Merge release-26.05 into staging-next-26.05

2026-07-06 17:13:24 -05:00 · 2026-06-09 00:48:30 +00:00 · 2026-06-09 00:48:30 +00:00 · ce6ea406e0
commit ce6ea406e0
parent 73b05c8e2f 9c92db6010
44 changed files with 684 additions and 231 deletions
--- a/.github/workflows/teams.yml
+++ b/.github/workflows/teams.yml
@ -2,7 +2,7 @@ name: Teams

 on:
  schedule:
-    # Every Tuesday at 19:42 (randomly chosen)
+    # Every Monday at 19:42 (randomly chosen)
    - cron: '42 19 * * 1'
  workflow_dispatch:

--- a/maintainers/github-teams.json
+++ b/maintainers/github-teams.json
@ -2,10 +2,11 @@
  "acme": {
    "description": "Maintain ACME-related packages and modules.",
    "id": 3806126,
-    "maintainers": {},
+    "maintainers": {
+      "emilazy": 18535642
+    },
    "members": {
      "arianvp": 628387,
-      "emilazy": 18535642,
      "m1cr0man": 3044438
    },
    "name": "ACME"
@ -71,11 +72,10 @@
    "description": "coordinates efforts towards bootstrappable builds (see https://bootstrappable.org/)",
    "id": 9141350,
    "maintainers": {
+      "philiptaron": 43863,
      "zeuner": 2545850
    },
-    "members": {
-      "philiptaron": 43863
-    },
+    "members": {},
    "name": "bootstrapping"
  },
  "categorization": {
@ -176,6 +176,7 @@
    "description": "Improve Darwin-support across Nixpkgs and help maintainers without access to Darwin hardware. Apply to join through https://github.com/NixOS/nixpkgs/issues/323144 to keep the process transparent.",
    "id": 2385202,
    "maintainers": {
+      "emilazy": 18535642,
      "toonn": 1486805
    },
    "members": {
@ -205,7 +206,6 @@
      "donn": 12652988,
      "dwt": 57199,
      "eclairevoyant": 848000,
-      "emilazy": 18535642,
      "ethancedwards8": 60861925,
      "fiddlerwoaroof": 808745,
      "fulsomenko": 14945057,
@ -410,9 +410,7 @@
      "jtojnar": 705123
    },
    "members": {
-      "bobby285271": 20080233,
-      "dasj19": 7589338,
-      "hedning": 71978
+      "bobby285271": 20080233
    },
    "name": "GNOME"
  },
@ -556,11 +554,12 @@
    "id": 9955829,
    "maintainers": {
      "RossComputerGuy": 19699320,
-      "alyssais": 2768870
+      "alyssais": 2768870,
+      "emilazy": 18535642
    },
    "members": {
      "Ericson2314": 1055245,
-      "emilazy": 18535642,
+      "peterwaller-arm": 52030119,
      "rrbutani": 7833358,
      "sternenseemann": 3154475
    },
@ -695,8 +694,7 @@
    "description": "",
    "id": 174820,
    "maintainers": {
-      "Ericson2314": 1055245,
-      "tomberek": 178444
+      "Ericson2314": 1055245
    },
    "members": {
      "Mic92": 96200,
@ -704,6 +702,7 @@
      "edolstra": 1148549,
      "lisanna-dettwyler": 72424138,
      "lovesegfault": 7243783,
+      "tomberek": 178444,
      "xokdvium": 145775305
    },
    "name": "Nix team"
@ -852,15 +851,15 @@
    "description": "Team that is interested in reproducible builds",
    "id": 7625643,
    "maintainers": {
-      "raboof": 131856,
-      "zimbatm": 3248
+      "raboof": 131856
    },
    "members": {
      "Artturin": 56650223,
      "Atemu": 18599032,
      "RaitoBezarius": 314564,
      "davidak": 91113,
-      "mschwaig": 3856390
+      "mschwaig": 3856390,
+      "zimbatm": 3248
    },
    "name": "reproducible"
  },
@ -964,13 +963,13 @@
    "description": "Maintain the standard environment and its surrounding logic.",
    "id": 11265412,
    "maintainers": {
-      "RossComputerGuy": 19699320
+      "RossComputerGuy": 19699320,
+      "emilazy": 18535642,
+      "philiptaron": 43863
    },
    "members": {
      "Artturin": 56650223,
      "Ericson2314": 1055245,
-      "emilazy": 18535642,
-      "philiptaron": 43863,
      "reckenrode": 7413633
    },
    "name": "stdenv"
--- a/nixos/modules/installer/cd-dvd/installation-cd-graphical-calamares-plasma6.nix
+++ b/nixos/modules/installer/cd-dvd/installation-cd-graphical-calamares-plasma6.nix
@ -21,11 +21,6 @@
    };
  };

-  environment.systemPackages = [
-    # provide onscreen keyboard
-    pkgs.kdePackages.plasma-keyboard
-  ];
-
  environment.plasma6.excludePackages = [
    # Optional wallpapers that add 126 MiB to the graphical installer
    # closure. They will still need to be downloaded when installing a
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -887,6 +887,7 @@
  ./services/misc/ihaskell.nix
  ./services/misc/iio-niri.nix
  ./services/misc/input-remapper.nix
+  ./services/misc/inventree.nix
  ./services/misc/invidious-router.nix
  ./services/misc/irkerd.nix
  ./services/misc/jackett.nix
--- a/nixos/modules/services/desktop-managers/pantheon.nix
+++ b/nixos/modules/services/desktop-managers/pantheon.nix
@ -276,8 +276,7 @@ in
        ++ (with pkgs.pantheon; [
          elementary-files
          elementary-settings-daemon
-          # https://github.com/elementary/portals/issues/157
-          # xdg-desktop-portal-pantheon
+          xdg-desktop-portal-pantheon
        ])
      ) config.environment.pantheon.excludePackages;

--- a/nixos/modules/services/desktop-managers/plasma6.nix
+++ b/nixos/modules/services/desktop-managers/plasma6.nix
@ -169,6 +169,9 @@ in
          krdp
          kconfig # required for xdg-terminal from xdg-utils
          qtbase # for qtpaths which is required for xdg-mime from xdg-utils
+          # touch keyboard
+          plasma-keyboard
+          qtvirtualkeyboard # used by plasma-keyboard KCM
        ]
        ++ lib.optional config.networking.networkmanager.enable qrca
        ++ lib.optionals config.hardware.sensor.iio.enable [
--- a/nixos/modules/services/hardware/scanservjs.nix
+++ b/nixos/modules/services/hardware/scanservjs.nix
@ -125,6 +125,12 @@ in
    };
    users.groups.scanservjs = { };

+    systemd.tmpfiles.rules = [
+      "d ${cfg.stateDir}/data 0755 scanservjs scanservjs - -"
+      "d ${cfg.stateDir}/data/preview 0755 scanservjs scanservjs - -"
+      "L+ ${cfg.stateDir}/data/preview/default.jpg - - - - ${package}/lib/data/preview/default.jpg"
+    ];
+
    systemd.services.scanservjs = {
      description = "scanservjs";
      after = [ "network.target" ];
--- a/nixos/modules/services/misc/inventree.nix
+++ b/nixos/modules/services/misc/inventree.nix
@ -0,0 +1,411 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+let
+  cfg = config.services.inventree;
+  pkg = cfg.package;
+
+  mysqlLocal = cfg.database.createLocally && cfg.database.dbtype == "mysql";
+  pgsqlLocal = cfg.database.createLocally && cfg.database.dbtype == "postgresql";
+
+  manage = pkgs.writeShellScriptBin "inventree-manage" ''
+    set -a
+    ${lib.toShellVars cfg.settings}
+    ${lib.optionalString (
+      cfg.database.passwordFile != null
+    ) ''INVENTREE_DB_PASSWORD="$(<${lib.escapeShellArg cfg.database.passwordFile})"''}
+    set +a
+
+    pushd ${lib.escapeShellArg cfg.dataDir}
+    expectedUser=${lib.escapeShellArg cfg.user}
+    sudo=()
+    if [[ "$USER" != "$expectedUser" ]]; then
+      ${
+        if config.security.sudo.enable then
+          ''sudo+=(${config.security.wrapperDir}/sudo -u "$expectedUser" -E)''
+        else
+          ''printf 'Aborting, inventree-manage must be run as user %s\n!' "$expectedUser" >&2; exit 2''
+      }
+    fi
+    exec "''${sudo[@]}" ${cfg.package}/bin/inventree "$@"
+  '';
+
+in
+{
+  meta.buildDocsInSandbox = false;
+
+  meta.maintainers = with lib.maintainers; [
+    kurogeek
+  ];
+
+  options.services.inventree = {
+    enable = lib.mkEnableOption "inventree";
+
+    dataDir = lib.mkOption {
+      type = lib.types.str;
+      default = "/var/lib/inventree";
+      description = "Inventree's data storage path.  Will be `/var/lib/inventree` by default.";
+    };
+
+    package = lib.mkOption {
+      type = lib.types.package;
+      description = "Which package to use for the InvenTree instance.";
+      default = pkgs.inventree;
+      defaultText = lib.literalExpression "pkgs.inventree";
+    };
+
+    adminPasswordFile = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
+      default = null;
+      example = "/run/keys/inventree-password";
+      description = "Path to a file containing admin password";
+    };
+
+    secretKeyFile = lib.mkOption {
+      type = lib.types.path;
+      default = "${cfg.dataDir}/secret_key.txt";
+      defaultText = lib.literalExpression ''"''${cfg.dataDir}/secret_key.txt"'';
+      example = "/run/keys/inventree-secret-key";
+      description = ''
+        Path to a file containing the secret key
+      '';
+    };
+
+    database = {
+      dbtype = lib.mkOption {
+        type = lib.types.nullOr (
+          lib.types.enum [
+            "postgresql"
+            "mysql"
+          ]
+        );
+        default = "postgresql";
+        description = "Database type.";
+      };
+      dbhost = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
+        default = null;
+        example = "localhost";
+        description = "Database host or socket path.";
+      };
+      dbport = lib.mkOption {
+        type = lib.types.nullOr lib.types.port;
+        default = null;
+        example = 5432;
+        description = "Database host port.";
+      };
+      dbname = lib.mkOption {
+        type = lib.types.str;
+        default = "inventree";
+        description = "Database name.";
+      };
+      dbuser = lib.mkOption {
+        type = lib.types.str;
+        default = "inventree";
+        description = "Database username.";
+      };
+      passwordFile = lib.mkOption {
+        type = with lib.types; nullOr path;
+        default = null;
+        example = "/run/keys/inventree-dbpassword";
+        description = ''
+          A file containing the password corresponding to
+          <option>database.dbuser</option>.
+        '';
+      };
+      createLocally = lib.mkOption {
+        type = lib.types.bool;
+        default = true;
+        description = "Create the database and database user locally.";
+      };
+    };
+
+    domain = lib.mkOption {
+      type = lib.types.str;
+      default = "localhost";
+      example = "inventree.example.com";
+      description = ''
+        The INVENTREE_SITE_URL option defines the base URL for the
+        InvenTree server. This is a critical setting, and it is required
+        for correct operation of the server. If not specified, the
+        server will attempt to determine the site URL automatically -
+        but this may not always be correct!
+
+        The site URL is the URL that users will use to access the
+        InvenTree server. For example, if the server is accessible at
+        `https://inventree.example.com`, the site URL should be set to
+        `https://inventree.example.com`. Note that this is not
+        necessarily the same as the internal URL that the server is
+        running on - the internal URL will depend entirely on your
+        server configuration and may be obscured by a reverse proxy or
+        other such setup.
+      '';
+    };
+
+    user = lib.mkOption {
+      type = lib.types.str;
+      default = "inventree";
+      description = "User under which InvenTree runs.";
+    };
+
+    group = lib.mkOption {
+      type = lib.types.str;
+      default = "inventree";
+      description = "Group under which InvenTree runs.";
+    };
+
+    settings = lib.mkOption {
+      type =
+        with lib.types;
+        attrsOf (
+          nullOr (oneOf [
+            path
+            str
+          ])
+        );
+      default = { };
+      description = ''
+        InvenTree config options.
+
+        See [the documentation](https://docs.inventree.org/en/stable/start/config/) for available options.
+      '';
+      example = {
+        INVENTREE_CACHE_ENABLED = true;
+        INVENTREE_CACHE_HOST = "localhost";
+
+        INVENTREE_EMAIL_HOST = "smtp.example.com";
+        INVENTREE_EMAIL_PORT = 25;
+      };
+    };
+
+  };
+
+  config = lib.mkIf cfg.enable (
+    lib.mkMerge [
+      {
+        services.inventree.settings = {
+          INVENTREE_DB_ENGINE = cfg.database.dbtype;
+          INVENTREE_DB_NAME = cfg.database.dbname;
+          INVENTREE_DB_HOST = cfg.database.dbhost;
+          INVENTREE_DB_USER = cfg.database.dbuser;
+          INVENTREE_DB_PORT = if cfg.database.dbport != null then toString cfg.database.dbport else null;
+
+          INVENTREE_CONFIG_FILE = lib.mkDefault "${cfg.dataDir}/config/config.yaml";
+          INVENTREE_OIDC_PRIVATE_KEY_FILE = lib.mkDefault "${cfg.dataDir}/config/oidc_private_key.txt";
+          INVENTREE_STATIC_ROOT = lib.mkDefault "${cfg.package}/lib/inventree/static";
+          INVENTREE_MEDIA_ROOT = lib.mkDefault "${cfg.dataDir}/data/media";
+          INVENTREE_BACKUP_DIR = lib.mkDefault "${cfg.dataDir}/data/backups";
+          INVENTREE_SITE_URL = lib.mkDefault "http://${cfg.domain}";
+          INVENTREE_PLUGIN_FILE = lib.mkDefault "${cfg.dataDir}/data/plugins/plugins.txt";
+          INVENTREE_PLUGIN_DIR = lib.mkDefault "${cfg.dataDir}/data/plugins";
+          INVENTREE_ADMIN_USER = lib.mkDefault "admin";
+          INVENTREE_ADMIN_EMAIL = lib.mkDefault "admin@${cfg.domain}";
+          INVENTREE_ADMIN_PASSWORD_FILE = lib.mkDefault cfg.adminPasswordFile;
+          INVENTREE_SECRET_KEY_FILE = lib.mkDefault cfg.secretKeyFile;
+          INVENTREE_AUTO_UPDATE = lib.mkDefault "false";
+        };
+        environment.systemPackages = [ manage ];
+        systemd.tmpfiles.rules = (
+          map (dir: "d ${dir} 0755 inventree inventree") [
+            "${cfg.dataDir}"
+            "${cfg.dataDir}/config"
+            "${cfg.dataDir}/data"
+            "${cfg.dataDir}/data/media"
+            "${cfg.dataDir}/data/backups"
+            "${cfg.dataDir}/data/plugins"
+          ]
+        );
+
+        services.postgresql = lib.mkIf pgsqlLocal {
+          enable = true;
+          ensureDatabases = [ cfg.database.dbname ];
+          ensureUsers = [
+            {
+              name = cfg.database.dbuser;
+              ensureDBOwnership = true;
+            }
+          ];
+        };
+
+        services.mysql = lib.mkIf mysqlLocal {
+          enable = true;
+          package = lib.mkDefault pkgs.mariadb;
+          ensureDatabases = [ cfg.database.dbname ];
+          ensureUsers = [
+            {
+              name = cfg.database.dbuser;
+              ensurePermissions = {
+                "${cfg.database.dbname}.*" = "ALL PRIVILEGES";
+              };
+            }
+          ];
+        };
+
+        services.nginx.enable = true;
+        services.nginx.virtualHosts.${cfg.domain} = {
+          locations =
+            let
+              unixPath = config.systemd.sockets.inventree-server.socketConfig.ListenStream;
+            in
+            {
+              "/" = {
+                extraConfig = ''
+                  proxy_set_header Host $host;
+                  proxy_set_header X-Forwarded-By $server_addr:$server_port;
+                  proxy_set_header X-Forwarded-For $remote_addr;
+                  proxy_set_header X-Forwarded-Proto $scheme;
+                  proxy_set_header X-Real-IP $remote_addr;
+                  proxy_set_header CLIENT_IP $remote_addr;
+
+                  proxy_pass_request_headers on;
+
+                  proxy_redirect off;
+
+                  client_max_body_size 100M;
+
+                  proxy_buffering off;
+                  proxy_request_buffering off;
+                '';
+                proxyPass = "http://unix:${unixPath}";
+              };
+              "/auth" = {
+                extraConfig = ''
+                  internal;
+                  proxy_pass_request_body off;
+                  proxy_set_header Content-Length "";
+                  proxy_set_header X-Original-URI $request_uri;
+                '';
+                proxyPass = "http://unix:${unixPath}:/auth/";
+              };
+              "/static/" = {
+                alias = "${cfg.settings.INVENTREE_STATIC_ROOT}/";
+                extraConfig = ''
+                  autoindex on;
+
+                  # Caching settings
+                  expires 30d;
+                  add_header Pragma public;
+                  add_header Cache-Control "public";
+                '';
+              };
+              "/media/" = {
+                alias = "${cfg.settings.INVENTREE_MEDIA_ROOT}/";
+                extraConfig = ''
+                  auth_request /auth;
+                  add_header Content-disposition "attachment";
+                '';
+              };
+            };
+        };
+
+        systemd.services.inventree-setup = {
+          description = "Inventree setup";
+          wantedBy = [ "inventree.target" ];
+          partOf = [ "inventree.target" ];
+          after = lib.optional mysqlLocal "mysql.service" ++ lib.optional pgsqlLocal "postgresql.target";
+          requires = lib.optional mysqlLocal "mysql.service" ++ lib.optional pgsqlLocal "postgresql.target";
+          before = [
+            "inventree-server.service"
+            "inventree-qcluster.service"
+          ];
+          serviceConfig = {
+            Type = "oneshot";
+            User = cfg.user;
+            Group = cfg.group;
+            RemainAfterExit = true;
+            PrivateTmp = true;
+          }
+          // lib.optionalAttrs (cfg.database.passwordFile != null) {
+            LoadCredential = "db_password:${cfg.database.passwordFile}";
+          };
+          environment = cfg.settings;
+          script = ''
+            set -euo pipefail
+            umask u=rwx,g=,o=
+
+            ${
+              lib.optionalString (cfg.database.passwordFile != null) ''
+                INVENTREE_DB_PASSWORD=$(<"$CREDENTIALS_DIRECTORY/db_password")
+              ''
+            } \
+            exec ${pkg}/bin/inventree migrate
+          '';
+        };
+
+        systemd.services.inventree-server = {
+          description = "Inventree Gunicorn service";
+          requiredBy = [ "inventree.target" ];
+          partOf = [ "inventree.target" ];
+          environment = cfg.settings;
+          serviceConfig = {
+            User = cfg.user;
+            Group = cfg.group;
+            StateDirectory = "inventree";
+            PrivateTmp = true;
+          }
+          // lib.optionalAttrs (cfg.database.passwordFile != null) {
+            LoadCredential = "db_password:${cfg.database.passwordFile}";
+          };
+          script = ''
+            ${
+              lib.optionalString (cfg.database.passwordFile != null) ''
+                INVENTREE_DB_PASSWORD=$(<"$CREDENTIALS_DIRECTORY/db_password")
+              ''
+            } \
+            exec ${pkg}/bin/gunicorn InvenTree.wsgi
+          '';
+        };
+
+        systemd.sockets.inventree-server = {
+          wantedBy = [ "sockets.target" ];
+          partOf = [ "inventree.target" ];
+          socketConfig.ListenStream = "/run/inventree/gunicorn.socket";
+        };
+
+        systemd.services.inventree-qcluster = {
+          description = "InvenTree qcluster server";
+          requiredBy = [ "inventree.target" ];
+          wantedBy = [ "inventree.target" ];
+          partOf = [ "inventree.target" ];
+          environment = cfg.settings;
+          serviceConfig = {
+            User = cfg.user;
+            Group = cfg.group;
+            StateDirectory = "inventree";
+            PrivateTmp = true;
+          }
+          // lib.optionalAttrs (cfg.database.passwordFile != null) {
+            LoadCredential = "db_password:${cfg.database.passwordFile}";
+          };
+          script = ''
+            ${
+              lib.optionalString (cfg.database.passwordFile != null) ''
+                INVENTREE_DB_PASSWORD=$(<"$CREDENTIALS_DIRECTORY/db_password")
+              ''
+            } \
+            exec ${pkg}/bin/inventree qcluster
+          '';
+        };
+
+        systemd.targets.inventree = {
+          description = "Target for all InvenTree services";
+          wantedBy = [ "multi-user.target" ];
+          wants = [ "network-online.target" ];
+          after = [ "network-online.target" ];
+        };
+
+        users = lib.optionalAttrs (cfg.user == cfg.user) {
+          users.${cfg.user} = {
+            group = cfg.group;
+            isSystemUser = true;
+            home = cfg.dataDir;
+          };
+          groups.${cfg.group}.members = [ cfg.user ];
+        };
+      }
+    ]
+  );
+}
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -800,6 +800,7 @@ in
  installer = handleTest ./installer.nix { systemdStage1 = false; };
  installer-systemd-stage-1 = handleTest ./installer.nix { systemdStage1 = true; };
  intune = runTest ./intune.nix;
+  inventree = runTest ./inventree.nix;
  invidious = runTest ./invidious.nix;
  invoiceplane = runTest ./invoiceplane.nix;
  iodine = runTest ./iodine.nix;
@ -1486,6 +1487,7 @@ in
  sane = runTest ./sane.nix;
  sanoid = runTest ./sanoid.nix;
  saunafs = runTest ./saunafs.nix;
+  scanservjs = runTest ./scanservjs.nix;
  scaphandre = runTest ./scaphandre.nix;
  schleuder = runTest ./schleuder.nix;
  scion-freestanding-deployment = runTest ./scion/freestanding-deployment;
--- a/nixos/tests/inventree.nix
+++ b/nixos/tests/inventree.nix
@ -0,0 +1,33 @@
+{ lib, ... }:
+{
+  name = "inventree";
+  meta.maintainers = with lib.maintainers; [
+    kurogeek
+  ];
+
+  nodes = {
+    psqlTest = {
+      services.inventree = {
+        enable = true;
+      };
+    };
+    mysqlTest = {
+      services.inventree = {
+        enable = true;
+        database.dbtype = "mysql";
+      };
+    };
+  };
+  testScript = ''
+    start_all()
+    psqlTest.wait_for_unit("inventree.target")
+    psqlTest.wait_for_unit("inventree-server.service")
+    psqlTest.wait_for_open_unix_socket("/run/inventree/gunicorn.socket")
+    psqlTest.wait_until_succeeds("curl -sf http://localhost/web")
+
+    mysqlTest.wait_for_unit("inventree.target")
+    mysqlTest.wait_for_unit("inventree-server.service")
+    mysqlTest.wait_for_open_unix_socket("/run/inventree/gunicorn.socket")
+    mysqlTest.wait_until_succeeds("curl -sf http://localhost/web")
+  '';
+}
--- a/nixos/tests/scanservjs.nix
+++ b/nixos/tests/scanservjs.nix
@ -0,0 +1,23 @@
+let
+  port = 1234;
+in
+{
+  name = "scanservjs";
+
+  nodes.machine =
+    { ... }:
+    {
+      services.scanservjs = {
+        enable = true;
+        settings.host = "0.0.0.0";
+        settings.port = port;
+      };
+    };
+
+  testScript = ''
+    machine.wait_for_unit("scanservjs.service")
+    machine.wait_until_succeeds(
+        "curl --silent --fail --show-error --location http://localhost:${toString port}"
+    )
+  '';
+}
--- a/pkgs/by-name/ad/adguardhome/package.nix
+++ b/pkgs/by-name/ad/adguardhome/package.nix
@ -9,15 +9,15 @@

 buildGoModule (finalAttrs: {
  pname = "adguardhome";
-  version = "0.107.76";
+  version = "0.107.77";
  src = fetchFromGitHub {
    owner = "AdguardTeam";
    repo = "AdGuardHome";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-CF1Ieu7oCnzvXwoHzX5126gQGcgXL+giMtUciKBZ2ZU=";
+    hash = "sha256-CwM8Zi5FXNwb+5gdESoP31Ja1O6PrnOgFfJaT8Yc890=";
  };

-  vendorHash = "sha256-tHabP5I7PZtDkVucF95StRyXGEsfbuc6Z3AhQZ/g2f8=";
+  vendorHash = "sha256-D91mHBG78LOG1O5oVlaA3T8HWIISPeKMB06VpWuxxqo=";

  dashboard = buildNpmPackage {
    inherit (finalAttrs) src version;
--- a/pkgs/by-name/ca/calibre/package.nix
+++ b/pkgs/by-name/ca/calibre/package.nix
@ -40,16 +40,16 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "calibre";
-  version = "9.8.0";
+  version = "9.9.0";

  src = fetchurl {
    url = "https://download.calibre-ebook.com/${finalAttrs.version}/calibre-${finalAttrs.version}.tar.xz";
-    hash = "sha256-3dkWokb8gh4JPbrBsJ9dGy/IS1PfNrAU775qxo8CaO8=";
+    hash = "sha256-ozwoRlJThVLiFmaR0fXdfxLDTEF4935rQGLZ+MzwXLk=";
  };

  patches =
    let
-      debian-source = "ds+_0.10.5-1";
+      debian-source = "ds+_0.10.6-1";
      debian-tag = "${finalAttrs.version}+${debian-source}";
    in
    [
--- a/pkgs/by-name/cr/croaring/package.nix
+++ b/pkgs/by-name/cr/croaring/package.nix
@ -8,13 +8,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "croaring";
-  version = "4.6.1";
+  version = "4.7.0";

  src = fetchFromGitHub {
    owner = "RoaringBitmap";
    repo = "CRoaring";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-wks7kkF0va7RUJXY74ku/yWTSsHQKlFczfhAHyuNudM=";
+    hash = "sha256-YXEEiWbbP6G7x/rQiihAq20OEMxJNSgky+JTEaKlNDU=";
  };

  # roaring.pc.in cannot handle absolute CMAKE_INSTALL_*DIRs, nor
@ -28,27 +28,6 @@ stdenv.mkDerivation (finalAttrs: {

  doCheck = true;

-  postPatch = ''
-    # Fixes the build of dependent projects by updating the supported
-    # CMake version.
-    # Issue: https://github.com/RoaringBitmap/CRoaring/issues/793
-    # PR: https://github.com/RoaringBitmap/CRoaring/pull/794
-    substituteInPlace CMakeLists.txt \
-      --replace-fail '2.8...3.15' '3.15'
-  '';
-
-  preConfigure = ''
-    mkdir -p dependencies/.cache
-    ln -s ${
-      fetchFromGitHub {
-        owner = "clibs";
-        repo = "cmocka";
-        rev = "f5e2cd77c88d9f792562888d2b70c5a396bfbf7a";
-        hash = "sha256-Oq0nFsZhl8IF7kQN/LgUq8VBy+P7gO98ep/siy5A7Js=";
-      }
-    } dependencies/.cache/cmocka
-  '';
-
  cmakeFlags = [ (lib.cmakeBool "ROARING_USE_CPM" false) ];

  meta = {
--- a/pkgs/by-name/de/deezer-desktop/package.nix
+++ b/pkgs/by-name/de/deezer-desktop/package.nix
@ -8,15 +8,15 @@
 }:

 let
-  version = "7.1.220";
+  version = "7.1.230";
  srcs = {
    x86_64-linux = fetchurl {
      url = "https://github.com/aunetx/deezer-linux/releases/download/v${version}/deezer-desktop-${version}-x64.tar.xz";
-      hash = "sha256-q4j4S88c7xsC+Ax7XY1EVbqRRJXH+JzLrZRRB6rfQOE=";
+      hash = "sha256-OP5ceyGQQFRgW1GZPElxdjkYikNVMkvomkXCr9dD67Y=";
    };
    aarch64-linux = fetchurl {
      url = "https://github.com/aunetx/deezer-linux/releases/download/v${version}/deezer-desktop-${version}-arm64.tar.xz";
-      hash = "sha256-g94qn+EHr8Dwn21L7z3W7Z5+LJoVSQcAEXHpJiAdbJg=";
+      hash = "sha256-IiUZgMHdhkU0B5uDLARHpcCUxlsZ4+rj5sAKJXZpcBw=";
    };
  };

--- a/pkgs/by-name/et/etcd_3_4/package.nix
+++ b/pkgs/by-name/et/etcd_3_4/package.nix
@ -7,17 +7,17 @@

 buildGoModule (finalAttrs: {
  pname = "etcd";
-  version = "3.4.44";
+  version = "3.4.45";

  src = fetchFromGitHub {
    owner = "etcd-io";
    repo = "etcd";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-56V9cAlFiCdDm3X8lBJmjwj1HVRNihrCzIV0r0XEMHk=";
+    hash = "sha256-GvhejN7+woYK7UBNguzEaO6rqAbT7Vbwl5nFmI/F6Sc=";
  };

  proxyVendor = true;
-  vendorHash = "sha256-DqKVZ4Z2RMRwi4Z/6Rh3SE6NSyuHePSYrIM7sPyPC74=";
+  vendorHash = "sha256-0xIK71sAwMzzSaN2lFKKdGtDKWYtL25x5GDoO6bO0wI=";

  preBuild = ''
    go mod tidy
--- a/pkgs/by-name/et/etcd_3_5/package.nix
+++ b/pkgs/by-name/et/etcd_3_5/package.nix
@ -7,11 +7,11 @@
 }:

 let
-  version = "3.5.30";
-  etcdSrcHash = "sha256-1FJOB9O1AP5zhQO+UtXeZ1zUUSLlNyrG8BKDNHn49aE=";
-  etcdServerVendorHash = "sha256-a8qk0KajYeAhqSHx87qjU1mWqd2z8JJmvL8VQiqD/eM=";
-  etcdUtlVendorHash = "sha256-zem39kXZivNYWhgGu7oC1/UuLcMfDLhd1Jgdi0EwKNM=";
-  etcdCtlVendorHash = "sha256-E6V6L6+eikcgCqE9+wJIdXnBCIuY+nq832TshYEvCL8=";
+  version = "3.5.31";
+  etcdSrcHash = "sha256-X3b1TBimNYo03fW0c5NeiD4uALMqtOQbJwPot11FCk8=";
+  etcdServerVendorHash = "sha256-1/XJGpyYuTsb+1hReksX5VyD+6xbKaiLA8520cDKc/4=";
+  etcdUtlVendorHash = "sha256-dUXAoIcOSlEbiSmy1M+oPaHt089gOttQwrB9ZhYc7v0=";
+  etcdCtlVendorHash = "sha256-l1j00Mzv1z021rfBbFZrIce2pifQyRkST0bkZhVoST0=";

  src = fetchFromGitHub {
    owner = "etcd-io";
--- a/pkgs/by-name/et/etcd_3_6/package.nix
+++ b/pkgs/by-name/et/etcd_3_6/package.nix
@ -9,11 +9,11 @@
 }:

 let
-  version = "3.6.11";
-  etcdSrcHash = "sha256-xn6PJin0xZXR/xoWhCxdEq7uVXSBqv+BapwbP1Pdv84=";
-  etcdCtlVendorHash = "sha256-+W8spn3T1vej4QD52ZxGXqTplwQBVG6Nuxf2P/u7nkQ=";
-  etcdUtlVendorHash = "sha256-s9/QFtbtRx7Jgd/S9pRx8/JMQWmi92Jz/H8YcRS9huk=";
-  etcdServerVendorHash = "sha256-nUangVgI4/62O7jhq2vNqrcJB/PtpZp+40X1W91+HOY=";
+  version = "3.6.12";
+  etcdSrcHash = "sha256-oUq/yRwSgJ2xZ6yoiEBYSSRH5NvHITXjMFuR7QZc4HU=";
+  etcdCtlVendorHash = "sha256-0ZlJiXFS7QxJ+dfstJf+ogLPL0kxrE/4ZTsKb0OOCqA=";
+  etcdUtlVendorHash = "sha256-o7TWg7RgeWZa92beumSGCpxvLcFMzqC1vgcKfi5K4dI=";
+  etcdServerVendorHash = "sha256-UzToh6FaAVyxzZdDoukrHez1W9+tifFGEM16UCcmm5U=";

  src = fetchFromGitHub {
    owner = "etcd-io";
--- a/pkgs/by-name/gl/gleam/package.nix
+++ b/pkgs/by-name/gl/gleam/package.nix
@ -2,10 +2,10 @@
  lib,
  stdenv,
  rustPlatform,
+
  fetchFromGitHub,
  git,
  pkg-config,
-  openssl,
  erlang,
  nodejs,
  bun,
@ -33,8 +33,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
    erlang
  ];

-  buildInputs = [ openssl ];
-
  nativeCheckInputs = [
    # used by several tests
    git
@ -48,8 +46,9 @@ rustPlatform.buildRustPackage (finalAttrs: {
  ];

  checkFlags = [
-    # Makes a network request
+    # These tests make network requests
    "--skip=tests::echo::echo_dict"
+    "--skip=tests::escript_success_with_dependency"
  ]
  ++ lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64) [
    # Snapshot tests fail because a warning is shown on stdout
--- a/pkgs/by-name/go/gossip/package.nix
+++ b/pkgs/by-name/go/gossip/package.nix
@ -38,7 +38,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
  cargoHash = "sha256-rE7SErOhl2fcmvLairq+mvdnbDIk1aPo3eYqwRx5kkA=";

  postPatch = ''
-    substituteInPlace $cargoDepsCopy/source-registry-0/sdl2-sys-0.37.0/SDL/CMakeLists.txt \
+    substituteInPlace $cargoDepsCopy/*/sdl2-sys-0.37.0/SDL/CMakeLists.txt \
      --replace-fail "cmake_minimum_required(VERSION 3.0.0)" "cmake_minimum_required(VERSION 3.0.0...3.5)" \
      --replace-fail "cmake_minimum_required(VERSION 3.4)" "cmake_minimum_required(VERSION 3.4...3.5)"
  '';
--- a/pkgs/by-name/ha/haveged/package.nix
+++ b/pkgs/by-name/ha/haveged/package.nix
@ -6,13 +6,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "haveged";
-  version = "1.9.20";
+  version = "1.9.21";

  src = fetchFromGitHub {
    owner = "jirka-h";
    repo = "haveged";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-7ymilQktEsCUTujGC2KTXN5LI2KQRbAd/4tEMxOZxpo=";
+    hash = "sha256-ldJsB09xgACCI9ne10gxr2T2f20aVPXJXea32hoCYP8=";
  };

  strictDeps = true;
--- a/pkgs/by-name/le/leanify/package.nix
+++ b/pkgs/by-name/le/leanify/package.nix
@ -8,13 +8,13 @@

 stdenv.mkDerivation {
  pname = "leanify";
-  version = "0-unstable-2025-12-12";
+  version = "0.4.3-unstable-2026-06-05";

  src = fetchFromGitHub {
    owner = "JayXon";
    repo = "Leanify";
-    rev = "d2ba1671056e022623e8445f5700670bc05204bf";
-    hash = "sha256-MXQnJyA6z01lodes6CINV7mzbRr6GnZaMAsjloGJzeg=";
+    rev = "dc557c4027fc8a7479c4a71506c75c98ea8829f9";
+    hash = "sha256-jyz0F0mY4z0lFA5a1ibJKHYKb35MvuVhFct2Him/my8=";
  };

  postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
--- a/pkgs/by-name/ma/matrix-synapse-unwrapped/package.nix
+++ b/pkgs/by-name/ma/matrix-synapse-unwrapped/package.nix
@ -14,14 +14,14 @@

 python3Packages.buildPythonApplication rec {
  pname = "matrix-synapse";
-  version = "1.153.0";
+  version = "1.154.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "element-hq";
    repo = "synapse";
    rev = "v${version}";
-    hash = "sha256-2/KzRPUMfOOmI8j8WZsVU2ubNxidTb+FW0MZF+ktSSQ=";
+    hash = "sha256-4US6PPJAI0UUOmy12thjXKX3IRUCH9w/zkRD3ivQ9BE=";
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
--- a/pkgs/by-name/ne/nezha/package.nix
+++ b/pkgs/by-name/ne/nezha/package.nix
@ -48,13 +48,13 @@ let
 in
 buildGoModule (finalAttrs: {
  pname = "nezha";
-  version = "2.0.14";
+  version = "2.2.2";

  src = fetchFromGitHub {
    owner = "nezhahq";
    repo = "nezha";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-dSFwU1p2lAI8CaNoQgdX/pkumIumZpdLgnn1XCkoeKU=";
+    hash = "sha256-40GirWaa03sX5UNL0ZI8qcFqYV2ZuRniWofKluKeW+0=";
  };

  proxyVendor = true;
@ -94,7 +94,7 @@ buildGoModule (finalAttrs: {
    GOROOT=''${GOROOT-$(go env GOROOT)} swag init --pd -d cmd/dashboard -g main.go -o cmd/dashboard/docs
  '';

-  vendorHash = "sha256-y7XvvpLrmoaU1gLtaN38T9rsS3Rpi313XAKaVcia6Q4=";
+  vendorHash = "sha256-rYzkaJqk5r31Uagn1FRFDeICUeK392o1fyP6IBk9zgk=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/oc/oculante/libaom-sys-0.17.2+libaom.3.11.0-cmake-nasm-fix.patch
+++ b/pkgs/by-name/oc/oculante/libaom-sys-0.17.2+libaom.3.11.0-cmake-nasm-fix.patch
@ -1,5 +1,5 @@
--- a/libaom-sys-0.17.2+libaom.3.11.0/vendor/build/cmake/aom_optimization.cmake
-+++ b/libaom-sys-0.17.2+libaom.3.11.0/vendor/build/cmake/aom_optimization.cmake
+--- a/vendor/build/cmake/aom_optimization.cmake
+++ b/vendor/build/cmake/aom_optimization.cmake
@@ -212,7 +212,7 @@ endfunction()
 # Currently checks only for presence of required object formats and support for
 # the -Ox argument (multipass optimization).
--- a/pkgs/by-name/oc/oculante/package.nix
+++ b/pkgs/by-name/oc/oculante/package.nix
@ -67,17 +67,11 @@ rustPlatform.buildRustPackage (finalAttrs: {
    "--skip=thumbnails::test_thumbs" # broken as of v0.9.2
  ];

-  patches = [
-    # The below patch is needed to fix this build, until the upstream dependency (libavif-rs) fixes the problem.
-    # The explicit `patchFlags` can also be removed when this patch becomes obsolete.
-    # <https://github.com/njaard/libavif-rs/issues/122>
-    ./libaom-sys-0.17.2+libaom.3.11.0-cmake-nasm-fix.patch
-  ];
-
-  patchFlags = [
-    "-p1"
-    "--directory=../${finalAttrs.pname}-${finalAttrs.version}-vendor/source-registry-0"
-  ];
+  # The below patch is needed to fix this build, until the upstream dependency (libavif-rs) fixes the problem.
+  # <https://github.com/njaard/libavif-rs/issues/122>
+  postPatch = ''
+    patch -p1 -d "$cargoDepsCopy"/*/libaom-sys-0.17.2+libaom.3.11.0 -i ${./libaom-sys-0.17.2+libaom.3.11.0-cmake-nasm-fix.patch}
+  '';

  postInstall = ''
    install -Dm444 $src/res/icons/icon.png $out/share/icons/hicolor/128x128/apps/oculante.png
--- a/pkgs/by-name/ol/olivetin/3k.nix
+++ b/pkgs/by-name/ol/olivetin/3k.nix
@ -16,18 +16,18 @@

 buildGoModule (finalAttrs: {
  pname = "olivetin";
-  version = "3000.13.0";
+  version = "3000.14.0";

  src = fetchFromGitHub {
    owner = "OliveTin";
    repo = "OliveTin";
    tag = finalAttrs.version;
-    hash = "sha256-WqqUOl42o8C6eAv0lZ44bolgt9jdZwOLmbzA174Nk8s=";
+    hash = "sha256-bMc+fmyaRNVLVzGSAUq+TgEdq1VO3Guvw9RnV+YdrRI=";
  };

  modRoot = "service";

-  vendorHash = "sha256-8oWvOeRgmbknd3iOMngAK914ut+230cr7pkw6hF/9Hc=";
+  vendorHash = "sha256-MxiINWFSpbkBDOBcusr2VViGgnlEoqOmj2gZaiGGjj0=";

  subPackages = [ "." ];

@ -75,14 +75,14 @@ buildGoModule (finalAttrs: {
    '';

    outputHashMode = "recursive";
-    outputHash = "sha256-SaGHxawFw55zI37psqI9kdaR8DLnx4iV2XZdomr28b8=";
+    outputHash = "sha256-EilPfKCT8byqBl2Ls5f8VrBcT8H+u8jqUQTX6brWhUE=";
  };

  webui = buildNpmPackage {
    pname = "olivetin-webui";
    inherit (finalAttrs) version src;

-    npmDepsHash = "sha256-Z9ovQRqKFWqp52xDUHvrWMHO9qDWJf9CqoXwlcfnnTU=";
+    npmDepsHash = "sha256-+XWucYyYHRC1usQ95HjlFVct2h8njuxfAKDFKNwwJLI=";

    sourceRoot = "${finalAttrs.src.name}/frontend";

--- a/pkgs/by-name/pe/peertube/package.nix
+++ b/pkgs/by-name/pe/peertube/package.nix
@ -21,13 +21,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "peertube";
-  version = "8.1.5";
+  version = "8.1.8";

  src = fetchFromGitHub {
    owner = "Chocobozzz";
    repo = "PeerTube";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-vLKjTn8tdHb/DUHj/w3ovXmRNzD8CMSKCaPleW+i7Tc=";
+    hash = "sha256-Ei7MgEyHDJyLXnjI8mT7S7pLno+pTmFWZHc6oEZaTcM=";
  };

  outputs = [
@ -40,7 +40,7 @@ stdenv.mkDerivation (finalAttrs: {
    inherit (finalAttrs) pname version src;
    pnpm = pnpm_10;
    fetcherVersion = 3;
-    hash = "sha256-gvjk4OmKR6W/nllUCSaiX/lVXJSac9r04xr7fNiBftI=";
+    hash = "sha256-fQ0FyBPZ3v3lCSoWYz1ccbOSrfgnzwQvOyE7Dp3ZGRY=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/qq/qq/package.nix
+++ b/pkgs/by-name/qq/qq/package.nix
@ -21,7 +21,6 @@
  systemd,
  stdenv,
  undmg,
-  vips,
  at-spi2-core,
  autoPatchelfHook,
  writeShellScript,
@ -112,7 +111,6 @@ else
      libkrb5
      libgbm
      nss
-      vips
      libxdamage
    ];

@ -201,9 +199,6 @@ else
            --run '${versionConfigScript} || true'
          ''}

-        # Remove bundled libraries
-        rm -r $out/opt/QQ/resources/app/sharp-lib
-
        # https://aur.archlinux.org/cgit/aur.git/commit/?h=linuxqq&id=f7644776ee62fa20e5eb30d0b1ba832513c77793
        rm -r $out/opt/QQ/resources/app/libssh2.so.1

--- a/pkgs/by-name/qq/qq/sources.nix
+++ b/pkgs/by-name/qq/qq/sources.nix
@ -1,12 +1,12 @@
 # Generated by ./update.sh - do not update manually!
-# Last updated: 2026-04-15
+# Last updated: 2026-06-03
 { fetchurl }:
 let
  any-darwin = {
-    version = "6.9.93-2026-04-01";
+    version = "6.9.96-2026-05-28";
    src = fetchurl {
-      url = "https://dldir1v6.qq.com/qqfile/qq/QQNT/Mac/QQ_6.9.93_260401_01.dmg";
-      hash = "sha256-xCyvVAxYKma92SkL1fLraXKeDcKlRLLybtwKPWUKlis=";
+      url = "https://qqdl.gtimg.cn/qqfile/QQNT/9.9.31/release/045f4292/QQ_6.9.96_260528_01.dmg";
+      hash = "sha256-cMgWMXfKtL4ZLBrjGhROpCMNAHtFIdnZRfyi9XtsIjI=";
    };
  };
 in
@ -14,17 +14,17 @@ in
  aarch64-darwin = any-darwin;
  x86_64-darwin = any-darwin;
  aarch64-linux = {
-    version = "3.2.27-2026-04-01";
+    version = "3.2.29-2026-05-28";
    src = fetchurl {
-      url = "https://dldir1v6.qq.com/qqfile/qq/QQNT/Linux/QQ_3.2.27_260401_arm64_01.deb";
-      hash = "sha256-sGLYPAdZmcxGy+3Lo7MEeEXysqP24XTWaQY/iM9bRLU=";
+      url = "https://qqdl.gtimg.cn/qqfile/QQNT/9.9.31/release/00e6a3e7/QQ_3.2.29_260528_arm64_01.deb";
+      hash = "sha256-W82MzaQB+/oYIafDx1j4SiU8MXVo8LnC10QmokdJ6aY=";
    };
  };
  x86_64-linux = {
-    version = "3.2.27-2026-04-01";
+    version = "3.2.29-2026-05-28";
    src = fetchurl {
-      url = "https://dldir1v6.qq.com/qqfile/qq/QQNT/Linux/QQ_3.2.27_260401_amd64_01.deb";
-      hash = "sha256-iI5gc0VSZAzab2B+w1I/6idSD/zx45Ou+uyqSJzCC+c=";
+      url = "https://qqdl.gtimg.cn/qqfile/QQNT/9.9.31/release/00e6a3e7/QQ_3.2.29_260528_amd64_01.deb";
+      hash = "sha256-HjgoB5ZzyUmUvA9HgNXYUoZHY5kgZZhi1J0cLyoZjiU=";
    };
  };
 }
--- a/pkgs/by-name/ra/rapidraw/package.nix
+++ b/pkgs/by-name/ra/rapidraw/package.nix
@ -42,20 +42,20 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "rapidraw";
-  version = "1.5.5";
+  version = "1.5.6";

  src = fetchFromGitHub {
    owner = "CyberTimon";
    repo = "RapidRAW";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-CnH8EuHzHxuXbnOry2gMU/tMqpE8++ztyNPk3HHdZqE=";
+    hash = "sha256-pfOdq2Q7GLGbzcgFkrRiczMWnS5TImbayYE1VWenYuo=";
  };

-  cargoHash = "sha256-c2MK1DyonfeZKfZAVWfwVh/In5SqKq7nnFrlz2686SM=";
+  cargoHash = "sha256-liWOY+Jq8Yqo0QsntKjq2ntMAacfFyHCm6yhQM+KwRA=";

  npmDeps = fetchNpmDeps {
    inherit (finalAttrs) src;
-    hash = "sha256-1A6b63FjNvkAbu62dRXfMjTL1y2wr2gEsZkLqYvTk0w=";
+    hash = "sha256-JtkzeCt21KIEshvoCHWo1QoxUgvVJN1loJrUHgvV4qE=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/sc/scanservjs/decouple-from-source-tree.patch
+++ b/pkgs/by-name/sc/scanservjs/decouple-from-source-tree.patch
@ -1,64 +0,0 @@
-diff --git a/packages/server/src/api.js b/packages/server/src/api.js
-index bd43842..71ce7c9 100644
--- a/packages/server/src/api.js
-+++ b/packages/server/src/api.js
-@@ -105,7 +105,7 @@ module.exports = new class Api {
-     }
- 
-     // If not then it's possible the default image is not quite the correct aspect ratio
-    const buffer = FileInfo.create(`${config.previewDirectory}/default.jpg`).toBuffer();
-+    const buffer = FileInfo.create('NIX_OUT_PLACEHOLDER/lib/node_modules/scanservjs-api/data/preview/default.jpg').toBuffer();
- 
-     try {
-       // We need to know the correct aspect ratio from the device
-diff --git a/packages/server/src/application.js b/packages/server/src/application.js
-index 2771036..0c2a4c0 100644
--- a/packages/server/src/application.js
-+++ b/packages/server/src/application.js
-@@ -26,7 +26,7 @@ module.exports = new class Application {
- 
-   userOptions() {
-     if (this._userOptions === null) {
-      this._userOptions = new UserOptions('../../config/config.local.js');
-+      this._userOptions = new UserOptions(process.env.NIX_SCANSERVJS_CONFIG_PATH);
-     }
-     return this._userOptions;
-   }
-diff --git a/packages/server/src/classes/user-options.js b/packages/server/src/classes/user-options.js
-index f129e3c..c71e754 100644
--- a/packages/server/src/classes/user-options.js
-+++ b/packages/server/src/classes/user-options.js
-@@ -4,7 +4,7 @@ const path = require('path');
- module.exports = class UserOptions {
-   constructor(localConfigPath) {
-     if (localConfigPath) {
-      const localPath = path.join(__dirname, localConfigPath);
-+      const localPath = localConfigPath;
-       if (fs.existsSync(localPath)) {
-         this.local = require(localPath);
-       }
-diff --git a/packages/server/src/configure.js b/packages/server/src/configure.js
-index c9e5ed8..484949c 100644
--- a/packages/server/src/configure.js
-+++ b/packages/server/src/configure.js
-@@ -71,6 +71,7 @@ function initialize(rootPath) {
- 
-   try {
-     fs.mkdirSync(config.outputDirectory, { recursive: true });
-+    fs.mkdirSync(config.previewDirectory, { recursive: true });
-     fs.mkdirSync(config.tempDirectory, { recursive: true });
-   } catch (exception) {
-     log.warn(`Error ensuring output and temp directories exist: ${exception}`);
-diff --git a/packages/server/src/server.js b/packages/server/src/server.js
-index e1a9fb0..3d58d37 100644
--- a/packages/server/src/server.js
-+++ b/packages/server/src/server.js
-@@ -5,7 +5,7 @@ const configure = require('./configure');
- const config = application.config();
- const app = express();
- 
-app.use(express.static('client'));
-+app.use(express.static('@client@'));
- 
- configure(app);
- 
--- a/pkgs/by-name/sc/scanservjs/nix-compatibility.patch
+++ b/pkgs/by-name/sc/scanservjs/nix-compatibility.patch
@ -0,0 +1,47 @@
+diff --git a/app-server/src/application.js b/app-server/src/application.js
+index a2c065f..2d594bf 100644
+--- a/app-server/src/application.js
+++ b/app-server/src/application.js
+@@ -26,7 +26,7 @@ module.exports = new class Application {
+ 
+   userOptions() {
+     if (this._userOptions === null) {
+-      this._userOptions = new UserOptions('../../config/config.local.js');
+      this._userOptions = new UserOptions(process.env.NIX_SCANSERVJS_CONFIG_PATH);
+     }
+     return this._userOptions;
+   }
+diff --git a/app-server/src/classes/user-options.js b/app-server/src/classes/user-options.js
+index f129e3c..c71e754 100644
+--- a/app-server/src/classes/user-options.js
+++ b/app-server/src/classes/user-options.js
+@@ -4,7 +4,7 @@ const path = require('path');
+ module.exports = class UserOptions {
+   constructor(localConfigPath) {
+     if (localConfigPath) {
+-      const localPath = path.join(__dirname, localConfigPath);
+      const localPath = localConfigPath;
+       if (fs.existsSync(localPath)) {
+         this.local = require(localPath);
+       }
+diff --git a/app-server/src/express-configurer.js b/app-server/src/express-configurer.js
+index 945dae2..1b456cc 100644
+--- a/app-server/src/express-configurer.js
+++ b/app-server/src/express-configurer.js
+@@ -166,6 +166,7 @@ module.exports = class ExpressConfigurer {
+ 
+     try {
+       fs.mkdirSync(config.outputDirectory, { recursive: true });
+      fs.mkdirSync(config.previewDirectory, { recursive: true });
+       fs.mkdirSync(config.thumbnailDirectory, { recursive: true });
+       fs.mkdirSync(config.tempDirectory, { recursive: true });
+     } catch (exception) {
+@@ -220,7 +221,7 @@ module.exports = class ExpressConfigurer {
+    * @returns {ExpressConfigurer}
+    */
+   statics() {
+-    this.app.use(express.static('client'));
+    this.app.use(express.static('@client@'));
+     return this;
+   }
+ 
--- a/pkgs/by-name/sc/scanservjs/package.nix
+++ b/pkgs/by-name/sc/scanservjs/package.nix
@ -3,6 +3,7 @@
  fetchFromGitHub,
  buildNpmPackage,
  nodejs,
+  nixosTests,
 }:

 buildNpmPackage (finalAttrs: {
@ -18,13 +19,42 @@ buildNpmPackage (finalAttrs: {

  npmDepsHash = "sha256-HIWT09G8gqSFt9CIjsjJaDRnj2GO0G6JOGeI0p4/1vw=";

-  postInstall = ''
-    mkdir $out/bin
+  patches = [
+    ./nix-compatibility.patch
+  ];
+
+  postBuild = ''
+    # Install runtime dependencies
+    npm install \
+      --prefix ./dist \
+      --offline \
+      --production \
+      --ignore-scripts
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    rm -rf $out/lib
+
+    mkdir -p $out/lib
+    cp -r dist/* $out/lib
+
+    substituteInPlace "$out/lib/server/express-configurer.js" \
+      --replace-fail "@client@" "$out/lib/client"
+
+    mkdir -p $out/bin
    makeWrapper ${lib.getExe nodejs} $out/bin/scanservjs \
      --set NODE_ENV production \
-      --add-flags "'$out/lib/node_modules/scanservjs/app-server/src/server.js'"
+      --add-flags "$out/lib/server/server.js"
+
+    runHook postInstall
  '';

+  passthru = {
+    tests.smoke-test = nixosTests.scanservjs;
+  };
+
  meta = {
    description = "SANE scanner nodejs web ui";
    longDescription = "scanservjs is a simple web-based UI for SANE which allows you to share a scanner on a network without the need for drivers or complicated installation.";
--- a/pkgs/by-name/sp/spaceship-prompt/package.nix
+++ b/pkgs/by-name/sp/spaceship-prompt/package.nix
@ -6,13 +6,13 @@

 stdenvNoCC.mkDerivation rec {
  pname = "spaceship-prompt";
-  version = "4.22.1";
+  version = "4.22.3";

  src = fetchFromGitHub {
    owner = "denysdovhan";
    repo = "spaceship-prompt";
    rev = "v${version}";
-    sha256 = "sha256-shZf1IfSkHnaHnQ4idiDrmaJYXtViwGntpfEOBUDyBk=";
+    sha256 = "sha256-v2D8+EwOV5gzzawjgn99WJnYjI9N6bxqbHtTTfNWBNo=";
  };

  strictDeps = true;
--- a/pkgs/by-name/st/strongswan/package.nix
+++ b/pkgs/by-name/st/strongswan/package.nix
@ -122,13 +122,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "strongswan";
-  version = "6.0.6"; # Make sure to also update <nixpkgs/nixos/modules/services/networking/strongswan-swanctl/swanctl-params.nix> when upgrading!
+  version = "6.0.7"; # Make sure to also update <nixpkgs/nixos/modules/services/networking/strongswan-swanctl/swanctl-params.nix> when upgrading!

  src = fetchFromGitHub {
    owner = "strongswan";
    repo = "strongswan";
    tag = finalAttrs.version;
-    hash = "sha256-Ojb+aAb9Ame4E9qzKcP9HZ+1AmP4XuxZO89nKca9Vl8=";
+    hash = "sha256-OgLvCrAwFJA2t78pu+p+3DrsD53QizVotQqTiNoY1dk=";
  };

  patches = [
--- a/pkgs/by-name/su/sub-store-frontend/package.nix
+++ b/pkgs/by-name/su/sub-store-frontend/package.nix
@ -14,13 +14,13 @@ let
 in
 buildNpmPackage (finalAttrs: {
  pname = "sub-store-frontend";
-  version = "2.17.19";
+  version = "2.17.31";

  src = fetchFromGitHub {
    owner = "sub-store-org";
    repo = "Sub-Store-Front-End";
    tag = finalAttrs.version;
-    hash = "sha256-fhJy/bErS9DHjjX5R+6KjqDNYyPOQaYPr54CS1vd3zc=";
+    hash = "sha256-/L5qdjqXZ8MjEjOGT8e8vdS/F9uudkemboAVrYih0Zc=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/sy/sylkserver/package.nix
+++ b/pkgs/by-name/sy/sylkserver/package.nix
@ -3,41 +3,37 @@
  fetchFromGitHub,
  python3Packages,
  versionCheckHook,
-  fetchpatch2,
 }:

 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "sylkserver";
-  version = "6.5.0";
+  version = "6.6.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "AGProjects";
    repo = "sylkserver";
    tag = finalAttrs.version;
-    hash = "sha256-A15EJs35ZgXy9db3+XC0q5fTlemLJsA945nvIY50Pa4=";
+    hash = "sha256-FeoyQWM4dvO1FJ6q5uXczPCtX2Aocm+jIkAy88uvPFI=";
  };

-  patches = [
-    # should be removed with next release
-    (fetchpatch2 {
-      url = "https://github.com/AGProjects/sylkserver/commit/c0d943b4ff4401b2892b84d66e7cd27db7e6a927.patch";
-      hash = "sha256-U0a8mRbt8c4lUcN2xYDfvXTt/sWcvi7F3/Vw5sIQPrU=";
-    })
+  build-system = with python3Packages; [
+    setuptools
  ];

-  build-system = [ python3Packages.setuptools ];
-
  dependencies = with python3Packages; [
    autobahn
+    cassandra-driver
    cement
    dnspython
    klein
    lxml
+    lxml-html-clean
    msrplib
    python3-eventlib
    python3-gnutls
    python3-sipsimple
+    systemd-python
    wokkel
    xcaplib
  ];
@ -53,7 +49,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
    description = "SIP/XMPP/WebRTC Application Server";
    homepage = "https://sylkserver.com/";
    downloadPage = "https://github.com/AGProjects/sylkserver";
-    changelog = "https://github.com/AGProjects/sylkserver/releases/tag/${finalAttrs.version}";
+    changelog = "https://github.com/AGProjects/sylkserver/blob/${finalAttrs.src.rev}/debian/changelog";
    license = lib.licenses.gpl3Plus;
    teams = [ lib.teams.ngi ];
    mainProgram = "sylk-server";
--- a/pkgs/by-name/un/unityhub/package.nix
+++ b/pkgs/by-name/un/unityhub/package.nix
@ -35,6 +35,7 @@ stdenv.mkDerivation rec {
        # Unity Hub binary dependencies
        libxrandr
        xdg-utils
+        p7zip

        # GTK filepicker
        gsettings-desktop-schemas
--- a/pkgs/by-name/yo/youtrack/package.nix
+++ b/pkgs/by-name/yo/youtrack/package.nix
@ -10,15 +10,15 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "youtrack";
-  version = "2026.1.12458";
+  version = "2026.1.13570";

  src = dockerTools.exportImage {
    diskSize = 8192;
    fromImage = dockerTools.pullImage {
      imageName = "jetbrains/youtrack";
      arch = "amd64";
-      imageDigest = "sha256:64b9c6c0e409e9cb7e62558bbb2ca0208a85d1c40331b41430e290404b300e40";
-      hash = "sha256-7rlilHogqwxPXZlhAHv5Kk2+i8rMyGP6eZR1DdbhRDM=";
+      imageDigest = "sha256:2ea82348ed037f91f847dd99f196e632769dbd44a00d5659ee7a50cf9774149a";
+      hash = "sha256-+GVDh4ptBQggtZDWI56pEvkPonL9QG9126amtwZS0T8=";
    };
  };
  unpackPhase = ''
--- a/pkgs/desktops/pantheon/apps/elementary-screenshot/default.nix
+++ b/pkgs/desktops/pantheon/apps/elementary-screenshot/default.nix
@ -6,27 +6,24 @@
  ninja,
  pkg-config,
  vala,
-  wrapGAppsHook3,
+  wrapGAppsHook4,
  gdk-pixbuf,
  glib,
-  granite,
-  gtk3,
-  libhandy,
+  granite7,
+  gtk4,
+  libportal,
  nix-update-script,
 }:

 stdenv.mkDerivation rec {
  pname = "elementary-screenshot";
-  # nixpkgs-update: no auto update
-  # We disabled x-d-p-pantheon due to https://github.com/elementary/portals/issues/157
-  # so hold back this before the issue is fixed since later versions enforce using portals.
-  version = "8.0.0";
+  version = "8.0.4";

  src = fetchFromGitHub {
    owner = "elementary";
    repo = "screenshot";
    rev = version;
-    hash = "sha256-z7FP+OZYF/9YLXYCQF/ElihKjKHVfeHc38RHdPb2aIE=";
+    hash = "sha256-hVYzriIRvBDBdRRZRiXZwEazu9ZPhPaVY/pOfw95ZkU=";
  };

  nativeBuildInputs = [
@ -34,15 +31,15 @@ stdenv.mkDerivation rec {
    ninja
    pkg-config
    vala
-    wrapGAppsHook3
+    wrapGAppsHook4
  ];

  buildInputs = [
    gdk-pixbuf
    glib
-    granite
-    gtk3
-    libhandy
+    granite7
+    gtk4
+    libportal
  ];

  passthru = {
--- a/pkgs/development/python-modules/pypdf/default.nix
+++ b/pkgs/development/python-modules/pypdf/default.nix
@ -23,7 +23,7 @@

 buildPythonPackage rec {
  pname = "pypdf";
-  version = "6.10.2";
+  version = "6.12.2";
  pyproject = true;

  src = fetchFromGitHub {
@ -32,7 +32,7 @@ buildPythonPackage rec {
    tag = version;
    # fetch sample files used in tests
    fetchSubmodules = true;
-    hash = "sha256-f7U9kZrAnUHv0nBrcHI+Otd49jIJz0d1uWRHymWJnYo=";
+    hash = "sha256-rRvRAasPgE5nCChYJYB9olSE3RWmztYSJoAbmh+a3Q0=";
  };

  outputs = [
--- a/pkgs/development/rocq-modules/mathcomp-analysis/default.nix
+++ b/pkgs/development/rocq-modules/mathcomp-analysis/default.nix
@ -38,8 +38,8 @@ let
  packages = {
    "classical" = [ ];
    "reals" = [ "classical" ];
-    "experimental-reals" = [ "reals" ];
    "analysis" = [ "reals" ];
+    "experimental-reals" = [ "analysis" ];
    "reals-stdlib" = [ "reals" ];
    "analysis-stdlib" = [
      "analysis"
--- a/pkgs/development/tools/build-managers/rebar3/default.nix
+++ b/pkgs/development/tools/build-managers/rebar3/default.nix
@ -48,6 +48,13 @@ let
      for i in _checkouts/* ; do
          ln -s $(pwd)/$i $(pwd)/_build/default/lib/
      done
+    ''
+    # OTP 29 tests fail on warnings, fixed in https://github.com/erlang/rebar3/pull/2996
+    + lib.optionalString ((lib.versions.major erlang.version) == "29") ''
+      substituteInPlace rebar.config --replace-fail 'nowarn_deprecated_catch' 'nowarn_deprecated_catch,nowarn_export_var_subexpr'
+
+      substituteInPlace apps/rebar/test/rebar_xref_SUITE.erl \
+        --replace-fail 'xref_test, xref_ignore_test,' 'xref_test,'
    '';

    buildPhase = ''