From 570aa41d3d9cff8dad67d470213cc35b5f8fa3cc Mon Sep 17 00:00:00 2001
From: Atlas Yu <pseudoc@163.com>
Date: Wed, 26 Feb 2025 11:00:34 +0800
Subject: [PATCH 01/53] intel-npu-driver: init at 1.19.0

Only support the standalone build.

Closes: #348739
(cherry picked from commit 1943dbfccadc22eda9e00bc48cc61dd35e438d25)
---
 maintainers/maintainer-list.nix               |  6 ++
 nixos/modules/hardware/cpu/intel-npu.nix      | 32 ++++++++
 .../installer/tools/nixos-generate-config.pl  |  5 ++
 pkgs/by-name/in/intel-npu-driver/package.nix  | 75 +++++++++++++++++++
 4 files changed, 118 insertions(+)
 create mode 100644 nixos/modules/hardware/cpu/intel-npu.nix
 create mode 100644 pkgs/by-name/in/intel-npu-driver/package.nix

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 74cd657e61482..66636ff7e9bc6 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -21170,6 +21170,12 @@
     matrix = "@pschmitt:one.ems.host";
     keys = [ { fingerprint = "9FBF 2ABF FB37 F7F3 F502  44E5 DC43 9C47 EACB 17F9"; } ];
   };
+  pseudocc = {
+    email = "pseudoc@163.com";
+    github = "pseudocc";
+    githubId = 85104110;
+    name = "Atlas Yu";
+  };
   pshirshov = {
     email = "pshirshov@eml.cc";
     github = "pshirshov";
diff --git a/nixos/modules/hardware/cpu/intel-npu.nix b/nixos/modules/hardware/cpu/intel-npu.nix
new file mode 100644
index 0000000000000..0bd406e6892f2
--- /dev/null
+++ b/nixos/modules/hardware/cpu/intel-npu.nix
@@ -0,0 +1,32 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.hardware.cpu.intel.npu;
+in
+{
+  options = {
+    hardware.cpu.intel.npu = {
+      enable = lib.mkEnableOption "Intel NPU support";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = config.hardware.graphics.enable;
+        message = "Intel NPU requires hardware.graphics.enable to be enabled";
+      }
+    ];
+
+    hardware.firmware = [ pkgs.intel-npu-driver.firmware ];
+    hardware.graphics.extraPackages = [ pkgs.intel-npu-driver ];
+    environment.systemPackages = [
+      pkgs.intel-npu-driver.validation
+      pkgs.level-zero
+    ];
+  };
+}
diff --git a/nixos/modules/installer/tools/nixos-generate-config.pl b/nixos/modules/installer/tools/nixos-generate-config.pl
index 9397d06e7ae78..77139976e7ad1 100644
--- a/nixos/modules/installer/tools/nixos-generate-config.pl
+++ b/nixos/modules/installer/tools/nixos-generate-config.pl
@@ -205,6 +205,11 @@ sub pciCheck {
         ($device eq "0x4229" || $device eq "0x4230" ||
          $device eq "0x4222" || $device eq "0x4227");
 
+    push @attrs, "hardware.cpu.intel.npu.enable = true;" if
+        $vendor eq "0x8086" &&
+        ($device eq "0x7d1d" || $device eq "0xad1d" ||
+         $device eq "0x643e" || $device eq "0xb03e");
+
     # Assume that all NVIDIA cards are supported by the NVIDIA driver.
     # There may be exceptions (e.g. old cards).
     # FIXME: do we want to enable an unfree driver here?
diff --git a/pkgs/by-name/in/intel-npu-driver/package.nix b/pkgs/by-name/in/intel-npu-driver/package.nix
new file mode 100644
index 0000000000000..9de9b3b36181d
--- /dev/null
+++ b/pkgs/by-name/in/intel-npu-driver/package.nix
@@ -0,0 +1,75 @@
+{
+  lib,
+  stdenv,
+  udev,
+  openssl,
+  boost,
+  cmake,
+  git,
+  level-zero,
+  fetchFromGitHub,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "intel-npu-driver";
+  version = "1.19.0";
+
+  src = fetchFromGitHub {
+    owner = "intel";
+    repo = "linux-npu-driver";
+    rev = "v${version}";
+    fetchSubmodules = true;
+    hash = "sha256-TQfqBSSHHPck0srnezqcXPHaIIC3SymvwaYU6svI13c=";
+  };
+
+  buildInputs = [
+    udev
+    openssl
+    boost
+    level-zero
+  ];
+
+  nativeBuildInputs = [
+    cmake
+  ];
+
+  outputs = [
+    "out"
+    "validation"
+    "firmware"
+  ];
+
+  postPatch = ''
+    rm -rf third_party/level-zero
+    rm third_party/cmake/level-zero.cmake
+    rm third_party/cmake/FindLevelZero.cmake
+    substituteInPlace third_party/CMakeLists.txt --replace-fail \
+      "include(cmake/level-zero.cmake)" \
+      ""
+    substituteInPlace third_party/level-zero-npu-extensions/ze_graph_ext.h --replace-fail \
+    "#include \"ze_api.h\"" \
+    "#include <level_zero/ze_api.h>"
+
+    substituteInPlace validation/{kmd-test,umd-test}/CMakeLists.txt --replace-fail \
+      "COMPONENT validation-npu" \
+      "DESTINATION $validation/bin COMPONENT validation-npu"
+
+    substituteInPlace firmware/CMakeLists.txt --replace-fail \
+      "DESTINATION /lib/firmware/updates/intel/vpu/" \
+      "DESTINATION $firmware/lib/firmware/intel/vpu/"
+  '';
+
+  installPhase = ''
+    cmake --install . --component level-zero-npu
+    cmake --install . --component validation-npu
+    cmake --install . --component fw-npu
+  '';
+
+  meta = {
+    homepage = "https://github.com/intel/linux-npu-driver";
+    description = "Intel NPU (Neural Processing Unit) Standalone Driver";
+    platforms = [ "x86_64-linux" ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ pseudocc ];
+  };
+}

From 0ac07ea2f1b885e1c49dcf1570d4315f4fb0ec68 Mon Sep 17 00:00:00 2001
From: Atlas Yu <pseudoc@163.com>
Date: Fri, 15 Aug 2025 12:18:23 +0800
Subject: [PATCH 02/53] intel-npu-driver: update to 1.22.0

Part-Of: #348739
(cherry picked from commit c190aa02b64c9133926102b2bc08ec4cf44c6302)
---
 pkgs/by-name/in/intel-npu-driver/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/in/intel-npu-driver/package.nix b/pkgs/by-name/in/intel-npu-driver/package.nix
index 9de9b3b36181d..ed6af954ce7de 100644
--- a/pkgs/by-name/in/intel-npu-driver/package.nix
+++ b/pkgs/by-name/in/intel-npu-driver/package.nix
@@ -12,14 +12,14 @@
 
 stdenv.mkDerivation rec {
   pname = "intel-npu-driver";
-  version = "1.19.0";
+  version = "1.22.0";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "linux-npu-driver";
     rev = "v${version}";
     fetchSubmodules = true;
-    hash = "sha256-TQfqBSSHHPck0srnezqcXPHaIIC3SymvwaYU6svI13c=";
+    hash = "sha256-GxmAmbf28hn/ragkTkFBYbM6Z+uFR6X4foMOyE8UVAc=";
   };
 
   buildInputs = [

From d2af864c1b22dc5f392e6c88bd26e425a0123367 Mon Sep 17 00:00:00 2001
From: Atlas Yu <pseudoc@163.com>
Date: Mon, 1 Sep 2025 09:48:42 +0800
Subject: [PATCH 03/53] intel-npu-driver: update to 1.23.0

Part-Of: #348739
(cherry picked from commit b37e56018c975d21c86d0dac6f8823d152687b85)
---
 pkgs/by-name/in/intel-npu-driver/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/in/intel-npu-driver/package.nix b/pkgs/by-name/in/intel-npu-driver/package.nix
index ed6af954ce7de..7cf9e28d09421 100644
--- a/pkgs/by-name/in/intel-npu-driver/package.nix
+++ b/pkgs/by-name/in/intel-npu-driver/package.nix
@@ -12,14 +12,14 @@
 
 stdenv.mkDerivation rec {
   pname = "intel-npu-driver";
-  version = "1.22.0";
+  version = "1.23.0";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "linux-npu-driver";
     rev = "v${version}";
     fetchSubmodules = true;
-    hash = "sha256-GxmAmbf28hn/ragkTkFBYbM6Z+uFR6X4foMOyE8UVAc=";
+    hash = "sha256-Lc+FsW0bM2cIqEXpCd9+nvFh70xCbY6aMSHZIjESxhs=";
   };
 
   buildInputs = [

From cb0049f269899d18b48951f867dea329a8ea69fd Mon Sep 17 00:00:00 2001
From: Atlas Yu <pseudoc@163.com>
Date: Wed, 3 Sep 2025 23:08:48 +0800
Subject: [PATCH 04/53] intel-npu-driver: apply suggestions

(cherry picked from commit 9486d5ee384e6eb10273fdb500ad96cd66ecf533)
---
 nixos/modules/hardware/cpu/intel-npu.nix     | 17 ++++++++---------
 pkgs/by-name/in/intel-npu-driver/package.nix |  2 +-
 2 files changed, 9 insertions(+), 10 deletions(-)

diff --git a/nixos/modules/hardware/cpu/intel-npu.nix b/nixos/modules/hardware/cpu/intel-npu.nix
index 0bd406e6892f2..a384708e35447 100644
--- a/nixos/modules/hardware/cpu/intel-npu.nix
+++ b/nixos/modules/hardware/cpu/intel-npu.nix
@@ -15,18 +15,17 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    assertions = [
-      {
-        assertion = config.hardware.graphics.enable;
-        message = "Intel NPU requires hardware.graphics.enable to be enabled";
-      }
-    ];
-
-    hardware.firmware = [ pkgs.intel-npu-driver.firmware ];
-    hardware.graphics.extraPackages = [ pkgs.intel-npu-driver ];
     environment.systemPackages = [
       pkgs.intel-npu-driver.validation
       pkgs.level-zero
     ];
+
+    hardware = {
+      firmware = [ pkgs.intel-npu-driver.firmware ];
+      graphics = {
+        enable = true;
+        extraPackages = [ pkgs.intel-npu-driver ];
+      };
+    };
   };
 }
diff --git a/pkgs/by-name/in/intel-npu-driver/package.nix b/pkgs/by-name/in/intel-npu-driver/package.nix
index 7cf9e28d09421..70c079eb73fe5 100644
--- a/pkgs/by-name/in/intel-npu-driver/package.nix
+++ b/pkgs/by-name/in/intel-npu-driver/package.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "intel";
     repo = "linux-npu-driver";
-    rev = "v${version}";
+    tag = "v${version}";
     fetchSubmodules = true;
     hash = "sha256-Lc+FsW0bM2cIqEXpCd9+nvFh70xCbY6aMSHZIjESxhs=";
   };

From 2660a397538da868b7a13a9430afb8742f1613d4 Mon Sep 17 00:00:00 2001
From: Atlas Yu <pseudoc@163.com>
Date: Thu, 9 Oct 2025 13:44:51 +0800
Subject: [PATCH 05/53] intel-npu-driver: update to 1.24.0

(cherry picked from commit 716bf6438cff55952fce359c45da439b3e2f6325)
---
 pkgs/by-name/in/intel-npu-driver/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/in/intel-npu-driver/package.nix b/pkgs/by-name/in/intel-npu-driver/package.nix
index 70c079eb73fe5..8428bd01bef23 100644
--- a/pkgs/by-name/in/intel-npu-driver/package.nix
+++ b/pkgs/by-name/in/intel-npu-driver/package.nix
@@ -12,14 +12,14 @@
 
 stdenv.mkDerivation rec {
   pname = "intel-npu-driver";
-  version = "1.23.0";
+  version = "1.24.0";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "linux-npu-driver";
     tag = "v${version}";
     fetchSubmodules = true;
-    hash = "sha256-Lc+FsW0bM2cIqEXpCd9+nvFh70xCbY6aMSHZIjESxhs=";
+    hash = "sha256-pnQ4OV+7bKivhS5lVmdz5Zb9kqaSJK0eK0lK+68wzYU=";
   };
 
   buildInputs = [

From 3b953572fa2c54163b62d5e0d22691c0752a7a80 Mon Sep 17 00:00:00 2001
From: Atlas Yu <pseudoc@163.com>
Date: Wed, 26 Nov 2025 10:09:24 +0800
Subject: [PATCH 06/53] intel-npu-driver: update to 1.26.0

Fix building the third party library yaml-cpp:
- Compatibility with CMake < 3.5 has been removed from CMake.

(cherry picked from commit 27a07b0ca9c40f5f6a4326aafc842f5b700c3cca)
---
 pkgs/by-name/in/intel-npu-driver/package.nix | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/in/intel-npu-driver/package.nix b/pkgs/by-name/in/intel-npu-driver/package.nix
index 8428bd01bef23..9f5680d1bb40b 100644
--- a/pkgs/by-name/in/intel-npu-driver/package.nix
+++ b/pkgs/by-name/in/intel-npu-driver/package.nix
@@ -12,14 +12,14 @@
 
 stdenv.mkDerivation rec {
   pname = "intel-npu-driver";
-  version = "1.24.0";
+  version = "1.26.0";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "linux-npu-driver";
     tag = "v${version}";
     fetchSubmodules = true;
-    hash = "sha256-pnQ4OV+7bKivhS5lVmdz5Zb9kqaSJK0eK0lK+68wzYU=";
+    hash = "sha256-f3GxvYBfCCK6EGASuHrevFEVcBAyKyWXaIvSNcNcSZQ=";
   };
 
   buildInputs = [
@@ -43,6 +43,11 @@ stdenv.mkDerivation rec {
     rm -rf third_party/level-zero
     rm third_party/cmake/level-zero.cmake
     rm third_party/cmake/FindLevelZero.cmake
+
+    substituteInPlace third_party/yaml-cpp/CMakeLists.txt --replace-fail \
+      "cmake_minimum_required" \
+      "# cmake_minimum_required"
+
     substituteInPlace third_party/CMakeLists.txt --replace-fail \
       "include(cmake/level-zero.cmake)" \
       ""

From d3401cd0b4f680b7cdfaab85c1396612f66447a6 Mon Sep 17 00:00:00 2001
From: Atlas Yu <pseudoc@163.com>
Date: Fri, 19 Dec 2025 16:57:19 +0800
Subject: [PATCH 07/53] nixos/nixos-generate-config: fix intel-npu imports

The generated configuration during the installation will failed to
evaluate "error: The option `hardware.cpu.intel.npu' does not exist."
on Intel CPUs have NPU support.

- Fix this by adding the missing imports when PCI ID matches.
- Also update the PCI ID list (linux v6.18).

(cherry picked from commit f2f3ce2af81912b28e6f99c3f092300cf5b2c860)
---
 .../installer/tools/nixos-generate-config.pl        | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/nixos/modules/installer/tools/nixos-generate-config.pl b/nixos/modules/installer/tools/nixos-generate-config.pl
index 77139976e7ad1..bbd0a093b998d 100644
--- a/nixos/modules/installer/tools/nixos-generate-config.pl
+++ b/nixos/modules/installer/tools/nixos-generate-config.pl
@@ -205,10 +205,15 @@ sub pciCheck {
         ($device eq "0x4229" || $device eq "0x4230" ||
          $device eq "0x4222" || $device eq "0x4227");
 
-    push @attrs, "hardware.cpu.intel.npu.enable = true;" if
-        $vendor eq "0x8086" &&
-        ($device eq "0x7d1d" || $device eq "0xad1d" ||
-         $device eq "0x643e" || $device eq "0xb03e");
+    # Intel NPU driver
+    # list taken from linux(v6.18): drivers/accel/ivpu/ivpu_drv.h
+    if ($vendor eq "0x8086" &&
+        ($device eq "0xfd3e" || $device eq "0x7d1d" || $device eq "0xad1d" ||
+         $device eq "0x643e" || $device eq "0xb03e"))
+    {
+        push @imports, "(modulesPath + \"/hardware/cpu/intel-npu.nix\")";
+        push @attrs, "hardware.cpu.intel.npu.enable = true;";
+    }
 
     # Assume that all NVIDIA cards are supported by the NVIDIA driver.
     # There may be exceptions (e.g. old cards).

From 9766b8db0c9cfaa51277ec0c1c5d80d9cc84ac8a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 19 Dec 2025 08:48:45 +0000
Subject: [PATCH 08/53] intel-npu-driver: 1.26.0 -> 1.28.0

(cherry picked from commit a6692797e4009b1564434915b2e4188f557185c3)
---
 pkgs/by-name/in/intel-npu-driver/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/in/intel-npu-driver/package.nix b/pkgs/by-name/in/intel-npu-driver/package.nix
index 9f5680d1bb40b..4ea78a1b57759 100644
--- a/pkgs/by-name/in/intel-npu-driver/package.nix
+++ b/pkgs/by-name/in/intel-npu-driver/package.nix
@@ -12,14 +12,14 @@
 
 stdenv.mkDerivation rec {
   pname = "intel-npu-driver";
-  version = "1.26.0";
+  version = "1.28.0";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "linux-npu-driver";
     tag = "v${version}";
     fetchSubmodules = true;
-    hash = "sha256-f3GxvYBfCCK6EGASuHrevFEVcBAyKyWXaIvSNcNcSZQ=";
+    hash = "sha256-aH7npJompKYlyq2RPXHn/lflQ1C/yYcTp2K+6kX/L0w=";
   };
 
   buildInputs = [

From cf2ceb1b8219f1e7c7f514708d1734200ccee863 Mon Sep 17 00:00:00 2001
From: Haonan Chen <chn@chn.moe>
Date: Sat, 20 Dec 2025 17:15:37 +0800
Subject: [PATCH 09/53] bintools-wrapper: fix rpath handling with symlinks in
 the store #454199

(cherry picked from commit 67898b4f6e30964267c3e3a47fc591d7af5ce9fc)
---
 .../bintools-wrapper/ld-wrapper.sh            | 27 ++++++++++++++++---
 1 file changed, 23 insertions(+), 4 deletions(-)

diff --git a/pkgs/build-support/bintools-wrapper/ld-wrapper.sh b/pkgs/build-support/bintools-wrapper/ld-wrapper.sh
index 944e45edac1bc..ae76e7a223f71 100644
--- a/pkgs/build-support/bintools-wrapper/ld-wrapper.sh
+++ b/pkgs/build-support/bintools-wrapper/ld-wrapper.sh
@@ -202,13 +202,32 @@ if [[ "$NIX_DONT_SET_RPATH_@suffixSalt@" != 1 && "$linkType" != static-pie ]]; t
     # the link time chosen objects will be those of runtime linking.
     declare -A rpaths
     for dir in ${libDirs+"${libDirs[@]}"}; do
-        if [[ "$dir" =~ [/.][/.] ]] && dir2=$(readlink -f "$dir"); then
+        # If the path is in the store, do not resolve any symlinks and add it to the rpath.
+        # Resolving symlinks in the store breaks bootstrapping, see issue #454199.
+        # If it is outside the store, resolve symlinks step by step until it falls
+        # into the store or it becomes not a symlink.
+        # Always canonicalize the path before checking it is in the store or not.
+        if dir2=$(realpath -s "$dir"); then
             dir="$dir2"
+        else
+            continue
         fi
+        while [ -z "${rpaths[$dir]:-}" ] && [[ "$dir" != "${NIX_STORE:-}"/* ]] && [ -L "$dir" ]; do
+            if dir2=$(readlink "$dir"); then
+                dir="dir2"
+            else
+                break
+            fi
+            if dir2=$(realpath -s "$dir"); then
+                dir="dir2"
+            else
+                break
+            fi
+        done
+        # If the path turns out to be outside the store, we do not add it to rpath.
+        # This typically happens for libraries in /tmp that are later
+        # copied to $out/lib. If not, we're screwed.
         if [ -n "${rpaths[$dir]:-}" ] || [[ "$dir" != "${NIX_STORE:-}"/* ]]; then
-            # If the path is not in the store, don't add it to the rpath.
-            # This typically happens for libraries in /tmp that are later
-            # copied to $out/lib.  If not, we're screwed.
             continue
         fi
         for path in "$dir"/*; do

From 8b733f3e93b65f5bf85f349407720ce831daf064 Mon Sep 17 00:00:00 2001
From: Jan Tojnar <jtojnar@gmail.com>
Date: Sat, 31 Jan 2026 12:39:07 +0000
Subject: [PATCH 10/53] =?UTF-8?q?gdk-pixbuf:=202.44.4=20=E2=86=92=202.44.5?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/compare/2.44.4...2.44.5
(cherry picked from commit a9e02e009ec8b14f09ced418bbb7dc058f568689)
---
 .../development/libraries/gdk-pixbuf/default.nix | 16 ++++++----------
 1 file changed, 6 insertions(+), 10 deletions(-)

diff --git a/pkgs/development/libraries/gdk-pixbuf/default.nix b/pkgs/development/libraries/gdk-pixbuf/default.nix
index d91e3971a6f68..8b782a3843049 100644
--- a/pkgs/development/libraries/gdk-pixbuf/default.nix
+++ b/pkgs/development/libraries/gdk-pixbuf/default.nix
@@ -28,7 +28,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gdk-pixbuf";
-  version = "2.44.4";
+  version = "2.44.5";
 
   outputs = [
     "out"
@@ -38,14 +38,10 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optional withIntrospection "devdoc"
   ++ lib.optional (stdenv.buildPlatform == stdenv.hostPlatform) "installedTests";
 
-  src =
-    let
-      inherit (finalAttrs) pname version;
-    in
-    fetchurl {
-      url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-      hash = "sha256-k6Gqw/FCeuc0Vzl1gqLDjQSWOKgBeIzL1fSMpge9vRc=";
-    };
+  src = fetchurl {
+    url = "mirror://gnome/sources/gdk-pixbuf/${lib.versions.majorMinor finalAttrs.version}/gdk-pixbuf-${finalAttrs.version}.tar.xz";
+    hash = "sha256-abk+CRObgMDuZhUD1g3rWlh0oxdytRhLnNVGKkEAq2g=";
+  };
 
   patches = [
     # Move installed tests to a separate output
@@ -155,7 +151,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   passthru = {
     updateScript = gnome.updateScript {
-      packageName = finalAttrs.pname;
+      packageName = "gdk-pixbuf";
       versionPolicy = "odd-unstable";
     };
 

From 795c5b84700065c657e05ae5161da95c7a094d31 Mon Sep 17 00:00:00 2001
From: Thiago Kenji Okada <thiagokokada@gmail.com>
Date: Wed, 4 Feb 2026 22:16:31 +0000
Subject: [PATCH 11/53] nixos-rebuild-ng: use sys.excepthook() to print
 CalledProcessError exceptions

This will give a better error output (e.g., colorized).

(cherry picked from commit 206c619d347d741bb531ca46b0341509cb21b96e)
---
 .../ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py  | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py
index ce7108175f0c7..c65f84560ceaa 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py
@@ -351,7 +351,7 @@ def main() -> None:
     try:
         execute(sys.argv)
     except CalledProcessError as ex:
-        _handle_called_process_error(ex)
+        sys.exit(_handle_called_process_error(ex))
     except (Exception, KeyboardInterrupt) as ex:
         if logger.isEnabledFor(logging.DEBUG):
             raise
@@ -359,11 +359,9 @@ def main() -> None:
             sys.exit(str(ex))
 
 
-def _handle_called_process_error(ex: CalledProcessError) -> None:
+def _handle_called_process_error(ex: CalledProcessError) -> int:
     if logger.isEnabledFor(logging.DEBUG):
-        import traceback
-
-        traceback.print_exception(ex)
+        sys.excepthook(*sys.exc_info())
     else:
         import shlex
 
@@ -384,4 +382,4 @@ def _handle_called_process_error(ex: CalledProcessError) -> None:
         print(str(ex), file=sys.stderr)
 
     # Exit with the error code of the process that failed
-    sys.exit(ex.returncode)
+    return ex.returncode

From f76e188c2a8d39132717726979045544aeb3d928 Mon Sep 17 00:00:00 2001
From: Thiago Kenji Okada <thiagokokada@gmail.com>
Date: Wed, 4 Feb 2026 22:34:18 +0000
Subject: [PATCH 12/53] nixos-rebuild-ng: fix Ctrl+D exit code

(cherry picked from commit eb95d74011dfcf9f51cb934cefa8d2933defe918)
---
 .../by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py
index c65f84560ceaa..199d6151a4962 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py
@@ -350,9 +350,11 @@ def main() -> None:
 
     try:
         execute(sys.argv)
+    except KeyboardInterrupt:
+        sys.exit(130)
     except CalledProcessError as ex:
         sys.exit(_handle_called_process_error(ex))
-    except (Exception, KeyboardInterrupt) as ex:
+    except Exception as ex:
         if logger.isEnabledFor(logging.DEBUG):
             raise
         else:

From 4fa4ab20defba981f72106d7d2570786e9c2969f Mon Sep 17 00:00:00 2001
From: Jason Odoom <jasonodoom@riseup.net>
Date: Fri, 20 Feb 2026 01:21:08 -0500
Subject: [PATCH 13/53] libjxl: 0.11.1 -> 0.11.2

https://github.com/libjxl/libjxl/releases/tag/v0.11.2

Fixes: CVE-2025-12474
(cherry picked from commit 2b56137231a8e16f6cd27b97ef8e4d9edda51ee2)
---
 pkgs/by-name/li/libjxl/package.nix | 16 ++--------------
 1 file changed, 2 insertions(+), 14 deletions(-)

diff --git a/pkgs/by-name/li/libjxl/package.nix b/pkgs/by-name/li/libjxl/package.nix
index baafab3033bf0..040b1d7a0bef3 100644
--- a/pkgs/by-name/li/libjxl/package.nix
+++ b/pkgs/by-name/li/libjxl/package.nix
@@ -2,7 +2,6 @@
   stdenv,
   lib,
   fetchFromGitHub,
-  fetchpatch,
   brotli,
   cmake,
   ctestCheckHook,
@@ -32,7 +31,7 @@ in
 
 stdenv.mkDerivation rec {
   pname = "libjxl";
-  version = "0.11.1";
+  version = "0.11.2";
 
   outputs = [
     "out"
@@ -43,7 +42,7 @@ stdenv.mkDerivation rec {
     owner = "libjxl";
     repo = "libjxl";
     tag = "v${version}";
-    hash = "sha256-ORwhKOp5Nog366UkLbuWpjz/6sJhxUO6+SkoJGH+3fE=";
+    hash = "sha256-L4/BY68ZBCpebQxryR7D1CxrsneYvw8B8EvW2mkF7bA=";
     # There are various submodules in `third_party/`.
     fetchSubmodules = true;
   };
@@ -145,17 +144,6 @@ stdenv.mkDerivation rec {
     rm -rf third_party/!(sjpeg)/
     shopt -u extglob
 
-    # Fix the build with CMake 4.
-    #
-    # See:
-    #
-    # * <https://github.com/webmproject/sjpeg/commit/9990bdceb22612a62f1492462ef7423f48154072>
-    # * <https://github.com/webmproject/sjpeg/commit/94e0df6d0f8b44228de5be0ff35efb9f946a13c9>
-    substituteInPlace third_party/sjpeg/CMakeLists.txt \
-      --replace-fail \
-        'cmake_minimum_required(VERSION 2.8.7)' \
-        'cmake_minimum_required(VERSION 3.5...3.10)'
-
     substituteInPlace plugins/gdk-pixbuf/jxl.thumbnailer \
       --replace '/usr/bin/gdk-pixbuf-thumbnailer' "$out/libexec/gdk-pixbuf-thumbnailer-jxl"
     substituteInPlace CMakeLists.txt \

From 7c148fc6bb974b39c22bbffe8b267975fb73f679 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Mon, 23 Feb 2026 23:12:50 -0800
Subject: [PATCH 14/53] imagemagick: 7.1.2-13 -> 7.1.2-15

Diff: https://github.com/ImageMagick/ImageMagick/compare/7.1.2-13...7.1.2-15

Changelog: https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
(cherry picked from commit ee33a7eea896972a062f805f282667a043e1c7aa)
---
 pkgs/applications/graphics/ImageMagick/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/graphics/ImageMagick/default.nix b/pkgs/applications/graphics/ImageMagick/default.nix
index f55bffa67262f..bb2ccf78ef381 100644
--- a/pkgs/applications/graphics/ImageMagick/default.nix
+++ b/pkgs/applications/graphics/ImageMagick/default.nix
@@ -85,13 +85,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "imagemagick";
-  version = "7.1.2-13";
+  version = "7.1.2-15";
 
   src = fetchFromGitHub {
     owner = "ImageMagick";
     repo = "ImageMagick";
     tag = finalAttrs.version;
-    hash = "sha256-meADRjoV1c48laD35TuWAwuE95L90agROuuKBd++Kn8=";
+    hash = "sha256-qL7CYq+aGCB3ZLgIcSBy2Dw69g0F68xGXxrE7xJhdNc=";
   };
 
   outputs = [

From f7e8321ac8bbd8cce2e8f304798365758eae341e Mon Sep 17 00:00:00 2001
From: Arian van Putten <arian@arianvp.me>
Date: Fri, 27 Feb 2026 13:16:06 +0100
Subject: [PATCH 15/53] systemd: 258.3 -> 258.5

Not-cherry-picked-because: unstable is already on 259
---
 pkgs/os-specific/linux/systemd/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index c1dac94276505..acb4c053438cf 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -207,13 +207,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   inherit pname;
-  version = "258.3";
+  version = "258.5";
 
   src = fetchFromGitHub {
     owner = "systemd";
     repo = "systemd";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-wpg/0z7xrB8ysPaa/zNp1mz+yYRCGyXz0ODZcKapovM=";
+    hash = "sha256-3xz8q0R0gMAwRDV2QmYO0r/0Fw+9LOyR3O3XuMrTpgY=";
   };
 
   # On major changes, or when otherwise required, you *must* :

From f5a8b39494d5fe1950410b50f4612c3afff72ab4 Mon Sep 17 00:00:00 2001
From: Olli Helenius <liff@iki.fi>
Date: Mon, 16 Feb 2026 18:56:45 +0200
Subject: [PATCH 16/53] libcanberra: use a local copy of the `GdkDisplay` patch

The patch is no longer available from git.0pointer.net.

(cherry picked from commit d2201dd6729815e09fd6eb32db07b50325b7ca01)
---
 ...-all-GdkDisplays-are-GdkX11Displays-.patch | 52 +++++++++++++++++++
 pkgs/by-name/li/libcanberra/package.nix       |  6 +--
 2 files changed, 53 insertions(+), 5 deletions(-)
 create mode 100644 pkgs/by-name/li/libcanberra/0001-gtk-Don-t-assume-all-GdkDisplays-are-GdkX11Displays-.patch

diff --git a/pkgs/by-name/li/libcanberra/0001-gtk-Don-t-assume-all-GdkDisplays-are-GdkX11Displays-.patch b/pkgs/by-name/li/libcanberra/0001-gtk-Don-t-assume-all-GdkDisplays-are-GdkX11Displays-.patch
new file mode 100644
index 0000000000000..8ca3625e356c9
--- /dev/null
+++ b/pkgs/by-name/li/libcanberra/0001-gtk-Don-t-assume-all-GdkDisplays-are-GdkX11Displays-.patch
@@ -0,0 +1,52 @@
+--- a/src/canberra-gtk-module.c
++++ b/src/canberra-gtk-module.c
+@@ -307,6 +307,11 @@
+         guchar *data = NULL;
+         gint ret = -1;
+ 
++#ifdef GDK_IS_X11_DISPLAY
++        if (!GDK_IS_X11_DISPLAY(d))
++                return 0;
++#endif
++
+         if (XGetWindowProperty(GDK_DISPLAY_XDISPLAY(d), GDK_WINDOW_XID(w),
+                                gdk_x11_get_xatom_by_name_for_display(d, "_NET_WM_DESKTOP"),
+                                0, G_MAXLONG, False, XA_CARDINAL, &type_return,
+@@ -335,6 +340,11 @@
+         guchar *data = NULL;
+         gint ret = -1;
+ 
++#ifdef GDK_IS_X11_DISPLAY
++        if (!GDK_IS_X11_DISPLAY(d))
++                return 0;
++#endif
++
+         if (XGetWindowProperty(GDK_DISPLAY_XDISPLAY(d), DefaultRootWindow(GDK_DISPLAY_XDISPLAY(d)),
+                                gdk_x11_get_xatom_by_name_for_display(d, "_NET_CURRENT_DESKTOP"),
+                                0, G_MAXLONG, False, XA_CARDINAL, &type_return,
+@@ -365,6 +375,11 @@
+         gboolean ret = FALSE;
+         Atom xembed;
+ 
++#ifdef GDK_IS_X11_DISPLAY
++        if (!GDK_IS_X11_DISPLAY(d))
++                return FALSE;
++#endif
++
+         /* Gnome Panel applets are XEMBED windows. We need to make sure we
+          * ignore them */
+ 
+--- a/src/canberra-gtk.c
++++ b/src/canberra-gtk.c
+@@ -185,6 +185,11 @@
+         guchar *data = NULL;
+         gint ret = -1;
+ 
++#ifdef GDK_IS_X11_DISPLAY
++        if (!GDK_IS_X11_DISPLAY(d))
++                return 0;
++#endif
++
+         if (XGetWindowProperty(GDK_DISPLAY_XDISPLAY(d), GDK_WINDOW_XID(w),
+                                gdk_x11_get_xatom_by_name_for_display(d, "_NET_WM_DESKTOP"),
+                                0, G_MAXLONG, False, XA_CARDINAL, &type_return,
diff --git a/pkgs/by-name/li/libcanberra/package.nix b/pkgs/by-name/li/libcanberra/package.nix
index 79b7a49817c27..bec8d5e9744e0 100644
--- a/pkgs/by-name/li/libcanberra/package.nix
+++ b/pkgs/by-name/li/libcanberra/package.nix
@@ -55,11 +55,7 @@ stdenv.mkDerivation rec {
   ++ lib.optional stdenv.hostPlatform.isLinux "--with-systemdsystemunitdir=${placeholder "out"}/lib/systemd/system";
 
   patches = [
-    (fetchpatch {
-      name = "0001-gtk-Don-t-assume-all-GdkDisplays-are-GdkX11Displays-.patch";
-      url = "http://git.0pointer.net/libcanberra.git/patch/?id=c0620e432650e81062c1967cc669829dbd29b310";
-      sha256 = "0rc7zwn39yxzxp37qh329g7375r5ywcqcaak8ryd0dgvg8m5hcx9";
-    })
+    ./0001-gtk-Don-t-assume-all-GdkDisplays-are-GdkX11Displays-.patch
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
     (fetchpatch {

From 2c0a57484da01b1b2aacbda5f85c4a1ed5de3a65 Mon Sep 17 00:00:00 2001
From: Theo <theo.johanson@gmail.com>
Date: Tue, 3 Mar 2026 23:31:19 +0100
Subject: [PATCH 17/53] freeipa: Add support for subUIDs and subGIDs (#492892)

(cherry picked from commit a542077c1217524857d3a425d6d3e08fc50d30b9)
---
 nixos/modules/config/nsswitch.nix    | 29 ++++++++++++++++++++++++++++
 nixos/modules/security/ipa.nix       |  1 +
 nixos/modules/services/misc/sssd.nix | 14 ++++++++++++++
 3 files changed, 44 insertions(+)

diff --git a/nixos/modules/config/nsswitch.nix b/nixos/modules/config/nsswitch.nix
index 354c506e0ae89..797d2422e27c0 100644
--- a/nixos/modules/config/nsswitch.nix
+++ b/nixos/modules/config/nsswitch.nix
@@ -97,6 +97,30 @@
         '';
         default = [ ];
       };
+
+      subuid = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+        description = ''
+          List of subuid entries to configure in {file}`/etc/nsswitch.conf`.
+
+          Note that "files" is always prepended.
+
+          This option only takes effect if nscd is enabled.
+        '';
+        default = [ ];
+      };
+
+      subgid = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+        description = ''
+          List of subgid entries to configure in {file}`/etc/nsswitch.conf`.
+
+          Note that "files" is always prepended.
+
+          This option only takes effect if nscd is enabled.
+        '';
+        default = [ ];
+      };
     };
   };
 
@@ -133,6 +157,9 @@
       services:  ${lib.concatStringsSep " " config.system.nssDatabases.services}
       protocols: files
       rpc:       files
+
+      subuid:    ${lib.concatStringsSep " " config.system.nssDatabases.subuid}
+      subgid:    ${lib.concatStringsSep " " config.system.nssDatabases.subgid}
     '';
 
     system.nssDatabases = {
@@ -145,6 +172,8 @@
         (lib.mkOrder 1499 [ "dns" ])
       ];
       services = lib.mkBefore [ "files" ];
+      subuid = lib.mkBefore [ "files" ];
+      subgid = lib.mkBefore [ "files" ];
     };
   };
 }
diff --git a/nixos/modules/security/ipa.nix b/nixos/modules/security/ipa.nix
index b9ed5ff36bf75..0951cc0d262de 100644
--- a/nixos/modules/security/ipa.nix
+++ b/nixos/modules/security/ipa.nix
@@ -307,6 +307,7 @@ in
           allowed_uids = lib.concatStringsSep ", " cfg.ifpAllowedUids;
         };
       };
+      subIDsIntegration = true;
     };
 
     networking.timeServers = lib.optional cfg.useAsTimeserver cfg.server;
diff --git a/nixos/modules/services/misc/sssd.nix b/nixos/modules/services/misc/sssd.nix
index 05351a040916c..5a4c3a3f45cad 100644
--- a/nixos/modules/services/misc/sssd.nix
+++ b/nixos/modules/services/misc/sssd.nix
@@ -93,6 +93,15 @@ in
           Kerberos will be configured to cache credentials in SSS.
         '';
       };
+
+      subIDsIntegration = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = ''
+          Whether to use SSS as a source for subuid and subgid.
+        '';
+      };
+
       environmentFile = lib.mkOption {
         type = lib.types.nullOr lib.types.path;
         default = null;
@@ -246,6 +255,11 @@ in
       services.openssh.authorizedKeysCommand = "/etc/ssh/authorized_keys_command";
       services.openssh.authorizedKeysCommandUser = "nobody";
     })
+
+    (lib.mkIf cfg.subIDsIntegration {
+      system.nssDatabases.subuid = [ "sss" ];
+      system.nssDatabases.subgid = [ "sss" ];
+    })
   ];
 
   meta.maintainers = with lib.maintainers; [ bbigras ];

From 2211f0277c09eb412490356b1391bb3b2b26326a Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 3 Mar 2026 23:51:12 +0100
Subject: [PATCH 18/53] python312Packages.django_4: 4.2.28 -> 4.2.29

https://docs.djangoproject.com/en/4.2/releases/4.2.29/
https://www.djangoproject.com/weblog/2026/mar/03/security-releases/

Fixes: CVE-2026-25673, CVE-2026-25674
(cherry picked from commit 68f65c4875a33470a9223332fc55700358c1c6ca)
---
 pkgs/development/python-modules/django/4.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/django/4.nix b/pkgs/development/python-modules/django/4.nix
index 0688f35b9855c..598dfcfb70568 100644
--- a/pkgs/development/python-modules/django/4.nix
+++ b/pkgs/development/python-modules/django/4.nix
@@ -45,7 +45,7 @@
 
 buildPythonPackage rec {
   pname = "django";
-  version = "4.2.28";
+  version = "4.2.29";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -54,7 +54,7 @@ buildPythonPackage rec {
     owner = "django";
     repo = "django";
     tag = version;
-    hash = "sha256-dxlTonT8zFIFGFrrOW4GFKOy5b0chcESxt9i9xHO8h4=";
+    hash = "sha256-30OcLxtACSxLJ1jT+k7fmM8CyMyleXSPc+l7/3JZKzI=";
   };
 
   patches = [

From 230258cd1bef850aaf9e48d529043fee812cc5d6 Mon Sep 17 00:00:00 2001
From: winston <hey@winston.sh>
Date: Tue, 16 Sep 2025 11:27:17 +0200
Subject: [PATCH 19/53] tree-sitter: fix pkgsStatic build

(cherry picked from commit 2b9bb8c6898a4d261f2c584556d309bbe7aa4632)
---
 .../tools/parsing/tree-sitter/default.nix     | 21 +++++++++++++------
 1 file changed, 15 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/tools/parsing/tree-sitter/default.nix b/pkgs/development/tools/parsing/tree-sitter/default.nix
index 69f72f57d4e23..257872a3cb20a 100644
--- a/pkgs/development/tools/parsing/tree-sitter/default.nix
+++ b/pkgs/development/tools/parsing/tree-sitter/default.nix
@@ -193,10 +193,19 @@ rustPlatform.buildRustPackage {
     })
   ];
 
-  postPatch = lib.optionalString webUISupport ''
-    substituteInPlace cli/loader/src/lib.rs \
-        --replace-fail 'let emcc_name = if cfg!(windows) { "emcc.bat" } else { "emcc" };' 'let emcc_name = "${lib.getExe' emscripten "emcc"}";'
-  '';
+  postPatch =
+    lib.optionalString webUISupport ''
+      substituteInPlace cli/loader/src/lib.rs \
+          --replace-fail 'let emcc_name = if cfg!(windows) { "emcc.bat" } else { "emcc" };' 'let emcc_name = "${lib.getExe' emscripten "emcc"}";'
+    ''
+    # when building on static platforms:
+    # 1. remove the `libtree-sitter.$(SOEXT)` step from `all`
+    # 2. remove references to shared object files in the Makefile
+    + lib.optionalString stdenv.hostPlatform.isStatic ''
+      substituteInPlace ./Makefile \
+          --replace-fail 'all: libtree-sitter.a libtree-sitter.$(SOEXT) tree-sitter.pc' 'all: libtree-sitter.a tree-sitter.pc'
+      sed -i '/^install:/,/^[^[:space:]]/ { /$(SOEXT/d; }' ./Makefile
+    '';
 
   # Compile web assembly with emscripten. The --debug flag prevents us from
   # minifying the JavaScript; passing it allows us to side-step more Node
@@ -209,8 +218,8 @@ rustPlatform.buildRustPackage {
 
   postInstall = ''
     PREFIX=$out make install
-    ${lib.optionalString (!enableShared) "rm $out/lib/*.so{,.*}"}
-    ${lib.optionalString (!enableStatic) "rm $out/lib/*.a"}
+    ${lib.optionalString (!enableShared) "rm -f $out/lib/*.so{,.*}"}
+    ${lib.optionalString (!enableStatic) "rm -f $out/lib/*.a"}
   ''
   + lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd tree-sitter \

From c378b4dab5fcff3bf807b6c2289204040ee210d2 Mon Sep 17 00:00:00 2001
From: ajs124 <git@ajs124.de>
Date: Tue, 3 Mar 2026 14:13:41 +0100
Subject: [PATCH 20/53] tzdata: 2025c -> 2026a

https://lists.iana.org/hyperkitty/list/tz-announce@iana.org/message/ASPLBE3A4BAEXIOQ3KZ6EJSJWBU6L53G/
(cherry picked from commit 23445724788ee97a4b5465aa726aadd2735d5744)
---
 pkgs/by-name/tz/tzdata/package.nix | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/tz/tzdata/package.nix b/pkgs/by-name/tz/tzdata/package.nix
index a92873e965c44..7c03fb60b296c 100644
--- a/pkgs/by-name/tz/tzdata/package.nix
+++ b/pkgs/by-name/tz/tzdata/package.nix
@@ -8,16 +8,16 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "tzdata";
-  version = "2025c";
+  version = "2026a";
 
   srcs = [
     (fetchurl {
       url = "https://data.iana.org/time-zones/releases/tzdata${finalAttrs.version}.tar.gz";
-      hash = "sha256-SqeeTv/uU/xAKf/l9uvpeTcoLrzfOG1dLakc6EFC+Vc=";
+      hash = "sha256-d7VBclk3u1O9kr1ITAtDvshUXi00Me4B8E748iA7orc=";
     })
     (fetchurl {
       url = "https://data.iana.org/time-zones/releases/tzcode${finalAttrs.version}.tar.gz";
-      hash = "sha256-aX6+ZiVESu9QgPWOSdA0JLu1Lgi/SD0921rPEMvRV0A=";
+      hash = "sha256-+AoXou3dK1QEH5yY11sKqAOLAW18XecokqFG2ZOHQOE=";
     })
   ];
 
@@ -50,6 +50,7 @@ stdenv.mkDerivation (finalAttrs: {
     "CFLAGS+=-DZIC_BLOAT_DEFAULT=\\\"fat\\\""
     "cc=${stdenv.cc.targetPrefix}cc"
     "AR=${stdenv.cc.targetPrefix}ar"
+    "REDO=posix_right"
   ]
   ++ lib.optionals stdenv.hostPlatform.isWindows [
     "CFLAGS+=-DHAVE_DIRECT_H"

From cf14c5d715205b9c849d6d76424a152fbe6a69bf Mon Sep 17 00:00:00 2001
From: Tom Herbers <mail@tomherbers.de>
Date: Fri, 6 Mar 2026 10:28:45 +0100
Subject: [PATCH 21/53] go_1_25: 1.25.7 -> 1.25.8

Changelog: https://go.dev/doc/devel/release#go1.25.minor
(cherry picked from commit f043b3a754002757ee81167fa580ddcc3b434a31)
---
 pkgs/development/compilers/go/1.25.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/compilers/go/1.25.nix b/pkgs/development/compilers/go/1.25.nix
index 15924f0934bd5..3fdeb90035932 100644
--- a/pkgs/development/compilers/go/1.25.nix
+++ b/pkgs/development/compilers/go/1.25.nix
@@ -25,11 +25,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "go";
-  version = "1.25.7";
+  version = "1.25.8";
 
   src = fetchurl {
     url = "https://go.dev/dl/go${finalAttrs.version}.src.tar.gz";
-    hash = "sha256-F48oMoICdLQ+F30y8Go+uwEp5CfdIKXkyI3ywXY88Qo=";
+    hash = "sha256-6YjUokRqx/4/baoImljpk2pSo4E1Wt7ByJgyMKjWxZ4=";
   };
 
   strictDeps = true;

From 04037997cecb7400110bdb6c876cbf3635551cef Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 3 Mar 2026 16:55:00 +0100
Subject: [PATCH 22/53] python312: 3.12.12 -> 3.12.13

https://docs.python.org/release/3.12.13/whatsnew/changelog.html
(cherry picked from commit 5c994fe2b1e540ff83aa59ba370918ad5aae4776)
---
 pkgs/development/interpreters/python/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/interpreters/python/default.nix b/pkgs/development/interpreters/python/default.nix
index 2e3bc851f5ad0..9b617307a8bc4 100644
--- a/pkgs/development/interpreters/python/default.nix
+++ b/pkgs/development/interpreters/python/default.nix
@@ -71,10 +71,10 @@
       sourceVersion = {
         major = "3";
         minor = "12";
-        patch = "12";
+        patch = "13";
         suffix = "";
       };
-      hash = "sha256-+4WhNBSwKMSboYu9UjwtBVowtWsYuSzkVOosUe3GVsQ=";
+      hash = "sha256-wIvGWoGXHB3VeDGCgmUDNpRmx+ZzdNFkZRmt8FIHtoQ=";
       inherit passthruFun;
     };
 

From b96b24b501d17a0637bb04206094794da956932d Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 3 Mar 2026 17:05:55 +0100
Subject: [PATCH 23/53] python311: 3.11.14 -> 3.11.15

https://docs.python.org/release/3.11.15/whatsnew/changelog.html
(cherry picked from commit f751ae3d2531bc9243b0f4cabe424b924d4b74cd)
---
 pkgs/development/interpreters/python/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/interpreters/python/default.nix b/pkgs/development/interpreters/python/default.nix
index 9b617307a8bc4..03d0f32da0f9d 100644
--- a/pkgs/development/interpreters/python/default.nix
+++ b/pkgs/development/interpreters/python/default.nix
@@ -59,10 +59,10 @@
       sourceVersion = {
         major = "3";
         minor = "11";
-        patch = "14";
+        patch = "15";
         suffix = "";
       };
-      hash = "sha256-jT7Y7FyIwclfXlWGEqclRQ0kUoE92tXlj9saU7Egm3g=";
+      hash = "sha256-JyF53dmi5BoPyOQuM9+9ygs3EapavzctPy1RVD0JtiU=";
       inherit passthruFun;
     };
 

From ef6662f6d0d5e5de572fed042dfcc8291020cfa5 Mon Sep 17 00:00:00 2001
From: Antoine du Hamel <duhamelantoine1995@gmail.com>
Date: Fri, 6 Mar 2026 23:49:02 +0100
Subject: [PATCH 24/53] nodejs_22: 22.22.0 -> 22.22.1

(cherry picked from commit 6361bf7e42f246c81f303c663b2f1d555eaba0f0)
---
 pkgs/development/web/nodejs/v22.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/web/nodejs/v22.nix b/pkgs/development/web/nodejs/v22.nix
index cfc4f014fa1df..5ea3155a048f7 100644
--- a/pkgs/development/web/nodejs/v22.nix
+++ b/pkgs/development/web/nodejs/v22.nix
@@ -23,8 +23,8 @@ let
 in
 buildNodejs {
   inherit enableNpm;
-  version = "22.22.0";
-  sha256 = "4c138012bb5352f49822a8f3e6d1db71e00639d0c36d5b6756f91e4c6f30b683";
+  version = "22.22.1";
+  sha256 = "87104b07e7acee748bcc5391e1bc69cf3571caa0fdfb8b1d6b5fd3f9599b7849";
   patches =
     (
       if (stdenv.hostPlatform.emulatorAvailable buildPackages) then

From 4605c531e5183a470664b5c200fc7e679d7cf8f9 Mon Sep 17 00:00:00 2001
From: Moinak Bhattacharyya <moinakb001@gmail.com>
Date: Sat, 27 Sep 2025 21:37:21 -0500
Subject: [PATCH 25/53] python3Packages.pytest-xdist: Disable
 test_workqueue_ordered_by_input Test fails consistently when building for
 znver5. So, disable it for now.

(cherry picked from commit 0787680945b55a7d1ba2b62b9eea207d18ecde9b)
---
 pkgs/development/python-modules/pytest-xdist/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/python-modules/pytest-xdist/default.nix b/pkgs/development/python-modules/pytest-xdist/default.nix
index 55fcd3b061620..39826f6418c5e 100644
--- a/pkgs/development/python-modules/pytest-xdist/default.nix
+++ b/pkgs/development/python-modules/pytest-xdist/default.nix
@@ -60,6 +60,8 @@ buildPythonPackage rec {
     "test_internal_errors_propagate_to_controller"
     # https://github.com/pytest-dev/pytest-xdist/issues/985
     "test_workqueue_ordered_by_size"
+    # https://github.com/pytest-dev/pytest-xdist/issues/1248
+    "test_workqueue_ordered_by_input"
   ];
 
   setupHook = ./setup-hook.sh;

From 347a244a2199d4f8a1299c1446a4e6394f6d5edb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Wed, 11 Mar 2026 10:00:05 -0700
Subject: [PATCH 26/53] imagemagick: 7.1.2-15 -> 7.1.2-16

Diff: https://github.com/ImageMagick/ImageMagick/compare/7.1.2-15...7.1.2-16

Changelog: https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
(cherry picked from commit f20a5011e3659f52dcdcab832aaa06e47efb2980)
---
 pkgs/applications/graphics/ImageMagick/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/graphics/ImageMagick/default.nix b/pkgs/applications/graphics/ImageMagick/default.nix
index bb2ccf78ef381..b447732cc038e 100644
--- a/pkgs/applications/graphics/ImageMagick/default.nix
+++ b/pkgs/applications/graphics/ImageMagick/default.nix
@@ -85,13 +85,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "imagemagick";
-  version = "7.1.2-15";
+  version = "7.1.2-16";
 
   src = fetchFromGitHub {
     owner = "ImageMagick";
     repo = "ImageMagick";
     tag = finalAttrs.version;
-    hash = "sha256-qL7CYq+aGCB3ZLgIcSBy2Dw69g0F68xGXxrE7xJhdNc=";
+    hash = "sha256-tuCJgns/ecbRbN0OwAZt3E65usA0ZyNLkIey4eQfzOg=";
   };
 
   outputs = [

From c3e934e8328edf607e765f4d45e9d40055a7143d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Wed, 11 Mar 2026 10:11:20 -0700
Subject: [PATCH 27/53] python3Packages.wand: 0.6.13 -> 0.7.0

Diff: https://github.com/emcconville/wand/compare/0.6.13...0.7.0

Changelog: https://docs.wand-py.org/en/0.7.0/changes.html
(cherry picked from commit e311cb5e69e453a7caf57c389bfcd66cdc165ada)
---
 .../python-modules/wand/default.nix           | 31 ++++++++-----------
 1 file changed, 13 insertions(+), 18 deletions(-)

diff --git a/pkgs/development/python-modules/wand/default.nix b/pkgs/development/python-modules/wand/default.nix
index a55258f573b82..8a4f89a2055ad 100644
--- a/pkgs/development/python-modules/wand/default.nix
+++ b/pkgs/development/python-modules/wand/default.nix
@@ -2,42 +2,37 @@
   stdenv,
   lib,
   buildPythonPackage,
-  fetchPypi,
+  fetchFromGitHub,
   imagemagickBig,
-  py,
   pytestCheckHook,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "wand";
-  version = "0.6.13";
-  format = "setuptools";
+  version = "0.7.0";
+  pyproject = true;
 
-  src = fetchPypi {
-    pname = "Wand";
-    inherit version;
-    hash = "sha256-9QE0hOr3og6yLRghqu/mC1DMMpciNytfhWXUbUqq/Mo=";
+  src = fetchFromGitHub {
+    owner = "emcconville";
+    repo = "wand";
+    tag = version;
+    hash = "sha256-U4qxtOC72YSgo74OZdFmMG8W2s4wFI0ohJ7uJ4caabA=";
   };
 
   postPatch = ''
-    substituteInPlace wand/api.py --replace \
+    substituteInPlace wand/api.py --replace-fail \
       "magick_home = os.environ.get('MAGICK_HOME')" \
       "magick_home = '${imagemagickBig}'"
   '';
 
+  build-system = [ setuptools ];
+
   nativeCheckInputs = [
-    py
     pytestCheckHook
   ];
 
-  disabledTests = [
-    # https://github.com/emcconville/wand/issues/558
-    "test_forward_fourier_transform"
-    "test_inverse_fourier_transform"
-    # our imagemagick doesn't set MagickReleaseDate
-    "test_configure_options"
-  ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+  disabledTests = lib.optionals stdenv.hostPlatform.isDarwin [
     # AssertionError: assert wand.color.Color('srgb(255,0,1.41553e-14)') == wand.color.Color('srgb(255,0,0)')
     "test_sparse_color"
   ];

From 96f4b186d2a0b18ccd82236905434ec9b1fcc256 Mon Sep 17 00:00:00 2001
From: "Adam C. Stephens" <adam@valkor.net>
Date: Thu, 12 Mar 2026 09:25:04 -0400
Subject: [PATCH 28/53] mimir: 3.0.3 -> 3.0.4

Changelog: https://github.com/grafana/mimir/releases/tag/mimir-3.0.4
(cherry picked from commit 0ba0cecafb92a1723864566d148fcc4137a659da)
---
 pkgs/by-name/mi/mimir/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/mi/mimir/package.nix b/pkgs/by-name/mi/mimir/package.nix
index 739d2c1a9a6a0..55267f83054f1 100644
--- a/pkgs/by-name/mi/mimir/package.nix
+++ b/pkgs/by-name/mi/mimir/package.nix
@@ -7,13 +7,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "mimir";
-  version = "3.0.3";
+  version = "3.0.4";
 
   src = fetchFromGitHub {
     rev = "mimir-${finalAttrs.version}";
     owner = "grafana";
     repo = "mimir";
-    hash = "sha256-OUFmtHGGDU1+7EwfGVzrjPS2hqba0FfIuQl0V7up9Yk=";
+    hash = "sha256-AVH2hY9BhQ6R8WCw6DcdkUSBzm5cTWyBL1pbqnRMVdE=";
   };
 
   vendorHash = null;

From 048e392218bc103e05e381d46cc08d2552bc2736 Mon Sep 17 00:00:00 2001
From: Jhony Elmer Angulo Fabian <leohjaf@gmail.com>
Date: Wed, 4 Feb 2026 11:55:23 -0500
Subject: [PATCH 29/53] rustPlatform.fetchCargoVendor: make manifest discovery
 deterministic

Sort Cargo.toml paths by depth/name for traversal.
Skip manifests where cargo metadata fails to avoid aborting on
invalid or unsupported example crates.
Fix mainfest/manifest typo in helper name.

(cherry picked from commit 804f0b0f7cd2977e675e3e472375b5882d2e954a)
---
 .../rust/fetch-cargo-vendor-util.py            | 18 +++++++++++++-----
 1 file changed, 13 insertions(+), 5 deletions(-)

diff --git a/pkgs/build-support/rust/fetch-cargo-vendor-util.py b/pkgs/build-support/rust/fetch-cargo-vendor-util.py
index 183b587c42170..eed3675f3186e 100644
--- a/pkgs/build-support/rust/fetch-cargo-vendor-util.py
+++ b/pkgs/build-support/rust/fetch-cargo-vendor-util.py
@@ -172,8 +172,12 @@ def get_manifest_metadata(manifest_path: Path) -> dict[str, Any]:
     return json.loads(output)
 
 
-def try_get_crate_manifest_path_from_mainfest_path(manifest_path: Path, crate_name: str) -> Path | None:
-    metadata = get_manifest_metadata(manifest_path)
+def try_get_crate_manifest_path_from_manifest_path(manifest_path: Path, crate_name: str) -> Path | None:
+    try:
+        metadata = get_manifest_metadata(manifest_path)
+    except subprocess.CalledProcessError:
+        eprint(f"Warning: cargo metadata failed for {manifest_path}, skipping")
+        return None
 
     for pkg in metadata["packages"]:
         if pkg["name"] == crate_name:
@@ -183,11 +187,15 @@ def try_get_crate_manifest_path_from_mainfest_path(manifest_path: Path, crate_na
 
 
 def find_crate_manifest_in_tree(tree: Path, crate_name: str) -> Path:
-    # in some cases Cargo.toml is not located at the top level, so we also look at subdirectories
-    manifest_paths = tree.glob("**/Cargo.toml")
+    # Scan all Cargo.toml files; sort by depth/path to make ordering deterministic
+    # and prefer less-nested manifests first.
+    manifest_paths = sorted(
+        tree.glob("**/Cargo.toml"),
+        key=lambda path: (len(path.parts), str(path)),
+    )
 
     for manifest_path in manifest_paths:
-        res = try_get_crate_manifest_path_from_mainfest_path(manifest_path, crate_name)
+        res = try_get_crate_manifest_path_from_manifest_path(manifest_path, crate_name)
         if res is not None:
             return res
 

From ac9e21ddbe67dc408ffd613c51b29e21926d515b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 15 Mar 2026 10:31:48 -0700
Subject: [PATCH 30/53] python3Packages.multipart: 1.3.0 -> 1.3.1

Diff: https://github.com/defnull/multipart/compare/v1.3.0...v1.3.1

Changelog: https://github.com/defnull/multipart/releases/tag/v1.3.1
(cherry picked from commit c8834c10905e49cf28b70d245ccb15284bbc12dd)
---
 pkgs/development/python-modules/multipart/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/multipart/default.nix b/pkgs/development/python-modules/multipart/default.nix
index 4eb143a42c578..1d02c7d6a0c3f 100644
--- a/pkgs/development/python-modules/multipart/default.nix
+++ b/pkgs/development/python-modules/multipart/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "multipart";
-  version = "1.3.0";
+  version = "1.3.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "defnull";
     repo = "multipart";
     tag = "v${version}";
-    hash = "sha256-6vlyoi4nayZOKyfO4jbKNzUy7G6K7mySYzkqfp+45O4=";
+    hash = "sha256-kLiOK6ovW3ki1CONXVQZCJw/U3K1AoR6rrmJUstwZOw=";
   };
 
   build-system = [ flit-core ];

From 4378a7588e2eb1a08714fcb2c6888afffd6ab82f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Mon, 16 Mar 2026 20:53:22 -0700
Subject: [PATCH 31/53] imagemagick: 7.1.2-16 -> 7.1.2-17

Diff: https://github.com/ImageMagick/ImageMagick/compare/7.1.2-16...7.1.2-17

Changelog: https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
(cherry picked from commit 273bca2481ffca5973e66dc168ca272de6e0b074)
---
 pkgs/applications/graphics/ImageMagick/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/graphics/ImageMagick/default.nix b/pkgs/applications/graphics/ImageMagick/default.nix
index b447732cc038e..68d0fb7190b33 100644
--- a/pkgs/applications/graphics/ImageMagick/default.nix
+++ b/pkgs/applications/graphics/ImageMagick/default.nix
@@ -85,13 +85,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "imagemagick";
-  version = "7.1.2-16";
+  version = "7.1.2-17";
 
   src = fetchFromGitHub {
     owner = "ImageMagick";
     repo = "ImageMagick";
     tag = finalAttrs.version;
-    hash = "sha256-tuCJgns/ecbRbN0OwAZt3E65usA0ZyNLkIey4eQfzOg=";
+    hash = "sha256-niqHdNrFMwIr+9560vceRn0LyJPi6DIp6qCn5GlcVjY=";
   };
 
   outputs = [

From e748421607668f9078f8ce74824bafe006a28c67 Mon Sep 17 00:00:00 2001
From: Sarah Clark <seclark@nextquestion.net>
Date: Sun, 15 Mar 2026 13:43:32 -0700
Subject: [PATCH 32/53] cairosvg: 2.8.2 -> 2.9.0

Fixes https://nvd.nist.gov/vuln/detail/CVE-2026-31899

(cherry picked from commit b07f64381c1adcea7945bbfcc289a0adf6f533d1)
---
 pkgs/development/python-modules/cairosvg/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/cairosvg/default.nix b/pkgs/development/python-modules/cairosvg/default.nix
index 509f6b18256f9..7daab37c42a46 100644
--- a/pkgs/development/python-modules/cairosvg/default.nix
+++ b/pkgs/development/python-modules/cairosvg/default.nix
@@ -19,14 +19,14 @@
 
 buildPythonPackage rec {
   pname = "cairosvg";
-  version = "2.8.2";
+  version = "2.9.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Kozea";
     repo = "CairoSVG";
     tag = version;
-    hash = "sha256-KWUZA8pcHMnDEkAYZt3zDzPNynhGBuLZuagNPfHF8EA=";
+    hash = "sha256-WtMFOYaN/cRrL1Q4ma/UkR3kNFObNhp0Gm7i9NQAqz8=";
   };
 
   build-system = [ setuptools ];

From e05384f41f668b041e4f9fd691361b117d8dac72 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Tue, 9 Dec 2025 21:29:06 +0300
Subject: [PATCH 33/53] qt6.qtdeclarative: cherry-pick patch to fix random
 Plasma crashes

(cherry picked from commit 8ae30516b638d364cbc121fe307e841a9f22f737)
---
 .../libraries/qt-6/modules/qtdeclarative/default.nix      | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/pkgs/development/libraries/qt-6/modules/qtdeclarative/default.nix b/pkgs/development/libraries/qt-6/modules/qtdeclarative/default.nix
index 58271c82c9bad..9579af8c34995 100644
--- a/pkgs/development/libraries/qt-6/modules/qtdeclarative/default.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtdeclarative/default.nix
@@ -10,6 +10,7 @@
   lib,
   pkgsBuildBuild,
   replaceVars,
+  fetchpatch,
 }:
 
 qtModule {
@@ -35,6 +36,13 @@ qtModule {
     })
     # add version specific QML import path
     ./use-versioned-import-path.patch
+
+    # fix common Plasma crasher
+    # FIXME: remove in 6.10.2
+    (fetchpatch {
+      url = "https://github.com/qt/qtdeclarative/commit/9c6b2b78e9076f1c2676aa0c41573db9ca480654.diff";
+      hash = "sha256-KMFurA9Q84qwuyBraU3ZdoFWs8uO3uoUcinfcfh/ps8=";
+    })
   ];
 
   cmakeFlags = [

From 65b5b535105a5f8cadcc943e1b59b87af957d5e8 Mon Sep 17 00:00:00 2001
From: Arnout Engelen <arnout@bzzt.net>
Date: Fri, 12 Dec 2025 12:12:57 +0100
Subject: [PATCH 34/53] qt6.qtdeclarative: cherry-pick r-b fixes

Already merged upstream, but 6.10.2 is some way off still.

Should fix #384761

(cherry picked from commit a1051077e6468fe0b35bdedd277efe3d4c484ba1)
---
 .../libraries/qt-6/modules/qtdeclarative/default.nix | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/pkgs/development/libraries/qt-6/modules/qtdeclarative/default.nix b/pkgs/development/libraries/qt-6/modules/qtdeclarative/default.nix
index 9579af8c34995..07f95c2290280 100644
--- a/pkgs/development/libraries/qt-6/modules/qtdeclarative/default.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtdeclarative/default.nix
@@ -43,6 +43,18 @@ qtModule {
       url = "https://github.com/qt/qtdeclarative/commit/9c6b2b78e9076f1c2676aa0c41573db9ca480654.diff";
       hash = "sha256-KMFurA9Q84qwuyBraU3ZdoFWs8uO3uoUcinfcfh/ps8=";
     })
+
+    # https://qt-project.atlassian.net/browse/QTBUG-137440
+    (fetchpatch {
+      name = "rb-dialogs-link-labsfolderlistmodel-into-quickdialogs2quickimpl.patch";
+      url = "https://github.com/qt/qtdeclarative/commit/4047fa8c6017d8e214e6ec3ddbed622fd34058e4.patch";
+      hash = "sha256-0a7a1AI8N35rqLY4M3aSruXXPBqz9hX2yT65r/xzfhc=";
+    })
+    (fetchpatch {
+      name = "rb-quickcontrols-fix-controls-styles-linkage.patch";
+      url = "https://github.com/qt/qtdeclarative/commit/aa805ed54d55479360e0e95964dcc09a858aeb28.patch";
+      hash = "sha256-EDdsXRokHPQ5jflaVucOZP3WSopMjrAM39WZD1Hk/5I=";
+    })
   ];
 
   cmakeFlags = [

From 4a1540a09b962093399a6a9fd3e7cd16904ec9ec Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Tue, 13 Jan 2026 23:17:11 +0300
Subject: [PATCH 35/53] qt6.qtdeclarative: backport another common Plasma crash
 fix

(cherry picked from commit 453809552c67fa1c7bd997f82090ec6e1281dd34)
---
 .../qtdeclarative/another-crash-fix.patch        | 16 ++++++++++++++++
 .../qt-6/modules/qtdeclarative/default.nix       |  5 +++++
 2 files changed, 21 insertions(+)
 create mode 100644 pkgs/development/libraries/qt-6/modules/qtdeclarative/another-crash-fix.patch

diff --git a/pkgs/development/libraries/qt-6/modules/qtdeclarative/another-crash-fix.patch b/pkgs/development/libraries/qt-6/modules/qtdeclarative/another-crash-fix.patch
new file mode 100644
index 0000000000000..e63a70c53708f
--- /dev/null
+++ b/pkgs/development/libraries/qt-6/modules/qtdeclarative/another-crash-fix.patch
@@ -0,0 +1,16 @@
+--- a/src/qml/jsruntime/qv4qobjectwrapper.cpp
++++ b/src/qml/jsruntime/qv4qobjectwrapper.cpp
+@@ -1583,10 +1583,9 @@
+                     o->deleteLater();
+             } else {
+                 // If the object is C++-owned, we still have to release the weak reference we have
+-                // to it.
+-                ddata->jsWrapper.clear();
+-                if (lastCall && ddata->propertyCache)
+-                    ddata->propertyCache.reset();
++                // to it. If the "main" wrapper is not ours, we should leave it alone, though.
++                if (ddata->jsWrapper.as<QObjectWrapper>() == this)
++                    ddata->jsWrapper.clear();
+             }
+         }
+     }
diff --git a/pkgs/development/libraries/qt-6/modules/qtdeclarative/default.nix b/pkgs/development/libraries/qt-6/modules/qtdeclarative/default.nix
index 07f95c2290280..d78544b8dc8d5 100644
--- a/pkgs/development/libraries/qt-6/modules/qtdeclarative/default.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtdeclarative/default.nix
@@ -44,6 +44,11 @@ qtModule {
       hash = "sha256-KMFurA9Q84qwuyBraU3ZdoFWs8uO3uoUcinfcfh/ps8=";
     })
 
+    # Backport of https://codereview.qt-project.org/c/qt/qtdeclarative/+/704031
+    # Fixes common Plasma crash
+    # FIXME: remove in 6.10.3
+    ./another-crash-fix.patch
+
     # https://qt-project.atlassian.net/browse/QTBUG-137440
     (fetchpatch {
       name = "rb-dialogs-link-labsfolderlistmodel-into-quickdialogs2quickimpl.patch";

From ab196db1cc1f562f2d2232efbd90ba2ed8aeb0f0 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Tue, 3 Feb 2026 11:47:05 +0300
Subject: [PATCH 36/53] qt6: 6.10.1 -> 6.10.2

(cherry picked from commit 71adc1a57a674cabe20efde013cb2f4b78e041be)
---
 pkgs/development/libraries/qt-6/fetch.sh      |   2 +-
 .../qt-6/modules/qtbase/no-sbom.patch         |  16 +-
 .../qt-6/modules/qtdeclarative/default.nix    |  20 --
 .../libraries/qt-6/modules/qtmqtt.nix         |   4 +-
 pkgs/development/libraries/qt-6/srcs.nix      | 312 +++++++++---------
 5 files changed, 167 insertions(+), 187 deletions(-)

diff --git a/pkgs/development/libraries/qt-6/fetch.sh b/pkgs/development/libraries/qt-6/fetch.sh
index 06f618c231791..7e4781e5114ea 100644
--- a/pkgs/development/libraries/qt-6/fetch.sh
+++ b/pkgs/development/libraries/qt-6/fetch.sh
@@ -1 +1 @@
-WGET_ARGS=( https://download.qt.io/official_releases/qt/6.10/6.10.1/submodules/ -A '*.tar.xz' )
+WGET_ARGS=( https://download.qt.io/official_releases/qt/6.10/6.10.2/submodules/ -A '*.tar.xz' )
diff --git a/pkgs/development/libraries/qt-6/modules/qtbase/no-sbom.patch b/pkgs/development/libraries/qt-6/modules/qtbase/no-sbom.patch
index d26bf4267c138..bed920da611ff 100644
--- a/pkgs/development/libraries/qt-6/modules/qtbase/no-sbom.patch
+++ b/pkgs/development/libraries/qt-6/modules/qtbase/no-sbom.patch
@@ -1,13 +1,13 @@
 diff --git a/cmake/QtPublicSbomHelpers.cmake b/cmake/QtPublicSbomHelpers.cmake
-index 3767fb4ff26..b642ea3e4b6 100644
+index 45342c2efb6..74bf58e6246 100644
 --- a/cmake/QtPublicSbomHelpers.cmake
 +++ b/cmake/QtPublicSbomHelpers.cmake
-@@ -369,7 +369,7 @@ function(_qt_internal_setup_sbom)
-     endif()
+@@ -538,7 +538,7 @@ function(_qt_internal_setup_sbom)
+     # Main SBOM toggle. Used to be the toggle for SPDX v2.3 only, but now would also enable Cyclone
+     # DX as well.
+     set(sbom_help_string "Generate SBOM.")
+-    option(QT_GENERATE_SBOM "${sbom_help_string}" "${default_value}")
++    option(QT_GENERATE_SBOM "${sbom_help_string}" OFF)
  
-     option(QT_GENERATE_SBOM "Generate SBOM documents in SPDX v2.3 tag:value format."
--        "${default_value}")
-+        OFF)
  
-     string(CONCAT help_string
-         "Generate SBOM documents in SPDX v2.3 JSON format if required python dependency "
+     # Toggle for SPDX V2.3 generation.
diff --git a/pkgs/development/libraries/qt-6/modules/qtdeclarative/default.nix b/pkgs/development/libraries/qt-6/modules/qtdeclarative/default.nix
index d78544b8dc8d5..972a8f3721702 100644
--- a/pkgs/development/libraries/qt-6/modules/qtdeclarative/default.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtdeclarative/default.nix
@@ -10,7 +10,6 @@
   lib,
   pkgsBuildBuild,
   replaceVars,
-  fetchpatch,
 }:
 
 qtModule {
@@ -37,29 +36,10 @@ qtModule {
     # add version specific QML import path
     ./use-versioned-import-path.patch
 
-    # fix common Plasma crasher
-    # FIXME: remove in 6.10.2
-    (fetchpatch {
-      url = "https://github.com/qt/qtdeclarative/commit/9c6b2b78e9076f1c2676aa0c41573db9ca480654.diff";
-      hash = "sha256-KMFurA9Q84qwuyBraU3ZdoFWs8uO3uoUcinfcfh/ps8=";
-    })
-
     # Backport of https://codereview.qt-project.org/c/qt/qtdeclarative/+/704031
     # Fixes common Plasma crash
     # FIXME: remove in 6.10.3
     ./another-crash-fix.patch
-
-    # https://qt-project.atlassian.net/browse/QTBUG-137440
-    (fetchpatch {
-      name = "rb-dialogs-link-labsfolderlistmodel-into-quickdialogs2quickimpl.patch";
-      url = "https://github.com/qt/qtdeclarative/commit/4047fa8c6017d8e214e6ec3ddbed622fd34058e4.patch";
-      hash = "sha256-0a7a1AI8N35rqLY4M3aSruXXPBqz9hX2yT65r/xzfhc=";
-    })
-    (fetchpatch {
-      name = "rb-quickcontrols-fix-controls-styles-linkage.patch";
-      url = "https://github.com/qt/qtdeclarative/commit/aa805ed54d55479360e0e95964dcc09a858aeb28.patch";
-      hash = "sha256-EDdsXRokHPQ5jflaVucOZP3WSopMjrAM39WZD1Hk/5I=";
-    })
   ];
 
   cmakeFlags = [
diff --git a/pkgs/development/libraries/qt-6/modules/qtmqtt.nix b/pkgs/development/libraries/qt-6/modules/qtmqtt.nix
index e2f1b86f12b08..ea00d966e8a39 100644
--- a/pkgs/development/libraries/qt-6/modules/qtmqtt.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtmqtt.nix
@@ -6,13 +6,13 @@
 
 qtModule rec {
   pname = "qtmqtt";
-  version = "6.10.1";
+  version = "6.10.2";
 
   src = fetchFromGitHub {
     owner = "qt";
     repo = "qtmqtt";
     tag = "v${version}";
-    hash = "sha256-ve9fyhUZFI6TAr/SFRXJudA1yTmTlg8+Fgyc9OUv3ds=";
+    hash = "sha256-NjYvL6BCn0UP7F2CW81upzZ8EwFAkhoUa5cdaH0uhM4=";
   };
 
   propagatedBuildInputs = [ qtbase ];
diff --git a/pkgs/development/libraries/qt-6/srcs.nix b/pkgs/development/libraries/qt-6/srcs.nix
index 38ac43ed4c396..585e16fb01486 100644
--- a/pkgs/development/libraries/qt-6/srcs.nix
+++ b/pkgs/development/libraries/qt-6/srcs.nix
@@ -4,315 +4,315 @@
 
 {
   qt3d = {
-    version = "6.10.1";
+    version = "6.10.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.10/6.10.1/submodules/qt3d-everywhere-src-6.10.1.tar.xz";
-      sha256 = "16lw0gpjcaf90iqnff95hxw3hng42c8hzknxczf4h7kv9zakynb0";
-      name = "qt3d-everywhere-src-6.10.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.2/submodules/qt3d-everywhere-src-6.10.2.tar.xz";
+      sha256 = "0vdvid42m9jyhmpclfgpc7j1ivxlj0jr23kp5pxa1v0z96fwmfzy";
+      name = "qt3d-everywhere-src-6.10.2.tar.xz";
     };
   };
   qt5compat = {
-    version = "6.10.1";
+    version = "6.10.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.10/6.10.1/submodules/qt5compat-everywhere-src-6.10.1.tar.xz";
-      sha256 = "097yvzmfz9w5xsrr3dxd2gv4q826mplwmw0wnh0ywg8m18b6sfbj";
-      name = "qt5compat-everywhere-src-6.10.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.2/submodules/qt5compat-everywhere-src-6.10.2.tar.xz";
+      sha256 = "1hk18428bpp60ypjzabzpc77nr10bzignqppqppvjbn0zbq1i91z";
+      name = "qt5compat-everywhere-src-6.10.2.tar.xz";
     };
   };
   qtactiveqt = {
-    version = "6.10.1";
+    version = "6.10.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.10/6.10.1/submodules/qtactiveqt-everywhere-src-6.10.1.tar.xz";
-      sha256 = "078bnj8a1faln3dibx14wxdsic5s94m00x73zwncfzx7ywczcr05";
-      name = "qtactiveqt-everywhere-src-6.10.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.2/submodules/qtactiveqt-everywhere-src-6.10.2.tar.xz";
+      sha256 = "09swk8xv93gmk67v6zccxr3hjy4404q0awljfjlapas9xi10bnym";
+      name = "qtactiveqt-everywhere-src-6.10.2.tar.xz";
     };
   };
   qtbase = {
-    version = "6.10.1";
+    version = "6.10.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.10/6.10.1/submodules/qtbase-everywhere-src-6.10.1.tar.xz";
-      sha256 = "0p96bnkgfb9s5aw6qkfcy1y49xgkafx1w4i36bf1zd9xwbvjcqjs";
-      name = "qtbase-everywhere-src-6.10.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.2/submodules/qtbase-everywhere-src-6.10.2.tar.xz";
+      sha256 = "07pjmnwmlsbxc9zxgcazq9w4jnq6ypw50ndm7kamyaqs54lqvdxf";
+      name = "qtbase-everywhere-src-6.10.2.tar.xz";
     };
   };
   qtcharts = {
-    version = "6.10.1";
+    version = "6.10.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.10/6.10.1/submodules/qtcharts-everywhere-src-6.10.1.tar.xz";
-      sha256 = "1x1adsv3nnx44y9ldfjrz4nlhacxalsixdklxypqzyvw05w2568p";
-      name = "qtcharts-everywhere-src-6.10.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.2/submodules/qtcharts-everywhere-src-6.10.2.tar.xz";
+      sha256 = "001ckwq5w5w164cz2hkkb2dvci1d77mm9hf4hha9ivgdqns1cla0";
+      name = "qtcharts-everywhere-src-6.10.2.tar.xz";
     };
   };
   qtconnectivity = {
-    version = "6.10.1";
+    version = "6.10.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.10/6.10.1/submodules/qtconnectivity-everywhere-src-6.10.1.tar.xz";
-      sha256 = "1zsl46nbacpkvgma9si39p8k7qhqq3cdwnfw7pij0f67j0xgvbkv";
-      name = "qtconnectivity-everywhere-src-6.10.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.2/submodules/qtconnectivity-everywhere-src-6.10.2.tar.xz";
+      sha256 = "0chs66537ki0yvq94m2i3k69wf8kyr741m4wg6vbamr8ychz0n6g";
+      name = "qtconnectivity-everywhere-src-6.10.2.tar.xz";
     };
   };
   qtdatavis3d = {
-    version = "6.10.1";
+    version = "6.10.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.10/6.10.1/submodules/qtdatavis3d-everywhere-src-6.10.1.tar.xz";
-      sha256 = "01xva2m5x71avdqzp48zlq57l8v7kishzg75iwjjbrbazpx7q730";
-      name = "qtdatavis3d-everywhere-src-6.10.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.2/submodules/qtdatavis3d-everywhere-src-6.10.2.tar.xz";
+      sha256 = "1hav6ncccdhw2kyx608xhchpmygx6sbfap8x6ch35l53yj5l0sdp";
+      name = "qtdatavis3d-everywhere-src-6.10.2.tar.xz";
     };
   };
   qtdeclarative = {
-    version = "6.10.1";
+    version = "6.10.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.10/6.10.1/submodules/qtdeclarative-everywhere-src-6.10.1.tar.xz";
-      sha256 = "0gl4akd7p0g6sf0y234lwkxvr16njjbxc19maj465fg0jjwfzd2g";
-      name = "qtdeclarative-everywhere-src-6.10.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.2/submodules/qtdeclarative-everywhere-src-6.10.2.tar.xz";
+      sha256 = "03sb1wfxqvy5dhyd85yc0776vvm2jzczlpwbvzqdpp3cyr7r2jd2";
+      name = "qtdeclarative-everywhere-src-6.10.2.tar.xz";
     };
   };
   qtdoc = {
-    version = "6.10.1";
+    version = "6.10.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.10/6.10.1/submodules/qtdoc-everywhere-src-6.10.1.tar.xz";
-      sha256 = "16h90yp34yn17z56y570yldl287glfasq4ayci7sk09jpd5n39h3";
-      name = "qtdoc-everywhere-src-6.10.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.2/submodules/qtdoc-everywhere-src-6.10.2.tar.xz";
+      sha256 = "011pp0nf019dg790vhr9i3xiy6vspzjpr8w8xd9cpyk723nsj54c";
+      name = "qtdoc-everywhere-src-6.10.2.tar.xz";
     };
   };
   qtgraphs = {
-    version = "6.10.1";
+    version = "6.10.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.10/6.10.1/submodules/qtgraphs-everywhere-src-6.10.1.tar.xz";
-      sha256 = "0vjpbv7ck5p8z38j9a70a6kgsjvfx432lvh5slmbgim33yra0ksd";
-      name = "qtgraphs-everywhere-src-6.10.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.2/submodules/qtgraphs-everywhere-src-6.10.2.tar.xz";
+      sha256 = "1bvsvmwf4csl63fqf4gdqb03s97b9dl0sdyffrp9mn37lmmgr47n";
+      name = "qtgraphs-everywhere-src-6.10.2.tar.xz";
     };
   };
   qtgrpc = {
-    version = "6.10.1";
+    version = "6.10.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.10/6.10.1/submodules/qtgrpc-everywhere-src-6.10.1.tar.xz";
-      sha256 = "0zspyhlhl4irwrr4vm4pg3mppyybyw0q76zlgvpj4j9wcfw8y4wq";
-      name = "qtgrpc-everywhere-src-6.10.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.2/submodules/qtgrpc-everywhere-src-6.10.2.tar.xz";
+      sha256 = "0dnibqlsnra4kwk1dng4g6rrndszx5kz1p12zzjj0y8cq74vz1kk";
+      name = "qtgrpc-everywhere-src-6.10.2.tar.xz";
     };
   };
   qthttpserver = {
-    version = "6.10.1";
+    version = "6.10.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.10/6.10.1/submodules/qthttpserver-everywhere-src-6.10.1.tar.xz";
-      sha256 = "0fz98hczfkkrhjmkwxi7159zpal4wvv5sb2y8pid9d2bsfb8sv52";
-      name = "qthttpserver-everywhere-src-6.10.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.2/submodules/qthttpserver-everywhere-src-6.10.2.tar.xz";
+      sha256 = "0hs6zq1qfs4yfr9bf2d089q37wcyhgvx48vq54szsn72prcqsmi6";
+      name = "qthttpserver-everywhere-src-6.10.2.tar.xz";
     };
   };
   qtimageformats = {
-    version = "6.10.1";
+    version = "6.10.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.10/6.10.1/submodules/qtimageformats-everywhere-src-6.10.1.tar.xz";
-      sha256 = "0wksip3a9xszlkq6368fdkz60qszfqy3wawl13w9dnw14ggsp3j9";
-      name = "qtimageformats-everywhere-src-6.10.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.2/submodules/qtimageformats-everywhere-src-6.10.2.tar.xz";
+      sha256 = "0rwxcdpzx5mls7sqvscq58hb2h01j4qpy3h07ixiw21qhrqrr3wb";
+      name = "qtimageformats-everywhere-src-6.10.2.tar.xz";
     };
   };
   qtlanguageserver = {
-    version = "6.10.1";
+    version = "6.10.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.10/6.10.1/submodules/qtlanguageserver-everywhere-src-6.10.1.tar.xz";
-      sha256 = "0v2m18bbm82n9lhb0lxabqnsabfh2nga8a8yndrncmad9xmm4q1k";
-      name = "qtlanguageserver-everywhere-src-6.10.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.2/submodules/qtlanguageserver-everywhere-src-6.10.2.tar.xz";
+      sha256 = "0lqdqknblw4nsv1mgi5jw6rqsf7h9zf59af7bw371d5hhhn3y14s";
+      name = "qtlanguageserver-everywhere-src-6.10.2.tar.xz";
     };
   };
   qtlocation = {
-    version = "6.10.1";
+    version = "6.10.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.10/6.10.1/submodules/qtlocation-everywhere-src-6.10.1.tar.xz";
-      sha256 = "02agg502pkdqgl3156al26bn4ascgyjz6ybsd7b53p4wp7qii5ib";
-      name = "qtlocation-everywhere-src-6.10.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.2/submodules/qtlocation-everywhere-src-6.10.2.tar.xz";
+      sha256 = "0g0gwldmdslzx0zjdpi3vc0pqnd266qkxynh8xy534y5xmfz04yk";
+      name = "qtlocation-everywhere-src-6.10.2.tar.xz";
     };
   };
   qtlottie = {
-    version = "6.10.1";
+    version = "6.10.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.10/6.10.1/submodules/qtlottie-everywhere-src-6.10.1.tar.xz";
-      sha256 = "1hjp0hml4cih3vk9dgn3cs94klp7q2di29cdk457jva890y3d75w";
-      name = "qtlottie-everywhere-src-6.10.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.2/submodules/qtlottie-everywhere-src-6.10.2.tar.xz";
+      sha256 = "1302lh7432372qy0mw2pv67miikf2ny2n103s8mhyfl30xx6pn55";
+      name = "qtlottie-everywhere-src-6.10.2.tar.xz";
     };
   };
   qtmultimedia = {
-    version = "6.10.1";
+    version = "6.10.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.10/6.10.1/submodules/qtmultimedia-everywhere-src-6.10.1.tar.xz";
-      sha256 = "1f371qrcf9rp384niqxqfx0wa01m7p5hv7rjyzwz1m2052ygk97p";
-      name = "qtmultimedia-everywhere-src-6.10.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.2/submodules/qtmultimedia-everywhere-src-6.10.2.tar.xz";
+      sha256 = "0aryhch6qlamgfcbrxc0d1ggq4f96vjg68r7b8b33mzv0q0yzxwk";
+      name = "qtmultimedia-everywhere-src-6.10.2.tar.xz";
     };
   };
   qtnetworkauth = {
-    version = "6.10.1";
+    version = "6.10.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.10/6.10.1/submodules/qtnetworkauth-everywhere-src-6.10.1.tar.xz";
-      sha256 = "039qrymh18as1ksch470mzrxixr3fry2jnkrs7bqin3jh5cynd8l";
-      name = "qtnetworkauth-everywhere-src-6.10.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.2/submodules/qtnetworkauth-everywhere-src-6.10.2.tar.xz";
+      sha256 = "1cw1355xxf0ca96xwjaw33nnrxh1qw26naa2zha5fpsh9fggsaag";
+      name = "qtnetworkauth-everywhere-src-6.10.2.tar.xz";
     };
   };
   qtpositioning = {
-    version = "6.10.1";
+    version = "6.10.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.10/6.10.1/submodules/qtpositioning-everywhere-src-6.10.1.tar.xz";
-      sha256 = "08xy8rzm86b55pr8hk1g5rym7y0kblk0wj121l4rzqyn3gpi3cxb";
-      name = "qtpositioning-everywhere-src-6.10.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.2/submodules/qtpositioning-everywhere-src-6.10.2.tar.xz";
+      sha256 = "1kndqjh3ylbs5a2chqv3a6jip83j6zy9dlya82c7crkw8xjgllbh";
+      name = "qtpositioning-everywhere-src-6.10.2.tar.xz";
     };
   };
   qtquick3d = {
-    version = "6.10.1";
+    version = "6.10.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.10/6.10.1/submodules/qtquick3d-everywhere-src-6.10.1.tar.xz";
-      sha256 = "1rh3wi6pxahdpzlnxw8xrxfx5l931k7kncv03fvxmw6fprr05m0p";
-      name = "qtquick3d-everywhere-src-6.10.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.2/submodules/qtquick3d-everywhere-src-6.10.2.tar.xz";
+      sha256 = "0xfdlafzz7k3vps0kzz4mnyv0cmr0f5v8a4qkqvhqn0y3prkjm5r";
+      name = "qtquick3d-everywhere-src-6.10.2.tar.xz";
     };
   };
   qtquick3dphysics = {
-    version = "6.10.1";
+    version = "6.10.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.10/6.10.1/submodules/qtquick3dphysics-everywhere-src-6.10.1.tar.xz";
-      sha256 = "1vigiln79xy6xgr00wgmbfngqqpv6wsr5pviww8yfvmyy5yq8wyr";
-      name = "qtquick3dphysics-everywhere-src-6.10.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.2/submodules/qtquick3dphysics-everywhere-src-6.10.2.tar.xz";
+      sha256 = "1nqw5kqrivmajbw2sqxll8zgqjk79g2pic8rghfkb52ps1xzdbxp";
+      name = "qtquick3dphysics-everywhere-src-6.10.2.tar.xz";
     };
   };
   qtquickeffectmaker = {
-    version = "6.10.1";
+    version = "6.10.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.10/6.10.1/submodules/qtquickeffectmaker-everywhere-src-6.10.1.tar.xz";
-      sha256 = "1jdc2bgkrk1kl72h2cjb6j8p9pd2p7ck0zbw9afgam2hqm69hdih";
-      name = "qtquickeffectmaker-everywhere-src-6.10.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.2/submodules/qtquickeffectmaker-everywhere-src-6.10.2.tar.xz";
+      sha256 = "1i62d7s6fl4lf92cfwljk7blirz82mv174k1d5nrw38c9qxz3jp3";
+      name = "qtquickeffectmaker-everywhere-src-6.10.2.tar.xz";
     };
   };
   qtquicktimeline = {
-    version = "6.10.1";
+    version = "6.10.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.10/6.10.1/submodules/qtquicktimeline-everywhere-src-6.10.1.tar.xz";
-      sha256 = "1dsiwbvd5gqlwm87s05w4qb20731sxqmlm724kisqaf2nj4x4bl8";
-      name = "qtquicktimeline-everywhere-src-6.10.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.2/submodules/qtquicktimeline-everywhere-src-6.10.2.tar.xz";
+      sha256 = "0933sggxp28mybdr8wgfyny9m0c23h70f3fy1mwxy7yjb2vxhckh";
+      name = "qtquicktimeline-everywhere-src-6.10.2.tar.xz";
     };
   };
   qtremoteobjects = {
-    version = "6.10.1";
+    version = "6.10.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.10/6.10.1/submodules/qtremoteobjects-everywhere-src-6.10.1.tar.xz";
-      sha256 = "03cakd52p33qi8cjn9zjjmympjd74bc2fsk22cyy6064wbdmd7kw";
-      name = "qtremoteobjects-everywhere-src-6.10.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.2/submodules/qtremoteobjects-everywhere-src-6.10.2.tar.xz";
+      sha256 = "1kb5xd1ckp4phq820rl9h6nbaryrybzk2zxlq83cykg79w23ys5w";
+      name = "qtremoteobjects-everywhere-src-6.10.2.tar.xz";
     };
   };
   qtscxml = {
-    version = "6.10.1";
+    version = "6.10.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.10/6.10.1/submodules/qtscxml-everywhere-src-6.10.1.tar.xz";
-      sha256 = "0s8q7873bklgd19ynwil0fxi03m0b7wbx39z07iqim66skjs0rzb";
-      name = "qtscxml-everywhere-src-6.10.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.2/submodules/qtscxml-everywhere-src-6.10.2.tar.xz";
+      sha256 = "0si3vpzva8wyqa0gh0fyk75knlgmsyjalahp41nv1cginf6ig70g";
+      name = "qtscxml-everywhere-src-6.10.2.tar.xz";
     };
   };
   qtsensors = {
-    version = "6.10.1";
+    version = "6.10.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.10/6.10.1/submodules/qtsensors-everywhere-src-6.10.1.tar.xz";
-      sha256 = "15dkhkb6hfybzy4wib3w2bzjqmkymi7fzb7wdmq8jii36gh9rkj9";
-      name = "qtsensors-everywhere-src-6.10.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.2/submodules/qtsensors-everywhere-src-6.10.2.tar.xz";
+      sha256 = "10gmis63gpqhbb7ljy1gx3gh7hww6psk66c6jqvaxgzbgidm3rli";
+      name = "qtsensors-everywhere-src-6.10.2.tar.xz";
     };
   };
   qtserialbus = {
-    version = "6.10.1";
+    version = "6.10.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.10/6.10.1/submodules/qtserialbus-everywhere-src-6.10.1.tar.xz";
-      sha256 = "1m9ymfggv3l8lj7ji6kgayr5x6cisi20r3ikasbsbpzjgbvzqf95";
-      name = "qtserialbus-everywhere-src-6.10.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.2/submodules/qtserialbus-everywhere-src-6.10.2.tar.xz";
+      sha256 = "0yrsg50gmjlxnp1574fzkfbxls1cmjkn1qpagayhx55nrzzbydj7";
+      name = "qtserialbus-everywhere-src-6.10.2.tar.xz";
     };
   };
   qtserialport = {
-    version = "6.10.1";
+    version = "6.10.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.10/6.10.1/submodules/qtserialport-everywhere-src-6.10.1.tar.xz";
-      sha256 = "0k2c1zbx20mcrn6hkcnsxy1252g1ycjh3mszqyh8axzn6n2gdchp";
-      name = "qtserialport-everywhere-src-6.10.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.2/submodules/qtserialport-everywhere-src-6.10.2.tar.xz";
+      sha256 = "0sxxvrn1bwrzm140988prn12f14pj15v8z3yxs7zl7qiv8lvy35l";
+      name = "qtserialport-everywhere-src-6.10.2.tar.xz";
     };
   };
   qtshadertools = {
-    version = "6.10.1";
+    version = "6.10.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.10/6.10.1/submodules/qtshadertools-everywhere-src-6.10.1.tar.xz";
-      sha256 = "1djvynddqksxnbb94m2pvf1ngkdqc8631xa61nnkvdaj6fk98y5n";
-      name = "qtshadertools-everywhere-src-6.10.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.2/submodules/qtshadertools-everywhere-src-6.10.2.tar.xz";
+      sha256 = "1j8ncwhjcy2k6p05cldnb20vbqijq1frdac9xpk9cvky9yydpn8q";
+      name = "qtshadertools-everywhere-src-6.10.2.tar.xz";
     };
   };
   qtspeech = {
-    version = "6.10.1";
+    version = "6.10.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.10/6.10.1/submodules/qtspeech-everywhere-src-6.10.1.tar.xz";
-      sha256 = "0kvzic83d98szj6scgkm6hhj1p6jgr3i17c1523dw43f1xafrjj2";
-      name = "qtspeech-everywhere-src-6.10.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.2/submodules/qtspeech-everywhere-src-6.10.2.tar.xz";
+      sha256 = "051h4v0qqjkz1brkypx6i2wzdpn8pwz5353f0f7hsavr2p3zcdyr";
+      name = "qtspeech-everywhere-src-6.10.2.tar.xz";
     };
   };
   qtsvg = {
-    version = "6.10.1";
+    version = "6.10.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.10/6.10.1/submodules/qtsvg-everywhere-src-6.10.1.tar.xz";
-      sha256 = "07xh78s2krgnhvdsysf2ji5dicmfns4g92v2990czfzkb1d3aby0";
-      name = "qtsvg-everywhere-src-6.10.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.2/submodules/qtsvg-everywhere-src-6.10.2.tar.xz";
+      sha256 = "1qfnv8ssflndjhv6r8s9vxfl8yblra956d00f8c3bwna707zhzzh";
+      name = "qtsvg-everywhere-src-6.10.2.tar.xz";
     };
   };
   qttools = {
-    version = "6.10.1";
+    version = "6.10.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.10/6.10.1/submodules/qttools-everywhere-src-6.10.1.tar.xz";
-      sha256 = "16yl0hj540bnf1c1w4h7ph6s6bk15f0mqc1638807spzh21l0j41";
-      name = "qttools-everywhere-src-6.10.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.2/submodules/qttools-everywhere-src-6.10.2.tar.xz";
+      sha256 = "092vimkdpad6q9dilkhc45wmzzzs5ykfmbkfbi1d4xpxq43jqg8y";
+      name = "qttools-everywhere-src-6.10.2.tar.xz";
     };
   };
   qttranslations = {
-    version = "6.10.1";
+    version = "6.10.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.10/6.10.1/submodules/qttranslations-everywhere-src-6.10.1.tar.xz";
-      sha256 = "0513kpwmsmmk85rwzh77nkmmgkwi58kvvrws8xm3fb51i3gs4jcf";
-      name = "qttranslations-everywhere-src-6.10.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.2/submodules/qttranslations-everywhere-src-6.10.2.tar.xz";
+      sha256 = "0i56a03b7f6snvxfjsa5q4mnw6x7kxjnx2yw2rbm8sypr4xq3cxk";
+      name = "qttranslations-everywhere-src-6.10.2.tar.xz";
     };
   };
   qtvirtualkeyboard = {
-    version = "6.10.1";
+    version = "6.10.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.10/6.10.1/submodules/qtvirtualkeyboard-everywhere-src-6.10.1.tar.xz";
-      sha256 = "1pxnp4lg6i3v57ynqvisljp3dmfcjpp6q0dr0av03g5gi0qxx72v";
-      name = "qtvirtualkeyboard-everywhere-src-6.10.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.2/submodules/qtvirtualkeyboard-everywhere-src-6.10.2.tar.xz";
+      sha256 = "0swqvcgp6p80k2g7nzb6dcjr2spxcj4lk48s7ll3ygx8j5h2awv2";
+      name = "qtvirtualkeyboard-everywhere-src-6.10.2.tar.xz";
     };
   };
   qtwayland = {
-    version = "6.10.1";
+    version = "6.10.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.10/6.10.1/submodules/qtwayland-everywhere-src-6.10.1.tar.xz";
-      sha256 = "04yb4x7k0dv4m7j6qagvgxz2k08yvl1msk0zjwn6nyi202w6vgs9";
-      name = "qtwayland-everywhere-src-6.10.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.2/submodules/qtwayland-everywhere-src-6.10.2.tar.xz";
+      sha256 = "1qkyabklzzzbh4ryxhbnvnpz52vzqvyqwzd6lqkdy6978gmrh69r";
+      name = "qtwayland-everywhere-src-6.10.2.tar.xz";
     };
   };
   qtwebchannel = {
-    version = "6.10.1";
+    version = "6.10.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.10/6.10.1/submodules/qtwebchannel-everywhere-src-6.10.1.tar.xz";
-      sha256 = "049iv4vhzx061ka5skz2803npjsb477c20nfxxc0zrihy8jnk8bv";
-      name = "qtwebchannel-everywhere-src-6.10.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.2/submodules/qtwebchannel-everywhere-src-6.10.2.tar.xz";
+      sha256 = "09rc9y51bdb46pj7wad59gycy2l4ki3siizxai6kgq0risgsa7p3";
+      name = "qtwebchannel-everywhere-src-6.10.2.tar.xz";
     };
   };
   qtwebengine = {
-    version = "6.10.1";
+    version = "6.10.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.10/6.10.1/submodules/qtwebengine-everywhere-src-6.10.1.tar.xz";
-      sha256 = "1qyix9wbb2k96ybfavl56ffh3s6kbkfswvv5irmrlhm0hrhymdbp";
-      name = "qtwebengine-everywhere-src-6.10.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.2/submodules/qtwebengine-everywhere-src-6.10.2.tar.xz";
+      sha256 = "07ln4f89qlxvsxg5gjwvwqhcfkhvf5kympk7hmhqi6m6jbrdsvl5";
+      name = "qtwebengine-everywhere-src-6.10.2.tar.xz";
     };
   };
   qtwebsockets = {
-    version = "6.10.1";
+    version = "6.10.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.10/6.10.1/submodules/qtwebsockets-everywhere-src-6.10.1.tar.xz";
-      sha256 = "00dxjl3zr2vgj374vd31frnp8sxxknl3pmw46cxv3qhq8klwfai7";
-      name = "qtwebsockets-everywhere-src-6.10.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.2/submodules/qtwebsockets-everywhere-src-6.10.2.tar.xz";
+      sha256 = "1g9fnj73q3s8a49qzhr1iv2h7z50hwwnja80s9bgd7jhx8dpbk7c";
+      name = "qtwebsockets-everywhere-src-6.10.2.tar.xz";
     };
   };
   qtwebview = {
-    version = "6.10.1";
+    version = "6.10.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.10/6.10.1/submodules/qtwebview-everywhere-src-6.10.1.tar.xz";
-      sha256 = "0vvgn95bkrisjqwml16964zk0r9s6qvc6g81anl69xbs7mc80422";
-      name = "qtwebview-everywhere-src-6.10.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.2/submodules/qtwebview-everywhere-src-6.10.2.tar.xz";
+      sha256 = "1d7as06xmbmjx1rfnhrvizhy85dz3xdlx3pzy370r44q17zhdi3y";
+      name = "qtwebview-everywhere-src-6.10.2.tar.xz";
     };
   };
 }

From 368f01e2db7824708b6dac064f66f49681a9ce97 Mon Sep 17 00:00:00 2001
From: Philip Taron <philip.taron@gmail.com>
Date: Thu, 8 Jan 2026 10:34:42 -0800
Subject: [PATCH 37/53] nixVersions.nix_2_31: 2.31.2 -> 2.31.3

Changelog of fixes:

- Fix segfaults from `toView()` when compiled with newer nixpkgs (NixOS/nix#14154)
- Fix use-after-move in `DerivationGoal::repairClosure` and `SampleStack` (NixOS/nix#14086)
- Fix assertion failure on partially valid derivation outputs (NixOS/nix#14137)
- Fix `RestrictedStore::addDependency` recursion causing crashes (NixOS/nix#14729)
- Fix crash on flakerefs containing newlines (NixOS/nix#14450)

- Fix fakeSSH check breaking SSH copies with `user@host` format (NixOS/nix#14150)
- Fix `builtins.dirOf` regression from Nix 2.23 (NixOS/nix#14515)
- Restore missing `isAllowed` check in `ChrootLinuxDerivationBuilder` (NixOS/nix#14531)
- Fix curl with c-ares failing to resolve DNS in sandbox on macOS (NixOS/nix#14792)
- Fix tarball percent decoding for `file://` URIs (NixOS/nix#14729)
- `exportReferencesGraph`: Handle heterogeneous arrays (NixOS/nix#13861)
- Fix filesystem ops in store optimization (NixOS/nix#14676)

- Fix double-quoting of paths in logs (NixOS/nix#14210)
- Include path in world-writable error messages (NixOS/nix#14785)

- Better git refnames validation (NixOS/nix#14253)
- Use pure/restricted eval for help pages (NixOS/nix#14156)
- Improve store-reference compatibility with IPv6 ZoneId literals (NixOS/nix#14134)
- Correct `build-dir` error in manual (NixOS/nix#14745)

- Add mdbook 0.5 support (NixOS/nix#14690)
- Drop legacy Apple SDK pattern (NixOS/nix#13976)

https://github.com/NixOS/nix/releases/tag/2.31.3
(cherry picked from commit a4ef4c189ca6a336cb3e7b7c0e6cc551a6d764c9)
---
 .../installer/tools/nix-fallback-paths.nix    | 12 +++++-----
 pkgs/tools/package-management/nix/default.nix | 24 +++++++++----------
 2 files changed, 17 insertions(+), 19 deletions(-)

diff --git a/nixos/modules/installer/tools/nix-fallback-paths.nix b/nixos/modules/installer/tools/nix-fallback-paths.nix
index f6f99b6218d28..68f6494510cb2 100644
--- a/nixos/modules/installer/tools/nix-fallback-paths.nix
+++ b/nixos/modules/installer/tools/nix-fallback-paths.nix
@@ -1,8 +1,8 @@
 {
-  x86_64-linux = "/nix/store/x30lnlgk1s16rynrfslbf8phr6h6rqf2-nix-2.31.2";
-  i686-linux = "/nix/store/ix94q6rrdg6cr4893cjpzdbmibhlm0dv-nix-2.31.2";
-  aarch64-linux = "/nix/store/xnybj9lk0kwvmr2va253avanq7m3cpyg-nix-2.31.2";
-  riscv64-linux = "/nix/store/33as1vqp8mq36nr5bb5gr7ziw1nf4q1v-nix-riscv64-unknown-linux-gnu-2.31.2";
-  x86_64-darwin = "/nix/store/b9dvary8rcljj7ajv1x64hwwch4cvyvp-nix-2.31.2";
-  aarch64-darwin = "/nix/store/lvv1j8qbrvlnl3aagcjrhf42d458zgb5-nix-2.31.2";
+  x86_64-linux = "/nix/store/mxn3vxpvk2b42kgd08aw4bn27qhf434w-nix-2.31.3";
+  i686-linux = "/nix/store/b7d35ifww9683l74ydkb0qhrq6lqcisi-nix-2.31.3";
+  aarch64-linux = "/nix/store/ysz7dwmy4zd1zm3wzx5dh9g999xv7pbm-nix-2.31.3";
+  riscv64-linux = "/nix/store/avfv2lqbnphj2ap8y5ihg1l0sqhpjll7-nix-riscv64-unknown-linux-gnu-2.31.3";
+  x86_64-darwin = "/nix/store/s8lcl6nrd5ia7nr4zx9mg720i9f8qm37-nix-2.31.3";
+  aarch64-darwin = "/nix/store/vfjzbcl3kf9jjwh0g2x03cvz2x5hg8py-nix-2.31.3";
 }
diff --git a/pkgs/tools/package-management/nix/default.nix b/pkgs/tools/package-management/nix/default.nix
index e7a186754a516..73e85c951200d 100644
--- a/pkgs/tools/package-management/nix/default.nix
+++ b/pkgs/tools/package-management/nix/default.nix
@@ -177,19 +177,17 @@ lib.makeExtensible (
 
       nix_2_30 = addTests "nix_2_30" self.nixComponents_2_30.nix-everything;
 
-      nixComponents_2_31 =
-        (nixDependencies.callPackage ./modular/packages.nix rec {
-          version = "2.31.2";
-          inherit (self.nix_2_30.meta) maintainers teams;
-          otherSplices = generateSplicesForNixComponents "nixComponents_2_31";
-          src = fetchFromGitHub {
-            owner = "NixOS";
-            repo = "nix";
-            tag = version;
-            hash = "sha256-NLGXPLjENLeKVOg3OZgHXZ+1x6sPIKq9FHH8pxbCrDI=";
-          };
-        }).appendPatches
-          patches_common;
+      nixComponents_2_31 = nixDependencies.callPackage ./modular/packages.nix rec {
+        version = "2.31.3";
+        inherit (self.nix_2_30.meta) maintainers teams;
+        otherSplices = generateSplicesForNixComponents "nixComponents_2_31";
+        src = fetchFromGitHub {
+          owner = "NixOS";
+          repo = "nix";
+          tag = version;
+          hash = "sha256-oe0YWe8f+pwQH4aYD2XXLW5iEHyXNUddurqJ5CUVCIk=";
+        };
+      };
 
       nix_2_31 = addTests "nix_2_31" self.nixComponents_2_31.nix-everything;
 

From 19b8777e2353fd4b620fdd85565dc168b84912bb Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Thu, 19 Mar 2026 16:53:14 +0000
Subject: [PATCH 38/53] qemu: 10.1.2 -> 10.1.5

---
 pkgs/applications/virtualization/qemu/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/virtualization/qemu/default.nix b/pkgs/applications/virtualization/qemu/default.nix
index c62b5cc27db18..3a50f6771344b 100644
--- a/pkgs/applications/virtualization/qemu/default.nix
+++ b/pkgs/applications/virtualization/qemu/default.nix
@@ -136,11 +136,11 @@ stdenv.mkDerivation (finalAttrs: {
     + lib.optionalString nixosTestRunner "-for-vm-tests"
     + lib.optionalString toolsOnly "-utils"
     + lib.optionalString userOnly "-user";
-  version = "10.1.2";
+  version = "10.1.5";
 
   src = fetchurl {
     url = "https://download.qemu.org/qemu-${finalAttrs.version}.tar.xz";
-    hash = "sha256-nXXzMcGly5tuuP2fZPVj7C6rNGyCLLl/izXNgtPxFHk=";
+    hash = "sha256-HxIJtNuC5sRBfq9ufgsHNWNXKgQtn7dJKwhLplqcBpM=";
   };
 
   depsBuildBuild = [

From 410cd0349e8d8c853fc7f3cd4bbf84dae24ad52f Mon Sep 17 00:00:00 2001
From: Sefa Eyeoglu <contact@scrumplex.net>
Date: Wed, 11 Mar 2026 20:33:18 +0100
Subject: [PATCH 39/53] curl: 8.18.0 -> 8.19.0

https://curl.se/ch/8.19.0.html

Fixes CVE-2026-3805
Fixes CVE-2026-3784
Fixes CVE-2026-3783
Fixes CVE-2026-1965

Signed-off-by: Sefa Eyeoglu <contact@scrumplex.net>
(cherry picked from commit df6cab7c12820f42c8b586be4ad87d900475b0be)
---
 pkgs/by-name/cu/curlMinimal/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/cu/curlMinimal/package.nix b/pkgs/by-name/cu/curlMinimal/package.nix
index 8e406e0190f64..e49cc075b43ac 100644
--- a/pkgs/by-name/cu/curlMinimal/package.nix
+++ b/pkgs/by-name/cu/curlMinimal/package.nix
@@ -86,7 +86,7 @@ assert
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "curl";
-  version = "8.18.0";
+  version = "8.19.0";
 
   src = fetchurl {
     urls = [
@@ -95,7 +95,7 @@ stdenv.mkDerivation (finalAttrs: {
         builtins.replaceStrings [ "." ] [ "_" ] finalAttrs.version
       }/curl-${finalAttrs.version}.tar.xz"
     ];
-    hash = "sha256-QN95Fm50qiAUk2XhHuTHmKRq1Xw05PaP0TEA4smpGUY=";
+    hash = "sha256-TrQUiXkNGeGQ16x+GOgoV83Wivj05mspLO1WLTM/Ed8=";
   };
 
   # this could be accomplished by updateAutotoolsGnuConfigScriptsHook, but that causes infinite recursion

From 331922862f0c2f416a65fe0509fe69dfd474addf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Fri, 20 Mar 2026 17:51:26 +0100
Subject: [PATCH 40/53] expat: 2.7.4 -> 2.7.5

https://github.com/libexpat/libexpat/blob/R_2_7_5/expat/Changes
Fixes CVE-2026-32776 CVE-2026-32777 CVE-2026-32778

(cherry picked from commit bae4040734f48b1059b22b36487cd82b2e5bf08f)
---
 pkgs/by-name/ex/expat/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ex/expat/package.nix b/pkgs/by-name/ex/expat/package.nix
index 80f5f017a36a5..a8c982f87805e 100644
--- a/pkgs/by-name/ex/expat/package.nix
+++ b/pkgs/by-name/ex/expat/package.nix
@@ -18,7 +18,7 @@
 # files.
 
 let
-  version = "2.7.4";
+  version = "2.7.5";
   tag = "R_${lib.replaceStrings [ "." ] [ "_" ] version}";
 in
 stdenv.mkDerivation (finalAttrs: {
@@ -29,7 +29,7 @@ stdenv.mkDerivation (finalAttrs: {
     url =
       with finalAttrs;
       "https://github.com/libexpat/libexpat/releases/download/${tag}/${pname}-${version}.tar.xz";
-    hash = "sha256-npyrtFfB4J3pHbJwbYNlZFeSY46zvh+U27IUkwEIasA=";
+    hash = "sha256-EDLf70/xf3BGSCfaooNpsg9lhNEIvDbxerFnbh7dL5E=";
   };
 
   strictDeps = true;

From bcdff56a5bf4ca28b8c25c9c081dd9a0fd274158 Mon Sep 17 00:00:00 2001
From: whoomee <git@miglix.eu>
Date: Mon, 16 Mar 2026 15:13:13 +0100
Subject: [PATCH 41/53] gstreamer: 1.26.5 -> 1.26.11, adopt

(cherry picked from commit f9e91528eb8c38ec2cebc29ff61bb819b1a560a8)
Conflict: removing matthewbauer as on nixpkgs master via PR #462219
---
 .../libraries/gstreamer/bad/default.nix       |  6 +++---
 .../libraries/gstreamer/base/default.nix      |  6 +++---
 .../libraries/gstreamer/core/default.nix      |  5 +++--
 .../libraries/gstreamer/devtools/default.nix  | 19 ++++---------------
 .../libraries/gstreamer/ges/default.nix       |  6 +++---
 .../libraries/gstreamer/good/default.nix      |  6 +++---
 .../libraries/gstreamer/libav/default.nix     |  6 +++---
 .../libraries/gstreamer/rs/default.nix        |  2 +-
 .../gstreamer/rtsp-server/default.nix         |  4 ++--
 .../libraries/gstreamer/ugly/default.nix      |  6 +++---
 .../libraries/gstreamer/vaapi/default.nix     |  6 +++---
 11 files changed, 31 insertions(+), 41 deletions(-)

diff --git a/pkgs/development/libraries/gstreamer/bad/default.nix b/pkgs/development/libraries/gstreamer/bad/default.nix
index 10720a06a06ed..5fbf223d674bb 100644
--- a/pkgs/development/libraries/gstreamer/bad/default.nix
+++ b/pkgs/development/libraries/gstreamer/bad/default.nix
@@ -115,7 +115,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gst-plugins-bad";
-  version = "1.26.5";
+  version = "1.26.11";
 
   outputs = [
     "out"
@@ -124,7 +124,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/gst-plugins-bad/gst-plugins-bad-${finalAttrs.version}.tar.xz";
-    hash = "sha256-mJDyYvOyqVZNy2KenraX13uT0fcYl+2hqBcLfc/nMpQ=";
+    hash = "sha256-EQ+4J5Xw5Wmx4nsSq5aZ01x3YuH/TblTNdasjRRCrz0=";
   };
 
   patches = [
@@ -427,6 +427,6 @@ stdenv.mkDerivation (finalAttrs: {
     '';
     license = if enableGplPlugins then lib.licenses.gpl2Plus else lib.licenses.lgpl2Plus;
     platforms = lib.platforms.linux ++ lib.platforms.darwin;
-    maintainers = with lib.maintainers; [ matthewbauer ];
+    maintainers = with lib.maintainers; [ tmarkus ];
   };
 })
diff --git a/pkgs/development/libraries/gstreamer/base/default.nix b/pkgs/development/libraries/gstreamer/base/default.nix
index 7e77cd97d782b..09b528ae812a1 100644
--- a/pkgs/development/libraries/gstreamer/base/default.nix
+++ b/pkgs/development/libraries/gstreamer/base/default.nix
@@ -50,7 +50,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gst-plugins-base";
-  version = "1.26.5";
+  version = "1.26.11";
 
   outputs = [
     "out"
@@ -61,7 +61,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/gst-plugins-base/gst-plugins-base-${finalAttrs.version}.tar.xz";
-    hash = "sha256-8MDibL7apXcyy2pXjozBOhFkvxjXN9VcMzBhxS8MSNc=";
+    hash = "sha256-/FD4hdQfXQQHzgh27HI12ee4LUjbL0vHLF8kSkrHkmM=";
   };
 
   strictDeps = true;
@@ -202,6 +202,6 @@ stdenv.mkDerivation (finalAttrs: {
       "gstreamer-video-1.0"
     ];
     platforms = lib.platforms.unix;
-    maintainers = with lib.maintainers; [ matthewbauer ];
+    maintainers = with lib.maintainers; [ tmarkus ];
   };
 })
diff --git a/pkgs/development/libraries/gstreamer/core/default.nix b/pkgs/development/libraries/gstreamer/core/default.nix
index fd588fc2300aa..bd5b3abb75c07 100644
--- a/pkgs/development/libraries/gstreamer/core/default.nix
+++ b/pkgs/development/libraries/gstreamer/core/default.nix
@@ -40,7 +40,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "gstreamer";
-  version = "1.26.5";
+  version = "1.26.11";
 
   outputs = [
     "bin"
@@ -52,7 +52,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/gstreamer/gstreamer-${finalAttrs.version}.tar.xz";
-    hash = "sha256-Cn7bDntC2+a1dfzmGkgIo/ayDghaHq7LwCXQ7CHx53Q=";
+    hash = "sha256-LgvRktBDjqYGpvdqlcjhZUIWdlb/7Cwrw6r27gg3+/Y=";
   };
 
   depsBuildBuild = [
@@ -155,6 +155,7 @@ stdenv.mkDerivation (finalAttrs: {
     ];
     platforms = lib.platforms.unix;
     maintainers = with lib.maintainers; [
+      tmarkus
       ttuegel
       matthewbauer
     ];
diff --git a/pkgs/development/libraries/gstreamer/devtools/default.nix b/pkgs/development/libraries/gstreamer/devtools/default.nix
index e92607625e9ff..9bb0c76bc56b0 100644
--- a/pkgs/development/libraries/gstreamer/devtools/default.nix
+++ b/pkgs/development/libraries/gstreamer/devtools/default.nix
@@ -28,7 +28,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gst-devtools";
-  version = "1.26.5";
+  version = "1.26.11";
 
   outputs = [
     "out"
@@ -37,29 +37,18 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/gst-devtools/gst-devtools-${finalAttrs.version}.tar.xz";
-    hash = "sha256-Y9Rqjv+ooiXiWkZLp1OKzoU/4NwecDZrJ8IIE15UAc4=";
+    hash = "sha256-Vl9IU4jJSYr+v3gAQYPN/xATEhEoZBqlbtql6pRBK+I=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs)
       src
-      patches
       cargoRoot
       ;
     name = "gst-devtools-${finalAttrs.version}";
-    hash = "sha256-gU+SBvxwmrGiyeKXF3SA2ohIHNTS4ZBC+elB0u1QKRE=";
+    hash = "sha256-sqN1IBkbrT3pQqUQKU2pr8G1t4kNMKk0NR7NH7dTvAE=";
   };
 
-  patches = [
-    # dots-viewer: sort static files
-    # https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/9208
-    (fetchpatch {
-      url = "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/b3099f78775eab1ac19a9e163c0386e01e74b768.patch";
-      stripLen = 2;
-      hash = "sha256-QRHqbZ6slYcwGl+o9Oi4jV+ANMorCED4cQV5qDS74eg=";
-    })
-  ];
-
   depsBuildBuild = [
     pkg-config
   ];
@@ -132,6 +121,6 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://gstreamer.freedesktop.org";
     license = lib.licenses.lgpl2Plus;
     platforms = lib.platforms.unix;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ tmarkus ];
   };
 })
diff --git a/pkgs/development/libraries/gstreamer/ges/default.nix b/pkgs/development/libraries/gstreamer/ges/default.nix
index 60cabc07f942d..bc9ddcf7bf261 100644
--- a/pkgs/development/libraries/gstreamer/ges/default.nix
+++ b/pkgs/development/libraries/gstreamer/ges/default.nix
@@ -23,7 +23,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gst-editing-services";
-  version = "1.26.5";
+  version = "1.26.11";
 
   outputs = [
     "out"
@@ -32,7 +32,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/gst-editing-services/gst-editing-services-${finalAttrs.version}.tar.xz";
-    hash = "sha256-c0kAlE+Q7OXi85g8M1F4/aUAI/40KqdezZ2KnDi2TZ4=";
+    hash = "sha256-o26HkAtErBYIYS8tYW/AMvnX2SAyfE0jGv+2/pNJcU0=";
   };
 
   nativeBuildInputs = [
@@ -83,6 +83,6 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://gstreamer.freedesktop.org";
     license = lib.licenses.lgpl2Plus;
     platforms = lib.platforms.unix;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ tmarkus ];
   };
 })
diff --git a/pkgs/development/libraries/gstreamer/good/default.nix b/pkgs/development/libraries/gstreamer/good/default.nix
index 60f2c8d2a99c6..0716755bd34c0 100644
--- a/pkgs/development/libraries/gstreamer/good/default.nix
+++ b/pkgs/development/libraries/gstreamer/good/default.nix
@@ -74,7 +74,7 @@ assert raspiCameraSupport -> hostSupportsRaspiCamera;
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gst-plugins-good";
-  version = "1.26.5";
+  version = "1.26.11";
 
   outputs = [
     "out"
@@ -83,7 +83,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/gst-plugins-good/gst-plugins-good-${finalAttrs.version}.tar.xz";
-    hash = "sha256-6whi6TQEsHPpjsUDUOzn5mheopNsq4EYwrjpOOLL6os=";
+    hash = "sha256-AB3rCHbV10PNNEir90onrew/2FABL8sbAJlIYb1sEUU=";
   };
 
   patches = [
@@ -293,6 +293,6 @@ stdenv.mkDerivation (finalAttrs: {
     '';
     license = lib.licenses.lgpl2Plus;
     platforms = lib.platforms.linux ++ lib.platforms.darwin;
-    maintainers = with lib.maintainers; [ matthewbauer ];
+    maintainers = with lib.maintainers; [ tmarkus ];
   };
 })
diff --git a/pkgs/development/libraries/gstreamer/libav/default.nix b/pkgs/development/libraries/gstreamer/libav/default.nix
index 990ed19d1b7ba..f5c149fdd1ecf 100644
--- a/pkgs/development/libraries/gstreamer/libav/default.nix
+++ b/pkgs/development/libraries/gstreamer/libav/default.nix
@@ -19,7 +19,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gst-libav";
-  version = "1.26.5";
+  version = "1.26.11";
 
   outputs = [
     "out"
@@ -28,7 +28,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/gst-libav/gst-libav-${finalAttrs.version}.tar.xz";
-    hash = "sha256-1t4FiE70I3bdjN6JlA97UM7Zb09vUoiOdkzYIz508FI=";
+    hash = "sha256-m7PSaB7w3pLRsanZVRhiNu4i5k83Lbm/wNIuLQ3xmGU=";
   };
 
   nativeBuildInputs = [
@@ -69,6 +69,6 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://gstreamer.freedesktop.org";
     license = lib.licenses.lgpl2Plus;
     platforms = lib.platforms.unix;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ tmarkus ];
   };
 })
diff --git a/pkgs/development/libraries/gstreamer/rs/default.nix b/pkgs/development/libraries/gstreamer/rs/default.nix
index e3bc29fec2949..4a77e4a43e8db 100644
--- a/pkgs/development/libraries/gstreamer/rs/default.nix
+++ b/pkgs/development/libraries/gstreamer/rs/default.nix
@@ -261,6 +261,6 @@ stdenv.mkDerivation (finalAttrs: {
       lgpl21Plus
     ];
     platforms = lib.platforms.unix;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ tmarkus ];
   };
 })
diff --git a/pkgs/development/libraries/gstreamer/rtsp-server/default.nix b/pkgs/development/libraries/gstreamer/rtsp-server/default.nix
index 61dfb7b58037f..1953051f7a67e 100644
--- a/pkgs/development/libraries/gstreamer/rtsp-server/default.nix
+++ b/pkgs/development/libraries/gstreamer/rtsp-server/default.nix
@@ -19,7 +19,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gst-rtsp-server";
-  version = "1.26.5";
+  version = "1.26.11";
 
   outputs = [
     "out"
@@ -28,7 +28,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/gst-rtsp-server/gst-rtsp-server-${finalAttrs.version}.tar.xz";
-    hash = "sha256-Mo3/JFdBloPypPBsoRnP0ivrYyzuGtaDBZEhMyU1PEQ=";
+    hash = "sha256-th1DBNjOqqoboTn7HOk18E8ac9fhgkPAoFsvsEMFQG8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/gstreamer/ugly/default.nix b/pkgs/development/libraries/gstreamer/ugly/default.nix
index b354474f4a25a..0a35aaf3157df 100644
--- a/pkgs/development/libraries/gstreamer/ugly/default.nix
+++ b/pkgs/development/libraries/gstreamer/ugly/default.nix
@@ -27,7 +27,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gst-plugins-ugly";
-  version = "1.26.5";
+  version = "1.26.11";
 
   outputs = [
     "out"
@@ -36,7 +36,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/gst-plugins-ugly/gst-plugins-ugly-${finalAttrs.version}.tar.xz";
-    hash = "sha256-PfxDQ1vpfhEIFrrG1gKw8gagOFRieWg9nSU3L/En21I=";
+    hash = "sha256-v5yfcu43SCXP1DhowoW8sBcA3yWEBp51169FX+SCRPg=";
   };
 
   nativeBuildInputs = [
@@ -114,6 +114,6 @@ stdenv.mkDerivation (finalAttrs: {
     '';
     license = if enableGplPlugins then lib.licenses.gpl2Plus else lib.licenses.lgpl2Plus;
     platforms = lib.platforms.unix;
-    maintainers = with lib.maintainers; [ matthewbauer ];
+    maintainers = with lib.maintainers; [ tmarkus ];
   };
 })
diff --git a/pkgs/development/libraries/gstreamer/vaapi/default.nix b/pkgs/development/libraries/gstreamer/vaapi/default.nix
index 4f19e307addd5..ed0195c8b1b74 100644
--- a/pkgs/development/libraries/gstreamer/vaapi/default.nix
+++ b/pkgs/development/libraries/gstreamer/vaapi/default.nix
@@ -30,7 +30,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gstreamer-vaapi";
-  version = "1.26.5";
+  version = "1.26.11";
 
   outputs = [
     "out"
@@ -39,7 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/gstreamer-vaapi/gstreamer-vaapi-${finalAttrs.version}.tar.xz";
-    hash = "sha256-tC1E22PzGVpvMyluHq0ywU0B7ydFK3Bo8aLYZiT1Xqk=";
+    hash = "sha256-8S+TAnPHodPg1/hblP+dE3nRYqzMky6Mo9OJk+0n/Kw=";
   };
 
   nativeBuildInputs = [
@@ -102,6 +102,6 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://gstreamer.freedesktop.org";
     license = lib.licenses.lgpl21Plus;
     platforms = lib.platforms.linux;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ tmarkus ];
   };
 })

From 421910c2c94b755c72788ddbc28272626b9dfade Mon Sep 17 00:00:00 2001
From: whoomee <git@miglix.eu>
Date: Mon, 16 Mar 2026 15:54:54 +0100
Subject: [PATCH 42/53] pythonPackages.gst-python: 1.26.0 -> 1.26.11

(cherry picked from commit 776c1caddbf88fd3d9388b999ea4c85cab87956b)
---
 pkgs/development/python-modules/gst-python/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/gst-python/default.nix b/pkgs/development/python-modules/gst-python/default.nix
index 52c3119e435fd..96ccc5f95b4cb 100644
--- a/pkgs/development/python-modules/gst-python/default.nix
+++ b/pkgs/development/python-modules/gst-python/default.nix
@@ -21,7 +21,7 @@
 
 buildPythonPackage rec {
   pname = "gst-python";
-  version = "1.26.0";
+  version = "1.26.11";
 
   format = "other";
 
@@ -32,7 +32,7 @@ buildPythonPackage rec {
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/gst-python/gst-python-${version}.tar.xz";
-    hash = "sha256-5QRqBdd6uxVnGtAc0ZCNF9YuWgb114Qb5DQq3io/uNs=";
+    hash = "sha256-ETFrp2m1bSbYsUZMcZipkkyurkgTT321kXH68ac9xDY=";
   };
 
   patches = [

From b686a1fda7a7fddb2cb66535336938c6986ee805 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Sat, 21 Mar 2026 09:04:11 +0100
Subject: [PATCH 43/53] python3Packages.gst-python: fixup after updating

One patch was applied already; the other needed to change.

(cherry picked from commit b6c0061b8ec0713f4395d445bb94d742e7c9b182)
---
 .../python-modules/gst-python/default.nix     | 17 ++-----
 .../skip-failing-test-not-initialized.patch   | 50 -------------------
 2 files changed, 5 insertions(+), 62 deletions(-)
 delete mode 100644 pkgs/development/python-modules/gst-python/skip-failing-test-not-initialized.patch

diff --git a/pkgs/development/python-modules/gst-python/default.nix b/pkgs/development/python-modules/gst-python/default.nix
index 96ccc5f95b4cb..abbc71377ceac 100644
--- a/pkgs/development/python-modules/gst-python/default.nix
+++ b/pkgs/development/python-modules/gst-python/default.nix
@@ -35,18 +35,11 @@ buildPythonPackage rec {
     hash = "sha256-ETFrp2m1bSbYsUZMcZipkkyurkgTT321kXH68ac9xDY=";
   };
 
-  patches = [
-    # Fix segfault with PyGObject>=3.52.0
-    # https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8653
-    (fetchpatch {
-      url = "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/69bba61e548c7a63bc18137e63e41489a7de9d36.patch";
-      stripLen = 2;
-      hash = "sha256-BfWPc8dsB09KiEm9bNT8e+jH76jiDefQlEhhLJoq7tI=";
-    })
-
-    # https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/4322
-    ./skip-failing-test-not-initialized.patch
-  ];
+  # https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/4322
+  postPatch = ''
+    substituteInPlace testsuite/meson.build \
+      --replace-fail "['gstinit', 'test_gst_init.py']," ""
+  '';
 
   # Python 2.x is not supported.
   disabled = !isPy3k;
diff --git a/pkgs/development/python-modules/gst-python/skip-failing-test-not-initialized.patch b/pkgs/development/python-modules/gst-python/skip-failing-test-not-initialized.patch
deleted file mode 100644
index 169c85a0802ce..0000000000000
--- a/pkgs/development/python-modules/gst-python/skip-failing-test-not-initialized.patch
+++ /dev/null
@@ -1,50 +0,0 @@
-diff --git a/testsuite/test_gst.py b/testsuite/test_gst.py
-index 2111b968..fd8a4627 100644
---- a/testsuite/test_gst.py
-+++ b/testsuite/test_gst.py
-@@ -38,45 +38,6 @@ class TimeArgsTest(TestCase):
-         self.assertEqual(Gst.TIME_ARGS(Gst.SECOND), '0:00:01.000000000')
- 
- 
--class TestNotInitialized(TestCase):
--    def testNotInitialized(self):
--        if sys.version_info >= (3, 0):
--            assert_type = Gst.NotInitialized
--        else:
--            assert_type = TypeError
--
--        with self.assertRaises(assert_type):
--            Gst.Caps.from_string("audio/x-raw")
--
--        with self.assertRaises(assert_type):
--            Gst.Structure.from_string("audio/x-raw")
--
--        with self.assertRaises(assert_type):
--            Gst.ElementFactory.make("identity", None)
--
--    def testNotDeinitialized(self):
--        Gst.init(None)
--
--        assert(Gst.Caps.from_string("audio/x-raw"))
--        assert(Gst.Structure.from_string("audio/x-raw"))
--        assert(Gst.ElementFactory.make("identity", None))
--
--        Gst.deinit()
--        if sys.version_info >= (3, 0):
--            assert_type = Gst.NotInitialized
--        else:
--            assert_type = TypeError
--
--        with self.assertRaises(assert_type):
--            Gst.Caps.from_string("audio/x-raw")
--
--        with self.assertRaises(assert_type):
--            Gst.Structure.from_string("audio/x-raw")
--
--        with self.assertRaises(assert_type):
--            Gst.ElementFactory.make("identity", None)
--
--
- class TestStructure(TestCase):
- 
-     def test_new(self):

From a0d4f84468b355c5eaf81093376a83afc5cc83ee Mon Sep 17 00:00:00 2001
From: Thomas Gerbet <thomas@gerbet.me>
Date: Fri, 27 Feb 2026 22:28:24 +0100
Subject: [PATCH 44/53] openexr: 3.3.5 -> 3.3.8

Fixes https://github.com/NixOS/nixpkgs/issues/494664 / CVE-2026-26981
Fixes https://github.com/NixOS/nixpkgs/issues/496657 / CVE-2026-27622

Changes:
https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.3.8
https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.3.7
https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.3.6
(cherry picked from commit 9276f66460637b6d326082fadf4e3b25f28301f9)
---
 pkgs/development/libraries/openexr/3.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/openexr/3.nix b/pkgs/development/libraries/openexr/3.nix
index 24287d4280656..70353953b6421 100644
--- a/pkgs/development/libraries/openexr/3.nix
+++ b/pkgs/development/libraries/openexr/3.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "openexr";
-  version = "3.3.5";
+  version = "3.3.8";
 
   src = fetchFromGitHub {
     owner = "AcademySoftwareFoundation";
     repo = "openexr";
     rev = "v${version}";
-    hash = "sha256-J1SButHDPy0gGkVOZKfemaMF0MY/lifB5n39+3GRKR8=";
+    hash = "sha256-bJJdfr+OybCl8L27m1uRynGaU1V8D70bSzQjkDuqMDU=";
   };
 
   outputs = [

From 6d9c81c30563d4518041351a26b0f8ac6eaa3f44 Mon Sep 17 00:00:00 2001
From: Thomas Gerbet <thomas@gerbet.me>
Date: Fri, 27 Feb 2026 23:51:03 +0100
Subject: [PATCH 45/53] re2c: apply patch for CVE-2026-2903

Fixes https://github.com/NixOS/nixpkgs/issues/494744 / CVE-2026-2903

(cherry picked from commit 61288782add47302823e827e4f31891cb0ea5760)
---
 pkgs/by-name/re/re2c/package.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/pkgs/by-name/re/re2c/package.nix b/pkgs/by-name/re/re2c/package.nix
index f3cd39eb7c811..1e699a3cbfbca 100644
--- a/pkgs/by-name/re/re2c/package.nix
+++ b/pkgs/by-name/re/re2c/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   autoreconfHook,
   nix-update-script,
   python3,
@@ -23,6 +24,14 @@ stdenv.mkDerivation rec {
     hash = "sha256-ihtAB6HLgYhX+FKPFy01RByy/M468YrHv2v5wB9bJws=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "CVE-2026-2903.patch";
+      url = "https://github.com/skvadrik/re2c/commit/febeb977936f9519a25d9fbd10ff8256358cdb97.patch";
+      hash = "sha256-JqnGfK48wpbWHb3aD9Fj3DOyoqHpbjvowppY/Vg5YWA=";
+    })
+  ];
+
   nativeBuildInputs = [
     autoreconfHook
     python3

From 9809d984d78ce0f2c61248109a8e4f8374a2eea6 Mon Sep 17 00:00:00 2001
From: Thomas Gerbet <thomas@gerbet.me>
Date: Mon, 16 Mar 2026 11:21:10 +0100
Subject: [PATCH 46/53] inetutils: apply patches for CVE-2026-32746 and
 CVE-2026-28372

Fixes #495296
Fixes #500351

https://lists.gnu.org/archive/html/bug-inetutils/2026-03/msg00031.html
https://lists.gnu.org/archive/html/bug-inetutils/2026-02/msg00000.html
(cherry picked from commit ba5589fc4fc4b9d7225b61b0d5ed462452db1bad)
---
 pkgs/by-name/in/inetutils/package.nix | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/pkgs/by-name/in/inetutils/package.nix b/pkgs/by-name/in/inetutils/package.nix
index 4ebc0e111e617..c6b725df11d2a 100644
--- a/pkgs/by-name/in/inetutils/package.nix
+++ b/pkgs/by-name/in/inetutils/package.nix
@@ -40,6 +40,21 @@ stdenv.mkDerivation (finalAttrs: {
       url = "https://codeberg.org/inetutils/inetutils/commit/ccba9f748aa8d50a38d7748e2e60362edd6a32cc.patch";
       hash = "sha256-ws+ed5vb7kVMHEbqK7yj6FUT355pTv2RZEYuXs5M7Io=";
     })
+    (fetchpatch {
+      name = "CVE-2026-28372.patch";
+      url = "https://codeberg.org/inetutils/inetutils/commit/4db2f19f4caac03c7f4da6363c140bd70df31386.patch";
+      excludes = [
+        "NEWS.md"
+        "THANKS"
+      ];
+      hash = "sha256-ASgcaNC+yo3Hth4M32IVbD3jFt8mxcGtLfl+ULNt4Ag=";
+    })
+    (fetchpatch {
+      name = "CVE-2026-32746.patch";
+      url = "https://codeberg.org/inetutils/inetutils/commit/6864598a29b652a6b69a958f5cd1318aa2b258af.patch";
+      excludes = [ "NEWS.md" ];
+      hash = "sha256-gQH4BZG9rkyGtOQjBqItx+fEBda/Wgg9f46VYPV8HLw=";
+    })
   ];
 
   strictDeps = true;

From 6139797dfb63c0ae6ea4b5272eb192c00a5df57f Mon Sep 17 00:00:00 2001
From: Thomas Gerbet <thomas@gerbet.me>
Date: Mon, 16 Mar 2026 12:07:10 +0100
Subject: [PATCH 47/53] libssh: 0.11.3 -> 0.11.4

https://www.libssh.org/2026/02/10/libssh-0-12-0-and-0-11-4-security-releases/

Fixes:
* CVE-2026-0964
* CVE-2026-0965
* CVE-2026-0966
* CVE-2026-0967
* CVE-2026-0968
* http://www.libssh.org/security/advisories/libssh-2026-sftp-extensions.txt

Fixes #498202

(cherry picked from commit c182d8a22747f3ba2f094ef7591b0e31b3f0fc45)
---
 pkgs/by-name/li/libssh/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libssh/package.nix b/pkgs/by-name/li/libssh/package.nix
index fc9ea4efe5b86..4ae69bf3b3a7e 100644
--- a/pkgs/by-name/li/libssh/package.nix
+++ b/pkgs/by-name/li/libssh/package.nix
@@ -16,11 +16,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libssh";
-  version = "0.11.3";
+  version = "0.11.4";
 
   src = fetchurl {
     url = "https://www.libssh.org/files/${lib.versions.majorMinor version}/libssh-${version}.tar.xz";
-    hash = "sha256-fYoTYbsJTsP1EZZOeKWk26aJtZhuESr6vk9NDWxhJcM=";
+    hash = "sha256-ACrDIOPWbJ4QDsZXbj6EqgxIlJ79479bQKKAKZIpdwE=";
   };
 
   outputs = [

From 4e5defa1182116e76b94b76a2c5f7f6a39cc2fd9 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 10 Mar 2026 19:02:21 +0000
Subject: [PATCH 48/53] libarchive: 3.8.4 -> 3.8.6

(cherry picked from commit 76609c3cd6721dec2f458741389a79d0bb3d00aa)
---
 pkgs/by-name/li/libarchive/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libarchive/package.nix b/pkgs/by-name/li/libarchive/package.nix
index 1cfcfd29c4b78..0c9dfead431d1 100644
--- a/pkgs/by-name/li/libarchive/package.nix
+++ b/pkgs/by-name/li/libarchive/package.nix
@@ -31,13 +31,13 @@
 assert xarSupport -> libxml2 != null;
 stdenv.mkDerivation (finalAttrs: {
   pname = "libarchive";
-  version = "3.8.4";
+  version = "3.8.6";
 
   src = fetchFromGitHub {
     owner = "libarchive";
     repo = "libarchive";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-qNz7BAvi3dTNg6Bz2cfqaYGKFJlM4C+y/GARsQRRYsY=";
+    hash = "sha256-XNFw0h++7B3ODnEi50zd7q/j1bYQzL1IKB2q3p4IzB4=";
   };
 
   outputs = [

From 3f6fdcdde7e94e435c26d375a01adbe79d40c59c Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Mon, 23 Mar 2026 06:48:50 +0000
Subject: [PATCH 49/53] libopenmpt: 0.8.4 -> 0.8.5

Changes: https://lib.openmpt.org/libopenmpt/2026/03/22/security-updates-0.8.5-0.7.18-0.6.27-0.5.41-0.4.53/
(cherry picked from commit 81aba0fbbe17f0b4df0e3d22a7e9d14e8e649555)
---
 pkgs/by-name/li/libopenmpt/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libopenmpt/package.nix b/pkgs/by-name/li/libopenmpt/package.nix
index 59c06637b4831..2bef845c342ad 100644
--- a/pkgs/by-name/li/libopenmpt/package.nix
+++ b/pkgs/by-name/li/libopenmpt/package.nix
@@ -17,7 +17,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libopenmpt";
-  version = "0.8.4";
+  version = "0.8.5";
 
   outputs = [
     "out"
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://lib.openmpt.org/files/libopenmpt/src/libopenmpt-${version}+release.autotools.tar.gz";
-    hash = "sha256-Yn+b8RqsrmFaHyyYLH6IyyHxGy1vAmeUb3yCxerklDs=";
+    hash = "sha256-9oCuq7P4TDcWna2H8V7YPymm67x/aJ+RLU2r7P8OMyQ=";
   };
 
   enableParallelBuilding = true;

From 1faaf002795aa3ac6c5fa219ec1727a7e5844724 Mon Sep 17 00:00:00 2001
From: Antoine du Hamel <duhamelantoine1995@gmail.com>
Date: Tue, 24 Mar 2026 21:40:38 +0100
Subject: [PATCH 50/53] nodejs_22: 22.22.1 -> 22.22.2

(cherry picked from commit c8aca3c231b6b39f945fae8c18cee5d7e786117a)
---
 pkgs/development/web/nodejs/v22.nix | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/web/nodejs/v22.nix b/pkgs/development/web/nodejs/v22.nix
index 5ea3155a048f7..d5aabb16c4b5c 100644
--- a/pkgs/development/web/nodejs/v22.nix
+++ b/pkgs/development/web/nodejs/v22.nix
@@ -17,14 +17,16 @@ let
 
   gypPatches =
     if stdenv.buildPlatform.isDarwin then
-      callPackage ./gyp-patches.nix { patch_tools = false; }
+      [
+        ./gyp-patches-set-fallback-value-for-CLT-darwin.patch
+      ]
     else
       [ ];
 in
 buildNodejs {
   inherit enableNpm;
-  version = "22.22.1";
-  sha256 = "87104b07e7acee748bcc5391e1bc69cf3571caa0fdfb8b1d6b5fd3f9599b7849";
+  version = "22.22.2";
+  sha256 = "b6bedd3a8cacd5df7df015a5088264b12c74a277ba60684cb9642ae8eb743132";
   patches =
     (
       if (stdenv.hostPlatform.emulatorAvailable buildPackages) then

From eeeb51f4e76cd22518b409943abc629f8292b549 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Mon, 23 Mar 2026 15:39:37 -0700
Subject: [PATCH 51/53] imagemagick: 7.1.2-17 -> 7.1.2-18

Diff: https://github.com/ImageMagick/ImageMagick/compare/7.1.2-17...7.1.2-18

Changelog: https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
(cherry picked from commit 0cda1bf293132a62a25956068b788dffd56c67f4)
---
 pkgs/applications/graphics/ImageMagick/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/graphics/ImageMagick/default.nix b/pkgs/applications/graphics/ImageMagick/default.nix
index 68d0fb7190b33..804d858bf078e 100644
--- a/pkgs/applications/graphics/ImageMagick/default.nix
+++ b/pkgs/applications/graphics/ImageMagick/default.nix
@@ -85,13 +85,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "imagemagick";
-  version = "7.1.2-17";
+  version = "7.1.2-18";
 
   src = fetchFromGitHub {
     owner = "ImageMagick";
     repo = "ImageMagick";
     tag = finalAttrs.version;
-    hash = "sha256-niqHdNrFMwIr+9560vceRn0LyJPi6DIp6qCn5GlcVjY=";
+    hash = "sha256-bt8PlCeEWaRsdMe/FP4HSgmzi1OATjH2Kx233OgleyI=";
   };
 
   outputs = [

From b90d9c1719ab807da4432e5261f729c3aa0f64d8 Mon Sep 17 00:00:00 2001
From: Adrian Pistol <vifino@posteo.net>
Date: Mon, 23 Mar 2026 14:15:26 +0100
Subject: [PATCH 52/53] wolfssl: 5.8.4 -> 5.9.0

(cherry picked from commit ed182b540c16582c6d094f9a92fd8c09ac96d129)
---
 pkgs/by-name/wo/wolfssl/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/wo/wolfssl/package.nix b/pkgs/by-name/wo/wolfssl/package.nix
index e904c4dfefcca..52c0d752dc0ab 100644
--- a/pkgs/by-name/wo/wolfssl/package.nix
+++ b/pkgs/by-name/wo/wolfssl/package.nix
@@ -17,13 +17,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "wolfssl-${variant}";
-  version = "5.8.4";
+  version = "5.9.0";
 
   src = fetchFromGitHub {
     owner = "wolfSSL";
     repo = "wolfssl";
     tag = "v${finalAttrs.version}-stable";
-    hash = "sha256-vfJKmDdM0r591t5GnuSS7NyiUYXCQOTKbWLVydB3N9s=";
+    hash = "sha256-Ov59Zt0UskADQThdzr9wni2junSpy3jiABWpiGr8xtg=";
   };
 
   postPatch = ''

From 40b0431e7a0805121ac621db63cedc7611234ec5 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 27 Mar 2026 03:33:36 +0000
Subject: [PATCH 53/53] bind: 9.20.18 -> 9.20.21

(cherry picked from commit 98b37f726dcab9347ba1203ea0597d44942b80d9)
---
 pkgs/by-name/bi/bind/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/bi/bind/package.nix b/pkgs/by-name/bi/bind/package.nix
index c49ae029d7fa6..0c4a7dd864618 100644
--- a/pkgs/by-name/bi/bind/package.nix
+++ b/pkgs/by-name/bi/bind/package.nix
@@ -29,11 +29,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "bind";
-  version = "9.20.18";
+  version = "9.20.21";
 
   src = fetchurl {
     url = "https://downloads.isc.org/isc/bind9/${finalAttrs.version}/bind-${finalAttrs.version}.tar.xz";
-    hash = "sha256-38VGyZCsRRVSnNRcTdmVhisYrootDLKSCOiJal0yUzE=";
+    hash = "sha256-FeG1oifSiQ98ToI6bqAY3nDuLzoOhZy/89gqrYWQ3gM=";
   };
 
   outputs = [