Merge staging-next into staging

2026-07-06 17:13:24 -05:00 · 2026-05-17 00:41:02 +00:00 · 2026-05-17 00:41:02 +00:00 · f590b9073a
commit f590b9073a
parent f6308ed8d8 9782b6213f
144 changed files with 1100 additions and 842 deletions
--- a/lib/systems/default.nix
+++ b/lib/systems/default.nix
@ -85,11 +85,12 @@ let
    let
      allArgs = systemToAttrs systemOrArgs;

-      # Those two will always be derived from "config", if given, so they should NOT
-      # be overridden further down with "// args".
+      # These attributes are derived from other inputs, so they should NOT be
+      # overridden further down with "// args".
      args = removeAttrs allArgs [
        "parsed"
        "system"
+        "_withoutFunctions"
      ];

      # TODO: deprecate args.rustc in favour of args.rust after 23.05 is EOL.
--- a/lib/tests/systems.nix
+++ b/lib/tests/systems.nix
@ -266,6 +266,22 @@ lib.runTests (
        }).parsed.cpu.arch;
      expected = "i686";
    };
+    test_equals_reelaborate_overridden_platform = {
+      expr =
+        let
+          base = lib.systems.elaborate "x86_64-linux";
+        in
+        lib.systems.equals base (
+          lib.systems.elaborate (
+            base
+            // {
+              useLLVM = true;
+              linker = "lld";
+            }
+          )
+        );
+      expected = false;
+    };
  }
  // {
    # equals.functionNames must list exactly the function-valued attrs of an
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -20233,11 +20233,13 @@
    github = "numinit";
    githubId = 369111;
    keys = [
-      # >=2025, stays in one place
+      # SSH
+      { fingerprint = "XX/0lMz82MpucPqf0KG+5EJoozzNRi8i/t59byD2kNo"; }
+      # GPG, >=2025, stays in one place
      { fingerprint = "FD28 F9C9 81C5 D78E 56E8  8311 5C3E B94D 198F 1491"; }
-      # >=2025, travels with me
+      # GPG, >=2025, travels with me
      { fingerprint = "C48F 475F 30A9 B192 3213  D5D5 C6E2 4809 77B2 F2F4"; }
-      # <=2024
+      # GPG, <=2024
      { fingerprint = "190B DA97 F616 DE35 6899  ED17 F819 F1AF 2FC1 C1FF"; }
    ];
  };
@ -30880,6 +30882,13 @@
    githubId = 873857;
    name = "Zack Newman";
  };
+  Zocker1999NET = {
+    github = "Zocker1999NET";
+    githubId = 1645646;
+    name = "Felix Stupp";
+    email = "felix.stupp@banananet.work";
+    keys = [ { fingerprint = "73D0 9948 B239 2D68 8A45  DC83 93E1 BD26 F6B0 2FB7"; } ];
+  };
  zodman = {
    github = "zodman";
    githubId = 44167;
--- a/maintainers/team-list.nix
+++ b/maintainers/team-list.nix
@ -358,7 +358,6 @@ with lib.maintainers;
  home-assistant = {
    members = [
      dotlambda
-      fab
      hexa
    ];
    scope = "Maintain the Home Assistant ecosystem";
--- a/nixos/doc/manual/release-notes/rl-2605.section.md
+++ b/nixos/doc/manual/release-notes/rl-2605.section.md
@ -306,6 +306,8 @@ See <https://github.com/NixOS/nixpkgs/issues/481673>.

 - support for `ecryptfs` in nixpkgs has been removed.

+- `services.xserver.cmt` has been removed as the `xf86-input-cmt` package was broken and unmaintained upstream.
+
 - `programs.light` was removed from nixpkgs due to the corresponding package being unmaintained upstream. `brightnessctl` and `programs.acpilight` offer replacements.

 - `ceph` has been upgraded to v20. See the [Ceph "tentacle" release notes](https://docs.ceph.com/en/latest/releases/tentacle/#v20-2-0-tentacle) for details and recommended upgrade procedure.
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -1856,7 +1856,6 @@
  ./services/x11/display-managers/xpra.nix
  ./services/x11/extra-layouts.nix
  ./services/x11/fractalart.nix
-  ./services/x11/hardware/cmt.nix
  ./services/x11/hardware/digimend.nix
  ./services/x11/hardware/synaptics.nix
  ./services/x11/hardware/wacom.nix
--- a/nixos/modules/rename.nix
+++ b/nixos/modules/rename.nix
@ -390,6 +390,10 @@ in
      as the underlying package isn't being maintained. Working alternatives are
      libinput and synaptics.
    '')
+    (mkRemovedOptionModule [ "services" "xserver" "windowManager" "ragnarwm" ] ''
+      The services.xserver.windowManager.ragnarwm module has been removed
+      because the corresponding package was removed from nixpkgs.
+    '')
    (mkRemovedOptionModule [
      "services"
      "xmr-stak"
@ -514,6 +518,9 @@ in
    (mkRemovedOptionModule [ "services" "xtreemfs" ] ''
      services.xtreemfs has been removed as it was broken and unmaintained upstream
    '')
+    (mkRemovedOptionModule [ "services" "xserver" "cmt" ] ''
+      services.xserver.cmt has been removed as it was broken and unmaintained upstream
+    '')
    # Do NOT add any option renames here, see top of the file
  ];
 }
--- a/nixos/modules/services/networking/mullvad-vpn.nix
+++ b/nixos/modules/services/networking/mullvad-vpn.nix
@ -39,7 +39,7 @@ with lib;
    };

    package = mkPackageOption pkgs "mullvad" {
-      example = "mullvad-vpn";
+      example = "pkgs.mullvad-vpn";
      extraDescription = ''
        `pkgs.mullvad` only provides the CLI tool, `pkgs.mullvad-vpn` provides both the CLI and the GUI.
      '';
--- a/nixos/modules/services/x11/hardware/cmt.nix
+++ b/nixos/modules/services/x11/hardware/cmt.nix
@ -1,114 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-
-with lib;
-
-let
-
-  cfg = config.services.xserver.cmt;
-  etcPath = "X11/xorg.conf.d";
-
-in
-{
-
-  options = {
-
-    services.xserver.cmt = {
-      enable = mkOption {
-        type = types.bool;
-        default = false;
-        description = "Enable chrome multitouch input (cmt). Touchpad drivers that are configured for chromebooks.";
-      };
-      models = mkOption {
-        type = types.enum [
-          "atlas"
-          "banjo"
-          "candy"
-          "caroline"
-          "cave"
-          "celes"
-          "clapper"
-          "cyan"
-          "daisy"
-          "elan"
-          "elm"
-          "enguarde"
-          "eve"
-          "expresso"
-          "falco"
-          "gandof"
-          "glimmer"
-          "gnawty"
-          "heli"
-          "kevin"
-          "kip"
-          "leon"
-          "lulu"
-          "orco"
-          "pbody"
-          "peppy"
-          "pi"
-          "pit"
-          "puppy"
-          "quawks"
-          "rambi"
-          "samus"
-          "snappy"
-          "spring"
-          "squawks"
-          "swanky"
-          "winky"
-          "wolf"
-          "auron_paine"
-          "auron_yuna"
-          "daisy_skate"
-          "nyan_big"
-          "nyan_blaze"
-          "veyron_jaq"
-          "veyron_jerry"
-          "veyron_mighty"
-          "veyron_minnie"
-          "veyron_speedy"
-        ];
-        example = "banjo";
-        description = ''
-          Which models to enable cmt for. Enter the Code Name for your Chromebook.
-          Code Name can be found at <https://www.chromium.org/chromium-os/developer-information-for-chrome-os-devices>.
-        '';
-      };
-    }; # closes services
-  }; # closes options
-
-  config = mkIf cfg.enable {
-
-    services.xserver.modules = [ pkgs.xf86-input-cmt ];
-
-    environment.etc = {
-      "${etcPath}/40-touchpad-cmt.conf" = {
-        source = "${pkgs.chromium-xorg-conf}/40-touchpad-cmt.conf";
-      };
-      "${etcPath}/50-touchpad-cmt-${cfg.models}.conf" = {
-        source = "${pkgs.chromium-xorg-conf}/50-touchpad-cmt-${cfg.models}.conf";
-      };
-      "${etcPath}/60-touchpad-cmt-${cfg.models}.conf" = {
-        source = "${pkgs.chromium-xorg-conf}/60-touchpad-cmt-${cfg.models}.conf";
-      };
-    };
-
-    assertions = [
-      {
-        assertion = !config.services.libinput.enable;
-        message = ''
-          cmt and libinput are incompatible, meaning you cannot enable them both.
-          To use cmt you need to disable libinput with `services.libinput.enable = false`
-          If you haven't enabled it in configuration.nix, it's enabled by default on a
-          different xserver module.
-        '';
-      }
-    ];
-  };
-}
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -1770,6 +1770,7 @@ in
  vector = import ./vector { inherit runTest; };
  velocity = runTest ./velocity.nix;
  vengi-tools = runTest ./vengi-tools.nix;
+  veroroute = runTest ./veroroute.nix;
  victorialogs = import ./victorialogs { inherit runTest; };
  victoriametrics = import ./victoriametrics { inherit runTest; };
  victoriatraces = import ./victoriatraces { inherit runTest; };
--- a/nixos/tests/gnupg.nix
+++ b/nixos/tests/gnupg.nix
@ -77,7 +77,7 @@
        machine.send_chars("pgp_p4ssphrase")
        machine.wait_until_tty_matches("1", "Passphrases match")
        machine.send_chars("\n")
-        machine.wait_until_tty_matches("1", "public and secret key created")
+        machine.wait_until_tty_matches("1", "secret key created and signed")

    with subtest("Confirm the key is in the keyring"):
        machine.wait_until_succeeds(as_alice("gpg --list-secret-keys | grep -q alice@machine"))
@ -92,7 +92,7 @@

        # Note: again, this needs a tty because of pinentry
        machine.send_chars("ssh-add alice\n")
-        machine.wait_until_tty_matches("1", "Enter passphrase")
+        machine.wait_until_tty_matches("1", "passphrase for")
        machine.send_chars("ssh_p4ssphrase\n")
        machine.wait_until_tty_matches("1", "Please enter")
        machine.send_chars("ssh_agent_p4ssphrase")
--- a/nixos/tests/veroroute.nix
+++ b/nixos/tests/veroroute.nix
@ -0,0 +1,31 @@
+{ pkgs, ... }:
+{
+  name = "veroroute";
+  meta.maintainers = with pkgs.lib.maintainers; [ nh2 ];
+
+  enableOCR = true;
+
+  nodes.machine =
+    { ... }:
+    {
+      imports = [
+        ./common/x11.nix
+      ];
+
+      services.xserver.enable = true;
+      environment.systemPackages = [
+        pkgs.veroroute
+        pkgs.xdotool
+      ];
+    };
+
+  testScript = ''
+    start_all()
+    machine.wait_for_x()
+
+    machine.execute("veroroute >&2 &")
+    machine.wait_until_succeeds("xdotool search --pid $(pidof veroroute)")
+    machine.wait_for_text("File")  # menu entry renders correctly
+    machine.screenshot("screen")
+  '';
+}
--- a/pkgs/applications/editors/android-studio/default.nix
+++ b/pkgs/applications/editors/android-studio/default.nix
@ -26,9 +26,9 @@ let
    url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2025.3.4.5/android-studio-panda4-rc1-linux.tar.gz";
  };
  latestVersion = {
-    version = "2026.1.1.4"; # "Android Studio Quail 1 | 2026.1.1 Canary 4"
-    sha256Hash = "sha256-aKbyRwgY4Z2W9hF3YY64dLLF5wUGIrdtGySYrV57lNQ=";
-    url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2026.1.1.4/android-studio-quail1-canary4-linux.tar.gz";
+    version = "2026.1.1.5"; # "Android Studio Quail 1 | 2026.1.1 Canary 5"
+    sha256Hash = "sha256-k4rM0MyTh0wnpsK8m6Hs1nSdwYpqUiQ+z7oiO6hn9YQ=";
+    url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2026.1.1.5/android-studio-quail1-canary5-linux.tar.gz";
  };
 in
 {
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@ -1174,8 +1174,8 @@ let
        mktplcRef = {
          publisher = "DanielSanMedium";
          name = "dscodegpt";
-          version = "3.17.36";
-          hash = "sha256-7+Ja5/zeGq+W1aCIzZu0x+CU1ERwZhwvOaZKaGSWK4c=";
+          version = "3.20.6";
+          hash = "sha256-QDs+zi2Kb2APYxZOzvBnrEZqlmhzNFmQ3bpSfIaPjlc=";
        };
        meta = {
          changelog = "https://marketplace.visualstudio.com/items/DanielSanMedium.dscodegpt/changelog";
@ -1226,8 +1226,8 @@ let
        mktplcRef = {
          name = "databricks";
          publisher = "databricks";
-          version = "2.10.6";
-          hash = "sha256-6D8QRH8x2LCZehkkaKf3s3yKzmAkiBg9gFaUCIzGJB4=";
+          version = "2.10.7";
+          hash = "sha256-ODAUmYiomllLMGbncU4T+8SfLZnhULggFB6Mfw7vn1o=";
        };
        meta = {
          changelog = "https://marketplace.visualstudio.com/items/databricks.databricks/changelog";
@ -3239,6 +3239,8 @@ let

      ms-python.vscode-pylance = callPackage ./ms-python.vscode-pylance { };

+      ms-python.vscode-python-envs = callPackage ./ms-python.vscode-python-envs { };
+
      ms-toolsai.datawrangler = buildVscodeMarketplaceExtension {
        mktplcRef = {
          name = "datawrangler";
@ -4220,8 +4222,8 @@ let
        mktplcRef = {
          publisher = "shd101wyy";
          name = "markdown-preview-enhanced";
-          version = "0.8.25";
-          hash = "sha256-0yOtvHL24eJizmzXAC956Tx9eNJaWDPl/OAhmFv2KJk=";
+          version = "0.8.26";
+          hash = "sha256-OZMUHqc8l8BrpLONlOIeImnsJVa0TLN1R51ulQ5n8h4=";
        };
        meta = {
          description = "Provides a live preview of markdown using either markdown-it or pandoc";
--- a/pkgs/applications/editors/vscode/extensions/ms-python.vscode-python-envs/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/ms-python.vscode-python-envs/default.nix
@ -0,0 +1,23 @@
+{
+  lib,
+  vscode-utils,
+}:
+
+vscode-utils.buildVscodeMarketplaceExtension {
+  mktplcRef = {
+    name = "vscode-python-envs";
+    publisher = "ms-python";
+    version = "1.33.2026051501";
+    hash = "sha256-V5anlwzLt0V08HsO6TCBIUPD3VPhyohg7YnSc/1++GE=";
+  };
+
+  meta = {
+    description = "Provides a unified python environment experience";
+    downloadPage = "https://marketplace.visualstudio.com/items?itemName=ms-python.vscode-python-envs";
+    homepage = "https://github.com/microsoft/vscode-python-environments";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [
+      Zocker1999NET
+    ];
+  };
+}
--- a/pkgs/applications/editors/vscode/extensions/saoudrizwan.claude-dev/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/saoudrizwan.claude-dev/default.nix
@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
  mktplcRef = {
    name = "claude-dev";
    publisher = "saoudrizwan";
-    version = "3.82.0";
-    hash = "sha256-+CtWfRGumMTFckmU9Z8TAwrn35WiUrri1x6XL9khOnM=";
+    version = "3.83.0";
+    hash = "sha256-d9b8mXi/PI87T9J67yzI2yID7hhd6OPdM2+Na3I5Wg8=";
  };

  meta = {
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@ -128,13 +128,13 @@
    "vendorHash": "sha256-/dOiXO2aPkuZaFiwv/6AXJdIADgx8T7eOwvJfBBoqg8="
  },
  "buildkite_buildkite": {
-    "hash": "sha256-/Bg9Dym8mdcsjnTzlBs8iw6z4JpGBRvDo2kJeFJQ2MY=",
+    "hash": "sha256-R9jG7ww2iEU1qif6NeV0lpgG6Nv5rsh5h+IVhSscuKI=",
    "homepage": "https://registry.terraform.io/providers/buildkite/buildkite",
    "owner": "buildkite",
    "repo": "terraform-provider-buildkite",
-    "rev": "v1.32.0",
+    "rev": "v1.33.0",
    "spdx": "MIT",
-    "vendorHash": "sha256-CdaYWCQQ0L1LprQ5G/aXoA5GCQWCxOkkiDbMd20r7rs="
+    "vendorHash": "sha256-n6+8mufcH3rNe4yLkc+7NkV7UwNwyIVzDFStSC7iqE4="
  },
  "camptocamp_pass": {
    "hash": "sha256-GQ2g7VyK+eeBqW3LMR4U0gMYsvQnG3y+KEKKkvnmfsk=",
@ -598,13 +598,13 @@
    "vendorHash": "sha256-qzwm0R51jvElo+T8ypkHrlQy/MH8c/o+NWIS+YrQ4uw="
  },
  "hashicorp_http": {
-    "hash": "sha256-IXqKZ9RQP0kZVxc9OfaWglF8GeycSAl5DATdqc8n35g=",
+    "hash": "sha256-5zZSKmlhSuIaIiXUZhmTCFwfJ/3QxdDOg4RVooY7qcA=",
    "homepage": "https://registry.terraform.io/providers/hashicorp/http",
    "owner": "hashicorp",
    "repo": "terraform-provider-http",
-    "rev": "v3.5.0",
+    "rev": "v3.6.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-SsEWNIBkgcdTlSrB4hIvRmhMv2eJ2qQaPUmiN09A+NM="
+    "vendorHash": "sha256-hh0tOG9HY0cWTda5vjpGwCGntD7I/wCJf6B92EMKRrQ="
  },
  "hashicorp_kubernetes": {
    "hash": "sha256-P9ChE8AZa6LqDMOyjAx2COMGmzhCpIsiUJ9uXbTUPwo=",
@ -1481,13 +1481,13 @@
    "vendorHash": "sha256-rUYHapEVqRupLOPVbcAH8YP0cuXclMmYTQUkqeOwCN0="
  },
  "vultr_vultr": {
-    "hash": "sha256-IKXby/v1oNjxwgzbFTSDQYEEWbV8v8qzB4ZC9ISEf5o=",
+    "hash": "sha256-TMja+5jeYxIjY/MvJwCR/2rsbHuF7RcPReQSzkksk7Q=",
    "homepage": "https://registry.terraform.io/providers/vultr/vultr",
    "owner": "vultr",
    "repo": "terraform-provider-vultr",
-    "rev": "v2.31.1",
+    "rev": "v2.31.2",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-XQcxOSvZKXyq+k8N5n1lMM1ThbWfDXBm1Hc+Rmagu7I="
+    "vendorHash": "sha256-OASLdReS245N4y0SQ4WY7kPNPpGTHptQgXlNqPlb3nM="
  },
  "wgebis_mailgun": {
    "hash": "sha256-Li4eyqZ6huO5Q+XTcQ+HQCg8IOjhxGU9Z4Uw3TbMdAc=",
--- a/pkgs/applications/networking/cluster/terraform/default.nix
+++ b/pkgs/applications/networking/cluster/terraform/default.nix
@ -200,9 +200,9 @@ rec {
  mkTerraform = attrs: pluggable (generic attrs);

  terraform_1 = mkTerraform {
-    version = "1.15.2";
-    hash = "sha256-jwmyZJHGfi2oO8FBebPKBQdXt61w02H6zbbqSXxMhMM=";
-    vendorHash = "sha256-Gv6V5aXqTuQoG1StbD/7Ln2QrLpMsW6fbUJUkyZMkvk=";
+    version = "1.15.3";
+    hash = "sha256-TyPatVcWgRbvUb9nlZ1gQXR2k8AUUubJlAAOhC9QYIc=";
+    vendorHash = "sha256-aGkIsUxKHRgz8vxNO8RhXS0CH78Q14zSVANLrBGdhWw=";
    patches = [ ./provider-path-0_15.patch ];
    passthru = {
      inherit plugins;
--- a/pkgs/applications/video/kodi/unwrapped.nix
+++ b/pkgs/applications/video/kodi/unwrapped.nix
@ -287,7 +287,6 @@ stdenv.mkDerivation (
      tinyxml-2
      taglib
      libssh
-      gtest
      ncurses
      spdlog
      alsa-lib
@ -405,6 +404,10 @@ stdenv.mkDerivation (
      waylandpp.bin
    ];

+    nativeCheckInputs = [
+      gtest
+    ];
+
    depsBuildBuild = [
      buildPackages.stdenv.cc
    ];
@ -445,9 +448,23 @@ stdenv.mkDerivation (
      "-DWITH_TEXTUREPACKER=${lib.getExe texturePacker}"
    ];

-    # 14 tests fail but the biggest issue is that every test takes 30 seconds -
-    # I'm guessing there is a thing waiting to time out
-    doCheck = false;
+    doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
+    checkPhase = ''
+      runHook preCheck
+
+      make -j $NIX_BUILD_CORES kodi-test
+
+      ./kodi-test --gtest_filter=-${
+        lib.concatStringsSep ":" [
+          "TestCPUInfo.GetCPUFrequency"
+          "TestNetwork.PingHost"
+          "TestSystemInfo.GetOsName"
+          "TestSystemInfo.GetOsPrettyNameWithVersion"
+        ]
+      }
+
+      runHook postCheck
+    '';

    preConfigure = ''
      cmakeFlagsArray+=("-DCORE_PLATFORM_NAME=${lib.concatStringsSep " " kodi_platforms}")
--- a/pkgs/applications/window-managers/hyprwm/xdg-desktop-portal-hyprland/default.nix
+++ b/pkgs/applications/window-managers/hyprwm/xdg-desktop-portal-hyprland/default.nix
@ -20,7 +20,6 @@
  qtwayland,
  sdbus-cpp_2,
  slurp,
-  systemd,
  wayland,
  wayland-protocols,
  wayland-scanner,
@ -60,7 +59,6 @@ stdenv.mkDerivation (finalAttrs: {
    qttools
    qtwayland
    sdbus-cpp_2
-    systemd
    wayland
    wayland-protocols
    wayland-scanner
--- a/pkgs/build-support/fetchpatch/tests.nix
+++ b/pkgs/build-support/fetchpatch/tests.nix
@ -6,26 +6,26 @@ in

 {
  simple = testers.invalidateFetcherByDrvHash fetchpatch {
-    url = "https://github.com/facebook/zstd/pull/2724/commits/e1f85dbca3a0ed5ef06c8396912a0914db8dea6a.patch";
+    url = "https://github.com/facebook/zstd/commit/e1f85dbca3a0ed5ef06c8396912a0914db8dea6a.patch?full_index=1";
    sha256 =
      if isFetchpatch2 then
-        "sha256-w4yU0wt64d0WkuBQPeGf8vn5TH6qSBJvNIgka9QK+/Q="
+        "sha256-2kFh8FC96njAKH69uJp1vZSye47Suf76RfBodqosLU0="
      else
        "sha256-PuYAqnJWAE+L9bsroOnnBGJhERW8LHrGSLtIEkKU9vg=";
  };

  relative = testers.invalidateFetcherByDrvHash fetchpatch {
-    url = "https://github.com/boostorg/math/commit/7d482f6ebc356e6ec455ccb5f51a23971bf6ce5b.patch";
+    url = "https://github.com/boostorg/math/commit/7d482f6ebc356e6ec455ccb5f51a23971bf6ce5b.patch?full_index=1";
    relative = "include";
    sha256 =
      if isFetchpatch2 then
-        "sha256-1TtmuKeNIl/Yp+sfzBMR8Ue78tPIgjqGgjasa5IN52o="
+        "sha256-NS1CH+V5I29Yc0PHXdVxAn5tAHTvnGphRjhv4hZGYIo="
      else
        "sha256-KlmIbixcds6GyKYt1fx5BxDIrU7msrgDdYo9Va/KJR4=";
  };

  hunks = testers.invalidateFetcherByDrvHash fetchpatch {
-    url = "https://github.com/openssh/openssh-portable/commit/35d5917652106aede47621bb3f64044604164043.patch";
+    url = "https://github.com/openssh/openssh-portable/commit/35d5917652106aede47621bb3f64044604164043.patch?full_index=1";
    stripLen = 1;
    hunks = [
      2
@ -37,13 +37,13 @@ in
    ];
    sha256 =
      if isFetchpatch2 then
-        "sha256-SXJALY4zC4y/ZV7uVglf+XB5cpC5tS4M8QDGlFRmcFM="
+        "sha256-2eiufShDHVpiK9DaGUzfu1MlGrgE9OJAhmQcEcAViQw="
      else
        "sha256-MV7uGgA1ESMR7W6H5FjAIxKcpySdQjWB+L2zaHjd96M=";
  };

  full = testers.invalidateFetcherByDrvHash fetchpatch {
-    url = "https://github.com/boostorg/math/commit/7d482f6ebc356e6ec455ccb5f51a23971bf6ce5b.patch";
+    url = "https://github.com/boostorg/math/commit/7d482f6ebc356e6ec455ccb5f51a23971bf6ce5b.patch?full_index=1";
    relative = "test";
    stripLen = 1;
    extraPrefix = "foo/bar/";
@ -66,10 +66,10 @@ in
  };

  fileWithSpace = testers.invalidateFetcherByDrvHash fetchpatch {
-    url = "https://github.com/jfly/annoying-filenames/commit/1e86a219f5fc9c4137b409bc9c38036f3922724b.patch";
+    url = "https://github.com/jfly/annoying-filenames/commit/1e86a219f5fc9c4137b409bc9c38036f3922724b.patch?full_index=1";
    sha256 =
      if isFetchpatch2 then
-        "sha256-RB6pjigoXtzHILkGFXYd3Lz2aM9DvO0NRmLdey1N6gg="
+        "sha256-HIS/I7tLl/XYcyLuyjrIkPmLPxJPAuAguMUmhL9Ei8g="
      else
        "sha256-aptUvVojqIIIVNuHqkl+C+dZBGFfs+1MUd0FNV+4j4E=";
  };
--- a/pkgs/by-name/aa/aacgain/package.nix
+++ b/pkgs/by-name/aa/aacgain/package.nix
@ -6,6 +6,7 @@
  autoconf,
  automake,
  libtool,
+  nix-update-script,
 }:

 stdenv.mkDerivation {
@ -27,7 +28,11 @@ stdenv.mkDerivation {
    libtool
  ];

-  env.NIX_CFLAGS_COMPILE = "-Wno-error=narrowing";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=narrowing -DHAVE_GETOPT_H=1";
+
+  passthru.updateScript = nix-update-script {
+    extraArgs = [ "--version=branch" ];
+  };

  meta = {
    description = "ReplayGain for AAC files";
--- a/pkgs/by-name/ac/ac-library/fix-char-signedness-tests.patch
+++ b/pkgs/by-name/ac/ac-library/fix-char-signedness-tests.patch
@ -0,0 +1,24 @@
+diff --git i/test/unittest/type_traits_test.cpp w/test/unittest/type_traits_test.cpp
+index 164cc79..123b3a2 100644
+--- i/test/unittest/type_traits_test.cpp
+++ w/test/unittest/type_traits_test.cpp
+@@ -1,5 +1,6 @@
+ #include "atcoder/internal_type_traits"
+ 
+#include <climits>
+ #include <type_traits>
+ 
+ #include <gtest/gtest.h>
+@@ -44,7 +45,12 @@ static_assert(internal::is_unsigned_int<unsigned long long>::value, "");
+ static_assert(!internal::is_signed_int<A>::value, "");
+ static_assert(!internal::is_unsigned_int<A>::value, "");
+ 
+#if CHAR_MIN < 0
+ static_assert(is_same<unsigned char, internal::to_unsigned_t<char>>::value, "");
+#else
+static_assert(is_same<char, internal::to_unsigned_t<char>>::value, "");
+#endif
+
+ static_assert(
+     is_same<unsigned char, internal::to_unsigned_t<signed char>>::value,
+     "");
--- a/pkgs/by-name/ac/ac-library/package.nix
+++ b/pkgs/by-name/ac/ac-library/package.nix
@ -18,7 +18,12 @@ stdenv.mkDerivation (finalAttrs: {
    fetchSubmodules = true;
    hash = "sha256-1wwzN/JPS6daj1vDFuEN5z20tMdLfMvEKti0sxCVlHA=";
  };
-
+  patches = [
+    # Fix type_traits_test assumptions about char signedness on platforms
+    # where char is unsigned by default (e.g. aarch64-linux).
+    # Reported upstream: https://github.com/atcoder/ac-library/issues/191
+    ./fix-char-signedness-tests.patch
+  ];
  outputs = [
    "dev"
    "out"
@ -60,7 +65,6 @@ stdenv.mkDerivation (finalAttrs: {
  env = {
    NIX_CFLAGS_COMPILE = toString [
      "-Wno-error=array-bounds"
-      "-Wno-character-conversion"
    ];
  };

--- a/pkgs/by-name/ac/acgtk/package.nix
+++ b/pkgs/by-name/ac/acgtk/package.nix
@ -2,9 +2,11 @@
  lib,
  stdenv,
  fetchFromGitLab,
-  fetchpatch,
  ocamlPackages,
+  darwin,
  dune,
+  nix-update-script,
+  writableTmpDirAsHomeHook,
 }:

 stdenv.mkDerivation {
@ -22,12 +24,16 @@ stdenv.mkDerivation {

  strictDeps = true;

-  nativeBuildInputs = with ocamlPackages; [
-    dune
-    findlib
-    menhir
-    ocaml
-  ];
+  nativeBuildInputs =
+    with ocamlPackages;
+    [
+      dune
+      findlib
+      menhir
+      ocaml
+      writableTmpDirAsHomeHook
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [ darwin.sigtool ];

  buildInputs = with ocamlPackages; [
    ansiterminal
@ -54,6 +60,13 @@ stdenv.mkDerivation {
    dune install -p acgtk --prefix $out --libdir $OCAMLFIND_DESTDIR
  '';

+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--version-regex"
+      "^release-(\\d+\\.\\d+\\.\\d+)$"
+    ];
+  };
+
  meta = {
    homepage = "https://acg.loria.fr/";
    description = "Toolkit for developing ACG signatures and lexicon";
--- a/pkgs/by-name/ag/age-plugin-ledger/package.nix
+++ b/pkgs/by-name/ag/age-plugin-ledger/package.nix
@ -1,5 +1,6 @@
 {
  lib,
+  stdenv,
  rustPlatform,
  fetchFromGitHub,
  pkg-config,
@ -30,6 +31,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
    openssl
  ];

+  # rage (used in tests) panics on locale detection in the Nix sandbox without
+  # a valid LANG set.
+  preCheck = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    export LANG=en_US.UTF-8
+  '';
+
  nativeCheckInputs = [
    rage
  ];
--- a/pkgs/by-name/au/autobrr/package.nix
+++ b/pkgs/by-name/au/autobrr/package.nix
@ -16,12 +16,12 @@

 let
  pname = "autobrr";
-  version = "1.77.1";
+  version = "1.78.0";
  src = fetchFromGitHub {
    owner = "autobrr";
    repo = "autobrr";
    tag = "v${version}";
-    hash = "sha256-XNTQmW8JUxe8bffe1eGvxoRQ3rKdoH0QQKDn/wY6L3o=";
+    hash = "sha256-iLMeKFDBzSYrCjwvafemSDq8cN3DTzT6KpJzmzgVbYY=";
  };

  autobrr-web = stdenvNoCC.mkDerivation {
--- a/pkgs/by-name/bl/blazingjj/package.nix
+++ b/pkgs/by-name/bl/blazingjj/package.nix
@ -0,0 +1,50 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  makeBinaryWrapper,
+  jujutsu,
+  versionCheckHook,
+}:
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "blazingjj";
+  version = "0.8.0";
+
+  src = fetchFromGitHub {
+    owner = "blazingjj";
+    repo = "blazingjj";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-vefD93gzT6WEplpnYiENtzXLSeXBo+9K3/RYpSBafDs=";
+  };
+
+  cargoHash = "sha256-E/xddxdvCDWH1xPn/CPXFyJIHg1Dy6EG3VZMZouWHQY=";
+
+  nativeBuildInputs = [ makeBinaryWrapper ];
+
+  nativeCheckInputs = [
+    jujutsu
+  ];
+
+  postInstall = ''
+    wrapProgram $out/bin/blazingjj \
+      --prefix PATH : ${lib.makeBinPath [ jujutsu ]}
+  '';
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  doInstallCheck = true;
+
+  __structuredAttrs = true;
+
+  meta = {
+    description = "TUI for Jujutsu/jj";
+    homepage = "https://github.com/blazingjj/blazingjj";
+    changelog = "https://github.com/blazingjj/blazingjj/releases/tag/v${finalAttrs.version}";
+    mainProgram = "blazingjj";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [
+      peret
+    ];
+  };
+})
--- a/pkgs/by-name/cd/cdesktopenv/package.nix
+++ b/pkgs/by-name/cd/cdesktopenv/package.nix
@ -110,6 +110,9 @@ stdenv.mkDerivation (finalAttrs: {

  enableParallelBuilding = true;

+  # https://sourceforge.net/p/cdesktopenv/tickets/193/
+  hardeningDisable = [ "fortify" ];
+
  # Can probably remove after next release
  # https://sourceforge.net/p/cdesktopenv/code/ci/f0154141b1f1501490bac8e0235214bf8f00f715/
  env.NIX_CFLAGS_COMPILE = "-std=gnu17";
--- a/pkgs/by-name/ch/chrony/package.nix
+++ b/pkgs/by-name/ch/chrony/package.nix
@ -77,6 +77,7 @@ stdenv.mkDerivation (finalAttrs: {
        darwin
        illumos
      ];
+    broken = stdenv.isDarwin;
    maintainers = with lib.maintainers; [
      thoughtpolice
      vifino
--- a/pkgs/by-name/cl/cliamp/package.nix
+++ b/pkgs/by-name/cl/cliamp/package.nix
@ -16,13 +16,13 @@

 buildGoModule (finalAttrs: {
  pname = "cliamp";
-  version = "1.39.1";
+  version = "1.50.0";

  src = fetchFromGitHub {
    owner = "bjarneo";
    repo = "cliamp";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-xGOTX6KQVtVuGPqTJGOXX80OaMlaK94qr67YecrRUEo=";
+    hash = "sha256-wXOIJ6oJfphEtBs84ova5tErcmKO3bHbDmRTiTX5zUE=";
  };

  vendorHash = "sha256-A2Ygc1a9e2flZzaNAEXvr8Ui1cE89TxBfUNALmDzIo0=";
--- a/pkgs/by-name/co/comma/package.nix
+++ b/pkgs/by-name/co/comma/package.nix
@ -14,16 +14,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "comma";
-  version = "2.3.3";
+  version = "2.4.1";

  src = fetchFromGitHub {
    owner = "nix-community";
    repo = "comma";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-dNek1a8Yt3icWc8ZpVe1NGuG+eSoTDOmAAJbkYmMocU=";
+    hash = "sha256-XZB0zx4wyNzy0LggAmh2gT2aEWAqVI9NljRoOkeK0c8=";
  };

-  cargoHash = "sha256-SJBfWjOVrv2WMIh/cQbaFK8jn3oSbmJpdJM7pkJppDs=";
+  cargoHash = "sha256-lY5HwWZm9X0xusLcC6MciAgSWEskNElrjhe9fexR6g8=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/by-name/cp/cpp-utilities/package.nix
+++ b/pkgs/by-name/cp/cpp-utilities/package.nix
@ -9,13 +9,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "cpp-utilities";
-  version = "5.34.0";
+  version = "5.34.1";

  src = fetchFromGitHub {
    owner = "Martchus";
    repo = "cpp-utilities";
    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-lwrGPWRzCmOP4xeMH4ruLJfVaYXKc//WRFBSmKQ2iw0=";
+    sha256 = "sha256-QzmjE0a89fdc6ueuZbg5JtoP74HRaE6VQ5N4hVoXhyI=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/by-name/di/dix/package.nix
+++ b/pkgs/by-name/di/dix/package.nix
@ -9,6 +9,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
  pname = "dix";
  version = "1.4.2";

+  __structuredAttrs = true;
+
  src = fetchFromGitHub {
    owner = "faukah";
    repo = "dix";
--- a/pkgs/by-name/ec/ecwolf/package.nix
+++ b/pkgs/by-name/ec/ecwolf/package.nix
@ -1,7 +1,7 @@
 {
  stdenv,
  lib,
-  fetchFromBitbucket,
+  fetchFromGitHub,
  cmake,
  pkg-config,
  makeWrapper,
@ -15,16 +15,15 @@
  writers,
  python3Packages,
  nix-update,
-  fetchpatch,
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "ecwolf";
  version = "1.4.2";

-  src = fetchFromBitbucket {
-    owner = "ecwolf";
-    repo = "ecwolf";
+  src = fetchFromGitHub {
+    owner = "ECWolfEngine";
+    repo = "ECWolf";
    tag = finalAttrs.version;
    hash = "sha256-T5K6B2fWMKMLB/662p/YLEv0Od9n0vUakznyoOnr0kI=";
  };
@ -98,12 +97,13 @@ stdenv.mkDerivation (finalAttrs: {
    ];

  meta = {
-    description = "Enhanched SDL-based port of Wolfenstein 3D for various platforms";
+    description = "Advanced source port for Wolfenstein 3D, Spear of Destiny, and Super 3D Noah's Ark";
    mainProgram = "ecwolf";
    homepage = "https://maniacsvault.net/ecwolf/";
    license = lib.licenses.gpl2Plus;
    maintainers = with lib.maintainers; [
      jayman2000
+      keenanweaver
    ];
    platforms = lib.platforms.all;
  };
--- a/pkgs/by-name/ex/explain/package.nix
+++ b/pkgs/by-name/ex/explain/package.nix
@ -4,6 +4,7 @@
  fetchurl,
  fetchpatch,
  libtool,
+  autoreconfHook,
  bison,
  groff,
  ghostscript,
@ -24,7 +25,7 @@ stdenv.mkDerivation rec {
  patches =
    let
      debian-src = "https://sources.debian.org/data/main";
-      debian-ver = "${version}.D001-12";
+      debian-ver = "${version}.D001-17";
      debian-patch =
        fname: hash:
        fetchpatch {
@ -35,14 +36,23 @@ stdenv.mkDerivation rec {
    in
    [
      (debian-patch "sanitize-bison.patch" "sha256-gU6JG32j2yIOwehZTUSvIr4TSDdlg+p1U3bhfZHMEDY=")
+      (debian-patch "01_termio.patch" "sha256-vLyhn1gqm6v+5e8jOiNyCUgEEY7dNSWKuxkUSoCZLxE=")
      (debian-patch "03_fsflags-4.5.patch" "sha256-ML7Qvf85vEBp+iwm6PSosMAn/frYdEOSHRToEggmR8M=")
+      (debian-patch "06_sysctl.patch" "sha256-GY2alw3um+j2fxA7gp6029Baej25PFQFgGgNbplP/P0=")
      (debian-patch "linux5.11.patch" "sha256-N7WwnTfwOxBfIiKntcFOqHTH9r2gd7NMEzic7szzR+Y=")
      (debian-patch "termiox-no-more-exists-since-kernel-5.12.patch" "sha256-cocgEYKoDMDnGk9VNQDtgoVxMGnnNpdae0hzgUlacOw=")
+      (debian-patch "missing-prototypes.patch" "sha256-RbVLVqAfjRN4FDt116WlIw2rKpYuOUxDmA+I7SziAJk=")
      (debian-patch "gcc-10.patch" "sha256-YNcYGyOOqPUuwpUpXGcR7zsWbepVg8SAqcVKlxENSQk=")
+      (debian-patch "gcc-14.patch" "sha256-hoDEG6Yk9j8WOHkNYAipPOgPTux308YCBEbjcykmEtA=")
    ];

+  postPatch = ''
+    ln -s etc/configure.ac configure.ac
+  '';
+
  nativeBuildInputs = [
    libtool
+    autoreconfHook
    bison
    groff
    ghostscript
@ -69,7 +79,5 @@ stdenv.mkDerivation rec {
    license = lib.licenses.lgpl3Plus;
    maintainers = with lib.maintainers; [ McSinyx ];
    platforms = lib.platforms.unix;
-    # never built on aarch64-linux since first introduction in nixpkgs
-    broken = stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64;
  };
 }
--- a/pkgs/by-name/fb/fbpanel/package.nix
+++ b/pkgs/by-name/fb/fbpanel/package.nix
@ -1,67 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  pkg-config,
-  libx11,
-  libxmu,
-  libxpm,
-  gtk2,
-  libpng,
-  libjpeg,
-  libtiff,
-  librsvg,
-  gdk-pixbuf,
-  gdk-pixbuf-xlib,
-  pypy2,
-}:
-
-stdenv.mkDerivation {
-  pname = "fbpanel";
-  version = "7.0";
-  src = fetchFromGitHub {
-    owner = "aanatoly";
-    repo = "fbpanel";
-    rev = "478754b687e2b48b111507ea22e8e2a001be5199";
-    hash = "sha256-+KcVcrh1aV6kjLGyiDnRHXSzJfelXWrhJS0DitG4yPA=";
-  };
-  nativeBuildInputs = [
-    pkg-config
-    pypy2
-  ];
-  buildInputs = [
-    libx11
-    libxmu
-    libxpm
-    gtk2
-    libpng
-    libjpeg
-    libtiff
-    librsvg
-    gdk-pixbuf
-    gdk-pixbuf-xlib.dev
-  ];
-
-  preConfigure = ''
-    sed -re '1i#!${pypy2}/bin/pypy' -i configure .config/*.py
-    sed -re 's/\<out\>/outputredirect/g' -i .config/rules.mk
-    sed -i 's/struct\ \_plugin_instance \*stam\;//' panel/plugin.h
-  '';
-
-  makeFlags = [ "V=1" ];
-
-  env.NIX_CFLAGS_COMPILE = toString [
-    "-Wno-error"
-    "-Wno-error=incompatible-pointer-types" # not implied by -Wno-error
-    "-I${gdk-pixbuf-xlib.dev}/include/gdk-pixbuf-2.0"
-  ];
-
-  meta = {
-    description = "Stand-alone panel";
-    maintainers = with lib.maintainers; [ raskin ];
-    platforms = lib.platforms.linux;
-    license = lib.licenses.mit;
-    mainProgram = "fbpanel";
-  };
-
-}
--- a/pkgs/by-name/fl/flood/package.nix
+++ b/pkgs/by-name/fl/flood/package.nix
@ -10,13 +10,13 @@
 }:
 buildNpmPackage (finalAttrs: {
  pname = "flood";
-  version = "4.13.10";
+  version = "4.14.2";

  src = fetchFromGitHub {
    owner = "jesec";
    repo = "flood";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-b2Va/t1yiIo1cmxSXfFd74z7pc3NjRCktioqEKxzUJI=";
+    hash = "sha256-gSjkpAGkvgRRh8WDpL/F7fS8KDxHRJUuWVqHGcFEGAc=";
  };

  nativeBuildInputs = [ pnpm_9 ];
@ -31,7 +31,7 @@ buildNpmPackage (finalAttrs: {
      ;
    pnpm = pnpm_9;
    fetcherVersion = 3;
-    hash = "sha256-NQ6SJ0etny+HE4ND/2s28Sbfi7vr+YnjCBfVB0OKWqM=";
+    hash = "sha256-Los6faQJ4it0fVqtRvPvYmyANK4qBcwHxmZBacR7Q6E=";
  };

  passthru = {
--- a/pkgs/by-name/fr/frankenphp/package.nix
+++ b/pkgs/by-name/fr/frankenphp/package.nix
@ -30,13 +30,13 @@ let
 in
 buildGoModule (finalAttrs: {
  pname = "frankenphp";
-  version = "1.12.2";
+  version = "1.12.3";

  src = fetchFromGitHub {
    owner = "php";
    repo = "frankenphp";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-wXBqUxGUvgfX2XmygBMZ6UEDxy8pyjcl+yob9egU8qw=";
+    hash = "sha256-TYpbHwlFZ9S4uqdhZoU0YqhOrLHrKaMVlJLEi+heEgE=";
  };

  sourceRoot = "${finalAttrs.src.name}/caddy";
@ -44,7 +44,7 @@ buildGoModule (finalAttrs: {
  # frankenphp requires C code that would be removed with `go mod tidy`
  # https://github.com/golang/go/issues/26366
  proxyVendor = true;
-  vendorHash = "sha256-nfDKg1erdErCVankdoqr1u5c2+lkgXU2tEgF3PDyTmU=";
+  vendorHash = "sha256-xmaMQIhImi9E7H/zA8DqrGG4oK5KIQWUTn+c1eas0Ho=";

  buildInputs = [
    phpUnwrapped
--- a/pkgs/by-name/fr/fresh-editor/package.nix
+++ b/pkgs/by-name/fr/fresh-editor/package.nix
@ -12,16 +12,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "fresh";
-  version = "0.3.5";
+  version = "0.3.6";

  src = fetchFromGitHub {
    owner = "sinelaw";
    repo = "fresh";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-L2UnVhNiZtawIYP8ni/TiAATt5gOAYUC0RgTe3zi5uk=";
+    hash = "sha256-seqYT2yRhRwQwsGjS6IMOwNtJAqhe2dL+uzr8qP7src=";
  };

-  cargoHash = "sha256-4SmvNOJIXV1u+BwOZgxEREtGdOpjACAf7AzYAzPWDVQ=";
+  cargoHash = "sha256-hJtLn4pW581Nazj+f4csHt/PQaxgOTfewmSZbyZKnNw=";

  nativeBuildInputs = [
    gzip
--- a/pkgs/by-name/ga/game-devices-udev-rules/package.nix
+++ b/pkgs/by-name/ga/game-devices-udev-rules/package.nix
@ -8,13 +8,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "game-devices-udev-rules";
-  version = "0.25";
+  version = "1.0";

  src = fetchFromCodeberg {
    owner = "fabiscafe";
    repo = "game-devices-udev";
    tag = finalAttrs.version;
-    hash = "sha256-CLQFdPr489OKZRj1v8EZypM1KOXgAOAOF0VQpeud4uo=";
+    hash = "sha256-J4LfRifTqBM+B/dryLHERaVa1UUWEbfjEUj+exCFVsU=";
  };

  nativeBuildInputs = [
@ -24,8 +24,8 @@ stdenv.mkDerivation (finalAttrs: {
  doInstallCheck = true;

  postInstall = ''
-    install -Dm444 -t "$out/lib/udev/rules.d" *.rules
-    substituteInPlace $out/lib/udev/rules.d/71-powera-controllers.rules \
+    install -Dm444 -t "$out/lib/udev/rules.d" src/*.rules
+    substituteInPlace $out/lib/udev/rules.d/powera-gdu.rules \
      --replace-fail "/bin/sh" "${bash}/bin/bash"
  '';

--- a/pkgs/by-name/gi/git-town/package.nix
+++ b/pkgs/by-name/gi/git-town/package.nix
@ -56,13 +56,14 @@ buildGoModule (finalAttrs: {
    let
      # Disable tests requiring local operations
      skippedTests = [
-        "TestGodog"
        "TestMockingRunner/MockCommand"
        "TestMockingRunner/MockCommitMessage"
        "TestMockingRunner/QueryWith"
        "TestTestCommands/CreateChildFeatureBranch"
        "TestTestCommands/CreateChildBranch"
        "TestTestCommands/CreateLocalBranchUsingGitTown"
+        "TestFrontendRunner_RetryOnIndexLock" # Timing issues.
+
      ];
    in
    [ "-skip=^${builtins.concatStringsSep "$|^" skippedTests}$" ];
--- a/pkgs/by-name/he/heroic-unwrapped/package.nix
+++ b/pkgs/by-name/he/heroic-unwrapped/package.nix
@ -29,13 +29,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "heroic-unwrapped";
-  version = "2.21.0";
+  version = "2.22.0";

  src = fetchFromGitHub {
    owner = "Heroic-Games-Launcher";
    repo = "HeroicGamesLauncher";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-rgLmm9krjPYjSn/wGAYbnFw7kqvuu9IBipb4ibOClOw=";
+    hash = "sha256-RDJDeL5exEzF2BhEWoiXWsTpV5hytrB6RDoXV0mTWTw=";
  };

  pnpmDeps = fetchPnpmDeps {
@ -47,7 +47,7 @@ stdenv.mkDerivation (finalAttrs: {
      ;
    inherit pnpm;
    fetcherVersion = 3;
-    hash = "sha256-O3QQsk8pvF9U5QvuMebCsy/iYz1oZIMkPeMtWohqW3w=";
+    hash = "sha256-lPHL6pA39hvEtq5WkcAXfcY3a0VPseQL/nI+oEjIZeE=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/hu/husky/package.nix
+++ b/pkgs/by-name/hu/husky/package.nix
@ -2,27 +2,48 @@
  lib,
  buildNpmPackage,
  fetchFromGitHub,
+
+  nix-update-script,
 }:

-buildNpmPackage rec {
+buildNpmPackage (finalAttrs: {
  pname = "husky";
-  version = "8.0.3";
+  version = "9.1.7";

  src = fetchFromGitHub {
    owner = "typicode";
    repo = "husky";
-    rev = "v${version}";
-    hash = "sha256-KoF2+vikgFyCGjfKeaqkC720UVMuvCIn9ApDPKbudsA=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-rjj6kG0f9dbwc3MOS3sXBp1tNOfbOgWAQzm7MbImMk8=";
  };

-  npmDepsHash = "sha256-u1dndTKvInobva+71yI2vPiwrW9vqzAJ2sDAqT9YJsg=";
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+    install -Dm755 bin.js husky -t $out/lib/node_modules/husky
+    install -Dm644 index.js -t $out/lib/node_modules/husky
+    ln -s ../lib/node_modules/husky/bin.js $out/bin/husky
+
+    runHook postInstall
+  '';
+
+  # The project is dependency free
+  dontNpmBuild = true;
+  forceEmptyCache = true;
+  npmDepsHash = "sha256-68/85gX0/9wZNOTpiy3AHqTW6FU9RoaeCKf8IQPOqys=";
+
+  passthru.updateScript = nix-update-script { };

  meta = {
    description = "Git hooks made easy";
    mainProgram = "husky";
    homepage = "https://github.com/typicode/husky";
-    changelog = "https://github.com/typicode/husky/releases/tag/v${version}";
+    changelog = "https://github.com/typicode/husky/releases/tag/${finalAttrs.src.tag}";
    license = lib.licenses.mit;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [
+      iamanaws
+      mrdev023
+    ];
  };
-}
+})
--- a/pkgs/by-name/im/imapgoose/package.nix
+++ b/pkgs/by-name/im/imapgoose/package.nix
@ -27,6 +27,8 @@ buildGoModule rec {
  postInstall = ''
    installManPage imapgoose.1
    installManPage imapgoose.conf.5
+
+    installShellCompletion --zsh contrib/_imapgoose
  '';

  meta = {
--- a/pkgs/by-name/in/inputplumber/package.nix
+++ b/pkgs/by-name/in/inputplumber/package.nix
@ -10,16 +10,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "inputplumber";
-  version = "0.77.0";
+  version = "0.77.1";

  src = fetchFromGitHub {
    owner = "ShadowBlip";
    repo = "InputPlumber";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-sSLazAjwkTu4Vns8Vs4Gx47WG8fYQYJX6zhk0p139q0=";
+    hash = "sha256-S3fyhgCNJFx9w64E/BfNh8i4nIBEFwoVLTcTFb8Escw=";
  };

-  cargoHash = "sha256-OEpv09DipaGtmlUWmvl4+Hm3DyBvSRkZaGePDy14/OU=";
+  cargoHash = "sha256-mnWjVM5nWkYMeRRKLsak0SZUUsVg9odjy7KFa/sldC8=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/by-name/in/intelli-shell/package.nix
+++ b/pkgs/by-name/in/intelli-shell/package.nix
@ -11,16 +11,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "intelli-shell";
-  version = "3.4.0";
+  version = "3.4.1";

  src = fetchFromGitHub {
    owner = "lasantosr";
    repo = "intelli-shell";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-TrT2gMc23m4xZ/fxxHqEkGpq3VBeLfkPXC9H1sSSOaQ=";
+    hash = "sha256-s5gbpobCxTtrlEwe1AAidoM8p/1yU/mnZ7JKUu4A0Qk=";
  };

-  cargoHash = "sha256-usALz3Wj3GyYjHjmEwFvjyDizXKQ66fkZ8Tb7GgT9BA=";
+  cargoHash = "sha256-D17BqWiUECM9DeOu/I3xN+aopmw8lZBbUyAIygse0kA=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/by-name/io/ioq3-scion/package.nix
+++ b/pkgs/by-name/io/ioq3-scion/package.nix
@ -18,8 +18,11 @@ ioquake3.overrideAttrs (old: {
    rev = "a21c257b9ad1d897f6c31883511c3f422317aa0a";
    hash = "sha256-CBy3Av/mkFojXr0tAXPRWKwLeQJPebazXQ4wzKEmx0I=";
  };
+  # gcc15
+  env.NIX_CFLAGS_COMPILE = "-std=gnu17";
  meta = {
    description = "ioquake3 with support for path aware networking";
    maintainers = with lib.maintainers; [ matthewcroughan ];
+    platforms = lib.platforms.linux;
  };
 })
--- a/pkgs/by-name/iv/ivpn-service/package.nix
+++ b/pkgs/by-name/iv/ivpn-service/package.nix
@ -17,7 +17,7 @@
 }:
 buildGoModule (finalAttrs: {
  pname = "ivpn-service";
-  version = "3.15.0";
+  version = "3.15.6";

  buildInputs = [ wirelesstools ];
  nativeBuildInputs = [ makeWrapper ];
@ -26,14 +26,15 @@ buildGoModule (finalAttrs: {
    owner = "ivpn";
    repo = "desktop-app";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Y+oW/2WDkH/YydR+xSzEHPdCNKTmmsV4yEsju+OmDYE=";
+    hash = "sha256-C24klcr10i0lki74eNfJ4bappdIttp3S4FGg1wkAGcY=";
  };

  strictDeps = true;
  __structuredAttrs = true;

  modRoot = "daemon";
-  vendorHash = "sha256-DVKSCcEeE7vI8aOYuEwk22n0wtF7MMDOyAgYoXYadwI=";
+  subPackages = [ "." ];
+  vendorHash = "sha256-YDvZVmResoieSBIp/yuZDvI9GSz3M6Bi5KksHOljuR0=";

  proxyVendor = true; # .c file

--- a/pkgs/by-name/iv/ivpn-ui/package.nix
+++ b/pkgs/by-name/iv/ivpn-ui/package.nix
@ -11,18 +11,18 @@
 }:
 buildNpmPackage (finalAttrs: {
  pname = "ivpn-ui";
-  version = "3.15.0";
+  version = "3.15.6";

  src = fetchFromGitHub {
    owner = "ivpn";
    repo = "desktop-app";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Y+oW/2WDkH/YydR+xSzEHPdCNKTmmsV4yEsju+OmDYE=";
+    hash = "sha256-C24klcr10i0lki74eNfJ4bappdIttp3S4FGg1wkAGcY=";
  };

  sourceRoot = "source/ui";

-  npmDepsHash = "sha256-OOBBUDJwTP2T/KqzJPRV+A9ncRmb14KBoAXqa0T6c58=";
+  npmDepsHash = "sha256-S/fB3MxEDLVEZ762EkBkyemYW2rgBGtCH5y/6p6nqgE=";

  nativeBuildInputs = [
    copyDesktopItems
--- a/pkgs/by-name/iv/ivpn/package.nix
+++ b/pkgs/by-name/iv/ivpn/package.nix
@ -7,7 +7,7 @@
 }:
 buildGoModule (finalAttrs: {
  pname = "ivpn";
-  version = "3.15.0";
+  version = "3.15.6";

  buildInputs = [ wirelesstools ];

@ -15,13 +15,13 @@ buildGoModule (finalAttrs: {
    owner = "ivpn";
    repo = "desktop-app";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Y+oW/2WDkH/YydR+xSzEHPdCNKTmmsV4yEsju+OmDYE=";
+    hash = "sha256-C24klcr10i0lki74eNfJ4bappdIttp3S4FGg1wkAGcY=";
  };

  __structuredAttrs = true;

  modRoot = "cli";
-  vendorHash = "sha256-xZ1tMiv06fE2wtpDagKjHiVTPYWpj32hM6n/v9ZcgrE=";
+  vendorHash = "sha256-Qm3OZq3W8GyfkYP674Jzse7wDPWgXfc0bi8ZpYl4T1I=";

  proxyVendor = true; # .c file

--- a/pkgs/by-name/ja/jamin/fix-crash.patch
+++ b/pkgs/by-name/ja/jamin/fix-crash.patch
@ -0,0 +1,21 @@
+From a6498278654792d46ebef4f918b8a1c7b663a2d9 Mon Sep 17 00:00:00 2001
+From: Herwig Hochleitner <herwig@bendlas.net>
+Date: Mon, 14 Apr 2025 15:11:37 +0200
+Subject: [PATCH] fix use-after-free during init
+
+---
+ src/state.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/src/state.c b/src/state.c
+index 6ee4099..48e0b30 100644
+--- a/src/state.c
+++ b/src/state.c
+@@ -234,6 +234,7 @@ void s_clear_history()
+     }
+     g_list_free(history);
+     history = NULL;
+    undo_pos = NULL;
+     s_history_add("Initial state");
+     undo_pos = history->next;
+     //s_restore_state((s_state *)history->data);
--- a/pkgs/by-name/ja/jamin/package.nix
+++ b/pkgs/by-name/ja/jamin/package.nix
@ -1,45 +1,73 @@
 {
  lib,
  stdenv,
-  fetchurl,
+  fetchgit,
+  fetchpatch,
  fftwFloat,
-  gtk2,
+  gtk3,
  ladspaPlugins,
  libjack2,
  liblo,
  libxml2,
+  autoconf,
+  automake,
+  intltool,
+  libtool,
  makeWrapper,
  pkg-config,
  perlPackages,
 }:

 stdenv.mkDerivation (finalAttrs: {
-  version = "0.95.0";
  pname = "jamin";
+  version = "0.98.9-unstable-2015-01-14";

-  src = fetchurl {
-    url = "mirror://sourceforge/jamin/jamin-${finalAttrs.version}.tar.gz";
-    hash = "sha256-di/uiGgvJ4iORt+wE6mrXnmFM7m2dkP/HXdgUBk5uzw=";
+  src = fetchgit {
+    url = "https://git.code.sf.net/p/jamin/code";
+    rev = "199091a6e3709e2890eaf2c8b4e57c6749776cdc";
+    hash = "sha256-wiIBymvpPxY+z/nZi+dH0hXEuhO5FYQjon6VfJaTwC0=";
  };

-  nativeBuildInputs = [
-    pkg-config
-    makeWrapper
+  patches = [
+    (fetchpatch {
+      url = "https://sources.debian.org/data/main/j/jamin/0.98.9~git20170111~199091~repack1-3/debian/patches/gcc15.patch";
+      hash = "sha256-dH0NI12Xfw9Rl7Iwm4QzDvXIHT7XzBC8Ly0lQOpDD84=";
+    })
+    # https://github.com/bendlas/jamin/commit/a6498278654792d46ebef4f918b8a1c7b663a2d9.patch
+    ./fix-crash.patch
  ];

-  buildInputs = [
-    fftwFloat
-    gtk2
-    ladspaPlugins
-    libjack2
-    liblo
-    libxml2
+  postPatch = ''
+    patchShebangs --build controller/xml2c.pl
+    # for whatever reason the default config file is gzipped
+    mv examples/default.jam{,.gz}
+    gunzip examples/default.jam.gz
+  '';
+
+  preConfigure = "./autogen.sh";
+
+  nativeBuildInputs = [
+    autoconf
+    automake
+    intltool
+    libtool
+    pkg-config
+    makeWrapper
  ]
  ++ (with perlPackages; [
    perl
    XMLParser
  ]);

+  buildInputs = [
+    fftwFloat
+    gtk3
+    ladspaPlugins
+    libjack2
+    liblo
+    libxml2
+  ];
+
  # Workaround build failure on -fno-common toolchains like upstream
  # gcc-10. Otherwise build fails as:
  #     ld: jamin-preferences.o:/build/jamin-0.95.0/src/hdeq.h:64: multiple definition of
--- a/pkgs/by-name/ji/jitterentropy-rngd/package.nix
+++ b/pkgs/by-name/ji/jitterentropy-rngd/package.nix
@ -2,6 +2,7 @@
  lib,
  stdenv,
  fetchFromGitHub,
+  fetchpatch,
 }:

 stdenv.mkDerivation (finalAttrs: {
@ -11,10 +12,18 @@ stdenv.mkDerivation (finalAttrs: {
  src = fetchFromGitHub {
    owner = "smuellerDD";
    repo = "jitterentropy-rngd";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
    hash = "sha256-iXpeN0PAPk8mcaNXwj6TlyK57NSFNOVs/XmEmUG1gIg=";
  };

+  patches = [
+    # Allow the systemd service to mlock the daemon's entropy buffer.
+    (fetchpatch {
+      url = "https://github.com/smuellerDD/jitterentropy-rngd/compare/v1.3.1...61ad2e7c83b95402536b90b52eabe20ce60cfbd7.patch";
+      hash = "sha256-Twg59vrqJGF0bH4pkIewbReCjabOFuqq+MtCnwjO9lw=";
+    })
+  ];
+
  enableParallelBuilding = true;

  installPhase = ''
@ -36,7 +45,7 @@ stdenv.mkDerivation (finalAttrs: {
  meta = {
    description = "Random number generator, which injects entropy to the kernel";
    homepage = "https://github.com/smuellerDD/jitterentropy-rngd";
-    changelog = "https://github.com/smuellerDD/jitterentropy-rngd/releases/tag/v${finalAttrs.version}";
+    changelog = "https://github.com/smuellerDD/jitterentropy-rngd/releases/tag/${finalAttrs.src.tag}";
    license = [
      lib.licenses.gpl2Only
      lib.licenses.bsd3
--- a/pkgs/by-name/jw/jwt-hack/package.nix
+++ b/pkgs/by-name/jw/jwt-hack/package.nix
@ -33,7 +33,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    openssl
  ];

-  OPENSSL_NO_VENDOR = 1;
+  env.OPENSSL_NO_VENDOR = 1;

  meta = {
    description = "JSON Web Token Hack Toolkit";
--- a/pkgs/by-name/ko/kopia/package.nix
+++ b/pkgs/by-name/ko/kopia/package.nix
@ -11,18 +11,18 @@

 buildGoModule (finalAttrs: {
  pname = "kopia";
-  version = "0.22.3";
+  version = "0.23.0";

  src = fetchFromGitHub {
    owner = "kopia";
    repo = "kopia";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-5oNam99Mij78snSO6jiGPYzeD68sXEBKM2dGQtTUrww=";
+    hash = "sha256-9xvgm+A8h2pAX3oHtiFSa2xNab5BDkEBEtXQZz3Fd5A=";
  };

  __structuredAttrs = true;

-  vendorHash = "sha256-szlCiZOLU0KVWb2YX3Wmicrumn+fNm2AWdPxaJZZT90=";
+  vendorHash = "sha256-VMfFXGBIUtRa4JxhOn7YBfdLNmpmGrkBVKiIDn5vKTc=";

  subPackages = [ "." ];

--- a/pkgs/by-name/ld/ldmtool/package.nix
+++ b/pkgs/by-name/ld/ldmtool/package.nix
@ -14,36 +14,24 @@
  lvm2,
  libxslt,
  docbook_xsl,
-  fetchpatch,
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "ldmtool";
-  version = "0.2.4";
+  version = "0.2.5-unstable-2025-02-06";

  src = fetchFromGitHub {
    owner = "mdbooth";
    repo = "libldm";
-    rev = "libldm-${finalAttrs.version}";
-    sha256 = "1fy5wbmk8kwl86lzswq0d1z2j5y023qzfm2ppm8knzv9c47kniqk";
+    rev = "1eafb653ac6347a9d4281848c8295f9daffb1613";
+    hash = "sha256-Vd+3FnM+U5y2FxuslEsEzgZEx+5AQWuTjUVRnoFhm3I=";
  };

-  patches = [
-    # Remove usage of deprecrated G_PARAM_PRIVATE
-    (fetchpatch {
-      url = "https://github.com/mdbooth/libldm/commit/ee1b37a034038f09d61b121cc8b3651024acc46f.patch";
-      sha256 = "02y34kbcpcpffvy1n9yqngvdldmxmvdkha1v2xjqvrnclanpigcp";
-    })
-  ];
-
  preConfigure = ''
    sed -i docs/reference/ldmtool/Makefile.am \
      -e 's|-nonet http://docbook.sourceforge.net/release/xsl/current/manpages/docbook.xsl|--nonet ${docbook_xsl}/xml/xsl/docbook/manpages/docbook.xsl|g'
  '';

-  # glib-2.62 deprecations
-  env.NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
-
  configureScript = "sh autogen.sh";

  nativeBuildInputs = [
--- a/pkgs/by-name/li/lib2geom/package.nix
+++ b/pkgs/by-name/li/lib2geom/package.nix
@ -46,11 +46,16 @@ stdenv.mkDerivation (finalAttrs: {
    double-conversion
  ];

-  nativeCheckInputs = [
+  checkInputs = [
    gtest
+  ];
+
+  nativeCheckInputs = [
    ctestCheckHook
  ];

+  strictDeps = true;
+
  cmakeFlags = [
    "-D2GEOM_BUILD_SHARED=ON"
    # For cross compilation.
--- a/pkgs/by-name/li/libgestures/include-fix.patch
+++ b/pkgs/by-name/li/libgestures/include-fix.patch
@ -1,12 +0,0 @@
-diff -ur a/include/gestures/include/finger_metrics.h b/include/gestures/include/finger_metrics.h
--- a/include/gestures/include/finger_metrics.h    1970-01-01 09:00:01.000000000 +0900
-+++ b/include/gestures/include/finger_metrics.h    2018-12-01 16:58:51.590718511 +0900
-@@ -5,6 +5,8 @@
- #ifndef GESTURES_FINGER_METRICS_H_
- #define GESTURES_FINGER_METRICS_H_
- 
-+#include <math.h>
-+
- #include "gestures/include/gestures.h"
- #include "gestures/include/prop_registry.h"
-#include "gestures/include/vector.h"
--- a/pkgs/by-name/li/libgestures/package.nix
+++ b/pkgs/by-name/li/libgestures/package.nix
@ -1,45 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  pkg-config,
-  glib,
-  jsoncpp,
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "libgestures";
-  version = "2.0.1";
-  src = fetchFromGitHub {
-    owner = "hugegreenbug";
-    repo = "libgestures";
-    rev = "v${finalAttrs.version}";
-    sha256 = "0dfvads2adzx4k8cqc1rbwrk1jm2wn9wl2jk51m26xxpmh1g0zab";
-  };
-  patches = [ ./include-fix.patch ];
-
-  postPatch = ''
-    substituteInPlace Makefile \
-      --replace -Werror -Wno-error \
-      --replace '$(DESTDIR)/usr/include' '$(DESTDIR)/include'
-  '';
-
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [
-    glib
-    jsoncpp
-  ];
-
-  makeFlags = [
-    "DESTDIR=$(out)"
-    "LIBDIR=/lib"
-  ];
-
-  meta = {
-    description = "ChromiumOS libgestures modified to compile for Linux";
-    license = lib.licenses.bsd3;
-    platforms = lib.platforms.linux;
-    homepage = "https://chromium.googlesource.com/chromiumos/platform/gestures";
-    maintainers = with lib.maintainers; [ kcalvinalvin ];
-  };
-})
--- a/pkgs/by-name/li/link-grammar/package.nix
+++ b/pkgs/by-name/li/link-grammar/package.nix
@ -5,17 +5,18 @@
  pkg-config,
  python3,
  flex,
-  sqlite,
  libedit,
+  pcre2,
+  sqlite,
  runCommand,
  dieHook,
 }:

 let

-  link-grammar = stdenv.mkDerivation rec {
+  link-grammar = stdenv.mkDerivation (finalAttrs: {
    pname = "link-grammar";
-    version = "5.10.5";
+    version = "5.13.0";

    outputs = [
      "bin"
@ -25,8 +26,8 @@ let
    ];

    src = fetchurl {
-      url = "http://www.abisource.com/downloads/link-grammar/${version}/link-grammar-${version}.tar.gz";
-      sha256 = "sha256-MkcQzYEyl1/5zLU1CXMvdVhHOxwZ8XiSAAo97bhhiu0=";
+      url = "https://www.gnucash.org/link-grammar/downloads/${finalAttrs.version}/link-grammar-${finalAttrs.version}.tar.gz";
+      hash = "sha256-5qDJBd+xdfNZefA1CgzzxnyzimgZ2fK3PGhN/nKpQd8=";
    };

    nativeBuildInputs = [
@ -36,15 +37,28 @@ let
    ];

    buildInputs = [
-      sqlite
      libedit
+      sqlite
+    ]
+    ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [
+      pcre2
    ];

    configureFlags = [
      "--disable-java-bindings"
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      # multi-dict and multi-threads crash when built with pcre2
+      # https://github.com/opencog/link-grammar/issues/1514
+      "--disable-pcre2"
    ];

-    doCheck = true;
+    preCheck = lib.optionalString stdenv.hostPlatform.isDarwin ''
+      export DYLD_LIBRARY_PATH=$(pwd)/link-grammar/.libs
+    '';
+
+    # multi-dict test randomly fails on x86_64-darwin
+    doCheck = stdenv.hostPlatform.system != "x86_64-darwin";

    passthru.tests = {
      quick =
@ -64,13 +78,13 @@ let

    meta = {
      description = "Grammar Checking library";
-      homepage = "https://www.abisource.com/projects/link-grammar/";
-      changelog = "https://github.com/opencog/link-grammar/blob/link-grammar-${version}/ChangeLog";
+      homepage = "https://opencog.github.io/link-grammar-website/";
+      changelog = "https://github.com/opencog/link-grammar/blob/link-grammar-${finalAttrs.version}/ChangeLog";
      license = lib.licenses.lgpl21Only;
      maintainers = with lib.maintainers; [ jtojnar ];
      platforms = lib.platforms.unix;
    };
-  };
+  });

 in
 link-grammar
--- a/pkgs/by-name/lr/lrs/package.nix
+++ b/pkgs/by-name/lr/lrs/package.nix
@ -3,6 +3,7 @@
  stdenv,
  fetchurl,
  gmp,
+  llvmPackages,
 }:

 stdenv.mkDerivation {
@ -19,7 +20,18 @@ stdenv.mkDerivation {
    ./fix-signal-handler-type.patch
  ];

-  buildInputs = [ gmp ];
+  # https://github.com/macports/macports-ports/blob/master/math/lrslib/Portfile
+  postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    substituteInPlace Makefile \
+      --replace-fail "-shared -Wl,-soname=" "-dynamiclib -install_name $out/lib/"
+  '';
+
+  buildInputs = [
+    gmp
+  ]
+  ++ lib.optionals stdenv.cc.isClang [
+    llvmPackages.openmp
+  ];

  makeFlags = [
    "prefix=${placeholder "out"}"
@ -30,7 +42,7 @@ stdenv.mkDerivation {
    description = "Implementation of the reverse search algorithm for vertex enumeration/convex hull problems";
    license = lib.licenses.gpl2;
    maintainers = [ lib.maintainers.raskin ];
-    platforms = lib.platforms.linux;
+    platforms = lib.platforms.unix;
    homepage = "http://cgm.cs.mcgill.ca/~avis/C/lrs.html";
  };
 }
--- a/pkgs/by-name/ma/matrix-zulip-bridge/package.nix
+++ b/pkgs/by-name/ma/matrix-zulip-bridge/package.nix
@ -36,6 +36,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
  pythonRelaxDeps = [
    "bidict"
    "markdownify"
+    "mautrix"
    "ruamel-yaml"
    "zulip-emoji-mapping"
  ];
--- a/pkgs/by-name/ma/mattermost/package.nix
+++ b/pkgs/by-name/ma/mattermost/package.nix
@ -12,6 +12,7 @@
  jq,
  nixosTests,

+  latestVersionInfo ? null,
  versionInfo ? {
    # ESR releases only. Note: if NixOS would release with an ESR that goes out
    # of support during the lifetime of the NixOS release, it is acceptable
@ -23,11 +24,11 @@
    # the version regex here as well.
    #
    # Ensure you also check ../mattermostLatest/package.nix.
-    regex = "^v(11\\.[67]\\.[0-9]+)$";
-    version = "11.6.1";
-    srcHash = "sha256-0TUh5qKi64jt3YhgCTceoizOGzqyt70Rh8VH+bSfS5o=";
-    vendorHash = "sha256-bWl1rdVRTOJzS2HKKsSRhzVcH1sPgEAlRLjrc+/o0lo=";
-    npmDepsHash = "sha256-30xwoizNh6fAWS0YdEheXtcO6I9MjoFdCekvLnnoBMc=";
+    regex = "^v(11\\.7\\.[0-9]+)$";
+    version = "11.7.0";
+    srcHash = "sha256-oH9bLN2BPvRSWl5m3VNHBNMBXfdmkwaE9tzL7pcD1mg=";
+    vendorHash = "sha256-PmwwiXNaDarc1H7z1G4zstgs7tvmZ/d7V5eGqMh1VX4=";
+    npmDepsHash = "sha256-C3vfWW2hMOMnrPn1538kT+ma09T9VswrmADV/KPkrPc=";
  },
  ...
 }:
@ -87,16 +88,27 @@ let
        };
    in
    finalPassthru.withoutTests;
+
+  versionInfo' =
+    if
+      latestVersionInfo != null && lib.versionAtLeast latestVersionInfo.version versionInfo.version
+    then
+      # Prefer the latest if we're building mattermostLatest
+      latestVersionInfo
+    else
+      # Prefer the one we have
+      assert versionInfo != null;
+      versionInfo;
 in
 buildMattermost rec {
  pname = "mattermost";
-  inherit (versionInfo) version;
+  inherit (versionInfo') version;

  src = fetchFromGitHub {
    owner = "mattermost";
    repo = "mattermost";
    tag = "v${version}";
-    hash = versionInfo.srcHash;
+    hash = versionInfo'.srcHash;
    postFetch = ''
      cd $out/webapp

@ -107,13 +119,13 @@ buildMattermost rec {
      ' < package-lock.json > package-lock.fixed.json

      # Run the lockfile overlay, if present.
-      ${lib.optionalString (versionInfo.lockfileOverlay or null != null) ''
+      ${lib.optionalString (versionInfo'.lockfileOverlay or null != null) ''
        ${lib.getExe jq} ${lib.escapeShellArg ''
          # Unlock a dependency and let npm-lockfile-fix relock it.
          def unlock(root; dependency; path):
            root | .packages[path] |= del(.resolved, .integrity)
                 | .packages[path].version = root.packages.channels.dependencies[dependency];
-          ${versionInfo.lockfileOverlay}
+          ${versionInfo'.lockfileOverlay}
        ''} < package-lock.fixed.json > package-lock.overlaid.json
        mv package-lock.overlaid.json package-lock.fixed.json
      ''}
@ -130,20 +142,24 @@ buildMattermost rec {
  # https://github.com/mattermost/mattermost/issues/26221#issuecomment-1945351597
  overrideModAttrs = _: {
    buildPhase = ''
+      runHook preBuild
+
      make setup-go-work
      go work vendor -e -v
+
+      runHook postBuild
    '';
  };

  npmDeps = fetchNpmDeps {
    inherit src;
    sourceRoot = "${src.name}/webapp";
-    hash = versionInfo.npmDepsHash;
+    hash = versionInfo'.npmDepsHash;
    makeCacheWritable = true;
    forceGitDeps = true;
  };

-  inherit (versionInfo) vendorHash;
+  inherit (versionInfo') vendorHash;

  modRoot = "./server";
  preBuild = ''
@ -188,9 +204,14 @@ buildMattermost rec {

  doInstallCheck = true;
  installCheckPhase = ''
+    runHook preInstallCheck
+
    for subPackage in $subPackages; do
+      echo "Checking version for: $subPackage" >&2
      "$out/bin/$(basename -- "$subPackage")" version | grep "$version"
    done
+
+    runHook postInstallCheck
  '';

  passthru = {
@ -198,11 +219,11 @@ buildMattermost rec {
      extraArgs = [
        "--use-github-releases"
        "--version-regex"
-        versionInfo.regex
+        versionInfo'.regex
      ]
-      ++ lib.optionals (versionInfo.autoUpdate or null != null) [
+      ++ lib.optionals (versionInfo'.autoUpdate or null != null) [
        "--override-filename"
-        versionInfo.autoUpdate
+        versionInfo'.autoUpdate
      ];
    };
    tests.mattermost = nixosTests.mattermost;
@ -235,7 +256,9 @@ buildMattermost rec {
        runHook preBuild

        for ws in platform/{types,client,components,shared} channels; do
-          npm run build --workspace="$ws"
+          if [ -d "$ws" ]; then
+            npm run build --workspace="$ws"
+          fi
        done

        runHook postBuild
--- a/pkgs/by-name/ma/mattermostLatest/package.nix
+++ b/pkgs/by-name/ma/mattermostLatest/package.nix
@ -3,4 +3,24 @@
  ...
 }@args:

-mattermost.override args
+mattermost.override (
+  {
+    latestVersionInfo = {
+      # Latest, non-RC releases only.
+      # If the latest is an ESR (Extended Support Release),
+      # duplicate it here to facilitate the update script.
+      # Note that the Mattermost package will prefer whichever is later of this one
+      # or itself, in case the update script is lagging on one set of hashes.
+      # See https://docs.mattermost.com/about/mattermost-server-releases.html
+      # and make sure the version regex is up to date here.
+      # Ensure you also check ../mattermost/package.nix for ESR releases.
+      regex = "^v(11\\.[0-9]+\\.[0-9]+)$";
+      version = "11.7.0";
+      srcHash = "sha256-oH9bLN2BPvRSWl5m3VNHBNMBXfdmkwaE9tzL7pcD1mg=";
+      vendorHash = "sha256-PmwwiXNaDarc1H7z1G4zstgs7tvmZ/d7V5eGqMh1VX4=";
+      npmDepsHash = "sha256-C3vfWW2hMOMnrPn1538kT+ma09T9VswrmADV/KPkrPc=";
+      autoUpdate = ./package.nix;
+    };
+  }
+  // args
+)
--- a/pkgs/by-name/mi/microfetch/package.nix
+++ b/pkgs/by-name/mi/microfetch/package.nix
@ -9,21 +9,25 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "microfetch";
-  version = "0.4.13";
+  version = "1.1.0";

  src = fetchFromGitHub {
    owner = "NotAShelf";
    repo = "microfetch";
    tag = "${finalAttrs.version}";
-    hash = "sha256-aJ2QuMbUM/beMD8b62AqzTNljQ8RtBNOSvj9nJfRXbA=";
+    hash = "sha256-akJ44+X1POnV1dZnWq66X5vWokp9TGgJ5/Ey6kh/icA=";
  };

-  cargoHash = "sha256-vGvpjRJr4ez322JWUwboVml22vnRVRlwpZ9W4F5wATA=";
+  cargoHash = "sha256-mVS1fv/FI3rDoNm2D7ToiqZJZuySggK2zW2KbbxtpuQ=";

  nativeBuildInputs = lib.optionals stdenv.hostPlatform.isLinux [ mold ];

  passthru.updateScript = nix-update-script { };

+  # For whatever reason the cargo test build in the checkphase attempts to use dynamic libraries.
+  # Could be wrong, but rectifying this is probably more of an investment than it's worth.
+  doCheck = false;
+
  meta = {
    description = "Microscopic fetch script in Rust, for NixOS systems";
    homepage = "https://github.com/NotAShelf/microfetch";
--- a/pkgs/by-name/mo/monkeys-audio/package.nix
+++ b/pkgs/by-name/mo/monkeys-audio/package.nix
@ -6,12 +6,12 @@
 }:

 stdenv.mkDerivation (finalAttrs: {
-  version = "12.84";
+  version = "12.93";
  pname = "monkeys-audio";

  src = fetchzip {
    url = "https://monkeysaudio.com/files/MAC_${builtins.concatStringsSep "" (lib.strings.splitString "." finalAttrs.version)}_SDK.zip";
-    hash = "sha256-WYBc59DJM5DVe7hZVXCsMJsShUQf8Ib0OLKISRjg4pY=";
+    hash = "sha256-T5Bt4g3xmxYb1YQyZ1/VnlJgk6JCPe8SiBT016dGPCA=";
    stripRoot = false;
  };

--- a/pkgs/by-name/mp/mpd/package.nix
+++ b/pkgs/by-name/mp/mpd/package.nix
@ -197,13 +197,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "mpd";
-  version = "0.24.10";
+  version = "0.24.12";

  src = fetchFromGitHub {
    owner = "MusicPlayerDaemon";
    repo = "MPD";
    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-qwBX5NG1h55HoNtHMyLfjDQhua1xCyONqd386+QB6IU=";
+    sha256 = "sha256-CYwpPKFTW7engtPJoUqIWWn6YhmoSRjiew6n0tAZSmE=";
  };

  buildInputs = [
--- a/pkgs/by-name/ne/netlistsvg/package-lock.json
+++ b/pkgs/by-name/ne/netlistsvg/package-lock.json
@ -903,9 +903,9 @@
      }
    },
    "node_modules/ajv": {
-      "version": "6.12.6",
-      "resolved": "https://registry.npmjs.org/ajv/-/ajv-6.12.6.tgz",
-      "integrity": "sha512-j3fVLgvTo527anyYyJOGTYJbG+vnnQYvE0m5mmkc1TK+nxAppkCLMIL0aZ4dblVCNoGShhm+kzE4ZUykBoMg4g==",
+      "version": "6.15.0",
+      "resolved": "https://registry.npmjs.org/ajv/-/ajv-6.15.0.tgz",
+      "integrity": "sha512-fgFx7Hfoq60ytK2c7DhnF8jIvzYgOMxfugjLOSMHjLIPgenqa7S7oaagATUq99mV6IYvN2tRmC0wnTYX6iPbMw==",
      "license": "MIT",
      "dependencies": {
        "fast-deep-equal": "^3.1.1",
@ -1141,9 +1141,9 @@
      }
    },
    "node_modules/asn1.js/node_modules/bn.js": {
-      "version": "4.12.2",
-      "resolved": "https://registry.npmjs.org/bn.js/-/bn.js-4.12.2.tgz",
-      "integrity": "sha512-n4DSx829VRTRByMRGdjQ9iqsN0Bh4OolPsFnaZBLcbi8iXcB+kJ9s7EnRt4wILZNV3kPLHkRVfOc/HvhC3ovDw==",
+      "version": "4.12.3",
+      "resolved": "https://registry.npmjs.org/bn.js/-/bn.js-4.12.3.tgz",
+      "integrity": "sha512-fGTi3gxV/23FTYdAoUtLYp6qySe2KE3teyZitipKNRuVYcBkoP/bB3guXN/XVKUe9mxCHXnc9C4ocyz8OmgN0g==",
      "dev": true,
      "license": "MIT"
    },
@ -1408,16 +1408,16 @@
      }
    },
    "node_modules/bn.js": {
-      "version": "5.2.2",
-      "resolved": "https://registry.npmjs.org/bn.js/-/bn.js-5.2.2.tgz",
-      "integrity": "sha512-v2YAxEmKaBLahNwE1mjp4WON6huMNeuDvagFZW+ASCuA/ku0bXR9hSMw0XpiqMoA3+rmnyck/tPRSFQkoC9Cuw==",
+      "version": "5.2.3",
+      "resolved": "https://registry.npmjs.org/bn.js/-/bn.js-5.2.3.tgz",
+      "integrity": "sha512-EAcmnPkxpntVL+DS7bO1zhcZNvCkxqtkd0ZY53h06GNQ3DEkkGZ/gKgmDv6DdZQGj9BgfSPKtJJ7Dp1GPP8f7w==",
      "dev": true,
      "license": "MIT"
    },
    "node_modules/brace-expansion": {
-      "version": "1.1.12",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz",
-      "integrity": "sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==",
+      "version": "1.1.14",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.14.tgz",
+      "integrity": "sha512-MWPGfDxnyzKU7rNOW9SP/c50vi3xrmrua/+6hfPbCS2ABNWfx24vPidzvC7krjU/RTo235sV776ymlsMtGKj8g==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
@ -1678,25 +1678,24 @@
      "license": "MIT"
    },
    "node_modules/browserify-sign": {
-      "version": "4.2.3",
-      "resolved": "https://registry.npmjs.org/browserify-sign/-/browserify-sign-4.2.3.tgz",
-      "integrity": "sha512-JWCZW6SKhfhjJxO8Tyiiy+XYB7cqd2S5/+WeYHsKdNKFlCBhKbblba1A/HN/90YwtxKc8tCErjffZl++UNmGiw==",
+      "version": "4.2.5",
+      "resolved": "https://registry.npmjs.org/browserify-sign/-/browserify-sign-4.2.5.tgz",
+      "integrity": "sha512-C2AUdAJg6rlM2W5QMp2Q4KGQMVBwR1lIimTsUnutJ8bMpW5B52pGpR2gEnNBNwijumDo5FojQ0L9JrXA8m4YEw==",
      "dev": true,
      "license": "ISC",
      "dependencies": {
-        "bn.js": "^5.2.1",
-        "browserify-rsa": "^4.1.0",
+        "bn.js": "^5.2.2",
+        "browserify-rsa": "^4.1.1",
        "create-hash": "^1.2.0",
        "create-hmac": "^1.1.7",
-        "elliptic": "^6.5.5",
-        "hash-base": "~3.0",
+        "elliptic": "^6.6.1",
        "inherits": "^2.0.4",
-        "parse-asn1": "^5.1.7",
+        "parse-asn1": "^5.1.9",
        "readable-stream": "^2.3.8",
        "safe-buffer": "^5.2.1"
      },
      "engines": {
-        "node": ">= 0.12"
+        "node": ">= 0.10"
      }
    },
    "node_modules/browserify-zlib": {
@ -2302,9 +2301,9 @@
      }
    },
    "node_modules/create-ecdh/node_modules/bn.js": {
-      "version": "4.12.2",
-      "resolved": "https://registry.npmjs.org/bn.js/-/bn.js-4.12.2.tgz",
-      "integrity": "sha512-n4DSx829VRTRByMRGdjQ9iqsN0Bh4OolPsFnaZBLcbi8iXcB+kJ9s7EnRt4wILZNV3kPLHkRVfOc/HvhC3ovDw==",
+      "version": "4.12.3",
+      "resolved": "https://registry.npmjs.org/bn.js/-/bn.js-4.12.3.tgz",
+      "integrity": "sha512-fGTi3gxV/23FTYdAoUtLYp6qySe2KE3teyZitipKNRuVYcBkoP/bB3guXN/XVKUe9mxCHXnc9C4ocyz8OmgN0g==",
      "dev": true,
      "license": "MIT"
    },
@ -2680,9 +2679,9 @@
      }
    },
    "node_modules/diff": {
-      "version": "4.0.2",
-      "resolved": "https://registry.npmjs.org/diff/-/diff-4.0.2.tgz",
-      "integrity": "sha512-58lmxKSA4BNyLz+HHMUzlOEpg09FV+ev6ZMe3vJihgdxzgcwZ8VoEEPmALCZG9LmqfVoNMMKpttIYTVG6uDY7A==",
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/diff/-/diff-4.0.4.tgz",
+      "integrity": "sha512-X07nttJQkwkfKfvTPG/KSnE2OMdcUCao6+eXF3wmnIQRn2aPAHH3VxDbDOdegkd6JbPsXqShpvEOHfAT+nCNwQ==",
      "dev": true,
      "license": "BSD-3-Clause",
      "engines": {
@ -2712,9 +2711,9 @@
      }
    },
    "node_modules/diffie-hellman/node_modules/bn.js": {
-      "version": "4.12.2",
-      "resolved": "https://registry.npmjs.org/bn.js/-/bn.js-4.12.2.tgz",
-      "integrity": "sha512-n4DSx829VRTRByMRGdjQ9iqsN0Bh4OolPsFnaZBLcbi8iXcB+kJ9s7EnRt4wILZNV3kPLHkRVfOc/HvhC3ovDw==",
+      "version": "4.12.3",
+      "resolved": "https://registry.npmjs.org/bn.js/-/bn.js-4.12.3.tgz",
+      "integrity": "sha512-fGTi3gxV/23FTYdAoUtLYp6qySe2KE3teyZitipKNRuVYcBkoP/bB3guXN/XVKUe9mxCHXnc9C4ocyz8OmgN0g==",
      "dev": true,
      "license": "MIT"
    },
@ -2826,9 +2825,9 @@
      }
    },
    "node_modules/elliptic/node_modules/bn.js": {
-      "version": "4.12.2",
-      "resolved": "https://registry.npmjs.org/bn.js/-/bn.js-4.12.2.tgz",
-      "integrity": "sha512-n4DSx829VRTRByMRGdjQ9iqsN0Bh4OolPsFnaZBLcbi8iXcB+kJ9s7EnRt4wILZNV3kPLHkRVfOc/HvhC3ovDw==",
+      "version": "4.12.3",
+      "resolved": "https://registry.npmjs.org/bn.js/-/bn.js-4.12.3.tgz",
+      "integrity": "sha512-fGTi3gxV/23FTYdAoUtLYp6qySe2KE3teyZitipKNRuVYcBkoP/bB3guXN/XVKUe9mxCHXnc9C4ocyz8OmgN0g==",
      "dev": true,
      "license": "MIT"
    },
@ -6198,9 +6197,9 @@
      "license": "MIT"
    },
    "node_modules/js-yaml": {
-      "version": "3.14.1",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.14.1.tgz",
-      "integrity": "sha512-okMH7OXXJ7YrN9Ok3/SXrnu4iX9yOk+25nqX4imS2npuvTYDmo/QEZoqwZkYaIDk3jVvBOTOIEgEhaLOynBS9g==",
+      "version": "3.14.2",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.14.2.tgz",
+      "integrity": "sha512-PMSmkqxr106Xa156c2M265Z+FTrPl+oxd/rgOQy2tijQeK5TxQ43psO1ZCwhVOSdnn+RzkzlRz/eY4BgJBYVpg==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
@ -6519,9 +6518,9 @@
      }
    },
    "node_modules/lodash": {
-      "version": "4.17.21",
-      "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz",
-      "integrity": "sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg==",
+      "version": "4.18.1",
+      "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.18.1.tgz",
+      "integrity": "sha512-dMInicTPVE8d1e5otfwmmjlxkZoUpiVLwyeTdUsi/Caj/gfzzblBcCE5sRHV/AsjuCmxWrte2TNGSYuCeCq+0Q==",
      "license": "MIT"
    },
    "node_modules/lodash.memoize": {
@ -6724,9 +6723,9 @@
      }
    },
    "node_modules/miller-rabin/node_modules/bn.js": {
-      "version": "4.12.2",
-      "resolved": "https://registry.npmjs.org/bn.js/-/bn.js-4.12.2.tgz",
-      "integrity": "sha512-n4DSx829VRTRByMRGdjQ9iqsN0Bh4OolPsFnaZBLcbi8iXcB+kJ9s7EnRt4wILZNV3kPLHkRVfOc/HvhC3ovDw==",
+      "version": "4.12.3",
+      "resolved": "https://registry.npmjs.org/bn.js/-/bn.js-4.12.3.tgz",
+      "integrity": "sha512-fGTi3gxV/23FTYdAoUtLYp6qySe2KE3teyZitipKNRuVYcBkoP/bB3guXN/XVKUe9mxCHXnc9C4ocyz8OmgN0g==",
      "dev": true,
      "license": "MIT"
    },
@ -6791,9 +6790,9 @@
      "license": "MIT"
    },
    "node_modules/minimatch": {
-      "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
-      "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
      "dev": true,
      "license": "ISC",
      "dependencies": {
@ -7392,17 +7391,16 @@
      }
    },
    "node_modules/parse-asn1": {
-      "version": "5.1.7",
-      "resolved": "https://registry.npmjs.org/parse-asn1/-/parse-asn1-5.1.7.tgz",
-      "integrity": "sha512-CTM5kuWR3sx9IFamcl5ErfPl6ea/N8IYwiJ+vpeB2g+1iknv7zBl5uPwbMbRVznRVbrNY6lGuDoE5b30grmbqg==",
+      "version": "5.1.9",
+      "resolved": "https://registry.npmjs.org/parse-asn1/-/parse-asn1-5.1.9.tgz",
+      "integrity": "sha512-fIYNuZ/HastSb80baGOuPRo1O9cf4baWw5WsAp7dBuUzeTD/BoaG8sVTdlPFksBE2lF21dN+A1AnrpIjSWqHHg==",
      "dev": true,
      "license": "ISC",
      "dependencies": {
        "asn1.js": "^4.10.1",
        "browserify-aes": "^1.2.0",
        "evp_bytestokey": "^1.0.3",
-        "hash-base": "~3.0",
-        "pbkdf2": "^3.1.2",
+        "pbkdf2": "^3.1.5",
        "safe-buffer": "^5.2.1"
      },
      "engines": {
@ -7534,55 +7532,21 @@
      }
    },
    "node_modules/pbkdf2": {
-      "version": "3.1.3",
-      "resolved": "https://registry.npmjs.org/pbkdf2/-/pbkdf2-3.1.3.tgz",
-      "integrity": "sha512-wfRLBZ0feWRhCIkoMB6ete7czJcnNnqRpcoWQBLqatqXXmelSRqfdDK4F3u9T2s2cXas/hQJcryI/4lAL+XTlA==",
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/pbkdf2/-/pbkdf2-3.1.5.tgz",
+      "integrity": "sha512-Q3CG/cYvCO1ye4QKkuH7EXxs3VC/rI1/trd+qX2+PolbaKG0H+bgcZzrTt96mMyRtejk+JMCiLUn3y29W8qmFQ==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "create-hash": "~1.1.3",
+        "create-hash": "^1.2.0",
        "create-hmac": "^1.1.7",
-        "ripemd160": "=2.0.1",
+        "ripemd160": "^2.0.3",
        "safe-buffer": "^5.2.1",
-        "sha.js": "^2.4.11",
-        "to-buffer": "^1.2.0"
+        "sha.js": "^2.4.12",
+        "to-buffer": "^1.2.1"
      },
      "engines": {
-        "node": ">=0.12"
-      }
-    },
-    "node_modules/pbkdf2/node_modules/create-hash": {
-      "version": "1.1.3",
-      "resolved": "https://registry.npmjs.org/create-hash/-/create-hash-1.1.3.tgz",
-      "integrity": "sha512-snRpch/kwQhcdlnZKYanNF1m0RDlrCdSKQaH87w1FCFPVPNCQ/Il9QJKAX2jVBZddRdaHBMC+zXa9Gw9tmkNUA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "cipher-base": "^1.0.1",
-        "inherits": "^2.0.1",
-        "ripemd160": "^2.0.0",
-        "sha.js": "^2.4.0"
-      }
-    },
-    "node_modules/pbkdf2/node_modules/hash-base": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/hash-base/-/hash-base-2.0.2.tgz",
-      "integrity": "sha512-0TROgQ1/SxE6KmxWSvXHvRj90/Xo1JvZShofnYF+f6ZsGtR4eES7WfrQzPalmyagfKZCXpVnitiRebZulWsbiw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "inherits": "^2.0.1"
-      }
-    },
-    "node_modules/pbkdf2/node_modules/ripemd160": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/ripemd160/-/ripemd160-2.0.1.tgz",
-      "integrity": "sha512-J7f4wutN8mdbV08MJnXibYpCOPHR+yzy+iQ/AsjMv2j8cLavQ8VGagDFUwwTAdF8FmRKVeNpbTTEwNHCW1g94w==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "hash-base": "^2.0.0",
-        "inherits": "^2.0.1"
+        "node": ">= 0.10"
      }
    },
    "node_modules/performance-now": {
@ -7785,9 +7749,9 @@
      }
    },
    "node_modules/public-encrypt/node_modules/bn.js": {
-      "version": "4.12.2",
-      "resolved": "https://registry.npmjs.org/bn.js/-/bn.js-4.12.2.tgz",
-      "integrity": "sha512-n4DSx829VRTRByMRGdjQ9iqsN0Bh4OolPsFnaZBLcbi8iXcB+kJ9s7EnRt4wILZNV3kPLHkRVfOc/HvhC3ovDw==",
+      "version": "4.12.3",
+      "resolved": "https://registry.npmjs.org/bn.js/-/bn.js-4.12.3.tgz",
+      "integrity": "sha512-fGTi3gxV/23FTYdAoUtLYp6qySe2KE3teyZitipKNRuVYcBkoP/bB3guXN/XVKUe9mxCHXnc9C4ocyz8OmgN0g==",
      "dev": true,
      "license": "MIT"
    },
@ -7810,9 +7774,9 @@
      "license": "MIT"
    },
    "node_modules/qs": {
-      "version": "6.5.3",
-      "resolved": "https://registry.npmjs.org/qs/-/qs-6.5.3.tgz",
-      "integrity": "sha512-qxXIEh4pCGfHICj1mAJQ2/2XVZkjCDTcEgfoSQxc/fYivUZxTkk7L3bDBJSoNrEzXI17oUO5Dp07ktqE5KzczA==",
+      "version": "6.5.5",
+      "resolved": "https://registry.npmjs.org/qs/-/qs-6.5.5.tgz",
+      "integrity": "sha512-mzR4sElr1bfCaPJe7m8ilJ6ZXdDaGoObcYR0ZHSsktM/Lt21MVHj5De30GQH2eiZ1qGRTO7LCAzQsUeXTNexWQ==",
      "dev": true,
      "license": "BSD-3-Clause",
      "engines": {
@ -8361,14 +8325,33 @@
      }
    },
    "node_modules/ripemd160": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/ripemd160/-/ripemd160-2.0.2.tgz",
-      "integrity": "sha512-ii4iagi25WusVoiC4B4lq7pbXfAp3D9v5CwfkY33vffw2+pkDjY1D8GaN7spsxvCSx8dkPqOZCEZyfxcmJG2IA==",
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/ripemd160/-/ripemd160-2.0.3.tgz",
+      "integrity": "sha512-5Di9UC0+8h1L6ZD2d7awM7E/T4uA1fJRlx6zk/NvdCCVEoAnFqvHmCuNeIKoCeIixBX/q8uM+6ycDvF8woqosA==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "hash-base": "^3.0.0",
-        "inherits": "^2.0.1"
+        "hash-base": "^3.1.2",
+        "inherits": "^2.0.4"
+      },
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/ripemd160/node_modules/hash-base": {
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/hash-base/-/hash-base-3.1.2.tgz",
+      "integrity": "sha512-Bb33KbowVTIj5s7Ked1OsqHUeCpz//tPwR+E2zJgJKo9Z5XolZ9b6bdUgjmYlwnWhoOQKoTd1TYToZGn5mAYOg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "inherits": "^2.0.4",
+        "readable-stream": "^2.3.8",
+        "safe-buffer": "^5.2.1",
+        "to-buffer": "^1.2.1"
+      },
+      "engines": {
+        "node": ">= 0.8"
      }
    },
    "node_modules/rsvp": {
@ -10375,9 +10358,9 @@
      }
    },
    "node_modules/url/node_modules/qs": {
-      "version": "6.14.0",
-      "resolved": "https://registry.npmjs.org/qs/-/qs-6.14.0.tgz",
-      "integrity": "sha512-YWWTjgABSKcvs/nWBi9PycY/JiPJqOD4JA6o9Sej2AtvSGarXxKC3OQSk4pAarbdQlKAh5D4FCQkJNkW+GAn3w==",
+      "version": "6.15.1",
+      "resolved": "https://registry.npmjs.org/qs/-/qs-6.15.1.tgz",
+      "integrity": "sha512-6YHEFRL9mfgcAvql/XhwTvf5jKcOiiupt2FiJxHkiX1z4j7WL8J/jRHYLluORvc1XxB5rV20KoeK00gVJamspg==",
      "dev": true,
      "license": "BSD-3-Clause",
      "dependencies": {
--- a/pkgs/by-name/ne/netlistsvg/package.nix
+++ b/pkgs/by-name/ne/netlistsvg/package.nix
@ -22,7 +22,7 @@ buildNpmPackage rec {
    cp ${./package-lock.json} ./package-lock.json
  '';

-  npmDepsHash = "sha256-Vs0RLj6ySkM5oQsBGv4MmgiIBMhiDhINpwuCBJH9L8s=";
+  npmDepsHash = "sha256-fESWYTx4cotURIjndLa5W+fCYJ12KwlDGXOPkzKmnTI=";

  dontNpmBuild = true;

--- a/pkgs/by-name/ne/networkmanager-strongswan/package.nix
+++ b/pkgs/by-name/ne/networkmanager-strongswan/package.nix
@ -15,11 +15,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "NetworkManager-strongswan";
-  version = "1.6.4";
+  version = "1.6.5";

  src = fetchurl {
    url = "https://download.strongswan.org/NetworkManager/NetworkManager-strongswan-${finalAttrs.version}.tar.bz2";
-    sha256 = "sha256-X9ftnoogw2W+p9ZTdgoECfmyEkRABtQ2UzK7zFGPbBU=";
+    sha256 = "sha256-OpHK38x8dGFkcLKw+A203BfxAzYrOG7XY0edhQBQG2c=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/op/open-webui/package.nix
+++ b/pkgs/by-name/op/open-webui/package.nix
@ -24,11 +24,9 @@ let

    # the backend for run-on-client-browser python execution
    # must match lock file in open-webui
-    # TODO: should we automate this?
-    # TODO: with JQ? "jq -r '.packages["node_modules/pyodide"].version' package-lock.json"
-    pyodideVersion = "0.28.2";
+    pyodideVersion = "0.28.3";
    pyodide = fetchurl {
-      hash = "sha256-MQIRdOj9yVVsF+nUNeINnAfyA6xULZFhyjuNnV0E5+c=";
+      hash = "sha256-fcqubT8VmGoJ8PnmxHE6DA8kv/DJDHToWoFyPxvGCUA=";
      url = "https://github.com/pyodide/pyodide/releases/download/${pyodideVersion}/pyodide-${pyodideVersion}.tar.bz2";
    };

--- a/pkgs/by-name/op/open-webui/update.sh
+++ b/pkgs/by-name/op/open-webui/update.sh
@ -22,11 +22,8 @@ npm_hash=$(prefetch-npm-deps package-lock.json)
 sed -i 's#npmDepsHash = "[^"]*"#npmDepsHash = "'"$npm_hash"'"#' "$path"

 # Extract pyodide version
-pyodide_version=$(sed -rn 's/^.*pyodide.*\^([0-9.]*)\".*$/\1/p' package.json)
+pyodide_version=$(jq -r '.packages["node_modules/pyodide"].version' package-lock.json)
 popd

-# Update the pyodide version if necessary
-current_pyodide_version=$(nix eval --raw -f . open-webui.frontend.pyodideVersion)
-if [ "$current_pyodide_version" < "$pyodide_version" ]; then
-  update-source-version open-webui.frontend "${pyodide_version}" --file="$path" --version-key=pyodideVersion --source-key=pyodide
-fi
+# Update the pyodide version
+update-source-version open-webui.frontend "${pyodide_version}" --file="$path" --version-key=pyodideVersion --source-key=pyodide
--- a/pkgs/by-name/op/opencode-desktop/package.nix
+++ b/pkgs/by-name/op/opencode-desktop/package.nix
@ -54,6 +54,12 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    OPENCODE_CHANNEL = "prod";
    MODELS_DEV_API_JSON = "${models-dev}/dist/_api.json";
    OPENCODE_DISABLE_MODELS_FETCH = true;
+  }
+  # Disable code signing on macOS. Public build hosts don't have Apple Developer
+  # certificates, so electron-builder's `security find-identity` spawns produce
+  # EPERM inside the nix sandbox.
+  // lib.optionalAttrs stdenvNoCC.hostPlatform.isDarwin {
+    CSC_IDENTITY_AUTO_DISCOVERY = "false";
  };

  postPatch = ''
@ -73,6 +79,18 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    runHook postConfigure
  '';

+  preBuild = lib.optionalString stdenvNoCC.hostPlatform.isDarwin ''
+    # Patch electron-builder to skip code signing on macOS.
+    # The nix sandbox on public Darwin builders cannot spawn
+    # `security find-identity` — trying gives spawn EPERM.
+    # We patch the compiled JS to make getValidIdentities a no-op.
+    for f in $(find node_modules -path "*/app-builder-lib/out/codeSign/macCodeSign.js" -type f 2>/dev/null); do
+      substituteInPlace "$f" \
+        --replace-fail "async function getValidIdentities" \
+        "async function getValidIdentities() { return []; }; async function getValidIdentities_DISABLED"
+    done
+  '';
+
  buildPhase = ''
    runHook preBuild

@ -98,7 +116,8 @@ stdenvNoCC.mkDerivation (finalAttrs: {
      --config=electron-builder.config.ts \
      --config.electronDist="$HOME/.electron-dist" \
      --config.electronVersion=${electron.version} \
-      --config.asarUnpack='**/*.node'
+      --config.asarUnpack='**/*.node' \
+      ${lib.optionalString stdenvNoCC.hostPlatform.isDarwin "--config.mac.identity=null"}

    cd ../..

--- a/pkgs/by-name/op/opencode/package.nix
+++ b/pkgs/by-name/op/opencode/package.nix
@ -16,13 +16,13 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "opencode";
-  version = "1.14.48";
+  version = "1.15.3";

  src = fetchFromGitHub {
    owner = "anomalyco";
    repo = "opencode";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-gyybqabTco+5ZeWv4lCX8t/R9Jm3tYsA8wVvkrxkEYQ=";
+    hash = "sha256-OKQR76q7trKQTvlMxH8tG2jNnRtBe3YeFfvNw8c3+8I=";
  };

  node_modules = stdenvNoCC.mkDerivation {
@ -75,7 +75,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    # NOTE: Required else we get errors that our fixed-output derivation references store paths
    dontFixup = true;

-    outputHash = "sha256-94uXrhyGqW016U6LPE/xIfZGoDOzyUto5DyQrYYePds=";
+    outputHash = "sha256-O6czNd9n6b0TTIsPseZn9qOlxsPzRTrePu3L6gM13oM=";
    outputHashAlgo = "sha256";
    outputHashMode = "recursive";
  };
--- a/pkgs/by-name/op/openvino/package.nix
+++ b/pkgs/by-name/op/openvino/package.nix
@ -55,14 +55,14 @@ in

 stdenv.mkDerivation (finalAttrs: {
  pname = "openvino";
-  version = "2026.1.0";
+  version = "2026.1.2";

  src = fetchFromGitHub {
    owner = "openvinotoolkit";
    repo = "openvino";
    tag = finalAttrs.version;
    fetchSubmodules = true;
-    hash = "sha256-ss6U4D1QyJM9hbauRBgNIrU09k6xMX0SUeleOXIDU6U=";
+    hash = "sha256-1lheHc0uajmUb1EW8q02bHX9PrCp4YoyT0l8dTyb4jM=";
  };

  outputs = [
--- a/pkgs/by-name/pi/pigpio/package.nix
+++ b/pkgs/by-name/pi/pigpio/package.nix
@ -26,6 +26,8 @@ mkDerivation rec {
    hash = "sha256-Z+SwUlBbtWtnbjTe0IghR3gIKS43ZziN0amYtmXy7HE=";
  };

+  NIX_CFLAGS_COMPILE = "-std=gnu17";
+
  nativeBuildInputs = [
    cmake
  ];
--- a/pkgs/by-name/pl/ploticus/package.nix
+++ b/pkgs/by-name/pl/ploticus/package.nix
@ -40,6 +40,11 @@ stdenv.mkDerivation (finalAttrs: {
    ./fix-zlib-file-type.patch
  ];

+  # GCC 15 uses C23, which fails with the following error
+  # plg.h:283:8: error: conflicting types for 'atof'; have 'double(void)'
+  #   283 | double atof(), sqrt(), log();
+  env.NIX_CFLAGS_COMPILE = "-std=gnu17";
+
  buildInputs = [
    zlib
    libx11
--- a/pkgs/by-name/pu/pulse-visualizer/package.nix
+++ b/pkgs/by-name/pu/pulse-visualizer/package.nix
@ -6,12 +6,14 @@
  ninja,
  pkg-config,
  sdl3,
+  sdl3-image,
  libpulseaudio,
  pipewire,
  fftwFloat,
  freetype,
  glew,
  libGL,
+  curl,
  yaml-cpp,
  libebur128,
  clang,
@ -19,13 +21,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "pulse-visualizer";
-  version = "1.2.2";
+  version = "1.3.9";

  src = fetchFromGitHub {
    owner = "Audio-Solutions";
    repo = "pulse-visualizer";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-OnZDNNDmN+OgsfzyPOtlpy8alt62WA6BNhNPJTtrHsU=";
+    hash = "sha256-IzJXFbsbpRszJEpU98exK4EKGU8kHH51BZzokJwzPzU=";
  };

  nativeBuildInputs = [
@ -37,12 +39,14 @@ stdenv.mkDerivation (finalAttrs: {

  buildInputs = [
    sdl3
+    sdl3-image
    libpulseaudio
    pipewire
    fftwFloat
    freetype
    glew
    libGL
+    curl
    yaml-cpp
    libebur128
  ];
--- a/pkgs/by-name/qr/qrupdate/package.nix
+++ b/pkgs/by-name/qr/qrupdate/package.nix
@ -7,6 +7,7 @@
  which,
  gfortran,
  blas,
+  ctestCheckHook,
 }:

 stdenv.mkDerivation (finalAttrs: {
@ -42,16 +43,6 @@ stdenv.mkDerivation (finalAttrs: {
      "-DBLA_VENDOR=Generic"
    ];

-  patches =
-    # https://github.com/mpimd-csc/qrupdate-ng/issues/4
-    lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64) [
-      ./disable-zch1dn-test.patch
-    ]
-    # https://github.com/mpimd-csc/qrupdate-ng/issues/7
-    ++ lib.optionals (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64) [
-      ./disable-aarch64-single-precision-tests.patch
-    ];
-
  postPatch = ''
    sed '/^cmake_minimum_required/Is/VERSION [0-9]\.[0-9]/VERSION 3.5/' -i ./CMakeLists.txt
  '';
@ -63,11 +54,26 @@ stdenv.mkDerivation (finalAttrs: {
    which
    gfortran
  ];
+
  buildInputs = [
    blas
    lapack
  ];

+  nativeCheckInputs = [
+    ctestCheckHook
+  ];
+
+  disabledTests =
+    lib.optionals (stdenv.hostPlatform.isAarch64 && stdenv.hostPlatform.isLinux) [
+      # https://github.com/mpimd-csc/qrupdate-ng/issues/7
+      "test_tchshx"
+    ]
+    ++ lib.optionals (stdenv.hostPlatform.isx86_64 && stdenv.hostPlatform.isDarwin) [
+      # https://github.com/mpimd-csc/qrupdate-ng/issues/4
+      "test_tch1dn"
+    ];
+
  meta = {
    description = "Library for fast updating of qr and cholesky decompositions";
    homepage = "https://github.com/mpimd-csc/qrupdate-ng";
--- a/pkgs/by-name/re/render-cli/package.nix
+++ b/pkgs/by-name/re/render-cli/package.nix
@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "render-cli";
-  version = "2.16.0";
+  version = "2.17.0";

  src = fetchFromGitHub {
    owner = "render-oss";
    repo = "cli";
    rev = "v${version}";
-    hash = "sha256-y9XlOMNwqdooj3LcNFIF9gov9KX+WtB8eU0NsjzVuUc=";
+    hash = "sha256-YfGgFtGq9nnucsderlNv8No8yzDM7WQ5YGqa6YEmxtc=";
  };

-  vendorHash = "sha256-K2RKcz5wAP0ZA5g5aDgSsEXKEEncFtO9qamgG3fW02Y=";
+  vendorHash = "sha256-Ja0BcZXF8f3L+rdmk3+pyCY7khAjK+w6pyPzZdYuufs=";

  # Tests require network access
  doCheck = false;
--- a/pkgs/by-name/re/reprepro/package.nix
+++ b/pkgs/by-name/re/reprepro/package.nix
@ -11,18 +11,22 @@
  libarchive,
  xz,
  zlib,
+  gcc14Stdenv,
 }:

-stdenv.mkDerivation (finalAttrs: {
+let
+  theStdenv = if stdenv.isDarwin then gcc14Stdenv else stdenv;
+in
+theStdenv.mkDerivation (finalAttrs: {
  pname = "reprepro";
-  version = "5.4.7";
+  version = "5.4.8";

  src = fetchFromGitLab {
    domain = "salsa.debian.org";
    owner = "debian";
    repo = "reprepro";
    tag = "reprepro-${finalAttrs.version}";
-    hash = "sha256-bGfVWOmcXvaE+t9jiZFrnaUTKVPJqGqbPFyThhKK8gQ=";
+    hash = "sha256-qHqRLWRbSwmpKkUQ8JenUo+CY91EY/h4yHHmq4TacMg=";
  };

  buildInputs = [
--- a/pkgs/by-name/si/siege/package.nix
+++ b/pkgs/by-name/si/siege/package.nix
@ -18,6 +18,7 @@ stdenv.mkDerivation (finalAttrs: {
  env =
    lib.optionalAttrs stdenv.hostPlatform.isLinux {
      NIX_LDFLAGS = toString [ "-lgcc_s" ];
+      NIX_CFLAGS_COMPILE = "-std=gnu17";
    }
    // lib.optionalAttrs stdenv.cc.isClang {
      # Borrowed solution from homebrew: https://github.com/Homebrew/homebrew-core/blob/1c7c95183c0984a84b1680422afab6578c300a27/Formula/s/siege.rb#L31
--- a/pkgs/by-name/si/simplex-chat-desktop/package.nix
+++ b/pkgs/by-name/si/simplex-chat-desktop/package.nix
@ -8,7 +8,7 @@

 let
  pname = "simplex-chat-desktop";
-  version = "6.5.1";
+  version = "6.5.2";

  sources = {
    "aarch64-linux" = fetchurl {
@ -17,7 +17,7 @@ let
    };
    "x86_64-linux" = fetchurl {
      url = "https://github.com/simplex-chat/simplex-chat/releases/download/v${version}/simplex-desktop-x86_64.AppImage";
-      hash = "sha256-xRHMdHaV+ppxAm1BDOP743N53oDnVPt8b7H+cRqzuZE=";
+      hash = "sha256-caRL09PKJ33XHRReZ5qSpfgKH0wpJxGSHXfA83sz5UE=";
    };
  };

--- a/pkgs/by-name/sy/syncthingtray/package.nix
+++ b/pkgs/by-name/sy/syncthingtray/package.nix
@ -27,14 +27,14 @@
 }:

 stdenv.mkDerivation (finalAttrs: {
-  version = "2.0.10";
+  version = "2.1.0";
  pname = "syncthingtray";

  src = fetchFromGitHub {
    owner = "Martchus";
    repo = "syncthingtray";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-dzsDTb7r1kbVTiapXskE5xvfdzGT2u3utbHGbt/1X7I=";
+    hash = "sha256-trmNK6lyKL6zNcL/FKELkLOJK9vVpFcS3uGMeMrlpPI=";
  };

  buildInputs = [
--- a/pkgs/by-name/uh/uhexen2/package.nix
+++ b/pkgs/by-name/uh/uhexen2/package.nix
@ -45,7 +45,7 @@ stdenv.mkDerivation {
    )
  '';

-  NIX_CFLAGS_COMPILE = "-std=gnu17";
+  env.NIX_CFLAGS_COMPILE = "-std=gnu17";

  buildPhase = ''
    runHook preBuild
--- a/pkgs/by-name/ve/veroroute/package.nix
+++ b/pkgs/by-name/ve/veroroute/package.nix
@ -2,7 +2,8 @@
  lib,
  stdenv,
  fetchurl,
-  libsForQt5,
+  qt6,
+  nixosTests,
 }:

 stdenv.mkDerivation (finalAttrs: {
@ -15,17 +16,21 @@ stdenv.mkDerivation (finalAttrs: {
  };

  nativeBuildInputs = [
-    libsForQt5.qmake
-    libsForQt5.wrapQtAppsHook
+    qt6.qmake
+    qt6.wrapQtAppsHook
  ];
  buildInputs = [
-    libsForQt5.qtbase
+    qt6.qtbase
  ];

  preConfigure = ''
    cd Src/
  '';

+  passthru.tests = {
+    veroroute = nixosTests.veroroute;
+  };
+
  meta = {
    description = "Qt based Veroboard/Perfboard/PCB layout and routing application";
    homepage = "https://sourceforge.net/projects/veroroute";
--- a/pkgs/by-name/wi/witr/package.nix
+++ b/pkgs/by-name/wi/witr/package.nix
@ -6,13 +6,13 @@
 }:
 buildGoModule (finalAttrs: {
  pname = "witr";
-  version = "0.3.1";
+  version = "0.3.2";

  src = fetchFromGitHub {
    owner = "pranshuparmar";
    repo = "witr";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-kjWhSRPU4OwRi4Azs7Ql//aMOhHU9Aya2EDcpNwOr6E=";
+    hash = "sha256-kNiBcLk+rxJno1ZHPxr28EI5T3tpJnFXgh8zIvEYy6M=";
    # populate values that require us to use git. By doing this in postFetch we
    # can delete .git afterwards and maintain better reproducibility of the src.
    leaveDotGit = true;
--- a/pkgs/by-name/xd/xdg-desktop-portal-termfilechooser/package.nix
+++ b/pkgs/by-name/xd/xdg-desktop-portal-termfilechooser/package.nix
@ -7,7 +7,7 @@
  meson,
  pkg-config,
  inih,
-  systemd,
+  systemdLibs,
  scdoc,
  nix-update-script,
 }:
@ -32,7 +32,7 @@ stdenv.mkDerivation (finalAttrs: {
  buildInputs = [
    xdg-desktop-portal
    inih
-    systemd
+    systemdLibs
  ];

  mesonFlags = [ "-Dsd-bus-provider=libsystemd" ];
--- a/pkgs/by-name/xf/xf86-input-cmt/package.nix
+++ b/pkgs/by-name/xf/xf86-input-cmt/package.nix
@ -1,48 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  pkg-config,
-  xorg-server,
-  xorgproto,
-  util-macros,
-  libgestures,
-  libevdevc,
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "xf86-input-cmt";
-  version = "2.0.2";
-  src = fetchFromGitHub {
-    owner = "hugegreenbug";
-    repo = "xf86-input-cmt";
-    rev = "v${finalAttrs.version}";
-    sha256 = "1cnwf518nc0ybc1r3rsgc1gcql1k3785khffv0i4v3akrm9wdw98";
-  };
-
-  postPatch = ''
-    patchShebangs ./apply_patches.sh
-    ./apply_patches.sh
-  '';
-
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [
-    xorg-server
-    xorgproto
-    util-macros
-    libgestures
-    libevdevc
-  ];
-
-  configureFlags = [
-    "--with-sdkdir=${placeholder "out"}"
-  ];
-
-  meta = {
-    description = "Chromebook touchpad driver";
-    license = lib.licenses.bsd3;
-    platforms = lib.platforms.linux;
-    homepage = "https://www.github.com/hugegreenbug/xf86-input-cmt";
-    maintainers = with lib.maintainers; [ kcalvinalvin ];
-  };
-})
--- a/pkgs/by-name/ya/yazi-unwrapped/package.nix
+++ b/pkgs/by-name/ya/yazi-unwrapped/package.nix
@ -8,17 +8,17 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "yazi";
-  version = "26.1.22";
+  version = "26.5.6";

  srcs = builtins.attrValues finalAttrs.passthru.srcs;

  sourceRoot = finalAttrs.passthru.srcs.code_src.name;

-  cargoHash = "sha256-VcoIjPZqLimo44atXh7pnCtF+QaZA7uHtKEE6FgTL2k=";
+  cargoHash = "sha256-gc0uEMNJ+eCIymXK10+Swi11xuyP5cj6MbLLB/ZDgXw=";

  env.YAZI_GEN_COMPLETIONS = true;
  env.VERGEN_GIT_SHA = "Nixpkgs";
-  env.VERGEN_BUILD_DATE = "2026-01-22";
+  env.VERGEN_BUILD_DATE = "2026-05-05";

  nativeBuildInputs = [ installShellFiles ];
  buildInputs = [ rust-jemalloc-sys ];
@ -36,18 +36,13 @@ rustPlatform.buildRustPackage (finalAttrs: {
    install -Dm444 assets/logo.png $out/share/pixmaps/yazi.png
  '';

-  postPatch = ''
-    substituteInPlace yazi-shared/Cargo.toml \
-      --replace-fail 'rust-version = "1.92.0"' 'rust-version = "1.91"'
-  '';
-
  passthru.updateScript.command = [ ./update.sh ];
  passthru.srcs = {
    code_src = fetchFromGitHub {
      owner = "sxyazi";
      repo = "yazi";
      tag = "v${finalAttrs.version}";
-      hash = "sha256-BZktPXn+8vyFyHapvW+9nepFsWRW/XBtdBcnLKrCNCw=";
+      hash = "sha256-sdaqZwLb+fBTg5Pd6WWfOWKCavsXWSSZrBEXuYuc8iM=";
    };

    man_src = fetchFromGitHub {
--- a/pkgs/by-name/ya/yazi-unwrapped/update.sh
+++ b/pkgs/by-name/ya/yazi-unwrapped/update.sh
@ -41,12 +41,12 @@ echo "Updating cargoHash"
 sed -i -E 's/cargoHash = ".*?"/cargoHash = ""/' package.nix

 # Build and get new hash
-cargoHash=$( (nix-build "$NIXPKGS_DIR" -A yazi-unwrapped 2>&1 || true) | awk '/got/{print $2}')
+cargoHash=$( (nix-build "$NIXPKGS_DIR" -A yazi-unwrapped 2>&1 || true) | awk '/got:/{print $2}')

 if [ "$cargoHash" == "" ]; then
    echo "Failed to get cargoHash, please update it manually"
    exit 0
 fi

-sed -i -E 's/cargoHash = ".*?"/cargoHash = "'"$cargoHash"'"/' package.nix
+sed -i -E 's#cargoHash = ".*?"#cargoHash = "'"$cargoHash"'"#' package.nix
 popd
--- a/pkgs/by-name/ya/yazi/plugins/split-tabs/default.nix
+++ b/pkgs/by-name/ya/yazi/plugins/split-tabs/default.nix
@ -11,8 +11,8 @@ mkYaziPlugin {
  src = fetchFromGitHub {
    owner = "terrakok";
    repo = "split-tabs.yazi";
-    rev = "ca95efc94a3a62e6e58c741f60801c1a0ddba1a6";
-    hash = "sha256-ic09opWZcoJ874bU2HN+5Y9mbnZEnvds+abqRQYuiYE=";
+    rev = "6da6089a0943bf5b9ee18942a890c294d4f227bc";
+    hash = "sha256-vIJNXmkIp5mjWuS/madKI/m9N8D4d6HaIyzeantrkig=";
  };

  meta = {
--- a/pkgs/by-name/yt/ytdl-sub/package.nix
+++ b/pkgs/by-name/yt/ytdl-sub/package.nix
@ -9,14 +9,14 @@

 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "ytdl-sub";
-  version = "2026.04.13.post1";
+  version = "2026.05.10.post1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "jmbannon";
    repo = "ytdl-sub";
    tag = finalAttrs.version;
-    hash = "sha256-nItpaxK2AuBn4yZLRGmUhqykawDIMZqxqPIXImZZwBE=";
+    hash = "sha256-lv82BqZHzAiQV8wAwZQ/BB/ohq+Sn2UlSNV6jFGE3Uk=";
  };

  postPatch = ''
--- a/pkgs/development/lua-modules/generated-packages.nix
+++ b/pkgs/development/lua-modules/generated-packages.nix
@ -1008,15 +1008,15 @@ final: prev: {
    }:
    buildLuarocksPackage {
      pname = "fzf-lua";
-      version = "0.0.2646-1";
+      version = "0.0.2648-1";
      knownRockspec =
        (fetchurl {
-          url = "mirror://luarocks/fzf-lua-0.0.2646-1.rockspec";
-          sha256 = "1mpvbkkj7lbmvcihz0f0sbh81g2y0kans1hj336298yc7mygj4b1";
+          url = "mirror://luarocks/fzf-lua-0.0.2648-1.rockspec";
+          sha256 = "0lkn7j9mfpv5vagp7xilki05k0ymrg22j95s2g8plg1fhvcykxxw";
        }).outPath;
      src = fetchzip {
-        url = "https://github.com/ibhagwan/fzf-lua/archive/97376e364f51f1b5ae3efaa3eb2e929430ca8419.zip";
-        sha256 = "029md3l7xccsnm3wwpdyi1mmxz7ha92c9qgx1qwqpnlc2p7cpdbm";
+        url = "https://github.com/ibhagwan/fzf-lua/archive/23f71140754b9162551dc8ccc1d6346e4275ecc2.zip";
+        sha256 = "0qw2chgv0zlwr524xi4ghxmfpn9nhxsbq7gga8i78sclsg7r8fhy";
      };

      disabled = luaOlder "5.1";
@ -1105,15 +1105,15 @@ final: prev: {
    }:
    buildLuarocksPackage {
      pname = "grug-far.nvim";
-      version = "1.6.68-1";
+      version = "1.6.69-1";
      knownRockspec =
        (fetchurl {
-          url = "mirror://luarocks/grug-far.nvim-1.6.68-1.rockspec";
-          sha256 = "1p5cmqb8k1ll8zmkmhf3q6vs73hfmzvmjlj9xxsirm8g697ya3sw";
+          url = "mirror://luarocks/grug-far.nvim-1.6.69-1.rockspec";
+          sha256 = "1fnk6s5kzq03ny3h18ap7454i2sv9c0ipbwl2zxhx1wkrpnbrnhy";
        }).outPath;
      src = fetchzip {
-        url = "https://github.com/MagicDuck/grug-far.nvim/archive/21790e59dd0109a92a70cb874dd002af186314f5.zip";
-        sha256 = "1zf9bf6l5069nx0yyv6bfk9y5f9589vxkhw4gy5f0qpn6j60h4qy";
+        url = "https://github.com/MagicDuck/grug-far.nvim/archive/a5875fde04e2940a5060f8df9c453bcfcfe0a5c0.zip";
+        sha256 = "0cygcm9giqxr701vn1dgq8bn3nvjnwl5f9shgxppdf5w9fw0l4bk";
      };

      disabled = luaOlder "5.1";
@ -5468,15 +5468,15 @@ final: prev: {
    }:
    buildLuarocksPackage {
      pname = "rocks.nvim";
-      version = "2.48.0-1";
+      version = "2.49.0-1";
      knownRockspec =
        (fetchurl {
-          url = "mirror://luarocks/rocks.nvim-2.48.0-1.rockspec";
-          sha256 = "125nhf4ncj1hdppy2w1c0c2j7ydhk0ai0caxcyn7qm69d1arqdix";
+          url = "mirror://luarocks/rocks.nvim-2.49.0-1.rockspec";
+          sha256 = "1krbnmx90avna2bzxvdv5zs7iakgkcm9w0dniingbhifkrkmiazr";
        }).outPath;
      src = fetchzip {
-        url = "https://github.com/lumen-oss/rocks.nvim/archive/v2.48.0.zip";
-        sha256 = "061a7xhnvqd2z3mhfpadlg51jsw1h7bb1g615bp07c9465diszcj";
+        url = "https://github.com/lumen-oss/rocks.nvim/archive/v2.49.0.zip";
+        sha256 = "13sr1alra4dlh22p6b53y6695zdv4vih3gdkvjfd7q3057ni7l20";
      };

      disabled = lua.luaversion != "5.1";
@ -5840,29 +5840,25 @@ final: prev: {
      ltreesitter,
      lua-cjson,
      luafilesystem,
-      luarocks-build-treesitter-parser,
      lusc_luv,
      luv,
      tl,
-      tree-sitter-cli,
-      tree-sitter-teal,
    }:
    buildLuarocksPackage {
      pname = "teal-language-server";
-      version = "0.1.2-1";
+      version = "0.1.3-1";
      knownRockspec =
        (fetchurl {
-          url = "mirror://luarocks/teal-language-server-0.1.2-1.rockspec";
-          sha256 = "1z7nbzhdqh2w7k635hbbfba2s37rxbcphaxq7dfsjfj3sgkj9snf";
+          url = "mirror://luarocks/teal-language-server-0.1.3-1.rockspec";
+          sha256 = "1mqg294rgzcfbfam0qdab3z93j7gsx250hs9f271337gqki34848";
        }).outPath;
      src = fetchFromGitHub {
        owner = "teal-language";
        repo = "teal-language-server";
-        tag = "0.1.2";
-        hash = "sha256-1ssgt+/e28TJ+1G1TWAPbZe5DiUYOafsSbc9exttesk=";
+        tag = "0.1.3";
+        hash = "sha256-XuHm6AbcBmv0fyQjlJlBMWqJlGYoveW7BEEN+axMRhw=";
      };

-      nativeBuildInputs = [ luarocks-build-treesitter-parser ];
      propagatedBuildInputs = [
        argparse
        inspect
@ -5872,8 +5868,6 @@ final: prev: {
        lusc_luv
        luv
        tl
-        tree-sitter-cli
-        tree-sitter-teal
      ];

      meta = {
@ -5939,8 +5933,8 @@ final: prev: {
      src = fetchFromGitHub {
        owner = "nvim-telescope";
        repo = "telescope.nvim";
-        rev = "f04ab730b8f9c6bf3f54a206d0dcddfd70c52d59";
-        hash = "sha256-M5cAQe0VxKwiOsLqXmlxNzd8xvLW+J1+Hd31PFmK+S8=";
+        rev = "7d324792b7943e4aa16ad007212e6acc6f9fe335";
+        hash = "sha256-+e/ijnuw0Zrj+zcfO2iRusukD4WHrgVC5reOTNk/04o=";
      };

      disabled = lua.luaversion != "5.1";
--- a/pkgs/development/lua-modules/overrides.nix
+++ b/pkgs/development/lua-modules/overrides.nix
@ -1170,9 +1170,7 @@ in
      substituteInPlace ''${rockspecFilename} \
        --replace-fail '"ltreesitter == 0.1.0",' '"ltreesitter >= 0.2.0",' \
        --replace-fail '"luv == 1.51.0",' '"luv >= 1.51.0",' \
-        --replace-fail '"tree-sitter-cli == 0.24.7",' "" \
-        --replace-fail '"tl == 0.24.5",' '"tl >= 0.24.5",' \
-        --replace-fail '"tree-sitter-teal == 0.0.34",' '"tree-sitter-teal >= 0.0.34",'
+        --replace-fail '"tl == 0.24.5",' '"tl >= 0.24.5",'
    '';
  });

--- a/pkgs/development/perl-modules/Math-Pari-darwin-callback-abi.patch
+++ b/pkgs/development/perl-modules/Math-Pari-darwin-callback-abi.patch
@ -0,0 +1,77 @@
+--- a/Pari.xs
+++ b/Pari.xs
+@@ -1518,21 +1518,63 @@
+ }
+ 
+ GEN
+-callPerlFunction(PerlFunctionArg1 long_ep, ...)
+-{
+-    GEN res;
+callPerlFunction_args(PerlFunctionArg1 long_ep, GEN *args)
+{
+     entree *ep = toEntreeP(long_ep);
+-    va_list args;
+     SV *cv = (SV*) ep->elt_CV;
+     int numargs = CV_NUMARGS_get(cv);
+-
+-    va_start(args, long_ep);
+-/*    warn("calling with numargs=%d", numargs); */
+-    res = callPerlFunction_va_list(G_SCALAR, numargs, cv, args);
+-/*    warn("ending call"); */
+-    va_end(args);
+-/*    warn("ended call"); */
+    GEN res;
+    int i;
+    dSP;
+    int count;
+    pari_sp oldavma = avma;
+    SV *oPariStack = PariStack;
+    SV *sv;
+
+    ENTER;
+    SAVETMPS;
+    SAVEINT(sentinel);
+    sentinel = avma;
+    PUSHMARK(sp);
+    EXTEND(sp, numargs + 1);
+    for (i = 0; i < numargs; i++)
+	PUSHs(pari2mortalsv(args[i], oldavma));
+    PUTBACK;
+    count = perl_call_sv(cv, G_SCALAR);
+
+    SPAGAIN;
+    if (count != 1)
+	croak("Perl function exported into PARI returns unexpected number %d of values (need 1)", count);
+
+    sv = SvREFCNT_inc(POPs);
+
+    PUTBACK;
+    FREETMPS;
+    LEAVE;
+
+    if (PariStack != oPariStack)
+	moveoffstack_newer_than(oPariStack);
+    res = sv2pari(sv);
+    res = myforcecopy(res);
+    SvREFCNT_dec(sv);
+
+     return res;
+}
+
+GEN
+callPerlFunction(PerlFunctionArg1 long_ep, GEN arg0, GEN arg1, GEN arg2, GEN arg3, GEN arg4, GEN arg5, GEN arg6, GEN arg7)
+{
+    GEN args[8];
+
+    args[0] = arg0;
+    args[1] = arg1;
+    args[2] = arg2;
+    args[3] = arg3;
+    args[4] = arg4;
+    args[5] = arg5;
+    args[6] = arg6;
+    args[7] = arg7;
+    return callPerlFunction_args(long_ep, args);
+ }
+ 
+ entree *
--- a/pkgs/development/python-modules/adb-enhanced/default.nix
+++ b/pkgs/development/python-modules/adb-enhanced/default.nix
@ -3,6 +3,7 @@
  buildPythonPackage,
  docopt,
  fetchFromGitHub,
+  fetchpatch,
  setuptools,
  jdk11,
  psutil,
@ -19,6 +20,13 @@ buildPythonPackage (finalAttrs: {
    tag = finalAttrs.version;
    hash = "sha256-YuQgz3WeN50hg/IgdoNV61St9gpu6lcgFfKCfI/ENl0=";
  };
+  patches = [
+    # psutil==7.2.1 -> psutil==7.2.2
+    (fetchpatch {
+      url = "https://github.com/ashishb/adb-enhanced/pull/337.patch";
+      hash = "sha256-BRpdgLS6CNkmyj+OwnIaqfkmz1jzZg/qtoiN32jUIog=";
+    })
+  ];

  build-system = [ setuptools ];

--- a/pkgs/development/python-modules/aioesphomeapi/default.nix
+++ b/pkgs/development/python-modules/aioesphomeapi/default.nix
@ -26,14 +26,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "aioesphomeapi";
-  version = "44.23.0";
+  version = "45.0.2";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "esphome";
    repo = "aioesphomeapi";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-mKk4NO44mVTV5Fe8oDhQYcNp8V1OLsPt4xk+kztXwrM=";
+    hash = "sha256-ajucVk5yF0akOIfBX28sjOndpmHQumJBUp5jnq//B+M=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/aioharmony/default.nix
+++ b/pkgs/development/python-modules/aioharmony/default.nix
@ -4,6 +4,7 @@
  async-timeout,
  buildPythonPackage,
  fetchFromGitHub,
+  pytest-asyncio,
  pytest-cov-stub,
  pytestCheckHook,
  setuptools,
@ -12,14 +13,14 @@

 buildPythonPackage rec {
  pname = "aioharmony";
-  version = "0.5.3";
+  version = "1.0.3";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "Harmony-Libs";
    repo = "aioharmony";
    tag = "v${version}";
-    hash = "sha256-H5zVY7LvTP8/CQtUGtXCXxOfG8GFQgdp7BY8jl9X+Gc=";
+    hash = "sha256-163L2ilmfMRL6qsD4RgWEX3kdKK6rnvjw9c78vKBtuE=";
  };

  build-system = [ setuptools ];
@ -31,6 +32,7 @@ buildPythonPackage rec {
  ];

  nativeCheckInputs = [
+    pytest-asyncio
    pytest-cov-stub
    pytestCheckHook
  ];
--- a/Show more
+++ b/Show more