python3Packages.schwifty: 2026.01.0 -> 2026.07.0 (#538909)

https://github.com/home-assistant-libs/modbus-connection/releases/tag/3.4.0
https://github.com/home-assistant-libs/modbus-connection/releases/tag/3.4.1

doc/release-notes/rl-2611.section.md

@@ -4,7 +4,17 @@
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
-- Create the first release note entry in this section!
+- The {file}`nixexprs.tar.xz` tarball will be discontinued together with Nixpkgs
+  27.05 after 2027-12-31. Migrate to the {file}`nixexprs.tar.zst` tarball
+  instead.
+
+  This affects for example users who pull Nixpkgs as a flake input from
+  https://channels.nixos.org:
+
+  ```diff
+  -nixpkgs.url = "https://channels.nixos.org/nixos-26.05/nixexprs.tar.xz";
+  +nixpkgs.url = "https://channels.nixos.org/nixos-26.05/nixexprs.tar.zst";
+  ```
 
 ## Backward Incompatibilities {#sec-nixpkgs-release-26.11-incompatibilities}
 
@@ -25,6 +35,9 @@
 
 - `hurl` has been updated to `8.x.x` which has some breaking changes. See [upstream changelog](https://github.com/Orange-OpenSource/hurl/releases/tag/8.0.0) for details.
 
+- `gotosocial` has been updated to 0.22.0. This release contains a very long database migration, which should not be cancelled or interrupted under any circumstances.
+ -  Postgres users: Following the migration, if you encounter slowdown on Postgres specifically (ie., timing out while loading timelines) you may need to run some manual database maintenance steps. Please check https://docs.gotosocial.org/en/stable/admin/database_maintenance/#postgres.
+
 - `xsecurelock` no longer supports authentication via htaccess files (`~/.xsecurelock.pw`) or via the `pamtester` program by default. Only the recommended PAM module is supported unless rebuilt with `withHtaccess` or `withPamtester`.
 
 - `python3Packages.django-health-check` has been updated to major version 4. See its [migration guide](https://codingjoe.dev/django-health-check/migrate-to-v4/) and [changelog](https://github.com/codingjoe/django-health-check/releases/tag/4.0.0) for breaking changes.

maintainers/maintainer-list.nix

@@ -9542,12 +9542,6 @@
     name = "Fritz Stracke";
     keys = [ { fingerprint = "7A9D 6DB2 0C5A AA55 7838  EEE6 B8CA 2D9A D8F0 506F"; } ];
   };
-  ftrvxmtrx = {
-    email = "ftrvxmtrx@gmail.com";
-    github = "ftrvxmtrx";
-    githubId = 248148;
-    name = "Sigrid Solveig Haflínudóttir";
-  };
   ftsimas = {
     name = "Filippos Tsimas";
     email = "filippos.tsimas@outlook.com";
@@ -9732,6 +9726,12 @@
     githubId = 45048741;
     name = "Alwanga Oyango";
   };
+  galder = {
+    email = "galder@ibm.com";
+    github = "galderz";
+    githubId = 50187;
+    name = "Galder Zamarreño";
+  };
   gale-username = {
     name = "gale";
     email = "git@galewebsite.com";
@@ -20161,7 +20161,7 @@
     name = "Nindouja";
   };
   ninelore = {
-    email = "9l+nix@9lo.re";
+    email = "9l@9lo.re";
     matrix = "@9lore:tchncs.de";
     github = "ninelore";
     githubId = 21343557;
@@ -24149,6 +24149,12 @@
     githubId = 7335;
     name = "Roman Gonzalez";
   };
+  roman-16 = {
+    email = "roman@lerchster.dev";
+    github = "roman-16";
+    githubId = 15262665;
+    name = "Roman";
+  };
   romildo = {
     email = "malaquias@gmail.com";
     github = "romildo";
@@ -28293,6 +28299,12 @@
     githubId = 1334474;
     name = "Timothy Stott";
   };
+  tiptenbrink = {
+    email = "tip@tenbrinkmeijs.com";
+    github = "tiptenbrink";
+    githubId = 75669206;
+    name = "Tip ten Brink";
+  };
   tiramiseb = {
     email = "sebastien@maccagnoni.eu";
     github = "tiramiseb";

maintainers/scripts/haskell/eval-pkg-sets.sh

@@ -1,39 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i bash
-#!nix-shell -p jq git
-# shellcheck shell=bash
-#
-# Usage: eval-pkg-sets.sh [extra flags for nix-* commands ...]
-#
-# Must be executed in a git checkout of Nixpkgs.
-
-set -euo pipefail
-
-NIXPKGS="$(git rev-parse --show-toplevel)"
-PKGSETS="$(nix-env --readonly-mode --json --drv-path -f "$NIXPKGS" -qaP -A haskell.compiler "$@" \
-  | jq -r 'to_entries | unique_by(.value.drvPath) .[] .key | sub("^haskell.compiler";"haskell.packages")')"
-
-trap 'exit 1' SIGINT SIGTERM
-
-set +e
-
-badsets=""
-for set in $PKGSETS; do
-  # Confirm an equivalent package set to haskell.compiler.$entry exists and is usable
-  if ! nix-instantiate --readonly-mode -A "$set.ghc" "$@" > /dev/null 2>&1; then
-    echo "Skipping $set... ($set.ghc does not evaluate)"
-  else
-    echo "Evaluating $set..."
-
-    if ! nix-env --readonly-mode -f "$NIXPKGS" -qaP --drv-path -A "$set" "$@" > /dev/null; then
-      badsets+="$set "
-    fi
-  fi
-done
-
-if [ -n "$badsets" ]; then
-  echo "Found potential eval issues in the following sets:" >&2
-  # shellcheck disable=SC2086
-  printf '%s\n' $badsets
-  exit 1
-fi

maintainers/scripts/haskell/update-stackage.sh

@@ -33,7 +33,7 @@ fi
 
 # Stackage solver to use, LTS or Nightly
 # (should be capitalized like the display name)
-SOLVER=Nightly
+SOLVER=LTS
 # Stackage solver verson, if any. Use latest if empty
 VERSION=
 TMP_TEMPLATE=update-stackage.XXXXXXX
@@ -105,7 +105,6 @@ sed -r \
     -e '/ hledger-ui /d' \
     -e '/ hledger-web /d' \
     -e '/ spacecookie /d' \
-    -e '/ hnix-store-core /d' \
     < "${tmpfile_new}" >> $stackage_config
 # Explanations:
 # cabal2nix, distribution-nixpkgs, jailbreak-cabal, language-nix: These are our packages and we know what we are doing.

nixos/doc/manual/release-notes/rl-2611.section.md

@@ -6,6 +6,18 @@
 
 - The default PostgreSQL version for new NixOS installations (i.e. with `system.stateVersion >= 26.11`) is v18.
 
+- The {file}`nixexprs.tar.xz` tarball will be discontinued together with Nixpkgs
+  27.05 after 2027-12-31. Migrate to the {file}`nixexprs.tar.zst` tarball
+  instead.
+
+  This affects for example users who pull Nixpkgs as a flake input from
+  https://channels.nixos.org:
+
+  ```diff
+  -nixpkgs.url = "https://channels.nixos.org/nixos-26.05/nixexprs.tar.xz";
+  +nixpkgs.url = "https://channels.nixos.org/nixos-26.05/nixexprs.tar.zst";
+  ```
+
 ## New Modules {#sec-release-26.11-new-modules}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
@@ -36,6 +48,8 @@
 
 - [Matrix Authentication Service](https://github.com/element-hq/matrix-authentication-service) is an OAuth2.0 and OpenID Connect provider for Matrix homeservers (such as Synapse). It replaces standard password authentication with modern OpenID Connect flows, and can delegate authentication to upstream OIDC providers. Available as [services.matrix-authentication-service](#opt-services.matrix-authentication-service.enable).
 
+- [stash-clipboard](https://github.com/NotAShelf/stash), a Wayland clipboard "manager" with fast persistent history and multi-media support. Available as [services.stash-clipboard](#opt-services.stash-clipboard.enable).
+
 ## Backward Incompatibilities {#sec-release-26.11-incompatibilities}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->

nixos/lib/make-channel.nix

@@ -18,7 +18,10 @@ pkgs.releaseTools.makeSourceTarball {
   officialRelease = false; # FIXME: fix this in makeSourceTarball
   inherit version versionSuffix;
 
-  buildInputs = [ pkgs.nix ];
+  buildInputs = with pkgs; [
+    nix
+    zstd
+  ];
 
   distPhase = ''
     rm -rf .git
@@ -32,6 +35,35 @@ pkgs.releaseTools.makeSourceTarball {
     NIX_STATE_DIR=$TMPDIR nix-env -f ../$releaseName/default.nix -qaP --meta --show-trace --xml \* > /dev/null
     cd ..
     chmod -R u+w $releaseName
-    tar cfJ $out/tarballs/$releaseName.tar.xz $releaseName
+
+    # The compression tasks are shortlived; use all available CPUs (-T0) to
+    # prioritize fast channel advancement.
+    XZ_OPT="-T0" tar \
+      --create \
+      --file=$out/tarballs/$releaseName.tar.xz \
+      --xz \
+      --absolute-names \
+      --owner=0 \
+      --group=0 \
+      --numeric-owner \
+      --format=gnu \
+      --sort=name \
+      --mtime="@$SOURCE_DATE_EPOCH" \
+      --hard-dereference \
+      $releaseName
+
+    tar \
+      --create \
+      --file="$out/tarballs/$releaseName.tar.zst" \
+      --use-compress-program="zstd -19 -T0" \
+      --absolute-names \
+      --owner=0 \
+      --group=0 \
+      --numeric-owner \
+      --format=gnu \
+      --sort=name \
+      --mtime="@$SOURCE_DATE_EPOCH" \
+      --hard-dereference \
+      $releaseName
   '';
 }

nixos/modules/module-list.nix

@@ -982,6 +982,7 @@
   ./services/misc/spice-webdavd.nix
   ./services/misc/spoolman.nix
   ./services/misc/sssd.nix
+  ./services/misc/stash-clipboard.nix
   ./services/misc/subsonic.nix
   ./services/misc/sundtek.nix
   ./services/misc/svnserve.nix

nixos/modules/services/continuous-integration/hydra/default.nix

@@ -360,7 +360,7 @@ in
         ${lib.optionalString haveLocalDB ''
           if ! [ -e ${baseDir}/.db-created ]; then
             runuser -u ${config.services.postgresql.superUser} ${config.services.postgresql.package}/bin/createuser hydra
-            runuser -u ${config.services.postgresql.superUser} ${config.services.postgresql.package}/bin/createdb -O hydra hydra
+            runuser -u ${config.services.postgresql.superUser} ${config.services.postgresql.package}/bin/createdb -- -O hydra hydra
             touch ${baseDir}/.db-created
           fi
           echo "create extension if not exists pg_trgm" | runuser -u ${config.services.postgresql.superUser} -- ${config.services.postgresql.package}/bin/psql hydra

nixos/modules/services/misc/stash-clipboard.nix

@@ -0,0 +1,73 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.stash-clipboard;
+  inherit (lib)
+    mkPackageOption
+    mkEnableOption
+    mkOption
+    types
+    mkIf
+    getExe
+    concatStringsSep
+    ;
+in
+{
+  options.services.stash-clipboard = {
+    enable = mkEnableOption "stash, a Wayland clipboard manager";
+
+    package = mkPackageOption pkgs [ "stash-clipboard" ] { };
+
+    arguments = mkOption {
+      type = types.listOf types.str;
+      default = [ ];
+      example = [ "--max-items 10" ];
+      description = "A list of arguments to pass to stash watch.";
+    };
+
+    filterFile = mkOption {
+      type = types.str;
+      default = "";
+      example = "/etc/stash/clipboard_filter";
+      description = ''
+        Stash can be configured to avoid storing clipboard entries that match a sensitive pattern, using a regular expression.
+        The file set here should contain your regex pattern (no quotes).
+
+        Example regex to block common password patterns:
+        - (password|secret|api[_-]?key|token)[=: ]+[^\s]+
+      '';
+    };
+
+    excludedApps = mkOption {
+      type = types.listOf types.str;
+      default = [ ];
+      example = [ "Bitwarden" ];
+      description = ''
+        List of application classes to exclude from the database.
+        Entries from these apps are still copied to the clipboard, but it will never be put inside the database.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    environment.systemPackages = [ cfg.package ];
+    systemd = {
+      user.services.stash-clipboard = {
+        description = "Stash clipboard manager daemon";
+        wantedBy = [ "graphical-session.target" ];
+        after = [ "graphical-session.target" ];
+        serviceConfig = {
+          ExecStart = "${getExe cfg.package} ${concatStringsSep " " cfg.arguments} watch";
+          LoadCredential = mkIf (cfg.filterFile != "") "clipboard_filter:${cfg.filterFile}";
+        };
+        environment = mkIf (cfg.excludedApps != [ ]) {
+          STASH_EXCLUDED_APPS = concatStringsSep "," cfg.excludedApps;
+        };
+      };
+    };
+  };
+}

nixos/modules/services/networking/mjpg-streamer.nix

@@ -20,6 +20,8 @@ in
 
       enable = mkEnableOption "mjpg-streamer webcam streamer";
 
+      package = mkPackageOption pkgs "mjpg-streamer" { };
+
       inputPlugin = mkOption {
         type = types.str;
         default = "input_uvc.so";
@@ -77,7 +79,7 @@ in
         IPLUGIN="${cfg.inputPlugin}"
         OPLUGIN="${cfg.outputPlugin}"
         OPLUGIN="''${OPLUGIN//@www@/${pkgs.mjpg-streamer}/share/mjpg-streamer/www}"
-        exec ${pkgs.mjpg-streamer}/bin/mjpg_streamer -i "$IPLUGIN" -o "$OPLUGIN"
+        exec ${lib.getExe cfg.package} -i "$IPLUGIN" -o "$OPLUGIN"
       '';
     };
 

nixos/modules/services/web-apps/akkoma.md

@@ -27,7 +27,7 @@ be run behind a HTTP proxy on `fediverse.example.com`.
         name = "My Akkoma instance";
         description = "More detailed description";
         email = "admin@example.com";
-        registration_open = false;
+        registrations_open = false;
       };
 
       "Pleroma.Web.Endpoint" = {
@@ -221,17 +221,28 @@ of the fediverse and providing a pleasant experience to the users of an instance
 
     ":mrf_simple" = {
       # Tag all media as sensitive
-      media_nsfw = mkMap { "nsfw.weird.kinky" = "Untagged NSFW content"; };
+      media_nsfw = map mkTuple [
+        [
+          "nsfw.weird.kinky"
+          "Untagged NSFW content"
+        ]
+      ];
 
       # Reject all activities except deletes
-      reject = mkMap {
-        "kiwifarms.cc" = "Persistent harassment of users, no moderation";
-      };
+      reject = map mkTuple [
+        [
+          "kiwifarms.cc"
+          "Persistent harassment of users, no moderation"
+        ]
+      ];
 
       # Force posts to be visible by followers only
-      followers_only = mkMap {
-        "beta.birdsite.live" = "Avoid polluting timelines with Twitter posts";
-      };
+      followers_only = map mkTuple [
+        [
+          "beta.birdsite.live"
+          "Avoid polluting timelines with Twitter posts"
+        ]
+      ];
     };
   };
 }

nixos/modules/services/web-apps/part-db.nix

@@ -8,6 +8,11 @@ let
   cfg = config.services.part-db;
   pkg = cfg.package;
 
+  envFile = pkgs.writeText "part-db-env" (
+    lib.concatStringsSep "\n" (lib.mapAttrsToList (key: value: "${key}=\"${value}\"") cfg.settings)
+    + "\n"
+  );
+
   inherit (lib)
     mkEnableOption
     mkPackageOption
@@ -62,6 +67,17 @@ in
       '';
     };
 
+    environmentFile = mkOption {
+      type = types.nullOr types.path;
+      default = null;
+      example = "/run/secrets/part-db.env";
+      description = ''
+        Path to a file containing extra Part-DB environment variables in dotenv
+        format. This can be used for secrets such as `APP_SECRET` without
+        putting them in the Nix store.
+      '';
+    };
+
     poolConfig = lib.mkOption {
       type = lib.types.attrsOf (
         lib.types.oneOf [
@@ -176,18 +192,34 @@ in
           root = "${pkg}/public";
           locations = {
             "/" = {
-              tryFiles = "$uri $uri/ /index.php?$query_string";
+              tryFiles = "$uri $uri/ /index.php$is_args$args";
               index = "index.php";
               extraConfig = ''
+                add_header Content-Security-Policy "default-src 'self'; script-src 'none'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; sandbox;" always;
+                add_header X-Content-Type-Options "nosniff" always;
                 sendfile off;
               '';
             };
-            "~ \\.php$" = {
+            "= /index.php" = {
               extraConfig = ''
-                include ${config.services.nginx.package}/conf/fastcgi_params ;
-                fastcgi_param SCRIPT_FILENAME $request_filename;
-                fastcgi_param modHeadersAvailable true; #Avoid sending the security headers twice
+                include ${config.services.nginx.package}/conf/fastcgi_params;
+                fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
+                fastcgi_param DOCUMENT_ROOT $realpath_root;
+                fastcgi_param modHeadersAvailable true; # Avoid sending the security headers twice
                 fastcgi_pass unix:${config.services.phpfpm.pools.part-db.socket};
+                internal;
+              '';
+            };
+            "~ \\.php$" = {
+              return = "404";
+            };
+            "~* ^/media/.*\\.(php[3-8]?|phar|phtml|pht|phps)$" = {
+              return = "403";
+            };
+            "~* \\.svg$" = {
+              extraConfig = ''
+                add_header Content-Security-Policy "default-src 'self'; script-src 'none'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; frame-ancestors 'none'; sandbox;" always;
+                add_header X-Content-Type-Options "nosniff" always;
               '';
             };
           };
@@ -197,10 +229,32 @@ in
 
     systemd = {
       services = {
+        part-db-setup = {
+          before = [ "part-db-migrate.service" ];
+          wantedBy = [ "multi-user.target" ];
+          serviceConfig = {
+            Type = "oneshot";
+            RemainAfterExit = true;
+          };
+          restartTriggers = [ envFile ];
+          script = ''
+            install -Dm0600 -o part-db -g part-db ${envFile} /var/lib/part-db/env.local
+          ''
+          + lib.optionalString (cfg.environmentFile != null) ''
+            cat ${lib.escapeShellArg cfg.environmentFile} >> /var/lib/part-db/env.local
+          '';
+        };
+
         part-db-migrate = {
           before = [ "phpfpm-part-db.service" ];
-          after = [ "postgresql.target" ];
-          requires = [ "postgresql.target" ];
+          after = [
+            "postgresql.target"
+            "part-db-setup.service"
+          ];
+          requires = [
+            "postgresql.target"
+            "part-db-setup.service"
+          ];
           wantedBy = [ "multi-user.target" ];
           serviceConfig = {
             Type = "oneshot";
@@ -235,10 +289,30 @@ in
           user = "part-db";
           group = "part-db";
         };
-        "/var/lib/part-db/env.local"."L+" = {
-          argument = "${pkgs.writeText "part-db-env" (
-            lib.concatStringsSep "\n" (lib.mapAttrsToList (key: value: "${key}=\"${value}\"") cfg.settings)
-          )}";
+        "/var/lib/part-db/".d = {
+          mode = "0755";
+          user = "part-db";
+          group = "part-db";
+        };
+        "/var/lib/part-db/public/".d = {
+          mode = "0755";
+          user = "part-db";
+          group = "part-db";
+        };
+        "/var/lib/part-db/public/media/".d = {
+          mode = "0755";
+          user = "part-db";
+          group = "part-db";
+        };
+        "/var/lib/part-db/uploads/".d = {
+          mode = "0750";
+          user = "part-db";
+          group = "part-db";
+        };
+        "/var/lib/part-db/share/".d = {
+          mode = "0750";
+          user = "part-db";
+          group = "part-db";
         };
         "/var/log/part-db/".d = {
           mode = "0750";

nixos/modules/services/web-apps/pretalx.nix

@@ -277,7 +277,7 @@ in
             backend = lib.mkOption {
               type = with lib.types; nullOr str;
               default = "redis+socket://${config.services.redis.servers.pretalx.unixSocket}?virtual_host=1";
-              defaultText = lib.literalExpression "redis+socket://''${config.services.redis.servers.pretalx.unixSocket}?virtual_host=1";
+              defaultText = lib.literalExpression "redis+socket://\${config.services.redis.servers.pretalx.unixSocket}?virtual_host=1";
               description = ''
                 URI to the celery backend used for the asynchronous job queue.
               '';
@@ -286,7 +286,7 @@ in
             broker = lib.mkOption {
               type = with lib.types; nullOr str;
               default = "redis+socket://${config.services.redis.servers.pretalx.unixSocket}?virtual_host=2";
-              defaultText = lib.literalExpression "redis+socket://''${config.services.redis.servers.pretalx.unixSocket}?virtual_host=2";
+              defaultText = lib.literalExpression "redis+socket://\${config.services.redis.servers.pretalx.unixSocket}?virtual_host=2";
               description = ''
                 URI to the celery broker used for the asynchronous job queue.
               '';

nixos/modules/services/x11/desktop-managers/default.nix

@@ -13,7 +13,7 @@ let
 
   # If desktop manager `d' isn't capable of setting a background and
   # the xserver is enabled, `feh' or `xsetroot' are used as a fallback.
-  needBGCond = d: !(d ? bgSupport && d.bgSupport) && xcfg.enable;
+  needBGCond = d: !(d ? bgSupport && d.bgSupport) && xcfg.enable && cfg.wallpaper.enable;
 
 in
 
@@ -48,6 +48,16 @@ in
     services.xserver.desktopManager = {
 
       wallpaper = {
+        enable = mkOption {
+          type = types.bool;
+          default = true;
+          description = ''
+            The file {file}`~/.background-image` is used as a background image.
+            The `mode` option specifies the placement of this image onto your desktop.
+            To disable this, set this option to `false`.
+          '';
+        };
+
         mode = mkOption {
           type = types.enum [
             "center"
@@ -59,9 +69,6 @@ in
           default = "scale";
           example = "fill";
           description = ''
-            The file {file}`~/.background-image` is used as a background image.
-            This option specifies the placement of this image onto your desktop.
-
             Possible values:
             `center`: Center the image on the background. If it is too small, it will be surrounded by a black border.
             `fill`: Like `scale`, but preserves aspect ratio by zooming the image until it fits. Either a horizontal or a vertical part of the image will be cut off.

nixos/tests/caddy.nix

@@ -1,11 +1,11 @@
-{ pkgs, ... }:
+{ lib, ... }:
+
 {
   name = "caddy";
-  meta = with pkgs.lib.maintainers; {
-    maintainers = [
-      stepbrobd
-    ];
-  };
+
+  meta.maintainers = with lib.maintainers; [
+    stepbrobd
+  ];
 
   nodes = {
     webserver =
@@ -69,24 +69,6 @@
             respond "hello world"
           '';
         };
-        specialisation.with-plugins.configuration = {
-          services.caddy = {
-            package = pkgs.caddy.withPlugins {
-              plugins = [ "github.com/caddyserver/replace-response@v0.0.0-20250618171559-80962887e4c6" ];
-              hash = "sha256-0N/bQAM5yT6g9UAteWsfxofGcelmU/NDTroS2oL43Gs=";
-            };
-            configFile = pkgs.writeText "Caddyfile" ''
-              {
-                order replace after encode
-              }
-
-              localhost:80 {
-                respond "hello world"
-                replace world caddy
-              }
-            '';
-          };
-        };
       };
   };
 
@@ -98,7 +80,6 @@
       multipleConfigs = "${nodes.webserver.system.build.toplevel}/specialisation/multiple-configs";
       multipleHostnames = "${nodes.webserver.system.build.toplevel}/specialisation/multiple-hostnames";
       rfc42Config = "${nodes.webserver.system.build.toplevel}/specialisation/rfc42";
-      withPluginsConfig = "${nodes.webserver.system.build.toplevel}/specialisation/with-plugins";
     in
     ''
       url = "http://localhost/example.html"
@@ -141,12 +122,5 @@
           )
           webserver.wait_for_open_port(80)
           webserver.succeed("curl http://localhost | grep hello")
-
-      with subtest("plugins are correctled installed and configurable"):
-          webserver.succeed(
-              "${withPluginsConfig}/bin/switch-to-configuration test >&2"
-          )
-          webserver.wait_for_open_port(80)
-          webserver.succeed("curl http://localhost | grep caddy")
     '';
 }

nixos/tests/web-apps/gotosocial.nix

@@ -3,7 +3,7 @@
   name = "gotosocial";
   meta.maintainers = with lib.maintainers; [ blakesmith ];
 
-  nodes.machine =
+  containers.machine =
     { pkgs, ... }:
     {
       environment.systemPackages = [ pkgs.jq ];

nixos/tests/web-apps/part-db.nix

@@ -1,11 +1,16 @@
-{ lib, ... }:
+{ lib, pkgs, ... }:
 {
   name = "part-db";
   meta.maintainers = with lib.maintainers; [ oddlama ];
 
   nodes = {
     machine = {
-      services.part-db.enable = true;
+      services.part-db = {
+        enable = true;
+        environmentFile = pkgs.writeText "part-db.env" ''
+          APP_SECRET=0123456789abcdef0123456789abcdef
+        '';
+      };
     };
   };
 
@@ -15,8 +20,22 @@
     machine.wait_for_unit("part-db-migrate.service")
     machine.wait_for_unit("phpfpm-part-db.service")
     machine.wait_for_unit("nginx.service")
+
+    machine.succeed("test -d /var/lib/part-db/public/media")
+    machine.succeed("test -d /var/lib/part-db/uploads")
+    machine.succeed("test -d /var/lib/part-db/share")
+    machine.succeed("test $(readlink ${pkgs.part-db}/public/media) = /var/lib/part-db/public/media/")
+    machine.succeed("test $(readlink ${pkgs.part-db}/uploads) = /var/lib/part-db/uploads/")
+    machine.succeed("grep APP_SECRET=0123456789abcdef0123456789abcdef /var/lib/part-db/env.local")
+    machine.succeed("test $(stat -c %a:%U:%G /var/lib/part-db/env.local) = 600:part-db:part-db")
+
     machine.wait_for_open_port(80)
 
     machine.succeed("curl -L --fail http://localhost | grep 'Part-DB'", timeout=10)
+    machine.succeed("echo static > /var/lib/part-db/public/media/static.txt")
+    machine.succeed("curl -I --fail http://localhost/media/static.txt | grep 'Content-Security-Policy'")
+    machine.succeed("curl -I --fail http://localhost/media/static.txt | grep 'X-Content-Type-Options: nosniff'")
+    machine.succeed("echo '<?php echo 1; ?>' > /var/lib/part-db/public/media/shell.phar")
+    machine.succeed("curl -I http://localhost/media/shell.phar | grep 'HTTP/1.1 403 Forbidden'")
   '';
 }

pkgs/applications/audio/mpg123/default.nix

@@ -96,7 +96,7 @@ stdenv.mkDerivation (finalAttrs: {
     description = "Fast console MPEG Audio Player and decoder library";
     homepage = "https://mpg123.org";
     license = lib.licenses.lgpl21Only;
-    maintainers = with lib.maintainers; [ ftrvxmtrx ];
+    maintainers = [ ];
     platforms = lib.platforms.all;
   };
 })

pkgs/applications/editors/android-studio/default.nix

@@ -26,9 +26,9 @@ let
     url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2026.1.2.8/android-studio-quail2-rc1-linux.tar.gz";
   };
   latestVersion = {
-    version = "2026.1.3.2"; # "Android Studio Quail 3 | 2026.1.3 Canary 2"
-    sha256Hash = "sha256-bGCLbl+b9vTml0m+uxBBWg99ikBAFfk5X+UnR+j2Ogw=";
-    url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2026.1.3.2/android-studio-quail3-canary2-linux.tar.gz";
+    version = "2026.1.3.3"; # "Android Studio Quail 3 | 2026.1.3 Canary 3"
+    sha256Hash = "sha256-C8rbR+0iGNzsr7HtiNiFw++ZG9/t00/c1Ozr9ngssPs=";
+    url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2026.1.3.3/android-studio-quail3-canary3-linux.tar.gz";
   };
 in
 {

pkgs/applications/editors/vscode/extensions/default.nix

@@ -1286,8 +1286,8 @@ let
         mktplcRef = {
           publisher = "denoland";
           name = "vscode-deno";
-          version = "3.52.0";
-          hash = "sha256-0Qkruo7Eh86JRm58G7XhyceUpCJDmhoYaPjUKJQjFiU=";
+          version = "3.53.0";
+          hash = "sha256-M+wFee1x/cCgGMFrDaV7OtIhEORHkLHf/Z06/VuZZmg=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/denoland.vscode-deno/changelog";

pkgs/applications/emulators/libretro/cores/ppsspp.nix

@@ -13,13 +13,13 @@
 }:
 mkLibretroCore {
   core = "ppsspp";
-  version = "0-unstable-2026-06-28";
+  version = "0-unstable-2026-07-08";
 
   src = fetchFromGitHub {
     owner = "hrydgard";
     repo = "ppsspp";
-    rev = "3b319699318731d6d1900ba4b65e2c8c47774631";
-    hash = "sha256-JcsYRV1T9Fpi7w0MB57IonhOG6CPCcejhx64ls4+Aqw=";
+    rev = "0335e5e6a98a9578a2a2b6a7698905d706e4ca82";
+    hash = "sha256-AE4IZ81Wrjn4g3BY9FEiIGOPQ5vRDUf7Jzo3lLwQqk4=";
     fetchSubmodules = true;
   };
 

pkgs/applications/networking/browsers/chromium/info.json

@@ -838,7 +838,7 @@
     }
   },
   "ungoogled-chromium": {
-    "version": "150.0.7871.46",
+    "version": "150.0.7871.100",
     "deps": {
       "depot_tools": {
         "rev": "f4fadaf6a5ba1bced9d3d9021060667b563bf583",
@@ -850,16 +850,16 @@
         "hash": "sha256-/1A+DkzAQj2zGPe/A/G0Z3VrYJXUxq4Hd/+d/o5p3G8="
       },
       "ungoogled-patches": {
-        "rev": "150.0.7871.46-1",
-        "hash": "sha256-SuZTPUpv7onrHvDrwZO0Xo/mxLVcGUSxf2xb+OC//L8="
+        "rev": "150.0.7871.100-1",
+        "hash": "sha256-a+bGt3sROlE9edUBN2/VGn/grN6BqxWX/bsUlAVoAxY="
       },
       "npmHash": "sha256-pF0JtwFpPC4/fodbhSJnQKkczA9WlDg4VqEAy9aDVLg="
     },
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "5b586c06e0d27582900f17e2d59c5370d8d6e0bb",
-        "hash": "sha256-OAZNyZtR5WFWW42r74RSy9fT7Eb7CNZwzoIHhuoqR28=",
+        "rev": "b5a9b587b83512ef1fab99cb7510c58a06d22089",
+        "hash": "sha256-bylGmZC9NhUjcU6amK3mwuZ1it7uTm2hsC60DaKINr4=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {

pkgs/applications/networking/cluster/terraform-providers/default.nix

@@ -127,189 +127,13 @@ let
       removed = name: date: throw "the ${name} terraform provider removed from nixpkgs on ${date}";
     in
     lib.optionalAttrs config.allowAliases {
-      _assert = archived "_assert" "2025/10";
-      azurestack = archived "azurestack" "2025/10";
-      googleworkspace = archived "googleworkspace" "2025/10";
-      huaweicloudstack = archived "huaweicloudstack" "2025/10";
-      metal = archived "metal" "2025/10";
-      stackpath = archived "stackpath" "2025/10";
-      vra7 = archived "vra7" "2025/10";
       ccloud = removed "ccloud" "2025/11. Try sap-cloud-infrastructure_sci instead.";
       sapcc_ccloud = removed "sapcc_ccloud" "2025/11. Try sap-cloud-infrastructure_sci instead.";
       argocd = removed "argocd" "2025/12. Try argoproj-labs_argocd instead.";
       oboukili_argocd = removed "oboukili_argocd" "2025/12. Try argoproj-labs_argocd instead.";
     };
 
-  # added 2025-10-12
-  renamed-providers = lib.optionalAttrs config.allowAliases {
-    onepassword =
-      lib.warnOnInstantiate
-        "terraform-providers.onepassword has been renamed to terraform-providers.1password_onepassword"
-        actualProviders."1password_onepassword";
-    thunder = lib.warnOnInstantiate "terraform-providers.thunder has been renamed to terraform-providers.a10networks_thunder" actualProviders.a10networks_thunder;
-    netlify = lib.warnOnInstantiate "terraform-providers.netlify has been renamed to terraform-providers.aegirhealth_netlify" actualProviders.aegirhealth_netlify;
-    aiven = lib.warnOnInstantiate "terraform-providers.aiven has been renamed to terraform-providers.aiven_aiven" actualProviders.aiven_aiven;
-    akamai = lib.warnOnInstantiate "terraform-providers.akamai has been renamed to terraform-providers.akamai_akamai" actualProviders.akamai_akamai;
-    alicloud = lib.warnOnInstantiate "terraform-providers.alicloud has been renamed to terraform-providers.aliyun_alicloud" actualProviders.aliyun_alicloud;
-    minio = lib.warnOnInstantiate "terraform-providers.minio has been renamed to terraform-providers.aminueza_minio" actualProviders.aminueza_minio;
-    auth0 = lib.warnOnInstantiate "terraform-providers.auth0 has been renamed to terraform-providers.auth0_auth0" actualProviders.auth0_auth0;
-    aviatrix = lib.warnOnInstantiate "terraform-providers.aviatrix has been renamed to terraform-providers.aviatrixsystems_aviatrix" actualProviders.aviatrixsystems_aviatrix;
-    dhall = lib.warnOnInstantiate "terraform-providers.dhall has been renamed to terraform-providers.awakesecurity_dhall" actualProviders.awakesecurity_dhall;
-    baiducloud = lib.warnOnInstantiate "terraform-providers.baiducloud has been renamed to terraform-providers.baidubce_baiducloud" actualProviders.baidubce_baiducloud;
-    brightbox = lib.warnOnInstantiate "terraform-providers.brightbox has been renamed to terraform-providers.brightbox_brightbox" actualProviders.brightbox_brightbox;
-    buildkite = lib.warnOnInstantiate "terraform-providers.buildkite has been renamed to terraform-providers.buildkite_buildkite" actualProviders.buildkite_buildkite;
-    pass = lib.warnOnInstantiate "terraform-providers.pass has been renamed to terraform-providers.camptocamp_pass" actualProviders.camptocamp_pass;
-    sops = lib.warnOnInstantiate "terraform-providers.sops has been renamed to terraform-providers.carlpett_sops" actualProviders.carlpett_sops;
-    checkly = lib.warnOnInstantiate "terraform-providers.checkly has been renamed to terraform-providers.checkly_checkly" actualProviders.checkly_checkly;
-    aci = lib.warnOnInstantiate "terraform-providers.aci has been renamed to terraform-providers.ciscodevnet_aci" actualProviders.ciscodevnet_aci;
-    ciscoasa = lib.warnOnInstantiate "terraform-providers.ciscoasa has been renamed to terraform-providers.ciscodevnet_ciscoasa" actualProviders.ciscodevnet_ciscoasa;
-    age = lib.warnOnInstantiate "terraform-providers.age has been renamed to terraform-providers.clementblaise_age" actualProviders.clementblaise_age;
-    cloudamqp = lib.warnOnInstantiate "terraform-providers.cloudamqp has been renamed to terraform-providers.cloudamqp_cloudamqp" actualProviders.cloudamqp_cloudamqp;
-    cloudflare = lib.warnOnInstantiate "terraform-providers.cloudflare has been renamed to terraform-providers.cloudflare_cloudflare" actualProviders.cloudflare_cloudflare;
-    cloudfoundry = lib.warnOnInstantiate "terraform-providers.cloudfoundry has been renamed to terraform-providers.cloudfoundry-community_cloudfoundry" actualProviders.cloudfoundry-community_cloudfoundry;
-    utils = lib.warnOnInstantiate "terraform-providers.utils has been renamed to terraform-providers.cloudposse_utils" actualProviders.cloudposse_utils;
-    cloudscale = lib.warnOnInstantiate "terraform-providers.cloudscale has been renamed to terraform-providers.cloudscale-ch_cloudscale" actualProviders.cloudscale-ch_cloudscale;
-    constellix = lib.warnOnInstantiate "terraform-providers.constellix has been renamed to terraform-providers.constellix_constellix" actualProviders.constellix_constellix;
-    porkbun = lib.warnOnInstantiate "terraform-providers.porkbun has been renamed to terraform-providers.cullenmcdermott_porkbun" actualProviders.cullenmcdermott_porkbun;
-    postgresql = lib.warnOnInstantiate "terraform-providers.postgresql has been renamed to terraform-providers.cyrilgdn_postgresql" actualProviders.cyrilgdn_postgresql;
-    rabbitmq = lib.warnOnInstantiate "terraform-providers.rabbitmq has been renamed to terraform-providers.cyrilgdn_rabbitmq" actualProviders.cyrilgdn_rabbitmq;
-    datadog = lib.warnOnInstantiate "terraform-providers.datadog has been renamed to terraform-providers.datadog_datadog" actualProviders.datadog_datadog;
-    nexus = lib.warnOnInstantiate "terraform-providers.nexus has been renamed to terraform-providers.datadrivers_nexus" actualProviders.datadrivers_nexus;
-    deno = lib.warnOnInstantiate "terraform-providers.deno has been renamed to terraform-providers.denoland_deno" actualProviders.denoland_deno;
-    hydra = lib.warnOnInstantiate "terraform-providers.hydra has been renamed to terraform-providers.determinatesystems_hydra" actualProviders.determinatesystems_hydra;
-    digitalocean = lib.warnOnInstantiate "terraform-providers.digitalocean has been renamed to terraform-providers.digitalocean_digitalocean" actualProviders.digitalocean_digitalocean;
-    libvirt = lib.warnOnInstantiate "terraform-providers.libvirt has been renamed to terraform-providers.dmacvicar_libvirt" actualProviders.dmacvicar_libvirt;
-    dnsimple = lib.warnOnInstantiate "terraform-providers.dnsimple has been renamed to terraform-providers.dnsimple_dnsimple" actualProviders.dnsimple_dnsimple;
-    dme = lib.warnOnInstantiate "terraform-providers.dme has been renamed to terraform-providers.dnsmadeeasy_dme" actualProviders.dnsmadeeasy_dme;
-    doppler = lib.warnOnInstantiate "terraform-providers.doppler has been renamed to terraform-providers.dopplerhq_doppler" actualProviders.dopplerhq_doppler;
-    bitbucket = lib.warnOnInstantiate "terraform-providers.bitbucket has been renamed to terraform-providers.drfaust92_bitbucket" actualProviders.drfaust92_bitbucket;
-    equinix = lib.warnOnInstantiate "terraform-providers.equinix has been renamed to terraform-providers.equinix_equinix" actualProviders.equinix_equinix;
-    exoscale = lib.warnOnInstantiate "terraform-providers.exoscale has been renamed to terraform-providers.exoscale_exoscale" actualProviders.exoscale_exoscale;
-    bigip = lib.warnOnInstantiate "terraform-providers.bigip has been renamed to terraform-providers.f5networks_bigip" actualProviders.f5networks_bigip;
-    fastly = lib.warnOnInstantiate "terraform-providers.fastly has been renamed to terraform-providers.fastly_fastly" actualProviders.fastly_fastly;
-    flexibleengine = lib.warnOnInstantiate "terraform-providers.flexibleengine has been renamed to terraform-providers.flexibleenginecloud_flexibleengine" actualProviders.flexibleenginecloud_flexibleengine;
-    fortios = lib.warnOnInstantiate "terraform-providers.fortios has been renamed to terraform-providers.fortinetdev_fortios" actualProviders.fortinetdev_fortios;
-    kubectl = lib.warnOnInstantiate "terraform-providers.kubectl has been renamed to terraform-providers.gavinbunney_kubectl" actualProviders.gavinbunney_kubectl;
-    gitlab = lib.warnOnInstantiate "terraform-providers.gitlab has been renamed to terraform-providers.gitlabhq_gitlab" actualProviders.gitlabhq_gitlab;
-    gandi = lib.warnOnInstantiate "terraform-providers.gandi has been renamed to terraform-providers.go-gandi_gandi" actualProviders.go-gandi_gandi;
-    gitea = lib.warnOnInstantiate "terraform-providers.gitea has been renamed to terraform-providers.go-gitea_gitea" actualProviders.go-gitea_gitea;
-    harbor = lib.warnOnInstantiate "terraform-providers.harbor has been renamed to terraform-providers.goharbor_harbor" actualProviders.goharbor_harbor;
-    grafana = lib.warnOnInstantiate "terraform-providers.grafana has been renamed to terraform-providers.grafana_grafana" actualProviders.grafana_grafana;
-    gridscale = lib.warnOnInstantiate "terraform-providers.gridscale has been renamed to terraform-providers.gridscale_gridscale" actualProviders.gridscale_gridscale;
-    archive = lib.warnOnInstantiate "terraform-providers.archive has been renamed to terraform-providers.hashicorp_archive" actualProviders.hashicorp_archive;
-    aws = lib.warnOnInstantiate "terraform-providers.aws has been renamed to terraform-providers.hashicorp_aws" actualProviders.hashicorp_aws;
-    awscc = lib.warnOnInstantiate "terraform-providers.awscc has been renamed to terraform-providers.hashicorp_awscc" actualProviders.hashicorp_awscc;
-    azuread = lib.warnOnInstantiate "terraform-providers.azuread has been renamed to terraform-providers.hashicorp_azuread" actualProviders.hashicorp_azuread;
-    azurerm = lib.warnOnInstantiate "terraform-providers.azurerm has been renamed to terraform-providers.hashicorp_azurerm" actualProviders.hashicorp_azurerm;
-    cloudinit = lib.warnOnInstantiate "terraform-providers.cloudinit has been renamed to terraform-providers.hashicorp_cloudinit" actualProviders.hashicorp_cloudinit;
-    consul = lib.warnOnInstantiate "terraform-providers.consul has been renamed to terraform-providers.hashicorp_consul" actualProviders.hashicorp_consul;
-    dns = lib.warnOnInstantiate "terraform-providers.dns has been renamed to terraform-providers.hashicorp_dns" actualProviders.hashicorp_dns;
-    external = lib.warnOnInstantiate "terraform-providers.external has been renamed to terraform-providers.hashicorp_external" actualProviders.hashicorp_external;
-    google = lib.warnOnInstantiate "terraform-providers.google has been renamed to terraform-providers.hashicorp_google" actualProviders.hashicorp_google;
-    google-beta = lib.warnOnInstantiate "terraform-providers.google-beta has been renamed to terraform-providers.hashicorp_google-beta" actualProviders.hashicorp_google-beta;
-    helm = lib.warnOnInstantiate "terraform-providers.helm has been renamed to terraform-providers.hashicorp_helm" actualProviders.hashicorp_helm;
-    http = lib.warnOnInstantiate "terraform-providers.http has been renamed to terraform-providers.hashicorp_http" actualProviders.hashicorp_http;
-    kubernetes = lib.warnOnInstantiate "terraform-providers.kubernetes has been renamed to terraform-providers.hashicorp_kubernetes" actualProviders.hashicorp_kubernetes;
-    local = lib.warnOnInstantiate "terraform-providers.local has been renamed to terraform-providers.hashicorp_local" actualProviders.hashicorp_local;
-    nomad = lib.warnOnInstantiate "terraform-providers.nomad has been renamed to terraform-providers.hashicorp_nomad" actualProviders.hashicorp_nomad;
-    null = lib.warnOnInstantiate "terraform-providers.null has been renamed to terraform-providers.hashicorp_null" actualProviders.hashicorp_null;
-    random = lib.warnOnInstantiate "terraform-providers.random has been renamed to terraform-providers.hashicorp_random" actualProviders.hashicorp_random;
-    tfe = lib.warnOnInstantiate "terraform-providers.tfe has been renamed to terraform-providers.hashicorp_tfe" actualProviders.hashicorp_tfe;
-    time = lib.warnOnInstantiate "terraform-providers.time has been renamed to terraform-providers.hashicorp_time" actualProviders.hashicorp_time;
-    tls = lib.warnOnInstantiate "terraform-providers.tls has been renamed to terraform-providers.hashicorp_tls" actualProviders.hashicorp_tls;
-    vault = lib.warnOnInstantiate "terraform-providers.vault has been renamed to terraform-providers.hashicorp_vault" actualProviders.hashicorp_vault;
-    vsphere = lib.warnOnInstantiate "terraform-providers.vsphere has been renamed to terraform-providers.hashicorp_vsphere" actualProviders.hashicorp_vsphere;
-    heroku = lib.warnOnInstantiate "terraform-providers.heroku has been renamed to terraform-providers.heroku_heroku" actualProviders.heroku_heroku;
-    hcloud = lib.warnOnInstantiate "terraform-providers.hcloud has been renamed to terraform-providers.hetznercloud_hcloud" actualProviders.hetznercloud_hcloud;
-    huaweicloud = lib.warnOnInstantiate "terraform-providers.huaweicloud has been renamed to terraform-providers.huaweicloud_huaweicloud" actualProviders.huaweicloud_huaweicloud;
-    ibm = lib.warnOnInstantiate "terraform-providers.ibm has been renamed to terraform-providers.ibm-cloud_ibm" actualProviders.ibm-cloud_ibm;
-    icinga2 = lib.warnOnInstantiate "terraform-providers.icinga2 has been renamed to terraform-providers.icinga_icinga2" actualProviders.icinga_icinga2;
-    infoblox = lib.warnOnInstantiate "terraform-providers.infoblox has been renamed to terraform-providers.infobloxopen_infoblox" actualProviders.infobloxopen_infoblox;
-    github = lib.warnOnInstantiate "terraform-providers.github has been renamed to terraform-providers.integrations_github" actualProviders.integrations_github;
-    artifactory = lib.warnOnInstantiate "terraform-providers.artifactory has been renamed to terraform-providers.jfrog_artifactory" actualProviders.jfrog_artifactory;
-    project = lib.warnOnInstantiate "terraform-providers.project has been renamed to terraform-providers.jfrog_project" actualProviders.jfrog_project;
-    sentry = lib.warnOnInstantiate "terraform-providers.sentry has been renamed to terraform-providers.jianyuan_sentry" actualProviders.jianyuan_sentry;
-    openwrt = lib.warnOnInstantiate "terraform-providers.openwrt has been renamed to terraform-providers.joneshf_openwrt" actualProviders.joneshf_openwrt;
-    triton = lib.warnOnInstantiate "terraform-providers.triton has been renamed to terraform-providers.joyent_triton" actualProviders.joyent_triton;
-    keycloak = lib.warnOnInstantiate "terraform-providers.keycloak has been renamed to terraform-providers.keycloak_keycloak" actualProviders.keycloak_keycloak;
-    neon = lib.warnOnInstantiate "terraform-providers.neon has been renamed to terraform-providers.kislerdm_neon" actualProviders.kislerdm_neon;
-    docker = lib.warnOnInstantiate "terraform-providers.docker has been renamed to terraform-providers.kreuzwerker_docker" actualProviders.kreuzwerker_docker;
-    launchdarkly = lib.warnOnInstantiate "terraform-providers.launchdarkly has been renamed to terraform-providers.launchdarkly_launchdarkly" actualProviders.launchdarkly_launchdarkly;
-    linode = lib.warnOnInstantiate "terraform-providers.linode has been renamed to terraform-providers.linode_linode" actualProviders.linode_linode;
-    htpasswd = lib.warnOnInstantiate "terraform-providers.htpasswd has been renamed to terraform-providers.loafoe_htpasswd" actualProviders.loafoe_htpasswd;
-    ssh = lib.warnOnInstantiate "terraform-providers.ssh has been renamed to terraform-providers.loafoe_ssh" actualProviders.loafoe_ssh;
-    incus = lib.warnOnInstantiate "terraform-providers.incus has been renamed to terraform-providers.lxc_incus" actualProviders.lxc_incus;
-    dexidp = lib.warnOnInstantiate "terraform-providers.dexidp has been renamed to terraform-providers.marcofranssen_dexidp" actualProviders.marcofranssen_dexidp;
-    bitwarden = lib.warnOnInstantiate "terraform-providers.bitwarden has been renamed to terraform-providers.maxlaverse_bitwarden" actualProviders.maxlaverse_bitwarden;
-    migadu = lib.warnOnInstantiate "terraform-providers.migadu has been renamed to terraform-providers.metio_migadu" actualProviders.metio_migadu;
-    kafka = lib.warnOnInstantiate "terraform-providers.kafka has been renamed to terraform-providers.mongey_kafka" actualProviders.mongey_kafka;
-    kafka-connect = lib.warnOnInstantiate "terraform-providers.kafka-connect has been renamed to terraform-providers.mongey_kafka-connect" actualProviders.mongey_kafka-connect;
-    mongodbatlas = lib.warnOnInstantiate "terraform-providers.mongodbatlas has been renamed to terraform-providers.mongodb_mongodbatlas" actualProviders.mongodb_mongodbatlas;
-    namecheap = lib.warnOnInstantiate "terraform-providers.namecheap has been renamed to terraform-providers.namecheap_namecheap" actualProviders.namecheap_namecheap;
-    jetstream = lib.warnOnInstantiate "terraform-providers.jetstream has been renamed to terraform-providers.nats-io_jetstream" actualProviders.nats-io_jetstream;
-    ansible = lib.warnOnInstantiate "terraform-providers.ansible has been renamed to terraform-providers.nbering_ansible" actualProviders.nbering_ansible;
-    newrelic = lib.warnOnInstantiate "terraform-providers.newrelic has been renamed to terraform-providers.newrelic_newrelic" actualProviders.newrelic_newrelic;
-    ns1 = lib.warnOnInstantiate "terraform-providers.ns1 has been renamed to terraform-providers.ns1-terraform_ns1" actualProviders.ns1-terraform_ns1;
-    linuxbox = lib.warnOnInstantiate "terraform-providers.linuxbox has been renamed to terraform-providers.numtide_linuxbox" actualProviders.numtide_linuxbox;
-    secret = lib.warnOnInstantiate "terraform-providers.secret has been renamed to terraform-providers.numtide_secret" actualProviders.numtide_secret;
-    nutanix = lib.warnOnInstantiate "terraform-providers.nutanix has been renamed to terraform-providers.nutanix_nutanix" actualProviders.nutanix_nutanix;
-    okta = lib.warnOnInstantiate "terraform-providers.okta has been renamed to terraform-providers.okta_okta" actualProviders.okta_okta;
-    oktaasa = lib.warnOnInstantiate "terraform-providers.oktaasa has been renamed to terraform-providers.oktadeveloper_oktaasa" actualProviders.oktadeveloper_oktaasa;
-    opennebula = lib.warnOnInstantiate "terraform-providers.opennebula has been renamed to terraform-providers.opennebula_opennebula" actualProviders.opennebula_opennebula;
-    openstack = lib.warnOnInstantiate "terraform-providers.openstack has been renamed to terraform-providers.terraform-provider-openstack_openstack" actualProviders.terraform-provider-openstack_openstack;
-    opentelekomcloud = lib.warnOnInstantiate "terraform-providers.opentelekomcloud has been renamed to terraform-providers.opentelekomcloud_opentelekomcloud" actualProviders.opentelekomcloud_opentelekomcloud;
-    opsgenie = lib.warnOnInstantiate "terraform-providers.opsgenie has been renamed to terraform-providers.opsgenie_opsgenie" actualProviders.opsgenie_opsgenie;
-    oci = lib.warnOnInstantiate "terraform-providers.oci has been renamed to terraform-providers.oracle_oci" actualProviders.oracle_oci;
-    ovh = lib.warnOnInstantiate "terraform-providers.ovh has been renamed to terraform-providers.ovh_ovh" actualProviders.ovh_ovh;
-    slack = lib.warnOnInstantiate "terraform-providers.slack has been renamed to terraform-providers.pablovarela_slack" actualProviders.pablovarela_slack;
-    pagerduty = lib.warnOnInstantiate "terraform-providers.pagerduty has been renamed to terraform-providers.pagerduty_pagerduty" actualProviders.pagerduty_pagerduty;
-    powerdns = lib.warnOnInstantiate "terraform-providers.powerdns has been renamed to terraform-providers.pan-net_powerdns" actualProviders.pan-net_powerdns;
-    elasticsearch = lib.warnOnInstantiate "terraform-providers.elasticsearch has been renamed to terraform-providers.phillbaker_elasticsearch" actualProviders.phillbaker_elasticsearch;
-    ct = lib.warnOnInstantiate "terraform-providers.ct has been renamed to terraform-providers.poseidon_ct" actualProviders.poseidon_ct;
-    matchbox = lib.warnOnInstantiate "terraform-providers.matchbox has been renamed to terraform-providers.poseidon_matchbox" actualProviders.poseidon_matchbox;
-    rancher2 = lib.warnOnInstantiate "terraform-providers.rancher2 has been renamed to terraform-providers.rancher_rancher2" actualProviders.rancher_rancher2;
-    rootly = lib.warnOnInstantiate "terraform-providers.rootly has been renamed to terraform-providers.rootlyhq_rootly" actualProviders.rootlyhq_rootly;
-    rundeck = lib.warnOnInstantiate "terraform-providers.rundeck has been renamed to terraform-providers.rundeck_rundeck" actualProviders.rundeck_rundeck;
-    sakuracloud = lib.warnOnInstantiate "terraform-providers.sakuracloud has been renamed to terraform-providers.sacloud_sakuracloud" actualProviders.sacloud_sakuracloud;
-    btp = lib.warnOnInstantiate "terraform-providers.btp has been renamed to terraform-providers.sap_btp" actualProviders.sap_btp;
-    scaleway = lib.warnOnInstantiate "terraform-providers.scaleway has been renamed to terraform-providers.scaleway_scaleway" actualProviders.scaleway_scaleway;
-    shell = lib.warnOnInstantiate "terraform-providers.shell has been renamed to terraform-providers.scottwinkler_shell" actualProviders.scottwinkler_shell;
-    selectel = lib.warnOnInstantiate "terraform-providers.selectel has been renamed to terraform-providers.selectel_selectel" actualProviders.selectel_selectel;
-    talos = lib.warnOnInstantiate "terraform-providers.talos has been renamed to terraform-providers.siderolabs_talos" actualProviders.siderolabs_talos;
-    skytap = lib.warnOnInstantiate "terraform-providers.skytap has been renamed to terraform-providers.skytap_skytap" actualProviders.skytap_skytap;
-    snowflake = lib.warnOnInstantiate "terraform-providers.snowflake has been renamed to terraform-providers.snowflake-labs_snowflake" actualProviders.snowflake-labs_snowflake;
-    spacelift = lib.warnOnInstantiate "terraform-providers.spacelift has been renamed to terraform-providers.spacelift-io_spacelift" actualProviders.spacelift-io_spacelift;
-    signalfx = lib.warnOnInstantiate "terraform-providers.signalfx has been renamed to terraform-providers.splunk-terraform_signalfx" actualProviders.splunk-terraform_signalfx;
-    spotinst = lib.warnOnInstantiate "terraform-providers.spotinst has been renamed to terraform-providers.spotinst_spotinst" actualProviders.spotinst_spotinst;
-    statuscake = lib.warnOnInstantiate "terraform-providers.statuscake has been renamed to terraform-providers.statuscakedev_statuscake" actualProviders.statuscakedev_statuscake;
-    sumologic = lib.warnOnInstantiate "terraform-providers.sumologic has been renamed to terraform-providers.sumologic_sumologic" actualProviders.sumologic_sumologic;
-    sysdig = lib.warnOnInstantiate "terraform-providers.sysdig has been renamed to terraform-providers.sysdiglabs_sysdig" actualProviders.sysdiglabs_sysdig;
-    tailscale = lib.warnOnInstantiate "terraform-providers.tailscale has been renamed to terraform-providers.tailscale_tailscale" actualProviders.tailscale_tailscale;
-    proxmox = lib.warnOnInstantiate "terraform-providers.proxmox has been renamed to terraform-providers.telmate_proxmox" actualProviders.telmate_proxmox;
-    temporalcloud = lib.warnOnInstantiate "terraform-providers.temporalcloud has been renamed to terraform-providers.temporalio_temporalcloud" actualProviders.temporalio_temporalcloud;
-    tencentcloud = lib.warnOnInstantiate "terraform-providers.tencentcloud has been renamed to terraform-providers.tencentcloudstack_tencentcloud" actualProviders.tencentcloudstack_tencentcloud;
-    remote = lib.warnOnInstantiate "terraform-providers.remote has been renamed to terraform-providers.tenstad_remote" actualProviders.tenstad_remote;
-    virtualbox = lib.warnOnInstantiate "terraform-providers.virtualbox has been renamed to terraform-providers.terra-farm_virtualbox" actualProviders.terra-farm_virtualbox;
-    lxd = lib.warnOnInstantiate "terraform-providers.lxd has been renamed to terraform-providers.terraform-lxd_lxd" actualProviders.terraform-lxd_lxd;
-    routeros = lib.warnOnInstantiate "terraform-providers.routeros has been renamed to terraform-providers.terraform-routeros_routeros" actualProviders.terraform-routeros_routeros;
-    hetznerdns = lib.warnOnInstantiate "terraform-providers.hetznerdns has been renamed to terraform-providers.timohirt_hetznerdns" actualProviders.timohirt_hetznerdns;
-    pocketid = lib.warnOnInstantiate "terraform-providers.pocketid has been renamed to terraform-providers.trozz_pocketid" actualProviders.trozz_pocketid;
-    turbot = lib.warnOnInstantiate "terraform-providers.turbot has been renamed to terraform-providers.turbot_turbot" actualProviders.turbot_turbot;
-    unifi = lib.warnOnInstantiate "terraform-providers.unifi has been renamed to terraform-providers.ubiquiti-community_unifi" actualProviders.ubiquiti-community_unifi;
-    ucloud = lib.warnOnInstantiate "terraform-providers.ucloud has been renamed to terraform-providers.ucloud_ucloud" actualProviders.ucloud_ucloud;
-    acme = lib.warnOnInstantiate "terraform-providers.acme has been renamed to terraform-providers.vancluever_acme" actualProviders.vancluever_acme;
-    venafi = lib.warnOnInstantiate "terraform-providers.venafi has been renamed to terraform-providers.venafi_venafi" actualProviders.venafi_venafi;
-    vinyldns = lib.warnOnInstantiate "terraform-providers.vinyldns has been renamed to terraform-providers.vinyldns_vinyldns" actualProviders.vinyldns_vinyldns;
-    avi = lib.warnOnInstantiate "terraform-providers.avi has been renamed to terraform-providers.vmware_avi" actualProviders.vmware_avi;
-    vcd = lib.warnOnInstantiate "terraform-providers.vcd has been renamed to terraform-providers.vmware_vcd" actualProviders.vmware_vcd;
-    wavefront = lib.warnOnInstantiate "terraform-providers.wavefront has been renamed to terraform-providers.vmware_wavefront" actualProviders.vmware_wavefront;
-    vpsadmin = lib.warnOnInstantiate "terraform-providers.vpsadmin has been renamed to terraform-providers.vpsfreecz_vpsadmin" actualProviders.vpsfreecz_vpsadmin;
-    vultr = lib.warnOnInstantiate "terraform-providers.vultr has been renamed to terraform-providers.vultr_vultr" actualProviders.vultr_vultr;
-    mailgun = lib.warnOnInstantiate "terraform-providers.mailgun has been renamed to terraform-providers.wgebis_mailgun" actualProviders.wgebis_mailgun;
-    yandex = lib.warnOnInstantiate "terraform-providers.yandex has been renamed to terraform-providers.yandex-cloud_yandex" actualProviders.yandex-cloud_yandex;
-  };
-
   # excluding aliases, used by terraform-full
   actualProviders = automated-providers // special-providers;
 in
-actualProviders // removed-providers // renamed-providers // { inherit actualProviders mkProvider; }
+actualProviders // removed-providers // { inherit actualProviders mkProvider; }

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -110,11 +110,11 @@
     "vendorHash": null
   },
   "bpg_proxmox": {
-    "hash": "sha256-Hi37jOpSfBO13BrBSQCrTaYhcyIuL4PAIV9ow7f4eOU=",
+    "hash": "sha256-lZQTbs5hPGswNiF5lJ+95y30i0TQAH3v5W4bVilp+CE=",
     "homepage": "https://registry.terraform.io/providers/bpg/proxmox",
     "owner": "bpg",
     "repo": "terraform-provider-proxmox",
-    "rev": "v0.111.0",
+    "rev": "v0.111.1",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-kvHI8cd/rl9kVKKzSwjrC0+Qikz3w2P9jgLvYa+T2DE="
   },
@@ -319,11 +319,11 @@
     "vendorHash": null
   },
   "digitalocean_digitalocean": {
-    "hash": "sha256-Myy9UIvKD0W19CGToMjq1iGy4tBVpfACpqgibsKOvac=",
+    "hash": "sha256-r+Bi8F603JE9K4hZDFwuhYtfg3FKYNPP1A7lpvvrZQg=",
     "homepage": "https://registry.terraform.io/providers/digitalocean/digitalocean",
     "owner": "digitalocean",
     "repo": "terraform-provider-digitalocean",
-    "rev": "v2.92.0",
+    "rev": "v2.95.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -517,13 +517,13 @@
     "vendorHash": "sha256-COWHnLR6aRwcGJVo6IFvqQLwAYxFpqUGQbZVvEo/b/I="
   },
   "hashicorp_awscc": {
-    "hash": "sha256-IRDNbQh3OouVUKranI962+3f5REeIC5Vtv8dw06z9UE=",
+    "hash": "sha256-z1wns0zuanfoeIb7CDRBtt4CoRQ4+b5PNKpmDbfyHd0=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/awscc",
     "owner": "hashicorp",
     "repo": "terraform-provider-awscc",
-    "rev": "v1.90.0",
+    "rev": "v1.92.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-9FzpBgb3BzIVhx8kqhyDJw/liH6X8jUhFmwtbic4uVw="
+    "vendorHash": "sha256-/kcUQo6hd1TxP6rEoTsll0ZRL2BXdRg8vxIoJ9VmzTs="
   },
   "hashicorp_azuread": {
     "hash": "sha256-mEYEZIztDjyqWSJFoJPXtV0E9YikumtwGVtZA4Jfw3U=",
@@ -1175,22 +1175,22 @@
     "vendorHash": "sha256-InCRL4k6v0avmnNja+b6Ozg5+injxa8EmrRHIWrq4Ag="
   },
   "sap_btp": {
-    "hash": "sha256-kTH3diM9jbncv80+I//mj+zCWGosIXjjMETXa6IS2HU=",
+    "hash": "sha256-1+gi+iRTKe/LHM6O3IBMRk9nba0kQ6+AbjYkrRXa5hM=",
     "homepage": "https://registry.terraform.io/providers/SAP/btp",
     "owner": "SAP",
     "repo": "terraform-provider-btp",
-    "rev": "v1.23.1",
+    "rev": "v1.24.0",
     "spdx": "Apache-2.0",
-    "vendorHash": "sha256-w/AmSHydCeyp/EURgPY2c/E2LjqAXXCORI53X1hEdxY="
+    "vendorHash": "sha256-uCw5Xdqp3VjLj6IytoVfO0atxkT69FNqJmAlA6eCmfs="
   },
   "scaleway_scaleway": {
-    "hash": "sha256-9fmNBTOG+A1X+em1nphvwmMUrM/kaR64HlI/e2QeWlA=",
+    "hash": "sha256-rO5xmAJB2ndhVh7Lkun1Gxi04+I2lGVtkbbCbmngp3E=",
     "homepage": "https://registry.terraform.io/providers/scaleway/scaleway",
     "owner": "scaleway",
     "repo": "terraform-provider-scaleway",
-    "rev": "v2.77.1",
+    "rev": "v2.78.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-nqDob9nyw21LwSj8lDrA/5kGxe4KwwnHy0+FedIJr3k="
+    "vendorHash": "sha256-x2cppxUU58nN7eu+wMxIoS16HezxzkHWI50ck2r34ls="
   },
   "scottwinkler_shell": {
     "hash": "sha256-LTWEdXxi13sC09jh+EFZ6pOi1mzuvgBz5vceIkNE/JY=",
@@ -1202,13 +1202,13 @@
     "vendorHash": "sha256-MIO0VHofPtKPtynbvjvEukMNr5NXHgk7BqwIhbc9+u0="
   },
   "selectel_selectel": {
-    "hash": "sha256-xoIwvrjeuY1T+7pyBQfoU8orWC4qMuQ9IgbLYIEzLIA=",
+    "hash": "sha256-DKz+Cs8Jh480SnZsG7x+CE70pCP43GhQa9S1gl5oWl0=",
     "homepage": "https://registry.terraform.io/providers/selectel/selectel",
     "owner": "selectel",
     "repo": "terraform-provider-selectel",
-    "rev": "v8.1.0",
+    "rev": "v8.2.1",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-Y2oj1DIn80CCdJ7ZM/p6sGqT64dGIEFg/vXXSv6B+iE="
+    "vendorHash": "sha256-PERDJ74FtXhK+HUd9EjYINpmUXVX+kHtkRbFf6gv8Ng="
   },
   "siderolabs_talos": {
     "hash": "sha256-/NACmEpodBNx+Q2M9y3JnKpw9a3Y1eFDdTQ+48MXAc8=",

pkgs/applications/networking/cluster/terraform/default.nix

@@ -200,9 +200,9 @@ rec {
   mkTerraform = attrs: pluggable (generic attrs);
 
   terraform_1 = mkTerraform {
-    version = "1.15.7";
-    hash = "sha256-FF3LEovWjEDrKp6e6opRfCt8c4wghva3mjN97vCxq3E=";
-    vendorHash = "sha256-3y9+KCmvskJ24X4F6gSLglmsl4hUlvzBb/ep4kcbS8A=";
+    version = "1.15.8";
+    hash = "sha256-FeXebcNl/npEkEyMvwzeMYTEsl9t8Iz+4lBHd/HzQHQ=";
+    vendorHash = "sha256-l5n5PS2buGPvmx/U8vQeKk6BlZdJQQEujJxlPMTdg0k=";
     patches = [ ./provider-path-0_15.patch ];
     passthru = {
       inherit plugins;

pkgs/applications/networking/instant-messengers/discord/darwin.nix

@@ -107,6 +107,7 @@ stdenv.mkDerivation {
   sourceRoot = ".";
 
   dontUnpack = true;
+  dontStrip = true;
 
   installPhase = ''
     runHook preInstall

pkgs/applications/networking/irc/weechat/default.nix

@@ -105,11 +105,11 @@ assert lib.all (p: p.enabled -> !(builtins.elem null p.buildInputs)) plugins;
 
 stdenv.mkDerivation rec {
   pname = "weechat";
-  version = "4.9.2";
+  version = "4.9.3";
 
   src = fetchurl {
     url = "https://weechat.org/files/src/weechat-${version}.tar.xz";
-    hash = "sha256-0TianlIb2gxOv6EI4qv4he5sUVDDhSmfXcoBgaQ6CRQ=";
+    hash = "sha256-XH2VOfqGyZ6nalUaiJqSusIeq3uyeQ29NGRS0AsQw3w=";
   };
 
   # Why is this needed? https://github.com/weechat/weechat/issues/2031

pkgs/applications/office/softmaker/softmaker-office-nx.nix

@@ -6,9 +6,9 @@
   # overridable. This is useful when the upstream archive was replaced
   # and nixpkgs is not in sync yet.
   officeVersion ? {
-    version = "1230";
+    version = "1234";
     edition = "";
-    hash = "sha256-/4qKFnLoou1ZuGkRt+2Yf/FPGOnYhx7fnE+8D3gutaY=";
+    hash = "sha256-00bscKt+4aE94x6wKGqXh6tE2GiDll6F4gWZZBEl2JE=";
   },
 
   ...

pkgs/applications/office/softmaker/softmaker-office.nix

@@ -7,9 +7,9 @@
   # Softmaker Office or when the upstream archive was replaced and
   # nixpkgs is not in sync yet.
   officeVersion ? {
-    version = "1230";
+    version = "1234";
     edition = "2024";
-    hash = "sha256-xaXS22feHbRVPWP43vGbfptoT2S6jLUrGVFQ3xY7SJY=";
+    hash = "sha256-oIO/p52ASIU0qjQqxp/l9GVrUK+LQNQxX1wKheKHT3w=";
   },
 
   ...

pkgs/build-support/build-mozilla-mach/default.nix

@@ -304,6 +304,9 @@ buildStdenv.mkDerivation {
 
   inherit src unpackPhase;
 
+  __structuredAttrs = true;
+  strictDeps = true;
+
   meta =
     meta
     // lib.optionalAttrs stdenv.hostPlatform.isDarwin {

pkgs/by-name/ae/aerospace/package.nix

@@ -9,7 +9,7 @@
 
 let
   appName = "AeroSpace.app";
-  version = "0.21.1-Beta";
+  version = "0.21.2-Beta";
 in
 stdenv.mkDerivation {
   pname = "aerospace";
@@ -18,7 +18,7 @@ stdenv.mkDerivation {
 
   src = fetchzip {
     url = "https://github.com/nikitabobko/AeroSpace/releases/download/v${version}/AeroSpace-v${version}.zip";
-    sha256 = "sha256-PXLVRAVsM+Zp+i3LAol9UoITxBE8DwI+qb0U5z6JvD0=";
+    sha256 = "sha256-+4n9di1NbPs5pttSEHPDzpHinfuSyWSx5CjNA9IOH+Q=";
   };
 
   nativeBuildInputs = [ installShellFiles ];

pkgs/by-name/al/alock/package.nix

@@ -64,7 +64,6 @@ stdenv.mkDerivation (finalAttrs: {
     '';
     platforms = lib.platforms.linux;
     maintainers = with lib.maintainers; [
-      ftrvxmtrx
       chris-martin
     ];
     license = lib.licenses.mit;

pkgs/by-name/ar/arti/package.nix

@@ -3,7 +3,6 @@
   stdenv,
   rustPlatform,
   fetchFromGitLab,
-  fetchpatch,
   pkg-config,
   sqlite,
   openssl,
@@ -14,7 +13,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "arti";
-  version = "2.4.0";
+  version = "2.5.0";
 
   src = fetchFromGitLab {
     domain = "gitlab.torproject.org";
@@ -22,29 +21,18 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "core";
     repo = "arti";
     tag = "arti-v${finalAttrs.version}";
-    hash = "sha256-YLOdrHstmN2pLl75uclkbpN5h3iBs3xpraZ8XN6R/+Q=";
+    hash = "sha256-jOCFXlBI2xAzgpb7Fa8ap53SpDF6kcRGYnBXcu3vpk4=";
   };
 
-  patches = [
-    # Fixes a panic that could allow malicious directory caches to crash
-    # clients.
-    # https://gitlab.torproject.org/tpo/core/arti/-/merge_requests/4062
-    (fetchpatch {
-      name = "TROVE-2026-024.patch";
-      url = "https://gitlab.torproject.org/tpo/core/arti/-/commit/f69be8c70561629e63004788f0aa4bf898025f93.patch";
-      hash = "sha256-P0sXTKOBW7ulqQZwmTVJfrpLksLyaonuDpxGF2keDqE=";
-    })
-  ];
-
   # Working around a bug in cargo that appears with cargo-auditable, see
   # https://github.com/rust-secure-code/cargo-auditable/issues/124.
   postPatch = ''
     substituteInPlace crates/arti/Cargo.toml \
-      --replace-fail '"tor-rpcbase"' '"dep:tor-rpcbase"'
+      --replace-fail '"tokio-util"' '"dep:tokio-util"'
   '';
 
   buildAndTestSubdir = "crates/arti";
-  cargoHash = "sha256-7X3JJbt0/jxaMvBR3XQvguR7tqd96kiqX66G2byvPjM=";
+  cargoHash = "sha256-JK6ubp697jZ98ErNrZdFe0mXIez3lUZ5SmAHkyD97WQ=";
 
   nativeBuildInputs = lib.optionals stdenv.hostPlatform.isLinux [ pkg-config ];
 

pkgs/by-name/av/aver/package.nix

@@ -0,0 +1,49 @@
+{
+  lib,
+  stdenv,
+  rustPlatform,
+  fetchFromGitHub,
+  lld,
+  nix-update-script,
+  versionCheckHook,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "aver";
+  version = "0.26.0";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "jasisz";
+    repo = "aver";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-LeI6qy+z8azrrgoskRq/hsk5t0PDydQ/yJNxYIB7I68=";
+  };
+
+  cargoHash = "sha256-Zqu56tBbKjWZmpRpPuK9JMexcajRcDzBW4AfTRAkPbs=";
+
+  cargoBuildFlags = [
+    "--workspace"
+    "--bin=aver"
+    "--bin=aver-lsp"
+  ];
+
+  nativeBuildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ lld ];
+
+  # some tests are generated, some take a long time, some need to be skipped
+  doCheck = false;
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Programming language for auditable AI-written code";
+    homepage = "https://github.com/jasisz/aver";
+    changelog = "https://github.com/jasisz/aver/blob/${finalAttrs.src.tag}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ Br1ght0ne ];
+    mainProgram = "aver";
+  };
+})

pkgs/by-name/bi/bird-lg/package.nix

@@ -10,13 +10,13 @@ let
     { modRoot, vendorHash }:
     buildGoModule rec {
       pname = "bird-lg-${modRoot}";
-      version = "1.4.5";
+      version = "1.4.7";
 
       src = fetchFromGitHub {
         owner = "xddxdd";
         repo = "bird-lg-go";
         rev = "v${version}";
-        hash = "sha256-xKDpaGnMv8e2OKV3547d7Jsq3VFNwayhCL2dGKVYSZM=";
+        hash = "sha256-Ca+wMiIMcknqhn+p8Cb00ibvsrsFXyFxvGhqOWrzZcA=";
       };
 
       doDist = false;
@@ -42,12 +42,12 @@ let
 
   bird-lg-frontend = generic {
     modRoot = "frontend";
-    vendorHash = "sha256-tqpDH7KfpwPuOvIfx3vVclMGOMNFroiBcNb1lN0PtQc=";
+    vendorHash = "sha256-SmpCCvOP9HQh+Niqa3EhRGj1a7EXQgwRW2hTJgv+oIw=";
   };
 
   bird-lg-proxy = generic {
     modRoot = "proxy";
-    vendorHash = "sha256-9BpsRIIidBEm+ivwFIo00H9MTH4R3kkze/W/HaH8124=";
+    vendorHash = "sha256-LRj5OvCu0e0iNW8nEUmbnKhhvaUXOVNIYGv0Lmai28g=";
   };
 in
 symlinkJoin {

pkgs/by-name/bi/bitwig-studio6/package.nix

@@ -38,12 +38,12 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "bitwig-studio6";
-  version = "6.0.6";
+  version = "6.0.11";
 
   src = fetchurl {
     name = "bitwig-studio-${finalAttrs.version}.deb";
     url = "https://www.bitwig.com/dl/Bitwig%20Studio/${finalAttrs.version}/installer_linux";
-    hash = "sha256-tczgtA4v3a5Qjxaa6ZvaiFDWD6dhRw19vj8IMxkyCNI=";
+    hash = "sha256-rnr/Z8y6klKrU2gT5/XT+sRryl/HZZZ04n565L0HPEw=";
   };
 
   strictDeps = true;

pkgs/by-name/bl/blink-qt/fix-none-account.patch

@@ -0,0 +1,25 @@
+From 6e438d1ab9f9da5e55b0cc96ea81fbac1f1a871b Mon Sep 17 00:00:00 2001
+From: phanirithvij <phanirithvij2000@gmail.com>
+Date: Sun, 5 Jul 2026 19:40:36 +0530
+Subject: [PATCH] fix: handle None default_account on startup
+
+---
+ blink/mainwindow.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/blink/mainwindow.py b/blink/mainwindow.py
+index d0baa21..77c67e8 100644
+--- a/blink/mainwindow.py
++++ b/blink/mainwindow.py
+@@ -1109,7 +1109,7 @@ class MainWindow(base_class, ui_class):
+ 
+     def _NH_SIPAccountManagerDidStart(self, notification):
+         account = notification.sender.default_account
+-        if account is not BonjourAccount() and account.sms.enable_pgp and account.sms.private_key is not None and os.path.exists(account.sms.private_key.normalized):
++        if account is not None and account is not BonjourAccount() and account.sms.enable_pgp and account.sms.private_key is not None and os.path.exists(account.sms.private_key.normalized):
+             self.export_pgp_key_action.setEnabled(True)
+ 
+     def _NH_SIPAccountManagerDidRemoveAccount(self, notification):
+-- 
+2.54.0
+

pkgs/by-name/bl/blink-qt/package.nix

@@ -5,26 +5,24 @@
   python3Packages,
   qt6Packages,
   libvncserver,
+  stdenv,
 }:
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "blink-qt";
-  version = "6.0.4";
+  version = "6.0.6";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "AGProjects";
     repo = "blink-qt";
     tag = finalAttrs.version;
-    hash = "sha256-QESg9yo5oddYqSKuFLSMI2Oju3FCq97+j0uJDK85Yy8=";
+    hash = "sha256-0hsuAYYp7KvfxErAcN4EX8G3goirGRmpijJfAMvbZJQ=";
   };
 
   patches = [
-    # Remove when version > 6.0.4
-    (fetchpatch2 {
-      url = "https://github.com/AGProjects/blink-qt/commit/45343c90ae0680a3d03589fa8a12ac1eb85a6925.patch";
-      hash = "sha256-XwV5L3r0IqWkhlaJypS2cHkDCcoumOgEEqDpdcaTviE=";
-    })
+    # Remove once https://github.com/AGProjects/blink-qt/pull/7 is mereged and tagged
+    ./fix-none-account.patch
   ];
 
   nativeBuildInputs = [ qt6Packages.wrapQtAppsHook ];
@@ -40,26 +38,31 @@ python3Packages.buildPythonApplication (finalAttrs: {
     qt6Packages.qtsvg
   ];
 
-  dependencies = with python3Packages; [
-    dateutils
-    dnspython
-    google-api-python-client
-    lxml
-    lxml-html-clean
-    msrplib
-    oauth2client
-    otr
-    pgpy
-    pyqt6
-    pyqt6-webengine
-    python3-application
-    python3-eventlib
-    python3-gnutls
-    python3-sipsimple
-    sqlobject
-    standard-imghdr
-    xcaplib
-  ];
+  dependencies =
+    with python3Packages;
+    [
+      dateutils
+      dnspython
+      google-auth-oauthlib
+      google-api-python-client
+      lxml
+      lxml-html-clean
+      msrplib
+      otr
+      pgpy
+      pyqt6
+      pyqt6-webengine
+      python3-application
+      python3-eventlib
+      python3-gnutls
+      python3-sipsimple
+      sqlobject
+      standard-imghdr
+      xcaplib
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      numpy
+    ];
 
   dontWrapQtApps = true;
 

pkgs/by-name/bl/bluebubbles/CMakeLists.patch

@@ -7,7 +7,7 @@
 -# ----------------------------------------------------------------------
 -# Download and add objectbox-c prebuilt library.
 -
--set(OBJECTBOX_VERSION 4.0.2)
+-set(OBJECTBOX_VERSION 4.3.0)
 -
 -set(OBJECTBOX_ARCH ${CMAKE_SYSTEM_PROCESSOR})
 -if (${OBJECTBOX_ARCH} MATCHES "x86_64")

pkgs/by-name/bl/bluebubbles/objectbox_flutter_libs.nix

@@ -19,11 +19,11 @@ let
   };
 
   objectbox-c = fetchzip {
-    name = "objectbox-linux-4.0.2";
-    url = "https://github.com/objectbox/objectbox-c/releases/download/v4.0.2/objectbox-linux-${arch}.tar.gz";
+    name = "objectbox-linux-4.3.0";
+    url = "https://github.com/objectbox/objectbox-c/releases/download/v4.3.0/objectbox-linux-${arch}.tar.gz";
     hash = selectSystem {
-      x86_64-linux = "sha256-v51/m+v/FjryZuJphVb35jKgQk6DtEu+uHEzUzmeKMo=";
-      aarch64-linux = "sha256-trpF71hpJA6+DFQ3cTKOyyjtLKf8aFHf6JWb6Jxm4eo=";
+      x86_64-linux = "sha256-VaDUQcTk0ArmeKFpdKN35WEGL8QX89k8KPHTRP9xadI=";
+      aarch64-linux = "sha256-vnsxkNiYoZIBfw6IcYg4cFgsdRyHGDbyA0y8J4NuYE0=";
     };
     stripRoot = false;
     meta.license = lib.licenses.unfree; # the release tarball has a proprietary shared library

pkgs/by-name/bl/bluebubbles/package.nix

@@ -13,13 +13,13 @@
 
 flutter329.buildFlutterApplication rec {
   pname = "bluebubbles";
-  version = "1.15.4";
+  version = "1.15.7";
 
   src = fetchFromGitHub {
     owner = "BlueBubblesApp";
     repo = "bluebubbles-app";
-    tag = "v${version}+73-desktop";
-    hash = "sha256-+JCj4EuwFbzE4u+7iJ+v9FQuLVt1tozwBufw+eL5usk=";
+    tag = "v${version}+76-desktop";
+    hash = "sha256-KmIoJHQAF4DQQ78SJ5Vra7ubfvqTjmK4lf8tGJDJNTs=";
   };
 
   pubspecLock = lib.importJSON ./pubspec.lock.json;
@@ -27,13 +27,14 @@ flutter329.buildFlutterApplication rec {
   customSourceBuilders.objectbox_flutter_libs = callPackage ./objectbox_flutter_libs.nix { };
 
   gitHashes = {
-    desktop_webview_auth = "sha256-n3lvYFUzm/1sCwQBJ3Ovup4Mq7lqGJ17ktk3TJrHhKE=";
+    desktop_webview_auth = "sha256-G6xrC6Jz3kYAysHI6w/8ahzXTvX7k6QW3GB3b8Uh+RQ=";
     disable_battery_optimization = "sha256-IsfclmbdLvju+0VWElFz9brdVntRESFB+PF8UPJBL2E=";
     firebase_dart = "sha256-jq4Y5ApGPrXcLN3gwC9NuGN/EQkl5u64iMzL8KG02Sc=";
     gesture_x_detector = "sha256-H3OJxDhESWwnpRky9jS9RIBiZ7gSqWQ/j0x/1VvRb5M=";
-    local_notifier = "sha256-0vajd2XNGpV9aqywbCUvDC2SLjwxh1LmshTa5yttQUI=";
+    local_notifier = "sha256-OvJKZXa2qmEgKV0Z3Ptdg0e/abWFAmH0z/DZFgW2TIQ=";
     permission_handler_windows = "sha256-9h0wEOgY6gtqaSyH9x2fbvH8Y0EfoVs/qNqwwI5d18k=";
     video_thumbnail = "sha256-7IbKg6bBA5D8ODwMNwJqIohTCbAox56TMgoI07CbrPw=";
+    flutter_map = "sha256-JsVh7wwyehhAkE+TIvThQ8iYx7icY76qm2Pwf/k0Z7M=";
   };
 
   nativeBuildInputs = [ autoPatchelfHook ];

pkgs/by-name/bo/boat-cli/package.nix

@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "boat-cli";
-  version = "0.9.1";
+  version = "0.9.2";
 
   src = fetchFromGitHub {
     owner = "coko7";
     repo = "boat-cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-+QhW7QWBoDzSNzkHotNLg/dnolSd3uK/IcDPnzVKBbI=";
+    hash = "sha256-oS+NfEQKAcfZwYQkftMJAUz7fG1nleruAROMUUbBP3Y=";
   };
 
-  cargoHash = "sha256-rfZbOeOoBWMp232vXVeKtQz3LP5IloIBZS0OWkN8Fys=";
+  cargoHash = "sha256-mHqXIFI2KJOMnxdG3X4DHDozFDPmqw4f//ori3Dc7us=";
 
   nativeBuildInputs = [
     writableTmpDirAsHomeHook

pkgs/by-name/bo/boring/package.nix

@@ -11,13 +11,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "boring";
-  version = "0.16.0";
+  version = "0.16.1";
 
   src = fetchFromGitHub {
     owner = "alebeck";
     repo = "boring";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-PU/DwYgP8pcBc21GwuMMiQIzdU4BhBvHzk9YrktYo1Y=";
+    hash = "sha256-Llc/zxra07DD3pxsUZGAKN2ltegCeTMTI/jSg76gn3U=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/br/brave/package.nix

@@ -3,24 +3,24 @@
 
 let
   pname = "brave";
-  version = "1.91.180";
+  version = "1.92.134";
 
   allArchives = {
     aarch64-linux = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_arm64.deb";
-      hash = "sha256-HdmJBLANsmlBi3EtzeuMn4USmW8x/LaYKUWDlqw3a2I=";
+      hash = "sha256-qo40t+PGl1RO2ajJ2Hev4G1FWvzTx7Ak5CVxjdxabLI=";
     };
     x86_64-linux = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-      hash = "sha256-mM2SOn6V1KQJEjxR0KH1lXJMLSzpx/IiZDeSrJtIFt0=";
+      hash = "sha256-T3A/ejmLkIRYGWc8GXQmvIAZvQFwYEyhQJxssNDalhQ=";
     };
     aarch64-darwin = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-v${version}-darwin-arm64.zip";
-      hash = "sha256-WkBudj8I0/pIzhA4fynkfY4t6M/6d1zPTZPSQeX3d5Y=";
+      hash = "sha256-K1p5mAYfEDJNZFSmoOQV7kHNsA5RQuyUl3T2KVsNcbw=";
     };
     x86_64-darwin = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-v${version}-darwin-x64.zip";
-      hash = "sha256-mxKhtUiLoloUvYK0hv1WHpVytadHPLGN8IePrscxWxs=";
+      hash = "sha256-IrhvRVFZGLoGSVNy10ppFL9rEy7MRTb/HIhzspDsrs8=";
     };
   };
 

pkgs/by-name/br/bruijn/generated.nix

@@ -22,10 +22,10 @@
 }:
 mkDerivation {
   pname = "bruijn";
-  version = "0-unstable-2026-05-03";
+  version = "0-unstable-2026-07-05";
   src = fetchzip {
-    url = "https://github.com/marvinborner/bruijn/archive/b5cb32a7bb3b44f58f9e909bfd394564be26d50a.tar.gz";
-    sha256 = "1k9sgl4h4da1qr9r1laz72rscxsicr5sjmla8qx7px0g1iajl0dn";
+    url = "https://github.com/marvinborner/bruijn/archive/29a4a3e9620702f47d839a154d64489b8fdce1a7.tar.gz";
+    sha256 = "18vxzgd6faq8djgpav4na1nvp0jid44vd52gn9a8smwr2xk44wnz";
   };
   isLibrary = true;
   isExecutable = true;

pkgs/by-name/bu/buildbox/package.nix

@@ -23,13 +23,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "buildbox";
-  version = "1.4.11";
+  version = "1.4.13";
 
   src = fetchFromGitLab {
     owner = "BuildGrid";
     repo = "buildbox/buildbox";
     tag = finalAttrs.version;
-    hash = "sha256-8Et5wgiugoDLtW2C2nsth5iPXPGQ7wkPDSc6hrBgeG8=";
+    hash = "sha256-W/QV65A7zm2vUdvJRrR+bxe8O3Zogzrx86RmqFVCY84=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/c2/c2patool/package.nix

@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "c2patool";
-  version = "0.26.68";
+  version = "0.26.69";
 
   src = fetchFromGitHub {
     owner = "contentauth";
     repo = "c2pa-rs";
     tag = "c2patool-v${finalAttrs.version}";
-    hash = "sha256-0St3EoHvUQtfPF0LOLkbQ3C6NT/R+F9YhQoE0TpDTOc=";
+    hash = "sha256-BTPkqRfET77IrNafeo/sPT/4AxXb87prqbu+GjKErG8=";
   };
 
-  cargoHash = "sha256-lUHRGfI/GW9ZMEor5NPATt/ih6D/AhvGbL4H7FtyzDQ=";
+  cargoHash = "sha256-cMvRDRVXa4044F7pHM+X3NcBB8OtgfIw6Sxw6PilNKs=";
 
   # use the non-vendored openssl
   env.OPENSSL_NO_VENDOR = 1;

pkgs/by-name/ca/caddy/package.nix

@@ -3,6 +3,7 @@
   buildGoModule,
   callPackage,
   fetchFromGitHub,
+  testers,
   nixosTests,
   caddy,
   installShellFiles,
@@ -10,23 +11,18 @@
   writableTmpDirAsHomeHook,
   versionCheckHook,
 }:
-let
-  version = "2.11.4";
-  dist = fetchFromGitHub {
-    owner = "caddyserver";
-    repo = "dist";
-    tag = "v${version}";
-    hash = "sha256-oRQfQH1GKjAjVMj+dZo1f1+HOaOdJIyEfod0iGLYcc8=";
-  };
-in
+
 buildGoModule (finalAttrs: {
   pname = "caddy";
-  inherit version;
+  version = "2.11.4";
+
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "caddyserver";
     repo = "caddy";
     tag = "v${finalAttrs.version}";
+    # remember to update hashes for `dist` and `plugins` test!
     hash = "sha256-wzk8KRZfDCbbjRlBwkoKAoMjOhV4xF3yuXUueqtl1xM=";
   };
 
@@ -52,7 +48,7 @@ buildGoModule (finalAttrs: {
   __darwinAllowLocalNetworking = true;
 
   postInstall = ''
-    install -Dm644 ${dist}/init/caddy.service ${dist}/init/caddy-api.service -t $out/lib/systemd/system
+    install -Dm644 ${finalAttrs.passthru.dist}/init/caddy.service ${finalAttrs.passthru.dist}/init/caddy-api.service -t $out/lib/systemd/system
 
     substituteInPlace $out/lib/systemd/system/caddy.service \
       --replace-fail "/usr/bin/caddy" "$out/bin/caddy"
@@ -72,20 +68,29 @@ buildGoModule (finalAttrs: {
       --zsh <($out/bin/caddy completion zsh)
   '';
 
-  passthru = {
-    tests = {
-      inherit (nixosTests) caddy;
-      acme-integration = nixosTests.acme.caddy;
-    };
-    withPlugins = callPackage ./plugins.nix { inherit caddy; };
-  };
-
+  doInstallCheck = true;
   nativeInstallCheckInputs = [
     writableTmpDirAsHomeHook
     versionCheckHook
   ];
   versionCheckKeepEnvironment = [ "HOME" ];
-  doInstallCheck = true;
+
+  passthru = {
+    withPlugins = callPackage ./plugins.nix { inherit caddy; };
+
+    dist = fetchFromGitHub {
+      owner = "caddyserver";
+      repo = "dist";
+      tag = "v${finalAttrs.version}";
+      hash = "sha256-oRQfQH1GKjAjVMj+dZo1f1+HOaOdJIyEfod0iGLYcc8=";
+    };
+
+    tests = {
+      inherit (nixosTests) caddy;
+      plugins = testers.runNixOSTest ./plugins.test.nix;
+      acme-integration = nixosTests.acme.caddy;
+    };
+  };
 
   meta = {
     homepage = "https://caddyserver.com";

pkgs/by-name/ca/caddy/plugins.test.nix

@@ -0,0 +1,36 @@
+{ lib, ... }:
+
+{
+  name = "caddy-plugins";
+  meta.maintainers = with lib.maintainers; [
+    stepbrobd
+  ];
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      services.caddy = {
+        enable = true;
+
+        package = pkgs.caddy.withPlugins {
+          plugins = [ "github.com/caddyserver/replace-response@v0.0.0-20250618171559-80962887e4c6" ];
+          hash = "sha256-oj0IpspxslpNZbJFsexh0W2Sja19XRUsbShoCuY6qkQ=";
+        };
+
+        globalConfig = ''
+          order replace after encode
+        '';
+
+        virtualHosts."localhost:80".extraConfig = ''
+          respond "hello world"
+          replace world nixos
+        '';
+      };
+    };
+
+  testScript = ''
+    machine.wait_for_unit("caddy")
+    machine.wait_for_open_port(80)
+    machine.succeed("curl http://localhost | grep nixos")
+  '';
+}

pkgs/by-name/ca/carapace-bridge/package.nix

@@ -8,19 +8,19 @@
 
 buildGoModule (finalAttrs: {
   pname = "carapace-bridge";
-  version = "1.6.0";
+  version = "1.6.1";
 
   src = fetchFromGitHub {
     owner = "carapace-sh";
     repo = "carapace-bridge";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-HEVFg9rW1UiRpcZlENTg+YgB/AwmtuEuNqTf4jXW4wU=";
+    hash = "sha256-+PxsIkNRG9lwmhdzW/KB+CUkjJUXpYNn82m1tqIo/NE=";
   };
 
   # buildGoModule tries to run `go mod vendor` instead of `go work vendor` on
   # the workspace if proxyVendor is off
   proxyVendor = true;
-  vendorHash = "sha256-RLx5QtA3oTsDSmSWoRqV0LJ+rSifSRc+WAQyeh0Xnbw=";
+  vendorHash = "sha256-5d1LTwfYJe2RCNYNpKbO/3ofayTXDHD+OFul+wuXO0w=";
 
   postPatch = ''
     substituteInPlace cmd/carapace-bridge/main.go \

pkgs/by-name/ce/cef-binary/package.nix

@@ -29,13 +29,13 @@
   libx11,
   libxshmfence,
   libxcb,
-  version ? "147.0.10",
-  gitRevision ? "d58e84d",
-  chromiumVersion ? "147.0.7727.118",
+  version ? "149.0.5",
+  gitRevision ? "6770623",
+  chromiumVersion ? "149.0.7827.197",
   buildType ? "Release",
   srcHashes ? {
-    aarch64-linux = "sha256-kaRijMDacPcoeCcS31zmRSNOvgozx+uq2M34mD28bu4=";
-    x86_64-linux = "sha256-CHzPofBDhCniDZEpOxXK4I7p57SYjMAY1HVo3Vna0e8=";
+    aarch64-linux = "sha256-cBAvcvs1rAg5EKJkCt81RZYupCWpUNIC/nLt3PJow7Q=";
+    x86_64-linux = "sha256-OPGMBJmvvLiLdBDniBQwx7LmTGGI59AcesJdILSeqcs=";
   },
 }:
 

pkgs/by-name/ch/chainsaw/package.nix

@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "chainsaw";
-  version = "2.16.0";
+  version = "2.16.2";
 
   src = fetchFromGitHub {
     owner = "WithSecureLabs";
     repo = "chainsaw";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ywHPDVHpw0TrzeWPzZ3cvQSxCr2Di2YjS0Not1B9vlg=";
+    hash = "sha256-EKL2MTo5qirpY4TCWwBptpRWJRd6Yp/dLz/5sIsdsbg=";
   };
 
-  cargoHash = "sha256-AA8JQiGukh4SRZyciuE2u4OUo7HNeb6+SWej9vlw5z8=";
+  cargoHash = "sha256-bbgRqp3bNw2U69aVqwvJNWOKgW0YhR8SlqzH9jdrHZU=";
 
   ldflags = [
     "-w"

pkgs/by-name/ci/cinny-desktop/package.nix

@@ -20,35 +20,30 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cinny-desktop";
-  # We have to be using the same version as cinny-web or this isn't going to work.
-  version = "4.12.2";
+  version = "4.12.5";
 
   src = fetchFromGitHub {
     owner = "cinnyapp";
     repo = "cinny-desktop";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-gaTgNTn0/HHzULHRL03+t73MEUOGdqcEyqaIt8CWA0k=";
+    hash = "sha256-/A/O42jwwK2iDV1IdRjOO8fE/AZ0h7UWAZZLozOqUWs=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/src-tauri";
 
-  cargoHash = "sha256-x7rpnhTz454Ftolu4x50NSGKdg8NfenUwdhPY4a+lbA=";
+  cargoHash = "sha256-EF8gpfeZasazq0NKrjItt4bkgautQjYjEegf1OlWLOw=";
 
   postPatch =
     let
-      cinny' =
-        assert lib.assertMsg (
-          cinny.version == finalAttrs.version
-        ) "cinny.version (${cinny.version}) != cinny-desktop.version (${finalAttrs.version})";
-        cinny.override {
-          conf = {
-            hashRouter.enabled = true;
-          };
+      cinny' = cinny.override {
+        conf = {
+          hashRouter.enabled = true;
         };
+      };
     in
     ''
       ${lib.getExe jq} \
-        'del(.plugins.tauri.updater) | .build.frontendDist = "${cinny'}" | del(.build.beforeBuildCommand) | .bundle.createUpdaterArtifacts = false' tauri.conf.json \
+        '.build.frontendDist = "${cinny'}" | del(.build.beforeBuildCommand) | .bundle.createUpdaterArtifacts = false' tauri.conf.json \
         | ${lib.getExe' moreutils "sponge"} tauri.conf.json
     '';
 
@@ -82,6 +77,9 @@ rustPlatform.buildRustPackage (finalAttrs: {
     webkitgtk_4_1
   ];
 
+  buildNoDefaultFeatures = true;
+  buildFeatures = [ "custom-protocol" ];
+
   passthru = {
     updateScript = _experimental-update-script-combinators.sequence [
       (nix-update-script { attrPath = "cinny-unwrapped"; })

pkgs/by-name/ci/cinny-unwrapped/package.nix

@@ -7,17 +7,17 @@
 buildNpmPackage (finalAttrs: {
   pname = "cinny-unwrapped";
   # Remember to update cinny-desktop when bumping this version.
-  version = "4.12.2";
+  version = "4.12.3";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "cinnyapp";
     repo = "cinny";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-UF5MwV02G0oYIXtvyzHn+DifYM8PFlyb9DZ4w1fuyDE=";
+    hash = "sha256-RjPdq9xNvUbJESV7CqxmgfqAx+MoKZbhUtJNTcH9aUk=";
   };
 
-  npmDepsHash = "sha256-8SyUFv1wgnqfSyBlykmeGI8RAmFt5Q5uS6OFLi+qPPY=";
+  npmDepsHash = "sha256-CU8AVRuMFOGI0/LbN0LGysBk+qc2XQYxQGfrrH72stc=";
 
   # Skip rebuilding native modules since they're not needed for the web app
   npmRebuildFlags = [

pkgs/by-name/cn/cnspec/package.nix

@@ -6,18 +6,18 @@
 
 buildGoModule (finalAttrs: {
   pname = "cnspec";
-  version = "13.27.4";
+  version = "13.28.0";
 
   src = fetchFromGitHub {
     owner = "mondoohq";
     repo = "cnspec";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-HcDGHcKxbXYTF+PdrjcOcCH/0Hnz++qIGdbDYtCRpDM=";
+    hash = "sha256-9AlHvxWdmJIdfvmok9n+6g0k5A4Rts2+G5pO9xbYWSQ=";
   };
 
   proxyVendor = true;
 
-  vendorHash = "sha256-suSEjRh6vSSI2jRyz12nLD/G1gvQiWC4aGx2J2drSIo=";
+  vendorHash = "sha256-LTzg76RQOV0d3Xk4Q8NvBnmTQv4QhJutNoJPw0gCCII=";
 
   subPackages = [ "apps/cnspec" ];
 

pkgs/by-name/co/coc-rust-analyzer/package.nix

@@ -7,16 +7,16 @@
 
 buildNpmPackage {
   pname = "coc-rust-analyzer";
-  version = "0-unstable-2026-06-16";
+  version = "0-unstable-2026-07-01";
 
   src = fetchFromGitHub {
     owner = "fannheyward";
     repo = "coc-rust-analyzer";
-    rev = "832db4c7c99b526bf3608ea40a5a904cae77b691";
-    hash = "sha256-bf3pA4JOCN+BhtIFIHBplHkLqvtdwYKZObrdkw+2v4E=";
+    rev = "056c78eb619bdf985d4414cbf73abfc5226d5c04";
+    hash = "sha256-1WhU2GYUU2l3tKpb5F6VxY61HPOHqtuS6hbI+upCmH8=";
   };
 
-  npmDepsHash = "sha256-5yOJwuqeW9tyXRmp/G1gEsv4h2OIr3QFYCXZC8pbJQI=";
+  npmDepsHash = "sha256-ifDAM08pfdbqPl9G5s5cx8hGzldNuVc0DcXDyCGgkkI=";
 
   passthru.updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; };
 

pkgs/by-name/co/codexbar/package.nix

@@ -38,7 +38,10 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     description = "Show usage stats for AI coding-provider limits";
     homepage = "https://codex.bar/";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ Br1ght0ne ];
+    maintainers = with lib.maintainers; [
+      Br1ght0ne
+      kinnrai
+    ];
     platforms = lib.platforms.darwin;
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
   };

pkgs/by-name/co/copyparty/package.nix

@@ -71,11 +71,11 @@ in
 
 python3Packages.buildPythonApplication rec {
   pname = "copyparty${nameSuffix}";
-  version = "1.20.16";
+  version = "1.20.17";
 
   src = fetchurl {
     url = "https://github.com/9001/copyparty/releases/download/v${version}/copyparty-${version}.tar.gz";
-    hash = "sha256-Yl+V1l2VzdaJhRBRjQE5BeZ2bH0q4Oqa59XeyW6J4C0=";
+    hash = "sha256-lJVTrv/qlCoN2r0+EtKKZD/qhi14kwuzbgrMxmxMlHU=";
   };
 
   pyproject = true;

pkgs/by-name/co/cosmic-ext-applet-sysinfo/package.nix

@@ -9,13 +9,13 @@
 }:
 rustPlatform.buildRustPackage {
   pname = "cosmic-ext-applet-sysinfo";
-  version = "0-unstable-2026-06-25";
+  version = "0-unstable-2026-07-04";
 
   src = fetchFromGitHub {
     owner = "cosmic-utils";
     repo = "cosmic-ext-applet-sysinfo";
-    rev = "34ed2a114ec327431e576dc8060e767d15d3571f";
-    hash = "sha256-9BF51WrASOSyBTmAenk02cR0fab2S7qU8KMfkgZGZDE=";
+    rev = "f00dfa49568f8e9d97cd109fa67045ddc6df78d7";
+    hash = "sha256-e/dmBJik953u1JSQwQ+n9A3jTVmcefKSkF+EmXhg73o=";
   };
 
   cargoHash = "sha256-KVnvyiF2rXb9gio3o+dE9w/zZ5gcad1uEbWHMBC3yDc=";

pkgs/by-name/cp/cpond/package.nix

@@ -0,0 +1,45 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  ncurses,
+}:
+stdenv.mkDerivation {
+  pname = "cpond";
+  version = "0-unstable-2025-11-23";
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  src = fetchFromGitHub {
+    owner = "ayuzur";
+    repo = "cpond";
+    rev = "b6d2827c73080b144ff07a70ec61757baff6a73b";
+    hash = "sha256-feRGJ2CIa82eEiGG65WwFlh6dhhIvhW70FJMObWvi1Q=";
+  };
+
+  buildInputs = [ ncurses ];
+
+  postPatch = ''
+    substituteInPlace Makefile \
+      --replace-fail '$(eflags)$(ncursesw_macros)' '$(eflags) $(ncursesw_macros)'
+  ''
+  + lib.optionalString stdenv.isDarwin ''
+    substituteInPlace Makefile \
+      --replace-fail '-lncursesw' '-lncurses'
+  '';
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp cpond $out/bin/
+  '';
+
+  meta = {
+    homepage = "https://github.com/ayuzur/cpond";
+    description = "Procedurally animated fish for your terminal";
+    license = lib.licenses.mit;
+    mainProgram = "cpond";
+    maintainers = with lib.maintainers; [ yarn ];
+    platforms = lib.platforms.unix;
+  };
+}

pkgs/by-name/cr/crossplane-cli/package.nix

@@ -9,16 +9,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "crossplane-cli";
-  version = "2.3.3";
+  version = "2.4.0";
 
   src = fetchFromGitHub {
     owner = "crossplane";
     repo = "cli";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-X40vTjtai6zlZWvGG/wPt8us4AONcXZ9TxIZn2cPH2E=";
+    hash = "sha256-pD91bH+K0nWDXv51mWtNlQVtBLi/zDEjAxAJ6ywd69g=";
   };
 
-  vendorHash = "sha256-WAGIhGW7R5BZuQmERbJhN3mFCLVSDsNqtAFYnrNo7XE=";
+  vendorHash = "sha256-d7ZgiRF5LVxJoOwqfe0nHyJmakbexGEA7865QXUotP8=";
 
   ldflags = [
     "-s"

pkgs/by-name/da/daktari/package.nix

@@ -7,7 +7,7 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "daktari";
-  version = "0.0.340";
+  version = "0.0.341";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -15,7 +15,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     owner = "genio-learn";
     repo = "daktari";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-gHBpezrya7i4Gh3dQHynS5vJtBhvXndruGsRRBBRde8=";
+    hash = "sha256-Z2NJ59APuw3AwJ4d3Ux8aaLugbzxjs7CnGQHyfIHiyk=";
   };
 
   patches = [ ./optional-pyclip.patch ];

pkgs/by-name/db/dblab/package.nix

@@ -7,13 +7,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "dblab";
-  version = "0.42.0";
+  version = "0.43.0";
 
   src = fetchFromGitHub {
     owner = "danvergara";
     repo = "dblab";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-zp3bF8mzhB2CPiUCNYDWTJVYrwZvZdV3xaM2Mil9sTo=";
+    hash = "sha256-SH5iSXo5QEZiguP2fW2mYMXWY4sPP4ImV+Y89hhm+ys=";
   };
 
   vendorHash = "sha256-widzVKA85qslxuuO/ledG+IUvr+vw2HUiD3kVbe2D2A=";

pkgs/by-name/di/discordchatexporter-desktop/package.nix

@@ -41,7 +41,10 @@ buildDotnetModule rec {
     license = lib.licenses.gpl3Plus;
     changelog = "https://github.com/Tyrrrz/DiscordChatExporter/releases/tag/${version}";
     maintainers = with lib.maintainers; [ willow ];
-    platforms = [ "x86_64-linux" ];
+    platforms = [
+      "x86_64-linux"
+      "aarch64-linux"
+    ];
     mainProgram = "discordchatexporter";
   };
 }

pkgs/by-name/di/diun/package.nix

@@ -19,7 +19,7 @@ buildGoModule (finalAttrs: {
 
   # upstream disable CGO in release build
   # https://github.com/crazy-max/diun/blob/76c0fe99212adc58d6a3433bbcde1ffa9fb879c4/Dockerfile#L11
-  env.CGO_ENABLED = false;
+  env.CGO_ENABLED = 0;
 
   ldflags = [
     "-s"

pkgs/by-name/dm/dms-shell/package.nix

@@ -28,18 +28,18 @@ buildGoModule (
   in
   {
     pname = "dms-shell";
-    version = "1.4.6";
+    version = "1.5.0";
 
     src = fetchFromGitHub {
       owner = "AvengeMedia";
       repo = "DankMaterialShell";
       tag = "v${finalAttrs.version}";
-      hash = "sha256-g6r/Gx8PTDzO3jCNzzySA+Ff1lmLF9nDlMCNyyoQjoE=";
+      hash = "sha256-zdHsPGPE5MVi/y+uIt548XScTfZjQzdF21dME7ISEJM=";
     };
 
     sourceRoot = "${finalAttrs.src.name}/core";
 
-    vendorHash = "sha256-cVUJXgzYMRSM0od1xzDVkMTdxHu3OIQX2bQ8AJbGQ1Q=";
+    vendorHash = "sha256-nvxFHQhOfBGl3h51fgYDb39K0NCj+H8mAEyKr1qOwJQ=";
 
     ldflags = [
       "-s"

pkgs/by-name/dn/dns-collector/package.nix

@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "dns-collector";
-  version = "2.3.0";
+  version = "2.4.0";
 
   src = fetchFromGitHub {
     owner = "dmachard";
     repo = "dns-collector";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-5SFdTDuXnVdMFGxoraUMbDV3o476sc9c7D9qWBoQXr4=";
+    hash = "sha256-Gm5PXEEgw98NnsfKN8JxhyTqEL9KSA6L2CgRTRJirdY=";
   };
 
   subPackages = [ "." ];
@@ -28,7 +28,7 @@ buildGoModule (finalAttrs: {
     "-X=github.com/prometheus/common/version.Version=${finalAttrs.version}"
   ];
 
-  vendorHash = "sha256-eoUsiRGtq1ucAIyeCRNEuro2Qj4iRe+3aE8DrqIcCWs=";
+  vendorHash = "sha256-pEex5xu3Cf6vqFp7YLwk+Ku+Yc0coOGLXP7/NUtDYbg=";
 
   passthru.updateScript = nix-update-script { };
 

pkgs/by-name/do/dopamine/bump-better-sqlite3.patch

@@ -0,0 +1,48 @@
+diff --git a/package-lock.json b/package-lock.json
+index 921ffcdc..f1a2aeeb 100644
+--- a/package-lock.json
++++ b/package-lock.json
+@@ -17,7 +17,7 @@
+                 "@electron/remote": "2.1.3",
+                 "@fortawesome/fontawesome-free": "^6.6.0",
+                 "angular-split": "14.1.0",
+-                "better-sqlite3": "12.5.0",
++                "better-sqlite3": "12.11.1",
+                 "cheerio": "1.0.0-rc.12",
+                 "discord-rpc": "4.0.1",
+                 "electron-log": "4.4.8",
+@@ -10353,9 +10353,9 @@
+             "license": "MIT"
+         },
+         "node_modules/better-sqlite3": {
+-            "version": "12.5.0",
+-            "resolved": "https://registry.npmjs.org/better-sqlite3/-/better-sqlite3-12.5.0.tgz",
+-            "integrity": "sha512-WwCZ/5Diz7rsF29o27o0Gcc1Du+l7Zsv7SYtVPG0X3G/uUI1LqdxrQI7c9Hs2FWpqXXERjW9hp6g3/tH7DlVKg==",
++            "version": "12.11.1",
++            "resolved": "https://registry.npmjs.org/better-sqlite3/-/better-sqlite3-12.11.1.tgz",
++            "integrity": "sha512-dq9AtApgg5PGFtBzPFSBl3HZQjHok5gaQCM6zh2Yk0aSmDCs1CbnVI8/HgASQkNKsWFpseIO9beg5xxpYhbIfA==",
+             "hasInstallScript": true,
+             "license": "MIT",
+             "dependencies": {
+@@ -10363,7 +10363,7 @@
+                 "prebuild-install": "^7.1.1"
+             },
+             "engines": {
+-                "node": "20.x || 22.x || 23.x || 24.x || 25.x"
++                "node": "20.x || 22.x || 23.x || 24.x || 25.x || 26.x"
+             }
+         },
+         "node_modules/big.js": {
+diff --git a/package.json b/package.json
+index 2c07792f..9023e10c 100644
+--- a/package.json
++++ b/package.json
+@@ -98,7 +98,7 @@
+         "@electron/remote": "2.1.3",
+         "@fortawesome/fontawesome-free": "^6.6.0",
+         "angular-split": "14.1.0",
+-        "better-sqlite3": "12.5.0",
++        "better-sqlite3": "12.11.1",
+         "cheerio": "1.0.0-rc.12",
+         "discord-rpc": "4.0.1",
+         "electron-log": "4.4.8",

pkgs/by-name/do/dopamine/package.nix

@@ -3,30 +3,36 @@
   stdenv,
   fetchFromGitHub,
   buildNpmPackage,
-  electron_40,
+  electron,
   python3,
   xcodebuild,
+  applyPatches,
 }:
 buildNpmPackage (finalAttrs: {
   pname = "dopamine";
   version = "3.0.6";
 
-  src = fetchFromGitHub {
-    owner = "digimezzo";
-    repo = "dopamine";
-    tag = "v${finalAttrs.version}";
-    hash = "sha256-HTPWejm5Wi6yGJyS/f1RhjIluTz01ue8lAsnAcQY3IY=";
+  # needed to upgrade better-sqlite3 in npmConfigHook
+  src = applyPatches {
+    src = fetchFromGitHub {
+      owner = "digimezzo";
+      repo = "dopamine";
+      tag = "v${finalAttrs.version}";
+      hash = "sha256-HTPWejm5Wi6yGJyS/f1RhjIluTz01ue8lAsnAcQY3IY=";
+    };
+    patches = [
+      # register-scheme contains install scripts, but has no lockfile
+      ./remove-register-scheme.patch
+
+      # fixes node-addon-api errors with aarch64-darwin
+      ./update-node-addon-api.patch
+
+      # bump better-sqlite3 to work with electron 41
+      ./bump-better-sqlite3.patch
+    ];
   };
 
-  npmDepsHash = "sha256-JkGS0YmjsdUiOD48HcGXy/fPTP33JQAtJui0mQWicmc=";
-
-  patches = [
-    # register-scheme contains install scripts, but has no lockfile
-    ./remove-register-scheme.patch
-
-    # fixes node-addon-api errors with aarch64-darwin
-    ./update-node-addon-api.patch
-  ];
+  npmDepsHash = "sha256-9dQUqoLfzYXOgmE9j2lkew9b/1m4XOghT7roD82y+qg=";
 
   nativeBuildInputs = [
     (python3.withPackages (ps: with ps; [ distutils ]))
@@ -39,8 +45,8 @@ buildNpmPackage (finalAttrs: {
     runHook preBuild
 
     # needed for better-sqlite3 rebuild
-    export npm_config_nodedir="${electron_40.headers}"
-    export npm_config_target="${electron_40.version}"
+    export npm_config_nodedir="${electron.headers}"
+    export npm_config_target="${electron.version}"
 
     npm rebuild --verbose --no-progress --offline
 
@@ -57,7 +63,7 @@ buildNpmPackage (finalAttrs: {
     ${
       if stdenv.hostPlatform.isDarwin then
         ''
-          cp -r ${electron_40.dist}/Electron.app ./
+          cp -r ${electron.dist}/Electron.app ./
           find ./Electron.app -name 'Info.plist' -exec chmod +rw {} \;
 
           npm exec electron-builder -- \
@@ -65,7 +71,7 @@ buildNpmPackage (finalAttrs: {
             -c.npmRebuild=false \
             -c.mac.identity=null \
             -c.electronDist=./ \
-            -c.electronVersion=${electron_40.version} \
+            -c.electronVersion=${electron.version} \
             -c.extraMetadata.version=v${finalAttrs.version} \
             --config electron-builder.config.js
         ''
@@ -74,8 +80,8 @@ buildNpmPackage (finalAttrs: {
           npm exec electron-builder -- \
             --dir \
             -c.npmRebuild=false \
-            -c.electronDist=${electron_40.dist} \
-            -c.electronVersion=${electron_40.version} \
+            -c.electronDist=${electron.dist} \
+            -c.electronVersion=${electron.version} \
             -c.extraMetadata.version=v${finalAttrs.version} \
             --config electron-builder.config.js
         ''
@@ -99,7 +105,7 @@ buildNpmPackage (finalAttrs: {
           mkdir -p $out/share/dopamine
           cp -r release/linux*unpacked/{locales,resources{,.pak}} $out/share/dopamine
 
-          makeWrapper ${lib.getExe electron_40} $out/bin/dopamine \
+          makeWrapper ${lib.getExe electron} $out/bin/dopamine \
             --add-flags $out/share/dopamine/resources/app.asar \
             --inherit-argv0
 

pkgs/by-name/do/dorion/package.nix

@@ -15,7 +15,7 @@
   openssl,
   pkg-config,
   yq-go,
-  pnpm_9,
+  pnpm_10,
   fetchPnpmDeps,
   pnpmConfigHook,
   webkitgtk_4_1,
@@ -51,9 +51,9 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
-    pnpm = pnpm_9;
+    pnpm = pnpm_10;
     fetcherVersion = 3;
-    hash = "sha256-E45X3JEns1TE+SVbtbBEl+RzwRgTiGN7/N4OgJ5o63o=";
+    hash = "sha256-WzJD2Brg7+cx7TXRpEg2c1QSY0uo0Ppulj3ytdl0A4I=";
   };
 
   # CMake (webkit extension, Linux only)
@@ -69,7 +69,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   nativeBuildInputs = [
     pnpmConfigHook
-    pnpm_9
+    pnpm_10
     cargo-tauri.hook
     nodejs
     pkg-config
@@ -180,6 +180,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
   doCheck = false;
 
   env = {
+    # pnpm 10 prompts before purging node_modules in non-interactive builds.
+    CI = "true";
     TAURI_RESOURCE_DIR = "${placeholder "out"}/lib";
   };
 

pkgs/by-name/du/dua/package.nix

@@ -1,9 +1,11 @@
 {
+  stdenv,
   lib,
   rustPlatform,
   fetchFromGitHub,
   versionCheckHook,
   nix-update-script,
+  installShellFiles,
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
@@ -38,6 +40,16 @@ rustPlatform.buildRustPackage (finalAttrs: {
   nativeInstallCheckInputs = [ versionCheckHook ];
   doInstallCheck = true;
 
+  nativeBuildInputs = [ installShellFiles ];
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    # TODO: Upstream also provides Elvish and PowerShell completions,
+    # but `installShellCompletion` only has support for Bash, Zsh and Fish at the moment.
+      installShellCompletion --cmd dua \
+        --bash <($out/bin/dua completions bash) \
+        --fish <($out/bin/dua completions fish) \
+        --zsh  <($out/bin/dua completions zsh)
+  '';
+
   passthru.updateScript = nix-update-script { };
 
   meta = {

pkgs/by-name/es/espeak-classic/package.nix

@@ -31,8 +31,10 @@ stdenv.mkDerivation (finalAttrs: {
   '');
 
   configurePhase = ''
+    runHook preConfigure
     cd src
     makeFlags="PREFIX=$out DATADIR=$out/share/espeak-data"
+    runHook postConfigure
   '';
 
   meta = {

pkgs/by-name/es/espeakedit/gcc6.patch

@@ -0,0 +1,13 @@
+diff --git c/src/tr_languages.cpp i/src/tr_languages.cpp
+index ec210a5..9503f47 100755
+--- c/src/tr_languages.cpp
++++ i/src/tr_languages.cpp
+@@ -198,7 +198,7 @@ static const unsigned short chars_ignore_zwnj_hyphen[] = {
+ 	0x200d,  1, // zero width joiner
+ 	0, 0 };
+ 
+-const char string_ordinal[] = {0xc2,0xba,0};  // masculine ordinal character, UTF-8
++const char string_ordinal[] = {char(0xc2),char(0xba),0};  // masculine ordinal character, UTF-8
+ 
+ 
+ static Translator* NewTranslator(void)

pkgs/by-name/es/espeakedit/package.nix

@@ -61,12 +61,15 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   buildPhase = ''
+    runHook preBuild
     make -C src
+    runHook postBuild
   '';
 
   installPhase = ''
-    mkdir -p "$out/bin"
-    cp src/espeakedit "$out/bin"
+    runHook preInstall
+    install -D src/espeakedit -t $out/bin
+    runHook postInstall
   '';
 
   meta = {

pkgs/by-name/ex/exploitdb/package.nix

@@ -6,13 +6,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "exploitdb";
-  version = "2026-07-07";
+  version = "2026-07-09";
 
   src = fetchFromGitLab {
     owner = "exploit-database";
     repo = "exploitdb";
     tag = finalAttrs.version;
-    hash = "sha256-YjE8ovQAbBPOT7dES7ihHWUQE2b/jhfboLuoqxrd314=";
+    hash = "sha256-V9hRNS5F6XovML9coPqSq1letp67THqqocqKYWJtFkQ=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

pkgs/by-name/fa/fast/package.nix

@@ -3,17 +3,17 @@
   buildGoModule,
   fetchFromGitHub,
 }:
-buildGoModule {
+buildGoModule rec {
   pname = "fast";
-  version = "0-unstable-2026-07-01";
+  version = "0.1.0";
 
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "maaslalani";
     repo = "fast";
-    rev = "26d8fc9c189ba748c68f8930af11dee5c2467f7e";
-    hash = "sha256-YeDx082+ySqzamo9UutFTXXkrb37nmqt3ZUNzUHShf4=";
+    tag = "v${version}";
+    hash = "sha256-/Li5AAuuHkVqJzmh38g5CPQXWj4RY0TRwvtjlpydosg=";
   };
 
   vendorHash = "sha256-YSjJ8NOL97hXZLnfGYIjoKmARv+gWOsv+5qkl9konnA=";

pkgs/by-name/fa/fastly/package.nix

@@ -12,13 +12,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "fastly";
-  version = "15.3.1";
+  version = "15.4.0";
 
   src = fetchFromGitHub {
     owner = "fastly";
     repo = "cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-SjRs4ZJnjRTfMgoMBoDoHImD6M6FO6QRA0Vmth1GFbI=";
+    hash = "sha256-vC3S3PYLtkbobfqUSdgrxcfFxHWN02mEO3YzctMkybU=";
     # The git commit is part of the `fastly version` original output;
     # leave that output the same in nixpkgs. Use the `.git` directory
     # to retrieve the commit SHA, and remove the directory afterwards,
@@ -35,7 +35,7 @@ buildGoModule (finalAttrs: {
     "cmd/fastly"
   ];
 
-  vendorHash = "sha256-zQ+ZJ4LXV9NR2zwcMrTTc3eWpNxrbFlik2m2CpaE3eA=";
+  vendorHash = "sha256-8TM/gprIgItjw9rUAHh6eJ8ZHlbUoB5KyKmFJDM2xlU=";
 
   nativeBuildInputs = [
     installShellFiles

pkgs/by-name/fl/fldigi/package.nix

@@ -62,7 +62,6 @@ stdenv.mkDerivation (finalAttrs: {
     license = lib.licenses.gpl3Plus;
     maintainers = with lib.maintainers; [
       relrod
-      ftrvxmtrx
     ];
     platforms = lib.platforms.unix;
   };

pkgs/by-name/fn/fnox/package.nix

@@ -0,0 +1,59 @@
+{
+  lib,
+  fetchFromGitHub,
+  stdenv,
+  rustPlatform,
+  perl,
+  pkg-config,
+  testers,
+  dbus,
+  udev,
+  nix-update-script,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  __structuredAttrs = true;
+  pname = "fnox";
+  version = "1.29.0";
+
+  src = fetchFromGitHub {
+    owner = "jdx";
+    repo = "fnox";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-sXFcvpAcHrzRbqYLIrq844TH1dHY1G23QIQoIcsCLGY=";
+  };
+
+  cargoHash = "sha256-BhBWghjPC8qs5oKECmddV250YO4/hSWupOz+J9DYKog=";
+
+  nativeBuildInputs = [
+    perl
+    pkg-config
+  ];
+
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
+    dbus
+    udev
+  ];
+
+  passthru = {
+    tests.version = testers.testVersion { package = finalAttrs.finalPackage; };
+    updateScript = nix-update-script { };
+  };
+
+  checkFlags = [
+    # requires a D-Bus session unavailable in the sandbox
+    "--skip=providers::keychain::tests::test_keychain_set_and_get"
+  ];
+
+  meta = {
+    description = "Flexible secret management tool supporting multiple providers and encryption methods";
+    homepage = "https://github.com/jdx/fnox";
+    changelog = "https://github.com/jdx/fnox/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [
+      tiptenbrink
+      Br1ght0ne
+    ];
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
+  };
+})

pkgs/by-name/fu/fulcio/package.nix

@@ -15,13 +15,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "fulcio";
-  version = "1.8.7";
+  version = "1.8.8";
 
   src = fetchFromGitHub {
     owner = "sigstore";
     repo = "fulcio";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-9TvucbTD2uPFxJqUG2EwMLRV6PxGf5UbxoEIUAqUE84=";
+    hash = "sha256-MKXJAk4N6Q/VM7/8Ri08rfrxHRw5FvOoreFrMp2SoE0=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -33,7 +33,7 @@ buildGoModule (finalAttrs: {
       find "$out" -name .git -print0 | xargs -0 rm -rf
     '';
   };
-  vendorHash = "sha256-Mb4MBqEbWAo58TLd15JUh53I7CUHu+nyyIAfZxx3DMw=";
+  vendorHash = "sha256-Bpu6PR3i+Sq5tZhCPLYi4rECwZ/QiN3Wls7U+8f6fBU=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/gc/gcli/package.nix

@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
   meta = {
     description = "Portable Git(Hub|Lab|ea) CLI tool";
     homepage = "https://herrhotzenplotz.de/gcli/";
-    changelog = "https://github.com/herrhotzenplotz/gcli/releases/tag/${version}";
+    changelog = "https://github.com/herrhotzenplotz/gcli/releases/tag/v${version}";
     license = lib.licenses.bsd2;
     mainProgram = "gcli";
     maintainers = with lib.maintainers; [ kenran ];

pkgs/by-name/gc/gcx/package.nix

@@ -9,13 +9,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "gcx";
-  version = "0.4.2";
+  version = "0.4.3";
 
   src = fetchFromGitHub {
     owner = "grafana";
     repo = "gcx";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Gf05N13ZJLjB55eCcIfXIoJn3CVAAR5mcFyEq8s+RxY=";
+    hash = "sha256-nSopsew5QMOs/QyJg7TzALokZagIGCjxMCNsairB5PA=";
   };
 
   vendorHash = "sha256-JioNpEqGFxD6Gg84ZZ/9OrETxTGn2V+HMlGGiiZfeIo=";

pkgs/by-name/ge/genimage/package.nix

@@ -1,7 +1,7 @@
 {
   lib,
   stdenv,
-  fetchurl,
+  fetchFromGitHub,
   autoreconfHook,
   pkg-config,
   libconfuse,
@@ -10,11 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "genimage";
-  version = "19";
+  version = "20";
 
-  src = fetchurl {
-    url = "https://public.pengutronix.de/software/genimage/genimage-${finalAttrs.version}.tar.xz";
-    sha256 = "sha256-fsT8uGVmKosv8gKEgZBE/6hBN788oW+3SXASkbwB8Qg=";
+  src = fetchFromGitHub {
+    owner = "pengutronix";
+    repo = "genimage";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-6pKqvpoEQWebubl6K5FzEAv2aUsBXgOBEAdcCwARkrU=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/gi/gilt-rs/package.nix

@@ -0,0 +1,28 @@
+{
+  lib,
+  fetchFromGitHub,
+  rustPlatform,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "gilt-rs";
+  version = "0.3.6";
+
+  src = fetchFromGitHub {
+    owner = "simonhollingshead";
+    repo = "gilt-rs";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-rW5uHRqGq8CBl+4eZo/1W0T7km+mRI2oFN0FU30To8Q=";
+  };
+
+  cargoHash = "sha256-oVHNBg6umFsPWBVIZEMBc6AB1SFqHMAxwuTa3cIyKjE=";
+
+  __structuredAttrs = true;
+
+  meta = {
+    description = "Tool for calculating which UK Gilt will give the best return if held to maturity";
+    homepage = "https://github.com/simonhollingshead/gilt-rs";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ ambroisie ];
+  };
+})

pkgs/by-name/go/go-avahi-cname/package.nix

@@ -0,0 +1,43 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  nix-update-script,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "go-avahi-cname";
+  version = "2.6.1";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "grishy";
+    repo = "go-avahi-cname";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-MeEytTRZF5zpfWYNzvqiMdjvf6IJpS1t5V7+D08GjAY=";
+  };
+
+  vendorHash = "sha256-vbIHB9u9Ftwdw7rHnj6rkk/ABmESNvOgp0hixeWVnkI=";
+
+  ldflags = [
+    "-w"
+    "-s"
+    "-X=main.version=${finalAttrs.version}"
+    "-X=main.commit=${finalAttrs.src.rev}"
+    "-X=main.date=1970-01-01T00:00:00Z"
+  ];
+
+  # bind: operation not permitted
+  __darwinAllowLocalNetworking = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Lightweight mDNS publisher of subdomains for your machine";
+    homepage = "https://github.com/grishy/go-avahi-cname";
+    changelog = "https://github.com/grishy/go-avahi-cname/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ sarahec ];
+    mainProgram = "go-avahi-cname";
+  };
+})

pkgs/by-name/go/go-ios/package.nix

@@ -7,33 +7,42 @@
   pkg-config,
   libusb1,
   iproute2,
-  net-tools,
 }:
 
 buildGoModule (finalAttrs: {
   pname = "go-ios";
-  version = "1.0.207";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "danielpaulus";
     repo = "go-ios";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-2GjUrt1F8MrPOITCsuWHHsi/85pfzbLeY+WbPfLYDY4=";
+    sha256 = "sha256-5fMsHSwJUH/JBaZXyB11rHCNOqzHF3MYI9gg29hj0O4=";
   };
 
   proxyVendor = true;
-  vendorHash = "sha256-/aVaTC9lfoXQvhDVQm31HmXBnDYYOv6RH69Nm3I/K7s=";
+  vendorHash = "sha256-Bl9nlRnclqVgFF6mS6DX6oS+1c26DoISqDBY2rMS2yw=";
 
   excludedPackages = [
     "restapi"
+    "test/e2e"
   ];
 
-  postPatch = lib.optionalString stdenv.hostPlatform.isLinux ''
+  ldflags = [
+    "-X main.version=${finalAttrs.version}"
+  ];
+
+  postPatch = ''
+    substituteInPlace main.go \
+      --replace-fail 'const version = ' 'var version = '
+  ''
+  + lib.optionalString stdenv.hostPlatform.isLinux ''
     substituteInPlace ncm/linux_commands.go \
       --replace-fail "ip " "${lib.getExe' iproute2 "ip"} "
-
-    substituteInPlace ios/tunnel/tunnel.go \
-      --replace-fail "ifconfig" "${lib.getExe' net-tools "ifconfig"}"
+  ''
+  + lib.optionalString stdenv.hostPlatform.isDarwin ''
+    substituteInPlace ios/tunnel/tunnel_darwin.go \
+      --replace-fail "ifconfig" "/sbin/ifconfig"
   '';
 
   nativeBuildInputs = [

pkgs/by-name/go/go-mockery/package.nix

@@ -28,7 +28,7 @@ buildGoModule (finalAttrs: {
     "-X github.com/vektra/mockery/v${lib.versions.major finalAttrs.version}/internal/logging.SemVer=v${finalAttrs.version}"
   ];
 
-  env.CGO_ENABLED = false;
+  env.CGO_ENABLED = 0;
 
   subPackages = [ "." ];
 

pkgs/by-name/go/go-mockery_2/package.nix

@@ -30,7 +30,7 @@ buildGoModule (finalAttrs: {
     "-X github.com/vektra/mockery/v${lib.versions.major finalAttrs.version}/pkg/logging.SemVer=v${finalAttrs.version}"
   ];
 
-  env.CGO_ENABLED = false;
+  env.CGO_ENABLED = 0;
 
   subPackages = [ "." ];
 

pkgs/by-name/go/goda/package.nix

@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "goda";
-  version = "0.9.3";
+  version = "0.9.4";
 
   src = fetchFromGitHub {
     owner = "loov";
     repo = "goda";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-tUt/VxO3QLqPuHleFSO7txiHZ1bJ7ohGak09ZIr/62A=";
+    hash = "sha256-ARiI5varW7p7eX58N8mtS6yeXeTlZfiiTFgI8pcDD6M=";
   };
 
-  vendorHash = "sha256-ZDiDAabLUGa/NFs2EQpwWAd8ypxUZ32I8AOeYCm/ntA=";
+  vendorHash = "sha256-jtri/73UnpI5oyykW2DYiH0vra62+jk8VIHhcWT2oJA=";
 
   passthru.updateScript = nix-update-script { };
 

pkgs/by-name/go/google-chrome/package.nix

@@ -179,11 +179,11 @@ let
 
   linux = stdenvNoCC.mkDerivation (finalAttrs: {
     inherit pname meta passthru;
-    version = "150.0.7871.46";
+    version = "150.0.7871.100";
 
     src = fetchurl {
       url = "https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-stable/google-chrome-stable_${finalAttrs.version}-1_amd64.deb";
-      hash = "sha256-abQBOftzoCGnSfMvzeCFP7F4G286izyvFzrY9nR/qnw=";
+      hash = "sha256-SbV/ACzm31CA1fglQtxc8RdBuTeal/HXXXtUFa0IYHk=";
     };
 
     # With strictDeps on, some shebangs were not being patched correctly
@@ -289,11 +289,11 @@ let
 
   darwin = stdenvNoCC.mkDerivation (finalAttrs: {
     inherit pname meta passthru;
-    version = "150.0.7871.47";
+    version = "150.0.7871.101";
 
     src = fetchurl {
-      url = "http://dl.google.com/release2/chrome/ad2pojsfcj6hr5telal5kk4t6gua_150.0.7871.47/GoogleChrome-150.0.7871.47.dmg";
-      hash = "sha256-1VTMVSBLfSRp9CxPaRkmdgAC0H5KNuZNWywTGLSphUI=";
+      url = "http://dl.google.com/release2/chrome/fwvlzsetnpzv5sb7rdxd5a6nke_150.0.7871.101/GoogleChrome-150.0.7871.101.dmg";
+      hash = "sha256-cumG2dMFXZuYCWWdIn6iJT0Bd24hauVMfXZzbDFVvuU=";
     };
 
     dontPatch = true;

pkgs/by-name/go/gotosocial/package.nix

@@ -11,13 +11,13 @@
 }:
 buildGo125Module (finalAttrs: {
   pname = "gotosocial";
-  version = "0.21.3";
+  version = "0.22.0";
 
   src = fetchFromCodeberg {
     owner = "superseriousbusiness";
     repo = "gotosocial";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-gemi9t4wTjmCHEXfdXz1X9Q4gcvj/3LMtlrO5UpQ19M=";
+    hash = "sha256-rslzi9WqPqN/wm9PN6SWdXtLdMRJJV6Hhb3whJ0RicU=";
   };
 
   vendorHash = null;
@@ -63,6 +63,9 @@ buildGo125Module (finalAttrs: {
   '';
 
   postInstall = ''
+    # remove a Go codegen helper binary
+    rm $out/bin/gen
+
     mkdir -p $out/share/gotosocial/web
     mv web/{assets,template} $out/share/gotosocial/web
   '';

pkgs/by-name/gr/graphite/package.nix

@@ -29,12 +29,12 @@
 }:
 
 let
-  version = "0-unstable-2026-06-23";
-  rev = "ebbbb6bd1b0add39969717d18563808cc6306a63";
+  version = "0-unstable-2026-07-01";
+  rev = "95c1ab81f31f318a9e344d1d229feacff861ad39";
 
-  srcHash = "sha256-8k30s/czdJ5uNHH75K4+XJo6Ncd1GA3NSlaa7yO4+mg=";
+  srcHash = "sha256-0GNoGD0S3YrHAaJ/aPNyVG6SfFi1h1NyTR1xmvd5+DQ=";
   shaderHash = "sha256-4lKBrGh1rfhTBczmCDvIF2KxLyEHzHdKVGgQ+jLd/Dw=";
-  cargoHash = "sha256-gpv4LZHEWKonQodW/uzdoAfkaxSRuCMKyX1SSit/gEQ=";
+  cargoHash = "sha256-1KZsh4M+ijd5LcoELzW9sGsuC+91XBamimvw0AXIgNU=";
   npmHash = "sha256-Rb0bLPk54QigNp7TkDkJJy/TEJXAhlXOCruckwvdXks=";
 
   brandingRev = "0d004aa61e6b48d316e8e5db6d59ccc4788f192d";