Merge master into staging-next

2025-11-21 00:17:16 +00:00
parent f7ff54e830 baa40a5be0
commit 323ae10c55
112 changed files with 1718 additions and 1284 deletions
@@ -64,6 +64,8 @@

 - `postgresql` and `libpq` don't provide `pg_config` by default anymore. Instead, `pg_config` is available via `postgresql.pg_config` or `libpq.pg_config`. This allowed implementing it as a shell script, which can be built for both the build and host systems when cross-compiling. If your build fails to find `pg_config`, add `postgresql.pg_config` or `libpq.pg_config` to `nativeBuildInputs`.

+- `postgresql_13` has been removed since it reached its end of life.
+
 - The [`no-broken-symlinks` hook](https://nixos.org/manual/nixpkgs/unstable/#no-broken-symlinks.sh) was added to catch builds containing dangling or reflexive symlinks, as these are indicative of problems with packaging.
  The hook can be disabled by providing `dontCheckForBrokenSymlinks = true;` as an argument to `mkDerivation`.
  For more information, [check the docs](https://nixos.org/manual/nixpkgs/unstable/#no-broken-symlinks.sh) or [see this PR](https://github.com/NixOS/nixpkgs/pull/370750).
@@ -167,7 +167,7 @@ Best practice is to name the map after the database role it manages to avoid nam
 ## Upgrading {#module-services-postgres-upgrading}

 ::: {.note}
-The steps below demonstrate how to upgrade from an older version to `pkgs.postgresql_13`.
+The steps below demonstrate how to upgrade from an older version to `pkgs.postgresql_15`.
 These instructions are also applicable to other versions.
 :::

@@ -176,8 +176,8 @@ each major version has some internal changes in the databases' state. Because of
 NixOS places the state into {file}`/var/lib/postgresql/&lt;version&gt;` where each `version`
 can be obtained like this:
 ```
-$ nix-instantiate --eval -A postgresql_13.psqlSchema
-"13"
+$ nix-instantiate --eval -A postgresql_15.psqlSchema
+"15"
 ```
 For an upgrade, a script like this can be used to simplify the process:
 ```nix
@@ -193,7 +193,7 @@ For an upgrade, a script like this can be used to simplify the process:
      let
        # XXX specify the postgresql package you'd like to upgrade to.
        # Do not forget to list the extensions you need.
-        newPostgres = pkgs.postgresql_13.withPackages (pp: [
+        newPostgres = pkgs.postgresql_15.withPackages (pp: [
          # pp.plv8
        ]);
        cfg = config.services.postgresql;
@@ -229,22 +229,7 @@ The upgrade process is:
  2. Login as root (`sudo su -`).
  3. Run `upgrade-pg-cluster`. This will stop the old postgresql cluster, initialize a new one and migrate the old one to the new one. You may supply arguments like `--jobs 4` and `--link` to speedup the migration process. See <https://www.postgresql.org/docs/current/pgupgrade.html> for details.
  4. Change the postgresql package in NixOS configuration to the one you were upgrading to via [](#opt-services.postgresql.package). Rebuild NixOS. This should start the new postgres version using the upgraded data directory and all services you stopped during the upgrade.
-  5. After the upgrade it's advisable to analyze the new cluster:
-
-       - For PostgreSQL ≥ 14, use the `vacuumdb` command printed by the upgrades script.
-       - For PostgreSQL < 14, run (as `su -l postgres` in the [](#opt-services.postgresql.dataDir), in this example {file}`/var/lib/postgresql/13`):
-
-         ```
-         $ ./analyze_new_cluster.sh
-         ```
-
-     ::: {.warning}
-     The next step removes the old state-directory!
-     :::
-
-     ```
-     $ ./delete_old_cluster.sh
-     ```
+  5. After the upgrade it's advisable to analyze the new cluster with the `vacuumdb` command printed by the upgrades script.

 ## Versioning and End-of-Life {#module-services-postgres-versioning}

@@ -120,10 +120,8 @@ in
            pkgs.postgresql_16
          else if versionAtLeast config.system.stateVersion "23.11" then
            pkgs.postgresql_15
-          else if versionAtLeast config.system.stateVersion "22.05" then
-            pkgs.postgresql_14
          else
-            pkgs.postgresql_13
+            pkgs.postgresql_14
        '';
        description = ''
          The package being used by postgresql.
@@ -697,7 +695,7 @@ in
          else if versionAtLeast config.system.stateVersion "22.05" then
            pkgs.postgresql_14
          else if versionAtLeast config.system.stateVersion "21.11" then
-            mkWarn "13" pkgs.postgresql_13
+            mkThrow "13"
          else if versionAtLeast config.system.stateVersion "20.03" then
            mkThrow "11"
          else if versionAtLeast config.system.stateVersion "17.09" then
@@ -25,10 +25,23 @@ in
  };

  config = lib.mkIf cfg.enable {
+    security.wrappers.espanso = lib.mkIf (cfg.package.waylandSupport or false) {
+      capabilities = "cap_dac_override+p";
+      owner = "root";
+      group = "root";
+      source = lib.getExe (
+        pkgs.espanso-wayland.override { securityWrapperPath = config.security.wrapperDir; }
+      );
+    };
    systemd.user.services.espanso = {
      description = "Espanso daemon";
      serviceConfig = {
-        ExecStart = "${lib.getExe cfg.package} daemon";
+        ExecStart = "${
+          if (cfg.package.waylandSupport or false) then
+            "${config.security.wrapperDir}/espanso"
+          else
+            lib.getExe cfg.package
+        } daemon";
        Restart = "on-failure";
      };
      wantedBy = [ "default.target" ];
@@ -523,6 +523,10 @@ in
  ergo = runTest ./ergo.nix;
  ergochat = runTest ./ergochat.nix;
  ersatztv = handleTest ./ersatztv.nix { };
+  espanso = import ./espanso.nix {
+    inherit (pkgs) lib;
+    inherit runTest;
+  };
  esphome = runTest ./esphome.nix;
  etc = pkgs.callPackage ../modules/system/etc/test.nix { inherit evalMinimalConfig; };
  etcd = import ./etcd/default.nix { inherit pkgs runTest; };
@@ -0,0 +1,86 @@
+{ lib, runTest }:
+let
+  makeTest =
+    conf:
+    runTest {
+      name = "espanso";
+      meta.maintainers = with lib.maintainers; [ n8henrie ];
+
+      nodes.machine =
+        let
+          base =
+            { pkgs, config, ... }:
+            {
+              imports = [ ./common/user-account.nix ];
+              services.espanso.enable = true;
+              system.activationScripts.espanso-config = {
+                deps = [ "users" ];
+                text =
+                  let
+                    confdir = "${config.users.users.alice.home}/.config/espanso";
+                    espanso_conf =
+                      let
+                        settingsFormat = pkgs.formats.yaml { };
+                      in
+                      settingsFormat.generate "base.yaml" {
+                        matches = [
+                          {
+                            trigger = ":nixostest";
+                            replace = "My NixOS Test Passed!";
+                          }
+                        ];
+                      };
+                  in
+                  ''
+                    mkdir -p ${confdir}/{config,match}
+                    touch ${confdir}/config/default.yml
+                    cp ${espanso_conf} ${confdir}/match/base.yml
+                    chown -R ${config.users.users.alice.name} ${confdir}
+                  '';
+              };
+            };
+        in
+        lib.mkMerge [
+          base
+          conf
+        ];
+
+      enableOCR = true;
+      testScript = ''
+        machine.wait_for_unit("graphical.target")
+        machine.wait_for_text("Espanso is running!")
+        machine.send_chars(":nixostest")
+        machine.wait_for_text("My NixOS Test Passed!")
+      '';
+    };
+in
+{
+  x11 = makeTest {
+    imports = [ ./common/x11.nix ];
+    test-support.displayManager.auto.user = "alice";
+    users.users.alice.extraGroups = [ "input" ];
+  };
+  wayland = makeTest (
+    { pkgs, config, ... }:
+    {
+      programs.sway.enable = true;
+      services = {
+        greetd =
+          let
+            initial_session = {
+              user = config.users.users.alice.name;
+              command = lib.getExe pkgs.sway;
+            };
+          in
+          {
+            enable = true;
+            settings = {
+              inherit initial_session;
+              default_session = initial_session;
+            };
+          };
+        espanso.package = pkgs.espanso-wayland;
+      };
+    }
+  );
+}
@@ -226,7 +226,7 @@ import ./make-test-python.nix (
            };
            postgresql = {
              enable = true;
-              package = pkgs.postgresql_13;
+              package = pkgs.postgresql_14;
            };
            nginx = {
              enable = true;
@@ -3,6 +3,7 @@
  name = "rasdaemon";
  meta = {
    maintainers = [ ];
+    broken = true; # test timed out
  };

  nodes.machine =
@@ -1156,8 +1156,8 @@ let
        mktplcRef = {
          publisher = "DanielSanMedium";
          name = "dscodegpt";
-          version = "3.14.172";
-          hash = "sha256-bJnGao3RrbjeMSkRkakM6UA9piYGEzwMInoBOev2YeM=";
+          version = "3.14.190";
+          hash = "sha256-OPnDQuXge9mGiTMpOBwOBnAXI4rDru//Pks1zygkYWk=";
        };
        meta = {
          changelog = "https://marketplace.visualstudio.com/items/DanielSanMedium.dscodegpt/changelog";
@@ -1727,8 +1727,8 @@ let
        mktplcRef = {
          name = "foam-vscode";
          publisher = "foam";
-          version = "0.29.0";
-          hash = "sha256-eAfWsIVAqRRfBNDZZq4SilqR48daY5IezjGULaU8AzU=";
+          version = "0.29.1";
+          hash = "sha256-U5DkTMNLoE9TDCa+Womml9ilv162FqVsnkyGsJ80+Ag=";
        };
        meta = {
          changelog = "https://marketplace.visualstudio.com/items/foam.foam-vscode/changelog";
@@ -1965,8 +1965,8 @@ let
        mktplcRef = {
          name = "gitlab-workflow";
          publisher = "gitlab";
-          version = "6.57.1";
-          hash = "sha256-w/qYR1nJ3+Z/4APFGUJwRCHc7gxjFbGTuh3Wl2kH6+g=";
+          version = "6.57.4";
+          hash = "sha256-dkDRRzxcDbzKw7L7wyHkoK4awSNxVapsO5tZoc/+zFk=";
        };
        meta = {
          description = "GitLab extension for Visual Studio Code";
@@ -2619,8 +2619,8 @@ let
        mktplcRef = {
          name = "language-julia";
          publisher = "julialang";
-          version = "1.149.2";
-          hash = "sha256-4IScbHi9iKd4zn0J5HG6FAdIXESwMrh0u07gw9TZJJ4=";
+          version = "1.158.2";
+          hash = "sha256-H3T/SiBqkjhItFDfGlVM+UINimrWlLryampggFPhvzM=";
        };
        meta = {
          changelog = "https://marketplace.visualstudio.com/items/julialang.language-julia/changelog";
@@ -4536,8 +4536,8 @@ let
        mktplcRef = {
          name = "tabnine-vscode";
          publisher = "tabnine";
-          version = "3.324.0";
-          hash = "sha256-W1+TCXUmuTCb+IZZk3n6dyIDfVbMuU3jJUOsfrdjoXo=";
+          version = "3.326.0";
+          hash = "sha256-aPJiUfwfR9JFX3S8fFrSCV4MezGYVY4nqCF0t3Wevfc=";
        };
        meta = {
          license = lib.licenses.mit;
@@ -516,11 +516,11 @@
    "vendorHash": null
  },
  "hashicorp_azurerm": {
-    "hash": "sha256-U7KmukBPLrHyWgkM3yaRIoKtnXONDRxZGIaTFIKfvOk=",
+    "hash": "sha256-t74oNkRchvTn3eletKAFlriOn/BOFUwNLK6NxILawpg=",
    "homepage": "https://registry.terraform.io/providers/hashicorp/azurerm",
    "owner": "hashicorp",
    "repo": "terraform-provider-azurerm",
-    "rev": "v4.52.0",
+    "rev": "v4.54.0",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
@@ -705,11 +705,11 @@
    "vendorHash": "sha256-xkhOzwFpON6dzi/qdpBazfrpMfWSUwUWs8VXLSAsqaM="
  },
  "huaweicloud_huaweicloud": {
-    "hash": "sha256-h7mFrBubLS3UaSxSEkZpJAceMm3AYNq0UVdnSa45Qho=",
+    "hash": "sha256-QyJkzNI+9kGz7c7laDA33zhRTJbeSwGt9PaLjun3TmU=",
    "homepage": "https://registry.terraform.io/providers/huaweicloud/huaweicloud",
    "owner": "huaweicloud",
    "repo": "terraform-provider-huaweicloud",
-    "rev": "v1.80.2",
+    "rev": "v1.80.3",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
@@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "aws-lambda-runtime-interface-emulator";
-  version = "1.28";
+  version = "1.29";

  src = fetchFromGitHub {
    owner = "aws";
    repo = "aws-lambda-runtime-interface-emulator";
    rev = "v${version}";
-    sha256 = "sha256-BEyztLEn2S3gkmb7WV+tZ6Cmjt3/h8mVToSQQ6qjmRo=";
+    sha256 = "sha256-iTNo6W533iQmguVd7O955q1LuyixdvVQ79KZyBjb/QE=";
  };

-  vendorHash = "sha256-+tgB9Z39Oq43PZoF85DG1Z/CGeoXXTKAML7Z6DZ1XvM=";
+  vendorHash = "sha256-jGz5reViV145GP9Sf8bGabYxVGi194vbvpTpEgUv3t8=";

  # disabled because I lack the skill
  doCheck = false;
@@ -10,16 +10,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "c2patool";
-  version = "0.26.1";
+  version = "0.26.5";

  src = fetchFromGitHub {
    owner = "contentauth";
    repo = "c2pa-rs";
    tag = "c2patool-v${finalAttrs.version}";
-    hash = "sha256-AmwtvFBN5r4DRuLgxn0q66TD9lzwUdEUVtkG1L0ceHw=";
+    hash = "sha256-l21tGPvbHgJOBzK+RQTa8RpeKJ8A/K6Z6CsPAjLTCUw=";
  };

-  cargoHash = "sha256-6gpTFgzfE3Tuhl5YiumxcmWJFBgo5cTQaXMWl9twQtc=";
+  cargoHash = "sha256-T3cpfujue5tMAiCCqOprG+rfqACiw4OLMsbOr2G23Jc=";

  # use the non-vendored openssl
  env.OPENSSL_NO_VENDOR = 1;
@@ -6,16 +6,16 @@

 buildNpmPackage (finalAttrs: {
  pname = "claude-code-acp";
-  version = "0.4.5";
+  version = "0.10.6";

  src = fetchFromGitHub {
    owner = "zed-industries";
    repo = "claude-code-acp";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-kkAQuYP2S5EwIGJV8TLrlYzHOC54vmxEHwwuZD5P1hI=";
+    hash = "sha256-sq4m4w8ZmgU7Quel5gUwmvq0rumo+G1SkCt7fQsg+8M=";
  };

-  npmDepsHash = "sha256-IR88NP1AiR6t/MLDdaZY1Np0AE7wfqEUfmnohaf0ymc=";
+  npmDepsHash = "sha256-ElxSaU74txRC/eH7S+Uv33Ji7y2HE6rZU2DmEPICTko=";

  meta = {
    description = "ACP-compatible coding agent powered by the Claude Code SDK";
@@ -6,18 +6,18 @@

 buildGoModule rec {
  pname = "cnspec";
-  version = "12.9.0";
+  version = "12.10.0";

  src = fetchFromGitHub {
    owner = "mondoohq";
    repo = "cnspec";
    tag = "v${version}";
-    hash = "sha256-90bM85hKI1XOxdHsVstzJANnWJEhTmmDzzUqL3qx9n4=";
+    hash = "sha256-6u5h3mF8LCEEqI/DKwEdFGjb7fufLbzPXGT1oJj5jvE=";
  };

  proxyVendor = true;

-  vendorHash = "sha256-Jf5R5Bz6VgPON49qrrV0Pyd42NfTImSFX0TATT+udOM=";
+  vendorHash = "sha256-lH91LoHHxYDfR9RuNUseQaSScFWmDrvfQNYVxlv4yyk=";

  subPackages = [ "apps/cnspec" ];

@@ -8,16 +8,16 @@
 }:

 let
-  openShiftVersion = "4.19.13";
-  okdVersion = "4.19.0-okd-scos.15";
-  microshiftVersion = "4.19.7";
+  openShiftVersion = "4.20.1";
+  okdVersion = "4.20.0-okd-scos.7";
+  microshiftVersion = "4.20.0";
  writeKey = "$(MODULEPATH)/pkg/crc/segment.WriteKey=cvpHsNcmGCJqVzf6YxrSnVlwFSAZaYtp";
-  gitCommit = "6252bcd46a133d830ea8e3d76ab0b5a3abfe104d";
-  gitHash = "sha256-bVQKKIO+aFNwcZ84Ui1SuexsilAa/Ee/zuoHqOsK6+Y=";
+  gitCommit = "cb4c9175d15c1fae26734da75806f8d436b6799a";
+  gitHash = "sha256-QdsknUcc9ugpwiyJerxUuf70vtLMXhc3Pz+f2+sPceI=";
 in
 buildGoModule (finalAttrs: {
  pname = "crc";
-  version = "2.55.1";
+  version = "2.56.0";

  src = fetchFromGitHub {
    owner = "crc-org";
@@ -0,0 +1,33 @@
+diff --git a/dep/CMakeLists.txt b/dep/CMakeLists.txt
+index 633267c66..b5ab0904c 100644
+--- a/dep/CMakeLists.txt
+++ b/dep/CMakeLists.txt
+@@ -25,9 +25,8 @@ add_subdirectory(rcheevos EXCLUDE_FROM_ALL)
+ disable_compiler_warnings_for_target(rcheevos)
+ add_subdirectory(rapidyaml EXCLUDE_FROM_ALL)
+ disable_compiler_warnings_for_target(rapidyaml)
+-add_subdirectory(cubeb EXCLUDE_FROM_ALL)
+-disable_compiler_warnings_for_target(cubeb)
+-disable_compiler_warnings_for_target(speex)
+find_package(cubeb REQUIRED GLOBAL)
+add_library(cubeb ALIAS cubeb::cubeb)
+ 
+ if(ENABLE_OPENGL)
+   add_subdirectory(glad EXCLUDE_FROM_ALL)
+diff --git a/src/util/cubeb_audio_stream.cpp b/src/util/cubeb_audio_stream.cpp
+index 52c7299c9..e20b52426 100644
+--- a/src/util/cubeb_audio_stream.cpp
+++ b/src/util/cubeb_audio_stream.cpp
+@@ -262,9 +262,9 @@ std::vector<std::pair<std::string, std::string>> AudioStream::GetCubebDriverName
+   std::vector<std::pair<std::string, std::string>> names;
+   names.emplace_back(std::string(), TRANSLATE_STR("AudioStream", "Default"));
+ 
+-  const char** cubeb_names = cubeb_get_backend_names();
+-  for (u32 i = 0; cubeb_names[i] != nullptr; i++)
+-    names.emplace_back(cubeb_names[i], cubeb_names[i]);
+  cubeb_backend_names backends = cubeb_get_backend_names();
+  for (u32 i = 0; i < backends.count; i++)
+    names.emplace_back(backends.names[i], backends.names[i]);
+   return names;
+ }
+ 
@@ -0,0 +1,20 @@
+diff --git a/src/scmversion/gen_scmversion.sh b/src/scmversion/gen_scmversion.sh
+index 0f8fa4239..2cc91a4a8 100755
+--- a/src/scmversion/gen_scmversion.sh
+++ b/src/scmversion/gen_scmversion.sh
+@@ -10,11 +10,11 @@ else
+ fi
+ 
+ 
+-HASH=$(git rev-parse HEAD)
+-BRANCH=$(git rev-parse --abbrev-ref HEAD | tr -d '\r\n')
+-TAG=$(git describe --dirty | tr -d '\r\n')
+HASH="@gitHash@"
+BRANCH="@gitBranch@"
+TAG="@gitTag@"
+ VERSION=$(echo "${TAG}" | sed -E 's/-g[0-9a-f]+//')
+-DATE=$(git log -1 --date=iso8601-strict --format=%cd)
+DATE="@gitDate@"
+ 
+ cd $CURDIR
+ 
@@ -29,10 +29,7 @@
  udev,
  libbacktrace,
  ffmpeg_8-headless,
-  alsa-lib,
-  libjack2,
-  libpulseaudio,
-  pipewire,
+  cubeb,
  fetchurl,
  zip,
  unzip,
@@ -64,21 +61,47 @@ let

  linuxDrv = llvmPackages.stdenv.mkDerivation (finalAttrs: {
    pname = "duckstation";
-    version = pkgSources.duckstation.version;
+    version = "0.1-10091";

    src = fetchFromGitHub {
      owner = "stenzek";
      repo = "duckstation";
      tag = "v${finalAttrs.version}";
-      hash = pkgSources.duckstation.hash_linux;
+      deepClone = true;
+      hash = "sha256-z6hpjMkz7zlt/NUzGl+Px058O99bfDCXV1l5lBqC6vw=";
+
+      postFetch = ''
+        cd $out
+        mkdir -p .nixpkgs-auxfiles/
+        git rev-parse HEAD > .nixpkgs-auxfiles/git_hash
+        git rev-parse --abbrev-ref HEAD | tr -d '\r\n' > .nixpkgs-auxfiles/git_branch
+        git describe | tr -d '\r\n' > .nixpkgs-auxfiles/git_tag
+        git log -1 --date=iso8601-strict --format=%cd > .nixpkgs-auxfiles/git_date
+        rm -rf .git
+      '';
    };

-    # TODO: Remove once this is fixed upstream.
-    postPatch = ''
-      substituteInPlace src/util/animated_image.cpp \
-        --replace-fail "png_write_frame_head(png_ptr, info_ptr," \
-                       "png_write_frame_head(png_ptr, info_ptr, 0,"
-    '';
+    patches = [
+      ./cubeb-remove-vendor.patch
+      ./git-version-info.patch
+    ];
+
+    postPatch =
+      # Fixes compilation error with nixpkgs libapng
+      ''
+        substituteInPlace src/util/animated_image.cpp \
+          --replace-fail "png_write_frame_head(png_ptr, info_ptr," \
+                         "png_write_frame_head(png_ptr, info_ptr, 0,"
+      ''
+      # Fills in git-info obtained in the `postFetch` step for version
+      # information in the UI
+      + ''
+        gitHash=$(cat .nixpkgs-auxfiles/git_hash) \
+        gitBranch=$(cat .nixpkgs-auxfiles/git_branch) \
+        gitTag=$(cat .nixpkgs-auxfiles/git_tag) \
+        gitDate=$(cat .nixpkgs-auxfiles/git_date) \
+        substituteAllInPlace src/scmversion/gen_scmversion.sh
+      '';

    vendorDiscordRPC = llvmPackages.stdenv.mkDerivation {
      pname = "discord-rpc-duckstation";
@@ -233,10 +256,7 @@ let
      udev
      libbacktrace
      ffmpeg_8-headless
-      alsa-lib
-      libjack2
-      pipewire
-      libpulseaudio
+      cubeb
    ]
    ++ [
      finalAttrs.vendorDiscordRPC
@@ -1,7 +1,6 @@
 {
  "duckstation": {
    "version": "0.1-10091",
-    "hash_linux": "sha256-mgrln6Z0kshFy/8QberfeXHWoSxxojvn53B/WYkobpQ=",
    "hash_darwin": "sha256-6bp3ksI3a3FYuGhP6y77AxTR1XOXyjmBuQNnWwU9Zoo="
  },
  "discord_rpc": {
@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p coreutils nix curl jq
+#!nix-shell -i bash -p coreutils nix nix-update curl jq
 # shellcheck shell=bash

 set -euo pipefail
@@ -15,7 +15,7 @@ if [[ $old_version == "$new_version" ]]; then
 fi

 echo "Updating duckstation from $old_version -> $new_version"
-duckstation_linux_hash=$(nix --extra-experimental-features "nix-command flakes" flake prefetch github:stenzek/duckstation/"$new_version" --json | jq -r '.hash')
+nix-update --src-only --version "$new_version" duckstation
 duckstation_darwin_hash=$(nix-hash --to-sri --type sha256 "$(nix-prefetch-url --type sha256 "https://github.com/stenzek/duckstation/releases/download/${new_version}/duckstation-mac-release.zip")")

 echo "Vendor library update..."
@@ -44,7 +44,6 @@ echo "Regenerating '""$location""/sources.json'"
 JSON=$(
  jq --null-input \
    --arg new_version "${new_version:1}" \
-    --arg duckstation_linux_hash "$duckstation_linux_hash" \
    --arg duckstation_darwin_hash "$duckstation_darwin_hash" \
    --arg discord_rpc_rev "$discord_rpc_rev" \
    --arg discord_rpc_hash "$discord_rpc_hash" \
@@ -55,7 +54,6 @@ JSON=$(
    --arg chtdb_hash "$chtdb_hash" \
    '{ "duckstation": {
             "version": $new_version,
-             "hash_linux": $duckstation_linux_hash,
             "hash_darwin": $duckstation_darwin_hash
           },
           "discord_rpc": {
@@ -20,11 +20,14 @@
  wl-clipboard,
  wxGTK32,
  makeWrapper,
+  securityWrapperPath ? null,
  nix-update-script,
  stdenv,
  waylandSupport ? false,
  x11Support ? stdenv.hostPlatform.isLinux,
  testers,
+  nixosTests,
+  fetchpatch,
 }:
 # espanso does not support building with both X11 and Wayland support at the same time
 assert stdenv.hostPlatform.isLinux -> x11Support != waylandSupport;
@@ -87,13 +90,29 @@ rustPlatform.buildRustPackage (finalAttrs: {
    xdotool
  ];

-  postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
-    substituteInPlace scripts/create_bundle.sh \
-      --replace-fail target/mac/ $out/Applications/ \
-      --replace-fail /bin/echo ${coreutils}/bin/echo
-    substituteInPlace espanso/src/path/macos.rs  espanso/src/path/linux.rs \
-      --replace-fail '"/usr/local/bin/espanso"' '"${placeholder "out"}/bin/espanso"'
-  '';
+  patches = [
+    # remove when version > 2.3.0
+    (fetchpatch {
+      name = "fix-welcome-screen-expansion.patch";
+      url = "https://github.com/espanso/espanso/commit/5d5fc84df695d628d1d9c3e7e3854c2991a64d64.patch";
+      hash = "sha256-dhoqq0V8b8mGvZvPInHiHKGmGDDFO/SH5HqMY7EA134=";
+    })
+  ];
+
+  postPatch =
+    lib.optionalString stdenv.hostPlatform.isDarwin ''
+      substituteInPlace scripts/create_bundle.sh \
+        --replace-fail target/mac/ $out/Applications/ \
+        --replace-fail /bin/echo ${coreutils}/bin/echo
+      substituteInPlace espanso/src/path/macos.rs  espanso/src/path/linux.rs \
+        --replace-fail '"/usr/local/bin/espanso"' '"${placeholder "out"}/bin/espanso"'
+    ''
+    + lib.optionalString (securityWrapperPath != null) ''
+      substituteInPlace espanso/src/cli/daemon/mod.rs \
+        --replace-fail \
+          'std::env::current_exe().expect("unable to obtain espanso executable location");' \
+          'std::ffi::OsString::from("${securityWrapperPath}/espanso");'
+    '';

  # Some tests require networking
  doCheck = false;
@@ -123,9 +142,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
      '';

  passthru = {
-    tests.version = testers.testVersion {
-      package = finalAttrs.finalPackage;
-      inherit (finalAttrs) version;
+    inherit waylandSupport;
+    tests = nixosTests.espanso // {
+      version = testers.testVersion {
+        package = finalAttrs.finalPackage;
+        inherit (finalAttrs) version;
+      };
    };
    updateScript = nix-update-script { };
  };
@@ -15,13 +15,13 @@

 buildGoModule rec {
  pname = "fulcio";
-  version = "1.8.1";
+  version = "1.8.2";

  src = fetchFromGitHub {
    owner = "sigstore";
    repo = "fulcio";
    tag = "v${version}";
-    hash = "sha256-KUwCeG26gv0LgIxTsvOGc0iQKdYI7IK+RWu8hJYo1cY=";
+    hash = "sha256-yAaMXlcGU1JXGMr2nkUHAWkd2JAlprPbKxs1MKvU6iM=";
    # populate values that require us to use git. By doing this in postFetch we
    # can delete .git afterwards and maintain better reproducibility of the src.
    leaveDotGit = true;
@@ -33,7 +33,7 @@ buildGoModule rec {
      find "$out" -name .git -print0 | xargs -0 rm -rf
    '';
  };
-  vendorHash = "sha256-4nonoxWjefbSFYErt/KT9vztPgIvkjukh34NQhFHeW4=";
+  vendorHash = "sha256-xOM92evfKrjFhPPny1kIVK5uxZkLJZ+qyJ15/4HpsN0=";

  nativeBuildInputs = [ installShellFiles ];

@@ -8,14 +8,14 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "game-devices-udev-rules";
-  version = "0.24";
+  version = "0.25";

  src = fetchFromGitea {
    domain = "codeberg.org";
    owner = "fabiscafe";
    repo = "game-devices-udev";
    tag = finalAttrs.version;
-    hash = "sha256-b2NBgGpRQ2pQZYQgiRSAt0loAxq1NEByRHVkQQRDOj0=";
+    hash = "sha256-CLQFdPr489OKZRj1v8EZypM1KOXgAOAOF0VQpeud4uo=";
  };

  nativeBuildInputs = [
@@ -27,7 +27,7 @@ stdenv.mkDerivation (finalAttrs: {
  postInstall = ''
    install -Dm444 -t "$out/lib/udev/rules.d" *.rules
    substituteInPlace $out/lib/udev/rules.d/71-powera-controllers.rules \
-    --replace-fail "/bin/sh" "${bash}/bin/bash"
+      --replace-fail "/bin/sh" "${bash}/bin/bash"
  '';

  meta = {
@@ -0,0 +1,45 @@
+{
+  lib,
+  python3Packages,
+  fetchFromGitHub,
+  versionCheckHook,
+}:
+python3Packages.buildPythonApplication rec {
+  pname = "gamma-launcher";
+  version = "2.5";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "Mord3rca";
+    repo = "gamma-launcher";
+    tag = "v${version}";
+    hash = "sha256-qzjfgDFimEL6vtsJBubY6fHsokilDB248WwHJt3F7fI=";
+  };
+
+  build-system = [ python3Packages.setuptools ];
+
+  dependencies = with python3Packages; [
+    beautifulsoup4
+    cloudscraper
+    gitpython
+    platformdirs
+    py7zr
+    python-unrar
+    requests
+    tenacity
+    tqdm
+  ];
+
+  nativeCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+
+  meta = {
+    description = "Python cli to download S.T.A.L.K.E.R. GAMMA";
+    changelog = "https://github.com/Mord3rca/gamma-launcher/releases/tag/v${version}";
+    homepage = "https://github.com/Mord3rca/gamma-launcher";
+    mainProgram = "gamma-launcher";
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ DrymarchonShaun ];
+    platforms = lib.platforms.linux;
+  };
+}
@@ -6,7 +6,7 @@

 let
  pname = "gate";
-  version = "0.58.0";
+  version = "0.58.1";
 in
 buildGoModule {
  inherit pname version;
@@ -15,7 +15,7 @@ buildGoModule {
    owner = "minekube";
    repo = "gate";
    tag = "v${version}";
-    hash = "sha256-1E6Ge3c+LQpDlyy5Jtyw21VFuKqyF4XVpxF41qOjk+w=";
+    hash = "sha256-EOiLoZgIKRobULHOKoUVLws+KRK1XhJvCWjQmKjvjcM=";
  };

  vendorHash = "sha256-2ZRfvjIGUznHjn7KA20uzEpVbI7EByNUYu6xALJEUfo=";
@@ -7,7 +7,7 @@
 }:

 let
-  version = "18.5.2";
+  version = "18.6.0";
  package_version = "v${lib.versions.major version}";
  gitaly_package = "gitlab.com/gitlab-org/gitaly/${package_version}";

@@ -21,10 +21,10 @@ let
      owner = "gitlab-org";
      repo = "gitaly";
      rev = "v${version}";
-      hash = "sha256-UOcO6iEFLSkQNU+UGWO6fQ67XmXisz6WRGXC8xNFmuM=";
+      hash = "sha256-uPbTjmixStlPaUuy9TAaMoYCPVrnpxf67ath+xDFLnw=";
    };

-    vendorHash = "sha256-I2YMn84wEAY+Z02bmkyP/b0eix7FW3hP/noyEKYsEaQ=";
+    vendorHash = "sha256-+5CTncYwtGlScFvVc3QaEScfuqMqvsjnGhggM1HMhNU=";

    ldflags = [
      "-X ${gitaly_package}/internal/version.version=${version}"
@@ -9,16 +9,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "gitlab-code-parser";
-  version = "0.19.3";
+  version = "0.20.2";

  src = fetchFromGitLab {
    owner = "gitlab-org";
    repo = "rust/gitlab-code-parser";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-gwldgZsiHjNafebtgiy5mVAmNNAj0Mz+krz4sI18zj4=";
+    hash = "sha256-JjWWlbSjbV9StDNI+aNExLcSNvLsuOPnqhyymEs8+Cg=";
  };

-  cargoHash = "sha256-h6JWOhdjN4Ikwzvuv7PIYmsk1KxJyGHbjibJKVWtExY=";
+  cargoHash = "sha256-pcWsVoC6076gdWTy3GgMXQIlKiGJZe2q7LSA9fVYxE8=";

  nativeBuildInputs = [
    pkg-config
@@ -11,17 +11,17 @@ let
 in
 buildGoModule rec {
  pname = "gitlab-elasticsearch-indexer";
-  version = "5.9.4";
+  version = "5.10.1";

  # nixpkgs-update: no auto update
  src = fetchFromGitLab {
    owner = "gitlab-org";
    repo = "gitlab-elasticsearch-indexer";
    rev = "v${version}";
-    hash = "sha256-Vj3QqskgrQIMF9mNY8WzvHL0KCU9Ebr3eDm4mUwQJL0=";
+    hash = "sha256-UB3rR6Fk/5M8rpixyg7R0Zd5JZYpG4gEEDHXOQ4b3vI=";
  };

-  vendorHash = "sha256-nmgRQwjf6F7IkED0S7Q03T6Wad5sEmYLbBHLyA33WjU=";
+  vendorHash = "sha256-EM41vNyE4nkv5IcGyRXqn+d7EHGMju2e76KWfHuOTmY=";

  buildInputs = [ icu ];
  nativeBuildInputs = [ pkg-config ];
@@ -31,6 +31,21 @@ buildGoModule rec {
    CGO_CFLAGS = "-I${codeParserBindings}/include";
  };

+  checkFlags =
+    let
+      # Skip tests that require an elasticsearch instance
+      skippedTests = [
+        "TestBulkSizeTracking"
+        "TestProactiveFlushOnSizeLimit"
+        "TestRemoveBulkSizeTracking"
+        "TestDeleteBulkSizeTracking"
+        "TestMixedOperationsBulkSizeTracking"
+        "TestConcurrentOperationsThreadSafety"
+        "TestConcurrentFlushOperations"
+      ];
+    in
+    [ "-skip=^${builtins.concatStringsSep "$|^" skippedTests}$" ];
+
  passthru = {
    inherit codeParserBindings;
  };
@@ -6,17 +6,17 @@

 buildGoModule rec {
  pname = "gitlab-pages";
-  version = "18.5.2";
+  version = "18.6.0";

  # nixpkgs-update: no auto update
  src = fetchFromGitLab {
    owner = "gitlab-org";
    repo = "gitlab-pages";
    rev = "v${version}";
-    hash = "sha256-KxlgJlRuy3q24NJ9kVfOJ3zG4k14wWPKYPTb6QfviHc=";
+    hash = "sha256-ndxdgvf+mjt6PYQpEvyinEP64qRVB5lQXvtgR1eUjWs=";
  };

-  vendorHash = "sha256-VWD/AXqEVWo7G9p1q1BM2LUNwAFmkPm+Gm2s9EPu6nM=";
+  vendorHash = "sha256-AL6V2LPzCGo/7IuY8msip35OScfocp3zO2ZzM8cZfnU=";
  subPackages = [ "." ];

  ldflags = [
@@ -10,16 +10,16 @@

 buildGoModule (finalAttrs: {
  pname = "gitlab-runner";
-  version = "18.5.0";
+  version = "18.6.0";

  src = fetchFromGitLab {
    owner = "gitlab-org";
    repo = "gitlab-runner";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-xuRYnK5Ev2M/vrVWMHcTcK7LLwlQ30MVadMjA67fHpY=";
+    hash = "sha256-SpfmFpL4bZbzC3T77EEbOoV9dVY3tLgcuE0gN4x1168=";
  };

-  vendorHash = "sha256-5Gh9jQ4GkvtN8inEUphehbsnmfyQldvxjbxBkXQ63wc=";
+  vendorHash = "sha256-9Ttmf/iTikSAlAIlmKSRMEDizPP4Iw0CttcR8oYLiMU=";

  # For patchShebangs
  buildInputs = [ bash ];
@@ -1,16 +1,16 @@
 {
-  "version": "18.5.2",
-  "repo_hash": "1gbhkg5m9gv8bj5nrppklajmxzmfq8r4sq4mxak8g2jsm7yxkhg1",
-  "yarn_hash": "16f7r4v4mjjdsfbzy5vy1g18p0l3gnjvfvzrl2xrxdibx7a3b4xs",
-  "frontend_islands_yarn_hash": "0kks9hzm5fq3fss9ys8zxls3d3860l1fvsfcrbhf9rccmwvmjn3l",
+  "version": "18.6.0",
+  "repo_hash": "0pnl0n4yx15i2p7c7738vs4wk4w922zw5nv8p2mjgi6h4frkcg89",
+  "yarn_hash": "1qrgi5zkjy3d74lfjhqwnlh9il572vjwcb63q0s1mcq7cpk8fwhs",
+  "frontend_islands_yarn_hash": "0m64xhlybjlax33k5rmj9kxcj1vzqqygybyz1yzzx9pd87570k2h",
  "owner": "gitlab-org",
  "repo": "gitlab",
-  "rev": "v18.5.2-ee",
+  "rev": "v18.6.0-ee",
  "passthru": {
-    "GITALY_SERVER_VERSION": "18.5.2",
-    "GITLAB_PAGES_VERSION": "18.5.2",
+    "GITALY_SERVER_VERSION": "18.6.0",
+    "GITLAB_PAGES_VERSION": "18.6.0",
    "GITLAB_SHELL_VERSION": "14.45.3",
-    "GITLAB_ELASTICSEARCH_INDEXER_VERSION": "5.9.4",
-    "GITLAB_WORKHORSE_VERSION": "18.5.2"
+    "GITLAB_ELASTICSEARCH_INDEXER_VERSION": "5.10.1",
+    "GITLAB_WORKHORSE_VERSION": "18.6.0"
  }
 }
@@ -10,7 +10,7 @@ in
 buildGoModule rec {
  pname = "gitlab-workhorse";

-  version = "18.5.2";
+  version = "18.6.0";

  # nixpkgs-update: no auto update
  src = fetchFromGitLab {
@@ -22,7 +22,7 @@ buildGoModule rec {

  sourceRoot = "${src.name}/workhorse";

-  vendorHash = "sha256-wO+QuWptrcpqy3K3tvYpQQFzlr7A2m2rhPM64Or3qaY=";
+  vendorHash = "sha256-FCaqoDS6qbKs4Uy8X76cco24HIRxf9gsnQpIjJOHba0=";
  buildInputs = [ git ];
  ldflags = [ "-X main.Version=${version}" ];
  doCheck = false;
@@ -147,7 +147,7 @@ let
      sha256 = data.yarn_hash;
    };
    frontendIslandsYarnOfflineCache = fetchYarnDeps {
-      yarnLock = src + "/ee/frontend_islands/apps/duo_next/yarn.lock";
+      yarnLock = src + "/ee/frontend_islands/yarn.lock";
      sha256 = data.frontend_islands_yarn_hash;
    };

@@ -194,7 +194,7 @@ let
    + lib.optionalString gitlabEnterprise ''
      # Get node modules for frontend islands
      export HOME=$(mktemp -d)
-      pushd ee/frontend_islands/apps/duo_next
+      pushd ee/frontend_islands
      yarn config --offline set yarn-offline-mirror "$frontendIslandsYarnOfflineCache"
      fixup-yarn-lock yarn.lock
      yarn install \
@@ -26,9 +26,9 @@ gem 'bundler-checksum', '~> 0.1.0', path: 'gems/bundler-checksum', require: fals
 # See https://docs.gitlab.com/ee/development/gemfile.html#upgrade-rails for guidelines when upgrading Rails

 if next?
-  gem 'rails', '~> 7.2.2.2', feature_category: :shared
+  gem 'rails', '~> 7.2.3', feature_category: :shared
 else
-  gem 'rails', '~> 7.1.5.2', feature_category: :shared
+  gem 'rails', '~> 7.1.6', feature_category: :shared
 end

 # Pin Zeitwerk until https://gitlab.com/gitlab-org/omnibus-gitlab/-/issues/9408 is fixed
@@ -50,7 +50,7 @@ else
  gem 'ffi', '~> 1.17.2', force_ruby_platform: true, feature_category: :shared
 end

-gem 'openssl', '~> 3.0', feature_category: :shared
+gem 'openssl', '~> 3.3.2', feature_category: :shared

 gem 'gitlab-safe_request_store', path: 'gems/gitlab-safe_request_store', feature_category: :shared

@@ -179,9 +179,9 @@ gem 'gitlab-topology-service-client', '~> 0.1',
  feature_category: :cell

 # Duo Workflow
-gem 'gitlab-duo-workflow-service-client', '~> 0.4',
+gem 'gitlab-duo-workflow-service-client', '~> 0.6',
  path: 'vendor/gems/gitlab-duo-workflow-service-client',
-  feature_category: :agent_foundations
+  feature_category: :duo_agent_platform

 # Generate Fake data
 gem 'ffaker', '~> 2.24', feature_category: :shared
@@ -230,7 +230,7 @@ gem 'google-apis-container_v1', '~> 0.100.0', feature_category: :shared
 gem 'google-apis-container_v1beta1', '~> 0.91.0', feature_category: :shared
 gem 'google-apis-cloudbilling_v1', '~> 0.22.0', feature_category: :shared
 gem 'google-apis-cloudresourcemanager_v1', '~> 0.44.0', feature_category: :shared
-gem 'google-apis-iam_v1', '~> 0.73.0', feature_category: :shared
+gem 'google-apis-iam_v1', '~> 0.79.0', feature_category: :shared
 gem 'google-apis-serviceusage_v1', '~> 0.28.0', feature_category: :shared
 gem 'google-apis-sqladmin_v1beta4', '~> 0.41.0', feature_category: :shared
 gem 'google-apis-androidpublisher_v3', '~> 0.86.0', feature_category: :shared
@@ -334,8 +334,7 @@ gem 'js_regex', '~> 3.8', feature_category: :shared
 gem 'device_detector', feature_category: :shared

 # Redis
-# Do NOT upgrade until Rails is upgraded with a version that contains https://github.com/rails/rails/pull/55359.
-gem 'redis', '= 5.4.0', feature_category: :redis
+gem 'redis', '~> 5.4.1', feature_category: :redis
 gem 'redis-client', '~> 0.25', feature_category: :redis
 gem 'redis-cluster-client', '~> 0.13', feature_category: :redis
 gem 'redis-clustering', '~> 5.4.0', feature_category: :redis
@@ -385,7 +384,7 @@ gem 'rack-proxy', '~> 0.7.7', feature_category: :shared
 gem 'cssbundling-rails', '1.4.3', feature_category: :shared
 gem 'terser', '1.0.2', feature_category: :shared

-gem 'click_house-client', '0.8.0', feature_category: :database
+gem 'click_house-client', '0.8.2', feature_category: :database
 gem 'addressable', '~> 2.8', feature_category: :shared
 gem 'gon', '~> 6.5.0', feature_category: :shared
 gem 'request_store', '~> 1.7.0', feature_category: :shared
@@ -393,7 +392,7 @@ gem 'base32', '~> 0.3.0', feature_category: :shared
 gem 'gitlab-license', '~> 2.6', feature_category: :shared

 # Protect against bruteforcing
-gem 'rack-attack', '~> 6.7.0', feature_category: :shared
+gem 'rack-attack', '~> 6.8.0', feature_category: :shared

 # Sentry integration
 gem 'sentry-ruby', '~> 5.23.0', feature_category: :observability
@@ -408,7 +407,7 @@ gem 'gitlab-schema-validation', path: 'gems/gitlab-schema-validation', feature_c
 gem 'gitlab-http', path: 'gems/gitlab-http', feature_category: :shared

 gem 'premailer-rails', '~> 1.12.0', feature_category: :notifications
-gem 'gitlab-labkit', '~> 0.42.0', feature_category: :shared
+gem 'gitlab-labkit', '~> 0.42.2', feature_category: :shared
 gem 'thrift', '~> 0.22.0', feature_category: :shared

 # I18n
@@ -512,7 +511,7 @@ end
 group :development, :test do
  gem 'deprecation_toolkit', '~> 2.2.3', require: false, feature_category: :shared
  gem 'bullet', '~> 8.0.0', feature_category: :shared
-  gem 'parser', '= 3.3.9.0', feature_category: :shared
+  gem 'parser', '= 3.3.10.0', feature_category: :shared
  gem 'pry-byebug', feature_category: :shared
  gem 'pry-rails', '~> 0.3.9', feature_category: :shared
  gem 'pry-shell', '~> 0.6.4', feature_category: :shared
@@ -609,7 +608,7 @@ group :test do
  # Moved in `test` because https://gitlab.com/gitlab-org/gitlab/-/issues/217527
  gem 'derailed_benchmarks', require: false, feature_category: :shared

-  gem 'gitlab_quality-test_tooling', '~> 2.20.0', require: false, feature_category: :tooling
+  gem 'gitlab_quality-test_tooling', '~> 2.26.0', require: false, feature_category: :tooling
 end

 gem 'octokit', '~> 9.0', feature_category: :importers
@@ -645,12 +644,12 @@ gem 'ssh_data', '~> 2.0', feature_category: :shared
 gem 'spamcheck', '~> 1.3.0', feature_category: :insider_threat

 # Gitaly GRPC protocol definitions
-gem 'gitaly', '~> 18.4.0.pre.rc1', feature_category: :gitaly
+gem 'gitaly', '~> 18.6.0.pre.rc1', feature_category: :gitaly

 # KAS GRPC protocol definitions
 gem 'gitlab-kas-grpc', '~> 18.5.0-rc4', feature_category: :deployment_management

-gem 'grpc', '~> 1.75.0', feature_category: :shared
+gem 'grpc', '~> 1.76.0', feature_category: :shared

 gem 'google-protobuf', '~> 3.25', '>= 3.25.3', feature_category: :shared

@@ -685,7 +684,7 @@ gem 'lru_redux', feature_category: :shared
 # `config/initializers/mail_starttls_patch.rb` has also been patched to
 # fix STARTTLS handling until https://github.com/mikel/mail/pull/1536 is
 # released.
-gem 'mail', '= 2.8.1', feature_category: :shared
+gem 'mail', '= 2.9.0', feature_category: :shared
 gem 'mail-smtp_pool', '~> 0.1.0', path: 'gems/mail-smtp_pool', require: false, feature_category: :shared

 gem 'microsoft_graph_mailer', '~> 0.1.0', path: 'vendor/gems/microsoft_graph_mailer', feature_category: :shared
@@ -752,7 +751,7 @@ gem 'net-http', '= 0.6.0', feature_category: :shared
 # This is locked to 0.13.0 because the default parser changes from RFC2396 to RFC3986,
 # which can be removed after Rails 7.2 upgrade
 # See https://gitlab.com/gitlab-org/gitlab/-/merge_requests/173142#note_2277952450
-gem 'uri', '= 0.13.2', feature_category: :shared
+gem 'uri', '= 0.13.3', feature_category: :shared

 gem 'duo_api', '~> 1.3', feature_category: :system_access

@@ -762,4 +761,4 @@ gem 'paper_trail', '~> 16.0', feature_category: :shared

 gem "i18n_data", "~> 0.13.1", feature_category: :system_access

-gem "gitlab-cloud-connector", "~> 1.26", require: 'gitlab/cloud_connector', feature_category: :plan_provisioning
+gem "gitlab-cloud-connector", "~> 1.35", require: 'gitlab/cloud_connector', feature_category: :plan_provisioning
@@ -87,7 +87,6 @@ PATH
      httparty (~> 0.21)
      ipaddress (~> 0.8.3)
      net-http (= 0.6.0)
-      railties (~> 7)

 PATH
  remote: gems/gitlab-rspec_flaky
@@ -156,7 +155,7 @@ PATH
 PATH
  remote: vendor/gems/gitlab-duo-workflow-service-client
  specs:
-    gitlab-duo-workflow-service-client (0.5)
+    gitlab-duo-workflow-service-client (0.6)
      grpc

 PATH
@@ -214,35 +213,36 @@ GEM
      base64 (~> 0.2)
      faraday (>= 1.0, < 3.0.0)
      faraday-retry (>= 1.0, < 3.0.0)
-    actioncable (7.1.5.2)
-      actionpack (= 7.1.5.2)
-      activesupport (= 7.1.5.2)
+    actioncable (7.1.6)
+      actionpack (= 7.1.6)
+      activesupport (= 7.1.6)
      nio4r (~> 2.0)
      websocket-driver (>= 0.6.1)
      zeitwerk (~> 2.6)
-    actionmailbox (7.1.5.2)
-      actionpack (= 7.1.5.2)
-      activejob (= 7.1.5.2)
-      activerecord (= 7.1.5.2)
-      activestorage (= 7.1.5.2)
-      activesupport (= 7.1.5.2)
+    actionmailbox (7.1.6)
+      actionpack (= 7.1.6)
+      activejob (= 7.1.6)
+      activerecord (= 7.1.6)
+      activestorage (= 7.1.6)
+      activesupport (= 7.1.6)
      mail (>= 2.7.1)
      net-imap
      net-pop
      net-smtp
-    actionmailer (7.1.5.2)
-      actionpack (= 7.1.5.2)
-      actionview (= 7.1.5.2)
-      activejob (= 7.1.5.2)
-      activesupport (= 7.1.5.2)
+    actionmailer (7.1.6)
+      actionpack (= 7.1.6)
+      actionview (= 7.1.6)
+      activejob (= 7.1.6)
+      activesupport (= 7.1.6)
      mail (~> 2.5, >= 2.5.4)
      net-imap
      net-pop
      net-smtp
      rails-dom-testing (~> 2.2)
-    actionpack (7.1.5.2)
-      actionview (= 7.1.5.2)
-      activesupport (= 7.1.5.2)
+    actionpack (7.1.6)
+      actionview (= 7.1.6)
+      activesupport (= 7.1.6)
+      cgi
      nokogiri (>= 1.8.5)
      racc
      rack (>= 2.2.4)
@@ -250,35 +250,36 @@ GEM
      rack-test (>= 0.6.3)
      rails-dom-testing (~> 2.2)
      rails-html-sanitizer (~> 1.6)
-    actiontext (7.1.5.2)
-      actionpack (= 7.1.5.2)
-      activerecord (= 7.1.5.2)
-      activestorage (= 7.1.5.2)
-      activesupport (= 7.1.5.2)
+    actiontext (7.1.6)
+      actionpack (= 7.1.6)
+      activerecord (= 7.1.6)
+      activestorage (= 7.1.6)
+      activesupport (= 7.1.6)
      globalid (>= 0.6.0)
      nokogiri (>= 1.8.5)
-    actionview (7.1.5.2)
-      activesupport (= 7.1.5.2)
+    actionview (7.1.6)
+      activesupport (= 7.1.6)
      builder (~> 3.1)
+      cgi
      erubi (~> 1.11)
      rails-dom-testing (~> 2.2)
      rails-html-sanitizer (~> 1.6)
-    activejob (7.1.5.2)
-      activesupport (= 7.1.5.2)
+    activejob (7.1.6)
+      activesupport (= 7.1.6)
      globalid (>= 0.3.6)
-    activemodel (7.1.5.2)
-      activesupport (= 7.1.5.2)
-    activerecord (7.1.5.2)
-      activemodel (= 7.1.5.2)
-      activesupport (= 7.1.5.2)
+    activemodel (7.1.6)
+      activesupport (= 7.1.6)
+    activerecord (7.1.6)
+      activemodel (= 7.1.6)
+      activesupport (= 7.1.6)
      timeout (>= 0.4.0)
-    activestorage (7.1.5.2)
-      actionpack (= 7.1.5.2)
-      activejob (= 7.1.5.2)
-      activerecord (= 7.1.5.2)
-      activesupport (= 7.1.5.2)
+    activestorage (7.1.6)
+      actionpack (= 7.1.6)
+      activejob (= 7.1.6)
+      activerecord (= 7.1.6)
+      activesupport (= 7.1.6)
      marcel (~> 1.0)
-    activesupport (7.1.5.2)
+    activesupport (7.1.6)
      base64
      benchmark (>= 0.3)
      bigdecimal
@@ -413,6 +414,7 @@ GEM
      mime-types (>= 1.16)
      ssrf_filter (~> 1.0, < 1.1.0)
    cbor (0.5.9.8)
+    cgi (0.5.0)
    character_set (1.8.0)
    charlock_holmes (0.7.9)
    chef-config (18.3.0)
@@ -432,7 +434,7 @@ GEM
      cork
      nap
      open4 (~> 1.3)
-    click_house-client (0.8.0)
+    click_house-client (0.8.2)
      activerecord (>= 7.0, < 9.0)
      activesupport (>= 7.0, < 9.0)
      addressable (~> 2.8)
@@ -730,14 +732,14 @@ GEM
    git (1.19.1)
      addressable (~> 2.8)
      rchardet (~> 1.8)
-    gitaly (18.4.1)
+    gitaly (18.6.0.pre.rc1)
      grpc (~> 1.0)
    gitlab (4.19.0)
      httparty (~> 0.20)
      terminal-table (>= 1.5.1)
    gitlab-chronic (0.10.6)
      numerizer (~> 0.2)
-    gitlab-cloud-connector (1.33.0)
+    gitlab-cloud-connector (1.36.0)
      activesupport (~> 7.0)
      jwt (~> 2.9)
    gitlab-crystalball (1.1.1)
@@ -763,7 +765,7 @@ GEM
      rb_sys (~> 0.9.109)
    gitlab-kas-grpc (18.5.0.pre.rc4)
      grpc (~> 1.0)
-    gitlab-labkit (0.42.0)
+    gitlab-labkit (0.42.2)
      actionpack (>= 5.0.0, < 8.1.0)
      activesupport (>= 5.0.0, < 8.1.0)
      google-protobuf (~> 3)
@@ -788,7 +790,7 @@ GEM
      activesupport (>= 5.2.0)
      rake (~> 13.0)
      snowplow-tracker (~> 0.8.0)
-    gitlab-secret_detection (0.35.1)
+    gitlab-secret_detection (0.38.0)
      grpc (>= 1.63.0, < 2)
      grpc_reflection (~> 0.1)
      parallel (~> 1)
@@ -816,7 +818,7 @@ GEM
      omniauth (>= 1.3, < 3)
      pyu-ruby-sasl (>= 0.0.3.3, < 0.1)
      rubyntlm (~> 0.5)
-    gitlab_quality-test_tooling (2.20.3)
+    gitlab_quality-test_tooling (2.26.0)
      activesupport (>= 7.0, < 7.3)
      amatch (~> 0.4.1)
      fog-google (~> 1.24, >= 1.24.1)
@@ -860,7 +862,7 @@ GEM
      retriable (>= 2.0, < 4.a)
    google-apis-dns_v1 (0.36.0)
      google-apis-core (>= 0.11.0, < 2.a)
-    google-apis-iam_v1 (0.73.0)
+    google-apis-iam_v1 (0.79.0)
      google-apis-core (>= 0.15.0, < 2.a)
    google-apis-iamcredentials_v1 (0.24.0)
      google-apis-core (>= 0.15.0, < 2.a)
@@ -975,7 +977,7 @@ GEM
      logger (~> 1.6)
      ostruct (~> 0.6)
      sass-embedded (~> 1.58)
-    grpc (1.75.0)
+    grpc (1.76.0)
      google-protobuf (>= 3.25, < 5.0)
      googleapis-common-protos-types (~> 1.0)
    grpc-google-iam-v1 (1.5.0)
@@ -1180,7 +1182,8 @@ GEM
      zeitwerk (~> 2.5)
    lru_redux (1.1.0)
    lumberjack (1.2.7)
-    mail (2.8.1)
+    mail (2.9.0)
+      logger
      mini_mime (>= 0.1.1)
      net-imap
      net-pop
@@ -1299,11 +1302,11 @@ GEM
    omniauth-github (2.0.1)
      omniauth (~> 2.0)
      omniauth-oauth2 (~> 1.8)
-    omniauth-google-oauth2 (1.1.1)
-      jwt (>= 2.0)
-      oauth2 (~> 2.0.6)
+    omniauth-google-oauth2 (1.2.1)
+      jwt (>= 2.9.2)
+      oauth2 (~> 2.0)
      omniauth (~> 2.0)
-      omniauth-oauth2 (~> 1.8.0)
+      omniauth-oauth2 (~> 1.8)
    omniauth-oauth2 (1.8.0)
      oauth2 (>= 1.4, < 3)
      omniauth (~> 2.0)
@@ -1471,7 +1474,7 @@ GEM
      activerecord (>= 6.1)
      request_store (~> 1.4)
    parallel (1.27.0)
-    parser (3.3.9.0)
+    parser (3.3.10.0)
      ast (~> 2.4.1)
      racc
    parslet (1.8.2)
@@ -1539,10 +1542,10 @@ GEM
    pyu-ruby-sasl (0.0.3.3)
    raabro (1.4.0)
    racc (1.8.1)
-    rack (2.2.20)
+    rack (2.2.21)
    rack-accept (0.4.5)
      rack (>= 0.4)
-    rack-attack (6.7.0)
+    rack-attack (6.8.0)
      rack (>= 1.0, < 4)
    rack-cors (2.0.2)
      rack (>= 2.0.0)
@@ -1565,20 +1568,20 @@ GEM
    rackup (1.0.1)
      rack (< 3)
      webrick
-    rails (7.1.5.2)
-      actioncable (= 7.1.5.2)
-      actionmailbox (= 7.1.5.2)
-      actionmailer (= 7.1.5.2)
-      actionpack (= 7.1.5.2)
-      actiontext (= 7.1.5.2)
-      actionview (= 7.1.5.2)
-      activejob (= 7.1.5.2)
-      activemodel (= 7.1.5.2)
-      activerecord (= 7.1.5.2)
-      activestorage (= 7.1.5.2)
-      activesupport (= 7.1.5.2)
+    rails (7.1.6)
+      actioncable (= 7.1.6)
+      actionmailbox (= 7.1.6)
+      actionmailer (= 7.1.6)
+      actionpack (= 7.1.6)
+      actiontext (= 7.1.6)
+      actionview (= 7.1.6)
+      activejob (= 7.1.6)
+      activemodel (= 7.1.6)
+      activerecord (= 7.1.6)
+      activestorage (= 7.1.6)
+      activesupport (= 7.1.6)
      bundler (>= 1.15.0)
-      railties (= 7.1.5.2)
+      railties (= 7.1.6)
    rails-controller-testing (1.0.5)
      actionpack (>= 5.0.1.rc1)
      actionview (>= 5.0.1.rc1)
@@ -1593,13 +1596,15 @@ GEM
    rails-i18n (7.0.10)
      i18n (>= 0.7, < 2)
      railties (>= 6.0.0, < 8)
-    railties (7.1.5.2)
-      actionpack (= 7.1.5.2)
-      activesupport (= 7.1.5.2)
+    railties (7.1.6)
+      actionpack (= 7.1.6)
+      activesupport (= 7.1.6)
+      cgi
      irb
      rackup (>= 1.0.0)
      rake (>= 12.2)
      thor (~> 1.0, >= 1.2.2)
+      tsort (>= 0.2)
      zeitwerk (~> 2.6)
    rainbow (3.1.1)
    rake (13.0.6)
@@ -1624,7 +1629,7 @@ GEM
      json
    recursive-open-struct (1.1.3)
    redcarpet (3.6.0)
-    redis (5.4.0)
+    redis (5.4.1)
      redis-client (>= 0.22.0)
    redis-actionpack (5.5.0)
      actionpack (>= 5)
@@ -1634,8 +1639,8 @@ GEM
      connection_pool
    redis-cluster-client (0.13.5)
      redis-client (~> 0.24)
-    redis-clustering (5.4.0)
-      redis (= 5.4.0)
+    redis-clustering (5.4.1)
+      redis (= 5.4.1)
      redis-cluster-client (>= 0.10.0)
    redis-namespace (1.11.0)
      redis (>= 4)
@@ -1955,6 +1960,7 @@ GEM
    truncato (0.7.13)
      htmlentities (~> 4.3.1)
      nokogiri (>= 1.7.0, <= 2.0)
+    tsort (0.2.0)
    ttfunk (1.8.0)
      bigdecimal (~> 3.1)
    tty-color (0.6.0)
@@ -2001,7 +2007,7 @@ GEM
    unparser (0.6.7)
      diff-lcs (~> 1.3)
      parser (>= 3.2.0)
-    uri (0.13.2)
+    uri (0.13.3)
    valid_email (0.1.3)
      activemodel
      mail (>= 2.6.1)
@@ -2115,7 +2121,7 @@ DEPENDENCIES
  carrierwave (~> 1.3)
  charlock_holmes (~> 0.7.9)
  circuitbox (= 2.0.0)
-  click_house-client (= 0.8.0)
+  click_house-client (= 0.8.2)
  commonmarker (~> 0.23.10)
  concurrent-ruby (~> 1.1)
  connection_pool (~> 2.5.3)
@@ -2172,14 +2178,14 @@ DEPENDENCIES
  gettext (~> 3.5, >= 3.5.1)
  gettext_i18n_rails (~> 1.13.0)
  git (~> 1.8)
-  gitaly (~> 18.4.0.pre.rc1)
+  gitaly (~> 18.6.0.pre.rc1)
  gitlab-active-context!
  gitlab-backup-cli!
  gitlab-chronic (~> 0.10.5)
-  gitlab-cloud-connector (~> 1.26)
+  gitlab-cloud-connector (~> 1.35)
  gitlab-crystalball (~> 1.1.0)
  gitlab-dangerfiles (~> 4.10.0)
-  gitlab-duo-workflow-service-client (~> 0.4)!
+  gitlab-duo-workflow-service-client (~> 0.6)!
  gitlab-experiment (~> 1.0.0)
  gitlab-fog-azure-rm (~> 2.4.0)
  gitlab-glfm-markdown (~> 0.0.38)
@@ -2187,7 +2193,7 @@ DEPENDENCIES
  gitlab-housekeeper!
  gitlab-http!
  gitlab-kas-grpc (~> 18.5.0.pre.rc4)
-  gitlab-labkit (~> 0.42.0)
+  gitlab-labkit (~> 0.42.2)
  gitlab-license (~> 2.6)
  gitlab-mail_room (~> 0.0.24)
  gitlab-markup (~> 2.0.0)
@@ -2205,7 +2211,7 @@ DEPENDENCIES
  gitlab-utils!
  gitlab_chronic_duration (~> 0.12)
  gitlab_omniauth-ldap (~> 2.3.0)
-  gitlab_quality-test_tooling (~> 2.20.0)
+  gitlab_quality-test_tooling (~> 2.26.0)
  gon (~> 6.5.0)
  google-apis-androidpublisher_v3 (~> 0.86.0)
  google-apis-cloudbilling_v1 (~> 0.22.0)
@@ -2214,7 +2220,7 @@ DEPENDENCIES
  google-apis-container_v1 (~> 0.100.0)
  google-apis-container_v1beta1 (~> 0.91.0)
  google-apis-core (~> 0.18.0, >= 0.18.0)
-  google-apis-iam_v1 (~> 0.73.0)
+  google-apis-iam_v1 (~> 0.79.0)
  google-apis-serviceusage_v1 (~> 0.28.0)
  google-apis-sqladmin_v1beta4 (~> 0.41.0)
  google-apis-storage_v1 (~> 0.29)
@@ -2234,7 +2240,7 @@ DEPENDENCIES
  graphlyte (~> 1.0.0)
  graphql (= 2.5.11)
  graphql-docs (~> 5.2.0)
-  grpc (~> 1.75.0)
+  grpc (~> 1.76.0)
  gssapi (~> 1.3.1)
  guard-rspec
  haml_lint (~> 0.58)
@@ -2272,7 +2278,7 @@ DEPENDENCIES
  loofah (~> 2.24.0)
  lookbook (~> 2.3)
  lru_redux
-  mail (= 2.8.1)
+  mail (= 2.9.0)
  mail-smtp_pool (~> 0.1.0)!
  marcel (~> 1.0.4)
  marginalia (~> 1.11.1)
@@ -2308,7 +2314,7 @@ DEPENDENCIES
  omniauth_crowd (~> 2.4.0)!
  omniauth_openid_connect (~> 0.8.0)
  openid_connect (~> 2.3.0)
-  openssl (~> 3.0)
+  openssl (~> 3.3.2)
  opentelemetry-exporter-otlp
  opentelemetry-instrumentation-action_pack
  opentelemetry-instrumentation-action_view
@@ -2337,7 +2343,7 @@ DEPENDENCIES
  pact (~> 1.64)
  paper_trail (~> 16.0)
  parallel (~> 1.19)
-  parser (= 3.3.9.0)
+  parser (= 3.3.10.0)
  parslet (~> 1.8)
  peek (~> 1.1)
  pg (~> 1.6.1)
@@ -2352,19 +2358,19 @@ DEPENDENCIES
  pry-shell (~> 0.6.4)
  puma (= 6.6.1)
  rack (~> 2.2.9)
-  rack-attack (~> 6.7.0)
+  rack-attack (~> 6.8.0)
  rack-cors (~> 2.0.1)
  rack-oauth2 (~> 2.2.1)
  rack-proxy (~> 0.7.7)
  rack-timeout (~> 0.7.0)
-  rails (~> 7.1.5.2)
+  rails (~> 7.1.6)
  rails-controller-testing
  rails-i18n (~> 7.0, >= 7.0.9)
  rainbow (~> 3.0)
  rbtrace (~> 0.4)
  re2 (~> 2.15)
  recaptcha (~> 5.12)
-  redis (= 5.4.0)
+  redis (~> 5.4.1)
  redis-actionpack (~> 5.5.0)
  redis-client (~> 0.25)
  redis-cluster-client (~> 0.13)
@@ -2435,7 +2441,7 @@ DEPENDENCIES
  undercover (~> 0.7.0)
  unicode-emoji (~> 4.0)
  unleash (~> 3.2.2)
-  uri (= 0.13.2)
+  uri (= 0.13.3)
  valid_email (~> 0.1)
  validates_hostname (~> 1.0.13)
  version_sorter (~> 2.3)
@@ -30,10 +30,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0dsyppp79da5p5jh3wxry08vy401xrff4sgww47i2l93mdyldpbr";
+      sha256 = "1nn30fnsbqhx3yyy6vf7wxcqz3fnv7rkrbi010b5414119gqshmd";
      type = "gem";
    };
-    version = "7.1.5.2";
+    version = "7.1.6";
  };
  actionmailbox = {
    dependencies = [
@@ -55,10 +55,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0kmcvibpi4ppk1j1dkqhglix73xhyr29k6l2ziy92azy0b0isaqr";
+      sha256 = "0cgpq8xn5apfrx89pc3phwcayqvhy10kb0sm8pqsaiy1isnminfy";
      type = "gem";
    };
-    version = "7.1.5.2";
+    version = "7.1.6";
  };
  actionmailer = {
    dependencies = [
@@ -80,15 +80,16 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "02w6kq5c2pjp1svfxxqqa46z6zgj2y7x6wybgpln9g5i3vn5yp3s";
+      sha256 = "0wyj251glxf2n00k6yc29r8dbys9b03mr8x5knd2kgb6xhh68zxh";
      type = "gem";
    };
-    version = "7.1.5.2";
+    version = "7.1.6";
  };
  actionpack = {
    dependencies = [
      "actionview"
      "activesupport"
+      "cgi"
      "nokogiri"
      "racc"
      "rack"
@@ -105,10 +106,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1za4sv0ch8j7adfldglp8jalcc8s68h031sqldw0f9pbmb4fvgx7";
+      sha256 = "1sq328ark8wa4c8x3y3nsv9qfysjbnn3bv8ily83dz6wdyijv91z";
      type = "gem";
    };
-    version = "7.1.5.2";
+    version = "7.1.6";
  };
  actiontext = {
    dependencies = [
@@ -127,15 +128,16 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "01q275ihq4gds2yvlbzdpqap95z5divwany0x5lcnqhpc7j7hmjh";
+      sha256 = "0rky5702sixkxb04fmpsyycqdv49kpn7nsl68v5whz6n5m15gmkr";
      type = "gem";
    };
-    version = "7.1.5.2";
+    version = "7.1.6";
  };
  actionview = {
    dependencies = [
      "activesupport"
      "builder"
+      "cgi"
      "erubi"
      "rails-dom-testing"
      "rails-html-sanitizer"
@@ -149,10 +151,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1jd1biyrf3n45jilazfqli27jnlk60bpn82mi4i1wqxcgsn1djag";
+      sha256 = "0rpmxm1vvga9jjym371h9q26wi4gdxf80xra5c3awr84z60ps50i";
      type = "gem";
    };
-    version = "7.1.5.2";
+    version = "7.1.6";
  };
  activejob = {
    dependencies = [
@@ -167,10 +169,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0kl0ppvvxhd4igaxpbn64yyam120vyf0h2bbzqs1xa6dqnjn5dmg";
+      sha256 = "1fyc5paw29kwc6v5mqvpvd8354y3c4z3l8nrkls0hij93l2wvn8d";
      type = "gem";
    };
-    version = "7.1.5.2";
+    version = "7.1.6";
  };
  activemodel = {
    dependencies = [ "activesupport" ];
@@ -183,10 +185,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1df89b7pf66r5v6ixf2kn5mb3mzhpkggqqw544685vhlhrmabdjg";
+      sha256 = "08g7lar9g9bqlvmhyc8bsvp0kzs18hhqiz1zksbbaq5530052bzp";
      type = "gem";
    };
-    version = "7.1.5.2";
+    version = "7.1.6";
  };
  activerecord = {
    dependencies = [
@@ -203,10 +205,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0alxm4yk5zqnzfj8jj06cwfzgb3gvcvab8mzd0lgs9x75lmsfgcj";
+      sha256 = "0yghfgk627mc5gf5p549ilhs2hvjs5ms81dvkrixhzn9gz6ri8hs";
      type = "gem";
    };
-    version = "7.1.5.2";
+    version = "7.1.6";
  };
  activerecord-gitlab = {
    dependencies = [ "activerecord" ];
@@ -234,10 +236,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "163wq77fx38vjdb4jhvfphahnrzdp2kq9ngg02g5y4zaghacp6pd";
+      sha256 = "167k9fgv7ymvrk737mf5zwfl8za7qhxajgdwkhypifljcn7cn6ig";
      type = "gem";
    };
-    version = "7.1.5.2";
+    version = "7.1.6";
  };
  activesupport = {
    dependencies = [
@@ -263,10 +265,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1lbfsgmbn87mim29v7h5w4v8zflhx6zxrbbp95hfmgxcr2wk204h";
+      sha256 = "0z1szpkxgxkq4ckgl4n51y2g3bi9f5a3wri2lci4j71vh45184kz";
      type = "gem";
    };
-    version = "7.1.5.2";
+    version = "7.1.6";
  };
  addressable = {
    dependencies = [ "public_suffix" ];
@@ -1025,6 +1027,21 @@ src: {
    };
    version = "3.0.7";
  };
+  cgi = {
+    groups = [
+      "default"
+      "development"
+      "monorepo"
+      "test"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1njrjznc2j5xqqw71sp9130b9hyv59h2gfrf6yaf4in1n9dzd6gy";
+      type = "gem";
+    };
+    version = "0.5.0";
+  };
  character_set = {
    groups = [ "default" ];
    platforms = [ ];
@@ -1148,10 +1165,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "166j9r2pn6hbqqhgjx37c245yhd60dz00jphp18snrsfcxx841ds";
+      sha256 = "1k35sm731qmxznzyhjcbqlypf070radmd4ai0i8yn4dzl4bmdqj9";
      type = "gem";
    };
-    version = "0.8.0";
+    version = "0.8.2";
  };
  coderay = {
    groups = [
@@ -2785,10 +2802,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1qg3kc103v767hjw77wcx5mwx5dg2b6vlhxk3bb4hpbsjqgm4mf3";
+      sha256 = "0xn347pk7zkks3zhzi73s2zg8ps5cbc8z6y0k678iafpsbnj0ayc";
      type = "gem";
    };
-    version = "18.4.1";
+    version = "18.6.0.pre.rc1";
  };
  gitlab = {
    dependencies = [
@@ -2882,10 +2899,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0bvjvc2yvc2sjn4f6lgww46gw39pb1ripsl5a6rq6wldfahvp7mw";
+      sha256 = "0x5qk0llskwk50qirlpmi1z4jfywfm3m1d6j9d0hsncjlphawyyy";
      type = "gem";
    };
-    version = "1.33.0";
+    version = "1.36.0";
  };
  gitlab-crystalball = {
    dependencies = [
@@ -2931,7 +2948,7 @@ src: {
      path = "${src}/vendor/gems/gitlab-duo-workflow-service-client";
      type = "path";
    };
-    version = "0.5";
+    version = "0.6";
  };
  gitlab-experiment = {
    dependencies = [
@@ -3016,7 +3033,6 @@ src: {
      "httparty"
      "ipaddress"
      "net-http"
-      "railties"
    ];
    groups = [ "default" ];
    platforms = [ ];
@@ -3054,10 +3070,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "07xbjd5vap486vspzz164hf2j5x0v9g4q6j0whzlh3ak1svqb22j";
+      sha256 = "0pa92lw9s9nz4xdv4hlh381niq8kj4lxdpafnkjhimfka8iibb63";
      type = "gem";
    };
-    version = "0.42.0";
+    version = "0.42.2";
  };
  gitlab-license = {
    groups = [ "default" ];
@@ -3197,10 +3213,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0s9akkxm69i9mlcl5n3ikv9dy678cqqa3jl3cq785653gcx8p8ww";
+      sha256 = "0v22xi0pvdnpzszlqhlc5xi547amlrs7a9s6qzygc07mnwbvzihj";
      type = "gem";
    };
-    version = "0.35.1";
+    version = "0.38.0";
  };
  gitlab-security_report_schemas = {
    dependencies = [
@@ -3327,10 +3343,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0b3db3p68b8h2089rhi5z3m927xkv4vcxa998v17lmspj2496wra";
+      sha256 = "0n9m042lmpxpyr9nldz6d9rksczra7agjkrvrwkqjj9a5w1grigy";
      type = "gem";
    };
-    version = "2.20.3";
+    version = "2.26.0";
  };
  globalid = {
    dependencies = [ "activesupport" ];
@@ -3485,10 +3501,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0jba8g7iykvmgbar1xvfwar18896bls2shccx59lvpb1y5ji263g";
+      sha256 = "1s3saxkxzrfyabc2ahrvxhvy02pk6bh16gs2z6alg5lcq564l0fw";
      type = "gem";
    };
-    version = "0.73.0";
+    version = "0.79.0";
  };
  google-apis-iamcredentials_v1 = {
    dependencies = [ "google-apis-core" ];
@@ -3982,10 +3998,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1na1h7nkc9s9s33g1pliml1nm3dq56ffwp9ajs95kpazbplbcd79";
+      sha256 = "162mayssd5y1jz7blwghdmjldxrb9gg7bffi1x2fwfhm8bx1c90i";
      type = "gem";
    };
-    version = "1.75.0";
+    version = "1.76.0";
  };
  grpc-google-iam-v1 = {
    dependencies = [
@@ -5046,6 +5062,7 @@ src: {
  };
  mail = {
    dependencies = [
+      "logger"
      "mini_mime"
      "net-imap"
      "net-pop"
@@ -5059,10 +5076,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1bf9pysw1jfgynv692hhaycfxa8ckay1gjw5hz3madrbrynryfzc";
+      sha256 = "0ha9sgkfqna62c1basc17dkx91yk7ppgjq32k4nhrikirlz6g9kg";
      type = "gem";
    };
-    version = "2.8.1";
+    version = "2.9.0";
  };
  mail-smtp_pool = {
    dependencies = [
@@ -5885,10 +5902,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0fahkghfa2iczmwss9bz5l4rh7siwzjnjp3akh7pdbsfx0kg35j4";
+      sha256 = "1pdf3bx036l6ggz6lkkykv77m9k4jypwsiw1q7874czwh2v50768";
      type = "gem";
    };
-    version = "1.1.1";
+    version = "1.2.1";
  };
  omniauth-oauth2 = {
    dependencies = [
@@ -6668,10 +6685,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1wl7frfk68q6gsf6q6j32jl5m3yc0b9x8ycxz3hy79miaj9r5mll";
+      sha256 = "1mmb59323ldv6vxfmy98azgsla9k3di3fasvpb28hnn5bkx8fdff";
      type = "gem";
    };
-    version = "3.3.9.0";
+    version = "3.3.10.0";
  };
  parslet = {
    groups = [
@@ -7080,10 +7097,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0w3iq14y3ldjq29qv2ll7y1dj7adxl9p9m0312h30ll4li3k9nl5";
+      sha256 = "0fgpa9qm5qgza69fjnagg2alxs2wmj41aq7z4kj5yib50wpzgqhl";
      type = "gem";
    };
-    version = "2.2.20";
+    version = "2.2.21";
  };
  rack-accept = {
    dependencies = [ "rack" ];
@@ -7102,10 +7119,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0z6pj5vjgl6swq7a33gssf795k958mss8gpmdb4v4cydcs7px91w";
+      sha256 = "1wpcxspprm187k6mch9fxhaaq1a3s9bzybd2fdaw1g45pzg9yjgj";
      type = "gem";
    };
-    version = "6.7.0";
+    version = "6.8.0";
  };
  rack-cors = {
    dependencies = [ "rack" ];
@@ -7235,10 +7252,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0ikmj9p48n8mms39jq8w91y12cm7zmxc7a1r9i7vzfn509r0i4m2";
+      sha256 = "0w3librd55ifs5za27afch673zyqycd7kka2fnnxmqqda5g362ls";
      type = "gem";
    };
-    version = "7.1.5.2";
+    version = "7.1.6";
  };
  rails-controller-testing = {
    dependencies = [
@@ -7312,10 +7329,12 @@ src: {
    dependencies = [
      "actionpack"
      "activesupport"
+      "cgi"
      "irb"
      "rackup"
      "rake"
      "thor"
+      "tsort"
      "zeitwerk"
    ];
    groups = [
@@ -7326,10 +7345,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "08fnm4bfkmjknnzmi1wkvyw9b2r4c5ammk0jzp4mgfgv1fgwh2mg";
+      sha256 = "076ywx2xs824c8bgy0fgshlfxri6v3sb3x7yy08nv9mc5rzyj41a";
      type = "gem";
    };
-    version = "7.1.5.2";
+    version = "7.1.6";
  };
  rainbow = {
    groups = [
@@ -7528,10 +7547,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0syhyw1bp9nbb0fvcmm58y1c6iav6xw6b4bzjz1rz2j1d7c012br";
+      sha256 = "1bpsh5dbvybsa8qnv4dg11a6f2zn4sndarf7pk4iaayjgaspbrmm";
      type = "gem";
    };
-    version = "5.4.0";
+    version = "5.4.1";
  };
  redis-actionpack = {
    dependencies = [
@@ -7579,10 +7598,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0fsnfi15xiy8sal6av11fqfjmdmjpy93amf790i0zwqcf1iq1qbw";
+      sha256 = "1sj4b3j7i3rb5a276g7yyd95kji4j9sl6wmqfgpz39gx06qlni47";
      type = "gem";
    };
-    version = "5.4.0";
+    version = "5.4.1";
  };
  redis-namespace = {
    dependencies = [ "redis" ];
@@ -9402,6 +9421,20 @@ src: {
    };
    version = "0.7.13";
  };
+  tsort = {
+    groups = [
+      "default"
+      "development"
+      "test"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "17q8h020dw73wjmql50lqw5ddsngg67jfw8ncjv476l5ys9sfl4n";
+      type = "gem";
+    };
+    version = "0.2.0";
+  };
  ttfunk = {
    dependencies = [ "bigdecimal" ];
    groups = [ "default" ];
@@ -9692,10 +9725,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0mz4hxi8lxh8rs6aph1mrihczvvz8ag9zlin1gzvq490cmp1jmx5";
+      sha256 = "19qy5sdl7c7h793r8dy8r06avz7y4srwqvaxlhvj8q3kbg0naigd";
      type = "gem";
    };
-    version = "0.13.2";
+    version = "0.13.3";
  };
  valid_email = {
    dependencies = [
@@ -112,7 +112,7 @@ class GitLabRepo:
            version=self.rev2version(rev),
            repo_hash=self.get_git_hash(rev),
            yarn_hash=self.get_yarn_hash(rev),
-            frontend_islands_yarn_hash=self.get_yarn_hash(rev, "/ee/frontend_islands/apps/duo_next/yarn.lock"),
+            frontend_islands_yarn_hash=self.get_yarn_hash(rev, "/ee/frontend_islands/yarn.lock"),
            owner=self.owner,
            repo=self.repo,
            rev=rev,
@@ -5,16 +5,16 @@
 }:
 buildGoModule rec {
  pname = "gptscript";
-  version = "0.9.5";
+  version = "0.9.7";

  src = fetchFromGitHub {
    owner = "gptscript-ai";
    repo = "gptscript";
    tag = "v${version}";
-    hash = "sha256-9wyDcvY5JCjtvx6XtvHwOsZLCiN1fRn0wBGaIaw2iRQ=";
+    hash = "sha256-eZvNW3VKhqgOOkkIFFHeWXowgxLV/05iQtR0XgH8Ghw=";
  };

-  vendorHash = "sha256-ajglXWGJhSJtcrbSBmxmriXFTT+Vb4xYq0Ec9SYRlQk=";
+  vendorHash = "sha256-BUOIIXFfd8p8tXH2tNLM897j5CkI2EqNU3V8pojrxFI=";

  ldflags = [
    "-s"
@@ -15,14 +15,14 @@
  testers,
 }:

-buildGoModule rec {
+buildGoModule (finalAttrs: {
  pname = "grafana-alloy";
  version = "1.11.3";

  src = fetchFromGitHub {
    owner = "grafana";
    repo = "alloy";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
    hash = "sha256-yO1r7GLXlD7f5Fpooit7SwkB7EB1hDO42o3BLvWY8Qo=";
  };

@@ -44,9 +44,9 @@ buildGoModule rec {
      "-s"
      "-w"
      # https://github.com/grafana/alloy/blob/3201389252d2c011bee15ace0c9f4cdbcb978f9f/Makefile#L110
-      "-X ${prefix}.Branch=v${version}"
-      "-X ${prefix}.Version=${version}"
-      "-X ${prefix}.Revision=v${version}"
+      "-X ${prefix}.Branch=v${finalAttrs.version}"
+      "-X ${prefix}.Version=${finalAttrs.version}"
+      "-X ${prefix}.Revision=v${finalAttrs.version}"
      "-X ${prefix}.BuildUser=nix"
      "-X ${prefix}.BuildDate=1970-01-01T00:00:00Z"
    ];
@@ -69,7 +69,7 @@ buildGoModule rec {
  );

  yarnOfflineCache = fetchYarnDeps {
-    yarnLock = "${src}/internal/web/ui/yarn.lock";
+    yarnLock = "${finalAttrs.src}/internal/web/ui/yarn.lock";
    hash = "sha256-oCDP2XJczLXgzEjyvFEIFBanlnzjrj0So09izG5vufs=";
  };

@@ -80,7 +80,7 @@ buildGoModule rec {
    export HOME=$NIX_BUILD_TOP/fake_home

    fixup-yarn-lock yarn.lock
-    yarn config --offline set yarn-offline-mirror ${yarnOfflineCache}
+    yarn config --offline set yarn-offline-mirror ${finalAttrs.yarnOfflineCache}
    yarn install --offline --frozen-lockfile --ignore-platform --ignore-scripts --no-progress --non-interactive

    patchShebangs node_modules/
@@ -123,7 +123,7 @@ buildGoModule rec {
    tests = {
      inherit (nixosTests) alloy;
      version = testers.testVersion {
-        version = "v${version}";
+        version = "v${finalAttrs.version}";
        package = grafana-alloy;
      };
    };
@@ -134,7 +134,7 @@ buildGoModule rec {
      ];
    };
    # alias for nix-update to be able to find and update this attribute
-    offlineCache = yarnOfflineCache;
+    offlineCache = finalAttrs.yarnOfflineCache;
  };

  meta = with lib; {
@@ -142,7 +142,7 @@ buildGoModule rec {
    mainProgram = "alloy";
    license = licenses.asl20;
    homepage = "https://grafana.com/oss/alloy";
-    changelog = "https://github.com/grafana/alloy/blob/${src.rev}/CHANGELOG.md";
+    changelog = "https://github.com/grafana/alloy/blob/${finalAttrs.src.rev}/CHANGELOG.md";
    maintainers = with maintainers; [
      azahi
      flokli
@@ -150,4 +150,4 @@ buildGoModule rec {
    ];
    platforms = lib.platforms.unix;
  };
-}
+})
@@ -31,7 +31,7 @@ let
  };
 in
 stdenv.mkDerivation rec {
-  version = "16.3.33";
+  version = "16.3.37";
  pname = "jmol";

  src =
@@ -40,7 +40,7 @@ stdenv.mkDerivation rec {
    in
    fetchurl {
      url = "mirror://sourceforge/jmol/Jmol/Version%20${baseVersion}/Jmol%20${version}/Jmol-${version}-binary.tar.gz";
-      hash = "sha256-U2UEK+ZjSErzgQAkcoZwoLZ9m3pI10pcdz79M7BmBB4=";
+      hash = "sha256-T/55q7+P2rVGlH1s9sD99u/WV8TSP5K4sZYu7MOxRWQ=";
    };

  patchPhase = ''
@@ -10,16 +10,16 @@

 buildGoModule rec {
  pname = "karmor";
-  version = "1.4.4";
+  version = "1.4.5";

  src = fetchFromGitHub {
    owner = "kubearmor";
    repo = "kubearmor-client";
    rev = "v${version}";
-    hash = "sha256-BlMWbd+c/dW3nrG9mQn4lfyXvauJ4GCcJypp+SMfAuY=";
+    hash = "sha256-coZYcLhY9KW1LsjRP7nJkjWW7lXZBO5Asgx0nSaVG9M=";
  };

-  vendorHash = "sha256-SZAJsstFUtZi+/sSkgmvFSjd4115YKsPuPEksWxE9D0=";
+  vendorHash = "sha256-FL5WL44dsM0uPYXMNfYKRd37umId21rMGvj84rYTU3A=";

  nativeBuildInputs = [ installShellFiles ];

@@ -6,13 +6,13 @@

 buildGoModule rec {
  pname = "kbld";
-  version = "0.46.0";
+  version = "0.47.0";

  src = fetchFromGitHub {
    owner = "carvel-dev";
    repo = "kbld";
    rev = "v${version}";
-    hash = "sha256-3QLvUvm1OBLGS8ucFEDDLVupwof8ToG0RBJpUPtqThE=";
+    hash = "sha256-ZYxfWgqqU9uLsSUhayDNYLkOjefXCnPs7+seUOy5swM=";
  };

  vendorHash = null;
@@ -8,16 +8,16 @@

 buildGoModule (finalAttrs: {
  pname = "kor";
-  version = "0.6.5";
+  version = "0.6.6";

  src = fetchFromGitHub {
    owner = "yonahd";
    repo = "kor";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-lHNRd3FmcVJduq0XA1r+FqRj0OVmNr22B4Hq/GrnHFs=";
+    hash = "sha256-eCWVMb5s9nArkW+mKzca/377qSH0k3NUcXyMOqtDUnM=";
  };

-  vendorHash = "sha256-bdnO4Rt0w0rV6/t5u0e0iwkYfbrtRfh6mIzyshT9wlQ=";
+  vendorHash = "sha256-ZTiFRBjLT1YHvw2yZAx3vFOvRPF237wbJABGIGr9LKc=";

  nativeCheckInputs = [ writableTmpDirAsHomeHook ];

@@ -8,13 +8,13 @@
 }:

 stdenv.mkDerivation rec {
-  version = "4.2.0";
+  version = "4.3.0";
  pname = "libre";
  src = fetchFromGitHub {
    owner = "baresip";
    repo = "re";
    rev = "v${version}";
-    sha256 = "sha256-BMaDkEpOnL1w8+SsPtX3SJPOmdLTURZPX/f1KMz1jhI=";
+    sha256 = "sha256-IOC6TRgxScLBCarECuUAfRoRweh5Q22JKsOUu9l7zWI=";
  };

  buildInputs = [
@@ -21,14 +21,14 @@ rustPlatform.buildRustPackage rec {
  pname = "libsignal-ffi";
  # must match the version used in mautrix-signal
  # see https://github.com/mautrix/signal/issues/401
-  version = "0.84.0";
+  version = "0.86.4";

  src = fetchFromGitHub {
    fetchSubmodules = true;
    owner = "signalapp";
    repo = "libsignal";
    tag = "v${version}";
-    hash = "sha256-fTXiNgto1m6PlGQQuBUPaWkS5fHTVunCn3eGKjmQlHM=";
+    hash = "sha256-f2f2AY4PYs+HcaordHAIXHhvyfgZ9D3GrfW5wC06/h4=";
  };

  nativeBuildInputs = [
@@ -40,7 +40,7 @@ rustPlatform.buildRustPackage rec {
  env.BORING_BSSL_PATH = "${boringssl-wrapper}";
  env.NIX_LDFLAGS = if stdenv.hostPlatform.isDarwin then "-lc++" else "-lstdc++";

-  cargoHash = "sha256-qnj9bVnnS76Sk9DfMprJn2xrc2G30yVXz3fTjjY3gnA=";
+  cargoHash = "sha256-JKFO/+t++3WEsqnCEsI/S4wpNUFiCIIudiRbjrT/i6k=";

  cargoBuildFlags = [
    "-p"
@@ -14,14 +14,14 @@

 python3Packages.buildPythonApplication rec {
  pname = "matrix-synapse";
-  version = "1.142.0";
+  version = "1.142.1";
  format = "pyproject";

  src = fetchFromGitHub {
    owner = "element-hq";
    repo = "synapse";
    rev = "v${version}";
-    hash = "sha256-op5h8BpQjntA0dFp4MuT/BZmVjZ8TJ2dqijLmvXXfI4=";
+    hash = "sha256-U/o7Ld9MjVO/QIIy+UyltfieR4CAdfN6dR6WWINoW40=";
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
@@ -20,14 +20,14 @@ let
 in
 buildGoModule rec {
  pname = "mautrix-signal";
-  version = "25.10";
-  tag = "v0.2510.0";
+  version = "25.11";
+  tag = "v0.2511.0";

  src = fetchFromGitHub {
    owner = "mautrix";
    repo = "signal";
-    tag = tag;
-    hash = "sha256-Bz4jBI/lLhCxZW7JmaX6dlVwbB3dLXn5v/8gMKcFKSE=";
+    inherit tag;
+    hash = "sha256-ynHJcVoSDFOulIE5Z5qmLGgmqGYtcAc2r+NhJ+THdHU=";
  };

  buildInputs =
@@ -44,7 +44,7 @@ buildGoModule rec {

  CGO_LDFLAGS = lib.optional withGoolm [ cppStdLib ];

-  vendorHash = "sha256-Sur29i5ih7xK85maVAaq9cwWJVGtwS7hPOxQI4YduNI=";
+  vendorHash = "sha256-oz/rCeA/UgwmIZhHxbcty5XWiIecBmHs1M1lavugZ24=";

  ldflags = [
    "-X"
@@ -14,20 +14,20 @@

 buildGoModule rec {
  pname = "mautrix-whatsapp";
-  version = "25.10";
-  tag = "v0.2510.0";
+  version = "25.11";
+  tag = "v0.2511.0";

  src = fetchFromGitHub {
    owner = "mautrix";
    repo = "whatsapp";
-    tag = tag;
-    hash = "sha256-jJIVlK4vTJpwjugKNtWZhO31t7YX+q3W+ZmU1w/itvM=";
+    inherit tag;
+    hash = "sha256-0Jpod9/mZ9eGFvPxki6Yz0KL1XQ4HTtZ7Zv7WvamuC0=";
  };

  buildInputs = lib.optional (!withGoolm) olm;
  tags = lib.optional withGoolm "goolm";

-  vendorHash = "sha256-LvGapdyGYXNUsC0qniwdoA3pUrOivfFq+nEilw5xFNM=";
+  vendorHash = "sha256-n25j2uM3e5/5PYs2jwH+iclaU/p/MhctCAhPninz2HI=";

  doCheck = false;

@@ -16,13 +16,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "media-downloader";
-  version = "5.4.4";
+  version = "5.4.6";

  src = fetchFromGitHub {
    owner = "mhogomchungu";
    repo = "media-downloader";
    rev = finalAttrs.version;
-    hash = "sha256-MZAzL9ORsuBid/nM0y3eibhyxfewfc7c18TGb82lKfo=";
+    hash = "sha256-2VcxNoC/9dVYItDJdWxuXFtl31p8kKCnbmAWfYFBGwQ=";
  };

  nativeBuildInputs = [
@@ -11,13 +11,13 @@ let
 in
 flutter.buildFlutterApplication rec {
  pname = "mhabit";
-  version = "1.21.0+118";
+  version = "1.21.1+120";

  src = fetchFromGitHub {
    owner = "FriesI23";
    repo = "mhabit";
    tag = "v${version}";
-    hash = "sha256-ZVuDOLGiigj4fa1kxIJ+vb3OZmrl22YMTvhZ5y7NGyI=";
+    hash = "sha256-ym+xCv7fRwlms2oIvcthyuz53T0LCgigleg1qmLfZVU=";
  };

  pubspecLock = lib.importJSON ./pubspec.lock.json;
@@ -0,0 +1,37 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "modest";
+  version = "0-unstable-2021-08-03";
+
+  src = fetchFromGitHub {
+    owner = "lexborisov";
+    repo = "modest";
+    rev = "2540a03259fc62fe15f47e85c20b2eedd5af66de";
+    hash = "sha256-o3asVErtc9CYRb3ZZFE5DYyT/Pjr7TZ79BLPnh6CCT0=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+  ];
+
+  env.NIX_CFLAGS_COMPILE = toString (
+    lib.optionals stdenv.hostPlatform.isDarwin [
+      "-Wno-void-pointer-to-enum-cast"
+      "-Wno-unused-but-set-variable"
+    ]
+  );
+
+  meta = {
+    description = "Fast HTML renderer implemented as a pure C99 library with no outside dependencies";
+    homepage = "https://github.com/lexborisov/Modest";
+    license = lib.licenses.lgpl21;
+    maintainers = [ lib.maintainers.drupol ];
+    platforms = lib.platforms.all;
+  };
+})
@@ -106,6 +106,8 @@ stdenv.mkDerivation rec {
    "--with-systemdshutdowndir=$(out)/lib/systemd/system-shutdown"
    "--with-systemdtmpfilesdir=$(out)/lib/tmpfiles.d"
    "--with-udev-dir=$(out)/etc/udev"
+    "--with-user=nutmon"
+    "--with-group=nutmon"
  ]
  ++ (lib.lists.optionals withApcModbus [
    "--with-modbus+usb"
@@ -9,13 +9,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "primecount";
-  version = "7.19";
+  version = "7.20";

  src = fetchFromGitHub {
    owner = "kimwalisch";
    repo = "primecount";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-prPNAmMSiZD1EbMyPSD6OmjFn/NQ7ULVxBM1AjCYWPo=";
+    hash = "sha256-rM+c1CDD75bRqvUMI8Ej02nSqkweR8+E4Wpag7mJcM4=";
  };

  outputs = [
@@ -9,13 +9,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "primesieve";
-  version = "12.9";
+  version = "12.10";

  src = fetchFromGitHub {
    owner = "kimwalisch";
    repo = "primesieve";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-xEGpMQ6kxby3nq3RBv6s6ZrTwC9KRKr3II1VQHGaAXk=";
+    hash = "sha256-7aXNpVKOfsQHvHJbR100QF6TSglPv5kcq22YTX2GkG4=";
  };

  outputs = [
@@ -21,13 +21,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "qbittorrent" + lib.optionalString (!guiSupport) "-nox";
-  version = "5.1.3";
+  version = "5.1.4";

  src = fetchFromGitHub {
    owner = "qbittorrent";
    repo = "qBittorrent";
    rev = "release-${finalAttrs.version}";
-    hash = "sha256-RIItbrpkMFglO2NwbgpBhgBSk5+vdywatGVwnbWkNVQ=";
+    hash = "sha256-9RfKir/e+8Kvln20F+paXqtWzC3KVef2kNGyk1YpSv4=";
  };

  nativeBuildInputs = [
@@ -10,13 +10,13 @@

 buildGoModule (finalAttrs: {
  pname = "qovery-cli";
-  version = "1.54.0";
+  version = "1.54.1";

  src = fetchFromGitHub {
    owner = "Qovery";
    repo = "qovery-cli";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-6z5s6bVzPYUHI3rBEddQT933Lj+hbcBK+safi5pHVO4=";
+    hash = "sha256-JuOnJ9+dcf/QSm96FmDgeS+6TwbyKPwvgBjOfZV8r+U=";
  };

  vendorHash = "sha256-1TprPzZb+Q9QcoGop6CAmnyqSU3dQ5CSAS0hsnQeWPw=";
@@ -1,11 +1,11 @@
 {
  autoreconfHook,
  fetchFromGitHub,
-  fetchpatch,
  lib,
  libtraceevent,
  nix-update-script,
  nixosTests,
+  pciutils,
  perl,
  pkg-config,
  sqlite,
@@ -17,24 +17,15 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "rasdaemon";
-  version = "0.8.3";
+  version = "0.8.4";

  src = fetchFromGitHub {
    owner = "mchehab";
    repo = "rasdaemon";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-SpMNkeJkjaWteWsIScRnzNILf+PtVu1sX9e6ctwm3G0=";
+    hash = "sha256-rk4CZrWQRe2wsx8/eXP0BIeaU/Gxmcb+Kry5F8t4YKQ=";
  };

-  patches = [
-    # https://github.com/mchehab/rasdaemon/pull/212
-    (fetchpatch {
-      name = "fix_buffer_overflow_in_add_event_handler_read.patch";
-      url = "https://github.com/mchehab/rasdaemon/commit/46bed1b6845bcb560d760b4cacea7df67cd6d1fd.patch";
-      hash = "sha256-5T5U2i0i/7MpHzqpPq6mn2ghSUj9O6BzY11VcySgCMo=";
-    })
-  ];
-
  strictDeps = true;

  enableParallelBuilding = true;
@@ -51,6 +42,7 @@ stdenv.mkDerivation (finalAttrs: {
        DBDSQLite
      ]
    ))
+    pciutils
    sqlite
  ]
  ++ lib.optionals enableDmidecode [
@@ -7,12 +7,12 @@
  stdenv,
 }:
 let
-  version = "25.2.11";
+  version = "25.3.1";
  src = fetchFromGitHub {
    owner = "redpanda-data";
    repo = "redpanda";
    rev = "v${version}";
-    sha256 = "sha256-MOfQ/7aCbC5zdEB+hyIAgbRLfpSdSIjKigfUPTSqqr8=";
+    sha256 = "sha256-/TodUIBsby4ewoyU72/5jHoBDoFHsSHqjJI7vtBlELU=";
  };
 in
 buildGoModule rec {
@@ -20,7 +20,7 @@ buildGoModule rec {
  inherit doCheck src version;
  modRoot = "./src/go/rpk";
  runVend = false;
-  vendorHash = "sha256-N9RZ5qRbh8B0g+A3UUutOnAeob0eR2jO9kmrlADT0iQ=";
+  vendorHash = "sha256-6iyHM7SWqorjjebmZEJKzUU1w0waTywAY//UcfikdAo=";

  ldflags = [
    ''-X "github.com/redpanda-data/redpanda/src/go/rpk/pkg/cli/cmd/version.version=${version}"''
@@ -9,16 +9,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "riffdiff";
-  version = "3.6.0";
+  version = "3.6.1";

  src = fetchFromGitHub {
    owner = "walles";
    repo = "riff";
    tag = version;
-    hash = "sha256-WpVj/sgvvdNweZ+exxoSc4rtDmuRvaIdkwKk+eu46Ok=";
+    hash = "sha256-2C1aD9sXh/+spNxbLbw13WAJ6ijdYqkWgPbKrw3zTm0=";
  };

-  cargoHash = "sha256-YJnqeuj4XvOnGJ9RcNBtfy1duYUu/u6ed47bAndLm30=";
+  cargoHash = "sha256-Jg9c7tSjluhHSl2GoZkZlkBs+ojCGjjQ3dheROUC60g=";

  passthru = {
    tests.version = testers.testVersion { package = riffdiff; };
@@ -6,13 +6,13 @@

 buildGoModule rec {
  pname = "runpodctl";
-  version = "1.14.11";
+  version = "1.14.12";

  src = fetchFromGitHub {
    owner = "runpod";
    repo = "runpodctl";
    rev = "v${version}";
-    hash = "sha256-RXI1NAdEg5QypRDXg0NCpHLDrxcRCCS22KGnZyotXrI=";
+    hash = "sha256-T0JFPoaH6UhgPMzo+491EUBmjgko1WXP1erMGKc3N5w=";
  };

  vendorHash = "sha256-SaaHVaN2r3DhUk7sVizhRggYZRujd+e8qbpq0xOVD88=";
@@ -8,16 +8,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "rust-motd";
-  version = "2.1.0";
+  version = "2.1.1";

  src = fetchFromGitHub {
    owner = "rust-motd";
    repo = "rust-motd";
    rev = "v${version}";
-    hash = "sha256-06iWk0VobdHP94eNaEyQnIBx5YkoW0/IQQtUFWTkEe0=";
+    hash = "sha256-8XuOleWJxNKXkFK330e2a4hGTCOx83kMgya2EPojqVQ=";
  };

-  cargoHash = "sha256-f+441tEy1+AWXsz2Byrg0+Tz8jHcC1SD9WNZlkgWGZ4=";
+  cargoHash = "sha256-el+7lzX28lxclwfq0ulehtZ5+Gv4ISHxPt1DXqwDBzc=";

  nativeBuildInputs = [
    pkg-config
@@ -13,11 +13,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "saw-tools";
-  version = "1.3";
+  version = "1.4";

  src = fetchurl {
    url = "https://github.com/GaloisInc/saw-script/releases/download/v${finalAttrs.version}/saw-${finalAttrs.version}-ubuntu-22.04-X64-with-solvers.tar.gz";
-    hash = "sha256-1t1uGAQXCBC//RNBxQfZIfg00At600An9HaEIcVBEy0=";
+    hash = "sha256-AjMGOi0Nzl0cjVltjgbqhzBiPpIZbDtS3+SqergeulE=";
  };

  buildInputs = [
@@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "seqkit";
-  version = "2.10.1";
+  version = "2.11.0";

  src = fetchFromGitHub {
    owner = "shenwei356";
    repo = "seqkit";
    rev = "v${version}";
-    sha256 = "sha256-rWmz9dPGCLY2d7aifRrz/GDiFTcc49+eB1xJLxs+Fyc=";
+    sha256 = "sha256-8AffU5u7Pw3WX+MaLioPKVwg3WnTLjHcY6Yvo5lrHwk=";
  };

-  vendorHash = "sha256-v8aAY6MQS8jsyd7eVm5liAG5ChPELNKu4b8U/3y6bL4=";
+  vendorHash = "sha256-TsL7iYZoxCGR2gl2YlNCnmssVui8TLKN8JTtLAzgvH4=";

  meta = with lib; {
    description = "Cross-platform and ultrafast toolkit for FASTA/Q file manipulation";
@@ -9,13 +9,13 @@

 rustPlatform.buildRustPackage rec {
  pname = "shpool";
-  version = "0.9.2";
+  version = "0.9.3";

  src = fetchFromGitHub {
    owner = "shell-pool";
    repo = "shpool";
    rev = "v${version}";
-    hash = "sha256-T7Ij8rxlF5AAEgVzT+C+X8sX0ebhY19NSFm3DB6LnXs=";
+    hash = "sha256-Ul1CENx1KVU2jnMNfxz3R6loBvFIcAUp6japxaK7wGU=";
  };

  postPatch = ''
@@ -23,7 +23,7 @@ rustPlatform.buildRustPackage rec {
      --replace-fail '/usr/bin/shpool' "$out/bin/shpool"
  '';

-  cargoHash = "sha256-uOz2yswKMrhtBqPRjlu9AIcR68jfIaWrXwtBeMb/GW0=";
+  cargoHash = "sha256-Year32ZIzikeC2QhqTufQhcbNM8VZUq2hfAimpUDI5w=";

  buildInputs = [
    linux-pam
@@ -6,11 +6,11 @@

 stdenvNoCC.mkDerivation rec {
  pname = "sudo-font";
-  version = "3.3";
+  version = "3.4";

  src = fetchzip {
    url = "https://github.com/jenskutilek/sudo-font/releases/download/v${version}/sudo.zip";
-    hash = "sha256-Y4+bRIXzN40RIij9mQT0GqONi7aMi13rhl5zd2f+7Uk=";
+    hash = "sha256-sSLY94wY9+AYAqWDq+Xy+KctUfJVS0jeS3baF8mLO9I=";
  };

  installPhase = ''
@@ -10,16 +10,16 @@

 buildGoModule rec {
  pname = "tenv";
-  version = "4.7.21";
+  version = "4.8.3";

  src = fetchFromGitHub {
    owner = "tofuutils";
    repo = "tenv";
    tag = "v${version}";
-    hash = "sha256-u7Whu2Y9MAGmEOnQECb0B/VMW6ZCflAANQxan+CrnAw=";
+    hash = "sha256-p0LaTj+hGZapvJR5IU0hwaeUjyBwEsvOXQhvA+NXHkw=";
  };

-  vendorHash = "sha256-Jt0GDrYay6ZbMsayO5BFO2psK6BHwL/4AyEi8SqxZ4E=";
+  vendorHash = "sha256-BZjS9A6j0S1Q1Aq0BeHXT8jiO4gZG4t3xySF4VtTsS4=";

  excludedPackages = [ "tools" ];

@@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "tfupdate";
-  version = "0.9.2";
+  version = "0.9.3";

  src = fetchFromGitHub {
    owner = "minamijoyo";
    repo = "tfupdate";
    rev = "v${version}";
-    sha256 = "sha256-izxvvR/wVNQlDWxJhUSAq2q0U0Y7fcFflEZRS2sfEIY=";
+    sha256 = "sha256-Df6imS3JCtMOMCNJd/3cFqK5JsGpIkF/yab7B7YgILI=";
  };

-  vendorHash = "sha256-gmIh1xlOXLASzY9E5phS48Bdj1agH5LdUUW0p/g4I5w=";
+  vendorHash = "sha256-0odAvB2VqYZnPu4wlXpPeR2ioEq3WOGyvpRm72/GWsg=";

  # Tests start http servers which need to bind to local addresses:
  # panic: httptest: failed to listen on a port: listen tcp6 [::1]:0: bind: operation not permitted
@@ -0,0 +1,49 @@
+{
+  lib,
+  fetchFromGitHub,
+  python3Packages,
+  mame-tools,
+  p7zip,
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "tochd";
+  version = "0.13-unstable-2024-06-08";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "thingsiplay";
+    repo = "tochd";
+    rev = "eea871b51cd4962d23a6426194f6f524e864c0ac";
+    hash = "sha256-lpDROCiXyfM4OdXBNGkEhD3T2c8aS8QyF7etHC5tQ8M=";
+  };
+
+  build-system = with python3Packages; [
+    setuptools
+  ];
+
+  makeWrapperArgs = [
+    "--prefix PATH : ${
+      lib.makeBinPath [
+        mame-tools
+        p7zip
+      ]
+    }"
+  ];
+
+  postInstall = ''
+    mv $out/bin/tochd.py $out/bin/tochd
+    install -Dm644 README.md -t $out/share/doc/tochd
+    install -Dm644 LICENSE -t $out/share/licenses/tochd
+  '';
+
+  meta = {
+    description = "Convert game ISO and archives to CD/DVD CHD";
+    homepage = "https://github.com/thingsiplay/tochd";
+    changelog = "https://github.com/thingsiplay/tochd/blob/${src.rev}/CHANGES.md";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [ keenanweaver ];
+    mainProgram = "tochd";
+  };
+}
@@ -16,13 +16,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "typescript-language-server";
-  version = "5.1.1";
+  version = "5.1.2";

  src = fetchFromGitHub {
    owner = "typescript-language-server";
    repo = "typescript-language-server";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-wYpW/HHuMetxnwEgGeQ8ptT6Kd5wp2kqUXnjWSkoDQY=";
+    hash = "sha256-8UDPeW8Bb6Or+G28GI+fprUtqnDGKTqeWskpn9i0HCA=";
  };

  patches = [
@@ -6,12 +6,12 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "unrar";
-  version = "7.2.1";
+  version = "7.2.2";

  src = fetchzip {
    url = "https://www.rarlab.com/rar/unrarsrc-${finalAttrs.version}.tar.gz";
    stripRoot = false;
-    hash = "sha256-er4F+TUFZ7Iv48PbV5FT371CPQ93Zorc5fCxfqGmij0=";
+    hash = "sha256-qRGaj2NL8uKq2O8t99odcfmiu2VamF409p4v5Wh29oM=";
  };

  sourceRoot = finalAttrs.src.name;
@@ -9,16 +9,16 @@

 buildGo125Module (finalAttrs: {
  pname = "upcloud-cli";
-  version = "3.24.1";
+  version = "3.25.0";

  src = fetchFromGitHub {
    owner = "UpCloudLtd";
    repo = "upcloud-cli";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-D9IF3yS0c4QxLbEE1ix8ann69Bhsbs24W79crVe//XI=";
+    hash = "sha256-uxlFqXLjZ62CYpR/NRj2MG0MlSwa58P3MfG49/zQ1TI=";
  };

-  vendorHash = "sha256-biRfhrlCI1JvXx9739yNlYXPgTaBslZ7OSleWLAaOzA=";
+  vendorHash = "sha256-WQf+ZZH+pKK3zeDRlKyriLIcHKZXdFdCU/K9LvFgT3k=";

  ldflags = [
    "-s -w -X github.com/UpCloudLtd/upcloud-cli/v3/internal/config.Version=${finalAttrs.version}"
@@ -23,20 +23,23 @@
  pipewire,
  pulseaudio,
  tinysparql,
+  nix-update-script,
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "valent";
-  version = "1.0.0.alpha.48";
+  version = "1.0.0.alpha.49";

  src = fetchFromGitHub {
    owner = "andyholmes";
    repo = "valent";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-CB3Jb7N8vcNTLCWXKoDh/wQkPW1CH6WRlwXg4efU3GY=";
+    hash = "sha256-dVV/rqd3DktI67DPo0qTs3VP7yZIAy7Ew5TSYsE6ZTA=";
    fetchSubmodules = true;
  };

+  strictDeps = true;
+
  nativeBuildInputs = [
    desktop-file-utils
    gobject-introspection
@@ -69,6 +72,8 @@ stdenv.mkDerivation (finalAttrs: {
    (lib.mesonBool "plugin_bluez" true)
  ];

+  passthru.updateScript = nix-update-script { };
+
  meta = {
    description = "Implementation of the KDE Connect protocol, built on GNOME platform libraries";
    mainProgram = "valent";
@@ -90,7 +95,7 @@ stdenv.mkDerivation (finalAttrs: {
      ```
    '';
    homepage = "https://valent.andyholmes.ca";
-    changelog = "https://github.com/andyholmes/valent/blob/${finalAttrs.src.rev}/CHANGELOG.md";
+    changelog = "https://github.com/andyholmes/valent/blob/${finalAttrs.src.tag}/CHANGELOG.md";
    license = with lib.licenses; [
      gpl3Plus
      cc0
@@ -9,7 +9,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "visual-paradigm-ce";
-  version = "17.3.20251156";
+  version = "17.3.20251162";

  src =
    let
@@ -21,7 +21,7 @@ stdenv.mkDerivation (finalAttrs: {
      url = "https://eu10-dl.visual-paradigm.com/visual-paradigm/vpce${majorMinor}/${suffix}/Visual_Paradigm_CE_${
        builtins.replaceStrings [ "." ] [ "_" ] majorMinor
      }_${suffix}_Linux64_InstallFree.tar.gz";
-      hash = "sha256-ow5Phzw4mK/sWR/42eoqPjWX0gL9OiovzLrnqrYVGuk=";
+      hash = "sha256-Af1aYb00OOsPP0vRqExr40GcvZQv5OZ2LJye8HOof1U=";
    };

  nativeBuildInputs = [
@@ -9,19 +9,19 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "vue-language-server";
-  version = "3.1.3";
+  version = "3.1.4";

  src = fetchFromGitHub {
    owner = "vuejs";
    repo = "language-tools";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-bzVqlO6Q3pgw9Kor6agpAlqyp3nj96+7f8j2nOzyEZ0=";
+    hash = "sha256-E5YnfYDK3TOQ7ViCpCFXtJVWgyG95NhDTBSbUPgTMAg=";
  };

  pnpmDeps = pnpm.fetchDeps {
    inherit (finalAttrs) pname version src;
    fetcherVersion = 1;
-    hash = "sha256-VcQbzvPa5FL8OH4Sk0j64M9D4Si/N4rm9nvIAN/xODs=";
+    hash = "sha256-urnzAHrhuqw/7UwryNnR/BCMyxbzGXKUx0PQ+oAd27o=";
  };

  nativeBuildInputs = [
@@ -10,11 +10,11 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "wiremock";
-  version = "3.13.1";
+  version = "3.13.2";

  src = fetchurl {
    url = "mirror://maven/org/wiremock/wiremock-standalone/${finalAttrs.version}/wiremock-standalone-${finalAttrs.version}.jar";
-    hash = "sha256-vfTHBef9Ycd45ZoZ91OW6sRSDv6r+sl2Q6U5eb1NVxY=";
+    hash = "sha256-0Jexm9SDxQOEebE6XHHp+vjy9RBlhPDBIKd3CrC9s2c=";
  };

  dontUnpack = true;
@@ -13,18 +13,20 @@
  libebur128,
  python3,
  yyjson,
+  discord-rpc,
  nix-update-script,
+  withDiscordRpc ? true,
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "woof-doom";
-  version = "15.2.0";
+  version = "15.3.0";

  src = fetchFromGitHub {
    owner = "fabiangreffrath";
    repo = "woof";
-    rev = "woof_${finalAttrs.version}";
-    hash = "sha256-U1JxdWKSIbIbPMipnjY2SJ5lOP9AFMLNjyplK0mFhxE=";
+    tag = "woof_${finalAttrs.version}";
+    hash = "sha256-G9exAJivfZnT2eWQhFYT8ZVRUU1QT0VAZF1CDCXmJ04=";
  };

  nativeBuildInputs = [
@@ -35,24 +37,33 @@ stdenv.mkDerivation (finalAttrs: {
  buildInputs = [
    SDL2
    SDL2_net
-    alsa-lib
    fluidsynth
    libsndfile
    libxmp
    libebur128
    openal
    yyjson
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [
+    alsa-lib
+  ]
+  ++ lib.optional withDiscordRpc discord-rpc;
+
+  strictDeps = true;
+
+  cmakeFlags = [
+    (lib.cmakeBool "WITH_DISCORD_RPC" withDiscordRpc)
  ];

  passthru.updateScript = nix-update-script { };

  meta = {
-    description = "Woof! is a continuation of the Boom/MBF bloodline of Doom source ports";
+    description = "Doom source port based on Boom/MBF";
    homepage = "https://github.com/fabiangreffrath/woof";
    changelog = "https://github.com/fabiangreffrath/woof/blob/${finalAttrs.src.rev}/CHANGELOG.md";
    license = lib.licenses.gpl2Only;
    maintainers = with lib.maintainers; [ keenanweaver ];
    mainProgram = "woof";
-    platforms = with lib.platforms; darwin ++ linux ++ windows;
+    platforms = lib.platforms.unix;
  };
 })
@@ -9,14 +9,14 @@

 buildPythonPackage rec {
  pname = "billiard";
-  version = "4.2.2";
+  version = "4.2.3";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "celery";
    repo = "billiard";
    tag = "v${version}";
-    hash = "sha256-KUA1ydRoDIALhapDPG4c0C4q0Z72MReHeFCqqGviCNw=";
+    hash = "sha256-Zogy5O/bHymkKMn5zeTltNq/1c1fT7s/YFIDA53dr40=";
  };

  build-system = [ setuptools ];
@@ -358,13 +358,13 @@

 buildPythonPackage rec {
  pname = "boto3-stubs";
-  version = "1.40.75";
+  version = "1.41.0";
  pyproject = true;

  src = fetchPypi {
    pname = "boto3_stubs";
    inherit version;
-    hash = "sha256-W7qRetSy2QWmrkzwesXoK90GgVolt0rsc46RFb122KM=";
+    hash = "sha256-dNE48tL19IFAvoHWgHIrAZTgm8340ggKkUwh0nfCz+M=";
  };

  build-system = [ setuptools ];
@@ -9,13 +9,13 @@

 buildPythonPackage rec {
  pname = "botocore-stubs";
-  version = "1.40.75";
+  version = "1.40.76";
  pyproject = true;

  src = fetchPypi {
    pname = "botocore_stubs";
    inherit version;
-    hash = "sha256-Lok+HCZcSvbaNp2JGMmVeuY4dbhzXNRevIJNX+3Wr9U=";
+    hash = "sha256-Jh1R5xoWSpOr+calx3nFZk0wfsRFDekXrZy+fCl4IiM=";
  };

  nativeBuildInputs = [ setuptools ];
@@ -12,13 +12,13 @@

 buildPythonPackage rec {
  pname = "entsoe-apy";
-  version = "0.5.1";
+  version = "0.6.1";

  src = fetchFromGitHub {
    owner = "berrij";
    repo = "entsoe-apy";
    tag = "v${version}";
-    hash = "sha256-aOZsD8Cio7TjYHnUlgfgVWLB2+AnDw1J2fTcD8PFioE=";
+    hash = "sha256-pjn4S5jrocLLi0Hc5TmteQiNkGBW6ZcT4VzBymXqv+8=";
  };

  pyproject = true;
@@ -57,6 +57,11 @@ buildPythonPackage rec {
    pytestCheckHook
  ];

+  pytestFlags = [
+    # DeprecationWarning: The default axis_types will change in JAX v0.9.0 to jax.sharding.AxisType.Explicit.
+    "-Wignore::DeprecationWarning"
+  ];
+
  disabledTests = [
    # Failed: DID NOT WARN. No warnings of type (<class 'Warning'>,) were emitted.
    "test_jax_transform_warn"
@@ -20,19 +20,19 @@

 buildPythonPackage rec {
  pname = "fastexcel";
-  version = "0.17.1";
+  version = "0.17.2";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "ToucanToco";
    repo = "fastexcel";
    tag = "v${version}";
-    hash = "sha256-FCI1pMCYN1f5hEg7PxF72uPPIJ5WiQPISF+YFj7+K60=";
+    hash = "sha256-MwwcxCnBDN5bK+Yv4LTdGCEFA/QbFE3tI9nN3dx1rrY=";
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
    inherit pname version src;
-    hash = "sha256-9Xr4woj7TU03AZaebpdlo1U2s0q/ls2fPmSKccpoZq0=";
+    hash = "sha256-X8qBIFCFq+7t5EtskVej+RcX1Egl2iGo4Ntqe3JsQvU=";
  };

  nativeBuildInputs = [
@@ -17,7 +17,7 @@

 let
  pname = "findpython";
-  version = "0.7.0";
+  version = "0.7.1";
 in
 buildPythonPackage {
  inherit pname version;
@@ -25,7 +25,7 @@ buildPythonPackage {

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-izFkfHY1J3mjwaCAZpm2jmp73AtcLd2a8qB6DUDGc9w=";
+    hash = "sha256-nynmo9q9t18rOclJdywO0m6rFTCABmafNHjNqw2GfHg=";
  };

  build-system = [ pdm-backend ];
@@ -15,7 +15,7 @@

 buildPythonPackage rec {
  pname = "geoalchemy2";
-  version = "0.18.0";
+  version = "0.18.1";
  pyproject = true;

  disabled = pythonOlder "3.7";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
    owner = "geoalchemy";
    repo = "geoalchemy2";
    tag = version;
-    hash = "sha256-xQxry/JJTkhsailk12lhu1SkpLlx0By/D35VSw+S/4M=";
+    hash = "sha256-F/+POYOb7PoUwLnQpM00zAPpbSXNeWJF2TZ4y260Pzw=";
  };

  build-system = [
@@ -8,14 +8,14 @@

 buildPythonPackage rec {
  pname = "iamdata";
-  version = "0.1.202511191";
+  version = "0.1.202511201";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "cloud-copilot";
    repo = "iam-data-python";
    tag = "v${version}";
-    hash = "sha256-xEMElAH0jcPDKiaNOXlq8l632wWT99uDnUQzRp4ahIs=";
+    hash = "sha256-fSttA/OKKiOk6V6wr/LZisIuDFkzoJm3zZRJiTfNHjs=";
  };

  __darwinAllowLocalNetworking = true;
@@ -50,8 +50,8 @@ buildPythonPackage rec {
      .${stdenv.hostPlatform.system};
    hash =
      {
-        x86_64-linux = "sha256-npnD5Ub2vgD/xqTt0s9bdtTFmqNKjYOW2COauP2Ov9M=";
-        aarch64-linux = "sha256-UAu8W9mrvcyyOP4TgbkAzVdyZFANFHA1H2jl29tSNcI=";
+        x86_64-linux = "sha256-RStw7hDLmsXX38pV/7zbibbIvGunCkWvfEkNHc6pjrc=";
+        aarch64-linux = "sha256-pjHQaJkDNUr9ez0uxZW32gamIwp22gD/lUj1QrIbYlA=";
      }
      .${stdenv.hostPlatform.system};
  };
@@ -39,32 +39,32 @@ let
    "3.11-x86_64-linux" = getSrcFromPypi {
      platform = "manylinux_2_27_x86_64";
      dist = "cp311";
-      hash = "sha256-cL6wFZM7RyEDSBonUh1NtBz1kgCHBfRBLL86HsrzXC4=";
+      hash = "sha256-R5ykONVVAk2sjdEFg3Hvv49HmBmnCuohPz8wN+zpnXQ=";
    };
    "3.11-aarch64-linux" = getSrcFromPypi {
      platform = "manylinux_2_27_aarch64";
      dist = "cp311";
-      hash = "sha256-x+pdt1IZS4o/v0xWS7e7wk8k4HEJu1nmWf1LETFLunY=";
+      hash = "sha256-szg73AufYmDZrcTKDR9ovyQRWN/mnXJrJnsGgTgup6c=";
    };
    "3.12-x86_64-linux" = getSrcFromPypi {
      platform = "manylinux_2_27_x86_64";
      dist = "cp312";
-      hash = "sha256-VVbj9Iy+HfYI2dDTQAMIZJ3eyqjQ4kOUkMb4i0GAMcs=";
+      hash = "sha256-tgvwu9okzsb6cRcL1pthM1nwGjdtjgn+NL9n7MmjFk8=";
    };
    "3.12-aarch64-linux" = getSrcFromPypi {
      platform = "manylinux_2_27_aarch64";
      dist = "cp312";
-      hash = "sha256-SdBMFULqpAi3utAXASC82oMqAvuUT8iT3OiCbublpJM=";
+      hash = "sha256-OFAB9W+FKVnwYa4VrRV8OcxEccjR0lRN/D+AVoSsIhM=";
    };
    "3.13-x86_64-linux" = getSrcFromPypi {
      platform = "manylinux_2_27_x86_64";
      dist = "cp313";
-      hash = "sha256-Rw6W5+pNsPN1jabn0VxF6BAmYpJP46hHIV7mXKySxo0=";
+      hash = "sha256-c0LIgQzJR9548oxyh6MLLiAbD1FXhUPdJVNpK3mkmUI=";
    };
    "3.13-aarch64-linux" = getSrcFromPypi {
      platform = "manylinux_2_27_aarch64";
      dist = "cp313";
-      hash = "sha256-IGmVNdeaLM+X8SEGC2BAUzhvQRzLMMElxmtqWgJsiSE=";
+      hash = "sha256-2nwPLvHGl/mt5Rpxz60hHiv/JUB6aFXd3eNywBkPxGg=";
    };
  };
 in
@@ -41,7 +41,7 @@ let
 in
 buildPythonPackage rec {
  pname = "jax";
-  version = "0.8.0";
+  version = "0.8.1";
  pyproject = true;

  src = fetchFromGitHub {
@@ -49,7 +49,7 @@ buildPythonPackage rec {
    repo = "jax";
    # google/jax contains tags for jax and jaxlib. Only use jax tags!
    tag = "jax-v${version}";
-    hash = "sha256-Ilcp4WW65SyqrqDGBRdnB25m7OCbrsfdtxWvl0uTjNw=";
+    hash = "sha256-e1XqcecIl8TGOZmA1FuWg8uwVUvgSdp8uYltXm9cJpQ=";
  };

  patches = [
@@ -18,7 +18,7 @@
 }:

 let
-  version = "0.8.0";
+  version = "0.8.1";
  inherit (python) pythonVersion;

  # As of 2023-06-06, google/jax upstream is no longer publishing CPU-only wheels to their GCS bucket. Instead the
@@ -49,49 +49,49 @@ let
      "3.11-x86_64-linux" = getSrcFromPypi {
        platform = "manylinux_2_27_x86_64";
        dist = "cp311";
-        hash = "sha256-/1Pouvl49rfEB2IVr3jwupacrENO0vclZdh+OMI/AOc=";
+        hash = "sha256-IvSJ+1yL4Np75eSVehCTazdgoWlmj4slxdCcUcPvR/Y=";
      };
      "3.11-aarch64-linux" = getSrcFromPypi {
        platform = "manylinux_2_27_aarch64";
        dist = "cp311";
-        hash = "sha256-Qa693vZ6VVpt4XQnpOZs5gpSioFYR+Ldltq85Xn3rPg=";
+        hash = "sha256-/zK2Mg1ykTHvryKTmCW1LXWVfITDKvKwsb2zPPJ7p18=";
      };
      "3.11-aarch64-darwin" = getSrcFromPypi {
        platform = "macosx_11_0_arm64";
        dist = "cp311";
-        hash = "sha256-u2AqjCTGFMuMpu7tPnCnM9k5nGoviJAKAlJiPNZydrU=";
+        hash = "sha256-hlrdVhOYg0BfPxXJsN5qZKuPSqVJ3/GWty28hr5szB8=";
      };

      "3.12-x86_64-linux" = getSrcFromPypi {
        platform = "manylinux_2_27_x86_64";
        dist = "cp312";
-        hash = "sha256-LIZ1v4bjka/k+NhjCAvhoCTXNN/T3RN/eqjn8iCRrc0=";
+        hash = "sha256-r0kkGJ/FO2kjdxW1bry/xxu5HKFhhBQ9zvDUMMgXPeY=";
      };
      "3.12-aarch64-linux" = getSrcFromPypi {
        platform = "manylinux_2_27_aarch64";
        dist = "cp312";
-        hash = "sha256-2D/4zxsHApljnNpPhCdwf2kFHchCHln7tzMFUjk3Vw0=";
+        hash = "sha256-vtHpSujHwWvKRHbY1/WC8NGhAqTmnDqb0gaaDcQidKk=";
      };
      "3.12-aarch64-darwin" = getSrcFromPypi {
        platform = "macosx_11_0_arm64";
        dist = "cp312";
-        hash = "sha256-9gqsD2Tp5wpc7zQf4pJoRRhpVRTHGtAANndLvtX3MS4=";
+        hash = "sha256-iL3g9TXu6maJ4M1X1At2YNUgaslcfULglWKhCbljpJ8=";
      };

      "3.13-x86_64-linux" = getSrcFromPypi {
        platform = "manylinux_2_27_x86_64";
        dist = "cp313";
-        hash = "sha256-Zsb1dvVKY+0FL1xGm+9NtyP18FC4OewMQpVzARNBvVg=";
+        hash = "sha256-0kW9aieccspfeW34TN1k18nIq8S42JrfSs9FiY2rlYs=";
      };
      "3.13-aarch64-linux" = getSrcFromPypi {
        platform = "manylinux_2_27_aarch64";
        dist = "cp313";
-        hash = "sha256-s+rFA7kP/sxo8R+hIhM+7yxixTbbKOgB5DbX56m2e/g=";
+        hash = "sha256-vWl8FxrOHi6dbtkQp484WzxAlc7ikLAlWqWISPKs3qs=";
      };
      "3.13-aarch64-darwin" = getSrcFromPypi {
        platform = "macosx_11_0_arm64";
        dist = "cp313";
-        hash = "sha256-X88zpWOfjxZKRzqceKH6Cy4VrD/L7NbZaqD4i/Jeprs=";
+        hash = "sha256-oDSfboF53Il9M665DsZrSoBBMw+7uo0HHcYWfNInFTk=";
      };
    };
 in
@@ -4,7 +4,6 @@
  stdenv,

  # Build-time dependencies:
-  addDriverRunpath,
  autoAddDriverRunpath,
  bazel_7,
  binutils,
@@ -33,14 +33,14 @@

 buildPythonPackage rec {
  pname = "langchain-huggingface";
-  version = "1.0.0";
+  version = "1.0.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "langchain-ai";
    repo = "langchain";
    tag = "langchain-huggingface==${version}";
-    hash = "sha256-5ovHScT4bi4Ix7ejeyTjYxBvraoegtyIBojTdTBH5Js=";
+    hash = "sha256-SPWGPwOphT0ewgLYIhFdbNtzCI2wFhmsBlxYxNjswOY=";
  };

  sourceRoot = "${src.name}/libs/partners/huggingface";
@@ -9,12 +9,12 @@

 buildPythonPackage rec {
  pname = "pyexploitdb";
-  version = "0.2.103";
+  version = "0.3.1";
  pyproject = true;

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-UAR3S0Tpo1C6a8YcNjoncPWEklwCsSC+T8E5s5rgaw8=";
+    hash = "sha256-1qimRLU3kp2iVOOyCMJlc/E9zjgNvPMprRECuyQ8u68=";
  };

  build-system = [ setuptools ];
@@ -27,7 +27,7 @@ buildPythonPackage rec {
  # Module has no tests
  doCheck = false;

-  pythonImportsCheck = [ "pyExploitDb" ];
+  pythonImportsCheck = [ "pyexploitdb" ];

  meta = with lib; {
    description = "Library to fetch the most recent exploit-database";
@@ -18,7 +18,7 @@

 buildPythonPackage rec {
  pname = "pysmartthings";
-  version = "3.3.3";
+  version = "3.3.4";
  pyproject = true;

  disabled = pythonOlder "3.12";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
    owner = "andrewsayre";
    repo = "pysmartthings";
    tag = "v${version}";
-    hash = "sha256-1fvgQE7p5R+Bq1O6wSHpPSIQI7pQRUXF+tXcTNLZ2II=";
+    hash = "sha256-R9n17dI/8qe1DU7KGquMtGKRcLDeOQw9YVJs73an054=";
  };

  build-system = [ poetry-core ];
@@ -0,0 +1,46 @@
+{
+  stdenv,
+  lib,
+  replaceVars,
+  buildPythonPackage,
+  fetchPypi,
+  unrar,
+  pytestCheckHook,
+  setuptools,
+}:
+buildPythonPackage rec {
+  pname = "python-unrar";
+  version = "0.4";
+  pyproject = true;
+
+  src = fetchPypi {
+    pname = "unrar";
+    inherit version;
+    hash = "sha256-skRHpbkwJL5gDvglVmi6I6MPRRF2V3tpFVnqE1n30WQ=";
+  };
+
+  build-system = [
+    setuptools
+  ];
+
+  patches = [
+    (replaceVars ./use_nix_unrar_path.patch {
+      unrar_lib_path = "${unrar}/lib/libunrar${stdenv.hostPlatform.extensions.sharedLibrary}";
+    })
+  ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  doCheck = true;
+
+  pythonImportsCheck = [ "unrar" ];
+
+  meta = {
+    homepage = "http://github.com/matiasb/python-unrar";
+    changelog = "https://github.com/matiasb/python-unrar/releases/tag/v${version}";
+    description = "Wrapper for UnRAR library, plus a rarfile module on top of it";
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ DrymarchonShaun ];
+    platforms = lib.platforms.linux;
+  };
+}
@@ -0,0 +1,13 @@
+diff --git a/unrar/unrarlib.py b/unrar/unrarlib.py
+index 06df081..22c1dde 100644
+--- a/unrar/unrarlib.py
+++ b/unrar/unrarlib.py
+@@ -31,7 +31,7 @@ __all__ = ["RAROpenArchiveDataEx", "RARHeaderDataEx", "RAROpenArchiveEx",
+            "dostime_to_timetuple"]
+ 
+ 
+-lib_path = os.environ.get('UNRAR_LIB_PATH', None)
+lib_path = "@unrar_lib_path@"
+ 
+ # find and load unrar library
+ unrarlib = None
@@ -9,14 +9,14 @@

 buildPythonPackage rec {
  pname = "tencentcloud-sdk-python";
-  version = "3.0.1490";
+  version = "3.0.1491";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "TencentCloud";
    repo = "tencentcloud-sdk-python";
    tag = version;
-    hash = "sha256-T52nSw2XljtlcxFCDlvsnr9429Jwlbo2fQB0HibEIPY=";
+    hash = "sha256-ygO1D9l0RPWvzTOxuKx7Mc233pgHmY+nmphw82a2U/Y=";
  };

  build-system = [ setuptools ];
@@ -16,14 +16,14 @@

 buildPythonPackage rec {
  pname = "testcontainers";
-  version = "4.13.2";
+  version = "4.13.3";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "testcontainers";
    repo = "testcontainers-python";
    tag = "testcontainers-v${version}";
-    hash = "sha256-S2k+zRNxQJcgVdZcU4TM2JHFJ+UflpXt6r6ooYxyOXo=";
+    hash = "sha256-/lIjrJO+Mw0gv0Ym98A4TrISvmKkCKLFeoJu6t9q9kE=";
  };

  postPatch = ''
@@ -1,7 +1,7 @@
 {
  lib,
  buildPythonPackage,
-  fetchFromGitHub,
+  fetchPypi,

  # build-system
  setuptools,
@@ -35,11 +35,12 @@ buildPythonPackage rec {
  version = "7.2";
  pyproject = true;

-  src = fetchFromGitHub {
-    owner = "wagtail";
-    repo = "wagtail";
-    tag = "v${version}";
-    hash = "sha256-o/4jn32ffR3BPVNwtFKJ6PowXYi7SpjBqghdeZIl5tM=";
+  # The GitHub source requires some assets to be compiled, which in turn
+  # requires fixing the upstream package lock. We need to use the PyPI release
+  # until https://github.com/wagtail/wagtail/pull/13136 gets merged.
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-ijnfkIvWSrAp4IvxkfR19UzJFPhKpB6a55tBv0HVXsM=";
  };

  build-system = [
@@ -15,14 +15,14 @@

 buildPythonPackage rec {
  pname = "youtubeaio";
-  version = "2.1.0";
+  version = "2.1.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "joostlek";
    repo = "python-youtube";
    tag = "v${version}";
-    hash = "sha256-qN2HV30Ds/FUOUG84cbtOgu2wVGeBRbwfYeXiP554g8=";
+    hash = "sha256-2PqVFZ5816g8Ilc0Mhlm+Gzw/eOSaC1JYPY/t2yzxCU=";
  };

  postPatch = ''
--- a/Show More
+++ b/Show More