Merge master into staging-nixos

2026-07-16 18:26:31 +00:00
parent 97316317a7 ab571fccdd
commit 396c3ebf9b
90 changed files with 656 additions and 496 deletions
@@ -6,17 +6,32 @@
 }:
 let
  cfg = config.services.vnstat;
+  settingsFormat = pkgs.formats.keyValue { };
 in
 {
  options.services.vnstat = {
    enable = lib.mkEnableOption "update of network usage statistics via vnstatd";
    package = lib.mkPackageOption pkgs "vnstat" { };
+    settings = lib.mkOption {
+      type = lib.types.submodule { freeformType = settingsFormat.type; };
+      default = { };
+      description = ''
+        Configuration for vnstat. Refer to
+        [https://humdi.net/vnstat/man/vnstat.conf.html]
+        or {manpage}`vnstat.conf(5)` for more information.
+      '';
+      example = {
+        AlwaysAddNewInterfaces = 1;
+      };
+    };
  };

  config = lib.mkIf cfg.enable {

    environment.systemPackages = [ cfg.package ];

+    environment.etc."vnstat.conf".source = settingsFormat.generate "vnstat.conf" cfg.settings;
+
    users = {
      groups.vnstatd = { };

@@ -59,4 +74,8 @@ in
      };
    };
  };
+
+  meta = {
+    maintainers = with lib.maintainers; [ hmenke ];
+  };
 }
@@ -44,7 +44,7 @@ in
    settings = mkOption {
      description = ''
        Headplane configuration options. Generates a YAML config file.
-        See: https://github.com/tale/headplane/blob/main/config.example.yaml
+        See <https://github.com/tale/headplane/blob/main/config.example.yaml>.
      '';
      type = types.submodule {
        options = {
@@ -129,6 +129,16 @@ in
          headscale = mkOption {
            type = types.submodule {
              options = {
+                api_key_path = mkOption {
+                  type = types.nullOr types.path;
+                  default = null;
+                  description = ''
+                    Path to a file containing a Headscale API key.
+                    This is required for OIDC authentication aswell for the Headplane agent.
+                  '';
+                  example = lib.literalExpression "config.sops.secrets.headplane_pre_authkey.path";
+                };
+
                url = mkOption {
                  type = types.str;
                  default = "http://127.0.0.1:${toString config.services.headscale.port}";
@@ -211,15 +221,6 @@ in
                          '';
                        };

-                        pre_authkey_path = mkOption {
-                          type = types.nullOr types.path;
-                          default = null;
-                          description = ''
-                            Path to a file containing a Headscale pre-auth key for the agent.
-                          '';
-                          example = lib.literalExpression "config.sops.secrets.headplane_pre_authkey.path";
-                        };
-
                        executable_path = mkOption {
                          type = types.path;
                          readOnly = true;
@@ -237,20 +238,14 @@ in
                        };

                        cache_ttl = mkOption {
-                          type = types.nullOr types.int;
-                          default = null;
+                          type = types.ints.positive;
+                          default = 180000;
                          description = ''
-                            Deprecated cache TTL for the agent. This option is accepted
-                            by Headplane 0.6.2 but has no effect.
+                            How long to cache agent information (in milliseconds).
+                            If you want data to update faster, reduce the TTL, but this will increase the frequency of requests to Headscale.
                          '';
                        };

-                        cache_path = mkOption {
-                          type = types.path;
-                          default = "/var/lib/headplane/agent_cache.json";
-                          description = "The path to store the agent's cache.";
-                        };
-
                        work_dir = mkOption {
                          type = types.path;
                          default = "/var/lib/headplane/agent";
@@ -325,16 +320,6 @@ in
                    example = lib.literalExpression "config.sops.secrets.oidc_client_secret.path";
                  };

-                  headscale_api_key_path = mkOption {
-                    type = types.nullOr types.path;
-                    default = null;
-                    description = ''
-                      Path to a file containing the Headscale API key.
-                      Required for OIDC authentication.
-                    '';
-                    example = lib.literalExpression "config.sops.secrets.headscale_api_key.path";
-                  };
-
                  disable_api_key_login = mkOption {
                    type = types.bool;
                    default = false;
@@ -366,25 +351,6 @@ in
                    '';
                  };

-                  redirect_uri = mkOption {
-                    type = types.nullOr types.str;
-                    default = null;
-                    description = ''
-                      Deprecated OIDC redirect URI. Use services.headplane.settings.server.base_url
-                      instead; Headplane derives the callback URL from it.
-                    '';
-                    example = "https://headplane.example.com/admin/oidc/callback";
-                  };
-
-                  strict_validation = mkOption {
-                    type = types.nullOr types.bool;
-                    default = null;
-                    description = ''
-                      Deprecated OIDC validation setting. This option is accepted
-                      by Headplane 0.6.2 but has no effect.
-                    '';
-                  };
-
                  profile_picture_source = mkOption {
                    type = types.enum [
                      "oidc"
@@ -429,16 +395,6 @@ in
                    description = "Custom userinfo endpoint URL.";
                    example = "https://provider.example.com/userinfo";
                  };
-
-                  user_storage_file = mkOption {
-                    type = types.nullOr types.path;
-                    default = null;
-                    description = ''
-                      Deprecated path to the pre-0.6.2 JSON user database.
-                      Headplane uses this once to migrate users into its internal database.
-                    '';
-                    example = "/var/lib/headplane/users.json";
-                  };
                };
              }
            );
@@ -452,33 +408,6 @@ in
  };

  config = mkIf cfg.enable {
-    warnings =
-      lib.optionals (cfg.settings.oidc != null && cfg.settings.oidc.redirect_uri != null) [
-        ''
-          services.headplane.settings.oidc.redirect_uri is deprecated by Headplane 0.6.2.
-          Use services.headplane.settings.server.base_url instead; Headplane derives
-          the OIDC callback URL from it.
-        ''
-      ]
-      ++ lib.optionals (cfg.settings.oidc != null && cfg.settings.oidc.strict_validation != null) [
-        ''
-          services.headplane.settings.oidc.strict_validation is deprecated and has no effect
-          in Headplane 0.6.2.
-        ''
-      ]
-      ++ lib.optionals (cfg.settings.oidc != null && cfg.settings.oidc.user_storage_file != null) [
-        ''
-          services.headplane.settings.oidc.user_storage_file is deprecated. Headplane 0.6.2
-          uses it only to migrate the pre-0.6.2 JSON user database into the internal database.
-        ''
-      ]
-      ++ lib.optionals (agentSettings != null && agentSettings.cache_ttl != null) [
-        ''
-          services.headplane.settings.integration.agent.cache_ttl is deprecated and has no
-          effect in Headplane 0.6.2.
-        ''
-      ];
-
    assertions = [
      {
        assertion = config.services.headscale.enable;
@@ -502,26 +431,25 @@ in
        '';
      }
      {
-        assertion = cfg.settings.oidc == null || cfg.settings.oidc.headscale_api_key_path != null;
+        assertion = cfg.settings.oidc == null || cfg.settings.headscale.api_key_path != null;
        message = ''
-          services.headplane.settings.oidc.headscale_api_key_path must be set
-          when services.headplane.settings.oidc is non-null. Headplane's OIDC
-          flow requires a Headscale API key to mint sessions.
+          services.headplane.settings.headscale.api_key_path must be set
+          when services.headplane.settings.oidc is non-null.
+          Headplane's OIDC flow requires a Headscale API key to mint sessions.
        '';
      }
      {
        assertion =
-          agentSettings == null || !agentSettings.enabled || agentSettings.pre_authkey_path != null;
+          agentSettings == null || !agentSettings.enabled || cfg.settings.headscale.api_key_path != null;
        message = ''
-          services.headplane.settings.integration.agent.pre_authkey_path must be set
-          when the agent is enabled.
+          services.headplane.settings.headscale.api_key_path must be set when the agent is enabled.
        '';
      }
    ];

    environment = {
      systemPackages = [ cfg.package ];
-      etc."headplane/config.yaml".source = "${settingsFile}";
+      etc."headplane/config.yaml".source = settingsFile;
    };

    systemd.services.headplane = {
@@ -534,6 +462,7 @@ in
        config.systemd.services.headscale.name
      ];
      requires = [ config.systemd.services.headscale.name ];
+      restartTriggers = [ settingsFile ];

      environment = {
        HEADPLANE_DEBUG_LOG = toString cfg.debug;
@@ -1844,6 +1844,7 @@ in
  };
  virtualbox = handleTestOn [ "x86_64-linux" ] ./virtualbox.nix { };
  vm-variant = handleTest ./vm-variant.nix { };
+  vnstat = runTest ./vnstat.nix;
  vscode-remote-ssh = handleTestOn [ "x86_64-linux" ] ./vscode-remote-ssh.nix { };
  vscodium = import ./vscodium.nix { inherit runTest; };
  vsftpd = runTest ./vsftpd.nix;
@@ -0,0 +1,26 @@
+{ lib, ... }:
+{
+  name = "vnstat";
+  meta.maintainers = with lib.maintainers; [ hmenke ];
+
+  containers.machine = {
+    services.vnstat = {
+      enable = true;
+      settings = {
+        AlwaysAddNewInterfaces = 1;
+      };
+    };
+  };
+
+  testScript = ''
+    start_all()
+
+    machine.wait_for_unit("vnstat.service")
+
+    machine.succeed("vnstat --iflist")
+    machine.fail("vnstat -i dummy0")
+    machine.succeed("ip link add dummy0 type dummy")
+    machine.succeed("ip link set dummy0 up")
+    machine.wait_until_succeeds("vnstat -i dummy0", timeout=10)
+  '';
+}
@@ -21,22 +21,22 @@ vscode-utils.buildVscodeMarketplaceExtension (finalAttrs: {
      sources = {
        "x86_64-linux" = {
          arch = "linux-x64";
-          hash = "sha256-uWghjE/Ue+i2kUD4KedN4NDTllgiZPMFFXbT0RQnGrE=";
+          hash = "sha256-JswgBhADhoEUug2h1ZZ7OtFjFUVgCxiqIaWCYCMf+Sw=";
        };
        "aarch64-linux" = {
          arch = "linux-arm64";
-          hash = "sha256-pIwEx6+1Wc+MazqJQYA4h9oOqNOOA8MyJcJOd9Bx2ZM=";
+          hash = "sha256-+TBwLHUsPx+TiFP+5Gg59Yii76IERNbBQT3RLidogSo=";
        };
        "aarch64-darwin" = {
          arch = "darwin-arm64";
-          hash = "sha256-Iq5C55YrV5ud74a218pTPIyq1oJisbDRNNefkzjpGs4=";
+          hash = "sha256-Xglh5yLP4QoeMxqqUUAJyuyehN9hdDookhjwU6znRX4=";
        };
      };
    in
    {
      name = "claude-code";
      publisher = "anthropic";
-      version = "2.1.210";
+      version = "2.1.211";
    }
    // sources.${stdenvNoCC.hostPlatform.system}
      or (throw "Unsupported system ${stdenvNoCC.hostPlatform.system}");
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "snes9x";
-  version = "0-unstable-2026-07-05";
+  version = "0-unstable-2026-07-13";

  src = fetchFromGitHub {
    owner = "snes9xgit";
    repo = "snes9x";
-    rev = "51ef0275df25fc6347d241e3b5325b52b6e96582";
-    hash = "sha256-+f6u8VUHNLI9pb2AFLyEoGQtGzNIkeWS2wvF9PYDIm8=";
+    rev = "b5cc7651f9fc02189cb51b5a43848877db5aec42";
+    hash = "sha256-htwL5m49J+ku7h79Eu4y74LKiHkbL3UE3+LAXE52ZY8=";
  };

  makefile = "Makefile";
@@ -38,14 +38,14 @@

 python3.pkgs.buildPythonApplication (finalAttrs: {
  pname = "gajim";
-  version = "2.4.7.1";
+  version = "2.5.0";

  src = fetchFromGitLab {
    domain = "dev.gajim.org";
    owner = "gajim";
    repo = "gajim";
-    tag = "${finalAttrs.version}+win";
-    hash = "sha256-/X2Xp1ZnPLTZc1Hf4Kp6R/+mezU6qoUhaT9OskYlnOY=";
+    tag = finalAttrs.version;
+    hash = "sha256-3/HQNizXLjeQpCdEK14LMflyNUKF1BI8eli3BGxiH40=";
  };

  pyproject = true;
@@ -55,11 +55,11 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
    adwaita-icon-theme
    gtksourceview5
    glib-networking
+    gstreamer
+    gst-plugins-base
  ]
  ++ lib.optionals enableJingle [
    farstream
-    gstreamer
-    gst-plugins-base
    gst-libav
    gst-plugins-good
    libnice
@@ -0,0 +1,18 @@
+{ lib, ocamlPackages }:
+
+let
+  inherit (ocamlPackages) buildDunePackage libabsolute;
+in
+
+buildDunePackage {
+  pname = "absolute";
+  inherit (libabsolute) src version;
+
+  __structuredAttrs = true;
+
+  buildInputs = [ libabsolute ];
+
+  meta = libabsolute.meta // {
+    description = "A constraint solver based on abstract domains from the theory of abstract interpretation";
+  };
+}
@@ -9,18 +9,21 @@

 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "afew";
-  version = "3.0.1";
+  version = "4.0.1";
  pyproject = true;

  src = fetchPypi {
    inherit (finalAttrs) pname version;
-    sha256 = "0wpfqbqjlfb9z0hafvdhkm7qw56cr9kfy6n8vb0q42dwlghpz1ff";
+    hash = "sha256-LPKSD4aMAREtf5Y4A9oa6Sh5lv/uuLpamcP35SBgA/M=";
  };

-  nativeBuildInputs = with python3Packages; [
-    sphinxHook
-    setuptools_80
-    setuptools-scm
+  build-system = [
+    python3Packages.setuptools
+    python3Packages.setuptools-scm
+  ];
+
+  nativeBuildInputs = [
+    python3Packages.sphinxHook
  ];

  sphinxBuilders = [
@@ -28,11 +31,10 @@ python3Packages.buildPythonApplication (finalAttrs: {
    "man"
  ];

-  propagatedBuildInputs = with python3Packages; [
-    chardet
-    dkimpy
-    notmuch
-    setuptools
+  dependencies = [
+    python3Packages.chardet
+    python3Packages.dkimpy
+    python3Packages.notmuch2
  ];

  nativeCheckInputs = [
@@ -7,13 +7,13 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "alacritty-theme";
-  version = "0-unstable-2026-06-12";
+  version = "0-unstable-2026-07-10";

  src = fetchFromGitHub {
    owner = "alacritty";
    repo = "alacritty-theme";
-    rev = "659d2e1d669cd5722f11e58c44fd45dc26a6ffcd";
-    hash = "sha256-1GMpnDdfzBIMm9fzQjxYgLNUGA3amvGYgO3VRcd49ro=";
+    rev = "03cce642656759f440c97bb99ce65fc1c5b064a1";
+    hash = "sha256-JfvBUsmw3lRxOj2lb9yVmkRwfUpjJwjBujwztoXtgMY=";
    sparseCheckout = [ "themes" ];
  };

@@ -11,16 +11,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "biome";
-  version = "2.5.0";
+  version = "2.5.4";

  src = fetchFromGitHub {
    owner = "biomejs";
    repo = "biome";
    rev = "@biomejs/biome@${finalAttrs.version}";
-    hash = "sha256-d8MhD749rkLWeCKDBxhw2aF3G09h8kug5w2Q40JSkt4=";
+    hash = "sha256-x8oMtugVmN8Z7obBsiZxLZ5Ikj/oGPXEgg/8M8dsRvc=";
  };

-  cargoHash = "sha256-z1KgScoH9retj0qNd6eOTjejjQypfVkha0ae71Z6TSg=";
+  cargoHash = "sha256-yV+lvPLPGtWCtbA39NVH1T1Sl1qn1MTsQIVRo3c9+Dg=";

  nativeBuildInputs = [ pkg-config ];

@@ -8,15 +8,15 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cargo-shear";
-  version = "1.13.1";
+  version = "1.13.2";

  src = fetchCrate {
    pname = "cargo-shear";
    version = finalAttrs.version;
-    hash = "sha256-Luf6/kG0MgnBDyMLZGUSadPI60DOx5Jra3I3ezOGM4w=";
+    hash = "sha256-69OwhT4vc4xwvuVxZ0C7F/Us01TsuYJnnTKT6PHsOF8=";
  };

-  cargoHash = "sha256-d+3ZfygD4CzHLgT45KcCw2rr313eVO7PhGZpgJpbxW8=";
+  cargoHash = "sha256-x0lZ8E/P9IaPSdzUo2O3t5qR2I3959So9uaAm4PBM4E=";

  env = {
    # https://github.com/Boshen/cargo-shear/blob/v1.6.2/src/lib.rs#L51-L54
@@ -1,13 +0,0 @@
-diff --git a/src/lib_ccx/hardsubx.c b/src/lib_ccx/hardsubx.c
-index 20b4388..fa6b5fa 100644
--- a/src/lib_ccx/hardsubx.c
-+++ b/src/lib_ccx/hardsubx.c
-@@ -125,7 +125,7 @@ int hardsubx_process_data(struct lib_hardsubx_ctx *ctx, struct lib_ccx_ctx *ctx_
- 	if (ctx->frame)
- 		av_frame_free(&ctx->frame);
- 	if (ctx->rgb_frame)
- 		av_frame_free(&ctx->rgb_frame);
-	avcodec_close(ctx->codec_ctx);
-+	avcodec_free_context(&ctx->codec_ctx);
- 	avformat_close_input(&ctx->format_ctx);
- }
@@ -31,24 +31,17 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "ccextractor";
-  version = "0.94-unstable-2025-05-20";
+  version = "0.96.6";

  src = fetchFromGitHub {
    owner = "CCExtractor";
    repo = "ccextractor";
-    rev = "407d0f4e93611c5b0ceb14b7fc01d4a4c2e90433";
-    hash = "sha256-BfsQmCNB4HRafqJ3pC2ECiwhOgwKuIqiLjr2/bvHr7Q=";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-nvfQX+1pM16ll7ruXcB22fWn2zQvmpUzKhD3vznEcbI=";
  };

  patches = [
-    ./remove-default-commit-hash.patch
    ./remove-vendored-libraries.patch
-    ./fix-avcodec-close.patch
-    (fetchpatch {
-      name = "CVE-2026-2245.patch";
-      url = "https://github.com/CCExtractor/ccextractor/commit/fd7271bae238ccb3ae8a71304ea64f0886324925.patch";
-      hash = "sha256-wZiJob5v4SVa5YBmiHuNvgphSi4PhTTb3hg4vs1lhVg=";
-    })
  ]
  ++ finalAttrs.cargoDeps.vendorStaging.patches;

@@ -58,8 +51,7 @@ stdenv.mkDerivation (finalAttrs: {

  cargoDeps = rustPlatform.fetchCargoVendor {
    inherit (finalAttrs) src cargoRoot;
-    patches = [ ./use-rsmpeg-0.15.patch ];
-    hash = "sha256-68Y8nzPHxhVIRHoPXOy9tc71177lCBuOf//z3cqyDGQ=";
+    hash = "sha256-0FPxU3rUoT3/Xy3mQjjQGmxkNjs++sQxjCJ1/UuRQlc=";
  };

  nativeBuildInputs = [
@@ -94,10 +86,6 @@ stdenv.mkDerivation (finalAttrs: {
    # The tests are all part of one `cargo test` invocation, so let’s
    # get the output from it.
    (lib.cmakeFeature "CMAKE_CTEST_ARGUMENTS" "--verbose")
-
-    # TODO: This (and the corresponding patch) should probably be
-    # removed for the next stable release.
-    (lib.cmakeFeature "GIT_COMMIT_HASH" finalAttrs.src.rev)
  ]
  ++ lib.optionals enableOcr [
    (lib.cmakeBool "WITH_OCR" true)
@@ -140,7 +128,7 @@ stdenv.mkDerivation (finalAttrs: {

  postPatch = lib.optionalString enableOcr ''
    substituteInPlace src/lib_ccx/ocr.c \
-      --replace-fail 'getenv("TESSDATA_PREFIX")' '"${tesseract}/share"'
+      --replace-fail 'getenv("TESSDATA_PREFIX")' '"${tesseract}/share/"'
  '';

  meta = {
@@ -1,14 +0,0 @@
-diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
-index d7fdda02e3...2738cab631 100644
--- a/src/CMakeLists.txt
-+++ b/src/CMakeLists.txt
-@@ -24,9 +24,6 @@
-             OUTPUT_VARIABLE GIT_COMMIT_HASH
-             OUTPUT_STRIP_TRAILING_WHITESPACE
-     )
-ELSE(EXISTS "${BASE_PROJ_DIR}/.git")
-    set(GIT_BRANCH "Unknown")
-    set(GIT_COMMIT_HASH "Unknown")
- ENDIF(EXISTS "${BASE_PROJ_DIR}/.git")
- 
- #Get the date
@@ -1,13 +1,12 @@
 diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
-index 2738cab631...5bb2b7d17a 100644
+index 95e27199..a1695a3f 100644
 --- a/src/CMakeLists.txt
 +++ b/src/CMakeLists.txt
-@@ -48,93 +48,20 @@
+@@ -49,74 +49,14 @@ endif()
 include_directories(${PROJECT_SOURCE_DIR})
 include_directories(${PROJECT_SOURCE_DIR}/lib_ccx)
 include_directories(${PROJECT_SOURCE_DIR}/lib_ccx/zvbi)
 -include_directories(${PROJECT_SOURCE_DIR}/thirdparty)
-include_directories(${PROJECT_SOURCE_DIR}/thirdparty/protobuf-c)
 include_directories(${PROJECT_SOURCE_DIR}/thirdparty/lib_hash)
 -include_directories(${PROJECT_SOURCE_DIR}/thirdparty/libpng)
 
@@ -27,13 +26,11 @@ index 2738cab631...5bb2b7d17a 100644
 -include_directories(${PROJECT_SOURCE_DIR}/thirdparty/freetype/include)
 aux_source_directory(${PROJECT_SOURCE_DIR}/thirdparty/lib_hash/ SOURCEFILE)
 -aux_source_directory(${PROJECT_SOURCE_DIR}/thirdparty/libpng/ SOURCEFILE)
-aux_source_directory(${PROJECT_SOURCE_DIR}/thirdparty/protobuf-c/ SOURCEFILE)
 -aux_source_directory(${PROJECT_SOURCE_DIR}/thirdparty/zlib/ SOURCEFILE)
 aux_source_directory(${PROJECT_SOURCE_DIR}/lib_ccx/zvbi/ SOURCEFILE)
 
 -set(UTF8PROC_SOURCE ${PROJECT_SOURCE_DIR}/thirdparty/utf8proc/utf8proc.c)
-+set(UTF8PROC_SOURCE)
- 
+-
 -set(FREETYPE_SOURCE
 -        ${PROJECT_SOURCE_DIR}/thirdparty/freetype/autofit/autofit.c
 -        ${PROJECT_SOURCE_DIR}/thirdparty/freetype/base/ftbase.c
@@ -77,10 +74,13 @@ index 2738cab631...5bb2b7d17a 100644
 -        ${PROJECT_SOURCE_DIR}/thirdparty/freetype/type42/type42.c
 -        ${PROJECT_SOURCE_DIR}/thirdparty/freetype/winfonts/winfnt.c
 -        )
+set(UTF8PROC_SOURCE)
+
 +set(FREETYPE_SOURCE)
 #Windows specific libraries and linker flags
 if(WIN32)
-     include_directories ("${PROJECT_SOURCE_DIR}/thirdparty/win_spec_incld/")
+     if(NOT MINGW)
+@@ -125,17 +65,6 @@ if(WIN32)
     include_directories ("${PROJECT_SOURCE_DIR}/thirdparty/win_iconv/")
     aux_source_directory ("${PROJECT_SOURCE_DIR}/thirdparty/win_iconv/" SOURCEFILE)
     set (EXTRA_LIBS ${EXTRA_LIBS} ws2_32 winmm Bcrypt)
@@ -98,21 +98,11 @@ index 2738cab631...5bb2b7d17a 100644
 endif(WIN32)
 
 if(MSVC)
-@@ -212,9 +139,6 @@
-   pkg_check_modules (NANOMSG REQUIRED libnanomsg)
-   set (EXTRA_LIBS ${EXTRA_LIBS} ${NANOMSG_STATIC_LIBRARIES})
- 
-  include_directories ("${PROJECT_SOURCE_DIR}/thirdparty/protobuf-c/")
-  aux_source_directory ("${PROJECT_SOURCE_DIR}/thirdparty/protobuf-c/" SOURCEFILE)
-
-   set (CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -DENABLE_SHARING")
- endif (PKG_CONFIG_FOUND AND WITH_SHARING)
- 
 diff --git a/src/lib_ccx/CMakeLists.txt b/src/lib_ccx/CMakeLists.txt
-index 4f329bcaab...a334d20c4d 100644
+index a891560b..154c1c15 100644
 --- a/src/lib_ccx/CMakeLists.txt
 +++ b/src/lib_ccx/CMakeLists.txt
-@@ -13,9 +13,39 @@
+@@ -13,9 +13,39 @@ endif(WIN32)
 find_package(PkgConfig)
 pkg_check_modules (GPAC REQUIRED gpac)
 
@@ -152,16 +142,16 @@ index 4f329bcaab...a334d20c4d 100644
 if (WITH_FFMPEG)
     find_package(PkgConfig)
 
-@@ -94,7 +124,7 @@
-     set (CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -DDISABLE_RUST")
- endif (WITHOUT_RUST)
+@@ -87,7 +117,7 @@ if (WITH_HARDSUBX)
+     set (CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -DENABLE_HARDSUBX")
+ endif (WITH_HARDSUBX)
 
 -file (GLOB HeaderFiles *.h)
 +file (GLOB_RECURSE HeaderFiles *.h)
 file (WRITE ccx.pc "prefix=${CMAKE_INSTALL_PREFIX}\n"
                   "includedir=\${prefix}/include\n"
                   "libdir=\${prefix}/lib\n\n"
-@@ -102,8 +132,8 @@
+@@ -95,8 +125,8 @@ file (WRITE ccx.pc "prefix=${CMAKE_INSTALL_PREFIX}\n"
                   "Description: Closed Caption Extraction library\n"
                   "Version: 0.75\n"
                   "Cflags: -I\${includedir}/\n"
@@ -172,16 +162,3 @@ index 4f329bcaab...a334d20c4d 100644
                   )
 
 install (TARGETS ccx DESTINATION lib)
-diff --git a/src/lib_ccx/params.c b/src/lib_ccx/params.c
-index eb1562e50c...984070a285 100644
--- a/src/lib_ccx/params.c
-+++ b/src/lib_ccx/params.c
-@@ -14,7 +14,7 @@
- #include "../lib_hash/sha2.h"
- #include <string.h>
- #include <stdio.h>
-#include <utf8proc/utf8proc.h>
-+#include <utf8proc.h>
- 
- #ifdef ENABLE_OCR
- #include <tesseract/capi.h>
@@ -1,42 +0,0 @@
-diff --git a/src/rust/Cargo.lock b/src/rust/Cargo.lock
-index 5c49573775..3e855aa637 100644
--- a/src/rust/Cargo.lock
-+++ b/src/rust/Cargo.lock
-@@ -665,11 +665,10 @@
- 
- [[package]]
- name = "rsmpeg"
-version = "0.14.2+ffmpeg.6.1"
-+version = "0.15.1+ffmpeg.7.0"
- source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "927012cd6ae43519f519741f4a69602ce3a47cf84750784da124dffd03527cc0"
-+checksum = "d3ffbead667d06e0c77c4363f83d49a3481cc3838bc9a61882aa07b01e3f63e1"
- dependencies = [
- "libc",
-  "paste",
-  "rusty_ffmpeg",
-  "thiserror",
-@@ -711,9 +710,9 @@
- 
- [[package]]
- name = "rusty_ffmpeg"
-version = "0.13.3+ffmpeg.6.1"
-+version = "0.14.1+ffmpeg.7.0"
- source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "716adffa5f909c8533611b1dab9ab5666bece35687845865b75ed6a990fc239c"
-+checksum = "40f4db8e3e23d4a3044d53a41aba5324eae70d3e7fe82375ce833521533bc315"
- dependencies = [
-  "bindgen 0.69.4",
-  "camino",
-diff --git a/src/rust/Cargo.toml b/src/rust/Cargo.toml
-index 4c1e73dcf0..68502915dc 100644
--- a/src/rust/Cargo.toml
-+++ b/src/rust/Cargo.toml
-@@ -15,7 +15,7 @@
- env_logger = "0.8.4"
- palette = "0.6.1"
-rsmpeg = { version = "0.14.2", optional = true, features = [
-+rsmpeg = { version = "0.15.1", optional = true, features = [
-     "link_system_ffmpeg",
- ] }
- tesseract-sys = { version = "0.5.15", optional = true, default-features = false }
@@ -1,47 +1,47 @@
 {
-  "version": "2.1.210",
-  "commit": "88e9fbf39bf4efa5bca44549b7fd9461628657e6",
-  "buildDate": "2026-07-14T15:12:31Z",
+  "version": "2.1.211",
+  "commit": "17a4b6d7b2ee1936b95e595054c7e7d38fddafb7",
+  "buildDate": "2026-07-15T16:42:49Z",
  "platforms": {
    "darwin-arm64": {
      "binary": "claude",
-      "checksum": "1b471d62d1117482689d75447f5e050c640da717a5a3c91e6c13792450f8c662",
-      "size": 241509968
+      "checksum": "5a728a76198b6eca7f3c7cdbff43bab44b77b48c2108f7a3107d889773382629",
+      "size": 242445680
    },
    "darwin-x64": {
      "binary": "claude",
-      "checksum": "892f2c878050d8829e67119328dd9768345fba18a58c169212b70597c9175c40",
-      "size": 251025552
+      "checksum": "33049eb14cf4702b992b7eda41ec077fc6e76539f7fd046e6d32538757235da4",
+      "size": 251966736
    },
    "linux-arm64": {
      "binary": "claude",
-      "checksum": "84feb193c1d91f3b5eba836ed47c0e4dee953195abba950917c3e101eff174e8",
-      "size": 257932016
+      "checksum": "1fff7e8f947c07b19d10b1fbf714b7e547e9536253b9b58230d8adbc4624f867",
+      "size": 258849520
    },
    "linux-x64": {
      "binary": "claude",
-      "checksum": "e7d2ceb53ed4c2ced1fe7fc1c6331c98dc5f7b4c9b2722d9c5fa3dd5dff6f719",
-      "size": 261081912
+      "checksum": "8272c8a474ac9ea1bc35f19b9f7c7e7dc4dc4eb6d5ad3e484b19335ac72446b2",
+      "size": 262023992
    },
    "linux-arm64-musl": {
      "binary": "claude",
-      "checksum": "17f617e24a05533cea8a344f44f0a25b6fb20ee467500601c3cd8392064ec528",
-      "size": 251180216
+      "checksum": "ca094a85ea464b2ebec2ecfcc9e2c056573d4ca95ebe12ffae2c7dccb722e17b",
+      "size": 252097720
    },
    "linux-x64-musl": {
      "binary": "claude",
-      "checksum": "03012f856faa1a9409d9add13936794f168e530c9746c8a099dec6ce8415c32b",
-      "size": 255742336
+      "checksum": "c99bd7934ac841d5be6ee7d3644cb63bccef2cd495c6c1bb982a1b1deac1b466",
+      "size": 256680320
    },
    "win32-x64": {
      "binary": "claude.exe",
-      "checksum": "29aa99c436f0d4125780691123b756176d83b59cc7d492304cd4694292d3f04f",
-      "size": 252385952
+      "checksum": "3d8509ae7de11d77dbdc711aa320fc6d5064ce795464a8670696611b57093caf",
+      "size": 253293728
    },
    "win32-arm64": {
      "binary": "claude.exe",
-      "checksum": "4a603da0a33d49478e55938898ddd06c4ec5d1ec7f443d92dd4352665faaef05",
-      "size": 246736544
+      "checksum": "a0f9bab0dbdda9b43a8765d54e329e44484d9dd7d4f40cf31db6eee27a2da41c",
+      "size": 247643808
    }
  },
  "sdkCompat": {
@@ -5,13 +5,13 @@
 }:
 buildGoModule (finalAttrs: {
  pname = "cntb";
-  version = "1.6";
+  version = "1.7";

  src = fetchFromGitHub {
    owner = "contabo";
    repo = "cntb";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-si6mJ5jHGrgnKp0NP92iFOtGf8x8LG7fqnGccBKXThI=";
+    hash = "sha256-FR55cvsEEKR+zdvHrJWtmIv/fUn2nAY7JKd2DUlhb4M=";
    # docs contains two files with the same name but different cases,
    # this leads to a different hash on case insensitive filesystems (e.g. darwin)
    # https://github.com/contabo/cntb/issues/34
@@ -22,7 +22,7 @@ buildGoModule (finalAttrs: {

  subPackages = [ "." ];

-  vendorHash = "sha256-W1087nbI6Gd9uy8HPTlms6mXfmj/IzcGIW2AXYRBQG4=";
+  vendorHash = "sha256-uM7RaVF95WsNok3W7smfX952+Ojl2saGO41QRIFG824=";

  ldflags = [
    "-X contabo.com/cli/cntb/cmd.version=${finalAttrs.src.rev}"
@@ -2,7 +2,20 @@
  lib,
  python3Packages,
  fetchFromGitHub,
+  fetchPypi,
 }:
+let
+  # Due to bug:
+  # https://github.com/codecov/codecov-cli/issues/721
+  click_8_2 = python3Packages.click.overridePythonAttrs (old: rec {
+    version = "8.2.1";
+    src = fetchPypi {
+      pname = "click";
+      inherit version;
+      hash = "sha256-J8SRzAXZaNJx1aHbE+O1oYRjbZ2TDxSMULA48NBkYgI=";
+    };
+  });
+in

 python3Packages.buildPythonApplication rec {
  pname = "codecov-cli";
@@ -21,12 +34,11 @@ python3Packages.buildPythonApplication rec {
  build-system = with python3Packages; [ setuptools ];

  pythonRelaxDeps = [
-    "click"
    "responses"
  ];

  dependencies = with python3Packages; [
-    click
+    click_8_2
    ijson
    pyyaml
    responses
@@ -72,13 +72,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "freerdp";
-  version = "3.27.1";
+  version = "3.29.0";

  src = fetchFromGitHub {
    owner = "FreeRDP";
    repo = "FreeRDP";
    tag = finalAttrs.version;
-    hash = "sha256-4U3QC1hka+qTQ0F7GqKPiMVwkkFeJvbjNtom5A7V/Sg=";
+    hash = "sha256-LTRV1vRTMR8015iFXZIEjz6ApN5kg1+T2nGZWJ873zY=";
  };

  postPatch = ''
@@ -9,7 +9,7 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "function-runner";
-  version = "9.2.0";
+  version = "9.2.1";

  __structuredAttrs = true;

@@ -17,10 +17,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
    owner = "Shopify";
    repo = "function-runner";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-+y4XQ4Oq4RdAMAD2mNtBAVb+8TqDbCNalXNo56UUOD4=";
+    hash = "sha256-IhlQEeKGWcE2lVhcLbOqUQU+DboxMDc/9eDlzlfcprg=";
  };

-  cargoHash = "sha256-2XkfABzi55J/uO/2zO5QLLNx8pIb+YqowNPdJeMNdDI=";
+  cargoHash = "sha256-mf1kIDsNIk5oXIuvki9zt3D7qJOUtPOvDC8jbLjCMtE=";

  nativeBuildInputs = [
    pkg-config
@@ -2,13 +2,30 @@
  lib,
  python3,
  fetchFromGitHub,
+  fetchPypi,
  sdcc,
  yosys,
  icestorm,
  nextpnr,
 }:

-python3.pkgs.buildPythonApplication rec {
+let
+  # glasgow uses importlib_resources' open_text(), removed in 7.x; pin it to 6.x.
+  pythonPackages = python3.pkgs.overrideScope (
+    final: prev: {
+      importlib-resources = prev.importlib-resources.overridePythonAttrs (old: rec {
+        version = "6.5.2";
+        src = fetchPypi {
+          pname = "importlib_resources";
+          inherit version;
+          hash = "sha256-GF+Hre9bzCiESdmPtPugfOp4vANkVd1ExfxKL+eP7Sw=";
+        };
+        doCheck = false;
+      });
+    }
+  );
+in
+pythonPackages.buildPythonApplication rec {
  pname = "glasgow";
  version = "0-unstable-2025-12-22";
  # Similar to `pdm show`, but without the commit counter
@@ -36,10 +53,10 @@ python3.pkgs.buildPythonApplication rec {
  ];

  build-system = [
-    python3.pkgs.pdm-backend
+    pythonPackages.pdm-backend
  ];

-  dependencies = with python3.pkgs; [
+  dependencies = with pythonPackages; [
    aiohttp
    amaranth
    cobs
@@ -54,7 +71,7 @@ python3.pkgs.buildPythonApplication rec {

  nativeCheckInputs = [
    # pytestCheckHook discovers way less tests
-    python3.pkgs.unittestCheckHook
+    pythonPackages.unittestCheckHook
    icestorm
    nextpnr
    yosys
@@ -67,10 +84,10 @@ python3.pkgs.buildPythonApplication rec {
  __darwinAllowLocalNetworking = true;

  preBuild = ''
-    make -C firmware GIT_REV_SHORT=${firmwareGitRev} LIBFX2=${python3.pkgs.fx2}/share/libfx2
+    make -C firmware GIT_REV_SHORT=${firmwareGitRev} LIBFX2=${pythonPackages.fx2}/share/libfx2

    # Normalize the .ihex file, see ./software/deploy-firmware.sh.
-    ${python3.withPackages (p: [ p.fx2 ])}/bin/python firmware/normalize.py \
+    ${pythonPackages.python.withPackages (p: [ p.fx2 ])}/bin/python firmware/normalize.py \
      firmware/glasgow.ihex firmware/glasgow.ihex

    # Ensure the compiled firmware is exactly the same as the one shipped in the repo.
@@ -11,17 +11,17 @@

 buildGoModule (finalAttrs: {
  pname = "gomuks-web";
-  version = "26.06";
+  version = "26.07";

  src = fetchFromGitHub {
    owner = "gomuks";
    repo = "gomuks";
    tag = "v0.${lib.replaceStrings [ "." ] [ "" ] finalAttrs.version}.0";
-    hash = "sha256-Q4hu3bcB16iuqASZvlv7nDvxj8CFX66qWp6DHIUTmh4=";
+    hash = "sha256-OgcmRBuVFTPzAVgNVDUZcfdgxHi4mtUcbmfTRPx/f9M=";
  };

  proxyVendor = true;
-  vendorHash = "sha256-iuSu5MvNRt+eCZ9wxUwMo6X0joos7q9WPyXBwhn/0yE=";
+  vendorHash = "sha256-wNscq9FDJb9+WqKCBZ9YD+EQ/Sc2PAznunKP6hrs+Ms=";

  nativeBuildInputs = [
    nodejs
@@ -37,7 +37,7 @@ buildGoModule (finalAttrs: {
    npmRoot = "web";
    npmDeps = fetchNpmDeps {
      src = "${finalAttrs.src}/web";
-      hash = "sha256-RiOes+tmAxhA9IkyA6yWQXTjjXyZg2Z8FmPTgcmCg/g=";
+      hash = "sha256-C+zEMI2wmO3EvefpswTk9Tq3AV1Acfi+w3oO5WpxLIQ=";
    };
  };

@@ -88,23 +88,18 @@
 }:

 let
-  version = "1.11.1";
+  version = "1.11.2";

  src = applyPatches {
    src = fetchFromGitHub {
      owner = "HandBrake";
      repo = "HandBrake";
      # uses version commit for logic in version.txt
-      rev = "4ce99a885cde39b3511016efdb5124726819defb";
-      hash = "sha256-oWXNiRK0wbmINnjM3GrOIawcSULTuy3yANfgW8li9F0=";
+      rev = "9eb6c936803e8b071035b1a77662cb0db58441ea";
+      hash = "sha256-f4kBFeW1yVFLlXGAimWsZx+9PKlgR6xrXUZG+CBh28A=";
    };

    patches = [
-      # Only needed so the subsequent patch applies
-      (fetchpatch2 {
-        url = "https://github.com/HandBrake/HandBrake/commit/c8e16778a330881af36fa32004f887bd73874d15.patch";
-        hash = "sha256-i3/X9opDzsZIO7bjLHHZltuQH93uENRF0t7FP7DDdBM=";
-      })
      # Update x265 submodule to v4.2, drop in next release
      (fetchpatch2 {
        url = "https://github.com/HandBrake/HandBrake/commit/432514bf839e7280511e4a7afc35fb4868ef4d0b.patch";
@@ -116,6 +111,14 @@ let
        ];
        hash = "sha256-xwIY1pO9mKbrQFjQCENuvntIoiZTHeUVg8axrl3zxxo=";
      })
+      # Update ffmpeg to v8.1.2, drop if backported
+      (fetchpatch2 {
+        url = "https://github.com/HandBrake/HandBrake/commit/02b704c5cf2e73d227fbb5be151501b232b0e5f2.patch?full_index=1";
+        excludes = [
+          "contrib/ffmpeg/module.defs"
+        ];
+        hash = "sha256-fSfLXH+aRwVv9BrDT1oNBHD2VUbAnN3jVu3CJeoaAKg=";
+      })
    ];
  };

@@ -150,6 +153,7 @@ let
      "${src}/contrib/ffmpeg/A22-fix-d3d11-static-pool-size-error.patch"
      "${src}/contrib/ffmpeg/A23-movenc-set-the-chapters-track-language-to-the-same-a.patch"
      "${src}/contrib/ffmpeg/A24-movenc-use-version-2-audio-descriptor-for-2-channels.patch"
+      "${src}/contrib/ffmpeg/A26-avformat-movenc-fix-mov_create_dvd_sub_decoder_speci.patch"
    ];
  });

@@ -173,12 +177,12 @@ let
  });

  svt-av1-hb = svt-av1.overrideAttrs (old: rec {
-    version = "4.0.1";
+    version = "4.1.0";
    src = fetchFromGitLab {
      owner = "AOMediaCodec";
      repo = "SVT-AV1";
-      rev = "v${version}";
-      hash = "sha256-7krVkLZxgolqPTkuyKAx07BekAPacftcGZ44lQTQFZQ=";
+      tag = "v${version}";
+      hash = "sha256-NPJG1SsRlG9kGtUwdJa/uP6DAtF09nCctzeorrvjAhQ=";
    };
    postPatch = (old.postPatch or "") + ''
      pushd ..
@@ -1,22 +1,15 @@
 {
  buildGoModule,
-  fetchFromGitHub,
+  headplane,
  lib,
 }:
 buildGoModule (finalAttrs: {
  pname = "headplane-agent";
  __structuredAttrs = true;
-  # Note, if you are upgrading this, you should upgrade headplane at the same time
-  version = "0.6.3";
+  inherit (headplane) version src;

-  src = fetchFromGitHub {
-    owner = "tale";
-    repo = "headplane";
-    tag = "v${finalAttrs.version}";
-    hash = "sha256-zvJUTKRIlHyPMq80teVXBSb7K9Zz44Kuuj2PPi6qIOw=";
-  };
+  vendorHash = headplane.goVendorHash;

-  vendorHash = "sha256-MvrqKMD+A+qBZmzQv+T9920U5uJop+pjfJpZdm2ZqEA=";
  subPackages = [ "cmd/hp_agent" ];

  ldflags = [
@@ -3,32 +3,31 @@
  fetchFromGitHub,
  fetchPnpmDeps,
  git,
-  headplane-agent,
  lib,
  makeWrapper,
  nixosTests,
-  nodejs_22,
+  nodejs_24,
  pnpm_10,
  pnpmConfigHook,
  stdenv,
 }:
 let
  pname = "headplane";
-  # Note, if you are upgrading this, you should upgrade headplane-agent at the same time
-  version = "0.6.3";
-  pnpmDepsHash = "sha256-CsmffCo9Se/4oiOqbcuhjPMuGmR2GL+YfcyWgzBTAh8=";
+  version = "0.7.0";
+  goVendorHash = "sha256-MvrqKMD+A+qBZmzQv+T9920U5uJop+pjfJpZdm2ZqEA=";
+  pnpmDepsHash = "sha256-OBerkCnB/QL5HGYp2kehzFYEIKSuqpBt0dTFHIypc00=";
  src = fetchFromGitHub {
    owner = "tale";
    repo = "headplane";
    tag = "v${version}";
-    hash = "sha256-zvJUTKRIlHyPMq80teVXBSb7K9Zz44Kuuj2PPi6qIOw=";
+    hash = "sha256-UMAGsrG2xfpgWlsDhf4aWJKoOrUbruucDNOhCJcYmQQ=";
  };

  headplaneSshWasm = buildGoModule {
    pname = "headplane-ssh-wasm";
    inherit version src;
    subPackages = [ "cmd/hp_ssh" ];
-    vendorHash = "sha256-MvrqKMD+A+qBZmzQv+T9920U5uJop+pjfJpZdm2ZqEA=";
+    vendorHash = goVendorHash;
    env.CGO_ENABLED = 0;
    doCheck = false;
    buildPhase = ''
@@ -73,7 +72,7 @@ stdenv.mkDerivation (finalAttrs: {
  nativeBuildInputs = [
    git
    makeWrapper
-    nodejs_22
+    nodejs_24
    pnpm_10
    pnpmConfigHook
  ];
@@ -82,14 +81,14 @@ stdenv.mkDerivation (finalAttrs: {
    inherit (finalAttrs) pname version src;
    pnpm = pnpm_10;
    hash = pnpmDepsHash;
-    fetcherVersion = 3;
+    fetcherVersion = 4;
  };

  buildPhase = ''
    runHook preBuild
-    cp ${headplaneSshWasm}/hp_ssh.wasm app/hp_ssh.wasm
-    cp ${headplaneSshWasm}/wasm_exec.js app/wasm_exec.js
-    pnpm --offline build
+    cp ${headplaneSshWasm}/hp_ssh.wasm public/hp_ssh.wasm
+    cp ${headplaneSshWasm}/wasm_exec.js public/wasm_exec.js
+    pnpm build
    runHook postBuild
  '';

@@ -97,18 +96,15 @@ stdenv.mkDerivation (finalAttrs: {
    runHook preInstall
    mkdir -p $out/{bin,share/headplane}
    cp -r build $out/share/headplane/
-    cp -r node_modules $out/share/headplane/
    cp -r drizzle $out/share/headplane/
-    substituteInPlace $out/share/headplane/build/server/index.js \
-      --replace "$PWD" "../.."
-    makeWrapper ${lib.getExe nodejs_22} $out/bin/headplane \
+    makeWrapper ${lib.getExe nodejs_24} $out/bin/headplane \
      --chdir $out/share/headplane \
      --add-flags $out/share/headplane/build/server/index.js
    runHook postInstall
  '';

  passthru = {
-    agent = headplane-agent;
+    inherit goVendorHash;
    tests = { inherit (nixosTests) headplane; };
  };

@@ -14,13 +14,13 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "home-assistant-matter-hub";
-  version = "2.0.48";
+  version = "2.0.49";

  src = fetchFromGitHub {
    owner = "RiDDiX";
    repo = "home-assistant-matter-hub";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-0M1ZSqNyLQECaO0cj4MpDGN5x8wVZeJczMViW5d9IXQ=";
+    hash = "sha256-AbXm70mxpqIefVyoapdYc8NC+XUTAdfRDhorMP446JI=";
  };

  # The bundled cli.js imports transitive dependencies (e.g. @noble/curves)
@@ -38,7 +38,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
      ;
    inherit pnpm;
    fetcherVersion = 4;
-    hash = "sha256-Bfg2c6gYTUv1rsBGriXUiftlOwGCzPdbdYgW9qhFSLw=";
+    hash = "sha256-PESk5TexRfwD/4upUA7npGQobhFwgm87oqVS1LqzbRg=";
  };

  __structuredAttrs = true;
@@ -18,13 +18,13 @@ maven.buildMavenPackage rec {
  pname = "jsign";
  # For build from non-release, increment version by one and add -SNAPSHOT
  # e.g. 7.3-SNAPSHOT
-  version = "7.4";
+  version = "7.5";

  src = fetchFromGitHub {
    owner = "ebourg";
    repo = "jsign";
    tag = version;
-    hash = "sha256-r19w9k6Iuk6AQGC3l2yu6Ocn740BtE7DjtFLXUdhdw8=";
+    hash = "sha256-Eg23jy5K4F8pL0qqt7Ut/9NOXR9UfnQD7S7qtX9vAjk=";
  };

  mvnHash = "sha256-zxlwb2id8yAw/yxTjD6jyAkPJx9IazrPQYGacQGLEK8=";
@@ -6,12 +6,12 @@

 let
  pname = "labymod-launcher";
-  version = "3.0.10";
+  version = "3.0.11";

  src = fetchurl {
    name = "labymod-launcher";
    url = "https://releases.r2.labymod.net/launcher/linux/x64/LabyMod%20Launcher-${version}.AppImage";
-    hash = "sha256-etrP2kfhaWVyTgRAsw8MeBy3ndScTkKi3ogXiaQZ2g0=";
+    hash = "sha256-piGk8nbOj4AUjw05y9Ux59JSPXBIB7VisDbVirriMoI=";
  };

  appimageContents = appimageTools.extract { inherit pname version src; };
@@ -7,14 +7,14 @@

 python3.pkgs.buildPythonApplication (finalAttrs: {
  pname = "maigret";
-  version = "0.6.2";
+  version = "0.6.3";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "soxoj";
    repo = "maigret";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-KgSf0lM8euahWRYT+acuoH6C+NN08IzkVGzytfnvHEg=";
+    hash = "sha256-iKWPIDxuwoNzyWZAiziWU2Q7VDFgGqAcxYjcw6L/5Ho=";
  };

  pythonRelaxDeps = true;
@@ -9,6 +9,7 @@
  versionCheckHook,
  zsh,
 }:
+
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "mas";
  version = "7.0.0";
@@ -60,6 +61,8 @@ stdenvNoCC.mkDerivation (finalAttrs: {
  nativeInstallCheckInputs = [ versionCheckHook ];
  doInstallCheck = true;

+  passthru.updateScript = ./update.sh;
+
  meta = {
    description = "Mac App Store command line interface";
    homepage = "https://github.com/mas-cli/mas";
@@ -67,6 +70,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    mainProgram = "mas";
    maintainers = with lib.maintainers; [
      zachcoyle
+      tiferrei
    ];
    platforms = [
      "aarch64-darwin"
@@ -0,0 +1,17 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl jq nurl gnused
+
+set -eu
+
+ROOT="$(dirname "$(readlink -f "$0")")"
+NIX_DRV="$ROOT/package.nix"
+
+VERSION="$(curl -s ${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} https://api.github.com/repos/mas-cli/mas/releases/latest \
+  | jq -r '.tag_name | ltrimstr("v")')"
+
+URL="https://github.com/mas-cli/mas/releases/download/v${VERSION}/mas-${VERSION}-arm64.pkg"
+HASH=$(nurl --hash --expr \
+    "(import <nixpkgs> { }).fetchurl { url = \"$URL\"; }")
+
+sed -i "s/version = \".*\"/version = \"$VERSION\"/" "$NIX_DRV"
+sed -i "/arm64.pkg\";/{n; s|hash = \"sha256-.\{44\}\"|hash = \"$HASH\"|}" "$NIX_DRV"
@@ -17,17 +17,17 @@ let
  # We pin the nix version to a known working one here as upgrades can likely break the build.
  # Since the nix language is rather stable we don't always need to have the latest and greatest for unit tests
  # On each update of nix unit we should re-evaluate what version we need.
-  nixComponents = nixVersions.nixComponents_2_34;
+  nixComponents = nixVersions.nixComponents_2_35;
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "nix-unit";
-  version = "2.34.2";
+  version = "2.35.0";

  src = fetchFromGitHub {
    owner = "nix-community";
    repo = "nix-unit";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-eG+ETC+lvHDLhlKgQB6/lGfpqr56Lt3+j1pHOeb4tK4=";
+    hash = "sha256-eXyZw2ddCKT5xMY8SDnV6lkr61zvSc7CNJeJSAjKqN4=";
  };

  buildInputs = [
@@ -6,16 +6,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "nixdoc";
-  version = "3.1.0";
+  version = "3.2.0";

  src = fetchFromGitHub {
    owner = "nix-community";
    repo = "nixdoc";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-7UOjmW8Ef4mEvj7SINaKWh2ZuyNMVEXB82mtuZTQiPA=";
+    hash = "sha256-FW8yZLO+hVDn2vs4pEUfjMM/5P508WKCLxd4AozLElk=";
  };

-  cargoHash = "sha256-Aw794yhIET8/pnlQiK2xKVbYC/Kd5MExvFTwkv4LLTc=";
+  cargoHash = "sha256-pV/KEg3/UaT7bbgtRgjZZGq+RVyN1xY28YqzfslYoQo=";

  meta = {
    description = "Generate documentation for Nix functions";
@@ -16,7 +16,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "parla";
-  version = "0.6.6";
+  version = "0.6.8";
  __structuredAttrs = true;
  strictDeps = true;

@@ -24,7 +24,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "trufae";
    repo = "parla";
    tag = finalAttrs.version;
-    hash = "sha256-ZSI/dABNaApCXKJkLGXFp1Fp221Axurj/Z3O9Q9pQZk=";
+    hash = "sha256-buUu3+HhK00rRg3ry6m8yBvH/wln7tUJfB5eXCwLCKc=";
  };

  nativeBuildInputs = [
@@ -12,16 +12,16 @@
 }:
 buildNpmPackage (finalAttrs: {
  pname = "pi-coding-agent";
-  version = "0.80.7";
+  version = "0.80.8";

  src = fetchFromGitHub {
    owner = "earendil-works";
    repo = "pi";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-s7dD82fugvWRvqL1VTcEwCIR5JI6t7VeFHR9NdMtG00=";
+    hash = "sha256-wCsZA1gb9sFri6OdTWBf0UCXYxqxlbImG8iE6K+D9u4=";
  };

-  npmDepsHash = "sha256-Bd/NIt3lyQR5Y7P+HksPxMQvJc0AjVfDi1M1bH3/eOg=";
+  npmDepsHash = "sha256-WdSQHKKOVzEFxUQH3QnSVzs+HpJPATnCQ701nbRB0lc=";

  npmWorkspace = "packages/coding-agent";

@@ -85,15 +85,15 @@
  },
  {
    "pname": "Microsoft.CodeAnalysis.Analyzers",
-    "version": "5.9.0-1.26306.2",
-    "hash": "sha256-GdxMDFLl+/+UaJHVKzchPi6Dy23WBPvvZW6Ez+XJc2w=",
-    "url": "https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/d1622942-d16f-48e5-bc83-96f4539e7601/nuget/v3/flat2/microsoft.codeanalysis.analyzers/5.9.0-1.26306.2/microsoft.codeanalysis.analyzers.5.9.0-1.26306.2.nupkg"
+    "version": "5.9.0-1.26314.1",
+    "hash": "sha256-eIH9cgoG7C9Q/DgIz4u8YccZpvuV+0e/wNVhHBZJMZU=",
+    "url": "https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/d1622942-d16f-48e5-bc83-96f4539e7601/nuget/v3/flat2/microsoft.codeanalysis.analyzers/5.9.0-1.26314.1/microsoft.codeanalysis.analyzers.5.9.0-1.26314.1.nupkg"
  },
  {
    "pname": "Microsoft.CodeAnalysis.BannedApiAnalyzers",
-    "version": "5.9.0-1.26312.114",
-    "hash": "sha256-vCAz49NzwPMKTrwF93rEyiLrtHyWvImhB/Upqeh3mBQ=",
-    "url": "https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/d1622942-d16f-48e5-bc83-96f4539e7601/nuget/v3/flat2/microsoft.codeanalysis.bannedapianalyzers/5.9.0-1.26312.114/microsoft.codeanalysis.bannedapianalyzers.5.9.0-1.26312.114.nupkg"
+    "version": "5.9.0-1.26318.105",
+    "hash": "sha256-th/gB+lr8eukOvYS3mgqOH1xw/MZB92DGtvzxQ1dhCY=",
+    "url": "https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/d1622942-d16f-48e5-bc83-96f4539e7601/nuget/v3/flat2/microsoft.codeanalysis.bannedapianalyzers/5.9.0-1.26318.105/microsoft.codeanalysis.bannedapianalyzers.5.9.0-1.26318.105.nupkg"
  },
  {
    "pname": "Microsoft.CodeAnalysis.Common",
@@ -115,9 +115,9 @@
  },
  {
    "pname": "Microsoft.CodeAnalysis.PublicApiAnalyzers",
-    "version": "5.9.0-1.26312.114",
-    "hash": "sha256-Eke4nmBnkDrCRILYpXoMzj/6wffm5twnbwkjX00JMsU=",
-    "url": "https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/d1622942-d16f-48e5-bc83-96f4539e7601/nuget/v3/flat2/microsoft.codeanalysis.publicapianalyzers/5.9.0-1.26312.114/microsoft.codeanalysis.publicapianalyzers.5.9.0-1.26312.114.nupkg"
+    "version": "5.9.0-1.26318.105",
+    "hash": "sha256-tmvcJ968qvZO0IxSAqGWvRY/Cf3sVoE3lgLKjEKdwMU=",
+    "url": "https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/d1622942-d16f-48e5-bc83-96f4539e7601/nuget/v3/flat2/microsoft.codeanalysis.publicapianalyzers/5.9.0-1.26318.105/microsoft.codeanalysis.publicapianalyzers.5.9.0-1.26318.105.nupkg"
  },
  {
    "pname": "Microsoft.CSharp",
@@ -481,9 +481,9 @@
  },
  {
    "pname": "Roslyn.Diagnostics.Analyzers",
-    "version": "5.9.0-1.26312.114",
-    "hash": "sha256-aUngqGTjpzYR2uPNHPfvhUApEqx3Sea50vpMU0yCVZ0=",
-    "url": "https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/d1622942-d16f-48e5-bc83-96f4539e7601/nuget/v3/flat2/roslyn.diagnostics.analyzers/5.9.0-1.26312.114/roslyn.diagnostics.analyzers.5.9.0-1.26312.114.nupkg"
+    "version": "5.9.0-1.26318.105",
+    "hash": "sha256-OtO3MoCsN12zTiqc2a5kcSe8Gz3bYsLlrRztvMiWTRg=",
+    "url": "https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/d1622942-d16f-48e5-bc83-96f4539e7601/nuget/v3/flat2/roslyn.diagnostics.analyzers/5.9.0-1.26318.105/roslyn.diagnostics.analyzers.5.9.0-1.26318.105.nupkg"
  },
  {
    "pname": "SQLitePCLRaw.bundle_green",
@@ -547,9 +547,9 @@
  },
  {
    "pname": "System.CommandLine",
-    "version": "3.0.0-preview.6.26312.114",
-    "hash": "sha256-0/D51nnC0jWdrqEUMIVj557NST8zSDwquxrVIRtyyN4=",
-    "url": "https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/516521bf-6417-457e-9a9c-0a4bdfde03e7/nuget/v3/flat2/system.commandline/3.0.0-preview.6.26312.114/system.commandline.3.0.0-preview.6.26312.114.nupkg"
+    "version": "3.0.0-preview.6.26318.105",
+    "hash": "sha256-Tk8jtUmyXXdA/vbu4JvRits1TFmoFILzrVwv4ltyF68=",
+    "url": "https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/516521bf-6417-457e-9a9c-0a4bdfde03e7/nuget/v3/flat2/system.commandline/3.0.0-preview.6.26318.105/system.commandline.3.0.0-preview.6.26318.105.nupkg"
  },
  {
    "pname": "System.ComponentModel.Composition",
@@ -38,18 +38,18 @@ in
 buildDotnetModule (finalAttrs: {
  inherit pname dotnet-sdk dotnet-runtime;

-  vsVersion = "2.144.9-prerelease";
+  vsVersion = "2.145.15-prerelease";
  src = fetchFromGitHub {
    owner = "dotnet";
    repo = "roslyn";
    rev = "VSCode-CSharp-${finalAttrs.vsVersion}";
-    hash = "sha256-Cq1ynxtNaguLhVSSR04wUkqrn4/0YmwGxHfBZC4zMS8=";
+    hash = "sha256-lQWmk+NYx2dUsD97manGi9s5i9KNBocNrVok3j/6gIw=";
  };

  # versioned independently from vscode-csharp
  # "roslyn" in here:
  # https://github.com/dotnet/vscode-csharp/blob/main/package.json
-  version = "5.9.0-1.26314.1";
+  version = "5.9.0-1.26319.6";
  projectFile = "src/LanguageServer/${project}/${project}.csproj";
  useDotnetFromEnv = true;
  nugetDeps = ./deps.json;
@@ -0,0 +1,24 @@
+diff --git a/src/sage/doctest/test.py b/src/sage/doctest/test.py
+index 812f8167c12..38e553ad5bd 100644
+--- a/src/sage/doctest/test.py
+++ b/src/sage/doctest/test.py
+@@ -468,6 +468,7 @@ Test the ``--debug`` option::
+         s...: b = 5
+         s...: a + b
+         8
+    ...
+     sage:
+     <BLANKLINE>
+     Returning to doctests...
+diff --git a/src/sage/tests/cmdline.py b/src/sage/tests/cmdline.py
+index 56fc16a205c..be2ae2a1b3d 100644
+--- a/src/sage/tests/cmdline.py
+++ b/src/sage/tests/cmdline.py
+@@ -327,6 +327,7 @@ be ignored. In Pdb, we run the ``help`` command::
+     **********************************************************************
+     Previously executed commands:
+         s...: assert True is False
+    ...
+     sage:
+     <BLANKLINE>
+     Returning to doctests...
@@ -0,0 +1,13 @@
+diff --git a/src/sage/plot/plot3d/plot3d.py b/src/sage/plot/plot3d/plot3d.py
+index bdf15a85e9d..36580eeab6b 100644
+--- a/src/sage/plot/plot3d/plot3d.py
+++ b/src/sage/plot/plot3d/plot3d.py
+@@ -316,7 +316,7 @@ class _Coordinates:
+             ....: [ 0.16763356,  0.19993708,  0.31403568,  0.47359696, 0.55282422],
+             ....: [ 0.16763356,  0.25683223,  0.16649297,  0.10594339, 0.55282422]])
+             sage: import scipy.interpolate
+-            sage: f=scipy.interpolate.RectBivariateSpline(v_phi,v_theta,m_r).ev
+            sage: f=lambda *x: scipy.interpolate.RectBivariateSpline(v_phi,v_theta,m_r).ev(*x).item()
+             sage: spherical_plot3d(f,(0,2*pi),(0,pi))
+             Graphics3d Object
+         """
@@ -130,6 +130,14 @@ stdenv.mkDerivation rec {
      url = "https://github.com/sagemath/sage/commit/926f32aab22f81ddb9fda874a20fee84c7bfacc3.patch?full_index=1";
      hash = "sha256-EMn/fr5WlRQtFj5GHo02kczasmKaiqFfRSVZo2uvOPI=";
    })
+
+    # work around https://github.com/ipython/ipython/issues/15207, which
+    # will likely be properly fixed in IPython 9.16.
+    ./patches/ipython-9_15-workaround.patch
+
+    # work around https://github.com/scipy/scipy/issues/25471, which is
+    # fixed as part of SciPy 1.18.1.
+    ./patches/scipy-1_18-workaround.patch
  ];

  patches = nixPatches ++ bugfixPatches ++ packageUpgradePatches;
@@ -26,22 +26,22 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "sone";
-  version = "0.20.0";
+  version = "0.21.0";

  src = fetchFromGitHub {
    owner = "lullabyX";
    repo = "sone";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-dVAVMcEr9cUPJetcVj9y9Lkj6LevJH0M7WYui43IjnY=";
+    hash = "sha256-JhzO4n6bR9Mb5U8hr6DuRm2xCjTVPasA86d6d/EG5Ig=";
  };

-  cargoHash = "sha256-gsg/aKy+RpJFF6Q2P5O7btoeY4Q/A9D/w3s1nLvnp1Q=";
+  cargoHash = "sha256-sLw31tCdmNLubsWySwGS5cp935wpqkwmM8/YCuQnM98=";

  pnpmDeps = fetchPnpmDeps {
    inherit (finalAttrs) pname version src;
    inherit pnpm;
    fetcherVersion = 4;
-    hash = "sha256-vOfDSTu7AnZINejVwnIXdZJYlmHSljJpddRRQqlI7ko=";
+    hash = "sha256-JCvImjN73oImtPKstbqqBsKHDW9iLPJMQsNm5I4Ws7k=";
  };

  nativeBuildInputs = [
@@ -30,10 +30,13 @@ stdenv.mkDerivation (finalAttrs: {
  pname = "spla";
  version = "1.6.1";

+  strictDeps = true;
+  __structuredAttrs = true;
+
  src = fetchFromGitHub {
    owner = "eth-cscs";
    repo = "spla";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
    hash = "sha256-fNH1IOKV1Re8G7GH9Xfn3itR80eonTbEGKQRRD16/2k=";
  };

@@ -50,13 +53,17 @@ stdenv.mkDerivation (finalAttrs: {
  nativeBuildInputs = [
    cmake
    gfortran
-  ];
+    mpi
+  ]
+  ++ lib.optionals (gpuBackend == "cuda") [ cudaPackages.cuda_nvcc ];

  buildInputs = [
    blas
-    mpi
  ]
-  ++ lib.optional (gpuBackend == "cuda") cudaPackages.cudatoolkit
+  ++ lib.optionals (gpuBackend == "cuda") [
+    cudaPackages.cuda_cudart
+    cudaPackages.libcublas
+  ]
  ++ lib.optionals (gpuBackend == "rocm") [
    rocmPackages.clr
    rocmPackages.rocblas
@@ -14,13 +14,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "sqlcipher";
-  version = "4.16.0";
+  version = "4.17.0";

  src = fetchFromGitHub {
    owner = "sqlcipher";
    repo = "sqlcipher";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-hvgdKpgyj2vD8rxCzS9gM5pKANgMFW4IV0M/c7eapNM=";
+    hash = "sha256-IMtyUfpwhvKPWyXYZCxw2F8pbWAnknW3kxf8Gx3kW5Q=";
  };

  nativeBuildInputs = [
@@ -1,4 +1,5 @@
 {
+  config,
  lib,
  stdenv,
  fetchFromGitHub,
@@ -8,9 +9,10 @@
  libxml2,
  symlinkJoin,
  cudaPackages,
-  enableCUDA ? false,
+  enableCUDA ? config.cudaSupport,
  libffi,
  libpfm,
+  versionCheckHook,
 }:

 let
@@ -20,7 +22,7 @@ let
  luajitSrc = fetchFromGitHub {
    owner = "LuaJIT";
    repo = "LuaJIT";
-    rev = luajitRev;
+    tag = luajitRev;
    hash = "sha256-L9T6lc32dDLAp9hPI5mKOzT0c4juW9JHA3FJCpm7HNQ=";
  };

@@ -37,8 +39,6 @@ let
    ];
  };

-  cuda = cudaPackages.cudatoolkit;
-
  clangVersion = llvmPackages.clang-unwrapped.version;

 in
@@ -46,21 +46,30 @@ stdenv.mkDerivation (finalAttrs: {
  pname = "terra";
  version = "1.2.0";

+  strictDeps = true;
+  __structuredAttrs = true;
+
  src = fetchFromGitHub {
    owner = "terralang";
    repo = "terra";
-    rev = "release-${finalAttrs.version}";
+    tag = "release-${finalAttrs.version}";
    hash = "sha256-CukNCvTHZUhjdHyvDUSH0YCVNkThUFPaeyLepyEKodA=";
  };

-  nativeBuildInputs = [ cmake ];
+  nativeBuildInputs = [ cmake ] ++ lib.optionals enableCUDA [ cudaPackages.cuda_nvcc ];
  buildInputs = [
    llvmMerged
    ncurses
    libffi
    libxml2
  ]
-  ++ lib.optionals enableCUDA [ cuda ]
+  ++ lib.optionals enableCUDA (
+    with cudaPackages;
+    [
+      cuda_nvcc # crt/host_config.h; even though we include this in nativeBuildInputs, it's needed here too
+      cuda_cudart
+    ]
+  )
  ++ lib.optional (!stdenv.hostPlatform.isDarwin) libpfm;

  cmakeFlags =
@@ -100,14 +109,21 @@ stdenv.mkDerivation (finalAttrs: {
  '';

  installPhase = ''
+    runHook preInstall
+
    install -Dm755 -t $bin/bin bin/terra
    install -Dm755 -t $out/lib lib/terra${stdenv.hostPlatform.extensions.sharedLibrary}
    install -Dm644 -t $static/lib lib/libterra_s.a

    mkdir -pv $dev/include
    cp -rv include/terra $dev/include
+
+    runHook postInstall
  '';

+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+
  meta = {
    description = "Low-level counterpart to Lua";
    homepage = "https://terralang.org/";
@@ -123,5 +139,6 @@ stdenv.mkDerivation (finalAttrs: {
    # Linux Aarch64 broken above LLVM11
    # https://github.com/terralang/terra/issues/597
    broken = stdenv.hostPlatform.isAarch64;
+    mainProgram = "terra";
  };
 })
@@ -9,16 +9,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "topgrade";
-  version = "17.7.0";
+  version = "17.8.0";

  src = fetchFromGitHub {
    owner = "topgrade-rs";
    repo = "topgrade";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-2oydjlPZLWlGNvahsRK7kG5gxEKEHMDNxteaOeYupPA=";
+    hash = "sha256-Cvyvk7Q9BpNGNDXYwSwUpAqF8RWNGZ3SVKDOzPrjzFs=";
  };

-  cargoHash = "sha256-8pK6ZUlMNcczbmMJvQUsJKp0RoXnimnkbAc7SzrIcJQ=";
+  cargoHash = "sha256-RPYJNcF6TUEH1a0ErcdqOs8RQcnBZu3sTiw6X1d15D8=";

  nativeBuildInputs = [
    installShellFiles
@@ -7,14 +7,14 @@

 python3.pkgs.buildPythonApplication (finalAttrs: {
  pname = "troubadix";
-  version = "26.4.6";
+  version = "26.7.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "greenbone";
    repo = "troubadix";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-wZpxwgIGvl4cVpPNrsYa5eGbAUgdf4lOxP2f537FYQI=";
+    hash = "sha256-qGByIyO9JmCDNs1BMpO5gjt27Av502NB92vaOcUpuaA=";
  };

  pythonRelaxDeps = [
@@ -15,13 +15,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "tsx";
-  version = "4.23.0";
+  version = "4.23.1";

  src = fetchFromGitHub {
    owner = "privatenumber";
    repo = "tsx";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-De/l8Z7+VAwkOZmAZZumqJBIMrDNhY9DM0fh4LuTWZM=";
+    hash = "sha256-zR3a3AZLPYmnIeiT0SNwN6gVcnR4ObzJsfj7aQ8LOkQ=";
  };

  pnpmDeps = fetchPnpmDeps {
@@ -32,7 +32,7 @@ stdenv.mkDerivation (finalAttrs: {
      ;
    pnpm = pnpm';
    fetcherVersion = 3;
-    hash = "sha256-kd28ZK1c7a/h7ZNf0fQuJdNUiuvJ1a9qvQut4Ms4xuo=";
+    hash = "sha256-jnCz9u+UMGV20t6fhzk/rVq68K+e5eBvUth6O7jOpQg=";
  };

  nativeBuildInputs = [
@@ -18,17 +18,17 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "uv";
-  version = "0.11.26";
+  version = "0.11.28";
  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "astral-sh";
    repo = "uv";
    tag = finalAttrs.version;
-    hash = "sha256-p9JOn28Mf2bbDqIR3z4pKmcIw54hKEINnz5KeD4ASRo=";
+    hash = "sha256-/mTH2hojC+l0yxn+LEAIj8FTA/nWKIPZ7uLMVJxebw4=";
  };

-  cargoHash = "sha256-EIRWisiPt+YaZsK5PgYP7nZ+3ZeaXkx5ThxD+o0Ehyg=";
+  cargoHash = "sha256-FvLl32JfIq5a1NnLtnFJyy5T+vkcOD+qfQLDy6NYhHg=";

  buildInputs = [
    rust-jemalloc-sys
@@ -7,6 +7,7 @@
  ncurses,
  sqlite,
  check,
+  nixosTests,
 }:

 stdenv.mkDerivation (finalAttrs: {
@@ -40,6 +41,8 @@ stdenv.mkDerivation (finalAttrs: {

  doCheck = true;

+  passthru.tests = { inherit (nixosTests) vnstat; };
+
  meta = {
    description = "Console-based network statistics utility for Linux";
    longDescription = ''
@@ -5,13 +5,13 @@
 }:
 mkYaziPlugin {
  pname = "clipboard.yazi";
-  version = "0-unstable-2026-05-22";
+  version = "0-unstable-2026-07-14";

  src = fetchFromGitHub {
    owner = "XYenon";
    repo = "clipboard.yazi";
-    rev = "0ac03203a88a6ca85539378fbb1b73b75fe8521e";
-    hash = "sha256-Ug0lEL+lR3xH1ps4fNljbs2DyExz0P5M2waWR9XTcEQ=";
+    rev = "4533c7f1b16196ad32749e35344bdc82a624871b";
+    hash = "sha256-lThDO1b9iq+N6x/F9fKEWlNPpgJBTfxpY2xjyZF22mM=";
  };

  meta = {
@@ -5,13 +5,13 @@
 }:
 mkYaziPlugin {
  pname = "gvfs.yazi";
-  version = "0-unstable-2026-03-29";
+  version = "0-unstable-2026-07-13";

  src = fetchFromGitHub {
    owner = "boydaihungst";
    repo = "gvfs.yazi";
-    rev = "3abc0a258f9d7aeaa453a2d0d6e103c5a305953d";
-    hash = "sha256-UHneVJ+YXyDuPrZS+PZbs9n9h+VN5M2QG36FdprBkJc=";
+    rev = "c5a0bb924eceeeb8b44bfc00aba0a97ba0287fa3";
+    hash = "sha256-hSHEN/F4uc1FFScB5lLRAKryLwP+O7I9vgEgobGbQyw=";
  };

  meta = {
@@ -5,13 +5,13 @@
 }:
 mkYaziPlugin {
  pname = "keep-preferences.yazi";
-  version = "0-unstable-2026-05-25";
+  version = "0-unstable-2026-07-15";

  src = fetchFromGitHub {
    owner = "XYenon";
    repo = "keep-preferences.yazi";
-    rev = "45d93faa8f1da3f4c2fabf68398204fd576705f7";
-    hash = "sha256-uNReRmj9slKE/7WYA0gfE5eTO60CdFrFMH1/V3GwvFg=";
+    rev = "0d32befc027b2ad31b8893bb2832f0f160442a0c";
+    hash = "sha256-fdZIouyrWxcFGv51NVYylQRba6PGEzFqEP6mrUQiC9s=";
  };

  meta = {
@@ -5,13 +5,13 @@
 }:
 mkYaziPlugin {
  pname = "mediainfo.yazi";
-  version = "0-unstable-2026-06-06";
+  version = "0-unstable-2026-07-13";

  src = fetchFromGitHub {
    owner = "boydaihungst";
    repo = "mediainfo.yazi";
-    rev = "a6d30a1c85faabe9bab215b83efb3c646b4c2924";
-    hash = "sha256-s2/6ljln64oVbKVFTGbRdxB8x9ASCo7FKDvC65eyDWM=";
+    rev = "e079a001f4fefd69007e515bbede4e16b95a811e";
+    hash = "sha256-RIVcKJO89R4oaE6sJuFcV8pFK4nvWtq6ILAXehu4FIY=";
  };

  meta = {
@@ -98,7 +98,7 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "zed-editor";
-  version = "1.10.0";
+  version = "1.11.3";

  outputs = [
    "out"
@@ -111,7 +111,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    owner = "zed-industries";
    repo = "zed";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-KLoowntT7rrUWJdZ+uA2qvKih+Ygo58RIxd5jR7fFYE=";
+    hash = "sha256-1T1MlbnRQgN9Y6bSxPScpsRW3diRCganwhJ5WcLi0dU=";
  };

  postPatch = ''
@@ -134,7 +134,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
      --replace-fail 'builder.include(&glib_path_config);' 'builder.include("${lib.getLib glib}/lib/glib-2.0/include");'
  '';

-  cargoHash = "sha256-HzDxvX72H3nLmfI0nIGZISpoF5vTiPj+hT/pz/6MUF4=";
+  cargoHash = "sha256-zBWVbJKvfzxoNptgczK3cPcF3ESS7P41gQC+r0l78Y0=";

  __structuredAttrs = true;

@@ -214,10 +214,7 @@ stdenv.mkDerivation (
    meta = {
      homepage = "https://ocaml.org/";
      branch = versionNoPatch;
-      license = with lib.licenses; [
-        qpl # compiler
-        lgpl2 # library
-      ];
+      license = lib.licenses.lgpl21;
      description = "OCaml is an industrial-strength programming language supporting functional, imperative and object-oriented styles";

      maintainers = [ lib.maintainers.georgyo ];
@@ -38,8 +38,11 @@ let
          "Coq tactic and verified tool for proving tautologies using Stålmarck's algorithm"
        else
          "A two-level approach to prove tautologies using Stålmarck's algorithm in Coq.";
+      duneOverride = lib.optionalAttrs (version == "8.20.0" || defaultVersion == "8.20.0") {
+        dune = dune.override { version = "3.21.1"; };
+      };
    in
-    mkRocqDerivation.override { dune = dune.override { version = "3.21.1"; }; } {
+    mkRocqDerivation.override duneOverride {
      useCoq = true;
      namePrefix = [ "coq" ];
      inherit
@@ -0,0 +1,48 @@
+{
+  lib,
+  buildDunePackage,
+  fetchFromGitHub,
+  astring,
+  fmt,
+  tyxml,
+  alcotest,
+}:
+
+buildDunePackage (finalAttrs: {
+  pname = "ansi";
+  version = "0.7.0";
+
+  minimalOCamlVersion = "4.10";
+
+  src = fetchFromGitHub {
+    owner = "ocurrent";
+    repo = "ansi";
+    tag = finalAttrs.version;
+    hash = "sha256-VZR8hz2v4gAvTkizBt59DSYr3tGPWT1Iid8m8YQx48Y=";
+  };
+
+  propagatedBuildInputs = [
+    astring
+    fmt
+    tyxml
+  ];
+
+  checkInputs = [
+    alcotest
+  ];
+
+  doCheck = true;
+
+  meta = {
+    description = "ANSI escape sequence parser";
+    longDescription = ''
+      This package provides a basic ANSI escape parser. Program output (such as
+      build logs) often includes ANSI escape codes to colour and style the output.
+      This library interprets some of the common codes and can convert them to
+      HTML, producing basic styled output (e.g. highlighting errors in red).
+    '';
+    homepage = "https://github.com/ocurrent/ansi";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ otini ];
+  };
+})
@@ -31,13 +31,15 @@ stdenv.mkDerivation (finalAttrs: {
  ];
  buildInputs = [
    gmp
-    mpfr
    ppl
-    camlidl
    flint
    pplite
  ];
-  propagatedBuildInputs = [ mlgmpidl ];
+  propagatedBuildInputs = [
+    camlidl
+    mlgmpidl
+    mpfr
+  ];

  outputs = [
    "out"
@@ -0,0 +1,27 @@
+{
+  lib,
+  fetchFromGitHub,
+  buildDunePackage,
+  apron,
+}:
+
+buildDunePackage (finalAttrs: {
+  pname = "apronext";
+  version = "1.0.4";
+
+  src = fetchFromGitHub {
+    owner = "ghilesZ";
+    repo = "apronext";
+    rev = "39610de5930e12c8d0156ed2d55fedc220f1e77d";
+    hash = "sha256-K19hmvyI1RJlKv24VJustDfkGTdrW4PcR8xif/y/giQ=";
+  };
+
+  propagatedBuildInputs = [ apron ];
+
+  meta = {
+    license = lib.licenses.asl20;
+    homepage = "https://github.com/ghilesZ/apronext";
+    description = "Extension for the OCaml interface of the apron library";
+  };
+
+})
@@ -0,0 +1,32 @@
+{
+  lib,
+  fetchFromGitHub,
+  buildDunePackage,
+  menhir,
+  apronext,
+  picasso,
+}:
+
+buildDunePackage (finalAttrs: {
+  pname = "libabsolute";
+  version = "0.3";
+
+  src = fetchFromGitHub {
+    owner = "mpelleau";
+    repo = "absolute";
+    tag = finalAttrs.version;
+    hash = "sha256-q2QxqZJn71MODJ1+Yf9m33qu8xERTqExMANqgk7aksQ=";
+  };
+
+  nativeBuildInputs = [ menhir ];
+
+  propagatedBuildInputs = [
+    apronext
+    picasso
+  ];
+  meta = {
+    license = lib.licenses.lgpl3Plus;
+    homepage = "https://github.com/mpelleau/AbSolute";
+    description = "A constraint programming library based on abstract domains";
+  };
+})
@@ -0,0 +1,26 @@
+{
+  lib,
+  fetchFromGitHub,
+  buildDunePackage,
+  apronext,
+}:
+
+buildDunePackage (finalAttrs: {
+  pname = "picasso";
+  version = "0.4";
+
+  src = fetchFromGitHub {
+    owner = "ghilesZ";
+    repo = "picasso";
+    tag = finalAttrs.version;
+    hash = "sha256-VYrN77IVXPdzPV1CNe5N4D2jgrVIHJFMvfRP6cQq/eI=";
+  };
+
+  propagatedBuildInputs = [ apronext ];
+
+  meta = {
+    description = "An Abstract element drawing library";
+    license = lib.licenses.lgpl2Plus;
+    homepage = "https://github.com/ghilesZ/picasso";
+  };
+})
@@ -9,14 +9,14 @@

 buildPythonPackage rec {
  pname = "aiosomecomfort";
-  version = "0.0.37";
+  version = "0.0.38";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "mkmer";
    repo = "AIOSomecomfort";
    tag = version;
-    hash = "sha256-xyGJsSgxE/UwTEfA2BzVHvgqG1c47/SokLHrysPkFAU=";
+    hash = "sha256-tjJazA5MFIr3Z3I8l9g6SngH6U616e9jWXfMrim2wPo=";
  };

  build-system = [
@@ -11,13 +11,14 @@

 buildPythonPackage rec {
  pname = "python-autopxd2";
-  version = "3.2.2";
+  version = "3.2.3";
  pyproject = true;
+  __structuredAttrs = true;

  src = fetchPypi {
    pname = "autopxd2";
    inherit version;
-    hash = "sha256-fzq5xy7vPjxwgaEyBXk3Ke9JnySJ3PM5WAucFCZ/IP8=";
+    hash = "sha256-Zf44gmkuWvp8lfrScq4GAhOisLYu4scyuNp1Cn3lnVc=";
  };

  build-system = [
@@ -34,6 +35,13 @@ buildPythonPackage rec {
    pytestCheckHook
  ];

+  disabledTestMarks = [
+    # downloads headers at runtime
+    "real_headers"
+    # needs clang2 python module
+    "libclang"
+  ];
+
  enabledTestPaths = [
    "test/"
  ];
@@ -358,13 +358,13 @@

 buildPythonPackage (finalAttrs: {
  pname = "boto3-stubs";
-  version = "1.43.46";
+  version = "1.43.49";
  pyproject = true;

  src = fetchPypi {
    pname = "boto3_stubs";
    inherit (finalAttrs) version;
-    hash = "sha256-dlHkPTCFXU3WqNqVSapQvlAOqnMBqfG+itIHkc4jbxw=";
+    hash = "sha256-A6jQK8hBfMl0stRkIScrU3APw0H7EENbgEuEi0jKM1c=";
  };

  build-system = [ setuptools ];
@@ -21,14 +21,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "coredis";
-  version = "6.6.1";
+  version = "6.7.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "alisaifee";
    repo = "coredis";
    tag = finalAttrs.version;
-    hash = "sha256-Jn6tqMpyk849/hwYM0DHuQnGbMltRpTXAVcN5Kt6lk4=";
+    hash = "sha256-1Ks8rfOaz7rZruzp1k3V7UHCtckzomvA76+QRS7RlZo=";
  };

  postPatch = ''
@@ -22,7 +22,7 @@

 buildPythonPackage (finalAttrs: {
  pname = "databricks-sdk";
-  version = "0.119.0";
+  version = "0.121.0";
  pyproject = true;
  __structuredAttrs = true;

@@ -30,7 +30,7 @@ buildPythonPackage (finalAttrs: {
    owner = "databricks";
    repo = "databricks-sdk-py";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-tdlFT0Rg0VGjtJ9UZSDu6zt5O+fXdmr484+3n4D0p8M=";
+    hash = "sha256-EvTh2zxQE7xSzxaipI8qeG0tK/Bnk8bDKbWKdMDO0F4=";
  };

  build-system = [
@@ -8,14 +8,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "iamdata";
-  version = "0.1.202607081";
+  version = "0.1.202607151";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "cloud-copilot";
    repo = "iam-data-python";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-5bVmdhbO2Gv4CvkZDGR/k4j9S8+vlTJXPI4hyVnyb54=";
+    hash = "sha256-MGKX+QzsXyohsRHHy4qt+H4BemgvJesKwKzi2KrETr4=";
  };

  __darwinAllowLocalNetworking = true;
@@ -25,7 +25,6 @@
  ifconfig-parser,
  pytestCheckHook,
  cherrypy,
-  importlib-resources,
  pyparsing,
  pytest-responses,
  net-tools,
@@ -74,7 +73,6 @@ buildPythonPackage rec {
  nativeCheckInputs = [
    pytestCheckHook
    cherrypy
-    importlib-resources
    pyparsing
    pytest-responses
  ]
@@ -16,14 +16,14 @@

 buildPythonPackage rec {
  pname = "msgraph-core";
-  version = "1.4.0";
+  version = "1.5.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "microsoftgraph";
    repo = "msgraph-sdk-python-core";
    tag = "v${version}";
-    hash = "sha256-1fgLW6tpaDMOIaAU92ty9JYx/bZxDs4VjNPDCPIze/A=";
+    hash = "sha256-oF9ipN8jEMFeC4b0jGlNPQWsk8/dTAmLzS4R/xfXZfk=";
  };

  build-system = [ setuptools ];
@@ -335,8 +335,8 @@ in
      "sha256-3JYcWKFk0dKJg/qn+EBvxeAO5xh5PXCU3dTEWDr1oXI=";

  mypy-boto3-connect =
-    buildMypyBoto3Package "connect" "1.43.45"
-      "sha256-HLKYdoO/ueyNxBEzAj6Rgzvzvcid7PPgjrzdNxmWF5s=";
+    buildMypyBoto3Package "connect" "1.43.48"
+      "sha256-M6zWE3yVBrBVpZqbftDuTIOUwmwmvbV/JLIZ0GDnBms=";

  mypy-boto3-connect-contact-lens =
    buildMypyBoto3Package "connect-contact-lens" "1.43.0"
@@ -423,8 +423,8 @@ in
      "sha256-67KqkSc8oUjKhuvQW6glmb211JZd+xkF03Mt8FISE8k=";

  mypy-boto3-drs =
-    buildMypyBoto3Package "drs" "1.43.0"
-      "sha256-1cKleN7L5xTlQCPq3OKiSQcnkeooPKS1AqIg1sBXOMk=";
+    buildMypyBoto3Package "drs" "1.43.48"
+      "sha256-tuVUCFE6CpcuKu9+hEOev1iIHqP3WFf9Ho4BTSvoMd8=";

  mypy-boto3-ds =
    buildMypyBoto3Package "ds" "1.43.0"
@@ -491,16 +491,16 @@ in
      "sha256-ft2sKNwhMdRhms/ZXOetpR/gnB3YNYGsbQWQySagk2E=";

  mypy-boto3-elbv2 =
-    buildMypyBoto3Package "elbv2" "1.43.0"
-      "sha256-duh/9/eUhdVkmkEgdf5EB5nbp/TlXQQLMMAorlYPRu8=";
+    buildMypyBoto3Package "elbv2" "1.43.49"
+      "sha256-j2IENj3FybRDIuhTUrKD3wbmhFbvy5XyZFHC//a+duk=";

  mypy-boto3-emr =
    buildMypyBoto3Package "emr" "1.43.23"
      "sha256-eaShKsX1+JR8ZOm70f1bMkUeJB/NEhq1xVOpCu4AGGA=";

  mypy-boto3-emr-containers =
-    buildMypyBoto3Package "emr-containers" "1.43.0"
-      "sha256-fvFFfq6wf98uG59Zb4dQFIx+i+NH14zn94lX7jwKPkI=";
+    buildMypyBoto3Package "emr-containers" "1.43.48"
+      "sha256-yEvsOJzD5qVgWSvpJN2Whaw031yfmLituv1Wo/Ctmc0=";

  mypy-boto3-emr-serverless =
    buildMypyBoto3Package "emr-serverless" "1.43.24"
@@ -511,8 +511,8 @@ in
      "sha256-vJVCkj3pNY8p6UKnr1zdMy8um84ONHYEYG2izkVaNA8=";

  mypy-boto3-es =
-    buildMypyBoto3Package "es" "1.43.7"
-      "sha256-ECDgtsDWKJGlXAI0KrwcVwDO3mqkHMm7wdW6pSVQ0hk=";
+    buildMypyBoto3Package "es" "1.43.47"
+      "sha256-5oCX/SqzPteV6nkys8NQXuFB5AX9VURIidU4MBmJil8=";

  mypy-boto3-events =
    buildMypyBoto3Package "events" "1.43.0"
@@ -559,8 +559,8 @@ in
      "sha256-4roB3AEdN4zXGceUNkrmarmTThmPbS9SltvHG6kF+84=";

  mypy-boto3-gamelift =
-    buildMypyBoto3Package "gamelift" "1.43.33"
-      "sha256-OVgUWPp91lYeOXZpFDYRiRxxLWt6xbI6Ib2aozMu2eU=";
+    buildMypyBoto3Package "gamelift" "1.43.47"
+      "sha256-RG+oi43/mshz3rbssYLfx6lI7VN5E7VHMiA7vFavJP4=";

  mypy-boto3-glacier =
    buildMypyBoto3Package "glacier" "1.43.0"
@@ -590,16 +590,16 @@ in
      "sha256-+DDeD9YWo98meLZU2Mzu5AE0S7HFg6kfxeUWUh9XcQA=";

  mypy-boto3-guardduty =
-    buildMypyBoto3Package "guardduty" "1.43.45"
-      "sha256-i/5xOzymGSnyYznSODZCBgCZM1JRXz7R9VKU71J9yNs=";
+    buildMypyBoto3Package "guardduty" "1.43.47"
+      "sha256-0+dEQ+FP/r1o+8XTKS/wG67RLb9euBEaU3dz4m4r4GI=";

  mypy-boto3-health =
    buildMypyBoto3Package "health" "1.43.0"
      "sha256-UHDodWN6MLV54LA31Pc7vlMr7a0tVrmCfVjXl96cjsE=";

  mypy-boto3-healthlake =
-    buildMypyBoto3Package "healthlake" "1.43.33"
-      "sha256-KBy7YsMMoTw7A+HPAA4hFKJ/cesmuBuiucPuCGkTlgI=";
+    buildMypyBoto3Package "healthlake" "1.43.49"
+      "sha256-oPQuxAKSUTpHGyq1J80W57cISh+d+4IGN8ClJdhkfnw=";

  mypy-boto3-iam =
    buildMypyBoto3Package "iam" "1.43.29"
@@ -766,8 +766,8 @@ in
      "sha256-gYTCgaRwH3zKi6gg4MC8DUwXQT+jZO6lqc/vi+JUahU=";

  mypy-boto3-lambda =
-    buildMypyBoto3Package "lambda" "1.43.46"
-      "sha256-mM1VwviZXBkkjd5PBEpJKZSDCoyV6VH26erz78gJKSk=";
+    buildMypyBoto3Package "lambda" "1.43.48"
+      "sha256-94PUbPDQAeunE7As6Yo5Vv+Q9KAt/phsDde6wyA0ywc=";

  mypy-boto3-lex-models =
    buildMypyBoto3Package "lex-models" "1.43.3"
@@ -926,8 +926,8 @@ in
      "sha256-Xn8quvaU8HAJKLiUuh7vGqy6j/VYWrrdwAEuMnFSdzw=";

  mypy-boto3-mq =
-    buildMypyBoto3Package "mq" "1.43.32"
-      "sha256-8O4z5OB5E/NbmM+hLvtJ6MmArl/Nub9HwkYmaWiGb6s=";
+    buildMypyBoto3Package "mq" "1.43.48"
+      "sha256-ALT7Le8lS4EXFe1a92z0t0iT8aYKOxJS5EGic/7hwC8=";

  mypy-boto3-mturk =
    buildMypyBoto3Package "mturk" "1.43.0"
@@ -1002,8 +1002,8 @@ in
      "sha256-R+9NhCyUKOhMZCyWll1kilbBGlcNfpqEXgQVskDo/nU=";

  mypy-boto3-payment-cryptography-data =
-    buildMypyBoto3Package "payment-cryptography-data" "1.43.12"
-      "sha256-SvSi3Mzf+Er3keeO4BeeIrfPKkzwZtKENKuAbaEz28c=";
+    buildMypyBoto3Package "payment-cryptography-data" "1.43.49"
+      "sha256-7qCpo7OktzpZtZosFM9e1ygUPhcYFmShD67ngrG5Wf0=";

  mypy-boto3-pca-connector-ad =
    buildMypyBoto3Package "pca-connector-ad" "1.43.0"
@@ -1082,8 +1082,8 @@ in
      "sha256-ZmYC3YQujmfSUK0pOGCGFwT7LrSa3oJfo9juUb+2Xpk=";

  mypy-boto3-rds =
-    buildMypyBoto3Package "rds" "1.43.30"
-      "sha256-VEWtNjsbdzYKdYufG0PrdMi9+kb4JxLvzsPo9DombYc=";
+    buildMypyBoto3Package "rds" "1.43.49"
+      "sha256-9NLdqD2ZtmgngemY5IKhIxcC+mSgQ1DkB5hqno4cOdo=";

  mypy-boto3-rds-data =
    buildMypyBoto3Package "rds-data" "1.43.37"
@@ -1098,8 +1098,8 @@ in
      "sha256-N8VjcHLbK2bd2Nd338HZvA3gfoSN581qMsbIjkdv1QI=";

  mypy-boto3-redshift-serverless =
-    buildMypyBoto3Package "redshift-serverless" "1.43.0"
-      "sha256-wDNJZO9wawzUzfDG7Qo7If/J1wUhrqNxklBEv4Wd4dg=";
+    buildMypyBoto3Package "redshift-serverless" "1.43.47"
+      "sha256-VaYGoE0AFuPeosL6DzjUMOL057iZw65IUQfG85aEjAo=";

  mypy-boto3-rekognition =
    buildMypyBoto3Package "rekognition" "1.43.0"
@@ -1218,8 +1218,8 @@ in
      "sha256-Jl7i/d+dPkKuOWhWJft4YaU5EQ2OMkNyhHwOHL1mayA=";

  mypy-boto3-securityhub =
-    buildMypyBoto3Package "securityhub" "1.43.42"
-      "sha256-cSOykgzNlSiXXnwyTF7MRWNhk4v83kabdJJ9FtIq108=";
+    buildMypyBoto3Package "securityhub" "1.43.48"
+      "sha256-R05c+bDVzi1NNW03CTkORKYhbiPyajsjn88BRx3RNJw=";

  mypy-boto3-securitylake =
    buildMypyBoto3Package "securitylake" "1.43.0"
@@ -1242,8 +1242,8 @@ in
      "sha256-tX0woQcWoUOPKxSthE9p2rs1gsiA57DJY4JgreeAt0c=";

  mypy-boto3-servicediscovery =
-    buildMypyBoto3Package "servicediscovery" "1.43.0"
-      "sha256-g1TsUJgdMpo1Sf8rPcmVi0ZNnTRmuqAKFz6LbMuZrp8=";
+    buildMypyBoto3Package "servicediscovery" "1.43.48"
+      "sha256-F0UEyBR8QZyFfB5REL9P5z0zsZNhcddgxksj/tE+GXQ=";

  mypy-boto3-ses =
    buildMypyBoto3Package "ses" "1.43.0"
@@ -1290,8 +1290,8 @@ in
      "sha256-Psjh5lHoMK/89/4VGy4wkLjqmNc8sGkFOwnKTH9MhjY=";

  mypy-boto3-ssm =
-    buildMypyBoto3Package "ssm" "1.43.42"
-      "sha256-HVyE4b0DZMpnCC0uzAC2HAnFioMgif7aeUZHg3zm05A=";
+    buildMypyBoto3Package "ssm" "1.43.48"
+      "sha256-5qAQOqzTY/iUoUl5NCmbL7Ldpsvev1KLCgN6HqfUjnc=";

  mypy-boto3-ssm-contacts =
    buildMypyBoto3Package "ssm-contacts" "1.43.0"
@@ -14,17 +14,17 @@
  setuptools,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "nbxmpp";
-  version = "7.2.0";
+  version = "7.3.0";
  pyproject = true;

  src = fetchFromGitLab {
    domain = "dev.gajim.org";
    owner = "gajim";
    repo = "python-nbxmpp";
-    tag = version;
-    hash = "sha256-OtJzCcaqcy2a46iNRcpknORgdTbzMtILocs5c6Akzrc=";
+    tag = finalAttrs.version;
+    hash = "sha256-UsWCZ5g7LJImqc32kBfyLaGrT3DKsl8/muWUbPufmXs=";
  };

  nativeBuildInputs = [
@@ -50,8 +50,9 @@ buildPythonPackage rec {

  meta = {
    homepage = "https://dev.gajim.org/gajim/python-nbxmpp";
+    changelog = "https://dev.gajim.org/gajim/python-nbxmpp/-/blob/${finalAttrs.src.tag}/ChangeLog";
    description = "Non-blocking Jabber/XMPP module";
    license = lib.licenses.gpl3Plus;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ haansn08 ];
  };
-}
+})
@@ -8,7 +8,7 @@

 buildPythonPackage (finalAttrs: {
  pname = "oelint-data";
-  version = "1.5.9";
+  version = "1.5.10";
  pyproject = true;
  __structuredAttrs = true;

@@ -16,7 +16,7 @@ buildPythonPackage (finalAttrs: {
    owner = "priv-kweihmann";
    repo = "oelint-data";
    tag = finalAttrs.version;
-    hash = "sha256-kVTuRhP9T6kyhgavLsKtxNQz/7fW7LYDLR23rj+WGRM=";
+    hash = "sha256-8lz1Y0lbsrFPJNWWaxSVFSpd23L5MODe71n+VknfPy8=";
  };

  build-system = [
@@ -13,14 +13,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "oelint-parser";
-  version = "8.11.5";
+  version = "8.11.6";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "priv-kweihmann";
    repo = "oelint-parser";
    tag = finalAttrs.version;
-    hash = "sha256-DwbpF1H5fY854YKqB/8ppg6gMS2VhMzoyY8yr/DsfBk=";
+    hash = "sha256-lRfSrWZqkTsDjJzYXg4juPpxmrHHp3hvatyN3TdPAVw=";
  };

  pythonRelaxDeps = [ "regex" ];
@@ -36,6 +36,12 @@ buildPythonPackage {

  enabledTestPaths = [ "tests" ];

+  disabledTests = [
+    # Timing-sensitive
+    "test_retry_info_is_respected"
+    "test_timeout_set_correctly"
+  ];
+
  pythonImportsCheck = [ "opentelemetry.exporter.otlp.proto.grpc" ];

  __darwinAllowLocalNetworking = true;
@@ -10,14 +10,14 @@

 buildPythonPackage rec {
  pname = "pydemumble";
-  version = "0.0.1";
+  version = "0.1.2";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "angr";
    repo = "pydemumble";
    tag = "v${version}";
-    hash = "sha256-JAUMTOYGHu64L0zLK2dzf0poHrGGiE29WoAR5kRsR+s=";
+    hash = "sha256-c6jKnWsB8Do076eiMQXNo0JNCiLNh9iMohEnBAf+YW8=";
    fetchSubmodules = true;
  };

@@ -19,14 +19,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "python-bsblan";
-  version = "6.1.6";
+  version = "6.1.7";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "liudger";
    repo = "python-bsblan";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-1nq1m1jGks4YPn64pUz8lKlES2PwvdfsMlRFYiAEbYg=";
+    hash = "sha256-ZjhGFEJOUyRz2RKCok/CT0ytInY1juHDqKurGsO5KFo=";
  };

  postPatch = ''
@@ -30,14 +30,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "requests-cache";
-  version = "1.3.2";
+  version = "1.3.3";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "requests-cache";
    repo = "requests-cache";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-qil5z54kkxu8QlPQ2P/7jo+VyfC+KhhiSUyAVmuLG/o=";
+    hash = "sha256-iqoP7NalipY3BXMQkh+lrzPtPQehYg3bB/3azgx0iuo=";
  };

  build-system = [ hatchling ];
@@ -9,14 +9,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "tencentcloud-sdk-python";
-  version = "3.1.132";
+  version = "3.1.133";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "TencentCloud";
    repo = "tencentcloud-sdk-python";
    tag = finalAttrs.version;
-    hash = "sha256-jfjArHN7+HARacfaePaP6+LsXNFK1uOHGoylc4FO46I=";
+    hash = "sha256-E9xxurSGAvJd4f2CGxI8IR9mSGTwGpOLqNMSEhrhOXY=";
  };

  build-system = [ setuptools ];
@@ -15,11 +15,11 @@ assert lib.versionAtLeast ocaml.version "4.08.0";

 stdenv.mkDerivation (finalAttrs: {
  pname = "opam";
-  version = "2.5.1";
+  version = "2.5.2";

  src = fetchurl {
    url = "https://github.com/ocaml/opam/releases/download/${finalAttrs.version}/opam-full-${finalAttrs.version}.tar.gz";
-    hash = "sha256-SMW/r19cQEjMX0ACXec4X1utOoJpdWIWzW3S8hUAM+0=";
+    hash = "sha256-s2I4CVZ/Ge1rXWebjHu8C97JQYv/Sodf8HmdRG2FVcM=";
  };

  strictDeps = true;
@@ -976,12 +976,12 @@ in
  tokyo-night-tmux = mkTmuxPlugin {
    pluginName = "tokyo-night-tmux";
    rtpFilePath = "tokyo-night.tmux";
-    version = "1.6.6";
+    version = "1.8.1";
    src = pkgs.fetchFromGitHub {
      owner = "janoamaral";
      repo = "tokyo-night-tmux";
-      rev = "caf6cbb4c3a32d716dfedc02bc63ec8cf238f632";
-      hash = "sha256-TOS9+eOEMInAgosB3D9KhahudW2i1ZEH+IXEc0RCpU0=";
+      rev = "a39e00bf01fea05f916e4b7707bad5e64adee02c";
+      hash = "sha256-tmS0MBANSsTg53E2GB0TnjwGcZXboTRFNeDE6Ehn+bM=";
    };
    meta = {
      homepage = "https://github.com/janoamaral/tokyo-night-tmux";
@@ -10,7 +10,7 @@ let
  rev-prefix = "ena_linux_";
 in
 stdenv.mkDerivation (finalAttrs: {
-  version = "2.17.0";
+  version = "2.17.2";
  pname = "ena";
  name = "${finalAttrs.pname}-${finalAttrs.version}-${kernel.version}";

@@ -18,7 +18,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "amzn";
    repo = "amzn-drivers";
    rev = "${rev-prefix}${finalAttrs.version}";
-    hash = "sha256-Yt8fF73lN5+wKEMtiSFToJMLv63EkfZI/WJfC9ae8H8=";
+    hash = "sha256-v/b4P5twRFaqjkeuXy6UhjnRCxVZ6+Muk80653uXnsY=";
  };

  hardeningDisable = [ "pic" ];
@@ -13,13 +13,13 @@
 buildHomeAssistantComponent (finalAttrs: {
  owner = "skye-harris";
  domain = "llm_intents";
-  version = "1.8.2";
+  version = "1.8.3";

  src = fetchFromGitHub {
    inherit (finalAttrs) owner;
    repo = "llm_intents";
    tag = finalAttrs.version;
-    hash = "sha256-UYWt+PpG0M1DE1nHqLJ/npp29JyfNz19Pyb1Jv3LM48=";
+    hash = "sha256-WqPemaBKTiOiO3nT0PDQqhRMjvLAA3WNOGM1stbapBE=";
  };

  dependencies = [
@@ -2,8 +2,8 @@

 grafanaPlugin {
  pname = "victoriametrics-metrics-datasource";
-  version = "0.25.1";
-  zipHash = "sha256-6+XUzT0vSVd4u8UeRSa/Px7vDjwQ7YkOmArFNZBY5ts=";
+  version = "0.25.2";
+  zipHash = "sha256-yHvzgimj49NCa2A1cm9W6AYwlXsVQXwBY6t7C72DuyU=";
  meta = {
    description = "VictoriaMetrics metrics datasource for Grafana";
    license = lib.licenses.agpl3Only;
@@ -2089,8 +2089,6 @@ with pkgs;

  gnucap-full = gnucap.withPlugins (p: [ p.verilog ]);

-  gnugrep = callPackage ../tools/text/gnugrep { };
-
  gnupg1compat = callPackage ../tools/security/gnupg/1compat.nix { };
  gnupg1 = gnupg1compat; # use config.packageOverrides if you prefer original gnupg1

@@ -52,12 +52,16 @@ let

        angstrom-unix = callPackage ../development/ocaml-modules/angstrom-unix { };

+        ansi = callPackage ../development/ocaml-modules/ansi { };
+
        ansiterminal = callPackage ../development/ocaml-modules/ansiterminal { };

        ao = callPackage ../development/ocaml-modules/ao { };

        apron = callPackage ../development/ocaml-modules/apron { };

+        apronext = callPackage ../development/ocaml-modules/apronext { };
+
        argon2 = callPackage ../development/ocaml-modules/argon2 { };

        arg-complete = callPackage ../development/ocaml-modules/arg-complete { };
@@ -1125,6 +1129,8 @@ let

        letters = callPackage ../development/ocaml-modules/letters { };

+        libabsolute = callPackage ../development/ocaml-modules/libabsolute { };
+
        libc = callPackage ../development/ocaml-modules/libc { };

        lilv = callPackage ../development/ocaml-modules/lilv {
@@ -1763,6 +1769,8 @@ let

        piaf = callPackage ../development/ocaml-modules/piaf { };

+        picasso = callPackage ../development/ocaml-modules/picasso { };
+
        piqi = callPackage ../development/ocaml-modules/piqi { };

        piqi-ocaml = callPackage ../development/ocaml-modules/piqi-ocaml { };
@@ -18399,10 +18399,10 @@ with self;

  JavaScriptMinifierXS = buildPerlPackage {
    pname = "JavaScript-Minifier-XS";
-    version = "0.15";
+    version = "0.16";
    src = fetchurl {
-      url = "mirror://cpan/authors/id/G/GT/GTERMARS/JavaScript-Minifier-XS-0.15.tar.gz";
-      hash = "sha256-XZsDT1jwtv9bZGR708WpzgWypw7e4zn7wxc67nR8wFA=";
+      url = "mirror://cpan/authors/id/G/GT/GTERMARS/JavaScript-Minifier-XS-0.16.tar.gz";
+      hash = "sha256-dQNOh2k568PdSM4uuvBgRLBu1XqzoYY/BT+VDphNmVQ=";
    };
    buildInputs = [ TestDiagINC ];
    meta = {