From f39a87c786530afecb9c71c375c017415b9c5ed6 Mon Sep 17 00:00:00 2001
From: Marcin Serwin <marcin@serwin.dev>
Date: Wed, 15 Apr 2026 18:22:45 +0200
Subject: [PATCH 01/42] SDL2_image: 2.8.8 -> 2.8.10

Signed-off-by: Marcin Serwin <marcin@serwin.dev>
(cherry picked from commit af8ed54e68b17685d4b11e2790a0ea1322472251)
---
 pkgs/by-name/sd/SDL2_image/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/sd/SDL2_image/package.nix b/pkgs/by-name/sd/SDL2_image/package.nix
index 4b60b11eecc4a..7c8c2263efb09 100644
--- a/pkgs/by-name/sd/SDL2_image/package.nix
+++ b/pkgs/by-name/sd/SDL2_image/package.nix
@@ -18,11 +18,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "SDL2_image";
-  version = "2.8.8";
+  version = "2.8.10";
 
   src = fetchurl {
     url = "https://www.libsdl.org/projects/SDL_image/release/SDL2_image-${finalAttrs.version}.tar.gz";
-    hash = "sha256-IhO1b9r/IiDQ44yOQgy+GoPIc3QZDLqMcK8hVgl84wo=";
+    hash = "sha256-68BZ0BwAemL0sE8Qz4WFJ8h1BiUyKWlDF035qAJk/WU=";
   };
 
   nativeBuildInputs = [

From 7900c8248c9de3cda0b90486b1a5a073589048e5 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Thu, 23 Apr 2026 22:11:02 +0100
Subject: [PATCH 02/42] tzdata: 2026a -> 2026b

Changes: https://lists.iana.org/hyperkitty/list/tz-announce@iana.org/thread/VX2Z3CBO6KHTYZNBBKFFWM7ZCI6TVCXP/
(cherry picked from commit 28f2c00b143150689ef0220a07bca5b02c754797)
---
 pkgs/by-name/tz/tzdata/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/tz/tzdata/package.nix b/pkgs/by-name/tz/tzdata/package.nix
index 7c03fb60b296c..b110696273a10 100644
--- a/pkgs/by-name/tz/tzdata/package.nix
+++ b/pkgs/by-name/tz/tzdata/package.nix
@@ -8,16 +8,16 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "tzdata";
-  version = "2026a";
+  version = "2026b";
 
   srcs = [
     (fetchurl {
       url = "https://data.iana.org/time-zones/releases/tzdata${finalAttrs.version}.tar.gz";
-      hash = "sha256-d7VBclk3u1O9kr1ITAtDvshUXi00Me4B8E748iA7orc=";
+      hash = "sha256-EUVD2fGaa/61vKQ2hq6hc9OHVaPbHy7sESZHrpLG9UQ=";
     })
     (fetchurl {
       url = "https://data.iana.org/time-zones/releases/tzcode${finalAttrs.version}.tar.gz";
-      hash = "sha256-+AoXou3dK1QEH5yY11sKqAOLAW18XecokqFG2ZOHQOE=";
+      hash = "sha256-N+nthCf101IcIvxY4pPL+wQ9cO7fEAOHCzPzY/Yco0Q=";
     })
   ];
 

From 5568b8b2c5332fe3670e12828b618d274d2e3345 Mon Sep 17 00:00:00 2001
From: Michael Daniels <mdaniels5757@gmail.com>
Date: Sun, 11 Jan 2026 21:24:57 -0500
Subject: [PATCH 03/42] python3Packages.tzdata: 2025.2 -> 2025.3

(cherry picked from commit f5d161248b32b5a2e63c8d2f3b7ee5721b2da5d0)
---
 pkgs/development/python-modules/tzdata/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/tzdata/default.nix b/pkgs/development/python-modules/tzdata/default.nix
index 889178fea5bb8..a7b927bfce3e4 100644
--- a/pkgs/development/python-modules/tzdata/default.nix
+++ b/pkgs/development/python-modules/tzdata/default.nix
@@ -11,12 +11,12 @@
 
 buildPythonPackage rec {
   pname = "tzdata";
-  version = "2025.2";
+  version = "2025.3";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-tgpjj8wNr/rfgv4PV+U9Br3sLzbE32YoCuebzmvW8rk=";
+    hash = "sha256-3jnCyl3HsDRPLrqG9J1hQBnSnwYPxOvIpBeJamILVqc=";
   };
 
   nativeBuildInputs = [ setuptools ];

From c8823d3aa727e383fa6d83d28fd52906c04d2523 Mon Sep 17 00:00:00 2001
From: Michael Daniels <mdaniels5757@gmail.com>
Date: Fri, 3 Apr 2026 17:41:07 -0400
Subject: [PATCH 04/42] python3Packages.tzdata: 2025.3 -> 2026.1

Changelog: https://github.com/python/tzdata/blob/2026.1/NEWS.md
(cherry picked from commit fa824fe25a10b042f427be21b187c9f5d68adb05)
---
 pkgs/development/python-modules/tzdata/default.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/tzdata/default.nix b/pkgs/development/python-modules/tzdata/default.nix
index a7b927bfce3e4..5f424c1b175e3 100644
--- a/pkgs/development/python-modules/tzdata/default.nix
+++ b/pkgs/development/python-modules/tzdata/default.nix
@@ -11,12 +11,12 @@
 
 buildPythonPackage rec {
   pname = "tzdata";
-  version = "2025.3";
+  version = "2026.1";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-3jnCyl3HsDRPLrqG9J1hQBnSnwYPxOvIpBeJamILVqc=";
+    hash = "sha256-Z2WKGQPHWRcwnnU/3DSawO/Ywn23oMtAaiW+SED4f5g=";
   };
 
   nativeBuildInputs = [ setuptools ];
@@ -30,6 +30,7 @@ buildPythonPackage rec {
   pythonImportsCheck = [ "tzdata" ];
 
   meta = {
+    changelog = "https://github.com/python/tzdata/blob/${version}/NEWS.md";
     description = "Provider of IANA time zone data";
     homepage = "https://github.com/python/tzdata";
     license = lib.licenses.asl20;

From 3a976899661c4c36263e10a7a267148cd9c46466 Mon Sep 17 00:00:00 2001
From: Michael Daniels <mdaniels5757@gmail.com>
Date: Fri, 24 Apr 2026 18:38:01 -0400
Subject: [PATCH 05/42] python3Packages.tzdata: 2026.1 -> 2026.2

Changelog: https://github.com/python/tzdata/blob/2026.2/NEWS.md
(cherry picked from commit b68a43f8645dc95fd2b4a18e02d3ae9650c546be)
---
 pkgs/development/python-modules/tzdata/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/tzdata/default.nix b/pkgs/development/python-modules/tzdata/default.nix
index 5f424c1b175e3..c7ef6c27b6486 100644
--- a/pkgs/development/python-modules/tzdata/default.nix
+++ b/pkgs/development/python-modules/tzdata/default.nix
@@ -11,12 +11,12 @@
 
 buildPythonPackage rec {
   pname = "tzdata";
-  version = "2026.1";
+  version = "2026.2";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Z2WKGQPHWRcwnnU/3DSawO/Ywn23oMtAaiW+SED4f5g=";
+    hash = "sha256-kXP959gNkBjgKmYuFo5aLQT4fEHqF0sTn772Qu2mLRA=";
   };
 
   nativeBuildInputs = [ setuptools ];

From ca8c801ec52aa04ec5a175d450bc81d132c2b1ce Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Thu, 23 Apr 2026 21:01:56 -0700
Subject: [PATCH 06/42] imagemagick: 7.1.2-19 -> 7.1.2-21

Diff: https://github.com/ImageMagick/ImageMagick/compare/7.1.2-19...7.1.2-21

Changelog: https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
(cherry picked from commit e3733092cb9688c38f99b4a84ab6e82ec6606a10)
---
 pkgs/applications/graphics/ImageMagick/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/graphics/ImageMagick/default.nix b/pkgs/applications/graphics/ImageMagick/default.nix
index 8114fac32fe78..b6aff2bfc6460 100644
--- a/pkgs/applications/graphics/ImageMagick/default.nix
+++ b/pkgs/applications/graphics/ImageMagick/default.nix
@@ -85,13 +85,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "imagemagick";
-  version = "7.1.2-19";
+  version = "7.1.2-21";
 
   src = fetchFromGitHub {
     owner = "ImageMagick";
     repo = "ImageMagick";
     tag = finalAttrs.version;
-    hash = "sha256-4uASM+GRTe0ES6FdshUMMkVof4IlLV+CMm2l+v5qZN0=";
+    hash = "sha256-eYrAj3kUGXgAdxohzn46MBuIjLAaQ1HGUEky3SSzh1U=";
   };
 
   outputs = [

From eacbc39040f33ca49b40abc26ed0c1fe66c85a25 Mon Sep 17 00:00:00 2001
From: Morgan Jones <me@numin.it>
Date: Mon, 13 Apr 2026 02:26:57 -0700
Subject: [PATCH 07/42] openssh_gssapi: 10.2p1 -> 10.3p1

(cherry picked from commit 52b76ad35e1aa02a88c7dae82ac6d74f6c86da3f)
---
 pkgs/tools/networking/openssh/default.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/tools/networking/openssh/default.nix b/pkgs/tools/networking/openssh/default.nix
index 35ece9ce73963..aeaaf85ac1484 100644
--- a/pkgs/tools/networking/openssh/default.nix
+++ b/pkgs/tools/networking/openssh/default.nix
@@ -82,12 +82,12 @@ in
 
   openssh_gssapi = common rec {
     pname = "openssh-with-gssapi";
-    version = "10.2p1";
+    version = "10.3p1";
     extraDesc = " with GSSAPI support";
 
     src = fetchurl {
       url = urlFor version;
-      hash = "sha256-zMQsBBmTeVkmP6Hb0W2vwYxWuYTANWLSk3zlamD3mLI=";
+      hash = "sha256-VmgqNruS3PS08Bb9jsjnQFm3mo3iXBXWcNcx59GORfQ=";
     };
 
     extraPatches = [
@@ -95,8 +95,8 @@ in
 
       (fetchpatch {
         name = "openssh-gssapi.patch";
-        url = "https://salsa.debian.org/ssh-team/openssh/raw/debian/1%2510.2p1-6/debian/patches/gssapi.patch";
-        hash = "sha256-mYrJJrE6l0r/VYLWlOTGkKLzj9Dj4wOLgJyW/NLGaeo=";
+        url = "https://salsa.debian.org/ssh-team/openssh/raw/debian/1%2510.3p1-1/debian/patches/gssapi.patch";
+        hash = "sha256-gs5Vw4f/TDxmme1DbrtgwvWcPGGmYIWE/A4JWa551zA=";
       })
     ];
 

From 4bdfb5318700082ab6a08e97e2383d9ae1e8b35b Mon Sep 17 00:00:00 2001
From: whispers <whispersofthedawn@duck.com>
Date: Fri, 24 Apr 2026 14:34:45 -0400
Subject: [PATCH 08/42] expat: 2.7.5 -> 2.8.0

https://github.com/libexpat/libexpat/blob/R_2_8_0/expat/Changes

Fixes CVE-2026-41080.

(cherry picked from commit c5086c36e4aa0489df1a0fbbc8d28ba9c168cc42)
---
 pkgs/by-name/ex/expat/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ex/expat/package.nix b/pkgs/by-name/ex/expat/package.nix
index a8c982f87805e..cf55e71a2037d 100644
--- a/pkgs/by-name/ex/expat/package.nix
+++ b/pkgs/by-name/ex/expat/package.nix
@@ -18,7 +18,7 @@
 # files.
 
 let
-  version = "2.7.5";
+  version = "2.8.0";
   tag = "R_${lib.replaceStrings [ "." ] [ "_" ] version}";
 in
 stdenv.mkDerivation (finalAttrs: {
@@ -29,7 +29,7 @@ stdenv.mkDerivation (finalAttrs: {
     url =
       with finalAttrs;
       "https://github.com/libexpat/libexpat/releases/download/${tag}/${pname}-${version}.tar.xz";
-    hash = "sha256-EDLf70/xf3BGSCfaooNpsg9lhNEIvDbxerFnbh7dL5E=";
+    hash = "sha256-o3v64KqXdb2FIevYXcRW1Ibw/zETj2yR/ZAupzJiRUI=";
   };
 
   strictDeps = true;

From 6a72380fd848f914e8ed8d2ed4711eceb327c495 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 7 Apr 2026 18:24:27 +0000
Subject: [PATCH 09/42] xdg-dbus-proxy: 0.1.6 -> 0.1.7

(cherry picked from commit a75667a07b61f270a9f8b3ac7b8ff2dd39127bab)
---
 pkgs/by-name/xd/xdg-dbus-proxy/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/xd/xdg-dbus-proxy/package.nix b/pkgs/by-name/xd/xdg-dbus-proxy/package.nix
index 9c661cd0dc0b5..098785d5556cb 100644
--- a/pkgs/by-name/xd/xdg-dbus-proxy/package.nix
+++ b/pkgs/by-name/xd/xdg-dbus-proxy/package.nix
@@ -14,11 +14,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "xdg-dbus-proxy";
-  version = "0.1.6";
+  version = "0.1.7";
 
   src = fetchurl {
     url = "https://github.com/flatpak/xdg-dbus-proxy/releases/download/${finalAttrs.version}/xdg-dbus-proxy-${finalAttrs.version}.tar.xz";
-    hash = "sha256-Exv1n858fufsvF2RBtZ1D09Ze/5gmWZXMkD35JUpc6E=";
+    hash = "sha256-OtPSe6V04XisteTUOLo2rOJeNWT4mcNvMcVvgsetu+c=";
   };
 
   nativeBuildInputs = [

From 6baeefee8a2a177a8bb5c0ed9373b127ce4c29de Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 14 Apr 2026 12:36:22 +0000
Subject: [PATCH 10/42] libexif: 0.6.25 -> 0.6.26

(cherry picked from commit 07f318c8ee924bc70e85499a4d30654826791402)
---
 pkgs/by-name/li/libexif/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libexif/package.nix b/pkgs/by-name/li/libexif/package.nix
index e828aeb8ac23b..35dd579a709bc 100644
--- a/pkgs/by-name/li/libexif/package.nix
+++ b/pkgs/by-name/li/libexif/package.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libexif";
-  version = "0.6.25";
+  version = "0.6.26";
 
   src = fetchFromGitHub {
     owner = "libexif";
     repo = "libexif";
     rev = "libexif-${builtins.replaceStrings [ "." ] [ "_" ] version}-release";
-    sha256 = "sha256-H8YzfNO2FCrYAwEA4bkOpRdxISK9RXaHVuK8zz70TlM=";
+    sha256 = "sha256-H51RlMT3swWF8oLWu70eTnuumee5mRMSCWkMFX7mJSk=";
   };
 
   nativeBuildInputs = [

From 136e5cd77ad246d8c6127d76eef1e46be7917cde Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 29 Apr 2026 15:25:03 +0000
Subject: [PATCH 11/42] unbound-full: 1.24.2 -> 1.25.0

(cherry picked from commit 912b1d9bea17efa06f6e57034d2e52011935023f)
---
 pkgs/by-name/un/unbound/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/un/unbound/package.nix b/pkgs/by-name/un/unbound/package.nix
index caff6ac844558..8dbc9d75866be 100644
--- a/pkgs/by-name/un/unbound/package.nix
+++ b/pkgs/by-name/un/unbound/package.nix
@@ -56,13 +56,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "unbound";
-  version = "1.24.2";
+  version = "1.25.0";
 
   src = fetchFromGitHub {
     owner = "NLnetLabs";
     repo = "unbound";
     tag = "release-${finalAttrs.version}";
-    hash = "sha256-kyTcDmNGKJuOMZ7cxIWh6o7aasRUoAB4M0tIG81BQsE=";
+    hash = "sha256-BAqGNi5lfYYTQd7CPH0lssLc5/AkeuKSVEFcrF/cNyc=";
   };
 
   outputs = [

From 8906001234195cd80417f5035094f00963957358 Mon Sep 17 00:00:00 2001
From: Matt Sturgeon <matt@sturgeon.me.uk>
Date: Thu, 16 Apr 2026 09:11:19 +0100
Subject: [PATCH 12/42] symlinkJoin: support __structuredAttrs

Use the $paths bash array from __structuredAttrs.
Populate it from $pathsPath if passAsFile is used instead.

(cherry picked from commit bc67c840d62b6c09690c722da617781ef3aa6306)
---
 .../build-support/trivial-builders/default.nix |  5 ++++-
 .../trivial-builders/test/symlink-join.nix     | 18 ++++++++++++++++++
 2 files changed, 22 insertions(+), 1 deletion(-)

diff --git a/pkgs/build-support/trivial-builders/default.nix b/pkgs/build-support/trivial-builders/default.nix
index b350d51455cdb..439d28ac0fe83 100644
--- a/pkgs/build-support/trivial-builders/default.nix
+++ b/pkgs/build-support/trivial-builders/default.nix
@@ -620,7 +620,10 @@ rec {
     in
     runCommand name args ''
       mkdir -p $out
-      for i in $(cat $pathsPath); do
+      if [ -n "''${pathsPath:-}" ] && [ -f "$pathsPath" ]; then
+        mapfile -d " " -t paths < "$pathsPath"
+      fi
+      for i in "''${paths[@]}"; do
         ${optionalString (!failOnMissing) "if test -d $i; then "}${lndir}/bin/lndir -silent $i $out${
           optionalString (!failOnMissing) "; fi"
         }
diff --git a/pkgs/build-support/trivial-builders/test/symlink-join.nix b/pkgs/build-support/trivial-builders/test/symlink-join.nix
index d50581d3f38af..4750d9680d4ae 100644
--- a/pkgs/build-support/trivial-builders/test/symlink-join.nix
+++ b/pkgs/build-support/trivial-builders/test/symlink-join.nix
@@ -55,6 +55,24 @@ in
     '';
   };
 
+  symlinkJoin-structured-attrs = testEqualContents {
+    assertion = "symlinkJoin-structured-attrs";
+    actual = symlinkJoin {
+      __structuredAttrs = true;
+      name = "symlinkJoin-structured-attrs";
+      paths = [
+        foo
+        bar
+        baz
+      ];
+    };
+    expected = runCommand "symlinkJoin-foo-bar-baz" { } ''
+      mkdir -p $out/{var/lib/arbitrary,etc/test.d}
+      ln -s {${foo},${bar}}/etc/test.d/* $out/etc/test.d
+      ln -s ${baz}/var/lib/arbitrary/baz $out/var/lib/arbitrary/
+    '';
+  };
+
   symlinkJoin-strip-paths = testEqualContents {
     assertion = "symlinkJoin-strip-paths";
     actual = symlinkJoin {

From 5a79f0d8df2e2168a1bab2c47b9114771caa54a7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Thu, 30 Apr 2026 11:17:42 +0200
Subject: [PATCH 13/42] gnutls: 3.8.12 -> 3.8.13

Fixes 13 CVEs, I think:
https://lists.gnutls.org/pipermail/gnutls-help/2026-April/004922.html

(cherry picked from commit ec9028a2b2f87085205f2a3b6fb36a412094de17)
---
 pkgs/development/libraries/gnutls/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/gnutls/default.nix b/pkgs/development/libraries/gnutls/default.nix
index 360e447e2d463..2ff1bc2af03dc 100644
--- a/pkgs/development/libraries/gnutls/default.nix
+++ b/pkgs/development/libraries/gnutls/default.nix
@@ -59,11 +59,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "gnutls";
-  version = "3.8.12";
+  version = "3.8.13";
 
   src = fetchurl {
     url = "mirror://gnupg/gnutls/v${lib.versions.majorMinor version}/gnutls-${version}.tar.xz";
-    hash = "sha256-p7NBQhv9RZrPejdMpK87ngZgjc1715Kyv0cL6gErjlE=";
+    hash = "sha256-/+2Owb8JwkJtTxSq43feR1O1PlN9aF5gTpmosWypyX4=";
   };
 
   outputs = [

From a89cf9d4abf693204bbc5e116c7afc6f211a37a8 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 5 May 2026 16:21:18 +0200
Subject: [PATCH 14/42] nspr: 4.38.2 -> 4.39

NSPR 4.39 contains the following changes:

- Improved error handling in PR_CreateThread on Windows
- Cleanup and Type-cast fixes for prtime
- Remove unused prstreams C++ wrapper from NSPR
- Memory poisoning and Arena redzone fixes
- Removed emacs/vim modelines and .cvsignore files
- Added .editorconfig

via dev-tech-crypto

(cherry picked from commit 5b3df9d80eb15152f58e130d2a3567626376c33d)
---
 ...OURCE_DATE_EPOCH-for-reproducibility.patch | 53 +++----------------
 pkgs/by-name/ns/nspr/package.nix              |  4 +-
 2 files changed, 9 insertions(+), 48 deletions(-)

diff --git a/pkgs/by-name/ns/nspr/0001-Makefile-use-SOURCE_DATE_EPOCH-for-reproducibility.patch b/pkgs/by-name/ns/nspr/0001-Makefile-use-SOURCE_DATE_EPOCH-for-reproducibility.patch
index d7fec73910fb6..fc2a83851f8db 100644
--- a/pkgs/by-name/ns/nspr/0001-Makefile-use-SOURCE_DATE_EPOCH-for-reproducibility.patch
+++ b/pkgs/by-name/ns/nspr/0001-Makefile-use-SOURCE_DATE_EPOCH-for-reproducibility.patch
@@ -1,20 +1,8 @@
-From e5cc8f7c387e3238ebb8239e2555c933a41502c0 Mon Sep 17 00:00:00 2001
-From: Graham Christensen <graham@grahamc.com>
-Date: Thu, 7 Mar 2019 08:11:32 -0500
-Subject: [PATCH] Makefile: use SOURCE_DATE_EPOCH for reproducibility
-
----
- nspr/lib/ds/Makefile.in        | 4 ++--
- nspr/lib/libc/src/Makefile.in  | 4 ++--
- nspr/lib/prstreams/Makefile.in | 4 ++--
- nspr/pr/src/Makefile.in        | 6 +++---
- 4 files changed, 9 insertions(+), 9 deletions(-)
-
 diff --git a/nspr/lib/ds/Makefile.in b/nspr/lib/ds/Makefile.in
-index e737791..d56b0a7 100644
+index fa8c783..eff1ac3 100644
 --- a/nspr/lib/ds/Makefile.in
 +++ b/nspr/lib/ds/Makefile.in
-@@ -101,8 +101,8 @@ ECHO = echo
+@@ -91,8 +91,8 @@ ECHO = echo
  TINC = $(OBJDIR)/_pl_bld.h
  PROD = $(notdir $(SHARED_LIBRARY))
  NOW = $(MOD_DEPTH)/config/$(OBJDIR)/now
@@ -26,10 +14,10 @@ index e737791..d56b0a7 100644
  ifeq ($(NS_USE_GCC)_$(OS_ARCH),_WINNT)
  	SUF = i64
 diff --git a/nspr/lib/libc/src/Makefile.in b/nspr/lib/libc/src/Makefile.in
-index e8a6d9f..0485737 100644
+index 9ef2007..2d5db8f 100644
 --- a/nspr/lib/libc/src/Makefile.in
 +++ b/nspr/lib/libc/src/Makefile.in
-@@ -103,8 +103,8 @@ ECHO = echo
+@@ -93,8 +93,8 @@ ECHO = echo
  TINC = $(OBJDIR)/_pl_bld.h
  PROD = $(notdir $(SHARED_LIBRARY))
  NOW = $(MOD_DEPTH)/config/$(OBJDIR)/now
@@ -40,36 +28,12 @@ index e8a6d9f..0485737 100644
  
  ifeq ($(NS_USE_GCC)_$(OS_ARCH),_WINNT)
  	SUF = i64
-diff --git a/nspr/lib/prstreams/Makefile.in b/nspr/lib/prstreams/Makefile.in
-index aeb2944..83ae423 100644
---- a/nspr/lib/prstreams/Makefile.in
-+++ b/nspr/lib/prstreams/Makefile.in
-@@ -105,8 +105,8 @@ ECHO = echo
- TINC = $(OBJDIR)/_pl_bld.h
- PROD = $(notdir $(SHARED_LIBRARY))
- NOW = $(MOD_DEPTH)/config/$(OBJDIR)/now
--SH_DATE = $(shell date "+%Y-%m-%d %T")
--SH_NOW = $(shell $(NOW))
-+SH_DATE = $(shell date "+%Y-%m-%d %T" --date $(SOURCE_DATE_EPOCH))
-+SH_NOW = $(SOURCE_DATE_EPOCH)000000
- 
- ifeq ($(OS_ARCH), WINNT)
- 	SUF = i64
 diff --git a/nspr/pr/src/Makefile.in b/nspr/pr/src/Makefile.in
-index 19c5a69..989cc8c 100644
+index a9e86f5..854c0a9 100644
 --- a/nspr/pr/src/Makefile.in
 +++ b/nspr/pr/src/Makefile.in
-@@ -46,7 +46,7 @@ MKSHLIB += -M $(MAPFILE)
- endif
- #
- # In Solaris 2.6 or earlier, -lrt is called -lposix4.
--# 
-+#
- LIBRT_TEST=$(firstword $(sort 5.7 $(OS_RELEASE)))
- ifeq (5.7, $(LIBRT_TEST))
- LIBRT=-lrt
-@@ -311,8 +311,8 @@ PROD = $(notdir $(SHARED_LIBRARY))
- endif
+@@ -276,8 +276,8 @@ TINC = $(OBJDIR)/_pr_bld.h
+ PROD = $(notdir $(SHARED_LIBRARY))
  
  NOW = $(MOD_DEPTH)/config/$(OBJDIR)/now
 -SH_DATE = $(shell date "+%Y-%m-%d %T")
@@ -79,6 +43,3 @@ index 19c5a69..989cc8c 100644
  
  ifeq ($(NS_USE_GCC)_$(OS_ARCH),_WINNT)
  	SUF = i64
--- 
-2.19.2
-
diff --git a/pkgs/by-name/ns/nspr/package.nix b/pkgs/by-name/ns/nspr/package.nix
index 17c2058403778..9dc78e0726c6c 100644
--- a/pkgs/by-name/ns/nspr/package.nix
+++ b/pkgs/by-name/ns/nspr/package.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation rec {
   pname = "nspr";
-  version = "4.38.2";
+  version = "4.39";
 
   src = fetchurl {
     url = "mirror://mozilla/nspr/releases/v${version}/src/nspr-${version}.tar.gz";
-    hash = "sha256-5Akvrqt3vcmzLbERPkIVlI7naOJsRmbbO1pgs18skQU=";
+    hash = "sha256-u9Au6HpVZ2Bjpj5byBngIn3iZmtHMHsqATRBTN9CNo4=";
   };
 
   patches = [

From 688950d1916e678a96f84d166623c00f61f5137b Mon Sep 17 00:00:00 2001
From: Yarny0 <41838844+Yarny0@users.noreply.github.com>
Date: Tue, 28 Apr 2026 12:07:47 +0200
Subject: [PATCH 15/42] cups: migrate to `finalAttrs`

(cherry picked from commit 84e12b93615cb9ff9aead062ebc01155722e6b12)
---
 pkgs/by-name/cu/cups/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/cu/cups/package.nix b/pkgs/by-name/cu/cups/package.nix
index bed46c4cfc5fa..9b52c3677adf6 100644
--- a/pkgs/by-name/cu/cups/package.nix
+++ b/pkgs/by-name/cu/cups/package.nix
@@ -23,12 +23,12 @@
   nixosTests,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "cups";
   version = "2.4.16";
 
   src = fetchurl {
-    url = "https://github.com/OpenPrinting/cups/releases/download/v${version}/cups-${version}-source.tar.gz";
+    url = "https://github.com/OpenPrinting/cups/releases/download/v${finalAttrs.version}/cups-${finalAttrs.version}-source.tar.gz";
     hash = "sha256-AzlYcgS0+UKN0FkuswHewL+epuqNzl2WkNVr5YWrqS0=";
   };
 
@@ -183,4 +183,4 @@ stdenv.mkDerivation rec {
     maintainers = with lib.maintainers; [ matthewbauer ];
     platforms = lib.platforms.unix;
   };
-}
+})

From c50a72149120e3fdbc4f351abec8c5a8376dd9cd Mon Sep 17 00:00:00 2001
From: Yarny0 <41838844+Yarny0@users.noreply.github.com>
Date: Tue, 28 Apr 2026 12:09:06 +0200
Subject: [PATCH 16/42] cups: enable `__structuredAttrs`

(cherry picked from commit fc3d40744435510b2538f0c98d17892fbbbd510d)
---
 pkgs/by-name/cu/cups/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/cu/cups/package.nix b/pkgs/by-name/cu/cups/package.nix
index 9b52c3677adf6..2cc362577711b 100644
--- a/pkgs/by-name/cu/cups/package.nix
+++ b/pkgs/by-name/cu/cups/package.nix
@@ -32,6 +32,8 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-AzlYcgS0+UKN0FkuswHewL+epuqNzl2WkNVr5YWrqS0=";
   };
 
+  __structuredAttrs = true;
+
   outputs = [
     "out"
     "lib"

From d0f98b6468d703c4abd79b56abdb4b3de6556188 Mon Sep 17 00:00:00 2001
From: Yarny0 <41838844+Yarny0@users.noreply.github.com>
Date: Tue, 28 Apr 2026 12:09:58 +0200
Subject: [PATCH 17/42] cups: enable `strictDeps`

(cherry picked from commit 996cb7716a290b80edcf93b0a390a3414ca98b02)
---
 pkgs/by-name/cu/cups/package.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/by-name/cu/cups/package.nix b/pkgs/by-name/cu/cups/package.nix
index 2cc362577711b..c0d197bf93935 100644
--- a/pkgs/by-name/cu/cups/package.nix
+++ b/pkgs/by-name/cu/cups/package.nix
@@ -33,6 +33,7 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   __structuredAttrs = true;
+  strictDeps = true;
 
   outputs = [
     "out"

From 84f7c0e3a3ec67b2e1b254b0463436749f8612ef Mon Sep 17 00:00:00 2001
From: Yarny0 <41838844+Yarny0@users.noreply.github.com>
Date: Tue, 28 Apr 2026 12:19:04 +0200
Subject: [PATCH 18/42] cups: 2.4.16 -> 2.4.19

https://github.com/OpenPrinting/cups/releases/tag/v2.4.17 (8 CVEs)
https://github.com/OpenPrinting/cups/releases/tag/v2.4.18
https://github.com/OpenPrinting/cups/releases/tag/v2.4.19
(cherry picked from commit fe6b3b95c3e35b6abb3c8df2b8c00f7058290a9e)
---
 pkgs/by-name/cu/cups/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/cu/cups/package.nix b/pkgs/by-name/cu/cups/package.nix
index c0d197bf93935..c5ddf3ba28a06 100644
--- a/pkgs/by-name/cu/cups/package.nix
+++ b/pkgs/by-name/cu/cups/package.nix
@@ -25,11 +25,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "cups";
-  version = "2.4.16";
+  version = "2.4.19";
 
   src = fetchurl {
     url = "https://github.com/OpenPrinting/cups/releases/download/v${finalAttrs.version}/cups-${finalAttrs.version}-source.tar.gz";
-    hash = "sha256-AzlYcgS0+UKN0FkuswHewL+epuqNzl2WkNVr5YWrqS0=";
+    hash = "sha256-ggmEsSpn+YcFeFquLdE0f+CsCXgoAB1Fg/9kV0rtY4k=";
   };
 
   __structuredAttrs = true;

From 50b848d95250b40134e6c58b47d31bec33c6404f Mon Sep 17 00:00:00 2001
From: Hythera <87016780+Hythera@users.noreply.github.com>
Date: Sun, 3 May 2026 14:40:33 +0200
Subject: [PATCH 19/42] libssh2: apply patch for CVE-2026-7598

(cherry picked from commit df1eba6695aef6f276903f7c90032079cb270f48)
---
 pkgs/by-name/li/libssh2/CVE-2026-7598.patch | 38 +++++++++++++++++++++
 pkgs/by-name/li/libssh2/package.nix         |  5 +++
 2 files changed, 43 insertions(+)
 create mode 100644 pkgs/by-name/li/libssh2/CVE-2026-7598.patch

diff --git a/pkgs/by-name/li/libssh2/CVE-2026-7598.patch b/pkgs/by-name/li/libssh2/CVE-2026-7598.patch
new file mode 100644
index 0000000000000..b35b0ed7b56da
--- /dev/null
+++ b/pkgs/by-name/li/libssh2/CVE-2026-7598.patch
@@ -0,0 +1,38 @@
+diff --git a/src/userauth.c b/src/userauth.c
+index f8e02651c4..43d9ab9b9d 100644
+--- a/src/userauth.c
++++ b/src/userauth.c
+@@ -80,6 +80,12 @@ static char *userauth_list(LIBSSH2_SESSION *session, const char *username,
+         memset(&session->userauth_list_packet_requirev_state, 0,
+                sizeof(session->userauth_list_packet_requirev_state));
+ 
++        if(username_len > UINT32_MAX - 27) {
++            _libssh2_error(session, LIBSSH2_ERROR_PROTO,
++                           "username_len out of bounds");
++            return NULL;
++        }
++
+         session->userauth_list_data_len = username_len + 27;
+ 
+         if(session->userauth_list_data) {
+@@ -316,6 +322,11 @@ userauth_password(LIBSSH2_SESSION *session,
+          * 40 = packet_type(1) + username_len(4) + service_len(4) +
+          * service(14)"ssh-connection" + method_len(4) + method(8)"password" +
+          * chgpwdbool(1) + password_len(4) */
++        if(username_len > UINT32_MAX - 40) {
++            return _libssh2_error(session, LIBSSH2_ERROR_PROTO,
++                                  "username_len out of bounds");
++        }
++
+         session->userauth_pswd_data_len = username_len + 40;
+ 
+         session->userauth_pswd_data0 =
+@@ -456,7 +467,7 @@ userauth_password(LIBSSH2_SESSION *session,
+                         }
+ 
+                         /* basic data_len + newpw_len(4) */
+-                        if(username_len + password_len + 44 <= UINT_MAX) {
++                        if(username_len <= UINT32_MAX - password_len - 44) {
+                             session->userauth_pswd_data_len =
+                                 username_len + password_len + 44;
+                             s = session->userauth_pswd_data =
diff --git a/pkgs/by-name/li/libssh2/package.nix b/pkgs/by-name/li/libssh2/package.nix
index eaef9807c897e..7702c4bd1eebe 100644
--- a/pkgs/by-name/li/libssh2/package.nix
+++ b/pkgs/by-name/li/libssh2/package.nix
@@ -23,6 +23,11 @@ stdenv.mkDerivation rec {
     hash = "sha256-2ex2y+NNuY7sNTn+LImdJrDIN8s+tGalaw8QnKv2WPc=";
   };
 
+  patches = [
+    # https://github.com/libssh2/libssh2/commit/256d04b60d80bf1190e96b0ad1e91b2174d744b1
+    ./CVE-2026-7598.patch
+  ];
+
   # this could be accomplished by updateAutotoolsGnuConfigScriptsHook, but that causes infinite recursion
   # necessary for FreeBSD code path in configure
   postPatch = ''

From 113894b496771eed5a896a51aceaf96e1c306fff Mon Sep 17 00:00:00 2001
From: Sefa Eyeoglu <contact@scrumplex.net>
Date: Wed, 29 Apr 2026 12:39:44 +0200
Subject: [PATCH 20/42] curlMinimal: 8.19.0 -> 8.20.0

https://github.com/curl/curl/releases/curl-8_20_0

Signed-off-by: Sefa Eyeoglu <contact@scrumplex.net>
(cherry picked from commit d67855994d6cac386faaf6c33adf084d896dcdbc)
---
 pkgs/by-name/cu/curlMinimal/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/cu/curlMinimal/package.nix b/pkgs/by-name/cu/curlMinimal/package.nix
index e49cc075b43ac..a101fc50ed422 100644
--- a/pkgs/by-name/cu/curlMinimal/package.nix
+++ b/pkgs/by-name/cu/curlMinimal/package.nix
@@ -86,7 +86,7 @@ assert
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "curl";
-  version = "8.19.0";
+  version = "8.20.0";
 
   src = fetchurl {
     urls = [
@@ -95,7 +95,7 @@ stdenv.mkDerivation (finalAttrs: {
         builtins.replaceStrings [ "." ] [ "_" ] finalAttrs.version
       }/curl-${finalAttrs.version}.tar.xz"
     ];
-    hash = "sha256-TrQUiXkNGeGQ16x+GOgoV83Wivj05mspLO1WLTM/Ed8=";
+    hash = "sha256-Y/4twUi6DOromSLvg49+XJRicsLni3xZ+rS3nTziuJY=";
   };
 
   # this could be accomplished by updateAutotoolsGnuConfigScriptsHook, but that causes infinite recursion

From 238424aefa27b5b3a221dfb0a9c730e41e65f759 Mon Sep 17 00:00:00 2001
From: Marcin Serwin <marcin@serwin.dev>
Date: Mon, 27 Apr 2026 16:23:03 +0200
Subject: [PATCH 21/42] mbedtls: 3.6.5 -> 3.6.6

Signed-off-by: Marcin Serwin <marcin@serwin.dev>
(cherry picked from commit dde2aba74fff3c283e845f3899e864c1493574d6)
---
 pkgs/development/libraries/mbedtls/3.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/mbedtls/3.nix b/pkgs/development/libraries/mbedtls/3.nix
index f9ddbfd83d821..44fde80fa51d1 100644
--- a/pkgs/development/libraries/mbedtls/3.nix
+++ b/pkgs/development/libraries/mbedtls/3.nix
@@ -1,8 +1,8 @@
 { callPackage, fetchurl }:
 
 callPackage ./generic.nix {
-  version = "3.6.5";
-  hash = "sha256-CAMksh7i4mg5zVTYLB/SZWFVmgQBMhPnislLCD9j7+o=";
+  version = "3.6.6";
+  hash = "sha256-+PW41/c8M/Yz0EVWM4Gt4HTNBMUTU5MayaKVZ+upLIo=";
 
   patches = [
     # Fixes the build with GCC 14 on aarch64.

From c2188c3cc34299a5bb4dbd83057e56f7af71e088 Mon Sep 17 00:00:00 2001
From: Tom Herbers <mail@tomherbers.de>
Date: Thu, 7 May 2026 19:02:35 +0200
Subject: [PATCH 22/42] go_1_25: 1.25.9 -> 1.25.10

Changelog: https://go.dev/doc/devel/release#go1.25.minor
(cherry picked from commit f71a37203b0c0b9af47e3f60f801bec8861a54f1)
---
 pkgs/development/compilers/go/1.25.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/compilers/go/1.25.nix b/pkgs/development/compilers/go/1.25.nix
index ed7f243279a1c..65070926dcb91 100644
--- a/pkgs/development/compilers/go/1.25.nix
+++ b/pkgs/development/compilers/go/1.25.nix
@@ -25,11 +25,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "go";
-  version = "1.25.9";
+  version = "1.25.10";
 
   src = fetchurl {
     url = "https://go.dev/dl/go${finalAttrs.version}.src.tar.gz";
-    hash = "sha256-DsnvjrzqCXqsN97K6fCachi0Uc2Wvn1u1RPY5Lz5Cc8=";
+    hash = "sha256-IM8EqS5a+ZdI40G8iZb6KAkMmsmHZfoRXsXd9B169B0=";
   };
 
   strictDeps = true;

From e9477add3746e2dce996faa3feee055222d32491 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 26 Apr 2026 14:10:36 +0000
Subject: [PATCH 23/42] openexr: 3.3.8 -> 3.4.10

(cherry picked from commit 1c511cda0ff7a81418ad8b5ca09f8518cad85122)
---
 pkgs/development/libraries/openexr/3.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/openexr/3.nix b/pkgs/development/libraries/openexr/3.nix
index 70353953b6421..11d5c376c025b 100644
--- a/pkgs/development/libraries/openexr/3.nix
+++ b/pkgs/development/libraries/openexr/3.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "openexr";
-  version = "3.3.8";
+  version = "3.4.10";
 
   src = fetchFromGitHub {
     owner = "AcademySoftwareFoundation";
     repo = "openexr";
     rev = "v${version}";
-    hash = "sha256-bJJdfr+OybCl8L27m1uRynGaU1V8D70bSzQjkDuqMDU=";
+    hash = "sha256-jXio+PvagKTR8NjcYIQ/j8LOMNc/0sQBuaixKk/0V3k=";
   };
 
   outputs = [

From eb9edd8e6e25c588b98fc3eb9be11b19af60a823 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sun, 5 Apr 2026 15:17:36 +0200
Subject: [PATCH 24/42] python3Packages.pillow: 12.1.1 -> 12.2.0

https://pillow.readthedocs.io/en/stable/releasenotes/12.2.0.html
(cherry picked from commit 7a19eeb8ee773a6375fc14d276ecf5912f742f66)
---
 pkgs/development/python-modules/pillow/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pillow/default.nix b/pkgs/development/python-modules/pillow/default.nix
index 94debf52dc9d3..057391033b0f8 100644
--- a/pkgs/development/python-modules/pillow/default.nix
+++ b/pkgs/development/python-modules/pillow/default.nix
@@ -45,14 +45,14 @@
 
 buildPythonPackage rec {
   pname = "pillow";
-  version = "12.1.1";
+  version = "12.2.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "python-pillow";
     repo = "pillow";
     tag = version;
-    hash = "sha256-NlmNabyoHiakwvomjivTA7N304ovNCMDSaBLSmcmZ7w=";
+    hash = "sha256-7w6FbZLTAoUMvLtSPvafk3wSRv8TrkAAfgZ/dfu3HpA=";
   };
 
   patches = [

From ad3214aeac5455e718dc33843b93086393554910 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sun, 10 May 2026 20:30:27 +0200
Subject: [PATCH 25/42] Revert "python3Packages.pillow: apply patch for
 CVE-2026-40192"

This reverts commit 267afd619efc138ac230b285ae924faec4b9bb43.

Obsoleted by bumping to 12.2.0.
---
 pkgs/development/python-modules/pillow/default.nix | 10 ----------
 1 file changed, 10 deletions(-)

diff --git a/pkgs/development/python-modules/pillow/default.nix b/pkgs/development/python-modules/pillow/default.nix
index 057391033b0f8..a359041b44e2b 100644
--- a/pkgs/development/python-modules/pillow/default.nix
+++ b/pkgs/development/python-modules/pillow/default.nix
@@ -4,7 +4,6 @@
   buildPythonPackage,
   pythonOlder,
   fetchFromGitHub,
-  fetchpatch,
 
   # build-system
   setuptools,
@@ -55,15 +54,6 @@ buildPythonPackage rec {
     hash = "sha256-7w6FbZLTAoUMvLtSPvafk3wSRv8TrkAAfgZ/dfu3HpA=";
   };
 
-  patches = [
-    (fetchpatch {
-      # https://github.com/python-pillow/Pillow/security/advisories/GHSA-whj4-6x5x-4v2j
-      name = "CVE-2026-40192.patch";
-      url = "https://github.com/python-pillow/Pillow/commit/3cb854e8b2bab43f40e342e665f9340d861aa628.patch";
-      hash = "sha256-7Hh72WoD7Iy/aB1J7w5X6ge3wx4lPWAQrOR6luO0FOg=";
-    })
-  ];
-
   build-system = [
     setuptools
     pybind11

From 7b7687447f8f6392af7684caedf42d588f01ed31 Mon Sep 17 00:00:00 2001
From: whispers <whispersofthedawn@duck.com>
Date: Mon, 11 May 2026 17:42:53 -0400
Subject: [PATCH 26/42] expat: 2.8.0 -> 2.8.1

Changelog: https://github.com/libexpat/libexpat/blob/R_2_8_1/expat/Changes
Diff: https://github.com/libexpat/libexpat/compare/R_2_8_0...R_2_8_1

Fixes: CVE-2026-45186
(cherry picked from commit fe1ca2c575fa37169ccb114ffc9a5581aa44860d)
---
 pkgs/by-name/ex/expat/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ex/expat/package.nix b/pkgs/by-name/ex/expat/package.nix
index cf55e71a2037d..78ff9e9253b06 100644
--- a/pkgs/by-name/ex/expat/package.nix
+++ b/pkgs/by-name/ex/expat/package.nix
@@ -18,7 +18,7 @@
 # files.
 
 let
-  version = "2.8.0";
+  version = "2.8.1";
   tag = "R_${lib.replaceStrings [ "." ] [ "_" ] version}";
 in
 stdenv.mkDerivation (finalAttrs: {
@@ -29,7 +29,7 @@ stdenv.mkDerivation (finalAttrs: {
     url =
       with finalAttrs;
       "https://github.com/libexpat/libexpat/releases/download/${tag}/${pname}-${version}.tar.xz";
-    hash = "sha256-o3v64KqXdb2FIevYXcRW1Ibw/zETj2yR/ZAupzJiRUI=";
+    hash = "sha256-ELGV7ngWCpCDiBgKj+NgPU6aEvR1X79fOBayOp11DaA=";
   };
 
   strictDeps = true;

From ce3d984572698242f20af1ba2613365616effa9d Mon Sep 17 00:00:00 2001
From: Grimmauld <Grimmauld@grimmauld.de>
Date: Tue, 12 May 2026 22:44:31 +0200
Subject: [PATCH 27/42] audit: 4.1.2-unstable-2025-09-06 -> 4.1.4

Upstream diff: https://github.com/linux-audit/audit-userspace/compare/cb13fe75ee2c36d5c525ed9de22aae10dbc8caf4...v4.1.4

Adds support for io_uring and syscalls of Linux 7.0 kernels.

(cherry picked from commit 2b8ed1fe219eb6783afc4081e3ab62e8ee99ee39)
---
 pkgs/by-name/au/audit/package.nix | 10 +++-------
 1 file changed, 3 insertions(+), 7 deletions(-)

diff --git a/pkgs/by-name/au/audit/package.nix b/pkgs/by-name/au/audit/package.nix
index d16ea8e586772..e67c399aee17b 100644
--- a/pkgs/by-name/au/audit/package.nix
+++ b/pkgs/by-name/au/audit/package.nix
@@ -29,13 +29,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "audit";
-  version = "4.1.2-unstable-2025-09-06"; # fixes to non-static builds right after 4.1.2 release
+  version = "4.1.4";
 
   src = fetchFromGitHub {
     owner = "linux-audit";
     repo = "audit-userspace";
-    rev = "cb13fe75ee2c36d5c525ed9de22aae10dbc8caf4";
-    hash = "sha256-NX0TWA+LtcZgbM9aQfokWv2rGNAAb3ksGqAH8URAkYM=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-GdJ9nzlDAdOazOHH/YWuEoELrJh+G5ZJUKwIqAKAzpo=";
   };
 
   postPatch = ''
@@ -130,10 +130,6 @@ stdenv.mkDerivation (finalAttrs: {
   # Instead, we load audit rules in a dedicated module.
   postFixup = ''
     moveToOutput bin/augenrules $scripts
-    substituteInPlace $scripts/bin/augenrules \
-      --replace-fail "/sbin/auditctl -R" "$bin/bin/auditctl -R" \
-      --replace-fail "auditctl -s" "$bin/bin/auditctl -s" \
-      --replace-fail "/bin/ls" "ls"
     wrapProgram $scripts/bin/augenrules \
       --prefix PATH : ${
         lib.makeBinPath [

From 74af5f26f3370a49881fa261530a9b561a52c7df Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Tue, 12 May 2026 11:54:57 -0700
Subject: [PATCH 28/42] imagemagick: 7.1.2-21 -> 7.1.2-22

Diff: https://github.com/ImageMagick/ImageMagick/compare/7.1.2-21...7.1.2-22

Changelog: https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
(cherry picked from commit 357647db5bba91ec33658ad3a53238103c22f26d)
---
 pkgs/applications/graphics/ImageMagick/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/graphics/ImageMagick/default.nix b/pkgs/applications/graphics/ImageMagick/default.nix
index b6aff2bfc6460..8d1adfb504e1c 100644
--- a/pkgs/applications/graphics/ImageMagick/default.nix
+++ b/pkgs/applications/graphics/ImageMagick/default.nix
@@ -85,13 +85,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "imagemagick";
-  version = "7.1.2-21";
+  version = "7.1.2-22";
 
   src = fetchFromGitHub {
     owner = "ImageMagick";
     repo = "ImageMagick";
     tag = finalAttrs.version;
-    hash = "sha256-eYrAj3kUGXgAdxohzn46MBuIjLAaQ1HGUEky3SSzh1U=";
+    hash = "sha256-ogXN+PrWQHlQF2B+KEWIYrc6DFQ1ZuvhAHEYt90Kw+o=";
   };
 
   outputs = [

From 85c164d37d556c39de056895445ac08d8120611c Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Fri, 15 May 2026 09:27:15 +0200
Subject: [PATCH 29/42] libpq: 18.2 -> 18.4

Release Notes:
https://www.postgresql.org/about/news/postgresql-184-1710-1614-1518-and-1423-released-3297/

Security: CVE-2026-6477
(cherry picked from commit c9b2117da59ee369e81235b4a19bb66125f51354)
---
 pkgs/servers/sql/postgresql/libpq.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/servers/sql/postgresql/libpq.nix b/pkgs/servers/sql/postgresql/libpq.nix
index 393341f0c919d..2029b8786fbfa 100644
--- a/pkgs/servers/sql/postgresql/libpq.nix
+++ b/pkgs/servers/sql/postgresql/libpq.nix
@@ -40,14 +40,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libpq";
-  version = "18.2";
+  version = "18.4";
 
   src = fetchFromGitHub {
     owner = "postgres";
     repo = "postgres";
     # rev, not tag, on purpose: see generic.nix.
-    rev = "refs/tags/REL_18_2";
-    hash = "sha256-cvBXxA7/kEwDGxFv/YoZCIh17jzUujrCtfKAmtSxKTw=";
+    rev = "refs/tags/REL_18_4";
+    hash = "sha256-Ac/Dqcj8vjcW3my5vsnKaMiQqTq/HPtUzckJ3SMyrfA=";
   };
 
   __structuredAttrs = true;

From 486ad9698a7a3986af244869df2a9a656a574d20 Mon Sep 17 00:00:00 2001
From: Marcin Serwin <marcin@serwin.dev>
Date: Sat, 2 May 2026 13:15:13 +0200
Subject: [PATCH 30/42] SDL2_image: 2.8.10 -> 2.8.12

Signed-off-by: Marcin Serwin <marcin@serwin.dev>
(cherry picked from commit 0a913259ea46c411559449b60554129a79897efc)
---
 pkgs/by-name/sd/SDL2_image/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/sd/SDL2_image/package.nix b/pkgs/by-name/sd/SDL2_image/package.nix
index 7c8c2263efb09..401f1191aeffb 100644
--- a/pkgs/by-name/sd/SDL2_image/package.nix
+++ b/pkgs/by-name/sd/SDL2_image/package.nix
@@ -18,11 +18,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "SDL2_image";
-  version = "2.8.10";
+  version = "2.8.12";
 
   src = fetchurl {
     url = "https://www.libsdl.org/projects/SDL_image/release/SDL2_image-${finalAttrs.version}.tar.gz";
-    hash = "sha256-68BZ0BwAemL0sE8Qz4WFJ8h1BiUyKWlDF035qAJk/WU=";
+    hash = "sha256-OT9e+1BTbsE8pPSv+2nMmWbTw/lp5sXnAfrd+fl4U4E=";
   };
 
   nativeBuildInputs = [

From dadb75397fe0875d0b618899996d90584e31ba59 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Mon, 18 May 2026 10:29:29 -0700
Subject: [PATCH 31/42] imagemagick: 7.1.2-22 -> 7.1.2-23

Diff: https://github.com/ImageMagick/ImageMagick/compare/7.1.2-22...7.1.2-23

Changelog: https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
(cherry picked from commit 151051dc52067d1a704d212bcf6d7fc202e4fa3a)
---
 pkgs/applications/graphics/ImageMagick/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/graphics/ImageMagick/default.nix b/pkgs/applications/graphics/ImageMagick/default.nix
index 8d1adfb504e1c..8aaf1a98b737e 100644
--- a/pkgs/applications/graphics/ImageMagick/default.nix
+++ b/pkgs/applications/graphics/ImageMagick/default.nix
@@ -85,13 +85,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "imagemagick";
-  version = "7.1.2-22";
+  version = "7.1.2-23";
 
   src = fetchFromGitHub {
     owner = "ImageMagick";
     repo = "ImageMagick";
     tag = finalAttrs.version;
-    hash = "sha256-ogXN+PrWQHlQF2B+KEWIYrc6DFQ1ZuvhAHEYt90Kw+o=";
+    hash = "sha256-zYk75q+EyWq5g/AHFU6v8a7gye0aDAEe/ZZvjqR9ZTc=";
   };
 
   outputs = [

From fd27b0b3d615fbf1ad350f3263d021c36f582d1d Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 18 Dec 2025 15:04:52 +0000
Subject: [PATCH 32/42] memcached: 1.6.39 -> 1.6.40

(cherry picked from commit 6e2827e835bb48f3226bb1f822074c55a65c257f)
---
 pkgs/by-name/me/memcached/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/me/memcached/package.nix b/pkgs/by-name/me/memcached/package.nix
index d25370d20c838..78cee0e3bdae9 100644
--- a/pkgs/by-name/me/memcached/package.nix
+++ b/pkgs/by-name/me/memcached/package.nix
@@ -8,12 +8,12 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "1.6.39";
+  version = "1.6.40";
   pname = "memcached";
 
   src = fetchurl {
     url = "https://memcached.org/files/${pname}-${version}.tar.gz";
-    sha256 = "sha256-I+VQfpM7FUYxYdTF05IbDF80C1Qtbt1/bF4Xw08Ro2M=";
+    sha256 = "sha256-o9Ng6doiIaSb+ark5ogPLUTaayovrjmxkRucp2SI+/0=";
   };
 
   configureFlags = [

From a4a102eb1db319b2ca5cfe49108615928747d1e6 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 7 Mar 2026 12:45:43 +0000
Subject: [PATCH 33/42] memcached: 1.6.40 -> 1.6.41

(cherry picked from commit 822c7dfb3d9472fff98732cf9187132cd243513b)
---
 pkgs/by-name/me/memcached/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/me/memcached/package.nix b/pkgs/by-name/me/memcached/package.nix
index 78cee0e3bdae9..7e99fbb179cf8 100644
--- a/pkgs/by-name/me/memcached/package.nix
+++ b/pkgs/by-name/me/memcached/package.nix
@@ -8,12 +8,12 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "1.6.40";
+  version = "1.6.41";
   pname = "memcached";
 
   src = fetchurl {
     url = "https://memcached.org/files/${pname}-${version}.tar.gz";
-    sha256 = "sha256-o9Ng6doiIaSb+ark5ogPLUTaayovrjmxkRucp2SI+/0=";
+    sha256 = "sha256-4JcHPBVu7/nhJlWwVPRG1XN0z7pcEy3Nvn+sZOcoKGo=";
   };
 
   configureFlags = [

From eec76e8e635e89a541d5a98b1e84718db0b61161 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 19 May 2026 12:49:01 +0000
Subject: [PATCH 34/42] memcached: 1.6.41 -> 1.6.42

https://github.com/memcached/memcached/wiki/ReleaseNotes1642

(cherry picked from commit 1171f45940a2e9b6e73c40fdbee62b559764e839)
---
 pkgs/by-name/me/memcached/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/me/memcached/package.nix b/pkgs/by-name/me/memcached/package.nix
index 7e99fbb179cf8..8f956c68a017c 100644
--- a/pkgs/by-name/me/memcached/package.nix
+++ b/pkgs/by-name/me/memcached/package.nix
@@ -8,12 +8,12 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "1.6.41";
+  version = "1.6.42";
   pname = "memcached";
 
   src = fetchurl {
     url = "https://memcached.org/files/${pname}-${version}.tar.gz";
-    sha256 = "sha256-4JcHPBVu7/nhJlWwVPRG1XN0z7pcEy3Nvn+sZOcoKGo=";
+    sha256 = "sha256-UPCLh51PnTbeqdkF6eqt4Vxwjjjbfppz/CHci0U5Xec=";
   };
 
   configureFlags = [

From 47ec808e4884259ef222d8f038dabbbb528057bb Mon Sep 17 00:00:00 2001
From: ElXreno <elxreno@gmail.com>
Date: Sat, 25 Apr 2026 16:00:45 +0300
Subject: [PATCH 35/42] openldap: skip flaky syncreplication tests

(cherry picked from commit 63147b12a5831e23ce5e88f5f9a35fe8997e9978)
---
 pkgs/by-name/op/openldap/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/op/openldap/package.nix b/pkgs/by-name/op/openldap/package.nix
index 3ebf541856ef4..713544a03fe38 100644
--- a/pkgs/by-name/op/openldap/package.nix
+++ b/pkgs/by-name/op/openldap/package.nix
@@ -121,6 +121,8 @@ stdenv.mkDerivation rec {
     # https://bugs.openldap.org/show_bug.cgi?id=8623
     rm -f tests/scripts/test022-ppolicy
 
+    rm -f tests/scripts/test*-sync*
+
     rm -f tests/scripts/test063-delta-multiprovider
 
     # https://bugs.openldap.org/show_bug.cgi?id=10009

From a7a4825dbeca6c7022bc7957643681c498a4001c Mon Sep 17 00:00:00 2001
From: Sefa Eyeoglu <contact@scrumplex.net>
Date: Thu, 21 May 2026 09:28:33 +0200
Subject: [PATCH 36/42] unbound: 1.25.0 -> 1.25.1

Signed-off-by: Sefa Eyeoglu <contact@scrumplex.net>
(cherry picked from commit 0c98395be2ba98874b055e6ed709c385446bfe06)
---
 pkgs/by-name/un/unbound/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/un/unbound/package.nix b/pkgs/by-name/un/unbound/package.nix
index 8dbc9d75866be..7b049c778b956 100644
--- a/pkgs/by-name/un/unbound/package.nix
+++ b/pkgs/by-name/un/unbound/package.nix
@@ -56,13 +56,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "unbound";
-  version = "1.25.0";
+  version = "1.25.1";
 
   src = fetchFromGitHub {
     owner = "NLnetLabs";
     repo = "unbound";
     tag = "release-${finalAttrs.version}";
-    hash = "sha256-BAqGNi5lfYYTQd7CPH0lssLc5/AkeuKSVEFcrF/cNyc=";
+    hash = "sha256-1PXnxCPxoB5IrVBQIsrxiWAq+IoH7Ma9T1TTJsoTJc4=";
   };
 
   outputs = [

From 0c76ded5a714231787f27efdabf21bc408e339d0 Mon Sep 17 00:00:00 2001
From: Thomas Gerbet <thomas.gerbet@3ds.com>
Date: Tue, 12 May 2026 13:58:14 +0200
Subject: [PATCH 37/42] libcaca: apply patch for CVE-2026-42046

Fixes https://github.com/NixOS/nixpkgs/issues/519387

(cherry picked from commit 00cd8e646c7da669125ae26acf4b47079826e1f0)
---
 pkgs/by-name/li/libcaca/package.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/pkgs/by-name/li/libcaca/package.nix b/pkgs/by-name/li/libcaca/package.nix
index 848f7c7d30604..31648cfd2e757 100644
--- a/pkgs/by-name/li/libcaca/package.nix
+++ b/pkgs/by-name/li/libcaca/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   autoreconfHook,
   imlib2,
   xorg,
@@ -22,6 +23,14 @@ stdenv.mkDerivation rec {
     hash = "sha256-N0Lfi0d4kjxirEbIjdeearYWvStkKMyV6lgeyNKXcVw=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "CVE-2026-42046.patch";
+      url = "https://github.com/cacalabs/libcaca/commit/fb77acff9ba6bb01d53940da34fb10f20b156a23.patch";
+      hash = "sha256-AdpiE5Gw/CVET//7TTYZCb0glW5HY+T8xZkYs1XCBvY=";
+    })
+  ];
+
   nativeBuildInputs = [
     autoreconfHook
     pkg-config

From 2d22bf589e13ab48747b74c2b066e3698690d5e8 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 20 May 2026 02:10:28 +0000
Subject: [PATCH 38/42] libde265: 1.0.18 -> 1.0.19

(cherry picked from commit 8aa7c75b47254ac38ee2470c3ad42a7d6af5bb99)
---
 pkgs/by-name/li/libde265/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libde265/package.nix b/pkgs/by-name/li/libde265/package.nix
index 51e24c6ed5ac2..65121864428c7 100644
--- a/pkgs/by-name/li/libde265/package.nix
+++ b/pkgs/by-name/li/libde265/package.nix
@@ -15,14 +15,14 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  version = "1.0.18";
+  version = "1.0.19";
   pname = "libde265";
 
   src = fetchFromGitHub {
     owner = "strukturag";
     repo = "libde265";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-N6K82ElrzrMSNKfPTDsc5onrxucIJ8niwFgbaEPPd2I=";
+    hash = "sha256-77OIclR2TwOigo/k5ps9S0TrDNvEjf290PqZyqBcydo=";
   };
 
   nativeBuildInputs = [

From 2b79d0759a66fc0023b7417c9761064e5be1702b Mon Sep 17 00:00:00 2001
From: Sarah Clark <seclark@nextquestion.net>
Date: Sun, 8 Mar 2026 17:59:31 -0700
Subject: [PATCH 39/42] python3Packages.twisted: disable flaky test on Darwin

(cherry picked from commit 677d53cdf8fa37c251654e0d13d5dcd76e11482b)
---
 pkgs/development/python-modules/twisted/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/python-modules/twisted/default.nix b/pkgs/development/python-modules/twisted/default.nix
index 316a281a106fb..9f20df52c8ec0 100644
--- a/pkgs/development/python-modules/twisted/default.nix
+++ b/pkgs/development/python-modules/twisted/default.nix
@@ -191,6 +191,8 @@ buildPythonPackage rec {
           # https://github.com/twisted/twisted/blob/twisted-25.5.0/src/twisted/internet/test/test_tcp.py
           "AbortConnectionTests_AsyncioSelectorReactorTests.test_resumeProducingAbort"
           "AbortConnectionTests_AsyncioSelectorReactorTests.test_resumeProducingAbortLater"
+          # Times out in Hydra on x86_64-darwin
+          "AbortConnectionTests_AsyncioSelectorReactorTests.test_fullWriteBufferAfterByteExchange"
         ];
       };
     in

From 5bc0c937fbbfd31adb83a53e6689149cb8a96e0a Mon Sep 17 00:00:00 2001
From: Jamie Magee <jamie.magee@gmail.com>
Date: Tue, 17 Mar 2026 21:46:51 -0700
Subject: [PATCH 40/42] python3Packages.twisted: skip flaky
 test_fullWriteBufferAfterByteExchange on macOS

Reactor timeout caused by a suspected macOS kernel bug where
select/kqueue fail to notify that a socket's peer has closed.

https://github.com/twisted/twisted/issues/12151
(cherry picked from commit 63c072d0a99830377ad31237691cc3a337d01786)
---
 pkgs/development/python-modules/twisted/default.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/twisted/default.nix b/pkgs/development/python-modules/twisted/default.nix
index 9f20df52c8ec0..a886c3576a414 100644
--- a/pkgs/development/python-modules/twisted/default.nix
+++ b/pkgs/development/python-modules/twisted/default.nix
@@ -187,8 +187,9 @@ buildPythonPackage rec {
           "ProcessTestsBuilder_SelectReactorTests.test_processEnded"
         ];
         "src/twisted/internet/test/test_tcp.py" = [
-          # marked as flaky on macOS by upstream
-          # https://github.com/twisted/twisted/blob/twisted-25.5.0/src/twisted/internet/test/test_tcp.py
+          # flaky on macOS, suspected kernel bug in socket notifications
+          # https://github.com/twisted/twisted/issues/12151
+          "AbortConnectionTests_AsyncioSelectorReactorTests.test_fullWriteBufferAfterByteExchange"
           "AbortConnectionTests_AsyncioSelectorReactorTests.test_resumeProducingAbort"
           "AbortConnectionTests_AsyncioSelectorReactorTests.test_resumeProducingAbortLater"
           # Times out in Hydra on x86_64-darwin

From cd623f2f2995325cac159bec8dc378cb41060744 Mon Sep 17 00:00:00 2001
From: Sarah Clark <seclark@nextquestion.net>
Date: Fri, 28 Nov 2025 12:25:56 -0800
Subject: [PATCH 41/42] python3Packages.accelerate: disable
 test_can_pickle_dataloader on Darwin

(cherry picked from commit 6877e19448851556f207bcfc7e95c020c213d063)
---
 pkgs/development/python-modules/accelerate/default.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/development/python-modules/accelerate/default.nix b/pkgs/development/python-modules/accelerate/default.nix
index b8c2be527e7fb..9c609195cf9dd 100644
--- a/pkgs/development/python-modules/accelerate/default.nix
+++ b/pkgs/development/python-modules/accelerate/default.nix
@@ -155,6 +155,9 @@ buildPythonPackage rec {
     # Fails with `sandbox=false` by mis-configuring the model it's using.
     # AttributeError: 'DistributedDataParallel' object has no attribute '_ignored_modules'. Did you mean: 'named_modules'?
     "test_ignored_modules_regex"
+
+    # Illegal instruction (x86_64) / Trace/BPT Error 5 (aarch64)
+    "test_can_pickle_dataloader"
   ]
   ++ lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64) [
     # RuntimeError: torch_shm_manager: execl failed: Permission denied

From 256e5262d598c03e60b5b6daf0049e28a5990de3 Mon Sep 17 00:00:00 2001
From: Sarah Clark <seclark@nextquestion.net>
Date: Thu, 26 Feb 2026 21:06:27 -0800
Subject: [PATCH 42/42] python3Packages.accelerate: disable test that fails on
 Darwin under nixpkgs-review

(cherry picked from commit 8782ed0ea93b43f6deed67d80e95be2ecb8f8630)
---
 pkgs/development/python-modules/accelerate/default.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/development/python-modules/accelerate/default.nix b/pkgs/development/python-modules/accelerate/default.nix
index 9c609195cf9dd..83443af6dd611 100644
--- a/pkgs/development/python-modules/accelerate/default.nix
+++ b/pkgs/development/python-modules/accelerate/default.nix
@@ -158,6 +158,9 @@ buildPythonPackage rec {
 
     # Illegal instruction (x86_64) / Trace/BPT Error 5 (aarch64)
     "test_can_pickle_dataloader"
+
+    # ImportError: cannot import name 'PretrainedConfig' from 'transformers.modeling_utils'
+    "test_nested_hook"
   ]
   ++ lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64) [
     # RuntimeError: torch_shm_manager: execl failed: Permission denied