Merge staging-next into staging

2026-07-06 17:13:24 -05:00 · 2026-07-04 00:36:45 +00:00 · 2026-07-04 00:36:45 +00:00 · f30659ca7c
commit f30659ca7c
parent 8ad0c2a646 a692067795
112 changed files with 3012 additions and 561 deletions
--- a/doc/build-helpers.md
+++ b/doc/build-helpers.md
@ -25,6 +25,5 @@ build-helpers/dev-shell-tools.chapter.md
 build-helpers/special.md
 build-helpers/images.md
 hooks/index.md
-languages-frameworks/index.md
 packages/index.md
 ```
--- a/doc/first-package.chapter.md
+++ b/doc/first-package.chapter.md
@ -0,0 +1,84 @@
+# Package your first application {#chap-first-package}
+
+Package an application with Nixpkgs by picking the build helper for its language and setting a few attributes.
+
+Each language ecosystem has its own build helper.
+See [](#chap-language-support) for the full set.
+
+## Package a Go application {#first-package-go}
+
+`buildGoModule` builds Go programs that use Go modules.
+
+Write the package to `package.nix`:
+
+:::{.example #ex-first-package-go}
+
+# Package `pet` with `buildGoModule`
+
+```nix
+# package.nix
+{
+  buildGoModule,
+  fetchFromGitHub,
+  lib,
+}:
+buildGoModule (finalAttrs: {
+  pname = "pet";
+  version = "0.3.4";
+
+  src = fetchFromGitHub {
+    owner = "knqyf263";
+    repo = "pet";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Gjw1dRrgM8D3G7v6WIM2+50r4HmTXvx0Xxme2fH9TlQ=";
+  };
+
+  vendorHash = "sha256-6hCgv2/8UIRHw1kCe3nLkxF23zE/7t5RDwEjSzX3pBQ=";
+
+  meta = {
+    description = "Simple command-line snippet manager, written in Go";
+    homepage = "https://github.com/knqyf263/pet";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ kalbasit ];
+  };
+})
+```
+
+:::
+
+`buildGoModule` needs `pname`, `version`, `src`, and `vendorHash`.
+
+Pin Nixpkgs and call the package from `default.nix`:
+
+```nix
+# default.nix
+let
+  nixpkgs = fetchTarball "https://github.com/NixOS/nixpkgs/archive/nixos-unstable.tar.gz";
+  pkgs = import nixpkgs { };
+in
+pkgs.callPackage ./package.nix { }
+```
+
+Build it:
+
+```shell
+$ nix-build ./default.nix
+# or equivalent
+$ nix-build
+```
+
+Run it:
+
+```shell
+$ ./result/bin/pet --help
+pet - Simple command-line snippet manager.
+```
+
+`vendorHash` pins the fetched dependencies.
+To find its value:
+
+1. Set `vendorHash` to an empty string `""`.
+2. Run `nix-build`.
+3. Copy the correct value from the error into `vendorHash`.
+
+See the [Go reference](#sec-language-go) for every attribute and advanced usage.
--- a/doc/languages-frameworks/index.md
+++ b/doc/languages-frameworks/index.md
@ -2,6 +2,10 @@

 The [standard build environment](#chap-stdenv) makes it easy to build typical Autotools-based packages with very little code. Any other kind of package can be accommodated by overriding the appropriate phases of `stdenv`. However, there are specialised functions in Nixpkgs to easily build packages for other programming languages, such as Perl or Haskell. These are described in this chapter.

+::: {.tip}
+New to packaging? Start with [](#chap-first-package), then return here for the ecosystem you need.
+:::
+
 Each supported language or software ecosystem has its own package set named `<language or ecosystem>Packages`, which can be explored in various ways:

 - Search on [search.nixos.org](https://search.nixos.org/packages)
--- a/doc/manual.md.in
+++ b/doc/manual.md.in
@ -3,6 +3,7 @@

 ```{=include=} chapters
 preface.chapter.md
+first-package.chapter.md
 ```

 ```{=include=} parts
@ -17,6 +18,10 @@ contributing.md
 interoperability.md
 ```

+```{=include=} chapters
+languages-frameworks/index.md
+```
+
 ```{=include=} appendix html:into-file=//release-notes.html
 release-notes/release-notes.md
 ```
--- a/doc/redirects.json
+++ b/doc/redirects.json
@ -2,6 +2,9 @@
  "chap-build-helpers-finalAttrs": [
    "index.html#chap-build-helpers-finalAttrs"
  ],
+  "chap-first-package": [
+    "index.html#chap-first-package"
+  ],
  "chap-release-notes": [
    "release-notes.html#chap-release-notes"
  ],
@ -105,6 +108,9 @@
  "ex-build-helpers-extendMkDerivation": [
    "index.html#ex-build-helpers-extendMkDerivation"
  ],
+  "ex-first-package-go": [
+    "index.html#ex-first-package-go"
+  ],
  "ex-modularServiceCompliance-nixos": [
    "index.html#ex-modularServiceCompliance-nixos"
  ],
@ -131,6 +137,9 @@
  "ex-writeShellApplication": [
    "index.html#ex-writeShellApplication"
  ],
+  "first-package-go": [
+    "index.html#first-package-go"
+  ],
  "friction-graphics": [
    "index.html#friction-graphics"
  ],
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -3390,6 +3390,13 @@
    githubId = 4313548;
    name = "Ben Sparks";
  };
+  benhaskins = {
+    name = "Ben Haskins";
+    email = "ben.haskins@spang.co.uk";
+    github = "benhaskins";
+    githubId = 179679961;
+    keys = [ { fingerprint = "bnYZE0VGodlVwh/eUlqGQsAHeSE0hBPbo2EN2LrGu0M"; } ];
+  };
  benhiemer = {
    name = "Benedikt Hiemer";
    email = "ben.email@posteo.de";
@ -6998,6 +7005,11 @@
    githubId = 2096594;
    email = "Dietrich@Daroch.me";
  };
+  different-error = {
+    name = "Sanfer D'souza";
+    github = "different-error";
+    githubId = 9338001;
+  };
  different-name = {
    name = "different-name";
    email = "hello@different-name.dev";
@ -14235,6 +14247,12 @@
    githubId = 48174247;
    name = "Aleksandar Nesovic";
  };
+  kayoubi13 = {
+    email = "nix@foss-daily.org";
+    github = "kayoubi13";
+    githubId = 299534864;
+    name = "Kayoubi13";
+  };
  kazcw = {
    email = "kaz@lambdaverse.org";
    github = "kazcw";
@ -20853,6 +20871,11 @@
    githubId = 31112680;
    name = "oidro";
  };
+  ojii3 = {
+    github = "OJII3";
+    githubId = 84656786;
+    name = "OJII3";
+  };
  ojsef39 = {
    name = "Josef Hofer";
    github = "ojsef39";
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@ -11735,6 +11735,20 @@ final: prev: {
    meta.hydraPlatforms = [ ];
  };

+  neovim-project = buildVimPlugin {
+    pname = "neovim-project";
+    version = "0.1";
+    src = fetchFromGitHub {
+      owner = "coffebar";
+      repo = "neovim-project";
+      tag = "0.1";
+      hash = "sha256-OCo4rF+mJ5it1S7UhlzpPpbi6Zxt211c4v6t1IPf1rw=";
+    };
+    meta.homepage = "https://github.com/coffebar/neovim-project/";
+    meta.license = getLicenseFromSpdxId "Apache-2.0";
+    meta.hydraPlatforms = [ ];
+  };
+
  neovim-sensible = buildVimPlugin {
    pname = "neovim-sensible";
    version = "0-unstable-2017-09-20";
@ -11749,6 +11763,20 @@ final: prev: {
    meta.hydraPlatforms = [ ];
  };

+  neovim-session-manager = buildVimPlugin {
+    pname = "neovim-session-manager";
+    version = "0-unstable-2026-01-26";
+    src = fetchFromGitHub {
+      owner = "shatur";
+      repo = "neovim-session-manager";
+      rev = "89d253a6c68af60b49570044591d5b8701866601";
+      hash = "sha256-d7lXPIy6qJDPvFk8twwkqKUWI205HfTqXMspnVRkng0=";
+    };
+    meta.homepage = "https://github.com/shatur/neovim-session-manager/";
+    meta.license = getLicenseFromSpdxId "GPL-3.0-only";
+    meta.hydraPlatforms = [ ];
+  };
+
  neovim-tips = buildVimPlugin {
    pname = "neovim-tips";
    version = "0.8.4";
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@ -3024,12 +3024,25 @@ assertNoAdditions {
    ];
  };

+  neovim-project = super.neovim-project.overrideAttrs {
+    dependencies = with self; [
+      plenary-nvim
+      neovim-session-manager
+    ];
+  };
+
  neovim-sensible = super.neovim-sensible.overrideAttrs (old: {
    meta = old.meta // {
      license = lib.licenses.mit;
    };
  });

+  neovim-session-manager = super.neovim-session-manager.overrideAttrs {
+    dependencies = with self; [
+      plenary-nvim
+    ];
+  };
+
  neovim-tips = super.neovim-tips.overrideAttrs {
    dependencies = [
      self.nui-nvim
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@ -836,7 +836,9 @@ https://github.com/marilari88/neotest-vitest/,,
 https://github.com/lawrence-laz/neotest-zig/,,
 https://github.com/Shatur/neovim-ayu/,,
 https://github.com/cloudhead/neovim-fuzzy/,,
+https://github.com/coffebar/neovim-project/,,
 https://github.com/jeffkreeftmeijer/neovim-sensible/,,
+https://github.com/shatur/neovim-session-manager/,,
 https://github.com/saxon1964/neovim-tips/,,
 https://github.com/trunk-io/neovim-trunk/,,
 https://github.com/Shougo/neoyank.vim/,,
--- a/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix
@ -21,26 +21,26 @@ vscode-utils.buildVscodeMarketplaceExtension (finalAttrs: {
      sources = {
        "x86_64-linux" = {
          arch = "linux-x64";
-          hash = "sha256-0iSA2ck0tJdOiiDlhwp7XaqYDFEAMZyI9mALIvYD6Zw=";
+          hash = "sha256-n6UmUqfzOADzZzJMvY40gBCBKYgDtig41AD1aieA/kQ=";
        };
        "aarch64-linux" = {
          arch = "linux-arm64";
-          hash = "sha256-35dMOAr9pb7Tb5gkiDp2K0xdodGduOEcJ9IFSenD03s=";
+          hash = "sha256-/T7H1itSllf1h6vPzXlwokBvNOVQjZjNuhmC/ocqmPI=";
        };
        "x86_64-darwin" = {
          arch = "darwin-x64";
-          hash = "sha256-rojFi5393B56j86IAtWWVP0XiNeCsnAvTFIr3CcGZYY=";
+          hash = "sha256-qj9K/BlKbl5ZuowRMSVBXLknM6NeOxtIYynIcSE+K5A=";
        };
        "aarch64-darwin" = {
          arch = "darwin-arm64";
-          hash = "sha256-X8nXfpfaM9KtZLvL4ACyevrtdm+eihtjXVlYHSSas78=";
+          hash = "sha256-kXKnSZ6VQa/NPXroEbQT1pNwIy1eKnIDgOWX5WvA3JI=";
        };
      };
    in
    {
      name = "claude-code";
      publisher = "anthropic";
-      version = "2.1.198";
+      version = "2.1.199";
    }
    // sources.${stdenvNoCC.hostPlatform.system}
      or (throw "Unsupported system ${stdenvNoCC.hostPlatform.system}");
--- a/pkgs/applications/networking/browsers/chromium/info.json
+++ b/pkgs/applications/networking/browsers/chromium/info.json
@ -838,28 +838,28 @@
    }
  },
  "ungoogled-chromium": {
-    "version": "149.0.7827.200",
+    "version": "150.0.7871.46",
    "deps": {
      "depot_tools": {
-        "rev": "45dedc4c3b87c982fd846b3dc599b233ed3aff90",
-        "hash": "sha256-Ttklyw6IdNeMExlzeiQg/qsCkTmqVhUJ34MFgYmCWD4="
+        "rev": "f4fadaf6a5ba1bced9d3d9021060667b563bf583",
+        "hash": "sha256-3atvbwYnFTA40MonAxSQWkF58Jku7O7fUzelGPQvDyY="
      },
      "gn": {
-        "version": "0-unstable-2026-05-01",
-        "rev": "1740f5c25bcac5a650ee3d1c1ec22bfa25fcd756",
-        "hash": "sha256-oFs7fZAZEs/gQ7X1A4uigo9+Y+iEN9sMMQYwAjEuD04="
+        "version": "0-unstable-2026-05-27",
+        "rev": "3357c4f51b1a9e676378c695dd9c7e9911c35ee6",
+        "hash": "sha256-/1A+DkzAQj2zGPe/A/G0Z3VrYJXUxq4Hd/+d/o5p3G8="
      },
      "ungoogled-patches": {
-        "rev": "149.0.7827.200-1",
-        "hash": "sha256-D7c1ToAoUzAMpXoe60YPimRqe6/LRe0T95TduXUeTFo="
+        "rev": "150.0.7871.46-1",
+        "hash": "sha256-SuZTPUpv7onrHvDrwZO0Xo/mxLVcGUSxf2xb+OC//L8="
      },
      "npmHash": "sha256-pF0JtwFpPC4/fodbhSJnQKkczA9WlDg4VqEAy9aDVLg="
    },
    "DEPS": {
      "src": {
        "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "c35c164b1b6d1adca9eddf914ed6d0d0743dba6a",
-        "hash": "sha256-b2gBRUzRjqVZEb/tWUL1JF6Afq5gHJ3aOM02My1FyYU=",
+        "rev": "5b586c06e0d27582900f17e2d59c5370d8d6e0bb",
+        "hash": "sha256-OAZNyZtR5WFWW42r74RSy9fT7Eb7CNZwzoIHhuoqR28=",
        "recompress": true
      },
      "src/third_party/clang-format/script": {
@ -869,13 +869,13 @@
      },
      "src/third_party/compiler-rt/src": {
        "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/compiler-rt.git",
-        "rev": "0408cce08083f3d81379ed7d9f5bd26c03e1495b",
-        "hash": "sha256-kR5osTmp2girvNRVHzEKMZDCelgux9RrRuMoXMCRSGM="
+        "rev": "03641f7a5b05e48e318d64369057db577cafc594",
+        "hash": "sha256-KnWESGG6aI0S+fkJ3/T1x4QSiIYaOOvWUAm6l6l9iME="
      },
      "src/third_party/libc++/src": {
        "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxx.git",
-        "rev": "be1c391acca009d8d80535ce924e3d285451cdfa",
-        "hash": "sha256-zKb9PUiiBvhVhWnbQwR8uOFJ9gt3uYmfJ4M9ijpgKRc="
+        "rev": "5abc7f839700f0f17338434e1c1c6a8c87c00c11",
+        "hash": "sha256-vT1km7JgVpotDoNK+ae1gplSHcwrVNLsv/QAFUrDsIM="
      },
      "src/third_party/libc++abi/src": {
        "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxxabi.git",
@ -884,13 +884,13 @@
      },
      "src/third_party/libunwind/src": {
        "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libunwind.git",
-        "rev": "71192be150bbe04d87bb5298512d464e38d2f654",
-        "hash": "sha256-PxXemxdWZoEavKDOovi67IVWEr2YW8YK2F0LXM3LZPw="
+        "rev": "d6c7a21e978f0adaa43accaad53bc64f0b64f6ec",
+        "hash": "sha256-EuaVSYiR7qrlYqBR0UqdWCvwdzJSn0RS2wC/lnP19AE="
      },
      "src/third_party/llvm-libc/src": {
        "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libc.git",
-        "rev": "deb95b5e48e875920a2eaae799c8dbcd76a6a4db",
-        "hash": "sha256-oAgIT3+vjBrX86jgi/Pb0SCyco0lozjBjXlrKm6i56M="
+        "rev": "6e5ec6f78d8b9f2e8a50fcc5692d1fc8b2964bde",
+        "hash": "sha256-qrkx8Z1fc088Ja32obIUPxDwklI7i1wdEw051UZ08u8="
      },
      "src/chrome/test/data/perf/canvas_bench": {
        "url": "https://chromium.googlesource.com/chromium/canvas_bench.git",
@ -909,8 +909,8 @@
      },
      "src/docs/website": {
        "url": "https://chromium.googlesource.com/website.git",
-        "rev": "c9a9ad55e9ec9934244e58a5a8cab9a295526010",
-        "hash": "sha256-2GKWEnlExrTzoIYMxeP4n2klLLT/phB5ZVJ5Nj3/aoY="
+        "rev": "3da515a67f412be05ea1ea6b39832a69aef8f54e",
+        "hash": "sha256-wrkFsPX7jrsjD/Ow1gna/xLvk0E49m5GVxP1G7Vx7HM="
      },
      "src/media/cdm/api": {
        "url": "https://chromium.googlesource.com/chromium/cdm.git",
@ -919,8 +919,8 @@
      },
      "src/net/third_party/quiche/src": {
        "url": "https://quiche.googlesource.com/quiche.git",
-        "rev": "fafc2fe9efc9f2e28a0815229fc14ca30c266ba8",
-        "hash": "sha256-4UmjE41MOFCBa3APDMyyJwkeV6LhHl5UsMxZpPRDsRY="
+        "rev": "997d654308b6a1a17435e472ef5190aecb12e3eb",
+        "hash": "sha256-xgDgW2foZZEWpr0ibSG21kf028FN07/1ecOqFCkNj/I="
      },
      "src/testing/libfuzzer/fuzzers/wasm_corpus": {
        "url": "https://chromium.googlesource.com/v8/fuzzer_wasm_corpus.git",
@ -929,8 +929,8 @@
      },
      "src/third_party/angle": {
        "url": "https://chromium.googlesource.com/angle/angle.git",
-        "rev": "355cc61af2aadd8f0494800325b2bf9908138108",
-        "hash": "sha256-fgaCyO0oaz90aTaWMHH8ocySA0hXDHsPEl6vtMj4BY0="
+        "rev": "bbf3d8a4755268f016087be2f56099fa5a5f3f6e",
+        "hash": "sha256-8iuHtNgHumlMXeXj2k0ZPcvnTeJ00di298+789OjScs="
      },
      "src/third_party/angle/third_party/glmark2/src": {
        "url": "https://chromium.googlesource.com/external/github.com/glmark2/glmark2",
@ -944,13 +944,18 @@
      },
      "src/third_party/angle/third_party/VK-GL-CTS/src": {
        "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/VK-GL-CTS",
-        "rev": "3fe33a325af90c1c820b1e8109f11ea0f4b60c9b",
-        "hash": "sha256-JgOdlwtjC5HiCWBAaeM+Ffp9KlbI7+erT0ZRZBlWxXI="
+        "rev": "01471f4b3846c97eceb5b16b8acad950808791b2",
+        "hash": "sha256-SrL+G3osTtJGQslfCBEYbslb2kWtHRrwO87PHi+5o6E="
      },
      "src/third_party/anonymous_tokens/src": {
        "url": "https://chromium.googlesource.com/external/github.com/google/anonymous-tokens.git",
-        "rev": "208ea23596884f6d86476ea88b64e7931cdec08a",
-        "hash": "sha256-HLUX0mUzA3xcXbw71sIxFBNEkL8x86urcdJH2Yuuy04="
+        "rev": "92d1fdf881a932e7aa2a9b20e006136a659c7a20",
+        "hash": "sha256-llPt+UR8hY0yaJkYmq+A3ZfRRReuaXN09qpap6C28jc="
+      },
+      "src/third_party/aria-practices/src": {
+        "url": "https://chromium.googlesource.com/external/github.com/w3c/aria-practices.git",
+        "rev": "7b134ce6d19497cce8a67db4a9f59980baf853dc",
+        "hash": "sha256-POnvoO1KfzJj4CbcMPI0pUTRk5EtHLTOyKKmJCZdXOc="
      },
      "src/third_party/readability/src": {
        "url": "https://chromium.googlesource.com/external/github.com/mozilla/readability.git",
@ -964,13 +969,13 @@
      },
      "src/third_party/dav1d/libdav1d": {
        "url": "https://chromium.googlesource.com/external/github.com/videolan/dav1d.git",
-        "rev": "5cfc3832687e3229117203905faf5425ac6bc0d7",
-        "hash": "sha256-MWDDrb8P5AIFszY0u5gCrK+kZlbYffIt9Y1b/thXL7I="
+        "rev": "62501cc7db378532d7e85ea434b70d57e1ba2cb0",
+        "hash": "sha256-5cpKTUnhR+QzQJR4KbAvdvqsWnT1fpH0g9MObv8Nx0c="
      },
      "src/third_party/dawn": {
        "url": "https://dawn.googlesource.com/dawn.git",
-        "rev": "54b4153cfef88e048f365f99b962478f0087dfe8",
-        "hash": "sha256-Bv30zz/pCNVzUl+mKCpusWc94poytv9ZFelZIcs+2B8="
+        "rev": "01249a97332468dbdd6cf5edb8dd7bae77875de5",
+        "hash": "sha256-tzomo+GTec2zixxk61gtlma/sjcBImgbLMwA+mIp1LM="
      },
      "src/third_party/dawn/third_party/glfw3/src": {
        "url": "https://chromium.googlesource.com/external/github.com/glfw/glfw",
@ -979,8 +984,8 @@
      },
      "src/third_party/dawn/third_party/directx-shader-compiler/src": {
        "url": "https://chromium.googlesource.com/external/github.com/microsoft/DirectXShaderCompiler",
-        "rev": "d73829d4e677ef00931e8e57de6d544396ab46cb",
-        "hash": "sha256-BIXNgVeF5x3BZWFWZ1Gz+zpNSOEl+hZWB0GgMEaNS2w="
+        "rev": "35c1b99e9e552267da5efaea07c003e322d65777",
+        "hash": "sha256-pzBk+jUp/FUV8ahHquE0942Qw/DjAUemSM9fxdFJ0JA="
      },
      "src/third_party/dawn/third_party/directx-headers/src": {
        "url": "https://chromium.googlesource.com/external/github.com/microsoft/DirectX-Headers",
@ -989,8 +994,8 @@
      },
      "src/third_party/dawn/third_party/OpenGL-Registry/src": {
        "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/OpenGL-Registry",
-        "rev": "9cb90ca4902d588bef3c830fbb1da484893bd5fb",
-        "hash": "sha256-mWVORjrbNFINr5WKAIDVnPs2T+96vkxWqZdJwp8oT9I="
+        "rev": "a30033d3e812c9bf10094f1010374a6b15e192eb",
+        "hash": "sha256-xLacUOSy783bCtv+wUnjVnNLwTQ3eLwUJtYXmELqekY="
      },
      "src/third_party/dawn/third_party/EGL-Registry/src": {
        "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/EGL-Registry",
@ -999,8 +1004,8 @@
      },
      "src/third_party/dawn/third_party/webgpu-cts": {
        "url": "https://chromium.googlesource.com/external/github.com/gpuweb/cts",
-        "rev": "5c6b119c4fa0d9059c45f7637df1fe26fc80a6e4",
-        "hash": "sha256-9DAdS2u2YtrCFJu0KTuwRJjTUNexFxdmnn7LkwQ+KiQ="
+        "rev": "f08551b0fc4d6cfa5ba582a0235b571aa363102d",
+        "hash": "sha256-f5kWMnaod/Ved1Fz/vTkdL0ihSUnNM8XN5Ht3Vs1YpU="
      },
      "src/third_party/dawn/third_party/webgpu-headers/src": {
        "url": "https://chromium.googlesource.com/external/github.com/webgpu-native/webgpu-headers",
@ -1024,8 +1029,8 @@
      },
      "src/third_party/boringssl/src": {
        "url": "https://boringssl.googlesource.com/boringssl.git",
-        "rev": "65818adf16411ca394625f5747a1af28faf95d2c",
-        "hash": "sha256-tcTTzQnBp8Od1jdDMrFoCr9bnW0OCjGqUjH3QMnusmo="
+        "rev": "3a9254f16eda7a4c5d2260039ff23456a0a34de4",
+        "hash": "sha256-JuMnNppWhIFHYfk6ANIZLC7ABhqMseoV5LYV7slevBE="
      },
      "src/third_party/breakpad/breakpad": {
        "url": "https://chromium.googlesource.com/breakpad/breakpad.git",
@ -1039,13 +1044,8 @@
      },
      "src/third_party/catapult": {
        "url": "https://chromium.googlesource.com/catapult.git",
-        "rev": "6e4188cabb4f37314ea41e9adfcb2cf9b64e2641",
-        "hash": "sha256-/kleYYllR22KjxHT2gTMGf6LEUZ1Ud7j593fIIAgqAA="
-      },
-      "src/third_party/catapult/third_party/webpagereplay": {
-        "url": "https://chromium.googlesource.com/webpagereplay.git",
-        "rev": "b7ac48f52cd298e966a76eb054412915c3e445d4",
-        "hash": "sha256-smtwB6vzLgCAePz0jNfrpm8TxrxBnBkigLxERhxUEvE="
+        "rev": "2852bb7e91e4995502ffb72b7ed21412ee157914",
+        "hash": "sha256-XYufVvzOXD4voZUWUvumQQqLNsx9sy0QmQzNzrgNEWg="
      },
      "src/third_party/ced/src": {
        "url": "https://chromium.googlesource.com/external/github.com/google/compact_enc_det.git",
@ -1064,13 +1064,13 @@
      },
      "src/third_party/cpu_features/src": {
        "url": "https://chromium.googlesource.com/external/github.com/google/cpu_features.git",
-        "rev": "d3b2440fcfc25fe8e6d0d4a85f06d68e98312f5b",
-        "hash": "sha256-IBJc1sHHh4G3oTzQm1RAHHahsEECC+BDl14DHJ8M1Ys="
+        "rev": "81d13c49649f0714dd41fb56bb246398b6584085",
+        "hash": "sha256-TrC1WMLAhko57rAyDCiAC/IJ0unAqVhyjkh7gKibyi4="
      },
      "src/third_party/cpuinfo/src": {
        "url": "https://chromium.googlesource.com/external/github.com/pytorch/cpuinfo.git",
-        "rev": "3681f0ce1446167d01dfe125d6db96ba2ac31c3c",
-        "hash": "sha256-PhWbzQgZSUb3eVyx+JTSnxVOAC2WzL2Dw1I9/6LEIsw="
+        "rev": "ea6b9f1bb6e1001d8b21574d5bc78ddef62e499d",
+        "hash": "sha256-/QsOjDik0TnH3FnK7LOwsJkvX+O+2DRFX4eF3MxD3fc="
      },
      "src/third_party/crc32c/src": {
        "url": "https://chromium.googlesource.com/external/github.com/google/crc32c.git",
@ -1079,28 +1079,28 @@
      },
      "src/third_party/cros_system_api": {
        "url": "https://chromium.googlesource.com/chromiumos/platform2/system_api.git",
-        "rev": "7ecd2b41460516ecd7b7d6e5c298db25e1436b6f",
-        "hash": "sha256-ehbAXv4DZStWDMC3iOjmWkAc4PhAamyI4C9bdXO7FfA="
+        "rev": "1c69e700a01a7fd3dd331f526c8a31ac1e5e49d0",
+        "hash": "sha256-qIwUs0KVU9xYFLN3UUayPLfz0ObA+EN6owKPW61J/5w="
      },
      "src/third_party/crossbench": {
        "url": "https://chromium.googlesource.com/crossbench.git",
-        "rev": "cecd70a5f49f777f603d38d11ac1f66c03c3e8af",
-        "hash": "sha256-zLwIY8fQVebkfN4KFMbitZODhmiN65JK2s9IG/5Cd+o="
+        "rev": "7d52b4ffbc319a7d5a0e0a0ebff744e5281d60c5",
+        "hash": "sha256-iwwvvIOuRMo/ZEu8Gk0lZaS4P5uGt8zpnYMChpZPcUo="
      },
      "src/third_party/crossbench-web-tests": {
        "url": "https://chromium.googlesource.com/chromium/web-tests.git",
-        "rev": "baf176aadedccc44329231d5dd40346874c2a63e",
-        "hash": "sha256-oY1/uGB6ykePIklWe35rmJWsnpu/wjkER4TJeP4TTdw="
+        "rev": "7b3de17542cc613aaddbfc72c6e12be37eed7b73",
+        "hash": "sha256-7ly4vaK+Pj4y91t6Q+igQ0890CqKyu9jNBhJnxbNGjI="
      },
      "src/third_party/depot_tools": {
        "url": "https://chromium.googlesource.com/chromium/tools/depot_tools.git",
-        "rev": "45dedc4c3b87c982fd846b3dc599b233ed3aff90",
-        "hash": "sha256-Ttklyw6IdNeMExlzeiQg/qsCkTmqVhUJ34MFgYmCWD4="
+        "rev": "f4fadaf6a5ba1bced9d3d9021060667b563bf583",
+        "hash": "sha256-3atvbwYnFTA40MonAxSQWkF58Jku7O7fUzelGPQvDyY="
      },
      "src/third_party/devtools-frontend/src": {
        "url": "https://chromium.googlesource.com/devtools/devtools-frontend",
-        "rev": "33c2f401a9c8ddad2159eb0ab83aa244a5247361",
-        "hash": "sha256-M9aULI+HECgA0ptAG47OPK0QuB+xzmb29iOtJ3whpB0="
+        "rev": "1d67dc0dafa344bbd6ca75c124e2d6d9d53074d8",
+        "hash": "sha256-VBXch2YwnKm+lMcZ5L0SlW+vAYeaSwgZvcOhg1TE5/A="
      },
      "src/third_party/dom_distiller_js/dist": {
        "url": "https://chromium.googlesource.com/chromium/dom-distiller/dist.git",
@ -1114,8 +1114,8 @@
      },
      "src/third_party/eigen3/src": {
        "url": "https://chromium.googlesource.com/external/gitlab.com/libeigen/eigen.git",
-        "rev": "2cf9891537250255f50df5109ffe9e700e2a73de",
-        "hash": "sha256-1bu1Y9itHIKcwY5J0sF08DSyfElLHiZ6SRsNZkFjz8o="
+        "rev": "662ba79d796a2851b10cdafc6668e45b65b1120f",
+        "hash": "sha256-6bZFDeo7TqWNunkkQv8OJ+7/hfKwoIUtqZoXaeLp6M8="
      },
      "src/third_party/farmhash/src": {
        "url": "https://chromium.googlesource.com/external/github.com/google/farmhash.git",
@ -1124,18 +1124,18 @@
      },
      "src/third_party/fast_float/src": {
        "url": "https://chromium.googlesource.com/external/github.com/fastfloat/fast_float.git",
-        "rev": "05087a303dad9c98768b33c829d398223a649bc6",
-        "hash": "sha256-ZQm8kDMYdwjKugc2vBG5mwTqXa01u6hODQc/Tai2I9A="
+        "rev": "cfd12ebcf1f82c4fd44a950b1815dd0549bc8d89",
+        "hash": "sha256-hzoB+Mmok3oe6B494uLc5ReWpUcB89zCGPYw4gvanK0="
      },
      "src/third_party/federated_compute/src": {
        "url": "https://chromium.googlesource.com/external/github.com/google-parfait/federated-compute.git",
-        "rev": "3112513bf1a80872311e7718c5385f535a819b89",
-        "hash": "sha256-jnG3PCxjaYcClRgzOfIkHbbD3xU9TDLyQR3VZUwHIgU="
+        "rev": "8de5837b817f28abc54a387a9417631b905ba90a",
+        "hash": "sha256-GZYo0FjgW8XCplAi6jzzruwDlIzsWjNEVQuCwXBCPz8="
      },
      "src/third_party/ffmpeg": {
        "url": "https://chromium.googlesource.com/chromium/third_party/ffmpeg.git",
-        "rev": "f45bab87ce4c5fafc67fd53fcde777578d01bfa0",
-        "hash": "sha256-fsZSqmG6vFOPJYuBgG6OSWkzRu27B3mv/PqAP8s4ARk="
+        "rev": "ad41607c61898cf7150e0fb20fe4bbabd44922a3",
+        "hash": "sha256-41qpsOTedB51WMzzHXDiXA19OIzA7wG/Qgbz6IkmWpk="
      },
      "src/third_party/flac": {
        "url": "https://chromium.googlesource.com/chromium/deps/flac.git",
@ -1164,8 +1164,8 @@
      },
      "src/third_party/freetype/src": {
        "url": "https://chromium.googlesource.com/chromium/src/third_party/freetype2.git",
-        "rev": "b6bcd2177f72bb4842c7701d7b7f633bb3fc951a",
-        "hash": "sha256-TUz3yUD9HxqUMCOpLk74rEf8J0tMTh4ZCuD94AD4+q4="
+        "rev": "b08a2eb0dd37f4a6c886fa5b0ecf5b3e1d27aac7",
+        "hash": "sha256-xnYeUAJx5n8LSg04AknfiudonfmlUdlj8nzHzSZi65I="
      },
      "src/third_party/fxdiv/src": {
        "url": "https://chromium.googlesource.com/external/github.com/Maratyszcza/FXdiv.git",
@ -1174,13 +1174,13 @@
      },
      "src/third_party/harfbuzz/src": {
        "url": "https://chromium.googlesource.com/external/github.com/harfbuzz/harfbuzz.git",
-        "rev": "e6741e2205309752839da60ff075b7fa2e7cddd3",
-        "hash": "sha256-XjUuY17fcZi+dIZFojq+eDsDVrBxtAWRydPdudt56+8="
+        "rev": "d639197ed529b05c27f38ebaab365a621d5edad5",
+        "hash": "sha256-uT4zK2hwHzEH6Nrd2rAeyzpQA1TmwtrdcujKYEUbLsY="
      },
      "src/third_party/ink/src": {
        "url": "https://chromium.googlesource.com/external/github.com/google/ink.git",
-        "rev": "a988417b6d0b1ea03fb0b40269fbc42313acc6fd",
-        "hash": "sha256-6O+N/ULn8sqsdgFw7VZ7TMjWvCAZbYo398PruPScU/k="
+        "rev": "0f9c6172b2ccc6b830ae313d522caf09e6933e06",
+        "hash": "sha256-LF+OcqNeg+KRuYmGuMZb4tmnr53sZHn/ZW1jg9ArPfc="
      },
      "src/third_party/instrumented_libs": {
        "url": "https://chromium.googlesource.com/chromium/third_party/instrumented_libraries.git",
@ -1204,8 +1204,8 @@
      },
      "src/third_party/libgav1/src": {
        "url": "https://chromium.googlesource.com/codecs/libgav1.git",
-        "rev": "40f58ed32ff39071c3f2a51056dbc49a070af0dc",
-        "hash": "sha256-gisU0p0HDL7Po/ZXIIZVOTnxnOuVvSE/FYo9DaEUFfo="
+        "rev": "66ac17620652635392f6ab24065c77b035e281c9",
+        "hash": "sha256-6/zMaX2DPSKpsaqirhrgi3nL/88Qr2VXacmyL5IyJ3U="
      },
      "src/third_party/googletest/src": {
        "url": "https://chromium.googlesource.com/external/github.com/google/googletest.git",
@ -1229,8 +1229,8 @@
      },
      "src/third_party/jsoncpp/source": {
        "url": "https://chromium.googlesource.com/external/github.com/open-source-parsers/jsoncpp.git",
-        "rev": "42e892d96e47b1f6e29844cc705e148ec4856448",
-        "hash": "sha256-bSLNcoYBz3QCt5VuTR056V9mU2PmBuYBa0W6hFg2m8Q="
+        "rev": "d4d072177213b117fb81d4cfda140de090616161",
+        "hash": "sha256-q+DOwkjRlHacgfWf5UVY02aqfnKK9M/1YRBX6aMce9g="
      },
      "src/third_party/leveldatabase/src": {
        "url": "https://chromium.googlesource.com/external/leveldb.git",
@ -1244,8 +1244,8 @@
      },
      "src/third_party/fuzztest/src": {
        "url": "https://chromium.googlesource.com/external/github.com/google/fuzztest.git",
-        "rev": "e24a91020ab19c3d6f590bd0911b7acb492f81be",
-        "hash": "sha256-wFjuvJzGEaal+pIo5UtkdLHYTpoWxRE6Vf5OGLObGQk="
+        "rev": "da27bcae1a8902af1ae6a5c55d3674f22709bbf5",
+        "hash": "sha256-317zRhJPc0D9A58W8fdCGFmpNZ5vACfd/tlZOsp/Cvw="
      },
      "src/third_party/domato/src": {
        "url": "https://chromium.googlesource.com/external/github.com/googleprojectzero/domato.git",
@ -1254,18 +1254,18 @@
      },
      "src/third_party/libaddressinput/src": {
        "url": "https://chromium.googlesource.com/external/libaddressinput.git",
-        "rev": "e20690c8d5178bb282641d5eb06ef0298ff4cbc5",
-        "hash": "sha256-rX7LQNUgk5ZljUrayD1a/SUrBrvpomW0Cs0KBw3lYu4="
+        "rev": "81eb9628382b07d371d8ea0b11badf7de3857fd5",
+        "hash": "sha256-6yDZpZ+CwxGqNO4+lZLFB6ESREeVku1BoOMtR+hKQ3I="
      },
      "src/third_party/libaom/source/libaom": {
        "url": "https://aomedia.googlesource.com/aom.git",
-        "rev": "33dba9e12a9f12e737eaa7c2624e8c580950a89a",
-        "hash": "sha256-01DbV0kQFg1yyFpVeo82KBoZHhizA7xnZ1qOuu4HTcs="
+        "rev": "137bcff61e73fdd2836dc04e8258bfb49cef595e",
+        "hash": "sha256-oDubKvgqMk3w0luM//rR3NnCOk1h/WVTyRkuCmYASrw="
      },
      "src/third_party/crabbyavif/src": {
        "url": "https://chromium.googlesource.com/external/github.com/webmproject/CrabbyAvif.git",
-        "rev": "c433c9a32320aed983e4106931596fbbae3f77ee",
-        "hash": "sha256-yw1cXB6s6biD2vj2K/3sVbKiaNK7bt+NkbQovbYlJ2Q="
+        "rev": "5e140b5abb9a91eb25b5ef66d29f6ee784ab7eab",
+        "hash": "sha256-tN+2YH2O9FTV50o4OVhKcKdwRwTI8NuNA0WqljUcrmo="
      },
      "src/third_party/nearby/src": {
        "url": "https://chromium.googlesource.com/external/github.com/google/nearby-connections.git",
@ -1279,8 +1279,8 @@
      },
      "src/third_party/jetstream/main": {
        "url": "https://chromium.googlesource.com/external/github.com/WebKit/JetStream.git",
-        "rev": "de88e36ae91d5bd13126fa4cc4b0e0346d779842",
-        "hash": "sha256-ZpU0ONqIVmY2VR0MxqtYj8KPNlK0L21gLJuT/Ff7KI8="
+        "rev": "b7babdf323e64e69bd2f6c376189c15825f5c73a",
+        "hash": "sha256-s6UMdUYWZqk/MbhyCi2zdQNgni98gGsYxcuUh/5AUy0="
      },
      "src/third_party/jetstream/v2.2": {
        "url": "https://chromium.googlesource.com/external/github.com/WebKit/JetStream.git",
@ -1319,8 +1319,8 @@
      },
      "src/third_party/cros-components/src": {
        "url": "https://chromium.googlesource.com/external/google3/cros_components.git",
-        "rev": "e580888fcc1c108e25c218ccf8b7a4372de18d57",
-        "hash": "sha256-p0Wfvhg/j8v9xL9Pueo7xPVHBKowOLI00AeIZXPQw4k="
+        "rev": "0abb2efaa3d16db861c9710b193c39e657ac3bdf",
+        "hash": "sha256-viuntf6umyLZwDR9BXG+ZOakp9f8rvpZYDBYAUkKzL4="
      },
      "src/third_party/libdrm/src": {
        "url": "https://chromium.googlesource.com/chromiumos/third_party/libdrm.git",
@ -1329,8 +1329,8 @@
      },
      "src/third_party/expat/src": {
        "url": "https://chromium.googlesource.com/external/github.com/libexpat/libexpat.git",
-        "rev": "f31adfd584b7f6c50bbf4d22eb928538ffc9145a",
-        "hash": "sha256-tLz4RejYQ/kFXhsWTduuGcinfUkqxYKPCpsou+WlvBc="
+        "rev": "9bdfbc77e3355405ceefbe59420abed953a5657e",
+        "hash": "sha256-veGg5/QjtBSmxYa8IyHF0NxEdJzlcJSZfzw8ay3ASVU="
      },
      "src/third_party/libipp/libipp": {
        "url": "https://chromium.googlesource.com/chromiumos/platform2/libipp.git",
@ -1339,8 +1339,8 @@
      },
      "src/third_party/libjpeg_turbo": {
        "url": "https://chromium.googlesource.com/chromium/deps/libjpeg_turbo.git",
-        "rev": "d1f5f2393e0d51f840207342ae86e55a86443288",
-        "hash": "sha256-KGeB/lTjhm8DQBDZVSPENvZEGSHeLTkviJrYsFh5vEM="
+        "rev": "640f254ad0fa03f6b1f29f89b7dd9366f2f6e533",
+        "hash": "sha256-wor4RTF3/5BFL9EWcGEofY+M4HN2+/KJUaOY+u86K5Q="
      },
      "src/third_party/liblouis/src": {
        "url": "https://chromium.googlesource.com/external/liblouis-github.git",
@ -1349,8 +1349,8 @@
      },
      "src/third_party/libphonenumber/src": {
        "url": "https://chromium.googlesource.com/external/libphonenumber.git",
-        "rev": "ade546d8856475d0493863ee270eb3be9628106b",
-        "hash": "sha256-cLtsM35Ir3iG3j8+Cy2McL1ysRB0Y1PXealAKl05Twg="
+        "rev": "c25558e39e2bcc9f26f7a2a1ef804324169eaf8f",
+        "hash": "sha256-Lr/gB5Em+TE092McPwJdOU0Ab4zyP4/2ZxlavMZMm+s="
      },
      "src/third_party/libprotobuf-mutator/src": {
        "url": "https://chromium.googlesource.com/external/github.com/google/libprotobuf-mutator.git",
@ -1374,8 +1374,8 @@
      },
      "src/third_party/libvpx/source/libvpx": {
        "url": "https://chromium.googlesource.com/webm/libvpx.git",
-        "rev": "d1268a5f3f3553ad7735911c614e8548381ca3cd",
-        "hash": "sha256-6IZTDhtjVWiqTv+jUC6Wr/tSqvql3thi9+mt+M3ixt4="
+        "rev": "5f00413667d19ad683674524a9d03543d86d188b",
+        "hash": "sha256-uTteQ+z7t5KOtPuBoZazmonRHd8jGS1/YZAq+RAvhX4="
      },
      "src/third_party/libwebm/source": {
        "url": "https://chromium.googlesource.com/webm/libwebm.git",
@ -1389,8 +1389,8 @@
      },
      "src/third_party/libyuv": {
        "url": "https://chromium.googlesource.com/libyuv/libyuv.git",
-        "rev": "644251f252a84bf8ce91ff0aca86a9b16b069ab8",
-        "hash": "sha256-DsoOY8bg0sPOF8tF67Gk7fRqdQzG1hc9fVMlZVjKWU4="
+        "rev": "3c5fa6ef272f6077d76816ee3d6a697ef1d6d272",
+        "hash": "sha256-FXFSC9dRb/KhSQdhJUqKEUpZbzU8ZpVnoSXtF/HPiJI="
      },
      "src/third_party/lss": {
        "url": "https://chromium.googlesource.com/linux-syscall-support.git",
@ -1409,8 +1409,8 @@
      },
      "src/third_party/nasm": {
        "url": "https://chromium.googlesource.com/chromium/deps/nasm.git",
-        "rev": "358842b6b7dd69b2ed635bef17f941e030a05e5f",
-        "hash": "sha256-YwjwubijMZ9OvYeMUVMSunWZ2VCuqUFEOyv/MK/oojc="
+        "rev": "525a09a813be0f75b646ee93fc2a31c27b87d722",
+        "hash": "sha256-uC6bGxSdz1V2SXIQjMsDd6555b3gAPN1Y0ZQtWoqDww="
      },
      "src/third_party/neon_2_sse/src": {
        "url": "https://chromium.googlesource.com/external/github.com/intel/ARM_NEON_2_x86_SSE.git",
@ -1424,8 +1424,8 @@
      },
      "src/third_party/openscreen/src": {
        "url": "https://chromium.googlesource.com/openscreen",
-        "rev": "684bcd767271a21f3e5d475b17a0fd862f16c65e",
-        "hash": "sha256-Yjz2E1/h+zp7L2x0zE0l+ktQIiSrJ4ZknXOhaVPKQVE="
+        "rev": "37ff938a93cb04c6b77e019b52328c8e9b320317",
+        "hash": "sha256-M57un/TVQPfTnKScVHS1VK1cUs8F/YPT3TwMVdo+mhM="
      },
      "src/third_party/openscreen/src/buildtools": {
        "url": "https://chromium.googlesource.com/chromium/src/buildtools",
@ -1439,13 +1439,13 @@
      },
      "src/third_party/pdfium": {
        "url": "https://pdfium.googlesource.com/pdfium.git",
-        "rev": "be702d63baba7507bb1f6f6ff2d35be9c133c08c",
-        "hash": "sha256-hXqSJn1C0ISLWx68UicggiL8xzgQX2Y8l75vtpJgHeU="
+        "rev": "c052afb72a08d79a26bcf3103d11f344981b09f1",
+        "hash": "sha256-zqfErp0pDXHXIvRpZ1TJu2UGXNZjATRbPgQWTniKTJs="
      },
      "src/third_party/perfetto": {
        "url": "https://chromium.googlesource.com/external/github.com/google/perfetto.git",
-        "rev": "97c58a94bb6495c4e202467fb1c55eaa22b5670f",
-        "hash": "sha256-qtClkWAluLDRZn7yrHLU7qp9szP+/WsiG5JZZzRKd38="
+        "rev": "9ede949f025303868fa0c42418f122ac47312539",
+        "hash": "sha256-IRzEqgunO4Nfz+FkYir8G/Ht+Zsn6wpzncgkEFpsC+k="
      },
      "src/third_party/protobuf-javascript/src": {
        "url": "https://chromium.googlesource.com/external/github.com/protocolbuffers/protobuf-javascript",
@ -1454,8 +1454,8 @@
      },
      "src/third_party/pthreadpool/src": {
        "url": "https://chromium.googlesource.com/external/github.com/google/pthreadpool.git",
-        "rev": "a56dcd79c699366e7ac6466792c3025883ff7704",
-        "hash": "sha256-WfyuPfII4eSmLskZV0TAcu4K6OyW38TjkDHm+VUx5eY="
+        "rev": "02460584c6092e527c8b89f7df4de143d70e801f",
+        "hash": "sha256-4EHJzZT+Gbhs8SkOhjSvDIPEqIQU93oJmtF3c/T+qjw="
      },
      "src/third_party/pyelftools": {
        "url": "https://chromium.googlesource.com/chromiumos/third_party/pyelftools.git",
@ -1484,13 +1484,18 @@
      },
      "src/third_party/search_engines_data/resources": {
        "url": "https://chromium.googlesource.com/external/search_engines_data.git",
-        "rev": "2345fee6ce4ae24d9c365d5c0884ece593c55c67",
-        "hash": "sha256-5qkra6FURaMvEOk+ZKMRH1hc8ixEnk3u4rxNm0G8tuQ="
+        "rev": "1aab872af8d44dcf59362d7ba8255922f74fafde",
+        "hash": "sha256-5/XnNx6Pyk4KBb9krVo9u6i7LWNrsLLOIi4qhEY2PZc="
+      },
+      "src/third_party/sframe/src": {
+        "url": "https://chromium.googlesource.com/external/github.com/cisco/sframe",
+        "rev": "b14090904433bed0d4ec3f875b9b39f3e0555930",
+        "hash": "sha256-bw+6ycUpnFZJhtXFUzr7XTOljNrs+7oFdVY+LN0Rqek="
      },
      "src/third_party/skia": {
        "url": "https://skia.googlesource.com/skia.git",
-        "rev": "75c589e1f436688fca8f5b7f7a8affeafaa4f923",
-        "hash": "sha256-x0jEek7iJv7WBNdkOUPc5VvIYJw9QPzzTChFUofqErM="
+        "rev": "14d05ec761901b6e9e9193af8b347ab3a7f6fed0",
+        "hash": "sha256-KZGrztOKaT368KSCxiJAqnsgINpNODUlaXnH/maQNIA="
      },
      "src/third_party/smhasher/src": {
        "url": "https://chromium.googlesource.com/external/smhasher.git",
@ -1504,13 +1509,13 @@
      },
      "src/third_party/sqlite/src": {
        "url": "https://chromium.googlesource.com/chromium/deps/sqlite.git",
-        "rev": "508ab21dc25702ed6690c4dd77da209a6bcd1239",
-        "hash": "sha256-SfvLfBKdPjFvZ7CzUeFMcyoHdCzQgNRQwZyzb6MRtJg="
+        "rev": "fc121d7d03cd6cbf499ec06a5112b263471b1181",
+        "hash": "sha256-hf9PxQhXEKT49GbkFYCvRPBT0Qu+hDnDpebI92yO1Oo="
      },
      "src/third_party/swiftshader": {
        "url": "https://swiftshader.googlesource.com/SwiftShader.git",
-        "rev": "f9d5d49a3c599a315e3493dc1e9b5309cffb3305",
-        "hash": "sha256-kBfqgXXJeEPT80mu6CJ2Bwmdv/y8jVzM6TedMXbzo4o="
+        "rev": "fce27a96526f54c6d31fdccf57629788e3712220",
+        "hash": "sha256-bmXZLpz3wv7eQWoqTjZmjwnnILWSIjZ8iqo8CeLk5fw="
      },
      "src/third_party/text-fragments-polyfill/src": {
        "url": "https://chromium.googlesource.com/external/github.com/GoogleChromeLabs/text-fragments-polyfill.git",
@ -1519,23 +1524,23 @@
      },
      "src/third_party/tflite/src": {
        "url": "https://chromium.googlesource.com/external/github.com/tensorflow/tensorflow.git",
-        "rev": "2216f531fb72119745382c62f232acf9790f4b6e",
-        "hash": "sha256-zySLNPmug5HS5pwJ/lEMAWjjZSOuxdTgup7Y90k7NZI="
+        "rev": "999d49c10046e240cd5366d349d3a5f6af16a0d4",
+        "hash": "sha256-eSqaWXtzZ4Bi9ilaJYGdZamzUjmo+AtDZ9KeZhsc/fY="
      },
      "src/third_party/litert/src": {
        "url": "https://chromium.googlesource.com/external/github.com/google-ai-edge/LiteRT.git",
-        "rev": "9b5418dd7a1a318eed20395743dcc868df17d8b0",
-        "hash": "sha256-80amwDPF3RrcoTaTQsunNmlvBGs6KCv369FW3J/Xcts="
+        "rev": "09b4b05203fd7a9402ffcce9cc736d887ff7e3fc",
+        "hash": "sha256-skMOzpsn67mmOAp7Mf6UrJdi2lbiQQ8b6kBy4Ik2ED8="
      },
      "src/third_party/vulkan-deps": {
        "url": "https://chromium.googlesource.com/vulkan-deps",
-        "rev": "d234b7b29748c07ef389279dd24f533ebd04cadc",
-        "hash": "sha256-w49HOjPixSI/C5IGlxQMj/Ol9f/Lr2zI2oMhQzzu1zk="
+        "rev": "669a28b1f31f89bfc46b74791f127bcc5e5b2f06",
+        "hash": "sha256-lsR+sh+XQP/wKgkBbie6Gp+kQNFnnC8TeNWpiWTdevw="
      },
      "src/third_party/glslang/src": {
        "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/glslang",
-        "rev": "458ff50a67cb69371850068a62b78f1990a1ff9a",
-        "hash": "sha256-2WauVjAEeZn16b4fE4ImKPX3wjDmeN92mqWi3NMiXSw="
+        "rev": "f6d9303ddaf2e879b9155f7186cd234f5a79079c",
+        "hash": "sha256-ru3QVyyyqxZRcvSpy9pYhHHhkjuLVhQbgOT/vQJ/oIw="
      },
      "src/third_party/spirv-cross/src": {
        "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/SPIRV-Cross",
@ -1544,43 +1549,43 @@
      },
      "src/third_party/spirv-headers/src": {
        "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/SPIRV-Headers",
-        "rev": "126038020c2bd47efaa942ccc364ca5353ffccde",
-        "hash": "sha256-QBX2M+ZSWgVvCx58NeDIdf6mIkdJbecDktBfUWGPvNc="
+        "rev": "1e770e7de8373a8dd49f23416cf7ca4001d01040",
+        "hash": "sha256-t8Shkoa90TJt1MbTOefnLaguW4eYKsRFO1Jd0AUc70Y="
      },
      "src/third_party/spirv-tools/src": {
        "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/SPIRV-Tools",
-        "rev": "2ec8457ab33d539b6f1fecc998360c0b8b05ed4f",
-        "hash": "sha256-9TBb/gnDXgZRZXhF27KEQ0XQI5itRHKJQjLrkFDQq7Q="
+        "rev": "b38c4f83024546d4000b2db8e2294cf81b7f26e0",
+        "hash": "sha256-q5G4B75xBIXl1aG/vzbIDrc3Hs/MFoQ4nwh4ozb8hys="
      },
      "src/third_party/vulkan-headers/src": {
        "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Headers",
-        "rev": "f6a6f7ab165cedbfa2a7d0c93fe27a2d01ce09c8",
-        "hash": "sha256-ZbjmxbRUiVJADNRWziCH0UIM09qKf+lm9PRnWOhZFhQ="
+        "rev": "015e25c3c91b70eb1a754d36fb14c4ba6ad9b0b9",
+        "hash": "sha256-pUxPwFGbOzP8ymTooeA1slFWEFsRoqUROSnndVtLiY8="
      },
      "src/third_party/vulkan-loader/src": {
        "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Loader",
-        "rev": "15a84652b94e465e9a7b25eb507193929863bc2f",
-        "hash": "sha256-pdC3YCM0Nzeabi5TPD+qR5PVdsxmWMnf2L9HsOcbv84="
+        "rev": "cf0cf82ea16c0ff0be75940f282540d6085b2d3b",
+        "hash": "sha256-uyoysS7lSBNDRfvcwPT+gQqhE20UxiYUEw1UXnYS3fY="
      },
      "src/third_party/vulkan-tools/src": {
        "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Tools",
-        "rev": "7c46da2b39036a80ce088576d5794bf39e667f56",
-        "hash": "sha256-nAyNVveeGg9sA0E37YiEPm+UdKsy48nAOjnUYHQnuqw="
+        "rev": "e3d18f90c0b8ef1f52539e0674a42f0adfe30381",
+        "hash": "sha256-Hs9N0FM3eWWjLm4BrDJoZIrsPDVFx0iRAJeQ4gHTM7o="
      },
      "src/third_party/vulkan-utility-libraries/src": {
        "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Utility-Libraries",
-        "rev": "2c909c1ab6f9c6caba39a84a4887186b3fafdead",
-        "hash": "sha256-k3xeKHQbd2rTQJsOZKXEMPrYjcHwoCC1N12F6AIP6Ho="
+        "rev": "8383c46b129c2b3a5f3833e602d946d2fcc57e39",
+        "hash": "sha256-ZBie5uDTVEehxRQW1GZY5Ki/bnp82LoW3jfMUFL0O9A="
      },
      "src/third_party/vulkan-validation-layers/src": {
        "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-ValidationLayers",
-        "rev": "b105d8ea361af258abed65efb5a1565c031dcf1c",
-        "hash": "sha256-GgznBGYgnCFMNaqAOQ15dlw2dOFfSp3mAV2KokVLzgk="
+        "rev": "044eaba8a34a6e3bfb1d6aafac7c01068813a2b6",
+        "hash": "sha256-i3hochkK0LZPg8CsZMFkAL+8tf8QuuwtApAc4FDd0RM="
      },
      "src/third_party/vulkan_memory_allocator": {
        "url": "https://chromium.googlesource.com/external/github.com/GPUOpen-LibrariesAndSDKs/VulkanMemoryAllocator.git",
-        "rev": "cb0597213b0fcb999caa9ed08c2f88dc45eb7d50",
-        "hash": "sha256-yBCs3zfqs/60htsZAOscjcyKhVbAWE6znweuXcs1oKo="
+        "rev": "7e55b011e16182fc349149abbd3aaf3b1db46421",
+        "hash": "sha256-fOnFkcQDEGIe5yB507qnP9nA1LBBPFblncNiJ8JxAwI="
      },
      "src/third_party/wayland/src": {
        "url": "https://chromium.googlesource.com/external/anongit.freedesktop.org/git/wayland/wayland.git",
@ -1614,18 +1619,23 @@
      },
      "src/third_party/webgpu-cts/src": {
        "url": "https://chromium.googlesource.com/external/github.com/gpuweb/cts.git",
-        "rev": "3b327ebc44f11212fd3872972a6dd394634fb9e3",
-        "hash": "sha256-RSZVKv2Z0pg2cGa3Elr2r5VZqdxlRJ+6mzm1Au1qg1I="
+        "rev": "b507bd117e53db86f2fb52d0d858d3ae7d684a85",
+        "hash": "sha256-6Y5Z0ErtsZdbuWTHa+PEiOxcZSbjBcnuOHbgtI1/+80="
      },
      "src/third_party/webpagereplay": {
        "url": "https://chromium.googlesource.com/webpagereplay.git",
-        "rev": "b7ac48f52cd298e966a76eb054412915c3e445d4",
-        "hash": "sha256-smtwB6vzLgCAePz0jNfrpm8TxrxBnBkigLxERhxUEvE="
+        "rev": "b2b856131e36c99e9de9c419fe8ca02f857082ba",
+        "hash": "sha256-+hcaP7C5Eh3SLl5B8mRgOVdM/tvnFnb/oqUIWPoe0NA="
+      },
+      "src/third_party/webpagereplay/third_party/clang-format/script": {
+        "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/clang/tools/clang-format.git",
+        "rev": "6eddfb5ec5f92127a531eda66c568d3a11e7ec11",
+        "hash": "sha256-Cm6BOOlEyD0kdYxMSmk6Fj1Dnfs3zCzXsm+BOXgBme0="
      },
      "src/third_party/webrtc": {
        "url": "https://webrtc.googlesource.com/src.git",
-        "rev": "28311abc149a9bb7e6761a3d54f362a8d77e6793",
-        "hash": "sha256-WuaxKrbISJ1nwyoj2sPAhGCNz33xEYSX1WlDiM+zxpw="
+        "rev": "1f975dfd761af6e5d76d28333191973b258d82a8",
+        "hash": "sha256-ucH+9HBkFyOKEItAWVoYmEzyU7h/UgWIvp/eC/JqGWU="
      },
      "src/third_party/wuffs/src": {
        "url": "https://skia.googlesource.com/external/github.com/google/wuffs-mirror-release-c.git",
@ -1639,8 +1649,8 @@
      },
      "src/third_party/xnnpack/src": {
        "url": "https://chromium.googlesource.com/external/github.com/google/XNNPACK.git",
-        "rev": "2ad25fc09167df69c6c02eb8082a0b9658dd5e80",
-        "hash": "sha256-vBMGBXzJPCcsc2kMyGecjti68oZHWUwJKd7tkKub6kg="
+        "rev": "56ac34b3f45fae2eca1f32584f7f0b279be2cf1f",
+        "hash": "sha256-uw3r5g5rWamlFubBkXDb4KRx3hkOAoQyFo8l95GYGZI="
      },
      "src/third_party/libei/src": {
        "url": "https://chromium.googlesource.com/external/gitlab.freedesktop.org/libinput/libei.git",
@ -1649,13 +1659,18 @@
      },
      "src/third_party/zstd/src": {
        "url": "https://chromium.googlesource.com/external/github.com/facebook/zstd.git",
-        "rev": "3ae099b48dfcfe02b1b3ba81ab85457f8a922e9f",
-        "hash": "sha256-futF0sM6z9HAl6AMJwUULBRByN92FTBjRIzYb2vBFGg="
+        "rev": "5233c58e6ca0b1c4c6b353ad79649191ed195bdc",
+        "hash": "sha256-vEl0s7Mjh+5rciOMxm99PNWiamtCk+sTN4lRYKCIZ+8="
      },
      "src/v8": {
        "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "933ce636c562cd54d68e7f7c93ab5cdffd685fca",
-        "hash": "sha256-zYArO6QS9nDIVWPINRVaDN1uX8X/wchBDeZHPZnwHYk="
+        "rev": "968f19a8970f8d91702d86f0ec1522f3909781b7",
+        "hash": "sha256-x3rCWvC3hEjyJq6PNThhZEp4oRF9Y1JJEPnZTqVNVrY="
+      },
+      "src/agents/shared": {
+        "url": "https://chromium.googlesource.com/chromium/agents.git",
+        "rev": "e75efa515896f6bf1dea92eaffbcf8ee711a65d8",
+        "hash": "sha256-z2GrzF8jDkdfBdq1HP3gTgQpoqjmhc80kEZBmlue0os="
      }
    }
  }
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@ -27,13 +27,13 @@
    "vendorHash": null
  },
  "aiven_aiven": {
-    "hash": "sha256-+iZbQ5V8DQXBRHlt3UuSa3WKbC5A0ootY4AQ6leTHBo=",
+    "hash": "sha256-rXoDdoBK4yS/suC6lEnK+dWxcILRG+XcMNXVyVmeQYw=",
    "homepage": "https://registry.terraform.io/providers/aiven/aiven",
    "owner": "aiven",
    "repo": "terraform-provider-aiven",
-    "rev": "v4.59.0",
+    "rev": "v4.60.0",
    "spdx": "MIT",
-    "vendorHash": "sha256-NWkgbkjaaA0dxphUWhiNqBaUKobdjsMEvD05WShZHHQ="
+    "vendorHash": "sha256-4S5uyvSjtEOO1hK5MhuAmjsPBJ6qC1KN3/mrtRHU+P4="
  },
  "akamai_akamai": {
    "hash": "sha256-M6Btq8wX1lsEs1HUaaTwGspnvS2IyE0L2ITe+ogDTlc=",
@ -589,13 +589,13 @@
    "vendorHash": "sha256-ayt8FR4684ZV5kd6exMw0AEgkMJLW5huvTYZqcr3q/s="
  },
  "hashicorp_google-beta": {
-    "hash": "sha256-LbNsD7R+TP9trNaMZq+OTyGlQPR6EZoSdUx3uo+3xUo=",
+    "hash": "sha256-pEdNv1MViCsCb3wFoDghCeQ5q2FErtGrQL9noL5B11g=",
    "homepage": "https://registry.terraform.io/providers/hashicorp/google-beta",
    "owner": "hashicorp",
    "repo": "terraform-provider-google-beta",
-    "rev": "v7.38.0",
+    "rev": "v7.39.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-JAxI/E8GlUZd3RlhsrIhGm4+G18/obms+czJORYCENY="
+    "vendorHash": "sha256-u4zldvOO/TtNHC8B+c63DWMbk7iEix+S+y/RLExchI8="
  },
  "hashicorp_helm": {
    "hash": "sha256-Dw6khnp0pronRKbBv2gx8ygtVvRV9uQIHCXj2BblZ6k=",
@ -688,13 +688,13 @@
    "vendorHash": "sha256-aM9bDzYM4RW3cIeJCMnIB9VqEaPV4D0r3zMOU3d0QDs="
  },
  "hashicorp_vault": {
-    "hash": "sha256-k/S1ez6q70vvnHMfU2aweTFzRnLlYbxUEh4xZumT1mo=",
+    "hash": "sha256-Jl1mF2DIzLcXmevrFGLjnThUBR0TXiXvvgQYwFLwBtE=",
    "homepage": "https://registry.terraform.io/providers/hashicorp/vault",
    "owner": "hashicorp",
    "repo": "terraform-provider-vault",
-    "rev": "v5.9.0",
+    "rev": "v5.10.1",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-0TJbC7gG5yduWrzp7MN5WWDjsdyL6RqXmOlIDs3OtaU="
+    "vendorHash": "sha256-MMivACUsYhJg+wkag08NHEYkjjdJouq+QCR08CTAiKM="
  },
  "hashicorp_vsphere": {
    "hash": "sha256-vRO6vxzi4d0hNc0MmQLhN7roONnsjxPBtFt0fyvxWd8=",
@ -1157,13 +1157,13 @@
    "vendorHash": null
  },
  "sacloud_sakuracloud": {
-    "hash": "sha256-mk5tmlx8UZXedRbSKmSg9YqX9MJFWsSrMea1dirL+HI=",
+    "hash": "sha256-oAD+QfMqUOtbh2GNooyV1Yc1OVHuAnv86ZvuCB7zo8E=",
    "homepage": "https://registry.terraform.io/providers/sacloud/sakuracloud",
    "owner": "sacloud",
    "repo": "terraform-provider-sakuracloud",
-    "rev": "v2.36.0",
+    "rev": "v2.36.1",
    "spdx": "Apache-2.0",
-    "vendorHash": "sha256-vBcPWjugjqyuUdvxNQN1oC8V5D2SeW2WR0/c6OlgaXU="
+    "vendorHash": "sha256-zklw0YajAZZLkosLxZCsWtAbvmHuGEI8OGpVykp1Xw4="
  },
  "sap-cloud-infrastructure_sci": {
    "hash": "sha256-eQA4mY+Rx5PLbTgGqfefYFc5gZKIvt1w2eag8ipE0PI=",
@ -1409,11 +1409,11 @@
    "vendorHash": null
  },
  "ubiquiti-community_unifi": {
-    "hash": "sha256-7lmT0ZCRfu3nL1FXAdxMxvQURtNcZiz9GY+0d7HI2N0=",
+    "hash": "sha256-wqR9XIuH9QzzacdOd8Z+QcfTXwjjnTQA8SbEHcLYhig=",
    "homepage": "https://registry.terraform.io/providers/ubiquiti-community/unifi",
    "owner": "ubiquiti-community",
    "repo": "terraform-provider-unifi",
-    "rev": "v0.53.0",
+    "rev": "v0.54.0",
    "spdx": "MPL-2.0",
    "vendorHash": "sha256-XPEH1zya7e/3N/HxBPN/vZxFU5GOOXfBPTrnZEUzdpw="
  },
--- a/pkgs/applications/virtualization/docker/compose.nix
+++ b/pkgs/applications/virtualization/docker/compose.nix
@ -6,16 +6,16 @@
 }:
 buildGoModule rec {
  pname = "docker-compose";
-  version = "5.2.0";
+  version = "5.3.0";

  src = fetchFromGitHub {
    owner = "docker";
    repo = "compose";
    tag = "v${version}";
-    hash = "sha256-sKfsPn8CV62TXY0LoquQYEUgSBVDRiKW0Z3/py1RFng=";
+    hash = "sha256-Vq1CJcneoFYGlQjJgAZsPN8kR/xrnsF7abG7HACkdKA=";
  };

-  vendorHash = "sha256-1cYmWaj6gvmM6207dj8E7kVKIOJlS4js9EwNXhnv13A=";
+  vendorHash = "sha256-aEM+iHtwy/axoI5KwG2BnqSYKEwmuUPr5KcmdaO1mho=";

  nativeInstallCheckInputs = [ versionCheckHook ];

--- a/pkgs/by-name/ad/adif-multitool/package.nix
+++ b/pkgs/by-name/ad/adif-multitool/package.nix
@ -5,15 +5,17 @@
 }:
 buildGoModule (finalAttrs: {
  pname = "adif-multitool";
-  version = "0.1.20";
+  version = "0.1.22";

-  vendorHash = "sha256-U9BpTDHjUZicMjKeyxyM/eOxJeAY2DMQMHOEMiCeN/U=";
+  vendorHash = "sha256-Fin0DUvpNPqKXpbDVekvWZYghJIpMLY9IRr2wdbZczc=";
+
+  proxyVendor = true;

  src = fetchFromGitHub {
    owner = "flwyd";
    repo = "adif-multitool";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-qeAH8UTyEZn8As3wTjluONpjeT/5l9zicN5+8uwnbLo=";
+    hash = "sha256-UYnm4S4DP0c2ZkPkPScUHXdKiAz6JY9Lzdu4mAO49Dc=";
  };

  meta = {
--- a/pkgs/by-name/aw/awsebcli/package.nix
+++ b/pkgs/by-name/aw/awsebcli/package.nix
@ -27,7 +27,7 @@ in

 python.pkgs.buildPythonApplication (finalAttrs: {
  pname = "awsebcli";
-  version = "3.27.2";
+  version = "3.27.3";
  pyproject = true;
  doInstallCheck = true;

@ -35,7 +35,7 @@ python.pkgs.buildPythonApplication (finalAttrs: {
    owner = "aws";
    repo = "aws-elastic-beanstalk-cli";
    tag = finalAttrs.version;
-    hash = "sha256-hTRgNqccwbXxpS4F+JD2h19N/U671NjCBEMiDp6Jbio=";
+    hash = "sha256-p7W9HoFND28jcqrMp7cFOzmarxvcA3wFhrOCHyvoj5E=";
  };

  pythonRelaxDeps = [
--- a/pkgs/by-name/ba/bacnet-stack/package.nix
+++ b/pkgs/by-name/ba/bacnet-stack/package.nix
@ -2,35 +2,42 @@
  lib,
  stdenv,
  fetchFromGitHub,
+  cmake,
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "bacnet-stack";
-  version = "1.3.5";
+  version = "1.5.0";

  src = fetchFromGitHub {
    owner = "bacnet-stack";
    repo = "bacnet-stack";
-    rev = "bacnet-stack-${finalAttrs.version}";
-    sha256 = "sha256-Iwo0bNulKdFNwNU2xj6Uin+5hQt1I3N6+zso5BHrIOU=";
+    tag = "bacnet-stack-${finalAttrs.version}";
+    hash = "sha256-CJmEEIGT6u2nsnl3btWL/JJPxQM53JF6l+mLBSF+Q8Q=";
  };

-  hardeningDisable = [ "all" ];
+  nativeBuildInputs = [ cmake ];

-  buildPhase = ''
-    make BUILD=debug BACNET_PORT=linux BACDL_DEFINE=-DBACDL_BIP=1 BACNET_DEFINES=" -DPRINT_ENABLED=1 -DBACFILE -DBACAPP_ALL -DBACNET_PROPERTY_LISTS"
-  '';
-
-  installPhase = ''
-    mkdir $out
-    cp -r bin $out/bin
+  # bacnet-stack's CMakeLists builds the apps via add_executable() but never
+  # adds install(TARGETS ...) rules for them, so `make install` skips them.
+  # Copy them out of the CMake build tree manually.
+  postInstall = ''
+    mkdir -p $out/bin
+    find . -maxdepth 2 -type f -executable -not -name '*.so*' -not -name '*.a' \
+      -exec cp -t $out/bin {} +
  '';

  meta = {
    description = "BACnet open source protocol stack for embedded systems, Linux, and Windows";
    homepage = "https://github.com/bacnet-stack/bacnet-stack";
-    platforms = lib.platforms.linux;
-    license = lib.licenses.gpl2Plus;
+    changelog = "https://github.com/bacnet-stack/bacnet-stack/blob/bacnet-stack-${finalAttrs.version}/CHANGELOG.md";
+    license = with lib.licenses; [
+      gpl2Plus # Core stack (WITH GCC-exception-2.0)
+      mit # Examples and applications
+      asl20 # Auxiliary files (SPDX identified)
+      bsd3 # Auxiliary files (SPDX identified)
+    ];
    maintainers = with lib.maintainers; [ WhittlesJr ];
+    platforms = lib.platforms.linux;
  };
 })
--- a/pkgs/by-name/ba/bazelisk/package.nix
+++ b/pkgs/by-name/ba/bazelisk/package.nix
@ -6,16 +6,16 @@

 buildGoModule (finalAttrs: {
  pname = "bazelisk";
-  version = "1.28.1";
+  version = "1.29.0";

  src = fetchFromGitHub {
    owner = "bazelbuild";
    repo = "bazelisk";
-    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-iKU8B8yOT8cPvZhuor8ZVRsHQDoXq1ja1mr60XqHoEs=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-NijRYjJyWOqSkfDKOdki3nrc1OIhfooKLhusuiMY/Js=";
  };

-  vendorHash = "sha256-PWqKq/2DFopeiecUL0iWnut8Kd/52U32sNSVGj3Ae5g=";
+  vendorHash = "sha256-oycCqzUAn/lNFjeLjM+PQfYNscaTi5E9D7Pnv8jrO8M=";

  ldflags = [
    "-s"
@ -30,8 +30,10 @@ buildGoModule (finalAttrs: {
      BEWARE: This package does not work on NixOS.
    '';
    homepage = "https://github.com/bazelbuild/bazelisk";
-    changelog = "https://github.com/bazelbuild/bazelisk/releases/tag/v${finalAttrs.version}";
+    changelog = "https://github.com/bazelbuild/bazelisk/releases/tag/${finalAttrs.src.tag}";
    license = lib.licenses.asl20;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [
+      hythera
+    ];
  };
 })
--- a/pkgs/by-name/bi/bitwarden-desktop/package.nix
+++ b/pkgs/by-name/bi/bitwarden-desktop/package.nix
@ -26,13 +26,13 @@ let
 in
 buildNpmPackage (finalAttrs: {
  pname = "bitwarden-desktop";
-  version = "2026.6.0";
+  version = "2026.6.1";

  src = fetchFromGitHub {
    owner = "bitwarden";
    repo = "clients";
    tag = "desktop-v${finalAttrs.version}";
-    hash = "sha256-JIIis3wW0cU33ovRQfJi3HlB2YdLZ5IPvueq1dGFbas=";
+    hash = "sha256-ee+C58Y5pZWEmqbRO/w7rdY+e6gy4EL7Sn0S1AxGMXI=";
  };

  patches = [
@ -74,7 +74,7 @@ buildNpmPackage (finalAttrs: {

  npmWorkspace = "apps/desktop";
  npmDepsFetcherVersion = 3;
-  npmDepsHash = "sha256-mvFLZwWwIv4PbUwfTWvwZ9JyRoHJSwAA0cT4RXD0/YU=";
+  npmDepsHash = "sha256-C5GLei/WWetd4qLv7obBJWbQR9LBy+Sqdbjko3/W7VY=";

  cargoDeps = rustPlatform.fetchCargoVendor {
    inherit (finalAttrs)
--- a/pkgs/by-name/br/breaktimer/package.nix
+++ b/pkgs/by-name/br/breaktimer/package.nix
@ -3,7 +3,7 @@
  stdenv,
  buildNpmPackage,
  copyDesktopItems,
-  electron_40,
+  electron_41,
  fetchFromGitHub,
  jq,
  makeDesktopItem,
@ -13,7 +13,7 @@
 }:

 let
-  electron = electron_40;
+  electron = electron_41;
  nodejs = nodejs_24;
  description = "Cross-platform desktop app for managing periodic breaks";
 in
@ -51,13 +51,6 @@ buildNpmPackage rec {
    copyDesktopItems
  ];

-  preBuild = ''
-    if [[ $(jq --raw-output '.devDependencies.electron' < package.json | grep -E --only-matching '\^[0-9]+' | sed -e 's/\^//') != ${lib.escapeShellArg (lib.versions.major electron.version)} ]]; then
-      echo 'ERROR: electron version mismatch'
-      exit 1
-    fi
-  '';
-
  buildPhase = ''
    runHook preBuild

--- a/pkgs/by-name/bu/burp/package.nix
+++ b/pkgs/by-name/bu/burp/package.nix
@ -2,65 +2,52 @@
  lib,
  stdenv,
  fetchFromGitHub,
-  fetchpatch,
  autoreconfHook,
  pkg-config,
  acl,
  librsync,
  ncurses,
-  openssl_legacy,
+  openssl,
  zlib,
  uthash,
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "burp";
-  version = "2.4.0";
+  version = "3.2.0";

  src = fetchFromGitHub {
    owner = "grke";
    repo = "burp";
    tag = finalAttrs.version;
-    hash = "sha256-y6kRd1jD6t+Q6d5t7W9MDuk+m2Iq1THQkP50PJwI7Nc=";
+    hash = "sha256-jZSrHq3dL9Za71E2k4UDTHe10ESAgkBy5bogY2AqtnM=";
  };

-  patches = [
-    # Pull upstream fix for ncurses-6.3 support
-    (fetchpatch {
-      name = "ncurses-6.3.patch";
-      url = "https://github.com/grke/burp/commit/1d6c931af7c11f164cf7ad3479781e8f03413496.patch";
-      hash = "sha256-dJn9YhFQWggoqD3hce7F1d5qHYogbPP6+NMqCpVbTpM=";
-    })
-    # Pull upstream fix for backup resuming
-    (fetchpatch {
-      name = "fix-resume.patch";
-      url = "https://github.com/grke/burp/commit/b5ed667f73805b5af9842bb0351f5af95d4d50b3.patch";
-      hash = "sha256-MT9D2thLgV4nT3LsIDHZp8sWQF2GlOENj0nkOQXZKuk=";
-    })
-  ];
-
  nativeBuildInputs = [
    autoreconfHook
    pkg-config
  ];
-  # use openssl_legacy due to burp-2.4.0 not supporting file encryption with openssl 3.0
-  # replace with 'openssl' once burp-3.x has been declared stable and this package upgraded
+
  buildInputs = [
    librsync
    ncurses
-    openssl_legacy
+    openssl
    zlib
    uthash
  ]
  ++ lib.optional (!stdenv.hostPlatform.isDarwin) acl;

-  configureFlags = [ "--localstatedir=/var" ];
+  configureFlags = [
+    "--sysconfdir=/etc/burp"
+    "--localstatedir=/var"
+  ];

  installFlags = [ "localstatedir=/tmp" ];

  meta = {
-    description = "BackUp and Restore Program";
+    description = "Backup and restore Program";
    homepage = "https://burp.grke.org";
+    changelog = "https://github.com/grke/burp/blob/${finalAttrs.version}/CHANGELOG";
    license = lib.licenses.agpl3Plus;
    maintainers = with lib.maintainers; [ arjan-s ];
    platforms = lib.platforms.all;
--- a/pkgs/by-name/cl/claude-code/manifest.json
+++ b/pkgs/by-name/cl/claude-code/manifest.json
@ -1,47 +1,47 @@
 {
-  "version": "2.1.198",
-  "commit": "b80c496480ebf28e6dfe755cf0b8e3dd1d7cba1f",
-  "buildDate": "2026-07-01T06:17:25Z",
+  "version": "2.1.199",
+  "commit": "968b0c4118bde7c998acd97511e68daecacd8507",
+  "buildDate": "2026-07-02T01:58:04Z",
  "platforms": {
    "darwin-arm64": {
      "binary": "claude",
-      "checksum": "ab6f7ee109816ede414f7c285446633f805b623aa609f425609a64266451d61e",
-      "size": 229328464
+      "checksum": "e3cb61abc8a2ec7b98976cee1ffdde5a3fa755c9990bc8d688cd89290e0dcec0",
+      "size": 232155536
    },
    "darwin-x64": {
      "binary": "claude",
-      "checksum": "280b6cfc60dacc4caed31af1249e53c259c01759556e60633944c02405c82dd0",
-      "size": 238706000
+      "checksum": "e64853ff3bc2ae6ed8115581c851e1176762d445d0b8b9e0dd37d0d560224a88",
+      "size": 240192080
    },
    "linux-arm64": {
      "binary": "claude",
-      "checksum": "99b50a6f2b1f3ef07bcaf1e58a2f9883c470c84e428afa321972b1aa20372e9a",
-      "size": 245742320
+      "checksum": "14851b5170b154b01baca09bba970172e70cdd768b5a012bf347ba0f594b4ad3",
+      "size": 247184112
    },
    "linux-x64": {
      "binary": "claude",
-      "checksum": "7066af42a5fe93038c13af5072d4c034dc3928092cb121fdd892c76b94b6b84d",
-      "size": 248900408
+      "checksum": "b31dfd5e3dee23b51c42e0d8ddb405148978237d3aabc8cbbf77c5cf83367e27",
+      "size": 250383160
    },
    "linux-arm64-musl": {
      "binary": "claude",
-      "checksum": "88cb391085e419457569bcc57a672f734f30b424e17df7323f3bbb421238e801",
-      "size": 238990520
+      "checksum": "4115c07bc6dfa71affff595400599032b70b4ab25b7a2dae982341ef4da47b38",
+      "size": 240432312
    },
    "linux-x64-musl": {
      "binary": "claude",
-      "checksum": "42892159a03bee492926b616b1270313544f7a52b68d32cb680e91984a4c6659",
-      "size": 243589504
+      "checksum": "22c8b0861078cef1b572023e7eda4ce0dda7e12cc2e3060858eaa3de010bee21",
+      "size": 245068160
    },
    "win32-x64": {
      "binary": "claude.exe",
-      "checksum": "6afd07cb03aa981c5e918808f53a1e2b729015b695122a944f6e41aaf5393933",
-      "size": 239292064
+      "checksum": "63de670613bb74594564a2125cb54e0e2e78192c5696e396adfae093b9132eec",
+      "size": 240716448
    },
    "win32-arm64": {
      "binary": "claude.exe",
-      "checksum": "10a6d21332f674c87f52b1dc09926945d0169f1bb82aced84ada100639ab70bc",
-      "size": 233758880
+      "checksum": "7e4900b1ce5588003e0ade6caa0aaef1e2b8efd903c5a86c671d0de258b7a4d4",
+      "size": 235182752
    }
  }
 }
--- a/pkgs/by-name/cl/cliflux/package.nix
+++ b/pkgs/by-name/cl/cliflux/package.nix
@ -1,7 +1,7 @@
 {
  lib,
  rustPlatform,
-  fetchFromGitHub,
+  fetchFromCodeberg,
  pkg-config,
  openssl,
  nix-update-script,
@ -9,16 +9,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cliflux";
-  version = "1.9.1";
+  version = "1.10.0";

-  src = fetchFromGitHub {
+  src = fetchFromCodeberg {
    owner = "spencerwi";
    repo = "cliflux";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-oBjflPZooZatZCvKLA8h0BMuj++2tPrhE365zTk7vhM=";
+    hash = "sha256-fzuqgzBVnVIOcRplDKLBskhX9PlMA9LM0f3MnLqzyhk=";
  };

-  cargoHash = "sha256-Q+/sh7Wku40SyhmgGci1YgCXQuEu1Zf4DaRDlDqWpak=";
+  cargoHash = "sha256-gAfN3kO5wrZ8usKv4C97LT+BAEu9ZD8ZP/GOCrWC7Nk=";

  nativeBuildInputs = [
    pkg-config
@ -32,8 +32,8 @@ rustPlatform.buildRustPackage (finalAttrs: {

  meta = {
    description = "Terminal client for Miniflux RSS reader";
-    homepage = "https://github.com/spencerwi/cliflux";
-    changelog = "https://github.com/spencerwi/cliflux/blob/v${finalAttrs.version}/CHANGELOG.md";
+    homepage = "https://codeberg.org/spencerwi/cliflux";
+    changelog = "https://codeberg.org/spencerwi/cliflux/raw/tag/v${finalAttrs.version}/CHANGELOG.md";
    license = lib.licenses.mit;
    maintainers = [ ];
    mainProgram = "cliflux";
--- a/pkgs/by-name/co/concord-tui/package.nix
+++ b/pkgs/by-name/co/concord-tui/package.nix
@ -10,16 +10,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "concord-tui";
-  version = "2.2.7";
+  version = "2.2.12";

  src = fetchFromGitHub {
    owner = "chojs23";
    repo = "concord";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-WSZsN1+ZhFWTHl9BvKERrr0lQj06N392Jo2nYjNm5QY=";
+    hash = "sha256-oohoQIShX6zZC4fEPQnkvJVqhJSmU21ZrbfN9bDTnQI=";
  };

-  cargoHash = "sha256-LJnwO9507nLptKARCih58+wKrHzLGu+qQ/guf1oezX8=";
+  cargoHash = "sha256-TFjph7qSc3dHaMRUC7kUwvblfB8zdyvcMT16aHFm8wo=";

  buildInputs = [
    opus
@ -40,7 +40,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
    description = "Feature-rich TUI client for Discord, written in Rust";
    homepage = "https://github.com/chojs23/concord";
    license = lib.licenses.gpl3Only;
-    maintainers = with lib.maintainers; [ Simon-Weij ];
+    maintainers = with lib.maintainers; [
+      Simon-Weij
+      neo
+    ];
    mainProgram = "concord";
  };
 })
--- a/pkgs/by-name/co/cope/package.nix
+++ b/pkgs/by-name/co/cope/package.nix
@ -14,6 +14,12 @@ perlPackages.buildPerlPackage {
    rev = "6d0322a8493361ad32e454b97998df715dbe7b97";
    hash = "sha256-VQveV7avM/4nbLroyujJaSoVAP3pXhwrzqzI3eMzxVo=";
  };
+
+  postPatch = ''
+    substituteInPlace lib/App/Cope.pm \
+      --replace-warn "feature->import( ':5.10' );" "require feature; feature->import( ':5.10' );"
+  '';
+
  nativeBuildInputs = [ makeWrapper ];

  buildInputs = with perlPackages; [
@ -67,6 +73,5 @@ perlPackages.buildPerlPackage {
      gpl1Plus
    ];
    maintainers = with lib.maintainers; [ deftdawg ];
-    broken = true; # requires old Perl we don't ship anymore
  };
 }
--- a/pkgs/by-name/ex/extism-js-core/package.nix
+++ b/pkgs/by-name/ex/extism-js-core/package.nix
@ -79,6 +79,9 @@ rustPlatform.buildRustPackage (finalAttrs: {
  __structuredAttrs = true;

  meta = {
+    # Fails to build on darwin due to libiconv linking failure (ld: library not found for -liconv)
+    # See https://github.com/NixOS/nixpkgs/pull/523442 for a (failed) attempt at fixing the issue
+    broken = stdenv.buildPlatform.isDarwin;
    changelog = "https://github.com/extism/js-pdk/releases/tag/${finalAttrs.src.tag}";
    description = "Write Extism plugins in JavaScript & TypeScript (WASM core)";
    homepage = "https://github.com/extism/js-pdk";
--- a/pkgs/by-name/fl/fluxcd/package.nix
+++ b/pkgs/by-name/fl/fluxcd/package.nix
@ -9,10 +9,10 @@
 }:

 let
-  version = "2.8.8";
-  srcHash = "sha256-ECFEzYhnhse2yrfWYaeN5dE+HUvCy5RKZ2OceCb5+sA=";
-  vendorHash = "sha256-pV7eoiGhWk6KYZbK8bamXJY/NdK7ZYqrVcCTX9ccLJc=";
-  manifestsHash = "sha256-fF21nDstKUrlW6fgm0DrDtntR/0cnHMEzRltjBm9nwA=";
+  version = "2.9.0";
+  srcHash = "sha256-zMlaBIxhmKFeBFhCC3M1wc9sKjSjUzpNLti53ow5SgU=";
+  vendorHash = "sha256-J1MofT7PwcQ74XwVumu7PfkAteKR6iJIZe+vMoaD+Eg=";
+  manifestsHash = "sha256-PAbQa76mwu6BNR7AX88IhQM9Veg01va4THJ/6B6pu9A=";

  manifests = fetchzip {
    url = "https://github.com/fluxcd/flux2/releases/download/v${version}/manifests.tar.gz";
--- a/pkgs/by-name/gp/gpclient/package.nix
+++ b/pkgs/by-name/gp/gpclient/package.nix
@ -82,7 +82,9 @@ rustPlatform.buildRustPackage {

  postPatch = ''
    substituteInPlace crates/openconnect/src/vpn_utils.rs \
+      --replace-fail /usr/local/libexec/gpclient/vpnc-script $out/libexec/gpclient/vpnc-script \
      --replace-fail /usr/libexec/gpclient/vpnc-script $out/libexec/gpclient/vpnc-script \
+      --replace-fail /usr/local/libexec/gpclient/hipreport.sh $out/libexec/gpclient/hipreport.sh \
      --replace-fail /usr/libexec/gpclient/hipreport.sh $out/libexec/gpclient/hipreport.sh

    substituteInPlace crates/common/src/constants.rs \
@ -99,7 +101,9 @@ rustPlatform.buildRustPackage {
    cp -r packaging/files/usr/libexec $out/libexec

    substituteInPlace $out/libexec/gpclient/hipreport.sh \
-      --replace-fail /usr/bin/gpclient $out/bin/gpclient
+      --replace-fail /usr/bin/gpclient $out/bin/gpclient \
+      --replace-fail /opt/homebrew/bin/gpclient $out/bin/gpclient \
+      --replace-fail /usr/local/bin/gpclient $out/bin/gpclient
  ''
  + lib.optionalString stdenv.hostPlatform.isLinux ''
    substituteInPlace $out/libexec/gpclient/vpnc-script \
--- a/pkgs/by-name/gw/gwq/package.nix
+++ b/pkgs/by-name/gw/gwq/package.nix
@ -0,0 +1,77 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  gitMinimal,
+  installShellFiles,
+  makeWrapper,
+  tmux,
+  writableTmpDirAsHomeHook,
+  versionCheckHook,
+  stdenv,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "gwq";
+  version = "0.1.1";
+
+  src = fetchFromGitHub {
+    owner = "d-kuro";
+    repo = "gwq";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-MfCYFbODWnfPxx+6sLlcMT6tqghgILHB13+ccYqVjBA=";
+  };
+
+  vendorHash = "sha256-4K01Xf1EXl/NVX1loQ76l1bW8QglBAQdvlZSo7J4NPI=";
+
+  subPackages = [ "cmd/gwq" ];
+
+  __structuredAttrs = true;
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/d-kuro/gwq/internal/cmd.version=v${finalAttrs.version}"
+  ];
+
+  nativeBuildInputs = [
+    installShellFiles
+    makeWrapper
+  ];
+
+  nativeCheckInputs = [
+    writableTmpDirAsHomeHook
+  ];
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+
+  postInstall = ''
+    wrapProgram $out/bin/gwq \
+      --prefix PATH : ${
+        lib.makeBinPath [
+          gitMinimal
+          tmux
+        ]
+      }
+  ''
+  + lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    installShellCompletion --cmd gwq \
+      --bash <($out/bin/gwq completion bash) \
+      --fish <($out/bin/gwq completion fish) \
+      --zsh <($out/bin/gwq completion zsh)
+  '';
+
+  doInstallCheck = true;
+
+  meta = {
+    description = "Git worktree manager with fuzzy finder interface";
+    homepage = "https://github.com/d-kuro/gwq";
+    changelog = "https://github.com/d-kuro/gwq/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.asl20;
+    mainProgram = "gwq";
+    maintainers = with lib.maintainers; [ ojii3 ];
+    platforms = lib.platforms.unix;
+  };
+})
--- a/pkgs/by-name/ha/handy/package.nix
+++ b/pkgs/by-name/ha/handy/package.nix
@ -28,6 +28,7 @@
  gtk-layer-shell,
  vulkan-loader,
  vulkan-headers,
+  spirv-headers,
  shaderc,
  gst_all_1,
  glib-networking,
@ -54,7 +55,7 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "handy";
-  version = "0.8.3";
+  version = "0.9.0";

  __structuredAttrs = true;

@ -62,11 +63,11 @@ rustPlatform.buildRustPackage (finalAttrs: {
    owner = "cjpais";
    repo = "Handy";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-sCCtp6UAxmCAcYeOM9+RW2czATh4Geqf1H8wXNMniYc=";
+    hash = "sha256-jRzy8nsLtlNrYXb4LWP5SK6XpIy2pguNcZno3m6Mkqw=";
  };

  cargoRoot = "src-tauri";
-  cargoHash = "sha256-mvOThNqfE24iMkVBM2zYexJkQxpMMgE4PPNXKy39hSg=";
+  cargoHash = "sha256-Ag02t6KwKvgO1kKsQ4RAw9X+rWYNhDyav2N6i4o7ifQ=";

  nativeInstallInputs = [ jq ];

@ -109,6 +110,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
  ++ lib.optionals stdenv.hostPlatform.isLinux [
    wrapGAppsHook4
    shaderc
+    spirv-headers
  ]
  ++ lib.optionals stdenv.hostPlatform.isDarwin [
    makeBinaryWrapper
@ -154,12 +156,19 @@ rustPlatform.buildRustPackage (finalAttrs: {
    SWIFTC = lib.getExe' swift "swiftc"; # Explicit so the Handy build system can avoid xcrun
  };

-  preBuild = ''
-    cp -R ${finalAttrs.passthru.frontendDeps}/node_modules .
-    chmod -R u+w node_modules
-    patchShebangs node_modules
-    bun run build
-  '';
+  preBuild =
+    lib.optionalString stdenv.hostPlatform.isLinux ''
+      # Linux enables transcribe-cpp's ggml Vulkan backend, whose CMake build
+      # needs SPIRV-Headers' package config and headers.
+      export CMAKE_PREFIX_PATH="${spirv-headers}''${CMAKE_PREFIX_PATH:+:''${CMAKE_PREFIX_PATH}}"
+      export NIX_CFLAGS_COMPILE="-isystem ${spirv-headers}/include ''${NIX_CFLAGS_COMPILE:-}"
+    ''
+    + ''
+      cp -R ${finalAttrs.passthru.frontendDeps}/node_modules .
+      chmod -R u+w node_modules
+      patchShebangs node_modules
+      bun run build
+    '';

  # If removed, the binary is produced, but not the app bundle for any platform.
  installPhase = ''
@ -208,8 +217,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    # The hook and deps fetcher in https://github.com/NixOS/nixpkgs/pull/376299 should simplify this dramatically.
    frontendDeps = stdenv.mkDerivation {
      pname = "handy-frontend-deps";
-      version = "0.8.3";
-      inherit (finalAttrs) src;
+      inherit (finalAttrs) src version;

      nativeBuildInputs = [
        bun
@ -238,9 +246,9 @@ rustPlatform.buildRustPackage (finalAttrs: {

      outputHash =
        {
-          "x86_64-linux" = "sha256-tJ6LK99dELOiR0BcsTRTt/vLyNamntujLxhBy5Xl/lc=";
-          "aarch64-linux" = "sha256-S+dX6ZVgv9dexxIHoa5PxP7e0nxf/d7cKUGty5eEi8A=";
-          "aarch64-darwin" = "sha256-DQbogNBQ9izK5GPmoOudqiB2lJvct1vZI2U5lp3WFy8=";
+          "x86_64-linux" = "sha256-1jZBFvX9Ch3jNGPgSnOE8yNCXlHru7tcMJZ5uNZtE1g=";
+          "aarch64-linux" = "sha256-MsY2tOdBg11OMyQLRkLoVKxyrcqa0yVddfcYuIVWSxw=";
+          "aarch64-darwin" = "sha256-Fw0va7mq0F36qa15bDFVL01Q5pEprWhza78CzurLoLg=";
        }
        .${stdenv.hostPlatform.system};

@ -268,7 +276,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
    changelog = "https://github.com/cjpais/Handy/releases/tag/v${finalAttrs.version}";
    license = lib.licenses.mit;
    mainProgram = "handy";
-    maintainers = with lib.maintainers; [ philocalyst ];
+    maintainers = with lib.maintainers; [
+      faukah
+      philocalyst
+    ];
    platforms = with lib.platforms; linux ++ darwin;
    badPlatforms = [ "x86_64-darwin" ]; # We weren't able to get hashes here
  };
--- a/pkgs/by-name/ha/hardinfo2/package.nix
+++ b/pkgs/by-name/ha/hardinfo2/package.nix
@ -51,13 +51,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "hardinfo2";
-  version = "2.2.16";
+  version = "2.3.1";

  src = fetchFromGitHub {
    owner = "hardinfo2";
    repo = "hardinfo2";
    tag = "release-${finalAttrs.version}";
-    hash = "sha256-n/Rf/XKsATx3OEzYSjl+2Yzk7WSiaBkbOveA9+xR6fc=";
+    hash = "sha256-rrb7iwR5kd7kJSncbE+yzdG55L7IaF7919kLsl/A5pY=";
  };

  patches = [
--- a/pkgs/by-name/hu/hue-plus/package.nix
+++ b/pkgs/by-name/hu/hue-plus/package.nix
@ -5,16 +5,18 @@
  libsForQt5,
 }:

-python3Packages.buildPythonApplication {
+python3Packages.buildPythonApplication (finalAttrs: {
  pname = "hue-plus";
  version = "1.4.5";
-  format = "setuptools";
+  pyproject = true;
+
+  build-system = with python3Packages; [ setuptools ];

  src = fetchFromGitHub {
    owner = "kusti8";
    repo = "hue-plus";
-    rev = "7ce7c4603c6d0ab1da29b0d4080aa05f57bd1760";
-    sha256 = "sha256-dDIJXhB3rmKnawOYJHE7WK38b0M5722zA+yLgpEjDyI=";
+    tag = "v.${finalAttrs.version}"; # Only the latest tag uses a . between v and 1.
+    hash = "sha256-dDIJXhB3rmKnawOYJHE7WK38b0M5722zA+yLgpEjDyI=";
  };

  buildInputs = [ libsForQt5.qtbase ];
@ -29,7 +31,6 @@ python3Packages.buildPythonApplication {
    setuptools
  ];

-  doCheck = false;
  dontWrapQtApps = true;

  makeWrapperArgs = [
@ -44,5 +45,6 @@ python3Packages.buildPythonApplication {
    '';
    license = lib.licenses.gpl3Only;
    maintainers = with lib.maintainers; [ garaiza-93 ];
+    mainProgram = "hue";
  };
-}
+})
--- a/pkgs/by-name/le/lens/darwin.nix
+++ b/pkgs/by-name/le/lens/darwin.nix
@ -4,6 +4,7 @@
  version,
  src,
  meta,
+  updateScript,
  undmg,
 }:

@ -29,4 +30,6 @@ stdenv.mkDerivation {
  '';

  dontFixup = true;
+
+  passthru = { inherit updateScript; };
 }
--- a/pkgs/by-name/le/lens/linux.nix
+++ b/pkgs/by-name/le/lens/linux.nix
@ -3,6 +3,7 @@
  version,
  src,
  meta,
+  updateScript,
  appimageTools,
  makeWrapper,
 }:
@ -21,6 +22,8 @@ appimageTools.wrapType2 {
    meta
    ;

+  passthru = { inherit updateScript; };
+
  nativeBuildInputs = [ makeWrapper ];

  extraInstallCommands = ''
--- a/pkgs/by-name/le/lens/package.nix
+++ b/pkgs/by-name/le/lens/package.nix
@ -8,20 +8,20 @@
 let

  pname = "lens-desktop";
-  version = "2024.11.261604";
+  version = "2026.6.260931";

  sources = {
    x86_64-linux = {
      url = "https://api.k8slens.dev/binaries/Lens-${version}-latest.x86_64.AppImage";
-      hash = "sha256-AbuEU5gOckVU+eDIFnomc7ryLq68ihuk3c0XosoJp74=";
+      hash = "sha512-P9PrtbGKaHNlzZsm10ovkYCBBfQpVWBgcVsYLETMwINP2bzrIIK5HVbkbcTEUsxK90L7MQmFwpAssojW0b9G5Q==";
    };
    x86_64-darwin = {
      url = "https://api.k8slens.dev/binaries/Lens-${version}-latest.dmg";
-      hash = "sha256-MQQRGTCe+LEHXJi6zjnpENbtlWNP+XVH9rWXRMk+26w=";
+      hash = "sha512-I/i9s7O3jT+eNqqUu6B+rB+YbegKhAsZwHlc3mp2wNWW9YDilQbzKrhF9Fq2dSz2WKVZUscBtSGtXCuiPcFXzw==";
    };
    aarch64-darwin = {
      url = "https://api.k8slens.dev/binaries/Lens-${version}-latest-arm64.dmg";
-      hash = "sha256-aakJCLnQBAnUdrrniTcahS+q3/kP09mlaPTV8FW5afI=";
+      hash = "sha512-eCE3w7NlYrHiexCirH2wFN0nOO3qAt5acbldXbDMVIrG94tbgM8Y5ZO8/YIUN45XbotYtKW8/Nw+WsrTp6DPBg==";
    };
  };

@ -35,12 +35,15 @@ let
    license = lib.licenses.lens;
    maintainers = with lib.maintainers; [
      dbirks
+      qweered
      RossComputerGuy
      starkca90
    ];
    platforms = builtins.attrNames sources;
  };

+  updateScript = ./update.sh;
+
 in
 if stdenv.hostPlatform.isDarwin then
  callPackage ./darwin.nix {
@ -49,6 +52,7 @@ if stdenv.hostPlatform.isDarwin then
      version
      src
      meta
+      updateScript
      ;
  }
 else
@ -58,5 +62,6 @@ else
      version
      src
      meta
+      updateScript
      ;
  }
--- a/pkgs/by-name/le/lens/update.sh
+++ b/pkgs/by-name/le/lens/update.sh
@ -0,0 +1,37 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p common-updater-scripts curl yq-go jq
+
+set -euo pipefail
+
+base="https://api.k8slens.dev/binaries"
+
+# Lens is built with electron-builder, which publishes an auto-update manifest
+# next to each binary. These manifests carry both the latest version and the
+# base64 sha512 digest of every artifact, so we can bump all platforms without
+# downloading the (~250 MiB) images ourselves.
+linux_manifest=$(curl -sfL "$base/latest-linux.yml" | yq -o=json)
+mac_manifest=$(curl -sfL "$base/latest-mac.yml" | yq -o=json)
+
+# The manifest reports e.g. "2026.6.260931-latest"; the "-latest" suffix only
+# lives in the download URL, so drop it from the Nix version.
+version=$(jq -r '.version' <<<"$linux_manifest")
+version=${version%-latest}
+
+# electron-builder records base64-encoded sha512 digests, which are already
+# valid Nix SRI hashes once prefixed with "sha512-". Match artifacts by filename
+# suffix (endswith) rather than a regex to keep jq's string escaping out of play.
+manifest_hash() {
+  echo "sha512-$(jq -r --arg suffix "$1" '.files[] | select(.url | endswith($suffix)) | .sha512' <<<"$2" | head -n1)"
+}
+
+appimage_hash=$(manifest_hash '.x86_64.AppImage' "$linux_manifest")
+dmg_hash=$(manifest_hash '-latest.dmg' "$mac_manifest")
+arm64_dmg_hash=$(manifest_hash '-arm64.dmg' "$mac_manifest")
+
+# The three platforms share one version but have distinct hashes. --system picks
+# which source (and therefore which hash) update-source-version rewrites; passing
+# the hash explicitly avoids a download. The version is written on the first call,
+# so the darwin calls need --ignore-same-version to not early-exit as "unchanged".
+update-source-version lens "$version" "$appimage_hash" --system=x86_64-linux
+update-source-version lens "$version" "$dmg_hash" --system=x86_64-darwin --ignore-same-version
+update-source-version lens "$version" "$arm64_dmg_hash" --system=aarch64-darwin --ignore-same-version
--- a/pkgs/by-name/lf/lfk/package.nix
+++ b/pkgs/by-name/lf/lfk/package.nix
@ -6,17 +6,17 @@

 buildGoModule (finalAttrs: {
  pname = "lfk";
-  version = "0.10.2";
+  version = "0.14.19";
  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "janosmiko";
    repo = "lfk";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-6H67d9zVdfsUhnsC4Hg6z3nm0w2//Q8oj1FZBR+a8SY=";
+    hash = "sha256-57bAYTU6/Fv7jbKK+RAbITECl4hYQzS2kkn7bytnW+Y=";
  };

-  vendorHash = "sha256-GfJr3jtG+GhV7AHgM0EjPe+bFqdIRkHpjaylu753cGI=";
+  vendorHash = "sha256-WYx/eMArAsiyfEvrBZmTfK2ABxX2X1VQEtDCxC+UyP8=";

  ldflags = [ "-s" ];

--- a/pkgs/by-name/ma/mastodon/gemset.nix
+++ b/pkgs/by-name/ma/mastodon/gemset.nix
@ -804,10 +804,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0pfl5c0pyqaparxaqxi6s4gfl21bdldwiawrc0aknyvflli60lfw";
+      sha256 = "15djj19ynz3sbw54fsf8n7y3sha8a333f2mgvjfwhr46jhcqg1ll";
      type = "gem";
    };
-    version = "1.0.6";
+    version = "1.0.7";
  };
  css_parser = {
    dependencies = [
@ -2274,10 +2274,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0v68nyl07xira30iyhn3118a4g59ar5748laq0cx2pwnsdy7ivrz";
+      sha256 = "18g6ps30z6m365bly7sfialavnsf6m6qamdxsr84w96k51j4mnlb";
      type = "gem";
    };
-    version = "1.8.1";
+    version = "1.8.3";
  };
  multi_json = {
    groups = [ "default" ];
--- a/pkgs/by-name/ma/mastodon/source.nix
+++ b/pkgs/by-name/ma/mastodon/source.nix
@ -5,14 +5,14 @@
  patches ? [ ],
 }:
 let
-  version = "4.6.2";
+  version = "4.6.3";
 in
 applyPatches {
  src = fetchFromGitHub {
    owner = "mastodon";
    repo = "mastodon";
    rev = "v${version}";
-    hash = "sha256-RA9yGmWyzwiD/skPxOB27hqRxMqKGFmMMDOvHR5FjqI=";
+    hash = "sha256-NMeI8Ev0CSIf0dfbjqVAmFuTU9MFC8Y3qO9gI3p8Y+4=";
    passthru = {
      inherit version;
      yarnHash = "sha256-G1keSWDDpp0vBAOqQI8y8n7bmAeo9Hrdbo7R+cVZQwE=";
--- a/pkgs/by-name/ma/mathematica/versions.nix
+++ b/pkgs/by-name/ma/mathematica/versions.nix
@ -4,6 +4,20 @@
    nix --extra-experimental-features nix-command hash file <installer-file>
 */
 [
+  {
+    version = "15.0.0";
+    lang = "en";
+    language = "English";
+    hash = "sha256-3xEWSCe4g8utJre7h6pr3uADh0VrDN+gh4Ye7eREyLw=";
+    installer = "Wolfram_15_LIN.sh";
+  }
+  {
+    version = "15.0.0";
+    lang = "en";
+    language = "English";
+    hash = "sha256-5GulP3FM7p/RBKJskVzywPGJMS90GNATpczcceKmUKo=";
+    installer = "Wolfram_15.sh";
+  }
  {
    version = "14.3.0";
    lang = "en";
--- a/pkgs/by-name/ma/mathjax/package.nix
+++ b/pkgs/by-name/ma/mathjax/package.nix
@ -5,13 +5,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "mathjax";
-  version = "4.1.2";
+  version = "4.1.3";

  src = fetchFromGitHub {
    owner = "mathjax";
    repo = "mathjax";
    tag = finalAttrs.version;
-    hash = "sha256-x4aRA1EDBpx/PmWF8YmWs1Le7yX/hJo0Egrhc/nrWsE=";
+    hash = "sha256-Vl4gh2GRnlLkTV1o41WV6WBccjr+bnbq6JPcHGwfKXQ=";
  };

  installPhase = ''
--- a/pkgs/by-name/mc/mcp-gateway/package.nix
+++ b/pkgs/by-name/mc/mcp-gateway/package.nix
@ -7,16 +7,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "mcp-gateway";
-  version = "2.19.0";
+  version = "3.0.1";

  src = fetchFromGitHub {
    owner = "MikkoParkkola";
    repo = "mcp-gateway";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Rt2FoIBSFEA9Zgy27ZlVeVOgI3NF09FuPC+XW/WV8Ns=";
+    hash = "sha256-BtKPUKcZFu1ybnDmp9yme5/2/gzv1ASQ5E9G/QZClOc=";
  };

-  cargoHash = "sha256-tMIsJkHxSNxwLkgoqVoSK1EFRgnhoCej7nAwcZcmLlQ=";
+  cargoHash = "sha256-hzx9qyqMk3kK8iCRYPtwGqXTQBaQUtt+l6KEn3KF1WE=";

  nativeInstallCheckInputs = [
    versionCheckHook
--- a/pkgs/by-name/md/mdfried/package.nix
+++ b/pkgs/by-name/md/mdfried/package.nix
@ -59,8 +59,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
    libiconv
  ];

-  CFLAGS_aarch64_apple_darwin = lib.optionalString stdenv.hostPlatform.isDarwin "-UTARGET_OS_MAC";
-  CXXFLAGS_aarch64_apple_darwin = lib.optionalString stdenv.hostPlatform.isDarwin "-UTARGET_OS_MAC";
+  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
+    CFLAGS_aarch64_apple_darwin = "-UTARGET_OS_MAC";
+    CXXFLAGS_aarch64_apple_darwin = "-UTARGET_OS_MAC";
+  };

  doCheck = true;

--- a/pkgs/by-name/me/meilisearch/package.nix
+++ b/pkgs/by-name/me/meilisearch/package.nix
@ -8,18 +8,18 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "meilisearch";
-  version = "1.48.2";
+  version = "1.48.3";

  src = fetchFromGitHub {
    owner = "meilisearch";
    repo = "meilisearch";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-qRs6U10fnCnGtzd6+GAExLnQ9v3pLT5/yxaAebKVJeY=";
+    hash = "sha256-Za5yhCPahJAZQhavhCwIqX6xhWa7l4sYRzhs+ozN94U=";
  };

  cargoBuildFlags = [ "--package=meilisearch" ];

-  cargoHash = "sha256-LJ/NtJ6PYR6rjT1mtGSPoCKmdeIiFUwF9SIHysfEn9w=";
+  cargoHash = "sha256-405b/puYbcIByE8nacJu8tjw5oh846c7UaCpWH4MpME=";

  # Default features include mini dashboard which downloads something from the internet.
  buildNoDefaultFeatures = true;
--- a/pkgs/by-name/mo/modrinth-app-unwrapped/package.nix
+++ b/pkgs/by-name/mo/modrinth-app-unwrapped/package.nix
@ -31,13 +31,13 @@ in

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "modrinth-app-unwrapped";
-  version = "0.14.8";
+  version = "0.15.1";

  src = fetchFromGitHub {
    owner = "modrinth";
    repo = "code";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-s34vmm0Apy20FrfSjESXtj+uggvr4ODpOrxfapAKtlc=";
+    hash = "sha256-kF808vT/CO1Aklv+P23GWdxSBqDshFphL8hx0PYSgQk=";
  };

  patches = [
@ -67,7 +67,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
      --replace-fail '1.0.0-local' '${finalAttrs.version}'
  '';

-  cargoHash = "sha256-JU8QhdDikqe9a/MXVe2jSsXATvwdgpyjWr7pV/75C9E=";
+  cargoHash = "sha256-GQmhyTGN+MItwQEVyZ5Ai0cowvOxp++THuSrXsrRG1A=";

  mitmCache = gradle.fetchDeps {
    inherit (finalAttrs) pname;
--- a/pkgs/by-name/mo/monsoon/package.nix
+++ b/pkgs/by-name/mo/monsoon/package.nix
@ -3,12 +3,16 @@
  stdenv,
  buildGoModule,
  fetchFromGitHub,
+  versionCheckHook,
+  nix-update-script,
 }:

 buildGoModule (finalAttrs: {
  pname = "monsoon";
  version = "0.10.1";

+  __structuredAttrs = true;
+
  src = fetchFromGitHub {
    owner = "RedTeamPentesting";
    repo = "monsoon";
@ -18,19 +22,32 @@ buildGoModule (finalAttrs: {

  vendorHash = "sha256-hGEUO1sl8IKXo4rkS81Wlf7187lu2PrSujNlGNTLwmE=";

+  ldflags = [
+    "-s"
+    "-X=main.version=v${finalAttrs.version}"
+  ];
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  doInstallCheck = true;
+
+  versionCheckProgramArg = [ "version" ];
+
  # Tests fails on darwin
  doCheck = !stdenv.hostPlatform.isDarwin;

+  passthru.updateScript = nix-update-script { };
+
  meta = {
    description = "Fast HTTP enumerator";
-    mainProgram = "monsoon";
    longDescription = ''
      A fast HTTP enumerator that allows you to execute a large number of HTTP
      requests, filter the responses and display them in real-time.
    '';
    homepage = "https://github.com/RedTeamPentesting/monsoon";
-    changelog = "https://github.com/RedTeamPentesting/monsoon/releases/tag/v${finalAttrs.version}";
+    changelog = "https://github.com/RedTeamPentesting/monsoon/releases/tag/v${finalAttrs.src.tag}";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "monsoon";
  };
 })
--- a/pkgs/by-name/no/nordvpn/cli.nix
+++ b/pkgs/by-name/no/nordvpn/cli.nix
@ -0,0 +1,151 @@
+{
+  desktopItemArgs,
+  meta,
+  src,
+  version,
+
+  buildGoModule,
+  copyDesktopItems,
+  e2fsprogs,
+  fetchFromGitHub,
+  iproute2,
+  lib,
+  libxslt,
+  makeDesktopItem,
+  makeWrapper,
+  nftables,
+  openvpn,
+  procps,
+  systemdMinimal,
+  wireguard-tools,
+}:
+let
+  patchedOpenvpn = openvpn.overrideAttrs (old: {
+    # Apply XOR obfuscation patches to disguise OpenVPN traffic,
+    # enabling connectivity on networks that block VPN protocols via DPI.
+    patches =
+      let
+        tunnelblickSrc = fetchFromGitHub {
+          owner = "Tunnelblick";
+          repo = "Tunnelblick";
+          # https://github.com/NordSecurity/nordvpn-linux/blob/4.6.0/ci/openvpn/env.sh#L11
+          tag = "v6.0beta09";
+          hash = "sha256-uLYrBgwX3HkEV06snlIYLsgfhD5lNDVR21D56ygoStY=";
+        };
+
+        pathDir = "third_party/sources/openvpn/openvpn-2.6.12/patches";
+      in
+      (old.patches or [ ])
+      ++ (map (fname: "${tunnelblickSrc}/${pathDir}/${fname}") [
+        "02-tunnelblick-openvpn_xorpatch-a.diff"
+        "03-tunnelblick-openvpn_xorpatch-b.diff"
+        "04-tunnelblick-openvpn_xorpatch-c.diff"
+        "05-tunnelblick-openvpn_xorpatch-d.diff"
+        "06-tunnelblick-openvpn_xorpatch-e.diff"
+      ]);
+  });
+
+in
+buildGoModule (finalAttrs: {
+  inherit src version;
+
+  pname = "nordvpn-cli";
+
+  nativeBuildInputs = [
+    copyDesktopItems
+    makeWrapper
+  ];
+
+  vendorHash = "sha256-I81sn+tHTny9bX5eNGQLPQtoabbaNZINMjYotCXt88A=";
+
+  preBuild = ''
+    # redirect AppDataPathStatic (/usr/lib/nordvpn) to $out/bin so that
+    # NorduserdBinaryPath resolves to $out/bin/norduserd.
+    substituteInPlace internal/constants.go \
+        --replace-fail "/usr/lib/nordvpn" "$out/bin"
+
+    # hardcode the openvpn path to the patched one
+    old_ovpn_path='filepath.Join(internal.AppDataPathStatic, "openvpn")'
+    new_ovpn_path='"${patchedOpenvpn}/bin/openvpn"'
+    substituteInPlace daemon/vpn/openvpn/config.go \
+        --replace-fail "$old_ovpn_path" "$new_ovpn_path"
+  '';
+
+  ldflags = [
+    "-X main.Environment=prod"
+    "-X main.Version=${finalAttrs.version}"
+  ];
+
+  subPackages = [
+    "cmd/cli"
+    "cmd/daemon"
+    "cmd/norduser"
+  ];
+
+  checkPhase = ''
+    runHook preCheck
+
+    go test ./cli
+    # skip tests that require network access
+    go test ./daemon -skip \
+        'TestTransports|TestH1Transport_RoundTrip|Test.*FileList_RealURL'
+    go test ./norduser
+
+    runHook postCheck
+  '';
+
+  postInstall = ''
+    # rename to standard names
+    BIN_DIR=$out/bin
+    mv $BIN_DIR/cli $BIN_DIR/nordvpn
+    mv $BIN_DIR/daemon $BIN_DIR/nordvpnd
+    mv $BIN_DIR/norduser $BIN_DIR/norduserd
+
+    # nordvpn needs icons for the system tray and notifications
+    ICONS_PATH=$out/share/icons/hicolor/scalable/apps
+    install -d $ICONS_PATH
+    install --mode=0444 assets/icon.svg $ICONS_PATH/nordvpn.svg
+    for file in assets/tray-*.svg; do
+        install --mode=0444 "$file" "$ICONS_PATH/nordvpn-$(basename $file)"
+    done
+  '';
+
+  postFixup = ''
+    wrapProgram $out/bin/nordvpnd --prefix PATH : ${
+      lib.makeBinPath [
+        e2fsprogs
+        iproute2
+        libxslt # xsltproc: used to populate OpenVPN configuration files from templates
+        nftables
+        patchedOpenvpn
+        procps
+        systemdMinimal
+        wireguard-tools
+      ]
+    }
+  '';
+
+  desktopItems = [
+    (makeDesktopItem (
+      desktopItemArgs
+      // {
+        comment = "Handles NordVPN OAuth browser login callbacks.";
+        desktopName = "NordVPN CLI";
+        exec = "nordvpn click %u";
+        mimeTypes = [ "x-scheme-handler/nordvpn" ];
+        name = "nordvpn";
+        noDisplay = true;
+        terminal = true;
+      }
+    ))
+  ];
+
+  meta = meta // {
+    description = "NordVPN command-line client and daemon";
+    longDescription = ''
+      Contains the nordvpn client and nordvpnd daemon.
+      Even if you intend to use the GUI only, you'd need this package.
+    '';
+    mainProgram = "nordvpn";
+  };
+})
--- a/pkgs/by-name/no/nordvpn/gui.nix
+++ b/pkgs/by-name/no/nordvpn/gui.nix
@ -0,0 +1,48 @@
+{
+  desktopItemArgs,
+  meta,
+  src,
+  version,
+
+  copyDesktopItems,
+  flutter,
+  lib,
+  makeDesktopItem,
+  libx11,
+}:
+flutter.buildFlutterApplication {
+  pname = "nordvpn-gui";
+  inherit src version;
+
+  sourceRoot = "${src.name}/gui";
+
+  buildInputs = [
+    libx11
+  ];
+
+  nativeBuildInputs = [
+    copyDesktopItems
+  ];
+
+  pubspecLock = lib.importJSON ./pubspec.lock.json;
+
+  # finds X11 using pkg-config
+  patches = [ ./linux-cmake.patch ];
+
+  desktopItems = [
+    (makeDesktopItem (
+      desktopItemArgs
+      // {
+        comment = "NordVPN's GUI to manage vpn connection, settings, etc.";
+        desktopName = "NordVPN GUI";
+        exec = "nordvpn-gui";
+        name = "nordvpn-gui";
+      }
+    ))
+  ];
+
+  meta = meta // {
+    description = "NordVPN graphical interface";
+    mainProgram = "nordvpn-gui";
+  };
+}
--- a/pkgs/by-name/no/nordvpn/linux-cmake.patch
+++ b/pkgs/by-name/no/nordvpn/linux-cmake.patch
@ -0,0 +1,23 @@
+--- a/linux/CMakeLists.txt
+++ b/linux/CMakeLists.txt
+@@ -51,10 +51,10 @@
+ # System-level dependencies.
+ find_package(PkgConfig REQUIRED)
+ pkg_check_modules(GTK REQUIRED IMPORTED_TARGET gtk+-3.0)
+pkg_check_modules(X11 REQUIRED IMPORTED_TARGET x11)
+ 
+ add_definitions(-DAPPLICATION_ID="${APPLICATION_ID}")
+ # Fix for: https://github.com/NordSecurity/nordvpn-linux/issues/1136
+-find_package(X11 REQUIRED)
+ 
+ # Define the application target. To change its name, change BINARY_NAME above,
+ # not the value here, or `flutter run` will no longer work.
+@@ -73,7 +73,7 @@
+ # Add dependency libraries. Add any application-specific dependencies here.
+ target_link_libraries(${BINARY_NAME} PRIVATE flutter)
+ target_link_libraries(${BINARY_NAME} PRIVATE PkgConfig::GTK)
+-target_link_libraries(${BINARY_NAME} PRIVATE X11::X11)
+target_link_libraries(${BINARY_NAME} PRIVATE PkgConfig::X11)
+ 
+ # Run the Flutter tool portions of the build. This must not be removed.
+ add_dependencies(${BINARY_NAME} flutter_assemble)
--- a/pkgs/by-name/no/nordvpn/package.nix
+++ b/pkgs/by-name/no/nordvpn/package.nix
@ -0,0 +1,66 @@
+{
+  callPackage,
+  fetchFromGitHub,
+  lib,
+  nix-update-script,
+  symlinkJoin,
+}:
+let
+  version = "5.2.0";
+
+  common = {
+    inherit version;
+
+    src = fetchFromGitHub {
+      owner = "NordSecurity";
+      repo = "nordvpn-linux";
+      tag = version;
+      hash = "sha256-F7iw856HVLbOz97j9sMkVwyZl0ZDwID1Tf0YwtdvZsU=";
+    };
+
+    # rec so that changelog can reference homepage
+    meta = rec {
+      homepage = "https://github.com/NordSecurity/nordvpn-linux";
+      changelog = "${homepage}/releases/tag/${version}";
+      license = lib.licenses.gpl3Only;
+      maintainers = with lib.maintainers; [ different-error ];
+      platforms = lib.platforms.linux;
+    };
+
+    desktopItemArgs = {
+      categories = [ "Network" ];
+      genericName = "VPN Client";
+      icon = "nordvpn";
+      type = "Application";
+    };
+  };
+in
+symlinkJoin {
+  pname = "nordvpn";
+  inherit version;
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  paths = [
+    (callPackage ./cli.nix common)
+    (callPackage ./gui.nix common)
+  ];
+
+  passthru = {
+    cli = callPackage ./cli.nix common;
+    gui = callPackage ./gui.nix common;
+    updateScript = nix-update-script { };
+  };
+
+  meta = common.meta // {
+    description = "NordVPN client and GUI for Linux";
+    longDescription = ''
+      NordVPN CLI and GUI applications for Linux.
+      This package currently does not support meshnet.
+      Additionally, if `networking.firewall.enable = true;`,
+      then also set `networking.firewall.checkReversePath = "loose";`.
+      The closed-source nordwhisper protocol is also not supported.
+    '';
+  };
+}
--- a/pkgs/by-name/no/nordvpn/pubspec.lock.json
+++ b/pkgs/by-name/no/nordvpn/pubspec.lock.json
--- a/pkgs/by-name/no/notesnook/package.nix
+++ b/pkgs/by-name/no/notesnook/package.nix
@ -82,7 +82,7 @@ let
      wrapProgram $out/bin/notesnook \
        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}"
      install -Dm444 ${appimageContents}/notesnook.desktop -t $out/share/applications
-      install -Dm444 ${appimageContents}/notesnook.png -t $out/share/pixmaps
+      install -Dm444 ${appimageContents}/notesnook.png -t $out/share/icons
      substituteInPlace $out/share/applications/notesnook.desktop \
        --replace 'Exec=AppRun --no-sandbox %U' 'Exec=${pname}'
    '';
--- a/pkgs/by-name/ob/obliteratus/package.nix
+++ b/pkgs/by-name/ob/obliteratus/package.nix
@ -1,26 +1,27 @@
 {
  lib,
-  python3,
+  stdenv,
+  python3Packages,
  fetchFromGitHub,
+  nix-update-script,
 }:

-python3.pkgs.buildPythonApplication (finalAttrs: {
+python3Packages.buildPythonApplication (finalAttrs: {
  pname = "obliteratus";
-  version = "0.1.2-unstable-2026-03-05";
+  version = "0-unstable-2026-06-17";
  pyproject = true;
+  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "elder-plinius";
    repo = "OBLITERATUS";
-    rev = "984ce140592a9385347934f9ca647413ba9fac76";
-    hash = "sha256-U5DcRC1/IEQRlBGLIfsCX48ZCxPkpzEhg8qIw3ytJps=";
+    rev = "a5a1ffa5849b442cf188b3c03fd4de71ddf5bdcc";
+    hash = "sha256-IxIpUlVlZRzXan53mCCsH8AYg/ajNofSm56iUO9XPrg=";
  };

-  __structuredAttrs = true;
+  build-system = with python3Packages; [ setuptools ];

-  build-system = with python3.pkgs; [ setuptools ];
-
-  dependencies = with python3.pkgs; [
+  dependencies = with python3Packages; [
    accelerate
    bitsandbytes
    datasets
@ -37,18 +38,44 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
    transformers
  ];

-  optional-dependencies = with python3.pkgs; {
+  optional-dependencies = with python3Packages; {
    spaces = [ gradio ];
  };

-  nativeCheckInputs = with python3.pkgs; [
+  pythonImportsCheck = [ "obliteratus" ];
+
+  nativeCheckInputs = with python3Packages; [
    pytest-cov-stub
    pytestCheckHook
  ];
-  # This increases the build time significantly
-  # ++ lib.flatten (builtins.attrValues finalAttrs.passthru.optional-dependencies);

-  pythonImportsCheck = [ "obliteratus" ];
+  disabledTestPaths = [
+    # These tests reference `obliteratus.models.loader._select_model_class`, which upstream
+    # removed/renamed without updating the tests or the benchmark script.
+    "tests/test_gemma4_hard_tier_bench.py"
+    "tests/test_gemma4_support.py"
+  ];
+
+  disabledTests = [
+    # Upstream tests that hardcode expectations the implementation has since outgrown
+    # (e.g. 512 prompts vs the current 842, a stale method set, changed pipeline defaults).
+    "test_default_values"
+    "test_informed_method_in_abliterate_methods"
+    "test_informed_method_standalone"
+    "test_inherits_base_pipeline"
+    "test_linear_cone_fewer_directions"
+    "test_methods_exist"
+    "test_prompt_count_512"
+  ]
+  ++ lib.optionals (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64) [
+    # aarch64-linux fails cpuinfo test, because /sys/devices/system/cpu/ does not exist in the sandbox:
+    # RuntimeError: Failed to initialize cpuinfo!
+    "test_output_dtype_preserved"
+  ];
+
+  passthru.updateScript = nix-update-script {
+    extraArgs = [ "--version=branch" ];
+  };

  meta = {
    description = "Ablation Suite for HuggingFace transformers";
--- a/pkgs/by-name/ob/obsidian/package.nix
+++ b/pkgs/by-name/ob/obsidian/package.nix
@ -3,7 +3,7 @@
  fetchurl,
  lib,
  makeWrapper,
-  electron_40, # see https://github.com/NixOS/nixpkgs/pull/521495
+  electron,
  makeDesktopItem,
  imagemagick,
  asar,
@ -102,7 +102,7 @@ let
        --replace-fail "supportFetchAPI: true," "supportFetchAPI: true, corsEnabled: true,"
      asar pack app-src resources/app.asar

-      makeWrapper ${electron_40}/bin/electron $out/bin/obsidian \
+      makeWrapper ${electron}/bin/electron $out/bin/obsidian \
        --add-flags $out/share/obsidian/app.asar \
        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform=wayland --enable-wayland-ime=true --wayland-text-input-version=3}}" \
        --add-flags ${lib.escapeShellArg commandLineArgs}
--- a/pkgs/by-name/ok/okteto/package.nix
+++ b/pkgs/by-name/ok/okteto/package.nix
@ -10,16 +10,16 @@

 buildGoModule (finalAttrs: {
  pname = "okteto";
-  version = "3.20.0";
+  version = "3.21.0";

  src = fetchFromGitHub {
    owner = "okteto";
    repo = "okteto";
    tag = finalAttrs.version;
-    hash = "sha256-s733L3Jhaz780fEa+mQnnokUXXwvUPDCZq3fWEUBaT0=";
+    hash = "sha256-EPtAOczXzBbt+lZFC+K0svh4hh/H3myduIoTs7nrjRw=";
  };

-  vendorHash = "sha256-/qZEO/oXEmr4VsrKZMiaJ/LOyFG7rQ8j3aUdqSspfCg=";
+  vendorHash = "sha256-+4QYxAe45jlbC2b06ZkJuSYjGX1v1CCJM1XNHx8rIFM=";

  postPatch = ''
    # Disable some tests that need file system & network access.
--- a/pkgs/by-name/op/opencode-desktop/package.nix
+++ b/pkgs/by-name/op/opencode-desktop/package.nix
@ -124,11 +124,11 @@ stdenvNoCC.mkDerivation (finalAttrs: {
  '';

  desktopItems = lib.optional stdenvNoCC.hostPlatform.isLinux (makeDesktopItem {
-    name = "opencode-desktop";
+    name = "ai.opencode.desktop";
    desktopName = "OpenCode";
    exec = "opencode-desktop %U";
    icon = "opencode-desktop";
-    startupWMClass = "OpenCode";
+    startupWMClass = "ai.opencode.desktop";
    categories = [ "Development" ];
    mimeTypes = [ "x-scheme-handler/opencode" ];
  });
--- a/pkgs/by-name/op/openobserve/package.nix
+++ b/pkgs/by-name/op/openobserve/package.nix
@ -12,6 +12,7 @@
  xz,
  zlib,
  zstd,
+  versionCheckHook,
  buildNpmPackage,
  gitUpdater,
 }:
@ -25,7 +26,7 @@ rustPlatform.buildRustPackage (

      sourceRoot = "${finalAttrs.src.name}/web";

-      npmDepsHash = "sha256-UNdFqUJI/pdHJjjA5Aebnvq1T7oITJ1R96rEQOBxTug=";
+      npmDepsHash = "sha256-te8uABzndzLRb6GQVSn33aaleQau2U/xo8LnMynTtx0=";

      preBuild = ''
        # Patch vite config to not open the browser to visualize plugin composition
@ -49,13 +50,13 @@ rustPlatform.buildRustPackage (
  in
  {
    pname = "openobserve";
-    version = "0.50.3";
+    version = "0.91.1";

    src = fetchFromGitHub {
      owner = "openobserve";
      repo = "openobserve";
      tag = "v${finalAttrs.version}";
-      hash = "sha256-eL1Qvl6M8idBHXSNHHQsTsu6g/CbTOt8NUTTaNZuB8M=";
+      hash = "sha256-4Oe1YRblkJg9aNG/aLvP89zrHIysA67GP7GN7oCTdd8=";
    };

    patches = [
@ -67,7 +68,7 @@ rustPlatform.buildRustPackage (
      cp -r ${web}/share/openobserve-ui web/dist
    '';

-    cargoHash = "sha256-d67ZeAth0Q8h8xXJZl+2Z2/+M54Ef4xFlsPT9CnrwK4=";
+    cargoHash = "sha256-PIhHHEP9kJmliOGtom1gDf7wt5C4RicWKgQe0hkW+4M=";

    nativeBuildInputs = [
      pkg-config
@ -129,11 +130,17 @@ rustPlatform.buildRustPackage (

    # requires network access or filesystem mutations
    checkFlags = [
+      "--skip=cli::basic::http::tests::test_node_operations_network_failure"
+      "--skip=cli::basic::http::tests::test_query_valid_time_range"
+      "--skip=common::meta::telemetry::test_telemetry::test_telemetry_send_track_event_without_base_info_or_zo_data"
      "--skip=handler::http::router::tests::test_get_proxy_routes"
      "--skip=tests::e2e_test"
      "--skip=tests::test_setup_logs"
      "--skip=handler::http::router::middlewares::compress::Compress"
+      "--skip=service::alerts::destinations::tests::test_alert_destination_requires_template"
+      "--skip=service::enrichment_table::url_processor"
      "--skip=service::github"
+      "--skip=service::sourcemaps"
      # Tests are not threadsafe. Most likely can only run one test at a time,
      # due to altering shared database state.
      # This option already in upstream code: https://github.com/openobserve/openobserve/pull/7084
@ -141,6 +148,9 @@ rustPlatform.buildRustPackage (
      "--test-threads=1"
    ];

+    doInstallCheck = true;
+    nativeInstallCheckInputs = [ versionCheckHook ];
+
    passthru.updateScript = gitUpdater {
      rev-prefix = "v";
      ignoredVersions = "rc";
@ -153,6 +163,7 @@ rustPlatform.buildRustPackage (
      license = lib.licenses.asl20;
      maintainers = with lib.maintainers; [ happysalada ];
      mainProgram = "openobserve";
+      platforms = lib.platforms.linux ++ lib.platforms.darwin;
    };
  }
 )
--- a/pkgs/by-name/or/orca-slicer/package.nix
+++ b/pkgs/by-name/or/orca-slicer/package.nix
@ -47,7 +47,7 @@ let
    (wxwidgets_3_3.override {
      withPrivateFonts = true;
      withWebKit = true;
-      withEGL = false;
+      withEGL = true;
    }).overrideAttrs
      (old: {
        buildInputs = old.buildInputs ++ [ libsecret ];
--- a/pkgs/by-name/pe/peertube/package.nix
+++ b/pkgs/by-name/pe/peertube/package.nix
@ -21,13 +21,16 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "peertube";
-  version = "8.1.8";
+  version = "8.2.2";
+
+  __structuredAttrs = true;
+  strictDeps = true;

  src = fetchFromGitHub {
    owner = "Chocobozzz";
    repo = "PeerTube";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Ei7MgEyHDJyLXnjI8mT7S7pLno+pTmFWZHc6oEZaTcM=";
+    hash = "sha256-huyuaCWJ3w1KHCcQFjH2ZcofPjqwjLpLt+dg6auD/dQ=";
  };

  outputs = [
@ -40,7 +43,7 @@ stdenv.mkDerivation (finalAttrs: {
    inherit (finalAttrs) pname version src;
    pnpm = pnpm_10;
    fetcherVersion = 3;
-    hash = "sha256-fQ0FyBPZ3v3lCSoWYz1ccbOSrfgnzwQvOyE7Dp3ZGRY=";
+    hash = "sha256-qrx8JtIAmn0JEsFwptrHlOL0IaYPJPLzjuDWNs7XFfc=";
  };

  nativeBuildInputs = [
@ -49,6 +52,7 @@ stdenv.mkDerivation (finalAttrs: {
    jq
    pnpmConfigHook
    pnpm_10
+    nodejs_24
    which
  ];

@ -69,8 +73,6 @@ stdenv.mkDerivation (finalAttrs: {
  buildPhase = ''
    runHook preBuild

-    export HOME=$PWD
-
    # Build PeerTube server
    npm run build:server

@ -79,22 +81,22 @@ stdenv.mkDerivation (finalAttrs: {

    # Build PeerTube cli
    npm run build:peertube-cli
-    patchShebangs ~/apps/peertube-cli/dist/peertube.mjs
+    patchShebangs ./apps/peertube-cli/dist/peertube.mjs

    # Build PeerTube runner
    npm run build:peertube-runner
-    patchShebangs ~/apps/peertube-runner/dist/peertube-runner.mjs
+    patchShebangs ./apps/peertube-runner/dist/peertube-runner.mjs

    # Clean up declaration files
    find \
-      ~/dist/ \
-      ~/packages/core-utils/dist/ \
-      ~/packages/ffmpeg/dist/ \
-      ~/packages/models/dist/ \
-      ~/packages/node-utils/dist/ \
-      ~/packages/server-commands/dist/ \
-      ~/packages/transcription/dist/ \
-      ~/packages/typescript-utils/dist/ \
+      ./dist/ \
+      ./packages/core-utils/dist/ \
+      ./packages/ffmpeg/dist/ \
+      ./packages/models/dist/ \
+      ./packages/node-utils/dist/ \
+      ./packages/server-commands/dist/ \
+      ./packages/transcription/dist/ \
+      ./packages/typescript-utils/dist/ \
      \( -name '*.d.ts' -o -name '*.d.ts.map' \) -type f -delete

    runHook postBuild
@ -104,21 +106,21 @@ stdenv.mkDerivation (finalAttrs: {
    runHook preInstall

    mkdir -p $out/dist
-    mv ~/dist $out
-    mv ~/node_modules $out/node_modules
+    mv ./dist $out
+    mv ./node_modules $out/node_modules

    mkdir $out/client
-    mv ~/client/{dist,node_modules,package.json} $out/client
+    mv ./client/{dist,node_modules,package.json} $out/client

    mkdir -p $out/packages/{core-utils,ffmpeg,models,node-utils,server-commands,transcription,typescript-utils}
-    mv ~/packages/core-utils/{dist,package.json} $out/packages/core-utils
-    mv ~/packages/ffmpeg/{dist,package.json} $out/packages/ffmpeg
-    mv ~/packages/models/{dist,package.json} $out/packages/models
-    mv ~/packages/node-utils/{dist,package.json} $out/packages/node-utils
-    mv ~/packages/server-commands/{dist,package.json} $out/packages/server-commands
-    mv ~/packages/transcription/{dist,package.json} $out/packages/transcription
-    mv ~/packages/typescript-utils/{dist,package.json} $out/packages/typescript-utils
-    mv ~/{config,support,CREDITS.md,FAQ.md,LICENSE,README.md,package.json,pnpm-lock.yaml} $out
+    mv ./packages/core-utils/{dist,package.json} $out/packages/core-utils
+    mv ./packages/ffmpeg/{dist,package.json} $out/packages/ffmpeg
+    mv ./packages/models/{dist,package.json} $out/packages/models
+    mv ./packages/node-utils/{dist,package.json} $out/packages/node-utils
+    mv ./packages/server-commands/{dist,package.json} $out/packages/server-commands
+    mv ./packages/transcription/{dist,package.json} $out/packages/transcription
+    mv ./packages/typescript-utils/{dist,package.json} $out/packages/typescript-utils
+    mv ./{config,support,CREDITS.md,FAQ.md,LICENSE,README.md,package.json,pnpm-lock.yaml} $out

    # Remove broken symlinks in node_modules from workspace packages that aren't needed
    # by the built artifact. If any new packages break the check for broken symlinks,
@ -129,11 +131,11 @@ stdenv.mkDerivation (finalAttrs: {
    rm $out/client/node_modules/@peertube/player

    mkdir -p $cli/bin
-    mv ~/apps/peertube-cli/{dist,node_modules,package.json} $cli
+    mv ./apps/peertube-cli/{dist,node_modules,package.json} $cli
    ln -s $cli/dist/peertube.mjs $cli/bin/peertube-cli

    mkdir -p $runner/bin
-    mv ~/apps/peertube-runner/{dist,node_modules,package.json} $runner
+    mv ./apps/peertube-runner/{dist,node_modules,package.json} $runner
    ln -s $runner/dist/peertube-runner.mjs $runner/bin/peertube-runner

    # Create static gzip and brotli files
--- a/pkgs/by-name/pg/pg-schema-diff/package.nix
+++ b/pkgs/by-name/pg/pg-schema-diff/package.nix
@ -6,13 +6,13 @@
 }:
 buildGoModule (finalAttrs: {
  pname = "pg-schema-diff";
-  version = "1.0.5";
+  version = "1.0.7";

  src = fetchFromGitHub {
    owner = "stripe";
    repo = "pg-schema-diff";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-MNuJS9zhTbF6FY1i5fF5VhX8pa+hVaQfdAaj3CKmG50=";
+    hash = "sha256-7N9n0puEyCOq3MKXRLNAgtgrFEC4Sh9d6OK9U/h4xCQ=";
  };

  subPackages = [
--- a/pkgs/by-name/pr/prow/package.nix
+++ b/pkgs/by-name/pr/prow/package.nix
@ -8,15 +8,15 @@

 buildGoModule rec {
  pname = "prow";
-  version = "0-unstable-2026-06-24";
-  rev = "2b5fea27a177c767160452ba75dba978a88d8d63";
+  version = "0-unstable-2026-07-02";
+  rev = "ef12e757d9a9ede25c2a41236ace781e56b23265";

  src = fetchFromGitHub {
    inherit rev;

    owner = "kubernetes-sigs";
    repo = "prow";
-    hash = "sha256-QKxalLV+UwFs+WspXgnqS3QFRTzDkh/NKHZr/+UPUNg=";
+    hash = "sha256-u8TQav5uv8uWpuO6n/gOkEYhZKq16EHRkdUMY3cq6Uc=";
  };

  vendorHash = "sha256-iLJ2atYyHNMvflyuETpPnuhKD293k25vfZQU68Y7oN8=";
--- a/pkgs/by-name/py/pyrefly/package.nix
+++ b/pkgs/by-name/py/pyrefly/package.nix
@ -10,18 +10,18 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "pyrefly";
-  version = "1.1.1";
+  version = "1.2.0-dev.1";

  src = fetchFromGitHub {
    owner = "facebook";
    repo = "pyrefly";
    tag = finalAttrs.version;
-    hash = "sha256-GHH+oG3oUEmGNEmtrmra321UIgRD04Eq1Ct0H7VsjxU=";
+    hash = "sha256-qi2ImB2fuaDJWlJpPSlopZZmdGplEGm6+31yNOP+b8g=";
  };

  buildAndTestSubdir = "pyrefly";

-  cargoHash = "sha256-vOHcmYVKlsxueWjvCCDWwSfJt+2/71b5+NdQyW3jYH4=";
+  cargoHash = "sha256-Q/xB79oR0yvXCT1bCPU82LUDrGpTUMt+uy67Si+mWL8=";

  buildInputs = [ rust-jemalloc-sys ];

--- a/pkgs/by-name/r2/r2modman/missing-hashes.json
+++ b/pkgs/by-name/r2/r2modman/missing-hashes.json
@ -78,8 +78,6 @@
  "@rollup/rollup-win32-ia32-msvc@npm:4.60.0": "0362713f7cfeb0b3deeedc11fabd551ec309cf21952735c2e2b76caf083331aef6701a11d2ad7a3824c439a9ff0d0c305aa12ef62f4f0a540eba2e952a18b00c",
  "@rollup/rollup-win32-x64-gnu@npm:4.60.0": "1400b3aace00dc90638bfd39d68275bb5f16143d240b9c36eb70f242ed2080c26fe14192fd3375120308ff94a7da1e169a8e0e56efbe41483f59731602d3be84",
  "@rollup/rollup-win32-x64-msvc@npm:4.60.0": "c948b3a8ed6e73f2382dc41ffab3e9928f95c4a0e3481272b26ad04a5f73084ca13fd5c253887f9077c37cb1c91bd8494b4a45a7764c874aa105684e8424289a",
-  "dmg-license@npm:1.0.11": "feef35cfb45270a72daadcca9584be5cb840f924448b9d4e543fcd61f1b6d471151049f277c91de1d8b003fad6203d0176066a5f427a01df5fb073402cb8c8b7",
-  "iconv-corefoundation@npm:1.1.7": "bc6f08ac421e5e92ed20f3825f123fd705e036612b2b6aa687958de753c06f32e54f0203ef55540869e3ee189eaea15e43a2757f3a90e555c4dd512c9422da43",
  "lightningcss-android-arm64@npm:1.32.0": "1cb326ad39dcb02cf9f45025c167b6900e3a04b08f5149d3c5ee26054b00d08db3736fb69183a6c3ed1cb32dddd148608c784b6631b4777623f7dd0c032c392d",
  "lightningcss-darwin-arm64@npm:1.32.0": "da954d0c215d0e95f15a92c8717f871017586e1332b98fd40e96196571d2fd3d51a727dc530768afee9f6a04da210510740574dd0c8dbf2ecced79e5996f1a06",
  "lightningcss-darwin-x64@npm:1.32.0": "b1d298c9173f839e8447d1917ed8bc5ab098ed0fc4e4b419d36ac5afe8b27bf21cb47d00a35c3d2edadcac598086e9b4f26c992a809d79f9681d6865a230d79e",
--- a/pkgs/by-name/r2/r2modman/package.nix
+++ b/pkgs/by-name/r2/r2modman/package.nix
@ -13,19 +13,19 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "r2modman";
-  version = "3.2.17";
+  version = "3.2.18";

  src = fetchFromGitHub {
    owner = "ebkr";
    repo = "r2modmanPlus";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-DXGgTezCcMl37Vu7R+2dwWJmuqsXXtlWRYMX9gqm7+w=";
+    hash = "sha256-QGs3kF2GkHlISmRb0cIYOKts1b1RvBj5qkc2cUPawwE=";
  };

  missingHashes = ./missing-hashes.json;
  offlineCache = yarn-berry.fetchYarnBerryDeps {
    inherit (finalAttrs) src patches missingHashes;
-    hash = "sha256-RAQgaxcQl15JqZsLA9ISfOiGgob4yYuc4bhjZFzW8xk=";
+    hash = "sha256-6CwayFhy0ZwdL1ZOZVtCJLlchCv5raX7WF1V4TvVpq4=";
  };

  patches = [
--- a/pkgs/by-name/ra/radicle-desktop/package.nix
+++ b/pkgs/by-name/ra/radicle-desktop/package.nix
@ -26,13 +26,13 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "radicle-desktop";
-  version = "0.12.0";
+  version = "0.13.0";

  src = fetchFromRadicle {
    seed = "seed.radicle.dev";
    repo = "z4D5UCArafTzTQpDZNQRuqswh3ury";
    tag = "releases/${finalAttrs.version}";
-    hash = "sha256-lbLBtLOBLf+w2Oq56JwXtouDykNrRZyrMxYX9131lf8=";
+    hash = "sha256-XpzOzyUwAGLF/klXXbBFX5oLRSURB+AsL8n9WWv5x7s=";
    leaveDotGit = true;
    postFetch = ''
      git -C $out rev-parse --short HEAD > $out/.git_head
@ -53,10 +53,10 @@ rustPlatform.buildRustPackage (finalAttrs: {

  npmDeps = fetchNpmDeps {
    inherit (finalAttrs) src;
-    hash = "sha256-7dXQ7wRJ2ZzuSplFdZTlfMetYPYA6/GODkuYjFRWfu0=";
+    hash = "sha256-EigvRDUmiuz/wt5vZ3NSxovxjvxHVGrHdA9HIod/fO8=";
  };

-  cargoHash = "sha256-UOk9v6tNshe6pNYU2djz50Ep7BEdUd4bLkGadO5VUb0=";
+  cargoHash = "sha256-HInTwQYuLVFnRCbQq2hNRPGJP1I9gBRQZQ9ul3DWtBQ=";

  twemojiAssets = fetchFromGitHub {
    owner = "twitter";
--- a/pkgs/by-name/re/renderdoc/package.nix
+++ b/pkgs/by-name/re/renderdoc/package.nix
@ -36,13 +36,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "renderdoc";
-  version = "1.44";
+  version = "1.45";

  src = fetchFromGitHub {
    owner = "baldurk";
    repo = "renderdoc";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-EInMFJMs+0bNSWmNP/f17pFCV9tJj6Ys3tZY6D69c/E=";
+    hash = "sha256-0XwKOLzkFN5u2ItRKPxNVC3hP3X6RVZyEL82LvYS0EA=";
  };

  outputs = [
--- a/pkgs/by-name/re/restate/package.nix
+++ b/pkgs/by-name/re/restate/package.nix
@ -13,6 +13,7 @@

  # buildInputs
  rdkafka,
+  rust-jemalloc-sys-unprefixed,

  # tests
  cacert,
@ -25,16 +26,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "restate";
-  version = "1.6.2";
+  version = "1.7.0";

  src = fetchFromGitHub {
    owner = "restatedev";
    repo = "restate";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-i9P6Lh0Qw4ylUVwAE51UTE5rSDluZafpEmxuAtv0SYQ=";
+    hash = "sha256-iXBGYgzguSHRFOR4ZqX7jGeQvGrBq9/+EFrc0RdVTMA=";
  };

-  cargoHash = "sha256-LfLqScEqBJK9s+xRg2Ah1OnBEDQjXQ9LgJGusmxEDfk=";
+  cargoHash = "sha256-haCi9qaDrRccw+2DKNi8gErp3jx5OuMWDJNy19xesNQ=";

  env = {
    PROTOC = lib.getExe protobuf;
@ -92,6 +93,8 @@ rustPlatform.buildRustPackage (finalAttrs: {

  buildInputs = [
    rdkafka
+    # tikv-jemalloc-sys's vendored jemalloc configure breaks under gcc 15.
+    rust-jemalloc-sys-unprefixed
  ];

  nativeCheckInputs = [
--- a/pkgs/by-name/ri/rio/package.nix
+++ b/pkgs/by-name/ri/rio/package.nix
@ -51,16 +51,24 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "rio";
-  version = "0.4.5";
+  version = "0.4.7";

  src = fetchFromGitHub {
    owner = "raphamorim";
    repo = "rio";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-ON7CJ1NDwLfjvLZ0ugN45LUjBGiwRNASiQwuDa6F1vM=";
+    hash = "sha256-vlNt8hBb1fhO5tEAID5WXMc7I0k9vn6/L45nkTXS6Qg=";
  };

-  cargoHash = "sha256-vSQ5heZZ8tYKeMABhZ8AziEAniavnAasH04BVlqYF4g=";
+  cargoHash = "sha256-8qVS9wINEBLKKWbylG3sHO+oqnLvsa1wgN0OOHFzOBM=";
+
+  # The 0.4.7 "update to rust 1.96" bump (raphamorim/rio@6a11aa33c7) only made
+  # clippy-style refactors that build on older rustc; the MSRV pin is cosmetic.
+  # Lower it so nixpkgs' rustc (1.95) can build rio.
+  postPatch = ''
+    substituteInPlace Cargo.toml \
+      --replace-fail 'rust-version = "1.96.0"' 'rust-version = "1.95.0"'
+  '';

  nativeBuildInputs = [
    rustPlatform.bindgenHook
--- a/pkgs/by-name/ro/rojo/package.nix
+++ b/pkgs/by-name/ro/rojo/package.nix
@ -10,17 +10,17 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "rojo";
-  version = "7.6.1";
+  version = "7.7.0";

  src = fetchFromGitHub {
    owner = "rojo-rbx";
    repo = "rojo";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-h8gd91Nc35jTQ4u9YyQGOB+rkgRAos8lsjX+bWzvpDs=";
+    hash = "sha256-2atNAiv51MNpxXdwvKSvtO1CGvQUOdUUOZszjAm3zi8=";
    fetchSubmodules = true;
  };

-  cargoHash = "sha256-zl1L8q1AJwVn0o2BazJ30FyBCMq5F5nAQ0FGuEAPGms=";
+  cargoHash = "sha256-1xTvW3Ra6erYpjxgfp2m8qVMz6u99WCDv2VE/Xh2mFc=";

  nativeBuildInputs = [ pkg-config ];
  buildInputs = [ openssl ];
--- a/pkgs/by-name/rs/rsync/package.nix
+++ b/pkgs/by-name/rs/rsync/package.nix
@ -85,6 +85,14 @@ stdenv.mkDerivation (finalAttrs: {
  ++ lib.optionals (stdenv.hostPlatform.isMusl && stdenv.hostPlatform.isx86_64) [
    # fix `multiversioning needs 'ifunc' which is not supported on this target` error
    "--disable-roll-simd"
+  ]
+  # Linux can hard-link symlinks; configure defaults this check to "no" when
+  # cross-compiling (e.g. pkgsStatic) because it cannot run the probe.
+  # That leaves hardlink_symlinks false while itemize still reports identical
+  # --copy-dest/--link-dest symlinks with blank attribute flags, so
+  # testsuite/itemize.test fails (https://github.com/NixOS/nixpkgs/issues/537437).
+  ++ lib.optionals (stdenv.hostPlatform.isLinux && stdenv.hostPlatform != stdenv.buildPlatform) [
+    "rsync_cv_can_hardlink_symlink=yes"
  ];

  enableParallelBuilding = true;
--- a/pkgs/by-name/sh/shantell-sans/package.nix
+++ b/pkgs/by-name/sh/shantell-sans/package.nix
@ -0,0 +1,36 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchzip,
+  installFonts,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "shantell-sans";
+  version = "1.011";
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  outputs = [
+    "out"
+    "webfont"
+  ];
+
+  src = fetchzip {
+    url = "https://github.com/arrowtype/shantell-sans/releases/download/${finalAttrs.version}/Shantell_Sans_${finalAttrs.version}.zip";
+    hash = "sha256-xgE4BSl2A7yeVP5hWWUViBDoU8pZ8KkJJrsSfGRIjOk=";
+  };
+
+  nativeBuildInputs = [ installFonts ];
+
+  meta = {
+    description = "A marker-style variable font by ArrowType and Shantell Martin";
+    homepage = "https://github.com/arrowtype/shantell-sans";
+    license = lib.licenses.ofl;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [
+      benhaskins
+    ];
+  };
+})
--- a/pkgs/by-name/so/sonic-pi/package.nix
+++ b/pkgs/by-name/so/sonic-pi/package.nix
@ -14,11 +14,11 @@
  crossguid,
  reproc,
  platform-folders,
-  ruby,
+  ruby_3_3,
  beamPackages,
  alsa-lib,
  rtmidi,
-  boost,
+  boost186,
  aubio,
  jack2,
  jack-example-tools,
@ -35,7 +35,7 @@
 }@args:

 let
-  ruby = args.ruby.withPackages (ps: [
+  ruby = args.ruby_3_3.withPackages (ps: [
    ps.prime
    ps.racc
    ps.rake
@ -92,7 +92,7 @@ stdenv.mkDerivation (finalAttrs: {
    ruby
    alsa-lib
    rtmidi
-    boost
+    boost186
    aubio
  ]
  ++ lib.optionals withTauWidget [
@ -274,6 +274,5 @@ stdenv.mkDerivation (finalAttrs: {
      sohalt
    ];
    platforms = lib.platforms.linux;
-    broken = true;
  };
 })
--- a/pkgs/by-name/su/sunsama/package.nix
+++ b/pkgs/by-name/su/sunsama/package.nix
@ -5,11 +5,11 @@
 }:

 let
-  version = "3.1.1";
+  version = "3.4.6";
  pname = "sunsama";
  src = fetchurl {
-    url = "https://download.todesktop.com/2003096gmmnl0g1/sunsama-${version}-build-250512vfxlcgvds-x86_64.AppImage";
-    hash = "sha512-VOzD/kWfsP2GR1uYkVUdjAuw9tlKjHRNxYuDSYYH7fn43Bk+wfgom/ofu3it/vQjjtuezkTN6gi96U87ypQrSA==";
+    url = "https://download.todesktop.com/2003096gmmnl0g1/sunsama-${version}-build-260521zej1bgvs1-x86_64.AppImage";
+    hash = "sha512-Stb0Mcap4KmRkj/s5jf1uZLm8sR5KNKGpZKXa2VtBIFxKofS1CxQJDWiJiPSNGsqtezLxmvsC4VSI45isYQSpQ==";
  };
  appimageContents = appimageTools.extractType2 { inherit pname version src; };
 in
--- a/pkgs/by-name/te/temporal/package.nix
+++ b/pkgs/by-name/te/temporal/package.nix
@ -49,6 +49,7 @@ buildGoModule (finalAttrs: {

    install -Dm755 "$GOPATH/bin/server" -T $out/bin/temporal-server
    install -Dm755 "$GOPATH/bin/cassandra" -T $out/bin/temporal-cassandra-tool
+    install -Dm755 "$GOPATH/bin/elasticsearch" -T $out/bin/temporal-elasticsearch-tool
    install -Dm755 "$GOPATH/bin/sql" -T $out/bin/temporal-sql-tool
    install -Dm755 "$GOPATH/bin/tdbg" -T $out/bin/tdbg

--- a/pkgs/by-name/te/terminusdb/package.nix
+++ b/pkgs/by-name/te/terminusdb/package.nix
@ -71,13 +71,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "terminusdb";
-  version = "12.0.4";
+  version = "12.0.6";

  src = fetchFromGitHub {
    owner = "terminusdb";
    repo = "terminusdb";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-vJifp0U4FrbtI86M8pt022BQWIIeK8jWWFG1Ch1m7IQ=";
+    hash = "sha256-TxLTPwESQ9pGrm/piWyyTwKlYtVogXRdQjnppvjX8F8=";
    leaveDotGit = true;
    postFetch = ''
      # Will be used for `TERMINUSDB_GIT_HASH`
@ -90,7 +90,7 @@ stdenv.mkDerivation (finalAttrs: {

  cargoDeps = rustPlatform.fetchCargoVendor {
    inherit (finalAttrs) src cargoRoot;
-    hash = "sha256-SvWS18amC4FHuXc/N6e+tomwnVfJ/KlTLIACfl72Nqc=";
+    hash = "sha256-WymXMJaUKz/IT2gDgQYagin1Sfg1akqCU+mkYUs40Ic=";
  };

  postPatch = ''
@ -100,6 +100,12 @@ stdenv.mkDerivation (finalAttrs: {
    substituteInPlace $cargoDepsCopy/*/tikv-jemalloc-sys-*/build.rs \
      --replace-fail 'format!("{orig_makeflags} {makeflags}")' \
                     'format!("{makeflags} {orig_makeflags}")'
+
+    # Hardcode terminus_home to a Nix store path that will exist both
+    # at compile time (via the symlink in preBuild) and at runtime.
+    substituteInPlace src/load_paths.pl \
+      --replace-fail "top_level_directory(TopDir)," \
+                     "TopDir = '$out/share/terminusdb',"
  '';

  strictDeps = true;
@ -151,6 +157,11 @@ stdenv.mkDerivation (finalAttrs: {
  preBuild = ''
    export TERMINUSDB_GIT_HASH=$(cat $src/COMMIT)
    export TERMINUSDB_JWT_ENABLED=true
+
+    # Point terminus_home at the build directory during compilation
+    # so the Rust dylib and Prolog sources are findable.
+    mkdir -p $out/share/terminusdb
+    ln --symbolic --force --no-target-directory $PWD/src $out/share/terminusdb/src
  '';

  # Required for Prolog initialisation
@ -160,6 +171,10 @@ stdenv.mkDerivation (finalAttrs: {
    runHook preInstall
    installBin terminusdb
    installManPage $src/docs/terminusdb.1
+
+    # Replace with the Nix store source so schema files are findable
+    # at runtime (the build directory no longer exists).
+    ln --symbolic --force --no-target-directory $src/src $out/share/terminusdb/src
    runHook postInstall
  '';

--- a/pkgs/by-name/te/terminusdb/tests.nix
+++ b/pkgs/by-name/te/terminusdb/tests.nix
@ -19,7 +19,7 @@ buildNpmPackage {

  sourceRoot = "${terminusdb.src.name}/tests";

-  npmDepsHash = "sha256-R2kbwHhlja5mH2AGpyiiVCz3YmSWF9cWptOTdcZb0PM=";
+  npmDepsHash = "sha256-AkTKdkKTCWExd3U1fkoXoF9znbIGzVGtQl06wfIVOeM=";

  # Test-only JS adjustments live here so the runtime package stays untouched
  postPatch = ''
--- a/pkgs/by-name/ti/tinycbor/package.nix
+++ b/pkgs/by-name/ti/tinycbor/package.nix
@ -1,4 +1,5 @@
 {
+  cmake,
  lib,
  stdenv,
  fetchFromGitHub,
@ -6,22 +7,22 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "tinycbor";
-  version = "0.6.1";
+  version = "7.0";

  src = fetchFromGitHub {
    owner = "intel";
    repo = "tinycbor";
-    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-JgkZAvZ63jjTdFRnyk+AeIWcGsg36UtPPFbhFjky9e8=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Fuw/hV3tVzoKf2Xrw64xuU+7xzSRPWL/ZdLjF0qICDY=";
  };

-  makeFlags = [ "prefix=$(out)" ];
+  nativeBuildInputs = [ cmake ];

  meta = {
    description = "Concise Binary Object Representation (CBOR) Library";
    mainProgram = "cbordump";
    homepage = "https://github.com/intel/tinycbor";
    license = lib.licenses.mit;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ tbutter ];
  };
 })
--- a/pkgs/by-name/tm/tmux/package.nix
+++ b/pkgs/by-name/tm/tmux/package.nix
@ -25,7 +25,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "tmux";
-  version = "3.7";
+  version = "3.7b";

  outputs = [
    "out"
@ -36,7 +36,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "tmux";
    repo = "tmux";
    tag = finalAttrs.version;
-    hash = "sha256-dgqI1jZjnluN/F/AjngzcaMy3TgudmkvDT336YlhGZM=";
+    hash = "sha256-CTq06XP997M0ODxQihTq34dI9H6jSRLUXLYuTWOwDpc=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/tm/tmuxp/package.nix
+++ b/pkgs/by-name/tm/tmuxp/package.nix
@ -7,12 +7,12 @@

 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "tmuxp";
-  version = "1.71.0";
+  version = "1.73.0";
  pyproject = true;

  src = fetchPypi {
    inherit (finalAttrs) pname version;
-    hash = "sha256-+Nsr4gNem/gB6ZMre53rfuM8Kwkiu86aGJmrxiFRorY=";
+    hash = "sha256-UExY0hC7HDWeISQ/mMZLMcMnqDko4i188MyoDbNePZc=";
  };

  build-system = with python3Packages; [
--- a/pkgs/by-name/to/tonearm/package.nix
+++ b/pkgs/by-name/to/tonearm/package.nix
@ -1,5 +1,5 @@
 {
-  buildGo126Module,
+  buildGoModule,
  cairo,
  copyDesktopItems,
  fetchFromCodeberg,
@ -15,7 +15,8 @@
  libsecret,
  librsvg,
  makeDesktopItem,
-  makeWrapper,
+  makeBinaryWrapper,
+  nix-update-script,
  pango,
  pkg-config,
  symlinkJoin,
@ -38,7 +39,8 @@ let
    ];
  };
 in
-buildGo126Module (finalAttrs: {
+buildGoModule (finalAttrs: {
+  __structuredAttrs = true;
  pname = "tonearm";
  version = "1.4.2";
  src = fetchFromCodeberg {
@ -66,7 +68,7 @@ buildGo126Module (finalAttrs: {
  nativeBuildInputs = [
    pkg-config
    copyDesktopItems
-    makeWrapper
+    makeBinaryWrapper
    wrapGAppsHook4
  ];

@ -106,6 +108,8 @@ buildGo126Module (finalAttrs: {
    glib-compile-schemas $out/share/glib-2.0/schemas
  '';

+  passthru.updateScript = nix-update-script { };
+
  meta = {
    description = "GTK client for TIDAL written in Golang";
    homepage = "https://codeberg.org/dergs/Tonearm";
@ -115,5 +119,6 @@ buildGo126Module (finalAttrs: {
      nilathedragon
    ];
    mainProgram = "tonearm";
+    platforms = lib.platforms.unix;
  };
 })
--- a/pkgs/by-name/vr/vrcx/package.nix
+++ b/pkgs/by-name/vr/vrcx/package.nix
@ -2,7 +2,7 @@
  lib,
  stdenv,
  nodejs_24,
-  electron_40,
+  electron_41,
  makeWrapper,
  fetchFromGitHub,
  buildNpmPackage,
@ -13,7 +13,7 @@
 }:
 let
  node = nodejs_24;
-  electron = electron_40;
+  electron = electron_41;
  dotnet = dotnetCorePackages.dotnet_9;
 in
 buildNpmPackage (finalAttrs: {
--- a/pkgs/by-name/we/webdav/package.nix
+++ b/pkgs/by-name/we/webdav/package.nix
@ -6,16 +6,16 @@

 buildGoModule (finalAttrs: {
  pname = "webdav";
-  version = "5.11.11";
+  version = "5.12.0";

  src = fetchFromGitHub {
    owner = "hacdias";
    repo = "webdav";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-WU8ZW1ty59ETgiedKdAzV1Sm8uu1nSJp9cSSrPgjyeU=";
+    hash = "sha256-lUekgI1p0abPDRQ4XU89EEIMO96jAnxMkDOP8xXngXw=";
  };

-  vendorHash = "sha256-cBfmN+D7zii7Khfv04q0HbiErn8vNMFeYGi17wAfOaE=";
+  vendorHash = "sha256-ZZ0wAivVN6xp/+16sbUDYVKmoMOGMf+sdHxa3fxaFOk=";

  __darwinAllowLocalNetworking = true;

--- a/pkgs/by-name/xa/xaos/package.nix
+++ b/pkgs/by-name/xa/xaos/package.nix
@ -27,6 +27,8 @@ stdenv.mkDerivation (finalAttrs: {
    qt6.qmake
    qt6.qttools
    qt6.wrapQtAppsHook
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [
    copyDesktopItems
  ];

@ -52,7 +54,7 @@ stdenv.mkDerivation (finalAttrs: {
        "QMAKE_APPLE_DEVICE_ARCHS = ${if stdenv.hostPlatform.isAarch64 then "arm64" else "x86_64"}"
  '';

-  desktopItems = [ "xdg/xaos.desktop" ];
+  desktopItems = [ "xdg/io.github.xaos_project.XaoS.desktop" ];

  postInstall = ''
    mkdir -p "${datapath}"
--- a/pkgs/by-name/xm/xmrig/package.nix
+++ b/pkgs/by-name/xm/xmrig/package.nix
@ -9,17 +9,44 @@
  hwloc,
  kmod,
  donateLevel ? 0,
+
+  # Algorithms
+  enableCnLite ? true,
+  enableCnHeavy ? true,
+  enableCnPico ? true,
+  enableCnFemto ? true,
+  enableRandomx ? true,
+  enableArgon2 ? true,
+  enableKawpow ? true,
+  enableGhostrider ? true,
+
+  # Features requiring external dependencies
+  withHwloc ? true,
+  withHttp ? true,
+  withTls ? true,
+
+  # Features (build toggles)
+  enableAsm ? true,
+  enableMsr ? true,
+  enableProfiling ? false,
+  enableSse4_1 ? true,
+  enableBenchmark ? true,
+  enableDmi ? true,
+
+  # Debug options
+  enableDebugLog ? false,
+  enableHwlocDebug ? false,
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "xmrig";
-  version = "6.25.0";
+  version = "6.26.0";

  src = fetchFromGitHub {
    owner = "xmrig";
    repo = "xmrig";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-X34djxUeSDwopwsipgrdFFFUP+tQ/uCNvupYzbegkEE=";
+    hash = "sha256-ZJKayM1kTLCXlQqqfN3MbAKPShi5OYafOdDbsMa0QIs=";
  };

  patches = [
@ -28,10 +55,12 @@ stdenv.mkDerivation (finalAttrs: {

  postPatch = ''
    substituteAllInPlace src/donate.h
+  ''
+  + lib.optionalString withTls ''
    substituteInPlace cmake/OpenSSL.cmake \
      --replace "set(OPENSSL_USE_STATIC_LIBS TRUE)" "set(OPENSSL_USE_STATIC_LIBS FALSE)"
  ''
-  + lib.optionalString stdenv.hostPlatform.isLinux ''
+  + lib.optionalString (stdenv.hostPlatform.isLinux && enableMsr) ''
    substituteInPlace src/hw/msr/Msr_linux.cpp \
      --replace "/sbin/modprobe" "${kmod}/bin/modprobe"
  '';
@ -42,9 +71,34 @@ stdenv.mkDerivation (finalAttrs: {

  buildInputs = [
    libuv
-    libmicrohttpd
-    openssl
-    hwloc
+  ]
+  ++ lib.optional withHttp libmicrohttpd
+  ++ lib.optional withTls openssl
+  ++ lib.optional withHwloc hwloc;
+
+  cmakeFlags = [
+    (lib.cmakeBool "WITH_CN_LITE" enableCnLite)
+    (lib.cmakeBool "WITH_CN_HEAVY" enableCnHeavy)
+    (lib.cmakeBool "WITH_CN_PICO" enableCnPico)
+    (lib.cmakeBool "WITH_CN_FEMTO" enableCnFemto)
+    (lib.cmakeBool "WITH_RANDOMX" enableRandomx)
+    (lib.cmakeBool "WITH_ARGON2" enableArgon2)
+    (lib.cmakeBool "WITH_KAWPOW" enableKawpow)
+    (lib.cmakeBool "WITH_GHOSTRIDER" enableGhostrider)
+
+    (lib.cmakeBool "WITH_HWLOC" withHwloc)
+    (lib.cmakeBool "WITH_HTTP" withHttp)
+    (lib.cmakeBool "WITH_TLS" withTls)
+
+    (lib.cmakeBool "WITH_ASM" enableAsm)
+    (lib.cmakeBool "WITH_MSR" enableMsr)
+    (lib.cmakeBool "WITH_PROFILING" enableProfiling)
+    (lib.cmakeBool "WITH_SSE4_1" enableSse4_1)
+    (lib.cmakeBool "WITH_BENCHMARK" enableBenchmark)
+    (lib.cmakeBool "WITH_DMI" enableDmi)
+
+    (lib.cmakeBool "WITH_DEBUG_LOG" enableDebugLog)
+    (lib.cmakeBool "HWLOC_DEBUG" enableHwlocDebug)
  ];

  inherit donateLevel;
@ -52,7 +106,7 @@ stdenv.mkDerivation (finalAttrs: {
  installPhase = ''
    runHook preInstall

-    install -vD xmrig $out/bin/xmrig
+    install -vD ${if withTls then "xmrig" else "xmrig-notls"} $out/bin/xmrig

    runHook postInstall
  '';
--- a/pkgs/by-name/zi/zigfetch/package.nix
+++ b/pkgs/by-name/zi/zigfetch/package.nix
@ -2,7 +2,7 @@
  lib,
  stdenv,
  fetchFromGitHub,
-  zig_0_15,
+  zig_0_16,
  pciutils,
  apple-sdk,
  replaceVars,
@ -11,13 +11,13 @@
 stdenv.mkDerivation (finalAttrs: {

  pname = "zigfetch";
-  version = "0.25.0";
+  version = "0.27.1";

  src = fetchFromGitHub {
    owner = "utox39";
    repo = "zigfetch";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-n5bVIkg/jMVLixIfMp1ah4iJJLv59MoH4/acvFye4vQ=";
+    hash = "sha256-A8DZ8O7WghvN9+74FGapLl/7SfGc3n+FlyI6jRKX/yk=";
  };

  patches = lib.optionals stdenv.hostPlatform.isDarwin [
@ -27,7 +27,7 @@ stdenv.mkDerivation (finalAttrs: {
  ];

  nativeBuildInputs = [
-    zig_0_15
+    zig_0_16
  ];

  buildInputs = [
@ -43,6 +43,6 @@ stdenv.mkDerivation (finalAttrs: {
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ heisfer ];
    mainProgram = "zigfetch";
-    inherit (zig_0_15.meta) platforms;
+    inherit (zig_0_16.meta) platforms;
  };
 })
--- a/pkgs/development/libraries/libxml2/default.nix
+++ b/pkgs/development/libraries/libxml2/default.nix
@ -37,6 +37,13 @@ let
        # Based on https://gitlab.gnome.org/GNOME/libxml2/-/commit/19549c61590c1873468c53e0026a2fbffae428ef.patch
        # There are only whitespace differences from upstream.
        ./2.13-CVE-2026-0989.patch
+
+        (fetchpatch {
+          name = "CVE-2026-11979.patch";
+          url = "https://gitlab.gnome.org/GNOME/libxml2/-/commit/c2e233fc1b341685fc99621b2768b503f777a72e.patch";
+          hash = "sha256-DcPZl6rOuP6aycK+1EHUgPX4YWDAH+ctAZtOI48QO2Q=";
+          excludes = [ "test/catalogs/test.sh" ];
+        })
      ];
      freezeUpdateScript = true;
      extraMeta = {
--- a/pkgs/development/python-modules/accelerate/default.nix
+++ b/pkgs/development/python-modules/accelerate/default.nix
@ -44,8 +44,6 @@ buildPythonPackage (finalAttrs: {
    hash = "sha256-IfKePiU38fUd5HefaS7J1s8Mb6hVmldINemxAJY+83o=";
  };

-  buildInputs = [ llvmPackages.openmp ];
-
  build-system = [ setuptools ];

  dependencies = [
--- a/pkgs/development/python-modules/beetcamp/default.nix
+++ b/pkgs/development/python-modules/beetcamp/default.nix
@ -17,14 +17,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "beetcamp";
-  version = "0.24.2";
+  version = "0.24.3";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "snejus";
    repo = "beetcamp";
    tag = finalAttrs.version;
-    hash = "sha256-AMHj7rsPAxUUvVg6vri2NnkO9+5NAVwGrWLvNvOtlLs=";
+    hash = "sha256-kKFYuTJys4j67+cak2PDmn6z2vNzVitFXIZXy2bClY8=";
  };

  patches = [
--- a/pkgs/development/python-modules/compressed-tensors/default.nix
+++ b/pkgs/development/python-modules/compressed-tensors/default.nix
@ -7,7 +7,6 @@
  # build-system
  setuptools,
  setuptools-scm,
-  llvmPackages,

  # dependencies
  frozendict,
@ -47,10 +46,6 @@ buildPythonPackage (finalAttrs: {
    setuptools-scm
  ];

-  buildInputs = lib.optionals stdenv.cc.isClang [
-    llvmPackages.openmp
-  ];
-
  dependencies = [
    frozendict
    loguru
@ -98,6 +93,9 @@ buildPythonPackage (finalAttrs: {
    "test_mxfp8_scales_e2e"
  ]
  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    # AssertionError: Numerical precision error
+    "test_quantization_enabled_disabled"
+
    # torch._inductor.exc.InductorError: ImportError: dlopen(/nix/var/nix/builds/nix-25002-542173852/torchinductor__nixbld1/xo/cxovsevcfanmw7lgoddbnyhoxes3nzlu7ecugxedaq2zr4f6b2qh.main.so, 0x0002):
    # symbol not found in flat namespace '___kmpc_barrier'
    "test_compress_decompress_module"
--- a/pkgs/development/python-modules/e3nn/default.nix
+++ b/pkgs/development/python-modules/e3nn/default.nix
@ -62,12 +62,6 @@ buildPythonPackage (finalAttrs: {
    "test_variance"
  ];

-  propagatedBuildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    # Otherwise, torch will fail to include `omp.h`:
-    # torch._inductor.exc.InductorError: CppCompileError: C++ compile error OpenMP support not found
-    llvmPackages.openmp
-  ];
-
  meta = {
    description = "Modular framework for neural networks with Euclidean symmetry";
    homepage = "https://github.com/e3nn/e3nn";
--- a/pkgs/development/python-modules/epaper-dithering/default.nix
+++ b/pkgs/development/python-modules/epaper-dithering/default.nix
@ -10,14 +10,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "epaper-dithering";
-  version = "5.0.6";
+  version = "5.0.7";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "OpenDisplay";
    repo = "epaper-dithering";
    tag = "epaper-dithering-v${finalAttrs.version}";
-    hash = "sha256-8xkgKOHS68aQWrJLNwUusZzXK7oAyjDvxd9c5aUDA84=";
+    hash = "sha256-cAMmjIBqUIhwS4Ak5fXG927pqt5xnBaOEUthv9LQjG8=";
  };

  sourceRoot = "${finalAttrs.src.name}/packages/python";
--- a/pkgs/development/python-modules/gradio/client.nix
+++ b/pkgs/development/python-modules/gradio/client.nix
@ -2,7 +2,6 @@
  lib,
  stdenv,
  buildPythonPackage,
-  nix-update-script,
  jq,

  # build-system
@ -32,7 +31,7 @@

 buildPythonPackage (finalAttrs: {
  pname = "gradio-client";
-  version = "2.3.0";
+  version = "2.5.0";
  pyproject = true;

  # no tests on pypi
--- a/pkgs/development/python-modules/gradio/default.nix
+++ b/pkgs/development/python-modules/gradio/default.nix
@ -21,14 +21,13 @@
  pnpmConfigHook,

  # dependencies
-  aiofiles,
  anyio,
  audioop-lts,
  brotli,
  fastapi,
-  ffmpy,
  gradio-client,
  groovy,
+  hf-gradio,
  httpx,
  huggingface-hub,
  jinja2,
@ -82,17 +81,23 @@ let
 in
 buildPythonPackage (finalAttrs: {
  pname = "gradio";
-  version = "6.9.0";
+  version = "6.19.0";
  pyproject = true;
+  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "gradio-app";
    repo = "gradio";
    tag = "gradio@${finalAttrs.version}";
-    hash = "sha256-iGaUiJto/tquCSa6D/wbkNyVtK/2kZB/hz62STfwLOY=";
+    hash = "sha256-9vO+cuxpXERD/rH8wMuNWBNSH6Mu+yZLQMxLoiUTKtk=";
  };

  patches = [
+    # Upstream's after_build.js runs `npm install --production` to vendor http-proxy into the server
+    # build output, which fails offline.
+    # Copy it (and its dependency closure) from the already-fetched pnpm workspace.
+    ./dont-npm-install-http-proxy.patch
+
    ./fix-transformers-pipelines-imports.patch
  ];

@ -103,8 +108,12 @@ buildPythonPackage (finalAttrs: {
      src
      ;
    inherit pnpm;
-    fetcherVersion = 3;
-    hash = "sha256-pZCYtWFNlrcRFomx6HbO0zySOyifO3n/ffzx59pS/A8=";
+    fetcherVersion = 4;
+    hash = "sha256-xCxr/jnp9emeB6THGt4cumvApw6fSZQwG2NGOcvR0yQ=";
+  };
+
+  env = {
+    CI = "true";
  };

  nativeBuildInputs = [
@ -121,19 +130,13 @@ buildPythonPackage (finalAttrs: {
    hatch-fancy-pypi-readme
  ];

-  pythonRelaxDeps = [
-    "aiofiles"
-    "tomlkit"
-  ];
-
  dependencies = [
-    aiofiles
    anyio
    brotli
    fastapi
-    ffmpy
    gradio-client
    groovy
+    hf-gradio
    httpx
    huggingface-hub
    jinja2
@ -397,13 +400,25 @@ buildPythonPackage (finalAttrs: {

  pythonImportsCheck = [ "gradio" ];

+  __darwinAllowLocalNetworking = true;
+
  # Cyclic dependencies are fun!
-  # This is gradio without gradio-client and gradio-pdf
+  # This is gradio without gradio-client and hf-gradio
  passthru = {
    sans-reverse-dependencies =
      (gradio.override {
        gradio-client = null;
        gradio-pdf = null;
+        # gradio imports hf_gradio at module load (gradio/routes.py), so we must keep it for the
+        # import to succeed.
+        # hf-gradio depends on gradio-client, whose test suite pulls in
+        # gradio.sans-reverse-dependencies, which would create a build cycle.
+        # Break it by giving hf-gradio a checkless gradio-client.
+        hf-gradio = hf-gradio.override {
+          gradio-client = gradio-client.overridePythonAttrs {
+            doCheck = false;
+          };
+        };
      }).overridePythonAttrs
        (old: {
          pname = old.pname + "-sans-reverse-dependencies";
--- a/pkgs/development/python-modules/gradio/dont-npm-install-http-proxy.patch
+++ b/pkgs/development/python-modules/gradio/dont-npm-install-http-proxy.patch
@ -0,0 +1,44 @@
+--- a/js/app/after_build.js	2026-05-28 14:03:04.411110834 +0000
+++ b/js/app/after_build.js	2026-05-28 14:03:32.000852551 +0000
+@@ -1,7 +1,7 @@
+-import { writeFileSync, copyFileSync } from "fs";
+import { writeFileSync, copyFileSync, cpSync, mkdirSync, readFileSync } from "fs";
+ import { resolve, dirname } from "path";
+ import { fileURLToPath } from "url";
+-import { execSync } from "child_process";
+import { createRequire } from "module";
+ 
+ const __filename = fileURLToPath(import.meta.url);
+ const __dirname = dirname(__filename);
+@@ -20,8 +20,29 @@
+ 	)
+ );
+ 
+-// Install http-proxy in the build output so it's available at runtime
+-execSync("npm install --production", { cwd: out_path, stdio: "inherit" });
+// Vendor http-proxy and its production dependency closure into the build
+// output so it's available at runtime. Upstream runs `npm install --production`
+// here, but the packages are already present in the workspace, so we copy them
+// instead of hitting the network.
+const out_node_modules = resolve(out_path, "node_modules");
+mkdirSync(out_node_modules, { recursive: true });
+
+const copied = new Set();
+function vendor(name, parentRequire) {
+	if (copied.has(name)) return;
+	copied.add(name);
+	const pkgJsonPath = parentRequire.resolve(`${name}/package.json`);
+	cpSync(dirname(pkgJsonPath), resolve(out_node_modules, name), {
+		recursive: true,
+		dereference: true
+	});
+	const pkgJson = JSON.parse(readFileSync(pkgJsonPath, "utf8"));
+	const ownRequire = createRequire(pkgJsonPath);
+	for (const dep of Object.keys(pkgJson.dependencies || {})) {
+		vendor(dep, ownRequire);
+	}
+}
+vendor("http-proxy", createRequire(import.meta.url));
+ 
+ // Replace the adapter-generated index.js with our custom proxy entry point
+ copyFileSync(
--- a/pkgs/development/python-modules/gradio/fix-transformers-pipelines-imports.patch
+++ b/pkgs/development/python-modules/gradio/fix-transformers-pipelines-imports.patch
@ -14,10 +14,10 @@ index 1903f758f..c40e6d3b1 100644
 -    FillMaskPipeline,
 -    ImageClassificationPipeline,
 -    ObjectDetectionPipeline,
-    QuestionAnsweringPipeline,
+-    QuestionAnsweringPipeline,  # ty: ignore[unresolved-import]
 -    TextClassificationPipeline,
 -    TextGenerationPipeline,
-    VisualQuestionAnsweringPipeline,
+-    VisualQuestionAnsweringPipeline,  # ty: ignore[unresolved-import]
 -    ZeroShotClassificationPipeline,
 -)
 
--- a/pkgs/development/python-modules/hf-gradio/default.nix
+++ b/pkgs/development/python-modules/hf-gradio/default.nix
@ -0,0 +1,48 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+
+  # build-system
+  hatchling,
+
+  # dependencies
+  gradio-client,
+  typer,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "hf-gradio";
+  version = "0.4.1";
+  pyproject = true;
+  __structuredAttrs = true;
+
+  # No tags on GitHub
+  # https://github.com/gradio-app/hf-gradio/issues/2
+  src = fetchPypi {
+    pname = "hf_gradio";
+    inherit (finalAttrs) version;
+    hash = "sha256-oBfZQmGPDUlaWO5FYwR/oEvvYUwA4Mt4mpptBjPP+ns=";
+  };
+
+  build-system = [
+    hatchling
+  ];
+
+  dependencies = [
+    gradio-client
+    typer
+  ];
+
+  # The PyPI sdist ships no test suite.
+  doCheck = false;
+
+  pythonImportsCheck = [ "hf_gradio" ];
+
+  meta = {
+    description = "Extension of the Hugging Face CLI for interacting with Gradio Spaces and Apps";
+    homepage = "https://pypi.org/project/hf-gradio";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ GaetanLepage ];
+  };
+})
--- a/pkgs/development/python-modules/hoptorch/default.nix
+++ b/pkgs/development/python-modules/hoptorch/default.nix
@ -40,12 +40,6 @@ buildPythonPackage (finalAttrs: {

  pythonImportsCheck = [ "hoptorch" ];

-  checkInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    # torch._inductor.exc.InductorError: CppCompileError: C++ compile error
-    # fatal error: 'omp.h' file not found
-    llvmPackages.openmp
-  ];
-
  nativeCheckInputs = [
    pytestCheckHook
  ];
--- a/pkgs/development/python-modules/junit2html/default.nix
+++ b/pkgs/development/python-modules/junit2html/default.nix
@ -9,14 +9,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "junit2html";
-  version = "31.1.3";
+  version = "31.1.4";
  pyproject = true;

  src = fetchFromGitLab {
    owner = "inorton";
    repo = "junit2html";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-TF+ifAFPn3PQwYQFruP++bWo6/6J8LEmDJYXDYSwcq0=";
+    hash = "sha256-GUlRGv4+tRslrvSWvb3Fe5DcMFeYgL7HCyAHzrksJeQ=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/lerobot/default.nix
+++ b/pkgs/development/python-modules/lerobot/default.nix
@ -59,11 +59,6 @@ buildPythonPackage (finalAttrs: {
  ];
  dontUseCmakeConfigure = true;

-  checkInputs = lib.optionals stdenv.cc.isClang [
-    # test_async_iterator_* hangs after failing to find OMP headers
-    llvmPackages.openmp
-  ];
-
  pythonRelaxDeps = [
    "av"
    "diffusers"
--- a/pkgs/development/python-modules/libtmux/default.nix
+++ b/pkgs/development/python-modules/libtmux/default.nix
@ -14,14 +14,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "libtmux";
-  version = "0.59.0";
+  version = "0.60.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "tmux-python";
    repo = "libtmux";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-RsK3nVGpgNX05tCc5kK5GFLUS5vVoe8NRKgg7Y/DzwM=";
+    hash = "sha256-1h+qkQDYRwP2peMOvKC1kk4DFcG4cwuBApsF8MmkWbo=";
  };

  patches = [ ./0001-fix-test_control_mode_stdout_preserves_non_ascii_out.patch ];
@ -45,7 +45,12 @@ buildPythonPackage (finalAttrs: {
  enabledTestPaths = [ "tests" ];

  disabledTestPaths = lib.optionals stdenv.hostPlatform.isDarwin [ "tests/test/test_retry.py" ];
-  disabledTests = lib.optionals stdenv.hostPlatform.isDarwin [
+  disabledTests = [
+    # test is broken for tmux 3.7a and later
+    # https://github.com/tmux-python/libtmux/issues/697
+    "test_new_window_name_invalid_on_3_7"
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
    # Fail with: 'no server running on /tmp/tmux-1000/libtmux_test8sorutj1'.
    "test_new_session_width_height"
    # AssertionError: assert '' == '$'
--- a/pkgs/development/python-modules/lime/default.nix
+++ b/pkgs/development/python-modules/lime/default.nix
@ -3,6 +3,8 @@
  fetchPypi,
  buildPythonPackage,

+  setuptools,
+
  matplotlib,
  numpy,
  scipy,
@ -13,13 +15,15 @@
  pytestCheckHook,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "lime";
  version = "0.2.0.1";
-  format = "setuptools";
+  pyproject = true;
+
+  __structuredAttrs = true;

  src = fetchPypi {
-    inherit pname version;
+    inherit (finalAttrs) pname version;
    hash = "sha256-dpYOTwVf61Pom1AiODuvyHtj8lusYmWYSwozPRpX94E=";
  };

@ -28,7 +32,9 @@ buildPythonPackage rec {
      --replace-fail "random_seed" "rng"
  '';

-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
    matplotlib
    numpy
    scipy
@ -42,6 +48,8 @@ buildPythonPackage rec {
  disabledTestPaths = [
    # touches network
    "lime/tests/test_lime_text.py"
+    # slightly flaky
+    "lime/tests/test_lime_tabular.py::TestLimeTabular::test_lime_explainer_entropy_discretizer"
  ];

  pythonImportsCheck = [
@ -55,8 +63,8 @@ buildPythonPackage rec {
  meta = {
    description = "Local Interpretable Model-Agnostic Explanations for machine learning classifiers";
    homepage = "https://github.com/marcotcr/lime";
-    changelog = "https://github.com/marcotcr/lime/releases/tag/${version}";
+    changelog = "https://github.com/marcotcr/lime/releases/tag/${finalAttrs.version}";
    license = lib.licenses.bsd2;
    maintainers = with lib.maintainers; [ khaser ];
  };
-}
+})
--- a/Show more
+++ b/Show more