Merge master into staging-next

2024-10-26 00:14:06 +00:00
parent 7f898ed413 9a415c28ae
commit 02bb5e5201
69 changed files with 1634 additions and 1129 deletions
@@ -161,9 +161,12 @@ in

        script = ''
          ${lib.getExe cfg.package} -u
-          files=(/run/resolvconf ${lib.escapeShellArgs cfg.subscriberFiles})
-          chgrp -R resolvconf "''${files[@]}"
-          chmod -R g=u "''${files[@]}"
+          chgrp resolvconf ${lib.escapeShellArgs cfg.subscriberFiles}
+          chmod g=u ${lib.escapeShellArgs cfg.subscriberFiles}
+          ${lib.getExe' pkgs.acl "setfacl"} -R \
+            -m group:resolvconf:rwx \
+            -m default:group:resolvconf:rwx \
+            /run/resolvconf
        '';
      };

@@ -201,6 +201,26 @@ let
    };
  };

+  promTypes.sigv4 = types.submodule {
+    options = {
+      region = mkOpt types.str ''
+        The AWS region.
+      '';
+      access_key = mkOpt types.str ''
+        The Access Key ID.
+      '';
+      secret_key = mkOpt types.str ''
+        The Secret Access Key.
+      '';
+      profile = mkOpt types.str ''
+        The named AWS profile used to authenticate.
+      '';
+      role_arn = mkOpt types.str ''
+        The AWS role ARN.
+      '';
+    };
+  };
+
  promTypes.tls_config = types.submodule {
    options = {
      ca_file = mkOpt types.str ''
@@ -1464,6 +1484,9 @@ let
        Sets the `Authorization` header on every remote write request with the bearer token
        read from the configured file. It is mutually exclusive with `bearer_token`.
      '';
+      sigv4 = mkOpt promTypes.sigv4 ''
+        Configures AWS Signature Version 4 settings.
+      '';
      tls_config = mkOpt promTypes.tls_config ''
        Configures the remote write request's TLS settings.
      '';
@@ -249,7 +249,7 @@ in
            ExecReload = "${dhcpcd}/sbin/dhcpcd --rebind";
            Restart = "always";
            AmbientCapabilities = [ "CAP_NET_ADMIN" "CAP_NET_RAW" "CAP_NET_BIND_SERVICE" ];
-            ReadWritePaths = [ "/proc/sys/net/ipv6" ]
+            ReadWritePaths = [ "/proc/sys/net/ipv4" "/proc/sys/net/ipv6" ]
              ++ lib.optionals useResolvConf ([ "/run/resolvconf" ] ++ config.networking.resolvconf.subscriberFiles);
            DeviceAllow = "";
            LockPersonality = true;
@@ -101,15 +101,12 @@ with lib;

        secrets="/etc/ppp-pptpd/chap-secrets"

-        [ -f "$secrets" ] || cat > "$secrets" << EOF
+        [ -f "$secrets" ] || install -m 600 -o root -g root /dev/stdin "$secrets" << EOF
        # From: pptpd-1.4.0/samples/chap-secrets
        # Secrets for authentication using CHAP
        # client	server	secret		IP addresses
        #username	pptpd	password	*
        EOF
-
-        chown root:root "$secrets"
-        chmod 600 "$secrets"
      '';

      serviceConfig = {
@@ -440,6 +440,7 @@ in {
  pyload = handleTest ./pyload.nix {};
  oci-containers = handleTestOn ["aarch64-linux" "x86_64-linux"] ./oci-containers.nix {};
  odoo = handleTest ./odoo.nix {};
+  odoo17 = handleTest ./odoo.nix { package = pkgs.odoo17; };
  odoo16 = handleTest ./odoo.nix { package = pkgs.odoo16; };
  odoo15 = handleTest ./odoo.nix { package = pkgs.odoo15; };
  # 9pnet_virtio used to mount /nix partition doesn't support
@@ -43,21 +43,21 @@ flutter324.buildFlutterApplication rec {

  postInstall = ''
    # Swap the authenticator-helper symlink with the correct symlink.
-    ln -fs "${passthru.helper}/bin/authenticator-helper" "$out/app/helper/authenticator-helper"
+    ln -fs "${passthru.helper}/bin/authenticator-helper" "$out/app/$pname/helper/authenticator-helper"

    # Move the icon.
    mkdir $out/share/icons
-    mv $out/app/linux_support/com.yubico.yubioath.png $out/share/icons
+    mv $out/app/$pname/linux_support/com.yubico.yubioath.png $out/share/icons

    # Cleanup.
    rm -rf \
-      "$out/app/README.adoc" \
-      "$out/app/desktop_integration.sh" \
-      "$out/app/linux_support" \
+      "$out/app/$pname/README.adoc" \
+      "$out/app/$pname/desktop_integration.sh" \
+      "$out/app/$pname/linux_support" \
      $out/bin/* # We will repopulate this directory later.

    # Symlink binary.
-    ln -sf "$out/app/authenticator" "$out/bin/yubioath-flutter"
+    ln -sf "$out/app/$pname/authenticator" "$out/bin/yubioath-flutter"

    # Set the correct path to the binary in desktop file.
    substituteInPlace "$out/share/applications/com.yubico.authenticator.desktop" \
@@ -48,13 +48,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "ladybird";
-  version = "0-unstable-2024-10-05";
+  version = "0-unstable-2024-10-22";

  src = fetchFromGitHub {
    owner = "LadybirdWebBrowser";
    repo = "ladybird";
-    rev = "077bc68a4cbf2d8c97abc818515a22471da42c99";
-    hash = "sha256-zlQEOk9rex9Evpc2+4q2e2QPwGd9kLOQ393DJPuwh7c=";
+    rev = "648fac7215e1841e3714d4c72c7aee75152da522";
+    hash = "sha256-OB9dV+dNr5eA4h1+telYitrI62m+XSK/SYc9UPs7D4M=";
  };

  postPatch = ''
@@ -17,13 +17,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "bitwuzla";
-  version = "0.5.0";
+  version = "0.6.0";

  src = fetchFromGitHub {
    owner = "bitwuzla";
    repo = "bitwuzla";
    rev = finalAttrs.version;
-    hash = "sha256-/izxmN+zlrXsY6g6TRC1QqsLqltvrmZquXRd6h8RLRc=";
+    hash = "sha256-xO9+hixboGaCAIi01sWuIYtPamIwUpiTujmOD60NEm0=";
  };

  strictDeps = true;
@@ -34,6 +34,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
  installPhase = ''
    runHook preInstall

+    install -Dm644 lib/* -t $out/lib
    install -Dm644 dist/axis2.war -t $out/webapps
    unzip $out/webapps/axis2.war -d $out/webapps/axis2

@@ -15,7 +15,8 @@ let
    rev = "40bc9ad53e5a59d596935839e7c072679e706266";
    hash = "sha256-CL0YMQd1ck6/dlvJCLxt9jYyqDuk+iAWfdBOMj864u8=";
  };
-in buildBazelPackage rec {
+in
+buildBazelPackage rec {
  pname = "bant";
  version = "0.1.7";

@@ -26,17 +27,22 @@ in buildBazelPackage rec {
    hash = "sha256-QbxPosjlrpxbz6gQKUKccF2Gu/i5xvqh2gwfABYE8kE=";
  };

-  bazelFlags = ["--registry" "file://${registry}"];
+  bazelFlags = [
+    "--registry"
+    "file://${registry}"
+  ];

  postPatch = ''
    patchShebangs scripts/create-workspace-status.sh
  '';

  fetchAttrs = {
-    sha256 = {
-      aarch64-linux = "sha256-09RL0tj6xsGEmuv11V81eAtqLc9nAaE8Il3d6ueS0UQ=";
-      x86_64-linux = "sha256-6mlaJ/kT14vKvlJjxqBK/lESjjxbcYxApi7+eiiI37M=";
-    }.${system} or (throw "No hash for system: ${system}");
+    hash =
+      {
+        aarch64-linux = "sha256-LNca4h4yceSgve9GYUoXqlODKPjLAa71kh1BWXqRYtk=";
+        x86_64-linux = "sha256-bRFIfaVbsU2WroXR/i0E7J4rWeaNEoum93r8qOMXXvc=";
+      }
+      .${system} or (throw "No hash for system: ${system}");
  };

  nativeBuildInputs = [
@@ -58,7 +64,10 @@ in buildBazelPackage rec {
    description = "Bazel/Build Analysis and Navigation Tool";
    homepage = "http://bant.build/";
    license = licenses.gpl2Only;
-    maintainers = with maintainers; [ hzeller lromor ];
+    maintainers = with maintainers; [
+      hzeller
+      lromor
+    ];
    platforms = platforms.linux;
  };
 }
@@ -8,15 +8,15 @@
 }:
 rustPlatform.buildRustPackage rec {
  pname = "commitlint-rs";
-  version = "0.1.11";
+  version = "0.1.12";

  src = fetchFromGitHub {
    owner = "KeisukeYamashita";
    repo = "commitlint-rs";
    rev = "v${version}";
-    hash = "sha256-FrYXEh75H0u1rE1YNDL/B1gMYMG43jPDJGUMv9y5/3g=";
+    hash = "sha256-xDEd3jNmqur+ULjXOReolIDiqvpT2tAHj/IbH2op5Po=";
  };
-  cargoHash = "sha256-W6HkLCUoylgQQc2fFprmJeLH8KtpVUD4+BXWbNECVZ4=";
+  cargoHash = "sha256-SNOy0B1QARfoueMsCjLZhJsGQy2jTSeFC/D1+R/FH4Y=";

  passthru = {
    updateScript = nix-update-script { };
@@ -16,7 +16,7 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "dbeaver-bin";
-  version = "24.2.1";
+  version = "24.2.3";

  src =
    let
@@ -29,10 +29,10 @@ stdenvNoCC.mkDerivation (finalAttrs: {
        aarch64-darwin = "macos-aarch64.dmg";
      };
      hash = selectSystem {
-        x86_64-linux = "sha256-U1KJxE1PzRRMvYw3jSYV2n6JuhzyL30le1HeY0kft1k=";
-        aarch64-linux = "sha256-AT/Xx+Hwu64sUfR1fS9nI+RTsIfdi9udF9TR9hbjnxg=";
-        x86_64-darwin = "sha256-hCIfBv6FaNoZiTvpx1UCdwBg15vq+ZsTG5upmbWXN0M=";
-        aarch64-darwin = "sha256-g0G6fqR75AoOEzlYr6MbTBL8aQ/hWQuFyw1G2w9/JlU=";
+        x86_64-linux = "sha256-TvDpoEcnZBS8ORggFwLM80FXsJ8EXKvRSPUn+VtNTk8=";
+        aarch64-linux = "sha256-59khU3VQzpNeZv69pbeeE4ZAFajyI5gUUw9baOWPIFM=";
+        x86_64-darwin = "sha256-/YyN5daeoxq0oii6qYRpZ8cb43u6n8HuVc2JqVOhrxs=";
+        aarch64-darwin = "sha256-Stb76QpLnpmpBYDm+6fgkcx+TlY8hVkNtvGgdMWbaHg=";
      };
    in
    fetchurl {
@@ -33,7 +33,7 @@ flutter324.buildFlutterApplication {
  };

  postFixup = ''
-    patchelf $out/app/finamp --add-needed libisar.so --add-needed libmpv.so --add-rpath ${lib.makeLibraryPath [ mpv-unwrapped ]}
+    patchelf $out/app/$pname/finamp --add-needed libisar.so --add-needed libmpv.so --add-rpath ${lib.makeLibraryPath [ mpv-unwrapped ]}
  '';

  postInstall = ''
@@ -1,26 +1,34 @@
-{ lib, buildGoModule, fetchFromGitHub, testers, flyctl, installShellFiles }:
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  testers,
+  flyctl,
+  installShellFiles,
+}:

 buildGoModule rec {
  pname = "flyctl";
-  version = "0.3.15";
+  version = "0.3.29";

  src = fetchFromGitHub {
    owner = "superfly";
    repo = "flyctl";
    rev = "v${version}";
-    hash = "sha256-RM9R3o1NJYrw21SYx5whdR9kbopdOXUj3Uw5dVmo6Kk=";
+    hash = "sha256-gaDmgMJ87d8SosmXuO2arLS7w+3NBS8teKhdIRIXRnM=";
  };

-  vendorHash = "sha256-0KVjg4gt0WOJgVaeugSGzJJE/MvKSPZP6MXCYIw0cxQ=";
+  vendorHash = "sha256-0GfbHCKzBE8dlf2ZtUZN5L6ZJK2/Jhd9HNnkCNTAgtk=";

  subPackages = [ "." ];

  ldflags = [
-    "-s" "-w"
+    "-s"
+    "-w"
    "-X github.com/superfly/flyctl/internal/buildinfo.buildDate=1970-01-01T00:00:00Z"
    "-X github.com/superfly/flyctl/internal/buildinfo.buildVersion=${version}"
  ];
-  tags = ["production"];
+  tags = [ "production" ];

  nativeBuildInputs = [ installShellFiles ];

@@ -64,7 +72,13 @@ buildGoModule rec {
    downloadPage = "https://github.com/superfly/flyctl";
    homepage = "https://fly.io/";
    license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ adtya jsierles techknowlogick RaghavSood teutat3s ];
+    maintainers = with lib.maintainers; [
+      adtya
+      jsierles
+      techknowlogick
+      RaghavSood
+      teutat3s
+    ];
    mainProgram = "flyctl";
  };
 }
@@ -12,13 +12,14 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "guile-ssh";
-  version = "0.16.3";
+  # XXX: using unstable to ensure proper build with libssh 0.11.1 (https://github.com/artyom-poptsov/guile-ssh/issues/42)
+  version = "0.17.0-unstable-2024-10-15";

  src = fetchFromGitHub {
    owner = "artyom-poptsov";
    repo = "guile-ssh";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-P29U88QrCjoyl/wdTPZbiMoykd/v6ul6CW/IJn9UAyw=";
+    rev = "9336580f92f83bb73041c5374b400144a56b4c35";
+    hash = "sha256-Hwg0xaNSm/SEZfzczjb7o8TJXfzT1mmOk1rJROxahLQ=";
  };

  patches = [
@@ -50,11 +50,13 @@ flutterPackages.v3_19.buildFlutterApplication rec {

  # without this, only the splash screen will be shown and the logs will contain the
  # line `Failed to load dynamic library 'lib/libintiface_engine_flutter_bridge.so'`
-  extraWrapProgramArgs = "--chdir $out/app";
+  # Environmental variables don't quite eval outside of hooks so use pname and
+  # version directly.
+  extraWrapProgramArgs = "--chdir $out/app/${pname}";

  postInstall = ''
    mkdir -p $out/share/pixmaps
-    cp $out/app/data/flutter_assets/assets/icons/intiface_central_icon.png $out/share/pixmaps/intiface-central.png
+    cp $out/app/$pname/data/flutter_assets/assets/icons/intiface_central_icon.png $out/share/pixmaps/intiface-central.png
  '';

  desktopItems = [
@@ -1,37 +1,42 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, cmake
-, pkg-config
-, makeWrapper
-, boost
-, portmidi
-, sqlite
-, freetype
-, libpng
-, pngpp
-, zlib
-, wxGTK32
-, wxsqlite3
-, fluidsynth
-, fontconfig
-, darwin
-, soundfont-fluid
-, openlilylib-fonts
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  pkg-config,
+  makeWrapper,
+  boost,
+  portmidi,
+  sqlite,
+  freetype,
+  libpng,
+  pngpp,
+  zlib,
+  wxGTK32,
+  wxsqlite3,
+  fluidsynth,
+  fontconfig,
+  darwin,
+  soundfont-fluid,
+  openlilylib-fonts,
 }:

 let
  inherit (darwin.apple_sdk.frameworks) Cocoa;
 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "lenmus";
  version = "6.0.1";

  src = fetchFromGitHub {
    owner = "lenmus";
    repo = "lenmus";
-    rev = "Release_${version}";
-    sha256 = "sha256-qegOAc6vs2+6VViDHVjv0q+qjLZyTT7yPF3hFpTt5zE=";
+    rev = "Release_${finalAttrs.version}";
+    hash = "sha256-qegOAc6vs2+6VViDHVjv0q+qjLZyTT7yPF3hFpTt5zE=";
+  };
+
+  env = {
+    NIX_CFLAGS_COMPILE = "-fpermissive";
  };

  postPatch = ''
@@ -40,28 +45,32 @@ stdenv.mkDerivation rec {
    sed -i 's/fixup_bundle.*")/")/g' CMakeLists.txt
  '';

-  nativeBuildInputs = [
-    cmake
-    pkg-config
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    makeWrapper
-  ];
+  nativeBuildInputs =
+    [
+      cmake
+      pkg-config
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      makeWrapper
+    ];

-  buildInputs = [
-    boost
-    portmidi
-    sqlite
-    freetype
-    libpng
-    pngpp
-    zlib
-    wxGTK32
-    wxsqlite3
-    fluidsynth
-    fontconfig
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    Cocoa
-  ];
+  buildInputs =
+    [
+      boost
+      portmidi
+      sqlite
+      freetype
+      libpng
+      pngpp
+      zlib
+      wxGTK32
+      wxsqlite3
+      fluidsynth
+      fontconfig
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      Cocoa
+    ];

  preConfigure = ''
    mkdir res/fonts
@@ -82,7 +91,7 @@ stdenv.mkDerivation rec {
    makeWrapper $out/{Applications/lenmus.app/Contents/MacOS,bin}/lenmus
  '';

-  meta = with lib; {
+  meta = {
    description = "LenMus Phonascus is a program for learning music";
    longDescription = ''
      LenMus Phonascus is a free open source program (GPL v3) for learning music.
@@ -90,9 +99,9 @@ stdenv.mkDerivation rec {
      The different activities can be customized to meet your needs
    '';
    homepage = "http://www.lenmus.org/";
-    license = licenses.gpl3Plus;
-    maintainers = with maintainers;  [ ramkromberg ];
-    platforms = with platforms; unix;
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ ramkromberg ];
+    platforms = lib.platforms.unix;
    mainProgram = "lenmus";
  };
-}
+})
@@ -6,11 +6,11 @@

 appimageTools.wrapType2 rec {
  pname = "lunarclient";
-  version = "3.2.19";
+  version = "3.2.24";

  src = fetchurl {
    url = "https://launcherupdates.lunarclientcdn.com/Lunar%20Client-${version}.AppImage";
-    hash = "sha512-OLXp355IxMmhLtsxNVj0/ykl2lGJtwu1Ti3TOJZ1dwTsx/Y+tdeFT+WeDAju9fMC2AssciUnAeqqdp76sHxUgw==";
+    hash = "sha512-0rTADFgOOBDuv4nk2lgP4YUFxfsasZDQkp/r26iVwSa5f1swQXALGFwLl1VdJTRQ5AlZvRm6WBbt/ML2jODTZw==";
  };

  nativeBuildInputs = [ makeWrapper ];
@@ -1,29 +1,17 @@
 { lib
 , fetchgit
 , fetchzip
-, python310
+, python312
 , rtlcss
 , wkhtmltopdf
 , nixosTests
-, odoo_version ? "17.0"
-, odoo_release ? "20240610"
 }:

 let
-  python = python310.override {
+  odoo_version = "18.0";
+  odoo_release = "20241010";
+  python = python312.override {
    self = python;
-    packageOverrides = final: prev: {
-      # requirements.txt fixes docutils at 0.17; the default 0.21.1 tested throws exceptions
-      docutils-0_17 = prev.docutils.overridePythonAttrs (old: rec {
-        version = "0.17";
-        src = fetchgit {
-          url = "git://repo.or.cz/docutils.git";
-          rev = "docutils-${version}";
-          hash = "sha256-O/9q/Dg1DBIxKdNBOhDV16yy5ez0QANJYMjeovDoWX8=";
-        };
-        buildInputs = with prev; [setuptools];
-      });
-    };
  };
 in python.pkgs.buildPythonApplication rec {
  pname = "odoo";
@@ -34,13 +22,10 @@ in python.pkgs.buildPythonApplication rec {
  src = fetchzip {
    # find latest version on https://nightly.odoo.com/${odoo_version}/nightly/src
    url = "https://nightly.odoo.com/${odoo_version}/nightly/src/odoo_${version}.zip";
-    name = "${pname}-${version}";
-    hash = "sha256-blibGJyaz+MxMazOXhPbGBAJWZoGubirwSnjVYyLBJs="; # odoo
+    name = "odoo-${version}";
+    hash = "sha256-TUfLyB0m8XyEiS493Q/ECgSJutAd1rtWX93f3mwfOK0="; # odoo
  };

-  # needs some investigation
-  doCheck = false;
-
  makeWrapperArgs = [
    "--prefix" "PATH" ":" "${lib.makeBinPath [ wkhtmltopdf rtlcss ]}"
  ];
@@ -50,7 +35,8 @@ in python.pkgs.buildPythonApplication rec {
    chardet
    cryptography
    decorator
-    docutils-0_17  # sphinx has a docutils requirement >= 18
+    docutils
+    distutils
    ebaysdk
    freezegun
    geoip2
@@ -1,9 +1,15 @@
 #!/usr/bin/env nix-shell
 #!nix-shell -i bash -p curl gnused nix coreutils nix-prefetch
+# shellcheck shell=bash

 set -euo pipefail

-VERSION="17.0" # must be incremented manually
+SCRIPT_DIR="$(dirname "${BASH_SOURCE[0]}")"
+PKG=$(basename "$SCRIPT_DIR")
+
+LATEST="18" # increment manually
+VERSION="${PKG/#odoo}"
+VERSION="${VERSION:-$LATEST}.0"

 RELEASE="$(
    curl "https://nightly.odoo.com/$VERSION/nightly/src/" |
@@ -12,15 +18,15 @@ RELEASE="$(
 )"

 latestVersion="$VERSION.$RELEASE"
-currentVersion=$(nix-instantiate --eval -E "with import ./. {}; odoo.version or (lib.getVersion odoo)" | tr -d '"')
+currentVersion=$(nix-instantiate --eval -E "with import ./. {}; $PKG.version or (lib.getVersion $PKG)" | tr -d '"')

 if [[ "$currentVersion" == "$latestVersion" ]]; then
-    echo "odoo is up-to-date: $currentVersion"
+    echo "$PKG is up-to-date: $currentVersion"
    exit 0
 fi

-cd "$(dirname "${BASH_SOURCE[0]}")"
+cd "$SCRIPT_DIR"

-sed -ri "s| hash.+ # odoo| hash = \"$(nix-prefetch -q fetchzip --url "https://nightly.odoo.com/${VERSION}/nightly/src/odoo_${latestVersion}.zip")\"; # odoo|g" package.nix
-sed -ri "s|, odoo_version \? .+|, odoo_version ? \"$VERSION\"|" package.nix
-sed -ri "s|, odoo_release \? .+|, odoo_release ? \"$RELEASE\"|" package.nix
+sed -ri "s| hash.+ # odoo| hash = \"$(nix-prefetch -q fetchzip --option extra-experimental-features flakes --url "https://nightly.odoo.com/${VERSION}/nightly/src/odoo_${latestVersion}.zip")\"; # odoo|g" package.nix
+sed -ri "s|odoo_version = .+|odoo_version = \"$VERSION\";|" package.nix
+sed -ri "s|odoo_release = .+|odoo_release = \"$RELEASE\";|" package.nix
@@ -1,13 +1,20 @@
-{ lib, fetchFromGitHub, fetchzip, python310, rtlcss, wkhtmltopdf
-, nixosTests }:
+{ lib
+, fetchFromGitHub
+, fetchzip
+, python310
+, rtlcss
+, wkhtmltopdf
+, nixosTests
+}:

 let
+  odoo_version = "15.0";
+  odoo_release = "20241010";
  python = python310.override {
    self = python;
    packageOverrides = self: super: {
      pypdf2 = super.pypdf2.overridePythonAttrs (old: rec {
        version = "1.28.6";
-        format = "setuptools";

        src = fetchFromGitHub {
          owner = "py-pdf";
@@ -17,43 +24,25 @@ let
          hash = "sha256-WnRbsy/PJcotZqY9mJPLadrYqkXykOVifLIbDyNf4s4=";
        };

+        dependencies = [ self.setuptools ];
+
        nativeCheckInputs = with self; [ pytestCheckHook pillow ];
      });
-      flask = super.flask.overridePythonAttrs (old: rec {
-        version = "2.1.3";
-        src = old.src.override {
-          inherit version;
-          hash = "sha256-FZcuUBffBXXD1sCQuhaLbbkCWeYgrI1+qBOjlrrVtss=";
-        };
-      });
-      werkzeug = super.werkzeug.overridePythonAttrs (old: rec {
-        version = "2.1.2";
-        src = old.src.override {
-          inherit version;
-          hash = "sha256-HOCOgJPtZ9Y41jh5/Rujc1gX96gN42dNKT9ZhPJftuY=";
-        };
-      });
    };
  };
-
-  odoo_version = "15.0";
-  odoo_release = "20230816";
 in python.pkgs.buildPythonApplication rec {
-  pname = "odoo15";
+  pname = "odoo";
  version = "${odoo_version}.${odoo_release}";

  format = "setuptools";

-  # latest release is at https://github.com/odoo/docker/blob/master/15.0/Dockerfile
+  # latest release is at https://github.com/odoo/docker/blob/5fb6a842747c296099d9384587cd89640eb7a615/15.0/Dockerfile#L58
  src = fetchzip {
    url = "https://nightly.odoo.com/${odoo_version}/nightly/src/odoo_${version}.zip";
-    name = "${pname}-${version}";
-    hash = "sha256-h81JA0o44DVtl/bZ52rGQfg54TigwQcNpcMjQbi0zIQ="; # odoo
+    name = "odoo-${version}";
+    hash = "sha256-Hkre6mghEiLrDwfB1BxGbqEm/zruHLwaS+eIFQKjl1o="; # odoo
  };

-  # needs some investigation
-  doCheck = false;
-
  makeWrapperArgs = [
    "--prefix"
    "PATH"
@@ -74,6 +63,7 @@ in python.pkgs.buildPythonApplication rec {
    jinja2
    libsass
    lxml
+    lxml-html-clean
    markupsafe
    mock
    num2words
@@ -108,6 +98,7 @@ in python.pkgs.buildPythonApplication rec {
  dontStrip = true;

  passthru = {
+    updateScript = ./update.sh;
    tests = { inherit (nixosTests) odoo15; };
  };

@@ -0,0 +1,32 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl gnused nix coreutils nix-prefetch
+# shellcheck shell=bash
+
+set -euo pipefail
+
+SCRIPT_DIR="$(dirname "${BASH_SOURCE[0]}")"
+PKG=$(basename "$SCRIPT_DIR")
+
+LATEST="18" # increment manually
+VERSION="${PKG/#odoo}"
+VERSION="${VERSION:-$LATEST}.0"
+
+RELEASE="$(
+    curl "https://nightly.odoo.com/$VERSION/nightly/src/" |
+        sed -nE 's/.*odoo_'"$VERSION"'.(20[0-9]{6}).tar.gz.*/\1/p' |
+        tail -n 1
+)"
+
+latestVersion="$VERSION.$RELEASE"
+currentVersion=$(nix-instantiate --eval -E "with import ./. {}; $PKG.version or (lib.getVersion $PKG)" | tr -d '"')
+
+if [[ "$currentVersion" == "$latestVersion" ]]; then
+    echo "$PKG is up-to-date: $currentVersion"
+    exit 0
+fi
+
+cd "$SCRIPT_DIR"
+
+sed -ri "s| hash.+ # odoo| hash = \"$(nix-prefetch -q fetchzip --option extra-experimental-features flakes --url "https://nightly.odoo.com/${VERSION}/nightly/src/odoo_${latestVersion}.zip")\"; # odoo|g" package.nix
+sed -ri "s|odoo_version = .+|odoo_version = \"$VERSION\";|" package.nix
+sed -ri "s|odoo_release = .+|odoo_release = \"$RELEASE\";|" package.nix
@@ -7,31 +7,11 @@
 }:

 let
+  odoo_version = "16.0";
+  odoo_release = "20241010";
  python = python310.override {
    self = python;
-    packageOverrides = self: super: {
-      flask = super.flask.overridePythonAttrs (old: rec {
-        version = "2.3.3";
-        src = old.src.override {
-          inherit version;
-          hash = "sha256-CcNHqSqn/0qOfzIGeV8w2CZlS684uHPQdEzVccpgnvw=";
-        };
-      });
-      werkzeug = super.werkzeug.overridePythonAttrs (old: rec {
-        version = "2.3.7";
-        src = old.src.override {
-          inherit version;
-          hash = "sha256-K4wORHtLnbzIXdl7butNy69si2w74L1lTiVVPgohV9g=";
-        };
-        disabledTests = old.disabledTests ++ [
-          "test_response_body"
-        ];
-      });
-    };
  };
-
-  odoo_version = "16.0";
-  odoo_release = "20231024";
 in python.pkgs.buildPythonApplication rec {
  pname = "odoo";
  version = "${odoo_version}.${odoo_release}";
@@ -41,13 +21,10 @@ in python.pkgs.buildPythonApplication rec {
  # latest release is at https://github.com/odoo/docker/blob/master/16.0/Dockerfile
  src = fetchzip {
    url = "https://nightly.odoo.com/${odoo_version}/nightly/src/odoo_${version}.zip";
-    name = "${pname}-${version}";
-    hash = "sha256-Ux8RfA7kWLKissBBY5wrfL+aKKw++5BxjP3Vw0JAOsk="; # odoo
+    name = "odoo-${version}";
+    hash = "sha256-ICe5UOy+Ga81fE66SnIhRz3+JEEbGfoz7ag53mkG4UM="; # odoo
  };

-  # needs some investigation
-  doCheck = false;
-
  makeWrapperArgs = [
    "--prefix" "PATH" ":" "${lib.makeBinPath [ wkhtmltopdf rtlcss ]}"
  ];
@@ -66,6 +43,7 @@ in python.pkgs.buildPythonApplication rec {
    jinja2
    libsass
    lxml
+    lxml-html-clean
    markupsafe
    num2words
    ofxparse
@@ -102,6 +80,7 @@ in python.pkgs.buildPythonApplication rec {
  dontStrip = true;

  passthru = {
+    updateScript = ./update.sh;
    tests = {
      inherit (nixosTests) odoo;
    };
@@ -0,0 +1,32 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl gnused nix coreutils nix-prefetch
+# shellcheck shell=bash
+
+set -euo pipefail
+
+SCRIPT_DIR="$(dirname "${BASH_SOURCE[0]}")"
+PKG=$(basename "$SCRIPT_DIR")
+
+LATEST="18" # increment manually
+VERSION="${PKG/#odoo}"
+VERSION="${VERSION:-$LATEST}.0"
+
+RELEASE="$(
+    curl "https://nightly.odoo.com/$VERSION/nightly/src/" |
+        sed -nE 's/.*odoo_'"$VERSION"'.(20[0-9]{6}).tar.gz.*/\1/p' |
+        tail -n 1
+)"
+
+latestVersion="$VERSION.$RELEASE"
+currentVersion=$(nix-instantiate --eval -E "with import ./. {}; $PKG.version or (lib.getVersion $PKG)" | tr -d '"')
+
+if [[ "$currentVersion" == "$latestVersion" ]]; then
+    echo "$PKG is up-to-date: $currentVersion"
+    exit 0
+fi
+
+cd "$SCRIPT_DIR"
+
+sed -ri "s| hash.+ # odoo| hash = \"$(nix-prefetch -q fetchzip --option extra-experimental-features flakes --url "https://nightly.odoo.com/${VERSION}/nightly/src/odoo_${latestVersion}.zip")\"; # odoo|g" package.nix
+sed -ri "s|odoo_version = .+|odoo_version = \"$VERSION\";|" package.nix
+sed -ri "s|odoo_release = .+|odoo_release = \"$RELEASE\";|" package.nix
@@ -0,0 +1,121 @@
+{
+  lib,
+  fetchgit,
+  fetchzip,
+  python310,
+  rtlcss,
+  wkhtmltopdf,
+  nixosTests,
+}:
+
+let
+  odoo_version = "17.0";
+  odoo_release = "20241010";
+  python = python310.override {
+    self = python;
+    packageOverrides = final: prev: {
+      # requirements.txt fixes docutils at 0.17; the default 0.21.1 tested throws exceptions
+      docutils-0_17 = prev.docutils.overridePythonAttrs (old: rec {
+        version = "0.17";
+        src = fetchgit {
+          url = "git://repo.or.cz/docutils.git";
+          rev = "docutils-${version}";
+          hash = "sha256-O/9q/Dg1DBIxKdNBOhDV16yy5ez0QANJYMjeovDoWX8=";
+        };
+        buildInputs = with prev; [ setuptools ];
+      });
+    };
+  };
+in
+python.pkgs.buildPythonApplication rec {
+  pname = "odoo";
+  version = "${odoo_version}.${odoo_release}";
+
+  format = "setuptools";
+
+  # latest release is at https://github.com/odoo/docker/blob/master/17.0/Dockerfile
+  src = fetchzip {
+    url = "https://nightly.odoo.com/${odoo_version}/nightly/src/odoo_${version}.zip";
+    name = "odoo-${version}";
+    hash = "sha256-s4Fvzjwl2oM0V9G1WQdSoqo7kE7b8tJdluk9f7A06e8="; # odoo
+  };
+
+  makeWrapperArgs = [
+    "--prefix"
+    "PATH"
+    ":"
+    "${lib.makeBinPath [
+      wkhtmltopdf
+      rtlcss
+    ]}"
+  ];
+
+  propagatedBuildInputs = with python.pkgs; [
+    babel
+    chardet
+    cryptography
+    decorator
+    docutils-0_17 # sphinx has a docutils requirement >= 18
+    ebaysdk
+    freezegun
+    geoip2
+    gevent
+    greenlet
+    idna
+    jinja2
+    libsass
+    lxml
+    lxml-html-clean
+    markupsafe
+    num2words
+    ofxparse
+    passlib
+    pillow
+    polib
+    psutil
+    psycopg2
+    pydot
+    pyopenssl
+    pypdf2
+    pyserial
+    python-dateutil
+    python-ldap
+    python-stdnum
+    pytz
+    pyusb
+    qrcode
+    reportlab
+    requests
+    rjsmin
+    urllib3
+    vobject
+    werkzeug
+    xlrd
+    xlsxwriter
+    xlwt
+    zeep
+
+    setuptools
+    mock
+  ];
+
+  # takes 5+ minutes and there are not files to strip
+  dontStrip = true;
+
+  passthru = {
+    updateScript = ./update.sh;
+    tests = {
+      inherit (nixosTests) odoo;
+    };
+  };
+
+  meta = with lib; {
+    description = "Open Source ERP and CRM";
+    homepage = "https://www.odoo.com/";
+    license = licenses.lgpl3Only;
+    maintainers = with maintainers; [
+      mkg20001
+      siriobalmelli
+    ];
+  };
+}
@@ -0,0 +1,32 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl gnused nix coreutils nix-prefetch
+# shellcheck shell=bash
+
+set -euo pipefail
+
+SCRIPT_DIR="$(dirname "${BASH_SOURCE[0]}")"
+PKG=$(basename "$SCRIPT_DIR")
+
+LATEST="18" # increment manually
+VERSION="${PKG/#odoo}"
+VERSION="${VERSION:-$LATEST}.0"
+
+RELEASE="$(
+    curl "https://nightly.odoo.com/$VERSION/nightly/src/" |
+        sed -nE 's/.*odoo_'"$VERSION"'.(20[0-9]{6}).tar.gz.*/\1/p' |
+        tail -n 1
+)"
+
+latestVersion="$VERSION.$RELEASE"
+currentVersion=$(nix-instantiate --eval -E "with import ./. {}; $PKG.version or (lib.getVersion $PKG)" | tr -d '"')
+
+if [[ "$currentVersion" == "$latestVersion" ]]; then
+    echo "$PKG is up-to-date: $currentVersion"
+    exit 0
+fi
+
+cd "$SCRIPT_DIR"
+
+sed -ri "s| hash.+ # odoo| hash = \"$(nix-prefetch -q fetchzip --option extra-experimental-features flakes --url "https://nightly.odoo.com/${VERSION}/nightly/src/odoo_${latestVersion}.zip")\"; # odoo|g" package.nix
+sed -ri "s|odoo_version = .+|odoo_version = \"$VERSION\";|" package.nix
+sed -ri "s|odoo_release = .+|odoo_release = \"$RELEASE\";|" package.nix
@@ -6,6 +6,8 @@
  gtk3,
  poppler_gi,
  libhandy,
+  gettext,
+  stdenv,
 }:

 python3Packages.buildPythonApplication rec {
@@ -20,7 +22,15 @@ python3Packages.buildPythonApplication rec {
    hash = "sha256-94qziqJaKW8/L/6+U1yojxdG8BmeAStn+qbfGemTrVA=";
  };

-  nativeBuildInputs = [ wrapGAppsHook3 ];
+  nativeBuildInputs = [ wrapGAppsHook3 ] ++ lib.optionals stdenv.isDarwin [ gettext ];
+
+  postPatch = lib.optionalString stdenv.isDarwin ''
+    LINTL="${lib.getLib gettext}/lib/libintl.8.dylib"
+    substituteInPlace pdfarranger/pdfarranger.py --replace-fail \
+      "return 'libintl.8.dylib'" \
+      "return '$LINTL'"
+    unset LINTL
+  '';

  build-system = with python3Packages; [ setuptools ];

@@ -49,8 +59,10 @@ python3Packages.buildPythonApplication rec {
    inherit (src.meta) homepage;
    description = "Merge or split pdf documents and rotate, crop and rearrange their pages using a graphical interface";
    mainProgram = "pdfarranger";
-    platforms = lib.platforms.linux;
-    maintainers = with lib.maintainers; [ symphorien ];
+    maintainers = with lib.maintainers; [
+      symphorien
+      endle
+    ];
    license = lib.licenses.gpl3Plus;
    changelog = "https://github.com/pdfarranger/pdfarranger/releases/tag/${version}";
  };
@@ -13,13 +13,13 @@

 rustPlatform.buildRustPackage rec {
  pname = "pixi";
-  version = "0.31.0";
+  version = "0.34.0";

  src = fetchFromGitHub {
    owner = "prefix-dev";
    repo = "pixi";
    rev = "v${version}";
-    hash = "sha256-1Woi+HwlN1nP05/cMNj+FVqEVREy/+UivdWGD6lZSNY=";
+    hash = "sha256-pXJna0WuosQ21u+ImIc70OaG63xVODLaWFkuYqxUc/Y=";
  };

  cargoLock = {
@@ -1,25 +1,30 @@
-{ lib
-, buildPythonApplication
-, fetchPypi
+{
+  lib,
+  python3Packages,
+  fetchPypi,
 }:

-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
  pname = "pwncat";
  version = "0.1.2";
+  pyproject = true;

  src = fetchPypi {
    inherit pname version;
-    sha256 = "1230fdn5mx3wwr3a3nn6z2vwh973n248m11hnx9y3fjq7bgpky67";
+    hash = "sha256-x/h53zpYuuFTtzCEioiw4yTIt/jG2qFG5nz0WmxzYIg=";
  };

+  build-system = with python3Packages; [ setuptools ];
+
  # Tests requires to start containers
  doCheck = false;

  meta = with lib; {
    description = "TCP/UDP communication suite";
-    mainProgram = "pwncat";
    homepage = "https://pwncat.org/";
-    license = with licenses; [ mit ];
+    changelog = "https://github.com/cytopia/pwncat/releases/tag/v${version}";
+    license = licenses.mit;
    maintainers = with maintainers; [ fab ];
+    mainProgram = "pwncat";
  };
 }
@@ -12,16 +12,16 @@ let
 in
 rustPlatform.buildRustPackage rec {
  pname = "railway";
-  version = "3.15.1";
+  version = "3.17.10";

  src = fetchFromGitHub {
    owner = "railwayapp";
    repo = "cli";
    rev = "v${version}";
-    hash = "sha256-2/Yaz+eqZEOh/bCme9DuQep4XDkatr9kw32zN1yn9DQ=";
+    hash = "sha256-WrNWtVlvEscyo/MOQEf+MikxHCKIqfKWfhPtV0DVhXM=";
  };

-  cargoHash = "sha256-9fO8YmmqyqVp0FYndUnTD6+nSvlV9jzjT+G/iNlZYLo=";
+  cargoHash = "sha256-C1lqK60asOW9Kl3cNgJvdDtZEtPUOE/SbBww0qL3fsU=";

  nativeBuildInputs = [ pkg-config ];

@@ -69,7 +69,7 @@ version = "0.9.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ccaf7e9dfbb6ab22c82e473cd1a8a7bd313c19a5b7e40970f3d89ef5a5c9e81e"
 dependencies = [
- "unicode-width",
+ "unicode-width 0.1.13",
 "yansi-term",
 ]

@@ -123,9 +123,9 @@ dependencies = [

 [[package]]
 name = "anyhow"
-version = "1.0.89"
+version = "1.0.90"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "86fdf8605db99b54d3cd748a44c6d04df638eb5dafb219b135d0149bd0db01f6"
+checksum = "37bf3594c4c988a53154954629820791dde498571819ae4ca50ca811e060cc95"

 [[package]]
 name = "append-only-vec"
@@ -407,7 +407,7 @@ dependencies = [
 "heck",
 "proc-macro2",
 "quote",
- "syn",
+ "syn 2.0.82",
 ]

 [[package]]
@@ -491,7 +491,7 @@ dependencies = [
 "encode_unicode",
 "lazy_static",
 "libc",
- "unicode-width",
+ "unicode-width 0.1.13",
 "windows-sys 0.52.0",
 ]

@@ -687,7 +687,7 @@ dependencies = [
 "proc-macro2",
 "quote",
 "strsim 0.10.0",
- "syn",
+ "syn 2.0.82",
 ]

 [[package]]
@@ -698,7 +698,7 @@ checksum = "a668eda54683121533a393014d8692171709ff57a7d61f187b6e782719f8933f"
 dependencies = [
 "darling_core",
 "quote",
- "syn",
+ "syn 2.0.82",
 ]

 [[package]]
@@ -750,6 +750,27 @@ dependencies = [
 "crypto-common",
 ]

+[[package]]
+name = "dir-test"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c44bdf9319ad5223afb7eb15a7110452b0adf0373ea6756561b2c708eef0dd1"
+dependencies = [
+ "dir-test-macros",
+]
+
+[[package]]
+name = "dir-test-macros"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "644f96047137dfaa7a09e34d4623f9e52a1926ecc25ba32ad2ba3fc422536b25"
+dependencies = [
+ "glob",
+ "proc-macro2",
+ "quote",
+ "syn 1.0.109",
+]
+
 [[package]]
 name = "dirs"
 version = "4.0.0"
@@ -879,9 +900,9 @@ checksum = "e8c02a5121d4ea3eb16a80748c74f5549a5665e4c21333c6098f283870fbdea6"

 [[package]]
 name = "fern"
-version = "0.6.2"
+version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d9f0c14694cbd524c8720dd69b0e3179344f04ebb5f90f2e4a440c6ea3b2f1ee"
+checksum = "69ff9c9d5fb3e6da8ac2f77ab76fe7e8087d512ce095200f8f29ac5b656cf6dc"
 dependencies = [
 "log",
 ]
@@ -957,7 +978,7 @@ version = "0.2.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "14dbbfd5c71d70241ecf9e6f13737f7b5ce823821063188d7e46c41d371eebd5"
 dependencies = [
- "unicode-width",
+ "unicode-width 0.1.13",
 ]

 [[package]]
@@ -1160,7 +1181,7 @@ dependencies = [
 "instant",
 "number_prefix",
 "portable-atomic",
- "unicode-width",
+ "unicode-width 0.1.13",
 "vt100",
 ]

@@ -1246,7 +1267,7 @@ dependencies = [
 "Inflector",
 "proc-macro2",
 "quote",
- "syn",
+ "syn 2.0.82",
 ]

 [[package]]
@@ -1346,9 +1367,9 @@ checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"

 [[package]]
 name = "libc"
-version = "0.2.159"
+version = "0.2.161"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "561d97a539a36e26a9a5fad1ea11a3039a67714694aaa379433e580854bc3dc5"
+checksum = "8e9489c2807c139ffd9c1794f4af0ebe86a828db53ecdc7fea2111d0fed085d1"

 [[package]]
 name = "libcst"
@@ -1372,7 +1393,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a2ae40017ac09cd2c6a53504cb3c871c7f2b41466eac5bc66ba63f39073b467b"
 dependencies = [
 "quote",
- "syn",
+ "syn 2.0.82",
 ]

 [[package]]
@@ -1760,18 +1781,17 @@ dependencies = [
 "once_cell",
 "regex",
 "serde",
- "unicode-width",
+ "unicode-width 0.1.13",
 ]

 [[package]]
 name = "pep440_rs"
-version = "0.6.6"
+version = "0.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "466eada3179c2e069ca897b99006cbb33f816290eaeec62464eea907e22ae385"
+checksum = "7c8ee724d21f351f9d47276614ac9710975db827ba9fe2ca5a517ba648193307"
 dependencies = [
- "once_cell",
 "serde",
- "unicode-width",
+ "unicode-width 0.2.0",
 "unscanny",
 ]

@@ -1787,7 +1807,7 @@ dependencies = [
 "serde",
 "thiserror",
 "tracing",
- "unicode-width",
+ "unicode-width 0.1.13",
 "url",
 ]

@@ -1828,7 +1848,7 @@ dependencies = [
 "pest_meta",
 "proc-macro2",
 "quote",
- "syn",
+ "syn 2.0.82",
 ]

 [[package]]
@@ -1943,9 +1963,9 @@ dependencies = [

 [[package]]
 name = "proc-macro2"
-version = "1.0.87"
+version = "1.0.88"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b3e4daa0dcf6feba26f985457cdf104d4b4256fc5a09547140f3631bb076b19a"
+checksum = "7c3a7fc5db1e57d5a779a352c8cdb57b29aa4c40cc69c3a68a7fedc815fbf2f9"
 dependencies = [
 "unicode-ident",
 ]
@@ -2080,6 +2100,7 @@ dependencies = [
 "camino",
 "compact_str",
 "countme",
+ "dir-test",
 "hashbrown 0.15.0",
 "insta",
 "itertools 0.13.0",
@@ -2087,7 +2108,6 @@ dependencies = [
 "ordermap",
 "red_knot_test",
 "red_knot_vendored",
- "rstest",
 "ruff_db",
 "ruff_index",
 "ruff_python_ast",
@@ -2136,7 +2156,7 @@ version = "0.0.0"
 dependencies = [
 "anyhow",
 "colored",
- "once_cell",
+ "memchr",
 "red_knot_python_semantic",
 "red_knot_vendored",
 "regex",
@@ -2154,7 +2174,6 @@ dependencies = [
 name = "red_knot_vendored"
 version = "0.0.0"
 dependencies = [
- "once_cell",
 "path-slash",
 "ruff_db",
 "walkdir",
@@ -2270,12 +2289,6 @@ version = "0.8.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2b15c43186be67a4fd63bee50d0303afffcef381492ebe2c5d87f324e1b8815c"

-[[package]]
-name = "relative-path"
-version = "1.9.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ba39f3699c378cd8970968dcbff9c43159ea4cfbd88d43c00b22f2ef10a435d2"
-
 [[package]]
 name = "ring"
 version = "0.17.8"
@@ -2291,36 +2304,9 @@ dependencies = [
 "windows-sys 0.52.0",
 ]

-[[package]]
-name = "rstest"
-version = "0.22.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7b423f0e62bdd61734b67cd21ff50871dfaeb9cc74f869dcd6af974fbcb19936"
-dependencies = [
- "rstest_macros",
- "rustc_version",
-]
-
-[[package]]
-name = "rstest_macros"
-version = "0.22.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c5e1711e7d14f74b12a58411c542185ef7fb7f2e7f8ee6e2940a883628522b42"
-dependencies = [
- "cfg-if",
- "glob",
- "proc-macro2",
- "quote",
- "regex",
- "relative-path",
- "rustc_version",
- "syn",
- "unicode-ident",
-]
-
 [[package]]
 name = "ruff"
-version = "0.7.0"
+version = "0.7.1"
 dependencies = [
 "anyhow",
 "argfile",
@@ -2382,7 +2368,6 @@ dependencies = [
 "codspeed-criterion-compat",
 "criterion",
 "mimalloc",
- "once_cell",
 "rayon",
 "red_knot_python_semantic",
 "red_knot_workspace",
@@ -2506,7 +2491,7 @@ dependencies = [
 "serde",
 "static_assertions",
 "tracing",
- "unicode-width",
+ "unicode-width 0.1.13",
 ]

 [[package]]
@@ -2515,7 +2500,6 @@ version = "0.1.0"
 dependencies = [
 "anyhow",
 "clap",
- "once_cell",
 "red_knot_python_semantic",
 "ruff_cache",
 "ruff_db",
@@ -2539,7 +2523,7 @@ dependencies = [

 [[package]]
 name = "ruff_linter"
-version = "0.7.0"
+version = "0.7.1"
 dependencies = [
 "aho-corasick",
 "annotate-snippets 0.9.2",
@@ -2560,10 +2544,9 @@ dependencies = [
 "log",
 "memchr",
 "natord",
- "once_cell",
 "path-absolutize",
 "pathdiff",
- "pep440_rs 0.6.6",
+ "pep440_rs 0.7.1",
 "pyproject-toml",
 "quick-junit",
 "regex",
@@ -2594,7 +2577,7 @@ dependencies = [
 "toml",
 "typed-arena",
 "unicode-normalization",
- "unicode-width",
+ "unicode-width 0.1.13",
 "unicode_names2",
 "url",
 ]
@@ -2607,7 +2590,7 @@ dependencies = [
 "proc-macro2",
 "quote",
 "ruff_python_trivia",
- "syn",
+ "syn 2.0.82",
 ]

 [[package]]
@@ -2616,7 +2599,6 @@ version = "0.0.0"
 dependencies = [
 "anyhow",
 "itertools 0.13.0",
- "once_cell",
 "rand",
 "ruff_diagnostics",
 "ruff_source_file",
@@ -2638,7 +2620,6 @@ dependencies = [
 "compact_str",
 "is-macro",
 "itertools 0.13.0",
- "once_cell",
 "ruff_cache",
 "ruff_macros",
 "ruff_python_trivia",
@@ -2664,7 +2645,6 @@ dependencies = [
 name = "ruff_python_codegen"
 version = "0.0.0"
 dependencies = [
- "once_cell",
 "ruff_python_ast",
 "ruff_python_literal",
 "ruff_python_parser",
@@ -2682,7 +2662,6 @@ dependencies = [
 "insta",
 "itertools 0.13.0",
 "memchr",
- "once_cell",
 "regex",
 "ruff_cache",
 "ruff_formatter",
@@ -2833,6 +2812,7 @@ dependencies = [
 "serde",
 "serde_json",
 "shellexpand",
+ "thiserror",
 "tracing",
 "tracing-subscriber",
 ]
@@ -2842,7 +2822,6 @@ name = "ruff_source_file"
 version = "0.0.0"
 dependencies = [
 "memchr",
- "once_cell",
 "ruff_text_size",
 "serde",
 ]
@@ -2859,7 +2838,7 @@ dependencies = [

 [[package]]
 name = "ruff_wasm"
-version = "0.7.0"
+version = "0.7.1"
 dependencies = [
 "console_error_panic_hook",
 "console_log",
@@ -2898,7 +2877,7 @@ dependencies = [
 "matchit",
 "path-absolutize",
 "path-slash",
- "pep440_rs 0.6.6",
+ "pep440_rs 0.7.1",
 "regex",
 "ruff_cache",
 "ruff_formatter",
@@ -2940,15 +2919,6 @@ version = "2.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "583034fd73374156e66797ed8e5b0d5690409c9226b22d87cb7f19821c05d152"

-[[package]]
-name = "rustc_version"
-version = "0.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cfcb3a22ef46e85b45de6ee7e79d063319ebb6594faafcf1c225ea92ab6e9b92"
-dependencies = [
- "semver",
-]
-
 [[package]]
 name = "rustix"
 version = "0.38.37"
@@ -3009,7 +2979,7 @@ checksum = "e86697c916019a8588c99b5fac3cead74ec0b4b819707a682fd4d23fa0ce1ba1"
 [[package]]
 name = "salsa"
 version = "0.18.0"
-source = "git+https://github.com/salsa-rs/salsa.git?rev=b14be5c0392f4c55eca60b92e457a35549372382#b14be5c0392f4c55eca60b92e457a35549372382"
+source = "git+https://github.com/salsa-rs/salsa.git?rev=254c749b02cde2fd29852a7463a33e800b771758#254c749b02cde2fd29852a7463a33e800b771758"
 dependencies = [
 "append-only-vec",
 "arc-swap",
@@ -3029,17 +2999,17 @@ dependencies = [
 [[package]]
 name = "salsa-macro-rules"
 version = "0.1.0"
-source = "git+https://github.com/salsa-rs/salsa.git?rev=b14be5c0392f4c55eca60b92e457a35549372382#b14be5c0392f4c55eca60b92e457a35549372382"
+source = "git+https://github.com/salsa-rs/salsa.git?rev=254c749b02cde2fd29852a7463a33e800b771758#254c749b02cde2fd29852a7463a33e800b771758"

 [[package]]
 name = "salsa-macros"
 version = "0.18.0"
-source = "git+https://github.com/salsa-rs/salsa.git?rev=b14be5c0392f4c55eca60b92e457a35549372382#b14be5c0392f4c55eca60b92e457a35549372382"
+source = "git+https://github.com/salsa-rs/salsa.git?rev=254c749b02cde2fd29852a7463a33e800b771758#254c749b02cde2fd29852a7463a33e800b771758"
 dependencies = [
 "heck",
 "proc-macro2",
 "quote",
- "syn",
+ "syn 2.0.82",
 "synstructure",
 ]

@@ -3073,7 +3043,7 @@ dependencies = [
 "proc-macro2",
 "quote",
 "serde_derive_internals",
- "syn",
+ "syn 2.0.82",
 ]

 [[package]]
@@ -3094,12 +3064,6 @@ version = "4.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1c107b6f4780854c8b126e228ea8869f4d7b71260f962fefb57b996b8959ba6b"

-[[package]]
-name = "semver"
-version = "1.0.23"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "61697e0a1c7e512e84a621326239844a24d8207b4669b41bc18b32ea5cbf988b"
-
 [[package]]
 name = "serde"
 version = "1.0.210"
@@ -3128,7 +3092,7 @@ checksum = "243902eda00fad750862fc144cea25caca5e20d615af0a81bee94ca738f1df1f"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn",
+ "syn 2.0.82",
 ]

 [[package]]
@@ -3139,14 +3103,14 @@ checksum = "330f01ce65a3a5fe59a60c82f3c9a024b573b8a6e875bd233fe5f934e71d54e3"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn",
+ "syn 2.0.82",
 ]

 [[package]]
 name = "serde_json"
-version = "1.0.128"
+version = "1.0.132"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ff5456707a1de34e7e37f2a6fd3d3f808c318259cbd01ab6377795054b483d8"
+checksum = "d726bfaff4b320266d395898905d0eba0345aae23b54aee3a737e260fd46db03"
 dependencies = [
 "itoa",
 "memchr",
@@ -3162,7 +3126,7 @@ checksum = "6c64451ba24fc7a6a2d60fc75dd9c83c90903b19028d4eff35e88fc1e86564e9"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn",
+ "syn 2.0.82",
 ]

 [[package]]
@@ -3203,7 +3167,7 @@ dependencies = [
 "darling",
 "proc-macro2",
 "quote",
- "syn",
+ "syn 2.0.82",
 ]

 [[package]]
@@ -3305,7 +3269,7 @@ dependencies = [
 "proc-macro2",
 "quote",
 "rustversion",
- "syn",
+ "syn 2.0.82",
 ]

 [[package]]
@@ -3316,9 +3280,20 @@ checksum = "81cdd64d312baedb58e21336b31bc043b77e01cc99033ce76ef539f78e965ebc"

 [[package]]
 name = "syn"
-version = "2.0.79"
+version = "1.0.109"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "89132cd0bf050864e1d38dc3bbc07a0eb8e7530af26344d3d2bbbef83499f590"
+checksum = "72b64191b275b66ffe2469e8af2c1cfe3bafa67b529ead792a6d0160888b4237"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "syn"
+version = "2.0.82"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "83540f837a8afc019423a8edb95b52a8effe46957ee402287f4292fae35be021"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -3333,7 +3308,7 @@ checksum = "c8af7666ab7b6390ab78131fb5b0fce11d6b7a6951602017c35fa82800708971"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn",
+ "syn 2.0.82",
 ]

 [[package]]
@@ -3396,7 +3371,7 @@ dependencies = [
 "cfg-if",
 "proc-macro2",
 "quote",
- "syn",
+ "syn 2.0.82",
 ]

 [[package]]
@@ -3407,7 +3382,7 @@ checksum = "5c89e72a01ed4c579669add59014b9a524d609c0c88c6a585ce37485879f6ffb"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn",
+ "syn 2.0.82",
 "test-case-core",
 ]

@@ -3428,7 +3403,7 @@ checksum = "08904e7672f5eb876eaaf87e0ce17857500934f4981c4a0ab2b4aa98baac7fc3"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn",
+ "syn 2.0.82",
 ]

 [[package]]
@@ -3540,7 +3515,7 @@ checksum = "34704c8d6ebcbc939824180af020566b01a7c01f80641264eba0999f6c2b6be7"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn",
+ "syn 2.0.82",
 ]

 [[package]]
@@ -3704,6 +3679,12 @@ version = "0.1.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0336d538f7abc86d282a4189614dfaa90810dfc2c6f6427eaf88e16311dd225d"

+[[package]]
+name = "unicode-width"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fc81956842c57dac11422a97c3b8195a1ff727f06e85c84ed2e8aa277c9a0fd"
+
 [[package]]
 name = "unicode_names2"
 version = "1.3.0"
@@ -3774,9 +3755,9 @@ checksum = "711b9620af191e0cdc7468a8d14e709c3dcdb115b36f838e601583af800a370a"

 [[package]]
 name = "uuid"
-version = "1.10.0"
+version = "1.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "81dfa00651efa65069b0b6b651f4aaa31ba9e3c3ce0137aaad053604ee7e0314"
+checksum = "f8c5f0a0af699448548ad1a2fbf920fb4bee257eae39953ba95cb84891a0446a"
 dependencies = [
 "getrandom",
 "rand",
@@ -3786,13 +3767,13 @@ dependencies = [

 [[package]]
 name = "uuid-macro-internal"
-version = "1.10.0"
+version = "1.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ee1cd046f83ea2c4e920d6ee9f7c3537ef928d75dce5d84a87c2c5d6b3999a3a"
+checksum = "6b91f57fe13a38d0ce9e28a03463d8d3c2468ed03d75375110ec71d93b449a08"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn",
+ "syn 2.0.82",
 ]

 [[package]]
@@ -3815,7 +3796,7 @@ checksum = "84cd863bf0db7e392ba3bd04994be3473491b31e66340672af5d11943c6274de"
 dependencies = [
 "itoa",
 "log",
- "unicode-width",
+ "unicode-width 0.1.13",
 "vte",
 ]

@@ -3878,7 +3859,7 @@ dependencies = [
 "once_cell",
 "proc-macro2",
 "quote",
- "syn",
+ "syn 2.0.82",
 "wasm-bindgen-shared",
 ]

@@ -3912,7 +3893,7 @@ checksum = "26c6ab57572f7a24a4985830b120de1594465e5d500f24afe89e16b4e833ef68"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn",
+ "syn 2.0.82",
 "wasm-bindgen-backend",
 "wasm-bindgen-shared",
 ]
@@ -3946,7 +3927,7 @@ checksum = "c97b2ef2c8d627381e51c071c2ab328eac606d3f69dd82bcbca20a9e389d95f0"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn",
+ "syn 2.0.82",
 ]

 [[package]]
@@ -4234,7 +4215,7 @@ checksum = "9ce1b18ccd8e73a9321186f97e46f9f04b778851177567b1975109d26a08d2a6"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn",
+ "syn 2.0.82",
 ]

 [[package]]
@@ -15,7 +15,7 @@

 python3Packages.buildPythonPackage rec {
  pname = "ruff";
-  version = "0.7.0";
+  version = "0.7.1";
  pyproject = true;

  outputs = [
@@ -27,7 +27,7 @@ python3Packages.buildPythonPackage rec {
    owner = "astral-sh";
    repo = "ruff";
    rev = "refs/tags/${version}";
-    hash = "sha256-//ayB5ayYM5FqiSXDDns2tIL+PJ0Osvkp8+MEEL0L+8=";
+    hash = "sha256-TPr6YdSb5JKltXHDi1PdGzPYjmmsbCFQKxIiJURrBMI=";
  };

  # Do not rely on path lookup at runtime to find the ruff binary
@@ -42,7 +42,7 @@ python3Packages.buildPythonPackage rec {
    lockFile = ./Cargo.lock;
    outputHashes = {
      "lsp-types-0.95.1" = "sha256-8Oh299exWXVi6A39pALOISNfp8XBya8z+KT/Z7suRxQ=";
-      "salsa-0.18.0" = "sha256-vuLgeaqIL8U+5PUHJaGdovHFapAMGGQ9nPAMJJnxz/o=";
+      "salsa-0.18.0" = "sha256-zUF2ZBorJzgo8O8ZEnFaitAvWXqNwtHSqx4JE8nByIg=";
    };
  };

@@ -4,9 +4,9 @@ version = 3

 [[package]]
 name = "addr2line"
-version = "0.24.1"
+version = "0.24.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f5fb1d8e4442bd405fdfd1dacb42792696b0cf9cb15882e5d097b742a676d375"
+checksum = "dfbe277e56a376000877090da837660b4427aad530e3028d44e0bffe4f89a1c1"
 dependencies = [
 "gimli",
 ]
@@ -109,6 +109,12 @@ version = "1.0.89"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "86fdf8605db99b54d3cd748a44c6d04df638eb5dafb219b135d0149bd0db01f6"

+[[package]]
+name = "arc-swap"
+version = "1.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "69f7f8c3906b62b754cd5326047894316021dcfe5a194c8ea52bdd94934a3457"
+
 [[package]]
 name = "asn1-rs"
 version = "0.6.2"
@@ -185,9 +191,9 @@ checksum = "ace50bade8e6234aa140d9a2f552bbee1db4d353f69b8217bc503490fc1a9f26"

 [[package]]
 name = "aws-lc-rs"
-version = "1.9.0"
+version = "1.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2f95446d919226d587817a7d21379e6eb099b97b45110a7f272a444ca5c54070"
+checksum = "cdd82dba44d209fddb11c190e0a94b78651f95299598e472215667417a03ff1d"
 dependencies = [
 "aws-lc-sys",
 "mirai-annotations",
@@ -198,9 +204,9 @@ dependencies = [

 [[package]]
 name = "aws-lc-sys"
-version = "0.21.2"
+version = "0.22.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b3ddc4a5b231dd6958b140ff3151b6412b3f4321fab354f399eec8f14b06df62"
+checksum = "df7a4168111d7eb622a31b214057b8509c0a7e1794f44c546d742330dc793972"
 dependencies = [
 "bindgen",
 "cc",
@@ -252,9 +258,9 @@ dependencies = [

 [[package]]
 name = "bindgen"
-version = "0.69.4"
+version = "0.69.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a00dc851838a2120612785d195287475a3ac45514741da670b735818822129a0"
+checksum = "271383c67ccabffb7381723dea0672a673f292304fcb45c01cc648c7a8d58088"
 dependencies = [
 "bitflags 2.6.0",
 "cexpr",
@@ -316,7 +322,7 @@ dependencies = [
 "hyperlocal",
 "log",
 "pin-project-lite",
- "rustls 0.23.13",
+ "rustls 0.23.14",
 "rustls-native-certs 0.7.3",
 "rustls-pemfile 2.2.0",
 "rustls-pki-types",
@@ -364,9 +370,9 @@ checksum = "428d9aa8fbc0670b7b8d6030a7fadd0f86151cae55e4dbbece15f3780a3dfaf3"

 [[package]]
 name = "cc"
-version = "1.1.24"
+version = "1.1.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "812acba72f0a070b003d3697490d2b55b837230ae7c6c6497f05cc2ddbb8d938"
+checksum = "b16803a61b81d9eabb7eae2588776c4c1e584b738ede45fdbb4c972cec1e9945"
 dependencies = [
 "jobserver",
 "libc",
@@ -420,9 +426,9 @@ dependencies = [

 [[package]]
 name = "clap"
-version = "4.5.19"
+version = "4.5.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7be5744db7978a28d9df86a214130d106a89ce49644cbc4e3f0c22c3fba30615"
+checksum = "b97f376d85a664d5837dbae44bf546e6477a679ff6610010f17276f686d867e8"
 dependencies = [
 "clap_builder",
 "clap_derive",
@@ -430,9 +436,9 @@ dependencies = [

 [[package]]
 name = "clap_builder"
-version = "4.5.19"
+version = "4.5.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a5fbc17d3ef8278f55b282b2a2e75ae6f6c7d4bb70ed3d0382375104bfafdb4b"
+checksum = "19bc80abd44e4bed93ca373a0704ccbd1b710dc5749406201bb018272808dc54"
 dependencies = [
 "anstream",
 "anstyle",
@@ -803,9 +809,9 @@ dependencies = [

 [[package]]
 name = "futures"
-version = "0.3.30"
+version = "0.3.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "645c6916888f6cb6350d2550b80fb63e734897a8498abe35cfb732b6487804b0"
+checksum = "65bc07b1a8bc7c85c5f2e110c476c7389b4554ba72af57d8445ea63a576b0876"
 dependencies = [
 "futures-channel",
 "futures-core",
@@ -818,9 +824,9 @@ dependencies = [

 [[package]]
 name = "futures-channel"
-version = "0.3.30"
+version = "0.3.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eac8f7d7865dcb88bd4373ab671c8cf4508703796caa2b1985a9ca867b3fcb78"
+checksum = "2dff15bf788c671c1934e366d07e30c1814a8ef514e1af724a602e8a2fbe1b10"
 dependencies = [
 "futures-core",
 "futures-sink",
@@ -828,15 +834,15 @@ dependencies = [

 [[package]]
 name = "futures-core"
-version = "0.3.30"
+version = "0.3.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dfc6580bb841c5a68e9ef15c77ccc837b40a7504914d52e47b8b0e9bbda25a1d"
+checksum = "05f29059c0c2090612e8d742178b0580d2dc940c837851ad723096f87af6663e"

 [[package]]
 name = "futures-executor"
-version = "0.3.30"
+version = "0.3.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a576fc72ae164fca6b9db127eaa9a9dda0d61316034f33a0a0d4eda41f02b01d"
+checksum = "1e28d1d997f585e54aebc3f97d39e72338912123a67330d723fdbb564d646c9f"
 dependencies = [
 "futures-core",
 "futures-task",
@@ -845,15 +851,15 @@ dependencies = [

 [[package]]
 name = "futures-io"
-version = "0.3.30"
+version = "0.3.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a44623e20b9681a318efdd71c299b6b222ed6f231972bfe2f224ebad6311f0c1"
+checksum = "9e5c1b78ca4aae1ac06c48a526a655760685149f0d465d21f37abfe57ce075c6"

 [[package]]
 name = "futures-macro"
-version = "0.3.30"
+version = "0.3.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "87750cf4b7a4c0625b1529e4c543c2182106e4dedc60a2a6455e00d212c489ac"
+checksum = "162ee34ebcb7c64a8abebc059ce0fee27c2262618d7b60ed8faf72fef13c3650"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -862,21 +868,21 @@ dependencies = [

 [[package]]
 name = "futures-sink"
-version = "0.3.30"
+version = "0.3.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9fb8e00e87438d937621c1c6269e53f536c14d3fbd6a042bb24879e57d474fb5"
+checksum = "e575fab7d1e0dcb8d0c7bcf9a63ee213816ab51902e6d244a95819acacf1d4f7"

 [[package]]
 name = "futures-task"
-version = "0.3.30"
+version = "0.3.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "38d84fa142264698cdce1a9f9172cf383a0c82de1bddcf3092901442c4097004"
+checksum = "f90f7dce0722e95104fcb095585910c0977252f286e354b5e3bd38902cd99988"

 [[package]]
 name = "futures-util"
-version = "0.3.30"
+version = "0.3.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3d6401deb83407ab3da39eba7e33987a73c3df0c82b4bb5813ee871c19c41d48"
+checksum = "9fa08315bb612088cc391249efdc3bc77536f16c91f6cf495e6fbe85b20a4a81"
 dependencies = [
 "futures-channel",
 "futures-core",
@@ -915,9 +921,9 @@ dependencies = [

 [[package]]
 name = "gimli"
-version = "0.31.0"
+version = "0.31.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32085ea23f3234fc7846555e85283ba4de91e21016dc0455a16286d87a292d64"
+checksum = "07e28edb80900c19c28f1072f2e8aeca7fa06b23cd4169cefe1af5aa3260783f"

 [[package]]
 name = "glob"
@@ -1171,7 +1177,7 @@ dependencies = [
 "http 1.1.0",
 "hyper",
 "hyper-util",
- "rustls 0.23.13",
+ "rustls 0.23.14",
 "rustls-pki-types",
 "tokio",
 "tokio-rustls 0.26.0",
@@ -1317,9 +1323,9 @@ dependencies = [

 [[package]]
 name = "ipnet"
-version = "2.10.0"
+version = "2.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "187674a687eed5fe42285b40c6291f9a01517d415fad1c3cbc6a9f778af7fcd4"
+checksum = "ddc24109865250148c2e0f3d25d4f0f479571723792d3802153c60922a4fb708"
 dependencies = [
 "serde",
 ]
@@ -1356,9 +1362,9 @@ dependencies = [

 [[package]]
 name = "js-sys"
-version = "0.3.70"
+version = "0.3.72"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1868808506b929d7b0cfa8f75951347aa71bb21144b7791bae35d9bccfcfe37a"
+checksum = "6a88f1bda2bd75b0452a14784937d796722fdebfe50df998aeb3f0b7603019a9"
 dependencies = [
 "wasm-bindgen",
 ]
@@ -1645,9 +1651,9 @@ dependencies = [

 [[package]]
 name = "object"
-version = "0.36.4"
+version = "0.36.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "084f1a5821ac4c651660a94a7153d27ac9d8a53736203f58b31945ded098070a"
+checksum = "aedf0a2d09c573ed1d8d85b30c119153926a2b36dce0ab28322c09a117a4683e"
 dependencies = [
 "memchr",
 ]
@@ -1663,12 +1669,9 @@ dependencies = [

 [[package]]
 name = "once_cell"
-version = "1.20.1"
+version = "1.20.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "82881c4be219ab5faaf2ad5e5e5ecdff8c66bd7402ca3160975c93b24961afd1"
-dependencies = [
- "portable-atomic",
-]
+checksum = "1261fe7e33c73b354eab43b1273a57c8f967d0391e80353e51f764ac02cf6775"

 [[package]]
 name = "openssl-probe"
@@ -1750,18 +1753,18 @@ checksum = "e3148f5046208a5d56bcfc03053e3ca6334e51da8dfb19b6cdc8b306fae3283e"

 [[package]]
 name = "pin-project"
-version = "1.1.5"
+version = "1.1.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6bf43b791c5b9e34c3d182969b4abb522f9343702850a2e57f460d00d09b4b3"
+checksum = "baf123a161dde1e524adf36f90bc5d8d3462824a9c43553ad07a8183161189ec"
 dependencies = [
 "pin-project-internal",
 ]

 [[package]]
 name = "pin-project-internal"
-version = "1.1.5"
+version = "1.1.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2f38a4412a78282e09a2cf38d195ea5420d15ba0602cb375210efbc877243965"
+checksum = "a4502d8515ca9f32f1fb543d987f63d95a14934883db45bdb48060b6b69257f8"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -1780,12 +1783,6 @@ version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"

-[[package]]
-name = "portable-atomic"
-version = "1.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cc9c68a3f6da06753e9335d63e27f6b9754dd1920d941135b7ea8224f141adb2"
-
 [[package]]
 name = "powerfmt"
 version = "0.2.0"
@@ -1822,9 +1819,9 @@ dependencies = [

 [[package]]
 name = "proc-macro2"
-version = "1.0.86"
+version = "1.0.87"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5e719e8df665df0d1c8fbfd238015744736151d4445ec0836b8e628aae103b77"
+checksum = "b3e4daa0dcf6feba26f985457cdf104d4b4256fc5a09547140f3631bb076b19a"
 dependencies = [
 "unicode-ident",
 ]
@@ -2022,9 +2019,9 @@ dependencies = [

 [[package]]
 name = "rustls"
-version = "0.23.13"
+version = "0.23.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2dabaac7466917e566adb06783a81ca48944c6898a1b08b9374106dd671f4c8"
+checksum = "415d9944693cb90382053259f89fbb077ea730ad7273047ec63b19bc9b160ba8"
 dependencies = [
 "aws-lc-rs",
 "log",
@@ -2137,9 +2134,9 @@ dependencies = [

 [[package]]
 name = "schannel"
-version = "0.1.24"
+version = "0.1.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e9aaafd5a2b6e3d657ff009d82fbd630b6bd54dd4eb06f21693925cdf80f9b8b"
+checksum = "01227be5826fa0690321a2ba6c5cd57a19cf3f6a09e76973b58e61de6ab9d1c1"
 dependencies = [
 "windows-sys 0.59.0",
 ]
@@ -2250,9 +2247,9 @@ dependencies = [

 [[package]]
 name = "serde_with"
-version = "3.10.0"
+version = "3.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9720086b3357bcb44fce40117d769a4d068c70ecfa190850a980a71755f66fcc"
+checksum = "8e28bdad6db2b8340e449f7108f020b3b092e8583a9e3fb82713e1d4e71fe817"
 dependencies = [
 "base64 0.22.1",
 "chrono",
@@ -2268,9 +2265,9 @@ dependencies = [

 [[package]]
 name = "serde_with_macros"
-version = "3.10.0"
+version = "3.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5f1abbfe725f27678f4663bcacb75a83e829fd464c25d78dd038a3a29e307cec"
+checksum = "9d846214a9854ef724f3da161b426242d8de7c1fc7de2f89bb1efcb154dca79d"
 dependencies = [
 "darling",
 "proc-macro2",
@@ -2603,7 +2600,7 @@ version = "0.26.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0c7bc40d0e5a97695bb96e27995cd3a08538541b0a846f65bba7a359f36700d4"
 dependencies = [
- "rustls 0.23.13",
+ "rustls 0.23.14",
 "rustls-pki-types",
 "tokio",
 ]
@@ -2846,9 +2843,9 @@ checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"

 [[package]]
 name = "wasm-bindgen"
-version = "0.2.93"
+version = "0.2.95"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a82edfc16a6c469f5f44dc7b571814045d60404b55a0ee849f9bcfa2e63dd9b5"
+checksum = "128d1e363af62632b8eb57219c8fd7877144af57558fb2ef0368d0087bddeb2e"
 dependencies = [
 "cfg-if",
 "once_cell",
@@ -2857,9 +2854,9 @@ dependencies = [

 [[package]]
 name = "wasm-bindgen-backend"
-version = "0.2.93"
+version = "0.2.95"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9de396da306523044d3302746f1208fa71d7532227f15e347e2d93e4145dd77b"
+checksum = "cb6dd4d3ca0ddffd1dd1c9c04f94b868c37ff5fac97c30b97cff2d74fce3a358"
 dependencies = [
 "bumpalo",
 "log",
@@ -2872,9 +2869,9 @@ dependencies = [

 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.93"
+version = "0.2.95"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "585c4c91a46b072c92e908d99cb1dcdf95c5218eeb6f3bf1efa991ee7a68cccf"
+checksum = "e79384be7f8f5a9dd5d7167216f022090cf1f9ec128e6e6a482a2cb5c5422c56"
 dependencies = [
 "quote",
 "wasm-bindgen-macro-support",
@@ -2882,9 +2879,9 @@ dependencies = [

 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.93"
+version = "0.2.95"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "afc340c74d9005395cf9dd098506f7f44e38f2b4a21c6aaacf9a105ea5e1e836"
+checksum = "26c6ab57572f7a24a4985830b120de1594465e5d500f24afe89e16b4e833ef68"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -2895,9 +2892,9 @@ dependencies = [

 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.93"
+version = "0.2.95"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c62a0a307cb4a311d3a07867860911ca130c3494e8c2719593806c08bc5d0484"
+checksum = "65fc09f10666a9f147042251e0dda9c18f166ff7de300607007e96bdebc1068d"

 [[package]]
 name = "which"
@@ -3117,10 +3114,11 @@ dependencies = [

 [[package]]
 name = "wstunnel"
-version = "10.1.3"
+version = "10.1.5"
 dependencies = [
 "ahash",
 "anyhow",
+ "arc-swap",
 "async-channel",
 "async-trait",
 "base64 0.22.1",
@@ -10,7 +10,7 @@
 }:

 let
-  version = "10.1.3";
+  version = "10.1.5";
 in

 rustPlatform.buildRustPackage {
@@ -21,7 +21,7 @@ rustPlatform.buildRustPackage {
    owner = "erebe";
    repo = "wstunnel";
    rev = "v${version}";
-    hash = "sha256-mrCDx9f+EeA6McRc1s9YwYL4RHKSla10fxXZc1WYPio=";
+    hash = "sha256-MomT9iwIsdou7lIfI7zBU9nEjjYGcsHKTlrYbK4p3BQ=";
  };

  cargoLock = {
@@ -57,6 +57,7 @@ rustPlatform.buildRustPackage {
    changelog = "https://github.com/erebe/wstunnel/releases/tag/v${version}";
    license = lib.licenses.bsd3;
    maintainers = with lib.maintainers; [
+      raylas
      rvdp
      neverbehave
    ];
@@ -0,0 +1,38 @@
+{
+  lib,
+  fetchFromGitHub,
+  python3Packages,
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "xortool";
+  version = "1.0.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "hellman";
+    repo = "xortool";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-xxaWhGUh/r34eS2TJt8c3Q795OsZOoQLXQllJGJTjqY=";
+  };
+
+  build-system = with python3Packages; [ poetry-core ];
+
+  dependencies = with python3Packages; [
+    docopt
+    importlib-metadata
+  ];
+
+  # Project has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [ "xortool" ];
+
+  meta = with lib; {
+    description = "Tool to analyze multi-byte XOR cipher";
+    homepage = "https://github.com/hellman/xortool";
+    changelog = "https://github.com/hellman/xortool/releases/tag/v${version}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+  };
+}
@@ -23,16 +23,16 @@ flutter.buildFlutterApplication rec {

  postInstall = ''
    rm $out/bin/calculator
-    ln -s $out/app/calculator $out/bin/expidus-calculator
+    ln -s $out/app/$pname/calculator $out/bin/expidus-calculator

    mkdir -p $out/share/applications
-    mv $out/app/data/com.expidusos.calculator.desktop $out/share/applications
+    mv $out/app/$pname/data/com.expidusos.calculator.desktop $out/share/applications

    mkdir -p $out/share/icons
-    mv $out/app/data/com.expidusos.calculator.png $out/share/icons
+    mv $out/app/$pname/data/com.expidusos.calculator.png $out/share/icons

    mkdir -p $out/share/metainfo
-    mv $out/app/data/com.expidusos.calculator.metainfo.xml $out/share/metainfo
+    mv $out/app/$pname/data/com.expidusos.calculator.metainfo.xml $out/share/metainfo

    substituteInPlace "$out/share/applications/com.expidusos.calculator.desktop" \
      --replace "Exec=calculator" "Exec=$out/bin/expidus-calculator" \
@@ -23,16 +23,16 @@ flutter.buildFlutterApplication rec {

  postInstall = ''
    rm $out/bin/file_manager
-    ln -s $out/app/file_manager $out/bin/expidus-file-manager
+    ln -s $out/app/$pname/file_manager $out/bin/expidus-file-manager

    mkdir -p $out/share/applications
-    mv $out/app/data/com.expidusos.file_manager.desktop $out/share/applications
+    mv $out/app/$pname/data/com.expidusos.file_manager.desktop $out/share/applications

    mkdir -p $out/share/icons
-    mv $out/app/data/com.expidusos.file_manager.png $out/share/icons
+    mv $out/app/$pname/data/com.expidusos.file_manager.png $out/share/icons

    mkdir -p $out/share/metainfo
-    mv $out/app/data/com.expidusos.file_manager.metainfo.xml $out/share/metainfo
+    mv $out/app/$pname/data/com.expidusos.file_manager.metainfo.xml $out/share/metainfo

    substituteInPlace "$out/share/applications/com.expidusos.file_manager.desktop" \
      --replace "Exec=file_manager" "Exec=$out/bin/expidus-file-manager" \
@@ -0,0 +1,33 @@
+From 7458110cc50d91cb7833b2abd232faca52865566 Mon Sep 17 00:00:00 2001
+From: Thomas Heijligen <src@posteo.de>
+Date: Tue, 21 May 2024 22:02:09 +0000
+Subject: [PATCH] fix install
+
+---
+ Makefile | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/Makefile b/Makefile
+index 4950b2d5cc..9d9358ad08 100644
+--- a/Makefile
+++ b/Makefile
+@@ -106,11 +106,11 @@ install:
+ 	$(CP) share/spark/theories/*why $(THEORIESDIR)
+ 	$(CP) share/spark/theories/*mlw $(THEORIESDIR)
+ 	$(CP) share/spark/runtimes/README $(RUNTIMESDIR)
+-	@echo "Generate Coq files by preprocessing context files:"
+-	$(MAKE) -C include generate
+-	$(CP) include/src/*.ad? $(INCLUDEDIR)
+-	$(CP) include/*.gpr $(LIBDIR)
+-	$(CP) include/proof $(LIBDIR)
+	#@echo "Generate Coq files by preprocessing context files:"
+	#$(MAKE) -C include generate
+	#$(CP) include/src/*.ad? $(INCLUDEDIR)
+	#$(CP) include/*.gpr $(LIBDIR)
+	#$(CP) include/proof $(LIBDIR)
+ 
+ doc: $(DOC)
+ 
+-- 
+2.44.0
+
@@ -7,10 +7,22 @@
 , python3
 , ocamlPackages
 , makeWrapper
+, gpr2
 }:
 let
  gnat_version = lib.versions.major gnat.version;

+  # gnatprove fsf-14 requires gpr2 from a special branch
+  gpr2_24_2_next = gpr2.overrideAttrs(old: rec {
+    version = "24.2.0-next";
+    src = fetchFromGitHub {
+      owner = "AdaCore";
+      repo = "gpr";
+      rev = "v${version}";
+      hash = "sha256-Tp+N9VLKjVWs1VRPYE0mQY3rl4E5iGb8xDoNatEYBg4=";
+    };
+  });
+
  fetchSpark2014 = { rev, hash } : fetchFromGitHub {
    owner = "AdaCore";
    repo = "spark2014";
@@ -33,10 +45,21 @@ let
      };
      commit_date = "2023-01-05";
    };
+    "14" = {
+      src = fetchSpark2014 {
+        rev = "ce5fad038790d5dc18f9b5345dc604f1ccf45b06"; # branch fsf-14
+        hash = "sha256-WprJJIe/GpcdabzR2xC2dAV7kIYdNTaTpNYoR3UYTVo=";
+      };
+      patches = [
+        # Disable Coq related targets which are missing in the fsf-14 branch
+        ./0001-fix-install.patch
+      ];
+      commit_date = "2024-01-11";
+    };
  };

  thisSpark = spark2014.${gnat_version} or
-    (builtins.throw "GNATprove depend on a specific GNAT version and can't be built using GNAT ${gnat_version}.");
+    (builtins.throw "GNATprove depends on a specific GNAT version and can't be built using GNAT ${gnat_version}.");

 in
 stdenv.mkDerivation rec {
@@ -45,24 +68,35 @@ stdenv.mkDerivation rec {

  src = thisSpark.src;

+  patches = thisSpark.patches or [];
+
  nativeBuildInputs = [
    gnat
    gprbuild
    python3
-    ocamlPackages.ocaml
    makeWrapper
-  ];
+  ] ++ (with ocamlPackages; [
+    ocaml
+    findlib
+    menhir
+  ]);

  buildInputs = [
    gnatcoll-core
-    ocamlPackages.camlzip
-    ocamlPackages.findlib
-    ocamlPackages.menhir
-    ocamlPackages.menhirLib
-    ocamlPackages.num
-    ocamlPackages.yojson
-    ocamlPackages.zarith
-  ];
+  ] ++ (with ocamlPackages; [
+    ocamlgraph
+    zarith
+    ppx_deriving
+    ppx_sexp_conv
+    camlzip
+    menhirLib
+    num
+    re
+    sexplib
+    yojson
+  ]) ++ (lib.optionals (gnat_version == "14")[
+    gpr2_24_2_next
+  ]);

  propagatedBuildInputs = [
    gprbuild
@@ -75,14 +109,18 @@ stdenv.mkDerivation rec {
  '';

  configurePhase = ''
+    runHook preConfigure
    make setup
+    runHook postConfigure
  '';

  installPhase = ''
+    runHook preInstall
    make install-all
    cp -a ./install/. $out
    mkdir $out/share/gpr
    ln -s $out/lib/gnat/* $out/share/gpr/
+    runHook postInstall
  '';

  meta = with lib; {
@@ -0,0 +1,53 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  gprbuild,
+  which,
+  gnat,
+  gnatcoll-core,
+  gnatcoll-iconv,
+  gnatcoll-gmp,
+  enableShared ? !stdenv.hostPlatform.isStatic,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "gpr2";
+  version = "24.0.0";
+
+  src = fetchurl {
+    url = "https://github.com/AdaCore/gpr/releases/download/v${version}/gpr2-with-lkparser-${lib.versions.majorMinor version}.tgz";
+    sha256 = "1g90689k94q3ma7q76gnjipfblgfvcq6ldwbzcf0l5hx6n8vbly8";
+  };
+
+  nativeBuildInputs = [
+    which
+    gnat
+    gprbuild
+  ];
+
+  makeFlags = [
+    "prefix=$(out)"
+    "GPR2KBDIR=${gprbuild}/share/gprconfig"
+    "PROCESSORS=$(NIX_BUILD_CORES)"
+    "ENABLE_SHARED=${if enableShared then "yes" else "no"}"
+  ];
+
+  propagatedBuildInputs = [
+    gprbuild
+    gnatcoll-gmp
+    gnatcoll-core
+    gnatcoll-iconv
+  ];
+
+  meta = with lib; {
+    description = "The framework for analyzing the GNAT Project (GPR) files";
+    homepage = "https://github.com/AdaCore/gpr";
+    license = with licenses; [
+      asl20
+      gpl3Only
+    ];
+    maintainers = with maintainers; [ heijligen ];
+    platforms = platforms.all;
+  };
+}
@@ -1,14 +1,22 @@
 { lib, stdenv
 , fetchzip
+
+# update script
+, writeScript
+, coreutils
+, curl
+, gnugrep
+, htmlq
+, nix-update
 }:

 stdenv.mkDerivation rec {
  pname = "fasmg";
-  version = "kd3c";
+  version = "kl0e";

  src = fetchzip {
    url = "https://flatassembler.net/fasmg.${version}.zip";
-    sha256 = "sha256-duxune/UjXppKf/yWp7y85rpBn4EIC6JcZPNDhScsEA=";
+    sha256 = "sha256-qUhsUMwxgUduGz+D8+Dm4EXyh7aiE9lJ1mhvTjHP6Tw=";
    stripRoot = false;
  };

@@ -48,6 +56,18 @@ stdenv.mkDerivation rec {
    cp docs/*.txt $doc/share/doc/fasmg
  '';

+  passthru.updateScript = writeScript "update-fasmg.sh" ''
+    export PATH="${lib.makeBinPath [ coreutils curl gnugrep htmlq nix-update ]}:$PATH"
+    version=$(
+      curl 'https://flatassembler.net/download.php' \
+        | htmlq .links a.boldlink  -a href \
+        | grep -E '^fasmg\..*\.zip$' \
+        | head -n1 \
+        | cut -d. -f2
+    )
+    nix-update fasmg --version "$version"
+  '';
+
  meta = with lib; {
    description = "x86(-64) macro assembler to binary, MZ, PE, COFF, and ELF";
    mainProgram = "fasmg";
@@ -146,21 +146,22 @@ let
        built=build/linux/*/$flutterMode/bundle

        mkdir -p $out/bin
-        mv $built $out/app
+        mkdir -p $out/app
+        mv $built $out/app/$pname

-        for f in $(find $out/app -iname "*.desktop" -type f); do
+        for f in $(find $out/app/$pname -iname "*.desktop" -type f); do
          install -D $f $out/share/applications/$(basename $f)
        done

-        for f in $(find $out/app -maxdepth 1 -type f); do
+        for f in $(find $out/app/$pname -maxdepth 1 -type f); do
          ln -s $f $out/bin/$(basename $f)
        done

        # make *.so executable
-        find $out/app -iname "*.so" -type f -exec chmod +x {} +
+        find $out/app/$pname -iname "*.so" -type f -exec chmod +x {} +

        # remove stuff like /build/source/packages/ubuntu_desktop_installer/linux/flutter/ephemeral
-        for f in $(find $out/app -executable -type f); do
+        for f in $(find $out/app/$pname -executable -type f); do
          if patchelf --print-rpath "$f" | grep /build; then # this ignores static libs (e,g. libapp.so) also
            echo "strip RPath of $f"
            newrp=$(patchelf --print-rpath $f | sed -r "s|/build.*ephemeral:||g" | sed -r "s|/build.*profile:||g")
@@ -1,31 +1,51 @@
-{ lib, stdenv, fetchurl, cmake, minizip, pcsclite, opensc, openssl
-, xercesc, xml-security-c, pkg-config, xsd, zlib, xalanc, xxd }:
+{ lib
+, stdenv
+, fetchurl
+, cmake
+, libtool
+, libxml2
+, minizip
+, pcsclite
+, opensc
+, openssl
+, xercesc
+, pkg-config
+, xsd
+, zlib
+, xmlsec
+, xxd
+}:

 stdenv.mkDerivation rec {
-  version = "3.17.1";
+  version = "4.0.0";
  pname = "libdigidocpp";

  src = fetchurl {
-     url = "https://github.com/open-eid/libdigidocpp/releases/download/v${version}/libdigidocpp-${version}.tar.gz";
-     hash = "sha256-3qDsIAOiWMZDj2zLE+Os7BoeCPeC4JQ6p8jSBd7PdV0=";
+    url = "https://github.com/open-eid/libdigidocpp/releases/download/v${version}/libdigidocpp-${version}.tar.gz";
+    hash = "sha256-0G7cjJEgLJ24SwHRznKJ18cRY0m50lr6HXstfbYq9f8=";
  };

  nativeBuildInputs = [ cmake pkg-config xxd ];

  buildInputs = [
-    minizip pcsclite opensc openssl xercesc
-    xml-security-c xsd zlib xalanc
+    libxml2
+    minizip
+    pcsclite
+    opensc
+    openssl
+    xercesc
+    xsd
+    zlib
+    xmlsec
  ];

  outputs = [ "out" "lib" "dev" "bin" ];

-  # Cherry-pick of
-  # https://github.com/open-eid/libdigidocpp/commit/2b5db855ba3ceb9bae1f11589ea1aea22bb7595a
-  # Fixes https://github.com/NixOS/nixpkgs/issues/334397
-  postPatch = ''
-    substituteInPlace CMakeLists.txt \
-      --replace-fail 'TSA_URL "http://dd-at.ria.ee/tsa"' 'TSA_URL "https://eid-dd.ria.ee/ts"'
-  '';
+  # This wants to link to ${CMAKE_DL_LIBS} (ltdl), and there doesn't seem to be
+  # a way to tell CMake where this should be pulled from.
+  # A cleaner fix would probably be to patch cmake to use
+  # `-L${libtool.lib}/lib -ltdl` for `CMAKE_DL_LIBS`, but that's a world rebuild.
+  env.NIX_LDFLAGS = "-L${libtool.lib}/lib";

  # libdigidocpp.so's `PKCS11Signer::PKCS11Signer()` dlopen()s "opensc-pkcs11.so"
  # itself, so add OpenSC to its DT_RUNPATH after the fixupPhase shrinked it.
@@ -23,7 +23,7 @@ assert enablePython -> pythonPackages != null;

 stdenv.mkDerivation rec {
  pname = "librealsense";
-  version = "2.56.1";
+  version = "2.56.2";

  outputs = [ "out" "dev" ];

@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
    owner = "IntelRealSense";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-1ICSJqr5WRePLIHsD3T2L0Nxdn1LWaHqHDJrfTIRl88=";
+    sha256 = "sha256-7DO+AC9R6mnSs52ex/uIzEv7q+fS7FQ5FGYe5niap4Q=";
  };

  buildInputs = [
@@ -1,122 +1,130 @@
-{ stdenv
-, lib
-, fetchFromGitHub
-, unstableGitUpdater
-, cmake
-, libiconv
-, zlib
-, enableShared ? true
+{
+  stdenv,
+  lib,
+  fetchFromGitHub,
+  unstableGitUpdater,
+  testers,
+  cmake,
+  libiconv,
+  zlib,
+  enableShared ? (!stdenv.hostPlatform.isStatic),

-, enableAudio ? true
-, withWaveWrite ? true
-, withWinMM ? stdenv.hostPlatform.isWindows
-, withDirectSound ? stdenv.hostPlatform.isWindows
-, withXAudio2 ? stdenv.hostPlatform.isWindows
-, withWASAPI ? stdenv.hostPlatform.isWindows
-, withOSS ? stdenv.hostPlatform.isFreeBSD
-, withSADA ? stdenv.hostPlatform.isSunOS
-, withALSA ? stdenv.hostPlatform.isLinux
-, alsa-lib
-, withPulseAudio ? stdenv.hostPlatform.isLinux
-, libpulseaudio
-, withCoreAudio ? stdenv.hostPlatform.isDarwin
-, CoreAudio
-, AudioToolbox
-, withLibao ? true
-, libao
+  enableAudio ? true,
+  withWaveWrite ? true,
+  withWinMM ? stdenv.hostPlatform.isWindows,
+  withDirectSound ? stdenv.hostPlatform.isWindows,
+  withXAudio2 ? stdenv.hostPlatform.isWindows,
+  withWASAPI ? stdenv.hostPlatform.isWindows,
+  withOSS ? stdenv.hostPlatform.isFreeBSD,
+  withSADA ? stdenv.hostPlatform.isSunOS,
+  withALSA ? stdenv.hostPlatform.isLinux,
+  alsa-lib,
+  withPulseAudio ? stdenv.hostPlatform.isLinux,
+  libpulseaudio,
+  withCoreAudio ? stdenv.hostPlatform.isDarwin,
+  CoreAudio,
+  AudioToolbox,
+  withLibao ? true,
+  libao,

-, enableEmulation ? true
-, withAllEmulators ? true
-, emulators ? [ ]
+  enableEmulation ? true,
+  withAllEmulators ? true,
+  emulators ? [ ],

-, enableLibplayer ? true
+  enableLibplayer ? true,

-, enableTools ? false
+  enableTools ? false,
 }:

 assert enableTools -> enableAudio && enableEmulation && enableLibplayer;

-let
-  inherit (lib) optional optionals;
-  onOff = val: if val then "ON" else "OFF";
-in
-stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
  pname = "libvgm";
-  version = "0-unstable-2024-06-08";
+  version = "0-unstable-2024-10-17";

  src = fetchFromGitHub {
    owner = "ValleyBell";
    repo = "libvgm";
-    rev = "34c368cde98f33c42455fbbfbec07073ba79bf5c";
-    hash = "sha256-eX2k2cUtapHhx8dLaFk63Si0Di1q0uDWvdOI0+FgqEY=";
+    rev = "7b694e53e42a75ce48b846c53d08e4a33f627842";
+    hash = "sha256-u+mBzmEixJT3rwuipITktFI4iVswnXftfF7syBw4t/w=";
  };

  outputs = [
    "out"
    "dev"
-  ] ++ optional enableTools "bin";
+  ] ++ lib.optionals enableTools [ "bin" ];

-  nativeBuildInputs = [
-    cmake
-  ];
+  nativeBuildInputs = [ cmake ];

-  propagatedBuildInputs = [
-    libiconv
-    zlib
-  ] ++ optionals withALSA [
-    alsa-lib
-  ] ++ optionals withPulseAudio [
-    libpulseaudio
-  ] ++ optionals withCoreAudio [
-    CoreAudio
-    AudioToolbox
-  ] ++ optionals withLibao [
-    libao
-  ];
+  propagatedBuildInputs =
+    [
+      libiconv
+      zlib
+    ]
+    ++ lib.optionals withALSA [ alsa-lib ]
+    ++ lib.optionals withPulseAudio [ libpulseaudio ]
+    ++ lib.optionals withCoreAudio [
+      CoreAudio
+      AudioToolbox
+    ]
+    ++ lib.optionals withLibao [ libao ];

-  cmakeFlags = [
-    "-DBUILD_LIBAUDIO=${onOff enableAudio}"
-    "-DBUILD_LIBEMU=${onOff enableEmulation}"
-    "-DBUILD_LIBPLAYER=${onOff enableLibplayer}"
-    "-DBUILD_TESTS=${onOff enableTools}"
-    "-DBUILD_PLAYER=${onOff enableTools}"
-    "-DBUILD_VGM2WAV=${onOff enableTools}"
-    "-DLIBRARY_TYPE=${if enableShared then "SHARED" else "STATIC"}"
-    "-DUSE_SANITIZERS=ON"
-  ] ++ optionals enableAudio [
-    "-DAUDIODRV_WAVEWRITE=${onOff withWaveWrite}"
-    "-DAUDIODRV_WINMM=${onOff withWinMM}"
-    "-DAUDIODRV_DSOUND=${onOff withDirectSound}"
-    "-DAUDIODRV_XAUDIO2=${onOff withXAudio2}"
-    "-DAUDIODRV_WASAPI=${onOff withWASAPI}"
-    "-DAUDIODRV_OSS=${onOff withOSS}"
-    "-DAUDIODRV_SADA=${onOff withSADA}"
-    "-DAUDIODRV_ALSA=${onOff withALSA}"
-    "-DAUDIODRV_PULSE=${onOff withPulseAudio}"
-    "-DAUDIODRV_APPLE=${onOff withCoreAudio}"
-    "-DAUDIODRV_LIBAO=${onOff withLibao}"
-  ] ++ optionals enableEmulation ([
-    "-DSNDEMU__ALL=${onOff withAllEmulators}"
-  ] ++ optionals (!withAllEmulators)
-    (lib.lists.forEach emulators (x: "-DSNDEMU_${x}=ON"))
-  ) ++ optionals enableTools [
-    "-DUTIL_CHARCNV_ICONV=ON"
-    "-DUTIL_CHARCNV_WINAPI=${onOff stdenv.hostPlatform.isWindows}"
-  ];
+  cmakeFlags =
+    [
+      (lib.cmakeBool "BUILD_LIBAUDIO" enableAudio)
+      (lib.cmakeBool "BUILD_LIBEMU" enableEmulation)
+      (lib.cmakeBool "BUILD_LIBPLAYER" enableLibplayer)
+      (lib.cmakeBool "BUILD_TESTS" enableTools)
+      (lib.cmakeBool "BUILD_PLAYER" enableTools)
+      (lib.cmakeBool "BUILD_VGM2WAV" enableTools)
+      (lib.cmakeFeature "LIBRARY_TYPE" (if enableShared then "SHARED" else "STATIC"))
+      (lib.cmakeBool "USE_SANITIZERS" true)
+    ]
+    ++ lib.optionals enableAudio [
+      (lib.cmakeBool "AUDIODRV_WAVEWRITE" withWaveWrite)
+      (lib.cmakeBool "AUDIODRV_WINMM" withWinMM)
+      (lib.cmakeBool "AUDIODRV_DSOUND" withDirectSound)
+      (lib.cmakeBool "AUDIODRV_XAUDIO2" withXAudio2)
+      (lib.cmakeBool "AUDIODRV_WASAPI" withWASAPI)
+      (lib.cmakeBool "AUDIODRV_OSS" withOSS)
+      (lib.cmakeBool "AUDIODRV_SADA" withSADA)
+      (lib.cmakeBool "AUDIODRV_ALSA" withALSA)
+      (lib.cmakeBool "AUDIODRV_PULSE" withPulseAudio)
+      (lib.cmakeBool "AUDIODRV_APPLE" withCoreAudio)
+      (lib.cmakeBool "AUDIODRV_LIBAO" withLibao)
+    ]
+    ++ lib.optionals enableEmulation (
+      [ (lib.cmakeBool "SNDEMU__ALL" withAllEmulators) ]
+      ++ lib.optionals (!withAllEmulators) (
+        lib.lists.forEach emulators (x: (lib.cmakeBool "SNDEMU_${x}" true))
+      )
+    )
+    ++ lib.optionals enableTools [
+      (lib.cmakeBool "UTIL_CHARCNV_ICONV" true)
+      (lib.cmakeBool "UTIL_CHARCNV_WINAPI" stdenv.hostPlatform.isWindows)
+    ];

-  passthru.updateScript = unstableGitUpdater {
-    url = "https://github.com/ValleyBell/libvgm.git";
+  passthru = {
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+    updateScript = unstableGitUpdater { };
  };

-  meta = with lib; {
-    homepage = "https://github.com/ValleyBell/libvgm";
+  meta = {
    description = "More modular rewrite of most components from VGMPlay";
+    homepage = "https://github.com/ValleyBell/libvgm";
    license =
-      if (enableEmulation && (withAllEmulators || (lib.lists.any (core: core == "WSWAN_ALL") emulators))) then
-        licenses.unfree # https://github.com/ValleyBell/libvgm/issues/43
+      if
+        (enableEmulation && (withAllEmulators || (lib.lists.any (core: core == "WSWAN_ALL") emulators)))
+      then
+        lib.licenses.unfree # https://github.com/ValleyBell/libvgm/issues/43
      else
-        licenses.gpl2Only;
-    maintainers = with maintainers; [ OPNA2608 ];
-    platforms = platforms.all;
+        lib.licenses.gpl2Only;
+    maintainers = with lib.maintainers; [ OPNA2608 ];
+    platforms = lib.platforms.all;
+    pkgConfigModules =
+      [ "vgm-utils" ]
+      ++ lib.optionals enableAudio [ "vgm-audio" ]
+      ++ lib.optionals enableEmulation [ "vgm-emu" ]
+      ++ lib.optionals enableLibplayer [ "vgm-player" ];
  };
-}
+})
@@ -6,6 +6,7 @@
  fetchFromGitHub,
  substituteAll,
  python,
+  isPy310,

  # build-system
  cython,
@@ -113,6 +114,11 @@ buildPythonPackage rec {
      # don't run benchmarks
      "test_import_time"
    ]
+    # these tests fail with python310 but succeeds with 11+
+    ++ lib.optionals isPy310 [
+      "test_https_proxy_unsupported_tls_in_tls"
+      "test_tcp_connector_raise_connector_ssl_error"
+    ]
    ++ lib.optionals stdenv.hostPlatform.is32bit [ "test_cookiejar" ]
    ++ lib.optionals stdenv.hostPlatform.isDarwin [
      "test_addresses" # https://github.com/aio-libs/aiohttp/issues/3572, remove >= v4.0.0
@@ -11,7 +11,7 @@

 buildPythonPackage rec {
  pname = "ducc0";
-  version = "0.34.0";
+  version = "0.35.0";
  pyproject = true;

  disabled = pythonOlder "3.8";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
    owner = "mtr";
    repo = "ducc";
    rev = "ducc0_${lib.replaceStrings [ "." ] [ "_" ] version}";
-    hash = "sha256-lxNqB3Lt+n4vIH7cVW4DAwhjuPn49y+/3RLKVO8IuJM=";
+    hash = "sha256-LfN+rwJp5euVpR/5sUBG3XqBhF7/KbgW/485eufJtMQ=";
  };

  buildInputs = [ pybind11 ];
@@ -34,6 +34,8 @@ buildPythonPackage rec {
  pytestFlagsArray = [ "python/test" ];
  pythonImportsCheck = [ "ducc0" ];

+  DUCC0_OPTIMIZATION = "portable-strip";
+
  meta = with lib; {
    homepage = "https://gitlab.mpcdf.mpg.de/mtr/ducc";
    description = "Efficient algorithms for Fast Fourier transforms and more";
@@ -1,48 +1,53 @@
 {
  lib,
+  stdenv,
  buildPythonPackage,
  fetchFromGitHub,
+
+  # build-system
  setuptools,
-  numpy,
+
+  # dependencies
  cloudpickle,
-  gym-notices,
-  jax-jumpy,
-  typing-extensions,
  farama-notifications,
-  importlib-metadata,
+  numpy,
+  typing-extensions,
  pythonOlder,
-  ffmpeg,
+  importlib-metadata,
+
+  # tests
+  dill,
+  flax,
  jax,
  jaxlib,
  matplotlib,
+  mujoco,
  moviepy,
  opencv4,
  pybox2d,
  pygame,
  pytestCheckHook,
  scipy,
-  stdenv,
 }:

 buildPythonPackage rec {
  pname = "gymnasium";
-  version = "0.29.1";
-  format = "pyproject";
+  version = "1.0.0";
+
+  pyproject = true;

  src = fetchFromGitHub {
    owner = "Farama-Foundation";
    repo = "gymnasium";
    rev = "refs/tags/v${version}";
-    hash = "sha256-L7fn9FaJzXwQhjDKwI9hlFpbPuQdwynU+Xjd8bbjxiw=";
+    hash = "sha256-Qchuz08yJ0giVrtKLC9vBgr28JrHQyAOCuoS239ivVw=";
  };

-  nativeBuildInputs = [ setuptools ];
+  build-system = [ setuptools ];

-  propagatedBuildInputs = [
+  dependencies = [
    cloudpickle
    farama-notifications
-    gym-notices
-    jax-jumpy
    numpy
    typing-extensions
  ] ++ lib.optionals (pythonOlder "3.10") [ importlib-metadata ];
@@ -50,11 +55,13 @@ buildPythonPackage rec {
  pythonImportsCheck = [ "gymnasium" ];

  nativeCheckInputs = [
-    ffmpeg
+    dill
+    flax
    jax
    jaxlib
    matplotlib
    moviepy
+    mujoco
    opencv4
    pybox2d
    pygame
@@ -69,20 +76,30 @@ buildPythonPackage rec {
  doCheck = !stdenv.hostPlatform.isDarwin;

  disabledTestPaths = [
-    # mujoco is required for those tests but the mujoco python bindings are not packaged in nixpkgs.
+    # Unpackaged `mujoco-py` (Openai's mujoco) is required for these tests.
    "tests/envs/mujoco/test_mujoco_custom_env.py"
+    "tests/envs/mujoco/test_mujoco_rendering.py"
+    "tests/envs/mujoco/test_mujoco_v5.py"

-    # Those tests need to write on the filesystem which cause them to fail.
-    "tests/experimental/wrappers/test_record_video.py"
+    # Rendering tests failing in the sandbox
+    "tests/wrappers/vector/test_human_rendering.py"
+
+    # These tests need to write on the filesystem which cause them to fail.
    "tests/utils/test_save_video.py"
    "tests/wrappers/test_record_video.py"
-    "tests/wrappers/test_video_recorder.py"
  ];

-  meta = with lib; {
+  disabledTests = [
+    # Succeeds for most environments but `test_render_modes[Reacher-v4]` fails because it requires
+    # OpenGL access which is not possible inside the sandbox.
+    "test_render_mode"
+  ];
+
+  meta = {
    description = "Standard API for reinforcement learning and a diverse set of reference environments (formerly Gym)";
    homepage = "https://github.com/Farama-Foundation/Gymnasium";
-    license = licenses.mit;
-    maintainers = with maintainers; [ GaetanLepage ];
+    changelog = "https://github.com/Farama-Foundation/Gymnasium/releases/tag/v${version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ GaetanLepage ];
  };
 }
@@ -22,14 +22,14 @@

 buildPythonPackage rec {
  pname = "oauthenticator";
-  version = "17.0.0";
+  version = "17.1.0";
  pyproject = true;

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-0eRfcuI+GuhgF0myZPy8ZcL4kBCLv6PcGEk+92J+GZ0=";
+    hash = "sha256-2RWsrS+W09AY9wWvvM/pYzsM0xzqcwWZYSv4BCsegiw=";
  };

  build-system = [ setuptools ];
@@ -0,0 +1,55 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+
+  # build-system
+  poetry-core,
+  poetry-dynamic-versioning,
+
+  # dependencies
+  pytest,
+  ruff,
+
+  # tests
+  pytestCheckHook,
+  pytest-mock,
+}:
+
+buildPythonPackage rec {
+  pname = "pytest-ruff";
+  version = "0.4.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "businho";
+    repo = "pytest-ruff";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-Ol+W5mDGMCwptuBa0b+Plkm64UUBf9bmr9YBo8g93Ok=";
+  };
+
+  build-system = [
+    poetry-core
+    poetry-dynamic-versioning
+  ];
+
+  dependencies = [
+    pytest
+    ruff
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    pytest-mock
+  ];
+
+  pythonImportsCheck = [ "pytest_ruff" ];
+
+  meta = {
+    description = "A pytest plugin to run ruff";
+    homepage = "https://github.com/businho/pytest-ruff";
+    changelog = "https://github.com/businho/pytest-ruff/releases/tag/v${version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ baloo ];
+  };
+}
@@ -1,12 +1,17 @@
 {
  lib,
  buildPythonPackage,
-  pythonOlder,
  fetchFromGitHub,
+  fetchpatch,
+
+  # build-system
  setuptools,
-  wheel,
+
+  # dependencies
  gymnasium,
  numpy,
+
+  # tests
  ale-py,
  bsuite,
  dm-control,
@@ -18,21 +23,32 @@

 buildPythonPackage rec {
  pname = "shimmy";
-  version = "1.3.0";
+  version = "2.0.0";
  pyproject = true;

-  disabled = pythonOlder "3.8";
-
  src = fetchFromGitHub {
    owner = "Farama-Foundation";
    repo = "Shimmy";
    rev = "refs/tags/v${version}";
-    hash = "sha256-rYBbGyMSFF/iIGruKn2JXKAVIZIfJDEHUEZUESiUg/k=";
+    hash = "sha256-/wIXjOGb3UeMQdeifYagd7OcxbBcdGPS09mjvkFsWmk=";
  };

+  patches = [
+    # Shimmy tries to register some environments from `dm-control` that require unpackaged `labmaze`.
+    # This prevents from importing `shimmy` itself by crashing with a `ModuleNotFoundError`.
+    # This patch imports those environments lazily.
+    #
+    # TODO: get rid of this patch at the next release as the issue has been fixed upstream:
+    # https://github.com/Farama-Foundation/Shimmy/pull/125
+    (fetchpatch {
+      name = "prevent-labmaze-import-crash";
+      url = "https://github.com/Farama-Foundation/Shimmy/commit/095d576f6aae15a09a1e426138629ce9f43a3c04.patch";
+      hash = "sha256-rr9l3tHunYFk0j7hfo9IaSRlogAtwXoXcQ0zuU/TL8c=";
+    })
+  ];
+
  build-system = [
    setuptools
-    wheel
  ];

  dependencies = [
@@ -58,10 +74,6 @@ buildPythonPackage rec {

    # Requires unpackaged pyspiel
    "tests/test_openspiel.py"
-
-    # Broken since ale-py v0.9.0 due to API change
-    # https://github.com/Farama-Foundation/Shimmy/issues/120
-    "tests/test_atari.py"
  ];

  preCheck = ''
@@ -20,7 +20,7 @@

 buildPythonPackage rec {
  pname = "slack-sdk";
-  version = "3.33.1";
+  version = "3.33.2";
  pyproject = true;

  disabled = pythonOlder "3.6";
@@ -29,7 +29,7 @@ buildPythonPackage rec {
    owner = "slackapi";
    repo = "python-slack-sdk";
    rev = "refs/tags/v${version}";
-    hash = "sha256-OcGzpYwa8Ouf1ojQS9KnqlL37EYCZo5yjNeXXrkd0B4=";
+    hash = "sha256-6Uvp7hVFgHVavJO6Un5L793pOOOBtaT4+eywS3rRWUU=";
  };

  postPatch = ''
@@ -1,7 +1,6 @@
 {
  lib,
  buildPythonPackage,
-  pythonOlder,
  fetchFromGitHub,

  # build-system
@@ -44,8 +43,6 @@
  pytestCheckHook,
  pyyaml,
  scipy,
-
-  stdenv,
 }:

 buildPythonPackage rec {
@@ -53,8 +50,6 @@ buildPythonPackage rec {
  version = "0.5.0";
  pyproject = true;

-  disabled = pythonOlder "3.8";
-
  src = fetchFromGitHub {
    owner = "pytorch";
    repo = "rl";
@@ -138,6 +133,11 @@ buildPythonPackage rec {
    ++ optional-dependencies.rendering;

  disabledTests = [
+    # torchrl is incompatible with gymnasium>=1.0
+    # https://github.com/pytorch/rl/discussions/2483
+    "test_resetting_strategies"
+    "test_torchrl_to_gym"
+
    # mujoco.FatalError: an OpenGL platform library has not been loaded into this process, this most likely means that a valid OpenGL context has not been created before mjr_makeContext was called
    "test_vecenvs_env"

@@ -175,6 +175,5 @@ buildPythonPackage rec {
    changelog = "https://github.com/pytorch/rl/releases/tag/v${version}";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ GaetanLepage ];
-    # ~3k tests fail with: RuntimeError: internal error
  };
 }
@@ -61,6 +61,9 @@ buildPythonPackage rec {
      "--deselect=tests/test_process.py::Test_UV_Process::test_process_streams_redirect"
      "--deselect=tests/test_process.py::Test_AIO_Process::test_process_streams_redirect"
    ]
+    ++ lib.optionals (pythonOlder "3.11") [
+      "--deselect=tests/test_tcp.py::Test_UV_TCPSSL::test_create_connection_ssl_failed_certificat"
+    ]
    ++ lib.optionals (stdenv.hostPlatform.isDarwin) [
      # Segmentation fault
      "--deselect=tests/test_fs_event.py::Test_UV_FS_EVENT_RENAME::test_fs_event_rename"
@@ -24,26 +24,31 @@ buildPythonPackage rec {

  build-system = [ setuptools ];

-  patchPhase = ''
-    # Disable all tests that need to terminate within a predetermined amount of
-    # time. This is nondeterministic.
-    sed -i 's/with self.assertCompletesWithin.*:/if True:/' \
-      tests/legacy/test_protocol.py
+  patchPhase =
+    ''
+      # Disable all tests that need to terminate within a predetermined amount of
+      # time. This is nondeterministic.
+      sed -i 's/with self.assertCompletesWithin.*:/if True:/' \
+        tests/legacy/test_protocol.py

-    # Disables tests relying on tight timeouts to avoid failures like:
-    #   File "/build/source/tests/legacy/test_protocol.py", line 1270, in test_keepalive_ping_with_no_ping_timeout
-    #     ping_1_again, ping_2 = tuple(self.protocol.pings)
-    #   ValueError: too many values to unpack (expected 2)
-    for t in \
-             test_keepalive_ping_stops_when_connection_closing \
-             test_keepalive_ping_does_not_crash_when_connection_lost \
-             test_keepalive_ping \
-             test_keepalive_ping_not_acknowledged_closes_connection \
-             test_keepalive_ping_with_no_ping_timeout \
-      ; do
-      sed -i "s/def $t(/def skip_$t(/" tests/legacy/test_protocol.py
-    done
-  '';
+      # Disables tests relying on tight timeouts to avoid failures like:
+      #   File "/build/source/tests/legacy/test_protocol.py", line 1270, in test_keepalive_ping_with_no_ping_timeout
+      #     ping_1_again, ping_2 = tuple(self.protocol.pings)
+      #   ValueError: too many values to unpack (expected 2)
+      for t in \
+               test_keepalive_ping_stops_when_connection_closing \
+               test_keepalive_ping_does_not_crash_when_connection_lost \
+               test_keepalive_ping \
+               test_keepalive_ping_not_acknowledged_closes_connection \
+               test_keepalive_ping_with_no_ping_timeout \
+        ; do
+        sed -i "s/def $t(/def skip_$t(/" tests/legacy/test_protocol.py
+      done
+    ''
+    + lib.optionalString (pythonOlder "3.11") ''
+      # Our Python 3.10 and older raise SSLError instead of SSLCertVerificationError
+      sed -i "s/def test_reject_invalid_server_certificate(/def skip_test_reject_invalid_server_certificate(/" tests/sync/test_client.py
+    '';

  nativeCheckInputs = [ unittestCheckHook ];

@@ -6,14 +6,14 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "sqlfluff";
-  version = "3.2.4";
+  version = "3.2.5";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "sqlfluff";
    repo = "sqlfluff";
    rev = "refs/tags/${version}";
-    hash = "sha256-7EP2XIbvdB3oCFTY6IS9r00/QEB/eHJth05hVBzZCUI=";
+    hash = "sha256-jYAzFqHuTpcgmnodt7vuNWTHRP3rd0B/3tp2Q04/N9o=";
  };

  build-system = with python3.pkgs; [ setuptools ];
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, nasm
+{ lib, stdenv, fetchFromGitHub, fetchpatch, nasm
 , alsa-lib, curl, flac, fluidsynth, freetype, libjpeg, libmad, libmpeg2, libogg, libtheora, libvorbis, libGLU, libGL, SDL2, zlib
 , Cocoa, AudioToolbox, Carbon, CoreMIDI, AudioUnit, cctools
 }:
@@ -14,6 +14,14 @@ stdenv.mkDerivation rec {
    hash = "sha256-8/q16MwHhbbmUxiwJOHkjNxrnBB4grMa7qw/n3KLvRc=";
  };

+  patches = [
+    # Fix building with Freetype 2.13.3. Remove after next release.
+    (fetchpatch {
+      url = "https://github.com/scummvm/scummvm/commit/65977961b20ba97b1213b5267da0cb1efb49063b.patch?full_index=1";
+      hash = "sha256-e5dJd3gP8OAD3hEJlvOhMemsNErCKTn7avlprApFig0=";
+    })
+  ];
+
  nativeBuildInputs = [ nasm ];

  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
@@ -20,28 +20,6 @@
  cmake,
  perl,
  git,
-  # nix has a problem with the `?` in the feature list
-  # enabling kafka will produce a vector with no features at all
-  enableKafka ? false,
-  # TODO investigate adding various "vendor-*"
-  # "disk-buffer" is using leveldb TODO: investigate how useful
-  # it would be, perhaps only for massive scale?
-  features ? (
-    [
-      "api"
-      "api-client"
-      "enrichment-tables"
-      "sinks"
-      "sources"
-      "sources-dnstap"
-      "transforms"
-      "component-validation-runner"
-    ]
-    # the second feature flag is passed to the rdkafka dependency
-    # building on linux fails without this feature flag (both x86_64 and AArch64)
-    ++ lib.optionals enableKafka [ "rdkafka?/gssapi-vendored" ]
-    ++ lib.optional stdenv.hostPlatform.isUnix "unix"
-  ),
  nixosTests,
  nix-update-script,
 }:
@@ -119,9 +97,6 @@ rustPlatform.buildRustPackage {
  CARGO_PROFILE_RELEASE_LTO = "fat";
  CARGO_PROFILE_RELEASE_CODEGEN_UNITS = "1";

-  buildNoDefaultFeatures = true;
-  buildFeatures = features;
-
  # TODO investigate compilation failure for tests
  # there are about 100 tests failing (out of 1100) for version 0.22.0
  doCheck = false;
@@ -158,7 +133,6 @@ rustPlatform.buildRustPackage {
  '';

  passthru = {
-    inherit features;
    tests = {
      inherit (nixosTests) vector;
    };
@@ -10,7 +10,7 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "pdm";
-  version = "2.19.2";
+  version = "2.19.3";
  pyproject = true;

  disabled = python3.pkgs.pythonOlder "3.8";
@@ -19,7 +19,7 @@ python3.pkgs.buildPythonApplication rec {
    owner = "pdm-project";
    repo = "pdm";
    rev = "refs/tags/${version}";
-    hash = "sha256-m+ZVaAZZ4+/qqJs3B8/CEj+in/mrBKgfrx1OD3GpXLU=";
+    hash = "sha256-xgwIPHlTtmgCNN4R6/BJsqmI9hbA0wFAiq4YCa+r/UM=";
  };

  nativeBuildInputs = [ installShellFiles ];
@@ -6,22 +6,24 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "dnsrecon";
-  version = "1.2.0";
+  version = "1.3.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "darkoperator";
    repo = "dnsrecon";
    rev = "refs/tags/${version}";
-    hash = "sha256-XboRxq3ZDIDtuECVSnncQ2Pa8YAvva4KUNm0O5ED6rc=";
+    hash = "sha256-h87sNorCKxUmXZAbF7FaOqruUCv84FepFwKMYrIl70M=";
  };

  build-system = with python3.pkgs; [ setuptools ];

  dependencies = with python3.pkgs; [
    dnspython
-    netaddr
+    loguru
    lxml
+    netaddr
+    requests
    setuptools
  ];

@@ -6,13 +6,13 @@

 buildGoModule rec {
  pname = "gowitness";
-  version = "3.0.4";
+  version = "3.0.5";

  src = fetchFromGitHub {
    owner = "sensepost";
    repo = "gowitness";
    rev = "refs/tags/${version}";
-    hash = "sha256-ygnYqX8il0nDvF5+jd52CypmHH8iiLMlOZWdoTsR0ig=";
+    hash = "sha256-oEEq4f5G0kOpaj4KORbVhZqW4RPkBXC33PXYUHhoMxo=";
  };

  vendorHash = "sha256-2hG+93LzJ+kUVCOXFGk83Asvn7zLWq2BSqrq+eOJhQ0=";
@@ -18,27 +18,27 @@

 mkDerivation rec {
  pname = "qdigidoc";
-  version = "4.5.1";
+  version = "4.6.0";

  src = fetchurl {
    url =
      "https://github.com/open-eid/DigiDoc4-Client/releases/download/v${version}/qdigidoc4-${version}.tar.gz";
-    hash = "sha256-grhSuexp5yd/s8h5AdmdSLBmQY85l9HKZ15oTTvC6PI=";
-  };
-
-  tsl = fetchurl {
-    url = "https://ec.europa.eu/tools/lotl/eu-lotl-pivot-300.xml";
-    sha256 = "1cikz36w9phgczcqnwk4k3mx3kk919wy2327jksmfa4cjfjq4a8d";
+    hash = "sha256-szFLY9PpZMMYhfV5joueShfu92YDVmcCC3MOWIOAKVg=";
  };

  patches = [
-    # https://github.com/open-eid/DigiDoc4-Client/pull/1251
    (fetchpatch {
-      url = "https://github.com/open-eid/DigiDoc4-Client/commit/30281d14c5fb5582832eafbc254b56f8d685227d.patch";
-      hash = "sha256-nv23NbPUogOhS8No3SMIrAcPChl+d1HkxnePpCKIoUw=";
+      url = "https://github.com/open-eid/DigiDoc4-Client/commit/bb324d18f0452c2ab1b360ff6c42bb7f11ea60d7.patch";
+      hash = "sha256-JpaU9inupSDsZKhHk+sp5g+oUynVFxR7lshjTXoFIbU=";
    })
  ];

+  # Check https://dss.nowina.lu/tl-info, "Pivots loaded" section
+  tsl = fetchurl {
+    url = "https://ec.europa.eu/tools/lotl/eu-lotl-pivot-341.xml";
+    hash = "sha256-/TI8qYxXzourjGFPBpsQzi9Depi7lLQ2JaV+FyP0FtE=";
+  };
+
  nativeBuildInputs = [ cmake gettext pkg-config qttools ];

  postPatch = ''
@@ -1,35 +0,0 @@
-{ lib
-, buildPythonApplication
-, docopt
-, fetchFromGitHub
-, importlib-metadata
-, poetry-core
-}:
-
-buildPythonApplication rec {
-  pname = "xortool";
-  version = "1.0.0";
-  format = "pyproject";
-
-  src = fetchFromGitHub {
-    owner = "hellman";
-    repo = pname;
-    rev = "v${version}";
-    sha256 = "19lfadi28r89bl5q8fhrxgjgs3nx3kgjd4rdg7wbvzi1cn29c5n7";
-  };
-
-  nativeBuildInputs = [ poetry-core ];
-
-  propagatedBuildInputs = [ docopt importlib-metadata ];
-
-  # Project has no tests
-  doCheck = false;
-  pythonImportsCheck = [ "xortool" ];
-
-  meta = with lib; {
-    description = "Tool to analyze multi-byte XOR cipher";
-    homepage = "https://github.com/hellman/xortool";
-    license = with licenses; [ mit ];
-    maintainers = with maintainers; [ fab ];
-  };
-}
@@ -139,7 +139,7 @@ let
        mainDrv = set.out or set.tex or set.tlpkg or set.texdoc or set.texsource; in
    builtins.removeAttrs mainDrv [ "outputSpecified" ];
  toTLPkgSets = { pkgs, ... }: lib.mapAttrsToList toTLPkgSet
-    (builtins.groupBy (p: p.pname) pkgs);
+    (lib.groupBy (p: p.pname) pkgs);

  # export TeX packages as { pkgs = [ ... ]; } in the top attribute set
  allPkgLists = lib.mapAttrs (n: drv: { pkgs = toTLPkgList drv; }) tl;
@@ -12,6 +12,8 @@ makeScopeWithSplicing' {
  f = (self: {
    inherit gnat;

+    gpr2 = self.callPackage ../development/ada-modules/gpr2 { };
+
    gprbuild-boot = self.callPackage ../development/ada-modules/gprbuild/boot.nix { };
    gprbuild      = self.callPackage ../development/ada-modules/gprbuild { };

@@ -466,6 +466,11 @@ with pkgs;
    inherit (darwin.apple_sdk.frameworks) AppKit;
  };

+  cope = callPackage ../by-name/co/cope/package.nix {
+    perl = perl538;
+    perlPackages = perl538Packages;
+  };
+
  cmark = callPackage ../development/libraries/cmark { };

  cmark-gfm = callPackage ../development/libraries/cmark-gfm { };
@@ -14495,8 +14500,6 @@ with pkgs;

  flasm = callPackage ../development/compilers/flasm { };

-  flyctl = callPackage ../development/web/flyctl { };
-
  fluidd = callPackage ../applications/misc/fluidd { };

  flutterPackages-bin = recurseIntoAttrs (callPackage ../development/compilers/flutter { });
@@ -14765,6 +14768,7 @@ with pkgs;

  gnat12Packages = recurseIntoAttrs (callPackage ./ada-packages.nix { gnat = buildPackages.gnat12; });
  gnat13Packages = recurseIntoAttrs (callPackage ./ada-packages.nix { gnat = buildPackages.gnat13; });
+  gnat14Packages = recurseIntoAttrs (callPackage ./ada-packages.nix { gnat = buildPackages.gnat14; });
  gnatPackages   = gnat12Packages;

  inherit (gnatPackages)
@@ -17884,8 +17888,6 @@ with pkgs;

  lemon = callPackage ../development/tools/parsing/lemon { };

-  lenmus = callPackage ../applications/misc/lenmus { };
-
  libtool = libtool_2;

  libtool_1_5 = callPackage ../development/tools/misc/libtool { };
@@ -37627,8 +37629,6 @@ with pkgs;

  pyupgrade = with python3Packages; toPythonApplication pyupgrade;

-  pwncat = python3Packages.callPackage ../tools/security/pwncat { };
-
  pwntools = with python3Packages; toPythonApplication pwntools;

  putty = callPackage ../applications/networking/remote/putty {
@@ -38140,8 +38140,6 @@ with pkgs;

  xboxdrv = callPackage ../misc/drivers/xboxdrv { };

-  xortool = python3Packages.callPackage ../tools/security/xortool { };
-
  xorex = callPackage ../tools/security/xorex { };

  xbps = callPackage ../tools/package-management/xbps { };
@@ -10374,6 +10374,8 @@ self: super: with self; {

  pytest-pudb = callPackage ../development/python-modules/pytest-pudb { };

+  pytest-ruff = callPackage ../development/python-modules/pytest-ruff { };
+
  pytlv = callPackage ../development/python-modules/pytlv { };

  pywebcopy = callPackage ../development/python-modules/pywebcopy { };