Merge master into staging-next

2025-07-17 18:05:44 +00:00
parent 063b784e2a efcd63784e
commit 2cdbebb801
88 changed files with 997 additions and 6362 deletions
@@ -427,6 +427,8 @@
  add `vimPlugins.notmuch-vim` to your (Neo)vim configuration if you want the
  vim plugin.

+- The fileSystems (e.g., `fileSystems."/"`) are now set by NixOS-implemented modules using `lib.mkDefault`, allowing wholesale overrides, but this means that overriding individual attributes (like `fsType` or `options`) without explicitly specifying `device` may result in missing required fields and errors such as `No device specified for mount point '/'` (https://github.com/NixOS/nixpkgs/pull/377406).
+
 - `prisma` and `prisma-engines` have been updated to version 6.7.0, which
  introduces several breaking changes. See the
  [Prisma ORM upgrade guide](https://www.prisma.io/docs/orm/more/upgrade-guides/upgrading-versions/upgrading-to-prisma-6)
@@ -587,6 +587,12 @@
  "module-services-suwayomi-server-extra-config": [
    "index.html#module-services-suwayomi-server-extra-config"
  ],
+  "module-services-paisa": [
+    "index.html#module-services-paisa"
+  ],
+  "module-services-paisa-usage": [
+    "index.html#module-services-paisa-usage"
+  ],
  "module-services-plausible": [
    "index.html#module-services-plausible"
  ],
@@ -62,6 +62,8 @@

 - [SuiteNumérique Meet](https://github.com/suitenumerique/meet) is an open source alternative to Google Meet and Zoom powered by LiveKit: HD video calls, screen sharing, and chat features. Built with Django and React. Available as [services.lasuite-meet](#opt-services.lasuite-meet.enable).

+- [paisa](https://github.com/ananthakumaran/paisa), a personal finance tracker and dashboard. Available as [services.paisa](#opt-services.paisa.enable).
+
 ## Backward Incompatibilities {#sec-release-25.11-incompatibilities}

 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
@@ -72,6 +74,9 @@

 - The `services.polipo` module has been removed as `polipo` is unmaintained and archived upstream.

+- The non-LTS Forgejo package (`forgejo`) has been updated to 12.0.0. This release contains breaking changes, see the [release blog post](https://forgejo.org/2025-07-release-v12-0/)
+  for all the details and how to ensure smooth upgrades.
+
 - The Pocket ID module ([`services.pocket-id`][#opt-services.pocket-id.enable]) and package (`pocket-id`) has been updated to 1.0.0. Some environment variables have been changed or removed, see the [migration guide](https://pocket-id.org/docs/setup/migrate-to-v1/).

 - []{#sec-release-25.11-incompatibilities-sourcehut-removed} The `services.sourcehut` module and corresponding `sourcehut` packages were removed due to being broken and unmaintained.
@@ -112,6 +117,8 @@

 - `services.clamsmtp` is unmaintained and was removed from Nixpkgs.

+- `services.dependency-track` removed its configuration of the JVM heap size. This lets the JVM choose its maximum heap size automatically, which should work much better in practice for most users. For deployments on systems with little RAM, it may now be necessary to manually configure a maximum heap size using  {option}`services.dependency-track.javaArgs`.
+
 - `services.dnscrypt-proxy2` gains a `package` option to specify dnscrypt-proxy package to use.

 - `services.gitea` supports sending notifications with sendmail again. To do this, activate the parameter `services.gitea.mailerUseSendmail` and configure SMTP server.
@@ -881,6 +881,7 @@
  ./services/misc/osrm.nix
  ./services/misc/owncast.nix
  ./services/misc/packagekit.nix
+  ./services/misc/paisa.nix
  ./services/misc/paperless.nix
  ./services/misc/parsoid.nix
  ./services/misc/persistent-evdev.nix
@@ -0,0 +1,32 @@
+# Paisa {#module-services-paisa}
+
+*Source:* {file}`modules/services/misc/paisa.nix`
+
+*Upstream documentation:* <https://paisa.fyi/>
+
+[Paisa](https://github.com/ananthakumaran/paisa) is a personal finance manager
+built on top of the ledger plain-text-accounting tool.
+
+## Usage {#module-services-paisa-usage}
+
+Paisa needs to have one of the following cli tools availabe in the PATH at
+runtime:
+
+- ledger
+- hledger
+- beancount
+
+All of these are available from nixpkgs. Currently, it is not possible to
+configure this in the module, but you can e.g. use systemd to give the unit
+access to the command at runtime.
+
+```nix
+systemd.services.paisa.path = [ pkgs.hledger ];
+```
+
+::: {.note}
+Paisa needs to be configured to use the correct cli tool. This is possible in
+the web interface (make sure to enable [](#opt-services.paisa.mutableSettings)
+if you want to persist these settings between service restarts), or in
+[](#opt-services.paisa.settings).
+:::
@@ -0,0 +1,145 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.paisa;
+  settingsFormat = pkgs.formats.yaml { };
+
+  args = lib.concatStringsSep " " [
+    "--config /var/lib/paisa/paisa.yaml"
+  ];
+
+  settings =
+    if (cfg.settings != null) then
+      builtins.removeAttrs
+        (
+          cfg.settings
+          // {
+            journal_path = cfg.settings.dataDir + cfg.settings.journalFile;
+            db_path = cfg.settings.dataDir + cfg.settings.dbFile;
+          }
+        )
+        [
+          "dataDir"
+          "journalFile"
+          "dbFile"
+        ]
+    else
+      null;
+
+  configFile = (settingsFormat.generate "paisa.yaml" settings).overrideAttrs (_: {
+    checkPhase = "";
+  });
+in
+{
+  options.services.paisa = with lib.types; {
+    enable = lib.mkEnableOption "Paisa personal finance manager";
+
+    package = lib.mkPackageOption pkgs "paisa" { };
+
+    openFirewall = lib.mkOption {
+      default = false;
+      type = bool;
+      description = "Open ports in the firewall for the Paisa web server.";
+    };
+
+    mutableSettings = lib.mkOption {
+      default = true;
+      type = bool;
+      description = ''
+        Allow changes made on the web interface to persist between service
+        restarts.
+      '';
+    };
+
+    host = lib.mkOption {
+      type = str;
+      default = "0.0.0.0";
+      description = "Host bind IP address.";
+    };
+
+    port = lib.mkOption {
+      type = port;
+      default = 7500;
+      description = "Port to serve Paisa on.";
+    };
+
+    settings = lib.mkOption {
+      default = null;
+      type = nullOr (submodule {
+        freeformType = settingsFormat.type;
+        options = {
+          dataDir = lib.mkOption {
+            type = lib.types.str;
+            default = "/var/lib/paisa/";
+            description = "Path to paisa data directory.";
+          };
+
+          journalFile = lib.mkOption {
+            type = lib.types.str;
+            default = "main.ledger";
+            description = "Filename of the main journal / ledger file.";
+          };
+
+          dbFile = lib.mkOption {
+            type = lib.types.str;
+            default = "paisa.sqlite3";
+            description = "Filename of the Paisa database.";
+          };
+
+        };
+      });
+      description = ''
+        Paisa configuration. Please refer to
+        <https://paisa.fyi/reference/config/> for details.
+
+        On start and if `mutableSettings` is `true`, these options are merged
+        into the configuration file on start, taking precedence over
+        configuration changes made on the web interface.
+      '';
+    };
+  };
+  config = lib.mkIf cfg.enable {
+    assertions = [ ];
+
+    systemd.services.paisa = {
+      description = "Paisa: Web Application";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      unitConfig = {
+        StartLimitIntervalSec = 5;
+        StartLimitBurst = 10;
+      };
+
+      preStart = lib.optionalString (settings != null) ''
+        if [ -e "$STATE_DIRECTORY/paisa.yaml" ] && [ "${toString cfg.mutableSettings}" = "1" ]; then
+          # do not write directly to the config file
+          ${lib.getExe pkgs.yaml-merge} "$STATE_DIRECTORY/paisa.yaml" "${configFile}" > "$STATE_DIRECTORY/paisa.yaml.tmp"
+          mv "$STATE_DIRECTORY/paisa.yaml.tmp" "$STATE_DIRECTORY/paisa.yaml"
+        else
+          cp --force "${configFile}" "$STATE_DIRECTORY/paisa.yaml"
+          chmod 600 "$STATE_DIRECTORY/paisa.yaml"
+        fi
+      '';
+
+      serviceConfig = {
+        DynamicUser = true;
+        ExecStart = "${lib.getExe cfg.package} serve ${args}";
+        AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
+        Restart = "always";
+        RestartSec = 5;
+        RuntimeDirectory = "paisa";
+        StateDirectory = "paisa";
+      };
+    };
+    networking.firewall.allowedTCPPorts = lib.mkIf cfg.openFirewall [ cfg.port ];
+  };
+
+  meta = {
+    maintainers = with lib.maintainers; [ skowalak ];
+    doc = ./paisa.md;
+  };
+}
@@ -76,8 +76,12 @@ in

    javaArgs = lib.mkOption {
      type = lib.types.listOf lib.types.str;
-      default = [ "-Xmx4G" ];
-      description = "Java options passed to JVM";
+      default = [ ];
+      example = lib.literalExpression ''[ "-Xmx16G" ] '';
+      description = ''
+        Java options passed to JVM. Configuring this is usually not necessary, but for small systems
+        it can be useful to tweak the JVM heap size.
+      '';
    };

    database = {
@@ -362,10 +362,6 @@ in
          touch .version
        fi

-        if [ "${cfg.backendPackage.version}" != "$(cat .version)" ]; then
-          ${getExe cfg.backendPackage} migrate
-          echo -n "${cfg.backendPackage.version}" > .version
-        fi
        ${optionalString (cfg.secretKeyPath == null) ''
          if [[ ! -f /var/lib/lasuite-docs/django_secret_key ]]; then
            (
@@ -374,6 +370,10 @@ in
            )
          fi
        ''}
+        if [ "${cfg.backendPackage.version}" != "$(cat .version)" ]; then
+          ${getExe cfg.backendPackage} migrate
+          echo -n "${cfg.backendPackage.version}" > .version
+        fi
      '';

      environment = pythonEnvironment;
@@ -37,6 +37,11 @@ in
        };
        services.dependency-track = {
          enable = true;
+
+          # The Java VM defaults (correctly) to tiny heap on this tiny
+          # VM, but that's not enough to start dependency-track.
+          javaArgs = [ "-Xmx4G" ];
+
          port = dependencyTrackPort;
          nginx.domain = "localhost";
          database.passwordFile = "${pkgs.writeText "dbPassword" ''hunter2'THE'''H''''E''}";
@@ -1,23 +1,26 @@
 { ... }:
 {
  name = "paisa";
-  nodes.machine =
-    { pkgs, lib, ... }:
+  nodes.serviceEmptyConf =
+    { ... }:
    {
-      systemd.services.paisa = {
-        description = "Paisa";
-        wantedBy = [ "multi-user.target" ];
-        serviceConfig.ExecStart = "${lib.getExe pkgs.paisa} serve";
+      services.paisa = {
+        enable = true;
+
+        settings = { };
      };
    };
+
  testScript = ''
    start_all()

    machine.systemctl("start network-online.target")
    machine.wait_for_unit("network-online.target")
-    machine.wait_for_unit("paisa.service")
-    machine.wait_for_open_port(7500)

-    machine.succeed("curl --location --fail http://localhost:7500")
+    with subtest("empty/default config test"):
+      serviceEmptyConf.wait_for_unit("paisa.service")
+      serviceEmptyConf.wait_for_open_port(7500)
+
+      serviceEmptyConf.succeed("curl --location --fail http://localhost:7500")
  '';
 }
@@ -24,8 +24,8 @@ let
    sha256Hash = "sha256-mqQM39PePFYWIgukzN3X4rTHPUcdrFTc/OC9w4t+wJM=";
  };
  latestVersion = {
-    version = "2025.1.2.8"; # "Android Studio Narwhal Feature Drop | 2025.1.2 Canary 8"
-    sha256Hash = "sha256-p7sIraR5MbFqr2svD1GKR71I0U1UDMkmAW4PAHjWyD4=";
+    version = "2025.1.2.9"; # "Android Studio Narwhal Feature Drop | 2025.1.2 Canary 9"
+    sha256Hash = "sha256-SvI3gF1e02FJOxibls37c4M7c3rZOjh63R+9fuj55d0=";
  };
 in
 {
@@ -26,11 +26,11 @@ let

  hash =
    {
-      x86_64-linux = "sha256-IDLwjwstwKc2xSWvY499+Hf6cLORnhD9H3OGPH0XEUo=";
-      x86_64-darwin = "sha256-HyFWmLw6OWZoCYKTBIljbUPB9hpr+RDK7wHp6kwinmY=";
-      aarch64-linux = "sha256-Ys336a/YSMniPLmPXKxCShDRutYvwIIHTG4iENsAIcc=";
-      aarch64-darwin = "sha256-exhkzEmBU5gZkBxwh2FOaNzTQweP/sKA4WjZHyiAk9M=";
-      armv7l-linux = "sha256-PqgCe76dyBijYN3xM8UyBqFyDZdqP/+JdE8Zisnpao4=";
+      x86_64-linux = "sha256-W1y/YOt4IP0XvsY5hDVY1u8yV8t5pLdayrvhYDIOylE=";
+      x86_64-darwin = "sha256-pGnOYDkuQUiYuu+bO8Mo/g0IFKrIxtdQMGDxRbmnDYQ=";
+      aarch64-linux = "sha256-SoA7LGgl0qw7bqVwSBN+cGLTVLTPweRJHqZEiPmdnRQ=";
+      aarch64-darwin = "sha256-ne1I80FxW9nwQcGipQPNpJcnpSiLA3CzCckb2lxEl70=";
+      armv7l-linux = "sha256-fN6VponkxBzCH+Xx4bwJSNsqv+/ZilBLZvFLgSKve3A=";
    }
    .${system} or throwSystem;

@@ -41,7 +41,7 @@ callPackage ./generic.nix rec {

  # Please backport all compatible updates to the stable release.
  # This is important for the extension ecosystem.
-  version = "1.101.24242";
+  version = "1.102.14746";
  pname = "vscodium";

  executableName = "codium";
@@ -1,51 +0,0 @@
-From 467156efccc5e36a36bec8c0b64cc5a70f14d5ed Mon Sep 17 00:00:00 2001
-From: Yana Timoshenko <yana@riseup.net>
-Date: Tue, 16 Jan 2018 11:43:46 +0000
-Subject: [PATCH] Fix Autoconf script
-
-gettext/intltool macros are not used correctly, see:
-https://bugs.launchpad.net/inkscape/+bug/1418943
---
- bootstrap    | 6 +-----
- configure.ac | 5 +----
- 2 files changed, 2 insertions(+), 9 deletions(-)
-
-diff --git a/bootstrap b/bootstrap
-index 0599cf5..40b1dca 100755
--- a/bootstrap
-+++ b/bootstrap
-@@ -1,7 +1,3 @@
- #!/bin/sh
- 
-# change to root directory
-cd $(dirname "$0")
-
-autopoint --force && \
-	AUTOPOINT="intltoolize --automake --copy" autoreconf --force --install --verbose
-+autoreconf --force --install && intltoolize
-diff --git a/configure.ac b/configure.ac
-index be0b51a..a2e7c42 100644
--- a/configure.ac
-+++ b/configure.ac
-@@ -17,6 +17,7 @@ AC_PROG_OBJC # For macOS support modules
- AC_LANG([C])
- 
- AC_PROG_INTLTOOL([0.50])
-+AC_SUBST(LIBINTL)
- 
- AC_CANONICAL_HOST
- 
-@@ -51,10 +52,6 @@ AC_COMPILE_IFELSE([AC_LANG_PROGRAM([])], [
- ])
- AC_LANG_POP([Objective C])
- 
-# Checks for libraries.
-AM_GNU_GETTEXT_VERSION([0.17])
-AM_GNU_GETTEXT([external])
-
- GETTEXT_PACKAGE=redshift
- AC_SUBST(GETTEXT_PACKAGE)
- AC_DEFINE_UNQUOTED(GETTEXT_PACKAGE, "$GETTEXT_PACKAGE", [Package name for gettext])
-- 
-2.15.1
-
@@ -51,11 +51,6 @@ let
        meta
        ;

-      patches = lib.optionals (pname != "gammastep") [
-        # https://github.com/jonls/redshift/pull/575
-        ./575.patch
-      ];
-
      strictDeps = true;

      depsBuildBuild = [ pkg-config ];
@@ -19,6 +19,7 @@
  ocamlPackages_4_10,
  ocamlPackages_4_12,
  ocamlPackages_4_14,
+  rocqPackages, # for versions >= 9.0 that are transition shims on top of Rocq
  ncurses,
  buildIde ? null, # default is true for Coq < 8.14 and false for Coq >= 8.14
  glib,
@@ -27,7 +28,6 @@
  makeDesktopItem,
  copyDesktopItems,
  csdp ? null,
-  rocq-core, # for versions >= 9.0 that are transition shims on top of Rocq
  version,
  coq-version ? null,
 }@args:
@@ -148,7 +148,6 @@ let
  self = stdenv.mkDerivation {
    pname = "coq";
    inherit (fetched) version src;
-    exact-version = args.version;

    passthru = {
      inherit coq-version;
@@ -161,6 +160,7 @@ let
        findlib
        num
        ;
+      rocqPackages = lib.optionalAttrs (coqAtLeast "8.21") rocqPackages;
      emacsBufferSetup = pkgs: ''
        ; Propagate coq paths to children
        (inherit-local-permanent coq-prog-name "${self}/bin/coqtop")
@@ -334,7 +334,7 @@ if coqAtLeast "8.21" then
  self.overrideAttrs (o: {
    # coq-core is now a shim for rocq
    propagatedBuildInputs = o.propagatedBuildInputs ++ [
-      (rocq-core.override { version = o.exact-version; })
+      rocqPackages.rocq-core
    ];
    buildPhase = ''
      runHook preBuild
@@ -5,7 +5,7 @@
 }:

 let
-  pListText = lib.generators.toPlist { } {
+  pListText = lib.generators.toPlist { escape = true; } {
    CFBundleDevelopmentRegion = "English";
    CFBundleExecutable = "$name";
    CFBundleIconFile = "$icon";
@@ -16,11 +16,11 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "angular-language-server";
-  version = "20.0.0";
+  version = "20.1.1";
  src = fetchurl {
    name = "angular-language-server-${finalAttrs.version}.zip";
    url = "https://github.com/angular/vscode-ng-language-service/releases/download/v${finalAttrs.version}/ng-template.vsix";
-    hash = "sha256-87SImzcGbwvf9xtdbD3etqaWe6fMVeCKc+f8qTyFnUA=";
+    hash = "sha256-fcJXyuGow39uep6Giexft+3a/nnoJSsKdwjtAQKTMj0=";
  };

  nativeBuildInputs = [
@@ -299,9 +299,17 @@ let
  };
 in
 {
-  "Info.plist" = builtins.toFile "Info.plist" (toPlist { } Info);
-  "ToolchainInfo.plist" = builtins.toFile "ToolchainInfo.plist" (toPlist { } ToolchainInfo);
-  "Architectures.xcspec" = builtins.toFile "Architectures.xcspec" (toPlist { } Architectures);
-  "PackageTypes.xcspec" = builtins.toFile "PackageTypes.xcspec" (toPlist { } PackageTypes);
-  "ProductTypes.xcspec" = builtins.toFile "ProductTypes.xcspec" (toPlist { } ProductTypes);
+  "Info.plist" = builtins.toFile "Info.plist" (toPlist { escape = true; } Info);
+  "ToolchainInfo.plist" = builtins.toFile "ToolchainInfo.plist" (
+    toPlist { escape = true; } ToolchainInfo
+  );
+  "Architectures.xcspec" = builtins.toFile "Architectures.xcspec" (
+    toPlist { escape = true; } Architectures
+  );
+  "PackageTypes.xcspec" = builtins.toFile "PackageTypes.xcspec" (
+    toPlist { escape = true; } PackageTypes
+  );
+  "ProductTypes.xcspec" = builtins.toFile "ProductTypes.xcspec" (
+    toPlist { escape = true; } ProductTypes
+  );
 }
@@ -23,13 +23,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "aquamarine";
-  version = "0.9.1";
+  version = "0.9.2";

  src = fetchFromGitHub {
    owner = "hyprwm";
    repo = "aquamarine";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-1bxH4zW/mnEh7ySsByZBRpANUG/Ym8kgorawYI70z7A=";
+    hash = "sha256-4izhj1j7J4mE8LgljCXSIUDculqOsxxhdoC81VhqizM=";
  };

  nativeBuildInputs = [
@@ -7,13 +7,13 @@

 buildGoModule rec {
  pname = "arkade";
-  version = "0.11.39";
+  version = "0.11.40";

  src = fetchFromGitHub {
    owner = "alexellis";
    repo = "arkade";
    rev = version;
-    hash = "sha256-ILiiK8WWuSB1QKTo89/JJ5ADCBKbRXVn9fNVL3c7y0s=";
+    hash = "sha256-9jFfYCMAyf6RAz4CjkYYRC68VkqrWCXkVUA2kZm0g7s=";
  };

  env.CGO_ENABLED = 0;
@@ -16,18 +16,18 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "blade-formatter";
-  version = "1.42.1";
+  version = "1.43.0";

  src = fetchFromGitHub {
    owner = "shufo";
    repo = "blade-formatter";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-tzga32YPRB3ONsguw+Ap6T98YhKk60bnqeV/OYhuvc4=";
+    hash = "sha256-jxRC7VYApAZrC/1b2r5cc9OCQ9/mA8ttizA4v0SY4U8=";
  };

  yarnOfflineCache = fetchYarnDeps {
    yarnLock = finalAttrs.src + "/yarn.lock";
-    hash = "sha256-ShmvKilQhJN8PNntVbLEKp/cxgmXHIYKOgVrpbrE+3M=";
+    hash = "sha256-pWa2gI3RiZd5BJ2KJQHKH6+KBJasIVV5xnIoFi8jzlg=";
  };

  nativeBuildInputs = [
@@ -6,17 +6,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "cargo-xwin";
-  version = "0.19.0";
+  version = "0.19.1";

  src = fetchFromGitHub {
    owner = "rust-cross";
    repo = "cargo-xwin";
    rev = "v${version}";
-    hash = "sha256-uu3fKq6ZebDbTBpp5UaAOCWnaeJ0xRgVO+GNDHheKGA=";
+    hash = "sha256-rmbu3WNwCmgojAWAthIQ9/XiSS04d9DoZwGRGAuRfDw=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-/u1qBe+eOAXqjgly62eFIglO3XuZd/f2w7DcHsqvZGA=";
+  cargoHash = "sha256-7xpkxJh5KVJVw6wQZGr2daU1qg0e969EWflf4Z/01oY=";

  meta = with lib; {
    description = "Cross compile Cargo project to Windows MSVC target with ease";
@@ -0,0 +1,12 @@
+diff --git a/configure.ac b/configure.ac
+index 52dea73..6b1a818 100644
+--- a/configure.ac
+++ b/configure.ac
+@@ -5,6 +5,8 @@ AC_INIT([caribou],
+         [caribou])
+
+ AC_CONFIG_MACRO_DIR([m4])
+AM_GNU_GETTEXT([external])
+AM_GNU_GETTEXT_VERSION([0.25])
+
+ AM_PROG_LIBTOOL
@@ -58,6 +58,8 @@ stdenv.mkDerivation rec {
      url = "https://gitlab.gnome.org/GNOME/caribou/-/commit/d41c8e44b12222a290eaca16703406b113a630c6.patch";
      hash = "sha256-yIsEqSflpAdQPAB6eNr6fctxzyACu7N1HVfMIdCQou0=";
    })
+    # Fix build with gettext 0.25
+    ./gettext-0.25.patch
  ];

  nativeBuildInputs = [
@@ -8,13 +8,13 @@

 buildNpmPackage rec {
  pname = "cfn-changeset-viewer";
-  version = "0.1.0";
+  version = "0.2.1";

  src = fetchFromGitHub {
    owner = "trek10inc";
    repo = "cfn-changeset-viewer";
    tag = version;
-    hash = "sha256-ONgjU07wyC1NoNtTsQO5LbVQiC8gsHqsyYv3Upc0hWQ=";
+    hash = "sha256-PPMmU5GMxxzBiTNAv/Rbtvkl5QK1BZjW4TJLT7xlpw4=";
  };

  npmDepsHash = "sha256-ICaGtofENMaAjk/KGRn8RgpMAICSttx4AIcbi1HsW8Q=";
@@ -6,13 +6,13 @@
  "packages": {
    "": {
      "dependencies": {
-        "@anthropic-ai/claude-code": "^1.0.51"
+        "@anthropic-ai/claude-code": "^1.0.53"
      }
    },
    "node_modules/@anthropic-ai/claude-code": {
-      "version": "1.0.51",
-      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-1.0.51.tgz",
-      "integrity": "sha512-annBc4ez7nDPbp+di6bjIQGiAdmdVln4k3gAYioym2MxOEl3py5s7SsoR+dNSmfgfIHUdKBTbtXnXD5rkmO5aA==",
+      "version": "1.0.53",
+      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-1.0.53.tgz",
+      "integrity": "sha512-YE7PKtU1VPLtI3kCI4lvQyR+GE6v18ZvigO2mZqUUCqw537jeRMpAtVCtrp/onAuWUdHBYm7GhV0yDtsVc5Vug==",
      "license": "SEE LICENSE IN README.md",
      "bin": {
        "claude": "cli.js"
@@ -7,16 +7,16 @@

 buildNpmPackage rec {
  pname = "claude-code";
-  version = "1.0.51";
+  version = "1.0.53";

  nodejs = nodejs_20; # required for sandboxed Nix builds on Darwin

  src = fetchzip {
    url = "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-${version}.tgz";
-    hash = "sha256-sAILRsi8ZViMfcpqykfnFQzHTJHRwRSZz45otMqa4U0=";
+    hash = "sha256-opFOUa/YtJDwhkD5dN+PL74z5NqkrRCVrU2RQu6xmEc=";
  };

-  npmDepsHash = "sha256-r/Na3lU7YQ8W5PUuL5EfPu1a/Rz6hBLw/9XmSrKHD1o=";
+  npmDepsHash = "sha256-e+WTydp3WIl6hZwbmv5SKM9XhcMJpYO5mTInT41/p2c=";

  postPatch = ''
    cp ${./package-lock.json} package-lock.json
@@ -59,13 +59,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "fastfetch";
-  version = "2.47.0";
+  version = "2.48.0";

  src = fetchFromGitHub {
    owner = "fastfetch-cli";
    repo = "fastfetch";
    tag = finalAttrs.version;
-    hash = "sha256-xe86u40zW1+2O4s6e64HlpxiaLIRpjgKLPNnSEGlioQ=";
+    hash = "sha256-PYGczt2wmxpExuPlu6U7vecePzuEH9IJIKKZtCC8FgU=";
  };

  outputs = [
@@ -9,16 +9,16 @@

 buildGoModule rec {
  pname = "flyctl";
-  version = "0.3.149";
+  version = "0.3.157";

  src = fetchFromGitHub {
    owner = "superfly";
    repo = "flyctl";
    rev = "v${version}";
-    hash = "sha256-9kzyQH5oJr8e0yYgTi7wBmnYRjyeiFffJccuPiAF5JQ=";
+    hash = "sha256-R5hZLY7uKYfSQdSnYkCruobdHiUZfHshnb/oIYbCMEc=";
  };

-  vendorHash = "sha256-G+RT2teg1+AoLJRjYKnQtVcGH3sbtrxhklQfGMIod+0=";
+  vendorHash = "sha256-OwxzdLXNPiQRq6mgvZaOs8tnNZQm0mYyzyPFUYcokb0=";

  subPackages = [ "." ];

@@ -27,7 +27,7 @@
 }:

 let
-  version = "1.22.3";
+  version = "1.23.0";

  # build stimuli file for PGO build and the script to generate it
  # independently of the foot's build, so we can cache the result
@@ -104,7 +104,7 @@ stdenv.mkDerivation {
    owner = "dnkl";
    repo = "foot";
    tag = version;
-    hash = "sha256:1l5liw4dgv7hxdimyk5qycmkfjgimdrx51rjvdizpcfmdlkvg518";
+    hash = "sha256-B7EKEIb6qA9UTRq0jdj1ShLhnldU0pwQPlkq6JrHWmI=";
  };

  separateDebugInfo = true;
@@ -17,28 +17,43 @@ let
 in
 buildGoModule rec {
  pname = "forgejo-runner";
-  version = "6.4.0";
+  version = "7.0.0";

  src = fetchFromGitea {
    domain = "code.forgejo.org";
    owner = "forgejo";
    repo = "runner";
    rev = "v${version}";
-    hash = "sha256-fEsT82h33XIBXyvcIYNsieQiV45jLnxLpFP5ji9pNlg=";
+    hash = "sha256-vt0uPGJdydy4cM1AEBeXQu4aNRggqaITS3eAmimVPRU=";
  };

-  vendorHash = "sha256-KV8KYOjy3WO+yfVWEFwKZVAesmx4tFk/k/sTLDKk9lo=";
+  vendorHash = "sha256-hE03QkXSPyl7IVEnXi/wWwQZOVcdyyGdEmGiOwLK6Zg=";
+
+  # See upstream Makefile
+  # https://code.forgejo.org/forgejo/runner/src/branch/main/Makefile
+  tags = [
+    "netgo"
+    "osusergo"
+  ];

  ldflags = [
    "-s"
    "-w"
-    "-X gitea.com/gitea/act_runner/internal/pkg/ver.version=${src.rev}"
+    "-X runner.forgejo.org/internal/pkg/ver.version=${src.rev}"
  ];

  checkFlags = [
    "-skip ${lib.concatStringsSep "|" disabledTests}"
  ];

+  postInstall = ''
+    # fix up go-specific executable naming derived from package name, upstream
+    # also calls it `forgejo-runner`
+    mv $out/bin/runner.forgejo.org $out/bin/forgejo-runner
+    # provide old binary name for compatibility
+    ln -s $out/bin/forgejo-runner $out/bin/act_runner
+  '';
+
  doInstallCheck = true;
  nativeInstallCheckInputs = [ versionCheckHook ];
  versionCheckProgram = "${placeholder "out"}/bin/${meta.mainProgram}";
@@ -61,6 +76,6 @@ buildGoModule rec {
      emilylange
      christoph-heiss
    ];
-    mainProgram = "act_runner";
+    mainProgram = "forgejo-runner";
  };
 }
@@ -1 +1,11 @@
-{ forgejo-lts }: forgejo-lts
+import ./generic.nix {
+  version = "12.0.0";
+  hash = "sha256-8cokjK9fbxd9lm+5oDoMll9f7ejiVzMNuDgC0Pk1pbM=";
+  npmDepsHash = "sha256-kq2AV1D0xA4Csm8XUTU5D0iCmyuajcnwlLdPjJ/mj1g=";
+  vendorHash = "sha256-B9menPCDUOYHPCS0B5KpxuE03FdFXmA8XqkiYEAxs5Y=";
+  lts = false;
+  nixUpdateExtraArgs = [
+    "--override-filename"
+    "pkgs/by-name/fo/forgejo/package.nix"
+  ];
+}
@@ -0,0 +1,14 @@
+diff --git a/configure.in b/configure.in
+index d71fc6a..fd14845 100644
+--- a/configure.in
+++ b/configure.in
+@@ -7,6 +7,9 @@ AM_MAINTAINER_MODE
+ AC_CONFIG_MACRO_DIR([m4])
+ AC_CONFIG_HEADER(config.h)
+ 
+AM_GNU_GETTEXT_VERSION([0.25])
+AM_GNU_GETTEXT([external])
+
+ AC_PROG_CC
+ AC_PROG_INTLTOOL(, no-xml)
+ AC_ISC_POSIX
@@ -29,6 +29,7 @@ stdenv.mkDerivation (finalAttrs: {
      url = "https://github.com/galculator/galculator/commit/501a9e3feeb2e56889c0ff98ab6d0ab20348ccd6.patch";
      hash = "sha256-qVJHcfJTtl0hK8pzSp6MjhYAh1NbIIWr3rBDodIYBvk=";
    })
+    ./gettext-0.25.patch
  ];

  nativeBuildInputs = [
@@ -9,16 +9,16 @@

 buildGoModule (finalAttrs: {
  pname = "golangci-lint";
-  version = "2.2.1";
+  version = "2.2.2";

  src = fetchFromGitHub {
    owner = "golangci";
    repo = "golangci-lint";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-c71Oe1PrH2PfbvOb0/gw9q/BxqC8zoxN+31FWV8rcsU=";
+    hash = "sha256-XpFbcyuARE4gvSsWoIXM+CMUiDeuIiM5dbGPt5ACLA8=";
  };

-  vendorHash = "sha256-iYfgvY2hboawbdzMvuSYeHeKN5E00hevk/kRz5jNlkw=";
+  vendorHash = "sha256-Dh+HTUM3uD/l2g4R0hFEtrzjlrOcZQf2S3ELXKWl01U=";

  subPackages = [ "cmd/golangci-lint" ];

@@ -2,8 +2,8 @@
  lib,
  appimageTools,
  fetchurl,
-  version ? "0.9.11.0",
-  hash ? "sha256-I13NEku2oM9HYDhZZI7Sflwhnnjhe1mAr8Cuu9shvms=",
+  version ? "0.9.11.1",
+  hash ? "sha256-7p09J4nyjsnprk8DZM8nKG+G7h6m9wtZPrz0DIIKa8I=",
 }:

 let
@@ -17,7 +17,7 @@

 stdenv.mkDerivation rec {
  pname = "intel-media-driver";
-  version = "25.1.4";
+  version = "25.2.6";

  outputs = [
    "out"
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
    owner = "intel";
    repo = "media-driver";
    rev = "intel-media-${version}";
-    hash = "sha256-kRMBOQpGWVrOvQ2RoYZzoYAfB2r7UqesiaTajjw+SLA=";
+    hash = "sha256-+gcecl04LSFTb9mn+2oJ07/z8aGYezP4AdeITlTS5OY=";
  };

  patches = [
@@ -11,21 +11,21 @@
 }:
 let
  pname = "josm";
-  version = "19412";
+  version = "19423";
  srcs = {
    jar = fetchurl {
      url = "https://josm.openstreetmap.de/download/josm-snapshot-${version}.jar";
-      hash = "sha256-lT7DoB4VJm9yBuQL+qYc4om/SFaJm8mH29R3P3mULjY=";
+      hash = "sha256-s8aMV31NsDFE5XLP523PH3RNvq78eTAa+UvmjyY5a+E=";
    };
    macosx = fetchurl {
      url = "https://josm.openstreetmap.de/download/macosx/josm-macos-${version}-java21.zip";
-      hash = "sha256-INChmimPk8K0UuDHDIh5prjj/gx26Pv1g1MJhhHVd+8=";
+      hash = "sha256-8eps1eTUn9FHHYwECH/742PV7wnnRO08dlZmaxd1aZU=";
    };
    pkg = fetchFromGitHub {
      owner = "JOSM";
      repo = "josm";
      tag = "${version}-tested";
-      hash = "sha256-5XOVDQzjZ6g5iGWTqhhO/yAxgBy4jSthDeHu4QpJxaY=";
+      hash = "sha256-ke8+JMFx95WyYR+ZIbjUVh3CT72bAfiMBGkc0Mim+60=";
    };
  };

@@ -72,6 +72,7 @@ stdenv.mkDerivation {
    maintainers = with lib.maintainers; [
      rycee
      sikmir
+      starsep
    ];
    platforms = lib.platforms.all;
    mainProgram = "josm";
@@ -1,43 +0,0 @@
-From ab1de49ad9c23e73cddc4dd82a9fede4f56d28d0 Mon Sep 17 00:00:00 2001
-From: soyouzpanda <soyouzpanda@soyouzpanda.fr>
-Date: Tue, 29 Apr 2025 17:09:51 +0200
-Subject: [PATCH 2/2] =?UTF-8?q?=E2=9C=A8(frontend)=20support=20`=5FFILE`?=
- =?UTF-8?q?=20envuronment=20variables=20for=20secrets?=
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Allow configuration variables that handles secrets to be read from a
-file given in an environment variable.
---
- src/frontend/servers/y-provider/src/env.ts | 13 +++++++++----
- 1 files changed, 9 insertions(+), 4 deletions(-)
-
-diff --git a/servers/y-provider/src/env.ts b/servers/y-provider/src/env.ts
-index fe281930..e0e02cf5 100644
--- a/servers/y-provider/src/env.ts
-+++ b/servers/y-provider/src/env.ts
-@@ -1,11 +1,16 @@
-+import { readFileSync } from 'fs';
-+
- export const COLLABORATION_LOGGING =
-   process.env.COLLABORATION_LOGGING || 'false';
- export const COLLABORATION_SERVER_ORIGIN =
-   process.env.COLLABORATION_SERVER_ORIGIN || 'http://localhost:3000';
-export const COLLABORATION_SERVER_SECRET =
-  process.env.COLLABORATION_SERVER_SECRET || 'secret-api-key';
-export const Y_PROVIDER_API_KEY =
-  process.env.Y_PROVIDER_API_KEY || 'yprovider-api-key';
-+export const COLLABORATION_SERVER_SECRET = process.env
-+  .COLLABORATION_SERVER_SECRET_FILE
-+  ? readFileSync(process.env.COLLABORATION_SERVER_SECRET_FILE, 'utf-8')
-+  : process.env.COLLABORATION_SERVER_SECRET || 'secret-api-key';
-+export const Y_PROVIDER_API_KEY = process.env.Y_PROVIDER_API_KEY_FILE
-+  ? readFileSync(process.env.Y_PROVIDER_API_KEY_FILE, 'utf-8')
-+  : process.env.Y_PROVIDER_API_KEY || 'yprovider-api-key';
- export const PORT = Number(process.env.PORT || 4444);
- export const SENTRY_DSN = process.env.SENTRY_DSN || '';
- export const COLLABORATION_BACKEND_BASE_URL =
-- 
-2.47.2
-
@@ -6,74 +6,40 @@
  nodejs,
  fixup-yarn-lock,
  yarn,
+  yarnConfigHook,
+  yarnBuildHook,
  makeWrapper,
 }:

 stdenv.mkDerivation rec {
  pname = "lasuite-docs-collaboration-server";
-  version = "3.3.0";
+  version = "3.4.1";

  src = fetchFromGitHub {
    owner = "suitenumerique";
    repo = "docs";
    tag = "v${version}";
-    hash = "sha256-SLTNkK578YhsDtVBS4vH0E/rXx+rXZIyXMhqwr95QEA=";
+    hash = "sha256-QAWwyFp9l+C0XfVu975zjiv61e/S2nYKkUSv4/p7gxw=";
  };

  sourceRoot = "source/src/frontend";

-  patches = [
-    # Support for $ENVIRONMENT_VARIABLE_FILE to be able to pass secret file
-    # See: https://github.com/suitenumerique/docs/pull/912
-    ./environment_variables.patch
-  ];
-
  offlineCache = fetchYarnDeps {
    yarnLock = "${src}/src/frontend/yarn.lock";
-    hash = "sha256-ei4xj+W2j5O675cpMAG4yCB3cPLeYwMhqKTacPWFjoo=";
+    hash = "sha256-07zsggGQFX/Wx/fxs1f0w01HHx7Z2BG5d3PIBlX2SVM=";
  };

  nativeBuildInputs = [
    nodejs
    fixup-yarn-lock
    yarn
+    yarnConfigHook
+    yarnBuildHook
    makeWrapper
  ];

-  configurePhase = ''
-    runHook preConfigure
-
-    export HOME=$(mktemp -d)
-    yarn config --offline set yarn-offline-mirror "$offlineCache"
-    fixup-yarn-lock yarn.lock
-
-    # Fixup what fixup-yarn-lock does not fix. Result in error if not fixed.
-    substituteInPlace yarn.lock \
-      --replace-fail '"@fastify/otel@https://codeload.github.com/getsentry/fastify-otel/tar.gz/ae3088d65e286bdc94ac5d722573537d6a6671bb"' '"@fastify/otel@^0.8.0"'
-
-    yarn install \
-        --frozen-lockfile \
-        --force \
-        --production=false \
-        --ignore-engines \
-        --ignore-platform \
-        --ignore-scripts \
-        --no-progress \
-        --non-interactive \
-        --offline
-
-    patchShebangs node_modules
-
-    runHook postConfigure
-  '';
-
-  buildPhase = ''
-    runHook preBuild
-
-    yarn --offline COLLABORATION_SERVER run build
-
-    runHook postBuild
-  '';
+  yarnBuildScript = "COLLABORATION_SERVER";
+  yarnBuildFlags = "run build";

  installPhase = ''
    runHook preInstall
@@ -6,66 +6,37 @@
  nodejs,
  fixup-yarn-lock,
  yarn,
+  yarnConfigHook,
+  yarnBuildHook,
 }:

 stdenv.mkDerivation rec {
  pname = "lasuite-docs-frontend";
-  version = "3.3.0";
+  version = "3.4.1";

  src = fetchFromGitHub {
    owner = "suitenumerique";
    repo = "docs";
    tag = "v${version}";
-    hash = "sha256-SLTNkK578YhsDtVBS4vH0E/rXx+rXZIyXMhqwr95QEA=";
+    hash = "sha256-QAWwyFp9l+C0XfVu975zjiv61e/S2nYKkUSv4/p7gxw=";
  };

  sourceRoot = "source/src/frontend";

  offlineCache = fetchYarnDeps {
    yarnLock = "${src}/src/frontend/yarn.lock";
-    hash = "sha256-ei4xj+W2j5O675cpMAG4yCB3cPLeYwMhqKTacPWFjoo=";
+    hash = "sha256-07zsggGQFX/Wx/fxs1f0w01HHx7Z2BG5d3PIBlX2SVM=";
  };

  nativeBuildInputs = [
    nodejs
    fixup-yarn-lock
    yarn
+    yarnConfigHook
+    yarnBuildHook
  ];

-  configurePhase = ''
-    runHook preConfigure
-
-    export HOME=$(mktemp -d)
-    yarn config --offline set yarn-offline-mirror "$offlineCache"
-    fixup-yarn-lock yarn.lock
-
-    # Fixup what fixup-yarn-lock does not fix. Result in error if not fixed.
-    substituteInPlace yarn.lock \
-      --replace-fail '"@fastify/otel@https://codeload.github.com/getsentry/fastify-otel/tar.gz/ae3088d65e286bdc94ac5d722573537d6a6671bb"' '"@fastify/otel@^0.8.0"'
-
-    yarn install \
-        --frozen-lockfile \
-        --force \
-        --production=false \
-        --ignore-engines \
-        --ignore-platform \
-        --ignore-scripts \
-        --no-progress \
-        --non-interactive \
-        --offline
-
-    patchShebangs node_modules
-
-    runHook postConfigure
-  '';
-
-  buildPhase = ''
-    runHook preBuild
-
-    yarn --offline app:build
-
-    runHook postBuild
-  '';
+  yarnBuildScript = "app:build";

  installPhase = ''
    runHook preInstall
@@ -1,109 +0,0 @@
-From dd7d54e64bbdb853ff60162908f142cb34034cdd Mon Sep 17 00:00:00 2001
-From: soyouzpanda <soyouzpanda@soyouzpanda.fr>
-Date: Mon, 28 Apr 2025 18:18:39 +0200
-Subject: [PATCH 1/2] =?UTF-8?q?=E2=9C=A8(backend)=20support=20`=5FFILE`=20?=
- =?UTF-8?q?environment=20variables=20for=20secrets?=
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Allow configuration variables that handles secrets, like
-`DJANGO_SECRET_KEY` to be able to read from a file which is given
-through an environment file.
-
-For example, if `DJANGO_SECRET_KEY_FILE` is set to
-`/var/lib/docs/django-secret-key`, the value of `DJANGO_SECRET_KEY` will
-be the content of `/var/lib/docs/django-secret-key`.
---
- src/backend/impress/settings.py | 19 ++++++++++---------
- 1 files changed, 10 insertions(+), 9 deletions(-)
-
-diff --git a/impress/settings.py b/impress/settings.py
-index 571d7052..23c75a98 100755
--- a/impress/settings.py
-+++ b/impress/settings.py
-@@ -18,6 +18,7 @@ from django.utils.translation import gettext_lazy as _
- 
- import sentry_sdk
- from configurations import Configuration, values
-+from lasuite.configuration.values import SecretFileValue
- from sentry_sdk.integrations.django import DjangoIntegration
- from sentry_sdk.integrations.logging import ignore_logger
- 
-@@ -65,7 +66,7 @@ class Base(Configuration):
- 
-     # Security
-     ALLOWED_HOSTS = values.ListValue([])
-    SECRET_KEY = values.Value(None)
-+    SECRET_KEY = SecretFileValue(None)
-     SERVER_TO_SERVER_API_TOKENS = values.ListValue([])
- 
-     # Application definition
-@@ -84,7 +85,7 @@ class Base(Configuration):
-                 "impress", environ_name="DB_NAME", environ_prefix=None
-             ),
-             "USER": values.Value("dinum", environ_name="DB_USER", environ_prefix=None),
-            "PASSWORD": values.Value(
-+            "PASSWORD": SecretFileValue(
-                 "pass", environ_name="DB_PASSWORD", environ_prefix=None
-             ),
-             "HOST": values.Value(
-@@ -122,10 +123,10 @@ class Base(Configuration):
-     AWS_S3_ENDPOINT_URL = values.Value(
-         environ_name="AWS_S3_ENDPOINT_URL", environ_prefix=None
-     )
-    AWS_S3_ACCESS_KEY_ID = values.Value(
-+    AWS_S3_ACCESS_KEY_ID = SecretFileValue(
-         environ_name="AWS_S3_ACCESS_KEY_ID", environ_prefix=None
-     )
-    AWS_S3_SECRET_ACCESS_KEY = values.Value(
-+    AWS_S3_SECRET_ACCESS_KEY = SecretFileValue(
-         environ_name="AWS_S3_SECRET_ACCESS_KEY", environ_prefix=None
-     )
-     AWS_S3_REGION_NAME = values.Value(
-@@ -384,7 +385,7 @@ class Base(Configuration):
-     EMAIL_BRAND_NAME = values.Value(None)
-     EMAIL_HOST = values.Value(None)
-     EMAIL_HOST_USER = values.Value(None)
-    EMAIL_HOST_PASSWORD = values.Value(None)
-+    EMAIL_HOST_PASSWORD = SecretFileValue(None)
-     EMAIL_LOGO_IMG = values.Value(None)
-     EMAIL_PORT = values.PositiveIntegerValue(None)
-     EMAIL_USE_TLS = values.BooleanValue(False)
-@@ -407,7 +408,7 @@ class Base(Configuration):
-     COLLABORATION_API_URL = values.Value(
-         None, environ_name="COLLABORATION_API_URL", environ_prefix=None
-     )
-    COLLABORATION_SERVER_SECRET = values.Value(
-+    COLLABORATION_SERVER_SECRET = SecretFileValue(
-         None, environ_name="COLLABORATION_SERVER_SECRET", environ_prefix=None
-     )
-     COLLABORATION_WS_URL = values.Value(
-@@ -477,7 +478,7 @@ class Base(Configuration):
-     OIDC_RP_CLIENT_ID = values.Value(
-         "impress", environ_name="OIDC_RP_CLIENT_ID", environ_prefix=None
-     )
-    OIDC_RP_CLIENT_SECRET = values.Value(
-+    OIDC_RP_CLIENT_SECRET = SecretFileValue(
-         None,
-         environ_name="OIDC_RP_CLIENT_SECRET",
-         environ_prefix=None,
-@@ -592,7 +593,7 @@ class Base(Configuration):
-     AI_FEATURE_ENABLED = values.BooleanValue(
-         default=False, environ_name="AI_FEATURE_ENABLED", environ_prefix=None
-     )
-    AI_API_KEY = values.Value(None, environ_name="AI_API_KEY", environ_prefix=None)
-+    AI_API_KEY = SecretFileValue(None, environ_name="AI_API_KEY", environ_prefix=None)
-     AI_BASE_URL = values.Value(None, environ_name="AI_BASE_URL", environ_prefix=None)
-     AI_MODEL = values.Value(None, environ_name="AI_MODEL", environ_prefix=None)
-     AI_ALLOW_REACH_FROM = values.Value(
-@@ -613,7 +614,7 @@ class Base(Configuration):
-     }
- 
-     # Y provider microservice
-    Y_PROVIDER_API_KEY = values.Value(
-+    Y_PROVIDER_API_KEY = SecretFileValue(
-         environ_name="Y_PROVIDER_API_KEY",
-         environ_prefix=None,
-     )
-
@@ -3,34 +3,40 @@
  python3,
  fetchFromGitHub,
  nixosTests,
+  fetchPypi,
 }:
 let
  python = python3.override {
    self = python3;
    packageOverrides = self: super: {
      django = super.django_5_2;
+      django-csp = super.django-csp.overridePythonAttrs rec {
+        version = "4.0";
+        src = fetchPypi {
+          inherit version;
+          pname = "django_csp";
+          hash = "sha256-snAQu3Ausgo9rTKReN8rYaK4LTOLcPvcE8OjvShxKDM=";
+        };
+      };
    };
  };
 in

 python.pkgs.buildPythonApplication rec {
  pname = "lasuite-docs";
-  version = "3.3.0";
+  version = "3.4.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "suitenumerique";
    repo = "docs";
    tag = "v${version}";
-    hash = "sha256-SLTNkK578YhsDtVBS4vH0E/rXx+rXZIyXMhqwr95QEA=";
+    hash = "sha256-QAWwyFp9l+C0XfVu975zjiv61e/S2nYKkUSv4/p7gxw=";
  };

  sourceRoot = "source/src/backend";

  patches = [
-    # Support for $ENVIRONMENT_VARIABLE_FILE to be able to pass secret files
-    # See: https://github.com/suitenumerique/docs/pull/912
-    ./environment_variables.patch
    # Support configuration throught environment variables for SECURE_*
    ./secure_settings.patch
  ];
@@ -45,6 +51,7 @@ python.pkgs.buildPythonApplication rec {
    django-configurations
    django-cors-headers
    django-countries
+    django-csp
    django-extensions
    django-filter
    django-lasuite
@@ -6,11 +6,11 @@

 stdenvNoCC.mkDerivation rec {
  pname = "libguestfs-appliance";
-  version = "1.54.0";
+  version = "1.56.0";

  src = fetchurl {
    url = "http://download.libguestfs.org/binaries/appliance/appliance-${version}.tar.xz";
-    hash = "sha256-D7f4Cnjx+OmLfqQWmauyXZiSjayG9TCmxftj0iOPFso=";
+    hash = "sha256-YbJlNaogMyutdtc7d+etyJvdd//yE8tedsZfkGXJr54=";
  };

  installPhase = ''
@@ -11,8 +11,6 @@
  cpio,
  gperf,
  cdrkit,
-  flex,
-  bison,
  qemu,
  pcre2,
  augeas,
@@ -29,10 +27,9 @@
  db,
  gmp,
  readline,
-  file,
  numactl,
  libapparmor,
-  jansson,
+  json_c,
  getopt,
  perlPackages,
  python3,
@@ -48,11 +45,11 @@ assert appliance == null || lib.isDerivation appliance;

 stdenv.mkDerivation (finalAttrs: {
  pname = "libguestfs";
-  version = "1.54.1";
+  version = "1.56.1";

  src = fetchurl {
    url = "https://libguestfs.org/download/${lib.versions.majorMinor finalAttrs.version}-stable/libguestfs-${finalAttrs.version}.tar.gz";
-    sha256 = "sha256-bj/GrBkmdfe8KEClYbs2o209Wo36f4jqL1P4z2AqF34=";
+    hash = "sha256-nK3VUK4xLy/+JDt3N9P0bVa+71Ob7IODyoyw0/32LvU=";
  };

  strictDeps = true;
@@ -60,10 +57,8 @@ stdenv.mkDerivation (finalAttrs: {
    [
      autoreconfHook
      removeReferencesTo
-      bison
      cdrkit
      cpio
-      flex
      getopt
      gperf
      makeWrapper
@@ -86,7 +81,7 @@ stdenv.mkDerivation (finalAttrs: {
  buildInputs = [
    libxcrypt
    ncurses
-    jansson
+    json_c
    pcre2
    augeas
    libxml2
@@ -100,7 +95,6 @@ stdenv.mkDerivation (finalAttrs: {
    libvirt
    gmp
    readline
-    file
    hivex
    db
    numactl
@@ -111,7 +105,6 @@ stdenv.mkDerivation (finalAttrs: {
    zstd
    ocamlPackages.ocamlbuild
    ocamlPackages.ocaml_libvirt
-    ocamlPackages.ounit
    ocamlPackages.augeas
    ocamlPackages.ocamlbuild
  ] ++ lib.optional javaSupport jdk;
@@ -194,6 +187,7 @@ stdenv.mkDerivation (finalAttrs: {
      lgpl21Plus
    ];
    homepage = "https://libguestfs.org/";
+    changelog = "https://libguestfs.org/guestfs-release-notes-${lib.versions.majorMinor finalAttrs.version}.1.html";
    maintainers = with lib.maintainers; [
      offline
      lukts30
@@ -17,13 +17,13 @@ in

 stdenv.mkDerivation rec {
  pname = "lsof";
-  version = "4.99.4";
+  version = "4.99.5";

  src = fetchFromGitHub {
    owner = "lsof-org";
    repo = "lsof";
    rev = version;
-    hash = "sha256-JyvQV/JOMaL/3jUr6O0YIzJU/JcXVR65CJf5ip7334w=";
+    hash = "sha256-zn09cwFFz5ZNJu8GwGGSSGNx5jvXbKLT6/+Lcmn1wK8=";
  };

  postPatch =
@@ -26,8 +26,18 @@ stdenv.mkDerivation rec {
      url = "https://github.com/nmap/ncrack/commit/cc4103267bab6017a4da9d41156d0c1075012eba.patch";
      sha256 = "06nlfvc7p108f8ppbcgwmj4iwmjy95xhc1sawa8c78lrx22r7gy3";
    })
+    # https://github.com/nmap/ncrack/pull/127
+    (fetchpatch {
+      url = "https://src.fedoraproject.org/rpms/ncrack/raw/425a54633e220b6bafca37554e5585e2c6b48082/f/ncrack-0.7-fedora-c99.patch";
+      hash = "sha256-kPYLPJ04dFI+WZQBecuTHXdTZhc40FDQkt35Jrddoyw=";
+    })
  ];

+  postPatch = ''
+    substituteInPlace crypto.cc \
+      --replace-fail "register" ""
+  '';
+
  # Our version is good; the check is bad.
  configureFlags = [ "--without-zlib-version-check" ];

@@ -8,16 +8,16 @@

 buildGoModule rec {
  pname = "osv-scanner";
-  version = "2.0.3";
+  version = "2.1.0";

  src = fetchFromGitHub {
    owner = "google";
    repo = "osv-scanner";
    tag = "v${version}";
-    hash = "sha256-jYcyzaUjIxuj4VoindgoAGbXVnAU6EgZW8eIu7kBDNM=";
+    hash = "sha256-Xr+16wG/iC4SxytfpjFDd3eKvINtCTMTECh3//wFHtY=";
  };

-  vendorHash = "sha256-7/y1woEnZyIlE6j/I/+dA9jvW1W4946DjOJwR7rWTFs=";
+  vendorHash = "sha256-+Ad4XiD4npaATUybVym1Pr+NwgjYDGNTGWdQEcgjWsI=";

  subPackages = [
    "cmd/osv-scanner"
@@ -2,9 +2,9 @@

 buildDotnetGlobalTool {
  pname = "pbm";
-  version = "1.4.4";
+  version = "1.4.5";

-  nugetHash = "sha256-2MoIpgBDrjbi2nInGxivgjLSnS/iyv01y0Yia8R/Gyc=";
+  nugetHash = "sha256-iwacwYa1bB51Wp7PvrUclJ+Rdn0yzZa0EKcBwbpGSag=";

  meta = with lib; {
    description = "CLI for managing Akka.NET applications and Akka.NET Clusters";
@@ -54,7 +54,7 @@ stdenv.mkDerivation (finalAttrs: {
    description = "Lightweight evaluation system based on Lemon + LemonPlus for OI competitions";
    homepage = "https://github.com/Project-LemonLime/Project_LemonLime";
    changelog = "https://github.com/Project-LemonLime/Project_LemonLime/releases/tag/${finalAttrs.version}";
-    license = lib.licenses.gpl3Only;
+    license = lib.licenses.gpl3Plus;
    maintainers = with lib.maintainers; [
      sigmanificient
      bot-wxt1221
@@ -11,17 +11,17 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "proxyauth";
-  version = "0.7.12";
+  version = "0.8.0";

  src = fetchFromGitHub {
    owner = "ProxyAuth";
    repo = "ProxyAuth";
    tag = finalAttrs.version;
-    hash = "sha256-P0sAbcaf0jP+d8YjHlNKqf7H5iv/hEr/IQbCE7cgeiQ=";
+    hash = "sha256-cVjD91tBCGyslLsYUSP1Gy7KuMQZDVxQXU7fQkWeWyM=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-Yxyg82rQaMgsnWOWE+DmrCzBBpgsicL2Qj6AB+7tv44=";
+  cargoHash = "sha256-YhFOh60D014Tb/Gi3u+tpmXbaaIFIB5HU4X8rhWPV40=";

  nativeBuildInputs = [
    pkg-config
@@ -7,17 +7,17 @@
 }:
 rustPlatform.buildRustPackage rec {
  pname = "railway";
-  version = "4.5.4";
+  version = "4.5.5";

  src = fetchFromGitHub {
    owner = "railwayapp";
    repo = "cli";
    rev = "v${version}";
-    hash = "sha256-Ov7s7Pl57rh8+aDi0rXP386ON2U9j4xHJEgEKbwsymk=";
+    hash = "sha256-l+HbtJyP6mygIh+H6MzfRoyz4RTgtF9B4hbQBHVRwhg=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-oo9vV6oFzyVCiSLXqme/HOchZcNwPxYyrufwFTnxdoU=";
+  cargoHash = "sha256-jzql0ndlQlDHYhfXO5pAKlnQr79QG/MCK+som2qwTfY=";

  nativeBuildInputs = [ pkg-config ];

@@ -11,7 +11,7 @@ gem 'marcel'
 gem 'mail', '~> 2.8.1'
 gem 'nokogiri', '~> 1.18.3'
 gem 'i18n', '~> 1.14.1'
-gem 'rbpdf', '~> 1.21.3'
+gem 'rbpdf', '~> 1.21.4'
 gem 'addressable'
 gem 'rubyzip', '~> 2.3.0'
 gem 'propshaft', '~> 1.1.0'
@@ -19,7 +19,7 @@ gem 'rack', '>= 3.1.3'

 #  Ruby Standard Gems
 gem 'csv', '~> 3.2.8'
-gem 'net-imap', '~> 0.4.8'
+gem 'net-imap', '~> 0.4.20'
 gem 'net-pop', '~> 0.1.2'
 gem 'net-smtp', '~> 0.4.0'

@@ -67,7 +67,7 @@ group :development do
 end

 group :test do
-  gem "rails-dom-testing"
+  gem "rails-dom-testing", '>= 2.3.0'
  gem 'mocha', '>= 2.0.1'
  gem 'simplecov', '~> 0.22.0', :require => false
  gem "ffi", platforms: [:mri, :mingw, :x64_mingw, :mswin]
@@ -77,6 +77,7 @@ group :test do
  gem 'selenium-webdriver', '>= 4.11.0'
  # RuboCop
  gem 'rubocop', '~> 1.68.0', require: false
+  gem 'rubocop-ast', '~> 1.40.0', require: false
  gem 'rubocop-performance', '~> 1.22.0', require: false
  gem 'rubocop-rails', '~> 2.27.0', require: false
  gem 'bundle-audit', require: false
@@ -112,7 +112,7 @@ GEM
      html-pipeline
    docile (1.4.1)
    drb (2.2.3)
-    erb (5.0.1)
+    erb (5.0.2)
    erubi (1.13.1)
    ffi (1.17.2)
    globalid (1.2.1)
@@ -123,12 +123,12 @@ GEM
    htmlentities (4.3.4)
    i18n (1.14.7)
      concurrent-ruby (~> 1.0)
-    io-console (0.8.0)
+    io-console (0.8.1)
    irb (1.15.2)
      pp (>= 0.6.0)
      rdoc (>= 4.0.0)
      reline (>= 0.4.2)
-    json (2.12.2)
+    json (2.13.0)
    language_server-protocol (3.17.0.5)
    listen (3.9.0)
      rb-fsevent (~> 0.10, >= 0.10.3)
@@ -173,7 +173,6 @@ GEM
    pp (0.6.2)
      prettyprint
    prettyprint (0.2.0)
-    prism (1.4.0)
    propshaft (1.1.0)
      actionpack (>= 7.0.0)
      activesupport (>= 7.0.0)
@@ -261,9 +260,8 @@ GEM
      rubocop-ast (>= 1.32.2, < 2.0)
      ruby-progressbar (~> 1.7)
      unicode-display_width (>= 2.4.0, < 3.0)
-    rubocop-ast (1.45.1)
-      parser (>= 3.3.7.2)
-      prism (~> 1.4)
+    rubocop-ast (1.40.0)
+      parser (>= 3.3.1.0)
    rubocop-performance (1.22.1)
      rubocop (>= 1.48.1, < 2.0)
      rubocop-ast (>= 1.31.1, < 2.0)
@@ -289,7 +287,7 @@ GEM
      docile (~> 1.1)
      simplecov-html (~> 0.11)
      simplecov_json_formatter (~> 0.1)
-    simplecov-html (0.13.1)
+    simplecov-html (0.13.2)
    simplecov_json_formatter (0.1.4)
    sqlite3 (1.7.3)
      mini_portile2 (~> 2.8.0)
@@ -342,7 +340,7 @@ DEPENDENCIES
  mini_mime (~> 1.1.0)
  mocha (>= 2.0.1)
  mysql2 (~> 0.5.0)
-  net-imap (~> 0.4.8)
+  net-imap (~> 0.4.20)
  net-ldap (~> 0.17.0)
  net-pop (~> 0.1.2)
  net-smtp (~> 0.4.0)
@@ -352,13 +350,14 @@ DEPENDENCIES
  puma
  rack (>= 3.1.3)
  rails (= 7.2.2.1)
-  rails-dom-testing
-  rbpdf (~> 1.21.3)
+  rails-dom-testing (>= 2.3.0)
+  rbpdf (~> 1.21.4)
  roadie-rails (~> 3.2.0)
  rotp (>= 5.0.0)
  rouge (~> 4.5)
  rqrcode
  rubocop (~> 1.68.0)
+  rubocop-ast (~> 1.40.0)
  rubocop-performance (~> 1.22.0)
  rubocop-rails (~> 2.27.0)
  rubyzip (~> 2.3.0)
@@ -488,10 +488,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "08rc8pzri3g7c85c76x84j05hkk12jvalrm2m3n97k1n7f03j13n";
+      sha256 = "03vcq8g8rxdq8njp9j9k9fxwjw19q4m08c7lxjs0yc6l8f0ja3yk";
      type = "gem";
    };
-    version = "5.0.1";
+    version = "5.0.2";
  };
  erubi = {
    groups = [ "default" ];
@@ -595,10 +595,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "18pgvl7lfjpichdfh1g50rpz0zpaqrpr52ybn9liv1v9pjn9ysnd";
+      sha256 = "1jszj95hazqqpnrjjzr326nn1j32xmsc9xvd97mbcrrgdc54858y";
      type = "gem";
    };
-    version = "0.8.0";
+    version = "0.8.1";
  };
  irb = {
    dependencies = [
@@ -627,10 +627,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1x5b8ipv6g0z44wgc45039k04smsyf95h2m5m67mqq35sa5a955s";
+      sha256 = "1861nwzxrfn7g90zmq9mndblprcqlfs1s0lyqp37wqdmip7g3gd4";
      type = "gem";
    };
-    version = "2.12.2";
+    version = "2.13.0";
  };
  language_server-protocol = {
    groups = [
@@ -957,19 +957,6 @@
    };
    version = "0.2.0";
  };
-  prism = {
-    groups = [
-      "default"
-      "test"
-    ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "0gkhpdjib9zi9i27vd9djrxiwjia03cijmd6q8yj2q1ix403w3nw";
-      type = "gem";
-    };
-    version = "1.4.0";
-  };
  propshaft = {
    dependencies = [
      "actionpack"
@@ -1394,21 +1381,15 @@
    version = "1.68.0";
  };
  rubocop-ast = {
-    dependencies = [
-      "parser"
-      "prism"
-    ];
-    groups = [
-      "default"
-      "test"
-    ];
+    dependencies = [ "parser" ];
+    groups = [ "test" ];
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0gis8w51k5dsmzzlppvwwznqyfd73fa3zcrpl1xihzy1mm4jw14l";
+      sha256 = "1rdjvc8jz05svc017akwsf2n91bmyj016m5qsg2dyz2i115hxyhp";
      type = "gem";
    };
-    version = "1.45.1";
+    version = "1.40.0";
  };
  rubocop-performance = {
    dependencies = [
@@ -1547,10 +1528,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "02zi3rwihp7rlnp9x18c9idnkx7x68w6jmxdhyc0xrhjwrz0pasx";
+      sha256 = "0ikjfwydgs08nm3xzc4cn4b6z6rmcrj2imp84xcnimy2wxa8w2xx";
      type = "gem";
    };
-    version = "0.13.1";
+    version = "0.13.2";
  };
  simplecov_json_formatter = {
    groups = [
@@ -12,17 +12,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "tpnote";
-  version = "1.25.11";
+  version = "1.25.12";

  src = fetchFromGitHub {
    owner = "getreu";
    repo = "tp-note";
    tag = "v${version}";
-    hash = "sha256-5YqOOHz4L+kho+08mYQSjcm1SFDeAas+xNaMhuY7H4s=";
+    hash = "sha256-rjRZVD0EDRtSiF8kU3VyQJhBJEGDqDsjJgEZkVeC+L0=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-qYQ6MJQfffiqXyvjZAl1qjbMZYeEw3Dt4uKlaKoh+vQ=";
+  cargoHash = "sha256-lUwusYFt7shEt2fTV4N5bn6bYTWDjUU7hY9VsC2bDHo=";

  nativeBuildInputs = [
    cmake
@@ -6,9 +6,10 @@
  writeShellApplication,
  nodejs,
  gnutar,
+  jq,
+  moreutils,
  nix-update,
  prefetch-npm-deps,
-  gnused,
 }:

 buildNpmPackage (finalAttrs: {
@@ -26,11 +27,21 @@ buildNpmPackage (finalAttrs: {
    hash = "sha256-cuddvrksLm65o0y1nXT6tcLubzKgMkqJQF9hZdWgg3Q=";
  };

+  # The upstream GitHub repository's package-lock.json differs from the package.json in the npmjs tarball.
+  # For example, package-lock.json for v5.8.3 defines TypeScript as version 5.9.0. Therefore, we should use our own package-lock.json file.
+  # These files are typically large due to devDependencies. Removing the devDependencies section is better, especially considering issue #327064.
+  #
+  # We've removed devDependencies from package-lock.json via updateScript to minimize its size.
+  # Now, we must also modify package.json to reflect this change.
+  # As TypeScript will then have no dependencies, place an empty node_modules directory.
  postPatch = ''
+    ${lib.getExe jq} 'del(.devDependencies)' package.json | ${moreutils}/bin/sponge package.json
    ln -s '${./package-lock.json}' package-lock.json
+    mkdir -p node_modules
  '';

-  npmDepsHash = "sha256-Y/+QPAVOQWKxrHBNEejC3UZrYKQNm7CleR0whFm2sLw=";
+  npmDepsHash = "sha256-f/7Dxwoz0qv7T3Ez4jeRvmu7PxhzObwczjO7JcEcCr4=";
+  forceEmptyCache = true;

  dontNpmBuild = true;

@@ -47,13 +58,15 @@ buildNpmPackage (finalAttrs: {
      runtimeInputs = [
        nodejs
        gnutar
+        jq
        nix-update
        prefetch-npm-deps
-        gnused
      ];
      runtimeEnv = {
        PNAME = finalAttrs.pname;
        PKG_DIR = builtins.toString ./.;
+        FORCE_EMPTY_CACHE = "true";
+        OLD_NPM_DEPS_HASH = finalAttrs.npmDepsHash;
      };
      text = builtins.readFile ./update.bash;
    });
@@ -1,16 +1,23 @@
+pkg_file="$PKG_DIR/package.nix"
+
 cd "$PKG_DIR"

 # Update lockfile
+rm ./package-lock.json
 version="$(npm view typescript version)"
 npm pack typescript
 tar xvf "typescript-${version}.tgz"
-mv package/package.json ./
+# Minimize size of package-lock.json
+jq 'del(.devDependencies)' package/package.json > package.json
 npm install --package-lock-only
-npmDepsHash=$(prefetch-npm-deps ./package-lock.json)
 rm -rf ./package ./package.json ./"typescript-${version}.tgz"
-
+NEW_NPM_DEPS_HASH=$(prefetch-npm-deps ./package-lock.json)
 cd -

-# Update version and hashes
+# Update version and src hash
 nix-update "$PNAME" --version "$version"
-sed -E 's#\bnpmDepsHash = ".*?"#npmDepsHash = "'"$npmDepsHash"'"#' -i "$PKG_DIR/package.nix"
+
+# Update npmDepsHash
+pkg_body="$(<"$pkg_file")"
+pkg_body="${pkg_body//"$OLD_NPM_DEPS_HASH"/"$NEW_NPM_DEPS_HASH"}"
+echo "$pkg_body" >"$pkg_file"
@@ -10,12 +10,12 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "unifi-controller";
-  version = "9.2.87";
+  version = "9.3.43";

  # see https://community.ui.com/releases / https://www.ui.com/download/unifi
  src = fetchurl {
    url = "https://dl.ui.com/unifi/${finalAttrs.version}/unifi_sysvinit_all.deb";
-    hash = "sha256-m7p71EzTWBUC6CePe+Zzbrhu0cqgroq+GkxaZtCr00Q=";
+    hash = "sha256-KpjPLiN8HJT3jXaQgybn6y8NCGwTR7jm0oOsudbphSM=";
  };

  nativeBuildInputs = [
@@ -18,17 +18,17 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "uv";
-  version = "0.7.20";
+  version = "0.7.21";

  src = fetchFromGitHub {
    owner = "astral-sh";
    repo = "uv";
    tag = finalAttrs.version;
-    hash = "sha256-DHad9vDkqmsUE9mfYJef7+Y25ryLWTRyGSe9hC+O/2U=";
+    hash = "sha256-xY7olVRb8xEvTB+VuUNoq29f37sms+JliU4L9dxsReU=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-WmJlYBaPHKm5yrypESNyJS4PoOx93MxHh6D7w2rw23A=";
+  cargoHash = "sha256-JVmRRYAHXEGzayiEnWPYi3azVPqLI6z4D0gx395glFQ=";

  buildInputs = [
    rust-jemalloc-sys
@@ -27,10 +27,16 @@ stdenv.mkDerivation (finalAttrs: {

  # error: cannot initialize a variable of type 'xmlErrorPtr' (aka '_xmlError *')
  #        with an rvalue of type 'const xmlError *' (aka 'const _xmlError *')
-  postPatch = ''
-    substituteInPlace src/wraplibxml.cpp \
-      --replace-fail "xmlErrorPtr err" "const xmlError *err"
-  '';
+  postPatch =
+    ''
+      substituteInPlace src/wraplibxml.cpp \
+        --replace-fail "xmlErrorPtr err" "const xmlError *err"
+    ''
+    # error: invalid type argument of unary '*' (have 'long int')
+    + ''
+      substituteInPlace src/wraplibxml.cpp \
+        --replace-fail "initGenericErrorDefaultFunc ( NULL )" "xmlSetGenericErrorFunc( nullptr , nullptr )"
+    '';

  nativeBuildInputs = [
    intltool
@@ -7,17 +7,17 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "zed-discord-presence";
-  version = "0.8.1";
+  version = "0.8.3";

  src = fetchFromGitHub {
    owner = "xhyrom";
    repo = "zed-discord-presence";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Q8vCCuSMxEdKUP3V4JHHYpwAt8rc9QOg0z2nCu2dUsk=";
+    hash = "sha256-0y28W54JZtjGmgrI7A0Ews+GKHK96nX0ejHMuqxjvh4=";
  };

  cargoBuildFlags = [ "--package discord-presence-lsp" ];
-  cargoHash = "sha256-MxwonmTTc4jF/wyP6cZeJKuoOeFW0a0zDej8uqr/VsI=";
+  cargoHash = "sha256-D2apZowN+NDcMTLnGDbFUIdiGckFsuUhlrW6an8ZdGE=";

  passthru.updateScript = nix-update-script { };

@@ -99,7 +99,7 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "zed-editor";
-  version = "0.194.3";
+  version = "0.195.3";

  outputs =
    [ "out" ]
@@ -111,7 +111,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    owner = "zed-industries";
    repo = "zed";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-KF83XTCOWi78Uq720YSpJ6+JzllhqJQKLCqzq2WFS/U=";
+    hash = "sha256-30P46Tb/j/KXIxSiHFMbme11kLd+5CoKrvaDTmySJmU=";
  };

  patches = [
@@ -138,7 +138,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    '';

  useFetchCargoVendor = true;
-  cargoHash = "sha256-gSM3Qd87rhtG/oPLe3b1ItJmz9G4AEJY5h81lTz9Kl0=";
+  cargoHash = "sha256-OIXTvsTnxp3hGDF+K/66KlQLCEV5sfWTehtG3lHIdmA=";

  nativeBuildInputs =
    [
@@ -1,31 +1,26 @@
 {
  lib,
  elixir,
+  fetchpatch,
  fetchFromGitHub,
  fetchMixDeps,
+  makeWrapper,
  mixRelease,
  nix-update-script,
 }:
-# Based on the work of Hauleth
-# None of this would have happened without him

-let
+mixRelease rec {
  pname = "elixir-ls";
  version = "0.28.1";
+
  src = fetchFromGitHub {
    owner = "elixir-lsp";
    repo = "elixir-ls";
    rev = "v${version}";
    hash = "sha256-r4P+3MPniDNdF3SG2jfBbzHsoxn826eYd2tsv6bJBoI=";
  };
-in
-mixRelease {
-  inherit
-    pname
-    version
-    src
-    elixir
-    ;
+
+  inherit elixir;

  stripDebug = true;

@@ -35,43 +30,45 @@ mixRelease {
    hash = "sha256-8zs+99jwf+YX5SwD65FCPmfrYhTCx4AQGCGsDeCKxKc=";
  };

-  # elixir-ls is an umbrella app
-  # override configurePhase to not skip umbrella children
-  configurePhase = ''
-    runHook preConfigure
-    mix deps.compile --no-deps-check
-    runHook postConfigure
-  '';
+  patches = [
+    # fix elixir deterministic support https://github.com/elixir-lsp/elixir-ls/pull/1216
+    # remove > 0.28.1
+    (fetchpatch {
+      url = "https://github.com/elixir-lsp/elixir-ls/pull/1216.patch";
+      hash = "sha256-J1Q7XQXWYuCMq48e09deQU71DOElZ2zMTzrceZMky+0=";
+    })
+
+    # patch wrapper script to remove elixir detection and inject necessary paths
+    ./launch.sh.patch
+  ];
+
+  nativeBuildInputs = [
+    makeWrapper
+  ];

  # elixir-ls require a special step for release
  # compile and release need to be performed together because
  # of the no-deps-check requirement
  buildPhase = ''
    runHook preBuild
+
    mix do compile --no-deps-check, elixir_ls.release${lib.optionalString (lib.versionAtLeast elixir.version "1.16.0") "2"}
+
    runHook postBuild
  '';

  installPhase = ''
-    runHook preInstall
    mkdir -p $out/bin
-    cp -Rv release $out/lib
-    # Prepare the wrapper script
-    substitute release/language_server.sh $out/bin/elixir-ls \
-      --replace 'exec "''${dir}/launch.sh"' "exec $out/lib/launch.sh"
-    chmod +x $out/bin/elixir-ls
+    cp -Rv release $out/libexec
+
+    substituteAllInPlace $out/libexec/launch.sh
+
+    makeWrapper $out/libexec/language_server.sh $out/bin/elixir-ls \
+      --set ELS_INSTALL_PREFIX "$out/libexec"
+
+    makeWrapper $out/libexec/debug_adapter.sh $out/bin/elixir-debug-adapter \
+      --set ELS_INSTALL_PREFIX "$out/libexec"

-    substitute release/debug_adapter.sh $out/bin/elixir-debug-adapter \
-      --replace 'exec "''${dir}/launch.sh"' "exec $out/lib/launch.sh"
-    chmod +x $out/bin/elixir-debug-adapter
-    # prepare the launchers
-    substituteInPlace $out/lib/launch.sh \
-      --replace "ERL_LIBS=\"\$SCRIPTPATH:\$ERL_LIBS\"" \
-                "ERL_LIBS=$out/lib:\$ERL_LIBS" \
-      --replace "exec elixir" "exec ${elixir}/bin/elixir" \
-      --replace 'echo "" | elixir' "echo \"\" | ${elixir}/bin/elixir"
-    substituteInPlace $out/lib/exec.zsh \
-      --replace "exec elixir" "exec ${elixir}/bin/elixir"
    runHook postInstall
  '';

@@ -0,0 +1,169 @@
+diff --git i/scripts/launch.sh w/scripts/launch.sh
+index 21afbb1e..975cbdf0 100755
+--- i/scripts/launch.sh
+++ w/scripts/launch.sh
+@@ -1,125 +1,4 @@
+-#!/bin/sh
+-# Actual launcher. This does the hard work of figuring out the best way
+-# to launch the language server or the debug adapter.
+-
+-# Running this script is a one-time action per project launch, so we opt for
+-# code simplicity instead of performance. Hence some potentially redundant
+-# moves here.
+-
+-
+-did_relaunch=$1
+-
+-# Get the user's preferred shell
+-preferred_shell=$(basename "$SHELL")
+-
+-# Get current dirname
+-dirname=$(dirname "$0")
+-
+-case "${did_relaunch}" in
+-  "")
+-    if [ "$preferred_shell" = "bash" ]; then
+-      >&2 echo "Preferred shell is bash, relaunching"
+-      exec "$(which bash)" "$0" relaunch
+-    elif [ "$preferred_shell" = "zsh" ]; then
+-      >&2 echo "Preferred shell is zsh, relaunching"
+-      exec "$(which zsh)" "$0" relaunch
+-    elif [ "$preferred_shell" = "fish" ]; then
+-      >&2 echo "Preferred shell is fish, launching launch.fish"
+-      exec "$(which fish)" "$dirname/launch.fish"
+-    else
+-      >&2 echo "Preferred shell $preferred_shell is not supported, continuing in POSIX shell"
+-    fi
+-    ;;
+-  *)
+-    # We have an arg2, so we got relaunched
+-    ;;
+-esac
+-
+-# First order of business, see whether we can setup asdf
+-echo "Looking for asdf install" >&2
+-
+-readlink_f () {
+-  cd "$(dirname "$1")" > /dev/null || exit 1
+-  filename="$(basename "$1")"
+-  if [ -h "$filename" ]; then
+-    readlink_f "$(readlink "$filename")"
+-  else
+-    echo "$(pwd -P)/$filename"
+-  fi
+-}
+-
+-export_stdlib_path () {
+-  which_elixir_expr=$1
+-  stdlib_path=$(eval "$which_elixir_expr")
+-  stdlib_real_path=$(readlink_f "$stdlib_path")
+-  ELX_STDLIB_PATH=$(echo "$stdlib_real_path" | sed "s/\(.*\)\/bin\/elixir/\1/")
+-  export ELX_STDLIB_PATH
+-}
+-
+-# Check if we have the asdf binary for version >= 0.16.0
+-if command -v asdf >/dev/null 2>&1; then
+-    asdf_version=$(asdf --version 2>/dev/null)
+-    version=$(echo "$asdf_version" | grep -Eo '[0-9]+\.[0-9]+\.[0-9]+')
+-    major=$(echo "$version" | cut -d. -f1)
+-    minor=$(echo "$version" | cut -d. -f2)
+-    # If the version is less than 0.16.0 (i.e. major = 0 and minor < 16), use legacy method.
+-    if [ "$major" -eq 0 ] && [ "$minor" -lt 16 ]; then
+-        ASDF_DIR=${ASDF_DIR:-"${HOME}/.asdf"}
+-        ASDF_SH="${ASDF_DIR}/asdf.sh"
+-        if test -f "$ASDF_SH"; then
+-            >&2 echo "Legacy pre v0.16.0 asdf install found at $ASDF_SH, sourcing"
+-            # Source the old asdf.sh script for versions <= 0.15.0
+-            . "$ASDF_SH"
+-        else
+-            >&2 echo "Legacy asdf not found at $ASDF_SH"
+-        fi
+-    else
+-        >&2 echo "asdf executable found at $(command -v asdf). Using ASDF_DIR=${ASDF_DIR}, ASDF_DATA_DIR=${ASDF_DATA_DIR}."
+-    fi
+-    export_stdlib_path "asdf which elixir"
+-else
+-    # Fallback to old method for version <= 0.15.x
+-    ASDF_DIR=${ASDF_DIR:-"${HOME}/.asdf"}
+-    ASDF_SH="${ASDF_DIR}/asdf.sh"
+-    if test -f "$ASDF_SH"; then
+-        >&2 echo "Legacy pre v0.16.0 asdf install found at $ASDF_SH, sourcing"
+-        # Source the old asdf.sh script for versions <= 0.15.0
+-        . "$ASDF_SH"
+-        export_stdlib_path "asdf which elixir"
+-    else
+-        >&2 echo "asdf not found"
+-        >&2 echo "Looking for mise executable"
+-
+-        # Look for mise executable
+-        if command -v mise >/dev/null 2>&1; then
+-            >&2 echo "mise executable found at $(command -v mise), activating"
+-            eval "$($(command -v mise) env -s "$preferred_shell")"
+-            export_stdlib_path "mise which elixir"
+-        else
+-            >&2 echo "mise not found"
+-            >&2 echo "Looking for rtx executable"
+-
+-            # Look for rtx executable
+-            if command -v rtx >/dev/null 2>&1; then
+-                >&2 echo "rtx executable found at $(command -v rtx), activating"
+-                eval "$($(command -v rtx) env -s "$preferred_shell")"
+-                export_stdlib_path "rtx which elixir"
+-            else
+-                >&2 echo "rtx not found"
+-                >&2 echo "Looking for vfox executable"
+-
+-                # Look for vfox executable
+-                if command -v vfox >/dev/null 2>&1; then
+-                    >&2 echo "vfox executable found at $(command -v vfox), activating"
+-                    eval "$($(command -v vfox) activate "$preferred_shell")"
+-                else
+-                    >&2 echo "vfox not found"
+-                    export_stdlib_path "which elixir"
+-                fi
+-            fi
+-        fi
+-    fi
+-fi
+#!/usr/bin/env bash
+ 
+ # In case that people want to tweak the path, which Elixir to use, or
+ # whatever prior to launching the language server or the debug adapter, we
+@@ -138,29 +17,18 @@ fi
+ # script so we can correctly configure the Erlang library path to
+ # include the local .ez files, and then do what we were asked to do.
+ 
+-if [ -z "${ELS_INSTALL_PREFIX}" ]; then
+-  SCRIPT=$(readlink_f "$0")
+-  SCRIPTPATH=$(dirname "$SCRIPT")
+-else
+-  SCRIPTPATH=${ELS_INSTALL_PREFIX}
+-fi
+SCRIPT=$(readlink -f "$0")
+SCRIPTPATH=$(dirname "$SCRIPT")/../libexec
+ 
+ export MIX_ENV=prod
+ # Mix.install prints to stdout and reads from stdin
+ # we need to make sure it doesn't interfere with LSP/DAP
+-echo "" | elixir "$SCRIPTPATH/quiet_install.exs" >/dev/null || exit 1
+echo "" | @elixir@/bin/elixir "$SCRIPTPATH/quiet_install.exs" >/dev/null || exit 1
+ 
+ default_erl_opts="-kernel standard_io_encoding latin1 +sbwt none +sbwtdcpu none +sbwtdio none"
+ 
+-if [ "$preferred_shell" = "bash" ]; then
+-  source "$dirname/exec.bash"
+-elif [ "$preferred_shell" = "zsh" ]; then
+-  source "$dirname/exec.zsh"
+-else
+-  if [ -z "$ELS_ELIXIR_OPTS" ]
+-  then
+-    # in posix shell does not support arrays
+-    >&2 echo "ELS_ELIXIR_OPTS is not supported in current shell"
+-  fi
+-  exec elixir --erl "$default_erl_opts $ELS_ERL_OPTS" "$SCRIPTPATH/launch.exs"
+-fi
+# ensure elixir stdlib can be found
+ELX_STDLIB_PATH=${ELX_STDLIB_PATH:-@elixir@/lib/elixir}
+export ELX_STDLIB_PATH
+
+source "$SCRIPTPATH/exec.bash"
@@ -2,85 +2,62 @@
  lib,
  mkCoqDerivation,
  coq,
-  rocqPackages_9_0,
-  rocqPackages_9_1,
-  rocqPackages,
  stdlib,
  version ? null,
 }:

-(mkCoqDerivation {
-  pname = "bignums";
-  owner = "rocq-community";
-  inherit version;
-  defaultVersion =
-    let
-      case = case: out: { inherit case out; };
-    in
-    with lib.versions;
-    lib.switch coq.coq-version [
-      (case (range "9.0" "9.1") "9.0.0+rocq${coq.coq-version}")
-      (case (range "8.13" "8.20") "9.0.0+coq${coq.coq-version}")
-      (case (range "8.6" "8.17") "${coq.coq-version}.0")
-    ] null;
+let
+  derivation = mkCoqDerivation {
+    pname = "bignums";
+    owner = "rocq-community";
+    inherit version;
+    defaultVersion =
+      let
+        case = case: out: { inherit case out; };
+      in
+      with lib.versions;
+      lib.switch coq.coq-version [
+        (case (range "8.13" "8.20") "9.0.0+coq${coq.coq-version}")
+        (case (range "8.6" "8.17") "${coq.coq-version}.0")
+      ] null;

-  release."9.0.0+rocq9.1".sha256 = "sha256-MSjlfJs3JOakuShOj+isNlus0bKlZ+rkvzRoKZQK5RQ=";
-  release."9.0.0+rocq9.0".sha256 = "sha256-ctnwpyNVhryEUA5YEsAImrcJsNMhtBgDSOz+z5Z4R78=";
-  release."9.0.0+coq8.20".sha256 = "sha256-pkvyDaMXRalc6Uu1eBTuiqTpRauRrzu946c6TavyTKY=";
-  release."9.0.0+coq8.19".sha256 = "sha256-02uL+qWbUveHe67zKfc8w3U0iN3X2DKBsvP3pKpW8KQ=";
-  release."9.0.0+coq8.18".sha256 = "sha256-vLeJ0GNKl4M84Uj2tAwlrxJOSR6VZoJQvdlDhxJRge8=";
-  release."9.0.0+coq8.17".sha256 = "sha256-Mn85LqxJKPDIfpxRef9Uh5POwOKlTQ7jsMVz1wnQwuY=";
-  release."9.0.0+coq8.16".sha256 = "sha256-pwFTl4Unr2ZIirAB3HTtfhL2YN7G/Pg88RX9AhKWXbE=";
-  release."9.0.0+coq8.15".sha256 = "sha256-2oGOANn3XULHNIlyqjZ5ppQTQa2QF1zzf3YjHAd/pjo=";
-  release."9.0.0+coq8.14".sha256 = "sha256-qTU152Dz34W6nFZ0pPbja9ouUm/714ZrLQ/Z4N/HIC4=";
-  release."9.0.0+coq8.13".sha256 = "sha256-zvAqV3VAB7cN+nlMhjSXzxuDkdd387ju2VSb2EUthI0=";
-  release."8.17.0".sha256 = "sha256-MXYjqN86+3O4hT2ql62U83T5H03E/8ysH8erpvC/oyw=";
-  release."8.16.0".sha256 = "sha256-DH3iWwatPlhhCVYVlgL2WLkvneSVzSXUiKo2e0+1zR4=";
-  release."8.15.0".sha256 = "093klwlhclgyrba1iv18dyz1qp5f0lwiaa7y0qwvgmai8rll5fns";
-  release."8.14.0".sha256 = "0jsgdvj0ddhkls32krprp34r64y1rb5mwxl34fgaxk2k4664yq06";
-  release."8.13.0".sha256 = "1n66i7hd9222b2ks606mak7m4f0dgy02xgygjskmmav6h7g2sx7y";
-  release."8.12.0".sha256 = "14ijb3qy2hin3g4djx437jmnswxxq7lkfh3dwh9qvrds9a015yg8";
-  release."8.11.0".sha256 = "1xcd7c7qlvs0narfba6px34zq0mz8rffnhxw0kzhhg6i4iw115dp";
-  release."8.10.0".sha256 = "0bpb4flckn4nqxbs3wjiznyx1k7r8k93qdigp3qwmikp2lxvcbw5";
-  release."8.9.0".sha256 = "03qz1w2xb2j5p06liz5yyafl0fl9vprcqm6j0iwi7rxwghl00p01";
-  release."8.8.0".sha256 = "1ymxyrvjygscxkfj3qkq66skl3vdjhb670rzvsvgmwrjkrakjnfg";
-  release."8.7.0".sha256 = "11c4sdmpd3l6jjl4v6k213z9fhrmmm1xnly3zmzam1wrrdif4ghl";
-  release."8.6.0".rev = "v8.6.0";
-  release."8.6.0".sha256 = "0553pcsy21cyhmns6k9qggzb67az8kl31d0lwlnz08bsqswigzrj";
-  releaseRev = v: "${if lib.versions.isGe "9.0" v then "v" else "V"}${v}";
+    release."9.0.0+coq8.20".sha256 = "sha256-pkvyDaMXRalc6Uu1eBTuiqTpRauRrzu946c6TavyTKY=";
+    release."9.0.0+coq8.19".sha256 = "sha256-02uL+qWbUveHe67zKfc8w3U0iN3X2DKBsvP3pKpW8KQ=";
+    release."9.0.0+coq8.18".sha256 = "sha256-vLeJ0GNKl4M84Uj2tAwlrxJOSR6VZoJQvdlDhxJRge8=";
+    release."9.0.0+coq8.17".sha256 = "sha256-Mn85LqxJKPDIfpxRef9Uh5POwOKlTQ7jsMVz1wnQwuY=";
+    release."9.0.0+coq8.16".sha256 = "sha256-pwFTl4Unr2ZIirAB3HTtfhL2YN7G/Pg88RX9AhKWXbE=";
+    release."9.0.0+coq8.15".sha256 = "sha256-2oGOANn3XULHNIlyqjZ5ppQTQa2QF1zzf3YjHAd/pjo=";
+    release."9.0.0+coq8.14".sha256 = "sha256-qTU152Dz34W6nFZ0pPbja9ouUm/714ZrLQ/Z4N/HIC4=";
+    release."9.0.0+coq8.13".sha256 = "sha256-zvAqV3VAB7cN+nlMhjSXzxuDkdd387ju2VSb2EUthI0=";
+    release."8.17.0".sha256 = "sha256-MXYjqN86+3O4hT2ql62U83T5H03E/8ysH8erpvC/oyw=";
+    release."8.16.0".sha256 = "sha256-DH3iWwatPlhhCVYVlgL2WLkvneSVzSXUiKo2e0+1zR4=";
+    release."8.15.0".sha256 = "093klwlhclgyrba1iv18dyz1qp5f0lwiaa7y0qwvgmai8rll5fns";
+    release."8.14.0".sha256 = "0jsgdvj0ddhkls32krprp34r64y1rb5mwxl34fgaxk2k4664yq06";
+    release."8.13.0".sha256 = "1n66i7hd9222b2ks606mak7m4f0dgy02xgygjskmmav6h7g2sx7y";
+    release."8.12.0".sha256 = "14ijb3qy2hin3g4djx437jmnswxxq7lkfh3dwh9qvrds9a015yg8";
+    release."8.11.0".sha256 = "1xcd7c7qlvs0narfba6px34zq0mz8rffnhxw0kzhhg6i4iw115dp";
+    release."8.10.0".sha256 = "0bpb4flckn4nqxbs3wjiznyx1k7r8k93qdigp3qwmikp2lxvcbw5";
+    release."8.9.0".sha256 = "03qz1w2xb2j5p06liz5yyafl0fl9vprcqm6j0iwi7rxwghl00p01";
+    release."8.8.0".sha256 = "1ymxyrvjygscxkfj3qkq66skl3vdjhb670rzvsvgmwrjkrakjnfg";
+    release."8.7.0".sha256 = "11c4sdmpd3l6jjl4v6k213z9fhrmmm1xnly3zmzam1wrrdif4ghl";
+    release."8.6.0".rev = "v8.6.0";
+    release."8.6.0".sha256 = "0553pcsy21cyhmns6k9qggzb67az8kl31d0lwlnz08bsqswigzrj";
+    releaseRev = v: "${if lib.versions.isGe "9.0" v then "v" else "V"}${v}";

-  mlPlugin = true;
+    mlPlugin = true;

-  propagatedBuildInputs = [ stdlib ];
+    propagatedBuildInputs = [ stdlib ];

-  meta = {
-    license = lib.licenses.lgpl2;
+    meta = {
+      license = lib.licenses.lgpl2;
+    };
  };
-}).overrideAttrs
-  (
-    o:
-    # this is just a wrapper for rocPackages.bignums for Rocq >= 9.0
-    lib.optionalAttrs
-      (coq.version != null && (coq.version == "dev" || lib.versions.isGe "9.0" coq.version))
-      (
-        let
-          case = case: out: { inherit case out; };
-          rp = lib.switch coq.coq-version [
-            (case (lib.versions.isEq "9.0") rocqPackages_9_0)
-            (case (lib.versions.isEq "9.1") rocqPackages_9_1)
-          ] rocqPackages;
-        in
-        {
-          configurePhase = ''
-            echo no configuration
-          '';
-          buildPhase = ''
-            echo building nothing
-          '';
-          installPhase = ''
-            echo installing nothing
-          '';
-          propagatedBuildInputs = o.propagatedBuildInputs ++ [ rp.bignums ];
-        }
-      )
-  )
+in
+# this is just a wrapper for rocqPackages.bignums for Rocq >= 9.0
+if coq.rocqPackages ? bignums then
+  coq.rocqPackages.bignums.override {
+    inherit version stdlib;
+    inherit (coq.rocqPackages) rocq-core;
+  }
+else
+  derivation
@@ -3,9 +3,6 @@
  mkCoqDerivation,
  which,
  coq,
-  rocqPackages_9_0,
-  rocqPackages_9_1,
-  rocqPackages,
  stdlib,
  version ? null,
  elpi-version ? null,
@@ -23,7 +20,7 @@ let
        in
        with lib.versions;
        lib.switch coq.coq-version [
-          (case (range "8.20" "9.1") "2.0.7")
+          (case (range "8.20" "8.20") "2.0.7")
          (case (range "8.18" "8.19") "1.18.1")
          (case (range "8.16" "8.17") "1.17.0")
          (case "8.15" "1.15.0")
@@ -47,8 +44,8 @@ let
      in
      with lib.versions;
      lib.switch coq.coq-version [
-        (case (range "8.20" "9.1") "2.6.0")
-        (case (range "8.20" "9.0") "2.5.2")
+        (case (range "8.20" "8.20") "2.6.0")
+        (case (range "8.20" "8.20") "2.5.2")
        (case "8.19" "2.0.1")
        (case "8.18" "2.0.0")
        (case "8.17" "1.18.0")
@@ -141,42 +138,27 @@ let
  );
  patched-derivation4 = patched-derivation3.overrideAttrs (
    o:
-    # this is just a wrapper for rocPackages.rocq-elpi for Rocq >= 9.0
-    if coq.version != null && (coq.version == "dev" || lib.versions.isGe "9.0" coq.version) then
-      let
-        case = case: out: { inherit case out; };
-        rp = lib.switch coq.coq-version [
-          (case "9.0" rocqPackages_9_0)
-          (case "9.1" rocqPackages_9_1)
-        ] rocqPackages;
-      in
+    lib.optionalAttrs (o.version != null && (o.version == "dev" || lib.versions.isGe "2.5.0" o.version))
      {
        configurePhase = ''
-          echo no configuration
+          make dune-files || true
        '';
        buildPhase = ''
-          echo building nothing
+          dune build -p rocq-elpi @install ''${enableParallelBuilding:+-j $NIX_BUILD_CORES}
        '';
        installPhase = ''
-          echo installing nothing
+          dune install --root . rocq-elpi --prefix=$out --libdir $OCAMLFIND_DESTDIR
+          mkdir $out/lib/coq/
+          mv $OCAMLFIND_DESTDIR/coq $out/lib/coq/${coq.coq-version}
        '';
-        propagatedBuildInputs = o.propagatedBuildInputs ++ [ rp.rocq-elpi ];
      }
-    else
-      lib.optionalAttrs (o.version != null && (o.version == "dev" || lib.versions.isGe "2.5.0" o.version))
-        {
-          configurePhase = ''
-            make dune-files || true
-          '';
-          buildPhase = ''
-            dune build -p rocq-elpi @install ''${enableParallelBuilding:+-j $NIX_BUILD_CORES}
-          '';
-          installPhase = ''
-            dune install --root . rocq-elpi --prefix=$out --libdir $OCAMLFIND_DESTDIR
-            mkdir $out/lib/coq/
-            mv $OCAMLFIND_DESTDIR/coq $out/lib/coq/${coq.coq-version}
-          '';
-        }
  );
 in
-patched-derivation4
+# this is just a wrapper for rocqPackages.stdlib for Rocq >= 9.0
+if coq.rocqPackages ? rocq-elpi then
+  coq.rocqPackages.rocq-elpi.override {
+    inherit version elpi-version;
+    inherit (coq.rocqPackages) rocq-core;
+  }
+else
+  patched-derivation4
@@ -2,9 +2,6 @@
  lib,
  mkCoqDerivation,
  coq,
-  rocqPackages_9_0,
-  rocqPackages_9_1,
-  rocqPackages,
  stdlib,
  coq-elpi,
  version ? null,
@@ -21,7 +18,7 @@ let
      in
      with lib.versions;
      lib.switch coq.coq-version [
-        (case (range "8.20" "9.1") "1.9.1")
+        (case (range "8.20" "8.20") "1.9.1")
        (case (range "8.19" "8.20") "1.8.0")
        (case (range "8.18" "8.20") "1.7.1")
        (case (range "8.16" "8.18") "1.6.0")
@@ -60,44 +57,28 @@ let
      license = licenses.mit;
    };
  };
+  hb2 = hb.overrideAttrs (
+    o:
+    lib.optionalAttrs (lib.versions.isGe "1.2.0" o.version || o.version == "dev") {
+      buildPhase = "make build";
+    }
+    // (
+      if lib.versions.isGe "1.1.0" o.version || o.version == "dev" then
+        { installFlags = [ "DESTDIR=$(out)" ] ++ o.installFlags; }
+      else
+        { installFlags = [ "VFILES=structures.v" ] ++ o.installFlags; }
+    )
+    // lib.optionalAttrs (o.version != null && o.version == "1.8.1") {
+      propagatedBuildInputs = o.propagatedBuildInputs ++ [ stdlib ];
+    }
+  );
 in
-hb.overrideAttrs (
-  o:
-  lib.optionalAttrs (lib.versions.isGe "1.2.0" o.version || o.version == "dev") {
-    buildPhase = "make build";
+# this is just a wrapper for rocqPackages.hierarchy-builder for Rocq >= 9.0
+if coq.rocqPackages ? hierarchy-builder then
+  coq.rocqPackages.hierarchy-builder.override {
+    inherit version;
+    inherit (coq.rocqPackages) rocq-core;
+    rocq-elpi = coq-elpi;
  }
-  // (
-    if lib.versions.isGe "1.1.0" o.version || o.version == "dev" then
-      { installFlags = [ "DESTDIR=$(out)" ] ++ o.installFlags; }
-    else
-      { installFlags = [ "VFILES=structures.v" ] ++ o.installFlags; }
-  )
-  // lib.optionalAttrs (o.version != null && o.version == "1.8.1") {
-    propagatedBuildInputs = o.propagatedBuildInputs ++ [ stdlib ];
-  }
-  # this is just a wrapper for rocqPackages.hierarchy-builder for Rocq >= 9.0
-  //
-    lib.optionalAttrs
-      (coq.version != null && (coq.version == "dev" || lib.versions.isGe "9.0" coq.version))
-      (
-        let
-          case = case: out: { inherit case out; };
-          rp = lib.switch coq.coq-version [
-            (case "9.0" rocqPackages_9_0)
-            (case "9.1" rocqPackages_9_1)
-          ] rocqPackages;
-        in
-        {
-          configurePhase = ''
-            echo no configuration
-          '';
-          buildPhase = ''
-            echo building nothing
-          '';
-          installPhase = ''
-            echo installing nothing
-          '';
-          propagatedBuildInputs = o.propagatedBuildInputs ++ [ rp.hierarchy-builder ];
-        }
-      )
-)
+else
+  hb2
@@ -1,67 +1,43 @@
 {
  lib,
  mkCoqDerivation,
-  rocqPackages_9_0,
-  rocqPackages_9_1,
-  rocqPackages,
-  which,
  coq,
  version ? null,
 }:

 with lib;
-(mkCoqDerivation {
-  pname = "parseque";
-  repo = "parseque";
-  owner = "rocq-community";
+let
+  derivation = mkCoqDerivation {
+    pname = "parseque";
+    repo = "parseque";
+    owner = "rocq-community";

-  inherit version;
-  defaultVersion =
-    with versions;
-    switch
-      [ coq.coq-version ]
-      [
-        {
-          cases = [ (range "8.16" "9.0") ];
-          out = "0.2.2";
-        }
-      ]
-      null;
+    inherit version;
+    defaultVersion =
+      let
+        case = case: out: { inherit case out; };
+      in
+      with versions;
+      switch coq.coq-version [
+        (case (range "8.16" "8.20") "0.2.2")
+      ] null;

-  release."0.2.2".sha256 = "sha256-O50Rs7Yf1H4wgwb7ltRxW+7IF0b04zpfs+mR83rxT+E=";
+    release."0.2.2".sha256 = "sha256-O50Rs7Yf1H4wgwb7ltRxW+7IF0b04zpfs+mR83rxT+E=";

-  releaseRev = v: "v${v}";
+    releaseRev = v: "v${v}";

-  meta = {
-    description = "Total parser combinators in Coq/Rocq";
-    maintainers = with maintainers; [ womeier ];
-    license = licenses.mit;
+    meta = {
+      description = "Total parser combinators in Coq/Rocq";
+      maintainers = with maintainers; [ womeier ];
+      license = licenses.mit;
+    };
  };
-}).overrideAttrs
-  (
-    o:
-    # this is just a wrapper for rocPackages.parseque for Rocq >= 9.0
-    lib.optionalAttrs
-      (coq.version != null && (coq.version == "dev" || lib.versions.isGe "9.0" coq.version))
-      (
-        let
-          case = case: out: { inherit case out; };
-          rp = lib.switch coq.coq-version [
-            (case "9.0" rocqPackages_9_0)
-            (case "9.1" rocqPackages_9_1)
-          ] rocqPackages;
-        in
-        {
-          configurePhase = ''
-            echo no configuration
-          '';
-          buildPhase = ''
-            echo building nothing
-          '';
-          installPhase = ''
-            echo installing nothing
-          '';
-          propagatedBuildInputs = [ rp.parseque ];
-        }
-      )
-  )
+in
+# this is just a wrapper for rocqPackages.parseque for Rocq >= 9.0
+if coq.rocqPackages ? parseque then
+  coq.rocqPackages.parseque.override {
+    inherit version;
+    inherit (coq.rocqPackages) rocq-core;
+  }
+else
+  derivation
@@ -1,67 +1,54 @@
 {
  coq,
-  rocqPackages_9_0,
-  rocqPackages_9_1,
-  rocqPackages,
  mkCoqDerivation,
  lib,
  version ? null,
-}@args:
-(mkCoqDerivation {
+}:

-  pname = "stdlib";
-  repo = "stdlib";
-  owner = "coq";
-  opam-name = "coq-stdlib";
+let
+  derivation = mkCoqDerivation {

-  inherit version;
-  defaultVersion =
-    let
-      case = case: out: { inherit case out; };
-    in
-    with lib.versions;
-    lib.switch coq.coq-version [
-      (case (isLe "9.1") "9.0.0")
-      # the < 9.0 above is artificial as stdlib was included in Coq before
-    ] null;
-  releaseRev = v: "V${v}";
+    pname = "stdlib";
+    repo = "stdlib";
+    owner = "coq";
+    opam-name = "coq-stdlib";

-  release."9.0.0".sha256 = "sha256-2l7ak5Q/NbiNvUzIVXOniEneDXouBMNSSVFbD1Pf8cQ=";
-
-  configurePhase = ''
-    echo no configuration
-  '';
-  buildPhase = ''
-    echo building nothing
-  '';
-  installPhase = ''
-    echo installing nothing
-  '';
-
-  meta = {
-    description = "Compatibility metapackage for Coq Stdlib library after the Rocq renaming";
-    license = lib.licenses.lgpl21Only;
-  };
-
-}).overrideAttrs
-  (
-    o:
-    # stdlib is already included in Coq <= 8.20
-    if coq.version != null && coq.version != "dev" && lib.versions.isLt "8.21" coq.version then
-      {
-        installPhase = ''
-          touch $out
-        '';
-      }
-    else
+    inherit version;
+    defaultVersion =
      let
        case = case: out: { inherit case out; };
-        rp = lib.switch coq.coq-version [
-          (case "9.0" rocqPackages_9_0)
-          (case "9.1" rocqPackages_9_1)
-        ] rocqPackages;
      in
-      {
-        propagatedBuildInputs = [ rp.stdlib ];
-      }
-  )
+      with lib.versions;
+      lib.switch coq.coq-version [
+        (case (isLe "9.1") "9.0.0")
+        # the < 9.0 above is artificial as stdlib was included in Coq before
+      ] null;
+    releaseRev = v: "V${v}";
+
+    release."9.0.0".sha256 = "sha256-2l7ak5Q/NbiNvUzIVXOniEneDXouBMNSSVFbD1Pf8cQ=";
+
+    configurePhase = ''
+      echo no configuration
+    '';
+    buildPhase = ''
+      echo building nothing
+    '';
+    installPhase = ''
+      echo installing nothing
+      touch $out
+    '';
+
+    meta = {
+      description = "Compatibility metapackage for Coq Stdlib library after the Rocq renaming";
+      license = lib.licenses.lgpl21Only;
+    };
+  };
+in
+# this is just a wrapper for rocqPackages.stdlib for Rocq >= 9.0
+if coq.rocqPackages ? stdlib then
+  coq.rocqPackages.stdlib.override {
+    inherit version;
+    inherit (coq.rocqPackages) rocq-core;
+  }
+else
+  derivation
@@ -3,6 +3,7 @@
  mkCoqDerivation,
  coq,
  coq-elpi,
+  stdlib,
  version ? null,
 }:

@@ -36,7 +37,10 @@ mkCoqDerivation {
      ]
      null;

-  propagatedBuildInputs = [ coq-elpi ];
+  propagatedBuildInputs = [
+    coq-elpi
+    stdlib
+  ];

  meta = with lib; {
    description = "Generic goal preprocessing tool for proof automation tactics in Coq";
@@ -4,5 +4,6 @@ mkDerivation {
  sha256 = "sha256-7Qo6y0KAQ9lwD4oH+7wQ4W5i6INHIBDN9IQAAsYzNJw=";
  # https://hexdocs.pm/elixir/1.17.3/compatibility-and-deprecations.html#compatibility-between-elixir-and-erlang-otp
  minimumOTPVersion = "25";
+  maximumOTPVersion = "27";
  escriptPath = "lib/elixir/scripts/generate_app.escript";
 }
@@ -1,5 +1,4 @@
 {
-  pkgs,
  lib,
  stdenv,
  fetchFromGitHub,
@@ -33,7 +32,7 @@ let
    assertMsg
    concatStringsSep
    getVersion
-    optional
+    optionals
    optionalString
    toInt
    versions
@@ -68,11 +67,13 @@ let
      "${coreutils}/bin/env $out/bin/elixir"
    else
      "$out/bin/elixir";
+
+  erlc_opts = [ "deterministic" ] ++ optionals debugInfo [ "debug_info" ];
 in
 assert assertMsg (versionAtLeast (getVersion erlang) minimumOTPVersion) compatibilityMsg;
 assert assertMsg maxAssert compatibilityMsg;

-stdenv.mkDerivation ({
+stdenv.mkDerivation {
  pname = "${baseName}";

  inherit src version debugInfo;
@@ -80,20 +81,23 @@ stdenv.mkDerivation ({
  nativeBuildInputs = [ makeWrapper ];
  buildInputs = [ erlang ];

-  LANG = "C.UTF-8";
-  LC_TYPE = "C.UTF-8";
-
-  ERLC_OPTS =
-    let
-      erlc_opts = [ "deterministic" ] ++ optional debugInfo "debug_info";
-    in
-    "[${concatStringsSep "," erlc_opts}]";
+  env = {
+    LANG = "C.UTF-8";
+    LC_TYPE = "C.UTF-8";
+    DESTDIR = placeholder "out";
+    PREFIX = "/";
+    ERL_COMPILER_OPTIONS = "[${concatStringsSep "," erlc_opts}]";
+  };

  preBuild = ''
    patchShebangs ${escriptPath} || true
+  '';

-    substituteInPlace Makefile \
-      --replace "/usr/local" $out
+  # copy stdlib source files for LSP access
+  postInstall = ''
+    for d in lib/*; do
+      cp -R "$d/lib" "$out/lib/elixir/$d"
+    done
  '';

  postFixup = ''
@@ -144,4 +148,4 @@ stdenv.mkDerivation ({
    platforms = platforms.unix;
    teams = [ teams.beam ];
  };
-})
+}
@@ -5,7 +5,7 @@
 }:

 let
-  version = "3.4.4";
+  version = "3.4.5";
 in
 buildPecl {
  inherit version;
@@ -16,7 +16,7 @@ buildPecl {
    owner = "xdebug";
    repo = "xdebug";
    rev = version;
-    hash = "sha256-IYyDolRfzIpIfaJPWLOKdZhGlG4TMR5v7p56fw76JOc=";
+    hash = "sha256-tJNN1GNEH3z/bsmzNMPoF6TAgOQ4EiM4QheqmhCQzM4=";
  };

  doCheck = true;
@@ -0,0 +1,45 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  django,
+  weasyprint,
+  pytestCheckHook,
+}:
+
+buildPythonPackage rec {
+  pname = "django-weasyprint";
+  version = "2.4.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "fdemmer";
+    repo = "django-weasyprint";
+    tag = "v${version}";
+    hash = "sha256-eSh1p+5MyYb6GIEgSdlFxPzVCenlkwSCTkTzgKjezIg=";
+  };
+
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
+    django
+    weasyprint
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [ "django_weasyprint" ];
+
+  meta = {
+    description = "Django class-based view generating PDF resposes using WeasyPrint";
+    homepage = "https://github.com/fdemmer/django-weasyprint";
+    changelog = "https://github.com/fdemmer/django-weasyprint/releases/tag/${src.tag}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ hoh ];
+  };
+}
@@ -58,7 +58,10 @@ buildPythonPackage rec {
    "psycopg-pool"
  ];

-  doCheck = !(stdenvNoCC.hostPlatform.isDarwin);
+  # Temporarily disabled until the following is solved:
+  # https://github.com/NixOS/nixpkgs/pull/425384
+  doCheck = false;
+  # doCheck = !(stdenvNoCC.hostPlatform.isDarwin);

  nativeCheckInputs = [
    pytest-asyncio
@@ -62,7 +62,7 @@ buildPythonPackage rec {
  version = "2.3.1";
  pyproject = true;

-  disabled = pythonOlder "3.10";
+  disabled = pythonOlder "3.11";

  src = fetchPypi {
    inherit pname version;
@@ -42,6 +42,10 @@ buildPythonPackage rec {

  dependencies = [ numpy ];

+  # Temporarily disabled until the following is solved:
+  # https://github.com/NixOS/nixpkgs/pull/425384
+  doCheck = false;
+
  nativeCheckInputs = [
    asyncpg
    django
@@ -29,7 +29,7 @@

 buildPythonPackage rec {
  pname = "trimesh";
-  version = "4.6.13";
+  version = "4.7.0";
  pyproject = true;

  disabled = pythonOlder "3.8";
@@ -38,7 +38,7 @@ buildPythonPackage rec {
    owner = "mikedh";
    repo = "trimesh";
    tag = version;
-    hash = "sha256-IOtdeYLrHj96av6wKupvmO39Zo5oIiCzQeqy0MnEvj0=";
+    hash = "sha256-oZNRQox1DyAca+adsqVyxWXKC1+BeUfTEOI6mzg7h8A=";
  };

  build-system = [ setuptools ];
@@ -1,7 +1,6 @@
 {
  lib,
  mkRocqDerivation,
-  which,
  stdlib,
  rocq-core,
  version ? null,
@@ -1,52 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchurl,
-  perl,
-  autoconf,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "automake";
-  version = "1.15.1";
-
-  src = fetchurl {
-    url = "mirror://gnu/automake/automake-${version}.tar.xz";
-    sha256 = "1bzd9g32dfm4rsbw93ld9x7b5nc1y6i4m6zp032qf1i28a8s6sxg";
-  };
-
-  nativeBuildInputs = [
-    autoconf
-    perl
-  ];
-  buildInputs = [ autoconf ];
-
-  setupHook = ./setup-hook.sh;
-
-  patches = [ ./help2man-SOURCE_DATE_EPOCH-support.patch ];
-
-  doCheck = false; # takes _a lot_ of time, fails 3 out of 2698 tests, all seem to be related to paths
-  doInstallCheck = false; # runs the same thing, fails the same tests
-
-  # The test suite can run in parallel.
-  enableParallelBuilding = true;
-
-  # Don't fixup "#! /bin/sh" in Libtool, otherwise it will use the
-  # "fixed" path in generated files!
-  dontPatchShebangs = true;
-
-  meta = {
-    branch = "1.15";
-    homepage = "https://www.gnu.org/software/automake/";
-    description = "GNU standard-compliant makefile generator";
-    license = lib.licenses.gpl2Plus;
-
-    longDescription = ''
-      GNU Automake is a tool for automatically generating
-      `Makefile.in' files compliant with the GNU Coding
-      Standards.  Automake requires the use of Autoconf.
-    '';
-
-    platforms = lib.platforms.all;
-  };
-}
@@ -1,41 +0,0 @@
-From 2e3357d7f0d63f1caeb40d9644c2436a5cd0da5f Mon Sep 17 00:00:00 2001
-From: David Terry <me@xwvvvvwx.com>
-Date: Fri, 18 Oct 2019 10:23:11 +0200
-Subject: [PATCH] help2man: add support for SOURCE_DATE_EPOCH
-
---
- doc/help2man | 14 +++++++++++++-
- 1 file changed, 13 insertions(+), 1 deletion(-)
-
-diff --git a/doc/help2man b/doc/help2man
-index af4306f..4a64167 100755
--- a/doc/help2man
-+++ b/doc/help2man
-@@ -213,11 +213,23 @@ sub get_option_value;
- my $help_text   = get_option_value $ARGV[0], $help_option;
- $version_text ||= get_option_value $ARGV[0], $version_option;
- 
-+# By default the generated manual pages will include the current date.  This may
-+# however be overriden by setting the environment variable $SOURCE_DATE_EPOCH
-+# to an integer value of the seconds since the UNIX epoch.  This is primarily
-+# intended to support reproducible builds (wiki.debian.org/ReproducibleBuilds)
-+# and will additionally ensure that the output date string is UTC.
-+my $epoch_secs = time;
-+if (exists $ENV{SOURCE_DATE_EPOCH} and $ENV{SOURCE_DATE_EPOCH} =~ /^(\d+)$/)
-+{
-+    $epoch_secs = $1;
-+    $ENV{TZ} = 'UTC';
-+}
-+
- # Translators: the following message is a strftime(3) format string, which in
- # the English version expands to the month as a word and the full year.  It
- # is used on the footer of the generated manual pages.  If in doubt, you may
- # just use %x as the value (which should be the full locale-specific date).
-my $date = enc strftime _("%B %Y"), localtime;
-+my $date = enc strftime _("%B %Y"), localtime $epoch_secs;
- (my $program = $ARGV[0]) =~ s!.*/!!;
- my $package = $program;
- my $version;
-- 
-2.23.0
-
@@ -16,8 +16,8 @@ let
      hash = "sha256-z4anrXZEBjldQoam0J1zBxFyCsxtk+nc6ax6xNxKKKc=";
    };
    "10" = {
-      version = "10.12.4";
-      hash = "sha256-yt/Z5sn8wst2/nwHeaUlC2MomK6l9T2DOnNpDHeneNk=";
+      version = "10.13.1";
+      hash = "sha256-D57UjYCJlq4AeDX7XEZBz5owDe8u3cnpV9m75HaMXyg=";
    };
  };

@@ -1,7 +1,7 @@
 import ./generic.nix {
-  version = "18beta1";
-  rev = "refs/tags/REL_18_BETA1";
-  hash = "sha256-P86bVYfPzkwK/rcvUInYZew/pKejk58/IcnDGx/BWno=";
+  version = "18beta2";
+  rev = "refs/tags/REL_18_BETA2";
+  hash = "sha256-n3NA0XJE2wvbOwrQOMXbzKn+7HLGAQSXgDU9ObhddZQ=";
  muslPatches = {
    dont-use-locale-a = {
      url = "https://git.alpinelinux.org/aports/plain/main/postgresql17/dont-use-locale-a-on-musl.patch?id=d69ead2c87230118ae7f72cef7d761e761e1f37e";
@@ -6862,8 +6862,6 @@ with pkgs;

  automake111x = callPackage ../development/tools/misc/automake/automake-1.11.x.nix { };

-  automake115x = callPackage ../development/tools/misc/automake/automake-1.15.x.nix { };
-
  automake116x = callPackage ../development/tools/misc/automake/automake-1.16.x.nix { };

  automake117x = callPackage ../development/tools/misc/automake/automake-1.17.x.nix { };
@@ -15462,6 +15460,21 @@ with pkgs;
    ocamlPackages = ocaml-ng.ocamlPackages_4_12;
  };

+  inherit
+    (callPackage ./rocq-packages.nix {
+      inherit (ocaml-ng)
+        ocamlPackages_4_14
+        ;
+    })
+    mkRocqPackages
+    rocqPackages_9_0
+    rocq-core_9_0
+    rocqPackages_9_1
+    rocq-core_9_1
+    rocqPackages
+    rocq-core
+    ;
+
  inherit
    (callPackage ./coq-packages.nix {
      inherit (ocaml-ng)
@@ -15471,6 +15484,11 @@ with pkgs;
        ocamlPackages_4_12
        ocamlPackages_4_14
        ;
+      inherit
+        rocqPackages_9_0
+        rocqPackages_9_1
+        rocqPackages
+        ;
    })
    mkCoqPackages
    coqPackages_8_5
@@ -15513,21 +15531,6 @@ with pkgs;
    coq
    ;

-  inherit
-    (callPackage ./rocq-packages.nix {
-      inherit (ocaml-ng)
-        ocamlPackages_4_14
-        ;
-    })
-    mkRocqPackages
-    rocqPackages_9_0
-    rocq-core_9_0
-    rocqPackages_9_1
-    rocq-core_9_1
-    rocqPackages
-    rocq-core
-    ;
-
  coq-kernel = callPackage ../applications/editors/jupyter-kernels/coq { };

  cubicle = callPackage ../applications/science/logic/cubicle {
@@ -11,6 +11,9 @@
  ocamlPackages_4_10,
  ocamlPackages_4_12,
  ocamlPackages_4_14,
+  rocqPackages_9_0,
+  rocqPackages_9_1,
+  rocqPackages,
  fetchpatch,
  makeWrapper,
  coq2html,
@@ -265,7 +268,7 @@ let
      ) (lib.attrNames set)
    );
  mkCoq =
-    version:
+    version: rp:
    callPackage ../applications/science/logic/coq {
      inherit
        version
@@ -275,6 +278,7 @@ let
        ocamlPackages_4_12
        ocamlPackages_4_14
        ;
+      rocqPackages = rp;
    };
 in
 rec {
@@ -295,24 +299,24 @@ rec {
    in
    self.filterPackages (!coq.dontFilter or false);

-  coq_8_5 = mkCoq "8.5";
-  coq_8_6 = mkCoq "8.6";
-  coq_8_7 = mkCoq "8.7";
-  coq_8_8 = mkCoq "8.8";
-  coq_8_9 = mkCoq "8.9";
-  coq_8_10 = mkCoq "8.10";
-  coq_8_11 = mkCoq "8.11";
-  coq_8_12 = mkCoq "8.12";
-  coq_8_13 = mkCoq "8.13";
-  coq_8_14 = mkCoq "8.14";
-  coq_8_15 = mkCoq "8.15";
-  coq_8_16 = mkCoq "8.16";
-  coq_8_17 = mkCoq "8.17";
-  coq_8_18 = mkCoq "8.18";
-  coq_8_19 = mkCoq "8.19";
-  coq_8_20 = mkCoq "8.20";
-  coq_9_0 = mkCoq "9.0";
-  coq_9_1 = mkCoq "9.1";
+  coq_8_5 = mkCoq "8.5" { };
+  coq_8_6 = mkCoq "8.6" { };
+  coq_8_7 = mkCoq "8.7" { };
+  coq_8_8 = mkCoq "8.8" { };
+  coq_8_9 = mkCoq "8.9" { };
+  coq_8_10 = mkCoq "8.10" { };
+  coq_8_11 = mkCoq "8.11" { };
+  coq_8_12 = mkCoq "8.12" { };
+  coq_8_13 = mkCoq "8.13" { };
+  coq_8_14 = mkCoq "8.14" { };
+  coq_8_15 = mkCoq "8.15" { };
+  coq_8_16 = mkCoq "8.16" { };
+  coq_8_17 = mkCoq "8.17" { };
+  coq_8_18 = mkCoq "8.18" { };
+  coq_8_19 = mkCoq "8.19" { };
+  coq_8_20 = mkCoq "8.20" { };
+  coq_9_0 = mkCoq "9.0" rocqPackages_9_0;
+  coq_9_1 = mkCoq "9.1" rocqPackages_9_1;

  coqPackages_8_5 = mkCoqPackages coq_8_5;
  coqPackages_8_6 = mkCoqPackages coq_8_6;
@@ -4059,6 +4059,8 @@ self: super: with self; {

  django-vite = callPackage ../development/python-modules/django-vite { };

+  django-weasyprint = callPackage ../development/python-modules/django-weasyprint { };
+
  django-webpack-loader = callPackage ../development/python-modules/django-webpack-loader { };

  django-webpush = callPackage ../development/python-modules/django-webpush { };