Merge remote-tracking branch 'origin/staging-next' into staging

2025-06-03 09:22:48 +03:00
parent 70e8bf7d38 e97cb6e2b4
commit 2be9252667
154 changed files with 1104 additions and 765 deletions
@@ -115,16 +115,17 @@ jobs:
                repo: context.repo.repo,
                pull_number: context.payload.pull_request.number
              })).filter(review =>
-                review.user.login == 'github-actions[bot]' &&
-                review.state == 'CHANGES_REQUESTED'
+                review.user.login == 'github-actions[bot]'
              ).map(async (review) => {
-                await github.rest.pulls.dismissReview({
-                  owner: context.repo.owner,
-                  repo: context.repo.repo,
-                  pull_number: context.payload.pull_request.number,
-                  review_id: review.id,
-                  message: 'All cherry-picks are good now, thank you!'
-                })
+                if (review.state == 'CHANGES_REQUESTED') {
+                  await github.rest.pulls.dismissReview({
+                    owner: context.repo.owner,
+                    repo: context.repo.repo,
+                    pull_number: context.payload.pull_request.number,
+                    review_id: review.id,
+                    message: 'All cherry-picks are good now, thank you!'
+                  })
+                }
                await github.graphql(`mutation($node_id:ID!) {
                  minimizeComment(input: {
                    classifier: RESOLVED,
@@ -25,7 +25,7 @@ jobs:
        with:
          merged-as-untrusted: true

-      - uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31
+      - uses: cachix/install-nix-action@17fe5fb4a23ad6cbbe47d6b3f359611ad276644c # v31
        with:
          extra_nix_config: sandbox = true

@@ -42,7 +42,7 @@ jobs:
        with:
          merged-as-untrusted: true

-      - uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31
+      - uses: cachix/install-nix-action@17fe5fb4a23ad6cbbe47d6b3f359611ad276644c # v31

      - uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16
        with:
@@ -45,7 +45,6 @@ jobs:
  check:
    name: Check
    runs-on: ubuntu-24.04-arm
-    if: github.repository_owner == 'NixOS'
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
@@ -56,7 +55,7 @@ jobs:
          merged-as-untrusted: true
          target-as-trusted: true

-      - uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31
+      - uses: cachix/install-nix-action@17fe5fb4a23ad6cbbe47d6b3f359611ad276644c # v31

      - uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16
        with:
@@ -68,7 +67,7 @@ jobs:
        run: nix-build trusted/ci -A codeownersValidator

      - uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
-        if: vars.OWNER_RO_APP_ID
+        if: github.event_name == 'pull_request_target' && vars.OWNER_RO_APP_ID
        id: app-token
        with:
          app-id: ${{ vars.OWNER_RO_APP_ID }}
@@ -91,9 +90,8 @@ jobs:
  request:
    name: Request
    runs-on: ubuntu-24.04-arm
-    if: github.repository_owner == 'NixOS'
    steps:
-      - uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31
+      - uses: cachix/install-nix-action@17fe5fb4a23ad6cbbe47d6b3f359611ad276644c # v31

      # Important: Because we use pull_request_target, this checks out the base branch of the PR, not the PR head.
      # This is intentional, because we need to request the review of owners as declared in the base branch.
@@ -101,8 +99,11 @@ jobs:
        with:
          path: trusted

+      - name: Build review request package
+        run: nix-build trusted/ci -A requestReviews
+
      - uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
-        if: vars.OWNER_APP_ID
+        if: github.event_name == 'pull_request_target' && vars.OWNER_APP_ID
        id: app-token
        with:
          app-id: ${{ vars.OWNER_APP_ID }}
@@ -111,9 +112,6 @@ jobs:
          permission-members: read
          permission-pull-requests: write

-      - name: Build review request package
-        run: nix-build trusted/ci -A requestReviews
-
      - name: Request reviews
        if: steps.app-token.outputs.token
        env:
@@ -26,7 +26,7 @@ jobs:
          merged-as-untrusted: true

      - name: Install Nix
-        uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31
+        uses: cachix/install-nix-action@17fe5fb4a23ad6cbbe47d6b3f359611ad276644c # v31
        with:
          extra_nix_config: sandbox = true

@@ -4,7 +4,7 @@ on:
  pull_request:
    paths:
      - .github/workflows/eval.yml
-      - .github/workflows/reviews.yml # needs eval results from the same event type
+      - .github/workflows/reviewers.yml # needs eval results from the same event type
  pull_request_target:
  push:
    # Keep this synced with ci/request-reviews/dev-branches.txt
@@ -68,7 +68,7 @@ jobs:
          path: untrusted

      - name: Install Nix
-        uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31
+        uses: cachix/install-nix-action@17fe5fb4a23ad6cbbe47d6b3f359611ad276644c # v31
        with:
          extra_nix_config: sandbox = true

@@ -180,7 +180,7 @@ jobs:
          path: trusted

      - name: Install Nix
-        uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31
+        uses: cachix/install-nix-action@17fe5fb4a23ad6cbbe47d6b3f359611ad276644c # v31
        with:
          extra_nix_config: sandbox = true

@@ -28,7 +28,7 @@ jobs:
        with:
          merged-as-untrusted: true

-      - uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31
+      - uses: cachix/install-nix-action@17fe5fb4a23ad6cbbe47d6b3f359611ad276644c # v31
        with:
          extra_nix_config: sandbox = true

@@ -45,7 +45,7 @@ jobs:
        with:
          merged-as-untrusted: true

-      - uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31
+      - uses: cachix/install-nix-action@17fe5fb4a23ad6cbbe47d6b3f359611ad276644c # v31
        with:
          extra_nix_config: sandbox = true

@@ -29,7 +29,7 @@ jobs:
        with:
          merged-as-untrusted: true

-      - uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31
+      - uses: cachix/install-nix-action@17fe5fb4a23ad6cbbe47d6b3f359611ad276644c # v31
        with:
          extra_nix_config: sandbox = true

@@ -26,7 +26,7 @@ jobs:
        with:
          merged-as-untrusted: true

-      - uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31
+      - uses: cachix/install-nix-action@17fe5fb4a23ad6cbbe47d6b3f359611ad276644c # v31
        with:
          extra_nix_config: sandbox = true
          nix_path: nixpkgs=channel:nixpkgs-unstable
@@ -36,7 +36,7 @@ jobs:
          merged-as-untrusted: true
          target-as-trusted: true

-      - uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31
+      - uses: cachix/install-nix-action@17fe5fb4a23ad6cbbe47d6b3f359611ad276644c # v31

      - name: Running nixpkgs-vet
        env:
@@ -34,7 +34,7 @@ jobs:
          sparse-checkout: ci

      - name: Install Nix
-        uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31
+        uses: cachix/install-nix-action@17fe5fb4a23ad6cbbe47d6b3f359611ad276644c # v31
        with:
          extra_nix_config: sandbox = true

@@ -44,7 +44,7 @@ jobs:
      # See ./codeowners-v2.yml, reuse the same App because we need the same permissions
      # Can't use the token received from permissions above, because it can't get enough permissions
      - uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
-        if: vars.OWNER_APP_ID
+        if: github.event_name == 'pull_request_target' && vars.OWNER_APP_ID
        id: app-token
        with:
          app-id: ${{ vars.OWNER_APP_ID }}
@@ -25,6 +25,8 @@ runCommand "nixpkgs-vet"
    env.NIXPKGS_VET_NIX_PACKAGE = nix;
  }
  ''
+    export NIX_STATE_DIR=$(mktemp -d)
+
    nixpkgs-vet --base ${filtered base} ${filtered head}

    touch $out
@@ -161,6 +161,27 @@ completely incompatible with packages from `haskellPackages`.

 <!-- TODO(@maralorn) Link to package set generation docs in the contributors guide below. -->

+### GHC Deprecation Policy {#ghc-deprecation-policy}
+
+We remove GHC versions according to the following policy:
+
+#### Major GHC versions {#major-ghc-deprecation}
+
+We keep the following GHC major versions:
+1. The current Stackage LTS as the default and all later major versions.
+2. The two latest major versions older than our default.
+3. The currently recommended GHCup version and all later major versions.
+
+Older GHC versions might be kept longer, if there are in-tree consumers. We will coordinate with the maintainers of those dependencies to find a way forward.
+
+#### Minor GHC versions {#minor-ghc-deprecation}
+
+Every major version has a default minor version. The default minor version will be updated as soon as viable without breakage.
+
+Older minor versions for a supported major version will only be kept, if they are the last supported version of a major Stackage LTS release.
+
+<!-- Policy introduced here: https://discourse.nixos.org/t/nixpkgs-ghc-deprecation-policy-user-feedback-necessary/64153 -->
+
 ## `haskellPackages.mkDerivation` {#haskell-mkderivation}

 Every haskell package set has its own haskell-aware `mkDerivation` which is used
@@ -605,8 +605,8 @@ In some projects, the Rust crate is not in the main Python source
 directory.  In such cases, the `cargoRoot` attribute can be used to
 specify the crate's directory relative to `sourceRoot`. In the
 following example, the crate is in `src/rust`, as specified in the
-`cargoRoot` attribute. Note that we also need to specify the correct
-path for `fetchCargoVendor`.
+`cargoRoot` attribute. Note that we also need to pass in `cargoRoot`
+to `fetchCargoVendor`.

 ```nix
 {
@@ -627,8 +627,12 @@ buildPythonPackage rec {
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit pname version src;
-    sourceRoot = "${pname}-${version}/${cargoRoot}";
+    inherit
+      pname
+      version
+      src
+      cargoRoot
+      ;
    hash = "sha256-ctUt8maCjnGddKPf+Ii++wKsAXA1h+JM6zKQNXXwJqQ=";
  };

@@ -40,9 +40,18 @@
  "ex-testEqualArrayOrMap-test-function-add-cowbell": [
    "index.html#ex-testEqualArrayOrMap-test-function-add-cowbell"
  ],
+  "ghc-deprecation-policy": [
+    "index.html#ghc-deprecation-policy"
+  ],
  "inkscape-plugins": [
    "index.html#inkscape-plugins"
  ],
+  "major-ghc-deprecation": [
+    "index.html#major-ghc-deprecation"
+  ],
+  "minor-ghc-deprecation": [
+    "index.html#minor-ghc-deprecation"
+  ],
  "neovim": [
    "index.html#neovim"
  ],
@@ -13,7 +13,7 @@

 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->

- The `boot.readOnlyNixStore` has been removed. Control over bind mount options on `/nix/store` is now offered by the `boot.nixStoreMountOpts` option.
+- The `offrss` package was removed due to lack of upstream maintenance since 2012. It's recommended for users to migrate to another RSS reader

 ## Other Notable Changes {#sec-nixpkgs-release-25.11-notable-changes}

@@ -17139,6 +17139,12 @@
    githubId = 1131571;
    name = "naelstrof";
  };
+  naggie = {
+    name = "Cal Bryant";
+    email = "callan.bryant@gmail.com";
+    github = "naggie";
+    githubId = 208440;
+  };
  nagisa = {
    name = "Simonas Kazlauskas";
    email = "nixpkgs@kazlauskas.me";
@@ -30,6 +30,8 @@

 - `renovate` was updated to v40. See the [upstream release notes](https://github.com/renovatebot/renovate/releases/tag/40.0.0) for breaking changes.

+- The `boot.readOnlyNixStore` has been removed. Control over bind mount options on `/nix/store` is now offered by the `boot.nixStoreMountOpts` option.
+
 ## Other Notable Changes {#sec-release-25.11-notable-changes}

 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
@@ -90,7 +90,7 @@ in
          }
        '';
        example.require-ipfs.paths = [ "/ipfs" ];
-        example.require-ipfs.onFeatures = [ "ifps" ];
+        example.require-ipfs.onFeatures = [ "ipfs" ];
      };
    extraWrapperArgs = lib.mkOption {
      type = with lib.types; listOf str;
@@ -23,8 +23,8 @@ let
    ;

  finalPackage = cfg.package.overridePythonAttrs (oldAttrs: {
-    propagatedBuildInputs =
-      oldAttrs.propagatedBuildInputs
+    dependencies =
+      oldAttrs.dependencies
      # for audio enhancements like auto-gain, noise suppression
      ++ cfg.package.optional-dependencies.webrtc
      # vad is currently optional, because it is broken on aarch64-linux
@@ -0,0 +1,31 @@
+# dsnet {#module-services-dsnet}
+
+dsnet is a CLI tool to manage a centralised wireguard server. It allows easy
+generation of client configuration, handling key generation, IP allocation etc.
+
+It keeps its own configuration at `/etc/dsnetconfig.json`, which is more of a
+database. It contains key material too.
+
+The way this module works is to patch this database with whatever is configured
+in the nix service instantiation. This happens automatically when required.
+
+This way it is possible to decide what to let dnset manage and what parts you
+want to keep declaratively.
+
+```
+services.dsnet = {
+  enable = true;
+  settings = {
+    ExternalHostname = "vpn.example.com";
+    Network = "10.171.90.0/24";
+    Network6 = "";
+    IP = "10.171.90.1";
+    IP6 = "";
+    DNS = "10.171.90.1";
+    Networks = [ "0.0.0.0/0" ];
+  };
+
+```
+
+
+See <https://github.com/naggie/dsnet> for more information.
@@ -0,0 +1,184 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.dsnet;
+  settingsFormat = pkgs.formats.json { };
+  patchFile = settingsFormat.generate "dsnet-patch.json" cfg.settings;
+in
+{
+  options.services.dsnet = {
+    enable = lib.mkEnableOption "dsnet, a centralised Wireguard VPN manager";
+
+    package = lib.mkPackageOption pkgs "dsnet" { };
+
+    settings = lib.mkOption {
+      type = lib.types.submodule {
+
+        freeformType = settingsFormat.type;
+
+        options = {
+          ExternalHostname = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+            example = "vpn.example.com";
+            description = ''
+              The hostname that clients should use to connect to this server.
+              This is used to generate the client configuration files.
+
+              This is preferred over ExternalIP, as it allows for IPv4 and
+              IPv6, as well as enabling the ability tp change IP.
+            '';
+          };
+
+          ExternalIP = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+            example = "192.0.2.1";
+            description = ''
+              The external IP address of the server. This is used to generate
+              the client configuration files for when an ExternalHostname is not set.
+
+              Leaving this empty will cause dsnet to use the IP address of
+              what looks like the WAN interface.
+            '';
+          };
+
+          ExternalIP6 = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+            example = "2001:db8::1";
+            description = ''
+              The external IPv6 address of the server. This is used to generate
+              the client configuration files for when an ExternalHostname is
+              not set. Used in preference to ExternalIP.
+
+              Leaving this empty will cause dsnet to use the IP address of
+              what looks like the WAN interface.
+            '';
+          };
+
+          Network = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+            example = "172.18.0.0/24";
+            description = ''
+              The IPv4 network that the server will use to allocate IPs on the network.
+              Leave this empty to let dsnet choose a network.
+            '';
+          };
+
+          Network6 = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+            example = "2001:db8::1/64";
+            description = ''
+              The IPv6 network that the server will use to allocate IPs on the
+              network.
+              Leave this empty to let dsnet choose a network.
+            '';
+          };
+
+          IP = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+            example = "172.18.0.1";
+            description = ''
+              The IPv4 address that the server will use on the network.
+              Leave this empty to let dsnet choose an address.
+            '';
+          };
+
+          IP6 = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+            example = "2001:db8::1";
+            description = ''
+              The IPv6 address that the server will use on the network
+              Leave this empty to let dsnet choose an address.
+            '';
+          };
+
+          Networks = lib.mkOption {
+            type = lib.types.nullOr (lib.types.listOf lib.types.str);
+            default = null;
+            example = [
+              "0.0.0.0/0"
+              "192.168.0.0/24"
+            ];
+            description = ''
+              The CIDR networks that should route through this server. Clients
+              will be configured to route traffic for these networks through
+              the server peer.
+            '';
+          };
+        };
+      };
+
+      default = { };
+      description = ''
+        The settings to use for dsnet. This will be converted to a JSON
+        object that will be passed to dsnet as a patch, using the patch
+        command when the service is started. See the dsnet documentation for
+        more information on the additional options.
+
+        Note that the resulting /etc/dsnetconfg.json is more of a database
+        than it is a configuration file. It is therefore recommended that
+        system specific values are configured here, rather than the full
+        configuration including peers.
+
+        Peers may be managed via the dsnet add/remove commands, negating the
+        need to manage key material and cumbersom configuration with nix. If
+        you want peer configuration in nix, you may as well use the regular
+        wireguard module.
+      '';
+      example = {
+        ExternalHostname = "vpn.example.com";
+        ExternalIP = "127.0.0.1";
+        ExternalIP6 = "";
+        ListenPort = 51820;
+        Network = "10.3.148.0/22";
+        Network6 = "";
+        IP = "10.3.148.1";
+        IP6 = "";
+        DNS = "8.8.8.8";
+        Networks = [ "0.0.0.0/0" ];
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [ cfg.package ];
+
+    systemd.services.dsnet = {
+      description = "dsnet VPN Management";
+      after = [ "network-online.target" ];
+      wants = [ "network-online.target" ];
+      wantedBy = [ "multi-user.target" ];
+      preStart = ''
+        test ! -f /etc/dsnetconfig.json && ${lib.getExe cfg.package} init
+        ${lib.getExe cfg.package} patch < ${patchFile}
+      '';
+      serviceConfig = {
+        ExecStart = "${lib.getExe cfg.package} up";
+        ExecStop = "${lib.getExe cfg.package} down";
+        Type = "oneshot";
+        # consider the service to be active after process exits, so it can be
+        # reloaded
+        RemainAfterExit = true;
+      };
+
+      reload = ''
+        ${lib.getExe cfg.package} patch < ${patchFile}
+        ${lib.getExe cfg.package} sync < ${patchFile}
+      '';
+
+      # reload _instead_ of restarting on change
+      reloadIfChanged = true;
+    };
+  };
+}
@@ -5,8 +5,6 @@
  ...
 }:

-with lib;
-
 let
  cfg = config.services.murmur;
  forking = cfg.logFile != null;
@@ -14,68 +12,53 @@ let
    database=${cfg.stateDir}/murmur.sqlite
    dbDriver=QSQLITE

-    autobanAttempts=${toString cfg.autobanAttempts}
-    autobanTimeframe=${toString cfg.autobanTimeframe}
-    autobanTime=${toString cfg.autobanTime}
+    autobanAttempts=${lib.toString cfg.autobanAttempts}
+    autobanTimeframe=${lib.toString cfg.autobanTimeframe}
+    autobanTime=${lib.toString cfg.autobanTime}

-    logfile=${optionalString (cfg.logFile != null) cfg.logFile}
-    ${optionalString forking "pidfile=/run/murmur/murmurd.pid"}
+    logfile=${lib.optionalString (cfg.logFile != null) cfg.logFile}
+    ${lib.optionalString forking "pidfile=/run/murmur/murmurd.pid"}

    welcometext="${cfg.welcometext}"
-    port=${toString cfg.port}
+    port=${lib.toString cfg.port}

-    ${optionalString (cfg.hostName != "") "host=${cfg.hostName}"}
-    ${optionalString (cfg.password != "") "serverpassword=${cfg.password}"}
+    ${lib.optionalString (cfg.hostName != "") "host=${cfg.hostName}"}
+    ${lib.optionalString (cfg.password != "") "serverpassword=${cfg.password}"}

-    bandwidth=${toString cfg.bandwidth}
-    users=${toString cfg.users}
+    bandwidth=${lib.toString cfg.bandwidth}
+    users=${lib.toString cfg.users}

-    textmessagelength=${toString cfg.textMsgLength}
-    imagemessagelength=${toString cfg.imgMsgLength}
-    allowhtml=${boolToString cfg.allowHtml}
-    logdays=${toString cfg.logDays}
-    bonjour=${boolToString cfg.bonjour}
-    sendversion=${boolToString cfg.sendVersion}
+    textmessagelength=${lib.toString cfg.textMsgLength}
+    imagemessagelength=${lib.toString cfg.imgMsgLength}
+    allowhtml=${lib.boolToString cfg.allowHtml}
+    logdays=${lib.toString cfg.logDays}
+    bonjour=${lib.boolToString cfg.bonjour}
+    sendversion=${lib.boolToString cfg.sendVersion}

-    ${optionalString (cfg.registerName != "") "registerName=${cfg.registerName}"}
-    ${optionalString (cfg.registerPassword != "") "registerPassword=${cfg.registerPassword}"}
-    ${optionalString (cfg.registerUrl != "") "registerUrl=${cfg.registerUrl}"}
-    ${optionalString (cfg.registerHostname != "") "registerHostname=${cfg.registerHostname}"}
+    ${lib.optionalString (cfg.registerName != "") "registerName=${cfg.registerName}"}
+    ${lib.optionalString (cfg.registerPassword != "") "registerPassword=${cfg.registerPassword}"}
+    ${lib.optionalString (cfg.registerUrl != "") "registerUrl=${cfg.registerUrl}"}
+    ${lib.optionalString (cfg.registerHostname != "") "registerHostname=${cfg.registerHostname}"}

-    certrequired=${boolToString cfg.clientCertRequired}
-    ${optionalString (cfg.sslCert != "") "sslCert=${cfg.sslCert}"}
-    ${optionalString (cfg.sslKey != "") "sslKey=${cfg.sslKey}"}
-    ${optionalString (cfg.sslCa != "") "sslCA=${cfg.sslCa}"}
+    certrequired=${lib.boolToString cfg.clientCertRequired}
+    ${lib.optionalString (cfg.sslCert != "") "sslCert=${cfg.sslCert}"}
+    ${lib.optionalString (cfg.sslKey != "") "sslKey=${cfg.sslKey}"}
+    ${lib.optionalString (cfg.sslCa != "") "sslCA=${cfg.sslCa}"}

-    ${optionalString (cfg.dbus != null) "dbus=${cfg.dbus}"}
+    ${lib.optionalString (cfg.dbus != null) "dbus=${cfg.dbus}"}

    ${cfg.extraConfig}
  '';
 in
 {
-  imports = [
-    (mkRenamedOptionModule [ "services" "murmur" "welcome" ] [ "services" "murmur" "welcometext" ])
-    (mkRemovedOptionModule [ "services" "murmur" "pidfile" ] "Hardcoded to /run/murmur/murmurd.pid now")
-  ];
-
  options = {
    services.murmur = {
-      enable = mkOption {
-        type = types.bool;
-        default = false;
-        description = "If enabled, start the Murmur Mumble server.";
-      };
+      enable = lib.mkEnableOption "Mumble server";

-      openFirewall = mkOption {
-        type = types.bool;
-        default = false;
-        description = ''
-          Open ports in the firewall for the Murmur Mumble server.
-        '';
-      };
+      openFirewall = lib.mkEnableOption "opening ports in the firewall for the Mumble server";

-      user = mkOption {
-        type = types.str;
+      user = lib.mkOption {
+        type = lib.types.str;
        default = "murmur";
        description = ''
          The name of an existing user to use to run the service.
@@ -83,8 +66,8 @@ in
        '';
      };

-      group = mkOption {
-        type = types.str;
+      group = lib.mkOption {
+        type = lib.types.str;
        default = "murmur";
        description = ''
          The name of an existing group to use to run the service.
@@ -92,16 +75,16 @@ in
        '';
      };

-      stateDir = mkOption {
-        type = types.path;
+      stateDir = lib.mkOption {
+        type = lib.types.path;
        default = "/var/lib/murmur";
        description = ''
          Directory to store data for the server.
        '';
      };

-      autobanAttempts = mkOption {
-        type = types.int;
+      autobanAttempts = lib.mkOption {
+        type = lib.types.int;
        default = 10;
        description = ''
          Number of attempts a client is allowed to make in
@@ -110,8 +93,8 @@ in
        '';
      };

-      autobanTimeframe = mkOption {
-        type = types.int;
+      autobanTimeframe = lib.mkOption {
+        type = lib.types.int;
        default = 120;
        description = ''
          Timeframe in which a client can connect without being banned
@@ -119,47 +102,47 @@ in
        '';
      };

-      autobanTime = mkOption {
-        type = types.int;
+      autobanTime = lib.mkOption {
+        type = lib.types.int;
        default = 300;
        description = "The amount of time an IP ban lasts (in seconds).";
      };

-      logFile = mkOption {
-        type = types.nullOr types.path;
+      logFile = lib.mkOption {
+        type = lib.types.nullOr lib.types.path;
        default = null;
        example = "/var/log/murmur/murmurd.log";
        description = "Path to the log file for Murmur daemon. Empty means log to journald.";
      };

-      welcometext = mkOption {
-        type = types.str;
+      welcometext = lib.mkOption {
+        type = lib.types.str;
        default = "";
        description = "Welcome message for connected clients.";
      };

-      port = mkOption {
-        type = types.port;
+      port = lib.mkOption {
+        type = lib.types.port;
        default = 64738;
        description = "Ports to bind to (UDP and TCP).";
      };

-      hostName = mkOption {
-        type = types.str;
+      hostName = lib.mkOption {
+        type = lib.types.str;
        default = "";
        description = "Host to bind to. Defaults binding on all addresses.";
      };

-      package = mkPackageOption pkgs "murmur" { };
+      package = lib.mkPackageOption pkgs "murmur" { };

-      password = mkOption {
-        type = types.str;
+      password = lib.mkOption {
+        type = lib.types.str;
        default = "";
        description = "Required password to join server, if specified.";
      };

-      bandwidth = mkOption {
-        type = types.int;
+      bandwidth = lib.mkOption {
+        type = lib.types.int;
        default = 72000;
        description = ''
          Maximum bandwidth (in bits per second) that clients may send
@@ -167,26 +150,26 @@ in
        '';
      };

-      users = mkOption {
-        type = types.int;
+      users = lib.mkOption {
+        type = lib.types.int;
        default = 100;
        description = "Maximum number of concurrent clients allowed.";
      };

-      textMsgLength = mkOption {
-        type = types.int;
+      textMsgLength = lib.mkOption {
+        type = lib.types.int;
        default = 5000;
        description = "Max length of text messages. Set 0 for no limit.";
      };

-      imgMsgLength = mkOption {
-        type = types.int;
+      imgMsgLength = lib.mkOption {
+        type = lib.types.int;
        default = 131072;
        description = "Max length of image messages. Set 0 for no limit.";
      };

-      allowHtml = mkOption {
-        type = types.bool;
+      allowHtml = lib.mkOption {
+        type = lib.types.bool;
        default = true;
        description = ''
          Allow HTML in client messages, comments, and channel
@@ -194,8 +177,8 @@ in
        '';
      };

-      logDays = mkOption {
-        type = types.int;
+      logDays = lib.mkOption {
+        type = lib.types.int;
        default = 31;
        description = ''
          How long to store RPC logs for in the database. Set 0 to
@@ -203,23 +186,16 @@ in
        '';
      };

-      bonjour = mkOption {
-        type = types.bool;
-        default = false;
-        description = ''
-          Enable Bonjour auto-discovery, which allows clients over
-          your LAN to automatically discover Murmur servers.
-        '';
-      };
+      bonjour = lib.mkEnableOption "Bonjour auto-discovery, which allows clients over your LAN to automatically discover Mumble servers";

-      sendVersion = mkOption {
-        type = types.bool;
+      sendVersion = lib.mkOption {
+        type = lib.types.bool;
        default = true;
        description = "Send Murmur version in UDP response.";
      };

-      registerName = mkOption {
-        type = types.str;
+      registerName = lib.mkOption {
+        type = lib.types.str;
        default = "";
        description = ''
          Public server registration name, and also the name of the
@@ -228,8 +204,8 @@ in
        '';
      };

-      registerPassword = mkOption {
-        type = types.str;
+      registerPassword = lib.mkOption {
+        type = lib.types.str;
        default = "";
        description = ''
          Public server registry password, used authenticate your
@@ -238,14 +214,14 @@ in
        '';
      };

-      registerUrl = mkOption {
-        type = types.str;
+      registerUrl = lib.mkOption {
+        type = lib.types.str;
        default = "";
        description = "URL website for your server.";
      };

-      registerHostname = mkOption {
-        type = types.str;
+      registerHostname = lib.mkOption {
+        type = lib.types.str;
        default = "";
        description = ''
          DNS hostname where your server can be reached. This is only
@@ -255,40 +231,36 @@ in
        '';
      };

-      clientCertRequired = mkOption {
-        type = types.bool;
-        default = false;
-        description = "Require clients to authenticate via certificates.";
-      };
+      clientCertRequired = lib.mkEnableOption "requiring clients to authenticate via certificates";

-      sslCert = mkOption {
-        type = types.str;
+      sslCert = lib.mkOption {
+        type = lib.types.str;
        default = "";
        description = "Path to your SSL certificate.";
      };

-      sslKey = mkOption {
-        type = types.str;
+      sslKey = lib.mkOption {
+        type = lib.types.str;
        default = "";
        description = "Path to your SSL key.";
      };

-      sslCa = mkOption {
-        type = types.str;
+      sslCa = lib.mkOption {
+        type = lib.types.str;
        default = "";
        description = "Path to your SSL CA certificate.";
      };

-      extraConfig = mkOption {
-        type = types.lines;
+      extraConfig = lib.mkOption {
+        type = lib.types.lines;
        default = "";
        description = "Extra configuration to put into murmur.ini.";
      };

-      environmentFile = mkOption {
-        type = types.nullOr types.path;
+      environmentFile = lib.mkOption {
+        type = lib.types.nullOr lib.types.path;
        default = null;
-        example = literalExpression ''"''${config.services.murmur.stateDir}/murmurd.env"'';
+        example = lib.literalExpression ''"''${config.services.murmur.stateDir}/murmurd.env"'';
        description = ''
          Environment file as defined in {manpage}`systemd.exec(5)`.

@@ -311,8 +283,8 @@ in
        '';
      };

-      dbus = mkOption {
-        type = types.enum [
+      dbus = lib.mkOption {
+        type = lib.types.enum [
          null
          "session"
          "system"
@@ -323,19 +295,19 @@ in
    };
  };

-  config = mkIf cfg.enable {
-    users.users.murmur = mkIf (cfg.user == "murmur") {
+  config = lib.mkIf cfg.enable {
+    users.users.murmur = lib.mkIf (cfg.user == "murmur") {
      description = "Murmur Service user";
      home = cfg.stateDir;
      createHome = true;
      uid = config.ids.uids.murmur;
      group = cfg.group;
    };
-    users.groups.murmur = mkIf (cfg.group == "murmur") {
+    users.groups.murmur = lib.mkIf (cfg.group == "murmur") {
      gid = config.ids.gids.murmur;
    };

-    networking.firewall = mkIf cfg.openFirewall {
+    networking.firewall = lib.mkIf cfg.openFirewall {
      allowedTCPPorts = [ cfg.port ];
      allowedUDPPorts = [ cfg.port ];
    };
@@ -353,8 +325,8 @@ in
      serviceConfig = {
        # murmurd doesn't fork when logging to the console.
        Type = if forking then "forking" else "simple";
-        PIDFile = mkIf forking "/run/murmur/murmurd.pid";
-        EnvironmentFile = mkIf (cfg.environmentFile != null) cfg.environmentFile;
+        PIDFile = lib.mkIf forking "/run/murmur/murmurd.pid";
+        EnvironmentFile = lib.mkIf (cfg.environmentFile != null) cfg.environmentFile;
        ExecStart = "${cfg.package}/bin/mumble-server -ini /run/murmur/murmurd.ini";
        Restart = "always";
        RuntimeDirectory = "murmur";
@@ -390,7 +362,7 @@ in

    # currently not included in upstream package, addition requested at
    # https://github.com/mumble-voip/mumble/issues/6078
-    services.dbus.packages = mkIf (cfg.dbus == "system") [
+    services.dbus.packages = lib.mkIf (cfg.dbus == "system") [
      (pkgs.writeTextFile {
        name = "murmur-dbus-policy";
        text = ''
@@ -432,19 +404,19 @@ in
          r /run/murmur/murmurd.ini,
          r ${configFile},
      ''
-      + optionalString (cfg.logFile != null) ''
+      + lib.optionalString (cfg.logFile != null) ''
        rw ${cfg.logFile},
      ''
-      + optionalString (cfg.sslCert != "") ''
+      + lib.optionalString (cfg.sslCert != "") ''
        r ${cfg.sslCert},
      ''
-      + optionalString (cfg.sslKey != "") ''
+      + lib.optionalString (cfg.sslKey != "") ''
        r ${cfg.sslKey},
      ''
-      + optionalString (cfg.sslCa != "") ''
+      + lib.optionalString (cfg.sslCa != "") ''
        r ${cfg.sslCa},
      ''
-      + optionalString (cfg.dbus != null) ''
+      + lib.optionalString (cfg.dbus != null) ''
        dbus bus=${cfg.dbus}
      ''
      + ''
@@ -9,6 +9,7 @@ let
  inherit (lib)
    getExe
    mapAttrs
+    match
    mkEnableOption
    mkIf
    mkPackageOption
@@ -32,6 +33,8 @@ let
      toString value
  ) cfg.settings;

+  proxySuffix = if match "unix:.*" cfg.bind != null then ":" else "";
+
  commonServiceConfig = {
    RuntimeDirectory = "lasuite-docs";
    StateDirectory = "lasuite-docs";
@@ -264,7 +267,7 @@ in
            type = types.str;
            default = if cfg.enableNginx then "localhost,127.0.0.1,${cfg.domain}" else "";
            defaultText = lib.literalExpression ''
-              if cfg.enableNginx then "localhost,127.0.0.1,$${cfg.domain}" else ""
+              if cfg.enableNginx then "localhost,127.0.0.1,''${cfg.domain}" else ""
            '';
            description = "Comma-separated list of hosts that are able to connect to the server";
          };
@@ -348,8 +351,6 @@ in
      wantedBy = [ "multi-user.target" ];

      preStart = ''
-        ln -sfT ${cfg.backendPackage}/share/static /var/lib/lasuite-docs/static
-
        if [ ! -f .version ]; then
          touch .version
        fi
@@ -371,6 +372,8 @@ in
      environment = pythonEnvironment;

      serviceConfig = {
+        BindReadOnlyPaths = "${cfg.backendPackage}/share/static:/var/lib/lasuite-docs/static";
+
        ExecStart = utils.escapeSystemdExecArgs (
          [
            (lib.getExe' cfg.backendPackage "gunicorn")
@@ -476,10 +479,9 @@ in
        };

        locations."/media-auth" = {
-          proxyPass = "http://${cfg.bind}";
+          proxyPass = "http://${cfg.bind}${proxySuffix}/api/v1.0/documents/media-auth/";
          recommendedProxySettings = true;
          extraConfig = ''
-            rewrite $/(.*)^ /api/v1.0/documents/$1 break;
            proxy_set_header X-Original-URL $request_uri;
            proxy_pass_request_body off;
            proxy_set_header Content-Length "";
@@ -489,7 +491,6 @@ in

        locations."/media/" = {
          proxyPass = cfg.s3Url;
-          recommendedProxySettings = true;
          extraConfig = ''
            auth_request /media-auth;
            auth_request_set $authHeader $upstream_http_authorization;
@@ -82,7 +82,7 @@ in

    # Create a test bucket on the server
    machine.succeed(
-        "mc config host add minio http://localhost:9000 ${accessKey} ${secretKey} --api s3v4"
+        "mc alias set minio http://localhost:9000 ${accessKey} ${secretKey} --api s3v4"
    )
    machine.succeed("mc mb minio/test-bucket")
    machine.succeed("${minioPythonScript}")
@@ -101,7 +101,7 @@ in

    # Create a test bucket on the server
    machine.succeed(
-        "mc config host add minio https://localhost:9000 ${accessKey} ${secretKey} --api s3v4"
+        "mc alias set minio https://localhost:9000 ${accessKey} ${secretKey} --api s3v4"
    )
    machine.succeed("mc --insecure mb minio/test-bucket")
    machine.succeed("${minioPythonScript} tls")
@@ -12,12 +12,12 @@
  pkgs,
 }:
 let
-  version = "0.0.23-unstable-2025-05-30";
+  version = "0.0.23-unstable-2025-06-02";
  src = fetchFromGitHub {
    owner = "yetone";
    repo = "avante.nvim";
-    rev = "22418bff8bcac4377ebf975cd48f716823867979";
-    hash = "sha256-qyeiDDjeReOr+TvgCWnKhb8FBN9t1YPFGvVqPvxXr0k=";
+    rev = "647a459a2b87e5c9b2987cb44150b71beffdfb10";
+    hash = "sha256-GgLOcVp2IuMBr4aBRWJTvrAuWWiMEIHmec/S97piBaM=";
  };
  avante-nvim-lib = rustPlatform.buildRustPackage {
    pname = "avante-nvim-lib";
@@ -6,13 +6,13 @@
 }:
 vimUtils.buildVimPlugin {
  pname = "sonarlint.nvim";
-  version = "0-unstable-2025-05-16";
+  version = "0-unstable-2025-05-30";

  src = fetchFromGitLab {
    owner = "schrieveslaach";
    repo = "sonarlint.nvim";
-    rev = "2aa7a9fd9d8022d1c8d472fb63ce62e021d70130";
-    hash = "sha256-RfQthodqF6r24I6EJxlewjYiX3jLAIb/RMAOVnWs73s=";
+    rev = "060df51352f9fb876d4ff43b8cd4b669a6bdfd89";
+    hash = "sha256-2MAi0nZIvAly+5p5fWKMi3tGSzMJgMnAzWnsr0rt+NM=";
  };

  passthru.updateScript = nix-update-script {
@@ -2792,8 +2792,8 @@ let
        mktplcRef = {
          name = "language-julia";
          publisher = "julialang";
-          version = "1.140.2";
-          hash = "sha256-YQwJq3QSzb2pAOLyy0w8RtrjAlxudBGN52fQtj+OmOk=";
+          version = "1.141.2";
+          hash = "sha256-i5mY037rs65BKiQLvUbu9Lup2ljhZI0owqjZ0AUsXMw=";
        };
        meta = {
          changelog = "https://marketplace.visualstudio.com/items/julialang.language-julia/changelog";
@@ -4703,8 +4703,8 @@ let
        mktplcRef = {
          name = "tabnine-vscode";
          publisher = "tabnine";
-          version = "3.283.0";
-          hash = "sha256-zn58iml+uN6K1qneLqnikaL5Gyk4rmNXo8TKKlO88jA=";
+          version = "3.287.0";
+          hash = "sha256-E4ew40NNuOW9e7ZIsJjkO/4r6gbbC2IsghFbO+n27cg=";
        };
        meta = {
          license = lib.licenses.mit;
@@ -77,7 +77,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "gimp";
-  version = "3.0.2";
+  version = "3.0.4";

  outputs = [
    "out"
@@ -87,7 +87,7 @@ stdenv.mkDerivation (finalAttrs: {

  src = fetchurl {
    url = "https://download.gimp.org/gimp/v${lib.versions.majorMinor finalAttrs.version}/gimp-${finalAttrs.version}.tar.xz";
-    hash = "sha256-VG3cMMstDnkSPH/LTXghHh7npqrOkaagrYy8v26lcaI=";
+    hash = "sha256-jKouwnW/CTJldWVKwnavwIP4SR58ykXRnPKeaWrsqyU=";
  };

  patches = [
@@ -242,9 +242,7 @@ stdenv.mkDerivation (finalAttrs: {
  };

  postPatch = ''
-    patchShebangs \
-      app/tests/create_test_env.sh \
-      tools/gimp-mkenums
+    patchShebangs tools/gimp-mkenums

    # GIMP is executed at build time so we need to fix this.
    # TODO: Look into if we can fix the interp thing.
@@ -62,11 +62,7 @@ stdenv.mkDerivation rec {
    ];

  cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit src;
-    postPatch = ''
-      cp ${./Cargo.lock} Cargo.lock
-    '';
-    sourceRoot = "${src.name}/${cargoRoot}";
+    inherit src cargoRoot postPatch;
    hash = "sha256-qZMTZi7eqEp5kSmVx7qdS7eDKOzSv9fMjWT0h/MGyeY=";
  };

@@ -1,10 +1,10 @@
 {
  "chromium": {
-    "version": "137.0.7151.55",
+    "version": "137.0.7151.68",
    "chromedriver": {
-      "version": "137.0.7151.56",
-      "hash_darwin": "sha256-z4GTPrONaXARP0d8vInJdFxR052PuuI6IJy1PEv2RNg=",
-      "hash_darwin_aarch64": "sha256-wlSDfCiBTdLWwabpHwOiM8Y3asn7ueHGSMh2AANaE+A="
+      "version": "137.0.7151.69",
+      "hash_darwin": "sha256-G88jte6xraXrrfEvCj7zndpQ7nxyzappuu4oZ79XY8U=",
+      "hash_darwin_aarch64": "sha256-wbOD/sVjLVcpPzrbAGu8b8YMbUOKkOt7eNxJDLKRjxo="
    },
    "deps": {
      "depot_tools": {
@@ -20,8 +20,8 @@
    "DEPS": {
      "src": {
        "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "254bc711794d7ad269495f3d419a209935b78cad",
-        "hash": "sha256-dB81lgjgVK0qXWgAddB7G4L7rsJpZp+0VsjDKvGugEs=",
+        "rev": "2989ffee9373ea8b8623bd98b3cb350a8e95cadc",
+        "hash": "sha256-lPmmXVCNUa9of8d52hUejImPSEfOz7v7PlovZS4cfIE=",
        "recompress": true
      },
      "src/third_party/clang-format/script": {
@@ -241,8 +241,8 @@
      },
      "src/third_party/devtools-frontend/src": {
        "url": "https://chromium.googlesource.com/devtools/devtools-frontend",
-        "rev": "a54ed1df191a9e2aff2e9ef453ee6fdc959dd125",
-        "hash": "sha256-E6sx2ioDZRWJljbS17ztRwz+gsDhIHiluvkUx1rRZcw="
+        "rev": "fdc8ca697612f90e7ddf2621dffbc43733d2d238",
+        "hash": "sha256-jKYldgZJwJeTQavmcM9enTdGN8+zt/EG7K1E9wQYIBA="
      },
      "src/third_party/dom_distiller_js/dist": {
        "url": "https://chromium.googlesource.com/chromium/dom-distiller/dist.git",
@@ -791,8 +791,8 @@
      },
      "src/v8": {
        "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "44fdd9108308773dd3f4fa040de5f4f75edf671f",
-        "hash": "sha256-BkLOmb97p2NcAIuQiDjIoVAe49h9iv79rC5G8wyD1as="
+        "rev": "e398f9bf6d5c8a768ab736f46146d7349cf31547",
+        "hash": "sha256-cJx8IgUB3UA3jEPvb5aDvHLYmAnHydK1qR11q6Y5PnA="
      }
    }
  },
@@ -126,13 +126,13 @@
    "vendorHash": null
  },
  "aws": {
-    "hash": "sha256-gBVJx6rk7rjrvyLaDJrHUmLRUbvgy60c/uQwsFXuQzA=",
+    "hash": "sha256-asrIQrhSSHjuOBFomgq9lbHc8rmkcy3OjJ5ig9I7XbU=",
    "homepage": "https://registry.terraform.io/providers/hashicorp/aws",
    "owner": "hashicorp",
    "repo": "terraform-provider-aws",
-    "rev": "v5.98.0",
+    "rev": "v5.99.1",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-OxyOD/um7hOpYpsZCyNnbdvo5K/r/L7JlWvXQBncIDw="
+    "vendorHash": "sha256-low0aq3i3pmqbadYg1VZra+ZzoV6nqyGutf8xzaces0="
  },
  "azuread": {
    "hash": "sha256-lNjU/206yS+smSe1SYlz0TOqHRlvSQKqhJ67fswNlIQ=",
@@ -216,11 +216,11 @@
    "vendorHash": "sha256-arLGaa/o9X0MYg/qIl6qhpBqcduu5Bu06FteR5KGSPw="
  },
  "buildkite": {
-    "hash": "sha256-+9gxJjLVExnpWtcF1NRQoKPg0jn1zGNSkmim5YFgs4w=",
+    "hash": "sha256-u2BkD6h12drlz6MQIjoi/EFSj7l1dBWBjHVSmL+hB4g=",
    "homepage": "https://registry.terraform.io/providers/buildkite/buildkite",
    "owner": "buildkite",
    "repo": "terraform-provider-buildkite",
-    "rev": "v1.18.0",
+    "rev": "v1.19.0",
    "spdx": "MIT",
    "vendorHash": "sha256-bhPpFPn1hdpSJYTvO1HWTrFRBvcm8gIDmMEGOaFjM6c="
  },
@@ -390,13 +390,13 @@
    "vendorHash": "sha256-xu5t7VaLvbwo/Q7Xb4mkNt7UjU+hzfk7NgfFlxwbIhU="
  },
  "dnsimple": {
-    "hash": "sha256-CkfgHBNtYCFZIMoXpX0ivkm1dyIs4mKSrHaiQ3qt/+w=",
+    "hash": "sha256-7o8shnWECaCLTCvmXrJ2eYloxtln2A2No8OK8Ig36qE=",
    "homepage": "https://registry.terraform.io/providers/dnsimple/dnsimple",
    "owner": "dnsimple",
    "repo": "terraform-provider-dnsimple",
-    "rev": "v1.9.0",
+    "rev": "v1.9.1",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-WZqwBkVXoFmDikIyt9GWszLA/9YBoQHAdBuWbGKZBZw="
+    "vendorHash": "sha256-0axKIqF1t4AW1PPi+fHfsFQLRrjhpsloQIZ9clR+8Gc="
  },
  "docker": {
    "hash": "sha256-sPeX1bupACBSmt8ppyxQKyD+FXIPdCBWn8cnOAvNHwQ=",
@@ -516,13 +516,13 @@
    "vendorHash": "sha256-X0vbtUIKYzCeRD/BbMj3VPVAwx6d7gkbHV8j9JXlaFM="
  },
  "google": {
-    "hash": "sha256-q/BFHpA3ig0QfB0mhJGqr/uQYs/SH5YX8QgWCyjcSio=",
+    "hash": "sha256-TSDkXXYkneTsY10WV5cSFzOX04kFdFVHJPgpKt5hBSE=",
    "homepage": "https://registry.terraform.io/providers/hashicorp/google",
    "owner": "hashicorp",
    "repo": "terraform-provider-google",
-    "rev": "v6.36.1",
+    "rev": "v6.37.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-rGpnPH8ebHXasvelGoJEUU4YbeGJY4adFBbgAHJ8vSs="
+    "vendorHash": "sha256-YZI6zhxXU2aABARP6GcTMeU98F4+imbL1vKIEMzsJHM="
  },
  "google-beta": {
    "hash": "sha256-VpfIfzIG1h5qnvEqogCK359LLLSgdgxg0DtRGvdZtLU=",
@@ -840,13 +840,13 @@
    "vendorHash": "sha256-7AU79r4OQbmrMI385KVIHon/4pWk6J9qnH+zQRrWtJI="
  },
  "mongodbatlas": {
-    "hash": "sha256-JQW9y1EfrEInmz2+Er8BE0+6ZdcrO/w1y+czg7jPeRE=",
+    "hash": "sha256-+JYvL6xGA2zIOg2fl8Bl7CYU4x9N4aVJpIl/6PYdyPU=",
    "homepage": "https://registry.terraform.io/providers/mongodb/mongodbatlas",
    "owner": "mongodb",
    "repo": "terraform-provider-mongodbatlas",
-    "rev": "v1.34.0",
+    "rev": "v1.35.1",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-y9dhiG0zyOcvjgygLEW2o+GPXUug0ibxC2aLvfcY260="
+    "vendorHash": "sha256-fz6e/QEcWQY7ZrWyUbk8M/+RPB8dwN3NHPLmNLyGVhQ="
  },
  "namecheap": {
    "hash": "sha256-fHH9sHI1mqQ9q9nX9DHJ0qfEfmDB4/2uzyVvUuIAF18=",
@@ -1084,11 +1084,11 @@
    "vendorHash": "sha256-j+3qtGlueKZgf0LuNps4Wc9G3EmpSgl8ZNSLqslyizI="
  },
  "rancher2": {
-    "hash": "sha256-H6ZdGvKSYRlDsCKIHlPHdEv1+6aa1rll/73IeJ+PDhc=",
+    "hash": "sha256-5NkvGETjJ5eoZC5Ohnoq2y1DQVs2WTrh/wEVO1HQsOA=",
    "homepage": "https://registry.terraform.io/providers/rancher/rancher2",
    "owner": "rancher",
    "repo": "terraform-provider-rancher2",
-    "rev": "v7.0.0",
+    "rev": "v7.2.0",
    "spdx": "MPL-2.0",
    "vendorHash": "sha256-M2lJKmIR66lQKFkInjizn68ax2Gq4sim5Y3vZKyDhZ8="
  },
@@ -1111,11 +1111,11 @@
    "vendorHash": "sha256-xo0alLK3fccbKRG5bN1G7orDsP47I3ySAzpZ9O0f2Fg="
  },
  "rootly": {
-    "hash": "sha256-SwZm4XCQUf3TQ6m77fAnhHMoW6ckpO5XSnjpEYuNyec=",
+    "hash": "sha256-2TVqXQYiCMsMQJtZMWtYiPbeOOsPck5Hpu6cmo9ZaIM=",
    "homepage": "https://registry.terraform.io/providers/rootlyhq/rootly",
    "owner": "rootlyhq",
    "repo": "terraform-provider-rootly",
-    "rev": "v2.27.1",
+    "rev": "v2.27.2",
    "spdx": "MPL-2.0",
    "vendorHash": "sha256-KezwDRmQQj0MnmsVlrX1OhNG6oMgw8fCxX5VFGdUynw="
  },
@@ -1327,22 +1327,22 @@
    "vendorHash": "sha256-HBdvXWZNPPAqPEKodwG0ZeiJOhfJHe9HRCcuozKpwVs="
  },
  "tencentcloud": {
-    "hash": "sha256-CHYuiAgzFIAApK8wZ75DtgVf8sAEVwrXP7l/l+VxB1o=",
+    "hash": "sha256-JMLuH/NDCNiByLh65NQH/goaN7/J7MGfsUNKfHJ3LFQ=",
    "homepage": "https://registry.terraform.io/providers/tencentcloudstack/tencentcloud",
    "owner": "tencentcloudstack",
    "repo": "terraform-provider-tencentcloud",
-    "rev": "v1.81.194",
+    "rev": "v1.81.197",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
  "tfe": {
-    "hash": "sha256-hMpCuLAnwwAb8ugKxKDuFvtII2k/lcwYYL0sCvZewOY=",
+    "hash": "sha256-w66HR1X/EUloz3W/6aBNvTsC5vWuAZytd2ej7DHVMU0=",
    "homepage": "https://registry.terraform.io/providers/hashicorp/tfe",
    "owner": "hashicorp",
    "repo": "terraform-provider-tfe",
-    "rev": "v0.65.2",
+    "rev": "v0.66.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-PSUob2u8hue5ii+kV4bGcvexkIQxzWsHbbEbYO0celU="
+    "vendorHash": "sha256-z1gbeYR+UFl+sBgehLgBITc9VwxEV6bRpN9A/4Fp7Oc="
  },
  "thunder": {
    "hash": "sha256-2i1DSOSt/vbFs0QCPogEBvADhLJFKbrQzwZ20ChCQMk=",
@@ -7,16 +7,16 @@

 buildGoModule rec {
  pname = "timoni";
-  version = "0.24.0";
+  version = "0.25.0";

  src = fetchFromGitHub {
    owner = "stefanprodan";
    repo = "timoni";
    rev = "v${version}";
-    hash = "sha256-nI0yy/zhsJUvisHo+C+/uNRF96ZQ1Ve8VWpE8ZvUeJc=";
+    hash = "sha256-Obx8I8n2UY6sTHKQ0qFNQ50XI+ajrbQtjQ7PCVwrSTI=";
  };

-  vendorHash = "sha256-YpwESaR+X2eOyaPdR+I3mURD7yvwzmpPmgPoSPrXjH8=";
+  vendorHash = "sha256-hCvFe27DdX/pAeyfSEDx5oiLEZjhldOVDz6ElsUPjJs=";

  subPackages = [ "cmd/timoni" ];
  nativeBuildInputs = [ installShellFiles ];
@@ -42,8 +42,7 @@ stdenv.mkDerivation rec {
  buildInputs = [ qtbase ];

  cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit src;
-    sourceRoot = "source/${cargoRoot}";
+    inherit src cargoRoot;
    hash = "sha256-1td3WjxbDq2lX7c0trpYRhO82ChNAG/ZABBRsekYtq4=";
  };

@@ -22,6 +22,8 @@

  obs-advanced-masks = callPackage ./obs-advanced-masks.nix { };

+  obs-aitum-multistream = qt6Packages.callPackage ./obs-aitum-multistream.nix { };
+
  obs-backgroundremoval = callPackage ./obs-backgroundremoval { };

  obs-color-monitor = qt6Packages.callPackage ./obs-color-monitor.nix { };
@@ -30,6 +32,8 @@

  obs-composite-blur = callPackage ./obs-composite-blur.nix { };

+  obs-dir-watch-media = callPackage ./obs-dir-watch-media.nix { };
+
  obs-dvd-screensaver = callPackage ./obs-dvd-screensaver.nix { };

  obs-freeze-filter = qt6Packages.callPackage ./obs-freeze-filter.nix { };
@@ -42,6 +46,8 @@

  obs-livesplit-one = callPackage ./obs-livesplit-one { };

+  obs-markdown = callPackage ./obs-markdown.nix { };
+
  obs-media-controls = qt6Packages.callPackage ./obs-media-controls.nix { };

  obs-move-transition = callPackage ./obs-move-transition.nix { };
@@ -62,6 +68,8 @@

  obs-replay-source = qt6Packages.callPackage ./obs-replay-source.nix { };

+  obs-retro-effects = callPackage ./obs-retro-effects.nix { };
+
  obs-rgb-levels = callPackage ./obs-rgb-levels.nix { };

  obs-scale-to-sound = callPackage ./obs-scale-to-sound.nix { };
@@ -0,0 +1,51 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  curl,
+  obs-studio,
+  qtbase,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "obs-aitum-multistream";
+  version = "1.0.7";
+
+  src = fetchFromGitHub {
+    owner = "Aitum";
+    repo = "obs-aitum-multistream";
+    tag = version;
+    hash = "sha256-TqddyTBRWLyfwYi9I0nQE8Z19YL2RwkZqUwi7F9XpwQ=";
+  };
+
+  # Fix FTBFS with Qt >= 6.8
+  prePatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail 'find_qt(COMPONENTS Widgets Core)' 'find_package(Qt6 REQUIRED COMPONENTS Core Widgets)'
+  '';
+
+  nativeBuildInputs = [ cmake ];
+  buildInputs = [
+    curl
+    obs-studio
+    qtbase
+  ];
+  dontWrapQtApps = true;
+
+  cmakeFlags = [
+    # Prevent deprecation warnings from failing the build
+    (lib.cmakeOptionType "string" "CMAKE_CXX_FLAGS" "-Wno-error=deprecated-declarations")
+  ];
+
+  meta = {
+    description = "Plugin to stream everywhere from a single instance of OBS";
+    homepage = "https://github.com/Aitum/obs-aitum-multistream";
+    maintainers = with lib.maintainers; [ flexiondotorg ];
+    license = lib.licenses.gpl2Plus;
+    platforms = [
+      "x86_64-linux"
+      "i686-linux"
+    ];
+  };
+}
@@ -0,0 +1,37 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  obs-studio,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "obs-dir-watch-media";
+  version = "0.7.0";
+
+  src = fetchFromGitHub {
+    owner = "exeldro";
+    repo = "obs-dir-watch-media";
+    rev = version;
+    sha256 = "sha256-zvg8Bu5wlcQe91ggteEj7G9Kx+mY1R6EN64T13vp7pc=";
+  };
+
+  nativeBuildInputs = [ cmake ];
+  buildInputs = [ obs-studio ];
+
+  postInstall = ''
+    rm -rf $out/obs-plugins $out/data
+  '';
+
+  meta = with lib; {
+    description = "Plugin for OBS Studio adding a filter that can watch a directory for media files";
+    homepage = "https://github.com/exeldro/obs-dir-watch-media";
+    maintainers = with maintainers; [ flexiondotorg ];
+    license = licenses.gpl2Only;
+    platforms = [
+      "x86_64-linux"
+      "i686-linux"
+    ];
+  };
+}
@@ -0,0 +1,37 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  obs-studio,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "obs-markdown";
+  version = "0.2.7";
+
+  src = fetchFromGitHub {
+    owner = "exeldro";
+    repo = "obs-markdown";
+    rev = version;
+    sha256 = "sha256-5ajX/cEa0n12Putx1k3ctl1v9wRzJRhyJNDlmjSMbeU=";
+  };
+
+  nativeBuildInputs = [ cmake ];
+  buildInputs = [ obs-studio ];
+
+  postInstall = ''
+    rm -rf $out/obs-plugins $out/data
+  '';
+
+  meta = with lib; {
+    description = "Plugin for OBS Studio to add Markdown sources";
+    homepage = "https://github.com/exeldro/obs-markdown";
+    maintainers = with maintainers; [ flexiondotorg ];
+    license = licenses.gpl2Only;
+    platforms = [
+      "x86_64-linux"
+      "i686-linux"
+    ];
+  };
+}
@@ -0,0 +1,39 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  obs-studio,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "obs-retro-effects";
+  version = "1.0.0";
+
+  src = fetchFromGitHub {
+    owner = "FiniteSingularity";
+    repo = "obs-retro-effects";
+    rev = "${version}";
+    sha256 = "sha256-+dg5ySleMb9abT9kIM7HvRSRx9V08B9XPjfoAVe+tWY=";
+  };
+
+  nativeBuildInputs = [ cmake ];
+  buildInputs = [ obs-studio ];
+
+  postFixup = ''
+    mv $out/data/obs-plugins/${pname}/shaders $out/share/obs/obs-plugins/${pname}/
+    rm -rf $out/obs-plugins
+    rm -rf $out/data
+  '';
+
+  meta = with lib; {
+    description = "A collection of OBS filters to give your stream that retro feel.";
+    homepage = "https://github.com/FiniteSingularity/obs-retro-effects";
+    maintainers = with maintainers; [ flexiondotorg ];
+    license = licenses.gpl2Plus;
+    platforms = [
+      "x86_64-linux"
+      "i686-linux"
+    ];
+  };
+}
@@ -90,9 +90,11 @@
    rev = "9d9dbe6ed05854e03811c361a3380e09183f4f4a";
    fetchTags = true;
    leaveDotGit = true;
-    sha256 = "sha256-2vfZnYjZlnC8ODz6B6aOqAqtb1Wbjojnn/5TmzwUrmo=";
+    sha256 = "sha256-y7l+46lVP2pzJwGON5qEV0EoxWofRoWAym5q9VXvpc8=";
    postFetch = ''
      cd $out && git describe --tags --always > describe-output.txt 2>&1 || echo "git describe failed" > describe-output.txt
+      # See https://github.com/NixOS/nixpkgs/issues/412967#issuecomment-2927452118
+      rm -rf .git
    '';
  };
 }
@@ -8,7 +8,7 @@
 }:

 let
-  version = "0.2.77";
+  version = "0.2.78";
 in
 buildGoModule {
  pname = "act";
@@ -18,7 +18,7 @@ buildGoModule {
    owner = "nektos";
    repo = "act";
    tag = "v${version}";
-    hash = "sha256-bcqHj40lySE2xXGuUbXbH5cjQ5NoJCvjE/uX8HaKVho=";
+    hash = "sha256-S4Ev7MszuvlsUstnjOltYnZTuhzeqP/GDqMEWsFLe5Y=";
  };

  vendorHash = "sha256-YH5SIZ73VYqg7+sSJpvqkIlBUy1rs3uNEWiEBDRdkQw=";
@@ -8,13 +8,13 @@

 buildGoModule {
  pname = "alertmanager-ntfy";
-  version = "0-unstable-2025-05-04";
+  version = "0-unstable-2025-05-31";

  src = fetchFromGitHub {
    owner = "alexbakker";
    repo = "alertmanager-ntfy";
-    rev = "f05e3c029bab3bdfb9aefbddbfc6bd9c7d4aa80f";
-    hash = "sha256-rKCJnffsBEXmTg2s0nqQf8BuHQnSgcwVBhC7gRzg4ew=";
+    rev = "76d5f772f70d6915c89da00414c20009b03cc361";
+    hash = "sha256-newJ1fCMEE3gsZncWU899Q6cS6llPNwJlHT7HdLQZf8=";
  };

  vendorHash = "sha256-e1JAoDNm2+xB/bZcEGr5l4+va8GIg1R8pdj3d+/Y+UY=";
@@ -1,27 +1,12 @@
 {
  lib,
-  buildPythonApplication,
  fetchFromGitHub,
-  poetry-core,
-  anchor-kr,
-  anitopy,
-  click,
-  cssselect,
-  httpx,
-  lxml,
-  packaging,
-  pkginfo,
-  pycryptodomex,
-  pyyaml,
-  regex,
-  rich,
-  tqdm,
-  yarl,
+  python3Packages,
 }:
-buildPythonApplication {
+python3Packages.buildPythonApplication {
  pname = "animdl";
  version = "1.7.27";
-  format = "pyproject";
+  pyproject = true;

  src = fetchFromGitHub {
    owner = "justfoolingaround";
@@ -34,7 +19,9 @@ buildPythonApplication {
  pythonRemoveDeps = [
    "comtypes" # windows only
  ];
+
  pythonRelaxDeps = [
+    "cssselect"
    "httpx"
    "lxml"
    "packaging"
@@ -45,10 +32,11 @@ buildPythonApplication {
    "yarl"
  ];

-  nativeBuildInputs = [
+  build-system = with python3Packages; [
    poetry-core
  ];
-  propagatedBuildInputs = [
+
+  dependencies = with python3Packages; [
    anchor-kr
    anitopy
    click
@@ -2,32 +2,20 @@
  lib,
  rustPlatform,
  fetchFromGitHub,
-  fetchpatch,
 }:
 rustPlatform.buildRustPackage rec {
  pname = "bootspec";
-  version = "1.0.0";
+  version = "1.0.1";

  src = fetchFromGitHub {
    owner = "DeterminateSystems";
    repo = "bootspec";
    rev = "v${version}";
-    hash = "sha256-5IGSMHeL0eKfl7teDejAckYQjc8aeLwfwIQSzQ8YaAg=";
+    hash = "sha256-0MO+SqG7Gjq+fmMJkIFvaKsfTmC7z3lGfi7bbBv7iBE=";
  };

-  patches = [
-    # https://github.com/DeterminateSystems/bootspec/pull/127
-    # Fixes the synthesize tool for aarch64-linux
-    (fetchpatch {
-      name = "aarch64-support.patch";
-      url = "https://github.com/DeterminateSystems/bootspec/commit/1d0e925f360f0199f13422fb7541225fd162fd4f.patch";
-      sha256 = "sha256-wU/jWnOqVBrU2swANdXbQfzRpNd/JIS4cxSyCvixZM0=";
-    })
-
-  ];
-
  useFetchCargoVendor = true;
-  cargoHash = "sha256-65jk8UlXZgQoxuwRcGlMnI4e+LpCJuP2TaqK+Kn4GnQ=";
+  cargoHash = "sha256-fKbF5SyI0UlZTWsygdE8BGWuOoNSU4jx+CGdJoJFhZs=";

  meta = with lib; {
    description = "Implementation of RFC-0125's datatype and synthesis tooling";
@@ -9,20 +9,20 @@
 }:

 let
-  version = "2025.4.2";
+  version = "2025.5.1";

  product =
    if proEdition then
      {
        productName = "pro";
        productDesktop = "Burp Suite Professional Edition";
-        hash = "sha256-wtCZ3/7JvygSCka4i3Il2ajpSuuTPTwHeVJa4gGFDPw=";
+        hash = "sha256-1AXAVXselQKqKsjTRJVN3rBQpSReTH3d0ulIahp9QCc=";
      }
    else
      {
        productName = "community";
        productDesktop = "Burp Suite Community Edition";
-        hash = "sha256-+1aTq7XKacsi/gzUpeZvSuwpKPDMo6H3C81pxWCC4w8=";
+        hash = "sha256-zX5QJz996WgKvDA6p5dRtmbZTRsgCl0URn302MkhVew=";
      };

  src = fetchurl {
@@ -91,6 +91,8 @@ buildFHSEnv {
    cp -r ${desktopItem}/share/applications $out/share
  '';

+  passthru.updateScript = ./update.sh;
+
  meta = with lib; {
    inherit description;
    longDescription = ''
@@ -0,0 +1,39 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl jq xxd gnused diffutils
+set -eu -o pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" &>/dev/null && pwd)"
+
+curl -s 'https://portswigger.net/burp/releases/data' |
+  jq -r '
+      [[
+        .ResultSet.Results[]
+        | select(
+            (.categories | sort) == (["Professional","Community"] | sort)
+            and .releaseChannels == ["Early Adopter"]
+          )
+      ][0].builds[]
+      | select(.ProductPlatform == "Jar")
+    ]' >latest.json
+
+version=$(jq -r '.[0].Version' latest.json)
+
+comm_hex=$(jq -r '.[] | select(.ProductId=="community") .Sha256Checksum' latest.json)
+pro_hex=$(jq -r '.[] | select(.ProductId=="pro") .Sha256Checksum' latest.json)
+
+comm_sri="sha256-$(printf %s "$comm_hex" | xxd -r -p | base64 -w0)"
+pro_sri="sha256-$(printf %s "$pro_hex" | xxd -r -p | base64 -w0)"
+
+sed -i \
+  -e "s|^\(\s*version = \)\"[^\"]*\";|\1\"$version\";|" \
+  -e "/productName = \"community\"/,/hash =/ {
+        s|sha256-[^\"]*|$comm_sri|
+     }" \
+  -e "/productName = \"pro\"/,/hash =/ {
+        s|sha256-[^\"]*|$pro_sri|
+     }" \
+  $SCRIPT_DIR/package.nix
+
+echo "burpsuite → $version"
+echo "  community: $comm_sri"
+echo "  pro      : $pro_sri"
@@ -49,10 +49,8 @@ stdenv.mkDerivation (finalAttrs: {
  cargoRoot = "src/rust";

  cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit (finalAttrs) src;
-    sourceRoot = "${finalAttrs.src.name}/${finalAttrs.cargoRoot}";
+    inherit (finalAttrs) src cargoRoot;
    patches = [ ./use-rsmpeg-0.15.patch ];
-    patchFlags = [ "-p3" ];
    hash = "sha256-7v3gQghByUDWZLJRRGa/7X2ivUumirq6BbexNQcCXCk=";
  };

@@ -6,13 +6,13 @@

 buildGoModule rec {
  pname = "cdncheck";
-  version = "1.1.20";
+  version = "1.1.21";

  src = fetchFromGitHub {
    owner = "projectdiscovery";
    repo = "cdncheck";
    tag = "v${version}";
-    hash = "sha256-qL2SNVHsAH+Z0A5Vv+kBa1O9VgdR7eZ29Z19s5GuTXA=";
+    hash = "sha256-GTYgo5rx4PrWLytqdH3LrasgyEAr1FuPyI26tGRaV0A=";
  };

  vendorHash = "sha256-/1REkZ5+sz/H4T4lXhloz7fu5cLv1GoaD3dlttN+Qd4=";
@@ -14,16 +14,16 @@

 buildGoModule rec {
  pname = "chart-testing";
-  version = "3.12.0";
+  version = "3.13.0";

  src = fetchFromGitHub {
    owner = "helm";
    repo = "chart-testing";
    rev = "v${version}";
-    hash = "sha256-q56ZM+YzL7RRC3RD3xO3K0hIDomKun5xmSKuiDTq1cU=";
+    hash = "sha256-59a86yR/TDAWGCsj3pbDjXJGMvyHYnjsnxzjWr61PuU=";
  };

-  vendorHash = "sha256-kTlqGZVOppf+WMcFw0T9FVbu9eOWAWzotR8fPPyo2Ms=";
+  vendorHash = "sha256-aVXISRthJxxvtrfC0DpewLHCiJPh4tO+SKl3Q9uP14k=";

  postPatch = ''
    substituteInPlace pkg/config/config.go \
@@ -11,14 +11,14 @@

 python3Packages.buildPythonApplication {
  pname = "chirp";
-  version = "0.4.0-unstable-2025-05-14";
+  version = "0.4.0-unstable-2025-05-29";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "kk7ds";
    repo = "chirp";
-    rev = "eb4e4547b517c3d10ede760bcd31eeb448c455dc";
-    hash = "sha256-e10WFYpIy6JnPAqUcapli9Q6R0GxNwb1YjnE4cu+xfk=";
+    rev = "db838b0c1ae9b0964efcd625c415a76ff9fbea4a";
+    hash = "sha256-C8sicZ4krALpsRFbX8Ls5GZc7FUimg2Ix6WsQP2oMvw=";
  };

  nativeBuildInputs = [
@@ -8,17 +8,17 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "clorinde";
-  version = "0.15.1";
+  version = "0.15.2";

  src = fetchFromGitHub {
    owner = "halcyonnouveau";
    repo = "clorinde";
    tag = "clorinde-v${finalAttrs.version}";
-    hash = "sha256-Ynz1pdgckQzMLuUJUGSzNRNwWZKrEZuYgrrT/BxAxzc=";
+    hash = "sha256-CrgJtgFX5RBNfFFr2ZZ0d3oKfryyLAHva7g2JyBFiB8=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-g3pWvoTq1DlKlIDJq79IJrvDiLR0HZRPIt4K1YUPsvM=";
+  cargoHash = "sha256-jUtkhOAosrxHGRbAdzdrgLzL5Xp2YhxcrG/dcwUhdLg=";

  cargoBuildFlags = [ "--package=clorinde" ];

@@ -11,16 +11,16 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "clouddrive2";
-  version = "0.8.19";
+  version = "0.8.20";

  src = fetchurl {
    url = "https://github.com/cloud-fs/cloud-fs.github.io/releases/download/v${finalAttrs.version}/clouddrive-2-${os}-${arch}-${finalAttrs.version}.tgz";
    hash =
      {
-        x86_64-linux = "sha256-pLimn6OfqByOyFIDYq0VD4yQ0BpL+st5VwYBKP5zSug=";
-        aarch64-linux = "sha256-Xr3locwzuCg0LRPvNBphhleHFZOnXLi9Md8R17k4vWU=";
-        x86_64-darwin = "sha256-klwicOa/jbjsGL09HR6v2CTA+vhHd1EjCbblAmEPqWQ=";
-        aarch64-darwin = "sha256-47AbC8SHDb1hRlePF6CszHqf2gpwIxsOhJK4+PMCHbQ=";
+        x86_64-linux = "sha256-pDZmrPLIppMMj8KqNGQLUM4ue43vSwVyEKCYrN0G2LM=";
+        aarch64-linux = "sha256-GraqtexpHN+bpArA1HQDYC7DG2QHK1P7o9QDXyFEir4=";
+        x86_64-darwin = "sha256-X/Gf4OipbUM8FwAYfA1+yMBVbsZK5UYz4HFiOYYaTdA=";
+        aarch64-darwin = "sha256-jmsj1VPpxTgly0xIB5pxl79NBZe1zp9rqAYePScMe80=";
      }
      .${stdenv.hostPlatform.system} or (throw "unsupported system ${stdenv.hostPlatform.system}");
  };
@@ -106,11 +106,11 @@ in
 # Note: when upgrading this package, please run the list-missing-tools.sh script as described below!
 python.pkgs.buildPythonApplication rec {
  pname = "diffoscope";
-  version = "295";
+  version = "297";

  src = fetchurl {
    url = "https://diffoscope.org/archive/diffoscope-${version}.tar.bz2";
-    hash = "sha256-BxyE14vXS7lGFwWsruDAcdXMRsoETFwXPQxfMpSh1+E=";
+    hash = "sha256-3dEZb7XZluTi+sUTgSqwLzCdNMJwekt1Em0XEDSAY/E=";
  };

  outputs = [
@@ -17,13 +17,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "distroshelf";
-  version = "1.0.7";
+  version = "1.0.8";

  src = fetchFromGitHub {
    owner = "ranfdev";
    repo = "DistroShelf";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-4xiqdLSmO9LXfVwF/QRJL8BhZDsNistdGVVT4YDdt4A=";
+    hash = "sha256-UZP/VohgYUe6Ly89oD9WlYyiAfQmTK1lXnf5TipoiNI=";
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
@@ -1,7 +1,7 @@
 { mkDprintPlugin }:
 mkDprintPlugin {
  description = "TypeScript/JavaScript code formatter.";
-  hash = "sha256-g41K7aTCZZc1zRoc9k1oG8rk88ZwJJH3jnnX+MKQ9mE=";
+  hash = "sha256-sn10yaYbp6VWspqEMKCd7HbDvKi35AW5Xn8FGzzN3kM=";
  initConfig = {
    configExcludes = [ "**/node_modules" ];
    configKey = "typescript";
@@ -16,6 +16,6 @@ mkDprintPlugin {
  };
  pname = "dprint-plugin-typescript";
  updateUrl = "https://plugins.dprint.dev/dprint/typescript/latest.json";
-  url = "https://plugins.dprint.dev/typescript-0.95.4.wasm";
-  version = "0.95.4";
+  url = "https://plugins.dprint.dev/typescript-0.95.5.wasm";
+  version = "0.95.5";
 }
@@ -8,7 +8,7 @@

 let
  themeName = "Dracula";
-  version = "4.0.0-unstable-2025-04-27";
+  version = "4.0.0-unstable-2025-05-24";
 in
 stdenvNoCC.mkDerivation {
  pname = "dracula-theme";
@@ -17,8 +17,8 @@ stdenvNoCC.mkDerivation {
  src = fetchFromGitHub {
    owner = "dracula";
    repo = "gtk";
-    rev = "3834a1bac175b226cff6b1c94faac9aba2819bd5";
-    hash = "sha256-T0X0h4Bz3sy5jqtB1PkpjFnB8jO3CehOxgRwPPG54Ds=";
+    rev = "74255b110e7e5f50a07f500f739bc59c2cbee472";
+    hash = "sha256-0NA/MTmcgRlR6JEOFz1+SgyoRwRygygEWAQDrpznA5w=";
  };

  propagatedUserEnvPkgs = [
@@ -0,0 +1,47 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  buildGoModule,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "dsnet";
+  version = "0.8.1";
+
+  src = fetchFromGitHub {
+    owner = "naggie";
+    repo = "dsnet";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-CKDtILZMWFeSU5nTSguM2fi0BCFdvR2LqELIZ6LYOMk=";
+  };
+  vendorHash = "sha256-Q2Ipj9yZ+/GUBEmDvgwFLLww7EXnbvdvj/shGQnh1G8=";
+
+  subPackages = [ "cmd" ];
+
+  postInstall = ''
+    mv $out/bin/cmd $out/bin/dsnet
+  '';
+
+  # The ldflags reduce the executable size by stripping some debug stuff.
+  # The other variables are set so that the output of dsnet version shows the
+  # git ref and the release version from github.
+  # Ref <https://github.com/NixOS/nixpkgs/pull/87383#discussion_r432097657>
+  ldflags = [
+    "-w"
+    "-s"
+    "-X github.com/naggie/dsnet.VERSION=${finalAttrs.src.tag}"
+    "-X github.com/naggie/dsnet.GIT_COMMIT=${finalAttrs.src.tag}"
+  ];
+
+  meta = {
+    description = "Fast command to manage a centralised Wireguard VPN";
+    homepage = "https://github.com/naggie/dsnet";
+    changelog = "https://github.com/naggie/dsnet/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.linux;
+    maintainers = [ lib.maintainers.naggie ];
+    mainProgram = "dsnet";
+  };
+
+})
@@ -59,11 +59,11 @@ stdenv.mkDerivation (finalAttrs: {
  '';

  installPhase = ''
-    mkdir -p $out/{bin,share/${finalAttrs.pname}-${finalAttrs.version}}
-    cp -r * $out/share/${finalAttrs.pname}-${finalAttrs.version}/.
+    mkdir -p $out/{bin,share/flaresolverr-${finalAttrs.version}}
+    cp -r * $out/share/flaresolverr-${finalAttrs.version}/.

    makeWrapper ${python}/bin/python $out/bin/flaresolverr \
-      --add-flags "$out/share/${finalAttrs.pname}-${finalAttrs.version}/src/flaresolverr.py" \
+      --add-flags "$out/share/flaresolverr-${finalAttrs.version}/src/flaresolverr.py" \
      --prefix PATH : "${lib.makeBinPath [ xorg.xvfb ]}"
  '';

@@ -20,7 +20,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
  };

  cargoHash = "sha256-7mApZj3Ksy8Av0W+0+UZQCkH281bSBd4xo8/7JowmHs=";
-  cargoDepsName = finalAttrs.pname;
+  cargoDepsName = "geoclock";

  meta = {
    description = "Displays time as calculated by your longitude";
@@ -24,8 +24,8 @@ let
 in

 stdenv.mkDerivation rec {
-  srcVersion = "may25a";
-  version = "20250501_a";
+  srcVersion = "jun25a";
+  version = "20250601_a";
  pname = "gildas";

  src = fetchurl {
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
      "http://www.iram.fr/~gildas/dist/gildas-src-${srcVersion}.tar.xz"
      "http://www.iram.fr/~gildas/dist/archive/gildas/gildas-src-${srcVersion}.tar.xz"
    ];
-    hash = "sha256-ofcuwc4vIKLbY/2uRqWG4sdrm9N0hpqz6zYwkZyySWo=";
+    hash = "sha256-DhUGaG96bsZ1NGfDQEujtiM0AUwZBMD42uRpRWI5DX0=";
  };

  nativeBuildInputs = [
@@ -11,16 +11,16 @@

 buildGoModule rec {
  pname = "gitleaks";
-  version = "8.26.0";
+  version = "8.27.0";

  src = fetchFromGitHub {
    owner = "zricethezav";
    repo = "gitleaks";
    tag = "v${version}";
-    hash = "sha256-lBIoEUjAllhUTS9PRSqdWUeBhEGs6wOHOWivj0PC9Is=";
+    hash = "sha256-62Tcj5NiEk4uaGpiallCjDzpkFbuTazfMiemEe+ATLg=";
  };

-  vendorHash = "sha256-MSF9N9kXsIM2WKsjKAVztYypwGPng2EElHx7p6vADqc=";
+  vendorHash = "sha256-vd39TbooEdmYa6QZGEnYOmYU9p+9mV+SrLKVY+h/PEM=";

  ldflags = [
    "-s"
@@ -15,16 +15,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "gleam";
-  version = "1.10.0";
+  version = "1.11.0";

  src = fetchFromGitHub {
    owner = "gleam-lang";
    repo = "gleam";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-0qK9dWkKnoXbIIBMN3p5noPEke/bgC8Bjtmf6lwtyr4=";
+    hash = "sha256-oxzFAqPZ+ZHd/+GwofDg0gA4NIFYWi2v8fOjMn8ixSU=";
  };

-  cargoHash = "sha256-EoRu8p6cUe1li54nVUkf+3qywIsDXh4ptIVLluJ3eFs=";
+  cargoHash = "sha256-9kk7w85imYIhywBuAgJS8wYAIEM3hXoHymGgMMmrgnI=";

  nativeBuildInputs = [
    git
@@ -53,7 +53,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
    homepage = "https://gleam.run/";
    changelog = "https://github.com/gleam-lang/gleam/blob/v${finalAttrs.version}/CHANGELOG.md";
    license = lib.licenses.asl20;
-    maintainers = [ lib.maintainers.philtaken ];
+    maintainers = with lib.maintainers; [
+      philtaken
+      llakala
+    ];
    teams = [ lib.teams.beam ];
  };
 })
@@ -1,13 +0,0 @@
-diff --git a/configure b/configure
-index 1b20711..79ce215 100644
--- a/configure
-+++ b/configure
-@@ -679,7 +679,7 @@ cat > conftest.$ac_ext << EOF
- #line 680 "configure"
- #include "confdefs.h"
- 
-main(){return(0);}
-+int main(){return(0);}
- EOF
- if { (eval echo configure:685: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
-   ac_cv_prog_cc_works=yes
@@ -7,21 +7,17 @@

 stdenv.mkDerivation rec {
  pname = "gopher";
-  version = "3.0.18";
+  version = "3.0.19";

  src = fetchFromGitHub {
    owner = "jgoerzen";
    repo = "gopher";
    rev = "release/${version}";
-    sha256 = "sha256-YAcpEV3SbiUZ4nqYk6k1M41YWdTGSSH7rNB15gv31qQ=";
+    sha256 = "sha256-8J63TnC3Yq7+64PPLrlPEueMa9D/eWkPsb08t1+rPAA=";
  };

  buildInputs = [ ncurses ];

-  patches = [
-    ./int_main.patch # https://github.com/jgoerzen/gopher/pull/8
-  ];
-
  preConfigure = "export LIBS=-lncurses";

  meta = with lib; {
@@ -9,16 +9,16 @@

 buildGoModule rec {
  pname = "helm-ls";
-  version = "0.2.2";
+  version = "0.3.0";

  src = fetchFromGitHub {
    owner = "mrjosh";
    repo = "helm-ls";
    rev = "v${version}";
-    hash = "sha256-NI9qtbt0Ci300DhDR+yjFThTGLXKrbsc1wuLPpC1l9o=";
+    hash = "sha256-OxrPqDa2g5jmm+XtLE0YCnVhkvVK60xxrO49Gl8VT60=";
  };

-  vendorHash = "sha256-1BO/0Ous4mclainPV+nqk5K+tHKgRnaxMtsI4xAhZF4=";
+  vendorHash = "sha256-w/BWPbpSYum0SU8PJj76XiLUjTWO4zNQY+khuLRK0O8=";

  nativeBuildInputs = [ installShellFiles ];

@@ -6,16 +6,16 @@
 }:
 buildGoModule rec {
  pname = "hyprls";
-  version = "0.6.0";
+  version = "0.7.0";

  src = fetchFromGitHub {
    owner = "hyprland-community";
    repo = "hyprls";
    rev = "v${version}";
-    hash = "sha256-sXC/JMd2NYc74k19DxZyldH+QLZ6W8dVHy0uyqyuCmg=";
+    hash = "sha256-cJDDyF44nD/XvxtaGPYCk2MC574HDBHP1ByhVwqatvQ=";
  };

-  vendorHash = "sha256-rG+oGJOABA9ee5nIpC5/U0mMsPhwvVtQvJBlQWfxi5Y=";
+  vendorHash = "sha256-WTdwIAC3gDWgCKlVuOtMyl0ZfdZ9RhlpqUl2S2d65HA=";

  checkFlags = [
    # Not yet implemented
@@ -9,15 +9,24 @@

 stdenv.mkDerivation rec {
  pname = "ike-scan";
-  version = "1.9.5";
+  version = "1.9.5-unstable-2024-09-15";

  src = fetchFromGitHub {
    owner = "royhills";
    repo = "ike-scan";
-    rev = version;
-    sha256 = "sha256-mbfg8p3y4aKoXpmLuF9GXAMPEqV5CsvetwGCRDJ9UNY=";
+    rev = "c74c01fd22d9a3aae3d8ba9a0bd2eb1a2146ac6f";
+    hash = "sha256-+eicvirqzZrAJiaGaVjqZlSpU2+jTG/MRPv50P+1Tpc=";
  };

+  patches = [
+    # Using the same patches as for the Fedora RPM
+    (fetchpatch {
+      # Memory leaks, https://github.com/royhills/ike-scan/pull/15
+      url = "https://github.com/royhills/ike-scan/pull/15/commits/d864811de08dcddd65ac9b8d0f2acf5d7ddb9dea.patch";
+      hash = "sha256-VVJZSTZfDV0qHuxdNoZV1NXJYCEMtB0bO1oi2hLCeXE=";
+    })
+  ];
+
  nativeBuildInputs = [
    autoreconfHook
    openssl
@@ -25,15 +34,6 @@ stdenv.mkDerivation rec {

  configureFlags = [ "--with-openssl=${openssl.dev}" ];

-  patches = [
-    # Using the same patches as for the Fedora RPM
-    (fetchpatch {
-      # Memory leaks, https://github.com/royhills/ike-scan/pull/15
-      url = "https://github.com/royhills/ike-scan/pull/15/commits/d864811de08dcddd65ac9b8d0f2acf5d7ddb9dea.patch";
-      sha256 = "0wbrq89dl8js7cdivd0c45hckmflan33cpgc3qm5s3az6r4mjljm";
-    })
-  ];
-
  meta = with lib; {
    description = "Tool to discover, fingerprint and test IPsec VPN servers";
    longDescription = ''
@@ -41,7 +41,7 @@ stdenv.mkDerivation rec {
      fingerprint and test IPsec VPN servers.
    '';
    homepage = "https://github.com/royhills/ike-scan";
-    license = with licenses; [ gpl3Plus ];
+    license = licenses.gpl3Plus;
    platforms = platforms.linux;
    maintainers = with maintainers; [ fab ];
  };
@@ -8,13 +8,13 @@

 buildGoModule rec {
  pname = "kool";
-  version = "3.5.0";
+  version = "3.5.2";

  src = fetchFromGitHub {
    owner = "kool-dev";
    repo = "kool";
    rev = version;
-    hash = "sha256-iB/9owaBNQVzdA4edrx0zl+COs7yVLs61Mij5kfjEhg=";
+    hash = "sha256-yUJbuMOLEa9LVRltskSwD0XBdmwwLcEaLYUHsSQOiCk=";
  };

  vendorHash = "sha256-IqUkIf0uk4iUTedTO5xRzjmJwHS+p6apo4E0WEEU6cc=";
@@ -8,17 +8,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "krapslog";
-  version = "0.6.0";
+  version = "0.6.1";

  src = fetchFromGitHub {
    owner = "acj";
    repo = "krapslog-rs";
    rev = version;
-    sha256 = "sha256-wRziLNMwLZBCn330FNC9x6loCCyuC+31Kh51ZI/j1Cc=";
+    sha256 = "sha256-c/Zh4fOsSKY0XopaklRbFEh4QM5jjUcj0zhAx5v9amI=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-Mv0wTuTWCsBGjlr4BhLezBOCtgQ0qq2kwLcZxU1nREM=";
+  cargoHash = "sha256-cXK7YZ9i/eKXTHPYnJcvcKyzFlZDnqmCBrEa75Mxfqc=";

  buildInputs = lib.optional stdenv.hostPlatform.isDarwin libiconv;

@@ -11,16 +11,16 @@

 buildGoModule (finalAttrs: {
  pname = "krillinai";
-  version = "1.1.5";
+  version = "1.2.1-hotfix-2";

  src = fetchFromGitHub {
    owner = "krillinai";
    repo = "KrillinAI";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-jQlgkpQ+UTzn6MqGa+yVQ9v04IGGlMQQim3s0Oc9Zts=";
+    hash = "sha256-Dw30Lsf4pHMDlrLmdoU+4v5SJfzx5UId6v/OocrsiS4=";
  };

-  vendorHash = "sha256-mpvypCZmvVVljftGpcV1aea3s7Xmhr0jLfKZIZ0nkX8=";
+  vendorHash = "sha256-14YNdIfylUpcWqHhrpgmjxBHYRXaoR59jb1QdTckuLY=";

  nativeBuildInputs = [ pkg-config ];

@@ -1,13 +0,0 @@
-diff --git a/src/Makefile b/src/Makefile
-index 2af4804..bcff809 100644
--- a/src/Makefile
-+++ b/src/Makefile
-@@ -80,7 +80,7 @@ PREFIX ?= /usr/local
- LIBDIRNAME ?= /lib/faketime
- PLATFORM ?=$(shell uname)
- 
-CFLAGS += -std=gnu99 -Wall -Wextra -Werror -Wno-nonnull-compare -DFAKE_PTHREAD -DFAKE_STAT -DFAKE_UTIME -DFAKE_SLEEP -DFAKE_TIMERS -DFAKE_INTERNAL_CALLS -fPIC -DPREFIX='"'$(PREFIX)'"' -DLIBDIRNAME='"'$(LIBDIRNAME)'"' $(FAKETIME_COMPILE_CFLAGS)
-+CFLAGS += -std=gnu99 -Wall -Wextra -DFAKE_PTHREAD -DFAKE_STAT -DFAKE_UTIME -DFAKE_SLEEP -DFAKE_TIMERS -DFAKE_INTERNAL_CALLS -fPIC -DPREFIX='"'$(PREFIX)'"' -DLIBDIRNAME='"'$(LIBDIRNAME)'"' $(FAKETIME_COMPILE_CFLAGS)
- ifeq ($(PLATFORM),SunOS)
- CFLAGS += -D__EXTENSIONS__ -D_XOPEN_SOURCE=600
- endif
@@ -9,41 +9,26 @@

 stdenv.mkDerivation rec {
  pname = "libfaketime";
-  version = "0.9.10";
+  version = "0.9.11";

  src = fetchFromGitHub {
    owner = "wolfcw";
    repo = "libfaketime";
    rev = "v${version}";
-    sha256 = "sha256-DYRuQmIhQu0CNEboBAtHOr/NnWxoXecuPMSR/UQ/VIQ=";
+    sha256 = "sha256-a0TjHYzwbkRQyvr9Sj/DqjgLBnE1Z8kjsTQxTfGqLjE=";
  };

-  patches =
-    [
-      ./nix-store-date.patch
-      (fetchpatch {
-        name = "0001-libfaketime.c-wrap-timespec_get-in-TIME_UTC-macro.patch";
-        url = "https://github.com/wolfcw/libfaketime/commit/e0e6b79568d36a8fd2b3c41f7214769221182128.patch";
-        sha256 = "sha256-KwwP76v0DXNW73p/YBvwUOPdKMAcVdbQSKexD/uFOYo=";
-      })
-      (fetchpatch {
-        name = "LFS64.patch";
-        url = "https://github.com/wolfcw/libfaketime/commit/f32986867addc9d22b0fab29c1c927f079d44ac1.patch";
-        hash = "sha256-fIXuxxcV9J2IcgwcwSrMo4maObkH9WYv1DC/wdtbq/g=";
-      })
-    ]
-    ++ (lib.optionals stdenv.cc.isClang [
-      # https://github.com/wolfcw/libfaketime/issues/277
-      ./0001-Remove-unsupported-clang-flags.patch
-    ]);
+  patches = [
+    ./nix-store-date.patch
+  ];

  postPatch = ''
    patchShebangs test src
    for a in test/functests/test_exclude_mono.sh src/faketime.c ; do
      substituteInPlace $a \
-        --replace /bin/bash ${stdenv.shell}
+        --replace-fail /bin/bash ${stdenv.shell}
    done
-    substituteInPlace src/faketime.c --replace @DATE_CMD@ ${coreutils}/bin/date
+    substituteInPlace src/faketime.c --replace-fail @DATE_CMD@ ${coreutils}/bin/date
  '';

  PREFIX = placeholder "out";
@@ -1,34 +1,50 @@
 {
  lib,
  stdenv,
-  fetchurl,
+  fetchFromGitLab,
+  autoreconfHook,
+  bison,
+  flex,
  libogg,
  libpng,
+  pkg-config,
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "libkate";
-  version = "0.4.1";
+  version = "0.4.3";

-  src = fetchurl {
-    url = "https://storage.googleapis.com/google-code-archive-downloads/v2/code.google.com/libkate/${pname}-${version}.tar.gz";
-    sha256 = "0s3vr2nxfxlf1k75iqpp4l78yf4gil3f0v778kvlngbchvaq23n4";
+  src = fetchFromGitLab {
+    domain = "gitlab.xiph.org/";
+    owner = "xiph";
+    repo = "kate";
+    tag = "kate-${finalAttrs.version}";
+    hash = "sha256-HwDahmjDC+O321Ba7MnHoQdHOFUMpFzaNdLHQeEg11Q=";
  };

+  nativeBuildInputs = [
+    autoreconfHook
+    bison
+    flex
+    pkg-config # provides macro PKG_CHECK_MODULES
+  ];
+
  buildInputs = [
    libogg
    libpng
  ];

-  meta = with lib; {
+  enableParallelBuilding = true;
+
+  meta = {
    description = "Library for encoding and decoding Kate streams";
    longDescription = ''
      This is libkate, the reference implementation of a codec for the Kate
      bitstream format. Kate is a karaoke and text codec meant for encapsulation
      in an Ogg container. It can carry Unicode text, images, and animate
      them.'';
-    homepage = "https://code.google.com/archive/p/libkate/";
-    platforms = platforms.unix;
-    license = licenses.bsd3;
+    homepage = "https://wiki.xiph.org/index.php/OggKate";
+    platforms = lib.platforms.unix;
+    license = lib.licenses.bsd3;
  };
-}
+})
@@ -7,13 +7,13 @@

 buildGoModule rec {
  pname = "logdy";
-  version = "0.16.0";
+  version = "0.17.0";

  src = fetchFromGitHub {
    owner = "logdyhq";
    repo = "logdy-core";
    tag = "v${version}";
-    hash = "sha256-OpG9jgm/A++PBDQH5IYY6PyXx87QvihyZqnwhdBWZGg=";
+    hash = "sha256-779ZO9WhE3IKbHJLchCfrIepMH+GOrlQJALLpoNZvbc=";
  };

  vendorHash = "sha256-kFhcbBMymzlJ+2zw7l09LJfCdps26Id+VzOehqrLDWU=";
@@ -10,7 +10,7 @@
  nix-update-script,
 }:
 let
-  version = "0.7.0";
+  version = "0.8.0";
 in
 rustPlatform.buildRustPackage {
  pname = "manga-tui";
@@ -20,11 +20,11 @@ rustPlatform.buildRustPackage {
    owner = "josueBarretogit";
    repo = "manga-tui";
    rev = "v${version}";
-    hash = "sha256-1WFg2hG3UnOO9+HpUcdPkZNhsNYa2QG1PhzLZ4bQiQM=";
+    hash = "sha256-81P5LwL9njxA0qx4FvqgrHdqVgUXkZTTzAXLdRTftS4=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-1nERwIZCR/afgfGdronpy145GnDkbsB7YjF6XyDcfEY=";
+  cargoHash = "sha256-dne0sJ0K/UVXGaj/vUM9O++ZS0hu69bdLnV8VAr3tbM=";

  nativeBuildInputs = [ pkg-config ];

@@ -7,13 +7,13 @@

 buildGoModule rec {
  pname = "minio-client";
-  version = "2025-04-16T18-13-26Z";
+  version = "2025-05-21T01-59-54Z";

  src = fetchFromGitHub {
    owner = "minio";
    repo = "mc";
    rev = "RELEASE.${version}";
-    sha256 = "sha256-23shNQWVIuTLL0FLM00919JaT2QR4R0ou5ZA2/mQ4PA=";
+    sha256 = "sha256-ss/GqOJz9FNrQzYABb8ePCMcmNVTYVji/Id1WOuu24M=";
  };

  vendorHash = "sha256-MpLQZFrf2sBAweXtYeFi5j6p6GaXuN99x+r4UK8D9xM=";
@@ -9,22 +9,24 @@
  ghostscript,
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "ne";
  version = "3.3.4";

  src = fetchFromGitHub {
    owner = "vigna";
    repo = "ne";
-    rev = version;
-    sha256 = "sha256-n8PERQD9G4jmW4avQjbFofrSapyRoSbQ2k1LzVt0i1o=";
+    tag = finalAttrs.version;
+    hash = "sha256-n8PERQD9G4jmW4avQjbFofrSapyRoSbQ2k1LzVt0i1o=";
  };

  postPatch = ''
-    substituteInPlace makefile --replace "./version.pl" "perl version.pl"
-    substituteInPlace src/makefile --replace "-lcurses" "-lncurses"
+    substituteInPlace makefile --replace-fail "./version.pl" "perl version.pl"
+    substituteInPlace src/makefile --replace-fail "-lcurses" "-lncurses"
  '';

+  strictDeps = true;
+
  nativeBuildInputs = [
    texliveMedium
    texinfo6
@@ -35,18 +37,20 @@ stdenv.mkDerivation rec {

  makeFlags = [ "PREFIX=${placeholder "out"}" ];

-  meta = with lib; {
+  meta = {
    description = "Nice editor";
    homepage = "https://ne.di.unimi.it/";
+    changelog = "https://github.com/vigna/ne/releases/tag/${finalAttrs.version}";
+    downloadPage = "https://github.com/vigna/ne";
    longDescription = ''
      ne is a free (GPL'd) text editor based on the POSIX standard that runs
      (we hope) on almost any UN*X machine.  ne is easy to use for the beginner,
      but powerful and fully configurable for the wizard, and most sparing in its
      resource usage.  See the manual for some highlights of ne's features.
    '';
-    license = licenses.gpl3;
-    platforms = platforms.unix;
-    maintainers = with maintainers; [ geri1701 ];
+    license = lib.licenses.gpl3Only;
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [ geri1701 ];
    mainProgram = "ne";
  };
-}
+})
@@ -1,58 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchurl,
-  curl,
-  libmrss,
-  podofo,
-  libiconv,
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "offrss";
-  version = "1.3";
-
-  installPhase = ''
-    mkdir -p $out/bin
-    cp offrss $out/bin
-  '';
-
-  buildInputs =
-    [
-      curl
-      libmrss
-    ]
-    ++ lib.optional (stdenv.hostPlatform == stdenv.buildPlatform) podofo
-    ++ lib.optional (!stdenv.hostPlatform.isLinux) libiconv;
-
-  # Workaround build failure on -fno-common toolchains:
-  #   ld: serve_pdf.o:offrss.h:75: multiple definition of `cgi_url_path';
-  #     offrss.o:offrss.h:75: first defined here
-  env.NIX_CFLAGS_COMPILE = "-fcommon -Wno-error=implicit-function-declaration";
-
-  configurePhase =
-    ''
-      substituteInPlace Makefile \
-        --replace '$(CC) $(CFLAGS) $(LDFLAGS)' '$(CXX) $(CFLAGS) $(LDFLAGS)'
-    ''
-    + lib.optionalString (!stdenv.hostPlatform.isLinux) ''
-      sed 's/#EXTRA/EXTRA/' -i Makefile
-    ''
-    + lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) ''
-      sed 's/^PDF/#PDF/' -i Makefile
-    '';
-
-  src = fetchurl {
-    url = "http://vicerveza.homeunix.net/~viric/soft/offrss/offrss-${finalAttrs.version}.tar.gz";
-    hash = "sha256-5oIiDLdFrnEfPfSiwCv3inIcxK+bbgbMT1VISVAPfKo=";
-  };
-
-  meta = {
-    homepage = "http://vicerveza.homeunix.net/~viric/cgi-bin/offrss";
-    description = "Offline RSS/Atom reader";
-    license = lib.licenses.agpl3Plus;
-    maintainers = [ ];
-    platforms = lib.platforms.linux;
-    mainProgram = "offrss";
-  };
-})
@@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "ogen";
-  version = "1.13.0";
+  version = "1.14.0";

  src = fetchFromGitHub {
    owner = "ogen-go";
    repo = "ogen";
    tag = "v${version}";
-    hash = "sha256-M2xKxaf+iWXTq+vMXsucMmVqs9BarCoyG6prmwcL8KI=";
+    hash = "sha256-w3h65MNXBgsH8PCHfoPqY+XNI6TMbLUAMI4Y3WWLEJM=";
  };

-  vendorHash = "sha256-TVnTg+SbTmpdfxWSr3KIPioQ/0OlUxCuCfyn5oMWPu8=";
+  vendorHash = "sha256-PQ2ZrigS9jZY1oL3Dsuc2RZwedZLzLKUqhMYfWiZ854=";

  patches = [ ./modify-version-handling.patch ];

@@ -81,18 +81,18 @@ buildGoModule (

  {
    pname = "olivetin";
-    version = "2025.5.26";
+    version = "2025.6.1";

    src = fetchFromGitHub {
      owner = "OliveTin";
      repo = "OliveTin";
      tag = finalAttrs.version;
-      hash = "sha256-BD52MxIHE56y3oWuRTCYmrEYMge70/MXt4B6g84ahF0=";
+      hash = "sha256-Bd+zxVEhP7LZk74Mfai/MkML1pKlPBKm4kh4jAkC/kQ=";
    };

    modRoot = "service";

-    vendorHash = "sha256-kfk4QFG+l+XKkKoOs2C1B6ZuMeeDz9DrzzR46S8Qnyk=";
+    vendorHash = "sha256-8rPJoB75de2Y56iyIwdI9HPk7OlCgfMPy28TW1i7+sU=";

    ldflags = [
      "-s"
@@ -117,13 +117,13 @@ in
 goBuild (finalAttrs: {
  pname = "ollama";
  # don't forget to invalidate all hashes each update
-  version = "0.7.1";
+  version = "0.9.0";

  src = fetchFromGitHub {
    owner = "ollama";
    repo = "ollama";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-ee2MkvdVDQaSFJDDuXEwedqOB2DUl3MIfp5tRxqbL8A=";
+    hash = "sha256-+8UHE9M2JWUARuuIRdKwNkn1hoxtuitVH7do5V5uEg0=";
    fetchSubmodules = true;
  };

@@ -35,8 +35,7 @@ stdenv.mkDerivation (finalAttrs: {
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit (finalAttrs) src;
-    sourceRoot = "source/${finalAttrs.cargoRoot}";
+    inherit (finalAttrs) src cargoRoot;
    hash = "sha256-T79G2bShJuFRfaCqG3IDHqW0s68yAdGyv58kdDYg6kg=";
  };
  cargoRoot = "extensions";
@@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "phrase-cli";
-  version = "2.40.0";
+  version = "2.42.0";

  src = fetchFromGitHub {
    owner = "phrase";
    repo = "phrase-cli";
    rev = version;
-    sha256 = "sha256-d/B5XzEAM1GlpQxshy0kEJexF01FlF99hnoctKDXhp0=";
+    sha256 = "sha256-dLdgJdR2faxpfHmYhhzn7nQxTrXDhF6XqOIKFLXDEj4=";
  };

-  vendorHash = "sha256-VV4ctHj9fPosAgqBOfkqOKETSeGJXFPPP+kBMgqV2nk=";
+  vendorHash = "sha256-zVIxBZ2zTXk407piA4dXxKfyD7Ke8RIq7lYogr/+rcs=";

  ldflags = [ "-X=github.com/phrase/phrase-cli/cmd.PHRASE_CLIENT_VERSION=${version}" ];

@@ -27,14 +27,14 @@ stdenv.mkDerivation (finalAttrs: {
  passthru.updateScript = _experimental-update-script-combinators.sequence [
    (nix-update-script { })
    (lib.getExe (writeShellApplication {
-      name = "${finalAttrs.pname}-dependencies-updater";
+      name = "podman-desktop-dependencies-updater";
      runtimeInputs = [
        nix
        jq
        gnugrep
      ];
      runtimeEnv = {
-        PNAME = finalAttrs.pname;
+        PNAME = "podman-desktop";
        PKG_FILE = builtins.toString ./package.nix;
      };
      text = ''
@@ -5,17 +5,18 @@
  autoreconfHook,
  libelf,
  libiberty,
+  unstableGitUpdater,
 }:

 stdenv.mkDerivation {
  pname = "prelink";
-  version = "unstable-2019-06-24";
+  version = "20151030-unstable-2024-07-02";

  src = fetchgit {
-    url = "https://git.yoctoproject.org/git/prelink-cross";
+    url = "https://git.yoctoproject.org/prelink-cross";
    branchName = "cross_prelink";
-    rev = "f9975537dbfd9ade0fc813bd5cf5fcbe41753a37";
-    sha256 = "sha256-O9/oZooLRyUBBZX3SFcB6LFMmi2vQqkUlqtZnrq5oZc=";
+    rev = "ff2561c02ade96c5d4d56ddd4e27ff064840a176";
+    sha256 = "sha256-wmX7ybrZDWEop9fiInZMvgK/fpEk3sq+Wu8DSWWIvQY=";
  };

  strictDeps = true;
@@ -40,6 +41,8 @@ stdenv.mkDerivation {

  enableParallelBuilding = true;

+  passthru.updateScript = unstableGitUpdater { };
+
  meta = with lib; {
    description = "ELF prelinking utility to speed up dynamic linking";
    homepage = "https://wiki.yoctoproject.org/wiki/Cross-Prelink";
@@ -7,20 +7,20 @@

 buildNpmPackage rec {
  pname = "protoc-gen-es";
-  version = "2.5.0";
+  version = "2.5.1";

  src = fetchFromGitHub {
    owner = "bufbuild";
    repo = "protobuf-es";
    tag = "v${version}";
-    hash = "sha256-wllLeX7veCbpb/mTAIs0cf/hcVItEmw2HW/UR4k0Epc=";
+    hash = "sha256-afCfRi9YSQS8BoYrDR66FBW7sbfYvSxVSpxYM8F6CRw=";

    postFetch = ''
      ${lib.getExe npm-lockfile-fix} $out/package-lock.json
    '';
  };

-  npmDepsHash = "sha256-PGieFyPgb2ERTdQc3HH5mg/uh5xj7nkUa0qwmgxofVY=";
+  npmDepsHash = "sha256-DDFMQqWoixZZ9u8MLOEaKiPAOB3pEGnsF7el8AIOPrc=";

  npmWorkspace = "packages/protoc-gen-es";

@@ -5,16 +5,16 @@
 }:
 buildGoModule rec {
  pname = "protolint";
-  version = "0.55.5";
+  version = "0.55.6";

  src = fetchFromGitHub {
    owner = "yoheimuta";
    repo = "protolint";
    rev = "v${version}";
-    hash = "sha256-uim4M1C51VVCOhcE/dyCLzx/Bks0h50+haw5mbAfiN8=";
+    hash = "sha256-RTej9zVQz6GESAoAAChidiolGEoHabUYlEZSV2gc8KQ=";
  };

-  vendorHash = "sha256-Zt1HbmdUpQmmK+404tfSs6qfZxZEqHIgQBoN63Els3M=";
+  vendorHash = "sha256-RS0t7n6pLYVKHluQtXsMjYL1SvN7IZFdKmkxOI8wFoE=";

  # Something about the way we run tests causes issues. It doesn't happen
  # when using "go test" directly:
@@ -6,17 +6,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "protols";
-  version = "0.12.0";
+  version = "0.12.5";

  src = fetchFromGitHub {
    owner = "coder3101";
    repo = "protols";
    tag = version;
-    hash = "sha256-v4ROQVoJmrukHFrxykr6EuBFXRuaBnPZ7f36ly7rPhg=";
+    hash = "sha256-zs78TKZU35UGAmEXK3EA9B6zRCqeCtNexHVAJERKyX8=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-fmsPkXwu8qy+SRyP5w940gqNmXg0V/p/vDSI7EIFrh0=";
+  cargoHash = "sha256-Lh6KJ5zclT650tPIpMJBALLj4gnis+fglhewiZ5mpMs=";

  meta = {
    description = "Protocol Buffers language server written in Rust";
@@ -37,7 +37,7 @@ python3Packages.buildPythonApplication rec {
  meta = {
    description = "Python package to interact with Kickstart files commonly found in the RPM world";
    homepage = "https://github.com/pykickstart/pykickstart";
-    changelog = "https://github.com/pykickstart/pykickstart/releases/tag/r${src.tag}";
+    changelog = "https://github.com/pykickstart/pykickstart/releases/tag/${src.tag}";
    license = lib.licenses.gpl2Only;
    maintainers = with lib.maintainers; [
      thefossguy
@@ -15,12 +15,12 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "qmk";
-  version = "1.1.7";
+  version = "1.1.8";
  format = "pyproject";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-4Qhzsa5GAAeSgt7FZsRWIVO1ZB+010WtBv9SV38Xgto=";
+    hash = "sha256-C0Jra/IK61tngGsuEnMD4mySRc/iZVgdYEbMXtwpBZ0=";
  };

  nativeBuildInputs = with python3.pkgs; [
@@ -7,14 +7,14 @@

 python3.pkgs.buildPythonApplication {
  pname = "renode-dts2repl";
-  version = "0-unstable-2025-05-20";
+  version = "0-unstable-2025-05-28";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "antmicro";
    repo = "dts2repl";
-    rev = "be40a3764a727a7a22eebb481b1fd3e0f70fca8c";
-    hash = "sha256-r+7J7AgWpBZuGpPU7EBn0KxM5ksHC6aED4oLe4oZzfQ=";
+    rev = "8413c5a08ed53867493b2a08fd4c730d7b419ee7";
+    hash = "sha256-Dl/JzkUP/mNBxz20C4qH5B3qpXjd4/q/r5n0RO3ga+U=";
  };

  nativeBuildInputs = [
@@ -13,13 +13,13 @@

 stdenv.mkDerivation rec {
  pname = "slirp4netns";
-  version = "1.3.2";
+  version = "1.3.3";

  src = fetchFromGitHub {
    owner = "rootless-containers";
    repo = "slirp4netns";
    rev = "v${version}";
-    sha256 = "sha256-1OiomraQ4wfrBPihGrf9sq8hPJUB45gvf7Y5j7iN8/E=";
+    sha256 = "sha256-dPhUr9GdujTpUsnfvZDp8eOBQwlzqwtwziII2QWD4JA=";
  };

  nativeBuildInputs = [
@@ -5,10 +5,10 @@
 }:
 let
  pname = "snipaste";
-  version = "2.10.6";
+  version = "2.10.7";
  src = fetchurl {
    url = "https://download.snipaste.com/archives/Snipaste-${version}-x86_64.AppImage";
-    hash = "sha256-lkP3YN4ZNbtM2beQEIWPxBE6JXToRBW48QAMLw/TBzQ=";
+    hash = "sha256-WzCSI0BfjolbWbj/mLhRj75tW/CvlbzQtFuBizg8xl4=";
  };
  contents = appimageTools.extract { inherit pname version src; };
 in
@@ -19,13 +19,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "snort";
-  version = "3.7.4.0";
+  version = "3.8.1.0";

  src = fetchFromGitHub {
    owner = "snort3";
    repo = "snort3";
    tag = finalAttrs.version;
-    hash = "sha256-c5GVFzZOeaI2te49m9crt9I0E/awHjcDR621tvDVgSQ=";
+    hash = "sha256-+59e6rLMvLQ+LNxwRRG6nLXqjMsbn3bdykfMpwPgSpA=";
  };

  nativeBuildInputs = [
@@ -1,56 +1,8 @@
 diff --git a/CMakeLists.txt b/CMakeLists.txt
-index 80a3bdcd6..380a1573a 100644
+index a4c631102..13b5743ca 100644
 --- a/CMakeLists.txt
 +++ b/CMakeLists.txt
-@@ -61,7 +61,7 @@ option(
- 	"Link dependencies using CMake's find_package and do not use internal builds"
- 	${SRB2_CONFIG_SYSTEM_LIBRARIES_DEFAULT}
- )
-option(SRB2_CONFIG_ENABLE_TESTS "Build the test suite" ON)
-+option(SRB2_CONFIG_ENABLE_TESTS "Build the test suite" OFF)
- # This option isn't recommended for distribution builds and probably won't work (yet).
- cmake_dependent_option(
- 	SRB2_CONFIG_SHARED_INTERNAL_LIBRARIES
-@@ -80,25 +80,6 @@ option(SRB2_CONFIG_ZDEBUG "Compile with ZDEBUG defined." OFF)
- option(SRB2_CONFIG_PROFILEMODE "Compile for profiling (GCC only)." OFF)
- set(SRB2_CONFIG_ASSET_DIRECTORY "" CACHE PATH "Path to directory that contains all asset files for the installer. If set, assets will be part of installation and cpack.")
- 
-if(SRB2_CONFIG_ENABLE_TESTS)
-	# https://github.com/catchorg/Catch2
-	CPMAddPackage(
-		NAME Catch2
-		VERSION 3.4.0
-		GITHUB_REPOSITORY catchorg/Catch2
-		OPTIONS
-			"CATCH_INSTALL_DOCS OFF"
-	)
-	list(APPEND CMAKE_MODULE_PATH "${Catch2_SOURCE_DIR}/extras")
-	include(CTest)
-	include(Catch)
-	add_executable(srb2tests)
-	# To add tests, use target_sources to add individual test files to the target in subdirs.
-	target_link_libraries(srb2tests PRIVATE Catch2::Catch2 Catch2::Catch2WithMain)
-	target_compile_features(srb2tests PRIVATE c_std_11 cxx_std_17)
-	catch_discover_tests(srb2tests)
-endif()
-
- # Enable CCache
- # (Set USE_CCACHE=ON to use, CCACHE_OPTIONS for options)
- if("${CMAKE_HOST_SYSTEM_NAME}" STREQUAL Windows)
-@@ -113,12 +94,6 @@ if("${CMAKE_HOST_SYSTEM_NAME}" STREQUAL Windows)
- 			message(WARNING "USE_CCACHE was set but ccache is not found (set CCACHE_TOOL_PATH)")
- 		endif()
- 	endif()
-else()
-	CPMAddPackage(
-		NAME Ccache.cmake
-		GITHUB_REPOSITORY TheLartians/Ccache.cmake
-		VERSION 1.2
-	)
- endif()
- 
- # Dependencies
-@@ -179,7 +154,7 @@ include(GitUtilities)
+@@ -141,7 +141,7 @@ include(GitUtilities)
 if("${SRB2_SDL2_EXE_NAME}" STREQUAL "")
 	# cause a reconfigure if the branch changes
 	get_git_dir(SRB2_GIT_DIR)
@@ -7,8 +7,8 @@
  curl,
  nasm,
  libopenmpt,
+  miniupnpc,
  game-music-emu,
-  libGLU,
  libpng,
  SDL2,
  SDL2_mixer,
@@ -20,13 +20,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "srb2";
-  version = "2.2.13";
+  version = "2.2.15";

  src = fetchFromGitHub {
    owner = "STJr";
    repo = "SRB2";
    rev = "SRB2_release_${finalAttrs.version}";
-    hash = "sha256-OSkkjCz7ZW5+0vh6l7+TpnHLzXmd/5QvTidRQSHJYX8=";
+    hash = "sha256-eJ0GYe3Rw6qQXj+jtyt8MkP87DaCiO9ffChg+SpQqaI=";
  };

  nativeBuildInputs = [
@@ -41,6 +41,7 @@ stdenv.mkDerivation (finalAttrs: {
    game-music-emu
    libpng
    libopenmpt
+    miniupnpc
    SDL2
    SDL2_mixer
    zlib
@@ -53,7 +54,7 @@ stdenv.mkDerivation (finalAttrs: {
    src = fetchgit {
      url = "https://git.do.srb2.org/STJr/srb2assets-public";
      rev = "SRB2_release_${finalAttrs.version}";
-      hash = "sha256-OXvO5ZlujIYmYevc62Dtx192dxoujQMNFUCrH5quBBg=";
+      hash = "sha256-1kwhWHzL2TbSx1rhFExbMhXqn0HMBRhR6LZiuoRx+iI=";
      fetchLFS = true;
    };

@@ -76,17 +77,9 @@ stdenv.mkDerivation (finalAttrs: {
  ];

  patches = [
-    # Make the build work without internet connectivity
-    # See: https://build.opensuse.org/request/show/1109889
    ./cmake.patch
-    ./thirdparty.patch
  ];

-  postPatch = ''
-    substituteInPlace ./src/sdl/ogl_sdl.c \
-      --replace libGLU.so.1 ${libGLU}/lib/libGLU.so.1
-  '';
-
  desktopItems = [
    (makeDesktopItem rec {
      name = "Sonic Robo Blast 2";
@@ -1,12 +0,0 @@
-diff --git a/thirdparty/CMakeLists.txt b/thirdparty/CMakeLists.txt
-index f33b3bf3f..1214f179c 100644
--- a/thirdparty/CMakeLists.txt
-+++ b/thirdparty/CMakeLists.txt
-@@ -16,6 +16,5 @@ if(NOT "${SRB2_CONFIG_SYSTEM_LIBRARIES}")
- 	include("cpm-png.cmake")
- 	include("cpm-curl.cmake")
- 	include("cpm-openmpt.cmake")
-+	include("cpm-libgme.cmake")
- endif()
-
-include("cpm-libgme.cmake")
@@ -60,8 +60,7 @@ stdenv.mkDerivation (finalAttrs: {
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit (finalAttrs) src;
-    sourceRoot = "${finalAttrs.src.name}/${finalAttrs.cargoRoot}";
+    inherit (finalAttrs) src cargoRoot;
    hash = "sha256-Su9ZOPIskV5poeS8pgtri+sZANBpdgnuCsQqE4WKFdA=";
  };

@@ -17,18 +17,18 @@ assert lib.asserts.assertMsg (

 stdenv.mkDerivation (finalAttrs: {
  pname = "synapse-admin-etkecc";
-  version = "0.11.0-etke42";
+  version = "0.11.1-etke43";

  src = fetchFromGitHub {
    owner = "etkecc";
    repo = "synapse-admin";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-HWhyG/dVP9M84OOYH95RPLqiXDYOs+QOxwLM8pPl1vA=";
+    hash = "sha256-mubONaT4qnbPlnYY15UtHGEp45k5mIxWt1shHRdwwTA=";
  };

  yarnOfflineCache = fetchYarnDeps {
    yarnLock = finalAttrs.src + "/yarn.lock";
-    hash = "sha256-GO5m+7fcm/XO38XlsQq6fwKslzdZkE6WleP3GHNKuPU=";
+    hash = "sha256-WFE2mtyK3xBOVIgJ0ODsv1C0pjpGdBM3+TtIiZUpj58=";
  };

  nativeBuildInputs = [
--- a/Show More
+++ b/Show More