Merge master into staging-next

2026-03-27 00:26:30 +00:00
parent f7921f6f81 ca19b8723a
commit 62826199a7
135 changed files with 1269 additions and 953 deletions
@@ -16,6 +16,7 @@ let
    ;

  inherit (types)
+    bool
    listOf
    enum
    str
@@ -54,6 +55,15 @@ in
      '';
    };

+    openFirewall = lib.mkOption {
+      type = bool;
+      default = false;
+      description = ''
+        Whether to open required ports for the configured providers.
+        Currently airplay and sendspin need port to be opened to function.
+      '';
+    };
+
    providers = mkOption {
      type = listOf (enum cfg.package.providerNames);
      default = [ ];
@@ -68,6 +78,31 @@ in
  };

  config = mkIf cfg.enable {
+    networking.firewall = lib.mkIf cfg.openFirewall {
+      allowedTCPPorts =
+        lib.optional cfg.enable 8097 # Music Assistant stream port
+        ++ lib.optional (lib.elem "airplay" cfg.providers) 7000
+        ++ lib.optional (lib.elem "sendspin" cfg.providers) 8927;
+      # The information published by Apple 1 seem to not apply to libraop.
+      # The closest we could find that represents the port range being used as observed by tcpdump is the ephemeral port range.
+      # 1: https://support.apple.com/en-us/103229#:~:text=49152%E2%80%93-,65535,-TCP%2C%20UDP
+      # 2: https://en.wikipedia.org/wiki/Ephemeral_port#Range
+      allowedUDPPortRanges = lib.mkIf (lib.elem "airplay" cfg.providers) [
+        {
+          from = 32768;
+          to = 65535;
+        }
+      ];
+    };
+
+    services.avahi = lib.mkIf (lib.elem "airplay_receiver" cfg.providers) {
+      enable = true;
+      publish = {
+        enable = true;
+        userServices = true;
+      };
+    };
+
    systemd.services.music-assistant = {
      description = "Music Assistant";
      documentation = [ "https://music-assistant.io" ];
@@ -87,6 +122,13 @@ in
        [
          lsof
        ]
+        ++ lib.optionals (lib.elem "airplay" cfg.providers) [
+          cliairplay
+          libraop
+        ]
+        ++ lib.optionals (lib.elem "airplay_receiver" cfg.providers) [
+          shairport-sync
+        ]
        ++ lib.optionals (lib.elem "spotify" cfg.providers) [
          librespot-ma
        ]
@@ -291,13 +291,20 @@ let
        sectionVLAN = checkUnitConfig "VLAN" [
          (assertOnlyFields [
            "Id"
+            "Protocol"
            "GVRP"
            "MVRP"
            "LooseBinding"
            "ReorderHeader"
+            "EgressQOSMaps"
+            "IngressQOSMaps"
          ])
          (assertInt "Id")
          (assertRange "Id" 0 4094)
+          (assertValueOneOf "Protocol" [
+            "802.1q"
+            "802.1ad"
+          ])
          (assertValueOneOf "GVRP" boolValues)
          (assertValueOneOf "MVRP" boolValues)
          (assertValueOneOf "LooseBinding" boolValues)
@@ -114,6 +114,6 @@
        agentHost.succeed("/run/current-system/specialisation/agent/bin/switch-to-configuration switch")
        agentHost.wait_for_unit("beszel-agent.service")
        agentHost.wait_until_succeeds("journalctl -eu beszel-agent --grep 'SSH connection established'")
-        agentHost.wait_until_succeeds(f'curl -H \'Authorization: {user["token"]}\' -f ${agentCfg.environment.HUB_URL}/api/collections/systems/records | grep agentHost')
+        agentHost.wait_until_succeeds(f'curl -H \'Authorization: {user["token"]}\' -f ${agentCfg.environment.HUB_URL}/api/collections/systems/records | jq -e \'.items[].status == "up"\' ')
    '';
 }
@@ -365,8 +365,8 @@ let
        mktplcRef = {
          name = "nix-env-selector";
          publisher = "arrterian";
-          version = "1.1.0";
-          hash = "sha256-c5WX5L1hufKwBX64UiaLWOQaZTYma+6AbOphLPEQ9C8=";
+          version = "1.2.0";
+          hash = "sha256-dvJmBoljMNS7I7c1DicIWW0t4GQvBFF9jAz2Z2v4lXw=";
        };
        meta = {
          license = lib.licenses.mit;
@@ -5019,6 +5019,8 @@ let
        };
      };

+      vitest.explorer = callPackage ./vitest.explorer { };
+
      vlanguage.vscode-vlang = buildVscodeMarketplaceExtension {
        mktplcRef = {
          name = "vscode-vlang";
@@ -5219,8 +5221,8 @@ let
        mktplcRef = {
          name = "gitblame";
          publisher = "waderyan";
-          version = "12.1.0";
-          sha256 = "sha256-S+OeS7YlygElzO/jgHidlIMLFmAOL3tQPcv/063LIEM=";
+          version = "13.0.0";
+          sha256 = "sha256-I6b4GDM8Ogf+ZH2lD2g4fUkQY9ktuO1xqxfSH6vAMVk=";
        };
        meta = {
          changelog = "https://marketplace.visualstudio.com/items/waderyan.gitblame/changelog";
@@ -4,6 +4,12 @@
  wasm-language-tools,
 }:

+# The update script for the wasm-language-tools package itself updates this
+# package too, so we disable nixpkgs-update for this package to avoid sometimes
+# accidentally updating just this package by itself.
+
+# nixpkgs-update: no auto update
+
 vscode-utils.buildVscodeMarketplaceExtension {
  mktplcRef = {
    publisher = "gplane";
@@ -0,0 +1,17 @@
+{ lib, vscode-utils }:
+
+vscode-utils.buildVscodeMarketplaceExtension {
+  mktplcRef = {
+    name = "explorer";
+    publisher = "vitest";
+    version = "1.48.2";
+    hash = "sha256-EaybAznwFjeFEmVW0v9iYCfqvqUKGkjmRBx7mZxvxWw=";
+  };
+  meta = {
+    changelog = "https://github.com/vitest-dev/vscode/releases";
+    description = "Vitest extension for Visual Studio Code";
+    downloadPage = "https://marketplace.visualstudio.com/items?itemName=vitest.explorer";
+    homepage = "https://github.com/vitest-dev/vscode";
+    license = lib.licenses.mit;
+  };
+}
@@ -128,13 +128,13 @@
    "vendorHash": "sha256-/dOiXO2aPkuZaFiwv/6AXJdIADgx8T7eOwvJfBBoqg8="
  },
  "buildkite_buildkite": {
-    "hash": "sha256-0FtTYHRWUJk2c/4f8bvF8mU1L7L8rFK6YyKqSX6EHFg=",
+    "hash": "sha256-RNWcVLpgBmwcHuopPRy0NkXXjmFUcWLn+GJy504J0ZA=",
    "homepage": "https://registry.terraform.io/providers/buildkite/buildkite",
    "owner": "buildkite",
    "repo": "terraform-provider-buildkite",
-    "rev": "v1.31.2",
+    "rev": "v1.31.4",
    "spdx": "MIT",
-    "vendorHash": "sha256-fRDthgXec+AdKDx0n2/8msa78bd1cUSDPx7VJ+UP8oI="
+    "vendorHash": "sha256-CdaYWCQQ0L1LprQ5G/aXoA5GCQWCxOkkiDbMd20r7rs="
  },
  "camptocamp_pass": {
    "hash": "sha256-GQ2g7VyK+eeBqW3LMR4U0gMYsvQnG3y+KEKKkvnmfsk=",
@@ -400,13 +400,13 @@
    "vendorHash": null
  },
  "fastly_fastly": {
-    "hash": "sha256-qEBjalezQhcDDeAW/GGf8d70A5iWpWU4C0ABN5HZpAM=",
+    "hash": "sha256-PCfCsr4FMbMT+BKP+U1Ji51heTmXrOQ/vCgnQYN2u3k=",
    "homepage": "https://registry.terraform.io/providers/fastly/fastly",
    "owner": "fastly",
    "repo": "terraform-provider-fastly",
-    "rev": "v8.7.2",
+    "rev": "v8.8.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-I+8Ql0/m/vYchnGsg0ADX/wpWwgH79ALN8Cl6gzcS2c="
+    "vendorHash": "sha256-WF+9Piyx+6vaUVujmlD3mKIEw/8KNJnlx7RlEWELbRg="
  },
  "flexibleenginecloud_flexibleengine": {
    "hash": "sha256-yEZ9JiUSqFFbfqzOOD59ZBv4yFCeUBBKlp6aiUqDqiM=",
@@ -715,11 +715,11 @@
    "vendorHash": "sha256-rd7QuDdq7xRMyaQIDyXY1DI2Tt/wy3oXan/nE0HIyT0="
  },
  "huaweicloud_huaweicloud": {
-    "hash": "sha256-uhhtNjVd4Jp8xYdwWX7XCepFcqZZ0ya/ekadmPvqgMU=",
+    "hash": "sha256-dBjanfq9CghhGV8L4So3fV2LFw/Yx7g8lLPLWY3GVUI=",
    "homepage": "https://registry.terraform.io/providers/huaweicloud/huaweicloud",
    "owner": "huaweicloud",
    "repo": "terraform-provider-huaweicloud",
-    "rev": "v1.87.0",
+    "rev": "v1.88.0",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
@@ -19,11 +19,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "fossil";
-  version = "2.27";
+  version = "2.28";

  src = fetchurl {
    url = "https://www.fossil-scm.org/home/tarball/version-${finalAttrs.version}/fossil-${finalAttrs.version}.tar.gz";
-    hash = "sha256-XzP5IKhlYi+ZBpWrKO7xc2Nb4i0ylYctd2aUG8S31DQ=";
+    hash = "sha256-y5joXR+QZAyYniRSHpD+vJjtjuPyZj2Lg6RFsVvMg9M=";
  };

  # required for build time tool `./tools/translate.c`
@@ -55,11 +55,6 @@ stdenv.mkDerivation (finalAttrs: {
    export USER=nonexistent-but-specified-user
  '';

-  # see https://fossil-scm.org/home/vinfo/4619d2efab946460?diff=1
-  preCheck = ''
-    mv test/settings.test test/settings.test.off
-  '';
-
  installPhase = ''
    mkdir -p $out/bin
    INSTALLDIR=$out/bin make install
@@ -8,13 +8,13 @@

 buildGoModule (finalAttrs: {
  pname = "aliyun-cli";
-  version = "3.3.1";
+  version = "3.3.3";

  src = fetchFromGitHub {
    owner = "aliyun";
    repo = "aliyun-cli";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-yCHxFJyh4TpQ4Me/WR5YKc7ff7m+qidIWQyKOC8umI0=";
+    hash = "sha256-v44QWIpFTfUD7gOaQGwJ12MvtO4rMS69rCZr4Hv/e3k=";
    fetchSubmodules = true;
  };

@@ -8,13 +8,13 @@

 buildGoModule (finalAttrs: {
  pname = "argonaut";
-  version = "2.14.1";
+  version = "2.15.0";

  src = fetchFromGitHub {
    owner = "darksworm";
    repo = "argonaut";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-vD7XDgENQWexNNMq41W0eC0snUA+JUZeXIBTCH1lbks=";
+    hash = "sha256-LDw2/8l/jipCVIMYeco08LukIfx3Kk1ROXkvU69SK5g=";
  };

  vendorHash = "sha256-xln/WmZbi0+rHqMMHRgt0ar/EaBDNscCsd/NckJZnMw=";
@@ -8,13 +8,13 @@

 buildGoModule (finalAttrs: {
  pname = "arkade";
-  version = "0.11.88";
+  version = "0.11.91";

  src = fetchFromGitHub {
    owner = "alexellis";
    repo = "arkade";
    tag = finalAttrs.version;
-    hash = "sha256-ISito/qTolDRyYSn3z/J6Zc07RlaKWm7t1ugUt3bDkI=";
+    hash = "sha256-9X+JVCtvkSU1JE1ZjpMIOedwIhoryWFe25hGWKyjecU=";
  };

  env.CGO_ENABLED = 0;
@@ -125,9 +125,15 @@ py.pkgs.buildPythonApplication rec {
  ];

  postInstall = ''
+    cat > aws.zsh <<EOF
+    #compdef aws
+    autoload -U +X bashcompinit && bashcompinit
+    complete -C $out/bin/aws_completer aws
+    EOF
+
    installShellCompletion --cmd aws \
      --bash <(echo "complete -C $out/bin/aws_completer aws") \
-      --zsh $out/bin/aws_zsh_completer.sh
+      --zsh aws.zsh
  ''
  + lib.optionalString (!stdenv.hostPlatform.isWindows) ''
    rm $out/bin/aws.cmd
@@ -7,13 +7,13 @@

 buildGoModule (finalAttrs: {
  pname = "buildkit";
-  version = "0.28.0";
+  version = "0.28.1";

  src = fetchFromGitHub {
    owner = "moby";
    repo = "buildkit";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-DJ/nA8EPEx7OQBScP1LupOlMXgpsWXSJaBXdTgtyTg0=";
+    hash = "sha256-tGn4TQZq1kcueuadwORRZbLTeJs79E7TFEwawfiFGsY=";
  };

  vendorHash = null;
@@ -186,9 +186,6 @@ stdenv.mkDerivation (finalAttrs: {
  installPhase = ''
    runHook preInstall

-    # Work around #493843 until #493988 lands on master.
-    export QMAKE="${qt6.qtbase}/bin/qmake"
-
    python setup.py install --root=$out \
      --prefix=$out \
      --libdir=$out/lib \
@@ -65,6 +65,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
    "pycep-parser"
    "rustworkx"
    "schema"
+    "tabulate"
    "termcolor"
    "urllib3"
  ];
@@ -6,12 +6,12 @@

 stdenvNoCC.mkDerivation rec {
  pname = "cldr-annotations";
-  version = "48.1";
+  version = "48.2";

  src = fetchzip {
    url = "https://unicode.org/Public/cldr/${version}/cldr-common-${version}.zip";
    stripRoot = false;
-    hash = "sha256-QGbP3VHn77hKmTr8JY+plEs69Wo57DkBtfuZ0lzh2jo=";
+    hash = "sha256-fFSLvhND8lg9gQFsrP3XScpSsGwCWWjuLhN22gQSVNs=";
  };

  installPhase = ''
@@ -0,0 +1,81 @@
+{
+  lib,
+  autoreconfHook,
+  bison,
+  curl,
+  fetchFromGitHub,
+  fetchpatch,
+  ffmpeg-headless,
+  flex,
+  gperf,
+  json_c,
+  libconfuse,
+  libevent,
+  libgcrypt,
+  libgpg-error,
+  libplist,
+  libsodium,
+  libunistring,
+  libuuid,
+  libxml2,
+  pkg-config,
+  stdenv,
+  zlib,
+}:
+
+stdenv.mkDerivation {
+  pname = "cliairplay";
+  # see the beginning of configure.ac for the upstream version number
+  version = "0.2-unstable-2025-12-30";
+
+  src = fetchFromGitHub {
+    owner = "music-assistant";
+    repo = "cliairplay";
+    # we try to closely match the commit used in the last music-assistant release from
+    # https://github.com/music-assistant/server/tree/stable/music_assistant/providers/airplay/bin
+    rev = "4660d886585d6bf8f32e889feec2a0e8975c51dc";
+    fetchSubmodules = true;
+    hash = "sha256-oDStn9LdLYWKhZNm7Qfdibs4qsct8gE3RZbTKooQeOM=";
+  };
+
+  patches = [
+    # Support gettext 0.25
+    (fetchpatch {
+      url = "https://github.com/music-assistant/cliairplay/commit/92a2445d64c476d740feba1f31c7e5bc768701b7.patch";
+      hash = "sha256-/YnopvAGHHnQhfr2X1OenLMoF4ZlUq9x8tQZha/XfbQ=";
+    })
+  ];
+
+  nativeBuildInputs = [
+    autoreconfHook
+    bison
+    flex
+    gperf
+    pkg-config
+  ];
+
+  buildInputs = [
+    curl
+    ffmpeg-headless
+    json_c
+    libconfuse
+    libevent
+    libgcrypt
+    libgpg-error
+    libplist
+    libsodium
+    libunistring
+    libuuid
+    libxml2
+    zlib
+  ];
+
+  meta = {
+    description = "Command line interface for audio streaming to AirPlay 2 devices";
+    homepage = "https://github.com/music-assistant/cliairplay";
+    license = lib.licenses.gpl2Plus;
+    maintainers = with lib.maintainers; [ SuperSandro2000 ];
+    mainProgram = "cliap2";
+    platforms = lib.platforms.unix;
+  };
+}
@@ -7,13 +7,13 @@

 buildGoModule (finalAttrs: {
  pname = "coroot-node-agent";
-  version = "1.29.0";
+  version = "1.30.0";

  src = fetchFromGitHub {
    owner = "coroot";
    repo = "coroot-node-agent";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-WaRPXqf7L26I46jdWEHZpYSwa7c3Ow5Ld1RcOOdZUow=";
+    hash = "sha256-vuUVRGehkzJEwQzvEOI/hNnEG1Wk8UqkTCMY47mY3BI=";
  };

  vendorHash = "sha256-OOd3OctfklHzpMVDCnnb8HYPYqWQgBe+8HfbSm7dXzg=";
@@ -9,16 +9,16 @@
 }:
 rustPlatform.buildRustPackage {
  pname = "cosmic-ext-applet-sysinfo";
-  version = "0-unstable-2026-03-06";
+  version = "0-unstable-2026-03-26";

  src = fetchFromGitHub {
    owner = "cosmic-utils";
    repo = "cosmic-ext-applet-sysinfo";
-    rev = "8012b7b09103722f0ed581b102e5134ae5a90da3";
-    hash = "sha256-zau7OCHjfnskQjC+G68Wc/s4Yk0Kjy9JsHLFk3jMTTs=";
+    rev = "a01f7d1217de6dcc961f258bef5ff2eb54fa84f3";
+    hash = "sha256-BtCArWWC5WbObpNp2OBxfn9Au+3SS+Gj/JBptDs8qbk=";
  };

-  cargoHash = "sha256-qOtj14G3iYEgXmTQfkjvMP7CBAFKvoGo7bfDu0PQSjU=";
+  cargoHash = "sha256-vD90KMBI1bQTwazVnEMFo3eKXmLLI9QswdIwz+XoDho=";

  nativeBuildInputs = [
    libcosmicAppHook
@@ -9,16 +9,16 @@
 }:
 rustPlatform.buildRustPackage {
  pname = "cosmic-ext-applet-weather";
-  version = "0-unstable-2026-03-11";
+  version = "0-unstable-2026-03-23";

  src = fetchFromGitHub {
    owner = "cosmic-utils";
    repo = "cosmic-ext-applet-weather";
-    rev = "d63918979b5208a49a6da2e7e338d706248fdae4";
-    hash = "sha256-OswoiPq27efi8lIrW3BnsVGkfFLMpasmHEXWSLIxNu4=";
+    rev = "e98c57c586180df0abf6efbe3ee479fc4849f4f7";
+    hash = "sha256-8m1L98wt0uf1vnZ7z4meb/9hU+k5bqe7x7Pidf1lBGM=";
  };

-  cargoHash = "sha256-4n8NC7IAhANT9FnzBJzzpsKyw8clJw2uqN1Ie2PK+eE=";
+  cargoHash = "sha256-DmPUA9qRgCMqVqBNVfyQg4UZkqnZXZvokoSAqPxg0Zc=";

  nativeBuildInputs = [
    libcosmicAppHook
@@ -15,13 +15,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "cutecosmic";
-  version = "0.1-unstable-2026-01-21";
+  version = "0.1-unstable-2026-03-25";

  src = fetchFromGitHub {
    owner = "IgKh";
    repo = "cutecosmic";
-    rev = "8e584418f69eeeaee8574c4a48cc92ef27fd610e";
-    hash = "sha256-jKiO+WlNHM1xavKdB6PrGd3HmTgnyL1vjh0Ps1HcWx4=";
+    rev = "441c5ac05b85dd7afeaf02689af7de7428717c6b";
+    hash = "sha256-NMRP9QeN+57pUyA0/xynITJyWrCu/Eg2ZvGzDBzfmvQ=";
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
@@ -10,7 +10,11 @@
  gobject-introspection,
  gtk4,
  libglvnd,
+  libx11,
+  libxcursor,
+  libxi,
  libxkbcommon,
+  libxrandr,
  pango,
  pkg-config,
  rustPlatform,
@@ -86,6 +90,10 @@ let
        lib.makeLibraryPath [
          fontconfig
          libglvnd
+          libx11
+          libxcursor
+          libxi
+          libxrandr
          libxkbcommon
          wayland
        ]
@@ -6,16 +6,16 @@

 buildGoModule (finalAttrs: {
  pname = "dcv";
-  version = "0.3.1";
+  version = "0.3.2";

  src = fetchFromGitHub {
    owner = "tokuhirom";
    repo = "dcv";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-OwfGZq+ce6RNb5dhNHsQ15iMPoEp7QlaYIUVYIiVqmI=";
+    hash = "sha256-j2cr0GaOEHc1qlvlfYkP2ggcrbalKLdMnN54MFfrb5s=";
  };

-  vendorHash = "sha256-xwTPb+eGsisYB9Jy7rG9tQlIbnKWTbAdXqJBsjB0YK0=";
+  vendorHash = "sha256-IHDrGT14wV5/36V/NhyeBEL3h9CGVpvlHqunF/Urw0E=";

  # Don't use the vendored dependencies as they are out of sync with go.mod
  # Instead, let Go download dependencies through the module proxy
@@ -4,18 +4,19 @@
  fetchurl,
  makeWrapper,
  electron,
+  writeScript,
 }:

 let
-  version = "7.1.100";
+  version = "7.1.110";
  srcs = {
    x86_64-linux = fetchurl {
      url = "https://github.com/aunetx/deezer-linux/releases/download/v${version}/deezer-desktop-${version}-x64.tar.xz";
-      hash = "sha256-KU7dmXXJGLVoDf/iHP3LBcbc/+ldTdYsRD3LyGvbvZc=";
+      hash = "sha256-g8HAAp36l0GrAg/bJOjlvNT13Z9p/geDbA5XQCk3QvM=";
    };
    aarch64-linux = fetchurl {
      url = "https://github.com/aunetx/deezer-linux/releases/download/v${version}/deezer-desktop-${version}-arm64.tar.xz";
-      hash = "sha256-sLso74DJaJK/o8cYYHEI/XNXjcl1MgfkegsCEOw+79Y=";
+      hash = "sha256-W6br5bvRwgrfSiwwO5OMwfReev7t3mvI6L0zTIIDiwI=";
    };
  };

@@ -62,6 +63,25 @@ stdenv.mkDerivation (finalAttrs: {
    runHook postInstall
  '';

+  passthru = {
+    inherit srcs;
+    updateScript = writeScript "update-deezer-desktop" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p curl jq common-updater-scripts
+      set -eu -o pipefail
+
+      latest_version="$(
+        curl --fail --silent --show-error --location \
+          'https://api.github.com/repos/aunetx/deezer-linux/releases/latest' |
+          jq -r '.tag_name | ltrimstr("v")'
+      )"
+
+      for platform in ${lib.escapeShellArgs (lib.attrNames srcs)}; do
+        update-source-version "${finalAttrs.pname}" "$latest_version" --ignore-same-version --source-key="passthru.srcs.$platform"
+      done
+    '';
+  };
+
  meta = {
    description = "Unofficial Linux port of the music streaming application";
    homepage = "https://github.com/aunetx/deezer-linux";
@@ -4,21 +4,24 @@
  git,
  glibcLocales,
  python3,
-  fetchPypi,
+  fetchFromGitHub,
  nix-update-script,
 }:

 python3.pkgs.buildPythonApplication (finalAttrs: {
  pname = "devpi-client";
-  version = "7.2.0";
+  version = "7.2.1";
  pyproject = true;

-  src = fetchPypi {
-    pname = "devpi-client";
-    inherit (finalAttrs) version;
-    hash = "sha256-wUM2hFjDh4unvuah2bQY4uZZVxo4VmFPWNdriigmnXs=";
+  src = fetchFromGitHub {
+    owner = "devpi";
+    repo = "devpi";
+    tag = "client-${finalAttrs.version}";
+    hash = "sha256-rAku3oHcmzFNA/MP/64382gCTgqopwjjy4S4HTEFZiY=";
  };

+  sourceRoot = "${finalAttrs.src.name}/client";
+
  build-system = with python3.pkgs; [
    setuptools
    setuptools-changelog-shortener
@@ -34,6 +37,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
    pkginfo
    pluggy
    platformdirs
+    requests
  ];

  nativeCheckInputs = [
@@ -1,31 +1,25 @@
 {
  fetchFromGitHub,
  lib,
-  openssl,
-  pkg-config,
  rustPlatform,
  versionCheckHook,
  nix-update-script,
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "dness";
-  version = "0.5.7";
+  version = "0.6.0";

  src = fetchFromGitHub {
    owner = "nickbabcock";
    repo = "dness";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Vty4ec6aoUh3p2b9vLkNeS5R4pJWzjwYrC5DtVVyhT8=";
+    hash = "sha256-Znlygpq0EetCLjtZC39ksaVFeuwMmqI5FhHxsliw+oE=";
  };

-  cargoHash = "sha256-WhSeNukPjgM7Cy8LWi/s1YGa5/UxsFU1NGL7vIUlU58=";
+  cargoHash = "sha256-2NT67tVMI511iISDln3p66Ls8XSLze0JSQZ50/s24tM=";

  doCheck = false; # Many tests require network access

-  nativeBuildInputs = [ pkg-config ];
-
-  buildInputs = [ openssl ];
-
  doInstallCheck = true;
  nativeInstallCheckInputs = [ versionCheckHook ];

@@ -9,13 +9,13 @@

 buildGoModule (finalAttrs: {
  pname = "emptty";
-  version = "0.15.0";
+  version = "0.16.0";

  src = fetchFromGitHub {
    owner = "tvrzna";
    repo = "emptty";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-7RYzj+LcxK9i2RM8NFfKjz2DiD9CjCTNSJe7wVnYzdM=";
+    hash = "sha256-JP9PElmwSHk8rcP7NF1PsZETul978UZR+MUulT3BtYs=";
  };

  buildInputs = [
@@ -8,11 +8,11 @@
  nodejs,
  rustPlatform,
  rustc,
-  wasm-bindgen-cli_0_2_106,
+  wasm-bindgen-cli_0_2_108,
  wasm-pack,
  yarnConfigHook,
  yarnBuildHook,
-  nix-update-script,
+  writeScript,
  extraBuildEnv ? { },
  # This package contains serveral sub-applications. This specifies which of them you want to build.
  enteApp ? "photos",
@@ -25,7 +25,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "ente-web-${enteApp}";
-  version = "1.3.13";
+  version = "1.3.24";

  src = fetchFromGitHub {
    owner = "ente-io";
@@ -36,7 +36,7 @@ stdenv.mkDerivation (finalAttrs: {
    ];
    tag = "photos-v${finalAttrs.version}";
    fetchSubmodules = true;
-    hash = "sha256-Bfu4O+kBtXxxVyx2iC/577TPD049ifjg1ItmKN4bx4U=";
+    hash = "sha256-fM/a5V5Depkeu8hIzaYJr/0w0Mt/zM9/b+76W7ggUfw=";
  };
  sourceRoot = "${finalAttrs.src.name}/web";

@@ -48,13 +48,13 @@ stdenv.mkDerivation (finalAttrs: {
      sourceRoot
      cargoRoot
      ;
-    hash = "sha256-dedLmQP15V+gAtycXx1fpWfjXWsTPLXPPcCIAcr/ME0=";
+    hash = "sha256-ftb0h5MOHyQ2iec6iE7/WdHXgrviLCy8oIqFXv5OTq8=";
  };
  cargoRoot = "packages/wasm";

  offlineCache = fetchYarnDeps {
    yarnLock = "${finalAttrs.src}/web/yarn.lock";
-    hash = "sha256-OPmO+4VlM4Fy9vjgb2ZxDP6Ber9A+ANwix1dZSuEgUE=";
+    hash = "sha256-NhpSwesQ9B5gEeBQVjEEAKO4A68wfmBoQ3ga/baieNE=";
  };

  nativeBuildInputs = [
@@ -66,7 +66,7 @@ stdenv.mkDerivation (finalAttrs: {
    rustc
    rustc.llvmPackages.lld
    nodejs
-    wasm-bindgen-cli_0_2_106
+    wasm-bindgen-cli_0_2_108
    wasm-pack
  ];

@@ -106,12 +106,57 @@ stdenv.mkDerivation (finalAttrs: {
      runHook postInstall
    '';

-  passthru.updateScript = nix-update-script {
-    extraArgs = [
-      "--version-regex"
-      "photos-v(.*)"
-    ];
-  };
+  passthru.updateScript = writeScript "update-ente-web" ''
+    #!/usr/bin/env nix-shell
+    #!nix-shell -i bash -p coreutils nix-update gnugrep gnused curl
+
+    set -eu -o pipefail
+
+    # Assume the current working directory is Nixpkgs
+    file_path="./pkgs/by-name/en/ente-web/package.nix"
+
+    # Extract version, then update
+    old_version=$(grep -oP 'version = "\K[^"]+' "$file_path" | head -n1)
+    if [[ -z "$old_version" ]]; then
+      echo "Failed to extract old version from $file_path"
+      exit 1
+    fi
+
+    nix-update ente-web --version-regex 'photos-v(.*)'
+
+    new_version=$(grep -oP 'version = "\K[^"]+' "$file_path" | head -n1)
+    if [[ -z "$new_version" ]]; then
+      echo "Failed to extract new version from $file_path"
+      exit 1
+    fi
+
+    if [[ "$old_version" == "$new_version" ]]; then
+      echo "No update"
+      exit 0
+    fi
+
+    echo "Updated to version $new_version, checking wasm-bindgen..."
+
+    # Fetch Cargo.lock from GitHub instead of cloning repository
+    cargo_lock_url="https://raw.githubusercontent.com/ente-io/ente/photos-v$new_version/web/packages/wasm/Cargo.lock"
+
+    wasm_bindgen_version=$(curl -s "$cargo_lock_url" | tr -d '\r' | grep -A1 '^name = "wasm-bindgen"$' | grep -oP 'version = "\K[^"]+' | head -n1)
+
+    if [[ -z "$wasm_bindgen_version" ]]; then
+      echo "Failed to find wasm-bindgen version in Cargo.lock from $cargo_lock_url"
+      exit 1
+    fi
+
+    echo "Found wasm-bindgen version: $wasm_bindgen_version"
+
+    # Construct new attribute name
+    wasm_bindgen_attr="wasm-bindgen-cli_''${wasm_bindgen_version//./_}"
+
+    # Replace old attribute name in file
+    sed -i "s/wasm-bindgen-cli_[0-9_]\+/$wasm_bindgen_attr/g" "$file_path"
+
+    echo "Successfully updated wasm-bindgen-cli to $wasm_bindgen_attr"
+  '';

  meta = {
    description = "Ente application web frontends";
@@ -6,14 +6,14 @@
 }:
 python3Packages.buildPythonApplication rec {
  pname = "exegol";
-  version = "5.1.9";
+  version = "5.1.10";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "ThePorgs";
    repo = "Exegol";
    tag = version;
-    hash = "sha256-nYtJkLpg7kaaENodSNJ9lf91/ry+jR+QuKjM0P39qIw=";
+    hash = "sha256-iyzTBZHOzr6CfZDqHvycdWZply/BXH7kESaO5pDLBMY=";
  };

  build-system = with python3Packages; [ pdm-backend ];
@@ -12,13 +12,13 @@

 buildGoModule (finalAttrs: {
  pname = "fastly";
-  version = "14.1.0";
+  version = "14.2.0";

  src = fetchFromGitHub {
    owner = "fastly";
    repo = "cli";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-IXfxrBHrVBAY9yakbBiWl2oBXFCnXxPz6l1avJab9kE=";
+    hash = "sha256-Pz1lK/A4PK41SNZgXLh041a8KQMH8zDuQevWQReffYU=";
    # The git commit is part of the `fastly version` original output;
    # leave that output the same in nixpkgs. Use the `.git` directory
    # to retrieve the commit SHA, and remove the directory afterwards,
@@ -35,7 +35,7 @@ buildGoModule (finalAttrs: {
    "cmd/fastly"
  ];

-  vendorHash = "sha256-9B47qGdSmNJcEI3kVwV2dyQmFbFrPMCX8izNjqbrFdk=";
+  vendorHash = "sha256-/pLaVfP/qnfcGNClhkhYB3Au8tEz1Tiw2HM7IiKfhPs=";

  nativeBuildInputs = [
    installShellFiles
@@ -1,83 +1,150 @@
 {
-  stdenv,
  lib,
-  buildNpmPackage,
+  stdenv,
+  bun,
  fetchFromGitHub,
-  makeWrapper,
-  nix-update-script,
  versionCheckHook,
-  libsecret,
-  nodejs,
-  perl,
-  pkg-config,
+  makeWrapper,
+  writableTmpDirAsHomeHook,
 }:
-
-buildNpmPackage (finalAttrs: {
+let
  pname = "filen-cli";
-  version = "0.0.34";
+  version = "0.0.36";

  src = fetchFromGitHub {
    owner = "FilenCloudDienste";
    repo = "filen-cli";
-    tag = "v${finalAttrs.version}";
-    hash = "sha256-iISW9EAk8haWUCh9I8qHhrBKLqHeBUC8sWA0MnXqQSA=";
+    tag = "v${version}";
+    hash = "sha256-2FN9KygSGir/vtHdKXX0zUeug2O6tgAc1PBhzD9HPqY=";
  };

-  npmDepsHash = "sha256-0DpiUjUFc0ThzP6/qrSEebKDq2fnr/CpcmtPFaIVHhU=";
+  node_modules = stdenv.mkDerivation {
+    pname = "${pname}-node_modules";
+    inherit version src;

-  inherit nodejs;
+    nativeBuildInputs = [
+      bun
+      writableTmpDirAsHomeHook
+    ];

-  env.npm_config_build_from_source = "true";
+    dontConfigure = true;
+
+    buildPhase = ''
+      runHook preBuild
+
+      export BUN_INSTALL_CACHE_DIR=$(mktemp -d)
+
+      bun install \
+        --force \
+        --frozen-lockfile \
+        --ignore-scripts \
+        --no-progress \
+        --production
+
+      runHook postBuild
+    '';
+
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p $out/node_modules
+      cp -R ./node_modules $out
+
+      runHook postInstall
+    '';
+
+    dontFixup = true;
+
+    outputHash =
+      {
+        aarch64-darwin = "sha256-+nTCiCEXsEz7YqRZkHlP3CWL7e7OPdds33BTwfqTL5c=";
+        aarch64-linux = "sha256-uvL498mHFXwoZpeCwsup4Iyh4l5buVnqLRBMyGVRIlA=";
+        x86_64-darwin = "sha256-5nEB6JQLmHasxcIReoiLLLRdSiaT1CRAmGFVyqdd+VY=";
+        x86_64-linux = "sha256-Ky+ewpdd5nKvRzXwEAUgT7P/OW3v6fdb2r6SGxZ/JEc=";
+      }
+      .${stdenv.hostPlatform.system}
+        or (throw "${pname}: Platform ${stdenv.hostPlatform.system} is not packaged yet.");
+
+    outputHashAlgo = "sha256";
+    outputHashMode = "recursive";
+  };
+in
+stdenv.mkDerivation {
+  inherit pname version src;

  nativeBuildInputs = [
+    bun
    makeWrapper
-    pkg-config # for keytar
-  ]
-  ++ lib.optionals stdenv.buildPlatform.isDarwin [
-    # for utf-8-validate
-    # https://github.com/websockets/utf-8-validate/blob/1439ad4cdf99d421084ae3a5f81e2cf43199a690/binding.gyp#L17
-    perl
  ];

-  # for keytar
-  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [ libsecret ];
+  configurePhase = ''
+    runHook preConfigure

-  postPatch = ''
-    # The version string is substituted during publishing:
-    # https://github.com/FilenCloudDienste/filen-cli/blob/c7d5eb2a2cd6d514321992815f16475f6909af36/.github/workflows/build-and-publish.yml#L24
-    substituteInPlace package.json \
-      --replace-fail '"version": "0.0.0"' '"version": "${finalAttrs.version}"' \
-      --replace-fail '\"--external:*keytar.node\" --external:keytar' \
-        '--loader:.node=copy'
+    cp -R ${node_modules}/node_modules .
+
+    runHook postConfigure
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+
+    bun build \
+      --compile \
+      --target=bun \
+      --minify \
+      --sourcemap src/index.ts \
+      --outfile dist/filen \
+      --define IS_RUNNING_AS_BINARY=true \
+      --define "VERSION=v${version}"
+
+    runHook postBuild
  '';

  installPhase = ''
    runHook preInstall
-    mkdir -p $out/bin $out/lib
-    install -T -m755 dist/bundle.js $out/lib/index.js
-    install -D -m755 dist/*.node $out/lib
-    install -D -m644 package.json $out/lib
-    makeWrapper "${lib.getExe nodejs}" $out/bin/filen \
-      --add-flags $out/lib/index.js
+
+    mkdir -p $out/bin
+    cp ./dist/filen $out/bin
+
+    wrapProgram $out/bin/filen \
+      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ stdenv.cc.cc ]}"
+
    runHook postInstall
  '';

-  nativeInstallCheckInputs = [ versionCheckHook ];
-  versionCheckProgram = "${placeholder "out"}/bin/filen";
+  # strip removes the JS bundle from the binary
+  dontStrip = true;

-  # Writes $HOME/Library/Application Support on darwin
-  doInstallCheck = !stdenv.hostPlatform.isDarwin;
+  nativeInstallCheckInputs = [
+    versionCheckHook
+    writableTmpDirAsHomeHook
+  ];

-  passthru.updateScript = nix-update-script {
-    extraArgs = [ "--version-regex=^v([0-9.]+)$" ];
-  };
+  versionCheckKeepEnvironment = [ "HOME" ];
+
+  preVersionCheck = ''
+    cat > filen-version << EOF
+    #!/bin/sh
+    exec $out/bin/filen --skip-update "\$@"
+    EOF
+    chmod +x filen-version
+    versionCheckProgram="$(pwd)/filen-version"
+  '';
+
+  doInstallCheck = true;

  meta = {
    description = "CLI tool for interacting with the Filen cloud";
    homepage = "https://github.com/FilenCloudDienste/filen-cli";
-    changelog = "https://github.com/FilenCloudDienste/filen-cli/releases/tag/v${finalAttrs.version}";
+    changelog = "https://github.com/FilenCloudDienste/filen-cli/releases/tag/v${version}";
    license = lib.licenses.agpl3Only;
    maintainers = with lib.maintainers; [ eilvelia ];
    mainProgram = "filen";
+    platforms = [
+      "aarch64-darwin"
+      "aarch64-linux"
+      "x86_64-darwin"
+      "x86_64-linux"
+    ];
  };
-})
+}
@@ -6,13 +6,13 @@

 buildGoModule (finalAttrs: {
  pname = "olm";
-  version = "1.4.3";
+  version = "1.4.4";

  src = fetchFromGitHub {
    owner = "fosrl";
    repo = "olm";
    tag = finalAttrs.version;
-    hash = "sha256-2FqtucYOfnyOcsEivhZFh18gofcqCGOMhPrr2V91OAM=";
+    hash = "sha256-G2kYzYg4RUFHgW9z44PcQPK85FsD5SVBefpzBKIwUw0=";
  };

  vendorHash = "sha256-D93SPwXAeoTLCbScjyH8AB9TJIF2b/UbLNMIQYi+B+c=";
@@ -7,14 +7,14 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "genemichaels";
-  version = "0.9.5";
+  version = "0.9.6";

  src = fetchCrate {
    inherit (finalAttrs) pname version;
-    hash = "sha256-KaGG2amPk/+fL7xLAfZw4SmCzXc+hS/9IkBG7G6sngI=";
+    hash = "sha256-H/IqREaLvfKQZGOioIJ7t3GdNzTTiE3fYlMOaxXASr4=";
  };

-  cargoHash = "sha256-RkGKzE/EKA1VUkVTTMdMKhtUrs3kmy4uDAHq2hJs5yk=";
+  cargoHash = "sha256-16axK0kQnkr99x13OvAqhCQz7hT1rRMZIRW4MgNOo40=";

  passthru.updateScript = nix-update-script { };

@@ -1,25 +1,25 @@
 {
  lib,
  fetchFromGitHub,
-  buildGo126Module,
+  buildGoModule,
  installShellFiles,
  stdenv,
  testers,
  gh,
 }:

-buildGo126Module (finalAttrs: {
+buildGoModule (finalAttrs: {
  pname = "gh";
-  version = "2.88.1";
+  version = "2.89.0";

  src = fetchFromGitHub {
    owner = "cli";
    repo = "cli";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-aM5hpkI4MTQ6eNUB4FVNQRSNUmwI84dTdVMUANtrnJk=";
+    hash = "sha256-SiPcji8CbJd6GwWmsIFWq3874Mr9/VggOATX9yKYjow=";
  };

-  vendorHash = "sha256-RD40Lqg6EF0T12JJ7Y4B5L2KIvwRHcgGRU1UMiU3qTo=";
+  vendorHash = "sha256-Sko+jTkGUTiR66Mv/p5INv/CLID1EK2v9fY0GfIeckg=";

  nativeBuildInputs = [ installShellFiles ];

@@ -1,19 +1,19 @@
 {
-  "version": "1.0.4",
+  "version": "1.0.9",
  "x86_64-linux": {
    "name": "copilot-linux-x64",
-    "hash": "sha256-xZkPmwKuakDB887hcCdBZF3uwQIhrl9ao4E6EOg4JnA="
+    "hash": "sha256-FwRLHgibSeqOuq142SRIuPbIw8YVHgSgmwuH41kvWD0="
  },
  "aarch64-linux": {
    "name": "copilot-linux-arm64",
-    "hash": "sha256-ssw8hqcPWkNsHTrYgkGZrE8ft5NU6rukOEidY60FOfk="
+    "hash": "sha256-YFaVWsztnMBG3xo4DSAPzlEAMTPLRCYUt34G8M7/yls="
  },
  "x86_64-darwin": {
    "name": "copilot-darwin-x64",
-    "hash": "sha256-Ea4+5mb3D+uOMed2kitUg6NVrKgL8kRQAcA4cdY80ME="
+    "hash": "sha256-YdraXVwpfVMPVnzuDCHTdKmuHlgjlAPzwagzDKW5RsE="
  },
  "aarch64-darwin": {
    "name": "copilot-darwin-arm64",
-    "hash": "sha256-TYhpNTp14OiQoa6Ep8wpNsMBYUeQN0TWZPkXcZBjWo8="
+    "hash": "sha256-pzXgRrr9dryBVaM2taf1JSidG2zgDa9Sx66Mew4zQZU="
  }
 }
@@ -6,16 +6,16 @@

 buildGoModule (finalAttrs: {
  pname = "grafana-dash-n-grab";
-  version = "0.9.2";
+  version = "0.9.3";

  src = fetchFromGitHub {
    rev = "v${finalAttrs.version}";
    owner = "esnet";
    repo = "gdg";
-    sha256 = "sha256-fKLyUaKcZfrBarKumjLmK+g9C0VZOYixxNXP7rU83co=";
+    sha256 = "sha256-K8/NhTFfYk9oL2wpRxFLobEx3aW6fx7PzLxf5wFNbFY=";
  };

-  vendorHash = "sha256-MXWJ/riQTzAgUNJWvAzSvdHTAzRymlHheeNyJoKGAF4=";
+  vendorHash = "sha256-8ZIu9U6OFRD4pu8K/AUBesX/SRyMkOKi8cdScHBdKnk=";

  ldflags = [
    "-s"
@@ -0,0 +1,41 @@
+{
+  lib,
+  appimageTools,
+  fetchurl,
+}:
+
+let
+  version = "1.5.7";
+  pname = "gsender";
+
+  src = fetchurl {
+    url = "https://github.com/Sienci-Labs/gsender/releases/download/v${version}/gSender-${version}-Linux-Intel-64Bit.AppImage";
+    hash = "sha256-J+GpDJ1PU07sxAmLON3GLE6RnsrSGPYfhsdESsFU/jQ=";
+  };
+
+  appimageContents = appimageTools.extractType2 { inherit pname version src; };
+
+in
+appimageTools.wrapType2 rec {
+  inherit pname version src;
+
+  extraInstallCommands = ''
+    install -Dm444 ${appimageContents}/gsender.desktop -t $out/share/applications/
+    install -Dm444 ${appimageContents}/gsender.png -t $out/share/icons/hicolor/512x512/apps/
+
+    substituteInPlace $out/share/applications/gsender.desktop \
+      --replace-fail 'Exec=AppRun' 'Exec=${meta.mainProgram}'
+  '';
+
+  meta = {
+    description = "G-code sender for grbl and grblHAL-based CNCs";
+    homepage = "https://sienci.com/gsender/";
+    downloadPage = "https://resources.sienci.com/view/gs-installation/";
+    changelog = "https://github.com/Sienci-Labs/gsender/releases/tag/v${version}";
+    license = lib.licenses.gpl3Plus;
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+    maintainers = with lib.maintainers; [ FlorisMenninga ];
+    platforms = [ "x86_64-linux" ];
+    mainProgram = "gsender";
+  };
+}
@@ -7,16 +7,16 @@

 buildGoModule (finalAttrs: {
  pname = "harsh";
-  version = "0.13.1";
+  version = "0.14.1";

  src = fetchFromGitHub {
    owner = "wakatara";
    repo = "harsh";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-QaHZg/qssHuxp+flSXqwlbTtB8H/zsfwn+yaw0tOb9o=";
+    hash = "sha256-Dyq6/Soc6J8rmqwvRtgz/H/l9gtSkEb6Ep/CxUteln4=";
  };

-  vendorHash = "sha256-cjlpCTIugNjgY4RKrjJZd4TSM5BqgSKwpd2HJP6V9i4=";
+  vendorHash = "sha256-yMiw/D1poesgkvJa4jUclityEfhBxhLUTffBnkoWLHw=";

  nativeCheckInputs = [ writableTmpDirAsHomeHook ];

@@ -36,9 +36,9 @@ type ConfigPeersElemRoutesElem struct {
 }

 // UnmarshalJSON implements json.Unmarshaler.
-func (j *ConfigPeersElemRoutesElem) UnmarshalJSON(b []byte) error {
+func (j *ConfigPeersElemRoutesElem) UnmarshalJSON(value []byte) error {
 	var raw map[string]interface{}
-	if err := json.Unmarshal(b, &raw); err != nil {
+	if err := json.Unmarshal(value, &raw); err != nil {
 		return err
 	}
 	if _, ok := raw["net"]; raw != nil && !ok {
@@ -46,7 +46,7 @@ func (j *ConfigPeersElemRoutesElem) UnmarshalJSON(b []byte) error {
 	}
 	type Plain ConfigPeersElemRoutesElem
 	var plain Plain
-	if err := json.Unmarshal(b, &plain); err != nil {
+	if err := json.Unmarshal(value, &plain); err != nil {
 		return err
 	}
 	*j = ConfigPeersElemRoutesElem(plain)
@@ -54,9 +54,9 @@ func (j *ConfigPeersElemRoutesElem) UnmarshalJSON(b []byte) error {
 }

 // UnmarshalJSON implements json.Unmarshaler.
-func (j *ConfigPeersElem) UnmarshalJSON(b []byte) error {
+func (j *ConfigPeersElem) UnmarshalJSON(value []byte) error {
 	var raw map[string]interface{}
-	if err := json.Unmarshal(b, &raw); err != nil {
+	if err := json.Unmarshal(value, &raw); err != nil {
 		return err
 	}
 	if _, ok := raw["id"]; raw != nil && !ok {
@@ -64,7 +64,7 @@ func (j *ConfigPeersElem) UnmarshalJSON(b []byte) error {
 	}
 	type Plain ConfigPeersElem
 	var plain Plain
-	if err := json.Unmarshal(b, &plain); err != nil {
+	if err := json.Unmarshal(value, &plain); err != nil {
 		return err
 	}
 	if v, ok := raw["name"]; !ok || v == nil {
@@ -78,12 +78,53 @@ func (j *ConfigPeersElem) UnmarshalJSON(b []byte) error {
 }

 // The services this node provides via the Service Network.
-type ConfigServices map[string]string
+type ConfigServices map[string]struct {
+	// Acl corresponds to the JSON schema field "acl".
+	Acl *ConfigServicesValueAcl `json:"acl,omitempty"`
+
+	// Target address.
+	Target string `json:"target"`
+}
+
+type ConfigServicesValueAcl struct {
+	// List of peers that are explicitly not allowed to connect.
+	Blacklist []string `json:"blacklist,omitempty"`
+
+	// Whether to enable whitelist enforcement.
+	EnableWhitelist bool `json:"enableWhitelist,omitempty"`
+
+	// List of peers that are allowed to connect.
+	Whitelist []string `json:"whitelist,omitempty"`
+}

 // UnmarshalJSON implements json.Unmarshaler.
-func (j *Config) UnmarshalJSON(b []byte) error {
+func (j *ConfigServicesValueAcl) UnmarshalJSON(value []byte) error {
 	var raw map[string]interface{}
-	if err := json.Unmarshal(b, &raw); err != nil {
+	if err := json.Unmarshal(value, &raw); err != nil {
+		return err
+	}
+	type Plain ConfigServicesValueAcl
+	var plain Plain
+	if err := json.Unmarshal(value, &plain); err != nil {
+		return err
+	}
+	if v, ok := raw["blacklist"]; !ok || v == nil {
+		plain.Blacklist = []string{}
+	}
+	if v, ok := raw["enableWhitelist"]; !ok || v == nil {
+		plain.EnableWhitelist = false
+	}
+	if v, ok := raw["whitelist"]; !ok || v == nil {
+		plain.Whitelist = []string{}
+	}
+	*j = ConfigServicesValueAcl(plain)
+	return nil
+}
+
+// UnmarshalJSON implements json.Unmarshaler.
+func (j *Config) UnmarshalJSON(value []byte) error {
+	var raw map[string]interface{}
+	if err := json.Unmarshal(value, &raw); err != nil {
 		return err
 	}
 	if _, ok := raw["privateKey"]; raw != nil && !ok {
@@ -91,7 +132,7 @@ func (j *Config) UnmarshalJSON(b []byte) error {
 	}
 	type Plain Config
 	var plain Plain
-	if err := json.Unmarshal(b, &plain); err != nil {
+	if err := json.Unmarshal(value, &plain); err != nil {
 		return err
 	}
 	if v, ok := raw["listenAddresses"]; !ok || v == nil {
@@ -106,7 +147,7 @@ func (j *Config) UnmarshalJSON(b []byte) error {
 		plain.Peers = []ConfigPeersElem{}
 	}
 	if v, ok := raw["services"]; !ok || v == nil {
-		plain.Services = map[string]string{}
+		plain.Services = ConfigServices{}
 	}
 	*j = Config(plain)
 	return nil
@@ -9,13 +9,13 @@

 buildGoModule (finalAttrs: {
  pname = "hyprspace";
-  version = "0.12.0";
+  version = "0.13.1";

  src = fetchFromGitHub {
    owner = "hyprspace";
    repo = "hyprspace";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-VOufAPhCbLzVxrj/XKwunJkxUx0EAovV4+adrQLwcoI=";
+    hash = "sha256-AsOgnnYZRoB/t2XwrTMD8XIHoy/bl6bqUvIT5e02uNo=";
  };

  env.CGO_ENABLED = "0";
@@ -0,0 +1,15 @@
+diff --git a/Makefile b/Makefile
+index 7d735b8..c3ea73a 100644
+--- a/Makefile
+++ b/Makefile
+@@ -68,7 +68,9 @@ OBJECTS_BIN += $(patsubst %.cpp,$(BUILDDIR)/%.o,$(filter %.cpp,$(SOURCES_BIN)))
+ 
+ LIBRARY	= $(CODECS)/$(HOST)/$(PLATFORM)/libcodecs.a $(MDNS)/$(HOST)/$(PLATFORM)/libmdns.a
+ 
+-ifneq ($(STATIC),)
+ifeq ($(STATIC),)
+LDFLAGS += -lcrypto
+else
+ LIBRARY	+= $(OPENSSL)/libopenssl.a
+ DEFINES += -DSSL_STATIC_LIB
+ endif
@@ -0,0 +1,83 @@
+{
+  lib,
+  fetchFromGitHub,
+  openssl,
+  stdenv,
+}:
+
+let
+  host =
+    if stdenv.hostPlatform.isLinux then
+      "linux"
+    else if stdenv.hostPlatform.isDarwin then
+      "macos"
+    else
+      throw "libraop does not support this platform, yet";
+in
+stdenv.mkDerivation {
+  pname = "libraop";
+  version = "0-unstable-2026-02-09";
+
+  src = fetchFromGitHub {
+    owner = "music-assistant";
+    repo = "libraop";
+    # we try to closely match the commit used in the last music-assistant release from
+    # https://github.com/music-assistant/server/tree/stable/music_assistant/providers/airplay/bin
+    rev = "f49284282ea4ea740d07fabc230b4182f8c69a74";
+    fetchSubmodules = true;
+    hash = "sha256-m1ll5vRZx4d/5IWCG24yY/SWEIIz2k/iU84vQKHlCdo=";
+  };
+
+  patches = [
+    # https://github.com/philippe44/libraop/pull/48
+    ./link-libssl.diff
+  ];
+
+  postPatch = ''
+    # the most security critical part we build ourself
+    rm -r libopenssl/
+
+    # do not confuse the prebuilt binaries with the ones we build
+    rm bin/*
+
+    # easen debugging and we strip ourselves, too
+    substituteInPlace Makefile \
+      --replace-fail "LDFLAGS += -s" "LDFLAGS +="
+  ''
+  + lib.optionalString stdenv.hostPlatform.isDarwin ''
+    # on darwin the direct dlopen to system libcrypto crashes with
+    # WARNING: /nix/store/.../bin/cliraop is loading libcrypto in an unsafe way
+    # Abort trap: 6
+    substituteInPlace crosstools/src/cross_ssl.c \
+      --replace-fail '"libcrypto.dylib"' '"${lib.getLib openssl}/lib/libcrypto.dylib"' \
+      --replace-fail '"libssl.dylib"' '"${lib.getLib openssl}/lib/libssl.dylib"'
+  '';
+
+  buildInputs = [
+    openssl
+  ];
+
+  makeFlags = [
+    "HOST=${host}"
+    "PLATFORM=${stdenv.hostPlatform.uname.processor}"
+  ];
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp bin/cliraop-${host}-${stdenv.hostPlatform.uname.processor} $out/bin/cliraop
+  '';
+
+  meta = {
+    description = "RAOP player and library (AirPlay)";
+    homepage = "https://github.com/music-assistant/libraop";
+    # https://github.com/philippe44/libraop/issues/36
+    license = with lib.licenses; [
+      gpl2Only
+      mit
+    ];
+    maintainers = with lib.maintainers; [ SuperSandro2000 ];
+    mainProgram = "cliraop";
+    platforms = with lib.platforms; linux ++ darwin;
+    sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
+  };
+}
@@ -25,7 +25,6 @@
  system-sendmail,
  libxcrypt,
  mkpasswd,
-  nss_wrapper,

  pythonSupport ? true,
  guileSupport ? true,
@@ -113,21 +112,8 @@ stdenv.mkDerivation (finalAttrs: {
  nativeCheckInputs = [
    dejagnu
    mkpasswd
-    nss_wrapper
  ];

-  preCheck = ''
-    # The nix sandbox's /etc/passwd has literal quotes around the home directory
-    # (e.g. "/build" instead of /build). imap4d's mu_homedir_assert (new in
-    # 3.21) calls stat() on this path, which fails because no directory named
-    # '"/build"' exists. Use nss_wrapper to provide a fixed passwd to the tests.
-    sed 's/"//g' /etc/passwd > "$TMPDIR/passwd"
-    sed 's/"//g' /etc/group > "$TMPDIR/group" 2>/dev/null || echo "nixbld:x:100:" > "$TMPDIR/group"
-    export LD_PRELOAD="${nss_wrapper}/lib/libnss_wrapper.so"
-    export NSS_WRAPPER_PASSWD="$TMPDIR/passwd"
-    export NSS_WRAPPER_GROUP="$TMPDIR/group"
-  '';
-
  doCheck = !stdenv.hostPlatform.isDarwin; # ERROR: All 46 tests were run, 46 failed unexpectedly.

  meta = {
@@ -8,16 +8,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "mdq";
-  version = "0.9.0";
+  version = "0.10.0";

  src = fetchFromGitHub {
    owner = "yshavit";
    repo = "mdq";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Ys5Ol/j4IZ4SNp6TjryfHCIgWoEu3ToNp7ffiTZp5BE=";
+    hash = "sha256-3WIw0n7fRJqOYpkdLh949JpbKKGUVcnnc+On2aWBXTE=";
  };

-  cargoHash = "sha256-fwFi/OYlTqRuDDE2TKuvf9T7u0hLyrDejhOwjFDYHAk=";
+  cargoHash = "sha256-3HXPN0E4HRMVtHZbmmUO+2bPd2C8rTjTVHGcFPM2OFY=";

  passthru.updateScript = nix-update-script { };

@@ -9,12 +9,12 @@
 }:
 let
  pname = "models-dev";
-  version = "0-unstable-2026-03-17";
+  version = "0-unstable-2026-03-26";
  src = fetchFromGitHub {
    owner = "anomalyco";
    repo = "models.dev";
-    rev = "7d3cc61a48f545739f05042b43110ea11147ac03";
-    hash = "sha256-Iyg1IAp3AiqxPqYil/ZhH7dXxkwxW9B3t3LwYMTiRjE=";
+    rev = "62015086c67bd76ebeb29cecb468834c9e17b938";
+    hash = "sha256-fIqUY3usE8pf10Q0SmLUZ9VB6TXeyiXcX4j97NRS4u4=";
  };

  node_modules = stdenvNoCC.mkDerivation {
@@ -11,16 +11,16 @@

 buildGoModule (finalAttrs: {
  pname = "mongodb-atlas-cli";
-  version = "1.53.0";
+  version = "1.53.2";

  src = fetchFromGitHub {
    owner = "mongodb";
    repo = "mongodb-atlas-cli";
    tag = "atlascli/v${finalAttrs.version}";
-    hash = "sha256-BOqXkm7PJAZUx1fuuTXhrubgWcI6MNiS6nBIRQEILVY=";
+    hash = "sha256-njclhtUYLya51mZSb4VKdR0CslaVGpFbYPw4v9qMEjo=";
  };

-  vendorHash = "sha256-ANwv4OGmMcdPssMzDIYGPPDjdQqqlCqxx9UR5nMf3Jo=";
+  vendorHash = "sha256-5P5wiWY4KnSR2T67BT/9d1xKPZdCZ7SE6oYjWmMcN/Q=";

  nativeBuildInputs = [ installShellFiles ];

@@ -11,13 +11,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "msolve";
-  version = "0.9.4";
+  version = "0.9.5";

  src = fetchFromGitHub {
    owner = "algebraic-solving";
    repo = "msolve";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-wlZLmX4a3QjBWraM3DS++YaO1FSzMbvi2wWgrxnwm8U=";
+    hash = "sha256-zty220Elqa8SACM9OlemVNEMbMx9DkhjJjUekZFR67A=";
  };

  postPatch = ''
@@ -0,0 +1,29 @@
+diff --git a/music_assistant/providers/airplay/helpers.py b/music_assistant/providers/airplay/helpers.py
+index c5fef7eb..a628622d 100644
+--- a/music_assistant/providers/airplay/helpers.py
+++ b/music_assistant/providers/airplay/helpers.py
+@@ -6,6 +6,7 @@
+ import os
+ import platform
+ import time
+from shutil import which
+ from typing import TYPE_CHECKING
+ 
+ from zeroconf import IPVersion
+@@ -176,7 +177,6 @@ async def check_binary(cli_path: str) -> str | None:
+             pass
+         return None
+ 
+-    base_path = os.path.join(os.path.dirname(__file__), "bin")
+     system = platform.system().lower().replace("darwin", "macos")
+     architecture = platform.machine().lower()
+ 
+@@ -188,7 +188,7 @@ async def check_binary(cli_path: str) -> str | None:
+         raise RuntimeError(f"Unsupported streaming protocol requested: {protocol}")
+ 
+     if bridge_binary := await check_binary(
+-        os.path.join(base_path, f"{package}-{system}-{architecture}")
+        which(package)
+     ):
+         return bridge_binary
+ 
@@ -40,11 +40,6 @@ let

  pythonPath = python.pkgs.makePythonPath providerDependencies;
 in
-
-assert
-  (lib.elem "airplay" providers)
-  -> throw "music-assistant: airplay support is missing libraop, a library we will not package because it depends on OpenSSL 1.1.";
-
 python.pkgs.buildPythonApplication rec {
  pname = "music-assistant";
  version = "2.7.11";
@@ -66,6 +61,12 @@ python.pkgs.buildPythonApplication rec {
    # Look up librespot from PATH at runtime
    ./librespot.patch

+    # Look up shairport-sync from PATH at runtime
+    ./shairport-sync.patch
+
+    # Look up cliraop/cliap2 from PATH at runtime
+    ./cliraop-cliap2.patch
+
    # Disable interactive dependency resolution, which clashes with the immutable Python environment
    ./dont-install-deps.patch

@@ -91,7 +92,16 @@ python.pkgs.buildPythonApplication rec {
    substituteInPlace pyproject.toml \
      --replace-fail "get-mac" "getmac"

-    rm -rv music_assistant/providers/spotify/bin
+    rm -rv \
+      music_assistant/providers/airplay/bin/{cliap2-*,cliraop-*} \
+      music_assistant/providers/airplay_receiver/bin/{build_binaries.sh,shairport-sync-*} \
+      music_assistant/providers/spotify/bin
+
+    found_bins=$(find music_assistant/ -wholename '*/bin/*' -type f -executable -print0 | tr '\0' ' ')
+    if [[ -n $found_bins ]]; then
+      echo "Found binaries that should be replaced with packages built from source: $found_bins"
+      exit 2
+    fi
  '';

  build-system = with python.pkgs; [
@@ -192,11 +202,6 @@ python.pkgs.buildPythonApplication rec {

  pythonImportsCheck = [ "music_assistant" ];

-  postFixup = ''
-    # binary native code, segfaults when autopatchelf'd, requires openssl 1.1 to build
-    rm $out/${python3.sitePackages}/music_assistant/providers/airplay/bin/cliraop-*
-  '';
-
  passthru = {
    inherit
      python
@@ -0,0 +1,20 @@
+diff --git a/music_assistant/providers/airplay_receiver/helpers.py b/music_assistant/providers/airplay_receiver/helpers.py
+index 6f2b35df..dd839b73 100644
+--- a/music_assistant/providers/airplay_receiver/helpers.py
+++ b/music_assistant/providers/airplay_receiver/helpers.py
+@@ -22,15 +22,9 @@ async def check_shairport_sync(shairport_path: str) -> str | None:
+         except OSError:
+             return None
+ 
+-    # First, check if bundled binary exists
+-    base_path = os.path.join(os.path.dirname(__file__), "bin")
+     system = platform.system().lower().replace("darwin", "macos")
+     architecture = platform.machine().lower()
+ 
+-    if shairport_binary := await check_shairport_sync(
+-        os.path.join(base_path, f"shairport-sync-{system}-{architecture}")
+-    ):
+-        return shairport_binary
+ 
+     # If no bundled binary, check system PATH
+     if system_binary := shutil.which("shairport-sync"):
@@ -8,16 +8,16 @@

 buildGoModule (finalAttrs: {
  pname = "nats-top";
-  version = "0.6.3";
+  version = "0.6.4";

  src = fetchFromGitHub {
    owner = "nats-io";
    repo = "nats-top";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-NOU0U1hyP9FCSLK0ulf28cx1K0/KWKQd+t3KtaVqWWo=";
+    hash = "sha256-yewSURZ5uFfDiSRjLmv8QU7XxTVsnZK2RvsPQ/ZEkRw=";
  };

-  vendorHash = "sha256-BQzOlX7Zrtlcd6+O92JoouzC1QCCbgRAeJoYn/runYA=";
+  vendorHash = "sha256-BY2WPwU6my1cqddgZvZl36KXKCpMo5RLT4bhk/b+xCM=";

  ldflags = [
    "-s"
@@ -3,10 +3,11 @@
  stdenv,
  cmake,
  fetchgit,
-  libnl,
+  libnl-tiny,
  libubox,
  uci,
  ubus,
+  ucode,
  json_c,
  pkg-config,
  udebug,
@@ -14,19 +15,20 @@

 stdenv.mkDerivation {
  pname = "netifd";
-  version = "unstable-2023-11-27";
+  version = "0-unstable-2026-02-26";

  src = fetchgit {
    url = "https://git.openwrt.org/project/netifd.git";
-    rev = "02bc2e14d1d37500e888c0c53ac41398a56b5579";
-    hash = "sha256-aMs/Y50+1Yk/j5jGubjBCRcPGw03oIitvEygaxRlr90=";
+    rev = "69a5afc9713adf31edbf3228a7a372ada7bba449";
+    hash = "sha256-R/ryiFiKNM7zrIgzlalAK0lNJF/vzWL56E9CbptJtmI=";
  };

  buildInputs = [
-    libnl.dev
+    libnl-tiny
    libubox
    uci
    ubus
+    ucode
    json_c
    udebug
  ];
@@ -45,11 +47,11 @@ stdenv.mkDerivation {
    sed "s|./ethtool-modes.h|$PWD/ethtool-modes.h|g" -i CMakeLists.txt
  '';

-  env.NIX_CFLAGS_COMPILE = toString (
-    lib.optionals (stdenv.cc.isGNU && lib.versionAtLeast stdenv.cc.version "12") [
-      "-Wno-error=maybe-uninitialized"
-    ]
-  );
+  cmakeFlags = [
+    (lib.cmakeFeature "LIBNL_LIBS" "-lnl-tiny")
+  ];
+
+  env.NIX_CFLAGS_COMPILE = "-I${libnl-tiny}/include/libnl-tiny";

  meta = {
    description = "OpenWrt Network interface configuration daemon";
@@ -57,6 +57,7 @@ python.pkgs.buildPythonApplication rec {
  ];

  pythonRelaxDeps = [
+    "tabulate"
    "urllib3"
  ];

@@ -9,16 +9,16 @@

 buildNpmPackage rec {
  pname = "node-red";
-  version = "4.1.7";
+  version = "4.1.8";

  src = fetchFromGitHub {
    owner = "node-red";
    repo = "node-red";
    tag = version;
-    hash = "sha256-J7LwIXicEMlWtnO1dXjipVOOQQKUB2bc8uJu0Yd/J7s=";
+    hash = "sha256-IjV3hS1v+KgtXbXO2/Nr4GpABK+l2HXfqsPukGD7ViQ=";
  };

-  npmDepsHash = "sha256-OiaUGSpSiQoQlwh28FZcKD1lPjt6VrTLu0KuOfAg2IE=";
+  npmDepsHash = "sha256-eFRA3oJeuxHWrZepWyGztvNdJ3QKG+J6pAxQhdVqxxw=";

  nativeBuildInputs = [ jq ];

@@ -11,13 +11,13 @@
 # https://github.com/oneapi-src/oneDNN#oneapi-deep-neural-network-library-onednn
 stdenv.mkDerivation (finalAttrs: {
  pname = "onednn";
-  version = "3.10.2";
+  version = "3.11.1";

  src = fetchFromGitHub {
    owner = "oneapi-src";
    repo = "oneDNN";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-/e57voLBNun/2koTF3sEb0Z/nDjCwq9NJVk7TaTSvMY=";
+    hash = "sha256-1U932f5RgXT0DVg0rk2GwbdVqtkibctsTYTX7ey9HVY=";
  };

  outputs = [
@@ -8,16 +8,16 @@
 }:
 buildGoModule (finalAttrs: {
  pname = "ostui";
-  version = "1.0.4";
+  version = "1.0.5";

  src = fetchFromSourcehut {
    owner = "~ser";
    repo = "ostui";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-efX19jkJnXyO4iuY2EZqhtLJZ7R/Q2JQZf72gyLgY8k=";
+    hash = "sha256-85vCyKcQIGjO6raYgKUt4D3N9UjbBJmEKkWxUB4Av48=";
  };

-  vendorHash = "sha256-Vmjd0bbeR9+PZCjh1cczE5MWeH5PDVE6obJLmV0wCLQ=";
+  vendorHash = "sha256-3FP+qZChS9A8R6il282pkyFweeOolrAu0L0WFcnrdKI=";

  nativeBuildInputs = [
    pkg-config
@@ -0,0 +1 @@
+{ ouch }: ouch.override { enableUnfree = true; }
@@ -5,14 +5,14 @@
 }:
 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "owocr";
-  version = "1.26.5";
+  version = "1.26.7";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "AuroraWright";
    repo = "owocr";
    tag = finalAttrs.version;
-    hash = "sha256-ZISL0K16Ilmne8SZ5+L7FSxjZJd8j7tDklUOjPvw7HM=";
+    hash = "sha256-OdGYxyJiIfkDxz6RyR9IrdO8ILCNHqb8CjSaUylauZA=";
  };

  # we use pystray directly to avoid making a new package
@@ -12,16 +12,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "oxlint";
-  version = "1.56.0";
+  version = "1.57.0";

  src = fetchFromGitHub {
    owner = "oxc-project";
    repo = "oxc";
    tag = "oxlint_v${finalAttrs.version}";
-    hash = "sha256-AgOfOuZRzT/sq1LpdiH8p6ib5+dDTs6FnQIiehC2Iic=";
+    hash = "sha256-IMGrnOZlNmVDBlyWnXflm3G7A4w3uBWc9thOjTELmVs=";
  };

-  cargoHash = "sha256-n8i3zF0WnLAenFU3NbUla3pVYxxr5r2IPwRTGCxSCAI=";
+  cargoHash = "sha256-ptLprKpkyAx+5/13MsH6lpnF9gznhsWQbcdoCOiPSXQ=";

  nativeBuildInputs = [
    cmake
@@ -1,200 +0,0 @@
-diff --git a/Cargo.lock b/Cargo.lock
-index e799bfd1..efd6601a 100644
--- a/Cargo.lock
-+++ b/Cargo.lock
-@@ -86,6 +86,21 @@ dependencies = [
-  "zbus",
- ]
- 
-+[[package]]
-+name = "astral-tokio-tar"
-+version = "0.5.6"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "ec179a06c1769b1e42e1e2cbe74c7dcdb3d6383c838454d063eaac5bbb7ebbe5"
-+dependencies = [
-+ "filetime",
-+ "futures-core",
-+ "libc",
-+ "portable-atomic",
-+ "rustc-hash",
-+ "tokio",
-+ "tokio-stream",
-+]
-+
- [[package]]
- name = "async-broadcast"
- version = "0.7.2"
-@@ -147,12 +162,6 @@ version = "0.13.1"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- checksum = "9e1b586273c5702936fe7b7d6896644d8be71e6314cfe09d3167c95f712589e8"
- 
-[[package]]
-name = "bitflags"
-version = "1.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
-
- [[package]]
- name = "bitflags"
- version = "2.9.0"
-@@ -213,7 +222,7 @@ version = "0.20.7"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- checksum = "ae50b5510d86cf96ac2370e66d8dc960882f3df179d6a5a1e52bd94a1416c0f7"
- dependencies = [
- "bitflags 2.9.0",
-+ "bitflags",
-  "cairo-sys-rs",
-  "glib",
-  "libc",
-@@ -833,7 +842,7 @@ version = "0.20.9"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- checksum = "707b819af8059ee5395a2de9f2317d87a53dbad8846a2f089f0bb44703f37686"
- dependencies = [
- "bitflags 2.9.0",
-+ "bitflags",
-  "futures-channel",
-  "futures-core",
-  "futures-executor",
-@@ -1368,9 +1377,9 @@ version = "0.1.3"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- checksum = "c0ff37bd590ca25063e35af745c343cb7a0271906fb7b37e4813e8f79f00268d"
- dependencies = [
- "bitflags 2.9.0",
-+ "bitflags",
-  "libc",
- "redox_syscall 0.5.10",
-+ "redox_syscall",
- ]
- 
- [[package]]
-@@ -1488,7 +1497,7 @@ version = "0.29.0"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- checksum = "71e2746dc3a24dd78b3cfcb7be93368c6de9963d30f43a6a73998a9cf4b17b46"
- dependencies = [
- "bitflags 2.9.0",
-+ "bitflags",
-  "cfg-if",
-  "cfg_aliases",
-  "libc",
-@@ -1842,6 +1851,7 @@ version = "2.2.0"
- dependencies = [
-  "anyhow",
-  "ashpd",
-+ "astral-tokio-tar",
-  "futures",
-  "gettext-rs",
-  "gtk4",
-@@ -1860,11 +1870,16 @@ dependencies = [
-  "syslog",
-  "tokio",
-  "tokio-stream",
- "tokio-tar",
-  "vte",
-  "vte4",
- ]
- 
-+[[package]]
-+name = "portable-atomic"
-+version = "1.11.1"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "f84267b20a16ea918e43c6a88433c2d54fa145c92a811b5b047ccbe153674483"
-+
- [[package]]
- name = "powerfmt"
- version = "0.2.0"
-@@ -1973,22 +1988,13 @@ dependencies = [
-  "getrandom 0.3.2",
- ]
- 
-[[package]]
-name = "redox_syscall"
-version = "0.3.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "567664f262709473930a4bf9e51bf2ebf3348f2e748ccc50dea20646858f8f29"
-dependencies = [
- "bitflags 1.3.2",
-]
-
- [[package]]
- name = "redox_syscall"
- version = "0.5.10"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- checksum = "0b8c0c260b63a8219631167be35e6a988e9554dbd323f8bd08439c8ed1302bd1"
- dependencies = [
- "bitflags 2.9.0",
-+ "bitflags",
- ]
- 
- [[package]]
-@@ -2026,6 +2032,12 @@ version = "0.1.24"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- checksum = "719b953e2095829ee67db738b3bfa9fa368c94900df327b3f07fe6e794d2fe1f"
- 
-+[[package]]
-+name = "rustc-hash"
-+version = "2.1.1"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "357703d41365b4b27c590e3ed91eabb1b663f07c4c084095e60cbed4362dff0d"
-+
- [[package]]
- name = "rustc_version"
- version = "0.4.1"
-@@ -2041,7 +2053,7 @@ version = "1.0.3"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- checksum = "e56a18552996ac8d29ecc3b190b4fdbb2d91ca4ec396de7bbffaf43f3d637e96"
- dependencies = [
- "bitflags 2.9.0",
-+ "bitflags",
-  "errno",
-  "libc",
-  "linux-raw-sys",
-@@ -2434,20 +2446,6 @@ dependencies = [
-  "tokio",
- ]
- 
-[[package]]
-name = "tokio-tar"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9d5714c010ca3e5c27114c1cdeb9d14641ace49874aa5626d7149e47aedace75"
-dependencies = [
- "filetime",
- "futures-core",
- "libc",
- "redox_syscall 0.3.5",
- "tokio",
- "tokio-stream",
-]
-
- [[package]]
- name = "toml"
- version = "0.8.20"
-@@ -2862,7 +2860,7 @@ version = "0.39.0"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- checksum = "6f42320e61fe2cfd34354ecb597f86f413484a798ba44a8ca1165c58d42da6c1"
- dependencies = [
- "bitflags 2.9.0",
-+ "bitflags",
- ]
- 
- [[package]]
-diff --git a/Cargo.toml b/Cargo.toml
-index 9a0b95d7..7d818fbf 100644
--- a/Cargo.toml
-+++ b/Cargo.toml
-@@ -8,6 +8,7 @@ edition = "2024"
- adw = { version = "0.7", package = "libadwaita", features = ["v1_7"] }
- anyhow = "1"
- ashpd = { version = "0.11", default-features = false, features = ["gtk4", "tokio"] }
-+astral-tokio-tar = { version = "0.5.6", default-features = false }
- futures = { version = "0.3", default-features = false }
- gettext-rs = { version = "=0.7.0", features = ["gettext-system"] }
- gtk = { version = "0.9", package = "gtk4", features = ["gnome_47"] }
-@@ -25,7 +26,6 @@ sourceview5 = { version = "0.9" }
- syslog = "7"
- tokio = "1"
- tokio-stream = { version = "0.1", default-features = false }
-tokio-tar = { version = "0.3", default-features = false }
- vte = { version = "0.15", default-features = false }
- vte4 = "0.8"
- 
@@ -2,8 +2,7 @@
  lib,
  stdenv,
  fetchFromGitHub,
-  applyPatches,
-  fetchpatch2,
+  blueprint-compiler,
  cargo,
  desktop-file-utils,
  glib,
@@ -24,29 +23,22 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "pods";
-  version = "2.2.0";
+  version = "2.3.0";

-  src = applyPatches {
-    name = "pods-patched";
-    src = fetchFromGitHub {
-      owner = "marhkb";
-      repo = "pods";
-      tag = "v${finalAttrs.version}";
-      hash = "sha256-m+0XjxY0nDAJbVX3r/Jfg+G+RU8Q51e0ZXxkdH69SiQ=";
-    };
-
-    # Based on upstream PR: https://github.com/marhkb/pods/pull/895
-    # which cannot be merged into 2.2.0 because dependencies were bumped since its release.
-    # Hopefully 2.2.1 will be released soon
-    patches = [ ./cve-2025-62516.patch ];
+  src = fetchFromGitHub {
+    owner = "marhkb";
+    repo = "pods";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-JWOxp3J+7k0ikdFJ8SDFcspuM5SO5rQm5/21G4FAAag=";
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
    inherit (finalAttrs) pname version src;
-    hash = "sha256-GBWaGCNXYCiT/favrIYB30VGMMoQQk1iUh4GTNPerK8=";
+    hash = "sha256-UkXBlqFmODlJEm2NBHdKoO5Yc086NAHjo9HOuWb3Jq0=";
  };

  nativeBuildInputs = [
+    blueprint-compiler
    desktop-file-utils
    glib
    gtk4
@@ -70,9 +62,7 @@ stdenv.mkDerivation (finalAttrs: {
  doInstallCheck = true;
  nativeInstallCheckInputs = [ versionCheckHook ];

-  passthru = {
-    updateScript = nix-update-script { };
-  };
+  passthru.updateScript = nix-update-script { };

  meta = {
    description = "Podman desktop application";
@@ -8,16 +8,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "rabbitmqadmin-ng";
-  version = "2.26.0";
+  version = "2.29.0";

  src = fetchFromGitHub {
    owner = "rabbitmq";
    repo = "rabbitmqadmin-ng";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-tc4ihqSZ+lIGg4PXzsLp51fMgYi2frsv6rxkOgp8J9k=";
+    hash = "sha256-On4eUeFM4/GDfbGJ7249LTAu3srAbxU6vizsGP3sXj4=";
  };

-  cargoHash = "sha256-V1ANIUTLYOfFEzIzEMFHiQD5hKFhv6maK5+bRS9TXTg=";
+  cargoHash = "sha256-Xr6j5lCdl0CXj3nWBMawHAWoizrMR7KABC3nIFc9kgk=";

  buildInputs = [ openssl ];
  nativeBuildInputs = [ pkg-config ];
@@ -34,6 +34,8 @@ stdenv.mkDerivation {
    substituteInPlace rarcrack.c --replace "file -i" "${file}/bin/file -i"
  '';

+  env.NIX_CFLAGS_COMPILE = "-Wno-error=incompatible-pointer-types";
+
  preInstall = ''
    mkdir -p $out/bin
  '';
@@ -13,7 +13,7 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "rust-analyzer-unwrapped";
-  version = "2026-03-16";
+  version = "2026-03-23";

  cargoHash = "sha256-osoNyx4UEbq0J2fx7WMJBfIRV3mhsO+OSBNrvu060IM=";

@@ -21,7 +21,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    owner = "rust-lang";
    repo = "rust-analyzer";
    rev = finalAttrs.version;
-    hash = "sha256-CKmkYqUi2pI1uDGDfpK0mkZbRLyjUKCpYDU3eMHtmks=";
+    hash = "sha256-aEIdkqB8gtQZtEbogdUb5iyfcZpKIlD3FkG8ANu73/I=";
  };

  cargoBuildFlags = [
@@ -27,6 +27,7 @@
  soxr,
  alac,
  sndio,
+  enableAvahi ? true,
  enableAirplay2 ? false,
  enableStdout ? true,
  enableAlsa ? true,
@@ -45,6 +46,7 @@
  enableAlac ? true,
  enableConvolution ? true,
  enableLibdaemon ? false,
+  enableTinySVCmDNS ? true,
 }:

 let
@@ -79,10 +81,10 @@ stdenv.mkDerivation (finalAttrs: {

  buildInputs = [
    openssl
-    avahi
    popt
    libconfig
  ]
+  ++ optional enableAvahi avahi
  ++ optional enableLibdaemon libdaemon
  ++ optional enableAlsa alsa-lib
  ++ optional enableSndio sndio
@@ -115,9 +117,8 @@ stdenv.mkDerivation (finalAttrs: {
    "--without-configfiles"
    "--sysconfdir=/etc"
    "--with-ssl=openssl"
-    "--with-stdout"
-    "--with-avahi"
  ]
+  ++ optional enableAvahi "--with-avahi"
  ++ optional enablePulse "--with-pa"
  ++ optional enablePipewire "--with-pw"
  ++ optional enableAlsa "--with-alsa"
@@ -134,6 +135,7 @@ stdenv.mkDerivation (finalAttrs: {
  ++ optional enableMetadata "--with-metadata"
  ++ optional enableMpris "--with-mpris-interface"
  ++ optional enableMqttClient "--with-mqtt-client"
+  ++ optional enableTinySVCmDNS "--with-tinysvcmdns"
  ++ optional enableLibdaemon "--with-libdaemon"
  ++ optional enableAirplay2 "--with-airplay-2";

@@ -10,16 +10,16 @@

 buildGoModule (finalAttrs: {
  pname = "sing-box";
-  version = "1.13.3";
+  version = "1.13.4";

  src = fetchFromGitHub {
    owner = "SagerNet";
    repo = "sing-box";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Kf9aVnCvN6wSegBzFyix+sUtvl/b+zUrbXDf7baxfNo=";
+    hash = "sha256-4u1GgIBXkFrorcZ9Z+83peaIlZHmUp6zmsZWC4k9GkY=";
  };

-  vendorHash = "sha256-oQst3UHdQ2aHc/yS2w72mSu8Set+CsgNZgYLnwUcmNo=";
+  vendorHash = "sha256-mfgCwTXwd6T1mzmHR3tTF4aKtfn4ehztVyeXrtEKDsk=";

  tags = [
    "with_gvisor"
@@ -8,13 +8,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "sirit";
-  version = "1.0.4";
+  version = "1.0.5";

  src = fetchFromGitHub {
    owner = "eden-emulator";
    repo = "sirit";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-ThyUaoVmnYz9eQ1a19BbLhqfOpPxRjSovBl2wvlfRoI=";
+    hash = "sha256-eiuAdnPBJAMCRbkwJkqjyaskBCa2/Cm0F3gqFwe3ePg=";
  };

  nativeBuildInputs = [
@@ -53,6 +53,10 @@ stdenv.mkDerivation (finalAttrs: {
  env.NIX_CFLAGS_COMPILE = toString [
    "-Wno-incompatible-pointer-types"
    "-Wno-implicit-function-declaration"
+
+    # Fix build with gcc15 (-std=gnu23)
+    "-std=gnu17"
+
  ];

  meta = {
@@ -6,13 +6,13 @@

 stdenvNoCC.mkDerivation rec {
  pname = "spaceship-prompt";
-  version = "4.22.0";
+  version = "4.22.1";

  src = fetchFromGitHub {
    owner = "denysdovhan";
    repo = "spaceship-prompt";
    rev = "v${version}";
-    sha256 = "sha256-+2Nlao4w3DoAqIMgc68iyUAXdTyPGrW9cfG1brELlyo=";
+    sha256 = "sha256-shZf1IfSkHnaHnQ4idiDrmaJYXtViwGntpfEOBUDyBk=";
  };

  strictDeps = true;
@@ -9,16 +9,16 @@

 buildGoModule (finalAttrs: {
  pname = "supercronic";
-  version = "0.2.43";
+  version = "0.2.44";

  src = fetchFromGitHub {
    owner = "aptible";
    repo = "supercronic";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-X6Q/TiABNVVgsKZOzWhiaKhhHFindWgrX721mfO5b3Q=";
+    hash = "sha256-xtTQ5T+/kVnh4sjIN/N9HN9MeEd2ekAzSkvYdei0dKA=";
  };

-  vendorHash = "sha256-w7BL/OgNbm4mMZ6x4zZhN7kYFmUOEX7ixYzocAFzAcU=";
+  vendorHash = "sha256-azjkMzmAhAKyHx/43cP0kpgo0mKM8Yh+LWHiR7audQw=";

  excludedPackages = [ "cronexpr/cronexpr" ];

@@ -10,13 +10,13 @@

 buildGoModule (finalAttrs: {
  pname = "talm";
-  version = "0.22.3";
+  version = "0.22.4";

  src = fetchFromGitHub {
    owner = "cozystack";
    repo = "talm";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-/veCnApXSX5ubfOb2g8MkLtN5Ejt7hdINwuHX/0JUYA=";
+    hash = "sha256-9CUr49uKvVwjU9rJpt0Y4BNtBUQiJxNcU8YMlNhyd/g=";
  };

  vendorHash = "sha256-jDp1WVETDbCtSq+v0BrIiTqoR2cnmI7JXdy5ydnt5wA=";
@@ -6,16 +6,16 @@

 buildGoModule (finalAttrs: {
  pname = "taproot-assets";
-  version = "0.7.1";
+  version = "0.7.2";

  src = fetchFromGitHub {
    owner = "lightninglabs";
    repo = "taproot-assets";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-F/I/h80+QEUpxF1fS90hgCXMubU4Hdk0ECGosSvdC1E=";
+    hash = "sha256-HFWSO5h/hp/XGCQ9MEqwe++P12XPbxv878xcJhUZTpQ=";
  };

-  vendorHash = "sha256-W6wAa1KAE0gBWkXeZ0VEQFyRle/qT/O3CvVAmm1nQfs=";
+  vendorHash = "sha256-sKyaj/PiNz0VbzWon4g5jIKcYAUdlXwBQwJoWEkMYsM=";

  subPackages = [
    "cmd/tapcli"
@@ -7,13 +7,13 @@
 }:
 buildGoModule (finalAttrs: {
  pname = "terragrunt";
-  version = "0.99.4";
+  version = "0.99.5";

  src = fetchFromGitHub {
    owner = "gruntwork-io";
    repo = "terragrunt";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-PuAV0RtWTdFM96LVL6i+RMrRF+H0HujgHtTCsrvyCoo=";
+    hash = "sha256-VlJRuW8TAlwszp2GzVC/7FY1jhq/7NHi/i5xPnw1nec=";
  };

  nativeBuildInputs = [
@@ -52,14 +52,14 @@
 }:

 stdenv.mkDerivation (finalAttrs: {
-  version = "1.16.0";
+  version = "1.16.1";
  pname = "tigervnc";

  src = fetchFromGitHub {
    owner = "TigerVNC";
    repo = "tigervnc";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-aIQcFX4GQ0VniacjYherpUSgzM55Han9oMvbjMUYgfE=";
+    hash = "sha256-mK9WjnAyEqikykCa6AzB6aB+QTZtxyCBmZV+rNbLxYM=";
  };

  postPatch =
@@ -12,16 +12,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "turn-rs";
-  version = "4.0.0";
+  version = "4.0.1";

  src = fetchFromGitHub {
    owner = "mycrl";
    repo = "turn-rs";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-HYrFnwxj4BRk2PGK52il5Bh5hxvWHJNQ/5Y0u5FSTwY=";
+    hash = "sha256-CtDlkHHOkU0mwNiyP9PNw/40szBNKeGYvVep9Z/aoDg=";
  };

-  cargoHash = "sha256-q1kq2ISzKZfJfKTRkMrVMQqngAqG2INfej9lGoll5c0=";
+  cargoHash = "sha256-x45GDuhxqoB/DZvccdzxBoS/7nnFvHtjkRgfM/LOOE8=";

  # By default, no features are enabled
  # https://github.com/mycrl/turn-rs?tab=readme-ov-file#features-1
@@ -8,13 +8,13 @@
 }:
 buildGoModule (finalAttrs: {
  pname = "turso-cli";
-  version = "1.0.17";
+  version = "1.0.18";

  src = fetchFromGitHub {
    owner = "tursodatabase";
    repo = "turso-cli";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-3u5yc49v0vwNKaI5GcE+rDEoscbQqpnaN11Bax0SEtE=";
+    hash = "sha256-mWX7cJK4TX2JXHYQ4d5WaS/ZwlEkXJaiNM7zx/w+n9c=";
  };

  vendorHash = "sha256-Cb4/KA9jfI/pNHbJqLWtm9oEXfMHGBS46J9o3lL4/Tk=";
@@ -14,14 +14,14 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "ty";
-  version = "0.0.25";
+  version = "0.0.26";

  src = fetchFromGitHub {
    owner = "astral-sh";
    repo = "ty";
    tag = finalAttrs.version;
    fetchSubmodules = true;
-    hash = "sha256-KMv/l4jGOJdL+KlTOrVRGMdAgleW/mXk7CWDd8Vlwig=";
+    hash = "sha256-Q4xYL+MbFnzLFUbfqY5yrepBD7tIujwr9tTPp0H2J/U=";
  };

  # For Darwin platforms, remove the integration test for file notifications,
@@ -6,12 +6,12 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "unrar";
-  version = "7.2.4";
+  version = "7.2.5";

  src = fetchzip {
    url = "https://www.rarlab.com/rar/unrarsrc-${finalAttrs.version}.tar.gz";
    stripRoot = false;
-    hash = "sha256-Rzab8jvER5fJpNXHCSi5FCYR9LfMX2Y/kP5JshYqTU0=";
+    hash = "sha256-UVoxvF3U4TKZ0kQ9+fEMAoZJwAa+e/XDS7JqXoo3GeA=";
  };

  sourceRoot = finalAttrs.src.name;
@@ -10,13 +10,13 @@ with python3Packages;

 buildPythonApplication (finalAttrs: {
  pname = "vit";
-  version = "2.3.3";
+  version = "2.3.4";
  pyproject = true;
  disabled = lib.versionOlder python.version "3.7";

  src = fetchPypi {
    inherit (finalAttrs) pname version;
-    hash = "sha256-+lrXGfhoB4z5IWkJTXMIm3GGVPfNGO9lUB3uFTx8hDY=";
+    hash = "sha256-NGohCqDedUz3ra9zcjv30syO51Tut4XrGDcNM/dOXOI=";
  };

  build-system = with python3Packages; [ setuptools ];
@@ -3,7 +3,9 @@
  rustPlatform,
  fetchFromGitHub,
  versionCheckHook,
+  _experimental-update-script-combinators,
  nix-update-script,
+  vscode-extension-update-script,
 }:

 rustPlatform.buildRustPackage (finalAttrs: {
@@ -23,7 +25,16 @@ rustPlatform.buildRustPackage (finalAttrs: {
  versionCheckProgram = "${placeholder "out"}/bin/wat_server";
  doInstallCheck = true;

-  passthru.updateScript = nix-update-script { };
+  passthru.updateScript = _experimental-update-script-combinators.sequence [
+    (nix-update-script { })
+    (vscode-extension-update-script {
+      attrPath = "vscode-extensions.gplane.wasm-language-tools";
+      extraArgs = [
+        "--override-filename"
+        "pkgs/applications/editors/vscode/extensions/gplane.wasm-language-tools/default.nix"
+      ];
+    })
+  ];

  meta = {
    description = "Language server and other tools for WebAssembly";
@@ -7,17 +7,17 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "zed-discord-presence";
-  version = "0.11.0";
+  version = "0.11.1";

  src = fetchFromGitHub {
    owner = "xhyrom";
    repo = "zed-discord-presence";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-HmSJipRWVB1rXyO5ZK1ksyCLDzSJD820Klo88A7NLx4=";
+    hash = "sha256-Y7Tns5UwYzDKKgo1AvLDTFxdpJrnXg5QBWhGsyecAXU=";
  };

  cargoBuildFlags = [ "--package discord-presence-lsp" ];
-  cargoHash = "sha256-x9sB90jW7v2SGggLILgLbBfFV7DkJazcrUiKAfIroMA=";
+  cargoHash = "sha256-z7SXterBkLT88LxgmcGFkUEWGBf2rSCgvd2NjMJuSOM=";

  passthru.updateScript = nix-update-script { };

@@ -8,16 +8,16 @@

 buildGoModule {
  pname = "zoekt";
-  version = "0-unstable-2026-01-14";
+  version = "0-unstable-2026-03-25";

  src = fetchFromGitHub {
    owner = "sourcegraph";
    repo = "zoekt";
-    rev = "c747a3bccc2a4a427204ac08eea62a522df6d2ec";
-    hash = "sha256-fIvDxOTPbtRqBX39Lfezy/q235/nPhog/UIEncdV9UQ=";
+    rev = "a0f5789d25cb80a36bfb0b85cde2f004880bcbeb";
+    hash = "sha256-y1BskdsrPrIRDFj9n7H6Dl17tS+4epwvShMe/i1I7KA=";
  };

-  vendorHash = "sha256-1QM6OVFXS88IryKuNJKcbgYZcRZ+E6Na5NqItAlicXw=";
+  vendorHash = "sha256-WaO8/33pPmGh6tO/poD5epBknZjyzydG9dRuD67dYEw=";

  nativeCheckInputs = [
    gitMinimal
@@ -69,7 +69,7 @@ buildRedist (
    ];

    # NOTE(@connorbaker): nsight-exporter and nsight-sys are deprecated scripts wrapping nsys, it's fine to remove them.
-    prePatch = ''
+    prePatch = lib.optionalString (lib.versionOlder finalAttrs.version "2025.5.2.26") ''
      if [[ -d bin ]]; then
        nixLog "Removing bin wrapper scripts"
        for knownWrapper in bin/{nsys{,-ui},nsight-{exporter,sys}}; do
@@ -442,10 +442,10 @@ builtins.intersectAttrs super {
      src = pkgs.fetchFromGitHub {
        repo = "nix-serve-ng";
        owner = "aristanetworks";
-        rev = "1d21f73a2d563ffbb924a4244c29b35e898caefe";
-        hash = "sha256-N6c3NozYqAGwmjf+k5GHOZzlcquDntrJwsZQ7O2sqtQ=";
+        rev = "f63998a6c81fab86e840dbab483d387dee5ffc0a";
+        hash = "sha256-paUnCU08wDZ3bS0Fa4QhtjWMcpWgcTRwO/ee3wT28Nw=";
      };
-      version = "1.0.1-unstable-2025-05-28";
+      version = "1.1.0-unstable-2026-03-26";
    })

    (overrideCabal (old: {
@@ -81,6 +81,7 @@ let
    "nativeBuildInputs"
    "nativeOctavePkgTestInputs"
    "passthru"
+    "env"
  ];
 in
 stdenv.mkDerivation (
@@ -96,7 +97,9 @@ stdenv.mkDerivation (
    # packages are installed into octave during the environment building phase.
    isOctavePackage = true;

-    OCTAVE_HISTFILE = "/dev/null";
+    env = attrs.env or { } // {
+      OCTAVE_HISTFILE = "/dev/null";
+    };

    inherit src;

@@ -179,7 +179,7 @@ stdenv.mkDerivation (finalAttrs: {
      installedTests = nixosTests.installed-tests.xdg-desktop-portal;

      validate-icon = runCommand "test-icon-validation" { } ''
-        ${finalAttrs.finalPackage}/libexec/xdg-desktop-portal-validate-icon --ruleset=desktop --sandbox --path=${../../../applications/audio/zynaddsubfx/ZynLogo.svg} > "$out"
+        ${finalAttrs.finalPackage}/libexec/xdg-desktop-portal-validate-icon --ruleset=desktop --sandbox --path=${../../../by-name/zy/zynaddsubfx/ZynLogo.svg} > "$out"
        grep format=svg "$out"
      '';
    };
@@ -32,7 +32,7 @@

 buildPythonPackage (finalAttrs: {
  pname = "ansible-core";
-  version = "2.20.3";
+  version = "2.20.4";
  pyproject = true;

  disabled = pythonOlder "3.12";
@@ -41,7 +41,7 @@ buildPythonPackage (finalAttrs: {
    owner = "ansible";
    repo = "ansible";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-WLfLbQYYJOdMHApNnFZYiET4es3z2SeeLP0jbrFqxrU=";
+    hash = "sha256-7KsxZH1d5FfdnsYfKSNGCmdYuBi8KzZxyZbG2WNAM9Y=";
  };

  # ansible_connection is already wrapped, so don't pass it through
@@ -15,19 +15,19 @@

 buildPythonPackage rec {
  pname = "blinkpy";
-  version = "0.25.3";
+  version = "0.25.5";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "fronzbot";
    repo = "blinkpy";
    tag = "v${version}";
-    hash = "sha256-1MROZbA6NDZ5mKmvcjyrYAx+tEP6Cyj2k1754v2W1Mw=";
+    hash = "sha256-wtuegaYB7/lh9d5kKgSEwCztLpaKcwHi9+ryMvGXVg8=";
  };

  postPatch = ''
    substituteInPlace pyproject.toml \
-      --replace-fail "wheel~=0.40.0" wheel \
+      --replace-fail "wheel>=0.40,<0.47" wheel \
      --replace-fail "setuptools>=68,<81" setuptools
  '';

@@ -16,14 +16,14 @@
  textparser,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "cantools";
-  version = "41.2.1";
+  version = "41.3.0";
  pyproject = true;

  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-HxdoK91A9oALjuiW0aGFM/5mRdbeb8j8T3J2n/uuLR4=";
+    inherit (finalAttrs) pname version;
+    hash = "sha256-VRuYBZLGbmsSX4xF8Styb6hzUrKTG5AmsHY2o3dQSp4=";
  };

  build-system = [
@@ -47,16 +47,16 @@ buildPythonPackage rec {
    pytest-freezegun
    pytestCheckHook
  ]
-  ++ optional-dependencies.plot;
+  ++ finalAttrs.passthru.optional-dependencies.plot;

  pythonImportsCheck = [ "cantools" ];

  meta = {
    description = "Tools to work with CAN bus";
    homepage = "https://github.com/cantools/cantools";
-    changelog = "https://github.com/cantools/cantools/releases/tag/${version}";
+    changelog = "https://github.com/cantools/cantools/releases/tag/${finalAttrs.version}";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ gray-heron ];
    mainProgram = "cantools";
  };
-}
+})
@@ -0,0 +1,57 @@
+{
+  buildPythonPackage,
+  django,
+  fetchFromGitHub,
+  lib,
+  pytest-django,
+  pytestCheckHook,
+  setuptools-scm,
+  icalendar,
+  django-recurrence,
+}:
+buildPythonPackage (finalAttrs: {
+  pname = "django-ical";
+  version = "1.9.2";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "jazzband";
+    repo = "django-ical";
+    tag = finalAttrs.version;
+    hash = "sha256-DUe0loayGcUS7MTyLn+g0KBxbIY7VsaoQNHGSMbMI3U=";
+  };
+
+  build-system = [ setuptools-scm ];
+
+  dependencies = [
+    django
+    django-recurrence
+    icalendar
+  ];
+
+  preCheck = ''
+    export DJANGO_SETTINGS_MODULE=test_settings
+  '';
+
+  disabledTestPaths = [
+    # AssertionError: 'Japan' != 'JST': there seems to be wrong raw data feed
+    "django_ical/tests/test_feed.py::ICal20FeedTest::test_timezone"
+  ];
+
+  pythonImportsCheck = [
+    "django_ical"
+  ];
+
+  nativeCheckInputs = [
+    pytest-django
+    pytestCheckHook
+  ];
+
+  meta = {
+    description = "iCal feeds for Django based on Django's syndication feed framework";
+    homepage = "https://github.com/jazzband/django-ical";
+    changelog = "https://github.com/jazzband/django-ical/blob/${finalAttrs.src.tag}/CHANGELOG.rst";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ kurogeek ];
+  };
+})
@@ -14,14 +14,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "elevenlabs";
-  version = "2.39.1";
+  version = "2.40.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "elevenlabs";
    repo = "elevenlabs-python";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Lx5bRl7Atwme+PHkyF0+CgQi0KB3qDCpoLG7JzFM3oE=";
+    hash = "sha256-1t+CJ+gHnF8wpq6/NpbuophKczXE/usKwwYCrgAZqsY=";
  };

  build-system = [ poetry-core ];
@@ -12,19 +12,19 @@

 buildPythonPackage rec {
  pname = "fastbencode";
-  version = "0.3.9";
+  version = "0.3.10";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "breezy-team";
    repo = "fastbencode";
    tag = "v${version}";
-    hash = "sha256-TZGIFcWm037h4Xs6e5a9j24FqhNxP9H71QVtL1homjQ=";
+    hash = "sha256-e+Ei+UIJ5sve6k3ApPJ2nswTgZLkzxZmpthK/f/rfCs=";
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
    inherit pname version src;
-    hash = "sha256-4DP8WOho4CKESfQHynZlosafcGPFqjpaOiZfLkcML3A=";
+    hash = "sha256-dqD/QF6/XCB9H/QkEobfIOo9S663fh9AHUuHqCoEcLM=";
  };

  nativeBuildInputs = [
@@ -13,19 +13,19 @@
  setuptools,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "google-cloud-netapp";
-  version = "3.31.3";
+  version = "0.8.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "googleapis";
    repo = "google-cloud-python";
-    tag = "google-cloud-build-v${version}";
-    hash = "sha256-qQ+8X6I8lt4OTgbvODsbdab2dYUk0wxWsbaVT2T651U=";
+    tag = "google-cloud-netapp-v${finalAttrs.version}";
+    hash = "sha256-uUBId7RxVfOPtemZYUqJXd4hw2/CU2cogZL39MrKehk=";
  };

-  sourceRoot = "${src.name}/packages/google-cloud-netapp";
+  sourceRoot = "${finalAttrs.src.name}/packages/google-cloud-netapp";

  build-system = [ setuptools ];

@@ -52,15 +52,19 @@ buildPythonPackage rec {
    "google.cloud.netapp_v1"
  ];

-  passthru.updateScript = gitUpdater {
-    rev-prefix = "google-cloud-netapp-v";
+  passthru = {
+    # builkupdater selects wrong tag
+    skipBulkUpdate = true;
+    updateScript = gitUpdater {
+      rev-prefix = "google-cloud-netapp-v";
+    };
  };

  meta = {
    description = "Python Client for NetApp API";
    homepage = "https://github.com/googleapis/google-cloud-python/tree/main/packages/google-cloud-netapp";
-    changelog = "https://github.com/googleapis/google-cloud-python/blob/google-cloud-netapp-${src.tag}/packages/google-cloud-netapp/CHANGELOG.md";
+    changelog = "https://github.com/googleapis/google-cloud-python/blob/${finalAttrs.src.tag}/packages/google-cloud-netapp/CHANGELOG.md";
    license = lib.licenses.asl20;
    maintainers = [ lib.maintainers.sarahec ];
  };
-}
+})
@@ -9,16 +9,16 @@
  pytestCheckHook,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "huum";
-  version = "0.8.1";
+  version = "0.8.2";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "frwickst";
    repo = "pyhuum";
-    tag = version;
-    hash = "sha256-8wldXJAdo1PK4bKX0rKJjNwwTS5FSgr9RcwiyVhESb8=";
+    tag = finalAttrs.version;
+    hash = "sha256-PM1At/AqKZ0QIJWlQeeTYqnQqK1wOnd4eRLyd7MvFLk=";
  };

  build-system = [ poetry-core ];
@@ -39,8 +39,8 @@ buildPythonPackage rec {
  meta = {
    description = "Library for Huum saunas";
    homepage = "https://github.com/frwickst/pyhuum";
-    changelog = "https://github.com/frwickst/pyhuum/releases/tag/${src.tag}";
+    changelog = "https://github.com/frwickst/pyhuum/releases/tag/${finalAttrs.src.tag}";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ fab ];
  };
-}
+})
@@ -8,14 +8,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "iamdata";
-  version = "0.1.202603251";
+  version = "0.1.202603261";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "cloud-copilot";
    repo = "iam-data-python";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-co6eQx2gI5UBH8cx4xgH//Qtf3m0HmCkPYdNpk2h/qE=";
+    hash = "sha256-ghj/GfymySYV7kiBFEkNk9G7lF/lfsWWCMMAnumNelI=";
  };

  __darwinAllowLocalNetworking = true;
@@ -9,16 +9,16 @@
  unittestCheckHook,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "karton-core";
-  version = "5.9.0";
+  version = "5.9.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "CERT-Polska";
    repo = "karton";
-    tag = "v${version}";
-    hash = "sha256-m7A7Fbl6VZtgR4+FhmV2T+K6kgHRNtdeyin1uhvw04U=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-b/wOkOk6LB8uTDsXJrNQ2iru2H6mgaMhIyWSU5y2mx0=";
  };

  build-system = [ setuptools ];
@@ -41,11 +41,11 @@ buildPythonPackage rec {
  meta = {
    description = "Distributed malware processing framework";
    homepage = "https://karton-core.readthedocs.io/";
-    changelog = "https://github.com/CERT-Polska/karton/releases/tag/${src.tag}";
+    changelog = "https://github.com/CERT-Polska/karton/releases/tag/${finalAttrs.src.tag}";
    license = lib.licenses.bsd3;
    maintainers = with lib.maintainers; [
      chivay
      fab
    ];
  };
-}
+})
@@ -0,0 +1,78 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+
+  # build-system
+  setuptools,
+  setuptools-scm,
+
+  # dependencies
+  aiohttp,
+  attrs,
+  jsonpatch,
+  yarl,
+  typing-extensions,
+
+  # tests
+  pytestCheckHook,
+  pytest-asyncio,
+  looptime,
+  aresponses,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "kmock";
+  version = "0.6";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "nolar";
+    repo = "kmock";
+    tag = finalAttrs.version;
+    hash = "sha256-qpRuSWwaPEgfE+wN1ADSyn2AbXPDzZfZ7dOf8Vw0zJA=";
+  };
+
+  build-system = [
+    setuptools
+    setuptools-scm
+  ];
+
+  dependencies = [
+    aiohttp
+    attrs
+    jsonpatch
+    yarl
+    typing-extensions
+  ];
+
+  pythonImportsCheck = [ "kmock" ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    pytest-asyncio
+    aresponses
+    looptime
+  ];
+
+  disabledTests = [
+    # Could not contact DNS servers
+    "test_bare_host_resolution"
+    # Cannot connect to host clients3.google.com
+    "test_hostname_interception"
+    # Timeout
+    "test_arbitrary_stream"
+    "test_kubernetes_watch_stream"
+    # assert 0 == 1
+    "test_sync_condition_notifying"
+  ];
+
+  __darwinAllowLocalNetworking = true;
+
+  meta = {
+    description = "HTTP/API/Kubernetes Mock Server in Python";
+    changelog = "https://github.com/nolar/kmock/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ sigmanificient ];
+  };
+})
@@ -10,9 +10,10 @@
  aiohttp,
  iso8601,
  python-json-logger,
-  clickclick,
-  typing-extensions,
+  click,

+  jsonpatch,
+  kmock,
  pytest-mock,
  pytest-timeout,
  pytest-asyncio,
@@ -20,18 +21,19 @@
  freezegun,
  certvalidator,
  aresponses,
+  looptime,
 }:

 buildPythonPackage rec {
  pname = "kopf";
-  version = "1.40.0";
+  version = "1.44.4";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "nolar";
    repo = "kopf";
    tag = version;
-    hash = "sha256-AXaEV3+p5NytKhuUkoaWBG4oNhPKQwoCRTmUkmb26RQ=";
+    hash = "sha256-AwIaWAwBBmQqxNQqFS8qNDlA+pjw5mQG3XKwamS3oQo=";
  };

  build-system = [
@@ -44,8 +46,8 @@ buildPythonPackage rec {
    python-json-logger
    aiohttp
    iso8601
-    clickclick
-    typing-extensions
+    jsonpatch
+    click
  ];

  nativeCheckInputs = [
@@ -54,9 +56,11 @@ buildPythonPackage rec {
    pytest-timeout
    pytest-asyncio
    pytest-mock
+    kmock
    freezegun
    certvalidator
    aresponses
+    looptime
  ];

  disabledTestPaths = [
@@ -64,12 +68,20 @@ buildPythonPackage rec {
    "tests/admission/test_certificates.py"
    "tests/e2e/test_examples.py"

-    #Module certbuilder unavailable in nixpkgs
+    # Module certbuilder unavailable in nixpkgs
    "tests/admission/test_webhook_detection.py"
    "tests/admission/test_webhook_ngrok.py"
    "tests/admission/test_webhook_server.py"
+    "tests/authentication/test_credentials.py"
  ];

+  disabledTests = [
+    # assert [] to due missing certificate
+    "test_connection_info_as_ssl_context_when_insecure"
+  ];
+
+  pytestFlags = [ "-Wignore::pytest.PytestUnraisableExceptionWarning" ];
+
  __darwinAllowLocalNetworking = true;

  pythonImportsCheck = [
@@ -31,14 +31,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "langsmith";
-  version = "0.7.18";
+  version = "0.7.22";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "langchain-ai";
    repo = "langsmith-sdk";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-praKCpNzZ8e+QEU9Ji9ryspzIiF9X98rUOvMbwjMZho=";
+    hash = "sha256-raotchNZFcQPUvQckq4Z6ntvh4tviCjTLv2s5Ueulqw=";
  };

  sourceRoot = "${finalAttrs.src.name}/python";
@@ -2,20 +2,27 @@
  lib,
  buildPythonPackage,
  fetchFromGitHub,
+
+  # build-system
  cython,
+  meson-python,
+  numpy,
+  setuptools-scm,
+
+  # dependencies
  formulaic,
  mypy-extensions,
-  numpy,
  pandas,
  pyhdfe,
-  pytestCheckHook,
  scipy,
-  setuptools,
-  setuptools-scm,
  statsmodels,
+
+  # tests
+  pytestCheckHook,
+  xarray,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "linearmodels";
  version = "7.0";
  pyproject = true;
@@ -23,24 +30,23 @@ buildPythonPackage rec {
  src = fetchFromGitHub {
    owner = "bashtage";
    repo = "linearmodels";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
    hash = "sha256-/unFszNGaEPsoXDtaS3tsLnsX4A6e7Y88O8pDrf4nKc=";
  };

  postPatch = ''
-    substituteInPlace requirements.txt \
-      --replace-fail "setuptools_scm[toml]>=8.0.0,<9.0.0" "setuptools_scm[toml]"
    substituteInPlace pyproject.toml \
-      --replace-fail "setuptools_scm[toml]>=8,<9" "setuptools_scm[toml]"
+      --replace-fail "setuptools_scm>=9.2.0,<10" "setuptools_scm"
  '';

  build-system = [
-    setuptools
-    setuptools-scm
    cython
+    meson-python
+    numpy
+    setuptools-scm
  ];

-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
+  env.SETUPTOOLS_SCM_PRETEND_VERSION = finalAttrs.version;

  dependencies = [
    formulaic
@@ -52,10 +58,17 @@ buildPythonPackage rec {
    statsmodels
  ];

-  nativeCheckInputs = [ pytestCheckHook ];
-
  pythonImportsCheck = [ "linearmodels" ];

+  nativeCheckInputs = [
+    pytestCheckHook
+    xarray
+  ];
+
+  preCheck = ''
+    rm linearmodels/__init__.py
+  '';
+
  disabledTestPaths = [
    # Skip long-running tests
    "linearmodels/tests/panel/test_panel_ols.py"
@@ -64,8 +77,8 @@ buildPythonPackage rec {
  meta = {
    description = "Models for panel data, system regression, instrumental variables and asset pricing";
    homepage = "https://bashtage.github.io/linearmodels/";
-    changelog = "https://github.com/bashtage/linearmodels/releases/tag/${src.tag}";
+    changelog = "https://github.com/bashtage/linearmodels/releases/tag/${finalAttrs.src.tag}";
    license = lib.licenses.ncsa;
    maintainers = with lib.maintainers; [ jherland ];
  };
-}
+})
--- a/Show More
+++ b/Show More
				`@@ -0,0 +1 @@`
				`{ ouch }: ouch.override { enableUnfree = true; }`