python3Packages.schwifty: 2026.01.0 -> 2026.07.0 (#538909)

https://github.com/home-assistant-libs/modbus-connection/releases/tag/3.4.0
https://github.com/home-assistant-libs/modbus-connection/releases/tag/3.4.1

doc/release-notes/rl-2611.section.md

@@ -31,13 +31,13 @@
   By the time of this release, Homebrew will offer only limited [Tier 3](https://docs.brew.sh/Support-Tiers#tier-3) support for the platform, but MacPorts will likely continue to support it for a long time.
   We also recommend users consider installing NixOS, which should continue to run on essentially all Intel Macs, especially after Apple stops security support for macOS 26 in 2028.
 
-- `bundlerApp` now sets `__structuredAttrs = true` for its result package.
-  Out-of-tree packages passing `postBuild` to `bundlerApp` should examine if their `postBuild` commands are compatible with structured attributes.
-
 - `databricks-cli` has been updated from `0.290.2` to `1.x.x`, the first major release. OAuth tokens for interactive logins (`auth_type = databricks-cli`) are now stored in the OS-native secure store by default (Secret Service on Linux) instead of `~/.databricks/token-cache.json`; cached tokens from older versions are not migrated, so run `databricks auth login` once per profile after upgrading. To keep the previous file-backed storage, set `DATABRICKS_AUTH_STORAGE=plaintext` or add `auth_storage = plaintext` under `[__settings__]` in `~/.databrickscfg`. Additionally, the `vector_search_endpoints` DABs resource renamed `min_qps` to `target_qps` (and the `vector-search-endpoints` command renamed `--min-qps` to `--target-qps`). See the [upstream changelog](https://github.com/databricks/cli/blob/main/CHANGELOG.md) for details.
 
 - `hurl` has been updated to `8.x.x` which has some breaking changes. See [upstream changelog](https://github.com/Orange-OpenSource/hurl/releases/tag/8.0.0) for details.
 
+- `gotosocial` has been updated to 0.22.0. This release contains a very long database migration, which should not be cancelled or interrupted under any circumstances.
+ -  Postgres users: Following the migration, if you encounter slowdown on Postgres specifically (ie., timing out while loading timelines) you may need to run some manual database maintenance steps. Please check https://docs.gotosocial.org/en/stable/admin/database_maintenance/#postgres.
+
 - `xsecurelock` no longer supports authentication via htaccess files (`~/.xsecurelock.pw`) or via the `pamtester` program by default. Only the recommended PAM module is supported unless rebuilt with `withHtaccess` or `withPamtester`.
 
 - `python3Packages.django-health-check` has been updated to major version 4. See its [migration guide](https://codingjoe.dev/django-health-check/migrate-to-v4/) and [changelog](https://github.com/codingjoe/django-health-check/releases/tag/4.0.0) for breaking changes.

nixos/doc/manual/release-notes/rl-2611.section.md

@@ -48,6 +48,8 @@
 
 - [Matrix Authentication Service](https://github.com/element-hq/matrix-authentication-service) is an OAuth2.0 and OpenID Connect provider for Matrix homeservers (such as Synapse). It replaces standard password authentication with modern OpenID Connect flows, and can delegate authentication to upstream OIDC providers. Available as [services.matrix-authentication-service](#opt-services.matrix-authentication-service.enable).
 
+- [stash-clipboard](https://github.com/NotAShelf/stash), a Wayland clipboard "manager" with fast persistent history and multi-media support. Available as [services.stash-clipboard](#opt-services.stash-clipboard.enable).
+
 ## Backward Incompatibilities {#sec-release-26.11-incompatibilities}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->

nixos/modules/module-list.nix

@@ -982,6 +982,7 @@
   ./services/misc/spice-webdavd.nix
   ./services/misc/spoolman.nix
   ./services/misc/sssd.nix
+  ./services/misc/stash-clipboard.nix
   ./services/misc/subsonic.nix
   ./services/misc/sundtek.nix
   ./services/misc/svnserve.nix

nixos/modules/services/misc/stash-clipboard.nix

@@ -0,0 +1,73 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.stash-clipboard;
+  inherit (lib)
+    mkPackageOption
+    mkEnableOption
+    mkOption
+    types
+    mkIf
+    getExe
+    concatStringsSep
+    ;
+in
+{
+  options.services.stash-clipboard = {
+    enable = mkEnableOption "stash, a Wayland clipboard manager";
+
+    package = mkPackageOption pkgs [ "stash-clipboard" ] { };
+
+    arguments = mkOption {
+      type = types.listOf types.str;
+      default = [ ];
+      example = [ "--max-items 10" ];
+      description = "A list of arguments to pass to stash watch.";
+    };
+
+    filterFile = mkOption {
+      type = types.str;
+      default = "";
+      example = "/etc/stash/clipboard_filter";
+      description = ''
+        Stash can be configured to avoid storing clipboard entries that match a sensitive pattern, using a regular expression.
+        The file set here should contain your regex pattern (no quotes).
+
+        Example regex to block common password patterns:
+        - (password|secret|api[_-]?key|token)[=: ]+[^\s]+
+      '';
+    };
+
+    excludedApps = mkOption {
+      type = types.listOf types.str;
+      default = [ ];
+      example = [ "Bitwarden" ];
+      description = ''
+        List of application classes to exclude from the database.
+        Entries from these apps are still copied to the clipboard, but it will never be put inside the database.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    environment.systemPackages = [ cfg.package ];
+    systemd = {
+      user.services.stash-clipboard = {
+        description = "Stash clipboard manager daemon";
+        wantedBy = [ "graphical-session.target" ];
+        after = [ "graphical-session.target" ];
+        serviceConfig = {
+          ExecStart = "${getExe cfg.package} ${concatStringsSep " " cfg.arguments} watch";
+          LoadCredential = mkIf (cfg.filterFile != "") "clipboard_filter:${cfg.filterFile}";
+        };
+        environment = mkIf (cfg.excludedApps != [ ]) {
+          STASH_EXCLUDED_APPS = concatStringsSep "," cfg.excludedApps;
+        };
+      };
+    };
+  };
+}

nixos/tests/web-apps/gotosocial.nix

@@ -3,7 +3,7 @@
   name = "gotosocial";
   meta.maintainers = with lib.maintainers; [ blakesmith ];
 
-  nodes.machine =
+  containers.machine =
     { pkgs, ... }:
     {
       environment.systemPackages = [ pkgs.jq ];

pkgs/build-support/build-typst-package.nix

@@ -40,9 +40,6 @@ lib.extendMkDerivation {
     {
       name = "typst-package-${finalAttrs.pname}-${finalAttrs.version}";
 
-      strictDeps = true;
-      __structuredAttrs = true;
-
       dontBuild = true;
 
       installPhase =

pkgs/build-support/go/module.nix

@@ -320,15 +320,10 @@ lib.extendMkDerivation {
               }
 
               getGoDirs() {
-                local -r type="$1"
-
-                # Support strucuredAttrs, they are not space seperated
-                local -a subPackagesArray
-                concatTo subPackagesArray subPackages
-
-                # Outputs each element prefixed with './' if the array is not empty
-                if [[ ''${#subPackagesArray[@]} -gt 0 ]]; then
-                  echo "''${subPackagesArray[*]/#/./}"
+                local type;
+                type="$1"
+                if [ -n "$subPackages" ]; then
+                  echo "$subPackages" | sed "s,\(^\| \),\1./,g"
                 else
                   find . -type f -name \*$type.go -exec dirname {} \; | grep -v "/vendor/" | sort --unique | grep -v "$exclude"
                 fi

pkgs/build-support/setup-hooks/make-wrapper.sh

@@ -3,8 +3,6 @@
 # assertExecutable FILE
 assertExecutable() {
     local file="$1"
-    [[ -e "$file" ]] || \
-        die "Cannot wrap '$file' because it does not exist"
     [[ -f "$file" && -x "$file" ]] || \
         die "Cannot wrap '$file' because it is not an executable file"
 }

pkgs/by-name/al/alsa-lib/package.nix

@@ -10,11 +10,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "alsa-lib";
-  version = "1.2.16.1";
+  version = "1.2.16";
 
   src = fetchurl {
     url = "mirror://alsa/lib/alsa-lib-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-90Dbf0iCVZRP/UQoQW7jOQqWdChWkWQz30aMKBQ2SA4=";
+    hash = "sha256-EiseMWbVX+GbzeZWU116NvKrEOZscsatL0PyD/3tCpY=";
   };
 
   patches = [
@@ -46,7 +46,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     homepage = "http://www.alsa-project.org/";
-    changelog = "https://github.com/alsa-project/alsa-lib/releases/tag/v${finalAttrs.version}";
     description = "ALSA, the Advanced Linux Sound Architecture libraries";
     mainProgram = "aserver";
 

pkgs/by-name/al/alsa-ucm-conf/package.nix

@@ -9,11 +9,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "alsa-ucm-conf";
-  version = "1.2.16.1";
+  version = "1.2.16";
 
   src = fetchurl {
     url = "mirror://alsa/lib/alsa-ucm-conf-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-zz0cB+CJqDxOziwg8F3WqKq3/NEIdow4gROGiAV1SSs=";
+    hash = "sha256-rLyXLW5x7fo0Xnav3xDDmf0PHzz5DYSv20z1G/xKZUg=";
   };
 
   patches = [
@@ -47,7 +47,6 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
   meta = {
     homepage = "https://www.alsa-project.org/";
-    changelog = "https://github.com/alsa-project/alsa-ucm-conf/releases/tag/v${finalAttrs.version}";
     description = "ALSA Use Case Manager configuration";
 
     longDescription = ''

pkgs/by-name/al/alsa-utils/package.nix

@@ -85,7 +85,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     homepage = "http://www.alsa-project.org/";
-    changelog = "https://github.com/alsa-project/alsa-utils/releases/tag/v${finalAttrs.version}";
     description = "ALSA, the Advanced Linux Sound Architecture utils";
     longDescription = ''
       The Advanced Linux Sound Architecture (ALSA) provides audio and

pkgs/by-name/ap/apparmor-parser/package.nix

@@ -37,6 +37,15 @@ stdenv.mkDerivation (finalAttrs: {
       --replace-fail "/usr/include/linux/capability.h" "${linuxHeaders}/include/linux/capability.h"
   '';
 
+  patches = [
+    (fetchpatch {
+      # https://gitlab.com/apparmor/apparmor/-/merge_requests/2133
+      # Patches generated yacc parser code to compile with format-security
+      url = "https://gitlab.com/apparmor/apparmor/-/commit/6bdec74d5e74660b97e00b4b8fafc014b05907b7.diff";
+      hash = "sha256-7c5EFByrGIDj2lc31bRttyeybwndDm4iS4qdPMVaG/I=";
+    })
+  ];
+
   nativeBuildInputs = [
     bison
     flex

pkgs/by-name/ar/arti/package.nix

@@ -3,7 +3,6 @@
   stdenv,
   rustPlatform,
   fetchFromGitLab,
-  fetchpatch,
   pkg-config,
   sqlite,
   openssl,
@@ -14,7 +13,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "arti";
-  version = "2.4.0";
+  version = "2.5.0";
 
   src = fetchFromGitLab {
     domain = "gitlab.torproject.org";
@@ -22,29 +21,18 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "core";
     repo = "arti";
     tag = "arti-v${finalAttrs.version}";
-    hash = "sha256-YLOdrHstmN2pLl75uclkbpN5h3iBs3xpraZ8XN6R/+Q=";
+    hash = "sha256-jOCFXlBI2xAzgpb7Fa8ap53SpDF6kcRGYnBXcu3vpk4=";
   };
 
-  patches = [
-    # Fixes a panic that could allow malicious directory caches to crash
-    # clients.
-    # https://gitlab.torproject.org/tpo/core/arti/-/merge_requests/4062
-    (fetchpatch {
-      name = "TROVE-2026-024.patch";
-      url = "https://gitlab.torproject.org/tpo/core/arti/-/commit/f69be8c70561629e63004788f0aa4bf898025f93.patch";
-      hash = "sha256-P0sXTKOBW7ulqQZwmTVJfrpLksLyaonuDpxGF2keDqE=";
-    })
-  ];
-
   # Working around a bug in cargo that appears with cargo-auditable, see
   # https://github.com/rust-secure-code/cargo-auditable/issues/124.
   postPatch = ''
     substituteInPlace crates/arti/Cargo.toml \
-      --replace-fail '"tor-rpcbase"' '"dep:tor-rpcbase"'
+      --replace-fail '"tokio-util"' '"dep:tokio-util"'
   '';
 
   buildAndTestSubdir = "crates/arti";
-  cargoHash = "sha256-7X3JJbt0/jxaMvBR3XQvguR7tqd96kiqX66G2byvPjM=";
+  cargoHash = "sha256-JK6ubp697jZ98ErNrZdFe0mXIez3lUZ5SmAHkyD97WQ=";
 
   nativeBuildInputs = lib.optionals stdenv.hostPlatform.isLinux [ pkg-config ];
 

pkgs/by-name/au/auto-patchelf/source/auto-patchelf.py

@@ -1,7 +1,6 @@
 #!/usr/bin/env python3
 
 import argparse
-import errno
 import os
 import pprint
 import subprocess
@@ -196,12 +195,6 @@ def populate_cache(initial: list[Path], recursive: bool =False) -> None:
             except ELFError:
                 # Not an ELF file in the right format
                 pass
-            except OSError as e:
-                if e.errno == errno.EINVAL:
-                    # pyelftools can raise EINVAL for certain compressed sections.
-                    pass
-                else:
-                    raise
 
 
 def find_dependency(soname: str, soarch: str, soabi: str) -> Optional[Path]:
@@ -350,10 +343,6 @@ def auto_patchelf_file(logger: Logger, path: Path, runtime_deps: list[Path], app
 
     except ELFError:
         return []
-    except OSError as e:
-        if e.errno == errno.EINVAL:
-            return []
-        raise
 
     # these platforms are packaged in nixpkgs with ld.so in a separate derivation
     # than libc.so and friends. keep_libc is mandatory.

pkgs/by-name/ba/bash-completion/package.nix

@@ -11,7 +11,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "bash-completion";
-  version = "2.18.0";
+  version = "2.17.0";
 
   # Using fetchurl because fetchGithub or fetchzip will have trouble on
   # e.g. APFS filesystems (macOS) because of non UTF-8 characters in some of the
@@ -19,7 +19,7 @@ stdenv.mkDerivation (finalAttrs: {
   # See discussion in https://github.com/NixOS/nixpkgs/issues/107768
   src = fetchurl {
     url = "https://github.com/scop/bash-completion/releases/download/${finalAttrs.version}/bash-completion-${finalAttrs.version}.tar.xz";
-    hash = "sha256-iLz4UST3f3Ty8vi80WrEOC2AeoJ+3nQqZJQMcRauoz8=";
+    hash = "sha256-3Z2CXklkNfs766Oue+qfd+gh6JRmfQdDHR1MjFcLnlg=";
   };
 
   postPatch = ''

pkgs/by-name/bi/bitwig-studio6/package.nix

@@ -38,12 +38,12 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "bitwig-studio6";
-  version = "6.0.6";
+  version = "6.0.11";
 
   src = fetchurl {
     name = "bitwig-studio-${finalAttrs.version}.deb";
     url = "https://www.bitwig.com/dl/Bitwig%20Studio/${finalAttrs.version}/installer_linux";
-    hash = "sha256-tczgtA4v3a5Qjxaa6ZvaiFDWD6dhRw19vj8IMxkyCNI=";
+    hash = "sha256-rnr/Z8y6klKrU2gT5/XT+sRryl/HZZZ04n565L0HPEw=";
   };
 
   strictDeps = true;

pkgs/by-name/bl/blink-qt/fix-none-account.patch

@@ -0,0 +1,25 @@
+From 6e438d1ab9f9da5e55b0cc96ea81fbac1f1a871b Mon Sep 17 00:00:00 2001
+From: phanirithvij <phanirithvij2000@gmail.com>
+Date: Sun, 5 Jul 2026 19:40:36 +0530
+Subject: [PATCH] fix: handle None default_account on startup
+
+---
+ blink/mainwindow.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/blink/mainwindow.py b/blink/mainwindow.py
+index d0baa21..77c67e8 100644
+--- a/blink/mainwindow.py
++++ b/blink/mainwindow.py
+@@ -1109,7 +1109,7 @@ class MainWindow(base_class, ui_class):
+ 
+     def _NH_SIPAccountManagerDidStart(self, notification):
+         account = notification.sender.default_account
+-        if account is not BonjourAccount() and account.sms.enable_pgp and account.sms.private_key is not None and os.path.exists(account.sms.private_key.normalized):
++        if account is not None and account is not BonjourAccount() and account.sms.enable_pgp and account.sms.private_key is not None and os.path.exists(account.sms.private_key.normalized):
+             self.export_pgp_key_action.setEnabled(True)
+ 
+     def _NH_SIPAccountManagerDidRemoveAccount(self, notification):
+-- 
+2.54.0
+

pkgs/by-name/bl/blink-qt/package.nix

@@ -5,26 +5,24 @@
   python3Packages,
   qt6Packages,
   libvncserver,
+  stdenv,
 }:
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "blink-qt";
-  version = "6.0.4";
+  version = "6.0.6";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "AGProjects";
     repo = "blink-qt";
     tag = finalAttrs.version;
-    hash = "sha256-QESg9yo5oddYqSKuFLSMI2Oju3FCq97+j0uJDK85Yy8=";
+    hash = "sha256-0hsuAYYp7KvfxErAcN4EX8G3goirGRmpijJfAMvbZJQ=";
   };
 
   patches = [
-    # Remove when version > 6.0.4
-    (fetchpatch2 {
-      url = "https://github.com/AGProjects/blink-qt/commit/45343c90ae0680a3d03589fa8a12ac1eb85a6925.patch";
-      hash = "sha256-XwV5L3r0IqWkhlaJypS2cHkDCcoumOgEEqDpdcaTviE=";
-    })
+    # Remove once https://github.com/AGProjects/blink-qt/pull/7 is mereged and tagged
+    ./fix-none-account.patch
   ];
 
   nativeBuildInputs = [ qt6Packages.wrapQtAppsHook ];
@@ -40,26 +38,31 @@ python3Packages.buildPythonApplication (finalAttrs: {
     qt6Packages.qtsvg
   ];
 
-  dependencies = with python3Packages; [
-    dateutils
-    dnspython
-    google-api-python-client
-    lxml
-    lxml-html-clean
-    msrplib
-    oauth2client
-    otr
-    pgpy
-    pyqt6
-    pyqt6-webengine
-    python3-application
-    python3-eventlib
-    python3-gnutls
-    python3-sipsimple
-    sqlobject
-    standard-imghdr
-    xcaplib
-  ];
+  dependencies =
+    with python3Packages;
+    [
+      dateutils
+      dnspython
+      google-auth-oauthlib
+      google-api-python-client
+      lxml
+      lxml-html-clean
+      msrplib
+      otr
+      pgpy
+      pyqt6
+      pyqt6-webengine
+      python3-application
+      python3-eventlib
+      python3-gnutls
+      python3-sipsimple
+      sqlobject
+      standard-imghdr
+      xcaplib
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      numpy
+    ];
 
   dontWrapQtApps = true;
 

pkgs/by-name/br/brave/package.nix

@@ -3,24 +3,24 @@
 
 let
   pname = "brave";
-  version = "1.91.180";
+  version = "1.92.134";
 
   allArchives = {
     aarch64-linux = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_arm64.deb";
-      hash = "sha256-HdmJBLANsmlBi3EtzeuMn4USmW8x/LaYKUWDlqw3a2I=";
+      hash = "sha256-qo40t+PGl1RO2ajJ2Hev4G1FWvzTx7Ak5CVxjdxabLI=";
     };
     x86_64-linux = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-      hash = "sha256-mM2SOn6V1KQJEjxR0KH1lXJMLSzpx/IiZDeSrJtIFt0=";
+      hash = "sha256-T3A/ejmLkIRYGWc8GXQmvIAZvQFwYEyhQJxssNDalhQ=";
     };
     aarch64-darwin = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-v${version}-darwin-arm64.zip";
-      hash = "sha256-WkBudj8I0/pIzhA4fynkfY4t6M/6d1zPTZPSQeX3d5Y=";
+      hash = "sha256-K1p5mAYfEDJNZFSmoOQV7kHNsA5RQuyUl3T2KVsNcbw=";
     };
     x86_64-darwin = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-v${version}-darwin-x64.zip";
-      hash = "sha256-mxKhtUiLoloUvYK0hv1WHpVytadHPLGN8IePrscxWxs=";
+      hash = "sha256-IrhvRVFZGLoGSVNy10ppFL9rEy7MRTb/HIhzspDsrs8=";
     };
   };
 

pkgs/by-name/c-/c-ares/package.nix

@@ -18,7 +18,7 @@
 
 stdenv.mkDerivation rec {
   pname = "c-ares";
-  version = "1.34.8";
+  version = "1.34.6";
 
   strictDeps = true;
   __structuredAttrs = true;
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
   src = fetchurl {
     # Note: tag name varies in some versions, e.g. v1.30.0, c-ares-1_17_0.
     url = "https://github.com/c-ares/c-ares/releases/download/v${version}/c-ares-${version}.tar.gz";
-    hash = "sha256-wiK21oEJb5RE0sSGPSwRdAGeJ8rMoKSlwRTTbdfXv3g=";
+    hash = "sha256-kS3XzDs+innFL9f7nA9Ozwqqc+Re/aiAJmotbia4TvU=";
   };
 
   outputs = [

pkgs/by-name/ca/cargo-auditable/builder.nix

@@ -42,9 +42,20 @@ lib.extendMkDerivation {
         # https://github.com/rust-secure-code/cargo-auditable/issues/235
         "--skip=test_proc_macro"
         "--skip=test_self_hosting"
-        # Expects `linker = "rust-lld"` to work.
-        "--skip=test_bare_linker"
-      ];
+      ]
+      # TODO: Clean up on `staging`.
+      ++
+        lib.optionals
+          (
+            stdenv.hostPlatform.isMusl
+            || stdenv.hostPlatform.isAarch32
+            || stdenv.hostPlatform.isDarwin
+            || stdenv.hostPlatform.isMsvc
+          )
+          [
+            # Expects `linker = "rust-lld"` to work.
+            "--skip=test_bare_linker"
+          ];
 
       postInstall = ''
         installManPage cargo-auditable/cargo-auditable.1

pkgs/by-name/ch/chainsaw/package.nix

@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "chainsaw";
-  version = "2.16.0";
+  version = "2.16.2";
 
   src = fetchFromGitHub {
     owner = "WithSecureLabs";
     repo = "chainsaw";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ywHPDVHpw0TrzeWPzZ3cvQSxCr2Di2YjS0Not1B9vlg=";
+    hash = "sha256-EKL2MTo5qirpY4TCWwBptpRWJRd6Yp/dLz/5sIsdsbg=";
   };
 
-  cargoHash = "sha256-AA8JQiGukh4SRZyciuE2u4OUo7HNeb6+SWej9vlw5z8=";
+  cargoHash = "sha256-bbgRqp3bNw2U69aVqwvJNWOKgW0YhR8SlqzH9jdrHZU=";
 
   ldflags = [
     "-w"

pkgs/by-name/ci/cinny-desktop/package.nix

@@ -20,35 +20,30 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cinny-desktop";
-  # We have to be using the same version as cinny-web or this isn't going to work.
-  version = "4.12.2";
+  version = "4.12.5";
 
   src = fetchFromGitHub {
     owner = "cinnyapp";
     repo = "cinny-desktop";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-gaTgNTn0/HHzULHRL03+t73MEUOGdqcEyqaIt8CWA0k=";
+    hash = "sha256-/A/O42jwwK2iDV1IdRjOO8fE/AZ0h7UWAZZLozOqUWs=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/src-tauri";
 
-  cargoHash = "sha256-x7rpnhTz454Ftolu4x50NSGKdg8NfenUwdhPY4a+lbA=";
+  cargoHash = "sha256-EF8gpfeZasazq0NKrjItt4bkgautQjYjEegf1OlWLOw=";
 
   postPatch =
     let
-      cinny' =
-        assert lib.assertMsg (
-          cinny.version == finalAttrs.version
-        ) "cinny.version (${cinny.version}) != cinny-desktop.version (${finalAttrs.version})";
-        cinny.override {
-          conf = {
-            hashRouter.enabled = true;
-          };
+      cinny' = cinny.override {
+        conf = {
+          hashRouter.enabled = true;
         };
+      };
     in
     ''
       ${lib.getExe jq} \
-        'del(.plugins.tauri.updater) | .build.frontendDist = "${cinny'}" | del(.build.beforeBuildCommand) | .bundle.createUpdaterArtifacts = false' tauri.conf.json \
+        '.build.frontendDist = "${cinny'}" | del(.build.beforeBuildCommand) | .bundle.createUpdaterArtifacts = false' tauri.conf.json \
         | ${lib.getExe' moreutils "sponge"} tauri.conf.json
     '';
 
@@ -82,6 +77,9 @@ rustPlatform.buildRustPackage (finalAttrs: {
     webkitgtk_4_1
   ];
 
+  buildNoDefaultFeatures = true;
+  buildFeatures = [ "custom-protocol" ];
+
   passthru = {
     updateScript = _experimental-update-script-combinators.sequence [
       (nix-update-script { attrPath = "cinny-unwrapped"; })

pkgs/by-name/ci/cinny-unwrapped/package.nix

@@ -7,17 +7,17 @@
 buildNpmPackage (finalAttrs: {
   pname = "cinny-unwrapped";
   # Remember to update cinny-desktop when bumping this version.
-  version = "4.12.2";
+  version = "4.12.3";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "cinnyapp";
     repo = "cinny";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-UF5MwV02G0oYIXtvyzHn+DifYM8PFlyb9DZ4w1fuyDE=";
+    hash = "sha256-RjPdq9xNvUbJESV7CqxmgfqAx+MoKZbhUtJNTcH9aUk=";
   };
 
-  npmDepsHash = "sha256-8SyUFv1wgnqfSyBlykmeGI8RAmFt5Q5uS6OFLi+qPPY=";
+  npmDepsHash = "sha256-CU8AVRuMFOGI0/LbN0LGysBk+qc2XQYxQGfrrH72stc=";
 
   # Skip rebuilding native modules since they're not needed for the web app
   npmRebuildFlags = [

pkgs/by-name/cm/cmake/darwin-binary-paths.patch

@@ -46,3 +46,16 @@ index 15a1e2c0c3..33bb304cf7 100644
          OUTPUT_VARIABLE OSX_VERSION
          OUTPUT_STRIP_TRAILING_WHITESPACE
          )
+diff --git a/Utilities/cmcurl/CMakeLists.txt b/Utilities/cmcurl/CMakeLists.txt
+index ddc975c202..8ff651fd90 100644
+--- a/Utilities/cmcurl/CMakeLists.txt
++++ b/Utilities/cmcurl/CMakeLists.txt
+@@ -127,7 +127,7 @@
+     set(OSX_VERSION ${CMAKE_OSX_DEPLOYMENT_TARGET})
+   else()
+     execute_process(
+-      COMMAND sw_vers -productVersion
++      COMMAND @sw_vers@ -productVersion
+       OUTPUT_VARIABLE OSX_VERSION
+       OUTPUT_STRIP_TRAILING_WHITESPACE
+       )

pkgs/by-name/cm/cmake/darwin-bsd-binary-paths.patch

@@ -39,13 +39,13 @@ index 260b6631c0..ffb8fcd8d2 100644
      if(ProcessorCount_cmd_sysctl)
        execute_process(COMMAND ${ProcessorCount_cmd_sysctl} -n hw.ncpu
 diff --git a/Source/kwsys/ProcessUNIX.c b/Source/kwsys/ProcessUNIX.c
-index 8c22b4e43a..6d9ccef5e7 100644
+index a918b8d9a7..36145707e1 100644
 --- a/Source/kwsys/ProcessUNIX.c
 +++ b/Source/kwsys/ProcessUNIX.c
-@@ -2503,7 +2503,7 @@ static pid_t kwsysProcessFork(kwsysProcess* cp,
+@@ -2503,7 +2503,7 @@
+    have two integers to store: the pid and then the ppid.  */
  #if defined(__linux__) || defined(__APPLE__) || defined(__FreeBSD__) ||       \
-   defined(__NetBSD__) || defined(__OpenBSD__) || defined(__GLIBC__) ||        \
-   defined(__GNU__)
+   defined(__OpenBSD__) || defined(__GLIBC__) || defined(__GNU__)
 -#  define KWSYSPE_PS_COMMAND "ps axo pid,ppid"
 +#  define KWSYSPE_PS_COMMAND "@ps@ axo pid,ppid"
  #  define KWSYSPE_PS_FORMAT "%d %d\n"

pkgs/by-name/cm/cmake/package.nix

@@ -50,11 +50,11 @@ stdenv.mkDerivation (finalAttrs: {
     + lib.optionalString isMinimalBuild "-minimal"
     + lib.optionalString cursesUI "-cursesUI"
     + lib.optionalString qt5UI "-qt5UI";
-  version = "4.3.4";
+  version = "4.1.2";
 
   src = fetchurl {
     url = "https://cmake.org/files/v${lib.versions.majorMinor finalAttrs.version}/cmake-${finalAttrs.version}.tar.gz";
-    hash = "sha256-/e/4l7nrSddkU58rHtxut+FEDfMlZ4qXwZeEmekxrdo=";
+    hash = "sha256-ZD8EGCt7oyOrMfUm94UTT7ecujGIqFIgbvBHP+4oKhU=";
   };
 
   patches = [

pkgs/by-name/cm/cmake/remove-impure-search-paths.patch

@@ -157,10 +157,10 @@ index 2a2f478fd7..f22281bdca 100644
  list(REMOVE_DUPLICATES _CPACK_IFW_PATHS)
  
 diff --git a/Modules/FindBLAS.cmake b/Modules/FindBLAS.cmake
-index 9f986a78e7..5a6a9758ea 100644
+index b45a279b94..884ccc0e32 100644
 --- a/Modules/FindBLAS.cmake
 +++ b/Modules/FindBLAS.cmake
-@@ -1112,16 +1112,10 @@ if(BLA_VENDOR MATCHES "ACML" OR BLA_VENDOR STREQUAL "All")
+@@ -1098,16 +1098,8 @@
      ((BLA_VENDOR STREQUAL "ACML_GPU") AND (NOT BLAS_ACML_GPU_LIB_DIRS))
      )
    # try to find acml in "standard" paths
@@ -176,11 +176,9 @@ index 9f986a78e7..5a6a9758ea 100644
 -  endif()
 +  set(_ACML_ROOT)
 +  set(_ACML_GPU_ROOT)
-+  list(GET _ACML_ROOT 0 _ACML_ROOT)
-+  list(GET _ACML_GPU_ROOT 0 _ACML_GPU_ROOT)
+   list(GET _ACML_ROOT 0 _ACML_ROOT)
+   list(GET _ACML_GPU_ROOT 0 _ACML_GPU_ROOT)
    if(_ACML_ROOT)
-     list(GET _ACML_ROOT 0 _ACML_ROOT)
-     list(GET _ACML_GPU_ROOT 0 _ACML_GPU_ROOT)
 diff --git a/Modules/FindCUDA.cmake b/Modules/FindCUDA.cmake
 index bceb615ca0..2350b15655 100644
 --- a/Modules/FindCUDA.cmake
@@ -231,13 +229,26 @@ index bceb615ca0..2350b15655 100644
  
  # Example of how to find an include file from the CUDA_SDK_ROOT_DIR
 diff --git a/Modules/FindCUDAToolkit.cmake b/Modules/FindCUDAToolkit.cmake
-index df36f9a19b..825d1e7386 100644
+index b00cd26b7e..f5f74ebe1d 100644
 --- a/Modules/FindCUDAToolkit.cmake
 +++ b/Modules/FindCUDAToolkit.cmake
-@@ -830,18 +830,9 @@ else()
-     # We will also search the default symlink location /usr/local/cuda first since
-     # if CUDAToolkit_ROOT is not specified, it is assumed that the symlinked
-     # directory is the desired location.
+@@ -776,12 +776,6 @@
+       elseif(CUDAToolkit_ROOT_DIR AND EXISTS "${CUDAToolkit_ROOT_DIR}/${vf}")
+         set(${result_variable} "${CUDAToolkit_ROOT_DIR}/${vf}" PARENT_SCOPE)
+         break()
+-      elseif(CMAKE_SYSROOT_LINK AND EXISTS "${CMAKE_SYSROOT_LINK}/usr/lib/cuda/${vf}")
+-        set(${result_variable} "${CMAKE_SYSROOT_LINK}/usr/lib/cuda/${vf}" PARENT_SCOPE)
+-        break()
+-      elseif(EXISTS "${CMAKE_SYSROOT}/usr/lib/cuda/${vf}")
+-        set(${result_variable} "${CMAKE_SYSROOT}/usr/lib/cuda/${vf}" PARENT_SCOPE)
+-        break()
+       endif()
+     endforeach()
+   endfunction()
+@@ -864,18 +858,8 @@
+   # if CUDAToolkit_ROOT is not specified, it is assumed that the symlinked
+   # directory is the desired location.
+   if(NOT CUDAToolkit_ROOT_DIR)
 -    if(UNIX)
 -      if(NOT APPLE)
 -        set(platform_base "/usr/local/cuda-")
@@ -247,14 +258,14 @@ index df36f9a19b..825d1e7386 100644
 -    else()
 -      set(platform_base "C:\\Program Files\\NVIDIA GPU Computing Toolkit\\CUDA\\v")
 -    endif()
- 
+-
      # Build out a descending list of possible cuda installations, e.g.
 -    file(GLOB possible_paths "${platform_base}*")
 +    set(possible_paths)
      # Iterate the glob results and create a descending list.
      set(versions)
      foreach(p ${possible_paths})
-@@ -857,14 +848,6 @@ else()
+@@ -891,14 +875,6 @@
  
      # With a descending list of versions, populate possible paths to search.
      set(search_paths)
@@ -269,19 +280,6 @@ index df36f9a19b..825d1e7386 100644
  
      # Now search for the toolkit again using the platform default search paths.
      _CUDAToolkit_find_root_dir(SEARCH_PATHS "${search_paths}" FIND_FLAGS PATH_SUFFIXES bin)
-@@ -889,12 +872,6 @@ else()
-       elseif(CUDAToolkit_ROOT_DIR AND EXISTS "${CUDAToolkit_ROOT_DIR}/${vf}")
-         set(${result_variable} "${CUDAToolkit_ROOT_DIR}/${vf}" PARENT_SCOPE)
-         break()
--      elseif(CMAKE_SYSROOT_LINK AND EXISTS "${CMAKE_SYSROOT_LINK}/usr/lib/cuda/${vf}")
--        set(${result_variable} "${CMAKE_SYSROOT_LINK}/usr/lib/cuda/${vf}" PARENT_SCOPE)
--        break()
--      elseif(EXISTS "${CMAKE_SYSROOT}/usr/lib/cuda/${vf}")
--        set(${result_variable} "${CMAKE_SYSROOT}/usr/lib/cuda/${vf}" PARENT_SCOPE)
--        break()
-       endif()
-     endforeach()
-   endfunction()
 diff --git a/Modules/FindCoin3D.cmake b/Modules/FindCoin3D.cmake
 index 1d89c604e0..5b70e71a87 100644
 --- a/Modules/FindCoin3D.cmake
@@ -581,10 +579,10 @@ index 82156747d3..cc3f2a64af 100644
         "Ice-${Ice_VERSION_SLICE2CPP_FULL}/slice"
         "Ice-${Ice_VERSION_SLICE2CPP_SHORT}/slice"
 diff --git a/Modules/FindJNI.cmake b/Modules/FindJNI.cmake
-index a70b00f330..1962b55d4a 100644
+index 10dcc51776..e272bd9583 100644
 --- a/Modules/FindJNI.cmake
 +++ b/Modules/FindJNI.cmake
-@@ -367,57 +367,6 @@ if (WIN32)
+@@ -363,51 +363,6 @@
  endif()
  
  set(_JNI_JAVA_DIRECTORIES_BASE
@@ -606,11 +604,6 @@ index a70b00f330..1962b55d4a 100644
 -  # Arch Linux specific paths for default JVM
 -  /usr/lib/jvm/default
 -  # Ubuntu specific paths for default JVM
--  /usr/lib/jvm/java-26-openjdk-{libarch}
--  /usr/lib/jvm/java-25-openjdk-{libarch}    # Ubuntu 24.04 LTS
--  /usr/lib/jvm/java-24-openjdk-{libarch}
--  /usr/lib/jvm/java-23-openjdk-{libarch}
--  /usr/lib/jvm/java-22-openjdk-{libarch}
 -  /usr/lib/jvm/java-21-openjdk-{libarch}    # Ubuntu 23.04
 -  /usr/lib/jvm/java-20-openjdk-{libarch}    # Ubuntu 22.10
 -  /usr/lib/jvm/java-19-openjdk-{libarch}    # Ubuntu 22.04 LTS
@@ -638,10 +631,9 @@ index a70b00f330..1962b55d4a 100644
 -  # SuSE specific paths for default JVM
 -  /usr/lib64/jvm/java
 -  /usr/lib64/jvm/jre
--  )
+   )
  
  set(_JNI_JAVA_AWT_LIBRARY_TRIES)
- set(_JNI_JAVA_INCLUDE_TRIES)
 diff --git a/Modules/FindJava.cmake b/Modules/FindJava.cmake
 index 1587ce648b..e92213cba7 100644
 --- a/Modules/FindJava.cmake
@@ -1101,28 +1093,28 @@ index edef791cb8..5515f44710 100644
  
  find_path(PHP4_FOUND_INCLUDE_PATH main/php.h
 diff --git a/Modules/FindPerlLibs.cmake b/Modules/FindPerlLibs.cmake
-index fbe1aade72..34562e7807 100644
+index 330700e183..7fc89df6eb 100644
 --- a/Modules/FindPerlLibs.cmake
 +++ b/Modules/FindPerlLibs.cmake
-@@ -176,10 +176,6 @@ if (PERL_EXECUTABLE)
+@@ -141,10 +141,6 @@
      PATHS
        "${PERL_UPDATE_ARCHLIB}/CORE"
        "${PERL_ARCHLIB}/CORE"
--      /usr/lib/perl5/${PerlLibs_VERSION}/${PERL_ARCHNAME}/CORE
--      /usr/lib/perl/${PerlLibs_VERSION}/${PERL_ARCHNAME}/CORE
--      /usr/lib/perl5/${PerlLibs_VERSION}/CORE
--      /usr/lib/perl/${PerlLibs_VERSION}/CORE
+-      /usr/lib/perl5/${PERL_VERSION_STRING}/${PERL_ARCHNAME}/CORE
+-      /usr/lib/perl/${PERL_VERSION_STRING}/${PERL_ARCHNAME}/CORE
+-      /usr/lib/perl5/${PERL_VERSION_STRING}/CORE
+-      /usr/lib/perl/${PERL_VERSION_STRING}/CORE
    )
  
    ### PERL_LIBRARY
-@@ -189,10 +185,6 @@ if (PERL_EXECUTABLE)
+@@ -154,10 +150,6 @@
      PATHS
        "${PERL_UPDATE_ARCHLIB}/CORE"
        "${PERL_ARCHLIB}/CORE"
--      /usr/lib/perl5/${PerlLibs_VERSION}/${PERL_ARCHNAME}/CORE
--      /usr/lib/perl/${PerlLibs_VERSION}/${PERL_ARCHNAME}/CORE
--      /usr/lib/perl5/${PerlLibs_VERSION}/CORE
--      /usr/lib/perl/${PerlLibs_VERSION}/CORE
+-      /usr/lib/perl5/${PERL_VERSION_STRING}/${PERL_ARCHNAME}/CORE
+-      /usr/lib/perl/${PERL_VERSION_STRING}/${PERL_ARCHNAME}/CORE
+-      /usr/lib/perl5/${PERL_VERSION_STRING}/CORE
+-      /usr/lib/perl/${PERL_VERSION_STRING}/CORE
    )
  
  endif ()
@@ -1351,21 +1343,17 @@ index 2c62a5f17f..772a8d88f6 100644
    PATH_SUFFIXES
      bin lib/qt lib/qt3 qt qt3 qt/bin qt3/bin lib/qt/bin lib/qt3/bin
 diff --git a/Modules/FindRuby.cmake b/Modules/FindRuby.cmake
-index 863f70a7f2..17e3ac606a 100644
+index 18b9e35855..dba9976565 100644
 --- a/Modules/FindRuby.cmake
 +++ b/Modules/FindRuby.cmake
-@@ -366,11 +366,6 @@ if (NOT Ruby_EXECUTABLE AND Ruby_FIND_VIRTUALENV MATCHES "^(FIRST|ONLY)$")
-   endif ()
- endif ()
+@@ -367,7 +367,6 @@
+           HINTS
+           ${Ruby_HDR_DIR}
+           ${Ruby_ARCH_DIR}
+-          /usr/lib/ruby/${_Ruby_VERSION_SHORT}/i586-linux-gnu/
+ )
  
--# Check for Homebrew Ruby (non-virtualenv, common on MacOS)
--if (NOT Ruby_EXECUTABLE AND NOT Ruby_FIND_VIRTUALENV STREQUAL "ONLY")
--  _RUBY_CHECK_BREW()
--endif ()
--
- # Fallback to system installed Ruby
- if (NOT Ruby_EXECUTABLE AND NOT Ruby_FIND_VIRTUALENV STREQUAL "ONLY")
-   _RUBY_CHECK_SYSTEM()
+ set(Ruby_INCLUDE_DIRS ${Ruby_INCLUDE_DIR})
 diff --git a/Modules/FindSDL.cmake b/Modules/FindSDL.cmake
 index a720dcc3df..73e222a27c 100644
 --- a/Modules/FindSDL.cmake
@@ -1656,20 +1644,6 @@ index 7c4f123a1d..4cfd53de9f 100644
  
  if(NOT CMAKE_CROSSCOMPILING)
    execute_process(COMMAND @sw_vers@ -productVersion
-@@ -277,13 +277,6 @@ if(NOT CMAKE_OSX_SYSROOT)
-     RESULT_VARIABLE _result
-   )
-   unset(_sdk_macosx)
--
--  list(APPEND CMAKE_PLATFORM_IMPLICIT_LINK_DIRECTORIES_EXCLUDE
--    # Without -isysroot, some compiler drivers implicitly pass -L/usr/local/lib
--    # to the linker.  Since the macOS dynamic loader does not search it by
--    # default, it is not a fully-implemented implicit link directory.
--    /usr/local/lib
--  )
- endif()
- 
- #----------------------------------------------------------------------------
 diff --git a/Modules/Platform/Darwin.cmake b/Modules/Platform/Darwin.cmake
 index 42c6b35424..f2985f3765 100644
 --- a/Modules/Platform/Darwin.cmake
@@ -1931,10 +1905,10 @@ index b977d955ca..5ff835298d 100644
      set(_jar_doc "NOTSET")
  
 diff --git a/Utilities/cmcurl/CMakeLists.txt b/Utilities/cmcurl/CMakeLists.txt
-index 2c6a6e6a19..3a43da619a 100644
+index 8ff651fd90..9659deedf5 100644
 --- a/Utilities/cmcurl/CMakeLists.txt
 +++ b/Utilities/cmcurl/CMakeLists.txt
-@@ -1566,43 +1566,6 @@ if(_curl_ca_bundle_supported)
+@@ -1826,43 +1826,6 @@
    endif()
    mark_as_advanced(CURL_CA_PATH_SET)
  
@@ -1955,8 +1929,8 @@ index 2c6a6e6a19..3a43da619a 100644
 -        if(EXISTS "${_search_ca_bundle_path}")
 -          message(STATUS "Found CA bundle: ${_search_ca_bundle_path}")
 -          set(CURL_CA_BUNDLE "${_search_ca_bundle_path}" CACHE
--            STRING "Absolute path to the CA bundle. ${_ca_opt_desc}")
--          set(CURL_CA_BUNDLE_SET TRUE CACHE BOOL "Absolute path to the CA bundle has been set")
+-            STRING "Path to the CA bundle. Set 'none' to disable or 'auto' for auto-detection. Defaults to 'auto'.")
+-          set(CURL_CA_BUNDLE_SET TRUE CACHE BOOL "Path to the CA bundle has been set")
 -          break()
 -        endif()
 -      endforeach()
@@ -1969,8 +1943,8 @@ index 2c6a6e6a19..3a43da619a 100644
 -        unset(_curl_ca_files_found)
 -        message(STATUS "Found CA path: ${_search_ca_path}")
 -        set(CURL_CA_PATH "${_search_ca_path}" CACHE
--          STRING "Absolute path to a directory containing CA certificates stored individually. ${_ca_opt_desc}")
--        set(CURL_CA_PATH_SET TRUE CACHE BOOL "Absolute path to the CA bundle has been set")
+-          STRING "Location of default CA path. Set 'none' to disable or 'auto' for auto-detection. Defaults to 'auto'.")
+-        set(CURL_CA_PATH_SET TRUE CACHE BOOL "Path to the CA bundle has been set")
 -      endif()
 -    endif()
 -  endif()

pkgs/by-name/cu/curlMinimal/package.nix

@@ -6,8 +6,6 @@
   perl,
   nixosTests,
   autoreconfHook,
-  buildPackages,
-  runtimeShellPackage,
   brotliSupport ? false,
   brotli,
   c-aresSupport ? false,
@@ -84,9 +82,6 @@ assert
     ]) > 1
   );
 
-let
-  isCross = !lib.systems.equals stdenv.buildPlatform stdenv.hostPlatform;
-in
 stdenv.mkDerivation (finalAttrs: {
   pname = "curl";
   version = "8.21.0";
@@ -246,20 +241,7 @@ stdenv.mkDerivation (finalAttrs: {
     ln $out/lib/libcurl${stdenv.hostPlatform.extensions.sharedLibrary} $out/lib/libcurl-gnutls${stdenv.hostPlatform.extensions.sharedLibrary}
     ln $out/lib/libcurl${stdenv.hostPlatform.extensions.sharedLibrary} $out/lib/libcurl-gnutls${stdenv.hostPlatform.extensions.sharedLibrary}.4
     ln $out/lib/libcurl${stdenv.hostPlatform.extensions.sharedLibrary} $out/lib/libcurl-gnutls${stdenv.hostPlatform.extensions.sharedLibrary}.4.4.0
-  ''
-  # The wcurl shell script found in `''${!outputBin}/bin`, is located in the
-  # source along with all the scripts patched in `postPatch` above.
-  # `patchShebangs` at that stage causes the host intended wcurl script to get
-  # the buildPlatform's runtimeShell shebang, instead of the hostPlatform's. To
-  # make sure this doesn't happen we disallow it, and fix it above in the
-  # postInstall, and also with the conditional hostPlatform's
-  # runtimeShellPackage added in buildInputs.
-  + lib.optionalString isCross ''
-    patchShebangs --update --host "''${!outputBin}/bin"
   '';
-  outputChecks.bin.disallowedReferences = lib.optional isCross buildPackages.runtimeShellPackage;
-  outputChecks.out.disallowedReferences = lib.optional isCross buildPackages.runtimeShellPackage;
-  buildInputs = lib.optional isCross runtimeShellPackage;
 
   passthru =
     let

pkgs/by-name/dn/dns-collector/package.nix

@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "dns-collector";
-  version = "2.3.0";
+  version = "2.4.0";
 
   src = fetchFromGitHub {
     owner = "dmachard";
     repo = "dns-collector";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-5SFdTDuXnVdMFGxoraUMbDV3o476sc9c7D9qWBoQXr4=";
+    hash = "sha256-Gm5PXEEgw98NnsfKN8JxhyTqEL9KSA6L2CgRTRJirdY=";
   };
 
   subPackages = [ "." ];
@@ -28,7 +28,7 @@ buildGoModule (finalAttrs: {
     "-X=github.com/prometheus/common/version.Version=${finalAttrs.version}"
   ];
 
-  vendorHash = "sha256-eoUsiRGtq1ucAIyeCRNEuro2Qj4iRe+3aE8DrqIcCWs=";
+  vendorHash = "sha256-pEex5xu3Cf6vqFp7YLwk+Ku+Yc0coOGLXP7/NUtDYbg=";
 
   passthru.updateScript = nix-update-script { };
 

pkgs/by-name/do/dopamine/bump-better-sqlite3.patch

@@ -0,0 +1,48 @@
+diff --git a/package-lock.json b/package-lock.json
+index 921ffcdc..f1a2aeeb 100644
+--- a/package-lock.json
++++ b/package-lock.json
+@@ -17,7 +17,7 @@
+                 "@electron/remote": "2.1.3",
+                 "@fortawesome/fontawesome-free": "^6.6.0",
+                 "angular-split": "14.1.0",
+-                "better-sqlite3": "12.5.0",
++                "better-sqlite3": "12.11.1",
+                 "cheerio": "1.0.0-rc.12",
+                 "discord-rpc": "4.0.1",
+                 "electron-log": "4.4.8",
+@@ -10353,9 +10353,9 @@
+             "license": "MIT"
+         },
+         "node_modules/better-sqlite3": {
+-            "version": "12.5.0",
+-            "resolved": "https://registry.npmjs.org/better-sqlite3/-/better-sqlite3-12.5.0.tgz",
+-            "integrity": "sha512-WwCZ/5Diz7rsF29o27o0Gcc1Du+l7Zsv7SYtVPG0X3G/uUI1LqdxrQI7c9Hs2FWpqXXERjW9hp6g3/tH7DlVKg==",
++            "version": "12.11.1",
++            "resolved": "https://registry.npmjs.org/better-sqlite3/-/better-sqlite3-12.11.1.tgz",
++            "integrity": "sha512-dq9AtApgg5PGFtBzPFSBl3HZQjHok5gaQCM6zh2Yk0aSmDCs1CbnVI8/HgASQkNKsWFpseIO9beg5xxpYhbIfA==",
+             "hasInstallScript": true,
+             "license": "MIT",
+             "dependencies": {
+@@ -10363,7 +10363,7 @@
+                 "prebuild-install": "^7.1.1"
+             },
+             "engines": {
+-                "node": "20.x || 22.x || 23.x || 24.x || 25.x"
++                "node": "20.x || 22.x || 23.x || 24.x || 25.x || 26.x"
+             }
+         },
+         "node_modules/big.js": {
+diff --git a/package.json b/package.json
+index 2c07792f..9023e10c 100644
+--- a/package.json
++++ b/package.json
+@@ -98,7 +98,7 @@
+         "@electron/remote": "2.1.3",
+         "@fortawesome/fontawesome-free": "^6.6.0",
+         "angular-split": "14.1.0",
+-        "better-sqlite3": "12.5.0",
++        "better-sqlite3": "12.11.1",
+         "cheerio": "1.0.0-rc.12",
+         "discord-rpc": "4.0.1",
+         "electron-log": "4.4.8",

pkgs/by-name/do/dopamine/package.nix

@@ -3,30 +3,36 @@
   stdenv,
   fetchFromGitHub,
   buildNpmPackage,
-  electron_40,
+  electron,
   python3,
   xcodebuild,
+  applyPatches,
 }:
 buildNpmPackage (finalAttrs: {
   pname = "dopamine";
   version = "3.0.6";
 
-  src = fetchFromGitHub {
-    owner = "digimezzo";
-    repo = "dopamine";
-    tag = "v${finalAttrs.version}";
-    hash = "sha256-HTPWejm5Wi6yGJyS/f1RhjIluTz01ue8lAsnAcQY3IY=";
+  # needed to upgrade better-sqlite3 in npmConfigHook
+  src = applyPatches {
+    src = fetchFromGitHub {
+      owner = "digimezzo";
+      repo = "dopamine";
+      tag = "v${finalAttrs.version}";
+      hash = "sha256-HTPWejm5Wi6yGJyS/f1RhjIluTz01ue8lAsnAcQY3IY=";
+    };
+    patches = [
+      # register-scheme contains install scripts, but has no lockfile
+      ./remove-register-scheme.patch
+
+      # fixes node-addon-api errors with aarch64-darwin
+      ./update-node-addon-api.patch
+
+      # bump better-sqlite3 to work with electron 41
+      ./bump-better-sqlite3.patch
+    ];
   };
 
-  npmDepsHash = "sha256-JkGS0YmjsdUiOD48HcGXy/fPTP33JQAtJui0mQWicmc=";
-
-  patches = [
-    # register-scheme contains install scripts, but has no lockfile
-    ./remove-register-scheme.patch
-
-    # fixes node-addon-api errors with aarch64-darwin
-    ./update-node-addon-api.patch
-  ];
+  npmDepsHash = "sha256-9dQUqoLfzYXOgmE9j2lkew9b/1m4XOghT7roD82y+qg=";
 
   nativeBuildInputs = [
     (python3.withPackages (ps: with ps; [ distutils ]))
@@ -39,8 +45,8 @@ buildNpmPackage (finalAttrs: {
     runHook preBuild
 
     # needed for better-sqlite3 rebuild
-    export npm_config_nodedir="${electron_40.headers}"
-    export npm_config_target="${electron_40.version}"
+    export npm_config_nodedir="${electron.headers}"
+    export npm_config_target="${electron.version}"
 
     npm rebuild --verbose --no-progress --offline
 
@@ -57,7 +63,7 @@ buildNpmPackage (finalAttrs: {
     ${
       if stdenv.hostPlatform.isDarwin then
         ''
-          cp -r ${electron_40.dist}/Electron.app ./
+          cp -r ${electron.dist}/Electron.app ./
           find ./Electron.app -name 'Info.plist' -exec chmod +rw {} \;
 
           npm exec electron-builder -- \
@@ -65,7 +71,7 @@ buildNpmPackage (finalAttrs: {
             -c.npmRebuild=false \
             -c.mac.identity=null \
             -c.electronDist=./ \
-            -c.electronVersion=${electron_40.version} \
+            -c.electronVersion=${electron.version} \
             -c.extraMetadata.version=v${finalAttrs.version} \
             --config electron-builder.config.js
         ''
@@ -74,8 +80,8 @@ buildNpmPackage (finalAttrs: {
           npm exec electron-builder -- \
             --dir \
             -c.npmRebuild=false \
-            -c.electronDist=${electron_40.dist} \
-            -c.electronVersion=${electron_40.version} \
+            -c.electronDist=${electron.dist} \
+            -c.electronVersion=${electron.version} \
             -c.extraMetadata.version=v${finalAttrs.version} \
             --config electron-builder.config.js
         ''
@@ -99,7 +105,7 @@ buildNpmPackage (finalAttrs: {
           mkdir -p $out/share/dopamine
           cp -r release/linux*unpacked/{locales,resources{,.pak}} $out/share/dopamine
 
-          makeWrapper ${lib.getExe electron_40} $out/bin/dopamine \
+          makeWrapper ${lib.getExe electron} $out/bin/dopamine \
             --add-flags $out/share/dopamine/resources/app.asar \
             --inherit-argv0
 

pkgs/by-name/du/duckdb/versions.json

@@ -1,6 +1,6 @@
 {
-  "version": "1.5.4",
-  "rev": "08e34c447bae34eaee3723cac61f2878b6bdf787",
-  "hash": "sha256-6xpKZKfH5/nwE2nU5kcpgITKFm3ilb1PYf9QEk+bKoM=",
-  "python_hash": "sha256-2TgMuaeAehJ5rvpfA57KTmHtTZnvfa/nl/Y9ASCwVs0="
+  "version": "1.5.3",
+  "rev": "14eca11bd9d4a0de2ea0f078be588a9c1c5b279c",
+  "hash": "sha256-k7mtYXHS8IcBAuOCJ/09lPYLxF3RMODIeDaz3tKmQAA=",
+  "python_hash": "sha256-r0jfYIyBHN5z4QKKxS/yjnkGjUy/yg9Kt/O6adBbH7Q="
 }

pkgs/by-name/fa/fast/package.nix

@@ -3,17 +3,17 @@
   buildGoModule,
   fetchFromGitHub,
 }:
-buildGoModule {
+buildGoModule rec {
   pname = "fast";
-  version = "0-unstable-2026-07-01";
+  version = "0.1.0";
 
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "maaslalani";
     repo = "fast";
-    rev = "26d8fc9c189ba748c68f8930af11dee5c2467f7e";
-    hash = "sha256-YeDx082+ySqzamo9UutFTXXkrb37nmqt3ZUNzUHShf4=";
+    tag = "v${version}";
+    hash = "sha256-/Li5AAuuHkVqJzmh38g5CPQXWj4RY0TRwvtjlpydosg=";
   };
 
   vendorHash = "sha256-YSjJ8NOL97hXZLnfGYIjoKmARv+gWOsv+5qkl9konnA=";

pkgs/by-name/gc/gcx/package.nix

@@ -9,13 +9,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "gcx";
-  version = "0.4.2";
+  version = "0.4.3";
 
   src = fetchFromGitHub {
     owner = "grafana";
     repo = "gcx";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Gf05N13ZJLjB55eCcIfXIoJn3CVAAR5mcFyEq8s+RxY=";
+    hash = "sha256-nSopsew5QMOs/QyJg7TzALokZagIGCjxMCNsairB5PA=";
   };
 
   vendorHash = "sha256-JioNpEqGFxD6Gg84ZZ/9OrETxTGn2V+HMlGGiiZfeIo=";

pkgs/by-name/gl/glog/package.nix

@@ -38,8 +38,6 @@ stdenv.mkDerivation (finalAttrs: {
     # consumers of the CMake config file to fail at the configuration step.
     # Explicitly disabling unwind support sidesteps the issue.
     "-DWITH_UNWIND=OFF"
-    # Enable pkg-config support so that a `.pc` file is generated.
-    "-DWITH_PKGCONFIG=ON"
   ];
 
   doCheck = true;

pkgs/by-name/gn/gnutar/acl-2.4.0-name-conflicts.patch

@@ -1,85 +0,0 @@
-diff --git a/src/xattrs.c b/src/xattrs.c
-index 86a7e59cbc..c872ae308d 100644
---- a/src/xattrs.c
-+++ b/src/xattrs.c
-@@ -139,13 +139,13 @@
- #ifdef HAVE_POSIX_ACLS
- 
- /* acl-at wrappers, TODO: move to gnulib in future? */
--static acl_t acl_get_file_at (int, const char *, acl_type_t);
--static int acl_set_file_at (int, const char *, acl_type_t, acl_t);
-+static acl_t tar_acl_get_file_at (int, const char *, acl_type_t);
-+static int tar_acl_set_file_at (int, const char *, acl_type_t, acl_t);
- static int file_has_acl_at (int, char const *, struct stat const *);
--static int acl_delete_def_file_at (int, char const *);
-+static int tar_acl_delete_def_file_at (int, char const *);
- 
--/* acl_get_file_at */
--#define AT_FUNC_NAME acl_get_file_at
-+/* tar_acl_get_file_at */
-+#define AT_FUNC_NAME tar_acl_get_file_at
- #define AT_FUNC_RESULT acl_t
- #define AT_FUNC_FAIL (acl_t)NULL
- #define AT_FUNC_F1 acl_get_file
-@@ -159,8 +159,8 @@
- #undef AT_FUNC_POST_FILE_PARAM_DECLS
- #undef AT_FUNC_POST_FILE_ARGS
- 
--/* acl_set_file_at */
--#define AT_FUNC_NAME acl_set_file_at
-+/* tar_acl_set_file_at */
-+#define AT_FUNC_NAME tar_acl_set_file_at
- #define AT_FUNC_F1 acl_set_file
- #define AT_FUNC_POST_FILE_PARAM_DECLS   , acl_type_t type, acl_t acl
- #define AT_FUNC_POST_FILE_ARGS          , type, acl
-@@ -170,8 +170,8 @@
- #undef AT_FUNC_POST_FILE_PARAM_DECLS
- #undef AT_FUNC_POST_FILE_ARGS
- 
--/* acl_delete_def_file_at */
--#define AT_FUNC_NAME acl_delete_def_file_at
-+/* tar_acl_delete_def_file_at */
-+#define AT_FUNC_NAME tar_acl_delete_def_file_at
- #define AT_FUNC_F1 acl_delete_def_file
- #define AT_FUNC_POST_FILE_PARAM_DECLS
- #define AT_FUNC_POST_FILE_ARGS
-@@ -299,10 +299,10 @@
-       /* No "default" IEEE 1003.1e ACL set for directory.  At this moment,
-          FILE_NAME may already have inherited default acls from parent
-          directory;  clean them up. */
--      if (acl_delete_def_file_at (chdir_fd, file_name))
-+      if (tar_acl_delete_def_file_at (chdir_fd, file_name))
-         WARNOPT (WARN_XATTR_WRITE,
-                 (0, errno,
--                 _("acl_delete_def_file_at: Cannot drop default POSIX ACLs "
-+                 _("tar_acl_delete_def_file_at: Cannot drop default POSIX ACLs "
-                    "for file '%s'"),
-                  file_name));
-       return;
-@@ -316,11 +316,11 @@
-       return;
-     }
- 
--  if (acl_set_file_at (chdir_fd, file_name, type, acl) == -1)
-+  if (tar_acl_set_file_at (chdir_fd, file_name, type, acl) == -1)
-     /* warn even if filesystem does not support acls */
-     WARNOPT (WARN_XATTR_WRITE,
- 	     (0, errno,
--	      _ ("acl_set_file_at: Cannot set POSIX ACLs for file '%s'"),
-+	      _ ("tar_acl_set_file_at: Cannot set POSIX ACLs for file '%s'"),
- 	      file_name));
- 
-   acl_free (acl);
-@@ -357,10 +357,10 @@
-   char *val = NULL;
-   acl_t acl;
- 
--  if (!(acl = acl_get_file_at (parentfd, file_name, type)))
-+  if (!(acl = tar_acl_get_file_at (parentfd, file_name, type)))
-     {
-       if (errno != ENOTSUP)
--        call_arg_warn ("acl_get_file_at", file_name);
-+        call_arg_warn ("tar_acl_get_file_at", file_name);
-       return;
-     }
- 

pkgs/by-name/gn/gnutar/package.nix

@@ -24,17 +24,9 @@ stdenv.mkDerivation (finalAttrs: {
     sha256 = "sha256-TWL/NzQux67XSFNTI5MMfPlKz3HDWRiCsmp+pQ8+3BY=";
   };
 
-  patches = [
-    # GNU tar fails to link libiconv even though the configure script detects it.
-    # https://savannah.gnu.org/bugs/index.php?64441
-    ./link-libiconv.patch
-
-    # acl 2.4.0 adds functions that have name conflicts with internal
-    # (`static`) functions from GNU tar. we prefix `tar_` to these names to
-    # avoid this, matching the approach from
-    # https://lists.gnu.org/archive/html/bug-tar/2026-06/msg00013.html
-    ./acl-2.4.0-name-conflicts.patch
-  ];
+  # GNU tar fails to link libiconv even though the configure script detects it.
+  # https://savannah.gnu.org/bugs/index.php?64441
+  patches = [ ./link-libiconv.patch ];
 
   # gnutar tries to call into gettext between `fork` and `exec`,
   # which is not safe on darwin.

pkgs/by-name/go/go-ios/package.nix

@@ -7,33 +7,42 @@
   pkg-config,
   libusb1,
   iproute2,
-  net-tools,
 }:
 
 buildGoModule (finalAttrs: {
   pname = "go-ios";
-  version = "1.0.207";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "danielpaulus";
     repo = "go-ios";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-2GjUrt1F8MrPOITCsuWHHsi/85pfzbLeY+WbPfLYDY4=";
+    sha256 = "sha256-5fMsHSwJUH/JBaZXyB11rHCNOqzHF3MYI9gg29hj0O4=";
   };
 
   proxyVendor = true;
-  vendorHash = "sha256-/aVaTC9lfoXQvhDVQm31HmXBnDYYOv6RH69Nm3I/K7s=";
+  vendorHash = "sha256-Bl9nlRnclqVgFF6mS6DX6oS+1c26DoISqDBY2rMS2yw=";
 
   excludedPackages = [
     "restapi"
+    "test/e2e"
   ];
 
-  postPatch = lib.optionalString stdenv.hostPlatform.isLinux ''
+  ldflags = [
+    "-X main.version=${finalAttrs.version}"
+  ];
+
+  postPatch = ''
+    substituteInPlace main.go \
+      --replace-fail 'const version = ' 'var version = '
+  ''
+  + lib.optionalString stdenv.hostPlatform.isLinux ''
     substituteInPlace ncm/linux_commands.go \
       --replace-fail "ip " "${lib.getExe' iproute2 "ip"} "
-
-    substituteInPlace ios/tunnel/tunnel.go \
-      --replace-fail "ifconfig" "${lib.getExe' net-tools "ifconfig"}"
+  ''
+  + lib.optionalString stdenv.hostPlatform.isDarwin ''
+    substituteInPlace ios/tunnel/tunnel_darwin.go \
+      --replace-fail "ifconfig" "/sbin/ifconfig"
   '';
 
   nativeBuildInputs = [

pkgs/by-name/go/gotosocial/package.nix

@@ -11,13 +11,13 @@
 }:
 buildGo125Module (finalAttrs: {
   pname = "gotosocial";
-  version = "0.21.3";
+  version = "0.22.0";
 
   src = fetchFromCodeberg {
     owner = "superseriousbusiness";
     repo = "gotosocial";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-gemi9t4wTjmCHEXfdXz1X9Q4gcvj/3LMtlrO5UpQ19M=";
+    hash = "sha256-rslzi9WqPqN/wm9PN6SWdXtLdMRJJV6Hhb3whJ0RicU=";
   };
 
   vendorHash = null;
@@ -63,6 +63,9 @@ buildGo125Module (finalAttrs: {
   '';
 
   postInstall = ''
+    # remove a Go codegen helper binary
+    rm $out/bin/gen
+
     mkdir -p $out/share/gotosocial/web
     mv web/{assets,template} $out/share/gotosocial/web
   '';

pkgs/by-name/gs/gssdp_1_6/package.nix

@@ -17,7 +17,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gssdp";
-  version = "1.6.6";
+  version = "1.6.5";
 
   outputs = [
     "out"
@@ -27,7 +27,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/gssdp/${lib.versions.majorMinor finalAttrs.version}/gssdp-${finalAttrs.version}.tar.xz";
-    hash = "sha256-dn0idSVM4O/q6sZEGf+fTwrUcNE072cvXFVrKrt4a8s=";
+    hash = "sha256-NP2CTDbvn1dVlNVXJyhBLduMUi9ga2yRPvi1qACq/E4=";
   };
 
   depsBuildBuild = [

pkgs/by-name/is/isa-l/package.nix

@@ -96,5 +96,12 @@ stdenv.mkDerivation (finalAttrs: {
     changelog = "https://github.com/intel/isa-l/releases/tag/v${finalAttrs.version}";
     maintainers = with lib.maintainers; [ jbedo ];
     platforms = lib.platforms.all;
+    badPlatforms = [
+      # <instantiation>:4:26: error: unexpected token in argument list
+      #  movk x7, p4_low_b1, lsl 16
+      "aarch64-darwin"
+      # https://github.com/intel/isa-l/issues/188
+      "i686-linux"
+    ];
   };
 })

pkgs/by-name/ja/jay/package.nix

@@ -2,33 +2,34 @@
   lib,
   stdenv,
   rustPlatform,
-  fetchFromGitHub,
-  libGL,
-  libinput,
-  pkgconf,
-  xkeyboard_config,
-  libgbm,
-  pango,
-  udev,
-  libglvnd,
-  vulkan-loader,
   autoPatchelfHook,
+  fetchFromGitHub,
   installShellFiles,
+  libGL,
+  libgbm,
+  libglvnd,
+  libinput,
   nix-update-script,
+  pango,
+  pkgconf,
+  sqlite,
+  udev,
+  vulkan-loader,
+  xkeyboard_config,
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "jay";
-  version = "1.13.0";
+  version = "1.14.0";
 
   src = fetchFromGitHub {
     owner = "mahkoh";
     repo = "jay";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-tC2V1BgUGsUMpZsKXjFSS8Mp28LrNI/QNu761zpgAkc=";
+    sha256 = "sha256-bdvcGO1E9fkmKiXQxc3nvISwjIAegY8g37HmxXolsmU=";
   };
 
-  cargoHash = "sha256-96vCkZR/8dgZH0hJPeKzP7jQZ41W7XTi9yMnxFaIhoY=";
+  cargoHash = "sha256-5yjMPDh7liaa9+KntfdCzUXz4vWzTcAhFmXrnVZ+pjM=";
 
   nativeBuildInputs = [
     autoPatchelfHook
@@ -38,16 +39,17 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   buildInputs = [
     libGL
-    xkeyboard_config
     libgbm
-    pango
-    udev
     libinput
+    pango
+    sqlite
+    udev
+    vulkan-loader
+    xkeyboard_config
   ];
 
   runtimeDependencies = [
     libglvnd
-    vulkan-loader
   ];
 
   checkFlags = [

pkgs/by-name/je/jemalloc/package.nix

@@ -60,8 +60,6 @@ stdenv.mkDerivation (finalAttrs: {
   configureFlags = [
     "--with-version=${finalAttrs.version}-0-g0000000000000000000000000000000000000000"
     "--with-lg-vaddr=${with stdenv.hostPlatform; toString (if isILP32 then 32 else parsed.cpu.bits)}"
-    # Profiling is inert unless enabled at runtime
-    "--enable-prof"
   ]
   # see the comment on stripPrefix
   ++ lib.optional stripPrefix "--with-jemalloc-prefix="

pkgs/by-name/ka/kanboard/package.nix

@@ -2,6 +2,7 @@
   lib,
   stdenvNoCC,
   fetchFromGitHub,
+  fetchpatch,
   nixosTests,
   nix-update-script,
   php,
@@ -18,6 +19,16 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     hash = "sha256-iI9Dyno1s9P9t7IxfDs5gQUl9yFyu2taXvKY0WnF2Q0=";
   };
 
+  # CVE-2026-56774 / NIXPKGS-2026-2001: scope remember-me session removal to
+  # the owning user so a session row can only be deleted by its owner.
+  # Remove this patch once upgraded past 1.2.52.
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/kanboard/kanboard/commit/928c68aa2b7c00092dd71084d329b912e229f3d1.patch";
+      hash = "sha256-K616dTwAsLJAJMqY+DJjebfi6MV5wSICbd1iy6VynlM=";
+    })
+  ];
+
   dontBuild = true;
 
   installPhase = ''

pkgs/by-name/le/lerc/package.nix

@@ -10,7 +10,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "lerc";
-  version = "4.1.1";
+  version = "4.1.0";
 
   outputs = [
     "out"
@@ -21,7 +21,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "esri";
     repo = "lerc";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-YTNIydQLCBzsuvPWA6qnOkOIPf9JlByJdNHkTevE7Z0=";
+    hash = "sha256-+X30DQuq2oT/sTe8usUaNK1V+UTNvXJW7IAJVIr8m78=";
   };
 
   # Required to get the freebsd-ports patch to apply.

pkgs/by-name/li/libadwaita/package.nix

@@ -23,7 +23,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libadwaita";
-  version = "1.9.2";
+  version = "1.9.1";
 
   outputs = [
     "out"
@@ -37,7 +37,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "GNOME";
     repo = "libadwaita";
     tag = finalAttrs.version;
-    hash = "sha256-XKKjnZz4CII6w9fKFptPK3aTNa5eMfyE7rcerbgaDco=";
+    hash = "sha256-Oy3WcsymNbbmAacm5hEOrorI1wKXjSp063mh4jCJRAE=";
   };
 
   depsBuildBuild = [

pkgs/by-name/li/libajantv2/package.nix

@@ -47,11 +47,11 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   postInstall = ''
-    mkdir -p "$dev/lib/pkgconfig"
-    cat >"$dev/lib/pkgconfig/libajantv2.pc" <<EOF
+    mkdir -p "$out/lib/pkgconfig"
+    cat >"$out/lib/pkgconfig/libajantv2.pc" <<EOF
     prefix=$out
     libdir=\''${prefix}/lib
-    includedir=$dev/include/libajantv2
+    includedir=\''${prefix}/include/libajantv2
 
     Name: libajantv2
     Description: Library for controlling AJA NTV2 video devices

pkgs/by-name/li/libapparmor/package.nix

@@ -32,13 +32,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "libapparmor";
-  version = "5.0.1";
+  version = "5.0.0";
 
   src = fetchFromGitLab {
     owner = "apparmor";
     repo = "apparmor";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-y5r8X7Cpwp7TSsKYXNoAeyy0MbgxLSW8gNtLsIvKP8c=";
+    hash = "sha256-seEREIc83alEPyZGD/GY48hjpqiw3QENnqYsdjHOGgs=";
   };
   sourceRoot = "${finalAttrs.src.name}/libraries/libapparmor";
 

pkgs/by-name/li/libchewing/package.nix

@@ -13,14 +13,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libchewing";
-  version = "0.12.0";
+  version = "0.13.0";
 
   src = fetchFromCodeberg {
     owner = "chewing";
     repo = "libchewing";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-+oSO1HgLMF5+UcY+2NwQjPmspGqaPYuI7mdvSLrhkNg=";
+    hash = "sha256-1/aamkc66pjAf/jl4pD2rJ9ipFW0bAWjvKg6KtINWuQ=";
   };
 
   # ld: unknown option: -version-script
@@ -31,7 +31,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) src;
-    hash = "sha256-TcNhoGCN+S/Tt3IdysVnGmXNl+hXQoWMppp8yN9N0NY=";
+    hash = "sha256-1b8GbZ75jBVmvXquOjG2CEcLXg4AthAwQzdO68CjjPs=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/li/libevent/package.nix

@@ -14,11 +14,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libevent";
-  version = "2.1.13";
+  version = "2.1.12";
 
   src = fetchurl {
     url = "https://github.com/libevent/libevent/releases/download/release-${finalAttrs.version}-stable/libevent-${finalAttrs.version}-stable.tar.gz";
-    hash = "sha256-9+k4O4wLqoG2h+W17swBvu+vGxm2QVHZXtYWR/56MVw=";
+    sha256 = "1fq30imk8zd26x8066di3kpc5zyfc5z6frr3zll685zcx4dxxrlj";
   };
 
   patches = [

pkgs/by-name/li/libffiReal/package.nix

@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libffi";
-  version = "3.7.0";
+  version = "3.5.2";
 
   src = fetchurl {
     url =
       with finalAttrs;
       "https://github.com/libffi/libffi/releases/download/v${version}/${pname}-${version}.tar.gz";
-    hash = "sha256-IlXFpjjftRv2fCChKnu3DRf+senqurrAX1VzFG9YZDY=";
+    hash = "sha256-86MIKiOzfCk6T80QUxR7Nx8v+R+n6hsqUuM1Z2usgtw=";
   };
 
   # Note: this package is used for bootstrapping fetchurl, and thus
@@ -32,9 +32,6 @@ stdenv.mkDerivation (finalAttrs: {
     ./freebsd-tsan-pthread.patch
   ];
 
-  # To workaround https://github.com/libffi/libffi/issues/993, we empty the test file:
-  postPatch = lib.optionalString stdenv.hostPlatform.isDarwin "echo 'int main (void) { return 0; }' > testsuite/libffi.call/i128-1.c";
-
   strictDeps = true;
   outputs = [
     "out"

pkgs/by-name/li/libjxl/package.nix

@@ -31,7 +31,7 @@ in
 
 stdenv.mkDerivation rec {
   pname = "libjxl";
-  version = "0.12.0";
+  version = "0.11.2";
 
   outputs = [
     "out"
@@ -44,7 +44,7 @@ stdenv.mkDerivation rec {
     owner = "libjxl";
     repo = "libjxl";
     tag = "v${version}";
-    hash = "sha256-rJyvJo1ZveE1pvMErK9ilFQA0NXkD2ka93L+1gXeqf8=";
+    hash = "sha256-L4/BY68ZBCpebQxryR7D1CxrsneYvw8B8EvW2mkF7bA=";
     # There are various submodules in `third_party/`.
     fetchSubmodules = true;
   };
@@ -69,6 +69,7 @@ stdenv.mkDerivation rec {
   # that the cmake build can apparently use:
   #     OpenGL/GLUT (for Examples -> comparison with sjpeg)
   #     viewer (see `cmakeFlags`)
+  #     plugins like for GDK and GIMP (see `cmakeFlags`)
 
   # Vendored libraries:
   # `libjxl` currently vendors many libraries as git submodules that they
@@ -126,6 +127,7 @@ stdenv.mkDerivation rec {
   ++ lib.optionals enablePlugins [
     # Enable plugins, such as:
     # * the `gdk-pixbuf` one, which allows applications like `eog` to load jpeg-xl files
+    # * the `gimp` one, which allows GIMP to load jpeg-xl files
     "-DJPEGXL_ENABLE_PLUGINS=ON"
   ]
   ++ lib.optionals stdenv.hostPlatform.isStatic [

pkgs/by-name/li/libmemcached/package.nix

@@ -23,7 +23,7 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-jEw6L2/139oo4sGprl9Xp0DTarxAK1bEF2ak2kHWSAs=";
   };
 
-  patches = [
+  patches = lib.optionals stdenv.hostPlatform.isDarwin [
     (fetchpatch {
       name = "libcxx-compat.patch";
       url = "https://github.com/awesomized/libmemcached/commit/547460c12287a34a5993045157a0e13e14203f92.patch";

pkgs/by-name/li/libressl/default.nix

@@ -64,7 +64,7 @@ let
         export PREVIOUS_${ldLibPathEnvName}=$${ldLibPathEnvName}
         export ${ldLibPathEnvName}="$${ldLibPathEnvName}:$(realpath tls/):$(realpath ssl/):$(realpath crypto/)"
       ''
-      + lib.optionalString (stdenv.hostPlatform.isElf && buildShared) ''
+      + lib.optionalString stdenv.hostPlatform.isElf ''
         # Bail if any shared object has executable stack enabled. This can
         # happen when an object produced from an assmbly file in libcrypto is
         # missing a .note.GNU-stack section. An executable stack is dangerous
@@ -151,10 +151,23 @@ in
     ];
   };
 
-  # 4.3 was released April 2026 and will become unsupported on May 19, 2027,
-  # one year after the release of OpenBSD 7.9.
+  # 4.3 was released April 2026 and will become unsupported one year after the
+  # release of OpenBSD 7.9.
   libressl_4_3 = generic {
-    version = "4.3.2";
-    hash = "sha256-7fAa7iTGXWnmqe/LnUS82mgv+dTzu72V55Th36kIR7U=";
+    version = "4.3.1";
+    hash = "sha256-wttCrOFOfVQZgm+rNadC7G5NEnJaBRpR0M6jwQug+lA=";
+    patches = [
+      # Fix for https://github.com/libressl/portable/issues/1278, where LibreSSL
+      # 4.3 started requiring executable stack because some objects were missing
+      # a .note.GNU-stack section; will probably be included in the next release.
+      (fetchpatch {
+        url = "https://raw.githubusercontent.com/libressl/portable/4dae91d056c6c75ba5cf2bc5e6148b8e02239119/patches/gnu-stack.patch";
+        hash = "sha256-Q1oWL4N8w5Zmjfq5QkTJR53NgZ4GqChSDaBicli5G2I=";
+        # This patch is written to be applied with -p0, with no leading path
+        # component, but Nix applies with -p1 by default, so we add it to not
+        # break compatibility with how other patches must be applied.
+        decode = "sed 's|^--- |--- a/|; s|^+++ |+++ b/|'";
+      })
+    ];
   };
 }

pkgs/by-name/li/libsepol/package.nix

@@ -7,7 +7,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libsepol";
-  version = "3.11";
+  version = "3.10";
   se_url = "https://github.com/SELinuxProject/selinux/releases/download";
 
   outputs = [
@@ -19,7 +19,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "${finalAttrs.se_url}/${finalAttrs.version}/libsepol-${finalAttrs.version}.tar.gz";
-    hash = "sha256-efPSyI9Et+tc9U2XkuAyMil+F/l6F5Fj8nUAmaAPFk0=";
+    hash = "sha256-1VVYZ5f6nzg0RJbSp+wRR7bKrz/MRMQtjVFz7denmnE=";
   };
 
   nativeBuildInputs = [ flex ];

pkgs/by-name/li/libssh/package.nix

@@ -8,9 +8,6 @@
   openssl,
   libsodium,
 
-  withGssapi ? false,
-  krb5,
-
   # for passthru.tests
   ffmpeg,
   sshping,
@@ -31,29 +28,20 @@ stdenv.mkDerivation (finalAttrs: {
     "dev"
   ];
 
-  strictDeps = true;
-
-  __structuredAttrs = true;
-
   postPatch = ''
     # Fix headers to use libsodium instead of NaCl
     sed -i 's,nacl/,sodium/,g' ./include/libssh/curve25519.h src/curve25519.c
   '';
 
-  cmakeFlags = [
-    # Don’t build examples, which are not installed and require additional dependencies not
-    # included in `buildInputs` such as libx11.
-    "-DWITH_EXAMPLES=OFF"
-
-    (lib.cmakeBool "USE_GSSAPI" withGssapi)
-  ];
+  # Don’t build examples, which are not installed and require additional dependencies not
+  # included in `buildInputs` such as libx11.
+  cmakeFlags = [ "-DWITH_EXAMPLES=OFF" ];
 
   buildInputs = [
     zlib
     openssl
     libsodium
-  ]
-  ++ lib.optional withGssapi krb5;
+  ];
 
   nativeBuildInputs = [
     cmake

pkgs/by-name/li/libsshWithGssapi/package.nix

@@ -1,3 +0,0 @@
-{ libssh }:
-
-libssh.override { withGssapi = true; }

pkgs/by-name/li/libxfont_2/package.nix

@@ -15,7 +15,7 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "libxfont_2";
-  version = "2.0.8";
+  version = "2.0.7";
 
   outputs = [
     "out"
@@ -24,7 +24,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://xorg/individual/lib/libXfont2-${finalAttrs.version}.tar.xz";
-    hash = "sha256-9VbA4Qk6TmkRzJC8SxBtIBkC7hh/10ryBv8WL35qJNU=";
+    hash = "sha256-i3uC/eukh2m2lDPo4/u5hKX2vzaLDV9Hq+7EnePljvs=";
   };
 
   strictDeps = true;

pkgs/by-name/ll/llama-cpp/package.nix

@@ -34,7 +34,7 @@
   npmHooks,
 
   pkg-config,
-  metalSupport ? stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64 && !openclSupport,
+  metalSupport ? stdenv.hostPlatform.isDarwin && !openclSupport,
   vulkanSupport ? false,
   rpcSupport ? false,
   openssl,
@@ -206,9 +206,6 @@ effectiveStdenv.mkDerivation (finalAttrs: {
   doCheck = false;
 
   passthru = {
-    tests = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
-      metal = llama-cpp.override { metalSupport = true; };
-    };
     updateScript = nix-update-script {
       attrPath = "llama-cpp";
       extraArgs = [

pkgs/by-name/lo/logseq/package.nix

@@ -260,7 +260,7 @@ stdenv.mkDerivation (finalAttrs: {
 
     makeWrapper ${lib.getExe electron} $out/bin/logseq \
         --add-flags $out/share/logseq/resources/app \
-        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime=true}}" \
+        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime=true --wayland-text-input-version=3}}" \
         --set-default LOCAL_GIT_DIRECTORY ${git} \
         --inherit-argv0
   ''

pkgs/by-name/ma/macos-instantview/package.nix

@@ -7,11 +7,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "instantview";
-  version = "3.22R0002";
+  version = "3.24R0004";
 
   src = fetchurl {
     url = "https://www.siliconmotion.com/downloads/macOS_InstantView_V${finalAttrs.version}.dmg";
-    hash = "sha256-PdgX9zCrVYtNbuOCYKVo9cegCG/VY7QXetivVsUltbg=";
+    hash = "sha256-lozVykKK1edUQlwxNKy/GyMKjsQaXeR9XVoau72Bwhg=";
   };
 
   nativeBuildInputs = [ _7zz ];
@@ -19,6 +19,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   dontUnpack = true;
   dontConfigure = true;
   dontBuild = true;
+  dontFixup = true;
 
   installPhase = ''
     runHook preInstall
@@ -27,8 +28,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     # Extract the DMG using 7zip
     7zz x "$src" -oextracted -y
 
-    # Move the extracted contents to $out
-    cp -r extracted/* "$out/Applications/"
+    cp -r extracted/*.app "$out/Applications/"
 
     runHook postInstall
   '';

pkgs/by-name/ma/makeBinaryWrapper/make-binary-wrapper.sh

@@ -6,8 +6,6 @@ set -euo pipefail
 # assertExecutable FILE
 assertExecutable() {
     local file="$1"
-    [[ -e "$file" ]] || \
-        die "Cannot wrap '$file' because it does not exist"
     [[ -f "$file" && -x "$file" ]] || \
         die "Cannot wrap '$file' because it is not an executable file"
 }

pkgs/by-name/me/merve/package.nix

@@ -26,14 +26,16 @@ stdenv.mkDerivation (finalAttrs: {
   cmakeFlags = [
     (lib.cmakeBool "BUILD_SHARED_LIBS" (!static))
     (lib.cmakeBool "MERVE_TESTING" finalAttrs.finalPackage.doCheck)
-  ]
-  ++ lib.optional (simdutf != null) (lib.cmakeBool "MERVE_USE_SIMDUTF" true);
+    (lib.cmakeBool "MERVE_USE_SIMDUTF" true)
+  ];
 
   nativeBuildInputs = [
     cmake
     validatePkgConfig
   ];
-  buildInputs = lib.optional (simdutf != null) simdutf;
+  buildInputs = [
+    simdutf
+  ];
   checkInputs = [
     gtest
   ];

pkgs/by-name/mo/mongosh/package.nix

@@ -2,21 +2,21 @@
   lib,
   buildNpmPackage,
   fetchFromGitHub,
-  nodejs_22,
+  nodejs_24,
 }:
 
-buildNpmPackage.override { nodejs = nodejs_22; } (finalAttrs: {
+buildNpmPackage.override { nodejs = nodejs_24; } (finalAttrs: {
   pname = "mongosh";
-  version = "2.8.3";
+  version = "2.9.2";
 
   src = fetchFromGitHub {
     owner = "mongodb-js";
     repo = "mongosh";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-CHHGQYJBv1sVo2LT9jxx+c15TU8ecG9R5DVQOA9yG+A=";
+    hash = "sha256-mwc9Mv8BJgI/7DzUH6QwHsWzgAquB8ehmnElM5+mYuI=";
   };
 
-  npmDepsHash = "sha256-FlVKJqXiDW3FdBrm2lN2vw+xFkvm7J1FgCEI6rFfR4o=";
+  npmDepsHash = "sha256-xI+6a0sMuZmij46N5aqsprLLiVaSZifGW8tMq189fww=";
 
   patches = [
     ./disable-telemetry.patch

pkgs/by-name/n8/n8n/package.nix

@@ -26,20 +26,20 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "n8n";
-  version = "2.27.4";
+  version = "2.28.6";
 
   src = fetchFromGitHub {
     owner = "n8n-io";
     repo = "n8n";
     tag = "n8n@${finalAttrs.version}";
-    hash = "sha256-Z8oAetoSJLTCO7UO+DrlSDFAIjLSLND9bQzrcLz0hYg=";
+    hash = "sha256-xll2dZon+WyJUXaCoel0htwgOGUqzpZvef/tDLTomZQ=";
   };
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
     pnpm = pnpm_10;
     fetcherVersion = 3;
-    hash = "sha256-xTZlv8YZC8u9pzD/WroduyO2MVtRvZ7ajKTphsHfObs=";
+    hash = "sha256-SjmKXjxIuRY1uFbFLTMlXd0WW+3cVfu4TU+NoZtEYSo=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/na/nasm/package.nix

@@ -9,20 +9,23 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "nasm";
-  version = "3.02";
+  version = "3.01";
 
   src = fetchurl {
     url = "https://www.nasm.us/pub/nasm/releasebuilds/${finalAttrs.version}/nasm-${finalAttrs.version}.tar.xz";
-    hash = "sha256-hzNuulO0rP6RdCSrXVANKwBU2fUUjTXCJzzPLPtxLw0=";
+    hash = "sha256-tzJMvobnZ7ZfJvRn7YsSrYDhJOPMuJB2hVyY5Dqe3dQ=";
   };
 
   patches = [
-    # Backport the fix for https://github.com/netwide-assembler/nasm/issues/203
-    # buffer overflow.
+    # Backport patches fixing nasm with gcc 15 and musl (and other?) platforms
+    # https://github.com/netwide-assembler/nasm/issues/169
     (fetchpatch {
-      name = "output-oob-fix.patch";
-      url = "https://github.com/netwide-assembler/nasm/commit/8890d723d0aa9ed1a790e2ce1c55eee8dfa0cf94.patch";
-      hash = "sha256-m03+bhKTgKlqeRLGZIy6GO5BTPIJ3r398VQrtN4waaw=";
+      url = "https://github.com/netwide-assembler/nasm/commit/44e89ba9b650b5e1533bca43682e167f51a3511f.patch";
+      hash = "sha256-zVeMFhoSY/HGYr4meIWBgt5Unq1fA8lM6h1Cl5fpbxo=";
+    })
+    (fetchpatch {
+      url = "https://github.com/netwide-assembler/nasm/commit/746e7c9efa37cec9a44d84a1e96b8c38f385cc1f.patch";
+      hash = "sha256-aXVS70O/wUkW8xtkwF7uwrQfTgGcNvxHrtGC0sjIPto=";
     })
   ];
 

pkgs/by-name/ne/neo-cowsay/package.nix

@@ -15,7 +15,6 @@ buildGoModule (finalAttrs: {
     hash = "sha256-DmIjqBTIzwkQ8aJ6xCgIwjDtczlTH5AKbPKFUGx3qQ8=";
   };
 
-  __structuredAttrs = true;
   vendorHash = "sha256-gBURmodXkod4fukw6LWEY+MBxPcf4vn/f6K78UR77n0=";
 
   modRoot = "./cmd";

pkgs/by-name/ne/nerva/package.nix

@@ -6,13 +6,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "nerva";
-  version = "1.38.0";
+  version = "1.39.0";
 
   src = fetchFromGitHub {
     owner = "praetorian-inc";
     repo = "nerva";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-7d6sib2nr1LZty3KRRAhvrOIVQr2KFQTvtoHNmte4Kc=";
+    hash = "sha256-SdSgBjbxsrnFuHVVa3yewzT9LTh6E2lW1rmZoWftVyg=";
   };
 
   vendorHash = "sha256-Z0MSD+1/1VzrJ+pz5x0JvxrCxtJe59ckaTqHK/+TVN8=";

pkgs/by-name/ni/nixos-render-docs/src/nixos_render_docs/commonmark.py

@@ -3,6 +3,7 @@ from dataclasses import dataclass
 from typing import cast, Optional
 
 from .md import md_escape, md_make_code, Renderer
+from .types import AdmonitionStyle
 
 from markdown_it.token import Token
 
@@ -20,12 +21,16 @@ class Par:
 class CommonMarkRenderer(Renderer):
     __output__ = "commonmark"
 
+    _admonition_style: AdmonitionStyle
+    _div_fence_sizes: list[int]
     _parstack: list[Par]
     _link_stack: list[str]
     _list_stack: list[List]
 
-    def __init__(self, manpage_urls: Mapping[str, str]):
+    def __init__(self, manpage_urls: Mapping[str, str], admonition_style: AdmonitionStyle = AdmonitionStyle.PLAIN):
         super().__init__(manpage_urls)
+        self._admonition_style = admonition_style
+        self._div_fence_sizes = [ ]
         self._parstack = [ Par("") ]
         self._link_stack = []
         self._list_stack = []
@@ -43,12 +48,46 @@ class CommonMarkRenderer(Renderer):
         self._parstack[-1].continuing = True
         return result
 
-    def _admonition_open(self, kind: str) -> str:
+    def _fenced_div_open(self, classes: Sequence[str] = ()) -> str:
+        fence_size = (
+            self._div_fence_sizes[-1] + 1
+            if self._div_fence_sizes
+            else 3
+        )
+        fence = ":" * fence_size
+        class_refs = [f".{c}" for c in classes]
+        annotation = (" {" + " ".join(class_refs) + "}") if classes else ""
         pbreak = self._maybe_parbreak()
-        self._enter_block("")
-        return f"{pbreak}**{kind}:** "
+        self._div_fence_sizes.append(fence_size)
+        return f"{pbreak}{fence}{annotation}"
+    def _fenced_div_close(self) -> str:
+        fence_size = self._div_fence_sizes.pop()
+        fence = ":" * fence_size
+        pbreak = self._maybe_parbreak()
+        return f"{pbreak}{fence}"
+
+    def _admonition_open(self, kind: str) -> str:
+        match self._admonition_style:
+            case AdmonitionStyle.PLAIN:
+                pbreak = self._maybe_parbreak()
+                self._enter_block("")
+                return f"{pbreak}**{kind}:** "
+            case AdmonitionStyle.GFM:
+                pbreak = self._maybe_parbreak()
+                lbreak = self._break()
+                self._enter_block("> ")
+                return f"{pbreak}> [!{kind}]{lbreak}> "
+            case AdmonitionStyle.PANDOC:
+                return self._fenced_div_open(classes=[kind.lower()])
+
     def _admonition_close(self) -> str:
-        self._leave_block()
+        match self._admonition_style:
+            case AdmonitionStyle.PLAIN:
+                self._leave_block()
+            case AdmonitionStyle.GFM:
+                self._leave_block()
+            case AdmonitionStyle.PANDOC:
+                return self._fenced_div_close()
         return ""
 
     def _indent_raw(self, s: str) -> str:

pkgs/by-name/ni/nixos-render-docs/src/nixos_render_docs/md.py

@@ -579,6 +579,58 @@ def _block_titles(block: str) -> Callable[[markdown_it.MarkdownIt], None]:
 
     return do_add
 
+
+def _gfm_alerts(md: markdown_it.MarkdownIt) -> None:
+
+    _ALERT_PATTERN = re.compile(r"^\[\!(TIP|NOTE|IMPORTANT|WARNING|CAUTION)\][ \t]*(?:\n|$)", re.IGNORECASE)
+
+    @dataclasses.dataclass
+    class Entry:
+        open: Token
+        content: Token | None = None
+
+    """
+    Find blockquote tokens and convert GFM-alert-style blockquotes to admonition tokens.
+    """
+    def gfm_alert(state: markdown_it.rules_core.StateCore) -> None:
+        stack: list[Entry] = []
+        size = len(state.tokens)
+
+        for i, token in enumerate(state.tokens):
+            match token.type:
+                case "blockquote_open":
+                    entry = Entry(token)
+                    # Get the first inline token of the blockquote's first paragraph
+                    if i + 2 < size:
+                        para = state.tokens[i + 1]
+                        inline = state.tokens[i + 2]
+                        if para and para.type == "paragraph_open" and inline and inline.type == "inline":
+                            entry.content = inline
+                    stack.append(entry)
+
+                case "blockquote_close":
+                    entry = stack.pop()
+
+                    if entry.content is None:
+                        continue
+
+                    m = _ALERT_PATTERN.match(entry.content.content)
+                    if m is None:
+                        continue
+
+                    # Remove the alert marker from the rendered text.
+                    entry.content.content = entry.content.content[m.end() :]
+
+                    # Rewrite the enclosing blockquote as an admonition.
+                    entry.open.type = "admonition_open"
+                    entry.open.tag = "div"
+                    entry.open.meta["kind"] = m.group(1).lower()
+                    token.type = "admonition_close"
+                    token.tag = "div"
+
+    md.core.ruler.after("block", "github-alerts", gfm_alert)
+
+
 TR = TypeVar('TR', bound='Renderer')
 
 class Converter(ABC, Generic[TR]):
@@ -626,6 +678,7 @@ class Converter(ABC, Generic[TR]):
         self._md.use(_block_attr)
         self._md.use(_block_titles("example"))
         self._md.use(_block_titles("figure"))
+        self._md.use(_gfm_alerts)
         self._md.enable(["smartquotes", "replacements"])
 
     def _parse(self, src: str) -> list[Token]:

pkgs/by-name/ni/nixos-render-docs/src/nixos_render_docs/options.py

@@ -21,7 +21,7 @@ from .html import HTMLRenderer
 from .manpage import ManpageRenderer, man_escape
 from .manual_structure import make_xml_id, XrefTarget
 from .md import Converter, md_escape, md_make_code
-from .types import OptionLoc, Option, RenderedOption, AnchorStyle
+from .types import OptionLoc, Option, RenderedOption, AnchorStyle, AdmonitionStyle
 
 def option_is(option: Option, key: str, typ: str) -> Optional[dict[str, str]]:
     if key not in option:
@@ -317,18 +317,20 @@ class OptionsCommonMarkRenderer(OptionDocsRestrictions, CommonMarkRenderer):
 
 class CommonMarkConverter(BaseConverter[OptionsCommonMarkRenderer]):
     __option_block_separator__ = ""
+    _admonition_style: AdmonitionStyle
     _anchor_style: AnchorStyle
     _anchor_prefix: str
 
 
-    def __init__(self, manpage_urls: Mapping[str, str], revision: str, anchor_style: AnchorStyle = AnchorStyle.NONE, anchor_prefix: str = ""):
+    def __init__(self, manpage_urls: Mapping[str, str], revision: str, anchor_style: AnchorStyle = AnchorStyle.NONE, anchor_prefix: str = "", admonition_style: AdmonitionStyle = AdmonitionStyle.PLAIN):
         super().__init__(revision)
-        self._renderer = OptionsCommonMarkRenderer(manpage_urls)
+        self._renderer = OptionsCommonMarkRenderer(manpage_urls, admonition_style)
+        self._admonition_style = admonition_style
         self._anchor_style = anchor_style
         self._anchor_prefix = anchor_prefix
 
     def _parallel_render_prepare(self) -> Any:
-        return (self._renderer._manpage_urls, self._revision)
+        return (self._renderer._manpage_urls, self._revision, self._anchor_style, self._anchor_prefix, self._admonition_style)
     @classmethod
     def _parallel_render_init_worker(cls, a: Any) -> CommonMarkConverter:
         return cls(*a)
@@ -514,6 +516,15 @@ def parse_anchor_style(value: str|AnchorStyle) -> AnchorStyle:
     except ValueError:
         raise argparse.ArgumentTypeError(f"Invalid value {value}\nExpected one of {', '.join(style.value for style in AnchorStyle)}")
 
+def parse_admonition_style(value: str|AdmonitionStyle) -> AdmonitionStyle:
+    if isinstance(value, AdmonitionStyle):
+        # Used by `argparse.add_argument`'s `default`
+        return value
+    try:
+        return AdmonitionStyle(value.lower())
+    except ValueError:
+        raise argparse.ArgumentTypeError(f"Invalid value {value}\nExpected one of {', '.join(style.value for style in AdmonitionStyle)}")
+
 def _build_cli_commonmark(p: argparse.ArgumentParser) -> None:
     p.add_argument('--manpage-urls', required=True)
     p.add_argument('--revision', required=True)
@@ -529,6 +540,13 @@ def _build_cli_commonmark(p: argparse.ArgumentParser) -> None:
         default="",
         help="(default: no prefix) String to prepend to anchor ids. Not used when anchor style is none."
     )
+    p.add_argument(
+        '--admonition-style',
+        required=False,
+        default=AdmonitionStyle.PLAIN.value,
+        choices = [style.value for style in AdmonitionStyle],
+        help = "(default: %(default)s) Admonition style to use for notes, warnings, etc. \nOnly plain is standard CommonMark."
+    )
     p.add_argument("infile")
     p.add_argument("outfile")
 
@@ -566,7 +584,9 @@ def _run_cli_commonmark(args: argparse.Namespace) -> None:
         md = CommonMarkConverter(json.load(manpage_urls),
             revision = args.revision,
             anchor_style = parse_anchor_style(args.anchor_style),
-            anchor_prefix = args.anchor_prefix)
+            anchor_prefix = args.anchor_prefix,
+            admonition_style = parse_admonition_style(args.admonition_style),
+         )
 
         with open(args.infile, 'r') as f:
             md.add_options(json.load(f))

pkgs/by-name/ni/nixos-render-docs/src/nixos_render_docs/types.py

@@ -17,3 +17,8 @@ RenderFn = Callable[[Token, Sequence[Token], int], str]
 class AnchorStyle(Enum):
     NONE = "none"
     LEGACY = "legacy"
+
+class AdmonitionStyle(Enum):
+    PLAIN = "plain"
+    PANDOC = "pandoc"
+    GFM = "gfm"

pkgs/by-name/ni/nixos-render-docs/src/tests/sample_md.py

@@ -1,4 +1,10 @@
 sample1 = """\
+> [!NOTE]
+> This is a *GFM* note.
+>
+> > [!caution]
+> > This is a **nested** GFM alert.
+
 :::: {.warning}
 foo
 ::: {.note}

pkgs/by-name/ni/nixos-render-docs/src/tests/sample_options_admonition.json

@@ -0,0 +1,17 @@
+{
+  "services.frobnicator.types.<name>.enable": {
+    "declarations": [
+      "nixos/modules/services/frobnicator.nix"
+    ],
+    "description": "Whether to enable the frobnication of this (`<name>`) type.\n::: {.important}\n\nAdmonition.\n\n:::",
+    "loc": [
+      "services",
+      "frobnicator",
+      "types",
+      "<name>",
+      "enable"
+    ],
+    "readOnly": false,
+    "type": "boolean"
+  }
+}

pkgs/by-name/ni/nixos-render-docs/src/tests/sample_options_admonition_gfm.md

@@ -0,0 +1,16 @@
+## services\.frobnicator\.types\.\<name>\.enable
+
+Whether to enable the frobnication of this (` <name> `) type\.
+
+> [!Important]
+> Admonition\.
+
+
+
+*Type:*
+boolean
+
+*Declared by:*
+ - [\<nixpkgs/nixos/modules/services/frobnicator\.nix>](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/frobnicator.nix)
+
+

pkgs/by-name/ni/nixos-render-docs/src/tests/sample_options_admonition_pandoc.md

@@ -0,0 +1,19 @@
+## services\.frobnicator\.types\.\<name>\.enable
+
+Whether to enable the frobnication of this (` <name> `) type\.
+
+::: {.important}
+
+Admonition\.
+
+:::
+
+
+
+*Type:*
+boolean
+
+*Declared by:*
+ - [\<nixpkgs/nixos/modules/services/frobnicator\.nix>](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/frobnicator.nix)
+
+

pkgs/by-name/ni/nixos-render-docs/src/tests/sample_options_admonition_plain.md

@@ -0,0 +1,15 @@
+## services\.frobnicator\.types\.\<name>\.enable
+
+Whether to enable the frobnication of this (` <name> `) type\.
+
+**Important:** Admonition\.
+
+
+
+*Type:*
+boolean
+
+*Declared by:*
+ - [\<nixpkgs/nixos/modules/services/frobnicator\.nix>](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/frobnicator.nix)
+
+

pkgs/by-name/ni/nixos-render-docs/src/tests/test_asciidoc.py

@@ -45,6 +45,18 @@ f
 def test_full() -> None:
     c = Converter({ 'man(1)': 'http://example.org' })
     assert c._render(sample1) == """\
+[NOTE]
+====
+This is a __GFM__ note{zwsp}.
+
+[CAUTION]
+=====
+This is a **nested** GFM alert{zwsp}.
+=====
+
+====
+
+
 [WARNING]
 ====
 foo

pkgs/by-name/ni/nixos-render-docs/src/tests/test_commonmark.py

@@ -1,3 +1,5 @@
+import pytest
+
 import nixos_render_docs as nrd
 
 from sample_md import sample1
@@ -6,9 +8,14 @@ from typing import Mapping
 
 
 class Converter(nrd.md.Converter[nrd.commonmark.CommonMarkRenderer]):
-    def __init__(self, manpage_urls: Mapping[str, str]):
+    def __init__(
+        self,
+        manpage_urls: Mapping[str, str],
+        admonition_style: nrd.types.AdmonitionStyle = nrd.types.AdmonitionStyle.PLAIN,
+    ):
         super().__init__()
-        self._renderer = nrd.commonmark.CommonMarkRenderer(manpage_urls)
+        self._renderer = nrd.commonmark.CommonMarkRenderer(manpage_urls, admonition_style)
+
 
 # NOTE: in these tests we represent trailing spaces by ` ` and replace them with real space later,
 # since a number of editors will strip trailing whitespace on save and that would break the tests.
@@ -24,9 +31,132 @@ def test_indented_fence() -> None:
 """.replace(' ', ' ')
     assert c._render(s) == s
 
+
+@pytest.mark.parametrize(
+    ("style", "expected"),
+    [
+        (
+            nrd.types.AdmonitionStyle.PLAIN,
+            """\
+**Warning:** foo
+
+**Note:** nested
+
+**Important:** nested GFM
+
+:::
+
+**Caution:** GFM caution
+
+**Important:** nested fenced
+
+**Note:** nested GFM\
+""",
+        ),
+        (
+            nrd.types.AdmonitionStyle.GFM,
+            f"""\
+> [!Warning]
+> foo
+>{" "}
+> > [!Note]
+> > nested
+
+> [!Important]
+> nested GFM
+
+:::
+
+> [!Caution]
+> GFM caution
+>{" "}
+> > [!Important]
+> > nested fenced
+>{" "}
+> > [!Note]
+> > nested GFM\
+""",
+        ),
+        (
+            nrd.types.AdmonitionStyle.PANDOC,
+            """\
+::: {.warning}
+
+foo
+
+:::: {.note}
+
+nested
+
+::::
+
+:::
+
+::: {.important}
+
+nested GFM
+
+:::
+
+:::
+
+::: {.caution}
+
+GFM caution
+
+:::: {.important}
+
+nested fenced
+
+::::
+
+:::: {.note}
+
+nested GFM
+
+::::
+
+:::""",
+        ),
+    ],
+)
+def test_admonition_styles(
+    style: nrd.types.AdmonitionStyle,
+    expected: str,
+) -> None:
+    c = Converter({}, admonition_style=style)
+    assert c._render("""\
+:::: {.warning}
+foo
+::: {.note}
+nested
+:::
+::::
+
+> [!important]
+> nested GFM
+
+:::
+
+> [!caution]
+> GFM caution
+>
+> ::: {.important}
+> nested fenced
+> :::
+>
+> > [!note]
+> > nested GFM
+""") == expected
+
+
 def test_full() -> None:
     c = Converter({ 'man(1)': 'http://example.org' })
     assert c._render(sample1) == """\
+**Note:** This is a *GFM* note\\.
+
+**Caution:** This is a **nested** GFM alert\\.
+
 **Warning:** foo
 
 **Note:** nested

pkgs/by-name/ni/nixos-render-docs/src/tests/test_html.py

@@ -149,6 +149,14 @@ def test_footnotes() -> None:
 def test_full() -> None:
     c = Converter({ 'man(1)': 'http://example.org' }, {})
     assert c._render(sample1) == unpretty("""
+        <div class="note">
+          <h3 class="title">Note</h3>
+          <p>This is a <span class="emphasis"><em>GFM</em></span> note.</p>
+          <div class="caution">
+            <h3 class="title">Caution</h3>
+            <p>This is a <span class="strong"><strong>nested</strong></span> GFM alert.</p>
+          </div>
+        </div>
         <div class="warning">
          <h3 class="title">Warning</h3>
          <p>foo</p>

pkgs/by-name/ni/nixos-render-docs/src/tests/test_manpage.py

@@ -41,6 +41,18 @@ def test_full() -> None:
     assert c._render(sample1) == """\
 .sp
 .RS 4
+\\fBNote\\fP
+.br
+This is a \\fIGFM\\fR note\\&.
+.sp
+.RS 4
+\\fBCaution\\fP
+.br
+This is a \\fBnested\\fR GFM alert\\&.
+.RE
+.RE
+.sp
+.RS 4
 \\fBWarning\\fP
 .br
 foo

pkgs/by-name/ni/nixos-render-docs/src/tests/test_options.py

@@ -39,3 +39,31 @@ def test_options_commonmark_legacy_anchors() -> None:
     c.add_options(opts)
     s = c.finalize()
     assert s == expected
+
+@pytest.mark.parametrize(
+    ("style", "expected_file"),
+    [
+        (nixos_render_docs.types.AdmonitionStyle.PLAIN,
+         "tests/sample_options_admonition_plain.md"),
+        (nixos_render_docs.types.AdmonitionStyle.GFM,
+         "tests/sample_options_admonition_gfm.md"),
+        (nixos_render_docs.types.AdmonitionStyle.PANDOC,
+         "tests/sample_options_admonition_pandoc.md"),
+    ],
+)
+def test_options_commonmark_admonition_style(style, expected_file):
+    c = nixos_render_docs.options.CommonMarkConverter(
+        {},
+        "local",
+        admonition_style=style,
+    )
+
+    with Path("tests/sample_options_admonition.json").open() as f:
+        opts = json.load(f)
+
+    with Path(expected_file).open() as f:
+        expected = f.read()
+
+    c.add_options(opts)
+
+    assert c.finalize() == expected

pkgs/by-name/ni/nixos-render-docs/src/tests/test_plugins.py

@@ -429,6 +429,90 @@ def test_admonitions() -> None:
               children=None, content='', markup=':::', info='', meta={}, block=True, hidden=False)
     ]
 
+@pytest.mark.parametrize(
+    ("alert", "kind"),
+    [
+        ("NOTE", "note"),
+        ("TIP", "tip"),
+        ("IMPORTANT", "important"),
+        ("WARNING", "warning"),
+        ("CAUTION", "caution"),
+    ],
+)
+def test_gfm_alert_kinds(alert: str, kind: str) -> None:
+    c = Converter({})
+    assert c._parse(f"> [!{alert}]\n> body") == [
+        Token(type='admonition_open', tag='div', markup='>', meta={'kind': kind}, nesting=1, map=[0, 2], block=True),
+        Token(type='paragraph_open', tag='p', nesting=1, map=[0, 2], level=1, block=True),
+        Token(type='inline', tag='', nesting=0, map=[0, 2], level=2, block=True, content='body', children=[
+            Token(type='text', tag='', nesting=0, content='body'),
+        ]),
+        Token(type='paragraph_close', tag='p', nesting=-1, level=1, block=True),
+        Token(type='admonition_close', tag='div', nesting=-1, markup='>', block=True)
+    ]
+
+def test_gfm_alert_basic_structure_preserved() -> None:
+    c = Converter({})
+    tokens = c._parse("> [!NOTE]\n> body text")
+    assert any(t.type == "inline" for t in tokens)
+
+@pytest.mark.parametrize(
+    "md",
+    [
+        "> # [!NOTE]",
+        "> - [!NOTE]",
+        "> - [!WARNING] body",
+        "> ### [!TIP]",
+        "> ```\n> [!NOTE]\n> ```",
+        "> This is not [!NOTE] an alert",
+        "> [!NOTE] with trailing text is ignored",
+    ],
+)
+def test_gfm_alert_rejected(md: str) -> None:
+    c = Converter({})
+    tokens = c._parse(md)
+    assert all(t.type != "admonition_open" for t in tokens)
+    assert tokens[0].type == "blockquote_open"
+    assert tokens[-1].type == "blockquote_close"
+
+def test_gfm_alert_multi_paragraph() -> None:
+    c = Converter({})
+    assert c._parse(
+        "> [!NOTE]\n"
+        "> line 1\n"
+        ">\n"
+        "> line 2"
+    ) == [
+        Token(type='admonition_open', tag='div', markup='>', meta={'kind': 'note'}, nesting=1, map=[0, 4], block=True),
+        Token(type='paragraph_open', tag='p', nesting=1, map=[0, 2], level=1, block=True),
+        Token(type='inline', tag='', nesting=0, map=[0, 2], level=2, block=True, content='line 1', children=[
+            Token(type='text', tag='', nesting=0, content='line 1'),
+        ]),
+        Token(type='paragraph_close', tag='p', nesting=-1, level=1, block=True),
+        Token(type='paragraph_open', tag='p', nesting=1, map=[3, 4], level=1, block=True),
+        Token(type='inline', tag='', nesting=0, map=[3, 4], level=2, block=True, content='line 2', children=[
+            Token(type='text', tag='', nesting=0, content='line 2')
+        ]),
+        Token(type='paragraph_close', tag='p', nesting=-1, level=1, block=True),
+        Token(type='admonition_close', tag='div', markup='>', block=True, nesting=-1),
+    ]
+
+def test_gfm_alert_whitespace_tolerant() -> None:
+    c = Converter({})
+    tokens = c._parse("> [!NOTE]   \n> body")
+    assert tokens[0].type == "admonition_open"
+    assert tokens[0].meta["kind"] == "note"
+
+def test_gfm_alert_empty_body_allowed() -> None:
+    c = Converter({})
+    assert c._parse("> [!NOTE]\n>") == [
+        Token(type='admonition_open', tag='div', markup='>', meta={'kind': 'note'}, nesting=1, map=[0, 2], block=True),
+        Token(type='paragraph_open', tag='p', nesting=1, map=[0, 1], level=1, block=True),
+        Token(type='inline', tag='', nesting=0, map=[0, 1], level=2, block=True, children=[]),
+        Token(type='paragraph_close', tag='p', nesting=-1, level=1, block=True),
+        Token(type='admonition_close', tag='div', markup='>', nesting=-1, block=True),
+    ]
+
 def test_example() -> None:
     c = Converter({})
     assert c._parse("::: {.example}\n# foo") == [

pkgs/by-name/ns/nsd/package.nix

@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchurl,
+  removeReferencesTo,
   fstrm,
   libevent,
   openssl,
@@ -32,15 +33,26 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "nsd";
-  version = "4.14.3";
+  version = "4.15.0";
 
   src = fetchurl {
     url = "https://www.nlnetlabs.nl/downloads/nsd/nsd-${finalAttrs.version}.tar.gz";
-    hash = "sha256-limtZNnBsBm74iKW1RSNeuZfWIziZaZCR1B0DwUrsSs=";
+    hash = "sha256-hPG+4ukqna20HZXsxkET5NPe+GIk3ndM2SADrdjE9XA=";
   };
 
+  patches = [
+    # https://github.com/NLnetLabs/nsd/pull/495 -- Without this patch, the build
+    # breaks with { openssl = libressl; bind8Stats = true; }. The patch will be
+    # included in 4.15.1, so we can drop it here on the next update.
+    (fetchurl {
+      url = "https://github.com/NLnetLabs/nsd/commit/15cf8736e3bfa0fd8f426b13637c44e638fa0d40.patch";
+      hash = "sha256-JVazJ83U80ASZypjic0epE92PZd3F1yi8UU6EapdW5U=";
+    })
+  ];
+
   nativeBuildInputs = [
     pkg-config
+    removeReferencesTo
   ]
   ++ lib.optionals withDnstap [ protobuf ];
 
@@ -57,12 +69,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   enableParallelBuilding = true;
 
-  # TODO: prePatch doesn't actually get executed because patchPhase is overridden
-  prePatch = ''
-    substituteInPlace nsd-control-setup.sh.in --replace openssl ${openssl}/bin/openssl
-  '';
-
-  patchPhase = ''
+  # Prevent the install script from copying nsd.conf.sample into /etc/nsd.
+  postPatch = ''
     sed 's@$(INSTALL_DATA) nsd.conf.sample $(DESTDIR)$(nsdconfigfile).sample@@g' -i Makefile.in
   '';
 
@@ -90,6 +98,10 @@ stdenv.mkDerivation (finalAttrs: {
       "--with-configdir=etc/nsd"
     ];
 
+  postFixup = ''
+    find "$out" -type f -exec remove-references-to -t ${openssl.dev} -t ${libevent.dev} '{}' +
+  '';
+
   passthru.tests = {
     inherit (nixosTests) nsd;
   };

pkgs/by-name/op/openfortivpn-webview-qt/package.nix

@@ -2,23 +2,24 @@
   stdenv,
   lib,
   fetchFromGitHub,
+  cmake,
   qt6Packages,
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "openfortivpn-webview-qt";
-  version = "1.2.3";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "gm-vm";
     repo = "openfortivpn-webview";
-    rev = "v${finalAttrs.version}-electron";
-    hash = "sha256-jGDCFdqRfnYwUgVs3KO1pDr52JgkYVRHi2KvABaZFl4=";
+    rev = "v${finalAttrs.version}-qt";
+    hash = "sha256-TohrOgLzvxmUsRVV36XHgE9ul38CjU/qKF+LZOZQieE=";
   };
   sourceRoot = "${finalAttrs.src.name}/openfortivpn-webview-qt";
 
   nativeBuildInputs = [
+    cmake
     qt6Packages.wrapQtAppsHook
-    qt6Packages.qmake
   ];
   buildInputs = [ qt6Packages.qtwebengine ];
   installPhase = ''

pkgs/by-name/op/openomf/package.nix

@@ -6,7 +6,6 @@
   cmake,
   argtable,
   enet,
-  git,
   libconfuse,
   libnatpmp,
   libepoxy,
@@ -18,7 +17,8 @@
   SDL2_mixer,
   unzip,
   zlib,
-  withRemix ? true,
+  nix-update-script,
+  versionCheckHook,
 }:
 
 let
@@ -30,25 +30,42 @@ let
     url = "https://www.omf2097.com/pub/files/omf/openomf-icons.zip";
     hash = "sha256-8LWmrkY3ZiXcuVe0Zj90RQFUTwM27dJ4ev9TiBGoVk0=";
   };
-  remix = fetchurl {
-    url = "https://github.com/omf2097/openomf/releases/download/0.8.0/ARENA2.ogg";
-    hash = "sha256-jOIzDaIwQDlwCaPrRZdG5Y0g7bWKwc38mPKP030PGb4=";
+  musicRemixes = fetchurl {
+    url = "https://github.com/omf2097/openomf-music-mod/releases/download/1.0/openomf-mods-1.0.zip";
+    hash = "sha256-uiaM6n+dDcTeBNNnypEWXPNG8Xac1JQXCTfVkORfvi0=";
   };
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "openomf";
-  version = "0.8.5";
+  version = "0.8.6";
+
+  __structuredAttrs = true;
+  strictDeps = true;
 
   src = fetchFromGitHub {
     owner = "omf2097";
     repo = "openomf";
     tag = finalAttrs.version;
-    hash = "sha256-5X8drQKMwYZ5M/i7hxyI25AysQGedQ5BLEYcNXWHgNk=";
+    hash = "sha256-KzT2leU52nxUIsuiVM5soWmi+x1LStdxY5JLoCkSSb8=";
   };
 
+  postPatch = ''
+    # TODO: Take this upstream
+    substituteInPlace cmake-scripts/version.cmake \
+      --replace-fail "set(VERSION_MAJOR 0)" "set(VERSION_MAJOR ${lib.versions.major finalAttrs.version})" \
+      --replace-fail "set(VERSION_MINOR 0)" "set(VERSION_MINOR ${lib.versions.minor finalAttrs.version})" \
+      --replace-fail "set(VERSION_PATCH 0)" "set(VERSION_PATCH ${lib.versions.patch finalAttrs.version})" \
+      --replace-fail "set(VERSION_LABEL)" "set(VERSION_LABEL)
+      return()"
+
+    substituteInPlace src/resources/resource_paths.c \
+      --replace-fail \
+        "/usr/local/share/games:/usr/share/games:/usr/local/share:/usr/share" \
+        "$out/share/games"
+  '';
+
   nativeBuildInputs = [
     cmake
-    git
     unzip
   ];
 
@@ -69,20 +86,39 @@ stdenv.mkDerivation (finalAttrs: {
 
   postInstall = ''
     mkdir -p $out/share/icons/hicolor/256x256/apps
-    unzip -j ${assets} -d $out/share/games/openomf
+
+    unzip -j ${assets} -d $out/share/games/openomf/resources
+
+    unzip ${musicRemixes} -d $out/share/games/openomf/mods
+
     unzip -p ${icons} omf-logo/omf-256x256.png > $out/share/icons/hicolor/256x256/apps/org.openomf.OpenOMF.png
     install -Dm644 $src/resources/flatpak/org.openomf.OpenOMF.desktop $out/share/applications/org.openomf.OpenOMF.desktop
-  ''
-  + lib.optionalString withRemix ''
-    ln -s ${remix} $out/share/games/openomf/ARENA2.ogg
-  ''
-  + lib.optionalString stdenv.hostPlatform.isDarwin ''
-    mkdir -p $out/resources
-    ln -s $out/share/games/openomf/* $out/resources
   '';
 
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     description = "One Must Fall 2097 Remake";
+    longDescription = ''
+      OpenOMF is an open-source remake of the 1994 DOS fighting game One Must
+      Fall 2097 by Diversions Entertainment. It reimplements the original
+      engine from scratch, uses the original (now freeware) game assets, and
+      adds modern conveniences such as online netplay.
+
+      Includes remixed music mod. To add other mods: drop its .zip file
+      into the user mods directory as-is; it does not need to be extracted.
+
+      The user mods directory is <state>/mods, where <state> is resolved at
+      launch in the following order.
+
+        1. $OPENOMF_STATE_PATH, if set
+        2. $XDG_STATE_HOME, if set
+           (e.g. ~/.local/state, giving ~/.local/state/mods)
+        3. SDL's preference path, ~/.local/share/OpenOMF/mods
+    '';
     homepage = "https://www.openomf.org";
     changelog = "https://github.com/omf2097/openomf/releases/tag/${finalAttrs.version}/CHANGELOG.md";
     license = lib.licenses.mit;

pkgs/by-name/os/osquery/info.json

@@ -5,9 +5,9 @@
     },
     "osquery": {
         "fetchSubmodules": true,
-        "hash": "sha256-m66JfsC1+YU1k3BKEwHx6jmqpRleaqP6f8M/NXJU8dg=",
+        "hash": "sha256-UeA3xnaNkOLFmNq4mgZM4f2BX0cidtantaSxgy/ahlk=",
         "owner": "osquery",
         "repo": "osquery",
-        "rev": "5.23.0"
+        "rev": "5.23.1"
     }
 }

pkgs/by-name/pc/pcre2/package.nix

@@ -8,19 +8,15 @@
   withJitSealloc ? !(stdenv.hostPlatform.isPower64 && stdenv.hostPlatform.isAbiElfv1),
 }:
 
-stdenv.mkDerivation (finalAttrs: {
+stdenv.mkDerivation rec {
   pname = "pcre2";
-  version = "10.47";
+  version = "10.46";
 
   src = fetchurl {
-    url = "https://github.com/PCRE2Project/pcre2/releases/download/pcre2-${finalAttrs.version}/pcre2-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-R/6MmUYSUNQviebo/a66naBXhV0G63/AjZygP9CNe8c=";
+    url = "https://github.com/PhilipHazel/pcre2/releases/download/pcre2-${version}/pcre2-${version}.tar.bz2";
+    hash = "sha256-FfvFq6a+7gsXrssEYCrjlDI5OroevY45t8q/fbiDKZ8=";
   };
 
-  __structuredAttrs = true;
-  strictDeps = true;
-  enableParallelBuilding = true;
-
   nativeBuildInputs = [ updateAutotoolsGnuConfigScriptsHook ];
 
   configureFlags = [
@@ -47,7 +43,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     homepage = "https://www.pcre.org/";
-    changelog = "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-${finalAttrs.version}";
     description = "Perl Compatible Regular Expressions";
     license = lib.licenses.bsd3;
     maintainers = [ ];
@@ -58,6 +53,6 @@ stdenv.mkDerivation (finalAttrs: {
       "libpcre2-16"
       "libpcre2-32"
     ];
-    identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "pcre" finalAttrs.version;
+    identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "pcre" version;
   };
-})
+}

pkgs/by-name/pl/playonlinux/package.nix

@@ -11,7 +11,7 @@
   mesa-demos,
   netcat-gnu,
   p7zip,
-  python3,
+  python312,
   unzip,
   wget,
   wine,
@@ -70,7 +70,7 @@ let
       libGL
     ];
 
-  python = python3.withPackages (
+  python = python312.withPackages (
     ps: with ps; [
       wxpython
       setuptools

pkgs/by-name/pr/praat/package.nix

@@ -8,18 +8,17 @@
   stdenv,
   wrapGAppsHook3,
   libjack2,
-  iconConvTools,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "praat";
-  version = "6.4.65";
+  version = "6.6.30";
 
   src = fetchFromGitHub {
     owner = "praat";
     repo = "praat.github.io";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-v4cAFLSJllrNgTm6ewR40HYvdi8a1bZcEBz/BTdFsxA=";
+    hash = "sha256-D6XnrN+pvUpgUcgyU8pEtuOx2cIMoSm8Px0+f5xi1aM=";
   };
 
   strictDeps = true;
@@ -27,7 +26,6 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [
     pkg-config
     wrapGAppsHook3
-    iconConvTools
   ];
 
   buildInputs = [
@@ -41,27 +39,15 @@ stdenv.mkDerivation (finalAttrs: {
     "AR=${stdenv.cc.targetPrefix}ar"
   ];
 
-  configurePhase = ''
-    runHook preConfigure
-
-    cp makefiles/makefile.defs.linux.pulse-gcc makefile.defs
-
-    runHook postConfigure
-  '';
-
-  installPhase = ''
-    runHook preInstall
-
-    install -Dt $out/bin praat
-    install -Dm444 main/praat.desktop -t $out/share/applications
-    icoFileToHiColorTheme main/praat.ico praat $out
-    install -Dm444 main/praat-480.svg $out/share/icons/hicolor/scalable/apps/praat.svg
-
-    runHook postInstall
-  '';
+  buildFlags = [ "PRAAT_AUDIO=pulse" ];
+  installFlags = [ "PREFIX=${placeholder "out"}" ];
 
   enableParallelBuilding = true;
 
+  postInstall = ''
+    mv $out/share/applications/org.praat.Praat.desktop $out/share/applications/praat.desktop
+  '';
+
   meta = {
     description = "Doing phonetics by computer";
     mainProgram = "praat";

pkgs/by-name/ps/psqlodbc/package.nix

@@ -18,13 +18,13 @@ assert lib.xor withLibiodbc withUnixODBC;
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "psqlodbc";
-  version = "18.00.0002";
+  version = "18.00.0001";
 
   src = fetchFromGitHub {
     owner = "postgresql-interfaces";
     repo = "psqlodbc";
     tag = "REL-${lib.replaceString "." "_" finalAttrs.version}";
-    hash = "sha256-qzbyo9P/o784Ux3KDA8NDMbcm0EbnfG8LiBLRk6n698=";
+    hash = "sha256-gCacZjP0FkCEuZRBfawZ2B3BcjR/sV1fypuT8XD2l+A=";
   };
 
   buildInputs = [

pkgs/by-name/pu/publicsuffix-list/package.nix

@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "publicsuffix-list";
-  version = "0-unstable-2026-06-24";
+  version = "0-unstable-2026-05-13";
 
   src = fetchFromGitHub {
     owner = "publicsuffix";
     repo = "list";
-    rev = "18ecca5d54471f21918798da451dd8d03a18f3c7";
-    hash = "sha256-xvOAZpWhuOU3koEHgNfVK6aHy+VMYRoHj3fq9PxaAFo=";
+    rev = "e452c7058d6946bd76952b128c12f5ce87a5acb8";
+    hash = "sha256-5D4RZAyJOL4hMU32Rmp3SYmjgqEtF36mZJr4YBG0k7E=";
   };
 
   dontBuild = true;

pkgs/by-name/re/remnote/package.nix

@@ -7,10 +7,10 @@
 }:
 let
   pname = "remnote";
-  version = "1.26.20";
+  version = "1.26.30";
   src = fetchurl {
     url = "https://download2.remnote.io/remnote-desktop2/RemNote-${version}.AppImage";
-    hash = "sha256-3/gb/7LO18exAmFYzzfJM7lCbMPrVqCcD32LfkVIO5g=";
+    hash = "sha256-GNUoyor7P3icfHurlwttn+TyAhiOvjYhFckMCiNW/Mk=";
   };
   appimageContents = appimageTools.extract { inherit pname version src; };
 in

pkgs/by-name/ro/rocketchat-desktop/package.nix

@@ -21,13 +21,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "rocketchat-desktop";
-  version = "4.15.0";
+  version = "4.15.2";
 
   src = fetchFromGitHub {
     owner = "RocketChat";
     repo = "Rocket.Chat.Electron";
     tag = finalAttrs.version;
-    hash = "sha256-2ko2medsG0C6uq8Lp7ej2RgEgA7OIDsVlMG2BD1ENcM=";
+    hash = "sha256-wme3RKGaHuoOf7yyXH3PZ/0xL73LqS9rPqL8IcxyAkA=";
   };
 
   patches = [
@@ -42,7 +42,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   offlineCache = yarn-berry.fetchYarnBerryDeps {
     inherit (finalAttrs) src missingHashes patches;
-    hash = "sha256-WfIY3kCVsL7rXbXiH7OTuiIZmGs7itdK2DG4onua3Bc=";
+    hash = "sha256-XYfC5K7oXVjxP6Ndlc3qYb47Zh3GnwPx7c4+vBiA2AI=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/sd/sdl3/package.nix

@@ -73,7 +73,7 @@ assert lib.assertMsg (ibusSupport -> dbusSupport) "SDL3 requires dbus support to
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "sdl3";
-  version = "3.4.12";
+  version = "3.4.10";
 
   outputs = [
     "lib"
@@ -86,7 +86,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "libsdl-org";
     repo = "SDL";
     tag = "release-${finalAttrs.version}";
-    hash = "sha256-b6l3HgdhqIe9LazJmLivbCJgbKPAS8S54fuB9xvgalI=";
+    hash = "sha256-6Dph2eLiJUmpQzPWe8EuY5LrWhrFwde2f2dwfgCcWNw=";
   };
 
   postPatch =

pkgs/by-name/se/serd/package.nix

@@ -15,7 +15,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "serd";
-  version = "0.32.10";
+  version = "0.32.8";
 
   outputs = [
     "out"
@@ -26,7 +26,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://download.drobilla.net/serd-${finalAttrs.version}.tar.xz";
-    hash = "sha256-sOk7SeUvAaBJR1t4hu8UBAcRWjLTseXcX5UUHIgnXRw=";
+    hash = "sha256-9HJZvDi6VTsN64ttq2tbc9NjBGmnyUOczcqA4G18Hs4=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/sh/shen-sbcl/package.nix

@@ -10,15 +10,15 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "shen-sbcl";
-  version = "41.1";
+  version = "41.2";
 
   src = fetchzip {
-    url = "https://www.shenlanguage.org/Download/S${finalAttrs.version}.zip";
-    hash = "sha256-v/hlP23yfpkpFEDCTKYoxeMJbfR2qVF9LFUkqsFwo6g=";
+    url = "https://shenlanguage.org/Download/S${finalAttrs.version}.zip";
+    hash = "sha256-hgO/g0XefSXn5pjiV5LzGmoZ8nsqmZcyZpK6nbcE0es=";
   };
 
-  sourceRoot = "${finalAttrs.src.name}/S41";
   nativeBuildInputs = [ sbcl ];
+  strictDeps = true;
   dontStrip = true; # necessary to prevent runtime errors with sbcl
 
   buildPhase = ''
@@ -45,15 +45,11 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     # remove interactive prompts during image creation
     # shen/tk requires further configuration and isn't supported by default
     substituteInPlace Lib/install.shen \
-      --replace-fail '(y-or-n? "install standard library?")' '${
-        if installStandardLibrary then "true" else "false"
-      }' \
-      --replace-fail '(y-or-n? "install concurrency? (required for Shen/tk)")' '${
-        if installConcurrency then "true" else "false"
-      }' \
+      --replace-fail '(y-or-n? "install standard library?")' '${lib.boolToString installStandardLibrary}' \
+      --replace-fail '(y-or-n? "install concurrency? (required for Shen/tk)")' '${lib.boolToString installConcurrency}' \
       --replace-fail '(y-or-n? "install Shen/tk + IDE?")' 'false' \
-      --replace-fail '(y-or-n? "install THORN?")' '${if installThorn then "true" else "false"}' \
-      --replace-fail '(y-or-n? "install Logic Lab?")' '${if installLogicLab then "true" else "false"}'
+      --replace-fail '(y-or-n? "install THORN?")' '${lib.boolToString installThorn}' \
+      --replace-fail '(y-or-n? "install Logic Lab?")' '${lib.boolToString installLogicLab}'
   '';
 
   meta = {

pkgs/by-name/sn/snmpen/package.nix

@@ -7,14 +7,14 @@
 
 python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "snmpen";
-  version = "1.1.3";
+  version = "1.1.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "fabaff";
     repo = "snmpen";
     tag = finalAttrs.version;
-    hash = "sha256-XJP+f5Ahizxgk80B0896sbE6JeNB0Bm7aafwJsFaHYY=";
+    hash = "sha256-4/QLPq4td2o17lIhktl5aVKz5esWibVoVm8OdVIxWmM=";
   };
 
   build-system = with python3.pkgs; [ hatchling ];

pkgs/by-name/st/stash-clipboard/package.nix

@@ -0,0 +1,36 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  nix-update-script,
+}:
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "stash-clipboard";
+  version = "0.4.0";
+
+  src = fetchFromGitHub {
+    owner = "NotAShelf";
+    repo = "stash";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-L5UfPKzdU8qQIyXSCMglLhv22J7xInxg3NNKCLkxszM=";
+  };
+
+  cargoHash = "sha256-iXL3G1H8tNS1oPAoEvvx7qwWUef95NBU3dwlEe+34zw=";
+
+  __structuredAttrs = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Wayland clipboard manager with fast persistent history and multi-media support";
+    homepage = "https://github.com/NotAShelf/stash";
+    changelog = "https://github.com/NotAShelf/stash/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mpl20;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [
+      NotAShelf
+      fazzi
+    ];
+    mainProgram = "stash";
+  };
+})