Merge 6c6254bd01 into haskell-updates

2025-07-17 00:24:03 +00:00
parent f10aa089db 6c6254bd01
commit 32e5230d01
198 changed files with 1922 additions and 1274 deletions
@@ -45,42 +45,25 @@ jobs:
          filter: tree:0
          path: trusted

-      - name: Check cherry-picks
-        id: check
-        continue-on-error: true
-        env:
-          BASE_SHA: ${{ github.event.pull_request.base.sha }}
-          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
-        run: |
-          ./trusted/ci/check-cherry-picks.sh "$BASE_SHA" "$HEAD_SHA" checked-cherry-picks.md
+      - name: Install dependencies
+        run: npm install bottleneck

      - name: Log current API rate limits
        env:
          GH_TOKEN: ${{ github.token }}
        run: gh api /rate_limit | jq

-      - name: Prepare review
-        if: steps.check.outcome == 'failure'
+      - name: Check cherry-picks
+        id: check
+        continue-on-error: true
        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
        with:
          script: |
-            const { readFile, writeFile } = require('node:fs/promises')
-
-            const job_url = (await github.rest.actions.listJobsForWorkflowRun({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              run_id: context.runId
-            })).data.jobs[0].html_url + '?pr=' + context.payload.pull_request.number
-
-            const header = await readFile('trusted/ci/check-cherry-picks.md')
-            const body = await readFile('checked-cherry-picks.md')
-            const footer =
-              `\n_Hint: The full diffs are also available in the [runner logs](${job_url}) with slightly better highlighting._`
-
-            const review = header + body + footer
-            await writeFile('review.md', review)
-            core.summary.addRaw(review)
-            core.summary.write()
+            require('./trusted/ci/github-script/commits.js')({
+              github,
+              context,
+              core,
+            })

      - name: Request changes
        if: ${{ github.event_name == 'pull_request_target' && steps.check.outcome == 'failure' }}
@@ -1,152 +0,0 @@
-#!/usr/bin/env bash
-# Find alleged cherry-picks
-
-set -euo pipefail
-
-if [[ $# != "2" && $# != "3" ]] ; then
-  echo "usage: check-cherry-picks.sh base_rev head_rev [markdown_file]"
-  exit 2
-fi
-
-markdown_file="$(realpath ${3:-/dev/null})"
-[ -v 3 ] && rm -f "$markdown_file"
-
-# Make sure we are inside the nixpkgs repo, even when called from outside
-cd "$(dirname "${BASH_SOURCE[0]}")"
-
-PICKABLE_BRANCHES="master staging release-??.?? staging-??.?? haskell-updates python-updates staging-next staging-next-??.??"
-problem=0
-
-# Not everyone calls their remote "origin"
-remote="$(git remote -v | grep -i 'NixOS/nixpkgs' | head -n1 | cut -f1 || true)"
-
-commits="$(git rev-list --reverse "$1..$2")"
-
-log() {
-  type="$1"
-  shift 1
-
-  local -A prefix
-  prefix[success]="  ✔ "
-  if [ -v GITHUB_ACTIONS ]; then
-    prefix[warning]="::warning::"
-    prefix[error]="::error::"
-  else
-    prefix[warning]="  ⚠ "
-    prefix[error]="  ✘ "
-  fi
-
-  echo "${prefix[$type]}$@"
-
-  # Only logging errors and warnings, which allows comparing the markdown file
-  # between pushes to the PR. Even if a new, proper cherry-pick, commit is added
-  # it won't change the markdown file's content and thus not trigger another comment.
-  if [ "$type" != "success" ]; then
-    local -A alert
-    alert[warning]="WARNING"
-    alert[error]="CAUTION"
-    echo >> $markdown_file
-    echo "> [!${alert[$type]}]" >> $markdown_file
-    echo "> $@" >> $markdown_file
-  fi
-}
-
-endgroup() {
-  if [ -v GITHUB_ACTIONS ] ; then
-    echo ::endgroup::
-  fi
-}
-
-while read -r new_commit_sha ; do
-  if [ -v GITHUB_ACTIONS ] ; then
-    echo "::group::Commit $new_commit_sha"
-  else
-    echo "================================================="
-  fi
-  git rev-list --max-count=1 --format=medium "$new_commit_sha"
-  echo "-------------------------------------------------"
-
-  # Using the last line with "cherry" + hash, because a chained backport
-  # can result in multiple of those lines. Only the last one counts.
-  original_commit_sha=$(
-    git rev-list --max-count=1 --format=format:%B "$new_commit_sha" \
-    | grep -Ei "cherry.*[0-9a-f]{40}" | tail -n1 \
-    | grep -Eoi -m1 '[0-9a-f]{40}' || true
-  )
-  if [ -z "$original_commit_sha" ] ; then
-    endgroup
-    log warning "Couldn't locate original commit hash in message of $new_commit_sha."
-    problem=1
-    continue
-  fi
-
-  set -f # prevent pathname expansion of patterns
-  for pattern in $PICKABLE_BRANCHES ; do
-    set +f # re-enable pathname expansion
-
-    # Reverse sorting by refname and taking one match only means we can only backport
-    # from unstable and the latest stable. That makes sense, because even right after
-    # branch-off, when we have two supported stable branches, we only ever want to cherry-pick
-    # **to** the older one, but never **from** it.
-    # This makes the job significantly faster in the case when commits can't be found,
-    # because it doesn't need to iterate through 20+ branches, which all need to be fetched.
-    branches="$(git for-each-ref --sort=-refname --format="%(refname)" \
-      "refs/remotes/${remote:-origin}/$pattern" | head -n1)"
-
-    while read -r picked_branch ; do
-      if git merge-base --is-ancestor "$original_commit_sha" "$picked_branch" ; then
-        range_diff_common='git --no-pager range-diff
-          --no-notes
-          --creation-factor=100
-          '"$original_commit_sha~..$original_commit_sha"'
-          '"$new_commit_sha~..$new_commit_sha"'
-        '
-
-        if $range_diff_common --no-color 2> /dev/null | grep -E '^ {4}[+-]{2}' > /dev/null ; then
-          log success "$original_commit_sha present in branch $picked_branch"
-          endgroup
-          log warning "Difference between $new_commit_sha and original $original_commit_sha may warrant inspection."
-
-          # First line contains commit SHAs, which we already printed.
-          $range_diff_common --color | tail -n +2
-
-          echo -e "> <details><summary>Show diff</summary>\n>" >> $markdown_file
-          echo '> ```diff' >> $markdown_file
-          # The output of `git range-diff` is indented with 4 spaces, which we need to match with the
-          # code blocks indent to get proper syntax highlighting on GitHub.
-          diff="$($range_diff_common | tail -n +2 | sed -Ee 's/^ {4}/> /g')"
-          # Also limit the output to 10k bytes (and remove the last, potentially incomplete line), because
-          # GitHub comments are limited in length. The value of 10k is arbitrary with the assumption, that
-          # after the range-diff becomes a certain size, a reviewer is better off reviewing the regular diff
-          # in GitHub's UI anyway, thus treating the commit as "new" and not cherry-picked.
-          # Note: This could still lead to a too lengthy comment with multiple commits touching the limit. We
-          # consider this too unlikely to happen, to deal with explicitly.
-          max_length=10000
-          if [ "${#diff}" -gt $max_length ]; then
-            printf -v diff "%s\n>\n> [...truncated...]" "$(echo "$diff" | head -c $max_length | head -n-1)"
-          fi
-          echo "$diff" >> $markdown_file
-          echo '> ```' >> $markdown_file
-          echo "> </details>" >> $markdown_file
-
-          problem=1
-        else
-          log success "$original_commit_sha present in branch $picked_branch"
-          log success "$original_commit_sha highly similar to $new_commit_sha"
-          $range_diff_common --color
-          endgroup
-        fi
-
-        # move on to next commit
-        continue 3
-      fi
-    done <<< "$branches"
-  done
-
-  endgroup
-  log error "$original_commit_sha given in $new_commit_sha not found in any pickable branch."
-
-  problem=1
-done <<< "$commits"
-
-exit $problem
@@ -1 +1,2 @@
 node_modules
+step-summary.md
@@ -1 +1,2 @@
 package-lock-only = true
+save-exact = true
@@ -8,6 +8,10 @@ To run any of the scripts locally:
 - Enter `nix-shell` in `./ci/github-script`.
 - Ensure `gh` is authenticated.

+## Check commits
+
+Run `./run commits OWNER REPO PR`, where OWNER is your username or "NixOS", REPO is the name of your fork or "nixpkgs" and PR is the number of the pull request to check.
+
 ## Labeler

 Run `./run labels OWNER REPO`, where OWNER is your username or "NixOS" and REPO the name of your fork or "nixpkgs".
@@ -0,0 +1,199 @@
+module.exports = async function ({ github, context, core }) {
+  const { execFileSync } = require('node:child_process')
+  const { readFile, writeFile } = require('node:fs/promises')
+  const { join } = require('node:path')
+  const { classify } = require('../supportedBranches.js')
+  const withRateLimit = require('./withRateLimit.js')
+
+  await withRateLimit({ github, core }, async (stats) => {
+    stats.prs = 1
+
+    const job_url =
+      context.runId &&
+      (
+        await github.rest.actions.listJobsForWorkflowRun({
+          ...context.repo,
+          run_id: context.runId,
+        })
+      ).data.jobs[0].html_url +
+        '?pr=' +
+        context.payload.pull_request.number
+
+    async function handle({ sha, commit }) {
+      // Using the last line with "cherry" + hash, because a chained backport
+      // can result in multiple of those lines. Only the last one counts.
+      const match = Array.from(
+        commit.message.matchAll(/cherry.*([0-9a-f]{40})/g),
+      ).at(-1)
+
+      if (!match)
+        return {
+          sha,
+          commit,
+          severity: 'warning',
+          message: `Couldn't locate original commit hash in message of ${sha}.`,
+        }
+
+      const original_sha = match[1]
+
+      let branches
+      try {
+        branches = (
+          await github.request({
+            // This is an undocumented endpoint to fetch the branches a commit is part of.
+            // There is no equivalent in neither the REST nor the GraphQL API.
+            // The endpoint itself is unlikely to go away, because GitHub uses it to display
+            // the list of branches on the detail page of a commit.
+            url: `https://github.com/${context.repo.owner}/${context.repo.repo}/branch_commits/${original_sha}`,
+            headers: {
+              accept: 'application/json',
+            },
+          })
+        ).data.branches
+          .map(({ branch }) => branch)
+          .filter((branch) => classify(branch).type.includes('development'))
+      } catch (e) {
+        // For some unknown reason a 404 error comes back as 500 without any more details in a GitHub Actions runner.
+        // Ignore these to return a regular error message below.
+        if (![404, 500].includes(e.status)) throw e
+      }
+      if (!branches?.length)
+        return {
+          sha,
+          commit,
+          severity: 'error',
+          message: `${original_sha} given in ${sha} not found in any pickable branch.`,
+        }
+
+      const diff = execFileSync('git', [
+        '-C',
+        __dirname,
+        'range-diff',
+        '--no-color',
+        '--no-notes',
+        '--creation-factor=100',
+        `${original_sha}~..${original_sha}`,
+        `${sha}~..${sha}`,
+      ])
+        .toString()
+        .split('\n')
+        // First line contains commit SHAs, which we'll print separately.
+        .slice(1)
+        // # The output of `git range-diff` is indented with 4 spaces, but we'll control indentation manually.
+        .map((line) => line.replace(/^ {4}/, ''))
+
+      if (!diff.some((line) => line.match(/^[+-]{2}/)))
+        return {
+          sha,
+          commit,
+          severity: 'info',
+          message: `✔ ${original_sha} is highly similar to ${sha}.`,
+        }
+
+      const colored_diff = execFileSync('git', [
+        '-C',
+        __dirname,
+        'range-diff',
+        '--color',
+        '--no-notes',
+        '--creation-factor=100',
+        `${original_sha}~..${original_sha}`,
+        `${sha}~..${sha}`,
+      ]).toString()
+
+      return {
+        sha,
+        commit,
+        diff,
+        colored_diff,
+        severity: 'warning',
+        message: `Difference between ${sha} and original ${original_sha} may warrant inspection.`,
+      }
+    }
+
+    const commits = await github.paginate(github.rest.pulls.listCommits, {
+      ...context.repo,
+      pull_number: context.payload.pull_request.number,
+    })
+
+    const results = await Promise.all(commits.map(handle))
+
+    // Log all results without truncation and with better highlighting to the job log.
+    results.forEach(({ sha, commit, severity, message, colored_diff }) => {
+      core.startGroup(`Commit ${sha}`)
+      core.info(`Author: ${commit.author.name} ${commit.author.email}`)
+      core.info(`Date: ${new Date(commit.author.date)}`)
+      core[severity](message)
+      core.endGroup()
+      if (colored_diff) core.info(colored_diff)
+    })
+
+    // Only create step summary below in case of warnings or errors.
+    if (results.every(({ severity }) => severity == 'info')) return
+    else process.exitCode = 1
+
+    core.summary.addRaw(
+      await readFile(join(__dirname, 'check-cherry-picks.md'), 'utf-8'),
+      true,
+    )
+    results.forEach(({ severity, message, diff }) => {
+      if (severity == 'info') return
+
+      // The docs for markdown alerts only show examples with markdown blockquote syntax, like this:
+      //   > [!WARNING]
+      //   > message
+      // However, our testing shows that this also works with a `<blockquote>` html tag, as long as there
+      // is an empty line:
+      //   <blockquote>
+      //
+      //   [!WARNING]
+      //   message
+      //   </blockquote>
+      // Whether this is intended or just an implementation detail is unclear.
+      core.summary.addRaw('<blockquote>')
+      core.summary.addRaw(
+        `\n\n[!${severity == 'warning' ? 'WARNING' : 'CAUTION'}]`,
+        true,
+      )
+      core.summary.addRaw(`${message}`, true)
+
+      if (diff) {
+        // Limit the output to 10k bytes and remove the last, potentially incomplete line, because GitHub
+        // comments are limited in length. The value of 10k is arbitrary with the assumption, that after
+        // the range-diff becomes a certain size, a reviewer is better off reviewing the regular diff in
+        // GitHub's UI anyway, thus treating the commit as "new" and not cherry-picked.
+        // Note: if multiple commits are close to the limit, this approach could still lead to a comment
+        // that's too long. We think this is unlikely to happen, and so don't deal with it explicitly.
+        const truncated = []
+        let total_length = 0
+        for (line of diff) {
+          total_length += line.length
+          if (total_length > 10000) {
+            truncated.push('', '[...truncated...]')
+            break
+          } else {
+            truncated.push(line)
+          }
+        }
+
+        core.summary.addRaw('<details><summary>Show diff</summary>')
+        core.summary.addRaw('\n\n```diff', true)
+        core.summary.addRaw(truncated.join('\n'), true)
+        core.summary.addRaw('```', true)
+        core.summary.addRaw('</details>')
+      }
+
+      core.summary.addRaw('</blockquote>')
+    })
+
+    if (job_url)
+      core.summary.addRaw(
+        `\n\n_Hint: The full diffs are also available in the [runner logs](${job_url}) with slightly better highlighting._`,
+      )
+
+    // Write to disk temporarily for next step in GHA.
+    await writeFile('review.md', core.summary.stringify())
+
+    core.summary.write()
+  })
+}
@@ -6,6 +6,7 @@
    "": {
      "dependencies": {
        "@actions/artifact": "2.3.2",
+        "@actions/core": "1.11.1",
        "@actions/github": "6.0.1",
        "bottleneck": "2.19.5",
        "commander": "14.0.0"
@@ -2,6 +2,7 @@
  "private": true,
  "dependencies": {
    "@actions/artifact": "2.3.2",
+    "@actions/core": "1.11.1",
    "@actions/github": "6.0.1",
    "bottleneck": "2.19.5",
    "commander": "14.0.0"
@@ -1,12 +1,13 @@
 #!/usr/bin/env -S node --import ./run
 import { execSync } from 'node:child_process'
-import { mkdtempSync, rmSync } from 'node:fs'
+import { closeSync, mkdtempSync, openSync, rmSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { program } from 'commander'
+import * as core from '@actions/core'
 import { getOctokit } from '@actions/github'

-async function run(action, owner, repo, pull_number, dry) {
+async function run(action, owner, repo, pull_number, dry = true) {
  const token = execSync('gh auth token', { encoding: 'utf-8' }).trim()

  const github = getOctokit(token)
@@ -19,39 +20,36 @@ async function run(action, owner, repo, pull_number, dry) {
    })).data
  }

-  const tmp = mkdtempSync(join(tmpdir(), 'github-script-'))
-  try {
-    process.env.GITHUB_WORKSPACE = tmp
-    process.chdir(tmp)
+  process.env['INPUT_GITHUB-TOKEN'] = token

-    await action({
-      github,
-      context: {
-        payload,
-        repo: {
-          owner,
-          repo,
-        },
+  closeSync(openSync('step-summary.md', 'w'))
+  process.env.GITHUB_STEP_SUMMARY = 'step-summary.md'
+
+  await action({
+    github,
+    context: {
+      payload,
+      repo: {
+        owner,
+        repo,
      },
-      core: {
-        getInput() {
-          return token
-        },
-        error: console.error,
-        info: console.log,
-        notice: console.log,
-        setFailed(msg) {
-          console.error(msg)
-          process.exitCode = 1
-        },
-      },
-      dry,
-    })
-  } finally {
-    rmSync(tmp, { recursive: true })
-  }
+    },
+    core,
+    dry,
+  })
 }

+program
+  .command('commits')
+  .description('Check commit structure of a pull request.')
+  .argument('<owner>', 'Owner of the GitHub repository to check (Example: NixOS)')
+  .argument('<repo>', 'Name of the GitHub repository to check (Example: nixpkgs)')
+  .argument('<pr>', 'Number of the Pull Request to check')
+  .action(async (owner, repo, pr) => {
+    const commits = (await import('./commits.js')).default
+    run(commits, owner, repo, pr)
+  })
+
 program
  .command('labels')
  .description('Manage labels on pull requests.')
@@ -61,7 +59,14 @@ program
  .option('--no-dry', 'Make actual modifications')
  .action(async (owner, repo, pr, options) => {
    const labels = (await import('./labels.js')).default
-    run(labels, owner, repo, pr, options.dry)
+    const tmp = mkdtempSync(join(tmpdir(), 'github-script-'))
+    try {
+      process.env.GITHUB_WORKSPACE = tmp
+      process.chdir(tmp)
+      run(labels, owner, repo, pr, options.dry)
+    } finally {
+      rmSync(tmp, { recursive: true })
+    }
  })

 await program.parse()
@@ -20,6 +20,8 @@ module.exports = async function ({ github, core }, callback) {
  // Pause between mutative requests
  const writeLimits = new Bottleneck({ minTime: 1000 }).chain(allLimits)
  github.hook.wrap('request', async (request, options) => {
+    // Requests to a different host do not count against the rate limit.
+    if (options.url.startsWith('https://github.com')) return request(options)
    // Requests to the /rate_limit endpoint do not count against the rate limit.
    if (options.url == '/rate_limit') return request(options)
    // Search requests are in a different resource group, which allows 30 requests / minute.
@@ -327,18 +327,54 @@ Dependency propagation takes cross compilation into account, meaning that depend

 To determine the exact rules for dependency propagation, we start by assigning to each dependency a couple of ternary numbers (`-1` for `build`, `0` for `host`, and `1` for `target`) representing its [dependency type](#possible-dependency-types), which captures how its host and target platforms are each "offset" from the depending derivation’s host and target platforms. The following table summarize the different combinations that can be obtained:

-| `host → target`     | attribute name      | offset   |
-| ------------------- | ------------------- | -------- |
-| `build --> build`   | `depsBuildBuild`    | `-1, -1` |
-| `build --> host`    | `nativeBuildInputs` | `-1, 0`  |
-| `build --> target`  | `depsBuildTarget`   | `-1, 1`  |
-| `host --> host`     | `depsHostHost`      | `0, 0`   |
-| `host --> target`   | `buildInputs`       | `0, 1`   |
-| `target --> target` | `depsTargetTarget`  | `1, 1`   |
+| `host → target`     | attribute name      | offset   | typical purpose                               |
+| ------------------- | ------------------- | -------- | --------------------------------------------- |
+| `build --> build`   | `depsBuildBuild`    | `-1, -1` | compilers for build helpers                   |
+| `build --> host`    | `nativeBuildInputs` | `-1, 0`  | build tools, compilers, setup hooks           |
+| `build --> target`  | `depsBuildTarget`   | `-1, 1`  | compilers to build stdlibs to run on target   |
+| `host --> host`     | `depsHostHost`      | `0, 0`   | compilers to build C code at runtime (rare)   |
+| `host --> target`   | `buildInputs`       | `0, 1`   | libraries                                     |
+| `target --> target` | `depsTargetTarget`  | `1, 1`   | stdlibs to run on target                      |

 Algorithmically, we traverse propagated inputs, accumulating every propagated dependency’s propagated dependencies and adjusting them to account for the “shift in perspective” described by the current dependency’s platform offsets. This results is sort of a transitive closure of the dependency relation, with the offsets being approximately summed when two dependency links are combined. We also prune transitive dependencies whose combined offsets go out-of-bounds, which can be viewed as a filter over that transitive closure removing dependencies that are blatantly absurd.

-We can define the process precisely with [Natural Deduction](https://en.wikipedia.org/wiki/Natural_deduction) using the inference rules. This probably seems a bit obtuse, but so is the bash code that actually implements it! [^footnote-stdenv-find-inputs-location] They’re confusing in very different ways so… hopefully if something doesn’t make sense in one presentation, it will in the other!
+We can define the process precisely with [Natural Deduction](https://en.wikipedia.org/wiki/Natural_deduction) using the inference rules below. This probably seems a bit obtuse, but so is the bash code that actually implements it! [^footnote-stdenv-find-inputs-location] They’re confusing in very different ways so… hopefully if something doesn’t make sense in one presentation, it will in the other!
+
+**Definitions:**
+
+`dep(h_offset, t_offset, X, Y)`
+:    Package X has a direct dependency on Y in a position with host offset `h_offset` and target offset `t_offset`.
+
+     For example, `nativeBuildInputs = [ Y ]` means `dep(-1, 0, X, Y)`.
+
+`propagated-dep(h_offset, t_offset, X, Y)`
+:    Package X has a propagated dependency on Y in a position with host offset `h_offset` and target offset `t_offset`.
+
+     For example, `depsBuildTargetPropagated = [ Y ]` means `propagated-dep(-1, 1, X, Y)`.
+
+`mapOffset(h, t, i) = offs`
+:    In a package X with a dependency on Y in a position with host offset `h` and target offset `t`, Y's transitive dependency Z in a position with offset `i` is mapped to offset `offs` in X.
+
+
+::: {.example}
+# Truth table of `mapOffset(h, t, i)`
+
+`x` means that the dependency was discarded because `h + i ∉ {-1, 0, 1}`.
+
+<!-- This is written as an ascii art table because the CSS was introducing so much space it was unreadable and doesn't support double lines -->
+
+```
+  h |   t  || i=-1 |  i=0 |  i=1
+----|------||------|------|-----
+ -1 |  -1  ||   x  |  -1  |  -1
+ -1 |   0  ||   x  |  -1  |   0
+ -1 |   1  ||   x  |  -1  |   1
+  0 |   0  ||  -1  |   0  |   0
+  0 |   1  ||  -1  |   0  |   1
+  1 |   1  ||   0  |   1  |   x
+```
+
+:::

 ```
 let mapOffset(h, t, i) = i + (if i <= 0 then h else t - 1)
@@ -372,7 +408,7 @@ propagated-dep(h, t, A, B)
 dep(h, t, A, B)
 ```

-Some explanation of this monstrosity is in order. In the common case, the target offset of a dependency is the successor to the host offset: `t = h + 1`. That means that:
+Some explanation of this monstrosity is in order. In the common case of `nativeBuildInputs` or `buildInputs`, the target offset of a dependency is one greater than the host offset: `t = h + 1`. That means that:

 ```
 let f(h, t, i) = i + (if i <= 0 then h else t - 1)
@@ -383,7 +419,11 @@ let f(h, h + 1, i) = i + h

 This is where “sum-like” comes in from above: We can just sum all of the host offsets to get the host offset of the transitive dependency. The target offset is the transitive dependency is the host offset + 1, just as it was with the dependencies composed to make this transitive one; it can be ignored as it doesn’t add any new information.

-Because of the bounds checks, the uncommon cases are `h = t` and `h + 2 = t`. In the former case, the motivation for `mapOffset` is that since its host and target platforms are the same, no transitive dependency of it should be able to “discover” an offset greater than its reduced target offsets. `mapOffset` effectively “squashes” all its transitive dependencies’ offsets so that none will ever be greater than the target offset of the original `h = t` package. In the other case, `h + 1` is skipped over between the host and target offsets. Instead of squashing the offsets, we need to “rip” them apart so no transitive dependencies’ offset is that one.
+Because of the bounds checks, the uncommon cases are `h = t` (`depsBuildBuild`, etc) and `h + 2 = t` (`depsBuildTarget`).
+
+In the former case, the motivation for `mapOffset` is that since its host and target platforms are the same, no transitive dependency of it should be able to “discover” an offset greater than its reduced target offsets. `mapOffset` effectively “squashes” all its transitive dependencies’ offsets so that none will ever be greater than the target offset of the original `h = t` package.
+
+In the other case, `h + 1` (0) is skipped over between the host (-1) and target (1) offsets. Instead of squashing the offsets, we need to “rip” them apart so no transitive dependency’s offset is 0.

 Overall, the unifying theme here is that propagation shouldn’t be introducing transitive dependencies involving platforms the depending package is unaware of. \[One can imagine the depending package asking for dependencies with the platforms it knows about; other platforms it doesn’t know how to ask for. The platform description in that scenario is a kind of unforgeable capability.\] The offset bounds checking and definition of `mapOffset` together ensure that this is the case. Discovering a new offset is discovering a new platform, and since those platforms weren’t in the derivation “spec” of the needing package, they cannot be relevant. From a capability perspective, we can imagine that the host and target platforms of a package are the capabilities a package requires, and the depending package must provide the capability to the dependency.

@@ -5471,12 +5471,6 @@
    name = "Dima";
    keys = [ { fingerprint = "1C4E F4FE 7F8E D8B7 1E88 CCDF BAB1 D15F B7B4 D4CE"; } ];
  };
-  d-xo = {
-    email = "hi@d-xo.org";
-    github = "d-xo";
-    githubId = 6689924;
-    name = "David Terry";
-  };
  d3vil0p3r = {
    name = "Antonio Voza";
    email = "vozaanthony@gmail.com";
@@ -7840,6 +7834,12 @@
    name = "Elis Hirwing";
    keys = [ { fingerprint = "67FE 98F2 8C44 CF22 1828  E12F D57E FA62 5C9A 925F"; } ];
  };
+  eu90h = {
+    email = "stefan@eu90h.com";
+    github = "eu90h";
+    githubId = 5161785;
+    name = "Stefan";
+  };
  euank = {
    email = "euank-nixpkg@euank.com";
    github = "euank";
@@ -10946,6 +10946,12 @@
    githubId = 16307070;
    name = "iosmanthus";
  };
+  iqubic = {
+    email = "sophia.b.caspe@gmail.com";
+    github = "iqubic";
+    githubId = 22628816;
+    name = "Sophia Caspe";
+  };
  iquerejeta = {
    github = "iquerejeta";
    githubId = 31273774;
@@ -120,6 +120,10 @@

 - `services.ntpd-rs` now performs configuration validation.

+- `services.postsrsd` now automatically integrates with the local Postfix instance, when enabled. This behavior can disabled using the [services.postsrsd.configurePostfix](#opt-services.postsrsd.configurePostfix) option.
+
+- `services.pfix-srsd` now automatically integrates with the local Postfix instance, when enabled. This behavior can disabled using the [services.pfix-srsd.configurePostfix](#opt-services.pfix-srsd.configurePostfix) option.
+
 - `services.monero` now includes the `environmentFile` option for adding secrets to the Monero daemon config.

 - `amdgpu` kernel driver overdrive mode can now be enabled by setting [hardware.amdgpu.overdrive.enable](#opt-hardware.amdgpu.overdrive.enable) and customized through [hardware.amdgpu.overdrive.ppfeaturemask](#opt-hardware.amdgpu.overdrive.ppfeaturemask).
@@ -0,0 +1,34 @@
+{
+  config,
+  lib,
+  ...
+}:
+
+let
+  cfg = config.hardware.sheep_net;
+in
+{
+  options.hardware.sheep_net = {
+    enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = ''
+        Enables sheep_net udev rules, ensures 'sheep_net' group exists, and adds
+        sheep-net to boot.kernelModules and boot.extraModulePackages
+      '';
+    };
+  };
+  config = lib.mkIf cfg.enable {
+    services.udev.extraRules = ''
+      KERNEL=="sheep_net", GROUP="sheep_net"
+    '';
+    boot.kernelModules = [
+      "sheep_net"
+    ];
+    boot.extraModulePackages = [
+      config.boot.kernelPackages.sheep-net
+    ];
+    users.groups.sheep_net = { };
+  };
+  meta.maintainers = with lib.maintainers; [ matthewcroughan ];
+}
@@ -104,6 +104,7 @@
  ./hardware/sata.nix
  ./hardware/sensor/hddtemp.nix
  ./hardware/sensor/iio.nix
+  ./hardware/sheep-net.nix
  ./hardware/steam-hardware.nix
  ./hardware/system-76.nix
  ./hardware/tuxedo-drivers.nix
@@ -1,13 +1,9 @@
 {
  config,
  lib,
-  options,
  pkgs,
  ...
-}: # XXX migration code for freeform settings: `options` can be removed in 2025
-let
-  optionsGlobal = options;
-in
+}:

 let

@@ -75,7 +71,7 @@ let
    {
      freeformType = attrsOf (either scalarType (listOf scalarType));
      # Client system-options file directives are explained here:
-      # https://www.ibm.com/docs/en/storage-protect/8.1.25?topic=commands-processing-options
+      # https://www.ibm.com/docs/en/storage-protect/8.1.27?topic=commands-processing-options
      options.servername = mkOption {
        type = servernameType;
        default = name;
@@ -150,27 +146,6 @@ let
      };
      config.commmethod = mkDefault "v6tcpip"; # uses v4 or v6, based on dns lookup result
      config.passwordaccess = if config.genPasswd then "generate" else "prompt";
-      # XXX migration code for freeform settings, these can be removed in 2025:
-      options.warnings = optionsGlobal.warnings;
-      options.assertions = optionsGlobal.assertions;
-      imports =
-        let
-          inherit (lib.modules) mkRemovedOptionModule mkRenamedOptionModule;
-        in
-        [
-          (mkRemovedOptionModule [ "extraConfig" ]
-            "Please just add options directly to the server attribute set, cf. the description of `programs.tsmClient.servers`."
-          )
-          (mkRemovedOptionModule [ "text" ]
-            "Please just add options directly to the server attribute set, cf. the description of `programs.tsmClient.servers`."
-          )
-          (mkRenamedOptionModule [ "name" ] [ "servername" ])
-          (mkRenamedOptionModule [ "server" ] [ "tcpserveraddress" ])
-          (mkRenamedOptionModule [ "port" ] [ "tcpport" ])
-          (mkRenamedOptionModule [ "node" ] [ "nodename" ])
-          (mkRenamedOptionModule [ "passwdDir" ] [ "passworddir" ])
-          (mkRenamedOptionModule [ "includeExclude" ] [ "inclexcl" ])
-        ];
    };

  options.programs.tsmClient = {
@@ -291,16 +266,7 @@ let
        contain duplicate names
        (note that setting names are case insensitive).
      '';
-    }) cfg.servers)
-    # XXX migration code for freeform settings, this can be removed in 2025:
-    ++ (enrichMigrationInfos "assertions" (
-      addText:
-      { assertion, message }:
-      {
-        inherit assertion;
-        message = addText message;
-      }
-    ));
+    }) cfg.servers);

  makeDsmSysLines =
    key: value:
@@ -340,17 +306,6 @@ let
      attrs = removeAttrs serverCfg [
        "servername"
        "genPasswd"
-        # XXX migration code for freeform settings, these can be removed in 2025:
-        "assertions"
-        "warnings"
-        "extraConfig"
-        "text"
-        "name"
-        "server"
-        "port"
-        "node"
-        "passwdDir"
-        "includeExclude"
      ];
    in
    ''
@@ -369,16 +324,6 @@ let
    ${concatLines (map makeDsmSysStanza (attrValues cfg.servers))}
  '';

-  # XXX migration code for freeform settings, this can be removed in 2025:
-  enrichMigrationInfos =
-    what: how:
-    concatLists (
-      mapAttrsToList (
-        name: serverCfg:
-        map (how (text: "In `programs.tsmClient.servers.${name}`: ${text}")) serverCfg."${what}"
-      ) cfg.servers
-    );
-
 in

 {
@@ -393,8 +338,6 @@ in
      dsmSysApi = dsmSysCli;
    };
    environment.systemPackages = [ cfg.wrappedPackage ];
-    # XXX migration code for freeform settings, this can be removed in 2025:
-    warnings = enrichMigrationInfos "warnings" (addText: addText);
  };

  meta.maintainers = [ lib.maintainers.yarny ];
@@ -89,7 +89,7 @@ in
      environment.HOME = "/var/lib/tsm-backup";
      serviceConfig = {
        # for exit status description see
-        # https://www.ibm.com/docs/en/storage-protect/8.1.25?topic=clients-client-return-codes
+        # https://www.ibm.com/docs/en/storage-protect/8.1.27?topic=clients-client-return-codes
        SuccessExitStatus = "4 8";
        # The `-se` option must come after the command.
        # The `-optfile` option suppresses a `dsm.opt`-not-found warning.
@@ -4,6 +4,10 @@
  pkgs,
  ...
 }:
+
+let
+  cfg = config.services.pfix-srsd;
+in
 {

  ###### interface
@@ -32,27 +36,46 @@
        type = lib.types.path;
        default = "/var/lib/pfix-srsd/secrets";
      };
+
+      configurePostfix = lib.mkOption {
+        type = lib.types.bool;
+        default = true;
+        description = ''
+          Whether to configure the required settings to use pfix-srsd in the local Postfix instance.
+        '';
+      };
    };
  };

  ###### implementation

-  config = lib.mkIf config.services.pfix-srsd.enable {
-    environment = {
-      systemPackages = [ pkgs.pfixtools ];
-    };
-
-    systemd.services.pfix-srsd = {
-      description = "Postfix sender rewriting scheme daemon";
-      before = [ "postfix.service" ];
-      #note that we use requires rather than wants because postfix
-      #is unable to process (almost) all mail without srsd
-      requiredBy = [ "postfix.service" ];
-      serviceConfig = {
-        Type = "forking";
-        PIDFile = "/run/pfix-srsd.pid";
-        ExecStart = "${pkgs.pfixtools}/bin/pfix-srsd -p /run/pfix-srsd.pid -I ${config.services.pfix-srsd.domain} ${config.services.pfix-srsd.secretsFile}";
+  config = lib.mkMerge [
+    (lib.mkIf (cfg.enable && cfg.configurePostfix && config.services.postfix.enable) {
+      services.postfix.config = {
+        sender_canonical_maps = [ "tcp:127.0.0.1:10001" ];
+        sender_canonical_classes = [ "envelope_sender" ];
+        recipient_canonical_maps = [ "tcp:127.0.0.1:10002" ];
+        recipient_canonical_classes = [ "envelope_recipient" ];
      };
-    };
-  };
+    })
+
+    (lib.mkIf cfg.enable {
+      environment = {
+        systemPackages = [ pkgs.pfixtools ];
+      };
+
+      systemd.services.pfix-srsd = {
+        description = "Postfix sender rewriting scheme daemon";
+        before = [ "postfix.service" ];
+        #note that we use requires rather than wants because postfix
+        #is unable to process (almost) all mail without srsd
+        requiredBy = [ "postfix.service" ];
+        serviceConfig = {
+          Type = "forking";
+          PIDFile = "/run/pfix-srsd.pid";
+          ExecStart = "${pkgs.pfixtools}/bin/pfix-srsd -p /run/pfix-srsd.pid -I ${config.services.pfix-srsd.domain} ${config.services.pfix-srsd.secretsFile}";
+        };
+      };
+    })
+  ];
 }
@@ -785,12 +785,6 @@ in
        description = "Maps to be compiled and placed into /var/lib/postfix/conf.";
      };

-      useSrs = lib.mkOption {
-        type = lib.types.bool;
-        default = false;
-        description = "Whether to enable sender rewriting scheme";
-      };
-
    };

  };
@@ -808,8 +802,6 @@ in
          systemPackages = [ pkgs.postfix ];
        };

-        services.pfix-srsd.enable = config.services.postfix.useSrs;
-
        services.mail.sendmailSetuidWrapper = lib.mkIf config.services.postfix.setSendmail {
          program = "sendmail";
          source = "${pkgs.postfix}/bin/sendmail";
@@ -1002,12 +994,6 @@ in
            ] ++ lib.optional haveAliases "$alias_maps";
          }
          // lib.optionalAttrs (cfg.dnsBlacklists != [ ]) { smtpd_client_restrictions = clientRestrictions; }
-          // lib.optionalAttrs cfg.useSrs {
-            sender_canonical_maps = [ "tcp:127.0.0.1:10001" ];
-            sender_canonical_classes = [ "envelope_sender" ];
-            recipient_canonical_maps = [ "tcp:127.0.0.1:10002" ];
-            recipient_canonical_classes = [ "envelope_recipient" ];
-          }
          // lib.optionalAttrs cfg.enableHeaderChecks {
            header_checks = [ "regexp:/etc/postfix/header_checks" ];
          }
@@ -1190,5 +1176,6 @@ in
      [ "services" "postfix" "config" "smtp_tls_security_level" ]
      (config: lib.mkIf config.services.postfix.useDane "dane")
    )
+    (lib.mkRenamedOptionModule [ "services" "postfix" "useSrs" ] [ "services" "pfix-srsd" "enable" ])
  ];
 }
@@ -2,37 +2,67 @@
  config,
  lib,
  pkgs,
+  utils,
  ...
 }:
 let

  cfg = config.services.postsrsd;
-  runtimeDirectoryName = "postsrsd";
-  runtimeDirectory = "/run/${runtimeDirectoryName}";
-  # TODO: follow RFC 42, but we need a libconfuse format first:
-  #       https://github.com/NixOS/nixpkgs/issues/401565
-  # Arrays in `libconfuse` look like this: {"Life", "Universe", "Everything"}
-  # See https://www.nongnu.org/confuse/tutorial-html/ar01s03.html.
-  #
-  # Note: We're using `builtins.toJSON` to escape strings, but JSON strings
-  # don't have exactly the same semantics as libconfuse strings. For example,
-  # "${F}" gets treated as an env var reference, see above issue for details.
-  libconfuseDomains = "{ " + lib.concatMapStringsSep ", " builtins.toJSON cfg.domains + " }";
-  configFile = pkgs.writeText "postsrsd.conf" ''
-    secrets-file = "''${CREDENTIALS_DIRECTORY}/secrets-file"
-    domains = ${libconfuseDomains}
-    separator = "${cfg.separator}"
-    socketmap = "unix:${cfg.socketPath}"

-    # Disable postsrsd's jailing in favor of confinement with systemd.
-    unprivileged-user = ""
-    chroot-dir = ""
-  '';
+  inherit (lib)
+    concatMapStringsSep
+    concatMapAttrsStringSep
+    isBool
+    isFloat
+    isInt
+    isPath
+    isString
+    isList
+    mkEnableOption
+    mkPackageOption
+    mkRemovedOptionModule
+    mkRenamedOptionModule
+    ;

+  # This is a implementation of a simple libconfuse config renderer sufficient
+  # for the postsrsd configuration file complexity.
+  # TODO: Replace with pkgs.formats.libconfuse, once implemented (https://github.com/NixOS/nixpkgs/issues/401565)
+  renderValue =
+    value:
+    if isBool value then
+      if value then "true" else "false"
+    else if isString value || isPath value then
+      builtins.toJSON value # for escaping
+    else if isInt value || isFloat value then
+      toString value
+    else if isList value then
+      "{${concatMapStringsSep "," renderValue value}}"
+    else
+      throw "postsrsd: unsupported value type in settings option";
+
+  renderAttr =
+    attrs: concatMapAttrsStringSep "\n" (name: value: "${name} = ${renderValue value}") attrs;
+
+  configFile = pkgs.writeText "postsrsd.conf" (
+    renderAttr (lib.filterAttrsRecursive (_: v: v != null) cfg.settings)
+  );
 in
 {
  imports =
-    map
+    [
+      (mkRemovedOptionModule [ "services" "postsrsd" "socketPath" ] ''
+        Configure/reference `services.postsrsd.settings.socketmap` instead. Note that its now required to start with the `inet:` or `unix:` prefix.
+      '')
+      (mkRenamedOptionModule
+        [ "services" "postsrsd" "domains" ]
+        [ "services" "postsrsd" "settings" "domains" ]
+      )
+      (mkRenamedOptionModule
+        [ "services" "postsrsd" "separator" ]
+        [ "services" "postsrsd" "settings" "separator" ]
+      )
+    ]
+    ++ map
      (
        name:
        lib.mkRemovedOptionModule [ "services" "postsrsd" name ] ''
@@ -53,33 +83,140 @@ in

  options = {
    services.postsrsd = {
-      enable = lib.mkOption {
-        type = lib.types.bool;
-        default = false;
-        description = "Whether to enable the postsrsd SRS server for Postfix.";
-      };
+      enable = mkEnableOption "the postsrsd SRS server for Postfix.";
+
+      package = mkPackageOption pkgs "postsrsd" { };

      secretsFile = lib.mkOption {
        type = lib.types.path;
        default = "/var/lib/postsrsd/postsrsd.secret";
-        description = "Secret keys used for signing and verification";
+        description = ''
+          Secret keys used for signing and verification.
+
+          ::: {.note}
+          The secret will be generated, if it does not exist at the given path.
+          :::
+        '';
      };

-      domains = lib.mkOption {
-        type = lib.types.listOf lib.types.str;
-        description = "Domain names for rewrite";
-        default = [ config.networking.hostName ];
-        defaultText = lib.literalExpression "[ config.networking.hostName ]";
+      settings = lib.mkOption {
+        type = lib.types.submodule {
+          freeformType =
+            with lib.types;
+            attrsOf (oneOf [
+              bool
+              float
+              int
+              path
+              str
+              (listOf str)
+            ]);
+
+          options = {
+            domains = lib.mkOption {
+              type = with lib.types; listOf str;
+              default = [ ];
+              example = [ "example.com" ];
+              description = ''
+                List of local domains, that do not require rewriting.
+              '';
+            };
+
+            secrets-file = lib.mkOption {
+              type = lib.types.str;
+              default = "\${CREDENTIALS_DIRECTORY}/secrets-file";
+              readOnly = true;
+              description = ''
+                Path to the file containing the secret keys.
+
+                ::: {.note}
+                Secrets are passed using `LoadCredential=` on the systemd unit,
+                so this options is read-only.
+
+                Configure {option}`services.postsrsd.secretsFile` instead.
+              '';
+            };
+
+            separator = lib.mkOption {
+              type = lib.types.enum [
+                "-"
+                "="
+                "+"
+              ];
+              default = "=";
+              description = ''
+                SRS tag separator used in generated sender addresses.
+
+                Unless you have a very good reason, you should leave this
+                setting at its default.
+              '';
+            };
+
+            srs-domain = lib.mkOption {
+              type = with lib.types; nullOr str;
+              default = null;
+              example = "srs.example.com";
+              description = ''
+                Dedicated mail domain used for ephemeral SRS envelope addresses.
+
+                Recommended to configure, when hosting multiple unrelated mail
+                domains (e.g. for different customers), to prevent privacy
+                issues.
+
+                Set to `null` to not configure any `srs-domain`.
+              '';
+            };
+
+            socketmap = lib.mkOption {
+              type = lib.types.strMatching "^(unix|inet):.+";
+              default = "unix:/run/postsrsd/socket";
+              example = "inet:localhost:10003";
+              description = ''
+                Listener configuration in socket map format native to Postfix configuration.
+              '';
+            };
+
+            chroot-dir = lib.mkOption {
+              type = lib.types.str;
+              default = "";
+              readOnly = true;
+              description = ''
+                Path to chroot into at runtime as an additional layer of protection.
+
+                ::: {.note}
+                We confine the runtime environment through systemd hardening instead, so this option is read-only.
+                :::
+              '';
+            };
+
+            unprivileged-user = lib.mkOption {
+              type = lib.types.str;
+              default = "";
+              readOnly = true;
+              description = ''
+                Unprivileged user to drop privileges to.
+
+                ::: {.note}
+                Our systemd unit never runs postsrsd as a privileged process, so this option is read-only.
+                :::
+              '';
+            };
+          };
+        };
+        default = { };
+        description = ''
+          Configuration options for the postsrsd.conf file.
+
+          See the [example configuration](https://github.com/roehling/postsrsd/blob/${cfg.package.version}/doc/postsrsd.conf) for possible values.
+        '';
      };

-      separator = lib.mkOption {
-        type = lib.types.enum [
-          "-"
-          "="
-          "+"
-        ];
-        default = "=";
-        description = "First separator character in generated addresses";
+      configurePostfix = lib.mkOption {
+        type = lib.types.bool;
+        default = true;
+        description = ''
+          Whether to configure the required settings to use postsrsd in the local Postfix instance.
+        '';
      };

      user = lib.mkOption {
@@ -93,66 +230,120 @@ in
        default = "postsrsd";
        description = "Group for the daemon";
      };
-
-      socketPath = lib.mkOption {
-        type = lib.types.path;
-        default = "${runtimeDirectory}/socket";
-        readOnly = true;
-        description = ''
-          Path to the Unix socket for connecting to postsrsd.
-          Read-only, intended for usage when integrating postsrsd into other NixOS config.'';
-      };
    };
  };

-  config = lib.mkIf cfg.enable {
-    users.users = lib.optionalAttrs (cfg.user == "postsrsd") {
-      postsrsd = {
-        group = cfg.group;
-        uid = config.ids.uids.postsrsd;
+  config = lib.mkMerge [
+    (lib.mkIf (cfg.enable && cfg.configurePostfix && config.services.postfix.enable) {
+      services.postfix.config = {
+        # https://github.com/roehling/postsrsd#configuration
+        sender_canonical_maps = "socketmap:${cfg.settings.socketmap}:forward";
+        sender_canonical_classes = "envelope_sender";
+        recipient_canonical_maps = "socketmap:${cfg.settings.socketmap}:reverse";
+        recipient_canonical_classes = [
+          "envelope_recipient"
+          "header_recipient"
+        ];
      };
-    };

-    users.groups = lib.optionalAttrs (cfg.group == "postsrsd") {
-      postsrsd.gid = config.ids.gids.postsrsd;
-    };
+      users.users.postfix.extraGroups = [ cfg.group ];
+    })

-    systemd.services.postsrsd-generate-secrets = {
-      path = [ pkgs.coreutils ];
-      script = ''
-        if [ -e "${cfg.secretsFile}" ]; then
-          echo "Secrets file exists. Nothing to do!"
-        else
-          echo "WARNING: secrets file not found, autogenerating!"
-          DIR="$(dirname "${cfg.secretsFile}")"
-          install -m 750 -o ${cfg.user} -g ${cfg.group} -d "$DIR"
-          install -m 600 -o ${cfg.user} -g ${cfg.group} <(dd if=/dev/random bs=18 count=1 | base64) "${cfg.secretsFile}"
-        fi
-      '';
-      serviceConfig = {
-        Type = "oneshot";
+    (lib.mkIf cfg.enable {
+      users.users = lib.optionalAttrs (cfg.user == "postsrsd") {
+        postsrsd = {
+          group = cfg.group;
+          uid = config.ids.uids.postsrsd;
+        };
      };
-    };

-    systemd.services.postsrsd = {
-      description = "PostSRSd SRS rewriting server";
-      after = [
-        "network.target"
-        "postsrsd-generate-secrets.service"
-      ];
-      before = [ "postfix.service" ];
-      wantedBy = [ "multi-user.target" ];
-      requires = [ "postsrsd-generate-secrets.service" ];
-      confinement.enable = true;
-
-      serviceConfig = {
-        ExecStart = "${lib.getExe pkgs.postsrsd} -C ${configFile}";
-        User = cfg.user;
-        Group = cfg.group;
-        PermissionsStartOnly = true;
-        RuntimeDirectory = runtimeDirectoryName;
-        LoadCredential = "secrets-file:${cfg.secretsFile}";
+      users.groups = lib.optionalAttrs (cfg.group == "postsrsd") {
+        postsrsd.gid = config.ids.gids.postsrsd;
      };
-    };
-  };
+
+      systemd.services.postsrsd-generate-secrets = {
+        path = [ pkgs.coreutils ];
+        script = ''
+          if [ -e "${cfg.secretsFile}" ]; then
+            echo "Secrets file exists. Nothing to do!"
+          else
+            echo "WARNING: secrets file not found, autogenerating!"
+            DIR="$(dirname "${cfg.secretsFile}")"
+            install -m 750 -o ${cfg.user} -g ${cfg.group} -d "$DIR"
+            install -m 600 -o ${cfg.user} -g ${cfg.group} <(dd if=/dev/random bs=18 count=1 | base64) "${cfg.secretsFile}"
+          fi
+        '';
+        serviceConfig = {
+          Type = "oneshot";
+        };
+      };
+
+      environment.etc."postsrsd.conf".source = configFile;
+
+      systemd.services.postsrsd = {
+        description = "PostSRSd SRS rewriting server";
+        after = [
+          "network.target"
+          "postsrsd-generate-secrets.service"
+        ];
+        before = [ "postfix.service" ];
+        wantedBy = [ "multi-user.target" ];
+        requires = [ "postsrsd-generate-secrets.service" ];
+        restartTriggers = [ configFile ];
+
+        serviceConfig = {
+          ExecStart = utils.escapeSystemdExecArgs [
+            (lib.getExe cfg.package)
+            "-C"
+            "/etc/postsrsd.conf"
+          ];
+          User = cfg.user;
+          Group = cfg.group;
+          RuntimeDirectory = "postsrsd";
+          RuntimeDirectoryMode = "0750";
+          LoadCredential = "secrets-file:${cfg.secretsFile}";
+
+          CapabilityBoundingSet = [ "" ];
+          LockPersonality = true;
+          MemoryDenyWriteExecute = true;
+          NoNewPrivileges = true;
+          PrivateDevices = true;
+          PrivateMounts = true;
+          PrivateNetwork = lib.hasPrefix "unix:" cfg.settings.socketmap;
+          PrivateTmp = true;
+          PrivateUsers = true;
+          ProtectControlGroups = true;
+          ProtectHome = true;
+          ProtectHostname = true;
+          ProtectKernelLogs = true;
+          ProtectKernelModules = true;
+          ProtectKernelTunables = true;
+          ProtectSystem = "strict";
+          ProtectProc = "invisible";
+          ProcSubset = "pid";
+          RemoveIPC = true;
+          RestrictAddressFamilies =
+            if lib.hasPrefix "unix:" cfg.settings.socketmap then
+              [ "AF_UNIX" ]
+            else
+              [
+                "AF_INET"
+                "AF_INET6"
+              ];
+          RestrictNamespaces = true;
+          RestrictRealtime = true;
+          RestrictSUIDSGID = true;
+          SystemCallArchitectures = "native";
+          SystemCallFilter = [
+            "@system-service"
+            "~@privileged @resources"
+          ];
+          UMask = "0027";
+        };
+      };
+    })
+  ];
+
+  # package version referenced in option documentation
+  meta.buildDocsInSandbox = false;
 }
@@ -165,7 +165,39 @@ in
    };

    settings = lib.mkOption {
-      type = settingsFormat.type;
+      type = lib.types.submodule (
+        { config, ... }:
+        {
+          freeformType = settingsFormat.type;
+          options = {
+            video_transcription = {
+              enabled = lib.mkOption {
+                type = lib.types.bool;
+                default = false;
+                description = "Enable automatic transcription of videos.";
+              };
+              engine_path = lib.mkOption {
+                type = with lib.types; either path str;
+                default =
+                  if config.video_transcription.enabled then
+                    lib.getExe pkgs.whisper-ctranslate2
+                  else
+                    # This will be in the error message when someone enables
+                    # transcription manually in the web UI and tries to run a
+                    # transcription job.
+                    "Set `services.peertube.settings.video_transcription.enabled = true`.";
+                defaultText = lib.literalExpression ''
+                  if config.services.peertube.settings.video_transcription.enabled then
+                    lib.getExe pkgs.whisper-ctranslate2
+                  else
+                    "Set `services.peertube.settings.video_transcription.enabled = true`."
+                '';
+                description = "Custom engine path for local transcription.";
+              };
+            };
+          };
+        }
+      );
      example = lib.literalExpression ''
        {
          listen = {
@@ -424,7 +456,6 @@ in
        };
        video_transcription = {
          engine = lib.mkDefault "whisper-ctranslate2";
-          engine_path = lib.mkDefault (lib.getExe pkgs.whisper-ctranslate2);
        };
      }
      (lib.mkIf cfg.redis.enableUnixSocket {
@@ -135,6 +135,44 @@ in
                (legacyCredentials cfg)
              else
                null;
+
+            # hardening
+            DevicePolicy = "closed";
+            CapabilityBoundingSet = "";
+            RestrictAddressFamilies = [
+              "AF_INET"
+              "AF_INET6"
+              "AF_NETLINK"
+              "AF_UNIX"
+            ];
+            DeviceAllow = "";
+            NoNewPrivileges = true;
+            PrivateDevices = true;
+            PrivateMounts = true;
+            PrivateTmp = true;
+            PrivateUsers = true;
+            ProtectClock = true;
+            ProtectControlGroups = true;
+            ProtectHome = true;
+            ProtectKernelLogs = true;
+            ProtectKernelModules = true;
+            ProtectKernelTunables = true;
+            MemoryDenyWriteExecute = true;
+            LockPersonality = true;
+            RemoveIPC = true;
+            RestrictNamespaces = true;
+            RestrictRealtime = true;
+            RestrictSUIDSGID = true;
+            SystemCallArchitectures = "native";
+            SystemCallFilter = [
+              "@system-service"
+              "~@privileged"
+            ];
+            ProtectProc = "invisible";
+            ProtectHostname = true;
+            UMask = "0077";
+            # minio opens /proc/mounts on startup
+            ProcSubset = "all";
          };
          environment = {
            MINIO_REGION = "${cfg.region}";
@@ -242,7 +242,7 @@ let
              ''
            }

-            ${optionalString cfg.recommendedZstdSettings ''
+            ${optionalString cfg.experimentalZstdSettings ''
              zstd on;
              zstd_comp_level 9;
              zstd_min_length 256;
@@ -630,11 +630,11 @@ in
        '';
      };

-      recommendedZstdSettings = mkOption {
+      experimentalZstdSettings = mkOption {
        default = false;
        type = types.bool;
        description = ''
-          Enable recommended zstd settings.
+          Enable alpha quality zstd module with recommended settings.
          Learn more about compression in Zstd format [here](https://github.com/tokers/zstd-nginx-module).

          This adds `pkgs.nginxModules.zstd` to `services.nginx.additionalModules`.
@@ -1305,6 +1305,12 @@ in
      [ "services" "nginx" "proxyCache" "enable" ]
      [ "services" "nginx" "proxyCachePath" "" "enable" ]
    )
+    (mkRemovedOptionModule [ "services" "nginx" "recommendedZstdSettings" ] ''
+      The zstd module for Nginx has known bugs and is not maintained well. It is thus not
+      generally recommend to use it. You may enable anyway by setting
+      `services.nginx.experimentalZstdSettings` which adds the same configuration as the
+      removed option.
+    '')
  ];

  config = mkIf cfg.enable {
@@ -1453,7 +1459,7 @@ in

    services.nginx.additionalModules =
      optional cfg.recommendedBrotliSettings pkgs.nginxModules.brotli
-      ++ lib.optional cfg.recommendedZstdSettings pkgs.nginxModules.zstd;
+      ++ lib.optional cfg.experimentalZstdSettings pkgs.nginxModules.zstd;

    services.nginx.virtualHosts.localhost = mkIf cfg.statusPage {
      serverAliases = [ "127.0.0.1" ] ++ lib.optional config.networking.enableIPv6 "[::1]";
@@ -5,7 +5,6 @@ let
 in
 {
  name = "bazarr";
-  meta.maintainers = with lib.maintainers; [ d-xo ];

  nodes.machine =
    { pkgs, ... }:
@@ -1,7 +1,10 @@
 { lib, ... }:
 {
  name = "firefly-iii-data-importer";
-  meta.maintainers = [ lib.maintainers.savyajha ];
+  meta = {
+    maintainers = [ lib.maintainers.savyajha ];
+    platforms = lib.platforms.linux;
+  };

  nodes.dataImporter =
    { ... }:
@@ -18,9 +18,6 @@ import ../make-test-python.nix (
  in
  {
    name = "wg-quick";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ d-xo ];
-    };

    nodes = {
      peer0 = peer {
@@ -38,17 +38,17 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "reaper";
-  version = "7.41";
+  version = "7.42";

  src = fetchurl {
    url = url_for_platform version stdenv.hostPlatform.qemuArch;
    hash =
      if stdenv.hostPlatform.isDarwin then
-        "sha256-A4MM+hcpyhw6zE18fSSHBu38A0cYiXzjmM5wqj0Cgzk="
+        "sha256-3K2cgOwBRwm/S4MRcymKCxRhUMkcfuWzWn1G2m3Dbf4="
      else
        {
-          x86_64-linux = "sha256-9M3WZijLTeKt2Asg3cE1OgS6tm1T4V0Cer9J4GPfTh4=";
-          aarch64-linux = "sha256-/Ir1UFUOZOEZPkTG3ykHy6PcOuDf/rbvxOeRt5iJzls=";
+          x86_64-linux = "sha256-XxVcy3s3gOnh6uhv9r0yJFwBMCxhrnT/swaUY4t1CpY=";
+          aarch64-linux = "sha256-3DKVyooYi6aSBzP4DSnIchGyHKbCANjX0TPspKf5dXU=";
        }
        .${stdenv.hostPlatform.system};
  };
@@ -0,0 +1,12 @@
+diff --git a/configure.ac b/configure.ac
+index 5a80c6b..07c37bf 100644
+--- a/configure.ac
+++ b/configure.ac
+@@ -3,6 +3,7 @@ AC_CONFIG_SRCDIR([src/spek.cc])
+ AC_CONFIG_HEADERS([config.h])
+ AM_INIT_AUTOMAKE([1.11.1 foreign no-dist-gzip dist-xz serial-tests])
+ AM_SILENT_RULES([yes])
+AC_CONFIG_MACRO_DIRS([m4])
+ 
+ AC_LANG([C++])
+ AM_PROG_AR
@@ -22,6 +22,10 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-VYt2so2k3Rk3sLSV1Tf1G2pESYiXygrKr9Koop8ChCg=";
  };

+  patches = [
+    ./autoconf.patch
+  ];
+
  nativeBuildInputs = [
    autoreconfHook
    intltool
@@ -32,13 +32,13 @@ let
 in
 melpaBuild {
  pname = "lsp-bridge";
-  version = "0-unstable-2025-02-10";
+  version = "0-unstable-2025-06-28";

  src = fetchFromGitHub {
    owner = "manateelazycat";
    repo = "lsp-bridge";
-    rev = "4401d1396dce89d1fc5dc5414565818dd1c30ae0";
-    hash = "sha256-lWbFbYwJoy4UAezKUK7rnjQlDcnszHQwK5I7fuHfE8Y=";
+    rev = "3b37a04bd1b6bbcdc2b0ad7a5c388ad027eb7a25";
+    hash = "sha256-0pjRihJapljd/9nR7G+FC+gCqD82YGITPK2mcJcI7ZI=";
  };

  patches = [
@@ -1,8 +1,8 @@
 diff --git a/lsp-bridge.el b/lsp-bridge.el
-index 278c27e..f0c67c2 100644
+index d3e2ff7..1b1d745 100644
 --- a/lsp-bridge.el
 +++ b/lsp-bridge.el
-@@ -340,19 +340,7 @@ Setting this to nil or 0 will turn off the indicator."
+@@ -417,21 +417,7 @@ LSP-Bridge will enable completion inside string literals."
   "Name of LSP-Bridge buffer."
   :type 'string)
 
@@ -13,7 +13,9 @@ index 278c27e..f0c67c2 100644
 -                                                   "python3.exe")
 -                                                  ((executable-find "python.exe")
 -                                                   "python.exe")))
-                                           (t (cond ((executable-find "pypy3")
+-                                           (t (cond ((executable-find "python-lsp-bridge")
+-                                                     "python-lsp-bridge")
+-                                                    ((executable-find "pypy3")
 -                                                     "pypy3")
 -                                                    ((executable-find "python3")
 -                                                     "python3")
@@ -1509,7 +1509,7 @@ in
    dependencies = [ self.nvim-treesitter ];
  };

-  jdd-nvim = super.lazyjj-nvim.overrideAttrs {
+  jdd-nvim = super.jdd-nvim.overrideAttrs {
    dependencies = [ self.plenary-nvim ];
  };

@@ -1789,6 +1789,8 @@ let
        };
      };

+      ethersync.ethersync = callPackage ./ethersync.ethersync { };
+
      eugleo.magic-racket = callPackage ./eugleo.magic-racket { };

      ExiaHuang.dictionary = buildVscodeMarketplaceExtension {
@@ -0,0 +1,22 @@
+{
+  lib,
+  vscode-utils,
+}:
+
+vscode-utils.buildVscodeMarketplaceExtension {
+  mktplcRef = {
+    publisher = "ethersync";
+    name = "ethersync";
+    version = "0.2.1";
+    hash = "sha256-/oRpoYMWSpkAEM89KlJnSJ7TWwcGloYHXh80Ml+vz+M=";
+  };
+
+  meta = {
+    description = "Extension for real-time co-editing of local text files";
+    downloadPage = "https://marketplace.visualstudio.com/items?itemName=ethersync.ethersync";
+    homepage = "https://github.com/ethersync/ethersync/tree/main/vscode-plugin";
+    license = lib.licenses.agpl3Plus;
+    maintainers = [ lib.maintainers.ethancedwards8 ];
+    teams = [ lib.teams.ngi ];
+  };
+}
@@ -36,22 +36,22 @@ let

  hash =
    {
-      x86_64-linux = "sha256-72KrCDUBe+xJjnSY/nnrNH92EP4tp71x1fadh0Pe0DM=";
-      x86_64-darwin = "sha256-Ua3oh0Hv0oiW15u3Rb0pSYu+JD8m1oYMAm5pEzXD6Rw=";
-      aarch64-linux = "sha256-5L0ZArj+7M5dhZDGzYj6NaxYYZEb8q89Vhngvjuw7wQ=";
-      aarch64-darwin = "sha256-uWOF/QGgXocKZAkFMN4Kh7HjiQTSIi+PVPy3V90wrAA=";
-      armv7l-linux = "sha256-FyGPvQeVz8yLhLjFGtCXPTVPvCB0/EX6pRe5RCAmXTU=";
+      x86_64-linux = "sha256-rUAu69aUjLQsDT5hK8E5yWiMdVfNFqwx9aA8op1ZYj8=";
+      x86_64-darwin = "sha256-BOrLjZsA9QFtcsvgsohZbCRRRqTHhn043HHIpl40kPA=";
+      aarch64-linux = "sha256-DBthRZDeJF6xksMWGvXIC7vdTkQCyjt+oHUI+FbLBrU=";
+      aarch64-darwin = "sha256-TWa2jMRBR0a0SOUkrnZw6Ej3cRGdZd0Gw5Obt11M45k=";
+      armv7l-linux = "sha256-SYrXdEzIYG/2ih3vqCTfIo+6jTvMJe+rIOzNQXfd+es=";
    }
    .${system} or throwSystem;
 in
 callPackage ./generic.nix rec {
  # Please backport all compatible updates to the stable release.
  # This is important for the extension ecosystem.
-  version = "1.101.2";
+  version = "1.102.1";
  pname = "vscode" + lib.optionalString isInsiders "-insiders";

  # This is used for VS Code - Remote SSH test
-  rev = "2901c5ac6db8a986a5666c3af51ff804d05af0d4";
+  rev = "7adae6a56e34cb64d08899664b814cf620465925";

  executableName = "code" + lib.optionalString isInsiders "-insiders";
  longName = "Visual Studio Code" + lib.optionalString isInsiders " - Insiders";
@@ -75,7 +75,7 @@ callPackage ./generic.nix rec {
    src = fetchurl {
      name = "vscode-server-${rev}.tar.gz";
      url = "https://update.code.visualstudio.com/commit:${rev}/server-linux-x64/stable";
-      hash = "sha256-Bocoiz8pxQNAZxmWdOgh+y44QTnqvDjcqFCodny7VoY=";
+      hash = "sha256-EP5xCkCSMROB60OmDFWVWF9qHqW8pjKWPh6mSUU5E7A=";
    };
    stdenv = stdenvNoCC;
  };
@@ -132,9 +132,9 @@ rec {

  unstable = fetchurl rec {
    # NOTE: Don't forget to change the hash for staging as well.
-    version = "10.7";
+    version = "10.12";
    url = "https://dl.winehq.org/wine/source/10.x/wine-${version}.tar.xz";
-    hash = "sha256-dRNnoxCZkNcD5ZDi21MBh8Th39Lo5hNzq4S0L+EbGPo=";
+    hash = "sha256-zVcscaPXLof5hJCyKMfCaq6z/eON2eefw7VjkdWZ1r8=";

    patches = [
      # Also look for root certificates at $NIX_SSL_CERT_FILE
@@ -144,7 +144,7 @@ rec {
    # see https://gitlab.winehq.org/wine/wine-staging
    staging = fetchFromGitLab {
      inherit version;
-      hash = "sha256-4doo7B3eEoQaml6KX02OhcLGGiLcgNhYq4ry/iB7kLc=";
+      hash = "sha256-a5Vw9UVawx/vvTeu6SGxf4C1GwvdmpPJDyuW0PCUob8=";
      domain = "gitlab.winehq.org";
      owner = "wine";
      repo = "wine-staging";
@@ -167,9 +167,9 @@ rec {

    ## see http://wiki.winehq.org/Mono
    mono = fetchurl rec {
-      version = "10.0.0";
+      version = "10.1.0";
      url = "https://dl.winehq.org/wine/wine-mono/${version}/wine-mono-${version}-x86.msi";
-      hash = "sha256-26ynPl0J96OnwVetBCia+cpHw87XAS1GVEpgcEaQK4c=";
+      hash = "sha256-yIwkMYkLwyys7I1+pw5Tpa5LlcjFXKbnXvjbDkzPEHA=";
    };

    updateScript = writeShellScript "update-wine-unstable" ''
@@ -85,13 +85,13 @@ in

 stdenv.mkDerivation (finalAttrs: {
  pname = "imagemagick";
-  version = "7.1.1-47";
+  version = "7.1.2-0";

  src = fetchFromGitHub {
    owner = "ImageMagick";
    repo = "ImageMagick";
    tag = finalAttrs.version;
-    hash = "sha256-lRPGVGv86vH7Q1cLoLp8mOAkxcHTHgUrx0mmKgl1oEc=";
+    hash = "sha256-4x0+yELmXstv9hPuwzMGcKiTa1rZtURZgwSSVIhzAkE=";
  };

  outputs = [
@@ -89,6 +89,11 @@ stdenv.mkDerivation (finalAttrs: {
    ./force-enable-libheif.patch
  ];

+  # error: possibly undefined macro: AM_NLS
+  preAutoreconf = ''
+    cp ${gettext}/share/gettext/m4/nls.m4 m4macros
+  '';
+
  nativeBuildInputs =
    [
      autoreconfHook # hardcode-plugin-interpreters.patch changes Makefile.am
@@ -1,10 +1,10 @@
 {
  "chromium": {
-    "version": "138.0.7204.100",
+    "version": "138.0.7204.157",
    "chromedriver": {
-      "version": "138.0.7204.101",
-      "hash_darwin": "sha256-ow+R2jcfm5tryB6UfnUNklVfLGc2Tzj2W6Nul6pRglI=",
-      "hash_darwin_aarch64": "sha256-GGcDoSkH8Z4N8yOL77nNMtz3BY4lNwlD10SPhEBRpJI="
+      "version": "138.0.7204.158",
+      "hash_darwin": "sha256-rNd7glDAVNkd4CNn4k3rdpb//yD/ccpebnGhDv1EGb8=",
+      "hash_darwin_aarch64": "sha256-oUMFW09mp2aUgplboMHaKvTVbKtqAy5C0KsA7DXbElc="
    },
    "deps": {
      "depot_tools": {
@@ -20,8 +20,8 @@
    "DEPS": {
      "src": {
        "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "5f45b4744e3d5ba82c2ca6d942f1e7a516110752",
-        "hash": "sha256-bI75IXPl6YeauK2oTnUURh1ch1H7KKw/QzKYZ/q6htI=",
+        "rev": "e533e98b1267baa1f1c46d666b120e64e5146aa9",
+        "hash": "sha256-LbZ8/6Lvz1p3ydRL4fXtd7RL426PU3jU01Hx+DP5QYQ=",
        "recompress": true
      },
      "src/third_party/clang-format/script": {
@@ -96,8 +96,8 @@
      },
      "src/third_party/angle": {
        "url": "https://chromium.googlesource.com/angle/angle.git",
-        "rev": "df15136b959fc60c230265f75ee7fc75c96e8250",
-        "hash": "sha256-b4bGxhtrsfmVdJo/5QT4/mtQ6hqxmfpmcrieqaT9/ls="
+        "rev": "e1dc0a7ab5d1f1f2edaa7e41447d873895e083bf",
+        "hash": "sha256-tkHvTkqbm4JtWnh41iu0aJ9Jo34hYc7aOKuuMQmST4c="
      },
      "src/third_party/angle/third_party/glmark2/src": {
        "url": "https://chromium.googlesource.com/external/github.com/glmark2/glmark2",
@@ -131,8 +131,8 @@
      },
      "src/third_party/dawn": {
        "url": "https://dawn.googlesource.com/dawn.git",
-        "rev": "86772f20cca54b46f62b65ece1ef61224aef09db",
-        "hash": "sha256-N9DVbQE56WWBmJ/PJlYhU+pr8I+PFf/7FzMLCNqx3hg="
+        "rev": "1fde167ae683982d77b9ca7e1308bf9f498291e8",
+        "hash": "sha256-PbDTKSU19jn2hLDoazceYB/Rd6/qu6npPSrjOdeXFuU="
      },
      "src/third_party/dawn/third_party/glfw": {
        "url": "https://chromium.googlesource.com/external/github.com/glfw/glfw",
@@ -246,8 +246,8 @@
      },
      "src/third_party/devtools-frontend/src": {
        "url": "https://chromium.googlesource.com/devtools/devtools-frontend",
-        "rev": "a6dbe06dafbad00ef4b0ea139ece1a94a5e2e6d8",
-        "hash": "sha256-XkyJFRxo3ZTBGfKdTwSIo14SLNPQAKQvY4lEX03j6LM="
+        "rev": "4cca0aa00c4915947f1081014d5cfa2e83d357fa",
+        "hash": "sha256-pVNr8NB5U/Uf688oOvPLpu81isCn/WmjJky01A000a4="
      },
      "src/third_party/dom_distiller_js/dist": {
        "url": "https://chromium.googlesource.com/chromium/dom-distiller/dist.git",
@@ -796,8 +796,8 @@
      },
      "src/v8": {
        "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "e5b4c78b54e8b033b2701db3df0bf67d3030e4c1",
-        "hash": "sha256-5y/yNZopnwtDrG+BBU6fMEi0yJJoYvsygQR+fl6vS/Y="
+        "rev": "de9d0f8b56ae61896e4d2ac577fc589efb14f87d",
+        "hash": "sha256-/T5fisjmN80bs3PtQrCRfH3Bo9dRSd3f+xpPLDh1RTY="
      }
    }
  },
@@ -9,54 +9,54 @@ let
  versions =
    if stdenv.hostPlatform.isLinux then
      {
-        stable = "0.0.100";
-        ptb = "0.0.148";
-        canary = "0.0.709";
-        development = "0.0.81";
+        stable = "0.0.101";
+        ptb = "0.0.151";
+        canary = "0.0.716";
+        development = "0.0.83";
      }
    else
      {
-        stable = "0.0.350";
-        ptb = "0.0.179";
-        canary = "0.0.808";
-        development = "0.0.94";
+        stable = "0.0.353";
+        ptb = "0.0.181";
+        canary = "0.0.823";
+        development = "0.0.96";
      };
  version = versions.${branch};
  srcs = rec {
    x86_64-linux = {
      stable = fetchurl {
        url = "https://stable.dl2.discordapp.net/apps/linux/${version}/discord-${version}.tar.gz";
-        hash = "sha256-3trE9awddfB1ZasJQjbQc0xOoTqIRY0thEwL7Uz5+O8=";
+        hash = "sha256-FB6GiCM+vGyjZLtF0GjAIq8etK5FYyQVisWX6IzB4Zc=";
      };
      ptb = fetchurl {
        url = "https://ptb.dl2.discordapp.net/apps/linux/${version}/discord-ptb-${version}.tar.gz";
-        hash = "sha256-VRhcnjbC42nFZ3DepKNX75pBl0GeDaSWM1SGXJpuQs0=";
+        hash = "sha256-7fQFCPUj59c/OfuNa4RDxGexAKZXLL7M+7n36WE5qDg=";
      };
      canary = fetchurl {
        url = "https://canary.dl2.discordapp.net/apps/linux/${version}/discord-canary-${version}.tar.gz";
-        hash = "sha256-2lzXTuE+nkyw+GG9nAMxIIloAlEngY9Q6OKfbrWgFiI=";
+        hash = "sha256-W7uPrJRKY4I6nsdj/TNxT8kHh5ssn9KyCArhOhAlaH4=";
      };
      development = fetchurl {
        url = "https://development.dl2.discordapp.net/apps/linux/${version}/discord-development-${version}.tar.gz";
-        hash = "sha256-njkuWtk+359feEYtWJSDukvbD5duXuRIr1m5cJVhNvs=";
+        hash = "sha256-KpZ90VekGf3KNpNpFfZlVXorv86yK1OuY0uqgBuWIQ4=";
      };
    };
    x86_64-darwin = {
      stable = fetchurl {
        url = "https://stable.dl2.discordapp.net/apps/osx/${version}/Discord.dmg";
-        hash = "sha256-Giz0bE16v2Q2jULcnZMI1AY8zyjZ03hw4KVpDPJOmCo=";
+        hash = "sha256-qHOLhPhHwN0fy1KiJroJvshlYExBDsuna2PddjtNyEI=";
      };
      ptb = fetchurl {
        url = "https://ptb.dl2.discordapp.net/apps/osx/${version}/DiscordPTB.dmg";
-        hash = "sha256-tGE7HAcWLpGlv5oXO7NEELdRtNfbhlpQeNc5zB7ba1A=";
+        hash = "sha256-Q153X08crRpXZMMgNDYbADHnL7MiBPCakJxQe8Pl0Uo=";
      };
      canary = fetchurl {
        url = "https://canary.dl2.discordapp.net/apps/osx/${version}/DiscordCanary.dmg";
-        hash = "sha256-Cu7U70yzHgOAJjtEx85T3x9f1oquNz7VNsX53ISbzKg=";
+        hash = "sha256-69Q8kTfenlmhjptVSQ9Y0AyeViRw+srMExOA7fAlaGw=";
      };
      development = fetchurl {
        url = "https://development.dl2.discordapp.net/apps/osx/${version}/DiscordDevelopment.dmg";
-        hash = "sha256-+bmzdkOSMpKnLGEoeXmAJSv2UHzirOLe1HDHAdHG2U8=";
+        hash = "sha256-fe7yE+dxEATIdfITg57evbaQkChCcoaLrzV+8KwEBws=";
      };
    };
    aarch64-darwin = x86_64-darwin;
@@ -11,13 +11,13 @@

 stdenv.mkDerivation rec {
  pname = "git-recent";
-  version = "2.0.2";
+  version = "2.0.4";

  src = fetchFromGitHub {
    owner = "paulirish";
    repo = "git-recent";
    rev = "v${version}";
-    sha256 = "sha256-BwnSDIBGjhfQ9mA/29NfWYaVZGXzZudX9LsCdRlnT0I=";
+    sha256 = "sha256-b6AWLEXCOza+lIHlvyYs3M6yHGr2StYXzl7OsA9gv/k=";
  };

  nativeBuildInputs = [ makeWrapper ];
@@ -65,10 +65,10 @@ let
      }
      ''
        mkdir -p $out/bin
-        makeWrapper ${Agda.bin}/bin/agda $out/bin/agda \
+        makeWrapper ${lib.getExe Agda} $out/bin/agda \
          ${lib.optionalString (ghc != null) ''--add-flags "--with-compiler=${ghc}/bin/ghc"''} \
          --add-flags "--library-file=${library-file}"
-        ln -s ${Agda.bin}/bin/agda-mode $out/bin/agda-mode
+        ln -s ${lib.getExe' Agda "agda-mode"} $out/bin/agda-mode
      '';

  withPackages = arg: if isAttrs arg then withPackages' arg else withPackages' { pkgs = arg; };
@@ -3,7 +3,6 @@
  makeSetupHook,
  jq,
  writeShellApplication,
-  moreutils,
  cacert,
  buildPackages,
 }:
@@ -18,9 +17,8 @@ in
 {
  composerRepositoryHook = makeSetupHook {
    name = "composer-repository-hook.sh";
-    propagatedBuildInputs = [
+    propagatedNativeBuildInputs = [
      jq
-      moreutils
      cacert
    ];
    substitutions = {
@@ -30,9 +28,8 @@ in

  composerInstallHook = makeSetupHook {
    name = "composer-install-hook.sh";
-    propagatedBuildInputs = [
+    propagatedNativeBuildInputs = [
      jq
-      moreutils
      cacert
    ];
    substitutions = {
@@ -45,9 +42,8 @@ in

  composerWithPluginVendorHook = makeSetupHook {
    name = "composer-with-plugin-vendor-hook.sh";
-    propagatedBuildInputs = [
+    propagatedNativeBuildInputs = [
      jq
-      moreutils
      cacert
    ];
    substitutions = {
@@ -3,7 +3,6 @@
  makeSetupHook,
  jq,
  writeShellApplication,
-  moreutils,
  cacert,
  buildPackages,
 }:
@@ -18,9 +17,8 @@ in
 {
  composerVendorHook = makeSetupHook {
    name = "composer-vendor-hook.sh";
-    propagatedBuildInputs = [
+    propagatedNativeBuildInputs = [
      jq
-      moreutils
      cacert
    ];
    substitutions = {
@@ -30,9 +28,8 @@ in

  composerInstallHook = makeSetupHook {
    name = "composer-install-hook.sh";
-    propagatedBuildInputs = [
+    propagatedNativeBuildInputs = [
      jq
-      moreutils
      cacert
    ];
    substitutions = {
@@ -740,6 +740,7 @@ rec {
      name ? lib.warn "calling makeSetupHook without passing a name is deprecated." "hook",
      # hooks go in nativeBuildInputs so these will be nativeBuildInputs
      propagatedBuildInputs ? [ ],
+      propagatedNativeBuildInputs ? [ ],
      # these will be buildInputs
      depsTargetTargetPropagated ? [ ],
      meta ? { },
@@ -758,6 +759,7 @@ rec {
          inherit meta;
          inherit depsTargetTargetPropagated;
          inherit propagatedBuildInputs;
+          inherit propagatedNativeBuildInputs;
          strictDeps = true;
          # TODO 2023-01, no backport: simplify to inherit passthru;
          passthru =
@@ -1,140 +1,30 @@
 {
  lib,
  stdenv,
-  buildPythonPackage,
+  python312Packages,
  fetchFromGitHub,
  replaceVars,
  gitMinimal,
  portaudio,
  playwright-driver,
-  pythonOlder,
-  pythonAtLeast,
-  setuptools-scm,
-  aiohappyeyeballs,
-  aiohttp,
-  aiosignal,
-  annotated-types,
-  anyio,
-  attrs,
-  backoff,
-  beautifulsoup4,
-  cachetools,
-  certifi,
-  cffi,
-  charset-normalizer,
-  click,
-  configargparse,
-  diff-match-patch,
-  diskcache,
-  distro,
-  filelock,
-  flake8,
-  frozenlist,
-  fsspec,
-  gitdb,
-  gitpython,
-  google-ai-generativelanguage,
-  google-generativeai,
-  grep-ast,
-  h11,
-  hf-xet,
-  httpcore,
-  httpx,
-  huggingface-hub,
-  idna,
-  importlib-resources,
-  jinja2,
-  jiter,
-  json5,
-  jsonschema,
-  jsonschema-specifications,
-  litellm,
-  markdown-it-py,
-  markupsafe,
-  mccabe,
-  mdurl,
-  multidict,
-  networkx,
-  numpy,
-  openai,
-  oslex,
-  packaging,
-  pathspec,
-  pexpect,
-  pillow,
-  prompt-toolkit,
-  psutil,
-  ptyprocess,
-  pycodestyle,
-  pycparser,
-  pydantic,
-  pydantic-core,
-  pydub,
-  pyflakes,
-  pygments,
-  pypandoc,
-  pyperclip,
-  python-dotenv,
-  pyyaml,
-  referencing,
-  regex,
-  requests,
-  rich,
-  rpds-py,
-  scipy,
-  shtab,
-  smmap,
-  sniffio,
-  sounddevice,
-  socksio,
-  soundfile,
-  soupsieve,
-  tiktoken,
-  tokenizers,
-  tqdm,
-  tree-sitter,
-  tree-sitter-language-pack,
-  typing-extensions,
-  typing-inspection,
-  urllib3,
-  watchfiles,
-  wcwidth,
-  yarl,
-  zipp,
-  pip,
-  mixpanel,
-  monotonic,
-  posthog,
-  propcache,
-  python-dateutil,
-  pytestCheckHook,
-  greenlet,
-  playwright,
-  pyee,
-  streamlit,
-  llama-index-core,
-  llama-index-embeddings-huggingface,
-  torch,
-  nltk,
-  boto3,
  nix-update-script,
 }:

 let
-  aider-nltk-data = nltk.dataDir (d: [
+  # dont support python 3.13 (Aider-AI/aider#3037)
+  python3Packages = python312Packages;
+
+  aider-nltk-data = python3Packages.nltk.dataDir (d: [
    d.punkt-tab
    d.stopwords
  ]);

  version = "0.85.1";
-  aider-chat = buildPythonPackage {
+  aider-chat = python3Packages.buildPythonApplication {
    pname = "aider-chat";
    inherit version;
    pyproject = true;

-    # dont support python 3.13 (Aider-AI/aider#3037)
-    disabled = pythonOlder "3.10" || pythonAtLeast "3.13";
-
    src = fetchFromGitHub {
      owner = "Aider-AI";
      repo = "aider";
@@ -144,9 +34,9 @@ let

    pythonRelaxDeps = true;

-    build-system = [ setuptools-scm ];
+    build-system = with python3Packages; [ setuptools-scm ];

-    dependencies = [
+    dependencies = with python3Packages; [
      aiohappyeyeballs
      aiohttp
      aiosignal
@@ -251,19 +141,20 @@ let
    buildInputs = [ portaudio ];

    nativeCheckInputs = [
-      pytestCheckHook
+      python3Packages.pytestCheckHook
      gitMinimal
    ];

    patches = [
      (replaceVars ./fix-flake8-invoke.patch {
-        flake8 = lib.getExe flake8;
+        flake8 = lib.getExe python3Packages.flake8;
      })
    ];

    disabledTestPaths = [
      # Tests require network access
      "tests/scrape/test_scrape.py"
+      "tests/basic/test_repomap.py"
      # Expected 'mock' to have been called once
      "tests/help/test_help.py"
    ];
@@ -273,6 +164,7 @@ let
        # Tests require network
        "test_urls"
        "test_get_commit_message_with_custom_prompt"
+        "test_cmd_tokens_output"
        # FileNotFoundError
        "test_get_commit_message"
        # Expected 'launch_gui' to have been called once
@@ -306,7 +198,7 @@ let
      export AIDER_ANALYTICS="false"
    '';

-    optional-dependencies = {
+    optional-dependencies = with python3Packages; {
      playwright = [
        greenlet
        playwright
@@ -8,13 +8,13 @@
 }:
 stdenv.mkDerivation {
  pname = "airwindows";
-  version = "0-unstable-2025-06-28";
+  version = "0-unstable-2025-07-06";

  src = fetchFromGitHub {
    owner = "airwindows";
    repo = "airwindows";
-    rev = "8aedc304ed6fd44dd170cbfc6a43a3f138835af9";
-    hash = "sha256-pQOuhXypo55GqsoCmhpjQkSIsEOVL7y6xqmMqP8yzqI=";
+    rev = "4a19d80d3d2a64a8773ca319a5002ac5eefbf69c";
+    hash = "sha256-aMPe1D1/hIVY4DGKzmX/HUO04pZVBtivhVzoeG02emY=";
  };

  # we patch helpers because honestly im spooked out by where those variables
@@ -5,7 +5,7 @@
  "packages": {
    "": {
      "dependencies": {
-        "@sourcegraph/amp": "^0.0.1750924878-gfee7d7"
+        "@sourcegraph/amp": "^0.0.1752566512-ga67426"
      }
    },
    "node_modules/@colors/colors": {
@@ -29,9 +29,9 @@
      }
    },
    "node_modules/@sourcegraph/amp": {
-      "version": "0.0.1750924878-gfee7d7",
-      "resolved": "https://registry.npmjs.org/@sourcegraph/amp/-/amp-0.0.1750924878-gfee7d7.tgz",
-      "integrity": "sha512-3TZRSPaQY1eSIyAy4m/wSmW8CUq33r1oZfxguq2IWBLYdud90vPoLgOf6Hl9ZX3bkiLVRiU34oXXMmhb2Z5nzA==",
+      "version": "0.0.1752566512-ga67426",
+      "resolved": "https://registry.npmjs.org/@sourcegraph/amp/-/amp-0.0.1752566512-ga67426.tgz",
+      "integrity": "sha512-nz+iPJwZs0ONCnh/pCX2sfm47nCCegl9OLMUx2Z3ZW604ZTQ8w0IeiBs1Gzjlt8EnXlBR8tWY6f5ff+DT8UihA==",
      "dependencies": {
        "@vscode/ripgrep": "1.15.11",
        "commander": "^11.1.0",
@@ -43,7 +43,7 @@
        "xdg-basedir": "^5.1.0"
      },
      "bin": {
-        "amp": "dist/amp.js"
+        "amp": "dist/main.js"
      },
      "engines": {
        "node": ">=18"
@@ -9,11 +9,11 @@

 buildNpmPackage (finalAttrs: {
  pname = "amp-cli";
-  version = "0.0.1750924878-gfee7d7";
+  version = "0.0.1752566512-ga67426";

  src = fetchzip {
    url = "https://registry.npmjs.org/@sourcegraph/amp/-/amp-${finalAttrs.version}.tgz";
-    hash = "sha256-scp4Nw6fwn8uB5oLPg6eWkT7+YGFV/B5VlQbbFimsLg=";
+    hash = "sha256-TgSqpczEFIW6doWzgfPg2y+o+64ntPMbTJ0FVzCGNOg=";
  };

  postPatch = ''
@@ -45,7 +45,7 @@ buildNpmPackage (finalAttrs: {
    chmod +x bin/amp-wrapper.js
  '';

-  npmDepsHash = "sha256-INH8Pulds05pZm6DeaFYfZR+1derav2ZjQC6aPx+8qA=";
+  npmDepsHash = "sha256-avgj8q1pyepWSt4RFK1+9Fqwtc7Z1Voz2RUYKuViZA0=";

  propagatedBuildInputs = [
    ripgrep
@@ -7,10 +7,10 @@
 }:
 let
  pname = "archipelago";
-  version = "0.6.1";
+  version = "0.6.2";
  src = fetchurl {
    url = "https://github.com/ArchipelagoMW/Archipelago/releases/download/${version}/Archipelago_${version}_linux-x86_64.AppImage";
-    hash = "sha256-8mPlR5xVnHL9I0rV4bMFaffSJv7dMlCcPHrLkM/pyVU=";
+    hash = "sha256-DdlfHb8iTCfTGGBUYQeELYh2NF/2GcamtuJzeYb2A5M=";
  };

  appimageContents = appimageTools.extractType2 { inherit pname version src; };
@@ -40,7 +40,10 @@ appimageTools.wrapType2 {
    changelog = "https://github.com/ArchipelagoMW/Archipelago/releases/tag/${version}";
    license = lib.licenses.mit;
    mainProgram = "archipelago";
-    maintainers = with lib.maintainers; [ pyrox0 ];
+    maintainers = with lib.maintainers; [
+      pyrox0
+      iqubic
+    ];
    platforms = lib.platforms.linux;
  };
 }
@@ -29,13 +29,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "ares";
-  version = "144";
+  version = "145";

  src = fetchFromGitHub {
    owner = "ares-emulator";
    repo = "ares";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-BpVyPdtsIUstLVf/HGO6vcAlLgJP5SgJbZtqEV/uJ2g=";
+    hash = "sha256-es+K5+qlK7FcJCFEIMcOsXCZSnoXEEmtS0yhpCvaILM";
  };

  nativeBuildInputs =
@@ -12,13 +12,13 @@

 stdenv.mkDerivation rec {
  pname = "audacious";
-  version = "4.4.2";
+  version = "4.5";

  src = fetchFromGitHub {
    owner = "audacious-media-player";
    repo = "audacious";
    rev = "${pname}-${version}";
-    hash = "sha256-Vh39uY15Pj2TbPk8gU55YykhFf5ytSUxN2gJ0VlC3tQ=";
+    hash = "sha256-oYssIeVAvz2nx/3GRxgmsUjp2mnEFMem0WNPJG9l14E=";
  };

  nativeBuildInputs = [
@@ -65,14 +65,14 @@ let
 in
 py.pkgs.buildPythonApplication rec {
  pname = "awscli2";
-  version = "2.27.49"; # N.B: if you change this, check if overrides are still up-to-date
+  version = "2.27.50"; # N.B: if you change this, check if overrides are still up-to-date
  pyproject = true;

  src = fetchFromGitHub {
    owner = "aws";
    repo = "aws-cli";
    tag = version;
-    hash = "sha256-fg4UMAsylJJ0Xy8s84Qr7OdiFrzMIP9RsAH+pYDThrU=";
+    hash = "sha256-ITiZ144YFhwuRcfhulLF0jxpp1OgznEE8frx4Yn4V+A=";
  };

  postPatch = ''
@@ -22,16 +22,16 @@ let
 in
 buildNpmPackage' rec {
  pname = "balena-cli";
-  version = "22.1.1";
+  version = "22.1.2";

  src = fetchFromGitHub {
    owner = "balena-io";
    repo = "balena-cli";
    rev = "v${version}";
-    hash = "sha256-KEYzYIrcJdpicu4L09UVAU25fC8bWbIYJOuSpCHU3K4=";
+    hash = "sha256-akrZca9bRKqEVgmTKS0n1XliVhDq2eeH1Bo5ubjpYnc=";
  };

-  npmDepsHash = "sha256-jErFmkOQ3ySdLLXDh0Xl2tcWlfxnL2oob+x7QDuLJ8w=";
+  npmDepsHash = "sha256-Xq5pp1NNOXyCXnq1mNDaxktbjSzz3T0vOYsYZ7drUNQ=";

  postPatch = ''
    ln -s npm-shrinkwrap.json package-lock.json
@@ -11,13 +11,15 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "basiliskii";
-  version = "unstable-2022-09-30";
+  version = "unstable-2025-07-16";

+  # This src is also used to build pkgs/os-specific/linux/sheep-net
+  # Therefore changes to it may effect the sheep-net package
  src = fetchFromGitHub {
    owner = "kanjitalk755";
    repo = "macemu";
-    rev = "2fa17a0783cf36ae60b77b5ed930cda4dc1824af";
-    sha256 = "+jkns6H2YjlewbUzgoteGSQYWJL+OWVu178aM+BtABM=";
+    rev = "030599cf8d31cb80afae0e1b086b5706dbdd2eea";
+    sha256 = "sha256-gxaj+2ymelH6uWmjMLXi64xMNrToo6HZcJ7RW7sVMzo=";
  };
  sourceRoot = "${finalAttrs.src.name}/BasiliskII/src/Unix";
  patches = [ ./remove-redhat-6-workaround-for-scsi-sg.h.patch ];
@@ -66,7 +66,6 @@ stdenv.mkDerivation rec {
    homepage = "https://www.bazarr.media/";
    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
    license = licenses.gpl3Only;
-    maintainers = with maintainers; [ d-xo ];
    mainProgram = "bazarr";
    platforms = platforms.all;
  };
@@ -9,10 +9,10 @@
 }:
 let
  pname = "beeper";
-  version = "4.0.779";
+  version = "4.0.821";
  src = fetchurl {
    url = "https://beeper-desktop.download.beeper.com/builds/Beeper-${version}.AppImage";
-    hash = "sha256-eRA/9OAWcYsn1C8xuC6NFj2/HxOHT0YISDC9Kp8H/Yg=";
+    hash = "sha256-bBQUCZ9v2MrGpziaSTVNRootXln51arO3NeuIRiMwZA=";
  };
  appimageContents = appimageTools.extract {
    inherit pname version src;
@@ -8,17 +8,17 @@

 buildGoModule rec {
  pname = "bento";
-  version = "1.8.2";
+  version = "1.9.0";

  src = fetchFromGitHub {
    owner = "warpstreamlabs";
    repo = "bento";
    tag = "v${version}";
-    hash = "sha256-EAEeyMWXL/OL/LGgOQxvXtwrrVXtqY05AMeU5z86tks=";
+    hash = "sha256-rAm9Jn1elux02W0sbMOvQmYyg9ONuSqyStVt1ieTFBk=";
  };

  proxyVendor = true;
-  vendorHash = "sha256-N3YkY1wfxdPnwbEXDxHi/J3Oi3qiNtDMOwvSThX6cf0=";
+  vendorHash = "sha256-Dwf4q5lXO2gtvfB0Ib5LmaXg/MSNir+RzLU4rfE/mB4=";

  subPackages = [
    "cmd/bento"
@@ -1,6 +1,6 @@
 # Generated by ./update.sh - do not update manually!
 {
-  version = "1.16.5-2";
-  arm64-hash = "sha256-7zbiswG0Q7cRMkJI22uk7VIpA8s5XS1CRL9nDyqUfq0=";
-  x86_64-hash = "sha256-zTbHNrd75w0x2dYOfxyH37GlgG8HT0YExUxZQU+1M/Q=";
+  version = "1.16.5-4";
+  arm64-hash = "sha256-8APk13cLzhOaPXCpkdX5OLpXM/EV93uR2LHuMaBeUb0=";
+  x86_64-hash = "sha256-S7R4XmBnqyXugwf5henOZG5TzGUw4IrU42SXINm6Wcw=";
 }
@@ -43,7 +43,6 @@ buildNpmPackage rec {
    homepage = "https://github.com/janoside/btc-rpc-explorer";
    license = lib.licenses.mit;
    mainProgram = "btc-rpc-explorer";
-    maintainers = with lib.maintainers; [ d-xo ];
    broken = true;
    # At 2024-06-29
    # https://hydra.nixos.org/build/264232177/nixlog/1
@@ -11,17 +11,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "cargo-codspeed";
-  version = "3.0.1";
+  version = "3.0.2";

  src = fetchFromGitHub {
    owner = "CodSpeedHQ";
    repo = "codspeed-rust";
    rev = "v${version}";
-    hash = "sha256-RlI4kfq9FS6f3o4mp6FF27S7ScK5oa61B+4+1f6XH1U=";
+    hash = "sha256-u/6pQSmm069IVXfk7Jy7zCYiGz8yNRz8z3XrBG/1Td0=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-Fu3A9v8Q6wSG8zmhIjQdWhbL1ygeFjOPY9lbQGnXFI8=";
+  cargoHash = "sha256-OdP01hgJfkxV9htGEoUs/xgbyWDEiyxT3NQLbAlt4K8=";

  nativeBuildInputs = [
    curl
@@ -8,17 +8,17 @@
 }:
 rustPlatform.buildRustPackage rec {
  pname = "cargo-leptos";
-  version = "0.2.36";
+  version = "0.2.38";

  src = fetchFromGitHub {
    owner = "leptos-rs";
    repo = "cargo-leptos";
    rev = "v${version}";
-    hash = "sha256-ogX8kfCC+1sh9VXT9eYDJSNtX5WH/QF5LtOOkR90Snc=";
+    hash = "sha256-RrgWIT6pCD7MY8SwuVPNdlEl81iT5zhVbT6y9LcpY1Y=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-USMJeyNdxEOQctsVCvD1ImuEIzbzskVoz6rcU270AFg=";
+  cargoHash = "sha256-0XsSa8/Utsqug+6rQ13drXQGgxJ7bxDwmACaZCmErws=";

  nativeBuildInputs = [ pkg-config ];

@@ -6,17 +6,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "cargo-llvm-lines";
-  version = "0.4.42";
+  version = "0.4.43";

  src = fetchFromGitHub {
    owner = "dtolnay";
    repo = "cargo-llvm-lines";
    rev = version;
-    hash = "sha256-qKdxnISussiyp1ylahS7qOdMfOGwJnlbWrgEHf/L2y0=";
+    hash = "sha256-fYoVPm3RxR1LZ8wJQpXQG3g69Fh7LLFwXZXmj+kr8zc=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-Ppuc6Dx3Y4JJ8doEJPCbwnD1+dQSLRuPdWfab+3q2Ug=";
+  cargoHash = "sha256-yhZ2MKswFvzkMamI9np7CRsQO4D/sldumaLPzSNsHgA=";

  meta = with lib; {
    description = "Count the number of lines of LLVM IR across all instantiations of a generic function";
@@ -7,17 +7,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "cargo-nextest";
-  version = "0.9.99";
+  version = "0.9.100";

  src = fetchFromGitHub {
    owner = "nextest-rs";
    repo = "nextest";
    rev = "cargo-nextest-${version}";
-    hash = "sha256-I1m4dURisTa4qwUilb8s8bvTsfMSodbZQxRlNDViFeM=";
+    hash = "sha256-MbgX/n6TC5hz66gvRAc7A0xFWbF2Ec68gMxCgPFpeoQ=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-f75yHVvxC+QhNmn1PUafviONLjrXhcNmMitFU06yAaQ=";
+  cargoHash = "sha256-jRBFjJB38JI9whFpImYlMx0znQj1+cdeu4Nc+nYc7OI=";

  cargoBuildFlags = [
    "-p"
@@ -7,17 +7,17 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cargo-sonar";
-  version = "1.3.0";
+  version = "1.3.1";

  src = fetchFromGitLab {
    owner = "woshilapin";
    repo = "cargo-sonar";
    tag = finalAttrs.version;
-    hash = "sha256-f319hi6mrnlHTvsn7kN2wFHyamXtplLZ8A6TN0+H3jY=";
+    hash = "sha256-QK5hri+H1sphk+/0gU5iGrFo6POP/sobq0JL7Q+rJcc=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-KLw6kAR2pF5RFhRDfsL093K+jk3oiSHLZ2CQvrBuhWY=";
+  cargoHash = "sha256-d6LXzWjt2Esbxje+gc8gRA72uxHE2kTUNKdhDlAP0K0=";

  doInstallCheck = true;
  nativeInstallCheckInputs = [ versionCheckHook ];
@@ -6,15 +6,15 @@

 rustPlatform.buildRustPackage rec {
  pname = "cargo-tally";
-  version = "1.0.65";
+  version = "1.0.66";

  src = fetchCrate {
    inherit pname version;
-    hash = "sha256-cvMB/hMq0LCfuXHX1Gg0c3i69T1uQWKIddUru5dcg7g=";
+    hash = "sha256-PC/gscMO7oYcsd/cVcP5WZYweWRsh23Z7Do/qeGjAOc=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-ReVLeyQY08i1sH6IujeLK8y1+PfPm8BoYInzbTHHnlw=";
+  cargoHash = "sha256-00J8ip2fr/nphY0OXVOLKv7gaHitMziwsdJ4YBaYxog=";

  meta = {
    description = "Graph the number of crates that depend on your crate over time";
@@ -6,13 +6,13 @@

 buildGoModule rec {
  pname = "cdncheck";
-  version = "1.1.26";
+  version = "1.1.27";

  src = fetchFromGitHub {
    owner = "projectdiscovery";
    repo = "cdncheck";
    tag = "v${version}";
-    hash = "sha256-mqCQ8CxV9N2lml/zPX/Ksf1kKmXWhjWth3KviTcxiRA=";
+    hash = "sha256-8TLsotEUnZyyeaJaAHjJT+Sk3GFztnJei3I9QHJ8raM=";
  };

  vendorHash = "sha256-/1REkZ5+sz/H4T4lXhloz7fu5cLv1GoaD3dlttN+Qd4=";
@@ -6,11 +6,11 @@
 }:
 let
  pname = "chatbox";
-  version = "1.14.3";
+  version = "1.15.0";

  src = fetchurl {
    url = "https://download.chatboxai.app/releases/Chatbox-${version}-x86_64.AppImage";
-    hash = "sha256-Qsf58SQANBic3LHY52vzCHO9W74cdP0EWtHB2uL45R0=";
+    hash = "sha256-TtYKOCnMuStoPSQfwXfLFli+qv2NVgiXJPCYylCgs6A=";
  };

  appimageContents = appimageTools.extract { inherit pname version src; };
@@ -9,16 +9,16 @@

 buildGoModule (finalAttrs: {
  pname = "cmctl";
-  version = "2.2.0";
+  version = "2.3.0";

  src = fetchFromGitHub {
    owner = "cert-manager";
    repo = "cmctl";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Kr7vwVW6v08QRbJDs2u0vK241ljNfhLVYIQCBl31QSs=";
+    hash = "sha256-yX3A63MU1PaFQmAemp62F5sHlgWpkInhbIIZx7HfdEc=";
  };

-  vendorHash = "sha256-SYCWvt2K3MEow4cDKxLSK+Bp0hZG9rNI9PoXdPcPESg=";
+  vendorHash = "sha256-LDmhlSWa6/Z4KyXnF9OFVkgTksV7TL+m1os0NW89ZpY=";

  ldflags = [
    "-s"
@@ -2,6 +2,7 @@
  lib,
  rustPlatform,
  fetchFromGitHub,
+  stdenv,
  versionCheckHook,
  nix-update-script,
 }:
@@ -20,6 +21,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
  useFetchCargoVendor = true;
  cargoHash = "sha256-1u3oUbqhwHXD90ld70pjK2XPJe5hpUbJtU78QpIjAE8=";

+  env = lib.optionalAttrs stdenv.hostPlatform.isStatic { RUSTFLAGS = "-C relocation-model=static"; };
+
  # skip flaky tests
  checkFlags = [ "--skip=options::tests::test_detect_display_width" ];

@@ -9,16 +9,16 @@

 buildGoModule rec {
  pname = "dnscontrol";
-  version = "4.21.0";
+  version = "4.22.0";

  src = fetchFromGitHub {
    owner = "StackExchange";
    repo = "dnscontrol";
    tag = "v${version}";
-    hash = "sha256-M1Ertf/0GBICci8CV/LyfuubsVTvQ1dql7hDKuHGM6k=";
+    hash = "sha256-5K2o0qa+19ur6axDrVkhDDoTMzRO/oNYIGJciIKGvII=";
  };

-  vendorHash = "sha256-BTysXvuE+LOHkUhsV+p8+5VOFcMUidz2i7uo2fdzyXg=";
+  vendorHash = "sha256-hniL/pFbYOjpLuAHdH0gD0kFKnW9d/pN7283m9V3e/0=";

  nativeBuildInputs = [ installShellFiles ];

@@ -27,7 +27,7 @@ buildGoModule rec {
  ldflags = [
    "-s"
    "-w"
-    "-X=main.version=${version}"
+    "-X=github.com/StackExchange/dnscontrol/v4/pkg/version.version=${version}"
  ];

  postInstall = ''
@@ -67,7 +67,6 @@ buildGoModule {
      gpl3Plus
    ];
    maintainers = with maintainers; [
-      d-xo
      happysalada
    ];
  };
@@ -6,17 +6,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "esp-generate";
-  version = "0.4.0";
+  version = "0.5.0";

  src = fetchFromGitHub {
    owner = "esp-rs";
    repo = "esp-generate";
    rev = "v${version}";
-    hash = "sha256-4RF0XcDpUcMQ0u2FTRBnZdQDM7DlaI7pl5HukMbbbBE=";
+    hash = "sha256-rvgmmG0LhRb+eRdqmlCf514lzV0QGWPaJ8pnlTnxfvo=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-c/BYf6SXOdI/K4t3fT4ycuILkIYCiSbHafLprSMvK8E=";
+  cargoHash = "sha256-ai8FUKHK/iHeUEgklZEDAMKoorXVDxGSZVrB7LahVV8=";

  meta = {
    description = "Template generation tool to create no_std applications targeting Espressif's chips";
@@ -34,14 +34,14 @@ let
 in
 python.pkgs.buildPythonApplication rec {
  pname = "esphome";
-  version = "2025.6.3";
+  version = "2025.7.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "esphome";
    repo = "esphome";
    tag = version;
-    hash = "sha256-3Xcxn12QKQg0jxdOPP7y01YaikvxmPPX9JL2JBvdsUM=";
+    hash = "sha256-EUnptlO9Ya6GWLP7FU3gWOAs2O5xzrHhyHr8LpomapY=";
  };

  build-system = with python.pkgs; [
@@ -82,6 +82,7 @@ python.pkgs.buildPythonApplication rec {
    esphome-glyphsets
    freetype-py
    icmplib
+    jinja2
    kconfiglib
    packaging
    paho-mqtt
@@ -135,25 +136,9 @@ python.pkgs.buildPythonApplication rec {
    ]
    ++ [ versionCheckHook ];

-  disabledTests = [
-    # race condition, also visible in upstream tests
-    # tests/dashboard/test_web_server.py:78: IndexError
-    "test_devices_page"
-
+  disabledTestPaths = [
    # platformio builds; requires networking for dependency resolution
-    "test_api_message_size_batching"
-    "test_host_mode_basic"
-    "test_host_mode_batch_delay"
-    "test_host_mode_empty_string_options"
-    "test_host_mode_entity_fields"
-    "test_host_mode_fan_preset"
-    "test_host_mode_many_entities"
-    "test_host_mode_many_entities_multiple_connections"
-    "test_host_mode_noise_encryption"
-    "test_host_mode_noise_encryption_wrong_key"
-    "test_host_mode_reconnect"
-    "test_host_mode_with_sensor"
-    "test_large_message_batching"
+    "tests/integration"
  ];

  preCheck = ''
@@ -0,0 +1,15 @@
+diff --git a/configure.ac b/configure.ac
+index 2e7d562..c8dd741 100644
+--- a/configure.ac
+++ b/configure.ac
+@@ -7,6 +7,10 @@ AC_INIT([Extract PDFmark], [1.1.1], , [extractpdfmark],
+ AM_INIT_AUTOMAKE([foreign])
+ AC_CONFIG_SRCDIR([src/main.cc])
+ AC_CONFIG_HEADERS([config.h])
+AC_CONFIG_MACRO_DIRS([m4])
+
+AM_GNU_GETTEXT_VERSION([0.25])
+AM_GNU_GETTEXT([external])
+ 
+ PACKAGE_COPYRIGHT="Copyright (C) 2016-2022 Masamichi Hosoda"
+ PACKAGE_LICENSE="License: GPL3+"
@@ -20,22 +20,28 @@ stdenv.mkDerivation rec {
    hash = "sha256-pNc/SWAtQWMbB2+lIQkJdBYSZ97iJXK71mS59qQa7Hs=";
  };

+  patches = [
+    ./gettext-0.25.patch
+  ];
+
+  strictDeps = true;
+
  nativeBuildInputs = [
    autoreconfHook
    pkg-config
  ];
+
  buildInputs = [
-    ghostscript
    poppler
-    texlive.combined.scheme-minimal
  ];

-  postPatch = ''
-    touch config.rpath
-  '';
-
  doCheck = true;

+  nativeCheckInputs = [
+    ghostscript
+    texlive.combined.scheme-minimal
+  ];
+
  meta = with lib; {
    homepage = "https://github.com/trueroad/extractpdfmark";
    description = "Extract page mode and named destinations as PDFmark from PDF";
@@ -13,13 +13,13 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "firefly-iii-data-importer";
-  version = "1.7.3";
+  version = "1.7.6";

  src = fetchFromGitHub {
    owner = "firefly-iii";
    repo = "data-importer";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-CUotqHmVXKKkbAS4a7YWoVjs1GRhxrA5Y5rXtMx/mCo=";
+    hash = "sha256-2QjflXnusdqg63S1RgSbDsYHk9U4Xjf59wkvvo9n+Zo=";
  };

  buildInputs = [ php84 ];
@@ -38,12 +38,12 @@ stdenvNoCC.mkDerivation (finalAttrs: {
  composerStrictValidation = true;
  strictDeps = true;

-  vendorHash = "sha256-JN9HaX056+AhYkMyZ7KO7c6z43ynbRyORAOvW+6eVO8=";
+  vendorHash = "sha256-j0KjjmaDyFBFWnz6e4Bkrb3gkitfSKsj9UB2j/G19do=";

  npmDeps = fetchNpmDeps {
    inherit (finalAttrs) src;
    name = "${finalAttrs.pname}-npm-deps";
-    hash = "sha256-0vMxwm6NOdhCQcVeO93QNGB1BlqVckXzHkpCVvDB9ms=";
+    hash = "sha256-4bDSEGg5vGoam1PLRfaxJK0aQ+MLBTF+GP0AZQjHvVw=";
  };

  composerRepository = php84.mkComposerRepository {
@@ -6,12 +6,12 @@

 python3Packages.buildPythonApplication rec {
  pname = "frida-tools";
-  version = "14.4.0";
+  version = "14.4.1";
  format = "pyproject";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-ACiznCkOZvnPUSB+Xcs4IZfbPGyknr193gLok0FrzqA=";
+    hash = "sha256-Zb6Pk6c7QbJLsb4twhdVgaUWtxCy/Vff5PKIno9B/b4=";
  };

  build-system = with python3Packages; [
@@ -9,17 +9,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "fselect";
-  version = "0.8.12";
+  version = "0.9.0";

  src = fetchFromGitHub {
    owner = "jhspetersson";
    repo = "fselect";
    rev = version;
-    sha256 = "sha256-tvc6Ume9VoPsVFH0AdaQejyRG2M3VapG073a3aYDp7o=";
+    sha256 = "sha256-uR0AElAjzvxymA9K/JySfYpPK59G2SaLTfZpdFtTg/g=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-cLskCSeMLe1aryBVhnAQAVbdKiF0pVFRi9JqcUR1Q6I=";
+  cargoHash = "sha256-j/c2+I/KIYgNxYiHE2oWIq5frNPFtXE5wELWsog8dsc=";

  nativeBuildInputs = [ installShellFiles ];
  buildInputs = lib.optional stdenv.hostPlatform.isDarwin libiconv;
@@ -19,13 +19,13 @@

 stdenv.mkDerivation rec {
  pname = "fzf-git-sh";
-  version = "0-unstable-2025-05-08";
+  version = "0-unstable-2025-07-10";

  src = fetchFromGitHub {
    owner = "junegunn";
    repo = "fzf-git.sh";
-    rev = "3ec3e97d1cc75ec97c0ab923ed5aa567aee01a5e";
-    hash = "sha256-hkxbFYCogrIhnAGs3lcqY8Zv51/TAfM6zB9G78UuYSA=";
+    rev = "79e10ccaa8b3bddff95cd1dcb44b0c30a39da71f";
+    hash = "sha256-5+rV3l1Jdy28IxGLMdmj0heLxmmpRwwobyg9sjdBRco=";
  };

  dontBuild = true;
@@ -7,13 +7,13 @@

 buildGoModule rec {
  pname = "gatekeeper";
-  version = "3.19.2";
+  version = "3.19.3";

  src = fetchFromGitHub {
    owner = "open-policy-agent";
    repo = "gatekeeper";
    tag = "v${version}";
-    hash = "sha256-ksspmNq42Wn/4Uzi8omvzCCprP+ELHVGBImgi8GrMSk=";
+    hash = "sha256-FQ5Q9S/YvJQaa2mUWXv8huTK89SZ31UaFbBCEduGsyg=";
  };

  vendorHash = null;
@@ -7,13 +7,13 @@

 buildGoModule rec {
  pname = "git-codereview";
-  version = "1.15.0";
+  version = "1.16.0";

  src = fetchFromGitHub {
    owner = "golang";
    repo = "review";
    rev = "v${version}";
-    hash = "sha256-CMe7xnR/cCjphuSI0/I0zqHehkRFX6DhLFpQNKwFErU=";
+    hash = "sha256-xokVMjCtpIugdO9JIoKPMg0neajsULn3okMXW82nCQg=";
  };

  vendorHash = null;
@@ -9,14 +9,14 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "git-machete";
-  version = "3.36.0";
+  version = "3.36.1";
  format = "pyproject";

  src = fetchFromGitHub {
    owner = "virtuslab";
    repo = "git-machete";
    rev = "v${version}";
-    hash = "sha256-iSuOiQC+dKqcDCS4nTPMrNFpo3ipPUQhfoofM11UInI=";
+    hash = "sha256-uVzER0Ll7d5cFrwtr1KcWeI70iioHDE6kpZYAiOxPnE=";
  };

  build-system = with python3.pkgs; [ setuptools ];
@@ -35,13 +35,13 @@ let
 in
 buildGoModule rec {
  pname = "gitea";
-  version = "1.24.2";
+  version = "1.24.3";

  src = fetchFromGitHub {
    owner = "go-gitea";
    repo = "gitea";
    tag = "v${gitea.version}";
-    hash = "sha256-NQSilSF/W69j1qEYYmlQfu2T0OefB+8yf9rCHAL8a6c=";
+    hash = "sha256-z9GaUkBh/hfDKkygi/1U0tK725mj39eBR906QKn3MWU=";
  };

  proxyVendor = true;
@@ -25,13 +25,13 @@ assert builtins.all (x: builtins.elem x [ "node20" ]) nodeRuntimes;

 buildDotnetModule (finalAttrs: {
  pname = "github-runner";
-  version = "2.325.0";
+  version = "2.326.0";

  src = fetchFromGitHub {
    owner = "actions";
    repo = "runner";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Ic/+bdEfipyOB7jA+SXBuyET6ERu6ox+SdlLy4mbuqw=";
+    hash = "sha256-bKOxTV6iAvC+QOsfSs1hTS9k/Ou+YGEwTr5hew23cLY=";
    leaveDotGit = true;
    postFetch = ''
      git -C $out rev-parse --short HEAD > $out/.git-revision
@@ -8,16 +8,16 @@

 buildGo124Module rec {
  pname = "gowebly";
-  version = "3.0.4";
+  version = "3.0.5";

  src = fetchFromGitHub {
    owner = "gowebly";
    repo = "gowebly";
    tag = "v${version}";
-    hash = "sha256-oz/O5scGJigWjrmA2wnagDbf+epvwuyRI2CaSQY8K5I=";
+    hash = "sha256-r1yyMbnpt0sDgqkm/EqaYysQnm48uIXzQHqJObVpT9g=";
  };

-  vendorHash = "sha256-BDdH6cFicbjT2WOldNRc8NcFKrIaeqy+mw113PRnwa8=";
+  vendorHash = "sha256-N48/67fMPsylNGr6ixay4si+9ifUryxkIJxKDYU46+o=";

  env.CGO_ENABLED = 0;

@@ -3,7 +3,7 @@
  stdenv,
  addDriverRunpath,
  config,
-  cudaPackages ? { },
+  cudaPackages_12_4 ? { },
  cudaSupport ? config.cudaSupport,
  fetchurl,
  makeWrapper,
@@ -83,7 +83,7 @@ stdenv.mkDerivation rec {
          "${ocl-icd}/lib"
        ]
        ++ lib.optionals cudaSupport [
-          "${cudaPackages.cudatoolkit}/lib"
+          "${cudaPackages_12_4.cudatoolkit}/lib"
        ]
      );
    in
@@ -31,13 +31,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "hmcl";
-  version = "3.6.13";
+  version = "3.6.14";

  src = fetchurl {
    # HMCL has built-in keys, such as the Microsoft OAuth secret and the CurseForge API key.
    # See https://github.com/HMCL-dev/HMCL/blob/refs/tags/release-3.6.12/.github/workflows/gradle.yml#L26-L28
    url = "https://github.com/HMCL-dev/HMCL/releases/download/release-${finalAttrs.version}/HMCL-${finalAttrs.version}.jar";
-    hash = "sha256-rqfesqt3yYDU6koDLFbE9FJpA6iNzDTNG6lWGA2bBYo=";
+    hash = "sha256-8AviAYAMm74uJeMvgESPNHbT5b91mDTxDgLYh+8VHb8=";
  };

  icon = fetchurl {
@@ -11,17 +11,17 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "holo-cli";
-  version = "0.5.0";
+  version = "0.5.0-unstable-2025-07-01";

  src = fetchFromGitHub {
    owner = "holo-routing";
    repo = "holo-cli";
-    tag = "v${finalAttrs.version}";
-    hash = "sha256-f34M3U7pitWuH1UQa4uJ/scIOAZiUtDXijOk8wZEm+c=";
+    rev = "f04c1d0dcd6d800e079f33b8431b17fa00afeeb1";
+    hash = "sha256-ZJeXGT5oajynk44550W4qz+OZEx7y52Wwy+DYzrHZig=";
  };

-  cargoHash = "sha256-s2em9v4SRQdC0aCD4ZXyhNNYnVKkg9XFzxkOlEFHmL0=";
-  passthru.updateScript = nix-update-script { };
+  cargoHash = "sha256-bsoxWjOMzRRtFGEaaqK0/adhGpDcejCIY0Pzw1HjQ5U=";
+  passthru.updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; };

  # Use rust nightly features
  RUSTC_BOOTSTRAP = 1;
@@ -40,6 +40,5 @@ buildNpmPackage rec {
    description = "Implementation of the Handshake protocol";
    homepage = "https://github.com/handshake-org/hsd";
    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ d-xo ];
  };
 }
@@ -7,16 +7,16 @@

 buildGoModule rec {
  pname = "httpx";
-  version = "1.7.0";
+  version = "1.7.1";

  src = fetchFromGitHub {
    owner = "projectdiscovery";
    repo = "httpx";
    tag = "v${version}";
-    hash = "sha256-V4OTIUm7KSUSKgQczkOtIw8HlkLEMgvX53a4caQP5IU=";
+    hash = "sha256-PJN7Pmor2pZauW70QDAs4U8Q5kjBrjfyWqEgkUNK+MQ=";
  };

-  vendorHash = "sha256-lwk/ajywAJ969U5gpYQgIg8+u1xKARFH+HTk2+OgY4A=";
+  vendorHash = "sha256-loxc8ddnape3d0TVvmAw76oqKJOJ6uFKNnPkPbEXEJ8=";

  subPackages = [ "cmd/httpx" ];

@@ -7,13 +7,13 @@

 buildNpmPackage (finalAttrs: {
  pname = "hypercore";
-  version = "11.10.0";
+  version = "11.11.0";

  src = fetchFromGitHub {
    owner = "holepunchto";
    repo = "hypercore";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-6Z6HbolPa3b4EKjUwNGw7gDAg4ijFadBDwpt3l6GUqo=";
+    hash = "sha256-fv/m/AicHW3cdatpsSAvv+PBo+2J1mE8pK+IWysY7D0=";
  };

  npmDepsHash = "sha256-ZJxVmQWKgHyKkuYfGIlANXFcROjI7fibg6mxIhDZowM=";
@@ -41,13 +41,13 @@

 gccStdenv.mkDerivation (finalAttrs: {
  pname = "icewm";
-  version = "3.8.0";
+  version = "3.8.1";

  src = fetchFromGitHub {
    owner = "ice-wm";
    repo = "icewm";
    tag = finalAttrs.version;
-    hash = "sha256-PHbBjwGxFxHnecuXXX2nT8SwmgJD0DzThiFEwKKDASU=";
+    hash = "sha256-ESq8ojGA5iF+VI4B+MIGWz7V2YIROorju8mJ4MV0gOo=";
  };

  strictDeps = true;
@@ -8,17 +8,17 @@
 }:
 buildNpmPackage rec {
  pname = "immich-public-proxy";
-  version = "1.11.3";
+  version = "1.11.5";
  src = fetchFromGitHub {
    owner = "alangrainger";
    repo = "immich-public-proxy";
    tag = "v${version}";
-    hash = "sha256-rroccsVgPsBOTQ/2Mb+BoqOm59LdjqSqKsL40n7NXss=";
+    hash = "sha256-jSAQbACWEt/gyZbr4sOM17t3KZoxPOM0RZFbsLZfcRM=";
  };

  sourceRoot = "${src.name}/app";

-  npmDepsHash = "sha256-9zuw24lPFsDWHrplShsCQDrUpBa6U+NeRVJNSI4OJHA=";
+  npmDepsHash = "sha256-av+XKzrTl+8xizYFZwCTmaLNsbBnusf03I1Uvkp0sF8=";

  # patch in absolute nix store paths so the process doesn't need to cwd in $out
  postPatch = ''
@@ -10,17 +10,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "inputplumber";
-  version = "0.59.2";
+  version = "0.60.2";

  src = fetchFromGitHub {
    owner = "ShadowBlip";
    repo = "InputPlumber";
    tag = "v${version}";
-    hash = "sha256-IAopZnGU0NOfpViLLetAm5BycTXyYL1fJ5WJW8qVnwA=";
+    hash = "sha256-zcy9scs7oRRLKm/FL6BfO64IstWY4HmTRxG/jJG0jLw=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-m/U9fYio39hkjcVDO3VlK5yJF9nWL9Y5B8D0FgD7LKk=";
+  cargoHash = "sha256-fw7pM6HSy/8fNTYu7MqKiTl/2jdyDOLDBNhd0rpzb6M=";

  nativeBuildInputs = [
    pkg-config
@@ -11,16 +11,16 @@

 buildGoModule rec {
  pname = "kargo";
-  version = "1.5.3";
+  version = "1.6.1";

  src = fetchFromGitHub {
    owner = "akuity";
    repo = "kargo";
    tag = "v${version}";
-    hash = "sha256-JjDlH3KqB0NEPFvOhKzUR24WvV/6lx7yXTwM10cIA2k=";
+    hash = "sha256-I1mOEI9F8qQU9g4iKZC6iE0Or2UA25qM4z+H1z2juRY=";
  };

-  vendorHash = "sha256-iZEAUDRqOHmG5u1FEtb14hSHp4p30FGzLEsCYJQCd8U=";
+  vendorHash = "sha256-K7/18Qk1sEmBW+Nt5VpO/eMKijDuXXx1+fIlXB1lUUM=";

  subPackages = [ "cmd/cli" ];

@@ -2,29 +2,20 @@
  lib,
  fetchFromGitLab,
  stdenv,
-  wrapQtAppsHook,
-  qtbase,
  cmake,
-  kconfig,
-  kio,
-  kiconthemes,
-  kxmlgui,
-  ki18n,
-  kguiaddons,
-  extra-cmake-modules,
  boost,
  shared-mime-info,
  rrdtool,
-  breeze-icons,
+  kdePackages,
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "kcollectd";
  version = "0.12.2";
  src = fetchFromGitLab {
    owner = "aerusso";
-    repo = pname;
-    rev = "v${version}";
+    repo = "kcollectd";
+    tag = "v${finalAttrs.version}";
    hash = "sha256-35zb5Kx0tRP5l0hILdomCu2YSQfng02mbyyAClm4uZs=";
  };

@@ -32,26 +23,31 @@ stdenv.mkDerivation rec {
    substituteInPlace kcollectd/rrd_interface.cc --replace-fail 'char *arg[] =' 'const char *arg[] ='
  '';

-  nativeBuildInputs = [
-    wrapQtAppsHook
-    cmake
-    extra-cmake-modules
-    shared-mime-info
-  ];
+  nativeBuildInputs =
+    [
+      shared-mime-info
+      cmake
+    ]
+    ++ (with kdePackages; [
+      wrapQtAppsHook
+      extra-cmake-modules
+    ]);

-  buildInputs = [
-    qtbase
-    kconfig
-    kio
-    kxmlgui
-    kiconthemes
-    ki18n
-    kguiaddons
-    boost
-    rrdtool
-    # otherwise some buttons are blank
-    breeze-icons
-  ];
+  buildInputs =
+    [
+      boost
+      rrdtool
+    ]
+    ++ (with kdePackages; [
+      qtbase
+      kconfig
+      kio
+      kxmlgui
+      kiconthemes
+      ki18n
+      kguiaddons
+      breeze-icons
+    ]);

  meta = with lib; {
    description = "Graphical frontend to collectd";
@@ -61,4 +57,4 @@ stdenv.mkDerivation rec {
    platforms = lib.platforms.linux;
    mainProgram = "kcollectd";
  };
-}
+})
@@ -50,21 +50,21 @@
 with python3Packages;
 buildPythonApplication rec {
  pname = "kitty";
-  version = "0.42.1";
+  version = "0.42.2";
  format = "other";

  src = fetchFromGitHub {
    owner = "kovidgoyal";
    repo = "kitty";
    tag = "v${version}";
-    hash = "sha256-dW6WgIi+3GJE4OlwxrnY8SUMCQ37eG19UGNfAU4Ts1o=";
+    hash = "sha256-YDfKYzj5LRx1XaKUpBKo97CMW4jPhVQq0aXx/Qfcdzo=";
  };

  goModules =
    (buildGo124Module {
      pname = "kitty-go-modules";
      inherit src version;
-      vendorHash = "sha256-gTzonKFXo1jhTU+bX3+4/5wvvLGDHE/ppUg1ImkVpAs=";
+      vendorHash = "sha256-q5LMyogAqgUFfln7LVkhuXzYSMuYmOif5sj15KkOjB4=";
    }).goModules;

  buildInputs =
--- a/Show More
+++ b/Show More