Merge remote-tracking branch 'origin/staging-next' into staging

2025-05-29 12:02:16 +03:00
parent a9810a8ea8 233ccf6b48
commit 37a72a5aa2
208 changed files with 3814 additions and 5257 deletions
@@ -20,7 +20,7 @@ jobs:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 0
-          filter: blob:none
+          filter: tree:0
          path: trusted

      - name: Check cherry-picks
@@ -28,4 +28,4 @@ jobs:
          BASE_SHA: ${{ github.event.pull_request.base.sha }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
        run: |
-          ./trusted/maintainers/scripts/check-cherry-picks.sh "$BASE_SHA" "$HEAD_SHA"
+          ./trusted/ci/check-cherry-picks.sh "$BASE_SHA" "$HEAD_SHA"
@@ -165,6 +165,13 @@ nixos/modules/installer/tools/nix-fallback-paths.nix  @NixOS/nix-team @raitobeza
 ## common-updater-scripts
 /pkgs/common-updater/scripts/update-source-version    @jtojnar

+# Android tools, libraries, and environments
+/pkgs/development/android*                    @NixOS/android
+/pkgs/development/mobile/android*             @NixOS/android
+/pkgs/applications/editors/android-studio*    @NixOS/android
+/doc/languages-frameworks/android*            @NixOS/android
+/pkgs/by-name/an/android*                     @NixOS/android
+
 # Python-related code and docs
 /doc/languages-frameworks/python.section.md   @mweinelt @natsukium
 /maintainers/scripts/update-python-libraries  @mweinelt @natsukium
@@ -11,14 +11,15 @@ fi
 # Make sure we are inside the nixpkgs repo, even when called from outside
 cd "$(dirname "${BASH_SOURCE[0]}")"

-PICKABLE_BRANCHES=${PICKABLE_BRANCHES:-master staging release-??.?? staging-??.??}
+PICKABLE_BRANCHES="master release-??.?? staging-??.?? haskell-updates python-updates"
 problem=0

-commits="$(git rev-list \
-  -E -i --grep="cherry.*[0-9a-f]{40}" --reverse \
-  "$1..$2")"
+# Not everyone calls their remote "origin"
+remote="$(git remote -v | grep -i 'NixOS/nixpkgs' | head -n1 | cut -f1 || true)"

-while read new_commit_sha ; do
+commits="$(git rev-list --reverse "$1..$2")"
+
+while read -r new_commit_sha ; do
  if [ -z "$new_commit_sha" ] ; then
    continue  # skip empty lines
  fi
@@ -33,30 +34,47 @@ while read new_commit_sha ; do
  original_commit_sha=$(
    git rev-list --max-count=1 --format=format:%B "$new_commit_sha" \
    | grep -Ei -m1 "cherry.*[0-9a-f]{40}" \
-    | grep -Eoi -m1 '[0-9a-f]{40}'
+    | grep -Eoi -m1 '[0-9a-f]{40}' || true
  )
-  if [ "$?" != "0" ] ; then
-    echo "  ? Couldn't locate original commit hash in message"
-    [ "$GITHUB_ACTIONS" = 'true' ] && echo ::endgroup::
+  if [ -z "$original_commit_sha" ] ; then
+    if [ "$GITHUB_ACTIONS" = 'true' ] ; then
+      echo ::endgroup::
+      echo -n "::error ::"
+    else
+      echo -n "  ✘ "
+    fi
+    echo "Couldn't locate original commit hash in message"
+    echo "Note this should not necessarily be treated as a hard fail, but a reviewer's attention should" \
+      "be drawn to it and github actions have no way of doing that but to raise a 'failure'"
+    problem=1
    continue
  fi

  set -f # prevent pathname expansion of patterns
-  for branch_pattern in $PICKABLE_BRANCHES ; do
+  for pattern in $PICKABLE_BRANCHES ; do
    set +f # re-enable pathname expansion

+    # Reverse sorting by refname and taking one match only means we can only backport
+    # from unstable and the latest stable. That makes sense, because even right after
+    # branch-off, when we have two supported stable branches, we only ever want to cherry-pick
+    # **to** the older one, but never **from** it.
+    # This makes the job significantly faster in the case when commits can't be found,
+    # because it doesn't need to iterate through 20+ branches, which all need to be fetched.
+    branches="$(git for-each-ref --sort=-refname --format="%(refname)" \
+      "refs/remotes/${remote:-origin}/$pattern" | head -n1)"
+
    while read -r picked_branch ; do
      if git merge-base --is-ancestor "$original_commit_sha" "$picked_branch" ; then
        echo "  ✔ $original_commit_sha present in branch $picked_branch"

-        range_diff_common='git range-diff
+        range_diff_common='git --no-pager range-diff
          --no-notes
          --creation-factor=100
          '"$original_commit_sha~..$original_commit_sha"'
          '"$new_commit_sha~..$new_commit_sha"'
        '

-        if $range_diff_common --no-color | grep -E '^ {4}[+-]{2}' > /dev/null ; then
+        if $range_diff_common --no-color 2> /dev/null | grep -E '^ {4}[+-]{2}' > /dev/null ; then
          if [ "$GITHUB_ACTIONS" = 'true' ] ; then
            echo ::endgroup::
            echo -n "::warning ::"
@@ -79,11 +97,7 @@ while read new_commit_sha ; do
        # move on to next commit
        continue 3
      fi
-    done <<< "$(
-      git for-each-ref \
-      --format="%(refname)" \
-      "refs/remotes/origin/$branch_pattern"
-    )"
+    done <<< "$branches"
  done

  if [ "$GITHUB_ACTIONS" = 'true' ] ; then
@@ -73,7 +73,9 @@ let
      # The number of attributes per chunk, see ./README.md for more info.
      chunkSize,
      checkMeta ? true,
-      includeBroken ? true,
+
+      # Don't try to eval packages marked as broken.
+      includeBroken ? false,
      # Whether to just evaluate a single chunk for quick testing
      quickTest ? false,
    }:
@@ -121,6 +121,8 @@ agda.withPackages {
 }
 ```

+To install Agda without GHC, use `ghc = null;`.
+
 ## Writing Agda packages {#writing-agda-packages}

 To write a nix derivation for an Agda library, first check that the library has a `*.agda-lib` file.
@@ -59,7 +59,7 @@ For instance, `sqlite-lua` needs `g:sqlite_clib_path` to be set to work. Nixpkgs
 - `neovimRcContent`: Extra vimL code sourced by the generated `init.lua`.
 - `wrapperArgs`: Extra arguments forwarded to the `makeWrapper` call.
 - `wrapRc`: Nix, not being able to write in your `$HOME`, loads the
-  generated Neovim configuration via its  `-u` argument, i.e. : `-u /nix/store/...generatedInit.lua`. This has side effects like preventing Neovim from reading your config in `$XDG_CONFIG_HOME` (see bullet 7 of [`:help startup`](https://neovim.io/doc/user/starting.html#_initialization) in Neovim). Disable it if you want to generate your own wrapper. You can still reuse while reusing the logic of the nixpkgs wrapper and access the generated config via `neovim.passthru.initRc`.
+  generated Neovim configuration via the `$VIMINIT` environment variable, i.e. : `export VIMINIT='lua dofile("/nix/store/…-init.lua")'`. This has side effects like preventing Neovim from sourcing your `init.lua` in `$XDG_CONFIG_HOME/nvim` (see bullet 7 of [`:help startup`](https://neovim.io/doc/user/starting.html#startup) in Neovim). Disable it if you want to generate your own wrapper. You can still reuse the generated vimscript init code via `neovim.passthru.initRc`.
 - `plugins`: A list of plugins to add to the wrapper.

 ```
@@ -28,7 +28,7 @@
  - Applications linked against different Mesa versions than installed on the system should now work correctly going forward (however, applications against older Mesa, e.g. from Nixpkgs releases before 25.05, remain broken)
  - Packages that used to depend on Mesa for libgbm or libdri should use `libgbm` or `dri-pkgconfig-stub` as inputs, respectively

- OpenSSH has been updated from 9.9p2 to 10.0p2, dropping support for DSA keys and adding a new `ssh-auth` binary to handle user authentication in a different address space from unauthenticated sessions. Additionally, we now enable a configure option by default that attempts to lock sshd into RAM to prevent it from being swapped out, which may improve performance if the system is under memory pressure. See the [full changelog](https://www.openwall.com/lists/oss-security/2025/04/09/1) for more details.
+- OpenSSH has been updated from 9.9p2 to 10.0p2, dropping support for DSA keys and adding a new `ssh-auth` binary to handle user authentication in a different address space from unauthenticated sessions. See the [full changelog](https://www.openwall.com/lists/oss-security/2025/04/09/1) for more details.

 - Emacs has been updated to 30.1.
  This introduces some backwards‐incompatible changes; see the NEWS for details.
@@ -37,4 +37,6 @@

 ### Additions and Improvements {#sec-nixpkgs-release-25.11-lib-additions-improvements}

- Create the first release note entry in this section!
+- `neovim`: Added support for the `vim.o.exrc` option, the `VIMINIT` environment variable, and sourcing of `sysinit.vim`.
+
+  See the neovim help page [`:help startup`](https://neovim.io/doc/user/starting.html#startup) for more information, as well as [the nixpkgs neovim wrapper documentation](#neovim-custom-configuration).
@@ -23436,6 +23436,13 @@
    githubId = 16364318;
    name = "Jeffrey Harmon";
  };
+  squat = {
+    matrix = "@squat:beeper.com";
+    name = "squat";
+    github = "squat";
+    githubId = 20484159;
+    keys = [ { fingerprint = "F246 425A 7650 6F37 0552  BA8D DEA9 C405 09D9 65F5"; } ];
+  };
  srghma = {
    email = "srghma@gmail.com";
    github = "srghma";
@@ -12,6 +12,8 @@

 - [gtklock](https://github.com/jovanlanik/gtklock), a GTK-based lockscreen for Wayland. Available as [programs.gtklock](#opt-programs.gtklock.enable).

+- [FileBrowser](https://filebrowser.org/), a web application for managing and sharing files. Available as [services.filebrowser](#opt-services.filebrowser.enable).
+
 - [SuiteNumérique Docs](https://github.com/suitenumerique/docs), a collaborative note taking, wiki and documentation web platform and alternative to Notion or Outline. Available as [services.lasuite-docs](#opt-services.lasuite-docs.enable).

 ## Backward Incompatibilities {#sec-release-25.11-incompatibilities}
@@ -1536,6 +1536,7 @@
  ./services/web-apps/engelsystem.nix
  ./services/web-apps/ethercalc.nix
  ./services/web-apps/fider.nix
+  ./services/web-apps/filebrowser.nix
  ./services/web-apps/filesender.nix
  ./services/web-apps/firefly-iii-data-importer.nix
  ./services/web-apps/firefly-iii.nix
@@ -249,6 +249,23 @@ let
              to provide Google Authenticator token to log in.
            '';
          };
+          allowNullOTP = lib.mkOption {
+            type = lib.types.bool;
+            default = false;
+            description = ''
+              Whether to allow login for accounts that have no OTP set
+              (i.e., accounts with no OTP configured or no existing
+              {file}`~/.google_authenticator`).
+            '';
+          };
+          forwardPass = lib.mkOption {
+            type = lib.types.bool;
+            default = false;
+            description = ''
+              The authentication provides a single field requiring
+              the user's password followed by the one-time password (OTP).
+            '';
+          };
        };

        otpwAuth = lib.mkOption {
@@ -1048,6 +1065,8 @@ let
                      modulePath = "${pkgs.google-authenticator}/lib/security/pam_google_authenticator.so";
                      settings = {
                        no_increment_hotp = true;
+                        forward_pass = cfg.googleAuthenticator.forwardPass;
+                        nullok = cfg.googleAuthenticator.allowNullOTP;
                      };
                    }
                    {
@@ -336,7 +336,10 @@ in
          [
            gitMinimal
            openssh
-            util-linux
+            # TODO (#409339): remove this patch. We had to add it to avoid a mass rebuild
+            # for the 25.05 release. Once the staging cycle referenced in the above PR completes,
+            # switch back to plain util-linux.
+            util-linux.withPatches
            iproute2
            ethtool
            thin-provisioning-tools
@@ -1,9 +1,11 @@
 {
-  deviceNameStrategy,
+  csv-files,
+  device-name-strategy,
+  discovery-mode,
+  mounts,
  glibc,
  jq,
  lib,
-  mounts,
  nvidia-container-toolkit,
  nvidia-driver,
  runtimeShell,
@@ -36,7 +38,14 @@ writeScriptBin "nvidia-cdi-generator" ''
  function cdiGenerate {
    ${lib.getExe' nvidia-container-toolkit "nvidia-ctk"} cdi generate \
      --format json \
-      --device-name-strategy ${deviceNameStrategy} \
+      ${
+        if (builtins.length csv-files) > 0 then
+          lib.concatMapStringsSep "\n" (file: "--csv.file ${file} \\") csv-files
+        else
+          "\\"
+      }
+      --discovery-mode ${discovery-mode} \
+      --device-name-strategy ${device-name-strategy} \
      --ldconfig-path ${lib.getExe' glibc "ldconfig"} \
      --library-search-path ${lib.getLib nvidia-driver}/lib \
      --nvidia-cdi-hook-path ${lib.getExe' nvidia-container-toolkit.tools "nvidia-cdi-hook"}
@@ -50,12 +50,39 @@
          '';
        };

-        suppressNvidiaDriverAssertion = lib.mkOption {
-          default = false;
-          type = lib.types.bool;
+        device-name-strategy = lib.mkOption {
+          default = "index";
+          type = lib.types.enum [
+            "index"
+            "uuid"
+            "type-index"
+          ];
          description = ''
-            Suppress the assertion for installing Nvidia driver.
-            Useful in WSL where drivers are mounted from Windows, not provided by NixOS.
+            Specify the strategy for generating device names,
+            passed to `nvidia-ctk cdi generate`. This will affect how
+            you reference the device using `nvidia.com/gpu=` in
+            the container runtime.
+          '';
+        };
+
+        discovery-mode = lib.mkOption {
+          default = "auto";
+          type = lib.types.enum [
+            "auto"
+            "csv"
+            "nvml"
+            "wsl"
+          ];
+          description = ''
+            The mode to use when discovering the available entities.
+          '';
+        };
+
+        csv-files = lib.mkOption {
+          default = [ ];
+          type = lib.types.listOf lib.types.path;
+          description = ''
+            The path to the list of CSV files to use when generating the CDI specification in CSV mode.
          '';
        };

@@ -74,21 +101,6 @@
          '';
        };

-        device-name-strategy = lib.mkOption {
-          default = "index";
-          type = lib.types.enum [
-            "index"
-            "uuid"
-            "type-index"
-          ];
-          description = ''
-            Specify the strategy for generating device names,
-            passed to `nvidia-ctk cdi generate`. This will affect how
-            you reference the device using `nvidia.com/gpu=` in
-            the container runtime.
-          '';
-        };
-
        mount-nvidia-docker-1-directories = lib.mkOption {
          default = true;
          type = lib.types.bool;
@@ -98,6 +110,15 @@
          '';
        };

+        suppressNvidiaDriverAssertion = lib.mkOption {
+          default = false;
+          type = lib.types.bool;
+          description = ''
+            Suppress the assertion for installing Nvidia driver.
+            Useful in WSL where drivers are mounted from Windows, not provided by NixOS.
+          '';
+        };
+
        package = lib.mkPackageOption pkgs "nvidia-container-toolkit" { };
      };

@@ -112,6 +133,12 @@
          || config.hardware.nvidia-container-toolkit.suppressNvidiaDriverAssertion;
        message = ''`nvidia-container-toolkit` requires nvidia drivers: set `hardware.nvidia.datacenter.enable`, add "nvidia" to `services.xserver.videoDrivers`, or set `hardware.nvidia-container-toolkit.suppressNvidiaDriverAssertion` if the driver is provided by another NixOS module (e.g. from NixOS-WSL)'';
      }
+      {
+        assertion =
+          ((builtins.length config.hardware.nvidia-container-toolkit.csv-files) > 0)
+          -> config.hardware.nvidia-container-toolkit.discovery-mode == "csv";
+        message = ''When CSV files are provided, `config.hardware.nvidia-container-toolkit.discovery-mode` has to be set to `csv`.'';
+      }
    ];

    virtualisation.docker = {
@@ -209,10 +236,14 @@
        ExecStart =
          let
            script = pkgs.callPackage ./cdi-generate.nix {
-              inherit (config.hardware.nvidia-container-toolkit) mounts;
+              inherit (config.hardware.nvidia-container-toolkit)
+                csv-files
+                device-name-strategy
+                discovery-mode
+                mounts
+                ;
              nvidia-container-toolkit = config.hardware.nvidia-container-toolkit.package;
              nvidia-driver = config.hardware.nvidia.package;
-              deviceNameStrategy = config.hardware.nvidia-container-toolkit.device-name-strategy;
            };
          in
          lib.getExe script;
@@ -185,7 +185,9 @@ let

  finalJson =
    if cfg.provision.extraJsonFile != null then
-      "<(${lib.getExe pkgs.jq} -s '.[0] * .[1]' ${provisionStateJson} ${cfg.provision.extraJsonFile})"
+      ''
+        <(${lib.getExe pkgs.yq-go} '. *+ load("${cfg.provision.extraJsonFile}") | (.. | select(type == "!!seq")) |= unique' ${provisionStateJson})
+      ''
    else
      provisionStateJson;

@@ -442,10 +444,8 @@ in
        description = ''
          A JSON file for provisioning persons, groups & systems.
          Options set in this file take precedence over values set using the other options.
-          In the case of duplicates, `jq` will remove all but the last one
-          when merging this file with the options.
+          The files get deeply merged, and deduplicated.
          The accepted JSON schema can be found at <https://github.com/oddlama/kanidm-provision#json-schema>.
-          Note: theoretically `jq` cannot merge nested types, but this does not pose an issue as kanidm-provision's JSON scheme does not use nested types.
        '';
        type = types.nullOr types.path;
        default = null;
@@ -0,0 +1,137 @@
+{
+  config,
+  pkgs,
+  lib,
+  utils,
+  ...
+}:
+let
+  cfg = config.services.filebrowser;
+  inherit (lib) types;
+  format = pkgs.formats.json { };
+in
+{
+  options = {
+    services.filebrowser = {
+      enable = lib.mkEnableOption "FileBrowser";
+
+      package = lib.mkPackageOption pkgs "filebrowser" { };
+
+      openFirewall = lib.mkEnableOption "opening firewall ports for FileBrowser";
+
+      settings = lib.mkOption {
+        default = { };
+        description = ''
+          Settings for FileBrowser.
+          Refer to <https://filebrowser.org/cli/filebrowser#options> for all supported values.
+        '';
+        type = types.submodule {
+          freeformType = format.type;
+
+          options = {
+            address = lib.mkOption {
+              default = "localhost";
+              description = ''
+                The address to listen on.
+              '';
+              type = types.str;
+            };
+
+            port = lib.mkOption {
+              default = 8080;
+              description = ''
+                The port to listen on.
+              '';
+              type = types.port;
+            };
+
+            root = lib.mkOption {
+              default = "/var/lib/filebrowser/data";
+              description = ''
+                The directory where FileBrowser stores files.
+              '';
+              type = types.path;
+            };
+
+            database = lib.mkOption {
+              default = "/var/lib/filebrowser/database.db";
+              description = ''
+                The path to FileBrowser's Bolt database.
+              '';
+              type = types.path;
+            };
+
+            cache-dir = lib.mkOption {
+              default = "/var/cache/filebrowser";
+              description = ''
+                The directory where FileBrowser stores its cache.
+              '';
+              type = types.path;
+              readOnly = true;
+            };
+          };
+        };
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd = {
+      services.filebrowser = {
+        after = [ "network.target" ];
+        description = "FileBrowser";
+        wantedBy = [ "multi-user.target" ];
+        serviceConfig = {
+          ExecStart =
+            let
+              args = [
+                (lib.getExe cfg.package)
+                "--config"
+                (format.generate "config.json" cfg.settings)
+              ];
+            in
+            utils.escapeSystemdExecArgs args;
+
+          StateDirectory = "filebrowser";
+          CacheDirectory = "filebrowser";
+          WorkingDirectory = cfg.settings.root;
+
+          DynamicUser = true;
+
+          NoNewPrivileges = true;
+          PrivateDevices = true;
+          ProtectKernelTunables = true;
+          ProtectKernelModules = true;
+          ProtectControlGroups = true;
+          MemoryDenyWriteExecute = true;
+          LockPersonality = true;
+          RestrictAddressFamilies = [
+            "AF_UNIX"
+            "AF_INET"
+            "AF_INET6"
+          ];
+          DevicePolicy = "closed";
+          RestrictNamespaces = true;
+          RestrictRealtime = true;
+          RestrictSUIDSGID = true;
+        };
+      };
+
+      tmpfiles.settings.filebrowser =
+        lib.genAttrs
+          [
+            cfg.settings.root
+            (builtins.dirOf cfg.settings.database)
+          ]
+          (_: {
+            d.mode = "0700";
+          });
+    };
+
+    networking.firewall.allowedTCPPorts = lib.mkIf cfg.openFirewall [ cfg.settings.port ];
+  };
+
+  meta.maintainers = [
+    lib.maintainers.lukaswrz
+  ];
+}
@@ -25,22 +25,32 @@ let

  iniFormat = pkgs.formats.ini { };

-  # we need to build our own GI_TYPELIB_PATH because celery and paster need this information, too and cannot easily be re-wrapped
-  GI_TYPELIB_PATH =
+  # we need to build our own GI_TYPELIB_PATH and GST_PLUGIN_PATH because celery, paster and gmg need this information and it cannot easily be re-wrapped
+  gst =
    let
      needsGst =
        (cfg.settings.mediagoblin.plugins ? "mediagoblin.media_types.audio")
        || (cfg.settings.mediagoblin.plugins ? "mediagoblin.media_types.video");
    in
-    lib.makeSearchPathOutput "out" "lib/girepository-1.0" (
-      with pkgs.gst_all_1;
+    with pkgs.gst_all_1;
+    [
+      pkgs.glib
+      gst-plugins-base
+      gstreamer
+    ]
+    # audio and video share most dependencies, so we can just take audio
+    ++ lib.optionals needsGst cfg.package.optional-dependencies.audio;
+  GI_TYPELIB_PATH = lib.makeSearchPathOutput "out" "lib/girepository-1.0" gst;
+  GST_PLUGIN_PATH = lib.makeSearchPathOutput "lib" "lib/gstreamer-1.0" gst;
+
+  path =
+    lib.optionals (cfg.settings.mediagoblin.plugins ? "mediagoblin.media_types.stl") [ pkgs.blender ]
+    ++ lib.optionals (cfg.settings.mediagoblin.plugins ? "mediagoblin.media_types.pdf") (
+      with pkgs;
      [
-        pkgs.glib
-        gst-plugins-base
-        gstreamer
+        poppler-utils
+        unoconv
      ]
-      # audio and video share most dependencies, so we can just take audio
-      ++ lib.optionals needsGst cfg.package.optional-dependencies.audio
    );

  finalPackage = cfg.package.python.buildEnv.override {
@@ -189,7 +199,7 @@ in
        if [[ "$USER" != mediagoblin ]]; then
         sudo='exec /run/wrappers/bin/sudo -u mediagoblin'
        fi
-        $sudo sh -c "cd /var/lib/mediagoblin; env GI_TYPELIB_PATH=${GI_TYPELIB_PATH} ${lib.getExe' finalPackage "gmg"} $@"
+        $sudo sh -c "cd /var/lib/mediagoblin; env GI_TYPELIB_PATH=${GI_TYPELIB_PATH} GST_PLUGIN_PATH=${GST_PLUGIN_PATH} PATH=$PATH:${lib.makeBinPath path} ${lib.getExe' finalPackage "gmg"} $*"
      '')
    ];

@@ -248,15 +258,7 @@ in
      let
        serviceDefaults = {
          wantedBy = [ "multi-user.target" ];
-          path =
-            lib.optionals (cfg.settings.mediagoblin.plugins ? "mediagoblin.media_types.stl") [ pkgs.blender ]
-            ++ lib.optionals (cfg.settings.mediagoblin.plugins ? "mediagoblin.media_types.pdf") (
-              with pkgs;
-              [
-                poppler-utils
-                unoconv
-              ]
-            );
+          inherit path;
          serviceConfig = {
            AmbientCapabilities = "";
            CapabilityBoundingSet = [ "" ];
@@ -325,6 +327,7 @@ in
            Environment = [
              "CELERY_CONFIG_MODULE=mediagoblin.init.celery.from_celery"
              "GI_TYPELIB_PATH=${GI_TYPELIB_PATH}"
+              "GST_PLUGIN_PATH=${GST_PLUGIN_PATH}"
              "MEDIAGOBLIN_CONFIG=/var/lib/mediagoblin/mediagoblin.ini"
              "PASTE_CONFIG=${pasteConfig}"
            ];
@@ -350,6 +353,7 @@ in
            Environment = [
              "CELERY_ALWAYS_EAGER=false"
              "GI_TYPELIB_PATH=${GI_TYPELIB_PATH}"
+              "GST_PLUGIN_PATH=${GST_PLUGIN_PATH}"
            ];
            ExecStart = "${lib.getExe' finalPackage "paster"} serve /var/lib/mediagoblin/paste.ini";
          };
@@ -420,7 +420,7 @@ in
  ecryptfs = runTest ./ecryptfs.nix;
  fscrypt = runTest ./fscrypt.nix;
  fastnetmon-advanced = runTest ./fastnetmon-advanced.nix;
-  eintopf = runTest ./eintopf.nix;
+  lauti = runTest ./lauti.nix;
  ejabberd = runTest ./xmpp/ejabberd.nix;
  elk = handleTestOn [ "x86_64-linux" ] ./elk.nix { };
  emacs-daemon = runTest ./emacs-daemon.nix;
@@ -466,6 +466,7 @@ in
  ferretdb = handleTest ./ferretdb.nix { };
  fider = runTest ./fider.nix;
  filesender = runTest ./filesender.nix;
+  filebrowser = runTest ./filebrowser.nix;
  filesystems-overlayfs = runTest ./filesystems-overlayfs.nix;
  firefly-iii = runTest ./firefly-iii.nix;
  firefly-iii-data-importer = runTest ./firefly-iii-data-importer.nix;
@@ -616,8 +617,14 @@ in
  pyload = runTest ./pyload.nix;
  oci-containers = handleTestOn [ "aarch64-linux" "x86_64-linux" ] ./oci-containers.nix { };
  odoo = runTest ./odoo.nix;
-  odoo17 = handleTest ./odoo.nix { package = pkgs.odoo17; };
-  odoo16 = handleTest ./odoo.nix { package = pkgs.odoo16; };
+  odoo17 = runTest {
+    imports = [ ./odoo.nix ];
+    _module.args.package = pkgs.odoo17;
+  };
+  odoo16 = runTest {
+    imports = [ ./odoo.nix ];
+    _module.args.package = pkgs.odoo16;
+  };
  oncall = runTest ./web-apps/oncall.nix;
  # 9pnet_virtio used to mount /nix partition doesn't support
  # hibernation. This test happens to work on x86_64-linux but
@@ -1297,8 +1304,9 @@ in
  systemd-initrd-btrfs-raid = runTest ./systemd-initrd-btrfs-raid.nix;
  systemd-initrd-luks-fido2 = runTest ./systemd-initrd-luks-fido2.nix;
  systemd-initrd-luks-keyfile = runTest ./systemd-initrd-luks-keyfile.nix;
-  systemd-initrd-luks-empty-passphrase = handleTest ./initrd-luks-empty-passphrase.nix {
-    systemdStage1 = true;
+  systemd-initrd-luks-empty-passphrase = runTest {
+    imports = [ ./initrd-luks-empty-passphrase.nix ];
+    _module.args.systemdStage1 = true;
  };
  systemd-initrd-luks-password = runTest ./systemd-initrd-luks-password.nix;
  systemd-initrd-luks-tpm2 = runTest ./systemd-initrd-luks-tpm2.nix;
@@ -1310,7 +1318,10 @@ in
    "x86_64-linux"
    "i686-linux"
  ] ./initrd-network-openvpn { systemdStage1 = true; };
-  systemd-initrd-shutdown = handleTest ./systemd-shutdown.nix { systemdStage1 = true; };
+  systemd-initrd-shutdown = runTest {
+    imports = [ ./systemd-shutdown.nix ];
+    _module.args.systemdStage1 = true;
+  };
  systemd-initrd-simple = runTest ./systemd-initrd-simple.nix;
  systemd-initrd-swraid = runTest ./systemd-initrd-swraid.nix;
  systemd-initrd-vconsole = runTest ./systemd-initrd-vconsole.nix;
@@ -3,6 +3,8 @@
  name = "breitbandmessung";
  meta.maintainers = with lib.maintainers; [ b4dm4n ];

+  node.pkgsReadOnly = false;
+
  nodes.machine =
    { pkgs, ... }:
    {
@@ -1,34 +1,30 @@
 # integration tests for brscan5 sane driver
-#
-
-{ pkgs, ... }:
+{ lib, ... }:
 {
  name = "brscan5";
-  meta = with pkgs.lib.maintainers; {
-    maintainers = [ mattchrist ];
-  };
+  meta.maintainers = with lib.maintainers; [ mattchrist ];

-  nodes.machine =
-    { pkgs, ... }:
-    {
-      nixpkgs.config.allowUnfree = true;
-      hardware.sane = {
+  node.pkgsReadOnly = false;
+
+  nodes.machine = {
+    nixpkgs.config.allowUnfree = true;
+    hardware.sane = {
+      enable = true;
+      brscan5 = {
        enable = true;
-        brscan5 = {
-          enable = true;
-          netDevices = {
-            "a" = {
-              model = "ADS-1200";
-              nodename = "BRW0080927AFBCE";
-            };
-            "b" = {
-              model = "ADS-1200";
-              ip = "192.168.1.2";
-            };
+        netDevices = {
+          "a" = {
+            model = "ADS-1200";
+            nodename = "BRW0080927AFBCE";
+          };
+          "b" = {
+            model = "ADS-1200";
+            ip = "192.168.1.2";
          };
        };
      };
    };
+  };

  testScript = ''
    import re
@@ -1,4 +1,4 @@
-{ pkgs, lib, ... }:
+{ lib, ... }:

 let
  # Settings for both servers and agents
@@ -117,6 +117,8 @@ in
 {
  name = "consul";

+  node.pkgsReadOnly = false;
+
  nodes = {
    server1 = server 0;
    server2 = server 1;
@@ -1,4 +1,4 @@
-{ pkgs, lib, ... }:
+{ lib, ... }:
 let
  httpPort = 800;
 in
@@ -9,24 +9,19 @@ in
    bjornfor
  ];

-  nodes.machine =
-    {
-      config,
-      pkgs,
-      lib,
-      ...
-    }:
-    {
-      nixpkgs.config.allowUnfree = true;
-      services.deconz = {
-        enable = true;
-        inherit httpPort;
-        extraArgs = [
-          "--dbg-err=2"
-          "--dbg-info=2"
-        ];
-      };
+  node.pkgsReadOnly = false;
+
+  nodes.machine = {
+    nixpkgs.config.allowUnfree = true;
+    services.deconz = {
+      enable = true;
+      inherit httpPort;
+      extraArgs = [
+        "--dbg-err=2"
+        "--dbg-info=2"
+      ];
    };
+  };

  testScript = ''
    machine.wait_for_unit("deconz.service")
@@ -4,9 +4,9 @@
 #  3. replying to that message via email.

 {
+  package,
  pkgs,
  lib,
-  package ? pkgs.discourse,
  ...
 }:
 let
@@ -24,9 +24,9 @@ let
 in
 {
  name = "discourse";
-  meta = with pkgs.lib.maintainers; {
-    maintainers = [ talyz ];
-  };
+  meta.maintainers = with lib.maintainers; [ talyz ];
+
+  _module.args.package = lib.mkDefault pkgs.discourse;

  nodes.discourse =
    { nodes, ... }:
@@ -62,7 +62,7 @@ in

      services.discourse = {
        enable = true;
-        inherit admin package;
+        inherit admin;
        hostname = discourseDomain;
        sslCertificate = "${certs.${discourseDomain}.cert}";
        sslCertificateKey = "${certs.${discourseDomain}.key}";
@@ -1,28 +1,15 @@
-{
-  system ? builtins.currentSystem,
-  config ? { },
-  pkgs ? import ../.. { inherit system config; },
-}:
-{ lib, pkgs, ... }:
+{ lib, ... }:
 {
  name = "fanout";
-  meta.maintainers = [ lib.maintainers.therishidesai ];
+  meta.maintainers = with lib.maintainers; [ therishidesai ];

-  nodes =
-    let
-      cfg =
-        { ... }:
-        {
-          services.fanout = {
-            enable = true;
-            fanoutDevices = 2;
-            bufferSize = 8192;
-          };
-        };
-    in
-    {
-      machine = cfg;
+  nodes.machine = {
+    services.fanout = {
+      enable = true;
+      fanoutDevices = 2;
+      bufferSize = 8192;
    };
+  };

  testScript = ''
    start_all()
@@ -0,0 +1,27 @@
+{
+  name = "filebrowser";
+
+  nodes.machine = {
+    services.filebrowser = {
+      enable = true;
+      settings = {
+        address = "localhost";
+        port = 8080;
+        database = "/var/lib/filebrowser/filebrowser.db";
+      };
+    };
+  };
+
+  testScript = ''
+    machine.start()
+
+    machine.wait_for_unit("filebrowser.service")
+    machine.wait_for_open_port(8080)
+
+    machine.succeed("curl --fail http://localhost:8080/")
+
+    machine.succeed("stat /var/lib/filebrowser/filebrowser.db")
+
+    machine.shutdown()
+  '';
+}
@@ -3,6 +3,8 @@
  name = "gnome-extensions";
  meta.maintainers = [ ];

+  node.pkgsReadOnly = false;
+
  nodes.machine =
    { pkgs, ... }:
    {
@@ -21,16 +23,14 @@

      # Configure GDM
      services.xserver.enable = true;
-      services.xserver.displayManager = {
-        gdm = {
-          enable = true;
-          debug = true;
-          wayland = true;
-        };
-        autoLogin = {
-          enable = true;
-          user = "alice";
-        };
+      services.xserver.displayManager.gdm = {
+        enable = true;
+        debug = true;
+        wayland = true;
+      };
+      services.displayManager.autoLogin = {
+        enable = true;
+        user = "alice";
      };

      # Configure Gnome
@@ -1,22 +1,21 @@
 {
-  system ? builtins.currentSystem,
-  config ? { },
-  pkgs ? import ../.. { inherit system config; },
-  systemdStage1 ? false,
+  systemdStage1,
+  lib,
+  pkgs,
+  ...
 }:
-{ lib, pkgs, ... }:
 let
-
  keyfile = pkgs.writeText "luks-keyfile" ''
    MIGHAoGBAJ4rGTSo/ldyjQypd0kuS7k2OSsmQYzMH6TNj3nQ/vIUjDn7fqa3slt2
    gV6EK3TmTbGc4tzC1v4SWx2m+2Bjdtn4Fs4wiBwn1lbRdC6i5ZYCqasTWIntWn+6
    FllUkMD5oqjOR/YcboxG8Z3B5sJuvTP9llsF+gnuveWih9dpbBr7AgEC
  '';
-
 in
 {
  name = "initrd-luks-empty-passphrase";

+  _module.args.systemdStage1 = lib.mkDefault false;
+
  nodes.machine =
    { pkgs, ... }:
    {
@@ -234,6 +234,29 @@ in
          };
        };

+      specialisation.extraJsonFile.configuration =
+        { ... }:
+        {
+          services.kanidm.provision = lib.mkForce {
+            enable = true;
+            idmAdminPasswordFile = pkgs.writeText "idm-admin-pw" provisionIdmAdminPassword;
+
+            extraJsonFile = pkgs.writeText "extra-json.json" (
+              builtins.toJSON {
+                persons.testuser2.displayName = "Test User 2";
+                groups.testgroup1.members = [ "testuser2" ];
+              }
+            );
+
+            groups.testgroup1 = { };
+
+            persons.testuser1 = {
+              displayName = "Test User 1";
+              groups = [ "testgroup1" ];
+            };
+          };
+        };
+
      security.pki.certificateFiles = [ certs.ca.cert ];

      networking.hosts."::1" = [ serverDomain ];
@@ -515,6 +538,25 @@ in
          out = provision.succeed("kanidm system oauth2 get service2")
          assert_lacks(out, "name: service2")

+          provision.succeed("kanidm logout -D idm_admin")
+
+      with subtest("Test Provisioning - extraJsonFile"):
+          provision.succeed('${specialisations}/extraJsonFile/bin/switch-to-configuration test')
+          provision_login("${provisionIdmAdminPassword}")
+
+          out = provision.succeed("kanidm group get testgroup1")
+          assert_contains(out, "name: testgroup1")
+
+          out = provision.succeed("kanidm person get testuser1")
+          assert_contains(out, "name: testuser1")
+
+          out = provision.succeed("kanidm person get testuser2")
+          assert_contains(out, "name: testuser2")
+
+          out = provision.succeed("kanidm group get testgroup1")
+          assert_contains(out, "member: testuser1")
+          assert_contains(out, "member: testuser2")
+
          provision.succeed("kanidm logout -D idm_admin")
    '';
 }
@@ -1,5 +1,8 @@
 { pkgs, lib, ... }:

+let
+  rtmpUrl = "rtmp://localhost:1935/test";
+in
 {
  name = "mediamtx";
  meta.maintainers = with lib.maintainers; [ fpletz ];
@@ -23,8 +26,8 @@
          DynamicUser = true;
          Restart = "on-failure";
          RestartSec = "1s";
-          TimeoutStartSec = "10s";
-          ExecStart = "${lib.getBin pkgs.ffmpeg-headless}/bin/ffmpeg -re -f lavfi -i smptebars=size=800x600:rate=10 -c libx264 -f flv rtmp://localhost:1935/test";
+          TimeoutStartSec = "30s";
+          ExecStart = "${lib.getBin pkgs.ffmpeg-headless}/bin/ffmpeg -re -f lavfi -i smptebars=size=800x600:rate=10 -c libx264 -f flv ${rtmpUrl}";
        };
      };

@@ -33,12 +36,13 @@
        after = [ "rtmp-publish.service" ];
        bindsTo = [ "rtmp-publish.service" ];
        wantedBy = [ "multi-user.target" ];
+        unitConfig.StartLimitIntervalSec = 0;
        serviceConfig = {
          DynamicUser = true;
          Restart = "on-failure";
          RestartSec = "1s";
-          TimeoutStartSec = "10s";
-          ExecStart = "${lib.getBin pkgs.ffmpeg-headless}/bin/ffmpeg -y -re -i rtmp://localhost:1935/test -f flv /dev/null";
+          TimeoutStartSec = "30s";
+          ExecStart = "${lib.getBin pkgs.ffmpeg-headless}/bin/ffmpeg -y -re -i ${rtmpUrl} -f flv /dev/null";
        };
      };
    };
@@ -48,11 +52,11 @@
    start_all()

    machine.wait_for_unit("mediamtx.service")
+
    machine.wait_for_unit("rtmp-publish.service")
-    machine.sleep(10)
+    machine.wait_until_succeeds("curl http://localhost:9998/metrics | grep '^rtmp_conns.*state=\"publish\".*1$'")
+
    machine.wait_for_unit("rtmp-receive.service")
-    machine.wait_for_open_port(9998)
-    machine.succeed("curl http://localhost:9998/metrics | grep '^rtmp_conns.*state=\"publish\".*1$'")
-    machine.succeed("curl http://localhost:9998/metrics | grep '^rtmp_conns.*state=\"read\".*1$'")
+    machine.wait_until_succeeds("curl http://localhost:9998/metrics | grep '^rtmp_conns.*state=\"read\".*1$'")
  '';
 }
@@ -3,12 +3,12 @@ let
  rcon-pass = "foobar";
  rcon-port = 43000;
 in
-{ pkgs, ... }:
+{ lib, pkgs, ... }:
 {
  name = "minecraft-server";
-  meta = with pkgs.lib.maintainers; {
-    maintainers = [ nequissimus ];
-  };
+  meta.maintainers = with lib.maintainers; [ nequissimus ];
+
+  node.pkgsReadOnly = false;

  nodes.server =
    { ... }:
@@ -1,37 +1,33 @@
 {
-  pkgs,
+  package,
  lib,
-  package ? pkgs.odoo,
+  pkgs,
  ...
 }:
 {
  name = "odoo";
  meta.maintainers = with lib.maintainers; [ mkg20001 ];

-  nodes = {
-    server =
-      { ... }:
-      {
-        services.nginx = {
-          enable = true;
-          recommendedProxySettings = true;
-        };
+  _module.args.package = lib.mkDefault pkgs.odoo;

-        services.odoo = {
-          enable = true;
-          package = package;
-          autoInit = true;
-          autoInitExtraFlags = [ "--without-demo=all" ];
-          domain = "localhost";
-        };
-      };
+  nodes.server = {
+    services.nginx = {
+      enable = true;
+      recommendedProxySettings = true;
+    };
+
+    services.odoo = {
+      enable = true;
+      package = package;
+      autoInit = true;
+      autoInitExtraFlags = [ "--without-demo=all" ];
+      domain = "localhost";
+    };
  };

-  testScript =
-    { nodes, ... }:
-    ''
-      server.wait_for_unit("odoo.service")
-      server.wait_until_succeeds("curl -s http://localhost:8069/web/database/selector | grep '<title>Odoo</title>'")
-      server.succeed("curl -s http://localhost/web/database/selector | grep '<title>Odoo</title>'")
-    '';
+  testScript = ''
+    server.wait_for_unit("odoo.service")
+    server.wait_until_succeeds("curl -s http://localhost:8069/web/database/selector | grep '<title>Odoo</title>'")
+    server.succeed("curl -s http://localhost/web/database/selector | grep '<title>Odoo</title>'")
+  '';
 }
@@ -54,7 +54,7 @@ in
  name = "openldap";

  nodes.machine =
-    { pkgs, ... }:
+    { config, pkgs, ... }:
    {
      environment.etc."openldap/root_password".text = "notapassword";

@@ -124,6 +124,8 @@ in
          configuration =
            { ... }:
            {
+              nixpkgs.hostPlatform = config.nixpkgs.hostPlatform;
+
              users.ldap = ldapClientConfig;
              services.openldap = {
                enable = true;
@@ -133,6 +135,7 @@ in
        };
      };
    };
+
  testScript =
    { nodes, ... }:
    let
@@ -15,28 +15,28 @@ in

  meta.maintainers = lib.teams.cyberus.members;

-  nodes = {
-    outline =
-      { pkgs, config, ... }:
-      {
-        nixpkgs.config.allowUnfree = true;
-        environment.systemPackages = [ pkgs.minio-client ];
-        services.outline = {
-          enable = true;
-          forceHttps = false;
-          storage = {
-            inherit accessKey secretKeyFile;
-            uploadBucketUrl = "http://localhost:9000";
-            uploadBucketName = "outline";
-            region = config.services.minio.region;
-          };
-        };
-        services.minio = {
-          enable = true;
-          inherit rootCredentialsFile;
+  node.pkgsReadOnly = false;
+
+  nodes.outline =
+    { pkgs, config, ... }:
+    {
+      nixpkgs.config.allowUnfree = true;
+      environment.systemPackages = [ pkgs.minio-client ];
+      services.outline = {
+        enable = true;
+        forceHttps = false;
+        storage = {
+          inherit accessKey secretKeyFile;
+          uploadBucketUrl = "http://localhost:9000";
+          uploadBucketName = "outline";
+          region = config.services.minio.region;
        };
      };
-  };
+      services.minio = {
+        enable = true;
+        inherit rootCredentialsFile;
+      };
+    };

  testScript = ''
    machine.wait_for_unit("minio.service")
@@ -1,7 +1,5 @@
-{ pkgs, lib, ... }:
-
+{ lib, ... }:
 let
-
  # Build Quake with coverage instrumentation.
  overrides = pkgs: {
    quake3game = pkgs.quake3game.override (args: {
@@ -23,7 +21,6 @@ let

  client =
    { pkgs, ... }:
-
    {
      imports = [ ./common/x11.nix ];
      hardware.graphics.enable = true;
@@ -31,14 +28,12 @@ let
      nixpkgs.config.packageOverrides = overrides;
      nixpkgs.config.allowUnfreePredicate = unfreePredicate;
    };
-
 in
-
-rec {
+{
  name = "quake3";
-  meta = with lib.maintainers; {
-    maintainers = [ domenkozar ];
-  };
+  meta.maintainers = with lib.maintainers; [ domenkozar ];
+
+  node.pkgsReadOnly = false;

  # TODO: lcov doesn't work atm
  #makeCoverageReport = true;
@@ -46,7 +41,6 @@ rec {
  nodes = {
    server =
      { pkgs, ... }:
-
      {
        systemd.services.quake3-server = {
          wantedBy = [ "multi-user.target" ];
@@ -96,5 +90,4 @@ rec {
    client2.shutdown()
    server.stop_job("quake3-server")
  '';
-
 }
@@ -1,12 +1,12 @@
-{ pkgs, lib, ... }:
+{ lib, ... }:
 {
  name = "sabnzbd";
-  meta = with pkgs.lib; {
-    maintainers = with maintainers; [ jojosch ];
-  };
+  meta.maintainers = with lib.maintainers; [ jojosch ];
+
+  node.pkgsReadOnly = false;

  nodes.machine =
-    { pkgs, ... }:
+    { lib, ... }:
    {
      services.sabnzbd = {
        enable = true;
@@ -43,9 +43,9 @@ let
 in
 {
  name = "squid";
-  meta = with pkgs.lib.maintainers; {
-    maintainers = [ cobalt ];
-  };
+  meta.maintainers = with lib.maintainers; [ cobalt ];
+
+  node.pkgsReadOnly = false;

  nodes = {
    client =
@@ -30,7 +30,7 @@ import ../make-test-python.nix (
        machine.succeed("stratis pool rebind keyring  testpool testkey2")
        # test restarting encrypted pool
        machine.succeed("stratis pool stop  --name testpool")
-        machine.succeed("stratis pool start --name testpool --unlock-method keyring")
+        machine.succeed("stratis pool start --name testpool --unlock-method any")
      '';
  }
 )
@@ -1,14 +1,14 @@
 {
-  pkgs,
-  latestKernel ? false,
+  latestKernel,
+  lib,
  ...
 }:

 {
  name = "systemd-analyze";
-  meta = with pkgs.lib.maintainers; {
-    maintainers = [ raskin ];
-  };
+  meta.maintainers = with lib.maintainers; [ raskin ];
+
+  _module.args.latestKernel = lib.mkDefault false;

  nodes.machine =
    { pkgs, lib, ... }:
@@ -1,6 +1,7 @@
 {
+  systemdStage1,
+  lib,
  pkgs,
-  systemdStage1 ? false,
  ...
 }:
 let
@@ -8,9 +9,9 @@ let
 in
 {
  name = "systemd-shutdown";
-  meta = with pkgs.lib.maintainers; {
-    maintainers = [ das_j ];
-  };
+  meta.maintainers = with lib.maintainers; [ das_j ];
+
+  _module.args.systemdStage1 = lib.mkDefault false;

  nodes.machine = {
    imports = [ ../modules/profiles/minimal.nix ];
@@ -10,20 +10,23 @@ let
      (lib.take 2)
      (lib.concatStringsSep ".")
    ];
-  oldApiVersion = apiVersion pkgs."${oldNetbox}".version;
-  newApiVersion = apiVersion pkgs."${newNetbox}".version;
+  oldApiVersion = apiVersion pkgs.${oldNetbox}.version;
+  newApiVersion = apiVersion pkgs.${newNetbox}.version;
 in
 {
  name = "netbox-upgrade";

-  meta = with lib.maintainers; {
-    maintainers = [
-      minijackson
-      raitobezarius
-    ];
-  };
+  meta.maintainers = with lib.maintainers; [
+    minijackson
+    raitobezarius
+  ];
+
+  node.pkgsReadOnly = false;

  nodes.machine =
+    let
+      pkgs' = pkgs;
+    in
    { config, pkgs, ... }:
    {
      virtualisation.memorySize = 2048;
@@ -31,7 +34,7 @@ in
        enable = true;
        # Pick the NetBox package from this config's "pkgs" argument,
        # so that `nixpkgs.config.permittedInsecurePackages` works
-        package = pkgs."${oldNetbox}";
+        package = pkgs.${oldNetbox};
        secretKeyFile = pkgs.writeText "secret" ''
          abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
        '';
@@ -53,9 +56,9 @@ in

      networking.firewall.allowedTCPPorts = [ 80 ];

-      nixpkgs.config.permittedInsecurePackages = [ pkgs."${oldNetbox}".name ];
+      nixpkgs.config.permittedInsecurePackages = [ pkgs'.${oldNetbox}.name ];

-      specialisation.upgrade.configuration.services.netbox.package = lib.mkForce pkgs."${newNetbox}";
+      specialisation.upgrade.configuration.services.netbox.package = lib.mkForce pkgs.${newNetbox};
    };

  testScript =
@@ -1,30 +1,28 @@
 { lib, ... }:
 {
  name = "without-nix";
-  meta = with lib.maintainers; {
-    maintainers = [ ericson2314 ];
-  };
+  meta.maintainers = with lib.maintainers; [ ericson2314 ];

-  nodes.machine =
-    { ... }:
-    {
-      nix.enable = false;
-      nixpkgs.overlays = [
-        (self: super: {
-          nix = throw "don't want to use pkgs.nix";
-          nixVersions = lib.mapAttrs (k: throw "don't want to use pkgs.nixVersions.${k}") super.nixVersions;
-          # aliases, some deprecated
-          nix_2_3 = throw "don't want to use pkgs.nix_2_3";
-          nix_2_4 = throw "don't want to use pkgs.nix_2_4";
-          nix_2_5 = throw "don't want to use pkgs.nix_2_5";
-          nix_2_6 = throw "don't want to use pkgs.nix_2_6";
-          nixFlakes = throw "don't want to use pkgs.nixFlakes";
-          nixStable = throw "don't want to use pkgs.nixStable";
-          nixUnstable = throw "don't want to use pkgs.nixUnstable";
-          nixStatic = throw "don't want to use pkgs.nixStatic";
-        })
-      ];
-    };
+  node.pkgsReadOnly = false;
+
+  nodes.machine = {
+    nix.enable = false;
+    nixpkgs.overlays = [
+      (self: super: {
+        nix = throw "don't want to use pkgs.nix";
+        nixVersions = lib.mapAttrs (k: throw "don't want to use pkgs.nixVersions.${k}") super.nixVersions;
+        # aliases, some deprecated
+        nix_2_3 = throw "don't want to use pkgs.nix_2_3";
+        nix_2_4 = throw "don't want to use pkgs.nix_2_4";
+        nix_2_5 = throw "don't want to use pkgs.nix_2_5";
+        nix_2_6 = throw "don't want to use pkgs.nix_2_6";
+        nixFlakes = throw "don't want to use pkgs.nixFlakes";
+        nixStable = throw "don't want to use pkgs.nixStable";
+        nixUnstable = throw "don't want to use pkgs.nixUnstable";
+        nixStatic = throw "don't want to use pkgs.nixStatic";
+      })
+    ];
+  };

  testScript = ''
    start_all()
@@ -33,6 +33,7 @@
  libdrm,
  libpng,
  libuuid,
+  libsecret,
  libX11,
  libxcb,
  libxkbcommon,
@@ -130,6 +131,7 @@ let
            git
            ps
            usbutils
+            libsecret
          ]
        }" \
        --prefix LD_LIBRARY_PATH : "${
@@ -142,6 +144,7 @@ let
            libXi
            libXrender
            libXtst
+            libsecret

            # No crash, but attempted to load at startup
            e2fsprogs
@@ -344,7 +347,6 @@ let
            ."${channel}";
          mainProgram = pname;
          sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
-          position = "pkgs/applications/editors/android-studio/common.nix:303";
        };
      }
      ''
@@ -48,7 +48,7 @@ let
      viAlias ? false,

      # additional argument not generated by makeNeovimConfig
-      # it will append "-u <customRc>" to the wrapped arguments
+      # it sets the VIMINIT environment variable to "lua dofile('${customRc}')"
      # set to false if you want to control where to save the generated config
      # (e.g., in ~/.config/init.vim or project/.nvimrc)
      wrapRc ? true,
@@ -193,8 +193,9 @@ let
            "${placeholder "out"}/rplugin.vim"
          ]
          ++ lib.optionals finalAttrs.wrapRc [
-            "--add-flags"
-            "-u ${writeText "init.lua" rcContent}"
+            "--set-default"
+            "VIMINIT"
+            "lua dofile('${writeText "init.lua" rcContent}')"
          ]
          ++ finalAttrs.generatedWrapperArgs;

@@ -89,8 +89,8 @@ let
        mktplcRef = {
          publisher = "42Crunch";
          name = "vscode-openapi";
-          version = "4.33.2";
-          hash = "sha256-agCxi2UhJitdQmHIf6rK7WexkfljUQdqK5rLqzV4J6o=";
+          version = "4.34.0";
+          hash = "sha256-iGVXWKa7xX4WrUeta8ofsXWHQSlxpv8289R9iFdPaII=";
        };
        meta = {
          changelog = "https://marketplace.visualstudio.com/items/42Crunch.vscode-openapi/changelog";
@@ -411,8 +411,8 @@ let
        mktplcRef = {
          name = "vscode-neovim";
          publisher = "asvetliakov";
-          version = "1.18.21";
-          hash = "sha256-I5jrp8sGn+M8bJo93jNrx+s4sB0p3sGN4lLLROstkKA=";
+          version = "1.18.22";
+          hash = "sha256-nSRZGRhqRO52dx3QfSJZR5uVNVaxw0mcH/JBFyrUGKA=";
        };
        meta = {
          changelog = "https://marketplace.visualstudio.com/items/asvetliakov.vscode-neovim/changelog";
@@ -1181,8 +1181,8 @@ let
        mktplcRef = {
          name = "vscode-database-client2";
          publisher = "cweijan";
-          version = "8.3.2";
-          hash = "sha256-cBFc8F8FwP7rSWyRTZqi19MihwHE6xNpb4I4O+4zhWs=";
+          version = "8.3.4";
+          hash = "sha256-rZ/xYe5Ng532XhLCzCtVmcYTDekAaMu3vLnvTagFupE=";
        };
        meta = {
          description = "Database Client For Visual Studio Code";
@@ -2129,8 +2129,8 @@ let
        mktplcRef = {
          name = "gitlab-workflow";
          publisher = "gitlab";
-          version = "6.13.1";
-          hash = "sha256-v+gnZPemEMtyBNxwQf0OOp1QSy1+uWDNH9tBu4HwGDg=";
+          version = "6.17.0";
+          hash = "sha256-4/wGrHFB7yn7WTJq9igOU6XTOQZ1PGZ6kdMBP/IlZqw=";
        };
        meta = {
          description = "GitLab extension for Visual Studio Code";
@@ -2975,8 +2975,8 @@ let
        mktplcRef = {
          name = "vscord";
          publisher = "leonardssh";
-          version = "5.2.13";
-          hash = "sha256-Jgm3ekXFLhylX7RM6tdfi+lRLrcl4UQGmRHbr27M59M=";
+          version = "5.3.2";
+          hash = "sha256-kj1D0X6Wj088nwgFlWZkPG+zaHsqb0MapycPIfRWEIk=";
        };
        meta = {
          description = "Highly customizable Discord Rich Presence extension for Visual Studio Code";
@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
  mktplcRef = {
    publisher = "ms-pyright";
    name = "pyright";
-    version = "1.1.400";
-    hash = "sha256-Twpsxtr6fUSDgCfMYFJF3asgaKLB/axIvOZRItuFyig=";
+    version = "1.1.401";
+    hash = "sha256-EkuF7GqGH30KSZzJVBJhLso6HkOi2fyzsO+fS8KQvaE=";
  };

  meta = {
@@ -15,8 +15,8 @@ vscode-utils.buildVscodeMarketplaceExtension rec {
  mktplcRef = {
    name = "python";
    publisher = "ms-python";
-    version = "2025.6.0";
-    hash = "sha256-DtnBFLSQj9y7UiHRhOILuua6c2eeJcFiyMNlIjTor9g=";
+    version = "2025.6.1";
+    hash = "sha256-aCutbmWI68IRqAwztQ9USo996zWL29UO2eAC75b3/IY=";
  };

  buildInputs = [ icu ];
@@ -8,8 +8,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
  mktplcRef = {
    publisher = "RooVeterinaryInc";
    name = "roo-cline";
-    version = "3.17.1";
-    hash = "sha256-gfzn0KulOHUKcG3LNF7+g7VwkDHR4BYsmq730Uuv2ZU=";
+    version = "3.18.3";
+    hash = "sha256-kg4kXO7UwDQPXb6CAysaez2v8FPRMbX+f41vE68V0QA=";
  };

  passthru.updateScript = vscode-extension-update-script { };
@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
  mktplcRef = {
    name = "claude-dev";
    publisher = "saoudrizwan";
-    version = "3.16.1";
-    hash = "sha256-o8sU4daSeaq6x24mGcBW84Z0SwLu76hZWA9ihlYlT1w=";
+    version = "3.17.7";
+    hash = "sha256-Sn3yyt1xMYYvUQKrY0YliCKS46g5VfvFZPgeSoc1c8E=";
  };

  meta = {
@@ -797,27 +797,27 @@
    }
  },
  "ungoogled-chromium": {
-    "version": "136.0.7103.113",
+    "version": "137.0.7151.55",
    "deps": {
      "depot_tools": {
-        "rev": "f40ddcd8d51626fb7be3ab3c418b3f3be801623f",
-        "hash": "sha256-O9vVbrCqHD4w39Q8ZAxl1RwzJxbH/thjqacMtCnOPdg="
+        "rev": "1fcc527019d786502b02f71b8b764ee674a40953",
+        "hash": "sha256-7HJyJARZPes5MmKgXd3TV1uRjk0bH/pkPm+F4scg+Tc="
      },
      "gn": {
-        "rev": "6e8e0d6d4a151ab2ed9b4a35366e630c55888444",
-        "hash": "sha256-vDKMt23RMDI+KX6CmjfeOhRv2haf/mDOuHpWKnlODcg="
+        "rev": "85cc21e94af590a267c1c7a47020d9b420f8a033",
+        "hash": "sha256-+nKP2hBUKIqdNfDz1vGggXSdCuttOt0GwyGUQ3Z1ZHI="
      },
      "ungoogled-patches": {
-        "rev": "136.0.7103.113-1",
-        "hash": "sha256-+xQvBkwza1QLwWgijoMnih2k2v0I7cBiAjxOeqMf6A0="
+        "rev": "137.0.7151.55-1",
+        "hash": "sha256-m8un3k5gz8nqQIvulvV2yhY/TQZ7wcp1zwQmtqjbCEw="
      },
-      "npmHash": "sha256-QRjk9X4rJW3ofizK33R4T1qym1riqcnpBhDF+FfNZLo="
+      "npmHash": "sha256-I6MsfAhrLRmgiRJ13LSejfy2N63C3Oug5tOOXA622j4="
    },
    "DEPS": {
      "src": {
        "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "76fa3c1782406c63308c70b54f228fd39c7aaa71",
-        "hash": "sha256-U6WsxmGf4eFKVBBgppoHIfMlrT34a1oymZETzEhzkQA=",
+        "rev": "254bc711794d7ad269495f3d419a209935b78cad",
+        "hash": "sha256-dB81lgjgVK0qXWgAddB7G4L7rsJpZp+0VsjDKvGugEs=",
        "recompress": true
      },
      "src/third_party/clang-format/script": {
@@ -827,28 +827,28 @@
      },
      "src/third_party/compiler-rt/src": {
        "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/compiler-rt.git",
-        "rev": "bc2b30185219a2defe3c8a3b45f95a11386a7f6f",
-        "hash": "sha256-bfDMglQaiExTFwaVBroia+6G+9AHEVy5cQGocaEVOgA="
+        "rev": "d0e4db9fcea15a392aaada986cbe33658afc0454",
+        "hash": "sha256-P/uDeqalafY1S7AqZkL1Pz7Jc+iWrkfiACxEtgTRqdU="
      },
      "src/third_party/libc++/src": {
        "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxx.git",
-        "rev": "449310fe2e37834a7e62972d2a690cade2ef596b",
-        "hash": "sha256-Ypi5fmWdoNA1IZDoKITlkNRITmho8HzVlgjlmtx0Y84="
+        "rev": "9d0cba76be7399399d3a499ff3a52c264db3b104",
+        "hash": "sha256-wpMma142NBqyrSbaReQr5yOYhvQIZ06j6S2EUnXmZ2I="
      },
      "src/third_party/libc++abi/src": {
        "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxxabi.git",
-        "rev": "94c5d7a8edc09f0680aee57548c0b5d400c2840d",
-        "hash": "sha256-wMMfj3E2AQJxovoSEIuT2uTyrcGBurS1HrHZOmP36+g="
+        "rev": "f2a7f2987f9dcdf8b04c2d8cd4dcb186641a7c3e",
+        "hash": "sha256-X9cAbyd8ZPSwqOGhPYwIZ6b9E3tVwAuAYZKMgbZQxgk="
      },
      "src/third_party/libunwind/src": {
        "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libunwind.git",
-        "rev": "e2e6f2a67e9420e770b014ce9bba476fa2ab9874",
-        "hash": "sha256-LdRaxPo2i7uMeFxpR7R4o3V+1ycBcygT/D+gklsD0tA="
+        "rev": "81e2cb40a70de2b6978e6d8658891ded9a77f7e3",
+        "hash": "sha256-XdFKn+cGOxA0fHkVMG9UAhCmpML44ocoyHB7XnumX7o="
      },
      "src/third_party/llvm-libc/src": {
        "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libc.git",
-        "rev": "97989c1bfa112c81f6499487fedc661dcf6d3b2e",
-        "hash": "sha256-9Ieaxe0PFIIP4RttODd8pTw/zVjQZGZtaYSybwnzTz0="
+        "rev": "cc59264cf9b2ecab0cfc8b51f6f1878372416d36",
+        "hash": "sha256-wQMUL5uAaR8sA1V0FHTZv3jVVaF3NxiHfNnlMq3YImY="
      },
      "src/chrome/test/data/perf/canvas_bench": {
        "url": "https://chromium.googlesource.com/chromium/canvas_bench.git",
@@ -867,18 +867,18 @@
      },
      "src/docs/website": {
        "url": "https://chromium.googlesource.com/website.git",
-        "rev": "929dd3e6d02aac1f46653d03b2a644e2873a3bbb",
-        "hash": "sha256-lY4P2f90/9JwCpxuBFjim7KygczM8zMDQVUaEYaQjnA="
+        "rev": "e157e12d99cfc729a970b474344673c44e2d2c9c",
+        "hash": "sha256-fowwJbXOR4OIN4+1bJEWv9VP/TLHb9+H1Vt3apVLwkk="
      },
      "src/media/cdm/api": {
        "url": "https://chromium.googlesource.com/chromium/cdm.git",
-        "rev": "5a1675c86821a48f8983842d07f774df28dfb43c",
-        "hash": "sha256-FgeuOsxToA4qx3H76czCPeO/WVtprRkllDMPancw3Ik="
+        "rev": "852a81f0ae3ab350041d2e44d207a42fb0436ae1",
+        "hash": "sha256-3JBBcBg2ep/7LnvMHBWnqAFG+etETArFXZr4Klv30T4="
      },
      "src/net/third_party/quiche/src": {
        "url": "https://quiche.googlesource.com/quiche.git",
-        "rev": "5077431b183c43f10890b865fc9f02a4dcf1dd85",
-        "hash": "sha256-CLvZTBvtTdOpC8eWUTWkb0ITJ5EViPmc6d5O8cTaKY8="
+        "rev": "faec206356fe384c522f34982ae2e92f2f111242",
+        "hash": "sha256-8SuRhYAD3RWMiqD/a8usrRnYKd6prAK5jdwJVXRI+Q0="
      },
      "src/testing/libfuzzer/fuzzers/wasm_corpus": {
        "url": "https://chromium.googlesource.com/v8/fuzzer_wasm_corpus.git",
@@ -892,8 +892,8 @@
      },
      "src/third_party/angle": {
        "url": "https://chromium.googlesource.com/angle/angle.git",
-        "rev": "fa40b7c586fd2da9fd7e5c4d893ecb1334553b9e",
-        "hash": "sha256-bIpN9lehrKpJYBKLeo8Szz0/aVe7NU2Eo2NIO5dAZ9w="
+        "rev": "df9c59dcacff7d186d00e3263a1aa68f8059137c",
+        "hash": "sha256-ybi/DwOQ10I+MK9buKpdNcUlFAI9RA3NfyoB3Udpfyo="
      },
      "src/third_party/angle/third_party/glmark2/src": {
        "url": "https://chromium.googlesource.com/external/github.com/glmark2/glmark2",
@@ -907,8 +907,8 @@
      },
      "src/third_party/angle/third_party/VK-GL-CTS/src": {
        "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/VK-GL-CTS",
-        "rev": "b6bb4bab7b4a36bc95566e00cb8f01051089afc3",
-        "hash": "sha256-L2ewIW6C+PTftbbXf+nlWcFD0y4naBNg7FLXMMxiWac="
+        "rev": "dd7e71367795e2dc4d46effda5378f22e9000d16",
+        "hash": "sha256-EZoSoDLFWRR2xkHOKNaNVQvubFp8in0p7/CHN8CFaVI="
      },
      "src/third_party/anonymous_tokens/src": {
        "url": "https://chromium.googlesource.com/external/github.com/google/anonymous-tokens.git",
@@ -927,8 +927,8 @@
      },
      "src/third_party/dawn": {
        "url": "https://dawn.googlesource.com/dawn.git",
-        "rev": "1cffe7ec763900d104e4df62bc96d93f572157cb",
-        "hash": "sha256-VK+5saAJlZOluMAYKTKwNcnZALsCYkzgVfQHylt3584="
+        "rev": "fbe707f88ccabca01031e47bf165bd9d499878dd",
+        "hash": "sha256-8tmDR3l7eHWUfVRU90Kg76N/moU6Lb5b3FySJOckl8U="
      },
      "src/third_party/dawn/third_party/glfw": {
        "url": "https://chromium.googlesource.com/external/github.com/glfw/glfw",
@@ -937,8 +937,8 @@
      },
      "src/third_party/dawn/third_party/dxc": {
        "url": "https://chromium.googlesource.com/external/github.com/microsoft/DirectXShaderCompiler",
-        "rev": "206b77577d15fc5798eb7ad52290388539b7146d",
-        "hash": "sha256-WXgiOlqtczrUkXp46Q/GTaYk0LDqebQSFbyWpD299Xw="
+        "rev": "8209d53f0ef0257e5b8c78d22057086403946cca",
+        "hash": "sha256-2yM8Fct7Ru8ZSFr+Qm1Bv52K2/geAwmOpWc/X7yxLQY="
      },
      "src/third_party/dawn/third_party/dxheaders": {
        "url": "https://chromium.googlesource.com/external/github.com/microsoft/DirectX-Headers",
@@ -957,8 +957,8 @@
      },
      "src/third_party/dawn/third_party/webgpu-cts": {
        "url": "https://chromium.googlesource.com/external/github.com/gpuweb/cts",
-        "rev": "5fbd82847521cb2d584773facd56c2eb6a4df180",
-        "hash": "sha256-WTVOc2EVB/DJ4aDeB8XIF/ff6LSeEUMt2Xkvj5Hu4aU="
+        "rev": "3df76734dc695c4d1c51276b5d9eb63078362972",
+        "hash": "sha256-4jCsCt2rcUpUk2xeL3tZx/jTnuJ+COG+xsDtR+sK1oQ="
      },
      "src/third_party/highway/src": {
        "url": "https://chromium.googlesource.com/external/github.com/google/highway.git",
@@ -972,13 +972,13 @@
      },
      "src/third_party/boringssl/src": {
        "url": "https://boringssl.googlesource.com/boringssl.git",
-        "rev": "a9993612faac4866bc33ca8ff37bfd0659af1c48",
-        "hash": "sha256-fUPl9E2b7RfanH0pZNArIkJ4lnnmCtyk7sCaTArCB70="
+        "rev": "918cf66ed841930fe1554ae8d78974b95e989596",
+        "hash": "sha256-gzcXse/emv9JBMiInUV5KTeyMQ0igUdFpzUJR4vCUu4="
      },
      "src/third_party/breakpad/breakpad": {
        "url": "https://chromium.googlesource.com/breakpad/breakpad.git",
-        "rev": "657a441e5c1a818d4c10b7bafd431454e6614901",
-        "hash": "sha256-9MePkv10fwyJ0VDWRtvRcbLMAcJzZlziGTPzXJYjVJE="
+        "rev": "232a723f5096ab02d53d87931efa485fa77d3b03",
+        "hash": "sha256-0ynZuxIqBIpNkfD3Y9XdPFQr7HeQcsUO3lhnqvH+k8c="
      },
      "src/third_party/cast_core/public/src": {
        "url": "https://chromium.googlesource.com/cast_core/public",
@@ -987,8 +987,8 @@
      },
      "src/third_party/catapult": {
        "url": "https://chromium.googlesource.com/catapult.git",
-        "rev": "5bda0fdab9d93ec9963e2cd858c7b49ad7fec7d4",
-        "hash": "sha256-xwR9gGE8uU8qFr7GgS3/1JiuTmj1tvcM5CoCfPMdW2M="
+        "rev": "000f47cfa393d7f9557025a252862e2a61a60d44",
+        "hash": "sha256-FIJZE1Qu1MLZA4qxB68k1NjhgSbFTjf57YF85JicVZw="
      },
      "src/third_party/ced/src": {
        "url": "https://chromium.googlesource.com/external/github.com/google/compact_enc_det.git",
@@ -1012,8 +1012,8 @@
      },
      "src/third_party/cpuinfo/src": {
        "url": "https://chromium.googlesource.com/external/github.com/pytorch/cpuinfo.git",
-        "rev": "b73ae6ce38d5dd0b7fe46dbe0a4b5f4bab91c7ea",
-        "hash": "sha256-JNLaK105qDk9DxTqCFyXFfYn46dF+nZIaF5urSVRa0U="
+        "rev": "39ea79a3c132f4e678695c579ea9353d2bd29968",
+        "hash": "sha256-uochXC0AtOw8N/ycyVJdiRw4pibCW2ENrFMT3jtxDSg="
      },
      "src/third_party/crc32c/src": {
        "url": "https://chromium.googlesource.com/external/github.com/google/crc32c.git",
@@ -1022,29 +1022,34 @@
      },
      "src/third_party/cros_system_api": {
        "url": "https://chromium.googlesource.com/chromiumos/platform2/system_api.git",
-        "rev": "62ab80355a8194e051bd1d93a5c09093c7645a32",
-        "hash": "sha256-pZi6GRu7OGL7jbN4FM2qDsLCsT6cM+RM0a7XtFZVSVE="
+        "rev": "68114875ad35b573034a2ab1f5cdf3dbb0e59468",
+        "hash": "sha256-cGpteAnjGcxJUcrdLRFfQN7ruTEdNvNCbOH6EC+a39s="
      },
      "src/third_party/crossbench": {
        "url": "https://chromium.googlesource.com/crossbench.git",
-        "rev": "ce46be2573328fa7b0fd1d23c04b63389f298122",
-        "hash": "sha256-Q0kdJdEmh+wbO5oeTp98OHKh9luz8u6PDztGToldZjk="
+        "rev": "d91cc488cd651b00009e5d6c70f222362598bec9",
+        "hash": "sha256-o/sw1P+mZOSb6XIVFivC02hTPu++x+xJy2SRP2I9yGE="
      },
      "src/third_party/depot_tools": {
        "url": "https://chromium.googlesource.com/chromium/tools/depot_tools.git",
-        "rev": "f40ddcd8d51626fb7be3ab3c418b3f3be801623f",
-        "hash": "sha256-O9vVbrCqHD4w39Q8ZAxl1RwzJxbH/thjqacMtCnOPdg="
+        "rev": "1fcc527019d786502b02f71b8b764ee674a40953",
+        "hash": "sha256-7HJyJARZPes5MmKgXd3TV1uRjk0bH/pkPm+F4scg+Tc="
      },
      "src/third_party/devtools-frontend/src": {
        "url": "https://chromium.googlesource.com/devtools/devtools-frontend",
-        "rev": "4a53cbe7a1270c91ec60903ee792de658453becb",
-        "hash": "sha256-hEksLeJli/1TNNrDcUjv19cpyIJph6kfriNfe7FWO0U="
+        "rev": "a54ed1df191a9e2aff2e9ef453ee6fdc959dd125",
+        "hash": "sha256-E6sx2ioDZRWJljbS17ztRwz+gsDhIHiluvkUx1rRZcw="
      },
      "src/third_party/dom_distiller_js/dist": {
        "url": "https://chromium.googlesource.com/chromium/dom-distiller/dist.git",
        "rev": "199de96b345ada7c6e7e6ba3d2fa7a6911b8767d",
        "hash": "sha256-yuEBD2XQlV3FGI/i7lTmJbCqzeBiuG1Qow8wvsppGJw="
      },
+      "src/third_party/dragonbox/src": {
+        "url": "https://chromium.googlesource.com/external/github.com/jk-jeon/dragonbox.git",
+        "rev": "6c7c925b571d54486b9ffae8d9d18a822801cbda",
+        "hash": "sha256-AOniXMPgwKpkJqivRd+GazEnhdw53FzhxKqG+GdU+cc="
+      },
      "src/third_party/eigen3/src": {
        "url": "https://chromium.googlesource.com/external/gitlab.com/libeigen/eigen.git",
        "rev": "464c1d097891a1462ab28bf8bb763c1683883892",
@@ -1062,8 +1067,8 @@
      },
      "src/third_party/ffmpeg": {
        "url": "https://chromium.googlesource.com/chromium/third_party/ffmpeg.git",
-        "rev": "fbce2a76c00cd2e5aeffe3c2e71d44c284ec52d6",
-        "hash": "sha256-bGa0BCvzNxEKu9VZEwJ1NLt+b2KKWUxshpKSN2FHNEM="
+        "rev": "01f23648c6b84de6c0f717fa4e1816f53b9ee72e",
+        "hash": "sha256-hNzQZQxaa2Wtl7GWWF852cFmmXy4pc15Pp0d59TTfnI="
      },
      "src/third_party/flac": {
        "url": "https://chromium.googlesource.com/chromium/deps/flac.git",
@@ -1092,8 +1097,8 @@
      },
      "src/third_party/freetype/src": {
        "url": "https://chromium.googlesource.com/chromium/src/third_party/freetype2.git",
-        "rev": "82090e67c24259c343c83fd9cefe6ff0be7a7eca",
-        "hash": "sha256-LhSIX7X0+dmLADYGNclg73kIrXmjTMM++tJ92MKzanA="
+        "rev": "2d1abd3bbb4d2396ed63b3e5accd66724cf62307",
+        "hash": "sha256-MAVHzILj9f+/HfVjZXyJkSQM3WBwzg7IDpAwiYHfA88="
      },
      "src/third_party/freetype-testing/src": {
        "url": "https://chromium.googlesource.com/external/github.com/freetype/freetype2-testing.git",
@@ -1107,18 +1112,18 @@
      },
      "src/third_party/harfbuzz-ng/src": {
        "url": "https://chromium.googlesource.com/external/github.com/harfbuzz/harfbuzz.git",
-        "rev": "8efd2d85c78fbba6ca09a3e454f77525f3b296ce",
-        "hash": "sha256-/WNGrvyvJ+FGqoIoHapaux1iu63zjID0yR30HYPpxaw="
+        "rev": "9f83bbbe64654b45ba5bb06927ff36c2e7588495",
+        "hash": "sha256-lNnCtgIegUy4DLhYaGZXcEaFw83KWAHoKpz69AEsWp4="
      },
      "src/third_party/ink/src": {
        "url": "https://chromium.googlesource.com/external/github.com/google/ink.git",
-        "rev": "c542d619a8959415beda5a76fe89ffa2f83df886",
-        "hash": "sha256-sMqSHYs3lvuHXEov1K9xWRd8tUPG00QBJl6an0zrxwA="
+        "rev": "da9cb551ada1e55309b0ac89b9fbff2d29dbfe1e",
+        "hash": "sha256-MqJXwtUGL/IakwOO63JX4gx0gTocgQT3hbhw6OcYUbc="
      },
      "src/third_party/ink_stroke_modeler/src": {
        "url": "https://chromium.googlesource.com/external/github.com/google/ink-stroke-modeler.git",
-        "rev": "f61f28792a00c9bdcb3489fec81d8fd0ca1cbaba",
-        "hash": "sha256-XMLW/m+Qx+RVgo1DeYggBLjUYg/M+2eHwgjVWrA/Erw="
+        "rev": "03db1ed37b8b10b47d62ed0fa142d198a3861689",
+        "hash": "sha256-jnIljheEBq96e6zZO87bhVJbA1vIjiRzm1Hh6YMBdnU="
      },
      "src/third_party/instrumented_libs": {
        "url": "https://chromium.googlesource.com/chromium/third_party/instrumented_libraries.git",
@@ -1142,8 +1147,8 @@
      },
      "src/third_party/googletest/src": {
        "url": "https://chromium.googlesource.com/external/github.com/google/googletest.git",
-        "rev": "52204f78f94d7512df1f0f3bea1d47437a2c3a58",
-        "hash": "sha256-8keF4E6ag/rikv5ROaWUB7oganjViupEAdxW1NJVgmE="
+        "rev": "cd430b47a54841ec45d64d2377d7cabaf0eba610",
+        "hash": "sha256-QT9PQ9bF+eCPfRLkcHpH4jc0UZfGPc98fHf8QDV5bZg="
      },
      "src/third_party/hunspell_dictionaries": {
        "url": "https://chromium.googlesource.com/chromium/deps/hunspell_dictionaries.git",
@@ -1152,8 +1157,8 @@
      },
      "src/third_party/icu": {
        "url": "https://chromium.googlesource.com/chromium/deps/icu.git",
-        "rev": "c9fb4b3a6fb54aa8c20a03bbcaa0a4a985ffd34b",
-        "hash": "sha256-Omv4sp9z44eINXtaE0+1TzIU1q2hWviANA79fmkF78U="
+        "rev": "4c8cc4b365a505ce35be1e0bd488476c5f79805d",
+        "hash": "sha256-eGI/6wk6IOUPvX7pRTm4VJk1CqkkxalTu84L36i/D6k="
      },
      "src/third_party/jsoncpp/source": {
        "url": "https://chromium.googlesource.com/external/github.com/open-source-parsers/jsoncpp.git",
@@ -1172,8 +1177,8 @@
      },
      "src/third_party/fuzztest/src": {
        "url": "https://chromium.googlesource.com/external/github.com/google/fuzztest.git",
-        "rev": "c31f0c0e6df5725c6b03124b579c9cf815fd10f4",
-        "hash": "sha256-Dz7DqucOxr5HzLNOdGNOG4iMw66bkOj64qOvqeADTic="
+        "rev": "b10387fdbbca18192f85eaa5323a59f44bf9c468",
+        "hash": "sha256-L2QG0pUmGjGdtdlivxYfxSqO9YaVHpIT6lvJwBMTxMw="
      },
      "src/third_party/domato/src": {
        "url": "https://chromium.googlesource.com/external/github.com/googleprojectzero/domato.git",
@@ -1187,8 +1192,8 @@
      },
      "src/third_party/libaom/source/libaom": {
        "url": "https://aomedia.googlesource.com/aom.git",
-        "rev": "9680f2b1781fb33b9eeb52409b75c679c8a954be",
-        "hash": "sha256-nfnt5JXyKR9JR3BflpGEkwzDo0lYa/oeCDm2bKH/j1g="
+        "rev": "719f60edc51b6141a2434bf1b5110c2fb075b246",
+        "hash": "sha256-W62uXVbQiq6Ef3bar2NsCXJoz5KKUK8Y/9n2vK7Vf3Q="
      },
      "src/third_party/crabbyavif/src": {
        "url": "https://chromium.googlesource.com/external/github.com/webmproject/CrabbyAvif.git",
@@ -1197,13 +1202,8 @@
      },
      "src/third_party/nearby/src": {
        "url": "https://chromium.googlesource.com/external/github.com/google/nearby-connections.git",
-        "rev": "8acf9249344ea9ff9806d0d7f46e07640fddf550",
-        "hash": "sha256-qIIyCHay3vkE14GVCq77psm1OyuEYs4guAaQDlEwiMg="
-      },
-      "src/third_party/beto-core/src": {
-        "url": "https://beto-core.googlesource.com/beto-core.git",
-        "rev": "89563fec14c756482afa08b016eeba9087c8d1e3",
-        "hash": "sha256-QPFGjtu/I0r4+dTQ2eSlWIEYwJ43B3yW0q4QtVFTVGY="
+        "rev": "e71de0e0c312caf8d2fa22f132619c6a68496444",
+        "hash": "sha256-dzJtRhoPA1FWeu0xjd7kJ1Q2nT5gIkKpIgQmywsRlPY="
      },
      "src/third_party/securemessage/src": {
        "url": "https://chromium.googlesource.com/external/github.com/google/securemessage.git",
@@ -1212,8 +1212,8 @@
      },
      "src/third_party/jetstream/main": {
        "url": "https://chromium.googlesource.com/external/github.com/WebKit/JetStream.git",
-        "rev": "0260caf74b5c115507ee0adb6d9cdf6aefb0965f",
-        "hash": "sha256-DbRup4tOAYv27plzB2JKi2DBX2FVMDtFR7AzuovXUDU="
+        "rev": "0976ddeae0863ef5fb3f9ad09906224b0989f9ad",
+        "hash": "sha256-NyXGd7SwsECGBJ2qodGYB3os+UBgIOg/I8mnrsZJuTg="
      },
      "src/third_party/jetstream/v2.2": {
        "url": "https://chromium.googlesource.com/external/github.com/WebKit/JetStream.git",
@@ -1222,8 +1222,8 @@
      },
      "src/third_party/speedometer/main": {
        "url": "https://chromium.googlesource.com/external/github.com/WebKit/Speedometer.git",
-        "rev": "c760d160caa05792d3ed7650e85861c9f9462506",
-        "hash": "sha256-/nAK2uLjpPem37XCHHx3LGZEpvL/7w4Uw5bVpQ4C6ms="
+        "rev": "dd661c033abdde11022779f40375c52632a9f43a",
+        "hash": "sha256-1/G06WCO5ssBS3+T6E3rnGdIf0r205wVxfJX7lgivR4="
      },
      "src/third_party/speedometer/v3.1": {
        "url": "https://chromium.googlesource.com/external/github.com/WebKit/Speedometer.git",
@@ -1262,8 +1262,8 @@
      },
      "src/third_party/expat/src": {
        "url": "https://chromium.googlesource.com/external/github.com/libexpat/libexpat.git",
-        "rev": "624da0f593bb8d7e146b9f42b06d8e6c80d032a3",
-        "hash": "sha256-Iwu9+i/0vsPyu6pOWFxjNNblVxMl6bTPW5eWyaju4Mg="
+        "rev": "69d6c054c1bd5258c2a13405a7f5628c72c177c2",
+        "hash": "sha256-qe8O7otL6YcDDBx2DS/+c5mWIS8Rf8RQXVtLFMIAeyk="
      },
      "src/third_party/libipp/libipp": {
        "url": "https://chromium.googlesource.com/chromiumos/platform2/libipp.git",
@@ -1307,8 +1307,8 @@
      },
      "src/third_party/libvpx/source/libvpx": {
        "url": "https://chromium.googlesource.com/webm/libvpx.git",
-        "rev": "027bbee30a0103b99d86327b48d29567fed11688",
-        "hash": "sha256-+4I6B1aTa+txhey6LMeflU0pe39V6TJ+lNIJPh6yFGM="
+        "rev": "40ec928b3fadcf8edd836445bb5842a11aeb7a2d",
+        "hash": "sha256-aUHvIv78KTiyN/cOYNuhW4UCOD55s8l8VLu4oP0Pk1s="
      },
      "src/third_party/libwebm/source": {
        "url": "https://chromium.googlesource.com/webm/libwebm.git",
@@ -1322,8 +1322,8 @@
      },
      "src/third_party/libyuv": {
        "url": "https://chromium.googlesource.com/libyuv/libyuv.git",
-        "rev": "ccdf870348764e4b77fa3b56accb2a896a901bad",
-        "hash": "sha256-8sH11psWPXLMy3Q0tAizCZ/woUWvTCCUf44jcr2C4Xs="
+        "rev": "9f9b5cf660dcfa0d3fdee41cf4ffbe4bb6e95114",
+        "hash": "sha256-OYmsMPz7nJwkVSpsDW7SbqrCU5raC1k3Mh/UkonCujM="
      },
      "src/third_party/lss": {
        "url": "https://chromium.googlesource.com/linux-syscall-support.git",
@@ -1342,8 +1342,8 @@
      },
      "src/third_party/nasm": {
        "url": "https://chromium.googlesource.com/chromium/deps/nasm.git",
-        "rev": "767a169c8811b090df222a458b25dfa137fc637e",
-        "hash": "sha256-yg4qwhS68B/sWfcJeXUqPC69ppE8FaIyRc+IkUQXSnU="
+        "rev": "9f916e90e6fc34ec302573f6ce147e43e33d68ca",
+        "hash": "sha256-neYrS4kQ76ihUh22Q3uPR67Ld8+yerA922YSZU1KxJs="
      },
      "src/third_party/neon_2_sse/src": {
        "url": "https://chromium.googlesource.com/external/github.com/intel/ARM_NEON_2_x86_SSE.git",
@@ -1357,8 +1357,8 @@
      },
      "src/third_party/openscreen/src": {
        "url": "https://chromium.googlesource.com/openscreen",
-        "rev": "db9e1ea566813606ca055868be13f6ff4a760ab8",
-        "hash": "sha256-K/frmCf3JMvPVZc6ZKPFAQrq4Pz4io3XBvADS0O5u78="
+        "rev": "40fe10467c27b6536e5d3241e5881b6e9f243216",
+        "hash": "sha256-fKXCuGzNVcN8l/2VNR5c9lwUjmSDb7MuEAVF5h8VXQU="
      },
      "src/third_party/openscreen/src/buildtools": {
        "url": "https://chromium.googlesource.com/chromium/src/buildtools",
@@ -1372,13 +1372,13 @@
      },
      "src/third_party/pdfium": {
        "url": "https://pdfium.googlesource.com/pdfium.git",
-        "rev": "ca83e69429af8f0bfa34b22dc54f538b9eebf5c5",
-        "hash": "sha256-6gsur+fx546YJn/PUOOthuj+XrSIruVUeAYl4nRI6xM="
+        "rev": "c82c611f105c0df064cc8c76363578caf9eafb75",
+        "hash": "sha256-kcrWcvbbGgQTfGypJ2EaLunYtSipJJRAin2jHunZoCU="
      },
      "src/third_party/perfetto": {
        "url": "https://chromium.googlesource.com/external/github.com/google/perfetto.git",
-        "rev": "054635b91453895720951f7329619d003a98b3e4",
-        "hash": "sha256-2jKRhHLitR0m2a4/asvVvTqAOhUlyLsBBSjpQAer4GA="
+        "rev": "f35ae1939989c58c29df43f9c2d8610f5b932715",
+        "hash": "sha256-SyYTZnNar6F6/k6PGrkRan3l9hAikEVRciDQQaR7Jvs="
      },
      "src/third_party/protobuf-javascript/src": {
        "url": "https://chromium.googlesource.com/external/github.com/protocolbuffers/protobuf-javascript",
@@ -1387,8 +1387,8 @@
      },
      "src/third_party/pthreadpool/src": {
        "url": "https://chromium.googlesource.com/external/github.com/google/pthreadpool.git",
-        "rev": "4e1831c02c74334a35ead03362f3342b6cea2a86",
-        "hash": "sha256-mB1QaAuY8vfv8FasPyio1AF75iYH+dM8t1GIr0Ty/+g="
+        "rev": "290ee6fff0c36614702d6b297c148e3fa08e056a",
+        "hash": "sha256-jRHF7vZPmh70jNFVukfWzVnA2dBLSDSnMWVyZ9e08n4="
      },
      "src/third_party/pyelftools": {
        "url": "https://chromium.googlesource.com/chromiumos/third_party/pyelftools.git",
@@ -1417,13 +1417,13 @@
      },
      "src/third_party/search_engines_data/resources": {
        "url": "https://chromium.googlesource.com/external/search_engines_data.git",
-        "rev": "07834ba1e5ebfb333d0b73556b7c4d62a53cb455",
-        "hash": "sha256-DTz351NpoygQLESm/z+fzFc/KGJyQelLnWpzNMmNT9o="
+        "rev": "be408bdc2c1501ef25206145a49dcebb98db34b5",
+        "hash": "sha256-XlAE782PsEysPVIBM/Q8VdE9XnvoYUVaeMmUUoYFgvM="
      },
      "src/third_party/skia": {
        "url": "https://skia.googlesource.com/skia.git",
-        "rev": "bcce46ca33b67cc302dd53927a63013b8f53bf73",
-        "hash": "sha256-ei95CJRfNPrsYt8XcDi7Pnl5dGiJu3qs7R4rAcZ24Uc="
+        "rev": "0dfd95a49aed617f242c8b06dd5b255d1cb07776",
+        "hash": "sha256-HBqkqEoyQo3KuRCwP5NW9kuY9maaBYSpjA1lcBdFjxk="
      },
      "src/third_party/smhasher/src": {
        "url": "https://chromium.googlesource.com/external/smhasher.git",
@@ -1442,8 +1442,8 @@
      },
      "src/third_party/swiftshader": {
        "url": "https://swiftshader.googlesource.com/SwiftShader.git",
-        "rev": "4982425ff1bdcb2ce52a360edde58a379119bfde",
-        "hash": "sha256-QTGU9Dgc6rgMeFZvhZyYeYj5W+ClJO8Yfa4+K7TmEec="
+        "rev": "7905fa19e456df5aa8e2233a7ec5832c9c6c287b",
+        "hash": "sha256-Wi8mttxM1fuLqrL2q6qPnpmyAfmDqJGA8Wub+yexFLA="
      },
      "src/third_party/text-fragments-polyfill/src": {
        "url": "https://chromium.googlesource.com/external/github.com/GoogleChromeLabs/text-fragments-polyfill.git",
@@ -1452,18 +1452,18 @@
      },
      "src/third_party/tflite/src": {
        "url": "https://chromium.googlesource.com/external/github.com/tensorflow/tensorflow.git",
-        "rev": "c8ed430d092acd485f00e7a9d7a888a0857d0430",
-        "hash": "sha256-S5zkpQZdhRdnZRUrUfi5FCrF2XFe3y/adAWwfh1OQYE="
+        "rev": "42d6877b1aa1cf324eb03ccf9b13511400341deb",
+        "hash": "sha256-KummGT7CUoGd3lCGXvtSFcFD1FhSlJXDcEi1WKUza70="
      },
      "src/third_party/vulkan-deps": {
        "url": "https://chromium.googlesource.com/vulkan-deps",
-        "rev": "1648e664337ca19a4f8679cbb9547a5b4b926995",
-        "hash": "sha256-CI0X6zbRV/snGcQZOUKQFn8Zo6D6Out6nN027HGZaa8="
+        "rev": "96793fb0ff6fb5d4328cc6f71d84f5cb2d835daf",
+        "hash": "sha256-rAtsw8JV8EwrNzjK5p7JbWQa6fHfpByvZcP71hHC8uM="
      },
      "src/third_party/glslang/src": {
        "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/glslang",
-        "rev": "e57f993cff981c8c3ffd38967e030f04d13781a9",
-        "hash": "sha256-nr7pGPNPMbmL/XnL27M4m5in8qnCDcpNtVsxBAc7zms="
+        "rev": "fc9889c889561c5882e83819dcaffef5ed45529b",
+        "hash": "sha256-HwFP4KJuA+BMQVvBWV0BCRj9U5I3CLEU+5bBtde2f6w="
      },
      "src/third_party/spirv-cross/src": {
        "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/SPIRV-Cross",
@@ -1472,38 +1472,38 @@
      },
      "src/third_party/spirv-headers/src": {
        "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/SPIRV-Headers",
-        "rev": "8c88e0c4c94a21de825efccba5f99a862b049825",
-        "hash": "sha256-s0Pe7kg5syKhK8qEZH8b7UCDa87Xk32Lh95cQbpLdAc="
+        "rev": "bab63ff679c41eb75fc67dac76e1dc44426101e1",
+        "hash": "sha256-hi4vCwdCnwuYodUYq75niCZt2t9lERQH6529/R+7nH8="
      },
      "src/third_party/spirv-tools/src": {
        "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/SPIRV-Tools",
-        "rev": "2e83ad7e6f2cc51f7eaff3ffeb10e34351b3c157",
-        "hash": "sha256-u4WDbWywua71yWB1cVIt1IDZRe4NnT5bUq3yHLKBgPo="
+        "rev": "8e9165a3d162967a424dcf2ff645a98b50381cce",
+        "hash": "sha256-GsoaeO3FMzMtMStg1Wp0KUHU3Xxmmr7t3lDyu0ervNk="
      },
      "src/third_party/vulkan-headers/src": {
        "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Headers",
-        "rev": "78c359741d855213e8685278eb81bb62599f8e56",
-        "hash": "sha256-VqKQeJd81feSgYnYLqb2sYirCmnHN9Rr19/4cPZ2TzE="
+        "rev": "e2e53a724677f6eba8ff0ce1ccb64ee321785cbd",
+        "hash": "sha256-lIuJ50zi9UIMrP/FePI8jHFhJ5LsKhthDY4gIHeZNpo="
      },
      "src/third_party/vulkan-loader/src": {
        "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Loader",
-        "rev": "723d6b4aa35853315c6e021ec86388b3a2559fae",
-        "hash": "sha256-tDW5ed6gsDKlCKf4gT8MNi1yaafocUTohL1upGKB+Cc="
+        "rev": "fb78607414e154c7a5c01b23177ba719c8a44909",
+        "hash": "sha256-CeIjyW90Ri0MvhyFfYgss5Rjh5fHKhQf7CgBEcB/nPk="
      },
      "src/third_party/vulkan-tools/src": {
        "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Tools",
-        "rev": "289efccc7560f2b970e2b4e0f50349da87669311",
-        "hash": "sha256-Cw7LWBPRbDVlfmeMM4CYEC9xbfqT1wV7yuUcpGMLahs="
+        "rev": "0b8196724e4ad28cc7459b82a9b75f252c08cb3e",
+        "hash": "sha256-oL4lyUH26eO6eJy7EQmuXdt4oy3eQ65fribfMSOZV+8="
      },
      "src/third_party/vulkan-utility-libraries/src": {
        "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Utility-Libraries",
-        "rev": "0d5b49b80f17bca25e7f9321ad4e671a56f70887",
-        "hash": "sha256-NdvjtdCrNVKY23B4YDL33KB+/9HsSWTVolZJOto8+pc="
+        "rev": "4e246c56ec5afb5ad66b9b04374d39ac04675c8e",
+        "hash": "sha256-MmC4UVa9P/0h7r8IBp1LhP9EztwyZv/ASWKKj8Gk1T8="
      },
      "src/third_party/vulkan-validation-layers/src": {
        "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-ValidationLayers",
-        "rev": "73d7d74bc979c8a16c823c4eae4ee881153e000a",
-        "hash": "sha256-2GII+RBRzPZTTib82srUEFDG+CbtPTZ6lX3oDJBC2gU="
+        "rev": "cea6ec1cdd37494c1f0fc5619c6c356ac33372fb",
+        "hash": "sha256-iXQZ6Qpe0li+QeThxMUCn45OufZ8W/qJcejpMb4/gWc="
      },
      "src/third_party/vulkan_memory_allocator": {
        "url": "https://chromium.googlesource.com/external/github.com/GPUOpen-LibrariesAndSDKs/VulkanMemoryAllocator.git",
@@ -1512,8 +1512,8 @@
      },
      "src/third_party/wasm_tts_engine/src": {
        "url": "https://chromium.googlesource.com/chromium/wasm-tts-engine",
-        "rev": "53d2aba6f0cf7db57e17edfc3ff6471871b0c125",
-        "hash": "sha256-t5eeehwspRLaowEMPLa8/lV5AHamXQBfH/un0DHLVAM="
+        "rev": "352880bb49e2410707543c252ef6b94a21b0f47f",
+        "hash": "sha256-TFkniS4XvP0RlPnI1lv4RxxSY44RUuwCMKmmybENEBw="
      },
      "src/third_party/wayland/src": {
        "url": "https://chromium.googlesource.com/external/anongit.freedesktop.org/git/wayland/wayland.git",
@@ -1547,8 +1547,8 @@
      },
      "src/third_party/webgpu-cts/src": {
        "url": "https://chromium.googlesource.com/external/github.com/gpuweb/cts.git",
-        "rev": "92f4eb4dae0f5439f2cdc7ce467d66b10e165f42",
-        "hash": "sha256-vXyp0+6eyKOzzQbkRa8f8dO+B9cyUCY2hCZEFc7+7lU="
+        "rev": "168536ad91bff176bbe31ae692d97f8bfe9fb86d",
+        "hash": "sha256-HB16HM4Gj+2F26tyN393VmHbGxvKOZ+M949059odN/4="
      },
      "src/third_party/webpagereplay": {
        "url": "https://chromium.googlesource.com/webpagereplay.git",
@@ -1557,8 +1557,8 @@
      },
      "src/third_party/webrtc": {
        "url": "https://webrtc.googlesource.com/src.git",
-        "rev": "2c8f5be6924d507ee74191b1aeadcec07f747f21",
-        "hash": "sha256-cNONf88oSbsdYuSdPiLxgTI973qOP6fb1OKb2WMQMMg="
+        "rev": "cec4daea7ed5da94fc38d790bd12694c86865447",
+        "hash": "sha256-mxRckkiBIpQp2Qxj6fcer3jDftp3wlg+aO4BoUHhyiY="
      },
      "src/third_party/wuffs/src": {
        "url": "https://skia.googlesource.com/external/github.com/google/wuffs-mirror-release-c.git",
@@ -1567,8 +1567,8 @@
      },
      "src/third_party/weston/src": {
        "url": "https://chromium.googlesource.com/external/anongit.freedesktop.org/git/wayland/weston.git",
-        "rev": "ccf29cb237c3ed09c5f370f35239c93d07abfdd7",
-        "hash": "sha256-y2srFaPUOoB2umzpo4+hFfhNlqXM2AoMGOpUy/ZSacg="
+        "rev": "4eb10b123b483327214d8da5da67e8bbeeaed8fe",
+        "hash": "sha256-VNHUAtfTB24SIf2kl+MMXF3rG5cJOPM93WU/sVSIQ1A="
      },
      "src/third_party/xdg-utils": {
        "url": "https://chromium.googlesource.com/chromium/deps/xdg-utils.git",
@@ -1577,18 +1577,18 @@
      },
      "src/third_party/xnnpack/src": {
        "url": "https://chromium.googlesource.com/external/github.com/google/XNNPACK.git",
-        "rev": "d6fc3be20b0d3e3742157fa26c5359babaa8bc8b",
-        "hash": "sha256-p5DjGNH9IR0KPWSFmbsdt2PU+kHgWRAnBw7J9sLV/S8="
+        "rev": "474d7e58d4b8f4bd1a98ee74bc57858769f7d925",
+        "hash": "sha256-UO+nOh7R+3xTSxF2u8dIrv7qn/QmhnDr2J5Ciumj93M="
      },
      "src/third_party/zstd/src": {
        "url": "https://chromium.googlesource.com/external/github.com/facebook/zstd.git",
-        "rev": "ef2bf5781112a4cd6b62ac1817f7842bbdc7ea8f",
-        "hash": "sha256-hDDNrUXGxG/o1oZnypAnuLyIeM16Hy6x1KacGu9Hhmw="
+        "rev": "d654fca78690fa15cceb8058ac47454d914a0e63",
+        "hash": "sha256-Ginvak0y1CjURT3mQZzdLn3MW9vXxC7T0KLsM6SHDV0="
      },
      "src/v8": {
        "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "5297e56d91816747d539abca52b578e5832135f0",
-        "hash": "sha256-Fi4pl6xSXkHF4XaQNfNzULVjQZSzDfaHFIyIxH103go="
+        "rev": "44fdd9108308773dd3f4fa040de5f4f75edf671f",
+        "hash": "sha256-BkLOmb97p2NcAIuQiDjIoVAe49h9iv79rC5G8wyD1as="
      }
    }
  }
@@ -10,11 +10,11 @@
 buildMozillaMach rec {
  pname = "firefox-beta";
  binaryName = pname;
-  version = "138.0b4";
+  version = "140.0b2";
  applicationName = "Firefox Beta";
  src = fetchurl {
    url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "a8f9e645c80d9c40b0435ee00261aa9fcac801efcfcbf42b10e6af9390290b9f643358aca6a01d9465eab3b64f46b2b71b4a3ea4c7e0a8f96bdfce15bf817f92";
+    sha512 = "c8010b6cdf90f52d5105971d726139460a0194ca7e84ed57184897f4f258957ff64117ef14a38a6dba4cab3074f3a92aee0eaf221ecf22218f6408636ab9c960";
  };

  meta = {
@@ -10,13 +10,13 @@
 buildMozillaMach rec {
  pname = "firefox-devedition";
  binaryName = pname;
-  version = "138.0b9";
+  version = "140.0b2";
  applicationName = "Firefox Developer Edition";
  requireSigning = false;
  branding = "browser/branding/aurora";
  src = fetchurl {
    url = "mirror://mozilla/devedition/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "cf737b8c394150430cda512a84ebdf04426db0c413863eb37a327c44fc952db7de1be07956aaded3ddb769480fb307a102c1f4f7dab4ba8a38f2371fdd35a961";
+    sha512 = "4a369638dab1202f21f071a1eb48552888adf01e49ee4e029dfe7b42919312719004099b203a066057fd4d9ef9a684e5f95b0aa06ecf82cc88df0025f33f6368";
  };

  meta = {
@@ -32,6 +32,7 @@ in
      squalus
      dwrege
      fpletz
+      grimmauld
    ];
    platforms = lib.platforms.unix;
    broken = stdenv.buildPlatform.is32bit;
@@ -15,12 +15,8 @@ rec {

  extraPostPatch = ''
    while read patch_name; do
-      if [ "$patch_name" != "patches/macos-import-vector.patch" ]; then
-        echo "applying LibreWolf patch: $patch_name"
-        patch -p1 < ${source}/$patch_name
-      else
-        echo "skipping LibreWolf patch: $patch"
-      fi
+      echo "applying LibreWolf patch: $patch_name"
+      patch -p1 < ${source}/$patch_name
    done <${source}/assets/patches.txt

    cp -r ${source}/themes/browser .
@@ -1,11 +1,11 @@
 {
-  "packageVersion": "138.0.4-1",
+  "packageVersion": "139.0-1",
  "source": {
-    "rev": "138.0.4-1",
-    "hash": "sha256-KR8ZiueaEOXt2dw8T6ZvrQURV49Xu4cYe0XE8tEUmbw="
+    "rev": "139.0-1",
+    "hash": "sha256-dhi9hUgEoOFQj7IixFKz1J81zo43h4MkAMpr2OIgass="
  },
  "firefox": {
-    "version": "138.0.4",
-    "hash": "sha512-ZNgEVtqN8n1+7tfrIMNfzyE7yUjrSHObYQHixHbqmpEz2pKEd6eWg8lsFg+NU77VK+SH8BqNKeONOQcfEmdoBg=="
+    "version": "139.0",
+    "hash": "sha512-hKK0fy/3GqwiandKsKyauNmhb1YgoG96u2ZIcyIJ0CKu81qdSHPpHr1npPxJT8I4Uk4lw4+tgEbbJq/aBub5cA=="
  }
 }
@@ -333,16 +333,10 @@ let
    }).overrideAttrs
      overrideContainerdAttrs;

-  # TODO (#405952): remove this patch. We had to add it to avoid a mass rebuild
-  # for the 25.05 release. Once the above PR is merged, switch back to plain util-linuxMinimal.
-  k3sUtilLinux = util-linuxMinimal.overrideAttrs (prev: {
-    patches =
-      prev.patches or [ ]
-      ++ lib.singleton (fetchpatch {
-        url = "https://github.com/util-linux/util-linux/commit/7dbfe31a83f45d5aef2b508697e9511c569ffbc8.patch";
-        hash = "sha256-bJqpZiPli5Pm/XpDA445Ab5jesXrlcnaO6e4V0B3rSw=";
-      });
-  });
+  # TODO (#409339): remove this patch. We had to add it to avoid a mass rebuild
+  # for the 25.05 release. Once the staging cycle referenced in the above PR completes,
+  # switch back to plain util-linuxMinimal.
+  k3sUtilLinux = util-linuxMinimal.withPatches;
 in
 buildGoModule rec {
  pname = "k3s";
@@ -97,8 +97,8 @@ in
  # a new NixOS release.
  spark_3_5 = spark {
    pname = "spark";
-    version = "3.5.4";
-    hash = "sha256-rSr7UH1dZIkUYW6ehc/dYxlmN9yVjEKwrwLMT+uMd/0=";
+    version = "3.5.5";
+    hash = "sha256-vzcWgIfHPhN3nyrxdk3f0p4fW3MpQ+FuEPnWPw0xNPg=";
  };
  spark_3_4 = spark rec {
    pname = "spark";
@@ -516,13 +516,13 @@
    "vendorHash": "sha256-rGpnPH8ebHXasvelGoJEUU4YbeGJY4adFBbgAHJ8vSs="
  },
  "google-beta": {
-    "hash": "sha256-b79IHQxSid4LhIl3ZPd2rok8V4BdXejcYe5LBCjgvlQ=",
+    "hash": "sha256-VpfIfzIG1h5qnvEqogCK359LLLSgdgxg0DtRGvdZtLU=",
    "homepage": "https://registry.terraform.io/providers/hashicorp/google-beta",
    "owner": "hashicorp",
    "repo": "terraform-provider-google-beta",
-    "rev": "v6.35.0",
+    "rev": "v6.37.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-Qad4Dfg65aX8dsan4gimGP/hzSaQ7Ay+WTFlr2TgUzw="
+    "vendorHash": "sha256-oz4zVv5swFokYCdcJhBE+PLrIOjwszl58Cn0e7hOKmI="
  },
  "googleworkspace": {
    "hash": "sha256-dedYnsKHizxJZibuvJOMbJoux0W6zgKaK5fxIofKqCY=",
@@ -750,13 +750,13 @@
    "vendorHash": "sha256-fP6brpY/wRI1Yjgapzi+FfOci65gxWeOZulXbGdilrE="
  },
  "linode": {
-    "hash": "sha256-LyGqcWYdwUfAKq3bTHMyZmIyJkndOUzWHkVXduESxus=",
+    "hash": "sha256-DNH+q9FSRlT/SoyW9+n+FLzy/Zi5l82sRigBZIaKabc=",
    "homepage": "https://registry.terraform.io/providers/linode/linode",
    "owner": "linode",
    "repo": "terraform-provider-linode",
-    "rev": "v2.39.0",
+    "rev": "v2.41.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-4YMqzX/vQvWj0sb46NlTADb0be9+/0lwKs+3QArBvUk="
+    "vendorHash": "sha256-j/YgQ4w89XRZPYMCGAT72ervryIeutvk0ivFPR8E1yI="
  },
  "linuxbox": {
    "hash": "sha256-svQRz1/PdVLpHoxOam1sfRTwHqgqs4ohJQs3IPMMAM4=",
@@ -858,13 +858,13 @@
    "vendorHash": null
  },
  "newrelic": {
-    "hash": "sha256-2Bmk1b84oL8DkPShff4RPQSlAu6ufwcb7sp6mJGeo84=",
+    "hash": "sha256-jmvCEJM+hcYToawCcUasWN+gMY9rw5Niw8YT28hk3aw=",
    "homepage": "https://registry.terraform.io/providers/newrelic/newrelic",
    "owner": "newrelic",
    "repo": "terraform-provider-newrelic",
-    "rev": "v3.61.0",
+    "rev": "v3.62.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-wqraBQqxpD69iIM45MZLWhgIEiyu300bok3OST+Hegs="
+    "vendorHash": "sha256-UArO7zOOAlnWzzg+t/IWWuMfRAmauvLO4M7Y/mmdz2k="
  },
  "nexus": {
    "hash": "sha256-Lm5CZ+eBDUNIL2KuK/iKc5dTif7P+E9II714vwvYuyU=",
@@ -17,7 +17,7 @@

 buildGoModule rec {
  pname = "rclone";
-  version = "1.69.2";
+  version = "1.69.3";

  outputs = [
    "out"
@@ -28,15 +28,10 @@ buildGoModule rec {
    owner = "rclone";
    repo = "rclone";
    tag = "v${version}";
-    hash = "sha256-WhviYa9H3FsYRgnUhheP6dRj9A9l2nrGeFAhUj5TCKU=";
+    hash = "sha256-VLE9cWR4Wp+MDbwmfNaJArxhXTOcVfM2C1TMCymKflw=";
  };

-  patches = [
-    # TODO: remove after updating to 1.69.3
-    ./purego-update.patch
-  ];
-
-  vendorHash = "sha256-Wu9d98SIENCkJYoGT/f9KN8vnYYGMN7HxhzqtkOYQ/8=";
+  vendorHash = "sha256-WY5xBBOhDRl+mU0KuVxph0wDhfUYLI0gmiGY1boxmKU=";

  subPackages = [ "." ];

@@ -1,28 +0,0 @@
-diff --git a/go.mod b/go.mod
-index f4d830b89..af23fc0d9 100644
--- a/go.mod
-+++ b/go.mod
-@@ -134,7 +134,7 @@ require (
- 	github.com/cronokirby/saferith v0.33.0 // indirect
- 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
- 	github.com/dustin/go-humanize v1.0.1 // indirect
-	github.com/ebitengine/purego v0.8.1 // indirect
-+	github.com/ebitengine/purego v0.8.3 // indirect
- 	github.com/emersion/go-message v0.18.0 // indirect
- 	github.com/emersion/go-textwrapper v0.0.0-20200911093747-65d896831594 // indirect
- 	github.com/emersion/go-vcard v0.0.0-20230815062825-8fda7d206ec9 // indirect
-diff --git a/go.sum b/go.sum
-index 06a76c5ef..28b4dddbe 100644
--- a/go.sum
-+++ b/go.sum
-@@ -213,8 +213,8 @@ github.com/dsnet/try v0.0.3/go.mod h1:WBM8tRpUmnXXhY1U6/S8dt6UWdHTQ7y8A5YSkRCkq4
- github.com/dustin/go-humanize v1.0.0/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk=
- github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
- github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
-github.com/ebitengine/purego v0.8.1 h1:sdRKd6plj7KYW33EH5As6YKfe8m9zbN9JMrOjNVF/BE=
-github.com/ebitengine/purego v0.8.1/go.mod h1:iIjxzd6CiRiOG0UyXP+V1+jWqUXVjPKLAI0mRfJZTmQ=
-+github.com/ebitengine/purego v0.8.3 h1:K+0AjQp63JEZTEMZiwsI9g0+hAMNohwUOtY0RPGexmc=
-+github.com/ebitengine/purego v0.8.3/go.mod h1:iIjxzd6CiRiOG0UyXP+V1+jWqUXVjPKLAI0mRfJZTmQ=
- github.com/emersion/go-message v0.18.0 h1:7LxAXHRpSeoO/Wom3ZApVZYG7c3d17yCScYce8WiXA8=
- github.com/emersion/go-message v0.18.0/go.mod h1:Zi69ACvzaoV/MBnrxfVBPV3xWEuCmC2nEN39oJF4B8A=
- github.com/emersion/go-textwrapper v0.0.0-20200911093747-65d896831594 h1:IbFBtwoTQyw0fIM5xv1HF+Y+3ZijDR839WMulgxCcUY=
@@ -66,7 +66,7 @@ let
      ''
        mkdir -p $out/bin
        makeWrapper ${Agda.bin}/bin/agda $out/bin/agda \
-          --add-flags "--with-compiler=${ghc}/bin/ghc" \
+          ${lib.optionalString (ghc != null) ''--add-flags "--with-compiler=${ghc}/bin/ghc"''} \
          --add-flags "--library-file=${library-file}"
        ln -s ${Agda.bin}/bin/agda-mode $out/bin/agda-mode
      '';
@@ -23,13 +23,13 @@ let
    if extension == "zip" then fetchzip args else fetchurl args;

  pname = "1password-cli";
-  version = "2.31.0";
+  version = "2.31.1";
  sources = rec {
-    aarch64-linux = fetch "linux_arm64" "sha256-l42h6mGqcb7Wy1ryXM0gxnt2fUUDr8+4nc9qIG0nDgc=" "zip";
-    i686-linux = fetch "linux_386" "sha256-3oxBu0SAbWNgHZxirmKXm0Mk/uRZRPX/qCfYvkANTfM=" "zip";
-    x86_64-linux = fetch "linux_amd64" "sha256-hlktdQCGMtTIbd2j9x0aHKCIoIAydDj/caKaIWJfJTI=" "zip";
+    aarch64-linux = fetch "linux_arm64" "sha256-cFGIzB1452XVSkajHbD45Pxp8Hfu10q68nMnbE9dtzg=" "zip";
+    i686-linux = fetch "linux_386" "sha256-EckUFVr5MQ75XW4eHCxWt9vtcqzAFHLUDlmr//pcmf8=" "zip";
+    x86_64-linux = fetch "linux_amd64" "sha256-jPZxqaLrtBC42bGVOByKuORyl2YFicILlQDHkNuuJuc=" "zip";
    aarch64-darwin =
-      fetch "apple_universal" "sha256-PahPWQ4HpaOvEC1zda8X1Bft+8l/0qGWSJUEcfuWlxg="
+      fetch "apple_universal" "sha256-B71apQ2JPyyVHhavMziKNtLNs+WfCDdUEtvfwGFkE+Y="
        "pkg";
    x86_64-darwin = aarch64-darwin;
  };
@@ -8,13 +8,13 @@

 buildGoModule rec {
  pname = "aliyun-cli";
-  version = "3.0.277";
+  version = "3.0.278";

  src = fetchFromGitHub {
    owner = "aliyun";
    repo = "aliyun-cli";
    tag = "v${version}";
-    hash = "sha256-4HWSebmMys3yzj2H3JC7hAayl9xQeVBQWCEGlZSudUc=";
+    hash = "sha256-SFoTeFKPUlP0clAP4gkPiNNVjqetJ8syNJDhGhNs6vo=";
    fetchSubmodules = true;
  };

@@ -7,11 +7,11 @@

 let
  pname = "altair";
-  version = "8.2.2";
+  version = "8.2.3";

  src = fetchurl {
    url = "https://github.com/imolorhe/altair/releases/download/v${version}/altair_${version}_x86_64_linux.AppImage";
-    sha256 = "sha256-3tLBZNuiqhSRg/a2g2PC53esnNb1jVFpCO2YiC7Rw6k=";
+    sha256 = "sha256-oOtQbTKD9UY+aXPqphGHeaXWxMI0/+9q82QaiQSXvwA=";
  };

  appimageContents = appimageTools.extract { inherit pname version src; };
@@ -24,13 +24,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "amd-blis";
-  version = "5.0";
+  version = "5.1";

  src = fetchFromGitHub {
    owner = "amd";
    repo = "blis";
    rev = version;
-    hash = "sha256-E6JmV4W0plFJfOAPK1Vn7qkmFalwl6OjqSpxYnhAPmw=";
+    hash = "sha256-hqb/Q1CBqtC4AXqHNd7voewGUD675hJ9IwvP3Mn9b+M=";
  };

  inherit blas64;
@@ -16,17 +16,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "amdgpu_top";
-  version = "0.10.4";
+  version = "0.10.5";

  src = fetchFromGitHub {
    owner = "Umio-Yasuno";
    repo = "amdgpu_top";
    rev = "v${version}";
-    hash = "sha256-OvxrcVjngIW/fVIPX1XhbGImAeDifoLzlaZpXUYS9FA=";
+    hash = "sha256-BT451a9S3hyugEFH1rHPiJLAb6LzB8rqMAZdWf4UNC8=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-na6pghbJ7Ek+rdbX4qJt2kv7C3AAqpgU/nYHaT9CQdo=";
+  cargoHash = "sha256-bZuwouL8kuEhEiuLsehON1OEPKR3QtSHtn8HvXTovSs=";

  buildInputs = [
    libdrm
@@ -17,11 +17,11 @@ let
    rec {
      x86_64-linux = {
        urlSuffix = "linux-x86_64.tar.gz";
-        hash = "sha256-EuioRmdN4kUDh2P4Qb5YQZeNZqxwBgZ57VsY0YD1ru4=";
+        hash = "sha256-2DdYPtEejIt5SUg4UjbYUMN4K+E3S1QbipKKL7IlQpY=";
      };
      x86_64-darwin = {
        urlSuffix = "macos-universal.zip";
-        hash = "sha256-uLM6hMASA9D5rOChgLnPsfeCAmgoo0IW8CsyfgRGBIU=";
+        hash = "sha256-J/lmjIbZp54Ntdrf8oiGQe3sf7LcTfDO6SgecxofrVM=";
      };
      aarch64-darwin = x86_64-darwin;
    }
@@ -30,7 +30,7 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "appflowy";
-  version = "0.9.2";
+  version = "0.9.3";

  src = fetchzip {
    url = "https://github.com/AppFlowy-IO/appflowy/releases/download/${finalAttrs.version}/AppFlowy-${finalAttrs.version}-${dist.urlSuffix}";
@@ -8,16 +8,16 @@

 buildGoModule rec {
  pname = "auth0-cli";
-  version = "1.13.0";
+  version = "1.14.1";

  src = fetchFromGitHub {
    owner = "auth0";
    repo = "auth0-cli";
    tag = "v${version}";
-    hash = "sha256-RcRJBW8FgCi9Lxz/KARql7ArozqYgttpQ9IXIKzvo6s=";
+    hash = "sha256-SrevadJWgs7nxRTfTG/3MhCaZ1F0F0re7q2KI4kPyeo=";
  };

-  vendorHash = "sha256-6y2iGxaromnMYIU2rnvwmQwn8f1PdihB4DH9r5sRT68=";
+  vendorHash = "sha256-y7tRtK1R/K7JIcMIeGU1OXhl4Cs3L3zW5rtbTuvjQZc=";

  ldflags = [
    "-s"
@@ -16,16 +16,16 @@

 buildNpmPackage rec {
  pname = "basedpyright";
-  version = "1.29.1";
+  version = "1.29.2";

  src = fetchFromGitHub {
    owner = "detachhead";
    repo = "basedpyright";
    tag = "v${version}";
-    hash = "sha256-DUcrR4UwqbP968QYPsjivf2FOUL6hwr5ZAGH+qA8Xtw=";
+    hash = "sha256-xzbIAzZS6kCrFDcbh7uFWV8Rbs91yx25RVKeGMSM5Dc=";
  };

-  npmDepsHash = "sha256-wzetOJxHJXK7oY1cwOG9YOrKKIDhFPD17em6UQ2859M=";
+  npmDepsHash = "sha256-s2Bavzd1IGuI7HfdKLAsFWHmr1RxBZO/21KXt060jbI=";
  npmWorkspace = "packages/pyright";

  preBuild = ''
@@ -1,7 +1,8 @@
 {
  lib,
  stdenv,
-  fetchurl,
+  fetchFromGitLab,
+  autoreconfHook,
  flex,
  bison,
  readline,
@@ -13,15 +14,20 @@ stdenv.mkDerivation rec {
  pname = "bird";
  version = "2.17.1";

-  src = fetchurl {
-    url = "https://bird.network.cz/download/bird-${version}.tar.gz";
-    hash = "sha256-v9cY36WWgZs4AWiHgyElFLRnFjMprsm7zQ+j3uA+EOk=";
+  src = fetchFromGitLab {
+    domain = "gitlab.nic.cz";
+    owner = "labs";
+    repo = "bird";
+    rev = "v${version}";
+    hash = "sha256-9Zg3UmNEW+Q26PMj3Z1XDbPFC5vatX8i7RQSUlKXlwg=";
  };

  nativeBuildInputs = [
+    autoreconfHook
    flex
    bison
  ];
+
  buildInputs = [
    readline
    libssh
@@ -1,7 +1,8 @@
 {
  lib,
  stdenv,
-  fetchurl,
+  fetchFromGitLab,
+  autoreconfHook,
  flex,
  bison,
  readline,
@@ -11,14 +12,18 @@

 stdenv.mkDerivation rec {
  pname = "bird";
-  version = "3.1.1";
+  version = "3.1.2";

-  src = fetchurl {
-    url = "https://bird.nic.cz/download/bird-${version}.tar.gz";
-    hash = "sha256-KXJRl0/4g+TvA/zNbJEtEW7Un/Lxxjtm0dul8HCUREo=";
+  src = fetchFromGitLab {
+    domain = "gitlab.nic.cz";
+    owner = "labs";
+    repo = "bird";
+    rev = "v${version}";
+    hash = "sha256-3Ms9yozF/Ox/kSP9rzKvkrA0VBPQb1VjtbEInl8/KZM=";
  };

  nativeBuildInputs = [
+    autoreconfHook
    flex
    bison
  ];
@@ -1,13 +0,0 @@
-diff --git a/frontends/qt/genassets.sh b/frontends/qt/genassets.sh
-index 4b1ba87be..b5a9ad279 100755
--- a/frontends/qt/genassets.sh
-+++ b/frontends/qt/genassets.sh
-@@ -20,7 +20,7 @@ if [ ! -d ../web/build ]; then
- fi
- 
- echo '<!DOCTYPE RCC><RCC version="1.0"><qresource>' > assets.qrc
-/usr/bin/find ../web/build/ -maxdepth 3 -type f | sed -e "s|../web/build/||" | awk '{ print "<file alias=\"" $1 "\">../web/build/" $1 "</file>" '} >> assets.qrc
-+find ../web/build/ -maxdepth 3 -type f | sort | sed -e "s|../web/build/||" | awk '{ print "<file alias=\"" $1 "\">../web/build/" $1 "</file>" '} >> assets.qrc
- 
- echo '<file alias="trayicon.png">resources/trayicon.png</file>' >> assets.qrc
- echo '</qresource></RCC>' >> assets.qrc
@@ -2,29 +2,35 @@
  lib,
  stdenv,
  fetchFromGitHub,
+  runCommand,
  buildNpmPackage,
  clang,
  go,
  libsForQt5,
+  qt6,
  udevCheckHook,
 }:

+let
+  # Qt 6 doesn’t provide the rcc binary so we create an ad hoc package pulling
+  # it from Qt 5.
+  rcc = runCommand "rcc" { } ''
+    mkdir -p $out/bin
+    cp ${lib.getExe' libsForQt5.qt5.qtbase.dev "rcc"} $out/bin
+  '';
+in
 stdenv.mkDerivation rec {
  pname = "bitbox";
-  version = "4.46.3";
+  version = "4.47.2";

  src = fetchFromGitHub {
    owner = "BitBoxSwiss";
    repo = "bitbox-wallet-app";
    rev = "v${version}";
    fetchSubmodules = true;
-    hash = "sha256-2oGVQ022NGOHLo7TBdeXG3ng1nYW8fyLwSV0hJdAl9I=";
+    hash = "sha256-sRE+Nnb3oqiJEjqiyG+3/sZLp23nquw5+4VpbZVFCQ8=";
  };

-  patches = [
-    ./genassets.patch
-  ];
-
  postPatch = ''
    substituteInPlace frontends/qt/resources/linux/usr/share/applications/bitbox.desktop \
        --replace-fail 'Exec=BitBox %u' 'Exec=bitbox %u'
@@ -37,7 +43,7 @@ stdenv.mkDerivation rec {
    inherit version;
    inherit src;
    sourceRoot = "source/frontends/web";
-    npmDepsHash = "sha256-w98wwKHiZtor5ivKd+sh5K8HnAepu6cw9RyVJ+eTq3k=";
+    npmDepsHash = "sha256-eazc3OIusY8cbaF8RJOrVcyWPQexcz6lZYLLCpB1mHc=";
    installPhase = "cp -r build $out";
  };

@@ -71,12 +77,13 @@ stdenv.mkDerivation rec {
    runHook postInstall
  '';

-  buildInputs = [ libsForQt5.qtwebengine ];
+  buildInputs = [ qt6.qtwebengine ];

  nativeBuildInputs = [
    clang
    go
-    libsForQt5.wrapQtAppsHook
+    qt6.wrapQtAppsHook
+    rcc
    udevCheckHook
  ];

@@ -9,13 +9,13 @@
 buildGoModule rec {
  pname = "bosh-cli";

-  version = "7.9.5";
+  version = "7.9.6";

  src = fetchFromGitHub {
    owner = "cloudfoundry";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-CyrOsPx55hZubBV0t5uMTTLVWC1qmEym1IwinvmSlWM=";
+    sha256 = "sha256-jWT34XdphNrkUwJq72EkvWLNoLVOc8rGf6SY4/CUvc0=";
  };
  vendorHash = null;

@@ -9,17 +9,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "cargo-clone";
-  version = "1.2.3";
+  version = "1.2.4";

  src = fetchFromGitHub {
    owner = "janlikar";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-kK0J1Vfx1T17CgZ3DV9kQbAUxk4lEfje5p6QvdBS5VQ=";
+    sha256 = "sha256-tAY4MUytFVa7kXLeOg4xak8XKGgApnEGWiK51W/7uDg=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-IbNwlVKGsi70G+ATimRZbHbW91vFddQl//dfAM6JO8I=";
+  cargoHash = "sha256-AFCCXZKm6XmiaayOqvGhMzjyMwAqVK1GZccWHWV5/9c=";

  nativeBuildInputs = [ pkg-config ];

@@ -3,7 +3,7 @@
  stdenv,
  fetchurl,
  unzip,
-  fetchpatch,
+  fetchDebianPatch,
 }:

 stdenv.mkDerivation rec {
@@ -18,52 +18,65 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [ unzip ];

-  patches = [
-    ./00-chntpw-build-arch-autodetect.patch
-    ./01-chntpw-install-target.patch
-    # Import various bug fixes from debian
-    (fetchpatch {
-      url = "https://sources.debian.org/data/main/c/chntpw/140201-1/debian/patches/04_get_abs_path";
-      sha256 = "17h0gaczqd5b792481synr1ny72frwslb779lm417pyrz6kh9q8n";
-    })
-    (fetchpatch {
-      url = "https://sources.debian.org/data/main/c/chntpw/140201-1/debian/patches/06_correct_test_open_syscall";
-      sha256 = "00lg83bimbki988n71w54mmhjp9529r0ngm40d7fdmnc2dlpj3hd";
-    })
-    (fetchpatch {
-      url = "https://sources.debian.org/data/main/c/chntpw/140201-1/debian/patches/07_detect_failure_to_write_key";
-      sha256 = "0pk6xnprh2pqyx4n4lw3836z6fqsw3mclkzppl5rhjaahriwxw4l";
-    })
-    (fetchpatch {
-      url = "https://sources.debian.org/data/main/c/chntpw/140201-1/debian/patches/08_no_deref_null";
-      sha256 = "1g7pfmjaj0c2sm64s3api2kglj7jbgddjjd3r4drw6phwdkah0zs";
-    })
-    (fetchpatch {
-      url = "https://sources.debian.org/data/main/c/chntpw/140201-1/debian/patches/09_improve_robustness";
-      sha256 = "1nszkdy01ixnain7cwdmfbhjngphw1300ifagc1wgl9wvghzviaa";
-    })
-    (fetchpatch {
-      url = "https://sources.debian.org/data/main/c/chntpw/140201-1/debian/patches/11_improve_documentation";
-      sha256 = "0yql6hj72q7cq69rrspsjkpiipdhcwb0b9w5j8nhq40cnx9mgqgg";
-    })
-    (fetchpatch {
-      url = "https://sources.debian.org/data/main/c/chntpw/140201-1/debian/patches/12_readonly_filesystem";
-      sha256 = "1kxcy7f2pl6fqgmjg8bnl3pl5wgiw5xnbyx12arinmqkkggp4fa4";
-    })
-    (fetchpatch {
-      url = "https://sources.debian.org/data/main/c/chntpw/140201-1/debian/patches/13_write_to_hive";
-      sha256 = "1638lcyxjkrkmbr3n28byixny0qrxvkciw1xd97x48mj6bnwqrkv";
-    })
-    (fetchpatch {
-      url = "https://sources.debian.org/data/main/c/chntpw/140201-1/debian/patches/14_improve_description";
-      sha256 = "11y5kc4dh4zv24nkb0jw2zwlifx6nzsd4jbizn63l6dbpqgb25rs";
-    })
-    (fetchpatch {
-      name = "17_hexdump-pointer-type.patch";
-      url = "https://git.launchpad.net/ubuntu/+source/chntpw/plain/debian/patches/17_hexdump-pointer-type.patch?id=aed501c87499f403293e7b9f505277567c2f3b52";
-      sha256 = "sha256-ir9LFl8FJq141OwF5SbyVMtjQ1kTMH1NXlHl0XZq7m8=";
-    })
-  ];
+  patches =
+    let
+      fetchChntpwDebianPatch =
+        { patch, hash }:
+        fetchDebianPatch {
+          inherit
+            hash
+            patch
+            pname
+            version
+            ;
+          debianRevision = "1.2";
+        };
+    in
+    [
+      ./00-chntpw-build-arch-autodetect.patch
+      ./01-chntpw-install-target.patch
+      # Import various bug fixes from debian
+      (fetchChntpwDebianPatch {
+        patch = "04_get_abs_path";
+        hash = "sha256-FuEEp/nZ3xNIpemcRTXPThxvQ7ZeB0REOqs0/Jl6AJ4=";
+      })
+      (fetchChntpwDebianPatch {
+        patch = "06_correct_test_open_syscall";
+        hash = "sha256-DQ55aRPM1uZOA6Q+C3ISJV0JayWFh2MRSnGuGtdAjwI=";
+      })
+      (fetchChntpwDebianPatch {
+        patch = "07_detect_failure_to_write_key";
+        hash = "sha256-lPDOY4ZKSZgLvfdPyurgGjvzzUCDU2JJ9/gKmK/tZl4=";
+      })
+      (fetchChntpwDebianPatch {
+        patch = "08_no_deref_null";
+        hash = "sha256-+gOoZuPwGp4byaNJ2dpb8kj6pohXDU1M1YIBqWR197w=";
+      })
+      (fetchChntpwDebianPatch {
+        patch = "09_improve_robustness";
+        hash = "sha256-SsX94ds80ccDe8pFAEbg8D4r4XK1cXZsVLbHAHybX9s=";
+      })
+      (fetchChntpwDebianPatch {
+        patch = "11_improve_documentation";
+        hash = "sha256-7+FXU7cMEAwtkoWnBRZnsN0Y75T66pyTwexgcSQ0FHs=";
+      })
+      (fetchChntpwDebianPatch {
+        patch = "12_readonly_filesystem";
+        hash = "sha256-RDly35sTVxuzEqH7ZXvh8fFC76B2oSfrw87QK9zxrM8=";
+      })
+      (fetchChntpwDebianPatch {
+        patch = "13_write_to_hive";
+        hash = "sha256-e2bM7TKyItJPaj3wyObuGQNve/QLCTvyqjNP2T2jaJg=";
+      })
+      (fetchChntpwDebianPatch {
+        patch = "14_improve_description";
+        hash = "sha256-OhexHr6rGTqM/XFJ0vS3prtI+RdcgjUtEfsT2AibxYc=";
+      })
+      (fetchChntpwDebianPatch {
+        patch = "17_hexdump-pointer-type.patch";
+        hash = "sha256-ir9LFl8FJq141OwF5SbyVMtjQ1kTMH1NXlHl0XZq7m8=";
+      })
+    ];

  installPhase = ''
    make install PREFIX=$out
@@ -103,10 +103,30 @@ stdenv.mkDerivation (finalAttrs: {
    hash = "sha256-Sgk5eaPC0C3i+8AFSaMncQB/LngDLG+qXs0vep4VICU=";
  };

-  patches = [
-    # Backport of https://github.com/curl/curl/commit/5fbd78eb2dc4afbd8884e8eed27147fc3d4318f6
-    ./0001-http2-fix-stream-window-size-after-unpausing.patch
-  ];
+  patches =
+    [
+      # Backport of https://github.com/curl/curl/commit/5fbd78eb2dc4afbd8884e8eed27147fc3d4318f6
+      ./0001-http2-fix-stream-window-size-after-unpausing.patch
+    ]
+    ++ lib.optionals wolfsslSupport [
+      (fetchpatch {
+        # https://curl.se/docs/CVE-2025-4947.html backported to 8.13. Remove when version is bumped to 8.14.
+        # Note that this works since fetchpatch uses curl, but does not use WolfSSL.
+        name = "curl-CVE-2025-4947.patch";
+        url = "https://github.com/curl/curl/commit/a85f1df4803bbd272905c9e7125.diff";
+        hash = "sha256-z4IYAkg/RylTs1m8tbwI2tVqTCHkIpmkzdFBcRBJmH4=";
+
+        # All the test patches fail to apply (seemingly, they were added for 8.14)
+        includes = [ "lib/vquic/vquic-tls.c" ];
+      })
+      (fetchpatch {
+        # https://curl.se/docs/CVE-2025-5025.html backported to 8.13. Remove when version is bumped to 8.14.
+        # Note that this works since fetchpatch uses curl, but does not use WolfSSL.
+        name = "curl-CVE-2025-5025.patch";
+        url = "https://github.com/curl/curl/commit/e1f65937a96a451292e92313396.diff";
+        hash = "sha256-9k05eDGUA7XT+H4p8H8v0lYXC4cW7W2uvO+z4gLapX4=";
+      })
+    ];

  # this could be accomplished by updateAutotoolsGnuConfigScriptsHook, but that causes infinite recursion
  # necessary for FreeBSD code path in configure
@@ -34,14 +34,14 @@ let

  edk2 = stdenv.mkDerivation {
    pname = "edk2";
-    version = "202411";
+    version = "202505";

    srcWithVendoring = fetchFromGitHub {
      owner = "tianocore";
      repo = "edk2";
-      rev = "edk2-stable${edk2.version}";
+      tag = "edk2-stable${edk2.version}";
      fetchSubmodules = true;
-      hash = "sha256-KYaTGJ3DHtWbPEbP+n8MTk/WwzLv5Vugty/tvzuEUf0=";
+      hash = "sha256-VuiEqVpG/k7pfy0cOC6XmY+8NBtU/OHdDB9Y52tyNe8=";
    };

    src = applyPatches {
@@ -62,18 +62,16 @@ let
        })
      ];

-      # EDK2 is currently working on OpenSSL 3.3.x support. Use buildpackages.openssl again,
-      # when "https://github.com/tianocore/edk2/pull/6167" is merged.
      postPatch = ''
-        # We don't want EDK2 to keep track of OpenSSL, they're frankly bad at it.
+        # de-vendor OpenSSL
        rm -r CryptoPkg/Library/OpensslLib/openssl
        mkdir -p CryptoPkg/Library/OpensslLib/openssl
        (
        cd CryptoPkg/Library/OpensslLib/openssl
-        tar --strip-components=1 -xf ${buildPackages.openssl_3.src}
+        tar --strip-components=1 -xf ${buildPackages.openssl.src}

        # Apply OpenSSL patches.
-        ${lib.pipe buildPackages.openssl_3.patches [
+        ${lib.pipe buildPackages.openssl.patches [
          (builtins.filter (
            patch:
            !builtins.elem (baseNameOf patch) [
@@ -144,7 +142,10 @@ let

    passthru = {
      # exercise a channel blocker
-      tests.uefiUsb = nixosTests.boot.uefiCdrom;
+      tests = {
+        systemdBootExtraEntries = nixosTests.systemd-boot.extraEntries;
+        uefiUsb = nixosTests.boot.uefiCdrom;
+      };

      updateScript = writeScript "update-edk2" ''
        #!/usr/bin/env nix-shell
@@ -6,25 +6,23 @@

 stdenvNoCC.mkDerivation rec {
  pname = "edusong";
-  version = "1.0"; # The upstream doesn't provide the version
+  version = "4.0";

  src = fetchzip {
    name = "${pname}-${version}";
    url = "https://language.moe.gov.tw/001/Upload/Files/site_content/M0001/eduSong_Unicode.zip";
-    hash = "sha256-pIG1EbFGf2O2AzM4+HCCvGPodBBwUt7ozpb+BpPk5Kw=";
+    hash = "sha256-4NBnwMrYufeZbgSiD2fAhe4tuy0aAA5u9tWwjQQjEQk=";
  };

  installPhase = ''
    mkdir -p $out/share/fonts/
-    mv *.ttf $out/share/fonts/
+    mv eduSong_Unicode*.ttf $out/share/fonts/eduSong_Unicode\(2024年12月\).ttf
  '';

  meta = {
-    description = "The MOE Standard Song Font, a Chinese font by the Ministry of Education, ROC (Taiwan)";
+    description = "The MOE Song font, a Song-style Chinese character typeface";
    longDescription = ''
-      The MOE Standard Song Font is a Chinese Song font provided by
-      the Midistry of Education, Republic of China (Taiwan).
-      Song or Ming is a category of CKJ typefaces in print.
+      A Song-style Chinese character typeface published by the Ministry of Education of the Republic of China (Taiwan). The Song style is also referred to as 宋體, 宋体, sòngtǐ, 明體, 明体, or míngtǐ, in Chinese; 명조체, 明朝體, or myeongjo in Korean; 明朝体, みんちょうたい, or minchōtai in Japanese.
    '';
    homepage = "https://language.moe.gov.tw/result.aspx?classify_sn=23&subclassify_sn=436&content_sn=48";
    license = lib.licenses.cc-by-nd-30;
@@ -1,39 +0,0 @@
-{
-  lib,
-  fetchFromSourcehut,
-  rustPlatform,
-  pkg-config,
-  openssl,
-}:
-
-rustPlatform.buildRustPackage rec {
-  pname = "eidolon";
-  version = "1.4.6";
-
-  src = fetchFromSourcehut {
-    owner = "~nicohman";
-    repo = "eidolon";
-    rev = version;
-    hash = "sha256-Ofc3i+iMmbUgY3bomUk4rM3bEQInTV3rIPz3m0yZw/o=";
-  };
-
-  cargoLock = {
-    lockFile = ./Cargo.lock;
-  };
-
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ openssl ];
-
-  postPatch = ''
-    ln -sf ${./Cargo.lock} Cargo.lock
-  '';
-
-  meta = with lib; {
-    description = "Single TUI-based registry for drm-free, wine and steam games on linux, accessed through a rofi launch menu";
-    mainProgram = "eidolon";
-    homepage = "https://github.com/nicohman/eidolon";
-    license = licenses.gpl3Only;
-    maintainers = with maintainers; [ _0x4A6F ];
-    platforms = platforms.linux;
-  };
-}
@@ -9,13 +9,13 @@

 stdenv.mkDerivation rec {
  pname = "fastp";
-  version = "0.24.1";
+  version = "0.24.2";

  src = fetchFromGitHub {
    owner = "OpenGene";
    repo = "fastp";
    rev = "v${version}";
-    sha256 = "sha256-vTAuuhnJ5O2mUFUxM5RIq8w/Zo3SmAgQIDd99YpDcww=";
+    sha256 = "sha256-8AJ6wgqbCqH/f3flgdVYUb5u0C5/CQl6MJe7HmZrp60=";
  };

  buildInputs = [
@@ -6,6 +6,8 @@

  nodejs_22,
  pnpm_9,
+
+  nixosTests,
 }:

 let
@@ -70,6 +72,9 @@ buildGo123Module {

  passthru = {
    inherit frontend;
+    tests = {
+      inherit (nixosTests) filebrowser;
+    };
  };

  meta = with lib; {
@@ -1,13 +1,12 @@
 {
  fetchzip,
-  gitUpdater,
  lib,
  stdenv,
  nix-update-script,
 }:

 let
-  version = "2.3.29";
+  version = "3.3.39";
 in
 stdenv.mkDerivation {
  pname = "flashspace";
@@ -16,7 +15,7 @@ stdenv.mkDerivation {

  src = fetchzip {
    url = "https://github.com/wojciech-kulik/FlashSpace/releases/download/v${version}/FlashSpace.app.zip";
-    hash = "sha256-aBqlxIPPhx5GwNowf172Ko10g8RXnN7nIJaD3Zh4TPg=";
+    hash = "sha256-/mgdeRxaxq+oIjbbaxCSExHxyYqqWl80+6jPzPIhT4M=";
  };

  installPhase = ''
@@ -8,13 +8,13 @@

 buildDotnetModule rec {
  pname = "garnet";
-  version = "1.0.64";
+  version = "1.0.65";

  src = fetchFromGitHub {
    owner = "microsoft";
    repo = "garnet";
    tag = "v${version}";
-    hash = "sha256-0poitBKuCfUtkGWXomQAictt7ts7Qdgq1TvEMSqvdJ4=";
+    hash = "sha256-Gebd0dj5VbUiYPTmOlkDQEiIDjflV02GLHCEIjh4S04=";
  };

  projectFile = "main/GarnetServer/GarnetServer.csproj";
@@ -8,16 +8,16 @@

 buildGoModule (finalAttrs: {
  pname = "geminicommit";
-  version = "0.3.1";
+  version = "0.4.0";

  src = fetchFromGitHub {
    owner = "tfkhdyt";
    repo = "geminicommit";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-G28vwH9i4eqr4vxidRYLgdFL6y5VztpvrI2UK+6aS8M=";
+    hash = "sha256-hJevJkniyICUUr1UyS0A5SKuuYRU0dGHMWzF99Yr2Eo=";
  };

-  vendorHash = "sha256-+eKJLXgKuUHelUjD8MpMa+cRP+clmYK+1olcb/jmabk=";
+  vendorHash = "sha256-IfqlPg+HPcOfjlwwuLi2/R21UD83xQzWyUmzM7JSDEs=";

  nativeBuildInputs = [
    installShellFiles
@@ -10,16 +10,16 @@

 buildGoModule (finalAttrs: {
  pname = "glab";
-  version = "1.56.0";
+  version = "1.57.0";

  src = fetchFromGitLab {
    owner = "gitlab-org";
    repo = "cli";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-dFyVhl4+WdQeoSZSY8JbkjJBhqOX/oN2b9q1CGlLhpc=";
+    hash = "sha256-a5gV47DP8+WOaMVcEWlTcriobnj74JTYKVDqYzJgGRU=";
  };

-  vendorHash = "sha256-m4IWtK2PNjs2UxzVCT2oSx6Gic2flN4Fq8w0mNIhHxo=";
+  vendorHash = "sha256-9NKY8CACcR70EdHGRWicROoA4khXYZjLPNd8A+VkjuY=";

  ldflags = [
    "-s"
@@ -3,17 +3,16 @@
  buildGoModule,
  fetchFromGitHub,
  testers,
-  go-jsonnet,
 }:

-buildGoModule rec {
+buildGoModule (finalAttrs: {
  pname = "go-jsonnet";
  version = "0.21.0";

  src = fetchFromGitHub {
    owner = "google";
-    repo = pname;
-    rev = "v${version}";
+    repo = finalAttrs.pname;
+    tag = "v${finalAttrs.version}";
    hash = "sha256-J92xNDpCidbiSsN6NveS6BX6Tx+qDQqkgm6pjk1wBTQ=";
  };

@@ -21,9 +20,14 @@ buildGoModule rec {

  subPackages = [ "cmd/jsonnet*" ];

+  ldflags = [
+    "-s"
+    "-w"
+  ];
+
  passthru.tests.version = testers.testVersion {
-    package = go-jsonnet;
-    version = "v${version}";
+    package = finalAttrs.finalPackage;
+    version = "v${finalAttrs.version}";
  };

  meta = {
@@ -36,4 +40,4 @@ buildGoModule rec {
    ];
    mainProgram = "jsonnet";
  };
-}
+})
@@ -19,7 +19,7 @@

 python3Packages.buildPythonApplication rec {
  pname = "hashes";
-  version = "1.1.1";
+  version = "1.1.2";

  pyproject = false;

@@ -27,7 +27,7 @@ python3Packages.buildPythonApplication rec {
    owner = "zefr0x";
    repo = "hashes";
    tag = "v${version}";
-    hash = "sha256-4khMRtKvYQkTwhiqv7FUy/jroGboNTdG1Q6wlTD4cwA=";
+    hash = "sha256-Nyf7jED6LnsFu86zWhRh05sdGKwVAybVsGLGFFsz6eA=";
  };

  nativeBuildInputs = [
@@ -1,26 +1,26 @@
 {
-  "version": "1.133.1",
-  "hash": "sha256-8jqFiVNj494GQInfLDTXm43mO+H9YuxPwIqUJFOwwW0=",
+  "version": "1.134.0",
+  "hash": "sha256-TTHgEQyKx54pFWvCD1FT8KZSO9/EZxULZS97VGTfFcE=",
  "components": {
    "cli": {
-      "npmDepsHash": "sha256-oDgO8kb/8VqOAGUfG70x2K58j+OsZe+CjurEShiMeCU=",
-      "version": "2.2.67"
+      "npmDepsHash": "sha256-FOtzQF+3yWJI1lzZq79pbPehDFHAsNk5bx71vm1xWBQ=",
+      "version": "2.2.68"
    },
    "server": {
-      "npmDepsHash": "sha256-3beEul7d4OfByrcm4u28Qv7KTdPW8GJ2gnHfQHT9LY0=",
-      "version": "1.133.1"
+      "npmDepsHash": "sha256-VzduZY7yMgjoCtTzW5rCooFubJeZuSnkYe9mwmI/n6Q=",
+      "version": "1.134.0"
    },
    "web": {
-      "npmDepsHash": "sha256-xvSh0NGm7O+lunbHcE7aGv2OzQNVFlHWIeUAQPF218c=",
-      "version": "1.133.1"
+      "npmDepsHash": "sha256-/T8GZ+kqx/G+9Yn76v2vj+KteoS046d0Cxk58YN+3es=",
+      "version": "1.134.0"
    },
    "open-api/typescript-sdk": {
-      "npmDepsHash": "sha256-y2jwNlqGUIsr3DfNSpEr8BFdP7e8xvNUhBQ52ypf0YI=",
-      "version": "1.133.1"
+      "npmDepsHash": "sha256-gTS+zrhL4mqT0UOLfzrKFdumtwZPmlQntj+DbCaQ2s8=",
+      "version": "1.134.0"
    },
    "geonames": {
-      "timestamp": "20250523191247",
-      "hash": "sha256-TiqUyYre3gGv3yJMoh6B+RZWu1AiMpgSZSW16NTI+Eg="
+      "timestamp": "20250527235755",
+      "hash": "sha256-vAoQS07EEPkDhrnJGz3iX+sBaPDUHB5uF0a/pr5+zD4="
    }
  }
 }
@@ -38,13 +38,13 @@ let
  ];
 in

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "instead";
-  version = "3.3.2";
+  version = "3.5.2";

  src = fetchurl {
-    url = "mirror://sourceforge/project/instead/instead/${version}/instead_${version}.tar.gz";
-    sha256 = "u5j2kDKRvMQPsG8iA6uOBScuyE/e1BJIK2+qVL6jqQs=";
+    url = "mirror://sourceforge/project/instead/instead/${finalAttrs.version}/instead_${finalAttrs.version}.tar.gz";
+    hash = "sha256-d5BvzZCZ3P5CLptuCuJ4KxfEp4CDbtmIZDIbGDcyV3o=";
  };

  NIX_LDFLAGS = "-llua -lgcc_s";
@@ -53,6 +53,7 @@ stdenv.mkDerivation rec {
    pkg-config
    unzip
  ];
+
  buildInputs = [
    SDL2
    SDL2_ttf
@@ -64,11 +65,15 @@ stdenv.mkDerivation rec {

  postPatch = ''
    substituteInPlace configure.sh \
-      --replace "/tmp/sdl-test" $(mktemp)
+      --replace-fail "/tmp/sdl-test" $(mktemp)
  '';

  configurePhase = ''
+    runHook preConfigure
+
    { echo 2; echo $out; } | ./configure.sh
+
+    runHook postConfigure
  '';

  inherit games;
@@ -83,11 +88,11 @@ stdenv.mkDerivation rec {

  enableParallelBuilding = true;

-  meta = with lib; {
+  meta = {
    description = "Simple text adventure interpreter for Unix and Windows";
    homepage = "https://instead.syscall.ru/";
    license = lib.licenses.mit;
    platforms = with lib.platforms; linux;
-    maintainers = with maintainers; [ pSub ];
+    maintainers = with lib.maintainers; [ pSub ];
  };
-}
+})
@@ -6,11 +6,11 @@

 let
  pname = "jbrowse";
-  version = "3.4.0";
+  version = "3.5.0";

  src = fetchurl {
    url = "https://github.com/GMOD/jbrowse-components/releases/download/v${version}/jbrowse-desktop-v${version}-linux.AppImage";
-    sha256 = "sha256-u7ZVHn1/HUyV27yGx0HZeWgdm4NuVK8ZH0UogrmbxOo=";
+    sha256 = "sha256-UAuKbfvJuCDIaERFVYo6rdhBG2ycp87ZnCrVPLDDv9g=";
  };

  appimageContents = appimageTools.extractType2 {
@@ -7,13 +7,13 @@

 buildGoModule rec {
  pname = "kubevpn";
-  version = "2.7.11";
+  version = "2.7.12";

  src = fetchFromGitHub {
    owner = "KubeNetworks";
    repo = "kubevpn";
    rev = "v${version}";
-    hash = "sha256-PqKgBJugibgG/4gGBINuFxWAxSYEKRpPXpofiOKmmIs=";
+    hash = "sha256-Tf0hhhabSP4MxXMb046dBzcjF7T+cmhcCF/1+ZNo1fM=";
  };

  vendorHash = null;
@@ -49,7 +49,16 @@ stdenv.mkDerivation rec {
  PREFIX = placeholder "out";
  LIBDIRNAME = "/lib";

-  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-error=cast-function-type -Wno-error=format-truncation";
+  env.NIX_CFLAGS_COMPILE = toString (
+    lib.optionals stdenv.cc.isClang [
+      "-Wno-error=cast-function-type"
+      "-Wno-error=format-truncation"
+    ]
+    # https://github.com/wolfcw/libfaketime/blob/6714b98794a9e8a413bf90d2927abf5d888ada99/README#L101-L104
+    ++ lib.optionals (stdenv.hostPlatform.isLoongArch64 || stdenv.hostPlatform.isRiscV64) [
+      "-DFORCE_PTHREAD_NONVER"
+    ]
+  );

  nativeCheckInputs = [ perl ];

@@ -42,14 +42,14 @@ in
 # as bootloader for various platforms and corresponding binary and helper files.
 stdenv.mkDerivation (finalAttrs: {
  pname = "limine";
-  version = "9.3.2";
+  version = "9.3.3";

  # We don't use the Git source but the release tarball, as the source has a
  # `./bootstrap` script performing network access to download resources.
  # Packaging that in Nix is very cumbersome.
  src = fetchurl {
    url = "https://github.com/limine-bootloader/limine/releases/download/v${finalAttrs.version}/limine-${finalAttrs.version}.tar.gz";
-    hash = "sha256-aYzNgErrlRIIv4hmekdoPMCZ4g5xDYIeTUJhEkfuuJQ=";
+    hash = "sha256-+yhHFt9SvYUl/tjfwZyR0OJK8+BDzieLS2AFY1VyNLE=";
  };

  enableParallelBuilding = true;
@@ -3,7 +3,6 @@
  stdenv,
  fetchurl,
  pkg-config,
-  SDL,
  SDL2,
  udevCheckHook,
 }:
@@ -22,7 +21,6 @@ stdenv.mkDerivation rec {
    udevCheckHook
  ];
  buildInputs = [
-    SDL
    SDL2
  ];

--- a/Show More
+++ b/Show More