Merge ee4a6d835b into haskell-updates

2026-07-06 17:13:24 -05:00 · 2026-05-23 00:48:26 +00:00 · 2026-05-23 00:48:26 +00:00 · ef80ea96c0
commit ef80ea96c0
parent 70b3bb6148 ee4a6d835b
240 changed files with 14820 additions and 1493 deletions
--- a/lib/trivial.nix
+++ b/lib/trivial.nix
@ -7,14 +7,16 @@ let
    functionArgs
    pathExists
    release
-    setFunctionArgs
    toBaseDigits
    version
    versionSuffix
    warn
    ;
  inherit (lib)
+    foldr
+    fromJSON
    isString
+    readFile
    ;
 in
 {
@ -789,7 +791,7 @@ in
    importJSON :: Path -> Any
    ```
  */
-  importJSON = path: builtins.fromJSON (builtins.readFile path);
+  importJSON = path: fromJSON (readFile path);

  /**
    Reads a TOML file.
@ -836,7 +838,7 @@ in
    importTOML :: Path -> Any
    ```
  */
-  importTOML = path: fromTOML (builtins.readFile path);
+  importTOML = path: fromTOML (readFile path);

  /**
    `warn` *`message`* *`value`*
@ -1046,7 +1048,7 @@ in

  info = msg: builtins.trace "INFO: ${msg}";

-  showWarnings = warnings: res: lib.foldr (w: x: warn w x) res warnings;
+  showWarnings = warnings: res: foldr warn res warnings;

  ## Function annotations

@ -1177,7 +1179,10 @@ in
    let
      fArgs = functionArgs f;
    in
-    g: setFunctionArgs g fArgs;
+    g: {
+      __functor = self: g;
+      __functionArgs = fArgs;
+    };

  /**
    Turns any non-callable values into constant functions.
@ -1325,11 +1330,11 @@ in
            r = i - ((i / base) * base);
            q = (i - r) / base;
          in
-          [ r ] ++ go q;
+          go q ++ [ r ];
    in
    assert (isInt base);
    assert (isInt i);
    assert (base >= 2);
    assert (i >= 0);
-    lib.reverseList (go i);
+    go i;
 }
--- a/nixos/lib/testing/run.nix
+++ b/nixos/lib/testing/run.nix
@ -150,7 +150,14 @@ in
        config.enableDebugHook -> isLinux
      ) "The debugging hook is not supported for macOS host systems!";
      {
-        name = "vm-test-run-${config.name}";
+        name =
+          let
+            inherit (config.driverConfiguration) containers vms;
+            kind = lib.concatStringsSep "-and-" (
+              (lib.optional (containers != { }) "container") ++ (lib.optional (vms != { }) "vm")
+            );
+          in
+          "${kind}-test-run-${config.name}";

        requiredSystemFeatures = lib.attrNames (lib.filterAttrs (_: v: v) config.requiredFeatures);

--- a/nixos/modules/programs/starship.nix
+++ b/nixos/modules/programs/starship.nix
@ -116,7 +116,7 @@ in
        # config file.  starship appears to use a hardcoded config location
        # rather than one inside an XDG folder:
        # https://github.com/starship/starship/blob/686bda1706e5b409129e6694639477a0f8a3f01b/src/configure.rs#L651
-        if [[ ! -f "$${STARSHIP_CONFIG:-$HOME/.config/starship.toml}" ]]; then
+        if [[ ! -f "''${STARSHIP_CONFIG:-$HOME/.config/starship.toml}" ]]; then
          export STARSHIP_CONFIG=${settingsFile}
        fi
        eval "$(${cfg.package}/bin/starship init bash --print-full-init)"
@ -154,7 +154,7 @@ in
        # config file.  starship appears to use a hardcoded config location
        # rather than one inside an XDG folder:
        # https://github.com/starship/starship/blob/686bda1706e5b409129e6694639477a0f8a3f01b/src/configure.rs#L651
-        if [[ ! -f "$${STARSHIP_CONFIG:-$HOME/.config/starship.toml}" ]]; then
+        if [[ ! -f "''${STARSHIP_CONFIG:-$HOME/.config/starship.toml}" ]]; then
          export STARSHIP_CONFIG=${settingsFile}
        fi
        eval "$(${cfg.package}/bin/starship init zsh)"
--- a/nixos/modules/programs/wayland/hyprland.nix
+++ b/nixos/modules/programs/wayland/hyprland.nix
@ -81,7 +81,12 @@ in
  config = lib.mkIf cfg.enable (
    lib.mkMerge [
      {
-        environment.systemPackages = [ cfg.package ];
+        environment = {
+          systemPackages = [ cfg.package ];
+
+          # Allows lua stub file to be accessed from /run/current-system/sw/share/hypr
+          pathsToLink = [ "/share/hypr" ];
+        };

        # Hyprland needs permissions to give itself SCHED_RR on startup:
        # https://github.com/hyprwm/Hyprland/blob/main/src/init/initHelpers.cpp
--- a/nixos/modules/services/audio/navidrome.nix
+++ b/nixos/modules/services/audio/navidrome.nix
@ -90,12 +90,9 @@ in

            Plugins = {
              Enabled = mkOption {
-                default = (builtins.length cfg.plugins) != 0;
-                defaultText = literalExpression "builtins.length \"\${config.services.navidrome.plugins != 0}\"";
+                default = true;
                description = ''
                  Enable plugin support in navidrome.
-
-                  This is automatically enabled if {option}`services.navidrome.plugins` is used.
                '';
              };
              Folder = mkOption {
--- a/nixos/modules/services/web-apps/nextcloud.md
+++ b/nixos/modules/services/web-apps/nextcloud.md
@ -68,6 +68,11 @@ It requires elevated permissions to become the `nextcloud` user. Given the way t
 escalation is implemented, parameters passed via the environment to Nextcloud are
 currently ignored, except for `OC_PASS` and `NC_PASS`.

+::: {.warning}
+When Polkit is enabled, the command being executed by `nextcloud-occ` might be logged
+into the system's journal. Be careful to not leak secrets that way!
+:::
+
 Custom service units that need to run `nextcloud-occ` either need elevated privileges
 or the systemd configuration from `nextcloud-setup.service` (recommended):

--- a/nixos/modules/services/web-servers/h2o/common.nix
+++ b/nixos/modules/services/web-servers/h2o/common.nix
@ -5,7 +5,6 @@
      lib.types.enum [
        "modern"
        "intermediate"
-        "old"
      ]
    );
    default = null;
@ -28,10 +27,6 @@
      : General-purpose servers with a variety of clients, recommended for
        almost all systems

-      old
-      : Compatible with a number of very old clients, & should be used only as
-        a last resort
-
      The default for all virtual hosts can be set with
      services.h2o.defaultTLSRecommendations, but this value can be overridden
      on a per-host basis using services.h2o.hosts.<name>.tls.recommmendations.
--- a/nixos/modules/services/web-servers/h2o/default.nix
+++ b/nixos/modules/services/web-servers/h2o/default.nix
@ -84,8 +84,8 @@ let
        # other settings with the tests @
        # `nixos/tests/web-servers/h2o/tls-recommendations.nix`
        # & run with `nix-build -A nixosTests.h2o.tls-recommendations`
-        version = "5.7";
-        git_tag = "v5.7.1";
+        version = "6.0";
+        git_tag = "v6.0";
        guidelinesJSON =
          lib.pipe
            {
@ -93,7 +93,7 @@ let
                "https://ssl-config.mozilla.org/guidelines/${version}.json"
                "https://raw.githubusercontent.com/mozilla/ssl-config-generator/refs/tags/${git_tag}/src/static/guidelines/${version}.json"
              ];
-              sha256 = "sha256:1mj2pcb1hg7q2wpgdq3ac8pc2q64wvwvwlkb9xjmdd9jm4hiyny7";
+              sha256 = "sha256-aHdzLNPo4c6jlbS+Fg3R0X5VcdPKtUky0oX5Q7Y94SQ=";
            }
            [
              pkgs.fetchurl
--- a/nixos/modules/virtualisation/nspawn-container/run-nspawn/src/run_nspawn/init.py
+++ b/nixos/modules/virtualisation/nspawn-container/run-nspawn/src/run_nspawn/init.py
@ -169,6 +169,7 @@ def run(

    root_dir.mkdir(parents=True, exist_ok=True)
    root_dir.chmod(0o755)
+    (root_dir / "usr/bin").mkdir(parents=True, exist_ok=True)

    with (
        mk_netns(f"nixos-nspawn-{container_name}") as netns,
--- a/nixos/tests/web-servers/h2o/tls-recommendations.nix
+++ b/nixos/tests/web-servers/h2o/tls-recommendations.nix
@ -25,7 +25,6 @@ let
          lib.optionalAttrs
            (builtins.elem recommendations [
              "intermediate"
-              "old"
            ])
            {
              openssl = pkgs.openssl_legacy;
@ -83,24 +82,20 @@ in
  nodes = {
    server_modern = mkH2OServer "modern";
    server_intermediate = mkH2OServer "intermediate";
-    server_old = mkH2OServer "old";
  };

  testScript =
    { nodes, ... }:
    let
-      inherit (nodes) server_modern server_intermediate server_old;
+      inherit (nodes) server_modern server_intermediate;
      modernPortStr = toString server_modern.services.h2o.hosts.${domain}.tls.port;
      intermediatePortStr = toString server_intermediate.services.h2o.hosts.${domain}.tls.port;
-      oldPortStr = toString server_old.services.h2o.hosts.${domain}.tls.port;
    in
-    # python
-    ''
+    /* python */ ''
      curl_basic = "curl -v --tlsv1.3 --http2 'https://${domain}:{port}/'"
      curl_head = "curl -v --head 'https://${domain}:{port}/'"
      curl_max_tls1_2 ="curl -v --tlsv1.0 --tls-max 1.2 'https://${domain}:{port}/'"
      curl_max_tls1_2_intermediate_cipher ="curl -v --tlsv1.0 --tls-max 1.2 --ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256' 'https://${domain}:{port}/'"
-      curl_max_tls1_2_old_cipher ="curl -v --tlsv1.0 --tls-max 1.2 --ciphers 'ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA256' 'https://${domain}:{port}/'"

      start_all()

@ -120,16 +115,5 @@ in
      assert "strict-transport-security" in intermediate_head
      server_intermediate.succeed(curl_max_tls1_2.format(port="${intermediatePortStr}"))
      server_intermediate.succeed(curl_max_tls1_2_intermediate_cipher.format(port="${intermediatePortStr}"))
-      server_intermediate.fail(curl_max_tls1_2_old_cipher.format(port="${intermediatePortStr}"))
-
-      server_old.wait_for_unit("h2o.service")
-      server_old.wait_for_open_port(${oldPortStr})
-      old_response = server_old.succeed(curl_basic.format(port="${oldPortStr}"))
-      assert "Hello, old!" in old_response
-      old_head = server_modern.succeed(curl_head.format(port="${oldPortStr}"))
-      assert "strict-transport-security" in old_head
-      server_old.succeed(curl_max_tls1_2.format(port="${oldPortStr}"))
-      server_old.succeed(curl_max_tls1_2_intermediate_cipher.format(port="${oldPortStr}"))
-      server_old.succeed(curl_max_tls1_2_old_cipher.format(port="${oldPortStr}"))
    '';
 }
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@ -1096,8 +1096,8 @@ let
        mktplcRef = {
          name = "csharpier-vscode";
          publisher = "csharpier";
-          version = "10.0.2";
-          hash = "sha256-SIogJ+5toIwa840I6ETxiLIHbfHjuAuOdleb+cYJElc=";
+          version = "10.0.3";
+          hash = "sha256-YTDpBGLbyM6Nq5DlEtqFiSsSRRECLIEqSM4xgIIVWG0=";
        };
        meta = {
          changelog = "https://marketplace.visualstudio.com/items/csharpier.csharpier-vscode/changelog";
--- a/pkgs/applications/editors/vscode/extensions/visualjj.visualjj/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/visualjj.visualjj/default.nix
@ -11,26 +11,26 @@ vscode-utils.buildVscodeMarketplaceExtension {
      sources = {
        "x86_64-linux" = {
          arch = "linux-x64";
-          hash = "sha256-YHerrkqMlLLHvbuM1fT6g4nBgO1DIkRBC+5ncw9ZA+I=";
+          hash = "sha256-VZKvoTJ/IKxYsEJl0XhtglsggmrYdaRUlXCpDv/9fQ0=";
        };
        "x86_64-darwin" = {
          arch = "darwin-x64";
-          hash = "sha256-iXRw+07xkSi6Gxhx+iezBaGlAaZM2L0BmzZ5ZfFUEbc=";
+          hash = "sha256-jo+fET/IyOl2zI/xxYy3KwnyOegTOXFhO1hDg5QtWrQ=";
        };
        "aarch64-linux" = {
          arch = "linux-arm64";
-          hash = "sha256-WkDu27TW1C+0UvNvNpWGKUhvqWo9rHMTWI9ro/gOYHs=";
+          hash = "sha256-HOSKZjozJlWn++P5bSwWdK3I+fgsPtS8kyvDWHMJQAY=";
        };
        "aarch64-darwin" = {
          arch = "darwin-arm64";
-          hash = "sha256-5RDH+TAfSkEYIleb2gb9vg+akWXp2JDcSUqyHZNJh/M=";
+          hash = "sha256-ABBYsSR3HQgSnnXUJXsg1DwqwFj9W6CT59/1fuqWsTc=";
        };
      };
    in
    {
      name = "visualjj";
      publisher = "visualjj";
-      version = "0.28.3";
+      version = "0.29.0";
    }
    // sources.${stdenvNoCC.hostPlatform.system}
      or (throw "Unsupported system ${stdenvNoCC.hostPlatform.system}");
--- a/pkgs/applications/emulators/libretro/cores/mame2000.nix
+++ b/pkgs/applications/emulators/libretro/cores/mame2000.nix
@ -6,13 +6,13 @@
 }:
 mkLibretroCore {
  core = "mame2000";
-  version = "0-unstable-2026-03-31";
+  version = "0-unstable-2026-05-22";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "mame2000-libretro";
-    rev = "cee538f9b28f00039f298cb3c2b588203f07d0be";
-    hash = "sha256-QgVLa6ZgyHWZeWRTemrzQW3hFYA+H+/twsghvlf/Z4c=";
+    rev = "fd0e767bd6378b35b505a04ada2b32bd98ffe8fb";
+    hash = "sha256-gS+fwsJ0/Bel2y2ajI+cSsrKlV5kWlCyOgr/JkJns1o=";
  };

  makefile = "Makefile";
--- a/pkgs/applications/emulators/libretro/cores/prboom.nix
+++ b/pkgs/applications/emulators/libretro/cores/prboom.nix
@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "prboom";
-  version = "0-unstable-2026-05-04";
+  version = "0-unstable-2026-05-20";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "libretro-prboom";
-    rev = "01b7411dab3ba8da6cdbc4fa83ac207f038f524d";
-    hash = "sha256-wNVUflrVAwwMvCfRk94k9SyANvVeHB3noN3yb5TpJpc=";
+    rev = "648223372e24773821a2041e0c39728f723badf4";
+    hash = "sha256-LyITrBmL5me5zWOfMRZAeCM9rDS19aV2TAFuU8QU/Kw=";
  };

  makefile = "Makefile";
--- a/pkgs/applications/networking/mailreaders/thunderbird-bin/release_esr_sources.nix
+++ b/pkgs/applications/networking/mailreaders/thunderbird-bin/release_esr_sources.nix
--- a/pkgs/applications/science/logic/coq/default.nix
+++ b/pkgs/applications/science/logic/coq/default.nix
@ -100,10 +100,7 @@ let
  coq-version =
    args.coq-version or (if version != "dev" then lib.versions.majorMinor version else "dev");
  coqAtLeast = v: coq-version == "dev" || lib.versionAtLeast coq-version v;
-  buildIde = args.buildIde or (!coqAtLeast "8.14");
-  ideFlags = lib.optionalString (
-    buildIde && !coqAtLeast "8.10"
-  ) "-lablgtkdir ${ocamlPackages.lablgtk}/lib/ocaml/*/site-lib/lablgtk2 -coqide opt";
+  buildIde = args.buildIde or (coqAtLeast "8.10" && !coqAtLeast "8.14");
  csdpPatch = lib.optionalString (csdp != null) ''
    substituteInPlace plugins/micromega/sos.ml --replace "; csdp" "; ${csdp}/bin/csdp"
    substituteInPlace plugins/micromega/coq_micromega.ml --replace "System.is_in_system_path \"csdp\"" "true"
@ -247,17 +244,9 @@ let
      addEnvHooks "$targetOffset" addCoqPath
    '';

-    preConfigure =
-      if coqAtLeast "8.10" then
-        ''
-          patchShebangs dev/tools/
-        ''
-      else
-        ''
-          configureFlagsArray=(
-            ${ideFlags}
-          )
-        '';
+    preConfigure = lib.optionalString (coqAtLeast "8.10") ''
+      patchShebangs dev/tools/
+    '';

    prefixKey = "-prefix ";

--- a/pkgs/applications/virtualization/docker/default.nix
+++ b/pkgs/applications/virtualization/docker/default.nix
@ -418,34 +418,16 @@ in
      tiniHash = "sha256-jCBNfoJAjmcTJBx08kHs+FmbaU82CbQcf0IVjd56Nuw=";
    };

-  docker_28 =
-    let
-      version = "28.5.2";
-    in
-    callPackage dockerGen {
-      inherit version;
-      cliRev = "v${version}";
-      cliHash = "sha256-11wbqvenTJooAzqOEp0UivPxhvWwSl1thCAzDMx0i/o=";
-      mobyRev = "v${version}";
-      mobyHash = "sha256-T5zz1lSLVdMR646CfhWAiVU4/VPAY1CRU+jIdjEWycs=";
-      runcRev = "v1.3.3";
-      runcHash = "sha256-Ci/2otySB7FaFoutmzWeVaTU+tO/lnluQfneFSQM1RE=";
-      containerdRev = "v1.7.28";
-      containerdHash = "sha256-vz7RFJkFkMk2gp7bIMx1kbkDFUMS9s0iH0VoyD9A21s=";
-      tiniRev = "369448a167e8b3da4ca5bca0b3307500c3371828";
-      tiniHash = "sha256-jCBNfoJAjmcTJBx08kHs+FmbaU82CbQcf0IVjd56Nuw=";
-    };
-
  docker_29 =
    let
-      version = "29.4.3";
+      version = "29.5.1";
    in
    callPackage dockerGen {
      inherit version;
      cliRev = "v${version}";
-      cliHash = "sha256-jGD+Z3koM0a2Te7cq2HdKFizZj39djvTQUmn815Mn4o=";
+      cliHash = "sha256-oobGr0UaeJL800hHx3K0tQs50HZbOn559WcLnSRiRhU=";
      mobyRev = "docker-v${version}";
-      mobyHash = "sha256-YWmxJZwjxh0gwqjHHJDpzZy1K1jS82Twmzb+uWtnejk=";
+      mobyHash = "sha256-ghYEOWr5RUDm0YLyupaDSpLd+8gFqxp3VjCt+3lztcA=";
      runcRev = "v1.3.5";
      runcHash = "sha256-Swphxbu/OLkUrfRjLMZIVGwYb7AN0xHdyxm0ysAVam0=";
      containerdRev = "v2.2.3";
--- a/pkgs/build-support/fetchgithub/default.nix
+++ b/pkgs/build-support/fetchgithub/default.nix
@ -3,7 +3,7 @@
  repoRevToNameMaybe,
  fetchgit,
  fetchzip,
-}:
+}@args:
 let
  # Here defines fetchFromGitHub arguments that determines useFetchGit,
  # The attribute value is their default values.
@ -37,6 +37,10 @@ let
  adjustFunctionArgs = f: lib.setFunctionArgs f (faUseFetchGit // lib.functionArgs f);

  decorate = f: lib.makeOverridable (adjustFunctionArgs f);
+
+  # fetchzip may not be overridable when using external tools, for example nix-prefetch
+  fetchzip =
+    if args.fetchzip ? override then args.fetchzip.override { withUnzip = false; } else args.fetchzip;
 in
 decorate (
  {
@ -105,14 +109,7 @@ decorate (
    varBase = "NIX${lib.optionalString (varPrefix != null) "_${varPrefix}"}_GITHUB_PRIVATE_";
    # We prefer fetchzip in cases we don't need submodules as the hash
    # is more stable in that case.
-    fetcher =
-      if useFetchGit then
-        fetchgit
-      # fetchzip may not be overridable when using external tools, for example nix-prefetch
-      else if fetchzip ? override then
-        fetchzip.override { withUnzip = false; }
-      else
-        fetchzip;
+    fetcher = if useFetchGit then fetchgit else fetchzip;
    privateAttrs = lib.optionalAttrs private {
      netrcPhase =
        # When using private repos:
--- a/pkgs/build-support/setup-hooks/install-fonts.sh
+++ b/pkgs/build-support/setup-hooks/install-fonts.sh
@ -20,7 +20,7 @@
 # This hook also provides an `installFont` function that can be used to install
 # additional fonts of a particular extension into their respective folder.
 #
-postInstallHooks+=(installFonts)
+preInstallHooks+=(installFonts)

 installFont() {
  if (($# != 2)); then
--- a/pkgs/by-name/_1/_1password-gui/sources.json
+++ b/pkgs/by-name/_1/_1password-gui/sources.json
@ -5,11 +5,11 @@
      "sources": {
        "x86_64": {
          "url": "https://downloads.1password.com/linux/tar/stable/x86_64/1password-8.12.21.x64.tar.gz",
-          "hash": "sha256-+TNkHD+CEODImJqxsvYO008UYqOAyrFpfXiaI5zYuDs="
+          "hash": "sha256-JwiMi2iozP6jWSIUtgXla86aSAhuUob7snqtUbeXPpI="
        },
        "aarch64": {
          "url": "https://downloads.1password.com/linux/tar/stable/aarch64/1password-8.12.21.arm64.tar.gz",
-          "hash": "sha256-zY2hwSANgpGLGh/qOXUbY2JlZnNpXByysAgZvnuS+Qc="
+          "hash": "sha256-WPFUqKKfdadzF7BtR9gUm0SlYq4ZN36eICfGsPxirH0="
        }
      }
    },
@ -18,39 +18,39 @@
      "sources": {
        "x86_64": {
          "url": "https://downloads.1password.com/mac/1Password-8.12.21-x86_64.zip",
-          "hash": "sha256-3CX1Qv2lYTy23XXRaAblOE+mp5YoX4qtV0SXV4hP8xI="
+          "hash": "sha256-tAWgIe7mcaGANCn8Kr0h6+zmvqufDJMjzAI3FrAGNk0="
        },
        "aarch64": {
          "url": "https://downloads.1password.com/mac/1Password-8.12.21-aarch64.zip",
-          "hash": "sha256-dwE97R0ZXn5kH9GGlyE+Zizb2T5GasgpGW+5zUFog8U="
+          "hash": "sha256-1c6YbzFYNyHKzY13OZ7z1Ad5hzgTIMs3aT0nluK9l0w="
        }
      }
    }
  },
  "beta": {
    "linux": {
-      "version": "8.12.12-43.BETA",
+      "version": "8.12.22-15.BETA",
      "sources": {
        "x86_64": {
-          "url": "https://downloads.1password.com/linux/tar/beta/x86_64/1password-8.12.12-43.BETA.x64.tar.gz",
-          "hash": "sha256-dMnYMw+egxZZXR03EBhOyL3mdRjp0nyuxL78eVKklHs="
+          "url": "https://downloads.1password.com/linux/tar/beta/x86_64/1password-8.12.22-15.BETA.x64.tar.gz",
+          "hash": "sha256-rqbbfsCgo5+3PecaVo0YKCXS9afgzSbXz1DxcVWfkf8="
        },
        "aarch64": {
-          "url": "https://downloads.1password.com/linux/tar/beta/aarch64/1password-8.12.12-43.BETA.arm64.tar.gz",
-          "hash": "sha256-nge4jT8M8X2LR18vHfZTRnIEcfxVgnbcHvvAJcveZxI="
+          "url": "https://downloads.1password.com/linux/tar/beta/aarch64/1password-8.12.22-15.BETA.arm64.tar.gz",
+          "hash": "sha256-e3IzRG/Ptj3MSszd1DRRMOXorlhVPon+oVinRy+4q+I="
        }
      }
    },
    "darwin": {
-      "version": "8.11.22-25.BETA",
+      "version": "8.12.22-15.BETA",
      "sources": {
        "x86_64": {
-          "url": "https://downloads.1password.com/mac/1Password-8.11.22-25.BETA-x86_64.zip",
-          "hash": "sha256-ZUFlsExUccqIXagggwTFj99Efd1i5Lo07P/XgTZuHBs="
+          "url": "https://downloads.1password.com/mac/1Password-8.12.22-15.BETA-x86_64.zip",
+          "hash": "sha256-AVKhJcRwkxp4N0s2dalY/lcFvcEzuJ0dJzVKwmEpT1M="
        },
        "aarch64": {
-          "url": "https://downloads.1password.com/mac/1Password-8.11.22-25.BETA-aarch64.zip",
-          "hash": "sha256-ALY5Kj/Wt/p3OTCv085q+TWFS5rLXp6MctCBUSG0ZSI="
+          "url": "https://downloads.1password.com/mac/1Password-8.12.22-15.BETA-aarch64.zip",
+          "hash": "sha256-ZQAZUFHlNfgvBe/JKVnpjpstQsivXemXMDFiHuxM3eo="
        }
      }
    }
--- a/pkgs/by-name/ai/aider-chat/package.nix
+++ b/pkgs/by-name/ai/aider-chat/package.nix
@ -112,6 +112,7 @@ let
      requests
      rich
      rpds-py
+      rsa
      scipy
      shtab
      smmap
--- a/pkgs/by-name/al/algia/package.nix
+++ b/pkgs/by-name/al/algia/package.nix
@ -7,13 +7,13 @@

 buildGoModule (finalAttrs: {
  pname = "algia";
-  version = "0.0.112";
+  version = "0.0.120";

  src = fetchFromGitHub {
    owner = "mattn";
    repo = "algia";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-y0mOzgWuuRAJQnP6Zg9lvjeOGMsJrRQgvPTmznK1PRA=";
+    hash = "sha256-pKoBPPvNtgRPwsJMSy8GViIB1Gcl780vsTPDjnhsB0Q=";
  };

  vendorHash = "sha256-JTTWVs0KwceiLy6tpyd48zORiXLc18zwgG1c+ceivKU=";
--- a/pkgs/by-name/al/alkalami/package.nix
+++ b/pkgs/by-name/al/alkalami/package.nix
@ -2,25 +2,28 @@
  lib,
  stdenvNoCC,
  fetchzip,
+  installFonts,
 }:

-stdenvNoCC.mkDerivation rec {
+stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "alkalami";
  version = "3.000";

  src = fetchzip {
-    url = "https://software.sil.org/downloads/r/alkalami/Alkalami-${version}.zip";
+    url = "https://software.sil.org/downloads/r/alkalami/Alkalami-${finalAttrs.version}.zip";
    hash = "sha256-ra664VbUKc8XpULCWhLMVnc1mW4pqZvbvwuBvRQRhcY=";
  };

-  installPhase = ''
-    runHook preInstall
+  outputs = [
+    "out"
+    "webfont"
+  ];

-    mkdir -p $out/share/{doc/${pname},fonts/truetype}
-    mv *.ttf $out/share/fonts/truetype/
-    mv *.txt documentation $out/share/doc/${pname}/
+  nativeBuildInputs = [ installFonts ];

-    runHook postInstall
+  postInstall = ''
+    mkdir -p $out/share/doc/alkalami
+    mv *.txt documentation $out/share/doc/alkalami
  '';

  meta = {
@ -30,4 +33,4 @@ stdenvNoCC.mkDerivation rec {
    maintainers = [ lib.maintainers.vbgl ];
    platforms = lib.platforms.all;
  };
-}
+})
--- a/pkgs/by-name/ar/archisteamfarm/deps.json
+++ b/pkgs/by-name/ar/archisteamfarm/deps.json
@ -281,8 +281,8 @@
  },
  {
    "pname": "Markdig.Signed",
-    "version": "1.1.2",
-    "hash": "sha256-I2d1n2NTV0xr+qasoTt7FdUArCPrinvLVqR4ZB5uWtI="
+    "version": "1.1.3",
+    "hash": "sha256-luLhgpC0d2ZTtvoSvaH/yaIc/IDppyf4P8M7sGbExJw="
  },
  {
    "pname": "Microsoft.ApplicationInsights",
@ -291,8 +291,8 @@
  },
  {
    "pname": "Microsoft.AspNetCore.OpenApi",
-    "version": "10.0.5",
-    "hash": "sha256-CQXAu6Tm8nOy/rrZksIKGaLW7USEP/N1kwKBMLoh7js="
+    "version": "10.0.7",
+    "hash": "sha256-WlAW49otxYzgrmuqHewUoBsjDcAZwhNz5WVbCT4EiIA="
  },
  {
    "pname": "Microsoft.CodeAnalysis.ResxSourceGenerator",
@ -301,13 +301,13 @@
  },
  {
    "pname": "Microsoft.CodeCoverage",
-    "version": "18.0.1",
-    "hash": "sha256-G6y5iyHZ3R2shlLCW/uTusio/UqcnWT79X+UAbxvDQY="
+    "version": "18.3.0",
+    "hash": "sha256-fqKglbYvEb/77+rmUvLyLZSwROM1P9OW03Ub307WYZ8="
  },
  {
    "pname": "Microsoft.DiaSymReader",
-    "version": "2.0.0",
-    "hash": "sha256-8hotZmh8Rb6Q6oD9Meb74SvAdbDo39Y/1m8h43HHjjw="
+    "version": "2.2.3",
+    "hash": "sha256-Wf2Hy/9o3xSKB9ZRXj3oUgr2CcUwu+BFn2BP2cX7KJQ="
  },
  {
    "pname": "Microsoft.Extensions.Configuration",
@ -396,28 +396,28 @@
  },
  {
    "pname": "Microsoft.IdentityModel.Abstractions",
-    "version": "8.17.0",
-    "hash": "sha256-AU+EMOZArc3rTdsnKYzAufFAtspuYQM3XYi8/VsQAio="
+    "version": "8.18.0",
+    "hash": "sha256-mkguJA4aXIVVQvSJ9Duq9mivbGXAIkLQp3a8PKy223A="
  },
  {
    "pname": "Microsoft.IdentityModel.JsonWebTokens",
-    "version": "8.17.0",
-    "hash": "sha256-MH7vdhCNAae32p6UTvaDtmyvFDxa/W71qTsEQ6yC9xM="
+    "version": "8.18.0",
+    "hash": "sha256-MdqY9CGRs+fTLb3HYYcSfuzqDFo4Dpho4McFWWferjA="
  },
  {
    "pname": "Microsoft.IdentityModel.Logging",
-    "version": "8.17.0",
-    "hash": "sha256-IM6jsPMz+l9JA0cye/v2ke51xlfP0u5HtWBqc2aKDYM="
+    "version": "8.18.0",
+    "hash": "sha256-09WyYskyL8gjjVDzoZBQAGXgsPmyagWftALSBCdt4gg="
  },
  {
    "pname": "Microsoft.IdentityModel.Tokens",
-    "version": "8.17.0",
-    "hash": "sha256-XcA0KXJbqMWt0I5LuHHMRLpgVQ18KcBej1BoySHeA1A="
+    "version": "8.18.0",
+    "hash": "sha256-sFhonZW9G6H4ooQ6N/78fkZvADZ2Hf5WAS3FKd/ue1E="
  },
  {
    "pname": "Microsoft.NET.Test.Sdk",
-    "version": "18.0.1",
-    "hash": "sha256-0c3/rp9di0w7E5UmfRh6Prrm3Aeyi8NOj5bm2i6jAh0="
+    "version": "18.3.0",
+    "hash": "sha256-o2bILLF5i+XUoi8xZYgolU3CxLTdql5R/tEVWVnKFPU="
  },
  {
    "pname": "Microsoft.OpenApi",
@ -426,73 +426,73 @@
  },
  {
    "pname": "Microsoft.Testing.Extensions.CodeCoverage",
-    "version": "18.4.1",
-    "hash": "sha256-GhxGUnM8Dvef4E0mPrNOEkoHD/sjcZX68rd78OytPPY="
+    "version": "18.5.2",
+    "hash": "sha256-PkIEXfbyEwlxOIG4h420/TpWbbzAy7eV8RUy7iXHVtk="
  },
  {
    "pname": "Microsoft.Testing.Extensions.Telemetry",
-    "version": "2.1.0",
-    "hash": "sha256-SawLiz1fB3QbkkyEVloEj8UpQTAIZR7U9FZfqwCkGr0="
+    "version": "2.2.2",
+    "hash": "sha256-4rXpgfroh8MnLWjYxUtYo/VcErYe9gpCaz80np3r1CI="
  },
  {
    "pname": "Microsoft.Testing.Extensions.TrxReport",
-    "version": "2.1.0",
-    "hash": "sha256-wNFj4ovblsnnDIYfDmhAE87hA5YWONhLSGLyTRuxbS4="
+    "version": "2.2.2",
+    "hash": "sha256-IOgroCb3Wvwas4z2Xxy4ils5AswZpKT/wvjQM5e95ig="
  },
  {
    "pname": "Microsoft.Testing.Extensions.TrxReport.Abstractions",
-    "version": "2.1.0",
-    "hash": "sha256-X54qc4Ey+3hm0e5eCY1R2me8b4zGrWzjesm9fGJWXys="
+    "version": "2.2.2",
+    "hash": "sha256-aP+mw/Q5U6lfNmMJCzLqVMpZ+TnBMTqXH0VGhR2FvbI="
  },
  {
    "pname": "Microsoft.Testing.Extensions.VSTestBridge",
-    "version": "2.1.0",
-    "hash": "sha256-2m14uEmuEELn4Ci/CZNpKjhlnzq9vYvhgeiM03DZj7A="
-  },
-  {
-    "pname": "Microsoft.Testing.Platform",
-    "version": "2.0.2",
-    "hash": "sha256-K8B4tQaYslm+njUQ59nyvh4f4UgrbOo6DQgO9Hwt0aY="
+    "version": "2.2.2",
+    "hash": "sha256-rtyA0w70swCKfz+ly6ev/BlNXH8WUHurfxsaWoo1LbA="
  },
  {
    "pname": "Microsoft.Testing.Platform",
    "version": "2.1.0",
    "hash": "sha256-CbR0j0Dh65cMccO7L6ppx4b5iiXjqxjjfC9A85HeLuM="
  },
+  {
+    "pname": "Microsoft.Testing.Platform",
+    "version": "2.2.2",
+    "hash": "sha256-azYgL1c9oVE1JDYs0HUWTClaIumw1xvxgmNz4Mx0q30="
+  },
  {
    "pname": "Microsoft.Testing.Platform.MSBuild",
-    "version": "2.1.0",
-    "hash": "sha256-6T2tBSokr5/oiwqKASk18BieKqkIzDbYX32j1Hl1z1g="
+    "version": "2.2.2",
+    "hash": "sha256-uuhiI0aGFpM+I2ASh99rsfsRhKf8b/JUNx4Hcd2Ac6Q="
  },
  {
    "pname": "Microsoft.TestPlatform.ObjectModel",
-    "version": "18.0.1",
-    "hash": "sha256-oJbS7SZ46RzyOQ+gCysW7qJRy7V8RlQVa5d8uajb91M="
+    "version": "18.3.0",
+    "hash": "sha256-3Y3OxAQsXl6sunQlSjfq31aLWykHQTj2o/TOVI/uy88="
  },
  {
    "pname": "Microsoft.TestPlatform.TestHost",
-    "version": "18.0.1",
-    "hash": "sha256-OXYf5vg4piDr10ve0bZ2ZSb+nb3yOiHayJV3cu5sMV4="
+    "version": "18.3.0",
+    "hash": "sha256-OkR+XvipAHPQbHywTwN8lVcMpyRs2MUJKCxJ5OfKAFk="
  },
  {
    "pname": "MSTest",
-    "version": "4.1.0",
-    "hash": "sha256-uzieN/+aBExm5gKSzQLwkTxrNqGigGhozeAOaApI8bg="
+    "version": "4.2.2",
+    "hash": "sha256-hTD140FHBWOoUxKmCkmL261gvwgJRXnzAwSl37sp6XI="
  },
  {
    "pname": "MSTest.Analyzers",
-    "version": "4.1.0",
-    "hash": "sha256-FeMIXYRPxXJCAKOk3dKWCtoNX3wC36NqC/IduOd1xTE="
+    "version": "4.2.2",
+    "hash": "sha256-m6FRWUdYM9tuNnm7ehY+j1wIr2i12+0LeK5JcpJdp5M="
  },
  {
    "pname": "MSTest.TestAdapter",
-    "version": "4.1.0",
-    "hash": "sha256-g7MuXzSJ2+ydwPzdBRzE8WFsjWSI3tf1X0rLNy7a9qU="
+    "version": "4.2.2",
+    "hash": "sha256-QFjHNHVyijmuq29MuhUNMnaWEcJWPWGVp21BQj0Hb7M="
  },
  {
    "pname": "MSTest.TestFramework",
-    "version": "4.1.0",
-    "hash": "sha256-ELpj0a6VDEIzY7RWsdyF/DREK8I/6CZen3OYO5dvloI="
+    "version": "4.2.2",
+    "hash": "sha256-+yrzh3fmkvOMnqk+eYKQTC1267uKeUDcS3TV1+3Gnck="
  },
  {
    "pname": "Newtonsoft.Json",
@ -521,58 +521,58 @@
  },
  {
    "pname": "NLog",
-    "version": "6.1.1",
-    "hash": "sha256-4pxy5z5FyRxBmZNBw+n32SjgEQzMsgSHTuSSn+vxLzk="
+    "version": "6.1.3",
+    "hash": "sha256-s0sxfQ1tiWRSFVh/m/eIzEe4+ZgT02e9GZiwDAi7xp4="
  },
  {
    "pname": "NLog.Extensions.Logging",
-    "version": "6.1.2",
-    "hash": "sha256-H8Wu5NlzMrbQ3IlTD0hutb9ZAg73YBynnjjtTp9NMqk="
+    "version": "6.1.3",
+    "hash": "sha256-7Ryjk3FZqz6Cn8bCSK5OUf7VCQL9LA/bMCgwr5tpIys="
  },
  {
    "pname": "NLog.Web.AspNetCore",
-    "version": "6.1.2",
-    "hash": "sha256-m/MF3dljgRIeGdYdh5m20lKMaQkMadUgXBBp2k5OtaQ="
+    "version": "6.1.3",
+    "hash": "sha256-FXxcK5kXO6qy/jw0lnphzhs9QF3u/i5A4GD13jqclUA="
  },
  {
    "pname": "OpenTelemetry",
-    "version": "1.15.0",
-    "hash": "sha256-L/CK3hlDc4+G16XZbV9y3iqV2ckIOiQQr1k4inWRtVQ="
+    "version": "1.15.3",
+    "hash": "sha256-zOrEPW8noHfUINJtIWQYMTls2JLRUYm7aoyffjrMBLU="
  },
  {
    "pname": "OpenTelemetry.Api",
-    "version": "1.15.0",
-    "hash": "sha256-CwzaQ4MKSdJ1q6qNzPXKRKNEvOLy5N9DDHu+TWqRYkU="
+    "version": "1.15.3",
+    "hash": "sha256-vriWJD2xvBt6ir9u5o/aVPBqBJJA7S6IJhkjKDkeLfc="
  },
  {
    "pname": "OpenTelemetry.Api.ProviderBuilderExtensions",
-    "version": "1.15.0",
-    "hash": "sha256-nYCg/lvC5Z7nmjWl1ikZALBvuYbDTN/6eqvANwjiHjI="
+    "version": "1.15.3",
+    "hash": "sha256-Z4x0eA1dkCOJS5xYZ6ogMOk6H+ivvXuVj1mORyWMOSo="
  },
  {
    "pname": "OpenTelemetry.Exporter.Prometheus.AspNetCore",
-    "version": "1.15.0-beta.1",
-    "hash": "sha256-NcMQu+IA3Nj3EkQgs2/T6kr36KJwj0/WkDlXtiyPJoU="
+    "version": "1.15.3-beta.1",
+    "hash": "sha256-qgaIwTB9To17OifsThq1AsXg1Ms8sqnooAvf+gNJR8Y="
  },
  {
    "pname": "OpenTelemetry.Extensions.Hosting",
-    "version": "1.15.0",
-    "hash": "sha256-4Y/qP5ao56w5T6B93CVQ+9ktuPYfeMg20BTRHe7q1L4="
+    "version": "1.15.3",
+    "hash": "sha256-5Z5/80xNttniodCF71s9cGXvDCkIc8Qdvpr969K5G0c="
  },
  {
    "pname": "OpenTelemetry.Instrumentation.AspNetCore",
-    "version": "1.15.1",
-    "hash": "sha256-72oILNRkqztOpRTNC/SjIrqe63ihs33ZwTvgKeP7rws="
+    "version": "1.15.2",
+    "hash": "sha256-rfStn++qynwoTOa5H5IFwbAPn7sOgW/vebcfKvOusio="
  },
  {
    "pname": "OpenTelemetry.Instrumentation.Http",
-    "version": "1.15.0",
-    "hash": "sha256-0qhyaFFqkscIJ5VN2Ya8rPGOrui40G//pG3cQJflsmg="
+    "version": "1.15.1",
+    "hash": "sha256-VG3zmUmFcN+mk7BkIcss1RjkcrVWrQMn8AUDTM4wpus="
  },
  {
    "pname": "OpenTelemetry.Instrumentation.Runtime",
-    "version": "1.15.0",
-    "hash": "sha256-thtGamTazhUbxMP//ztbvLfAcNy3dtdtUStVkycW4Io="
+    "version": "1.15.1",
+    "hash": "sha256-wE0909zdzuGUB/KD/yEfLV9F5EvZGMmwjL2tpO4bOh4="
  },
  {
    "pname": "protobuf-net",
@ -586,8 +586,8 @@
  },
  {
    "pname": "Scalar.AspNetCore",
-    "version": "2.13.15",
-    "hash": "sha256-kT5XPl+ZuqMByeH3gLe3EKd3G3yzXViCnehC0fag0lM="
+    "version": "2.14.11",
+    "hash": "sha256-NOH8fyTW+uuvggup1581IwO1Gv1FyvpCQMsPWItBlwA="
  },
  {
    "pname": "SteamKit2",
@ -596,33 +596,33 @@
  },
  {
    "pname": "System.Composition",
-    "version": "10.0.5",
-    "hash": "sha256-+Vi5vhZm+McB1aYmUtvPiJDgylwB06PNiFMyCXz435g="
+    "version": "10.0.7",
+    "hash": "sha256-+D0uPBsF3vIl1IU3DZ1aCWpdQompwSvyFLvxprUErAE="
  },
  {
    "pname": "System.Composition.AttributedModel",
-    "version": "10.0.5",
-    "hash": "sha256-z81DulJ1fL+UBve882LNCyz/+/vaI4ZIN2FnGWuDTDk="
+    "version": "10.0.7",
+    "hash": "sha256-PxE1IuviKGncIzrCFNqhqFMNzEdnN5/A9kFHSyvg4P4="
  },
  {
    "pname": "System.Composition.Convention",
-    "version": "10.0.5",
-    "hash": "sha256-bG/OoFHQ2Uq3Ez+G6UKZrDCAoY+5kgeEBNAIIf7ClGc="
+    "version": "10.0.7",
+    "hash": "sha256-oPAOsNnNF0tOXHZoxnQt7PC2R4f+iqmzYKg++zPCdaA="
  },
  {
    "pname": "System.Composition.Hosting",
-    "version": "10.0.5",
-    "hash": "sha256-lWMeuR0MrTf/lahN/Sk7g0bppJ3VZvYAmbBFE3Zd73Y="
+    "version": "10.0.7",
+    "hash": "sha256-bBoobvUuurRqog2nqchZKTwkIn7Weq7M3auboVgwALA="
  },
  {
    "pname": "System.Composition.Runtime",
-    "version": "10.0.5",
-    "hash": "sha256-uzEeZ4NA4b9O2hVVUuR3haRYGUt/OROelrwis+spu94="
+    "version": "10.0.7",
+    "hash": "sha256-sZTjqpSbbEy4KsRMDoEKvvfjHkl7IL9pcD2N8kFVWro="
  },
  {
    "pname": "System.Composition.TypedParts",
-    "version": "10.0.5",
-    "hash": "sha256-nIWGm5I+eR5kx+VL+1PsOFXYgvKd2vwB7s/gPYOxKfI="
+    "version": "10.0.7",
+    "hash": "sha256-gqDp0guxUnnEJaB6I/9PSgxXWDbE5YhyrTa9Yu4s0OM="
  },
  {
    "pname": "System.IO.Hashing",
@ -631,13 +631,13 @@
  },
  {
    "pname": "System.Security.Cryptography.ProtectedData",
-    "version": "10.0.5",
-    "hash": "sha256-Zyqq70EacxdKIx78p49cZ2rveGLxzU9VZxJsPtB2bK0="
+    "version": "10.0.7",
+    "hash": "sha256-IhiXDRoBQil9KAVV97PiCOhiIQCSTIJuKQOOfBECSz0="
  },
  {
    "pname": "Tmds.DBus.Protocol",
-    "version": "0.91.1",
-    "hash": "sha256-L7L4zp8NtS+VvLVjgqgBkVzCxElxfGSCTJwC5gWbq9A="
+    "version": "0.93.0",
+    "hash": "sha256-Oi2SDkrhTG3v9KXlRsmXQWsRJbQYVqg9bgiao1pUD0k="
  },
  {
    "pname": "ZstdSharp.Port",
--- a/pkgs/by-name/ar/archisteamfarm/package.nix
+++ b/pkgs/by-name/ar/archisteamfarm/package.nix
@ -21,13 +21,13 @@ in
 buildDotnetModule rec {
  pname = "archisteamfarm";
  # nixpkgs-update: no auto update
-  version = "6.3.4.2";
+  version = "6.3.6.0";

  src = fetchFromGitHub {
    owner = "JustArchiNET";
    repo = "ArchiSteamFarm";
    rev = version;
-    hash = "sha256-h9wvMT7BIzIMSnHoinBiZLYbWYPELT3dO+ao+gwTfbw=";
+    hash = "sha256-S2T741eOO0s8a3pikHz0hy/PBPpw5fmtpzGv0cmRk0I=";
  };

  dotnet-runtime = dotnetCorePackages.aspnetcore_10_0;
--- a/pkgs/by-name/ar/ardour/package.nix
+++ b/pkgs/by-name/ar/ardour/package.nix
@ -73,14 +73,14 @@ stdenv.mkDerivation (
  in
  {
    pname = "ardour";
-    version = "9.4";
+    version = "9.5";

    # We can't use `fetchFromGitea` here, as attempting to fetch release archives from git.ardour.org
    # result in an empty archive. See https://tracker.ardour.org/view.php?id=7328 for more info.
    src = fetchgit {
      url = "git://git.ardour.org/ardour/ardour.git";
-      rev = finalAttrs.version;
-      hash = "sha256-/obRWtluM60OWcr93Ci40tjJMbnBvNqF3tWRO7uCrv8=";
+      tag = finalAttrs.version;
+      hash = "sha256-Jaq1jgiGMmLeIw66RIXfZJxc+HCho2eGl5uEqAlNk6w=";
    };

    bundledContent = fetchzip {
--- a/pkgs/by-name/aw/aws-sam-cli/package.nix
+++ b/pkgs/by-name/aw/aws-sam-cli/package.nix
@ -2,7 +2,6 @@
  lib,
  python3,
  fetchFromGitHub,
-  fetchpatch2,
  git,
  testers,
  aws-sam-cli,
@ -12,14 +11,14 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "aws-sam-cli";
-  version = "1.154.0";
+  version = "1.160.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "aws";
    repo = "aws-sam-cli";
    tag = "v${version}";
-    hash = "sha256-wy6LZbWmK5rb0foFttPOvDOsFtrQNFc8mGBP9WTzVyw=";
+    hash = "sha256-IBxnBIgTSpPUNb/4yx3OqA7WFzudzRKgkKCFsJeyx08=";
  };

  build-system = with python3.pkgs; [ setuptools ];
@ -30,6 +29,7 @@ python3.pkgs.buildPythonApplication rec {
    "boto3"
    "boto3-stubs"
    "cfn-lint"
+    "click"
    "cookiecutter"
    "docker"
    "jsonschema"
@ -58,6 +58,7 @@ python3.pkgs.buildPythonApplication rec {
      flask
      jsonschema
      pyopenssl
+      python-dotenv
      pyyaml
      requests
      rich
@ -87,20 +88,6 @@ python3.pkgs.buildPythonApplication rec {
      ]
    );

-  patches = [
-    # Remove after aws-sam-cli > 1.154.0
-    (fetchpatch2 {
-      url = "https://github.com/aws/aws-sam-cli/commit/1e1664faae8ff799cbb03fe16ef1650689803587.patch";
-      hash = "sha256-HnOBrKkE/sIGZrgRq8G+ef1wnGvtALV4wma8J5eZfLc=";
-    })
-  ];
-
-  # Remove after upstream bumps click > 8.1.8
-  postPatch = ''
-    substituteInPlace requirements/base.txt --replace-fail \
-      'click==8.1.8' 'click==${python3.pkgs.click.version}'
-  '';
-
  postFixup = ''
    # Disable telemetry: https://github.com/aws/aws-sam-cli/issues/1272
    wrapProgram $out/bin/sam \
@ -129,9 +116,7 @@ python3.pkgs.buildPythonApplication rec {
    "-Wignore::DeprecationWarning"
  ];

-  enabledTestPaths = [
-    "tests"
-  ];
+  enabledTestPaths = [ "tests" ];

  disabledTestPaths = [
    # Disable tests that requires networking or complex setup
@ -158,6 +143,8 @@ python3.pkgs.buildPythonApplication rec {
    "test_delete_deployment"
    "test_request_with_no_data"
    "test_import_should_succeed_for_a_defined_hidden_package_540_pkg_resources_py2_warn"
+    "test_updates_imageuri_when_pointing_to_local_archive"
+    "test_subcommand_help_0_invoke"
  ];

  pythonImportsCheck = [ "samcli" ];
--- a/pkgs/by-name/bi/bitwarden-cli/package.nix
+++ b/pkgs/by-name/bi/bitwarden-cli/package.nix
@ -14,13 +14,13 @@

 buildNpmPackage (finalAttrs: {
  pname = "bitwarden-cli";
-  version = "2026.4.1";
+  version = "2026.4.2";

  src = fetchFromGitHub {
    owner = "bitwarden";
    repo = "clients";
    tag = "cli-v${finalAttrs.version}";
-    hash = "sha256-QhkuGW3R577zHpTZ1+GPhEtSUdZAKrAN/WPJhA5AA7c=";
+    hash = "sha256-8UDzW93O+AvMGXcVHe1PTvYvmXewl/bXsxIdjoGRtcQ=";
  };

  postPatch = ''
@ -38,7 +38,7 @@ buildNpmPackage (finalAttrs: {
  nodejs = nodejs_22;
  npmDepsFetcherVersion = 2;

-  npmDepsHash = "sha256-QCN0fyXr/D39MJnwOyAvYu5hANj8flk3HMVuw9kaJwc=";
+  npmDepsHash = "sha256-3RQ0HRsLQlXMeJIHAPKbZsGi6I/70pSIg8NM/3uJvUo=";

  nativeBuildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
    perl
--- a/pkgs/by-name/ca/camilladsp/package.nix
+++ b/pkgs/by-name/ca/camilladsp/package.nix
@ -50,8 +50,11 @@ rustPlatform.buildRustPackage (finalAttrs: {
    homepage = "https://github.com/HEnquist/camilladsp";
    changelog = "https://github.com/HEnquist/camilladsp/blob/v${finalAttrs.version}/CHANGELOG.md";
    license = lib.licenses.gpl3Only;
-    platforms = lib.platforms.linux;
-    maintainers = with lib.maintainers; [ paepcke ];
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
+    maintainers = with lib.maintainers; [
+      paepcke
+      stepbrobd
+    ];
    mainProgram = "camilladsp";
  };
 })
--- a/pkgs/by-name/ca/cargo-about/package.nix
+++ b/pkgs/by-name/ca/cargo-about/package.nix
@ -8,16 +8,18 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cargo-about";
-  version = "0.8.4";
+  version = "0.9.0";

  src = fetchFromGitHub {
    owner = "EmbarkStudios";
    repo = "cargo-about";
    tag = finalAttrs.version;
-    sha256 = "sha256-QbmZIbn/xPZUTXNpUjGuWTjoh8RpsMRuVIfJRO9M3xM=";
+    hash = "sha256-0iY/kZmPYoMAQVU+Z/GWom7IgllYwUM34A80dgFYnXs=";
  };

-  cargoHash = "sha256-oO5Kp5A2v1w6EUwgcHhyagZDIK7a/2d9uTiCoXHuHhY=";
+  cargoHash = "sha256-Hp2PRwPpSUKdExOvF2szb8W5+juPv2HfK7cPBm1rm5Q=";
+
+  buildFeatures = [ "cli" ];

  nativeBuildInputs = [ pkg-config ];

--- a/pkgs/by-name/ca/cargo-feature-combinations/package.nix
+++ b/pkgs/by-name/ca/cargo-feature-combinations/package.nix
@ -0,0 +1,35 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  nix-update-script,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  __structuredAttrs = true;
+
+  pname = "cargo-feature-combinations";
+  version = "0.0.52";
+
+  src = fetchFromGitHub {
+    owner = "romnn";
+    repo = "cargo-feature-combinations";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-e012XP2LsbcYC5oQYebvLzQvRzfjTSgIyngd/EpIYKY=";
+  };
+
+  cargoHash = "sha256-JcqVGS5EFED66e8BDXLqDz8OAjW3+/H4XkLb5mYV1Dc=";
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Cargo plugin to run commands against all combinations of features";
+    homepage = "https://github.com/romnn/cargo-feature-combinations";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [
+      matthiasbeyer
+      pinage404
+    ];
+    mainProgram = "cargo-feature-combinations";
+  };
+})
--- a/pkgs/by-name/ca/cargo-hakari/package.nix
+++ b/pkgs/by-name/ca/cargo-hakari/package.nix
@ -8,16 +8,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cargo-hakari";
-  version = "0.9.37";
+  version = "0.9.38";

  src = fetchFromGitHub {
    owner = "guppy-rs";
    repo = "guppy";
    tag = "cargo-hakari-${finalAttrs.version}";
-    hash = "sha256-Rf/1IhcvSp9Q8dLo/kuG0O9uIUH15Aw567ggaABANJw=";
+    hash = "sha256-joTDNEIlNDtRBFV6QL2yqM3VWbZ05nF235U3F8lekeE=";
  };

-  cargoHash = "sha256-vL+1oJO9qTg/SX0mvt3hvKo1t3FhQJmUSLoK6LZuqZc=";
+  cargoHash = "sha256-JmRq6Hoss99tOymMQvrBZevrf56+nSS70AZb2XeqZSc=";

  cargoBuildFlags = [
    "-p"
--- a/pkgs/by-name/ch/chafa/package.nix
+++ b/pkgs/by-name/ch/chafa/package.nix
@ -19,14 +19,14 @@
 }:

 stdenv.mkDerivation (finalAttrs: {
-  version = "1.18.1";
+  version = "1.18.2";
  pname = "chafa";

  src = fetchFromGitHub {
    owner = "hpjansson";
    repo = "chafa";
    tag = finalAttrs.version;
-    hash = "sha256-Is7N5WUjYVDFz1VKrKQqa7n48gXf2JtvDHB5vXMjoZg=";
+    hash = "sha256-M4TTLpaIV7H3aLj7/C7FHT0GNCxN9SRZ81FtxuWNzjo=";
  };

  outputs = [
--- a/pkgs/by-name/cl/clap/package.nix
+++ b/pkgs/by-name/cl/clap/package.nix
@ -8,13 +8,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "clap";
-  version = "1.2.7";
+  version = "1.2.8";

  src = fetchFromGitHub {
    owner = "free-audio";
    repo = "clap";
    rev = finalAttrs.version;
-    hash = "sha256-FtsqfpUBn0YGEyhRrJnPGSqrawS1g3F/exVGAuvXkRQ=";
+    hash = "sha256-slvq7p15xCa7l2tvEaGPzDL8w6/8EI0DySC4Zp+c7tQ=";
  };

  postPatch = ''
--- a/pkgs/by-name/co/code-cursor/sources.json
+++ b/pkgs/by-name/co/code-cursor/sources.json
@ -1,22 +1,22 @@
 {
-  "version": "3.4.16",
+  "version": "3.5.17",
  "vscodeVersion": "1.105.1",
  "sources": {
    "x86_64-linux": {
-      "url": "https://downloads.cursor.com/production/f736016b0aa20ba1f99b7eec1dda48579fa4c295/linux/x64/Cursor-3.4.16-x86_64.AppImage",
-      "hash": "sha256-KSicp27+WSr1qIRUFflRHbxc/eRzcOnWEVQkLYr0ekU="
+      "url": "https://downloads.cursor.com/production/d5b2fc092e16007956c9e5047f76097b9e626cab/linux/x64/Cursor-3.5.17-x86_64.AppImage",
+      "hash": "sha256-hOo7SIITt8GnzChwPCmAXIyOJBhiSV+fQ3ovLFAT49c="
    },
    "aarch64-linux": {
-      "url": "https://downloads.cursor.com/production/f736016b0aa20ba1f99b7eec1dda48579fa4c295/linux/arm64/Cursor-3.4.16-aarch64.AppImage",
-      "hash": "sha256-EHRffgia7L7l/WXtODIaeFUpfS5WD9mvwR7muPcycgY="
+      "url": "https://downloads.cursor.com/production/d5b2fc092e16007956c9e5047f76097b9e626cab/linux/arm64/Cursor-3.5.17-aarch64.AppImage",
+      "hash": "sha256-sutJMIhZw45glApbzOrUXleIGkrYeC8lGarc7pckuTg="
    },
    "x86_64-darwin": {
-      "url": "https://downloads.cursor.com/production/f736016b0aa20ba1f99b7eec1dda48579fa4c295/darwin/x64/Cursor-darwin-x64.dmg",
-      "hash": "sha256-g2jrQNiYI2ekIOsaTeWfbvn2gLVDeBzRo4/jvNHNlSY="
+      "url": "https://downloads.cursor.com/production/d5b2fc092e16007956c9e5047f76097b9e626cab/darwin/x64/Cursor-darwin-x64.dmg",
+      "hash": "sha256-0sJSQJyhu2RZhHaU/nr7/whKt31vFq6Tmxr9NOWlJ2g="
    },
    "aarch64-darwin": {
-      "url": "https://downloads.cursor.com/production/f736016b0aa20ba1f99b7eec1dda48579fa4c295/darwin/arm64/Cursor-darwin-arm64.dmg",
-      "hash": "sha256-PbU8WqoMyG2/9D7/iWWeqAxEgycH1kGUj7pfH5b4GqI="
+      "url": "https://downloads.cursor.com/production/d5b2fc092e16007956c9e5047f76097b9e626cab/darwin/arm64/Cursor-darwin-arm64.dmg",
+      "hash": "sha256-7POR+9pveTdR9WYx0/OdgOhF8yTkiZwhzg0jKEfWrfs="
    }
  }
 }
--- a/pkgs/by-name/co/codex/package.nix
+++ b/pkgs/by-name/co/codex/package.nix
@ -25,18 +25,18 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "codex";
-  version = "0.131.0";
+  version = "0.133.0";

  src = fetchFromGitHub {
    owner = "openai";
    repo = "codex";
    tag = "rust-v${finalAttrs.version}";
-    hash = "sha256-pWQxDJZO+xbY8aax9QRQRtx/BJw+4CZRL65W3Od4Ep8=";
+    hash = "sha256-RTxhhZjZ/64N60pmbNVzLwcSBomn67pPDpOjkL6RPUw=";
  };

  sourceRoot = "${finalAttrs.src.name}/codex-rs";

-  cargoHash = "sha256-CaCYBg8U4pxi3EFBH81k1dWtGY1AL/cZmP9ZtvjDxzw=";
+  cargoHash = "sha256-J4wvPn4lSTSsJrTG56vkhJe2F2b+fUvJLEd+qKQ9LUg=";

  # Match upstream's release build for the codex binary only.
  cargoBuildFlags = [
--- a/pkgs/by-name/co/cohomcalg/package.nix
+++ b/pkgs/by-name/co/cohomcalg/package.nix
@ -49,5 +49,6 @@ stdenv.mkDerivation (finalAttrs: {
    homepage = "https://github.com/BenjaminJurke/cohomCalg";
    license = lib.licenses.gpl3Only;
    maintainers = with lib.maintainers; [ coolcuber ];
+    platforms = lib.platforms.unix;
  };
 })
--- a/pkgs/by-name/co/comma/package.nix
+++ b/pkgs/by-name/co/comma/package.nix
@ -1,6 +1,5 @@
 {
  stdenv,
-  comma,
  fetchFromGitHub,
  installShellFiles,
  fzy,
@ -8,7 +7,7 @@
  nix-index-unwrapped,
  nix,
  rustPlatform,
-  testers,
+  versionCheckHook,
  buildPackages,
 }:

@ -16,10 +15,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
  pname = "comma";
  version = "2.4.1";

+  __structuredAttrs = true;
+
  src = fetchFromGitHub {
    owner = "nix-community";
    repo = "comma";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
    hash = "sha256-XZB0zx4wyNzy0LggAmh2gT2aEWAqVI9NljRoOkeK0c8=";
  };

@ -56,9 +57,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
    installManPage comma.1
  '';

-  passthru.tests = {
-    version = testers.testVersion { package = comma; };
-  };
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;

  meta = {
    homepage = "https://github.com/nix-community/comma";
--- a/pkgs/by-name/co/copilot-language-server/package.nix
+++ b/pkgs/by-name/co/copilot-language-server/package.nix
@ -10,11 +10,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "copilot-language-server";
-  version = "1.487.0";
+  version = "1.495.0";

  src = fetchzip {
    url = "https://github.com/github/copilot-language-server-release/releases/download/${finalAttrs.version}/copilot-language-server-js-${finalAttrs.version}.zip";
-    hash = "sha256-v7bYNfpN7xFg4Zc0kb3RpwSBqUew3wG7JdX6BM7nzxI=";
+    hash = "sha256-6ld4pAyC0zS0T1kLNKtEywFrVMTUOdN3edbtjVhjlpY=";
    stripRoot = false;
  };

--- a/pkgs/by-name/cu/curtail/package.nix
+++ b/pkgs/by-name/cu/curtail/package.nix
@ -4,6 +4,7 @@
  fetchFromGitHub,
  wrapGAppsHook4,
  appstream-glib,
+  blueprint-compiler,
  desktop-file-utils,
  gettext,
  gtk4,
@ -22,19 +23,20 @@

 python3.pkgs.buildPythonApplication (finalAttrs: {
  pname = "curtail";
-  version = "1.15.1";
+  version = "1.16.1";
  pyproject = false;

  src = fetchFromGitHub {
    owner = "Huluti";
    repo = "Curtail";
    tag = finalAttrs.version;
-    hash = "sha256-NPLixVrlM8i+AWcQ/poYGfBn0t8HOTUTryJf3VXy3lM=";
+    hash = "sha256-vegtuuGyjfr0vJgaGLTkws/BysxHeVod/C9bz8lnJpo=";
  };

  nativeBuildInputs = [
    wrapGAppsHook4
    appstream-glib
+    blueprint-compiler
    desktop-file-utils
    gettext
    gtk4
--- a/pkgs/by-name/db/dblab/package.nix
+++ b/pkgs/by-name/db/dblab/package.nix
@ -7,13 +7,13 @@

 buildGoModule (finalAttrs: {
  pname = "dblab";
-  version = "0.38.0";
+  version = "0.39.0";

  src = fetchFromGitHub {
    owner = "danvergara";
    repo = "dblab";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-0tkIDWAub+wfoJ760m1kU7XYnGNner/zLtCod6UPF60=";
+    hash = "sha256-tiB1nX3sm/pZpOFgNyhgxDsEzk0QcJQjwTLYx17LQMI=";
  };

  vendorHash = "sha256-UGnbXjXnZ3EVcAk0ZTaV2wWWXv5nsbyNlTv8PMl2rP4=";
--- a/pkgs/by-name/dc/dcp/package.nix
+++ b/pkgs/by-name/dc/dcp/package.nix
@ -15,16 +15,16 @@

 buildGoModule (finalAttrs: {
  pname = "dcp";
-  version = "0.23.4";
+  version = "0.24.3";

  src = fetchFromGitHub {
    owner = "microsoft";
    repo = "dcp";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-4hGFoFmVltr2oS1Bq7bB0V1TYnh2QEleFG29A0VfZYM=";
+    hash = "sha256-SHMthGpQ3zKJXmltIjSEI0vq1fysdUCs1rIiaBHi0JI=";
  };

-  vendorHash = "sha256-f5NcEgkBzOdYqBdVGYoL8EYew6LXmZwpNiIQeoett/k=";
+  vendorHash = "sha256-hcuVUUr3kr3iBmSEhHy365LIWGGLFTYnBRa5jnt7kPw=";

  # This is required so we:
  # - Delete an inconsistent vendor directory from upstream
--- a/pkgs/by-name/de/deja-dup/package.nix
+++ b/pkgs/by-name/de/deja-dup/package.nix
@ -28,14 +28,14 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "deja-dup";
-  version = "50.0";
+  version = "50.1";

  src = fetchFromGitLab {
    domain = "gitlab.gnome.org";
    owner = "World";
    repo = "deja-dup";
    tag = finalAttrs.version;
-    hash = "sha256-sdUyKRksi0ZvheivQVcDRBh7t6PoFeQ1mf4ygSTk4b4=";
+    hash = "sha256-c4Myy1nV6CupGG53Iqm0Z82yVx/Llgot4IZCrnubacE=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/de/deja/package.nix
+++ b/pkgs/by-name/de/deja/package.nix
@ -0,0 +1,41 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  nix-update-script,
+  versionCheckHook,
+}:
+buildGoModule (finalAttrs: {
+  pname = "deja";
+  version = "0.2.5";
+  __structuredAttrs = true;
+  src = fetchFromGitHub {
+    owner = "Giammarco-Ferranti";
+    repo = "deja";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-0eRXPtm+L1C4/fc/WLn9p2LV8uhJ4w+40hhA69+CEdw=";
+  };
+
+  vendorHash = "sha256-KmLdMK94cGOXMPJwWS6NgLB5OiNmJbszHdnLzauqJm8=";
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X main.version=${finalAttrs.version}"
+  ];
+
+  doCheck = true;
+
+  nativeCheckInputs = [ versionCheckHook ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Predictive inline shell autosuggestions for zsh";
+    homepage = "https://github.com/Giammarco-Ferranti/deja";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [ tomasrivera ];
+    mainProgram = "deja";
+  };
+})
--- a/pkgs/by-name/di/displaycal/package.nix
+++ b/pkgs/by-name/di/displaycal/package.nix
@ -16,7 +16,7 @@
 python3.pkgs.buildPythonApplication (finalAttrs: {
  pname = "displaycal";
  version = "3.9.17";
-  format = "setuptools";
+  pyproject = true;

  src = fetchPypi {
    pname = "DisplayCAL";
@ -29,7 +29,9 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
    gtk3
  ];

-  propagatedBuildInputs = with python3.pkgs; [
+  build-system = with python3.pkgs; [ setuptools ];
+
+  dependencies = with python3.pkgs; [
    build
    certifi
    wxpython
--- a/pkgs/by-name/dm/dmensamenu/package.nix
+++ b/pkgs/by-name/dm/dmensamenu/package.nix
@ -9,7 +9,7 @@
 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "dmensamenu";
  version = "1.2.2";
-  format = "setuptools";
+  pyproject = true;

  src = fetchFromGitHub {
    owner = "dotlambda";
@ -24,6 +24,8 @@ python3Packages.buildPythonApplication (finalAttrs: {
    })
  ];

+  build-system = with python3Packages; [ setuptools ];
+
  dependencies = with python3Packages; [
    requests
  ];
--- a/pkgs/by-name/do/doggo/package.nix
+++ b/pkgs/by-name/do/doggo/package.nix
@ -9,16 +9,16 @@

 buildGoModule (finalAttrs: {
  pname = "doggo";
-  version = "1.1.5";
+  version = "1.1.6";

  src = fetchFromGitHub {
    owner = "mr-karan";
    repo = "doggo";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-x3A/Grg5ZLi8l3bvMPGmVFB9EcaEAO158daB8WV8Yqg=";
+    hash = "sha256-NPbBQ11QuNKDtNnh8OoVpSsnC62078HYtE4E6esf6Hs=";
  };

-  vendorHash = "sha256-5GU3d2TfKjCe4DSw177egJkEhRvPqHI1SoROrh2CIS8=";
+  vendorHash = "sha256-JMyGYG3cLOZmH9EcLPe+5+ViHv7Z7brLj5uqJrPYm7A=";
  nativeBuildInputs = [ installShellFiles ];
  subPackages = [ "cmd/doggo" ];

--- a/pkgs/by-name/el/elastic/package.nix
+++ b/pkgs/by-name/el/elastic/package.nix
@ -19,14 +19,14 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "elastic";
-  version = "1.0.2";
+  version = "1.0.3";

  src = fetchFromGitLab {
    domain = "gitlab.gnome.org";
    owner = "World";
    repo = "elastic";
    rev = finalAttrs.version;
-    hash = "sha256-zOqOAUbPjyVl/96oVBhsjBrSMGt+NEbraznNGu374dM=";
+    hash = "sha256-NAxztd+Q5TlBAuXCgGPT6aTfj5mVsNdU+5WoNM8Bb84=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/es/esphome/dashboard.nix
+++ b/pkgs/by-name/es/esphome/dashboard.nix
@ -13,14 +13,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "esphome-dashboard";
-  version = "20260408.1";
+  version = "20260425.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "esphome";
    repo = "dashboard";
    tag = finalAttrs.version;
-    hash = "sha256-OY7s/b0rWmjI9QfmEwj3VxbTFrj99fyf9x1tPl24RbI=";
+    hash = "sha256-OhvRPIvytLmWkIvO45arikC3+7WCTdsEOwswuSAx0XA=";
  };

  npmDeps = fetchNpmDeps {
--- a/pkgs/by-name/es/esphome/package.nix
+++ b/pkgs/by-name/es/esphome/package.nix
@ -33,14 +33,14 @@ let
 in
 python.pkgs.buildPythonApplication (finalAttrs: {
  pname = "esphome";
-  version = "2026.4.5";
+  version = "2026.5.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "esphome";
    repo = "esphome";
    tag = finalAttrs.version;
-    hash = "sha256-uMlkrHg4cZYsdSv8D8U57mEZnjwcRkJe2zKI8VFsTRk=";
+    hash = "sha256-oWlzpBzDOSrXv+gOnFSL7TQqDZJc3oN2RoAW2ywFCGo=";
  };

  patches = [
@ -73,7 +73,7 @@ python.pkgs.buildPythonApplication (finalAttrs: {
  postPatch = ''
    substituteInPlace pyproject.toml \
      --replace-fail "setuptools==82.0.1" "setuptools" \
-      --replace-fail "wheel>=0.43,<0.47" "wheel"
+      --replace-fail "wheel>=0.43,<0.48" "wheel"
  '';

  # Remove esptool and platformio from requirements
@ -189,6 +189,7 @@ python.pkgs.buildPythonApplication (finalAttrs: {
    # Patched to run platformio without the esphome wrapper
    "test_run_platformio_cli_strips_win_long_path_prefix"
    "test_run_platformio_cli_does_not_set_pythonexepath_without_strip"
+    "test_patch_file_downloader_recovers_against_real_server"
  ];

  passthru = {
--- a/pkgs/by-name/es/esphome/platformio-binary-reference.patch
+++ b/pkgs/by-name/es/esphome/platformio-binary-reference.patch
@ -1,12 +1,12 @@
-diff --git a/esphome/platformio_api.py b/esphome/platformio_api.py
-index 81ff01306..2dfa523dd 100644
--- a/esphome/platformio_api.py
-+++ b/esphome/platformio_api.py
+diff --git a/esphome/platformio/toolchain.py b/esphome/platformio/toolchain.py
+index 073e134ac4..2dfa523ddc 100644
+--- a/esphome/platformio/toolchain.py
+++ b/esphome/platformio/toolchain.py
@@ -64,7 +64,7 @@ def run_platformio_cli(*args, **kwargs) -> str | int:
         # a user-provided value (or the unmodified path on platforms that
         # don't need the strip).
         os.environ["PYTHONEXEPATH"] = python_exe
-    cmd = [python_exe, "-m", "esphome.platformio_runner"] + list(args)
+-    cmd = [python_exe, "-m", "esphome.platformio.runner"] + list(args)
 +    cmd = ["platformio"] + list(args)
 
     return run_external_process(*cmd, **kwargs)
--- a/pkgs/by-name/ev/evcc/package.nix
+++ b/pkgs/by-name/ev/evcc/package.nix
@ -17,33 +17,21 @@
 }:

 let
-  version = "0.306.3";
+  version = "0.307.0";

  src = fetchFromGitHub {
    owner = "evcc-io";
    repo = "evcc";
    tag = version;
-    hash = "sha256-6j4GTAgC5xvLkaNaOQQBkjINI4Wg57IHVVUoDY/rfBo=";
+    hash = "sha256-G6+8cJF+So9kePDpNlFGuvsTU5+KXg9dlgaMnElWwL8=";
  };

-  vendorHash = "sha256-JBhx1K8E2BynsgjXBno+0OUpWF15Eyo9yBzofruBEck=";
+  vendorHash = "sha256-ie5wCRgGj8DeotYD/GrDP9qTnonTJsMqj1fBqHNR84M=";

  commonMeta = {
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ hexa ];
  };
-
-  decorate = buildGo126Module {
-    pname = "evcc-decorate";
-    inherit version src vendorHash;
-
-    subPackages = "cmd/decorate";
-
-    meta = commonMeta // {
-      description = "EVCC decorate helper";
-      homepage = "https://github.com/evcc-io/evcc/tree/master/cmd/decorate";
-    };
-  };
 in

 buildGo126Module rec {
@ -52,7 +40,7 @@ buildGo126Module rec {

  npmDeps = fetchNpmDeps {
    inherit src;
-    hash = "sha256-PL16KEA5XaJjE5SvziMxdjlG2j7fQutfOoSvruxGJHQ=";
+    hash = "sha256-CtZoPtpENUfaVvs2zozBWsMYD8ZJFAXig7sYcNNLwzY=";
  };

  nativeBuildInputs = [
@ -62,7 +50,6 @@ buildGo126Module rec {

  overrideModAttrs = _: {
    nativeBuildInputs = [
-      decorate
      enumer
      go_1_26
      gokrazy
@ -106,7 +93,6 @@ buildGo126Module rec {
    [ "-skip=^${lib.concatStringsSep "$|^" skippedTests}$" ];

  passthru = {
-    inherit decorate;
    tests = {
      inherit (nixosTests) evcc;
    };
--- a/pkgs/by-name/ev/evince/package.nix
+++ b/pkgs/by-name/ev/evince/package.nix
@ -42,7 +42,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "evince";
-  version = "48.1";
+  version = "48.4";

  outputs = [
    "out"
@ -52,7 +52,7 @@ stdenv.mkDerivation (finalAttrs: {

  src = fetchurl {
    url = "mirror://gnome/sources/evince/${lib.versions.major finalAttrs.version}/evince-${finalAttrs.version}.tar.xz";
-    hash = "sha256-fYuab6OgXT9bkEiFkCdojHOniP9ukjvDlFEmiElD+hA=";
+    hash = "sha256-8pbFxmKIZjXUzVl+isCvzeeYK+RIZTPCt/CVsmi+hmg=";
  };

  depsBuildBuild = [
--- a/pkgs/by-name/ey/eyedropper/package.nix
+++ b/pkgs/by-name/ey/eyedropper/package.nix
@ -20,18 +20,18 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "eyedropper";
-  version = "2.1.0";
+  version = "2.2.1";

  src = fetchFromGitHub {
    owner = "FineFindus";
    repo = "eyedropper";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-t/OFA4oDXtnMmyFptG7zsGW5ubaSNrSnaDR1l9nVbLQ=";
+    hash = "sha256-008VFC2jjLWW6t6e7C8ZEoD+hFFqJVSmlgovO2RHGjw=";
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
    inherit (finalAttrs) pname src version;
-    hash = "sha256-39BWpyGhX6fYzxwrodiK1A3ASuRiI7tOA+pSKu8Bx5Q=";
+    hash = "sha256-P5Ligi6yfSHPHjO5Gsxsf7ZbXh3GOK/q8k4GqNnsQck=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/fi/fira-sans/package.nix
+++ b/pkgs/by-name/fi/fira-sans/package.nix
@ -21,7 +21,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    stripRoot = false;
  };

-  postInstall = ''
+  preInstall = ''
    rm -r "__MACOSX"
  '';

--- a/pkgs/by-name/fl/flare-signal/package.nix
+++ b/pkgs/by-name/fl/flare-signal/package.nix
@ -24,18 +24,18 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "flare";
-  version = "0.20.4";
+  version = "0.20.5";

  src = fetchFromGitLab {
    owner = "schmiddi-on-mobile";
    repo = "flare";
    tag = finalAttrs.version;
-    hash = "sha256-Py5NKH8kBIBMfq3tz59fz5MZdPE6DC6NS2m5HlhSf5M=";
+    hash = "sha256-ZxUIqfEQe7tv6HBwOMLKruYDNJLlRie3nztwVER6sAE=";
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
    inherit (finalAttrs) pname version src;
-    hash = "sha256-DD6bqw0RUClkjClS2QjYOt3PMKy3d9uRZVBf7bVR4hg=";
+    hash = "sha256-dNcHPLoKbHFj73Xtb4Ud42xKmmLy9eADUnsqPj9+l8Y=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/fl/flexget/package.nix
+++ b/pkgs/by-name/fl/flexget/package.nix
@ -7,14 +7,14 @@

 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "flexget";
-  version = "3.19.17";
+  version = "3.19.21";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "Flexget";
    repo = "Flexget";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-0NSK7yUWw/fUmhNdP+/KVgyKTpsk131yxtP5yMQMc2c=";
+    hash = "sha256-rwG+D1XE6Am5B2gt8iOyaTrfwRV1dCvkAj5BeQeX4cw=";
  };

  pythonRelaxDeps = true;
--- a/pkgs/by-name/fo/fop/fix-maven-plugin-versions.patch
+++ b/pkgs/by-name/fo/fop/fix-maven-plugin-versions.patch
@ -0,0 +1,72 @@
+diff --git a/pom.xml b/pom.xml
+index 8f135d34c..f4e972e2d 100644
+--- a/pom.xml
+++ b/pom.xml
+@@ -92,6 +92,41 @@
+           <artifactId>maven-jar-plugin</artifactId>
+           <version>${jar.plugin.version}</version>
+         </plugin>
+        <plugin>
+          <groupId>org.apache.maven.plugins</groupId>
+          <artifactId>maven-site-plugin</artifactId>
+          <version>3.20.0</version>
+        </plugin>
+        <plugin>
+          <groupId>org.apache.maven.plugins</groupId>
+          <artifactId>maven-clean-plugin</artifactId>
+          <version>3.2.0</version>
+        </plugin>
+        <plugin>
+          <groupId>org.apache.maven.plugins</groupId>
+          <artifactId>maven-install-plugin</artifactId>
+          <version>3.1.3</version>
+        </plugin>
+        <plugin>
+          <groupId>org.apache.maven.plugins</groupId>
+          <artifactId>maven-deploy-plugin</artifactId>
+          <version>3.1.2</version>
+        </plugin>
+        <plugin>
+          <groupId>org.apache.maven.plugins</groupId>
+          <artifactId>maven-resources-plugin</artifactId>
+          <version>3.3.1</version>
+        </plugin>
+        <plugin>
+          <groupId>org.apache.maven.plugins</groupId>
+          <artifactId>maven-dependency-plugin</artifactId>
+          <version>3.7.0</version>
+        </plugin>
+        <plugin>
+          <groupId>org.apache.maven.plugins</groupId>
+          <artifactId>maven-assembly-plugin</artifactId>
+          <version>3.7.1</version>
+        </plugin>
+         <plugin>
+           <groupId>org.apache.maven.plugins</groupId>
+           <artifactId>maven-project-info-reports-plugin</artifactId>
+@@ -107,6 +142,25 @@
+           <artifactId>spotbugs-maven-plugin</artifactId>
+           <version>${findbugs.plugin.version}</version>
+         </plugin>        
+        <plugin>
+          <groupId>org.apache.maven.plugins</groupId>
+          <artifactId>maven-enforcer-plugin</artifactId>
+          <version>3.5.0</version>
+          <configuration>
+            <rules>
+              <requirePluginVersions />
+            </rules>
+          </configuration>
+          <executions>
+            <execution>
+              <id>require-all-plugin-versions-to-be-set</id>
+              <phase>validate</phase>
+              <goals>
+                <goal>enforce</goal>
+              </goals>
+            </execution>
+          </executions>
+        </plugin>
+       </plugins>
+     </pluginManagement>
+   </build>
--- a/pkgs/by-name/fo/fop/package.nix
+++ b/pkgs/by-name/fo/fop/package.nix
@ -16,6 +16,8 @@ maven.buildMavenPackage rec {
    hash = "sha256-uY6cUjmyuenfK3jAWvugsYa5qg8rbnvRZZ6qA/g2fZM=";
  };

+  patches = [ ./fix-maven-plugin-versions.patch ];
+
  mvnHash = "sha256-EaOIAy0+YPrF+yGsFKKqcA4bt90bq1Z86V57P9rMatE=";

  buildOffline = true;
--- a/pkgs/by-name/fr/fragment-mono/package.nix
+++ b/pkgs/by-name/fr/fragment-mono/package.nix
@ -2,24 +2,24 @@
  lib,
  stdenvNoCC,
  fetchzip,
+  installFonts,
 }:

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "fragment-mono";
  version = "1.21";

+  outputs = [
+    "out"
+    "webfont"
+  ];
+
  src = fetchzip {
    url = "https://github.com/weiweihuanghuang/fragment-mono/releases/download/${finalAttrs.version}/fragment-mono-${finalAttrs.version}.zip";
    hash = "sha256-H5s4rYDN2d0J+zVRgBzg8vfZXCA/jjHrGBV8o8Dxutc=";
  };

-  installPhase = ''
-    runHook preInstall
-
-    install -Dm644 fonts/ttf/*.ttf -t $out/share/fonts/truetype
-
-    runHook postInstall
-  '';
+  nativeBuildInputs = [ installFonts ];

  meta = {
    homepage = "https://github.com/weiweihuanghuang/fragment-mono";
--- a/pkgs/by-name/fr/frobby/package.nix
+++ b/pkgs/by-name/fr/frobby/package.nix
@ -65,5 +65,6 @@ stdenv.mkDerivation (finalAttrs: {
    homepage = "https://github.com/Macaulay2/frobby";
    license = lib.licenses.gpl2Plus;
    maintainers = with lib.maintainers; [ coolcuber ];
+    platforms = lib.platforms.unix;
  };
 })
--- a/pkgs/by-name/ga/gaphor/package.nix
+++ b/pkgs/by-name/ga/gaphor/package.nix
@ -13,20 +13,21 @@
 }:
 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "gaphor";
-  version = "3.3.1";
+  version = "3.3.2";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "gaphor";
    repo = "gaphor";
    tag = finalAttrs.version;
-    hash = "sha256-oGOi1vyLOrElj/kbqHgPEyAwtVvVA3a1j9VSWMts/bM=";
+    hash = "sha256-oSPdWQcdt00SSdvlnAtPrsACBCiA4NlCE9Fwt4G9bjk=";
  };

  pythonRelaxDeps = [
    "pydot"
    "pygobject"
    "dulwich"
+    "jedi"
  ];

  nativeBuildInputs = [
--- a/pkgs/by-name/gh/gh-markdown-preview/package.nix
+++ b/pkgs/by-name/gh/gh-markdown-preview/package.nix
@ -8,13 +8,13 @@

 buildGoModule (finalAttrs: {
  pname = "gh-markdown-preview";
-  version = "1.11.0";
+  version = "1.11.1";

  src = fetchFromGitHub {
    owner = "yusukebe";
    repo = "gh-markdown-preview";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-Q6rTkiklSU1lh4mEKYJYXOmGlRkNUYTC/jtMkVVFRu0=";
+    hash = "sha256-CD3ZasrkAijC1msOSBJZAfIfrGKKHPIom57t+wmFdMY=";
  };

  vendorHash = "sha256-O6Q9h5zcYAoKLjuzGu7f7UZY0Y5rL2INqFyJT2QZJ/E=";
--- a/pkgs/by-name/gi/git-archive-all/package.nix
+++ b/pkgs/by-name/gi/git-archive-all/package.nix
@ -8,7 +8,7 @@
 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "git-archive-all";
  version = "1.23.1";
-  format = "setuptools";
+  pyproject = true;

  src = fetchFromGitHub {
    owner = "Kentzo";
@ -33,6 +33,8 @@ python3Packages.buildPythonApplication (finalAttrs: {
      --replace "import pycodestyle" ""
  '';

+  build-system = [ python3Packages.setuptools ];
+
  nativeCheckInputs = [
    git
  ];
--- a/pkgs/by-name/gi/gitea/package.nix
+++ b/pkgs/by-name/gi/gitea/package.nix
@ -30,7 +30,7 @@ let
      inherit (finalAttrs) pname version src;
      inherit pnpm;
      fetcherVersion = 3;
-      hash = "sha256-dewYYPO2wmNyYiQadoEKWJ10cghm6Lv7UE1iVlyNiEY=";
+      hash = "sha256-Qo0DLuZv+2GVLsBfCv/6CC9E/qhSE4HwV4StQL4HX4Y=";
    };

    nativeBuildInputs = [
@ -51,18 +51,18 @@ let
 in
 buildGoModule rec {
  pname = "gitea";
-  version = "1.26.1";
+  version = "1.26.2";

  src = fetchFromGitHub {
    owner = "go-gitea";
    repo = "gitea";
    tag = "v${gitea.version}";
-    hash = "sha256-UlPS+gcSEzKY+g5y+k3NsL3b8FRVHnlqkiuJTz5ijFM=";
+    hash = "sha256-S7KV7soOnVQbw+2Ru7+DOL3Q4uWmSSdR6K90yofQlqw=";
  };

  proxyVendor = true;

-  vendorHash = "sha256-JSyjJIdRePbSnKL6GHdjx5Xbnsniq6KHOlEFsYvMmbw=";
+  vendorHash = "sha256-7+M1n8RSgB3gZ/2na4RF9kYOf90H0bnsJZMDKpgAy64=";

  outputs = [
    "out"
@ -77,14 +77,14 @@ buildGoModule rec {
  overrideModAttrs = _: {
    postPatch = ''
      substituteInPlace go.mod \
-        --replace-fail "go 1.26.2" "go 1.26"
+        --replace-fail "go 1.26.3" "go 1.26"
    '';
  };

  postPatch = ''
    substituteInPlace modules/setting/server.go --subst-var data
    substituteInPlace go.mod \
-      --replace-fail "go 1.26.2" "go 1.26"
+      --replace-fail "go 1.26.3" "go 1.26"
  '';

  subPackages = [ "." ];
--- a/pkgs/by-name/gi/gitfs/package.nix
+++ b/pkgs/by-name/gi/gitfs/package.nix
@ -1,60 +0,0 @@
-{
-  lib,
-  fetchFromGitHub,
-  python3Packages,
-}:
-
-python3Packages.buildPythonApplication rec {
-  pname = "gitfs";
-  version = "0.5.2";
-  format = "setuptools";
-
-  src = fetchFromGitHub {
-    owner = "PressLabs";
-    repo = "gitfs";
-    rev = version;
-    sha256 = "1jzwdwan8ndvp2lw6j7zbvg5k9rgf2d8dcxjrwc6bwyk59xdxn4p";
-  };
-
-  patchPhase = ''
-    # requirement checks are unnecessary at runtime
-    echo > requirements.txt
-
-    # NOTE: As of gitfs 0.5.2, The pygit2 release that upstream uses is a major
-    # version behind the one packaged in nixpkgs.
-    substituteInPlace gitfs/mounter.py --replace \
-      'from pygit2.remote import RemoteCallbacks' \
-      'from pygit2 import RemoteCallbacks'
-  '';
-
-  nativeCheckInputs = with python3Packages; [
-    pytestCheckHook
-    pytest-cov-stub
-    mock
-  ];
-  propagatedBuildInputs = with python3Packages; [
-    atomiclong
-    fusepy
-    pygit2
-    six
-  ];
-
-  pythonImportsCheck = [ "gitfs" ];
-
-  meta = {
-    description = "FUSE filesystem that fully integrates with git";
-    longDescription = ''
-      A git remote repository's branch can be mounted locally,
-      and any subsequent changes made to the files will be
-      automatically committed to the remote.
-    '';
-    homepage = "https://github.com/PressLabs/gitfs";
-    license = lib.licenses.asl20;
-    platforms = lib.platforms.unix;
-    maintainers = [ lib.maintainers.robbinch ];
-    mainProgram = "gitfs";
-    # requires <=python39, otherwise you get this at runtime:
-    # AttributeError: module 'collections' has no attribute 'MutableMapping'
-    broken = true;
-  };
-}
--- a/pkgs/by-name/gi/github-copilot-cli/package.nix
+++ b/pkgs/by-name/gi/github-copilot-cli/package.nix
@ -4,6 +4,8 @@
  autoPatchelfHook,
  cacert,
  fetchurl,
+  glib,
+  libsecret,
  makeBinaryWrapper,
  bash,
  nodejs,
@ -28,12 +30,25 @@ stdenv.mkDerivation (finalAttrs: {
    makeBinaryWrapper
  ]
  ++ lib.optionals stdenv.hostPlatform.isLinux [ autoPatchelfHook ];
-  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [ stdenv.cc.cc.lib ];
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
+    stdenv.cc.cc.lib
+    glib
+    libsecret
+  ];
  sourceRoot = "package";
  dontStrip = true;
-  # keytar.node and computer.node have optional system-library deps not provided
-  # here; ignore missing deps rather than fail the build.
-  autoPatchelfIgnoreMissingDeps = true;
+  # computer.node requires GUI/media libraries (X11, pipewire, libei, libjpeg,
+  # libpng) for screen-capture and input-simulation features that are not
+  # relevant for CLI use; ignore those missing deps rather than fail the build
+  # or pull in heavy dependencies.
+  autoPatchelfIgnoreMissingDeps = [
+    "libX11.so.6"
+    "libXtst.so.6"
+    "libjpeg.so.8"
+    "libpng16.so.16"
+    "libpipewire-0.3.so.0"
+    "libei.so.1"
+  ];

  installPhase = ''
    runHook preInstall
@ -69,6 +84,7 @@ stdenv.mkDerivation (finalAttrs: {
    license = lib.licenses.unfree;
    maintainers = with lib.maintainers; [
      dbreyfogle
+      me-and
    ];
    mainProgram = "copilot";
    platforms = [
--- a/pkgs/by-name/gl/glab/package.nix
+++ b/pkgs/by-name/gl/glab/package.nix
@ -13,13 +13,13 @@

 buildGoModule (finalAttrs: {
  pname = "glab";
-  version = "1.93.0";
+  version = "1.99.0";

  src = fetchFromGitLab {
    owner = "gitlab-org";
    repo = "cli";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-ra+cXfB5DtFXmpgxSTZuXUgRY8Uzsxc84cmmAGq06AE=";
+    hash = "sha256-RDOBNZIbHTA1vuOvNVBSzKKxe8kvy6sx1oVGd7fdFuo=";
    leaveDotGit = true;
    postFetch = ''
      cd "$out"
@ -28,7 +28,7 @@ buildGoModule (finalAttrs: {
    '';
  };

-  vendorHash = "sha256-FBYTwTGQ2ma4dEeCGpvduGAPux5g7MsxBHQy8QXXVgQ=";
+  vendorHash = "sha256-82BAOGylNXjGh1nOPqc4yNKoFHUgarTgjwlM31kih0I=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/gl/glaze/package.nix
+++ b/pkgs/by-name/gl/glaze/package.nix
@ -11,13 +11,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "glaze";
-  version = "7.6.0";
+  version = "7.7.0";

  src = fetchFromGitHub {
    owner = "stephenberry";
    repo = "glaze";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-3sRWE+kEde9LVQ4mSL/2vplS2nF1BYGGIdwQHadY0uA=";
+    hash = "sha256-CxuNDOjdF6zYs0zRptqNJgfQondUSaN1AZanksG4U8s=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/by-name/go/gotlsaflare/package.nix
+++ b/pkgs/by-name/go/gotlsaflare/package.nix
@ -8,16 +8,16 @@

 buildGoModule (finalAttrs: {
  pname = "gotlsaflare";
-  version = "2.8.2";
+  version = "2.8.3";

  src = fetchFromGitHub {
    owner = "Stenstromen";
    repo = "gotlsaflare";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-r2stN75+5BLCogEXWFCnWKuUl26SXIrjxENbmU6zlXc=";
+    hash = "sha256-Zw8RfwAR6dw4YUSdML1QJCXVj1s9ZNzr3LTb2vt2fjI=";
  };

-  vendorHash = "sha256-Hr8SK4kHhXn8mxZrmyxZgs95tt1x2nBUoe4CW+4fOXA=";
+  vendorHash = "sha256-OaaIhXh9+iqMBnP4pHxuJMynXxvfY6iiv+Cd4Dq1I+I=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/by-name/h2/h2o/package.nix
+++ b/pkgs/by-name/h2/h2o/package.nix
@ -24,13 +24,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "h2o";
-  version = "2.3.0-rolling-2026-04-30";
+  version = "2.3.0-rolling-2026-05-15";

  src = fetchFromGitHub {
    owner = "h2o";
    repo = "h2o";
-    rev = "8cb324bd2d5efb1926d0b8408b1d367687e50cfa";
-    hash = "sha256-4GS2hQzBJXA0C9ClWGppocBdjO4BHDK2Balm0O8Ps/I=";
+    rev = "9e7f283e5801bd0707cc5d48d0188c4c162fe7b3";
+    hash = "sha256-8FdUQLX67E+7f4HyoH6atLDxYzniVEFqc+jbjzTytFM=";
  };

  outputs = [
--- a/pkgs/by-name/ha/har-to-k6/package.nix
+++ b/pkgs/by-name/ha/har-to-k6/package.nix
@ -8,18 +8,18 @@

 buildNpmPackage rec {
  pname = "har-to-k6";
-  version = "0.14.14";
+  version = "0.14.15";

  src = fetchFromGitHub {
    owner = "grafana";
    repo = "har-to-k6";
    tag = "v${version}";
-    hash = "sha256-03WhzmdmncM7YqavYnivzxD3oo48MAkrn/1qTcK8w7o=";
+    hash = "sha256-8cMq0fWBRPR9SmPMSgjulA//BN91xZbFVPCYxxULRKQ=";
  };

  dontNpmBuild = true;

-  npmDepsHash = "sha256-ZVBlHjDB5LbOWXuoz4IIQF0lqDGANxpPE1sAy9roxbo=";
+  npmDepsHash = "sha256-7YPlXrBxO3Zdm+3vkHdcCABV1dUJ6BCPwCZ4IFKZjT4=";

  nativeInstallCheckInputs = [ versionCheckHook ];
  doInstallCheck = true;
--- a/pkgs/by-name/he/hello/package.nix
+++ b/pkgs/by-name/he/hello/package.nix
@ -7,6 +7,7 @@
  testers,
  versionCheckHook,
  hello,
+  gettext,
  gnulib,
 }:

@ -30,6 +31,10 @@ stdenv.mkDerivation (finalAttrs: {
    NIX_LDFLAGS = "-liconv";
  };

+  buildInputs = lib.optionals stdenv.hostPlatform.isFreeBSD [
+    gettext
+  ];
+
  doCheck = true;

  doInstallCheck = true;
--- a/pkgs/by-name/hl/hledger-fmt/package.nix
+++ b/pkgs/by-name/hl/hledger-fmt/package.nix
@ -9,20 +9,20 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "hledger-fmt";
-  version = "0.3.8";
+  version = "0.3.9";

  src = fetchFromGitHub {
    owner = "mondeja";
    repo = "hledger-fmt";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-GbDZ6fvzd6/flASqy86km1LZ+B+loy0odmRQRfdkcCs=";
+    hash = "sha256-knwrx1hfSBmgZLqmcAOf4Rtc5yVO50IdrzovAgOgQD0=";
  };

  nativeBuildInputs = [
    installShellFiles
  ];

-  cargoHash = "sha256-LN9D7EVbDUjNa/eCmuBT2kghzDqoXhMB5ihx40ixS1E=";
+  cargoHash = "sha256-/Tz5WqnBIU4vXKhGsODZKD1sFti797Ya6OHeg4I7Flk=";

  # Tests try to invoke the binary from "target/debug/hledger-fmt"
  # https://github.com/mondeja/hledger-fmt/blob/783abdb32eefb20195c7e9562858552935bb9c8e/src/cli/tests.rs#L5
--- a/pkgs/by-name/ht/httptoolkit-server/package.nix
+++ b/pkgs/by-name/ht/httptoolkit-server/package.nix
@ -1,30 +1,33 @@
 {
  lib,
-  nodejs_22,
+
  buildNpmPackage,
  fetchFromGitHub,
  writeShellScriptBin,
-  nss,
+
  cmake,
+  nodejs_24,
+  nss,
  pkg-config,
-  openssl,
+
  libdatachannel,
+  openssl,
  plog,
 }:

 let
-  nodejs = nodejs_22;
+  nodejs = nodejs_24;
  buildNpmPackage' = buildNpmPackage.override { inherit nodejs; };

  # update together with httptoolkit
  # nixpkgs-update: no auto update
-  version = "1.24.2";
+  version = "1.26.1";

  src = fetchFromGitHub {
    owner = "httptoolkit";
    repo = "httptoolkit-server";
    tag = "v${version}";
-    hash = "sha256-tcUQe4YIUpQ9I5nq66K7LO84mLFo8YAdHY/c2HROSpk=";
+    hash = "sha256-pCEz5bgpzEjGeBoOp3fb/WBW+loCzjvCckJTEwK0o7U=";
  };

  overridesNodeModules = buildNpmPackage' {
@ -32,7 +35,7 @@ let
    inherit version src;
    sourceRoot = "${src.name}/overrides/js";

-    npmDepsHash = "sha256-8cNGJdT8ndXa72ETttU2PjA8nfn+MTWesVVlA8GA1qQ=";
+    npmDepsHash = "sha256-B/W6kD6x10bfsuehRb9oObi+Gf3Hovm0jMNLcbuigeo=";

    dontBuild = true;

@ -65,8 +68,8 @@ let
    ];

    buildInputs = [
-      openssl
      libdatachannel
+      openssl
      plog
    ];

@ -79,14 +82,14 @@ let
      # don't use static libs and don't use FetchContent
      # don't try to link plog (it's headers-only)
      substituteInPlace CMakeLists.txt \
-          --replace-fail 'OPENSSL_USE_STATIC_LIBS TRUE' 'OPENSSL_USE_STATIC_LIBS FALSE' \
-          --replace-fail 'if(NOT libdatachannel)' 'if(false)' \
-          --replace-fail 'datachannel-static' 'datachannel' \
-          --replace-fail 'plog::plog' ""
+        --replace-fail 'OPENSSL_USE_STATIC_LIBS TRUE' 'OPENSSL_USE_STATIC_LIBS FALSE' \
+        --replace-fail 'if(NOT libdatachannel)' 'if(false)' \
+        --replace-fail 'datachannel-static' 'datachannel' \
+        --replace-fail 'plog::plog' ""

      # don't fetch node headers
      substituteInPlace node_modules/cmake-js/lib/dist.js \
-          --replace-fail '!this.downloaded' 'false'
+        --replace-fail '!this.downloaded' 'false'
    '';

    installPhase = ''
@ -102,7 +105,7 @@ buildNpmPackage' {

  patches = [ ./only-build-for-one-platform.patch ];

-  npmDepsHash = "sha256-vhTe7EccEX57h7LDtNaaLaNR8xHSOlbnLtGrs7qT7pY=";
+  npmDepsHash = "sha256-OO1QI2KNbZo/2Bl6xC6oORVfDtBqjr2tuQmk6s70znM=";

  npmFlags = [ "--ignore-scripts" ];

@ -117,8 +120,8 @@ buildNpmPackage' {
  postConfigure = ''
    # make sure `oclif-dev' doesn't fetch `node` binary to bundle with the app
    substituteInPlace node_modules/@oclif/dev-cli/lib/tarballs/node.js --replace-fail \
-        'async function fetchNodeBinary({ nodeVersion, output, platform, arch, tmp }) {' \
-        'async function fetchNodeBinary({ nodeVersion, output, platform, arch, tmp }) { return;'
+      'async function fetchNodeBinary({ nodeVersion, output, platform, arch, tmp }) {' \
+      'async function fetchNodeBinary({ nodeVersion, output, platform, arch, tmp }) { return;'

    # manually place our prebuilt `node-datachannel` binary into its place, since we used '--ignore-scripts'
    ln -s ${nodeDatachannel}/build node_modules/node-datachannel/build
@ -152,12 +155,12 @@ buildNpmPackage' {

    # disable updating functionality
    substituteInPlace $out/share/httptoolkit-server/node_modules/@oclif/plugin-update/lib/commands/update.js \
-        --replace-fail "await this.skipUpdate()" "'cannot update nix based package'"
+      --replace-fail "await this.skipUpdate()" "'cannot update nix based package'"

    # the app determines if it's in production by checking if HTTPTOOLKIT_SERVER_BINPATH is set to anything
    makeWrapper $out/share/httptoolkit-server/bin/run $out/bin/httptoolkit-server \
-        --set HTTPTOOLKIT_SERVER_BINPATH dummy \
-        --prefix PATH : ${lib.makeBinPath [ nss.tools ]}
+      --set HTTPTOOLKIT_SERVER_BINPATH dummy \
+      --prefix PATH : ${lib.makeBinPath [ nss.tools ]}

    runHook postInstall
  '';
--- a/pkgs/by-name/ht/httptoolkit/fix-paths.patch
+++ b/pkgs/by-name/ht/httptoolkit/fix-paths.patch
@ -0,0 +1,60 @@
+diff --git a/httptoolkit-ctl b/httptoolkit-ctl
+index 0878247..d299b71 100644
+--- a/httptoolkit-ctl
+++ b/httptoolkit-ctl
+@@ -1,10 +1,5 @@
+ #!/bin/sh
+ SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+-APP_DIR="$(dirname "$SCRIPT_DIR")"
+ export HTK_DESKTOP_RESOURCES="$SCRIPT_DIR"
+-if [ "$(uname)" = "Darwin" ]; then
+-    export HTK_DESKTOP_EXE="$APP_DIR/MacOS/HTTP Toolkit"
+-else
+-    export HTK_DESKTOP_EXE="$APP_DIR/httptoolkit"
+-fi
+export HTK_DESKTOP_EXE="@out@/bin/httptoolkit"
+ exec "$SCRIPT_DIR/httptoolkit-server/bin/httptoolkit-server" ctl "$@"
+diff --git a/httptoolkit-mcp b/httptoolkit-mcp
+index c27b25a..c7b3f07 100644
+--- a/httptoolkit-mcp
+++ b/httptoolkit-mcp
+@@ -1,10 +1,5 @@
+ #!/bin/sh
+ SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+-APP_DIR="$(dirname "$SCRIPT_DIR")"
+ export HTK_DESKTOP_RESOURCES="$SCRIPT_DIR"
+-if [ "$(uname)" = "Darwin" ]; then
+-    export HTK_DESKTOP_EXE="$APP_DIR/MacOS/HTTP Toolkit"
+-else
+-    export HTK_DESKTOP_EXE="$APP_DIR/httptoolkit"
+-fi
+export HTK_DESKTOP_EXE="@out@/bin/httptoolkit"
+ exec "$SCRIPT_DIR/httptoolkit-server/bin/httptoolkit-server" mcp "$@"
+diff --git a/package.json b/package.json
+index e6a9ef4..f8d7ec1 100644
+--- a/package.json
+++ b/package.json
+@@ -58,8 +58,8 @@
+     ],
+     "extraResources": [
+       "httptoolkit-server/**/*",
+-      "httptoolkit-ctl{,.*}",
+-      "httptoolkit-mcp{,.*}"
+      "httptoolkit-ctl",
+      "httptoolkit-mcp"
+     ],
+     "artifactName": "HttpToolkit-${version}-${arch}.${ext}",
+     "mac": {
+diff --git a/src/index.ts b/src/index.ts
+index 8a63c58..0511575 100644
+--- a/src/index.ts
+++ b/src/index.ts
+@@ -392,7 +392,7 @@ if (!amMainInstance) {
+             ...process.env,
+ 
+             HTK_SERVER_TOKEN: AUTH_TOKEN,
+-            HTK_DESKTOP_EXE: app.getPath('exe'),
+            HTK_DESKTOP_EXE: '@out@/bin/httptoolkit',
+             HTK_DESKTOP_RESOURCES: RESOURCES_PATH,
+             NODE_SKIP_PLATFORM_CHECK: '1',
+             OPENSSL_CONF: undefined, // Not relevant to us, and if set this can crash Node.js
--- a/pkgs/by-name/ht/httptoolkit/package.nix
+++ b/pkgs/by-name/ht/httptoolkit/package.nix
@ -1,89 +1,97 @@
 {
  lib,
  stdenv,
+
  buildNpmPackage,
  fetchFromGitHub,
-  makeWrapper,
  makeDesktopItem,
+
  copyDesktopItems,
-  electron_39,
+  makeWrapper,
+  xcbuild,
+
+  electron_41,
  httptoolkit-server,
 }:

 let
-  electron = electron_39;
+  electron = electron_41;
 in
 buildNpmPackage rec {
  pname = "httptoolkit";

  # update together with httptoolkit-server
  # nixpkgs-update: no auto update
-  version = "1.24.4";
+  version = "1.26.0";

  src = fetchFromGitHub {
    owner = "httptoolkit";
    repo = "httptoolkit-desktop";
    tag = "v${version}";
-    hash = "sha256-b1u+DFhxU/ED4GgMHFaF51zNfC+0vIg6ujyA8jIy8AQ=";
+    hash = "sha256-WEl0DGYdq1qa5zNEVO6L8TW6lgNTI0NdL0YXeR3Z0BI=";
  };

-  npmDepsHash = "sha256-FX8sClJL66zvWEaaw0lmoat7cM396RA8Rq9NgRVh0Vw=";
+  patches = [
+    ./fix-paths.patch
+  ];
+
+  postPatch = ''
+    substituteInPlace httptoolkit-{mcp,ctl} src/index.ts \
+      --replace-fail "@out@" "$out"
+  '';
+
+  npmDepsHash = "sha256-fGVxHhJU/1ZsRyX3AnP6jM/jkY0PZHKDA1tb2z06lLs=";

  makeCacheWritable = true;

-  env = {
-    ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
-    # disable code signing on Darwin
-    CSC_IDENTITY_AUTO_DISCOVERY = "false";
-  };
+  env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";

  nativeBuildInputs = [
    makeWrapper
  ]
-  ++ lib.optionals stdenv.hostPlatform.isLinux [ copyDesktopItems ];
+  ++ lib.optionals stdenv.hostPlatform.isLinux [ copyDesktopItems ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [ xcbuild ];

  npmBuildScript = "build:src";

  postBuild = ''
-    substituteInPlace package.json --replace-fail \
-        '"forceCodeSigning": true' \
-        '"forceCodeSigning": false'
-
    cp -rL ${electron.dist} electron-dist
    chmod -R u+w electron-dist

    npm exec electron-builder -- \
-        --dir \
-        -c.electronDist=electron-dist \
-        -c.electronVersion=${electron.version}
+      --dir \
+      -c.electronDist=electron-dist \
+      -c.electronVersion=${electron.version} \
+      -c.mac.forceCodeSigning=false \
+      -c.mac.identity=null
+    # ^ this disables codesigning on Darwin
  '';

  installPhase = ''
    runHook preInstall
+  ''
+  + lib.optionalString stdenv.hostPlatform.isLinux ''
+    mkdir -p $out/share/httptoolkit
+    cp -r dist/*-unpacked/{locales,resources{,.pak}} $out/share/httptoolkit

-    ${lib.optionalString stdenv.hostPlatform.isLinux ''
-      mkdir -p $out/share/httptoolkit
-      cp -r dist/*-unpacked/{locales,resources{,.pak}} $out/share/httptoolkit
+    ln -s ${httptoolkit-server} $out/share/httptoolkit/resources/httptoolkit-server

-      ln -s ${httptoolkit-server} $out/share/httptoolkit/resources/httptoolkit-server
+    install -Dm644 src/icons/icon.svg $out/share/icons/hicolor/scalable/apps/httptoolkit.svg

-      install -Dm644 src/icons/icon.svg $out/share/icons/hicolor/scalable/apps/httptoolkit.svg
+    makeWrapper ${lib.getExe electron} $out/bin/httptoolkit \
+      --add-flags $out/share/httptoolkit/resources/app.asar \
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime=true}}" \
+      --inherit-argv0
+  ''
+  + lib.optionalString stdenv.hostPlatform.isDarwin ''
+    mkdir -p $out/Applications
+    cp -r dist/mac*/"HTTP Toolkit.app" $out/Applications

-      makeWrapper ${lib.getExe electron} $out/bin/httptoolkit \
-          --add-flags $out/share/httptoolkit/resources/app.asar \
-          --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime=true}}" \
-          --inherit-argv0
-    ''}
-
-    ${lib.optionalString stdenv.hostPlatform.isDarwin ''
-      mkdir -p $out/Applications
-      cp -r dist/mac*/"HTTP Toolkit.app" $out/Applications
-
-      ln -s ${httptoolkit-server} "$out/Applications/HTTP Toolkit.app/Contents/Resources/httptoolkit-server"
-
-      makeWrapper "$out/Applications/HTTP Toolkit.app/Contents/MacOS/HTTP Toolkit" $out/bin/httptoolkit
-    ''}
+    ln -s ${httptoolkit-server} "$out/Applications/HTTP Toolkit.app/Contents/Resources/httptoolkit-server"

+    makeWrapper "$out/Applications/HTTP Toolkit.app/Contents/MacOS/HTTP Toolkit" $out/bin/httptoolkit
+  ''
+  + ''
    runHook postInstall
  '';

--- a/pkgs/by-name/ig/igraph/package.nix
+++ b/pkgs/by-name/ig/igraph/package.nix
@ -7,12 +7,13 @@
  blas,
  cmake,
  flex,
-  fop,
  glpk,
  gmp,
  lapack,
  libxml2,
  libxslt,
+  docbook_xml_dtd_43,
+  docbook_xsl,
  llvmPackages,
  pkg-config,
  plfit,
@ -48,9 +49,10 @@ stdenv.mkDerivation (finalAttrs: {
    bison
    cmake
    flex
-    fop
    libxml2
    libxslt
+    docbook_xml_dtd_43
+    docbook_xsl
    pkg-config
    python3
    sourceHighlight
@ -85,6 +87,11 @@ stdenv.mkDerivation (finalAttrs: {
    "-DBUILD_SHARED_LIBS=ON"
  ];

+  buildFlags = [
+    "all"
+    "html"
+  ];
+
  doCheck = true;

  postInstall = ''
--- a/pkgs/by-name/ip/ip2unix/package.nix
+++ b/pkgs/by-name/ip/ip2unix/package.nix
@ -20,24 +20,15 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "ip2unix";
-  version = "2.2.1";
+  version = "2.2.2";

  src = fetchFromGitHub {
    owner = "nixcloud";
    repo = "ip2unix";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-+p5wQbX35LAjZ4vIE4AhI4M6gQ7gVviqf9jJDAr9xg8";
+    hash = "sha256-QWhOO2tHl8fwXy0k9W+I/XHPJI8OJyexMsgOSJes37s";
  };

-  patches = [
-    # https://github.com/nixcloud/ip2unix/pull/35
-    # fix out of range string_view access
-    (fetchpatch {
-      url = "https://github.com/nixcloud/ip2unix/commit/050ddf76b4b925f27e255fbb820b0700407ceb2b.patch";
-      hash = "sha256-5vaLmZmwuiMGV4KnVhuDSnXG1a390aBU51TShwpaMLs=";
-    })
-  ];
-
  nativeBuildInputs = [
    meson
    ninja
--- a/pkgs/by-name/js/json-sort/package.nix
+++ b/pkgs/by-name/js/json-sort/package.nix
@ -8,7 +8,7 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "json-sort";
-  version = "1.1.0";
+  version = "1.1.5";

  __structuredAttrs = true;

@ -16,10 +16,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
    owner = "drupol";
    repo = "json-sort";
    tag = finalAttrs.version;
-    hash = "sha256-yojMXJiP87l5B7D74V6z9FNvSYebtn71GnB0d+Q7/UI=";
+    hash = "sha256-Xs1dMtPUmunkExQQ6IRmfFNz/3hVbARdtAL6K2Ur0ZQ=";
  };

-  cargoHash = "sha256-LpZIVWWb8HI1HM3m8Vhfk27bWFpU37GYssmsfEJQAVg=";
+  cargoHash = "sha256-RrNgmQ5v5zCKz/XaaLub16URmurQxfYTeNxy6UswFYY=";

  dontUseCargoParallelTests = true;

--- a/pkgs/by-name/ki/kitty/package.nix
+++ b/pkgs/by-name/ki/kitty/package.nix
@ -45,27 +45,26 @@
  makeBinaryWrapper,
  darwin,
  cairo,
-  fetchpatch,
 }:

 with python3Packages;
 buildPythonApplication rec {
  pname = "kitty";
-  version = "0.46.2";
+  version = "0.47.0";
  pyproject = false;

  src = fetchFromGitHub {
    owner = "kovidgoyal";
    repo = "kitty";
    tag = "v${version}";
-    hash = "sha256-x+jBQrg3Iaj6PLMF1hIjS46odxv5GxPMcvC9JddYCHo=";
+    hash = "sha256-QI+h7LSpJ5VYae3XdwDhKmpLqEGpmSulXP/mTop3gio=";
  };

  goModules =
    (buildGo126Module {
      pname = "kitty-go-modules";
      inherit src version;
-      vendorHash = "sha256-FaSWBeQJlvw9vXcHJ/OaFd48K8d7X86X8w7wpG84Ltw=";
+      vendorHash = "sha256-ZEiIGHj30h3l7mfJkOrPDTMI/GBtf/QDiG/lrqceggg=";
    }).goModules;

  buildInputs = [
@ -215,31 +214,36 @@ buildPythonApplication rec {
  ];

  # skip failing tests due to darwin sandbox
-  preCheck = lib.optionalString stdenv.hostPlatform.isDarwin ''
-    substituteInPlace kitty_tests/check_build.py \
-      --replace test_macos_dictation_forwarding no_test_macos_dictation_forwarding
+  preCheck =
+    lib.optionalString stdenv.hostPlatform.isDarwin ''
+      substituteInPlace kitty_tests/check_build.py \
+        --replace test_macos_dictation_forwarding no_test_macos_dictation_forwarding

-    substituteInPlace kitty_tests/file_transmission.py \
-      --replace test_transfer_send dont_test_transfer_send
+      substituteInPlace kitty_tests/file_transmission.py \
+        --replace test_transfer_send dont_test_transfer_send

-    substituteInPlace kitty_tests/ssh.py \
-      --replace test_ssh_connection_data no_test_ssh_connection_data \
-      --replace test_ssh_shell_integration no_test_ssh_shell_integration \
-      --replace test_ssh_copy no_test_ssh_copy \
-      --replace test_ssh_env_vars no_test_ssh_env_vars
+      substituteInPlace kitty_tests/ssh.py \
+        --replace test_ssh_connection_data no_test_ssh_connection_data \
+        --replace test_ssh_shell_integration no_test_ssh_shell_integration \
+        --replace test_ssh_copy no_test_ssh_copy \
+        --replace test_ssh_env_vars no_test_ssh_env_vars

-    substituteInPlace kitty_tests/shell_integration.py \
-      --replace test_fish_integration no_test_fish_integration \
-      --replace test_zsh_integration no_test_zsh_integration
+      substituteInPlace kitty_tests/shell_integration.py \
+        --replace test_fish_integration no_test_fish_integration \
+        --replace test_zsh_integration no_test_zsh_integration

-    substituteInPlace kitty_tests/fonts.py \
-      --replace test_fallback_font_not_last_resort no_test_fallback_font_not_last_resort
+      substituteInPlace kitty_tests/fonts.py \
+        --replace test_fallback_font_not_last_resort no_test_fallback_font_not_last_resort

-    # theme collection test starts an http server
-    rm tools/themes/collection_test.go
-    # passwd_test tries to exec /usr/bin/dscl
-    rm tools/utils/passwd_test.go
-  '';
+      # theme collection test starts an http server
+      rm tools/themes/collection_test.go
+      # passwd_test tries to exec /usr/bin/dscl
+      rm tools/utils/passwd_test.go
+    ''
+    + ''
+      # These depend on files that are not available in the sandbox
+      rm tools/utils/machine_id/api_test.go
+    '';

  checkPhase = ''
    runHook preCheck
--- a/pkgs/by-name/ko/koodo-reader/bump-abi-compat.patch
+++ b/pkgs/by-name/ko/koodo-reader/bump-abi-compat.patch
@ -1,30 +1,30 @@
 diff --git a/package.json b/package.json
-index 3a001b5..c6ba849 100644
+index 4441e8b..269a8ed 100644
 --- a/package.json
 +++ b/package.json
@@ -14,6 +14,8 @@
   "repository": "https://github.com/koodo-reader/koodo-reader",
   "private": false,
   "resolutions": {
-+    "nan": "2.24.0",
-+    "node-abi": "3.85.0",
-     "//": "See https://github.com/facebook/create-react-app/issues/11773",
-     "react-error-overlay": "6.0.9"
+    "nan": "2.27.0",
+    "node-abi": "3.92.0",
+     "@types/react": "^18.3.1",
+     "node-gyp": "^10.0.0"
   },
@@ -22,7 +24,7 @@
     "adm-zip": "^0.5.2",
     "axios": "^0.19.2",
     "basic-ftp": "^5.0.5",
 -    "better-sqlite3": "^11.6.0",
-+    "better-sqlite3": "^12.4.5",
+    "better-sqlite3": "^12.10.0",
     "buffer": "^6.0.3",
     "chardet": "^2.0.0",
-     "copy-text-to-clipboard": "^2.2.0",
+     "color-thief-browser": "^2.0.2",
 diff --git a/yarn.lock b/yarn.lock
-index 83cf080..0dda6d2 100644
+index 6ced710..42e4e4f 100644
 --- a/yarn.lock
 +++ b/yarn.lock
-@@ -5358,10 +5358,10 @@ bcrypt-pbkdf@^1.0.0, bcrypt-pbkdf@^1.0.2:
+@@ -5407,10 +5407,10 @@ bcrypt-pbkdf@^1.0.0, bcrypt-pbkdf@^1.0.2:
   dependencies:
     tweetnacl "^0.14.3"
 
@ -32,14 +32,14 @@ index 83cf080..0dda6d2 100644
 -  version "11.6.0"
 -  resolved "https://registry.yarnpkg.com/better-sqlite3/-/better-sqlite3-11.6.0.tgz#e50736956e6fe1c30dc94f1bc94a9c15d63b7b6b"
 -  integrity sha512-2J6k/eVxcFYY2SsTxsXrj6XylzHWPxveCn4fKPKZFv/Vqn/Cd7lOuX4d7rGQXT5zL+97MkNL3nSbCrIoe3LkgA==
-+better-sqlite3@^12.4.5:
-+  version "12.5.0"
-+  resolved "https://registry.yarnpkg.com/better-sqlite3/-/better-sqlite3-12.5.0.tgz#c570873d9635b5d56baa52f7e72634c2c589f35f"
-+  integrity sha512-WwCZ/5Diz7rsF29o27o0Gcc1Du+l7Zsv7SYtVPG0X3G/uUI1LqdxrQI7c9Hs2FWpqXXERjW9hp6g3/tH7DlVKg==
+better-sqlite3@^12.10.0:
+  version "12.10.0"
+  resolved "https://registry.yarnpkg.com/better-sqlite3/-/better-sqlite3-12.10.0.tgz#bde622d14a18008583a53bc53501ae98f1a12221"
+  integrity sha512-CyzaZRQKyHkB2ZInfTTl2nvT33EbDpjkLEbE8/Zck3Ll6O0qqvuGdrJ45HgtH+HykRg88ITY3AdreBGN70aBSQ==
   dependencies:
     bindings "^1.5.0"
     prebuild-install "^7.1.1"
-@@ -10853,10 +10853,10 @@ mz@^2.7.0:
+@@ -11041,10 +11041,10 @@ mz@^2.7.0:
     object-assign "^4.0.1"
     thenify-all "^1.0.0"
 
@ -47,18 +47,25 @@ index 83cf080..0dda6d2 100644
 -  version "2.22.0"
 -  resolved "https://registry.yarnpkg.com/nan/-/nan-2.22.0.tgz#31bc433fc33213c97bad36404bb68063de604de3"
 -  integrity sha512-nbajikzWTMwsW+eSsNm3QwlOs7het9gGJU5dDZzRTQGk03vyBOauxgI4VakDzE0PtsGTmXPsXTbbjVhRwR5mpw==
-+nan@2.24.0, nan@^2.19.0, nan@^2.20.0:
-+  version "2.24.0"
-+  resolved "https://registry.yarnpkg.com/nan/-/nan-2.24.0.tgz#a8919b36e692aa5b260831910e4f81419fc0a283"
-+  integrity sha512-Vpf9qnVW1RaDkoNKFUvfxqAbtI8ncb8OJlqZ9wwpXzWPEsvsB1nvdUi6oYrHIkQ1Y/tMDnr1h4nczS0VB9Xykg==
+nan@2.27.0, nan@^2.19.0, nan@^2.20.0:
+  version "2.27.0"
+  resolved "https://registry.yarnpkg.com/nan/-/nan-2.27.0.tgz#804e389f4c0e39b729a17eca85c80ebc4355c4c4"
+  integrity sha512-hC+0LidcL3XE4rp1C4H54KujgXKzbfyTngZTwBByQxsOxCEKZT0MPQ4hOKUH2jU1OYstqdDH4onyHPDzcV0XdQ==
 
 nanoid@^3.3.6:
   version "3.3.6"
-@@ -10906,17 +10906,10 @@ no-case@^3.0.4:
+@@ -11094,24 +11094,10 @@ no-case@^3.0.4:
     lower-case "^2.0.2"
     tslib "^2.0.3"
 
-node-abi@^3.0.0, node-abi@^3.3.0:
+-node-abi@^3.0.0:
+-  version "3.85.0"
+-  resolved "https://registry.yarnpkg.com/node-abi/-/node-abi-3.85.0.tgz#b115d575e52b2495ef08372b058e13d202875a7d"
+-  integrity sha512-zsFhmbkAzwhTft6nd3VxcG0cvJsT70rL+BIGHWVq5fi6MwGrHwzqKaxXE+Hl2GmnGItnDKPPkO5/LQqjVkIdFg==
+-  dependencies:
+-    semver "^7.3.5"
+-
+-node-abi@^3.3.0:
 -  version "3.71.0"
 -  resolved "https://registry.yarnpkg.com/node-abi/-/node-abi-3.71.0.tgz#52d84bbcd8575efb71468fbaa1f9a49b2c242038"
 -  integrity sha512-SZ40vRiy/+wRTf21hxkkEjPJZpARzUMVcJoQse2EF8qkUWbbO2z7vd5oA/H6bVH6SZQ5STGcu0KRDS7biNRfxw==
@ -69,10 +76,10 @@ index 83cf080..0dda6d2 100644
 -  version "3.74.0"
 -  resolved "https://registry.yarnpkg.com/node-abi/-/node-abi-3.74.0.tgz#5bfb4424264eaeb91432d2adb9da23c63a301ed0"
 -  integrity sha512-c5XK0MjkGBrQPGYG24GBADZud0NCbznxNx0ZkS+ebUTrmV1qTDxPxSL8zEAPURXSbLRWVexxmP4986BziahL5w==
-+node-abi@3.85.0, node-abi@^3.0.0, node-abi@^3.3.0, node-abi@^3.45.0:
-+  version "3.85.0"
-+  resolved "https://registry.yarnpkg.com/node-abi/-/node-abi-3.85.0.tgz#b115d575e52b2495ef08372b058e13d202875a7d"
-+  integrity sha512-zsFhmbkAzwhTft6nd3VxcG0cvJsT70rL+BIGHWVq5fi6MwGrHwzqKaxXE+Hl2GmnGItnDKPPkO5/LQqjVkIdFg==
+node-abi@3.92.0, node-abi@^3.0.0, node-abi@^3.3.0, node-abi@^3.45.0:
+  version "3.92.0"
+  resolved "https://registry.yarnpkg.com/node-abi/-/node-abi-3.92.0.tgz#18e2214677499b8dda81ffcd095afc763d5a9802"
+  integrity sha512-KdHvFWZjEKDf0cakgFjebl371GPsISX2oZHcuyKqM7DtogIsHrqKeLTo8wBHxaXRAQlY2PsPlZmfo+9ZCxEREQ==
   dependencies:
     semver "^7.3.5"
 
--- a/pkgs/by-name/ko/koodo-reader/package.nix
+++ b/pkgs/by-name/ko/koodo-reader/package.nix
@ -14,23 +14,24 @@
  wrapGAppsHook3,
  xcbuild,

-  electron_39,
+  electron_41,

  nix-update-script,
 }:

 let
-  electron = electron_39; # don't use latest electron to avoid going over the supported abi numbers
+  # don't use latest electron to avoid going over the supported abi numbers
+  electron = electron_41;
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "koodo-reader";
-  version = "2.2.4";
+  version = "2.3.4";

  src = fetchFromGitHub {
    owner = "koodo-reader";
    repo = "koodo-reader";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-KUcI+0+ICMdwAF30CLM3QdS+X8UnYiHhcYkvEQ6WgS8=";
+    hash = "sha256-GWhofLT5p8Li0aErJlUQ6E5xSkK4CnnM7UwGDJQBq9I=";
  };

  patches = [
@ -39,7 +40,7 @@ stdenv.mkDerivation (finalAttrs: {

  yarnOfflineCache = fetchYarnDeps {
    inherit (finalAttrs) src patches;
-    hash = "sha256-XyFcY0XeNdNzLuqfv9Z2/41875Nl5OrAT/QVyI/+OQc=";
+    hash = "sha256-HRWp/lXXPSw2OdvBaEX0W3hnxL9NvIjIk62Dj+rKm1g=";
  };

  nativeBuildInputs = [
@ -70,8 +71,6 @@ stdenv.mkDerivation (finalAttrs: {
    npm rebuild --verbose cpu-features

    export npm_config_nodedir=${electron.headers}
-    npm run postinstall
-
    # Explicitly set identity to null to avoid signing on darwin
    yarn --offline run electron-builder --dir \
      -c.mac.identity=null \
@ -125,7 +124,6 @@ stdenv.mkDerivation (finalAttrs: {
        "image/vnd.djvu"
        "application/x-mobipocket-ebook"
        "application/vnd.amazon.ebook"
-        "application/vnd.amazon.ebook"
        "application/x-cbz"
        "application/x-cbr"
        "application/x-cbt"
--- a/pkgs/by-name/li/libaec/package.nix
+++ b/pkgs/by-name/li/libaec/package.nix
@ -1,7 +1,7 @@
 {
  lib,
  stdenv,
-  fetchFromGitLab,
+  fetchFromGitHub,
  cmake,
 }:

@ -9,9 +9,8 @@ stdenv.mkDerivation (finalAttrs: {
  pname = "libaec";
  version = "1.1.6";

-  src = fetchFromGitLab {
-    domain = "gitlab.dkrz.de";
-    owner = "k202009";
+  src = fetchFromGitHub {
+    owner = "Deutsches-Klimarechenzentrum";
    repo = "libaec";
    tag = "v${finalAttrs.version}";
    hash = "sha256-cxDP+JNwokxgzH9hO2zw+rIcz8XG7E8ujbAbWpgUEW8=";
@ -24,7 +23,8 @@ stdenv.mkDerivation (finalAttrs: {
  doCheck = true;

  meta = {
-    homepage = "https://gitlab.dkrz.de/k202009/libaec";
+    changelog = "https://github.com/Deutsches-Klimarechenzentrum/libaec/blob/v${finalAttrs.version}/CHANGELOG.md";
+    homepage = "https://github.com/Deutsches-Klimarechenzentrum/libaec";
    description = "Adaptive Entropy Coding library";
    license = lib.licenses.bsd2;
    maintainers = [ ];
--- a/pkgs/by-name/li/libcss/fix-calloc-transposed-args-computed.patch
+++ b/pkgs/by-name/li/libcss/fix-calloc-transposed-args-computed.patch
@ -0,0 +1,11 @@
+--- a/src/select/computed.c
+++ b/src/select/computed.c
+@@ -73,7 +73,7 @@
+ 	if (result == NULL)
+ 		return CSS_BADPARM;
+ 
+-	s = calloc(sizeof(css_computed_style), 1);
+	s = calloc(1, sizeof(css_computed_style));
+ 	if (s == NULL)
+ 		return CSS_NOMEM;
+ 
--- a/pkgs/by-name/li/libcss/fix-calloc-transposed-args-select.patch
+++ b/pkgs/by-name/li/libcss/fix-calloc-transposed-args-select.patch
@ -0,0 +1,29 @@
+--- a/src/select/select.c
+++ b/src/select/select.c
+@@ -138,7 +138,7 @@
+ {
+ 	struct css_node_data *nd;
+ 
+-	nd = calloc(sizeof(struct css_node_data), 1);
+	nd = calloc(1, sizeof(struct css_node_data));
+ 	if (nd == NULL) {
+ 		return CSS_NOMEM;
+ 	}
+@@ -234,7 +234,7 @@
+ 	if (result == NULL)
+ 		return CSS_BADPARM;
+ 
+-	c = calloc(sizeof(css_select_ctx), 1);
+	c = calloc(1, sizeof(css_select_ctx));
+ 	if (c == NULL)
+ 		return CSS_NOMEM;
+ 
+@@ -613,7 +613,7 @@
+ 	*node_bloom = NULL;
+ 
+ 	/* Create the node's bloom */
+-	bloom = calloc(sizeof(css_bloom), CSS_BLOOM_SIZE);
+	bloom = calloc(CSS_BLOOM_SIZE, sizeof(css_bloom));
+ 	if (bloom == NULL) {
+ 		return CSS_NOMEM;
+ 	}
--- a/pkgs/by-name/li/libcss/package.nix
+++ b/pkgs/by-name/li/libcss/package.nix
@ -22,18 +22,10 @@ stdenv.mkDerivation (finalAttrs: {
  patches = [
    # select: computed: Squash -Wcalloc-transposed-args (gcc-14)
    # remove on next release
-    (fetchpatch {
-      name = "fix-calloc-transposed-args-computed.patch";
-      url = "https://source.netsurf-browser.org/libcss.git/patch/?id=0541e18b442d2f46abc0f0b09e0db950e1b657e5";
-      hash = "sha256-6nrT1S1E+jU6UDr3BZo9GH8jcSiIwTNLnmI1rthhhws=";
-    })
+    ./fix-calloc-transposed-args-computed.patch
    # select: select: Squash -Wcalloc-transposed-args (gcc-14)
    # remove on next release
-    (fetchpatch {
-      name = "fix-calloc-transposed-args-select.patch";
-      url = "https://source.netsurf-browser.org/libcss.git/patch/?id=8619d09102d6cc34d63fe87195c548852fc93bf4";
-      hash = "sha256-Clkhw/n/+NQR/T8Gi+2Lc1Neq5dWsNKM8RqieYuTnzQ=";
-    })
+    ./fix-calloc-transposed-args-select.patch
  ];

  nativeBuildInputs = [ pkg-config ];
--- a/pkgs/by-name/li/libdom/fix-calloc-transposed-args.patch
+++ b/pkgs/by-name/li/libdom/fix-calloc-transposed-args.patch
@ -0,0 +1,40 @@
+--- a/bindings/xml/expat_xmlparser.c
+++ b/bindings/xml/expat_xmlparser.c
+@@ -484,7 +484,7 @@
+ 
+ 	UNUSED(int_enc);
+ 
+-	parser = calloc(sizeof(*parser), 1);
+	parser = calloc(1, sizeof(*parser));
+ 	if (parser == NULL) {
+ 		msg(DOM_MSG_CRITICAL, mctx, "No memory for parser");
+ 		return NULL;
+--- a/src/core/node.c
+++ b/src/core/node.c
+@@ -2379,7 +2379,7 @@
+ 	if (t == NULL) {
+ 		/* Create the event target list */
+ 		size = 64;
+-		t = calloc(sizeof(*t), size);
+		t = calloc(size, sizeof(*t));
+ 		if (t == NULL) {
+ 			return DOM_NO_MEM_ERR;
+ 		}
+--- a/src/html/html_document.c
+++ b/src/html/html_document.c
+@@ -134,13 +134,12 @@
+ 	doc->cookie = NULL;
+ 	doc->body = NULL;
+ 
+-	doc->memoised = calloc(sizeof(dom_string *), hds_COUNT);
+	doc->memoised = calloc(hds_COUNT, sizeof(dom_string *));
+ 	if (doc->memoised == NULL) {
+ 		error = DOM_NO_MEM_ERR;
+ 		goto out;
+ 	}
+-	doc->elements = calloc(sizeof(dom_string *),
+-			DOM_HTML_ELEMENT_TYPE__COUNT);
+	doc->elements = calloc(DOM_HTML_ELEMENT_TYPE__COUNT, sizeof(dom_string *));
+ 	if (doc->elements == NULL) {
+ 		error = DOM_NO_MEM_ERR;
+ 		goto out;
--- a/pkgs/by-name/li/libdom/package.nix
+++ b/pkgs/by-name/li/libdom/package.nix
@ -23,11 +23,7 @@ stdenv.mkDerivation (finalAttrs: {
  patches = [
    # fixes libdom build on gcc 14 due to calloc-transposed-args warning
    # remove on next release
-    (fetchpatch {
-      name = "fix-calloc-transposed-args.patch";
-      url = "https://source.netsurf-browser.org/libdom.git/patch/?id=2687282d56dfef19e26e9639a5c0cd81de957e22";
-      hash = "sha256-1uAdLM9foplCVu8IQlMMlXh6OWHs5eUgsKp+0ZqM9yM=";
-    })
+    ./fix-calloc-transposed-args.patch
  ];

  nativeBuildInputs = [ pkg-config ];
--- a/pkgs/by-name/li/libdwarf/package.nix
+++ b/pkgs/by-name/li/libdwarf/package.nix
@ -11,13 +11,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "libdwarf";
-  version = "2.2.0";
+  version = "2.3.1";

  src = fetchFromGitHub {
    owner = "davea42";
    repo = "libdwarf-code";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-PJhhrNsYZNDKzLYJzF+eSJfEH1ehF/aeJrNjiEdFEas=";
+    hash = "sha256-azVCzQt9oA40YACa9PkdNt0D8vWRNHXXGoSFOYNJxgA=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/li/libodfgen/package.nix
+++ b/pkgs/by-name/li/libodfgen/package.nix
@ -2,22 +2,18 @@
  lib,
  stdenv,
  fetchurl,
-  boost,
  pkg-config,
-  cppunit,
-  zlib,
-  libwpg,
-  libwpd,
  librevenge,
+  libxml2,
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "libodfgen";
-  version = "0.1.7";
+  version = "0.1.8";

  src = fetchurl {
    url = "mirror://sourceforge/project/libwpd/libodfgen/libodfgen-${finalAttrs.version}/libodfgen-${finalAttrs.version}.tar.xz";
-    sha256 = "sha256-Mj5JH5VsjKKrsSyZjjUGcJMKMjF7+WYrBhXdSzkiuDE=";
+    hash = "sha256-VSAAJ/1GYjub3d040nXnRS0bD/iu3crW+a5twl9hBiU=";
  };

  patches = [
@ -26,16 +22,26 @@ stdenv.mkDerivation (finalAttrs: {
    ./libodfgen-add-include-cstdint-gcc15.patch
  ];

+  enableParallelBuilding = true;
+
+  configureFlags = lib.optional finalAttrs.finalPackage.doCheck "--enable-test";
+
  nativeBuildInputs = [ pkg-config ];
+
  buildInputs = [
-    boost
-    cppunit
-    zlib
-    libwpg
-    libwpd
    librevenge
+    libxml2
  ];

+  doCheck = true;
+
+  checkFlags = [
+    "-C"
+    "test"
+  ];
+
+  checkTarget = "launch_all";
+
  meta = {
    description = "Base library for generating ODF documents";
    license = lib.licenses.mpl20;
--- a/pkgs/by-name/li/libphonenumber/package.nix
+++ b/pkgs/by-name/li/libphonenumber/package.nix
@ -15,13 +15,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "libphonenumber";
-  version = "9.0.30";
+  version = "9.0.31";

  src = fetchFromGitHub {
    owner = "google";
    repo = "libphonenumber";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-+VGANm6L2TZkOW97PDYCH+rELyppyJ/GIiabnZXWNTc=";
+    hash = "sha256-5LJVlcii0uolu4p+z4R9uvYnzLBIdJEQp9AUUnNB5mE=";
  };

  patches = [
--- a/pkgs/by-name/li/libsignal-ffi/package.nix
+++ b/pkgs/by-name/li/libsignal-ffi/package.nix
@ -13,14 +13,14 @@ rustPlatform.buildRustPackage (finalAttrs: {
  pname = "libsignal-ffi";
  # must match the version used in mautrix-signal
  # see https://github.com/mautrix/signal/issues/401
-  version = "0.92.1";
+  version = "0.93.2";

  src = fetchFromGitHub {
    fetchSubmodules = true;
    owner = "signalapp";
    repo = "libsignal";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-gAXLt0e2k5PA6PgFRQa22oGuNLM7TGkOKQnYtFhn8I8=";
+    hash = "sha256-U32vd5TzgA1LwlFgLUJU30gUeQoYnKI7kYnhy+d8eQk=";
  };

  postPatch =
@ -46,7 +46,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    NIX_LDFLAGS = if stdenv.hostPlatform.isDarwin then "-lc++" else "-lstdc++";
  };

-  cargoHash = "sha256-TqYxkkzlbgrc7jkAubz3TsXhcU8Do5IFaLRqSPiZVR0=";
+  cargoHash = "sha256-5thq1MXL792u87fv6M5E1oi8gq6S8dnTsy3k26T7pgM=";

  cargoBuildFlags = [
    "-p"
--- a/pkgs/by-name/li/libsvgtiny/fix-calloc-transposed-args.patch
+++ b/pkgs/by-name/li/libsvgtiny/fix-calloc-transposed-args.patch
@ -0,0 +1,11 @@
+--- a/src/svgtiny.c
+++ b/src/svgtiny.c
+@@ -586,7 +586,7 @@
+ {
+ 	struct svgtiny_diagram *diagram;
+ 
+-	diagram = calloc(sizeof(*diagram), 1);
+	diagram = calloc(1, sizeof(*diagram));
+ 	if (!diagram)
+ 		return 0;
+ 
--- a/pkgs/by-name/li/libsvgtiny/package.nix
+++ b/pkgs/by-name/li/libsvgtiny/package.nix
@ -24,11 +24,7 @@ stdenv.mkDerivation (finalAttrs: {
  patches = [
    # fixes libdom build on gcc 14 due to calloc-transposed-args warning
    # remove on next release
-    (fetchpatch {
-      name = "fix-calloc-transposed-args.patch";
-      url = "https://source.netsurf-browser.org/libsvgtiny.git/patch/?id=9d14633496ae504557c95d124b97a71147635f04";
-      hash = "sha256-IRWWjyFXd+lWci/bKR9uPDKbP3ttK6zNB6Cy5bv4huc=";
-    })
+    ./fix-calloc-transposed-args.patch
  ];

  nativeBuildInputs = [
--- a/pkgs/by-name/lu/lunar-client/package.nix
+++ b/pkgs/by-name/lu/lunar-client/package.nix
@ -7,11 +7,11 @@

 appimageTools.wrapType2 rec {
  pname = "lunarclient";
-  version = "3.6.10";
+  version = "3.6.11";

  src = fetchurl {
    url = "https://launcherupdates.lunarclientcdn.com/Lunar%20Client-${version}-ow.AppImage";
-    hash = "sha512-qdr6CcCtZa++KLzfmpA8ChdHXO3N+syn06pTXH7EQY0uI10ZI0w4os+hZ6SNoh0+YOcMY90gv4k4zpI9jWKPVg==";
+    hash = "sha512-WHjeAA+vS/gC8ZI2jUWpiJasvT+AgEWB14/ZnJGIOJPi4PUxtBNseM6HR8Aql8a8JGzobyZS9ISqYtFJEiYQ+A==";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/by-name/ma/macaulay2/package.nix
+++ b/pkgs/by-name/ma/macaulay2/package.nix
@ -294,5 +294,6 @@ stdenv.mkDerivation (finalAttrs: {
    homepage = "https://macaulay2.com/";
    license = lib.licenses.gpl2Plus;
    maintainers = with lib.maintainers; [ coolcuber ];
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
  };
 })
--- a/pkgs/by-name/ma/mailspring/darwin.nix
+++ b/pkgs/by-name/ma/mailspring/darwin.nix
@ -13,7 +13,7 @@ stdenv.mkDerivation (finalAttrs: {

  src = fetchurl {
    url = "https://github.com/Foundry376/Mailspring/releases/download/${finalAttrs.version}/Mailspring-AppleSilicon.zip";
-    hash = "sha256-P4VP/EHQKb8WFhZhJZyaaJ1KLpPl0fZwBzozZynn62w=";
+    hash = "sha256-U8yh7Qsxu1AmqMVV2p9MmvNHH922yBEqWA8OsQleoCQ=";
  };
  dontUnpack = true;

--- a/pkgs/by-name/ma/mailspring/linux.nix
+++ b/pkgs/by-name/ma/mailspring/linux.nix
@ -34,7 +34,7 @@ stdenv.mkDerivation (finalAttrs: {

  src = fetchurl {
    url = "https://github.com/Foundry376/Mailspring/releases/download/${finalAttrs.version}/mailspring-${finalAttrs.version}-amd64.deb";
-    hash = "sha256-xla2M3k6KXSyn2Ta4PQfWC+0AVkstwbjviaq1ie+awM=";
+    hash = "sha256-pyEWypqujSYYmbpUgcUMJoew4nIjE/dQWTVdYTxhmN4=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/ma/mailspring/package.nix
+++ b/pkgs/by-name/ma/mailspring/package.nix
@ -5,7 +5,7 @@
 }:
 let
  pname = "mailspring";
-  version = "1.21.0";
+  version = "1.21.1";

  meta = {
    description = "Beautiful, fast and maintained fork of Nylas Mail by one of the original authors";
--- a/Show more
+++ b/Show more