Merge staging-next into staging

2025-05-06 12:07:56 +00:00
parent 091b1f1944 776a17e1f5
commit 527e9cfcc4
89 changed files with 2285 additions and 344 deletions
@@ -10,6 +10,10 @@
      "extraNixConfig": "experimental-features = nix-command flakes,sandbox = true"
    }
  },
+  // Fixup permissions inside container.
+  // https://github.com/NixOS/nix/issues/6680#issuecomment-1230902525
+  "postCreateCommand": "sudo apt-get install -y acl",
+  "postStartCommand": "sudo setfacl -k /tmp; if [ -e /dev/kvm ]; then sudo chgrp $(id -g) /dev/kvm; fi",
  "customizations": {
    "vscode": {
      "extensions": [
@@ -24738,10 +24738,10 @@
    name = "Travis Whitton";
  };
  tmplt = {
-    email = "tmplt@dragons.rocks";
+    email = "v@tmplt.dev";
    github = "tmplt";
    githubId = 6118602;
-    name = "Viktor";
+    name = "Viktor Sonesten";
  };
  tmssngr = {
    email = "nixpkgs@syntevo.com";
@@ -21,7 +21,8 @@ let
    pname = "dbee-bin";
    inherit version;

-    src = "${src}/dbee";
+    inherit src;
+    sourceRoot = "${src.name}/dbee";

    vendorHash = "sha256-U/3WZJ/+Bm0ghjeNUILsnlZnjIwk3ySaX3Rd4L9Z62A=";
    buildInputs = [
@@ -51,7 +52,7 @@ vimUtils.buildVimPlugin {

  passthru = {
    updateScript = nix-update-script {
-      attrPath = "vimPlugins.nvim-dbee.dbee-lib";
+      attrPath = "vimPlugins.nvim-dbee.dbee-bin";
    };

    # needed for the update script
@@ -30,6 +30,7 @@
  utf8proc,
  versionCheckHook,
  which,
+  wrapQtAppsHook,
  writeScript,
  zlib,
 }:
@@ -72,8 +73,6 @@ stdenv.mkDerivation rec {
    "USE_SYSTEM_LIB_ZLIB=1"
  ];

-  dontWrapQtApps = true;
-
  # https://docs.mamedev.org/initialsetup/compilingmame.html
  buildInputs =
    [
@@ -110,6 +109,7 @@ stdenv.mkDerivation rec {
    pkg-config
    python3
    which
+    wrapQtAppsHook
  ];

  patches = [
@@ -8,13 +8,13 @@

 stdenvNoCC.mkDerivation (self: {
  pname = "alacritty-theme";
-  version = "0-unstable-2025-03-20";
+  version = "0-unstable-2025-04-30";

  src = fetchFromGitHub {
    owner = "alacritty";
    repo = "alacritty-theme";
-    rev = "86c578469e2bf784faf6f916883bf48349ff4f6d";
-    hash = "sha256-0phAQvPPiwE7MneaN7XoLZKPgAIDGYf3fYvYUjhbts8=";
+    rev = "2f97742d8d7c65f5b0562d124c1efd5e28294a97";
+    hash = "sha256-zc/saPCspfLA9mddnRmFiqYfdmBs/o5bgnQlD5lm7Ls=";
    sparseCheckout = [ "themes" ];
  };

@@ -3,27 +3,37 @@
  fetchFromGitHub,
  rustPlatform,
  protobuf_26,
+  versionCheckHook,
 }:

-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
  pname = "amazon-q-cli";
-  version = "1.8.0";
+  version = "1.9.1";

  src = fetchFromGitHub {
    owner = "aws";
    repo = "amazon-q-developer-cli";
-    tag = "v${version}";
-    hash = "sha256-fOz9oz+xNwX2Bzl6szgQ9oai6lqP+EzbaCNzHPUT2cA=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-BiVCiMBL5LLm8RYw58u6P7yqQq9XnN8b6fTbxNE2QsA=";
  };

  useFetchCargoVendor = true;

-  cargoHash = "sha256-H9bCke3vQDuS6RDEg8dzeFiBWCex64A8KSRhfgyp8e8=";
+  cargoHash = "sha256-7zUgWLGTZx3Ex7RYxb3eZimWdy6AxkNwpCDUwiAr2JE=";

  cargoBuildFlags = [
    "-p"
    "q_cli"
  ];
+
+  nativeBuildInputs = [
+    protobuf_26
+  ];
+
+  postInstall = ''
+    install -m 0755 $out/bin/q_cli $out/bin/amazon-q
+  '';
+
  cargoTestFlags = [
    "-p"
    "q_cli"
@@ -52,13 +62,10 @@ rustPlatform.buildRustPackage rec {
    "--skip=init_lint_zsh_pre_zshrc"
  ];

-  nativeBuildInputs = [
-    protobuf_26
-  ];
-
-  postInstall = ''
-    mv $out/bin/q_cli $out/bin/amazon-q
-  '';
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgram = "${placeholder "out"}/bin/amazon-q";
+  versionCheckProgramArg = "--version";

  meta = {
    description = "Amazon Q Developer AI coding agent CLI";
@@ -67,7 +74,8 @@ rustPlatform.buildRustPackage rec {
      mit
      asl20
    ];
+    mainProgram = "amazon-q";
    maintainers = [ lib.maintainers.jamesward ];
    platforms = lib.platforms.linux;
  };
-}
+})
@@ -6,14 +6,14 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "calcure";
-  version = "3.1";
+  version = "3.2.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "anufrievroman";
    repo = "calcure";
    tag = version;
-    hash = "sha256-ufrJbc3WMY88VEsUHlWxQ1m0iupts4zNusvQL8YAqJc=";
+    hash = "sha256-YFX70gtNcIXG5XIuMlz47nmtjt/2oHzi6cajcj+DAyQ=";
  };

  nativeBuildInputs = with python3.pkgs; [
@@ -35,7 +35,7 @@ python3.pkgs.buildPythonApplication rec {
    description = "Modern TUI calendar and task manager with minimal and customizable UI";
    mainProgram = "calcure";
    homepage = "https://github.com/anufrievroman/calcure";
-    changelog = "https://github.com/anufrievroman/calcure/releases/tag/${version}";
+    changelog = "https://github.com/anufrievroman/calcure/releases/tag/${src.tag}";
    license = licenses.mit;
    maintainers = with maintainers; [ dit7ya ];
  };
@@ -6,7 +6,7 @@
  fetchFromGitHub,
  cmake,
  freedvSupport ? false,
-  lpcnetfreedv,
+  lpcnet,
 }:

 stdenv.mkDerivation (finalAttrs: {
@@ -37,7 +37,7 @@ stdenv.mkDerivation (finalAttrs: {
  ];

  buildInputs = lib.optionals freedvSupport [
-    lpcnetfreedv
+    lpcnet
  ];

  # we need to unset these variables from stdenv here and then set their equivalents in the cmake flags
@@ -10,13 +10,13 @@

 buildGoModule (finalAttrs: {
  pname = "databricks-cli";
-  version = "0.249.0";
+  version = "0.250.0";

  src = fetchFromGitHub {
    owner = "databricks";
    repo = "cli";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-DNa/ovllWJwsja8+QXP4Z38NE2uO99kHFQsXAEbKciQ=";
+    hash = "sha256-AqXwlt7Aqi0cRoDiUfE1LFOJqtRmySuA6D4RMYOonU4=";
  };

  # Otherwise these tests fail asserting that the version is 0.0.0-dev
@@ -25,7 +25,7 @@ buildGoModule (finalAttrs: {
      --replace-fail "cli/0.0.0-dev" "cli/${finalAttrs.version}"
  '';

-  vendorHash = "sha256-Nj9oQryh3tsXUoIPunl5EXKkWeT76zGTsdFaK0UuNVY=";
+  vendorHash = "sha256-tpm7eCjJuRpVnZfMZais1bHVhnQ8DxchaN1/7ljKNOo=";

  excludedPackages = [
    "bundle/internal"
@@ -6,16 +6,16 @@
 }:
 rustPlatform.buildRustPackage rec {
  pname = "firezone-gateway";
-  version = "1.4.6";
+  version = "1.4.8";
  src = fetchFromGitHub {
    owner = "firezone";
    repo = "firezone";
    tag = "gateway-${version}";
-    hash = "sha256-ra5ZWPwNhyZEc9pBkcITvQyomgQ22yiWI16dnv1Fm3E=";
+    hash = "sha256-C5zCo9G21xrrPzabD/8Tiil8D1RlRG8+3/jLTf5/pTQ=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-5B9nvFanHXZV8p8m2vsRLC5pSzwL2lX+V651oV8joJs=";
+  cargoHash = "sha256-eJfRTtLHYOc3M3dOP/VvrC6Qm2ovoR6LQSgCPwntc1M=";
  sourceRoot = "${src.name}/rust";
  buildAndTestSubdir = "gateway";
  RUSTFLAGS = "--cfg system_certs";
@@ -24,12 +24,12 @@
  copyDesktopItems,
 }:
 let
-  version = "1.4.9";
+  version = "1.4.12";
  src = fetchFromGitHub {
    owner = "firezone";
    repo = "firezone";
    tag = "gui-client-${version}";
-    hash = "sha256-nOf7+48WUzQ7VmP7PFo07ZhtgyG7VOI/Hb/rXyBU5o0=";
+    hash = "sha256-jvrkAbXHFWdNInDCrktC7eMZQ2a/rzUxfCOny7nHQmQ=";
  };

  frontend = stdenvNoCC.mkDerivation rec {
@@ -39,7 +39,7 @@ let
    pnpmDeps = pnpm_9.fetchDeps {
      inherit pname version;
      src = "${src}/rust/gui-client";
-      hash = "sha256-9ywC920EF6UxkXHs+0WWaU8fr5J35/C+0nNGbSVHESE=";
+      hash = "sha256-bVWpyGwEaxYi3N6BJqOilnHJDgAykKHgRC2QKlvSm4Q=";
    };
    pnpmRoot = "rust/gui-client";

@@ -73,7 +73,7 @@ rustPlatform.buildRustPackage rec {
  inherit version src;

  useFetchCargoVendor = true;
-  cargoHash = "sha256-ltxyI3Xoute0/HHXYU4XdFjcQ9zSLx6ZzAZFEjDk6zw=";
+  cargoHash = "sha256-YETCRhECbMTRmNsvOFl7R2YScY6ArjsOYJKdPVuUyGI=";
  sourceRoot = "${src.name}/rust";
  buildAndTestSubdir = "gui-client";
  RUSTFLAGS = "--cfg system_certs";
@@ -6,16 +6,16 @@
 }:
 rustPlatform.buildRustPackage rec {
  pname = "firezone-headless-client";
-  version = "1.4.6";
+  version = "1.4.7";
  src = fetchFromGitHub {
    owner = "firezone";
    repo = "firezone";
    tag = "headless-client-${version}";
-    hash = "sha256-ra5ZWPwNhyZEc9pBkcITvQyomgQ22yiWI16dnv1Fm3E=";
+    hash = "sha256-2zRuOY8D6NEopKg13bvJoTR7uXZ4wm40VFvR3NRKqJc=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-5B9nvFanHXZV8p8m2vsRLC5pSzwL2lX+V651oV8joJs=";
+  cargoHash = "sha256-YETCRhECbMTRmNsvOFl7R2YScY6ArjsOYJKdPVuUyGI=";
  sourceRoot = "${src.name}/rust";
  buildAndTestSubdir = "headless-client";
  RUSTFLAGS = "--cfg system_certs";
@@ -9,16 +9,16 @@

 buildGoModule rec {
  pname = "flyctl";
-  version = "0.3.106";
+  version = "0.3.110";

  src = fetchFromGitHub {
    owner = "superfly";
    repo = "flyctl";
    rev = "v${version}";
-    hash = "sha256-RGpf9R5tEss5gD/WfZ/wWRNPGJiFpUvcTX7H+cfjPzg=";
+    hash = "sha256-zZlTVpqW96SSY1Lsgyax8bJ1VfErPet8YX5nUep8Auo=";
  };

-  vendorHash = "sha256-QaCBeSCaA5MyagpAG5SC46YefhQD1UgFqK5jo0UqnUo=";
+  vendorHash = "sha256-QrjK5p5eCfQ4eEgaUhUq4Ps1E8ZPee0698a7tGZYHWo=";

  subPackages = [ "." ];

@@ -0,0 +1,47 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+
+  # Build the FMUs following the latest FMI standard
+  FMIVersion ? 3,
+}:
+
+# C.f. <https://fmi-standard.org/>
+assert lib.asserts.assertMsg (
+  FMIVersion >= 1 && FMIVersion <= 3
+) "FMIVersion must be a valid FMI specification standard: 1, 2, or 3; not ${toString FMIVersion}";
+
+# NB: this derivation does not package the fmusim executables, only
+# the FMUs.
+stdenv.mkDerivation (finalAttrs: {
+  pname = "reference-fmus";
+  version = "0.0.38";
+  src = fetchFromGitHub {
+    owner = "modelica";
+    repo = finalAttrs.pname;
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-FeDKYcm9K670q1FGqy41Tp2Ag8p2JidH4z78zpHOngw=";
+  };
+
+  nativeBuildInputs = [ cmake ];
+
+  cmakeFlags = [
+    "-DFMI_VERSION=${toString FMIVersion}"
+    (lib.cmakeBool "WITH_FMUSIM" false)
+  ];
+  CFLAGS = lib.optionalString (FMIVersion == 3) "-Wno-stringop-truncation";
+
+  meta = {
+    # CMakeLists.txt explicitly states support for aarch64-darwin, but
+    # the build fails in a Nix environment. C.f.
+    # <https://github.com/NixOS/nixpkgs/pull/397658#issuecomment-2851958172>.
+    broken = with stdenv.hostPlatform; isAarch64 && isDarwin;
+    description = "Functional Mock-up Units for development, testing and debugging";
+    homepage = "https://github.com/modelica/Reference-FMUs";
+    license = lib.licenses.bsd2;
+    maintainers = with lib.maintainers; [ tmplt ];
+    platforms = lib.platforms.all;
+  };
+})
@@ -11,7 +11,7 @@
  libpulseaudio,
  libsamplerate,
  libsndfile,
-  lpcnetfreedv,
+  lpcnet,
  portaudio,
  speexdsp,
  hamlib_4,
@@ -54,7 +54,7 @@ stdenv.mkDerivation (finalAttrs: {
    codec2
    libsamplerate
    libsndfile
-    lpcnetfreedv
+    lpcnet
    speexdsp
    hamlib_4
    wxGTK32
@@ -19,19 +19,19 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "gancio";
-  version = "1.25.1";
+  version = "1.26.1";

  src = fetchFromGitLab {
    domain = "framagit.org";
    owner = "les";
    repo = "gancio";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-fkX9L7SG3WNmobIxclX7LQUOxBhX70EZSgWMmK9qf5c=";
+    hash = "sha256-i69sne2kkimAuwYZb0r7LfoVOdl8v4hN0s4PzgELOrk=";
  };

  offlineCache = fetchYarnDeps {
    yarnLock = finalAttrs.src + "/yarn.lock";
-    hash = "sha256-b6eEEwAVjqebBNBR9V2KCPDpoJcs2HAWQJ+eAb6zVIc=";
+    hash = "sha256-Jvp45pKeqyQN8lb8rzTryOGDTVwnETOw8OEUUnOPjEE=";
  };

  nativeBuildInputs = [
@@ -2,10 +2,6 @@
  stdenv,
  fetchFromGitHub,
  lib,
-  zsh,
-  coreutils,
-  inetutils,
-  procps,
  txt2tags,
 }:
 stdenv.mkDerivation rec {
@@ -21,11 +17,6 @@ stdenv.mkDerivation rec {

  strictDeps = true;
  nativeBuildInputs = [ txt2tags ];
-  buildInputs = [
-    zsh
-    coreutils
-    procps
-  ] ++ lib.optional stdenv.hostPlatform.isLinux inetutils;

  buildPhase = ''
    cd doc
@@ -5,14 +5,14 @@
 }:
 buildGoModule rec {
  pname = "honeymarker";
-  version = "0.2.1";
-  vendorHash = "sha256-ZuDobjC/nizZ7G0o/zVTQmDfDjcdBhfPcmkhgwFc7VU=";
+  version = "0.2.12";
+  vendorHash = "sha256-jtDjy8Y2S5/Ujtv+dtoRZ4SP66sSP7yer97fwdNZEpg=";

  src = fetchFromGitHub {
    owner = "honeycombio";
    repo = "honeymarker";
    rev = "v${version}";
-    hash = "sha256-tiwX94CRvXnUYpiux94XhOj2abn1Uc+wjcDOmw79ab4=";
+    hash = "sha256-28NCAtx3MHlwm44IUlI0DzUaycH9cPN8ZdEhhQtdciU=";
  };

  meta = with lib; {
@@ -41,13 +41,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "icewm";
-  version = "3.7.3";
+  version = "3.7.4";

  src = fetchFromGitHub {
    owner = "ice-wm";
    repo = "icewm";
    tag = finalAttrs.version;
-    hash = "sha256-A9LLVIU00ddINMiiuBapp4dc4/w8Z+TeC+zXV1CtTCE=";
+    hash = "sha256-lrYMx7UlVXQg6HlyajuxpV9liHXka0K/pJLrquTX2XQ=";
  };

  strictDeps = true;
@@ -12,13 +12,13 @@

 buildGoModule rec {
  pname = "k9s";
-  version = "0.50.3";
+  version = "0.50.4";

  src = fetchFromGitHub {
    owner = "derailed";
    repo = "k9s";
    rev = "v${version}";
-    hash = "sha256-kv52OcQqi88kdGuWjZxE3+tSANOpTSbATrmJitUUicA=";
+    hash = "sha256-JosFo7/JgM7tVMXY+OjASXnbwVYoJ5WGtgR5LTxaAYY=";
  };

  ldflags = [
@@ -33,7 +33,7 @@ buildGoModule rec {

  proxyVendor = true;

-  vendorHash = "sha256-FliIL1yMEvsvrjemaV5B++6OBQMXU/9EvBD1hiEwnnw=";
+  vendorHash = "sha256-uWdSeHYbDvRWwKAd/wwUsI7uEtX6aunsB1+cRmfBNUc=";

  # TODO investigate why some config tests are failing
  doCheck = !(stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64);
@@ -7,18 +7,18 @@

 rustPlatform.buildRustPackage rec {
  pname = "komodo";
-  version = "1.17.1";
+  version = "1.17.5";

  src = fetchFromGitHub {
    owner = "moghtech";
    repo = "komodo";
    tag = "v${version}";
-    hash = "sha256-fYuRvaWhNjNzmMFE7Y1QB6y4rxYIbF6p5BRpu6bzrfY=";
+    hash = "sha256-vIK/4WH85qTdjXBX32F6P/XEHdsNw2Kd86btjfl13lE=";
  };

  useFetchCargoVendor = true;

-  cargoHash = "sha256-NGAyyLAK9tI2GrV0cOmPn6CVBSOcf1JFg00eBOYdR38=";
+  cargoHash = "sha256-YCSxMcuzN1IroDfbj18yjGT0ua1xfY4l0dJ/OZhHPZw=";

  # disable for check. document generation is fail
  # > error: doctest failed, to rerun pass `-p komodo_client --doc`
@@ -5,22 +5,25 @@
  fetchurl,
  cmake,
  codec2,
-  # for tests
-  octave,
  sox,
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "LPCNet";
-  version = "0.5";
+  version = "0.5-unstable-2025-01-19";

  src = fetchFromGitHub {
    owner = "drowe67";
    repo = "LPCNet";
-    tag = "v${finalAttrs.version}";
-    hash = "sha256-tHZLKXmuM86A6OpfS3CRRjhFbqj1Q/w1w56msdgLHb0=";
+    rev = "c8e51ac5e2fe674849cb53e7da44689b572cc246";
+    sha256 = "sha256-0Knoym+deTuFAyJrrD55MijVh6DlhJp3lss66BJUHiA=";
  };

+  patches = [
+    # extracted from https://github.com/drowe67/LPCNet/pull/59
+    ./darwin.patch
+  ];
+
  passthru = {
    # Prebuilt neural network model that is needed during the build - can be overwritten
    nnmodel = fetchurl {
@@ -36,10 +39,6 @@ stdenv.mkDerivation (finalAttrs: {
      build/${finalAttrs.finalPackage.passthru.nnmodel.name}
  '';

-  prePatch = ''
-    patchShebangs *.sh unittest/*.sh
-  '';
-
  nativeBuildInputs = [
    cmake
  ];
@@ -48,37 +47,23 @@ stdenv.mkDerivation (finalAttrs: {
    codec2
  ];

-  cmakeFlags = lib.optionals (stdenv.cc.isClang && stdenv.hostPlatform.isAarch64) [
-    # unsupported option '-mfpu=' for target 'x86_64-apple-darwin'
-    "-DNEON=OFF"
-  ];
-
+  doCheck = true;
  nativeCheckInputs = [
-    octave
+    # NOTE: From some reason, the tests pass without this on x86_64-linux, but
+    # not on aarch64-linux, although the relevant test is not enabled
+    # conditionally, see:
+    # https://github.com/drowe67/LPCNet/blob/c8e51ac5e2fe674849cb53e7da44689b572cc246/CMakeLists.txt#L220-L225
    sox
  ];

-  disabledTests = lib.optionals (stdenv.cc.isClang && stdenv.hostPlatform.isAarch64) [
-    # disable tests that require NEON
-    "SIMD_functions"
-  ];
-
-  doCheck = true;
-  checkPhase = ''
-    runHook preCheck
-
-    export LD_LIBRARY_PATH="$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}/build/source/build/src"
-
-    ctest -j 1 --output-on-failure -E '^${lib.concatStringsSep "|" finalAttrs.disabledTests}$'
-
-    runHook postCheck
-  '';
-
  meta = {
    description = "Experimental Neural Net speech coding for FreeDV";
    homepage = "https://github.com/drowe67/LPCNet";
    license = lib.licenses.bsd3;
-    maintainers = with lib.maintainers; [ doronbehar ];
+    maintainers = with lib.maintainers; [
+      doronbehar
+      mvs
+    ];
    platforms = lib.platforms.all;
  };
 })
@@ -1,51 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  fetchurl,
-  cmake,
-  nix-update-script,
-}:
-
-let
-  dataVersion = "191005_v1.0";
-  data = fetchurl {
-    url = "http://rowetel.com/downloads/deep/lpcnet_${dataVersion}.tgz";
-    sha256 = "sha256-UJRAkkdR/dh/+qVoPuPd3ZN69cgzuRBMzOZdUWFJJsg=";
-  };
-in
-stdenv.mkDerivation {
-  pname = "lpcnetfreedv";
-  version = "0.5-unstable-2025-01-19";
-
-  src = fetchFromGitHub {
-    owner = "drowe67";
-    repo = "LPCNet";
-    rev = "c8e51ac5e2fe674849cb53e7da44689b572cc246";
-    sha256 = "sha256-0Knoym+deTuFAyJrrD55MijVh6DlhJp3lss66BJUHiA=";
-  };
-
-  nativeBuildInputs = [ cmake ];
-
-  patches = [
-    # extracted from https://github.com/drowe67/LPCNet/pull/59
-    ./darwin.patch
-  ];
-
-  postPatch = ''
-    mkdir build
-    ln -s ${data} build/lpcnet_${dataVersion}.tgz
-  '';
-
-  passthru.updateScript = nix-update-script {
-    extraArgs = [ "--version=branch" ];
-  };
-
-  meta = {
-    homepage = "https://freedv.org/";
-    description = "Experimental Neural Net speech coding for FreeDV";
-    license = lib.licenses.bsd3;
-    maintainers = with lib.maintainers; [ mvs ];
-    platforms = lib.platforms.all;
-  };
-}
@@ -10,11 +10,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "maestro";
-  version = "1.39.13";
+  version = "1.40.0";

  src = fetchurl {
    url = "https://github.com/mobile-dev-inc/maestro/releases/download/cli-${finalAttrs.version}/maestro.zip";
-    hash = "sha256-J1Gy12VF5C7OTDCOs4s7sWuwixZR1tz4hQyRxKcwahM=";
+    hash = "sha256-K0KSlSA2Jyeqck0CXZw3kh0qexIvL6vDn3EhAtIzCJc=";
  };

  dontUnpack = true;
@@ -0,0 +1,27 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "mcphost";
+  version = "0.7.1";
+
+  src = fetchFromGitHub {
+    owner = "mark3labs";
+    repo = "mcphost";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-4vKzrT/1pEupiW3IaQV6d4Y2QHKNBH8sCA4TP8qn+50=";
+  };
+
+  vendorHash = "sha256-yD+83cuOIBFF91Zu4Xi2g+dsP4iUOTrjBOuetowLRQw=";
+
+  meta = {
+    description = "A CLI host application that enables Large Language Models (LLMs) to interact with external tools through the Model Context Protocol (MCP";
+    homepage = "https://github.com/mark3labs/mcphost";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ drupol ];
+    mainProgram = "mcphost";
+  };
+})
@@ -7,7 +7,7 @@
  installShellFiles,
 }:
 let
-  version = "0.4.48";
+  version = "0.4.49";
 in
 rustPlatform.buildRustPackage rec {
  inherit version;
@@ -17,11 +17,11 @@ rustPlatform.buildRustPackage rec {
    owner = "rust-lang";
    repo = "mdBook";
    tag = "v${version}";
-    hash = "sha256-ZCV8BSoaYIhNZV3Spsd7rsp8D2zTZSdWMuicQrgax2I=";
+    hash = "sha256-X+ptqzAOjCX2Tt5jDfH/jdUy99WrITGfzDj+F2DoI5w=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-ZpfzAzqVL7/GaI4C7X0UqZAPFT/Y/OCQ53wDcmgM2zI=";
+  cargoHash = "sha256-ZPJkSMcxyTOivfwThPfaO6oRkfewH048rrCDCwCtE8c=";

  nativeBuildInputs = [ installShellFiles ];

@@ -16,7 +16,7 @@

 stdenv.mkDerivation rec {
  pname = "mihomo-party";
-  version = "1.7.2";
+  version = "1.7.3";

  src =
    let
@@ -31,8 +31,8 @@ stdenv.mkDerivation rec {
    fetchurl {
      url = "https://github.com/mihomo-party-org/mihomo-party/releases/download/v${version}/mihomo-party-linux-${version}-${arch}.deb";
      hash = selectSystem {
-        x86_64-linux = "sha256-hJnb0K3ytw0ITwL6dY1klSG260WrZQiHhz4FRZ0idI4=";
-        aarch64-linux = "sha256-6hAB1QezewgKI2We0zDTK+vNgxcMP2AEmGZqdSbMcWQ=";
+        x86_64-linux = "sha256-IzOW36nJS8SBc3o6/E6eGdBi9I7JApmWydk1x0gEWUw=";
+        aarch64-linux = "sha256-AKOATvsAqX1CkoQrMQzVlbf2x+BzIP4bcj49vPRIkEg=";
      };
    };

@@ -14,11 +14,11 @@

 stdenv.mkDerivation rec {
  pname = "monit";
-  version = "5.35.0";
+  version = "5.35.1";

  src = fetchurl {
    url = "https://mmonit.com/monit/dist/monit-${version}.tar.gz";
-    hash = "sha256-6VIqeLlU6u6TPEgQ23uZo2+UHgIsorAVcBhdTOQdjxI=";
+    hash = "sha256-d6TAI+4Gru1IU23+tJ2WqGip64EGw+LojKtTe7xylRs=";
  };

  nativeBuildInputs = [
@@ -6,17 +6,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "nixpacks";
-  version = "1.35.0";
+  version = "1.37.0";

  src = fetchFromGitHub {
    owner = "railwayapp";
    repo = "nixpacks";
    rev = "v${version}";
-    hash = "sha256-lWd8y/gZTLza9WrIBSsqg0TUkmwzvcZE97kj+NnHrSI=";
+    hash = "sha256-1Kw5vOE8UhGWlSjBX/wMiUyRvCYwha343RiGAXEcFXw=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-BuQNJTvL7vxAAS86ENTqgFbneaRo/W+C1rhTmF9BgUM=";
+  cargoHash = "sha256-rmndlNqUtGpSBLclyoTL01CP3qgCNoTmOnpR+9ux/VE=";

  # skip test due FHS dependency
  doCheck = false;
@@ -18,11 +18,11 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "oils-for-unix";
-  version = "0.28.0";
+  version = "0.29.0";

  src = fetchurl {
    url = "https://oils.pub/download/oils-for-unix-${version}.tar.gz";
-    hash = "sha256-Jm0UsW2Q1KB/53SIHq+g7Nu8hBHPHHX4tuJWNwtmjjU=";
+    hash = "sha256-NP21Px29K4dC73TNOkbYer/NoY0NZF8pdixP3bmis6w=";
  };

  postPatch = ''
@@ -0,0 +1,161 @@
+{
+ "!comment": "This is a nixpkgs Gradle dependency lockfile. For more details, refer to the Gradle section in the nixpkgs manual.",
+ "!version": 1,
+ "https://download.eclipse.org": {
+  "eclipse/updates/4.30/R-4.30-202312010110/plugins/org.eclipse.swt.gtk.linux.x86_64_3.124.200.v20231113-1355": {
+   "jar": "sha256-Q048o4oWnZ9Y33AxXiSxbxEeayfbWOf1HoxtoLS4SIs="
+  },
+  "eclipse/updates/4.30/R-4.30-202312010110/plugins/org.eclipse.swt.gtk.linux.aarch64_3.124.200.v20231113-1355": {
+   "jar": "sha256-j98ySq5bTxFHbDJKzWMZP+kfUqekWU1jYUJNDyNg9js="
+  }
+ },
+ "https://github.com": {
+  "unicode-org/icu/releases/download/release-74-2/icu4c-74_2-data-bin-l": {
+   "zip": "sha256-Ks2xuYIigECWPRg7LdnTISUsYT4PTbIT1LvBBBfN5Wk="
+  }
+ },
+ "https://repo.maven.apache.org/maven2": {
+  "com/ibm/icu#icu4j/61.1": {
+   "jar": "sha256-VcmOsYOLKku5oH3Da9N4Uy1k0M3LfO7pFCNoZqfeRGQ=",
+   "pom": "sha256-E7h6QHnOsFUVsZrHoVIDlHB1YB1JQj9xk1ikmACYBWs="
+  },
+  "junit#junit/4.13.2": {
+   "jar": "sha256-jklbY0Rp1k+4rPo0laBly6zIoP/1XOHjEAe+TBbcV9M=",
+   "pom": "sha256-Vptpd+5GA8llwcRsMFj6bpaSkbAWDraWTdCSzYnq3ZQ="
+  },
+  "net/java#jvnet-parent/3": {
+   "pom": "sha256-MPV4nvo53b+WCVqto/wSYMRWH68vcUaGcXyy3FBJR1o="
+  },
+  "org/abego/treelayout#org.abego.treelayout.core/1.0.3": {
+   "jar": "sha256-+l4xOVw5wufUasoPgfcgYJMWB7L6Qb02A46yy2+5MyY=",
+   "pom": "sha256-o7KyI3lDcDVeeSQzrwEvyZNmfAMxviusrYTbwJrOSgw="
+  },
+  "org/antlr#ST4/4.1": {
+   "jar": "sha256-ixzK7Z7cVc0lXZwZxNjaR1bZtvy0NWcSkrQ0cLFtddg=",
+   "pom": "sha256-cz5r2XyjTMbfk6QkPlEeVnPLm4jHSxiETgQqRdUWmHw="
+  },
+  "org/antlr#antlr-master/3.5.2": {
+   "pom": "sha256-QtkaUx6lEA6wm1QaoALDuQjo8oK9c7bi9S83HvEzG9Y="
+  },
+  "org/antlr#antlr-runtime/3.5.2": {
+   "jar": "sha256-zj/I7LEPOemjzdy7LONQ0nLZzT0LHhjm/nPDuTichzQ=",
+   "pom": "sha256-RqnCIAu4sSvXEkqnpQl/9JCZkIMpyFGgTLIFFCCqfyU="
+  },
+  "org/antlr#antlr4-master/4.7.2": {
+   "pom": "sha256-upnLJdI5DzhoDHUChCoO4JWdHmQD4BPM/2mP1YVu6tE="
+  },
+  "org/antlr#antlr4-runtime/4.7.2": {
+   "jar": "sha256-TFGLh9S9/4tEzYy8GvgW6US2Kj/luAt4FQHPH0dZu8Q=",
+   "pom": "sha256-3AnLqYwl08BuSuxRaIXUw68DBiulX0/mKD/JzxdqYPs="
+  },
+  "org/antlr#antlr4/4.7.2": {
+   "pom": "sha256-z56zaUD6xEiBA4wb4/LFjgbmjRq/v9SmjTS72LrFV3E="
+  },
+  "org/antlr#antlr4/4.7.2/complete": {
+   "jar": "sha256-aFI4bXl17/KRcdrgAswiMlFRDTXyka4neUjzgaezgLQ="
+  },
+  "org/apache#apache/13": {
+   "pom": "sha256-/1E9sDYf1BI3vvR4SWi8FarkeNTsCpSW+BEHLMrzhB0="
+  },
+  "org/apache/lucene#lucene-core/7.7.3": {
+   "jar": "sha256-jrAzNcGjxqixiN9012G6qDVplTWCq0QLU0yIRJ6o4N4=",
+   "pom": "sha256-gvilIoHGyLp5dKy6rESzLXbiYAgvP0u+FlwPbkuJFCo="
+  },
+  "org/apache/lucene#lucene-grouping/7.7.3": {
+   "jar": "sha256-L1vNY7JXQ9MMMTmGIk0Qf3XFKThxSVQlNRDFfT9nvrg=",
+   "pom": "sha256-HwStk+IETUCP2SXu4K6ktKHvjAdXe0Jme7U2BgKCImU="
+  },
+  "org/apache/lucene#lucene-parent/7.7.3": {
+   "pom": "sha256-6PrdU9XwBMQN3SNdQ4ZI5yxyVZn+4VQ+ViTV+1AQcwU="
+  },
+  "org/apache/lucene#lucene-queries/7.7.3": {
+   "jar": "sha256-PLWS2wpulWnGrMvbiKmtex2nQo28p5Ia0cWlhl1bQiY=",
+   "pom": "sha256-rkBsiiuw12SllERCefRiihl2vQlB551CzmTgmHxYnFA="
+  },
+  "org/apache/lucene#lucene-queryparser/7.7.3": {
+   "jar": "sha256-F3XJ/o7dlobTt6ZHd4+kTqqW8cwMSZMVCHEz4amDnoQ=",
+   "pom": "sha256-z2klkhWscjC5+tYKXInKDp9bm6rM7dFGlY/76Q9OsNI="
+  },
+  "org/apache/lucene#lucene-sandbox/7.7.3": {
+   "jar": "sha256-VfG38J2uKwytMhw00Vw8/FmgIRviM/Yp0EbEK/FwErc=",
+   "pom": "sha256-1vbdxsz1xvymRH1HD1BJ4WN6xje/HbWuDV8WaP34EiI="
+  },
+  "org/apache/lucene#lucene-solr-grandparent/7.7.3": {
+   "pom": "sha256-Oig3WAynavNq99/i3B0zT8b/XybRDySJnbd3CtfP2f4="
+  },
+  "org/apiguardian#apiguardian-api/1.1.2": {
+   "jar": "sha256-tQlEisUG1gcxnxglN/CzXXEAdYLsdBgyofER5bW3Czg=",
+   "module": "sha256-4IAoExN1s1fR0oc06aT7QhbahLJAZByz7358fWKCI/w=",
+   "pom": "sha256-MjVQgdEJCVw9XTdNWkO09MG3XVSemD71ByPidy5TAqA="
+  },
+  "org/glassfish#javax.json/1.0.4": {
+   "jar": "sha256-Dh3sQKHt6WWUElHtqWiu7gUsxPUDeLwxbMSOgVm9vrQ=",
+   "pom": "sha256-a6+Dg/+pi2bqls1b/B7H8teUY7uYrJgFKWSxIcIhLVQ="
+  },
+  "org/glassfish#json/1.0.4": {
+   "pom": "sha256-bXxoQjEV+SFxjZRPhZkktMaFIX7AOkn3BFWossqpcuY="
+  },
+  "org/hamcrest#hamcrest-core/1.3": {
+   "jar": "sha256-Zv3vkelzk0jfeglqo4SlaF9Oh1WEzOiThqekclHE2Ok=",
+   "pom": "sha256-/eOGp5BRc6GxA95quCBydYS1DQ4yKC4nl3h8IKZP+pM="
+  },
+  "org/hamcrest#hamcrest-parent/1.3": {
+   "pom": "sha256-bVNflO+2Y722gsnyelAzU5RogAlkK6epZ3UEvBvkEps="
+  },
+  "org/junit#junit-bom/5.11.3": {
+   "module": "sha256-S/D1PO6nx5D9+9JNujyeBM3FGGQnnuv8V6qkc+vKA4A=",
+   "pom": "sha256-8T3y5Mrx/rzlZ2Z+fDeBAaAzHVPRMk1uLf467Psfd3Q="
+  },
+  "org/junit/jupiter#junit-jupiter-api/5.11.3": {
+   "jar": "sha256-XYFHpg9JRTlz4lDtaHAbf/BVlk/iRi/Cyx7B1tRIibo=",
+   "module": "sha256-zC4yvwDuZDSpoZ3P2fJ6z2ZaPdYy03fkdhgNies+8n0=",
+   "pom": "sha256-8Zr+CSOwGTXEDy5+ltZgN+IAi3AXkXzHBRM4N3hJYY4="
+  },
+  "org/junit/jupiter#junit-jupiter-engine/5.11.3": {
+   "jar": "sha256-5iQgyZ98DVmiFZou9j5hh36cgL1yLAPKi/O9zqBQpYk=",
+   "module": "sha256-s3w9vEFSbrpeVMz/ROxUf0hVYstDyj0J2p+n2hmjBl4=",
+   "pom": "sha256-eJ43jTfEndhlTWbjrTreQY5YhK5vSHI5Ad0758nsngM="
+  },
+  "org/junit/jupiter#junit-jupiter-params/5.11.3": {
+   "jar": "sha256-D3mOvsdExOZgX9TyBy9BqOmJ4tRp4h21qmfPeZwLUew=",
+   "module": "sha256-sLUYC9HX9NFhsKCF+7JP2hbNcKfQX2Ni4asuSS0cq+w=",
+   "pom": "sha256-zOw0JKBxSUTGd7lP1QP9DByiQ84VxAFg1gzmKKr6Nf8="
+  },
+  "org/junit/jupiter#junit-jupiter/5.11.3": {
+   "jar": "sha256-rHV47+0WI2fD3cAGM44H1FcVEP2YZmQuqT1bnk7S9mU=",
+   "module": "sha256-a5pr3dlKOPEmUmh67HyBJisZkf6+vEjKmP6rxWOhKwE=",
+   "pom": "sha256-y+nzhaChO2/tjGxu0fFtxgWpJlfzslsZaDjHPZdoSAY="
+  },
+  "org/junit/platform#junit-platform-commons/1.11.3": {
+   "jar": "sha256-viYpZLC2tI3pd8YdT5Md+M9h6A51DMPzoKOc3SHBAIw=",
+   "module": "sha256-l531zqTESC/fxZCK3ItGq2q/ADbpmk0CzBjAdDyLggc=",
+   "pom": "sha256-gW69MkSncNkV2cHUDTtGUf40j0L4m3y369De4gnFIEA="
+  },
+  "org/junit/platform#junit-platform-engine/1.11.3": {
+   "jar": "sha256-AEP3L2EWZHNdqNyaMIvxLs0iNrBTOTUcR0HttNj6sNo=",
+   "module": "sha256-K5UnTIxw3eS9vEmQnxxY61qSLlQcXdO+qpx68rv6Qaw=",
+   "pom": "sha256-/ibcXakRuUtowSsiQSV6IIE1u7m4yRzBoTQzqAp6eR4="
+  },
+  "org/junit/platform#junit-platform-launcher/1.11.3": {
+   "jar": "sha256-tHJ0WSAbABG+sHQr2AdCGh/IQmsRYZMDHth4JbwtTwQ=",
+   "module": "sha256-cqqtIKPLIsFMA9WYDgJZZ1KmWe3EaylHH35c/yJWbow=",
+   "pom": "sha256-ElFDZ7k84oUOXa4jt8PWSjZuVMuLgjf5FNiD/Z26G/o="
+  },
+  "org/junit/vintage#junit-vintage-engine/5.11.3": {
+   "jar": "sha256-1YAiQZvHaz309Hmis1mdleJEZM1o+3wiZ/GhqHEhXEc=",
+   "module": "sha256-/ruKwpJtQhhJUQhtKDFqn0AfjEoUMhW4QleXCHEGBoQ=",
+   "pom": "sha256-Js5pMwDkTPg5mu0wujw7kBA6inM8/wH5DfCMDyvs2CA="
+  },
+  "org/opentest4j#opentest4j/1.3.0": {
+   "jar": "sha256-SOLfY2yrZWPO1k3N/4q7I1VifLI27wvzdZhoLd90Lxs=",
+   "module": "sha256-SL8dbItdyU90ZSvReQD2VN63FDUCSM9ej8onuQkMjg0=",
+   "pom": "sha256-m/fP/EEPPoNywlIleN+cpW2dQ72TfjCUhwbCMqlDs1U="
+  },
+  "org/sonatype/oss#oss-parent/7": {
+   "pom": "sha256-tR+IZ8kranIkmVV/w6H96ne9+e9XRyL+kM5DailVlFQ="
+  },
+  "org/sonatype/oss#oss-parent/9": {
+   "pom": "sha256-+0AmX5glSCEv+C42LllzKyGH7G8NgBgohcFO8fmCgno="
+  }
+ }
+}
@@ -0,0 +1,6 @@
+{
+  "hash": "sha256-pXQCzNcucQAYv0Da1uE5xG6pGqxQXrTDzvFqrn7H92M=",
+  "owner": "openjdk",
+  "repo": "jfx24u",
+  "rev": "refs/tags/24+29"
+}
@@ -36,11 +36,13 @@
  jdk17_headless,
  jdk21_headless,
  jdk23_headless,
+  jdk24_headless,
  jdk-bootstrap ?
    {
      "17" = jdk17_headless;
      "21" = jdk21_headless;
      "23" = jdk23_headless;
+      "24" = jdk24_headless;
    }
    .${featureVersion},
 }:
@@ -1,16 +1,42 @@
+From e49f97eb4b0fd27b26437638db7984fbcfd3a14f Mon Sep 17 00:00:00 2001
+From: Morgan Jones <me@numin.it>
+Date: Sun, 4 May 2025 15:46:07 -0700
+Subject: [PATCH] net: disable tests in the Nix sandbox
+
+---
+ packages/net/_test.pony | 19 +------------------
+ 1 file changed, 1 insertion(+), 18 deletions(-)
+
 diff --git a/packages/net/_test.pony b/packages/net/_test.pony
-index 9044dfb1..f0ea10f7 100644
+index 05462eb2..c0c6cdfa 100644
 --- a/packages/net/_test.pony
 +++ b/packages/net/_test.pony
-@@ -26,11 +26,6 @@ actor \nodoc\ Main is TestList
-       test(_TestTCPThrottle)
-     end
+@@ -15,25 +15,8 @@ actor \nodoc\ Main is TestList
+   new make() => None
 
+   fun tag tests(test: PonyTest) =>
+-    // Tests below function across all systems and are listed alphabetically
+    // (@numinit): only this test works in the Nix sandbox:
+     test(_TestTCPConnectionFailed)
+-    test(_TestTCPExpect)
+-    test(_TestTCPExpectOverBufferSize)
+-    test(_TestTCPMute)
+-    test(_TestTCPProxy)
+-    test(_TestTCPUnmute)
+-    test(_TestTCPWritev)
+-
+-    // Tests below exclude windows and are listed alphabetically
+-    ifdef not windows then
+-      test(_TestTCPConnectionToClosedServerFailed)
+-      test(_TestTCPThrottle)
+-    end
+-
 -    // Tests below exclude osx and are listed alphabetically
 -    ifdef not osx then
 -      test(_TestBroadcast)
 -    end
-
+ 
 class \nodoc\ _TestPing is UDPNotify
   let _h: TestHelper
-   let _ip: NetAddress
+-- 
+2.47.0
@@ -0,0 +1,26 @@
+From 77d703b11d298f6be88b04f7e8ca85de139e82be Mon Sep 17 00:00:00 2001
+From: Morgan Jones <me@numin.it>
+Date: Mon, 5 May 2025 20:34:02 -0700
+Subject: [PATCH] process: disable KillLongRunningChild test
+
+---
+ packages/process/_test.pony | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/packages/process/_test.pony b/packages/process/_test.pony
+index fe9fdb04..756588f9 100644
+--- a/packages/process/_test.pony
+++ b/packages/process/_test.pony
+@@ -18,7 +18,8 @@ actor \nodoc\ Main is TestList
+     test(_TestChdir)
+     test(_TestExpect)
+     test(_TestFileExecCapabilityIsRequired)
+-    test(_TestKillLongRunningChild)
+    // (@booxter/@numinit) Appears to be flaky.
+    // test(_TestKillLongRunningChild)
+     test(_TestLongRunningChild)
+     test(_TestNonExecutablePathResultsInExecveError)
+     test(_TestPrintvOrdering)
+-- 
+2.47.0
+
@@ -19,6 +19,7 @@
  which,
  z3,
  cctools,
+  procps,
 }:

 stdenv.mkDerivation (rec {
@@ -73,6 +74,7 @@ stdenv.mkDerivation (rec {
    [
      # Sandbox disallows network access, so disabling problematic networking tests
      ./disable-networking-tests.patch
+      ./disable-process-tests.patch
    ]
    ++ lib.optionals stdenv.hostPlatform.isDarwin [
      (replaceVars ./fix-darwin-build.patch {
@@ -102,10 +104,19 @@ stdenv.mkDerivation (rec {
        --replace-fail "https://github.com/google/googletest/archive/refs/tags/v$googletestRev.tar.gz" "$NIX_BUILD_TOP/deps/googletest-$googletestRev.tar"
  '';

-  preBuild = ''
-    make libs build_flags=-j$NIX_BUILD_CORES
-    make configure build_flags=-j$NIX_BUILD_CORES
-  '';
+  preBuild =
+    ''
+      extraFlags=(build_flags=-j$NIX_BUILD_CORES)
+    ''
+    + lib.optionalString stdenv.hostPlatform.isAarch64 ''
+      # See this relnote about building on Raspbian:
+      # https://github.com/ponylang/ponyc/blob/0.46.0/.release-notes/0.45.2.md
+      extraFlags+=(pic_flag=-fPIC)
+    ''
+    + ''
+      make libs "''${extraFlags[@]}"
+      make configure "''${extraFlags[@]}"
+    '';

  makeFlags = [
    "PONYC_VERSION=${version}"
@@ -117,8 +128,9 @@ stdenv.mkDerivation (rec {
    "-Wno-error=implicit-fallthrough"
  ];

-  # make: *** [Makefile:222: test-full-programs-release] Killed: 9
-  doCheck = !stdenv.hostPlatform.isDarwin;
+  doCheck = true;
+
+  nativeCheckInputs = [ procps ];

  installPhase =
    ''
@@ -14,12 +14,12 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "qmk";
-  version = "1.1.6";
+  version = "1.1.7";
  format = "pyproject";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-3ENs26vy+M7G261FPeODK+AbrI5+nBkHXCmGbuIqi1A=";
+    hash = "sha256-4Qhzsa5GAAeSgt7FZsRWIVO1ZB+010WtBv9SV38Xgto=";
  };

  nativeBuildInputs = with python3.pkgs; [
@@ -35,7 +35,7 @@ in

 python3Packages.buildPythonApplication rec {
  pname = "refine";
-  version = "0.5.7";
+  version = "0.5.8";
  pyproject = false; # uses meson

  src = fetchFromGitLab {
@@ -43,7 +43,7 @@ python3Packages.buildPythonApplication rec {
    owner = "TheEvilSkeleton";
    repo = "Refine";
    tag = version;
-    hash = "sha256-Ew/FCCJxgc5ybc/o6tEYP65G24sEmVLoeMTu9/cCjVQ=";
+    hash = "sha256-56aJQAeLpecoq7lcw2Cgd8XzpO0mXv+lBG+Qv28Ae1I=";
  };

  nativeBuildInputs = [
@@ -0,0 +1,26 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "rpclib";
+  version = "2.3.0";
+
+  src = fetchFromGitHub {
+    owner = "rpclib";
+    repo = "rpclib";
+    rev = "v${finalAttrs.version}";
+    sha256 = "0dlbkl47zd2fkxwbn93w51wmvfr8ssp4zribn5wi4cpiky44a4g9";
+  };
+
+  nativeBuildInputs = [ cmake ];
+
+  meta = {
+    description = "RPC library for C++, providing both a client and server implementation";
+    homepage = "https://github.com/rpclib/rpclib/";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ tmplt ];
+  };
+})
@@ -9,16 +9,16 @@

 php84.buildComposerProject2 (finalAttrs: {
  pname = "snipe-it";
-  version = "8.1.0";
+  version = "8.1.2";

  src = fetchFromGitHub {
    owner = "grokability";
    repo = "snipe-it";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-/yIuoyHkONv94J+MOeahVDXhHbwW1scfwNqcO3NaDwA=";
+    hash = "sha256-tF7lTkmowJAEz2BGNWK2yHkPYafS9Rs5Z98snsbCNQU=";
  };

-  vendorHash = "sha256-+TGloF4V/r9lgO5itk2MnQNj3Fsgq8cwUB5zbA1ZQWM=";
+  vendorHash = "sha256-wVRmvxcrsu5ZBPYrIx9p4+ddWTgBBaeLvyqFMPj3iIg=";

  postInstall = ''
    snipe_it_out="$out/share/php/snipe-it"
@@ -12,11 +12,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "spring-boot-cli";
-  version = "3.4.4";
+  version = "3.4.5";

  src = fetchzip {
    url = "mirror://maven/org/springframework/boot/spring-boot-cli/${finalAttrs.version}/spring-boot-cli-${finalAttrs.version}-bin.zip";
-    hash = "sha256-+dhYpd8qrsYZ5a5xuOsym/Oa0vkB0z1ZWNP9eGgcQv8=";
+    hash = "sha256-ZGOhxeKkUF0kLPTp6oSa1s1rYs7H75uptITf3xvxXJU=";
  };

  nativeBuildInputs = [
@@ -8,13 +8,13 @@

 buildGoModule rec {
  pname = "stripe-cli";
-  version = "1.26.1";
+  version = "1.27.0";

  src = fetchFromGitHub {
    owner = "stripe";
    repo = "stripe-cli";
    rev = "v${version}";
-    hash = "sha256-21KkeGbvI3QVT3G8Mn7y710waLhNoPtlDFz5Ji5lhhI=";
+    hash = "sha256-tV76A1qnsaj3Zp9W9aMrmvVVWjxgjUUkIwNSxdLaakk=";
  };
  vendorHash = "sha256-T8vrEbR240ihkLDG4vu0s+MxKJ5nOLm0aseDgK9EPPE=";

@@ -3,8 +3,6 @@
  buildNpmPackage,
  fetchFromGitHub,
  callPackage,
-  libdbusmenu,
-  xdg-utils,
  makeShellWrapper,
  copyDesktopItems,
  makeDesktopItem,
@@ -106,13 +104,6 @@ buildNpmPackage {
    copyDesktopItems
  ];

-  runtimeDependencies = [
-    (lib.getLib systemd)
-    libnotify
-    libdbusmenu
-    xdg-utils
-  ];
-
  npmDepsHash = "sha256-TNhD/ZkqJtsidAEIOL/WmJZw09BuFgd4ECnzbieNhVY=";
  forceGitDeps = true;
  makeCacheWritable = true;
@@ -134,6 +125,7 @@ buildNpmPackage {

  desktopItems = [
    (makeDesktopItem {
+      exec = "tidal-hifi";
      name = "TIDAL Hi-Fi";
      desktopName = "tidal-hifi";
      genericName = "TIDAL Hi-Fi";
@@ -189,8 +181,7 @@ buildNpmPackage {
      $out/share/tidal-hifi/lib*GL*

    # replace bundled vulkan-loader
-    rm "$out/share/tidal-hifi/libvulkan.so.1"
-    ln -s -t "$out/share/tidal-hifi" "${lib.getLib vulkan-loader}/lib/libvulkan.so.1"
+    ln -sf -t "$out/share/tidal-hifi" "${lib.getLib vulkan-loader}/lib/libvulkan.so.1"

    makeShellWrapper "$out/share/tidal-hifi/tidal-hifi" "$out/bin/tidal-hifi" \
      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
@@ -7,16 +7,16 @@

 buildGoModule rec {
  pname = "vitess";
-  version = "21.0.4";
+  version = "22.0.0";

  src = fetchFromGitHub {
    owner = "vitessio";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-QapbbLZ/wDCKYQW98l780PT4ZEXAbhW0o4Zk2MlG6DQ=";
+    hash = "sha256-YfFGKOYlsCy9mSjtRB+ajmXnXIB8Awjm54DGGhTnu5U=";
  };

-  vendorHash = "sha256-Bc9rhfGSjqhDQBOPS4noW8qJ4P5xLtVcokRhDbqP3a0=";
+  vendorHash = "sha256-0rgosDZn/DZcEK8f1JE2ICiOQX1GU2H93EEAlvesNE8=";

  buildInputs = [ sqlite ];

@@ -10,17 +10,17 @@
 }:
 buildGoModule (finalAttrs: {
  pname = "werf";
-  version = "2.35.4";
+  version = "2.35.8";

  src = fetchFromGitHub {
    owner = "werf";
    repo = "werf";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-bp0KtTsKSBfCLwKfHseLKnGh9ub09+FC841y0I+KNtw=";
+    hash = "sha256-akrhVRjoWrBdSrYWe4MZnCAMdT2KfXxAI4oBvrHBwC8=";
  };

  proxyVendor = true;
-  vendorHash = "sha256-vWjFdwcVbw8lxJl2mR54O8DpiwbGzyCy50Heu7NFLA8=";
+  vendorHash = "sha256-9caBSJ/eMEdVQ55eebjibtsZJOMZk4OcP1D/NckWxCQ=";

  subPackages = [ "cmd/werf" ];

@@ -78,6 +78,10 @@ runCommand "flutter-artifacts-${flutterPlatform}-${systemPlatform}"
      mkdir "$FLUTTER_ROOT/bin/cache/dart-sdk"
      lndir -silent '${flutter'}/bin/cache/dart-sdk' "$FLUTTER_ROOT/bin/cache/dart-sdk"
    ''
+    # Could not determine engine revision
+    + lib.optionalString (lib.versionAtLeast flutter'.version "3.32") ''
+      cp '${flutter'}/bin/internal/engine.version' "$FLUTTER_ROOT/bin/cache/engine.stamp"
+    ''
    + ''

      HOME="$(mktemp -d)" flutter precache ${
@@ -6,6 +6,7 @@
  dart,
  lib,
  stdenv,
+  runCommand,
 }:
 let
  mkCustomFlutter = args: callPackage ./flutter.nix args;
@@ -69,12 +70,27 @@ let
            };
          };
        };
-        src = fetchFromGitHub {
-          owner = "flutter";
-          repo = "flutter";
-          rev = version;
-          hash = flutterHash;
-        };
+        src =
+          let
+            source = fetchFromGitHub {
+              owner = "flutter";
+              repo = "flutter";
+              rev = version;
+              hash = flutterHash;
+            };
+          in
+          (
+            if lib.versionAtLeast version "3.32" then
+              # # Could not determine engine revision
+              (runCommand source.name { } ''
+                cp -r ${source} $out
+                chmod +w $out/bin
+                mkdir $out/bin/cache
+                cp $out/bin/internal/engine.version $out/bin/cache/engine.stamp
+              '')
+            else
+              source
+          );
      };
    in
    (mkCustomFlutter args).overrideAttrs (
@@ -0,0 +1,21 @@
+diff --git a/packages/flutter_tools/lib/src/flutter_cache.dart b/packages/flutter_tools/lib/src/flutter_cache.dart
+index df67547..eacc7c4 100644
+--- a/packages/flutter_tools/lib/src/flutter_cache.dart
+++ b/packages/flutter_tools/lib/src/flutter_cache.dart
+@@ -51,16 +51,6 @@ class FlutterCache extends Cache {
+       registerArtifact(IosUsbArtifacts(artifactName, this, platform: platform));
+     }
+     registerArtifact(FontSubsetArtifacts(this, platform: platform));
+-    registerArtifact(
+-      PubDependencies(
+-        logger: logger,
+-        // flutter root and pub must be lazily initialized to avoid accessing
+-        // before the version is determined.
+-        flutterRoot: () => Cache.flutterRoot!,
+-        pub: () => pub,
+-        projectFactory: projectFactory,
+-      ),
+-    );
+   }
+ }
+ 
@@ -0,0 +1,30 @@
+diff --git a/packages/flutter_tools/lib/src/runner/flutter_command.dart b/packages/flutter_tools/lib/src/runner/flutter_command.dart
+index e4e474ab6e..5548599802 100644
+--- a/packages/flutter_tools/lib/src/runner/flutter_command.dart
+++ b/packages/flutter_tools/lib/src/runner/flutter_command.dart
+@@ -1693,7 +1693,7 @@ Run 'flutter -h' (or 'flutter <command> -h') for available flutter commands and
+ 
+     // Populate the cache. We call this before pub get below so that the
+     // sky_engine package is available in the flutter cache for pub to find.
+-    if (shouldUpdateCache) {
+    if (false) {
+       // First always update universal artifacts, as some of these (e.g.
+       // ios-deploy on macOS) are required to determine `requiredArtifacts`.
+       final bool offline;
+diff --git a/packages/flutter_tools/lib/src/runner/flutter_command_runner.dart b/packages/flutter_tools/lib/src/runner/flutter_command_runner.dart
+index a1104da..1749d65 100644
+--- a/packages/flutter_tools/lib/src/runner/flutter_command_runner.dart
+++ b/packages/flutter_tools/lib/src/runner/flutter_command_runner.dart
+@@ -444,12 +444,8 @@ class FlutterCommandRunner extends CommandRunner<void> {
+           globals.analytics.suppressTelemetry();
+         }
+ 
+-        globals.flutterVersion.ensureVersionFile();
+         final bool machineFlag =
+             topLevelResults[FlutterGlobalOptions.kMachineFlag] as bool? ?? false;
+-        if (await _shouldCheckForUpdates(topLevelResults, topLevelMachineFlag: machineFlag)) {
+-          await globals.flutterVersion.checkFlutterVersionFreshness();
+-        }
+ 
+         // See if the user specified a specific device.
+         final String? specifiedDeviceId =
@@ -0,0 +1,69 @@
+From 6df275df3b8694daf16302b407520e3b1dee6724 Mon Sep 17 00:00:00 2001
+From: Philip Hayes <philiphayes9@gmail.com>
+Date: Thu, 12 Sep 2024 13:23:00 -0700
+Subject: [PATCH] fix: cleanup xcode_backend.sh to fix iOS build w/
+ `NixOS/nixpkgs` flutter
+
+This patch cleans up `xcode_backend.sh`. It now effectively just runs
+`exec $FLUTTER_ROOT/bin/dart ./xcode_backend.dart`.
+
+The previous `xcode_backend.sh` tries to discover `$FLUTTER_ROOT` from
+argv[0], even though its presence is already guaranteed (the wrapped
+`xcode_backend.dart` also relies on this env).
+
+When using nixpkgs flutter, the flutter SDK directory is composed of several
+layers, joined together using symlinks (called a `symlinkJoin`). Without this
+patch, the auto-discover traverses the symlinks into the wrong layer, and so it
+uses an "unwrapped" `dart` command instead of a "wrapped" dart that sets some
+important envs/flags (like `$FLUTTER_ROOT`).
+
+Using the "unwrapped" dart then manifests in this error when compiling, since
+it doesn't see the ios build-support artifacts:
+
+```
+$ flutter run -d iphone
+Running Xcode build...
+Xcode build done.                                            6.4s
+Failed to build iOS app
+Error (Xcode): Target debug_unpack_ios failed: Error: Flutter failed to create a directory at "/<nix-store>/XXXX-flutter-3.24.1-unwrapped/bin/cache/artifacts".
+```
+---
+ packages/flutter_tools/bin/xcode_backend.sh | 25 ++++-----------------
+ 1 file changed, 4 insertions(+), 21 deletions(-)
+
+diff --git a/packages/flutter_tools/bin/xcode_backend.sh b/packages/flutter_tools/bin/xcode_backend.sh
+index 2889d7c8e4..48b9d06c6e 100755
+--- a/packages/flutter_tools/bin/xcode_backend.sh
+++ b/packages/flutter_tools/bin/xcode_backend.sh
+@@ -6,24 +6,7 @@
+ # exit on error, or usage of unset var
+ set -euo pipefail
+ 
+-# Needed because if it is set, cd may print the path it changed to.
+-unset CDPATH
+-
+-function follow_links() (
+-  cd -P "$(dirname -- "$1")"
+-  file="$PWD/$(basename -- "$1")"
+-  while [[ -h "$file" ]]; do
+-    cd -P "$(dirname -- "$file")"
+-    file="$(readlink -- "$file")"
+-    cd -P "$(dirname -- "$file")"
+-    file="$PWD/$(basename -- "$file")"
+-  done
+-  echo "$file"
+-)
+-
+-PROG_NAME="$(follow_links "${BASH_SOURCE[0]}")"
+-BIN_DIR="$(cd "${PROG_NAME%/*}" ; pwd -P)"
+-FLUTTER_ROOT="$BIN_DIR/../../.."
+-DART="$FLUTTER_ROOT/bin/dart"
+-
+-"$DART" "$BIN_DIR/xcode_backend.dart" "$@"
+# Run `dart ./xcode_backend.dart` with the dart from $FLUTTER_ROOT.
+dart="${FLUTTER_ROOT}/bin/dart"
+xcode_backend_dart="${BASH_SOURCE[0]%.sh}.dart"
+exec "${dart}" "${xcode_backend_dart}" "$@"
+-- 
+2.46.0
+
@@ -0,0 +1,44 @@
+This patch introduces an intermediate Gradle build step to alter the behavior
+of flutter_tools' Gradle project, specifically moving the creation of `build`
+and `.gradle` directories from within the Nix Store to somewhere in `$HOME/.cache/flutter/nix-flutter-tools-gradle/$engineShortRev`.
+
+Without this patch, flutter_tools' Gradle project tries to generate `build` and `.gradle`
+directories within the Nix Store. Resulting in read-only errors when trying to build a
+Flutter Android app at runtime.
+
+This patch takes advantage of the fact settings.gradle takes priority over settings.gradle.kts to build the intermediate Gradle project
+when a Flutter app runs `includeBuild("${settings.ext.flutterSdkPath}/packages/flutter_tools/gradle")`
+
+`rootProject.buildFileName = "/dev/null"` so that the intermediate project doesn't use `build.gradle.kts` that's in the same directory.
+
+The intermediate project makes a `settings.gradle` file in `$HOME/.cache/flutter/nix-flutter-tools-gradle/<short engine rev>/` and `includeBuild`s it.
+This Gradle project will build the actual `packages/flutter_tools/gradle` project by setting
+`rootProject.projectDir = new File("$settingsDir")` and `apply from: new File("$settingsDir/settings.gradle.kts")`.
+
+Now the `.gradle` will be built in `$HOME/.cache/flutter/nix-flutter-tools-gradle/<short engine rev>/`, but `build` doesn't.
+To move `build` to `$HOME/.cache/flutter/nix-flutter-tools-gradle/<short engine rev>/` as well, we need to set `buildDirectory`.
+diff --git a/packages/flutter_tools/gradle/settings.gradle b/packages/flutter_tools/gradle/settings.gradle
+new file mode 100644
+index 0000000000..b2485c94b4
+--- /dev/null
+++ b/packages/flutter_tools/gradle/settings.gradle
+@@ -0,0 +1,19 @@
+rootProject.buildFileName = "/dev/null"
+
+def engineShortRev = (new File("$settingsDir/../../../bin/internal/engine.version")).text.take(10)
+def dir = new File("$System.env.HOME/.cache/flutter/nix-flutter-tools-gradle/$engineShortRev")
+dir.mkdirs()
+def file = new File(dir, "settings.gradle")
+
+file.text = """
+rootProject.projectDir = new File("$settingsDir")
+apply from: new File("$settingsDir/settings.gradle.kts")
+
+gradle.allprojects { project ->
+  project.beforeEvaluate {
+    project.layout.buildDirectory = new File("$dir/build")
+  }
+}
+"""
+
+includeBuild(dir)
@@ -0,0 +1,13 @@
+--- a/src/hotspot/os/linux/os_linux.cpp	2025-04-08 14:43:06.765198522 +0200
+++ b/src/hotspot/os/linux/os_linux.cpp	2025-04-08 14:43:27.890301990 +0200
+@@ -2758,9 +2758,7 @@
+   assert(ret, "cannot locate libjvm");
+   char *rp = nullptr;
+   if (ret && dli_fname[0] != '\0') {
+-    rp = os::realpath(dli_fname, buf, buflen);
+-  }
+-  if (rp == nullptr) {
+    snprintf(buf, buflen, "%s", dli_fname);
+     return;
+   }
+ 
@@ -0,0 +1,30 @@
+--- a/src/java.base/share/classes/sun/security/ssl/TrustStoreManager.java	2017-06-26 21:48:25.000000000 -0400
+++ b/src/java.base/share/classes/sun/security/ssl/TrustStoreManager.java	2017-07-05 20:45:57.491295030 -0400
+@@ -71,6 +71,7 @@
+      *
+      * The preference of the default trusted KeyStore is:
+      *    javax.net.ssl.trustStore
+     *    system environment variable JAVAX_NET_SSL_TRUSTSTORE
+      *    jssecacerts
+      *    cacerts
+      */
+@@ -125,7 +126,8 @@
+         static TrustStoreDescriptor run() {
+             // Get the system properties for trust store.
+             String storePropName = System.getProperty(
+-                    "javax.net.ssl.trustStore", jsseDefaultStore);
+                    "javax.net.ssl.trustStore",
+                    System.getenv("JAVAX_NET_SSL_TRUSTSTORE"));
+             String storePropType = System.getProperty(
+                     "javax.net.ssl.trustStoreType",
+                     KeyStore.getDefaultType());
+@@ -137,6 +139,9 @@
+             String temporaryName = "";
+             File temporaryFile = null;
+             long temporaryTime = 0L;
+            if (storePropName == null) {
+                storePropName = jsseDefaultStore;
+            }
+             if (!"NONE".equals(storePropName)) {
+                 String[] fileNames =
+                         new String[] {storePropName, defaultStore};
@@ -0,0 +1,6 @@
+{
+  "hash": "sha256-ogWq6oLyZzzvxGTqEEoPMXdtfbobUyXcC5bXXxBxfuo=",
+  "owner": "openjdk",
+  "repo": "jdk24u",
+  "rev": "refs/tags/jdk-24+36"
+}
@@ -13,6 +13,7 @@
  lndir,
  unzip,
  ensureNewerSourcesForZipFilesHook,
+  pandoc,

  cpio,
  file,
@@ -58,11 +59,13 @@
  openjfx17,
  openjfx21,
  openjfx23,
+  openjfx24,
  openjfx_jdk ?
    {
      "17" = openjfx17;
      "21" = openjfx21;
      "23" = openjfx23;
+      "24" = openjfx24;
    }
    .${featureVersion} or (throw "JavaFX is not supported on OpenJDK ${featureVersion}"),

@@ -76,6 +79,7 @@
  temurin-bin-17,
  temurin-bin-21,
  temurin-bin-23,
+  temurin-bin-24,
  jdk-bootstrap ?
    {
      "8" = temurin-bin-8.__spliced.buildBuild or temurin-bin-8;
@@ -83,6 +87,7 @@
      "17" = temurin-bin-17.__spliced.buildBuild or temurin-bin-17;
      "21" = temurin-bin-21.__spliced.buildBuild or temurin-bin-21;
      "23" = temurin-bin-23.__spliced.buildBuild or temurin-bin-23;
+      "24" = temurin-bin-24.__spliced.buildBuild or temurin-bin-24;
    }
    .${featureVersion},
 }:
@@ -98,6 +103,7 @@ let
  atLeast17 = lib.versionAtLeast featureVersion "17";
  atLeast21 = lib.versionAtLeast featureVersion "21";
  atLeast23 = lib.versionAtLeast featureVersion "23";
+  atLeast24 = lib.versionAtLeast featureVersion "24";

  tagPrefix = if atLeast11 then "jdk-" else "jdk";
  version = lib.removePrefix "refs/tags/${tagPrefix}" source.src.rev;
@@ -143,7 +149,9 @@ stdenv.mkDerivation (finalAttrs: {
  patches =
    [
      (
-        if atLeast21 then
+        if atLeast24 then
+          ./24/patches/fix-java-home-jdk24.patch
+        else if atLeast21 then
          ./21/patches/fix-java-home-jdk21.patch
        else if atLeast11 then
          ./11/patches/fix-java-home-jdk10.patch
@@ -151,7 +159,9 @@ stdenv.mkDerivation (finalAttrs: {
          ./8/patches/fix-java-home-jdk8.patch
      )
      (
-        if atLeast11 then
+        if atLeast24 then
+          ./24/patches/read-truststore-from-env-jdk24.patch
+        else if atLeast11 then
          ./11/patches/read-truststore-from-env-jdk10.patch
        else
          ./8/patches/read-truststore-from-env-jdk8.patch
@@ -254,6 +264,9 @@ stdenv.mkDerivation (finalAttrs: {
    ]
    ++ lib.optionals atLeast21 [
      ensureNewerSourcesForZipFilesHook
+    ]
+    ++ lib.optionals atLeast24 [
+      pandoc
    ];

  buildInputs =
@@ -475,10 +488,15 @@ stdenv.mkDerivation (finalAttrs: {

  doInstallCheck = atLeast23;

-  ${if atLeast17 then "postPatch" else null} = ''
-    chmod +x configure
-    patchShebangs --build configure
-  '';
+  ${if atLeast17 then "postPatch" else null} =
+    ''
+      chmod +x configure
+      patchShebangs --build configure
+    ''
+    + lib.optionalString atLeast24 ''
+      chmod +x make/scripts/*.{template,sh,pl}
+      patchShebangs --build make/scripts
+    '';

  ${if !atLeast17 then "preConfigure" else null} =
    ''
@@ -0,0 +1,58 @@
+{
+  callPackage,
+  enableJavaFX ? false,
+  ...
+}@args:
+
+let
+  # For 24 JDK FX is newer than regular JDK?
+  zuluVersion = if enableJavaFX then "24.28.85" else "24.28.83";
+in
+callPackage ./common.nix (
+  {
+    # Details from https://www.azul.com/downloads/?version=java-24&package=jdk
+    # Note that the latest build may differ by platform
+    dists = {
+      x86_64-linux = {
+        inherit zuluVersion;
+        jdkVersion = "24.0.0";
+        hash =
+          if enableJavaFX then
+            "sha256-y8jiE5yECh96pHYZFM0Q/JTiVcm5a0PONYJDLYydCT0="
+          else
+            "sha256-Kf6gF8A8ZFIhujEgjlENeuSPVzW6QWnVZcRst35/ZvI=";
+      };
+
+      aarch64-linux = {
+        inherit zuluVersion;
+        jdkVersion = "24.0.0";
+        hash =
+          if enableJavaFX then
+            "sha256-H6YD8uhk9rTpd+3/S1+7QVzpCi6jykWKyu7RPxMx/sI="
+          else
+            "sha256-6J7szd/ax9xCMNA9efw9Bhgv/VwQFXz5glWIoj+UYIc=";
+      };
+
+      x86_64-darwin = {
+        inherit zuluVersion;
+        jdkVersion = "24.0.0";
+        hash =
+          if enableJavaFX then
+            "sha256-lMdbPkUdXyNcye8uMxGIhZTErrTI0P0SnqMS+8+Rjqg="
+          else
+            "sha256-e7KJtJ9+mFFSdKCj68thfTXguWH5zXaSSb9phzXf/lQ=";
+      };
+
+      aarch64-darwin = {
+        inherit zuluVersion;
+        jdkVersion = "24.0.0";
+        hash =
+          if enableJavaFX then
+            "sha256-oR2x0vphBGgh3KkEkLAcmtIMNONny9/b32z9jLR98X0="
+          else
+            "sha256-7yXLOJCK0RZ8V1vsexOGxGR9NAwi/pCl95BlO8E8nGU=";
+      };
+    };
+  }
+  // builtins.removeAttrs args [ "callPackage" ]
+)
@@ -1322,7 +1322,7 @@ builtins.intersectAttrs super {
    overrideCabal
      (old: {
        passthru = old.passthru or { } // {
-          nixPackage = pkgs.nixVersions.nix_2_24;
+          nixPackage = pkgs.nixVersions.nix_2_28;
        };
      })
      (
@@ -80,8 +80,8 @@
 }:
 mkDerivation {
  pname = "hercules-ci-agent";
-  version = "0.10.5";
-  sha256 = "ab1c2370dbfdca7d7b67cb1985648edabf40d99f01b88a98d6961a2706c0e591";
+  version = "0.10.6";
+  sha256 = "5551c8eda390b48da6801f8f8580dc770e6e2fa2adf467ea7afd174748816fd6";
  isLibrary = true;
  isExecutable = true;
  setupHaskellDepends = [
@@ -30,8 +30,8 @@
 }:
 mkDerivation {
  pname = "hercules-ci-cnix-expr";
-  version = "0.3.6.5";
-  sha256 = "0adbd451815bb6ea7388c0477fe6e114e0ba019819027709855e7834aedcb6df";
+  version = "0.4.0.0";
+  sha256 = "ba6dadda0a14e456780df018a610209ef288ed6562ad5843cb8d19d38fc026ed";
  setupHaskellDepends = [
    base
    Cabal
@@ -24,8 +24,8 @@
 }:
 mkDerivation {
  pname = "hercules-ci-cnix-store";
-  version = "0.3.6.1";
-  sha256 = "35e3d21f9bbc1c83187af22a2532d227fc42a5cf3cf683a86be7bb7180f10d5e";
+  version = "0.3.7.0";
+  sha256 = "6feba2a6e1a267bc69b67962ed6eaa3510b1ae31c411fdb4e6670763d175d3b1";
  setupHaskellDepends = [
    base
    Cabal
@@ -128,7 +128,7 @@ assert (

 let
  pname = "libint";
-  version = "2.10.2";
+  version = "2.11.0";

  meta = {
    description = "Library for the evaluation of molecular integrals of many-body operators over Gaussian functions";
@@ -151,7 +151,7 @@ let
      owner = "evaleev";
      repo = pname;
      rev = "v${version}";
-      hash = "sha256-pxSqW3K76RURy1nhWJKtFNWsiSpU8jPtd+ZMICEr0IY=";
+      hash = "sha256-z5D3wX+AFBM4KcU77Rwma8lgqx8vwDmerFxu0mC1XCk=";
    };

    # Replace hardcoded "/bin/rm" with normal "rm"
@@ -1,13 +0,0 @@
-diff --git a/JuceLibraryCode/modules/juce_core/native/juce_osx_ObjCHelpers.h b/JuceLibraryCode/modules/juce_core/native/juce_osx_ObjCHelpers.h
-index 2593790..0b5983d 100644
--- a/JuceLibraryCode/modules/juce_core/native/juce_osx_ObjCHelpers.h
-+++ b/JuceLibraryCode/modules/juce_core/native/juce_osx_ObjCHelpers.h
-@@ -209,7 +209,7 @@ static inline ReturnValue ObjCMsgSendSuper (struct objc_super* s, SEL sel, Param
- typedef id (*MsgSendSuperFn) (struct objc_super*, SEL, ...);
- static inline MsgSendSuperFn getMsgSendSuperFn() noexcept   { return (MsgSendSuperFn) (void*) objc_msgSendSuper; }
- 
-#if ! JUCE_IOS
-+#if JUCE_INTEL && ! JUCE_IOS
- typedef double (*MsgSendFPRetFn) (id, SEL op, ...);
- static inline MsgSendFPRetFn getMsgSendFPRetFn() noexcept   { return (MsgSendFPRetFn) (void*) objc_msgSend_fpret; }
- #endif
@@ -17,20 +17,15 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "libopenshot-audio";
-  version = "0.3.3";
+  version = "0.4.0";

  src = fetchFromGitHub {
    owner = "OpenShot";
    repo = "libopenshot-audio";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-9iHeVMoyzTQae/PVYJqON0qOPo3SJlhrqbcp2u1Y8MA=";
+    hash = "sha256-FTSITx6GoH1cGWeWNWtz1Ih+zozK8aA+u54Y4s0DylQ=";
  };

-  patches = [
-    # https://forum.juce.com/t/juce-and-macos-11-arm/40285/24
-    ./0001-undef-fpret-on-aarch64-darwin.patch
-  ];
-
  nativeBuildInputs = [
    cmake
    doxygen
@@ -21,13 +21,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "libopenshot";
-  version = "0.3.3";
+  version = "0.4.0";

  src = fetchFromGitHub {
    owner = "OpenShot";
    repo = "libopenshot";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-9X2UIRDD+1kNLbV8AnnPabdO2M0OfTDxQ7xyZtsE10k=";
+    hash = "sha256-zroTnJRYIIglhha6jQvaVNTgnIV6kUWcu7s5zEvgH6Q=";
  };

  patches = lib.optionals stdenv.hostPlatform.isDarwin [
@@ -69,6 +69,8 @@ stdenv.mkDerivation (finalAttrs: {

  cmakeFlags = [
    (lib.cmakeBool "ENABLE_RUBY" false)
+    (lib.cmakeBool "ENABLE_PYTHON" true)
+    (lib.cmakeOptionType "filepath" "PYTHON_EXECUTABLE" (lib.getExe python3))
    (lib.cmakeOptionType "filepath" "PYTHON_MODULE_PATH" python3.sitePackages)
  ];

@@ -14,7 +14,7 @@

 buildPythonPackage rec {
  pname = "django-modeltranslation";
-  version = "0.19.13";
+  version = "0.19.14";
  pyproject = true;

  disabled = pythonOlder "3.11";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
    owner = "deschler";
    repo = "django-modeltranslation";
    tag = "v${version}";
-    hash = "sha256-mn3dGSJbujULPT/PBAVvd1hlCukMItC4Z8dIZ+MWZ2w=";
+    hash = "sha256-jvVzSltq4wkSmndyyOGxldXJVpydmCCrHMGTGiMUNA0=";
  };

  build-system = [ setuptools ];
@@ -2,13 +2,23 @@
  lib,
  buildPythonPackage,
  fetchFromGitHub,
+
+  fontconfig,
+
+  # nativeBuildInputs
  cmake,
  doxygen,
+  graphviz,
+  scipy,
+
+  # buildInputs
  boost,
+
+  # propagatedBuildInputs
  eigen,
  jrl-cmakemodules,
  numpy,
-  scipy,
+
 }:

 buildPythonPackage rec {
@@ -31,14 +41,22 @@ buildPythonPackage rec {

  cmakeFlags = [
    "-DINSTALL_DOCUMENTATION=ON"
+    "-DBUILD_TESTING=ON"
    "-DBUILD_TESTING_SCIPY=ON"
  ];

  strictDeps = true;

+  # Fontconfig error: No writable cache directories
+  preBuild = "export XDG_CACHE_HOME=$(mktemp -d)";
+
+  # Fontconfig error: Cannot load default config file: No such file: (null)
+  env.FONTCONFIG_FILE = "${fontconfig.out}/etc/fonts/fonts.conf";
+
  nativeBuildInputs = [
    cmake
    doxygen
+    graphviz
    scipy
  ];

@@ -50,6 +68,8 @@ buildPythonPackage rec {
    numpy
  ];

+  preInstallCheck = "make test";
+
  pythonImportsCheck = [ "eigenpy" ];

  meta = with lib; {
@@ -0,0 +1,10 @@
+--- a/src/fmpy/gui/__init__.py
+++ b/src/fmpy/gui/__init__.py
+@@ -15,6 +15,7 @@ def compile_resources():
+
+     if os.name == 'posix':
+         pyside_dir = pyside_dir / 'Qt' / 'libexec'
+    pyside_dir = Path("@qt6libexec@")
+
+     gui_dir = Path(__file__).parent
+     forms_dir = gui_dir / 'forms'
@@ -0,0 +1,10 @@
+--- a/src/fmpy/sundials/libraries.py
+++ b/src/fmpy/sundials/libraries.py
+@@ -9,6 +9,7 @@ if platform_tuple == 'aarch64_darwin':
+     library_dir = library_dir / 'x86_64-darwin'
+ else:
+     library_dir = library_dir / platform_tuple
+library_dir = Path("@cvode@") / 'lib'
+
+ # load SUNDIALS shared libraries
+ sundials_nvecserial     = cdll.LoadLibrary(str(library_dir / f'sundials_nvecserial{sharedLibraryExtension}'))
@@ -0,0 +1,44 @@
+From bf0f536776d2554a99af3fbcc08fa4c43bba1c7e Mon Sep 17 00:00:00 2001
+From: Viktor Sonesten <v@tmplt.dev>
+Date: Mon, 5 May 2025 17:40:10 +0200
+Subject: [PATCH] remoting/client: create lockfile with explicit r+w
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This fixes the compilation error below, which is triggered in hardened
+build environments (e.g. NixOS):
+
+       > In file included from /nix/store/aaaaaaaa-glibc-2.40-66-dev/include/fcntl.h:341,
+       >                  from /build/source/native/remoting/client_tcp.cpp:12:
+       > In function ‘int open(const char*, int, ...)’,
+       >     inlined from ‘void* fmi2Instantiate(fmi2String, fmi2Type, fmi2String, fmi2String, const fmi2CallbackFunctions*, fmi2Boolean, fmi2Boolean)’ at /build/source/native/remoting/client_tcp.cpp:217:28:
+       > /nix/store/aaaaaaaa-glibc-2.40-66-dev/include/bits/fcntl2.h:52:31: error: call to ‘__open_missing_mode’ declared with attribute error: open with O_CREAT or O_TMPFILE in second argument needs 3 arguments
+       >    52 |           __open_missing_mode ();
+       >       |           ~~~~~~~~~~~~~~~~~~~~^~
+
+In short: O_CREAT without explicit mode params may generate a file
+with suid/sgid. Error triggered by _FORTIFY_SOURCE. This commit
+explicitly creates the file with read/write permissions for the file
+owner.
+
+Adopted from https://github.com/facebook/hhvm/issues/168
+---
+ native/remoting/client_tcp.cpp | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/native/remoting/client_tcp.cpp b/native/remoting/client_tcp.cpp
+index 708c895..7acbc80 100644
+--- a/native/remoting/client_tcp.cpp
+++ b/native/remoting/client_tcp.cpp
+@@ -214,7 +214,7 @@ fmi2Component fmi2Instantiate(fmi2String instanceName, fmi2Type fmuType, fmi2Str
+         // create lock file
+         const char *lockFilePath = tempnam(NULL, "");
+
+-        int lockFile = open(lockFilePath, O_CREAT | O_EXCL);
+        int lockFile = open(lockFilePath, O_CREAT | O_EXCL, S_IRUSR | S_IWUSR);
+
+         if (lockFile == -1) {
+             s_logger(s_componentEnvironment, instanceName, fmi2Error, "error", "Failed to create lock file %s.", lockFilePath);
+--
+2.47.1
@@ -0,0 +1,232 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  buildPythonPackage,
+  fetchFromGitHub,
+  pythonOlder,
+  cmake,
+  sundials,
+  lapack,
+  attrs,
+  lark,
+  lxml,
+  rpclib,
+  msgpack,
+  numpy,
+  scipy,
+  pytz,
+  dask,
+  requests,
+  matplotlib,
+  pyqtgraph,
+  notebook,
+  plotly,
+  hatchling,
+  pyside6,
+  jinja2,
+  flask,
+  dash,
+  dash-bootstrap-components,
+  qt6,
+  fmpy,
+  runCommand,
+  enableRemoting ? true,
+  versionCheckHook,
+  fmi-reference-fmus,
+  replaceVars,
+}:
+buildPythonPackage rec {
+  pname = "fmpy";
+  version = "0.3.23";
+  disabled = pythonOlder "3.10";
+  pyproject = true;
+
+  # Bumping version? Make sure to look through the commit history for
+  # bumped native/build_cvode.py pins (see above).
+  src = fetchFromGitHub {
+    owner = "CATIA-Systems";
+    repo = "FMPy";
+    rev = "v${version}";
+    fetchSubmodules = true;
+    hash = "sha256-4jBYOymurGCbjT0WQjIRNsztwOXBYVTGLdc4kNSTOZw=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+  ];
+
+  build-system = [
+    hatchling
+  ];
+
+  dependencies = [
+    pyqtgraph
+    pyside6
+    attrs
+    lark
+    lxml
+    msgpack
+    numpy
+    scipy
+    pytz
+    dask
+    requests
+    matplotlib
+    pyqtgraph
+    notebook
+    plotly
+    rpclib
+    fmpy.passthru.cvode
+    pyside6
+    jinja2
+    flask
+    dash
+    dash-bootstrap-components
+  ];
+
+  dontUseCmakeConfigure = true;
+  dontUseCmakeBuildDir = true;
+
+  patches = [
+    (replaceVars ./0001-gui-override-Qt6-libexec-path.patch {
+      qt6libexec = "${qt6.qtbase}/libexec/";
+    })
+    (replaceVars ./0002-sundials-override-shared-object-paths.patch {
+      inherit (fmpy.passthru) cvode;
+    })
+    # Upstream does not accept pull requests for unknown legal
+    # reasons, see:
+    # <https://github.com/CATIA-Systems/FMPy/blob/v0.3.23/docs/contributing.md?plain=1#L60-L63>.
+    # Thus a fix is vendored here until patched by maintainer. C.f.
+    # <https://github.com/CATIA-Systems/FMPy/pull/762>
+    ./0003-remoting-client-create-lockfile-with-explicit-r-w.patch
+  ];
+
+  # Make forced includes of other systems' artifacts optional in order
+  # to pass build (otherwise vendored upstream from CI)
+  postPatch = ''
+    sed --in-place 's/force-include/source/g' pyproject.toml
+  '';
+
+  # Don't run upstream build scripts as they are too specialized.
+  # cvode is already built, so we only need to build native binaries.
+  # We run these cmake builds and then run the standard
+  # buildPythonPackage phases.
+  preBuild =
+    ''
+      cmakeFlags="-S native/src -B native/src/build -D CVODE_INSTALL_DIR=${passthru.cvode}"
+      cmakeConfigurePhase
+      cmake --build native/src/build --config Release
+    ''
+    + lib.optionalString (enableRemoting && stdenv.isLinux) ''
+      # reimplementation of native/build_remoting.py
+      cmakeFlags="-S native/remoting -B remoting/linux64 -D RPCLIB=${rpclib}"
+      cmakeConfigurePhase
+      cmake --build remoting/linux64 --config Release
+    ''
+    # C.f. upstream build-wheel CI job
+    + ''
+      python native/copy_sources.py
+
+      # reimplementation of native/compile_resources.py
+      pushd src/
+      python -c "from fmpy.gui import compile_resources; compile_resources()"
+      popd
+    '';
+
+  pythonImportsCheck = [
+    "fmpy"
+    "fmpy.cross_check"
+    "fmpy.cswrapper"
+    "fmpy.examples"
+    "fmpy.fmucontainer"
+    "fmpy.logging"
+    "fmpy.gui"
+    "fmpy.gui.generated"
+    "fmpy.ssp"
+    "fmpy.sundials"
+  ];
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+
+  passthru = {
+    # From sundials, build only the CVODE solver. C.f.
+    # src/native/build_cvode.py
+    cvode =
+      (sundials.overrideAttrs (prev: {
+        # hash copied from native/build_cvode.py
+        version = "5.3.0";
+        src = fetchurl {
+          url = "https://github.com/LLNL/sundials/releases/download/v5.3.0/sundials-5.3.0.tar.gz";
+          sha256 = "88dff7e11a366853d8afd5de05bf197a8129a804d9d4461fb64297f1ef89bca7";
+        };
+
+        cmakeFlags =
+          prev.cmakeFlags
+          ++ lib.mapAttrsToList (option: enable: lib.cmakeBool option enable) {
+            # only build the CVODE solver
+            BUILD_CVODE = true;
+
+            BUILD_CVODES = false;
+            BUILD_ARKODE = false;
+            BUILD_IDA = false;
+            BUILD_IDAS = false;
+            BUILD_KINSOL = false;
+          };
+
+        # FMPy searches for sundials without the "lib"-prefix; strip it
+        # and symlink the so-files into existance.
+        postFixup = ''
+          pushd $out/lib
+          for so in *.so; do
+            ln --verbose --symbolic $so ''${so#lib}
+          done
+          popd
+        '';
+      })).override
+        {
+          lapackSupport = false;
+          lapack.isILP64 = stdenv.hostPlatform.is64bit;
+          blas = lapack;
+          kluSupport = false;
+        };
+
+    # Simulate reference FMUs from
+    # <https://github.com/modelica/Reference-FMUs>.
+    #
+    # Just check that the execution passes; don't verify any numerical
+    # results, but save them in case of future or manual check use.
+    tests.simulate-reference-fmus = runCommand "${pname}-simulate-reference-fmus" { } ''
+      mkdir $out
+      # NB(find ! -name): Clocks.fmu is marked TODO upstream and is of a
+      # FMI type that FMPy doesn't support currently (ModelExchange)
+      for fmu in $(find ${fmi-reference-fmus}/*.fmu ! -name "Clocks.fmu"); do
+        name=$(basename $fmu)
+        echo "--- START $name ---"
+        ${fmpy}/bin/fmpy simulate $fmu \
+          --fmi-logging \
+          --output-file $out/$name.csv \
+          | tee $out/$name.out
+      done
+    '';
+  };
+
+  meta = {
+    # A logging.dylib is built but is not packaged correctly so as to
+    # be found. C.f.
+    # <https://logs.ofborg.org/?key=nixos/nixpkgs.397658&attempt_id=9d7cb742-db51-4d9e-99ca-49425d87d14d>
+    broken = stdenv.hostPlatform.isDarwin;
+    description = "Simulate Functional Mockup Units (FMUs) in Python";
+    homepage = "https://github.com/CATIA-Systems/FMPy";
+    license = lib.licenses.bsd2;
+    maintainers = with lib.maintainers; [ tmplt ];
+    # Supported platforms are not exhaustively and explicitly stated,
+    # but inferred from the artifacts that are vendored in upstream CI
+    # builds. C.f.
+    # <https://github.com/CATIA-Systems/FMPy/blob/v0.3.23/pyproject.toml?plain=1#L71-L112>
+    platforms = lib.platforms.x86_64 ++ [ "i686-windows" ];
+  };
+}
@@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "llama-index-llms-openai";
-  version = "0.3.29";
+  version = "0.3.33";
  pyproject = true;

  disabled = pythonOlder "3.8";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    pname = "llama_index_llms_openai";
    inherit version;
-    hash = "sha256-320v9zhSpHGAlPawJmRWnSirpLeEi0SlEEQMdvE8Lic=";
+    hash = "sha256-ESlCyiIcIjPtLPmV/a8IZfK3+SldmwHFp/yu83PBrIc=";
  };

  pythonRemoveDeps = [
@@ -8,14 +8,14 @@

 buildPythonPackage rec {
  pname = "oelint-data";
-  version = "1.0.10";
+  version = "1.0.11";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "priv-kweihmann";
    repo = "oelint-data";
    tag = version;
-    hash = "sha256-lBy/aGxcmJ3v5f+0YAJtuk0IK4WpL5iFrgKjyoLswro=";
+    hash = "sha256-i3HxvEaWfrRwOSXZiqukyiUl24pYQnH0JO+Are3AWrc=";
  };

  build-system = [
@@ -2,6 +2,7 @@
  lib,
  buildPythonPackage,
  fetchFromGitHub,
+  setuptools,
  flake8,
  python,
  pythonOlder,
@@ -9,19 +10,21 @@

 buildPythonPackage rec {
  pname = "pep8-naming";
-  version = "0.14.1";
-  format = "setuptools";
+  version = "0.15.0";
+  pyproject = true;

-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.9";

  src = fetchFromGitHub {
    owner = "PyCQA";
-    repo = pname;
+    repo = "pep8-naming";
    tag = version;
-    hash = "sha256-uIVk8+5rVEIBZLz70WUi0O6/Q9ERptJ3b7314gLPeHk=";
+    hash = "sha256-LOHPLS0BtKsocghi3K24VitlRCwyHbYZB6916i7Gj9c=";
  };

-  propagatedBuildInputs = [ flake8 ];
+  build-system = [ setuptools ];
+
+  dependencies = [ flake8 ];

  checkPhase = ''
    runHook preCheck
@@ -34,7 +37,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "Check PEP-8 naming conventions, plugin for flake8";
    homepage = "https://github.com/PyCQA/pep8-naming";
-    changelog = "https://github.com/PyCQA/pep8-naming/blob/${version}/CHANGELOG.rst";
+    changelog = "https://github.com/PyCQA/pep8-naming/blob/${src.tag}/CHANGELOG.rst";
    license = licenses.mit;
    maintainers = with maintainers; [ eadwu ];
  };
@@ -12,7 +12,7 @@

 buildPythonPackage rec {
  pname = "rtfde";
-  version = "0.1.2";
+  version = "0.1.2.1";
  pyproject = true;

  disabled = pythonOlder "3.7";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
    owner = "seamustuohy";
    repo = "RTFDE";
    tag = version;
-    hash = "sha256-zmcf9wqlKz55dOIchUC9sgW0PcTCPc52IkbIonOFlmU=";
+    hash = "sha256-dtPWgtOYpGaNRmIE7WNGJd/GWB2hQXsFJDDSHIcIjY4=";
  };

  build-system = [ setuptools ];
@@ -46,7 +46,7 @@ buildPythonPackage rec {
  ];

  meta = {
-    changelog = "https://github.com/seamustuohy/RTFDE/releases/tag/${version}";
+    changelog = "https://github.com/seamustuohy/RTFDE/releases/tag/${src.tag}";
    description = "Library for extracting encapsulated HTML and plain text content from the RTF bodies";
    homepage = "https://github.com/seamustuohy/RTFDE";
    license = lib.licenses.lgpl3Only;
@@ -3,10 +3,9 @@
  feature,
  libraries,
  versionAttr,
-  pythonPackages,
 }:

-(cudaPackages.writeGpuTestPython.override { python3Packages = pythonPackages; })
+cudaPackages.writeGpuTestPython
  {
    inherit feature;
    inherit libraries;
@@ -4,13 +4,12 @@
  lib,
  libraries,
  name ? if feature == null then "torch-compile-cpu" else "torch-compile-${feature}",
-  pythonPackages,
  stdenv,
 }:
 let
  deviceStr = if feature == null then "" else '', device="cuda"'';
 in
-(cudaPackages.writeGpuTestPython.override { python3Packages = pythonPackages; })
+cudaPackages.writeGpuTestPython
  {
    inherit name feature libraries;
    makeWrapperArgs = [
@@ -27,14 +27,14 @@

 buildPythonPackage rec {
  pname = "trytond";
-  version = "7.4.9";
+  version = "7.4.10";
  pyproject = true;

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-yH0dIRVBPKOjzk+36HGHN13ffhD4y+ZCC123s33YfMA=";
+    hash = "sha256-kzoZDcHNPjmsNxrQ11MAksK+24nI1YNmONQd21s3weA=";
  };

  build-system = [ setuptools ];
@@ -71,17 +71,18 @@
  soundfile,
  tenacity,
  torch,
+  torchvision,
  tqdm,
  writableTmpDirAsHomeHook,
 }:

 let
-  version = "0.19.8";
+  version = "0.19.10";
  src = fetchFromGitHub {
    owner = "wandb";
    repo = "wandb";
    tag = "v${version}";
-    hash = "sha256-hveMyGeu9RhdtWMbV/4GQ4KUNfjSt0CKyW7Yx8QtlLM=";
+    hash = "sha256-SptjImAK0hDAr7UZjUMWnAVB1bxyzoATlyrPek5Tm48=";
  };

  gpu-stats = rustPlatform.buildRustPackage {
@@ -92,7 +93,7 @@ let
    sourceRoot = "${src.name}/gpu_stats";

    useFetchCargoVendor = true;
-    cargoHash = "sha256-KrwZh8OoVwImfYDmvT2Je2MYyiTZVQYngwvVC+7fTzI=";
+    cargoHash = "sha256-kkWvTLduxFVIEvi4e65QQ7S0kHTRJ8XW028o430L91s=";

    checkFlags = [
      # fails in sandbox
@@ -119,9 +120,9 @@ let

    # hardcode the `gpu_stats` binary path.
    postPatch = ''
-      substituteInPlace pkg/monitor/gpu.go \
+      substituteInPlace pkg/monitor/gpuresourcemanager.go \
        --replace-fail \
-          'cmdPath, err := getGPUStatsCmdPath()' \
+          'cmdPath, err := getGPUCollectorCmdPath()' \
          'cmdPath, err := "${lib.getExe gpu-stats}", error(nil)'
    '';

@@ -137,6 +138,18 @@ let
    versionCheckProgramArg = "--version";
    doInstallCheck = true;

+    checkFlags =
+      let
+        skippedTests = [
+          # gpu sampling crashes in the sandbox
+          "TestSystemMonitor_BasicStateTransitions"
+          "TestSystemMonitor_RepeatedCalls"
+          "TestSystemMonitor_UnexpectedTransitions"
+          "TestSystemMonitor_FullCycle"
+        ];
+      in
+      [ "-skip=^${lib.concatStringsSep "$|^" skippedTests}$" ];
+
    __darwinAllowLocalNetworking = true;

    meta.mainProgram = "wandb-core";
@@ -238,6 +251,7 @@ buildPythonPackage rec {
    soundfile
    tenacity
    torch
+    torchvision
    tqdm
    writableTmpDirAsHomeHook
  ];
@@ -91,15 +91,9 @@ rec {
      installPhase =
        with builtins;
        let
-          toolchain = rec {
-            prefix = x: "JAVA_TOOLCHAIN_NIX_${toString x}";
-            varDefs = (lib.imap0 (i: x: "${prefix i} ${x}") javaToolchains);
-            varNames = lib.imap0 (i: x: prefix i) javaToolchains;
-            property = " -Porg.gradle.java.installations.fromEnv='${concatStringsSep "," varNames}'";
-          };
-          varDefs = concatStringsSep "\n" (
-            map (x: "  --set ${x} \\") ([ "JAVA_HOME ${java}" ] ++ toolchain.varDefs)
-          );
+          # set toolchains via installations.path property in gradle.properties.
+          # See https://docs.gradle.org/current/userguide/toolchains.html#sec:custom_loc
+          toolchainPaths = "org.gradle.java.installations.paths=${concatStringsSep "," javaToolchains}";
          jnaLibraryPath = if stdenv.hostPlatform.isLinux then lib.makeLibraryPath [ udev ] else "";
          jnaFlag =
            if stdenv.hostPlatform.isLinux then "--add-flags \"-Djna.library.path=${jnaLibraryPath}\"" else "";
@@ -111,9 +105,11 @@ rec {
          gradle_launcher_jar=$(echo $out/lib/gradle/lib/gradle-launcher-*.jar)
          test -f $gradle_launcher_jar
          makeWrapper ${java}/bin/java $out/bin/gradle \
-            ${varDefs}
+            --set JAVA_HOME ${java} \
            ${jnaFlag} \
-            --add-flags "-classpath $gradle_launcher_jar org.gradle.launcher.GradleMain${toolchain.property}"
+            --add-flags "-classpath $gradle_launcher_jar org.gradle.launcher.GradleMain"
+
+          echo "${toolchainPaths}" > $out/lib/gradle/gradle.properties
        '';

      dontFixup = !stdenv.hostPlatform.isLinux;
@@ -1,15 +1,17 @@
 {
  stdenv,
  lib,
-  fetchurl,
+  fetchzip,
  ghostscript,
-  gyre-fonts,
  texinfo,
  imagemagick,
  texi2html,
+  extractpdfmark,
  guile,
  python3,
  gettext,
+  glib,
+  gmp,
  flex,
  perl,
  bison,
@@ -21,9 +23,6 @@
  pango,
  fontforge,
  help2man,
-  zip,
-  netpbm,
-  groff,
  freefont_ttf,
  makeFontsConf,
  makeWrapper,
@@ -34,10 +33,11 @@
  texliveSmall,
  tex ? texliveSmall.withPackages (
    ps: with ps; [
-      lh
-      metafont
      epsf
      fontinst
+      fontware
+      lh
+      metafont
    ]
  ),
 }:
@@ -46,9 +46,9 @@ stdenv.mkDerivation rec {
  pname = "lilypond";
  version = "2.24.4";

-  src = fetchurl {
+  src = fetchzip {
    url = "http://lilypond.org/download/sources/v${lib.versions.majorMinor version}/lilypond-${version}.tar.gz";
-    sha256 = "sha256-6W+gNXHHnyDhl5ZTr6vb5O5Cdlo9n9FJU/DNnupReBw=";
+    hash = "sha256-UYdORvodrVchxslOxpMiXrAh7DtB9sWp9yqZU/jeB9Y=";
  };

  postInstall = ''
@@ -68,48 +68,48 @@ stdenv.mkDerivation rec {
    done
  '';

-  configureFlags = [
-    "--disable-documentation"
-    # FIXME: these URW fonts are not OTF, configure reports "URW++ OTF files... no".
-    "--with-urwotf-dir=${ghostscript.fonts}/share/fonts"
-    "--with-texgyre-dir=${gyre-fonts}/share/fonts/truetype/"
-  ];
-
  preConfigure = ''
-    sed -e "s@mem=mf2pt1@mem=$PWD/mf/mf2pt1@" -i scripts/build/mf2pt1.pl
-    export HOME=$TMPDIR/home
+    substituteInPlace scripts/build/mf2pt1.pl \
+      --replace-fail "mem=mf2pt1" "mem=$PWD/mf/mf2pt1"
  '';

+  strictDeps = true;
+
+  depsBuildBuild = [
+    pkg-config
+  ];
+
  nativeBuildInputs = [
    autoreconfHook
    bison
-    flex
+    dblatex
+    extractpdfmark
+    flex # for flex binary
+    fontconfig
+    fontforge
+    gettext
+    ghostscript
+    guile
+    help2man
+    imagemagick
    makeWrapper
+    perl
    pkg-config
+    python3
+    rsync
+    t1utils
+    tex
+    texi2html
+    texinfo
  ];

  buildInputs = [
-    ghostscript
-    texinfo
-    imagemagick
-    texi2html
-    guile
-    dblatex
-    tex
-    zip
-    netpbm
-    python3
-    gettext
-    perl
-    fontconfig
-    freetype
-    pango
-    fontforge
-    help2man
-    groff
-    t1utils
    boehmgc
-    rsync
+    flex # FlexLexer.h
+    freetype
+    glib
+    gmp
+    pango
  ];

  autoreconfPhase = "NOCONFIGURE=1 sh autogen.sh";
@@ -121,15 +121,23 @@ stdenv.mkDerivation rec {
    supportedFeatures = [ "commit" ];
  };

-  meta = with lib; {
+  # documentation makefile uses "out" for different purposes, hence we explicitly set it to an empty string
+  makeFlags = [ "out=" ];
+
+  meta = {
    description = "Music typesetting system";
-    homepage = "http://lilypond.org/";
-    license = licenses.gpl3;
-    maintainers = with maintainers; [
+    homepage = "https://lilypond.org/";
+    license = with lib.licenses; [
+      gpl3Plus # most code
+      gpl3Only # ly/articulate.ly
+      fdl13Plus # docs
+      ofl # mf/
+    ];
+    maintainers = with lib.maintainers; [
      marcweber
      yurrriq
    ];
-    platforms = platforms.all;
+    platforms = lib.platforms.all;
  };

  FONTCONFIG_FILE = lib.optional stdenv.hostPlatform.isDarwin (makeFontsConf {
@@ -1,14 +1,14 @@
 {
  lib,
-  fetchurl,
+  fetchzip,
  lilypond,
 }:

 lilypond.overrideAttrs (oldAttrs: rec {
-  version = "2.25.24";
-  src = fetchurl {
+  version = "2.25.25";
+  src = fetchzip {
    url = "https://lilypond.org/download/sources/v${lib.versions.majorMinor version}/lilypond-${version}.tar.gz";
-    hash = "sha256-1n6mJBbZcfQYsmrjWxcG/EtIyF9uHNRVT7fX3+zoXc4=";
+    hash = "sha256-OO3yXA2PgOuUUR4Bo5wP4PieBvIxV1N9hPiapOB6cAE=";
  };

  passthru.updateScript = {
@@ -21,5 +21,5 @@ echo "[{\"commitMessage\":\"$ATTR: $PREV -> $NEXT\"}]"

 # update hash
 PREV=$(nix eval --raw -f default.nix $ATTR.src.outputHash)
-NEXT=$(nix hash to-sri --type sha256 $(nix-prefetch-url --type sha256 $(nix eval --raw -f default.nix $ATTR.src.url)))
+NEXT=$(nix hash to-sri --type sha256 $(nix-prefetch-url --type sha256 --unpack $(nix eval --raw -f default.nix $ATTR.src.url)))
 sed -i "s|$PREV|$NEXT|" "$FILE"
@@ -1817,6 +1817,8 @@ mapAliases {
  libtransmission = lib.warnOnInstantiate (transmission3Warning {
    prefix = "lib";
  }) libtransmission_3; # Added 2024-06-10
+  lpcnetfreedv = throw "lpcnetfreedv was removed in favor of LPCNet"; # Added 2025-05-05
+  LPCNet = lpcnet; # Added 2025-05-05
  tracker = lib.warnOnInstantiate "tracker has been renamed to tinysparql" tinysparql; # Added 2024-09-30
  tracker-miners = lib.warnOnInstantiate "tracker-miners has been renamed to localsearch" localsearch; # Added 2024-09-30
  transcode = throw "transcode has been removed as it is unmaintained"; # Added 2024-12-11
@@ -5126,6 +5126,7 @@ with pkgs;
  );
  flutterPackages = flutterPackages-bin;
  flutter = flutterPackages.stable;
+  flutter332 = flutterPackages.v3_32;
  flutter329 = flutterPackages.v3_29;
  flutter327 = flutterPackages.v3_27;
  flutter326 = flutterPackages.v3_26;
@@ -5713,6 +5714,7 @@ with pkgs;
  openjfx17 = openjfx;
  openjfx21 = callPackage ../by-name/op/openjfx/package.nix { featureVersion = "21"; };
  openjfx23 = callPackage ../by-name/op/openjfx/package.nix { featureVersion = "23"; };
+  openjfx24 = callPackage ../by-name/op/openjfx/package.nix { featureVersion = "24"; };

  openjdk8-bootstrap = javaPackages.compiler.openjdk8-bootstrap;
  openjdk8 = javaPackages.compiler.openjdk8;
@@ -5744,6 +5746,11 @@ with pkgs;
  jdk23 = openjdk23;
  jdk23_headless = openjdk23_headless;

+  openjdk24 = javaPackages.compiler.openjdk24;
+  openjdk24_headless = javaPackages.compiler.openjdk24.headless;
+  jdk24 = openjdk24;
+  jdk24_headless = openjdk24_headless;
+
  # default JDK
  jdk = jdk21;
  jdk_headless = jdk21_headless;
@@ -5779,9 +5786,7 @@ with pkgs;
      graalvmDrv = graalvmPackages.graalvm-ce;
    }).override;

-  openshot-qt = libsForQt5.callPackage ../applications/video/openshot-qt {
-    python3 = python311;
-  };
+  openshot-qt = libsForQt5.callPackage ../applications/video/openshot-qt { };

  inherit (callPackage ../development/compilers/julia { })
    julia_19-bin
@@ -6244,6 +6249,7 @@ with pkgs;
  zulu17 = callPackage ../development/compilers/zulu/17.nix { };
  zulu21 = callPackage ../development/compilers/zulu/21.nix { };
  zulu23 = callPackage ../development/compilers/zulu/23.nix { };
+  zulu24 = callPackage ../development/compilers/zulu/24.nix { };
  zulu = zulu21;

  ### DEVELOPMENT / INTERPRETERS
@@ -49,6 +49,7 @@ with pkgs;
      openjdk17 = mkOpenjdk "17";
      openjdk21 = mkOpenjdk "21";
      openjdk23 = mkOpenjdk "23";
+      openjdk24 = mkOpenjdk "24";

      # Legacy aliases
      openjdk8-bootstrap = temurin-bin.jdk-8;
@@ -4372,7 +4372,9 @@ self: super: with self; {

  eheimdigital = callPackage ../development/python-modules/eheimdigital { };

-  eigenpy = callPackage ../development/python-modules/eigenpy { };
+  eigenpy = callPackage ../development/python-modules/eigenpy {
+    inherit (pkgs) graphviz; # need the `dot` program, not the python module
+  };

  einops = callPackage ../development/python-modules/einops { };

@@ -5171,6 +5173,8 @@ self: super: with self; {

  flynt = callPackage ../development/python-modules/flynt { };

+  fmpy = callPackage ../development/python-modules/fmpy { };
+
  fnllm = callPackage ../development/python-modules/fnllm { };

  fnv-hash-fast = callPackage ../development/python-modules/fnv-hash-fast { };
@@ -190,9 +190,7 @@ makeScopeWithSplicing' {

        liblastfm = callPackage ../development/libraries/liblastfm { };

-        libopenshot = callPackage ../development/libraries/libopenshot {
-          python3 = pkgs.python311;
-        };
+        libopenshot = callPackage ../development/libraries/libopenshot { };

        packagekit-qt = callPackage ../tools/package-management/packagekit/qt.nix { };