Merge remote-tracking branch 'origin/master' into staging-nixos

2026-01-27 21:15:07 +03:00
parent 385af37993 885dfe3960
commit 230e0e4cbd
79 changed files with 673 additions and 816 deletions
@@ -453,10 +453,13 @@ jobs:
      - name: Install Nix
        uses: cachix/install-nix-action@4e002c8ec80594ecd40e759629461e26c8abed15 # v31

-      - name: Run misc eval tasks in parallel
+      - name: Ensure flake outputs on all systems still evaluate
+        run: nix flake check --all-systems --no-build './nixpkgs/untrusted?shallow=1'
+
+      - name: Query nixpkgs with aliases enabled to check for basic syntax errors
        run: |
-          # Ensure flake outputs on all systems still evaluate
-          nix flake check --all-systems --no-build './nixpkgs/untrusted?shallow=1' &
-          # Query nixpkgs with aliases enabled to check for basic syntax errors
-          nix-env -I ./nixpkgs/untrusted -f ./nixpkgs/untrusted -qa '*' --option restrict-eval true --option allow-import-from-derivation false >/dev/null &
-          wait
+          time nix-env -I ./nixpkgs/untrusted -f ./nixpkgs/untrusted -qa '*' --option restrict-eval true --option allow-import-from-derivation false >/dev/null
+
+      - name: Ensure NixOS modules meta is valid
+        run: |
+          time nix-instantiate -I ./nixpkgs/untrusted --strict --eval --json ./nixpkgs/untrusted/nixos --arg configuration '{}' --attr config.meta --option restrict-eval true --option allow-import-from-derivation false
@@ -36,7 +36,7 @@
 /maintainers/computed-team-list.nix @infinisil
 ## Standard environment–related libraries
 /lib/customisation.nix      @alyssais @NixOS/stdenv
-/lib/derivations.nix        @alyssais @NixOS/stdenv
+/lib/derivations.nix        @NixOS/stdenv
 /lib/fetchers.nix           @alyssais @NixOS/stdenv
 /lib/meta.nix               @alyssais @NixOS/stdenv
 /lib/source-types.nix       @alyssais @NixOS/stdenv
@@ -8,7 +8,7 @@
 let
  cfg = config.security.run0;

-  sudoAlias = pkgs.writeScriptBin "sudo" ''
+  sudoAlias = pkgs.writeShellScriptBin "sudo" ''
    if [[ "$1" == -* ]]; then
      echo "This script is a sudo-alias to systemd's run0 and does not support any sudo parameters."
      exit 1
@@ -1254,6 +1254,10 @@ in
    inherit runTest;
    php = pkgs.php84;
  };
+  php85 = import ./php/default.nix {
+    inherit runTest;
+    php = pkgs.php85;
+  };
  phylactery = runTest ./web-apps/phylactery.nix;
  pict-rs = runTest ./pict-rs.nix;
  pihole-ftl = import ./pihole-ftl { inherit runTest; };
@@ -40,8 +40,15 @@ let
      nodes.server =
        { ... }:
        {
-          system.activationScripts = {
-            keyPlacement.text = ''
+          systemd.services.create-keys = {
+            wantedBy = [ "postgresql.target" ];
+
+            serviceConfig = {
+              Type = "oneshot";
+              RemainAfterExit = true;
+            };
+
+            script = ''
              mkdir -p '${serverKeyPath}'
              cp '${serverKey}' '${serverKeyPath}/server.key'
              chown postgres:postgres '${serverKeyPath}/server.key'
@@ -85,8 +92,15 @@ let
      nodes.client =
        { ... }:
        {
-          system.activationScripts = {
-            keyPlacement.text = ''
+          systemd.services.create-keys = {
+            wantedBy = [ "multi-user.target" ];
+
+            serviceConfig = {
+              Type = "oneshot";
+              RemainAfterExit = true;
+            };
+
+            script = ''
              mkdir -p '${clientKeyPath}'
              cp '${clientKey}' '${clientKeyPath}/client.key'
              chown root:root '${clientKeyPath}/client.key'
@@ -92,63 +92,27 @@ in
  plugins = callPackage ./plugins { };
 }

-// lib.optionalAttrs config.allowAliases rec {
+// lib.optionalAttrs config.allowAliases {

  # Deprecated products and aliases.

-  aqua =
-    lib.warnOnInstantiate
-      "jetbrains.aqua: Aqua has been discontinued by Jetbrains and is not receiving updates. It will be removed in NixOS 26.05."
-      (mkBinIde ./ides/aqua.nix { });
+  aqua = throw "jetbrains.aqua: Aqua has been removed as it has been discontinued by JetBrains";

-  idea-community =
-    lib.warnOnInstantiate
-      "jetbrains.idea-community: IntelliJ IDEA Community has been discontinued by Jetbrains. This deprecated alias uses the, no longer updated, binary build on Darwin & Linux aarch64. On other platforms it uses IDEA Open Source, built from source. Either switch to 'jetbrains.idea-oss' or 'jetbrains.idea'. See: https://blog.jetbrains.com/idea/2025/07/intellij-idea-unified-distribution-plan/"
-      (
-        if stdenv.hostPlatform.isDarwin || stdenv.hostPlatform.isAarch64 then
-          idea-community-bin
-        else
-          _idea-oss
-      );
+  idea-community = throw "jetbrains.idea-community: IntelliJ IDEA Community has been removed as it has been discontinued by JetBrains. Either switch to 'jetbrains.idea-oss' or 'jetbrains.idea'. See: https://blog.jetbrains.com/idea/2025/07/intellij-idea-unified-distribution-plan/";

-  idea-community-bin =
-    lib.warnOnInstantiate
-      "jetbrains.idea-community-bin: IntelliJ IDEA Community has been discontinued by Jetbrains. This binary build is no longer updated. Switch to 'jetbrains.idea-oss' for open source builds (from source) or 'jetbrains.idea' for commercial builds (binary, unfree). See: https://blog.jetbrains.com/idea/2025/07/intellij-idea-unified-distribution-plan/"
-      (mkBinIde ./ides/idea-community.nix { });
+  idea-community-bin = throw "jetbrains.idea-community-bin: IntelliJ IDEA Community has been removed as it has been discontinued by JetBrains. Either switch to 'jetbrains.idea-oss' or 'jetbrains.idea'. See: https://blog.jetbrains.com/idea/2025/07/intellij-idea-unified-distribution-plan/";

-  idea-ultimate =
-    lib.warnOnInstantiate "'jetbrains.idea-ultimate' has been renamed to/replaced by 'jetbrains.idea'"
-      (mkBinIde ./ides/idea.nix { });
+  idea-community-src = throw "jetbrains.idea-community-src: IntelliJ IDEA Community has been removed as it has been discontinued by JetBrains. Either switch to 'jetbrains.idea-oss' or 'jetbrains.idea'. See: https://blog.jetbrains.com/idea/2025/07/intellij-idea-unified-distribution-plan/";

-  idea-community-src = lib.warnOnInstantiate "jetbrains.idea-community-src: IntelliJ IDEA Community has been discontinued by Jetbrains. This is now an alias for 'jetbrains.idea-oss', the Open Source build of IntelliJ. See: https://blog.jetbrains.com/idea/2025/07/intellij-idea-unified-distribution-plan/" _idea-oss;
+  idea-ultimate = throw "'jetbrains.idea-ultimate' has been renamed to/replaced by 'jetbrains.idea'";

-  pycharm-community =
-    lib.warnOnInstantiate
-      "pycharm-community: PyCharm Community has been discontinued by Jetbrains. This deprecated alias uses the, no longer updated, binary build on Darwin. On Linux it uses PyCharm Open Source, built from source. Either switch to 'jetbrains.pycharm-oss' or 'jetbrains.pycharm'. See: https://blog.jetbrains.com/pycharm/2025/04/pycharm-2025"
-      (
-        if stdenv.hostPlatform.isDarwin then
-          pycharm-community-bin
-        else
-          (mkSrcIde ./ides/pycharm-oss.nix { inherit pyCharmCommonOverrides; })
-      );
+  pycharm-community = throw "jetbrains.pycharm-community: PyCharm Community has been removed as it has been discontinued by JetBrains. Either switch to 'jetbrains.pycharm-oss' or 'jetbrains.pycharm'. See: https://blog.jetbrains.com/pycharm/2025/04/pycharm-2025";

-  pycharm-community-bin =
-    lib.warnOnInstantiate
-      "pycharm-community-bin: PyCharm Community has been discontinued by Jetbrains. This binary build is no longer updated. Switch to 'jetbrains.pycharm-oss' for open source builds (from source) or 'jetbrains.pycharm' for commercial builds (binary, unfree). See: https://blog.jetbrains.com/pycharm/2025/04/pycharm-2025"
-      (mkBinIde ./ides/pycharm-community.nix { inherit pyCharmCommonOverrides; });
+  pycharm-community-bin = throw "jetbrains.pycharm-community-bin: PyCharm Community has been removed as it has been discontinued by JetBrains. Either switch to 'jetbrains.pycharm-oss' or 'jetbrains.pycharm'. See: https://blog.jetbrains.com/pycharm/2025/04/pycharm-2025";

-  pycharm-community-src =
-    lib.warnOnInstantiate
-      "jetbrains.idea-community-src: PyCharm Community has been discontinued by Jetbrains. This is now an alias for 'jetbrains.pycharm-oss', the Open Source build of PyCharm. See: https://blog.jetbrains.com/pycharm/2025/04/pycharm-2025"
-      (mkSrcIde ./ides/pycharm-oss.nix { inherit pyCharmCommonOverrides; });
+  pycharm-community-src = throw "jetbrains.pycharm-community-src: PyCharm Community has been removed as it has been discontinued by JetBrains. Either switch to 'jetbrains.pycharm-oss' or 'jetbrains.pycharm'. See: https://blog.jetbrains.com/pycharm/2025/04/pycharm-2025";

-  pycharm-professional =
-    lib.warnOnInstantiate
-      "'jetbrains.pycharm-professional' has been renamed to/replaced by 'jetbrains.pycharm'"
-      (mkBinIde ./ides/pycharm.nix { inherit pyCharmCommonOverrides; });
+  pycharm-professional = throw "'jetbrains.pycharm-professional' has been renamed to/replaced by 'jetbrains.pycharm'";

-  writerside =
-    lib.warnOnInstantiate
-      "jetbrains.writerside: Writerside has been discontinued by Jetbrains and is not receiving updates. It will be removed in NixOS 26.05."
-      (mkBinIde ./ides/writerside.nix { });
+  writerside = throw "jetbrains.writerside: Writerside has been removed as it has been discontinued by JetBrains";
 }
@@ -1,66 +0,0 @@
-# TODO: This IDE is deprecated and scheduled for removal in 26.05
-{
-  stdenv,
-  lib,
-  fetchurl,
-  mkJetBrainsProduct,
-  libdbm,
-  fsnotifier,
-  lldb,
-}:
-let
-  system = stdenv.hostPlatform.system;
-  # update-script-start: urls
-  urls = {
-    x86_64-linux = {
-      url = "https://download.jetbrains.com/aqua/aqua-2024.3.2.tar.gz";
-      sha256 = "de073e8a3734a2c4ef984b3e1bd68f5de72a6180e73400889510439ac3f419aa";
-    };
-    aarch64-linux = {
-      url = "https://download.jetbrains.com/aqua/aqua-2024.3.2-aarch64.tar.gz";
-      sha256 = "d2a3c781756a83ccea63dc6d9aebf85f819de1edb5bcd4e5a1a161eaa0779c84";
-    };
-    x86_64-darwin = {
-      url = "https://download.jetbrains.com/aqua/aqua-2024.3.2.dmg";
-      sha256 = "423d492e9849beb7edbbd1771650a04e8df9f469bf1789b41bc5878c84cee393";
-    };
-    aarch64-darwin = {
-      url = "https://download.jetbrains.com/aqua/aqua-2024.3.2-aarch64.dmg";
-      sha256 = "43974cdbbb71aaf5bfcfaf2cfd0e69e9920dda3973e64671936c1d52b267494d";
-    };
-  };
-  # update-script-end: urls
-in
-mkJetBrainsProduct {
-  inherit libdbm fsnotifier;
-
-  pname = "aqua";
-
-  wmClass = "jetbrains-aqua";
-  product = "Aqua";
-
-  # update-script-start: version
-  version = "2024.3.2";
-  buildNumber = "243.23654.154";
-  # update-script-end: version
-
-  src = fetchurl (urls.${system} or (throw "Unsupported system: ${system}"));
-
-  buildInputs = [
-    lldb
-  ];
-
-  # NOTE: meta attrs are currently used by the desktop entry, so changing them may cause rebuilds (see TODO in README)
-  meta = {
-    homepage = "https://www.jetbrains.com/aqua/";
-    description = "Test automation IDE from JetBrains";
-    longDescription = "Aqua is a test automation IDE from jetbrains that can deal with many languages and frameworks to improve your test workflows. Has support for popular testing frameworks like Selenium, Cypress, and Playwright.";
-    maintainers = with lib.maintainers; [ remcoschrijver ];
-    license = lib.licenses.unfree;
-    sourceProvenance =
-      if stdenv.hostPlatform.isDarwin then
-        [ lib.sourceTypes.binaryNativeCode ]
-      else
-        [ lib.sourceTypes.binaryBytecode ];
-  };
-}
@@ -1,69 +0,0 @@
-# TODO: This IDE is deprecated and scheduled for removal in 26.05
-{
-  stdenv,
-  lib,
-  fetchurl,
-  mkJetBrainsProduct,
-  libdbm,
-  fsnotifier,
-  maven,
-  zlib,
-}:
-let
-  system = stdenv.hostPlatform.system;
-  # update-script-start: urls
-  urls = {
-    x86_64-linux = {
-      url = "https://download.jetbrains.com/idea/ideaIC-2025.2.5.tar.gz";
-      sha256 = "995c334cc3e143f13467abafef07a1ccf7d06275512bb6f4c91123948786ab7c";
-    };
-    aarch64-linux = {
-      url = "https://download.jetbrains.com/idea/ideaIC-2025.2.5-aarch64.tar.gz";
-      sha256 = "4c57a783f31ee6f2c82d8c43bb5d0334a9afbc8bfb4542e732048c41f61e63a0";
-    };
-    x86_64-darwin = {
-      url = "https://download.jetbrains.com/idea/ideaIC-2025.2.5.dmg";
-      sha256 = "ff48a1e60869342a91db867fa482a49d4cdf38476496911c109f34a7e8d6523d";
-    };
-    aarch64-darwin = {
-      url = "https://download.jetbrains.com/idea/ideaIC-2025.2.5-aarch64.dmg";
-      sha256 = "52065492d433f0ea9df4debd5f0683154ab4dab5846394cabc8a49903d70e5bc";
-    };
-  };
-  # update-script-end: urls
-in
-mkJetBrainsProduct {
-  inherit libdbm fsnotifier;
-
-  pname = "idea-community";
-
-  wmClass = "jetbrains-idea-ce";
-  product = "IntelliJ IDEA CE";
-  productShort = "IDEA";
-
-  # update-script-start: version
-  version = "2025.2.5";
-  buildNumber = "252.28238.7";
-  # update-script-end: version
-
-  src = fetchurl (urls.${system} or (throw "Unsupported system: ${system}"));
-
-  extraLdPath = [ zlib ];
-  extraWrapperArgs = [
-    ''--set M2_HOME "${maven}/maven"''
-    ''--set M2 "${maven}/maven/bin"''
-  ];
-
-  # NOTE: meta attrs are currently used by the desktop entry, so changing them may cause rebuilds (see TODO in README)
-  meta = {
-    homepage = "https://www.jetbrains.com/idea/";
-    description = "Free Java, Kotlin, Groovy and Scala IDE from Jetbrains (built from source)";
-    longDescription = "IDE for Java SE, Groovy & Scala development Powerful environment for building Google Android apps Integration with JUnit, TestNG, popular SCMs, Ant & Maven. Also known as IntelliJ.";
-    maintainers = with lib.maintainers; [
-      gytis-ivaskevicius
-      tymscar
-    ];
-    license = lib.licenses.asl20;
-    sourceProvenance = [ lib.sourceTypes.fromSource ];
-  };
-}
@@ -1,62 +0,0 @@
-# TODO: This IDE is deprecated and scheduled for removal in 26.05
-{
-  stdenv,
-  lib,
-  fetchurl,
-  mkJetBrainsProduct,
-  libdbm,
-  fsnotifier,
-  pyCharmCommonOverrides,
-}:
-let
-  system = stdenv.hostPlatform.system;
-  # update-script-start: urls
-  urls = {
-    x86_64-linux = {
-      url = "https://download.jetbrains.com/python/pycharm-community-2025.2.5.tar.gz";
-      sha256 = "7f49a014f53f0f6f7c46f6710b131f390302287f4046b606331d88081cdb551f";
-    };
-    aarch64-linux = {
-      url = "https://download.jetbrains.com/python/pycharm-community-2025.2.5-aarch64.tar.gz";
-      sha256 = "67b61a3e788b043d93b3cc3e0dd3cea350e6d170402fd94adaf792cfc57e5462";
-    };
-    x86_64-darwin = {
-      url = "https://download.jetbrains.com/python/pycharm-community-2025.2.5.dmg";
-      sha256 = "08ba97a278031ff1942ddefb18d8acf7582f0bb4a28ccdf5d65721bfb80ca456";
-    };
-    aarch64-darwin = {
-      url = "https://download.jetbrains.com/python/pycharm-community-2025.2.5-aarch64.dmg";
-      sha256 = "040a4ed6bb7563972d844c450f615d0d11385e524fbbfdbfc9fc68d78811e994";
-    };
-  };
-  # update-script-end: urls
-in
-(mkJetBrainsProduct {
-  inherit libdbm fsnotifier;
-
-  pname = "pycharm-community";
-
-  wmClass = "jetbrains-pycharm-ce";
-  product = "PyCharm CE";
-  productShort = "PyCharm";
-
-  # update-script-start: version
-  version = "2025.2.5";
-  buildNumber = "252.28238.29";
-  # update-script-end: version
-
-  src = fetchurl (urls.${system} or (throw "Unsupported system: ${system}"));
-
-  # NOTE: meta attrs are currently used by the desktop entry, so changing them may cause rebuilds (see TODO in README)
-  meta = {
-    homepage = "https://www.jetbrains.com/pycharm/";
-    description = "Free Python IDE from JetBrains (built from source)";
-    longDescription = "Python IDE with complete set of tools for productive development with Python programming language. In addition, the IDE provides high-class capabilities for professional Web development with Django framework and Google App Engine. It has powerful coding assistance, navigation, a lot of refactoring features, tight integration with various Version Control Systems, Unit testing, powerful all-singing all-dancing Debugger and entire customization. PyCharm is developer driven IDE. It was developed with the aim of providing you almost everything you need for your comfortable and productive development!";
-    maintainers = with lib.maintainers; [
-      tymscar
-    ];
-    license = lib.licenses.asl20;
-    sourceProvenance = [ lib.sourceTypes.fromSource ];
-  };
-}).overrideAttrs
-  pyCharmCommonOverrides
@@ -1,66 +0,0 @@
-# TODO: This IDE is deprecated and scheduled for removal in 26.05
-{
-  stdenv,
-  lib,
-  fetchurl,
-  mkJetBrainsProduct,
-  libdbm,
-  fsnotifier,
-  musl,
-}:
-let
-  system = stdenv.hostPlatform.system;
-  # update-script-start: urls
-  urls = {
-    x86_64-linux = {
-      url = "https://download.jetbrains.com/writerside/writerside-243.22562.371.tar.gz";
-      sha256 = "d49e58020d51ec4ccdbdffea5d42b5a2d776a809fc00789cef5abda7b23bd3f6";
-    };
-    aarch64-linux = {
-      url = "https://download.jetbrains.com/writerside/writerside-243.22562.371-aarch64.tar.gz";
-      sha256 = "6067f6f73c4a178e2d0ae42bd18669045d85b5b5ed2c9115c2488ba7aa2a3d88";
-    };
-    x86_64-darwin = {
-      url = "https://download.jetbrains.com/writerside/writerside-243.22562.371.dmg";
-      sha256 = "0c78b8035497c855aea5666256716778abd46dadf68f51e4f91c0db01f62b280";
-    };
-    aarch64-darwin = {
-      url = "https://download.jetbrains.com/writerside/writerside-243.22562.371-aarch64.dmg";
-      sha256 = "9d86ef50b4c6d2a07d236219e9b05c0557241fb017d52ac395719bdb425130f5";
-    };
-  };
-  # update-script-end: urls
-in
-mkJetBrainsProduct {
-  inherit libdbm fsnotifier;
-
-  pname = "writerside";
-
-  wmClass = "jetbrains-writerside";
-  product = "Writerside";
-
-  # update-script-start: version
-  version = "2024.3 EAP";
-  buildNumber = "243.22562.371";
-  # update-script-end: version
-
-  src = fetchurl (urls.${system} or (throw "Unsupported system: ${system}"));
-
-  buildInputs = [
-    musl
-  ];
-
-  # NOTE: meta attrs are currently used by the desktop entry, so changing them may cause rebuilds (see TODO in README)
-  meta = {
-    homepage = "https://www.jetbrains.com/writerside/";
-    description = "Documentation IDE from JetBrains";
-    longDescription = "The most powerful development environment – now adapted for writing documentation.";
-    maintainers = with lib.maintainers; [ zlepper ];
-    license = lib.licenses.unfree;
-    sourceProvenance =
-      if stdenv.hostPlatform.isDarwin then
-        [ lib.sourceTypes.binaryNativeCode ]
-      else
-        [ lib.sourceTypes.binaryBytecode ];
-  };
-}
@@ -14,27 +14,21 @@ let
    if ideName == null then
      with jetbrains;
      [
-        aqua
        clion
        datagrip
        dataspell
        gateway
        goland
-        idea-community-src
-        idea-community-bin
        idea-oss
        idea
        mps
        phpstorm
-        pycharm-community-src
-        pycharm-community-bin
        pycharm-oss
        pycharm
        rider
        ruby-mine
        rust-rover
        webstorm
-        writerside
      ]
    else
      [ (jetbrains.${ideName}) ];
@@ -56,8 +56,7 @@ Any comments or other manual changes between these markers will be removed when
 - Add it to `default.nix`

 ### TODO:
- - drop the community IDEs
- - Switch `mkJetBrainsProduct` to use `lib.extendMkDerivation`, see also:
+ - Switch `mkJetbrainsProduct` to use `lib.extendMkDerivation`, see also:
   - https://github.com/NixOS/nixpkgs/pull/475183#discussion_r2655305961
   - https://github.com/NixOS/nixpkgs/pull/475183#discussion_r2655348886
 - move PyCharm overrides to a common place outside of `default.nix`
@@ -12,12 +12,12 @@
  pkgs,
 }:
 let
-  version = "0.0.27-unstable-2026-01-20";
+  version = "0.0.27-unstable-2026-01-24";
  src = fetchFromGitHub {
    owner = "yetone";
    repo = "avante.nvim";
-    rev = "08b202a5c5dc93959bfe7dc276adfcba84ecc5be";
-    hash = "sha256-YDlxwAOimaTFo7mTICQBdb7EQCp8vrBnwjWwxmBImis=";
+    rev = "fde9a524457d17661618678f085649d4e8d3fd6f";
+    hash = "sha256-i+IxrUcqQk9okjXkHm7m+PF6+H4YKUkOtuyF/ZuoCWc=";
  };
  avante-nvim-lib = rustPlatform.buildRustPackage {
    pname = "avante-nvim-lib";
@@ -8,8 +8,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
  mktplcRef = {
    name = "claude-code";
    publisher = "anthropic";
-    version = "2.1.19";
-    hash = "sha256-Qh7wUa+WK5FNsIcxJ2HxO1LHlRVdIcM7Y9ubtRONczc=";
+    version = "2.1.20";
+    hash = "sha256-8r2/bF5zkq4LkMKvI5YcBMaaMzgWAIezdIwTMQQBHsM=";
  };

  postInstall = ''
@@ -35,13 +35,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "organicmaps";
-  version = "2025.12.16-16";
+  version = "2026.01.26-11";

  src = fetchFromGitHub {
    owner = "organicmaps";
    repo = "organicmaps";
    tag = "${finalAttrs.version}-android";
-    hash = "sha256-Ep+CmTT2yCimchUAxdnRU3QqtLOfJWbw0gRioB0snQI=";
+    hash = "sha256-EsVPzibUta0cmKA6bYLqCKKij5FWbwPHgMmIs2THpL0=";
    fetchSubmodules = true;
  };

@@ -27,14 +27,14 @@
  srtp,
  libnice,
  gnutls,
-  gstreamer,
-  gst-plugins-base,
-  gst-plugins-good,
-  gst-plugins-bad,
-  gst-vaapi,
+  gst_all_1,
  webrtc-audio-processing,
 }:

+# Upstream is very deliberate about which features are enabled per default or are automatically enabled.
+# Everything that is disabled per default has to been seen experimental and should not be enabled without strong reasoning.
+# see https://github.com/NixOS/nixpkgs/issues/469614#issuecomment-3649662176
+
 stdenv.mkDerivation (finalAttrs: {
  pname = "dino";
  version = "0.5.1";
@@ -79,24 +79,13 @@ stdenv.mkDerivation (finalAttrs: {
    srtp
    libnice
    gnutls
-    gstreamer
-    gst-plugins-base
-    gst-plugins-good # contains rtpbin, required for VP9
-    gst-plugins-bad # required for H264, MSDK
-    gst-vaapi # required for VAAPI
+    gst_all_1.gstreamer
+    gst_all_1.gst-plugins-base
    webrtc-audio-processing
  ];

  doCheck = true;

-  mesonFlags = [
-    "-Dplugin-notification-sound=enabled"
-    "-Dplugin-rtp-h264=enabled"
-    "-Dplugin-rtp-msdk=enabled"
-    "-Dplugin-rtp-vaapi=enabled"
-    "-Dplugin-rtp-vp9=enabled"
-  ];
-
  # Undefined symbols for architecture arm64: "_gpg_strerror"
  NIX_LDFLAGS = lib.optionalString stdenv.hostPlatform.isDarwin "-lgpg-error";

@@ -108,7 +97,7 @@ stdenv.mkDerivation (finalAttrs: {
  # will load
  #
  # See https://github.com/dino/dino/wiki/macOS
-  postFixup = lib.optionalString (stdenv.hostPlatform.isDarwin) ''
+  postFixup = lib.optionalString stdenv.hostPlatform.isDarwin ''
    cd "$out/lib/dino/plugins/"
    for f in *.dylib; do
      mv "$f" "$(basename "$f" .dylib).so"
@@ -13,19 +13,26 @@
  cargo-geiger,
 }:

-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cargo-geiger";
  version = "0.13.0";

  src = fetchFromGitHub {
    owner = "geiger-rs";
    repo = "cargo-geiger";
-    tag = "cargo-geiger-${version}";
+    tag = "cargo-geiger-${finalAttrs.version}";
    hash = "sha256-dZ71WbTKsR6g5UhWuJNfNAAqNNxbTgwL5fsgkm50BaM=";
  };

  cargoHash = "sha256-GgCmUNOwvyTB82Y/ddgJIAb1SpO4mRPjECqCagJ8GmE=";

+  postPatch = ''
+    # https://github.com/geiger-rs/cargo-geiger/pull/562
+    # Fix unused import warning which is treated as an error
+    substituteInPlace cargo-geiger/tests/integration_tests.rs \
+      --replace-fail "use std::env;" ""
+  '';
+
  buildInputs = [
    openssl
  ]
@@ -76,7 +83,7 @@ rustPlatform.buildRustPackage rec {
      code is appropriate.
    '';
    homepage = "https://github.com/geiger-rs/cargo-geiger";
-    changelog = "https://github.com/geiger-rs/cargo-geiger/blob/cargo-geiger-${version}/CHANGELOG.md";
+    changelog = "https://github.com/geiger-rs/cargo-geiger/blob/cargo-geiger-${finalAttrs.version}/CHANGELOG.md";
    mainProgram = "cargo-geiger";
    license = with lib.licenses; [
      asl20 # or
@@ -89,4 +96,4 @@ rustPlatform.buildRustPackage rec {
      matthiasbeyer
    ];
  };
-}
+})
@@ -1,12 +1,12 @@
 # This file is automatically @generated by Cargo.
 # It is not intended for manual editing.
-version = 3
+version = 4

 [[package]]
 name = "aho-corasick"
-version = "1.1.3"
+version = "1.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e60d3430d3a69478ad0993f19238d2df97c507009a52b3c10addcd7f6bcb916"
+checksum = "ddd31a130427c27518df266943a5308ed92d4b226cc639f5a8f1002816174301"
 dependencies = [
 "memchr",
 ]
@@ -25,15 +25,15 @@ checksum = "c08606f8c3cbf4ce6ec8e28fb0014a2c086708fe954eaa885384a6165172e7e8"

 [[package]]
 name = "bitflags"
-version = "2.9.4"
+version = "2.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2261d10cca569e4643e526d8dc2e62e433cc8aba21ab764233731f8d369bf394"
+checksum = "812e12b5285cc515a9c72a5c1d3b6d46a19dac5acfef5265968c166106e31dd3"

 [[package]]
 name = "bstr"
-version = "1.12.0"
+version = "1.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "234113d19d0d7d613b40e86fb654acf958910802bcceab913a4f9e7cda03b1a4"
+checksum = "63044e1ae8e69f3b5a92c736ca6269b8d12fa7efe39bf34ddb06d102cf0e2cab"
 dependencies = [
 "memchr",
 "regex-automata",
@@ -42,15 +42,15 @@ dependencies = [

 [[package]]
 name = "camino"
-version = "1.2.1"
+version = "1.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "276a59bf2b2c967788139340c9f0c5b12d7fd6630315c15c217e559de85d2609"
+checksum = "e629a66d692cb9ff1a1c664e41771b3dcaf961985a9774c0eb0bd1b51cf60a48"

 [[package]]
 name = "cargo-config2"
-version = "0.1.38"
+version = "0.1.39"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2bf2da6c8158a7ad35217e3187ac07db64d19719a934ffaf9b7591cda1f31964"
+checksum = "3795d3a48839a46854805f56c8fe9c558f10804bcf57df53925ca843d87c788f"
 dependencies = [
 "serde",
 "serde_derive",
@@ -60,7 +60,7 @@ dependencies = [

 [[package]]
 name = "cargo-llvm-cov"
-version = "0.6.20"
+version = "0.8.1"
 dependencies = [
 "anyhow",
 "camino",
@@ -88,15 +88,15 @@ dependencies = [

 [[package]]
 name = "cfg-if"
-version = "1.0.3"
+version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2fd1289c04a9ea8cb22300a459a72a385d7c73d3259e2ed7dcb2af674838cfa9"
+checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"

 [[package]]
 name = "duct"
-version = "1.1.0"
+version = "1.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d7478638a31d1f1f3d6c9f5e57c76b906a04ac4879d6fd0fb6245bc88f73fd0b"
+checksum = "7e66e9c0c03d094e1a0ba1be130b849034aa80c3a2ab8ee94316bc809f3fa684"
 dependencies = [
 "libc",
 "os_pipe",
@@ -122,21 +122,20 @@ checksum = "37909eebbb50d72f9059c3b6d82c0463f2ff062c9e95845c43a6c9c0355411be"

 [[package]]
 name = "filetime"
-version = "0.2.26"
+version = "0.2.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bc0505cd1b6fa6580283f6bdf70a73fcf4aba1184038c90902b92b3dd0df63ed"
+checksum = "f98844151eee8917efc50bd9e8318cb963ae8b297431495d3f758616ea5c57db"
 dependencies = [
 "cfg-if",
 "libc",
 "libredox",
- "windows-sys 0.60.2",
 ]

 [[package]]
 name = "fs-err"
-version = "3.1.3"
+version = "3.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ad492b2cf1d89d568a43508ab24f98501fe03f2f31c01e1d0fe7366a71745d2"
+checksum = "baf68cef89750956493a66a10f512b9e58d9db21f2a573c079c0bdf1207a54a7"
 dependencies = [
 "autocfg",
 ]
@@ -149,9 +148,9 @@ checksum = "0cc23270f6e1808e30a928bdc84dea0b9b4136a8bc82338574f23baf47bbd280"

 [[package]]
 name = "itoa"
-version = "1.0.15"
+version = "1.0.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4a5f13b858c8d314ee3e8f639011f7ccefe71f97f96e50151fb991f267928e2c"
+checksum = "92ecc6618181def0457392ccd0ee51198e065e016d1d527a7ac1b6dc7c1f09d2"

 [[package]]
 name = "lcov2cobertura"
@@ -173,15 +172,15 @@ checksum = "9fa0e2a1fcbe2f6be6c42e342259976206b383122fc152e872795338b5a3f3a7"

 [[package]]
 name = "libc"
-version = "0.2.176"
+version = "0.2.180"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "58f929b4d672ea937a23a1ab494143d968337a5f47e56d0815df1e0890ddf174"
+checksum = "bcc35a38544a891a5f7c865aca548a982ccb3b8650a5b06d0fd33a10283c56fc"

 [[package]]
 name = "libredox"
-version = "0.1.10"
+version = "0.1.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "416f7e718bdb06000964960ffa43b4335ad4012ae8b99060261aa4a8088d5ccb"
+checksum = "3d0b95e02c851351f877147b7deea7b1afb1df71b63aa5f8270716e0c5720616"
 dependencies = [
 "bitflags",
 "libc",
@@ -217,30 +216,30 @@ checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d"

 [[package]]
 name = "opener"
-version = "0.8.3"
+version = "0.8.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cb9024962ab91e00c89d2a14352a8d0fc1a64346bf96f1839b45c09149564e47"
+checksum = "a2fa337e0cf13357c13ef1dc108df1333eb192f75fc170bea03fcf1fd404c2ee"
 dependencies = [
 "bstr",
 "normpath",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]

 [[package]]
 name = "os_pipe"
-version = "1.2.2"
+version = "1.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "db335f4760b14ead6290116f2427bf33a14d4f0617d49f78a246de10c1831224"
+checksum = "7d8fae84b431384b68627d0f9b3b1245fcf9f46f6c0e3dc902e9dce64edd1967"
 dependencies = [
 "libc",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]

 [[package]]
 name = "proc-macro2"
-version = "1.0.101"
+version = "1.0.106"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "89ae43fd86e4158d6db51ad8e2b80f313af9cc74f5c0e03ccb87de09998732de"
+checksum = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934"
 dependencies = [
 "unicode-ident",
 ]
@@ -256,27 +255,27 @@ dependencies = [

 [[package]]
 name = "quote"
-version = "1.0.41"
+version = "1.0.44"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce25767e7b499d1b604768e7cde645d14cc8584231ea6b295e9c9eb22c02e1d1"
+checksum = "21b2ebcf727b7760c461f091f9f0f539b77b8e87f2fd88131e7f1b433b3cece4"
 dependencies = [
 "proc-macro2",
 ]

 [[package]]
 name = "redox_syscall"
-version = "0.5.18"
+version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ed2bf2547551a7053d6fdfafda3f938979645c44812fbfcda098faae3f1a362d"
+checksum = "49f3fe0889e69e2ae9e41f4d6c4c0181701d00e4697b356fb1f74173a5e0ee27"
 dependencies = [
 "bitflags",
 ]

 [[package]]
 name = "regex"
-version = "1.11.3"
+version = "1.12.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8b5288124840bee7b386bc413c487869b360b2b4ec421ea56425128692f2a82c"
+checksum = "843bc0191f75f3e22651ae5f1e72939ab2f72a4bc30fa80a066bd66edefc24d4"
 dependencies = [
 "aho-corasick",
 "memchr",
@@ -286,9 +285,9 @@ dependencies = [

 [[package]]
 name = "regex-automata"
-version = "0.4.11"
+version = "0.4.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "833eb9ce86d40ef33cb1306d8accf7bc8ec2bfea4355cbdebb3df68b40925cad"
+checksum = "5276caf25ac86c8d810222b3dbb938e512c55c6831a10f3e6ed1c93b84041f1c"
 dependencies = [
 "aho-corasick",
 "memchr",
@@ -297,21 +296,21 @@ dependencies = [

 [[package]]
 name = "regex-syntax"
-version = "0.8.6"
+version = "0.8.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "caf4aa5b0f434c91fe5c7f1ecb6a5ece2130b02ad2a590589dda5146df959001"
+checksum = "7a2d987857b319362043e95f5353c0535c1f58eec5336fdfcf626430af7def58"

 [[package]]
 name = "rustc-demangle"
-version = "0.1.26"
+version = "0.1.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "56f7d92ca342cea22a06f2121d944b4fd82af56988c270852495420f961d4ace"
+checksum = "b50b8869d9fc858ce7266cce0194bd74df58b9d0e3f6df3a9fc8eb470d95c09d"

 [[package]]
 name = "rustix"
-version = "1.1.2"
+version = "1.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cd15f8a2c5551a84d56efdc1cd049089e409ac19a3072d5037a17fd70719ff3e"
+checksum = "146c9e247ccc180c1f61615433868c99f3de3ae256a30a43b49f67c2d9171f34"
 dependencies = [
 "bitflags",
 "errno",
@@ -328,15 +327,9 @@ checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d"

 [[package]]
 name = "ruzstd"
-version = "0.8.1"
+version = "0.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3640bec8aad418d7d03c72ea2de10d5c646a598f9883c7babc160d91e3c1b26c"
-
-[[package]]
-name = "ryu"
-version = "1.0.20"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "28d3b2b1366ec20994f1fd18c3c594f05c5dd4bc44d8bb0c1c632c8d6829481f"
+checksum = "e5ff0cc5e135c8870a775d3320910cd9b564ec036b4dc0b8741629020be63f01"

 [[package]]
 name = "same-file"
@@ -378,22 +371,22 @@ dependencies = [

 [[package]]
 name = "serde_json"
-version = "1.0.145"
+version = "1.0.149"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "402a6f66d8c709116cf22f558eab210f5a50187f702eb4d7e5ef38d9a7f1c79c"
+checksum = "83fc039473c5595ace860d8c4fafa220ff474b3fc6bfdb4293327f1a37e94d86"
 dependencies = [
 "itoa",
 "memchr",
- "ryu",
 "serde",
 "serde_core",
+ "zmij",
 ]

 [[package]]
 name = "serde_spanned"
-version = "1.0.2"
+version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5417783452c2be558477e104686f7de5dae53dba813c28435e0e70f82d9b04ee"
+checksum = "f8bbf91e5a4d6315eee45e704372590b30e260ee83af6639d64557f51b067776"
 dependencies = [
 "serde_core",
 ]
@@ -422,9 +415,9 @@ checksum = "45bb67a18fa91266cc7807181f62f9178a6873bfad7dc788c42e6430db40184f"

 [[package]]
 name = "syn"
-version = "2.0.106"
+version = "2.0.114"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ede7c438028d4436d71104916910f5bb611972c5cfd7f89b8300a8186e6fada6"
+checksum = "d4d107df263a3013ef9b1879b0df87d706ff80f65a86ea879bd9c31f9b307c2a"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -444,9 +437,9 @@ dependencies = [

 [[package]]
 name = "tempfile"
-version = "3.23.0"
+version = "3.24.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2d31c77bdf42a745371d260a26ca7163f1e0924b64afa0b688e61b5a9fa02f16"
+checksum = "655da9c7eb6305c55742045d5a8d2037996d61d8de95806335c7c86ce0f82e9c"
 dependencies = [
 "fastrand",
 "once_cell",
@@ -473,9 +466,9 @@ dependencies = [

 [[package]]
 name = "toml"
-version = "0.9.7"
+version = "0.9.11+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "00e5e5d9bf2475ac9d4f0d9edab68cc573dc2fd644b0dba36b0c30a92dd9eaa0"
+checksum = "f3afc9a848309fe1aaffaed6e1546a7a14de1f935dc9d89d32afd9a44bab7c46"
 dependencies = [
 "serde_core",
 "serde_spanned",
@@ -486,27 +479,27 @@ dependencies = [

 [[package]]
 name = "toml_datetime"
-version = "0.7.2"
+version = "0.7.5+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32f1085dec27c2b6632b04c80b3bb1b4300d6495d1e129693bdda7d91e72eec1"
+checksum = "92e1cfed4a3038bc5a127e35a2d360f145e1f4b971b551a2ba5fd7aedf7e1347"
 dependencies = [
 "serde_core",
 ]

 [[package]]
 name = "toml_parser"
-version = "1.0.3"
+version = "1.0.6+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4cf893c33be71572e0e9aa6dd15e6677937abd686b066eac3f8cd3531688a627"
+checksum = "a3198b4b0a8e11f09dd03e133c0280504d0801269e9afa46362ffde1cbeebf44"
 dependencies = [
 "winnow",
 ]

 [[package]]
 name = "unicode-ident"
-version = "1.0.19"
+version = "1.0.22"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f63a545481291138910575129486daeaf8ac54aee4387fe7906919f7830c7d9d"
+checksum = "9312f7c4f6ff9069b165498234ce8be658059c6728633667c526e27dc2cf1df5"

 [[package]]
 name = "walkdir"
@@ -533,22 +526,13 @@ version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"

-[[package]]
-name = "windows-sys"
-version = "0.59.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e38bc4d79ed67fd075bcc251a1c39b32a1776bbe92e5bef1f0bf1f8c531853b"
-dependencies = [
- "windows-targets 0.52.6",
-]
-
 [[package]]
 name = "windows-sys"
 version = "0.60.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f2f500e4d28234f72040990ec9d39e3a6b950f9f22d3dba18416c35882612bcb"
 dependencies = [
- "windows-targets 0.53.5",
+ "windows-targets",
 ]

 [[package]]
@@ -560,22 +544,6 @@ dependencies = [
 "windows-link",
 ]

-[[package]]
-name = "windows-targets"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
-dependencies = [
- "windows_aarch64_gnullvm 0.52.6",
- "windows_aarch64_msvc 0.52.6",
- "windows_i686_gnu 0.52.6",
- "windows_i686_gnullvm 0.52.6",
- "windows_i686_msvc 0.52.6",
- "windows_x86_64_gnu 0.52.6",
- "windows_x86_64_gnullvm 0.52.6",
- "windows_x86_64_msvc 0.52.6",
-]
-
 [[package]]
 name = "windows-targets"
 version = "0.53.5"
@@ -583,106 +551,58 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4945f9f551b88e0d65f3db0bc25c33b8acea4d9e41163edf90dcd0b19f9069f3"
 dependencies = [
 "windows-link",
- "windows_aarch64_gnullvm 0.53.1",
- "windows_aarch64_msvc 0.53.1",
- "windows_i686_gnu 0.53.1",
- "windows_i686_gnullvm 0.53.1",
- "windows_i686_msvc 0.53.1",
- "windows_x86_64_gnu 0.53.1",
- "windows_x86_64_gnullvm 0.53.1",
- "windows_x86_64_msvc 0.53.1",
+ "windows_aarch64_gnullvm",
+ "windows_aarch64_msvc",
+ "windows_i686_gnu",
+ "windows_i686_gnullvm",
+ "windows_i686_msvc",
+ "windows_x86_64_gnu",
+ "windows_x86_64_gnullvm",
+ "windows_x86_64_msvc",
 ]

-[[package]]
-name = "windows_aarch64_gnullvm"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
-
 [[package]]
 name = "windows_aarch64_gnullvm"
 version = "0.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a9d8416fa8b42f5c947f8482c43e7d89e73a173cead56d044f6a56104a6d1b53"

-[[package]]
-name = "windows_aarch64_msvc"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
-
 [[package]]
 name = "windows_aarch64_msvc"
 version = "0.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b9d782e804c2f632e395708e99a94275910eb9100b2114651e04744e9b125006"

-[[package]]
-name = "windows_i686_gnu"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
-
 [[package]]
 name = "windows_i686_gnu"
 version = "0.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "960e6da069d81e09becb0ca57a65220ddff016ff2d6af6a223cf372a506593a3"

-[[package]]
-name = "windows_i686_gnullvm"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
-
 [[package]]
 name = "windows_i686_gnullvm"
 version = "0.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fa7359d10048f68ab8b09fa71c3daccfb0e9b559aed648a8f95469c27057180c"

-[[package]]
-name = "windows_i686_msvc"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
-
 [[package]]
 name = "windows_i686_msvc"
 version = "0.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1e7ac75179f18232fe9c285163565a57ef8d3c89254a30685b57d83a38d326c2"

-[[package]]
-name = "windows_x86_64_gnu"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
-
 [[package]]
 name = "windows_x86_64_gnu"
 version = "0.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9c3842cdd74a865a8066ab39c8a7a473c0778a3f29370b5fd6b4b9aa7df4a499"

-[[package]]
-name = "windows_x86_64_gnullvm"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
-
 [[package]]
 name = "windows_x86_64_gnullvm"
 version = "0.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0ffa179e2d07eee8ad8f57493436566c7cc30ac536a3379fdf008f47f6bb7ae1"

-[[package]]
-name = "windows_x86_64_msvc"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
-
 [[package]]
 name = "windows_x86_64_msvc"
 version = "0.53.1"
@@ -691,9 +611,9 @@ checksum = "d6bbff5f0aada427a1e5a6da5f1f98158182f26556f345ac9e04d36d0ebed650"

 [[package]]
 name = "winnow"
-version = "0.7.13"
+version = "0.7.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "21a0236b59786fed61e2a80582dd500fe61f18b5dca67a4a067d0bc9039339cf"
+checksum = "5a5364e9d77fcdeeaa6062ced926ee3381faa2ee02d3eb83a5c27a8825540829"

 [[package]]
 name = "xattr"
@@ -704,3 +624,9 @@ dependencies = [
 "libc",
 "rustix",
 ]
+
+[[package]]
+name = "zmij"
+version = "1.0.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "02aae0f83f69aafc94776e879363e9771d7ecbffe2c7fbb6c14c5e00dfe88439"
@@ -25,7 +25,7 @@

 let
  pname = "cargo-llvm-cov";
-  version = "0.6.20";
+  version = "0.8.1";

  owner = "taiki-e";
  homepage = "https://github.com/${owner}/${pname}";
@@ -42,7 +42,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    inherit owner;
    repo = "cargo-llvm-cov";
    rev = "v${version}";
-    sha256 = "sha256-LAiN9Opc0XQVepQ9IhK9JFWGoeRR3U6V680jgGiaDGo=";
+    sha256 = "sha256-w7UHfb5g8g9AYGbxoUpmiBsFEnSuc/RBEAZAYwoFjRg=";
  };

  # Upstream doesn't include the lockfile so we need to add it back
@@ -0,0 +1,34 @@
+{
+  "version": "2.1.20",
+  "buildDate": "2026-01-27T00:41:34Z",
+  "platforms": {
+    "darwin-arm64": {
+      "checksum": "c5703596ed854ae8e5775cf38de5d71d8a56ecfe3f36904812870e9e34178c8c",
+      "size": 181661168
+    },
+    "darwin-x64": {
+      "checksum": "0d38292770c88bd9b13b0684afb0d2dc0028a1437d0c09be3449d2b3d369b045",
+      "size": 187958208
+    },
+    "linux-arm64": {
+      "checksum": "eb8801c7a4a8501b21c235f36674f17328e65e796cf8a6196b3bf9a23ae16f99",
+      "size": 216047898
+    },
+    "linux-x64": {
+      "checksum": "f9d3698f5378a486db2d4eea5c80f95c2ceb410fbcea9ffc5703b5aac9574fcc",
+      "size": 223852550
+    },
+    "linux-arm64-musl": {
+      "checksum": "2a7d24d2b85068c5aca6c014dd5f3f94bd8d55803a06f0d39eea776ab3282d76",
+      "size": 211311930
+    },
+    "linux-x64-musl": {
+      "checksum": "0b392cc1c268f0e48ceedee384535451013f69887a61e23f989e3b743373796a",
+      "size": 216541126
+    },
+    "win32-x64": {
+      "checksum": "12e88d78570b6e979f5cf290652dc45ca8b9327f43bb27e275f87146190bef05",
+      "size": 233703072
+    }
+  }
+}
@@ -0,0 +1,101 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchurl,
+  installShellFiles,
+  makeBinaryWrapper,
+  autoPatchelfHook,
+  procps,
+  ripgrep,
+  bubblewrap,
+  socat,
+  versionCheckHook,
+  writableTmpDirAsHomeHook,
+}:
+let
+  stdenv = stdenvNoCC;
+  baseUrl = "https://storage.googleapis.com/claude-code-dist-86c565f3-f756-42ad-8dfa-d59b1c096819/claude-code-releases";
+  manifest = lib.importJSON ./manifest.json;
+  platformKey = "${stdenv.hostPlatform.node.platform}-${stdenv.hostPlatform.node.arch}";
+  platformManifestEntry = manifest.platforms.${platformKey};
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "claude-code-bin";
+  inherit (manifest) version;
+
+  src = fetchurl {
+    url = "${baseUrl}/${finalAttrs.version}/${platformKey}/claude";
+    sha256 = platformManifestEntry.checksum;
+  };
+
+  dontUnpack = true;
+  dontBuild = true;
+  __noChroot = stdenv.hostPlatform.isDarwin;
+  # otherwise the bun runtime is executed instead of the binary
+  dontStrip = true;
+
+  nativeBuildInputs = [
+    installShellFiles
+    makeBinaryWrapper
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isElf [ autoPatchelfHook ];
+
+  strictDeps = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    installBin $src
+
+    wrapProgram $out/bin/claude \
+      --set DISABLE_AUTOUPDATER 1 \
+      --set USE_BUILTIN_RIPGREP 0 \
+      --prefix PATH : ${
+        lib.makeBinPath (
+          [
+            # claude-code uses [node-tree-kill](https://github.com/pkrumins/node-tree-kill) which requires procps's pgrep(darwin) or ps(linux)
+            procps
+            # https://code.claude.com/docs/en/troubleshooting#search-and-discovery-issues
+            ripgrep
+          ]
+          # the following packages are required for the sandbox to work (Linux only)
+          ++ lib.optionals stdenv.hostPlatform.isLinux [
+            bubblewrap
+            socat
+          ]
+        )
+      }
+
+    runHook postInstall
+  '';
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [
+    writableTmpDirAsHomeHook
+    versionCheckHook
+  ];
+  versionCheckKeepEnvironment = [ "HOME" ];
+  versionCheckProgramArg = "--version";
+
+  passthru.updateScript = ./update.sh;
+
+  meta = {
+    description = "Agentic coding tool that lives in your terminal, understands your codebase, and helps you code faster";
+    homepage = "https://github.com/anthropics/claude-code";
+    downloadPage = "https://claude.com/product/claude-code";
+    changelog = "https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md";
+    license = lib.licenses.unfree;
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+    platforms = [
+      "aarch64-darwin"
+      "x86_64-darwin"
+      "aarch64-linux"
+      "x86_64-linux"
+    ];
+    maintainers = with lib.maintainers; [
+      xiaoxiangmoe
+      mirkolenz
+    ];
+    mainProgram = "claude";
+  };
+})
@@ -0,0 +1,10 @@
+#!/usr/bin/env nix
+#!nix shell --ignore-environment .#cacert .#curl .#bash --command bash
+
+set -euo pipefail
+
+BASE_URL="https://storage.googleapis.com/claude-code-dist-86c565f3-f756-42ad-8dfa-d59b1c096819/claude-code-releases"
+
+VERSION=$(curl -fsSL "$BASE_URL/latest")
+
+curl -fsSL "$BASE_URL/$VERSION/manifest.json" --output pkgs/by-name/cl/claude-code-bin/manifest.json
@@ -1,12 +1,12 @@
 {
  "name": "@anthropic-ai/claude-code",
-  "version": "2.1.19",
+  "version": "2.1.20",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "@anthropic-ai/claude-code",
-      "version": "2.1.19",
+      "version": "2.1.20",
      "license": "SEE LICENSE IN README.md",
      "bin": {
        "claude": "cli.js"
@@ -1,6 +1,6 @@
 # NOTE: Use the following command to update the package
 # ```sh
-# nix-shell maintainers/scripts/update.nix --argstr commit true --arg predicate '(path: pkg: builtins.elem path [["claude-code"] ["vscode-extensions" "anthropic" "claude-code"]])'
+# nix-shell maintainers/scripts/update.nix --argstr commit true --arg predicate '(path: pkg: builtins.elem path [["claude-code"] ["claude-code-bin"] ["vscode-extensions" "anthropic" "claude-code"]])'
 # ```
 {
  lib,
@@ -15,19 +15,23 @@
 }:
 buildNpmPackage (finalAttrs: {
  pname = "claude-code";
-  version = "2.1.19";
+  version = "2.1.20";

  src = fetchzip {
    url = "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-${finalAttrs.version}.tgz";
-    hash = "sha256-K2fJf1eRAyqmtAvKBzpAtMohQ4B1icwC9yf5zEf52C8=";
+    hash = "sha256-V2BIqUUJnQpjIsCAAk932L8wp5T74s22q3KgFoxfdDg=";
  };

-  npmDepsHash = "sha256-C8HVKSz1ZQmYNMoLUKk2XUpf5y+Np4nTacCGMVEqO8c=";
+  npmDepsHash = "sha256-X8j7httM9qMpAPR11oDAWwDpkxZ2bc20y6ruMoStMsQ=";

  strictDeps = true;

  postPatch = ''
    cp ${./package-lock.json} package-lock.json
+
+    # https://github.com/anthropics/claude-code/issues/15195
+    substituteInPlace cli.js \
+          --replace-fail '#!/bin/sh' '#!/usr/bin/env sh'
  '';

  dontNpmBuild = true;
@@ -6,13 +6,13 @@

 buildGoModule rec {
  pname = "cnquery";
-  version = "12.19.0";
+  version = "12.19.2";

  src = fetchFromGitHub {
    owner = "mondoohq";
    repo = "cnquery";
    tag = "v${version}";
-    hash = "sha256-lFnXkBPokDO/eduWhg/lSqqjRhC8/5tGqkS/RZHhZnU=";
+    hash = "sha256-9POb9iQrLSLl8pwLg+y1SzjlxYvcGuIJx5o+djsOxIc=";
  };

  subPackages = [ "apps/cnquery" ];
@@ -7,17 +7,18 @@
  nix,
  nixos-install,
  coreutils,
+  xcp,
  testers,
 }:

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "disko";
-  version = "1.12.0";
+  version = "1.13.0";
  src = fetchFromGitHub {
    owner = "nix-community";
    repo = "disko";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-eDoSOhxGEm2PykZFa/x9QG5eTH0MJdiJ9aR00VAofXE=";
+    hash = "sha256-CNzzBsRhq7gg4BMBuTDObiWDH/rFYHEuDRVOwCcwXw4=";
  };
  nativeBuildInputs = [ makeWrapper ];
  buildInputs = [ bash ];
@@ -26,17 +27,25 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    mkdir -p $out/bin $out/share/disko
    cp -r install-cli.nix cli.nix default.nix disk-deactivate lib $out/share/disko

-    for i in disko disko-install; do
+    scripts=(disko)
+    ${lib.optionalString (!stdenvNoCC.isDarwin) ''
+      scripts+=(disko-install)
+    ''}
+
+    for i in "''${scripts[@]}"; do
      sed -e "s|libexec_dir=\".*\"|libexec_dir=\"$out/share/disko\"|" "$i" > "$out/bin/$i"
      chmod 755 "$out/bin/$i"
      wrapProgram "$out/bin/$i" \
        --set DISKO_VERSION "${finalAttrs.version}" \
        --prefix PATH : ${
-          lib.makeBinPath [
-            nix
-            coreutils
-            nixos-install
-          ]
+          lib.makeBinPath (
+            [
+              nix
+              coreutils
+              xcp
+            ]
+            ++ lib.optional (!stdenvNoCC.isDarwin) nixos-install
+          )
        }
    done
    runHook postInstall
@@ -45,7 +54,9 @@ stdenvNoCC.mkDerivation (finalAttrs: {
  installCheckPhase = ''
    runHook preInstallCheck
    $out/bin/disko --help
-    $out/bin/disko-install --help
+    ${lib.optionalString (!stdenvNoCC.isDarwin) ''
+      $out/bin/disko-install --help
+    ''}
    runHook postInstallCheck
  '';

@@ -60,7 +71,8 @@ stdenvNoCC.mkDerivation (finalAttrs: {
      mic92
      lassulus
      iFreilicht
+      Enzime
    ];
-    platforms = lib.platforms.linux;
+    platforms = lib.platforms.unix;
  };
 })
@@ -11,13 +11,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "fastcdr";
-  version = "2.3.4";
+  version = "2.3.5";

  src = fetchFromGitHub {
    owner = "eProsima";
    repo = "Fast-CDR";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-KXQRQieyDPuSmLltf7iOVO4QdsHgaek+x1vneZyEg0E=";
+    hash = "sha256-gWENB3zqnFll047Jv+GL4k497wrzNaIaVTbXY7feRNQ=";
  };

  patches = [
@@ -10,16 +10,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "inputplumber";
-  version = "0.70.2";
+  version = "0.72.0";

  src = fetchFromGitHub {
    owner = "ShadowBlip";
    repo = "InputPlumber";
    tag = "v${version}";
-    hash = "sha256-D79muCj4L4bhnDwTDkD5Ovr8AWpdcAGznBtvtFX/ktA=";
+    hash = "sha256-bzIrP6bUxEEgQ+lCKV3jpdyBNMAanCYXiMCr8ypUkUY=";
  };

-  cargoHash = "sha256-1ej1CNvlB6WtRB5BYaaSMSHWKJ3anvJVpJqEL2feQuA=";
+  cargoHash = "sha256-DP4Qe9bzDkuE36RldYPYNeGrQWVqBewU5GUt8zw3GAA=";

  nativeBuildInputs = [
    pkg-config
@@ -2,21 +2,26 @@
  lib,
  fetchCrate,
  rustPlatform,
+  cacert,
  versionCheckHook,
  nix-update-script,
 }:

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "jsonschema-cli";
-  version = "0.38.1";
+  version = "0.40.0";

  src = fetchCrate {
    pname = "jsonschema-cli";
    inherit (finalAttrs) version;
-    hash = "sha256-W3pyT5DK8ADkWi7znuTDTq1hjRTOwhg9rSmuGZTX8r0=";
+    hash = "sha256-giHE1iawz3iahO98C5Wq6QboLX2nTzeK/xhASzzDmAY=";
  };

-  cargoHash = "sha256-C8A+cyNix0Q9OACyyPM3A74jZKNBCGz/622YsZqtY2E=";
+  cargoHash = "sha256-PhWT0ewOQ1ZUQ8xyCeDTNs96XjFGmk+uzvDSWANDCjo=";
+
+  preCheck = ''
+    export SSL_CERT_FILE=${cacert}/etc/ssl/certs/ca-bundle.crt
+  '';

  nativeInstallCheckInputs = [
    versionCheckHook
@@ -31,17 +31,18 @@
  libtommath,
  sdl3,
  icu78,
+  simdjson,
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "ladybird";
-  version = "0-unstable-2026-01-11";
+  version = "0-unstable-2026-01-27";

  src = fetchFromGitHub {
    owner = "LadybirdBrowser";
    repo = "ladybird";
-    rev = "7814b497850ce131dfbfff8bd48836c121c2b237";
-    hash = "sha256-MMIk1FF9GB4pPNDdeSAGMjqqbVybn67EVtzcEOVbRIg=";
+    rev = "6b9797f480509b29afae4a88bc5931221ac7e7fe";
+    hash = "sha256-wqY7bG2Y5QNAeOMccvKbf8QFU7u6iRs2bGcDDe5K8cQ=";
  };

  postPatch = ''
@@ -113,6 +114,7 @@ stdenv.mkDerivation (finalAttrs: {
    }))
    woff2
    icu78
+    simdjson
  ]
  ++ lib.optional stdenv.hostPlatform.isLinux [
    libpulseaudio.dev
@@ -14,13 +14,13 @@

 gcc15Stdenv.mkDerivation {
  pname = "libresplit";
-  version = "0-unstable-2026-01-09";
+  version = "0-unstable-2026-01-22";

  src = fetchFromGitHub {
    owner = "LibreSplit";
    repo = "LibreSplit";
-    rev = "5cce8434645c249b2a8bfc4bcf10ce8766df9fe6";
-    hash = "sha256-nn6EmsG0RqpljylX4lAXDJC1JTWzzMDVCT+ObhVl5E4=";
+    rev = "be1ae0ea476846bb7e296613f471ba8803b1d7ff";
+    hash = "sha256-9BzzpKun8c9TFzwHHbGxFK6ThfVHRMUUqjwRiS+Lfks=";
  };

  nativeBuildInputs = [
@@ -26,19 +26,19 @@ stdenv.mkDerivation (
        "http://www.makemkv.com/download/makemkv-bin-${version}.tar.gz"
        "http://www.makemkv.com/download/old/makemkv-bin-${version}.tar.gz"
      ];
-      hash = "sha256-v8THzrwPAEl2cf/Vbmo08HcKnmr37/LwEn76FD8oY24=";
+      hash = "sha256-we5yCukbJ2p8ib6GEUbFuTRjGDHo1sj0U0BkNXJOkr0=";
    };
    srcs.oss = fetchurl {
      urls = [
        "http://www.makemkv.com/download/makemkv-oss-${version}.tar.gz"
        "http://www.makemkv.com/download/old/makemkv-oss-${version}.tar.gz"
      ];
-      hash = "sha256-uUl/VVXCV/XTx/GLarA8dM/z6kQ36ANJ1hjRFb9fpEU=";
+      hash = "sha256-vIuwhK46q81QPVu5PvwnPgRuT9RmPTmpg2zgwEf+6CM=";
    };
  in
  {
    pname = "makemkv";
-    version = "1.18.2";
+    version = "1.18.3";

    srcs = lib.attrValues finalAttrs.passthru.srcs;
    sourceRoot = "makemkv-oss-${version}";
@@ -7,16 +7,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "managarr";
-  version = "0.6.3";
+  version = "0.7.0";

  src = fetchFromGitHub {
    owner = "Dark-Alex-17";
    repo = "managarr";
    tag = "v${version}";
-    hash = "sha256-RBJ4Z5WTArQ/fG3Bv6wHAPJzRJNrIGTNphPYjV8Ocqc=";
+    hash = "sha256-6aqJxnhc1eXqJIuX07aKSEooNeVwnq8ic7yZnJaokR8=";
  };

-  cargoHash = "sha256-om4zGqh4bEgQZ+G2/MVGi9SCbopLdZ2K8hjIPIefiSQ=";
+  cargoHash = "sha256-BdgJVByyJ7Nq8gjPXxSaeQQYVQRM/leTd9AxWd7IpDw=";

  nativeBuildInputs = [ perl ];

@@ -14,13 +14,13 @@

 let
  pname = "mangayomi";
-  version = "0.6.85";
+  version = "0.7.0";

  src = fetchFromGitHub {
    owner = "kodjodevf";
    repo = "mangayomi";
    tag = "v${version}";
-    hash = "sha256-Zy4B0nl9R/LmXj/DUI4v98GbSUu8YWGOO0GCXpRHtBA=";
+    hash = "sha256-NcM0saSuNlxw16+MIT5o/DLRhV5+PbNBb2HnbRpYl/o=";
  };

  metaCommon = {
@@ -30,16 +30,6 @@
      "source": "hosted",
      "version": "0.1.10"
    },
-    "analyzer_plugin": {
-      "dependency": "transitive",
-      "description": {
-        "name": "analyzer_plugin",
-        "sha256": "a5ab7590c27b779f3d4de67f31c4109dbe13dd7339f86461a6f2a8ab2594d8ce",
-        "url": "https://pub.dev"
-      },
-      "source": "hosted",
-      "version": "0.13.4"
-    },
    "antlr4": {
      "dependency": "transitive",
      "description": {
@@ -390,35 +380,15 @@
      "source": "hosted",
      "version": "1.0.8"
    },
-    "custom_lint_core": {
-      "dependency": "transitive",
-      "description": {
-        "name": "custom_lint_core",
-        "sha256": "cc4684d22ca05bf0a4a51127e19a8aea576b42079ed2bc9e956f11aaebe35dd1",
-        "url": "https://pub.dev"
-      },
-      "source": "hosted",
-      "version": "0.8.0"
-    },
-    "custom_lint_visitor": {
-      "dependency": "transitive",
-      "description": {
-        "name": "custom_lint_visitor",
-        "sha256": "4a86a0d8415a91fbb8298d6ef03e9034dc8e323a599ddc4120a0e36c433983a2",
-        "url": "https://pub.dev"
-      },
-      "source": "hosted",
-      "version": "1.0.0+7.7.0"
-    },
    "d4rt": {
      "dependency": "direct main",
      "description": {
        "name": "d4rt",
-        "sha256": "03d99e97cc893e312d568c657e9fe1034a0941f14043388a578e28500d1a31fb",
+        "sha256": "eff6a10f31e9e5b60b99146a33204c5f2d74e20ac3eeb14132d8a8ed0921c6e1",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "0.1.8"
+      "version": "0.1.9"
    },
    "dart_style": {
      "dependency": "transitive",
@@ -576,11 +546,11 @@
      "dependency": "direct main",
      "description": {
        "name": "ffigen",
-        "sha256": "2bd9a420ca42cb5ce8cff5d80f88547b547a042ae26807704b1698714e4464a2",
+        "sha256": "b7803707faeec4ce3c1b0c2274906504b796e3b70ad573577e72333bd1c9b3ba",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "19.1.0"
+      "version": "20.1.1"
    },
    "file": {
      "dependency": "transitive",
@@ -596,11 +566,11 @@
      "dependency": "direct main",
      "description": {
        "name": "file_picker",
-        "sha256": "7872545770c277236fd32b022767576c562ba28366204ff1a5628853cf8f2200",
+        "sha256": "d974b6ba2606371ac71dd94254beefb6fa81185bde0b59bdc1df09885da85fde",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "10.3.7"
+      "version": "10.3.8"
    },
    "fixnum": {
      "dependency": "transitive",
@@ -790,11 +760,11 @@
      "dependency": "direct main",
      "description": {
        "name": "flutter_riverpod",
-        "sha256": "9e2d6907f12cc7d23a846847615941bddee8709bf2bfd274acdf5e80bcf22fde",
+        "sha256": "38ec6c303e2c83ee84512f5fc2a82ae311531021938e63d7137eccc107bf3c02",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "3.0.3"
+      "version": "3.1.0"
    },
    "flutter_rust_bridge": {
      "dependency": "direct main",
@@ -893,21 +863,21 @@
      "dependency": "direct main",
      "description": {
        "name": "go_router",
-        "sha256": "c92d18e1fe994cb06d48aa786c46b142a5633067e8297cff6b5a3ac742620104",
+        "sha256": "eff94d2a6fc79fa8b811dde79c7549808c2346037ee107a1121b4a644c745f2a",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "17.0.0"
+      "version": "17.0.1"
    },
    "google_fonts": {
      "dependency": "direct main",
      "description": {
        "name": "google_fonts",
-        "sha256": "517b20870220c48752eafa0ba1a797a092fb22df0d89535fd9991e86ee2cdd9c",
+        "sha256": "eefe5ee217f331627d8bbcf01f91b21c730bf66e225d6dc8a148370b0819168d",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "6.3.2"
+      "version": "7.0.0"
    },
    "graphs": {
      "dependency": "transitive",
@@ -1722,41 +1692,41 @@
      "dependency": "transitive",
      "description": {
        "name": "riverpod",
-        "sha256": "c406de02bff19d920b832bddfb8283548bfa05ce41c59afba57ce643e116aa59",
+        "sha256": "16ff608d21e8ea64364f2b7c049c94a02ab81668f78845862b6e88b71dd4935a",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "3.0.3"
+      "version": "3.1.0"
    },
    "riverpod_analyzer_utils": {
      "dependency": "transitive",
      "description": {
        "name": "riverpod_analyzer_utils",
-        "sha256": "a0f68adb078b790faa3c655110a017f9a7b7b079a57bbd40f540e80dce5fcd29",
+        "sha256": "947b05d04c52a546a2ac6b19ef2a54b08520ff6bdf9f23d67957a4c8df1c3bc0",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "1.0.0-dev.7"
+      "version": "1.0.0-dev.8"
    },
    "riverpod_annotation": {
      "dependency": "direct main",
      "description": {
        "name": "riverpod_annotation",
-        "sha256": "7230014155777fc31ba3351bc2cb5a3b5717b11bfafe52b1553cb47d385f8897",
+        "sha256": "cc1474bc2df55ec3c1da1989d139dcef22cd5e2bd78da382e867a69a8eca2e46",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "3.0.3"
+      "version": "4.0.0"
    },
    "riverpod_generator": {
      "dependency": "direct dev",
      "description": {
        "name": "riverpod_generator",
-        "sha256": "49894543a42cf7a9954fc4e7366b6d3cb2e6ec0fa07775f660afcdd92d097702",
+        "sha256": "e43b1537229cc8f487f09b0c20d15dba840acbadcf5fc6dad7ad5e8ab75950dc",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "3.0.3"
+      "version": "4.0.0+1"
    },
    "rust_lib_mangayomi": {
      "dependency": "direct main",
@@ -2505,7 +2475,7 @@
    }
  },
  "sdks": {
-    "dart": ">=3.10.1 <4.0.0",
+    "dart": ">=3.10.4 <4.0.0",
    "flutter": ">=3.38.1"
  }
 }
@@ -22,16 +22,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "mise";
-  version = "2026.1.5";
+  version = "2026.1.8";

  src = fetchFromGitHub {
    owner = "jdx";
    repo = "mise";
    rev = "v${version}";
-    hash = "sha256-rOeTm4Qc8+cqce5jx4LciVMiQ7Jvu4883t0KdqgeTy4=";
+    hash = "sha256-D2WTKMjxUCunp5GDA0TG1P9lilLoytk1KWJiI+ht3XM=";
  };

-  cargoHash = "sha256-/QcnUD8/WsZnbQY+Ecc33KT4tOj0Ua+BOBFybBK/O4Y=";
+  cargoHash = "sha256-2Fv+kRWtDAgAvqehgdqWfznKY4UhUdEj2NRN9MD2vy4=";

  nativeBuildInputs = [
    installShellFiles
@@ -31,13 +31,13 @@ in

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "modrinth-app-unwrapped";
-  version = "0.10.26";
+  version = "0.10.27";

  src = fetchFromGitHub {
    owner = "modrinth";
    repo = "code";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-1C0BCbDJ6/nYzWEL5UA9GQW4vSo4ZfP6BuA3i4JoiuY=";
+    hash = "sha256-5KHxoOozqZMvq91oKZ18Hmt0W8r9Va0AJr0hWMmBCfs=";
  };

  patches = [
@@ -67,7 +67,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
      --replace-fail '1.0.0-local' '${finalAttrs.version}'
  '';

-  cargoHash = "sha256-pZwWqWkcq142iIO0Ier9NH56P1EWXAoRiqDCNyElXCA=";
+  cargoHash = "sha256-OQVHG0iUyYcpc63N4Y3i8oWohDO4JBUIk3LEAf6ifL0=";
  mitmCache = gradle.fetchDeps {
    inherit (finalAttrs) pname;
    data = ./deps.json;
@@ -77,7 +77,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    inherit (finalAttrs) pname version src;
    pnpm = pnpm_9;
    fetcherVersion = 1;
-    hash = "sha256-m5/7fD4OBJcY7stZhwDLw4asmXqUThUjTaRb3oVul78=";
+    hash = "sha256-N57RSuVRX33AhQBjHbxR0g9q62rYVqAlYJ1dhuUu0xw=";
  };

  nativeBuildInputs = [
@@ -163,6 +163,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    maintainers = with lib.maintainers; [
      getchoo
      hythera
+      encode42
    ];
    mainProgram = "ModrinthApp";
    platforms = with lib.platforms; linux ++ darwin;
@@ -95,7 +95,7 @@ stdenv.mkDerivation (
  in
  {
    pname = "neovim-unwrapped";
-    version = "0.11.5";
+    version = "0.11.6";

    __structuredAttrs = true;

@@ -103,7 +103,7 @@ stdenv.mkDerivation (
      owner = "neovim";
      repo = "neovim";
      tag = "v${finalAttrs.version}";
-      hash = "sha256-OsvLB9kynCbQ8PDQ2VQ+L56iy7pZ0ZP69J2cEG8Ad8A=";
+      hash = "sha256-GdfCaKNe/qPaUV2NJPXY+ATnQNWnyFTFnkOYDyLhTNg=";
    };

    strictDeps = true;
@@ -12,11 +12,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "plasticscm-client-core-unwrapped";
-  version = "11.0.16.9872";
+  version = "11.0.16.9890";

  src = fetchurl {
    url = "https://www.plasticscm.com/plasticrepo/stable/debian/amd64/plasticscm-client-core_${finalAttrs.version}_amd64.deb";
-    hash = "sha256-5V1x21+Dal6JDI8KBEFr9PXH1k12LutVWbaMOuDL954=";
+    hash = "sha256-J87bDtuAN+5sRLecdCXmaUlICTnCp25XMMIS+IQM/jQ=";
    nativeBuildInputs = [ dpkg ];
    downloadToTemp = true;
    recursiveHash = true;
@@ -14,13 +14,13 @@

 stdenv.mkDerivation {
  pname = "projectm-sdl-cpp";
-  version = "0-unstable-2025-12-27";
+  version = "0-unstable-2026-01-20";

  src = fetchFromGitHub {
    owner = "projectM-visualizer";
    repo = "frontend-sdl-cpp";
-    rev = "0231108c9574c7ba04490fe0036b314f7f37ca6e";
-    hash = "sha256-NSwy0pJeJpqRxQI451J2kdevNt5EWUF4REhsmF0HS3w=";
+    rev = "7a07229428c51378f43843cf160bcddc21ef70ff";
+    hash = "sha256-hz1Au5Gn10Yi5f7d7UiQOHTCU00Ze5UoQ40jirg54Pc=";
    fetchSubmodules = true;
  };

@@ -8,18 +8,18 @@

 buildGoModule rec {
  pname = "prow";
-  version = "0-unstable-2025-12-23";
-  rev = "f0341d7b566080979b11661dc61a98f64db0d028";
+  version = "0-unstable-2026-01-26";
+  rev = "a0e74f2f7661a5ce8ecae738314ec0b4d4a182b0";

  src = fetchFromGitHub {
    inherit rev;

    owner = "kubernetes-sigs";
    repo = "prow";
-    hash = "sha256-V0tdABcZ/ob3duUkKbdcLn4AyOA8um7WkcohoH5J/pQ=";
+    hash = "sha256-EKWd0G6ONOWNYZCyp4UlY4lalfhB27sV5HwkKmyRscs=";
  };

-  vendorHash = "sha256-/ZAnYxUHHq+tqk0hcJrt6ZrpDDRqyLITWGL/hgW4A6A=";
+  vendorHash = "sha256-Pv9LznRh7Nzm74gMKT2Q/VLIMIIc93en0qX6YA6TwK4=";

  # doCheck = false;

@@ -13,19 +13,19 @@
  lld,
 }:
 let
-  version = "0.34.1";
+  version = "0.34.2";
  pname = "rauthy";

  src = fetchFromGitHub {
    owner = "sebadob";
    repo = "rauthy";
    tag = "v${version}";
-    hash = "sha256-6Ddf8ukwEecxBp9hMbWS4odxrRGB/uIXWdTbIU3MAUM=";
+    hash = "sha256-h7Nd17l/BR7p+b+9AqX8IYf0mfcc9QI9LQnR2cBc2s4=";
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
    inherit src pname version;
-    hash = "sha256-fXe4bQRLscUk7fdAQGwzwBVJIRs8+puWfTeAjby1MmE=";
+    hash = "sha256-jhli1axBU/UV6k5apxbE7g9+F6dsHzY30/QKSgJ22Ws=";
  };

  # Wasm modules are needed to build the frontend and are part of the main Rust repo.
@@ -77,7 +77,7 @@ let
      "-p2"
    ];

-    npmDepsHash = "sha256-F8/zbqI7Nmm8GLtkL25QDX222yzhlg7NA32tpBa8b5o=";
+    npmDepsHash = "sha256-pfrT2cXZWOetoquaMMNslo8nTy9DBornLCp48pGHRIM=";

    preBuild = ''
      mkdir -p ./src/wasm/
@@ -7,14 +7,14 @@

 python3.pkgs.buildPythonApplication {
  pname = "renode-dts2repl";
-  version = "0-unstable-2026-01-12";
+  version = "0-unstable-2026-01-23";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "antmicro";
    repo = "dts2repl";
-    rev = "b47b972dff8a835be2999cab8cd167d8778ce53a";
-    hash = "sha256-34BEX7WaFZJVNeXxfPr6V6MGiqrIJ/Wdal8iwQkr4tQ=";
+    rev = "778be81b48eeeeb7991a49a816b350e4a88e0be1";
+    hash = "sha256-Bmfty8W02RVTFU5yhIhkcDmO2yE8ECV87kbAsNNRGcY=";
  };

  nativeBuildInputs = [
@@ -7,16 +7,16 @@

 php.buildComposerProject2 (finalAttrs: {
  pname = "roave-backward-compatibility-check";
-  version = "8.15.0";
+  version = "8.17.0";

  src = fetchFromGitHub {
    owner = "Roave";
    repo = "BackwardCompatibilityCheck";
    tag = finalAttrs.version;
-    hash = "sha256-vhoV8AkkcL1pDmHkpPYs5lD6TUcvMC6BXkQF1T2esIE=";
+    hash = "sha256-+LoAR7pViUnzIICRUUWa7Z5DvSBXo+lr4bjFrTSwq0g=";
  };

-  vendorHash = "sha256-LBvqnBcSpjffS3cjgVgql8eNmaP45uNx9BKr72Mr+ZY=";
+  vendorHash = "sha256-q3n3VIxGlIz+xI5h/JNq40CvXFbShXeVoQ5VoIjk21I=";

  nativeInstallCheckInputs = [
    versionCheckHook
@@ -2,50 +2,68 @@
  lib,
  stdenv,
  fetchzip,
-  autoPatchelfHook,
  upx,
+  autoPatchelfHook,
+  versionCheckHook,
+  writeShellScript,
+  nix-update,
 }:
-let
-  platformMap = {
-    "x86_64-linux" = "linux-amd64";
-    "aarch64-linux" = "linux-aarch64";
-  };
-  system = stdenv.hostPlatform.system;
-  platform = platformMap.${system} or (throw "Unsupported platform: ${system}");
-  hashs = {
-    "x86_64-linux" = "sha256-J2kRVJRC0GhxLMarg7Ucdk8uvzTsKbFHePEflPjwsHU=";
-    "aarch64-linux" = "sha256-UT+Rd6TEMYL/+xfqGxGN/tiSBvN8ntDrkCBj4PuMRwg=";
-  };
-in
+
 stdenv.mkDerivation (finalAttrs: {
  pname = "snell-server";
  version = "5.0.1";

-  src = fetchzip {
-    url = "https://dl.nssurge.com/snell/snell-server-v${finalAttrs.version}-${platform}.zip";
-    hash = hashs.${system};
-  };
+  src =
+    let
+      selectSystem = attrs: attrs.${stdenv.hostPlatform.system};
+      arch = selectSystem {
+        x86_64-linux = "amd64";
+        aarch64-linux = "aarch64";
+      };
+    in
+    fetchzip {
+      url = "https://dl.nssurge.com/snell/snell-server-v${finalAttrs.version}-linux-${arch}.zip";
+      hash = selectSystem {
+        x86_64-linux = "sha256-J2kRVJRC0GhxLMarg7Ucdk8uvzTsKbFHePEflPjwsHU=";
+        aarch64-linux = "sha256-UT+Rd6TEMYL/+xfqGxGN/tiSBvN8ntDrkCBj4PuMRwg=";
+      };
+    };

  nativeBuildInputs = [
    upx
    autoPatchelfHook
+    versionCheckHook
  ];
-  buildInputs = [
-    (lib.getLib stdenv.cc.cc)
-  ];
+
+  buildInputs = [ (lib.getLib stdenv.cc.cc) ];
+
  installPhase = ''
    runHook preInstall
+
    upx -d snell-server
    install -Dm755 snell-server $out/bin/snell-server
+
    runHook postInstall
  '';

+  doInstallCheck = true;
+
+  passthru.updateScript = writeShellScript "update-snell-server" ''
+    latestVersion=$(curl --fail --silent https://kb.nssurge.com/surge-knowledge-base/release-notes/snell | grep -oE 'snell-server-v[0-9]+\.[0-9]+\.[0-9]+' | sed 's/snell-server-v//' | sort -V | tail -n1)
+    if [[ "$latestVersion" == "$UPDATE_NIX_OLD_VERSION" ]]; then exit 0; fi
+    ${lib.getExe nix-update} pkgsCross.gnu64.snell --version "$latestVersion"
+    ${lib.getExe nix-update} pkgsCross.aarch64-multiplatform.snell --version skip
+  '';
+
  meta = {
    description = "Lean encrypted proxy protocol";
    homepage = "https://kb.nssurge.com/surge-knowledge-base/release-notes/snell";
    license = lib.licenses.unfree;
    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
-    platforms = lib.attrNames platformMap;
+    platforms = [
+      "x86_64-linux"
+      "aarch64-linux"
+    ];
    maintainers = with lib.maintainers; [
      mlyxshi
    ];
@@ -66,6 +66,11 @@ stdenv.mkDerivation rec {
    wrapProgram $out/bin/sshfs --prefix PATH : "${openssh}/bin"
  '';

+  outputs = [
+    "out"
+    "man"
+  ];
+
  # doCheck = true;
  checkPhase = lib.optionalString (!stdenv.hostPlatform.isDarwin) ''
    # The tests need fusermount:
@@ -9,13 +9,13 @@

 buildGoModule (finalAttrs: {
  pname = "tsgolint";
-  version = "0.11.1";
+  version = "0.11.2";

  src = fetchFromGitHub {
    owner = "oxc-project";
    repo = "tsgolint";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-s+rXbUrP/mJiqUruFUlzz8gxG4LDfvFRLKmlUIOcFho=";
+    hash = "sha256-Gby8JW3bwVOIuNgLCIIt0y3egdljrR5cgbqAGqqqzpI=";
    fetchSubmodules = true;
  };

@@ -49,7 +49,7 @@ buildGoModule (finalAttrs: {
    '';

  proxyVendor = true;
-  vendorHash = "sha256-CGgLQKNGMKqIjfBnR7Uv6TwOfukfLX3hpLmSNHAZRv8=";
+  vendorHash = "sha256-pCmPL0OVwclCV5riL8wozCiQA2zRDafBKTxdkt/q3ns=";

  subPackages = [ "cmd/tsgolint" ];

@@ -18,16 +18,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "turbo-unwrapped";
-  version = "2.7.3";
+  version = "2.7.6";

  src = fetchFromGitHub {
    owner = "vercel";
    repo = "turborepo";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-DLe3gCMSSB8464DAKnzDk6iJVVL2yL02+1sUOGbdGxI=";
+    hash = "sha256-skpTDC27F2S+rKB+24+I1OxgDX6AmdI9QwnUAr0Ps4o=";
  };

-  cargoHash = "sha256-1M0EGZIiYkQcEByKZFRVEfWDp9Yb/kHr/VijRFNronk=";
+  cargoHash = "sha256-47ATXzlArTT+QsQvCQ7AfnFOXxTbPfXqmMS3zIimkEc=";

  nativeBuildInputs = [
    capnproto
@@ -82,6 +82,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [
      getchoo
+      hythera
    ];
    mainProgram = "turbo";
  };
@@ -14,14 +14,14 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "ty";
-  version = "0.0.13";
+  version = "0.0.14";

  src = fetchFromGitHub {
    owner = "astral-sh";
    repo = "ty";
    tag = finalAttrs.version;
    fetchSubmodules = true;
-    hash = "sha256-2KPnFNutndxE5ap0E9BCL5w6vpnfow8GIY4/N9dgYy8=";
+    hash = "sha256-8mpTz0X7rV+lNX/qyWywomkBVY0Gq9UrKF8pv5dNlcI=";
  };

  # For Darwin platforms, remove the integration test for file notifications,
@@ -35,7 +35,7 @@ rustPlatform.buildRustPackage (finalAttrs: {

  cargoBuildFlags = [ "--package=ty" ];

-  cargoHash = "sha256-E/kR6AxzpIqKMM80+ute5Z6LUL5f39RYfj7BnGOg6V4=";
+  cargoHash = "sha256-8W37Ul7hx99rSbzGsVKp5burq0D55I+dezidYfJ60a8=";

  nativeBuildInputs = [ installShellFiles ];

@@ -2,20 +2,20 @@
  lib,
  stdenv,
  fetchurl,
+  pkg-config,
  dlib,
  gsl,
  mpfr,
  perl,
  python3,
 }:
-
 stdenv.mkDerivation rec {
  pname = "viennarna";
-  version = "2.7.0";
+  version = "2.7.2";

  src = fetchurl {
    url = "https://www.tbi.univie.ac.at/RNA/download/sourcecode/2_7_x/ViennaRNA-${version}.tar.gz";
-    hash = "sha256-mpn9aO04CJTe+01eaooocWKScAKM338W8KBdpujHFHM=";
+    hash = "sha256-GrX0pPdvyFoiQ1RgiORfXYXy16VsxlbpabAFzOm/q18=";
  };

  # use nixpkgs dlib sources instead of bundled ones
@@ -26,6 +26,10 @@ stdenv.mkDerivation rec {
    find ./src/dlib-19.24 -type d -exec chmod +w {} \;
  '';

+  nativeBuildInputs = [
+    pkg-config
+  ];
+
  buildInputs = [
    gsl
    mpfr
@@ -4,16 +4,16 @@
  python3,
 }:

-python3.pkgs.buildPythonApplication rec {
+python3.pkgs.buildPythonApplication (finalAttrs: {
  pname = "wafw00f";
-  version = "2.3.2";
+  version = "2.4.2";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "EnableSecurity";
    repo = "wafw00f";
-    tag = "v${version}";
-    hash = "sha256-nJNJAmSjEYKgqVYcNDIL8O6AQzK6DrIN8P4U0s/PWQM=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-vGTqgvAVO6fbgRN5V5HhlKFrI9Z2XZaAjI1L19RIi9U=";
  };

  build-system = with python3.pkgs; [ setuptools ];
@@ -31,9 +31,9 @@ python3.pkgs.buildPythonApplication rec {
  meta = {
    description = "Tool to identify and fingerprint Web Application Firewalls (WAF)";
    homepage = "https://github.com/EnableSecurity/wafw00f";
-    changelog = "https://github.com/EnableSecurity/wafw00f/releases/tag/v${version}";
+    changelog = "https://github.com/EnableSecurity/wafw00f/releases/tag/${finalAttrs.src.tag}";
    license = lib.licenses.bsd3;
    maintainers = with lib.maintainers; [ fab ];
    mainProgram = "wafw00f";
  };
-}
+})
@@ -186,6 +186,18 @@ stdenv.mkDerivation (finalAttrs: {

    (replaceVars ./0002-scripts-external-executable-calls.patch scriptDeps)

+    # XSA #477
+    (fetchpatch {
+      url = "https://xenbits.xenproject.org/xsa/xsa477.patch";
+      hash = "sha256-c9i61GvHPiLwMGvd+5IKgUwyu/NPub+mtnxUPHW/HhI=";
+    })
+
+    # XSA #479
+    (fetchpatch {
+      url = "https://xenbits.xenproject.org/xsa/xsa479.patch";
+      hash = "sha256-2o6RYyT4Nrg1le6BUOQ3AwedorCvxvKao2uMYWrUV1Y=";
+    })
+
    # patch `libxl` to search for `qemu-system-i386` properly. (Before 4.21)
    (fetchpatch {
      url = "https://github.com/xen-project/xen/commit/f6281291704aa356489f4bd927cc7348a920bd01.diff?full_index=1";
@@ -5,13 +5,13 @@
 }:
 mkYaziPlugin {
  pname = "yatline.yazi";
-  version = "25.5.31-unstable-2026-01-21";
+  version = "25.12.29-unstable-2026-01-27";

  src = fetchFromGitHub {
    owner = "imsi32";
    repo = "yatline.yazi";
-    rev = "3227a30b21f69b68df513754b5a00d6e75cece57";
-    hash = "sha256-yhptHABQ0alVab2i367D5grJyG7SrfHH8H4JuGeYFyk=";
+    rev = "c5d4b487d6277dd68ea9d3c6537641bf4ae9cf8e";
+    hash = "sha256-HjTRAfUHs6vlEWKruQWeA2wT/Mcd+WEHM90egFTYcWQ=";
  };

  meta = {
@@ -1,21 +1,21 @@
 {
  lib,
  stdenv,
-  fetchFromGitLab,
+  fetchFromGitHub,
  pkg-config,
  gtk3,
  wrapGAppsHook3,
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
  pname = "zenmonitor";
-  version = "unstable-2024-12-19";
+  version = "unstable-2025-06-12";

-  src = fetchFromGitLab {
-    owner = "shdwchn10";
+  src = fetchFromGitHub {
+    owner = "detiam";
    repo = "zenmonitor3";
-    rev = "a09f0b25d33967fd32f3831304be049b008cdabf";
-    sha256 = "sha256-5N1Hhv2s0cv4Rujw4wFGHyIy7NyKAFThVvAo+xXqSyk=";
+    rev = "1e1ceec7353dc418578fe8ae56536bfee6adeca3";
+    sha256 = "sha256-q5BeLu0A2XJkJL8ptN4hj/iLhQmpb16QEhOuIhNzVaI=";
  };

  buildInputs = [ gtk3 ];
@@ -27,8 +27,8 @@ stdenv.mkDerivation rec {
  makeFlags = [ "PREFIX=${placeholder "out"}" ];

  meta = {
-    inherit (src.meta) homepage;
    description = "Monitoring software for AMD Zen-based CPUs";
+    homepage = "https://github.com/detiam/zenmonitor3";
    mainProgram = "zenmonitor";
    license = lib.licenses.mit;
    platforms = [
@@ -18,8 +18,8 @@ let
  param =
    if lib.versionAtLeast ppxlib.version "0.36" then
      {
-        version = "3.17.2";
-        hash = "sha256-f0CHAW6MOToT1Xt3N2d7wdvxaXj9Q8GTVNTXmnlMjEc=";
+        version = "3.17.3";
+        hash = "sha256-AcRZG4ITrYxxtunx0YDqvSANRBk27if+n5lka3X5hlw=";
      }
    else
      {
@@ -0,0 +1,57 @@
+{ callPackage, ... }@_args:
+
+let
+  base = callPackage ./generic.nix (
+    _args
+    // {
+      version = "8.5.2";
+      hash = "sha256-9+/ezMOoELGJIGkjBlNrmaO6hmENvQeVopbPd9P7OgY=";
+    }
+  );
+in
+base.withExtensions (
+  { all, ... }:
+  with all;
+  [
+    bcmath
+    calendar
+    curl
+    ctype
+    dom
+    exif
+    fileinfo
+    filter
+    ftp
+    gd
+    gettext
+    gmp
+    iconv
+    intl
+    ldap
+    mbstring
+    mysqli
+    mysqlnd
+    openssl
+    pcntl
+    pdo
+    pdo_mysql
+    pdo_odbc
+    pdo_pgsql
+    pdo_sqlite
+    pgsql
+    posix
+    readline
+    session
+    simplexml
+    sockets
+    soap
+    sodium
+    sysvsem
+    sqlite3
+    tokenizer
+    xmlreader
+    xmlwriter
+    zip
+    zlib
+  ]
+)
@@ -346,6 +346,10 @@ let

            substituteInPlace $dev/bin/phpize \
              --replace-fail "$out/lib" "$dev/lib"
+          ''
+          + lib.optionalString (lib.versionAtLeast version "8.5") ''
+            # PHP 8.5+ has lexbor built into core; dom needs its headers.
+            cp -r ext/lexbor/lexbor $dev/include/php/ext/lexbor/
          '';

          src = if phpSrc == null then defaultPhpSrc else phpSrc;
@@ -1,24 +0,0 @@
-{ stdenv }:
-
-let
-  windir = "/cygdrive/c/WINDOWS";
-in
-{
-  pkg = stdenv.mkDerivation rec {
-    pname = "dotnetfx";
-    version = "3.5";
-    src = "${windir}/Microsoft.NET/Framework/v${version}";
-    buildCommand = ''
-      mkdir -p $out/bin
-      ln -s $src/MSBuild.exe $out/bin
-    '';
-  };
-
-  assembly20Path = "/cygdrive/c/WINDOWS/Microsoft.NET/Framework/v2.0.50727";
-
-  wcfPath = "/cygdrive/c/WINDOWS/Microsoft.NET/Framework/v3.0/WINDOW~1";
-
-  referenceAssembly30Path = "/cygdrive/c/PROGRA~1/REFERE~1/Microsoft/Framework/v3.0";
-
-  referenceAssembly35Path = "/cygdrive/c/PROGRA~1/REFERE~1/Microsoft/Framework/v3.5";
-}
@@ -1,24 +0,0 @@
-{ stdenv }:
-
-let
-  windir = "/cygdrive/c/WINDOWS";
-in
-{
-  pkg = stdenv.mkDerivation rec {
-    pname = "dotnetfx";
-    version = "4.0.30319";
-    src = "${windir}/Microsoft.NET/Framework/v${version}";
-    buildCommand = ''
-      mkdir -p $out/bin
-      ln -s $src/MSBuild.exe $out/bin
-    '';
-  };
-
-  assembly20Path = "/cygdrive/c/WINDOWS/Microsoft.NET/Framework/v2.0.50727";
-
-  wcfPath = "/cygdrive/c/WINDOWS/Microsoft.NET/Framework/v3.0/WINDOW~1";
-
-  referenceAssembly30Path = "/cygdrive/c/PROGRA~1/REFERE~1/Microsoft/Framework/v3.0";
-
-  referenceAssembly35Path = "/cygdrive/c/PROGRA~1/REFERE~1/Microsoft/Framework/v3.5";
-}
@@ -4,24 +4,25 @@
  fetchFromGitHub,
 }:

-buildDunePackage rec {
+buildDunePackage (finalAttrs: {
  pname = "gendarme";
-  version = "0.3";
+  version = "0.4";

-  minimalOCamlVersion = "4.08";
+  minimalOCamlVersion = "4.13";

  src = fetchFromGitHub {
    owner = "bensmrs";
    repo = "gendarme";
-    tag = version;
-    hash = "sha256-GWWAbYevd74YYRpyUjEI4rtzuXGZPp4Wa4uUqD6D7l8=";
+    tag = finalAttrs.version;
+    hash = "sha256-yiHBAhnWYntv+5fKG7Sa1RqsnvWIsW0YDqp+uAzpg/s=";
  };

  meta = {
    description = "Marshalling library for OCaml";
    homepage = "https://github.com/bensmrs/gendarme";
-    changelog = "https://github.com/bensmrs/gendarme/releases/tag/${version}";
+    changelog = "https://github.com/bensmrs/gendarme/releases/tag/${finalAttrs.src.tag}";
    license = lib.licenses.mit;
-    maintainers = [ lib.maintainers.ethancedwards8 ];
+    maintainers = with lib.maintainers; [ ethancedwards8 ];
+    teams = with lib.teams; [ ngi ];
  };
-}
+})
@@ -3,6 +3,7 @@
  pkg-config,
  lib,
  grpc,
+  php,
 }:

 buildPecl {
@@ -26,5 +27,6 @@ buildPecl {
    homepage = "https://github.com/grpc/grpc/tree/master/src/php/ext/grpc";
    license = lib.licenses.asl20;
    teams = [ lib.teams.php ];
+    broken = lib.versionAtLeast php.version "8.5";
  };
 }
@@ -1,5 +1,8 @@
-{ buildPecl, lib }:
-
+{
+  buildPecl,
+  lib,
+  php,
+}:
 buildPecl {
  pname = "igbinary";
  version = "3.2.14";
@@ -17,5 +20,6 @@ buildPecl {
    homepage = "https://github.com/igbinary/igbinary/";
    license = lib.licenses.bsd3;
    teams = [ lib.teams.php ];
+    broken = lib.versionAtLeast php.version "8.5";
  };
 }
@@ -49,6 +49,7 @@ stdenv.mkDerivation {
    sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
    license = lib.licenses.unfree;
    maintainers = with lib.maintainers; [ neverbehave ];
+    broken = lib.versionAtLeast php.version "8.5";
    platforms = [
      "x86_64-linux"
      "aarch64-linux"
@@ -31,5 +31,6 @@ buildPecl rec {
    homepage = "https://github.com/websupport-sk/pecl-memcache";
    maintainers = [ lib.maintainers.krzaczek ];
    teams = [ lib.teams.php ];
+    broken = lib.versionAtLeast php.version "8.5";
  };
 }
@@ -35,6 +35,6 @@ buildPecl {
      You can use the sync or async, Coroutine API to write whole applications or create thousands of light weight Coroutines within one Linux process.
    '';
    teams = [ lib.teams.php ];
-    broken = lib.versionOlder php.version "8.2";
+    broken = lib.versionOlder php.version "8.2" || lib.versionAtLeast php.version "8.5";
  };
 }
@@ -22,5 +22,6 @@ buildPecl {
    license = lib.licenses.mit;
    homepage = "https://github.com/Microsoft/msphpsql";
    teams = [ lib.teams.php ];
+    broken = lib.versionAtLeast php.version "8.5";
  };
 }
@@ -38,5 +38,6 @@ buildPecl rec {
    homepage = "https://phalcon.io";
    maintainers = [ lib.maintainers.krzaczek ];
    teams = [ lib.teams.php ];
+    broken = lib.versionAtLeast php.version "8.5";
  };
 }
@@ -3,6 +3,7 @@
  lib,
  pkg-config,
  rrdtool,
+  fetchpatch,
 }:

 buildPecl {
@@ -19,6 +20,14 @@ buildPecl {
    pkg-config
  ];

+  patches = [
+    # PHP 8.5 compatibility patch
+    (fetchpatch {
+      url = "https://github.com/php/pecl-processing-rrd/pull/4/commits/dd4856dc89499a0141b1710e791f0e1096c7b244.patch";
+      hash = "sha256-ES+cMhMBUubFB5TpTZzzKKfEK2cY737z7zCuNy4XF8Y=";
+    })
+  ];
+
  # Fix GCC 14 build.
  # from incompatible pointer type [-Wincompatible-pointer-types
  env.NIX_CFLAGS_COMPILE = "-Wno-error=incompatible-pointer-types";
@@ -33,5 +33,6 @@ buildPecl {
    homepage = "https://www.swoole.com";
    license = lib.licenses.asl20;
    teams = [ lib.teams.php ];
+    broken = lib.versionAtLeast php.version "8.5";
  };
 }
@@ -15,14 +15,14 @@

 buildPythonPackage rec {
  pname = "coverage";
-  version = "7.13.1";
+  version = "7.13.2";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "coveragepy";
    repo = "coveragepy";
    tag = version;
-    hash = "sha256-xdbgHUE+vbSiqLRDhd5G5u90VU5+TxLehAuwdhdGzBQ=";
+    hash = "sha256-dYgZLAiuPwYs4NomT+c2KS9VXXYEMW8oyHk2y4TCwe0=";
  };

  build-system = [ setuptools ];
@@ -9,21 +9,21 @@
  setuptools,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "iterfzf";
-  version = "1.8.0.62.0";
+  version = "1.9.0.67.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "dahlia";
    repo = "iterfzf";
-    tag = version;
-    hash = "sha256-eLgF+9p+sqxWR1VkSoeL0NPDMamzUYbql4gMeG8fyNY=";
+    tag = finalAttrs.version;
+    hash = "sha256-Giw5d0X8/1PXK1j428LJjg+Gqadm93C51mLfrYc5J94=";
  };

  postPatch = ''
    substituteInPlace pyproject.toml \
-      --replace-fail 'dynamic = ["version"]' 'version = "${version}"' \
+      --replace-fail 'dynamic = ["version"]' 'version = "${finalAttrs.version}"' \
      --replace-fail 'backend-path = ["."]' '# backend-path = ["."]' \
      --replace-fail 'build-backend = "build_dist"' '# build-backend = "build_dist"'

@@ -53,9 +53,9 @@ buildPythonPackage rec {
  meta = {
    description = "Pythonic interface to fzf, a CLI fuzzy finder";
    homepage = "https://github.com/dahlia/iterfzf";
-    changelog = "https://github.com/dahlia/iterfzf/releases/tag/${version}";
-    license = lib.licenses.gpl3Only;
+    changelog = "https://github.com/dahlia/iterfzf/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.gpl3Plus;
    maintainers = with lib.maintainers; [ fab ];
    platforms = lib.platforms.unix;
  };
-}
+})
@@ -1,7 +1,7 @@
 {
  lib,
  buildPythonPackage,
-  fetchPypi,
+  fetchFromGitHub,
  freetds,
  krb5-c,
  openssl,
@@ -13,20 +13,21 @@
  sqlalchemy,
  tomli,
 }:
-
 buildPythonPackage rec {
  pname = "pymssql";
-  version = "2.3.7";
+  version = "2.3.11";
  pyproject = true;

-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-Xm15x7HOxArr7EsJnG5EXMqsJFGeXnZ7SaTm9IwIflA=";
+  src = fetchFromGitHub {
+    owner = "pymssql";
+    repo = "pymssql";
+    tag = "v${version}";
+    hash = "sha256-Ybfg3V4qRqfA5basRAdL027aImt5i2SdfoC+Tfy/qBI=";
  };

  postPatch = ''
    substituteInPlace pyproject.toml \
-      --replace-fail "setuptools>=54.0,<70.3" "setuptools>=54.0"
+      --replace-fail '"standard-distutils ; python_version>='"'"'3.12'"'"'"' ""
  '';

  build-system = [
@@ -61,7 +61,7 @@ rec {
  godotPackages_4_4 = mkGodotPackages "4.4";
  godotPackages_4_5 = mkGodotPackages "4.5";
  godotPackages_4_6 = mkGodotPackages "4.6";
-  godotPackages_4 = godotPackages_4_5;
+  godotPackages_4 = godotPackages_4_6;
  godotPackages = godotPackages_4;

  godot_4_3 = godotPackages_4_3.godot;
@@ -19,8 +19,8 @@
    {
      "4.12.0" = "4.7-412";
      "4.12.1" = "4.7-412";
-      "4.13.0" = "4.7-413";
-      "4.13.1" = "4.7-413";
+      "4.13.0" = "4.7.1-413";
+      "4.13.1" = "4.7.1-413";
      "4.14.0" = "4.19-414";
      "4.14.1" = "4.19-414";
      "4.14.2" = "4.19-414";
@@ -39,7 +39,7 @@ let

  hashes = {
    "4.7-412" = "sha256-0U3Ia7EblKULNy8AuXFVKACZvGN0arYJv7BWiBRgT0Y=";
-    "4.7-413" = "sha256-aVmGWS4bJBLuwsxDKsng/n0A6qlyJ/pnDTcYab/5gyU=";
+    "4.7.1-413" = "sha256-owR9ooUoOrKLOpZbKYDm8Q2ZfDn6C8GJwUF/4HQVRcI=";
    "4.14-500" = "sha256-7CPzJPh1UgzYiX8wPMbU5ZXz1wAJFNQQcp8WuGrR1w4=";
    "4.16-414" = "sha256-xekZdfPfVoSeGzBvNWwxcJorE519V2NLjSHkcyZvzy0="; # Used by ocaml-lsp
    "4.16-501" = "sha256-2lvzCbBAZFwpKuRXLMagpwDb0rz8mWrBPI5cODbCHiY="; # Used by ocaml-lsp
@@ -308,9 +308,9 @@
  };

  glimmer = {
-    version = "1.4.0";
-    url = "github:ember-tooling/tree-sitter-glimmer?ref=v1.4.0-tree-sitter-glimmer";
-    hash = "sha256-4kEOvObNnZtt2aaf0Df+R/Wvyk/JlFnsvbasDIJxt4w=";
+    version = "1.6.0";
+    url = "github:ember-tooling/tree-sitter-glimmer?ref=v1.6.0-tree-sitter-glimmer";
+    hash = "sha256-AW+jd1Kl3krTgnPc8NoXfSM91fOan/wIB/mo/feWj74=";
    meta = {
      license = lib.licenses.mit;
    };
@@ -598,9 +598,9 @@
  };

  markdown = {
-    version = "0.3.2";
+    version = "0.5.2";
    url = "github:tree-sitter-grammars/tree-sitter-markdown";
-    hash = "sha256-OlVuHz9/5lxsGVT+1WhKx+7XtQiezMW1odiHGinzro8=";
+    hash = "sha256-JJCFksPDwaiOmU+nZ3PHeLHlPKWTZBTnqcD/tQorWdU=";
    location = "tree-sitter-markdown";
    meta = {
      license = lib.licenses.mit;
@@ -609,9 +609,9 @@

  markdown-inline = {
    language = "markdown_inline";
-    version = "0.3.2";
+    version = "0.5.2";
    url = "github:tree-sitter-grammars/tree-sitter-markdown";
-    hash = "sha256-OlVuHz9/5lxsGVT+1WhKx+7XtQiezMW1odiHGinzro8=";
+    hash = "sha256-JJCFksPDwaiOmU+nZ3PHeLHlPKWTZBTnqcD/tQorWdU=";
    location = "tree-sitter-markdown-inline";
    meta = {
      license = lib.licenses.mit;
@@ -7,13 +7,13 @@

 stdenv.mkDerivation rec {
  pname = "zenpower";
-  version = "unstable-2025-06-17";
+  version = "unstable-2025-12-20";

  src = fetchFromGitHub {
    owner = "AliEmreSenel";
    repo = "zenpower3";
-    rev = "41e042935ee9840c0b9dd55d61b6ddd58bc4fde6";
-    hash = "sha256-0U/JmEd6OJJeUm1ZLFYxpKH15n7+QTWYOgtKIFAuf/4=";
+    rev = "dc4f1e2d2f5e26ad5b314497485419cb240e7134";
+    hash = "sha256-NvCBog1rAAjbhT9dMOjsmio6lVZ9h36XvOiE7znJdTo=";
  };

  hardeningDisable = [ "pic" ];
@@ -567,6 +567,8 @@ mapAliases {
  dolphin-emu-beta = throw "'dolphin-emu-beta' has been renamed to/replaced by 'dolphin-emu'"; # Converted to throw 2025-10-27
  dontRecurseIntoAttrs = warnAlias "dontRecurseIntoAttrs has been removed from pkgs, use `lib.dontRecurseIntoAttrs` instead" lib.dontRecurseIntoAttrs; # Added 2025-10-30
  dotnetenv = throw "'dotnetenv' has been removed because it was unmaintained in Nixpkgs"; # Added 2025-07-11
+  dotnetfx35 = throw "'dotnetfx35' has been removed because it was unmaintained in Nixpkgs"; # Added 2026-01-27
+  dotnetfx40 = throw "'dotnetfx40' has been removed because it was unmaintained in Nixpkgs"; # Added 2026-01-27
  dotty = throw "'dotty' has been renamed to/replaced by 'scala_3'"; # Converted to throw 2025-10-27
  dovecot_fts_xapian = throw "'dovecot_fts_xapian' has been removed because it was unmaintained in Nixpkgs. Consider using dovecot-fts-flatcurve instead"; # Added 2025-08-16
  dsd = throw "dsd has been removed, as it was broken and lack of upstream maintenance"; # Added 2025-08-25
@@ -1756,15 +1756,7 @@ with pkgs;
    asciidoc = asciidoc-full;
  };

-  dino = callPackage ../applications/networking/instant-messengers/dino {
-    inherit (gst_all_1)
-      gstreamer
-      gst-plugins-base
-      gst-plugins-bad
-      gst-vaapi
-      ;
-    gst-plugins-good = gst_all_1.gst-plugins-good.override { gtkSupport = true; };
-  };
+  dino = callPackage ../applications/networking/instant-messengers/dino { };

  dnschef = python3Packages.callPackage ../tools/networking/dnschef { };

@@ -2344,10 +2336,6 @@ with pkgs;

  diffutils = callPackage ../tools/text/diffutils { };

-  dotnetfx35 = callPackage ../development/libraries/dotnetfx35 { };
-
-  dotnetfx40 = callPackage ../development/libraries/dotnetfx40 { };
-
  drone = callPackage ../development/tools/continuous-integration/drone { };
  drone-oss = callPackage ../development/tools/continuous-integration/drone {
    enableUnfree = false;
@@ -5385,6 +5373,16 @@ with pkgs;
  phpExtensions = recurseIntoAttrs php.extensions;
  phpPackages = recurseIntoAttrs php.packages;

+  # Import PHP85 interpreter, extensions and packages
+  php85 = callPackage ../development/interpreters/php/8.5.nix {
+    stdenv = if stdenv.cc.isClang then llvmPackages.stdenv else stdenv;
+    pcre2 = pcre2.override {
+      withJitSealloc = false; # See https://bugs.php.net/bug.php?id=78927 and https://bugs.php.net/bug.php?id=78630
+    };
+  };
+  php85Extensions = recurseIntoAttrs php85.extensions;
+  php85Packages = recurseIntoAttrs php85.packages;
+
  # Import PHP84 interpreter, extensions and packages
  php84 = callPackage ../development/interpreters/php/8.4.nix {
    stdenv = if stdenv.cc.isClang then llvmPackages.stdenv else stdenv;
@@ -446,6 +446,10 @@ lib.makeScope pkgs.newScope (
              configureFlags = [
                "--enable-dom"
              ];
+              # PHP 8.5+ has lexbor built into core; dom needs its headers.
+              env = lib.optionalAttrs (lib.versionAtLeast php.version "8.5") {
+                NIX_CFLAGS_COMPILE = "-I${php.unwrapped.dev}/include/php/ext/lexbor";
+              };
            }
            {
              name = "enchant";
@@ -572,28 +576,6 @@ lib.makeScope pkgs.newScope (
                '')
              ];
            }
-            {
-              name = "opcache";
-              buildInputs = [
-                pcre2
-              ]
-              ++ lib.optional (
-                !stdenv.hostPlatform.isDarwin && lib.meta.availableOn stdenv.hostPlatform valgrind
-              ) valgrind.dev;
-              configureFlags = lib.optional php.ztsSupport "--disable-opcache-jit";
-              zendExtension = true;
-              postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
-                # Tests are flaky on darwin
-                rm ext/opcache/tests/blacklist.phpt
-                rm ext/opcache/tests/bug66338.phpt
-                rm ext/opcache/tests/bug78106.phpt
-                rm ext/opcache/tests/issue0115.phpt
-                rm ext/opcache/tests/issue0149.phpt
-                rm ext/opcache/tests/revalidate_path_01.phpt
-              '';
-              # Tests launch the builtin webserver.
-              __darwinAllowLocalNetworking = true;
-            }
            {
              name = "openssl";
              buildInputs = [ openssl ];
@@ -828,6 +810,30 @@ lib.makeScope pkgs.newScope (
                "--with-kerberos"
              ];
            }
+          ]
+          ++ lib.optionals (lib.versionOlder php.version "8.5") [
+            {
+              name = "opcache";
+              buildInputs = [
+                pcre2
+              ]
+              ++ lib.optional (
+                !stdenv.hostPlatform.isDarwin && lib.meta.availableOn stdenv.hostPlatform valgrind
+              ) valgrind.dev;
+              configureFlags = lib.optional php.ztsSupport "--disable-opcache-jit";
+              zendExtension = true;
+              postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
+                # Tests are flaky on darwin
+                rm ext/opcache/tests/blacklist.phpt
+                rm ext/opcache/tests/bug66338.phpt
+                rm ext/opcache/tests/bug78106.phpt
+                rm ext/opcache/tests/issue0115.phpt
+                rm ext/opcache/tests/issue0149.phpt
+                rm ext/opcache/tests/revalidate_path_01.phpt
+              '';
+              # Tests launch the builtin webserver.
+              __darwinAllowLocalNetworking = true;
+            }
          ];

          # Convert the list of attrs: