Merge branch 'master' into current

2025-07-16 09:21:26 +02:00
parent c4ffc7691f 4c04711a91
commit 5caf94ab00
512 changed files with 3784 additions and 2158 deletions
@@ -43,7 +43,7 @@ jobs:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          sparse-checkout: |
-            ci/labels
+            ci/github-script

      - name: Install dependencies
        run: npm install @actions/artifact bottleneck
@@ -69,7 +69,7 @@ jobs:
          github-token: ${{ steps.app-token.outputs.token || github.token }}
          retries: 3
          script: |
-            require('./ci/labels/labels.cjs')({
+            require('./ci/github-script/labels.js')({
              github,
              context,
              core,
@@ -0,0 +1,3 @@
+[run]
+indent_style = space
+indent_size = 2
@@ -0,0 +1,13 @@
+# GitHub specific CI scripts
+
+This folder contains [`actions/github-script`](https://github.com/actions/github-script)-based JavaScript code.
+It provides a `nix-shell` environment to run and test these actions locally.
+
+To run any of the scripts locally:
+
+- Enter `nix-shell` in `./ci/github-script`.
+- Ensure `gh` is authenticated.
+
+## Labeler
+
+Run `./run labels OWNER REPO`, where OWNER is your username or "NixOS" and REPO the name of your fork or "nixpkgs".
@@ -1,61 +1,12 @@
 module.exports = async function ({ github, context, core, dry }) {
-  const Bottleneck = require('bottleneck')
  const path = require('node:path')
  const { DefaultArtifactClient } = require('@actions/artifact')
  const { readFile, writeFile } = require('node:fs/promises')
+  const withRateLimit = require('./withRateLimit.js')

  const artifactClient = new DefaultArtifactClient()

-  const stats = {
-    issues: 0,
-    prs: 0,
-    requests: 0,
-    artifacts: 0,
-  }
-
-  // Rate-Limiting and Throttling, see for details:
-  //   https://github.com/octokit/octokit.js/issues/1069#throttling
-  //   https://docs.github.com/en/rest/using-the-rest-api/best-practices-for-using-the-rest-api
-  const allLimits = new Bottleneck({
-    // Avoid concurrent requests
-    maxConcurrent: 1,
-    // Will be updated with first `updateReservoir()` call below.
-    reservoir: 0,
-  })
-  // Pause between mutative requests
-  const writeLimits = new Bottleneck({ minTime: 1000 }).chain(allLimits)
-  github.hook.wrap('request', async (request, options) => {
-    // Requests to the /rate_limit endpoint do not count against the rate limit.
-    if (options.url == '/rate_limit') return request(options)
-    // Search requests are in a different resource group, which allows 30 requests / minute.
-    // We do less than a handful each run, so not implementing throttling for now.
-    if (options.url.startsWith('/search/')) return request(options)
-    stats.requests++
-    if (['POST', 'PUT', 'PATCH', 'DELETE'].includes(options.method))
-      return writeLimits.schedule(request.bind(null, options))
-    else return allLimits.schedule(request.bind(null, options))
-  })
-
-  async function updateReservoir() {
-    let response
-    try {
-      response = await github.rest.rateLimit.get()
-    } catch (err) {
-      core.error(`Failed updating reservoir:\n${err}`)
-      // Keep retrying on failed rate limit requests instead of exiting the script early.
-      return
-    }
-    // Always keep 1000 spare requests for other jobs to do their regular duty.
-    // They normally use below 100, so 1000 is *plenty* of room to work with.
-    const reservoir = Math.max(0, response.data.resources.core.remaining - 1000)
-    core.info(`Updating reservoir to: ${reservoir}`)
-    allLimits.updateSettings({ reservoir })
-  }
-  await updateReservoir()
-  // Update remaining requests every minute to account for other jobs running in parallel.
-  const reservoirUpdater = setInterval(updateReservoir, 60 * 1000)
-
-  async function handlePullRequest(item) {
+  async function handlePullRequest({ item, stats }) {
    const log = (k, v) => core.info(`PR #${item.number} - ${k}: ${v}`)

    const pull_number = item.number
@@ -221,7 +172,7 @@ module.exports = async function ({ github, context, core, dry }) {
    return prLabels
  }

-  async function handle(item) {
+  async function handle({ item, stats }) {
    try {
      const log = (k, v, skip) => {
        core.info(`#${item.number} - ${k}: ${v}` + (skip ? ' (skipped)' : ''))
@@ -237,7 +188,7 @@ module.exports = async function ({ github, context, core, dry }) {

      if (item.pull_request || context.payload.pull_request) {
        stats.prs++
-        Object.assign(itemLabels, await handlePullRequest(item))
+        Object.assign(itemLabels, await handlePullRequest({ item, stats }))
      } else {
        stats.issues++
      }
@@ -326,9 +277,9 @@ module.exports = async function ({ github, context, core, dry }) {
    }
  }

-  try {
+  await withRateLimit({ github, core }, async (stats) => {
    if (context.payload.pull_request) {
-      await handle(context.payload.pull_request)
+      await handle({ item: context.payload.pull_request, stats })
    } else {
      const lastRun = (
        await github.rest.actions.listWorkflowRuns({
@@ -447,17 +398,11 @@ module.exports = async function ({ github, context, core, dry }) {
            arr.findIndex((firstItem) => firstItem.number == thisItem.number),
        )

-      ;(await Promise.allSettled(items.map(handle)))
+      ;(await Promise.allSettled(items.map((item) => handle({ item, stats }))))
        .filter(({ status }) => status == 'rejected')
        .map(({ reason }) =>
          core.setFailed(`${reason.message}\n${reason.cause.stack}`),
        )
-
-      core.notice(
-        `Processed ${stats.prs} PRs, ${stats.issues} Issues, made ${stats.requests + stats.artifacts} API requests and downloaded ${stats.artifacts} artifacts.`,
-      )
    }
-  } finally {
-    clearInterval(reservoirUpdater)
-  }
+  })
 }
@@ -1,5 +1,5 @@
 {
-  "name": "labels",
+  "name": "github-script",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
@@ -7,7 +7,8 @@
      "dependencies": {
        "@actions/artifact": "2.3.2",
        "@actions/github": "6.0.1",
-        "bottleneck": "2.19.5"
+        "bottleneck": "2.19.5",
+        "commander": "14.0.0"
      }
    },
    "node_modules/@actions/artifact": {
@@ -950,6 +951,15 @@
      "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
      "license": "MIT"
    },
+    "node_modules/commander": {
+      "version": "14.0.0",
+      "resolved": "https://registry.npmjs.org/commander/-/commander-14.0.0.tgz",
+      "integrity": "sha512-2uM9rYjPvyq39NwLRqaiLtWHyDC1FvryJDa2ATTVims5YAS4PupsEQsDvP14FqhFr0P49CYDugi59xaxJlTXRA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=20"
+      }
+    },
    "node_modules/compress-commons": {
      "version": "6.0.2",
      "resolved": "https://registry.npmjs.org/compress-commons/-/compress-commons-6.0.2.tgz",
@@ -1,9 +1,9 @@
 {
  "private": true,
-  "type": "module",
  "dependencies": {
    "@actions/artifact": "2.3.2",
    "@actions/github": "6.0.1",
-    "bottleneck": "2.19.5"
+    "bottleneck": "2.19.5",
+    "commander": "14.0.0"
  }
 }
@@ -0,0 +1,67 @@
+#!/usr/bin/env -S node --import ./run
+import { execSync } from 'node:child_process'
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { program } from 'commander'
+import { getOctokit } from '@actions/github'
+
+async function run(action, owner, repo, pull_number, dry) {
+  const token = execSync('gh auth token', { encoding: 'utf-8' }).trim()
+
+  const github = getOctokit(token)
+
+  const payload = !pull_number ? {} : {
+    pull_request: (await github.rest.pulls.get({
+      owner,
+      repo,
+      pull_number,
+    })).data
+  }
+
+  const tmp = mkdtempSync(join(tmpdir(), 'github-script-'))
+  try {
+    process.env.GITHUB_WORKSPACE = tmp
+    process.chdir(tmp)
+
+    await action({
+      github,
+      context: {
+        payload,
+        repo: {
+          owner,
+          repo,
+        },
+      },
+      core: {
+        getInput() {
+          return token
+        },
+        error: console.error,
+        info: console.log,
+        notice: console.log,
+        setFailed(msg) {
+          console.error(msg)
+          process.exitCode = 1
+        },
+      },
+      dry,
+    })
+  } finally {
+    rmSync(tmp, { recursive: true })
+  }
+}
+
+program
+  .command('labels')
+  .description('Manage labels on pull requests.')
+  .argument('<owner>', 'Owner of the GitHub repository to label (Example: NixOS)')
+  .argument('<repo>', 'Name of the GitHub repository to label (Example: nixpkgs)')
+  .argument('[pr]', 'Number of the Pull Request to label')
+  .option('--no-dry', 'Make actual modifications')
+  .action(async (owner, repo, pr, options) => {
+    const labels = (await import('./labels.js')).default
+    run(labels, owner, repo, pr, options.dry)
+  })
+
+await program.parse()
@@ -5,12 +5,14 @@

 pkgs.callPackage (
  {
-    mkShell,
+    gh,
    importNpmLock,
+    mkShell,
    nodejs,
  }:
  mkShell {
    packages = [
+      gh
      importNpmLock.hooks.linkNodeModulesHook
      nodejs
    ];
@@ -0,0 +1,61 @@
+module.exports = async function ({ github, core }, callback) {
+  const Bottleneck = require('bottleneck')
+
+  const stats = {
+    issues: 0,
+    prs: 0,
+    requests: 0,
+    artifacts: 0,
+  }
+
+  // Rate-Limiting and Throttling, see for details:
+  //   https://github.com/octokit/octokit.js/issues/1069#throttling
+  //   https://docs.github.com/en/rest/using-the-rest-api/best-practices-for-using-the-rest-api
+  const allLimits = new Bottleneck({
+    // Avoid concurrent requests
+    maxConcurrent: 1,
+    // Will be updated with first `updateReservoir()` call below.
+    reservoir: 0,
+  })
+  // Pause between mutative requests
+  const writeLimits = new Bottleneck({ minTime: 1000 }).chain(allLimits)
+  github.hook.wrap('request', async (request, options) => {
+    // Requests to the /rate_limit endpoint do not count against the rate limit.
+    if (options.url == '/rate_limit') return request(options)
+    // Search requests are in a different resource group, which allows 30 requests / minute.
+    // We do less than a handful each run, so not implementing throttling for now.
+    if (options.url.startsWith('/search/')) return request(options)
+    stats.requests++
+    if (['POST', 'PUT', 'PATCH', 'DELETE'].includes(options.method))
+      return writeLimits.schedule(request.bind(null, options))
+    else return allLimits.schedule(request.bind(null, options))
+  })
+
+  async function updateReservoir() {
+    let response
+    try {
+      response = await github.rest.rateLimit.get()
+    } catch (err) {
+      core.error(`Failed updating reservoir:\n${err}`)
+      // Keep retrying on failed rate limit requests instead of exiting the script early.
+      return
+    }
+    // Always keep 1000 spare requests for other jobs to do their regular duty.
+    // They normally use below 100, so 1000 is *plenty* of room to work with.
+    const reservoir = Math.max(0, response.data.resources.core.remaining - 1000)
+    core.info(`Updating reservoir to: ${reservoir}`)
+    allLimits.updateSettings({ reservoir })
+  }
+  await updateReservoir()
+  // Update remaining requests every minute to account for other jobs running in parallel.
+  const reservoirUpdater = setInterval(updateReservoir, 60 * 1000)
+
+  try {
+    await callback(stats)
+  } finally {
+    clearInterval(reservoirUpdater)
+    core.notice(
+      `Processed ${stats.prs} PRs, ${stats.issues} Issues, made ${stats.requests + stats.artifacts} API requests and downloaded ${stats.artifacts} artifacts.`,
+    )
+  }
+}
@@ -1,4 +0,0 @@
-# TODO: Move to <top-level>/.editorconfig, once ci/.editorconfig has made its way through staging.
-[*.cjs]
-indent_style = space
-indent_size = 2
@@ -1,4 +0,0 @@
-To test the labeler locally:
- Provide `gh` on `PATH` and make sure it's authenticated.
- Enter `nix-shell` in `./ci/labels`.
- Run `./run.js OWNER REPO`, where OWNER is your username or "NixOS" and REPO the name of your fork or "nixpkgs".
@@ -1,45 +0,0 @@
-#!/usr/bin/env node
-import { execSync } from 'node:child_process'
-import { mkdtempSync, rmSync } from 'node:fs'
-import { tmpdir } from 'node:os'
-import { join } from 'node:path'
-import { getOctokit } from '@actions/github'
-import labels from './labels.cjs'
-
-if (process.argv.length !== 4)
-  throw new Error('Call this with exactly two arguments: ./run.js OWNER REPO')
-const [, , owner, repo] = process.argv
-
-const token = execSync('gh auth token', { encoding: 'utf-8' }).trim()
-
-const tmp = mkdtempSync(join(tmpdir(), 'labels-'))
-try {
-  process.env.GITHUB_WORKSPACE = tmp
-  process.chdir(tmp)
-
-  await labels({
-    github: getOctokit(token),
-    context: {
-      payload: {},
-      repo: {
-        owner,
-        repo,
-      },
-    },
-    core: {
-      getInput() {
-        return token
-      },
-      error: console.error,
-      info: console.log,
-      notice: console.log,
-      setFailed(msg) {
-        console.error(msg)
-        process.exitCode = 1
-      },
-    },
-    dry: true,
-  })
-} finally {
-  rmSync(tmp, { recursive: true })
-}
@@ -443,8 +443,8 @@ stdenv.mkDerivation (finalAttrs: {

  pnpmDeps = pnpm.fetchDeps {
    inherit (finalAttrs) pname version src;
-    hash = "...";
    fetcherVersion = 2;
+    hash = "...";
  };
 })
 ```
@@ -568,8 +568,8 @@ This is the version of the output of `pnpm.fetchDeps`, if you haven't set it alr
  # ...
  pnpmDeps = pnpm.fetchDeps {
    # ...
-    hash = "..."; # you can use your already set hash here
    fetcherVersion = 1;
+    hash = "..."; # you can use your already set hash here
  };
 }
 ```
@@ -581,8 +581,8 @@ After upgrading to a newer `fetcherVersion`, you need to regenerate the hash:
  # ...
  pnpmDeps = pnpm.fetchDeps {
    # ...
-    hash = "..."; # clear this hash and generate a new one
    fetcherVersion = 2;
+    hash = "..."; # clear this hash and generate a new one
  };
 }
 ```
@@ -43,6 +43,8 @@
  of the [4.3 release](https://github.com/netbox-community/netbox/releases/tag/v4.2.0),
  make the required changes to your database, if needed, then upgrade by setting `services.netbox.package = pkgs.netbox_4_3;` in your configuration.

+- `go-mockery` has been updated to v3. For migration instructions see the [upstream documentation](https://vektra.github.io/mockery/latest/v3/). If v2 is still required `go-mockery_v2` has been added but will be removed on or before 2029-12-31 in-line with it's [upstream support lifecycle](https://vektra.github.io/mockery/
+
 ## Other Notable Changes {#sec-nixpkgs-release-25.11-notable-changes}

 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
@@ -327,18 +327,54 @@ Dependency propagation takes cross compilation into account, meaning that depend

 To determine the exact rules for dependency propagation, we start by assigning to each dependency a couple of ternary numbers (`-1` for `build`, `0` for `host`, and `1` for `target`) representing its [dependency type](#possible-dependency-types), which captures how its host and target platforms are each "offset" from the depending derivation’s host and target platforms. The following table summarize the different combinations that can be obtained:

-| `host → target`     | attribute name      | offset   |
-| ------------------- | ------------------- | -------- |
-| `build --> build`   | `depsBuildBuild`    | `-1, -1` |
-| `build --> host`    | `nativeBuildInputs` | `-1, 0`  |
-| `build --> target`  | `depsBuildTarget`   | `-1, 1`  |
-| `host --> host`     | `depsHostHost`      | `0, 0`   |
-| `host --> target`   | `buildInputs`       | `0, 1`   |
-| `target --> target` | `depsTargetTarget`  | `1, 1`   |
+| `host → target`     | attribute name      | offset   | typical purpose                               |
+| ------------------- | ------------------- | -------- | --------------------------------------------- |
+| `build --> build`   | `depsBuildBuild`    | `-1, -1` | compilers for build helpers                   |
+| `build --> host`    | `nativeBuildInputs` | `-1, 0`  | build tools, compilers, setup hooks           |
+| `build --> target`  | `depsBuildTarget`   | `-1, 1`  | compilers to build stdlibs to run on target   |
+| `host --> host`     | `depsHostHost`      | `0, 0`   | compilers to build C code at runtime (rare)   |
+| `host --> target`   | `buildInputs`       | `0, 1`   | libraries                                     |
+| `target --> target` | `depsTargetTarget`  | `1, 1`   | stdlibs to run on target                      |

 Algorithmically, we traverse propagated inputs, accumulating every propagated dependency’s propagated dependencies and adjusting them to account for the “shift in perspective” described by the current dependency’s platform offsets. This results is sort of a transitive closure of the dependency relation, with the offsets being approximately summed when two dependency links are combined. We also prune transitive dependencies whose combined offsets go out-of-bounds, which can be viewed as a filter over that transitive closure removing dependencies that are blatantly absurd.

-We can define the process precisely with [Natural Deduction](https://en.wikipedia.org/wiki/Natural_deduction) using the inference rules. This probably seems a bit obtuse, but so is the bash code that actually implements it! [^footnote-stdenv-find-inputs-location] They’re confusing in very different ways so… hopefully if something doesn’t make sense in one presentation, it will in the other!
+We can define the process precisely with [Natural Deduction](https://en.wikipedia.org/wiki/Natural_deduction) using the inference rules below. This probably seems a bit obtuse, but so is the bash code that actually implements it! [^footnote-stdenv-find-inputs-location] They’re confusing in very different ways so… hopefully if something doesn’t make sense in one presentation, it will in the other!
+
+**Definitions:**
+
+`dep(h_offset, t_offset, X, Y)`
+:    Package X has a direct dependency on Y in a position with host offset `h_offset` and target offset `t_offset`.
+
+     For example, `nativeBuildInputs = [ Y ]` means `dep(-1, 0, X, Y)`.
+
+`propagated-dep(h_offset, t_offset, X, Y)`
+:    Package X has a propagated dependency on Y in a position with host offset `h_offset` and target offset `t_offset`.
+
+     For example, `depsBuildTargetPropagated = [ Y ]` means `propagated-dep(-1, 1, X, Y)`.
+
+`mapOffset(h, t, i) = offs`
+:    In a package X with a dependency on Y in a position with host offset `h` and target offset `t`, Y's transitive dependency Z in a position with offset `i` is mapped to offset `offs` in X.
+
+
+::: {.example}
+# Truth table of `mapOffset(h, t, i)`
+
+`x` means that the dependency was discarded because `h + i ∉ {-1, 0, 1}`.
+
+<!-- This is written as an ascii art table because the CSS was introducing so much space it was unreadable and doesn't support double lines -->
+
+```
+  h |   t  || i=-1 |  i=0 |  i=1
+----|------||------|------|-----
+ -1 |  -1  ||   x  |  -1  |  -1
+ -1 |   0  ||   x  |  -1  |   0
+ -1 |   1  ||   x  |  -1  |   1
+  0 |   0  ||  -1  |   0  |   0
+  0 |   1  ||  -1  |   0  |   1
+  1 |   1  ||   0  |   1  |   x
+```
+
+:::

 ```
 let mapOffset(h, t, i) = i + (if i <= 0 then h else t - 1)
@@ -372,7 +408,7 @@ propagated-dep(h, t, A, B)
 dep(h, t, A, B)
 ```

-Some explanation of this monstrosity is in order. In the common case, the target offset of a dependency is the successor to the host offset: `t = h + 1`. That means that:
+Some explanation of this monstrosity is in order. In the common case of `nativeBuildInputs` or `buildInputs`, the target offset of a dependency is one greater than the host offset: `t = h + 1`. That means that:

 ```
 let f(h, t, i) = i + (if i <= 0 then h else t - 1)
@@ -383,7 +419,11 @@ let f(h, h + 1, i) = i + h

 This is where “sum-like” comes in from above: We can just sum all of the host offsets to get the host offset of the transitive dependency. The target offset is the transitive dependency is the host offset + 1, just as it was with the dependencies composed to make this transitive one; it can be ignored as it doesn’t add any new information.

-Because of the bounds checks, the uncommon cases are `h = t` and `h + 2 = t`. In the former case, the motivation for `mapOffset` is that since its host and target platforms are the same, no transitive dependency of it should be able to “discover” an offset greater than its reduced target offsets. `mapOffset` effectively “squashes” all its transitive dependencies’ offsets so that none will ever be greater than the target offset of the original `h = t` package. In the other case, `h + 1` is skipped over between the host and target offsets. Instead of squashing the offsets, we need to “rip” them apart so no transitive dependencies’ offset is that one.
+Because of the bounds checks, the uncommon cases are `h = t` (`depsBuildBuild`, etc) and `h + 2 = t` (`depsBuildTarget`).
+
+In the former case, the motivation for `mapOffset` is that since its host and target platforms are the same, no transitive dependency of it should be able to “discover” an offset greater than its reduced target offsets. `mapOffset` effectively “squashes” all its transitive dependencies’ offsets so that none will ever be greater than the target offset of the original `h = t` package.
+
+In the other case, `h + 1` (0) is skipped over between the host (-1) and target (1) offsets. Instead of squashing the offsets, we need to “rip” them apart so no transitive dependency’s offset is 0.

 Overall, the unifying theme here is that propagation shouldn’t be introducing transitive dependencies involving platforms the depending package is unaware of. \[One can imagine the depending package asking for dependencies with the platforms it knows about; other platforms it doesn’t know how to ask for. The platform description in that scenario is a kind of unforgeable capability.\] The offset bounds checking and definition of `mapOffset` together ensure that this is the case. Discovering a new offset is discovering a new platform, and since those platforms weren’t in the derivation “spec” of the needing package, they cannot be relevant. From a capability perspective, we can imagine that the host and target platforms of a package are the capabilities a package requires, and the depending package must provide the capability to the dependency.

@@ -7840,6 +7840,12 @@
    name = "Elis Hirwing";
    keys = [ { fingerprint = "67FE 98F2 8C44 CF22 1828  E12F D57E FA62 5C9A 925F"; } ];
  };
+  eu90h = {
+    email = "stefan@eu90h.com";
+    github = "eu90h";
+    githubId = 5161785;
+    name = "Stefan";
+  };
  euank = {
    email = "euank-nixpkg@euank.com";
    github = "euank";
@@ -10946,6 +10952,12 @@
    githubId = 16307070;
    name = "iosmanthus";
  };
+  iqubic = {
+    email = "sophia.b.caspe@gmail.com";
+    github = "iqubic";
+    githubId = 22628816;
+    name = "Sophia Caspe";
+  };
  iquerejeta = {
    github = "iquerejeta";
    githubId = 31273774;
@@ -23100,6 +23112,12 @@
    githubId = 251028;
    name = "Shell Turner";
  };
+  shellhazard = {
+    email = "shellhazard@tutanota.com";
+    github = "shellhazard";
+    githubId = 10951745;
+    name = "shellhazard";
+  };
  shelvacu = {
    name = "Shelvacu";
    email = "nix-maint@shelvacu.com";
@@ -2,6 +2,7 @@
 #!nix-shell -i python3 -p "python3.withPackages(ps: [ ps.beautifulsoup4 ps.click ps.httpx ps.jinja2 ps.packaging ps.pyyaml ])" nix-update
 import base64
 import binascii
+import hashlib
 import json
 import pathlib
 import subprocess
@@ -112,8 +113,17 @@ def main(pkgset: str, version: str, nixpkgs: pathlib.Path, sources_url: str | No

        url = urljoin(sources_url, link.attrs["href"])

-        hash = client.get(url + ".sha256").text.split(" ", maxsplit=1)[0]
-        assert hash
+        hash = client.get(url + ".sha256").text.strip()
+
+        if hash == "Hash type not supported":
+            print(f"{url} missing hash on CDN, downloading...")
+            hasher = hashlib.sha256()
+            with client.stream("GET", url, follow_redirects=True) as r:
+                for data in r.iter_bytes():
+                    hasher.update(data)
+            hash = hasher.hexdigest()
+        else:
+            hash = hash.split(" ", maxsplit=1)[0]

        if existing := results.get(project_name):
            old_version = existing["version"]
@@ -125,6 +125,11 @@
 - `amdgpu` kernel driver overdrive mode can now be enabled by setting [hardware.amdgpu.overdrive.enable](#opt-hardware.amdgpu.overdrive.enable) and customized through [hardware.amdgpu.overdrive.ppfeaturemask](#opt-hardware.amdgpu.overdrive.ppfeaturemask).
  This allows for fine-grained control over the GPU's performance and maybe required by overclocking softwares like Corectrl and Lact. These new options replace old options such as {option}`programs.corectrl.gpuOverclock.enable` and {option}`programs.tuxclocker.enableAMD`.

+- `services.varnish.http_address` has been superseeded by `services.varnish.listen` which is now
+  structured config for all of varnish's `-a` variations.
+
 - [](#opt-services.gnome.gnome-keyring.enable) does not ship with an SSH agent anymore, as this is now handled by the `gcr_4` package instead of `gnome-keyring`. A new module has been added to support this, under [](#opt-services.gnome.gcr-ssh-agent.enable) (its default value has been set to [](#opt-services.gnome.gnome-keyring.enable) to ensure a smooth transition). See the [relevant upstream PR](https://gitlab.gnome.org/GNOME/gcr/-/merge_requests/67) for more details.

 - The `nettools` package (ifconfig, arp, mii-tool, netstat, route) is not installed by default anymore. The suite is unmaintained and users should migrate to `iproute2` and `ethtool` instead.
+
+- `sparkleshare` has been removed as it no longer builds and has been abandoned upstream.
@@ -0,0 +1,33 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.hardware.kryoflux;
+
+in
+{
+  options.hardware.kryoflux = {
+    enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = ''
+        Enables kryoflux udev rules, ensures 'floppy' group exists. This is a
+        prerequisite to using devices supported by kryoflux without being root,
+        since kryoflux device descriptors will be owned by floppy through udev.
+      '';
+    };
+    package = lib.mkPackageOption pkgs "kryoflux" { };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.udev.packages = [ cfg.package ];
+    environment.systemPackages = [ cfg.package ];
+    users.groups.floppy = { };
+  };
+
+  meta.maintainers = with lib.maintainers; [ matthewcroughan ];
+}
@@ -121,6 +121,7 @@ in

    users.users.spamd = {
      description = "Spam Assassin Daemon";
+      home = "/var/lib/spamassassin";
      uid = config.ids.uids.spamd;
      group = "spamd";
    };
@@ -22,6 +22,7 @@ Example configuration:
 {
  services.pihole-ftl = {
    enable = true;
+    openFirewallDNS = true;
    openFirewallDHCP = true;
    queryLogDeleter.enable = true;
    lists = [
@@ -56,6 +56,12 @@ in
      example = "3";
    };

+    openFirewallDNS = mkOption {
+      type = types.bool;
+      default = false;
+      description = "Open ports in the firewall for pihole-FTL's DNS server.";
+    };
+
    openFirewallDHCP = mkOption {
      type = types.bool;
      default = false;
@@ -434,11 +440,15 @@ in
    };

    networking.firewall = lib.mkMerge [
-      (mkIf cfg.openFirewallDHCP {
+      (mkIf cfg.openFirewallDNS {
        allowedUDPPorts = [ 53 ];
        allowedTCPPorts = [ 53 ];
      })

+      (mkIf cfg.openFirewallDHCP {
+        allowedUDPPorts = [ 67 ];
+      })
+
      (mkIf cfg.openFirewallWebserver {
        allowedTCPPorts = lib.pipe cfg.settings.webserver.port [
          (lib.splitString ",")
@@ -6,6 +6,16 @@
 }:

 let
+  inherit (lib)
+    types
+    mkOption
+    hasPrefix
+    concatMapStringsSep
+    optionalString
+    concatMap
+    ;
+  inherit (builtins) isNull;
+
  cfg = config.services.varnish;

  # Varnish has very strong opinions and very complicated code around handling
@@ -26,6 +36,91 @@ let
    else
      "/var/run/varnishd";

+  # from --help:
+  #   -a [<name>=]address[:port][,proto] # HTTP listen address and port
+  #      [,user=<u>][,group=<g>]   # Can be specified multiple times.
+  #      [,mode=<m>]               #   default: ":80,HTTP"
+  #                                # Proto can be "PROXY" or "HTTP" (default)
+  #                                # user, group and mode set permissions for
+  #                                #   a Unix domain socket.
+  commandLineAddresses =
+    (concatMapStringsSep " " (
+      a:
+      "-a "
+      + optionalString (!isNull a.name) "${a.name}="
+      + a.address
+      + optionalString (!isNull a.port) ":${toString a.port}"
+      + optionalString (!isNull a.proto) ",${a.proto}"
+      + optionalString (!isNull a.user) ",user=${a.user}"
+      + optionalString (!isNull a.group) ",group=${a.group}"
+      + optionalString (!isNull a.mode) ",mode=${a.mode}"
+    ) cfg.listen)
+    + lib.optionalString (!isNull cfg.http_address) " -a ${cfg.http_address}";
+  addressSubmodule = types.submodule {
+    options = {
+      name = mkOption {
+        description = "Name is referenced in logs. If name is not specified, 'a0', 'a1', etc. is used.";
+        default = null;
+        type = with types; nullOr str;
+      };
+      address = mkOption {
+        description = ''
+          If given an IP address, it can be a host name ("localhost"), an IPv4 dotted-quad
+          ("127.0.0.1") or an IPv6  address enclosed in square brackets ("[::1]").
+
+          (VCL4.1 and higher) If given an absolute Path ("/path/to/listen.sock") or "@"
+          followed by the name of an abstract socket ("@myvarnishd") accept connections
+          on a Unix domain socket.
+
+          The user, group and mode sub-arguments may be used to specify the permissions
+          of the socket file. These sub-arguments do not apply to  abstract sockets.
+        '';
+        type = types.str;
+      };
+      port = mkOption {
+        description = "The port to use for IP sockets. If port is not specified, port 80 (http) is used.";
+        default = null;
+        type = with types; nullOr int;
+      };
+      proto = mkOption {
+        description = "PROTO can be 'HTTP' (the default) or 'PROXY'.  Both version 1 and 2 of the proxy protocol can be used.";
+        type = types.enum [
+          "HTTP"
+          "PROXY"
+        ];
+        default = "HTTP";
+      };
+      user = mkOption {
+        description = "User name who owns the socket file.";
+        default = null;
+        type = with lib.types; nullOr str;
+      };
+      group = mkOption {
+        description = "Group name who owns the socket file.";
+        default = null;
+        type = with lib.types; nullOr str;
+      };
+      mode = mkOption {
+        description = "Permission of the socket file (3-digit octal value).";
+        default = null;
+        type = with types; nullOr str;
+      };
+    };
+  };
+  checkedAddressModule = types.addCheck addressSubmodule (
+    m:
+    (
+      if ((hasPrefix "@" m.address) || (hasPrefix "/" m.address)) then
+        # this is a unix socket
+        (m.port != null)
+      else
+      # this is not a path-based unix socket
+      if !(hasPrefix "/" m.address) && (m.group != null) || (m.user != null) || (m.mode != null) then
+        false
+      else
+        true
+    )
+  );
  commandLine =
    "-f ${pkgs.writeText "default.vcl" cfg.config}"
    +
@@ -54,13 +149,23 @@ in
      package = lib.mkPackageOption pkgs "varnish" { };

      http_address = lib.mkOption {
-        type = lib.types.str;
-        default = "*:6081";
+        type = with lib.types; nullOr str;
+        default = null;
        description = ''
          HTTP listen address and port.
        '';
      };

+      listen = lib.mkOption {
+        description = "Accept for client requests on the specified listen addresses.";
+        type = lib.types.listOf checkedAddressModule;
+        defaultText = lib.literalExpression ''[ { address="*"; port=6081; } ]'';
+        default = lib.optional (isNull cfg.http_address) {
+          address = "*";
+          port = 6081;
+        };
+      };
+
      config = lib.mkOption {
        type = lib.types.lines;
        description = ''
@@ -97,7 +202,7 @@ in
      serviceConfig = {
        Type = "simple";
        PermissionsStartOnly = true;
-        ExecStart = "${cfg.package}/sbin/varnishd -a ${cfg.http_address} -n ${stateDir} -F ${cfg.extraCommandLine} ${commandLine}";
+        ExecStart = "${cfg.package}/sbin/varnishd ${commandLineAddresses} -n ${stateDir} -F ${cfg.extraCommandLine} ${commandLine}";
        Restart = "always";
        RestartSec = "5s";
        User = "varnish";
@@ -118,6 +223,21 @@ in
      '')
    ];

+    assertions = concatMap (m: [
+      {
+        assertion = (hasPrefix "/" m.address) || (hasPrefix "@" m.address) -> m.port == null;
+        message = "Listen ports must not be specified with UNIX sockets: ${builtins.toJSON m}";
+      }
+      {
+        assertion = !(hasPrefix "/" m.address) -> m.user == null && m.group == null && m.mode == null;
+        message = "Abstract UNIX sockets or IP sockets can not be used with user, group, and mode settings: ${builtins.toJSON m}";
+      }
+    ]) cfg.listen;
+
+    warnings =
+      lib.optional (!isNull cfg.http_address)
+        "The option `services.varnish.http_address` is deprecated. Use `services.varnish.listen` instead.";
+
    users.users.varnish = {
      group = "varnish";
      uid = config.ids.uids.varnish;
@@ -274,7 +274,7 @@ def install_bootloader() -> None:
    profiles = [('system', get_gens())]

    for profile in get_profiles():
-        profiles += (profile, get_gens(profile))
+        profiles += [(profile, get_gens(profile))]

    timeout = config('timeout')
    editor_enabled = 'yes' if config('enableEditor') else 'no'
@@ -1,7 +1,10 @@
 { lib, ... }:
 {
  name = "firefly-iii-data-importer";
-  meta.maintainers = [ lib.maintainers.savyajha ];
+  meta = {
+    maintainers = [ lib.maintainers.savyajha ];
+    platforms = lib.platforms.linux;
+  };

  nodes.dataImporter =
    { ... }:
@@ -57,8 +57,6 @@ let
      "${hosts."${server_host}"}/32"
    ];
    strict_route = false;
-    sniff = true;
-    sniff_override_destination = false;
  };

  tproxyPort = 1081;
@@ -219,6 +217,9 @@ in
                tag = "outbound:direct";
              }
            ];
+            route = {
+              default_interface = "eth1";
+            };
          };
        };
      };
@@ -267,6 +268,7 @@ in
              vmessOutbound
            ];
            route = {
+              default_interface = "eth1";
              final = "outbound:block";
              rules = [
                {
@@ -315,25 +317,28 @@ in
                type = "block";
                tag = "outbound:block";
              }
+            ];
+            endpoints = [
              {
-                type = "direct";
-                tag = "outbound:direct";
-              }
-              {
-                detour = "outbound:direct";
                type = "wireguard";
                tag = "outbound:wireguard";
-                interface_name = "wg0";
-                local_address = [ "10.23.42.2/32" ];
+                name = "wg0";
+                address = [ "10.23.42.2/32" ];
                mtu = 1280;
                private_key = wg-keys.peer1.privateKey;
-                peer_public_key = wg-keys.peer0.publicKey;
-                server = server_host;
-                server_port = 2408;
-                system_interface = true;
+                peers = [
+                  {
+                    address = server_host;
+                    port = 2408;
+                    public_key = wg-keys.peer0.publicKey;
+                    allowed_ips = [ "0.0.0.0/0" ];
+                  }
+                ];
+                system = true;
              }
            ];
            route = {
+              default_interface = "eth1";
              final = "outbound:block";
            };
          };
@@ -377,8 +382,6 @@ in
                listen = "0.0.0.0";
                listen_port = tproxyPort;
                udp_fragment = true;
-                sniff = true;
-                sniff_override_destination = false;
              }
            ];
            outbounds = [
@@ -393,6 +396,7 @@ in
              vmessOutbound
            ];
            route = {
+              default_interface = "eth1";
              final = "outbound:block";
              rules = [
                {
@@ -434,7 +438,7 @@ in
              independent_cache = true;
              fakeip = {
                enabled = true;
-                "inet4_range" = "198.18.0.0/16";
+                inet4_range = "198.18.0.0/16";
              };
              servers = [
                {
@@ -458,7 +462,6 @@ in
                    "AAAA"
                  ];
                  server = "dns:fakeip";
-
                }
              ];
            };
@@ -474,17 +477,17 @@ in
                type = "direct";
                tag = "outbound:direct";
              }
-              {
-                type = "dns";
-                tag = "outbound:dns";
-              }
            ];
            route = {
+              default_interface = "eth1";
              final = "outbound:direct";
              rules = [
+                {
+                  action = "sniff";
+                }
                {
                  protocol = "dns";
-                  outbound = "outbound:dns";
+                  action = "hijack-dns";
                }
              ];
            };
@@ -10,7 +10,12 @@ in

  nodes = {
    varnish =
-      { config, pkgs, ... }:
+      {
+        config,
+        pkgs,
+        lib,
+        ...
+      }:
      {
        services.nix-serve = {
          enable = true;
@@ -19,9 +24,29 @@ in
        services.varnish = {
          inherit package;
          enable = true;
-          http_address = "0.0.0.0:80";
+          http_address = "0.0.0.0:81";
+          listen = [
+            {
+              address = "0.0.0.0";
+              port = 80;
+              proto = "HTTP";
+            }
+            {
+              name = "proxyport";
+              address = "0.0.0.0";
+              port = 8080;
+              proto = "PROXY";
+            }
+            { address = "@asdf"; }
+            {
+              address = "/run/varnishd/client.http.sock";
+              user = "varnish";
+              group = "varnish";
+              mode = "660";
+            }
+          ];
          config = ''
-            vcl 4.0;
+            vcl 4.1;

            backend nix-serve {
              .host = "127.0.0.1";
@@ -32,6 +57,26 @@ in

        networking.firewall.allowedTCPPorts = [ 80 ];
        system.extraDependencies = [ testPath ];
+
+        assertions =
+          map
+            (
+              pattern:
+              let
+                cmdline = config.systemd.services.varnish.serviceConfig.ExecStart;
+              in
+              {
+                assertion = lib.hasInfix pattern cmdline;
+                message = "Address argument `${pattern}` missing in commandline `${cmdline}`.";
+              }
+            )
+            [
+              " -a 0.0.0.0:80,HTTP "
+              " -a proxyport=0.0.0.0:8080,PROXY "
+              " -a @asdf,HTTP "
+              " -a /run/varnishd/client.http.sock,HTTP,user=varnish,group=varnish,mode=660 "
+              " -a 0.0.0.0:81 "
+            ];
      };

    client =
@@ -48,6 +93,7 @@ in
    start_all()
    varnish.wait_for_open_port(80)

+
    client.wait_until_succeeds("curl -f http://varnish/nix-cache-info");

    client.wait_until_succeeds("nix-store -r ${testPath}")
@@ -19,6 +19,8 @@

      services.xserver.desktopManager.xfce.enable = true;
      environment.systemPackages = [ pkgs.xfce.xfce4-whiskermenu-plugin ];
+
+      programs.thunar.plugins = [ pkgs.xfce.thunar-archive-plugin ];
    };

  enableOCR = true;
@@ -24,8 +24,8 @@ stdenv.mkDerivation (finalAttrs: {

  pnpmDeps = pnpm.fetchDeps {
    inherit (finalAttrs) pname version src;
-    hash = "sha256-xIQyTetHU37gTxCcQp4VCqzGdIfVQGy/aORCVba6YQ0=";
    fetcherVersion = 1;
+    hash = "sha256-xIQyTetHU37gTxCcQp4VCqzGdIfVQGy/aORCVba6YQ0=";
  };

  nativeBuildInputs = [
@@ -32,13 +32,13 @@ let
 in
 melpaBuild {
  pname = "lsp-bridge";
-  version = "0-unstable-2025-02-10";
+  version = "0-unstable-2025-06-28";

  src = fetchFromGitHub {
    owner = "manateelazycat";
    repo = "lsp-bridge";
-    rev = "4401d1396dce89d1fc5dc5414565818dd1c30ae0";
-    hash = "sha256-lWbFbYwJoy4UAezKUK7rnjQlDcnszHQwK5I7fuHfE8Y=";
+    rev = "3b37a04bd1b6bbcdc2b0ad7a5c388ad027eb7a25";
+    hash = "sha256-0pjRihJapljd/9nR7G+FC+gCqD82YGITPK2mcJcI7ZI=";
  };

  patches = [
@@ -1,8 +1,8 @@
 diff --git a/lsp-bridge.el b/lsp-bridge.el
-index 278c27e..f0c67c2 100644
+index d3e2ff7..1b1d745 100644
 --- a/lsp-bridge.el
 +++ b/lsp-bridge.el
-@@ -340,19 +340,7 @@ Setting this to nil or 0 will turn off the indicator."
+@@ -417,21 +417,7 @@ LSP-Bridge will enable completion inside string literals."
   "Name of LSP-Bridge buffer."
   :type 'string)
 
@@ -13,7 +13,9 @@ index 278c27e..f0c67c2 100644
 -                                                   "python3.exe")
 -                                                  ((executable-find "python.exe")
 -                                                   "python.exe")))
-                                           (t (cond ((executable-find "pypy3")
+-                                           (t (cond ((executable-find "python-lsp-bridge")
+-                                                     "python-lsp-bridge")
+-                                                    ((executable-find "pypy3")
 -                                                     "pypy3")
 -                                                    ((executable-find "python3")
 -                                                     "python3")
@@ -8,19 +8,19 @@
  gitMinimal,
 }:
 let
-  version = "1.4.1";
+  version = "1.5.0";
  src = fetchFromGitHub {
    owner = "Saghen";
    repo = "blink.cmp";
    tag = "v${version}";
-    hash = "sha256-0RmX/uANgU/di3Iu0V6Oe3jZj4ikzeegW/XQUZhPgRc=";
+    hash = "sha256-R95i3dDVBfH0oxTdK0F0ami0SAk0VVONXIlX6ZF0kmk=";
  };
  blink-fuzzy-lib = rustPlatform.buildRustPackage {
    inherit version src;
    pname = "blink-fuzzy-lib";

    useFetchCargoVendor = true;
-    cargoHash = "sha256-/8eiZyJEwPXAviwVMFTr+NKSwMwxdraKtrlXNU0cBM4=";
+    cargoHash = "sha256-pWBOPMUy/gXeujaowlp2I6kqD+Q95h+f9mXl231DN88=";

    nativeBuildInputs = [ gitMinimal ];

@@ -8,8 +8,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
  mktplcRef = {
    publisher = "RooVeterinaryInc";
    name = "roo-cline";
-    version = "3.22.6";
-    hash = "sha256-Gu1QcGLJVSiFCO7C6q1fVbi5MOztdKyFFyEhxxCpfUE=";
+    version = "3.23.8";
+    hash = "sha256-2k9a27sbKYcrKVFRSdneUAV/bN0Y2Q5a7vorFRmgQPo=";
  };

  passthru.updateScript = vscode-extension-update-script { };
@@ -6,8 +6,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
  mktplcRef = {
    name = "cwtools-vscode";
    publisher = "tboby";
-    version = "0.10.25";
-    hash = "sha256-TcnS4Cwn+V9hwScpLgUK5u8Jfm89EBv+koUOi1bB0DM=";
+    version = "0.10.26";
+    hash = "sha256-1ZfmcF87LyRxCbQvVX21m1yFu+7QeDCofKXEHj5W8DA=";
  };
  meta = {
    description = "Paradox Language Features for Visual Studio Code";
@@ -36,22 +36,22 @@ let

  hash =
    {
-      x86_64-linux = "sha256-72KrCDUBe+xJjnSY/nnrNH92EP4tp71x1fadh0Pe0DM=";
-      x86_64-darwin = "sha256-Ua3oh0Hv0oiW15u3Rb0pSYu+JD8m1oYMAm5pEzXD6Rw=";
-      aarch64-linux = "sha256-5L0ZArj+7M5dhZDGzYj6NaxYYZEb8q89Vhngvjuw7wQ=";
-      aarch64-darwin = "sha256-uWOF/QGgXocKZAkFMN4Kh7HjiQTSIi+PVPy3V90wrAA=";
-      armv7l-linux = "sha256-FyGPvQeVz8yLhLjFGtCXPTVPvCB0/EX6pRe5RCAmXTU=";
+      x86_64-linux = "sha256-zgrNohvsmhcRQmkX7Io2/U3qbVWdcqwT7VK7Y3ENb9g=";
+      x86_64-darwin = "sha256-depSpPZm6bMQv9yvLUJ6yacCwTDtcpoFu15b67oiFJY=";
+      aarch64-linux = "sha256-Fo2X4VAWcyySQ+CE/bt+lJneLoEKVl6tLwPSW5LwvFY=";
+      aarch64-darwin = "sha256-WdYmlopeVsFCndnTALKiQgx2O4zzkDtotR/qj7A56bY=";
+      armv7l-linux = "sha256-OF4qjhgQiagpQP8p9gV63I/B8s/CSl8KlA+FoNhl3/c=";
    }
    .${system} or throwSystem;
 in
 callPackage ./generic.nix rec {
  # Please backport all compatible updates to the stable release.
  # This is important for the extension ecosystem.
-  version = "1.101.2";
+  version = "1.102.0";
  pname = "vscode" + lib.optionalString isInsiders "-insiders";

  # This is used for VS Code - Remote SSH test
-  rev = "2901c5ac6db8a986a5666c3af51ff804d05af0d4";
+  rev = "cb0c47c0cfaad0757385834bd89d410c78a856c0";

  executableName = "code" + lib.optionalString isInsiders "-insiders";
  longName = "Visual Studio Code" + lib.optionalString isInsiders " - Insiders";
@@ -75,7 +75,7 @@ callPackage ./generic.nix rec {
    src = fetchurl {
      name = "vscode-server-${rev}.tar.gz";
      url = "https://update.code.visualstudio.com/commit:${rev}/server-linux-x64/stable";
-      hash = "sha256-Bocoiz8pxQNAZxmWdOgh+y44QTnqvDjcqFCodny7VoY=";
+      hash = "sha256-Hf/pukcQf7PaHORItWO74gC54TWto+nHiKaCHzD0TmI=";
    };
    stdenv = stdenvNoCC;
  };
@@ -85,13 +85,13 @@ in

 stdenv.mkDerivation (finalAttrs: {
  pname = "imagemagick";
-  version = "7.1.1-47";
+  version = "7.1.2-0";

  src = fetchFromGitHub {
    owner = "ImageMagick";
    repo = "ImageMagick";
    tag = finalAttrs.version;
-    hash = "sha256-lRPGVGv86vH7Q1cLoLp8mOAkxcHTHgUrx0mmKgl1oEc=";
+    hash = "sha256-4x0+yELmXstv9hPuwzMGcKiTa1rZtURZgwSSVIhzAkE=";
  };

  outputs = [
@@ -1,7 +1,7 @@
 { callPackage, ... }:

 callPackage ./generic.nix {
-  version = "5.2.9";
+  version = "5.2.10";
  kde-channel = "stable";
-  hash = "sha256-CMmvVW3r8mkxvWUGeS45G0t6MzSlog9RazJJBDNKy6Y=";
+  hash = "sha256-pJrJcrO7lkU0h3XPFpOADL9zXINcqfn1Thep4fMHctU=";
 }
@@ -12,13 +12,13 @@
 buildDotnetModule rec {
  pname = "ArchiSteamFarm";
  # nixpkgs-update: no auto update
-  version = "6.1.6.7";
+  version = "6.1.7.8";

  src = fetchFromGitHub {
    owner = "JustArchiNET";
    repo = "ArchiSteamFarm";
    rev = version;
-    hash = "sha256-XdnKcWzw/d7yLG2efgw/gQ8UkPjExigffbomTD3YUgE=";
+    hash = "sha256-bdjkYrfaC/5rKqRmKr+NVmCMU871WJFNRdh92i8GJF8=";
  };

  dotnet-runtime = dotnetCorePackages.aspnetcore_9_0;
@@ -276,8 +276,8 @@
  },
  {
    "pname": "Markdig.Signed",
-    "version": "0.41.1",
-    "hash": "sha256-A8dOAwZ9hMVPk8xZBaJOo0gu5Z01JQZiz0uZbIZA2eU="
+    "version": "0.41.3",
+    "hash": "sha256-r4DrP47vgky0+AbNBFso7AwwzAHgrioK2B08UIxEaNI="
  },
  {
    "pname": "Microsoft.ApplicationInsights",
@@ -286,13 +286,8 @@
  },
  {
    "pname": "Microsoft.AspNetCore.OpenApi",
-    "version": "9.0.5",
-    "hash": "sha256-v2T37X1dm/NG0ZJWk6cXB9lf8tOc6JI4uxFPqmV7ne0="
-  },
-  {
-    "pname": "Microsoft.Bcl.AsyncInterfaces",
-    "version": "6.0.0",
-    "hash": "sha256-49+H/iFwp+AfCICvWcqo9us4CzxApPKC37Q5Eqrw+JU="
+    "version": "9.0.6",
+    "hash": "sha256-Kk1WNf1BS+9LjjXjBrYb1YCr+23W9PJ+B9Kv2OBv2Oc="
  },
  {
    "pname": "Microsoft.CodeAnalysis.ResxSourceGenerator",
@@ -431,23 +426,23 @@
  },
  {
    "pname": "Microsoft.IdentityModel.Abstractions",
-    "version": "8.11.0",
-    "hash": "sha256-qTBsPDE2FD/JA/n7P9g5FQPu7whUyX1X2HS62StxfLM="
+    "version": "8.12.1",
+    "hash": "sha256-gG2S/1+fPV74J9EE3oI3FKG/bRX/F7ujRvGTgxZ4r1A="
  },
  {
    "pname": "Microsoft.IdentityModel.JsonWebTokens",
-    "version": "8.11.0",
-    "hash": "sha256-JayQNiEiMsvpoAM993VNfJOyAYkatRoFBuLO+ZBzBGo="
+    "version": "8.12.1",
+    "hash": "sha256-NF1kPBAfiNEIsiyNSUSPwPJMEvdk6IMC+95PdqearuM="
  },
  {
    "pname": "Microsoft.IdentityModel.Logging",
-    "version": "8.11.0",
-    "hash": "sha256-aBJSBytPxw+t68O94B8Sj+PjtBi9c2Csy5x7xyVV4m8="
+    "version": "8.12.1",
+    "hash": "sha256-zliqyeeJ9hvPUxm+rWCHGAH+aR+OeIxNhcKxM6G5AEc="
  },
  {
    "pname": "Microsoft.IdentityModel.Tokens",
-    "version": "8.11.0",
-    "hash": "sha256-9sg63wXOJa2HrQBsC3w0vXsWww7FvCnjrtoaf7OsyuA="
+    "version": "8.12.1",
+    "hash": "sha256-brSDa39ISF1+N8u/b/x27IN3wiu+sTll2nMf+IqWPS0="
  },
  {
    "pname": "Microsoft.NET.Test.Sdk",
@@ -471,23 +466,23 @@
  },
  {
    "pname": "Microsoft.Testing.Extensions.Telemetry",
-    "version": "1.7.1",
-    "hash": "sha256-HpIgMY0LRyeeipkW+rjhsqZnso3bWUTP5GZ4EJfkR0w="
+    "version": "1.7.3",
+    "hash": "sha256-Z6WsY2FCUbNnT5HJd7IOrfOvqknVXp6PWzTVeb0idVg="
  },
  {
    "pname": "Microsoft.Testing.Extensions.TrxReport",
-    "version": "1.7.1",
-    "hash": "sha256-LrNo9GKe7cFL7JXKU4h1jpiGxp5465MRJFWhErfOYOs="
+    "version": "1.7.3",
+    "hash": "sha256-QX6Oo6uI9XWRbgrjdHxzROIhTHm12ai6wIDtDuqDJwA="
  },
  {
    "pname": "Microsoft.Testing.Extensions.TrxReport.Abstractions",
-    "version": "1.7.1",
-    "hash": "sha256-zaDOAoEA4CF6/7rXLBO5f5d8PpcqB7hKlwdEWzaFsNk="
+    "version": "1.7.3",
+    "hash": "sha256-PTee04FHyTHx/gF5NLckXuVje807G51MzkPrZ1gkgCw="
  },
  {
    "pname": "Microsoft.Testing.Extensions.VSTestBridge",
-    "version": "1.7.1",
-    "hash": "sha256-6o3qqXK6dxybHybl2k/aY2flxPc2z/1VQMWQPm2Ns0g="
+    "version": "1.7.3",
+    "hash": "sha256-8d+wZmucfSO7PsviHjVxYB4q6NcjgxvnCUpLePq35sM="
  },
  {
    "pname": "Microsoft.Testing.Platform",
@@ -496,13 +491,13 @@
  },
  {
    "pname": "Microsoft.Testing.Platform",
-    "version": "1.7.1",
-    "hash": "sha256-YJ41q1VXvFZh/TWo3tutGQnhNCrxv/QbDLTxCS4b/w4="
+    "version": "1.7.3",
+    "hash": "sha256-cavX11P5o9rooqC3ZHw5h002OKRg2ZNR/VaRwpNTQYA="
  },
  {
    "pname": "Microsoft.Testing.Platform.MSBuild",
-    "version": "1.7.1",
-    "hash": "sha256-j/JO5dVIHWTbUO12ZZJdQ5CB2TcBqGfZTcmVFuT3nyA="
+    "version": "1.7.3",
+    "hash": "sha256-cREl529UQ/c5atT8KimMgrgNdy6MrAd0sBGT8sXRRPM="
  },
  {
    "pname": "Microsoft.TestPlatform.AdapterUtilities",
@@ -526,23 +521,23 @@
  },
  {
    "pname": "MSTest",
-    "version": "3.9.1",
-    "hash": "sha256-7gpZKkbGRA4kjUMHrE5pgM3jQhzYQxO3RB5OfDz0Ed4="
+    "version": "3.9.3",
+    "hash": "sha256-sfvkUW4AZEmFduiSZYh3ZuXgE8/boC7gYMMleP4nkUA="
  },
  {
    "pname": "MSTest.Analyzers",
-    "version": "3.9.1",
-    "hash": "sha256-jr5UOnoX2mHFjMgo/e//4Fi736mkaYj6ChFuwP8jC2w="
+    "version": "3.9.3",
+    "hash": "sha256-uD74gJNVNSQNsxyzf/5kxCBFbgIY7pYdUrKZihAyLi4="
  },
  {
    "pname": "MSTest.TestAdapter",
-    "version": "3.9.1",
-    "hash": "sha256-nlX47U5Yxds0BXJtwWtMPY+HbEFO8TRr7yC+GS1laxU="
+    "version": "3.9.3",
+    "hash": "sha256-0krWgHpALFJMX707/SMN7b5ryEgm7taCoxtC4WBaglM="
  },
  {
    "pname": "MSTest.TestFramework",
-    "version": "3.9.1",
-    "hash": "sha256-ORwTveV9nPnx4s9av8EFt8MQ4G0pF9M8Ped/ibZXvG4="
+    "version": "3.9.3",
+    "hash": "sha256-kkW155gzuv0xjiucutNs4RjF9g2NEIZ39+nruRun4As="
  },
  {
    "pname": "Newtonsoft.Json",
@@ -646,13 +641,13 @@
  },
  {
    "pname": "Scalar.AspNetCore",
-    "version": "2.4.4",
-    "hash": "sha256-MyNRQMFXIRf6znM3SL3P+Z8jO+3Q5i23TDQuG+ZUcTY="
+    "version": "2.5.3",
+    "hash": "sha256-5rMpkchzxeO3/694RvaVzuQS9Xqd7YGDbBzqCkNyhFs="
  },
  {
    "pname": "SteamKit2",
-    "version": "3.2.0",
-    "hash": "sha256-hB/36fP9kf+1mIx+hTELUMHe8ZkmSKxOK41ZzOaBa3E="
+    "version": "3.3.0",
+    "hash": "sha256-/NxnVDatdrqIXCjs0P4gRjHq42r/K+wOv3JO5yiAIjU="
  },
  {
    "pname": "System.Buffers",
@@ -671,33 +666,33 @@
  },
  {
    "pname": "System.Composition",
-    "version": "9.0.5",
-    "hash": "sha256-Y8MPR8xot93lo4jAgVJ101M+JN973CpvOlCSYUK7wxc="
+    "version": "9.0.6",
+    "hash": "sha256-p8Oa6kjNnwzUPiotQZaLKNd5HWyaLAUrXDEb9+qGe4c="
  },
  {
    "pname": "System.Composition.AttributedModel",
-    "version": "9.0.5",
-    "hash": "sha256-CkqRwQGCRteSmN+nRF0rm8wGf2QA7gfqsVF8lBTg9EE="
+    "version": "9.0.6",
+    "hash": "sha256-39rilNPGuizRbLS9uJf8xKUsJwP6OrwlIrC0b2n2ujI="
  },
  {
    "pname": "System.Composition.Convention",
-    "version": "9.0.5",
-    "hash": "sha256-iaSaDpiep+8dthACDpgN0GJ5jRqLVzCVEKNOHUuy3/0="
+    "version": "9.0.6",
+    "hash": "sha256-/+Os5orfTZ45G+SSccBV21OGlbmqI71wZDTCbzvI3DI="
  },
  {
    "pname": "System.Composition.Hosting",
-    "version": "9.0.5",
-    "hash": "sha256-P98I/5Vs08bDObpicSzHXigXiadJA5uIKqd78WABU40="
+    "version": "9.0.6",
+    "hash": "sha256-krp3xyEOHtF/TRu7GPKaNXe+uKhDRhlNBWAD+eAfyYg="
  },
  {
    "pname": "System.Composition.Runtime",
-    "version": "9.0.5",
-    "hash": "sha256-o4yiU61i6X2Tn20pUrf/psESngE/nGHTlJSe4S7qIQ0="
+    "version": "9.0.6",
+    "hash": "sha256-ou4oVkNKVFcHgBsiKxmBfwLCDRberIlwD1uvR2XfMT8="
  },
  {
    "pname": "System.Composition.TypedParts",
-    "version": "9.0.5",
-    "hash": "sha256-+09hA4PfsR9BLHkV1aadh8Jx10AwcFrG+49U0vMATPU="
+    "version": "9.0.6",
+    "hash": "sha256-2z3Pi2vu6Acyn988JeM2B5jKYxCg8LqV8p+4Z4e094g="
  },
  {
    "pname": "System.Diagnostics.DiagnosticSource",
@@ -711,13 +706,13 @@
  },
  {
    "pname": "System.IO.Hashing",
-    "version": "9.0.4",
-    "hash": "sha256-rbcQzEncB3VuUZIcsE1tq30suf5rvRE4HkE+0lR/skU="
+    "version": "9.0.5",
+    "hash": "sha256-hMAhIhYl1QhtD21kSitvSnsNd9KgSydIRvjwZ/1iFes="
  },
  {
    "pname": "System.Linq.Async",
-    "version": "6.0.1",
-    "hash": "sha256-uH5fZhcyQVtnsFc6GTUaRRrAQm05v5euJyWCXSFSOYI="
+    "version": "6.0.3",
+    "hash": "sha256-i+2XnsOJnD7R/vCFtadp+lwrkDNAscANes2Ur0MSTl8="
  },
  {
    "pname": "System.Memory",
@@ -746,8 +741,8 @@
  },
  {
    "pname": "System.Security.Cryptography.ProtectedData",
-    "version": "9.0.5",
-    "hash": "sha256-Ed2Ea4ssYYHBBeFs0Vva+G8lEF5VFcm+DWJl/xi7arY="
+    "version": "9.0.6",
+    "hash": "sha256-WMa3KDeFuOLyIZduYd+9PCyx7usJMRu/q2x3eOw9MAQ="
  },
  {
    "pname": "System.Security.Principal.Windows",
@@ -7,7 +7,7 @@

 buildNpmPackage rec {
  pname = "asf-ui";
-  version = "9920764dafb0a7a87c355d9c87aff285e41494be";
+  version = "b984a9de784afb9d11364b3541961888cab8e025";

  src = fetchFromGitHub {
    owner = "JustArchiNET";
@@ -15,10 +15,10 @@ buildNpmPackage rec {
    # updated by the update script
    # this is always the commit that should be used with asf-ui from the latest asf version
    rev = version;
-    hash = "sha256-w4pYFCdJiHocy41az4/tjWdBwAdI68RV/N8I0Onsofg=";
+    hash = "sha256-qipcDwn6Jte8MRUIgmYSuMzs4sewItlzFIeupYKkg+A=";
  };

-  npmDepsHash = "sha256-V9u+n4CTB+BU0zeiB8vLpFkI2VJGArU6WL+PFfi624M=";
+  npmDepsHash = "sha256-UhakvqDoWxt/nudEqUZcp8Bk0sIdYSXCYHv8YbsrWDU=";

  installPhase = ''
    runHook preInstall
@@ -1,10 +1,10 @@
 {
  "chromium": {
-    "version": "138.0.7204.100",
+    "version": "138.0.7204.157",
    "chromedriver": {
-      "version": "138.0.7204.101",
-      "hash_darwin": "sha256-ow+R2jcfm5tryB6UfnUNklVfLGc2Tzj2W6Nul6pRglI=",
-      "hash_darwin_aarch64": "sha256-GGcDoSkH8Z4N8yOL77nNMtz3BY4lNwlD10SPhEBRpJI="
+      "version": "138.0.7204.158",
+      "hash_darwin": "sha256-rNd7glDAVNkd4CNn4k3rdpb//yD/ccpebnGhDv1EGb8=",
+      "hash_darwin_aarch64": "sha256-oUMFW09mp2aUgplboMHaKvTVbKtqAy5C0KsA7DXbElc="
    },
    "deps": {
      "depot_tools": {
@@ -20,8 +20,8 @@
    "DEPS": {
      "src": {
        "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "5f45b4744e3d5ba82c2ca6d942f1e7a516110752",
-        "hash": "sha256-bI75IXPl6YeauK2oTnUURh1ch1H7KKw/QzKYZ/q6htI=",
+        "rev": "e533e98b1267baa1f1c46d666b120e64e5146aa9",
+        "hash": "sha256-LbZ8/6Lvz1p3ydRL4fXtd7RL426PU3jU01Hx+DP5QYQ=",
        "recompress": true
      },
      "src/third_party/clang-format/script": {
@@ -96,8 +96,8 @@
      },
      "src/third_party/angle": {
        "url": "https://chromium.googlesource.com/angle/angle.git",
-        "rev": "df15136b959fc60c230265f75ee7fc75c96e8250",
-        "hash": "sha256-b4bGxhtrsfmVdJo/5QT4/mtQ6hqxmfpmcrieqaT9/ls="
+        "rev": "e1dc0a7ab5d1f1f2edaa7e41447d873895e083bf",
+        "hash": "sha256-tkHvTkqbm4JtWnh41iu0aJ9Jo34hYc7aOKuuMQmST4c="
      },
      "src/third_party/angle/third_party/glmark2/src": {
        "url": "https://chromium.googlesource.com/external/github.com/glmark2/glmark2",
@@ -131,8 +131,8 @@
      },
      "src/third_party/dawn": {
        "url": "https://dawn.googlesource.com/dawn.git",
-        "rev": "86772f20cca54b46f62b65ece1ef61224aef09db",
-        "hash": "sha256-N9DVbQE56WWBmJ/PJlYhU+pr8I+PFf/7FzMLCNqx3hg="
+        "rev": "1fde167ae683982d77b9ca7e1308bf9f498291e8",
+        "hash": "sha256-PbDTKSU19jn2hLDoazceYB/Rd6/qu6npPSrjOdeXFuU="
      },
      "src/third_party/dawn/third_party/glfw": {
        "url": "https://chromium.googlesource.com/external/github.com/glfw/glfw",
@@ -246,8 +246,8 @@
      },
      "src/third_party/devtools-frontend/src": {
        "url": "https://chromium.googlesource.com/devtools/devtools-frontend",
-        "rev": "a6dbe06dafbad00ef4b0ea139ece1a94a5e2e6d8",
-        "hash": "sha256-XkyJFRxo3ZTBGfKdTwSIo14SLNPQAKQvY4lEX03j6LM="
+        "rev": "4cca0aa00c4915947f1081014d5cfa2e83d357fa",
+        "hash": "sha256-pVNr8NB5U/Uf688oOvPLpu81isCn/WmjJky01A000a4="
      },
      "src/third_party/dom_distiller_js/dist": {
        "url": "https://chromium.googlesource.com/chromium/dom-distiller/dist.git",
@@ -796,8 +796,8 @@
      },
      "src/v8": {
        "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "e5b4c78b54e8b033b2701db3df0bf67d3030e4c1",
-        "hash": "sha256-5y/yNZopnwtDrG+BBU6fMEi0yJJoYvsygQR+fl6vS/Y="
+        "rev": "de9d0f8b56ae61896e4d2ac577fc589efb14f87d",
+        "hash": "sha256-/T5fisjmN80bs3PtQrCRfH3Bo9dRSd3f+xpPLDh1RTY="
      }
    }
  },
@@ -91,9 +91,9 @@ rec {

  nomad_1_10 = generic {
    buildGoModule = buildGo124Module;
-    version = "1.10.2";
-    hash = "sha256-7i/tMQwaEmLGXNarrdPzmorv+SHrxCzeaF3BI9Jjhwg=";
-    vendorHash = "sha256-yq8xQ9wThPK/X9/lEHD8FCXq1Mrz0lO6UvrP2ipXMnw=";
+    version = "1.10.3";
+    hash = "sha256-sDOo7b32H/d5OJ6CRyga1rZZk55bFTi4ynHL/aIH87w=";
+    vendorHash = "sha256-bpCnpeRk329vUd9e6x7iCh+1ouSGd4o4Hq79K0qchJ8=";
    license = lib.licenses.bsl11;
    passthru.tests.nomad = nixosTests.nomad;
    preCheck = ''
@@ -171,22 +171,22 @@
    "vendorHash": null
  },
  "bigip": {
-    "hash": "sha256-JGsleJiOo2wnIObvbQpvpmfc/CUaznVDIiNFX+eetW8=",
+    "hash": "sha256-lhN9YPufx6JITEhwLfqUMudXKTJqFdRCPkS+lTZpmH8=",
    "homepage": "https://registry.terraform.io/providers/F5Networks/bigip",
    "owner": "F5Networks",
    "repo": "terraform-provider-bigip",
-    "rev": "v1.23.0",
+    "rev": "v1.23.1",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
  "bitbucket": {
-    "hash": "sha256-ZFHe91xPeKTdLRnOyFECjg1/7G2RPGpXSgaZOFrnDpY=",
+    "hash": "sha256-McRv7POFoxkehhDQWIzMY96e/Uv+lc5L0bKVlzITBZA=",
    "homepage": "https://registry.terraform.io/providers/DrFaust92/bitbucket",
    "owner": "DrFaust92",
    "repo": "terraform-provider-bitbucket",
-    "rev": "v2.47.0",
+    "rev": "v2.48.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-AcHndbTWMMsE7CSnLtUdnfyIfkKVfmOobNOhvtrTh4I="
+    "vendorHash": "sha256-ok73U0WWFGXp5TJ7sp7U9umq7DlChCw7fSyFmbifwKE="
  },
  "bitwarden": {
    "hash": "sha256-eqWyKPzSINSZcO8Ho0WHTeVDOxbUynOzupXu6vzTtuU=",
@@ -326,13 +326,13 @@
    "vendorHash": "sha256-ZCMSmOCPEMxCSpl3DjIUGPj1W/KNJgyjtHpmQ19JquA="
  },
  "datadog": {
-    "hash": "sha256-FYgjffK21Z/a7wpke5/Um0f8NiDfs7Xf4l7/f3i41+g=",
+    "hash": "sha256-u+iiWStjO2OFMkQp8Skynb4seTK61ETSKrEP+6o16LA=",
    "homepage": "https://registry.terraform.io/providers/DataDog/datadog",
    "owner": "DataDog",
    "repo": "terraform-provider-datadog",
-    "rev": "v3.66.0",
+    "rev": "v3.67.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-9YkSNGNcdMBLJZSlMTGoDrLZFTeGSTfhX1H8ub77Ebk="
+    "vendorHash": "sha256-fLdJxYuN4p0ZwXUXcN6BtATcwVg9asgdjHg9nOPcxK4="
  },
  "deno": {
    "hash": "sha256-7IvJrhXMeAmf8e21QBdYNSJyVMEzLpat4Tm4zHWglW8=",
@@ -552,11 +552,11 @@
    "vendorHash": "sha256-QTcWJlwE6s4nEPSg6svzIhsJo9p9rk1gQiSr4qSTfns="
  },
  "gridscale": {
-    "hash": "sha256-GHKGlqAFWVPmD7NRFcm651XBVzTtNy8mb/sKtjULkB4=",
+    "hash": "sha256-zD3KiTLKALVOvFOewWyrd65p0XmLOi/bSIP27dXwveU=",
    "homepage": "https://registry.terraform.io/providers/gridscale/gridscale",
    "owner": "gridscale",
    "repo": "terraform-provider-gridscale",
-    "rev": "v2.1.2",
+    "rev": "v2.2.0",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
@@ -624,11 +624,11 @@
    "vendorHash": "sha256-SsEWNIBkgcdTlSrB4hIvRmhMv2eJ2qQaPUmiN09A+NM="
  },
  "huaweicloud": {
-    "hash": "sha256-v0UqXIK4SPGouETUWSQI1K1hpsPMyUuEpLQ++Gs4+yk=",
+    "hash": "sha256-jXppJtVMPpipXbEhgenVtFP5YxwlQzekquRoZmgoP0Q=",
    "homepage": "https://registry.terraform.io/providers/huaweicloud/huaweicloud",
    "owner": "huaweicloud",
    "repo": "terraform-provider-huaweicloud",
-    "rev": "v1.76.1",
+    "rev": "v1.76.4",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
@@ -1147,13 +1147,13 @@
    "vendorHash": null
  },
  "sakuracloud": {
-    "hash": "sha256-vIP7hlPvx7o8/uXpg6TOEeoDL9FGaTBdXzziOyLrdGY=",
+    "hash": "sha256-IbR3m0s5LCC9tIOC67yn2yI6lssnIlc/pB6XIf0UOuk=",
    "homepage": "https://registry.terraform.io/providers/sacloud/sakuracloud",
    "owner": "sacloud",
    "repo": "terraform-provider-sakuracloud",
-    "rev": "v2.28.0",
+    "rev": "v2.28.1",
    "spdx": "Apache-2.0",
-    "vendorHash": "sha256-hJmMNxlhyzcnguLFJih/K1CSZHIOspTgCJ8nyVjT7mg="
+    "vendorHash": "sha256-HKmIl/GjGJZmhWLrK3lMjYo1F5nmo+U9ZpvBo5hDH/0="
  },
  "scaleway": {
    "hash": "sha256-3MLtSOcMCIl3pFJH/xKK/fPQcRrW2Nx4b2jCZiUE2aw=",
@@ -22,14 +22,14 @@

 buildPythonApplication rec {
  pname = "protonvpn-gui";
-  version = "4.9.6";
+  version = "4.9.7";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "ProtonVPN";
    repo = "proton-vpn-gtk-app";
-    tag = "${version}";
-    hash = "sha256-Undf3qSClcRa1e9f6B/1hLPIjc2KPG745AXxYHQA0nE=";
+    tag = "v${version}";
+    hash = "sha256-xpMXpYLLui+1bjK72VPhUT6T/sYpoqN2Jz6sczKJO5U=";
  };

  nativeBuildInputs = [
@@ -4,14 +4,27 @@
  cmake,
  cups,
  fetchurl,
+  fetchpatch,
  fontconfig,
  freetype,
+  graphicsmagick,
  harfbuzzFull,
  hunspell,
  lcms2,
+  libcdr,
+  libfreehand,
  libjpeg,
+  libjxl,
+  libmspub,
+  libpagemaker,
+  libqxp,
+  librevenge,
+  libsysprof-capture,
  libtiff,
+  libvisio,
+  libwpg,
  libxml2,
+  libzmf,
  pixman,
  pkg-config,
  podofo_0_10,
@@ -20,7 +33,7 @@
  python3,
  lib,
  stdenv,
-  qt5,
+  qt6,
 }:

 let
@@ -32,17 +45,17 @@ in
 stdenv.mkDerivation (finalAttrs: {
  pname = "scribus";

-  version = "1.6.4";
+  version = "1.7.0";

  src = fetchurl {
    url = "mirror://sourceforge/scribus/scribus-devel/scribus-${finalAttrs.version}.tar.xz";
-    hash = "sha256-UzvnrwOs+qc27F96P8JWKr0gD+9coqfN7gK19E1hgp4=";
+    hash = "sha256-+lnWIh/3z/qTcjV5l+hlcBYuHhiRNza3F2/RD0jCQ/Y=";
  };

  nativeBuildInputs = [
    cmake
    pkg-config
-    qt5.wrapQtAppsHook
+    qt6.wrapQtAppsHook
  ];

  buildInputs = [
@@ -51,37 +64,63 @@ stdenv.mkDerivation (finalAttrs: {
    cups
    fontconfig
    freetype
+    graphicsmagick
    harfbuzzFull
    hunspell
    lcms2
+    libcdr
+    libfreehand
    libjpeg
+    libjxl
+    libpagemaker
+    libqxp
+    librevenge
+    libsysprof-capture
    libtiff
+    libvisio
+    libwpg
    libxml2
+    libzmf
    pixman
    podofo_0_10
    poppler
    poppler_data
    pythonEnv
-    qt5.qtbase
-    qt5.qtimageformats
-    qt5.qttools
+    qt6.qt5compat
+    qt6.qtbase
+    qt6.qtdeclarative
+    qt6.qtimageformats
+    qt6.qtsvg
+    qt6.qttools
+  ] ++ lib.optionals libmspub.meta.available [ libmspub ];
+
+  cmakeFlags = [ (lib.cmakeBool "WANT_GRAPHICSMAGICK" true) ];
+
+  patches = [
+    (fetchpatch {
+      url = "https://aur.archlinux.org/cgit/aur.git/plain/fix_build_with_qt_6.9.0.patch?h=scribus-unstable";
+      hash = "sha256-hzd9XpoVVqbwvZ40QPGBqqWkIFXug/tSojf/Ikc4nn4=";
+    })
+    (fetchpatch {
+      url = "https://aur.archlinux.org/cgit/aur.git/plain/fix_build_with_poppler_25.02.0.patch?h=scribus-unstable";
+      hash = "sha256-t9xJA6KGMGAdUFyjI8OlTNilewyMr1FFM7vjHOM15Xg=";
+    })
  ];

-  meta = with lib; {
-    maintainers = with maintainers; [
-      arthsmn
-    ];
+  meta = {
+    maintainers = with lib.maintainers; [ arthsmn ];
    description = "Desktop Publishing (DTP) and Layout program";
    mainProgram = "scribus";
    homepage = "https://www.scribus.net";
    # There are a lot of licenses...
    # https://github.com/scribusproject/scribus/blob/20508d69ca4fc7030477db8dee79fd1e012b52d2/COPYING#L15-L19
-    license = with licenses; [
+    license = with lib.licenses; [
      bsd3
      gpl2Plus
      mit
      publicDomain
    ];
+    platforms = lib.platforms.all;
    broken = stdenv.hostPlatform.isDarwin;
  };
 })
@@ -113,6 +113,12 @@ stdenv.mkDerivation {
    )
    ++ [
      ./patches/256-color-resources.patch
+      (fetchPatchFromAUR {
+        name = "7-bit-queries.patch";
+        package = "rxvt-unicode-truecolor-wide-glyphs";
+        rev = "61ed186890a2bf37585e4704a095be61e6504ac6";
+        sha256 = "1xpv6g3bhxq5gp40k3rp8yjp4xrw7dr2g9sfkdmj0gi3rr0myx46";
+      })
    ]
    ++ lib.optional (perlSupport && lib.versionAtLeast perl.version "5.38") (fetchpatch {
      name = "perl538-locale-c.patch";
@@ -9,13 +9,13 @@

 stdenv.mkDerivation rec {
  pname = "obs-shaderfilter";
-  version = "2.5.0";
+  version = "2.5.1";

  src = fetchFromGitHub {
    owner = "exeldro";
    repo = "obs-shaderfilter";
    rev = version;
-    sha256 = "sha256-HJFgGicOtEZMMJyAkwgHCvWPoj00C6YGU9NwagD4Fpw=";
+    sha256 = "sha256-1RRGXAzP7BIwJJMmXSknPDtHxXZex9SqDDVbWOE43Yk=";
  };

  nativeBuildInputs = [ cmake ];
@@ -367,13 +367,13 @@ rec {
  # Get revisions from
  # https://github.com/moby/moby/tree/${version}/hack/dockerfile/install/*
  docker_25 = callPackage dockerGen rec {
-    version = "25.0.10";
+    version = "25.0.11";
    # Upstream forgot to tag release
    # https://github.com/docker/cli/issues/5789
    cliRev = "43987fca488a535d810c429f75743d8c7b63bf4f";
    cliHash = "sha256-OwufdfuUPbPtgqfPeiKrQVkOOacU2g4ommHb770gV40=";
    mobyRev = "v${version}";
-    mobyHash = "sha256-57iXL+QYtbEz099yOTR4k/2Z7CT08OAkQ3kVJSmsa/U=";
+    mobyHash = "sha256-vHHi0/sX9fm83gyUjDpRYTGV9h18IVia1oSmj4n31nc=";
    runcRev = "v1.2.5";
    runcHash = "sha256-J/QmOZxYnMPpzm87HhPTkYdt+fN+yeSUu2sv6aUeTY4=";
    containerdRev = "v1.7.27";
@@ -383,11 +383,11 @@ rec {
  };

  docker_28 = callPackage dockerGen rec {
-    version = "28.2.2";
+    version = "28.3.2";
    cliRev = "v${version}";
-    cliHash = "sha256-ZaKG4H8BqIzgs9OFktH9bjHSf9exAlh5kPCGP021BWI=";
+    cliHash = "sha256-LsV9roOPw0LccvBUeF3bY014OwG6QpnVsLf+dqKyvsg=";
    mobyRev = "v${version}";
-    mobyHash = "sha256-Y2yP2NBJLrI83iHe2EoA7/cXiQifrCkUKlwJhINKBXE=";
+    mobyHash = "sha256-YfdnCAc9NgLTuvxLHGhTPdWqXz9VSVsQsfzLD3YER3g=";
    runcRev = "v1.2.6";
    runcHash = "sha256-XMN+YKdQOQeOLLwvdrC6Si2iAIyyHD5RgZbrOHrQE/g=";
    containerdRev = "v1.7.27";
@@ -69,12 +69,6 @@
  gnome = [
    # This one redirects to some mirror closeby, so it should be all you need
    "https://download.gnome.org/"
-
-    "https://fr2.rpmfind.net/linux/gnome.org/"
-    "https://ftp.acc.umu.se/pub/GNOME/"
-    "https://ftp.belnet.be/mirror/ftp.gnome.org/"
-    "ftp://ftp.cse.buffalo.edu/pub/Gnome/"
-    "ftp://ftp.nara.wide.ad.jp/pub/X11/GNOME/"
  ];

  # GNU (https://www.gnu.org/prep/ftp.html)
@@ -69,19 +69,17 @@ async function main() {
      // Don't unlink this file, we just wrote it.
      managed.delete(file);

-      // Link to a temporary dummy path and rename.
-      // This is to get some degree of atomicity.
+      // Link file
      try {
-        await fs.promises.symlink(sourcePath, targetPath + "-nix-hook-temp");
+        await fs.promises.symlink(sourcePath, targetPath);
      } catch (err) {
+        // If the target file already exists remove it and try again
        if (err.code !== "EEXIST") {
          throw err;
        }
-
-        await fs.promises.unlink(targetPath + "-nix-hook-temp");
-        await fs.promises.symlink(sourcePath, targetPath + "-nix-hook-temp");
+        await fs.promises.unlink(targetPath);
+        await fs.promises.symlink(sourcePath, targetPath);
      }
-      await fs.promises.rename(targetPath + "-nix-hook-temp", targetPath);
    })
  );

@@ -1,28 +1,89 @@
 {
+  lib,
  runCommand,
  srcOnly,
+  hello,
  emptyDirectory,
-  glibc,
+  zlib,
+  stdenv,
+  testers,
 }:

 let
  emptySrc = srcOnly emptyDirectory;
-  glibcSrc = srcOnly glibc;
+  zlibSrc = srcOnly zlib;
+
+  # It can be invoked in a number of ways. Let's make sure they're equivalent.
+  zlibSrcDrvAttrs = srcOnly zlib.drvAttrs;
+  # zlibSrcFreeform = # ???;
+  helloSrc = srcOnly hello;
+  helloSrcDrvAttrs = srcOnly hello.drvAttrs;
+
+  # The srcOnly <drv> invocation leaks a lot of attrs into the srcOnly derivation,
+  # so for comparing with the freeform invocation, we need to make a selection.
+  # Otherwise, we'll be comparing against whatever attribute the fancy hello drv
+  # has.
+  helloDrvSimple = stdenv.mkDerivation {
+    inherit (hello)
+      name
+      pname
+      version
+      src
+      patches
+      ;
+  };
+  helloDrvSimpleSrc = srcOnly helloDrvSimple;
+  helloDrvSimpleSrcFreeform = srcOnly (
+    {
+      inherit (helloDrvSimple)
+        name
+        pname
+        version
+        src
+        patches
+        stdenv
+        ;
+    }
+    # __impureHostDeps get duplicated in helloDrvSimpleSrc (on darwin)
+    # This is harmless, but fails the test for what is arguably an
+    # unrelated non-problem, so we just work around it here.
+    # The inclusion of __impureHostDeps really shouldn't be required,
+    # and should be removed from this test.
+    // lib.optionalAttrs (helloDrvSimple ? __impureHostDeps) {
+      inherit (helloDrvSimple) __impureHostDeps;
+    }
+  );
+
 in

-runCommand "srcOnly-tests" { } ''
-  # Test that emptySrc is empty
-  if [ -n "$(ls -A ${emptySrc})" ]; then
-    echo "emptySrc is not empty"
-    exit 1
-  fi
+runCommand "srcOnly-tests"
+  {
+    moreTests = [
+      (testers.testEqualDerivation "zlibSrcDrvAttrs == zlibSrc" zlibSrcDrvAttrs zlibSrc)
+      # (testers.testEqualDerivation
+      #   "zlibSrcFreeform == zlibSrc"
+      #   zlibSrcFreeform
+      #   zlibSrc)
+      (testers.testEqualDerivation "helloSrcDrvAttrs == helloSrc" helloSrcDrvAttrs helloSrc)
+      (testers.testEqualDerivation "helloDrvSimpleSrcFreeform == helloDrvSimpleSrc"
+        helloDrvSimpleSrcFreeform
+        helloDrvSimpleSrc
+      )
+    ];
+  }
+  ''
+    # Test that emptySrc is empty
+    if [ -n "$(ls -A ${emptySrc})" ]; then
+      echo "emptySrc is not empty"
+      exit 1
+    fi

-  # Test that glibcSrc is not empty
-  if [ -z "$(ls -A ${glibcSrc})" ]; then
-    echo "glibcSrc is empty"
-    exit 1
-  fi
+    # Test that zlibSrc is not empty
+    if [ -z "$(ls -A ${zlibSrc})" ]; then
+      echo "zlibSrc is empty"
+      exit 1
+    fi

-  # Make $out exist to avoid build failure
-  mkdir -p $out
-''
+    # Make $out exist to avoid build failure
+    mkdir -p $out
+  ''
@@ -7,13 +7,13 @@

 stdenv.mkDerivation rec {
  pname = "ada";
-  version = "3.2.4";
+  version = "3.2.5";

  src = fetchFromGitHub {
    owner = "ada-url";
    repo = "ada";
    tag = "v${version}";
-    hash = "sha256-tC7Hpf9xCysraTtVC+mYE/DVNrG02lwLAlDiTeaWpY4=";
+    hash = "sha256-gXeQYNuhrlCEvvDQtQ07+nE/9gGzzEYPnEKMxWryLRI=";
  };

  nativeBuildInputs = [ cmake ];
@@ -7,13 +7,13 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "amazon-q-cli";
-  version = "1.12.2";
+  version = "1.12.4";

  src = fetchFromGitHub {
    owner = "aws";
    repo = "amazon-q-developer-cli-autocomplete";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-TIKG1nzpmjiHE+EjTJR+/GklQNJQeUzmDXaPEiRT80Y=";
+    hash = "sha256-juZuqZkBsIHhLOCZk+QpTaO1BsHj2RZyCvkvc0G5KbU=";
  };

  nativeBuildInputs = [
@@ -22,7 +22,7 @@ rustPlatform.buildRustPackage (finalAttrs: {

  useFetchCargoVendor = true;

-  cargoHash = "sha256-lJbHPqQ3eybo03oZY2VyKlsxcTdbdrc8q8AjV+IahEY=";
+  cargoHash = "sha256-BT3LNOkRf4gfBy5SwuAnMoJVF9PmwiLsS5phdtEgIrs=";

  cargoBuildFlags = [
    "-p"
@@ -16,6 +16,7 @@
  wireguard-tools,
  libssh,
  zlib,
+  openssl,
  tun2socks,
  xray,
  nix-update-script,
@@ -41,16 +42,16 @@ let
  amnezia-xray = xray.overrideAttrs (
    finalAttrs: prevAttrs: {
      pname = "amnezia-xray";
-      version = "1.8.13";
+      version = "1.8.15";

      src = fetchFromGitHub {
        owner = "amnezia-vpn";
        repo = "amnezia-xray-core";
        tag = "v${finalAttrs.version}";
-        hash = "sha256-7XYdogoUEv3kTPTOQwRCohsPtfSDf+aRdI28IkTjvPk=";
+        hash = "sha256-3ZGkfGxYl9/yE7Q2CsJkFJ6xSGybBdq3DztQ0f4VsnY=";
      };

-      vendorHash = "sha256-zArdGj5yeRxU0X4jNgT5YBI9SJUyrANDaqNPAPH3d5M=";
+      vendorHash = "sha256-AimQsuBRhgpTY5rW8WRejCkx4s9Q9n+OuTf4XCrgpnE=";
    }
  );

@@ -64,56 +65,50 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "amnezia-vpn";
-  version = "4.8.6.0";
+  version = "4.8.8.3";

  src = fetchFromGitHub {
    owner = "amnezia-vpn";
    repo = "amnezia-client";
    tag = finalAttrs.version;
-    hash = "sha256-WQbay3dtGNPPpcK1O7bfs/HKO4ytfmQo60firU/9o28=";
+    hash = "sha256-hDbrp6eT+avFepJL55Vl2alOD+IMnyy8MPXZQTEmLJo=";
    fetchSubmodules = true;
  };

-  # Temporary patch header file to fix build with QT 6.9
-  patches = [
-    (fetchpatch {
-      name = "add-missing-include.patch";
-      url = "https://github.com/amnezia-vpn/amnezia-client/commit/c44ce0d77cc3acdf1de48a12459a1a821d404a1c.patch";
-      hash = "sha256-Q6UMD8PlKAcI6zNolT5+cULECnxNrYrD7cifvNg1ZrY=";
-    })
-  ];
-
-  postPatch =
-    ''
-      substituteInPlace client/platforms/linux/daemon/wireguardutilslinux.cpp \
-        --replace-fail 'm_tunnel.start(appPath.filePath("../../client/bin/wireguard-go"), wgArgs);' 'm_tunnel.start("${amneziawg-go}/bin/amneziawg-go", wgArgs);'
-      substituteInPlace client/utilities.cpp \
-        --replace-fail 'return Utils::executable("../../client/bin/openvpn", true);' 'return Utils::executable("${openvpn}/bin/openvpn", false);' \
-        --replace-fail 'return Utils::executable("../../client/bin/tun2socks", true);' 'return Utils::executable("${amnezia-tun2socks}/bin/amnezia-tun2socks", false);' \
-        --replace-fail 'return Utils::usrExecutable("wg-quick");' 'return Utils::executable("${wireguard-tools}/bin/wg-quick", false);'
-      substituteInPlace client/protocols/xrayprotocol.cpp \
-        --replace-fail 'return Utils::executable(QString("xray"), true);' 'return Utils::executable(QString("${amnezia-xray}/bin/xray"), false);'
-      substituteInPlace client/protocols/openvpnovercloakprotocol.cpp \
-        --replace-fail 'return Utils::executable(QString("/ck-client"), true);' 'return Utils::executable(QString("${cloak-pt}/bin/ck-client"), false);'
-      substituteInPlace client/protocols/shadowsocksvpnprotocol.cpp \
-        --replace-fail 'return Utils::executable(QString("/ss-local"), true);' 'return Utils::executable(QString("${shadowsocks-rust}/bin/sslocal"), false);'
-      substituteInPlace client/configurators/openvpn_configurator.cpp \
-        --replace-fail ".arg(qApp->applicationDirPath());" ".arg(\"$out/libexec\");"
-      substituteInPlace client/ui/qautostart.cpp \
-        --replace-fail "/usr/share/pixmaps/AmneziaVPN.png" "AmneziaVPN"
-      substituteInPlace deploy/installer/config/AmneziaVPN.desktop.in \
-        --replace-fail "/usr/share/pixmaps/AmneziaVPN.png" "$out/share/pixmaps/AmneziaVPN.png"
-      substituteInPlace deploy/data/linux/AmneziaVPN.service \
-        --replace-fail "ExecStart=/opt/AmneziaVPN/service/AmneziaVPN-service.sh" "ExecStart=$out/bin/AmneziaVPN-service" \
-        --replace-fail "Environment=LD_LIBRARY_PATH=/opt/AmneziaVPN/client/lib" ""
-    ''
-    + (lib.optionalString (stdenv.hostPlatform.isAarch64 && stdenv.hostPlatform.isLinux) ''
-      substituteInPlace client/cmake/3rdparty.cmake \
-        --replace-fail 'set(LIBSSH_LIB_PATH "''${LIBSSH_ROOT_DIR}/linux/x86_64/libssh.a")' 'set(LIBSSH_LIB_PATH "${libssh}/lib/libssh.so")' \
-        --replace-fail 'set(ZLIB_LIB_PATH "''${LIBSSH_ROOT_DIR}/linux/x86_64/libz.a")' 'set(ZLIB_LIB_PATH "${zlib}/lib/libz.so")' \
-        --replace-fail 'set(OPENSSL_LIB_SSL_PATH "''${OPENSSL_ROOT_DIR}/linux/x86_64/libssl.a")' 'set(OPENSSL_LIB_SSL_PATH "''${OPENSSL_ROOT_DIR}/linux/arm64/libssl.a")' \
-        --replace-fail 'set(OPENSSL_LIB_CRYPTO_PATH "''${OPENSSL_ROOT_DIR}/linux/x86_64/libcrypto.a")' 'set(OPENSSL_LIB_CRYPTO_PATH "''${OPENSSL_ROOT_DIR}/linux/arm64/libcrypto.a")'
-    '');
+  postPatch = ''
+    substituteInPlace client/platforms/linux/daemon/wireguardutilslinux.cpp \
+      --replace-fail 'm_tunnel.start(appPath.filePath("../../client/bin/wireguard-go"), wgArgs);' 'm_tunnel.start("${amneziawg-go}/bin/amneziawg-go", wgArgs);'
+    substituteInPlace client/utilities.cpp \
+      --replace-fail 'return Utils::executable("../../client/bin/openvpn", true);' 'return Utils::executable("${openvpn}/bin/openvpn", false);' \
+      --replace-fail 'return Utils::executable("../../client/bin/tun2socks", true);' 'return Utils::executable("${amnezia-tun2socks}/bin/amnezia-tun2socks", false);' \
+      --replace-fail 'return Utils::usrExecutable("wg-quick");' 'return Utils::executable("${wireguard-tools}/bin/wg-quick", false);'
+    substituteInPlace client/protocols/xrayprotocol.cpp \
+      --replace-fail 'return Utils::executable(QString("xray"), true);' 'return Utils::executable(QString("${amnezia-xray}/bin/xray"), false);'
+    substituteInPlace client/protocols/openvpnovercloakprotocol.cpp \
+      --replace-fail 'return Utils::executable(QString("/ck-client"), true);' 'return Utils::executable(QString("${cloak-pt}/bin/ck-client"), false);'
+    substituteInPlace client/protocols/shadowsocksvpnprotocol.cpp \
+      --replace-fail 'return Utils::executable(QString("/ss-local"), true);' 'return Utils::executable(QString("${shadowsocks-rust}/bin/sslocal"), false);'
+    substituteInPlace client/configurators/openvpn_configurator.cpp \
+      --replace-fail ".arg(qApp->applicationDirPath());" ".arg(\"$out/libexec\");"
+    substituteInPlace client/ui/qautostart.cpp \
+      --replace-fail "/usr/share/pixmaps/AmneziaVPN.png" "AmneziaVPN"
+    substituteInPlace deploy/installer/config/AmneziaVPN.desktop.in \
+      --replace-fail "/usr/share/pixmaps/AmneziaVPN.png" "$out/share/pixmaps/AmneziaVPN.png"
+    substituteInPlace deploy/data/linux/AmneziaVPN.service \
+      --replace-fail "ExecStart=/opt/AmneziaVPN/service/AmneziaVPN-service.sh" "ExecStart=$out/bin/AmneziaVPN-service" \
+      --replace-fail "Environment=LD_LIBRARY_PATH=/opt/AmneziaVPN/client/lib" ""
+    substituteInPlace client/cmake/3rdparty.cmake \
+      --replace-fail 'set(LIBSSH_LIB_PATH "''${LIBSSH_ROOT_DIR}/linux/x86_64/libssh.a")' 'set(LIBSSH_LIB_PATH "${libssh}/lib/libssh.so")' \
+      --replace-fail 'set(ZLIB_LIB_PATH "''${LIBSSH_ROOT_DIR}/linux/x86_64/libz.a")' 'set(ZLIB_LIB_PATH "${zlib}/lib/libz.so")' \
+      --replace-fail 'set(OPENSSL_INCLUDE_DIR "''${OPENSSL_ROOT_DIR}/linux/include")' 'set(OPENSSL_INCLUDE_DIR "${openssl.dev}/include")' \
+      --replace-fail 'set(OPENSSL_LIB_SSL_PATH "''${OPENSSL_ROOT_DIR}/linux/x86_64/libssl.a")' 'set(OPENSSL_LIB_SSL_PATH "${openssl.out}/lib/libssl.so")' \
+      --replace-fail 'set(OPENSSL_LIB_CRYPTO_PATH "''${OPENSSL_ROOT_DIR}/linux/x86_64/libcrypto.a")' 'set(OPENSSL_LIB_CRYPTO_PATH "${openssl.out}/lib/libcrypto.so")' \
+      --replace-fail 'set(OPENSSL_USE_STATIC_LIBS TRUE)' 'set(OPENSSL_USE_STATIC_LIBS FALSE)'
+    substituteInPlace service/server/CMakeLists.txt \
+      --replace-fail 'set(OPENSSL_INCLUDE_DIR "''${OPENSSL_ROOT_DIR}/linux/include")' 'set(OPENSSL_INCLUDE_DIR "${openssl.dev}/include")' \
+      --replace-fail 'set(OPENSSL_LIB_CRYPTO_PATH "''${OPENSSL_ROOT_DIR}/linux/x86_64/libcrypto.a")' 'set(OPENSSL_LIB_CRYPTO_PATH "${openssl.out}/lib/libcrypto.so")' \
+      --replace-fail 'set(OPENSSL_USE_STATIC_LIBS TRUE)' 'set(OPENSSL_USE_STATIC_LIBS FALSE)'
+  '';

  strictDeps = true;

@@ -8,7 +8,7 @@

 buildGoModule (finalAttrs: {
  pname = "andcli";
-  version = "2.2.0";
+  version = "2.3.0";

  subPackages = [ "cmd/andcli" ];

@@ -16,10 +16,10 @@ buildGoModule (finalAttrs: {
    owner = "tjblackheart";
    repo = "andcli";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-wAatlCckSpa/BE4UVR/L6SkVmNyW2/cl//JOy62EaLc=";
+    hash = "sha256-umV0oJ4sySnZzrIpRuTP/fT8a9nhkC1shVEfVVRpEyI=";
  };

-  vendorHash = "sha256-/rmx9g7OfsZXr3zb1UfR1qLxdV2/ELzc/wXn0fJRzbE=";
+  vendorHash = "sha256-lzmkNxQUqktnl2Rpjgoa2yvAuGiMtVGNhiuF40how4o=";

  ldflags = [
    "-s"
@@ -27,8 +27,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
  # lockfileVersion: '6.0' need old pnpm
  pnpmDeps = pnpm_8.fetchDeps {
    inherit (finalAttrs) pname version src;
-    hash = "sha256-h1rcM+H2c0lk7bpGeQT5ue9bQIggrCFHkj4o7KxnH08=";
    fetcherVersion = 1;
+    hash = "sha256-h1rcM+H2c0lk7bpGeQT5ue9bQIggrCFHkj4o7KxnH08=";
  };

  cargoRoot = "src-tauri";
@@ -28,8 +28,8 @@ buildGoModule rec {
    pnpmDeps = pnpm_9.fetchDeps {
      inherit src version pname;
      sourceRoot = "${src.name}/ui";
-      hash = "sha256-/se6IWeHdazqS7PzOpgtT4IxCJ1WptqBzZ/BdmGb4BA=";
      fetcherVersion = 1;
+      hash = "sha256-/se6IWeHdazqS7PzOpgtT4IxCJ1WptqBzZ/BdmGb4BA=";
    };

    nativeBuildInputs = [
@@ -11,13 +11,13 @@

 buildGoModule (finalAttrs: {
  pname = "apko";
-  version = "0.29.2";
+  version = "0.29.3";

  src = fetchFromGitHub {
    owner = "chainguard-dev";
    repo = "apko";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-szUOl5nKrra7Vvyfcd60/Oy/QFiXZpGJR2gtw3lriKE=";
+    hash = "sha256-3BmWxHhpdkJ7Zyd+K+YS/u4cIiwPsNGaYNvb6ZrIaeQ=";
    # populate values that require us to use git. By doing this in postFetch we
    # can delete .git afterwards and maintain better reproducibility of the src.
    leaveDotGit = true;
@@ -79,7 +79,7 @@ buildGoModule (finalAttrs: {
        --zsh <(${apko}/bin/apko completion zsh)
    '';

-  nativeCheckInstallInputs = [ versionCheckHook ];
+  nativeInstallCheckInputs = [ versionCheckHook ];
  doInstallCheck = true;
  versionCheckProgramArg = "version";

@@ -23,13 +23,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "aquamarine";
-  version = "0.8.0";
+  version = "0.9.1";

  src = fetchFromGitHub {
    owner = "hyprwm";
    repo = "aquamarine";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-ybpV2+yNExdHnMhhhmtxqgBCgI+nRr8gi/D+VVb9lQY=";
+    hash = "sha256-1bxH4zW/mnEh7ySsByZBRpANUG/Ym8kgorawYI70z7A=";
  };

  nativeBuildInputs = [
@@ -7,10 +7,10 @@
 }:
 let
  pname = "archipelago";
-  version = "0.6.1";
+  version = "0.6.2";
  src = fetchurl {
    url = "https://github.com/ArchipelagoMW/Archipelago/releases/download/${version}/Archipelago_${version}_linux-x86_64.AppImage";
-    hash = "sha256-8mPlR5xVnHL9I0rV4bMFaffSJv7dMlCcPHrLkM/pyVU=";
+    hash = "sha256-DdlfHb8iTCfTGGBUYQeELYh2NF/2GcamtuJzeYb2A5M=";
  };

  appimageContents = appimageTools.extractType2 { inherit pname version src; };
@@ -40,7 +40,10 @@ appimageTools.wrapType2 {
    changelog = "https://github.com/ArchipelagoMW/Archipelago/releases/tag/${version}";
    license = lib.licenses.mit;
    mainProgram = "archipelago";
-    maintainers = with lib.maintainers; [ pyrox0 ];
+    maintainers = with lib.maintainers; [
+      pyrox0
+      iqubic
+    ];
    platforms = lib.platforms.linux;
  };
 }
@@ -29,13 +29,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "ares";
-  version = "144";
+  version = "145";

  src = fetchFromGitHub {
    owner = "ares-emulator";
    repo = "ares";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-BpVyPdtsIUstLVf/HGO6vcAlLgJP5SgJbZtqEV/uJ2g=";
+    hash = "sha256-es+K5+qlK7FcJCFEIMcOsXCZSnoXEEmtS0yhpCvaILM";
  };

  nativeBuildInputs =
@@ -33,8 +33,8 @@ let

    pnpmDeps = pnpm_9.fetchDeps {
      inherit (finalAttrs) pname version src;
-      hash = "sha256-QIfadS2gNPtH006O86EndY/Hx2ml2FoKfUXJF5qoluw=";
      fetcherVersion = 1;
+      hash = "sha256-QIfadS2gNPtH006O86EndY/Hx2ml2FoKfUXJF5qoluw=";
    };

    buildPhase = ''
@@ -25,8 +25,8 @@ stdenv.mkDerivation (finalAttrs: {
      pnpmWorkspaces
      prePnpmInstall
      ;
-    hash = "sha256-tlpk+wbLjJqt37lu67p2A2RZAR1ZfnZFiYoqIQwvWPQ=";
    fetcherVersion = 1;
+    hash = "sha256-tlpk+wbLjJqt37lu67p2A2RZAR1ZfnZFiYoqIQwvWPQ=";
  };

  nativeBuildInputs = [
@@ -7,16 +7,16 @@

 buildGoModule (finalAttrs: {
  pname = "atmos";
-  version = "1.180.0";
+  version = "1.182.0";

  src = fetchFromGitHub {
    owner = "cloudposse";
    repo = "atmos";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-/yCgC73J4PVTqmJBW0eLCMVWtsyMGLeF0Rmvx+N/oP8=";
+    hash = "sha256-xGNexXxeX6ZKG4eWCoj0laHHXegnNqSfRPEkIWcieNQ=";
  };

-  vendorHash = "sha256-k1zC3tUF2uDAo86J6dZmYOGZcYFBNdSH15cyX2tiZEg=";
+  vendorHash = "sha256-P+Fsc6z3kTG8iq29KEp7DUV4zeT7Kee384TMosTDKGU=";

  ldflags = [
    "-s"
@@ -21,13 +21,13 @@ in

 rustPlatform.buildRustPackage {
  pname = "attic";
-  version = "0-unstable-2025-07-08";
+  version = "0-unstable-2025-07-11";

  src = fetchFromGitHub {
    owner = "zhaofengli";
    repo = "attic";
-    rev = "07147da79388468ff85c2a650500d11ca0edd12e";
-    hash = "sha256-pHsHcWQWGyzDh48YHnSw9YVKEnQ95QWnmHNFtvo7iu0=";
+    rev = "24fad0622fc9404c69e83bab7738359c5be4988e";
+    hash = "sha256-5TomR72rn4q+5poQcN6EnanxeXKqJSqWVAoDAFN0lUc=";
  };

  nativeBuildInputs = [
@@ -38,7 +38,7 @@ rustPlatform.buildRustPackage {
  buildInputs = lib.optional needNixInclude nix ++ [ boost ];

  cargoBuildFlags = lib.concatMapStrings (c: "-p ${c} ") crates;
-  cargoHash = "sha256-I5GS32dOCECYKSNMi2Xs2rBRxPLcvLEWHlIIWP/bMBU=";
+  cargoHash = "sha256-NdzwYnD0yMEI2RZwwXl/evYx9zdBVMOUee+V7uq1cf0=";
  useFetchCargoVendor = true;

  env = {
@@ -1,9 +1,9 @@
 {
  "owner": "advplyr",
  "repo": "audiobookshelf",
-  "rev": "f3f5f3b9bd540d311a6ab0a99b9317a5142755ea",
-  "hash": "sha256-tymJLs0gucJX0n0helxAkCrifG4uWcxaEBpgK7uVG2c=",
-  "version": "2.25.1",
-  "depsHash": "sha256-JFoE4jNyIfdk/uhhbdP3flcNRus8FvwRNrs+hf4YJ5E=",
-  "clientDepsHash": "sha256-s8fybUu3hJozX57RfsxBSy09QjOiVGO4vg7woOEqMi4="
+  "rev": "264ae928a9c1af620487488110eec816b14e23ec",
+  "hash": "sha256-QNzQY5+tHzMopvJJw3ihb+x203wNnvIRbyyFNESN0Bk=",
+  "version": "2.26.0",
+  "depsHash": "sha256-rbe0EAGK2t3KkTaNie9psiFcA4EVooPDQzQclgW9R6k=",
+  "clientDepsHash": "sha256-yrTkVDFsf8o3QVtRAiy6rS3UZO2vxvBIoh2RsAmVp18="
 }
@@ -40,8 +40,8 @@ let
        src
        sourceRoot
        ;
-      hash = "sha256-TbdRJqLdNI7wchUsx2Kw1LlDyv50XlCiKyn6rhZyN1U=";
      fetcherVersion = 1;
+      hash = "sha256-TbdRJqLdNI7wchUsx2Kw1LlDyv50XlCiKyn6rhZyN1U=";
    };

    postBuild = ''
@@ -6,17 +6,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "automatic-timezoned";
-  version = "2.0.80";
+  version = "2.0.82";

  src = fetchFromGitHub {
    owner = "maxbrunet";
    repo = "automatic-timezoned";
    rev = "v${version}";
-    sha256 = "sha256-5JrIcdNgi68g+5zF0y4YeNboFl6SS9QvZEsmcMh35gE=";
+    sha256 = "sha256-qUpPeuFfdj0rIygSo9C7LGdFi7l1erfz4XYTuxLgL7M=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-IX3lSupcKn1ET4Q7tLpUBhQ+wfmfUyM/onlTwW7wloU=";
+  cargoHash = "sha256-7QkrKeF1WY1ewe4GsdpZ/Na7hd9AGq+ixepeB473bDQ=";

  meta = {
    description = "Automatically update system timezone based on location";
@@ -25,8 +25,8 @@ stdenv.mkDerivation (finalAttrs: {

  pnpmDeps = pnpm_9.fetchDeps {
    inherit (finalAttrs) pname version src;
-    hash = "sha256-zb/BwL//i0oly5HEXN20E3RzZXdaOn+G2yIWRas3PB4=";
    fetcherVersion = 1;
+    hash = "sha256-zb/BwL//i0oly5HEXN20E3RzZXdaOn+G2yIWRas3PB4=";
  };

  installPhase = ''
@@ -6,17 +6,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "autotiling-rs";
-  version = "0.1.4";
+  version = "0.1.5";

  src = fetchFromGitHub {
    owner = "ammgws";
    repo = "autotiling-rs";
    rev = "v${version}";
-    sha256 = "sha256-rihNlKaESxIEQ61FP6PzIg82yuwQ/R4GX5BA0Ss+I5w=";
+    sha256 = "sha256-S/6LRQTHdPGZkmbTAb0ufNoXE1nD+rIQ2ASJ8jjFS3E=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-mXuI+kA8J2Bhli6HiX9h72i61cRbByKJQtUHHjCUza8=";
+  cargoHash = "sha256-riQ1nOs4fBj9y/jK0nS7Y85vMejLrKrEJzNnsQKkoeg=";

  meta = with lib; {
    description = "Autotiling for sway (and possibly i3)";
@@ -56,6 +56,8 @@ stdenv.mkDerivation rec {
    homepage = "https://github.com/awslabs/aws-c-common";
    license = licenses.asl20;
    platforms = platforms.unix;
+    # https://github.com/awslabs/aws-c-common/issues/1175
+    badPlatforms = platforms.bigEndian;
    maintainers = with maintainers; [
      orivej
      r-burns
@@ -33,8 +33,8 @@ let

    pnpmDeps = pnpm_9.fetchDeps {
      inherit (finalAttrs) pname version src;
-      hash = "sha256-q7VMQb/FRT953yT2cyGMxUPp8p8XkA9mvqGI7S7Eifg=";
      fetcherVersion = 1;
+      hash = "sha256-q7VMQb/FRT953yT2cyGMxUPp8p8XkA9mvqGI7S7Eifg=";
    };

    buildPhase = ''
@@ -16,13 +16,13 @@

 buildNpmPackage rec {
  pname = "basedpyright";
-  version = "1.29.5";
+  version = "1.30.1";

  src = fetchFromGitHub {
    owner = "detachhead";
    repo = "basedpyright";
    tag = "v${version}";
-    hash = "sha256-fD7A37G1kr7sWfwI8GXOm1cOlpnTSE9tN/WzotM8BeQ=";
+    hash = "sha256-YPjeiRg7vIpb9k32og6byWMk+EfhDS9MwfJveAndbQQ=";
  };

  npmDepsHash = "sha256-aJte4ApeXJQ9EYn87Uo+Xx7s+wi80I1JsZHeqklHGs4=";
@@ -28,8 +28,8 @@ stdenvNoCC.mkDerivation (finalAttrs: {
      src
      pnpmWorkspaces
      ;
-    hash = "sha256-NvyqPv5OKgZi3hW98Da8LhsYatmrzrPX8kLOfLr+BrI=";
    fetcherVersion = 1;
+    hash = "sha256-NvyqPv5OKgZi3hW98Da8LhsYatmrzrPX8kLOfLr+BrI=";
  };

  nativeBuildInputs = [
@@ -13,16 +13,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "bootc";
-  version = "1.1.2";
+  version = "1.4.0";
  useFetchCargoVendor = true;
-  cargoHash = "sha256-/Sb2XtVguj5zpj/OTl90xFHFSaBeLgb8xIlNm4UrnRI=";
+  cargoHash = "sha256-7Fn68bcm8ZyR5eALCMIdcXcZ595EnWFHKdnqI5vMso4=";
  doInstallCheck = true;

  src = fetchFromGitHub {
-    owner = "containers";
+    owner = "bootc-dev";
    repo = "bootc";
    rev = "v${version}";
-    hash = "sha256-p1+j62MllmPcvWnijieSZmlgwYy76X17fv12Haetz78=";
+    hash = "sha256-FuU3rQtKpK+ScQ10GivisSJseY2GOFJ/y2HRKIiU0G8=";
  };

  nativeBuildInputs = [ pkg-config ];
@@ -35,13 +35,26 @@ rustPlatform.buildRustPackage rec {
    ostree-full
  ];

+  checkFlags = [
+    # These all require a writable /var/tmp
+    "--skip=test_cli_fns"
+    "--skip=test_diff"
+    "--skip=test_tar_export_reproducible"
+    "--skip=test_tar_export_structure"
+    "--skip=test_tar_import_empty"
+    "--skip=test_tar_import_export"
+    "--skip=test_tar_import_signed"
+    "--skip=test_tar_write"
+    "--skip=test_tar_write_tar_layer"
+  ];
+
  nativeInstallCheckInputs = [
    versionCheckHook
  ];

  meta = {
    description = "Boot and upgrade via container images";
-    homepage = "https://containers.github.io/bootc";
+    homepage = "https://bootc-dev.github.io/bootc";
    license = lib.licenses.mit;
    mainProgram = "bootc";
    maintainers = with lib.maintainers; [ thesola10 ];
@@ -24,8 +24,8 @@ stdenv.mkDerivation (finalAttrs: {

  pnpmDeps = pnpm.fetchDeps {
    inherit (finalAttrs) pname version src;
-    hash = "sha256-duxpym1DlJM4q5j0wmrubYiAHQ3cDEFfeD9Gyic6mbI=";
    fetcherVersion = 1;
+    hash = "sha256-duxpym1DlJM4q5j0wmrubYiAHQ3cDEFfeD9Gyic6mbI=";
  };

  nativeBuildInputs = [
@@ -6,13 +6,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "byedpi";
-  version = "0.17.1";
+  version = "0.17.2";

  src = fetchFromGitHub {
    owner = "hufrea";
    repo = "byedpi";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-an0UmsAZw5DJMuM4WpAWBVVN0ZVBpXhn0cbZ0ZbfBjo=";
+    hash = "sha256-XeUcf8w6b0vZQwttopRnmg5320oF/Z+gHWcWMQ6kAkc=";
  };

  installPhase = ''
@@ -8,13 +8,13 @@

 stdenvNoCC.mkDerivation {
  pname = "candy-icons";
-  version = "0-unstable-2025-06-23";
+  version = "0-unstable-2025-07-10";

  src = fetchFromGitHub {
    owner = "EliverLara";
    repo = "candy-icons";
-    rev = "29976b2036490599753766f869f83e9346d8cf8e";
-    hash = "sha256-UxuW9cRGmKS2t8ik2tMAQHU0Xj+W5WhWuBxnLkkPnoE=";
+    rev = "475c5b27d34e6bde3ed11e985a727bd7ec9f155a";
+    hash = "sha256-XU10gw0WYWnzyzbzJlg2oNCksLY/Tt1CJGo0Nu4FLnM=";
  };

  nativeBuildInputs = [ gtk3 ];
@@ -8,17 +8,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "cargo-deb";
-  version = "3.2.0";
+  version = "3.2.1";

  src = fetchFromGitHub {
    owner = "kornelski";
    repo = "cargo-deb";
    rev = "v${version}";
-    hash = "sha256-2HHxGpp/N8QDytOsiWh8nkYNbWhThjisjnyI3B8+XYo=";
+    hash = "sha256-MvuwvJUPI+UBw9oEVYtjWjPCHUEBJE3L5+EEwBROwQ8=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-hHZt4mRLpeXj1XWJ6v0pBDO0NpFDn0BT2oLgT2yZlm0=";
+  cargoHash = "sha256-k6mghoRWaKfHzT8YM2ZylJSLDIf005gRL64qqGwo2qw=";

  nativeBuildInputs = [
    makeWrapper
@@ -34,8 +34,8 @@ stdenv.mkDerivation (finalAttrs: {
      src
      ;

-    hash = "sha256-plANa/+9YEQ4ipgdQ7QzPyxgz6eDCBhO7qFlxK6Ab58=";
    fetcherVersion = 1;
+    hash = "sha256-plANa/+9YEQ4ipgdQ7QzPyxgz6eDCBhO7qFlxK6Ab58=";
  };

  nativeBuildInputs = [
@@ -37,8 +37,8 @@ stdenv.mkDerivation (finalAttrs: {

  pnpmDeps = pnpm_9.fetchDeps {
    inherit (finalAttrs) pname version src;
-    hash = "sha256-7NrDYd4H0cPQs8w4lWlB0BhqcYZVo6/9zf0ujPjBzsE=";
    fetcherVersion = 1;
+    hash = "sha256-7NrDYd4H0cPQs8w4lWlB0BhqcYZVo6/9zf0ujPjBzsE=";
  };

  buildPhase = ''
@@ -19,12 +19,12 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "circt";
-  version = "1.124.0";
+  version = "1.125.0";
  src = fetchFromGitHub {
    owner = "llvm";
    repo = "circt";
    rev = "firtool-${version}";
-    hash = "sha256-IoS7mhQLiaVlqyosqOOaoGKBkS5WuQHRJK9v+FonCxc=";
+    hash = "sha256-bpQvBUSYpmv6bmgXSCz9pfGgFxlGVFFDfaSkvk7481E=";
    fetchSubmodules = true;
  };

@@ -37,8 +37,8 @@ rustPlatform.buildRustPackage {

  pnpmDeps = pnpm_9.fetchDeps {
    inherit pname version src;
-    hash = pnpm-hash;
    fetcherVersion = 1;
+    hash = pnpm-hash;
  };

  env = {
@@ -8,16 +8,16 @@

 buildGoModule rec {
  pname = "clickhouse-backup";
-  version = "2.6.24";
+  version = "2.6.26";

  src = fetchFromGitHub {
    owner = "Altinity";
    repo = "clickhouse-backup";
    rev = "v${version}";
-    hash = "sha256-KpCucAG2t2+HyDLCkc838k07QqWTC57Oolp9CAxTQiY=";
+    hash = "sha256-CdDzIKCtOE8Q7I6YhMIi4oyjo5rnYrySvzbpcdgQH6s=";
  };

-  vendorHash = "sha256-ynXS0owzBBIPzSma/nhY/cX/gSL6nQ+/KmMYY16NloU=";
+  vendorHash = "sha256-Vqudi7sl9VTWo4g+74qh9sMUOGd9OpNDlzimEPm/EtU=";

  ldflags = [
    "-X main.version=${version}"
@@ -9,16 +9,16 @@

 buildGoModule (finalAttrs: {
  pname = "cmctl";
-  version = "2.2.0";
+  version = "2.3.0";

  src = fetchFromGitHub {
    owner = "cert-manager";
    repo = "cmctl";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Kr7vwVW6v08QRbJDs2u0vK241ljNfhLVYIQCBl31QSs=";
+    hash = "sha256-yX3A63MU1PaFQmAemp62F5sHlgWpkInhbIIZx7HfdEc=";
  };

-  vendorHash = "sha256-SYCWvt2K3MEow4cDKxLSK+Bp0hZG9rNI9PoXdPcPESg=";
+  vendorHash = "sha256-LDmhlSWa6/Z4KyXnF9OFVkgTksV7TL+m1os0NW89ZpY=";

  ldflags = [
    "-s"
@@ -11,17 +11,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "comma";
-  version = "2.0.0";
+  version = "2.1.0";

  src = fetchFromGitHub {
    owner = "nix-community";
    repo = "comma";
    rev = "v${version}";
-    hash = "sha256-EP1UGmoPXeyJY1mk3c4DNF6/HkjqlwKf5ZLhjNa1WMo=";
+    hash = "sha256-Q9s3z/FqkEqCQyvYhH07qlITGGlA8quZcYsK3lO8M8g=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-GEHvS4hDBKqSquRmGZ9LMIFsX8MGqOqPZVf0aAzMmmI=";
+  cargoHash = "sha256-yNx0Sc2JnEfndBBPxaeNMWsdWpB9fAUqXUPVNR+NOrM=";

  nativeBuildInputs = [ makeBinaryWrapper ];

@@ -29,8 +29,8 @@ stdenv.mkDerivation (finalAttrs: {
      src
      patches
      ;
-    hash = "sha256-F1teWIABkK0mqZcK3RdGNKmexI/C59QWSrrD1jYbHt0=";
    fetcherVersion = 1;
+    hash = "sha256-F1teWIABkK0mqZcK3RdGNKmexI/C59QWSrrD1jYbHt0=";
  };

  patches = [
@@ -13,11 +13,11 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "copybara";
-  version = "20250630";
+  version = "20250714";

  src = fetchurl {
    url = "https://github.com/google/copybara/releases/download/v${finalAttrs.version}/copybara_deploy.jar";
-    hash = "sha256-eXvFPzlQT3sVcXi+b6ze/3Llnv9T0S2cELdDbyHJ6Yg=";
+    hash = "sha256-pvJnBMuTJb4juJBJObpA9hP2Fw42IssdAARUGUuEgJo=";
  };

  nativeBuildInputs = [
@@ -6,21 +6,21 @@
  installShellFiles,
  nixosTests,
  externalPlugins ? [ ],
-  vendorHash ? "sha256-mp+0/DQTNsgAZTnLqcQq1HVLAfKr5vUGYSZlIvM7KpE=",
+  vendorHash ? "sha256-Es3xy8NVDo7Xgu32jJa4lhYWGa5hJnRyDKFYQqB3aBY=",
 }:

 let
  attrsToSources = attrs: builtins.map ({ repo, version, ... }: "${repo}@${version}") attrs;
 in
-buildGoModule rec {
+buildGoModule (finalAttrs: {
  pname = "coredns";
-  version = "1.11.3";
+  version = "1.12.2";

  src = fetchFromGitHub {
    owner = "coredns";
    repo = "coredns";
-    rev = "v${version}";
-    sha256 = "sha256-8LZMS1rAqEZ8k1IWSRkQ2O650oqHLP0P31T8oUeE4fw=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-P4GhWrEACR1ZhNhGAoXWvNXYlpwnm2dz6Ggqv72zYog=";
  };

  inherit vendorHash;
@@ -95,16 +95,17 @@ buildGoModule rec {
  postPatch =
    ''
      substituteInPlace test/file_cname_proxy_test.go \
-        --replace "TestZoneExternalCNAMELookupWithProxy" \
-                  "SkipZoneExternalCNAMELookupWithProxy"
+        --replace-fail \
+          "TestZoneExternalCNAMELookupWithProxy" \
+          "SkipZoneExternalCNAMELookupWithProxy"

      substituteInPlace test/readme_test.go \
-        --replace "TestReadme" "SkipReadme"
+        --replace-fail "TestReadme" "SkipReadme"

      # this test fails if any external plugins were imported.
      # it's a lint rather than a test of functionality, so it's safe to disable.
      substituteInPlace test/presubmit_test.go \
-        --replace "TestImportOrdering" "SkipImportOrdering"
+        --replace-fail "TestImportOrdering" "SkipImportOrdering"
    ''
    + lib.optionalString stdenv.hostPlatform.isDarwin ''
      # loopback interface is lo0 on macos
@@ -112,9 +113,11 @@ buildGoModule rec {

      # test is apparently outdated but only exhibits this on darwin
      substituteInPlace test/corefile_test.go \
-        --replace "TestCorefile1" "SkipCorefile1"
+        --replace-fail "TestCorefile1" "SkipCorefile1"
    '';

+  __darwinAllowLocalNetworking = true;
+
  postInstall = ''
    installManPage man/*
  '';
@@ -124,15 +127,16 @@ buildGoModule rec {
    kubernetes-multi-node = nixosTests.kubernetes.dns-multi-node;
  };

-  meta = with lib; {
+  meta = {
    homepage = "https://coredns.io";
    description = "DNS server that runs middleware";
    mainProgram = "coredns";
-    license = licenses.asl20;
-    maintainers = with maintainers; [
-      rushmorem
-      rtreffer
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [
      deltaevo
+      djds
+      rtreffer
+      rushmorem
    ];
  };
-}
+})
@@ -1,57 +0,0 @@
-From c0d7c99632ea2ee01066988708cbb41f335cbdc3 Mon Sep 17 00:00:00 2001
-From: Brahmajit Das <listout@listout.xyz>
-Date: Sat, 14 Jun 2025 00:18:38 +0530
-Subject: [PATCH] src/lib/serialize.h: don't define double as float_t
-
-libuv with commit 85b526f makes uv.h include math.h for the definitions
-of NAN/INFINITY. That header also defines the ISO C standard float_t
-type. Now that that definition is in scope, the cowsql definition in
-src/lib/serialize.h conflicts with it.
-
-Fixes: 451cff63b29366237a9502823299b05bbff8662b
-Closes: https://github.com/cowsql/cowsql/issues/35
-Signed-off-by: Brahmajit Das <listout@listout.xyz>
---
- src/lib/serialize.h | 8 ++++----
- 1 file changed, 4 insertions(+), 4 deletions(-)
-
-diff --git a/src/lib/serialize.h b/src/lib/serialize.h
-index 9fbd49c..a7f9147 100644
--- a/src/lib/serialize.h
-+++ b/src/lib/serialize.h
-@@ -37,7 +37,7 @@ static_assert(sizeof(double) == sizeof(uint64_t),
-  * Basic type aliases to used by macro-based processing.
-  */
- typedef const char *text_t;
-typedef double float_t;
-+typedef double cowsql_float;
- typedef uv_buf_t blob_t;
- 
- /**
-@@ -143,7 +143,7 @@ COWSQL_INLINE size_t int64__sizeof(const int64_t *value)
- 	return sizeof(int64_t);
- }
- 
-COWSQL_INLINE size_t float__sizeof(const float_t *value)
-+COWSQL_INLINE size_t float__sizeof(const cowsql_float *value)
- {
- 	(void)value;
- 	return sizeof(double);
-@@ -190,7 +190,7 @@ COWSQL_INLINE void int64__encode(const int64_t *value, void **cursor)
- 	*cursor += sizeof(int64_t);
- }
- 
-COWSQL_INLINE void float__encode(const float_t *value, void **cursor)
-+COWSQL_INLINE void float__encode(const cowsql_float *value, void **cursor)
- {
- 	*(uint64_t *)(*cursor) = ByteFlipLe64(*(uint64_t *)value);
- 	*cursor += sizeof(uint64_t);
-@@ -273,7 +273,7 @@ COWSQL_INLINE int int64__decode(struct cursor *cursor, int64_t *value)
- 	return 0;
- }
- 
-COWSQL_INLINE int float__decode(struct cursor *cursor, float_t *value)
-+COWSQL_INLINE int float__decode(struct cursor *cursor, cowsql_float *value)
- {
- 	size_t n = sizeof(double);
- 	if (n > cursor->cap) {
@@ -13,21 +13,15 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "cowsql";
-  version = "1.15.8";
+  version = "1.15.9";

  src = fetchFromGitHub {
    owner = "cowsql";
    repo = "cowsql";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-rwTa9owtnkyI9OpUKLk6V7WbAkqlYucpGzPnHHvKW/A=";
+    hash = "sha256-7djVcozWklI/0KhDC20df+H3YQbodUZaXBnQT4Ug8oI=";
  };

-  patches = [
-    # fix libuv changes. review removal in > 1.15.8
-    # https://github.com/cowsql/cowsql/pull/37
-    ./37.patch
-  ];
-
  nativeBuildInputs = [
    autoreconfHook
    pkg-config
@@ -21,12 +21,12 @@

 rustPlatform.buildRustPackage {
  pname = "crosvm";
-  version = "0-unstable-2025-06-26";
+  version = "0-unstable-2025-07-02";

  src = fetchgit {
    url = "https://chromium.googlesource.com/chromiumos/platform/crosvm";
-    rev = "4c8cd6ddfd940a1f61178bb469a2bb7274bc07b1";
-    hash = "sha256-6Io0Vj5QG6BwAlcgB0KyQlsRU3Z/elvd1oXt2w+hgBM=";
+    rev = "0435ecd305e4a4f9f4110cfe7d94a6ff906d2f5d";
+    hash = "sha256-NZezC/XZwWivJsmVUkcncVonJM5jRZottRGO+I0KhIY=";
    fetchSubmodules = true;
  };

@@ -24,13 +24,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "cubeb";
-  version = "0-unstable-2025-06-16";
+  version = "0-unstable-2025-07-10";

  src = fetchFromGitHub {
    owner = "mozilla";
    repo = "cubeb";
-    rev = "566c73da47668ca85817108b749a13ac9c3f5a9d";
-    hash = "sha256-qYDsRhVBHLOVpWwtRNUtnZRZZq9Rot1pOn+4let6v6I=";
+    rev = "fa021607121360af7c171d881dc5bc8af7bb56eb";
+    hash = "sha256-6PUHUPybe3g5nexunAHsHLThFdvpnv+avks+C0oYih0=";
  };

  outputs = [
@@ -27,8 +27,8 @@ let

    pnpmDeps = pnpm_9.fetchDeps {
      inherit pname version src;
-      hash = "sha256-+yLpSbDzr1OV/bmUUg6drOvK1ok3cBd+RRV7Qrrlp+Q=";
      fetcherVersion = 1;
+      hash = "sha256-+yLpSbDzr1OV/bmUUg6drOvK1ok3cBd+RRV7Qrrlp+Q=";
    };

    nativeBuildInputs = [
@@ -10,13 +10,13 @@

 buildGoModule (finalAttrs: {
  pname = "databricks-cli";
-  version = "0.258.0";
+  version = "0.259.0";

  src = fetchFromGitHub {
    owner = "databricks";
    repo = "cli";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-8JVU0tn0KINBdEE0nS2VQ8v9TUn9h2euPGZELSCbcLA=";
+    hash = "sha256-UzfLtGwiyEnHRn54qAwcqMXag8k8GjpB5BGMYh/93O8=";
  };

  # Otherwise these tests fail asserting that the version is 0.0.0-dev
@@ -0,0 +1,67 @@
+{
+  lib,
+  stdenv,
+  buildGoModule,
+  fetchFromGitHub,
+  installShellFiles,
+  buildPackages,
+  versionCheckHook,
+  nix-update-script,
+}:
+buildGoModule (finalAttrs: {
+  pname = "dbtpl";
+  version = "1.1.0";
+
+  src = fetchFromGitHub {
+    owner = "xo";
+    repo = "dbtpl";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-r0QIgfDSt7HWnIDnJWGbwkqkXWYWGXoF5H/+zS6gEtE=";
+  };
+
+  vendorHash = "sha256-scJRJaaccQovxhzC+/OHuPR4NRaE8+u57S1JY40bif8=";
+
+  nativeBuildInputs = [
+    installShellFiles
+  ];
+
+  modPostBuild = ''
+    substituteInPlace vendor/github.com/xo/ox/ox.go \
+        --replace-warn "ver := \"(devel)\"" "ver := \"${finalAttrs.version}\""
+  '';
+
+  postInstall =
+    let
+      exe =
+        if stdenv.buildPlatform.canExecute stdenv.hostPlatform then
+          "$out/bin/dbtpl"
+        else
+          lib.getExe buildPackages.dbtpl;
+    in
+    ''
+      installShellCompletion --cmd dbtpl \
+        --bash <(${exe} completion bash) \
+        --fish <(${exe} completion fish) \
+        --zsh <(${exe} completion zsh)
+    '';
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  versionCheckProgramArg = "version";
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Command line tool to generate idiomatic Go code for SQL databases supporting PostgreSQL, MySQL, SQLite, Oracle, and Microsoft SQL Server";
+    homepage = "https://github.com/xo/dbtpl";
+    changelog = "https://github.com/xo/dbtpl/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [
+      xiaoxiangmoe
+      shellhazard
+    ];
+    mainProgram = "dbtpl";
+  };
+})
@@ -6,13 +6,13 @@

 buildGoModule rec {
  pname = "ddns-go";
-  version = "6.11.2";
+  version = "6.11.3";

  src = fetchFromGitHub {
    owner = "jeessy2";
    repo = "ddns-go";
    rev = "v${version}";
-    hash = "sha256-dzHNv7zfn1jU3F7nyQP/mP3icGCoeR3C7rerE3oYoTw=";
+    hash = "sha256-65j1hZqnpSRpDmkzjb8ciJoVGHbV2xuOwBLcsW65eOE=";
  };

  vendorHash = "sha256-oHiREhvqu14z5StjzD4PgtFasYQ0X435eMCRMiWUzg0=";
@@ -48,8 +48,8 @@ stdenv.mkDerivation (finalAttrs: {

  pnpmDeps = pnpm.fetchDeps {
    inherit (finalAttrs) pname version src;
-    hash = "sha256-PBCmyNmlH88y5s7+8WHcei8SP3Q0lIAAnAQn9uaFxLc=";
    fetcherVersion = 1;
+    hash = "sha256-PBCmyNmlH88y5s7+8WHcei8SP3Q0lIAAnAQn9uaFxLc=";
  };

  nativeBuildInputs =
--- a/Show More
+++ b/Show More