Merge 101f44a827 into haskell-updates

2025-08-27 00:21:06 +00:00
parent c6f1e97131 101f44a827
commit 033e135e6b
415 changed files with 3773 additions and 11528 deletions
@@ -27,7 +27,7 @@ jobs:
    steps:
      # Use a GitHub App to create the PR so that CI gets triggered
      # The App is scoped to Repository > Contents and Pull Requests: write for Nixpkgs
-      - uses: actions/create-github-app-token@0f859bf9e69e887678d5bbfbee594437cb440ffe # v2.1.0
+      - uses: actions/create-github-app-token@a8d616148505b5069dccd32f177bb87d7f39123b # v2.1.1
        id: app-token
        with:
          app-id: ${{ vars.NIXPKGS_CI_APP_ID }}
@@ -48,7 +48,7 @@ jobs:

      - name: Create backport PRs
        id: backport
-        uses: korthout/backport-action@0193454f0c5947491d348f33a275c119f30eb736 # v3.2.1
+        uses: korthout/backport-action@ca4972adce8039ff995e618f5fc02d1b7961f27a # v3.3.0
        with:
          # Config README: https://github.com/korthout/backport-action#backport-action
          copy_labels_pattern: 'severity:\ssecurity'
@@ -109,7 +109,7 @@ jobs:
      - name: Build codeowners validator
        run: nix-build nixpkgs/trusted/ci --arg nixpkgs ./nixpkgs/trusted-pinned -A codeownersValidator

-      - uses: actions/create-github-app-token@0f859bf9e69e887678d5bbfbee594437cb440ffe # v2.1.0
+      - uses: actions/create-github-app-token@a8d616148505b5069dccd32f177bb87d7f39123b # v2.1.1
        if: github.event_name == 'pull_request_target' && vars.OWNER_RO_APP_ID
        id: app-token
        with:
@@ -36,7 +36,7 @@ jobs:
      # Use a GitHub App to create the PR so that CI gets triggered
      # The App is scoped to Repository > Contents and Pull Requests: write for Nixpkgs
      # We only need Pull Requests: write here, but the app is also used for backports.
-      - uses: actions/create-github-app-token@0f859bf9e69e887678d5bbfbee594437cb440ffe # v2.1.0
+      - uses: actions/create-github-app-token@a8d616148505b5069dccd32f177bb87d7f39123b # v2.1.1
        id: app-token
        with:
          app-id: ${{ vars.NIXPKGS_CI_APP_ID }}
@@ -49,8 +49,8 @@ jobs:
        run: npm install @actions/artifact bottleneck

      # Use a GitHub App, because it has much higher rate limits: 12,500 instead of 5,000 req / hour.
-      - uses: actions/create-github-app-token@0f859bf9e69e887678d5bbfbee594437cb440ffe # v2.1.0
-        if: vars.NIXPKGS_CI_APP_ID
+      - uses: actions/create-github-app-token@a8d616148505b5069dccd32f177bb87d7f39123b # v2.1.1
+        if: github.event_name != 'pull_request' && vars.NIXPKGS_CI_APP_ID
        id: app-token
        with:
          app-id: ${{ vars.NIXPKGS_CI_APP_ID }}
@@ -23,7 +23,7 @@ jobs:
    steps:
      # Use a GitHub App to create the PR so that CI gets triggered
      # The App is scoped to Repository > Contents and Pull Requests: write for Nixpkgs
-      - uses: actions/create-github-app-token@0f859bf9e69e887678d5bbfbee594437cb440ffe # v2.1.0
+      - uses: actions/create-github-app-token@a8d616148505b5069dccd32f177bb87d7f39123b # v2.1.1
        id: app-token
        with:
          app-id: ${{ vars.NIXPKGS_CI_APP_ID }}
@@ -48,7 +48,7 @@ jobs:
      #   - OWNER_APP_PRIVATE_KEY (secret)
      #
      # Can't use the token received from permissions above, because it can't get enough permissions.
-      - uses: actions/create-github-app-token@0f859bf9e69e887678d5bbfbee594437cb440ffe # v2.1.0
+      - uses: actions/create-github-app-token@a8d616148505b5069dccd32f177bb87d7f39123b # v2.1.1
        if: github.event_name == 'pull_request_target' && vars.OWNER_APP_ID
        id: app-token
        with:
@@ -19,7 +19,6 @@
 /.github/workflows                      @NixOS/nixpkgs-ci
 /ci                                     @NixOS/nixpkgs-ci
 /ci/OWNERS                              @infinisil @philiptaron
-/maintainers                            @philiptaron

 # Development support
 /.editorconfig @Mic92 @zowoq
@@ -49,7 +49,7 @@ program
  .option('--no-dry', 'Make actual modifications')
  .action(async (owner, repo, pr, options) => {
    const prepare = (await import('./prepare.js')).default
-    run(prepare, owner, repo, pr, options)
+    await run(prepare, owner, repo, pr, options)
  })

 program
@@ -61,7 +61,7 @@ program
  .option('--no-cherry-picks', 'Do not expect cherry-picks.')
  .action(async (owner, repo, pr, options) => {
    const commits = (await import('./commits.js')).default
-    run(commits, owner, repo, pr, options)
+    await run(commits, owner, repo, pr, options)
  })

 program
@@ -77,7 +77,7 @@ program
    try {
      process.env.GITHUB_WORKSPACE = tmp
      process.chdir(tmp)
-      run(labels, owner, repo, pr, options)
+      await run(labels, owner, repo, pr, options)
    } finally {
      rmSync(tmp, { recursive: true })
    }
@@ -50,6 +50,8 @@

 - Zig 0.12 has been removed.

+- `ansible-later` has been removed because it was discontinued by the author.
+
 - `stalwart-mail` since `0.13.0` "introduces a significant redesign of the MTA’s delivery and queueing subsystem". See [the upgrading announcement for the `0.13.0` release](https://github.com/stalwartlabs/stalwart/blob/89b561b5ca1c5a11f2a768b4a2cfef0f473b7a01/UPGRADING.md#upgrading-from-v012x-and-v011x-to-v013x).

 - Greetd and its original greeters (`tuigreet`, `gtkgreet`, `qtgreet`, `regreet`, `wlgreet`) were moved from `greetd` namespace to top level (`greetd.tuigreet` -> `tuigreet`, `greetd.greetd` -> `greetd`, etc). The original attrs are available for compatibility as passthrus of `greetd`, but will emit a warning. They will be removed in future releases.
@@ -116,6 +118,8 @@

 - `lisp-modules` were brought in sync with the [June 2025 Quicklisp release](http://blog.quicklisp.org/2025/07/june-2025-quicklisp-dist-now-available.html).

+- `ffmpeg_8`, `ffmpeg_8-headless`, and `ffmpeg_8-full` have been added. The default version of FFmpeg remains ffmpeg_7 for now, though this may change before release.
+
 - `searx` was updated to use `envsubst` instead of `sed` for parsing secrets from environment variables.
  If your previous configuration included a secret reference like `server.secret_key = "@SEARX_SECRET_KEY@"`, you must migrate to the new envsubst syntax: `server.secret_key = "$SEARX_SECRET_KEY"`.

@@ -166,7 +166,7 @@ The following is a non-exhaustive list of such differences:
 - Other environment variables may be inconsistent with a `nix-build` either due to `nix-shell`'s initialization script or due to the use of `nix-shell` without the `--pure` option.

 If the build fails differently inside the shell than in the sandbox, consider using [`breakpointHook`](#breakpointhook) and invoking `nix-build` instead.
-The [`--keep-failed`](https://nixos.org/manual/nix/unstable/command-ref/conf-file#opt--keep-failed) option for `nix-build` may also be useful to examine the build directory of a failed build.
+The [`--keep-failed`](https://nixos.org/manual/nix/unstable/command-ref/conf-file#conf-keep-failed) option for `nix-build` may also be useful to examine the build directory of a failed build.
 :::

 ## Tools provided by `stdenv` {#sec-tools-of-stdenv}
@@ -140,7 +140,7 @@ stdenv.mkDerivation {

 ### Switching the MPI implementation {#sec-overlays-alternatives-mpi}

-All programs that are built with [MPI](https://en.wikipedia.org/wiki/Message_Passing_Interface) support use the generic attribute `mpi` as an input. At the moment Nixpkgs natively provides two different MPI implementations:
+All programs that are built with [MPI](https://en.wikipedia.org/wiki/Message_Passing_Interface) support use the generic attribute `mpi` as an input. At the moment Nixpkgs natively provides the following MPI implementations:

 -   [Open MPI](https://www.open-mpi.org/) (default), attribute name
    `openmpi`
@@ -541,6 +541,12 @@
    github = "aciceri";
    githubId = 2318843;
  };
+  acidbong = {
+    name = "Acid Bong";
+    email = "acidbong@tilde.club";
+    github = "acid-bong";
+    githubId = 94849097;
+  };
  acowley = {
    email = "acowley@gmail.com";
    github = "acowley";
@@ -1581,6 +1587,12 @@
    githubId = 587021;
    name = "André V L Matos";
  };
+  andrewbastin = {
+    email = "andrewbastin.k@gmail.com";
+    github = "AndrewBastin";
+    githubId = 9131943;
+    name = "Andrew Bastin";
+  };
  andrewchambers = {
    email = "ac@acha.ninja";
    github = "andrewchambers";
@@ -2071,6 +2083,12 @@
    githubId = 29145250;
    name = "Armeen Mahdian";
  };
+  armelclo = {
+    email = "armel@armelclo.fr";
+    github = "ArmelClo";
+    githubId = 61419525;
+    name = "Armel Cloarec";
+  };
  armijnhemel = {
    email = "armijn@tjaldur.nl";
    github = "armijnhemel";
@@ -7759,6 +7777,13 @@
    github = "ErinvanderVeen";
    githubId = 10973664;
  };
+  eripa = {
+    name = "Eric Ripa";
+    email = "eric@ripa.io";
+    keys = [ { fingerprint = "L2IODNAzlzi0tkpCy4LHixqMUhkEas9D3+mo4a+PQZg"; } ];
+    github = "eripa";
+    githubId = 1429673;
+  };
  ern775 = {
    email = "eren.demir2479090@gmail.com";
    github = "ern775";
@@ -9368,6 +9393,12 @@
    githubId = 471835;
    name = "Giorgio Gallo";
  };
+  gipphe = {
+    email = "gipphe@gmail.com";
+    github = "Gipphe";
+    githubId = 2266817;
+    name = "Victor Nascimento Bakke";
+  };
  GirardR1006 = {
    email = "julien.girard2@cea.fr";
    github = "GirardR1006";
@@ -14125,6 +14156,11 @@
    githubId = 61395246;
    name = "Lampros Pitsillos";
  };
+  langsjo = {
+    name = "langsjo";
+    github = "langsjo";
+    githubId = 104687438;
+  };
  larsr = {
    email = "Lars.Rasmusson@gmail.com";
    github = "larsr";
@@ -18030,6 +18066,12 @@
    githubId = 42888162;
    keys = [ { fingerprint = "A0B9 48C5 A263 55C2 035F  8567 FBB7 2A94 52D9 1A72"; } ];
  };
+  neurofibromin = {
+    name = "Neurofibromin";
+    github = "Neurofibromin";
+    githubId = 125222560;
+    keys = [ { fingerprint = "9F9B FE94 618A D266 67BD 2821 4F67 1AFA D8D4 428B"; } ];
+  };
  neverbehave = {
    email = "i@never.pet";
    github = "NeverBehave";
@@ -18452,6 +18494,12 @@
    githubId = 148037;
    name = "Joachim Breitner";
  };
+  nomis = {
+    email = "nixpkgs@octiron.net";
+    github = "nomis";
+    githubId = 70171;
+    name = "Simon Arlott";
+  };
  nomisiv = {
    email = "simon@nomisiv.com";
    github = "NomisIV";
@@ -18674,6 +18722,12 @@
    githubId = 51034487;
    matrix = "@nullcube:matrix.org";
  };
+  nulleric = {
+    email = "erichelgeson@gmail.com";
+    name = "Eric Helgeson";
+    github = "erichelgeson";
+    githubId = 271734;
+  };
  nullishamy = {
    email = "spam@amyerskine.me";
    name = "nullishamy";
@@ -20815,11 +20869,10 @@
    githubId = 7279609;
  };
  pyrotelekinetic = {
-    name = "Clover";
-    email = "carter@isons.org";
+    name = "Clover Ison";
+    email = "clover@isons.org";
    github = "pyrotelekinetic";
    githubId = 29682759;
-    keys = [ { fingerprint = "5963 78DB 25AA 608D 2743  D466 5D6A D9AE 71B3 F983"; } ];
  };
  pyrox0 = {
    name = "Pyrox";
@@ -21168,6 +21221,12 @@
    githubId = 5653911;
    name = "Rampoina";
  };
+  randomdude = {
+    name = "Random Dude";
+    email = "randomdude16671@proton.me";
+    github = "randomdude16671";
+    githubId = 210965013;
+  };
  rane = {
    name = "Rane";
    email = "rane+git@junkyard.systems";
@@ -23255,6 +23314,12 @@
    githubId = 1588288;
    name = "Shahrukh Khan";
  };
+  shakhzodkudratov = {
+    email = "shakhzodkudratov@gmail.com";
+    github = "shakhzodkudratov";
+    githubId = 37299109;
+    name = "Shakhzod Kudratov";
+  };
  shamilton = {
    email = "sgn.hamilton@protonmail.com";
    github = "SCOTT-HAMILTON";
@@ -23954,6 +24019,12 @@
    githubId = 55726;
    name = "Stanislav Ochotnický";
  };
+  sodagunz = {
+    name = "sodagunz";
+    github = "sodagunz";
+    githubId = 19618127;
+    email = "sodagunz+nixpkgs@proton.me";
+  };
  sodiboo = {
    name = "sodiboo";
    github = "sodiboo";
@@ -1256,6 +1256,7 @@ with lib.maintainers;
      orzklv
      bahrom04
      bemeritus
+      shakhzodkudratov
    ];
    scope = "Maintain Uzbek Linux state & community packages and modules.";
    shortName = "Uzinfocom Open Source";
@@ -151,6 +151,8 @@

 - `renovate` was updated to v41. See the upstream release notes for [v40](https://github.com/renovatebot/renovate/releases/tag/40.0.0) and [v41](https://github.com/renovatebot/renovate/releases/tag/41.0.0) for breaking changes.

+- `i18n.inputMethod.fcitx5.plasma6Support` has been removed because qt6 is the only one used for fcitx5-configtool now.
+
 - The `boot.readOnlyNixStore` has been removed. Control over bind mount options on `/nix/store` is now offered by the `boot.nixStoreMountOpts` option.

 - The Postfix module has been updated and likely requires configuration changes:
@@ -22,13 +22,12 @@ let
        preferLocalBuild = true;
        allowSubstitutes = false;
        buildInputs = [
-          pkgs.gtk2
          cfg.package
        ];
      }
      ''
        mkdir -p $out/etc/gtk-2.0/
-        GTK_PATH=${cfg.package}/lib/gtk-2.0/ gtk-query-immodules-2.0 > $out/etc/gtk-2.0/immodules.cache
+        GTK_PATH=${cfg.package}/lib/gtk-2.0/ ${pkgs.stdenv.hostPlatform.emulator pkgs.buildPackages} ${lib.getExe' pkgs.gtk2.dev "gtk-query-immodules-2.0"} > $out/etc/gtk-2.0/immodules.cache
      '';

  gtk3_cache =
@@ -37,13 +36,12 @@ let
        preferLocalBuild = true;
        allowSubstitutes = false;
        buildInputs = [
-          pkgs.gtk3
          cfg.package
        ];
      }
      ''
        mkdir -p $out/etc/gtk-3.0/
-        GTK_PATH=${cfg.package}/lib/gtk-3.0/ gtk-query-immodules-3.0 > $out/etc/gtk-3.0/immodules.cache
+        GTK_PATH=${cfg.package}/lib/gtk-3.0/ ${pkgs.stdenv.hostPlatform.emulator pkgs.buildPackages} ${lib.getExe' pkgs.gtk3.dev "gtk-query-immodules-3.0"} > $out/etc/gtk-3.0/immodules.cache
      '';

 in
@@ -107,8 +105,12 @@ in
    environment.systemPackages = [
      cfg.package
    ]
-    ++ lib.optional cfg.enableGtk2 gtk2_cache
-    ++ lib.optional cfg.enableGtk3 gtk3_cache;
+    ++ lib.optional (
+      cfg.enableGtk2 && (pkgs.stdenv.hostPlatform.emulatorAvailable pkgs.buildPackages)
+    ) gtk2_cache
+    ++ lib.optional (
+      cfg.enableGtk3 && (pkgs.stdenv.hostPlatform.emulatorAvailable pkgs.buildPackages)
+    ) gtk3_cache;
  };

  meta = {
@@ -7,11 +7,7 @@
 let
  imcfg = config.i18n.inputMethod;
  cfg = imcfg.fcitx5;
-  fcitx5Package =
-    if cfg.plasma6Support then
-      pkgs.qt6Packages.fcitx5-with-addons.override { inherit (cfg) addons; }
-    else
-      pkgs.libsForQt5.fcitx5-with-addons.override { inherit (cfg) addons; };
+  fcitx5Package = pkgs.qt6Packages.fcitx5-with-addons.override { inherit (cfg) addons; };
  settingsFormat = pkgs.formats.ini { };
 in
 {
@@ -33,15 +29,6 @@ in
          See [Using Fcitx 5 on Wayland](https://fcitx-im.org/wiki/Using_Fcitx_5_on_Wayland).
        '';
      };
-      plasma6Support = lib.mkOption {
-        type = lib.types.bool;
-        default = config.services.desktopManager.plasma6.enable;
-        defaultText = lib.literalExpression "config.services.desktopManager.plasma6.enable";
-        description = ''
-          Use qt6 versions of fcitx5 packages.
-          Required for configuring fcitx5 in KDE System Settings.
-        '';
-      };
      quickPhrase = lib.mkOption {
        type = with lib.types; attrsOf str;
        default = { };
@@ -109,6 +96,9 @@ in
    (lib.mkRemovedOptionModule [ "i18n" "inputMethod" "fcitx5" "enableRimeData" ] ''
      RIME data is now included in `fcitx5-rime` by default, and can be customized using `fcitx5-rime.override { rimeDataPkgs = ...; }`
    '')
+    (lib.mkRemovedOptionModule [ "i18n" "inputMethod" "fcitx5" "plasma6Support" ] ''
+      qt6 is the only one used for fcitx5-configtool now.
+    '')
  ];

  config = lib.mkIf (imcfg.enable && imcfg.type == "fcitx5") {
@@ -286,7 +286,16 @@ in
      in
      {
        sudo = {
-          source = "${lib.getExe cfg.package}";
+          source = lib.getExe cfg.package;
+          inherit
+            owner
+            group
+            setuid
+            permissions
+            ;
+        };
+        sudoedit = {
+          source = lib.getExe' cfg.package "sudoedit";
          inherit
            owner
            group
@@ -152,45 +152,48 @@ in

  };

-  config = lib.mkMerge [
-    {
-      assertions = [
-        {
-          assertion = cfg.backupAll -> cfg.databases == [ ];
-          message = "config.services.postgresqlBackup.backupAll cannot be used together with config.services.postgresqlBackup.databases";
-        }
-        {
-          assertion =
-            cfg.compression == "none"
-            || (cfg.compression == "gzip" && cfg.compressionLevel >= 1 && cfg.compressionLevel <= 9)
-            || (cfg.compression == "zstd" && cfg.compressionLevel >= 1 && cfg.compressionLevel <= 19);
-          message = "config.services.postgresqlBackup.compressionLevel must be set between 1 and 9 for gzip and 1 and 19 for zstd";
-        }
-      ];
-    }
-    (lib.mkIf cfg.enable {
-      systemd.tmpfiles.rules = [
-        "d '${cfg.location}' 0700 postgres - - -"
-      ];
-    })
-    (lib.mkIf (cfg.enable && cfg.backupAll) {
-      systemd.services.postgresqlBackup = postgresqlBackupService "all" "pg_dumpall ${cfg.pgdumpOptions}";
-    })
-    (lib.mkIf (cfg.enable && !cfg.backupAll) {
-      systemd.services = lib.listToAttrs (
-        map (
-          db:
-          let
-            cmd = "pg_dump ${cfg.pgdumpOptions} ${db}";
-          in
+  config = lib.mkIf cfg.enable (
+    lib.mkMerge [
+      {
+        assertions = [
          {
-            name = "postgresqlBackup-${db}";
-            value = postgresqlBackupService db cmd;
+            assertion = cfg.backupAll -> cfg.databases == [ ];
+            message = "config.services.postgresqlBackup.backupAll cannot be used together with config.services.postgresqlBackup.databases";
          }
-        ) cfg.databases
-      );
-    })
-  ];
+          {
+            assertion =
+              cfg.compression == "none"
+              || (cfg.compression == "gzip" && cfg.compressionLevel >= 1 && cfg.compressionLevel <= 9)
+              || (cfg.compression == "zstd" && cfg.compressionLevel >= 1 && cfg.compressionLevel <= 19);
+            message = "config.services.postgresqlBackup.compressionLevel must be set between 1 and 9 for gzip and 1 and 19 for zstd";
+          }
+        ];
+
+        systemd.tmpfiles.rules = [
+          "d '${cfg.location}' 0700 postgres - - -"
+        ];
+      }
+
+      (lib.mkIf cfg.backupAll {
+        systemd.services.postgresqlBackup = postgresqlBackupService "all" "pg_dumpall ${cfg.pgdumpOptions}";
+      })
+
+      (lib.mkIf (!cfg.backupAll) {
+        systemd.services = lib.listToAttrs (
+          map (
+            db:
+            let
+              cmd = "pg_dump ${cfg.pgdumpOptions} ${db}";
+            in
+            {
+              name = "postgresqlBackup-${db}";
+              value = postgresqlBackupService db cmd;
+            }
+          ) cfg.databases
+        );
+      })
+    ]
+  );

  meta.maintainers = with lib.maintainers; [ Scrumplex ];
 }
@@ -20,7 +20,8 @@ in
        {
          options = {
            passwordFile = lib.mkOption {
-              type = lib.types.str;
+              type = with lib.types; nullOr str;
+              default = null;
              description = ''
                Read the repository password from a file.
              '';
@@ -366,8 +367,10 @@ in
    assertions = lib.flatten (
      lib.mapAttrsToList (name: backup: [
        {
-          assertion = (backup.repository == null) != (backup.repositoryFile == null);
-          message = "services.restic.backups.${name}: exactly one of repository or repositoryFile should be set";
+          assertion =
+            ((backup.repository == null) != (backup.repositoryFile == null))
+            || (backup.environmentFile != null);
+          message = "services.restic.backups.${name}: exactly one of repository, repositoryFile or environmentFile should be set";
        }
        {
          assertion =
@@ -378,6 +381,10 @@ in
            !(fileBackup && commandBackup);
          message = "services.restic.backups.${name}: cannot do both a command backup and a file backup at the same time.";
        }
+        {
+          assertion = (backup.passwordFile != null) || (backup.environmentFile != null);
+          message = "services.restic.backups.${name}: passwordFile or environmentFile must be set";
+        }
      ]) config.services.restic.backups
    );
    systemd.services = lib.mapAttrs' (
@@ -256,8 +256,16 @@
            };

            nodeRuntimes = lib.mkOption {
-              type = with lib.types; nonEmptyListOf (enum [ "node20" ]);
-              default = [ "node20" ];
+              type =
+                with lib.types;
+                nonEmptyListOf (enum [
+                  "node20"
+                  "node24"
+                ]);
+              default = [
+                "node20"
+                "node24"
+              ];
              description = ''
                List of Node.js runtimes the runner should support.
              '';
@@ -22,6 +22,7 @@ let
          "SpeedMeterIntervalSec"
          "ManageForeignRoutingPolicyRules"
          "ManageForeignRoutes"
+          "ManageForeignNextHops"
          "RouteTable"
          "IPv6PrivacyExtensions"
          "IPv4Forwarding"
@@ -32,6 +33,7 @@ let
        (assertInt "SpeedMeterIntervalSec")
        (assertValueOneOf "ManageForeignRoutingPolicyRules" boolValues)
        (assertValueOneOf "ManageForeignRoutes" boolValues)
+        (assertValueOneOf "ManageForeignNextHops" boolValues)
        (assertValueOneOf "IPv6PrivacyExtensions" (
          boolValues
          ++ [
@@ -120,6 +120,13 @@ in
    };

    systemd.user.tmpfiles = {
+      enable =
+        (mkEnableOption "systemd user units systemd-tmpfiles-setup.service and systemd-tmpfiles-clean.timer")
+        // {
+          default = true;
+          example = false;
+        };
+
      rules = mkOption {
        type = types.listOf types.str;
        default = [ ];
@@ -210,11 +217,15 @@ in
      // mapAttrs' (n: v: nameValuePair "${n}.target" (targetToUnit v)) cfg.targets
      // mapAttrs' (n: v: nameValuePair "${n}.timer" (timerToUnit v)) cfg.timers;

+    systemd.user.timers = {
+      # enable systemd user tmpfiles
+      systemd-tmpfiles-clean.wantedBy = optional cfg.tmpfiles.enable "timers.target";
+    }
    # Generate timer units for all services that have a ‘startAt’ value.
-    systemd.user.timers = mapAttrs (name: service: {
+    // (mapAttrs (name: service: {
      wantedBy = [ "timers.target" ];
      timerConfig.OnCalendar = service.startAt;
-    }) (filterAttrs (name: service: service.startAt != [ ]) cfg.services);
+    }) (filterAttrs (name: service: service.startAt != [ ]) cfg.services));

    # Provide the systemd-user PAM service, required to run systemd
    # user instances.
@@ -233,9 +244,7 @@ in
    systemd.services.systemd-user-sessions.restartIfChanged = false; # Restart kills all active sessions.

    # enable systemd user tmpfiles
-    systemd.user.services.systemd-tmpfiles-setup.wantedBy = optional (
-      cfg.tmpfiles.rules != [ ] || any (cfg': cfg'.rules != [ ]) (attrValues cfg.tmpfiles.users)
-    ) "basic.target";
+    systemd.user.services.systemd-tmpfiles-setup.wantedBy = optional cfg.tmpfiles.enable "basic.target";

    # /run/current-system/sw/etc/xdg is in systemd's $XDG_CONFIG_DIRS so we can
    # write the tmpfiles.d rules for everyone there
@@ -1345,6 +1345,7 @@ in
  simple = runTest ./simple.nix;
  sing-box = runTest ./sing-box.nix;
  slimserver = runTest ./slimserver.nix;
+  slipshow = runTest ./slipshow.nix;
  slurm = runTest ./slurm.nix;
  snmpd = runTest ./snmpd.nix;
  smokeping = runTest ./smokeping.nix;
@@ -0,0 +1,35 @@
+{
+  lib,
+  pkgs,
+  ...
+}:
+{
+  name = "slipshow presentation test";
+
+  meta.maintainers = with lib.maintainers; [ ethancedwards8 ];
+
+  nodes.machine = {
+    environment.systemPackages = with pkgs; [ slipshow ];
+
+    environment.etc."slipshow".source = pkgs.fetchFromGitHub {
+      owner = "meithecatte";
+      repo = "bbslides";
+      rev = "ce1c08cafa71ae36dda8cc581956548b8386ae16";
+      hash = "sha256-sOydmvtDeMhNejDkwlsXdrbwtqN6lcNnzTnGzBVRFxA=";
+    };
+  };
+
+  testScript =
+    { nodes, ... }:
+    ''
+      start_all()
+
+      # it may take around a minute to compile the file and serve it
+      machine.succeed("slipshow serve /etc/slipshow/bbslides.md &>/dev/null &")
+
+      # slipshow serves defaultly on :8080 and unfortunately cannot
+      # be changed currently
+      machine.wait_for_open_port(8080)
+      machine.succeed("curl -i 0.0.0.0:8080")
+    '';
+}
@@ -49,6 +49,16 @@ let
      mkdir -p $out/bin
      ${lib.getDev pkgs.mpi}/bin/mpicc ${mpitestC} -o $out/bin/mpitest
    '';
+
+  sbatchOutput = "/tmp/shared/sbatch.log";
+  sbatchScript = pkgs.writeText "sbatchScript" ''
+    #!${pkgs.runtimeShell}
+    #SBATCH --nodes 1
+    #SBATCH --ntasks 1
+    #SBATCH --output ${sbatchOutput}
+
+    echo "sbatch success"
+  '';
 in
 {
  name = "slurm";
@@ -127,43 +137,38 @@ in
    };

  testScript = ''
-    start_all()
-
-    # Make sure DBD is up after DB initialzation
    with subtest("can_start_slurmdbd"):
-        dbd.succeed("systemctl restart slurmdbd")
        dbd.wait_for_unit("slurmdbd.service")
        dbd.wait_for_open_port(6819)

-    # there needs to be an entry for the current
-    # cluster in the database before slurmctld is restarted
-    with subtest("add_account"):
-        control.succeed("sacctmgr -i add cluster default")
-        # check for cluster entry
-        control.succeed("sacctmgr list cluster | awk '{ print $1 }' | grep default")
-
-    with subtest("can_start_slurmctld"):
-        control.succeed("systemctl restart slurmctld")
+    with subtest("cluster_is_initialized"):
+        control.wait_for_unit("multi-user.target")
        control.wait_for_unit("slurmctld.service")
+        control.wait_until_succeeds("sacctmgr list cluster | awk '{ print $1 }' | grep default")
+
+    start_all()

    with subtest("can_start_slurmd"):
        for node in [node1, node2, node3]:
-            node.succeed("systemctl restart slurmd.service")
            node.wait_for_unit("slurmd")

    # Test that the cluster works and can distribute jobs;
+    submit.wait_for_unit("multi-user.target")

    with subtest("run_distributed_command"):
        # Run `hostname` on 3 nodes of the partition (so on all the 3 nodes).
        # The output must contain the 3 different names
        submit.succeed("srun -N 3 hostname | sort | uniq | wc -l | xargs test 3 -eq")

-        with subtest("check_slurm_dbd"):
+        with subtest("check_slurm_dbd_job"):
            # find the srun job from above in the database
-            control.succeed("sleep 5")
-            control.succeed("sacct | grep hostname")
+            control.wait_until_succeeds("sacct | grep hostname")

    with subtest("run_PMIx_mpitest"):
        submit.succeed("srun -N 3 --mpi=pmix mpitest | grep size=3")
+
+    with subtest("run_sbatch"):
+        submit.succeed("sbatch --wait ${sbatchScript}")
+        submit.succeed("grep 'sbatch success' ${sbatchOutput}")
  '';
 }
@@ -6,9 +6,8 @@
    maintainers = [ schnusch ];
  };

-  nodes.machine =
-    { ... }:
-    {
+  nodes = rec {
+    machine = {
      users.users = {
        alice.isNormalUser = true;
        bob.isNormalUser = true;
@@ -21,8 +20,22 @@
        users.alice.rules = [
          "d %h/only_alice"
        ];
+        users.bob.rules = [
+          "D %h/cleaned_up - - - 0"
+        ];
+      };
+
+      # run every 10 seconds
+      systemd.user.timers.systemd-tmpfiles-clean.timerConfig = {
+        OnStartupSec = "10s";
+        OnUnitActiveSec = "10s";
      };
    };
+    disabled = {
+      imports = [ machine ];
+      systemd.user.tmpfiles.enable = false;
+    };
+  };

  testScript =
    { ... }:
@@ -36,5 +49,16 @@
      machine.wait_until_succeeds("systemctl --user --machine=bob@ is-active systemd-tmpfiles-setup.service")
      machine.succeed("[ -d ~bob/user_tmpfiles_created ]")
      machine.succeed("[ ! -e ~bob/only_alice ]")
+
+      machine.succeed("systemctl --user --machine=bob@ is-active systemd-tmpfiles-clean.timer")
+      machine.succeed("runuser -u bob -- touch ~bob/cleaned_up/file")
+      machine.wait_until_fails("[ -e ~bob/cleaned_up/file ]")
+
+      # disabled user tmpfiles
+      disabled.succeed("loginctl enable-linger alice bob")
+      for user in ("alice", "bob"):
+          for verb in ("is-enabled", "is-active"):
+              for unit in ("systemd-tmpfiles-setup.service", "systemd-tmpfiles-clean.timer"):
+                  disabled.fail(f"systemctl --user --machine={user}@ {verb} {unit}")
    '';
 }
@@ -13,7 +13,7 @@ lib.makeScope pkgs.newScope (
      inherit lib;
      inherit (pkgs)
        fetchFromBitbucket
-        fetchFromSavannah
+        fetchurl
        ;
    };

@@ -69,7 +69,6 @@
  # Boolean flags
  withNativeCompilation ? stdenv.buildPlatform.canExecute stdenv.hostPlatform,
  noGui ? false,
-  srcRepo ? true,
  withAcl ? false,
  withAlsaLib ? false,
  withAthena ? false,
@@ -200,9 +199,11 @@ mkDerivation (finalAttrs: {
    ];

  postPatch = lib.concatStringsSep "\n" [
-    (lib.optionalString srcRepo ''
-      rm -fr .git
-    '')
+
+    # See: https://github.com/NixOS/nixpkgs/issues/170426
+    ''
+      find . -type f \( -name "*.elc" -o -name "*loaddefs.el" \) -exec rm {} \;
+    ''

    # Add the name of the wrapped gvfsd
    # This used to be carried as a patch but it often got out of sync with
@@ -247,11 +248,6 @@ mkDerivation (finalAttrs: {
  nativeBuildInputs = [
    makeWrapper
    pkg-config
-  ]
-  ++ lib.optionals (variant == "macport") [
-    texinfo
-  ]
-  ++ lib.optionals srcRepo [
    autoreconfHook
    texinfo
  ]
@@ -1,7 +1,7 @@
 {
  lib,
  fetchFromBitbucket,
-  fetchFromSavannah,
+  fetchurl,
 }:

 let
@@ -26,9 +26,9 @@ let
      src =
        {
          "mainline" = (
-            fetchFromSavannah {
-              repo = "emacs";
-              inherit rev hash;
+            fetchurl {
+              url = "mirror://gnu/emacs/emacs-${rev}.tar.xz";
+              inherit hash;
            }
          );
          "macport" = (
@@ -108,7 +108,7 @@ in
    version = "30.2";
    variant = "mainline";
    rev = "30.2";
-    hash = "sha256-3Lfb3HqdlXqSnwJfxe7npa4GGR9djldy8bKRpkQCdSA=";
+    hash = "sha256-s/NvGKbdJxVxM3AWYlfeL64B+dOM/oeM7Zsebe1b79k=";
    patches = fetchpatch: [
      (builtins.path {
        name = "inhibit-lexical-cookie-warning-67916.patch";
@@ -12415,6 +12415,19 @@ final: prev: {
    meta.hydraPlatforms = [ ];
  };

+  perfanno-nvim = buildVimPlugin {
+    pname = "perfanno.nvim";
+    version = "2024-12-28";
+    src = fetchFromGitHub {
+      owner = "t-troebst";
+      repo = "perfanno.nvim";
+      rev = "8640d6655f17a79af8de3153af2ce90c03f65e86";
+      sha256 = "1097sppcsw41asps1k51ic9h4z0hpzgc44kjfcyqdhclnxwady81";
+    };
+    meta.homepage = "https://github.com/t-troebst/perfanno.nvim/";
+    meta.hydraPlatforms = [ ];
+  };
+
  persisted-nvim = buildVimPlugin {
    pname = "persisted.nvim";
    version = "2025-08-16";
@@ -20126,6 +20139,19 @@ final: prev: {
    meta.hydraPlatforms = [ ];
  };

+  vim-rhai = buildVimPlugin {
+    pname = "vim-rhai";
+    version = "2022-07-16";
+    src = fetchFromGitHub {
+      owner = "rhaiscript";
+      repo = "vim-rhai";
+      rev = "b0585e2c92a4a64edcd060836ae41d1e698ebc20";
+      sha256 = "0m36d7f2zkb5197k3gfjdhidpl2j50y2n2ywg1mxv4a55b06vfbh";
+    };
+    meta.homepage = "https://github.com/rhaiscript/vim-rhai/";
+    meta.hydraPlatforms = [ ];
+  };
+
  vim-rhubarb = buildVimPlugin {
    pname = "vim-rhubarb";
    version = "2025-06-27";
@@ -24,6 +24,7 @@
  direnv,
  fzf,
  gawk,
+  gperf,
  helm-ls,
  himalaya,
  htop,
@@ -2972,6 +2973,11 @@ in
    ];
  });

+  perfanno-nvim = super.perfanno-nvim.overrideAttrs (old: {
+    dependencies = [ gperf ];
+    meta.maintainers = with lib.maintainers; [ fredeb ];
+  });
+
  persisted-nvim = super.persisted-nvim.overrideAttrs {
    nvimSkipModules = [
      # /lua/persisted/init.lua:44: attempt to index upvalue 'config' (a nil value)
@@ -953,6 +953,7 @@ https://github.com/lewis6991/pckr.nvim/,HEAD,
 https://github.com/tmsvg/pear-tree/,,
 https://github.com/steelsojka/pears.nvim/,,
 https://github.com/toppair/peek.nvim/,HEAD,
+https://github.com/t-troebst/perfanno.nvim/,HEAD,
 https://github.com/olimorris/persisted.nvim/,HEAD,
 https://github.com/folke/persistence.nvim/,,
 https://github.com/Weissle/persistent-breakpoints.nvim/,,
@@ -1545,6 +1546,7 @@ https://github.com/tpope/vim-ragtag/,,
 https://github.com/tpope/vim-rails/,,
 https://github.com/jordwalke/vim-reasonml/,,
 https://github.com/tpope/vim-repeat/,,
+https://github.com/rhaiscript/vim-rhai/,,
 https://github.com/tpope/vim-rhubarb/,,
 https://github.com/airblade/vim-rooter/,,
 https://github.com/tpope/vim-rsi/,,
@@ -493,8 +493,8 @@ let
        mktplcRef = {
          publisher = "banacorn";
          name = "agda-mode";
-          version = "0.6.4";
-          hash = "sha256-KBOVVVDw+72QSYv4jynqeVBdIfYz+T5hD2//royVJpw=";
+          version = "0.6.5";
+          hash = "sha256-fq3JiqdtYN9kAWDvu8X+2mlU5kj2RwUTPA4QF43vShQ=";
        };
        meta = {
          changelog = "https://marketplace.visualstudio.com/items/banacorn.agda-mode/changelog";
@@ -920,8 +920,8 @@ let
        mktplcRef = {
          name = "crabviz";
          publisher = "chanhx";
-          version = "0.4.0";
-          hash = "sha256-SOsoSQLDNRqby91Ire4euSz6udRZI6G/RVloVjIvhUM=";
+          version = "0.5.0";
+          hash = "sha256-YLNx/9jmHc0HDm/yHquOlMDPmAbpIdd6UZn0JZQVJko=";
        };
        meta = {
          description = "VSCode extension for generating call graphs based on LSP";
@@ -1614,8 +1614,8 @@ let
        mktplcRef = {
          name = "elixir-ls";
          publisher = "JakeBecker";
-          version = "0.29.2";
-          hash = "sha256-+MkKUhyma/mc5MZa0+RFty5i7rox0EARPTm/uggQj6M=";
+          version = "0.29.3";
+          hash = "sha256-cghDjgv3FWsNpnH6Pa9iPuiPOlLI/iucGH+fzF35ERk=";
        };
        meta = {
          changelog = "https://marketplace.visualstudio.com/items/JakeBecker.elixir-ls/changelog";
@@ -11,7 +11,7 @@ vscode-utils.buildVscodeMarketplaceExtension {
    name = "tinymist";
    publisher = "myriad-dreamin";
    inherit (tinymist) version;
-    hash = "sha256-fI+HzioLDxACH0anSkYOw47jpocVQp7m9xHh6APehis=";
+    hash = "sha256-wFFzUwOyaMInaVskKK/KA1eDd71fZ2j+snZ2NvFB5nU=";
  };

  nativeBuildInputs = [
@@ -9,13 +9,13 @@
 }:
 mkLibretroCore {
  core = "citra";
-  version = "0-unstable-2025-06-22";
+  version = "0-unstable-2025-08-17";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "citra";
-    rev = "176214934cd46d6e072adcbda5f676bc4ca3162e";
-    hash = "sha256-cdBR64OBOGMy0ROR89mbKXC0xk+QkBHUKEkIn2czGiQ=";
+    rev = "5263fae3344e5e9af43036e0e38bec2d10fb2407";
+    hash = "sha256-66kbE1taODjxXDhO3uV5R212nikyXfHwCHC/zamZuL0=";
    fetchSubmodules = true;
  };

@@ -133,9 +133,9 @@ rec {

  unstable = fetchurl rec {
    # NOTE: Don't forget to change the hash for staging as well.
-    version = "10.12";
+    version = "10.13";
    url = "https://dl.winehq.org/wine/source/10.x/wine-${version}.tar.xz";
-    hash = "sha256-zVcscaPXLof5hJCyKMfCaq6z/eON2eefw7VjkdWZ1r8=";
+    hash = "sha256-8fON8gVb2vpGtEwe34ZB5oMzDjoUbgn9UhnP6T4zxTE=";

    patches = [
      # Also look for root certificates at $NIX_SSL_CERT_FILE
@@ -145,7 +145,7 @@ rec {
    # see https://gitlab.winehq.org/wine/wine-staging
    staging = fetchFromGitLab {
      inherit version;
-      hash = "sha256-a5Vw9UVawx/vvTeu6SGxf4C1GwvdmpPJDyuW0PCUob8=";
+      hash = "sha256-s2ceNBCBj2Zy1FLjjwEbbX3SQiqNwMPu49Ytq6X8R9U=";
      domain = "gitlab.winehq.org";
      owner = "wine";
      repo = "wine-staging";
@@ -168,9 +168,9 @@ rec {

    ## see http://wiki.winehq.org/Mono
    mono = fetchurl rec {
-      version = "10.1.0";
+      version = "10.2.0";
      url = "https://dl.winehq.org/wine/wine-mono/${version}/wine-mono-${version}-x86.msi";
-      hash = "sha256-yIwkMYkLwyys7I1+pw5Tpa5LlcjFXKbnXvjbDkzPEHA=";
+      hash = "sha256-Th7T8C6S0FMTPQPd++/PbbSk3CMamu0zZ7FxF6iIR9g=";
    };

    updateScript = writeShellScript "update-wine-unstable" ''
@@ -85,13 +85,13 @@ in

 stdenv.mkDerivation (finalAttrs: {
  pname = "imagemagick";
-  version = "7.1.2-1";
+  version = "7.1.2-2";

  src = fetchFromGitHub {
    owner = "ImageMagick";
    repo = "ImageMagick";
    tag = finalAttrs.version;
-    hash = "sha256-SHzDSknIHz8/CHV0Lnlr8YtOhs67MPMXiVHfv50gfwY=";
+    hash = "sha256-bQzHZGTr3dl8G7cMSjC5Is+H/7pnRtqgp/rvYZeJDu0=";
  };

  outputs = [
@@ -22,6 +22,7 @@ let
      gnome-desktop
      libgnome-keyring
      webkitgtk_4_1
+      adwaita-icon-theme
    ];
  xorgDeps =
    pkgs: with pkgs.xorg; [
@@ -1,10 +1,10 @@
 {
  "chromium": {
-    "version": "139.0.7258.138",
+    "version": "139.0.7258.154",
    "chromedriver": {
-      "version": "139.0.7258.139",
-      "hash_darwin": "sha256-EqKEyT/iEJkVASSAEP0/dNptDw3yr3AwoM2yUYbn1to=",
-      "hash_darwin_aarch64": "sha256-3H9CUsMDvD+PJ+n/YwCv22uEIxa80y+cMvL1PWOWQg0="
+      "version": "139.0.7258.155",
+      "hash_darwin": "sha256-9tHj/QSFz9fJTQ+xivOKbssqXsE53BHViy7uCZ4OMhc=",
+      "hash_darwin_aarch64": "sha256-fmflqWTiruKD/VtmNWllCA71tqaB0OIOUiXsmJOTJFI="
    },
    "deps": {
      "depot_tools": {
@@ -21,8 +21,8 @@
    "DEPS": {
      "src": {
        "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "884e54ea8d42947ed636779015c5b4815e069838",
-        "hash": "sha256-MCBHB1ms3H8AXqiIDHH7C+8/NDcgsn3pDx7mKtGdfbc=",
+        "rev": "9e0d6b2b47ffb17007b713429c9a302f9e43847f",
+        "hash": "sha256-L3cq3kx7hOv8bzwkQ+nyDM9VDzsvHaRzrSwrqwyCdHA=",
        "recompress": true
      },
      "src/third_party/clang-format/script": {
@@ -97,8 +97,8 @@
      },
      "src/third_party/angle": {
        "url": "https://chromium.googlesource.com/angle/angle.git",
-        "rev": "96492b317e27ba4106ed00f5faa4534cfeaa0b8f",
-        "hash": "sha256-TE8vYLNnAzVkGQZ2ZYuNHnu8fwp2Qv4ANP0btgrKYSQ="
+        "rev": "d9fc4a372074b1079c193c422fc4a180e79b6636",
+        "hash": "sha256-owMOjZEXhjXkEwzKdNVUk6Uzqdfp8UQq4JLDSvbvyeA="
      },
      "src/third_party/angle/third_party/glmark2/src": {
        "url": "https://chromium.googlesource.com/external/github.com/glmark2/glmark2",
@@ -582,8 +582,8 @@
      },
      "src/third_party/pdfium": {
        "url": "https://pdfium.googlesource.com/pdfium.git",
-        "rev": "849572b5c41e5bf59dc88bf54c41067faa9b5b00",
-        "hash": "sha256-lTUkzpzIskbEL7b2xBWT8s9YNyu1AZ235SBo5AfQtpg="
+        "rev": "bbdc38bc2d1693f56154f78eb5d4ff296d8ca3da",
+        "hash": "sha256-LYo73KuSVBEcRN1PqG0EBFeKaLy66UPtZ3DMHP5YVXM="
      },
      "src/third_party/perfetto": {
        "url": "https://chromium.googlesource.com/external/github.com/google/perfetto.git",
@@ -797,8 +797,8 @@
      },
      "src/v8": {
        "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "4d36678284f92d381f411c7947588d7a09989ca4",
-        "hash": "sha256-X5k2R7/sS3/C2S5hC1ILSquWjnPol3Pk+xe1suzgnFs="
+        "rev": "a0a7886d6b3707be8d4b403e463fa82fdb3f216c",
+        "hash": "sha256-KjIBJw40hiBkcHNn96dD5iZs2n2HMWIkAJ6ND2+5JJQ="
      }
    }
  },
@@ -135,13 +135,13 @@
    "vendorHash": "sha256-rTQzbI04C92J+IXVX8dHtcbMvOif5jLW8ejm20qfrSA="
  },
  "awscc": {
-    "hash": "sha256-lsnmPbG5juue8ZQ/JT8zjk4vSDwMqUlIxAqKxbaR3iY=",
+    "hash": "sha256-RMOLAJyoIVIlg4GgU6rCSASgcZlvFMmLjFPqc5Lrdp8=",
    "homepage": "https://registry.terraform.io/providers/hashicorp/awscc",
    "owner": "hashicorp",
    "repo": "terraform-provider-awscc",
-    "rev": "v1.51.0",
+    "rev": "v1.53.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-1PX776uNp1uXW2i23Ea7b74rEQk2hH6xpDqi7StK3Hs="
+    "vendorHash": "sha256-VNWa7ynbqhaPXrnZBmWLsMOExnjBRD7+gp89tMReNAY="
  },
  "azuread": {
    "hash": "sha256-7dbBhQz0MDUAaz4U1ewM2RayWtp5gbo3FrrQ762Tb6A=",
@@ -597,11 +597,11 @@
    "vendorHash": "sha256-sPvX69R2BmlY/KhXZgxCunzseoOkz1h2b8yqekBBn0k="
  },
  "heroku": {
-    "hash": "sha256-B/NaFe8KOKGJJlF3vZnpdMnbD1VxBktqodPBk+4NZEc=",
+    "hash": "sha256-Kc9/k+PyUHXj3F3YnqlPI+d7eroscBkdHt68nUbwyX8=",
    "homepage": "https://registry.terraform.io/providers/heroku/heroku",
    "owner": "heroku",
    "repo": "terraform-provider-heroku",
-    "rev": "v5.2.8",
+    "rev": "v5.2.11",
    "spdx": null,
    "vendorHash": null
  },
@@ -110,7 +110,20 @@ rec {
  };

  # Eventually, switch to an updateScript without versionPrefix hardcoded...
-  thunderbird-esr = thunderbird-128;
+  thunderbird-esr = thunderbird-140;
+
+  thunderbird-140 = common {
+    applicationName = "Thunderbird ESR";
+
+    version = "140.2.0esr";
+    sha512 = "6a10f95b805f00a0820c822ae07bc52ac39d0a55f084c319d27f01710d8a1d809b7b224da966632ae0a22658bf14e76c8fd7cec022718316c306c43809a4997d";
+
+    updateScript = callPackage ./update.nix {
+      attrPath = "thunderbirdPackages.thunderbird-140";
+      versionPrefix = "140";
+      versionSuffix = "esr";
+    };
+  };

  thunderbird-128 = common {
    applicationName = "Thunderbird ESR";
@@ -1,72 +0,0 @@
-diff --git a/src/services/log.js b/src/services/log.js
-index a141eae14..094b9381b 100644
--- a/src/services/log.js
-+++ b/src/services/log.js
-@@ -1,15 +1,7 @@
- "use strict";
- 
-const fs = require('fs');
-const dataDir = require('./data_dir.js');
- const cls = require('./cls.js');
- 
-if (!fs.existsSync(dataDir.LOG_DIR)) {
-    fs.mkdirSync(dataDir.LOG_DIR, 0o700);
-}
-
-let logFile = null;
-
- const SECOND = 1000;
- const MINUTE = 60 * SECOND;
- const HOUR = 60 * MINUTE;
-@@ -17,38 +9,6 @@ const DAY = 24 * HOUR;
- 
- const NEW_LINE = process.platform === "win32" ? '\r\n' : '\n';
- 
-let todaysMidnight = null;
-
-initLogFile();
-
-function getTodaysMidnight() {
-    const now = new Date();
-
-    return new Date(now.getFullYear(), now.getMonth(), now.getDate());
-}
-
-function initLogFile() {
-    todaysMidnight = getTodaysMidnight();
-
-    const path = `${dataDir.LOG_DIR}/trilium-${formatDate()}.log`;
-
-    if (logFile) {
-        logFile.end();
-    }
-
-    logFile = fs.createWriteStream(path, {flags: 'a'});
-}
-
-function checkDate(millisSinceMidnight) {
-    if (millisSinceMidnight >= DAY) {
-        initLogFile();
-
-        millisSinceMidnight -= DAY;
-    }
-
-    return millisSinceMidnight;
-}
-
- function log(str) {
-     const bundleNoteId = cls.get("bundleNoteId");
- 
-@@ -56,12 +16,6 @@ function log(str) {
-         str = `[Script ${bundleNoteId}] ${str}`;
-     }
- 
-    let millisSinceMidnight = Date.now() - todaysMidnight.getTime();
-
-    millisSinceMidnight = checkDate(millisSinceMidnight);
-
-    logFile.write(`${formatTime(millisSinceMidnight)} ${str}${NEW_LINE}`);
-
-     console.log(str);
- }
- 
@@ -1,21 +0,0 @@
-{ lib, callPackage, ... }:
-
-let
-  metaCommon = with lib; {
-    description = "Hierarchical note taking application with focus on building large personal knowledge bases";
-    homepage = "https://github.com/zadam/trilium";
-    license = licenses.agpl3Plus;
-    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
-    platforms = [ "x86_64-linux" ];
-    maintainers = with maintainers; [
-      fliegendewurst
-      eliandoran
-    ];
-  };
-in
-{
-
-  trilium-desktop = callPackage ./desktop.nix { metaCommon = metaCommon; };
-  trilium-server = callPackage ./server.nix { metaCommon = metaCommon; };
-
-}
@@ -1,113 +0,0 @@
-{
-  stdenv,
-  lib,
-  unzip,
-  autoPatchelfHook,
-  fetchurl,
-  makeWrapper,
-  alsa-lib,
-  libgbm,
-  nss,
-  nspr,
-  systemd,
-  makeDesktopItem,
-  copyDesktopItems,
-  wrapGAppsHook3,
-  metaCommon,
-}:
-
-let
-  pname = "trilium-desktop";
-  version = "0.63.6";
-
-  linuxSource.url = "https://github.com/zadam/trilium/releases/download/v${version}/trilium-linux-x64-${version}.tar.xz";
-  linuxSource.sha256 = "12kgq5x4f93hxz057zqhz0x1y0rxfxh90fv9fjjs3jrnk0by7f33";
-
-  darwinSource.url = "https://github.com/zadam/trilium/releases/download/v${version}/trilium-mac-x64-${version}.zip";
-  darwinSource.sha256 = "0ry512cn622av3nm8rnma2yvqc71rpzax639872ivvc5vm4rsc30";
-
-  meta = metaCommon // {
-    mainProgram = "trilium";
-    platforms = [
-      "x86_64-linux"
-      "x86_64-darwin"
-    ];
-  };
-
-  linux = stdenv.mkDerivation rec {
-    inherit pname version meta;
-
-    src = fetchurl linuxSource;
-
-    # TODO: migrate off autoPatchelfHook and use nixpkgs' electron
-    nativeBuildInputs = [
-      autoPatchelfHook
-      makeWrapper
-      wrapGAppsHook3
-      copyDesktopItems
-    ];
-
-    buildInputs = [
-      alsa-lib
-      libgbm
-      nss
-      nspr
-      stdenv.cc.cc
-      systemd
-    ];
-
-    desktopItems = [
-      (makeDesktopItem {
-        name = "Trilium";
-        exec = "trilium";
-        icon = "trilium";
-        comment = meta.description;
-        desktopName = "Trilium Notes";
-        categories = [ "Office" ];
-        startupWMClass = "trilium notes";
-      })
-    ];
-
-    # Remove trilium-portable.sh, so trilium knows it is packaged making it stop auto generating a desktop item on launch
-    postPatch = ''
-      rm ./trilium-portable.sh
-    '';
-
-    installPhase = ''
-      runHook preInstall
-      mkdir -p $out/bin
-      mkdir -p $out/share/trilium
-      mkdir -p $out/share/icons/hicolor/128x128/apps
-
-      cp -r ./* $out/share/trilium
-      ln -s $out/share/trilium/trilium $out/bin/trilium
-
-      ln -s $out/share/trilium/icon.png $out/share/icons/hicolor/128x128/apps/trilium.png
-      runHook postInstall
-    '';
-
-    # LD_LIBRARY_PATH "shouldn't" be needed, remove when possible :)
-    # Error: libstdc++.so.6: cannot open shared object file: No such file or directory
-    preFixup = ''
-      gappsWrapperArgs+=(--prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath buildInputs})
-    '';
-
-    dontStrip = true;
-
-    passthru.updateScript = ./update.sh;
-  };
-
-  darwin = stdenv.mkDerivation {
-    inherit pname version meta;
-
-    src = fetchurl darwinSource;
-    nativeBuildInputs = [ unzip ];
-
-    installPhase = ''
-      mkdir -p $out/Applications
-      cp -r *.app $out/Applications
-    '';
-  };
-
-in
-if stdenv.hostPlatform.isDarwin then darwin else linux
@@ -1,65 +0,0 @@
-{
-  lib,
-  stdenv,
-  autoPatchelfHook,
-  fetchurl,
-  nixosTests,
-  metaCommon,
-}:
-
-let
-  serverSource.url = "https://github.com/zadam/trilium/releases/download/v${version}/trilium-linux-x64-server-${version}.tar.xz";
-  serverSource.sha256 = "0gwp6h6nvfzq7k1g3233h838nans45jkd5c3pzl6qdhhm19vcs27";
-  version = "0.63.6";
-in
-stdenv.mkDerivation {
-  pname = "trilium-server";
-  inherit version;
-  meta = metaCommon // {
-    platforms = [ "x86_64-linux" ];
-    mainProgram = "trilium-server";
-  };
-
-  src = fetchurl serverSource;
-
-  nativeBuildInputs = [
-    autoPatchelfHook
-  ];
-
-  buildInputs = [
-    (lib.getLib stdenv.cc.cc)
-  ];
-
-  patches = [
-    # patch logger to use console instead of rolling files
-    ./0001-Use-console-logger-instead-of-rolling-files.patch
-  ];
-
-  installPhase = ''
-    runHook preInstall
-    mkdir -p $out/bin
-    mkdir -p $out/share/trilium-server
-
-    cp -r ./* $out/share/trilium-server
-    runHook postInstall
-  '';
-
-  postFixup = ''
-    cat > $out/bin/trilium-server <<EOF
-    #!${stdenv.cc.shell}
-    cd $out/share/trilium-server
-    exec ./node/bin/node src/www
-    EOF
-    chmod a+x $out/bin/trilium-server
-
-    # ERROR: noBrokenSymlinks: found 4 dangling symlinks, 0 reflexive symlinks and 0 unreadable symlinks
-    unlink $out/share/trilium-server/node/bin/npx
-    unlink $out/share/trilium-server/node/bin/npm
-    unlink $out/share/trilium-server/node_modules/.bin/electron
-    unlink $out/share/trilium-server/node_modules/.bin/electron-installer-debian
-  '';
-
-  passthru.tests = {
-    trilium-server = nixosTests.trilium-server;
-  };
-}
@@ -1,23 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i bash -p coreutils curl jq
-set -euo pipefail
-
-cd $(dirname "${BASH_SOURCE[0]}")
-
-setKV () {
-    sed -i "s|$2 = \".*\"|$2 = \"${3:-}\"|" $1
-}
-
-version=$(curl -s --show-error "https://api.github.com/repos/zadam/trilium/releases/latest" | jq -r '.tag_name' | tail -c +2)
-
-# Update desktop application
-sha256_linux64=$(nix-prefetch-url --quiet https://github.com/zadam/trilium/releases/download/v${version}/trilium-linux-x64-${version}.tar.xz)
-sha256_darwin64=$(nix-prefetch-url --quiet https://github.com/zadam/trilium/releases/download/v${version}/trilium-mac-x64-${version}.zip)
-setKV ./desktop.nix version $version
-setKV ./desktop.nix linuxSource.sha256 $sha256_linux64
-setKV ./desktop.nix darwinSource.sha256 $sha256_darwin64
-
-# Update server
-sha256_linux64_server=$(nix-prefetch-url --quiet https://github.com/zadam/trilium/releases/download/v${version}/trilium-linux-x64-server-${version}.tar.xz)
-setKV ./server.nix version $version
-setKV ./server.nix serverSource.sha256 $sha256_linux64_server
@@ -11,13 +11,13 @@

 stdenv.mkDerivation rec {
  pname = "obs-text-pthread";
-  version = "2.0.5";
+  version = "2.0.6";

  src = fetchFromGitHub {
    owner = "norihiro";
    repo = "obs-text-pthread";
    rev = version;
-    sha256 = "sha256-zrgxKs3jmrwQJiEgKfZz1BOVToTLauQXtFYcuFlV71o=";
+    sha256 = "sha256-lDGji2ZdK5XoBKLRdgYCIDPndVkhIZltc94wWFRTLCA=";
  };

  nativeBuildInputs = [
@@ -169,8 +169,12 @@ stdenv.mkDerivation (finalAttrs: {
    ninja
    perl

-    # Don't change this to python3 and python3.pkgs.*, breaks cross-compilation
-    (python3Packages.python.withPackages (ps: with ps; [ distlib ]))
+    # For python changes other than simple package additions, ping @dramforever for review.
+    # Don't change `python3Packages` to `python3.pkgs.*`, breaks cross-compilation.
+    python3Packages.distlib
+    # Hooks from the python package are needed to add `$pythonPath` so
+    # `python/scripts/mkvenv.py` can detect `meson` otherwise the vendored meson without patches will be used.
+    python3Packages.python
  ]
  ++ lib.optionals gtkSupport [ wrapGAppsHook3 ]
  ++ lib.optionals enableDocs [
@@ -1,8 +1,8 @@
 {
  lib,
  stdenv,
-  fetchurl,
-  directoryListingUpdater,
+  fetchFromGitLab,
+  nix-update-script,
  meson,
  ninja,
  pkg-config,
@@ -39,16 +39,40 @@
  evolution-data-server,
  nixosTests,
  gmobile,
+  appstream,
 }:

+let
+  # Derived from subprojects/libcall-ui.wrap
+  libcall-ui = fetchFromGitLab {
+    domain = "gitlab.gnome.org";
+    group = "World";
+    owner = "Phosh";
+    repo = "libcall-ui";
+    tag = "v0.1.4";
+    hash = "sha256-6fiqdvagcMnvaZ9UxC05haBwObcsqwgJL/V03LuSMF8=";
+  };
+
+  # Derived from subprojects/gvc.wrap
+  gvc = fetchFromGitLab {
+    domain = "gitlab.gnome.org";
+    owner = "GNOME";
+    repo = "libgnome-volume-control";
+    rev = "5f9768a2eac29c1ed56f1fbb449a77a3523683b6";
+    hash = "sha256-gdgTnxzH8BeYQAsvv++Yq/8wHi7ISk2LTBfU8hk12NM=";
+  };
+in
 stdenv.mkDerivation (finalAttrs: {
  pname = "phosh";
-  version = "0.44.1";
+  version = "0.48.0";

-  src = fetchurl {
-    # Release tarball which includes subprojects gvc and libcall-ui
-    url = with finalAttrs; "https://sources.phosh.mobi/releases/${pname}/${pname}-${version}.tar.xz";
-    hash = "sha256-rczGr7YSmVFu13oa3iSTmSQ4jsjl7lv38zQtD7WmDis=";
+  src = fetchFromGitLab {
+    domain = "gitlab.gnome.org";
+    group = "World";
+    owner = "Phosh";
+    repo = "phosh";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-HnjR0hVjkGfoD8RYCJqpGjRhl0W+QO8tYwSo71XFL6A=";
  };

  nativeBuildInputs = [
@@ -71,7 +95,6 @@ stdenv.mkDerivation (finalAttrs: {
    callaudiod
    evolution-data-server
    pulseaudio
-    glib
    modemmanager
    gcr
    networkmanager
@@ -87,6 +110,7 @@ stdenv.mkDerivation (finalAttrs: {
    upower
    wayland
    feedbackd
+    appstream
  ];

  nativeCheckInputs = [
@@ -97,10 +121,16 @@ stdenv.mkDerivation (finalAttrs: {
  # Temporarily disabled - Test is broken (SIGABRT)
  doCheck = false;

+  postPatch = ''
+    ln -s ${libcall-ui} subprojects/libcall-ui
+    ln -s ${gvc} subprojects/gvc
+  '';
+
  mesonFlags = [
    "-Dcompositor=${phoc}/bin/phoc"
    # Save some time building if tests are disabled
    "-Dtests=${lib.boolToString finalAttrs.finalPackage.doCheck}"
+    "-Dc_args=-I${glib.dev}/include/gio-unix-2.0/"
  ];

  checkPhase = ''
@@ -123,7 +153,7 @@ stdenv.mkDerivation (finalAttrs: {
  passthru = {
    providedSessions = [ "phosh" ];
    tests.phosh = nixosTests.phosh;
-    updateScript = directoryListingUpdater { };
+    updateScript = nix-update-script { };
  };

  meta = with lib; {
@@ -134,6 +164,7 @@ stdenv.mkDerivation (finalAttrs: {
    maintainers = with maintainers; [
      masipcat
      zhaofengli
+      armelclo
    ];
    platforms = platforms.linux;
    mainProgram = "phosh-session";
@@ -3,7 +3,7 @@
  stdenv,
  fetchFromGitLab,
  nixosTests,
-  directoryListingUpdater,
+  nix-update-script,
  meson,
  ninja,
  pkg-config,
@@ -20,11 +20,26 @@
  json-glib,
  gsound,
  gmobile,
+  gnome-desktop,
+  libpulseaudio,
+  libportal,
+  libportal-gtk4,
+  glib,
 }:

+let
+  # Derived from subprojects/gvc.wrap
+  gvc = fetchFromGitLab {
+    domain = "gitlab.gnome.org";
+    owner = "GNOME";
+    repo = "libgnome-volume-control";
+    rev = "5f9768a2eac29c1ed56f1fbb449a77a3523683b6";
+    hash = "sha256-gdgTnxzH8BeYQAsvv++Yq/8wHi7ISk2LTBfU8hk12NM=";
+  };
+in
 stdenv.mkDerivation rec {
  pname = "phosh-mobile-settings";
-  version = "0.41.0";
+  version = "0.48.0";

  src = fetchFromGitLab {
    domain = "gitlab.gnome.org";
@@ -32,7 +47,7 @@ stdenv.mkDerivation rec {
    owner = "Phosh";
    repo = "phosh-mobile-settings";
    rev = "v${version}";
-    hash = "sha256-t5qngjQcjPltUGbcZ+CF5FbZtZkV/cD3xUhuApQbKHo=";
+    hash = "sha256-XnXwTjZnPlGNUmqizcIQdJ6SmrQ0dq9jNEhNsmDPzyM=";
  };

  nativeBuildInputs = [
@@ -42,6 +57,7 @@ stdenv.mkDerivation rec {
    pkg-config
    wayland-scanner
    wrapGAppsHook4
+    glib.dev
  ];

  buildInputs = [
@@ -55,22 +71,25 @@ stdenv.mkDerivation rec {
    json-glib
    gsound
    gmobile
+    gnome-desktop
+    libpulseaudio
+    libportal
+    libportal-gtk4
  ];

  postPatch = ''
-    # There are no schemas to compile.
-    substituteInPlace meson.build \
-      --replace 'glib_compile_schemas: true' 'glib_compile_schemas: false'
+    ln -s ${gvc} subprojects/gvc
  '';

  postInstall = ''
    # this is optional, but without it phosh-mobile-settings won't know about lock screen plugins
    ln -s '${phosh}/lib/phosh' "$out/lib/phosh"
+    glib-compile-schemas "$out/share/glib-2.0/schemas"
  '';

  passthru = {
    tests.phosh = nixosTests.phosh;
-    updateScript = directoryListingUpdater { };
+    updateScript = nix-update-script { };
  };

  meta = {
@@ -79,7 +98,10 @@ stdenv.mkDerivation rec {
    homepage = "https://gitlab.gnome.org/World/Phosh/phosh-mobile-settings";
    changelog = "https://gitlab.gnome.org/World/Phosh/phosh-mobile-settings/-/blob/v${version}/debian/changelog";
    license = lib.licenses.gpl3Plus;
-    maintainers = with lib.maintainers; [ rvl ];
+    maintainers = with lib.maintainers; [
+      rvl
+      armelclo
+    ];
    platforms = lib.platforms.linux;
  };
 }
@@ -0,0 +1,22 @@
+diff --git a/toolkit/xre/nsXREDirProvider.cpp b/toolkit/xre/nsXREDirProvider.cpp
+index 6db876975187..5882c5d7f1d6 100644
+--- a/toolkit/xre/nsXREDirProvider.cpp
+++ b/toolkit/xre/nsXREDirProvider.cpp
+@@ -11,6 +11,7 @@
+ 
+ #include "jsapi.h"
+ #include "xpcpublic.h"
+#include "prenv.h"
+ #include "prprf.h"
+ 
+ #include "nsIAppStartup.h"
+@@ -297,7 +297,8 @@ static nsresult GetSystemParentDirectory(nsIFile** aFile) {
+       "/usr/lib/mozilla"_ns
+ #    endif
+       ;
+-  rv = NS_NewNativeLocalFile(dirname, getter_AddRefs(localDir));
+  const char* pathVar = PR_GetEnv("MOZ_SYSTEM_DIR");
+  rv = NS_NewNativeLocalFile((pathVar && *pathVar) ? nsDependentCString(pathVar) : reinterpret_cast<const nsCString&>(dirname), getter_AddRefs(localDir));
+ #  endif
+ 
+   if (NS_SUCCEEDED(rv)) {
@@ -0,0 +1,26 @@
+diff --git a/docshell/base/nsAboutRedirector.cpp b/docshell/base/nsAboutRedirector.cpp
+index 16888323d7..b96450a247 100644
+--- a/docshell/base/nsAboutRedirector.cpp
+++ b/docshell/base/nsAboutRedirector.cpp
+@@ -90,9 +90,6 @@ static const RedirEntry kRedirMap[] = {
+     {"addons", "chrome://mozapps/content/extensions/aboutaddons.html",
+      nsIAboutModule::ALLOW_SCRIPT | nsIAboutModule::IS_SECURE_CHROME_UI},
+ #endif
+-    {"buildconfig", "chrome://global/content/buildconfig.html",
+-     nsIAboutModule::URI_SAFE_FOR_UNTRUSTED_CONTENT |
+-         nsIAboutModule::IS_SECURE_CHROME_UI},
+     {"checkerboard", "chrome://global/content/aboutCheckerboard.html",
+      nsIAboutModule::URI_SAFE_FOR_UNTRUSTED_CONTENT |
+          nsIAboutModule::ALLOW_SCRIPT},
+diff --git a/toolkit/content/jar.mn b/toolkit/content/jar.mn
+index eb6c179b60..57568668b1 100644
+--- a/toolkit/content/jar.mn
+++ b/toolkit/content/jar.mn
+@@ -40,7 +40,6 @@ toolkit.jar:
+    content/global/aboutUrlClassifier.js
+    content/global/aboutUrlClassifier.xhtml
+    content/global/aboutUrlClassifier.css
+-*   content/global/buildconfig.html
+    content/global/buildconfig.css
+    content/global/contentAreaUtils.js
+    content/global/datepicker.xhtml
@@ -305,7 +305,11 @@ buildStdenv.mkDerivation {
  ];

  patches =
-    lib.optionals (lib.versionAtLeast version "139" && lib.versionOlder version "141") [
+    # Remove references to the build clsoure
+    lib.optionals (lib.versionAtLeast version "136") [ ./136-no-buildconfig.patch ]
+    # Add MOZ_SYSTEM_DIR env var for native messaging host support
+    ++ lib.optionals (lib.versionAtLeast version "133") [ ./133-env-var-for-system-dir.patch ]
+    ++ lib.optionals (lib.versionAtLeast version "139" && lib.versionOlder version "141") [
      # https://bugzilla.mozilla.org/show_bug.cgi?id=1955112
      # https://hg-edge.mozilla.org/mozilla-central/rev/aa8a29bd1fb9
      ./139-wayland-drag-animation.patch
@@ -9,6 +9,7 @@ dartConfigHook() {
    echo "Installing dependencies"
    mkdir -p .dart_tool
    cp "$packageConfig" .dart_tool/package_config.json
+    @python3@ @packageGraphScript@ > .dart_tool/package_graph.json

    packagePath() {
        jq --raw-output --arg name "$1" '.packages.[] | select(.name == $name) .rootUri | sub("file://"; "")' .dart_tool/package_config.json
@@ -4,6 +4,7 @@
  dart,
  yq,
  jq,
+  python3,
 }:

 {
@@ -11,6 +12,8 @@
    name = "dart-config-hook";
    substitutions.yq = "${yq}/bin/yq";
    substitutions.jq = "${jq}/bin/jq";
+    substitutions.python3 = lib.getExe (python3.withPackages (ps: with ps; [ pyyaml ]));
+    substitutions.packageGraphScript = ../../pub2nix/package-graph.py;
  } ./dart-config-hook.sh;
  dartBuildHook = makeSetupHook {
    name = "dart-build-hook";
@@ -0,0 +1,54 @@
+"""
+https://github.com/dart-lang/pub/issues/4522
+This script generates a package_graph.json file.
+"""
+
+import json
+import os
+from pathlib import Path
+from urllib.parse import unquote, urlparse
+
+import yaml
+
+
+def get_package(pubspec_path: Path, dev_dependencies: bool = False):
+    with pubspec_path.open("r", encoding="utf-8") as f:
+        pubspec = yaml.load(f, Loader=yaml.CSafeLoader)
+    package = {
+        "name": pubspec["name"],
+        "version": pubspec.get("version") or "0.0.0",
+        "dependencies": list(pubspec.get("dependencies") or {}),
+    }
+    if dev_dependencies:
+        package["devDependencies"] = list(pubspec.get("dev_dependencies") or {})
+    return package
+
+
+def main() -> None:
+    package_config_file_path = Path(os.environ["packageConfig"])  # noqa: SIM112
+    with package_config_file_path.open("r", encoding="utf-8") as f:
+        package_config = json.load(f)
+    package_graph = []
+    root_package = get_package(Path("pubspec.yaml"), dev_dependencies=True)
+    for data in package_config.get("packages", []):
+        if data["name"] == root_package["name"] or data["rootUri"] == "flutter_gen":
+            continue
+        package_graph.append(
+            get_package(Path(unquote(urlparse(data["rootUri"]).path)) / "pubspec.yaml")
+        )
+    package_graph.append(root_package)
+    print(
+        json.dumps(
+            {
+                "roots": [root_package["name"]],
+                "packages": package_graph,
+                "configVersion": 1,
+            },
+            indent=2,
+            ensure_ascii=False,
+        )
+    )
+
+
+if __name__ == "__main__":
+    main()
@@ -11,6 +11,8 @@
  xz,
  version,
  pharHash,
+  installShellFiles,
+  stdenv,
 }:

 stdenvNoCC.mkDerivation (finalAttrs: {
@@ -24,7 +26,10 @@ stdenvNoCC.mkDerivation (finalAttrs: {

  dontUnpack = true;

-  nativeBuildInputs = [ makeBinaryWrapper ];
+  nativeBuildInputs = [
+    makeBinaryWrapper
+    installShellFiles
+  ];

  installPhase = ''
    runHook preInstall
@@ -46,13 +51,19 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    runHook postInstall
  '';

+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    installShellCompletion --cmd composer \
+      --bash <($out/bin/composer completion bash)
+  '';
+
  meta = {
    changelog = "https://github.com/composer/composer/releases/tag/${finalAttrs.version}";
    description = "Dependency Manager for PHP, shipped from the PHAR file";
    homepage = "https://getcomposer.org/";
    license = lib.licenses.mit;
    mainProgram = "composer";
-    maintainers = with lib.maintainers; [ ];
+    maintainers = [ lib.maintainers.patka ];
+    teams = [ lib.teams.php ];
    platforms = lib.platforms.all;
  };
 })
@@ -0,0 +1,44 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  libusb-compat-0_1,
+  versionCheckHook,
+  nix-update-script,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "0xFFFF";
+  version = "0.10";
+
+  src = fetchFromGitHub {
+    owner = "pali";
+    repo = "0xFFFF";
+    tag = finalAttrs.version;
+    hash = "sha256-RTpiH6OpC1hRbhLW5Em01oDQdpAZ/mfggCDLSUzOC9s=";
+  };
+
+  strictDeps = true;
+
+  buildInputs = [ libusb-compat-0_1 ];
+
+  installFlags = [
+    "DESTDIR=$(out)"
+    "PREFIX="
+  ];
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "-h";
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Open Free Fiasco Firmware Flasher for Maemo devices";
+    homepage = "https://github.com/pali/0xFFFF";
+    changelog = "https://github.com/pali/0xFFFF/releases/tag/${finalAttrs.version}";
+    license = lib.licenses.gpl3Plus;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ ungeskriptet ];
+    mainProgram = "0xFFFF";
+  };
+})
@@ -161,6 +161,9 @@ stdenv.mkDerivation (finalAttrs: {
    # Enable support for Little/Big Endian Interoperability
    (lib.cmakeBool "ADIOS2_USE_Endian_Reverse" true)

+    # force use of "-fallow-argument-mismatch"
+    (lib.cmakeBool "ADIOS2_USE_Fortran_flag_argument_mismatch" true)
+
    (lib.cmakeBool "ADIOS2_BUILD_EXAMPLES" withExamples)
    (lib.cmakeFeature "CMAKE_INSTALL_BINDIR" "bin")
    (lib.cmakeFeature "CMAKE_INSTALL_LIBDIR" "lib")
@@ -14,15 +14,18 @@
  libgcrypt,
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "aide";
  version = "0.19.2";

  src = fetchurl {
-    url = "https://github.com/aide/aide/releases/download/v${version}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-I3YrBfRhEe3rPIoFAWyHMcAb24wfkb5IwVbDGrhedMQ=";
+    # We specifically want the tar.gz, so fetchFromGitHub is not suitable here
+    url = "https://github.com/aide/aide/releases/download/v${finalAttrs.version}/${finalAttrs.pname}-${finalAttrs.version}.tar.gz";
+    hash = "sha256-I3YrBfRhEe3rPIoFAWyHMcAb24wfkb5IwVbDGrhedMQ=";
  };

+  nativeBuildInputs = [ pkg-config ];
+
  buildInputs = [
    flex
    bison
@@ -35,8 +38,6 @@ stdenv.mkDerivation rec {
    libgcrypt
  ];

-  nativeBuildInputs = [ pkg-config ];
-
  configureFlags = [
    "--with-posix-acl"
    "--with-selinux"
@@ -46,11 +47,11 @@ stdenv.mkDerivation rec {

  meta = {
    homepage = "https://aide.github.io/";
-    changelog = "https://github.com/aide/aide/blob/v${version}/ChangeLog";
+    changelog = "https://github.com/aide/aide/blob/v${finalAttrs.version}/ChangeLog";
    description = "File and directory integrity checker";
    mainProgram = "aide";
    license = lib.licenses.gpl2Plus;
    maintainers = with lib.maintainers; [ happysalada ];
    platforms = lib.platforms.linux;
  };
-}
+})
@@ -0,0 +1,21 @@
+diff --git a/aider/repomap.py b/aider/repomap.py
+index 23eee239..0a40f2e6 100644
+--- a/aider/repomap.py
+++ b/aider/repomap.py
+@@ -16,6 +16,7 @@ from grep_ast import TreeContext, filename_to_lang
+ from pygments.lexers import guess_lexer_for_filename
+ from pygments.token import Token
+ from tqdm import tqdm
+from tree_sitter import QueryCursor
+ 
+ from aider.dump import dump
+ from aider.special import filter_important_files
+@@ -286,7 +287,7 @@ class RepoMap:
+ 
+         # Run the tags queries
+         query = language.query(query_scm)
+-        captures = query.captures(tree.root_node)
+        captures = QueryCursor(query).captures(tree.root_node)
+ 
+         saw = set()
+         if USING_TSL_PACK:
@@ -146,6 +146,8 @@ let
    ];

    patches = [
+      ./fix-tree-sitter.patch
+
      (replaceVars ./fix-flake8-invoke.patch {
        flake8 = lib.getExe python3Packages.flake8;
      })
@@ -9,7 +9,7 @@
  nodejs,
  jpegoptim,
  oxipng,
-  nodePackages,
+  svgo,
  nix-update-script,
 }:

@@ -37,7 +37,7 @@ stdenv.mkDerivation (finalAttrs: {
    nodejs
    jpegoptim
    oxipng
-    nodePackages.svgo
+    svgo
  ];

  postPatch = ''
@@ -75,7 +75,7 @@ stdenv.mkDerivation (finalAttrs: {
    # (Losslessly) optimise compression of image artifacts
    find dist -type f -name '*.jpg' -execdir ${jpegoptim}/bin/jpegoptim -w$NIX_BUILD_CORES {} \;
    find dist -type f -name '*.png' -execdir ${oxipng}/bin/oxipng -o max -t $NIX_BUILD_CORES {} \;
-    find dist -type f -name '*.svg' -execdir ${nodePackages.svgo}/bin/svgo {} \;
+    find dist -type f -name '*.svg' -execdir ${svgo}/bin/svgo {} \;

    cp -R -v dist $out

@@ -65,13 +65,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "amnezia-vpn";
-  version = "4.8.9.1";
+  version = "4.8.9.2";

  src = fetchFromGitHub {
    owner = "amnezia-vpn";
    repo = "amnezia-client";
    tag = finalAttrs.version;
-    hash = "sha256-docQqOVzmgqWPhKzOmKeXhssjyhtfYy1fNn0ZGXjsZ0=";
+    hash = "sha256-UavKtAwnEa+Ym1a7XzC3JPDLovqggjsav4q2MiYUxbI=";
    fetchSubmodules = true;
  };

@@ -1,63 +0,0 @@
-{
-  lib,
-  fetchFromGitHub,
-  python3Packages,
-  writableTmpDirAsHomeHook,
-}:
-
-python3Packages.buildPythonApplication rec {
-  pname = "ansible-later";
-  version = "4.0.8";
-  pyproject = true;
-
-  src = fetchFromGitHub {
-    owner = "thegeeklab";
-    repo = "ansible-later";
-    tag = "v${version}";
-    hash = "sha256-4ZHCnLeG5gr0UtKQLU+6xnTxUbxnLcmDd51Psnaa42I=";
-  };
-
-  pythonRelaxDeps = [
-    "python-json-logger"
-    "yamllint"
-  ];
-
-  build-system = with python3Packages; [
-    poetry-core
-    poetry-dynamic-versioning
-  ];
-
-  dependencies = with python3Packages; [
-    pyyaml
-    ansible-core
-    ansible
-    anyconfig
-    appdirs
-    colorama
-    jsonschema
-    nested-lookup
-    pathspec
-    python-json-logger
-    toolz
-    unidiff
-    yamllint
-  ];
-
-  nativeCheckInputs = with python3Packages; [
-    pytest-cov-stub
-    pytest-mock
-    pytestCheckHook
-    writableTmpDirAsHomeHook
-  ];
-
-  pythonImportsCheck = [ "ansiblelater" ];
-
-  meta = {
-    description = "Best practice scanner for Ansible roles and playbooks";
-    homepage = "https://github.com/thegeeklab/ansible-later";
-    changelog = "https://github.com/thegeeklab/ansible-later/releases/tag/${src.tag}";
-    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ tboerger ];
-    mainProgram = "ansible-later";
-  };
-}
@@ -5,29 +5,55 @@
  installShellFiles,
  nix-update-script,
  stdenv,
+  fetchYarnDeps,
+  yarnConfigHook,
+  yarnBuildHook,
+  nodejs,
 }:

 buildGoModule rec {
  pname = "argocd";
-  version = "2.14.11";
+  version = "3.1.0";

  src = fetchFromGitHub {
    owner = "argoproj";
    repo = "argo-cd";
    rev = "v${version}";
-    hash = "sha256-KCU/WMytx4kOzlkZDwLfRRfutBtdk6UVBNdXOWC5kWc=";
+    hash = "sha256-zg6zd10hpGUOukrwMK0qJXBL8nVgPSZJ6+jh+/mbOL0=";
+  };
+
+  ui = stdenv.mkDerivation {
+    pname = "${pname}-ui";
+    inherit version;
+    src = src + "/ui";
+
+    offlineCache = fetchYarnDeps {
+      yarnLock = "${src}/ui/yarn.lock";
+      hash = "sha256-ekhSPWzIgFhwSw0bIlBqu8LTYk3vuJ9VM8eHc3mnHGM=";
+    };
+
+    nativeBuildInputs = [
+      yarnConfigHook
+      yarnBuildHook
+      nodejs
+    ];
+
+    postInstall = ''
+      mkdir -p $out
+      cp -r dist $out/dist
+    '';
  };

  proxyVendor = true; # darwin/linux hash mismatch
-  vendorHash = "sha256-Xm9J08pxzm3fPQjMA6NDu+DPJGsvtUvj+n/qrOZ9BE4=";
+  vendorHash = "sha256-tYHA1WlziKWOvv3uF3tTSrvqDoHBVRhUnKZXOxT1rMk=";

  # Set target as ./cmd per cli-local
-  # https://github.com/argoproj/argo-cd/blob/master/Makefile#L227
+  # https://github.com/argoproj/argo-cd/blob/master/Makefile
  subPackages = [ "cmd" ];

  ldflags =
    let
-      packageUrl = "github.com/argoproj/argo-cd/v2/common";
+      packageUrl = "github.com/argoproj/argo-cd/v3/common";
    in
    [
      "-s"
@@ -41,12 +67,17 @@ buildGoModule rec {

  nativeBuildInputs = [ installShellFiles ];

+  preBuild = ''
+    cp -r ${ui}/dist ./ui
+    stat ./ui/dist/app/index.html # Sanity check
+  '';
+
  # set ldflag for kubectlVersion since it is needed for argo
  # Per https://github.com/search?q=repo%3Aargoproj%2Fargo-cd+%22KUBECTL_VERSION%3D%22+path%3AMakefile&type=code
  prePatch = ''
    export KUBECTL_VERSION=$(grep 'k8s.io/kubectl v' go.mod | cut -f 2 -d " " | cut -f 1 -d "=" )
    echo using $KUBECTL_VERSION
-    ldflags="''${ldflags} -X github.com/argoproj/argo-cd/v2/common.kubectlVersion=''${KUBECTL_VERSION}"
+    ldflags="''${ldflags} -X github.com/argoproj/argo-cd/v3/common.kubectlVersion=''${KUBECTL_VERSION}"
  '';
  installPhase = ''
    runHook preInstall
@@ -7,13 +7,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "asciiquarium-transparent";
-  version = "1.3";
+  version = "1.4";

  src = fetchFromGitHub {
    owner = "nothub";
    repo = "asciiquarium";
-    rev = "${finalAttrs.version}";
-    hash = "sha256-zQyVIfwmhF3WsCeIZLwjDufvKzAfjLxaK2s7WTedqCg=";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-lUNPg+/R/UwnHxjVXROMjvQxBZuCPBrYWB546OHplJM=";
  };

  nativeBuildInputs = [ makeWrapper ];
@@ -7,16 +7,16 @@

 buildGoModule (finalAttrs: {
  pname = "atmos";
-  version = "1.186.0";
+  version = "1.188.0";

  src = fetchFromGitHub {
    owner = "cloudposse";
    repo = "atmos";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Mi18XmKXT27fMONfRqQqfi1TIGQ3sLTW9aeUJvPjTac=";
+    hash = "sha256-WQ4u/5V7zVS1d7J3XS3nix465AyZGudpdSEZiBD+HMc=";
  };

-  vendorHash = "sha256-qYKHfLsz0rno2JGIyG4aTcNW51waaeXJK7V5tkypueA=";
+  vendorHash = "sha256-HlFwFzP1K/qiuRu3/XvNZiCB7oXBk5rx6mSlCB+q4kc=";

  ldflags = [
    "-s"
@@ -15,10 +15,10 @@

 let
  source = {
-    version = "2.28.0";
-    hash = "sha256-bbsiaSGIaD5oFnhk3e+SWzYxv4dsRXrgMVbe1lsj4pw=";
-    npmDepsHash = "sha256-JC2uOXV+EwS6CGwyOUTXcymFwLSz/KUqIoB4ccSGgbw=";
-    clientNpmDepsHash = "sha256-6l8apOd3R259+SlcD6P6rx1FkRnB80keoBGcfbQNhGU=";
+    version = "2.29.0";
+    hash = "sha256-Vewznln5Ny8SWfOfyusnDcO9CsTwWrOTP+W8ynnSdR0=";
+    npmDepsHash = "sha256-zk2Xw3lpy/ZBZZKSsMgdIHrKGB7yl9GYtewn9ME1guc=";
+    clientNpmDepsHash = "sha256-mDS/onnotiBTFihoSMSccF/mrdTduZj5DZfQpyzMoDY=";
  };

  src = fetchFromGitHub {
@@ -11,14 +11,14 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "aws-sam-cli";
-  version = "1.135.0";
+  version = "1.143.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "aws";
    repo = "aws-sam-cli";
    tag = "v${version}";
-    hash = "sha256-ccYpEznuU6d7gDyrDiuUmvdCJutXI7SAH2PH9Vdq8Fs=";
+    hash = "sha256-QnJQ45ucziHmOkQdAT29szOljBExiIXZ2zvhiKYXBxI=";
  };

  build-system = with python3.pkgs; [ setuptools ];
@@ -3,7 +3,7 @@
  stdenv,
  buildBazelPackage,
  fetchFromGitHub,
-  bazel_6,
+  bazel_7,
  jdk,
  nix-update-script,
  cctools,
@@ -39,12 +39,14 @@ buildBazelPackage rec {
    patchShebangs scripts/create-workspace-status.sh
  '';

+  removeRulesCC = false;
+
  fetchAttrs = {
    hash =
      {
-        aarch64-linux = "sha256-ibv49Y0VjAvfTUwxRUH4BmzUvz8J/qfYPGnI5Tw51HA=";
-        x86_64-linux = "sha256-VHR08FB4G0LlczWtBb8AdU5tNEzBDNUZpHoB6e3HB1M=";
-        aarch64-darwin = "sha256-5uKCLDJs0tzOJ7YiKP90RIfIYrken3XFyhT5HHdzft0=";
+        aarch64-linux = "sha256-1iy2S0mmXksfwucks+HOZ2/HUGaVBqk7VlR+kO6iYZE=";
+        x86_64-linux = "sha256-YOIwwlCYlNINlYbm/vq3Jjhe+/zgrtECdMRl+vE8FgI=";
+        aarch64-darwin = "sha256-7g1deAihrjpwAxNbG7rv9dDs3FjOCuRIFieLbENKmbw=";
      }
      .${system} or (throw "No hash for system: ${system}");
  };
@@ -52,7 +54,7 @@ buildBazelPackage rec {
  nativeBuildInputs = [
    jdk
  ];
-  bazel = bazel_6;
+  bazel = bazel_7;

  bazelBuildFlags = [ "-c opt" ];
  bazelTestTargets = [ "//..." ];
@@ -38,6 +38,12 @@ let
          rev = "932366c9d4d8e487162b5c1b2a2d9693e24e0483";
          hash = "sha256-zOekPmP1zR/S+zxq/7OrEz24k8SInlsB+wJ8kPlmqe4=";
        };
+        patches = [ ];
+        preCheck = ''
+          rm -rf src/coincurve
+          # don't run benchmark tests
+          rm tests/test_bench.py
+        '';
      });
  bindir = linkFarm "bindir" (
    lib.mapAttrs (_: p: "${lib.getBin p}/bin") {
@@ -9,10 +9,10 @@
 }:
 let
  pname = "beeper";
-  version = "4.1.111";
+  version = "4.1.135";
  src = fetchurl {
    url = "https://beeper-desktop.download.beeper.com/builds/Beeper-${version}.AppImage";
-    hash = "sha256-0cr6syveIHIIy8+FyE23U8iidMYJXkN8CqhhbH0oNt0=";
+    hash = "sha256-bp0RGU689A8kgphNgJJnlbQBh1fAubwWUvM9StzLwB4=";
  };
  appimageContents = appimageTools.extract {
    inherit pname version src;
@@ -49,6 +49,8 @@ buildNpmPackage' rec {

    # ensures `app.getPath("exe")` returns our wrapper, not ${electron}/bin/electron
    ./set-exe-path.patch
+    # ensure that the desktop proxy is correctly located in libexec
+    ./set-desktop-proxy-path.patch
    # on linux: don't flip fuses, don't create wrapper script, on darwin: don't try copying safari extensions, don't try re-signing app
    ./skip-afterpack-and-aftersign.patch
    # since out arch doesn't match upstream, we'll generate and use desktop_napi.node instead of desktop_napi.${platform}-${arch}.node
@@ -60,6 +62,8 @@ buildNpmPackage' rec {
    rm -r bitwarden_license

    substituteInPlace apps/desktop/src/main.ts --replace-fail '%%exePath%%' "$out/bin/bitwarden"
+    substituteInPlace apps/desktop/src/main/native-messaging.main.ts \
+      --replace-fail '%%desktopProxyPath%%' "$out/libexec/desktop_proxy"

    # force canUpdate to false
    # will open releases page instead of trying to update files
@@ -133,6 +137,10 @@ buildNpmPackage' rec {
    pushd apps/desktop/desktop_native/napi
    npm run build
    popd
+
+    pushd apps/desktop/desktop_native/proxy
+    cargo build --bin desktop_proxy --release -j $NIX_BUILD_CORES --offline
+    popd
  '';

  postBuild = ''
@@ -176,6 +184,8 @@ buildNpmPackage' rec {

  installPhase = ''
    runHook preInstall
+
+    install -Dm755 -t $out/libexec apps/desktop/desktop_native/target/release/desktop_proxy
  ''
  + lib.optionalString stdenv.hostPlatform.isDarwin ''
    mkdir -p $out/Applications
@@ -0,0 +1,13 @@
+diff --git a/apps/desktop/src/main/native-messaging.main.ts b/apps/desktop/src/main/native-messaging.main.ts
+index 30f3e03..6bbf96f 100644
+--- a/apps/desktop/src/main/native-messaging.main.ts
+++ b/apps/desktop/src/main/native-messaging.main.ts
+@@ -500,7 +500,7 @@ export class NativeMessagingMain {
+       }
+     }
+ 
+-    return path.join(path.dirname(this.exePath), `desktop_proxy${ext}`);
+    return "%%desktopProxyPath%%";
+   }
+ 
+   private homedir() {
@@ -1,65 +0,0 @@
-{
-  autoPatchelfHook,
-  lib,
-  fetchFromGitHub,
-  flutter324,
-  mpv,
-  makeDesktopItem,
-  copyDesktopItems,
-}:
-
-flutter324.buildFlutterApplication rec {
-  pname = "bloomeetunes";
-  version = "2.11.6";
-
-  src = fetchFromGitHub {
-    owner = "HemantKArya";
-    repo = "BloomeeTunes";
-    tag = "v${version}+171";
-    hash = "sha256-gSAe5S5rdcNLP4v7NTchQj3UJ/h6msLax9H77w+JJnk=";
-  };
-
-  pubspecLock = lib.importJSON ./pubspec.lock.json;
-
-  gitHashes = {
-    youtube_explode_dart = "sha256-ctUSoXLUJCu23hvEzYy5EoTCv7gG79rEiMFX7i1RGX0=";
-  };
-
-  nativeBuildInputs = [
-    autoPatchelfHook
-    copyDesktopItems
-  ];
-
-  desktopItems = [
-    (makeDesktopItem {
-      name = "bloomeetunes";
-      exec = "bloomee";
-      icon = "bloomeetunes";
-      genericName = "Music Player";
-      desktopName = "Bloomee Tunes";
-    })
-  ];
-
-  postInstall = ''
-    install -Dm644 assets/icons/bloomee_new_logo_c.png $out/share/pixmaps/bloomeetunes.png
-  '';
-
-  extraWrapProgramArgs = ''
-    --prefix LD_LIBRARY_PATH : $out/app/bloomeetunes/lib:${
-      lib.makeLibraryPath [
-        mpv
-      ]
-    }
-  '';
-
-  passthru.updateScript = ./update.sh;
-
-  meta = {
-    description = "Cross-platform music app designed to bring you ad-free tunes from various sources";
-    homepage = "https://github.com/HemantKArya/BloomeeTunes";
-    mainProgram = "bloomee";
-    license = with lib.licenses; [ gpl2Plus ];
-    maintainers = with lib.maintainers; [ ];
-    platforms = lib.platforms.linux;
-  };
-}
@@ -1,24 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -I nixpkgs=./. -i bash -p curl gnused jq yq nix bash coreutils common-updater-scripts
-
-set -eou pipefail
-
-ROOT="$(dirname "$(readlink -f "$0")")"
-
-latestTag=$(curl ${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} -sL https://api.github.com/repos/HemantKArya/BloomeeTunes/releases/latest | jq --raw-output .tag_name)
-latestVersion=$(echo "$latestTag" | sed 's/^v//' | grep -o '^[^+]*')
-RunNumber=$(echo "$latestTag" | grep -o '[^+]*$')
-
-currentVersion=$(nix-instantiate --eval -E "with import ./. {}; bloomeetunes.version or (lib.getVersion bloomeetunes)" | tr -d '"')
-
-if [[ "$currentVersion" == "$latestVersion" ]]; then
-    echo "package is up-to-date: $currentVersion"
-    exit 0
-fi
-
-sed -i "s/\(tag = \"v\${version}+\)[0-9]\+/\1${RunNumber}/" "$ROOT/package.nix"
-
-hash=$(nix --extra-experimental-features nix-command hash convert --hash-algo sha256 --to sri $(nix-prefetch-url --unpack "https://github.com/HemantKArya/BloomeeTunes/archive/refs/tags/${latestTag}.tar.gz"))
-update-source-version bloomeetunes $latestVersion $hash
-
-curl https://raw.githubusercontent.com/HemantKArya/BloomeeTunes/${latestTag}/pubspec.lock | yq . >$ROOT/pubspec.lock.json
@@ -0,0 +1,36 @@
+{
+  lib,
+  buildNpmPackage,
+  fetchFromGitHub,
+  hugo,
+}:
+
+buildNpmPackage (finalAttrs: {
+  pname = "blowfish-tools";
+  version = "1.10.0";
+
+  src = fetchFromGitHub {
+    owner = "nunocoracao";
+    repo = "blowfish-tools";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-90EKsRKOO2Hb64Wy3TlwzlPU2K8AAlSxc17ek5ZLoG0=";
+  };
+
+  dontNpmBuild = true;
+
+  npmDepsHash = "sha256-P6XHXR4QcVCRz5ju36OzCTNxXtW9RYxkfhbp7kJVfoY=";
+
+  postFixup = ''
+    wrapProgram $out/bin/blowfish-tools \
+      --prefix PATH : ${lib.makeBinPath [ hugo ]}
+  '';
+
+  meta = {
+    description = "CLI to initialize and configure a Blowfish project";
+    homepage = "https://blowfish.page";
+    changelog = "https://github.com/nunocoracao/blowfish-tools/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ eripa ];
+    mainProgram = "blowfish-tools";
+  };
+})
@@ -48,7 +48,8 @@ python3Packages.buildPythonPackage rec {
  postPatch = ''
    substituteInPlace requirements.txt \
        --replace-fail "psutil==6.1.0" "psutil" \
-        --replace-fail "evdev==1.7.1" "evdev"
+        --replace-fail "evdev==1.7.1" "evdev" \
+        --replace-fail "pycairo==1.27.0" "pycairo"
  '';

  preBuild = ''
@@ -71,6 +71,10 @@ stdenv.mkDerivation rec {
  ]
  ++ lib.optionals (!udevSupport) [
    "--disable-libudev"
+  ]
+  ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+    "ac_cv_func_malloc_0_nonnull=yes"
+    "ac_cv_func_realloc_0_nonnull=yes"
  ];

  makeFlags = [ "udevruledir=$(out)/lib/udev/rules.d" ];
@@ -6,13 +6,13 @@

 buildGoModule rec {
  pname = "cdncheck";
-  version = "1.1.32";
+  version = "1.1.33";

  src = fetchFromGitHub {
    owner = "projectdiscovery";
    repo = "cdncheck";
    tag = "v${version}";
-    hash = "sha256-K2nuReA5rl78qrZ8e7vfR2kuB7CSRJeUILHOE9qIIuE=";
+    hash = "sha256-T00lM/jA0+3z5RViQkzACNyUqsgSzYtdgGwNli+nm7w=";
  };

  vendorHash = "sha256-/1REkZ5+sz/H4T4lXhloz7fu5cLv1GoaD3dlttN+Qd4=";
@@ -6,16 +6,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "choose";
-  version = "1.3.6";
+  version = "1.3.7";

  src = fetchFromGitHub {
    owner = "theryangeary";
    repo = "choose";
    rev = "v${version}";
-    sha256 = "sha256-ojmib9yri/Yj1VSwwssbXv+ThnZjUXLTmOpfPGdGFaU=";
+    sha256 = "sha256-nqL8CAnpqOaecC6vHlCtVXFRO0OAGZAn12TdOM5iUFA=";
  };

-  cargoHash = "sha256-SecWDujJu68K1LMQJQ55LeW51Ag/aCt1YKcdWeRp22c=";
+  cargoHash = "sha256-NVpkCs1QY2e+WiI9nk1uz/j3pOtsJpMwgAMspB6Bs1E=";

  meta = with lib; {
    description = "Human-friendly and fast alternative to cut and (sometimes) awk";
@@ -1,41 +0,0 @@
-{
-  lib,
-  python3,
-  fetchFromGitHub,
-}:
-
-python3.pkgs.buildPythonApplication {
-  pname = "ci-edit";
-  version = "51-unstable-2023-04-11";
-  pyproject = true;
-
-  src = fetchFromGitHub {
-    owner = "google";
-    repo = "ci_edit";
-    # Last build iteration is v51 from 2021, but there are some recent
-    # additions of syntax highlighting and dictionary files.
-    rev = "2976f01dc6421b5639505292b335212d413d044f";
-    hash = "sha256-DwVNNotRcYbvJX6iXffSQyZMFTxQexIhfG8reFmozN8=";
-  };
-
-  nativeBuildInputs = with python3.pkgs; [
-    setuptools
-  ];
-
-  postInstall = ''
-    ln -s $out/bin/ci.py $out/bin/ci_edit
-    ln -s $out/bin/ci.py $out/bin/we
-    install -Dm644 $src/app/*.words $out/${python3.sitePackages}/app/
-  '';
-
-  pythonImportsCheck = [ "app" ];
-
-  meta = with lib; {
-    description = "Terminal text editor with mouse support and ctrl+Q to quit";
-    homepage = "https://github.com/google/ci_edit";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ katexochen ];
-    mainProgram = "ci_edit";
-    platforms = platforms.unix;
-  };
-}
@@ -0,0 +1,44 @@
+{
+  lib,
+  buildDotnetModule,
+  fetchFromGitHub,
+}:
+
+buildDotnetModule rec {
+  pname = "ciderpress2";
+  version = "1.1.0";
+
+  src = fetchFromGitHub {
+    owner = "fadden";
+    repo = "CiderPress2";
+    tag = "v${version}";
+    hash = "sha256-nzCuKCntqYVhjSHljPkY5ziAjYH/qGUqukRPrHzhOzo=";
+  };
+
+  projectFile = [ "cp2/cp2.csproj" ];
+
+  executables = [ "cp2" ];
+
+  patches = [ ./retarget-net8.patch ];
+
+  preBuild = ''
+    # Disable MS telemetry
+    export DOTNET_CLI_TELEMETRY_OPTOUT=1
+    export DOTNET_NOLOGO=1
+  '';
+
+  meta = {
+    description = "File archive utility for Apple II disk images and file archives";
+    longDescription = ''
+      CiderPress 2 is a file archive utility for Apple II disk images and file
+      archives. It can extract files from disk images and file archives, and
+      create new archives.
+    '';
+    homepage = "https://github.com/fadden/CiderPress2";
+    changelog = "https://github.com/fadden/CiderPress2/releases/tag/v${version}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ nulleric ];
+    platforms = lib.platforms.unix;
+    mainProgram = "cp2";
+  };
+}
@@ -0,0 +1,162 @@
+From 4b97c8cc49ee2068198bbfaa7eacb17cf1cf067c Mon Sep 17 00:00:00 2001
+From: Eric Helgeson <erichelgeson@gmail.com>
+Date: Fri, 22 Aug 2025 10:05:56 -0500
+Subject: [PATCH] Retarget to .NET 8
+
+---
+ AppCommon/AppCommon.csproj                | 2 +-
+ CommonUtil/CommonUtil.csproj              | 2 +-
+ DiskArc/DiskArc.csproj                    | 2 +-
+ DiskArcTests/DiskArcTests.csproj          | 2 +-
+ Examples/AddFile/AddFile.csproj           | 2 +-
+ Examples/ListContents/ListContents.csproj | 2 +-
+ FileConv/FileConv.csproj                  | 2 +-
+ FileConvTests/FileConvTests.csproj        | 2 +-
+ MakeDist/MakeDist.csproj                  | 2 +-
+ cp2/cp2.csproj                            | 2 +-
+ cp2_wpf/cp2_wpf.csproj                    | 2 +-
+ 11 files changed, 11 insertions(+), 11 deletions(-)
+
+diff --git a/AppCommon/AppCommon.csproj b/AppCommon/AppCommon.csproj
+index 48e8e5c..1e58dc6 100644
+--- a/AppCommon/AppCommon.csproj
+++ b/AppCommon/AppCommon.csproj
+@@ -1,7 +1,7 @@
+ <Project Sdk="Microsoft.NET.Sdk">
+ 
+   <PropertyGroup>
+-    <TargetFramework>net6.0</TargetFramework>
+    <TargetFramework>net8.0</TargetFramework>
+     <ImplicitUsings>enable</ImplicitUsings>
+     <Nullable>enable</Nullable>
+   </PropertyGroup>
+diff --git a/CommonUtil/CommonUtil.csproj b/CommonUtil/CommonUtil.csproj
+index 132c02c..30402ac 100644
+--- a/CommonUtil/CommonUtil.csproj
+++ b/CommonUtil/CommonUtil.csproj
+@@ -1,7 +1,7 @@
+ <Project Sdk="Microsoft.NET.Sdk">
+ 
+   <PropertyGroup>
+-    <TargetFramework>net6.0</TargetFramework>
+    <TargetFramework>net8.0</TargetFramework>
+     <ImplicitUsings>enable</ImplicitUsings>
+     <Nullable>enable</Nullable>
+   </PropertyGroup>
+diff --git a/DiskArc/DiskArc.csproj b/DiskArc/DiskArc.csproj
+index a1c95f7..cc0baef 100644
+--- a/DiskArc/DiskArc.csproj
+++ b/DiskArc/DiskArc.csproj
+@@ -1,7 +1,7 @@
+ <Project Sdk="Microsoft.NET.Sdk">
+ 
+   <PropertyGroup>
+-    <TargetFramework>net6.0</TargetFramework>
+    <TargetFramework>net8.0</TargetFramework>
+     <ImplicitUsings>enable</ImplicitUsings>
+     <Nullable>enable</Nullable>
+   </PropertyGroup>
+diff --git a/DiskArcTests/DiskArcTests.csproj b/DiskArcTests/DiskArcTests.csproj
+index 521776e..40db439 100644
+--- a/DiskArcTests/DiskArcTests.csproj
+++ b/DiskArcTests/DiskArcTests.csproj
+@@ -1,7 +1,7 @@
+ <Project Sdk="Microsoft.NET.Sdk">
+ 
+   <PropertyGroup>
+-    <TargetFramework>net6.0</TargetFramework>
+    <TargetFramework>net8.0</TargetFramework>
+     <ImplicitUsings>enable</ImplicitUsings>
+     <Nullable>enable</Nullable>
+   </PropertyGroup>
+diff --git a/Examples/AddFile/AddFile.csproj b/Examples/AddFile/AddFile.csproj
+index 09d4137..690e75b 100644
+--- a/Examples/AddFile/AddFile.csproj
+++ b/Examples/AddFile/AddFile.csproj
+@@ -2,7 +2,7 @@
+ 
+   <PropertyGroup>
+     <OutputType>Exe</OutputType>
+-    <TargetFramework>net6.0</TargetFramework>
+    <TargetFramework>net8.0</TargetFramework>
+     <ImplicitUsings>enable</ImplicitUsings>
+     <Nullable>enable</Nullable>
+   </PropertyGroup>
+diff --git a/Examples/ListContents/ListContents.csproj b/Examples/ListContents/ListContents.csproj
+index 1e27d16..ea1a510 100644
+--- a/Examples/ListContents/ListContents.csproj
+++ b/Examples/ListContents/ListContents.csproj
+@@ -2,7 +2,7 @@
+ 
+   <PropertyGroup>
+     <OutputType>Exe</OutputType>
+-    <TargetFramework>net6.0</TargetFramework>
+    <TargetFramework>net8.0</TargetFramework>
+     <ImplicitUsings>enable</ImplicitUsings>
+     <Nullable>enable</Nullable>
+   </PropertyGroup>
+diff --git a/FileConv/FileConv.csproj b/FileConv/FileConv.csproj
+index 4c2e0e7..f44d628 100644
+--- a/FileConv/FileConv.csproj
+++ b/FileConv/FileConv.csproj
+@@ -1,7 +1,7 @@
+ <Project Sdk="Microsoft.NET.Sdk">
+ 
+   <PropertyGroup>
+-    <TargetFramework>net6.0</TargetFramework>
+    <TargetFramework>net8.0</TargetFramework>
+     <ImplicitUsings>enable</ImplicitUsings>
+     <Nullable>enable</Nullable>
+   </PropertyGroup>
+diff --git a/FileConvTests/FileConvTests.csproj b/FileConvTests/FileConvTests.csproj
+index 48e8e5c..1e58dc6 100644
+--- a/FileConvTests/FileConvTests.csproj
+++ b/FileConvTests/FileConvTests.csproj
+@@ -1,7 +1,7 @@
+ <Project Sdk="Microsoft.NET.Sdk">
+ 
+   <PropertyGroup>
+-    <TargetFramework>net6.0</TargetFramework>
+    <TargetFramework>net8.0</TargetFramework>
+     <ImplicitUsings>enable</ImplicitUsings>
+     <Nullable>enable</Nullable>
+   </PropertyGroup>
+diff --git a/MakeDist/MakeDist.csproj b/MakeDist/MakeDist.csproj
+index 7bcab19..69753a9 100644
+--- a/MakeDist/MakeDist.csproj
+++ b/MakeDist/MakeDist.csproj
+@@ -2,7 +2,7 @@
+ 
+   <PropertyGroup>
+     <OutputType>Exe</OutputType>
+-    <TargetFramework>net6.0</TargetFramework>
+    <TargetFramework>net8.0</TargetFramework>
+     <ImplicitUsings>enable</ImplicitUsings>
+     <Nullable>enable</Nullable>
+   </PropertyGroup>
+diff --git a/cp2/cp2.csproj b/cp2/cp2.csproj
+index cdcac51..45234aa 100644
+--- a/cp2/cp2.csproj
+++ b/cp2/cp2.csproj
+@@ -2,7 +2,7 @@
+ 
+   <PropertyGroup>
+     <OutputType>Exe</OutputType>
+-    <TargetFramework>net6.0</TargetFramework>
+    <TargetFramework>net8.0</TargetFramework>
+     <ImplicitUsings>enable</ImplicitUsings>
+     <Nullable>enable</Nullable>
+     <StartupObject>cp2.CP2Main</StartupObject>
+diff --git a/cp2_wpf/cp2_wpf.csproj b/cp2_wpf/cp2_wpf.csproj
+index bdfe5cc..9f5ed90 100644
+--- a/cp2_wpf/cp2_wpf.csproj
+++ b/cp2_wpf/cp2_wpf.csproj
+@@ -2,7 +2,7 @@
+ 
+   <PropertyGroup>
+     <OutputType>WinExe</OutputType>
+-    <TargetFramework>net6.0-windows</TargetFramework>
+    <TargetFramework>net8.0-windows</TargetFramework>
+     <Nullable>enable</Nullable>
+     <UseWPF>true</UseWPF>
+     <AssemblyName>CiderPress2</AssemblyName>
@@ -19,12 +19,12 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "circt";
-  version = "1.125.0";
+  version = "1.128.0";
  src = fetchFromGitHub {
    owner = "llvm";
    repo = "circt";
    rev = "firtool-${version}";
-    hash = "sha256-bpQvBUSYpmv6bmgXSCz9pfGgFxlGVFFDfaSkvk7481E=";
+    hash = "sha256-pIuBIl1iZRuqjy7CPfsTnR82Fq7iH22TtpbSk4oBshQ=";
    fetchSubmodules = true;
  };

@@ -75,6 +75,7 @@ stdenv.mkDerivation rec {
          "CIRCT :: circt-as-dis/.*\\.mlir"
          "CIRCT :: circt-reduce/.*\\.mlir"
          "CIRCT :: circt-test/basic.mlir"
+          "CIRCT :: firld/.*\\.mlir"
        ]
        ++ [
          # Temporarily disable for bump: https://github.com/llvm/circt/issues/8000
@@ -6,13 +6,13 @@
  "packages": {
    "": {
      "dependencies": {
-        "@anthropic-ai/claude-code": "^1.0.90"
+        "@anthropic-ai/claude-code": "^1.0.92"
      }
    },
    "node_modules/@anthropic-ai/claude-code": {
-      "version": "1.0.90",
-      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-1.0.90.tgz",
-      "integrity": "sha512-waC7GC4fnfyiFVFTS7Eo4MAS/iEYpyM67JZFXr+B07bOkjBYtBqXh77+Z/btcyI8NxvUtpnFS0R5FXkU/tKCwg==",
+      "version": "1.0.92",
+      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-1.0.92.tgz",
+      "integrity": "sha512-/XuwJqAvXwIGf9WeZOxHI6qQsAGzxhrRc3hyQdvwW6cU5iviTmrxWasksPbJMvFt6KQoAUU6XHs78XyYmBpOXQ==",
      "license": "SEE LICENSE IN README.md",
      "bin": {
        "claude": "cli.js"
@@ -7,16 +7,16 @@

 buildNpmPackage rec {
  pname = "claude-code";
-  version = "1.0.90";
+  version = "1.0.92";

  nodejs = nodejs_20; # required for sandboxed Nix builds on Darwin

  src = fetchzip {
    url = "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-${version}.tgz";
-    hash = "sha256-dI3nnuN5a8lBsuTVGzEASxqxCKr2KrTpBdEIgk/47Kw=";
+    hash = "sha256-xW+oI91wL+DFaOHw5M84QJktuE9HXb031pGbrNcrpPQ=";
  };

-  npmDepsHash = "sha256-LinE6hbDhvZ5RlkRSzQMC+JbnmocQRosJLo5aP4p3hE=";
+  npmDepsHash = "sha256-rrMskQkWKz+B5dqJ8gHgBxO20OdgE3d53TJWDxeJGbo=";

  postPatch = ''
    cp ${./package-lock.json} package-lock.json
@@ -20,6 +20,7 @@
  jq,
  ripgrep,
  common-updater-scripts,
+  headless ? false,
 }:

 let
@@ -38,7 +39,7 @@ in
 stdenv.mkDerivation rec {
  inherit version;

-  pname = "cloudflare-warp";
+  pname = "cloudflare-warp" + lib.optionalString headless "-headless";

  src =
    sources.${stdenv.hostPlatform.system}
@@ -49,20 +50,24 @@ stdenv.mkDerivation rec {
    autoPatchelfHook
    versionCheckHook
    makeWrapper
+  ]
+  ++ lib.optionals (!headless) [
    copyDesktopItems
    desktop-file-utils
  ];

  buildInputs = [
    dbus
-    gtk3
    libpcap
    openssl
    nss
    (lib.getLib stdenv.cc.cc)
+  ]
+  ++ lib.optionals (!headless) [
+    gtk3
  ];

-  desktopItems = [
+  desktopItems = lib.optionals (!headless) [
    (makeDesktopItem {
      name = "com.cloudflare.WarpCli";
      desktopName = "Cloudflare Zero Trust Team Enrollment";
@@ -93,22 +98,35 @@ stdenv.mkDerivation rec {
    mv lib/systemd/system $out/lib/systemd/
    substituteInPlace $out/lib/systemd/system/warp-svc.service \
      --replace-fail "ExecStart=" "ExecStart=$out"
-    substituteInPlace $out/lib/systemd/user/warp-taskbar.service \
-      --replace-fail "ExecStart=" "ExecStart=$out" \
-      --replace-fail "BindsTo=" "PartOf="
+    ${lib.optionalString (!headless) ''
+      substituteInPlace $out/lib/systemd/user/warp-taskbar.service \
+        --replace-fail "ExecStart=" "ExecStart=$out" \
+        --replace-fail "BindsTo=" "PartOf="

-    cat >>$out/lib/systemd/user/warp-taskbar.service <<EOF
+      cat >>$out/lib/systemd/user/warp-taskbar.service <<EOF

-    [Service]
-    BindReadOnlyPaths=$out:/usr:
-    EOF
+      [Service]
+      BindReadOnlyPaths=$out:/usr:
+      EOF
+    ''}
+    ${lib.optionalString headless ''
+      # For headless version, remove GUI components
+      rm $out/bin/warp-taskbar
+      rm -r $out/lib/systemd/user
+      rm -r $out/etc
+      rm -r $out/share/applications
+      rm -r $out/share/icons
+      rm -r $out/share/warp
+    ''}

    runHook postInstall
  '';

  postInstall = ''
    wrapProgram $out/bin/warp-svc --prefix PATH : ${lib.makeBinPath [ nftables ]}
-    wrapProgram $out/bin/warp-cli --prefix PATH : ${lib.makeBinPath [ desktop-file-utils ]}
+    ${lib.optionalString (!headless) ''
+      wrapProgram $out/bin/warp-cli --prefix PATH : ${lib.makeBinPath [ desktop-file-utils ]}
+    ''}
  '';

  doInstallCheck = true;
@@ -146,7 +164,9 @@ stdenv.mkDerivation rec {
  };

  meta = with lib; {
-    description = "Replaces the connection between your device and the Internet with a modern, optimized, protocol";
+    description =
+      "Replaces the connection between your device and the Internet with a modern, optimized, protocol"
+      + lib.optionalString headless " (headless version)";
    homepage = "https://pkg.cloudflareclient.com/";
    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
    license = licenses.unfree;
@@ -6,18 +6,18 @@

 buildGoModule rec {
  pname = "cnspec";
-  version = "11.68.0";
+  version = "11.69.0";

  src = fetchFromGitHub {
    owner = "mondoohq";
    repo = "cnspec";
    tag = "v${version}";
-    hash = "sha256-OFV6xk8JbdmW0hj6UsrK/KW96kVNSCtzQ75dGLeuJCk=";
+    hash = "sha256-oMGkGZH6k5E/8/WyMOqoB5oQskKd1FZbyQJ9XS+f/G0=";
  };

  proxyVendor = true;

-  vendorHash = "sha256-vVCpA7ete2XPcwSZLmtcmdcc467g+KI5zXbZVjZsur4=";
+  vendorHash = "sha256-7/DjNBpecs65VwaEXnnPunx9phpzSH9p/+Y82XRWJjo=";

  subPackages = [ "apps/cnspec" ];

@@ -16,20 +16,20 @@ let

  sources = {
    x86_64-linux = fetchurl {
-      url = "https://downloads.cursor.com/production/af58d92614edb1f72bdd756615d131bf8dfa5299/linux/x64/Cursor-1.4.5-x86_64.AppImage";
-      hash = "sha256-2Hz1tXC+YkIIHWG1nO3/84oygH+wvaUtTXqvv19ZAz4=";
+      url = "https://downloads.cursor.com/production/823f58d4f60b795a6aefb9955933f3a2f0331d7b/linux/x64/Cursor-1.5.5-x86_64.AppImage";
+      hash = "sha256-eq/AQcAONs6HBpRdx2yf4MFTQ1cm/rOeaZZTq8YUF8s=";
    };
    aarch64-linux = fetchurl {
-      url = "https://downloads.cursor.com/production/af58d92614edb1f72bdd756615d131bf8dfa5299/linux/arm64/Cursor-1.4.5-aarch64.AppImage";
-      hash = "sha256-kKoOSxLsgeM2FJRW2HlCinhz6Ij6lpVsbWxQmTiMBSs=";
+      url = "https://downloads.cursor.com/production/823f58d4f60b795a6aefb9955933f3a2f0331d7b/linux/arm64/Cursor-1.5.5-aarch64.AppImage";
+      hash = "sha256-709MYaAnoYI+k1CPkfVzL0PvrJ4zw4wSHZvbuqLlXMQ=";
    };
    x86_64-darwin = fetchurl {
-      url = "https://downloads.cursor.com/production/af58d92614edb1f72bdd756615d131bf8dfa5299/darwin/x64/Cursor-darwin-x64.dmg";
-      hash = "sha256-fX8ukEWKS2prNz+UopZ9a4uhDLoGYuXa6P8cSJqBang=";
+      url = "https://downloads.cursor.com/production/823f58d4f60b795a6aefb9955933f3a2f0331d7b/darwin/x64/Cursor-darwin-x64.dmg";
+      hash = "sha256-A13mVAw8mgjGlGegAzkeUi536keZwcJZkbO4ZzfMmXs=";
    };
    aarch64-darwin = fetchurl {
-      url = "https://downloads.cursor.com/production/af58d92614edb1f72bdd756615d131bf8dfa5299/darwin/arm64/Cursor-darwin-arm64.dmg";
-      hash = "sha256-J/by3BOoIV2HUtcCqaCEJoPzqcFFooc/zShSmEBSw/Q=";
+      url = "https://downloads.cursor.com/production/823f58d4f60b795a6aefb9955933f3a2f0331d7b/darwin/arm64/Cursor-darwin-arm64.dmg";
+      hash = "sha256-Pc1pG1Vj9bf8H6Gt2bR8JANo/6oZza+L3Zlrihpg1dk=";
    };
  };

@@ -39,7 +39,7 @@ in
  inherit useVSCodeRipgrep;
  commandLineArgs = finalCommandLineArgs;

-  version = "1.4.5";
+  version = "1.5.5";
  pname = "cursor";

  # You can find the current VSCode version in the About dialog:
@@ -8,13 +8,13 @@

 buildGoModule rec {
  pname = "cri-tools";
-  version = "1.33.0";
+  version = "1.34.0";

  src = fetchFromGitHub {
    owner = "kubernetes-sigs";
    repo = "cri-tools";
    rev = "v${version}";
-    hash = "sha256-KxckDpZ3xfD+buCGrQ+udJF0X2D9sg/d3TLSQEcWyV4=";
+    hash = "sha256-nWbxPw8lz1FYLHXJ2G4kzOl5nBPXSl4nEJ9KgzS/wmA=";
  };

  vendorHash = null;
@@ -0,0 +1,67 @@
+{
+  lib,
+  fetchurl,
+  stdenv,
+  autoPatchelfHook,
+}:
+
+let
+  inherit (stdenv) hostPlatform;
+  sources = {
+    x86_64-linux = fetchurl {
+      url = "https://downloads.cursor.com/lab/2025.08.22-82fb571/linux/x64/agent-cli-package.tar.gz";
+      hash = "sha256-jfjYWM9Vuq9sYZcnqiap3TKuVWHHKt/aF7XaVilJjsE=";
+    };
+    aarch64-linux = fetchurl {
+      url = "https://downloads.cursor.com/lab/2025.08.22-82fb571/linux/arm64/agent-cli-package.tar.gz";
+      hash = "sha256-uMK5jO77TQntsrR450WWBj9q5VBowNUhO6UkZ/z1ys4=";
+    };
+    x86_64-darwin = fetchurl {
+      url = "https://downloads.cursor.com/lab/2025.08.22-82fb571/darwin/x64/agent-cli-package.tar.gz";
+      hash = "sha256-gFM+igXGdLLJXVHAou6pRTIVqsg6iPagaghBAzRcPXw=";
+    };
+    aarch64-darwin = fetchurl {
+      url = "https://downloads.cursor.com/lab/2025.08.22-82fb571/darwin/arm64/agent-cli-package.tar.gz";
+      hash = "sha256-XN2QaFt/lbVHfFfdZaznRvUlMWIHq7nUbe3uptrGjN0=";
+    };
+  };
+in
+stdenv.mkDerivation {
+  pname = "cursor-cli";
+  version = "0-unstable-2025-08-22";
+
+  src = sources.${hostPlatform.system};
+
+  nativeBuildInputs = lib.optionals hostPlatform.isLinux [
+    autoPatchelfHook
+    stdenv.cc.cc.lib
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin $out/share/cursor-agent
+    cp -r * $out/share/cursor-agent/
+    ln -s $out/share/cursor-agent/cursor-agent $out/bin/cursor-agent
+
+    runHook postInstall
+  '';
+
+  passthru = {
+    inherit sources;
+    updateScript = ./update.sh;
+  };
+
+  meta = {
+    description = "Cursor CLI";
+    homepage = "https://cursor.com/cli";
+    license = lib.licenses.unfree;
+    maintainers = with lib.maintainers; [
+      sudosubin
+      andrewbastin
+    ];
+    platforms = builtins.attrNames sources;
+    mainProgram = "cursor-agent";
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+  };
+}
@@ -0,0 +1,32 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl coreutils common-updater-scripts
+set -eu -o pipefail
+
+release=$(curl -s https://cursor.com/install | grep -oP "lab/\K[^/]+")
+
+# Check if release matches the pattern YYYY.MM.DD-{commithash}
+if [[ "$release" =~ ^[0-9]{4}\.[0-9]{2}\.[0-9]{2}-[a-f0-9]+$ ]]; then
+  timestamp=$(echo "$release" | cut -d"-" -f1 | tr "." "-")
+  latestVersion="0-unstable-$timestamp"
+else
+  latestVersion="$release"
+fi
+
+currentVersion=$(nix eval --raw -f . cursor-cli.version)
+
+echo "latest  version: $latestVersion"
+echo "current version: $currentVersion"
+
+if [[ "$latestVersion" == "$currentVersion" ]]; then
+  echo "package is up-to-date"
+  exit 0
+fi
+
+declare -A platforms=( [x86_64-linux]="linux/x64" [aarch64-linux]="linux/arm64" [x86_64-darwin]="darwin/x64" [aarch64-darwin]="darwin/arm64" )
+
+for platform in "${!platforms[@]}"; do
+  url="https://downloads.cursor.com/lab/$release/${platforms[$platform]}/agent-cli-package.tar.gz"
+  source=$(nix-prefetch-url "$url" --name "cursor-cli-$latestVersion")
+  hash=$(nix-hash --to-sri --type sha256 "$source")
+  update-source-version cursor-cli "$latestVersion" "$hash" "$url" --system="$platform" --source-key="sources.$platform" --ignore-same-version
+done
@@ -7,14 +7,14 @@

 python3Packages.buildPythonApplication rec {
  pname = "django-upgrade";
-  version = "1.22.2";
+  version = "1.25.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "adamchainz";
    repo = "django-upgrade";
    tag = version;
-    hash = "sha256-QhowVqvN1kODKFLp2uA9CXLWqNJl1p5kC5z4rjRqKNk=";
+    hash = "sha256-Y49GNAc1RFGcjQbZhKzf71KxCcPJT4jPhpjq1HvIBWU=";
  };

  build-system = [ python3Packages.setuptools ];
@@ -33,7 +33,7 @@ python3Packages.buildPythonApplication rec {
  meta = {
    description = "Automatically upgrade your Django projects";
    homepage = "https://github.com/adamchainz/django-upgrade";
-    changelog = "https://github.com/adamchainz/django-upgrade/blob/${version}/CHANGELOG.rst";
+    changelog = "https://github.com/adamchainz/django-upgrade/blob/${version}/docs/changelog.rst";
    mainProgram = "django-upgrade";
    license = lib.licenses.mit;
    maintainers = [ lib.maintainers.kalekseev ];
@@ -9,7 +9,7 @@

 buildGoModule rec {
  pname = "doctl";
-  version = "1.139.0";
+  version = "1.141.0";

  vendorHash = null;

@@ -42,7 +42,7 @@ buildGoModule rec {
    owner = "digitalocean";
    repo = "doctl";
    tag = "v${version}";
-    hash = "sha256-oofG1Fj+1NiDhvSMm0k49K740aUWTrAqH4s/8KsY82o=";
+    hash = "sha256-IZ/CP9xdupwkiOihZuf/MXEP2cnoJ/lqYUEsFDf/ITk=";
  };

  meta = {
@@ -6,18 +6,18 @@

 buildGoModule rec {
  pname = "dolt";
-  version = "1.58.3";
+  version = "1.58.5";

  src = fetchFromGitHub {
    owner = "dolthub";
    repo = "dolt";
    rev = "v${version}";
-    sha256 = "sha256-JQD/qYcVOvjkVPpE7oUxGwCJR5dkVuJpU9fMYT0W7fI=";
+    sha256 = "sha256-ieMAld3wssub+vdNNassjpc3X1KPSNhR6GK/EmIwQ28=";
  };

  modRoot = "./go";
  subPackages = [ "cmd/dolt" ];
-  vendorHash = "sha256-MaqRgGCzWMjoNGPTDQg8xukeYwxnPzds6qd9lIEdi0U=";
+  vendorHash = "sha256-Mr51zbGBnO0sb9KDBiidFpRZk7wHJqbY1fYnXwgqJA8=";
  proxyVendor = true;
  doCheck = false;

@@ -0,0 +1,91 @@
+{
+  fetchFromGitHub,
+  lib,
+  nix-update-script,
+  pkgs,
+  stdenv,
+  # nativeBuildInputs
+  gettext,
+  meson,
+  ninja,
+  pkg-config,
+  python3,
+  sphinx,
+  # buildInputs
+  boost,
+  # nativeCheckInputs
+  bash,
+  coreutils,
+  diffutils,
+  findutils,
+  glibcLocales,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "dtee";
+  version = "1.1.3";
+
+  src = fetchFromGitHub {
+    owner = "nomis";
+    repo = "dtee";
+    tag = finalAttrs.version;
+    hash = "sha256-trREhITO3cY4j75mpudWhOA3GXI0Q8GkUxNq2s6154w=";
+  };
+
+  passthru.updateScript = nix-update-script { };
+
+  # Make "#!/usr/bin/env bash" work in tests
+  postPatch = "patchShebangs tests";
+
+  nativeBuildInputs = [
+    gettext
+    meson
+    ninja
+    pkg-config
+    python3
+    sphinx # For the man page
+  ];
+
+  buildInputs = [ boost ];
+
+  nativeCheckInputs = [
+    bash
+    coreutils
+    diffutils
+    findutils
+    glibcLocales # For tests that check translations work
+  ];
+
+  # Use the correct copyright year on the man page (workaround for https://github.com/sphinx-doc/sphinx/issues/13231)
+  preBuild = ''
+    SOURCE_DATE_EPOCH=$(python3 $NIX_BUILD_TOP/$sourceRoot/release_date.py -e ${finalAttrs.version}) || exit 1
+    export SOURCE_DATE_EPOCH
+  '';
+
+  mesonFlags = [ "--unity on" ];
+  doCheck = true;
+
+  meta = {
+    description = "Run a program with standard output and standard error copied to files";
+    longDescription = ''
+      Run a program with standard output and standard error copied to files
+      while maintaining the original standard output and standard error in
+      the original order. When invoked as "cronty", allows programs to be run
+      from cron, suppressing all output unless the process outputs an error
+      message or has a non-zero exit status whereupon the original output
+      will be written as normal and the exit code will be appended to standard
+      error.
+    '';
+
+    homepage = "https://dtee.readthedocs.io/";
+    downloadPage = "https://github.com/nomis/dtee/releases/tag/${finalAttrs.version}";
+    changelog = "https://dtee.readthedocs.io/en/${finalAttrs.version}/changelog.html";
+
+    license = lib.licenses.gpl3Plus;
+    sourceProvenance = [ lib.sourceTypes.fromSource ];
+    maintainers = with lib.maintainers; [ nomis ];
+    mainProgram = "dtee";
+    # Only Linux has reliable local datagram sockets
+    platforms = lib.platforms.linux;
+  };
+})
@@ -0,0 +1,85 @@
+{
+  stdenv,
+  lib,
+  fetchFromGitHub,
+  cargo,
+  desktop-file-utils,
+  gnome-desktop,
+  meson,
+  ninja,
+  pkg-config,
+  polkit,
+  rustc,
+  rustPlatform,
+  wrapGAppsHook4,
+  gdk-pixbuf,
+  glib,
+  adwaita-icon-theme,
+  gtk4,
+  libadwaita,
+  openssl,
+  nix-update-script,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "e-imzo-manager";
+  version = "0.1.1";
+
+  src = fetchFromGitHub {
+    owner = "xinux-org";
+    repo = "e-imzo";
+    tag = finalAttrs.version;
+    hash = "sha256-uDaqkz2VDvqTgi+k8EGGKjLkjoH93xXHQcgUc1NVo30=";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit (finalAttrs) pname version src;
+    hash = "sha256-rulWG4L/uN6+JBk+SzC0y57Pdw5N0Q1dJlpXGVo+vbQ=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+    cargo
+    rustPlatform.cargoSetupHook
+    rustc
+    desktop-file-utils
+    wrapGAppsHook4
+  ];
+
+  buildInputs = [
+    gdk-pixbuf
+    glib
+    gnome-desktop
+    adwaita-icon-theme
+    gtk4
+    libadwaita
+    openssl
+    rustPlatform.bindgenHook
+    polkit
+  ];
+
+  propagatedUserEnvPkgs = [ polkit ];
+
+  postInstall = ''
+    gappsWrapperArgs+=(
+      --suffix PATH : ${lib.makeBinPath finalAttrs.propagatedUserEnvPkgs}
+    )
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    homepage = "https://github.com/xinux-org/e-imzo";
+    mainProgram = "E-IMZO-Manager";
+    description = "GTK application for managing E-IMZO keys";
+    license = with lib.licenses; [
+      asl20
+      mit
+    ];
+    platforms = lib.platforms.linux;
+    teams = [ lib.teams.uzinfocom ];
+  };
+})
--- a/Show More
+++ b/Show More