Merge master into staging-next

2025-06-13 12:07:07 +00:00
parent b8e64cf111 e23c230d5c
commit 386c13fe1a
82 changed files with 1315 additions and 844 deletions
@@ -1,22 +1,10 @@
-name: "Build NixOS manual v2"
+name: Build

 on:
  pull_request:
    paths:
-      - .github/workflows/manual-nixos-v2.yml
+      - .github/workflows/build.yml
  pull_request_target:
-    branches:
-      - master
-      - release-*
-    paths:
-      - "nixos/**"
-      # Also build when the nixpkgs doc changed, since we take things like
-      # the release notes and some css and js files from there.
-      # See nixos/doc/manual/default.nix
-      - "doc/**"
-      # Build when something in lib changes
-      # Since the lib functions are used to 'massage' the options before producing the manual
-      - "lib/**"

 concurrency:
  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.head_ref || github.run_id }}
@@ -29,16 +17,24 @@ defaults:
    shell: bash

 jobs:
-  nixos:
-    name: nixos-manual-build
+  build:
    strategy:
      fail-fast: false
      matrix:
        include:
          - runner: ubuntu-24.04
            system: x86_64-linux
+            builds: [shell,manual-nixos,lib-tests]
          - runner: ubuntu-24.04-arm
            system: aarch64-linux
+            builds: [shell,manual-nixos,manual-nixpkgs,manual-nixpkgs-tests]
+          - runner: macos-13
+            system: x86_64-darwin
+            builds: [shell]
+          - runner: macos-14
+            system: aarch64-darwin
+            builds: [shell]
+    name: ${{ matrix.system }}
    runs-on: ${{ matrix.runner }}
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
@@ -59,13 +55,34 @@ jobs:
          name: nixpkgs-ci
          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"

+      - name: Build shell
+        if: contains(matrix.builds, 'shell')
+        run: nix-build untrusted/ci -A shell
+
      - name: Build NixOS manual
-        id: build-manual
-        run: nix-build untrusted/ci -A manual-nixos --argstr system ${{ matrix.system }}
+        if: |
+          contains(matrix.builds, 'manual-nixos') && !cancelled() &&
+          (github.base_ref == 'master' || startsWith(github.base_ref, 'release-'))
+        run: nix-build untrusted/ci -A manual-nixos --argstr system ${{ matrix.system }} --out-link nixos-manual
+
+      - name: Build Nixpkgs manual
+        if: contains(matrix.builds, 'manual-nixpkgs') && !cancelled()
+        run: nix-build untrusted/ci -A manual-nixpkgs -A manual-nixpkgs-tests
+
+      - name: Build Nixpkgs manual tests
+        if: contains(matrix.builds, 'manual-nixpkgs-tests') && !cancelled()
+        run: nix-build untrusted/ci -A manual-nixpkgs-tests
+
+      - name: Build lib tests
+        if: contains(matrix.builds, 'lib-tests') && !cancelled()
+        run: nix-build untrusted/ci -A lib-tests

      - name: Upload NixOS manual
+        if: |
+          contains(matrix.builds, 'manual-nixos') && !cancelled() &&
+          (github.base_ref == 'master' || startsWith(github.base_ref, 'release-'))
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: nixos-manual-${{ matrix.system }}
-          path: result/
+          path: nixos-manual
          if-no-files-found: error
@@ -1,50 +0,0 @@
-name: Check that files are formatted
-
-on:
-  pull_request:
-    paths:
-      - .github/workflows/check-format.yml
-  pull_request_target:
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.head_ref || github.run_id }}
-  cancel-in-progress: true
-
-permissions: {}
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  nixos:
-    name: fmt-check
-    runs-on: ubuntu-24.04-arm
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          sparse-checkout: .github/actions
-      - name: Check if the PR can be merged and checkout the merge commit
-        uses: ./.github/actions/get-merge-commit
-        with:
-          merged-as-untrusted: true
-
-      - uses: cachix/install-nix-action@17fe5fb4a23ad6cbbe47d6b3f359611ad276644c # v31
-        with:
-          extra_nix_config: sandbox = true
-
-      - name: Check that files are formatted
-        run: |
-          # Note that it's fine to run this on untrusted code because:
-          # - There's no secrets accessible here
-          # - The build is sandboxed
-          if ! nix-build untrusted/ci -A fmt.check; then
-            echo "Some files are not properly formatted"
-            echo "Please format them by going to the Nixpkgs root directory and running one of:"
-            echo "  nix-shell --run treefmt"
-            echo "  nix develop --command treefmt"
-            echo "  nix fmt"
-            echo "Make sure your branch is up to date with master; rebase if not."
-            echo "If you're having trouble, please ping @NixOS/nix-formatting"
-            exit 1
-          fi
@@ -1,58 +0,0 @@
-name: "Check shell"
-
-on:
-  pull_request:
-    paths:
-      - .github/workflows/check-shell.yml
-  pull_request_target:
-    paths:
-      - 'shell.nix'
-      - 'ci/**'
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.head_ref || github.run_id }}
-  cancel-in-progress: true
-
-permissions: {}
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  shell-check:
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - runner: ubuntu-24.04
-            system: x86_64-linux
-          - runner: ubuntu-24.04-arm
-            system: aarch64-linux
-          - runner: macos-13
-            system: x86_64-darwin
-          - runner: macos-14
-            system: aarch64-darwin
-
-    name: shell-check-${{ matrix.system }}
-    runs-on: ${{ matrix.runner }}
-
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          sparse-checkout: .github/actions
-      - name: Check if the PR can be merged and checkout the merge commit
-        uses: ./.github/actions/get-merge-commit
-        with:
-          merged-as-untrusted: true
-
-      - uses: cachix/install-nix-action@17fe5fb4a23ad6cbbe47d6b3f359611ad276644c # v31
-
-      - uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16
-        with:
-          # This cache is for the nixpkgs repo checks and should not be trusted or used elsewhere.
-          name: nixpkgs-ci
-          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
-
-      - name: Build shell
-        run: nix-build untrusted/ci -A shell
@@ -1,29 +1,45 @@
-name: "Check cherry-picks"
+name: Check

 on:
  pull_request:
    paths:
-      - .github/workflows/check-cherry-picks.yml
+      - .github/workflows/check.yml
  pull_request_target:
-    branches:
-      - 'release-**'
-      - 'staging-**'
-      - '!staging-next'

 concurrency:
  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

-permissions:
-  pull-requests: write
+permissions: {}

 defaults:
  run:
    shell: bash

 jobs:
-  check:
-    name: cherry-pick-check
+  no-channel-base:
+    name: no channel base
+    if: |
+      startsWith(github.base_ref, 'nixos-') ||
+      startsWith(github.base_ref, 'nixpkgs-')
+    runs-on: ubuntu-24.04-arm
+    steps:
+      - run: |
+          cat <<EOF
+          The nixos-* and nixpkgs-* branches are pushed to by the channel
+          release script and should not be merged into directly.
+
+          Please target the equivalent release-* branch or master instead.
+          EOF
+          exit 1
+
+  cherry-pick:
+    if: |
+      github.event_name == 'pull_request' ||
+      startsWith(github.base_ref, 'release-') ||
+      (startsWith(github.base_ref, 'staging-') && github.base_ref != 'staging-next')
+    permissions:
+      pull-requests: write
    runs-on: ubuntu-24.04-arm
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
@@ -0,0 +1,65 @@
+name: Dismissed review
+
+on:
+  workflow_run:
+    workflows:
+      - Review dismissed
+    types: [completed]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
+permissions:
+  pull-requests: write
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  # The `check-cherry-picks` workflow creates review comments which reviewers
+  # are encouraged to manually dismiss if they're not relevant.
+  # When a CI-generated review is dismissed, this job automatically minimizes
+  # it, preventing it from cluttering the PR.
+  minimize:
+    name: Minimize as resolved
+    runs-on: ubuntu-24.04-arm
+    steps:
+      - uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        with:
+          script: |
+            // PRs from forks don't have any PRs associated by default.
+            // Thus, we request the PR number with an API call *to* the fork's repo.
+            // Multiple pull requests can be open from the same head commit, either via
+            // different base branches or head branches.
+            const { head_repository, head_sha, repository } = context.payload.workflow_run
+            await Promise.all(
+              (await github.paginate(github.rest.repos.listPullRequestsAssociatedWithCommit, {
+                owner: head_repository.owner.login,
+                repo: head_repository.name,
+                commit_sha: head_sha
+              }))
+              .filter(pull_request => pull_request.base.repo.id == repository.id)
+              .map(async (pull_request) =>
+                Promise.all(
+                  (await github.paginate(github.rest.pulls.listReviews, {
+                    owner: context.repo.owner,
+                    repo: context.repo.repo,
+                    pull_number: pull_request.number
+                  })).filter(review =>
+                    review.user.login == 'github-actions[bot]' &&
+                    review.state == 'DISMISSED'
+                  ).map(review => github.graphql(`
+                    mutation($node_id:ID!) {
+                      minimizeComment(input: {
+                        classifier: RESOLVED,
+                        subjectId: $node_id
+                      })
+                      { clientMutationId }
+                    }`,
+                    { node_id: review.node_id }
+                  ))
+                )
+              )
+            )
@@ -217,46 +217,6 @@ jobs:
          name: comparison
          path: comparison/*

-      - name: Labelling pull request
-        if: ${{ github.event_name == 'pull_request_target' }}
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
-        with:
-          script: |
-            const { readFile } = require('node:fs/promises')
-
-            const pr = {
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: context.payload.pull_request.number
-            }
-
-            // Get all currently set labels that we manage
-            const before =
-              (await github.paginate(github.rest.issues.listLabelsOnIssue, pr))
-              .map(({ name }) => name)
-              .filter(name => name.startsWith('10.rebuild') || name == '11.by: package-maintainer')
-
-            // And the labels that should be there
-            const after = JSON.parse(await readFile('comparison/changed-paths.json', 'utf-8')).labels
-
-            // Remove the ones not needed anymore
-            await Promise.all(
-              before.filter(name => !after.includes(name))
-              .map(name => github.rest.issues.removeLabel({
-                ...pr,
-                name
-              }))
-            )
-
-            // And add the ones that aren't set already
-            const added = after.filter(name => !before.includes(name))
-            if (added.length > 0) {
-              await github.rest.issues.addLabels({
-                ...pr,
-                labels: added
-              })
-            }
-
      - name: Add eval summary to commit statuses
        if: ${{ github.event_name == 'pull_request_target' }}
        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
@@ -289,6 +249,16 @@ jobs:
              target_url
            })

+  labels:
+    name: Labels
+    needs: [ compare ]
+    uses: ./.github/workflows/labels.yml
+    permissions:
+      issues: write
+      pull-requests: write
+    with:
+      caller: ${{ github.workflow }}
+
  reviewers:
    name: Reviewers
    # No dependency on "compare", so that it can start at the same time.
@@ -6,14 +6,23 @@
 name: "Label PR"

 on:
-  pull_request_target:
+  workflow_call:
+    inputs:
+      caller:
+        description: Name of the calling workflow.
+        required: true
+        type: string
+  workflow_run:
+    workflows:
+      - Review dismissed
+      - Review submitted
+    types: [completed]

 concurrency:
-  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.head_ref || github.run_id }}
+  group: ${{ inputs.caller }}-${{ github.workflow }}-${{ github.event_name }}-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

 permissions:
-  contents: read
  issues: write # needed to create *new* labels
  pull-requests: write

@@ -27,8 +36,113 @@ jobs:
    runs-on: ubuntu-24.04-arm
    if: "!contains(github.event.pull_request.title, '[skip treewide]')"
    steps:
+      - uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        id: eval
+        with:
+          script: |
+            const run_id = (await github.rest.actions.listWorkflowRuns({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              workflow_id: 'eval.yml',
+              event: 'pull_request_target',
+              head_sha: context.payload.pull_request?.head.sha ?? context.payload.workflow_run.head_sha
+            })).data.workflow_runs[0]?.id
+            core.setOutput('run-id', run_id)
+
+      - name: Download the comparison results
+        if: steps.eval.outputs.run-id
+        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
+        with:
+          run-id: ${{ steps.eval.outputs.run-id }}
+          github-token: ${{ github.token }}
+          pattern: comparison
+          path: comparison
+          merge-multiple: true
+
+      - name: Labels from eval
+        if: steps.eval.outputs.run-id && github.event_name != 'pull_request'
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        with:
+          script: |
+            const { readFile } = require('node:fs/promises')
+
+            let pull_requests
+            if (context.payload.workflow_run) {
+              // PRs from forks don't have any PRs associated by default.
+              // Thus, we request the PR number with an API call *to* the fork's repo.
+              // Multiple pull requests can be open from the same head commit, either via
+              // different base branches or head branches.
+              const { head_repository, head_sha, repository } = context.payload.workflow_run
+              pull_requests = (await github.paginate(github.rest.repos.listPullRequestsAssociatedWithCommit, {
+                owner: head_repository.owner.login,
+                repo: head_repository.name,
+                commit_sha: head_sha
+              })).filter(pull_request => pull_request.base.repo.id == repository.id)
+            } else {
+              pull_requests = [ context.payload.pull_request ]
+            }
+
+            await Promise.all(
+              pull_requests.map(async (pull_request) => {
+                const pr = {
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  issue_number: pull_request.number
+                }
+
+                // Get all currently set labels that we manage
+                const before =
+                  (await github.paginate(github.rest.issues.listLabelsOnIssue, pr))
+                  .map(({ name }) => name)
+                  .filter(name =>
+                    name.startsWith('10.rebuild') ||
+                    name == '11.by: package-maintainer' ||
+                    name.startsWith('12.approvals:') ||
+                    name == '12.approved-by: package-maintainer'
+                  )
+
+                const approvals =
+                  (await github.paginate(github.rest.pulls.listReviews, {
+                    owner: context.repo.owner,
+                    repo: context.repo.repo,
+                    pull_number: pull_request.number
+                  }))
+                  .filter(review => review.state == 'APPROVED')
+                  .map(review => review.user.id)
+
+                const maintainers = Object.keys(
+                  JSON.parse(await readFile('comparison/maintainers.json', 'utf-8'))
+                )
+
+                // And the labels that should be there
+                const after = JSON.parse(await readFile('comparison/changed-paths.json', 'utf-8')).labels
+                if (approvals.length > 0) after.push(`12.approvals: ${approvals.length > 2 ? '3+' : approvals.length}`)
+                if (maintainers.some(id => approvals.includes(id))) after.push('12.approved-by: package-maintainer')
+
+                // Remove the ones not needed anymore
+                await Promise.all(
+                  before.filter(name => !after.includes(name))
+                  .map(name => github.rest.issues.removeLabel({
+                    ...pr,
+                    name
+                  }))
+                )
+
+                // And add the ones that aren't set already
+                const added = after.filter(name => !before.includes(name))
+                if (added.length > 0) {
+                  await github.rest.issues.addLabels({
+                    ...pr,
+                    labels: added
+                  })
+                }
+              })
+            )
+
      - uses: actions/labeler@8558fd74291d67161a8a78ce36a881fa63b766a9 # v5.0.0
+        name: Labels from touched files
        if: |
+          github.event_name != 'workflow_run' &&
          github.event.pull_request.head.repo.owner.login != 'NixOS' || !(
            github.head_ref == 'haskell-updates' ||
            github.head_ref == 'python-updates' ||
@@ -39,8 +153,11 @@ jobs:
          repo-token: ${{ secrets.GITHUB_TOKEN }}
          configuration-path: .github/labeler.yml # default
          sync-labels: true
+
      - uses: actions/labeler@8558fd74291d67161a8a78ce36a881fa63b766a9 # v5.0.0
+        name: Labels from touched files (no sync)
        if: |
+          github.event_name != 'workflow_run' &&
          github.event.pull_request.head.repo.owner.login != 'NixOS' || !(
            github.head_ref == 'haskell-updates' ||
            github.head_ref == 'python-updates' ||
@@ -51,11 +168,14 @@ jobs:
          repo-token: ${{ secrets.GITHUB_TOKEN }}
          configuration-path: .github/labeler-no-sync.yml
          sync-labels: false
+
      - uses: actions/labeler@8558fd74291d67161a8a78ce36a881fa63b766a9 # v5.0.0
+        name: Labels from touched files (development branches)
        # Development branches like staging-next, haskell-updates and python-updates get special labels.
        # This is to avoid the mass of labels there, which is mostly useless - and really annoying for
        # the backport labels.
        if: |
+          github.event_name != 'workflow_run' &&
          github.event.pull_request.head.repo.owner.login == 'NixOS' && (
            github.head_ref == 'haskell-updates' ||
            github.head_ref == 'python-updates' ||
@@ -1,47 +0,0 @@
-name: "Building Nixpkgs lib-tests"
-
-on:
-  pull_request:
-    paths:
-      - .github/workflows/lib-tests.yml
-  pull_request_target:
-    paths:
-      - 'lib/**'
-      - 'maintainers/**'
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.head_ref || github.run_id }}
-  cancel-in-progress: true
-
-permissions: {}
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  nixpkgs-lib-tests:
-    name: nixpkgs-lib-tests
-    runs-on: ubuntu-24.04
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          sparse-checkout: .github/actions
-      - name: Check if the PR can be merged and checkout the merge commit
-        uses: ./.github/actions/get-merge-commit
-        with:
-          merged-as-untrusted: true
-
-      - uses: cachix/install-nix-action@17fe5fb4a23ad6cbbe47d6b3f359611ad276644c # v31
-        with:
-          extra_nix_config: sandbox = true
-
-      - uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16
-        with:
-          # This cache is for the nixpkgs repo checks and should not be trusted or used elsewhere.
-          name: nixpkgs-ci
-          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
-
-      - name: Building Nixpkgs lib-tests
-        run: |
-          nix-build untrusted/ci -A lib-tests
@@ -0,0 +1,101 @@
+name: Lint
+
+on:
+  pull_request:
+    paths:
+      - .github/workflows/lint.yml
+  pull_request_target:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
+permissions: {}
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  treefmt:
+    runs-on: ubuntu-24.04-arm
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          sparse-checkout: .github/actions
+      - name: Check if the PR can be merged and checkout the merge commit
+        uses: ./.github/actions/get-merge-commit
+        with:
+          merged-as-untrusted: true
+
+      - uses: cachix/install-nix-action@17fe5fb4a23ad6cbbe47d6b3f359611ad276644c # v31
+        with:
+          extra_nix_config: sandbox = true
+
+      - name: Check that files are formatted
+        run: |
+          # Note that it's fine to run this on untrusted code because:
+          # - There's no secrets accessible here
+          # - The build is sandboxed
+          if ! nix-build untrusted/ci -A fmt.check; then
+            echo "Some files are not properly formatted"
+            echo "Please format them by going to the Nixpkgs root directory and running one of:"
+            echo "  nix-shell --run treefmt"
+            echo "  nix develop --command treefmt"
+            echo "  nix fmt"
+            echo "Make sure your branch is up to date with master; rebase if not."
+            echo "If you're having trouble, please ping @NixOS/nix-formatting"
+            exit 1
+          fi
+
+  parse:
+    runs-on: ubuntu-24.04-arm
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          sparse-checkout: .github/actions
+      - name: Check if the PR can be merged and checkout the merge commit
+        uses: ./.github/actions/get-merge-commit
+        with:
+          merged-as-untrusted: true
+
+      - uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31
+        with:
+          extra_nix_config: sandbox = true
+
+      - name: Parse all nix files
+        run: |
+          # Tests multiple versions at once, let's make sure all of them run, so keep-going.
+          nix-build untrusted/ci -A parse --keep-going
+
+  nixpkgs-vet:
+    runs-on: ubuntu-24.04-arm
+    # This should take 1 minute at most, but let's be generous. The default of 6 hours is definitely too long.
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          sparse-checkout: .github/actions
+      - name: Check if the PR can be merged and checkout merged and target commits
+        uses: ./.github/actions/get-merge-commit
+        with:
+          merged-as-untrusted: true
+          target-as-trusted: true
+
+      - uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31
+        with:
+          extra_nix_config: sandbox = true
+
+      - name: Running nixpkgs-vet
+        env:
+          # Force terminal colors to be enabled. The library that `nixpkgs-vet` uses respects https://bixense.com/clicolors/
+          CLICOLOR_FORCE: 1
+        run: |
+          if nix-build untrusted/ci -A nixpkgs-vet --arg base "./trusted" --arg head "./untrusted"; then
+            exit 0
+          else
+            exitCode=$?
+            echo "To run locally: ./ci/nixpkgs-vet.sh $GITHUB_BASE_REF https://github.com/$GITHUB_REPOSITORY.git"
+            echo "If you're having trouble, ping @NixOS/nixpkgs-vet"
+            exit "$exitCode"
+          fi
@@ -1,47 +0,0 @@
-name: "Build Nixpkgs manual v2"
-
-on:
-  pull_request:
-    paths:
-      - .github/workflows/manual-nixpkgs-v2.yml
-  pull_request_target:
-    paths:
-      - 'doc/**'
-      - 'lib/**'
-      - 'pkgs/by-name/ni/nixdoc/**'
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.head_ref || github.run_id }}
-  cancel-in-progress: true
-
-permissions: {}
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  nixpkgs:
-    name: nixpkgs-manual-build
-    runs-on: ubuntu-24.04-arm
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          sparse-checkout: .github/actions
-      - name: Check if the PR can be merged and checkout the merge commit
-        uses: ./.github/actions/get-merge-commit
-        with:
-          merged-as-untrusted: true
-
-      - uses: cachix/install-nix-action@17fe5fb4a23ad6cbbe47d6b3f359611ad276644c # v31
-        with:
-          extra_nix_config: sandbox = true
-
-      - uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16
-        with:
-          # This cache is for the nixpkgs repo checks and should not be trusted or used elsewhere.
-          name: nixpkgs-ci
-          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
-
-      - name: Building Nixpkgs manual
-        run: nix-build untrusted/ci -A manual-nixpkgs -A manual-nixpkgs-tests
@@ -1,41 +0,0 @@
-name: "Check whether nix files are parseable v2"
-
-on:
-  pull_request:
-    paths:
-      - .github/workflows/nix-parse-v2.yml
-  pull_request_target:
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.head_ref || github.run_id }}
-  cancel-in-progress: true
-
-permissions: {}
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  tests:
-    name: nix-files-parseable-check
-    runs-on: ubuntu-24.04-arm
-    if: "!contains(github.event.pull_request.title, '[skip treewide]')"
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          sparse-checkout: .github/actions
-      - name: Check if the PR can be merged and checkout the merge commit
-        uses: ./.github/actions/get-merge-commit
-        with:
-          merged-as-untrusted: true
-
-      - uses: cachix/install-nix-action@17fe5fb4a23ad6cbbe47d6b3f359611ad276644c # v31
-        with:
-          extra_nix_config: sandbox = true
-          nix_path: nixpkgs=channel:nixpkgs-unstable
-
-      - name: Parse all nix files
-        run: |
-          # Tests multiple versions at once, let's make sure all of them run, so keep-going.
-          nix-build untrusted/ci -A parse --keep-going
@@ -1,54 +0,0 @@
-# `nixpkgs-vet` is a tool to vet Nixpkgs: its architecture, package structure, and more.
-# Among other checks, it makes sure that `pkgs/by-name` (see `../../pkgs/by-name/README.md`) follows the validity rules outlined in [RFC 140](https://github.com/NixOS/rfcs/pull/140).
-# When you make changes to this workflow, please also update `ci/nixpkgs-vet.sh` to reflect the impact of your work to the CI.
-# See https://github.com/NixOS/nixpkgs-vet for details on the tool and its checks.
-
-name: Vet nixpkgs
-
-on:
-  pull_request:
-    paths:
-      - .github/workflows/nixpkgs-vet.yml
-  pull_request_target:
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.head_ref || github.run_id }}
-  cancel-in-progress: true
-
-permissions: {}
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  check:
-    name: nixpkgs-vet
-    runs-on: ubuntu-24.04-arm
-    # This should take 1 minute at most, but let's be generous. The default of 6 hours is definitely too long.
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          sparse-checkout: .github/actions
-      - name: Check if the PR can be merged and checkout merged and target commits
-        uses: ./.github/actions/get-merge-commit
-        with:
-          merged-as-untrusted: true
-          target-as-trusted: true
-
-      - uses: cachix/install-nix-action@17fe5fb4a23ad6cbbe47d6b3f359611ad276644c # v31
-
-      - name: Running nixpkgs-vet
-        env:
-          # Force terminal colors to be enabled. The library that `nixpkgs-vet` uses respects https://bixense.com/clicolors/
-          CLICOLOR_FORCE: 1
-        run: |
-          if nix-build untrusted/ci -A nixpkgs-vet --arg base "./trusted" --arg head "./untrusted"; then
-            exit 0
-          else
-            exitCode=$?
-            echo "To run locally: ./ci/nixpkgs-vet.sh $GITHUB_BASE_REF https://github.com/$GITHUB_REPOSITORY.git"
-            echo "If you're having trouble, ping @NixOS/nixpkgs-vet"
-            exit "$exitCode"
-          fi
@@ -1,30 +0,0 @@
-name: "No channel PR"
-
-on:
-  pull_request:
-    paths:
-      - .github/workflows/no-channel.yml
-  pull_request_target:
-
-permissions: {}
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  fail:
-    if: |
-      startsWith(github.event.pull_request.base.ref, 'nixos-') ||
-      startsWith(github.event.pull_request.base.ref, 'nixpkgs-')
-    name: "This PR is targeting a channel branch"
-    runs-on: ubuntu-24.04-arm
-    steps:
-      - run: |
-          cat <<EOF
-          The nixos-* and nixpkgs-* branches are pushed to by the channel
-          release script and should not be merged into directly.
-
-          Please target the equivalent release-* branch or master instead.
-          EOF
-          exit 1
@@ -0,0 +1,17 @@
+name: Review dismissed
+
+on:
+  pull_request_review:
+    types: [dismissed]
+
+permissions: {}
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  trigger:
+    runs-on: ubuntu-24.04-arm
+    steps:
+      - run: echo This is a no-op only used as a trigger for workflow_run.
@@ -0,0 +1,17 @@
+name: Review submitted
+
+on:
+  pull_request_review:
+    types: [submitted]
+
+permissions: {}
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  trigger:
+    runs-on: ubuntu-24.04-arm
+    steps:
+      - run: echo This is a no-op only used as a trigger for workflow_run.
@@ -10876,6 +10876,12 @@
    githubId = 13622947;
    keys = [ { fingerprint = "1412 816B A9FA F62F D051 1975 D3E1 B013 B463 1293"; } ];
  };
+  isotoxal = {
+    name = "Abhinav Kuruvila Joseph";
+    email = "abhinavkuruvila@proton.me";
+    github = "IsotoxalDev";
+    githubId = 62714538;
+  };
  istoph = {
    email = "chr@istoph.de";
    name = "Christoph Hüffelmann";
@@ -14429,6 +14435,12 @@
    name = "legendofmiracles";
    keys = [ { fingerprint = "CC50 F82C 985D 2679 0703  AF15 19B0 82B3 DEFE 5451"; } ];
  };
+  lonerOrz = {
+    email = "2788892716@qq.com";
+    name = "lonerOrz";
+    github = "lonerOrz";
+    githubId = 68736947;
+  };
  longer = {
    email = "michal@mieszczak.com.pl";
    name = "Michał Mieszczak";
@@ -19405,6 +19417,12 @@
    githubId = 28323;
    name = "Peter Simons";
  };
+  petingoso = {
+    email = "petingavasco@protonmail.com";
+    github = "Petingoso";
+    githubId = 92183955;
+    name = "Vasco Petinga";
+  };
  petrkozorezov = {
    email = "petr.kozorezov@gmail.com";
    github = "petrkozorezov";
@@ -118,6 +118,10 @@ in
        StateDirectory = "gatus";
        SyslogIdentifier = "gatus";
        EnvironmentFile = lib.optional (cfg.environmentFile != null) cfg.environmentFile;
+        # see https://github.com/prometheus-community/pro-bing#linux
+        AmbientCapabilities = "CAP_NET_RAW";
+        CapabilityBoundingSet = "CAP_NET_RAW";
+        NoNewPrivileges = true;
      };

      environment = {
@@ -12,12 +12,12 @@
  pkgs,
 }:
 let
-  version = "0.0.24-unstable-2025-06-05";
+  version = "0.0.24-unstable-2025-06-12";
  src = fetchFromGitHub {
    owner = "yetone";
    repo = "avante.nvim";
-    rev = "12bdb66ea4749f9f59861e7165a4de6cfbf4eb22";
-    hash = "sha256-dUtvMkb85HR7xzMoCHeeJIwwyQPdwHNdQHUMyA7+EsU=";
+    rev = "8a64d454ef8cfaef2c6280efc9a09ba94fec2c42";
+    hash = "sha256-45Hnopy5yAFpPFNnsTEmfeFTub5tQvhf4dRYoKC+F0g=";
  };
  avante-nvim-lib = rustPlatform.buildRustPackage {
    pname = "avante-nvim-lib";
@@ -1,21 +1,32 @@
 {
  lib,
  vscode-utils,
+  jq,
+  moreutils,
  terraform-ls,
+  vscode-extension-update-script,
 }:
+
 vscode-utils.buildVscodeMarketplaceExtension {
  mktplcRef = {
    name = "terraform";
    publisher = "hashicorp";
-    version = "2.34.3";
-    hash = "sha256-kE9xH0cp741aCqhrwFDW+lQxOAsdLNzCCOTWMxd+li0=";
+    version = "2.34.4";
+    hash = "sha256-gTU37q7kh51CxqQE7KylSwEK4ubiUU5uihbFew/Fg98=";
  };

-  postPatch = ''
-    substituteInPlace dist/extension.js \
-      --replace-fail 'this.customBinPath=Ga("terraform").get("languageServer.path")' 'this.customBinPath = Ga("terraform").get("languageServer.path") || '${terraform-ls}/bin/terraform-ls';'
+  postInstall = ''
+    cd "$out/$installPrefix"
+    ${lib.getExe jq} '.contributes.configuration[0].properties."terraform.languageServer.path".default = "${terraform-ls}/bin/terraform-ls"' package.json | ${lib.getExe' moreutils "sponge"} package.json
  '';

+  passthru.updateScript = vscode-extension-update-script {
+    extraArgs = [
+      "--override-filename"
+      "pkgs/applications/editors/vscode/extensions/hashicorp.terraform/default.nix"
+    ];
+  };
+
  meta = {
    license = lib.licenses.mit;
    maintainers = [ lib.maintainers.rhoriguchi ];
@@ -9,6 +9,9 @@
  qtsvg,
  qtwayland,
  kimageformats,
+  libavif,
+  libheif,
+  libjxl,
  wrapGAppsHook3,
  wrapQtAppsHook,
  glib-networking,
@@ -34,11 +37,16 @@ stdenv.mkDerivation (finalAttrs: {
      qtbase
      qtimageformats
      qtsvg
-      kimageformats
    ]
    ++ lib.optionals stdenv.hostPlatform.isLinux [
+      kimageformats
      qtwayland
    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      libavif
+      libheif
+      libjxl
+    ]
    ++ lib.optionals withWebkit [
      glib-networking
    ];
@@ -404,11 +404,11 @@ rec {
  };

  docker_28 = callPackage dockerGen rec {
-    version = "28.1.1";
+    version = "28.2.2";
    cliRev = "v${version}";
-    cliHash = "sha256-bRnJ+c2C4t+94NL82L0S3r84uoJaTDq16YQGvEmo7Sw=";
+    cliHash = "sha256-ZaKG4H8BqIzgs9OFktH9bjHSf9exAlh5kPCGP021BWI=";
    mobyRev = "v${version}";
-    mobyHash = "sha256-FB9btun41PAqqBjb9Ebn7SyjrIg/ILe3xJ+mqu2lqrs=";
+    mobyHash = "sha256-Y2yP2NBJLrI83iHe2EoA7/cXiQifrCkUKlwJhINKBXE=";
    runcRev = "v1.2.6";
    runcHash = "sha256-XMN+YKdQOQeOLLwvdrC6Si2iAIyyHD5RgZbrOHrQE/g=";
    containerdRev = "v1.7.27";
@@ -6,12 +6,12 @@

 python3Packages.buildPythonApplication rec {
  pname = "bikeshed";
-  version = "5.2.0";
+  version = "5.2.1";
  pyproject = true;

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-HUPkLEpwLRnrffUMN62WPqsZX2UsGqPfjEa91UMbUMM=";
+    hash = "sha256-EMWIHtIomiq7BvnG6x0+gJeSkouWpZzcnqys5mSM7aI=";
  };

  build-system = [ python3Packages.setuptools ];
@@ -6,17 +6,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "cargo-careful";
-  version = "0.4.6";
+  version = "0.4.7";

  src = fetchFromGitHub {
    owner = "RalfJung";
    repo = "cargo-careful";
    rev = "v${version}";
-    hash = "sha256-aKmaNDk9yZ/1MS3vQ9c1rCySfxiNv8PRwnIjT5bdhMg=";
+    hash = "sha256-aMQrPJp0AVEYfMlWZBy9IMvQQxlkW7KWuxqLn1Ds2ck=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-KtTTpYwhNYvghb8k2NXyCRV5NGn07d7iaW+5uTI6qJ4=";
+  cargoHash = "sha256-5uMz1j0ZnA4wPMfC2SeY33zsiTt2NNZnWh9th2UJiNI=";

  meta = with lib; {
    description = "Tool to execute Rust code carefully, with extra checking along the way";
@@ -137,6 +137,11 @@ stdenvNoCC.mkDerivation {
    mkdir -p $out/bin
    ln -s ${fhs-env}/bin/${fhs-env.name} $out/bin/packettracer8

+    mkdir -p $out/share/icons/hicolor/48x48/apps
+    ln -s ${unwrapped}/opt/pt/art/app.png $out/share/icons/hicolor/48x48/apps/cisco-packet-tracer.png
+    ln -s ${unwrapped}/usr/share/icons/gnome/48x48/mimetypes $out/share/icons/hicolor/48x48/mimetypes
+    ln -s ${unwrapped}/usr/share/mime $out/share/mime
+
    runHook postInstall
  '';

@@ -144,12 +149,14 @@ stdenvNoCC.mkDerivation {
    (makeDesktopItem {
      name = "cisco-pt8.desktop";
      desktopName = "Cisco Packet Tracer 8";
-      icon = "${unwrapped}/opt/pt/art/app.png";
+      icon = "cisco-packet-tracer";
      exec = "packettracer8 %f";
      mimeTypes = [
        "application/x-pkt"
        "application/x-pka"
        "application/x-pkz"
+        "application/x-pksz"
+        "application/x-pks"
      ];
    })
  ];
@@ -1,4 +1,5 @@
 {
+  apple-sdk,
  cmake,
  fetchFromGitHub,
  git,
@@ -10,7 +11,7 @@
  python3,
  zlib,

-  # *NOT* from LLVM 9!
+  # *NOT* from LLVM 13!
  # The compiler used to compile Cling may affect the runtime include and lib
  # directories it expects to be run with. Cling builds against (a fork of) Clang,
  # so we prefer to use Clang as the compiler as well for consistency.
@@ -131,25 +132,6 @@ let
    };
  };

-  # Runtime flags for the C++ standard library
-  cxxFlags =
-    if useLLVMLibcxx then
-      [
-        "-I"
-        "${lib.getDev llvmPackages_13.libcxx}/include/c++/v1"
-        "-L"
-        "${llvmPackages_13.libcxx}/lib"
-        "-l"
-        "${llvmPackages_13.libcxx}/lib/libc++${stdenv.hostPlatform.extensions.sharedLibrary}"
-      ]
-    else
-      [
-        "-I"
-        "${gcc-unwrapped}/include/c++/${gcc-unwrapped.version}"
-        "-I"
-        "${gcc-unwrapped}/include/c++/${gcc-unwrapped.version}/${stdenv.hostPlatform.config}"
-      ];
-
  # The flags passed to the wrapped cling should
  # a) prevent it from searching for system include files and libs, and
  # b) provide it with the include files and libs it needs (C and C++ standard library plus
@@ -172,15 +154,35 @@ let
      "-isystem"
      "${lib.getLib unwrapped}/lib/clang/${llvmPackages_13.clang.version}/include"
    ]
-    ++ cxxFlags
+    ++ lib.optionals useLLVMLibcxx [
+      "-I"
+      "${lib.getDev llvmPackages_13.libcxx}/include/c++/v1"
+      "-L"
+      "${llvmPackages_13.libcxx}/lib"
+      "-l"
+      "${llvmPackages_13.libcxx}/lib/libc++${stdenv.hostPlatform.extensions.sharedLibrary}"
+    ]
+    ++ lib.optionals (!useLLVMLibcxx) [
+      "-I"
+      "${gcc-unwrapped}/include/c++/${gcc-unwrapped.version}"
+      "-I"
+      "${gcc-unwrapped}/include/c++/${gcc-unwrapped.version}/${stdenv.hostPlatform.config}"
+    ]
    ++ [
-      # System libc
+      # System libc on Linux
+      # On Darwin, this is an empty directory, so we need a separate include with
+      # apple-sdk (see below)
      "-isystem"
      "${lib.getDev stdenv.cc.libc}/include"

      # cling includes
      "-isystem"
      "${lib.getDev unwrapped}/include"
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      # On Darwin, we need the system includes
+      "-isystem"
+      "${apple-sdk}/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/usr/include"
    ];

 in
@@ -1,266 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchurl,
-  makeWrapper,
-  patchelf,
-  copyDesktopItems,
-  makeDesktopItem,
-
-  # Linked dynamic libraries.
-  alsa-lib,
-  at-spi2-atk,
-  at-spi2-core,
-  atk,
-  cairo,
-  cups,
-  dbus,
-  expat,
-  fontconfig,
-  freetype,
-  gcc-unwrapped,
-  gdk-pixbuf,
-  glib,
-  gtk3,
-  gtk4,
-  libdrm,
-  libglvnd,
-  libkrb5,
-  libX11,
-  libxcb,
-  libXcomposite,
-  libXcursor,
-  libXdamage,
-  libXext,
-  libXfixes,
-  libXi,
-  libxkbcommon,
-  libXrandr,
-  libXrender,
-  libXScrnSaver,
-  libxshmfence,
-  libXtst,
-  libgbm,
-  nspr,
-  nss,
-  pango,
-  pipewire,
-  vulkan-loader,
-  wayland, # ozone/wayland
-
-  # Command line programs
-  coreutils,
-
-  # Will crash without.
-  systemd,
-
-  # Loaded at runtime.
-  libexif,
-  pciutils,
-
-  # Additional dependencies according to other distros.
-  ## Ubuntu
-  curl,
-  liberation_ttf,
-  util-linux,
-  wget,
-  xdg-utils,
-  ## Arch Linux.
-  flac,
-  harfbuzz,
-  icu,
-  libopus,
-  libpng,
-  snappy,
-  speechd-minimal,
-  ## Gentoo
-  bzip2,
-  libcap,
-
-  # Necessary for USB audio devices.
-  libpulseaudio,
-  pulseSupport ? true,
-
-  adwaita-icon-theme,
-  gsettings-desktop-schemas,
-
-  # For video acceleration via VA-API (--enable-features=VaapiVideoDecoder)
-  libva,
-  libvaSupport ? true,
-
-  # For Vulkan support (--enable-features=Vulkan)
-  addDriverRunpath,
-
-  # For QT support
-  qt6,
-
-  # command line arguments which are always set e.g "--disable-gpu"
-  commandLineArgs ? "",
-}:
-
-let
-  opusWithCustomModes = libopus.override { withCustomModes = true; };
-
-  deps =
-    [
-      alsa-lib
-      at-spi2-atk
-      at-spi2-core
-      atk
-      bzip2
-      cairo
-      coreutils
-      cups
-      curl
-      dbus
-      expat
-      flac
-      fontconfig
-      freetype
-      gcc-unwrapped.lib
-      gdk-pixbuf
-      glib
-      harfbuzz
-      icu
-      libcap
-      libdrm
-      liberation_ttf
-      libexif
-      libglvnd
-      libkrb5
-      libpng
-      libX11
-      libxcb
-      libXcomposite
-      libXcursor
-      libXdamage
-      libXext
-      libXfixes
-      libXi
-      libxkbcommon
-      libXrandr
-      libXrender
-      libXScrnSaver
-      libxshmfence
-      libXtst
-      libgbm
-      nspr
-      nss
-      opusWithCustomModes
-      pango
-      pciutils
-      pipewire
-      snappy
-      speechd-minimal
-      systemd
-      util-linux
-      vulkan-loader
-      wayland
-      wget
-    ]
-    ++ lib.optionals pulseSupport [ libpulseaudio ]
-    ++ lib.optionals libvaSupport [ libva ]
-    ++ [
-      gtk3
-      gtk4
-      qt6.qtbase
-      qt6.qtwayland
-    ];
-in
-stdenv.mkDerivation (finalAttrs: {
-  pname = "cromite";
-  version = "137.0.7151.72";
-  commit = "4ea840397d139bcaf3298a54a80a93d135f7dac7";
-
-  src = fetchurl {
-    url = "https://github.com/uazo/cromite/releases/download/v${finalAttrs.version}-${finalAttrs.commit}/chrome-lin64.tar.gz";
-    hash = "sha256-WqOQaoboRqgYXW2tzyW3LMo5WRA8l5UWjUnfBIq6r9k=";
-  };
-
-  # With strictDeps on, some shebangs were not being patched correctly
-  # ie, $out/share/cromite/chrome
-  strictDeps = false;
-
-  nativeBuildInputs = [
-    makeWrapper
-    patchelf
-    copyDesktopItems
-  ];
-
-  buildInputs = [
-    # needed for XDG_ICON_DIRS
-    adwaita-icon-theme
-    glib
-    gtk3
-    gtk4
-    # needed for GSETTINGS_SCHEMAS_PATH
-    gsettings-desktop-schemas
-  ];
-
-  rpath = lib.makeLibraryPath deps + ":" + lib.makeSearchPathOutput "lib" "lib64" deps;
-
-  binpath = lib.makeBinPath deps;
-
-  desktopItems = [
-    (makeDesktopItem {
-      name = "cromite";
-      exec = "cromite %U";
-      icon = "cromite";
-      genericName = "Cromite";
-      desktopName = "Cromite";
-      categories = [
-        "Application"
-        "Network"
-        "WebBrowser"
-      ];
-    })
-  ];
-
-  installPhase = ''
-    runHook preInstall
-
-    install -Dm644 product_logo_48.png $out/share/pixmaps/cromite.png
-    cp -v -a . $out/share/cromite
-    # replace bundled vulkan-loader
-    rm -v $out/share/cromite/libvulkan.so.1
-    ln -v -s -t $out/share/cromite ${lib.getLib vulkan-loader}/lib/libvulkan.so.1
-    # "--simulate-outdated-no-au" disables auto updates and browser outdated popup
-    mkdir $out/bin
-    makeWrapper $out/share/cromite/chrome $out/bin/cromite \
-      --prefix QT_PLUGIN_PATH  : "${qt6.qtbase}/lib/qt-6/plugins:${qt6.qtwayland}/lib/qt-6/plugins" \
-      --prefix NIXPKGS_QT6_QML_IMPORT_PATH : "${qt6.qtwayland}/lib/qt-6/qml" \
-      --prefix LD_LIBRARY_PATH : "$rpath" \
-      --prefix PATH            : "$binpath:${lib.makeBinPath [ xdg-utils ]}" \
-      --prefix XDG_DATA_DIRS   : "$XDG_ICON_DIRS:$GSETTINGS_SCHEMAS_PATH:${addDriverRunpath.driverLink}/share" \
-      --set CHROME_WRAPPER  "cromite" \
-      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime=true --wayland-text-input-version=3}}" \
-      --add-flags "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" \
-      --add-flags ${lib.escapeShellArg commandLineArgs}
-
-    # Make sure that libGL and libvulkan are found by ANGLE libGLESv2.so
-    patchelf --set-rpath $rpath $out/share/cromite/lib*GL*
-
-    for elf in $out/share/cromite/{chrome,chrome_sandbox,chrome_crashpad_handler}; do
-      patchelf --set-rpath $rpath $elf
-      patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" $elf
-    done
-
-    runHook postInstall
-  '';
-
-  passthru.updateScript = ./update.sh;
-
-  meta = {
-    changelog = "https://github.com/uazo/cromite/releases";
-    description = "Bromite fork with ad blocking and privacy enhancements";
-    homepage = "https://github.com/uazo/cromite";
-    license = with lib.licenses; [
-      bsd3
-      gpl3Plus
-    ];
-    maintainers = with lib.maintainers; [ emaryn ];
-    mainProgram = "cromite";
-    platforms = [ "x86_64-linux" ];
-    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
-  };
-})
@@ -1,18 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -I nixpkgs=./. -i bash -p curl gnused jq nix bash coreutils nix-update common-updater-scripts
-
-set -eou pipefail
-
-latestTag=$(curl ${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} -sL https://api.github.com/repos/uazo/cromite/releases/latest | jq --raw-output .tag_name | sed 's/^v//')
-latestVersion="${latestTag%-*}"
-commit="${latestTag#*-}"
-
-currentVersion=$(nix-instantiate --eval -E "with import ./. {}; cromite.version or (lib.getVersion cromite)" | tr -d '"')
-
-if [[ "$currentVersion" == "$latestVersion" ]]; then
-    echo "package is up-to-date: $currentVersion"
-    exit 0
-fi
-
-update-source-version cromite $commit --version-key=commit || true
-nix-update cromite --version $latestVersion
@@ -6,16 +6,16 @@
 }:
 rustPlatform.buildRustPackage rec {
  pname = "firezone-headless-client";
-  version = "1.4.8";
+  version = "1.5.0";
  src = fetchFromGitHub {
    owner = "firezone";
    repo = "firezone";
    tag = "headless-client-${version}";
-    hash = "sha256-JfsOiNTwwpO998mKA1ZGZTdZfzOgP6AKBkg8cuaqKr0=";
+    hash = "sha256-3iU7AHu3GupqiZEDkuOEb+rFPA2KB1fjVNX1BY4abXc=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-Ok+pyGG5VHJbsKenKBr0mM1XRoOiAso0ebeQ5hDuwjM=";
+  cargoHash = "sha256-p2zLhLFL6NbHvVojQU5+1amf+Kh0jRAbIESPt2vqWwg=";
  sourceRoot = "${src.name}/rust";
  buildAndTestSubdir = "headless-client";
  RUSTFLAGS = "--cfg system_certs";
@@ -17,7 +17,7 @@ buildGoModule rec {
  src = fetchFromGitHub {
    owner = "getgauge";
    repo = "gauge";
-    rev = "v${version}";
+    tag = "v${version}";
    hash = "sha256-2ThnmniL2YQKBBKlBPNdO/xkHTj1JFQ0xZ5mFAjwRMg=";
  };

@@ -7,7 +7,6 @@
  xorg,
  gaugePlugins,
  plugins ? [ ],
-  runCommand,
 }:

 stdenvNoCC.mkDerivation {
@@ -8,17 +8,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "git-cliff";
-  version = "2.9.0";
+  version = "2.9.1";

  src = fetchFromGitHub {
    owner = "orhun";
    repo = "git-cliff";
    rev = "v${version}";
-    hash = "sha256-ZxMwQBhU+49+MaId16tH2np2slgCmq4yKi6PI9Dy+o4=";
+    hash = "sha256-J3KjVPH7shMupogLSfA5HV1FyA+cFSOWP9gMBU6txww=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-QPxrdmuQINzuZXyRRYDA+HguRdt6n++XuLj/OF0ceKU=";
+  cargoHash = "sha256-16ouBn6GQlE1ZVr4g/TicEL0cTiewegGkuhGcJPicrc=";

  # attempts to run the program on .git in src which is not deterministic
  doCheck = false;
@@ -17,17 +17,17 @@

 buildGoModule rec {
  pname = "grafana-alloy";
-  version = "1.8.3";
+  version = "1.9.1";

  src = fetchFromGitHub {
    owner = "grafana";
    repo = "alloy";
    tag = "v${version}";
-    hash = "sha256-Uec8DnT6tZcHYchDJr5F0t5kkEjKPOKPkdbr4Rtm51c=";
+    hash = "sha256-j3zuV+a3hLgHrb1jcPav9AhQpT8WT/cP4KSZ9gJY0p4=";
  };

  proxyVendor = true;
-  vendorHash = "sha256-b0byafxHXnrYg2dQ0hoNvo0+jmCOJ4/hVMV8J7g7MBc=";
+  vendorHash = "sha256-bePkYhKL8yNzVgX3Can9jyC1WKFQzHoX+L3qapZ0fjQ=";

  nativeBuildInputs = [
    fixup-yarn-lock
@@ -70,7 +70,7 @@ buildGoModule rec {

  yarnOfflineCache = fetchYarnDeps {
    yarnLock = "${src}/internal/web/ui/yarn.lock";
-    hash = "sha256-gKCjJe3TVpaHm/gwaNh4zeL5k4jlbWfF94aDYQ1brU8=";
+    hash = "sha256-oCDP2XJczLXgzEjyvFEIFBanlnzjrj0So09izG5vufs=";
  };

  preBuild = ''
@@ -53,7 +53,7 @@ stdenv.mkDerivation {
      # Fixup build with newer Linux headers: https://github.com/lkl/linux/pull/484
      sed '1i#include <linux/sockios.h>' -i tools/lkl/lib/hijack/xlate.c
    ''
-    + lib.optionalString stdenv.hostPlatform.isi686 ''
+    + lib.optionalString (stdenv.hostPlatform.isi686 || stdenv.hostPlatform.isLoongArch64) ''
      echo CONFIG_KALLSYMS=n >> arch/lkl/configs/defconfig
      echo CONFIG_KALLSYMS_BASE_RELATIVE=n >> arch/lkl/configs/defconfig
    ''
@@ -92,6 +92,12 @@ stdenv.mkDerivation {
  # symbol lookup error: liblkl-hijack.so: undefined symbol: __aarch64_ldadd4_sync
  env.NIX_CFLAGS_LINK = "-lgcc_s";

+  # Fixes the following error when linking on loongarch64-linux:
+  # ld: tools/lkl/liblkl.a(lkl.o): relocation R_LARCH_PCREL20_S2 overflow 0x200090
+  # ld: recompile with 'gcc -mno-relax' or 'as -mno-relax' or 'ld --no-relax'
+  # ld: final link failed: bad value
+  env.NIX_LDFLAGS = lib.optionalString stdenv.hostPlatform.isLoongArch64 "--no-relax";
+
  makeFlags = [
    "-C tools/lkl"
    "CC=${stdenv.cc}/bin/${stdenv.cc.targetPrefix}cc"
@@ -21,17 +21,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "mise";
-  version = "2025.6.0";
+  version = "2025.6.2";

  src = fetchFromGitHub {
    owner = "jdx";
    repo = "mise";
    rev = "v${version}";
-    hash = "sha256-vlzId9SjxcSQ6DDw0H68zi7xHd2Nn3bPSG+rsR7UEBs=";
+    hash = "sha256-vptTQdP7r9m328DK7USB6bV7muLVPIkZG8596nfdNQ8=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-YVeF+2qJuOMhNQLEpH3P0ufqHU0sBFRHN5yXZGTJEQA=";
+  cargoHash = "sha256-0PS3WWQo3+fJ2TivvRalYCzDFmNxPRZStJj13kAP9bg=";

  nativeBuildInputs = [
    installShellFiles
@@ -0,0 +1,50 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  makeWrapper,
+  mpv,
+  yt-dlp,
+  nix-update-script,
+}:
+rustPlatform.buildRustPackage rec {
+  pname = "mpv-handler";
+  version = "0.3.16";
+
+  src = fetchFromGitHub {
+    owner = "akiirui";
+    repo = "mpv-handler";
+    tag = "v${version}";
+    hash = "sha256-RpfHUVZmhtneeu8PIfxinYG3/groJPA9QveDSvzU6Zo=";
+  };
+
+  cargoHash = "sha256-FrE1PSRc7GTNUum05jNgKnzpDUc3FiS5CEM18It0lYY=";
+  useFetchCargoVendor = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  postInstall = ''
+    install -Dm644 share/linux/mpv-handler.desktop -t $out/share/applications/
+    install -Dm644 share/linux/mpv-handler-debug.desktop -t $out/share/applications/
+    install -Dm644 share/linux/config.toml -t $out/share/doc/mpv-handler/
+
+    wrapProgram $out/bin/mpv-handler \
+      --prefix PATH : ${
+        lib.makeBinPath [
+          mpv
+          yt-dlp
+        ]
+      }
+  '';
+
+  meta = {
+    description = "Play website videos and songs with mpv & yt-dlp";
+    homepage = "https://github.com/akiirui/mpv-handler";
+    mainProgram = "mpv-handler";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ lonerOrz ];
+    platforms = lib.platforms.linux;
+  };
+}
@@ -16,16 +16,16 @@ let
 in
 buildNpmPackage (finalAttrs: {
  pname = "netron";
-  version = "8.3.5";
+  version = "8.3.8";

  src = fetchFromGitHub {
    owner = "lutzroeder";
    repo = "netron";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-YxvUUn8VWv5M6FvIHJCaXQl7PRGcZ8qSgrZ7K0+8iME=";
+    hash = "sha256-BHV51d5X8uXnqjCkpVnZX40dAuF2HCNk/6A5cKr9nZE=";
  };

-  npmDepsHash = "sha256-fsF40qUKUNXeqvdM1m/IEgnxRZrnGW/aOYS3oZKQNpk=";
+  npmDepsHash = "sha256-E4jqaDJqgvOvV+67jtMzt/4YkhQ4GmKati0wuVMC8yI=";

  nativeBuildInputs = [ jq ];

@@ -3,26 +3,30 @@
  rustPlatform,
  fetchFromGitHub,
  nix,
+  nixfmt-rfc-style,
  nix-update-script,
 }:

 rustPlatform.buildRustPackage rec {
  pname = "nil";
-  version = "2024-08-06";
+  version = "2025-06-13";

  src = fetchFromGitHub {
    owner = "oxalica";
    repo = "nil";
    rev = version;
-    hash = "sha256-DqsN/VkYVr4M0PVRQKXPPOTaind5miYZURIYqM4MxYM=";
+    hash = "sha256-oxvVAFUO9husnRk6XZcLFLjLWL9z0pW25Fk6kVKwt1c=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-7TR/xTc66WpPszJDrpisVvHXl2+FGrUOskZAkGyY04Q=";
+  cargoHash = "sha256-OZIajxv8xNfCGalVw/FUAwWdQzPqfGuDoeRg2E2RR7s=";

  nativeBuildInputs = [ nix ];

-  env.CFG_RELEASE = version;
+  env = {
+    CFG_RELEASE = version;
+    CFG_DEFAULT_FORMATTER = lib.getExe nixfmt-rfc-style;
+  };

  # might be related to https://github.com/NixOS/nix/issues/5884
  preBuild = ''
@@ -2,7 +2,6 @@
  lib,
  stdenv,
  fetchFromGitHub,
-  fetchpatch,
  autoreconfHook,
  pkg-config,
  numactl,
@@ -10,49 +9,37 @@
  check,
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "numatop";
-  version = "2.2";
+  version = "2.5.1";
+
  src = fetchFromGitHub {
    owner = "intel";
    repo = "numatop";
-    rev = "v${version}";
-    sha256 = "sha256-GJvTwqgx34ZW10eIJj/xiKe3ZkAfs7GlJImz8jrnjfI=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-951Sm2zu1mPxMbPdZy+kMH8RAQo0z+Gqf2lxsY/+Lrg=";
  };

  nativeBuildInputs = [
    autoreconfHook
    pkg-config
  ];
+
  buildInputs = [
    numactl
    ncurses
  ];
-  nativeCheckInputs = [ check ];

-  patches = [
-    (fetchpatch {
-      # https://github.com/intel/numatop/pull/54
-      url = "https://github.com/intel/numatop/compare/eab0ac5253c5843aa0f0ac36e2eec7612207711b...c1001fd926c24eae2d40729492e07270ce133b72.patch";
-      sha256 = "sha256-TbMLv7TT9T8wE4uJ1a/AroyPPwrwL0eX5IBLsh9GTTM=";
-      name = "fix-string-operations.patch";
-    })
-    (fetchpatch {
-      # https://github.com/intel/numatop/pull/64
-      url = "https://github.com/intel/numatop/commit/635e2ce2ccb1ac793cc276a7fcb8a92b1ffefa5d.patch";
-      sha256 = "sha256-IevbSFJRTS5iQ5apHOVXzF67f3LJaW6j7DySFmVuyiM=";
-      name = "fix-format-strings-mvwprintw.patch";
-    })
-  ];
+  nativeCheckInputs = [ check ];

  doCheck = true;

-  meta = with lib; {
+  meta = {
    description = "Tool for runtime memory locality characterization and analysis of processes and threads on a NUMA system";
    mainProgram = "numatop";
    homepage = "https://01.org/numatop";
-    license = licenses.bsd3;
-    maintainers = with maintainers; [ dtzWill ];
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ dtzWill ];
    platforms = [
      "i686-linux"
      "x86_64-linux"
@@ -60,4 +47,4 @@ stdenv.mkDerivation rec {
      "powerpc64le-linux"
    ];
  };
-}
+})
@@ -6,6 +6,7 @@
  openssl,
  perl,
  libmysqlclient,
+  sqlite,
  mariadb,
  postgresql,
  mbedtls,
@@ -15,26 +16,33 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "ocsp-server";
-  version = "0.4.1";
+  version = "0.6.0";

  src = fetchFromGitHub {
    owner = "DorianCoding";
    repo = "OCSP-server";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-xYZ2NM+U7ZW5xDKVUhT+s66i/d7zaDLBbSbr6TDOG0o=";
+    hash = "sha256-QaPE1mbOI6+D2pPfhpMA8LmWXKqkOoLLBQSVxdlNkoY=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-RFrm2dtjJ2VvOg8ee54ps8MuWgsV0kd9rhpzOFTem2k=";
+  cargoHash = "sha256-qaDnMbAQA5c8Nim28HAN9QB1cxfBRaFAy8xh41Iekds=";
+
+  checkFlags = [
+    # Requires database access
+    "--skip=test::checkconfig"
+  ];

  nativeBuildInputs = [
    pkg-config
    perl
    libmysqlclient
+    sqlite
  ];

  buildInputs = [
    openssl
+    sqlite
    mariadb
    postgresql
    mbedtls
@@ -0,0 +1,317 @@
+[
+  {
+    "pname": "Microsoft.NETCore.Platforms",
+    "version": "1.1.0",
+    "hash": "sha256-FeM40ktcObQJk4nMYShB61H/E8B7tIKfl9ObJ0IOcCM="
+  },
+  {
+    "pname": "Microsoft.NETCore.Targets",
+    "version": "1.1.0",
+    "hash": "sha256-0AqQ2gMS8iNlYkrD+BxtIg7cXMnr9xZHtKAuN4bjfaQ="
+  },
+  {
+    "pname": "Mono.Cecil",
+    "version": "0.11.4",
+    "hash": "sha256-HrnRgFsOzfqAWw0fUxi/vkzZd8dMn5zueUeLQWA9qvs="
+  },
+  {
+    "pname": "MonoMod",
+    "version": "22.1.4.3",
+    "hash": "sha256-kindD5YUjBWsopvEnmOL4XsldgwE1zRrmMxIh6nDua8="
+  },
+  {
+    "pname": "MonoMod.RuntimeDetour",
+    "version": "22.1.4.3",
+    "hash": "sha256-m7FN3SGME4GRGuc7l5ClCT9W3mXqbbhAJHHpWwYqLi8="
+  },
+  {
+    "pname": "MonoMod.RuntimeDetour.HookGen",
+    "version": "22.1.4.3",
+    "hash": "sha256-DuOnuXQcS63Z/y5s3q5FHZiqWTPgayNpylkzRzl6pE4="
+  },
+  {
+    "pname": "MonoMod.Utils",
+    "version": "22.1.4.3",
+    "hash": "sha256-0KyqozOCC26+z5+Ah35iFvRwrPXvvxDlEq6gLl5lPNU="
+  },
+  {
+    "pname": "Newtonsoft.Json",
+    "version": "13.0.1",
+    "hash": "sha256-K2tSVW4n4beRPzPu3rlVaBEMdGvWSv/3Q1fxaDh4Mjo="
+  },
+  {
+    "pname": "runtime.any.System.Collections",
+    "version": "4.3.0",
+    "hash": "sha256-4PGZqyWhZ6/HCTF2KddDsbmTTjxs2oW79YfkberDZS8="
+  },
+  {
+    "pname": "runtime.any.System.Globalization",
+    "version": "4.3.0",
+    "hash": "sha256-PaiITTFI2FfPylTEk7DwzfKeiA/g/aooSU1pDcdwWLU="
+  },
+  {
+    "pname": "runtime.any.System.IO",
+    "version": "4.3.0",
+    "hash": "sha256-vej7ySRhyvM3pYh/ITMdC25ivSd0WLZAaIQbYj/6HVE="
+  },
+  {
+    "pname": "runtime.any.System.Reflection",
+    "version": "4.3.0",
+    "hash": "sha256-ns6f++lSA+bi1xXgmW1JkWFb2NaMD+w+YNTfMvyAiQk="
+  },
+  {
+    "pname": "runtime.any.System.Reflection.Extensions",
+    "version": "4.3.0",
+    "hash": "sha256-Y2AnhOcJwJVYv7Rp6Jz6ma0fpITFqJW+8rsw106K2X8="
+  },
+  {
+    "pname": "runtime.any.System.Reflection.Primitives",
+    "version": "4.3.0",
+    "hash": "sha256-LkPXtiDQM3BcdYkAm5uSNOiz3uF4J45qpxn5aBiqNXQ="
+  },
+  {
+    "pname": "runtime.any.System.Resources.ResourceManager",
+    "version": "4.3.0",
+    "hash": "sha256-9EvnmZslLgLLhJ00o5MWaPuJQlbUFcUF8itGQNVkcQ4="
+  },
+  {
+    "pname": "runtime.any.System.Runtime",
+    "version": "4.3.0",
+    "hash": "sha256-qwhNXBaJ1DtDkuRacgHwnZmOZ1u9q7N8j0cWOLYOELM="
+  },
+  {
+    "pname": "runtime.any.System.Runtime.Handles",
+    "version": "4.3.0",
+    "hash": "sha256-PQRACwnSUuxgVySO1840KvqCC9F8iI9iTzxNW0RcBS4="
+  },
+  {
+    "pname": "runtime.any.System.Runtime.InteropServices",
+    "version": "4.3.0",
+    "hash": "sha256-Kaw5PnLYIiqWbsoF3VKJhy7pkpoGsUwn4ZDCKscbbzA="
+  },
+  {
+    "pname": "runtime.any.System.Text.Encoding",
+    "version": "4.3.0",
+    "hash": "sha256-Q18B9q26MkWZx68exUfQT30+0PGmpFlDgaF0TnaIGCs="
+  },
+  {
+    "pname": "runtime.any.System.Threading.Tasks",
+    "version": "4.3.0",
+    "hash": "sha256-agdOM0NXupfHbKAQzQT8XgbI9B8hVEh+a/2vqeHctg4="
+  },
+  {
+    "pname": "runtime.debian.8-x64.runtime.native.System.Security.Cryptography.OpenSsl",
+    "version": "4.3.0",
+    "hash": "sha256-LXUPLX3DJxsU1Pd3UwjO1PO9NM2elNEDXeu2Mu/vNps="
+  },
+  {
+    "pname": "runtime.fedora.23-x64.runtime.native.System.Security.Cryptography.OpenSsl",
+    "version": "4.3.0",
+    "hash": "sha256-qeSqaUI80+lqw5MK4vMpmO0CZaqrmYktwp6L+vQAb0I="
+  },
+  {
+    "pname": "runtime.fedora.24-x64.runtime.native.System.Security.Cryptography.OpenSsl",
+    "version": "4.3.0",
+    "hash": "sha256-SrHqT9wrCBsxILWtaJgGKd6Odmxm8/Mh7Kh0CUkZVzA="
+  },
+  {
+    "pname": "runtime.native.System",
+    "version": "4.3.0",
+    "hash": "sha256-ZBZaodnjvLXATWpXXakFgcy6P+gjhshFXmglrL5xD5Y="
+  },
+  {
+    "pname": "runtime.native.System.Security.Cryptography.OpenSsl",
+    "version": "4.3.0",
+    "hash": "sha256-Jy01KhtcCl2wjMpZWH+X3fhHcVn+SyllWFY8zWlz/6I="
+  },
+  {
+    "pname": "runtime.opensuse.13.2-x64.runtime.native.System.Security.Cryptography.OpenSsl",
+    "version": "4.3.0",
+    "hash": "sha256-wyv00gdlqf8ckxEdV7E+Ql9hJIoPcmYEuyeWb5Oz3mM="
+  },
+  {
+    "pname": "runtime.opensuse.42.1-x64.runtime.native.System.Security.Cryptography.OpenSsl",
+    "version": "4.3.0",
+    "hash": "sha256-zi+b4sCFrA9QBiSGDD7xPV27r3iHGlV99gpyVUjRmc4="
+  },
+  {
+    "pname": "runtime.osx.10.10-x64.runtime.native.System.Security.Cryptography.OpenSsl",
+    "version": "4.3.0",
+    "hash": "sha256-gybQU6mPgaWV3rBG2dbH6tT3tBq8mgze3PROdsuWnX0="
+  },
+  {
+    "pname": "runtime.rhel.7-x64.runtime.native.System.Security.Cryptography.OpenSsl",
+    "version": "4.3.0",
+    "hash": "sha256-VsP72GVveWnGUvS/vjOQLv1U80H2K8nZ4fDAmI61Hm4="
+  },
+  {
+    "pname": "runtime.ubuntu.14.04-x64.runtime.native.System.Security.Cryptography.OpenSsl",
+    "version": "4.3.0",
+    "hash": "sha256-4yKGa/IrNCKuQ3zaDzILdNPD32bNdy6xr5gdJigyF5g="
+  },
+  {
+    "pname": "runtime.ubuntu.16.04-x64.runtime.native.System.Security.Cryptography.OpenSsl",
+    "version": "4.3.0",
+    "hash": "sha256-HmdJhhRsiVoOOCcUvAwdjpMRiyuSwdcgEv2j9hxi+Zc="
+  },
+  {
+    "pname": "runtime.ubuntu.16.10-x64.runtime.native.System.Security.Cryptography.OpenSsl",
+    "version": "4.3.0",
+    "hash": "sha256-pVFUKuPPIx0edQKjzRon3zKq8zhzHEzko/lc01V/jdw="
+  },
+  {
+    "pname": "runtime.unix.System.Diagnostics.Debug",
+    "version": "4.3.0",
+    "hash": "sha256-ReoazscfbGH+R6s6jkg5sIEHWNEvjEoHtIsMbpc7+tI="
+  },
+  {
+    "pname": "runtime.unix.System.Private.Uri",
+    "version": "4.3.0",
+    "hash": "sha256-c5tXWhE/fYbJVl9rXs0uHh3pTsg44YD1dJvyOA0WoMs="
+  },
+  {
+    "pname": "runtime.unix.System.Runtime.Extensions",
+    "version": "4.3.0",
+    "hash": "sha256-l8S9gt6dk3qYG6HYonHtdlYtBKyPb29uQ6NDjmrt3V4="
+  },
+  {
+    "pname": "System.Collections",
+    "version": "4.3.0",
+    "hash": "sha256-afY7VUtD6w/5mYqrce8kQrvDIfS2GXDINDh73IjxJKc="
+  },
+  {
+    "pname": "System.Collections.NonGeneric",
+    "version": "4.3.0",
+    "hash": "sha256-8/yZmD4jjvq7m68SPkJZLBQ79jOTOyT5lyzX4SCYAx8="
+  },
+  {
+    "pname": "System.Collections.Specialized",
+    "version": "4.3.0",
+    "hash": "sha256-QNg0JJNx+zXMQ26MJRPzH7THdtqjrNtGLUgaR1SdvOk="
+  },
+  {
+    "pname": "System.ComponentModel",
+    "version": "4.3.0",
+    "hash": "sha256-i00uujMO4JEDIEPKLmdLY3QJ6vdSpw6Gh9oOzkFYBiU="
+  },
+  {
+    "pname": "System.ComponentModel.Primitives",
+    "version": "4.3.0",
+    "hash": "sha256-IOMJleuIBppmP4ECB3uftbdcgL7CCd56+oAD/Sqrbus="
+  },
+  {
+    "pname": "System.ComponentModel.TypeConverter",
+    "version": "4.3.0",
+    "hash": "sha256-PSDiPYt8PgTdTUBz+GH6lHCaM1YgfObneHnZsc8Fz54="
+  },
+  {
+    "pname": "System.Diagnostics.Debug",
+    "version": "4.3.0",
+    "hash": "sha256-fkA79SjPbSeiEcrbbUsb70u9B7wqbsdM9s1LnoKj0gM="
+  },
+  {
+    "pname": "System.Globalization",
+    "version": "4.3.0",
+    "hash": "sha256-caL0pRmFSEsaoeZeWN5BTQtGrAtaQPwFi8YOZPZG5rI="
+  },
+  {
+    "pname": "System.Globalization.Extensions",
+    "version": "4.3.0",
+    "hash": "sha256-mmJWA27T0GRVuFP9/sj+4TrR4GJWrzNIk2PDrbr7RQk="
+  },
+  {
+    "pname": "System.IO",
+    "version": "4.3.0",
+    "hash": "sha256-ruynQHekFP5wPrDiVyhNiRIXeZ/I9NpjK5pU+HPDiRY="
+  },
+  {
+    "pname": "System.IO.FileSystem.Primitives",
+    "version": "4.3.0",
+    "hash": "sha256-LMnfg8Vwavs9cMnq9nNH8IWtAtSfk0/Fy4s4Rt9r1kg="
+  },
+  {
+    "pname": "System.Linq",
+    "version": "4.3.0",
+    "hash": "sha256-R5uiSL3l6a3XrXSSL6jz+q/PcyVQzEAByiuXZNSqD/A="
+  },
+  {
+    "pname": "System.Private.Uri",
+    "version": "4.3.0",
+    "hash": "sha256-fVfgcoP4AVN1E5wHZbKBIOPYZ/xBeSIdsNF+bdukIRM="
+  },
+  {
+    "pname": "System.Reflection",
+    "version": "4.3.0",
+    "hash": "sha256-NQSZRpZLvtPWDlvmMIdGxcVuyUnw92ZURo0hXsEshXY="
+  },
+  {
+    "pname": "System.Reflection.Emit.ILGeneration",
+    "version": "4.7.0",
+    "hash": "sha256-GUnQeGo/DtvZVQpFnESGq7lJcjB30/KnDY7Kd2G/ElE="
+  },
+  {
+    "pname": "System.Reflection.Emit.Lightweight",
+    "version": "4.7.0",
+    "hash": "sha256-V0Wz/UUoNIHdTGS9e1TR89u58zJjo/wPUWw6VaVyclU="
+  },
+  {
+    "pname": "System.Reflection.Extensions",
+    "version": "4.3.0",
+    "hash": "sha256-mMOCYzUenjd4rWIfq7zIX9PFYk/daUyF0A8l1hbydAk="
+  },
+  {
+    "pname": "System.Reflection.Primitives",
+    "version": "4.3.0",
+    "hash": "sha256-5ogwWB4vlQTl3jjk1xjniG2ozbFIjZTL9ug0usZQuBM="
+  },
+  {
+    "pname": "System.Reflection.TypeExtensions",
+    "version": "4.7.0",
+    "hash": "sha256-GEtCGXwtOnkYejSV+Tfl+DqyGq5jTUaVyL9eMupMHBM="
+  },
+  {
+    "pname": "System.Resources.ResourceManager",
+    "version": "4.3.0",
+    "hash": "sha256-idiOD93xbbrbwwSnD4mORA9RYi/D/U48eRUsn/WnWGo="
+  },
+  {
+    "pname": "System.Runtime",
+    "version": "4.3.0",
+    "hash": "sha256-51813WXpBIsuA6fUtE5XaRQjcWdQ2/lmEokJt97u0Rg="
+  },
+  {
+    "pname": "System.Runtime.Extensions",
+    "version": "4.3.0",
+    "hash": "sha256-wLDHmozr84v1W2zYCWYxxj0FR0JDYHSVRaRuDm0bd/o="
+  },
+  {
+    "pname": "System.Runtime.Handles",
+    "version": "4.3.0",
+    "hash": "sha256-KJ5aXoGpB56Y6+iepBkdpx/AfaJDAitx4vrkLqR7gms="
+  },
+  {
+    "pname": "System.Runtime.InteropServices",
+    "version": "4.3.0",
+    "hash": "sha256-8sDH+WUJfCR+7e4nfpftj/+lstEiZixWUBueR2zmHgI="
+  },
+  {
+    "pname": "System.Text.Encoding",
+    "version": "4.3.0",
+    "hash": "sha256-GctHVGLZAa/rqkBNhsBGnsiWdKyv6VDubYpGkuOkBLg="
+  },
+  {
+    "pname": "System.Threading",
+    "version": "4.3.0",
+    "hash": "sha256-ZDQ3dR4pzVwmaqBg4hacZaVenQ/3yAF/uV7BXZXjiWc="
+  },
+  {
+    "pname": "System.Threading.Tasks",
+    "version": "4.3.0",
+    "hash": "sha256-Z5rXfJ1EXp3G32IKZGiZ6koMjRu0n8C1NGrwpdIen4w="
+  },
+  {
+    "pname": "YamlDotNet",
+    "version": "9.1.0",
+    "hash": "sha256-WbMPOLkbyN+SdMrBYuaXV2qKB+bLTV+6RdSFSy/iljk="
+  }
+]
@@ -0,0 +1,106 @@
+{
+  lib,
+  fetchFromGitHub,
+  fetchzip,
+  buildDotnetModule,
+  dotnetCorePackages,
+  luajitPackages,
+  sqlite,
+  libarchive,
+  curl,
+  love,
+  xdg-utils,
+}:
+let
+  lua_cpath =
+    with luajitPackages;
+    lib.concatMapStringsSep ";" getLuaCPath [
+      (buildLuarocksPackage {
+        pname = "lsqlite3";
+        version = "0.9.6-1";
+        src = fetchzip {
+          url = "http://lua.sqlite.org/home/zip/lsqlite3_v096.zip";
+          hash = "sha256-Mq409A3X9/OS7IPI/KlULR6ZihqnYKk/mS/W/2yrGBg=";
+        };
+        buildInputs = [ sqlite.dev ];
+      })
+
+      lua-subprocess
+      nfd
+    ];
+
+  phome = "$out/lib/olympus";
+  # The following variables are to be updated by the update script.
+  version = "25.04.20.01";
+  buildId = "4758"; # IMPORTANT: This line is matched with regex in update.sh.
+  rev = "10e01bf182e51d1fc2b6060622108a1fb98ae7b7";
+in
+buildDotnetModule {
+  pname = "olympus-unwrapped";
+  inherit version;
+
+  src = fetchFromGitHub {
+    inherit rev;
+    owner = "EverestAPI";
+    repo = "Olympus";
+    fetchSubmodules = true; # Required. See upstream's README.
+    hash = "sha256-7Xdd6AdDpHQUmQ3ogEyir/OQwvOcVDMtweE3D/v4uuQ=";
+  };
+
+  nativeBuildInputs = [
+    libarchive # To create the .love file (zip format).
+  ];
+
+  nugetDeps = ./deps.json;
+  projectFile = "sharp/Olympus.Sharp.csproj";
+  executables = [ ];
+  installPath = "${placeholder "out"}/lib/olympus/sharp";
+
+  # See the 'Dist: Update src/version.txt' step in azure-pipelines.yml from upstream.
+  preConfigure = ''
+    echo ${version}-nixos-${buildId}-${builtins.substring 0 5 rev} > src/version.txt
+  '';
+
+  # The script find-love is hacked to use love from nixpkgs.
+  # It is used to launch Loenn from Olympus.
+  # I assume --fused is so saves are properly made (https://love2d.org/wiki/love.filesystem).
+  preInstall = ''
+    mkdir -p ${phome}
+    makeWrapper ${lib.getExe love} ${phome}/find-love \
+      --add-flags "--fused"
+
+    install -Dm755 suppress-output.sh ${phome}/suppress-output
+
+    mkdir -p $out/bin
+    makeWrapper ${phome}/find-love $out/bin/olympus \
+      --prefix LUA_CPATH ";" "${lua_cpath}" \
+      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ curl ]}" \
+      --suffix PATH : "${lib.makeBinPath [ xdg-utils ]}" \
+      --add-flags ${phome}/olympus.love \
+      --set DOTNET_ROOT ${dotnetCorePackages.runtime_8_0}/share/dotnet
+
+    bsdtar --format zip --strip-components 1 -cf ${phome}/olympus.love src
+  '';
+
+  postInstall = ''
+    install -Dm644 lib-linux/olympus.desktop $out/share/applications/olympus.desktop
+    install -Dm644 src/data/icon.png $out/share/icons/hicolor/128x128/apps/olympus.png
+    install -Dm644 LICENSE $out/share/licenses/olympus/LICENSE
+  '';
+
+  passthru.updateScript = ./update.sh;
+
+  meta = {
+    description = "Cross-platform GUI Everest installer and Celeste mod manager";
+    homepage = "https://github.com/EverestAPI/Olympus";
+    downloadPage = "https://everestapi.github.io/#olympus";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [
+      ulysseszhan
+      petingoso
+    ];
+    mainProgram = "olympus";
+    platforms = lib.platforms.unix;
+    badPlatforms = lib.platforms.aarch; # Celeste doesn't support aarch in the first place
+  };
+}
@@ -0,0 +1,32 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl jq common-updater-scripts
+
+set -eu -o pipefail
+
+attr=olympus-unwrapped
+nix_file=$(nix-instantiate --eval --strict -A "$attr.meta.position" | sed -re 's/^"(.*):[0-9]+"$/\1/')
+
+api() {
+  curl -s "https://dev.azure.com/EverestAPI/Olympus/_apis/$1?api-version=7.1"
+}
+
+pipeline_id=$(api pipelines | jq -r '
+  .value
+  | map(select(.name == "EverestAPI.Olympus"))
+  | .[0].id
+')
+
+run_id=$(api pipelines/$pipeline_id/runs | jq -r '
+  .value
+  | map(select(.result == "succeeded"))
+  | max_by(.finishedDate)
+  | .id
+')
+sed -i 's|buildId\s*=\s*".*";|buildId = "'$run_id'";|' $nix_file
+
+run=$(api pipelines/$pipeline_id/runs/$run_id)
+commit=$(echo "$run" | jq -r '.resources.repositories.self.version')
+version=$(echo "$run" | jq -r '.name')
+update-source-version $attr $version --rev=$commit
+
+"$(nix-build --attr $attr.fetch-deps --no-out-link)"
@@ -0,0 +1,71 @@
+{
+  lib,
+  makeWrapper,
+  olympus-unwrapped,
+  symlinkJoin,
+  buildFHSEnv,
+  writeShellScript,
+  # These need overriding if you launch Celeste/Loenn/MiniInstaller from Olympus.
+  # Some examples:
+  # - null: Use default wrapper.
+  # - "": Do not use wrapper.
+  # - steam-run: Use steam-run.
+  # - "steam-run": Use steam-run command available from PATH.
+  # - writeShellScriptBin { ... }: Use a custom script.
+  # - ./my-wrapper.sh: Use a custom script.
+  # In any case, it can be overridden at runtime by OLYMPUS_{CELESTE,LOENN,MINIINSTALLER}_WRAPPER.
+  celesteWrapper ? null,
+  loennWrapper ? null,
+  miniinstallerWrapper ? null,
+  skipHandlerCheck ? false, # whether to skip olympus xdg-mime check, true will override it
+}:
+let
+
+  wrapper-to-env =
+    wrapper:
+    if lib.isDerivation wrapper then
+      lib.getExe wrapper
+    else if wrapper != null then
+      wrapper
+    else
+      "";
+
+  # When installing Everest, Olympus uses MiniInstaller, which is dynamically linked.
+  miniinstaller-fhs = buildFHSEnv {
+    pname = "olympus-miniinstaller-fhs";
+    version = "1.0.0"; # remains constant, just to prevent complains
+    targetPkgs =
+      pkgs:
+      (with pkgs; [
+        icu
+        openssl
+        dotnet-runtime # Without this, MiniInstaller will install dotnet itself.
+      ]);
+  };
+
+  miniinstaller-wrapper =
+    if miniinstallerWrapper == null then
+      (writeShellScript "miniinstaller-wrapper" "exec ${lib.getExe miniinstaller-fhs} -c \"$@\"")
+    else
+      (wrapper-to-env miniinstallerWrapper);
+
+in
+symlinkJoin {
+
+  inherit (olympus-unwrapped) version meta;
+  pname = "olympus";
+
+  paths = [
+    olympus-unwrapped
+  ];
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  postBuild = ''
+    wrapProgram $out/bin/olympus \
+      --set OLYMPUS_CELESTE_WRAPPER "${wrapper-to-env celesteWrapper}" \
+      --set OLYMPUS_LOENN_WRAPPER "${wrapper-to-env loennWrapper}"  \
+      --set OLYMPUS_MINIINSTALLER_WRAPPER "${miniinstaller-wrapper}" \
+      --set OLYMPUS_SKIP_SCHEME_HANDLER_CHECK "${if skipHandlerCheck then "1" else "0"}"
+  '';
+}
@@ -6,17 +6,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "protols";
-  version = "0.12.5";
+  version = "0.12.7";

  src = fetchFromGitHub {
    owner = "coder3101";
    repo = "protols";
    tag = version;
-    hash = "sha256-zs78TKZU35UGAmEXK3EA9B6zRCqeCtNexHVAJERKyX8=";
+    hash = "sha256-3XTFKqUPXW7Zm9IruePxq8uY1H/axuE1h22cqQj/YGg=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-Lh6KJ5zclT650tPIpMJBALLj4gnis+fglhewiZ5mpMs=";
+  cargoHash = "sha256-19CNMaDVI804ekxrmUjbx9WmqsG91rviLTsvFtN+D/o=";

  meta = {
    description = "Protocol Buffers language server written in Rust";
@@ -0,0 +1,82 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitea,
+
+  pkg-config,
+  cmake,
+  ninja,
+  spirv-tools,
+  qt6,
+  breakpad,
+  jemalloc,
+  cli11,
+  wayland,
+  wayland-protocols,
+  wayland-scanner,
+  xorg,
+  libdrm,
+  libgbm,
+  pipewire,
+  pam,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "quickshell";
+  version = "0.1.0";
+
+  # github mirror: https://github.com/quickshell-mirror/quickshell
+  src = fetchFromGitea {
+    domain = "git.outfoxxed.me";
+    owner = "quickshell";
+    repo = "quickshell";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-DdE50ZJN/mKsSF/vc9hrMboOeJ7BST5DD6GNEXgVbWg=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    ninja
+    qt6.qtshadertools
+    spirv-tools
+    wayland-scanner
+    qt6.wrapQtAppsHook
+    pkg-config
+  ];
+
+  buildInputs = [
+    qt6.qtbase
+    qt6.qtdeclarative
+    qt6.qtwayland
+    qt6.qtsvg
+    cli11
+    wayland
+    wayland-protocols
+    libdrm
+    libgbm
+    breakpad
+    jemalloc
+    xorg.libxcb
+    pam
+    pipewire
+  ];
+
+  cmakeFlags = [
+    (lib.cmakeFeature "DISTRIBUTOR" "Nixpkgs")
+    (lib.cmakeBool "DISTRIBUTOR_DEBUGINFO_AVAILABLE" true)
+    (lib.cmakeFeature "INSTALL_QML_PREFIX" qt6.qtbase.qtQmlPrefix)
+    (lib.cmakeFeature "GIT_REVISION" "tag-v${finalAttrs.version}")
+  ];
+
+  cmakeBuildType = "RelWithDebInfo";
+  separateDebugInfo = true;
+  dontStrip = false;
+
+  meta = {
+    homepage = "https://quickshell.outfoxxed.me";
+    description = "Flexbile QtQuick based desktop shell toolkit";
+    license = lib.licenses.lgpl3Only;
+    platforms = lib.platforms.linux;
+    mainProgram = "quickshell";
+    maintainers = with lib.maintainers; [ outfoxxed ];
+  };
+})
@@ -449,11 +449,6 @@
    "version": "2023.2.0",
    "hash": "sha256-Um10fSmO+21I7f+lbzzVq5e8GBijJ9amTvOlt362p1s="
  },
-  {
-    "pname": "LibHac",
-    "version": "0.19.0",
-    "hash": "sha256-FDEmeGHbX/aCFjFbFk8QwO2rTfFizt9UKb+KFDt23hk="
-  },
  {
    "pname": "MicroCom.CodeGenerator.MSBuild",
    "version": "0.11.0",
@@ -804,6 +799,11 @@
    "version": "1.2.0",
    "hash": "sha256-vdDw6YGoyQzv6ustyXP6v7YWUIKEXaZOyUKAaVbRauI="
  },
+  {
+    "pname": "Ryujinx.LibHac",
+    "version": "0.20.0",
+    "hash": "sha256-msrn9BElOOGtQAz6oK3HbMeyLOQ10Xt8wT0Qyr8NwYU="
+  },
  {
    "pname": "Ryujinx.SDL2-CS",
    "version": "2.30.0-build32",
@@ -30,14 +30,14 @@

 buildDotnetModule rec {
  pname = "ryubing";
-  version = "1.3.1";
+  version = "1.3.2";

  src = fetchFromGitLab {
    domain = "git.ryujinx.app";
    owner = "Ryubing";
    repo = "Ryujinx";
    tag = version;
-    hash = "sha256-MFZIFoMc80b2xTjKiHaabToftk3BZUP/Sr/V5q6rjpw=";
+    hash = "sha256-6BCDFd0nU96OgI5lqf4fbyNkG4PS5P4raHVbvBAhB5A=";
  };

  nativeBuildInputs = lib.optional stdenv.hostPlatform.isDarwin [
@@ -5,10 +5,10 @@
 }:
 let
  pname = "snipaste";
-  version = "2.10.7";
+  version = "2.10.8";
  src = fetchurl {
    url = "https://download.snipaste.com/archives/Snipaste-${version}-x86_64.AppImage";
-    hash = "sha256-WzCSI0BfjolbWbj/mLhRj75tW/CvlbzQtFuBizg8xl4=";
+    hash = "sha256-Ieitxc1HPjqBpf7/rREKca+U0srE+q/s8mz+9Vhczk0=";
  };
  contents = appimageTools.extract { inherit pname version src; };
 in
@@ -13,17 +13,17 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "swww";
-  version = "0.10.2";
+  version = "0.10.3";

  src = fetchFromGitHub {
    owner = "LGFae";
    repo = "swww";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-qvxG8UhO7MsS0lWVGfHUsBKevAa+VJe41NrcX1ZCJdU=";
+    hash = "sha256-GXqXZn29r7ktL01KBzlPZ+9b1fdnAPF8qhsQxhiqAsQ=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-Tiszc/COelBRolrrbKpNklk8IVppIhGmxspnTb20LAE=";
+  cargoHash = "sha256-jCjeHeHML8gHtvFcnHbiGL5fZ3LhABhXrcUTQriUDc0=";

  buildInputs = [
    lz4
@@ -12,11 +12,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "tart";
-  version = "2.24.0";
+  version = "2.27.2";

  src = fetchurl {
    url = "https://github.com/cirruslabs/tart/releases/download/${finalAttrs.version}/tart.tar.gz";
-    hash = "sha256-5GBn5jWT3d/PidVvmWgfxGTuk72an6WbtRtR/5XHOzk=";
+    hash = "sha256-KUmNMQGhPk/mWOVYJYQe1jkOTI1H/4yYd/IXle2tO8o=";
  };
  sourceRoot = ".";

@@ -0,0 +1,52 @@
+{
+  lib,
+  python3Packages,
+  fetchFromGitHub,
+  wrapGAppsHook3,
+  gtk3,
+  glib,
+  gsettings-desktop-schemas,
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "trelby";
+  version = "2.4.15";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "trelby";
+    repo = "trelby";
+    tag = version;
+    hash = "sha256-CTasd+YlRHjYUVepZf2RDOuw1p0OdQfJENZamSmXXFw=";
+  };
+
+  build-system = [
+    python3Packages.setuptools
+  ];
+
+  nativeBuildInputs = [
+    wrapGAppsHook3
+  ];
+
+  buildInputs = [
+    glib
+    gsettings-desktop-schemas
+    gtk3
+  ];
+
+  dependencies = with python3Packages; [
+    lxml
+    reportlab
+    wxpython
+  ];
+
+  meta = {
+    description = "Free, multiplatform, feature-rich screenwriting program";
+    homepage = "www.trelby.org";
+    downloadPage = "https://github.com/trelby/trelby";
+    mainProgram = "trelby";
+    license = lib.licenses.gpl2Only;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ isotoxal ];
+  };
+}
@@ -32,13 +32,13 @@

 stdenv.mkDerivation rec {
  pname = "ueberzugpp";
-  version = "2.9.6";
+  version = "2.9.7";

  src = fetchFromGitHub {
    owner = "jstkdng";
    repo = "ueberzugpp";
    rev = "v${version}";
-    hash = "sha256-qo9Rwnx6Oh8DRcCBUMS3JVdNyx1iZSB2Z1qfptUoPFQ=";
+    hash = "sha256-FR05vBKIMbGiOnugkBi8IkLfHU7LzNF2ihxD7FWWYGU=";
  };

  strictDeps = true;
@@ -15,13 +15,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "uxplay";
-  version = "1.72";
+  version = "1.72.1";

  src = fetchFromGitHub {
    owner = "FDH2";
    repo = "UxPlay";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-pS9TgGymQwSDBrhHMQYasJfDchMap49fhHTgxYzq+L4=";
+    hash = "sha256-qb4wsVPdT4rRQxHjLnft0C1D41IhA7M0ZqiLL65r3Ns=";
  };

  postPatch = ''
@@ -66,7 +66,7 @@

 stdenv.mkDerivation rec {
  pname = "vivaldi";
-  version = "7.4.3684.46";
+  version = "7.4.3684.50";

  suffix =
    {
@@ -79,8 +79,8 @@ stdenv.mkDerivation rec {
    url = "https://downloads.vivaldi.com/stable/vivaldi-stable_${version}-1_${suffix}.deb";
    hash =
      {
-        aarch64-linux = "sha256-vcTuqCZy0OlfO5Iz06QVGJRtT3L55wWdmE9R6Y3P1/k=";
-        x86_64-linux = "sha256-uD2CZ4OEZbLIDgl3VGdHwr0edyJd4Gv/C22Z5wQMYk8=";
+        aarch64-linux = "sha256-we9+rJ8hOiMboNmcLlu6V/2Q/1lAwpQ+hu9s+JVXJcI=";
+        x86_64-linux = "sha256-JC/vKl2BU+P6qyU8WhiLoVd4nEG2EYYvwOVPqdVa2Eo=";
      }
      .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
  };
@@ -305,12 +305,13 @@ stdenv.mkDerivation (
          "$mini/lib/perl5/cross_perl/${version}:$out/lib/perl5/${version}:$out/lib/perl5/${version}/$runtimeArch"
      ''; # */

-    meta = with lib; {
+    meta = {
      homepage = "https://www.perl.org/";
      description = "Standard implementation of the Perl 5 programming language";
-      license = licenses.artistic1;
+      license = lib.licenses.artistic1;
      maintainers = [ ];
-      platforms = platforms.all;
+      teams = [ lib.teams.perl ];
+      platforms = lib.platforms.all;
      priority = 6; # in `buildEnv' (including the one inside `perl.withPackages') the library files will have priority over files in `perl`
      mainProgram = "perl";
    };
@@ -1,43 +1,38 @@
 {
  lib,
-  stdenv,
-  fetchFromGitHub,
-  ocaml,
-  findlib,
  easy-format,
+  buildDunePackage,
+  fetchurl,
 }:

-stdenv.mkDerivation rec {
-  pname = "ocaml${ocaml.version}-dum";
-  version = "1.0.1";
+buildDunePackage rec {
+  pname = "dum";
+  version = "1.0.3";

-  src = fetchFromGitHub {
-    owner = "mjambon";
-    repo = "dum";
-    rev = "v${version}";
-    sha256 = "0yrxl97szjc0s2ghngs346x3y0xszx2chidgzxk93frjjpsr1mlr";
+  src = fetchurl {
+    url = "https://github.com/mjambon/dum/releases/download/${version}/dum-${version}.tbz";
+    hash = "sha256-ZFojUD/IoxVTDfGyh2wveFsSz4D19pKkHrNuU+LFJlE=";
  };

  postPatch = ''
    substituteInPlace "dum.ml" \
-    --replace "Lazy.lazy_is_val" "Lazy.is_val" \
-    --replace "Obj.final_tag" "Obj.custom_tag"
+    --replace-fail "Lazy.lazy_is_val" "Lazy.is_val" \
+    --replace-fail "Obj.final_tag" "Obj.custom_tag"
  '';

-  nativeBuildInputs = [
-    ocaml
-    findlib
-  ];
  propagatedBuildInputs = [ easy-format ];

-  strictDeps = true;
-
-  createFindlibDestdir = true;
-
-  meta = with lib; {
+  meta = {
    homepage = "https://github.com/mjambon/dum";
    description = "Inspect the runtime representation of arbitrary OCaml values";
-    license = licenses.lgpl21Plus;
-    maintainers = [ maintainers.alexfmpe ];
+    longDescription = ''
+      Dum is a library for inspecting the runtime representation of
+      arbitrary OCaml values. Shared or cyclic data are detected
+      and labelled. This guarantees that printing would always
+      terminate. This makes it possible to print values such as closures,
+      objects or exceptions in depth and without risk.
+    '';
+    license = lib.licenses.lgpl21Plus;
+    maintainers = with lib.maintainers; [ alexfmpe ];
  };
 }
@@ -20,7 +20,7 @@

 buildPythonPackage rec {
  pname = "authlib";
-  version = "1.5.2";
+  version = "1.6.0";
  pyproject = true;

  disabled = pythonOlder "3.8";
@@ -29,7 +29,7 @@ buildPythonPackage rec {
    owner = "lepture";
    repo = "authlib";
    tag = "v${version}";
-    hash = "sha256-ra1RKprUAqhax0z1osl0lFgFENQZuSW/5FxSmsCdKNY=";
+    hash = "sha256-USZc+IKcg0+aEG2ISx29jTwm8BBuzNqFoZLBpZ7K2DU=";
  };

  build-system = [ setuptools ];
@@ -28,7 +28,7 @@

 buildPythonPackage rec {
  pname = "translate-toolkit";
-  version = "3.15.2";
+  version = "3.15.3";

  pyproject = true;

@@ -36,7 +36,7 @@ buildPythonPackage rec {
    owner = "translate";
    repo = "translate";
    tag = version;
-    hash = "sha256-HZ00ds3MUrtLb6WjxpCch8CPvOuadHJXZsJRQdqge0M=";
+    hash = "sha256-T/bH9qz8UbiDfuL0hkmIN7Pmj/aZLRF+lJSjsUmDXiU=";
  };

  build-system = [ setuptools-scm ];
@@ -77,7 +77,7 @@ buildPythonPackage rec {
  meta = {
    description = "Useful localization tools for building localization & translation systems";
    homepage = "https://toolkit.translatehouse.org/";
-    changelog = "https://docs.translatehouse.org/projects/translate-toolkit/en/latest/releases/${version}.html";
+    changelog = "https://docs.translatehouse.org/projects/translate-toolkit/en/latest/releases/${src.tag}.html";
    license = lib.licenses.gpl2Plus;
    maintainers = with lib.maintainers; [ erictapen ];
  };
@@ -17,13 +17,13 @@
 let
  data = stdenv.mkDerivation (finalAttrs: {
    pname = "path-of-building-data";
-    version = "2.52.3";
+    version = "2.53.0";

    src = fetchFromGitHub {
      owner = "PathOfBuildingCommunity";
      repo = "PathOfBuilding";
      rev = "v${finalAttrs.version}";
-      hash = "sha256-hwluSZGYRMN32dSLIe8Cs6l6R84V5fNCuHYtoc7+b00=";
+      hash = "sha256-LT8EVO/VkwIVF3DbRZiHab5m6TYqhlHDFGai52TBWqo=";
    };

    nativeBuildInputs = [ unzip ];
@@ -27,21 +27,21 @@ let
  # pulling it out of the Git history every few months and checking which files
  # we need to update now is slightly annoying.
  patchGoVersion = ''
-    find . -name go.mod -not -path "./.bingo/*" -not -path "./.citools/*" -print0 | while IFS= read -r -d ''' line; do
+    find . -name go.mod -not -path "./.bingo/*" -print0 | while IFS= read -r -d ''' line; do
      substituteInPlace "$line" \
-        --replace-fail "go 1.24.2" "go 1.24.2"
+        --replace-fail "go 1.24.3" "go 1.24.2"
    done
    find . -name go.work -print0 | while IFS= read -r -d ''' line; do
      substituteInPlace "$line" \
-        --replace-fail "go 1.24.2" "go 1.24.2"
+        --replace-fail "go 1.24.3" "go 1.24.2"
    done
    substituteInPlace Makefile \
-      --replace-fail "GO_VERSION = 1.24.2" "GO_VERSION = 1.24.2"
+      --replace-fail "GO_VERSION = 1.24.3" "GO_VERSION = 1.24.2"
  '';
 in
 buildGoModule rec {
  pname = "grafana";
-  version = "12.0.0+security-01";
+  version = "12.0.1+security-01";

  subPackages = [
    "pkg/cmd/grafana"
@@ -53,7 +53,7 @@ buildGoModule rec {
    owner = "grafana";
    repo = "grafana";
    rev = "v${version}";
-    hash = "sha256-4i9YHhoneptF72F4zvV+KVUJiP8xfiowPJExQ9iteK4=";
+    hash = "sha256-cYEWNXuIrTrtXR3XHqizDJ17QyBYkaccIThSorWO5GA=";
  };

  # borrowed from: https://github.com/NixOS/nixpkgs/blob/d70d9425f49f9aba3c49e2c389fe6d42bac8c5b0/pkgs/development/tools/analysis/snyk/default.nix#L20-L22
@@ -67,14 +67,14 @@ buildGoModule rec {
  missingHashes = ./missing-hashes.json;
  offlineCache = yarn-berry_4.fetchYarnBerryDeps {
    inherit src missingHashes;
-    hash = "sha256-yLrGllct+AGG/u/E2iX2gog1d/iKNfkYu6GV6Pw6nuc=";
+    hash = "sha256-Vjr/jyXqHoM/3o49IDJ2aT1s1tMkP90H+2E+yUiviF4=";
  };

  disallowedRequisites = [ offlineCache ];

  postPatch = patchGoVersion;

-  vendorHash = "sha256-dpLcU4ru/wIsxwYAI1qROtYwHJ2WOJSZpIhd9/qMwZo=";
+  vendorHash = "sha256-Vlao6eNEHtl1+6vAAjDOxINuGxSwAqdi6Hc8oVniTO8=";

  proxyVendor = true;

@@ -53,7 +53,7 @@ postgresqlBuildExtension (finalAttrs: {
    inherit (finalAttrs) finalPackage;
    withPackages = [ "timescaledb_toolkit" ];
    postgresqlExtraSettings = ''
-      shared_preload_libraries='timescaledb,timescaledb_toolkit'
+      shared_preload_libraries='timescaledb'
    '';
    sql = ''
      CREATE EXTENSION timescaledb;
@@ -460,6 +460,7 @@ mapAliases {
  cosmic-tasks = tasks; # Added 2024-07-04
  cpp-ipfs-api = cpp-ipfs-http-client; # Project has been renamed. Added 2022-05-15
  crispyDoom = crispy-doom; # Added 2023-05-01
+  cromite = throw "'cromite' has been removed from nixpkgs due to it not being maintained"; # Added 2025-06-12
  crossLibcStdenv = stdenvNoLibc; # Added 2024-09-06
  crystal_1_2 = throw "'crystal_1_2' has been removed as it is obsolete and no longer used in the tree. Consider using 'crystal' instead"; # Added 2025-02-13
  crystal_1_7 = throw "'crystal_1_7' has been removed as it is obsolete and no longer used in the tree. Consider using 'crystal' instead"; # Added 2025-02-13
@@ -3052,9 +3052,7 @@ with pkgs;
    garage_1_x
    ;

-  gauge-unwrapped = callPackage ../development/tools/gauge { };
-  gauge = callPackage ../development/tools/gauge/wrapper.nix { };
-  gaugePlugins = recurseIntoAttrs (callPackage ../development/tools/gauge/plugins { });
+  gaugePlugins = recurseIntoAttrs (callPackage ../by-name/ga/gauge/plugins { });

  gawd = python3Packages.toPythonApplication python3Packages.gawd;