Merge master into staging-next

2025-11-09 16:18:34 +01:00 · 2025-11-01 19:02:04 +00:00 · 2025-11-01 19:02:04 +00:00 · dfb4258c69
parent 4aca83065f c5e5e27146
commit dfb4258c69
100 changed files with 1187 additions and 1801 deletions
--- a/.github/labeler-development-branches.yml
+++ b/.github/labeler-development-branches.yml
@ -1,4 +1,4 @@
-# This file is used by .github/workflows/labels.yml
+# This file is used by .github/workflows/bot.yml
 # This version is only run for Pull Requests from development branches like staging-next, haskell-updates or python-updates.

 "4.workflow: package set update":
--- a/.github/labeler-no-sync.yml
+++ b/.github/labeler-no-sync.yml
@ -1,4 +1,4 @@
-# This file is used by .github/workflows/labels.yml
+# This file is used by .github/workflows/bot.yml
 # This version uses `sync-labels: false`, meaning that a non-match will NOT remove the label

 # keep-sorted start case=no numeric=yes newline_separated=yes skip_lines=1
--- a/.github/labeler.yml
+++ b/.github/labeler.yml
@ -1,4 +1,4 @@
-# This file is used by .github/workflows/labels.yml
+# This file is used by .github/workflows/bot.yml
 # This version uses `sync-labels: true`, meaning that a non-match will remove the label

 # keep-sorted start case=no numeric=yes newline_separated=yes skip_lines=1
--- a/.github/workflows/labels.yml
+++ b/.github/workflows/labels.yml
@ -3,7 +3,7 @@
 # access to the GitHub API. This means that it should not evaluate user input in
 # a way that allows code injection.

-name: Labels
+name: Bot

 on:
  schedule:
@ -21,7 +21,7 @@ on:
 concurrency:
  # This explicitly avoids using `run_id` for the concurrency key to make sure that only
  # *one* scheduled run can run at a time.
-  group: labels-${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number }}
+  group: bot-${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number }}
  # PR-triggered runs will be cancelled, but scheduled runs will be queued.
  cancel-in-progress: ${{ github.event_name != 'schedule' }}

@ -36,9 +36,13 @@ defaults:
    shell: bash

 jobs:
-  update:
+  run:
    runs-on: ubuntu-24.04-arm
    if: github.event_name != 'schedule' || github.repository_owner == 'NixOS'
+    env:
+      # TODO: Remove after 2026-03-04, when Node 24 becomes the default.
+      # https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
+      FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
    steps:
      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
@ -56,7 +60,10 @@ jobs:
        with:
          app-id: ${{ vars.NIXPKGS_CI_APP_ID }}
          private-key: ${{ secrets.NIXPKGS_CI_APP_PRIVATE_KEY }}
+          permission-administration: read
+          permission-contents: write
          permission-issues: write
+          permission-members: read
          permission-pull-requests: write

      - name: Log current API rate limits
@ -64,13 +71,13 @@ jobs:
          GH_TOKEN: ${{ steps.app-token.outputs.token || github.token }}
        run: gh api /rate_limit | jq

-      - name: Labels from API data and Eval results
+      - name: Run bot
        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
        with:
          github-token: ${{ steps.app-token.outputs.token || github.token }}
          retries: 3
          script: |
-            require('./ci/github-script/labels.js')({
+            require('./ci/github-script/bot.js')({
              github,
              context,
              core,
--- a/.github/workflows/comment.yml
+++ b/.github/workflows/comment.yml
@ -0,0 +1,54 @@
+name: Comment
+
+on:
+  issue_comment:
+    types: [created]
+
+# This is used as fallback without app only.
+# This happens when testing in forks without setting up that app.
+permissions:
+  pull-requests: write
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  # The `bot` workflow reacts to comments with @NixOS/nixpkgs-merge-bot references, but might only
+  # pick up a comment after up to 10 minutes. To give the user instant feedback, this job adds
+  # a reaction to these comments.
+  react:
+    name: React with eyes
+    runs-on: ubuntu-24.04-arm
+    timeout-minutes: 2
+    if: contains(github.event.comment.body, '@NixOS/nixpkgs-merge-bot merge')
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
+          sparse-checkout: |
+            ci/github-script
+
+      # Use the GitHub App to make sure the reaction happens with the same user who will later merge.
+      - uses: actions/create-github-app-token@67018539274d69449ef7c02e8e71183d1719ab42 # v2.1.4
+        if: github.event_name != 'pull_request' && vars.NIXPKGS_CI_APP_ID
+        id: app-token
+        with:
+          app-id: ${{ vars.NIXPKGS_CI_APP_ID }}
+          private-key: ${{ secrets.NIXPKGS_CI_APP_PRIVATE_KEY }}
+          permission-pull-requests: write
+
+      - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        with:
+          github-token: ${{ steps.app-token.outputs.token || github.token }}
+          retries: 3
+          script: |
+            const { handleMergeComment } = require('./ci/github-script/merge.js')
+            const { body, node_id } = context.payload.comment
+
+            await handleMergeComment({
+              github,
+              body,
+              node_id,
+              reaction: 'EYES',
+            })
--- a/.github/workflows/dismissed-review.yml
+++ b/.github/workflows/dismissed-review.yml
@ -1,66 +0,0 @@
-name: Dismissed review
-
-on:
-  workflow_run:
-    workflows:
-      - Review dismissed
-    types: [completed]
-
-concurrency:
-  group: dismissed-review-${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.run_id }}
-  cancel-in-progress: true
-
-permissions:
-  pull-requests: write
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  # The `check-cherry-picks` workflow creates review comments which reviewers
-  # are encouraged to manually dismiss if they're not relevant.
-  # When a CI-generated review is dismissed, this job automatically minimizes
-  # it, preventing it from cluttering the PR.
-  minimize:
-    name: Minimize as resolved
-    runs-on: ubuntu-24.04-arm
-    timeout-minutes: 2
-    steps:
-      - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
-        with:
-          script: |
-            // PRs from forks don't have any PRs associated by default.
-            // Thus, we request the PR number with an API call *to* the fork's repo.
-            // Multiple pull requests can be open from the same head commit, either via
-            // different base branches or head branches.
-            const { head_repository, head_sha, repository } = context.payload.workflow_run
-            await Promise.all(
-              (await github.paginate(github.rest.repos.listPullRequestsAssociatedWithCommit, {
-                owner: head_repository.owner.login,
-                repo: head_repository.name,
-                commit_sha: head_sha
-              }))
-              .filter(pull_request => pull_request.base.repo.id == repository.id)
-              .map(async (pull_request) =>
-                Promise.all(
-                  (await github.paginate(github.rest.pulls.listReviews, {
-                    owner: context.repo.owner,
-                    repo: context.repo.repo,
-                    pull_number: pull_request.number
-                  })).filter(review =>
-                    review.user?.login == 'github-actions[bot]' &&
-                    review.state == 'DISMISSED'
-                  ).map(review => github.graphql(`
-                    mutation($node_id:ID!) {
-                      minimizeComment(input: {
-                        classifier: RESOLVED,
-                        subjectId: $node_id
-                      })
-                      { clientMutationId }
-                    }`,
-                    { node_id: review.node_id }
-                  ))
-                )
-              )
-            )
--- a/.github/workflows/pull-request-target.yml
+++ b/.github/workflows/pull-request-target.yml
@ -100,10 +100,10 @@ jobs:
      systems: ${{ needs.prepare.outputs.systems }}
      testVersions: ${{ contains(fromJSON(needs.prepare.outputs.touched), 'pinned') && !contains(fromJSON(needs.prepare.outputs.headBranch).type, 'development') }}

-  labels:
-    name: Labels
+  bot:
+    name: Bot
    needs: [prepare, eval]
-    uses: ./.github/workflows/labels.yml
+    uses: ./.github/workflows/bot.yml
    permissions:
      issues: write
      pull-requests: write
--- a/.github/workflows/review.yml
+++ b/.github/workflows/review.yml
@ -0,0 +1,92 @@
+name: Review
+
+on:
+  workflow_run:
+    workflows:
+      - Reviewed
+    types: [completed]
+
+# This is used as fallback without app only.
+# This happens when testing in forks without setting up that app.
+permissions:
+  pull-requests: write
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  process:
+    runs-on: ubuntu-24.04-arm
+    timeout-minutes: 2
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
+          sparse-checkout: |
+            ci/github-script
+
+      # Use the GitHub App to make sure the reaction happens with the same user who will later merge.
+      - uses: actions/create-github-app-token@67018539274d69449ef7c02e8e71183d1719ab42 # v2.1.4
+        if: github.event_name != 'pull_request' && vars.NIXPKGS_CI_APP_ID
+        id: app-token
+        with:
+          app-id: ${{ vars.NIXPKGS_CI_APP_ID }}
+          private-key: ${{ secrets.NIXPKGS_CI_APP_PRIVATE_KEY }}
+          permission-pull-requests: write
+
+      - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        with:
+          github-token: ${{ steps.app-token.outputs.token || github.token }}
+          retries: 3
+          script: |
+            const { handleMergeComment } = require('./ci/github-script/merge.js')
+
+            // PRs from forks don't have any PRs associated by default.
+            // Thus, we request the PR number with an API call *to* the fork's repo.
+            // Multiple pull requests can be open from the same head commit, either via
+            // different base branches or head branches.
+            const { head_repository, head_sha, repository } = context.payload.workflow_run
+            await Promise.all(
+              (await github.paginate(github.rest.repos.listPullRequestsAssociatedWithCommit, {
+                owner: head_repository.owner.login,
+                repo: head_repository.name,
+                commit_sha: head_sha
+              }))
+              .filter(pull_request => pull_request.base.repo.id == repository.id)
+              .map(async (pull_request) =>
+                Promise.all(
+                  (await github.paginate(github.rest.pulls.listReviews, {
+                    owner: context.repo.owner,
+                    repo: context.repo.repo,
+                    pull_number: pull_request.number
+                  })).map(review => {
+                    // The `check` workflow creates review comments which reviewers
+                    // are encouraged to manually dismiss if they're not relevant.
+                    // When a CI-generated review is dismissed, this job automatically minimizes
+                    // it, preventing it from cluttering the PR.
+                    if (review.user?.login == 'github-actions[bot]' && review.state == 'DISMISSED')
+                      return github.graphql(`
+                        mutation($node_id:ID!) {
+                          minimizeComment(input: {
+                            classifier: RESOLVED,
+                            subjectId: $node_id
+                          })
+                          { clientMutationId }
+                        }`,
+                        { node_id: review.node_id }
+                      )
+
+                    // The `bot` workflow reacts to comments with @NixOS/nixpkgs-merge-bot references, but might only
+                    // pick up a comment after up to 10 minutes. To give the user instant feedback, this job adds
+                    // a reaction to these comments.
+                    return handleMergeComment({
+                      github,
+                      body: review.body,
+                      node_id: review.node_id,
+                      reaction: 'EYES',
+                    })
+                  })
+                )
+              )
+            )
--- a/.github/workflows/review-dismissed.yml
+++ b/.github/workflows/review-dismissed.yml
@ -1,8 +1,8 @@
-name: Review dismissed
+name: Reviewed

 on:
  pull_request_review:
-    types: [dismissed]
+    types: [submitted, dismissed]

 permissions: {}

--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@ -58,14 +58,17 @@ jobs:

            if (files.some(file => [
              '.github/actions/checkout/action.yml',
+              '.github/workflows/bot.yml',
              '.github/workflows/build.yml',
              '.github/workflows/check.yml',
              '.github/workflows/eval.yml',
-              '.github/workflows/labels.yml',
              '.github/workflows/lint.yml',
              '.github/workflows/pull-request-target.yml',
              '.github/workflows/reviewers.yml',
              '.github/workflows/test.yml',
+              'ci/github-script/bot.js',
+              'ci/github-script/merge.js',
+              'ci/github-script/withRateLimit.js',
            ].includes(file))) core.setOutput('pr', true)

  merge-group:
--- a/ci/OWNERS
+++ b/ci/OWNERS
@ -58,7 +58,8 @@
 /pkgs/top-level/by-name-overlay.nix              @infinisil @philiptaron
 /pkgs/stdenv                                     @philiptaron @NixOS/stdenv
 /pkgs/stdenv/generic                             @Ericson2314 @NixOS/stdenv
-/pkgs/stdenv/generic/check-meta.nix              @Ericson2314 @NixOS/stdenv
+/pkgs/stdenv/generic/check-meta.nix              @Ericson2314 @adisbladis @NixOS/stdenv
+/pkgs/stdenv/generic/meta-types.nix              @adisbladis @NixOS/stdenv
 /pkgs/stdenv/cross                               @Ericson2314 @NixOS/stdenv
 /pkgs/build-support                              @philiptaron
 /pkgs/build-support/cc-wrapper                   @Ericson2314
--- a/ci/github-script/labels.js
+++ b/ci/github-script/labels.js
@ -4,6 +4,7 @@ module.exports = async ({ github, context, core, dry }) => {
  const { readFile, writeFile } = require('node:fs/promises')
  const withRateLimit = require('./withRateLimit.js')
  const { classify } = require('../supportedBranches.js')
+  const { handleMerge } = require('./merge.js')

  const artifactClient = new DefaultArtifactClient()

@ -95,7 +96,7 @@ module.exports = async ({ github, context, core, dry }) => {
    return maintainerMaps[branch]
  }

-  async function handlePullRequest({ item, stats }) {
+  async function handlePullRequest({ item, stats, events }) {
    const log = (k, v) => core.info(`PR #${item.number} - ${k}: ${v}`)

    const pull_number = item.number
@ -109,6 +110,19 @@ module.exports = async ({ github, context, core, dry }) => {
      })
    ).data

+    const maintainers = await getMaintainerMap(pull_request.base.ref)
+
+    const merge_bot_eligible = await handleMerge({
+      github,
+      context,
+      core,
+      log,
+      dry,
+      pull_request,
+      events,
+      maintainers,
+    })
+
    // When the same change has already been merged to the target branch, a PR will still be
    // open and display the same changes - but will not actually have any effect. This causes
    // strange CI behavior, because the diff of the merge-commit is empty, no rebuilds will
@ -185,6 +199,7 @@ module.exports = async ({ github, context, core, dry }) => {
      // The second pass will then read the result from the first pass and set the label.
      '2.status: merge conflict':
        merge_commit_sha_valid && !pull_request.merge_commit_sha,
+      '2.status: merge-bot eligible': merge_bot_eligible,
      '12.approvals: 1': approvals.size === 1,
      '12.approvals: 2': approvals.size === 2,
      '12.approvals: 3+': approvals.size >= 3,
@ -305,8 +320,6 @@ module.exports = async ({ github, context, core, dry }) => {
        )
      }

-      const maintainers = await getMaintainerMap(pull_request.base.ref)
-
      Object.assign(prLabels, evalLabels, {
        '11.by: package-maintainer':
          packages.length &&
@ -377,9 +390,21 @@ module.exports = async ({ github, context, core, dry }) => {

      const itemLabels = {}

+      const events = await github.paginate(
+        github.rest.issues.listEventsForTimeline,
+        {
+          ...context.repo,
+          issue_number,
+          per_page: 100,
+        },
+      )
+
      if (item.pull_request || context.payload.pull_request) {
        stats.prs++
-        Object.assign(itemLabels, await handlePullRequest({ item, stats }))
+        Object.assign(
+          itemLabels,
+          await handlePullRequest({ item, stats, events }),
+        )
      } else {
        stats.issues++
        if (item.labels.some(({ name }) => name === '4.workflow: auto-close')) {
@ -391,13 +416,7 @@ module.exports = async ({ github, context, core, dry }) => {
      }

      const latest_event_at = new Date(
-        (
-          await github.paginate(github.rest.issues.listEventsForTimeline, {
-            ...context.repo,
-            issue_number,
-            per_page: 100,
-          })
-        )
+        events
          .filter(({ event }) =>
            [
              // These events are hand-picked from:
@ -484,7 +503,7 @@ module.exports = async ({ github, context, core, dry }) => {
      const lastRun = (
        await github.rest.actions.listWorkflowRuns({
          ...context.repo,
-          workflow_id: 'labels.yml',
+          workflow_id: 'bot.yml',
          event: 'schedule',
          status: 'success',
          exclude_pull_requests: true,
--- a/ci/github-script/merge.js
+++ b/ci/github-script/merge.js
@ -0,0 +1,271 @@
+// Caching the list of committers saves API requests when running the bot on the schedule and
+// processing many PRs at once.
+let committers
+
+async function runChecklist({ github, context, pull_request, maintainers }) {
+  const pull_number = pull_request.number
+
+  if (!committers) {
+    if (context.eventName === 'pull_request') {
+      // We have no chance of getting a token in the pull_request context with the right
+      // permissions to access the members endpoint below. Thus, we're pretending to have
+      // no committers. This is OK; because this is only for the Test workflow, not for
+      // real use.
+      committers = new Set()
+    } else {
+      committers = github
+        .paginate(github.rest.teams.listMembersInOrg, {
+          org: context.repo.owner,
+          team_slug: 'nixpkgs-committers',
+          per_page: 100,
+        })
+        .then((members) => new Set(members.map(({ id }) => id)))
+    }
+  }
+
+  const files = await github.paginate(github.rest.pulls.listFiles, {
+    ...context.repo,
+    pull_number,
+    per_page: 100,
+  })
+
+  const packages = files
+    .filter(({ filename }) => filename.startsWith('pkgs/by-name/'))
+    .map(({ filename }) => filename.split('/')[3])
+
+  const eligible = !packages.length
+    ? new Set()
+    : packages
+        .map((pkg) => new Set(maintainers[pkg]))
+        .reduce((acc, cur) => acc?.intersection(cur) ?? cur)
+
+  const checklist = {
+    'PR targets one of the allowed branches: master, staging, staging-next.': [
+      'master',
+      'staging',
+      'staging-next',
+    ].includes(pull_request.base.ref),
+    'PR touches only files in `pkgs/by-name/`.': files.every(({ filename }) =>
+      filename.startsWith('pkgs/by-name/'),
+    ),
+    'PR authored by r-ryantm or committer.':
+      pull_request.user.login === 'r-ryantm' ||
+      (await committers).has(pull_request.user.id),
+    'PR has maintainers eligible for merge.': eligible.size > 0,
+  }
+
+  return {
+    checklist,
+    eligible,
+    result: Object.values(checklist).every(Boolean),
+  }
+}
+
+// The merge command must be on a separate line and not within codeblocks or html comments.
+// Codeblocks can have any number of ` larger than 3 to open/close. We only look at code
+// blocks that are not indented, because the later regex wouldn't match those anyway.
+function hasMergeCommand(body) {
+  return (body ?? '')
+    .replace(/<!--.*?-->/gms, '')
+    .replace(/(^`{3,})[^`].*?\1/gms, '')
+    .match(/^@NixOS\/nixpkgs-merge-bot merge\s*$/m)
+}
+
+async function handleMergeComment({ github, body, node_id, reaction }) {
+  if (!hasMergeCommand(body)) return
+
+  await github.graphql(
+    `mutation($node_id: ID!, $reaction: ReactionContent!) {
+      addReaction(input: {
+        content: $reaction,
+        subjectId: $node_id
+      })
+      { clientMutationId }
+    }`,
+    { node_id, reaction },
+  )
+}
+
+async function handleMerge({
+  github,
+  context,
+  core,
+  log,
+  dry,
+  pull_request,
+  events,
+  maintainers,
+}) {
+  const pull_number = pull_request.number
+
+  const { checklist, eligible, result } = await runChecklist({
+    github,
+    context,
+    pull_request,
+    maintainers,
+  })
+  log('checklist', JSON.stringify(checklist))
+  log('eligible', JSON.stringify(Array.from(eligible)))
+  log('result', result)
+
+  // Only look through comments *after* the latest (force) push.
+  const latestChange = events.findLast(({ event }) =>
+    ['committed', 'head_ref_force_pushed'].includes(event),
+  ) ?? { sha: pull_request.head.sha }
+  const latestSha = latestChange.sha ?? latestChange.commit_id
+  log('latest sha', latestSha)
+  const latestIndex = events.indexOf(latestChange)
+
+  const comments = events.slice(latestIndex + 1).filter(
+    ({ event, body, node_id }) =>
+      ['commented', 'reviewed'].includes(event) &&
+      hasMergeCommand(body) &&
+      // Ignore comments which had already been responded to by the bot.
+      !events.some(
+        ({ event, user, body }) =>
+          ['commented'].includes(event) &&
+          // We're only testing this hidden reference, but not the author of the comment.
+          // We'll just assume that nobody creates comments with this marker on purpose.
+          // Additionally checking the author is quite annoying for local debugging.
+          body.match(new RegExp(`^<!-- comment: ${node_id} -->$`, 'm')),
+      ),
+  )
+
+  async function merge() {
+    if (dry) {
+      core.info(`Merging #${pull_number}... (dry)`)
+      return 'Merge completed (dry)'
+    }
+
+    // Using GraphQL's enablePullRequestAutoMerge mutation instead of the REST
+    // /merge endpoint, because the latter doesn't work with Merge Queues.
+    // This mutation works both with and without Merge Queues.
+    // It doesn't work when there are no required status checks for the target branch.
+    // All development branches have these enabled, so this is a non-issue.
+    try {
+      await github.graphql(
+        `mutation($node_id: ID!, $sha: GitObjectID) {
+          enablePullRequestAutoMerge(input: {
+            expectedHeadOid: $sha,
+            pullRequestId: $node_id
+          })
+          { clientMutationId }
+        }`,
+        { node_id: pull_request.node_id, sha: latestSha },
+      )
+      return 'Enabled Auto Merge'
+    } catch (e) {
+      log('Auto Merge failed', e.response.errors[0].message)
+    }
+
+    // Auto-merge doesn't work if the target branch has already run all CI, in which
+    // case the PR must be enqueued explicitly.
+    // We now have merge queues enabled on all development branches, thus don't need a
+    // fallback after this.
+    try {
+      const resp = await github.graphql(
+        `mutation($node_id: ID!, $sha: GitObjectID) {
+          enqueuePullRequest(input: {
+            expectedHeadOid: $sha,
+            pullRequestId: $node_id
+          })
+          {
+            clientMutationId,
+            mergeQueueEntry { mergeQueue { url } }
+          }
+        }`,
+        { node_id: pull_request.node_id, sha: latestSha },
+      )
+      return `[Queued](${resp.enqueuePullRequest.mergeQueueEntry.mergeQueue.url}) for merge`
+    } catch (e) {
+      log('Enqueing failed', e.response.errors[0].message)
+      throw new Error(e.response.errors[0].message)
+    }
+  }
+
+  for (const comment of comments) {
+    log('comment', comment.node_id)
+
+    async function react(reaction) {
+      if (dry) {
+        core.info(`Reaction ${reaction} on ${comment.node_id} (dry)`)
+        return
+      }
+
+      await handleMergeComment({
+        github,
+        body: comment.body,
+        node_id: comment.node_id,
+        reaction,
+      })
+    }
+
+    async function isMaintainer(username) {
+      try {
+        return (
+          (
+            await github.rest.teams.getMembershipForUserInOrg({
+              org: context.repo.owner,
+              team_slug: 'nixpkgs-maintainers',
+              username,
+            })
+          ).data.state === 'active'
+        )
+      } catch (e) {
+        if (e.status === 404) return false
+        else throw e
+      }
+    }
+
+    const canUseMergeBot = await isMaintainer(comment.user.login)
+    const isEligible = eligible.has(comment.user.id)
+    const canMerge = result && canUseMergeBot && isEligible
+
+    const body = [
+      `<!-- comment: ${comment.node_id} -->`,
+      '',
+      'Requirements to merge this PR:',
+      ...Object.entries(checklist).map(
+        ([msg, res]) => `- :${res ? 'white_check_mark' : 'x'}: ${msg}`,
+      ),
+      `- :${canUseMergeBot ? 'white_check_mark' : 'x'}: ${comment.user.login} can use the merge bot.`,
+      `- :${isEligible ? 'white_check_mark' : 'x'}: ${comment.user.login} is eligible to merge changes to the touched packages.`,
+      '',
+    ]
+
+    if (canMerge) {
+      await react('ROCKET')
+      try {
+        body.push(`:heavy_check_mark: ${await merge()} (#306934)`)
+      } catch (e) {
+        // Remove the HTML comment with node_id reference to allow retrying this merge on the next run.
+        body.shift()
+        body.push(`:x: Merge failed with: ${e} (#371492)`)
+      }
+    } else {
+      await react('THUMBS_DOWN')
+      body.push(':x: Pull Request could not be merged (#305350)')
+    }
+
+    if (dry) {
+      core.info(body.join('\n'))
+    } else {
+      await github.rest.issues.createComment({
+        ...context.repo,
+        issue_number: pull_number,
+        body: body.join('\n'),
+      })
+    }
+
+    if (canMerge) break
+  }
+
+  // Returns a boolean, which indicates whether the PR is merge-bot eligible in principle.
+  // This is used to set the respective label in bot.js.
+  return result
+}
+
+module.exports = {
+  handleMerge,
+  handleMergeComment,
+}
--- a/ci/github-script/run
+++ b/ci/github-script/run
@ -65,19 +65,19 @@ program
  })

 program
-  .command('labels')
-  .description('Manage labels on pull requests.')
+  .command('bot')
+  .description('Run automation on pull requests and issues.')
  .argument('<owner>', 'Owner of the GitHub repository to label (Example: NixOS)')
  .argument('<repo>', 'Name of the GitHub repository to label (Example: nixpkgs)')
  .argument('[pr]', 'Number of the Pull Request to label')
  .option('--no-dry', 'Make actual modifications')
  .action(async (owner, repo, pr, options) => {
-    const labels = (await import('./labels.js')).default
+    const bot = (await import('./bot.js')).default
    const tmp = mkdtempSync(join(tmpdir(), 'github-script-'))
    try {
      process.env.GITHUB_WORKSPACE = tmp
      process.chdir(tmp)
-      await run(labels, owner, repo, pr, options)
+      await run(bot, owner, repo, pr, options)
    } finally {
      rmSync(tmp, { recursive: true })
    }
--- a/lib/systems/examples.nix
+++ b/lib/systems/examples.nix
@ -302,15 +302,6 @@ rec {
    libc = "newlib";
  };

-  #
-  # Redox
-  #
-
-  x86_64-unknown-redox = {
-    config = "x86_64-unknown-redox";
-    libc = "relibc";
-  };
-
  #
  # Darwin
  #
--- a/nixos/lib/testing/driver.nix
+++ b/nixos/lib/testing/driver.nix
@ -202,7 +202,7 @@ in
    _module.args = {
      hostPkgs =
        # Comment is in nixos/modules/misc/nixpkgs.nix
-        lib.mkOverride lib.modules.defaultOverridePriority config.hostPkgs.__splicedPackages;
+        lib.mkOverride lib.modules.defaultOverridePriority config.hostPkgs;
    };

    driver = withChecks driver;
--- a/nixos/modules/misc/nixpkgs.nix
+++ b/nixos/modules/misc/nixpkgs.nix
@ -355,7 +355,7 @@ in
        # which is somewhat costly for Nixpkgs. With an explicit priority, we only
        # evaluate the wrapper to find out that the priority is lower, and then we
        # don't need to evaluate `finalPkgs`.
-        lib.mkOverride lib.modules.defaultOverridePriority finalPkgs.__splicedPackages;
+        lib.mkOverride lib.modules.defaultOverridePriority finalPkgs;
    };

    assertions =
--- a/nixos/modules/misc/nixpkgs/read-only.nix
+++ b/nixos/modules/misc/nixpkgs/read-only.nix
@ -63,7 +63,7 @@ in
      # find mistaken definitions
      builtins.seq cfg.config builtins.seq cfg.overlays builtins.seq cfg.hostPlatform builtins.seq
        cfg.buildPlatform
-        cfg.pkgs.__splicedPackages;
+        cfg.pkgs;
    nixpkgs.config = cfg.pkgs.config;
    nixpkgs.overlays = cfg.pkgs.overlays;
    nixpkgs.hostPlatform = cfg.pkgs.stdenv.hostPlatform;
--- a/nixos/modules/programs/steam.nix
+++ b/nixos/modules/programs/steam.nix
@ -256,7 +256,16 @@ in
      })

      (lib.mkIf cfg.remotePlay.openFirewall {
-        allowedTCPPorts = [ 27036 ];
+        # https://help.steampowered.com/en/faqs/view/3E3D-BE6B-787D-A5D2
+        # https://help.steampowered.com/en/faqs/view/2EA8-4D75-DA21-31EB
+        allowedTCPPorts = [
+          27036
+          27037
+        ];
+        allowedUDPPorts = [
+          10400
+          10401
+        ];
        allowedUDPPortRanges = [
          {
            from = 27031;
--- a/nixos/modules/services/networking/anubis.nix
+++ b/nixos/modules/services/networking/anubis.nix
@ -25,14 +25,14 @@ let
  instanceUsesDedicatedRuntimeDirectory =
    name: instance:
    lib.any (lib.hasPrefix (runtimeDirectoryPrefix name)) (unixSocketAddrs instance.settings);
-  useDedicatedRuntimeDirectory =
+  useLegacyRuntimeDirectory =
    # Set when:
-    # - Multiple instances are configured to use unix sockets.
-    # - At least one instance uses the new runtime directory prefix: /run/anubis/anubis-<instance name>.
-    lib.count instanceUsesUnixSockets (lib.attrValues enabledInstances) > 1
-    || lib.any (attrs: instanceUsesDedicatedRuntimeDirectory attrs.name attrs.value) (
+    # - Only one instance is configured with unix sockets.
+    # - No instance uses the new runtime directory prefix: /run/anubis/anubis-<name>.
+    lib.count instanceUsesUnixSockets (lib.attrValues enabledInstances) == 1
+    && !(lib.any (attrs: instanceUsesDedicatedRuntimeDirectory attrs.name attrs.value) (
      lib.attrsToList enabledInstances
-    );
+    ));

  commonSubmodule =
    isDefault:
@ -207,7 +207,7 @@ let
        default = "/run/anubis/${instanceName name}.sock";
        description = ''
          The address that Anubis listens to. See Go's [`net.Listen`](https://pkg.go.dev/net#Listen) for syntax.
-          Use the prefix ${runtimeDirectoryPrefix "<instance name>"} when configuring multiple instances.
+          Use the prefix "${runtimeDirectoryPrefix "<name>"}". The prefix "/run/anubis" is deprecated.

          Defaults to Unix domain sockets. To use TCP sockets, set this to a TCP address and `BIND_NETWORK` to `"tcp"`.
        '';
@ -219,7 +219,7 @@ let
        description = ''
          The address Anubis' metrics server listens to. See Go's [`net.Listen`](https://pkg.go.dev/net#Listen) for
          syntax.
-          Use the prefix ${runtimeDirectoryPrefix "<instance name>"} when configuring multiple instances.
+          Use the prefix "${runtimeDirectoryPrefix "<name>"}". The prefix "/run/anubis" is deprecated.

          The metrics server is enabled by default and may be disabled. However, due to implementation details, this is
          only possible by setting a command line flag. See {option}`services.anubis.defaultOptions.extraFlags` for an
@ -269,9 +269,7 @@ in
  };

  config = lib.mkIf (enabledInstances != { }) {
-    warnings = [
-      "RuntimeDirectory is going to be migrated from `anubis` to `anubis/anubis-<instance name>`, update BIND and METRICS_BIND to ${runtimeDirectoryPrefix "<instance name>"} if using unix sockets"
-    ];
+    warnings = lib.optional useLegacyRuntimeDirectory ''Anubis service: runtime directory is going to be migrated from "anubis" to "anubis/anubis-<name>". Update services.anubis.instances.<name>.BIND to "${runtimeDirectoryPrefix "<name>"}anubis.sock" and services.anubis.instances.<name>.METRICS_BIND to "${runtimeDirectoryPrefix "<name>"}anubis-metrics.sock". Note: if <name> is "", use the prefix "/run/anubis/anubis".'';

    assertions =
      let
@ -282,9 +280,9 @@ in
      [
        {
          assertion =
-            !useDedicatedRuntimeDirectory
+            useLegacyRuntimeDirectory
            || lib.all validInstanceUnixSocketAddrs (lib.attrsToList enabledInstances);
-          message = "use the prefix ${runtimeDirectoryPrefix "<instance name>"} in BIND and METRICS_BIND when configuring multiple instances";
+          message = ''use the prefix "${runtimeDirectoryPrefix "<name>"}" in services.anubis.instances.<name>.BIND and services.anubis.instances.<name>.METRICS_BIND'';
        }
      ];

@ -331,12 +329,11 @@ in
            (lib.singleton (lib.getExe cfg.package)) ++ instance.extraFlags
          );
          RuntimeDirectory =
-            if useDedicatedRuntimeDirectory then
-              "anubis/${instanceName name}"
-            else if instanceUsesUnixSockets instance then
-              # `dedicatedRuntimeDirectory = false`: /run/anubis may still be used.
+            if useLegacyRuntimeDirectory && instanceUsesUnixSockets instance then
              # Warning: `anubis` will be deprecated eventually.
              "anubis"
+            else if instanceUsesUnixSockets instance then
+              "anubis/${instanceName name}"
            else
              null;
          # hardening
--- a/nixos/modules/system/boot/systemd/journald-gateway.nix
+++ b/nixos/modules/system/boot/systemd/journald-gateway.nix
@ -108,18 +108,6 @@ in
  };

  config = lib.mkIf cfg.enable {
-    assertions = [
-      {
-        # This prevents the weird case were disabling "system" and "user"
-        # actually enables both because the cli flags are not present.
-        assertion = cfg.system || cfg.user;
-        message = ''
-          systemd-journal-gatewayd cannot serve neither "system" nor "user"
-          journals.
-        '';
-      }
-    ];
-
    systemd.additionalUpstreamSystemUnits = [
      "systemd-journal-gatewayd.socket"
      "systemd-journal-gatewayd.service"
--- a/pkgs/applications/audio/magnetophonDSP/ConstantDetuneChorus/default.nix
+++ b/pkgs/applications/audio/magnetophonDSP/ConstantDetuneChorus/default.nix
@ -42,7 +42,5 @@ stdenv.mkDerivation rec {
    homepage = "https://github.com/magnetophon/constant-detune-chorus";
    license = lib.licenses.gpl3;
    maintainers = [ lib.maintainers.magnetophon ];
-    # ERROR3 : n is NaN in an Interval
-    broken = true;
  };
 }
--- a/pkgs/applications/audio/quodlibet/default.nix
+++ b/pkgs/applications/audio/quodlibet/default.nix
@ -34,7 +34,7 @@
  withGstPlugins ? withGstreamerBackend,
  withGstreamerBackend ? true,
  gst_all_1,
-  withXineBackend ? true,
+  withXineBackend ? !withGstreamerBackend,
  xine-lib,

  # tests
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@ -4735,8 +4735,8 @@ let
        mktplcRef = {
          name = "opa";
          publisher = "tsandall";
-          version = "0.19.0";
-          hash = "sha256-jRwZD4TwLMdwBdV59HonMkF2ds4heXHPtpw1sxq1RsA=";
+          version = "0.20.0";
+          hash = "sha256-1o7v9lncnmYWr9FPEjQmamfNW/Lui9A0V+l7bCjn/hw=";
        };
        meta = {
          changelog = "https://github.com/open-policy-agent/vscode-opa/blob/master/CHANGELOG.md";
--- a/pkgs/applications/editors/vscode/extensions/oracle.oracle-java/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/oracle.oracle-java/default.nix
@ -8,7 +8,7 @@ vscode-utils.buildVscodeMarketplaceExtension rec {
    name = "oracle-java";
    publisher = "oracle";
    version = "24.1.2";
-    hash = "sha256-sw+FJbpdkHABKgnRsA5tS6FYEjBD0/iVRCHHzf49Xx4=";
+    hash = "sha256-RX+Yq7fVmN797qlvSWV9hOqQV3lpWBzDjOMm/1sbv0k=";
  };

  meta = {
--- a/pkgs/applications/editors/vscode/extensions/saoudrizwan.claude-dev/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/saoudrizwan.claude-dev/default.nix
@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
  mktplcRef = {
    name = "claude-dev";
    publisher = "saoudrizwan";
-    version = "3.33.1";
-    hash = "sha256-DSLRfzAL4jqj32XZOmGGSb/BBGEfzJ9fbkiSLLpaYM4=";
+    version = "3.35.0";
+    hash = "sha256-fPoSrpWHfDEGLbawTVV65MAQAXWUy6WTb7ijhKaoLvc=";
  };

  meta = {
--- a/pkgs/applications/emulators/libretro/cores/ppsspp.nix
+++ b/pkgs/applications/emulators/libretro/cores/ppsspp.nix
@ -13,13 +13,13 @@
 }:
 mkLibretroCore {
  core = "ppsspp";
-  version = "0-unstable-2025-10-22";
+  version = "0-unstable-2025-10-31";

  src = fetchFromGitHub {
    owner = "hrydgard";
    repo = "ppsspp";
-    rev = "28790c19af7ddfa822c4152a3cae4a7fb6c06bc7";
-    hash = "sha256-m1qmgr92Ni8wAYer6kIdcu+BUiBSROFcSC/M3v/JOmA=";
+    rev = "884ec9d16e39272d6f04ce6e7e202290ec31f45d";
+    hash = "sha256-vC2GPK5hHjOUtoxG2rw2ESiAbTOsQRx8tDABxNjRkFw=";
    fetchSubmodules = true;
  };

--- a/pkgs/applications/misc/opentx/default.nix
+++ b/pkgs/applications/misc/opentx/default.nix
@ -26,6 +26,10 @@ mkDerivation rec {
    sha256 = "sha256-F3zykJhKuIpLQSTjn7mcdjEmgRAlwCZpkTaKQR9ve3g=";
  };

+  patches = [
+    # fix error "The LOCATION property may not be read from target" and ensure proper linking of Qt modules so build don't fail
+    ./fix-cmake-qt-linking-and-location.patch
+  ];
  nativeBuildInputs = [
    cmake
    gcc-arm-embedded
@ -44,6 +48,12 @@ mkDerivation rec {
    sed -i companion/src/burnconfigdialog.cpp \
      -e 's|/usr/.*bin/dfu-util|${dfu-util}/bin/dfu-util|' \
      -e 's|/usr/.*bin/avrdude|${avrdude}/bin/avrdude|'
+
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "cmake_minimum_required(VERSION 2.8)" "cmake_minimum_required(VERSION 3.10)" \
+      --replace-fail "cmake_policy(SET CMP0023 OLD)" "cmake_policy(SET CMP0023 NEW)"
+    substituteInPlace companion/src/thirdparty/maxlibqt/src/widgets/CMakeLists.txt \
+      --replace-fail "cmake_minimum_required(VERSION 2.8.12)" "cmake_minimum_required(VERSION 3.10)"
  '';

  cmakeFlags = [
--- a/pkgs/applications/misc/opentx/fix-cmake-qt-linking-and-location.patch
+++ b/pkgs/applications/misc/opentx/fix-cmake-qt-linking-and-location.patch
@ -0,0 +1,27 @@
+--- a/companion/src/CMakeLists.txt
+++ b/companion/src/CMakeLists.txt
+@@ -313,8 +313,8 @@
+ qt5_wrap_cpp(companion_SRCS ${companion_MOC_HDRS})
+ 
+ add_executable(${COMPANION_NAME} MACOSX_BUNDLE ${WIN_EXECUTABLE_TYPE} ${companion_SRCS} ${icon_RC})
+-target_link_libraries(${COMPANION_NAME} PRIVATE generaledit modeledit qcustomplot shared ${CPN_COMMON_LIB})
+-
+target_link_libraries(${COMPANION_NAME} PRIVATE generaledit modeledit qcustomplot shared ${CPN_COMMON_LIB}
+Qt5::Network Qt5::PrintSupport)
+ PrintTargetReport("${COMPANION_NAME}")
+ 
+ ############# Standalone simulator ###############
+@@ -371,11 +371,11 @@
+   string(TOLOWER ${PCB} FLAVOUR)
+ endif()
+ if(POLICY CMP0026)
+-  cmake_policy(SET CMP0026 OLD)  # https://cmake.org/cmake/help/v3.0/policy/CMP0026.html
+  cmake_policy(SET CMP0026 NEW)  # https://cmake.org/cmake/help/v3.0/policy/CMP0026.html
+ endif()
+ 
+ if(SIMU_TARGET)
+-  get_property(current_plugin TARGET opentx-${FLAVOUR}-simulator PROPERTY LOCATION)
+  set(current_plugin $<TARGET_FILE:opentx-${FLAVOUR}-simulator>)
+   list(APPEND simulator_plugins "${current_plugin}")
+ endif()
+ 
--- a/pkgs/applications/networking/cluster/spark/default.nix
+++ b/pkgs/applications/networking/cluster/spark/default.nix
@ -8,6 +8,8 @@
  RSupport ? true,
  R,
  nixosTests,
+  # needeed in situations where hadoop's jdk version is too old
+  jdk21_headless,
 }:

 let
@ -28,7 +30,15 @@ let
        R
        pysparkPython
        ;
-      inherit (finalAttrs.hadoop) jdk;
+      jdk =
+        if
+          (
+            (lib.versionAtLeast finalAttrs.version "4") && (lib.versionOlder finalAttrs.hadoop.jdk.version "21")
+          )
+        then
+          jdk21_headless
+        else
+          finalAttrs.hadoop.jdk;
      src = fetchzip {
        url =

@ -96,6 +106,11 @@ in
  # we strictly adhere to the EOL timeline, despite 3.3.4 being released one day before (2023-12-08).
  # A better policy is to keep these versions around, and clean up EOL versions just before
  # a new NixOS release.
+  spark_4_0 = spark {
+    pname = "spark";
+    version = "4.0.1";
+    hash = "sha256-AW+EQ83b4orJO3+dUPPDlTRAH/D94U7KQBKvKjguChY=";
+  };
  spark_3_5 = spark {
    pname = "spark";
    version = "3.5.5";
--- a/pkgs/applications/networking/mailreaders/evolution/evolution/default.nix
+++ b/pkgs/applications/networking/mailreaders/evolution/evolution/default.nix
@ -1,6 +1,7 @@
 {
  lib,
  stdenv,
+  fetchpatch,
  cmake,
  ninja,
  intltool,
@ -53,6 +54,16 @@ stdenv.mkDerivation rec {
    hash = "sha256-ff3JrrLasybav9wfhXfE7MEjoS2gAS+MZKcmBlo8Cys=";
  };

+  patches = [
+    # fix crash when opening attachment with recent webkitgtk versions
+    # https://gitlab.gnome.org/GNOME/evolution/-/issues/3124
+    # remove when updating to 3.58.0
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/evolution/-/commit/811a6df1f990855e49ecc0ba7b1a7f7a5ec251e6.patch";
+      hash = "sha256-Aj8H7PnAblInX2zRPQH7n0HOdLNuhITNHunWRYCPBsI=";
+    })
+  ];
+
  nativeBuildInputs = [
    cmake
    intltool
--- a/pkgs/applications/science/biology/hh-suite/default.nix
+++ b/pkgs/applications/science/biology/hh-suite/default.nix
@ -41,6 +41,13 @@ stdenv.mkDerivation rec {

  buildInputs = lib.optional stdenv.cc.isClang openmp ++ lib.optional enableMpi mpi;

+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "cmake_minimum_required(VERSION 2.8.12)" "cmake_minimum_required(VERSION 3.10)"
+    substituteInPlace lib/ffindex/CMakeLists.txt \
+      --replace-fail "cmake_minimum_required(VERSION 2.8.12 FATAL_ERROR)" "cmake_minimum_required(VERSION 3.10)"
+  '';
+
  meta = with lib; {
    description = "Remote protein homology detection suite";
    homepage = "https://github.com/soedinglab/hh-suite";
--- a/pkgs/by-name/am/ams-lv2/package.nix
+++ b/pkgs/by-name/am/ams-lv2/package.nix
@ -1,56 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  cairo,
-  fftw,
-  gtkmm2,
-  lv2,
-  lvtk,
-  pkg-config,
-  wafHook,
-  python3,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "ams-lv2";
-  version = "1.2.2";
-
-  src = fetchFromGitHub {
-    owner = "blablack";
-    repo = "ams-lv2";
-    rev = version;
-    sha256 = "1lz2mvk4gqsyf92yxd3aaldx0d0qi28h4rnnvsaz4ls0ccqm80nk";
-  };
-
-  nativeBuildInputs = [
-    pkg-config
-    wafHook
-    python3
-  ];
-  buildInputs = [
-    cairo
-    fftw
-    gtkmm2
-    lv2
-    lvtk
-  ];
-
-  postPatch = ''
-    # U was removed in python 3.11 because it had no effect
-    substituteInPlace waflib/*.py \
-      --replace "m='rU" "m='r"
-  '';
-
-  meta = with lib; {
-    description = "LV2 port of the internal modules found in Alsa Modular Synth";
-    homepage = "https://github.com/blablack/ams-lv2";
-    license = licenses.gpl3;
-    maintainers = [ ];
-    platforms = platforms.linux;
-    # Build uses `-msse` and `-mfpmath=sse`
-    badPlatforms = [ "aarch64-linux" ];
-    # `ModuleNotFoundError: No module named 'imp'`
-    broken = true;
-  };
-}
--- a/pkgs/by-name/bl/bluebubbles/package.nix
+++ b/pkgs/by-name/bl/bluebubbles/package.nix
@ -1,6 +1,6 @@
 {
  lib,
-  flutter327,
+  flutter329,
  fetchFromGitHub,
  autoPatchelfHook,
  webkitgtk_4_1,
@ -10,7 +10,7 @@
  mpv,
 }:

-flutter327.buildFlutterApplication rec {
+flutter329.buildFlutterApplication rec {
  pname = "bluebubbles";
  version = "1.15.4";

--- a/pkgs/by-name/bo/bottles-unwrapped/package.nix
+++ b/pkgs/by-name/bo/bottles-unwrapped/package.nix
@ -32,13 +32,13 @@

 python3Packages.buildPythonApplication rec {
  pname = "bottles-unwrapped";
-  version = "51.24";
+  version = "51.25";

  src = fetchFromGitHub {
    owner = "bottlesdevs";
    repo = "bottles";
    tag = version;
-    hash = "sha256-cKW2b8MVpVksDnthn9kPBtUoCiiCMTQ993KTJSJuZDE=";
+    hash = "sha256-W25MpdXLO+vcMvvCJmA87lB9WiBOJHsWp8D/LU0xjAY=";
  };

  patches = [
--- a/pkgs/by-name/ch/chow-kick/package.nix
+++ b/pkgs/by-name/ch/chow-kick/package.nix
@ -1,38 +1,21 @@
 {
  alsa-lib,
-  at-spi2-core,
-  brotli,
  cmake,
  curl,
-  dbus,
  libepoxy,
  fetchFromGitHub,
-  libglut,
  freetype,
-  gtk2-x11,
  lib,
  libGL,
  libXcursor,
-  libXdmcp,
  libXext,
  libXinerama,
  libXrandr,
-  libXtst,
-  libdatrie,
  libjack2,
-  libpsl,
-  libselinux,
-  libsepol,
-  libsysprof-capture,
-  libthai,
  libxkbcommon,
  lv2,
-  pcre,
  pkg-config,
-  python3,
-  sqlite,
  stdenv,
-  util-linuxMinimal,
 }:

 stdenv.mkDerivation (finalAttrs: {
@ -53,34 +36,17 @@ stdenv.mkDerivation (finalAttrs: {
  ];
  buildInputs = [
    alsa-lib
-    at-spi2-core
-    brotli
    curl
-    dbus
    libepoxy
-    libglut
    freetype
-    gtk2-x11
    libGL
    libXcursor
-    libXdmcp
    libXext
    libXinerama
    libXrandr
-    libXtst
-    libdatrie
    libjack2
-    libpsl
-    libselinux
-    libsepol
-    libsysprof-capture
-    libthai
    libxkbcommon
    lv2
-    pcre
-    python3
-    sqlite
-    util-linuxMinimal
  ];

  cmakeFlags = [
@ -101,12 +67,12 @@ stdenv.mkDerivation (finalAttrs: {
    cp ChowKick_artefacts/Release/Standalone/ChowKick  $out/bin
  '';

-  meta = with lib; {
+  meta = {
    homepage = "https://github.com/Chowdhury-DSP/ChowKick";
    description = "Kick synthesizer based on old-school drum machine circuits";
-    license = with licenses; [ bsd3 ];
-    maintainers = with maintainers; [ magnetophon ];
-    platforms = platforms.linux;
+    license = [ lib.licenses.bsd3 ];
+    maintainers = [ lib.maintainers.magnetophon ];
+    platforms = lib.platforms.linux;
    mainProgram = "ChowKick";
  };
 })
--- a/pkgs/by-name/ec/ecspresso/package.nix
+++ b/pkgs/by-name/ec/ecspresso/package.nix
@ -7,20 +7,20 @@

 buildGoModule rec {
  pname = "ecspresso";
-  version = "2.6.2";
+  version = "2.6.3";

  src = fetchFromGitHub {
    owner = "kayac";
    repo = "ecspresso";
    tag = "v${version}";
-    hash = "sha256-9C/OJ1rnH77jcF3hDr2uyXcNViAkM84LjmkJsKmQkXo=";
+    hash = "sha256-ZruQx2Nm/1An9yGNhQ/2Kbah4eSFBD/pp3c6WZIBGXA=";
  };

  subPackages = [
    "cmd/ecspresso"
  ];

-  vendorHash = "sha256-tL/AjGU/Pi5ypcv9jqUukg6sGJqpPlHhwxzve7/KgDo=";
+  vendorHash = "sha256-oq2BOzSHwAq/gNBknwm1LXUKu+est/kjM1jlVBvQZbg=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/ev/evolve-core/package.nix
+++ b/pkgs/by-name/ev/evolve-core/package.nix
@ -1,12 +1,12 @@
 {
  lib,
  fetchFromGitHub,
-  flutter327,
+  flutter329,
  makeDesktopItem,
  copyDesktopItems,
 }:

-flutter327.buildFlutterApplication rec {
+flutter329.buildFlutterApplication rec {
  pname = "evolve-core";
  version = "1.7";

--- a/pkgs/by-name/fa/fastd-exporter/package.nix
+++ b/pkgs/by-name/fa/fastd-exporter/package.nix
@ -0,0 +1,35 @@
+{
+  buildGoModule,
+  fetchFromGitHub,
+  lib,
+}:
+
+buildGoModule {
+  pname = "fastd-exporter";
+  version = "0-unstable-2024-04-09";
+
+  src = fetchFromGitHub {
+    owner = "freifunk-darmstadt";
+    repo = "fastd-exporter";
+    rev = "374e4334af6661f4c91a3e83bf7ce071a2a72eca";
+    sha256 = "sha256-0oU4+9G19XP5qtGdcfMz08T04hjcoXX/O+FkaUPxzXE=";
+  };
+
+  vendorHash = "sha256-r0W64dct6XWa9sIrzy0UdyoMw+kAq73Qc/QchmsYZkY=";
+
+  ldflags = [
+    "-s"
+    "-w"
+  ];
+
+  meta = {
+    description = "Prometheus exporter for fastd";
+    homepage = "https://github.com/freifunk-darmstadt/fastd-exporter";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.linux;
+    mainProgram = "fastd-exporter";
+    maintainers = with lib.maintainers; [
+      felixsinger
+    ];
+  };
+}
--- a/pkgs/by-name/hd/hdf5-blosc/package.nix
+++ b/pkgs/by-name/hd/hdf5-blosc/package.nix
@ -43,6 +43,11 @@ stdenv.mkDerivation rec {
    "-DBUILD_TESTS=ON"
  ];

+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "cmake_minimum_required(VERSION 2.8.10)" "cmake_minimum_required(VERSION 3.10)"
+  '';
+
  postInstall = ''
    mkdir -p $out/lib/pkgconfig
    substituteAll ${./blosc_filter.pc.in} $out/lib/pkgconfig/blosc_filter.pc
--- a/pkgs/by-name/hy/hydralauncher/package.nix
+++ b/pkgs/by-name/hy/hydralauncher/package.nix
@ -6,10 +6,10 @@
 }:
 let
  pname = "hydralauncher";
-  version = "3.6.8";
+  version = "3.7.3";
  src = fetchurl {
    url = "https://github.com/hydralauncher/hydra/releases/download/v${version}/hydralauncher-${version}.AppImage";
-    hash = "sha256-wZszjO+4n1BaiWX9Dw+chZvL89hPmugHju5JlRfPYl4=";
+    hash = "sha256-prX/6cmWEz81nj/W28QbclyaJyNmGOug/ANXee3e0Cs=";
  };

  appimageContents = appimageTools.extractType2 { inherit pname src version; };
--- a/pkgs/by-name/ip/ipget/package.nix
+++ b/pkgs/by-name/ip/ipget/package.nix
@ -8,16 +8,16 @@

 buildGoModule rec {
  pname = "ipget";
-  version = "0.12.0";
+  version = "0.12.1";

  src = fetchFromGitHub {
    owner = "ipfs";
    repo = "ipget";
    rev = "v${version}";
-    hash = "sha256-7/wXrjnd7YD2qhVvP0yBMJDkDZjxJC1vZcQuqVd44rU=";
+    hash = "sha256-a+dVqIo+cmEnYrc1A98/APJq0m2pSKC5HKIN04rfziY=";
  };

-  vendorHash = "sha256-b6Lulzi7zgO0VdWboxi5Vibx8cjuZ6r6O1PJvYubZu4=";
+  vendorHash = "sha256-tYBM0NGHhLNTRfsv+UgBmtpxItjPIr7Klo708vaXItw=";

  postPatch = ''
    # main module (github.com/ipfs/ipget) does not contain package github.com/ipfs/ipget/sharness/dependencies
--- a/pkgs/by-name/ja/jack-link/package.nix
+++ b/pkgs/by-name/ja/jack-link/package.nix
@ -0,0 +1,40 @@
+{
+  stdenv,
+  lib,
+  fetchFromGitHub,
+  unstableGitUpdater,
+  pkg-config,
+  libjack2,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "jack-link";
+  version = "0.2.4";
+
+  src = fetchFromGitHub {
+    owner = "rncbc";
+    repo = "jack_link";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-bIB3lxKKaI8DLtmnkRTTHXDopCZ3FAv15cAYcyJcBYA=";
+    fetchSubmodules = true;
+  };
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    libjack2
+  ];
+
+  makeFlags = [ "PREFIX=$(out)" ];
+
+  meta = {
+    homepage = "https://github.com/rncbc/jack_link";
+    description = "jack_link bridges JACK transport with Ableton Link";
+    license = lib.licenses.gpl2Plus;
+    mainProgram = "jack_link";
+    maintainers = with lib.maintainers; [ magnetophon ];
+    platforms = lib.platforms.linux;
+  };
+})
--- a/pkgs/by-name/ka/karabiner-dk/package.nix
+++ b/pkgs/by-name/ka/karabiner-dk/package.nix
@ -12,14 +12,14 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "karabiner-dk";
-  sourceVersion = "6.4.0";
+  sourceVersion = "6.5.0";
  version = lib.defaultTo finalAttrs.sourceVersion driver-version;

  src = fetchFromGitHub {
    owner = "pqrs-org";
    repo = "Karabiner-DriverKit-VirtualHIDDevice";
    tag = "v${finalAttrs.sourceVersion}";
-    hash = "sha256-NlzIb9srGVdYUOAOL8W9UJZVrf5IQOm6TVjm73epemM=";
+    hash = "sha256-/77FaQUiJXqS7szOb92n/czuBup+f29GwLjQ9OXPvC4=";
  };

  nativeBuildInputs = [
@ -44,7 +44,7 @@ stdenv.mkDerivation (finalAttrs: {

  passthru.updateScript = writeShellScript "karabiner-dk" ''
    NEW_VERSION=$(${lib.getExe curl} --silent https://api.github.com/repos/pqrs-org/Karabiner-DriverKit-VirtualHIDDevice/releases/latest $${GITHUB_TOKEN:+" -u \":$GITHUB_TOKEN\""} | ${lib.getExe jq} '.tag_name | ltrimstr("v")' --raw-output)
-    ${lib.getExe' common-updater-scripts "update-source-version"} "karabiner-dk" "$NEW_VERSION" --ignore-same-version --version-key="sourceVersion";
+    ${lib.getExe' common-updater-scripts "update-source-version"} "karabiner-dk" "$NEW_VERSION" --system=aarch64-darwin --ignore-same-version --version-key="sourceVersion";
  '';

  meta = {
--- a/pkgs/by-name/kg/kgeotag/package.nix
+++ b/pkgs/by-name/kg/kgeotag/package.nix
@ -9,14 +9,14 @@

 stdenv.mkDerivation {
  pname = "kgeotag";
-  version = "1.8.0-unstable-2025-07-25";
+  version = "1.8.0-unstable-2025-11-01";

  src = fetchFromGitLab {
    domain = "invent.kde.org";
    repo = "kgeotag";
    owner = "graphics";
-    rev = "b2b140e8f72ab37bad3729bea527203324d12131";
-    hash = "sha256-jUcKm4IPQt2JiZUmIjMJ9EG0kDjzoPGjzBPMHZ6j9lM=";
+    rev = "879418eb57e96beb5be3e3a69d0bab2b666b7c7f";
+    hash = "sha256-RFC8UMrURn2vsTRjPFyLNlsep/PWRadkRkS7aFtTlKE=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/la/lazygit/package.nix
+++ b/pkgs/by-name/la/lazygit/package.nix
@ -8,13 +8,13 @@
 }:
 buildGoModule rec {
  pname = "lazygit";
-  version = "0.55.1";
+  version = "0.56.0";

  src = fetchFromGitHub {
    owner = "jesseduffield";
    repo = "lazygit";
    tag = "v${version}";
-    hash = "sha256-UofhgILZhVXnYiGpb25m4Ct4sbu5pRmjVgj3oEf5Uyk=";
+    hash = "sha256-oTj+9zDmbXD4rlFZ++hcd1WSfskSNI7ojI9gN8UcpT8=";
  };

  vendorHash = null;
--- a/pkgs/by-name/ll/llama-cpp/package.nix
+++ b/pkgs/by-name/ll/llama-cpp/package.nix
@ -75,13 +75,13 @@ let
 in
 effectiveStdenv.mkDerivation (finalAttrs: {
  pname = "llama-cpp";
-  version = "6869";
+  version = "6908";

  src = fetchFromGitHub {
    owner = "ggml-org";
    repo = "llama.cpp";
    tag = "b${finalAttrs.version}";
-    hash = "sha256-LZSeejn1IPybmfoRsOhg1YpTCFl0LrRJZyKT8ECbVjo=";
+    hash = "sha256-7zgeVK1dQLFy9rm6VsaVK9/vIadMst+RNry5Vf7yk+A=";
    leaveDotGit = true;
    postFetch = ''
      git -C "$out" rev-parse --short HEAD > $out/COMMIT
--- a/pkgs/by-name/lo/localsend/package.nix
+++ b/pkgs/by-name/lo/localsend/package.nix
@ -3,7 +3,7 @@
  stdenv,
  fetchurl,
  fetchFromGitHub,
-  flutter327,
+  flutter329,
  makeDesktopItem,
  copyDesktopItems,
  nixosTests,
@ -16,7 +16,7 @@ let
  pname = "localsend";
  version = "1.17.0";

-  linux = flutter327.buildFlutterApplication rec {
+  linux = flutter329.buildFlutterApplication rec {
    inherit pname version;

    src = fetchFromGitHub {
--- a/pkgs/by-name/mo/mongodb-atlas-cli/package.nix
+++ b/pkgs/by-name/mo/mongodb-atlas-cli/package.nix
@ -11,16 +11,16 @@

 buildGoModule rec {
  pname = "mongodb-atlas-cli";
-  version = "1.49.0";
+  version = "1.50.0";

  src = fetchFromGitHub {
    owner = "mongodb";
    repo = "mongodb-atlas-cli";
    tag = "atlascli/v${version}";
-    hash = "sha256-thip1zWOQJOKrShf8O1erIUdYuqLg6VaMqMRV/a7/dg=";
+    hash = "sha256-vo2vfnGKp71S9mVGK5SVi8YqNLjedzfjJhh5uK/pb4E=";
  };

-  vendorHash = "sha256-HtdZ+wfibcqKoTf5BT5nNX4+m7bP/f2gvkvA+PnYb2s=";
+  vendorHash = "sha256-qcB8Hgp/4kVsEo32E6I4GMSBbRByPTyk3Oas2CpS4Xc=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/by-name/mo/mongodb-compass/package.nix
+++ b/pkgs/by-name/mo/mongodb-compass/package.nix
@ -40,7 +40,7 @@

 let
  pname = "mongodb-compass";
-  version = "1.47.1";
+  version = "1.48.0";

  selectSystem =
    attrs:
@ -55,9 +55,9 @@ let
      }
    }";
    hash = selectSystem {
-      x86_64-linux = "sha256-L+IhvRqUllrFkntYeuE+3Ox59U60fu0P2VP6Zb/1ORA=";
-      x86_64-darwin = "sha256-NYgXtCdrny6pKACYmWDHvrlCOJupyP4GqobDr+13WqU=";
-      aarch64-darwin = "sha256-mZ6bLY6hnOhPb2pxPKpiVQpF3ffZlC265QvkIIjpM9A=";
+      x86_64-linux = "sha256-lmg+zfUUT4dAObJzEmGzBCmnHkc6rkPKk1XIfmZ6uJc=";
+      x86_64-darwin = "sha256-T7MF1TYBPbTg2VBWImA38xN+eCs1ZKT2e5TzHYi08KE=";
+      aarch64-darwin = "sha256-zKSmhU0p87+2SFzA7ZdMy/p/cw8K5JtYfC5np6HnjBg=";
    };
  };

--- a/pkgs/by-name/na/nagios/package.nix
+++ b/pkgs/by-name/na/nagios/package.nix
@ -16,13 +16,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "nagios";
-  version = "4.5.9";
+  version = "4.5.10";

  src = fetchFromGitHub {
    owner = "NagiosEnterprises";
    repo = "nagioscore";
    tag = "nagios-${finalAttrs.version}";
-    hash = "sha256-aOHdMZJCrGeJ3XA3+ed3JUb7X1FdfdGiT2ytzBDAT4c=";
+    hash = "sha256-NnGnatzu/iFKFaofg0O2gqDqkQwg/jrBLgSmrWqef5Q=";
  };

  patches = [ ./nagios.patch ];
--- a/pkgs/by-name/na/navicat-premium/package.nix
+++ b/pkgs/by-name/na/navicat-premium/package.nix
@ -3,35 +3,130 @@
  stdenv,
  fetchurl,
  appimageTools,
+  autoPatchelfHook,
+  qt6,
+  cjson,
+  curl,
+  e2fsprogs,
+  expat,
+  fontconfig,
+  freetype,
+  glib,
+  glibc,
+  harfbuzz,
+  libGL,
+  libX11,
+  libgpg-error,
+  libselinux,
+  libxcb,
+  libxcrypt,
+  libxcrypt-legacy,
+  libxkbcommon,
+  p11-kit,
+  pango,
 }:
-let
+
+stdenv.mkDerivation (finalAttrs: {
  pname = "navicat-premium";
-  version = "17.3.1";
+  version = "17.3.3";

-  src =
-    {
-      x86_64-linux = fetchurl {
-        url = "https://web.archive.org/web/20250904095427/https://dn.navicat.com/download/navicat17-premium-en-x86_64.AppImage";
-        hash = "sha256-5vGctpbAg3mVhalr+Yg3iFZNCyY+0+a98sldhUcHkm0=";
-      };
-      aarch64-linux = fetchurl {
-        url = "https://web.archive.org/web/20250904095643/https://dn.navicat.com/download/navicat17-premium-en-aarch64.AppImage";
-        hash = "sha256-r31u/b/3HO9PEQtIr9AZ/5NVrRcgJ+GACHPWCICZYec=";
-      };
-    }
-    .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
-
-  appimageContents = appimageTools.extractType2 {
-    inherit pname version src;
+  src = appimageTools.extractType2 {
+    inherit (finalAttrs) pname version;
+    src =
+      {
+        x86_64-linux = fetchurl {
+          url = "https://web.archive.org/web/20251008050849/https://dn.navicat.com/download/navicat17-premium-en-x86_64.AppImage";
+          hash = "sha256-gXXj2FXOw2OHUTaX5XYtd0/nL/E/hNmcmvc0TDaOCUQ=";
+        };
+        aarch64-linux = fetchurl {
+          url = "https://web.archive.org/web/20251008051000/https://dn.navicat.com/download/navicat17-premium-en-aarch64.AppImage";
+          hash = "sha256-18JbUJV8jAXRiVVerfYZLsjy+5K2DjwqAY+Hqjtlnfg=";
+        };
+      }
+      .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
  };
-in
-appimageTools.wrapType2 {
-  inherit pname version src;

-  extraInstallCommands = ''
-    cp -r ${appimageContents}/usr/share $out/share
-    substituteInPlace $out/share/applications/navicat.desktop \
-      --replace-fail "Exec=navicat" "Exec=navicat-premium"
+  nativeBuildInputs = [
+    autoPatchelfHook
+    qt6.wrapQtAppsHook
+  ];
+
+  buildInputs = [
+    cjson
+    curl
+    e2fsprogs
+    expat
+    fontconfig
+    freetype
+    glib
+    glibc
+    harfbuzz
+    libGL
+    libX11
+    libgpg-error
+    libselinux
+    libxcb
+    libxcrypt
+    libxcrypt-legacy
+    libxkbcommon
+    p11-kit
+    pango
+    qt6.qtbase
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    cp -r --no-preserve=mode usr $out
+    chmod +x $out/bin/navicat
+    mkdir -p $out/usr
+    ln -s $out/lib $out/usr/lib
+
+    runHook postInstall
+  '';
+
+  autoPatchelfIgnoreMissingDeps = lib.optionals stdenv.hostPlatform.isAarch64 [
+    "libgs_ktool.so"
+    "libkmc.so"
+  ];
+
+  dontWrapQtApps = true;
+
+  preFixup = ''
+    rm $out/lib/libselinux.so.1
+    ln -s ${libselinux.out}/lib/libselinux.so.1 $out/lib/libselinux.so.1
+    rm $out/lib/glib/libglib-2.0.so.0
+    ln -s ${glib.out}/lib/libglib-2.0.so.0 $out/lib/glib/libglib-2.0.so.0
+    patchelf --replace-needed libcrypt.so.1 \
+      ${libxcrypt}/lib/libcrypt.so.2 $out/lib/pq-g/libpq.so.5.5
+    patchelf --replace-needed libcrypt.so.1 \
+      ${libxcrypt}/lib/libcrypt.so.2 $out/lib/pq-g/libpq_ce.so.5.5
+    patchelf --replace-needed libselinux.so.1 \
+      ${libselinux.out}/lib/libselinux.so.1 $out/lib/pq-g/libpq.so.5.5
+    wrapQtApp $out/bin/navicat \
+      --prefix LD_LIBRARY_PATH : ${
+        lib.makeLibraryPath [
+          e2fsprogs
+          expat
+          fontconfig
+          freetype
+          glib
+          glibc
+          harfbuzz
+          libGL
+          libX11
+          libgpg-error
+          libselinux
+          libxcb
+          libxkbcommon
+          p11-kit
+          pango
+        ]
+      }:$out/lib \
+      --set QT_PLUGIN_PATH $out/plugins \
+      --set QT_QPA_PLATFORM xcb \
+      --set QT_STYLE_OVERRIDE Fusion \
+      --chdir $out
  '';

  meta = {
@ -47,4 +142,4 @@ appimageTools.wrapType2 {
    ];
    mainProgram = "navicat-premium";
  };
-}
+})
--- a/pkgs/by-name/op/openmpi/package.nix
+++ b/pkgs/by-name/op/openmpi/package.nix
@ -40,11 +40,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "openmpi";
-  version = "5.0.8";
+  version = "5.0.9";

  src = fetchurl {
    url = "https://www.open-mpi.org/software/ompi/v${lib.versions.majorMinor finalAttrs.version}/downloads/openmpi-${finalAttrs.version}.tar.bz2";
-    sha256 = "sha256-UxMeGlfnJw9kVwf4sLZbpWBI9bWsP2j6q+0+sNcQ5Ek=";
+    sha256 = "sha256-37cnYlMRcIR68+Sg8h1317I8829nznzpAzZZJzZ32As=";
  };

  postPatch = ''
--- a/pkgs/by-name/ov/ovhcloud-cli/package.nix
+++ b/pkgs/by-name/ov/ovhcloud-cli/package.nix
@ -8,13 +8,13 @@

 buildGoModule (finalAttrs: {
  pname = "ovhcloud-cli";
-  version = "0.7.1";
+  version = "0.8.1";

  src = fetchFromGitHub {
    owner = "ovh";
    repo = "ovhcloud-cli";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-pps6PuaIJxZ0ewrBXgq4TnICOW3wjHJQDDmcQUfYDNg=";
+    hash = "sha256-Z5CMOZ1NJ0tcO/aKkFQetW/E0eURucv/CyT6KnoMCHQ=";
  };

  vendorHash = "sha256-WNONEceR/cDVloosQ/BMYjPTk9elQ1oTX89lgzENSAI=";
--- a/pkgs/by-name/pi/pied/package.nix
+++ b/pkgs/by-name/pi/pied/package.nix
@ -1,11 +1,11 @@
 {
  lib,
  fetchFromGitHub,
-  flutter327,
+  flutter329,
  gst_all_1,
 }:

-flutter327.buildFlutterApplication rec {
+flutter329.buildFlutterApplication rec {
  pname = "pied";
  version = "0.3.1";

--- a/pkgs/by-name/pl/pluto/package.nix
+++ b/pkgs/by-name/pl/pluto/package.nix
@ -6,13 +6,13 @@

 buildGoModule rec {
  pname = "pluto";
-  version = "5.22.5";
+  version = "5.22.6";

  src = fetchFromGitHub {
    owner = "FairwindsOps";
    repo = "pluto";
    rev = "v${version}";
-    hash = "sha256-MserKZcOkif56XeTLRzHDDk6HYeVhgKsnOjsfv0vPeQ=";
+    hash = "sha256-6Xi+EWQvFYtdiVywhSB4Lmzsc6Z1nE8UWO8vBteVOnE=";
  };

  vendorHash = "sha256-59mRVfQ2rduTvIJE1l/j3K+PY3OEMfNpjjYg3hqNUhs=";
--- a/pkgs/by-name/po/pocket-id/package.nix
+++ b/pkgs/by-name/po/pocket-id/package.nix
@ -11,13 +11,13 @@

 buildGo125Module (finalAttrs: {
  pname = "pocket-id";
-  version = "1.14.1";
+  version = "1.14.2";

  src = fetchFromGitHub {
    owner = "pocket-id";
    repo = "pocket-id";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-PnZKlJ6smwpgijqQM5xTcopyGJfO2pebiEJhEIdAOFk=";
+    hash = "sha256-0x80oykzMTEsuGUBtXXdKgWJld8mrDPUssYpAznqKnc=";
  };

  sourceRoot = "${finalAttrs.src.name}/backend";
--- a/pkgs/by-name/po/podofo_0_9/package.nix
+++ b/pkgs/by-name/po/podofo_0_9/package.nix
@ -62,6 +62,9 @@ stdenv.mkDerivation rec {
        -e 's/LIBDIRNAME/CMAKE_INSTALL_LIBDIR/' -e "$failNoMatches"
    sed -ni src/podofo/libpodofo.pc.in \
        -e 's/^libdir=.*/libdir=@CMAKE_INSTALL_LIBDIR@/' -e "$failNoMatches"
+
+    substituteInPlace {src/podofo/,./}CMakeLists.txt \
+      --replace-fail "CMAKE_MINIMUM_REQUIRED(VERSION 2.6)" "cmake_minimum_required(VERSION 3.10)"
  '';

  meta = {
--- a/pkgs/by-name/pr/precious/package.nix
+++ b/pkgs/by-name/pr/precious/package.nix
@ -8,16 +8,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "precious";
-  version = "0.10.0";
+  version = "0.10.1";

  src = fetchFromGitHub {
    owner = "houseabsolute";
    repo = "precious";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-bHrn78wzdkxV92Lp3MzNUpSvMTyc8l3tw+z5NBxJPoA=";
+    hash = "sha256-xM4NqcT1NGR3tkLOPt59lfFpjRnohU+tTTk9Ijkf97o=";
  };

-  cargoHash = "sha256-OA1C98C0BHEVl056UCL5alT292djuBDGFjZn2HAytEQ=";
+  cargoHash = "sha256-tp0kvG5G7mW0czfZ43AbT7Lcv1sMnO5Zc+t2d5w4aqA=";

  nativeInstallCheckInputs = [ versionCheckHook ];
  doInstallCheck = true;
--- a/pkgs/by-name/sd/sdl-jstest/package.nix
+++ b/pkgs/by-name/sd/sdl-jstest/package.nix
@ -13,13 +13,13 @@

 stdenv.mkDerivation {
  pname = "sdl-jstest";
-  version = "2018-06-15";
+  version = "0.2.2-unstable-2025-03-27";

  src = fetchFromGitHub {
    owner = "Grumbel";
    repo = "sdl-jstest";
-    rev = "aafbdb1ed3e687583037ba55ae88b1210d6ce98b";
-    hash = "sha256-Mw+ENOVZ0O8WercdDNLAAkNMPZ2NyxSa+nMtgNmXjFw=";
+    rev = "917d27b3b45a335137bd2c8597f8bcf2bac8a569";
+    hash = "sha256-lUHI72fcIEllbcieUrp9A/iKSjUHqmKOUXbzdXCV5jE=";
    fetchSubmodules = true;
  };

--- a/pkgs/by-name/sl/sly/package.nix
+++ b/pkgs/by-name/sl/sly/package.nix
@ -1,7 +1,7 @@
 {
  lib,
  fetchFromGitHub,
-  flutter327,
+  flutter335,
  runCommand,
  yq,
  sly,
@ -9,7 +9,7 @@
  gitUpdater,
 }:

-flutter327.buildFlutterApplication rec {
+flutter335.buildFlutterApplication rec {
  pname = "sly";
  version = "1.0.0";

--- a/pkgs/by-name/sl/sly/pubspec.lock.json
+++ b/pkgs/by-name/sl/sly/pubspec.lock.json
@ -4,51 +4,51 @@
      "dependency": "transitive",
      "description": {
        "name": "archive",
-        "sha256": "08064924cbf0ab88280a0c3f60db9dd24fec693927e725ecb176f16c629d1cb8",
+        "sha256": "2fde1607386ab523f7a36bb3e7edb43bd58e6edaf2ffb29d8a6d578b297fdbbd",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "4.0.1"
+      "version": "4.0.7"
    },
    "args": {
      "dependency": "transitive",
      "description": {
        "name": "args",
-        "sha256": "bf9f5caeea8d8fe6721a9c358dd8a5c1947b27f1cfaa18b39c301273594919e6",
+        "sha256": "d0481093c50b1da8910eb0bb301626d4d8eb7284aa739614d2b394ee09e3ea04",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "2.6.0"
+      "version": "2.7.0"
    },
    "async": {
      "dependency": "transitive",
      "description": {
        "name": "async",
-        "sha256": "947bfcf187f74dbc5e146c9eb9c0f10c9f8b30743e341481c1e2ed3ecc18c20c",
+        "sha256": "758e6d74e971c3e5aceb4110bfd6698efc7f501675bcfe0c775459a8140750eb",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "2.11.0"
+      "version": "2.13.0"
    },
    "boolean_selector": {
      "dependency": "transitive",
      "description": {
        "name": "boolean_selector",
-        "sha256": "6cfb5af12253eaf2b368f07bacc5a80d1301a071c73360d746b7f2e32d762c66",
+        "sha256": "8aab1771e1243a5063b8b0ff68042d67334e3feab9e95b9490f9a6ebf73b42ea",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "2.1.1"
+      "version": "2.1.2"
    },
    "characters": {
      "dependency": "transitive",
      "description": {
        "name": "characters",
-        "sha256": "04a925763edad70e8443c99234dc3328f442e811f1d8fd1a72f1c8ad0f69a605",
+        "sha256": "f71061c654a3380576a52b451dd5532377954cf9dbd272a78fc8479606670803",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "1.3.0"
+      "version": "1.4.0"
    },
    "cli_util": {
      "dependency": "transitive",
@ -64,21 +64,21 @@
      "dependency": "transitive",
      "description": {
        "name": "clock",
-        "sha256": "cb6d7f03e1de671e34607e909a7213e31d7752be4fb66a86d29fe1eb14bfb5cf",
+        "sha256": "fddb70d9b5277016c77a80201021d40a2247104d9f4aa7bab7157b7e3f05b84b",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "1.1.1"
+      "version": "1.1.2"
    },
    "collection": {
      "dependency": "transitive",
      "description": {
        "name": "collection",
-        "sha256": "a1ace0a119f20aabc852d165077c036cd864315bd99b7eaa10a60100341941bf",
+        "sha256": "2f5709ae4d3d59dd8f7cd309b4e023046b57d8a6c82130785d2b0e5868084e76",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "1.19.0"
+      "version": "1.19.1"
    },
    "console": {
      "dependency": "transitive",
@ -94,11 +94,11 @@
      "dependency": "direct main",
      "description": {
        "name": "crop_image",
-        "sha256": "2e629cd141a360cb9060b5a0837fd49b0260d3d931244717213bf164f6813c82",
+        "sha256": "4fdebd00d0c7d1a6e3abeb1e3843efbc202204b867f3e377fcebcf77aaf69a17",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "1.0.15"
+      "version": "1.0.16"
    },
    "cross_file": {
      "dependency": "transitive",
@ -134,21 +134,21 @@
      "dependency": "transitive",
      "description": {
        "name": "fake_async",
-        "sha256": "511392330127add0b769b75a987850d136345d9227c6b94c96a04cf4a391bf78",
+        "sha256": "5368f224a74523e8d2e7399ea1638b37aecfca824a3cc4dfdf77bf1fa905ac44",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "1.3.1"
+      "version": "1.3.3"
    },
    "ffi": {
      "dependency": "transitive",
      "description": {
        "name": "ffi",
-        "sha256": "16ed7b077ef01ad6170a3d0c57caa4a112a38d7a2ed5602e0aca9ca6f3d98da6",
+        "sha256": "289279317b4b16eb2bb7e271abccd4bf84ec9bdcbe999e278a94b804f5630418",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "2.1.3"
+      "version": "2.1.4"
    },
    "file": {
      "dependency": "transitive",
@ -164,31 +164,31 @@
      "dependency": "direct main",
      "description": {
        "name": "file_selector",
-        "sha256": "5019692b593455127794d5718304ff1ae15447dea286cdda9f0db2a796a1b828",
+        "sha256": "5f1d15a7f17115038f433d1b0ea57513cc9e29a9d5338d166cb0bef3fa90a7a0",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "1.0.3"
+      "version": "1.0.4"
    },
    "file_selector_android": {
      "dependency": "transitive",
      "description": {
        "name": "file_selector_android",
-        "sha256": "98ac58e878b05ea2fdb204e7f4fc4978d90406c9881874f901428e01d3b18fbc",
+        "sha256": "2db9a2d05f66b49a3b45c4a7c2f040dd5fcd457ca30f39df7cdcf80b8cd7f2d4",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "0.5.1+12"
+      "version": "0.5.2+1"
    },
    "file_selector_ios": {
      "dependency": "transitive",
      "description": {
        "name": "file_selector_ios",
-        "sha256": "94b98ad950b8d40d96fee8fa88640c2e4bd8afcdd4817993bd04e20310f45420",
+        "sha256": "fc3c3fc567cd9bcae784dfeb98d37c46a8ded9e8757d37ea67e975c399bc14e0",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "0.5.3+1"
+      "version": "0.5.3+3"
    },
    "file_selector_linux": {
      "dependency": "transitive",
@ -204,11 +204,11 @@
      "dependency": "transitive",
      "description": {
        "name": "file_selector_macos",
-        "sha256": "271ab9986df0c135d45c3cdb6bd0faa5db6f4976d3e4b437cf7d0f258d941bfc",
+        "sha256": "88707a3bec4b988aaed3b4df5d7441ee4e987f20b286cddca5d6a8270cab23f2",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "0.9.4+2"
+      "version": "0.9.4+5"
    },
    "file_selector_platform_interface": {
      "dependency": "transitive",
@ -234,11 +234,11 @@
      "dependency": "transitive",
      "description": {
        "name": "file_selector_windows",
-        "sha256": "8f5d2f6590d51ecd9179ba39c64f722edc15226cc93dcc8698466ad36a4a85a4",
+        "sha256": "320fcfb6f33caa90f0b58380489fc5ac05d99ee94b61aa96ec2bff0ba81d3c2b",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "0.9.3+3"
+      "version": "0.9.3+4"
    },
    "fl_chart": {
      "dependency": "direct main",
@ -270,11 +270,11 @@
      "dependency": "transitive",
      "description": {
        "name": "flutter_plugin_android_lifecycle",
-        "sha256": "615a505aef59b151b46bbeef55b36ce2b6ed299d160c51d84281946f0aa0ce0e",
+        "sha256": "306f0596590e077338312f38837f595c04f28d6cdeeac392d3d74df2f0003687",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "2.0.24"
+      "version": "2.0.32"
    },
    "flutter_test": {
      "dependency": "direct dev",
@ -292,21 +292,21 @@
      "dependency": "direct main",
      "description": {
        "name": "gal",
-        "sha256": "2771519c8b29f784d5e27f4efc2667667eef51c6c47cccaa0435a8fe8aa208e4",
+        "sha256": "969598f986789127fd407a750413249e1352116d4c2be66e81837ffeeaafdfee",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "2.3.1"
+      "version": "2.3.2"
    },
    "get_it": {
      "dependency": "transitive",
      "description": {
        "name": "get_it",
-        "sha256": "d85128a5dae4ea777324730dc65edd9c9f43155c109d5cc0a69cab74139fbac1",
+        "sha256": "a4292e7cf67193f8e7c1258203104eb2a51ec8b3a04baa14695f4064c144297b",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "7.7.0"
+      "version": "8.2.0"
    },
    "handy_window": {
      "dependency": "direct main",
@ -322,111 +322,111 @@
      "dependency": "transitive",
      "description": {
        "name": "http",
-        "sha256": "b9c29a161230ee03d3ccf545097fccd9b87a5264228c5d348202e0f0c28f9010",
+        "sha256": "bb2ce4590bc2667c96f318d68cac1b5a7987ec819351d32b1c987239a815e007",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "1.2.2"
+      "version": "1.5.0"
    },
    "http_parser": {
      "dependency": "transitive",
      "description": {
        "name": "http_parser",
-        "sha256": "2aa08ce0341cc9b354a498388e30986515406668dbcc4f7c950c3e715496693b",
+        "sha256": "178d74305e7866013777bab2c3d8726205dc5a4dd935297175b19a23a2e66571",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "4.0.2"
+      "version": "4.1.2"
    },
    "image": {
      "dependency": "direct main",
      "description": {
        "name": "image",
-        "sha256": "20842a5ad1555be624c314b0c0cc0566e8ece412f61e859a42efeb6d4101a26c",
+        "sha256": "4e973fcf4caae1a4be2fa0a13157aa38a8f9cb049db6529aa00b4d71abc4d928",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "4.5.0"
+      "version": "4.5.4"
    },
    "image_picker": {
      "dependency": "direct main",
      "description": {
        "name": "image_picker",
-        "sha256": "021834d9c0c3de46bf0fe40341fa07168407f694d9b2bb18d532dc1261867f7a",
+        "sha256": "736eb56a911cf24d1859315ad09ddec0b66104bc41a7f8c5b96b4e2620cf5041",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "1.1.2"
+      "version": "1.2.0"
    },
    "image_picker_android": {
      "dependency": "transitive",
      "description": {
        "name": "image_picker_android",
-        "sha256": "fa8141602fde3f7e2f81dbf043613eb44dfa325fa0bcf93c0f142c9f7a2c193e",
+        "sha256": "58a85e6f09fe9c4484d53d18a0bd6271b72c53fce1d05e6f745ae36d8c18efca",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "0.8.12+18"
+      "version": "0.8.13+5"
    },
    "image_picker_for_web": {
      "dependency": "transitive",
      "description": {
        "name": "image_picker_for_web",
-        "sha256": "717eb042ab08c40767684327be06a5d8dbb341fe791d514e4b92c7bbe1b7bb83",
+        "sha256": "40c2a6a0da15556dc0f8e38a3246064a971a9f512386c3339b89f76db87269b6",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "3.0.6"
+      "version": "3.1.0"
    },
    "image_picker_ios": {
      "dependency": "transitive",
      "description": {
        "name": "image_picker_ios",
-        "sha256": "4f0568120c6fcc0aaa04511cb9f9f4d29fc3d0139884b1d06be88dcec7641d6b",
+        "sha256": "e675c22790bcc24e9abd455deead2b7a88de4b79f7327a281812f14de1a56f58",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "0.8.12+1"
+      "version": "0.8.13+1"
    },
    "image_picker_linux": {
      "dependency": "transitive",
      "description": {
        "name": "image_picker_linux",
-        "sha256": "4ed1d9bb36f7cd60aa6e6cd479779cc56a4cb4e4de8f49d487b1aaad831300fa",
+        "sha256": "1f81c5f2046b9ab724f85523e4af65be1d47b038160a8c8deed909762c308ed4",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "0.2.1+1"
+      "version": "0.2.2"
    },
    "image_picker_macos": {
      "dependency": "transitive",
      "description": {
        "name": "image_picker_macos",
-        "sha256": "3f5ad1e8112a9a6111c46d0b57a7be2286a9a07fc6e1976fdf5be2bd31d4ff62",
+        "sha256": "86f0f15a309de7e1a552c12df9ce5b59fe927e71385329355aec4776c6a8ec91",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "0.2.1+1"
+      "version": "0.2.2+1"
    },
    "image_picker_platform_interface": {
      "dependency": "transitive",
      "description": {
        "name": "image_picker_platform_interface",
-        "sha256": "9ec26d410ff46f483c5519c29c02ef0e02e13a543f882b152d4bfd2f06802f80",
+        "sha256": "567e056716333a1647c64bb6bd873cff7622233a5c3f694be28a583d4715690c",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "2.10.0"
+      "version": "2.11.1"
    },
    "image_picker_windows": {
      "dependency": "transitive",
      "description": {
        "name": "image_picker_windows",
-        "sha256": "6ad07afc4eb1bc25f3a01084d28520496c4a3bb0cb13685435838167c9dcedeb",
+        "sha256": "d248c86554a72b5495a31c56f060cf73a41c7ff541689327b1a7dbccc33adfae",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "0.2.1+1"
+      "version": "0.2.2"
    },
    "json_annotation": {
      "dependency": "transitive",
@ -442,31 +442,31 @@
      "dependency": "transitive",
      "description": {
        "name": "leak_tracker",
-        "sha256": "7bb2830ebd849694d1ec25bf1f44582d6ac531a57a365a803a6034ff751d2d06",
+        "sha256": "33e2e26bdd85a0112ec15400c8cbffea70d0f9c3407491f672a2fad47915e2de",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "10.0.7"
+      "version": "11.0.2"
    },
    "leak_tracker_flutter_testing": {
      "dependency": "transitive",
      "description": {
        "name": "leak_tracker_flutter_testing",
-        "sha256": "9491a714cca3667b60b5c420da8217e6de0d1ba7a5ec322fab01758f6998f379",
+        "sha256": "1dbc140bb5a23c75ea9c4811222756104fbcd1a27173f0c34ca01e16bea473c1",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "3.0.8"
+      "version": "3.0.10"
    },
    "leak_tracker_testing": {
      "dependency": "transitive",
      "description": {
        "name": "leak_tracker_testing",
-        "sha256": "6ba465d5d76e67ddf503e1161d1f4a6bc42306f9d66ca1e8f079a47290fb06d3",
+        "sha256": "8d5a2d49f4a66b49744b23b018848400d23e54caf9463f4eb20df3eb8acb2eb1",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "3.0.1"
+      "version": "3.0.2"
    },
    "lints": {
      "dependency": "transitive",
@ -482,11 +482,11 @@
      "dependency": "transitive",
      "description": {
        "name": "matcher",
-        "sha256": "d2323aa2060500f906aa31a895b4030b6da3ebdcc5619d14ce1aada65cd161cb",
+        "sha256": "dc58c723c3c24bf8d3e2d3ad3f2f9d7bd9cf43ec6feaa64181775e60190153f2",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "0.12.16+1"
+      "version": "0.12.17"
    },
    "material_color_utilities": {
      "dependency": "transitive",
@ -502,11 +502,11 @@
      "dependency": "transitive",
      "description": {
        "name": "meta",
-        "sha256": "bdb68674043280c3428e9ec998512fb681678676b3c54e773629ffe74419f8c7",
+        "sha256": "e3641ec5d63ebf0d9b41bd43201a66e3fc79a65db5f61fc181f04cd27aab950c",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "1.15.0"
+      "version": "1.16.0"
    },
    "mime": {
      "dependency": "transitive",
@ -522,31 +522,31 @@
      "dependency": "direct dev",
      "description": {
        "name": "msix",
-        "sha256": "c50d6bd1aafe0d071a3c1e5a5ccb056404502935cb0a549e3178c4aae16caf33",
+        "sha256": "f88033fcb9e0dd8de5b18897cbebbd28ea30596810f4a7c86b12b0c03ace87e5",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "3.16.8"
+      "version": "3.16.12"
    },
    "package_config": {
      "dependency": "transitive",
      "description": {
        "name": "package_config",
-        "sha256": "92d4488434b520a62570293fbd33bb556c7d49230791c1b4bbd973baf6d2dc67",
+        "sha256": "f096c55ebb7deb7e384101542bfba8c52696c1b56fca2eb62827989ef2353bbc",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "2.1.1"
+      "version": "2.2.0"
    },
    "path": {
      "dependency": "transitive",
      "description": {
        "name": "path",
-        "sha256": "087ce49c3f0dc39180befefc60fdb4acd8f8620e5682fe2476afd0b3688bb4af",
+        "sha256": "75cca69d1490965be98c73ceaea117e8a04dd21217b37b292c9ddbec0d955bc5",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "1.9.0"
+      "version": "1.9.1"
    },
    "path_provider_linux": {
      "dependency": "transitive",
@ -582,11 +582,11 @@
      "dependency": "transitive",
      "description": {
        "name": "petitparser",
-        "sha256": "c15605cd28af66339f8eb6fbe0e541bfe2d1b72d5825efc6598f3e0a31b9ad27",
+        "sha256": "1a97266a94f7350d30ae522c0af07890c70b8e62c71e8e3920d1db4d23c057d1",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "6.0.2"
+      "version": "7.0.1"
    },
    "platform": {
      "dependency": "transitive",
@ -612,21 +612,21 @@
      "dependency": "transitive",
      "description": {
        "name": "posix",
-        "sha256": "a0117dc2167805aa9125b82eee515cc891819bac2f538c83646d355b16f58b9a",
+        "sha256": "6323a5b0fa688b6a010df4905a56b00181479e6d10534cecfecede2aa55add61",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "6.0.1"
+      "version": "6.0.3"
    },
    "pub_semver": {
      "dependency": "transitive",
      "description": {
        "name": "pub_semver",
-        "sha256": "7b3cfbf654f3edd0c6298ecd5be782ce997ddf0e00531b9464b55245185bbbbd",
+        "sha256": "5bfcf68ca79ef689f8990d1160781b4bad40a3bd5e5218ad4076ddb7f4081585",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "2.1.5"
+      "version": "2.2.0"
    },
    "screen_retriever": {
      "dependency": "transitive",
@ -682,31 +682,31 @@
      "dependency": "direct main",
      "description": {
        "name": "shared_preferences",
-        "sha256": "3c7e73920c694a436afaf65ab60ce3453d91f84208d761fbd83fc21182134d93",
+        "sha256": "6e8bf70b7fef813df4e9a36f658ac46d107db4b4cfe1048b477d4e453a8159f5",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "2.3.4"
+      "version": "2.5.3"
    },
    "shared_preferences_android": {
      "dependency": "transitive",
      "description": {
        "name": "shared_preferences_android",
-        "sha256": "02a7d8a9ef346c9af715811b01fbd8e27845ad2c41148eefd31321471b41863d",
+        "sha256": "34266009473bf71d748912da4bf62d439185226c03e01e2d9687bc65bbfcb713",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "2.4.0"
+      "version": "2.4.15"
    },
    "shared_preferences_foundation": {
      "dependency": "transitive",
      "description": {
        "name": "shared_preferences_foundation",
-        "sha256": "6a52cfcdaeac77cad8c97b539ff688ccfc458c007b4db12be584fbe5c0e49e03",
+        "sha256": "1c33a907142607c40a7542768ec9badfd16293bac51da3a4482623d15845f88b",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "2.5.4"
+      "version": "2.5.5"
    },
    "shared_preferences_linux": {
      "dependency": "transitive",
@ -732,11 +732,11 @@
      "dependency": "transitive",
      "description": {
        "name": "shared_preferences_web",
-        "sha256": "d2ca4132d3946fec2184261726b355836a82c33d7d5b67af32692aff18a4684e",
+        "sha256": "c49bd060261c9a3f0ff445892695d6212ff603ef3115edbb448509d407600019",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "2.4.2"
+      "version": "2.4.3"
    },
    "shared_preferences_windows": {
      "dependency": "transitive",
@ -758,61 +758,61 @@
      "dependency": "transitive",
      "description": {
        "name": "source_span",
-        "sha256": "53e943d4206a5e30df338fd4c6e7a077e02254531b138a15aec3bd143c1a8b3c",
+        "sha256": "254ee5351d6cb365c859e20ee823c3bb479bf4a293c22d17a9f1bf144ce86f7c",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "1.10.0"
+      "version": "1.10.1"
    },
    "stack_trace": {
      "dependency": "transitive",
      "description": {
        "name": "stack_trace",
-        "sha256": "9f47fd3630d76be3ab26f0ee06d213679aa425996925ff3feffdec504931c377",
+        "sha256": "8b27215b45d22309b5cddda1aa2b19bdfec9df0e765f2de506401c071d38d1b1",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "1.12.0"
+      "version": "1.12.1"
    },
    "stream_channel": {
      "dependency": "transitive",
      "description": {
        "name": "stream_channel",
-        "sha256": "ba2aa5d8cc609d96bbb2899c28934f9e1af5cddbd60a827822ea467161eb54e7",
+        "sha256": "969e04c80b8bcdf826f8f16579c7b14d780458bd97f56d107d3950fdbeef059d",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "2.1.2"
+      "version": "2.1.4"
    },
    "string_scanner": {
      "dependency": "transitive",
      "description": {
        "name": "string_scanner",
-        "sha256": "688af5ed3402a4bde5b3a6c15fd768dbf2621a614950b17f04626c431ab3c4c3",
+        "sha256": "921cd31725b72fe181906c6a94d987c78e3b98c2e205b397ea399d4054872b43",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "1.3.0"
+      "version": "1.4.1"
    },
    "term_glyph": {
      "dependency": "transitive",
      "description": {
        "name": "term_glyph",
-        "sha256": "a29248a84fbb7c79282b40b8c72a1209db169a2e0542bce341da992fe1bc7e84",
+        "sha256": "7f554798625ea768a7518313e58f83891c7f5024f88e46e7182a4558850a4b8e",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "1.2.1"
+      "version": "1.2.2"
    },
    "test_api": {
      "dependency": "transitive",
      "description": {
        "name": "test_api",
-        "sha256": "664d3a9a64782fcdeb83ce9c6b39e78fd2971d4e37827b9b06c3aa1edc5e760c",
+        "sha256": "522f00f556e73044315fa4585ec3270f1808a4b186c936e612cab0b565ff1e00",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "0.7.3"
+      "version": "0.7.6"
    },
    "typed_data": {
      "dependency": "transitive",
@ -828,31 +828,31 @@
      "dependency": "direct main",
      "description": {
        "name": "url_launcher",
-        "sha256": "9d06212b1362abc2f0f0d78e6f09f726608c74e3b9462e8368bb03314aa8d603",
+        "sha256": "f6a7e5c4835bb4e3026a04793a4199ca2d14c739ec378fdfe23fc8075d0439f8",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "6.3.1"
+      "version": "6.3.2"
    },
    "url_launcher_android": {
      "dependency": "transitive",
      "description": {
        "name": "url_launcher_android",
-        "sha256": "6fc2f56536ee873eeb867ad176ae15f304ccccc357848b351f6f0d8d4a40d193",
+        "sha256": "5c8b6c2d89a78f5a1cca70a73d9d5f86c701b36b42f9c9dac7bad592113c28e9",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "6.3.14"
+      "version": "6.3.24"
    },
    "url_launcher_ios": {
      "dependency": "transitive",
      "description": {
        "name": "url_launcher_ios",
-        "sha256": "16a513b6c12bb419304e72ea0ae2ab4fed569920d1c7cb850263fe3acc824626",
+        "sha256": "6b63f1441e4f653ae799166a72b50b1767321ecc263a57aadf825a7a2a5477d9",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "6.3.2"
+      "version": "6.3.5"
    },
    "url_launcher_linux": {
      "dependency": "transitive",
@ -868,11 +868,11 @@
      "dependency": "transitive",
      "description": {
        "name": "url_launcher_macos",
-        "sha256": "17ba2000b847f334f16626a574c702b196723af2a289e7a93ffcb79acff855c2",
+        "sha256": "8262208506252a3ed4ff5c0dc1e973d2c0e0ef337d0a074d35634da5d44397c9",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "3.2.2"
+      "version": "3.2.4"
    },
    "url_launcher_platform_interface": {
      "dependency": "transitive",
@ -888,51 +888,51 @@
      "dependency": "transitive",
      "description": {
        "name": "url_launcher_web",
-        "sha256": "772638d3b34c779ede05ba3d38af34657a05ac55b06279ea6edd409e323dca8e",
+        "sha256": "4bd2b7b4dc4d4d0b94e5babfffbca8eac1a126c7f3d6ecbc1a11013faa3abba2",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "2.3.3"
+      "version": "2.4.1"
    },
    "url_launcher_windows": {
      "dependency": "transitive",
      "description": {
        "name": "url_launcher_windows",
-        "sha256": "44cf3aabcedde30f2dba119a9dea3b0f2672fbe6fa96e85536251d678216b3c4",
+        "sha256": "3284b6d2ac454cf34f114e1d3319866fdd1e19cdc329999057e44ffe936cfa77",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "3.1.3"
+      "version": "3.1.4"
    },
    "vector_math": {
      "dependency": "transitive",
      "description": {
        "name": "vector_math",
-        "sha256": "80b3257d1492ce4d091729e3a67a60407d227c27241d6927be0130c98e741803",
+        "sha256": "d530bd74fea330e6e364cda7a85019c434070188383e1cd8d9777ee586914c5b",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "2.1.4"
+      "version": "2.2.0"
    },
    "vm_service": {
      "dependency": "transitive",
      "description": {
        "name": "vm_service",
-        "sha256": "f6be3ed8bd01289b34d679c2b62226f63c0e69f9fd2e50a6b3c1c729a961041b",
+        "sha256": "45caa6c5917fa127b5dbcfbd1fa60b14e583afdc08bfc96dda38886ca252eb60",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "14.3.0"
+      "version": "15.0.2"
    },
    "web": {
      "dependency": "transitive",
      "description": {
        "name": "web",
-        "sha256": "cd3543bd5798f6ad290ea73d210f423502e71900302dde696f8bff84bf89a1cb",
+        "sha256": "868d88a33d8a87b18ffc05f9f030ba328ffefba92d6c127917a2ba740f9cfe4a",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "1.1.0"
+      "version": "1.1.1"
    },
    "window_manager": {
      "dependency": "direct main",
@ -958,25 +958,25 @@
      "dependency": "transitive",
      "description": {
        "name": "xml",
-        "sha256": "b015a8ad1c488f66851d762d3090a21c600e479dc75e68328c52774040cf9226",
+        "sha256": "971043b3a0d3da28727e40ed3e0b5d18b742fa5a68665cca88e74b7876d5e025",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "6.5.0"
+      "version": "6.6.1"
    },
    "yaml": {
      "dependency": "transitive",
      "description": {
        "name": "yaml",
-        "sha256": "75769501ea3489fca56601ff33454fe45507ea3bfb014161abc3b43ae25989d5",
+        "sha256": "b9da305ac7c39faa3f030eccd175340f968459dae4af175130b3fc47e40d76ce",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "3.1.2"
+      "version": "3.1.3"
    }
  },
  "sdks": {
-    "dart": ">=3.5.0 <4.0.0",
-    "flutter": ">=3.24.0"
+    "dart": ">=3.9.0 <4.0.0",
+    "flutter": ">=3.35.0"
  }
 }
--- a/pkgs/by-name/sp/sphinx-lint/package.nix
+++ b/pkgs/by-name/sp/sphinx-lint/package.nix
@ -6,14 +6,14 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "sphinx-lint";
-  version = "1.0.0";
+  version = "1.0.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "sphinx-contrib";
    repo = "sphinx-lint";
    tag = "v${version}";
-    hash = "sha256-VM8PyUZVQQFdXLR14eN7+hPT/iGOVHG6s1bcac4MPo4=";
+    hash = "sha256-9xqGb/RdaySTys3gjIU0GJSqGOWXQQ/NeSRS8dmx5lg=";
  };

  build-system = [
--- a/pkgs/by-name/st/steampipe/package.nix
+++ b/pkgs/by-name/st/steampipe/package.nix
@ -11,7 +11,7 @@

 buildGoModule rec {
  pname = "steampipe";
-  version = "2.2.0";
+  version = "2.3.1";

  env.CGO_ENABLED = 0;

@ -19,10 +19,10 @@ buildGoModule rec {
    owner = "turbot";
    repo = "steampipe";
    tag = "v${version}";
-    hash = "sha256-bYnwtGeFOtUfYzlx0o0jtfuyeItXU9LiO0fJy8UGv6k=";
+    hash = "sha256-be9Q3X/XZ7OdJChRxVFQzglhMfpLzbzaCfSn7hUR5AA=";
  };

-  vendorHash = "sha256-VHAbMgBISWWGhZBRl5JA0gytRSSdaFMCJUzMxmoNtPc=";
+  vendorHash = "sha256-1o7ANCyz19WSIkYYoA0DpYzkY2qBXHHSfAGrAG2+k88=";
  proxyVendor = true;

  postPatch = ''
--- a/pkgs/by-name/to/tomat/package.nix
+++ b/pkgs/by-name/to/tomat/package.nix
@ -0,0 +1,46 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  pkg-config,
+  alsa-lib,
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "tomat";
+  version = "2.3.0";
+
+  src = fetchFromGitHub {
+    owner = "jolars";
+    repo = "tomat";
+    tag = "v${version}";
+    hash = "sha256-lkNBcTn7uXWifIVNoXmggPy+UjozL5YqVYorH9XAejo=";
+  };
+
+  cargoHash = "sha256-jBpZyNfsJKchJnKwWJQeVavj0Yog83QrCM8kOJFVugg=";
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    alsa-lib
+  ];
+
+  checkFlags = [
+    # Skip tests that require access to file system locations not available during Nix builds
+    "--skip=timer::tests::test_icon_path_creation"
+    "--skip=timer::tests::test_notification_icon_config"
+    "--skip=integration::"
+  ];
+
+  meta = {
+    description = "Pomodoro timer for status bars";
+    homepage = "https://github.com/jolars/tomat";
+    changelog = "https://github.com/jolars/tomat/blob/${src.rev}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ jolars ];
+    mainProgram = "tomat";
+    platforms = lib.platforms.linux;
+  };
+}
--- a/pkgs/by-name/wh/whisper/package.nix
+++ b/pkgs/by-name/wh/whisper/package.nix
@ -35,6 +35,12 @@ stdenv.mkDerivation rec {

  enableParallelBuilding = true;

+  # The package comes with prebuilt static
+  # libraries of bzip2, zlib, libdeflate and asmlib.
+  # They are not built with -fPIE and thus linking fails.
+  # As asmlib is not packages in nixpkgs let's disable PIE.
+  env.NIX_LDFLAGS = "-no-pie";
+
  installPhase = ''
    runHook preInstall
    install -Dt $out/bin whisper whisper-index
@ -48,5 +54,6 @@ stdenv.mkDerivation rec {
    homepage = "https://github.com/refresh-bio/whisper";
    maintainers = with maintainers; [ jbedo ];
    platforms = platforms.x86_64;
+    sourceProvenance = [ sourceTypes.binaryNativeCode ];
  };
 }
--- a/pkgs/by-name/x4/x42-plugins/package.nix
+++ b/pkgs/by-name/x4/x42-plugins/package.nix
@ -11,7 +11,6 @@
  libjack2,
  libGLU,
  lv2,
-  gtk2,
  cairo,
  pango,
  fftwFloat,
@ -37,7 +36,6 @@ stdenv.mkDerivation rec {
    libsndfile
    libsamplerate
    lv2
-    gtk2
    cairo
    pango
    fftwFloat
--- a/pkgs/by-name/ya/yafc-ce/deps.json
+++ b/pkgs/by-name/ya/yafc-ce/deps.json
@ -34,6 +34,21 @@
    "version": "3.26.1",
    "hash": "sha256-1tHxDuJwwvJWZ3H9ooPFAKuaJIthSdTDlmjHlxH/euc="
  },
+  {
+    "pname": "Microsoft.CodeAnalysis.Analyzers",
+    "version": "3.11.0",
+    "hash": "sha256-hQ2l6E6PO4m7i+ZsfFlEx+93UsLPo4IY3wDkNG11/Sw="
+  },
+  {
+    "pname": "Microsoft.CodeAnalysis.Common",
+    "version": "4.14.0",
+    "hash": "sha256-ne/zxH3GqoGB4OemnE8oJElG5mai+/67ASaKqwmL2BE="
+  },
+  {
+    "pname": "Microsoft.CodeAnalysis.CSharp",
+    "version": "4.14.0",
+    "hash": "sha256-5Mzj3XkYYLkwDWh17r1NEXSbXwwWYQPiOmkSMlgo1JY="
+  },
  {
    "pname": "Microsoft.CodeCoverage",
    "version": "17.11.1",
@ -94,11 +109,21 @@
    "version": "6.0.0",
    "hash": "sha256-KQmlUpG9ovRpNqKhKe6rz3XMLUjkBqjyQhEm2hV5Sow="
  },
+  {
+    "pname": "System.Collections.Immutable",
+    "version": "9.0.0",
+    "hash": "sha256-+6q5VMeoc5bm4WFsoV6nBXA9dV5pa/O4yW+gOdi8yac="
+  },
  {
    "pname": "System.Reflection.Metadata",
    "version": "1.6.0",
    "hash": "sha256-JJfgaPav7UfEh4yRAQdGhLZF1brr0tUWPl6qmfNWq/E="
  },
+  {
+    "pname": "System.Reflection.Metadata",
+    "version": "9.0.0",
+    "hash": "sha256-avEWbcCh7XgpsSesnR3/SgxWi/6C5OxjR89Jf/SfRjQ="
+  },
  {
    "pname": "xunit",
    "version": "2.9.2",
--- a/pkgs/by-name/ya/yafc-ce/package.nix
+++ b/pkgs/by-name/ya/yafc-ce/package.nix
@ -12,13 +12,13 @@ let
 in
 buildDotnetModule (finalAttrs: {
  pname = "yafc-ce";
-  version = "2.14.0";
+  version = "2.16.0";

  src = fetchFromGitHub {
    owner = "shpaass";
    repo = "yafc-ce";
-    rev = finalAttrs.version;
-    hash = "sha256-EbVPPSci4AziF+n/8pIa9M44WEUj+vvEOQqu3HJ6aNQ=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-6+GGxEwn3tenmcukOZPTIZ7UZg/d9uudQP0qwU8mifY=";
  };

  projectFile = [
--- a/pkgs/by-name/zw/zwave-js-ui/package.nix
+++ b/pkgs/by-name/zw/zwave-js-ui/package.nix
@ -7,15 +7,15 @@

 buildNpmPackage rec {
  pname = "zwave-js-ui";
-  version = "11.5.2";
+  version = "11.6.1";

  src = fetchFromGitHub {
    owner = "zwave-js";
    repo = "zwave-js-ui";
    tag = "v${version}";
-    hash = "sha256-G/ZHp5JmCpFCsjbgHyAS4+5eihyzqVtkcZT5vj6Pxos=";
+    hash = "sha256-SNxwZw4ebcngUD6EEI9GGAsxhcR6wQBs2sdnmuZycmw=";
  };
-  npmDepsHash = "sha256-amw6eVKWCIuF/XcY1dHb9/qMADGkUANT4WmQNx3O+NY=";
+  npmDepsHash = "sha256-Aec2IWCeeOTrHMfk1uqCHNL30Kbsa5uCf4NkZc+Q4rA=";

  passthru.tests.zwave-js-ui = nixosTests.zwave-js-ui;

--- a/pkgs/desktops/pantheon/artwork/elementary-icon-theme/default.nix
+++ b/pkgs/desktops/pantheon/artwork/elementary-icon-theme/default.nix
@ -5,6 +5,7 @@
  nix-update-script,
  meson,
  ninja,
+  adwaita-icon-theme,
  hicolor-icon-theme,
  gtk3,
  xcursorgen,
@ -13,13 +14,13 @@

 stdenvNoCC.mkDerivation rec {
  pname = "elementary-icon-theme";
-  version = "8.1.0";
+  version = "8.2.0";

  src = fetchFromGitHub {
    owner = "elementary";
    repo = "icons";
-    rev = version;
-    sha256 = "sha256-WltMfWMcfUqpnfuGa6NzfxSeTais0MLsiu82ybaOcvs=";
+    tag = version;
+    hash = "sha256-ntv+efkyfB66HL3tWEkiOj+MFRGqhfMo1/FUO2fIqBM=";
  };

  nativeBuildInputs = [
@ -31,6 +32,7 @@ stdenvNoCC.mkDerivation rec {
  ];

  propagatedBuildInputs = [
+    adwaita-icon-theme
    hicolor-icon-theme
  ];

--- a/pkgs/development/beam-modules/default.nix
+++ b/pkgs/development/beam-modules/default.nix
@ -1,11 +1,10 @@
 {
  lib,
-  __splicedPackages,
+  pkgs,
  erlang,
 }:

 let
-  pkgs = __splicedPackages;
  inherit (lib) makeExtensible;

  # FIXME: add support for overrideScope
--- a/pkgs/development/compilers/flutter/versions/3_27/data.json
+++ b/pkgs/development/compilers/flutter/versions/3_27/data.json
--- a/pkgs/development/compilers/flutter/versions/3_27/patches/deregister-pub-dependencies-artifact.patch
+++ b/pkgs/development/compilers/flutter/versions/3_27/patches/deregister-pub-dependencies-artifact.patch
@ -1,19 +0,0 @@
-diff --git a/packages/flutter_tools/lib/src/flutter_cache.dart b/packages/flutter_tools/lib/src/flutter_cache.dart
-index 252021cf78..e50ef0885d 100644
--- a/packages/flutter_tools/lib/src/flutter_cache.dart
-+++ b/packages/flutter_tools/lib/src/flutter_cache.dart
-@@ -51,14 +51,6 @@ class FlutterCache extends Cache {
-       registerArtifact(IosUsbArtifacts(artifactName, this, platform: platform));
-     }
-     registerArtifact(FontSubsetArtifacts(this, platform: platform));
-    registerArtifact(PubDependencies(
-      logger: logger,
-      // flutter root and pub must be lazily initialized to avoid accessing
-      // before the version is determined.
-      flutterRoot: () => Cache.flutterRoot!,
-      pub: () => pub,
-      projectFactory: projectFactory,
-    ));
-   }
- }
- 
--- a/pkgs/development/compilers/flutter/versions/3_27/patches/disable-auto-update.patch
+++ b/pkgs/development/compilers/flutter/versions/3_27/patches/disable-auto-update.patch
@ -1,30 +0,0 @@
-diff --git a/packages/flutter_tools/lib/src/runner/flutter_command.dart b/packages/flutter_tools/lib/src/runner/flutter_command.dart
-index e4e474ab6e..5548599802 100644
--- a/packages/flutter_tools/lib/src/runner/flutter_command.dart
-+++ b/packages/flutter_tools/lib/src/runner/flutter_command.dart
-@@ -1693,7 +1693,7 @@ Run 'flutter -h' (or 'flutter <command> -h') for available flutter commands and
- 
-     // Populate the cache. We call this before pub get below so that the
-     // sky_engine package is available in the flutter cache for pub to find.
-    if (shouldUpdateCache) {
-+    if (false) {
-       // First always update universal artifacts, as some of these (e.g.
-       // ios-deploy on macOS) are required to determine `requiredArtifacts`.
-       final bool offline;
-diff --git a/packages/flutter_tools/lib/src/runner/flutter_command_runner.dart b/packages/flutter_tools/lib/src/runner/flutter_command_runner.dart
-index 50783f8435..db94062840 100644
--- a/packages/flutter_tools/lib/src/runner/flutter_command_runner.dart
-+++ b/packages/flutter_tools/lib/src/runner/flutter_command_runner.dart
-@@ -377,11 +377,7 @@ class FlutterCommandRunner extends CommandRunner<void> {
-           globals.analytics.suppressTelemetry();
-         }
- 
-        globals.flutterVersion.ensureVersionFile();
-         final bool machineFlag = topLevelResults[FlutterGlobalOptions.kMachineFlag] as bool? ?? false;
-        if (await _shouldCheckForUpdates(topLevelResults, topLevelMachineFlag: machineFlag)) {
-          await globals.flutterVersion.checkFlutterVersionFreshness();
-        }
- 
-         // See if the user specified a specific device.
-         final String? specifiedDeviceId = topLevelResults[FlutterGlobalOptions.kDeviceIdOption] as String?;
-
--- a/pkgs/development/compilers/flutter/versions/3_27/patches/fix-ios-build-xcode-backend-sh.patch
+++ b/pkgs/development/compilers/flutter/versions/3_27/patches/fix-ios-build-xcode-backend-sh.patch
@ -1,69 +0,0 @@
-From 6df275df3b8694daf16302b407520e3b1dee6724 Mon Sep 17 00:00:00 2001
-From: Philip Hayes <philiphayes9@gmail.com>
-Date: Thu, 12 Sep 2024 13:23:00 -0700
-Subject: [PATCH] fix: cleanup xcode_backend.sh to fix iOS build w/
- `NixOS/nixpkgs` flutter
-
-This patch cleans up `xcode_backend.sh`. It now effectively just runs
-`exec $FLUTTER_ROOT/bin/dart ./xcode_backend.dart`.
-
-The previous `xcode_backend.sh` tries to discover `$FLUTTER_ROOT` from
-argv[0], even though its presence is already guaranteed (the wrapped
-`xcode_backend.dart` also relies on this env).
-
-When using nixpkgs flutter, the flutter SDK directory is composed of several
-layers, joined together using symlinks (called a `symlinkJoin`). Without this
-patch, the auto-discover traverses the symlinks into the wrong layer, and so it
-uses an "unwrapped" `dart` command instead of a "wrapped" dart that sets some
-important envs/flags (like `$FLUTTER_ROOT`).
-
-Using the "unwrapped" dart then manifests in this error when compiling, since
-it doesn't see the ios build-support artifacts:
-
-```
-$ flutter run -d iphone
-Running Xcode build...
-Xcode build done.                                            6.4s
-Failed to build iOS app
-Error (Xcode): Target debug_unpack_ios failed: Error: Flutter failed to create a directory at "/<nix-store>/XXXX-flutter-3.24.1-unwrapped/bin/cache/artifacts".
-```
---
- packages/flutter_tools/bin/xcode_backend.sh | 25 ++++-----------------
- 1 file changed, 4 insertions(+), 21 deletions(-)
-
-diff --git a/packages/flutter_tools/bin/xcode_backend.sh b/packages/flutter_tools/bin/xcode_backend.sh
-index 2889d7c8e4..48b9d06c6e 100755
--- a/packages/flutter_tools/bin/xcode_backend.sh
-+++ b/packages/flutter_tools/bin/xcode_backend.sh
-@@ -6,24 +6,7 @@
- # exit on error, or usage of unset var
- set -euo pipefail
- 
-# Needed because if it is set, cd may print the path it changed to.
-unset CDPATH
-
-function follow_links() (
-  cd -P "$(dirname -- "$1")"
-  file="$PWD/$(basename -- "$1")"
-  while [[ -h "$file" ]]; do
-    cd -P "$(dirname -- "$file")"
-    file="$(readlink -- "$file")"
-    cd -P "$(dirname -- "$file")"
-    file="$PWD/$(basename -- "$file")"
-  done
-  echo "$file"
-)
-
-PROG_NAME="$(follow_links "${BASH_SOURCE[0]}")"
-BIN_DIR="$(cd "${PROG_NAME%/*}" ; pwd -P)"
-FLUTTER_ROOT="$BIN_DIR/../../.."
-DART="$FLUTTER_ROOT/bin/dart"
-
-"$DART" "$BIN_DIR/xcode_backend.dart" "$@"
-+# Run `dart ./xcode_backend.dart` with the dart from $FLUTTER_ROOT.
-+dart="${FLUTTER_ROOT}/bin/dart"
-+xcode_backend_dart="${BASH_SOURCE[0]%.sh}.dart"
-+exec "${dart}" "${xcode_backend_dart}" "$@"
-- 
-2.46.0
-
--- a/pkgs/development/compilers/flutter/versions/3_27/patches/gradle-flutter-tools-wrapper.patch
+++ b/pkgs/development/compilers/flutter/versions/3_27/patches/gradle-flutter-tools-wrapper.patch
@ -1,44 +0,0 @@
-This patch introduces an intermediate Gradle build step to alter the behavior
-of flutter_tools' Gradle project, specifically moving the creation of `build`
-and `.gradle` directories from within the Nix Store to somewhere in `$HOME/.cache/flutter/nix-flutter-tools-gradle/$engineShortRev`.
-
-Without this patch, flutter_tools' Gradle project tries to generate `build` and `.gradle`
-directories within the Nix Store. Resulting in read-only errors when trying to build a
-Flutter Android app at runtime.
-
-This patch takes advantage of the fact settings.gradle takes priority over settings.gradle.kts to build the intermediate Gradle project
-when a Flutter app runs `includeBuild("${settings.ext.flutterSdkPath}/packages/flutter_tools/gradle")`
-
-`rootProject.buildFileName = "/dev/null"` so that the intermediate project doesn't use `build.gradle.kts` that's in the same directory.
-
-The intermediate project makes a `settings.gradle` file in `$HOME/.cache/flutter/nix-flutter-tools-gradle/<short engine rev>/` and `includeBuild`s it.
-This Gradle project will build the actual `packages/flutter_tools/gradle` project by setting
-`rootProject.projectDir = new File("$settingsDir")` and `apply from: new File("$settingsDir/settings.gradle.kts")`.
-
-Now the `.gradle` will be built in `$HOME/.cache/flutter/nix-flutter-tools-gradle/<short engine rev>/`, but `build` doesn't.
-To move `build` to `$HOME/.cache/flutter/nix-flutter-tools-gradle/<short engine rev>/` as well, we need to set `buildDirectory`.
-diff --git a/packages/flutter_tools/gradle/settings.gradle b/packages/flutter_tools/gradle/settings.gradle
-new file mode 100644
-index 0000000000..b2485c94b4
--- /dev/null
-+++ b/packages/flutter_tools/gradle/settings.gradle
-@@ -0,0 +1,19 @@
-+rootProject.buildFileName = "/dev/null"
-+
-+def engineShortRev = (new File("$settingsDir/../../../bin/internal/engine.version")).text.take(10)
-+def dir = new File("$System.env.HOME/.cache/flutter/nix-flutter-tools-gradle/$engineShortRev")
-+dir.mkdirs()
-+def file = new File(dir, "settings.gradle")
-+
-+file.text = """
-+rootProject.projectDir = new File("$settingsDir")
-+apply from: new File("$settingsDir/settings.gradle.kts")
-+
-+gradle.allprojects { project ->
-+  project.beforeEvaluate {
-+    project.layout.buildDirectory = new File("$dir/build")
-+  }
-+}
-+"""
-+
-+includeBuild(dir)
--- a/pkgs/development/compilers/flutter/versions/3_35/data.json
+++ b/pkgs/development/compilers/flutter/versions/3_35/data.json
@ -1,17 +1,17 @@
 {
-  "version": "3.35.5",
-  "engineVersion": "d3d45dcf251823c1769909cd43698d126db38deb",
+  "version": "3.35.7",
+  "engineVersion": "035316565ad77281a75305515e4682e6c4c6f7ca",
  "engineSwiftShaderHash": "sha256-ATVcuxqPHqHOWYyO7DoX9LdgUiO3INUi7m9Mc6ccc1M=",
  "engineSwiftShaderRev": "d040a5bab638bf7c226235c95787ba6288bb6416",
  "channel": "stable",
  "engineHashes": {
    "aarch64-linux": {
-      "aarch64-linux": "sha256-0g9ozn4aamUI85j11xEwW6Xv61APIpuLSmg6I0cHiiM=",
-      "x86_64-linux": "sha256-0g9ozn4aamUI85j11xEwW6Xv61APIpuLSmg6I0cHiiM="
+      "aarch64-linux": "sha256-v2L0MQRTXvWngb8fu/AR9iofq2CDq1HFedXE8cSzOws=",
+      "x86_64-linux": "sha256-v2L0MQRTXvWngb8fu/AR9iofq2CDq1HFedXE8cSzOws="
    },
    "x86_64-linux": {
-      "aarch64-linux": "sha256-tXUALuEJZUiUoVOV6vxfdjrSSUe4Mm4Nax+j9lvVCJM=",
-      "x86_64-linux": "sha256-tXUALuEJZUiUoVOV6vxfdjrSSUe4Mm4Nax+j9lvVCJM="
+      "aarch64-linux": "sha256-RKfKhFwlwVEguWqI6OinTqdCM3yNTP/5PwevREmS4Nk=",
+      "x86_64-linux": "sha256-RKfKhFwlwVEguWqI6OinTqdCM3yNTP/5PwevREmS4Nk="
    }
  },
  "dartVersion": "3.9.2",
@ -21,53 +21,53 @@
    "x86_64-darwin": "sha256-mjWHCF5voWLKlqBKYhl2OKg2aDx0pyIQ1TlF6k4MQz0=",
    "aarch64-darwin": "sha256-1rAfqatlOdphdi6dZSfUfKywAbdwRn6ijo60isjV3Lw="
  },
-  "flutterHash": "sha256-EVJ/2Qk5r9CL/WObLsH3J/KW/ota6HgkAUYNgLYZwkw=",
+  "flutterHash": "sha256-0GI3P11vys6JU+H5MXKznHTItOXZwap7bxHzgj6umc4=",
  "artifactHashes": {
    "android": {
-      "aarch64-darwin": "sha256-XU2WMX8lYGZgERKcUXXRCG0i+v+NeJQt05ZcwVEPkwE=",
-      "aarch64-linux": "sha256-SDJXjztXecAQPwDgZlg3Lk04LRVmuVLhEoC1nPTlDw0=",
-      "x86_64-darwin": "sha256-XU2WMX8lYGZgERKcUXXRCG0i+v+NeJQt05ZcwVEPkwE=",
-      "x86_64-linux": "sha256-SDJXjztXecAQPwDgZlg3Lk04LRVmuVLhEoC1nPTlDw0="
+      "aarch64-darwin": "sha256-BbwfmKPmxZUPVoZEE687vudBCBPzVM/C9ehPEAPr6Jw=",
+      "aarch64-linux": "sha256-Pgc/ybLcRFJkbGUI2eY689yxOv2VyKdO/F5vGkTg/tM=",
+      "x86_64-darwin": "sha256-BbwfmKPmxZUPVoZEE687vudBCBPzVM/C9ehPEAPr6Jw=",
+      "x86_64-linux": "sha256-Pgc/ybLcRFJkbGUI2eY689yxOv2VyKdO/F5vGkTg/tM="
    },
    "fuchsia": {
-      "aarch64-darwin": "sha256-6XXdeFJJCPz4GXjtHODNUUlVxOC+wsxQHlk1utB1hro=",
-      "aarch64-linux": "sha256-6XXdeFJJCPz4GXjtHODNUUlVxOC+wsxQHlk1utB1hro=",
-      "x86_64-darwin": "sha256-6XXdeFJJCPz4GXjtHODNUUlVxOC+wsxQHlk1utB1hro=",
-      "x86_64-linux": "sha256-6XXdeFJJCPz4GXjtHODNUUlVxOC+wsxQHlk1utB1hro="
+      "aarch64-darwin": "sha256-qpHjEpuIK1hI6ga1qr0Q/t5S2Jjk8oUpnkeXsIeu7UM=",
+      "aarch64-linux": "sha256-qpHjEpuIK1hI6ga1qr0Q/t5S2Jjk8oUpnkeXsIeu7UM=",
+      "x86_64-darwin": "sha256-qpHjEpuIK1hI6ga1qr0Q/t5S2Jjk8oUpnkeXsIeu7UM=",
+      "x86_64-linux": "sha256-qpHjEpuIK1hI6ga1qr0Q/t5S2Jjk8oUpnkeXsIeu7UM="
    },
    "ios": {
-      "aarch64-darwin": "sha256-aWAK+2tSlp8UJ1kMjewIbxthGctiovXNgSjGEJVW/7w=",
-      "aarch64-linux": "sha256-aWAK+2tSlp8UJ1kMjewIbxthGctiovXNgSjGEJVW/7w=",
-      "x86_64-darwin": "sha256-aWAK+2tSlp8UJ1kMjewIbxthGctiovXNgSjGEJVW/7w=",
-      "x86_64-linux": "sha256-aWAK+2tSlp8UJ1kMjewIbxthGctiovXNgSjGEJVW/7w="
+      "aarch64-darwin": "sha256-ZjNJhDXqv9dg9Gn62TRYX1Vb4Qn0adS5nxxpYZOGsgY=",
+      "aarch64-linux": "sha256-ZjNJhDXqv9dg9Gn62TRYX1Vb4Qn0adS5nxxpYZOGsgY=",
+      "x86_64-darwin": "sha256-ZjNJhDXqv9dg9Gn62TRYX1Vb4Qn0adS5nxxpYZOGsgY=",
+      "x86_64-linux": "sha256-ZjNJhDXqv9dg9Gn62TRYX1Vb4Qn0adS5nxxpYZOGsgY="
    },
    "linux": {
-      "aarch64-darwin": "sha256-2ggkx/GSox34XxRfHJM3ipf9wqsR4rKYfn8Mzo4NmqI=",
-      "aarch64-linux": "sha256-2ggkx/GSox34XxRfHJM3ipf9wqsR4rKYfn8Mzo4NmqI=",
-      "x86_64-darwin": "sha256-uObm7ogCp1JEMJ7CFeIzcN/ore6VPGvmvhsEYiXroWY=",
-      "x86_64-linux": "sha256-uObm7ogCp1JEMJ7CFeIzcN/ore6VPGvmvhsEYiXroWY="
+      "aarch64-darwin": "sha256-TB9BOiV1Z1cKJKusNW4O0oJEJCt9XmWN+g4yCXtyepc=",
+      "aarch64-linux": "sha256-TB9BOiV1Z1cKJKusNW4O0oJEJCt9XmWN+g4yCXtyepc=",
+      "x86_64-darwin": "sha256-7BocNpo89xSXNy6yob+EESVfalm2olwR/knVfq9I1VA=",
+      "x86_64-linux": "sha256-7BocNpo89xSXNy6yob+EESVfalm2olwR/knVfq9I1VA="
    },
    "macos": {
-      "aarch64-darwin": "sha256-VBJntqCFoTAS+8FwxroCmSarfx9yqL5n4Q5oWz1JgII=",
-      "aarch64-linux": "sha256-VBJntqCFoTAS+8FwxroCmSarfx9yqL5n4Q5oWz1JgII=",
-      "x86_64-darwin": "sha256-VBJntqCFoTAS+8FwxroCmSarfx9yqL5n4Q5oWz1JgII=",
-      "x86_64-linux": "sha256-VBJntqCFoTAS+8FwxroCmSarfx9yqL5n4Q5oWz1JgII="
+      "aarch64-darwin": "sha256-vnV12shNi630OuyWTey/31vsmAcF7UMEgfdBZBXWc4c=",
+      "aarch64-linux": "sha256-vnV12shNi630OuyWTey/31vsmAcF7UMEgfdBZBXWc4c=",
+      "x86_64-darwin": "sha256-vnV12shNi630OuyWTey/31vsmAcF7UMEgfdBZBXWc4c=",
+      "x86_64-linux": "sha256-vnV12shNi630OuyWTey/31vsmAcF7UMEgfdBZBXWc4c="
    },
    "universal": {
-      "aarch64-darwin": "sha256-dXJmnOZunesXmUAGt32LE+hXB2b3KNhauSYeduPuK70=",
-      "aarch64-linux": "sha256-xWvFZH3RcTMuV2wn6bpEe4eiKdjGy7u/YlxZrqfOCQA=",
-      "x86_64-darwin": "sha256-9anTlYdSTIK1go8dxZ0TqfWQNz0YTCEGEESvXw+nTec=",
-      "x86_64-linux": "sha256-5DQ+4pPBtmc391cm446Ql6OtSGz3DLtO4pI3ueX0jUY="
+      "aarch64-darwin": "sha256-oPUDsJxKbbWEH1XgxOFoBnVYJAjgeCBKIrYtBafWtWU=",
+      "aarch64-linux": "sha256-ae6UH4K09lcl7UZzD/WKFxWUKEZQsLmizODs/RMKcis=",
+      "x86_64-darwin": "sha256-wxDWrT35CUIEQaKeIK0adr0oPfv6to60Z6R+8zrwhmU=",
+      "x86_64-linux": "sha256-CxvOlq8nxeY5esRanl2N7oO4RFgBTwQcRdS7Pp/5tt8="
    },
    "web": {
-      "aarch64-darwin": "sha256-duX+iGMFQ18nJIT49V1ZeyXTV+9Z8oDot0jgeonmVHA=",
-      "aarch64-linux": "sha256-duX+iGMFQ18nJIT49V1ZeyXTV+9Z8oDot0jgeonmVHA=",
-      "x86_64-darwin": "sha256-duX+iGMFQ18nJIT49V1ZeyXTV+9Z8oDot0jgeonmVHA=",
-      "x86_64-linux": "sha256-duX+iGMFQ18nJIT49V1ZeyXTV+9Z8oDot0jgeonmVHA="
+      "aarch64-darwin": "sha256-T+LR7Yo2hEy24u3aS+ehp9nyRBB+3dNDyF6jw1oOd1o=",
+      "aarch64-linux": "sha256-T+LR7Yo2hEy24u3aS+ehp9nyRBB+3dNDyF6jw1oOd1o=",
+      "x86_64-darwin": "sha256-T+LR7Yo2hEy24u3aS+ehp9nyRBB+3dNDyF6jw1oOd1o=",
+      "x86_64-linux": "sha256-T+LR7Yo2hEy24u3aS+ehp9nyRBB+3dNDyF6jw1oOd1o="
    },
    "windows": {
-      "x86_64-darwin": "sha256-aZ7owKiUsfuV6UqlO9I8aD1aWVjA55sOHdq+pgaLJGQ=",
-      "x86_64-linux": "sha256-aZ7owKiUsfuV6UqlO9I8aD1aWVjA55sOHdq+pgaLJGQ="
+      "x86_64-darwin": "sha256-xTWgw8JE/4R9UcdZmLEbMk+yL2V3zfAIXDRli9XYe5k=",
+      "x86_64-linux": "sha256-xTWgw8JE/4R9UcdZmLEbMk+yL2V3zfAIXDRli9XYe5k="
    }
  },
  "pubspecLock": {
--- a/pkgs/development/compilers/gcc/all.nix
+++ b/pkgs/development/compilers/gcc/all.nix
@ -2,6 +2,8 @@
  lib,
  stdenv,
  pkgs,
+  overrideCC,
+  buildPackages,
  targetPackages,
  callPackage,
  isl_0_20,
@ -61,7 +63,7 @@ let
                )
                && stdenv.cc.isGNU
              then
-                pkgs."gcc${majorVersion}Stdenv"
+                overrideCC stdenv buildPackages."gcc${majorVersion}"
              else
                stdenv;
          }
--- a/pkgs/development/interpreters/perl/default.nix
+++ b/pkgs/development/interpreters/perl/default.nix
@ -30,11 +30,7 @@ let
            }:
            let
              perlPackagesFun = callPackage ../../../top-level/perl-packages.nix {
-                # allow 'perlPackages.override { pkgs = pkgs // { imagemagick = imagemagickBig; }; }' like in python3Packages
-                # most perl packages aren't called with callPackage so it's not possible to override their arguments individually
-                # the conditional is because the // above won't be applied to __splicedPackages and hopefully no one is doing that when cross-compiling
-                pkgs = if stdenv.buildPlatform != stdenv.hostPlatform then pkgs.__splicedPackages else pkgs;
-                inherit stdenv;
+                inherit stdenv pkgs;
                perl = self;
              };

--- a/pkgs/development/interpreters/php/8.3.nix
+++ b/pkgs/development/interpreters/php/8.3.nix
@ -4,8 +4,8 @@ let
  base = callPackage ./generic.nix (
    _args
    // {
-      version = "8.3.26";
-      hash = "sha256-chtj1TSfEx9Ql1N7O+a6aAHi2Ob6uh8fLqlbT9YudSU=";
+      version = "8.3.27";
+      hash = "sha256-od0rUbQ3wKYzfgGQBHeKjvJT206a/31I2IeYypG34qQ=";
    }
  );
 in
--- a/pkgs/development/python-modules/ansible-builder/default.nix
+++ b/pkgs/development/python-modules/ansible-builder/default.nix
@ -13,13 +13,13 @@

 buildPythonPackage rec {
  pname = "ansible-builder";
-  version = "3.1.0";
+  version = "3.1.1";
  pyproject = true;

  src = fetchPypi {
    pname = "ansible_builder";
    inherit version;
-    hash = "sha256-0txXPianvVCV6YrrN+6bALyfUAWr6nFH10IpwPNCb8s=";
+    hash = "sha256-nYi8FazH0xBW0MUZFKYQLayOWtc/ny01upg3jIlxTtI=";
  };

  patchPhase = ''
--- a/pkgs/development/python-modules/blake3/Cargo.lock
+++ b/pkgs/development/python-modules/blake3/Cargo.lock
@ -22,7 +22,7 @@ checksum = "c08606f8c3cbf4ce6ec8e28fb0014a2c086708fe954eaa885384a6165172e7e8"

 [[package]]
 name = "blake3"
-version = "1.0.7"
+version = "1.0.8"
 dependencies = [
 "blake3 1.8.2",
 "hex",
@ -47,9 +47,9 @@ dependencies = [

 [[package]]
 name = "cc"
-version = "1.2.39"
+version = "1.2.41"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e1354349954c6fc9cb0deab020f27f783cf0b604e8bb754dc4658ecf0d29c35f"
+checksum = "ac9fe6cdbb24b6ade63616c0a0688e45bb56732262c158df3c0c4bea4ca47cb7"
 dependencies = [
 "find-msvc-tools",
 "shlex",
@ -57,9 +57,9 @@ dependencies = [

 [[package]]
 name = "cfg-if"
-version = "1.0.3"
+version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2fd1289c04a9ea8cb22300a459a72a385d7c73d3259e2ed7dcb2af674838cfa9"
+checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"

 [[package]]
 name = "constant_time_eq"
@ -100,9 +100,9 @@ checksum = "48c757948c5ede0e46177b7add2e67155f70e33c07fea8284df6576da70b3719"

 [[package]]
 name = "find-msvc-tools"
-version = "0.1.2"
+version = "0.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ced73b1dacfc750a6db6c0a0c3a3853c8b41997e2e2c563dc90804ae6867959"
+checksum = "52051878f80a721bb68ebfbc930e07b65ba72f2da88968ea5c06fd6ca3d3a127"

 [[package]]
 name = "heck"
@ -124,9 +124,9 @@ checksum = "f4c7245a08504955605670dbf141fceab975f15ca21570696aebe9d2e71576bd"

 [[package]]
 name = "libc"
-version = "0.2.176"
+version = "0.2.177"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "58f929b4d672ea937a23a1ab494143d968337a5f47e56d0815df1e0890ddf174"
+checksum = "2874a2af47a2325c2001a6e6fad9b16a53b802102b528163885171cf92b15976"

 [[package]]
 name = "memmap2"
--- a/pkgs/development/python-modules/blake3/default.nix
+++ b/pkgs/development/python-modules/blake3/default.nix
@ -12,14 +12,14 @@

 buildPythonPackage rec {
  pname = "blake3";
-  version = "1.0.7";
+  version = "1.0.8";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "oconnor663";
    repo = "blake3-py";
    tag = version;
-    hash = "sha256-km4vN/xKvjNd/bdHEIsUR9+Hmi0K5ju+wlQ2kuuDzzI=";
+    hash = "sha256-gwPGSah9qzApDwsBNABRLPZGrpaO3WArHoK6Jj6WJzo=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/gst-python/default.nix
+++ b/pkgs/development/python-modules/gst-python/default.nix
@ -6,6 +6,9 @@
  fetchpatch,
  meson,
  ninja,
+  # TODO: We can get rid of this once `buildPythonPackage` accepts `finalAttrs`.
+  # See: https://github.com/NixOS/nixpkgs/pull/271387
+  gst-python,

  pkg-config,
  python,
@ -42,13 +45,6 @@ buildPythonPackage rec {
    })
  ];

-  postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
-    # The analytics tests often timeout under load on Darwin (e.g. on Hydra), so remove them
-    substituteInPlace testsuite/meson.build --replace-fail \
-      "['Test analytics', 'test_analytics.py', ['gst-plugins-bad/gst-libs/gst/analytics', 'gst-plugins-base/gst-libs/gst/video']]," \
-      ""
-  '';
-
  # Python 2.x is not supported.
  disabled = !isPy3k;

@ -80,11 +76,24 @@ buildPythonPackage rec {
    "-Dpygi-overrides-dir=${placeholder "out"}/${python.sitePackages}/gi/overrides"
    # Exec format error during configure
    "-Dpython-exe=${python.pythonOnBuildForHost.interpreter}"
+    # This is needed to prevent the project from looking for `gst-rtsp-server`
+    # from `checkInputs`.
+    #
+    # TODO: This should probably be moved at least partially into the Meson hook.
+    #
+    # NB: We need to use `doInstallCheck` here because `buildPythonPackage`
+    # renames `doCheck` to `doInstallCheck`.
+    (lib.mesonEnable "tests" gst-python.doInstallCheck)
  ];

-  # TODO: Meson setup hook does not like buildPythonPackage
-  # https://github.com/NixOS/nixpkgs/issues/47390
-  installCheckPhase = "meson test --print-errorlogs";
+  # Tests are very flaky on Darwin.
+  # See: https://github.com/NixOS/nixpkgs/issues/454955
+  doCheck = !stdenv.hostPlatform.isDarwin;
+
+  # `buildPythonPackage` uses `installCheckPhase` and leaves `checkPhase`
+  # empty. It renames `doCheck` from its arguments, but not `checkPhase`.
+  # See: https://github.com/NixOS/nixpkgs/issues/47390
+  installCheckPhase = "mesonCheckPhase";

  preCheck = lib.optionalString stdenv.hostPlatform.isDarwin ''
    export DYLD_LIBRARY_PATH="${gst_all_1.gst-plugins-base}/lib"
--- a/pkgs/development/python-modules/iamdata/default.nix
+++ b/pkgs/development/python-modules/iamdata/default.nix
@ -8,14 +8,14 @@

 buildPythonPackage rec {
  pname = "iamdata";
-  version = "0.1.202510301";
+  version = "0.1.202511011";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "cloud-copilot";
    repo = "iam-data-python";
    tag = "v${version}";
-    hash = "sha256-83vicOeL/CufgkOO+oKLbydv0Hu08kMcPxVjrQGzn3c=";
+    hash = "sha256-uVZdWEFh9yLYl5gywj4Nwopwz9J0f/0nfaseK3mhTyA=";
  };

  __darwinAllowLocalNetworking = true;
--- a/pkgs/development/python-modules/langgraph-cli/default.nix
+++ b/pkgs/development/python-modules/langgraph-cli/default.nix
@ -24,14 +24,14 @@

 buildPythonPackage rec {
  pname = "langgraph-cli";
-  version = "0.4.4";
+  version = "0.4.5";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "langchain-ai";
    repo = "langgraph";
    tag = "cli==${version}";
-    hash = "sha256-Ka/fm+lWxP6bpd4/Umgwfo1J1T05A6LHZb/ZeQ8HTSo=";
+    hash = "sha256-YGO1eq1IEKkxuH/9ZsaeaWpQ2vD97du32iopdXFqZf8=";
  };

  sourceRoot = "${src.name}/libs/cli";
--- a/pkgs/development/python-modules/llama-cloud-services/default.nix
+++ b/pkgs/development/python-modules/llama-cloud-services/default.nix
@ -17,14 +17,14 @@

 buildPythonPackage rec {
  pname = "llama-cloud-services";
-  version = "0.6.69";
+  version = "0.6.77";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "run-llama";
    repo = "llama_cloud_services";
-    tag = "v${version}";
-    hash = "sha256-+90b/EwG8OfpjG/MJM5shvQHLsLpLe+TviufwoWI7mg=";
+    tag = "llama-cloud-services-py%40${version}";
+    hash = "sha256-Fl4rmKJ26yeXYjR2qhpusQrRa0sCe6TigWqEyfjA8lQ=";
  };

  sourceRoot = "${src.name}/py";
--- a/pkgs/development/python-modules/llama-parse/default.nix
+++ b/pkgs/development/python-modules/llama-parse/default.nix
@ -8,13 +8,13 @@

 buildPythonPackage rec {
  pname = "llama-parse";
-  version = "0.6.54";
+  version = "0.6.77";
  pyproject = true;

  src = fetchPypi {
    pname = "llama_parse";
    inherit version;
-    hash = "sha256-xwezEVIVXJuuhOMW+reQu8jIX02IJc5e44br632yWPE=";
+    hash = "sha256-cxjDJT/ADoPwDmN4Cg06AyQvJcasGZwmw6ctuHVNRLc=";
  };

  build-system = [ hatchling ];
--- a/pkgs/development/python-modules/localzone/default.nix
+++ b/pkgs/development/python-modules/localzone/default.nix
@ -30,6 +30,13 @@ buildPythonPackage rec {

  pythonImportsCheck = [ "localzone" ];

+  postPatch = ''
+    # Fix tests with dnspython 2.8.0
+    # https://github.com/ags-slc/localzone/pull/6
+    substituteInPlace tests/test_models.py \
+      --replace-fail 'raises((AttributeError, DNSSyntaxError))' 'raises((AttributeError, DNSSyntaxError, ValueError))'
+  '';
+
  meta = with lib; {
    description = "Simple DNS library for managing zone files";
    homepage = "https://localzone.iomaestro.com";
--- a/pkgs/development/python-modules/mitogen/default.nix
+++ b/pkgs/development/python-modules/mitogen/default.nix
@ -8,7 +8,7 @@

 buildPythonPackage rec {
  pname = "mitogen";
-  version = "0.3.29";
+  version = "0.3.30";
  pyproject = true;

  disabled = pythonOlder "3.7";
@ -17,7 +17,7 @@ buildPythonPackage rec {
    owner = "mitogen-hq";
    repo = "mitogen";
    tag = "v${version}";
-    hash = "sha256-j2VT46bYi9lmFKNNCHshs56b2HqqvfpEDBHnaHvfYgY=";
+    hash = "sha256-witxGRPi2TOwLOnsJcxOKLJdZ6ggapANXneFMJdHa98=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/os-service-types/default.nix
+++ b/pkgs/development/python-modules/os-service-types/default.nix
@ -10,13 +10,13 @@

 buildPythonPackage rec {
  pname = "os-service-types";
-  version = "1.8.0";
+  version = "1.8.1";
  pyproject = true;

  src = fetchPypi {
    pname = "os_service_types";
    inherit version;
-    hash = "sha256-iQznTxMsozTCsj8AJRErR8aSbabSjC91vPwKg96jYD4=";
+    hash = "sha256-w9YBNO5QnPVUUsc/+L1BiRvLbPQkIaFZwBOIJOEmQCs=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/publicsuffixlist/default.nix
+++ b/pkgs/development/python-modules/publicsuffixlist/default.nix
@ -10,12 +10,12 @@

 buildPythonPackage rec {
  pname = "publicsuffixlist";
-  version = "1.0.2.20251030";
+  version = "1.0.2.20251031";
  pyproject = true;

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-vEQp18br81UIBQtfVW8XAsR3i9iMhTiPtDKQqyJhW9w=";
+    hash = "sha256-pMZj8al1ps6NMzOcBJK5eO3ckNnYX0dFYKQ/3stVmmQ=";
  };

  build-system = [ setuptools ];
--- a/pkgs/os-specific/windows/default.nix
+++ b/pkgs/os-specific/windows/default.nix
@ -27,11 +27,11 @@ lib.makeScope newScope (
      else
        buildPackages.gccWithoutTargetLibc.override (old: {
          bintools = old.bintools.override {
-            libc = pkgs.libc;
+            libc = pkgs.pkgsHostTarget.libc;
            noLibc = pkgs.libc == null;
            nativeLibc = false;
          };
-          libc = pkgs.libc;
+          libc = pkgs.pkgsHostTarget.libc;
          noLibc = pkgs.libc == null;
          nativeLibc = false;
        })
--- a/pkgs/servers/monitoring/grafana/plugins/victoriametrics-logs-datasource/default.nix
+++ b/pkgs/servers/monitoring/grafana/plugins/victoriametrics-logs-datasource/default.nix
@ -2,8 +2,8 @@

 grafanaPlugin {
  pname = "victoriametrics-logs-datasource";
-  version = "0.21.0";
-  zipHash = "sha256-KesSzORt243WS9sR+iinq+wRI6q+8MPn8o9Bj2ic6E0=";
+  version = "0.21.1";
+  zipHash = "sha256-mhGxUt+JWX4i/CYcJOAYpCszF4F2ieaosERVoFUg/mU=";
  meta = {
    description = "Grafana datasource for VictoriaLogs";
    license = lib.licenses.asl20;
--- a/pkgs/servers/monitoring/grafana/plugins/volkovlabs-variable-panel/default.nix
+++ b/pkgs/servers/monitoring/grafana/plugins/volkovlabs-variable-panel/default.nix
@ -2,8 +2,8 @@

 grafanaPlugin {
  pname = "volkovlabs-variable-panel";
-  version = "4.1.0";
-  zipHash = "sha256-3AkCebT9KcQdsi+T3+0XMhwZaEmqlOmY90RidcVqUb4=";
+  version = "5.1.1";
+  zipHash = "sha256-lLzOCgOh4a/Ee6QO5gJkJkHoPzylk9Y3vilXBtvn5G8=";
  meta = with lib; {
    description = "Variable panel allows you to have dashboard filters in a separate panel which you can place anywhere on the dashboard";
    license = licenses.asl20;
--- a/pkgs/stdenv/booter.nix
+++ b/pkgs/stdenv/booter.nix
@ -162,5 +162,9 @@ let
        buildPackages.stdenv.cc;
  };

+  pkgs = dfold folder postStage (_: { }) withAllowCustomOverrides;
+
 in
-dfold folder postStage (_: { }) withAllowCustomOverrides
+# Return the spliced package set, so that consumers of the nixpkgs top-level
+# attributes, like NixOS, don't break when cross-compiling.
+pkgs.__splicedPackages
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@ -254,6 +254,7 @@ mapAliases {
  elasticsearch7Plugins = elasticsearchPlugins; # preserve, reason: until v8
  fetchFromGithub = throw "You meant fetchFromGitHub, with a capital H"; # preserve, reason: common typo
  fuse2fs = if stdenv.hostPlatform.isLinux then e2fsprogs.fuse2fs else null; # Added 2022-03-27 preserve, reason: convenience, arch has a package named fuse2fs too.
+  uclibc = uclibc-ng; # preserve, because uclibc-ng can't be used in config string
  wlroots = wlroots_0_19; # preserve, reason: wlroots is unstable, we must keep depending on 'wlroots_0_*', convert to package after a stable(1.x) release
  wormhole-rs = magic-wormhole-rs; # Added 2022-05-30. preserve, reason: Arch package name, main binary name

@ -277,6 +278,7 @@ mapAliases {
  akkoma-frontends.akkoma-fe = throw "'akkoma-frontends.akkoma-fe' has been renamed to/replaced by 'akkoma-fe'"; # Converted to throw 2025-10-27
  amazon-qldb-shell = throw "'amazon-qldb-shell' has been removed due to being unmaintained upstream"; # Added 2025-07-30
  amdvlk = throw "'amdvlk' has been removed since it was deprecated by AMD. Its replacement, RADV, is enabled by default."; # Added 2025-09-20
+  ams-lv2 = throw "'ams-lv2' has been removed due to being archived upstream."; # Added 2025-10-26
  android-udev-rules = throw "'android-udev-rules' has been removed due to being superseded by built-in systemd uaccess rules."; # Added 2025-10-21
  androidndkPkgs_21 = throw "androidndkPkgs_21 has been removed, as it is EOL"; # Added 2025-08-09
  androidndkPkgs_23 = throw "androidndkPkgs_23 has been removed, as it is EOL"; # Added 2025-08-09
@ -520,7 +522,6 @@ mapAliases {
  elm-github-install = throw "'elm-github-install' has been removed as it is abandoned upstream and only supports Elm 0.18.0"; # Added 2025-08-25
  emacsMacport = throw "'emacsMacport' has been renamed to/replaced by 'emacs-macport'"; # Converted to throw 2025-10-27
  emacsNativeComp = throw "'emacsNativeComp' has been renamed to/replaced by 'emacs'"; # Converted to throw 2025-10-27
-  emacsPackages = throw "'emacsPackages' has been renamed to/replaced by 'emacs.pkgs'"; # Converted to throw 2025-10-27
  embree2 = throw "embree2 has been removed, as it is unmaintained upstream and depended on tbb_2020"; # Added 2025-09-14
  EmptyEpsilon = throw "'EmptyEpsilon' has been renamed to/replaced by 'empty-epsilon'"; # Converted to throw 2025-10-27
  emulationstation = throw "emulationstation was removed due to numerous vulnerabilities in freeimage"; # Added 2025-10-23
@ -567,6 +568,7 @@ mapAliases {
  flut-renamer = throw "flut-renamer is unmaintained and has been removed"; # Added 2025-08-26
  flutter324 = throw "flutter324 has been removed because it isn't updated anymore, and no packages in nixpkgs use it. If you still need it, use flutter.mkFlutter to get a custom version"; # Added 2025-10-28
  flutter326 = throw "flutter326 has been removed because it isn't updated anymore, and no packages in nixpkgs use it. If you still need it, use flutter.mkFlutter to get a custom version"; # Added 2025-06-08
+  flutter327 = throw "flutter327 has been removed because it isn't updated anymore, and no packages in nixpkgs use it. If you still need it, use flutter.mkFlutter to get a custom version"; # Added 2025-10-28
  fmsynth = throw "'fmsynth' has been removed as it was broken and unmaintained both upstream and in nixpkgs."; # Added 2025-09-01
  follow = warnAlias "follow has been renamed to folo" folo; # Added 2025-05-18
  forceSystem = warnAlias "forceSystem is deprecated in favour of explicitly importing Nixpkgs" (
@ -1521,7 +1523,6 @@ mapAliases {
  uade123 = throw "'uade123' has been renamed to/replaced by 'uade'"; # Converted to throw 2025-10-27
  uae = throw "'uae' has been removed due to lack of upstream maintenance. Consider using 'fsuae' instead."; # Added 2025-06-11
  ubuntu_font_family = throw "'ubuntu_font_family' has been renamed to/replaced by 'ubuntu-classic'"; # Converted to throw 2025-10-27
-  uclibc = throw "'uclibc' has been renamed to/replaced by 'uclibc-ng'"; # Converted to throw 2025-10-27
  unicap = throw "'unicap' has been removed because it is unmaintained"; # Added 2025-05-17
  unifi-poller = throw "'unifi-poller' has been renamed to/replaced by 'unpoller'"; # Converted to throw 2025-10-27
  unzoo = throw "'unzoo' has been removed since it is unmaintained upstream and doesn't compile with newer versions of GCC anymore"; # Removed 2025-05-24
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -4064,11 +4064,7 @@ with pkgs;

  tldr-hs = haskellPackages.tldr;

-  tmuxPlugins = recurseIntoAttrs (
-    callPackage ../misc/tmux-plugins {
-      pkgs = pkgs.__splicedPackages;
-    }
-  );
+  tmuxPlugins = recurseIntoAttrs (callPackage ../misc/tmux-plugins { });

  tpm2-totp-with-plymouth = tpm2-totp.override {
    withPlymouth = true;
@ -4282,9 +4278,7 @@ with pkgs;
  yarn-berry_4 = yarn-berry.override { berryVersion = 4; };
  yarn-berry_3 = yarn-berry.override { berryVersion = 3; };

-  yarn2nix-moretea = callPackage ../development/tools/yarn2nix-moretea {
-    pkgs = pkgs.__splicedPackages;
-  };
+  yarn2nix-moretea = callPackage ../development/tools/yarn2nix-moretea { };

  inherit (yarn2nix-moretea)
    yarn2nix
@ -4498,7 +4492,6 @@ with pkgs;
  flutter335 = flutterPackages.v3_35;
  flutter332 = flutterPackages.v3_32;
  flutter329 = flutterPackages.v3_29;
-  flutter327 = flutterPackages.v3_27;

  fpc = callPackage ../development/compilers/fpc { };

@ -4986,7 +4979,6 @@ with pkgs;
  idrisPackages = recurseIntoAttrs (
    callPackage ../development/idris-modules {
      idris-no-deps = haskellPackages.idris;
-      pkgs = pkgs.__splicedPackages;
    }
  );

@ -5977,11 +5969,13 @@ with pkgs;
  rubyPackages_3_5 = recurseIntoAttrs ruby_3_5.gems;

  inherit (callPackages ../applications/networking/cluster/spark { })
+    spark_4_0
    spark_3_5
    spark_3_4
    ;
  spark3 = spark_3_5;
-  spark = spark3;
+  spark4 = spark_4_0;
+  spark = spark_4_0;

  inherit
    ({
@ -6289,7 +6283,7 @@ with pkgs;
      null;
  bintoolsNoLibc = wrapBintoolsWith {
    bintools = bintools-unwrapped;
-    libc = targetPackages.preLibcHeaders;
+    libc = targetPackages.preLibcHeaders or preLibcHeaders;
  };
  bintools = wrapBintoolsWith {
    bintools = bintools-unwrapped;
@ -8834,8 +8828,6 @@ with pkgs;
  );
  agda = agdaPackages.agda;

-  ### DEVELOPMENT / LIBRARIES / BASH
-
  ### DEVELOPMENT / LIBRARIES / JAVA

  saxonb = saxonb_8_8;
@ -9836,8 +9828,6 @@ with pkgs;

  zabbix = zabbix60;

-  ### SERVERS / GEOSPATIAL
-
  ### OS-SPECIFIC

  alfred = callPackage ../os-specific/linux/batman-adv/alfred.nix { };
@ -10937,6 +10927,10 @@ with pkgs;
      pkgs' = pkgs; # default pkgs used for bootstrapping the emacs package set
    };

+  # emacsPackages is exposed on search.nixos.org.
+  # Also see pkgs/top-level/packages-config.nix
+  emacsPackages = dontRecurseIntoAttrs emacs.pkgs;
+
  espeak-classic = callPackage ../applications/audio/espeak { };

  espeak = espeak-ng;
@ -13503,10 +13497,6 @@ with pkgs;
    libxc = pkgs.libxc_7;
  };

-  ### SCIENCE/GEOMETRY
-
-  ### SCIENCE/BENCHMARK
-
  ### SCIENCE/BIOLOGY

  cd-hit = callPackage ../applications/science/biology/cd-hit {
@ -13655,8 +13645,6 @@ with pkgs;
    }
  );

-  ### SCIENCE/MEDICINE
-
  ### SCIENCE/PHYSICS

  mcfm = callPackage ../applications/science/physics/MCFM {
@ -13669,8 +13657,6 @@ with pkgs;

  xflr5 = libsForQt5.callPackage ../applications/science/physics/xflr5 { };

-  ### SCIENCE/PROGRAMMING
-
  ### SCIENCE/LOGIC

  abella = callPackage ../applications/science/logic/abella {
@ -13809,8 +13795,6 @@ with pkgs;
    inherit (ocaml-ng.ocamlPackages_4_14_unsafe_string) ocaml;
  };

-  ### SCIENCE / ENGINEERING
-
  ### SCIENCE / ELECTRONICS

  simulide_0_4_15 = callPackage ../by-name/si/simulide/package.nix { versionNum = "0.4.15"; };
--- a/pkgs/top-level/splice.nix
+++ b/pkgs/top-level/splice.nix
@ -140,6 +140,8 @@ in

  newScope = extra: lib.callPackageWith (pkgsForCall // extra);

+  pkgs = if actuallySplice then splicedPackages // { recurseForDerivations = false; } else pkgs;
+
  # prefill 2 fields of the function for convenience
  makeScopeWithSplicing = lib.makeScopeWithSplicing splicePackages pkgs.newScope;
  makeScopeWithSplicing' = lib.makeScopeWithSplicing' {