From 1df62de244537106405c3896f00facd195e9bc59 Mon Sep 17 00:00:00 2001
From: superherointj <sergiomarcelo@ya.ru>
Date: Mon, 24 Nov 2025 15:41:09 -0300
Subject: fluxcd: 2.7.3 -> 2.7.4

Release: https://github.com/fluxcd/flux2/releases/tag/v2.7.4
(cherry picked from commit cec4d758d04331533fd11788c23c965c535bd6e3)
---
 pkgs/by-name/fl/fluxcd/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/fl/fluxcd/package.nix b/pkgs/by-name/fl/fluxcd/package.nix
index 868e15d61d4c..ba7575722767 100644
--- a/pkgs/by-name/fl/fluxcd/package.nix
+++ b/pkgs/by-name/fl/fluxcd/package.nix
@@ -8,10 +8,10 @@
 }:
 
 let
-  version = "2.7.3";
-  srcHash = "sha256-nyMKlcJcDa532NqiT16eQJH0Z4dAO1MHkIzsrWlJS7Q=";
-  vendorHash = "sha256-0aQYOmH9CFv0gQ3PIEWr3OhC1jyQOIkNMp9lb7GQ40I=";
-  manifestsHash = "sha256-SQkMqcJY3FHLx6aAwWL0Nuz3fzPTevod4paz2H2srcI=";
+  version = "2.7.4";
+  srcHash = "sha256-O3YaT8fFQz4iF8dZmwIVms/6XtJ+v/8hRw0wlSN2jq0=";
+  vendorHash = "sha256-vrIh4gI5SwhNpquNb5jz821ZHjoYlEHod84ljQkQQE4=";
+  manifestsHash = "sha256-5Bohn437eZcTKQ+7FP7eYdTuTq2X7/ennfKqIm58Lgg=";
 
   manifests = fetchzip {
     url = "https://github.com/fluxcd/flux2/releases/download/v${version}/manifests.tar.gz";
-- 
cgit v1.2.3


From 90c7599200a9832e9c0af428645b9a5b44dcab6c Mon Sep 17 00:00:00 2001
From: superherointj <sergiomarcelo@ya.ru>
Date: Thu, 27 Nov 2025 13:30:20 -0300
Subject: fluxcd: 2.7.4 -> 2.7.5

Release: https://github.com/fluxcd/flux2/releases/tag/v2.7.5
(cherry picked from commit 153ce91e9e44c170307774337b596396266b86b6)
---
 pkgs/by-name/fl/fluxcd/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/fl/fluxcd/package.nix b/pkgs/by-name/fl/fluxcd/package.nix
index ba7575722767..72e6cb96e78d 100644
--- a/pkgs/by-name/fl/fluxcd/package.nix
+++ b/pkgs/by-name/fl/fluxcd/package.nix
@@ -8,10 +8,10 @@
 }:
 
 let
-  version = "2.7.4";
-  srcHash = "sha256-O3YaT8fFQz4iF8dZmwIVms/6XtJ+v/8hRw0wlSN2jq0=";
-  vendorHash = "sha256-vrIh4gI5SwhNpquNb5jz821ZHjoYlEHod84ljQkQQE4=";
-  manifestsHash = "sha256-5Bohn437eZcTKQ+7FP7eYdTuTq2X7/ennfKqIm58Lgg=";
+  version = "2.7.5";
+  srcHash = "sha256-vTb1YE73xxCC4GlR6UW5Ibu+ck+N+KKYUg50csb7eUA=";
+  vendorHash = "sha256-AgWDvlXVZXXprWCeoNeAMDb6LeYfa9yG5afc7TNISQs=";
+  manifestsHash = "sha256-CmYuHhEiKxkSRtN+fri2/4ILxpwRy2xGwGqCqcfsQwU=";
 
   manifests = fetchzip {
     url = "https://github.com/fluxcd/flux2/releases/download/v${version}/manifests.tar.gz";
-- 
cgit v1.2.3


From 338ba6d16570ab6d7f7ee99458e449f7b0dbfce0 Mon Sep 17 00:00:00 2001
From: Yiyu Zhou <yiyu@yiyuzhou.io>
Date: Sun, 11 Jan 2026 00:00:34 -0800
Subject: maintainers: update yiyu email

(cherry picked from commit 019099b9db2b0f355b4ecda9045448d78dbed844)
---
 maintainers/maintainer-list.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 43eaa108f3c0..38da2cc619c8 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -28910,7 +28910,7 @@
     githubId = 102890144;
   };
   yiyu = {
-    email = "yiyuzhou19@gmail.com";
+    email = "yiyu@yiyuzhou.io";
     name = "Yiyu Zhou";
     github = "yzhou216";
     githubId = 50000936;
-- 
cgit v1.2.3


From 128277bd1417b178dd5c2b90d5e6417ceb2ff641 Mon Sep 17 00:00:00 2001
From: Luke Granger-Brown <git@lukegb.com>
Date: Sun, 11 Jan 2026 09:55:28 +0900
Subject: odhcp6c: actually install outputs

(cherry picked from commit fb13f051515da9aa3567ef1b51f29588772bf758)
---
 pkgs/by-name/od/odhcp6c/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/od/odhcp6c/package.nix b/pkgs/by-name/od/odhcp6c/package.nix
index fa6b0f113122..f3c8e606a323 100644
--- a/pkgs/by-name/od/odhcp6c/package.nix
+++ b/pkgs/by-name/od/odhcp6c/package.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation {
   nativeBuildInputs = [ cmake ];
 
   cmakeFlags = [
-    "-DCMAKE_INSTALL_PREFIX=$out"
+    "-DCMAKE_INSTALL_PREFIX=${placeholder "out"}"
   ];
 
   passthru.updateScript = unstableGitUpdater { };
-- 
cgit v1.2.3


From dea51c184a2471a1d983730e631a7c4ce40a2d88 Mon Sep 17 00:00:00 2001
From: Luke Granger-Brown <git@lukegb.com>
Date: Sun, 11 Jan 2026 09:58:55 +0900
Subject: odhcp6c: 0-unstable-2025-10-21 -> 0-unstable-2025-12-29

(cherry picked from commit 63a3eff35f30bbe743ee694297d78ea62680ead2)
---
 pkgs/by-name/od/odhcp6c/package.nix | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/od/odhcp6c/package.nix b/pkgs/by-name/od/odhcp6c/package.nix
index f3c8e606a323..81fa2c16169c 100644
--- a/pkgs/by-name/od/odhcp6c/package.nix
+++ b/pkgs/by-name/od/odhcp6c/package.nix
@@ -3,20 +3,22 @@
   stdenv,
   fetchgit,
   cmake,
+  libubox,
   unstableGitUpdater,
 }:
 
 stdenv.mkDerivation {
   pname = "odhcp6c";
-  version = "0-unstable-2025-10-21";
+  version = "0-unstable-2025-12-29";
 
   src = fetchgit {
     url = "https://git.openwrt.org/project/odhcp6c.git";
-    rev = "77e1ae21e67f81840024ffe5bb7cf69a8fb0d2f0";
-    hash = "sha256-aOW0rOGd4YwnfXjsUj6HHy8zf0FJYFjsKMWJ5yhUl5g=";
+    rev = "8abb45065f5ef9d176efa6bd151a1209b05852c4";
+    hash = "sha256-xly6FAp8yddBnJeCSupVIq0Wec+sSFuuKH91MNKvHwM=";
   };
 
   nativeBuildInputs = [ cmake ];
+  buildInputs = [ libubox ];
 
   cmakeFlags = [
     "-DCMAKE_INSTALL_PREFIX=${placeholder "out"}"
-- 
cgit v1.2.3


From 1348b607028883bf3f3939798e2777bbf3928af7 Mon Sep 17 00:00:00 2001
From: azey <me@azey.net>
Date: Wed, 26 Nov 2025 23:47:56 +0100
Subject: subunit: 1.4.2 -> 1.4.5

(cherry picked from commit a819a30eb28977611867a56e355171d3eb72af45)
---
 pkgs/by-name/su/subunit/package.nix                | 25 ++++++++++++++--------
 .../development/python-modules/subunit/default.nix |  4 ++--
 2 files changed, 18 insertions(+), 11 deletions(-)

diff --git a/pkgs/by-name/su/subunit/package.nix b/pkgs/by-name/su/subunit/package.nix
index 3342e4d58b46..98095c1720a7 100644
--- a/pkgs/by-name/su/subunit/package.nix
+++ b/pkgs/by-name/su/subunit/package.nix
@@ -1,7 +1,9 @@
 {
   lib,
   stdenv,
-  fetchurl,
+  fetchFromGitHub,
+  nix-update-script,
+  autoreconfHook,
   pkg-config,
   check,
   cppunit,
@@ -13,14 +15,17 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "subunit";
-  version = "1.4.2";
+  version = "1.4.5";
 
-  src = fetchurl {
-    url = "https://launchpad.net/subunit/trunk/${finalAttrs.version}/+download/subunit-${finalAttrs.version}.tar.gz";
-    hash = "sha256-hlOOv6kIC97w7ICVsuXeWrsUbVu3tCSzEVKUHXYG2dI=";
+  src = fetchFromGitHub {
+    owner = "testing-cabal";
+    repo = "subunit";
+    tag = finalAttrs.version;
+    hash = "sha256-yM5mlYV7KyPRzPhnbDYBFLn4uiwxFFEotX2r6KcKAwA=";
   };
 
   nativeBuildInputs = [
+    autoreconfHook
     pkg-config
     perl
     python3Packages.wrapPython
@@ -38,13 +43,15 @@ stdenv.mkDerivation (finalAttrs: {
 
   strictDeps = true;
 
-  postFixup = "wrapPythonPrograms";
+  passthru.updateScript = nix-update-script;
 
   meta = {
     description = "Streaming protocol for test results";
-    mainProgram = "subunit-diff";
-    homepage = "https://launchpad.net/subunit";
-    license = lib.licenses.asl20;
+    homepage = "https://github.com/testing-cabal/subunit";
+    license = with lib.licenses; [
+      asl20
+      bsd3
+    ];
     platforms = lib.platforms.all;
     maintainers = with lib.maintainers; [ azey7f ];
   };
diff --git a/pkgs/development/python-modules/subunit/default.nix b/pkgs/development/python-modules/subunit/default.nix
index d1dec1faaa66..d255cf862fbb 100644
--- a/pkgs/development/python-modules/subunit/default.nix
+++ b/pkgs/development/python-modules/subunit/default.nix
@@ -8,9 +8,9 @@
   pythonOlder,
 
   # python dependencies
-  extras,
   fixtures,
   hypothesis,
+  iso8601,
   pytestCheckHook,
   setuptools,
   testscenarios,
@@ -39,7 +39,7 @@ buildPythonPackage {
   ];
 
   propagatedBuildInputs = [
-    extras
+    iso8601
     testtools
   ];
 
-- 
cgit v1.2.3


From 69ddba9df71dfbebb0e34e984ebaef2b0e267593 Mon Sep 17 00:00:00 2001
From: Yiyu Zhou <yiyu@yiyuzhou.io>
Date: Tue, 13 Jan 2026 15:27:19 -0800
Subject: librewolf-unwrapped: 146.0.1-1 -> 147.0-1

(cherry picked from commit df8a9fb0bd2e91d0ee6a8dddcea9b558322dc575)
---
 pkgs/applications/networking/browsers/librewolf/src.json | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/applications/networking/browsers/librewolf/src.json b/pkgs/applications/networking/browsers/librewolf/src.json
index 7b9178ab9343..dfacf296ab60 100644
--- a/pkgs/applications/networking/browsers/librewolf/src.json
+++ b/pkgs/applications/networking/browsers/librewolf/src.json
@@ -1,11 +1,11 @@
 {
-  "packageVersion": "146.0.1-1",
+  "packageVersion": "147.0-1",
   "source": {
-    "rev": "146.0.1-1",
-    "hash": "sha256-MYp0PEAbUSJwrvaXYaie7eXj3XRw/EyGrQvsFdVT/Y0="
+    "rev": "147.0-1",
+    "hash": "sha256-LZE4d1z4djtGSrnFsh1i9GXvFbK55RQMcqyID9ui0Ng="
   },
   "firefox": {
-    "version": "146.0.1",
-    "hash": "sha512-rpW4bkg/6/jf7INHdI3ZBI7X1/hFJQ4HqoBI4rNR2mH288X4O7DQxy4adexhtg5Zu+aWOfDzNTKRD/i/XKBzlA=="
+    "version": "147.0",
+    "hash": "sha512-rJAXsaLaey8Tk5LDlMNjQf00duPU6ho8fl578QDcMNGFEy75JWvn5rD52/xpI0rFceofxtudhFQ7FXcvTshRYQ=="
   }
 }
-- 
cgit v1.2.3


From 9fe92e6370a2513bf553b2075ea125d2d539a971 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Sat, 17 Jan 2026 13:10:21 +0100
Subject: deno: fix CVE-2026-22863

Backport upstream fix to prevent cipher operations after finalize.
This fixes a vulnerability where node:crypto doesn't finalize cipher,
allowing infinite encryptions which could enable brute forcing attacks.

Upstream fix: https://github.com/denoland/deno/pull/31533
Security advisory: https://github.com/denoland/deno/security/advisories/GHSA-5379-f5hf-w38v
---
 pkgs/by-name/de/deno/package.nix                   |   3 +
 ...-prevent-cipher-operations-after-finalize.patch | 193 +++++++++++++++++++++
 2 files changed, 196 insertions(+)
 create mode 100644 pkgs/by-name/de/deno/patches/0005-fix-ext-node-prevent-cipher-operations-after-finalize.patch

diff --git a/pkgs/by-name/de/deno/package.nix b/pkgs/by-name/de/deno/package.nix
index 58884dd9b516..8c8f35d1000e 100644
--- a/pkgs/by-name/de/deno/package.nix
+++ b/pkgs/by-name/de/deno/package.nix
@@ -53,6 +53,9 @@ rustPlatform.buildRustPackage (finalAttrs: {
     ./patches/0002-tests-replace-hardcoded-paths.patch
     ./patches/0003-tests-linux-no-chown.patch
     ./patches/0004-tests-darwin-fixes.patch
+    # CVE-2026-22863: prevent cipher operations after finalize
+    # https://github.com/denoland/deno/security/advisories/GHSA-5379-f5hf-w38v
+    ./patches/0005-fix-ext-node-prevent-cipher-operations-after-finalize.patch
   ];
   postPatch = ''
     # Use patched nixpkgs libffi in order to fix https://github.com/libffi/libffi/pull/857
diff --git a/pkgs/by-name/de/deno/patches/0005-fix-ext-node-prevent-cipher-operations-after-finalize.patch b/pkgs/by-name/de/deno/patches/0005-fix-ext-node-prevent-cipher-operations-after-finalize.patch
new file mode 100644
index 000000000000..6dbfffaee572
--- /dev/null
+++ b/pkgs/by-name/de/deno/patches/0005-fix-ext-node-prevent-cipher-operations-after-finalize.patch
@@ -0,0 +1,193 @@
+From 446c4c8d36b9b9d3a8eccbb1486ac6e644aed930 Mon Sep 17 00:00:00 2001
+From: Divy <dj.srivastava23@gmail.com>
+Date: Tue, 9 Dec 2025 16:03:37 +0530
+Subject: [PATCH] fix(ext/node): prevent cipher operations after finalize
+ (#31533)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Throw a state error for operations if the cipher is already finalized.
+
+(cherry picked from commit 0bc213b15b819597d935be6cb04cec03659d146b)
+Signed-off-by: Jörg Thalheim <joerg@thalheim.io>
+---
+ ext/node/polyfills/internal/crypto/cipher.ts | 25 ++++++++
+ tests/unit_node/crypto/crypto_cipher_test.ts | 63 ++++++++++++++++++++
+ 2 files changed, 88 insertions(+)
+
+diff --git a/ext/node/polyfills/internal/crypto/cipher.ts b/ext/node/polyfills/internal/crypto/cipher.ts
+index d4c790706..ac2a32118 100644
+--- a/ext/node/polyfills/internal/crypto/cipher.ts
++++ b/ext/node/polyfills/internal/crypto/cipher.ts
+@@ -184,6 +184,8 @@ export class Cipheriv extends Transform implements Cipher {
+ 
+   #autoPadding = true;
+ 
++  #finalized = false;
++
+   constructor(
+     cipher: string,
+     key: CipherKey,
+@@ -213,12 +215,17 @@ export class Cipheriv extends Transform implements Cipher {
+   }
+ 
+   final(encoding: string = getDefaultEncoding()): Buffer | string {
++    if (this.#finalized) {
++      throw new ERR_CRYPTO_INVALID_STATE("final");
++    }
++
+     this.#lazyInitDecoder(encoding);
+ 
+     const buf = new FastBuffer(16);
+     if (this.#cache.cache.byteLength == 0) {
+       const maybeTag = op_node_cipheriv_take(this.#context);
+       if (maybeTag) this.#authTag = Buffer.from(maybeTag);
++      this.#finalized = true;
+       return encoding === "buffer" ? Buffer.from([]) : "";
+     }
+ 
+@@ -233,9 +240,11 @@ export class Cipheriv extends Transform implements Cipher {
+     );
+     if (maybeTag) {
+       this.#authTag = Buffer.from(maybeTag);
++      this.#finalized = true;
+       return encoding === "buffer" ? Buffer.from([]) : "";
+     }
+ 
++    this.#finalized = true;
+     if (encoding !== "buffer") {
+       return this.#decoder!.end(buf);
+     }
+@@ -270,6 +279,10 @@ export class Cipheriv extends Transform implements Cipher {
+     inputEncoding?: Encoding,
+     outputEncoding: Encoding = getDefaultEncoding(),
+   ): Buffer | string {
++    if (this.#finalized) {
++      throw new ERR_CRYPTO_INVALID_STATE("update");
++    }
++
+     // TODO(kt3k): throw ERR_INVALID_ARG_TYPE if data is not string, Buffer, or ArrayBufferView
+     let buf = data;
+     if (typeof data === "string") {
+@@ -391,6 +404,8 @@ export class Decipheriv extends Transform implements Cipher {
+ 
+   #authTag?: BinaryLike;
+ 
++  #finalized = false;
++
+   constructor(
+     cipher: string,
+     key: CipherKey,
+@@ -427,6 +442,10 @@ export class Decipheriv extends Transform implements Cipher {
+   }
+ 
+   final(encoding: string = getDefaultEncoding()): Buffer | string {
++    if (this.#finalized) {
++      throw new ERR_CRYPTO_INVALID_STATE("final");
++    }
++
+     this.#lazyInitDecoder(encoding);
+ 
+     let buf = new FastBuffer(16);
+@@ -439,6 +458,7 @@ export class Decipheriv extends Transform implements Cipher {
+     );
+ 
+     if (!this.#needsBlockCache || this.#cache.cache.byteLength === 0) {
++      this.#finalized = true;
+       return encoding === "buffer" ? Buffer.from([]) : "";
+     }
+     if (this.#cache.cache.byteLength != 16) {
+@@ -446,6 +466,7 @@ export class Decipheriv extends Transform implements Cipher {
+     }
+ 
+     buf = buf.subarray(0, 16 - buf.at(-1)); // Padded in Pkcs7 mode
++    this.#finalized = true;
+     if (encoding !== "buffer") {
+       return this.#decoder!.end(buf);
+     }
+@@ -480,6 +501,10 @@ export class Decipheriv extends Transform implements Cipher {
+     inputEncoding?: Encoding,
+     outputEncoding: Encoding = getDefaultEncoding(),
+   ): Buffer | string {
++    if (this.#finalized) {
++      throw new ERR_CRYPTO_INVALID_STATE("update");
++    }
++
+     // TODO(kt3k): throw ERR_INVALID_ARG_TYPE if data is not string, Buffer, or ArrayBufferView
+     let buf = data;
+     if (typeof data === "string") {
+diff --git a/tests/unit_node/crypto/crypto_cipher_test.ts b/tests/unit_node/crypto/crypto_cipher_test.ts
+index 4d96a11d8..a15032dea 100644
+--- a/tests/unit_node/crypto/crypto_cipher_test.ts
++++ b/tests/unit_node/crypto/crypto_cipher_test.ts
+@@ -569,3 +569,66 @@ Deno.test({
+     assertEquals(decryptedText, text);
+   },
+ });
++
++
++Deno.test({
++  name: "createCipheriv - cipher lockdown after final()",
++  fn() {
++    const key = crypto.randomBytes(32);
++    const iv = crypto.randomBytes(16);
++    const cipher = crypto.createCipheriv("aes-256-cbc", key, iv);
++
++    // Call final() to lock down the cipher
++    cipher.final();
++
++    assertThrows(
++      () => {
++        cipher.update("test data");
++      },
++      Error,
++      "Invalid state for operation update",
++    );
++
++    assertThrows(
++      () => {
++        cipher.final();
++      },
++      Error,
++      "Invalid state for operation final",
++    );
++  },
++});
++
++Deno.test({
++  name: "createDecipheriv - decipher lockdown after final()",
++  fn() {
++    const key = crypto.randomBytes(32);
++    const iv = crypto.randomBytes(16);
++
++    const cipher = crypto.createCipheriv("aes-256-cbc", key, iv);
++    const encrypted = Buffer.concat([
++      cipher.update("test data"),
++      cipher.final(),
++    ]);
++
++    const decipher = crypto.createDecipheriv("aes-256-cbc", key, iv);
++    decipher.update(encrypted);
++    decipher.final();
++
++    assertThrows(
++      () => {
++        decipher.update(encrypted);
++      },
++      Error,
++      "Invalid state for operation update",
++    );
++
++    assertThrows(
++      () => {
++        decipher.final();
++      },
++      Error,
++      "Invalid state for operation final",
++    );
++  },
++});
+-- 
+2.52.0
+
-- 
cgit v1.2.3


From 033b69245b78a449a58b971cfbf5516048a01c43 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 19 Dec 2025 11:30:00 +0000
Subject: fastmail-desktop: 1.0.6 -> 1.0.7

(cherry picked from commit a02e976da24b7966d76eff4c243c609c3a56b015)
---
 pkgs/by-name/fa/fastmail-desktop/sources.nix | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/pkgs/by-name/fa/fastmail-desktop/sources.nix b/pkgs/by-name/fa/fastmail-desktop/sources.nix
index 874ee15e85d2..4fd1a3f64b9c 100644
--- a/pkgs/by-name/fa/fastmail-desktop/sources.nix
+++ b/pkgs/by-name/fa/fastmail-desktop/sources.nix
@@ -1,19 +1,19 @@
 # Generated by ./update.sh - do not update manually!
-# Last updated: 2025-12-06
+# Last updated: 2025-12-19
 { fetchurl, fetchzip }:
 {
   aarch64-darwin = {
-    version = "1.0.6";
+    version = "1.0.7";
     src = fetchurl {
-      url = "https://dl.fastmailcdn.com/desktop/production/mac/arm64/Fastmail-1.0.6-arm64-mac.zip";
-      hash = "sha512-viKPE0LS4dQQxw9jimEGjAl65uSE7XeAcuoLzq7n4i/BEfNo9QjzOzDMbxhwkGY0Ba92coddwJRXaSdx48fTTw==";
+      url = "https://dl.fastmailcdn.com/desktop/production/mac/arm64/Fastmail-1.0.7-arm64-mac.zip";
+      hash = "sha512-pH6m2BxP/y/A/DaPVNgwmd5HHVbyCVefYhJENyImsKQAKzn8RY9EI/kaybMHlQjv6N0Gmixpskvm0K74k3LUqg==";
     };
   };
   x86_64-linux = {
-    version = "1.0.6";
+    version = "1.0.7";
     src = fetchurl {
-      url = "https://dl.fastmailcdn.com/desktop/production/linux/x64/Fastmail-1.0.6.AppImage";
-      hash = "sha512-WKMhy7dLoFUqUkevkZAgxgxpz5jD4O9VVaKDYxQs0jXJVt5GUcIHDJ6aZIJG6jyinAC18NzF3vJnOftw8ZWdmg==";
+      url = "https://dl.fastmailcdn.com/desktop/production/linux/x64/Fastmail-1.0.7.AppImage";
+      hash = "sha512-MFVqBuuruqDVOkK9NC5E60BPJnIHdiL4MhitWqmmUB+NidlBxQbeDeWZu5Pwhh878UXrNvA0mVCgTZAOK7e2Ew==";
     };
   };
 }
-- 
cgit v1.2.3


From d81e9689a48404c21e5e4c3ef0371249ecb4cdd1 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 16 Jan 2026 04:06:32 +0000
Subject: firefly-iii-data-importer: 2.0.2 -> 2.0.4

(cherry picked from commit 9f701e21a8ebafcbd038c73dd007e6829a825006)
---
 pkgs/by-name/fi/firefly-iii-data-importer/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/fi/firefly-iii-data-importer/package.nix b/pkgs/by-name/fi/firefly-iii-data-importer/package.nix
index d7e651d17baf..f1098d2df592 100644
--- a/pkgs/by-name/fi/firefly-iii-data-importer/package.nix
+++ b/pkgs/by-name/fi/firefly-iii-data-importer/package.nix
@@ -13,13 +13,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "firefly-iii-data-importer";
-  version = "2.0.2";
+  version = "2.0.4";
 
   src = fetchFromGitHub {
     owner = "firefly-iii";
     repo = "data-importer";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-+oc6FJwlixJ6PNQmZoZxUveR3h+zRopptMYm6ef9r/I=";
+    hash = "sha256-PeJf0b15865iz6q3vPNIIEg8UggP7OTukyRn3yLI25o=";
   };
 
   buildInputs = [ php84 ];
@@ -38,7 +38,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   composerStrictValidation = true;
   strictDeps = true;
 
-  vendorHash = "sha256-y8tGv5dgGHV2moBgYKSvBoc0SfHvt7HbSrctoAdMQGE=";
+  vendorHash = "sha256-hNapeTzqsDqfnG3iea6+bOdb6wd/6fgyfMpEnj5lhB4=";
 
   npmDeps = fetchNpmDeps {
     inherit (finalAttrs) src;
-- 
cgit v1.2.3


From a43fd8aeed4629bf0d240e7f762e509399697ee5 Mon Sep 17 00:00:00 2001
From: "Adam C. Stephens" <adam@valkor.net>
Date: Sat, 17 Jan 2026 09:30:02 -0500
Subject: forgejo-lts: 11.0.9 -> 11.0.10

Changelog: https://codeberg.org/forgejo/forgejo/releases/tag/v11.0.10
(cherry picked from commit 92de2eba4b7db4bace18812caffc01f76c3f57d0)
---
 pkgs/by-name/fo/forgejo/lts.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/fo/forgejo/lts.nix b/pkgs/by-name/fo/forgejo/lts.nix
index 7b6b3636237e..1e7ec7fdfe87 100644
--- a/pkgs/by-name/fo/forgejo/lts.nix
+++ b/pkgs/by-name/fo/forgejo/lts.nix
@@ -1,6 +1,6 @@
 import ./generic.nix {
-  version = "11.0.9";
-  hash = "sha256-1jp0FT/T+j1CAPc99lTRSUd4R4YhgLMjZr4k3jW6ho8=";
+  version = "11.0.10";
+  hash = "sha256-vATc7pBOejBfZKNj3WsQeFWr1xKpIB4ODv4TPRrwdg0=";
   npmDepsHash = "sha256-Qs1aZxgjlsjdxfBpa4pOrwEfDfb/96L49uJd29Ysn/I=";
   vendorHash = "sha256-TVp4WxrGBlKVaPIbsj4EP/3pt5iseXLY7xIVum71ZXU=";
   lts = true;
-- 
cgit v1.2.3


From dd0b4cddb1c601f1733e1ea1b0040b232e30aa62 Mon Sep 17 00:00:00 2001
From: "Adam C. Stephens" <adam@valkor.net>
Date: Sat, 17 Jan 2026 09:35:38 -0500
Subject: forgejo: 14.0.0 -> 14.0.1

Changelog: https://codeberg.org/forgejo/forgejo/releases/tag/v14.0.1
(cherry picked from commit 10f4ed9ba21490b95c8dd97daeb09086d96d15f2)
---
 pkgs/by-name/fo/forgejo/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/fo/forgejo/package.nix b/pkgs/by-name/fo/forgejo/package.nix
index d4227a77c1f4..71c18e592348 100644
--- a/pkgs/by-name/fo/forgejo/package.nix
+++ b/pkgs/by-name/fo/forgejo/package.nix
@@ -1,7 +1,7 @@
 import ./generic.nix {
-  version = "14.0.0";
-  hash = "sha256-kQaaRwVUYIYTTjWcHKb09CzygDR6lhEbnY3FOsnyYpg=";
-  npmDepsHash = "sha256-rdlVXdoov3zppDgoLODl22AKCdm+AXiV1O63dmo6trg=";
+  version = "14.0.1";
+  hash = "sha256-nnHpi2mb+QziEtahRVMUt7t+xKiylzLCalh+6ywcP7w=";
+  npmDepsHash = "sha256-gyEr5uNZfBELxbvQeZ48xqtay7ObQL4dQaFO9yPC2Hg=";
   vendorHash = "sha256-7xgm57IqsFOh3CPwGybPHLLlckGLplJpU7M5upYKBl8=";
   lts = false;
   nixUpdateExtraArgs = [
-- 
cgit v1.2.3


From ccd12fec3b95e5dd81142e4af6f37929f8fac10c Mon Sep 17 00:00:00 2001
From: Jost Alemann <alemann@posteo.com>
Date: Sat, 17 Jan 2026 23:30:59 +0100
Subject: jjui: 0.9.9 -> 0.9.10

Changelog: https://github.com/idursun/jjui/releases/tag/v0.9.10
Diff: https://github.com/idursun/jjui/compare/v0.9.9...v0.9.10
(cherry picked from commit 37d940236354e7efb14541e283a7738ba06fe06e)
---
 pkgs/by-name/jj/jjui/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/jj/jjui/package.nix b/pkgs/by-name/jj/jjui/package.nix
index 082cd77da9c5..b6960bceed6b 100644
--- a/pkgs/by-name/jj/jjui/package.nix
+++ b/pkgs/by-name/jj/jjui/package.nix
@@ -8,13 +8,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "jjui";
-  version = "0.9.9";
+  version = "0.9.10";
 
   src = fetchFromGitHub {
     owner = "idursun";
     repo = "jjui";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-kBhEX6k/1vVhSqKeUcIQp6sOpKDnJfgUNKOTzbjG/VI=";
+    hash = "sha256-Hsuyf5VcSZcNi2gmubXS47uRarL17oPEtorisY75bbM=";
   };
 
   vendorHash = "sha256-jte0g+aUiGNARLi8DyfsX6wYYJnodHnILzmid6KvMiA=";
-- 
cgit v1.2.3


From ec4b9fc29d3ecfa8ba61648575da5f2f52d28896 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sun, 18 Jan 2026 02:13:15 +0100
Subject: forgejo-runner: 12.5.2 -> 12.5.3

https://code.forgejo.org/forgejo/runner/releases/tag/v12.5.3
(cherry picked from commit 13aad2545a7909c9e737bb2b001f77c613d6cbc6)
---
 pkgs/by-name/fo/forgejo-runner/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/fo/forgejo-runner/package.nix b/pkgs/by-name/fo/forgejo-runner/package.nix
index cc1d6df01c26..7240d478b9c2 100644
--- a/pkgs/by-name/fo/forgejo-runner/package.nix
+++ b/pkgs/by-name/fo/forgejo-runner/package.nix
@@ -49,17 +49,17 @@ let
 in
 buildGoModule rec {
   pname = "forgejo-runner";
-  version = "12.5.2";
+  version = "12.5.3";
 
   src = fetchFromGitea {
     domain = "code.forgejo.org";
     owner = "forgejo";
     repo = "runner";
     rev = "v${version}";
-    hash = "sha256-aL79wMzoqt1rqaOQyV28HSeZwjL3k60AyQOhOT/+BRY=";
+    hash = "sha256-qCk2GvPWKIQfEjYtx2Uc7GcVDehUu0/u4LP88FxoA9A=";
   };
 
-  vendorHash = "sha256-XNUhlGkW8bZ1cjODD6QIyRmmNdQ4Tq/hP2FToYfTq2k=";
+  vendorHash = "sha256-pGLZmSW7MKEy/K+njgcPv5a+7Qtf8mqUI4OwKhfEZXY=";
 
   nativeBuildInputs = [ makeWrapper ];
 
-- 
cgit v1.2.3


From f0d5e6ed2a001a38e53162408004f9b10a6068c1 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 17 Jan 2026 09:32:07 +0000
Subject: pyfa: 2.65.2 -> 2.65.4

(cherry picked from commit 772443df67c7f82de1701710c030c5be13852a41)
---
 pkgs/by-name/py/pyfa/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/py/pyfa/package.nix b/pkgs/by-name/py/pyfa/package.nix
index fd068e38e525..8cbfa685838f 100644
--- a/pkgs/by-name/py/pyfa/package.nix
+++ b/pkgs/by-name/py/pyfa/package.nix
@@ -11,7 +11,7 @@
   copyDesktopItems,
 }:
 let
-  version = "2.65.2";
+  version = "2.65.4";
 in
 python3Packages.buildPythonApplication rec {
   inherit version;
@@ -22,7 +22,7 @@ python3Packages.buildPythonApplication rec {
     owner = "pyfa-org";
     repo = "Pyfa";
     tag = "v${version}";
-    hash = "sha256-W3HQ6x9WXYXCczVj+3MBhEnkoDgJUJ6oZal1N4iDjdg=";
+    hash = "sha256-dBJmtKZD2MvQjLhz2Jcn/ldAEbo0wllXDItQu5pyrW8=";
   };
 
   desktopItems = [
-- 
cgit v1.2.3


From 11e6a9cd95d4191bb9ccfab2de40ee9b406aaefb Mon Sep 17 00:00:00 2001
From: zowoq <59103226+zowoq@users.noreply.github.com>
Date: Sun, 18 Jan 2026 08:37:42 +1000
Subject: linux_6_18: 6.18.5 -> 6.18.6

(cherry picked from commit d3ae307c40d3823c7bfc1ae6636fdb6c29ce72a8)
---
 pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index 9d8494c2be6d..2f7f250ec50a 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -30,8 +30,8 @@
         "lts": true
     },
     "6.18": {
-        "version": "6.18.5",
-        "hash": "sha256:0h6r5w7755gd8ys18zi9rgw95wrd2yalbq0h88ihv3ggki01z78q",
+        "version": "6.18.6",
+        "hash": "sha256:06x3z649mzwwkb1hvsy0yh7j5jk9qrnwqcmwy7dx8s1ggccrf927",
         "lts": false
     }
 }
-- 
cgit v1.2.3


From 891512c13185b564312d03ec55eb1f245dad021d Mon Sep 17 00:00:00 2001
From: zowoq <59103226+zowoq@users.noreply.github.com>
Date: Sun, 18 Jan 2026 08:38:18 +1000
Subject: linux_6_12: 6.12.65 -> 6.12.66

(cherry picked from commit 30faebbd255174397316c3746b310815cf111271)
---
 pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index 2f7f250ec50a..b493821931ca 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -25,8 +25,8 @@
         "lts": true
     },
     "6.12": {
-        "version": "6.12.65",
-        "hash": "sha256:1h9rl62lffwxan5ggz1vi9wmyzzsclg330gwdk80wp7kg9k55s2l",
+        "version": "6.12.66",
+        "hash": "sha256:1bvfadb5149sh927f8cbr1rnypn7v0h6znjdrc1mmc30q2hrff5s",
         "lts": true
     },
     "6.18": {
-- 
cgit v1.2.3


From 1dfb3992e7d6feeff71771c0beda46979d9beada Mon Sep 17 00:00:00 2001
From: zowoq <59103226+zowoq@users.noreply.github.com>
Date: Sun, 18 Jan 2026 08:39:08 +1000
Subject: linux_6_6: 6.6.120 -> 6.6.121

(cherry picked from commit 672eb8dd41adefff3bf3a18cf94e7d382b53f42c)
---
 pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index b493821931ca..385574918614 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -20,8 +20,8 @@
         "lts": true
     },
     "6.6": {
-        "version": "6.6.120",
-        "hash": "sha256:08fwwi9wjnhaj4ig0n0ycppzw384djh0gzv3i3blzp7fb4nk6p20",
+        "version": "6.6.121",
+        "hash": "sha256:1fhl9pr02s10j4b5nli0isy7ps644cpbmjqzkwf5mk14rr7rvbvn",
         "lts": true
     },
     "6.12": {
-- 
cgit v1.2.3


From 3ed30989cd673f7ab9ebd800079b0d4d03711445 Mon Sep 17 00:00:00 2001
From: zowoq <59103226+zowoq@users.noreply.github.com>
Date: Sun, 18 Jan 2026 08:39:53 +1000
Subject: linux_6_1: 6.1.160 -> 6.1.161

(cherry picked from commit 8e4510a4fe63aee0f08ece8026f0e8e422a0d8c8)
---
 pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index 385574918614..1d98124cfc82 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -5,8 +5,8 @@
         "lts": false
     },
     "6.1": {
-        "version": "6.1.160",
-        "hash": "sha256:15l4s87vyv4rnf5yagl6x7kz4yrlalh191ssxwbvwn3m8fl4d18f",
+        "version": "6.1.161",
+        "hash": "sha256:0aasgrq6mv5nj7b8ashzx0pxlaah5y0f3sq7d8w00di2lyync5ml",
         "lts": true
     },
     "5.15": {
-- 
cgit v1.2.3


From e53dfb06b93eaded2fe2dcc62cf32632739b8de7 Mon Sep 17 00:00:00 2001
From: Defelo <mail@defelo.de>
Date: Sun, 11 Jan 2026 12:46:54 +0000
Subject: mask: 0.11.6 -> 0.11.7

Changelog: https://github.com/jacobdeichert/mask/blob/mask/0.11.7/CHANGELOG.md
Diff: https://github.com/jacobdeichert/mask/compare/mask/0.11.6...mask/0.11.7
(cherry picked from commit 5a56dad8f2d5cf318954d6c4ea661cc33bb4310d)
---
 pkgs/by-name/ma/mask/package.nix | 21 +++++++++++++--------
 1 file changed, 13 insertions(+), 8 deletions(-)

diff --git a/pkgs/by-name/ma/mask/package.nix b/pkgs/by-name/ma/mask/package.nix
index b82b4f42df79..4269d7b9fb74 100644
--- a/pkgs/by-name/ma/mask/package.nix
+++ b/pkgs/by-name/ma/mask/package.nix
@@ -7,36 +7,43 @@
   nix-update-script,
 
   # tests
+  lua,
   nodejs,
-  python3,
   php,
+  python3,
   ruby,
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "mask";
-  version = "0.11.6";
+  version = "0.11.7";
 
   src = fetchFromGitHub {
     owner = "jacobdeichert";
     repo = "mask";
     tag = "mask/${finalAttrs.version}";
-    hash = "sha256-xGD23pso5iS+9dmfTMNtR6YqUqKnzJTzMl+OnRGpL3g=";
+    hash = "sha256-jz2x3Do+fqDHS7vNdnZsNOj36dRFt/khFaF/ztyKji8=";
   };
 
-  cargoHash = "sha256-JaYr6J3NOwVIHzGO4wLkke5O/T/9WUDENPgLP5Fwyhg=";
+  cargoHash = "sha256-HnRNg1/ZVWr6JRIsBf2kH9Xys7Hth4fMI12dClsPKv0=";
 
   preCheck = ''
     export PATH=$PATH:$PWD/target/${stdenv.hostPlatform.rust.rustcTarget}/$cargoBuildType
   '';
 
   nativeCheckInputs = [
+    lua
     nodejs
-    python3
     php
+    python3
     ruby
   ];
 
+  checkFlags = [
+    # requires swift which currently fails to build
+    "--skip=swift"
+  ];
+
   nativeInstallCheckInputs = [ versionCheckHook ];
   versionCheckProgramArg = "--version";
   doInstallCheck = true;
@@ -49,8 +56,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
     homepage = "https://github.com/jacobdeichert/mask";
     changelog = "https://github.com/jacobdeichert/mask/blob/mask/${finalAttrs.version}/CHANGELOG.md";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [
-      defelo
-    ];
+    maintainers = with lib.maintainers; [ defelo ];
   };
 })
-- 
cgit v1.2.3


From a2617c8ac8e61eec96c1a84dbb176836b2e324ec Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 18 Jan 2026 09:51:55 +0000
Subject: obfs4: 0.8.0 -> 0.8.1

(cherry picked from commit 8c07773cd37168e297a410587049e77ae45021e5)
---
 pkgs/by-name/ob/obfs4/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ob/obfs4/package.nix b/pkgs/by-name/ob/obfs4/package.nix
index 31ac4a734c29..6e1c34fa9d60 100644
--- a/pkgs/by-name/ob/obfs4/package.nix
+++ b/pkgs/by-name/ob/obfs4/package.nix
@@ -9,7 +9,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "obfs4";
-  version = "0.8.0";
+  version = "0.8.1";
 
   src = fetchFromGitLab {
     domain = "gitlab.torproject.org";
@@ -19,10 +19,10 @@ buildGoModule (finalAttrs: {
     # will collide with lyrebird Gtk3 program.
     repo = "lyrebird";
     tag = "lyrebird-${finalAttrs.version}";
-    hash = "sha256-h4ZhjyWRovoEFEFjjJBHBWc3kup60MNFvaYN6UPPxOE=";
+    hash = "sha256-KI9tGQomqSbiW8itxQ72rPwL67LVTmP110FrYVELr5w=";
   };
 
-  vendorHash = "sha256-isquplrmgtR8Mn5M+XNRdeGJHrAm7V7h1etVmVmN60I=";
+  vendorHash = "sha256-AlLRJieCiCLQPbqT+0J3Zxe73ryNB8MQkAyHsU+wr2A=";
 
   ldflags = [
     "-s"
-- 
cgit v1.2.3


From 9a039faf4b7c19b77d4a7f1fd900620ed1104a95 Mon Sep 17 00:00:00 2001
From: Marcin Serwin <marcin@serwin.dev>
Date: Mon, 13 Oct 2025 18:38:32 +0200
Subject: gimp3: enable QOI format support

Since the 3.0 release GIMP supports the QOI format [1], however, it is
only enabled if the qoi.h header is present during building.

[1]: https://www.gimp.org/release-notes/gimp-3.0.html#improved-file-format-support

Signed-off-by: Marcin Serwin <marcin@serwin.dev>
(cherry picked from commit a6cf3654bc269db048e54cf31820e3cbfffa29a6)
---
 pkgs/applications/graphics/gimp/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/applications/graphics/gimp/default.nix b/pkgs/applications/graphics/gimp/default.nix
index 66a79a253ccf..7f13314ab351 100644
--- a/pkgs/applications/graphics/gimp/default.nix
+++ b/pkgs/applications/graphics/gimp/default.nix
@@ -68,6 +68,7 @@
   alsa-lib,
   desktopToDarwinBundle,
   fetchpatch,
+  qoi,
 }:
 
 let
@@ -192,6 +193,7 @@ stdenv.mkDerivation (finalAttrs: {
     glib-networking
     libmypaint
     mypaint-brushes1
+    qoi
 
     # New file dialogue crashes with “Icon 'image-missing' not present in theme Symbolic” without an icon theme.
     adwaita-icon-theme
-- 
cgit v1.2.3


From da53cbbf55f07e3bbb6a7067a09cc231e3a64f5e Mon Sep 17 00:00:00 2001
From: Muhammad Falak R Wani <falakreyaz@gmail.com>
Date: Mon, 15 Dec 2025 17:45:04 +0000
Subject: gitui: 0.27.0 -> 0.28.0

Diff: https://github.com/extrawurst/gitui/compare/v0.27.0...v0.28.0

Changelog: https://github.com/extrawurst/gitui/blob/v0.28.0/CHANGELOG.md
(cherry picked from commit 2369fe58d63e7ae133cd2e9ea338e66db6660901)
---
 pkgs/by-name/gi/gitui/package.nix | 16 +++-------------
 1 file changed, 3 insertions(+), 13 deletions(-)

diff --git a/pkgs/by-name/gi/gitui/package.nix b/pkgs/by-name/gi/gitui/package.nix
index 8abe536cbb67..722cc86eb449 100644
--- a/pkgs/by-name/gi/gitui/package.nix
+++ b/pkgs/by-name/gi/gitui/package.nix
@@ -13,7 +13,7 @@
 }:
 let
   pname = "gitui";
-  version = "0.27.0";
+  version = "0.28.0";
 in
 rustPlatform.buildRustPackage {
   inherit pname version;
@@ -22,10 +22,10 @@ rustPlatform.buildRustPackage {
     owner = "extrawurst";
     repo = "gitui";
     rev = "v${version}";
-    hash = "sha256-jKJ1XnF6S7clyFGN2o3bHnYpC4ckl/lNXscmf6GRLbI=";
+    hash = "sha256-B3Cdhhu8ECfpc57TKe6u08Q/Kl4JzUlzw4vtJJ1YAUQ=";
   };
 
-  cargoHash = "sha256-Le/dD8bTd5boz1IeEq4ItJZYC3MRW8uiT/3Zy1yv5L0=";
+  cargoHash = "sha256-dq5F7NJ0XcJ9x6hVWOboQQn8Liw8n8vkFgQSmTYIkSw=";
 
   nativeBuildInputs = [
     pkg-config
@@ -40,16 +40,6 @@ rustPlatform.buildRustPackage {
     libiconv
   ];
 
-  patches = [
-    # Fixes the build for rust 1.89
-    # Upstream PR: https://github.com/gitui-org/gitui/pull/2663
-    # TOREMOVE for gitui > 0.27.0
-    (fetchpatch {
-      url = "https://github.com/gitui-org/gitui/commit/950e703cab1dd37e3d02e7316ec99cc0dc70513c.patch";
-      sha256 = "sha256-KDgOPLKGuJaF0Nc6rw9FPFmcI07I8Gyp/KNX8x6+2xw=";
-    })
-  ];
-
   postPatch = ''
     # The cargo config overrides linkers for some targets, breaking the build
     # on e.g. `aarch64-linux`. These overrides are not required in the Nix
-- 
cgit v1.2.3


From dc419fb2b0a894b3fe2e49764ba4be23bda211e7 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 31 Dec 2025 19:58:38 +0000
Subject: jetbrains-runner: 3.0.6 -> 3.0.7

(cherry picked from commit 4a104b0b8fb5631c7f3f38e5b74d57bc2307cde5)
---
 pkgs/by-name/je/jetbrains-runner/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/je/jetbrains-runner/package.nix b/pkgs/by-name/je/jetbrains-runner/package.nix
index c5caba3c2a16..d2b399fd0cf2 100644
--- a/pkgs/by-name/je/jetbrains-runner/package.nix
+++ b/pkgs/by-name/je/jetbrains-runner/package.nix
@@ -8,13 +8,13 @@
 }:
 stdenv.mkDerivation rec {
   pname = "jetbrains-runner";
-  version = "3.0.6";
+  version = "3.0.7";
 
   src = fetchFromGitHub {
     owner = "alex1701c";
     repo = "JetBrainsRunner";
     tag = version;
-    hash = "sha256-Jw86JFaaJ5kGB4dnOInAcdGsLmE4XO7O8/aBaV1zcNU=";
+    hash = "sha256-TaueSAxGiKiPVT26DSy1mzwsw2vBUK3D//vtOLtw2KQ=";
     fetchSubmodules = true;
   };
 
-- 
cgit v1.2.3


From 8934a76b2d9c9195864e74c41dd4f1e5e0946a5e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 10 Jan 2026 04:49:57 +0000
Subject: linuxKernel.kernels.linux_zen: 6.18.3 -> 6.18.4

(cherry picked from commit 93bf0821321ffa0bd4f6e478144a55deb76ce1d9)
---
 pkgs/os-specific/linux/kernel/zen-kernels.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/zen-kernels.nix b/pkgs/os-specific/linux/kernel/zen-kernels.nix
index f2679c376c9d..e25f2b26a5cc 100644
--- a/pkgs/os-specific/linux/kernel/zen-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/zen-kernels.nix
@@ -16,9 +16,9 @@ let
   variants = {
     # ./update-zen.py zen
     zen = {
-      version = "6.18.3"; # zen
+      version = "6.18.4"; # zen
       suffix = "zen1"; # zen
-      sha256 = "02iw0lsgb8b3yiqdcf90fn0dgbrlbalgdbzbgn6mpy44ycynl8jc"; # zen
+      sha256 = "08zx7zs3vs8y27pg7fqd25gdh30hn79kwwclnpxh0g3nr3hix783"; # zen
       isLqx = false;
     };
     # ./update-zen.py lqx
-- 
cgit v1.2.3


From 6c5da69a1f1b2a9808fc0559040c6b07a8e1ea01 Mon Sep 17 00:00:00 2001
From: Cathal Mullan <contact@cathal.dev>
Date: Sat, 17 Jan 2026 13:23:42 +0000
Subject: wasm-bindgen-cli_0_2_108: init at 0.2.108

(cherry picked from commit b27fe87d37ac5fd4bf502d4688410ad8d967447a)
---
 pkgs/by-name/wa/wasm-bindgen-cli_0_2_108/package.nix | 19 +++++++++++++++++++
 pkgs/top-level/aliases.nix                           |  2 +-
 2 files changed, 20 insertions(+), 1 deletion(-)
 create mode 100644 pkgs/by-name/wa/wasm-bindgen-cli_0_2_108/package.nix

diff --git a/pkgs/by-name/wa/wasm-bindgen-cli_0_2_108/package.nix b/pkgs/by-name/wa/wasm-bindgen-cli_0_2_108/package.nix
new file mode 100644
index 000000000000..9ec22500a2c3
--- /dev/null
+++ b/pkgs/by-name/wa/wasm-bindgen-cli_0_2_108/package.nix
@@ -0,0 +1,19 @@
+{
+  buildWasmBindgenCli,
+  fetchCrate,
+  rustPlatform,
+}:
+
+buildWasmBindgenCli rec {
+  src = fetchCrate {
+    pname = "wasm-bindgen-cli";
+    version = "0.2.108";
+    hash = "sha256-UsuxILm1G6PkmVw0I/JF12CRltAfCJQFOaT4hFwvR8E=";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit src;
+    inherit (src) pname version;
+    hash = "sha256-iqQiWbsKlLBiJFeqIYiXo3cqxGLSjNM8SOWXGM9u43E=";
+  };
+}
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 78d84122776e..d5208534f4e1 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1649,7 +1649,7 @@ mapAliases {
   warmux = throw "'warmux' has been removed as it is unmaintained and broken"; # Added 2025-11-03
   warsow = throw "'warsow' has been removed as it is unmaintained and is broken"; # Added 2025-10-09
   warsow-engine = throw "'warsow-engine' has been removed as it is unmaintained and is broken"; # Added 2025-10-09
-  wasm-bindgen-cli = wasm-bindgen-cli_0_2_106;
+  wasm-bindgen-cli = wasm-bindgen-cli_0_2_108;
   wasm-strip = throw "'wasm-strip' has been removed due to upstream deprecation. Use 'wabt' instead."; # Added 2025-11-06
   wavebox = throw "'wavebox' has been removed due to lack of maintenance in nixpkgs"; # Added 2025-06-24
   wavm = throw "wavm has been removed, as it does not build with supported LLVM versions"; # Added 2025-08-10
-- 
cgit v1.2.3


From 2b2ac9157cf331760a3c25918722041f13e00477 Mon Sep 17 00:00:00 2001
From: Cathal Mullan <contact@cathal.dev>
Date: Sat, 17 Jan 2026 13:23:57 +0000
Subject: dioxus-cli: 0.7.2 -> 0.7.3

(cherry picked from commit b4194b4c84a6e03e9e8f6fe23fe958ff09067023)
---
 pkgs/by-name/di/dioxus-cli/package.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/di/dioxus-cli/package.nix b/pkgs/by-name/di/dioxus-cli/package.nix
index d3be3f661a3d..4e6c1d5ac365 100644
--- a/pkgs/by-name/di/dioxus-cli/package.nix
+++ b/pkgs/by-name/di/dioxus-cli/package.nix
@@ -7,7 +7,7 @@
   openssl,
   rustfmt,
   makeWrapper,
-  wasm-bindgen-cli_0_2_106,
+  wasm-bindgen-cli_0_2_108,
   testers,
   dioxus-cli,
   withTelemetry ? false,
@@ -15,15 +15,15 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "dioxus-cli";
-  version = "0.7.2";
+  version = "0.7.3";
 
   src = fetchCrate {
     pname = "dioxus-cli";
     version = finalAttrs.version;
-    hash = "sha256-VCoTxZKFYkGBCu1X/9US/OCFpp6zc5ojmXWJfzozCxc=";
+    hash = "sha256-6uG737MNk+wTKqNWgFEd8MsOOvllZLDnIrJPAn5Wjuw=";
   };
 
-  cargoHash = "sha256-de8z68uXnrzyxTJY53saJ6hT7rvYbSdsSA/WWQa6nl4=";
+  cargoHash = "sha256-BdPsdWah/f2pveQViPikIV2riSwjSo+qGOFoP+hHaiM=";
   buildFeatures = [
     "no-downloads"
   ]
@@ -68,7 +68,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   postInstall = ''
     wrapProgram $out/bin/dx \
-      --prefix PATH : ${lib.makeBinPath [ wasm-bindgen-cli_0_2_106 ]}
+      --prefix PATH : ${lib.makeBinPath [ wasm-bindgen-cli_0_2_108 ]}
   '';
 
   meta = {
-- 
cgit v1.2.3


From c04e684faeae43f7df0cbc0db611514a73381813 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 16 Jan 2026 17:13:56 +0000
Subject: linuxKernel.kernels.linux_zen: 6.18.4 -> 6.18.5

(cherry picked from commit 6b3e3e666b12e9177ed515ae67ab25f0908449e7)
---
 pkgs/os-specific/linux/kernel/zen-kernels.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/zen-kernels.nix b/pkgs/os-specific/linux/kernel/zen-kernels.nix
index e25f2b26a5cc..a60255c005cf 100644
--- a/pkgs/os-specific/linux/kernel/zen-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/zen-kernels.nix
@@ -16,9 +16,9 @@ let
   variants = {
     # ./update-zen.py zen
     zen = {
-      version = "6.18.4"; # zen
+      version = "6.18.5"; # zen
       suffix = "zen1"; # zen
-      sha256 = "08zx7zs3vs8y27pg7fqd25gdh30hn79kwwclnpxh0g3nr3hix783"; # zen
+      sha256 = "1slclm2mgv7z3s0lcjrhqhzhbas4yq9yxkdjr27hlx7madplwbmi"; # zen
       isLqx = false;
     };
     # ./update-zen.py lqx
-- 
cgit v1.2.3


From 6d0a1f3ee02082555cd4a8690059bd03c1a063aa Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Fri, 18 Jul 2025 09:23:17 +0200
Subject: .github/PULL_REQUEST_TEMPLATE: remove +1 footer

The footer has the following problems:
- It's not consistently added in all PRs, for example backports or those
where the template is not used. Inconsistency in a voting skews the
results.
- It's arguably not effective, because people use reactions naturally to
interact with PRs anyway. As long as there are multiple different
reaction types, what does it mean that one PR has 20 :+1:, but another
has 22 :tada:? The latter won't show up in the ranking for :+1:, so at
the minimum confusing. Same for :heart:.
- It's not useful to determine priority as in "higher number of votes
should be merged". A PR's quality should be determined independently of
votes - when it's good, it will be merged. The currently most upvoted PR
has serious issues, so this invites drive-by questions like "Why isn't
this merged, given the number of upvotes?".

(cherry picked from commit c89c90dfa137316f3cf662783b4795d8b9897237)
---
 .github/PULL_REQUEST_TEMPLATE.md | 7 -------
 1 file changed, 7 deletions(-)

diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
index 85561029c86a..45a55eb45dce 100644
--- a/.github/PULL_REQUEST_TEMPLATE.md
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@@ -38,10 +38,3 @@ For new packages please briefly describe the package or provide a link to its ho
 [nixos/tests]: https://github.com/NixOS/nixpkgs/blob/master/nixos/tests
 [pkgs/README.md]: https://github.com/NixOS/nixpkgs/blob/master/pkgs/README.md
 [pkgs/test]: https://github.com/NixOS/nixpkgs/blob/master/pkgs/test
-
----
-
-Add a :+1: [reaction] to [pull requests you find important].
-
-[reaction]: https://github.blog/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/
-[pull requests you find important]: https://github.com/NixOS/nixpkgs/pulls?q=is%3Aopen+sort%3Areactions-%2B1-desc
-- 
cgit v1.2.3


From 59077630677820d337d33ea8d71d1293a8eb5371 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Wed, 14 Jan 2026 08:53:20 -0800
Subject: changedetection-io: mark unfree

> If you are reselling this software either in part or full as part of
> any commercial arrangement, you must abide by our
> COMMERCIAL_LICENCE.md found in our code repository.[^1]

[^1]: https://github.com/dgtlmoon/changedetection.io/blob/0.51.4/README.md#commercial-licencing

(cherry picked from commit e24ed70c8776d973f5b75cd0403bb690698ee809)
---
 pkgs/by-name/ch/changedetection-io/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/ch/changedetection-io/package.nix b/pkgs/by-name/ch/changedetection-io/package.nix
index 777fb073314b..a5c23a274c93 100644
--- a/pkgs/by-name/ch/changedetection-io/package.nix
+++ b/pkgs/by-name/ch/changedetection-io/package.nix
@@ -91,7 +91,7 @@ python3.pkgs.buildPythonApplication rec {
     description = "Self-hosted free open source website change detection tracking, monitoring and notification service";
     homepage = "https://github.com/dgtlmoon/changedetection.io";
     changelog = "https://github.com/dgtlmoon/changedetection.io/releases/tag/${src.tag}";
-    license = lib.licenses.asl20;
+    license = lib.licenses.unfree;
     maintainers = with lib.maintainers; [
       mikaelfangel
       thanegill
-- 
cgit v1.2.3