Merge staging-next into staging

2025-02-01 00:15:45 +00:00
parent 62c60f167e c27f09976f
commit 63ab5cd1c5
148 changed files with 2352 additions and 1182 deletions
@@ -3577,6 +3577,17 @@
    githubId = 382011;
    name = "c4605";
  };
+  c4thebomb = {
+    name = "Ceferino Patino";
+    email = "c4patino@gmail.com";
+    github = "c4thebomb";
+    githubId = 79673111;
+    keys = [
+      {
+        fingerprint = "EA60 D516 A926 7532 369D  3E67 E161 DF22 9EC1 280E";
+      }
+    ];
+  };
  caarlos0 = {
    name = "Carlos A Becker";
    email = "carlos@becker.software";
@@ -11620,6 +11631,11 @@
    githubId = 1792886;
    name = "Julien Malka";
  };
+  juliusfreudenberger = {
+    name = "Julius Freudenberger";
+    github = "JuliusFreudenberger";
+    githubId = 13383409;
+  };
  juliusrickert = {
    email = "nixpkgs@juliusrickert.de";
    github = "juliusrickert";
@@ -470,7 +470,6 @@ with lib.maintainers;
  gnome-circle = {
    members = [
      aleksana
-      dawidd6
      getchoo
      michaelgrahamevans
    ];
@@ -65,6 +65,8 @@

 - [Kimai](https://www.kimai.org/), a web-based multi-user time-tracking application. Available as [services.kimai](options.html#opt-services.kimai).

+- [Homer](https://homer-demo.netlify.app/), a very simple static homepage for your server. Available as [services.homer](options.html#opt-services.homer).
+
 - [Omnom](https://github.com/asciimoo/omnom), a webpage bookmarking and snapshotting service. Available as [services.omnom](options.html#opt-services.omnom.enable).

 - [Yggdrasil-Jumper](https://github.com/one-d-wide/yggdrasil-jumper) is an independent project that aims to transparently reduce latency of a connection over Yggdrasil network, utilizing NAT traversal to automatically bypass intermediary nodes.
@@ -97,6 +99,8 @@

 - [Bat](https://github.com/sharkdp/bat), a {manpage}`cat(1)` clone with wings. Available as [programs.bat](options.html#opt-programs.bat).

+- [Autotier](https://github.com/45Drives/autotier), a passthrough FUSE filesystem. Available as [services.autotierfs](options.html#opt-services.autotierfs.enable).
+
 - [µStreamer](https://github.com/pikvm/ustreamer), a lightweight MJPEG-HTTP streamer. Available as [services.ustreamer](options.html#opt-services.ustreamer).

 - [Whoogle Search](https://github.com/benbusby/whoogle-search), a self-hosted, ad-free, privacy-respecting metasearch engine. Available as [services.whoogle-search](options.html#opt-services.whoogle-search.enable).
@@ -417,6 +417,7 @@
  ./services/audio/squeezelite.nix
  ./services/audio/tts.nix
  ./services/audio/ympd.nix
+  ./services/autotierfs.nix
  ./services/backup/automysqlbackup.nix
  ./services/backup/bacula.nix
  ./services/backup/borgbackup.nix
@@ -1497,6 +1498,7 @@
  ./services/web-apps/hedgedoc.nix
  ./services/web-apps/hledger-web.nix
  ./services/web-apps/homebox.nix
+  ./services/web-apps/homer.nix
  ./services/web-apps/honk.nix
  ./services/web-apps/icingaweb2/icingaweb2.nix
  ./services/web-apps/icingaweb2/module-monitoring.nix
@@ -0,0 +1,95 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.autotierfs;
+  ini = pkgs.formats.ini { };
+  format = lib.types.attrsOf ini.type;
+  stateDir = "/var/lib/autotier";
+
+  generateConfigName =
+    name: builtins.replaceStrings [ "/" ] [ "-" ] (lib.strings.removePrefix "/" name);
+  configFiles = builtins.mapAttrs (
+    name: val: ini.generate "${generateConfigName name}.conf" val
+  ) cfg.settings;
+
+  getMountDeps =
+    settings: builtins.concatStringsSep " " (builtins.catAttrs "Path" (builtins.attrValues settings));
+
+  mountPaths = builtins.attrNames cfg.settings;
+in
+{
+  options.services.autotierfs = {
+    enable = lib.mkEnableOption "the autotier passthrough tiering filesystem";
+    package = lib.mkPackageOption pkgs "autotier" { };
+    settings = lib.mkOption {
+      type = lib.types.submodule {
+        freeformType = format;
+      };
+      default = { };
+      description = ''
+        The contents of the configuration file for autotier.
+        See the [autotier repo](https://github.com/45Drives/autotier#configuration) for supported values.
+      '';
+      example = lib.literalExpression ''
+        {
+          "/mnt/autotier" = {
+            Global = {
+              "Log Level" = 1;
+              "Tier Period" = 1000;
+              "Copy Buffer Size" = "1 MiB";
+            };
+            "Tier 1" = {
+              Path = "/mnt/tier1";
+              Quota = "30GiB";
+            };
+            "Tier 2" = {
+              Path = "/mnt/tier2";
+              Quota = "200GiB";
+            };
+          };
+        }
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = cfg.settings != { };
+        message = "`services.autotierfs.settings` must be configured.";
+      }
+    ];
+
+    system.fsPackages = [ cfg.package ];
+
+    # Not necessary for module to work but makes it easier to pass config into cli
+    environment.etc = lib.attrsets.mapAttrs' (
+      name: value:
+      lib.attrsets.nameValuePair "autotier/${(generateConfigName name)}.conf" { source = value; }
+    ) configFiles;
+
+    systemd.tmpfiles.rules = (map (path: "d ${path} 0770 - autotier - -") mountPaths) ++ [
+      "d ${stateDir} 0774 - autotier - -"
+    ];
+
+    users.groups.autotier = { };
+
+    systemd.services = lib.attrsets.mapAttrs' (
+      path: values:
+      lib.attrsets.nameValuePair (generateConfigName path) {
+        description = "Mount autotierfs virtual path ${path}";
+        unitConfig.RequiresMountsFor = getMountDeps values;
+        wantedBy = [ "local-fs.target" ];
+        serviceConfig = {
+          Type = "forking";
+          ExecStart = "${lib.getExe' cfg.package "autotierfs"} -c /etc/autotier/${generateConfigName path}.conf ${path} -o allow_other,default_permissions";
+          ExecStop = "umount ${path}";
+        };
+      }
+    ) cfg.settings;
+  };
+}
@@ -97,7 +97,7 @@ in
      } // cfg.environment;

      serviceConfig = {
-        ExecStart = "${lib.getExe cfg.package} serve --host ${cfg.host} --port ${toString cfg.port}";
+        ExecStart = "${lib.getExe cfg.package} serve --host \"${cfg.host}\" --port ${toString cfg.port}";
        EnvironmentFile = lib.optional (cfg.environmentFile != null) cfg.environmentFile;
        WorkingDirectory = cfg.stateDir;
        StateDirectory = "open-webui";
@@ -0,0 +1,184 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.homer;
+  settingsFormat = pkgs.formats.yaml { };
+  configFile = settingsFormat.generate "homer-config.yml" cfg.settings;
+in
+{
+  options.services.homer = {
+    enable = lib.mkEnableOption ''
+      A dead simple static HOMepage for your servER to keep your services on hand, from a simple yaml configuration file.
+    '';
+
+    virtualHost = {
+      nginx.enable = lib.mkEnableOption "a virtualhost to serve homer through nginx";
+      caddy.enable = lib.mkEnableOption "a virtualhost to serve homer through caddy";
+
+      domain = lib.mkOption {
+        description = ''
+          Domain to use for the virtual host.
+
+          This can be used to change nginx options like
+          ```nix
+          services.nginx.virtualHosts."$\{config.services.homer.virtualHost.domain}".listen = [ ... ]
+          ```
+          or
+          ```nix
+          services.nginx.virtualHosts."example.com".listen = [ ... ]
+          ```
+        '';
+        type = lib.types.str;
+      };
+    };
+
+    package = lib.mkPackageOption pkgs "homer" { };
+
+    settings = lib.mkOption {
+      default = { };
+      description = ''
+        Settings serialized into `config.yml` before build.
+        If left empty, the default configuration shipped with the package will be used instead.
+        For more information, see the [official documentation](https://github.com/bastienwirtz/homer/blob/main/docs/configuration.md).
+
+        Note that the full configuration will be written to the nix store as world readable, which may include secrets such as [api-keys](https://github.com/bastienwirtz/homer/blob/main/docs/customservices.md).
+
+        To add files such as icons or backgrounds, you can reference them in line such as
+        ```nix
+        icon = "$\{./icon.png}";
+        ```
+        This will add the file to the nix store upon build, referencing it by file path as expected by Homer.
+      '';
+      example = ''
+        {
+          title = "App dashboard";
+          subtitle = "Homer";
+          logo = "assets/logo.png";
+          header = true;
+          footer = ${"''"}
+            <p>Created with <span class="has-text-danger">❤️</span> with
+            <a href="https://bulma.io/">bulma</a>,
+            <a href="https://vuejs.org/">vuejs</a> &
+            <a href="https://fontawesome.com/">font awesome</a> //
+            Fork me on <a href="https://github.com/bastienwirtz/homer">
+            <i class="fab fa-github-alt"></i></a></p>
+          ${"''"};
+          columns = "3";
+          connectivityCheck = true;
+
+          proxy = {
+            useCredentials = false;
+            headers = {
+              Test = "Example";
+              Test1 = "Example1";
+            };
+          };
+
+          defaults = {
+            layout = "columns";
+            colorTheme = "auto";
+          };
+
+          theme = "default";
+
+          message = {
+            style = "is-warning";
+            title = "Optional message!";
+            icon = "fa fa-exclamation-triangle";
+            content = "Lorem ipsum dolor sit amet, consectetur adipiscing elit.";
+          };
+
+          links = [
+            {
+              name = "Link 1";
+              icon = "fab fa-github";
+              url = "https://github.com/bastienwirtz/homer";
+              target = "_blank";
+            }
+            {
+              name = "link 2";
+              icon = "fas fa-book";
+              url = "https://github.com/bastienwirtz/homer";
+            }
+          ];
+
+          services = [
+            {
+              name = "Application";
+              icon = "fas fa-code-branch";
+              items = [
+                {
+                  name = "Awesome app";
+                  logo = "assets/tools/sample.png";
+                  subtitle = "Bookmark example";
+                  tag = "app";
+                  keywords = "self hosted reddit";
+                  url = "https://www.reddit.com/r/selfhosted/";
+                  target = "_blank";
+                }
+                {
+                  name = "Another one";
+                  logo = "assets/tools/sample2.png";
+                  subtitle = "Another application";
+                  tag = "app";
+                  tagstyle = "is-success";
+                  url = "#";
+                }
+              ];
+            }
+            {
+              name = "Other group";
+              icon = "fas fa-heartbeat";
+              items = [
+                {
+                  name = "Pi-hole";
+                  logo = "assets/tools/sample.png";
+                  tag = "other";
+                  url = "http://192.168.0.151/admin";
+                  type = "PiHole";
+                  target = "_blank";
+                }
+              ];
+            }
+          ];
+        }
+
+      '';
+      inherit (pkgs.formats.yaml { }) type;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.nginx = lib.mkIf cfg.virtualHost.nginx.enable {
+      enable = true;
+      virtualHosts."${cfg.virtualHost.domain}" = {
+        locations."/" = {
+          root = cfg.package;
+          tryFiles = "$uri /index.html";
+        };
+        locations."= /assets/config.yml" = {
+          alias = configFile;
+        };
+      };
+    };
+    services.caddy = lib.mkIf cfg.virtualHost.caddy.enable {
+      enable = true;
+      virtualHosts."${cfg.virtualHost.domain}".extraConfig = ''
+        root * ${cfg.package}
+        file_server
+        handle_path /assets/config.yml {
+          root * ${configFile}
+          file_server
+        }
+      '';
+    };
+  };
+
+  meta.maintainers = [
+    lib.maintainers.stunkymonkey
+  ];
+}
@@ -65,7 +65,7 @@ let

    inherit (cfg.package) version src;

-    nativeBuildInputs = with pkgs.nodePackages; [ less ];
+    nativeBuildInputs = with pkgs; [ lessc ];

    buildPhase = ''
      mkdir -p $out
@@ -436,6 +436,7 @@ in {
  hedgedoc = handleTest ./hedgedoc.nix {};
  herbstluftwm = handleTest ./herbstluftwm.nix {};
  homebox = handleTest ./homebox.nix {};
+  homer = handleTest ./homer {};
  homepage-dashboard = handleTest ./homepage-dashboard.nix {};
  honk = runTest ./honk.nix;
  installed-tests = pkgs.recurseIntoAttrs (handleTest ./installed-tests {});
@@ -0,0 +1,30 @@
+import ../make-test-python.nix (
+  { lib, ... }:
+
+  {
+    name = "homer-caddy";
+    meta.maintainers = with lib.maintainers; [ stunkymonkey ];
+
+    nodes.machine =
+      { pkgs, ... }:
+      {
+        services.homer = {
+          enable = true;
+          virtualHost = {
+            caddy.enable = true;
+            domain = "localhost:80";
+          };
+          settings = {
+            title = "testing";
+          };
+        };
+      };
+
+    testScript = ''
+      machine.wait_for_unit("caddy.service")
+      machine.wait_for_open_port(80)
+      machine.succeed("curl --fail --show-error --silent http://localhost:80/ | grep '<title>Homer</title>'")
+      machine.succeed("curl --fail --show-error --silent http://localhost:80/assets/config.yml | grep 'title: testing'")
+    '';
+  }
+)
@@ -0,0 +1,6 @@
+{ system, pkgs, ... }:
+
+{
+  caddy = import ./caddy.nix { inherit system pkgs; };
+  nginx = import ./nginx.nix { inherit system pkgs; };
+}
@@ -0,0 +1,30 @@
+import ../make-test-python.nix (
+  { lib, ... }:
+
+  {
+    name = "homer-nginx";
+    meta.maintainers = with lib.maintainers; [ stunkymonkey ];
+
+    nodes.machine =
+      { pkgs, ... }:
+      {
+        services.homer = {
+          enable = true;
+          virtualHost = {
+            nginx.enable = true;
+            domain = "localhost";
+          };
+          settings = {
+            title = "testing";
+          };
+        };
+      };
+
+    testScript = ''
+      machine.wait_for_unit("nginx.service")
+      machine.wait_for_open_port(80)
+      machine.succeed("curl --fail --show-error --silent http://localhost:80/ | grep '<title>Homer</title>'")
+      machine.succeed("curl --fail --show-error --silent http://localhost:80/assets/config.yml | grep 'title: testing'")
+    '';
+  }
+)
@@ -15,6 +15,7 @@ in
      {
        services.open-webui = {
          enable = true;
+          host = "";
          environment = {
            # Requires network connection
            RAG_EMBEDDING_MODEL = "";
@@ -27,6 +27,8 @@ lib.packagesFromDirectoryRecursive {
      ;
  };

+  lua = callPackage ./manual-packages/lua { inherit (pkgs) lua; };
+
  straight = callPackage ./manual-packages/straight { inherit (pkgs) git; };

  structured-haskell-mode = self.shm;
@@ -0,0 +1,39 @@
+{
+  lib,
+  lua,
+  melpaBuild,
+  pkg-config,
+  fetchFromGitHub,
+  unstableGitUpdater,
+}:
+
+melpaBuild {
+  pname = "lua";
+  version = "0-unstable-2025-01-27";
+
+  src = fetchFromGitHub {
+    owner = "syohex";
+    repo = "emacs-lua";
+    rev = "501189b5fc069fcead8843b2b0ad510c08de1397";
+    hash = "sha256-psCrto12p03R9XxPtDYTMB5vcRVWj+Blq7D30nLsSbU=";
+  };
+
+  preBuild = ''
+    make LUA_VERSION=${lua.luaversion} CC=$CC LD=$CC
+  '';
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [ lua ];
+
+  files = ''(:defaults "lua-core.so")'';
+
+  passthru.updateScript = unstableGitUpdater { };
+
+  meta = with lib; {
+    homepage = "https://github.com/syohex/emacs-lua";
+    description = "Lua engine from Emacs Lisp";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ nagy ];
+  };
+}
@@ -11223,6 +11223,18 @@ final: prev:
    meta.homepage = "https://github.com/amitds1997/remote-nvim.nvim/";
  };

+  remote-sshfs-nvim = buildVimPlugin {
+    pname = "remote-sshfs.nvim";
+    version = "2024-08-29";
+    src = fetchFromGitHub {
+      owner = "nosduco";
+      repo = "remote-sshfs.nvim";
+      rev = "03f6c40c4032eeb1ab91368e06db9c3f3a97a75d";
+      sha256 = "1pl08cpgx27mhmbjxlqld4n2728hxs0hvwyjjy982k315hhhhldw";
+    };
+    meta.homepage = "https://github.com/nosduco/remote-sshfs.nvim/";
+  };
+
  renamer-nvim = buildVimPlugin {
    pname = "renamer.nvim";
    version = "2022-08-29";
@@ -44,12 +44,14 @@
  nodejs,
  notmuch,
  openscad,
+  openssh,
  parinfer-rust,
  phpactor,
  ranger,
  ripgrep,
  skim,
  sqlite,
+  sshfs,
  statix,
  stylish-haskell,
  tabnine,
@@ -2796,6 +2798,17 @@ in
    nvimSkipModule = "repro";
  };

+  remote-sshfs-nvim = super.remote-sshfs-nvim.overrideAttrs {
+    dependencies = with self; [
+      telescope-nvim
+      plenary-nvim
+    ];
+    runtimeDeps = [
+      openssh
+      sshfs
+    ];
+  };
+
  renamer-nvim = super.renamer-nvim.overrideAttrs {
    dependencies = [ self.plenary-nvim ];
  };
@@ -929,6 +929,7 @@ https://github.com/theprimeagen/refactoring.nvim/,,
 https://github.com/tversteeg/registers.nvim/,,
 https://github.com/vladdoster/remember.nvim/,,
 https://github.com/amitds1997/remote-nvim.nvim/,HEAD,
+https://github.com/nosduco/remote-sshfs.nvim/,HEAD,
 https://github.com/filipdutescu/renamer.nvim/,,
 https://github.com/MeanderingProgrammer/render-markdown.nvim/,,
 https://github.com/gabrielpoca/replacer.nvim/,HEAD,
@@ -1,7 +1,7 @@
 { callPackage, ... }:

 callPackage ./generic.nix {
-  version = "5.2.6";
+  version = "5.2.9";
  kde-channel = "stable";
-  hash = "sha256-SNcShVT99LTpLFSuMbUq95IfR6jabOyqBnRKu/yC1fs=";
+  hash = "sha256-CMmvVW3r8mkxvWUGeS45G0t6MzSlog9RazJJBDNKy6Y=";
 }
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
 , cmake
 , ninja
 , pkg-config
@@ -31,24 +30,16 @@ let
  };
 in stdenv.mkDerivation rec {
  pname = "organicmaps";
-  version = "2024.11.27-12";
+  version = "2025.01.26-9";

  src = fetchFromGitHub {
    owner = "organicmaps";
    repo = "organicmaps";
    rev = "${version}-android";
-    hash = "sha256-lBEDPqxdnaajMHlf7G/d1TYYL9yPZo8AGekoKmF1ObM=";
+    hash = "sha256-pzZmaOBo4aYywprxrJa3Rk9Uu3w+Q6XdVdcPmV0cSUs=";
    fetchSubmodules = true;
  };

-  patches = [
-    # Fix for https://github.com/organicmaps/organicmaps/issues/7838
-    (fetchpatch {
-      url = "https://github.com/organicmaps/organicmaps/commit/1caf64e315c988cd8d5196c80be96efec6c74ccc.patch";
-      hash = "sha256-k3VVRgHCFDhviHxduQMVRUUvQDgMwFHIiDZKa4BNTyk=";
-    })
-  ];
-
  postPatch = ''
    # Disable certificate check. It's dependent on time
    echo "exit 0" > tools/unix/check_cert.sh
@@ -11,6 +11,7 @@
 , pkg-config
 , curl
 , libavif
+, libGL
 , libjxl
 , libpulseaudio
 , libwebp
@@ -48,13 +49,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "ladybird";
-  version = "0-unstable-2024-12-30";
+  version = "0-unstable-2025-01-28";

  src = fetchFromGitHub {
    owner = "LadybirdWebBrowser";
    repo = "ladybird";
-    rev = "4324439006a6df1179440ce4f415b67658919957";
-    hash = "sha256-vg2Nb85+fegs7Idika9Mbq+f27wrIO48pWQSUidLKwE=";
+    rev = "eca68aad8846f20f64167cf53dc1f432abe1590e";
+    hash = "sha256-8vENHJ6BdMAEhlt54IU9+i4iVPnGp0R42v6zykGrrg4=";
  };

  postPatch = ''
@@ -108,6 +109,7 @@ stdenv.mkDerivation (finalAttrs: {
    ffmpeg
    fontconfig
    libavif
+    libGL
    libjxl
    libwebp
    libxcrypt
@@ -141,6 +143,11 @@ stdenv.mkDerivation (finalAttrs: {

  # FIXME: Add an option to -DENABLE_QT=ON on macOS to use Qt rather than Cocoa for the GUI

+  # ld: [...]/OESVertexArrayObject.cpp.o: undefined reference to symbol 'glIsVertexArrayOES'
+  # ld: [...]/libGL.so.1: error adding symbols: DSO missing from command line
+  # https://github.com/LadybirdBrowser/ladybird/issues/371#issuecomment-2616415434
+  env.NIX_LDFLAGS = "-lGL";
+
  postInstall = lib.optionalString stdenv.hostPlatform.isDarwin ''
    mkdir -p $out/Applications $out/bin
    mv $out/bundle/Ladybird.app $out/Applications
@@ -9,16 +9,16 @@

 buildGoModule rec {
  pname = "helmfile";
-  version = "0.170.0";
+  version = "0.170.1";

  src = fetchFromGitHub {
    owner = "helmfile";
    repo = "helmfile";
    rev = "v${version}";
-    hash = "sha256-HlSpY7+Qct2vxtAejrwmmWhnWq+jVycjuxQ42KScpSs=";
+    hash = "sha256-qu/0l+4fZUk7H5sCZopmCNxja5hI5WwfXga90Yeuy7o=";
  };

-  vendorHash = "sha256-BmEtzUUORY/ck158+1ItVeiG9mzXdikjjUX7XwQ7xoo=";
+  vendorHash = "sha256-vAv/VlAvkPRWrOHDNkt4VdXXjqi65RVjYtvqSJjb8ds=";

  proxyVendor = true; # darwin/linux hash mismatch

@@ -30,7 +30,7 @@ mkDerivation rec {
    "out"
    "dev"
  ];
-  version = "15.54.3";
+  version = "15.61.3";

  src =
    let
@@ -39,11 +39,11 @@ mkDerivation rec {
    {
      x86_64-linux = fetchurl {
        url = "${base_url}/teamviewer_${version}_amd64.deb";
-        hash = "sha256-41zVX2svomcRKu2ow1A/EeKojBIpABO4o2EZxappzgo=";
+        hash = "sha256-o7Em+QRW4TebRTJS5xjcx1M6KPh1ziB1j0fvlO+RYa4=";
      };
      aarch64-linux = fetchurl {
        url = "${base_url}/teamviewer_${version}_arm64.deb";
-        hash = "sha256-wuQYWeYgXW54/5dpiGzJxZ9JZDlUgFgCKq8Z4xV2HlI=";
+        hash = "sha256-LDByF4u9xZV1MYApBrnlNrUPndbDrQt6DKX+r8Kmq6k=";
      };
    }
    .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
@@ -152,6 +152,8 @@ mkDerivation rec {
  dontWrapQtApps = true;
  preferLocalBuild = true;

+  passthru.updateScript = ./update-teamviewer.sh;
+
  meta = with lib; {
    homepage = "https://www.teamviewer.com";
    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
@@ -162,6 +164,7 @@ mkDerivation rec {
      jagajaga
      jraygauthier
      gador
+      c4thebomb
    ];
  };
 }
@@ -0,0 +1,7 @@
+#! /usr/bin/env nix-shell
+#! nix-shell -i bash -p nix-update curl
+
+TEAMVIEWER_VER=$(curl -s https://www.teamviewer.com/en-us/download/linux/ | grep -oP 'Current version: <span data-dl-version-label>\K[0-9]+\.[0-9]+\.[0-9]+')
+
+nix-update --version "$TEAMVIEWER_VER" --system x86_64-linux teamviewer
+nix-update --version "skip" --system aarch64-linux teamviewer
@@ -11,13 +11,13 @@
 buildKodiBinaryAddon rec {
  pname = "visualization-fishbmc";
  namespace = "visualization.fishbmc";
-  version = "21.0.1";
+  version = "21.0.2";

  src = fetchFromGitHub {
    owner = "xbmc";
    repo = namespace;
    rev = "${version}-${rel}";
-    hash = "sha256-JAiWkW9iaOq+Q2tArxJ+S7sXQM2K010uT09j30rTY0I=";
+    hash = "sha256-4cU5g50ZRnkKSfT/V2hHw1l0PTFkvV4hrxAgPDpfCiw=";
  };

  extraBuildInputs = [
@@ -11,13 +11,13 @@
 buildKodiBinaryAddon rec {
  pname = "visualization-goom";
  namespace = "visualization.goom";
-  version = "21.0.1";
+  version = "21.0.2";

  src = fetchFromGitHub {
    owner = "xbmc";
    repo = namespace;
    rev = "${version}-${rel}";
-    hash = "sha256-Cu0XRv2iU35bakbS5JkjSYAW5Enra1gt1I0sebcapx4=";
+    hash = "sha256-TGSYSrQLFrjbp+UMQ14f5sb8thePFZaSH7x/ckLIoqw=";
  };

  extraBuildInputs = [
@@ -11,13 +11,13 @@
 buildKodiBinaryAddon rec {
  pname = "visualization-pictureit";
  namespace = "visualization.pictureit";
-  version = "21.0.1";
+  version = "21.0.2";

  src = fetchFromGitHub {
    owner = "xbmc";
    repo = namespace;
    rev = "${version}-${rel}";
-    hash = "sha256-0soMNqff/aVANDFORL3mqUUpi2BWmauUtE4EBr3QwlI=";
+    hash = "sha256-jFRv/fYR/98jcP9GCRVYu2EQIdWQItzYrEoXW/RF+bA=";
  };

  extraBuildInputs = [
@@ -11,13 +11,13 @@
 buildKodiBinaryAddon rec {
  pname = "visualization-waveform";
  namespace = "visualization.waveform";
-  version = "21.0.1";
+  version = "21.0.2";

  src = fetchFromGitHub {
    owner = "xbmc";
    repo = namespace;
    rev = "${version}-${rel}";
-    hash = "sha256-ocLiDt9Fvwb/KvCsULyWRCNK0vOGMh/r88PRn1WYyXs=";
+    hash = "sha256-RiFPR0nlyrnHzHBosvU+obbdtHXjdgMtxscQTcQ7kLw=";
  };

  extraBuildInputs = [
@@ -3,7 +3,7 @@
 , fetchFromGitHub
 , makeWrapper
 , copyDesktopItems
-, electron
+, electron_33
 , nodejs
 , pnpm_9
 , makeDesktopItem
@@ -56,7 +56,7 @@ stdenv.mkDerivation (finalAttrs: {
  buildPhase = ''
    runHook preBuild

-    cp -r ${electron.dist} electron-dist
+    cp -r ${electron_33.dist} electron-dist
    chmod -R u+w electron-dist

    pnpm build
@@ -64,7 +64,7 @@ stdenv.mkDerivation (finalAttrs: {
      --dir \
      --config .electron-builder.config.cjs \
      -c.electronDist=electron-dist \
-      -c.electronVersion=${electron.version}
+      -c.electronVersion=${electron_33.version}

    runHook postBuild
  '';
@@ -84,7 +84,7 @@ stdenv.mkDerivation (finalAttrs: {

    install -Dm644 buildResources/icon.svg "$out/share/icons/hicolor/scalable/apps/podman-desktop.svg"

-    makeWrapper '${electron}/bin/electron' "$out/bin/podman-desktop" \
+    makeWrapper '${electron_33}/bin/electron' "$out/bin/podman-desktop" \
      --add-flags "$out/share/lib/podman-desktop/resources/app.asar" \
      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime=true}}" \
      --inherit-argv0
@@ -113,7 +113,7 @@ stdenv.mkDerivation (finalAttrs: {
    changelog = "https://github.com/containers/podman-desktop/releases/tag/v${finalAttrs.version}";
    license = lib.licenses.asl20;
    maintainers = with lib.maintainers; [ booxter panda2134 ];
-    inherit (electron.meta) platforms;
+    inherit (electron_33.meta) platforms;
    mainProgram = "podman-desktop";
  };
 })
@@ -8,13 +8,13 @@
 }:
 mkHyprlandPlugin hyprland rec {
  pluginName = "hy3";
-  version = "0.46.0";
+  version = "0.47.0";

  src = fetchFromGitHub {
    owner = "outfoxxed";
    repo = "hy3";
    rev = "refs/tags/hl${version}";
-    hash = "sha256-etPkIYs38eDgJOpsFfgljlGIy0FPRXgU3DRWuib1wWc=";
+    hash = "sha256-DicW4xltTHVk1L34xtEJwrKb9nSBWJ+zLVrh28Fr6Fg=";
  };

  nativeBuildInputs = [ cmake ];
@@ -7,7 +7,6 @@
  kdePackages,
  qt6,
  libsecret,
-  xdg-utils,
  amneziawg-go,
  openvpn,
  shadowsocks-rust,
@@ -20,6 +19,7 @@
  zlib,
  tun2socks,
  xray,
+  nix-update-script,
 }:
 let
  amnezia-tun2socks = tun2socks.overrideAttrs (
@@ -35,13 +35,6 @@ let
      };

      vendorHash = "sha256-VvOaTJ6dBFlbGZGxnHy2sCtds1tyhu6VsPewYpsDBiM=";
-
-      ldflags = [
-        "-w"
-        "-s"
-        "-X github.com/amnezia-vpn/amnezia-tun2socks/v2/internal/version.Version=v${finalAttrs.version}"
-        "-X github.com/amnezia-vpn/amnezia-tun2socks/v2/internal/version.GitCommit=v${finalAttrs.version}"
-      ];
    }
  );

@@ -63,18 +56,16 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "amnezia-vpn";
-  version = "4.8.2.3";
+  version = "4.8.3.1";

  src = fetchFromGitHub {
    owner = "amnezia-vpn";
    repo = "amnezia-client";
    tag = finalAttrs.version;
-    hash = "sha256-bCWPyRW2xnnopcwfPHgQrdP85Ct0CDufJRQ1PvCAiDE=";
+    hash = "sha256-U/fVO9GcSdxFg5r57vX5Ylgu6CMjG4GKyInIgBNUiEw=";
    fetchSubmodules = true;
  };

-  patches = [ ./router.patch ];
-
  postPatch =
    ''
      substituteInPlace client/platforms/linux/daemon/wireguardutilslinux.cpp \
@@ -82,8 +73,7 @@ stdenv.mkDerivation (finalAttrs: {
      substituteInPlace client/utilities.cpp \
        --replace-fail 'return Utils::executable("../../client/bin/openvpn", true);' 'return Utils::executable("${openvpn}/bin/openvpn", false);' \
        --replace-fail 'return Utils::executable("../../client/bin/tun2socks", true);' 'return Utils::executable("${amnezia-tun2socks}/bin/amnezia-tun2socks", false);' \
-        --replace-fail 'return Utils::usrExecutable("wg-quick");' 'return Utils::executable("${wireguard-tools}/bin/wg-quick", false);' \
-        --replace-fail 'QProcess::execute(QString("pkill %1").arg(name));' 'return QProcess::execute(QString("pkill -f %1").arg(name)) == 0;'
+        --replace-fail 'return Utils::usrExecutable("wg-quick");' 'return Utils::executable("${wireguard-tools}/bin/wg-quick", false);'
      substituteInPlace client/protocols/xrayprotocol.cpp \
        --replace-fail 'return Utils::executable(QString("xray"), true);' 'return Utils::executable(QString("${amnezia-xray}/bin/xray"), false);'
      substituteInPlace client/protocols/openvpnovercloakprotocol.cpp \
@@ -91,11 +81,10 @@ stdenv.mkDerivation (finalAttrs: {
      substituteInPlace client/protocols/shadowsocksvpnprotocol.cpp \
        --replace-fail 'return Utils::executable(QString("/ss-local"), true);' 'return Utils::executable(QString("${shadowsocks-rust}/bin/sslocal"), false);'
      substituteInPlace client/configurators/openvpn_configurator.cpp \
-        --replace-fail ".arg(qApp->applicationDirPath());" ".arg(\"$out/local/bin\");"
+        --replace-fail ".arg(qApp->applicationDirPath());" ".arg(\"$out/libexec\");"
      substituteInPlace client/ui/qautostart.cpp \
        --replace-fail "/usr/share/pixmaps/AmneziaVPN.png" "$out/share/pixmaps/AmneziaVPN.png"
      substituteInPlace deploy/installer/config/AmneziaVPN.desktop.in \
-        --replace-fail "#!/usr/bin/env xdg-open" "#!${xdg-utils}/bin/xdg-open" \
        --replace-fail "/usr/share/pixmaps/AmneziaVPN.png" "$out/share/pixmaps/AmneziaVPN.png"
      substituteInPlace deploy/data/linux/AmneziaVPN.service \
        --replace-fail "ExecStart=/opt/AmneziaVPN/service/AmneziaVPN-service.sh" "ExecStart=$out/bin/AmneziaVPN-service" \
@@ -137,14 +126,26 @@ stdenv.mkDerivation (finalAttrs: {
  ];

  postInstall = ''
-    mkdir -p $out/bin $out/local/bin $out/share/applications $out/share/pixmaps $out/lib/systemd/system
+    mkdir -p $out/bin $out/libexec $out/share/applications $out/share/pixmaps $out/lib/systemd/system
    cp client/AmneziaVPN service/server/AmneziaVPN-service $out/bin/
-    cp ../deploy/data/linux/client/bin/update-resolv-conf.sh $out/local/bin/
+    cp ../deploy/data/linux/client/bin/update-resolv-conf.sh $out/libexec/
    cp ../AppDir/AmneziaVPN.desktop $out/share/applications/
    cp ../deploy/data/linux/AmneziaVPN.png $out/share/pixmaps/
    cp ../deploy/data/linux/AmneziaVPN.service $out/lib/systemd/system/
  '';

+  passthru = {
+    inherit amnezia-tun2socks amnezia-xray;
+    updateScript = nix-update-script {
+      extraArgs = [
+        "--subpackage"
+        "amnezia-tun2socks"
+        "--subpackage"
+        "amnezia-xray"
+      ];
+    };
+  };
+
  meta = with lib; {
    description = "Amnezia VPN Client";
    downloadPage = "https://amnezia.org/en/downloads";
@@ -1,54 +0,0 @@
--- a/service/server/router_linux.cpp   2025-01-01 11:36:27.615658613 +0300
-+++ b/service/server/router_linux.cpp   2025-01-01 18:07:57.300178080 +0300
-@@ -19,9 +19,27 @@
- #include <stdio.h>
- #include <unistd.h>
- #include <QFileInfo>
-+#include <QStringList>
-+#include <QString>
- 
- #include <core/networkUtilities.h>
- 
-+bool isServiceActive(const QString &serviceName) {
-+    QProcess process;
-+    process.start("systemctl", { "list-units", "--type=service", "--state=running", "--no-legend" });
-+    process.waitForFinished();
-+
-+    QString output = process.readAllStandardOutput();
-+    QStringList services = output.split('\n', Qt::SkipEmptyParts);
-+
-+    for (const QString &service : services) {
-+        if (service.contains(serviceName)) {
-+            return true;
-+        }
-+    }
-+    return false;
-+}
-+
- RouterLinux &RouterLinux::Instance()
- {
-     static RouterLinux s;
-@@ -158,15 +176,14 @@
-     p.setProcessChannelMode(QProcess::MergedChannels);
- 
-     //check what the dns manager use
-    if (QFileInfo::exists("/usr/bin/nscd")
-        || QFileInfo::exists("/usr/sbin/nscd")
-        || QFileInfo::exists("/usr/lib/systemd/system/nscd.service"))
-    {
-        p.start("systemctl restart nscd");
-    }
-    else
-    {
-        p.start("systemctl restart systemd-resolved");
-+    if (isServiceActive("nscd.service")) {
-+        qDebug() << "Restarting nscd.service";
-+        p.start("systemctl", { "restart", "nscd" });
-+    } else if (isServiceActive("systemd-resolved.service")) {
-+        qDebug() << "Restarting systemd-resolved.service";
-+        p.start("systemctl", { "restart", "systemd-resolved" });
-+    } else {
-+        qDebug() << "No suitable DNS manager found.";
-     }
- 
-     p.waitForFinished();
@@ -0,0 +1,88 @@
+{
+  stdenv,
+  lib,
+  fetchFromGitHub,
+  fetchpatch,
+  pkg-config,
+  rocksdb,
+  boost,
+  fuse3,
+  lib45d,
+  tbb_2021_11,
+  liburing,
+  installShellFiles,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  name = "autotier";
+  version = "1.2.0";
+  src = fetchFromGitHub {
+    owner = "45Drives";
+    repo = "autotier";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Pf1baDJsyt0ScASWrrgMu8+X5eZPGJSu0/LDQNHe1Ok=";
+  };
+
+  patches = [
+    # https://github.com/45Drives/autotier/pull/70
+    # fix "error: 'uintmax_t' has not been declared" build failure until next release
+    (fetchpatch {
+      url = "https://github.com/45Drives/autotier/commit/d447929dc4262f607d87cbc8ad40a54d64f5011a.patch";
+      hash = "sha256-0ab8YBgdJMxBHfOgUsgPpyUE1GyhAU3+WCYjYA2pjqo=";
+    })
+    # Unvendor rocksdb (nixpkgs already applies RTTI and PORTABLE flags) and use pkg-config for flags
+    (fetchpatch {
+      url = "https://github.com/45Drives/autotier/commit/fa282f5079ff17c144a7303d64dad0e44681b87f.patch";
+      hash = "sha256-+W3RwSe8zJKgZIXOaawHuI6xRzedYIcZundPC8eHuwM=";
+    })
+    # Add missing list import to src/incl/config.hpp
+    (fetchpatch {
+      url = "https://github.com/45Drives/autotier/commit/1f97703f4dfbfe093f5c18c4ee01dcc1c8fe04f3.patch";
+      hash = "sha256-3+KOh7JvbujCMbMqnZ5SGopAuOKHitKq6XV6a/jkcog=";
+    })
+  ];
+
+  buildInputs = [
+    rocksdb
+    boost
+    fuse3
+    lib45d
+    tbb_2021_11
+    liburing
+  ];
+
+  nativeBuildInputs = [
+    pkg-config
+    installShellFiles
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    # binaries
+    installBin dist/from_source/*
+
+    # docs
+    installManPage doc/man/autotier.8
+
+    # Completions
+    installShellCompletion --bash doc/completion/autotier.bash-completion
+    installShellCompletion --bash doc/completion/autotierfs.bash-completion
+
+    # Scripts
+    installBin script/autotier-init-dirs
+
+    # Default config
+    install -Dm755 -t $out/etc/autotier.conf doc/autotier.conf.template
+
+    runHook postInstall
+  '';
+
+  meta = {
+    homepage = "https://github.com/45Drives/autotier";
+    description = "Passthrough FUSE filesystem that intelligently moves files between storage tiers based on frequency of use, file age, and tier fullness";
+    license = lib.licenses.gpl3;
+    maintainers = with lib.maintainers; [ philipwilk ];
+    mainProgram = "autotier"; # cli, for file system use autotierfs
+    platforms = lib.platforms.linux; # uses io_uring so only available on linux not unix
+  };
+})
@@ -0,0 +1,29 @@
+From 316457cf70dd105905d5d4925f43de280f08ab10 Mon Sep 17 00:00:00 2001
+From: OPNA2608 <opna2608@protonmail.com>
+Date: Sat, 11 Jan 2025 20:55:29 +0100
+Subject: [PATCH] tests/CMakeLists.txt: Drop hardcoded -no-pie linker flags
+
+---
+ tests/CMakeLists.txt | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt
+index 63beacb..5b0812c 100644
+--- a/tests/CMakeLists.txt
+++ b/tests/CMakeLists.txt
+@@ -32,7 +32,6 @@ add_dependencies("indicator-messages-service" "ayatana-indicator-messages-servic
+ # test-gactionmuxer
+ 
+ add_executable("test-gactionmuxer" test-gactionmuxer.cpp)
+-target_link_options("test-gactionmuxer" PRIVATE -no-pie)
+ target_include_directories("test-gactionmuxer" PUBLIC ${PROJECT_DEPS_INCLUDE_DIRS} "${CMAKE_SOURCE_DIR}/src")
+ target_link_libraries("test-gactionmuxer" "indicator-messages-service" ${PROJECT_DEPS_LIBRARIES} ${GTEST_LIBRARIES} ${GTEST_BOTH_LIBRARIES} ${GMOCK_LIBRARIES})
+ add_test("test-gactionmuxer" "test-gactionmuxer")
+@@ -59,7 +58,6 @@ add_custom_target("gschemas-compiled" ALL DEPENDS gschemas.compiled)
+ 
+ pkg_check_modules(DBUSTEST REQUIRED dbustest-1)
+ add_executable("indicator-test" indicator-test.cpp)
+-target_link_options("indicator-test" PRIVATE -no-pie)
+ target_include_directories("indicator-test" PUBLIC ${PROJECT_DEPS_INCLUDE_DIRS} ${DBUSTEST_INCLUDE_DIRS} "${CMAKE_SOURCE_DIR}/libmessaging-menu")
+ target_link_libraries("indicator-test" "messaging-menu" ${PROJECT_DEPS_LIBRARIES} ${DBUSTEST_LIBRARIES} ${GTEST_LIBRARIES} ${GTEST_BOTH_LIBRARIES} ${GMOCK_LIBRARIES})
+ target_compile_definitions(
@@ -40,6 +40,11 @@ stdenv.mkDerivation (finalAttrs: {
    "dev"
  ] ++ lib.optionals withDocumentation [ "devdoc" ];

+  patches = [
+    # Remove when https://github.com/AyatanaIndicators/ayatana-indicator-messages/pull/39 merged & in release
+    ./fix-pie.patch
+  ];
+
  postPatch =
    ''
      # Uses pkg_get_variable, cannot substitute prefix with that
@@ -12,17 +12,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "cargo-make";
-  version = "0.37.23";
+  version = "0.37.24";

  src = fetchFromGitHub {
    owner = "sagiegurari";
    repo = "cargo-make";
    rev = version;
-    hash = "sha256-yYZasrnfxpLf0z6GndLYhkIFfVNjTkx4zdfHYX6WyXk=";
+    hash = "sha256-hrUd4J15cDyd78BVVzi8jiDqJI1dE35WUdOo6Tq8gH8=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-DtNSP/S41wj4lfd8yE3t8dJOf0yX+ifuj+L6pB53yR8=";
+  cargoHash = "sha256-ml/OW4S4fIMLmm7vVPgsXB7CigDYORGFpN3jZRp1f8c=";

  nativeBuildInputs = [
    pkg-config
@@ -0,0 +1,31 @@
+{
+  fetchFromGitHub,
+  lib,
+  nix-update-script,
+  rustPlatform,
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "dhcpm";
+  version = "0.2.3";
+
+  src = fetchFromGitHub {
+    owner = "leshow";
+    repo = "dhcpm";
+    tag = "v${version}";
+    hash = "sha256-vjKN9arR6Os3pgG89qmHt/0Ds5ToO38tLsQBay6VEIk=";
+  };
+
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-L6+/buzhYoLdFh7x8EmT37JyY5Pr7oFzyOGbhvgNvlw=";
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Dhcpm is a CLI tool for constructing & sending DHCP messages";
+    homepage = "https://github.com/leshow/dhcpm";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.jmbaur ];
+    mainProgram = "dhcpm";
+  };
+}
@@ -1,16 +1,16 @@
 {
  lib,
-  fetchFromGitHub,
-  python3Packages,
  appstream,
  blueprint-compiler,
  desktop-file-utils,
-  glib,
+  fetchFromGitHub,
  gdm,
+  glib,
  libadwaita,
  meson,
  ninja,
  pkg-config,
+  python3Packages,
  wrapGAppsHook4,
  # gdm-settings needs to know where to look for themes
  # This should work for most systems, but can be overridden if not
@@ -23,14 +23,14 @@

 python3Packages.buildPythonApplication rec {
  pname = "gdm-settings";
-  version = "4.4";
+  version = "5.0";
  pyproject = false;

  src = fetchFromGitHub {
    owner = "gdm-settings";
    repo = "gdm-settings";
    tag = "v${version}";
-    hash = "sha256-3Te8bhv2TkpJFz4llm1itRhzg9v64M7Drtrm4s9EyiQ=";
+    hash = "sha256-x7w6m0+uwkm95onR+ioQAoLlaPoUmLc0+NgawQIIa/Y=";
  };

  nativeBuildInputs = [
@@ -9,13 +9,13 @@

 buildGoModule rec {
  pname = "go-blueprint";
-  version = "0.10.4";
+  version = "0.10.5";

  src = fetchFromGitHub {
    owner = "Melkeydev";
    repo = "go-blueprint";
    rev = "v${version}";
-    hash = "sha256-/MIMDQKdpgY0bCwrYpJNC6jiEhNECROe61uuoFz8P68=";
+    hash = "sha256-8J+PxFHrNkX2McBn1tO7Q1X4tWtMWDIRsxzKtRhM/Jk=";
  };

  ldflags = [
@@ -12,16 +12,16 @@

 buildGoModule rec {
  pname = "gocryptfs";
-  version = "2.5.0";
+  version = "2.5.1";

  src = fetchFromGitHub {
    owner = "rfjakob";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-+JMit0loxT5KOupqL5bkO3pcAfuiN8YAw0ueUh9mUJI=";
+    sha256 = "sha256-yTZD4Q/krl6pW6EdtU+sdCWOOo9LHJqHCuNubAoEIyo=";
  };

-  vendorHash = "sha256-9qYmErARMIxnbECANO66m6fPwoR8YQlJzP/VcK9tfP4=";
+  vendorHash = "sha256-bzhwYiTqI3MV0KxDT5j9TVnWJxM0BuLgEC8/r+2aQjI=";

  nativeBuildInputs = [
    makeWrapper
@@ -10,13 +10,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "graphene-hardened-malloc";
-  version = "2024123000";
+  version = "2025012700";

  src = fetchFromGitHub {
    owner = "GrapheneOS";
    repo = "hardened_malloc";
    rev = finalAttrs.version;
-    hash = "sha256-zsP/ym/MXomqq+t/ckiAzHVR4AuFg+mEwXlICbBbODA=";
+    hash = "sha256-Xi34Dv+qGBrmmyYQ69KnyI+WQNJMRPlZQnSv3ey72zI=";
  };

  nativeCheckInputs = [ python3 ];
@@ -6,6 +6,7 @@
  nodejs,
  dart-sass,
  nix-update-script,
+  nixosTests,
 }:
 stdenvNoCC.mkDerivation rec {
  pname = "homer";
@@ -54,7 +55,12 @@ stdenvNoCC.mkDerivation rec {
    runHook postInstall
  '';

-  passthru.updateScript = nix-update-script { };
+  passthru = {
+    updateScript = nix-update-script { };
+    tests = {
+      inherit (nixosTests.homer) caddy nginx;
+    };
+  };

  meta = with lib; {
    description = "A very simple static homepage for your server.";
@@ -10,18 +10,19 @@
  openssl,

  # passthru
+  nixosTests,
  unstableGitUpdater,
 }:

 rustPlatform.buildRustPackage {
  pname = "inv-sig-helper";
-  version = "0-unstable-2024-12-17";
+  version = "0-unstable-2025-01-31";

  src = fetchFromGitHub {
    owner = "iv-org";
    repo = "inv_sig_helper";
-    rev = "74e879b54e46831e31c09fd08fe672ca58e9cb2d";
-    hash = "sha256-Q+u09WWBwWLcLLW9XwkaYDxM3xoQmeJzi37mrdDGvRc=";
+    rev = "40835906774cc7cdefa76b2648216afd063ad0e2";
+    hash = "sha256-yjVN81VSXPOXSOhhlF6Jjc/7sYsdoWT+Tr1BA+C2XQI=";
  };

  useFetchCargoVendor = true;
@@ -35,7 +36,12 @@ rustPlatform.buildRustPackage {
    openssl
  ];

-  passthru.updateScript = unstableGitUpdater { };
+  passthru = {
+    tests = {
+      inherit (nixosTests) invidious;
+    };
+    updateScript = unstableGitUpdater { };
+  };

  meta = {
    description = "Rust service that decrypts YouTube signatures and manages player information";
@@ -0,0 +1,17 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index e4e5547af..a3017d197 100644
+--- a/CMakeLists.txt
+++ b/CMakeLists.txt
+@@ -428,12 +425,6 @@ if (MINGW)
+     install(SCRIPT "${CMAKE_CURRENT_BINARY_DIR}/install-dlls-mingw.cmake")
+ endif()
+ 
+-if(APPLE)
+-    file(GLOB APPLE_DIST_FILES "${CMAKE_CURRENT_SOURCE_DIR}/assets/distr-files-mac/*.txt")
+-    install(FILES ${APPLE_DIST_FILES} DESTINATION .)
+-    install(DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}/dependencies/lib-SDL2-2.0.20-macos/SDL2.framework DESTINATION .)
+-endif()
+-
+ ## Build AppImage
+ 
+ add_custom_target(package-appimage
@@ -0,0 +1,109 @@
+{
+  stdenv,
+  lib,
+  fetchurl,
+  fetchFromGitHub,
+  cmake,
+  python3,
+  rustPlatform,
+  cargo,
+  rustc,
+  SDL2,
+  fltk,
+  lua5_3,
+  miniaudio,
+  rapidjson,
+  sol2,
+  gtest,
+}:
+
+let
+  stringTheory = fetchurl {
+    url = "https://github.com/zrax/string_theory/archive/3.8.tar.gz";
+    hash = "sha256-mq7pW3qRZs03/SijzbTl1txJHCSW/TO+gvRLWZh/11M=";
+  };
+
+  magicEnum = fetchurl {
+    url = "https://github.com/Neargye/magic_enum/archive/v0.8.2.zip";
+    hash = "sha256-oQ+mUDB8YJULcSploz+0bprJbqclhc+p/Pmsn1AsAes=";
+  };
+in
+stdenv.mkDerivation rec {
+  pname = "ja2-stracciatella";
+  version = "0.21.0";
+
+  src = fetchFromGitHub {
+    owner = "ja2-stracciatella";
+    repo = "ja2-stracciatella";
+    tag = "v${version}";
+    hash = "sha256-zMCFDMSKcsYz5LjW8UJbBlSmuJX6ibr9zIS3BgZMgAg=";
+  };
+
+  patches = [
+    # Note: this patch is only relevant for darwin
+    ./dont-use-vendored-sdl2.patch
+  ];
+
+  postPatch = ''
+    # Patch dependencies that are usually loaded by url
+    substituteInPlace dependencies/lib-string_theory/builder/CMakeLists.txt.in \
+      --replace-fail ${stringTheory.url} file://${stringTheory}
+    substituteInPlace dependencies/lib-magic_enum/getter/CMakeLists.txt.in \
+      --replace-fail ${magicEnum.url} file://${magicEnum}
+  '';
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    cmake
+    python3
+    rustPlatform.cargoSetupHook
+    cargo
+    rustc
+  ];
+
+  buildInputs = [
+    SDL2
+    fltk
+    lua5_3
+    rapidjson
+    sol2
+    gtest
+  ];
+
+  cargoRoot = "rust";
+
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit
+      pname
+      version
+      src
+      cargoRoot
+      ;
+    hash = "sha256-5KZa5ocn6Q4qUeRmm7Tymgg09dr6aZoAuJvtF32CXNg=";
+  };
+
+  cmakeFlags = [
+    (lib.cmakeBool "FLTK_SKIP_FLUID" true) # otherwise `find_package(FLTK)` fails
+    (lib.cmakeBool "LOCAL_LUA_LIB" false)
+    (lib.cmakeBool "LOCAL_MINIAUDIO_LIB" false)
+    (lib.cmakeFeature "MINIAUDIO_INCLUDE_DIR" "${miniaudio}")
+    (lib.cmakeBool "LOCAL_RAPIDJSON_LIB" false)
+    (lib.cmakeBool "LOCAL_SOL_LIB" false)
+    (lib.cmakeBool "LOCAL_GTEST_LIB" false)
+    (lib.cmakeFeature "EXTRA_DATA_DIR" "${placeholder "out"}/share/ja2")
+  ];
+
+  doInstallCheck = true;
+
+  installCheckPhase = ''
+    HOME=$(mktemp -d) $out/bin/ja2 -unittests
+  '';
+
+  meta = {
+    description = "Jagged Alliance 2, with community fixes";
+    license = "SFI Source Code license agreement";
+    homepage = "https://ja2-stracciatella.github.io/";
+    maintainers = [ ];
+  };
+}
@@ -10,7 +10,7 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "katawa-shoujo-re-engineered";
-  version = "1.4.9";
+  version = "2.0.0";

  src = fetchFromGitea {
    # GitHub mirror at fleetingheart/ksre
@@ -18,7 +18,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    owner = "fhs";
    repo = "katawa-shoujo-re-engineered";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-JrR1om7bvigVJbJKrKhfigpLvEGWTKzH8BNeNIYJrvA=";
+    hash = "sha256-JvwMbwbPWH3iLc03qCWknrK2kSC7D92rcdDpVpbaruM=";
  };

  desktopItems = [
@@ -5,14 +5,14 @@
  nixosTests,
 }:

-php.buildComposerProject (finalAttrs: {
+php.buildComposerProject2 (finalAttrs: {
  pname = "kimai";
  version = "2.28.0";

  src = fetchFromGitHub {
    owner = "kimai";
    repo = "kimai";
-    rev = finalAttrs.version;
+    tag = finalAttrs.version;
    hash = "sha256-z8NyPpaG6wNxQ7SSEdtVM/gFTOzxjclhE/Y++M4wN5I=";
  };

@@ -26,7 +26,6 @@ php.buildComposerProject (finalAttrs: {
        mbstring
        pdo
        tokenizer
-        xml
        xsl
        zip
      ])
@@ -39,7 +38,7 @@ php.buildComposerProject (finalAttrs: {
    '';
  };

-  vendorHash = "sha256-xa0vdlCxKe5QPsqVZ61HcUcxnYYbb7w+Qn3PBEmUkH0=";
+  vendorHash = "sha256-E0l6eeMlXFmsZ1v27/v4DbbmiINxXf+t2H/Xcr/hocs=";

  composerNoPlugins = false;
  composerNoScripts = false;
@@ -9,11 +9,11 @@

 stdenvNoCC.mkDerivation rec {
  pname = "komga";
-  version = "1.18.0";
+  version = "1.19.0";

  src = fetchurl {
    url = "https://github.com/gotson/${pname}/releases/download/${version}/${pname}-${version}.jar";
-    sha256 = "sha256-I0xJfX0f1srIjiitBt5EN6j/pOCvfGUIwxCt5sT2UuY=";
+    sha256 = "sha256-9klOS9VFKMiOWihJkXdk5/GTW6oRVrmSAKwK7es6IhM=";
  };

  nativeBuildInputs = [
@@ -6,17 +6,17 @@

 buildGoModule rec {
  pname = "kuttl";
-  version = "0.20.0";
+  version = "0.21.0";
  cli = "kubectl-kuttl";

  src = fetchFromGitHub {
    owner = "kudobuilder";
    repo = "kuttl";
    rev = "v${version}";
-    sha256 = "sha256-RZmylvf4q1JD8EAnxiFVfu9Q/ya1TXnbZhn4RguehII=";
+    sha256 = "sha256-0eETF9kf5e0E7R9CEANZC854r7/P/wjxeVgx90TdRFg=";
  };

-  vendorHash = "sha256-XdHgPN0gE1ie4kxqmZQgxlV+RUddu6OPbqWwIHAw6Hc=";
+  vendorHash = "sha256-QYdeYmp++sAvgDPWpEscfm4n0lRejLTPZPGbVPCoWmk=";

  subPackages = [ "cmd/kubectl-kuttl" ];

@@ -0,0 +1,77 @@
+{
+  lib,
+  buildNpmPackage,
+  fetchFromGitHub,
+  callPackage,
+  testers,
+  runCommand,
+  writeText,
+  nix-update-script,
+  lessc,
+}:
+
+buildNpmPackage rec {
+  pname = "lessc";
+  version = "4.2.0";
+
+  src = fetchFromGitHub {
+    owner = "less";
+    repo = "less.js";
+    rev = "v${version}";
+    hash = "sha256-pOTKw+orCl2Y8lhw5ZyAqjFJDoka7uG7V5ae6RS1yqw=";
+  };
+  sourceRoot = "${src.name}/packages/less";
+
+  npmDepsHash = "sha256-oPE2lo/lMiU8cnOciPW/gwzOtiehl9MGNncCrq1Hk+g=";
+
+  postPatch = ''
+    sed -i ./package.json \
+      -e '/@less\/test-data/d' \
+      -e '/@less\/test-import-module/d'
+  '';
+
+  env.PUPPETEER_SKIP_DOWNLOAD = 1;
+
+  passthru = {
+    updateScript = nix-update-script { };
+    plugins = callPackage ./plugins { };
+    wrapper = callPackage ./wrapper { };
+    withPlugins = fn: lessc.wrapper.override { plugins = fn lessc.plugins; };
+    tests = {
+      version = testers.testVersion { package = lessc; };
+
+      simple = testers.testEqualContents {
+        assertion = "lessc compiles a basic less file";
+        expected = writeText "expected" ''
+          body h1 {
+            color: red;
+          }
+        '';
+        actual =
+          runCommand "actual"
+            {
+              nativeBuildInputs = [ lessc ];
+              base = writeText "base" ''
+                @color: red;
+                body {
+                  h1 {
+                    color: @color;
+                  }
+                }
+              '';
+            }
+            ''
+              lessc $base > $out
+            '';
+      };
+    };
+  };
+
+  meta = {
+    homepage = "https://github.com/less/less.js";
+    description = "Dynamic stylesheet language";
+    mainProgram = "lessc";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ lelgenio ];
+  };
+}
@@ -0,0 +1,61 @@
+{
+  lib,
+  buildNpmPackage,
+  fetchFromGitHub,
+  testers,
+  runCommand,
+  writeText,
+  lessc,
+}:
+
+buildNpmPackage {
+  pname = "less-plugin-clean-css";
+  version = "1.6.0";
+
+  src = fetchFromGitHub {
+    owner = "less";
+    repo = "less-plugin-clean-css";
+    rev = "b2c3886b7af67ab45a5568e7758bbc2d5b82b112";
+    hash = "sha256-dYYcaCLTwAI2T7cWCfiK866Azrw4fnzTE/mkUA6HUFo=";
+  };
+
+  npmDepsHash = "sha256-uAYXFxOoUo8tLrYqNeUFMRuaYp2GArGMLaaes1QhLp4=";
+
+  dontNpmBuild = true;
+
+  passthru = {
+    updateScript = ./update.sh;
+    tests = {
+      simple = testers.testEqualContents {
+        assertion = "lessc compiles a basic less file";
+        expected = writeText "expected" ''
+          body h1{color:red}
+        '';
+        actual =
+          runCommand "actual"
+            {
+              nativeBuildInputs = [ (lessc.withPlugins (p: [ p.clean-css ])) ];
+              base = writeText "base" ''
+                @color: red;
+                body {
+                  h1 {
+                    color: @color;
+                  }
+                }
+              '';
+            }
+            ''
+              lessc $base --clean-css="--s1 --advanced" > $out
+              printf "\n" >> $out
+            '';
+      };
+    };
+  };
+
+  meta = {
+    homepage = "https://github.com/less/less-plugin-clean-css";
+    description = " Post-process and compress CSS using clean-css";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ lelgenio ];
+  };
+}
@@ -0,0 +1,31 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl jq common-updater-scripts nodejs prefetch-npm-deps sd
+
+set -xeu -o pipefail
+
+PACKAGE_DIR="$(realpath "$(dirname "$0")")"
+cd "$PACKAGE_DIR/.."
+while ! test -f flake.nix; do cd .. ; done
+NIXPKGS_DIR="$PWD"
+
+latest_commit="$(
+  curl -L -s ${GITHUB_TOKEN:+-u ":${GITHUB_TOKEN}"} https://api.github.com/repos/less/less-plugin-clean-css/branches/master \
+  | jq -r .commit.sha
+)"
+
+# This repository does not report it's version in tags
+version="$(
+  curl https://raw.githubusercontent.com/less/less-plugin-clean-css/$latest_commit/package.json \
+  | jq -r .version
+)"
+update-source-version lessc.plugins.clean-css "$version" --rev=$latest_commit
+
+src="$(nix-build --no-link "$NIXPKGS_DIR" -A lessc.plugins.clean-css.src)"
+
+prev_npm_hash="$(
+  nix-instantiate "$NIXPKGS_DIR" \
+  --eval --json -A lessc.plugins.clean-css.npmDepsHash \
+  | jq -r .
+)"
+new_npm_hash="$(prefetch-npm-deps "$src/package-lock.json")"
+sd --fixed-strings "$prev_npm_hash" "$new_npm_hash" "$PACKAGE_DIR/default.nix"
@@ -0,0 +1,4 @@
+{ callPackage }:
+{
+  clean-css = callPackage ./clean-css { };
+}
@@ -0,0 +1,27 @@
+{
+  lib,
+  stdenv,
+  makeWrapper,
+  lessc,
+  plugins ? [ ],
+}:
+
+stdenv.mkDerivation {
+  pname = "lessc-with-plugins";
+  nativeBuildInputs = [ makeWrapper ];
+  buildPhase = ''
+    mkdir -p $out/bin
+
+    makeWrapper "${lib.getExe lessc}" "$out/bin/lessc" \
+      --prefix NODE_PATH : "${lib.makeSearchPath "/lib/node_modules" plugins}"
+  '';
+
+  doUnpack = false;
+
+  inherit (lessc)
+    version
+    src
+    passthru
+    meta
+    ;
+}
@@ -0,0 +1,44 @@
+{
+  stdenv,
+  fetchFromGitHub,
+  fetchpatch,
+  lib,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  name = "lib45d";
+  version = "0.3.6";
+  src = fetchFromGitHub {
+    owner = "45Drives";
+    repo = "lib45d";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-42xB30Iu2WxNrBxomVBKd/uyIRt27y/Y1ah5mckOrc0=";
+  };
+
+  patches = [
+    # https://github.com/45Drives/lib45d/issues/3
+    # fix "error: 'uintmax_t' has not been declared" build failure until next release
+    (fetchpatch {
+      url = "https://github.com/45Drives/lib45d/commit/a607e278182a3184c004c45c215aa22c15d6941d.patch";
+      hash = "sha256-sMAvOp4EjBXGHa9PGuuEqJvpEvUlMuzRKCfq9oqQLgY=";
+    })
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm755 -t $out/lib dist/shared/lib45d.so
+
+    mkdir -p $out/include/45d
+    cp -f -r src/incl/45d/* $out/include/45d/
+
+    runHook postInstall
+  '';
+
+  meta = {
+    homepage = "https://github.com/45Drives/lib45d";
+    description = "45Drives C++ Library";
+    license = lib.licenses.gpl3;
+    maintainers = with lib.maintainers; [ philipwilk ];
+    platforms = lib.platforms.linux;
+  };
+})
@@ -6,11 +6,11 @@

 let
  pname = "librewolf-bin";
-  upstreamVersion = "134.0-1";
+  upstreamVersion = "134.0.1-1";
  version = lib.replaceStrings [ "-" ] [ "." ] upstreamVersion;
  src = fetchurl {
    url = "https://gitlab.com/api/v4/projects/24386000/packages/generic/librewolf/${upstreamVersion}/LibreWolf.x86_64.AppImage";
-    hash = "sha256-WlI0a2Sb59O6QGZ59vseTeDIkzyJd4/VIZ/qTFcLWm0=";
+    hash = "sha256-AZSIHs8m0Y5CWE9C1MyQReOIxkrl3QvLhHx+n41hlIk=";
  };
  appimageContents = appimageTools.extract { inherit pname version src; };
 in
@@ -2,13 +2,17 @@
  lib,
  fetchFromGitHub,
  buildNpmPackage,
-  electron,
+  electron_33,
  makeWrapper,
  testers,
  mattermost-desktop,
  nix-update-script,
 }:

+let
+  electron = electron_33;
+in
+
 buildNpmPackage rec {
  pname = "mattermost-desktop";
  version = "5.10.2";
@@ -7,17 +7,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "microfetch";
-  version = "0.4.4";
+  version = "0.4.6";

  src = fetchFromGitHub {
    owner = "NotAShelf";
    repo = "microfetch";
    tag = "v${version}";
-    hash = "sha256-SY7Eln0Hwj0VWqzzYfqsVpAMES+SCiZkLgNZR3a8d7A=";
+    hash = "sha256-qpwzuzEqXsGO4y3ClaY25Q4rFm2RyPl/X3yNcQz3R4E=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-fHIQK1zsYuKj2ps6tmzqGwX8woiuIQx0yiyWdMf2Fnw=";
+  cargoHash = "sha256-UguHTRHdcogxg/8DmRWSE7XwmaF36MTGHzF5CpMBc3Y=";

  passthru.updateScript = nix-update-script { };

@@ -0,0 +1,39 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  versionCheckHook,
+  testers,
+  nix-update-script,
+  moonpalace,
+}:
+buildGoModule rec {
+  pname = "moonpalace";
+  version = "0.12.0";
+
+  src = fetchFromGitHub {
+    owner = "MoonshotAI";
+    repo = "moonpalace";
+    tag = "v${version}";
+    hash = "sha256-30ibs49srFwTsnjbtvLUNQ79yA/vZJdlHQZ8ERi5lls=";
+  };
+  vendorHash = "sha256-e5G+28cgUJvUpS1CX/Tinn3gDK8fNEcJi8uv9xMR+5o=";
+
+  passthru = {
+    tests.version = testers.testVersion {
+      package = moonpalace;
+      version = "v${moonpalace.version}";
+      command = "HOME=$(mktemp -d) moonpalace --version";
+    };
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "An API debugging tool provided by Moonshot AI";
+    homepage = "https://github.com/MoonshotAI/moonpalace";
+    changelog = "https://github.com/MoonshotAI/moonpalace/releases/tag/v${version}";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ xiaoxiangmoe ];
+    mainProgram = "moonpalace";
+  };
+}
@@ -33,6 +33,7 @@ stdenv.mkDerivation (finalAttrs: {
    gzip
    perl
    jq
+    lua5_3 # luac is needed for cross builds
  ];
  preConfigure = ''
    env MYMPD_BUILDDIR=$PWD/build ./build.sh createassets
@@ -59,6 +60,8 @@ stdenv.mkDerivation (finalAttrs: {
  # 5 tests out of 23 fail, probably due to the sandbox...
  doCheck = false;

+  strictDeps = true;
+
  passthru.tests = { inherit (nixosTests) mympd; };

  meta = {
@@ -80,7 +80,8 @@ rustPlatform.buildRustPackage rec {

  env = {
    GEN_ARTIFACTS = "artifacts";
-    LIBGIT2_NO_VENDOR = 1;
+    # FIXME: our libgit2 is currently too new
+    # LIBGIT2_NO_VENDOR = 1;
    NIX = lib.getExe nix;
    NURL = lib.getExe nurl;
    ZSTD_SYS_USE_PKG_CONFIG = true;
@@ -17,11 +17,12 @@ nixos-rebuild - reconfigure a NixOS machine

 # SYNOPSIS

+; document here only non-deprecated flags
 _nixos-rebuild_ \[--verbose] [--max-jobs MAX_JOBS] [--cores CORES] [--log-format LOG_FORMAT] [--keep-going] [--keep-failed] [--fallback] [--repair] [--option OPTION OPTION] [--builders BUILDERS]++
 	\[--include INCLUDE] [--quiet] [--print-build-logs] [--show-trace] [--accept-flake-config] [--refresh] [--impure] [--offline] [--no-net] [--recreate-lock-file]++
 	\[--no-update-lock-file] [--no-write-lock-file] [--no-registries] [--commit-lock-file] [--update-input UPDATE_INPUT] [--override-input OVERRIDE_INPUT OVERRIDE_INPUT]++
 	\[--no-build-output] [--use-substitutes] [--help] [--file FILE] [--attr ATTR] [--flake [FLAKE]] [--no-flake] [--install-bootloader] [--profile-name PROFILE_NAME]++
-	\[--specialisation SPECIALISATION] [--rollback] [--upgrade] [--upgrade-all] [--json] [--ask-sudo-password] [--sudo] [--fast]++
+	\[--specialisation SPECIALISATION] [--rollback] [--upgrade] [--upgrade-all] [--json] [--ask-sudo-password] [--sudo] [--no-reexec]++
 	\[--image-variant VARIANT]++
 	\[--build-host BUILD_HOST] [--target-host TARGET_HOST]++
 	\[{switch,boot,test,build,edit,repl,dry-build,dry-run,dry-activate,build-image,build-vm,build-vm-with-bootloader,list-generations}]
@@ -170,7 +171,7 @@ It must be one of the following:
 	Causes the boot loader to be (re)installed on the device specified by
 	the relevant configuration options.

-*--fast*
+*--no-reexec*
 	Normally, *nixos-rebuild* first finds and builds itself from the
 	_config.system.build.nixos-rebuild_ attribute from the current user
 	channel or flake and exec into it. This allows *nixos-rebuild* to run
@@ -18,7 +18,7 @@ logger.setLevel(logging.INFO)


 def get_parser() -> tuple[argparse.ArgumentParser, dict[str, argparse.ArgumentParser]]:
-    common_flags = argparse.ArgumentParser(add_help=False)
+    common_flags = argparse.ArgumentParser(add_help=False, allow_abbrev=False)
    common_flags.add_argument(
        "--verbose",
        "-v",
@@ -37,13 +37,13 @@ def get_parser() -> tuple[argparse.ArgumentParser, dict[str, argparse.ArgumentPa
    common_flags.add_argument("--repair", action="store_true")
    common_flags.add_argument("--option", nargs=2, action="append")

-    common_build_flags = argparse.ArgumentParser(add_help=False)
+    common_build_flags = argparse.ArgumentParser(add_help=False, allow_abbrev=False)
    common_build_flags.add_argument("--builders")
    common_build_flags.add_argument("--include", "-I", action="append")
    common_build_flags.add_argument("--print-build-logs", "-L", action="store_true")
    common_build_flags.add_argument("--show-trace", action="store_true")

-    flake_common_flags = argparse.ArgumentParser(add_help=False)
+    flake_common_flags = argparse.ArgumentParser(add_help=False, allow_abbrev=False)
    flake_common_flags.add_argument("--accept-flake-config", action="store_true")
    flake_common_flags.add_argument("--refresh", action="store_true")
    flake_common_flags.add_argument("--impure", action="store_true")
@@ -57,10 +57,10 @@ def get_parser() -> tuple[argparse.ArgumentParser, dict[str, argparse.ArgumentPa
    flake_common_flags.add_argument("--update-input", action="append")
    flake_common_flags.add_argument("--override-input", nargs=2, action="append")

-    classic_build_flags = argparse.ArgumentParser(add_help=False)
+    classic_build_flags = argparse.ArgumentParser(add_help=False, allow_abbrev=False)
    classic_build_flags.add_argument("--no-build-output", "-Q", action="store_true")

-    copy_flags = argparse.ArgumentParser(add_help=False)
+    copy_flags = argparse.ArgumentParser(add_help=False, allow_abbrev=False)
    copy_flags.add_argument(
        "--use-substitutes",
        "--substitute-on-destination",
@@ -166,10 +166,15 @@ def get_parser() -> tuple[argparse.ArgumentParser, dict[str, argparse.ArgumentPa
        help="Deprecated, use '--sudo' instead",
    )
    main_parser.add_argument("--no-ssh-tty", action="store_true", help="Deprecated")
+    main_parser.add_argument(
+        "--no-reexec",
+        action="store_true",
+        help="Do not update nixos-rebuild in-place (also known as re-exec) before build",
+    )
    main_parser.add_argument(
        "--fast",
        action="store_true",
-        help="Skip possibly expensive operations",
+        help="Deprecated, use '--no-reexec' instead",
    )
    main_parser.add_argument("--build-host", help="Specifies host to perform the build")
    main_parser.add_argument(
@@ -223,23 +228,23 @@ def parse_args(
    if args.ask_sudo_password:
        args.sudo = True

-    # TODO: use deprecated=True in Python >=3.13
    if args.install_grub:
-        parser_warn("--install-grub deprecated, use --install-bootloader instead")
+        parser_warn("--install-grub is deprecated, use --install-bootloader instead")
        args.install_bootloader = True

-    # TODO: use deprecated=True in Python >=3.13
    if args.use_remote_sudo:
-        parser_warn("--use-remote-sudo deprecated, use --sudo instead")
+        parser_warn("--use-remote-sudo is deprecated, use --sudo instead")
        args.sudo = True

-    # TODO: use deprecated=True in Python >=3.13
+    if args.fast:
+        parser_warn("--fast is deprecated, use --no-reexec instead")
+        args.no_reexec = True
+
    if args.no_ssh_tty:
-        parser_warn("--no-ssh-tty deprecated, SSH's TTY is never used anymore")
+        parser_warn("--no-ssh-tty is deprecated, SSH's TTY is never used anymore")

-    # TODO: use deprecated=True in Python >=3.13
    if args.no_build_nix:
-        parser_warn("--no-build-nix deprecated, we do not build nix anymore")
+        parser_warn("--no-build-nix is deprecated, we do not build nix anymore")

    if args.action == Action.EDIT.value and (args.file or args.attr):
        parser.error("--file and --attr are not supported with 'edit'")
@@ -351,7 +356,7 @@ def execute(argv: list[str]) -> None:
    if (
        WITH_REEXEC
        and can_run
-        and not args.fast
+        and not args.no_reexec
        and not os.environ.get("_NIXOS_REBUILD_REEXEC")
    ):
        reexec(argv, args, build_flags, flake_build_flags)
@@ -144,7 +144,7 @@ def test_execute_nix_boot(mock_run: Any, tmp_path: Path) -> None:

    mock_run.side_effect = run_side_effect

-    nr.execute(["nixos-rebuild", "boot", "--no-flake", "-vvv", "--fast"])
+    nr.execute(["nixos-rebuild", "boot", "--no-flake", "-vvv", "--no-reexec"])

    assert mock_run.call_count == 6
    mock_run.assert_has_calls(
@@ -222,7 +222,7 @@ def test_execute_nix_build_vm(mock_run: Any, tmp_path: Path) -> None:
            "nixos-config=./configuration.nix",
            "-I",
            "nixpkgs=$HOME/.nix-defexpr/channels/pinned_nixpkgs",
-            "--fast",
+            "--no-reexec",
        ]
    )

@@ -340,7 +340,7 @@ def test_execute_nix_switch_flake(mock_run: Any, tmp_path: Path) -> None:
            "--install-bootloader",
            "--sudo",
            "--verbose",
-            "--fast",
+            "--no-reexec",
            # https://github.com/NixOS/nixpkgs/issues/374050
            "--option",
            "narinfo-cache-negative-ttl",
@@ -418,7 +418,7 @@ def test_execute_nix_switch_flake_target_host(
            "--use-remote-sudo",
            "--target-host",
            "user@localhost",
-            "--fast",
+            "--no-reexec",
        ]
    )

@@ -508,7 +508,7 @@ def test_execute_nix_switch_flake_build_host(
            "/path/to/config#hostname",
            "--build-host",
            "user@localhost",
-            "--fast",
+            "--no-reexec",
        ]
    )

@@ -587,7 +587,7 @@ def test_execute_switch_rollback(mock_run: Any, tmp_path: Path) -> None:
    nixpkgs_path.touch()

    nr.execute(
-        ["nixos-rebuild", "switch", "--rollback", "--install-bootloader", "--fast"]
+        ["nixos-rebuild", "switch", "--rollback", "--install-bootloader", "--no-reexec"]
    )

    assert mock_run.call_count >= 2
@@ -625,7 +625,7 @@ def test_execute_build(mock_run: Any, tmp_path: Path) -> None:
        CompletedProcess([], 0, str(config_path)),
    ]

-    nr.execute(["nixos-rebuild", "build", "--no-flake", "--fast"])
+    nr.execute(["nixos-rebuild", "build", "--no-flake", "--no-reexec"])

    assert mock_run.call_count == 1
    mock_run.assert_has_calls(
@@ -659,7 +659,7 @@ def test_execute_test_flake(mock_run: Any, tmp_path: Path) -> None:
    mock_run.side_effect = run_side_effect

    nr.execute(
-        ["nixos-rebuild", "test", "--flake", "github:user/repo#hostname", "--fast"]
+        ["nixos-rebuild", "test", "--flake", "github:user/repo#hostname", "--no-reexec"]
    )

    assert mock_run.call_count == 2
@@ -712,7 +712,7 @@ def test_execute_test_rollback(
    mock_run.side_effect = run_side_effect

    nr.execute(
-        ["nixos-rebuild", "test", "--rollback", "--profile-name", "foo", "--fast"]
+        ["nixos-rebuild", "test", "--rollback", "--profile-name", "foo", "--no-reexec"]
    )

    assert mock_run.call_count == 2
@@ -20,7 +20,7 @@ from .helpers import get_qualified_name
    autospec=True,
    return_value=CompletedProcess([], 0, stdout=" \n/path/to/file\n "),
 )
-def test_build(mock_run: Any, monkeypatch: Any) -> None:
+def test_build(mock_run: Any) -> None:
    assert n.build(
        "config.system.build.attr",
        m.BuildAttr("<nixpkgs/nixos>", None),
@@ -79,7 +79,7 @@ def test_build_flake(mock_run: Any, monkeypatch: MonkeyPatch, tmpdir: Path) -> N

@patch(get_qualified_name(n.run_wrapper, n), autospec=True)
@patch(get_qualified_name(n.uuid4, n), autospec=True)
-def test_build_remote(mock_uuid4: Any, mock_run: Any, monkeypatch: Any) -> None:
+def test_build_remote(mock_uuid4: Any, mock_run: Any, monkeypatch: MonkeyPatch) -> None:
    build_host = m.Remote("user@host", [], None)
    monkeypatch.setenv("NIX_SSHOPTS", "--ssh opts")

@@ -226,7 +226,7 @@ def test_build_remote_flake(
    )


-def test_copy_closure(monkeypatch: Any) -> None:
+def test_copy_closure(monkeypatch: MonkeyPatch) -> None:
    closure = Path("/path/to/closure")
    with patch(get_qualified_name(n.run_wrapper, n), autospec=True) as mock_run:
        n.copy_closure(closure, None)
@@ -290,7 +290,7 @@ def test_copy_closure(monkeypatch: Any) -> None:


@patch(get_qualified_name(n.run_wrapper, n), autospec=True)
-def test_edit(mock_run: Any, monkeypatch: Any, tmpdir: Any) -> None:
+def test_edit(mock_run: Any, monkeypatch: MonkeyPatch, tmpdir: Path) -> None:
    # Flake
    flake = m.Flake.parse(f"{tmpdir}#attr")
    n.edit(flake, {"commit_lock_file": True})
@@ -309,8 +309,8 @@ def test_edit(mock_run: Any, monkeypatch: Any, tmpdir: Any) -> None:

    # Classic
    with monkeypatch.context() as mp:
-        default_nix = tmpdir.join("default.nix")
-        default_nix.write("{}")
+        default_nix = tmpdir / "default.nix"
+        default_nix.write_text("{}", encoding="utf-8")

        mp.setenv("NIXOS_CONFIG", str(tmpdir))
        mp.setenv("EDITOR", "editor")
@@ -333,7 +333,7 @@ def test_edit(mock_run: Any, monkeypatch: Any, tmpdir: Any) -> None:
        """,
    ),
 )
-def test_get_build_image_variants(mock_run: Any) -> None:
+def test_get_build_image_variants(mock_run: Any, tmp_path: Path) -> None:
    build_attr = m.BuildAttr("<nixpkgs/nixos>", None)
    assert n.get_build_image_variants(build_attr) == {
        "azure": "nixos-image-azure-25.05.20250102.6df2492-x86_64-linux.vhd",
@@ -357,7 +357,7 @@ def test_get_build_image_variants(mock_run: Any) -> None:
        stdout=PIPE,
    )

-    build_attr = m.BuildAttr(Path("/tmp"), "preAttr")
+    build_attr = m.BuildAttr(Path(tmp_path), "preAttr")
    assert n.get_build_image_variants(build_attr, {"inst_flag": True}) == {
        "azure": "nixos-image-azure-25.05.20250102.6df2492-x86_64-linux.vhd",
        "vmware": "nixos-image-vmware-25.05.20250102.6df2492-x86_64-linux.vmdk",
@@ -369,10 +369,10 @@ def test_get_build_image_variants(mock_run: Any) -> None:
            "--strict",
            "--json",
            "--expr",
-            textwrap.dedent("""
+            textwrap.dedent(f"""
            let
-              value = import "/tmp";
-              set = if builtins.isFunction value then value {} else value;
+              value = import "{tmp_path}";
+              set = if builtins.isFunction value then value {{}} else value;
            in
              builtins.mapAttrs (n: v: v.passthru.filePath) set.preAttr.config.system.build.images
            """),
@@ -687,7 +687,7 @@ def test_set_profile(mock_run: Any) -> None:


@patch(get_qualified_name(n.run_wrapper, n), autospec=True)
-def test_switch_to_configuration(mock_run: Any, monkeypatch: Any) -> None:
+def test_switch_to_configuration(mock_run: Any, monkeypatch: MonkeyPatch) -> None:
    profile_path = Path("/path/to/profile")
    config_path = Path("/path/to/config")

@@ -1,6 +1,8 @@
 from typing import Any
 from unittest.mock import patch

+from pytest import MonkeyPatch
+
 import nixos_rebuild.models as m
 import nixos_rebuild.process as p

@@ -94,7 +96,7 @@ def test_run(mock_run: Any) -> None:
    )


-def test_remote_from_name(monkeypatch: Any) -> None:
+def test_remote_from_name(monkeypatch: MonkeyPatch) -> None:
    monkeypatch.setenv("NIX_SSHOPTS", "")
    assert m.Remote.from_arg("user@localhost", None, False) == m.Remote(
        "user@localhost",
@@ -13,7 +13,7 @@
 }:
 let
  pname = "obsidian";
-  version = "1.8.3";
+  version = "1.8.4";
  appname = "Obsidian";
  meta = with lib; {
    description = "Powerful knowledge base that works on top of a local folder of plain text Markdown files";
@@ -37,9 +37,9 @@ let
    url = "https://github.com/obsidianmd/obsidian-releases/releases/download/v${version}/${filename}";
    hash =
      if stdenv.hostPlatform.isDarwin then
-        "sha256-SqeCnS2Ncz8y1F+YAzAfBlsAgSaaMfmMcCjke9/UbXQ="
+        "sha256-kg0gH4LW78uKUxnvE1CG8B1BvJzyO8vlP6taLvmGw/s="
      else
-        "sha256-t5iZOA/cFJpn9OtbutQ6gJ6SVkG0QljnJZ931YnGc54=";
+        "sha256-bvmvzVyHrjh1Yj3JxEfry521CMX3E2GENmXddEeLwiE=";
  };

  icon = fetchurl {
@@ -13,18 +13,18 @@

 rustPlatform.buildRustPackage rec {
  pname = "openpgp-card-tools";
-  version = "0.11.7";
+  version = "0.11.8";

  src = fetchFromGitea {
    domain = "codeberg.org";
    owner = "openpgp-card";
    repo = "openpgp-card-tools";
    rev = "v${version}";
-    hash = "sha256-sR+jBCSuDH4YdJz3YuvA4EE36RHV3m/xU8hIEXXsqKo=";
+    hash = "sha256-pE7AAgps8LlsmM97q/XIi7If1UwNP/0uJH9wOeZ6neM=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-WFh6blk0sdpDVBsiQVXtXzVQBjAKJ2995PQ4voqxm+A=";
+  cargoHash = "sha256-/OC/+eMRBF2MICVUtsJR0m62fWLP0lr10J/XkKGcPnA=";

  nativeBuildInputs = [
    installShellFiles
@@ -6,7 +6,7 @@
  versionCheckHook,
 }:
 let
-  version = "1.2.7";
+  version = "1.3.0";
 in
 rustPlatform.buildRustPackage {
  pname = "patchy";
@@ -16,10 +16,10 @@ rustPlatform.buildRustPackage {
    owner = "nik-rev";
    repo = "patchy";
    tag = "v${version}";
-    hash = "sha256-Npb+qcguxZAvWggJC5NtxCeUCU/nOtjCbK5gfkDTkfw=";
+    hash = "sha256-7WAdfbnvsmaD8fMCJQ8dQenCDmLLxjVTj2DGcAhMxcg=";
  };
  useFetchCargoVendor = true;
-  cargoHash = "sha256-+0hgG+PcxZQGgen969cnQcaGW47tDVGCCoiK/31YI0M=";
+  cargoHash = "sha256-QaFIu7YVixQsDGL5fjQ3scKMyr0hw8lEWVc80EMTBB8=";

  nativeInstallCheckInputs = [ versionCheckHook ];
  versionCheckProgramArg = "--version";
@@ -6,13 +6,13 @@

 buildGoModule rec {
  pname = "protoc-gen-go";
-  version = "1.36.3";
+  version = "1.36.4";

  src = fetchFromGitHub {
    owner = "protocolbuffers";
    repo = "protobuf-go";
    rev = "v${version}";
-    hash = "sha256-yzrdZMWl5MBOAGCXP1VxVZNLCSFUWEURVYiDhRKSSRc=";
+    hash = "sha256-lDhg72i/5J4PMsdMPBthEpV3gFqr+ds3O4+rj6AZoMs=";
  };

  vendorHash = "sha256-nGI/Bd6eMEoY0sBwWEtyhFowHVvwLKjbT4yfzFz6Z3E=";
@@ -12,19 +12,19 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "raycast";
-  version = "1.89.0";
+  version = "1.90.0";

  src =
    {
      aarch64-darwin = fetchurl {
        name = "Raycast.dmg";
        url = "https://releases.raycast.com/releases/${finalAttrs.version}/download?build=arm";
-        hash = "sha256-v/0Sg7f/pf7wt7r0+ewSXGKgBqMFnOwldKQUwKQ8Fz0=";
+        hash = "sha256-3++hipn/7dJKQhY1gh8v/OsY+R316n5EJcEcmOheYnM=";
      };
      x86_64-darwin = fetchurl {
        name = "Raycast.dmg";
        url = "https://releases.raycast.com/releases/${finalAttrs.version}/download?build=x86_64";
-        hash = "sha256-UIdoFcnXeCpf1CSBTmdxkP5uKz+WoJt5u5u6MXCqnG4=";
+        hash = "sha256-qa4ESWW6voh45Kl0ydL6kyTwH8MNUNnyRSlFJcu3trI=";
      };
    }
    .${stdenvNoCC.system} or (throw "raycast: ${stdenvNoCC.system} is unsupported.");
@@ -0,0 +1,16 @@
+diff --git a/renpy/common/00steam.rpy b/renpy/common/00steam.rpy
+index 9a5f9c405..68c8c26e0 100644
+--- a/renpy/common/00steam.rpy
+++ b/renpy/common/00steam.rpy
+@@ -1029,11 +1029,6 @@ init -1499 python in achievement:
+             steam = None
+             steamapi = None
+ 
+-    if renpy.windows or renpy.macintosh or renpy.linux:
+-        steam_preinit()
+-        steam_init()
+-
+-
+ init 1500 python in achievement:
+ 
+     # Steam position.
@@ -16,6 +16,7 @@
  zlib,
  harfbuzz,
  makeWrapper,
+  withoutSteam ? true,
 }:

 let
@@ -90,7 +91,7 @@ stdenv.mkDerivation {
  patches = [
    ./shutup-erofs-errors.patch
    ./5687.patch
-  ];
+  ] ++ lib.optional withoutSteam ./noSteam.patch;

  postPatch = ''
    cp tutorial/game/tutorial_director.rpy{m,}
@@ -136,7 +137,5 @@ stdenv.mkDerivation {
    maintainers = with lib.maintainers; [ shadowrz ];
  };

-  passthru = {
-    inherit base_version vc_version;
-  };
+  passthru = { inherit base_version vc_version; };
 }
@@ -3,18 +3,18 @@
  fetchFromGitHub,
  lib,
 }:
-php.buildComposerProject (finalAttrs: {
+php.buildComposerProject2 (finalAttrs: {
  pname = "simplesamlphp";
  version = "1.19.7";

  src = fetchFromGitHub {
    owner = "simplesamlphp";
    repo = "simplesamlphp";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
    hash = "sha256-Qmy9fuZq8MBqvYV6/u3Dg92pHHicuUhdNeB22u4hwwA=";
  };

-  vendorHash = "sha256-FMFD0AXmD7Rq4d9+aNtGVk11YuOt40FWEqxvf+gBjmI=";
+  vendorHash = "sha256-kFRvOxSfqlM+xzFFlEm9YrbQDOvC4AA0BtztFQ1xxDU=";

  meta = {
    description = "SimpleSAMLphp is an application written in native PHP that deals with authentication (SQL, .htpasswd, YubiKey, LDAP, PAPI, Radius)";
@@ -12,16 +12,16 @@

 buildGoModule rec {
  pname = "sing-box";
-  version = "1.10.7";
+  version = "1.11.0";

  src = fetchFromGitHub {
    owner = "SagerNet";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-+0wzCFeQ0ZdjYKGQQcwBOAj3bGRHOaHeFMMg/hyXDGQ=";
+    hash = "sha256-or3RklqfrDIC2ZHJ7jDs1y+118/OsJiRKyDt1NCWqfI=";
  };

-  vendorHash = "sha256-Z3SGEDphy4U+AJzI7QSTEWG/T+U/FwTlP/zJN/mBAL0=";
+  vendorHash = "sha256-NWHDEN7aQWR3DXp9nFNhxDXFMeBsCk8/ZzCcT/zgwmI=";

  tags = [
    "with_quic"
@@ -8,7 +8,7 @@
 }:

 let
-  version = "1.1295.0";
+  version = "1.1295.2";
 in
 buildNpmPackage {
  pname = "snyk";
@@ -18,7 +18,7 @@ buildNpmPackage {
    owner = "snyk";
    repo = "cli";
    tag = "v${version}";
-    hash = "sha256-KFSEnNO1K1dAU8IIrWMOXtgoRmCaGeHdEUtU+bHjIOk=";
+    hash = "sha256-cHOIToO9xr+CNS0llwffaTUdhUqFbFcZcrPnBeD+JxE=";
  };

  npmDepsHash = "sha256-RuIavwtTbgo5Ni7oGH2i5VAcVxfS4wKKSX6qHD8CHIw=";
@@ -27,13 +27,13 @@

 stdenv.mkDerivation rec {
  pname = "tangram";
-  version = "3.1";
+  version = "3.3";

  src = fetchFromGitHub {
    owner = "sonnyp";
    repo = "Tangram";
    rev = "v${version}";
-    hash = "sha256-vN9zRc8Ac9SI0lIcuf01A2WLqLGtV3DUiNzCSmc2ri4=";
+    hash = "sha256-OtQN8Iigu92iKa7CAaslIpbS0bqJ9Vus++inrgV/eeM=";
    fetchSubmodules = true;
  };

@@ -10,13 +10,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "tippecanoe";
-  version = "2.74.0";
+  version = "2.75.0";

  src = fetchFromGitHub {
    owner = "felt";
    repo = "tippecanoe";
    rev = finalAttrs.version;
-    hash = "sha256-LOy9q2Qc47DQxPkAt2mmlmrJUcoL+hBpm0dFI4oZo/0=";
+    hash = "sha256-0ayEGmIUw5jI5utp689oxlFR15TeQ1gbLJIos4AXdd4=";
  };

  buildInputs = [
@@ -10,17 +10,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "tuisky";
-  version = "0.1.5";
+  version = "0.2.0";

  src = fetchFromGitHub {
    owner = "sugyan";
    repo = "tuisky";
    tag = "v${version}";
-    hash = "sha256-phadkJgSvizSNPvrVaYu/+y1uAj6fmb9JQLdj0dEQIg=";
+    hash = "sha256-s0eKWP4cga82Fj7KGIG6yLk67yOqGoAqfhvJINzytTw=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-nY+9DOdpFxVA16DTL47rDbbeBPSrXxlC1+APzb4Kkbk=";
+  cargoHash = "sha256-F/gEBEpcgNT0Q55zUTf8254yYIZI6RmiW9heCuljAEY=";

  nativeBuildInputs = [
    pkg-config
@@ -43,7 +43,7 @@ rustPlatform.buildRustPackage rec {
  meta = {
    description = "TUI client for bluesky";
    homepage = "https://github.com/sugyan/tuisky";
-    changelog = "https://github.com/sugyan/tuisky/blob/${lib.removePrefix "refs/tags/" src.rev}/CHANGELOG.md";
+    changelog = "https://github.com/sugyan/tuisky/blob/v${version}/CHANGELOG.md";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ GaetanLepage ];
    mainProgram = "tuisky";
@@ -17,17 +17,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "turbo-unwrapped";
-  version = "2.3.3";
+  version = "2.3.4";

  src = fetchFromGitHub {
    owner = "vercel";
    repo = "turbo";
    tag = "v${version}";
-    hash = "sha256-L51RgXUlA9hnVt232qdLo6t0kqXl7b01jotUk1r8wO0=";
+    hash = "sha256-cvwYBdvBxkntCXA4FJMc54Rca+zoZEjyWZUQoMH9Qdc=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-qv5bK65vA94M/YSjSRaYilg44NqkzF2ybmUVapu8cpI=";
+  cargoHash = "sha256-e9xq3xc8Rtuq3e/3IEwj9eR9SEj5N4bvsu4PFubm8mM=";

  nativeBuildInputs =
    [
@@ -17,17 +17,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "uv";
-  version = "0.5.25";
+  version = "0.5.26";

  src = fetchFromGitHub {
    owner = "astral-sh";
    repo = "uv";
    tag = version;
-    hash = "sha256-nDZaS3Yc7Z8gKyl2+HTpwoTTJKJDZCTQIiZazICvlvQ=";
+    hash = "sha256-Rp6DexvMbUdE7i8hik4MC2sW/VFmpxJFfF7ukc49VlE=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-GWlL5NZwHfkOfl16Eh38xo4OETmy/HFFeOZCGDruluI=";
+  cargoHash = "sha256-MZKrkxy7bXQ3lTrPwCRT8nAR8fP+SeZmBEMQrXlvkYo=";

  nativeBuildInputs = [
    cmake
@@ -51,5 +51,10 @@ python3Packages.buildPythonApplication {
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ happysalada ];
    mainProgram = "whisper-ctranslate2";
+    badPlatforms = [
+      # terminate called after throwing an instance of 'onnxruntime::OnnxRuntimeException'
+      #   what():  /build/source/include/onnxruntime/core/common/logging/logging.h:320 static const onnxruntime::logging::Logger& onnxruntime::logging::LoggingManager::DefaultLogger() Attempt to use DefaultLogger but none has been registered.
+      "aarch64-linux"
+    ];
  };
 }
@@ -95,7 +95,7 @@ let
 in
 rustPlatform.buildRustPackage rec {
  pname = "zed-editor";
-  version = "0.171.3";
+  version = "0.171.4";

  outputs = [ "out" ] ++ lib.optional buildRemoteServer "remote_server";

@@ -103,7 +103,7 @@ rustPlatform.buildRustPackage rec {
    owner = "zed-industries";
    repo = "zed";
    tag = "v${version}";
-    hash = "sha256-hUEZzN2rocWXxEFmtjB/7AZf+1kAGx8IZ3U57+Zi0EQ=";
+    hash = "sha256-DeZHXU106uqCyqjdF+rMdnFifra9ug9Dzosg+PcD8Nw=";
  };

  patches = [
@@ -123,7 +123,7 @@ rustPlatform.buildRustPackage rec {
  '';

  useFetchCargoVendor = true;
-  cargoHash = "sha256-s+SH6anGnYAPMDTD71QEclp8XM+ceyur3Anto0JOPyc=";
+  cargoHash = "sha256-uB6CM3KSr57sfbh81rXBhNq8LChme5+WHVIjwZrSso4=";

  nativeBuildInputs =
    [
@@ -29,13 +29,13 @@ in

 stdenv.mkDerivation (finalAttrs: {
  pname = "zipline";
-  version = "3.7.11";
+  version = "3.7.12";

  src = fetchFromGitHub {
    owner = "diced";
    repo = "zipline";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-sogsPx6vh+1+ew9o3/0B4yU9I/Gllo9XLJqvMvGZ89Q=";
+    hash = "sha256-i3IGcSxIhy8jmCMsDJGGszYoFsShBfbv7SjTQL1dDM0=";
  };

  patches = [
@@ -2,35 +2,22 @@
  lib,
  python3,
  fetchFromGitHub,
-  fetchpatch,
  deterministic-uname,
 }:
-
 python3.pkgs.buildPythonApplication rec {
  pname = "zxpy";
-  version = "1.6.3";
-  format = "pyproject";
+  version = "1.6.4";
+  pyproject = true;

  src = fetchFromGitHub {
    owner = "tusharsadhwani";
    repo = "zxpy";
-    rev = version;
-    hash = "sha256-/sOLSIqaAUkaAghPqe0Zoq7C8CSKAd61o8ivtjJFcJY=";
+    tag = version;
+    hash = "sha256-/VITHN517lPUmhLYgJHBYYvvlJdGg2Hhnwk47Mp9uc0=";
  };

-  patches = [
-    # fix test caused by `uname -p` printing unknown
-    # https://github.com/tusharsadhwani/zxpy/pull/53
-    (fetchpatch {
-      name = "allow-unknown-processor-in-injection-test.patch";
-      url = "https://github.com/tusharsadhwani/zxpy/commit/95ad80caddbab82346f60ad80a601258fd1238c9.patch";
-      hash = "sha256-iXasOKjWuxNjjTpb0umNMNhbFgBjsu5LsOpTaXllATM=";
-    })
-  ];
-
-  nativeBuildInputs = [
+  build-system = [
    python3.pkgs.setuptools
-    python3.pkgs.wheel
  ];

  nativeCheckInputs = [
@@ -44,12 +31,12 @@ python3.pkgs.buildPythonApplication rec {

  pythonImportsCheck = [ "zx" ];

-  meta = with lib; {
+  meta = {
    description = "Shell scripts made simple";
    homepage = "https://github.com/tusharsadhwani/zxpy";
    changelog = "https://github.com/tusharsadhwani/zxpy/releases/tag/${version}";
-    license = licenses.mit;
-    maintainers = with maintainers; [ figsoda ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ figsoda ];
    mainProgram = "zxpy";
  };
 }
@@ -0,0 +1,240 @@
+From 9c2a6a6349f705017e3c8a34daa4ba1805586498 Mon Sep 17 00:00:00 2001
+From: OPNA2608 <opna2608@protonmail.com>
+Date: Thu, 30 Jan 2025 14:53:02 +0100
+Subject: [PATCH] tests/unit/secret-agent/test-secret-agent: Make sure signal
+ emitted on agent startup doesn't leak into tests
+
+---
+ tests/unit/secret-agent/test-secret-agent.cpp | 116 ++++++++++--------
+ 1 file changed, 67 insertions(+), 49 deletions(-)
+
+diff --git a/tests/unit/secret-agent/test-secret-agent.cpp b/tests/unit/secret-agent/test-secret-agent.cpp
+index 1f1cd7e9..9c72e251 100644
+--- a/tests/unit/secret-agent/test-secret-agent.cpp
+++ b/tests/unit/secret-agent/test-secret-agent.cpp
+@@ -29,6 +29,16 @@
+ #include <lomiri/gmenuharness/MatchUtils.h>
+ #include <lomiri/gmenuharness/MenuMatcher.h>
+ 
+#define WAIT_FOR_SIGNALS(signalSpy, signalsExpected)\
+{\
+	while (signalSpy.size() < signalsExpected)\
+	{\
+		ASSERT_TRUE(signalSpy.wait()) << "Waiting for " << signalsExpected << " signals, got " << signalSpy.size();\
+	}\
+	ASSERT_EQ(signalsExpected, signalSpy.size()) << "Waiting for " << signalsExpected << " signals, got " << signalSpy.size();\
+}
+
+
+ using namespace std;
+ using namespace testing;
+ using namespace QtDBusTest;
+@@ -49,21 +59,6 @@ protected:
+ 		dbusMock.registerTemplate(NM_DBUS_SERVICE, NETWORK_MANAGER_TEMPLATE_PATH, {}, QDBusConnection::SystemBus);
+ 		dbusTestRunner.startServices();
+ 
+-		QProcessEnvironment env(QProcessEnvironment::systemEnvironment());
+-		env.insert("SECRET_AGENT_DEBUG_PASSWORD", "1");
+-		secretAgent.setProcessEnvironment(env);
+-		secretAgent.setReadChannel(QProcess::StandardOutput);
+-		secretAgent.setProcessChannelMode(QProcess::ForwardedErrorChannel);
+-		secretAgent.start(SECRET_AGENT_BIN, QStringList() << "--print-address");
+-		secretAgent.waitForStarted();
+-		secretAgent.waitForReadyRead();
+-		agentBus = secretAgent.readAll().trimmed();
+-
+-		agentInterface.reset(
+-				new OrgFreedesktopNetworkManagerSecretAgentInterface(agentBus,
+-				NM_DBUS_PATH_SECRET_AGENT, dbusTestRunner.systemConnection()));
+-
+-
+ 		notificationsInterface.reset(
+ 				new OrgFreedesktopDBusMockInterface(
+ 						"org.freedesktop.Notifications",
+@@ -72,8 +67,11 @@ protected:
+ 	}
+ 
+ 	virtual ~TestSecretAgentCommon() {
+-		secretAgent.terminate();
+-		secretAgent.waitForFinished();
+		if (secretAgent.state() != QProcess::NotRunning)
+		{
+				secretAgent.terminate();
+				secretAgent.waitForFinished();
+		}
+ 	}
+ 
+ 	QVariantDictMap connection(const QString &keyManagement) {
+@@ -111,6 +109,32 @@ protected:
+ 		return connection;
+ 	}
+ 
+	void setupSecretAgent (void) {
+		QSignalSpy notificationSpy(notificationsInterface.data(),
+				SIGNAL(MethodCalled(const QString &, const QVariantList &)));
+
+		QProcessEnvironment env(QProcessEnvironment::systemEnvironment());
+		env.insert("SECRET_AGENT_DEBUG_PASSWORD", "1");
+		secretAgent.setProcessEnvironment(env);
+		secretAgent.setReadChannel(QProcess::StandardOutput);
+		secretAgent.setProcessChannelMode(QProcess::ForwardedErrorChannel);
+		secretAgent.start(SECRET_AGENT_BIN, QStringList() << "--print-address");
+		secretAgent.waitForStarted();
+		secretAgent.waitForReadyRead();
+
+		agentBus = secretAgent.readAll().trimmed();
+
+		agentInterface.reset(
+				new OrgFreedesktopNetworkManagerSecretAgentInterface(agentBus,
+				NM_DBUS_PATH_SECRET_AGENT, dbusTestRunner.systemConnection()));
+
+		WAIT_FOR_SIGNALS(notificationSpy, 1);
+		{
+				const QVariantList &call(notificationSpy.at(0));
+				EXPECT_EQ(call.at(0), "GetServerInformation");
+		}
+	}
+
+ 	DBusTestRunner dbusTestRunner;
+ 
+ 	DBusMock dbusMock;
+@@ -163,22 +187,21 @@ static void transform(QVariantList &list) {
+ }
+ 
+ TEST_P(TestSecretAgentGetSecrets, ProvidesPasswordForWpaPsk) {
+	setupSecretAgent();
+
+	QSignalSpy notificationSpy(notificationsInterface.data(),
+			SIGNAL(MethodCalled(const QString &, const QVariantList &)));
+
+ 	QDBusPendingReply<QVariantDictMap> reply(
+ 			agentInterface->GetSecrets(connection(GetParam().keyManagement),
+ 					QDBusObjectPath("/connection/foo"),
+ 					SecretAgent::NM_WIRELESS_SECURITY_SETTING_NAME, QStringList(),
+ 					5));
+ 
+-	QSignalSpy notificationSpy(notificationsInterface.data(),
+-	SIGNAL(MethodCalled(const QString &, const QVariantList &)));
+-	if (notificationSpy.empty())
+-	{
+-		ASSERT_TRUE(notificationSpy.wait());
+-	}
+	WAIT_FOR_SIGNALS(notificationSpy, 1);
+ 
+-	ASSERT_EQ(1, notificationSpy.size());
+ 	const QVariantList &call(notificationSpy.at(0));
+-	EXPECT_EQ("Notify", call.at(0).toString().toStdString());
+	EXPECT_EQ("Notify", call.at(0));
+ 
+ 	QVariantList args(call.at(1).toList());
+ 	transform(args);
+@@ -254,6 +277,7 @@ class TestSecretAgent: public TestSecretAgentCommon, public Test {
+ };
+ 
+ TEST_F(TestSecretAgent, GetSecretsWithNone) {
+	setupSecretAgent();
+ 
+ 	QDBusPendingReply<QVariantDictMap> reply(
+ 			agentInterface->GetSecrets(
+@@ -272,6 +296,8 @@ TEST_F(TestSecretAgent, GetSecretsWithNone) {
+ /* Tests that if we request secrets and then cancel the request
+    that we close the notification */
+ TEST_F(TestSecretAgent, CancelGetSecrets) {
+	setupSecretAgent();
+
+ 	QSignalSpy notificationSpy(notificationsInterface.data(), SIGNAL(MethodCalled(const QString &, const QVariantList &)));
+ 
+ 	agentInterface->GetSecrets(
+@@ -280,23 +306,19 @@ TEST_F(TestSecretAgent, CancelGetSecrets) {
+ 			SecretAgent::NM_WIRELESS_SECURITY_SETTING_NAME, QStringList(),
+ 			5);
+ 
+-	notificationSpy.wait();
+-
+-	ASSERT_EQ(1, notificationSpy.size());
+-	const QVariantList &call(notificationSpy.at(0));
+-	EXPECT_EQ("Notify", call.at(0).toString().toStdString());
+	WAIT_FOR_SIGNALS(notificationSpy, 1);
+	{
+		const QVariantList &call(notificationSpy.at(0));
+		EXPECT_EQ("Notify", call.at(0));
+	}
+ 
+ 	notificationSpy.clear();
+ 
+ 	agentInterface->CancelGetSecrets(QDBusObjectPath("/connection/foo"),
+ 			SecretAgent::NM_WIRELESS_SECURITY_SETTING_NAME);
+ 
+-	if (notificationSpy.empty())
+-	{
+-		ASSERT_TRUE(notificationSpy.wait());
+-	}
+	WAIT_FOR_SIGNALS(notificationSpy, 1);
+ 
+-	ASSERT_EQ(1, notificationSpy.size());
+ 	const QVariantList &closecall(notificationSpy.at(0));
+ 	EXPECT_EQ("CloseNotification", closecall.at(0).toString().toStdString());
+ }
+@@ -304,6 +326,8 @@ TEST_F(TestSecretAgent, CancelGetSecrets) {
+ /* Ensures that if we request secrets twice we close the notification
+    for the first request */
+ TEST_F(TestSecretAgent, MultiSecrets) {
+	setupSecretAgent();
+
+ 	QSignalSpy notificationSpy(notificationsInterface.data(), SIGNAL(MethodCalled(const QString &, const QVariantList &)));
+ 
+ 	agentInterface->GetSecrets(
+@@ -312,15 +336,12 @@ TEST_F(TestSecretAgent, MultiSecrets) {
+ 			SecretAgent::NM_WIRELESS_SECURITY_SETTING_NAME, QStringList(),
+ 			5);
+ 
+-	if (notificationSpy.empty())
+	WAIT_FOR_SIGNALS(notificationSpy, 1);
+ 	{
+-		ASSERT_TRUE(notificationSpy.wait());
+		const QVariantList &call(notificationSpy.at(0));
+		EXPECT_EQ("Notify", call.at(0));
+ 	}
+ 
+-	ASSERT_EQ(1, notificationSpy.size());
+-	const QVariantList &call(notificationSpy.at(0));
+-	EXPECT_EQ("Notify", call.at(0).toString().toStdString());
+-
+ 	notificationSpy.clear();
+ 
+ 	agentInterface->GetSecrets(
+@@ -329,14 +350,7 @@ TEST_F(TestSecretAgent, MultiSecrets) {
+ 			SecretAgent::NM_WIRELESS_SECURITY_SETTING_NAME, QStringList(),
+ 			5);
+ 
+-	if (notificationSpy.empty())
+-	{
+-		ASSERT_TRUE(notificationSpy.wait());
+-	}
+-	if (notificationSpy.size() == 1)
+-	{
+-		ASSERT_TRUE(notificationSpy.wait());
+-	}
+	WAIT_FOR_SIGNALS(notificationSpy, 2);
+ 
+ 	ASSERT_EQ(2, notificationSpy.size());
+ 	const QVariantList &closecall(notificationSpy.at(1));
+@@ -347,11 +361,15 @@ TEST_F(TestSecretAgent, MultiSecrets) {
+ }
+ 
+ TEST_F(TestSecretAgent, SaveSecrets) {
+	setupSecretAgent();
+
+ 	agentInterface->SaveSecrets(QVariantDictMap(),
+ 			QDBusObjectPath("/connection/foo")).waitForFinished();
+ }
+ 
+ TEST_F(TestSecretAgent, DeleteSecrets) {
+	setupSecretAgent();
+
+ 	agentInterface->DeleteSecrets(QVariantDictMap(),
+ 			QDBusObjectPath("/connection/foo")).waitForFinished();
+ }
+-- 
+2.47.1
+
@@ -49,6 +49,10 @@ stdenv.mkDerivation (finalAttrs: {
    "doc"
  ];

+  patches = [
+    ./1001-test-secret-agent-Make-GetServerInformation-not-leak-into-tests.patch
+  ];
+
  postPatch = ''
    # Override original prefixes
    substituteInPlace data/CMakeLists.txt \
@@ -21,13 +21,13 @@

 stdenv.mkDerivation rec {
  pname = "lximage-qt";
-  version = "2.1.0";
+  version = "2.1.1";

  src = fetchFromGitHub {
    owner = "lxqt";
    repo = pname;
    rev = version;
-    hash = "sha256-08HEPTbZw4CCq3A9KxMKeT/X1notXwsV1sSSgtRFPO0=";
+    hash = "sha256-Y9lBXEROC4LIl1M7js0TvJBBNyO06qCWpHxvQjcYPhc=";
  };

  nativeBuildInputs = [
@@ -23,13 +23,13 @@

 stdenv.mkDerivation rec {
  pname = "lxqt-runner";
-  version = "2.1.0";
+  version = "2.1.2";

  src = fetchFromGitHub {
    owner = "lxqt";
    repo = pname;
    rev = version;
-    hash = "sha256-NsAlaoWMvisRZ04KkrQzwi5B2eXnaHqg0HtYG4NKLcs=";
+    hash = "sha256-AJLm6bjlM6cq9PNrM8eyvX4xN6lUxVSzgJs4+p/11ug=";
  };

  nativeBuildInputs = [
@@ -10,8 +10,13 @@
  pname = "equations";
  owner = "mattam82";
  repo = "Coq-Equations";
+  opam-name = "rocq-equations";
  inherit version;
  defaultVersion = lib.switch coq.coq-version [
+    {
+      case = "9.0";
+      out = "1.3.1+9.0";
+    }
    {
      case = "8.20";
      out = "1.3.1+8.20";
@@ -117,9 +122,14 @@
  release."1.3+8.19".sha256 = "sha256-roBCWfAHDww2Z2JbV5yMI3+EOfIsv3WvxEcUbBiZBsk=";
  release."1.3.1+8.20".rev = "v1.3.1-8.20";
  release."1.3.1+8.20".sha256 = "sha256-u8LB1KiACM5zVaoL7dSdHYvZgX7pf30VuqtjLLGuTzc=";
+  release."1.3.1+9.0".rev = "v1.3.1-9.0";
+  release."1.3.1+9.0".sha256 = "sha256-186Z0/wCuGAjIvG1LoYBMPooaC6HmnKWowYXuR0y6bA=";

  mlPlugin = true;

+  useDuneifVersion =
+    v: v != null && (v == "dev" || lib.versionAtLeast v "1.3.1+9.0");
+
  propagatedBuildInputs = [ stdlib ];

  meta = with lib; {
@@ -128,8 +138,12 @@
    maintainers = with maintainers; [ jwiegley ];
  };
 }).overrideAttrs
-  (o: {
+  (o: if o.version != null && o.version != "dev"
+         && !(lib.versionAtLeast o.version "1.3.1+9.0") then {
    preBuild = "coq_makefile -f _CoqProject -o Makefile${
      lib.optionalString (lib.versionAtLeast o.version "1.2.1" || o.version == "dev") ".coq"
    }";
+  } else {
+    propagatedBuildInputs = o.propagatedBuildInputs
+      ++ [ coq.ocamlPackages.ppx_optcomp ];
  })
@@ -2565,14 +2565,14 @@ buildLuarocksPackage {
 lze = callPackage({ buildLuarocksPackage, fetchurl, fetchzip, luaOlder }:
 buildLuarocksPackage {
  pname = "lze";
-  version = "0.4.5-1";
+  version = "0.6.3-1";
  knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/lze-0.4.5-1.rockspec";
-    sha256 = "1r029y9d8dvl5ynwspxq6168x0bg3qyf5m1x9yrqvb52mk0dyhbq";
+    url    = "mirror://luarocks/lze-0.6.3-1.rockspec";
+    sha256 = "1g1snlzpqkmb3wlahdz2zd2ivrz1kqvszriznix612ziwd6i9iij";
  }).outPath;
  src = fetchzip {
-    url    = "https://github.com/BirdeeHub/lze/archive/v0.4.5.zip";
-    sha256 = "0lsy7ikwqnpis8mwha4sl5i0v6x51xxravnsdjvy6fvcr6jbp51r";
+    url    = "https://github.com/BirdeeHub/lze/archive/v0.6.3.zip";
+    sha256 = "02rjd1z4dznacn9m8smd141qaml9jyfgbgyb3vrxnx8irh50mbzl";
  };

  disabled = luaOlder "5.1";
@@ -133,6 +133,8 @@ mapAliases {
  inherit (pkgs) kaput-cli; # added 2024-12-03
  karma = pkgs.karma-runner; # added 2023-07-29
  leetcode-cli = self.vsc-leetcode-cli; # added 2023-08-31
+  less = pkgs.lessc; # added 2024-06-15
+  less-plugin-clean-css = pkgs.lessc.plugins.clean-css; # added 2024-06-15
  inherit (pkgs) lv_font_conv; # added 2024-06-28
  manta = pkgs.node-manta; # Added 2023-05-06
  inherit (pkgs) markdown-link-check; # added 2024-06-28
@@ -32,7 +32,6 @@
  graphql-language-service-cli = "graphql-lsp";
  grunt-cli = "grunt";
  gulp-cli = "gulp";
-  less = "lessc";
  localtunnel = "lt";
  lua-fmt = "luafmt";
  parsoid = "parse.js";
@@ -116,8 +116,6 @@
 , "keyoxide"
 , "lcov-result-merger"
 , "lerna"
-, "less"
-, "less-plugin-clean-css"
 , "live-server"
 , "livedown"
 , "localtunnel"
@@ -69097,65 +69097,6 @@ in
    bypassCache = true;
    reconstructLock = true;
  };
-  less = nodeEnv.buildNodePackage {
-    name = "less";
-    packageName = "less";
-    version = "4.2.0";
-    src = fetchurl {
-      url = "https://registry.npmjs.org/less/-/less-4.2.0.tgz";
-      sha512 = "P3b3HJDBtSzsXUl0im2L7gTO5Ubg8mEN6G8qoTS77iXxXX4Hvu4Qj540PZDvQ8V6DmX6iXo98k7Md0Cm1PrLaA==";
-    };
-    dependencies = [
-      sources."copy-anything-2.0.6"
-      sources."errno-0.1.8"
-      sources."graceful-fs-4.2.11"
-      sources."iconv-lite-0.6.3"
-      sources."image-size-0.5.5"
-      sources."is-what-3.14.1"
-      sources."make-dir-2.1.0"
-      sources."mime-1.6.0"
-      sources."needle-3.3.1"
-      sources."parse-node-version-1.0.1"
-      sources."pify-4.0.1"
-      sources."prr-1.0.1"
-      sources."safer-buffer-2.1.2"
-      sources."sax-1.4.1"
-      sources."semver-5.7.2"
-      sources."source-map-0.6.1"
-      sources."tslib-2.7.0"
-    ];
-    buildInputs = globalBuildInputs;
-    meta = {
-      description = "Leaner CSS";
-      homepage = "http://lesscss.org";
-      license = "Apache-2.0";
-    };
-    production = true;
-    bypassCache = true;
-    reconstructLock = true;
-  };
-  less-plugin-clean-css = nodeEnv.buildNodePackage {
-    name = "less-plugin-clean-css";
-    packageName = "less-plugin-clean-css";
-    version = "1.6.0";
-    src = fetchurl {
-      url = "https://registry.npmjs.org/less-plugin-clean-css/-/less-plugin-clean-css-1.6.0.tgz";
-      sha512 = "jwXX6WlXT57OVCXa5oBJBaJq1b4s1BOKeEEoAL2UTeEitogQWfTcBbLT/vow9pl0N0MXV8Mb4KyhTGG0YbEKyQ==";
-    };
-    dependencies = [
-      sources."clean-css-5.3.3"
-      sources."source-map-0.6.1"
-    ];
-    buildInputs = globalBuildInputs;
-    meta = {
-      description = "clean-css plugin for less.js";
-      homepage = "https://lesscss.org";
-      license = "Apache-2.0";
-    };
-    production = true;
-    bypassCache = true;
-    reconstructLock = true;
-  };
  live-server = nodeEnv.buildNodePackage {
    name = "live-server";
    packageName = "live-server";
@@ -17,13 +17,13 @@

 buildDunePackage rec {
  pname = "eliom";
-  version = "11.1.0";
+  version = "11.1.1";

  src = fetchFromGitHub {
    owner = "ocsigen";
    repo = "eliom";
    rev = version;
-    hash = "sha256-q8XLkyE5GE7NmU+v5221mkMrm2pK0Loh+RsS++PZp+Q=";
+    hash = "sha256-ALuoyO6axNQEeBteBVIFwdoSrbLxxcaSTObAcLPGIvo=";
  };

  nativeBuildInputs = [
@@ -6,16 +6,16 @@

 php.buildComposerProject2 (finalAttrs: {
  pname = "php-codesniffer";
-  version = "3.11.2";
+  version = "3.11.3";

  src = fetchFromGitHub {
    owner = "PHPCSStandards";
    repo = "PHP_CodeSniffer";
    tag = "${finalAttrs.version}";
-    hash = "sha256-/rUkAQvdVMjeIS9UIKjTgk2D9Hb6HfQBRUXqbDYTAmg=";
+    hash = "sha256-yOi3SFBZfE6WhmMRHt0z86UJPnDnc9hXHtzYe5Ess6c=";
  };

-  vendorHash = "sha256-t5v+HyzOwa6+z5+PtEAAs9wSKxNBZ++tNc2iGO3tspY=";
+  vendorHash = "sha256-XAyRbfISIpIa4H9IX4TvpDnHhLj6SdqyKlpyG68mnUM=";

  meta = {
    changelog = "https://github.com/PHPCSStandards/PHP_CodeSniffer/releases/tag/${finalAttrs.version}";
@@ -6,16 +6,16 @@

 php.buildComposerProject2 (finalAttrs: {
  pname = "phpstan";
-  version = "2.1.1";
+  version = "2.1.2";

  src = fetchFromGitHub {
    owner = "phpstan";
    repo = "phpstan-src";
    tag = finalAttrs.version;
-    hash = "sha256-pc65TtMFsei338t73kjKO8agPhyvYfJrtKleQG7ZLlY=";
+    hash = "sha256-Wh0dBO5tokAJXxndL5QsgWUiYh0cE4B4EDmHKGC6uFk=";
  };

-  vendorHash = "sha256-HclF1hXWKwfq+r897FV8XMG1I31RyppyDz5LdFj2Sbg=";
+  vendorHash = "sha256-rkrJ36jugPyZ0v92bPSm4/77POLGqncOGo1PBQQdsds=";
  composerStrictValidation = false;

  meta = {
@@ -23,7 +23,7 @@ in
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "tideways-php";
  extensionName = "tideways";
-  version = "5.17.0";
+  version = "5.17.2";

  src =
    finalAttrs.passthru.sources.${stdenvNoCC.hostPlatform.system}
@@ -43,15 +43,15 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    sources = {
      "x86_64-linux" = fetchurl {
        url = "https://s3-eu-west-1.amazonaws.com/tideways/extension/${finalAttrs.version}/tideways-php-${finalAttrs.version}-x86_64.tar.gz";
-        hash = "sha256-zWmGGSSvV48dSU+Ox2ypPcIxVzr0oru9Eaoh1hQ+WgI=";
+        hash = "sha256-Uo9GWpT3TV2+NCaAaFeWwcoyya4ZMrhOOMI5PtJ5WEo=";
      };
      "aarch64-linux" = fetchurl {
        url = "https://s3-eu-west-1.amazonaws.com/tideways/extension/${finalAttrs.version}/tideways-php-${finalAttrs.version}-arm64.tar.gz";
-        hash = "sha256-xGkyLBy5oXVXs3VHT6fVg82H7Dmfc8VGHV9CEfw3ETY=";
+        hash = "sha256-p1ng6v2GkoqoH3WuGT3d/ZqD6lbpqS4PIlq9Fodpkog=";
      };
      "aarch64-darwin" = fetchurl {
        url = "https://s3-eu-west-1.amazonaws.com/tideways/extension/${finalAttrs.version}/tideways-php-${finalAttrs.version}-macos-arm.tar.gz";
-        hash = "sha256-StVPDWGKseagnkEi9dUX2dvu0+tIN8xxUTWmxKW1kDM=";
+        hash = "sha256-T43HwPKB5LOqR7wA1Gw5eTzIEc5kmn+uGZik1b6dwB4=";
      };
    };

@@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "ailment";
-  version = "9.2.137";
+  version = "9.2.138";
  pyproject = true;

  disabled = pythonOlder "3.11";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
    owner = "angr";
    repo = "ailment";
    tag = "v${version}";
-    hash = "sha256-5/dJFjqLIDafjzapsuSNz5YnaA9faDAgkW01tpHUHrA=";
+    hash = "sha256-EFynGM265FNUgBrofp0nFhamom26yse9sMDympXM1rk=";
  };

  build-system = [ setuptools ];
--- a/Show More
+++ b/Show More