Merge fbdfe58264 into haskell-updates

Linux was done in 8b266eba3a.

Release note: https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html

ci/default.nix

@@ -70,7 +70,7 @@ rec {
   };
   parse = pkgs.lib.recurseIntoAttrs {
     nix_latest = pkgs.callPackage ./parse.nix { nix = pkgs.nixVersions.latest; };
-    nix_2_28 = pkgs.callPackage ./parse.nix { nix = pkgs.nixVersions.nix_2_28; };
+    stable = pkgs.callPackage ./parse.nix { nix = pkgs.nixVersions.stable; };
     lix = pkgs.callPackage ./parse.nix { nix = pkgs.lix; };
     lix_latest = pkgs.callPackage ./parse.nix { nix = pkgs.lixPackageSets.latest.lix; };
   };

ci/pinned.json

@@ -9,9 +9,9 @@
       },
       "branch": "nixpkgs-unstable",
       "submodules": false,
-      "revision": "8c91a71d13451abc40eb9dae8910f972f979852f",
-      "url": "https://github.com/NixOS/nixpkgs/archive/8c91a71d13451abc40eb9dae8910f972f979852f.tar.gz",
-      "hash": "sha256-fnzKKPvS+oieI/pTzotA5tkoM47EB1NpaBcgk4R97hE="
+      "revision": "6edbf1a6a03e75886a6609c088801a0856449e88",
+      "url": "https://github.com/NixOS/nixpkgs/archive/6edbf1a6a03e75886a6609c088801a0856449e88.tar.gz",
+      "hash": "sha256-0lkauQbtrljJqwtzTCILPAiHAJyMvn6XDo264moDv30="
     }
   },
   "version": 8

ci/update-pinned.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p npins -I nixpkgs=../
+#!nix-shell -i bash -E 'with import ../. {}; mkShell { packages = [ npins ]; }'
 
 set -euo pipefail
 

doc/release-notes/rl-2611.section.md

@@ -70,6 +70,8 @@
 - `rebuilderd` has been updated to 0.27.0 introducing breaking changes. See upstream changelog for details: [0.26.0](https://github.com/kpcyrd/rebuilderd/releases/tag/v0.26.0), [0.27.0](https://github.com/kpcyrd/rebuilderd/releases/tag/v0.27.0)
 
 - Starting with v14, `flameshot` will primarily utilise xdg-desktop-portal calls for screenshotting. This will directly affect users on X11 window managers due to the lack of a compatible portal with Screenshot feature. See [upstream changelog](https://github.com/flameshot-org/flameshot/releases/tag/v14.0.0) or [NixOS Flameshot](https://wiki.nixos.org/wiki/Flameshot) wiki page for workarounds.
+- `nim1` and respective aliases have been removed due to entering EOL; please migrate to `nim` or `nim-unwrapped` (nim 2).
+- `nim-2_0` & `nim-2_2` and respective aliases have been removed; please migrate to `nim` or `nim-unwrapped` (nim 2.2.10).
 
 ## Other Notable Changes {#sec-nixpkgs-release-26.11-notable-changes}
 

maintainers/maintainer-list.nix

@@ -411,8 +411,8 @@
   };
   aaravrav = {
     name = "aaravrav";
-    github = "Aarav";
-    githubId = 3279912;
+    github = "aaravrav";
+    githubId = 37036762;
   };
   aarnphm = {
     email = "contact@aarnphm.xyz";

nixos/doc/manual/development/running-nixos-tests-interactively.section.md

@@ -43,6 +43,11 @@ test script).
 
 ## Shell access to VMs in interactive mode {#sec-nixos-test-shell-access}
 
+::: {.warning}
+Using `shell_interact()` is deprecated. Use the
+[interactive SSH backdoor](#sec-nixos-test-ssh-access) instead.
+:::
+
 The function `<yourmachine>.shell_interact()` grants access to a shell running
 inside a virtual machine. To use it, replace `<yourmachine>` with the name of a
 virtual machine defined in the test, for example: `machine.shell_interact()`.

nixos/doc/manual/release-notes/rl-2611.section.md

@@ -75,6 +75,8 @@
 
 - `komodo` has been updated to the v2 release line (2.x). See the [upstream v1 → v2 upgrade guide](https://github.com/moghtech/komodo/releases/tag/v2.0.0).
 
+- The `shell_interact()` function on interactive runs of NixOS VM tests has been deprecated. Use the SSH backdoor instead.
+
 - `security.run0.enableSudoAlias` now uses the `run0-sudo-shim` instead of a shell-script to improve compatibility.
 
 - With `system.etc.overlay.mutable = false`, NixOS now ships an empty `/etc/machine-id` in the image. Previously the file was absent and systemd logged `System cannot boot: Missing /etc/machine-id and /etc/ is read-only` while `ConditionFirstBoot` fired on every boot. With this change, systemd now overlays a transient ID from `/run/machine-id` for the session, and `systemd-machine-id-commit.service` has `ConditionFirstBoot` so it writes the machine-id through to a persistent backing file when one is bind-mounted over `/etc/machine-id`. To persist the machine-id across reboots, bind-mount a writable file containing `uninitialized` over `/etc/machine-id` from the initrd, or set `systemd.machine_id=` on the kernel command line (use `systemd.machine_id=firmware` to derive a stable ID on hardware that supports it).

nixos/lib/test-driver/src/test_driver/__init__.py

@@ -6,6 +6,7 @@ import warnings
 from pathlib import Path
 
 import ptpython.ipython
+import ptpython.repl
 from colorama import Fore, Style
 
 from test_driver.debug import Debug, DebugAbstract, DebugNop
@@ -174,6 +175,7 @@ def main() -> None:
         if args.interactive:
             history_dir = os.getcwd()
             history_path = os.path.join(history_dir, ".nixos-test-history")
+            ptpython.repl.enable_deprecation_warnings()
             ptpython.ipython.embed(
                 user_ns=driver.test_symbols(),
                 history_filename=history_path,

nixos/lib/test-driver/src/test_driver/machine/__init__.py

@@ -908,6 +908,7 @@ class QemuMachine(BaseMachine):
 
         return (rc, output.decode(errors="replace"))
 
+    @warnings.deprecated("Use the SSH backdoor instead")
     def shell_interact(self, address: str | None = None) -> None:
         """
         Allows you to directly interact with the guest shell. This should
@@ -1450,6 +1451,7 @@ class NspawnMachine(BaseMachine):
 
     machine_sock_path: Path
     machine_sock: socket.socket | None
+    notify_thread: threading.Thread | None
 
     @staticmethod
     def machine_name_from_start_command(start_command: str) -> str:
@@ -1480,6 +1482,12 @@ class NspawnMachine(BaseMachine):
 
         self.start_command = start_command
         self.process = None
+        self.notify_thread = None
+        # State maintained by the notify-socket drainer thread (see
+        # `_drain_notify_socket`). Guarded by `_notify_lock`.
+        self._notify_lock = threading.Lock()
+        self._notify_ready = False
+        self._notify_leader_pid: int | None = None
 
         self.machine_sock_path = self.tmp_dir / f"{self.name}-nspawn.sock"
 
@@ -1514,43 +1522,76 @@ class NspawnMachine(BaseMachine):
     def is_up(self) -> bool:
         return self.process is not None
 
-    def _poll_socket(self) -> tuple[bool, int | None]:
-        """Non-blocking check of container status via socket.
-        Returns (is_ready, leader_pid).
+    def _drain_notify_socket(self) -> None:
+        """Continuously drain the container's `sd_notify` socket (NOTIFY_SOCKET)
+        for the whole lifetime of the container, recording readiness and the
+        leader PID as they arrive.
+
+        Draining must not stop after boot: the container's PID 1 re-sends
+        `READY=1` on every `systemctl daemon-reexec` (the same Manager.Reexecute
+        that switch-to-configuration issues on a systemd change). If nothing
+        reads the socket, its receive buffer fills and PID 1 blocks in
+        `sendmsg()` to NOTIFY_SOCKET while re-executing -- it never finishes
+        re-initializing, and every later `systemctl` call inside the container
+        hangs or fails with `Transport endpoint is not connected`.
         """
         assert self.machine_sock is not None
-        ready = False
-        leader_pid = None
-        try:
-            data, _ = self.machine_sock.recvfrom(4096)
-            msg = data.decode()
-            for line in msg.splitlines():
+        sock = self.machine_sock
+        proc = self.process
+        assert proc is not None
+        # Bound the thread to the container's lifetime: on
+        # `wait_for_shutdown()` only non-None `proc.poll()` ends the loop.
+        # On exit of PID 1, any datagrams still queued are stale, so drop them.
+        while proc.poll() is None:
+            try:
+                # Block (with a timeout so we notice the container exiting)
+                # rather than busy-poll; we just need to keep the buffer empty.
+                sock.settimeout(0.5)
+                data, _ = sock.recvfrom(4096)
+            except (TimeoutError, BlockingIOError):
+                continue
+            except OSError:
+                break
+            ready = False
+            leader_pid = None
+            for line in data.decode(errors="replace").splitlines():
                 if line == "READY=1":
                     ready = True
                 if line.startswith("X_NSPAWN_LEADER_PID="):
                     leader_pid = int(line.split("=")[1])
-        except OSError:
-            pass
-        return ready, leader_pid
+            if ready or leader_pid is not None:
+                with self._notify_lock:
+                    if ready:
+                        self._notify_ready = True
+                    if leader_pid is not None:
+                        self._notify_leader_pid = leader_pid
 
     @cached_property
     def get_systemd_process(self) -> int:
-        """Block until startup is complete and return the PID of the container's systemd process."""
-        assert self.process is not None
+        """Block until startup is complete and return the PID of the container's systemd process.
 
-        container_pid: int | None = None
-        is_ready = False
+        Readiness and the leader PID are reported over NOTIFY_SOCKET, which is
+        drained by `_drain_notify_socket` (started in `start()`); we just wait
+        for that thread to record both.
+        """
+        assert self.process is not None
 
         start_time = time.monotonic()
         last_warning = start_time
         delay = 0.01
         max_delay = 0.5
 
-        while not is_ready or container_pid is None:
-            # Poll the socket until we have the container leader PID
+        # Poll the socket until we have the container leader PID
+        while True:
             if self.process.poll() is not None:
                 raise MachineError("systemd-nspawn process exited unexpectedly")
 
+            with self._notify_lock:
+                is_ready = self._notify_ready
+                container_pid = self._notify_leader_pid
+            if is_ready and container_pid is not None:
+                return container_pid
+
             # Print periodic warnings every 10s so the user knows we aren't deadlocked
             now = time.monotonic()
             if now - last_warning > 10.0:
@@ -1559,18 +1600,8 @@ class NspawnMachine(BaseMachine):
                 )
                 last_warning = now
 
-            # Poll and update our local tracking variables
-            ready_now, pid_now = self._poll_socket()
-            if ready_now:
-                is_ready = True
-            if pid_now:
-                container_pid = pid_now
-
-            if not (is_ready and container_pid):
-                time.sleep(delay)
-                delay = min(delay * 2, max_delay)
-
-        return container_pid
+            time.sleep(delay)
+            delay = min(delay * 2, max_delay)
 
     def _execute(
         self,
@@ -1684,7 +1715,6 @@ class NspawnMachine(BaseMachine):
 
         self.machine_sock = socket.socket(family=socket.AF_UNIX, type=socket.SOCK_DGRAM)
         self.machine_sock.bind(str(self.machine_sock_path))
-        self.machine_sock.setblocking(False)
 
         self.process = subprocess.Popen(
             [self.start_command],
@@ -1700,6 +1730,13 @@ class NspawnMachine(BaseMachine):
 
         self.log(f"systemd-nspawn running (pid {self.process.pid})")
 
+        # Keep the notify socket drained for the container's whole lifetime, so
+        # PID 1 never blocks re-sending `READY=1` on `daemon-reexec`.
+        self.notify_thread = threading.Thread(
+            target=self._drain_notify_socket, daemon=True
+        )
+        self.notify_thread.start()
+
         journal_thread = threading.Thread(target=self._stream_journal, daemon=True)
         journal_thread.start()
 

nixos/modules/programs/immersed.nix

@@ -26,6 +26,12 @@ in
     programs.immersed = {
       enable = lib.mkEnableOption "immersed";
 
+      openFirewall = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = "Whether to open firewall ports for Immersed";
+      };
+
       package = lib.mkPackageOption pkgs "immersed" { };
     };
   };
@@ -43,6 +49,15 @@ in
     };
 
     environment.systemPackages = [ cfg.package ];
+
+    # https://immersed.helpscoutdocs.com/article/23-connection-troubleshooting-linux
+    networking.firewall = lib.mkIf cfg.openFirewall {
+      allowedTCPPorts = [ 21000 ];
+      allowedUDPPorts = [
+        21000
+        21010
+      ];
+    };
   };
 
   meta.maintainers = pkgs.immersed.meta.maintainers;

nixos/modules/services/web-apps/cloudlog.nix

@@ -62,17 +62,14 @@ let
       ln -s ${configFile} $out/application/config/config.php
       ln -s ${dbFile} $out/application/config/database.php
 
+      # make a copy of the original assets/json to prime the datadir
+      cp -a "$out/assets/json/" "$out/assets/json.original/"
+
       # link writable directories
-      for directory in updates uploads backup logbook; do
+      for directory in updates uploads backup logbook assets/qslcard images/eqsl_card_images assets/sstvimages assets/json; do
         rm -rf $out/$directory
         ln -s ${cfg.dataDir}/$directory $out/$directory
       done
-
-      # link writable asset files
-      for asset in dok sota wwff; do
-        rm -rf $out/assets/json/$asset.txt
-        ln -s ${cfg.dataDir}/assets/json/$asset.txt $out/assets/json/$asset.txt
-      done
     '';
   };
 in
@@ -503,13 +500,26 @@ in
           group = config.services.nginx.group;
         in
         [
-          "d ${cfg.dataDir}                0750 ${cfg.user} ${group} - -"
-          "d ${cfg.dataDir}/updates        0750 ${cfg.user} ${group} - -"
-          "d ${cfg.dataDir}/uploads        0750 ${cfg.user} ${group} - -"
-          "d ${cfg.dataDir}/backup         0750 ${cfg.user} ${group} - -"
-          "d ${cfg.dataDir}/logbook        0750 ${cfg.user} ${group} - -"
-          "d ${cfg.dataDir}/assets/json    0750 ${cfg.user} ${group} - -"
-          "d ${cfg.dataDir}/assets/qslcard 0750 ${cfg.user} ${group} - -"
+          "d ${cfg.dataDir}                         0750 ${cfg.user} ${group} - -"
+          "d ${cfg.dataDir}/updates                 0750 ${cfg.user} ${group} - -"
+          "d ${cfg.dataDir}/uploads                 0750 ${cfg.user} ${group} - -"
+          "d ${cfg.dataDir}/backup                  0750 ${cfg.user} ${group} - -"
+          "d ${cfg.dataDir}/logbook                 0750 ${cfg.user} ${group} - -"
+          "d ${cfg.dataDir}/assets                  0750 ${cfg.user} ${group} - -"
+          "d ${cfg.dataDir}/assets/json             0750 ${cfg.user} ${group} - -"
+          "d ${cfg.dataDir}/assets/qslcard          0750 ${cfg.user} ${group} - -"
+          "d ${cfg.dataDir}/assets/sstvimages       0750 ${cfg.user} ${group} - -"
+          "d ${cfg.dataDir}/images                  0750 ${cfg.user} ${group} - -"
+          "d ${cfg.dataDir}/images/eqsl_card_images 0750 ${cfg.user} ${group} - -"
+          "C ${cfg.dataDir}/assets/json/dok.txt                              0640 ${cfg.user} ${group} - ${package}/assets/json.original/dok.txt"
+          "C ${cfg.dataDir}/assets/json/pota.txt                             0640 ${cfg.user} ${group} - ${package}/assets/json.original/pota.txt"
+          "C ${cfg.dataDir}/assets/json/satellite_data.json                  0640 ${cfg.user} ${group} - ${package}/assets/json.original/satellite_data.json"
+          "C ${cfg.dataDir}/assets/json/sota.txt                             0640 ${cfg.user} ${group} - ${package}/assets/json.original/sota.txt"
+          "C ${cfg.dataDir}/assets/json/US_counties.csv                      0640 ${cfg.user} ${group} - ${package}/assets/json.original/US_counties.csv"
+          "C ${cfg.dataDir}/assets/json/us_national_parksontheair.csv        0640 ${cfg.user} ${group} - ${package}/assets/json.original/us_national_parksontheair.csv"
+          "C ${cfg.dataDir}/assets/json/WABSquares.geojson                   0640 ${cfg.user} ${group} - ${package}/assets/json.original/WABSquares.geojson"
+          "C ${cfg.dataDir}/assets/json/wwff.txt                             0640 ${cfg.user} ${group} - ${package}/assets/json.original/wwff.txt"
+          "C+ ${cfg.dataDir}/assets/json/datatables_languages                0750 ${cfg.user} ${group} - ${package}/assets/json.original/datatables_languages"
         ];
     };
 

nixos/modules/services/web-apps/lasuite-meet.nix

@@ -36,48 +36,62 @@ let
       toString value
   ) cfg.settings;
 
-  commonServiceConfig = {
-    RuntimeDirectory = "lasuite-meet";
-    StateDirectory = "lasuite-meet";
-    WorkingDirectory = "/var/lib/lasuite-meet";
+  commonSystemdConfig = {
+    after = [
+      "network.target"
+    ]
+    ++ (optional cfg.postgresql.createLocally "postgresql.service")
+    ++ (optional cfg.redis.createLocally "redis-lasuite-meet.service");
 
-    User = "lasuite-meet";
-    DynamicUser = true;
-    SupplementaryGroups = mkIf cfg.redis.createLocally [
-      config.services.redis.servers.lasuite-meet.group
-    ];
-    # hardening
-    AmbientCapabilities = "";
-    CapabilityBoundingSet = [ "" ];
-    DevicePolicy = "closed";
-    LockPersonality = true;
-    NoNewPrivileges = true;
-    PrivateDevices = true;
-    PrivateTmp = true;
-    PrivateUsers = true;
-    ProcSubset = "pid";
-    ProtectClock = true;
-    ProtectControlGroups = true;
-    ProtectHome = true;
-    ProtectHostname = true;
-    ProtectKernelLogs = true;
-    ProtectKernelModules = true;
-    ProtectKernelTunables = true;
-    ProtectProc = "invisible";
-    ProtectSystem = "strict";
-    RemoveIPC = true;
-    RestrictAddressFamilies = [
-      "AF_INET"
-      "AF_INET6"
-      "AF_UNIX"
-    ];
-    RestrictNamespaces = true;
-    RestrictRealtime = true;
-    RestrictSUIDSGID = true;
-    SystemCallArchitectures = "native";
-    MemoryDenyWriteExecute = true;
-    EnvironmentFile = optional (cfg.environmentFile != null) cfg.environmentFile;
-    UMask = "0077";
+    wants =
+      (optional cfg.postgresql.createLocally "postgresql.service")
+      ++ (optional cfg.redis.createLocally "redis-lasuite-meet.service");
+
+    environment = pythonEnvironment;
+
+    serviceConfig = {
+      RuntimeDirectory = "lasuite-meet";
+      StateDirectory = "lasuite-meet";
+      WorkingDirectory = "/var/lib/lasuite-meet";
+
+      User = "lasuite-meet";
+      DynamicUser = true;
+      SupplementaryGroups = mkIf cfg.redis.createLocally [
+        config.services.redis.servers.lasuite-meet.group
+      ];
+      # hardening
+      AmbientCapabilities = "";
+      CapabilityBoundingSet = [ "" ];
+      DevicePolicy = "closed";
+      LockPersonality = true;
+      NoNewPrivileges = true;
+      PrivateDevices = true;
+      PrivateTmp = true;
+      PrivateUsers = true;
+      ProcSubset = "pid";
+      ProtectClock = true;
+      ProtectControlGroups = true;
+      ProtectHome = true;
+      ProtectHostname = true;
+      ProtectKernelLogs = true;
+      ProtectKernelModules = true;
+      ProtectKernelTunables = true;
+      ProtectProc = "invisible";
+      ProtectSystem = "strict";
+      RemoveIPC = true;
+      RestrictAddressFamilies = [
+        "AF_INET"
+        "AF_INET6"
+        "AF_UNIX"
+      ];
+      RestrictNamespaces = true;
+      RestrictRealtime = true;
+      RestrictSUIDSGID = true;
+      SystemCallArchitectures = "native";
+      MemoryDenyWriteExecute = true;
+      EnvironmentFile = optional (cfg.environmentFile != null) cfg.environmentFile;
+      UMask = "0077";
+    };
   };
 in
 {
@@ -342,74 +356,54 @@ in
   };
 
   config = mkIf cfg.enable {
-    systemd.services.lasuite-meet = {
-      description = "Meet from SuiteNumérique";
-      after = [
-        "network.target"
-      ]
-      ++ (optional cfg.postgresql.createLocally "postgresql.service")
-      ++ (optional cfg.redis.createLocally "redis-lasuite-meet.service");
+    systemd.services.lasuite-meet = lib.mkMerge [
+      {
+        description = "Meet from SuiteNumérique";
 
-      wants =
-        (optional cfg.postgresql.createLocally "postgresql.service")
-        ++ (optional cfg.redis.createLocally "redis-lasuite-meet.service");
+        wantedBy = [ "multi-user.target" ];
 
-      wantedBy = [ "multi-user.target" ];
-
-      preStart = ''
-        if [ ! -f .version ]; then
-          touch .version
-        fi
-
-        ${optionalString (cfg.secretKeyPath == null) ''
-          if [[ ! -f /var/lib/lasuite-meet/django_secret_key ]]; then
-            (
-              umask 0377
-              tr -dc A-Za-z0-9 < /dev/urandom | head -c64 | ${pkgs.moreutils}/bin/sponge /var/lib/lasuite-meet/django_secret_key
-            )
+        preStart = ''
+          if [ ! -f .version ]; then
+            touch .version
           fi
-        ''}
-        if [ "${cfg.package.version}" != "$(cat .version)" ]; then
-          ${getExe cfg.package} migrate
-          echo -n "${cfg.package.version}" > .version
-        fi
-      '';
 
-      environment = pythonEnvironment;
+          ${optionalString (cfg.secretKeyPath == null) ''
+            if [[ ! -f /var/lib/lasuite-meet/django_secret_key ]]; then
+              (
+                umask 0377
+                tr -dc A-Za-z0-9 < /dev/urandom | head -c64 | ${pkgs.moreutils}/bin/sponge /var/lib/lasuite-meet/django_secret_key
+              )
+            fi
+          ''}
+          if [ "${cfg.package.version}" != "$(cat .version)" ]; then
+            ${getExe cfg.package} migrate
+            echo -n "${cfg.package.version}" > .version
+          fi
+        '';
 
-      serviceConfig = {
-        BindReadOnlyPaths = "${cfg.package}/share/static:/var/lib/lasuite-meet/static";
+        serviceConfig = {
+          BindReadOnlyPaths = "${cfg.package}/share/static:/var/lib/lasuite-meet/static";
 
-        ExecStart = utils.escapeSystemdExecArgs (
-          [
-            (lib.getExe' cfg.package "gunicorn")
-            "--bind=${cfg.bind}"
-          ]
-          ++ cfg.gunicorn.extraArgs
-          ++ [ "meet.wsgi:application" ]
-        );
+          ExecStart = utils.escapeSystemdExecArgs (
+            [
+              (lib.getExe' cfg.package "gunicorn")
+              "--bind=${cfg.bind}"
+            ]
+            ++ cfg.gunicorn.extraArgs
+            ++ [ "meet.wsgi:application" ]
+          );
+        };
       }
-      // commonServiceConfig;
-    };
+      commonSystemdConfig
+    ];
 
-    systemd.services.lasuite-meet-celery = {
-      description = "Meet Celery broker from SuiteNumérique";
-      after = [
-        "network.target"
-      ]
-      ++ (optional cfg.postgresql.createLocally "postgresql.service")
-      ++ (optional cfg.redis.createLocally "redis-lasuite-meet.service");
+    systemd.services.lasuite-meet-celery = lib.mkMerge [
+      {
+        description = "Meet Celery broker from SuiteNumérique";
 
-      wants =
-        (optional cfg.postgresql.createLocally "postgresql.service")
-        ++ (optional cfg.redis.createLocally "redis-lasuite-meet.service");
+        wantedBy = [ "multi-user.target" ];
 
-      wantedBy = [ "multi-user.target" ];
-
-      environment = pythonEnvironment;
-
-      serviceConfig = {
-        ExecStart = utils.escapeSystemdExecArgs (
+        serviceConfig.ExecStart = utils.escapeSystemdExecArgs (
           [ (lib.getExe' cfg.package "celery") ]
           ++ cfg.celery.extraArgs
           ++ [
@@ -418,8 +412,26 @@ in
           ]
         );
       }
-      // commonServiceConfig;
-    };
+      commonSystemdConfig
+    ];
+
+    systemd.services.lasuite-meet-clean-pending-files = lib.mkMerge [
+      {
+        description = "Scheduled job to clean up pending uploads from LaSuite Meet";
+        startAt = "daily";
+        serviceConfig.ExecStart = "${getExe cfg.package} clean_pending_files";
+      }
+      commonSystemdConfig
+    ];
+
+    systemd.services.lasuite-meet-purge-deleted-files = lib.mkMerge [
+      {
+        description = "Scheduled job to purge deleted files from LaSuite Meet";
+        startAt = "daily";
+        serviceConfig.ExecStart = "${getExe cfg.package} purge_deleted_files";
+      }
+      commonSystemdConfig
+    ];
 
     services.postgresql = mkIf cfg.postgresql.createLocally {
       enable = true;

nixos/tests/all-tests.nix

@@ -152,6 +152,7 @@ in
     ssh-backdoor = runTestOn [ "x86_64-linux" ] ./nixos-test-driver/ssh-backdoor.nix;
     console-log = runTest ./nixos-test-driver/console-log.nix;
     containers = runTest ./nixos-test-driver/containers.nix;
+    nspawn-daemon-reexec-dbus = runTest ./nspawn-daemon-reexec-dbus.nix;
     skip-typecheck = runTest ./nixos-test-driver/skip-typecheck.nix;
     options-doc-regression = import ./nixos-test-driver/options-doc-regression.nix { inherit pkgs; };
     driver-timeout =

nixos/tests/nspawn-daemon-reexec-dbus.nix

@@ -0,0 +1,79 @@
+# Regression test for an nspawn-only systemd re-exec failure that broke D-Bus.
+#
+# Demonstrates `systemctl show` keeps working on `daemon-reexec`.
+#
+# Trigger: `systemctl daemon-reexec` issues a D-Bus `Manager.Reexecute`, like
+# `switch-to-configuration-ng` on a systemd package change.
+#
+# Root cause: inside nspawn test containers PID 1 re-send `READY=1` on the
+# `NOTIFY_SOCKET` on re-exec. The test driver stopped draining that socket
+# after boot, so until drained its receive buffer filled and `systemctl` hung /
+# errored `Failed to connect to bus: Transport endpoint is not connected`.
+{ ... }:
+{
+  name = "nspawn-daemon-reexec-dbus";
+
+  # `containers.<name>` => systemd-nspawn machine (vs `nodes.<name>` => QEMU).
+  # An empty container boots full systemd + D-Bus, which is all we need.
+  containers.machine = { };
+
+  testScript = # python
+    ''
+      import re
+
+      BUS_BROKEN = re.compile(
+          r"Transport endpoint is not connected|Failed to connect to bus"
+      )
+
+      # Without the fix the notify socket's receive buffer fills after 10
+      # undrained `READY=1` resends, so PID 1 blocks then.
+      REEXECS = 10
+
+
+      def bus_broken():
+          """Whether the in-container D-Bus is unusable. A broken bus prints a
+          transport error or hangs until `timeout` kills it (status 124); both
+          count as broken."""
+          status, out = machine.execute(
+              "timeout 10 systemctl show -p ActiveState --value "
+              "multi-user.target 2>&1",
+              check_return=False,
+              timeout=20,
+          )
+          return status != 0 or bool(BUS_BROKEN.search(out)), status, out
+
+
+      machine.start()
+      machine.wait_for_unit("multi-user.target", timeout=120)
+
+      # Pre-reexec sanity: the bus works and shows no break.
+      broken, status, out = bus_broken()
+      assert not broken, (
+          f"bus already broken before any reexec: status={status} out={out!r}"
+      )
+      machine.log(f"pre-reexec sanity OK: {out.strip()!r}")
+
+      broke_at = None
+      for i in range(1, REEXECS + 1):
+          # The same D-Bus Manager.Reexecute that switch-to-configuration issues
+          # on a systemd change.
+          machine.execute(
+              "timeout 30 systemctl daemon-reexec",
+              check_return=False,
+              timeout=45,
+          )
+          broken, status, out = bus_broken()
+          machine.log(f"[reexec {i}] status={status} out={out.strip()!r}")
+          if broken:
+              broke_at = i
+              break
+
+      assert broke_at is None, (
+          f"nspawn D-Bus broke after daemon-reexec #{broke_at} of {REEXECS} "
+          "(systemctl hung or returned a bus transport error). The re-exec'd "
+          "PID 1 never finished re-initialising -- the test driver stopped "
+          "draining the notify socket, so PID 1's READY=1 resend blocked. "
+          "Never observed on QEMU."
+      )
+    '';
+}

nixos/tests/web-apps/immich.nix

@@ -8,7 +8,7 @@
       # These tests need a little more juice
       virtualisation = {
         cores = 2;
-        memorySize = 2048;
+        memorySize = 4096;
         diskSize = 4096;
       };
 

pkgs/applications/editors/emacs/elisp-packages/manual-packages/ghostel/package.nix

@@ -14,13 +14,13 @@ let
 
   pname = "ghostel";
 
-  version = "0.39.0-unstable-2026-06-26";
+  version = "0.41.0-unstable-2026-07-05";
 
   src = fetchFromGitHub {
     owner = "dakra";
     repo = "ghostel";
-    rev = "92bfcc57dc85f254ce95dcb51dbdd2411fea5f02";
-    hash = "sha256-havDs3fZENB/ozMWWKQkdsyHUIBIeewmrjL+3xJKM94=";
+    rev = "f77efee9172854abc08652637d23adc26faa25a2";
+    hash = "sha256-6ME+aStZ9X1pkTr0uwwhrJXEHu/uLStPHsKtbudXl9I=";
   };
 
   module = stdenv.mkDerivation (finalAttrs: {
@@ -29,7 +29,7 @@ let
     deps = zig.fetchDeps {
       inherit (finalAttrs) src pname version;
       fetchAll = true;
-      hash = "sha256-CTsG3dXu3DECDbklBAtr2fYou82WNvQ1Q3JET0TmuyM=";
+      hash = "sha256-lFU0ywNyP1q2NL9MkIfWciH03VAA/Act5dGYAV4V7EY=";
     };
 
     nativeBuildInputs = [ zig ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ xcbuild ];
@@ -48,19 +48,6 @@ let
 
     zigBuildFlags = finalAttrs.zigCheckFlags;
 
-    postPatch = ''
-      # https://github.com/dakra/ghostel/issues/446
-      substituteInPlace build.zig \
-        --replace-fail 'addInstallFile(version_file, "../ghostel-module.version")' \
-                       'addInstallFile(version_file, "ghostel-module.version")'
-
-      # remove copy_step
-      substituteInPlace build.zig \
-        --replace-fail 'b.getInstallStep().dependOn(&copy_step.step);' ' ' \
-        --replace-fail 'const copy_step = b.addInstallFile' \
-                       '_ = b.addInstallFile'
-    '';
-
     postConfigure = ''
       cp -rLT ${finalAttrs.deps} "$ZIG_GLOBAL_CACHE_DIR/p"
       chmod -R u+w "$ZIG_GLOBAL_CACHE_DIR/p"
@@ -77,7 +64,7 @@ melpaBuild {
   '';
 
   preBuild = ''
-    install ${module}/lib/libghostel-module${libExt} ghostel-module${libExt}
+    install ${module}/ghostel-module${libExt} ghostel-module${libExt}
     install --mode=444 ${module}/ghostel-module.version ghostel-module.version
   '';
 

pkgs/applications/editors/emacs/elisp-packages/manual-packages/treesit-grammars/package.nix

@@ -15,9 +15,9 @@ let
 
   # Usage:
   # treesit-grammars.with-grammars (p: [ p.tree-sitter-bash p.tree-sitter-c ... ])
-  with-grammars = fn: grammarPackage (fn pkgs.tree-sitter.builtGrammars);
+  with-grammars = fn: grammarPackage (fn pkgs.tree-sitter-grammars.derivations);
 
-  with-all-grammars = grammarPackage pkgs.tree-sitter.allGrammars;
+  with-all-grammars = grammarPackage pkgs.tree-sitter-grammars.allGrammars;
 in
 {
   inherit with-grammars with-all-grammars;

pkgs/applications/editors/jetbrains/ides/clion.nix

@@ -21,20 +21,20 @@ let
   # update-script-start: urls
   urls = {
     x86_64-linux = {
-      url = "https://download.jetbrains.com/cpp/CLion-2026.1.2.tar.gz";
-      hash = "sha256-Q3LOhpwpU6vrPWEzA+s2ZnbRxo+EeodBUHUYs3Xikrs=";
+      url = "https://download.jetbrains.com/cpp/CLion-2026.1.4.tar.gz";
+      hash = "sha256-uOhFuDqVw3pxtqBvOQH+FpJTFrneaD/R0VcpJZRYD2o=";
     };
     aarch64-linux = {
-      url = "https://download.jetbrains.com/cpp/CLion-2026.1.2-aarch64.tar.gz";
-      hash = "sha256-YM105ozP78oLDmwKL0t4Z4wGjCDh6xvhf/C1oCD6Qi8=";
+      url = "https://download.jetbrains.com/cpp/CLion-2026.1.4-aarch64.tar.gz";
+      hash = "sha256-I6IKQng4lNtRlQIq08K5bueqgKI/q1awX4EuRnyAnOk=";
     };
     x86_64-darwin = {
-      url = "https://download.jetbrains.com/cpp/CLion-2026.1.2.dmg";
-      hash = "sha256-UEkYDJBjRvvUUB2UFsc37kdp/i+1ctqULSKs62/t9/I=";
+      url = "https://download.jetbrains.com/cpp/CLion-2026.1.4.dmg";
+      hash = "sha256-AJt+K1zv4eyjdzubUeFGwB9mqzvOeb3ffA2k0MajPBs=";
     };
     aarch64-darwin = {
-      url = "https://download.jetbrains.com/cpp/CLion-2026.1.2-aarch64.dmg";
-      hash = "sha256-scMwDF+mIfx/66cBrvdxp+gU3+qA2sUWqoGCEhPItjE=";
+      url = "https://download.jetbrains.com/cpp/CLion-2026.1.4-aarch64.dmg";
+      hash = "sha256-i3stX7dyRgSOJkFTMD9/hkw6e2mGNqn13S7X/vJ66RQ=";
     };
   };
   # update-script-end: urls
@@ -48,8 +48,8 @@ in
   product = "CLion";
 
   # update-script-start: version
-  version = "2026.1.2";
-  buildNumber = "261.24374.148";
+  version = "2026.1.4";
+  buildNumber = "261.26222.59";
   # update-script-end: version
 
   src = fetchurl (urls.${system} or (throw "Unsupported system: ${system}"));

pkgs/applications/editors/jetbrains/ides/goland.nix

@@ -12,20 +12,20 @@ let
   # update-script-start: urls
   urls = {
     x86_64-linux = {
-      url = "https://download.jetbrains.com/go/goland-2026.1.2.tar.gz";
-      hash = "sha256-1FkDEaapyDbTPe4soOdyCHLkp/UT3rZ6siGyGyjmGJo=";
+      url = "https://download.jetbrains.com/go/goland-2026.1.4.tar.gz";
+      hash = "sha256-pHSbmAZ+tSfa0wdtDp/3Ib/GNMP30OFNQlHWUfMwrW0=";
     };
     aarch64-linux = {
-      url = "https://download.jetbrains.com/go/goland-2026.1.2-aarch64.tar.gz";
-      hash = "sha256-E8WpA4s/ePEDAs47IPC0v10C1VKl9UYU7VNX/5igpm4=";
+      url = "https://download.jetbrains.com/go/goland-2026.1.4-aarch64.tar.gz";
+      hash = "sha256-7s98kY08aKjdRGQLDkffeVhgj1FWurLmTTYmtb5Qx6c=";
     };
     x86_64-darwin = {
-      url = "https://download.jetbrains.com/go/goland-2026.1.2.dmg";
-      hash = "sha256-iWYTMImwzMh9KSJgek8a84o/KlLWBaOj80vKlB8Ftes=";
+      url = "https://download.jetbrains.com/go/goland-2026.1.4.dmg";
+      hash = "sha256-RbvcLpLVyeL4B1DJ2/9Ub/6Cz6fJGXMPCHsJ705GsAo=";
     };
     aarch64-darwin = {
-      url = "https://download.jetbrains.com/go/goland-2026.1.2-aarch64.dmg";
-      hash = "sha256-TFnEMq7u51UvtaOjnxS+abJhsR3aSnaQjNFfF8EQrcQ=";
+      url = "https://download.jetbrains.com/go/goland-2026.1.4-aarch64.dmg";
+      hash = "sha256-y7mEke0z0MvQs+kMtrmrq7EeAtJUbgo6sGZrOB0MraM=";
     };
   };
   # update-script-end: urls
@@ -39,8 +39,8 @@ in
   product = "Goland";
 
   # update-script-start: version
-  version = "2026.1.2";
-  buildNumber = "261.24374.154";
+  version = "2026.1.4";
+  buildNumber = "261.26222.72";
   # update-script-end: version
 
   src = fetchurl (urls.${system} or (throw "Unsupported system: ${system}"));

pkgs/applications/editors/jetbrains/ides/idea.nix

@@ -15,20 +15,20 @@ let
   # update-script-start: urls
   urls = {
     x86_64-linux = {
-      url = "https://download.jetbrains.com/idea/ideaIU-2026.1.3.tar.gz";
-      hash = "sha256-pvBJcW2h0J2eDsFQDGC/AaX/ig/iQZF43R/y/bK3dWM=";
+      url = "https://download.jetbrains.com/idea/ideaIU-2026.1.4.tar.gz";
+      hash = "sha256-MQTYXZUH/4ggZeP465UGQCtKgSkJLSaCZiu26cTwY/w=";
     };
     aarch64-linux = {
-      url = "https://download.jetbrains.com/idea/ideaIU-2026.1.3-aarch64.tar.gz";
-      hash = "sha256-dlnnkWCSM8Pmv2fBv8yG9foRdkd8pYFa5hJbDq6EqIs=";
+      url = "https://download.jetbrains.com/idea/ideaIU-2026.1.4-aarch64.tar.gz";
+      hash = "sha256-MDZFuLrUxcCIc0Zhi4QhgKPeU7Pgs9oJ/FxQH1n3gBM=";
     };
     x86_64-darwin = {
-      url = "https://download.jetbrains.com/idea/ideaIU-2026.1.3.dmg";
-      hash = "sha256-Sv6A37Y5yIkaE+qnFEGDBq/q9fSSSZPjJC59NB2Fsns=";
+      url = "https://download.jetbrains.com/idea/ideaIU-2026.1.4.dmg";
+      hash = "sha256-8K+LiewiINP4S9eqV0kGWtfy2Ff/zvBwX89iX7mYZ78=";
     };
     aarch64-darwin = {
-      url = "https://download.jetbrains.com/idea/ideaIU-2026.1.3-aarch64.dmg";
-      hash = "sha256-LRyg2DLmTgChdFKR8NMGGjWDZTAWnjQpoTp3NIBvYrI=";
+      url = "https://download.jetbrains.com/idea/ideaIU-2026.1.4-aarch64.dmg";
+      hash = "sha256-XIBK/+Lxaz9dX+Lxl7HXsl+Z3Z7GBzSuDxNssb/4A2s=";
     };
   };
   # update-script-end: urls
@@ -43,8 +43,8 @@ mkJetBrainsProduct {
   productShort = "IDEA";
 
   # update-script-start: version
-  version = "2026.1.3";
-  buildNumber = "261.25134.95";
+  version = "2026.1.4";
+  buildNumber = "261.26222.65";
   # update-script-end: version
 
   src = fetchurl (urls.${system} or (throw "Unsupported system: ${system}"));

pkgs/applications/editors/jetbrains/ides/phpstorm.nix

@@ -12,20 +12,20 @@ let
   # update-script-start: urls
   urls = {
     x86_64-linux = {
-      url = "https://download.jetbrains.com/webide/PhpStorm-2026.1.3.tar.gz";
-      hash = "sha256-hXb2KcCaNKIJOGbN0ZUDxMKuX++dO1FRoxvC580VIHQ=";
+      url = "https://download.jetbrains.com/webide/PhpStorm-2026.1.4.tar.gz";
+      hash = "sha256-SF25D7dDn7b6AzcXEDLKwhpjTnCqYz1fEmvND5dl8Is=";
     };
     aarch64-linux = {
-      url = "https://download.jetbrains.com/webide/PhpStorm-2026.1.3-aarch64.tar.gz";
-      hash = "sha256-+As41qcyCvAICIttMEi30b8mBTZoWKK4rjxjkVx4TXs=";
+      url = "https://download.jetbrains.com/webide/PhpStorm-2026.1.4-aarch64.tar.gz";
+      hash = "sha256-T9q3/nxv/AA6y7CHWtOhUibR7bnKN8OZmfN3NWYTsIQ=";
     };
     x86_64-darwin = {
-      url = "https://download.jetbrains.com/webide/PhpStorm-2026.1.3.dmg";
-      hash = "sha256-Q9m/XIgDg4F4yH0P35IaInk/se5CXqewvp248VqA4uc=";
+      url = "https://download.jetbrains.com/webide/PhpStorm-2026.1.4.dmg";
+      hash = "sha256-W7EwYu7S3hs1564tXq8H1Uok/Gwx/8QJO4brUGOfFY4=";
     };
     aarch64-darwin = {
-      url = "https://download.jetbrains.com/webide/PhpStorm-2026.1.3-aarch64.dmg";
-      hash = "sha256-Yo50EhVQDg7c/C3JZ9utZxpsOY0DuZfgYzYtBN9Nmwk=";
+      url = "https://download.jetbrains.com/webide/PhpStorm-2026.1.4-aarch64.dmg";
+      hash = "sha256-XGcfEWHHeLugvkT/WlQDsVRN33F46b1PCNhINQitqSY=";
     };
   };
   # update-script-end: urls
@@ -39,8 +39,8 @@ mkJetBrainsProduct {
   product = "PhpStorm";
 
   # update-script-start: version
-  version = "2026.1.3";
-  buildNumber = "261.25134.104";
+  version = "2026.1.4";
+  buildNumber = "261.26222.71";
   # update-script-end: version
 
   src = fetchurl (urls.${system} or (throw "Unsupported system: ${system}"));

pkgs/applications/editors/jetbrains/ides/pycharm.nix

@@ -13,20 +13,20 @@ let
   # update-script-start: urls
   urls = {
     x86_64-linux = {
-      url = "https://download.jetbrains.com/python/pycharm-2026.1.2.tar.gz";
-      hash = "sha256-kcd1vhb7CFn5sY69RW2I4THK3zN7DOn52O0YeIZWGWY=";
+      url = "https://download.jetbrains.com/python/pycharm-2026.1.4.tar.gz";
+      hash = "sha256-RIufgZhg/n+D1uEdcDyYRjTDfh8Jicyz4h0B1kTbVXs=";
     };
     aarch64-linux = {
-      url = "https://download.jetbrains.com/python/pycharm-2026.1.2-aarch64.tar.gz";
-      hash = "sha256-5rTyUmevreBL5nZPa7FuodFhWcrjSQ+7T1jMFo7P/uM=";
+      url = "https://download.jetbrains.com/python/pycharm-2026.1.4-aarch64.tar.gz";
+      hash = "sha256-71FbYpN0seJ5k/yZA7aoXgU4W/N1BhjtKl7W7Hic9UE=";
     };
     x86_64-darwin = {
-      url = "https://download.jetbrains.com/python/pycharm-2026.1.2.dmg";
-      hash = "sha256-Fej8KylKSFKVxCMrBAcUIDwb0v5B5r1RysMAvcBVgh8=";
+      url = "https://download.jetbrains.com/python/pycharm-2026.1.4.dmg";
+      hash = "sha256-Q5hTcYoNUzmAxwcsXJNS4medQjFKWc/Sgkybt4PQPfg=";
     };
     aarch64-darwin = {
-      url = "https://download.jetbrains.com/python/pycharm-2026.1.2-aarch64.dmg";
-      hash = "sha256-oau/wa9spYnn7XE07NGsINyqof3Mu9t9WQLuPAQ4TDc=";
+      url = "https://download.jetbrains.com/python/pycharm-2026.1.4-aarch64.dmg";
+      hash = "sha256-qxSgp8r4S0KXjCCTIoAiEZFCn3uBE/0pWLLA6td0Fq0=";
     };
   };
   # update-script-end: urls
@@ -40,8 +40,8 @@ in
   product = "PyCharm";
 
   # update-script-start: version
-  version = "2026.1.2";
-  buildNumber = "261.24374.152";
+  version = "2026.1.4";
+  buildNumber = "261.26222.68";
   # update-script-end: version
 
   src = fetchurl (urls.${system} or (throw "Unsupported system: ${system}"));

pkgs/applications/editors/jetbrains/ides/rider.nix

@@ -24,20 +24,20 @@ let
   # update-script-start: urls
   urls = {
     x86_64-linux = {
-      url = "https://download.jetbrains.com/rider/JetBrains.Rider-2026.1.2.tar.gz";
-      hash = "sha256-OmysaGXGMxxAAa2qrHvX8yXIwJLU7tKG8/EBGhr55EA=";
+      url = "https://download.jetbrains.com/rider/JetBrains.Rider-2026.1.4.tar.gz";
+      hash = "sha256-K+X2M4idv+oDqC/dkbzMTX3W3zx0b0e8ZTsxkP7rAfI=";
     };
     aarch64-linux = {
-      url = "https://download.jetbrains.com/rider/JetBrains.Rider-2026.1.2-aarch64.tar.gz";
-      hash = "sha256-xcwd4OgobMXFQ2W+SN6O5I3mud4kedVQ/0rZBWbXIGY=";
+      url = "https://download.jetbrains.com/rider/JetBrains.Rider-2026.1.4-aarch64.tar.gz";
+      hash = "sha256-GXmyBrqxUpwK4djjwllvK+pnfktDrDHpLJKoe4D2xFo=";
     };
     x86_64-darwin = {
-      url = "https://download.jetbrains.com/rider/JetBrains.Rider-2026.1.2.dmg";
-      hash = "sha256-uoOP+EYB11M99MlAFF7efZSKmCk0fwjCImFiasUQPUw=";
+      url = "https://download.jetbrains.com/rider/JetBrains.Rider-2026.1.4.dmg";
+      hash = "sha256-GfQ5WpKunJ+JhE1VcArm3UxZ5udCbfnS1Kw3D4gZorA=";
     };
     aarch64-darwin = {
-      url = "https://download.jetbrains.com/rider/JetBrains.Rider-2026.1.2-aarch64.dmg";
-      hash = "sha256-Mo6gxWatX6wlL3s8Li19F58cnKZtOtFUfNyGPrC6CtA=";
+      url = "https://download.jetbrains.com/rider/JetBrains.Rider-2026.1.4-aarch64.dmg";
+      hash = "sha256-cfwT22BN1jzKZzrZHMQqYFJPGuRwta/sqoOJOp+PfBE=";
     };
   };
   # update-script-end: urls
@@ -51,8 +51,8 @@ in
   product = "Rider";
 
   # update-script-start: version
-  version = "2026.1.2";
-  buildNumber = "261.24374.190";
+  version = "2026.1.4";
+  buildNumber = "261.26222.60";
   # update-script-end: version
 
   src = fetchurl (urls.${system} or (throw "Unsupported system: ${system}"));

pkgs/applications/editors/jetbrains/ides/ruby-mine.nix

@@ -12,20 +12,20 @@ let
   # update-script-start: urls
   urls = {
     x86_64-linux = {
-      url = "https://download.jetbrains.com/ruby/RubyMine-2026.1.3.tar.gz";
-      hash = "sha256-0KF/IEVRT8kgHpULEmqMy9gOf06IIDA4vEV3RujjQoE=";
+      url = "https://download.jetbrains.com/ruby/RubyMine-2026.1.4.tar.gz";
+      hash = "sha256-0EhtU4XKWI9i7ij+m5uvxHSYnbQaYJy8Sa6S1OW4CFU=";
     };
     aarch64-linux = {
-      url = "https://download.jetbrains.com/ruby/RubyMine-2026.1.3-aarch64.tar.gz";
-      hash = "sha256-kiuRp9JhdS0aUFPX1brI1T9ik/iWhglIckHvv4bdPWk=";
+      url = "https://download.jetbrains.com/ruby/RubyMine-2026.1.4-aarch64.tar.gz";
+      hash = "sha256-oSu19pkGVWt31vWBdAffSZsu4QzsUznVbUSwDy98nug=";
     };
     x86_64-darwin = {
-      url = "https://download.jetbrains.com/ruby/RubyMine-2026.1.3.dmg";
-      hash = "sha256-UjpwMCXhI+bMOvyyEbRBoNW3GGCDpi7aF6hUxffW/h0=";
+      url = "https://download.jetbrains.com/ruby/RubyMine-2026.1.4.dmg";
+      hash = "sha256-BLo2weIJK8gQAcMtAiETM7FMdhw9aoFIGh5Yqjv3k7s=";
     };
     aarch64-darwin = {
-      url = "https://download.jetbrains.com/ruby/RubyMine-2026.1.3-aarch64.dmg";
-      hash = "sha256-lqa3L+rBiEH/hPmFcevWBumvvyBBzoUR3ttvA8s0uT0=";
+      url = "https://download.jetbrains.com/ruby/RubyMine-2026.1.4-aarch64.dmg";
+      hash = "sha256-4wEnwcPRtwp0wxePUMiLow6sMxirwndRMdmJL8LBh9k=";
     };
   };
   # update-script-end: urls
@@ -39,8 +39,8 @@ mkJetBrainsProduct {
   product = "RubyMine";
 
   # update-script-start: version
-  version = "2026.1.3";
-  buildNumber = "261.25134.97";
+  version = "2026.1.4";
+  buildNumber = "261.26222.67";
   # update-script-end: version
 
   src = fetchurl (urls.${system} or (throw "Unsupported system: ${system}"));

pkgs/applications/editors/jetbrains/ides/rust-rover.nix

@@ -18,20 +18,20 @@ let
   # update-script-start: urls
   urls = {
     x86_64-linux = {
-      url = "https://download.jetbrains.com/rustrover/RustRover-2026.1.3.tar.gz";
-      hash = "sha256-0+v05zxvFqXV13c8oV9dTTwtO+shgywD75cwUiZAab0=";
+      url = "https://download.jetbrains.com/rustrover/RustRover-2026.1.4.tar.gz";
+      hash = "sha256-8x/AP6uKSVJavwjA9tYT1IM1xVspOZZzwmcwpGloIcw=";
     };
     aarch64-linux = {
-      url = "https://download.jetbrains.com/rustrover/RustRover-2026.1.3-aarch64.tar.gz";
-      hash = "sha256-SZ4OkWgAGeSafFo1ml5dv5tN5su+HgzbEhQ5GzPqGdo=";
+      url = "https://download.jetbrains.com/rustrover/RustRover-2026.1.4-aarch64.tar.gz";
+      hash = "sha256-KpF3jCnLKCEeEXkBdB8ZsPPqP9FOVRTwRV/FQLKyh1Q=";
     };
     x86_64-darwin = {
-      url = "https://download.jetbrains.com/rustrover/RustRover-2026.1.3.dmg";
-      hash = "sha256-JA++mbKvRTvjHEblbgmjBzbWbxcV7ss3+W9M6i6ePu0=";
+      url = "https://download.jetbrains.com/rustrover/RustRover-2026.1.4.dmg";
+      hash = "sha256-2BwgAD0xF9IxRJh+gW4vLzBW13rFQSzQPbEwdmQGvLU=";
     };
     aarch64-darwin = {
-      url = "https://download.jetbrains.com/rustrover/RustRover-2026.1.3-aarch64.dmg";
-      hash = "sha256-ndipMTztrYeUdo4MfOHjJHk3liHutWmMj+J6G8xjtWA=";
+      url = "https://download.jetbrains.com/rustrover/RustRover-2026.1.4-aarch64.dmg";
+      hash = "sha256-Hly4NBv9mg/RMmxCM6m9w5eS/CQ7ycxp7V2VQZwyGQE=";
     };
   };
   # update-script-end: urls
@@ -45,8 +45,8 @@ in
   product = "RustRover";
 
   # update-script-start: version
-  version = "2026.1.3";
-  buildNumber = "261.25134.134";
+  version = "2026.1.4";
+  buildNumber = "261.26222.73";
   # update-script-end: version
 
   src = fetchurl (urls.${system} or (throw "Unsupported system: ${system}"));

pkgs/applications/editors/vim/plugins/non-generated/meson/default.nix

@@ -8,11 +8,9 @@ vimUtils.buildVimPlugin {
   preInstall = "cd data/syntax-highlighting/vim";
 
   meta = {
+    description = "Vim plugin for meson providing syntax highlighting";
     inherit (meson.meta)
       homepage
-      description
-      mainProgram
-      longDescription
       license
       platforms
       ;

pkgs/applications/editors/vim/plugins/nvim-treesitter/overrides.nix

@@ -4,6 +4,7 @@
   symlinkJoin,
   vimUtils,
   tree-sitter,
+  tree-sitter-grammars,
   neovim,
   neovimUtils,
   runCommand,
@@ -127,7 +128,7 @@ let
   withPlugins =
     f:
     let
-      selectedGrammars = f (tree-sitter.builtGrammars // builtGrammars);
+      selectedGrammars = f (tree-sitter-grammars.derivations // builtGrammars);
 
       grammarPlugins = map grammarToPlugin selectedGrammars;
 

pkgs/applications/emulators/libretro/cores/opera.nix

@@ -6,13 +6,13 @@
 }:
 mkLibretroCore {
   core = "opera";
-  version = "0-unstable-2026-06-19";
+  version = "0-unstable-2026-06-28";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "opera-libretro";
-    rev = "eb3a9162e99a71da221107aa58e7650fd076bbca";
-    hash = "sha256-swFdGY8ScsQG/8E/JWzGRL80jdMVzsr1BJ+UAisSJ9g=";
+    rev = "340f9e9014c292fc47a8844a871a71dafe072b6d";
+    hash = "sha256-geBK8RIlaRcWn4CDzVl3pjK0WOFQcMZl7zFMXE2oZNo=";
   };
 
   makefile = "Makefile";

pkgs/applications/emulators/libretro/cores/prboom.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "prboom";
-  version = "0-unstable-2026-06-15";
+  version = "0-unstable-2026-07-01";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "libretro-prboom";
-    rev = "b760de6a1eb1bfcd7833c5b677ff9170d104302f";
-    hash = "sha256-JZrQbhntCGV4WIktUbtVXCSGAEmh9gTPn+tLiMyt6ZY=";
+    rev = "141978db577b52cb943641629401776e49ccbbe6";
+    hash = "sha256-USRBq+h2HAoDIdYVd47wGLEnUzJAEOvikuvSNTHpboI=";
   };
 
   makefile = "Makefile";

pkgs/applications/emulators/libretro/cores/stella2014.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "stella2014";
-  version = "0-unstable-2026-04-12";
+  version = "0-unstable-2026-07-04";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "stella2014-libretro";
-    rev = "eed47e154d1bbda3305e9ef2d486b6710c8973f4";
-    hash = "sha256-QpPjVnFCkn6xlB7LxpE6bsNfYe3HSsEKUjqmEf2yTvA=";
+    rev = "8ddf2146ed2d2053cff9df64192f920e57709629";
+    hash = "sha256-VDywbP7PhcQPHhu/KMvV1LlI/iOGjMzRooqvoT+Tnxc=";
   };
 
   makefile = "Makefile";

pkgs/applications/virtualization/docker/default.nix

@@ -420,18 +420,18 @@ in
 
   docker_29 =
     let
-      version = "29.6.0";
+      version = "29.6.1";
     in
     callPackage dockerGen {
       inherit version;
       cliRev = "v${version}";
-      cliHash = "sha256-2JTiqvrIYhpwbEgU+5DnmlHpaf8Re1vYPkySs93sKZU=";
+      cliHash = "sha256-cpK2UMRP/WXHsehG9Sq5UJAjhMesmXTrhe00y4RMRZc=";
       mobyRev = "docker-v${version}";
-      mobyHash = "sha256-xr3+RZANLP4IkLv26/7znXnTCOm/5Gm7k6WBaOlZfQk=";
+      mobyHash = "sha256-gv+mea9X5TYDWN3IBRpmw0+R2waGxCiubdatNTeUQZI=";
       runcRev = "v1.3.6";
       runcHash = "sha256-cBMYZOElWHQ4OkF2NlYJSZrlW4833WD8CRJRkkXeKJc=";
-      containerdRev = "v2.2.4";
-      containerdHash = "sha256-F0lw7zh4V9JlFQGkE4RNT1VLX8WWLgZAAvbP12jnRMw=";
+      containerdRev = "v2.2.5";
+      containerdHash = "sha256-3ui+0AjEU6H4VHYwF3G85ggVMUdONCLJ5KfciFasmkk=";
       tiniRev = "369448a167e8b3da4ca5bca0b3307500c3371828";
       tiniHash = "sha256-jCBNfoJAjmcTJBx08kHs+FmbaU82CbQcf0IVjd56Nuw=";
     };

pkgs/applications/window-managers/evilwm/default.nix

@@ -12,11 +12,11 @@
 
 stdenv.mkDerivation rec {
   pname = "evilwm";
-  version = "1.4.3";
+  version = "1.5";
 
   src = fetchurl {
     url = "https://www.6809.org.uk/evilwm/evilwm-${version}.tar.gz";
-    sha256 = "sha256-1ZRbILEskdskEvrA29o/ucPsjeu44bEJg4mSsrG75dQ=";
+    sha256 = "sha256-YQSFJBPm1QZpNh3K3aWiXTnisrDJWmOEAiyQWVeidA8=";
   };
 
   buildInputs = [

pkgs/build-support/build-nim-package.nix

@@ -3,10 +3,8 @@
   buildPackages,
   callPackage,
   stdenv,
-  nim1,
-  nim2,
+  nim,
   nim_builder,
-  defaultNimVersion ? 2,
   nimOverrides,
   buildNimPackage,
 }:
@@ -17,6 +15,7 @@ let
     enableParallelBuilding = true;
     __structuredAttrs = true;
     doCheck = true;
+
     configurePhase = ''
       runHook preConfigure
       export NIX_NIM_BUILD_INPUTS=''${pkgsHostTarget[@]} $NIX_NIM_BUILD_INPUTS
@@ -38,7 +37,7 @@ let
       nim_builder --phase:install
       runHook postInstall
     '';
-    meta = { inherit (nim2.meta) maintainers platforms; };
+    meta = { inherit (nim.meta) maintainers platforms; };
   };
 
   fodFromLockEntry =
@@ -108,30 +107,34 @@ let
 
       finalOverride =
         {
-          depsBuildBuild ? [ ],
-          nativeBuildInputs ? [ ],
           nimFlags ? [ ],
-          requiredNimVersion ? defaultNimVersion,
           passthru ? { },
+          nativeBuildInputs ? [ ],
+          depsBuildBuild ? [ ],
           ...
-        }:
+        }@args:
         (
-          if requiredNimVersion == 1 then
-            {
-              depsBuildBuild = [ nim_builder ] ++ depsBuildBuild;
-              nativeBuildInputs = [ nim1 ] ++ nativeBuildInputs;
-            }
-          else if requiredNimVersion == 2 then
-            {
-              depsBuildBuild = [ nim_builder ] ++ depsBuildBuild;
-              nativeBuildInputs = [ nim2 ] ++ nativeBuildInputs;
-            }
+          #TODO: Remove at 26.11
+          if args ? requiredNimVersion then
+            if args.requiredNimVersion == 2 then
+              lib.warn ''
+                `requiredNimVersion' is deprecated and will be removed in nixpkgs 26.11.
+                Please update your package to remove this.
+              ''
+            else
+              throw ''
+                `requiredNimVersion' ${toString args.requiredNimVersion} is not supported.
+                Ensure your package supports nim 2, and remove `requiredNimVersion'.
+              ''
           else
-            throw "requiredNimVersion ${toString requiredNimVersion} is not valid"
+            { }
         )
         // {
+          nativeBuildInputs = [ nim ] ++ nativeBuildInputs;
+          depsBuildBuild = [ nim_builder ] ++ depsBuildBuild;
           nimFlags = lockFileNimFlags ++ nimFlags;
           passthru = passthru // {
+
             # allow overriding the result of buildNimPackageArgs before this composition is applied
             # this allows overriding the lockFile for packages built using buildNimPackage
             # this is adapted from mkDerivationExtensible in stdenv.mkDerivation

pkgs/build-support/writers/scripts.nix

@@ -799,7 +799,7 @@ rec {
     ## `pkgs.writers.writeNim` usage example
 
     ```nix
-      writeNim "hello-nim" { nim = pkgs.nim2; } ''
+      writeNim "hello-nim" { nim = pkgs.nim; } ''
         echo "hello nim"
       '';
     ```
@@ -809,7 +809,7 @@ rec {
     name:
     {
       makeWrapperArgs ? [ ],
-      nim ? pkgs.nim2,
+      nim ? pkgs.nim,
       nimCompileOptions ? { },
       strip ? true,
     }:

pkgs/by-name/al/algia/package.nix

@@ -7,13 +7,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "algia";
-  version = "0.0.125";
+  version = "0.0.130";
 
   src = fetchFromGitHub {
     owner = "mattn";
     repo = "algia";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-MPCCu34bJoj0QctG4Xe6B1BIUyLaTQ7N8IG15jMZCTE=";
+    hash = "sha256-QuusIoZfNhETaVJJ8sUy3Zo3VnRUp7cfudDP562ZNLU=";
   };
 
   vendorHash = "sha256-mim8EImPFHF2vf1vCi9jgECbVAOB32oXxsPMgUwYDBA=";

pkgs/by-name/ar/ariang/package.nix

@@ -1,6 +1,7 @@
 {
   lib,
   fetchFromGitHub,
+  nodejs_22,
   buildNpmPackage,
   copyDesktopItems,
   imagemagick,
@@ -19,6 +20,8 @@ buildNpmPackage rec {
     hash = "sha256-u4MnjGMvnnb9EGHwK2QYpW7cuX1e1+6z2/1X1baR8iA=";
   };
 
+  nodejs = nodejs_22;
+
   npmDepsHash = "sha256-kxoSEdM8H7M9s6U2dtCdfuvqVROEk35jAkO7MgyVVRg=";
 
   makeCacheWritable = true;

pkgs/by-name/ar/arrow-adbc/package.nix

@@ -0,0 +1,107 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  buildGoModule,
+
+  # nativeBuildInputs
+  cmake,
+  pkg-config,
+
+  # buildInputs
+  nanoarrow,
+  fmt,
+  gtest,
+  libpq,
+  sqlite,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "arrow-adbc";
+  version = "23";
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  src = fetchFromGitHub {
+    owner = "apache";
+    repo = "arrow-adbc";
+    tag = "apache-arrow-adbc-${finalAttrs.version}";
+    fetchSubmodules = true;
+    hash = "sha256-33JUx4ZI+BHIZMvlCO43mjU34zShJZGQpAkqRrvgl2w=";
+  };
+
+  vendorHash = "sha256-uGxCTllRNtXkrl31d88TOK36X09ylo++gtorx0uFR8A=";
+
+  # We are building the C project
+  preConfigure = ''
+    cd c/
+  '';
+  # Upstream's build invoces a custom `go build` command to build one of the
+  # targets. We use buildGoModule's engineering to supply it the offline
+  # `goModules` path and other GO[A-Z] environment variables. Ideally, there
+  # should be setup hooks for the mechanisms of buildGoModule, that would make
+  # it easier.
+  modRoot = "../../go/adbc";
+  inherit (finalAttrs.finalPackage.passthru.bigquery-go-package) goModules;
+  preBuild =
+    (lib.pipe finalAttrs.finalPackage.passthru.bigquery-go-package.configurePhase [
+      # Make that this configure phase doesn't run our configure hooks.
+      (lib.replaceString "runHook preConfigure" "")
+      (lib.replaceString "runHook postConfigure" "")
+    ])
+    # Return to original meson build directory.
+    + ''
+      cd ../../c/build
+    '';
+
+  nativeBuildInputs = [
+    # NOTE that the meson build system has a bug that it puts a few shared
+    # objects in $out and not in $out/lib.
+    cmake
+    pkg-config
+    finalAttrs.finalPackage.passthru.bigquery-go-package.passthru.go
+  ];
+
+  cmakeFlags = map (driver: lib.cmakeBool "ADBC_DRIVER_${driver}" true) [
+    "BIGQUERY"
+    "FLIGHTSQL"
+    "MANAGER"
+    "POSTGRESQL"
+    "SNOWFLAKE"
+    "SQLITE"
+  ];
+
+  buildInputs = [
+    fmt
+    gtest
+    libpq
+    nanoarrow
+    sqlite
+  ];
+
+  passthru = {
+    bigquery-go-package = buildGoModule (finalGoAttrs: {
+      inherit (finalAttrs)
+        pname
+        version
+        src
+        vendorHash
+        ;
+      sourceRoot = "${finalAttrs.src.name}/go/adbc";
+      # This derivation is not really evaluated anyway, but it is used to
+      # update the vendorHash... TODO: Check that nix-update is capable of
+      # updating vendorHash automatically.
+      dontBuild = true;
+      dontInstall = true;
+    });
+  };
+
+  meta = {
+    description = "Database connectivity API standard and libraries for Apache Arrow";
+    homepage = "https://arrow.apache.org/adbc/";
+    changelog = "https://github.com/apache/arrow-adbc/blob/${finalAttrs.src.rev}/CHANGELOG.md";
+    license = lib.licenses.afl20;
+    maintainers = with lib.maintainers; [ doronbehar ];
+    platforms = lib.platforms.all;
+  };
+})

pkgs/by-name/av/avdl/package.nix

@@ -6,17 +6,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "avdl";
-  version = "0.1.9+1.12.1";
+  version = "0.1.10+1.12.1";
 
   src = fetchFromGitHub {
     owner = "jonhoo";
     repo = "avdl";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-HfcDSv3RzmoFbwt7iAP/UXdeJupfng8oeaeerUwW1Ik=";
+    hash = "sha256-DGRBLXE8YMZs1fBBuTtUuhsc490IJB3G9Khddk3l8gw=";
     fetchSubmodules = true;
   };
 
-  cargoHash = "sha256-5ftBXywOUQKzIwjaQVHtxO/6A1bb1jGZAxYYY7GttCg=";
+  cargoHash = "sha256-wTiQ1Ssn6Q1ZjR52a4+qyDrQqVUcP+/4paOjKKPJuII=";
 
   meta = {
     description = "Rust port of avro-tools' IDL tooling";

pkgs/by-name/ba/bazaar/package.nix

@@ -34,7 +34,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "bazaar";
-  version = "0.8.3";
+  version = "0.9.0";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -50,7 +50,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "bazaar-org";
     repo = "bazaar";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-s0l548kuVD+eNAxA3BnbpuMHD1alq0/xGBIkXb7WpC0=";
+    hash = "sha256-6MDrMXwtNcNJtnoRwfIKVulHu4FtVb4hhCtqIxmlz4A=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ba/bazarr/package.nix

@@ -17,11 +17,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "bazarr";
-  version = "1.5.6";
+  version = "1.6.0";
 
   src = fetchzip {
     url = "https://github.com/morpheus65535/bazarr/releases/download/v${version}/bazarr.zip";
-    hash = "sha256-S3idNH9Wm9f6aNj69dERmeks1rLvUeQJYFebXa5cWQo=";
+    hash = "sha256-LRcc2wg5u260yl3A7rRwBfldl6WOyvF2T9NKGTKabfw=";
     stripRoot = false;
   };
 

pkgs/by-name/ca/cargo-feature-combinations/package.nix

@@ -9,16 +9,16 @@ rustPlatform.buildRustPackage (finalAttrs: {
   __structuredAttrs = true;
 
   pname = "cargo-feature-combinations";
-  version = "0.0.54";
+  version = "0.2.3";
 
   src = fetchFromGitHub {
     owner = "romnn";
     repo = "cargo-feature-combinations";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-SgVwgG7lNFrDMH1t9yvYTTm7pQth2hcEAjwMuRkC5Kg=";
+    hash = "sha256-5QQrWdq1jTGUCnzZkzJ2WzJRpxhRtaZMLpgCIktaiPc=";
   };
 
-  cargoHash = "sha256-S0I2itkyAhZwk+S/k/Sr3bpENpIQNHSaJwVpA8rvQ+E=";
+  cargoHash = "sha256-PMZGYxdB9cbWLVtvfRtWsRqVwJWayPbrdhpKvxmq3dM=";
 
   passthru.updateScript = nix-update-script { };
 

pkgs/by-name/co/code-cursor/sources.json

@@ -1,22 +1,22 @@
 {
-  "version": "3.9.8",
+  "version": "3.9.16",
   "vscodeVersion": "1.105.1",
   "sources": {
     "x86_64-linux": {
-      "url": "https://downloads.cursor.com/production/4aa8ff1b7877ed7bd01bcba308698f71a6735380/linux/x64/Cursor-3.9.8-x86_64.AppImage",
-      "hash": "sha256-xcyFowrW5yzIDCwbFGmpDRSNa3OUXsHwpLkbyNcSzqM="
+      "url": "https://downloads.cursor.com/production/042b3c1a4c53f2c3808067f519fbfc67b72cad8b/linux/x64/Cursor-3.9.16-x86_64.AppImage",
+      "hash": "sha256-dG61VYGMHPip57ldzNICEi1yPc4s1dON+MlDGiKadKc="
     },
     "aarch64-linux": {
-      "url": "https://downloads.cursor.com/production/4aa8ff1b7877ed7bd01bcba308698f71a6735380/linux/arm64/Cursor-3.9.8-aarch64.AppImage",
-      "hash": "sha256-ZhRMvfJkt8NZT45tYxfO2gBFaVw6hR2nVeRzmrxQfeE="
+      "url": "https://downloads.cursor.com/production/042b3c1a4c53f2c3808067f519fbfc67b72cad8b/linux/arm64/Cursor-3.9.16-aarch64.AppImage",
+      "hash": "sha256-7tkupyy8EFeOpzQqoHQsYxWQlFoW6VBpXkuCJsRIhRw="
     },
     "x86_64-darwin": {
-      "url": "https://downloads.cursor.com/production/4aa8ff1b7877ed7bd01bcba308698f71a6735380/darwin/x64/Cursor-darwin-x64.dmg",
-      "hash": "sha256-IOQsZQAncDgZGEnCZWg/LQqD/PquFifBmuk2hnJ1L/s="
+      "url": "https://downloads.cursor.com/production/042b3c1a4c53f2c3808067f519fbfc67b72cad8b/darwin/x64/Cursor-darwin-x64.dmg",
+      "hash": "sha256-5sAj/FiPAs1facGmNKgXiNzs1Kc1ht9eXYU1aZ1VoUA="
     },
     "aarch64-darwin": {
-      "url": "https://downloads.cursor.com/production/4aa8ff1b7877ed7bd01bcba308698f71a6735380/darwin/arm64/Cursor-darwin-arm64.dmg",
-      "hash": "sha256-GxpBKyx0Yo3e8AUS9Oxei/hHm1m3JdxMKjX7qAxUGm4="
+      "url": "https://downloads.cursor.com/production/042b3c1a4c53f2c3808067f519fbfc67b72cad8b/darwin/arm64/Cursor-darwin-arm64.dmg",
+      "hash": "sha256-pnSsOvyFiBKJsPUPkfnSY1l+LEzz3g5kbepIco7dDIM="
     }
   }
 }

pkgs/by-name/co/codex/package.nix

@@ -26,13 +26,13 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "codex";
-  version = "0.142.3";
+  version = "0.142.5";
 
   src = fetchFromGitHub {
     owner = "openai";
     repo = "codex";
     tag = "rust-v${finalAttrs.version}";
-    hash = "sha256-dxkyaWpgzqpAVFojDYQ6JpMPNBIX+d7xjIyLic4Cs8A=";
+    hash = "sha256-Ua1UVArTvjHcg3bPK1FYyShYiIUH3AOxtoUTvA4UZwU=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/codex-rs";

pkgs/by-name/co/copilot-language-server/package.nix

@@ -10,11 +10,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "copilot-language-server";
-  version = "1.513.0";
+  version = "1.517.0";
 
   src = fetchzip {
     url = "https://github.com/github/copilot-language-server-release/releases/download/${finalAttrs.version}/copilot-language-server-js-${finalAttrs.version}.zip";
-    hash = "sha256-wVibxZjUW6BX4YhdYlyE0/zp0fst2H/XmmqZLqxGXH8=";
+    hash = "sha256-BzvUARAI8DOEYHPMavJdtSkr+ZCj/E+mM9wQtmEGyjY=";
     stripRoot = false;
   };
 

pkgs/by-name/ct/ctranslate2/package.nix

@@ -28,14 +28,14 @@ let
 in
 stdenv'.mkDerivation (finalAttrs: {
   pname = "ctranslate2";
-  version = "4.8.0";
+  version = "4.8.1";
 
   src = fetchFromGitHub {
     owner = "OpenNMT";
     repo = "CTranslate2";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-Z7Gq+kXIfMdZs48WeptRGXhXnLfehegAwTtQpTbPM4U=";
+    hash = "sha256-+82u+w08wGX0oh1wBaH/epI2IH7lxbvMThJEoGt0Kvk=";
   };
 
   # Fix CMake 4 compatibility

pkgs/by-name/dc/dcp/package.nix

@@ -15,13 +15,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "dcp";
-  version = "0.25.1";
+  version = "0.25.2";
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "dcp";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-mWTGwM1y5zGd610N6Mg3Q3o2Lqf4ANdCWTjNNG/3dBg=";
+    hash = "sha256-afQa5arDC9GD0jzzKBSc+zHrNmHpn91HdcWDeFzpbzQ=";
   };
 
   vendorHash = "sha256-hcuVUUr3kr3iBmSEhHy365LIWGGLFTYnBRa5jnt7kPw=";

pkgs/by-name/di/diffsitter/package.nix

@@ -4,32 +4,19 @@
   linkFarm,
   makeWrapper,
   rustPlatform,
-  tree-sitter,
+  tree-sitter-grammars,
   gitUpdater,
   versionCheckHook,
 }:
 
 let
   # based on https://github.com/NixOS/nixpkgs/blob/aa07b78b9606daf1145a37f6299c6066939df075/pkgs/development/tools/parsing/tree-sitter/default.nix#L85-L104
-  withPlugins =
-    grammarFn:
-    let
-      grammars = grammarFn tree-sitter.builtGrammars;
-    in
-    linkFarm "grammars" (
-      map (
-        drv:
-        let
-          name = lib.strings.getName drv;
-        in
-        {
-          name = "lib" + (lib.strings.removeSuffix "-grammar" name) + ".so";
-          path = "${drv}/parser";
-        }
-      ) grammars
-    );
+  grammarToAttrSet = drv: {
+    name = "lib" + (lib.strings.removeSuffix "-grammar" (lib.strings.getName drv)) + ".so";
+    path = "${drv}/parser";
+  };
 
-  libPath = withPlugins (_: tree-sitter.allGrammars);
+  libPath = linkFarm "grammars" (map grammarToAttrSet tree-sitter-grammars.allGrammars);
 in
 rustPlatform.buildRustPackage rec {
   pname = "diffsitter";

pkgs/by-name/di/diskwatch/package.nix

@@ -7,18 +7,18 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "diskwatch";
-  version = "0.1.1";
+  version = "0.1.2";
 
   src = fetchFromGitHub {
     owner = "matthart1983";
     repo = "diskwatch";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-pveHyT3ljQQ9GdOMhZhcY7QD/pMvL3fLrbM6D5fO+h4=";
+    hash = "sha256-8tQXcbY/sguw42vE0p5Q8/psmwfYQihWcSIsApI4OmE=";
   };
 
   __structuredAttrs = true;
 
-  cargoHash = "sha256-PufgQqJGsPMBcnNV/QXQnE/wrI4FAJWXLvoHEqLQm5k=";
+  cargoHash = "sha256-kO6g5JJogNN5xqD5Qoj6Ncd6scA7PFAjg6y0AWnNhAM=";
 
   nativeCheckInputs = [ versionCheckHook ];
 

pkgs/by-name/dj/django-upgrade/package.nix

@@ -7,14 +7,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "django-upgrade";
-  version = "1.30.0";
+  version = "1.31.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "adamchainz";
     repo = "django-upgrade";
     tag = finalAttrs.version;
-    hash = "sha256-IiGwYq6TTNiNIx1jrzQlLiULWNZlam7onJJGFFJ/hVM=";
+    hash = "sha256-6x1542ieT+G/r3IiCw4aLePY3HLzpycI7FOBqHm1fmE=";
   };
 
   build-system = [ python3Packages.setuptools ];

pkgs/by-name/dp/dprint/package.nix

@@ -12,7 +12,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "dprint";
-  version = "0.54.0";
+  version = "0.55.1";
 
   # Prefer repository rather than crate here
   #   - They have Cargo.lock in the repository
@@ -21,10 +21,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "dprint";
     repo = "dprint";
     tag = finalAttrs.version;
-    hash = "sha256-dNs2LQeEndeXS8xR9SXVFWT9PS+haB9SDZ+3PUPkFjg=";
+    hash = "sha256-OXXLpKgP2cUuPl7ikgZVPFgJiLY0Zy8MmBkz8Kp2+XM=";
   };
 
-  cargoHash = "sha256-fmbO14eTObK1cZu9gDls25KRmzAJPGiqQ8uURGD2vV0=";
+  cargoHash = "sha256-IDxJPicTq0/7LI/07QfJrteaKAHDoeKdzpbEv871xxE=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/dt/dtc/package.nix

@@ -49,8 +49,6 @@ stdenv.mkDerivation (finalAttrs: {
         }
       );
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = finalAttrs.version;
-
   nativeBuildInputs = [
     meson
     ninja

pkgs/by-name/em/emcee/package.nix

@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "emcee";
-  version = "0.7.0";
+  version = "0.8.0";
 
   src = fetchFromGitHub {
     owner = "mattt";
     repo = "emcee";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-czOUhaPBxzuqZ72Y3TuzZ8r0Ab3OqGbDPZipkcak3Cw=";
+    hash = "sha256-S3hSexTjedfmjLuFHXtyiDiKM4NaLeUIJCEl2PKAOCw=";
   };
 
   vendorHash = "sha256-e8LPcKue7rhAh03uCRG0VTcwwyj3kDOBoeo3t7Hwvi0=";

pkgs/by-name/et/etcd_3_5/package.nix

@@ -7,11 +7,11 @@
 }:
 
 let
-  version = "3.5.31";
-  etcdSrcHash = "sha256-X3b1TBimNYo03fW0c5NeiD4uALMqtOQbJwPot11FCk8=";
-  etcdServerVendorHash = "sha256-1/XJGpyYuTsb+1hReksX5VyD+6xbKaiLA8520cDKc/4=";
-  etcdUtlVendorHash = "sha256-dUXAoIcOSlEbiSmy1M+oPaHt089gOttQwrB9ZhYc7v0=";
-  etcdCtlVendorHash = "sha256-l1j00Mzv1z021rfBbFZrIce2pifQyRkST0bkZhVoST0=";
+  version = "3.5.32";
+  etcdSrcHash = "sha256-pqCMgY5veIF5kQDjqTg9B7aSL+V6bdMZpc464wjTLMo=";
+  etcdServerVendorHash = "sha256-FDzAF2J9wbRmQETvrdJK3gL4cfAhiiihb5EOrimE11M=";
+  etcdUtlVendorHash = "sha256-0xfq7f7Xr3SWxiU8C1bWQPxdFvEaoIrlK+gX3hkd4ho=";
+  etcdCtlVendorHash = "sha256-59e/TORi/XX+GXRjMO/45SMumYgrFbOHEXqV7sM72H8=";
 
   src = fetchFromGitHub {
     owner = "etcd-io";

pkgs/by-name/fa/fatsort/package.nix

@@ -7,12 +7,12 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  version = "1.6.5.640";
+  version = "1.7.679";
   pname = "fatsort";
 
   src = fetchurl {
     url = "mirror://sourceforge/fatsort/fatsort-${finalAttrs.version}.tar.xz";
-    sha256 = "sha256-Yw7OVtnrOlVSSvCuw6reeFQ2DrqUkXKmz7R2jLj75C4=";
+    sha256 = "sha256-EBL1UTgmOdaeGU6r++mTQu3nyFaxzWeIKH+d/UvY0SI=";
   };
 
   buildInputs = [

pkgs/by-name/fi/firezone-gateway/package.nix

@@ -6,15 +6,15 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "firezone-gateway";
-  version = "1.4.18";
+  version = "1.5.2";
   src = fetchFromGitHub {
     owner = "firezone";
     repo = "firezone";
     tag = "gateway-${finalAttrs.version}";
-    hash = "sha256-vxOFca6yO9AvgIJwizhaNlOjOvV00+ckQfXIJ17ASq4=";
+    hash = "sha256-bfLPOhxv0xfnU3Q1zZWbhqvNe9Hav2RgF/ESMk81F4I=";
   };
 
-  cargoHash = "sha256-8YftVt72JpmxWB/WvOPpduE0/QgYvQhSuFRmsFth2iU=";
+  cargoHash = "sha256-oOJ/UkamQrlWjAz2A4oObdBssHH9iJWN2BHFgMPOxck=";
   sourceRoot = "${finalAttrs.src.name}/rust";
   buildAndTestSubdir = "gateway";
   env.RUSTFLAGS = "--cfg system_certs";

pkgs/by-name/fi/firezone-headless-client/package.nix

@@ -6,15 +6,15 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "firezone-headless-client";
-  version = "1.5.5";
+  version = "1.5.6";
   src = fetchFromGitHub {
     owner = "firezone";
     repo = "firezone";
     tag = "headless-client-${finalAttrs.version}";
-    hash = "sha256-Lo5iUXlpAecglr0uohOdsefeaDQZor2YoF0O99CxvEo=";
+    hash = "sha256-yEceZJBqSF35herNjbqFHKaIoFJwbkDN28wlxFa1UbU=";
   };
 
-  cargoHash = "sha256-1e2uqxZFDbtcQREB0s2jxfSFgs/hnPxTlUGFeK5L9yw=";
+  cargoHash = "sha256-3V2eMxUtNcnWsh7cYA5Wf979sKmFl7bjwwrqwcfW4tI=";
   sourceRoot = "${finalAttrs.src.name}/rust";
   buildAndTestSubdir = "headless-client";
   env.RUSTFLAGS = "--cfg system_certs";

pkgs/by-name/fl/flintlock/package.nix

@@ -11,16 +11,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "flintlock";
-  version = "0.8.1";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner = "liquidmetal-dev";
     repo = "flintlock";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-Kbk94sqj0aPsVonPsiu8kbjhIOURB1kX9Lt3NURL+jk=";
+    sha256 = "sha256-WQbZUbTrg50vYvFY5ng8LtT4d6aVsUzZUIy8tMUr50M=";
   };
 
-  vendorHash = "sha256-Iv1qHEQLgw6huCA/6PKNmm+dS2yHgOvY/oy2fKjwEpY=";
+  vendorHash = "sha256-SjKxnLsC6RAg7is+ABRG1NyKX01cRNwCcW5B3Fgo/FQ=";
 
   subPackages = [
     "cmd/flintlock-metrics"

pkgs/by-name/fr/freescout/package.nix

@@ -7,13 +7,13 @@
 stdenv.mkDerivation (finalAttrs: {
   preferLocalBuild = true;
   pname = "freescout";
-  version = "1.8.226";
+  version = "1.8.229";
 
   src = fetchFromGitHub {
     owner = "freescout-help-desk";
     repo = "freescout";
     tag = finalAttrs.version;
-    hash = "sha256-9fojG6S6yb2+W94cHrLuYIRjRL8JWspsj4bNE4QKSuk=";
+    hash = "sha256-oA/GWEhdqmXt7v6iRKqud75uUBj1a6nKN7EjaYF0USk=";
   };
 
   patches = [

pkgs/by-name/fs/fsverity-utils/package.nix

@@ -10,7 +10,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fsverity-utils";
-  version = "1.6";
+  version = "1.7";
 
   outputs = [
     "out"
@@ -21,7 +21,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchzip {
     url = "https://git.kernel.org/pub/scm/fs/fsverity/fsverity-utils.git/snapshot/fsverity-utils-v${finalAttrs.version}.tar.gz";
-    sha256 = "sha256-FZN4MKNmymIXZ2Q0woA0SLzPf4SaUJkj4ssKPsY4xXc=";
+    sha256 = "sha256-c8dillkgGh41elo/a5EqGQIrS4TZeDLsYkmyNke6koc=";
   };
 
   patches = lib.optionals (!enableShared) [

pkgs/by-name/fz/fzf-zsh-plugin/package.nix

@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation {
   pname = "fzf-zsh-plugin";
-  version = "1.0.0-unstable-2026-06-21";
+  version = "1.0.0-unstable-2026-06-30";
 
   src = fetchFromGitHub {
     owner = "unixorn";
     repo = "fzf-zsh-plugin";
-    rev = "70e2ac8a12c137c1b097a6ecfdc0236e5ef51d1b";
-    hash = "sha256-qwqezNXBRFKTWyMp+9Ss2hEAU9Bznc/DK0XNGZOfVOE=";
+    rev = "6f953534d4c69a7340d27b7dcf14f406a22bed61";
+    hash = "sha256-RQrxCU7f3LSepUYm0+2ljvJfzVh8yp4NMJHxssA60Vk=";
   };
 
   strictDeps = true;

pkgs/by-name/go/google-chrome/package.nix

@@ -289,11 +289,11 @@ let
 
   darwin = stdenvNoCC.mkDerivation (finalAttrs: {
     inherit pname meta passthru;
-    version = "149.0.7827.201";
+    version = "150.0.7871.47";
 
     src = fetchurl {
-      url = "http://dl.google.com/release2/chrome/ph3mj7mqtvbfhr67ckmjvjj5a4_149.0.7827.201/GoogleChrome-149.0.7827.201.dmg";
-      hash = "sha256-AI5oBE0uB2/YacF9LB4d6rXlAqEuZtlPYNQwLbs1K7E=";
+      url = "http://dl.google.com/release2/chrome/ad2pojsfcj6hr5telal5kk4t6gua_150.0.7871.47/GoogleChrome-150.0.7871.47.dmg";
+      hash = "sha256-1VTMVSBLfSRp9CxPaRkmdgAC0H5KNuZNWywTGLSphUI=";
     };
 
     dontPatch = true;

pkgs/by-name/gr/gram/package.nix

@@ -65,6 +65,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
     cargo-bundle
+    rustPlatform.bindgenHook
   ];
 
   dontUseCmakeConfigure = true;

pkgs/by-name/he/headplane/package.nix

@@ -15,13 +15,13 @@
 let
   pname = "headplane";
   # Note, if you are upgrading this, you should upgrade headplane-agent at the same time
-  version = "0.6.2";
+  version = "0.6.3";
   pnpmDepsHash = "sha256-CsmffCo9Se/4oiOqbcuhjPMuGmR2GL+YfcyWgzBTAh8=";
   src = fetchFromGitHub {
     owner = "tale";
     repo = "headplane";
     tag = "v${version}";
-    hash = "sha256-2C/Pn2M2aHADtoljSFg9hz6xOaZp6IRI77jjy+LDAgw=";
+    hash = "sha256-zvJUTKRIlHyPMq80teVXBSb7K9Zz44Kuuj2PPi6qIOw=";
   };
 
   headplaneSshWasm = buildGoModule {

pkgs/by-name/he/helix/package.nix

@@ -6,7 +6,7 @@
   helix-unwrapped,
   removeReferencesTo,
   pkgs,
-  tree-sitter,
+  tree-sitter-grammars,
   lockedGrammars ? lib.importJSON ./grammars.json,
   grammarsOverlay ? (
     final: prev: {
@@ -66,13 +66,9 @@ let
         }
     ) prev;
 
-  tree-sitter-grammars =
+  helixTreeSitterGrammars =
     lib.filterAttrs (drvName: _: lib.hasAttr (lib.removePrefix "tree-sitter-" drvName) lockedGrammars)
-      (
-        tree-sitter.grammarsScope.overrideScope (
-          lib.composeExtensions lockedVersionsOverlay grammarsOverlay
-        )
-      );
+      (tree-sitter-grammars.overrideScope (lib.composeExtensions lockedVersionsOverlay grammarsOverlay));
 
   # Dynamic libraries for the grammars always use the `.so` extension, also on Darwin (should use `.dylib`)
   # See here: https://github.com/helix-editor/helix/pull/14982
@@ -82,7 +78,7 @@ let
     lib.concatMapAttrsStringSep "\n" (_: grammar: ''
       install -D ${grammar}/parser $out/${grammar.language}.so
       ${lib.getExe removeReferencesTo} -t ${grammar} $out/${grammar.language}.so
-    '') (lib.filterAttrs (_: lib.isDerivation) tree-sitter-grammars)
+    '') helixTreeSitterGrammars
   );
 
   lockedGrammarsCount = lib.length (lib.attrNames lockedGrammars);
@@ -113,7 +109,7 @@ symlinkJoin {
   passthru = {
     updateScript = ./update.sh;
     runtime = runtimeDir;
-    inherit tree-sitter-grammars;
+    tree-sitter-grammars = helixTreeSitterGrammars;
   };
 
   meta = {

pkgs/by-name/im/immersed/linux.nix

@@ -25,6 +25,13 @@ appimageTools.wrapAppImage {
 
   extraPkgs =
     pkgs: with pkgs; [
+      libva
+      # VAAPI backends
+      intel-media-driver
+      intel-vaapi-driver
+      nvidia-vaapi-driver
+      mesa
+      # Other dependencies
       libgpg-error
       fontconfig
       libGL

pkgs/by-name/im/immich-cli/package.nix

@@ -12,12 +12,6 @@ stdenv.mkDerivation (finalAttrs: {
   pname = "immich-cli";
   inherit (immich) version src pnpmDeps;
 
-  postPatch = ''
-    local -r cli_version="$(jq -r .version cli/package.json)"
-    test "$cli_version" = ${finalAttrs.version} \
-      || (echo "error: update immich-cli version to $cli_version" && exit 1)
-  '';
-
   nativeBuildInputs = [
     jq
     makeWrapper
@@ -29,8 +23,7 @@ stdenv.mkDerivation (finalAttrs: {
   buildPhase = ''
     runHook preBuild
 
-    pnpm --filter @immich/sdk build
-    pnpm --filter @immich/cli build
+    pnpm --filter @immich/cli... build
 
     runHook postBuild
   '';

pkgs/by-name/im/immich-machine-learning/package.nix

@@ -1,6 +1,5 @@
 {
   lib,
-  fetchpatch2,
   immich,
   python3,
   nixosTests,
@@ -17,15 +16,6 @@ python.pkgs.buildPythonApplication rec {
   src = "${immich.src}/machine-learning";
   pyproject = true;
 
-  patches = [
-    (fetchpatch2 {
-      name = "fix_tests_with_openvino_ep.patch";
-      relative = "machine-learning";
-      url = "https://github.com/immich-app/immich/commit/7f611d90317d75ac3d75adf428f367376171e106.patch?full_index=1";
-      hash = "sha256-dntL5AZS3VIp7++yUec4HWIdtwltrnIePNFPJaiZdy4=";
-    })
-  ];
-
   pythonRelaxDeps = [
     "huggingface-hub"
     "insightface"

pkgs/by-name/im/immich/package.nix

@@ -4,7 +4,7 @@
   fetchFromGitHub,
   fetchPnpmDeps,
   pnpmConfigHook,
-  pnpm_10,
+  pnpm_11,
   python3,
   nodejs,
   node-gyp,
@@ -37,7 +37,7 @@
   buildPackages,
 }:
 let
-  pnpm = pnpm_10;
+  pnpm = pnpm_11;
 
   esbuild' = buildPackages.esbuild.override {
     buildGoModule =
@@ -45,12 +45,12 @@ let
       buildPackages.buildGoModule (
         args
         // rec {
-          version = "0.25.5";
+          version = "0.28.1";
           src = fetchFromGitHub {
             owner = "evanw";
             repo = "esbuild";
             tag = "v${version}";
-            hash = "sha256-jemGZkWmN1x2+ZzJ5cLp3MoXO0oDKjtZTmZS9Be/TDw=";
+            hash = "sha256-V+HKaWGAIs24ynFFIS9fQ0EAJJdNmlAMeL1sgDEAqWM=";
           };
           vendorHash = "sha256-+BfxCyg0KkDQpHt/wycy/8CTG6YBA/VJvJFhhzUnSiQ=";
         }
@@ -115,20 +115,20 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "immich";
-  version = "2.7.5";
+  version = "3.0.1";
 
   src = fetchFromGitHub {
     owner = "immich-app";
     repo = "immich";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-EC1IXM7KObAWfwG5KEao5VDp79d8WGNEI7E89lLOJ44=";
+    hash = "sha256-Z18SEjUdFP2/grQtHFI6J7CVcAMalshPt3Sd4tGXsDw=";
   };
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
     inherit pnpm;
-    fetcherVersion = 3;
-    hash = "sha256-FEesjbhxP7ydFfNshF3iFIk9N3Z53jrEZ9DRBjgEfs0=";
+    fetcherVersion = 4;
+    hash = "sha256-kCMFAPWcv2/qqVUoR5pbRxmkGg3mLPrpm8ce7R+9VYM=";
   };
 
   postPatch = ''
@@ -174,7 +174,7 @@ stdenv.mkDerivation (finalAttrs: {
     # If exiftool-vendored.pl isn't found, exiftool is searched for on the PATH
     rm node_modules/.pnpm/node_modules/exiftool-vendored.pl
 
-    pnpm --filter immich build
+    pnpm --filter immich... build
 
     runHook postBuild
   '';
@@ -196,8 +196,8 @@ stdenv.mkDerivation (finalAttrs: {
       -o -name '*.target.mk' \
     \) -exec rm -r {} +
 
-    mkdir -p "$packageOut/build"
-    ln -s '${finalAttrs.passthru.plugins}' "$packageOut/build/corePlugin"
+    mkdir -p "$packageOut/build/plugins"
+    ln -s '${finalAttrs.passthru.plugin-core}' "$packageOut/build/plugins/immich-plugin-core"
     ln -s '${finalAttrs.passthru.web}' "$packageOut/build/www"
     ln -s '${geodata}' "$packageOut/build/geodata"
 
@@ -231,8 +231,8 @@ stdenv.mkDerivation (finalAttrs: {
       immich = finalAttrs.finalPackage;
     };
 
-    plugins = stdenv.mkDerivation {
-      pname = "immich-plugins";
+    plugin-core = stdenv.mkDerivation {
+      pname = "immich-plugin-core";
       inherit (finalAttrs) version src pnpmDeps;
 
       nativeBuildInputs = [
@@ -246,7 +246,7 @@ stdenv.mkDerivation (finalAttrs: {
       buildPhase = ''
         runHook preBuild
 
-        pnpm --filter plugins build
+        pnpm --filter @immich/plugin-core... build
 
         runHook postBuild
       '';
@@ -254,7 +254,7 @@ stdenv.mkDerivation (finalAttrs: {
       installPhase = ''
         runHook preInstall
 
-        cd plugins
+        cd packages/plugin-core
         mkdir $out
         cp -r dist manifest.json $out
 
@@ -275,8 +275,7 @@ stdenv.mkDerivation (finalAttrs: {
       buildPhase = ''
         runHook preBuild
 
-        pnpm --filter @immich/sdk build
-        pnpm --filter immich-web build
+        pnpm --filter immich-web... build
 
         runHook postBuild
       '';

pkgs/by-name/in/interval-tree/package.nix

@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "interval-tree";
-  version = "3.1.1";
+  version = "3.1.2";
 
   src = fetchFromGitHub {
     owner = "5cript";
     repo = "interval-tree";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-bSZ56EzzNy6gHgs8OptT/iBlf56RJz+09BE4WGGJpog=";
+    hash = "sha256-t1/oTr+sYkpTiDzaM4SxUcWzO3r24EkUJO04TYNLcQQ=";
   };
 
   # interval-tree is a header only library

pkgs/by-name/je/jellyfin-mpv-shim/package.nix

@@ -10,12 +10,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "jellyfin-mpv-shim";
-  version = "2.9.0";
+  version = "2.10.0";
   pyproject = true;
 
+  # contains shaderpacks
   src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-YrwMvP66LAWKgx/yWBkWIkZtJ4a0YnhCiL7xB6fGm0E=";
+    pname = "jellyfin_mpv_shim";
+    inherit version;
+    hash = "sha256-ZWmJQJAGAonStZyWww4P+034f2vGnTwLua7KUOqoBBE=";
   };
 
   nativeBuildInputs = [
@@ -29,29 +31,23 @@ python3Packages.buildPythonApplication rec {
   dependencies = with python3Packages; [
     jellyfin-apiclient-python
     mpv
-    pillow
     python-mpv-jsonipc
+    requests
 
-    # gui dependencies
+    # gui + mirror dependencies
+    pillow
     pystray
     tkinter
 
-    # display_mirror dependencies
-    jinja2
-    pywebview
-
     # discord rich presence dependency
     pypresence
   ];
 
-  # override $HOME directory:
-  #   error: [Errno 13] Permission denied: '/homeless-shelter'
-  #
-  # remove jellyfin_mpv_shim/win_utils.py:
-  #   ModuleNotFoundError: No module named 'win32gui'
   preCheck = ''
     export HOME=$TMPDIR
 
+    # remove jellyfin_mpv_shim/win_utils.py:
+    #   ModuleNotFoundError: No module named 'win32gui'
     rm jellyfin_mpv_shim/win_utils.py
   '';
 
@@ -60,7 +56,7 @@ python3Packages.buildPythonApplication rec {
       --replace-fail "check_updates: bool = True" "check_updates: bool = False" \
       --replace-fail "notify_updates: bool = True" "notify_updates: bool = False"
     # python-mpv renamed to mpv with 1.0.4
-    substituteInPlace setup.py \
+    substituteInPlace pyproject.toml \
       --replace-fail "python-mpv" "mpv" \
       --replace-fail "mpv-jsonipc" "python_mpv_jsonipc"
   '';
@@ -70,7 +66,7 @@ python3Packages.buildPythonApplication rec {
     for s in 16 32 48 64 128 256; do
       mkdir -p $out/share/icons/hicolor/''${s}x''${s}/apps
       ln -s $out/${python3Packages.python.sitePackages}/jellyfin_mpv_shim/integration/jellyfin-''${s}.png \
-        $out/share/icons/hicolor/''${s}x''${s}/apps/${pname}.png
+        $out/share/icons/hicolor/''${s}x''${s}/apps/jellyfin-mpv-shim.png
     done
   '';
 
@@ -84,9 +80,9 @@ python3Packages.buildPythonApplication rec {
 
   desktopItems = [
     (makeDesktopItem {
-      name = pname;
-      exec = pname;
-      icon = pname;
+      name = "jellyfin-mpv-shim";
+      exec = "jellyfin-mpv-shim";
+      icon = "jellyfin-mpv-shim";
       desktopName = "Jellyfin MPV Shim";
       categories = [
         "Video"
@@ -123,5 +119,6 @@ python3Packages.buildPythonApplication rec {
     ];
     maintainers = with lib.maintainers; [ jojosch ];
     mainProgram = "jellyfin-mpv-shim";
+    platforms = lib.platforms.linux;
   };
 }

pkgs/by-name/jj/jjui/package.nix

@@ -8,13 +8,13 @@
 }:
 buildGo125Module (finalAttrs: {
   pname = "jjui";
-  version = "0.10.7";
+  version = "0.10.8";
 
   src = fetchFromGitHub {
     owner = "idursun";
     repo = "jjui";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-IcJImxowBuQy9MBsz4QesDJM484qSvfQxPx4ykQ0ttA=";
+    hash = "sha256-ZbmCPCTsSbphLUy+lrTt4/6DVq70edKGI59U0HDbawE=";
   };
 
   vendorHash = "sha256-thGlfZ0SwHpynYydxu6Sg8OUe5kr7jiPKvl6BXS5BWA=";

pkgs/by-name/la/lasuite-meet/frontend.nix

@@ -3,17 +3,37 @@
   version,
   meta,
   fetchNpmDeps,
+  fetchpatch,
   buildNpmPackage,
 }:
 buildNpmPackage (finalAttrs: {
   pname = "lasuite-meet-frontend";
   inherit src version;
 
+  patches = [
+    # backport build fix
+    # FIXME: remove in next release
+    (fetchpatch {
+      url = "https://github.com/suitenumerique/meet/commit/df1495c97bc913866169ee8875a9a3169fcfc87e.diff";
+      stripLen = 2;
+      includes = [
+        "package.json"
+        "package-lock.json"
+      ];
+      hash = "sha256-1A26T6LtFlOiJNVGD/fZs562feoQXY37A2ecUfvDGpk=";
+    })
+  ];
+
   sourceRoot = "${finalAttrs.src.name}/src/frontend";
 
   npmDeps = fetchNpmDeps {
-    inherit (finalAttrs) version src sourceRoot;
-    hash = "sha256-YnHjuwDp293KVNTYTd4KcZqMamZNeccOdpSGgJ9a3G8=";
+    inherit (finalAttrs)
+      version
+      src
+      patches
+      sourceRoot
+      ;
+    hash = "sha256-uiD5pcpmka43uraMFo7lRuQFx/4aq1BEhQvyCAzo8fg=";
   };
   npmBuildScript = "build";
 

pkgs/by-name/la/lasuite-meet/mail.nix

@@ -22,7 +22,7 @@ buildNpmPackage (finalAttrs: {
     pname = "${finalAttrs.pname}-npm-deps";
     inherit version src;
     inherit (finalAttrs) sourceRoot;
-    hash = "sha256-yq88kbrKn9HMwvxcWNXm7zonAqTs8T2i7iQAsD0TtnU=";
+    hash = "sha256-EPVkSzhecDZpvz+uOW0GZnmWl9KfE3UpkTCnhVnJ7dg=";
   };
   npmBuildScript = "build";
 

pkgs/by-name/la/lasuite-meet/package.nix

@@ -6,13 +6,13 @@
   python3,
 }:
 let
-  version = "1.21.0";
+  version = "1.22.0";
 
   src = fetchFromGitHub {
     owner = "suitenumerique";
     repo = "meet";
     tag = "v${version}";
-    hash = "sha256-pUCSdnTBj/qwc0cya3P96r89r2K1GNSGg4DeIhxUKwI=";
+    hash = "sha256-w2Lw5K62Iaqzqa/ckxK36o5ZHFLXUpHnGGGl5PYGjaI=";
   };
 
   meta = {
@@ -86,6 +86,7 @@ python.pkgs.buildPythonApplication (finalAttrs: {
       mozilla-django-oidc
       nested-multipart-parser
       phonenumbers
+      posthog
       psycopg
       pydantic
       pyjwt

pkgs/by-name/ma/matterjs-server/package.nix

@@ -12,7 +12,7 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "matterjs-server";
-  version = "1.1.2";
+  version = "1.1.7";
   __structuredAttrs = true;
   strictDeps = true;
 
@@ -20,10 +20,10 @@ buildNpmPackage (finalAttrs: {
     owner = "matter-js";
     repo = "matterjs-server";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-+ICWKZAcKwfd72eWUwmM7XmCwC4F6P+o1JsHNK2+ROE=";
+    hash = "sha256-8b4bLDVHTFcOHj3h/VuIxwdHJBleibZe9gUQvUD+aPA=";
   };
 
-  npmDepsHash = "sha256-L1G8/Y23deIjA4azMFLn+ZS95sKoRPSR1O7R8kZF5MU=";
+  npmDepsHash = "sha256-wkxYJtHwwpP87PDuE2HWA/2GDEUWfcSN2sEvjWz27a8=";
 
   nativeBuildInputs = [
     makeBinaryWrapper

pkgs/by-name/mc/mcp-server-filesystem/package.nix

@@ -7,13 +7,13 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "mcp-server-filesystem";
-  version = "2026.1.26";
+  version = "2026.7.4";
 
   src = fetchFromGitHub {
     owner = "modelcontextprotocol";
     repo = "servers";
     tag = finalAttrs.version;
-    hash = "sha256-uULXUEHFZpYm/fmF6PkOFCxS+B+0q3dMveLG+3JHrhk=";
+    hash = "sha256-rBdJoTC1wOEMbAAeSccFqaHL7lacf2SFfxZ/pp2Lx90=";
   };
 
   nativeBuildInputs = [
@@ -22,7 +22,7 @@ buildNpmPackage (finalAttrs: {
 
   dontNpmPrune = true;
   npmWorkspace = "src/filesystem";
-  npmDepsHash = "sha256-jmz4JdpeHH07vJQFntBwrENbJaIcOuZMb7+qf497VOE=";
+  npmDepsHash = "sha256-KhlTXcS+VDSPGnEus9fA0xhIxfTGwX1Cr5hbxFvdc2k=";
 
   # TODO: revisit this when https://github.com/NixOS/nixpkgs/pull/333759 has landed
   postInstall = ''

pkgs/by-name/mc/mcp-server-memory/package.nix

@@ -7,13 +7,13 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "mcp-server-memory";
-  version = "2026.1.26";
+  version = "2026.7.4";
 
   src = fetchFromGitHub {
     owner = "modelcontextprotocol";
     repo = "servers";
     tag = finalAttrs.version;
-    hash = "sha256-uULXUEHFZpYm/fmF6PkOFCxS+B+0q3dMveLG+3JHrhk=";
+    hash = "sha256-rBdJoTC1wOEMbAAeSccFqaHL7lacf2SFfxZ/pp2Lx90=";
   };
 
   nativeBuildInputs = [
@@ -22,7 +22,7 @@ buildNpmPackage (finalAttrs: {
 
   dontNpmPrune = true;
   npmWorkspace = "src/memory";
-  npmDepsHash = "sha256-jmz4JdpeHH07vJQFntBwrENbJaIcOuZMb7+qf497VOE=";
+  npmDepsHash = "sha256-KhlTXcS+VDSPGnEus9fA0xhIxfTGwX1Cr5hbxFvdc2k=";
 
   # TODO: revisit this when https://github.com/NixOS/nixpkgs/pull/333759 has landed
   postInstall = ''

pkgs/by-name/mc/mcp-server-sequential-thinking/package.nix

@@ -7,13 +7,13 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "mcp-server-sequential-thinking";
-  version = "2026.1.26";
+  version = "2026.7.4";
 
   src = fetchFromGitHub {
     owner = "modelcontextprotocol";
     repo = "servers";
     tag = finalAttrs.version;
-    hash = "sha256-uULXUEHFZpYm/fmF6PkOFCxS+B+0q3dMveLG+3JHrhk=";
+    hash = "sha256-rBdJoTC1wOEMbAAeSccFqaHL7lacf2SFfxZ/pp2Lx90=";
   };
 
   nativeBuildInputs = [
@@ -22,7 +22,7 @@ buildNpmPackage (finalAttrs: {
 
   dontNpmPrune = true;
   npmWorkspace = "src/sequentialthinking";
-  npmDepsHash = "sha256-jmz4JdpeHH07vJQFntBwrENbJaIcOuZMb7+qf497VOE=";
+  npmDepsHash = "sha256-KhlTXcS+VDSPGnEus9fA0xhIxfTGwX1Cr5hbxFvdc2k=";
 
   # TODO: revisit this when https://github.com/NixOS/nixpkgs/pull/333759 has landed
   postInstall = ''

pkgs/by-name/mo/mongodb-compass/package.nix

@@ -52,7 +52,7 @@
 
 let
   pname = "mongodb-compass";
-  version = "1.49.9";
+  version = "1.49.10";
 
   selectSystem =
     attrs:
@@ -67,9 +67,9 @@ let
       }
     }";
     hash = selectSystem {
-      x86_64-linux = "sha256-Fx//NMDHqVaLwthOM7FeSgUXkvLOSbw5EH1qp1dgPcM=";
-      x86_64-darwin = "sha256-l5Jx0BUQR++tkF0cpctxhku6lB2rHEydp7roJy9AGFc=";
-      aarch64-darwin = "sha256-HCKt1rq6P7Uy6NJiFRBBp4YdpAdhwQQjEGT5h7IcyWE=";
+      x86_64-linux = "sha256-faD8sIbnho5urBWE0btcmD7tXT8eQCNyJYzpIyI+bA4=";
+      x86_64-darwin = "sha256-Ddue3jSvQecBjxQlyh/+ujrF9NheZ9PS0Dq7J08SJr8=";
+      aarch64-darwin = "sha256-HGOJPYC4+CgLQQ3BNUTNZUln5oqPkC8ewHft99LCZQ8=";
     };
   };
 

pkgs/by-name/mo/mosdepth/package.nix

@@ -9,8 +9,6 @@ buildNimPackage (finalAttrs: {
   pname = "mosdepth";
   version = "0.3.13";
 
-  requiredNimVersion = 1;
-
   src = fetchFromGitHub {
     owner = "brentp";
     repo = "mosdepth";

pkgs/by-name/my/mysql84/package.nix

@@ -28,11 +28,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mysql";
-  version = "8.4.9";
+  version = "8.4.10";
 
   src = fetchurl {
     url = "https://dev.mysql.com/get/Downloads/MySQL-${lib.versions.majorMinor finalAttrs.version}/mysql-${finalAttrs.version}.tar.gz";
-    hash = "sha256-5KqLOeQtH+B48zu9c2lfrCtU28e7E38L2+Y/e+GgLWs=";
+    hash = "sha256-1XpnMLrvFK4Rj39KbgKEW1tQkzdY32H7BuEE8nzMj5Y=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/na/nanoarrow/package.nix

@@ -0,0 +1,89 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  fetchzip,
+
+  # nativeBuildInputs
+  meson,
+  ninja,
+  pkg-config,
+
+  # buildInputs
+  arrow-cpp,
+  gbenchmark,
+  gtest,
+  nlohmann_json,
+  zlib,
+  zstd,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "nanoarrow";
+  version = "0.8.0";
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  src = fetchFromGitHub {
+    owner = "apache";
+    repo = "arrow-nanoarrow";
+    tag = "apache-arrow-nanoarrow-${finalAttrs.version}";
+    hash = "sha256-1iLbT1eeyZaoB75uYTgg4qns+C7b4DErqMwJ9nQPRls=";
+  };
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+  ];
+
+  buildInputs = [
+    arrow-cpp
+    gbenchmark
+    gtest
+    nlohmann_json
+    zlib
+    zstd
+  ];
+
+  doCheck = true;
+
+  # Pre-populate the meson subproject with the flatcc source so meson doesn't try to download it.
+  # The wrap's patch_directory overlay (meson.build) must also be applied.
+  postPatch = ''
+    cp -r --no-preserve=mode ${finalAttrs.finalPackage.passthru.flatcc-src} ${finalAttrs.finalPackage.passthru.flatcc-src-dest}
+    cp subprojects/packagefiles/flatcc/meson.build ${finalAttrs.finalPackage.passthru.flatcc-src-dest}/
+  '';
+  mesonFlags = [
+    # Needed only on Darwin, because otherwise a metal-cpp dependency is
+    # required. It doesn't hurt to enable it for all platforms, so it'd be
+    # easier to spot if the option will disappear in the future for instance..
+    (lib.mesonOption "metal" "disabled")
+  ];
+
+  passthru = {
+    # Nanoarrow requires a specific post-0.6.1 flatcc commit that adds `_with_size` API variants not
+    # present in the upstream 0.6.1 release.
+    flatcc-src = fetchFromGitHub {
+      owner = "dvidelabs";
+      repo = "flatcc";
+      rev = "fd3c4ae5cd39f0651eda6a3a1a374278070135d6";
+      hash = "sha256-8MqazKuwfFWVJ/yjT5fNrRzexFQ2ky4YTcZqOYjk9Qc=";
+    };
+    flatcc-src-dest = "subprojects/flatcc-${finalAttrs.finalPackage.passthru.flatcc-src.rev}";
+  };
+
+  outputs = [
+    "out"
+    "dev"
+  ];
+
+  meta = {
+    description = "Helpers for Arrow C Data & Arrow C Stream interfaces";
+    homepage = "https://github.com/apache/arrow-nanoarrow";
+    changelog = "https://github.com/apache/arrow-nanoarrow/blob/${finalAttrs.src.rev}/CHANGELOG.md";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ doronbehar ];
+    platforms = lib.platforms.all;
+  };
+})

pkgs/by-name/ni/nim-1_0/nim.cfg.patch

@@ -1,31 +0,0 @@
-diff --git a/config/nim.cfg b/config/nim.cfg
-index 3b964d124..850ed0ed9 100644
---- a/config/nim.cfg
-+++ b/config/nim.cfg
-@@ -8,26 +8,12 @@
- # Environment variables can be accessed like so:
- #  gcc.path %= "$CC_PATH"
- 
--cc = gcc
--
- # additional options always passed to the compiler:
- --parallel_build: "0" # 0 to auto-detect number of processors
- 
- hint[LineTooLong]=off
- #hint[XDeclaredButNotUsed]=off
- 
--# Examples of how to setup a cross-compiler:
--
--# Cross-compiling for Raspberry Pi.
--# (This compiler is available in gcc-arm-linux-gnueabihf package on Ubuntu)
--arm.linux.gcc.exe = "arm-linux-gnueabihf-gcc"
--arm.linux.gcc.linkerexe = "arm-linux-gnueabihf-gcc"
--
--# For OpenWRT, you will also need to adjust PATH to point to your toolchain.
--mips.linux.gcc.exe = "mips-openwrt-linux-gcc"
--mips.linux.gcc.linkerexe = "mips-openwrt-linux-gcc"
--
--
- path="$lib/deprecated/core"
- path="$lib/deprecated/pure"
- path="$lib/pure/collections"

pkgs/by-name/ni/nim-1_0/package.nix

@@ -1,9 +0,0 @@
-{
-  nim-unwrapped-1,
-  nim,
-}:
-
-nim.passthru.wrapNim {
-  nimUnwrapped = nim-unwrapped-1;
-  patches = [ ./nim.cfg.patch ];
-}

pkgs/by-name/ni/nim-2_0/package.nix

@@ -1,9 +0,0 @@
-{
-  nim-unwrapped-2_0,
-  nim-2_2,
-}:
-
-nim-2_2.passthru.wrapNim {
-  nimUnwrapped = nim-unwrapped-2_0;
-  inherit (nim-2_2) patches;
-}

pkgs/by-name/ni/nim-unwrapped-1_0/extra-mangling.patch

@@ -1,52 +0,0 @@
-diff --git a/compiler/modulepaths.nim b/compiler/modulepaths.nim
-index fa8fab08a..63b0cb44d 100644
---- a/compiler/modulepaths.nim
-+++ b/compiler/modulepaths.nim
-@@ -73,6 +73,17 @@ proc checkModuleName*(conf: ConfigRef; n: PNode; doLocalError=true): FileIndex =
-   else:
-     result = fileInfoIdx(conf, fullPath)
- 
-+proc rot13(result: var string) =
-+  # don't mangle .nim
-+  let finalIdx =
-+    if result.endsWith(".nim"): result.len - 4
-+    else: result.len
-+  for i, c in result[0..<finalIdx]:
-+    case c
-+    of 'a'..'m', 'A'..'M': result[i] = char(c.uint8 + 13)
-+    of 'n'..'z', 'N'..'Z': result[i] = char(c.uint8 - 13)
-+    else: discard
-+
- proc mangleModuleName*(conf: ConfigRef; path: AbsoluteFile): string =
-   ## Mangle a relative module path to avoid path and symbol collisions.
-   ##
-@@ -81,9 +92,11 @@ proc mangleModuleName*(conf: ConfigRef; path: AbsoluteFile): string =
-   ##
-   ## Example:
-   ## `foo-#head/../bar` becomes `@foo-@hhead@s..@sbar`
--  "@m" & relativeTo(path, conf.projectPath).string.multiReplace(
-+  result = "@m" & relativeTo(path, conf.projectPath).string.multiReplace(
-     {$os.DirSep: "@s", $os.AltSep: "@s", "#": "@h", "@": "@@", ":": "@c"})
-+  rot13(result)
- 
- proc demangleModuleName*(path: string): string =
-   ## Demangle a relative module path.
-   result = path.multiReplace({"@@": "@", "@h": "#", "@s": "/", "@m": "", "@c": ":"})
-+  rot13(result)
-diff --git a/compiler/msgs.nim b/compiler/msgs.nim
-index ae4bcfcb8..1ad7e5c08 100644
---- a/compiler/msgs.nim
-+++ b/compiler/msgs.nim
-@@ -661,8 +661,10 @@ proc uniqueModuleName*(conf: ConfigRef; fid: FileIndex): string =
-   for i in 0..<trunc:
-     let c = rel[i]
-     case c
--    of 'a'..'z':
--      result.add c
-+    of 'a'..'m':
-+      result.add char(c.uint8 + 13)
-+    of 'n'..'z':
-+      result.add char(c.uint8 - 13)
-     of {os.DirSep, os.AltSep}:
-       result.add 'Z' # because it looks a bit like '/'
-     of '.':

pkgs/by-name/ni/nim-unwrapped-1_0/package.nix

@@ -1,30 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchurl,
-  nim-unwrapped-2,
-}:
-
-nim-unwrapped-2.overrideAttrs (
-  finalAttrs: prevAttrs: {
-    version = "1.6.20";
-    src = fetchurl {
-      url = "https://nim-lang.org/download/nim-${finalAttrs.version}.tar.xz";
-      hash = "sha256-/+0EdQTR/K9hDw3Xzz4Ce+kaKSsMnFEWFQTC87mE/7k=";
-    };
-
-    patches =
-      builtins.filter (
-        p:
-        builtins.elem (baseNameOf p) [
-          "NIM_CONFIG_DIR.patch"
-          "nixbuild.patch"
-        ]
-      ) nim-unwrapped-2.patches
-      ++ [
-        ./extra-mangling.patch
-        # Mangle store paths of modules to prevent runtime dependence.
-      ]
-      ++ lib.optional (!stdenv.hostPlatform.isWindows) ./toLocation.patch;
-  }
-)

pkgs/by-name/ni/nim-unwrapped-1_0/toLocation.patch

@@ -1,16 +0,0 @@
-diff --git a/lib/std/private/miscdollars.nim b/lib/std/private/miscdollars.nim
-index 840fedf54..6c3436308 100644
---- a/lib/std/private/miscdollars.nim
-+++ b/lib/std/private/miscdollars.nim
-@@ -6,9 +6,8 @@ template toLocation*(result: var string, file: string | cstring, line: int, col:
-   # it can be done in a single place.
-   result.add file
-   if line > 0:
--    result.add "("
-+    result.add ":"
-     addInt(result, line)
-     if col > 0:
--      result.add ", "
-+      result.add ":"
-       addInt(result, col)
--    result.add ")"

pkgs/by-name/ni/nim-unwrapped-2_0/package.nix

@@ -1,27 +0,0 @@
-{
-  lib,
-  fetchurl,
-  nim-unwrapped-1,
-  nim-unwrapped-2_2,
-}:
-
-nim-unwrapped-2_2.overrideAttrs (
-  finalAttrs: previousAttrs: {
-    version = "2.0.16";
-    src = fetchurl {
-      url = "https://nim-lang.org/download/nim-${finalAttrs.version}.tar.xz";
-      hash = "sha256-sucMbAEbVQcJMJCoiH+iUncyCP0EfuOPhWLiVp5cN4o=";
-    };
-    patches = lib.lists.unique (
-      builtins.filter (
-        p:
-        builtins.elem (baseNameOf p) [
-          "NIM_CONFIG_DIR.patch"
-          "nixbuild.patch"
-          "extra-mangling.patch"
-          "openssl.patch"
-        ]
-      ) (nim-unwrapped-1.patches ++ nim-unwrapped-2_2.patches)
-    );
-  }
-)

pkgs/by-name/ni/nim-unwrapped-2_2/extra-mangling-2.patch

@@ -1,52 +0,0 @@
-diff --git a/compiler/modulegraphs.nim b/compiler/modulegraphs.nim
-index 77762d23a..59dd8903a 100644
---- a/compiler/modulegraphs.nim
-+++ b/compiler/modulegraphs.nim
-@@ -503,7 +503,11 @@ proc uniqueModuleName*(conf: ConfigRef; m: PSym): string =
-   for i in 0..<trunc:
-     let c = rel[i]
-     case c
--    of 'a'..'z', '0'..'9':
-+    of 'a'..'m':
-+      result.add char(c.uint8 + 13)
-+    of 'n'..'z':
-+      result.add char(c.uint8 - 13)
-+    of '0'..'9':
-       result.add c
-     of {os.DirSep, os.AltSep}:
-       result.add 'Z' # because it looks a bit like '/'
-diff --git a/compiler/modulepaths.nim b/compiler/modulepaths.nim
-index c9e6060e5..2b349f27c 100644
---- a/compiler/modulepaths.nim
-+++ b/compiler/modulepaths.nim
-@@ -79,6 +79,17 @@ proc checkModuleName*(conf: ConfigRef; n: PNode; doLocalError=true): FileIndex =
-   else:
-     result = fileInfoIdx(conf, fullPath)
- 
-+proc rot13(result: var string) =
-+  # don't mangle .nim
-+  let finalIdx =
-+    if result.endsWith(".nim"): result.len - 4
-+    else: result.len
-+  for i, c in result[0..<finalIdx]:
-+    case c
-+    of 'a'..'m', 'A'..'M': result[i] = char(c.uint8 + 13)
-+    of 'n'..'z', 'N'..'Z': result[i] = char(c.uint8 - 13)
-+    else: discard
-+
- proc mangleModuleName*(conf: ConfigRef; path: AbsoluteFile): string =
-   ## Mangle a relative module path to avoid path and symbol collisions.
-   ##
-@@ -87,9 +98,11 @@ proc mangleModuleName*(conf: ConfigRef; path: AbsoluteFile): string =
-   ##
-   ## Example:
-   ## `foo-#head/../bar` becomes `@foo-@hhead@s..@sbar`
--  "@m" & relativeTo(path, conf.projectPath).string.multiReplace(
-+  result = "@m" & relativeTo(path, conf.projectPath).string.multiReplace(
-     {$os.DirSep: "@s", $os.AltSep: "@s", "#": "@h", "@": "@@", ":": "@c"})
-+  rot13(result)
- 
- proc demangleModuleName*(path: string): string =
-   ## Demangle a relative module path.
-   result = path.multiReplace({"@@": "@", "@h": "#", "@s": "/", "@m": "", "@c": ":"})
-+  rot13(result)

pkgs/by-name/ni/nim-unwrapped/extra-mangling.patch

@@ -0,0 +1,17 @@
+diff --git a/compiler/modulegraphs.nim b/compiler/modulegraphs.nim
+index 55f751cda..b0b3e3f40 100644
+--- a/compiler/modulegraphs.nim
++++ b/compiler/modulegraphs.nim
+@@ -466,7 +466,11 @@ proc uniqueModuleName*(conf: ConfigRef; m: PSym): string =
+   for i in 0..<trunc:
+     let c = rel[i]
+     case c
+-    of 'a'..'z', '0'..'9':
++    of 'a'..'m':
++      result.add char(c.uint8 + 13)
++    of 'n'..'z':
++      result.add char(c.uint8 - 13)
++    of '0'..'9':
+       result.add c
+     of {os.DirSep, os.AltSep}:
+       result.add 'Z' # because it looks a bit like '/'

pkgs/by-name/ni/nim-unwrapped/openssl.patch

@@ -48,21 +48,21 @@ index e659746ee..dfb2d3cf2 100644
        SSLeay()
  
 -    proc ERR_load_BIO_strings*() {.cdecl, dynlib: DLLUtilName, importc.}
-+    proc ERR_load_BIO_strings*() {.cdecl, gimportc.}
++    proc ERR_load_BIO_strings*() {.cdecl, importc.}
    else:
 -    proc OPENSSL_init_ssl*(opts: uint64, settings: uint8): cint {.cdecl, dynlib: DLLSSLName, importc, discardable.}
-+    proc OPENSSL_init_ssl*(opts: uint64, settings: uint8): cint {.cdecl, gimportc, discardable.}
++    proc OPENSSL_init_ssl*(opts: uint64, settings: uint8): cint {.cdecl, importc, discardable.}
      proc SSL_library_init*(): cint {.discardable.} =
        ## Initialize SSL using OPENSSL_init_ssl for OpenSSL >= 1.1.0
        return OPENSSL_init_ssl(0.uint64, 0.uint8)
  
 -    proc TLS_method*(): PSSL_METHOD {.cdecl, dynlib: DLLSSLName, importc.}
-+    proc TLS_method*(): PSSL_METHOD {.cdecl, gimportc.}
++    proc TLS_method*(): PSSL_METHOD {.cdecl, importc.}
      proc SSLv23_method*(): PSSL_METHOD =
        TLS_method()
  
 -    proc OpenSSL_version_num(): culong {.cdecl, dynlib: DLLUtilName, importc.}
-+    proc OpenSSL_version_num(): culong {.cdecl, gimportc.}
++    proc OpenSSL_version_num(): culong {.cdecl, importc.}
  
      proc getOpenSSLVersion*(): culong =
        ## Return OpenSSL version as unsigned long
@@ -71,13 +71,13 @@ index e659746ee..dfb2d3cf2 100644
  
    when defined(libressl) or defined(openssl10):
 -    proc SSL_state(ssl: SslPtr): cint {.cdecl, dynlib: DLLSSLName, importc.}
-+    proc SSL_state(ssl: SslPtr): cint {.cdecl, gimportc.}
++    proc SSL_state(ssl: SslPtr): cint {.cdecl, importc.}
      proc SSL_in_init*(ssl: SslPtr): cint {.inline.} =
        SSL_state(ssl) and SSL_ST_INIT
    else:
 -    proc SSL_in_init*(ssl: SslPtr): cint {.cdecl, dynlib: DLLSSLName, importc.}
 -    proc SSL_CTX_set_ciphersuites*(ctx: SslCtx, str: cstring): cint {.cdecl, dynlib: DLLSSLName, importc.}
-+    proc SSL_in_init*(ssl: SslPtr): cint {.cdecl, gimportc.}
++    proc SSL_in_init*(ssl: SslPtr): cint {.cdecl, importc.}
 +    proc SSL_CTX_set_ciphersuites*(ctx: SslCtx, str: cstring): cint {.cdecl, importc.}
  
    template OpenSSL_add_all_algorithms*() = discard
@@ -89,7 +89,7 @@ index e659746ee..dfb2d3cf2 100644
 +  proc SSLv23_client_method*(): PSSL_METHOD {.cdecl, importc.}
 +  proc SSLv2_method*(): PSSL_METHOD {.cdecl, importc.}
 +  proc SSLv3_method*(): PSSL_METHOD {.cdecl, importc.}
-+  proc CRYPTO_set_mem_functions(a,b,c: pointer){.cdecl, gimportc.}
++  proc CRYPTO_set_mem_functions(a,b,c: pointer){.cdecl, importc.}
  
  else:
    # Here we're trying to stay compatible between openssl versions. Some

pkgs/by-name/ni/nim-unwrapped/package.nix

@@ -13,12 +13,12 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "nim-unwrapped";
-  version = "2.2.4";
+  version = "2.2.10";
   strictDeps = true;
 
   src = fetchurl {
     url = "https://nim-lang.org/download/nim-${finalAttrs.version}.tar.xz";
-    hash = "sha256-+CtBl1D8zlYfP4l6BIaxgBhoRddvtdmfJIzhZhCBicc=";
+    hash = "sha256-eVe37QBCBrzxC8xPO0dEFTh45i8kMVUqmo6dP0Do1dU=";
   };
 
   buildInputs = [
@@ -36,7 +36,7 @@ stdenv.mkDerivation (finalAttrs: {
     ./nixbuild.patch
     # Load libraries at runtime by absolute path
 
-    ./extra-mangling-2.patch
+    ./extra-mangling.patch
     # Mangle store paths of modules to prevent runtime dependence.
 
     ./openssl.patch
@@ -49,6 +49,11 @@ stdenv.mkDerivation (finalAttrs: {
         pname = "nim-bootstrap";
         inherit (finalAttrs) version src preBuild;
         enableParallelBuilding = true;
+        buildPhase = ''
+          runHook preBuild
+          ./build.sh
+          runHook postBuild
+        '';
         installPhase = ''
           runHook preInstall
           install -Dt $out/bin bin/nim
@@ -67,9 +72,7 @@ stdenv.mkDerivation (finalAttrs: {
     "--cpu:${stdenv.hostPlatform.nim.cpu}"
     "--os:${stdenv.hostPlatform.nim.os}"
     "-d:release"
-    "-d:useGnuReadline"
-  ]
-  ++ lib.optional (stdenv.hostPlatform.isDarwin || stdenv.hostPlatform.isLinux) "-d:nativeStacktrace";
+  ];
 
   preBuild = lib.optionalString (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64) ''
     substituteInPlace makefile \

pkgs/by-name/ni/nim/package.nix

@@ -8,7 +8,7 @@
   makeWrapper,
   openssl,
   pcre,
-  nim-unwrapped-2_2 ? buildPackages.nim-unwrapped-2_2,
+  nim-unwrapped ? buildPackages.nim-unwrapped,
 }:
 
 let
@@ -18,7 +18,7 @@ let
       targetPlatformConfig = stdenv.targetPlatform.config;
     in
     stdenv.mkDerivation (finalAttrs: {
-      name = "${targetPlatformConfig}-nim-wrapper-${nimUnwrapped.version}";
+      pname = "${targetPlatformConfig}-nim-wrapper";
       inherit (nimUnwrapped) version;
       preferLocalBuild = true;
       strictDeps = true;
@@ -86,7 +86,7 @@ let
           runHook postBuild
         '';
 
-      wrapperArgs = lib.optionals (!(stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64)) [
+      wrapperArgs = [
         "--prefix PATH : ${lib.makeBinPath [ buildPackages.gdb ]}:${placeholder "out"}/bin"
         # Used by nim-gdb
 
@@ -148,6 +148,6 @@ let
     });
 in
 wrapNim {
-  nimUnwrapped = nim-unwrapped-2_2;
+  nimUnwrapped = nim-unwrapped;
   patches = [ ./nim2.cfg.patch ];
 }

pkgs/by-name/ni/nim_lk/nil.patch

@@ -0,0 +1,13 @@
+diff --git a/src/nim_lk.nim b/src/nim_lk.nim
+index 09ced9d..45c5ddc 100644
+--- a/src/nim_lk.nim
++++ b/src/nim_lk.nim
+@@ -573,7 +573,7 @@ proc update(bom: JsonNode; bomRef: string; byName: bool): bool =
+   let comp = bom.getComponent(bomRef, byName)
+   assert not comp.isNil
+   var bomRef = comp{"bom-ref"}.getStr
+-  assert not bomRef.isNil
++  assert bomRef != ""
+   var suitableRefFound = false
+   let extRefs = comp{"externalReferences"}
+   for extRef in extRefs.elems:

pkgs/by-name/ni/nim_lk/package.nix

@@ -23,6 +23,10 @@ buildNimSbom (finalAttrs: {
   buildInputs = [ openssl ];
   nativeBuildInputs = [ makeWrapper ];
 
+  patches = [
+    ./nil.patch
+  ];
+
   postFixup = ''
     wrapProgram $out/bin/nim_lk \
       --suffix PATH : ${