judicial branches of government. Over time, the Liberal laws of this nation will erode and turn the country into a BACKWOODS YET CORPORATE NIGHTMARE. To prevent this from happening, the Liberal Crime Squad was established. The mood of the country is shifting, and we need to turn things around. Go out on the streets and indoctrinate Conservative automatons. That is, let them see their True Liberal Nature. Then arm them and send them forth to Stop Evil.
    '';
    homepage = "https://github.com/Kamal-Sadek/Liberal-Crime-Squad";
-    maintainers = [ lib.maintainers.rardiol ];
+    maintainers = [ ];
    mainProgram = "crimesquad";
    license = lib.licenses.gpl2Plus;
    platforms = lib.platforms.all;
--- a/pkgs/by-name/li/libtree/package.nix
+++ b/pkgs/by-name/li/libtree/package.nix
@ -53,7 +53,6 @@ stdenv.mkDerivation (finalAttrs: {
    platforms = lib.platforms.linux;
    maintainers = with lib.maintainers; [
      prusnak
-      rardiol
    ];
  };
 })
--- a/pkgs/by-name/li/libwmf/package.nix
+++ b/pkgs/by-name/li/libwmf/package.nix
@ -2,7 +2,9 @@
  lib,
  stdenv,
  fetchFromGitHub,
+  autoreconfHook,
  pkg-config,
+  expat,
  freetype,
  glib,
  imagemagick,
@ -14,7 +16,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "libwmf";
-  version = "0.2.13";
+  version = "0.2.15";

  outputs = [
    "out"
@ -24,11 +26,15 @@ stdenv.mkDerivation (finalAttrs: {
  src = fetchFromGitHub {
    owner = "caolanm";
    repo = "libwmf";
-    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-vffohx57OvQKu8DfNXNBm9bPsA8KgkQWs/3mmFn7L6M=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Bpxr04dQ6EjX1FBVF4KcbJQvUjsPK6L03xLIXG6F2FI=";
  };

-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
+  ];
+
  buildInputs = [
    zlib
    imagemagick
@ -37,10 +43,12 @@ stdenv.mkDerivation (finalAttrs: {
    freetype
    libjpeg
    libxml2
+    expat
  ];
  enableParallelBuilding = true;

  meta = {
+    changelog = "https://github.com/caolanm/libwmf/blob/${finalAttrs.src.tag}/ChangeLog";
    description = "WMF library from wvWare";
    homepage = "https://wvware.sourceforge.net/libwmf.html";
    downloadPage = "https://github.com/caolanm/libwmf/releases";
--- a/pkgs/by-name/li/lima/source.nix
+++ b/pkgs/by-name/li/lima/source.nix
@ -4,7 +4,7 @@
 }:

 let
-  version = "2.1.2";
+  version = "2.1.3";
 in
 {
  inherit version;
@ -13,7 +13,7 @@ in
    owner = "lima-vm";
    repo = "lima";
    tag = "v${version}";
-    hash = "sha256-WN0HsSnxLh8MiA9UQoYWnfp5fJyEc6w1XJaencZCsL4=";
+    hash = "sha256-7hr89PApcxi/qoYZK8xPuGbhG95RfiYjkyVvZYIflyw=";
  };

  vendorHash = "sha256-8AksUgle1SlWuALi553TlpZ2qwO+jMA1kZQke91fimU=";
--- a/pkgs/by-name/ls/lstk/package.nix
+++ b/pkgs/by-name/ls/lstk/package.nix
@ -7,7 +7,7 @@
 }:
 buildGoModule (finalAttrs: {
  pname = "lstk";
-  version = "0.11.0";
+  version = "0.13.0";

  __structuredAttrs = true;

@ -15,10 +15,10 @@ buildGoModule (finalAttrs: {
    owner = "localstack";
    repo = "lstk";
    tag = "v${finalAttrs.version}";
-    sha256 = "sha256-2PViyzcJ2AGigfxLwQ5FnULV4zF0FPQIr6nqg5d90S4=";
+    sha256 = "sha256-UF+ySjw3fdb9aTA/tRDmFR3EXYA7nvbuv/esT/3Rsv4=";
  };

-  vendorHash = "sha256-y/QlgdYS4IeU9Xf/2trHRvjB5QOHDbFDrF57y9B6jxI=";
+  vendorHash = "sha256-zKEUGn9eKYdxSinS+NXc7PrgZkrQRZnIxTNH3yNL4GE=";

  excludedPackages = "test/integration";

--- a/pkgs/by-name/lx/lxmf-rs/package.nix
+++ b/pkgs/by-name/lx/lxmf-rs/package.nix
@ -13,14 +13,14 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "lxmf-rs";
-  version = "0.4.1";
+  version = "0.5.0";
  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "FreeTAKTeam";
    repo = "LXMF-rs";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-GCN4HpqbCM2xCBpBRpUALmHGfhOm1qZScdYgBqJqLQU=";
+    hash = "sha256-9yTteJCH/5/LGvp6AH74oKYcnue1NetD7DG3fMz+D2Y=";
  };

  cargoHash = "sha256-a6O1VslizDom6AuJKF5xZgKNSgrw1EfvJRWpG9J7Le8=";
--- a/pkgs/by-name/ma/mangowc/package.nix
+++ b/pkgs/by-name/ma/mangowc/package.nix
@ -1,4 +1,5 @@
 {
+  cjson,
  lib,
  libx11,
  libinput,
@ -23,13 +24,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "mangowc";
-  version = "0.12.8";
+  version = "0.14.4";

  src = fetchFromGitHub {
    owner = "mangowm";
    repo = "mango";
    tag = finalAttrs.version;
-    hash = "sha256-k9qFn9I+eeAq1kBfw6QRLRMDb6sIV+pgd5zpKNoc1ck=";
+    hash = "sha256-WfQNALT+8ZbjZG2co1tz2dZZZw1tcU5ynuFe+vVMbV0=";
  };

  nativeBuildInputs = [
@ -40,6 +41,7 @@ stdenv.mkDerivation (finalAttrs: {
  ];

  buildInputs = [
+    cjson
    libinput
    libxcb
    libxkbcommon
@ -72,7 +74,10 @@ stdenv.mkDerivation (finalAttrs: {
    description = "Lightweight and feature-rich Wayland compositor based on dwl";
    homepage = "https://mangowm.github.io";
    license = lib.licenses.gpl3Plus;
-    maintainers = with lib.maintainers; [ hustlerone ];
+    maintainers = with lib.maintainers; [
+      hustlerone
+      yvnth
+    ];
    platforms = lib.platforms.linux;
  };
 })
--- a/pkgs/by-name/mc/mctc-lib/package.nix
+++ b/pkgs/by-name/mc/mctc-lib/package.nix
@ -50,7 +50,9 @@ stdenv.mkDerivation (finalAttrs: {
  ]
  ++ lib.optional (buildType == "cmake") cmake;

-  buildInputs = [
+  propagatedBuildInputs = [
+    # jonquil (and the toml-f it propagates) appears in mctc-lib.pc's Requires.private, so it must
+    # be propagated for pkg-config consumers (e.g. dftd4) to resolve mctc-lib
    jonquil
  ];

--- a/pkgs/by-name/me/memtier-benchmark/package.nix
+++ b/pkgs/by-name/me/memtier-benchmark/package.nix
@ -37,10 +37,8 @@ stdenv.mkDerivation (finalAttrs: {
    homepage = "https://github.com/redis/memtier_benchmark";
    license = lib.licenses.gpl2Only;
    platforms = lib.platforms.unix;
-    maintainers = with lib.maintainers; [
-      thoughtpolice
-      hythera
-    ];
+    maintainers = with lib.maintainers; [ thoughtpolice ];
    mainProgram = "memtier_benchmark";
+    teams = [ lib.teams.redis ];
  };
 })
--- a/pkgs/by-name/me/meshcentral/optionalDependencies.patch
+++ b/pkgs/by-name/me/meshcentral/optionalDependencies.patch
--- a/pkgs/by-name/me/meshcentral/package.nix
+++ b/pkgs/by-name/me/meshcentral/package.nix
@ -7,16 +7,16 @@

 buildNpmPackage (finalAttrs: {
  pname = "meshcentral";
-  version = "1.1.59";
+  version = "1.2.0";

  src = fetchFromGitHub {
    owner = "Ylianst";
    repo = "MeshCentral";
    tag = finalAttrs.version;
-    hash = "sha256-qfiIofwFOXHzxnqyJyXCgwMqBhONjBiU/5YLOE7u4n8=";
+    hash = "sha256-a+vqNjmKP866O2t+UsedpgYtWFbjeoYNtuCziAa436A=";
  };

-  npmDepsHash = "sha256-UYPx3OIeT1HUgyjY743F/DTwsfIRTlsQLJxK99LbA/k=";
+  npmDepsHash = "sha256-ZnSpqw4pn6OI8Gh9qLseTLH24jtj1zPGfHiMlUX+l/s=";
  # Using the npmDeps with a newer nodejs causes `npm ci` errors, also upstream
  # states they stick to the LTS version of nodejs:
  # https://meshcentral.com/docs/MeshCentral2InstallGuide.pdf
--- a/pkgs/by-name/mi/miracle-wm/package.nix
+++ b/pkgs/by-name/mi/miracle-wm/package.nix
@ -2,6 +2,7 @@
  stdenv,
  lib,
  fetchFromGitHub,
+  fetchpatch,
  gitUpdater,
  nixosTests,
  boost,
@ -42,6 +43,17 @@ stdenv.mkDerivation (finalAttrs: {
    hash = "sha256-7JtdSopKBHfFK0KsV0+9OxrOx3vrSydmZSmAiBvKQiI=";
  };

+  patches = [
+    (fetchpatch {
+      name = "0001-miracle-wm-mir2.28.patch";
+      url = "https://github.com/miracle-wm-org/miracle-wm/commit/0fcfb54c59327d0776f6e8074e885080731a95c4.patch";
+      excludes = [
+        ".github/workflows/test-deb-install.yml"
+      ];
+      hash = "sha256-HuXwPkM0whLFIy8HM6n9bG9I/DZOuzAajmDpJMZt9BQ=";
+    })
+  ];
+
  postPatch = ''
    substituteInPlace CMakeLists.txt \
      --replace-fail 'DESTINATION lib' 'DESTINATION ''${CMAKE_INSTALL_LIBDIR}' \
--- a/pkgs/by-name/mo/modrinth-app-unwrapped/package.nix
+++ b/pkgs/by-name/mo/modrinth-app-unwrapped/package.nix
@ -31,13 +31,13 @@ in

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "modrinth-app-unwrapped";
-  version = "0.14.2";
+  version = "0.14.8";

  src = fetchFromGitHub {
    owner = "modrinth";
    repo = "code";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-j4HaBmWzCFAmkzeEWln+nSwNuvlv5zmwf89ClGqCvus=";
+    hash = "sha256-s34vmm0Apy20FrfSjESXtj+uggvr4ODpOrxfapAKtlc=";
  };

  patches = [
@ -67,7 +67,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
      --replace-fail '1.0.0-local' '${finalAttrs.version}'
  '';

-  cargoHash = "sha256-VKz06Z3bFuJrzNEeIF6O4N0Mju1RtuZVQfw2ONIBwmg=";
+  cargoHash = "sha256-JU8QhdDikqe9a/MXVe2jSsXATvwdgpyjWr7pV/75C9E=";

  mitmCache = gradle.fetchDeps {
    inherit (finalAttrs) pname;
@ -78,7 +78,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    inherit (finalAttrs) pname version src;
    pnpm = pnpm_10;
    fetcherVersion = 3;
-    hash = "sha256-bBXnRtFeMzBr3XvXqYsY2iGHD7q4qDrPhxW163N0MTo=";
+    hash = "sha256-pbEKD8xkO7+//m0PBcAL62q0LC5YEKR+wOPGnzXIRJk=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/mu/multicharge/package.nix
+++ b/pkgs/by-name/mu/multicharge/package.nix
@ -25,13 +25,13 @@ assert (

 stdenv.mkDerivation (finalAttrs: {
  pname = "multicharge";
-  version = "0.3.1";
+  version = "0.5.0";

  src = fetchFromGitHub {
    owner = "grimme-lab";
    repo = "multicharge";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-8qwM3dpvFoL2WrMWNf14zYtRap0ijdfZ95XaTlkHhqQ=";
+    hash = "sha256-hswqC+fvC6tuxDpuUgowyqm72ubVikzpR4EzXtTM5cs=";
  };

  patches = [
@ -69,6 +69,11 @@ stdenv.mkDerivation (finalAttrs: {

  postPatch = ''
    patchShebangs --build config/install-mod.py
+
+    # custom blas and lapack need to be explicitly found for transitive dependencies
+    # otherwise CMAKE builds can not proceed.
+    echo 'set(custom-blas_FOUND TRUE)' >> config/cmake/Findcustom-blas.cmake
+    echo 'set(custom-lapack_FOUND TRUE)' >> config/cmake/Findcustom-lapack.cmake
  '';

  preCheck = ''
--- a/pkgs/by-name/my/mymake/package.nix
+++ b/pkgs/by-name/my/mymake/package.nix
@ -7,13 +7,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "mymake";
-  version = "2.4.3";
+  version = "2.4.4";

  src = fetchFromGitHub {
    owner = "fstromback";
    repo = "mymake";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-OjlcQ49jxMMmAhyl8c6lREOwBE63s+DIEf+rFElUsi0=";
+    hash = "sha256-H7uoTnFtRf0jaqQ+N2IK4I+edx+cK/5wXDG1Orc2XcY=";
  };

  buildPhase = ''
--- a/pkgs/by-name/ni/niks3/package.nix
+++ b/pkgs/by-name/ni/niks3/package.nix
@ -21,6 +21,7 @@ buildGoModule (finalAttrs: {

  subPackages = [
    "cmd/niks3"
+    "cmd/niks3-hook"
    "cmd/niks3-server"
  ];

--- a/Show more
+++ b/Show more