Merge staging-next into staging

2025-02-10 00:15:37 +00:00
parent 2beec940c1 5140d32870
commit 2af91468da
311 changed files with 8734 additions and 5291 deletions
@@ -31,6 +31,15 @@ An attribute set of module arguments that can be used in `imports`.

 This is in contrast to `config._module.args`, which is only available after all `imports` have been resolved.

+::: {.warning}
+You may be tempted to use `specialArgs.lib` to provide extra library functions. Doing so limits the interoperability of modules, as well as the interoperability of Module System applications.
+
+`lib` is reserved for the Nixpkgs library, and should not be used for custom functions.
+
+Instead, you may create a new attribute in `specialArgs` to provide custom functions.
+This clarifies their origin and avoids incompatibilities.
+:::
+
 #### `class` {#module-system-lib-evalModules-param-class}

 If the `class` attribute is set and non-`null`, the module system will reject `imports` with a different `_class` declaration.
@@ -24,6 +24,8 @@

        - `lib.nixos` for other NixOS-provided functionality, such as [`runTest`](https://nixos.org/manual/nixos/unstable/#sec-call-nixos-test-outside-nixos)
      */
+      # DON'T USE lib.extend TO ADD NEW FUNCTIONALITY.
+      # THIS WAS A MISTAKE. See the warning in lib/default.nix.
      lib = lib.extend (final: prev: {

        /**
@@ -5,9 +5,41 @@
 */
 let

-  inherit (import ./fixed-points.nix { inherit lib; }) makeExtensible;
+  # A copy of `lib.makeExtensible'` in order to document `extend`.
+  # It has been leading to some trouble, so we have to document it specially.
+  makeExtensible' =
+    rattrs:
+    let self = rattrs self // {
+          /**
+            Patch the Nixpkgs library

-  lib = makeExtensible (self: let
+            A function that applies patches onto the nixpkgs library.
+            Usage is discouraged for most scenarios.
+
+            :::{.note}
+            The name `extends` is a bit misleading, as it doesn't actually extend the library, but rather patches it.
+            It is merely a consequence of being implemented by `makeExtensible`.
+            :::
+
+            # Inputs
+
+            - An "extension function" `f` that returns attributes that will be updated in the returned Nixpkgs library.
+
+            # Output
+
+            A patched Nixpkgs library.
+
+            :::{.warning}
+            This functionality is intended as an escape hatch for when the provided version of the Nixpkgs library has a flaw.
+
+            If you were to use it to add new functionality, you will run into compatibility and interoperability issues.
+            :::
+          */
+          extend = f: lib.makeExtensible (lib.extends f rattrs);
+        };
+    in self;
+
+  lib = makeExtensible' (self: let
    callLibs = file: import file { lib = self; };
  in {

@@ -40,6 +40,7 @@ rec {
    znver2         = [ "sse3" "ssse3" "sse4_1" "sse4_2" "sse4a" "aes" "avx" "avx2"          "fma"        ];
    znver3         = [ "sse3" "ssse3" "sse4_1" "sse4_2" "sse4a" "aes" "avx" "avx2"          "fma"        ];
    znver4         = [ "sse3" "ssse3" "sse4_1" "sse4_2" "sse4a" "aes" "avx" "avx2" "avx512" "fma"        ];
+    znver5         = [ "sse3" "ssse3" "sse4_1" "sse4_2" "sse4a" "aes" "avx" "avx2" "avx512" "fma"        ];
    # other
    armv5te        = [ ];
    armv6          = [ ];
@@ -113,6 +114,7 @@ rec {
    znver2         = [ "znver1"  ] ++ inferiors.znver1;
    znver3         = [ "znver2"  ] ++ inferiors.znver2;
    znver4         = lib.unique ([ "znver3" "x86-64-v4" ] ++ inferiors.znver3 ++ inferiors.x86-64-v4);
+    znver5         = [ "znver4"  ] ++ inferiors.znver4;

    # other
    armv5te        = [ ];
@@ -9920,6 +9920,11 @@
    github = "ilyakooo0";
    githubId = 6209627;
  };
+  ilys = {
+    name = "ilys";
+    github = "ilyist";
+    githubId = 185637611;
+  };
  imadnyc = {
    email = "me@imad.nyc";
    github = "imadnyc";
@@ -21194,6 +21199,12 @@
    githubId = 46294732;
    name = "Sharzy";
  };
+  shavyn = {
+    name = "Marco Desiderati";
+    email = "desideratimarco@gmail.com";
+    github = "Shavyn";
+    githubId = 7593302;
+  };
  shawn8901 = {
    email = "shawn8901@googlemail.com";
    github = "Shawn8901";
@@ -296,9 +296,10 @@
  Read the [release blog post](https://prometheus.io/blog/2024/11/14/prometheus-3-0/) and
  [migration guide](https://prometheus.io/docs/prometheus/3.1/migration/).

- `kanata` was updated to v1.7.0, which introduces several breaking changes.
+- `kanata` was updated to v1.8.0, which introduces several breaking changes.
  See the release notes of
-  [v1.7.0](https://github.com/jtroo/kanata/releases/tag/v1.7.0)
+  [v1.7.0](https://github.com/jtroo/kanata/releases/tag/v1.7.0) and
+  [v1.8.0](https://github.com/jtroo/kanata/releases/tag/v1.8.0)
  for more information.

 - `ags` was updated to v2, which is just a CLI for Astal now. Components are available as a different package set `astal.*`.
@@ -377,7 +377,7 @@ let
         <<'EOF'
        ${toJSON set}
        EOF
-        (( ! $inherit_errexit_enabled )) && shopt -u inherit_errexit
+        (( ! inherit_errexit_enabled )) && shopt -u inherit_errexit
      '';

    /*
@@ -50,10 +50,10 @@ let
    pkgs.addDriverRunpath.driverLink

    # mesa:
-    config.hardware.opengl.package
+    config.hardware.graphics.package

    # nvidia_x11, etc:
-  ] ++ config.hardware.opengl.extraPackages; # nvidia_x11
+  ] ++ config.hardware.graphics.extraPackages; # nvidia_x11

  defaults = {
    nvidia-gpu.onFeatures = package.allowedPatterns.nvidia-gpu.onFeatures;
@@ -82,8 +82,8 @@ in
        default = { };
        defaultText = lib.literalExpression ''
          {
-            opengl.paths = config.hardware.opengl.extraPackages ++ [
-              config.hardware.opengl.package
+            opengl.paths = config.hardware.graphics.extraPackages ++ [
+              config.graphics.opengl.package
              pkgs.addDriverRunpath.driverLink
              "/dev/dri"
            ];
@@ -11,6 +11,15 @@ let
  interfaceOpts = { ... }: {
    options = {

+      type = mkOption {
+        example = "amneziawg";
+        default = "wireguard";
+        type = types.enum ["wireguard" "amneziawg"];
+        description = ''
+          The type of the interface. Currently only "wireguard" and "amneziawg" are supported.
+        '';
+      };
+
      configFile = mkOption {
        example = "/secret/wg0.conf";
        default = null;
@@ -151,6 +160,22 @@ let
        description = "Peers linked to the interface.";
        type = with types; listOf (submodule peerOpts);
      };
+
+      extraOptions = mkOption {
+        type = with types; attrsOf (oneOf [ str int ]);
+        default = { };
+        example = {
+          Jc = 5;
+          Jmin = 10;
+          Jmax = 42;
+          S1 = 60;
+          S2 = 90;
+          H4 = 12345;
+        };
+        description = ''
+          Extra options to append to the interface section. Can be used to define AmneziaWG-specific options.
+        '';
+      };
    };
  };

@@ -230,7 +255,7 @@ let

  writeScriptFile = name: text: ((pkgs.writeShellScriptBin name text) + "/bin/${name}");

-  generatePrivateKeyScript = privateKeyFile: ''
+  generatePrivateKeyScript = privateKeyFile: wgBin: ''
    set -e

    # If the parent dir does not already exist, create it.
@@ -239,7 +264,7 @@ let

    if [ ! -f "${privateKeyFile}" ]; then
      # Write private key file with atomically-correct permissions.
-      (set -e; umask 077; wg genkey > "${privateKeyFile}")
+      (set -e; umask 077; ${wgBin} genkey > "${privateKeyFile}")
    fi
  '';

@@ -247,11 +272,19 @@ let
    assert assertMsg (values.configFile != null || ((values.privateKey != null) != (values.privateKeyFile != null))) "Only one of privateKey, configFile or privateKeyFile may be set";
    assert assertMsg (values.generatePrivateKeyFile == false || values.privateKeyFile != null) "generatePrivateKeyFile requires privateKeyFile to be set";
    let
-      generateKeyScriptFile = if values.generatePrivateKeyFile then writeScriptFile "generatePrivateKey.sh" (generatePrivateKeyScript values.privateKeyFile) else null;
+      wgBin = {
+        wireguard = "wg";
+        amneziawg = "awg";
+      }.${values.type};
+      generateKeyScriptFile =
+        if values.generatePrivateKeyFile then
+          writeScriptFile "generatePrivateKey.sh" (generatePrivateKeyScript values.privateKeyFile wgBin)
+        else
+          null;
      preUpFile = if values.preUp != "" then writeScriptFile "preUp.sh" values.preUp else null;
      postUp =
-            optional (values.privateKeyFile != null) "wg set ${name} private-key <(cat ${values.privateKeyFile})" ++
-            (concatMap (peer: optional (peer.presharedKeyFile != null) "wg set ${name} peer ${peer.publicKey} preshared-key <(cat ${peer.presharedKeyFile})") values.peers) ++
+            optional (values.privateKeyFile != null) "${wgBin} set ${name} private-key <(cat ${values.privateKeyFile})" ++
+            (concatMap (peer: optional (peer.presharedKeyFile != null) "${wgBin} set ${name} peer ${peer.publicKey} preshared-key <(cat ${peer.presharedKeyFile})") values.peers) ++
            optional (values.postUp != "") values.postUp;
      postUpFile = if postUp != [] then writeScriptFile "postUp.sh" (concatMapStringsSep "\n" (line: line) postUp) else null;
      preDownFile = if values.preDown != "" then writeScriptFile "preDown.sh" values.preDown else null;
@@ -279,6 +312,7 @@ let
        optionalString (postUpFile != null) "PostUp = ${postUpFile}\n" +
        optionalString (preDownFile != null) "PreDown = ${preDownFile}\n" +
        optionalString (postDownFile != null) "PostDown = ${postDownFile}\n" +
+        concatLines (mapAttrsToList (n: v: "${n} = ${toString v}") values.extraOptions) +
        concatMapStringsSep "\n" (peer:
          assert assertMsg (!((peer.presharedKeyFile != null) && (peer.presharedKey != null))) "Only one of presharedKey or presharedKeyFile may be set";
          "[Peer]\n" +
@@ -304,7 +338,10 @@ let
        wantedBy = optional values.autostart "multi-user.target";
        environment.DEVICE = name;
        path = [
-          pkgs.wireguard-tools
+          {
+            wireguard = pkgs.wireguard-tools;
+            amneziawg = pkgs.amneziawg-tools;
+          }.${values.type}
          config.networking.firewall.package   # iptables or nftables
          config.networking.resolvconf.package # openresolv or systemd
        ];
@@ -315,11 +352,11 @@ let
        };

        script = ''
-          ${optionalString (!config.boot.isContainer) "${pkgs.kmod}/bin/modprobe wireguard"}
+          ${optionalString (!config.boot.isContainer) "${pkgs.kmod}/bin/modprobe ${values.type}"}
          ${optionalString (values.configFile != null) ''
            cp ${values.configFile} ${configPath}
          ''}
-          wg-quick up ${configPath}
+          ${wgBin}-quick up ${configPath}
        '';

        serviceConfig = {
@@ -328,7 +365,7 @@ let
        };

        preStop = ''
-          wg-quick down ${configPath}
+          ${wgBin}-quick down ${configPath}
        '';
      };
 in {
@@ -360,8 +397,12 @@ in {
  ###### implementation

  config = mkIf (cfg.interfaces != {}) {
-    boot.extraModulePackages = optional (versionOlder kernel.kernel.version "5.6") kernel.wireguard;
-    environment.systemPackages = [ pkgs.wireguard-tools ];
+    boot.extraModulePackages =
+      optional (any (x: x.type == "wireguard") (attrValues cfg.interfaces) && (versionOlder kernel.kernel.version "5.6")) kernel.wireguard
+      ++ optional (any (x: x.type == "amneziawg") (attrValues cfg.interfaces)) kernel.amneziawg;
+    environment.systemPackages =
+      optional (any (x: x.type == "wireguard") (attrValues cfg.interfaces)) pkgs.wireguard-tools
+      ++ optional (any (x: x.type == "amneziawg") (attrValues cfg.interfaces)) pkgs.amneziawg-tools;
    systemd.services = mapAttrs' generateUnit cfg.interfaces;

    # Prevent networkd from clearing the rules set by wg-quick when restarted (e.g. when waking up from suspend).
@@ -189,6 +189,10 @@ in
            assertion = interface.interfaceNamespace == null;
            message = "networking.wireguard.interfaces.${name}.interfaceNamespace cannot be used with networkd.";
          }
+          {
+            assertion = interface.type == "wireguard";
+            message = "networking.wireguard.interfaces.${name}.type value must be \"wireguard\" when used with networkd.";
+          }
        ]
        ++ flip concatMap interface.ips (ip: [
          # IP assertions
@@ -15,6 +15,15 @@ let

    options = {

+      type = mkOption {
+        example = "amneziawg";
+        default = "wireguard";
+        type = types.enum ["wireguard" "amneziawg"];
+        description = ''
+          The type of the interface. Currently only "wireguard" and "amneziawg" are supported.
+        '';
+      };
+
      ips = mkOption {
        example = [ "192.168.2.1/24" ];
        default = [];
@@ -206,6 +215,22 @@ let
          :::
        '';
      };
+
+      extraOptions = mkOption {
+        type = with types; attrsOf (oneOf [ str int ]);
+        default = { };
+        example = {
+          Jc = 5;
+          Jmin = 10;
+          Jmax = 42;
+          S1 = 60;
+          S2 = 90;
+          H4 = 12345;
+        };
+        description = ''
+          Extra options to append to the interface section. Can be used to define AmneziaWG-specific options.
+        '';
+      };
    };

  };
@@ -346,6 +371,16 @@ let

  };

+  wgBins = {
+    wireguard = "wg";
+    amneziawg = "awg";
+  };
+
+  wgPackages = {
+    wireguard = pkgs.wireguard-tools;
+    amneziawg = pkgs.amneziawg-tools;
+  };
+
  generateKeyServiceUnit = name: values:
    assert values.generatePrivateKeyFile;
    nameValuePair "wireguard-${name}-key"
@@ -354,7 +389,7 @@ let
        wantedBy = [ "wireguard-${name}.service" ];
        requiredBy = [ "wireguard-${name}.service" ];
        before = [ "wireguard-${name}.service" ];
-        path = with pkgs; [ wireguard-tools ];
+        path = [ wgPackages.${values.type} ];

        serviceConfig = {
          Type = "oneshot";
@@ -370,7 +405,7 @@ let

          if [ ! -f "${values.privateKeyFile}" ]; then
            # Write private key file with atomically-correct permissions.
-            (set -e; umask 077; wg genkey > "${values.privateKeyFile}")
+            (set -e; umask 077; ${wgBins.${values.type}} genkey > "${values.privateKeyFile}")
          fi
        '';
      };
@@ -395,7 +430,7 @@ let
      src = interfaceCfg.socketNamespace;
      dst = interfaceCfg.interfaceNamespace;
      ip = nsWrap "ip" src dst;
-      wg = nsWrap "wg" src dst;
+      wg = nsWrap wgBins.${interfaceCfg.type} src dst;
      dynamicEndpointRefreshSeconds = dynamicRefreshSeconds interfaceCfg peer;
      dynamicRefreshEnabled = dynamicEndpointRefreshSeconds != 0;
      # We generate a different name (a `-refresh` suffix) when `dynamicEndpointRefreshSeconds`
@@ -412,7 +447,7 @@ let
        wantedBy = [ "wireguard-${interfaceName}.service" ];
        environment.DEVICE = interfaceName;
        environment.WG_ENDPOINT_RESOLUTION_RETRIES = "infinity";
-        path = with pkgs; [ iproute2 wireguard-tools ];
+        path = with pkgs; [ iproute2 wgPackages.${interfaceCfg.type} ];

        serviceConfig =
          if !dynamicRefreshEnabled
@@ -501,7 +536,7 @@ let
        dst = values.interfaceNamespace;
        ipPreMove  = nsWrap "ip" src null;
        ipPostMove = nsWrap "ip" src dst;
-        wg = nsWrap "wg" src dst;
+        wg = nsWrap wgBins.${values.type} src dst;
        ns = if dst == "init" then "1" else dst;

    in
@@ -512,7 +547,7 @@ let
        wants = [ "network.target" ];
        before = [ "network.target" ];
        environment.DEVICE = name;
-        path = with pkgs; [ kmod iproute2 wireguard-tools ];
+        path = with pkgs; [ kmod iproute2 wgPackages.${values.type} ];

        serviceConfig = {
          Type = "oneshot";
@@ -520,10 +555,10 @@ let
        };

        script = concatStringsSep "\n" (
-          optional (!config.boot.isContainer) "modprobe wireguard || true"
+          optional (!config.boot.isContainer) "modprobe ${values.type} || true"
          ++ [
            values.preSetup
-            ''${ipPreMove} link add dev "${name}" type wireguard''
+            ''${ipPreMove} link add dev "${name}" type ${values.type}''
          ]
          ++ optional (values.interfaceNamespace != null && values.interfaceNamespace != values.socketNamespace) ''${ipPreMove} link set "${name}" netns "${ns}"''
          ++ optional (values.mtu != null) ''${ipPostMove} link set "${name}" mtu ${toString values.mtu}''
@@ -535,6 +570,7 @@ let
            [ ''${wg} set "${name}" private-key "${privKey}"'' ]
            ++ optional (values.listenPort != null) ''listen-port "${toString values.listenPort}"''
            ++ optional (values.fwMark != null) ''fwmark "${values.fwMark}"''
+            ++ mapAttrsToList (k: v: ''${toLower k} "${toString v}"'') values.extraOptions
            ))
            ''${ipPostMove} link set up dev "${name}"''
            values.postSetup
@@ -554,6 +590,9 @@ let
      ns = last nsList;
    in
      if (length nsList > 0 && ns != "init") then ''ip netns exec "${ns}" "${cmd}"'' else cmd;
+
+  usingWg = any (x: x.type == "wireguard") (attrValues cfg.interfaces);
+  usingAwg = any (x: x.type == "amneziawg") (attrValues cfg.interfaces);
 in

 {
@@ -628,9 +667,11 @@ in
          message = "networking.wireguard.interfaces.${interfaceName} peer «${peer.publicKey}» has both presharedKey and presharedKeyFile set, but only one can be used.";
        }) all_peers;

-    boot.extraModulePackages = optional (versionOlder kernel.kernel.version "5.6") kernel.wireguard;
-    boot.kernelModules = [ "wireguard" ];
-    environment.systemPackages = [ pkgs.wireguard-tools ];
+    boot.extraModulePackages =
+      optional (usingWg && (versionOlder kernel.kernel.version "5.6")) kernel.wireguard
+      ++ optional usingAwg kernel.amneziawg;
+    boot.kernelModules = optional usingWg "wireguard" ++ optional usingAwg "amneziawg";
+    environment.systemPackages = optional usingWg pkgs.wireguard-tools ++ optional usingAwg pkgs.amneziawg-tools;

    systemd.services = mkIf (!cfg.useNetworkd) (
      (mapAttrs' generateInterfaceUnit cfg.interfaces)
@@ -0,0 +1,125 @@
+import ../make-test-python.nix (
+  {
+    pkgs,
+    lib,
+    kernelPackages ? null,
+    nftables ? false,
+    ...
+  }:
+  let
+    wg-snakeoil-keys = import ./snakeoil-keys.nix;
+    peer = import ./make-peer.nix { inherit lib; };
+    commonConfig = {
+      boot.kernelPackages = lib.mkIf (kernelPackages != null) kernelPackages;
+      networking.nftables.enable = nftables;
+      # Make sure iptables doesn't work with nftables enabled
+      boot.blacklistedKernelModules = lib.mkIf nftables [ "nft_compat" ];
+    };
+    extraOptions = {
+      Jc = 5;
+      Jmin = 10;
+      Jmax = 42;
+      S1 = 60;
+      S2 = 90;
+    };
+  in
+  {
+    name = "amneziawg-quick";
+    meta = with pkgs.lib.maintainers; {
+      maintainers = [
+        averyanalex
+        azahi
+      ];
+    };
+
+    nodes = {
+      peer0 = peer {
+        ip4 = "192.168.0.1";
+        ip6 = "fd00::1";
+        extraConfig = lib.mkMerge [
+          commonConfig
+          {
+            networking.firewall.allowedUDPPorts = [ 23542 ];
+            networking.wg-quick.interfaces.wg0 = {
+              type = "amneziawg";
+
+              address = [
+                "10.23.42.1/32"
+                "fc00::1/128"
+              ];
+              listenPort = 23542;
+
+              inherit (wg-snakeoil-keys.peer0) privateKey;
+
+              peers = lib.singleton {
+                allowedIPs = [
+                  "10.23.42.2/32"
+                  "fc00::2/128"
+                ];
+
+                inherit (wg-snakeoil-keys.peer1) publicKey;
+              };
+
+              dns = [
+                "10.23.42.2"
+                "fc00::2"
+                "wg0"
+              ];
+
+              inherit extraOptions;
+            };
+          }
+        ];
+      };
+
+      peer1 = peer {
+        ip4 = "192.168.0.2";
+        ip6 = "fd00::2";
+        extraConfig = lib.mkMerge [
+          commonConfig
+          {
+            networking.useNetworkd = true;
+            networking.wg-quick.interfaces.wg0 = {
+              type = "amneziawg";
+
+              address = [
+                "10.23.42.2/32"
+                "fc00::2/128"
+              ];
+              inherit (wg-snakeoil-keys.peer1) privateKey;
+
+              peers = lib.singleton {
+                allowedIPs = [
+                  "0.0.0.0/0"
+                  "::/0"
+                ];
+                endpoint = "192.168.0.1:23542";
+                persistentKeepalive = 25;
+
+                inherit (wg-snakeoil-keys.peer0) publicKey;
+              };
+
+              dns = [
+                "10.23.42.1"
+                "fc00::1"
+                "wg0"
+              ];
+
+              inherit extraOptions;
+            };
+          }
+        ];
+      };
+    };
+
+    testScript = ''
+      start_all()
+
+      peer0.wait_for_unit("wg-quick-wg0.service")
+      peer1.wait_for_unit("wg-quick-wg0.service")
+
+      peer1.succeed("ping -c5 fc00::1")
+      peer1.succeed("ping -c5 10.23.42.1")
+    '';
+  }
+)
@@ -0,0 +1,111 @@
+import ../make-test-python.nix (
+  {
+    pkgs,
+    lib,
+    kernelPackages ? null,
+    ...
+  }:
+  let
+    wg-snakeoil-keys = import ./snakeoil-keys.nix;
+    peer = (import ./make-peer.nix) { inherit lib; };
+    extraOptions = {
+      Jc = 5;
+      Jmin = 10;
+      Jmax = 42;
+      S1 = 60;
+      S2 = 90;
+    };
+  in
+  {
+    name = "amneziawg";
+    meta = with pkgs.lib.maintainers; {
+      maintainers = [
+        averyanalex
+        azahi
+      ];
+    };
+
+    nodes = {
+      peer0 = peer {
+        ip4 = "192.168.0.1";
+        ip6 = "fd00::1";
+        extraConfig = {
+          boot = lib.mkIf (kernelPackages != null) { inherit kernelPackages; };
+          networking.firewall.allowedUDPPorts = [ 23542 ];
+          networking.wireguard.interfaces.wg0 = {
+            type = "amneziawg";
+            ips = [
+              "10.23.42.1/32"
+              "fc00::1/128"
+            ];
+            listenPort = 23542;
+
+            inherit (wg-snakeoil-keys.peer0) privateKey;
+
+            peers = lib.singleton {
+              allowedIPs = [
+                "10.23.42.2/32"
+                "fc00::2/128"
+              ];
+
+              inherit (wg-snakeoil-keys.peer1) publicKey;
+            };
+
+            inherit extraOptions;
+          };
+        };
+      };
+
+      peer1 = peer {
+        ip4 = "192.168.0.2";
+        ip6 = "fd00::2";
+        extraConfig = {
+          boot = lib.mkIf (kernelPackages != null) { inherit kernelPackages; };
+          networking.wireguard.interfaces.wg0 = {
+            type = "amneziawg";
+            ips = [
+              "10.23.42.2/32"
+              "fc00::2/128"
+            ];
+            listenPort = 23542;
+            allowedIPsAsRoutes = false;
+
+            inherit (wg-snakeoil-keys.peer1) privateKey;
+
+            peers = lib.singleton {
+              allowedIPs = [
+                "0.0.0.0/0"
+                "::/0"
+              ];
+              endpoint = "192.168.0.1:23542";
+              persistentKeepalive = 25;
+
+              inherit (wg-snakeoil-keys.peer0) publicKey;
+            };
+
+            postSetup =
+              let
+                inherit (pkgs) iproute2;
+              in
+              ''
+                ${iproute2}/bin/ip route replace 10.23.42.1/32 dev wg0
+                ${iproute2}/bin/ip route replace fc00::1/128 dev wg0
+              '';
+
+            inherit extraOptions;
+          };
+        };
+      };
+    };
+
+    testScript = ''
+      start_all()
+
+      peer0.wait_for_unit("wireguard-wg0.service")
+      peer1.wait_for_unit("wireguard-wg0.service")
+
+      peer1.succeed("ping -c5 fc00::1")
+      peer1.succeed("ping -c5 10.23.42.1")
+    '';
+  }
+)
@@ -10,10 +10,12 @@ with pkgs.lib;
 let
  tests = let callTest = p: args: import p ({ inherit system pkgs; } // args); in {
    basic = callTest ./basic.nix;
+    amneziawg = callTest ./amneziawg.nix;
    namespaces = callTest ./namespaces.nix;
    networkd = callTest ./networkd.nix;
    wg-quick = callTest ./wg-quick.nix;
    wg-quick-nftables = args: callTest ./wg-quick.nix ({ nftables = true; } // args);
+    amneziawg-quick = callTest ./amneziawg-quick.nix;
    generated = callTest ./generated.nix;
    dynamic-refresh = callTest ./dynamic-refresh.nix;
    dynamic-refresh-networkd = args: callTest ./dynamic-refresh.nix ({ useNetworkd = true; } // args);
@@ -49,13 +49,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "clementine";
-  version = "1.4.1";
+  version = "1.4.1-31-g69ba3e85f";

  src = fetchFromGitHub {
    owner = "clementine-player";
    repo = "Clementine";
    tag = finalAttrs.version;
-    hash = "sha256-ges7PHsv/J0R5dqmKvS5BpYxOgy9YB8hZMXOIe16M6A=";
+    hash = "sha256-r6x3/Kr8XdFP4sXERjWWMEAxY4M/vIS0QQfneTUWGuc=";
  };

  nativeBuildInputs = [
@@ -15,11 +15,11 @@

 stdenv.mkDerivation rec {
  pname = "drumkv1";
-  version = "1.0.0";
+  version = "1.3.0";

  src = fetchurl {
    url = "mirror://sourceforge/drumkv1/drumkv1-${version}.tar.gz";
-    hash = "sha256-vi//84boqaVxC/KCg+HF76vB4Opch02LU4RtbVaxaX4=";
+    hash = "sha256-WcWhq1Li9dfj0piyW6F0mdfzcK+nvk5Rtl8pQZTYyt8=";
  };

  buildInputs = [
@@ -45,7 +45,7 @@ in

 stdenv.mkDerivation rec {
  pname = "touchosc";
-  version = "1.3.7.218";
+  version = "1.3.8.222";

  suffix = {
    aarch64-linux = "linux-arm64";
@@ -56,9 +56,9 @@ stdenv.mkDerivation rec {
  src = fetchurl {
    url = "https://hexler.net/pub/${pname}/${pname}-${version}-${suffix}.deb";
    hash = {
-      aarch64-linux = "sha256-6nnTSMTKlUyqzhxSmTfDcpNcxCb34B0vuJaUiVNS0NE=";
-      armv7l-linux  = "sha256-eOQiYqAKt36ah7BY5yxChaPF6lhBnVOshhep1u36p3U=";
-      x86_64-linux  = "sha256-rBGbiV/1RhL513qSyc2TTsdvkTPJ2bmP6oq2Q6Ykay8=";
+      aarch64-linux = "sha256-TuO0dzV2j2YRbb5NJ/iIS186XCJ1E+15P8k7hVxElCE=";
+      armv7l-linux  = "sha256-LJ4a9TZQr4LGuS5gGpmW1yp1q0Smsr8mIhz18ISM3sc=";
+      x86_64-linux  = "sha256-l+7wefJC6q+hgjKuRMqCuD5XHNiw9DQANP99FkjIWOk=";
    }.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
  };

@@ -19,11 +19,11 @@

 mkDerivation rec {
  pname = "okteta";
-  version = "0.26.18";
+  version = "0.26.19";

  src = fetchurl {
    url = "mirror://kde/stable/okteta/${version}/src/${pname}-${version}.tar.xz";
-    sha256 = "sha256-xAlhZtQuIRtvMaHflCr89lHH6ocqIRAECwHdRa+/imM=";
+    sha256 = "sha256-shVLRZqxFGstKmqtBIUT//kz8WLos+u4s6ftlXgospM=";
  };

  nativeBuildInputs = [
@@ -10,19 +10,19 @@
  vimUtils,
 }:
 let
-  version = "0.0.16";
+  version = "0.0.18";
  src = fetchFromGitHub {
    owner = "yetone";
    repo = "avante.nvim";
    tag = "v${version}";
-    hash = "sha256-rnd+ASzKTOF3JXjbq6JaNd/tYPpEIvzKK0TZHmDJ+MQ=";
+    hash = "sha256-HSXqD+bC0sdvNbmV8hIU99cLrVyIMAzbWf5cqUpIhZU=";
  };
  avante-nvim-lib = rustPlatform.buildRustPackage {
    pname = "avante-nvim-lib";
    inherit version src;

    useFetchCargoVendor = true;
-    cargoHash = "sha256-KbGRt5gKsXFRFMTcwK0db53Ul7M3jMFda4m+sRjXi2Y=";
+    cargoHash = "sha256-XDxWeEbsDf4r346OkQkZPmYLANgtydspPk1uLrnvrnY=";

    nativeBuildInputs = [
      pkg-config
@@ -39,6 +39,7 @@ let
      "--skip=test_hf"
      "--skip=test_public_url"
      "--skip=test_roundtrip"
+      "--skip=test_fetch_md"
    ];
  };
 in
@@ -40,14 +40,14 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "mame";
-  version = "0.273";
+  version = "0.274";
  srcVersion = builtins.replaceStrings [ "." ] [ "" ] version;

  src = fetchFromGitHub {
    owner = "mamedev";
    repo = "mame";
    rev = "mame${srcVersion}";
-    hash = "sha256-aOBYnkdcFKDkw/KFiv0IRgpOChn8NRKD2xmbfExYGKY=";
+    hash = "sha256-fZ2mjwP45qpFB0VaIHBccjkDPKyDmxqaXcZg3TFSAlY=";
  };

  outputs = [
@@ -1,6 +1,6 @@
 {
  lib,
-  mkDerivation,
+  stdenv,
  fetchFromGitHub,
  fetchurl,
  povray,
@@ -8,37 +8,45 @@
  qttools,
  replaceVars,
  zlib,
+  testers,
+  wrapQtAppsHook,
+  nix-update-script,
+  libGL,
 }:

 /*
-  To use aditional parts libraries
+  To use additional parts libraries
  set the variable LEOCAD_LIB=/path/to/libs/ or use option -l /path/to/libs/
 */

 let
  parts = fetchurl {
-    url = "https://web.archive.org/web/20210705153544/https://www.ldraw.org/library/updates/complete.zip";
-    sha256 = "sha256-PW3XCbFwRaNkx4EgCnl2rXH7QgmpNgjTi17kZ5bladA=";
+    url = "https://web.archive.org/web/20241230062818/https://library.ldraw.org/library/updates/complete.zip";
+    hash = "sha256-0RIJYEU+MpE4MSfxk2HK5hQd8IsiPn2xEGUFmItzlk8=";
  };

 in
-mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "leocad";
-  version = "21.06";
+  version = "23.03";

  src = fetchFromGitHub {
    owner = "leozide";
    repo = "leocad";
-    rev = "v${version}";
-    sha256 = "1ifbxngkbmg6d8vv08amxbnfvlyjdwzykrjp98lbwvgb0b843ygq";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-IY9mr2gSMZL9pxiVTKH/f7rjsOvBDNgwVKpXA57oMGo=";
  };

  nativeBuildInputs = [
    qmake
    qttools
+    wrapQtAppsHook
  ];

-  buildInputs = [ zlib ];
+  buildInputs = [
+    zlib
+    libGL
+  ];

  propagatedBuildInputs = [ povray ];

@@ -57,12 +65,23 @@ mkDerivation rec {
    "--set-default LEOCAD_LIB ${parts}"
  ];

-  meta = with lib; {
+  passthru = {
+    tests.version = testers.testVersion {
+      package = finalAttrs.finalPackage;
+      command = "env QT_QPA_PLATFORM=minimal ${lib.getExe finalAttrs.finalPackage} --version";
+    };
+    updateScript = nix-update-script { };
+  };
+
+  passthru = {
    description = "CAD program for creating virtual LEGO models";
    mainProgram = "leocad";
    homepage = "https://www.leocad.org/";
-    license = licenses.gpl2Only;
-    maintainers = with maintainers; [ peterhoeg ];
-    platforms = platforms.linux;
+    license = lib.licenses.gpl2Only;
+    maintainers = with lib.maintainers; [
+      peterhoeg
+      hetraeus
+    ];
+    platforms = lib.platforms.linux;
  };
-}
+})
@@ -10,25 +10,25 @@

 let
  pname = "1password";
-  version = if channel == "stable" then "8.10.58" else "8.10.60-4.BETA";
+  version = if channel == "stable" then "8.10.60" else "8.10.60-4.BETA";

  sources = {
    stable = {
      x86_64-linux = {
        url = "https://downloads.1password.com/linux/tar/stable/x86_64/1password-${version}.x64.tar.gz";
-        hash = "sha256-JznF2xG66z8FKwC7Xg3Pe/LLwxw5PqbHBessmxzpyRA=";
+        hash = "sha256-QCoV66LvGo6vA5fjuE3fG+LwehKVMPmgaDghh9YEvmA=";
      };
      aarch64-linux = {
        url = "https://downloads.1password.com/linux/tar/stable/aarch64/1password-${version}.arm64.tar.gz";
-        hash = "sha256-q3qb1S30svgrMeOv5okAqH//RUnDuD0RUTdjxDoQFJo=";
+        hash = "sha256-E5TniXur9ATJ3ER/zTFc6EiBrH/kbNvIao0ADLyBZZE=";
      };
      x86_64-darwin = {
        url = "https://downloads.1password.com/mac/1Password-${version}-x86_64.zip";
-        hash = "sha256-ER+NLSVyYJpxNx4mHgJJE8OWSXSx5WppN2YqMaWuJ7E=";
+        hash = "sha256-2Nv4CHKLgCFbU1TeJQhIq8YdkJSQJXtUw2S17B8cS4s=";
      };
      aarch64-darwin = {
        url = "https://downloads.1password.com/mac/1Password-${version}-aarch64.zip";
-        hash = "sha256-7SczaIcY/bQtTy6ODQh464/14q+VvgnJr7EdhEzevCs=";
+        hash = "sha256-drJiM8EiUM3M54+KPQdLvAmSfBH5YPqQk14yjHzoBtM=";
      };
    };
    beta = {
@@ -9,12 +9,12 @@

 stdenv.mkDerivation rec {
  pname = "ganttproject-bin";
-  version = "3.3.3312";
+  version = "3.3.3316";

  src = fetchzip {
    url = "https://dl.ganttproject.biz/ganttproject-${version}/ganttproject-${version}.zip";
    stripRoot = false;
-    hash = "sha256-mvup4yMfFfzL2iLMj9vlFFrJT0wLmeadNEnf2QO53H0=";
+    hash = "sha256-tiEq/xdC0gXiUInLS9xGR/vI/BpdSA+mSf5yukuejc4=";
  };

  nativeBuildInputs = [ makeWrapper ];
@@ -21,7 +21,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "palemoon-bin";
-  version = "33.5.1";
+  version = "33.6.0";

  src = finalAttrs.passthru.sources."gtk${if withGTK3 then "3" else "2"}";

@@ -172,11 +172,11 @@ stdenv.mkDerivation (finalAttrs: {
      {
        gtk3 = fetchzip {
          urls = urlRegionVariants "gtk3";
-          hash = "sha256-N3z03c4DsEG/L3T4BjOSx7XOGT988ZDshYhgl9TuOQM=";
+          hash = "sha256-fOha0D8drFbKtfl/UA4MqzBhhBrvS3T81XP09RZQc9c=";
        };
        gtk2 = fetchzip {
          urls = urlRegionVariants "gtk2";
-          hash = "sha256-L+SgmjzilFFK8FcutINVac4MCAPvgJ3OqpwBaQqNlCI=";
+          hash = "sha256-r8sAkQ7XiYs39VZjvegVgx7KrfB8WyZfcl/XgGV/kwA=";
        };
      };

@@ -24,7 +24,7 @@ let
  vivaldiName = if isSnapshot then "vivaldi-snapshot" else "vivaldi";
 in stdenv.mkDerivation rec {
  pname = "vivaldi";
-  version = "7.1.3570.39";
+  version = "7.1.3570.47";

  suffix = {
    aarch64-linux = "arm64";
@@ -34,8 +34,8 @@ in stdenv.mkDerivation rec {
  src = fetchurl {
    url = "https://downloads.vivaldi.com/${branch}/vivaldi-${branch}_${version}-1_${suffix}.deb";
    hash = {
-      aarch64-linux = "sha256-rhIz+vX/W39sN/j37nhaq+iEbIc/rfgMprqmX+DM2D8=";
-      x86_64-linux = "sha256-d6NQRueNE9P2/IOLwBIm4evrqO0D+RNKUUC156PEgcc=";
+      aarch64-linux = "sha256-wpx4IonQNTY4KmzP2uP8XDTupQNeZm808JOfS2aeXBY=";
+      x86_64-linux = "sha256-alUT0cMl2gKFDNE+DW8SS2ith4J3baCXu5m4vEYGNrw=";
    }.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
  };

@@ -1192,11 +1192,11 @@
    "vendorHash": "sha256-c3R/7k7y7XS2Qli00nSj7gh/3Mj88PY4WybBTq/+pPs="
  },
  "spotinst": {
-    "hash": "sha256-zP71u5xaWcb+LBKGU3yFAQcZnK6MlO5WRQwc8Fz9ZJY=",
+    "hash": "sha256-ThGr8oY7SevU05S7g4r8Il4mr02zzg53YzaYztkY7M4=",
    "homepage": "https://registry.terraform.io/providers/spotinst/spotinst",
    "owner": "spotinst",
    "repo": "terraform-provider-spotinst",
-    "rev": "v1.208.0",
+    "rev": "v1.209.1",
    "spdx": "MPL-2.0",
    "vendorHash": "sha256-HNKdEwG+7IJ2YpX97qkvXZbsoJWx+u+rZXRoZzvB1XA="
  },
@@ -1228,11 +1228,11 @@
    "vendorHash": "sha256-9M1DsE/FPQK8TG7xCJWbU3HAJCK3p/7lxdzjO1oAfWs="
  },
  "sumologic": {
-    "hash": "sha256-T+DQ2uTkbwzTShKx1FOavOc/V/DxwBOxKPE639+mhXg=",
+    "hash": "sha256-jGfBRem860KZfu0HjgAPm8Qwp3nM6993px7Gkt1BUGA=",
    "homepage": "https://registry.terraform.io/providers/SumoLogic/sumologic",
    "owner": "SumoLogic",
    "repo": "terraform-provider-sumologic",
-    "rev": "v3.0.1",
+    "rev": "v3.0.4",
    "spdx": "MPL-2.0",
    "vendorHash": "sha256-YdWs2orKhbwAZSQYC73t4e/vvVxk8LrBPG9ZC38VcZE="
  },
@@ -3,13 +3,13 @@

 buildGoModule rec {
  pname = "discordo";
-  version = "0-unstable-2025-01-27";
+  version = "0-unstable-2025-02-08";

  src = fetchFromGitHub {
    owner = "ayn2op";
    repo = pname;
-    rev = "1783361d5fb839e54f4562a9c42eb478d9cc8f57";
-    hash = "sha256-AU7gT+q1vF4WWn5o2OCiAjHjub0ig1O7/CjFnuQaN6I=";
+    rev = "ea51fac7d6ea0fcb48decac8600d82e39a6879dd";
+    hash = "sha256-pQjukqycdiMG9aCk37+LKZXlJPxgi8ZrI0G5Tsnv9xg=";
  };

  vendorHash = "sha256-FsZRh4k9ucmAruJa1MZ4kVVryrEuHy9StgXHvgBiWSg=";
@@ -17,8 +17,14 @@
  openasar,
  withVencord ? false,
  vencord,
+  withMoonlight ? false,
+  moonlight,
 }:

+assert lib.assertMsg (
+  !(withMoonlight && withVencord)
+) "discord: Moonlight and Vencord can not be enabled at the same time";
+
 let
  disableBreakingUpdates =
    runCommand "disable-breaking-updates.py"
@@ -72,6 +78,13 @@ stdenv.mkDerivation {
      mkdir $out/Applications/${desktopName}.app/Contents/Resources/app.asar
      echo '{"name":"discord","main":"index.js"}' > $out/Applications/${desktopName}.app/Contents/Resources/app.asar/package.json
      echo 'require("${vencord}/patcher.js")' > $out/Applications/${desktopName}.app/Contents/Resources/app.asar/index.js
+    ''
+
+    + lib.strings.optionalString withMoonlight ''
+      mv $out/Applications/${desktopName}.app/Contents/Resources/app.asar $out/Applications/${desktopName}.app/Contents/Resources/_app.asar
+      mkdir $out/Applications/${desktopName}.app/Contents/Resources/app.asar
+      echo '{"name":"discord","main":"injector.js","private": true}' > $out/Applications/${desktopName}.app/Contents/Resources/app.asar/package.json
+      echo 'require("${moonlight}/injector.js").inject(require("path").join(__dirname, "../_app.asar"));' > $out/Applications/${desktopName}.app/Contents/Resources/app.asar/injector.js
    '';

  passthru = {
@@ -9,16 +9,16 @@ let
  versions =
    if stdenv.hostPlatform.isLinux then
      {
-        stable = "0.0.83";
-        ptb = "0.0.128";
-        canary = "0.0.581";
+        stable = "0.0.84";
+        ptb = "0.0.130";
+        canary = "0.0.585";
        development = "0.0.68";
      }
    else
      {
-        stable = "0.0.334";
-        ptb = "0.0.157";
-        canary = "0.0.692";
+        stable = "0.0.335";
+        ptb = "0.0.159";
+        canary = "0.0.696";
        development = "0.0.78";
      };
  version = versions.${branch};
@@ -26,15 +26,15 @@ let
    x86_64-linux = {
      stable = fetchurl {
        url = "https://stable.dl2.discordapp.net/apps/linux/${version}/discord-${version}.tar.gz";
-        hash = "sha256-thBnSYjYa2QEHyxIhEiA73hMs/S8n808oq8IAKtA7VI=";
+        hash = "sha256-Gbxa8Yekjx8a3BkPBfUAdLW5gdnq3WMcwW3rzVgZjog=";
      };
      ptb = fetchurl {
        url = "https://ptb.dl2.discordapp.net/apps/linux/${version}/discord-ptb-${version}.tar.gz";
-        hash = "sha256-ccmlOyzPu6aMqmC2+mRXMQh6OYIFLrlTNwKmBGE61ic=";
+        hash = "sha256-MuFPQK9HgTgkZV/48OazJfBXFgrEjT57SNKnq9HKD4s=";
      };
      canary = fetchurl {
        url = "https://canary.dl2.discordapp.net/apps/linux/${version}/discord-canary-${version}.tar.gz";
-        hash = "sha256-PUTu1eoq8lB+4rX0qACh3M8tOjR83Tgs3vaN5t70Mo8=";
+        hash = "sha256-PxdnCrZU8QoToyXk0LSzYUp25OFOJOJ5fKpH1aT2vt8=";
      };
      development = fetchurl {
        url = "https://development.dl2.discordapp.net/apps/linux/${version}/discord-development-${version}.tar.gz";
@@ -44,15 +44,15 @@ let
    x86_64-darwin = {
      stable = fetchurl {
        url = "https://stable.dl2.discordapp.net/apps/osx/${version}/Discord.dmg";
-        hash = "sha256-8zAwOh1waRAQwW/RnjUJsOQJmYcCK5dZ10Ib08F7U08=";
+        hash = "sha256-TybjfJoWoOcpmBVPwIjTpzfhsMwzfxF5Gr2xEoHNKzk=";
      };
      ptb = fetchurl {
        url = "https://ptb.dl2.discordapp.net/apps/osx/${version}/DiscordPTB.dmg";
-        hash = "sha256-bZ9LVthjBib/yRfDTIXBNKDulWhW35HOdSDyEyjyLyA=";
+        hash = "sha256-ZokyBmeMKlP45c7q17Xbyc1prpPXtIgZJ2LK1NXBU/4=";
      };
      canary = fetchurl {
        url = "https://canary.dl2.discordapp.net/apps/osx/${version}/DiscordCanary.dmg";
-        hash = "sha256-xA9TU6ODC6c8m+dLHxc5ZxD+SmTfXIjXl1wbA5JVay4=";
+        hash = "sha256-N53fCN9QL1oOavM0m8iofRsCRMaxsafsseBr+XuxfKc=";
      };
      development = fetchurl {
        url = "https://development.dl2.discordapp.net/apps/osx/${version}/DiscordDevelopment.dmg";
@@ -62,9 +62,15 @@
  openasar,
  withVencord ? false,
  vencord,
+  withMoonlight ? false,
+  moonlight,
  withTTS ? true,
 }:

+assert lib.assertMsg (
+  !(withMoonlight && withVencord)
+) "discord: Moonlight and Vencord can not be enabled at the same time";
+
 let
  disableBreakingUpdates =
    runCommand "disable-breaking-updates.py"
@@ -195,6 +201,12 @@ stdenv.mkDerivation rec {
      mkdir $out/opt/${binaryName}/resources/app.asar
      echo '{"name":"discord","main":"index.js"}' > $out/opt/${binaryName}/resources/app.asar/package.json
      echo 'require("${vencord}/patcher.js")' > $out/opt/${binaryName}/resources/app.asar/index.js
+    ''
+    + lib.strings.optionalString withMoonlight ''
+      mv $out/opt/${binaryName}/resources/app.asar $out/opt/${binaryName}/resources/_app.asar
+      mkdir $out/opt/${binaryName}/resources/app
+      echo '{"name":"discord","main":"injector.js","private": true}' > $out/opt/${binaryName}/resources/app/package.json
+      echo 'require("${moonlight}/injector.js").inject(require("path").join(__dirname, "../_app.asar"));' > $out/opt/${binaryName}/resources/app/injector.js
    '';

  desktopItem = makeDesktopItem {
@@ -3,19 +3,23 @@
  buildPythonApplication,
  fetchFromGitHub,
  isPyPy,
+  pythonOlder,
  lib,
  defusedxml,
  packaging,
  psutil,
  setuptools,
-  pydantic,
  nixosTests,
+  pytestCheckHook,
+  which,
+  podman,
+  selenium,
  # Optional dependencies:
  fastapi,
  jinja2,
  pysnmp,
  hddtemp,
-  netifaces, # IP module
+  netifaces2, # IP module
  uvicorn,
  requests,
  prometheus-client,
@@ -23,16 +27,16 @@

 buildPythonApplication rec {
  pname = "glances";
-  version = "4.2.1";
+  version = "4.3.0.6";
  pyproject = true;

-  disabled = isPyPy;
+  disabled = isPyPy || pythonOlder "3.9";

  src = fetchFromGitHub {
    owner = "nicolargo";
    repo = "glances";
    tag = "v${version}";
-    hash = "sha256-8Jm6DE3B7OQkaNwX/KwXMNZHUyvPtln8mJYaD6yzJRM=";
+    hash = "sha256-r4wDuV7WS3BQ5hidp2x6JqvHQLf6FchoHisMMEye1PM=";
  };

  build-system = [ setuptools ];
@@ -50,17 +54,9 @@ buildPythonApplication rec {
  # some tests fail in darwin sandbox
  doCheck = !stdenv.hostPlatform.isDarwin;

-  checkPhase = ''
-    runHook preCheck
-
-    python unittest-core.py
-
-    runHook postCheck
-  '';
-
  dependencies = [
    defusedxml
-    netifaces
+    netifaces2
    packaging
    psutil
    pysnmp
@@ -68,6 +64,7 @@ buildPythonApplication rec {
    uvicorn
    requests
    jinja2
+    which
    prometheus-client
  ] ++ lib.optional stdenv.hostPlatform.isLinux hddtemp;

@@ -75,6 +72,18 @@ buildPythonApplication rec {
    service = nixosTests.glances;
  };

+  nativeCheckInputs = [
+    which
+    pytestCheckHook
+    selenium
+    podman
+  ];
+
+  disabledTestPaths = [
+    # Message: Unable to obtain driver for chrome
+    "tests/test_webui.py"
+  ];
+
  meta = {
    homepage = "https://nicolargo.github.io/glances/";
    description = "Cross-platform curses-based monitoring tool";
@@ -8,13 +8,13 @@

 buildLua {
  pname = "mpv-thumbfast";
-  version = "0-unstable-2024-08-02";
+  version = "0-unstable-2025-02-04";

  src = fetchFromGitHub {
    owner = "po5";
    repo = "thumbfast";
-    rev = "f1fdf10b17f394f2d42520d0e9bf22feaa20a9f4";
-    hash = "sha256-cygLf+0PMH7cVXBcY12PdcxBHmy38DNoXQubKAlerHM=";
+    rev = "9deb0733c4e36938cf90e42ddfb7a19a8b2f4641";
+    hash = "sha256-avG1CRBrs0UM4HcFMUVAQyOtcIFkZ/H+PbjZJKU7o2A=";
  };
  passthru.updateScript = unstableGitUpdater { };

@@ -1,15 +1,14 @@
 {
  lib,
+  stdenv,
  fetchFromGitHub,
-  fetchpatch2,
  pkg-config,
  libxcb,
-  mkDerivation,
  cmake,
  qtbase,
  qtdeclarative,
-  qtquickcontrols,
-  qtquickcontrols2,
+  wrapQtAppsHook,
+  qtsvg,
  ffmpeg,
  gst_all_1,
  libpulseaudio,
@@ -17,31 +16,23 @@
  jack2,
  v4l-utils,
 }:
-mkDerivation rec {
+
+stdenv.mkDerivation rec {
  pname = "webcamoid";
-  version = "9.1.1";
+  version = "9.2.3";

  src = fetchFromGitHub {
-    sha256 = "sha256-E2hHFrksJtdDLWiX7wL1z9LBbBKT04a853V8u+WiwbA=";
-    rev = version;
-    repo = "webcamoid";
    owner = "webcamoid";
+    repo = "webcamoid";
+    tag = version;
+    hash = "sha256-j4FiRQeFsrZD48P1CUESFytz9l/64Lz1EuOZp0ZSEmI=";
  };

-  patches = [
-    # Update mediawriterffmpeg.cpp for ffmpeg-7.0
-    (fetchpatch2 {
-      url = "https://github.com/webcamoid/webcamoid/commit/b4864f13ec8c2ec93ebb5c13d9293cf9c02c93fd.patch?full_index=1";
-      hash = "sha256-QasfVocxAzRMME03JFRfz7QQYXQGq4TSFiBsKL1g/wU=";
-    })
-  ];
-
  buildInputs = [
    libxcb
    qtbase
    qtdeclarative
-    qtquickcontrols
-    qtquickcontrols2
+    qtsvg
    ffmpeg
    gst_all_1.gstreamer
    gst_all_1.gst-plugins-base
@@ -54,15 +45,16 @@ mkDerivation rec {
  nativeBuildInputs = [
    pkg-config
    cmake
+    wrapQtAppsHook
  ];

-  meta = with lib; {
+  meta = {
    description = "Webcam Capture Software";
    longDescription = "Webcamoid is a full featured and multiplatform webcam suite.";
    homepage = "https://github.com/webcamoid/webcamoid/";
-    license = [ licenses.gpl3Plus ];
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ robaca ];
+    license = with lib.licenses; [ gpl3Plus ];
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ robaca ];
    mainProgram = "webcamoid";
  };
 }
@@ -233,3 +233,4 @@ CONFIG_NFT_SYNPROXY=y
 CONFIG_NFT_TPROXY=y
 CONFIG_NFT_TUNNEL=y
 CONFIG_NFT_XFRM=y
+CONFIG_BRIDGE=y
@@ -8,13 +8,13 @@

 mkHyprlandPlugin hyprland {
  pluginName = "hyprspace";
-  version = "0-unstable-2025-01-18";
+  version = "0-unstable-2025-02-08";

  src = fetchFromGitHub {
    owner = "KZDKM";
    repo = "hyprspace";
-    rev = "1b5865f4ac9a04ba614df50de7acfaa40dcb852f";
-    hash = "sha256-YQgW4QifYIcNaFF4nMw0LpllXn0rhk/Yb6cwyH3PB9o=";
+    rev = "ac55bbdb6cee760af9315899b5b187a40ce43e46";
+    hash = "sha256-t/KaeHEgzh225HUdAiHXRsgDeyDrBCMTg0LjR73v3Nw=";
  };

  dontUseCmakeConfigure = true;
@@ -36,6 +36,5 @@ mkHyprlandPlugin hyprland {
    license = lib.licenses.gpl2Only;
    platforms = lib.platforms.linux;
    maintainers = with lib.maintainers; [ donovanglover ];
-    broken = true; # Doesn't work on Hyprland v0.47.0+
  };
 }
@@ -172,6 +172,7 @@ let
        znver2         = versionAtLeast ccVersion "9.0";
        znver3         = versionAtLeast ccVersion "11.0";
        znver4         = versionAtLeast ccVersion "13.0";
+        znver5         = versionAtLeast ccVersion "14.0";
      }.${arch} or true
    else if isClang then
      { #Generic
@@ -193,6 +194,7 @@ let
        znver2         = versionAtLeast ccVersion "9.0";
        znver3         = versionAtLeast ccVersion "12.0";
        znver4         = versionAtLeast ccVersion "16.0";
+        znver5         = versionAtLeast ccVersion "19.1";
      }.${arch} or true
    else
      false;
@@ -6,13 +6,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "acr";
-  version = "2.1.4";
+  version = "2.2.0";

  src = fetchFromGitHub {
    owner = "radareorg";
    repo = "acr";
    rev = finalAttrs.version;
-    hash = "sha256-RPqbL21gxM66Wjov0QVuiFJNAfia+xxF53fNdksU5fQ=";
+    hash = "sha256-GgF2sen7RcnuXrtLzkeGllMvY65LffR+jPPqUhbsOGk=";
  };

  preConfigure = ''
@@ -15,7 +15,7 @@

 python3Packages.buildPythonApplication rec {
  pname = "addwater";
-  version = "1.2.2";
+  version = "1.2.5";
  # built with meson, not a python format
  pyproject = false;

@@ -23,7 +23,7 @@ python3Packages.buildPythonApplication rec {
    owner = "largestgithubuseronearth";
    repo = "addwater";
    tag = "v${version}";
-    hash = "sha256-BpV4nJbJNMI0Nzzsl1NbsWTNRMFRBSrUF1+Qdd7h6eg=";
+    hash = "sha256-Klz7FYlvkiokoISXsVvyWGKWR/MVhpj4OjQQhvPzju4=";
  };

  buildInputs = [
@@ -12,13 +12,13 @@

 stdenv.mkDerivation rec {
  pname = "aerospike-server";
-  version = "8.0.0.1";
+  version = "8.0.0.2";

  src = fetchFromGitHub {
    owner = "aerospike";
    repo = "aerospike-server";
    rev = version;
-    hash = "sha256-uVHi1/cT/3Rr/r3JudA09d3TMaTPYjc0ZpvTlz4m8aU=";
+    hash = "sha256-Wto0C4q/x0VD9kHSOFuquh/vXC7pSEBFqpZJxRAa2Cg=";
    fetchSubmodules = true;
  };

@@ -9,13 +9,13 @@
 }:
 stdenv.mkDerivation {
  pname = "airwindows";
-  version = "0-unstable-2025-01-06";
+  version = "0-unstable-2025-02-02";

  src = fetchFromGitHub {
    owner = "airwindows";
    repo = "airwindows";
-    rev = "0ca33035253b9fc0c6c876592d9e5ff3a654cd10";
-    hash = "sha256-+AyB6y179BRWTvflA9Ld5utpF2scSJDszkGa8BCvPdM=";
+    rev = "14f348fe83cfd42a6402856d3d15a1866b157996";
+    hash = "sha256-IHOEpVykX1416wQBqymFgYHA8AnNH9mfUU53IkVVs6Y=";
  };

  # we patch helpers because honestly im spooked out by where those variables
@@ -5,11 +5,11 @@

 stdenv.mkDerivation rec {
  pname = "alfaview";
-  version = "9.19.0";
+  version = "9.20.0";

  src = fetchurl {
    url = "https://assets.alfaview.com/stable/linux/deb/${pname}_${version}.deb";
-    hash = "sha256-o0sB+JLwemUNRflp8cR0exc5QvCkpxIAVd/g4vwix6Q=";
+    hash = "sha256-CnD75PTi5pfkS+F8a3sf+J3zz5Ro/8m2Z4GINTvQV6k=";
  };

  nativeBuildInputs = [
@@ -78,13 +78,13 @@ let
 in
 stdenv.mkDerivation {
  pname = "ansel";
-  version = "0-unstable-2025-01-12";
+  version = "0-unstable-2025-02-06";

  src = fetchFromGitHub {
    owner = "aurelienpierreeng";
    repo = "ansel";
-    rev = "c15d92ab7236e61454aaf8e8591777adfa3a73f7";
-    hash = "sha256-FVb4xoHIs+DJG6Lw6Qf755Tjt0Sg9i+Hp979/GgD3IQ=";
+    rev = "701595ea91c366572c1ebefdd0464c94bd588d99";
+    hash = "sha256-139YRDTuw4JGM1+EkWuskojNQzRvPequTl/LcUM+AW4=";
    fetchSubmodules = true;
  };

@@ -17,13 +17,13 @@
 }:
 rustPlatform.buildRustPackage rec {
  pname = "asusctl";
-  version = "6.1.0";
+  version = "6.1.1";

  src = fetchFromGitLab {
    owner = "asus-linux";
    repo = "asusctl";
    rev = version;
-    hash = "sha256-EedOSStqZ2Q8PUJ+0mgIC2+MbiO19VUVDoVvWkkQscc=";
+    hash = "sha256-E2c4KhwLGAgorq4cHdPt/j45ebL0k+A/ktkXh71utxA=";
  };

  useFetchCargoVendor = true;
@@ -88,6 +88,9 @@ rustPlatform.buildRustPackage rec {

  postInstall = ''
    make prefix=$out install-data
+
+    patchelf $out/bin/rog-control-center \
+      --add-needed ${lib.getLib libxkbcommon}/lib/libxkbcommon.so.0
  '';

  meta = with lib; {
@@ -10,16 +10,16 @@

 buildGoModule rec {
  pname = "aws-nuke";
-  version = "3.44.0";
+  version = "3.47.1";

  src = fetchFromGitHub {
    owner = "ekristen";
    repo = "aws-nuke";
    tag = "v${version}";
-    hash = "sha256-cYKVKJWIX3MqjN4LzNjBuvdsUSxF63L5MaFxW9gzyQQ=";
+    hash = "sha256-5vOCfLHW2TLx9t1hado3+JqvRaPqJOR5ZaQP2x1Xcl8=";
  };

-  vendorHash = "sha256-NPp6ivngNX0cQCUx4ZEP29t3+uuy5o1z0KcA65YUZ9k=";
+  vendorHash = "sha256-811gUe7L/1Y5HTRgywjzBe7b9VjWt6GjbuyBOORaOCI=";

  overrideModAttrs = _: {
    preBuild = ''
@@ -195,6 +195,11 @@ let
        overrideAzureMgmtPackage super.azure-mgmt-rdbms "10.2.0b17" "tar.gz"
          "sha256-1nnRkyr4Im79B7DDqGz/FOrPAToFaGhE+a7r5bZMuOQ=";

+      # ModuleNotFoundError: No module named 'azure.mgmt.redhatopenshift.v2023_11_22'
+      azure-mgmt-redhatopenshift =
+        overrideAzureMgmtPackage super.azure-mgmt-redhatopenshift "1.5.0" "tar.gz"
+          "sha256-Uft0KcOciKzJ+ic9n4nxkwNSBmKZam19jhEiqY9fJSc=";
+
      # ImportError: cannot import name 'IPRule' from 'azure.mgmt.signalr.models'
      azure-mgmt-signalr =
        overrideAzureMgmtPackage super.azure-mgmt-signalr "2.0.0b2" "tar.gz"
@@ -25,17 +25,17 @@ in

 rustPlatform.buildRustPackage rec {
  pname = "bacon";
-  version = "3.9.1";
+  version = "3.10.0";

  src = fetchFromGitHub {
    owner = "Canop";
    repo = "bacon";
    tag = "v${version}";
-    hash = "sha256-TniEPcY3mK5LO9CBXi5kgnUQkOeDwF9n1K0kSn4ucKk=";
+    hash = "sha256-FU7hIMAJIXD/pJ9FZSPkO1CQhmmSWwaewGyogGdZoeI=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-6vR8Bxv/A6do4+oGAI0kx1yUyht7YOi1pP/mnIiBPmc=";
+  cargoHash = "sha256-+lk4YrJ7zI6t24y76kODfUok5Ibu3fFxpLIUQZQqgcw=";

  buildFeatures = lib.optionals withSound [
    "sound"
@@ -7,7 +7,7 @@
  ninja,
  pkg-config,
  wrapGAppsHook3,
-  boost,
+  boost186,
  cereal,
  cgal,
  curl,
@@ -74,7 +74,7 @@ stdenv.mkDerivation rec {

  buildInputs = [
    binutils
-    boost
+    boost186
    cereal
    cgal
    curl
@@ -16,16 +16,16 @@

 buildNpmPackage rec {
  pname = "basedpyright";
-  version = "1.26.0";
+  version = "1.27.0";

  src = fetchFromGitHub {
    owner = "detachhead";
    repo = "basedpyright";
    tag = "v${version}";
-    hash = "sha256-USGndOqosE6+gkCow7UeqEd37R4gYo5om1QEV7iz77g=";
+    hash = "sha256-2lQ/uOojY/u43Yf/rqLdzTn4fs8/HHxztH5ua7fOXsk=";
  };

-  npmDepsHash = "sha256-lpAsDMa3yRtbORmycDh3nGpozmzHej4WORvEml/+buE=";
+  npmDepsHash = "sha256-4EFl0hOI6DcpzcSedanQBOrNbHTxR0G7C8L4+7EnESE=";
  npmWorkspace = "packages/pyright";

  preBuild = ''
@@ -29,23 +29,15 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "bcachefs-tools";
-  version = "1.13.0";
+  version = "1.20.0";

  src = fetchFromGitHub {
    owner = "koverstreet";
    repo = "bcachefs-tools";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-w55Fs1RZ4c55vTvb3jArPcmBLij1nuLi2MUHMMXPhng=";
+    hash = "sha256-WZmT8qYLQBp0lftm4T6BU92xffGmhniQNP7TI5pl4Y8=";
  };

-  patches = [
-    # backport patch to fix build with latest liburcu
-    (fetchpatch {
-      url = "https://github.com/koverstreet/bcachefs-tools/commit/634c812a1ed05de8e3d1dc146eed95b942e1e38d.patch";
-      hash = "sha256-AL+nflQHKIwzI35NXZG2rniNjUfgLmv3osHHdpB1cGs=";
-    })
-  ];
-
  nativeBuildInputs = [
    pkg-config
    cargo
@@ -10,13 +10,13 @@

 flutter324.buildFlutterApplication rec {
  pname = "bloomeetunes";
-  version = "2.10.13";
+  version = "2.10.14";

  src = fetchFromGitHub {
    owner = "HemantKArya";
    repo = "BloomeeTunes";
-    tag = "v${version}+157";
-    hash = "sha256-cLhcuk4rLHFg3al+MkZnOWMG8n6r61idBSmDyP6ez+g=";
+    tag = "v${version}+161";
+    hash = "sha256-Cj4NfWEIEYTNAdb6CunA7ExTebK89OlHvZx9n853eHI=";
  };

  pubspecLock = lib.importJSON ./pubspec.lock.json;
@@ -9,17 +9,18 @@
  libcap,
  libnl,
  nixosTests,
+  unstableGitUpdater,
 }:

 stdenv.mkDerivation rec {
  pname = "bpftune";
-  version = "0-unstable-2024-10-25";
+  version = "0-unstable-2025-01-17";

  src = fetchFromGitHub {
    owner = "oracle";
    repo = "bpftune";
-    rev = "6a50f5ff619caeea6f04d889e3a60de6c12feb76";
-    hash = "sha256-yol6VFelqQiPKLg1UUeP+r/+XO4fjYeDbIeI29gZ7j4=";
+    rev = "3c6ce4fc0c963610b7bada0ad6bac31c43eaab2e";
+    hash = "sha256-0f9cbJgZqGlatMSCKjNsT1NniyrteRANHR1Fj8o4J0c=";
  };

  postPatch = ''
@@ -59,8 +60,11 @@ stdenv.mkDerivation rec {
    "zerocallusedregs"
  ];

-  passthru.tests = {
-    inherit (nixosTests) bpftune;
+  passthru = {
+    tests = {
+      inherit (nixosTests) bpftune;
+    };
+    updateScript = unstableGitUpdater { };
  };

  enableParallelBuilding = true;
@@ -15,14 +15,14 @@ let
    "cli"
    "desktop"
  ];
-  version = "0.44.1";
+  version = "0.45.1";
  cli = fetchurl {
    url = "https://caido.download/releases/v${version}/caido-cli-v${version}-linux-x86_64.tar.gz";
-    hash = "sha256-h8pqR74UcFp9eYiDB6+xck4uUs8qh/yE3LBuoUzmchs=";
+    hash = "sha256-tudXyf9wwWABMGwfsxaLJtkZPKImlgjzfJJYFtimQOE=";
  };
  desktop = fetchurl {
    url = "https://caido.download/releases/v${version}/caido-desktop-v${version}-linux-x86_64.AppImage";
-    hash = "sha256-GKhjTTPXtZ7jMFdKKDUsT1pZsj2+Kmn3Au++sAsV6U8=";
+    hash = "sha256-meNB1KCtxApsP95476ggL2gbCxu2fdold6BQ2dlZqFc=";
  };
  appimageContents = appimageTools.extractType2 {
    inherit pname version;
@@ -16,17 +16,17 @@ let
 in
 rustPlatform.buildRustPackage rec {
  pname = "cargo-leptos";
-  version = "0.2.26";
+  version = "0.2.27";

  src = fetchFromGitHub {
    owner = "leptos-rs";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-v1gNH3pq5db/swsk79nEzgtR4jy3f/xHs4QaLnVcVYU=";
+    hash = "sha256-1aknYwxHpMJmieg0HGu6E+uAUH01l6qZvbZsVK+cP34=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-fyOlMagXrpfMsaLffeXolTgMldN9u6RQ08Zak9MdC4U=";
+  cargoHash = "sha256-dTyPY0kUXh7PZ4kEPGX/DilN9tAV8RT2luRG3xiJK+o=";

  buildInputs = optionals isDarwin [
    SystemConfiguration
@@ -10,10 +10,10 @@

 let
  pname = "chatzone-desktop";
-  version = "5.2.3";
+  version = "5.2.4";
  src = fetchurl {
-    url = "https://cdn1.ozone.ru/s3/chatzone-clients/ci/5.2.3/466/chatzone-desktop-linux-5.2.3.AppImage";
-    hash = "sha256-/1xAMtw1SgYge4b9RngBFQjb+rOUkvOalZPC+GtnvSA=";
+    url = "https://cdn1.ozone.ru/s3/chatzone-clients/ci/v5.2.4/506/chatzone-desktop-linux-5.2.4.AppImage";
+    hash = "sha256-sd648wMCVYq5fpL4Ws9/fN4+ArqmsAIgY67a+AoFi8E=";
  };
  appimageContents = appimageTools.extract { inherit pname version src; };
 in
@@ -136,7 +136,6 @@ stdenvNoCC.mkDerivation {

    mkdir -p $out/bin
    ln -s ${fhs-env}/bin/${fhs-env.name} $out/bin/packettracer8
-    ln -s ${fhs-env}/usr $out/usr

    runHook postInstall
  '';
@@ -8,17 +8,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "clorinde";
-  version = "0.11.3";
+  version = "0.11.4";

  src = fetchFromGitHub {
    owner = "halcyonnouveau";
    repo = "clorinde";
    tag = "clorinde-v${version}";
-    hash = "sha256-03lKEAPJTxIXLNF2jVuD6DHJDqTkqCt1Vc+A1/E1CP4=";
+    hash = "sha256-p91LgbRj2+acOrmNuupIR92Z5aOJnTobVDd7A6ezrHk=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-a/MH1jG3w7zgUQnlLRtZyn+MM7vdlydq/u4XSGPGgSA=";
+  cargoHash = "sha256-Vo7Ho+48QJEeAm+eLTCvB/4Q6/YoE0KbbfvdC2WictY=";

  cargoBuildFlags = [ "--package=clorinde" ];

@@ -42,6 +42,11 @@ stdenv.mkDerivation rec {
    ./dont-call-setgroups-unconditionally.patch
  ];

+  configureFlags = [
+    # don't install examples due to broken symlinks
+    "--examplesdir=.."
+  ];
+
  # Workaround build failure on -fno-common toolchains like upstream
  # gcc-10. Otherwise build fails as:
  #   ld: ...-libprom-0.1.1/include/prom_collector_registry.h:37: multiple definition of
@@ -12,17 +12,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "couchbase-shell";
-  version = "1.0.0";
+  version = "1.1.0";

  src = fetchFromGitHub {
    owner = "couchbaselabs";
    repo = "couchbase-shell";
    rev = "v${version}";
-    hash = "sha256-ksAyi7yMz56de1lA2LYVNdsn02GNrcJVoRLcK1zFppE=";
+    hash = "sha256-wqOU94rPqIO128uL9iyVzWcAgqnDUPUy1+Qq1hSkvHA=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-8AnnZNXp/D8lUCohgrLzqJ+7gwucC3OBh1TK3dYKp4Y=";
+  cargoHash = "sha256-tlVOro9u4ypgJ5yqjEzjfvrGXVCYe6DN6bg/3NhipR4=";

  nativeBuildInputs = [
    pkg-config
@@ -6,11 +6,11 @@

 let
  pname = "cozydrive";
-  version = "3.41.0";
+  version = "3.42.0";

  src = fetchurl {
    url = "https://github.com/cozy-labs/cozy-desktop/releases/download/v${version}/Cozy-Drive-${version}-x86_64.AppImage";
-    sha256 = "sha256-cNjr6QpzugVSSS1QrL+KwU5V0KAcupezZZIIQuHBIC8=";
+    sha256 = "sha256-1MsRxLp+IZAoj9yqo5n0N1kfRYmYR2tjIjnlbRPrKH4=";
  };
  appimageContents = appimageTools.extract { inherit pname version src; };

@@ -12,18 +12,18 @@ let
 in
 flutter.buildFlutterApplication rec {
  pname = "cwtch-ui";
-  version = "1.15.1";
+  version = "1.15.4";
  # This Gitea instance has archive downloads disabled, so: fetchgit
  src = fetchgit {
    url = "https://git.openprivacy.ca/cwtch.im/cwtch-ui";
    rev = "v${version}";
-    hash = "sha256-+UtWhQMhm0UjY0kx3B5TwcBFhUfJma3rpeYls4XWy7I=";
+    hash = "sha256-Ee6LKqh4Xe+93noJktCGQyW1YLxSXgVKh6YoG0xebBc=";
  };

  # NOTE: The included pubspec.json does not exactly match the upstream
  # pubspec.lock. With Flutter 3.24, a newer version of material_color_utilities
  # is required than the upstream locked version. From a checkout of cwtch-ui
-  # 1.15.1, I ran `flutter pub upgrade material_color_utilities` on 2024-10-17.
+  # 1.15.4, I ran `flutter pub upgrade material_color_utilities` on 2024-12-15.
  # This upgraded material_color_utilities and its dependencies.
  pubspecLock = lib.importJSON ./pubspec.json;
  gitHashes = {
@@ -238,6 +238,16 @@
      "source": "hosted",
      "version": "3.1.1"
    },
+    "coverage": {
+      "dependency": "transitive",
+      "description": {
+        "name": "coverage",
+        "sha256": "c1fb2dce3c0085f39dc72668e85f8e0210ec7de05345821ff58530567df345a5",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "1.9.2"
+    },
    "crypto": {
      "dependency": "direct main",
      "description": {
@@ -651,6 +661,16 @@
      "source": "hosted",
      "version": "1.0.0"
    },
+    "node_preamble": {
+      "dependency": "transitive",
+      "description": {
+        "name": "node_preamble",
+        "sha256": "6e7eac89047ab8a8d26cf16127b5ed26de65209847630400f9aefd7cd5c730db",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.0.2"
+    },
    "package_config": {
      "dependency": "transitive",
      "description": {
@@ -881,15 +901,35 @@
      "source": "hosted",
      "version": "1.4.1"
    },
+    "shelf_packages_handler": {
+      "dependency": "transitive",
+      "description": {
+        "name": "shelf_packages_handler",
+        "sha256": "89f967eca29607c933ba9571d838be31d67f53f6e4ee15147d5dc2934fee1b1e",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "3.0.2"
+    },
+    "shelf_static": {
+      "dependency": "transitive",
+      "description": {
+        "name": "shelf_static",
+        "sha256": "c87c3875f91262785dade62d135760c2c69cb217ac759485334c5857ad89f6e3",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "1.1.3"
+    },
    "shelf_web_socket": {
      "dependency": "transitive",
      "description": {
        "name": "shelf_web_socket",
-        "sha256": "073c147238594ecd0d193f3456a5fe91c4b0abbcc68bf5cd95b36c4e194ac611",
+        "sha256": "9ca081be41c60190ebcb4766b2486a7d50261db7bd0f5d9615f2d653637a84c1",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "2.0.0"
+      "version": "1.0.4"
    },
    "sky_engine": {
      "dependency": "transitive",
@@ -907,6 +947,26 @@
      "source": "hosted",
      "version": "1.5.0"
    },
+    "source_map_stack_trace": {
+      "dependency": "transitive",
+      "description": {
+        "name": "source_map_stack_trace",
+        "sha256": "c0713a43e323c3302c2abe2a1cc89aa057a387101ebd280371d6a6c9fa68516b",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.1.2"
+    },
+    "source_maps": {
+      "dependency": "transitive",
+      "description": {
+        "name": "source_maps",
+        "sha256": "708b3f6b97248e5781f493b765c3337db11c5d2c81c3094f10904bfa8004c703",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "0.10.12"
+    },
    "source_span": {
      "dependency": "transitive",
      "description": {
@@ -977,6 +1037,16 @@
      "source": "hosted",
      "version": "1.2.1"
    },
+    "test": {
+      "dependency": "direct dev",
+      "description": {
+        "name": "test",
+        "sha256": "7ee44229615f8f642b68120165ae4c2a75fe77ae2065b1e55ae4711f6cf0899e",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "1.25.7"
+    },
    "test_api": {
      "dependency": "transitive",
      "description": {
@@ -987,6 +1057,16 @@
      "source": "hosted",
      "version": "0.7.2"
    },
+    "test_core": {
+      "dependency": "transitive",
+      "description": {
+        "name": "test_core",
+        "sha256": "55ea5a652e38a1dfb32943a7973f3681a60f872f8c3a05a14664ad54ef9c6696",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "0.6.4"
+    },
    "timezone": {
      "dependency": "transitive",
      "description": {
@@ -1147,25 +1227,15 @@
      "source": "hosted",
      "version": "0.5.1"
    },
-    "web_socket": {
-      "dependency": "transitive",
-      "description": {
-        "name": "web_socket",
-        "sha256": "24301d8c293ce6fe327ffe6f59d8fd8834735f0ec36e4fd383ec7ff8a64aa078",
-        "url": "https://pub.dev"
-      },
-      "source": "hosted",
-      "version": "0.1.5"
-    },
    "web_socket_channel": {
      "dependency": "transitive",
      "description": {
        "name": "web_socket_channel",
-        "sha256": "a2d56211ee4d35d9b344d9d4ce60f362e4f5d1aafb988302906bd732bc731276",
+        "sha256": "58c6666b342a38816b2e7e50ed0f1e261959630becd4c879c4f26bfa14aa5a42",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "3.0.0"
+      "version": "2.4.5"
    },
    "webdriver": {
      "dependency": "transitive",
@@ -1177,6 +1247,16 @@
      "source": "hosted",
      "version": "3.0.3"
    },
+    "webkit_inspection_protocol": {
+      "dependency": "transitive",
+      "description": {
+        "name": "webkit_inspection_protocol",
+        "sha256": "87d3f2333bb240704cd3f1c6b5b7acd8a10e7f0bc28c28dcf14e782014f4a572",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "1.2.1"
+    },
    "win32": {
      "dependency": "transitive",
      "description": {
@@ -5,15 +5,15 @@
 }:
 buildGoModule rec {
  pname = "libcwtch";
-  version = "0.1.3";
+  version = "0.1.5";
  # This Gitea instance has archive downloads disabled, so: fetchgit
  src = fetchgit {
    url = "https://git.openprivacy.ca/cwtch.im/autobindings.git";
    rev = "v${version}";
-    hash = "sha256-Gp6JnyjKChB7w0fUHkreu81QRXQ3YdMb2ReD/VCkVOE=";
+    hash = "sha256-SeMpL/ncDh4DgYYeikHiwRIF/RKsrOhRzPAePXglvqM=";
  };

-  vendorHash = "sha256-UgG/yjupUFrfjPZ4E+OM1VsWi9MuMuHxcZ4yvz+q/Y0=";
+  vendorHash = "sha256-ZgysF9ZYbuUdaxUiNAJ44JAeFKjBpOQ1DMXhO2RV7zc=";
  overrideModAttrs = (
    old: {
      preBuild = ''
@@ -30,14 +30,15 @@ buildGoModule rec {

  buildPhase = ''
    runHook preBuild
-    make linux
+    make libCwtch.so
    runHook postBuild
  '';

  installPhase = ''
    runHook preInstall
    install -D build/linux/libCwtch.h -t $out/include
-    install -D build/linux/libCwtch.*.so $out/lib/libCwtch.so
+    # * will match either "amd64" or "arm64" depending on the platform.
+    install -D build/linux/*/libCwtch.so $out/lib/libCwtch.so
    runHook postInstall
  '';

@@ -29,16 +29,18 @@
  libsysprof-capture,
  lerc,
  doxygen,
+  writableTmpDirAsHomeHook,
 }:
+
 stdenv.mkDerivation rec {
  pname = "deskflow";
-  version = "1.18.0";
+  version = "1.19.0";

  src = fetchFromGitHub {
    owner = "deskflow";
    repo = "deskflow";
    tag = "v${version}";
-    hash = "sha256-FdpDaJ+pphy2+8prlKst0DjmdbcZOmNp+lKN5xdnvC8=";
+    hash = "sha256-Jj2BNqz4pIJ468pywJRKu6GjgGX31GZZtDLHgcvC3JE=";
  };

  postPatch = ''
@@ -95,11 +97,12 @@ stdenv.mkDerivation rec {

  doCheck = true;

+  nativeCheckInputs = [ writableTmpDirAsHomeHook ];
+
  checkPhase = ''
    runHook preCheck

    export QT_QPA_PLATFORM=offscreen
-    export HOME=$(mktemp -d)
    ./bin/unittests
    ./bin/integtests

@@ -7,13 +7,13 @@

 stdenv.mkDerivation rec {
  pname = "dool";
-  version = "1.3.3";
+  version = "1.3.4";

  src = fetchFromGitHub {
    owner = "scottchiefbaker";
    repo = "dool";
    rev = "v${version}";
-    hash = "sha256-VII8Om43YILP3w0CsiKKdJDuK2Lc1rit2EY+eAArvng=";
+    hash = "sha256-eyWt8gWPGiU8YavX8KT018upSB6xg8eAyRZ84snrvoY=";
  };

  buildInputs = [
@@ -8,7 +8,7 @@

 let
  themeName = "Dracula";
-  version = "4.0.0-unstable-2025-01-10";
+  version = "4.0.0-unstable-2025-02-05";
 in
 stdenvNoCC.mkDerivation {
  pname = "dracula-theme";
@@ -17,8 +17,8 @@ stdenvNoCC.mkDerivation {
  src = fetchFromGitHub {
    owner = "dracula";
    repo = "gtk";
-    rev = "79235b53c33f02d826d76cf991f5aa8f04ed4e76";
-    hash = "sha256-glcDK0zUSYRU3SOrjxDUI170Ky995Js24DPxmL1rSPA=";
+    rev = "c2210b503b6acf7948218ea99c6b472744b345b5";
+    hash = "sha256-b6OMY++9UdK+jb7cAr+9+Fyy9ARYcIA/27UHRSIVu0g=";
  };

  propagatedUserEnvPkgs = [
@@ -2,7 +2,9 @@
  lib,
  stdenv,
  fetchFromGitHub,
+  libbsd,
  libgcrypt,
+  xxHash,
  pkg-config,
  glib,
  linuxHeaders ? stdenv.cc.libc.linuxHeaders,
@@ -14,13 +16,13 @@

 stdenv.mkDerivation rec {
  pname = "duperemove";
-  version = "0.14.1";
+  version = "0.15";

  src = fetchFromGitHub {
    owner = "markfasheh";
    repo = "duperemove";
    rev = "v${version}";
-    hash = "sha256-iMv80UKktYOhNfVA3mW6kKv8TwLZaP6MQt24t3Rchk4=";
+    hash = "sha256-m89e7ewda4+TNemoXG/9dG7HI9xHmsqVfMIFg5Ft2YM=";
  };

  postPatch = ''
@@ -30,11 +32,13 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [ pkg-config ];
  buildInputs = [
+    libbsd
    libgcrypt
    glib
    linuxHeaders
    sqlite
    util-linux
+    xxHash
  ];

  makeFlags = [
@@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "amazon-ecs-agent";
-  version = "1.89.2";
+  version = "1.89.3";

  src = fetchFromGitHub {
    rev = "v${version}";
    owner = "aws";
    repo = pname;
-    hash = "sha256-Uld8WSN36byx0eDHsdEGVdiV0LFIPomc2eChn1wYC9w=";
+    hash = "sha256-zhltYmhISAbxYL+oeJLoxd5OaFjAoTJHAJWuIaBPYZs=";
  };

  vendorHash = null;
@@ -10,16 +10,16 @@

 buildGoModule rec {
  pname = "ejson2env";
-  version = "2.0.6";
+  version = "2.0.7";

  src = fetchFromGitHub {
    owner = "Shopify";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-VXkWmmX+4D+j9ODSEeJJbIx+Bfni9d2X22BFQIe4kwk=";
+    sha256 = "sha256-9i84nHIuAR7PG6/v8O5GEi6xToJk0c+knpVPOPx+1b8=";
  };

-  vendorHash = "sha256-7oy8bCegsvv35zyo2aTFMSGZMFkArmxy0rOpK6WlubI=";
+  vendorHash = "sha256-NirIAwmrUH7ny1H7d63bIrFQ8EWuxjh6Qp66Sw8eMO8=";

  ldflags = [
    "-s"
@@ -23,13 +23,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "equibop";
-  version = "2.1.1";
+  version = "2.1.2";

  src = fetchFromGitHub {
    owner = "Equicord";
    repo = "Equibop";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-LGgmWaC7iYj0Mx5wPKmLkYV2ozyhkiwrE4v4uFB0erg=";
+    hash = "sha256-lDDGZUpW9LU5S/gzNJFIuVIk08pQlQLK07RwuzcYyjg=";
  };

  pnpmDeps = pnpm_9.fetchDeps {
@@ -39,7 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
      src
      patches
      ;
-    hash = "sha256-dIz/HyhzFU86QqQEQ9qWSthKB9HfoRJbmpc3raWNbcA=";
+    hash = "sha256-MuCQJgUHyAKpKWM7lYE49zur+G+KtIVBVXCspWImnY8=";
  };

  nativeBuildInputs = [
@@ -8,11 +8,11 @@

 stdenvNoCC.mkDerivation rec {
  pname = "flix";
-  version = "0.56.0";
+  version = "0.57.0";

  src = fetchurl {
    url = "https://github.com/flix/flix/releases/download/v${version}/flix.jar";
-    sha256 = "sha256-1xrfJesagHlN7Kur/ZeaYxqDVmFK+DaJ9ELmPfrQEVo=";
+    sha256 = "sha256-8qiNh8a6fwKkCeTGda/rBVWFSbYJsLRg27CxQsuL9Mo=";
  };

  dontUnpack = true;
@@ -3,25 +3,25 @@
  rustPlatform,
  fetchFromGitHub,
  autoPatchelfHook,
-  stdenv,
  openssl,
  dbus,
  pkg-config,
  libgcc,
+  nix-update-script,
 }:
 rustPlatform.buildRustPackage rec {
  pname = "fum";
-  version = "0.6.4";
+  version = "0.9.17";

  src = fetchFromGitHub {
    owner = "qxb3";
    repo = "fum";
    tag = "v${version}";
-    hash = "sha256-vBn76s2ewLVVYhyXviQUmq+AzH6FSVdJaTEJQ2EPlM0=";
+    hash = "sha256-E9Z8bs5bdNcXHRJIkzcISIz8R1wnZu8sO6tXQp+5bpQ=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-7h/KIAIxldXPXUo0lzuBqs6Uf5S5p39yV+kTfLe/LBo=";
+  cargoHash = "sha256-yrDukkbbXqS2iAdtY4WZS6VkqSbyeBXWkn2Od4+mWLw=";

  nativeBuildInputs = [
    autoPatchelfHook
@@ -36,9 +36,12 @@ rustPlatform.buildRustPackage rec {

  doCheck = false;

+  passthru.updateScript = nix-update-script { };
+
  meta = {
    description = "Fully ricable tui-based music client";
    homepage = "https://github.com/qxb3/fum";
+    changelog = "https://github.com/qxb3/fum/releases/tag/v${version}";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ linuxmobile ];
    platforms = lib.platforms.linux;
@@ -8,6 +8,7 @@
 let
  inherit (python3Packages)
    buildPythonApplication
+    setuptools
    gitpython
    manim
    opencv4
@@ -35,7 +36,7 @@ buildPythonApplication {

  patches = [ ./tests.patch ];

-  build-system = [ ];
+  build-system = [ setuptools ];

  pythonRemoveDeps = [ "opencv-python-headless" ];

@@ -6,14 +6,14 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "gitxray";
-  version = "1.0.17";
+  version = "1.0.17.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "kulkansecurity";
    repo = "gitxray";
    tag = version;
-    hash = "sha256-wPqjCIHYvU1QuQIXCrbzr8+JtwQmFNHzAjxr8AXkxrc=";
+    hash = "sha256-T4s7mgfZs2RIq/iLXT0WBbVhdY8JhEyTJ2CmUycifRc=";
  };

  build-system = with python3.pkgs; [ setuptools ];
@@ -25,7 +25,7 @@ python3.pkgs.buildPythonApplication rec {
  meta = {
    description = "Tool which leverages Public GitHub REST APIs for various tasks";
    homepage = "https://github.com/kulkansecurity/gitxray";
-    changelog = "https://github.com/kulkansecurity/gitxray/blob/${src.rev}/CHANGELOG.md";
+    changelog = "https://github.com/kulkansecurity/gitxray/blob/${src.tag}/CHANGELOG.md";
    license = lib.licenses.agpl3Only;
    maintainers = with lib.maintainers; [ fab ];
    mainProgram = "gitxray";
@@ -29,12 +29,12 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "glamoroustoolkit";
-  version = "1.1.11";
+  version = "1.1.13";

  src = fetchzip {
    url = "https://github.com/feenkcom/gtoolkit-vm/releases/download/v${finalAttrs.version}/GlamorousToolkit-x86_64-unknown-linux-gnu.zip";
    stripRoot = false;
-    hash = "sha256-bb5tU4UtqdWcSqgl28V8IoATWx4TADxNFXkn9ljmw6Y=";
+    hash = "sha256-2Rr5x7gVwyksJ19t6Ho8UQGbTmv0yvZuZou1FTfHUbE=";
  };

  nativeBuildInputs = [
@@ -1,36 +1,37 @@
 {
-  stdenv,
  lib,
+  stdenv,
  fetchFromGitHub,
-  wrapGAppsHook4,
-  libadwaita,
-  meson,
-  ninja,
-  gettext,
-  gtk4,
+
  appstream,
  appstream-glib,
  desktop-file-utils,
-  gobject-introspection,
-  blueprint-compiler,
-  pkg-config,
-  json-glib,
-  libsoup_3,
+  gettext,
  glib,
+  gobject-introspection,
+  meson,
+  ninja,
+  pkg-config,
+  wrapGAppsHook4,
+
+  blueprint-compiler,
+  gtk4,
+  json-glib,
+  libadwaita,
  libbacktrace,
-  text-engine,
-  fetchpatch,
+  libsoup_3,
+  libxml2,
 }:

 stdenv.mkDerivation rec {
  pname = "gnome-extension-manager";
-  version = "0.5.1";
+  version = "0.6.0";

  src = fetchFromGitHub {
    owner = "mjakeman";
    repo = "extension-manager";
    rev = "v${version}";
-    hash = "sha256-PWpnLtzQDF2Is63CY9bNzYSo+MiA2oxzJi7B4nQZ7v8=";
+    hash = "sha256-AotIzFCx4k7XLdk+2eFyJgrG97KC1wChnSlpLdk90gE=";
  };

  nativeBuildInputs = [
@@ -51,17 +52,9 @@ stdenv.mkDerivation rec {
    gtk4
    json-glib
    libadwaita
-    libsoup_3
    libbacktrace
-    text-engine
-  ];
-
-  patches = [
-    # fix black window when opened, remove in next release
-    (fetchpatch {
-      url = "https://github.com/mjakeman/extension-manager/commit/91d1c42a30e12131dc3c5afd8a709e7db2a95b70.patch";
-      hash = "sha256-NtsJeqclUx4L3wbyQ46ZCoo4IKSu4/HoT/FD20xriZ4=";
-    })
+    libsoup_3
+    libxml2
  ];

  mesonFlags = [
@@ -69,12 +62,12 @@ stdenv.mkDerivation rec {
    (lib.mesonOption "distributor" "nixpkgs")
  ];

-  meta = with lib; {
+  meta = {
    description = "Desktop app for managing GNOME shell extensions";
    homepage = "https://github.com/mjakeman/extension-manager";
-    license = licenses.gpl3Plus;
-    platforms = platforms.linux;
+    license = lib.licenses.gpl3Plus;
+    platforms = lib.platforms.linux;
    mainProgram = "extension-manager";
-    maintainers = with maintainers; [ foo-dogsquared ];
+    maintainers = with lib.maintainers; [ foo-dogsquared ];
  };
 }
@@ -15,11 +15,11 @@

 stdenv.mkDerivation rec {
  pname = "groovy";
-  version = "4.0.24";
+  version = "4.0.25";

  src = fetchurl {
    url = "mirror://apache/groovy/${version}/distribution/apache-groovy-binary-${version}.zip";
-    sha256 = "sha256-2/82g1VovsInGHb3C/zKbeuA4bF5RTzKk0pQLqMBu4A=";
+    sha256 = "sha256-giytjgM4jyO/YT03+ZC4E7tBZf44n9P8wk+LlkdsMO8=";
  };

  nativeBuildInputs = [
@@ -10,16 +10,16 @@

 buildGoModule rec {
  pname = "gtt";
-  version = "9";
+  version = "10";

  src = fetchFromGitHub {
    owner = "eeeXun";
    repo = "gtt";
    rev = "v${version}";
-    hash = "sha256-WDuQ8daKA8Skto4soG9L4ChkYzV18BwVZh+AbyDyXYs=";
+    hash = "sha256-ghdf8UQA+SfsBiD5bPrNZM8sPE+Xhbhn18iNl3xLh8c=";
  };

-  vendorHash = "sha256-5Uwi1apowHoUtvkSgmUV9WbfpVQFTqJ9GA2sRnC5nFw=";
+  vendorHash = "sha256-6C+++HIVwOwOmlsdwXWF/ykyK9WOlq/ktIPjRslvllk=";

  nativeBuildInputs = [
    pkg-config
@@ -36,11 +36,11 @@ buildGoModule rec {
    "-w"
  ];

-  meta = with lib; {
+  meta = {
    description = "Google Translate TUI (Originally). Now support Apertium, Argos, Bing, ChatGPT, DeepL, Google, Reverso";
    homepage = "https://github.com/eeeXun/gtt";
-    license = licenses.mit;
-    maintainers = with maintainers; [ linuxissuper ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ linuxissuper ];
    mainProgram = "gtt";
  };
 }
@@ -8,16 +8,16 @@

 buildGoModule rec {
  pname = "gum";
-  version = "0.15.1";
+  version = "0.15.2";

  src = fetchFromGitHub {
    owner = "charmbracelet";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-5/ifKAKKl4adhTsrfIzViLuYpHyf1W6L0KQXk9EObow=";
+    hash = "sha256-kQDCgQXI9jTUHM8UEfDSLXMoUUMOt0Iccv3P3RtPOIg=";
  };

-  vendorHash = "sha256-H29cyhgC+ZI7CjFTfYb4ekvHfkMfUUzgCDtWXYW6iYM=";
+  vendorHash = "sha256-WxM1gCIsxRWNq9IdBux4BJi6r87wY2/6vtMjEDSQnv0=";

  nativeBuildInputs = [
    installShellFiles
@@ -25,6 +25,7 @@ python3Packages.buildPythonApplication rec {
    "numpy"
    "pyarrow"
    "textual"
+    "syrupy"
  ];

  build-system = with python3Packages; [ poetry-core ];
@@ -15,13 +15,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "hoarder";
-  version = "0.21.0";
+  version = "0.22.0";

  src = fetchFromGitHub {
    owner = "hoarder-app";
    repo = "hoarder";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-3xgpiqq+BV0a/OlcQiGDt59fYNF+zP0+HPeBCRiZj48=";
+    hash = "sha256-SYcJfobuDl2iPXy5qGGG8ukBX/CSboSo/hF2e/8ixVw=";
  };

  patches = [
@@ -56,7 +56,7 @@ stdenv.mkDerivation (finalAttrs: {
      installPhase = "cp -pr --reflink=auto -- . $out";
    };

-    hash = "sha256-U2wrjBhklP7c8S3QQoUtOPTYyJr7MBOwm0R/76FjhqE=";
+    hash = "sha256-4MSNh2lyl0PFUoG29Tmk3WOZSRnW8NBE3xoppJr8ZNY=";
  };
  buildPhase = ''
    runHook preBuild
@@ -11,18 +11,18 @@
 }:
 let
  pname = "homebox";
-  version = "0.16.0";
+  version = "0.17.0";
  src = fetchFromGitHub {
    owner = "sysadminsmedia";
    repo = "homebox";
    rev = "v${version}";
-    hash = "sha256-d8SQWj7S6G1ZemMH6QL9QZuPQfxNRcfCurPaTnS0Iyo=";
+    hash = "sha256-XzO/aJcLGu+ZHt9fDUhUzBbUS9VpChFVOH0cgvYK6kc=";
  };
 in
 buildGo123Module {
  inherit pname version src;

-  vendorHash = "sha256-Ftm5tR3w8S3mjYLJG0+17nYP5kDbaAd8QkbZpNt7WuE=";
+  vendorHash = "sha256-Zo/yI1mNeN0O9gZsHux6aOzBlv72h17s7QNO+MaG2/g=";
  modRoot = "backend";
  # the goModules derivation inherits our buildInputs and buildPhases
  # Since we do pnpm thing in those it fails if we don't explicitely remove them
@@ -38,7 +38,7 @@ buildGo123Module {
  pnpmDeps = pnpm_9.fetchDeps {
    inherit pname version;
    src = "${src}/frontend";
-    hash = "sha256-x7sWSH84UJEXNRLCgEgXc4NrTRsn6OplANi+XGtIN9Y=";
+    hash = "sha256-nbZxCUXgXoaxIiJsB57OZ7YUkD7Njccj6nFkaHBbctw=";
  };
  pnpmRoot = "../frontend";

@@ -5,26 +5,23 @@
  cmake,
  gtest,
  c-ares,
-  curl,
+  curlHTTP3,
  libev,
 }:

 let
-  # https-dns-proxy supports HTTP3 if curl has support, but as of 2022-08 curl doesn't work with that enabled
-  # curl' = (curl.override { http3Support = true; });
-  curl' = curl;
-
+  curl' = curlHTTP3;
 in
 stdenv.mkDerivation rec {
  pname = "https-dns-proxy";
  # there are no stable releases (yet?)
-  version = "unstable-2022-05-05";
+  version = "0-unstable-2024-11-18";

  src = fetchFromGitHub {
    owner = "aarond10";
    repo = "https_dns_proxy";
-    rev = "d310a378795790350703673388821558163944de";
-    hash = "sha256-On4SKUeltPhzM/x+K9aKciKBw5lmVySxnmLi2tnKr3Y=";
+    rev = "484bd153bb85a51df1c5bede1b091be76537e0a7";
+    hash = "sha256-T4l3kQ2hPgmyKE7xzlkDDUD6AQi8dQPJQnw8NhUUhDY=";
  };

  postPatch = ''
@@ -12,16 +12,16 @@

 buildNpmPackage rec {
  pname = "httptoolkit";
-  version = "1.19.0";
+  version = "1.19.4";

  src = fetchFromGitHub {
    owner = "httptoolkit";
    repo = "httptoolkit-desktop";
    tag = "v${version}";
-    hash = "sha256-e+ngBZMwMTvwzY1K7IaxlNoRkZUPDdJvKxvxuCsc9pw=";
+    hash = "sha256-oDwAosyFY4ff9MP82O8q5o+mN/X6+J7hM3b7myfOq7k=";
  };

-  npmDepsHash = "sha256-XgJIs4P1ezCEPPitIIfYpNkX0/3dPdajeIiDwHm7DSU=";
+  npmDepsHash = "sha256-4kREJgw7OjKkOF/J1HpD3uPn+awtQIfUGWqJctwq3N0=";

  env = {
    ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
@@ -12,13 +12,13 @@

 stdenv.mkDerivation rec {
  pname = "ipv6calc";
-  version = "4.2.2";
+  version = "4.3.0";

  src = fetchFromGitHub {
    owner = "pbiering";
    repo = pname;
    rev = version;
-    sha256 = "sha256-Mu9tcx/J58cRRqExlqvQzMIR87wJWX8eDacTVCZ7bNs=";
+    sha256 = "sha256-ObJn7T7dGp6HjICWHWAbJjgHM08FrJx31AxIMmIexuQ=";
  };

  buildInputs = [
@@ -7,13 +7,13 @@

 stdenvNoCC.mkDerivation {
  pname = "jawiki-all-titles-in-ns0";
-  version = "0-unstable-2025-01-01";
+  version = "0-unstable-2025-02-01";

  src = fetchFromGitHub {
    owner = "musjj";
    repo = "jawiki-archive";
-    rev = "dbd1e032f8685387c0dbeb1a472ab9215250d11f";
-    hash = "sha256-2GjbXjsf8OV/9EuX675hBXTWQsf+KhKhh1IiAxbzqfU=";
+    rev = "6cc3e7af84f3809f95bd4340847de3fabccb0a8c";
+    hash = "sha256-nd329TNBABpRb+Z2eMUzNwTToMIDM/2Zt47NYfKyXe0=";
  };

  installPhase = ''
@@ -6,11 +6,11 @@

 let
  pname = "jbrowse";
-  version = "2.18.0";
+  version = "3.0.0";

  src = fetchurl {
    url = "https://github.com/GMOD/jbrowse-components/releases/download/v${version}/jbrowse-desktop-v${version}-linux.AppImage";
-    sha256 = "sha256-1YtINJgOMXwLPT7eyS85ebNCxTF8TbvHU7gOq9qNyF4=";
+    sha256 = "sha256-gg+DR6yjsdWE85nIj5eMjthvlZ3QaeugEugXD2AZeug=";
  };

  appimageContents = appimageTools.extractType2 {
@@ -3,21 +3,21 @@
 }:
 let
  pname = "josm";
-  version = "19277";
+  version = "19307";
  srcs = {
    jar = fetchurl {
      url = "https://josm.openstreetmap.de/download/josm-snapshot-${version}.jar";
-      hash = "sha256-NXf95ANB5Ezgf1CKEbefrIxoyqHgYC/WKNf7+p3D/pY=";
+      hash = "sha256-08dacfJrRbdk8Bj+lDW2s8YuGVvnKdvMQN825lusohk=";
    };
    macosx = fetchurl {
      url = "https://josm.openstreetmap.de/download/macosx/josm-macos-${version}-java21.zip";
-      hash = "sha256-vP7s6kneOOpLUYZ1Un7Zdo8wMZ/fErLaJFxtR/vCvD8=";
+      hash = "sha256-wFLQXGOaRnFDZEDlZwmv8wb3pNJbVxocYVjc8wy1Q10=";
    };
    pkg = fetchFromGitHub {
      owner = "JOSM";
      repo = "josm";
      tag = "${version}-tested";
-      hash = "sha256-3aVMZFYz7J8fkCR4TVmkvsAu2cX7swxiNt12is42nKE=";
+      hash = "sha256-TwheY/9gXbKH36jZLMoV9xIBeq59FpHUUoselaiYGzA=";
    };
  };

@@ -7,15 +7,15 @@

 stdenvNoCC.mkDerivation {
  pname = "jp-zip-code";
-  version = "0-unstable-2025-01-01";
+  version = "0-unstable-2025-02-01";

  # This package uses a mirror as the source because the
  # original provider uses the same URL for updated content.
  src = fetchFromGitHub {
    owner = "musjj";
    repo = "jp-zip-codes";
-    rev = "45aa11f1f60515893b0eb8f533f540632b394564";
-    hash = "sha256-qcP1lc5E1RS+n7e3hmZwaHtnf9ErOYprW+/w0r65ZuI=";
+    rev = "2fdcd4f4c00a90de1dacfe16644bbaadbfd377aa";
+    hash = "sha256-i81TzPrhHE3wZdq/HJGnTsvmo/clWCYO74hJf9hMxs4=";
  };

  installPhase = ''
@@ -2,13 +2,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "jsoncons";
-  version = "1.1.0";
+  version = "1.2.0";

  src = fetchFromGitHub {
    owner = "danielaparker";
    repo = "jsoncons";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-3NG9Jal3+BdcFeWAIq3eFoV+1ywUCsWafe/WNu2VJU8=";
+    hash = "sha256-JGA3mQToTflm+1rLtKLzbX4x84S+6JoEQAQgx5+E278=";
  };

  nativeBuildInputs = [ cmake ];
@@ -33,13 +33,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "justbuild";
-  version = "1.4.2";
+  version = "1.4.3";

  src = fetchFromGitHub {
    owner = "just-buildsystem";
    repo = "justbuild";
    rev = "refs/tags/v${version}";
-    hash = "sha256-oMl+hY7E4vYB4J/5LXq6sw9bafYwhXY8lkEWwU6j0Fk=";
+    hash = "sha256-Hx+MU1W/vwN+hlAAbIieBAmHUw65AGZ10ItBdIG+IEM=";
  };

  bazelapi = fetchurl {
@@ -13,17 +13,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "kanata";
-  version = "1.7.0";
+  version = "1.8.0";

  src = fetchFromGitHub {
    owner = "jtroo";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-cG9so0x0y8CbTxLOxSQwn5vG72KxHJzzTIH4lQA4MvE=";
+    sha256 = "sha256-RTFP063NGNfjlOlZ4wghpcUQEmmj73Xlu3KPIxeUI/I=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-VKvle1hQae+0Vbvd7Epq3cDqG8OV5J2mowF5lue59oc=";
+  cargoHash = "sha256-/r4u7pM7asCvG3LkbuP1Y63WVls1uZtV/L3cSOzUXr4=";

  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ darwin.apple_sdk.frameworks.IOKit ];

@@ -17,13 +17,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "keymapper";
-  version = "4.9.2";
+  version = "4.10.0";

  src = fetchFromGitHub {
    owner = "houmain";
    repo = "keymapper";
    rev = finalAttrs.version;
-    hash = "sha256-8SHFIL0HLzi0UkZ8E+VnLf9pQ/I048/HhVx3eWavt/Y=";
+    hash = "sha256-F6SQMsb4juH9lXA2Hr4CeaOGAlvVssFX5pCrAkn5r3w=";
  };

  # all the following must be in nativeBuildInputs
@@ -16,7 +16,7 @@ let
        src = fetchFromGitHub {
          owner = "collective";
          repo = "icalendar";
-          rev = "refs/tags/v${version}";
+          tag = "v${version}";
          hash = "sha256-2gpWfLXR4HThw23AWxY2rY9oiK6CF3Qiad8DWHCs4Qk=";
        };
        patches = [ ];
@@ -37,10 +37,14 @@ python.pkgs.buildPythonApplication rec {
  src = fetchFromGitHub {
    owner = "pimutils";
    repo = "khal";
-    rev = "refs/tags/v${version}";
+    tag = "v${version}";
    hash = "sha256-YP2kQ/qXPDwvFvlHf+A2Ymvk49dmt5tAnTaOhrOV92M=";
  };

+  postPatch = ''
+    sed -i /intersphinx/d doc/source/conf.py
+  '';
+
  build-system = with python.pkgs; [
    setuptools
    setuptools-scm
@@ -111,11 +115,11 @@ python.pkgs.buildPythonApplication rec {
    "test_event_no_dst"
  ];

-  meta = with lib; {
+  meta = {
    description = "CLI calendar application";
-    homepage = "http://lostpackets.de/khal/";
+    homepage = "https://lostpackets.de/khal/";
    changelog = "https://github.com/pimutils/khal/releases/tag/v${version}";
-    license = licenses.mit;
-    maintainers = with maintainers; [ gebner ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ gebner ];
  };
 }
@@ -7,15 +7,15 @@

 buildGoModule rec {
  pname = "konstraint";
-  version = "0.38.0";
+  version = "0.39.0";

  src = fetchFromGitHub {
    owner = "plexsystems";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-02vmIsYGX6HB7k1HArMpNY+UxVX24IyraNPu13ht2qQ=";
+    sha256 = "sha256-pn5uL3ibDb3vXaBhf34LmFNGpR8SYJkg5IcnN+eVfWk=";
  };
-  vendorHash = "sha256-eD0K2te9+9x0fUYMVZ6SreV2AhkYwBzQHUTyeNwuEHc=";
+  vendorHash = "sha256-ZpNLxoUHwNMzMiKSm8rY27dH9AukXZEitrFb7TlSyQ0=";

  # Exclude go within .github folder
  excludedPackages = ".github";
@@ -8,14 +8,14 @@
 }:
 python3Packages.buildPythonApplication rec {
  pname = "labelle";
-  version = "1.3.2";
+  version = "1.4.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "labelle-org";
    repo = "labelle";
    tag = "v${version}";
-    hash = "sha256-+aRq+zwnoHy+kXerFCw1b46OHmWDDpyOiBRu4IvYAQg=";
+    hash = "sha256-y26eJKR2QZv/qKORZzag/44b1RryXMwpyMuRgac2puE=";
  };

  postPatch = ''
@@ -54,7 +54,7 @@ python3Packages.buildPythonApplication rec {
  ];

  meta = {
-    changelog = "https://github.com/labelle-org/labelle/releases/tag/v${version}";
+    changelog = "https://github.com/labelle-org/labelle/releases/tag/${src.tag}";
    description = "Print labels with LabelManager PnP from Dymo";
    homepage = "https://github.com/labelle-org/labelle";
    license = lib.licenses.asl20;
@@ -20,13 +20,13 @@

 stdenv.mkDerivation rec {
  pname = "libdeltachat";
-  version = "1.155.1";
+  version = "1.155.3";

  src = fetchFromGitHub {
    owner = "deltachat";
    repo = "deltachat-core-rust";
    tag = "v${version}";
-    hash = "sha256-XZLKvOvdyvR5poRY/oo9MHi1f2XzBmSDR8VqjW3wq74=";
+    hash = "sha256-UFDQj3TWfWdHT20R16+NqZ2lBxp5r1G5bHwm2cAWpqY=";
  };

  patches = [
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
  cargoDeps = rustPlatform.fetchCargoVendor {
    pname = "deltachat-core-rust";
    inherit version src;
-    hash = "sha256-ZxKR1M9wqmzKVbSdBKzTsKF9tDVRGHnd+Ra9Jy5CQQY=";
+    hash = "sha256-Y1/33KH5cRzunzcF+3QMSArDAb3iOR62pccHDAR3pEc=";
  };

  nativeBuildInputs = [
@@ -12,13 +12,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "libinput-gestures";
-  version = "2.78";
+  version = "2.79";

  src = fetchFromGitHub {
    owner = "bulletmark";
    repo = "libinput-gestures";
    tag = finalAttrs.version;
-    hash = "sha256-J9+KbaZYDPJzl/AE1gq6KNXIJns+XxoAL1oOSy7UTtY=";
+    hash = "sha256-oMteEOx2bwPBLgxB9uSE7zuR5vmuqX6J1Tk5nxefWa4=";
  };
  patches = [
    ./0001-hardcode-name.patch
@@ -16,14 +16,14 @@

 stdenv.mkDerivation rec {
  pname = "livi";
-  version = "0.3.0";
+  version = "0.3.1";

  src = fetchFromGitLab {
    owner = "guidog";
    repo = "livi";
    domain = "gitlab.gnome.org";
    rev = "v${version}";
-    hash = "sha256-13hvpYlMDfB6Y0yH2MaowuylKUk1AGv6R7j4E156YpI=";
+    hash = "sha256-cPnmKepXPeA3h0VYHypEPHAOclhVseokL1NsCKxGJ78=";
  };
  nativeBuildInputs = [
    meson
@@ -144,7 +144,7 @@ effectiveStdenv.mkDerivation (finalAttrs: {
      (cmakeBool "GGML_BLAS" blasSupport)
      (cmakeBool "GGML_CLBLAST" openclSupport)
      (cmakeBool "GGML_CUDA" cudaSupport)
-      (cmakeBool "GGML_HIPBLAS" rocmSupport)
+      (cmakeBool "GGML_HIP" rocmSupport)
      (cmakeBool "GGML_METAL" metalSupport)
      (cmakeBool "GGML_RPC" rpcSupport)
      (cmakeBool "GGML_VULKAN" vulkanSupport)
@@ -7,14 +7,14 @@
  dpkg,
  libGL,
  systemd,
-  electron_30,
+  electron_32,

  commandLineArgs ? "",
 }:

 let
  pname = "lx-music-desktop";
-  version = "2.9.0";
+  version = "2.10.0";

  buildUrl =
    version: arch:
@@ -23,17 +23,17 @@ let
  srcs = {
    x86_64-linux = fetchurl {
      url = buildUrl version "amd64";
-      hash = "sha256-krjC3vAwTMzlWJJIuJmYzFtN/Z/IINnzooUtlONeUM0=";
+      hash = "sha256-btNB8XFCJij1wUVZoWaa55vZn5n1gsKSMnEbQPTd9lg=";
    };

    aarch64-linux = fetchurl {
      url = buildUrl version "arm64";
-      hash = "sha256-734hTi/vgSrLAks+CV1vxrrZfSShnpExlO0JWUc4oUE=";
+      hash = "sha256-GVTzxTV7bM4AWZ+Xfb70fyedDMIa9eX/YwnGkm3WOsk=";
    };

    armv7l-linux = fetchurl {
      url = buildUrl version "armv7l";
-      hash = "sha256-e4Elipw7MzO+3XmmGlZfLDFgSph0by5Xy6FtYCie/38=";
+      hash = "sha256-3zttIk+A4BpG0W196LzgTJ5WeqWvLjqPFz6e9RCGlJo=";
    };
  };

@@ -71,7 +71,7 @@ stdenv.mkDerivation {
  '';

  postFixup = ''
-    makeWrapper ${electron_30}/bin/electron $out/bin/lx-music-desktop \
+    makeWrapper ${electron_32}/bin/electron $out/bin/lx-music-desktop \
        --add-flags $out/opt/lx-music-desktop/resources/app.asar \
        --prefix LD_LIBRARY_PATH : "${runtimeLibs}" \
        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime=true}}" \
--- a/Show More
+++ b/Show More