Merge staging-next into staging

2026-01-07 18:06:59 +00:00
parent 9e110f8faf 9b3b5e1f5b
commit 1bab15e567
155 changed files with 2786 additions and 1720 deletions
@@ -1,4 +1,4 @@
-Copyright (c) 2003-2025 Eelco Dolstra and the Nixpkgs/NixOS contributors
+Copyright (c) 2003-2026 Eelco Dolstra and the Nixpkgs/NixOS contributors

 Permission is hereby granted, free of charge, to any person obtaining
 a copy of this software and associated documentation files (the
@@ -55,6 +55,8 @@

 - `elegant-sddm` has been updated to be Qt6 compatible. Themes for SDDM are slightly different so read the [wiki](https://wiki.nixos.org/wiki/SDDM_Themes) for more.

+- `n8n` has been updated to version 2. You can find the breaking changes here: https://docs.n8n.io/2-0-breaking-changes/.
+
 - `iroh` has been removed and split up into `iroh-dns-server` and `iroh-relay`.

 - `python3Packages.pygame` has been been renamed to `python3Packages.pygame-original`, the attribute `python3Packages.pygame` will from python 3.14 default to the more actively maintained `python3Packages.pygame-ce`
@@ -102,6 +102,30 @@
              example = "/run/secrets/github-runner/nixos.token";
            };

+            tokenType = lib.mkOption {
+              type = lib.types.enum [
+                "auto"
+                "access"
+                "registration"
+              ];
+              description = ''
+                Type of token to use for runner registration.
+
+                An access token is a personal access token or any other kind of GitHub token that
+                starts with `ghp_`, `gho_`, etc prefix. It is passed as `--pat` to the runner
+                config script.
+
+                A registration token is an unprefixed string generated by the
+                "Add new self-hosted runner" page. It is passed as `--token` to runner config
+                script.
+
+                The default `auto` attempts to detect the token type automatically based on its
+                format.
+              '';
+              example = "registration";
+              default = "auto";
+            };
+
            name = lib.mkOption {
              type = lib.types.nullOr lib.types.str;
              description = ''
@@ -184,14 +184,25 @@
                          ${lib.optionalString cfg.ephemeral "--ephemeral"}
                          ${lib.optionalString cfg.noDefaultLabels "--no-default-labels"}
                        )
-                        # If the token file contains a PAT (i.e., it starts with "ghp_" or "github_pat_"), we have to use the --pat option,
-                        # if it is not a PAT, we assume it contains a registration token and use the --token option
                        token=$(<"${newConfigTokenPath}")
-                        if [[ "$token" =~ ^ghp_* ]] || [[ "$token" =~ ^github_pat_* ]]; then
+                        case ${cfg.tokenType} in
+                        access)
                          args+=(--pat "$token")
-                        else
+                          ;;
+                        registration)
                          args+=(--token "$token")
-                        fi
+                          ;;
+                        auto)
+                          # If the token file contains a PAT (i.e., it starts with "ghp_" or "github_pat_"),
+                          # we have to use the --pat option, if it is not a PAT, we assume it contains a
+                          # registration token and use the --token option
+                          if [[ "$token" =~ ^gh[a-z]+_* ]] || [[ "$token" =~ ^github_pat_* ]]; then
+                            args+=(--pat "$token")
+                          else
+                            args+=(--token "$token")
+                          fi
+                          ;;
+                        esac
                        ${cfg.package}/bin/Runner.Listener configure "''${args[@]}"
                        # Move the automatically created _diag dir to the logs dir
                        mkdir -p  "$STATE_DIRECTORY/_diag"
@@ -12,12 +12,12 @@
  pkgs,
 }:
 let
-  version = "0.0.27-unstable-2025-12-30";
+  version = "0.0.27-unstable-2026-01-04";
  src = fetchFromGitHub {
    owner = "yetone";
    repo = "avante.nvim";
-    rev = "7a9fbbd4ddc9affc6a33bff644b1af7c0f908e74";
-    hash = "sha256-YpNNd9x6GFeWLxaShL6+g1Z29wUM/aJKZQ24/twXvAU=";
+    rev = "a27b821cc1f9fec70d7b7dc4a42c6dbd76266997";
+    hash = "sha256-Hm1Zr10xH9B4GzRyCKI/qsbhkJCD69qo8gC+Njna/5w=";
  };
  avante-nvim-lib = rustPlatform.buildRustPackage {
    pname = "avante-nvim-lib";
@@ -2769,7 +2769,7 @@ assertNoAdditions {
  };

  nvim-treesitter-textobjects = super.nvim-treesitter-textobjects.overrideAttrs {
-    dependencies = [ self.nvim-treesitter-legacy ];
+    dependencies = [ self.nvim-treesitter ];
  };

  nvim-treesitter-textsubjects = super.nvim-treesitter-textsubjects.overrideAttrs {
@@ -13,7 +13,7 @@ vscode-utils.buildVscodeMarketplaceExtension {
    name = "harper";
    publisher = "elijah-potter";
    version = harper.version;
-    hash = "sha256-khsOlVP9RyC4wYQjl+q0wEhBoPelbhchKwa1wie8Jl4=";
+    hash = "sha256-6aR9A2hZMtIIiaJinWUSyJBGAt4Dd9C+r70K6W4K3DA";
  };

  nativeBuildInputs = [
@@ -18,6 +18,7 @@ for i in \
    "x86_64-linux linux-x64 tar.gz" \
    "aarch64-linux linux-arm64 tar.gz" \
    "armv7l-linux linux-armhf tar.gz" \
+    "loongarch64-linux linux-loong64 tar.gz" \
    "aarch64-darwin darwin-arm64 zip" \
    "x86_64-darwin darwin-x64 zip"; do
    set -- $i
@@ -19,6 +19,7 @@ let
      aarch64-linux = "linux-arm64";
      aarch64-darwin = "darwin-arm64";
      armv7l-linux = "linux-armhf";
+      loongarch64-linux = "linux-loong64";
    }
    .${system} or throwSystem;

@@ -31,6 +32,7 @@ let
      aarch64-linux = "sha256-32WP74IJYVIKuhmsMi0EFqjTlWAO4DgC24ptm3BqSpg=";
      aarch64-darwin = "sha256-2hYTrkCNzVy6wXT+cGWkDEAy+g/KSkWsLltMSuSSBTk=";
      armv7l-linux = "sha256-bNjc91zjVXnQ763GHmlVTNDD5ynlJhrtGR7Xzciq7tA=";
+      loongarch64-linux = "sha256-RaxzbawVYT1V0u+RU0gaWTrn2X3uRxEO9T8IAmPJTds=";
    }
    .${system} or throwSystem;

@@ -89,6 +91,7 @@ callPackage ./generic.nix rec {
      "aarch64-linux"
      "aarch64-darwin"
      "armv7l-linux"
+      "loongarch64-linux"
    ];
    # requires libc.so.6 and other glibc specifics
    broken = stdenv.hostPlatform.isLinux && !stdenv.hostPlatform.isGnu;
@@ -38,14 +38,14 @@
 }:

 stdenv.mkDerivation (finalAttrs: {
-  version = "2.0.5";
+  version = "2.0.6";
  pname = "syncthingtray";

  src = fetchFromGitHub {
    owner = "Martchus";
    repo = "syncthingtray";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-a2pYQCpcF4nIr2HaU+29umiTdXN2P//+a9SZ7pG55lo=";
+    hash = "sha256-ie4NCeOsVEXzg0qM06D5dZhtwx3UT9BghH4fP0B9oIY=";
  };

  buildInputs = [
@@ -146,28 +146,26 @@ let

      # The recursiveUpdate below breaks default meta.position, so manually override it.
      pos = __curPos;
-      meta =
-        with lib;
-        recursiveUpdate {
-          homepage = "https://hadoop.apache.org/";
-          description = "Framework for distributed processing of large data sets across clusters of computers";
-          license = lib.licenses.asl20;
-          sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
+      meta = lib.recursiveUpdate {
+        homepage = "https://hadoop.apache.org/";
+        description = "Framework for distributed processing of large data sets across clusters of computers";
+        license = lib.licenses.asl20;
+        sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];

-          longDescription = ''
-            The Apache Hadoop software library is a framework that allows for
-            the distributed processing of large data sets across clusters of
-            computers using a simple programming model. It is designed to
-            scale up from single servers to thousands of machines, each
-            offering local computation and storage. Rather than rely on
-            hardware to deliver high-avaiability, the library itself is
-            designed to detect and handle failures at the application layer,
-            so delivering a highly-availabile service on top of a cluster of
-            computers, each of which may be prone to failures.
-          '';
-          maintainers = with lib.maintainers; [ illustris ];
-          platforms = attrNames platformAttrs;
-        } (attrByPath [ stdenv.system "meta" ] { } platformAttrs);
+        longDescription = ''
+          The Apache Hadoop software library is a framework that allows for
+          the distributed processing of large data sets across clusters of
+          computers using a simple programming model. It is designed to
+          scale up from single servers to thousands of machines, each
+          offering local computation and storage. Rather than rely on
+          hardware to deliver high-avaiability, the library itself is
+          designed to detect and handle failures at the application layer,
+          so delivering a highly-availabile service on top of a cluster of
+          computers, each of which may be prone to failures.
+        '';
+        maintainers = with lib.maintainers; [ illustris ];
+        platforms = lib.attrNames platformAttrs;
+      } (lib.attrByPath [ stdenv.system "meta" ] { } platformAttrs);
    });
 in
 {
@@ -109,7 +109,7 @@ openvpn.overrideAttrs (
    meta = oldAttrs.meta or { } // {
      description = "OpenVPN with Mullvad-specific patches applied";
      homepage = "https://github.com/mullvad/openvpn";
-      maintainers = with lib; [ maintainers.cole-h ];
+      maintainers = with lib.maintainers; [ cole-h ];
    };
  }
 )
@@ -1,5 +1,6 @@
 {
  fetchFromGitHub,
+  fetchpatch,
  fetchPypi,
  python3,
 }:
@@ -8,12 +9,12 @@ let
  python = python3.override {
    self = python;
    packageOverrides = pySelf: pySuper: {
-      connexion = pySuper.connexion.overridePythonAttrs (o: rec {
+      connexion = pySuper.connexion.overridePythonAttrs rec {
        version = "2.14.2";
        src = fetchFromGitHub {
          owner = "spec-first";
          repo = "connexion";
-          rev = "refs/tags/${version}";
+          tag = version;
          hash = "sha256-1v1xCHY3ZnZG/Vu9wN/it7rLKC/StoDefoMNs+hMjIs=";
        };
        nativeBuildInputs = with pySelf; [
@@ -40,15 +41,44 @@ let
          aiohttp-remotes
          decorator
          pytest-aiohttp
+          pytest-tornasync
          pytestCheckHook
          testfixtures
        ];
        disabledTests = [
+          "test_aiohttp_simple_api"
          "test_app"
+          "test_invalid_type" # https://github.com/spec-first/connexion/issues/1969
          "test_openapi_yaml_behind_proxy"
+          "test_run_with_wsgi_containers"
          "test_swagger_ui"
        ];
-      });
+        postPatch = ''
+          substituteInPlace connexion/__init__.py \
+            --replace "2020.0.dev1" "${version}"
+        '';
+      };
+      werkzeug = pySuper.werkzeug.overridePythonAttrs rec {
+        version = "2.3.8";
+        src = fetchPypi {
+          pname = "werkzeug";
+          inherit version;
+          hash = "sha256-VUslfHS763oNJUFgpPj/4YUkP1KlIDUGC3Ycpi2XfwM=";
+        };
+        nativeCheckInputs = with pySelf; [
+          pytest-xprocess
+        ];
+      };
+      # flask's test-suite needs click 8.1.8
+      #   TypeError: CliRunner.__init__() got an unexpected keyword argument 'mix_stderr'
+      click = pySuper.click.overridePythonAttrs rec {
+        version = "8.1.8";
+        src = fetchPypi {
+          pname = "click";
+          inherit version;
+          hash = "sha256-7VPJ2JkNg8Kifermjk7jN0c/YzDAQKMdQiXJV00WCWo=";
+        };
+      };
      flask = pySuper.flask.overridePythonAttrs (o: rec {
        version = "2.2.5";
        src = fetchPypi {
@@ -59,22 +89,67 @@ let
        nativeBuildInputs = (o.nativeBuildInputs or [ ]) ++ [
          pySelf.setuptools
        ];
+        pytestFlagsArray = [
+          # tests that are marked with filterwarnings fail with
+          # DeprecationWarning: 'pkgutil.get_loader' is deprecated and slated for
+          # removal in Python 3.14; use importlib.util.find_spec() instead
+          "-W ignore::DeprecationWarning"
+        ];
      });
+      flask-login = pySuper.flask-login.overridePythonAttrs rec {
+        version = "0.6.3";
+        src = fetchFromGitHub {
+          owner = "maxcountryman";
+          repo = "flask-login";
+          tag = version;
+          hash = "sha256-Sn7Ond67P/3+OmKKFE/KfA6FE4IajhiRXVVrXKJtY3I=";
+        };
+        nativeBuildInputs = with pySelf; [ setuptools ];
+        pytestFlagsArray = [
+          # DeprecationWarning: datetime.datetime.utcnow() is deprecated
+          # and scheduled for removal in a future version.
+          # Use timezone-aware objects to represent datetimes in UTC:
+          # datetime.datetime.now(datetime.UTC).
+          "-W ignore::DeprecationWarning"
+        ];
+      };
+      flask-session = pySuper.flask-session.overridePythonAttrs rec {
+        version = "0.5.0";
+        src = fetchFromGitHub {
+          owner = "palletc-eco";
+          repo = "flask-session";
+          tag = version;
+          hash = "sha256-t8w6ZS4gBDpnnKvL3DLtn+rRLQNJbrT2Hxm4f3+a3Xc=";
+        };
+        nativeCheckInputs = with pySelf; [ pytestCheckHook ];
+        pytestFlagsArray = [
+          "-k"
+          "'null_session or filesystem_session'"
+        ];
+        dependencies = with pySelf; [
+          flask-sqlalchemy
+          cachelib
+        ];
+        disabledTests = [ ];
+        disabledTestPaths = [ ];
+        preCheck = "";
+        postCheck = "";
+      };
      # flask-appbuilder doesn't work with sqlalchemy 2.x, flask-appbuilder 3.x
      # https://github.com/dpgaspar/Flask-AppBuilder/issues/2038
-      flask-appbuilder = pySuper.flask-appbuilder.overridePythonAttrs (o: {
+      flask-appbuilder = pySuper.flask-appbuilder.overridePythonAttrs {
        meta.broken = false;
-      });
+      };
      # a knock-on effect from overriding the sqlalchemy version
-      flask-sqlalchemy = pySuper.flask-sqlalchemy.overridePythonAttrs (o: {
+      flask-sqlalchemy = pySuper.flask-sqlalchemy.overridePythonAttrs {
        src = fetchPypi {
          pname = "Flask-SQLAlchemy";
          version = "2.5.1";
          hash = "sha256-K9pEtD58rLFdTgX/PMH4vJeTbMRkYjQkECv8LDXpWRI=";
        };
        format = "setuptools";
-      });
-      httpcore = pySuper.httpcore.overridePythonAttrs (o: {
+      };
+      httpcore = pySuper.httpcore.overridePythonAttrs {
        # nullify upstream's pytest flags which cause
        # "TLS/SSL connection has been closed (EOF)"
        # with pytest-httpbin 1.x
@@ -82,20 +157,121 @@ let
          substituteInPlace pyproject.toml \
            --replace '[tool.pytest.ini_options]' '[tool.notpytest.ini_options]'
        '';
-      });
-      pytest-httpbin = pySuper.pytest-httpbin.overridePythonAttrs (o: rec {
+      };
+      pytest-httpbin = pySuper.pytest-httpbin.overridePythonAttrs rec {
        version = "1.0.2";
        src = fetchFromGitHub {
          owner = "kevin1024";
          repo = "pytest-httpbin";
-          rev = "refs/tags/v${version}";
+          tag = "v${version}";
          hash = "sha256-S4ThQx4H3UlKhunJo35esPClZiEn7gX/Qwo4kE1QMTI=";
        };
-      });
+        # Use unmerged PR #65 to fix older version:
+        #   https://github.com/kevin1024/pytest-httpbin/pull/65/
+        # It was closed in favour of another which isn't compatible with the overriden version.
+        patches = [
+          (fetchpatch {
+            url = "https://github.com/kevin1024/pytest-httpbin/commit/4e325f877ff8f77dec9f380bd8e53bb42976775c.patch";
+            hash = "sha256-a33XcdMupD+7ZzvUibePdldGImmPLDNU2sxRbwpveDA=";
+          })
+          (fetchpatch {
+            url = "https://github.com/kevin1024/pytest-httpbin/commit/463afb9b200563ac6fe7ae535f7a7a3c818b0418.patch";
+            hash = "sha256-HFmuLtAtEjnB6heSG1YNnqxtz2phXNkHbQaZyB5bLJs=";
+          })
+        ];
+        disabledTests = [
+          "test_httpbin_secure_accepts_get_requests"
+          "test_httpbin_secure_accepts_lots_of_get_requests"
+          "test_httpbin_both[https]"
+          "test_chunked_encoding[https]"
+          "TestClassBassedTests::test_http_secure"
+          "test_dont_crash_on_certificate_problems"
+          "test_redirect_location_is_https_for_secure_server"
+          "test_httpbin_secure_accepts_get_requests"
+          "test_http_secure"
+        ];
+      };
      # apache-airflow doesn't work with sqlalchemy 2.x
      # https://github.com/apache/airflow/issues/28723
      sqlalchemy = pySuper.sqlalchemy_1_4;
-
+      gitpython = pySuper.gitpython.overridePythonAttrs rec {
+        version = "3.1.44";
+        src = fetchFromGitHub {
+          owner = "gitpython-developers";
+          repo = "gitpython";
+          rev = version;
+          hash = "sha256-KnKaBv/tKk4wiGWUWCEgd1vgrTouwUhqxJ1/nMjRaWk=";
+        };
+      };
+      # ValueError: Unknown classifier in field `project.classifiers`: Programming Language :: Python :: Free Threading :: 2 - Beta
+      urllib3 = pySuper.urllib3.overridePythonAttrs rec {
+        version = "2.5.0";
+        src = fetchPypi {
+          pname = "urllib3";
+          inherit version;
+          hash = "sha256-P8R3M8fkGdS8P2s9wrT4kLt0OQajDVa6Slv6S7/5J2A=";
+        };
+        postPatch = ''
+          substituteInPlace pyproject.toml \
+            --replace-fail ', "setuptools-scm>=8,<9"' ""
+        '';
+      };
+      smmap = pySuper.smmap.overridePythonAttrs rec {
+        version = "5.0.2";
+        src = fetchFromGitHub {
+          owner = "gitpython-developers";
+          repo = "smmap";
+          rev = "refs/tags/v${version}";
+          hash = "sha256-0Y175kjv/8UJpSxtLpWH4/VT7JrcVPAq79Nf3rtHZZM=";
+        };
+      };
+      trove-classifiers = pySuper.trove-classifiers.overridePythonAttrs rec {
+        version = "2024.10.21.16";
+        src = fetchPypi {
+          pname = "trove_classifiers";
+          inherit version;
+          hash = "sha256-F8vQVdZ9Xp2d5jKTqHMpQ/q8IVdOTHt07fEStJKM9fM=";
+        };
+        postPatch = "";
+      };
+      packaging = pySuper.packaging.overridePythonAttrs rec {
+        version = "24.2";
+        src = fetchPypi {
+          pname = "packaging";
+          inherit version;
+          hash = "sha256-wiim3F6TLTRrxXOTeRCdSeiFPdgiNXHHxbVSYO3AuX8=";
+        };
+      };
+      pluggy = pySuper.pluggy.overridePythonAttrs rec {
+        version = "1.5.0";
+        src = fetchFromGitHub {
+          owner = "pytest-dev";
+          repo = "pluggy";
+          tag = version;
+          hash = "sha256-f0DxyZZk6RoYtOEXLACcsOn2B+Hot4U4g5Ogr/hKmOE=";
+        };
+      };
+      pyproject-api = pySuper.pyproject-api.overridePythonAttrs rec {
+        version = "1.8.0";
+        src = fetchPypi {
+          pname = "pyproject_api";
+          inherit version;
+          hash = "sha256-d7gEny/rXTPu/MIbV/HieWNid6isita1hxA3skN3hJY=";
+        };
+        disabledTests = [
+          # AssertionError: assert ['magic>3', 'requests>2'] == ['magic >3', 'requests >2']
+          "test_frontend_setuptools"
+        ];
+      };
+      tox = pySuper.tox.overridePythonAttrs rec {
+        version = "4.27.0";
+        src = fetchFromGitHub {
+          owner = "tox-dev";
+          repo = "tox";
+          tag = version;
+          hash = "sha256-Z3qUK4w1ebPvdZD4ZuKgZXJPUu5lG0G41vn/pc9gC/0=";
+        };
+      };
      apache-airflow = pySelf.callPackage ./python-package.nix { };
    };
  };
@@ -1,96 +1,72 @@
 {
  lib,
  stdenv,
-  python,
-  buildPythonPackage,
  fetchFromGitHub,
+  writeScript,
+
+  # javascript
+  fetchYarnDeps,
+  nodejs,
+  webpack-cli,
+  yarnBuildHook,
+  yarnConfigHook,
+
+  # python
  alembic,
  argcomplete,
-  asgiref,
-  attrs,
-  blinker,
-  cached-property,
-  cattrs,
-  clickclick,
+  buildPythonPackage,
  colorlog,
  configupdater,
  connexion,
  cron-descriptor,
  croniter,
  cryptography,
-  deprecated,
  dill,
-  flask,
-  flask-login,
-  flask-appbuilder,
  flask-caching,
+  flask-login,
  flask-session,
-  flask-wtf,
+  fsspec,
+  gitdb,
  gitpython,
-  google-re2,
-  graphviz,
  gunicorn,
-  httpx,
-  iso8601,
-  importlib-resources,
-  importlib-metadata,
-  inflection,
-  itsdangerous,
-  jinja2,
-  jsonschema,
+  hatchling,
  lazy-object-proxy,
  linkify-it-py,
  lockfile,
-  markdown,
-  markupsafe,
  marshmallow-oneofschema,
  mdit-py-plugins,
-  numpy,
-  openapi-spec-validator,
+  methodtools,
  opentelemetry-api,
  opentelemetry-exporter-otlp,
+  packaging,
  pandas,
  pathspec,
  pendulum,
+  pluggy,
  psutil,
-  pydantic,
-  pygments,
-  pyjwt,
+  pytest-asyncio,
+  pytestCheckHook,
+  python,
  python-daemon,
-  python-dateutil,
  python-nvd3,
  python-slugify,
-  python3-openid,
-  pythonOlder,
-  pyyaml,
-  rich,
  rich-argparse,
  setproctitle,
+  smmap,
  sqlalchemy,
  sqlalchemy-jsonfield,
-  swagger-ui-bundle,
  tabulate,
  tenacity,
  termcolor,
-  typing-extensions,
-  unicodecsv,
-  werkzeug,
-  freezegun,
-  pytest-asyncio,
-  pytestCheckHook,
-  time-machine,
-  yarnConfigHook,
-  yarnBuildHook,
-  nodejs,
-  webpack-cli,
-  fetchYarnDeps,
-  writeScript,
+  tomli,
+  trove-classifiers,
+  universal-pathlib,

  # Extra airflow providers to enable
  enabledProviders ? [ ],
 }:
 let
-  version = "2.7.3";
+  version = "2.10.5";

  airflow-src = fetchFromGitHub {
    owner = "apache";
@@ -99,7 +75,7 @@ let
    # Download using the git protocol rather than using tarballs, because the
    # GitHub archive tarballs don't appear to include tests
    forceFetchGit = true;
-    hash = "sha256-+YbiKFZLigSDbHPaUKIl97kpezW1rIt/j09MMa6lwhQ=";
+    hash = "sha256-q5/CM+puXE31+15F3yZmcrR74LrqHppdCDUqjLQXPfk=";
  };

  # airflow bundles a web interface, which is built using webpack by an undocumented shell script in airflow's source tree.
@@ -112,7 +88,7 @@ let

    offlineCache = fetchYarnDeps {
      yarnLock = "${src}/yarn.lock";
-      hash = "sha256-WQKuQgNp35fU6z7owequXOSwoUGJDJYcUgkjPDMOops=";
+      hash = "sha256-hKgtMH4c8sPRDLPLVn+H8rmwc2Q6ei6U4er6fGuFn4I=";
    };

    nativeBuildInputs = [
@@ -122,10 +98,10 @@ let
      webpack-cli
    ];

-    # The webpack license plugin tries to create /licenses when given the
+    # The webpack license plugin tries to create /3rd-party-licenses when given the
    # original relative path
    postPatch = ''
-      sed -i 's!../../../../licenses/LICENSES-ui.txt!licenses/LICENSES-ui.txt!' webpack.config.js
+      sed -i 's!../../../../3rd-party-licenses/LICENSES-ui.txt!/3rd-party-licenses/LICENSES-ui.txt!' webpack.config.js
    '';

    postBuild = ''
@@ -138,129 +114,165 @@ let
    '';
  };

+  requiredProviders = [
+    "common_compat"
+    "common_io"
+    "common_sql"
+    "fab"
+    "ftp"
+    "http"
+    "imap"
+    "smtp"
+    "sqlite"
+  ];
+
  # Import generated file with metadata for provider dependencies and imports.
  # Enable additional providers using enabledProviders above.
  providers = import ./providers.nix;
+  getProviderPath = provider: lib.replaceStrings [ "_" ] [ "/" ] provider;
  getProviderDeps = provider: map (dep: python.pkgs.${dep}) providers.${provider}.deps;
  getProviderImports = provider: providers.${provider}.imports;
-  providerDependencies = lib.concatMap getProviderDeps enabledProviders;
  providerImports = lib.concatMap getProviderImports enabledProviders;
+
+  buildProvider =
+    provider:
+    let
+      providerPath = getProviderPath provider;
+    in
+    python.pkgs.buildPythonPackage {
+      pname = "apache-airflow-providers-${provider}";
+      version = "unstable"; # will be extracted in the build phase
+      pyproject = false; # providers packages don't have pyproject.toml nor setup.py
+
+      src = airflow-src;
+
+      propagatedBuildInputs = getProviderDeps provider;
+      dependencies = [ packaging ];
+
+      buildPhase = ''
+        # extract version from the provider's __init__.py file
+        if [ -f "airflow/providers/${providerPath}/__init__.py" ]; then
+          version=$(grep -oP "(?<=__version__ = ')[^']+" "airflow/providers/${providerPath}/__init__.py" || echo "0.0.0")
+          echo "Provider ${provider} version: $version"
+        else
+          echo "Error: __init__.py not found for provider ${provider} at path airflow/providers/${providerPath}"
+          exit 1
+        fi
+      '';
+
+      installPhase = ''
+                      # create directory structure
+                      mkdir -p $out/${python.sitePackages}/airflow/providers
+
+                      # copy the provider directory
+                      if [ -d "airflow/providers/${providerPath}" ]; then
+                        mkdir -p $out/${python.sitePackages}/airflow/providers/$(dirname "${providerPath}")
+                        cp -r airflow/providers/${providerPath} $out/${python.sitePackages}/airflow/providers/$(dirname "${providerPath}")
+
+                        # create parent __init__.py files
+                        touch $out/${python.sitePackages}/airflow/__init__.py
+                        touch $out/${python.sitePackages}/airflow/providers/__init__.py
+
+                        # create any needed intermediate __init__.py files for nested providers
+                        providerDir=$(dirname "${providerPath}")
+                        while [ "$providerDir" != "." ] && [ -n "$providerDir" ]; do
+                          mkdir -p $out/${python.sitePackages}/airflow/providers/$providerDir
+                          touch $out/${python.sitePackages}/airflow/providers/$providerDir/__init__.py
+                          providerDir=$(dirname "$providerDir")
+                        done
+
+                        # create egg-info for package discovery
+                        mkdir -p $out/${python.sitePackages}/apache_airflow_providers_${provider}.egg-info
+                        cat > $out/${python.sitePackages}/apache_airflow_providers_${provider}.egg-info/PKG-INFO <<EOF
+        Metadata-Version: 2.1
+        Name: apache-airflow-providers-${lib.replaceStrings [ "_" ] [ "-" ] provider}
+        Version: ${version}
+        Summary: Apache Airflow Provider for ${provider}
+        EOF
+                      else
+                        echo "Provider directory not found: airflow/providers/${providerPath}"
+                        exit 1
+                      fi
+      '';
+    };
+
+  providerPackages = map buildProvider (requiredProviders ++ enabledProviders);
+
 in
 buildPythonPackage rec {
  pname = "apache-airflow";
  inherit version;
-  format = "setuptools";
  src = airflow-src;
+  pyproject = true;

-  disabled = pythonOlder "3.7";
+  nativeBuildInputs = [ hatchling ];

-  propagatedBuildInputs = [
+  dependencies = [
    alembic
    argcomplete
-    asgiref
-    attrs
-    blinker
-    cached-property
-    cattrs
-    clickclick
    colorlog
    configupdater
    connexion
    cron-descriptor
    croniter
    cryptography
-    deprecated
    dill
-    flask
-    flask-appbuilder
    flask-caching
-    flask-session
-    flask-wtf
    flask-login
+    flask-session
+    fsspec
+    gitdb
    gitpython
-    google-re2
-    graphviz
    gunicorn
-    httpx
-    iso8601
-    importlib-resources
-    inflection
-    itsdangerous
-    jinja2
-    jsonschema
    lazy-object-proxy
    linkify-it-py
    lockfile
-    markdown
-    markupsafe
-    marshmallow-oneofschema
    mdit-py-plugins
-    numpy
-    openapi-spec-validator
+    methodtools
    opentelemetry-api
    opentelemetry-exporter-otlp
+    packaging
    pandas
    pathspec
    pendulum
+    pluggy
    psutil
-    pydantic
-    pygments
-    pyjwt
    python-daemon
-    python-dateutil
    python-nvd3
    python-slugify
-    python3-openid
-    pyyaml
-    rich
    rich-argparse
    setproctitle
+    smmap
    sqlalchemy
    sqlalchemy-jsonfield
-    swagger-ui-bundle
    tabulate
    tenacity
    termcolor
-    typing-extensions
-    unicodecsv
-    werkzeug
+    tomli
+    trove-classifiers
+    universal-pathlib
  ]
-  ++ lib.optionals (pythonOlder "3.9") [
-    importlib-metadata
-  ]
-  ++ providerDependencies;
-
-  buildInputs = [
-    airflow-frontend
-  ];
+  ++ providerPackages;

  nativeCheckInputs = [
-    freezegun
    pytest-asyncio
    pytestCheckHook
-    time-machine
+    marshmallow-oneofschema
  ];

-  # By default, source code of providers is included but unusable due to missing
-  # transitive dependencies. To enable a provider, add it to extraProviders
-  # above
-  INSTALL_PROVIDERS_FROM_SOURCES = "true";
+  checkPhase = ''
+    export PYTEST_ADDOPTS="--asyncio_default_fixture_loop_scope=cache"
+  '';

  postPatch = ''
-    # https://github.com/apache/airflow/issues/33854
    substituteInPlace pyproject.toml \
-      --replace '[project]' $'[project]\nname = "apache-airflow"\nversion = "${version}"'
-  ''
-  + lib.optionalString stdenv.hostPlatform.isDarwin ''
-    # Fix failing test on Hydra
-    substituteInPlace airflow/utils/db.py \
-      --replace "/tmp/sqlite_default.db" "$TMPDIR/sqlite_default.db"
+      --replace-fail "hatchling==1.27.0" "hatchling" \
+      --replace-fail "\"/airflow/providers/\"," ""
  '';

  pythonRelaxDeps = [
+    "apache-airflow-providers-fab" # fab provider package has wrong version
    "colorlog"
-    "flask-appbuilder"
-    "opentelemetry-api"
    "pathspec"
  ];

@@ -285,10 +297,6 @@ buildPythonPackage rec {
    export AIRFLOW__CORE__UNIT_TEST_MODE=True
    export AIRFLOW_DB="$HOME/airflow.db"
    export PATH=$PATH:$out/bin
-
-    airflow version
-    airflow db init
-    airflow db reset -y
  '';

  enabledTestPaths = [
@@ -325,25 +333,22 @@ buildPythonPackage rec {
  # You can (manually) test the web UI as follows:
  #
  #   nix shell .#apache-airflow
+  #   airflow version
  #   airflow db reset  # WARNING: this will wipe any existing db state you might have!
-  #   airflow db init
  #   airflow standalone
  #
  # Then navigate to the localhost URL using the credentials printed, try
-  # triggering the 'example_bash_operator' and 'example_bash_operator' DAGs and
-  # see if they report success.
+  # triggering the 'example_bash_operator' DAG and see if it reports success.

  meta = {
    description = "Programmatically author, schedule and monitor data pipelines";
    homepage = "https://airflow.apache.org/";
+    changelog = "https://airflow.apache.org/docs/apache-airflow/${version}/release_notes.html";
    license = lib.licenses.asl20;
    maintainers = with lib.maintainers; [
      gbpdt
      ingenieroariel
-    ];
-    knownVulnerabilities = [
-      "CVE-2023-50943"
-      "CVE-2023-50944"
+      taranarmo
    ];
  };
 }
@@ -33,7 +33,7 @@ EXTRA_REQS = {


 def get_version():
-    with open(os.path.dirname(sys.argv[0]) + "/default.nix") as fh:
+    with open(os.path.dirname(sys.argv[0]) + "/python-package.nix") as fh:
        # A version consists of digits, dots, and possibly a "b" (for beta)
        m = re.search('version = "([\\d\\.b]+)";', fh.read())
        return m.group(1)
@@ -47,7 +47,7 @@ def get_file_from_github(version: str, path: str):


 def repository_root() -> Path:
-    return Path(os.path.dirname(sys.argv[0])) / "../../.."
+    return Path(os.path.dirname(sys.argv[0])) / "../../../.."


 def dump_packages() -> Dict[str, Dict[str, str]]:
@@ -8,7 +8,7 @@
  bash,
  chromedriver,
  nodejs_24,
-  python312,
+  python3,
  makeWrapper,
 }:

@@ -202,7 +202,7 @@ let
    ];
  };

-  python = python312.override {
+  python = python3.override {
    self = python;
    packageOverrides = final: prev: {
      # https://github.com/goauthentik/authentik/pull/16324
@@ -6,12 +6,12 @@

 python3Packages.buildPythonApplication rec {
  pname = "bikeshed";
-  version = "7.0.6";
+  version = "7.0.7";
  pyproject = true;

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-0lO5TlAnUMtJp81XQEXpxt3yBz3zx6ff+vO/LYJfFZA=";
+    hash = "sha256-s+NHSOHqJl89/sB5b3SWS+dT7WpsSv9tedoOfuDA2ls=";
  };

  patches = [ ./remove-install-check.patch ];
@@ -8,16 +8,16 @@

 php83.buildComposerProject2 (finalAttrs: {
  pname = "bookstack";
-  version = "25.11.6";
+  version = "25.12.1";

  src = fetchFromGitHub {
    owner = "bookstackapp";
    repo = "bookstack";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-2JyWCP2ISgl82P6W5dL5Zbl+phgREQEonQ+12fu3q/E=";
+    hash = "sha256-lp2qC2K2RnWgI0g/67WNPtatbLCTUau37PcLqG6dQlw=";
  };

-  vendorHash = "sha256-tuVei2GRTrYyJQtX7Y7A4pgCjqhS+xjaH1FoCwjrHUg=";
+  vendorHash = "sha256-kbyFPDg9ev0IjvqtFoTiiYyza2oriAhMLbAU7Js9Dyc=";

  passthru = {
    phpPackage = php83;
@@ -6,12 +6,12 @@
 let
  pname = "caprine";
  version = "2.59.1";
-  metaCommon = with lib; {
+  metaCommon = {
    description = "Elegant Facebook Messenger desktop app";
    homepage = "https://sindresorhus.com/caprine";
-    license = licenses.mit;
-    maintainers = with maintainers; [ ShamrockLee ];
-    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ ShamrockLee ];
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
  };
  x86_64-appimage = callPackage ./build-from-appimage.nix {
    inherit pname version metaCommon;
@@ -6,18 +6,18 @@

 buildGoModule rec {
  pname = "cnspec";
-  version = "12.16.0";
+  version = "12.17.0";

  src = fetchFromGitHub {
    owner = "mondoohq";
    repo = "cnspec";
    tag = "v${version}";
-    hash = "sha256-N6Rd/NRNpimJrbzG5XzJ/LoSlk8x4W84hHcy95e1JK0=";
+    hash = "sha256-tuFdhaFp2gpMm8RzOs502TVy89btlpqklSW2OweREOA=";
  };

  proxyVendor = true;

-  vendorHash = "sha256-+dkC4rhkB6XOFyaRhwd7u1kBq2DAts+izedYmtYDFB0=";
+  vendorHash = "sha256-Q09fQoBrTMbnT0Edvue7/8hwAZQQdAJBjQ+9V/HFvY4=";

  subPackages = [ "apps/cnspec" ];

@@ -14,18 +14,18 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "codex";
-  version = "0.77.0";
+  version = "0.79.0";

  src = fetchFromGitHub {
    owner = "openai";
    repo = "codex";
    tag = "rust-v${finalAttrs.version}";
-    hash = "sha256-05zjzCrVhPLvrqx9UA2dPOjP8mQFUTWBCrmq/iaR3hg=";
+    hash = "sha256-fp/R/F0LcFLHfSNUW4pO2EG2ICce5vzxsOBYrm2tyaA=";
  };

  sourceRoot = "${finalAttrs.src.name}/codex-rs";

-  cargoHash = "sha256-bxy8YaUxsud3Gg09ebJyo0WNFvt76dcQTQ50B+xSbJU=";
+  cargoHash = "sha256-qCf8kJ2AuPfpykNiF2KNJqOs+Vq+BQHgMseqPtiGiz0=";

  nativeBuildInputs = [
    installShellFiles
@@ -120,10 +120,10 @@ stdenv.mkDerivation (finalAttrs: {
    description = "Share one mouse and keyboard between multiple computers on Windows, macOS and Linux";
    mainProgram = "deskflow";
    maintainers = with lib.maintainers; [ flacks ];
-    license = with lib; [
-      licenses.gpl2Plus
-      licenses.openssl
-      licenses.mit # share/applications/org.deskflow.deskflow.desktop
+    license = with lib.licenses; [
+      gpl2Plus
+      openssl
+      mit # share/applications/org.deskflow.deskflow.desktop
    ];
    platforms = lib.platforms.linux;
  };
@@ -1,187 +0,0 @@
-[
-  {
-    "pname": "CsvHelper",
-    "version": "30.0.1",
-    "sha256": "0v01s672zcrd3fjwzh14dihbal3apzyg3dc80k05a90ljk8yh9wl"
-  },
-  {
-    "pname": "McMaster.Extensions.CommandLineUtils",
-    "version": "4.0.2",
-    "sha256": "1x2a60vjq0n6mb7bfjlggbvp8vpq0m7ls5x4bwff2g2qxhw09rbv"
-  },
-  {
-    "pname": "Microsoft.Bcl.AsyncInterfaces",
-    "version": "7.0.0",
-    "sha256": "1waiggh3g1cclc81gmjrqbh128kwfjky3z79ma4bd2ms9pa3gvfm"
-  },
-  {
-    "pname": "Microsoft.Extensions.DependencyInjection",
-    "version": "7.0.0",
-    "sha256": "121zs4jp8iimgbpzm3wsglhjwkc06irg1pxy8c1zcdlsg34cfq1p"
-  },
-  {
-    "pname": "Microsoft.Extensions.DependencyInjection.Abstractions",
-    "version": "7.0.0",
-    "sha256": "181d7mp9307fs17lyy42f8cxnjwysddmpsalky4m0pqxcimnr6g7"
-  },
-  {
-    "pname": "Newtonsoft.Json",
-    "version": "13.0.3",
-    "sha256": "0xrwysmrn4midrjal8g2hr1bbg38iyisl0svamb11arqws4w2bw7"
-  },
-  {
-    "pname": "NuGet.Common",
-    "version": "6.8.0",
-    "sha256": "0l3ij8iwy7wj6s7f93lzi9168r4wz8zyin6a08iwgk7hvq44cia1"
-  },
-  {
-    "pname": "NuGet.Configuration",
-    "version": "6.8.0",
-    "sha256": "0x03p408smkmv1gv7pmvsia4lkn0xaj4wfrkl58pjf8bbv51y0yw"
-  },
-  {
-    "pname": "NuGet.Credentials",
-    "version": "6.8.0",
-    "sha256": "0dypmdkibgm5d9imhjnpgpdi6kmg6cnlvc7lc9w4v7ijflril15l"
-  },
-  {
-    "pname": "NuGet.DependencyResolver.Core",
-    "version": "6.8.0",
-    "sha256": "0da44ni1g6s3fkzmhymbcv98fcpd31bfmivq4cg90d0wiig85wvw"
-  },
-  {
-    "pname": "NuGet.Frameworks",
-    "version": "6.8.0",
-    "sha256": "0i2xvhgkjkjr496i3pg8hamwv6505fia45qhn7jg5m01wb3cvsjl"
-  },
-  {
-    "pname": "NuGet.LibraryModel",
-    "version": "6.8.0",
-    "sha256": "13qn64jckc9fd7yx5nwsxpj1i9gndlks35w0bdsfy8gc791wqdy4"
-  },
-  {
-    "pname": "NuGet.Packaging",
-    "version": "6.8.0",
-    "sha256": "031z4s905bxi94h3f0qy4j1b6jxdxgqgpkzqvvpfxch07szxcbim"
-  },
-  {
-    "pname": "NuGet.ProjectModel",
-    "version": "6.8.0",
-    "sha256": "1619jxp12cggspnwpk2x99s6h4z7gbc6kyngkij5cjd5wwc05haj"
-  },
-  {
-    "pname": "NuGet.Protocol",
-    "version": "6.8.0",
-    "sha256": "1d7hpdhrwv2fj7kzhqs6bp03vq9krv87jgxdhz0n9mih3zank4y0"
-  },
-  {
-    "pname": "NuGet.Versioning",
-    "version": "6.8.0",
-    "sha256": "1sd25h46fd12ng780r02q4ijcx1imkb53kj1y2y7cwg5myh537ks"
-  },
-  {
-    "pname": "System.Buffers",
-    "version": "4.5.1",
-    "sha256": "04kb1mdrlcixj9zh1xdi5as0k0qi8byr5mi3p3jcxx72qz93s2y3"
-  },
-  {
-    "pname": "System.ComponentModel.Annotations",
-    "version": "5.0.0",
-    "sha256": "021h7x98lblq9avm1bgpa4i31c2kgsa7zn4sqhxf39g087ar756j"
-  },
-  {
-    "pname": "System.Formats.Asn1",
-    "version": "6.0.0",
-    "sha256": "1vvr7hs4qzjqb37r0w1mxq7xql2b17la63jwvmgv65s1hj00g8r9"
-  },
-  {
-    "pname": "System.IO.Abstractions",
-    "version": "19.2.64",
-    "sha256": "1hgii2s97wima8cx2nabvmsg7ij6rl23x436zb9naj97kssfyxw4"
-  },
-  {
-    "pname": "System.IO.FileSystem.AccessControl",
-    "version": "5.0.0",
-    "sha256": "0ixl68plva0fsj3byv76bai7vkin86s6wyzr8vcav3szl862blvk"
-  },
-  {
-    "pname": "System.Memory",
-    "version": "4.5.4",
-    "sha256": "14gbbs22mcxwggn0fcfs1b062521azb9fbb7c113x0mq6dzq9h6y"
-  },
-  {
-    "pname": "System.Memory",
-    "version": "4.5.5",
-    "sha256": "08jsfwimcarfzrhlyvjjid61j02irx6xsklf32rv57x2aaikvx0h"
-  },
-  {
-    "pname": "System.Numerics.Vectors",
-    "version": "4.4.0",
-    "sha256": "0rdvma399070b0i46c4qq1h2yvjj3k013sqzkilz4bz5cwmx1rba"
-  },
-  {
-    "pname": "System.Numerics.Vectors",
-    "version": "4.5.0",
-    "sha256": "1kzrj37yzawf1b19jq0253rcs8hsq1l2q8g69d7ipnhzb0h97m59"
-  },
-  {
-    "pname": "System.Runtime.CompilerServices.Unsafe",
-    "version": "4.5.3",
-    "sha256": "1afi6s2r1mh1kygbjmfba6l4f87pi5sg13p4a48idqafli94qxln"
-  },
-  {
-    "pname": "System.Runtime.CompilerServices.Unsafe",
-    "version": "6.0.0",
-    "sha256": "0qm741kh4rh57wky16sq4m0v05fxmkjjr87krycf5vp9f0zbahbc"
-  },
-  {
-    "pname": "System.Security.AccessControl",
-    "version": "5.0.0",
-    "sha256": "17n3lrrl6vahkqmhlpn3w20afgz09n7i6rv0r3qypngwi7wqdr5r"
-  },
-  {
-    "pname": "System.Security.Cryptography.Cng",
-    "version": "5.0.0",
-    "sha256": "06hkx2za8jifpslkh491dfwzm5dxrsyxzj5lsc0achb6yzg4zqlw"
-  },
-  {
-    "pname": "System.Security.Cryptography.Pkcs",
-    "version": "6.0.4",
-    "sha256": "0hh5h38pnxmlrnvs72f2hzzpz4b2caiiv6xf8y7fzdg84r3imvfr"
-  },
-  {
-    "pname": "System.Security.Cryptography.ProtectedData",
-    "version": "4.4.0",
-    "sha256": "1q8ljvqhasyynp94a1d7jknk946m20lkwy2c3wa8zw2pc517fbj6"
-  },
-  {
-    "pname": "System.Security.Principal.Windows",
-    "version": "5.0.0",
-    "sha256": "1mpk7xj76lxgz97a5yg93wi8lj0l8p157a5d50mmjy3gbz1904q8"
-  },
-  {
-    "pname": "System.Text.Encodings.Web",
-    "version": "7.0.0",
-    "sha256": "1151hbyrcf8kyg1jz8k9awpbic98lwz9x129rg7zk1wrs6vjlpxl"
-  },
-  {
-    "pname": "System.Text.Json",
-    "version": "7.0.3",
-    "sha256": "0zjrnc9lshagm6kdb9bdh45dmlnkpwcpyssa896sda93ngbmj8k9"
-  },
-  {
-    "pname": "System.Threading.Tasks.Extensions",
-    "version": "4.5.4",
-    "sha256": "0y6ncasgfcgnjrhynaf0lwpkpkmv4a07sswwkwbwb5h7riisj153"
-  },
-  {
-    "pname": "TestableIO.System.IO.Abstractions",
-    "version": "19.2.64",
-    "sha256": "0ayrz1n777cgjgnp4iff90z43s9w3df62r93nkxg6wkga8v0dyr5"
-  },
-  {
-    "pname": "TestableIO.System.IO.Abstractions.Wrappers",
-    "version": "19.2.64",
-    "sha256": "0l2lv45mcr54b8h37bwqag9n9qbh8vyyxz88mw6pcdz2k3z475jc"
-  }
-]
@@ -1,44 +1,22 @@
 {
  lib,
-  fetchFromGitHub,
-  buildDotnetModule,
+  buildDotnetGlobalTool,
  dotnetCorePackages,
 }:
-buildDotnetModule rec {
+buildDotnetGlobalTool rec {
  pname = "dotnet-outdated";
-  version = "4.6.4";
+  nugetName = "dotnet-outdated-tool";
+  version = "4.6.9";

-  src = fetchFromGitHub {
-    owner = "dotnet-outdated";
-    repo = "dotnet-outdated";
-    rev = "v${version}";
-    hash = "sha256-Ah5VOCIkSRkeDWk/KYHIc/OELo0T/HuJl0LEUiumlu0=";
-  };
+  dotnet-sdk = dotnetCorePackages.sdk_10_0;

-  dotnet-sdk = dotnetCorePackages.sdk_8_0;
-  dotnet-runtime = dotnetCorePackages.runtime_8_0;
-  useDotnetFromEnv = true;
-
-  nugetDeps = ./deps.json;
-
-  projectFile = "src/DotNetOutdated/DotNetOutdated.csproj";
-  executables = "dotnet-outdated";
-
-  dotnetFlags = [ "-p:TargetFrameworks=net8.0" ];
-  dotnetInstallFlags = [
-    "--framework"
-    "net8.0"
-  ];
+  nugetHash = "sha256-LVe/b18hxM9A0Kni6Kl4sE38KgzIihDuc+xRw8qaKv0=";

  meta = {
    description = ".NET Core global tool to display and update outdated NuGet packages in a project";
+    downloadPage = "https://www.nuget.org/packages/dotnet-outdated-tool";
    homepage = "https://github.com/dotnet-outdated/dotnet-outdated";
-    sourceProvenance = with lib.sourceTypes; [
-      fromSource
-      # deps
-      binaryBytecode
-      binaryNativeCode
-    ];
+    changelog = "https://github.com/dotnet-outdated/dotnet-outdated/releases/tag/v${version}";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ emilioziniades ];
    mainProgram = "dotnet-outdated";
@@ -12,11 +12,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "eigenwallet";
-  version = "3.6.3";
+  version = "3.6.4";

  src = fetchurl {
    url = "https://github.com/eigenwallet/core/releases/download/${finalAttrs.version}/eigenwallet_${finalAttrs.version}_amd64.deb";
-    hash = "sha256-3lgHMkiwbE7P72sZZ9pcxdaN3/X8XDq3uNcaj/IV+v8=";
+    hash = "sha256-OvbkIOAQBwpZnFU1nT72/ePC6IG9t4CNjQJOhCoGxYw=";
  };

  nativeBuildInputs = [
@@ -11,13 +11,13 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "espflash";
-  version = "4.2.0";
+  version = "4.3.0";

  src = fetchFromGitHub {
    owner = "esp-rs";
    repo = "espflash";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Ia7o2u7egBTlzQAWnME6+/8V+5Go70wwXi/nJLKbGZM=";
+    hash = "sha256-CeXkC+3M22EmHG0KL0wMXn49bUbxgD33ojQvbeaf5Gs=";
  };

  nativeBuildInputs = [
@@ -30,10 +30,10 @@ rustPlatform.buildRustPackage (finalAttrs: {

  buildInputs = [ openssl ];

-  cargoHash = "sha256-Jh5JoHHfbrpwedXHuCBlIJxCTYjKfofjAoWD8QhGSH8=";
+  cargoHash = "sha256-Vgf3k0pT8VswESXuWIIeZlCFLm861BYrteRFkmhk/3M=";

  cargoBuildFlags = [
-    "--exclude xtask"
+    "--exclude=xtask"
    "--workspace"
  ];

@@ -28,9 +28,9 @@ let

  vendorHash = "sha256-VG1/6KadRC4jLBIOL39M6l8ZED1KLb+wKGHNQowAV1g=";

-  commonMeta = with lib; {
-    license = licenses.mit;
-    maintainers = with maintainers; [ hexa ];
+  commonMeta = {
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ hexa ];
  };

  decorate = buildGo125Module {
@@ -150,13 +150,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "fish";
-  version = "4.3.2";
+  version = "4.3.3";

  src = fetchFromGitHub {
    owner = "fish-shell";
    repo = "fish-shell";
    tag = finalAttrs.version;
-    hash = "sha256-/B4U3giKGmU5B/L5HQLS1lU8f7hsfI4aCeOjWcQ1dpA=";
+    hash = "sha256-mAEsqAXwge5FUuYD4yge7TfwrmAyhpzjrbjPOoQKQDo=";
  };

  env = {
@@ -169,7 +169,7 @@ stdenv.mkDerivation (finalAttrs: {

  cargoDeps = rustPlatform.fetchCargoVendor {
    inherit (finalAttrs) src patches;
-    hash = "sha256-/udRRs/ieLfazVTwM47ElExN40QdAG/OqQXmYurgC1I=";
+    hash = "sha256-fwERCvGfBOXlVFHQl6moZV8kNmHA7N/PkS3eDaLKPkA=";
  };

  patches = [
@@ -196,7 +196,6 @@ stdenv.mkDerivation (finalAttrs: {
      --replace-fail '"/bin/ls"' '"${lib.getExe' coreutils "ls"}"'

    substituteInPlace src/highlight/highlight.rs \
-      --replace-fail '"/bin/echo"' '"${lib.getExe' coreutils "echo"}"' \
      --replace-fail '"/bin/c"' '"${lib.getExe' coreutils "c"}"' \
      --replace-fail '"/bin/ca"' '"${lib.getExe' coreutils "ca"}"'

@@ -10,9 +10,6 @@
  name ? "zig-packages",
 }:

-with builtins;
-with lib;
-
 let
  unpackZigArtifact =
    { name, artifact }:
@@ -41,9 +38,9 @@ let
      rev ? throw "rev is required, remove and regenerate the zon2json-lock file",
    }:
    let
-      parts = splitString "#" url;
-      url_base = elemAt parts 0;
-      url_without_query = elemAt (splitString "?" url_base) 0;
+      parts = lib.splitString "#" url;
+      url_base = lib.elemAt parts 0;
+      url_without_query = lib.elemAt (lib.splitString "?" url_base) 0;
    in
    fetchgit {
      inherit name rev hash;
@@ -59,9 +56,9 @@ let
      ...
    }@args:
    let
-      parts = splitString "://" url;
-      proto = elemAt parts 0;
-      path = elemAt parts 1;
+      parts = lib.splitString "://" url;
+      proto = lib.elemAt parts 0;
+      path = lib.elemAt parts 1;
      fetcher = {
        "git+http" = fetchGitZig (
          args
@@ -138,5 +138,6 @@ stdenv.mkDerivation rec {
      amiddelk
    ];
    platforms = lib.platforms.unix;
+    broken = !lib.versionAtLeast ocamlPackages.ocaml.version "4.14";
  };
 }
@@ -11,16 +11,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "fresh";
-  version = "0.1.67";
+  version = "0.1.70";

  src = fetchFromGitHub {
    owner = "sinelaw";
    repo = "fresh";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-OA5foQEAs01bAi78c6tEaLKaQHcRhRVtNkwpOjbPgEQ=";
+    hash = "sha256-Lr5tMzEuUJJjsixji3H1Ms9of7JZD47kH8bJoOt2niw=";
  };

-  cargoHash = "sha256-/sJ956ZqtI1xV0JW3RwRd0b5pYW2W/vQhb9ApF61eF0=";
+  cargoHash = "sha256-OJwyckBWBPBcQL3f0wTDrNeyhwEXCzQesEiwTxt9uco=";

  passthru.updateScript = nix-update-script { };

@@ -9,13 +9,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "gambit-project";
-  version = "16.4.1";
+  version = "16.5.0";

  src = fetchFromGitHub {
    owner = "gambitproject";
    repo = "gambit";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-jRjL/rQ3k0zdTFCx1S/jdYpijcBx1aV8zsC8mz8aZ3A=";
+    hash = "sha256-xoFtqPUC/qLrlEewIPeDmOH7rWMB+ak5CdVlH5t84MY=";
  };

  nativeBuildInputs = [ autoreconfHook ] ++ lib.optional withGui wxGTK31;
@@ -0,0 +1,40 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  versionCheckHook,
+}:
+
+buildGoModule rec {
+  pname = "h2spec";
+  version = "2.6.0";
+
+  src = fetchFromGitHub {
+    owner = "summerwind";
+    repo = "h2spec";
+    tag = "v${version}";
+    hash = "sha256-HEvaE363bqwE9o0FPue+x+SaThohmCWbFXSraB0hP1I=";
+  };
+
+  vendorHash = "sha256-LR5YN0M8PQjQMMsbhQvITFXuhNG8J/poijYeeh2fHYs=";
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X=main.VERSION=${version}"
+    "-X main.COMMIT=${version}"
+  ];
+
+  doInstallCheck = true;
+
+  meta = {
+    description = "Testing tool for HTTP/2 implementation";
+    homepage = "https://github.com/summerwind/h2spec";
+    changelog = "https://github.com/summerwind/h2spec/releases/tag/${src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "h2spec";
+  };
+}
@@ -8,18 +8,18 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "harper";
-  version = "1.3.0";
+  version = "1.4.0";

  src = fetchFromGitHub {
    owner = "Automattic";
    repo = "harper";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-AXBRCQpa2cmdmVeABZb9hXNWH7gJgqfrqot16fTgJrY=";
+    hash = "sha256-JHefzppRB8OmnSH0zAUZTFyBt8sgam4QBfAoZRurYYg=";
  };

  buildAndTestSubdir = "harper-ls";

-  cargoHash = "sha256-LqjdH6qKpcMBy8Pqks4nmvej3wbT5EvIISxp9ULgqs4=";
+  cargoHash = "sha256-XjE+CXJ25/VfDhkElv+fNDgjBJ2rLeFpnUC/DG8hXAk=";

  passthru.updateScript = nix-update-script { };

@@ -17,15 +17,15 @@
 }:

 let
-  version = "5.13.0-35";
+  version = "5.16.2-43";
  srcs = {
    aarch64-linux = fetchurl {
-      url = "https://signalyst.com/bins/bookworm/hqplayer5desktop_${version}_arm64.deb";
-      hash = "sha256-ofS+EDNHKv94GSi9DrZPUhosAZsjSuP8rQghldKZmkU=";
+      url = "https://signalyst.com/bins/trixie/hqplayer5desktop_${version}_arm64.deb";
+      hash = "sha256-dmnDbFf1obuBvKSMIGFiI7fXi/5YRP23625Y+UEj+Wo=";
    };
    x86_64-linux = fetchurl {
      url = "https://signalyst.com/bins/noble/hqplayer5desktop_${version}_amd64.deb";
-      hash = "sha256-ej4H7SuDMkihlJsHcvPIFSGghyqCvVY/7LbCdq6lky4=";
+      hash = "sha256-WUqfMUQSVb+MSc0GyhuEMM9H6fJP/NcmpFAX46BCiPI=";
    };
  };
 in
@@ -108,6 +108,17 @@ buildGoModule (finalAttrs: {
  # required for go-cowsql.
  CGO_LDFLAGS_ALLOW = "(-Wl,-wrap,pthread_create)|(-Wl,-z,now)";

+  # add our lxc location to incus's acceptable rootFsPaths
+  # this is necessary for tmpfs/tmpfs-overlay to work
+  postPatch =
+    if (lib.versionAtLeast finalAttrs.version "6.16") then
+      ''
+        substituteInPlace internal/server/device/disk.go \
+          --replace-fail '"/opt/incus/lib/lxc/rootfs/"' '"${lxc}/lib/lxc/rootfs/"'
+      ''
+    else
+      null;
+
  postBuild = ''
    # build docs
    mkdir -p .sphinx/deps
@@ -24,7 +24,7 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "komikku";
-  version = "1.98.0";
+  version = "1.99.0";
  pyproject = false;

  src = fetchFromGitea {
@@ -32,7 +32,7 @@ python3.pkgs.buildPythonApplication rec {
    owner = "valos";
    repo = "Komikku";
    tag = "v${version}";
-    hash = "sha256-7UMCSqVj6eOjpuuMeOuvMtBELjkG4ayaJgFVwMDP0Ag=";
+    hash = "sha256-JKPAY6vfoU0FIXW8BDjUimeDkqp6K1/DG81wNWBGLbY=";
  };

  nativeBuildInputs = [
@@ -6,13 +6,13 @@

 buildGoModule rec {
  pname = "kubectl-ktop";
-  version = "0.5.0";
+  version = "0.5.1";

  src = fetchFromGitHub {
    owner = "vladimirvivien";
    repo = "ktop";
    rev = "v${version}";
-    sha256 = "sha256-VNP66Mtzyd8U5ddP4n+VvT5ZrPDOqvDbylj3F0dMViM=";
+    sha256 = "sha256-Hf9Vywi67Xjyea+4RJJll8htrCWTtpT/xakBjR+n/ak=";
  };

  vendorHash = "sha256-kSDbQFiZ8XMKyW7aYKe1s0pq038YC+RORCtMXFI+knA=";
@@ -11,16 +11,16 @@

 buildGoModule rec {
  pname = "lazysql";
-  version = "0.4.3";
+  version = "0.4.6";

  src = fetchFromGitHub {
    owner = "jorgerojas26";
    repo = "lazysql";
    rev = "v${version}";
-    hash = "sha256-mab6YZPOq6DerBrHK3UQrccrM8Jtp9nu2bzUus2zLYs=";
+    hash = "sha256-kEGUPlFCU2kKgVJHobVP+DFmAcMc/ZDP+u0w03DnhSo=";
  };

-  vendorHash = "sha256-NGwCTEh1/5dJWOCSe18FZYYu8v7Mj6MWVEWyNNA1T68=";
+  vendorHash = "sha256-FbAt/HsjoxqAKWQqqWN2xuyyTG2Ic4DcyEU4O0rjpQE=";

  ldflags = [
    "-X main.version=${version}"
@@ -48,10 +48,7 @@ stdenv.mkDerivation rec {
    description = "RAW camerafile decoding library";
    homepage = "https://libopenraw.freedesktop.org";
    license = lib.licenses.lgpl3Plus;
-    platforms = [
-      "x86_64-linux"
-      "aarch64-linux"
-    ];
+    platforms = lib.platforms.linux;
    maintainers = [ lib.maintainers.struan ];
  };
 }
@@ -8,13 +8,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "libpqxx";
-  version = "7.10.4";
+  version = "7.10.5";

  src = fetchFromGitHub {
    owner = "jtv";
    repo = "libpqxx";
    rev = finalAttrs.version;
-    hash = "sha256-0/gkfoJg+Zt9LLLQ/TVkUhBZ3NYIzg+uIClU89ORr+4=";
+    hash = "sha256-QlzP/4ze9PFdadkcCxppVeOAKYGscrc4Db52xHcbPIA=";
  };

  outputs = [
@@ -7,13 +7,13 @@

 stdenvNoCC.mkDerivation {
  pname = "libretro-shaders-slang";
-  version = "0-unstable-2025-12-27";
+  version = "0-unstable-2026-01-02";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "slang-shaders";
-    rev = "e24402e35d762a017127f44701cad8d3f4704f44";
-    hash = "sha256-yv0MM90ACG5JGf9ypkyK3xlr6V284F/PrPAbXjuLZWw=";
+    rev = "bb2899e53c3d785efceae56be38503d1bcbe6359";
+    hash = "sha256-Ed3E4pMtw90iYwNVN/QOA7ICL1yAkGRPQOCGei2+BIQ=";
  };

  dontConfigure = true;
@@ -30,13 +30,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "librime";
-  version = "1.15.0";
+  version = "1.16.0";

  src = fetchFromGitHub {
    owner = "rime";
    repo = "librime";
    rev = version;
-    sha256 = "sha256-B3mhHv8fk8TGXu+jJSYJ2R8QW+nG5RJx6kFtP5ILhYY=";
+    sha256 = "sha256-zKc9Xxv+DHOfwpMaXeG34NwdGbXH6XP3ua+LrivQvBU=";
  };

  nativeBuildInputs = [
@@ -22,7 +22,7 @@ stdenv.mkDerivation (finalAttrs: {
    description = "Cross-platform shared library for serial port access";
    homepage = "https://sigrok.org/";
    license = lib.licenses.gpl3Plus;
-    platforms = with lib; platforms.linux ++ platforms.darwin ++ platforms.windows;
+    platforms = with lib.platforms; linux ++ darwin ++ windows;
    maintainers = [ lib.maintainers.bjornfor ];
  };
 })
@@ -47,14 +47,14 @@ in
 # as bootloader for various platforms and corresponding binary and helper files.
 stdenv.mkDerivation (finalAttrs: {
  pname = "limine";
-  version = "10.6.1";
+  version = "10.6.2";

  # We don't use the Git source but the release tarball, as the source has a
  # `./bootstrap` script performing network access to download resources.
  # Packaging that in Nix is very cumbersome.
  src = fetchurl {
    url = "https://codeberg.org/Limine/Limine/releases/download/v${finalAttrs.version}/limine-${finalAttrs.version}.tar.gz";
-    hash = "sha256-juCivgLVpGY7hiHLMhZwhTTcIPA2CfYyKHTp8Oy33mI=";
+    hash = "sha256-WHzv4pNXSIu6H2i8MtxO6ogIzB7ZVcBqAGz+zzbmFKs=";
  };

  enableParallelBuilding = true;
@@ -4,29 +4,36 @@
  fetchFromGitHub,
  makeBinaryWrapper,
  installShellFiles,
+  pkg-config,
+  oniguruma,
  versionCheckHook,
  nix-update-script,
 }:
-let
-  version = "0.5.0";
-in
-rustPlatform.buildRustPackage {
+rustPlatform.buildRustPackage (finalAttrs: {
  pname = "lla";
-  inherit version;
+  version = "0.5.3";

  src = fetchFromGitHub {
    owner = "chaqchase";
    repo = "lla";
-    tag = "v${version}";
-    hash = "sha256-xbXTiOr3c9PX0SRfjO+3Kib5S0fruFhjHO2Mf00BVBg=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-AVvng3pF68bLlJBobEDBxW7/CQADTfg1Ylm/tjQFFfQ=";
  };

  nativeBuildInputs = [
    makeBinaryWrapper
    installShellFiles
+    pkg-config
  ];

-  cargoHash = "sha256-qKeNSaZMpyQpI7oGqn416pfBINMsIE+0sjzg38roxc8=";
+  buildInputs = [
+    oniguruma
+  ];
+
+  # Do not vendor Oniguruma
+  env.RUSTONIG_SYSTEM_LIBONIG = true;
+
+  cargoHash = "sha256-SQBaUaNuPUUw/bQ9UnUNCo+HpU7VVK3wzKAtSDpmTHo=";

  cargoBuildFlags = [ "--workspace" ];

@@ -55,10 +62,10 @@ rustPlatform.buildRustPackage {
      Git integration, and a robust plugin system with an extensible list of plugins to add more functionality.
    '';
    homepage = "https://lla.chaqchase.com";
-    changelog = "https://github.com/chaqchase/lla/blob/refs/tags/v${version}/CHANGELOG.md";
+    changelog = "https://github.com/chaqchase/lla/blob/refs/tags/v${finalAttrs.version}/CHANGELOG.md";
    license = with lib.licenses; [ mit ];
    maintainers = with lib.maintainers; [ pluiedev ];
    platforms = lib.platforms.unix;
    mainProgram = "lla";
  };
-}
+})
@@ -34,10 +34,8 @@ stdenvNoCC.mkDerivation {
    runHook postInstall
  '';

-  meta =
-    metaCommon
-    // (with lib; {
-      platforms = if isAarch64 then [ "aarch64-darwin" ] else platforms.darwin;
-      mainProgram = "losslesscut";
-    });
+  meta = metaCommon // {
+    platforms = if isAarch64 then [ "aarch64-darwin" ] else lib.platforms.darwin;
+    mainProgram = "losslesscut";
+  };
 }
@@ -36,10 +36,8 @@ stdenvNoCC.mkDerivation {
    runHook postInstall
  '';

-  meta =
-    metaCommon
-    // (with lib; {
-      platforms = platforms.windows;
-      mainProgram = "LosslessCut.exe";
-    });
+  meta = metaCommon // {
+    platforms = lib.platforms.windows;
+    mainProgram = "LosslessCut.exe";
+  };
 }
@@ -8,13 +8,13 @@
 let
  pname = "losslesscut";
  version = "3.64.0";
-  metaCommon = with lib; {
+  metaCommon = {
    description = "Swiss army knife of lossless video/audio editing";
    homepage = "https://mifi.no/losslesscut/";
-    license = licenses.gpl2Only;
-    maintainers = with maintainers; [ ShamrockLee ];
+    license = lib.licenses.gpl2Only;
+    maintainers = with lib.maintainers; [ ShamrockLee ];
    mainProgram = "losslesscut";
-    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
+    sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
  };
  x86_64-appimage = callPackage ./build-from-appimage.nix {
    inherit pname version metaCommon;
@@ -10,9 +10,6 @@
  name ? "zig-packages",
 }:

-with builtins;
-with lib;
-
 let
  unpackZigArtifact =
    { name, artifact }:
@@ -41,9 +38,9 @@ let
      rev ? throw "rev is required, remove and regenerate the zon2json-lock file",
    }:
    let
-      parts = splitString "#" url;
-      url_base = elemAt parts 0;
-      url_without_query = elemAt (splitString "?" url_base) 0;
+      parts = lib.splitString "#" url;
+      url_base = lib.elemAt parts 0;
+      url_without_query = lib.elemAt (lib.splitString "?" url_base) 0;
    in
    fetchgit {
      inherit name rev hash;
@@ -59,9 +56,9 @@ let
      ...
    }@args:
    let
-      parts = splitString "://" url;
-      proto = elemAt parts 0;
-      path = elemAt parts 1;
+      parts = lib.splitString "://" url;
+      proto = lib.elemAt parts 0;
+      path = lib.elemAt parts 1;
      fetcher = {
        "git+http" = fetchGitZig (
          args
@@ -164,9 +164,9 @@ stdenv.mkDerivation (finalAttrs: {
    sed -i '/set (ADD_AVX_BUILDS 1)/d' CMakeLists.txt
  '';

-  meta = with lib; {
+  meta = {
    description = "Manticore Columnar Library - columnar storage and secondary indexes library for Manticore Search";
    homepage = "https://github.com/manticoresoftware/columnar";
-    license = licenses.asl20;
+    license = lib.licenses.asl20;
  };
 })
@@ -9,20 +9,24 @@

 buildGoModule (finalAttrs: {
  pname = "miniflux";
-  version = "2.2.15";
+  version = "2.2.16";

  src = fetchFromGitHub {
    owner = "miniflux";
    repo = "v2";
    tag = finalAttrs.version;
-    hash = "sha256-19i+TeBcPnI1Gfpf81gHE9sLvytsS4x1A5XU8oD7YIU=";
+    hash = "sha256-mJ0FgoTm/SzS/T6xcLk232Xs3TgaDQahib4BeWzNfAk=";
  };

  vendorHash = "sha256-XrTmXAUABlTQaA3Z0vU0HQW5Q1e/Yg6yq690oZH8M+A=";

  nativeBuildInputs = [ installShellFiles ];

-  checkFlags = [ "-skip=TestClient" ]; # skip client tests as they require network access
+  # skip tests that require network access
+  checkFlags = [
+    "-skip=TestClient"
+    "-skip=TestResolvesToPrivateIP"
+  ];

  ldflags = [
    "-s"
@@ -162,7 +162,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    ];
    maintainers = with lib.maintainers; [ getchoo ];
    mainProgram = "ModrinthApp";
-    platforms = with lib; platforms.linux ++ platforms.darwin;
+    platforms = with lib.platforms; linux ++ darwin;
    # This builds on architectures like aarch64, but the launcher itself does not support them yet.
    # Darwin is the only exception
    # See https://github.com/modrinth/code/issues/776#issuecomment-1742495678
@@ -82,16 +82,15 @@ let

  scope =
    self:
-    with lib;
-    pipe
+    lib.pipe
      {
        inherit (self) callPackage;
        directory = ./scripts;
      }
      [
-        packagesFromDirectoryRecursive
-        recurseIntoAttrs
-        (mapAttrsRecursiveCond (x: x.recurseForDerivations or false) addTests)
+        lib.packagesFromDirectoryRecursive
+        lib.recurseIntoAttrs
+        (lib.mapAttrsRecursiveCond (x: x.recurseForDerivations or false) addTests)
      ];

  mkAliases = self: {
@@ -18,20 +18,20 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "n8n";
-  version = "1.123.5";
+  version = "2.3.0";

  src = fetchFromGitHub {
    owner = "n8n-io";
    repo = "n8n";
    tag = "n8n@${finalAttrs.version}";
-    hash = "sha256-3vXJnLqQz60Sq1A8lLW0x6xAoN3DneFYVsaHAD0nzng=";
+    hash = "sha256-6VfoT8Rw2c46ugSpW1IHJPSHTWnphNn0MG1XDhrPeBg=";
  };

  pnpmDeps = fetchPnpmDeps {
    inherit (finalAttrs) pname version src;
    pnpm = pnpm_10;
-    fetcherVersion = 2;
-    hash = "sha256-JlW08N9LuwmWqZsXmu4uMAHO0cb8XtOmtER7Bt/Vg8A=";
+    fetcherVersion = 3;
+    hash = "sha256-wSKxoxWys3gf++yTDr/XBadW9bq/w/NKPGUZpbAPe+I=";
  };

  nativeBuildInputs = [
@@ -116,6 +116,7 @@ stdenv.mkDerivation (finalAttrs: {
    maintainers = with lib.maintainers; [
      gepbird
      AdrienLemaire
+      sweenu
    ];
    license = lib.licenses.sustainableUse;
    mainProgram = "n8n";
@@ -21,14 +21,12 @@ buildNimPackage (

    doCheck = false;

-    meta =
-      final.src.meta
-      // (with lib; {
-        description = "Nim language server implementation (based on nimsuggest)";
-        homepage = "https://github.com/nim-lang/langserver";
-        license = licenses.mit;
-        mainProgram = "nimlangserver";
-        maintainers = with maintainers; [ daylinmorgan ];
-      });
+    meta = final.src.meta // {
+      description = "Nim language server implementation (based on nimsuggest)";
+      homepage = "https://github.com/nim-lang/langserver";
+      license = lib.licenses.mit;
+      mainProgram = "nimlangserver";
+      maintainers = with lib.maintainers; [ daylinmorgan ];
+    };
  }
 )
@@ -24,14 +24,14 @@ let
  platformSources =
    sources.${stdenvNoCC.system} or (throw "unsupported platform ${stdenvNoCC.system}");

-  sharedMeta = with lib; {
+  sharedMeta = {
    description = "CLI tool for managing Nordic Semiconductor devices";
    homepage = "https://www.nordicsemi.com/Products/Development-tools/nRF-Util";
    changelog = "https://docs.nordicsemi.com/bundle/nrfutil/page/guides/revision_history.html";
-    license = licenses.unfree;
+    license = lib.licenses.unfree;
    platforms = lib.attrNames sources;
    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
-    maintainers = with maintainers; [
+    maintainers = with lib.maintainers; [
      h7x4
      ezrizhu
    ];
@@ -10,9 +10,6 @@
  name ? "zig-packages",
 }:

-with builtins;
-with lib;
-
 let
  unpackZigArtifact =
    { name, artifact }:
@@ -41,9 +38,9 @@ let
      rev ? throw "rev is required, remove and regenerate the zon2json-lock file",
    }:
    let
-      parts = splitString "#" url;
-      url_base = elemAt parts 0;
-      url_without_query = elemAt (splitString "?" url_base) 0;
+      parts = lib.splitString "#" url;
+      url_base = lib.elemAt parts 0;
+      url_without_query = lib.elemAt (lib.splitString "?" url_base) 0;
    in
    fetchgit {
      inherit name rev hash;
@@ -59,9 +56,9 @@ let
      ...
    }@args:
    let
-      parts = splitString "://" url;
-      proto = elemAt parts 0;
-      path = elemAt parts 1;
+      parts = lib.splitString "://" url;
+      proto = lib.elemAt parts 0;
+      path = lib.elemAt parts 1;
      fetcher = {
        "git+http" = fetchGitZig (
          args
@@ -6,7 +6,6 @@
  pkgs,

  gradle_8,
-  gradle_7,
  perl,
  pkg-config,
  cmake,
@@ -23,6 +22,7 @@
  ffmpeg_7,
  ffmpeg_7-headless,

+  fetchpatch2,
  writeText,

  _experimental-update-script-combinators,
@@ -54,8 +54,6 @@ let

  atLeast21 = lib.versionAtLeast featureVersion "21";
  atLeast23 = lib.versionAtLeast featureVersion "23";
-
-  gradle_openjfx = if atLeast21 then gradle_8 else gradle_7;
 in

 assert lib.assertMsg (lib.pathExists sourceFile)
@@ -76,11 +74,28 @@ stdenv.mkDerivation {
      [
        ./17/patches/backport-ffmpeg-6-support-jfx11.patch
        ./17/patches/backport-ffmpeg-7-support-jfx11.patch
+
+        # Build with Gradle 8
+        (fetchpatch2 {
+          # Yes, this patch taken from the jfx21u repo is intended to be
+          # applied to jfx17.
+          url = "https://github.com/openjdk/jfx21u/commit/7f704c24c2238f9d7bb744a20667a8c1337decc6.patch?full_index=1";
+          excludes = [
+            # The patch fails to apply to these files, but with the exception
+            # of build.properties (which is patched in postPatch), none of them
+            # matter.
+            "build.properties"
+            "gradle/legal/gradle.md"
+            "gradle/wrapper/gradle-wrapper.properties"
+            "gradlew"
+          ];
+          hash = "sha256-WuJtzPy0IV4xvn+i5xeDqekWO0VR2GIfsYKkEmh8KKU=";
+        })
      ]
  );

  nativeBuildInputs = [
-    gradle_openjfx
+    gradle_8
    perl
    pkg-config
    cmake
@@ -99,7 +114,7 @@ stdenv.mkDerivation {
    (if atLeast21 then ffmpeg_7 else ffmpeg_7-headless)
  ];

-  mitmCache = gradle_openjfx.fetchDeps {
+  mitmCache = gradle_8.fetchDeps {
    attrPath = "openjfx${featureVersion}";
    pkg = pkgs."openjfx${featureVersion}".override { withWebKit = true; };
    data = ./. + "/${featureVersion}/deps.json";
@@ -132,6 +147,10 @@ stdenv.mkDerivation {
           modules/javafx.web/src/main/native/Source/bmalloc/bmalloc/IsoSharedPageInlines.h

    ''
+    + lib.optionalString (!atLeast21) ''
+      substituteInPlace build.properties \
+        --replace-fail jfx.gradle.version=7.3 jfx.gradle.version=8.4
+    ''
    + ''
      ln -s $config gradle.properties
    '';
@@ -156,7 +175,7 @@ stdenv.mkDerivation {

  disallowedReferences = [
    jdk-bootstrap
-    gradle_openjfx.jdk
+    gradle_8.jdk
  ];

  passthru.updateScript = _experimental-update-script-combinators.sequence [
@@ -36,6 +36,6 @@ stdenv.mkDerivation rec {
    description = "Provide user runtime directory on Linux systems";
    license = lib.licenses.gpl2Plus;
    platforms = lib.platforms.unix;
-    maintainers = with lib; [ maintainers.aanderse ];
+    maintainers = with lib.maintainers; [ aanderse ];
  };
 }
@@ -6,12 +6,12 @@

 python3Packages.buildPythonApplication rec {
  pname = "patatt";
-  version = "0.6.3";
+  version = "0.7.0";
  pyproject = true;

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-mAgm9lKdJXbCZ8ofVk1b7wRstH5UIVu1mO1sS5stCig=";
+    hash = "sha256-97K+ihXyUfu8kMa3NKuRBlSnqdGENpzp53ttJuQ7nuo=";
  };

  build-system = with python3Packages; [
@@ -16,11 +16,18 @@ stdenvNoCC.mkDerivation (finalAttrs: {

  src = fetchurl {
    url = "https://www.plasticscm.com/plasticrepo/stable/debian/amd64/plasticscm-client-core_${finalAttrs.version}_amd64.deb";
-    hash = "sha256-NuMY75JnnWVRKBSh/1XYipqc0m+O0vt7lJMVkQyTaNA=";
+    hash = "sha256-9K4pvl+hxB3+bQwC3HYaEOq5nQlCyTQQuYsuqT4BbRg=";
+    nativeBuildInputs = [ dpkg ];
+    downloadToTemp = true;
+    recursiveHash = true;
+    postFetch = ''
+      mkdir -p $out
+      dpkg-deb --fsys-tarfile $downloadedFile | tar --extract --directory=$out
+      rm -rf $out/usr/share/doc
+    '';
  };

  nativeBuildInputs = [
-    dpkg
    makeWrapper
  ];

@@ -40,15 +47,16 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    runtimeInputs = [
      common-updater-scripts
      curl
+      dpkg
      jc
      jq
    ];
    text = ''
-      eval "$(curl -sSL https://www.plasticscm.com/plasticrepo/stable/debian/Packages |
+      version="$(curl -sSL https://www.plasticscm.com/plasticrepo/stable/debian/Packages |
        jc --pkg-index-deb |
-        jq -r '[.[] | select(.package == "plasticscm-client-core")] | sort_by(.version) | last | @sh "version=\(.version) hash=\(.sha256)"')"
-      # shellcheck disable=SC2154
-      update-source-version plasticscm-client-core-unwrapped "$version" "sha256-$(xxd -r -p <<<"$hash" | base64)"
+        jq -r '[.[] | select(.package == "plasticscm-client-core")] | sort_by(.version) | last | .version')"
+
+      update-source-version --ignore-same-hash plasticscm-client-core-unwrapped "$version"
    '';
  });

@@ -15,13 +15,17 @@ stdenvNoCC.mkDerivation (finalAttrs: {

  src = fetchurl {
    url = "https://www.plasticscm.com/plasticrepo/stable/debian/amd64/plasticscm-client-gui_${finalAttrs.version}_amd64.deb";
-    hash = "sha256-sSabW3j9h9uNQSwWKvAH+3D9lRWvMRYcuITDonD7Inw=";
+    hash = "sha256-jqU4nfRtobdXiNIx9pjceje5Y+m+xFYdWQwWgEXxW+k=";
+    nativeBuildInputs = [ dpkg ];
+    downloadToTemp = true;
+    recursiveHash = true;
+    postFetch = ''
+      mkdir -p $out
+      dpkg-deb --fsys-tarfile $downloadedFile | tar --extract --directory=$out
+      rm -rf $out/usr/share/doc
+    '';
  };

-  nativeBuildInputs = [
-    dpkg
-  ];
-
  dontFixup = true;

  installPhase = ''
@@ -38,15 +42,16 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    runtimeInputs = [
      common-updater-scripts
      curl
+      dpkg
      jc
      jq
    ];
    text = ''
-      eval "$(curl -sSL https://www.plasticscm.com/plasticrepo/stable/debian/Packages |
+      version="$(curl -sSL https://www.plasticscm.com/plasticrepo/stable/debian/Packages |
        jc --pkg-index-deb |
-        jq -r '[.[] | select(.package == "plasticscm-client-gui")] | sort_by(.version) | last | @sh "version=\(.version) hash=\(.sha256)"')"
-      # shellcheck disable=SC2154
-      update-source-version plasticscm-client-gui-unwrapped "$version" "sha256-$(xxd -r -p <<<"$hash" | base64)"
+        jq -r '[.[] | select(.package == "plasticscm-client-gui")] | sort_by(.version) | last | .version')"
+
+      update-source-version --ignore-same-hash plasticscm-client-gui-unwrapped "$version"
    '';
  });

@@ -15,13 +15,17 @@ stdenvNoCC.mkDerivation (finalAttrs: {

  src = fetchurl {
    url = "https://www.plasticscm.com/plasticrepo/stable/debian/amd64/plasticscm-theme_${finalAttrs.version}_amd64.deb";
-    hash = "sha256-sInKMW6KoUNZ/06+E8MTGyVtOd+8wFLPrFibNw/DYQ0=";
+    hash = "sha256-qxOzt+cylEt0kCKb7n+fd4Ut9R4KxYArUm9Ntxe4yVU=";
+    nativeBuildInputs = [ dpkg ];
+    downloadToTemp = true;
+    recursiveHash = true;
+    postFetch = ''
+      mkdir -p $out
+      dpkg-deb --fsys-tarfile $downloadedFile | tar --extract --directory=$out
+      rm -rf $out/usr/share/doc
+    '';
  };

-  nativeBuildInputs = [
-    dpkg
-  ];
-
  dontFixup = true;

  installPhase = ''
@@ -38,15 +42,16 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    runtimeInputs = [
      common-updater-scripts
      curl
+      dpkg
      jc
      jq
    ];
    text = ''
-      eval "$(curl -sSL https://www.plasticscm.com/plasticrepo/stable/debian/Packages |
+      version="$(curl -sSL https://www.plasticscm.com/plasticrepo/stable/debian/Packages |
        jc --pkg-index-deb |
-        jq -r '[.[] | select(.package == "plasticscm-theme")] | sort_by(.version) | last | @sh "version=\(.version) hash=\(.sha256)"')"
-      # shellcheck disable=SC2154
-      update-source-version plasticscm-theme "$version" "sha256-$(xxd -r -p <<<"$hash" | base64)"
+        jq -r '[.[] | select(.package == "plasticscm-theme")] | sort_by(.version) | last | .version')"
+
+      update-source-version --ignore-same-hash plasticscm-theme "$version"
    '';
  });

@@ -49,13 +49,13 @@ rustPlatform.buildRustPackage (finalAttrs: {

  setupHook = ./setup-hook.sh;

-  meta = with lib; {
+  meta = {
    description = "Collection of engines that power the core stack for Prisma";
    homepage = "https://www.prisma.io/";
-    license = licenses.asl20;
-    platforms = platforms.unix;
+    license = lib.licenses.asl20;
+    platforms = lib.platforms.unix;
    mainProgram = "prisma";
-    maintainers = with maintainers; [
+    maintainers = with lib.maintainers; [
      aqrln
    ];
  };
@@ -98,12 +98,12 @@ stdenv.mkDerivation (finalAttrs: {
    cli = callPackage ./test-cli.nix { };
  };

-  meta = with lib; {
+  meta = {
    description = "Next-generation ORM for Node.js and TypeScript";
    homepage = "https://www.prisma.io/";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ aqrln ];
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ aqrln ];
    mainProgram = "prisma";
-    platforms = platforms.unix;
+    platforms = lib.platforms.unix;
  };
 })
@@ -27,13 +27,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "prismlauncher-unwrapped";
-  version = "10.0.0";
+  version = "10.0.1";

  src = fetchFromGitHub {
    owner = "PrismLauncher";
    repo = "PrismLauncher";
    tag = finalAttrs.version;
-    hash = "sha256-s3gMalc98lo8T+RZDZRO6AtV0Wf54wHo0/vmAss3dQE=";
+    hash = "sha256-wQ8+9mo4R88da/ZZcBSSvVmznl1GxIso3eynyZhkh7g=";
  };

  postUnpack = ''
@@ -7,14 +7,14 @@

 python3.pkgs.buildPythonApplication {
  pname = "renode-dts2repl";
-  version = "0-unstable-2025-12-29";
+  version = "0-unstable-2026-01-07";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "antmicro";
    repo = "dts2repl";
-    rev = "aace53b51d6503bc5a2ba1ee2c6b1242a1795401";
-    hash = "sha256-2leYwGFDy7rbaAo/fVOVHuej7Zuw2Vg7igfUEKf0IJg=";
+    rev = "1b072467e75464dc6171825e0ca44a2ffdb791a7";
+    hash = "sha256-ctPp1B4pZSMBWjqtfOq6hqLvisrXyppvTiKXPrI94No=";
  };

  nativeBuildInputs = [
@@ -28,11 +28,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "reqable";
-  version = "3.0.31";
+  version = "3.0.32";

  src = fetchurl {
    url = "https://github.com/reqable/reqable-app/releases/download/${finalAttrs.version}/reqable-app-linux-x86_64.deb";
-    hash = "sha256-GNxSGw00nnM9bN46sL7G4KcXnJ3gDXv8Xf3N0qbL/ao=";
+    hash = "sha256-7Pk3LWi5wUz1P2UkTxU21x5P0DNmmaCbZAXqq2UCrb8=";
  };

  nativeBuildInputs = [
@@ -10,9 +10,6 @@
  name ? "zig-packages",
 }:

-with builtins;
-with lib;
-
 let
  unpackZigArtifact =
    { name, artifact }:
@@ -41,9 +38,9 @@ let
      rev ? throw "rev is required, remove and regenerate the zon2json-lock file",
    }:
    let
-      parts = splitString "#" url;
-      url_base = elemAt parts 0;
-      url_without_query = elemAt (splitString "?" url_base) 0;
+      parts = lib.splitString "#" url;
+      url_base = lib.elemAt parts 0;
+      url_without_query = lib.elemAt (lib.splitString "?" url_base) 0;
    in
    fetchgit {
      inherit name rev hash;
@@ -59,9 +56,9 @@ let
      ...
    }@args:
    let
-      parts = splitString "://" url;
-      proto = elemAt parts 0;
-      path = elemAt parts 1;
+      parts = lib.splitString "://" url;
+      proto = lib.elemAt parts 0;
+      path = lib.elemAt parts 1;
      fetcher = {
        "git+http" = fetchGitZig (
          args
@@ -32,8 +32,8 @@ stdenv.mkDerivation rec {
    wrapGAppsHook4
    qt6.wrapQtAppsHook
  ];
-  cmakeFlags = with lib; [
-    (cmakeFeature "CMAKE_BUILD_TYPE" "\"Release\"")
+  cmakeFlags = [
+    (lib.cmakeFeature "CMAKE_BUILD_TYPE" "\"Release\"")
  ];

  dontWrapGApps = true;
@@ -7,20 +7,25 @@
  cairo,
  cctools,
  ffmpeg-headless,
+  giflib,
  jemalloc,
  makeWrapper,
  nix-update-script,
-  nodejs,
+  nodejs_22,
  pango,
  pixman,
  pkg-config,
-  pnpm_9,
+  pnpm_10,
  fetchPnpmDeps,
  pnpmConfigHook,
  python3,
  vips,
  xcbuild,
 }:
+
+let
+  pnpm = pnpm_10.override { nodejs = nodejs_22; };
+in
 stdenv.mkDerivation (finalAttrs: {
  pname = "sharkey";
  version = "2025.4.4";
@@ -36,29 +41,32 @@ stdenv.mkDerivation (finalAttrs: {

  pnpmDeps = fetchPnpmDeps {
    inherit (finalAttrs) pname version src;
-    pnpm = pnpm_9;
-    fetcherVersion = 2;
-    hash = "sha256-34X8oJGkGXB9y7W4MquUkv8vY5yq2RoGIUCbjYppkIU=";
+    pnpm = pnpm;
+    fetcherVersion = 3;
+    hash = "sha256-wrA5Huv7b/P+5MNbScN9KzNwdHMtuceHu+Lw/C9lKlI=";
  };

  nativeBuildInputs = [
    makeWrapper
-    nodejs
+    nodejs_22
    pkg-config
    pnpmConfigHook
-    pnpm_9
+    pnpm
    python3
  ]
-  ++ (lib.optionals stdenv.hostPlatform.isDarwin [
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
    cctools
    xcbuild
-  ]);
+  ];

  buildInputs = [
    cairo
    pango
    pixman
    vips
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    giflib
  ];

  buildPhase = ''
@@ -71,7 +79,7 @@ stdenv.mkDerivation (finalAttrs: {
    popd

    # rebuild some node modules that have native dependencies
-    export npm_config_nodedir=${nodejs}
+    export npm_config_nodedir=${nodejs_22}

    pushd node_modules/.pnpm/node_modules/re2
    pnpm rebuild
@@ -82,12 +90,13 @@ stdenv.mkDerivation (finalAttrs: {
    popd

    pushd node_modules/.pnpm/node_modules/canvas
-    pnpm run install
+    NIX_CFLAGS_COMPILE="-include cstdint $NIX_CFLAGS_COMPILE" pnpm run install
    popd

    pnpm build
    node scripts/trim-deps.mjs
-    pnpm prune --prod --ignore-scripts
+    # FIXME: pruning is broken at the moment
+    # CI=true pnpm prune --prod --ignore-scripts

    runHook postBuild
  '';
@@ -96,8 +105,8 @@ stdenv.mkDerivation (finalAttrs: {
    let
      binPath = lib.makeBinPath [
        bash
-        nodejs
-        pnpm_9
+        nodejs_22
+        pnpm
      ];
      libPath = lib.makeLibraryPath [
        ffmpeg-headless
@@ -134,7 +143,7 @@ stdenv.mkDerivation (finalAttrs: {
      cp -r tossface-emojis/dist $out/sharkey/tossface-emojis/

      # create a wrapper script for running sharkey commands (ie. alias for pnpm run)
-      makeWrapper ${lib.getExe pnpm_9} $out/bin/sharkey \
+      makeWrapper ${lib.getExe pnpm} $out/bin/sharkey \
        --chdir $out/sharkey \
        --add-flags run \
        --set-default NODE_ENV production \
@@ -14,7 +14,7 @@ nixeval() {
 }

 vendorhash() {
-    (nix --extra-experimental-features nix-command build --impure --argstr nixpkgs "$nixpkgs" --argstr attr "$1" --expr '{ nixpkgs, attr }: let pkgs = import nixpkgs {}; in with pkgs.lib; (getAttrFromPath (splitString "." attr) pkgs).overrideAttrs (attrs: { outputHash = fakeHash; })' --no-link 2>&1 >/dev/null | tail -n3 | grep -F got: | cut -d: -f2- | stripwhitespace) 2>/dev/null || true
+    (nix --extra-experimental-features nix-command build --impure --argstr nixpkgs "$nixpkgs" --argstr attr "$1" --expr '{ nixpkgs, attr }: let pkgs = import nixpkgs {}; in (pkgs.lib.getAttrFromPath (pkgs.lib.splitString "." attr) pkgs).overrideAttrs (attrs: { outputHash = pkgs.lib.fakeHash; })' --no-link 2>&1 >/dev/null | tail -n3 | grep -F got: | cut -d: -f2- | stripwhitespace) 2>/dev/null || true
 }

 findpath() {
@@ -110,17 +110,17 @@ effectiveStdenv.mkDerivation (finalAttrs: {
    (cmakeFeature "CMAKE_HIP_ARCHITECTURES" (builtins.concatStringsSep ";" rocmGpuTargets))
  ];

-  meta = with lib; {
+  meta = {
    description = "Stable Diffusion inference in pure C/C++";
    homepage = "https://github.com/leejet/stable-diffusion.cpp";
-    license = licenses.mit;
+    license = lib.licenses.mit;
    mainProgram = "sd";
    maintainers = with lib.maintainers; [
      dit7ya
      adriangl
    ];
-    platforms = platforms.unix;
-    badPlatforms = optionals (cudaSupport || openclSupport) platforms.darwin;
+    platforms = lib.platforms.unix;
+    badPlatforms = lib.optionals (cudaSupport || openclSupport) lib.platforms.darwin;
    broken = metalSupport && !stdenv.hostPlatform.isDarwin;
  };
 })
@@ -0,0 +1,11 @@
+{
+  syncthingtray,
+}:
+
+syncthingtray.override {
+  webviewSupport = false;
+  jsSupport = false;
+  kioPluginSupport = false;
+  plasmoidSupport = false;
+  systemdSupport = true;
+}
@@ -5,6 +5,7 @@
  fetchFromGitHub,
  nix-update-script,
  testers,
+  validatePkgConfig,
 }:

 rustPlatform.buildRustPackage (finalAttrs: {
@@ -34,6 +35,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    "--features"
    "zoneinfo64,compiled_data"
  ];
+  nativeBuildInputs = [ validatePkgConfig ];

  installPhase = ''
    runHook preInstall
@@ -84,7 +86,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
  passthru.tests = {
    pkg-config = testers.hasPkgConfigModules {
      package = finalAttrs.finalPackage;
-      moduleNames = [ "temporal_capi" ];
    };
    updateScript = nix-update-script { };
  };
@@ -98,5 +99,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
      mit
    ];
    maintainers = with lib.maintainers; [ aduh95 ];
+    pkgConfigModules = [ "temporal_capi" ];
  };
 })
@@ -0,0 +1,63 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  findutils,
+  applyPatches,
+  go,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "tsgolint";
+  version = "v0.10.1";
+
+  src = applyPatches rec {
+    src = fetchFromGitHub {
+      owner = "oxc-project";
+      repo = "tsgolint";
+      tag = finalAttrs.version;
+      hash = "sha256-6cDQjYVNfujIh3s+9pNCfqUEtfdvgx66oZoENqpJ7jE=";
+      fetchSubmodules = true;
+    };
+    prePatch = ''
+      cd typescript-go
+    '';
+    # These patches are applied to the typescript-go submodule in justfile's "init" target upstream.
+    patches = [
+      (src + "/patches/0001-Parallel-readDirectory-visitor.patch")
+      (src + "/patches/0002-Adapt-project-service-for-single-run-mode.patch")
+      (src + "/patches/0003-patch-expose-more-functions-via-the-shim-with-type-f.patch")
+      (src + "/patches/0004-feat-improve-panic-message-for-extracting-TS-extensi.patch")
+      (src + "/patches/0005-fix-early-return-from-invalid-tsconfig-for-better-er.patch")
+    ];
+    # We don't want to build with go.work, so we add the replacement to
+    # the local module to the go.mod instead.
+    postPatch = ''
+      cd ..
+      ${lib.getExe go} mod edit --replace=github.com/microsoft/typescript-go=./typescript-go
+    '';
+  };
+
+  nativeBuildInputs = [ findutils ];
+
+  # From justfile's "init" target upstream.
+  postPatch = ''
+    rm go.work{,.sum}
+    mkdir -p internal/collections && find ./typescript-go/internal/collections -type f ! -name '*_test.go' -exec cp {} internal/collections/ \;
+  '';
+
+  proxyVendor = true;
+  vendorHash = "sha256-t1qyCdMeA5rh5/9yQ9LAhRO+0nSiMyFHp3sSPOJQWQA=";
+
+  subPackages = [ "cmd/tsgolint" ];
+
+  env.GOEXPERIMENT = "greenteagc";
+
+  meta = {
+    description = "Type aware linting for oxlint";
+    homepage = "https://github.com/oxc-project/tsgolint";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ jnsgruk ];
+    mainProgram = "tsgolint";
+  };
+})
@@ -105,23 +105,21 @@ stdenv.mkDerivation (finalAttrs: {
    };
  };

-  meta =
-    with lib;
-    {
-      description = "Ultra fast grep with interactive query UI";
-      homepage = "https://github.com/Genivia/ugrep";
-      changelog = "https://github.com/Genivia/ugrep/releases/tag/v${finalAttrs.version}";
-      maintainers = with lib.maintainers; [
-        numkem
-        mikaelfangel
-      ];
-      license = lib.licenses.bsd3;
-      platforms = lib.platforms.all;
-      mainProgram = "ug";
-    }
-    # Needed to ensure that the grep replacements take precedence over
-    # `gnugrep` when installed. Lower priority values win.
-    // lib.optionalAttrs createGrepReplacementLinks {
-      priority = (gnugrep.meta.priority or meta.defaultPriority) - 1;
-    };
+  meta = {
+    description = "Ultra fast grep with interactive query UI";
+    homepage = "https://github.com/Genivia/ugrep";
+    changelog = "https://github.com/Genivia/ugrep/releases/tag/v${finalAttrs.version}";
+    maintainers = with lib.maintainers; [
+      numkem
+      mikaelfangel
+    ];
+    license = lib.licenses.bsd3;
+    platforms = lib.platforms.all;
+    mainProgram = "ug";
+  }
+  # Needed to ensure that the grep replacements take precedence over
+  # `gnugrep` when installed. Lower priority values win.
+  // lib.optionalAttrs createGrepReplacementLinks {
+    priority = (gnugrep.meta.priority or lib.meta.defaultPriority) - 1;
+  };
 })
@@ -8,11 +8,11 @@

 stdenvNoCC.mkDerivation rec {
  pname = "utm";
-  version = "4.7.4";
+  version = "4.7.5";

  src = fetchurl {
    url = "https://github.com/utmapp/UTM/releases/download/v${version}/UTM.dmg";
-    hash = "sha256-4lnoH9FCrL3EWWNpmAEYz+XCxPSR7Za/W8YGxAXXms4=";
+    hash = "sha256-qENck8+1+Lv+6ksTTPrRrGa2djK3XkOMY7GorgQ77w4=";
  };

  nativeBuildInputs = [
@@ -19,11 +19,11 @@ buildNpmPackage rec {

  npmDepsHash = "sha256-LGgyMdhDQ4UwdtENZT/89yiQawn8SxKdth/p7evDAgk=";

-  meta = with lib; {
+  meta = {
    description = "Cross-platform UI framework CLI by Snapchat";
    homepage = "https://github.com/Snapchat/Valdi";
-    license = licenses.mit;
-    maintainers = with maintainers; [ jonasfranke ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ jonasfranke ];
    mainProgram = "valdi";
  };
 }
@@ -9,7 +9,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "visual-paradigm-ce";
-  version = "17.3.20251221";
+  version = "17.3.20260101";

  src =
    let
@@ -21,7 +21,7 @@ stdenv.mkDerivation (finalAttrs: {
      url = "https://eu10-dl.visual-paradigm.com/visual-paradigm/vpce${majorMinor}/${suffix}/Visual_Paradigm_CE_${
        builtins.replaceStrings [ "." ] [ "_" ] majorMinor
      }_${suffix}_Linux64_InstallFree.tar.gz";
-      hash = "sha256-N2REwBXhKBqyVPb9YfWCBSJfqFXDorsXvnHX+5gQrS4=";
+      hash = "sha256-RAujr6tws3HTyoZc6/MTbc5HEqyX9XmSl4IPJNayjQA=";
    };

  nativeBuildInputs = [
@@ -8,27 +8,26 @@
 }:
 let
  pname = "workout-tracker";
-  version = "2.4.1";
+  version = "2.5.1";

  src = fetchFromGitHub {
    owner = "jovandeginste";
    repo = "workout-tracker";
    tag = "v${version}";
-    hash = "sha256-MS4+dbJUh+oHWcQKe84VWW2e3hbZM4dgDWl6ZkFQkDo=";
+    hash = "sha256-S7rKa79w5Lqv8QBKNc8Zp35GOOBN4JnoNE7FNWsCzoY=";
  };

  assets = buildNpmPackage {
    pname = "${pname}-assets";
    inherit version src;
-    npmDepsHash = "sha256-kzHISDTACtqTJWyjMaXb5HtuM1oaBaSscDZl9EOuRV8=";
-    dontNpmBuild = true;
+    npmDepsHash = "sha256-vSFwCB5qbiHLiK0ns6YUj8yr3FjeNCqT8yvLRQzZycI=";
    makeCacheWritable = true;
    postPatch = ''
-      rm Makefile
+      cd frontend
    '';
    installPhase = ''
      runHook preInstall
-      cp -r . "$out"
+      cp -r ../assets "$out"
      runHook postInstall
    '';
  };
@@ -39,8 +38,8 @@ buildGoModule {
  vendorHash = null;

  postPatch = ''
-    ln -s ${assets}/node_modules ./node_modules
-    make build-dist
+    rm -r assets
+    ln -s ${assets} ./assets
  '';

  ldflags = [
@@ -52,6 +51,8 @@ buildGoModule {
    "-X main.gitRefName=v${version}"
  ];

+  __darwinAllowLocalNetworking = true;
+
  passthru.updateScript = nix-update-script { };

  passthru.tests = {
@@ -23,12 +23,12 @@ stdenv.mkDerivation rec {
    patchShebangs src/rcode/rcd_autogen
  '';

-  meta = with lib; {
+  meta = {
    description = "wxWidgets-based EDID (Extended Display Identification Data) editor";
    homepage = "https://sourceforge.net/projects/wxedid";
-    license = licenses.gpl3Only;
+    license = lib.licenses.gpl3Only;
    mainProgram = "wxedid";
-    maintainers = [ maintainers.meanwhile131 ];
+    maintainers = [ lib.maintainers.meanwhile131 ];
    platforms = lib.platforms.linux;
  };
 }
@@ -52,7 +52,7 @@ stdenv.mkDerivation (finalAttrs: {
  meta = {
    description = "Display battery status in X11";
    homepage = "https://salsa.debian.org/debian/xbattbar";
-    license = with lib; licenses.gpl2Plus;
+    license = lib.licenses.gpl2Plus;
    platforms = lib.platforms.linux;
    maintainers = with lib.maintainers; [ q3k ];
    mainProgram = "xbattbar";
@@ -13,15 +13,16 @@
  i3ipc-glib,
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
  pname = "xfce4-i3-workspaces-plugin";
-  version = "1.4.2";
+  version = "1.4.2-unstable-2025-05-28";

  src = fetchFromGitHub {
    owner = "denesb";
    repo = "xfce4-i3-workspaces-plugin";
-    rev = version;
-    sha256 = "sha256-CKpofupoJhe5IORJgij6gOGotB+dGkUDtTUdon8/JdE=";
+    # Fix build with GCC 15.
+    rev = "d7c2d978e736a5e07f96142a31fac3bb7d0806b4";
+    hash = "sha256-9xr9uoXjriVmFmotsaM/wVAaJA/k5Dl/SWsPo4skV2E=";
  };

  nativeBuildInputs = [
@@ -11,16 +11,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "zizmor";
-  version = "1.19.0";
+  version = "1.20.0";

  src = fetchFromGitHub {
    owner = "zizmorcore";
    repo = "zizmor";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-GWAjz/RYShjSFgQP1I3AxwVkiUJ9iwhT5R7UIHaLDuk=";
+    hash = "sha256-hLLse28YL0WU5mU2fYycALdS4X+pEBtumJjNEdIXRf0=";
  };

-  cargoHash = "sha256-Zd1lTUtfJf2p6MkscHgpEHvmLufnQYSWoYcQqn0ap+g=";
+  cargoHash = "sha256-7MnsBSoh1So5+LBEt/0efr9Q/BbIvP8QzsB+JCobsck=";

  buildInputs = [
    rust-jemalloc-sys
@@ -17,7 +17,7 @@ let
    }:
    stdenv.mkDerivation rec {
      inherit pname;
-      version = "7.6";
+      version = "7.9";
      src = fetchurl {
        url = "https://github.com/subframe7536/Maple-font/releases/download/v${version}/${pname}.zip";
        inherit hash;
@@ -1,46 +1,46 @@
 {
-  "MapleMono-CN-unhinted": "sha256-QnjRoW04WvGtgoKVm46U0Z0wImp2YVBdB/8LD37mfWk=",
-  "MapleMono-CN": "sha256-BF8VP6uZHgyuy/X0iie43jdJ6zyJUCXHlzHt6fOPEEQ=",
-  "MapleMono-NF-CN-unhinted": "sha256-8PSw/qGYXjpaazyY99bOQFbM+QOkJfizrmll8DTGwq8=",
-  "MapleMono-NF-CN": "sha256-q3wIvSszhOLyZkqvgvipQ2eEvG9K3Sf2o5hrpHS2vD8=",
-  "MapleMono-NF-unhinted": "sha256-7KEs6EtgfdO2DZIFGlHAWdIzKqKDaq7aRTG08HEYihw=",
-  "MapleMono-NF": "sha256-If/kKAFiyOs5NnxXeDOGsLSZRsCdhDmgOtP0SuN96pg=",
-  "MapleMono-OTF": "sha256-5XsHz8QsruS4oNfwazEfAWXSPr+mX+a5ayUPe5DF/nc=",
-  "MapleMono-TTF-AutoHint": "sha256-gmBHcBQk8GuWhdVF+TCB23Bh0raB5HVSwHNacVOScWM=",
-  "MapleMono-TTF": "sha256-n4kivPRcI80jEj7dRX3/SKyWHiBiiXXoY4jEV7eCSSI=",
-  "MapleMono-Variable": "sha256-8US2XL/RTIeWHatHeLv7/yWib5Vv7rdOyNC5qosRXw0=",
-  "MapleMono-Woff2": "sha256-f6khGfztBDMX8q7o9VlvLA2YikPoNDqxCf0KVxAR498=",
-  "MapleMonoNL-CN-unhinted": "sha256-qmtqUCoaWpqGIfIGOBlUU2WIm6vUOUP3S/SyUCCQSSE=",
-  "MapleMonoNL-CN": "sha256-rs5WcOBR9SYVsCFog6CY04RstSfZmbwo4HuwpeGw/V8=",
-  "MapleMonoNL-NF-CN-unhinted": "sha256-p8J1tiBXxus2xTvV884QjT8N19vV/uIlz/bCIIGCUp0=",
-  "MapleMonoNL-NF-CN": "sha256-aDutuElaeOrcKBjNxi096SEylvsSHVe5Fmcj3yoT19M=",
-  "MapleMonoNL-NF-unhinted": "sha256-fcAQa79JDpxB6A4bAGpY5K9RZhVTmoVnyHx72pRtHxE=",
-  "MapleMonoNL-NF": "sha256-HZByDLhGkJPDV7t0LXsINLDMYKso19bJD72MiWU/8N4=",
-  "MapleMonoNL-OTF": "sha256-4zjWL0g7BubP8lVswUe4nPuLHV0rBsAHD/TwmROVXdI=",
-  "MapleMonoNL-TTF-AutoHint": "sha256-9Q4MdpzfiTZB9QFbH3K2O66hkEQmJdgjPRA1iGG51yc=",
-  "MapleMonoNL-TTF": "sha256-PM5Dy1lU5MX5nilxHA34x5jBNYp4m8BknJ/aHrprxpY=",
-  "MapleMonoNL-Variable": "sha256-jvUfLi+DLTCHkdNuKMgcVp49MMeRiVVjwdIVXNKOaYc=",
-  "MapleMonoNL-Woff2": "sha256-SOCpyCMfXS9atPD2g58dTK67M61rJkoYOIolveCjVYY=",
-  "MapleMonoNormal-CN-unhinted": "sha256-X6cnYCp2V7pNLxeYE7BmxQncOfes6Vl4TTpONb10xrI=",
-  "MapleMonoNormal-CN": "sha256-FmZt06ZgRWTRemGMzxkQjU9B26FSQsAFXLc8b/Hv1Ko=",
-  "MapleMonoNormal-NF-CN-unhinted": "sha256-uRJEJVkcoAyK85V788UU29R9lH9Vuw9RbsrrSEOzdMU=",
-  "MapleMonoNormal-NF-CN": "sha256-nXENizBJawD/UgrYUNP9mU8m2mt9KH2Sy6vQeXFOmNI=",
-  "MapleMonoNormal-NF-unhinted": "sha256-qIDYALvHBz8g3V4/jaVAEz5ZIgfNSkLqrVv/AT6pRPM=",
-  "MapleMonoNormal-NF": "sha256-xWAhVQl9xsKXTJWNCfPBUV6gdHhmf9WUUrAYk2erTM0=",
-  "MapleMonoNormal-OTF": "sha256-EU4/dvUR68LaM/je41IyXTQyDxroJUTQ6GvkcaTHsSw=",
-  "MapleMonoNormal-TTF-AutoHint": "sha256-N7DM6nzYRi2zGXMlvc9FmwcWMLvC1bq1AULzsZu0c9E=",
-  "MapleMonoNormal-TTF": "sha256-HRy0W3srGzO54/VxFk+7q6m0iXFHcii47+Tcxz2RkzI=",
-  "MapleMonoNormal-Variable": "sha256-CE1XGv0AlbXRW9uRzXKN4pcQHqK4gtoOQyYLM3S4QZo=",
-  "MapleMonoNormal-Woff2": "sha256-tUvhscxn9r8P8DSJPMRmmUhIB7Owv5fI3fYCYP3CWtg=",
-  "MapleMonoNormalNL-CN-unhinted": "sha256-XT7cnDJsjNm8OFPqnBWMargcaWo9nl77K+4+DHuYZ4w=",
-  "MapleMonoNormalNL-CN": "sha256-6okDLMwtXgIiHfSapwKPk7ZKSSxGTBHFzg5STmgTO9Q=",
-  "MapleMonoNormalNL-NF-CN-unhinted": "sha256-6xQPEAlMjEFb0BaTSqC/4QfCcZYD8uUYMDOgGVFqdrs=",
-  "MapleMonoNormalNL-NF-CN": "sha256-z1xQa89ex5M4fOnl30Ay0O+eVpuP5644OpRVwE4s8qo=",
-  "MapleMonoNormalNL-NF-unhinted": "sha256-7BBO3nUUxFf/Nd1CWBukNjGIhc5MmvB8R7B5V0nTJ6I=",
-  "MapleMonoNormalNL-NF": "sha256-yd8HUSmsTq2RdTNaK0gkh8WpPfuf93vMUD9SZOU415s=",
-  "MapleMonoNormalNL-OTF": "sha256-nNbOJeqWG55IXWmShMMb2YTrjQe5Yz5A0y2zwwV9irI=",
-  "MapleMonoNormalNL-TTF-AutoHint": "sha256-/Dpk7Hb7h/VCU5dHR8AyVrrJTGNHHB6OMY85eJNhMhU=",
-  "MapleMonoNormalNL-TTF": "sha256-ydFuYEgK8o57s67lK1ZAxwTBpuM7fHFGZamQh7YmZcI=",
-  "MapleMonoNormalNL-Variable": "sha256-KcWDxyp2/kdehiL3/eE1I33so+pR7iFl4zSsKSygsWE=",
-  "MapleMonoNormalNL-Woff2": "sha256-f5MaDdfaBgxeR0rGlBr6LrCqyPalZjc2ffUVarD24aw="
+  "MapleMono-CN-unhinted": "sha256-1By3JyHpnP5PvRp7DxgqATRX3kaqYSAY+STdAkaZ07k=",
+  "MapleMono-CN": "sha256-yx55ssI9/3cq41F4TvK4RFSmGzkg6bIL1dtL8gfkRy0=",
+  "MapleMono-NF-CN-unhinted": "sha256-q4hSKTLPQBXf/q723txZoipf7+zcxuWD2fzZl9pbfKw=",
+  "MapleMono-NF-CN": "sha256-r5E7YyKQU0iz9Q5Dl/7cNbOogNte/8znlpADBR3NPpQ=",
+  "MapleMono-NF-unhinted": "sha256-gkjWJgZgvhBmtevpDSUTFYLfg4PzjbHChN0fLcnStG4=",
+  "MapleMono-NF": "sha256-WQmLh8iV2HFjXTdoDogACuKysltVQoGVsijsWJ41+4k=",
+  "MapleMono-OTF": "sha256-7PR7hRrkABsAVkOZURr43JYVM5066d7VToVH1tGtPaE=",
+  "MapleMono-TTF-AutoHint": "sha256-yDtFoH3Nzqy9SZhqhitW9g8xyLl2VG+uoaPyuj26QDU=",
+  "MapleMono-TTF": "sha256-OjX48Gab7z3e2d8gjMRSam91cyEOE0gW6QhKiYEnHXU=",
+  "MapleMono-Variable": "sha256-ueV2d8xOwGnOF4vZZdZs0UvSbBLjfYnXhv+Vkzm/jJM=",
+  "MapleMono-Woff2": "sha256-XjjoOwB+cVfCU8P1fApvgEFTePSFnUPrPPSx2FgAFoE=",
+  "MapleMonoNL-CN-unhinted": "sha256-gL9tuJILKZnZAOCPnlAx92hrrrctvbgIkfLBrpzsYG8=",
+  "MapleMonoNL-CN": "sha256-/Vpcmg3MBLNWta2pe5Imac7AnUfzLHiGq+PLLam0NkM=",
+  "MapleMonoNL-NF-CN-unhinted": "sha256-bTCsaUJyaltTEXyC5rN4FErAKmKo5rKHArlh24Y5Csk=",
+  "MapleMonoNL-NF-CN": "sha256-YQPTpz0Ald5rNOcJ8+yvEUfjWrdxfAMGjgfAuwqO+i4=",
+  "MapleMonoNL-NF-unhinted": "sha256-a3HytphxXBmdYH+nKbvEcqKYwQcvW1xRX3ykBX/OYAk=",
+  "MapleMonoNL-NF": "sha256-9rLG0ZgcozhylEnboMrwe6BXUe3R1LR0tG17MWs8DbM=",
+  "MapleMonoNL-OTF": "sha256-BZ4gVgTqrvxm8ECuwY9w7WLawY5Fq01g4DhHIUZD7wU=",
+  "MapleMonoNL-TTF-AutoHint": "sha256-rY2oGaoCVK84agd+OaNHZXqoxu/1WF4mEx9jcyGiq38=",
+  "MapleMonoNL-TTF": "sha256-L39wKhIc2RB1GEnd529DHYGlvhYYUH9XJGBtMUcCi4g=",
+  "MapleMonoNL-Variable": "sha256-v8LYpGBQ6Nc9p8CaWbrawexuvSz/Z4NUj5AFzlQluE8=",
+  "MapleMonoNL-Woff2": "sha256-7mjuolU/srX/+6abV+y15bpd1hMnhUhckA4+aA7X0iE=",
+  "MapleMonoNormal-CN-unhinted": "sha256-Sw23bRf9ED1lSGIoegf4O3xUeZFyixRRIq2kIB/Zqo0=",
+  "MapleMonoNormal-CN": "sha256-DulVez9MlFZLZnpF7p+yKBj4gNh78XBofHs9AVHFhMs=",
+  "MapleMonoNormal-NF-CN-unhinted": "sha256-pP+Bq2LsS+uwp+vNA1KJ/txVGKTy9j3JeBQfZ9GfGBw=",
+  "MapleMonoNormal-NF-CN": "sha256-JK6xTtdW14sRLmaS6gLGaeFq+qDwHnv9uzfS5j+kX6c=",
+  "MapleMonoNormal-NF-unhinted": "sha256-bjAfckcoVuGy8vkdJSKka0G2rgwUyY7IIDLb/B2CC8k=",
+  "MapleMonoNormal-NF": "sha256-3xwaXueEwooa0iiuEzXTu4I5rEg9udt/O6mGEE4Gl3I=",
+  "MapleMonoNormal-OTF": "sha256-aVSCsamEDYfh+yU2e7R4zcULFWYQX7q1QC1KoA87sPo=",
+  "MapleMonoNormal-TTF-AutoHint": "sha256-1MeM5hxkmVoM58MGY14xsCfveFETEJrL2amWf5yHeyI=",
+  "MapleMonoNormal-TTF": "sha256-OUuyK1d+L+PQmHeNSxe77ly7c833FTYyULuEe9cbh38=",
+  "MapleMonoNormal-Variable": "sha256-1ud9zOHF1oY2OS/U13pCLnRgLDH0Zd5j1eIiMB/F9jc=",
+  "MapleMonoNormal-Woff2": "sha256-MZcyS34l1rw+d9wNWXjxmm1kmjsvTLgwisPGDLkR5Dw=",
+  "MapleMonoNormalNL-CN-unhinted": "sha256-pUPwGnmNaz8DZ7EiEBuc77FpCgB+mA3ueZXl0I5ynUU=",
+  "MapleMonoNormalNL-CN": "sha256-IOMfTCGI4tqFGQSKkrPMBBPrAuO7lgxflKx8Za0Kni0=",
+  "MapleMonoNormalNL-NF-CN-unhinted": "sha256-G9a0vjBi5u8rSqpE4ETQXvpFAa/TxCNnhCFUvbA2fQs=",
+  "MapleMonoNormalNL-NF-CN": "sha256-r4CCxITLEQPabC76S3b0A/40L5o6yB/2ZbjGxmwviGM=",
+  "MapleMonoNormalNL-NF-unhinted": "sha256-30H37xTIqrjHNhjzyEcffdlO+ysbAolCPVTjJG3QIus=",
+  "MapleMonoNormalNL-NF": "sha256-OmZHjJaa0334tHz2fAZPxNQ6/a03bMcbScCdGMDXGeQ=",
+  "MapleMonoNormalNL-OTF": "sha256-WdtNGfp/kUZIUjsEovVc4TXALObDFibSN/thhDlcLfU=",
+  "MapleMonoNormalNL-TTF-AutoHint": "sha256-mxh+2EXBoaZWKywmSRSiRaMUU53Z67MJwjilZUnJ6As=",
+  "MapleMonoNormalNL-TTF": "sha256-XbJKKE0tBOUnp3WkfUGBaesdEWWBj/VGWVNLwGt9Yec=",
+  "MapleMonoNormalNL-Variable": "sha256-+nQjxTd6WH0gCCCUMa4Wr6pJzufddcpwxsf4YyykhLk=",
+  "MapleMonoNormalNL-Woff2": "sha256-b9bIZoZX1LVfEIoRXln6eggXV/KfWZ6/wwqFWLhXJb8="
 }
@@ -8,13 +8,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "llef";
-  version = "2.0.0";
+  version = "2.2.1";

  src = fetchFromGitHub {
    owner = "foundryzero";
    repo = "llef";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-pAFjLaZi4Sjlq3evKT2IG+0/imf4Fp5bM2gknLKpRvs=";
+    hash = "sha256-PqPsZNLiKW1czxfpJMNnQbdak37WbGc7Otq1uU6wXqc=";
  };

  dontBuild = true;
@@ -118,9 +118,11 @@ stdenv.mkDerivation (
      ++ optional noNakedPointers (flags "--disable-naked-pointers" "-no-naked-pointers");
    dontAddStaticConfigureFlags = lib.versionOlder version "4.08";

-    env = lib.optionalAttrs (lib.versionOlder version "4.14") {
-      NIX_CFLAGS_COMPILE = "-std=gnu11";
-    };
+    env =
+      lib.optionalAttrs (lib.versionOlder version "4.14" || lib.versions.majorMinor version == "5.0")
+        {
+          NIX_CFLAGS_COMPILE = "-std=gnu11";
+        };

    # on aarch64-darwin using --host and --target causes the build to invoke
    # `aarch64-apple-darwin-clang` while using assembler. However, such binary
@@ -7,7 +7,6 @@
  version ? null,
 }:

-with lib;
 mkCoqDerivation {
  pname = "ElmExtraction";
  repo = "coq-elm-extraction";
@@ -25,14 +24,13 @@ mkCoqDerivation {
        inherit out;
      };
    in
-    with versions;
-    switch
+    lib.switch
      [
        coq.coq-version
        metacoq.version
      ]
      [
-        (case (range "8.17" "9.0") (range "1.3.1" "1.3.4") "0.1.1")
+        (case (lib.versions.range "8.17" "9.0") (lib.versions.range "1.3.1" "1.3.4") "0.1.1")
      ]
      null;

@@ -50,7 +48,7 @@ mkCoqDerivation {

  meta = {
    description = "Framework for extracting Coq programs to Elm";
-    maintainers = with maintainers; [ _4ever2 ];
-    license = licenses.mit;
+    maintainers = with lib.maintainers; [ _4ever2 ];
+    license = lib.licenses.mit;
  };
 }
@@ -7,7 +7,6 @@
  version ? null,
 }:

-with lib;
 mkCoqDerivation {
  pname = "RustExtraction";
  repo = "coq-rust-extraction";
@@ -24,9 +23,9 @@ mkCoqDerivation {
        ];
        inherit out;
      };
+      inherit (lib.versions) range;
    in
-    with versions;
-    switch
+    lib.switch
      [
        coq.coq-version
        metacoq.version
@@ -56,7 +55,7 @@ mkCoqDerivation {

  meta = {
    description = "Framework for extracting Coq programs to Rust";
-    maintainers = with maintainers; [ _4ever2 ];
-    license = licenses.mit;
+    maintainers = with lib.maintainers; [ _4ever2 ];
+    license = lib.licenses.mit;
  };
 }
@@ -5,7 +5,6 @@
  version ? null,
 }:

-with lib;
 let
  derivation = mkCoqDerivation {
    pname = "parseque";
@@ -17,9 +16,8 @@ let
      let
        case = case: out: { inherit case out; };
      in
-      with versions;
-      switch coq.coq-version [
-        (case (range "8.16" "8.20") "0.2.2")
+      lib.switch coq.coq-version [
+        (case (lib.versions.range "8.16" "8.20") "0.2.2")
      ] null;

    release."0.2.2".sha256 = "sha256-O50Rs7Yf1H4wgwb7ltRxW+7IF0b04zpfs+mR83rxT+E=";
@@ -28,8 +26,8 @@ let

    meta = {
      description = "Total parser combinators in Coq/Rocq";
-      maintainers = with maintainers; [ womeier ];
-      license = licenses.mit;
+      maintainers = with lib.maintainers; [ womeier ];
+      license = lib.licenses.mit;
    };
  };
 in
@@ -77,16 +77,14 @@ ocamlPackages.buildDunePackage {
    ppx_optcomp
  ]);

-  meta =
-    with lib;
-    {
-      description = "Language server for the vscoq vscode/codium extension";
-      homepage = "https://github.com/coq-community/vscoq";
-      maintainers = with lib.maintainers; [ cohencyril ];
-      license = lib.licenses.mit;
-    }
-    // optionalAttrs (fetched.broken or false) {
-      coqFilter = true;
-      broken = true;
-    };
+  meta = {
+    description = "Language server for the vscoq vscode/codium extension";
+    homepage = "https://github.com/coq-community/vscoq";
+    maintainers = with lib.maintainers; [ cohencyril ];
+    license = lib.licenses.mit;
+  }
+  // lib.optionalAttrs (fetched.broken or false) {
+    coqFilter = true;
+    broken = true;
+  };
 }
@@ -11,7 +11,6 @@
  version ? null,
 }:

-with lib;
 mkCoqDerivation {
  pname = "wasm";
  repo = "WasmCert-Coq";
@@ -28,11 +27,10 @@ mkCoqDerivation {
        inherit out;
      };
    in
-    with lib.versions;
    lib.switch
      [ coq.coq-version mathcomp-boot.version ]
      [
-        (case (range "8.20" "9.0") (isGe "2.4") "2.2.0")
+        (case (lib.versions.range "8.20" "9.0") (lib.versions.isGe "2.4") "2.2.0")
      ]
      null;

@@ -62,7 +60,7 @@ mkCoqDerivation {

  meta = {
    description = "Wasm mechanisation in Coq/Rocq";
-    maintainers = with maintainers; [ womeier ];
-    license = licenses.mit;
+    maintainers = with lib.maintainers; [ womeier ];
+    license = lib.licenses.mit;
  };
 }
@@ -1,5 +1,6 @@
 {
  lib,
+  ocaml,
  buildDunePackage,
  fetchurl,
  mdx,
@@ -16,7 +17,7 @@ buildDunePackage rec {
    hash = "sha256-fY1j9FODVnifwsI8qkKm0QSmssgWqYFXJ7y8o7/KmEY=";
  };

-  doCheck = true;
+  doCheck = lib.versionAtLeast ocaml.version "5.1";

  checkInputs = [
    mdx
@@ -1,4 +1,6 @@
 {
+  lib,
+  ocaml,
  buildDunePackage,
  dolmen,
  dolmen_type,
@@ -11,6 +13,17 @@ buildDunePackage {
  pname = "dolmen_loop";
  inherit (dolmen) src version;

+  env =
+    # Fix build with gcc15
+    lib.optionalAttrs
+      (
+        lib.versionAtLeast ocaml.version "4.10" && lib.versionOlder ocaml.version "4.14"
+        || lib.versions.majorMinor ocaml.version == "5.0"
+      )
+      {
+        NIX_CFLAGS_COMPILE = "-std=gnu11";
+      };
+
  propagatedBuildInputs = [
    dolmen
    dolmen_type
@@ -1,5 +1,6 @@
 {
  lib,
+  ocaml,
  buildDunePackage,
  fetchurl,
  alcotest,
@@ -14,6 +15,11 @@ buildDunePackage rec {

  minimalOCamlVersion = "5.0";

+  # Fix build with gcc15
+  env = lib.optionalAttrs (lib.versions.majorMinor ocaml.version == "5.0") {
+    NIX_CFLAGS_COMPILE = "-std=gnu11";
+  };
+
  src = fetchurl {
    url = "https://github.com/ocaml-multicore/${pname}/releases/download/${version}/${pname}-${version}.tbz";
    hash = "sha256-KVIRPFPLB+KwVLLchs5yk5Ex2rggfI8xOa2yPmTN+m8=";
@@ -28,7 +28,7 @@ buildDunePackage rec {
    thread-table
  ];

-  doCheck = lib.versionAtLeast ocaml.version "5.0";
+  doCheck = lib.versionAtLeast ocaml.version "5.1";
  nativeCheckInputs = [ mdx.bin ];
  checkInputs = [
    alcotest
--- a/Show More
+++ b/Show More