Merge staging-next into staging

2025-04-18 00:16:05 +00:00
parent 2518f525a1 20c76a2b74
commit 27f5e49d97
106 changed files with 1784 additions and 1213 deletions
@@ -161,6 +161,8 @@

 - The `haka` package and module has been removed because the package was broken and unmaintained for 9 years.

+- The `gsignond` package, plugins and module have been removed because they were unmaintained for 6 years.
+
 - `strawberry` has been updated to 1.2, which drops support for the VLC backend and Qt 5. The `strawberry-qt5` package
  and `withGstreamer`/`withVlc` override options have been removed due to this.

@@ -7013,6 +7013,12 @@
    githubId = 8146662;
    name = "Eric Lesiuta";
  };
+  elfenermarcell = {
+    email = "elfenermarcell@gmail.com";
+    github = "elfenermarcell";
+    githubId = 183738665;
+    name = "Marcell Tóth";
+  };
  eliandoran = {
    email = "contact@eliandoran.me";
    name = "Elian Doran";
@@ -343,14 +343,23 @@ in
            ];

            # Don't add `nvidia-uvm` to `kernelModules`, because we want
-            # `nvidia-uvm` be loaded only after `udev` rules for `nvidia` kernel
-            # module are applied.
+            # `nvidia-uvm` be loaded only after the GPU device is available, i.e. after `udev` rules
+            # for `nvidia` kernel module are applied.
+            # This matters on Azure GPU instances: https://github.com/NixOS/nixpkgs/pull/267335
            #
            # Instead, we use `softdep` to lazily load `nvidia-uvm` kernel module
            # after `nvidia` kernel module is loaded and `udev` rules are applied.
            extraModprobeConfig = ''
              softdep nvidia post: nvidia-uvm
            '';
+
+            # Exception is the open-source kernel module failing to load nvidia-uvm using softdep
+            # for unknown reasons.
+            # It affects CUDA: https://github.com/NixOS/nixpkgs/issues/334180
+            # Previously nvidia-uvm was explicitly loaded only when xserver was enabled:
+            # https://github.com/NixOS/nixpkgs/pull/334340/commits/4548c392862115359e50860bcf658cfa8715bde9
+            # We are now loading the module eagerly for all users of the open driver (including headless).
+            kernelModules = lib.optionals useOpenModules [ "nvidia_uvm" ];
          };
          systemd.tmpfiles.rules = lib.mkIf config.virtualisation.docker.enableNvidia [
            "L+ /run/nvidia-docker/bin - - - - ${nvidia_x11.bin}/origBin"
@@ -639,16 +648,11 @@ in
          boot = {
            extraModulePackages = if useOpenModules then [ nvidia_x11.open ] else [ nvidia_x11.bin ];
            # nvidia-uvm is required by CUDA applications.
-            kernelModules =
-              lib.optionals config.services.xserver.enable [
-                "nvidia"
-                "nvidia_modeset"
-                "nvidia_drm"
-              ]
-              # With the open driver, nvidia-uvm does not automatically load as
-              # a softdep of the nvidia module, so we explicitly load it for now.
-              # See https://github.com/NixOS/nixpkgs/issues/334180
-              ++ lib.optionals (config.services.xserver.enable && useOpenModules) [ "nvidia_uvm" ];
+            kernelModules = lib.optionals config.services.xserver.enable [
+              "nvidia"
+              "nvidia_modeset"
+              "nvidia_drm"
+            ];

            # If requested enable modesetting via kernel parameters.
            kernelParams =
@@ -554,7 +554,6 @@
  ./services/desktops/gnome/rygel.nix
  ./services/desktops/gnome/sushi.nix
  ./services/desktops/gnome/tinysparql.nix
-  ./services/desktops/gsignond.nix
  ./services/desktops/gvfs.nix
  ./services/desktops/malcontent.nix
  ./services/desktops/neard.nix
@@ -299,6 +299,9 @@ in
      See https://www.isc.org/blogs/isc-dhcp-eol/ for details.
      Please switch to a different implementation like kea or dnsmasq.
    '')
+    (mkRemovedOptionModule [ "services" "gsignond" ] ''
+      The corresponding package was unmaintained, abandoned upstream, used outdated library and thus removed from nixpkgs.
+    '')
    (mkRemovedOptionModule [ "services" "haka" ] ''
      The corresponding package was broken and removed from nixpkgs.
    '')
@@ -1,46 +0,0 @@
-# Accounts-SSO gSignOn daemon
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-let
-  package = pkgs.gsignond.override { plugins = config.services.gsignond.plugins; };
-in
-{
-
-  meta.maintainers = [ ];
-
-  ###### interface
-
-  options = {
-
-    services.gsignond = {
-
-      enable = lib.mkOption {
-        type = lib.types.bool;
-        default = false;
-        description = ''
-          Whether to enable gSignOn daemon, a DBus service
-          which performs user authentication on behalf of its clients.
-        '';
-      };
-
-      plugins = lib.mkOption {
-        type = lib.types.listOf lib.types.package;
-        default = [ ];
-        description = ''
-          What plugins to use with the gSignOn daemon.
-        '';
-      };
-    };
-  };
-
-  ###### implementation
-  config = lib.mkIf config.services.gsignond.enable {
-    environment.etc."gsignond.conf".source = "${package}/etc/gsignond.conf";
-    services.dbus.packages = [ package ];
-  };
-
-}
@@ -966,7 +966,7 @@ in
  nzbhydra2 = handleTest ./nzbhydra2.nix { };
  ocis = handleTest ./ocis.nix { };
  oddjobd = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./oddjobd.nix { };
-  obs-studio = handleTest ./obs-studio.nix { };
+  obs-studio = runTest ./obs-studio.nix;
  oh-my-zsh = handleTest ./oh-my-zsh.nix { };
  ollama = runTest ./ollama.nix;
  ollama-cuda = runTestOn [ "x86_64-linux" "aarch64-linux" ] ./ollama-cuda.nix;
@@ -1092,21 +1092,25 @@ in
  pretalx = runTest ./web-apps/pretalx.nix;
  prefect = runTest ./prefect.nix;
  pretix = runTest ./web-apps/pretix.nix;
-  printing-socket = handleTest ./printing.nix {
-    socket = true;
-    listenTcp = true;
+  printing-socket = runTest {
+    imports = [ ./printing.nix ];
+    _module.args.socket = true;
+    _module.args.listenTcp = true;
  };
-  printing-service = handleTest ./printing.nix {
-    socket = false;
-    listenTcp = true;
+  printing-service = runTest {
+    imports = [ ./printing.nix ];
+    _module.args.socket = false;
+    _module.args.listenTcp = true;
  };
-  printing-socket-notcp = handleTest ./printing.nix {
-    socket = true;
-    listenTcp = false;
+  printing-socket-notcp = runTest {
+    imports = [ ./printing.nix ];
+    _module.args.socket = true;
+    _module.args.listenTcp = false;
  };
-  printing-service-notcp = handleTest ./printing.nix {
-    socket = false;
-    listenTcp = false;
+  printing-service-notcp = runTest {
+    imports = [ ./printing.nix ];
+    _module.args.socket = false;
+    _module.args.listenTcp = false;
  };
  private-gpt = handleTest ./private-gpt.nix { };
  privatebin = runTest ./privatebin.nix;
@@ -1459,7 +1463,7 @@ in
  wpa_supplicant = import ./wpa_supplicant.nix { inherit pkgs runTest; };
  wordpress = runTest ./wordpress.nix;
  wrappers = handleTest ./wrappers.nix { };
-  writefreely = handleTest ./web-apps/writefreely.nix { };
+  writefreely = import ./web-apps/writefreely.nix { inherit pkgs runTest; };
  wstunnel = runTest ./wstunnel.nix;
  xandikos = runTest ./xandikos.nix;
  xautolock = runTest ./xautolock.nix;
@@ -11,5 +11,5 @@ makeInstalledTest {
    ];
  };

-  tested = pkgs.geocode-glib;
+  tested = pkgs.geocode-glib_2;
 }
@@ -1,40 +1,38 @@
-import ./make-test-python.nix (
-  { ... }:
+{ ... }:

-  {
-    name = "obs-studio";
+{
+  name = "obs-studio";

-    nodes.machine =
-      { pkgs, ... }:
-      {
-        imports = [
-          ./common/x11.nix
-          ./common/user-account.nix
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      imports = [
+        ./common/x11.nix
+        ./common/user-account.nix
+      ];
+
+      programs.obs-studio = {
+        enable = true;
+        plugins = with pkgs.obs-studio-plugins; [
+          wlrobs
+          obs-vkcapture
        ];
-
-        programs.obs-studio = {
-          enable = true;
-          plugins = with pkgs.obs-studio-plugins; [
-            wlrobs
-            obs-vkcapture
-          ];
-          enableVirtualCamera = true;
-        };
+        enableVirtualCamera = true;
      };
+    };

-    testScript = ''
-      machine.wait_for_x()
-      machine.succeed("obs --version")
+  testScript = ''
+    machine.wait_for_x()
+    machine.succeed("obs --version")

-      # virtual camera tests
-      machine.succeed("lsmod | grep v4l2loopback")
-      machine.succeed("ls /dev/video1")
-      machine.succeed("obs --startvirtualcam >&2 &")
-      machine.wait_for_window("OBS")
-      machine.sleep(5)
+    # virtual camera tests
+    machine.succeed("lsmod | grep v4l2loopback")
+    machine.succeed("ls /dev/video1")
+    machine.succeed("obs --startvirtualcam >&2 &")
+    machine.wait_for_window("OBS")
+    machine.sleep(5)

-      # test plugins
-      machine.succeed("which obs-vkcapture")
-    '';
-  }
-)
+    # test plugins
+    machine.succeed("which obs-vkcapture")
+  '';
+}
@@ -1,141 +1,138 @@
 # Test printing via CUPS.
+{
+  pkgs,
+  socket ? true, # whether to use socket activation
+  listenTcp ? true, # whether to open port 631 on client
+  ...
+}:

-import ./make-test-python.nix (
-  {
-    pkgs,
-    socket ? true, # whether to use socket activation
-    listenTcp ? true, # whether to open port 631 on client
-    ...
-  }:
+let
+  inherit (pkgs) lib;
+in

-  let
-    inherit (pkgs) lib;
-  in
+{
+  name = "printing";
+  meta = with lib.maintainers; {
+    maintainers = [
+      domenkozar
+      matthewbauer
+    ];
+  };

-  {
-    name = "printing";
-    meta = with lib.maintainers; {
-      maintainers = [
-        domenkozar
-        matthewbauer
+  nodes.server =
+    { ... }:
+    {
+      services.printing = {
+        enable = true;
+        stateless = true;
+        startWhenNeeded = socket;
+        listenAddresses = [ "*:631" ];
+        defaultShared = true;
+        openFirewall = true;
+        extraConf = ''
+          <Location />
+            Order allow,deny
+            Allow from all
+          </Location>
+        '';
+      };
+      # Add a HP Deskjet printer connected via USB to the server.
+      hardware.printers.ensurePrinters = [
+        {
+          name = "DeskjetLocal";
+          deviceUri = "usb://foobar/printers/foobar";
+          model = "drv:///sample.drv/deskjet.ppd";
+        }
      ];
    };

-    nodes.server =
-      { ... }:
-      {
-        services.printing = {
-          enable = true;
-          stateless = true;
-          startWhenNeeded = socket;
-          listenAddresses = [ "*:631" ];
-          defaultShared = true;
-          openFirewall = true;
-          extraConf = ''
-            <Location />
-              Order allow,deny
-              Allow from all
-            </Location>
-          '';
-        };
-        # Add a HP Deskjet printer connected via USB to the server.
-        hardware.printers.ensurePrinters = [
-          {
-            name = "DeskjetLocal";
-            deviceUri = "usb://foobar/printers/foobar";
-            model = "drv:///sample.drv/deskjet.ppd";
-          }
-        ];
-      };
+  nodes.client =
+    { lib, ... }:
+    {
+      services.printing.enable = true;
+      services.printing.startWhenNeeded = socket;
+      services.printing.listenAddresses = lib.mkIf (!listenTcp) [ ];
+      # Add printer to the client as well, via IPP.
+      hardware.printers.ensurePrinters = [
+        {
+          name = "DeskjetRemote";
+          deviceUri = "ipp://server/printers/DeskjetLocal";
+          model = "drv:///sample.drv/deskjet.ppd";
+        }
+      ];
+      hardware.printers.ensureDefaultPrinter = "DeskjetRemote";
+    };

-    nodes.client =
-      { lib, ... }:
-      {
-        services.printing.enable = true;
-        services.printing.startWhenNeeded = socket;
-        services.printing.listenAddresses = lib.mkIf (!listenTcp) [ ];
-        # Add printer to the client as well, via IPP.
-        hardware.printers.ensurePrinters = [
-          {
-            name = "DeskjetRemote";
-            deviceUri = "ipp://server/printers/DeskjetLocal";
-            model = "drv:///sample.drv/deskjet.ppd";
-          }
-        ];
-        hardware.printers.ensureDefaultPrinter = "DeskjetRemote";
-      };
+  testScript = ''
+    import os
+    import re

-    testScript = ''
-      import os
-      import re
+    start_all()

-      start_all()
+    with subtest("Make sure that cups is up on both sides and printers are set up"):
+        server.wait_for_unit("ensure-printers.service")
+        client.wait_for_unit("ensure-printers.service")

-      with subtest("Make sure that cups is up on both sides and printers are set up"):
-          server.wait_for_unit("ensure-printers.service")
-          client.wait_for_unit("ensure-printers.service")
+    assert "scheduler is running" in client.succeed("lpstat -r")

-      assert "scheduler is running" in client.succeed("lpstat -r")
+    with subtest("UNIX socket is used for connections"):
+        assert "/var/run/cups/cups.sock" in client.succeed("lpstat -H")

-      with subtest("UNIX socket is used for connections"):
-          assert "/var/run/cups/cups.sock" in client.succeed("lpstat -H")
+    with subtest("HTTP server is available too"):
+        ${lib.optionalString listenTcp ''client.succeed("curl --fail http://localhost:631/")''}
+        client.succeed(f"curl --fail http://{server.name}:631/")
+        server.fail(f"curl --fail --connect-timeout 2 http://{client.name}:631/")

-      with subtest("HTTP server is available too"):
-          ${lib.optionalString listenTcp ''client.succeed("curl --fail http://localhost:631/")''}
-          client.succeed(f"curl --fail http://{server.name}:631/")
-          server.fail(f"curl --fail --connect-timeout 2 http://{client.name}:631/")
+    with subtest("LP status checks"):
+        assert "DeskjetRemote accepting requests" in client.succeed("lpstat -a")
+        assert "DeskjetLocal accepting requests" in client.succeed(
+            f"lpstat -h {server.name}:631 -a"
+        )
+        client.succeed("cupsdisable DeskjetRemote")
+        out = client.succeed("lpq")
+        print(out)
+        assert re.search(
+            "DeskjetRemote is not ready.*no entries",
+            client.succeed("lpq"),
+            flags=re.DOTALL,
+        )
+        client.succeed("cupsenable DeskjetRemote")
+        assert re.match(
+            "DeskjetRemote is ready.*no entries", client.succeed("lpq"), flags=re.DOTALL
+        )

-      with subtest("LP status checks"):
-          assert "DeskjetRemote accepting requests" in client.succeed("lpstat -a")
-          assert "DeskjetLocal accepting requests" in client.succeed(
-              f"lpstat -h {server.name}:631 -a"
-          )
-          client.succeed("cupsdisable DeskjetRemote")
-          out = client.succeed("lpq")
-          print(out)
-          assert re.search(
-              "DeskjetRemote is not ready.*no entries",
-              client.succeed("lpq"),
-              flags=re.DOTALL,
-          )
-          client.succeed("cupsenable DeskjetRemote")
-          assert re.match(
-              "DeskjetRemote is ready.*no entries", client.succeed("lpq"), flags=re.DOTALL
-          )
+    # Test printing various file types.
+    for file in [
+        "${pkgs.groff.doc}/share/doc/*/examples/mom/penguin.pdf",
+        "${pkgs.groff.doc}/share/doc/*/meref.ps",
+        "${pkgs.cups.out}/share/doc/cups/images/cups.png",
+        "${pkgs.pcre.doc}/share/doc/pcre/pcre.txt",
+    ]:
+        file_name = os.path.basename(file)
+        with subtest(f"print {file_name}"):
+            # Print the file on the client.
+            print(client.succeed("lpq"))
+            client.succeed(f"lp {file}")
+            client.wait_until_succeeds(
+                f"lpq; lpq | grep -q -E 'active.*root.*{file_name}'"
+            )

-      # Test printing various file types.
-      for file in [
-          "${pkgs.groff.doc}/share/doc/*/examples/mom/penguin.pdf",
-          "${pkgs.groff.doc}/share/doc/*/meref.ps",
-          "${pkgs.cups.out}/share/doc/cups/images/cups.png",
-          "${pkgs.pcre.doc}/share/doc/pcre/pcre.txt",
-      ]:
-          file_name = os.path.basename(file)
-          with subtest(f"print {file_name}"):
-              # Print the file on the client.
-              print(client.succeed("lpq"))
-              client.succeed(f"lp {file}")
-              client.wait_until_succeeds(
-                  f"lpq; lpq | grep -q -E 'active.*root.*{file_name}'"
-              )
+            # Ensure that a raw PCL file appeared in the server's queue
+            # (showing that the right filters have been applied).  Of
+            # course, since there is no actual USB printer attached, the
+            # file will stay in the queue forever.
+            server.wait_for_file("/var/spool/cups/d*-001")
+            server.wait_until_succeeds(f"lpq -a | grep -q -E '{file_name}'")

-              # Ensure that a raw PCL file appeared in the server's queue
-              # (showing that the right filters have been applied).  Of
-              # course, since there is no actual USB printer attached, the
-              # file will stay in the queue forever.
-              server.wait_for_file("/var/spool/cups/d*-001")
-              server.wait_until_succeeds(f"lpq -a | grep -q -E '{file_name}'")
+            # Delete the job on the client.  It should disappear on the
+            # server as well.
+            client.succeed("lprm")
+            client.wait_until_succeeds("lpq -a | grep -q -E 'no entries'")

-              # Delete the job on the client.  It should disappear on the
-              # server as well.
-              client.succeed("lprm")
-              client.wait_until_succeeds("lpq -a | grep -q -E 'no entries'")
+            retry(lambda _: "no entries" in server.succeed("lpq -a"))

-              retry(lambda _: "no entries" in server.succeed("lpq -a"))
-
-              # The queue is empty already, so this should be safe.
-              # Otherwise, pairs of "c*"-"d*-001" files might persist.
-              server.execute("rm /var/spool/cups/*")
-    '';
-  }
-)
+            # The queue is empty already, so this should be safe.
+            # Otherwise, pairs of "c*"-"d*-001" files might persist.
+            server.execute("rm /var/spool/cups/*")
+  '';
+}
@@ -1,16 +1,12 @@
 {
-  system ? builtins.currentSystem,
-  config ? { },
-  pkgs ? import ../../.. { inherit system config; },
+  runTest,
+  ...
 }:

-with import ../../lib/testing-python.nix { inherit system pkgs; };
-with pkgs.lib;
-
 let
  writefreelyTest =
    { name, type }:
-    makeTest {
+    runTest {
      name = "writefreely-${name}";

      nodes.machine =
@@ -38,17 +38,17 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "reaper";
-  version = "7.35";
+  version = "7.36";

  src = fetchurl {
    url = url_for_platform version stdenv.hostPlatform.qemuArch;
    hash =
      if stdenv.hostPlatform.isDarwin then
-        "sha256-X3KNESHUmcs3zcwURKvaDqvkf9P/XncO/hpsOGxKMmg="
+        "sha256-++LWAnOUNVe3EOkBMlHizaBSQ5B2DJPhNUT8w2mTuiI="
      else
        {
-          x86_64-linux = "sha256-VD2VUTZUYi+7rDCG1joElajbfxLiramQwwrUgDDpuPI=";
-          aarch64-linux = "sha256-TFhv4CS7VCysup3Xy/uXHxaWhG4J8WCgxtaooGFj4vw=";
+          x86_64-linux = "sha256-wQIDTumxQI8S446u87noYvIx/pyfCa/Xe1U/Ot/7ESY=";
+          aarch64-linux = "sha256-5AkwRG1+xDVAhEOUTdpK1G7+qjE68zr4hs55mMQivmM=";
        }
        .${stdenv.hostPlatform.system};
  };
@@ -8,13 +8,13 @@
 }:
 mkLibretroCore {
  core = "mednafen-psx" + lib.optionalString withHw "-hw";
-  version = "0-unstable-2025-04-04";
+  version = "0-unstable-2025-04-11";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "beetle-psx-libretro";
-    rev = "90c09d4b8e6923a22538c35f68ace2d9fead134d";
-    hash = "sha256-eVoKmGE3N8uePcNpxWjAjgUjTIfEHZR3K2FLtQtLp+M=";
+    rev = "5d2137e5f15db3b52583e8246bcf2669cebb147b";
+    hash = "sha256-Gu5rubuNsMWOCNaNrqRR/hoErmhYdGC+9o/xDXuaWuM=";
  };

  extraBuildInputs = lib.optionals withHw [
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "bluemsx";
-  version = "0-unstable-2024-12-04";
+  version = "0-unstable-2025-04-15";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "bluemsx-libretro";
-    rev = "572c91856a5288b7433c619af651e31f00f3ce7e";
-    hash = "sha256-fN5zjQGIyx3yIEgIhC50gD3O2F6WPJ/ssiauQ5Z/t9s=";
+    rev = "efaaa1052dc427d64534531cf59a6a9a659dc6a6";
+    hash = "sha256-oCjIQ78YU5SeeefHHwd7l3U+YhwVMf6R2mbsuHAQUYQ=";
  };

  meta = {
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "bsnes";
-  version = "0-unstable-2025-04-04";
+  version = "0-unstable-2025-04-11";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "bsnes-libretro";
-    rev = "8d89089d35bedc257dc13bebd3790f70417311a5";
-    hash = "sha256-0n2N2Ks8MIy7dcuj2SESjDNxma7RRhAgOxQ5sC3XJTM=";
+    rev = "b102d6d5817b25aa059b573cd3b7675f2e375fa4";
+    hash = "sha256-a77SSoz0C189iNHUB2bcO3X76LPbA/V7pAZtUR03u48=";
  };

  makefile = "Makefile";
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "fceumm";
-  version = "0-unstable-2025-04-06";
+  version = "0-unstable-2025-04-11";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "libretro-fceumm";
-    rev = "b349f7f3e211bb7725f133d3818ab98da5059760";
-    hash = "sha256-MNYpuipjnDl9GUl5qWGi5W5cFhUCd/weCKuTRdttKJ4=";
+    rev = "43e6496351b544df0de692fbb01b2a6942073f5c";
+    hash = "sha256-kGGvI1rKE/oSF2v3URDY/fLTThYc3Crk9UFN69Rcckg=";
  };

  meta = {
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "mame2003-plus";
-  version = "0-unstable-2025-04-07";
+  version = "0-unstable-2025-04-16";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "mame2003-plus-libretro";
-    rev = "2b5fc26ee64d963021bc266aa45f19d90b282f92";
-    hash = "sha256-ZbebYUOUdaLVTh+VD8AQvAv/zQzr6tugJRl3iYSrUeo=";
+    rev = "c2128c3e82d884f39d824b5ef2716ac35dfa406b";
+    hash = "sha256-acicfUJlDT2Tm3aGTs9tAGaAGCC22ebRXnVLAxgcRI8=";
  };

  makefile = "Makefile";
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "pcsx-rearmed";
-  version = "0-unstable-2025-03-30";
+  version = "0-unstable-2025-04-13";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "pcsx_rearmed";
-    rev = "6091efb4d64ed745495455ba82352ec82f55cb4f";
-    hash = "sha256-9FyD3a6FE7xtt/UGvRNfopvQPgAg/0QGrJ1NNMEIsyg=";
+    rev = "febf2246848efb8937ab24c562bba20107bb46f0";
+    hash = "sha256-1mnPYr5A6KmZXXbvkE9XkZiCjx/y0Y9/Ed34LQHDbvE=";
  };

  dontConfigure = true;
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "picodrive";
-  version = "0-unstable-2025-04-03";
+  version = "0-unstable-2025-04-10";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "picodrive";
-    rev = "1a08d73159820bb31941d8c5ed6242a74bd4b332";
-    hash = "sha256-849XeceXoPHpOMlxVtHgL2TYQTHibUbGs0oHBEiCzvw=";
+    rev = "c4332d608c1005a46ce51236ade9894e0d32e52b";
+    hash = "sha256-qu5pnqHHO/k8OO2XXwd/H7AQsutmnMz+RBT6ZZFXZgk=";
    fetchSubmodules = true;
  };

@@ -14,13 +14,13 @@
 }:
 mkLibretroCore {
  core = "play";
-  version = "0-unstable-2025-04-04";
+  version = "0-unstable-2025-04-07";

  src = fetchFromGitHub {
    owner = "jpd002";
    repo = "Play-";
-    rev = "225e37d0dc7b8a7bb6dc3534b992373477f9923d";
-    hash = "sha256-bY4RwJyS4R/vjae2UCi4SnIW04IzoQyMOYsW4f+UQg8=";
+    rev = "f66e60ffda14cc615336d2997c09b3b1b998e8eb";
+    hash = "sha256-qGIqXc0xouWcOPMmBUFRyA4DHmdNEopxUR/J+o0H+QE=";
    fetchSubmodules = true;
  };

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "puae";
-  version = "0-unstable-2025-03-27";
+  version = "0-unstable-2025-04-15";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "libretro-uae";
-    rev = "987ac9bf14b813bf14ee6ab0f9d1f95c9d19ea78";
-    hash = "sha256-ONL7KjDMF+syiwBG+ivU7b7D7qFVr2gpw5ulnV3OZU8=";
+    rev = "0faf39cfd84e114d985e020562e75c22b4bc1569";
+    hash = "sha256-eJnCHei0/SdJD33SGsRgUL1+IapcvX/FcxHDlYmkob0=";
  };

  makefile = "Makefile";
@@ -7,13 +7,13 @@
 }:
 mkLibretroCore {
  core = "vecx";
-  version = "0-unstable-2024-10-21";
+  version = "0-unstable-2025-04-12";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "libretro-vecx";
-    rev = "a103a212ca8644fcb5d76eac7cdec77223c4fb02";
-    hash = "sha256-veCGW5mbR1V7cCzZ4BzDSdPZDycw4WNveie/DDVAzw8=";
+    rev = "841229a6a81a0461d08af6488f252dcec5266c6a";
+    hash = "sha256-bWhXXJCf/ax7n/sOfXibGvcFnCnmULcALoBR1uyIN+I=";
  };

  extraBuildInputs = [
@@ -8,12 +8,12 @@
 buildLua {
  pname = "manga-reader";

-  version = "0-unstable-2025-02-16";
+  version = "0-unstable-2025-04-16";
  src = fetchFromGitHub {
    owner = "Dudemanguy";
    repo = "mpv-manga-reader";
-    rev = "68824666b669ec101835f6d7aa510896e82ec30f";
-    hash = "sha256-9PGJ2OrAcbJIBLI/XGT2HQpC3KuoYnn1ws9oB9AnHQA=";
+    rev = "41c4be078fe6250b87eea21545c74d649719f8e4";
+    hash = "sha256-uUaKqPtONuoRuVqtP0FwcUdhG2WlPRfizuZIzDPPjac=";
  };
  passthru.updateScript = unstableGitUpdater { };

@@ -9,13 +9,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "obs-color-monitor";
-  version = "0.9.1";
+  version = "0.9.3";

  src = fetchFromGitHub {
    owner = "norihiro";
    repo = "obs-color-monitor";
    tag = finalAttrs.version;
-    hash = "sha256-4Dagga9BgW1Fiaxqs9QlyTax+SgFyTiNiU3yP2GjIDs=";
+    hash = "sha256-TwsEIOgQjj1wza7i8nne63oBM3FB6GmMjCq8/PuiWHs=";
  };

  nativeBuildInputs = [ cmake ];
@@ -10,11 +10,11 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "arc-browser";
-  version = "1.87.1-60573";
+  version = "1.90.1-61364";

  src = fetchurl {
    url = "https://releases.arc.net/release/Arc-${finalAttrs.version}.dmg";
-    hash = "sha256-UiB5MQl7hRl6nPu4xiwOdhC40bHYIcpPNtWg98HqCJc=";
+    hash = "sha256-lQelLROhnefvcUholJlABaIgmWebFYGu5rmbnAtHs1c=";
  };

  nativeBuildInputs = [ undmg ];
@@ -7,14 +7,14 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "cewler";
-  version = "1.2.0";
+  version = "1.3.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "roys";
    repo = "cewler";
    rev = "v${version}";
-    hash = "sha256-lVI3p6YMugQ3yKHFNxISmUY7XZMuX/TXvVUoZfIeJog=";
+    hash = "sha256-Od9O71122jVwqZ5ntoBQQtyNQjt2RRbZT8DzWFPUN84=";
  };

  nativeBuildInputs = with python3.pkgs; [
@@ -5,16 +5,16 @@
 }:
 buildGoModule rec {
  pname = "cloudflare-utils";
-  version = "1.3.5";
+  version = "1.4.2";

  src = fetchFromGitHub {
    owner = "Cyb3r-Jak3";
    repo = "cloudflare-utils";
    rev = "v${version}";
-    hash = "sha256-LbqH48ysOp2s+e+52doHIyaxUbzzCdJqhdvLuIJ3CCc=";
+    hash = "sha256-/vausJEe5g6Txgq1z7oUUku0w6sd/mmYcZQ8D7dZ03E=";
  };

-  vendorHash = "sha256-fg2BJkXdCWAO83kMoxkHlEyZuVezu9rs0hEda17KObE=";
+  vendorHash = "sha256-/kbXAljCe07dC/jL4RMeN8tKXhSPMxXY33CqBDySA8w=";

  meta = {
    description = "Helpful Cloudflare utility program";
@@ -9,13 +9,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "codipack";
-  version = "2.3.1";
+  version = "2.3.2";

  src = fetchFromGitHub {
    owner = "SciCompKL";
    repo = "CoDiPack";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-ZD9P4yWcF9zGeTyw6ENAcGoPyc8QcBdNZNnqRV4MH8s=";
+    hash = "sha256-feYtPDV0t7b49NIL5s6ZoBttRG2Bkwc0gOX6R6xDIbs=";
  };

  nativeBuildInputs = [
@@ -4,15 +4,10 @@
  fetchFromGitHub,
  rustPlatform,
  just,
+  libcosmicAppHook,
  which,
-  pkg-config,
-  makeBinaryWrapper,
-  libxkbcommon,
-  wayland,
-  appstream-glib,
-  desktop-file-utils,
-  intltool,
  nixosTests,
+  nix-update-script,
 }:

 rustPlatform.buildRustPackage (finalAttrs: {
@@ -29,25 +24,15 @@ rustPlatform.buildRustPackage (finalAttrs: {
  useFetchCargoVendor = true;
  cargoHash = "sha256-utip7E8NST88mPaKppkuOcdW+QkFoRqWy3a2McvMHo8=";

-  postPatch = ''
-    substituteInPlace justfile --replace-fail '#!/usr/bin/env' "#!$(command -v env)"
-  '';
-
  nativeBuildInputs = [
    just
    which
-    pkg-config
-    makeBinaryWrapper
-  ];
-  buildInputs = [
-    libxkbcommon
-    wayland
-    appstream-glib
-    desktop-file-utils
-    intltool
+    libcosmicAppHook
  ];

  dontUseJustBuild = true;
+  # Runs the default checkPhase instead
+  dontUseJustCheck = true;

  justFlags = [
    "--set"
@@ -58,26 +43,32 @@ rustPlatform.buildRustPackage (finalAttrs: {
    "target/${stdenv.hostPlatform.rust.cargoShortTarget}/release/cosmic-notifications"
  ];

-  postInstall = ''
-    wrapProgram $out/bin/cosmic-notifications \
-      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ wayland ]}"
-  '';
+  passthru = {
+    tests = {
+      inherit (nixosTests)
+        cosmic
+        cosmic-autologin
+        cosmic-noxwayland
+        cosmic-autologin-noxwayland
+        ;
+    };

-  passthru.tests = {
-    inherit (nixosTests)
-      cosmic
-      cosmic-autologin
-      cosmic-noxwayland
-      cosmic-autologin-noxwayland
-      ;
+    updateScript = nix-update-script {
+      extraArgs = [
+        "--version"
+        "unstable"
+        "--version-regex"
+        "epoch-(.*)"
+      ];
+    };
  };

-  meta = with lib; {
+  meta = {
    homepage = "https://github.com/pop-os/cosmic-notifications";
    description = "Notifications for the COSMIC Desktop Environment";
    mainProgram = "cosmic-notifications";
-    license = licenses.gpl3Only;
-    maintainers = teams.cosmic.members;
-    platforms = platforms.linux;
+    license = lib.licenses.gpl3Only;
+    maintainers = lib.teams.cosmic.members;
+    platforms = lib.platforms.linux;
  };
 })
@@ -20,17 +20,17 @@ in

 rustPlatform.buildRustPackage {
  pname = "dmlive";
-  version = "5.5.7-unstable-2025-01-25";
+  version = "5.5.8-unstable-2025-04-06";

  src = fetchFromGitHub {
    owner = "THMonster";
    repo = "dmlive";
-    rev = "79b4d9430fca3ebb86c57ee506989f620ea68a21"; # no tag
-    hash = "sha256-0DDKKd4IZj+3AyVMG4FXjCbvvMg5iDCiF1B6nB8n3lU=";
+    rev = "b066a637093871de9962e08d4f0ae0b77bd8f1f4"; # no tag
+    hash = "sha256-pAsxr6zGCDZ0qysGT1+2+5+WKI2QopGxnZWpfnxk/fI=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-UwKQivYZyXYADbwf4VA1h2y7YzpxefUgDYQG+NaLMwE=";
+  cargoHash = "sha256-GVko8GK5Muha4uqDMgk7VkFoFCVcmk0vM1GUELvSzgM=";

  nativeBuildInputs = [
    pkg-config
@@ -0,0 +1,120 @@
+{
+  stdenv,
+  lib,
+  fetchFromGitHub,
+  gradle,
+  jdk23,
+  makeWrapper,
+  wrapGAppsHook3,
+  libXxf86vm,
+  libXtst,
+  libglvnd,
+  glib,
+  copyDesktopItems,
+  makeDesktopItem,
+  nix-update-script,
+}:
+stdenv.mkDerivation rec {
+  pname = "ed-odyssey-materials-helper";
+  version = "2.156";
+
+  src = fetchFromGitHub {
+    owner = "jixxed";
+    repo = "ed-odyssey-materials-helper";
+    tag = version;
+    hash = "sha256-T7Mh9QZRQbDJmW976bOg5YNQoFxJ2SUFl6qBjos8LSo=";
+  };
+
+  nativeBuildInputs = [
+    gradle
+    makeWrapper
+    wrapGAppsHook3
+    copyDesktopItems
+  ];
+
+  patches = [
+    # We'll set up the edomh: URL scheme in makeDesktopItem,
+    # so this removes 1) the popup about it when you first start the program, 2) the option in the settings
+    # and makes the program always know that it is set up
+    ./remove-urlscheme-settings.patch
+  ];
+  postPatch = ''
+    # oslib doesn't seem to do releases and hasn't had a change since 2021, so always use commit d6ee6549bb
+    # it is not the latest commit because using a commit here whose hash starts with a number causes issues, but this works
+    substituteInPlace build.gradle \
+      --replace-fail '"com.github.wille:oslib:master-SNAPSHOT"' '"com.github.wille:oslib:d6ee6549bb"'
+    substituteInPlace application/src/main/java/module-info.java \
+      --replace-fail 'requires oslib.master.SNAPSHOT;' 'requires oslib.d6ee6549bb;'
+  '';
+
+  mitmCache = gradle.fetchDeps {
+    inherit pname;
+    data = ./deps.json;
+  };
+
+  gradleFlags = [ "-Dorg.gradle.java.home=${jdk23}" ];
+
+  gradleBuildTask = "application:jpackage";
+  gradleUpdateTask = "application:nixDownloadDeps";
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/{share/ed-odyssey-materials-helper,bin}
+    cp -r application/build/jpackage/Elite\ Dangerous\ Odyssey\ Materials\ Helper/* $out/share/ed-odyssey-materials-helper
+
+    mkdir -p $out/share/icons/hicolor/512x512/apps/
+    ln -s $out/share/ed-odyssey-materials-helper/lib/Elite\ Dangerous\ Odyssey\ Materials\ Helper.png $out/share/icons/hicolor/512x512/apps/ed-odyssey-materials-helper.png
+
+    runHook postInstall
+  '';
+
+  dontWrapGApps = true;
+
+  postFixup = ''
+    # The logs would go into the current directory, so the wrapper will cd to the config dir first
+    makeShellWrapper $out/share/ed-odyssey-materials-helper/bin/Elite\ Dangerous\ Odyssey\ Materials\ Helper $out/bin/ed-odyssey-materials-helper \
+      --run 'mkdir -p ~/.config/odyssey-materials-helper/ && cd ~/.config/odyssey-materials-helper/' \
+      --prefix LD_LIBRARY_PATH : ${
+        lib.makeLibraryPath [
+          libXxf86vm
+          glib
+          libXtst
+          libglvnd
+        ]
+      } "''${gappsWrapperArgs[@]}"
+  '';
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "ed-odyssey-materials-helper";
+      type = "Application";
+      desktopName = "Elite Dangerous Odyssey Materials Helper";
+      comment = "Helper for managing materials in Elite Dangerous Odyssey";
+      icon = "ed-odyssey-materials-helper";
+      exec = "ed-odyssey-materials-helper %u";
+      categories = [ "Game" ];
+      mimeTypes = [ "x-scheme-handler/edomh" ];
+    })
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Helper for managing materials in Elite Dangerous Odyssey";
+    homepage = "https://github.com/jixxed/ed-odyssey-materials-helper";
+    downloadPage = "https://github.com/jixxed/ed-odyssey-materials-helper/releases/tag/${version}";
+    changelog = "https://github.com/jixxed/ed-odyssey-materials-helper/releases/tag/${version}";
+    license = lib.licenses.gpl3Only;
+    sourceProvenance = with lib.sourceTypes; [
+      fromSource
+      binaryBytecode # mitm cache
+    ];
+    maintainers = with lib.maintainers; [
+      elfenermarcell
+      toasteruwu
+    ];
+    mainProgram = "ed-odyssey-materials-helper";
+    platforms = lib.platforms.linux;
+  };
+}
@@ -0,0 +1,42 @@
+diff --git a/application/src/main/java/nl/jixxed/eliteodysseymaterials/FXApplication.java b/application/src/main/java/nl/jixxed/eliteodysseymaterials/FXApplication.java
+index a38ae02d..1c164911 100644
+--- a/application/src/main/java/nl/jixxed/eliteodysseymaterials/FXApplication.java
+++ b/application/src/main/java/nl/jixxed/eliteodysseymaterials/FXApplication.java
+@@ -112,7 +112,6 @@ public class FXApplication extends Application {
+             }
+             PreferencesService.setPreference(PreferenceConstants.APP_SETTINGS_VERSION, System.getProperty("app.version"));
+             whatsnewPopup();
+-            urlSchemePopup();
+             eddnPopup();
+             versionPopup();
+             MaterialTrackingService.initialize();
+diff --git a/application/src/main/java/nl/jixxed/eliteodysseymaterials/service/registry/UbuntuRegistrationHandler.java b/application/src/main/java/nl/jixxed/eliteodysseymaterials/service/registry/UbuntuRegistrationHandler.java
+index 6ac788ea..a5281983 100644
+--- a/application/src/main/java/nl/jixxed/eliteodysseymaterials/service/registry/UbuntuRegistrationHandler.java
+++ b/application/src/main/java/nl/jixxed/eliteodysseymaterials/service/registry/UbuntuRegistrationHandler.java
+@@ -62,11 +62,7 @@ public class UbuntuRegistrationHandler implements RegistrationHandler {
+ 
+     @Override
+     public boolean isRegistered() {
+-        if (!IS_JAVA) {
+-            final File file = new File(System.getProperty(USER_HOME) + DESKTOP_FILE_PATH);
+-            return file.exists() && file.isFile();
+-        }
+-        return false;
+        return true;
+     }
+ 
+ 
+diff --git a/application/src/main/java/nl/jixxed/eliteodysseymaterials/templates/settings/sections/General.java b/application/src/main/java/nl/jixxed/eliteodysseymaterials/templates/settings/sections/General.java
+index 3b00de60..78d6afd7 100644
+--- a/application/src/main/java/nl/jixxed/eliteodysseymaterials/templates/settings/sections/General.java
+++ b/application/src/main/java/nl/jixxed/eliteodysseymaterials/templates/settings/sections/General.java
+@@ -99,7 +99,7 @@ public class General extends VBox implements Template {
+         final HBox supportPackageSetting = createSupportPackageSetting();
+         final HBox wipSetting = createWIPSetting();
+         this.getStyleClass().addAll("settingsblock", SETTINGS_SPACING_10_CLASS);
+-        this.getChildren().addAll(generalLabel, langSetting, fontSetting, customJournalFolderSetting, pollSetting, urlSchemeLinkingSetting, exportInventory, blueprintExpandedSetting, importFromClipboardSetting,importSlefFromClipboardSetting,supportPackageSetting);
+        this.getChildren().addAll(generalLabel, langSetting, fontSetting, customJournalFolderSetting, pollSetting, exportInventory, blueprintExpandedSetting, importFromClipboardSetting,importSlefFromClipboardSetting,supportPackageSetting);
+     }
+ 
+     @Override
@@ -7,7 +7,7 @@

 let
  pname = "erigon";
-  version = "3.0.0";
+  version = "3.0.2";
 in
 buildGoModule {
  inherit pname version;
@@ -16,11 +16,11 @@ buildGoModule {
    owner = "ledgerwatch";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-63wh9D5D9qzABEvKCBxBRHYuGBnlX+hrme56STkyoQU=";
+    hash = "sha256-1rMlRlEUheW6g3kigh+DjQxtNJOrqrADPkjQn7TQr1g=";
    fetchSubmodules = true;
  };

-  vendorHash = "sha256-Mvat9+mbgpept9g8pYNf4a/bAGZGBM0MAM417DDIT9w=";
+  vendorHash = "sha256-tCohubwCk5HERoAaGWgEsl5kpI8w8dn0oZCZ2AxkKXk=";
  proxyVendor = true;

  # Build errors in mdbx when format hardening is enabled:
@@ -7,13 +7,13 @@

 stdenv.mkDerivation rec {
  pname = "exploitdb";
-  version = "2025-04-14";
+  version = "2025-04-17";

  src = fetchFromGitLab {
    owner = "exploit-database";
    repo = "exploitdb";
    rev = "refs/tags/${version}";
-    hash = "sha256-yoQB2QM9Fg4tKKPeGTM68+Su98mt8znkINNQY9cVUoI=";
+    hash = "sha256-nHiXbbKDzdTTPWkW8g/mX25IfgcOAcOUHkycqBM1eqU=";
  };

  nativeBuildInputs = [ makeWrapper ];
@@ -6,11 +6,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "fcitx5-pinyin-moegirl";
-  version = "20250309";
+  version = "20250409";

  src = fetchurl {
    url = "https://github.com/outloudvi/mw2fcitx/releases/download/${finalAttrs.version}/moegirl.dict";
-    hash = "sha256-0ZXlPpeaxXK3dI2uGBmISpCGM9isQdPxJRTcoIa75fg=";
+    hash = "sha256-OuAJbuQs/yiCFJAG1qkS+0INdpmjdwc7vvz5WZruQ98=";
  };

  dontUnpack = true;
@@ -8,16 +8,16 @@

 buildGoModule rec {
  pname = "fleeting-plugin-aws";
-  version = "1.0.0";
+  version = "1.0.1";

  src = fetchFromGitLab {
    owner = "gitlab-org/fleeting/plugins";
    repo = "aws";
    tag = "v${version}";
-    hash = "sha256-8vEduf+xh9R3+GoouXJS2h/ELlzKXDmLBLekaXGn7SE=";
+    hash = "sha256-3m7t2uGO7Rlfckb8mdYVutW0/ng0OiUAH5XTBoB//ZU=";
  };

-  vendorHash = "sha256-bfEzPPP280peOK4Jyu1fyfFCaFnRLoPmsjJ+G1BoVW4=";
+  vendorHash = "sha256-hfuszGVWfMreGz22+dkx0/cxznjq2XZf7pAn4TWOQ5M=";

  subPackages = [ "cmd/fleeting-plugin-aws" ];

@@ -15,11 +15,11 @@ assert odbcSupport -> unixODBC != null;

 stdenv.mkDerivation rec {
  pname = "freetds";
-  version = "1.4.26";
+  version = "1.4.27";

  src = fetchurl {
    url = "https://www.freetds.org/files/stable/${pname}-${version}.tar.bz2";
-    hash = "sha256-dGQaZswr+uMCwqZKSyaKPbj7DMc2TceXXETFfWXNjRw=";
+    hash = "sha256-jAcexiW401UtI54kvtjdVfkJjg/Jk5fhySajwnpKMs0=";
  };

  buildInputs = [
@@ -4,6 +4,11 @@
    "version": "1.44.1",
    "hash": "sha256-0su/ylZ68+FDZ6mgfp3qsm7qpfPtD5SW75HXbVhs5qk="
  },
+  {
+    "pname": "Azure.Identity",
+    "version": "1.13.0",
+    "hash": "sha256-BXru3jP4oQchrBF/c3WDekZeRJlUxenBwVZ5YsifseI="
+  },
  {
    "pname": "Azure.Storage.Blobs",
    "version": "12.24.0",
@@ -21,8 +26,8 @@
  },
  {
    "pname": "KeraLua",
-    "version": "1.4.1",
-    "hash": "sha256-ouRL7+0bW/VYUNNYQoXenXzYO0HNF3D1IsScqtah3DE="
+    "version": "1.4.4",
+    "hash": "sha256-MF7DBdc8xNiEcauNer7YFRgjbUU4ANmc2uQKrzVDRDs="
  },
  {
    "pname": "Microsoft.Bcl.AsyncInterfaces",
@@ -104,6 +109,21 @@
    "version": "9.0.3",
    "hash": "sha256-iBwolNt6Lb2OqjDWBVnUj8vZDSID9EQw/JPI1xcuFus="
  },
+  {
+    "pname": "Microsoft.Identity.Client",
+    "version": "4.65.0",
+    "hash": "sha256-gkBVLb8acLYexNM4ZzMJ0qfDp2UqjUt0yiu3MfMcWig="
+  },
+  {
+    "pname": "Microsoft.Identity.Client.Extensions.Msal",
+    "version": "4.65.0",
+    "hash": "sha256-Xmy/evicLvmbC+6ytxwVE646uVcJB5yMpEK73H5tzD0="
+  },
+  {
+    "pname": "Microsoft.IdentityModel.Abstractions",
+    "version": "6.35.0",
+    "hash": "sha256-bxyYu6/QgaA4TQYBr5d+bzICL+ktlkdy/tb/1fBu00Q="
+  },
  {
    "pname": "Microsoft.IdentityModel.Abstractions",
    "version": "8.6.1",
@@ -179,6 +199,11 @@
    "version": "6.0.1",
    "hash": "sha256-uH5fZhcyQVtnsFc6GTUaRRrAQm05v5euJyWCXSFSOYI="
  },
+  {
+    "pname": "System.Memory",
+    "version": "4.5.5",
+    "hash": "sha256-EPQ9o1Kin7KzGI5O3U3PUQAZTItSbk9h/i4rViN3WiI="
+  },
  {
    "pname": "System.Memory.Data",
    "version": "1.0.2",
@@ -199,6 +224,11 @@
    "version": "6.0.0",
    "hash": "sha256-bEG1PnDp7uKYz/OgLOWs3RWwQSVYm+AnPwVmAmcgp2I="
  },
+  {
+    "pname": "System.Security.Cryptography.ProtectedData",
+    "version": "4.5.0",
+    "hash": "sha256-Z+X1Z2lErLL7Ynt2jFszku6/IgrngO3V1bSfZTBiFIc="
+  },
  {
    "pname": "System.Text.Encodings.Web",
    "version": "6.0.0",
@@ -8,13 +8,13 @@

 buildDotnetModule rec {
  pname = "garnet";
-  version = "1.0.61";
+  version = "1.0.63";

  src = fetchFromGitHub {
    owner = "microsoft";
    repo = "garnet";
    tag = "v${version}";
-    hash = "sha256-Xvc/ECu/aIduHABZ08J3+iDgvOBs3vLCpzHJwfuLSp0=";
+    hash = "sha256-pOAeWQcZTkvnJGAP8H4dOABcHSEfGI4xTC/eS/3QoTM=";
  };

  projectFile = "main/GarnetServer/GarnetServer.csproj";
@@ -11,13 +11,13 @@
  docbook-xsl-nons,
  gobject-introspection,
  gnome,
-  libsoup_2_4,
+  libsoup_3,
  json-glib,
  glib,
  nixosTests,
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "geocode-glib";
  version = "3.26.4";

@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
  ];

  src = fetchurl {
-    url = "mirror://gnome/sources/geocode-glib/${lib.versions.majorMinor version}/geocode-glib-${version}.tar.xz";
+    url = "mirror://gnome/sources/geocode-glib/${lib.versions.majorMinor finalAttrs.version}/geocode-glib-${finalAttrs.version}.tar.xz";
    sha256 = "LZpoJtFYRwRJoXOHEiFZbaD4Pr3P+YuQxwSQiQVqN6o=";
  };

@@ -53,28 +53,30 @@ stdenv.mkDerivation rec {

  buildInputs = [
    glib
-    libsoup_2_4
+    libsoup_3
    json-glib
  ];

  mesonFlags = [
-    "-Dsoup2=${lib.boolToString (lib.versionOlder libsoup_2_4.version "2.99")}"
+    "-Dsoup2=false"
    "-Dinstalled_test_prefix=${placeholder "installedTests"}"
  ];

  passthru = {
    updateScript = gnome.updateScript {
-      packageName = pname;
+      packageName = "geocode-glib";
    };
    tests = {
      installed-tests = nixosTests.installed-tests.geocode-glib;
    };
  };

-  meta = with lib; {
+  meta = {
+    changelog = "https://gitlab.gnome.org/GNOME/geocode-glib/-/blob/${finalAttrs.version}/NEWS?ref_type=tags";
    description = "Convenience library for the geocoding and reverse geocoding using Nominatim service";
-    license = licenses.lgpl2Plus;
-    maintainers = teams.gnome.members;
-    platforms = platforms.unix;
+    homepage = "https://gitlab.gnome.org/GNOME/geocode-glib";
+    license = lib.licenses.lgpl2Plus;
+    maintainers = lib.teams.gnome.members;
+    platforms = lib.platforms.unix;
  };
-}
+})
@@ -1,70 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchurl,
-  which,
-  pkg-config,
-  gtk2,
-  pcre,
-  glib,
-  libxml2,
-  libsoup_2_4 ? null,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "hardinfo";
-  version = "0.5.1";
-
-  src = fetchurl {
-    url = "mirror://sourceforge/project/hardinfo.berlios/hardinfo-${version}.tar.bz2";
-    sha256 = "0yhvfc5icam3i4mphlz0m9d9d2irjw8mbsxq203x59wjgh6nrpx0";
-  };
-
-  # Not adding 'hostname' command, the build shouldn't depend on what the build
-  # host is called.
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [
-    which
-    gtk2
-    pcre
-    glib
-    libxml2
-    libsoup_2_4
-  ];
-
-  # Fixes '#error You must compile this program without "-O"'
-  hardeningDisable = [ "all" ];
-
-  # Ignore undefined references to a bunch of libsoup symbols
-  NIX_LDFLAGS = "--unresolved-symbol=ignore-all";
-
-  preConfigure = ''
-    patchShebangs configure
-
-    # -std=gnu89 fixes build error, copied from
-    # https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=757525
-    sed -i -e "s/^CFLAGS = \(.*\)/CFLAGS = \1 -std=gnu89/" Makefile.in
-
-    substituteInPlace ./arch/linux/common/modules.h --replace /sbin/modinfo modinfo
-    substituteInPlace ./arch/linux/common/os.h --replace /lib/libc.so.6 ${stdenv.cc.libc}/lib/libc.so
-  '';
-
-  # Makefile supports DESTDIR but not PREFIX (it hardcodes $DESTDIR/usr/).
-  installFlags = [ "DESTDIR=$(out)" ];
-  postInstall = ''
-    mv "$out/usr/"* "$out"
-    rmdir "$out/usr"
-  '';
-
-  meta = with lib; {
-    homepage = "http://hardinfo.org/";
-    description = "Display information about your hardware and operating system";
-    license = licenses.gpl2Only;
-    maintainers = with maintainers; [ bjornfor ];
-    platforms = [
-      "x86_64-linux"
-      "i686-linux"
-    ]; # ARMv7 and AArch64 are unsupported
-    mainProgram = "hardinfo";
-  };
-}
@@ -7,18 +7,18 @@

 rustPlatform.buildRustPackage rec {
  pname = "harper";
-  version = "0.28.0";
+  version = "0.29.0";

  src = fetchFromGitHub {
    owner = "Automattic";
    repo = "harper";
    rev = "v${version}";
-    hash = "sha256-g+noAc+vKli2T8C2EAK4ejw/2DWZPhtKbezyt53iHYg=";
+    hash = "sha256-wsCUB3UO5czqJPGctb3ZsTtcVXMqBB7/8/uk5ShL8ZA=";
  };

  buildAndTestSubdir = "harper-ls";
  useFetchCargoVendor = true;
-  cargoHash = "sha256-Ql1WdwDnXBC4JHO/uzJJlacQC44bOaHo2i3M9atjf3I=";
+  cargoHash = "sha256-KrW4I4Tg30/Yg5PuZCEWkrtjNUKMZmzqCmFAnKtj7A4=";

  passthru.updateScript = nix-update-script { };

@@ -8,15 +8,15 @@

 rustPlatform.buildRustPackage rec {
  pname = "jsonschema-cli";
-  version = "0.29.1";
+  version = "0.30.0";

  src = fetchCrate {
    inherit pname version;
-    hash = "sha256-HHS8dt3bJZ3dPWqB5K0h5KQTn/wHRYvIROfYmqfxolw=";
+    hash = "sha256-AjBVvEixkP7khm3/0U81E/G7tCKoqnfNG05gpgYlqNE=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-RIt+b1Yokc4UMFPxOzO5GARsI32wL71ZmcoN+P/KE5c=";
+  cargoHash = "sha256-3hZAEjJrJ5vw6kXwY+xTv/mO0lx/KNmXA2lULJkX9aE=";

  nativeInstallCheckInputs = [
    versionCheckHook
@@ -1,87 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchurl,
-  pkg-config,
-  meson,
-  ninja,
-  makeFontsConf,
-  vala,
-  fetchpatch,
-  gnome,
-  libgee,
-  glib,
-  json-glib,
-  libarchive,
-  libsoup_2_4,
-  gobject-introspection,
-}:
-
-let
-  pname = "libhttpseverywhere";
-  version = "0.8.3";
-in
-stdenv.mkDerivation rec {
-  name = "${pname}-${version}";
-
-  src = fetchurl {
-    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${name}.tar.xz";
-    sha256 = "1jmn6i4vsm89q1axlq4ajqkzqmlmjaml9xhw3h9jnal46db6y00w";
-  };
-
-  nativeBuildInputs = [
-    vala
-    gobject-introspection
-    meson
-    ninja
-    pkg-config
-  ];
-  buildInputs = [
-    glib
-    libgee
-    json-glib
-    libsoup_2_4
-    libarchive
-  ];
-
-  patches = [
-    # Fixes build with vala >=0.42
-    (fetchpatch {
-      url = "https://gitlab.gnome.org/GNOME/libhttpseverywhere/commit/6da08ef1ade9ea267cecf14dd5cb2c3e6e5e50cb.patch";
-      sha256 = "1nwjlh8iqgjayccwdh0fbpq2g1h8bg1k1g9i324f2bhhvyhmpq8f";
-    })
-    # fix build with meson 0.60
-    (fetchpatch {
-      url = "https://gitlab.gnome.org/GNOME/libhttpseverywhere/-/commit/4c38b2ca25802c464f3204a62815201d8cf549fd.patch";
-      sha256 = "sha256-1+fmR0bpvJ9ISN2Hr+BTIQz+Bf6VfY1RdVZ/OohUlWU=";
-    })
-  ];
-
-  mesonFlags = [ "-Denable_valadoc=true" ];
-
-  doCheck = true;
-
-  checkPhase = "(cd test && ./httpseverywhere_test)";
-
-  FONTCONFIG_FILE = makeFontsConf { fontDirectories = [ ]; };
-
-  outputs = [
-    "out"
-    "devdoc"
-  ];
-
-  passthru = {
-    updateScript = gnome.updateScript {
-      packageName = pname;
-      versionPolicy = "odd-unstable";
-    };
-  };
-
-  meta = with lib; {
-    description = "Library to use HTTPSEverywhere in desktop applications";
-    homepage = "https://gitlab.gnome.org/GNOME/libhttpseverywhere";
-    license = licenses.lgpl3;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ sternenseemann ] ++ teams.gnome.members;
-  };
-}
@@ -10,13 +10,13 @@
 buildNimPackage (
  finalAttrs: prevAttrs: {
    pname = "nitter";
-    version = "0-unstable-2025-04-05";
+    version = "0-unstable-2025-04-15";

    src = fetchFromGitHub {
      owner = "zedeus";
      repo = "nitter";
-      rev = "83b0f8b55ae7bfb8a19a0bf14de52f30d06b8db6";
-      hash = "sha256-2QIcAhzYrIo1q80959980H+hzLYtPHAOy0+CItDZ1d4=";
+      rev = "94c83f38114abaef10c36903fbcd59d78db7a578";
+      hash = "sha256-J5w16EpQf98fozSfci7xua9AeULB0JZNbOsCzMGrnJg=";
    };

    lockFile = ./lock.json;
@@ -8,13 +8,13 @@

 buildGoModule rec {
  pname = "nsc";
-  version = "2.10.2";
+  version = "2.11.0";

  src = fetchFromGitHub {
    owner = "nats-io";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-F/9yAF1vXG4eWMmS6l/qWqlEV8YkS7nihHN2vK3JFbE=";
+    hash = "sha256-/xfNl91cb82kV2IC/m56p94nb3WLDPU5O+1H+sTZnW4=";
  };

  ldflags = [
@@ -24,7 +24,7 @@ buildGoModule rec {
    "-X main.builtBy=nixpkgs"
  ];

-  vendorHash = "sha256-MxkpK3CgQ+eoxGfLRqE3kudyZounDD0+cmzOoiPf1wc=";
+  vendorHash = "sha256-Ms+chBbQCo3TGWPgIy4OSXNpxO5jpm1zxEe9upiPmnY=";

  nativeBuildInputs = [ installShellFiles ];

@@ -47,7 +47,7 @@ buildGoModule rec {
  # the test strips table formatting from the command output in a naive way
  # that removes all the table characters, including '-'.
  # The nix build directory looks something like:
-  # /private/tmp/nix-build-nsc-2.10.2.drv-0/nsc_test2000598938/keys
+  # /private/tmp/nix-build-nsc-2.11.0.drv-0/nsc_test2000598938/keys
  # Then the `-` are removed from the path unintentionally and the test fails.
  # This should be fixed upstream to avoid mangling the path when
  # removing the table decorations from the command output.
@@ -7,13 +7,13 @@

 stdenvNoCC.mkDerivation rec {
  pname = "nu_scripts";
-  version = "0-unstable-2025-04-07";
+  version = "0-unstable-2025-04-14";

  src = fetchFromGitHub {
    owner = "nushell";
    repo = pname;
-    rev = "b7869a8f337dc64f4d1dbf8f2c7a5833bc3abfbf";
-    hash = "sha256-IoyClULiILl5wPwyf7zzTK5Rb0yEbkVpFRtUSHksrjc=";
+    rev = "c639113adebdf05f25e0e33b833798a6b0c624d4";
+    hash = "sha256-aeYe642070aAvhIES9apQAC/vyj7pnXiQbn7QTYVVlQ=";
  };

  installPhase = ''
@@ -8,12 +8,12 @@

 stdenv.mkDerivation rec {
  pname = "opengrok";
-  version = "1.13.27";
+  version = "1.13.28";

  # binary distribution
  src = fetchurl {
    url = "https://github.com/oracle/opengrok/releases/download/${version}/${pname}-${version}.tar.gz";
-    hash = "sha256-Qr30+paSn3I3+tWpzALTIXP8kxireL96rKopDDj/qnM=";
+    hash = "sha256-WomA61x6/IeEZdsQJwIzmaPZdYttGLJ+Yw36gOnAUK4=";
  };

  nativeBuildInputs = [ makeWrapper ];
@@ -25,13 +25,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "osm2pgsql";
-  version = "2.1.0";
+  version = "2.1.1";

  src = fetchFromGitHub {
    owner = "osm2pgsql-dev";
    repo = "osm2pgsql";
    rev = finalAttrs.version;
-    hash = "sha256-YKlw/YIRogu0AbkRA3kZ4j4tbbVYbgVcLVYifYarmjE=";
+    hash = "sha256-5rENMcYCfHUdb4QsyOnnGe/qCbdYLoXI15e7OqJXit4=";
  };

  postPatch = ''
@@ -1,19 +1,22 @@
 {
  lib,
+  stdenv,
  python3Packages,
  fetchFromGitHub,
+  versionCheckHook,
+  nix-update-script,
 }:

 python3Packages.buildPythonApplication rec {
  pname = "oterm";
-  version = "0.9.3";
+  version = "0.11.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "ggozad";
    repo = "oterm";
    tag = version;
-    hash = "sha256-2zzDVUZc+H2tBO5scRUjwz859uaQIbpvCaC0bm4B7NM=";
+    hash = "sha256-b/+siNzmM6RUJ3jv/2dNJJFueejChKde0D5r8J0lTqM=";
  };

  pythonRelaxDeps = [
@@ -23,6 +26,7 @@ python3Packages.buildPythonApplication rec {
    "ollama"
    "packaging"
    "pillow"
+    "pydantic"
    "textual"
    "typer"
  ];
@@ -43,14 +47,24 @@ python3Packages.buildPythonApplication rec {
    python-dotenv
    rich-pixels
    textual
+    textual-image
    textualeffects
    typer
  ];

  pythonImportsCheck = [ "oterm" ];

-  # Tests require a HTTP connection to ollama
-  doCheck = false;
+  # Python tests require a HTTP connection to ollama
+
+  # Fails on darwin with: PermissionError: [Errno 1] Operation not permitted: '/var/empty/Library'
+  nativeCheckInputs = lib.optionals (!stdenv.hostPlatform.isDarwin) [
+    versionCheckHook
+  ];
+  versionCheckProgramArg = "--version";
+
+  passthru = {
+    updateScript = nix-update-script { };
+  };

  meta = {
    description = "Text-based terminal client for Ollama";
@@ -12,11 +12,11 @@

 stdenv.mkDerivation rec {
  pname = "pgbouncer";
-  version = "1.24.0";
+  version = "1.24.1";

  src = fetchurl {
    url = "https://www.pgbouncer.org/downloads/files/${version}/${pname}-${version}.tar.gz";
-    hash = "sha256-52rflBoxkaQW4iPAss2/cxWe74CioyMUr2+9guQaHUE=";
+    hash = "sha256-2nKjq6EwcodtBVo+WN1Kukpd5O1hSOcwMxhSRVmP0+A=";
  };

  nativeBuildInputs = [ pkg-config ];
@@ -6,13 +6,13 @@

 buildGoModule rec {
  pname = "pluto";
-  version = "5.21.3";
+  version = "5.21.4";

  src = fetchFromGitHub {
    owner = "FairwindsOps";
    repo = "pluto";
    rev = "v${version}";
-    hash = "sha256-/gq6BdlNG9vUazVt7Ucvv2679BytUEZrx6u8znnsxG4=";
+    hash = "sha256-tUMQ9d5q4dK63In8uj4+gdrADMMrQLW37UipnSw7hnA=";
  };

  vendorHash = "sha256-PABCma+pfguDHxRhvQYCHcjr7Epy2AteC+QiXbAx04k=";
@@ -0,0 +1,31 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}:
+
+buildGoModule rec {
+  pname = "postfix-tlspol";
+  version = "1.8.8";
+
+  src = fetchFromGitHub {
+    owner = "Zuplu";
+    repo = "postfix-tlspol";
+    tag = "v${version}";
+    hash = "sha256-XEQ2SOITUPmqI/+R7/O9ST5m5lHJT5fcBoBQk7GoOZM=";
+  };
+
+  vendorHash = null;
+
+  # don't run tests, they perform checks via the network
+  doCheck = false;
+
+  ldflags = [ "-X main.Version=${version}" ];
+
+  meta = {
+    description = "Lightweight MTA-STS + DANE/TLSA resolver and TLS policy server for Postfix, prioritizing DANE.";
+    homepage = "https://github.com/Zuplu/postfix-tlspol";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ valodim ];
+  };
+}
@@ -9,17 +9,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "reindeer";
-  version = "2025.03.31.00";
+  version = "2025.04.14.00";

  src = fetchFromGitHub {
    owner = "facebookincubator";
    repo = "reindeer";
    tag = "v${version}";
-    hash = "sha256-ocnd/4bIZwrGik2r8HSeyPfLQycmJJrKikgLIZhsb6A=";
+    hash = "sha256-Htmc2z2umh9RKRvrOSGUXqk/Clzw+1+SB8EOGLJZKqM=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-DguWlibOB8z0Blj5ZVFycyJrxJHK3uUROt8hGxacxOY=";
+  cargoHash = "sha256-i0TmB+JtJKCS/eQxOb5SIKi8jf1qqygndDdJOmGl66A=";

  nativeBuildInputs = [ pkg-config ];

@@ -10,13 +10,13 @@

 stdenv.mkDerivation rec {
  pname = "sentry-native";
-  version = "0.8.3";
+  version = "0.8.4";

  src = fetchFromGitHub {
    owner = "getsentry";
    repo = "sentry-native";
    tag = version;
-    hash = "sha256-9jsn7oydaOYOAq6XYYlPjzzy6LSiKOpRtp+PxMlzwz0=";
+    hash = "sha256-0NLxu+aelp36m3ocPhyYz3LDeq310fkyu8WSpZML3Pc=";
  };

  nativeBuildInputs = [
@@ -7,11 +7,11 @@

 let
  pname = "simplex-chat-desktop";
-  version = "6.3.1";
+  version = "6.3.2";

  src = fetchurl {
    url = "https://github.com/simplex-chat/simplex-chat/releases/download/v${version}/simplex-desktop-x86_64.AppImage";
-    hash = "sha256-jCBCZ5nzA8WxIQFsGpuuyZ1Jmt+PJmqybFHFOUkw9L0=";
+    hash = "sha256-zGF8K0Dqi79EYq8UptwD9kAvsuzdvdGrRxuS3z0Ve/c=";
  };

  appimageContents = appimageTools.extract {
@@ -12,16 +12,16 @@

 buildGoModule rec {
  pname = "sing-box";
-  version = "1.11.6";
+  version = "1.11.7";

  src = fetchFromGitHub {
    owner = "SagerNet";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-/RTpdbDFCDk1sq7lBIXQ3ElgYqflDumffZy1DVP0zOY=";
+    hash = "sha256-lNgvJ2ycIP/dWFskiDcabFjXfLifueQIXfMW/m3Y8EA=";
  };

-  vendorHash = "sha256-+XDkza0rymQAWUCmHhKas7FFS8lRPSmGHwAV/072aeo=";
+  vendorHash = "sha256-sq7qjEXB0XqUQ+HDItfjWryBDHXU2jqMRMQDfKHOdB0=";

  tags = [
    "with_quic"
@@ -8,17 +8,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "slumber";
-  version = "3.0.1";
+  version = "3.1.0";

  src = fetchFromGitHub {
    owner = "LucasPickering";
    repo = "slumber";
    tag = "v${version}";
-    hash = "sha256-7MPNs2vAzCo5TPJZFhd3xaZW0YbF724gfKNLB08IU8A=";
+    hash = "sha256-GFkssVTOohEdczIi4+OV7qKHBPqa2yFZNhAoMAIBZN0=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-eWox5NrvZr+mEGGwxYbAW5EgEOQ8WQUy2pughBlpXgM=";
+  cargoHash = "sha256-4RDnIWr0Z6FGnUQxh+yk7L/mg/Jw6JROns4DXkYIbuE=";

  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ darwin.apple_sdk.frameworks.AppKit ];

@@ -134,6 +134,9 @@ buildGoModule {
          # test for a dev util which helps to fork golang.org/x/crypto/acme
          # not necessary and fails to match
          "TestSyncedToUpstream" # tempfork/acme
+
+          # flaky: https://github.com/tailscale/tailscale/issues/7030
+          "TestConcurrent"
        ]
        ++ lib.optionals stdenv.hostPlatform.isDarwin [
          # syscall default route interface en0 differs from netstat
@@ -10,16 +10,16 @@

 buildGoModule rec {
  pname = "tbls";
-  version = "1.84.1";
+  version = "1.85.0";

  src = fetchFromGitHub {
    owner = "k1LoW";
    repo = "tbls";
    tag = "v${version}";
-    hash = "sha256-c4LxntQhni6dHbjs0QZLWgioU2GT101x4lDC43buiwk=";
+    hash = "sha256-zXaygbcKUZ5BzTKur+K0gUGtoc4FFG0EPwl0KxaJGJo=";
  };

-  vendorHash = "sha256-6b5JYWjJIbZakrOkB1Xgg4HyBBBecN31iutOMZpLeHc=";
+  vendorHash = "sha256-hARsbsy9us/knGg6dwNgDezjas5IC6GtL7neEZbwgvo=";

  excludedPackages = [ "scripts/jsonschema" ];

@@ -12,8 +12,6 @@
  desktop-file-utils,
  libsoup_3,
  json-glib,
-  geoclue2,
-  geocode-glib,
  libgee,
  gtk3,
  pantheon,
@@ -45,8 +43,6 @@ stdenv.mkDerivation rec {
  buildInputs = [
    libsoup_3
    json-glib
-    geoclue2
-    geocode-glib
    libgee
    glib
    gtk3
@@ -14,13 +14,13 @@

 stdenv.mkDerivation {
  pname = "urn-timer";
-  version = "0-unstable-2025-02-07";
+  version = "0-unstable-2025-04-17";

  src = fetchFromGitHub {
    owner = "paoloose";
    repo = "urn";
-    rev = "0486ff9af0a404e73d66ea3d8ad7f9107efff35f";
-    hash = "sha256-3fgKs0cWr972pYLTfIy6HLDP+GUdNog4FEQ70ACKYKI=";
+    rev = "5eea3f9efb03758bfafcd029406797d34e4c875b";
+    hash = "sha256-rlUFZiA2fMa5QkKqKBRkiM8o2nioD0MPn6eJTJSJq3M=";
  };

  nativeBuildInputs = [
@@ -61,12 +61,12 @@ in

  google = buildStyle rec {
    name = "Google";
-    version = "0.6.2";
+    version = "0.6.3";
    src = fetchFromGitHub {
      owner = "errata-ai";
      repo = "Google";
      rev = "v${version}";
-      hash = "sha256-ldwK9tMA04H/jTd3dQeRX/sZOwZcyPb+I56cDg0vZDg=";
+      hash = "sha256-1aN7wCdShhMsBN83u7l+5Ffm2WKC8ltZyT3hPZCNWYo=";
    };
    meta = {
      description = "Vale-compatible implementation of the Google Developer Documentation Style Guide";
@@ -93,12 +93,12 @@ in

  microsoft = buildStyle rec {
    name = "Microsoft";
-    version = "0.14.1";
+    version = "0.14.2";
    src = fetchFromGitHub {
      owner = "errata-ai";
      repo = "Microsoft";
      rev = "v${version}";
-      hash = "sha256-4j05bIGAVEy6untUqtrUxdLKlhyOcJsbcsow8OxRp1A=";
+      hash = "sha256-Sie4bBeKPOFOJhgd+mLbiz4vG+xpKL0LnwnRQHzOw+Q=";
    };
    meta = {
      description = "Vale-compatible implementation of the Microsoft Writing Style Guide";
@@ -3,7 +3,7 @@
  stdenv,
  fetchFromGitHub,
  pkg-config,
-  libsoup_2_4,
+  libsoup_3,
  webkitgtk_4_1,
  gtk3,
  glib-networking,
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {

  buildInputs = [
    gtk3
-    libsoup_2_4
+    libsoup_3
    webkitgtk_4_1
    glib-networking
    gsettings-desktop-schemas
@@ -6,20 +6,20 @@

 rustPlatform.buildRustPackage rec {
  pname = "wasm-tools";
-  version = "1.228.0";
+  version = "1.229.0";

  src = fetchFromGitHub {
    owner = "bytecodealliance";
    repo = "wasm-tools";
    rev = "v${version}";
-    hash = "sha256-lVrZCjLhSCyD3aEr6IyRZejqwdiT89w0/ppmQE8Thto=";
+    hash = "sha256-fJQN5AKhILP7d+0GEtnHKuZtZEr/61TfGwpH1EbbSg4=";
    fetchSubmodules = true;
  };

  # Disable cargo-auditable until https://github.com/rust-secure-code/cargo-auditable/issues/124 is solved.
  auditable = false;
  useFetchCargoVendor = true;
-  cargoHash = "sha256-yUOgQRdducguVinceeIs9PGk8Pq9Y24I3KbsRcCWpAY=";
+  cargoHash = "sha256-OqQJ2jvceHPoSx7Iic/hsJWv8vJnEo9F1bbpqfL5HsM=";
  cargoBuildFlags = [
    "--package"
    "wasm-tools"
@@ -11,15 +11,15 @@

 buildGoModule rec {
  pname = "witness";
-  version = "0.8.1";
+  version = "0.9.0";

  src = fetchFromGitHub {
    owner = "in-toto";
    repo = "witness";
    rev = "v${version}";
-    sha256 = "sha256-ylCUy44sX1KPfQqEldixmLcXkk+Uwca4q1gZRgxHdeg=";
+    sha256 = "sha256-taTK/b3HA18UPyi3zxGWBG6Wy4XtHcfTaA8NiYZaPA0=";
  };
-  vendorHash = "sha256-CR95CsGthdjq/dtxmIjmZlQeyKimumCP9mWr6tNrBJI=";
+  vendorHash = "sha256-3/vn+rWVbljkPksiNXoTU0volV3xwxunMwCV9w9fAWo=";

  nativeBuildInputs = [ installShellFiles ];

@@ -8,13 +8,13 @@

 buildGoModule {
  pname = "zoekt";
-  version = "3.7.2-2-unstable-2025-03-25";
+  version = "3.7.2-2-unstable-2025-04-15";

  src = fetchFromGitHub {
    owner = "sourcegraph";
    repo = "zoekt";
-    rev = "47287adecfbd6b068cf7ad5fb67c9548a7062156";
-    hash = "sha256-RRlCfv34hSBWpeXxvXsPtfziE0L0FhZfMIfBi8i2XWg=";
+    rev = "0978c13fb6683be9908ee1a578360734e61cc8b5";
+    hash = "sha256-1Ris2GsZnHHrxvXxOCRSPvvk35YEhqDxNHkd7cjv0YY=";
  };

  vendorHash = "sha256-B45Q9G+p/idqqz45lLQQuDGLwAzhKuo9Ev+cISGbKUo=";
@@ -42,12 +42,12 @@ in
  );
  julia_111-bin = wrapJulia (
    callPackage (import ./generic-bin.nix {
-      version = "1.11.4";
+      version = "1.11.5";
      sha256 = {
-        x86_64-linux = "fb3d3c5fccef82158a70677c0044ac5ae40410eceb0604cdc8e643eeff21df8d";
-        aarch64-linux = "859f1a8cc4bce6911bc912f0e226a6ba2b1c144110b9d559d88f5077513d0e37";
-        x86_64-darwin = "7e693914399f2ebe1fafe5c670af0373474145cfe2bfda661f370559a680720a";
-        aarch64-darwin = "5adfb4482bba9610405c0f9b5a3c1aa09cabf70c8751d75970f2dab0fa819488";
+        x86_64-linux = "723e878c642220cc0251a0e13758c059a389cadc7f01376feaf1ea7388fe8f9c";
+        aarch64-linux = "f63203574fba25c9bda5e98b2f87f985d4672109855633a46bae32bfba3cbc0d";
+        x86_64-darwin = "9bee8cc79a7dda56a38bbef88e72687ea0cb35d4c382eb9076ee8a3c53c3a8cf";
+        aarch64-darwin = "2c279005f5059d10eade27a59e25f5ea53e00b0caa30a6d73fa32529ec046735";
      };
    }) { }
  );
@@ -79,8 +79,8 @@ in
  );
  julia_111 = wrapJulia (
    callPackage (import ./generic.nix {
-      version = "1.11.4";
-      hash = "sha256-xJNlYtBRKIQtf+K+MHNDM1GeqUpUhhtdC/440QPpa1s=";
+      version = "1.11.5";
+      hash = "sha256-FHYm22toh7+2YSy2zSpI1omAZkn6403HSf3cg3XCxiU=";
      patches = [
        ./patches/1.11/0002-skip-failing-and-flaky-tests.patch
      ];
@@ -10,13 +10,13 @@

 stdenv.mkDerivation rec {
  pname = "gensio";
-  version = "2.8.12";
+  version = "2.8.14";

  src = fetchFromGitHub {
    owner = "cminyard";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-DlveXTkdNu6Pb/0sL9K5HaOJ9HEhv2gwk5Kka9nI7U0=";
+    sha256 = "sha256-vxa1r0vloiqMrGhXriIbBfJC6wmm54YWg0nCnB8MDG0=";
  };

  passthru = {
@@ -1,12 +0,0 @@
-diff --git a/meson.build b/meson.build
-index cb1e0df..d90c85c 100644
--- a/meson.build
-+++ b/meson.build
-@@ -95,6 +95,6 @@ endif
- configure_file(
-     input: 'gsignond.conf.in',
-     configuration: conf_data,
-    install_dir: sysconf_dir,
-+    install_dir: 'etc/',
-     output: 'gsignond.conf'
- )
@@ -1,93 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitLab,
-  pkg-config,
-  meson,
-  ninja,
-  glib,
-  glib-networking,
-  sqlite,
-  gobject-introspection,
-  vala,
-  gtk-doc,
-  libsecret,
-  docbook_xsl,
-  docbook_xml_dtd_43,
-  docbook_xml_dtd_45,
-  glibcLocales,
-  makeWrapper,
-  symlinkJoin,
-  gsignondPlugins,
-  plugins,
-}:
-
-let
-  unwrapped = stdenv.mkDerivation rec {
-    pname = "gsignond";
-    version = "1.2.0";
-
-    outputs = [
-      "out"
-      "dev"
-      "devdoc"
-    ];
-
-    src = fetchFromGitLab {
-      owner = "accounts-sso";
-      repo = pname;
-      rev = version;
-      sha256 = "17cpil3lpijgyj2z5c41vhb7fpk17038k5ggyw9p6049jrlf423m";
-    };
-
-    nativeBuildInputs = [
-      docbook_xml_dtd_43
-      docbook_xml_dtd_45
-      docbook_xsl
-      glibcLocales
-      gobject-introspection
-      gtk-doc
-      meson
-      ninja
-      pkg-config
-      vala
-    ];
-
-    buildInputs = [
-      glib
-      glib-networking
-      libsecret
-    ];
-
-    propagatedBuildInputs = [ sqlite ];
-
-    mesonFlags = [
-      "-Dbus_type=session"
-      "-Dextension=desktop"
-    ];
-
-    LC_ALL = "en_US.UTF-8";
-
-    patches = [
-      ./conf.patch
-      ./plugin-load-env.patch
-    ];
-
-    meta = with lib; {
-      description = "D-Bus service which performs user authentication on behalf of its clients";
-      mainProgram = "gsignond";
-      homepage = "https://gitlab.com/accounts-sso/gsignond";
-      license = licenses.lgpl21Plus;
-      maintainers = [ ];
-      platforms = platforms.linux;
-    };
-  };
-
-in
-if plugins == [ ] then
-  unwrapped
-else
-  import ./wrapper.nix {
-    inherit makeWrapper symlinkJoin plugins;
-    gsignond = unwrapped;
-  }
@@ -1,35 +0,0 @@
-diff --git a/src/gplugind/gsignond-plugin-loader.c b/src/gplugind/gsignond-plugin-loader.c
-index 5497b32..979e1b4 100644
--- a/src/gplugind/gsignond-plugin-loader.c
-+++ b/src/gplugind/gsignond-plugin-loader.c
-@@ -38,11 +38,10 @@ gsignond_load_plugin (
-     gchar *plugin_filename;
-     GSignondPlugin *plugin;
- 
-#   ifdef ENABLE_DEBUG
-     const gchar *env_val = g_getenv("SSO_GPLUGINS_DIR");
-     if (env_val)
-         plugin_path = env_val;
-#   endif
-+
-     plugin_filename = g_module_build_path (plugin_path, plugin_type);
-     plugin = gsignond_load_plugin_with_filename (plugin_type,
-                                                  plugin_filename);
-diff --git a/src/gplugind/main.c b/src/gplugind/main.c
-index 1c6cdb6..c85c623 100644
--- a/src/gplugind/main.c
-+++ b/src/gplugind/main.c
-@@ -93,11 +93,11 @@ _install_sighandlers (GMainLoop *main_loop)
- static const gchar* _plugin_path(void)
- {
-     const gchar *plugin_path = GSIGNOND_GPLUGINS_DIR;
-#   ifdef ENABLE_DEBUG
-+
-     const gchar *env_val = g_getenv("SSO_GPLUGINS_DIR");
-     if (env_val)
-         plugin_path = env_val;
-#   endif
-+
-     return plugin_path;
- }
- 
@@ -1,51 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitLab,
-  pkg-config,
-  meson,
-  ninja,
-  vala,
-  glib,
-  gsignond,
-  json-glib,
-  libsoup_2_4,
-  gobject-introspection,
-}:
-
-stdenv.mkDerivation {
-  pname = "gsignond-plugin-lastfm";
-  version = "2018-05-07";
-
-  src = fetchFromGitLab {
-    owner = "accounts-sso";
-    repo = "gsignond-plugin-lastfm";
-    rev = "0a7a5f8511282e45cfe35987b81f27f158f0648c";
-    sha256 = "0ay6ir9zg9l0264x5xwd7c6j8qmwlhrifkkkjd1yrjh9sqxyfj7f";
-  };
-
-  nativeBuildInputs = [
-    gobject-introspection
-    meson
-    ninja
-    pkg-config
-    vala
-  ];
-
-  buildInputs = [
-    glib
-    gsignond
-    json-glib
-    libsoup_2_4
-  ];
-
-  PKG_CONFIG_GSIGNOND_GPLUGINSDIR = "${placeholder "out"}/lib/gsignond/gplugins";
-
-  meta = with lib; {
-    description = "Plugin for the Accounts-SSO gSignOn daemon that handles Last.FM credentials";
-    homepage = "https://gitlab.com/accounts-sso/gsignond-plugin-lastfm";
-    license = licenses.lgpl21Plus;
-    maintainers = [ ];
-    platforms = platforms.linux;
-  };
-}
@@ -1,47 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitLab,
-  pkg-config,
-  meson,
-  ninja,
-  vala,
-  glib,
-  gsignond,
-  gobject-introspection,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "gsignond-plugin-mail";
-  version = "0.3.0";
-
-  src = fetchFromGitLab {
-    owner = "accounts-sso";
-    repo = "gsignond-plugin-mail";
-    rev = version;
-    sha256 = "0x8jcl0ra9kacm80f1im5wpxp9r9wxayjwnk6dkv7fhjbl2p4nh0";
-  };
-
-  nativeBuildInputs = [
-    gobject-introspection
-    meson
-    ninja
-    pkg-config
-    vala
-  ];
-
-  buildInputs = [
-    glib
-    gsignond
-  ];
-
-  PKG_CONFIG_GSIGNOND_GPLUGINSDIR = "${placeholder "out"}/lib/gsignond/gplugins";
-
-  meta = with lib; {
-    description = "Plugin for the Accounts-SSO gSignOn daemon that handles E-Mail credentials";
-    homepage = "https://gitlab.com/accounts-sso/gsignond-plugin-mail";
-    license = licenses.lgpl21Plus;
-    maintainers = [ ];
-    platforms = platforms.linux;
-  };
-}
@@ -1,65 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitLab,
-  pkg-config,
-  meson,
-  ninja,
-  glib,
-  gsignond,
-  check,
-  json-glib,
-  libsoup_2_4,
-  gnutls,
-  gtk-doc,
-  docbook_xml_dtd_43,
-  docbook_xml_dtd_45,
-  docbook_xsl,
-  glibcLocales,
-  gobject-introspection,
-}:
-
-stdenv.mkDerivation {
-  pname = "gsignond-plugin-oauth";
-  version = "2018-10-15";
-
-  src = fetchFromGitLab {
-    owner = "accounts-sso";
-    repo = "gsignond-plugin-oa";
-    rev = "d471cebfd7c50567b1244277a9559f18f8d58691";
-    sha256 = "00axl8wwp2arc6h4bpr4m3ik2hy8an0lbm48q2a9r94krmq56hnx";
-  };
-
-  nativeBuildInputs = [
-    check
-    docbook_xml_dtd_43
-    docbook_xml_dtd_45
-    docbook_xsl
-    glibcLocales
-    gobject-introspection
-    gtk-doc
-    meson
-    ninja
-    pkg-config
-  ];
-
-  buildInputs = [
-    glib
-    gnutls
-    gsignond
-    json-glib
-    libsoup_2_4
-  ];
-
-  LC_ALL = "en_US.UTF-8";
-
-  PKG_CONFIG_GSIGNOND_GPLUGINSDIR = "${placeholder "out"}/lib/gsignond/gplugins";
-
-  meta = with lib; {
-    description = "Plugin for the Accounts-SSO gSignOn daemon that handles the OAuth 1.0 and 2.0 authentication protocols";
-    homepage = "https://gitlab.com/accounts-sso/gsignond-plugin-oa";
-    license = licenses.lgpl21Plus;
-    maintainers = [ ];
-    platforms = platforms.linux;
-  };
-}
@@ -1,61 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitLab,
-  pkg-config,
-  meson,
-  ninja,
-  glib,
-  gsignond,
-  gsasl,
-  check,
-  gtk-doc,
-  docbook_xml_dtd_43,
-  docbook_xml_dtd_45,
-  docbook_xsl,
-  glibcLocales,
-  gobject-introspection,
-}:
-
-stdenv.mkDerivation {
-  pname = "gsignond-plugin-sasl";
-  version = "2018-10-15";
-
-  src = fetchFromGitLab {
-    owner = "accounts-sso";
-    repo = "gsignond-plugin-sasl";
-    rev = "b304c70b7dad9368b23b1205122d10de684c896a";
-    sha256 = "0knzw7c2fm2kzs1gxbrm4kk67522w9cpwqj7xvn86473068k90va";
-  };
-
-  nativeBuildInputs = [
-    check
-    docbook_xml_dtd_43
-    docbook_xml_dtd_45
-    docbook_xsl
-    glibcLocales
-    gobject-introspection
-    gtk-doc
-    meson
-    ninja
-    pkg-config
-  ];
-
-  buildInputs = [
-    glib
-    gsasl
-    gsignond
-  ];
-
-  LC_ALL = "en_US.UTF-8";
-
-  PKG_CONFIG_GSIGNOND_GPLUGINSDIR = "${placeholder "out"}/lib/gsignond/gplugins";
-
-  meta = with lib; {
-    description = "Plugin for the Accounts-SSO gSignOn daemon that handles the SASL authentication protocol";
-    homepage = "https://gitlab.com/accounts-sso/gsignond-plugin-sasl";
-    license = licenses.lgpl21Plus;
-    maintainers = [ ];
-    platforms = platforms.linux;
-  };
-}
@@ -1,30 +0,0 @@
-{
-  makeWrapper,
-  symlinkJoin,
-  gsignond,
-  plugins,
-}:
-
-symlinkJoin {
-  name = "gsignond-with-plugins-${gsignond.version}";
-
-  paths = [ gsignond ] ++ plugins;
-
-  nativeBuildInputs = [ makeWrapper ];
-
-  postBuild = ''
-    wrapProgram $out/bin/gsignond \
-      --set SSO_GPLUGINS_DIR "$out/lib/gsignond/gplugins"
-
-    rm $out/share/dbus-1/services/com.google.code.AccountsSSO.gSingleSignOn.service
-    rm $out/share/dbus-1/services/com.google.code.AccountsSSO.SingleSignOn.service
-
-    substitute ${gsignond}/share/dbus-1/services/com.google.code.AccountsSSO.gSingleSignOn.service $out/share/dbus-1/services/com.google.code.AccountsSSO.gSingleSignOn.service \
-      --replace ${gsignond} $out
-
-    substitute ${gsignond}/share/dbus-1/services/com.google.code.AccountsSSO.SingleSignOn.service $out/share/dbus-1/services/com.google.code.AccountsSSO.SingleSignOn.service \
-      --replace ${gsignond} $out
-  '';
-
-  inherit (gsignond) meta;
-}
@@ -1,89 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchurl,
-  fetchpatch,
-  pkg-config,
-  vala,
-  gobject-introspection,
-  gtk-doc,
-  docbook_xsl,
-  docbook_xml_dtd_412,
-  glib,
-  libxml2,
-  libsoup_2_4,
-  gnome,
-  buildPackages,
-  Foundation,
-  AppKit,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "libgrss";
-  version = "0.7.0";
-
-  outputs = [
-    "out"
-    "dev"
-    "devdoc"
-  ];
-
-  src = fetchurl {
-    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "1nalslgyglvhpva3px06fj6lv5zgfg0qmj0sbxyyl5d963vc02b7";
-  };
-
-  patches = [
-    (fetchpatch {
-      name = "CVE-2016-20011.patch";
-      # https://gitlab.gnome.org/GNOME/libgrss/-/merge_requests/7, not yet merged!
-      url = "https://gitlab.gnome.org/GNOME/libgrss/-/commit/2c6ea642663e2a44efc8583fae7c54b7b98f72b3.patch";
-      sha256 = "1ijvq2jl97vphcvrbrqxvszdmv6yyjfygdca9vyaijpafwyzzb18";
-    })
-  ];
-
-  nativeBuildInputs = [
-    pkg-config
-    vala
-    gobject-introspection
-    gtk-doc
-    docbook_xsl
-    docbook_xml_dtd_412
-  ];
-
-  buildInputs =
-    [
-      glib
-      libxml2
-      libsoup_2_4
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Foundation
-      AppKit
-    ];
-
-  configureFlags =
-    [
-      "PKG_CONFIG=${buildPackages.pkg-config}/bin/${buildPackages.pkg-config.targetPrefix}pkg-config"
-    ]
-    ++ lib.optionals (stdenv.buildPlatform == stdenv.hostPlatform) [
-      "--enable-gtk-doc"
-    ];
-
-  doCheck = true;
-
-  passthru = {
-    updateScript = gnome.updateScript {
-      packageName = pname;
-      versionPolicy = "none";
-    };
-  };
-
-  meta = with lib; {
-    description = "Glib abstaction to handle feeds in RSS, Atom and other formats";
-    homepage = "https://gitlab.gnome.org/GNOME/libgrss";
-    license = licenses.lgpl3Plus;
-    maintainers = teams.gnome.members;
-    platforms = platforms.unix;
-  };
-}
@@ -3,6 +3,7 @@
  fetchFromGitHub,
  buildDunePackage,
  ocaml,
+  ounit,
  qtest,
  qcheck,
  num,
@@ -24,7 +25,10 @@ buildDunePackage rec {
  };

  nativeCheckInputs = [ qtest ];
-  checkInputs = [ qcheck ];
+  checkInputs = [
+    ounit
+    qcheck
+  ];
  propagatedBuildInputs = [
    camlp-streams
    num
@@ -9,8 +9,6 @@ buildDunePackage {

  inherit (qcheck-core) version src patches;

-  duneVersion = "3";
-
  propagatedBuildInputs = [
    qcheck-core
    alcotest
@@ -6,15 +6,15 @@

 buildDunePackage rec {
  pname = "qcheck-core";
-  version = "0.24";
+  version = "0.25";

  minimalOCamlVersion = "4.08";

  src = fetchFromGitHub {
    owner = "c-cube";
    repo = "qcheck";
-    rev = "v${version}";
-    hash = "sha256-iuFlmSeUhumeWhqHlaNqDjReRf8c4e76hhT27DK3+/g=";
+    tag = "v${version}";
+    hash = "sha256-Z89jJ21zm89wb9m5HthnbHdnE9iXLyaH9k8S+FAWkKQ=";
  };

  meta = {
@@ -5,8 +5,6 @@ buildDunePackage {

  inherit (qcheck-ounit) version src patches;

-  duneVersion = "3";
-
  propagatedBuildInputs = [ qcheck-ounit ];

  meta = qcheck-ounit.meta // {
@@ -1,7 +1,7 @@
 {
  buildDunePackage,
  qcheck-core,
-  ounit,
+  ounit2,
 }:

 buildDunePackage {
@@ -9,11 +9,9 @@ buildDunePackage {

  inherit (qcheck-core) version src patches;

-  duneVersion = "3";
-
  propagatedBuildInputs = [
    qcheck-core
-    ounit
+    ounit2
  ];

  meta = qcheck-core.meta // {
@@ -1,6 +1,6 @@
 {
  buildDunePackage,
-  qcheck-core,
+  fetchFromGitHub,
  qcheck,
  ppxlib,
  ppx_deriving,
@@ -8,10 +8,14 @@

 buildDunePackage {
  pname = "ppx_deriving_qcheck";
+  version = "0.6";

-  inherit (qcheck-core) version src patches;
-
-  duneVersion = "3";
+  src = fetchFromGitHub {
+    owner = "c-cube";
+    repo = "qcheck";
+    tag = "v0.24";
+    hash = "sha256-iuFlmSeUhumeWhqHlaNqDjReRf8c4e76hhT27DK3+/g=";
+  };

  propagatedBuildInputs = [
    qcheck
@@ -19,7 +23,7 @@ buildDunePackage {
    ppx_deriving
  ];

-  meta = qcheck-core.meta // {
+  meta = qcheck.meta // {
    description = "PPX Deriver for QCheck";
  };
 }
@@ -73,6 +73,10 @@ buildPythonPackage rec {
  ];

  disabledTests = [
+    # Fatal Python error: Aborted
+    # line 414 in test_display_screen
+    "test_display_screen"
+
    # test_atari_env.py tests fail on the majority of the environments because the ROM are missing.
    # The user is expected to manually download the roms:
    # https://github.com/Farama-Foundation/Arcade-Learning-Environment/blob/v0.9.0/docs/faq.md#i-downloaded-ale-and-i-installed-it-successfully-but-i-cannot-find-any-rom-file-at-roms-do-i-have-to-get-them-somewhere-else
@@ -359,7 +359,7 @@

 buildPythonPackage rec {
  pname = "boto3-stubs";
-  version = "1.37.34";
+  version = "1.37.35";
  pyproject = true;

  disabled = pythonOlder "3.7";
@@ -367,7 +367,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    pname = "boto3_stubs";
    inherit version;
-    hash = "sha256-55s1NWY0F9P7T2W/FqAFzhtCbrN3sjYF48EZTXkclb4=";
+    hash = "sha256-OQDIBsLGaIBPFxPm79VmoGyZv/zI43CemCKp3saBkj8=";
  };

  build-system = [ setuptools ];
@@ -19,7 +19,7 @@

 buildPythonPackage rec {
  pname = "cyclopts";
-  version = "3.12.0";
+  version = "3.13.0";
  pyproject = true;

  disabled = pythonOlder "3.8";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
    owner = "BrianPugh";
    repo = "cyclopts";
    tag = "v${version}";
-    hash = "sha256-VV2C9SvVOF2452lP20WJaSppXrenUhSf2QTh0t3WjgM=";
+    hash = "sha256-L8RHBjOfXS2VocyVG/GL4LgfYN/ev+BbMqK8uE3lkOw=";
  };

  build-system = [
@@ -19,7 +19,7 @@

 buildPythonPackage rec {
  pname = "dinghy";
-  version = "1.3.3";
+  version = "1.4.1";
  pyproject = true;

  disabled = pythonOlder "3.8";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
    owner = "nedbat";
    repo = pname;
    tag = version;
-    hash = "sha256-fn8SRzhFJyyr2Wr9/cp8Sm6kbVARq2LEeKSE0HU9V74=";
+    hash = "sha256-51BXQdDxlI6+3ctDSa/6tyRXBb1E9BVej9qy7WtkOGM=";
  };

  nativeBuildInputs = [ setuptools ];
@@ -56,7 +56,7 @@ buildPythonPackage rec {
    description = "GitHub activity digest tool";
    mainProgram = "dinghy";
    homepage = "https://github.com/nedbat/dinghy";
-    changelog = "https://github.com/nedbat/dinghy/blob/${version}/CHANGELOG.rst";
+    changelog = "https://github.com/nedbat/dinghy/blob/${src.tag}/CHANGELOG.rst";
    license = licenses.asl20;
    maintainers = with maintainers; [
      trundle
@@ -62,7 +62,7 @@ buildPythonPackage rec {
  ];

  preBuild = ''
-    ${python.interpreter} -m django compilemessages
+    ${python.pythonOnBuildForHost.interpreter} -m django compilemessages
  '';

  optional-dependencies = {
@@ -3,35 +3,29 @@
  buildPythonPackage,
  fetchFromGitHub,
  setuptools,
-  wheel,
  aiohttp,
+  orjson,
 }:

 buildPythonPackage rec {
  pname = "esphome-dashboard-api";
-  version = "1.2.3";
-  format = "pyproject";
+  version = "1.3.0";
+  pyproject = true;

  src = fetchFromGitHub {
    owner = "esphome";
    repo = "dashboard-api";
    tag = version;
-    hash = "sha256-RFfS0xzRXoM6ETXmviiMPxffPzspjTqpkvHOlTJXN9g=";
+    hash = "sha256-b3PnMzlA9N8NH6R5ed6wf5QF45i887iQk2QgH7e755k=";
  };

-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace "setuptools~=65.6" "setuptools" \
-      --replace "wheel~=0.37.1" "wheel"
-  '';
+  build-system = [ setuptools ];

-  nativeBuildInputs = [
-    setuptools
-    wheel
+  dependencies = [
+    aiohttp
+    orjson
  ];

-  propagatedBuildInputs = [ aiohttp ];
-
  doCheck = false; # no tests

  pythonImportsCheck = [ "esphome_dashboard_api" ];
@@ -350,8 +350,8 @@ rec {
      "sha256-5rf6lym+LUdtellsFlCOPcL7ZR44cxL7ozMG77QBp4U=";

  mypy-boto3-connectcases =
-    buildMypyBoto3Package "connectcases" "1.37.0"
-      "sha256-xDjzytVFmlZuYKcvzgMsVfyT8Xn9X0a4/OHZzLW80pI=";
+    buildMypyBoto3Package "connectcases" "1.37.35"
+      "sha256-Lnnfhpgau08hnTT73wGvGi3ssGIzGzZanRb/BO8JHXU=";

  mypy-boto3-connectparticipant =
    buildMypyBoto3Package "connectparticipant" "1.37.0"
@@ -470,8 +470,8 @@ rec {
      "sha256-uKccWDS0zhFrs6CQ9ve6by4rYL43T6iFZ3rjNy7SiyI=";

  mypy-boto3-eks =
-    buildMypyBoto3Package "eks" "1.37.24"
-      "sha256-Fh3hdSfyUHT9DTHjp7GVk4GPDbI1IbK1+u2LIbFGhY4=";
+    buildMypyBoto3Package "eks" "1.37.35"
+      "sha256-Uk7r11ayOnQl6HSiFHlfpj7whRFjSz8nJMxxs0ZZn/w=";

  mypy-boto3-elastic-inference =
    buildMypyBoto3Package "elastic-inference" "1.36.0"
@@ -518,8 +518,8 @@ rec {
      "sha256-jKo/VYOtHEWPFh3w0Q3rg3nlreizEcNG7C/eADRNy88=";

  mypy-boto3-events =
-    buildMypyBoto3Package "events" "1.37.28"
-      "sha256-U8L97t7Tql+SpCSpfOTF22RRKLFvN+2SoTkweGAMe0c=";
+    buildMypyBoto3Package "events" "1.37.35"
+      "sha256-HIZTGaVSNsddZxDxenpzNFWZDvV7Hl21ZKVfbGYYF9g=";

  mypy-boto3-evidently =
    buildMypyBoto3Package "evidently" "1.37.0"
@@ -1118,8 +1118,8 @@ rec {
      "sha256-031skcPZd/jBWIod9JAbIc9NUcEBBN33UxIoGc2IiAA=";

  mypy-boto3-resource-groups =
-    buildMypyBoto3Package "resource-groups" "1.37.0"
-      "sha256-38L7Iirnj8n6MnWSCY1ZylCAECSW4wo3gvddKq74aIs=";
+    buildMypyBoto3Package "resource-groups" "1.37.35"
+      "sha256-ae1MUUGAapRCLaWrMzlzQvNc+9ijTQxFMlxqvOFD4WI=";

  mypy-boto3-resourcegroupstaggingapi =
    buildMypyBoto3Package "resourcegroupstaggingapi" "1.37.0"
@@ -1238,8 +1238,8 @@ rec {
      "sha256-toCWU6Bh5IJ5lupehKJ6EvsMKZz5s/uPWG9qF+4P5uM=";

  mypy-boto3-servicecatalog =
-    buildMypyBoto3Package "servicecatalog" "1.37.0"
-      "sha256-/MJaP0iTix/cyCxJrTuTWHf0lSCt8dfJI67Y6+PdJF4=";
+    buildMypyBoto3Package "servicecatalog" "1.37.35"
+      "sha256-blNOCdn3J1XNwGjWMo5eN+a2SzKqCt/1at8l8AzNZsg=";

  mypy-boto3-servicecatalog-appregistry =
    buildMypyBoto3Package "servicecatalog-appregistry" "1.37.0"
@@ -15,14 +15,14 @@

 buildPythonPackage rec {
  pname = "nbdev";
-  version = "2.3.37";
+  version = "2.4.2";
  pyproject = true;

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-6Z/p71t9FopVcSh4TCFSPP382AM1CYen00eQOD8Jx8A=";
+    hash = "sha256-OtCpN2Jw4ghv19jY4N2Yn46CxxZuPQSybFw62MIIf0g=";
  };

  pythonRelaxDeps = [ "ipywidgets" ];
@@ -1,5 +1,6 @@
 {
  lib,
+  stdenv,
  buildPythonPackage,
  fetchFromGitHub,
  rustPlatform,
@@ -81,6 +82,11 @@ buildPythonPackage rec {
    writableTmpDirAsHomeHook
  ];

+  disabledTests = lib.optionals (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64) [
+    # flaky (assert np.float64(0.0017554642626285276) > 0.01)
+    "test_normalizing_flow"
+  ];
+
  disabledTestPaths = [
    # Require unpackaged bridgestan
    "tests/test_stan.py"
@@ -2,88 +2,104 @@
  lib,
  fetchFromGitHub,
  buildPythonPackage,
-  pythonOlder,
  poetry-core,

-  setuptools,
+  anthropic,
  astor,
-  inquirer,
-  pyyaml,
-  rich,
-  six,
-  tokentrim,
-  wget,
-  psutil,
+  fastapi,
+  google-generativeai,
  html2image,
-  send2trash,
+  html2text,
+  inquirer,
  ipykernel,
  jupyter-client,
-  matplotlib,
-  toml,
-  tiktoken,
-  platformdirs,
-  pydantic,
-  google-generativeai,
-  pynput,
-  pyperclip,
-  yaspin,
-  shortuuid,
  litellm,
+  matplotlib,
+  platformdirs,
+  psutil,
+  pyautogui,
+  pydantic,
+  pyperclip,
+  pyyaml,
+  rich,
+  selenium,
+  send2trash,
+  setuptools,
+  shortuuid,
+  six,
+  starlette,
+  tiktoken,
+  tokentrim,
+  toml,
+  typer,
+  uvicorn,
+  webdriver-manager,
+  wget,
+  yaspin,

  nltk,
 }:

 buildPythonPackage rec {
  pname = "open-interpreter";
-  version = "0.3.6";
+  version = "0.4.2";
  pyproject = true;

-  disabled = pythonOlder "3.9";
-
  src = fetchFromGitHub {
    owner = "KillianLucas";
    repo = "open-interpreter";
-    rev = "v${version}";
-    hash = "sha256-TeBiRylrq5CrAG9XS47Z9GlruAv7V7Nsl4QbSV55isM=";
+    tag = "v${version}";
+    hash = "sha256-fogCcWAhcrCrrcV0q4oKttkf/GeJaJSZnbgiFxvySs8=";
  };

  pythonRemoveDeps = [ "git-python" ];

  pythonRelaxDeps = [
+    "anthropic"
    "google-generativeai"
    "psutil"
-    "pynput"
+    "rich"
+    "starlette"
    "tiktoken"
+    "typer"
    "yaspin"
  ];

  build-system = [ poetry-core ];

  dependencies = [
-    setuptools
+    anthropic
    astor
-    inquirer
-    pyyaml
-    rich
-    six
-    tokentrim
-    wget
-    psutil
+    fastapi
+    google-generativeai
    html2image
-    send2trash
+    html2text
+    inquirer
    ipykernel
    jupyter-client
-    matplotlib
-    toml
-    tiktoken
-    platformdirs
-    pydantic
-    google-generativeai
-    pynput
-    pyperclip
-    yaspin
-    shortuuid
    litellm
+    matplotlib
+    platformdirs
+    psutil
+    pyautogui
+    pydantic
+    pyperclip
+    pyyaml
+    rich
+    selenium
+    send2trash
+    setuptools
+    shortuuid
+    six
+    starlette
+    tiktoken
+    tokentrim
+    toml
+    typer
+    uvicorn
+    webdriver-manager
+    wget
+    yaspin

    # marked optional in pyproject.toml but still required?
    nltk
@@ -94,12 +110,12 @@ buildPythonPackage rec {
  # Most tests required network access
  doCheck = false;

-  meta = with lib; {
+  meta = {
    description = "OpenAI's Code Interpreter in your terminal, running locally";
    homepage = "https://github.com/KillianLucas/open-interpreter";
-    license = licenses.mit;
+    license = lib.licenses.mit;
    changelog = "https://github.com/KillianLucas/open-interpreter/releases/tag/v${version}";
-    maintainers = with maintainers; [ happysalada ];
+    maintainers = with lib.maintainers; [ happysalada ];
    mainProgram = "interpreter";
  };
 }
@@ -13,12 +13,12 @@

 buildPythonPackage rec {
  pname = "picos";
-  version = "2.6.0";
+  version = "2.6.1";
  format = "setuptools";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-LU5OxinhDBewQ/32cxyOSQyUexMD8xdJIkrsiaWBils=";
+    hash = "sha256-u9yaKeP34YW55+PyVy3wPR0p0jBmiLywvZzw2zWdd6g=";
  };

  # Needed only for the tests
@@ -28,7 +28,10 @@ buildPythonPackage rec {
    hash = "sha256-kp2S3xnclMktEi6aqMBahQVZQeLriSigq77mRu+7A9I=";
  };

-  pythonRelaxDeps = [ "pipdeptree" ];
+  pythonRelaxDeps = [
+    "rich"
+    "pipdeptree"
+  ];

  build-system = [ poetry-core ];

@@ -51,26 +51,28 @@

 buildPythonPackage rec {
  pname = "reflex";
-  version = "0.7.6";
+  version = "0.7.7";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "reflex-dev";
    repo = "reflex";
    tag = "v${version}";
-    hash = "sha256-LwonbORSoNKi1dHmKxjI2H3G+ZtEGFSpQGwPi/2lRv4=";
+    hash = "sha256-27sgU9ugSkStDOg64W1RgiqmlbOzrdxg7kz2AztfERA=";
  };

+  # 'rich' is also somehow checked when building the wheel,
+  # pythonRelaxDepsHook modifies the wheel METADATA in postBuild
+  pypaBuildFlags = [ "--skip-dependency-check" ];
+
  pythonRelaxDeps = [
+    # needed
+    "rich"
+    # preventative
    "fastapi"
    "gunicorn"
  ];

-  pythonRemoveDeps = [
-    "setuptools"
-    "build"
-  ];
-
  build-system = [ hatchling ];

  dependencies = [
@@ -45,6 +45,10 @@ buildPythonPackage rec {

  build-system = [ setuptools ];

+  pythonRelaxDeps = [
+    "pillow"
+  ];
+
  dependencies = [
    duckduckgo-search
    huggingface-hub
--- a/Show More
+++ b/Show More