Merge staging-next into staging

2025-05-21 00:18:18 +00:00
parent bc145eb3b2 0c7af57894
commit 6946a1548e
151 changed files with 1494 additions and 1249 deletions
@@ -348,6 +348,8 @@ Alongside many enhancements to NixOS modules and general system improvements, th

 - The behavior of the `networking.nat.externalIP` and `networking.nat.externalIPv6` options has been changed. `networking.nat.forwardPorts` now only forwards packets destined for the specified IP addresses.

+- `gitlab` has been updated from 17.x to 18.x and requires `postgresql` >= 16, as stated in the [documentation](https://docs.gitlab.com/18.0/install/requirements/#postgresql). Check the [upgrade guide](#module-services-postgres-upgrading) in the NixOS manual on how to upgrade your PostgreSQL installation.
+
 - `services.gitlab` now requires the setting of `activeRecordPrimaryKeyFile`, `activeRecordDeterministicKeyFile`, `activeRecordSaltFile` as GitLab introduced Rails ActiveRecord encryption.

 - `python3Packages.bpycv` has been removed due to being incompatible with Blender 4 and unmaintained.
@@ -20,6 +20,7 @@ in

  config = mkIf cfg.enable {
    environment.systemPackages = [ cfg.package ];
+    systemd.services.display-manager.path = [ cfg.package ];
    services.speechd.enable = true;
  };
 }
@@ -1237,8 +1237,8 @@ in
        message = "services.gitlab.secrets.activeRecordSaltFile must be set!";
      }
      {
-        assertion = versionAtLeast postgresqlPackage.version "14.9";
-        message = "PostgreSQL >= 14.9 is required to run GitLab 17. Follow the instructions in the manual section for upgrading PostgreSQL here: https://nixos.org/manual/nixos/stable/index.html#module-services-postgres-upgrading";
+        assertion = versionAtLeast postgresqlPackage.version "16";
+        message = "PostgreSQL >= 16 is required to run GitLab 18. Follow the instructions in the manual section for upgrading PostgreSQL here: https://nixos.org/manual/nixos/stable/index.html#module-services-postgres-upgrading";
      }
    ];

@@ -48,6 +48,10 @@ import ./make-test-python.nix (
      print(scanimage)
      assert """device `brother5:net1;dev0' is a Brother b ADS-1200""" in scanimage
      assert """device `brother5:net1;dev1' is a Brother a ADS-1200""" in scanimage
+
+      # Confirm systemd-udevd no longer logs errors about SYSFS
+      logs = machine.succeed('journalctl --unit systemd-udevd')
+      assert "Invalid key 'SYSFS'" not in logs
    '';
  }
 )
@@ -43,6 +43,7 @@ in
    client.succeed("${pkgs.coreutils}/bin/truncate --size=100M file-100M.bin")

    # Upload it.
+    client.wait_for_unit("network.target")
    client.succeed("${./tus-curl-upload.sh} file-100M.bin http://server:${toString port}/files/")

    print("Upload succeeded")
@@ -114,6 +114,7 @@ import ../make-test-python.nix (
      unbound.wait_for_file("${dnstapSocket}")
      unbound.succeed("test 770 -eq $(stat -c '%a' ${dnstapSocket})")

+      dnsclient.systemctl("start network-online.target")
      dnsclient.wait_for_unit("network-online.target")
      dnsclient.succeed(
        "dig @unbound test.local"
@@ -19,6 +19,7 @@
  icu,
  freetype,
  pugixml,
+  xorg,
  nix-update-script,
 }:

@@ -32,13 +33,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "organicmaps";
-  version = "2025.03.02-7";
+  version = "2025.05.20-5";

  src = fetchFromGitHub {
    owner = "organicmaps";
    repo = "organicmaps";
    tag = "${finalAttrs.version}-android";
-    hash = "sha256-5WX+YDgu8Ll5+rZWWxfbNW0pBFz+2XWkw/ahM14Ml08=";
+    hash = "sha256-cqcFI5cXREOeHusPkXsMwdCopzpea50mZQ/+ogLlemk=";
    fetchSubmodules = true;
  };

@@ -78,6 +79,9 @@ stdenv.mkDerivation (finalAttrs: {
    icu
    freetype
    pugixml
+    xorg.libXrandr
+    xorg.libXinerama
+    xorg.libXcursor
  ];

  # Yes, this is PRE configure. The configure phase uses cmake
@@ -94,14 +98,14 @@ stdenv.mkDerivation (finalAttrs: {
    };
  };

-  meta = with lib; {
+  meta = {
    # darwin: "invalid application of 'sizeof' to a function type"
    broken = stdenv.hostPlatform.isDarwin;
    homepage = "https://organicmaps.app/";
    description = "Detailed Offline Maps for Travellers, Tourists, Hikers and Cyclists";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ fgaz ];
-    platforms = platforms.all;
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ fgaz ];
+    platforms = lib.platforms.all;
    mainProgram = "OMaps";
  };
 })
@@ -1,15 +0,0 @@
-{
-  "version": "17.11.2",
-  "repo_hash": "1jaxqchqag6q0c4vmrpwnmflv72b2xpskba9b0m4y6w6sy7hqx7q",
-  "yarn_hash": "0z06jaxqbg2wnq7yhpkba0cpxp4w4iy2cxla8nhc6kgx49xk179v",
-  "owner": "gitlab-org",
-  "repo": "gitlab",
-  "rev": "v17.11.2-ee",
-  "passthru": {
-    "GITALY_SERVER_VERSION": "17.11.2",
-    "GITLAB_PAGES_VERSION": "17.11.2",
-    "GITLAB_SHELL_VERSION": "14.41.0",
-    "GITLAB_ELASTICSEARCH_INDEXER_VERSION": "5.5.0",
-    "GITLAB_WORKHORSE_VERSION": "17.11.2"
-  }
-}
@@ -21,13 +21,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "obs-vkcapture";
-  version = "1.5.1";
+  version = "1.5.2";

  src = fetchFromGitHub {
    owner = "nowrep";
    repo = "obs-vkcapture";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-RIDsT6eL6bUfqPiyPlecnZHu5OorcJb3Xal8pjdOpAA=";
+    hash = "sha256-ghfRST7J3bipQnOZnYMtmDggET+Etq/ngHs+zQ0bm1w=";
  };

  cmakeFlags = lib.optionals stdenv.hostPlatform.isi686 [
@@ -1,21 +1,12 @@
-{ lib, rustPlatform }:
-let
-  fs = lib.fileset;
-in
+{ rustPlatform }:
+
 rustPlatform.buildRustPackage {
  pname = "basic-dynamic";
  version = "0.1.0";

-  src = fs.toSource {
-    root = ./.;
-    fileset = fs.unions [
-      ./Cargo.toml
-      ./Cargo.lock
-      ./src
-    ];
-  };
+  src = ./package;

-  cargoLock.lockFileContents = builtins.readFile ./Cargo.lock;
+  cargoLock.lockFileContents = builtins.readFile ./package/Cargo.lock;

  doInstallCheck = true;

@@ -1,23 +1,13 @@
-{ lib, rustPlatform }:
-let
-  fs = lib.fileset;
-in
+{ rustPlatform }:
+
 rustPlatform.buildRustPackage {
  pname = "basic-sparse";
  version = "0.1.0";

-  src = fs.toSource {
-    root = ./.;
-    fileset = fs.unions [
-      ./.cargo/config.toml
-      ./Cargo.toml
-      ./Cargo.lock
-      ./src
-    ];
-  };
+  src = ./package;

  cargoLock = {
-    lockFile = ./Cargo.lock;
+    lockFile = ./package/Cargo.lock;
    extraRegistries = {
      "sparse+https://index.crates.io/" = "https://static.crates.io/crates";
    };
@@ -1,22 +1,13 @@
 { lib, rustPlatform }:
-let
-  fs = lib.fileset;
-in
+
 rustPlatform.buildRustPackage {
  pname = "basic";
  version = "0.1.0";

-  src = fs.toSource {
-    root = ./.;
-    fileset = fs.unions [
-      ./Cargo.toml
-      ./Cargo.lock
-      ./src
-    ];
-  };
+  src = ./package;

  cargoLock = {
-    lockFile = ./Cargo.lock;
+    lockFile = ./package/Cargo.lock;
  };

  doInstallCheck = true;
@@ -1,22 +1,13 @@
-{ lib, rustPlatform }:
-let
-  fs = lib.fileset;
-in
+{ rustPlatform }:
+
 rustPlatform.buildRustPackage {
  pname = "git-dependency-branch";
  version = "0.1.0";

-  src = fs.toSource {
-    root = ./.;
-    fileset = fs.unions [
-      ./Cargo.toml
-      ./Cargo.lock
-      ./src
-    ];
-  };
+  src = ./package;

  cargoLock = {
-    lockFile = ./Cargo.lock;
+    lockFile = ./package/Cargo.lock;
    outputHashes = {
      "rand-0.8.4" = "1ilk9wvfw3mdm57g199ys8f5nrgdrh0n3a4c8b7nz6lgnqvfrv6z";
    };
@@ -3,23 +3,13 @@
  pkg-config,
  openssl,
  zlib,
-  lib,
 }:
-let
-  fs = lib.fileset;
-in
+
 rustPlatform.buildRustPackage {
  pname = "git-dependency-rev-non-workspace-nested-crate";
  version = "0.1.0";

-  src = fs.toSource {
-    root = ./.;
-    fileset = fs.unions [
-      ./Cargo.toml
-      ./Cargo.lock
-      ./src
-    ];
-  };
+  src = ./package;

  nativeBuildInputs = [
    pkg-config
@@ -31,7 +21,7 @@ rustPlatform.buildRustPackage {
  ];

  cargoLock = {
-    lockFile = ./Cargo.lock;
+    lockFile = ./package/Cargo.lock;
    outputHashes = {
      "cargo-test-macro-0.1.0" = "1yy1y1d523xdzwg1gc77pigbcwsbawmy4b7vw8v21m7q957sk0c4";
    };
@@ -1,22 +1,13 @@
-{ lib, rustPlatform }:
-let
-  fs = lib.fileset;
-in
+{ rustPlatform }:
+
 rustPlatform.buildRustPackage {
  pname = "git-dependency-rev";
  version = "0.1.0";

-  src = fs.toSource {
-    root = ./.;
-    fileset = fs.unions [
-      ./Cargo.toml
-      ./Cargo.lock
-      ./src
-    ];
-  };
+  src = ./package;

  cargoLock = {
-    lockFile = ./Cargo.lock;
+    lockFile = ./package/Cargo.lock;
    outputHashes = {
      "rand-0.8.3" = "0l3p174bpwia61vcvxz5mw65a13ri3wy94z04xrnyy5lzciykz4f";
    };
@@ -1,22 +1,13 @@
-{ lib, rustPlatform }:
-let
-  fs = lib.fileset;
-in
+{ rustPlatform }:
+
 rustPlatform.buildRustPackage {
  pname = "git-dependency-tag";
  version = "0.1.0";

-  src = fs.toSource {
-    root = ./.;
-    fileset = fs.unions [
-      ./Cargo.toml
-      ./Cargo.lock
-      ./src
-    ];
-  };
+  src = ./package;

  cargoLock = {
-    lockFile = ./Cargo.lock;
+    lockFile = ./package/Cargo.lock;
    outputHashes = {
      "rand-0.8.3" = "0l3p174bpwia61vcvxz5mw65a13ri3wy94z04xrnyy5lzciykz4f";
    };
@@ -1,22 +1,13 @@
-{ lib, rustPlatform }:
-let
-  fs = lib.fileset;
-in
+{ rustPlatform }:
+
 rustPlatform.buildRustPackage {
  pname = "git-dependency";
  version = "0.1.0";

-  src = fs.toSource {
-    root = ./.;
-    fileset = fs.unions [
-      ./Cargo.toml
-      ./Cargo.lock
-      ./src
-    ];
-  };
+  src = ./package;

  cargoLock = {
-    lockFile = ./Cargo.lock;
+    lockFile = ./package/Cargo.lock;
    outputHashes = {
      "rand-0.8.3" = "0ya2hia3cn31qa8894s3av2s8j5bjwb6yq92k0jsnlx7jid0jwqa";
    };
@@ -1,22 +1,13 @@
-{ lib, rustPlatform }:
-let
-  fs = lib.fileset;
-in
+{ rustPlatform }:
+
 rustPlatform.buildRustPackage {
  pname = "v1";
  version = "0.1.0";

-  src = fs.toSource {
-    root = ./.;
-    fileset = fs.unions [
-      ./Cargo.toml
-      ./Cargo.lock
-      ./src
-    ];
-  };
+  src = ./package;

  cargoLock = {
-    lockFile = ./Cargo.lock;
+    lockFile = ./package/Cargo.lock;
  };

  doInstallCheck = true;
@@ -456,7 +456,7 @@ recurseIntoAttrs {
    );
  };

-  data = {
+  data = recurseIntoAttrs {
    json = expectDataEqual {
      file = writeJSON "data.json" { hello = "world"; };
      expected = ''
@@ -8,17 +8,17 @@

 buildGoModule rec {
  pname = "aliyun-cli";
-  version = "3.0.273";
+  version = "3.0.277";

  src = fetchFromGitHub {
    owner = "aliyun";
    repo = "aliyun-cli";
    tag = "v${version}";
-    hash = "sha256-Zmi+izG8gHZrtSaLR9sE9F0W55+PEj25lBKueIwY8iY=";
+    hash = "sha256-4HWSebmMys3yzj2H3JC7hAayl9xQeVBQWCEGlZSudUc=";
    fetchSubmodules = true;
  };

-  vendorHash = "sha256-K6et/P1GKoZeEsfB5LMBqfBx+YoVMMC87YLNKOkL30g=";
+  vendorHash = "sha256-cyE7yuwYUR/vv1w/b7QaiSoyX2XiUy5vNdodu+9PIl8=";

  subPackages = [ "main" ];

@@ -1,18 +1,18 @@
 diff --git a/cmake/macos/compilerconfig.cmake b/cmake/macos/compilerconfig.cmake
-index 99272c662..50f94db37 100644
+index f0c900f28..4da64f0b3 100644
 --- a/cmake/macos/compilerconfig.cmake
 +++ b/cmake/macos/compilerconfig.cmake
-@@ -27,7 +27,7 @@ message(DEBUG "macOS SDK Path: ${CMAKE_OSX_SYSROOT}")
- string(REGEX MATCH ".+/SDKs/MacOSX([0-9]+\\.[0-9])+\\.sdk$" _ ${CMAKE_OSX_SYSROOT})
- set(_ares_macos_current_sdk ${CMAKE_MATCH_1})
- message(DEBUG "macOS SDK version: ${_ares_macos_current_sdk}")
-if(_ares_macos_current_sdk VERSION_LESS _ares_macos_minimum_sdk)
-+if(FALSE)
-   message(
-     FATAL_ERROR
-     "Your macOS SDK version (${_ares_macos_current_sdk}) is too low. "
+@@ -25,7 +25,7 @@ function(check_sdk_requirements)
+   set(ares_macos_minimum_sdk 11.1) # Minimum tested SDK
+   set(ares_macos_minimum_xcode 12.4) # Sync with SDK
+   execute_process(
+-    COMMAND xcrun --sdk macosx --show-sdk-platform-version
+    COMMAND echo @sdkVersion@
+     OUTPUT_VARIABLE ares_macos_current_sdk
+     RESULT_VARIABLE result
+     OUTPUT_STRIP_TRAILING_WHITESPACE
 diff --git a/cmake/macos/helpers.cmake b/cmake/macos/helpers.cmake
-index 864a629f0..f455345bf 100644
+index 3777ac98a..07ff17009 100644
 --- a/cmake/macos/helpers.cmake
 +++ b/cmake/macos/helpers.cmake
@@ -35,7 +35,6 @@ function(ares_configure_executable target)
@@ -23,3 +23,16 @@ index 864a629f0..f455345bf 100644
 
     install(TARGETS ${target} BUNDLE DESTINATION "." COMPONENT Application)
   endif()
+diff --git a/ruby/cmake/os-macos.cmake b/ruby/cmake/os-macos.cmake
+index 39c339428..dafb58c66 100644
+--- a/ruby/cmake/os-macos.cmake
+++ b/ruby/cmake/os-macos.cmake
+@@ -43,7 +43,7 @@ target_link_libraries(
+ if(SDL_FOUND)
+   target_link_libraries(
+     ruby
+-    PRIVATE "$<LINK_LIBRARY:WEAK_FRAMEWORK,SDL::SDL>"
+    PRIVATE "$<LINK_LIBRARY:WEAK_LIBRARY,SDL::SDL>"
+   )
+ endif()
+ 
@@ -1,6 +1,5 @@
 {
  lib,
-  SDL2,
  alsa-lib,
  apple-sdk_14,
  cmake,
@@ -19,6 +18,8 @@
  moltenvk,
  openal,
  pkg-config,
+  replaceVars,
+  sdl3,
  stdenv,
  udev,
  vulkan-loader,
@@ -28,13 +29,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "ares";
-  version = "143";
+  version = "144";

  src = fetchFromGitHub {
    owner = "ares-emulator";
    repo = "ares";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-uuFKbS7WvxkTyyQfuQ6iKPvRt+54zUPdjUlQ/ohBAr8=";
+    hash = "sha256-BpVyPdtsIUstLVf/HGO6vcAlLgJP5SgJbZtqEV/uJ2g=";
  };

  nativeBuildInputs =
@@ -49,7 +50,7 @@ stdenv.mkDerivation (finalAttrs: {

  buildInputs =
    [
-      SDL2
+      sdl3
      libao
      librashader
      vulkan-loader
@@ -73,7 +74,9 @@ stdenv.mkDerivation (finalAttrs: {
    ];

  patches = [
-    ./darwin-build-fixes.patch
+    (replaceVars ./darwin-build-fixes.patch {
+      sdkVersion = apple-sdk_14.version;
+    })
  ];

  cmakeFlags = [
@@ -8,16 +8,16 @@

 buildGoModule rec {
  pname = "auth0-cli";
-  version = "1.12.0";
+  version = "1.13.0";

  src = fetchFromGitHub {
    owner = "auth0";
    repo = "auth0-cli";
    tag = "v${version}";
-    hash = "sha256-T3AJYDPdVkFYsvZUIdqndaxsJmsoJeeyr0316rafg7Q=";
+    hash = "sha256-RcRJBW8FgCi9Lxz/KARql7ArozqYgttpQ9IXIKzvo6s=";
  };

-  vendorHash = "sha256-/F3GNGCfsa9LM1F+eYJ+okqqjIuKfxHDT90ZS9gsJzs=";
+  vendorHash = "sha256-6y2iGxaromnMYIU2rnvwmQwn8f1PdihB4DH9r5sRT68=";

  ldflags = [
    "-s"
@@ -10,13 +10,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "bamtools";
-  version = "2.5.2";
+  version = "2.5.3";

  src = fetchFromGitHub {
    owner = "pezmaster31";
    repo = "bamtools";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-l2DmA4P1kPneTCL9YVACE6LcQHT0F+mufPyM69VkksE=";
+    hash = "sha256-3kIa407YgBpulh2koQQFK/RLmGEZvEvTnZyWKm+pngg=";
  };

  nativeBuildInputs = [
@@ -8,17 +8,17 @@

 buildGoModule rec {
  pname = "bento";
-  version = "1.6.1";
+  version = "1.7.1";

  src = fetchFromGitHub {
    owner = "warpstreamlabs";
    repo = "bento";
    tag = "v${version}";
-    hash = "sha256-T13r41ygQNmEBCwTKyCocQbGcyJSQ8lvmRllbxU512Y=";
+    hash = "sha256-pV7Fd+Ir+ZqteM0In/NiZrAyvPFS+oOnONhGVeBzA2g=";
  };

  proxyVendor = true;
-  vendorHash = "sha256-/DXdPL98Y4peF3USV9/J4sT/TUTRp3Cds500kxb18QA=";
+  vendorHash = "sha256-ow/XOO8Xc72v6Ue9VHjnPuq+HlqE4YZHw+gJB4x7sKk=";

  subPackages = [
    "cmd/bento"
@@ -79,6 +79,9 @@ stdenv.mkDerivation rec {
      # driver is hardcoded to look in /opt/brother/scanner/brscan5/models for model metadata.
      # patch it to look in /etc/opt/brother/scanner/models instead, so nixos environment.etc can make it available
      printf '/etc/opt/brother/scanner/models\x00' | dd of=opt/brother/scanner/brscan5/libsane-brother5.so.1.0.7 bs=1 seek=${toString patchOffsetBytes} conv=notrunc
+
+      # remove deprecated SYSFS udev rule
+      sed -i -e '/^SYSFS/d' opt/brother/scanner/brscan5/udev-rules/*.rules
    '';

  installPhase = ''
@@ -7,13 +7,13 @@

 buildGoModule rec {
  pname = "circleci-cli";
-  version = "0.1.31632";
+  version = "0.1.31792";

  src = fetchFromGitHub {
    owner = "CircleCI-Public";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-3ufazu7DuUFp3aBxQ5MPlndECHSjvEIscYjlvE3j9G8=";
+    sha256 = "sha256-0D0jCBE027zEQI/3iX4nF5ut8PS+nKuKhNf5+buazb8=";
  };

  vendorHash = "sha256-H7q373HL6M6ETkXEY5tAwN32rx0eMkqRAAZ4kQf9rKk=";
@@ -93,4 +93,10 @@ rustPlatform.buildRustPackage {
    openssl
    webkitgtk_4_1
  ];
+
+  # make sure the .desktop file name does not contain whitespace,
+  # so that the service can register it as an auto-start item
+  postInstall = ''
+    mv $out/share/applications/Clash\ Verge.desktop $out/share/applications/clash-verge.desktop
+  '';
 }
@@ -6,18 +6,18 @@

 buildGoModule rec {
  pname = "cnquery";
-  version = "11.53.2";
+  version = "11.54.0";

  src = fetchFromGitHub {
    owner = "mondoohq";
    repo = "cnquery";
    tag = "v${version}";
-    hash = "sha256-nqzlwBGsqGFh6yeqEWXE6MJyyiHwFh8ehaJjDbl+yd0=";
+    hash = "sha256-w9O3uEgzSe7e6+ij3AGVOVmDemDY8D1I4UcGXKb1B3E=";
  };

  subPackages = [ "apps/cnquery" ];

-  vendorHash = "sha256-CNbpMNT9OX7lAbLugS4vUcOHhtqEQcYFYaTe+HjewdA=";
+  vendorHash = "sha256-iGWdx4bgc4TFZ6opc/W9FfXkn6Xgff8pQjOl5SczgSE=";

  ldflags = [
    "-w"
@@ -8,17 +8,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "cotp";
-  version = "1.9.4";
+  version = "1.9.5";

  src = fetchFromGitHub {
    owner = "replydev";
    repo = "cotp";
    rev = "v${version}";
-    hash = "sha256-O9qss8vxsGyBWaCTt3trjnFVol5ib/G7IZIj742A/XI=";
+    hash = "sha256-Jv5BT7P/OXLkkfrEf+8x2IrACMhqr3zpbcKX8I/TzDc=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-Y8kGOeDKjdG+5zuA1mDx4h5IbKETjZU+SiFWiUv3xkw=";
+  cargoHash = "sha256-9iZyi3TPnqRpt+SRI3t7kwwiGpwUjQ0BrLZQY3X383o=";

  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [ libxcb ];

@@ -6,13 +6,13 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "cpm-cmake";
-  version = "0.41.0";
+  version = "0.42.0";

  src = fetchFromGitHub {
    owner = "cpm-cmake";
    repo = "cpm.cmake";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-sQHDZD2/BBlBXlPeY094dNkJNw+CF00FBvezYA5zxXg=";
+    hash = "sha256-IA13qA/b+owlrqbVAkhd4rS98/XB5RNONiJaPwjDm+A=";
  };

  postPatch = ''
@@ -7,16 +7,16 @@

 buildGoModule rec {
  pname = "ctlptl";
-  version = "0.8.40";
+  version = "0.8.41";

  src = fetchFromGitHub {
    owner = "tilt-dev";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-O6oAkYzkBUecwAcLjPIR7D/k4REWND8TWdstPNVJ0MU=";
+    hash = "sha256-PjTgXjA3lP4tzkcnWt711DJtu5/2zR+a2yyYmzf5WvE=";
  };

-  vendorHash = "sha256-1BrohvN3Eefuy2y7pjdwhzFQG9YLr9X/CLbOeTBZkjY=";
+  vendorHash = "sha256-EYpPZvAhKsKguvDousIs9BTD8fnCcZql3IktKf92wxs=";

  nativeBuildInputs = [ installShellFiles ];

@@ -11,7 +11,7 @@
 }:
 let
  pname = "dependabot-cli";
-  version = "1.63.0";
+  version = "1.64.0";

  # vv Also update this vv
  tag = "nixpkgs-dependabot-cli-${version}";
@@ -47,7 +47,7 @@ buildGoModule {
    owner = "dependabot";
    repo = "cli";
    rev = "v${version}";
-    hash = "sha256-lk0AEFQYemr4wP7JXx5mPzzo2VzSJvygPP5vtUvPaxs=";
+    hash = "sha256-NcmDYCXdhMY1KFz3if0XlX4EisQFr0YhJItllXnOfaA=";
  };

  vendorHash = "sha256-pnB1SkuEGm0KfkDfjnoff5fZRsAgD5w2H4UwsD3Jlbo=";
@@ -7,13 +7,13 @@

 buildGoModule rec {
  pname = "ergo";
-  version = "2.15.0";
+  version = "2.16.0";

  src = fetchFromGitHub {
    owner = "ergochat";
    repo = "ergo";
    rev = "v${version}";
-    sha256 = "sha256-8qZ5pnbCYN/j8B5cS456HVK2hDGqJwrPo1k4oagJrqU=";
+    sha256 = "sha256-AUXuH7YjC/yG5Ocs+kAOF8bAR4UVgfx96VDSHEqmqgg=";
  };

  vendorHash = null;
@@ -5,13 +5,13 @@
 }:
 buildGoModule rec {
  pname = "git-who";
-  version = "0.7";
+  version = "1.0";

  src = fetchFromGitHub {
    owner = "sinclairtarget";
    repo = "git-who";
    rev = "v${version}";
-    hash = "sha256-64Hb2+ZCXJis19V0WDyZ0SHZX99Dqxr3UGQTQZSCAp8=";
+    hash = "sha256-xJHFPf3w+6jh6vPTg4ggq652lANZkBBkKsmkvWx48ZU=";
  };

  vendorHash = "sha256-e2P7szjtAn4EFTy+eGi/9cYf/Raw/7O+PbYEOD8i3Hs=";
@@ -10,14 +10,14 @@

 stdenv.mkDerivation rec {
  pname = "gitaly-git";
-  version = "2.48.1.gl1";
+  version = "2.49.0.gl2";

  # `src` attribute for nix-update
  src = fetchFromGitLab {
    owner = "gitlab-org";
    repo = "git";
    rev = "v${version}";
-    hash = "sha256-j7yKImeRerdsYtSMrAU4y5vAJ2BT5wnJxURbDIwVot4=";
+    hash = "sha256-1y94T5UBG7s76ENsUmaXRXngSKmqIAT0nq1u+QjSWaY=";
  };

  # we actually use the gitaly build system
@@ -7,7 +7,7 @@
 }:

 let
-  version = "17.11.2";
+  version = "18.0.0";
  package_version = "v${lib.versions.major version}";
  gitaly_package = "gitlab.com/gitlab-org/gitaly/${package_version}";

@@ -21,10 +21,10 @@ let
      owner = "gitlab-org";
      repo = "gitaly";
      rev = "v${version}";
-      hash = "sha256-Ihw3Mezfz9H19oGM7X9B50aUbyh1JjDOmVU5ZNoiWug=";
+      hash = "sha256-IhFKEBYCEORLPEplPDRdV61kY5ZgFAxJmfmoG9Q58ec=";
    };

-    vendorHash = "sha256-ExqgxukFKXq/Z//hGSoDevfpJiNbVHhind63os1/3Fk=";
+    vendorHash = "sha256-PXONynRY5ZLQO2yQdtljDmLhVBIgfEYmyez9pIm9vtw=";

    ldflags = [
      "-X ${gitaly_package}/internal/version.version=${version}"
@@ -8,17 +8,17 @@

 buildGoModule rec {
  pname = "gitlab-elasticsearch-indexer";
-  version = "5.5.0";
+  version = "5.5.1";

  # nixpkgs-update: no auto update
  src = fetchFromGitLab {
    owner = "gitlab-org";
    repo = "gitlab-elasticsearch-indexer";
    rev = "v${version}";
-    hash = "sha256-b2kXp77pb9MXMRJsbDdNOXub8eZbZkHRwu/Ru0Voi60=";
+    hash = "sha256-N2H9jLpsP39nKrokWwphAspQwXcL3stAdvNVItIHFyo=";
  };

-  vendorHash = "sha256-9T8LbMROLcQYm9cT32Uc6Cuxwt9OYj3WzSYFgSQg1HQ=";
+  vendorHash = "sha256-Go02W09799Vu9v7y+P7z1gj7ijG3No5AVprRrmspPZE=";

  buildInputs = [ icu ];
  nativeBuildInputs = [ pkg-config ];
@@ -6,17 +6,17 @@

 buildGoModule rec {
  pname = "gitlab-pages";
-  version = "17.11.2";
+  version = "18.0.0";

  # nixpkgs-update: no auto update
  src = fetchFromGitLab {
    owner = "gitlab-org";
    repo = "gitlab-pages";
    rev = "v${version}";
-    hash = "sha256-tnswEoocMZXBrS+5toV8IOVs8HcNrTG320ebQqB3XiQ=";
+    hash = "sha256-c2y11lMeHBi62Ql63HGolF454GkFp7UCErHGk5Bvgvw=";
  };

-  vendorHash = "sha256-jCuLRXr7WHGxbXVg2JB1vp9WiNaLgsIJ6GJSS4QrlwY=";
+  vendorHash = "sha256-BjCwPt1duDINHP7L0qT2KNTjOZ62bWgVij88ztjjyPg=";
  subPackages = [ "." ];

  meta = with lib; {
@@ -0,0 +1,15 @@
+{
+  "version": "18.0.0",
+  "repo_hash": "03x2ypyn7kkald6pzvzh19cmlr6km9fdssw823565rd1kikywb87",
+  "yarn_hash": "0vv09y1pjcm2723jh842pgnmnrf4yqk7558v57dp08rxrqnsni5x",
+  "owner": "gitlab-org",
+  "repo": "gitlab",
+  "rev": "v18.0.0-ee",
+  "passthru": {
+    "GITALY_SERVER_VERSION": "18.0.0",
+    "GITLAB_PAGES_VERSION": "18.0.0",
+    "GITLAB_SHELL_VERSION": "14.41.0",
+    "GITLAB_ELASTICSEARCH_INDEXER_VERSION": "5.5.1",
+    "GITLAB_WORKHORSE_VERSION": "18.0.0"
+  }
+}
@@ -10,7 +10,7 @@ in
 buildGoModule rec {
  pname = "gitlab-workhorse";

-  version = "17.11.2";
+  version = "18.0.0";

  # nixpkgs-update: no auto update
  src = fetchFromGitLab {
@@ -22,7 +22,7 @@ buildGoModule rec {

  sourceRoot = "${src.name}/workhorse";

-  vendorHash = "sha256-76JO/oayqhv36WM7zC/a85l8CK1orsMuMksBYbmDN1o=";
+  vendorHash = "sha256-tLlxsUCoSGvUpJnS0GsNobk2IuSEgs3R4UDUmNf+HrA=";
  buildInputs = [ git ];
  ldflags = [ "-X main.Version=${version}" ];
  doCheck = false;
@@ -82,7 +82,7 @@ let
              cp Cargo.lock $out
            '';
          };
-          hash = "sha256-Jr3lS3gQI/jojWIUxEBp7a950mcOvnbjlRIFXvfGays=";
+          hash = "sha256-73uliXjZNT8Ok98ai2rY+b0jYqxoQH3qW5YS+Ap6KK0=";
        };

        dontBuild = false;
@@ -1,9 +1,5 @@
 # frozen_string_literal: true

-def next?
-  File.basename(__FILE__) == "Gemfile.next"
-end
-
 source 'https://rubygems.org'

 if ENV.fetch('BUNDLER_CHECKSUM_VERIFICATION_OPT_IN', 'false') != 'false' # this verification is still experimental
@@ -29,11 +25,7 @@ gem 'bundler-checksum', '~> 0.1.0', path: 'vendor/gems/bundler-checksum', requir
 #
 # See https://docs.gitlab.com/ee/development/gemfile.html#upgrade-rails for guidelines when upgrading Rails

-if next?
-  gem 'rails', '~> 7.1.5.1', feature_category: :shared
-else
-  gem 'rails', '~> 7.0.8.7', feature_category: :shared
-end
+gem 'rails', '~> 7.1.5.1', feature_category: :shared

 gem 'activerecord-gitlab', path: 'gems/activerecord-gitlab', feature_category: :shared
 # This can be dropped after upgrading to Rails 7.2: https://github.com/rails/rails/pull/49674
@@ -88,7 +80,7 @@ gem 'marginalia', '~> 1.11.1', feature_category: :database
 gem 'declarative_policy', '~> 1.1.0', feature_category: :shared

 # For source code paths mapping
-gem 'coverband', '6.1.4', require: false, feature_category: :shared
+gem 'coverband', '6.1.5', require: false, feature_category: :shared

 # Authentication libraries
 gem 'devise', '~> 4.9.3', feature_category: :system_access
@@ -197,6 +189,10 @@ gem 'hamlit', '~> 2.15.0', feature_category: :shared
 gem 'carrierwave', '~> 1.3', feature_category: :shared
 gem 'mini_magick', '~> 4.12', feature_category: :shared

+# PDF generation
+gem 'prawn', feature_category: :vulnerability_management
+gem 'prawn-svg', feature_category: :vulnerability_management
+
 # for backups
 gem 'fog-aws', '~> 3.26', feature_category: :shared
 # Locked until fog-google resolves https://github.com/fog/fog-google/issues/421.
@@ -242,9 +238,9 @@ gem 'seed-fu', '~> 2.3.7', feature_category: :shared
 gem 'elasticsearch-model', '~> 7.2', feature_category: :global_search
 gem 'elasticsearch-rails', '~> 7.2', require: 'elasticsearch/rails/instrumentation', feature_category: :global_search
 gem 'elasticsearch-api', '7.17.11', feature_category: :global_search
-gem 'aws-sdk-core', '~> 3.215.0', feature_category: :global_search
+gem 'aws-sdk-core', '~> 3.223.0', feature_category: :global_search
 gem 'aws-sdk-cloudformation', '~> 1', feature_category: :global_search
-gem 'aws-sdk-s3', '~> 1.177.0', feature_category: :global_search
+gem 'aws-sdk-s3', '~> 1.185.0', feature_category: :global_search
 gem 'faraday-typhoeus', '~> 1.1', feature_category: :global_search
 gem 'faraday_middleware-aws-sigv4', '~> 1.0.1', feature_category: :global_search
 # Used with Elasticsearch to support http keep-alive connections
@@ -270,7 +266,7 @@ gem 'asciidoctor-kroki', '~> 0.10.0', require: false, feature_category: :markdow
 gem 'rouge', '~> 4.5.0', feature_category: :shared
 gem 'truncato', '~> 0.7.13', feature_category: :team_planning
 gem 'nokogiri', '~> 1.18', feature_category: :shared
-gem 'gitlab-glfm-markdown', '~> 0.0.29', feature_category: :markdown
+gem 'gitlab-glfm-markdown', '~> 0.0.30', feature_category: :markdown
 gem 'tanuki_emoji', '~> 0.13', feature_category: :markdown
 gem 'unicode-emoji', '~> 4.0', feature_category: :markdown

@@ -319,7 +315,7 @@ gem 're2', '~> 2.15', feature_category: :shared

 # Misc

-gem 'semver_dialects', '~> 3.6', feature_category: :software_composition_analysis
+gem 'semver_dialects', '~> 3.7', feature_category: :software_composition_analysis
 gem 'version_sorter', '~> 2.3', feature_category: :shared
 gem 'csv_builder', path: 'gems/csv_builder', feature_category: :shared

@@ -395,9 +391,9 @@ gem 'gitlab-license', '~> 2.6', feature_category: :shared
 gem 'rack-attack', '~> 6.7.0', feature_category: :shared

 # Sentry integration
-gem 'sentry-ruby', '~> 5.22.0', feature_category: :observability
-gem 'sentry-rails', '~> 5.22.0', feature_category: :observability
-gem 'sentry-sidekiq', '~> 5.22.0', feature_category: :observability
+gem 'sentry-ruby', '~> 5.23.0', feature_category: :observability
+gem 'sentry-rails', '~> 5.23.0', feature_category: :observability
+gem 'sentry-sidekiq', '~> 5.23.0', feature_category: :observability

 # PostgreSQL query parsing
 #
@@ -433,7 +429,7 @@ gem 'cloud_profiler_agent', '~> 0.0.0', path: 'vendor/gems/cloud_profiler_agent'
 gem 'snowplow-tracker', '~> 0.8.0', feature_category: :product_analytics

 # Metrics
-gem 'webrick', '~> 1.8.1', require: false, feature_category: :shared
+gem 'webrick', '~> 1.9.0', require: false, feature_category: :shared
 gem 'prometheus-client-mmap', '~> 1.2.9', require: 'prometheus/client', feature_category: :shared

 # Event-driven reactor for Ruby
@@ -478,7 +474,9 @@ gem 'warning', '~> 1.5.0', feature_category: :shared
 group :development do
  gem 'lefthook', '~> 1.11.0', require: false, feature_category: :tooling
  gem 'rubocop', feature_category: :tooling
-  gem 'solargraph', '~> 0.47.2', require: false, feature_category: :shared
+
+  gem 'solargraph', '~> 0.54.0', require: false, feature_category: :shared
+  gem 'solargraph-rspec', '~> 0.5.1', require: false, feature_category: :shared

  gem 'letter_opener_web', '~> 3.0.0', feature_category: :shared
  gem 'lookbook', '~> 2.3', feature_category: :shared
@@ -505,9 +503,9 @@ group :development do
 end

 group :development, :test do
-  gem 'deprecation_toolkit', '~> 1.5.1', require: false, feature_category: :shared
+  gem 'deprecation_toolkit', '~> 2.2.3', require: false, feature_category: :shared
  gem 'bullet', '~> 7.2.0', feature_category: :shared
-  gem 'parser', '= 3.3.7.1', feature_category: :shared
+  gem 'parser', '= 3.3.8.0', feature_category: :shared
  gem 'pry-byebug', feature_category: :shared
  gem 'pry-rails', '~> 0.3.9', feature_category: :shared
  gem 'pry-shell', '~> 0.6.4', feature_category: :shared
@@ -535,7 +533,7 @@ group :development, :test do
  gem 'influxdb-client', '~> 3.1', require: false, feature_category: :tooling

  gem 'knapsack', '~> 4.0.0', feature_category: :tooling
-  gem 'crystalball', '~> 0.7.0', require: false, feature_category: :tooling
+  gem 'gitlab-crystalball', '~> 0.7.2', require: false, feature_category: :tooling
  gem 'test_file_finder', '~> 0.3.1', feature_category: :tooling

  gem 'simple_po_parser', '~> 1.1.6', require: false, feature_category: :shared
@@ -559,7 +557,7 @@ group :development, :test do
 end

 group :development, :test, :danger do
-  gem 'gitlab-dangerfiles', '~> 4.8.0', require: false, feature_category: :tooling
+  gem 'gitlab-dangerfiles', '~> 4.9.0', require: false, feature_category: :tooling
 end

 group :development, :test, :coverage do
@@ -602,11 +600,12 @@ group :test do
  gem 'rspec_junit_formatter', feature_category: :shared
  gem 'guard-rspec', feature_category: :shared
  gem 'axe-core-rspec', '~> 4.10.0', feature_category: :tooling
+  gem 'state_machines-rspec', '~> 0.6', feature_category: :shared

  # Moved in `test` because https://gitlab.com/gitlab-org/gitlab/-/issues/217527
  gem 'derailed_benchmarks', require: false, feature_category: :shared

-  gem 'gitlab_quality-test_tooling', '~> 2.8.0', require: false, feature_category: :tooling
+  gem 'gitlab_quality-test_tooling', '~> 2.10.0', require: false, feature_category: :tooling
 end

 gem 'octokit', '~> 9.0', feature_category: :importers
@@ -646,7 +645,7 @@ gem 'spamcheck', '~> 1.3.0', feature_category: :insider_threat
 gem 'gitaly', '~> 17.8.0', feature_category: :gitaly

 # KAS GRPC protocol definitions
-gem 'gitlab-kas-grpc', '~> 17.9.0.pre.rc2', feature_category: :deployment_management
+gem 'gitlab-kas-grpc', '~> 17.11.0', feature_category: :deployment_management

 # Lock the version before issues below are resolved:
 # https://gitlab.com/gitlab-org/gitlab/-/issues/473169#note_2028352939
@@ -670,7 +669,7 @@ gem 'lograge', '~> 0.5', feature_category: :shared
 gem 'grape_logging', '~> 1.8', '>= 1.8.4', feature_category: :api

 # DNS Lookup
-gem 'gitlab-net-dns', '~> 0.10.0', feature_category: :shared
+gem 'gitlab-net-dns', '~> 0.12.0', feature_category: :shared

 # Countries list
 gem 'countries', '~> 4.0.0', feature_category: :shared
@@ -700,7 +699,7 @@ gem 'valid_email', '~> 0.1', feature_category: :shared

 # JSON
 gem 'jsonb_accessor', '~> 1.4', feature_category: :shared
-gem 'json', '~> 2.10.0', feature_category: :shared
+gem 'json', '~> 2.11.0', feature_category: :shared
 gem 'json_schemer', '~> 2.3.0', feature_category: :shared
 gem 'oj', '~> 3.16.0', '>=3.16.10', feature_category: :shared
 gem 'oj-introspect', '~> 0.8', feature_category: :shared
@@ -716,7 +715,7 @@ gem 'parslet', '~> 1.8', feature_category: :shared

 gem 'ipynbdiff', path: 'gems/ipynbdiff', require: 'ipynb_diff', feature_category: :shared

-gem 'ed25519', '~> 1.3.0', feature_category: :shared
+gem 'ed25519', '~> 1.4.0', feature_category: :shared

 # Error Tracking OpenAPI client
 # See https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/development/rake_tasks.md#update-openapi-client-for-error-tracking-feature
@@ -729,7 +728,7 @@ gem 'cvss-suite', '~> 3.3.0', require: 'cvss_suite', feature_category: :software
 gem 'arr-pm', '~> 0.0.12', feature_category: :package_registry

 # Remote Development
-gem 'devfile', '~> 0.4.3', feature_category: :workspaces
+gem 'devfile', '~> 0.4.4', feature_category: :workspaces

 # Apple plist parsing
 gem 'CFPropertyList', '~> 3.0.0', feature_category: :mobile_devops
@@ -756,8 +755,8 @@ gem 'duo_api', '~> 1.3', feature_category: :system_access

 gem 'gitlab-sdk', '~> 0.3.0', feature_category: :application_instrumentation

-gem 'paper_trail', '~> 15.0', feature_category: :shared
+gem 'paper_trail', '~> 16.0', feature_category: :shared

 gem "i18n_data", "~> 0.13.1", feature_category: :system_access

-gem "gitlab-cloud-connector", "~> 1.5", require: 'gitlab/cloud_connector', feature_category: :cloud_connector
+gem "gitlab-cloud-connector", "~> 1.11", require: 'gitlab/cloud_connector', feature_category: :cloud_connector
@@ -42,6 +42,7 @@ PATH
      activerecord (>= 7)
      activesupport (>= 7)
      addressable (~> 2.8)
+      bigdecimal (~> 3.1)
      concurrent-ruby (~> 1.1)
      faraday (~> 2)
      google-cloud-storage_transfer (~> 1.2.0)
@@ -52,6 +53,7 @@ PATH
      jwt (~> 2.5)
      logger (~> 1.5)
      minitest (~> 5.11.0)
+      mutex_m (~> 0.3)
      parallel (~> 1.19)
      pg (~> 1.5.6)
      rack (~> 2.2.9)
@@ -225,73 +227,85 @@ GEM
      base64 (~> 0.2.0)
      faraday (>= 1.0, < 3.0.0)
      faraday-retry (>= 1.0, < 3.0.0)
-    actioncable (7.0.8.7)
-      actionpack (= 7.0.8.7)
-      activesupport (= 7.0.8.7)
+    actioncable (7.1.5.1)
+      actionpack (= 7.1.5.1)
+      activesupport (= 7.1.5.1)
      nio4r (~> 2.0)
      websocket-driver (>= 0.6.1)
-    actionmailbox (7.0.8.7)
-      actionpack (= 7.0.8.7)
-      activejob (= 7.0.8.7)
-      activerecord (= 7.0.8.7)
-      activestorage (= 7.0.8.7)
-      activesupport (= 7.0.8.7)
+      zeitwerk (~> 2.6)
+    actionmailbox (7.1.5.1)
+      actionpack (= 7.1.5.1)
+      activejob (= 7.1.5.1)
+      activerecord (= 7.1.5.1)
+      activestorage (= 7.1.5.1)
+      activesupport (= 7.1.5.1)
      mail (>= 2.7.1)
      net-imap
      net-pop
      net-smtp
-    actionmailer (7.0.8.7)
-      actionpack (= 7.0.8.7)
-      actionview (= 7.0.8.7)
-      activejob (= 7.0.8.7)
-      activesupport (= 7.0.8.7)
+    actionmailer (7.1.5.1)
+      actionpack (= 7.1.5.1)
+      actionview (= 7.1.5.1)
+      activejob (= 7.1.5.1)
+      activesupport (= 7.1.5.1)
      mail (~> 2.5, >= 2.5.4)
      net-imap
      net-pop
      net-smtp
-      rails-dom-testing (~> 2.0)
-    actionpack (7.0.8.7)
-      actionview (= 7.0.8.7)
-      activesupport (= 7.0.8.7)
-      rack (~> 2.0, >= 2.2.4)
+      rails-dom-testing (~> 2.2)
+    actionpack (7.1.5.1)
+      actionview (= 7.1.5.1)
+      activesupport (= 7.1.5.1)
+      nokogiri (>= 1.8.5)
+      racc
+      rack (>= 2.2.4)
+      rack-session (>= 1.0.1)
      rack-test (>= 0.6.3)
-      rails-dom-testing (~> 2.0)
-      rails-html-sanitizer (~> 1.0, >= 1.2.0)
-    actiontext (7.0.8.7)
-      actionpack (= 7.0.8.7)
-      activerecord (= 7.0.8.7)
-      activestorage (= 7.0.8.7)
-      activesupport (= 7.0.8.7)
+      rails-dom-testing (~> 2.2)
+      rails-html-sanitizer (~> 1.6)
+    actiontext (7.1.5.1)
+      actionpack (= 7.1.5.1)
+      activerecord (= 7.1.5.1)
+      activestorage (= 7.1.5.1)
+      activesupport (= 7.1.5.1)
      globalid (>= 0.6.0)
      nokogiri (>= 1.8.5)
-    actionview (7.0.8.7)
-      activesupport (= 7.0.8.7)
+    actionview (7.1.5.1)
+      activesupport (= 7.1.5.1)
      builder (~> 3.1)
-      erubi (~> 1.4)
-      rails-dom-testing (~> 2.0)
-      rails-html-sanitizer (~> 1.1, >= 1.2.0)
-    activejob (7.0.8.7)
-      activesupport (= 7.0.8.7)
+      erubi (~> 1.11)
+      rails-dom-testing (~> 2.2)
+      rails-html-sanitizer (~> 1.6)
+    activejob (7.1.5.1)
+      activesupport (= 7.1.5.1)
      globalid (>= 0.3.6)
-    activemodel (7.0.8.7)
-      activesupport (= 7.0.8.7)
-    activerecord (7.0.8.7)
-      activemodel (= 7.0.8.7)
-      activesupport (= 7.0.8.7)
+    activemodel (7.1.5.1)
+      activesupport (= 7.1.5.1)
+    activerecord (7.1.5.1)
+      activemodel (= 7.1.5.1)
+      activesupport (= 7.1.5.1)
+      timeout (>= 0.4.0)
    activerecord-explain-analyze (0.1.0)
      activerecord (>= 4)
      pg
-    activestorage (7.0.8.7)
-      actionpack (= 7.0.8.7)
-      activejob (= 7.0.8.7)
-      activerecord (= 7.0.8.7)
-      activesupport (= 7.0.8.7)
+    activestorage (7.1.5.1)
+      actionpack (= 7.1.5.1)
+      activejob (= 7.1.5.1)
+      activerecord (= 7.1.5.1)
+      activesupport (= 7.1.5.1)
      marcel (~> 1.0)
-      mini_mime (>= 1.1.0)
-    activesupport (7.0.8.7)
+    activesupport (7.1.5.1)
+      base64
+      benchmark (>= 0.3)
+      bigdecimal
      concurrent-ruby (~> 1.0, >= 1.0.2)
+      connection_pool (>= 2.2.5)
+      drb
      i18n (>= 1.6, < 2)
+      logger (>= 1.4.2)
      minitest (>= 5.1)
+      mutex_m
+      securerandom (>= 0.3)
      tzinfo (~> 2.0)
    addressable (2.8.7)
      public_suffix (>= 2.0.2, < 7.0)
@@ -336,26 +350,28 @@ GEM
    aws-sdk-cloudformation (1.41.0)
      aws-sdk-core (~> 3, >= 3.99.0)
      aws-sigv4 (~> 1.1)
-    aws-sdk-core (3.215.0)
+    aws-sdk-core (3.223.0)
      aws-eventstream (~> 1, >= 1.3.0)
      aws-partitions (~> 1, >= 1.992.0)
      aws-sigv4 (~> 1.9)
+      base64
      jmespath (~> 1, >= 1.6.1)
+      logger
    aws-sdk-kms (1.76.0)
      aws-sdk-core (~> 3, >= 3.188.0)
      aws-sigv4 (~> 1.1)
-    aws-sdk-s3 (1.177.0)
-      aws-sdk-core (~> 3, >= 3.210.0)
+    aws-sdk-s3 (1.185.0)
+      aws-sdk-core (~> 3, >= 3.216.0)
      aws-sdk-kms (~> 1)
      aws-sigv4 (~> 1.5)
    aws-sigv4 (1.9.1)
      aws-eventstream (~> 1, >= 1.0.2)
-    axe-core-api (4.10.2)
+    axe-core-api (4.10.3)
      dumb_delegator
      ostruct
      virtus
-    axe-core-rspec (4.10.2)
-      axe-core-api (= 4.10.2)
+    axe-core-rspec (4.10.3)
+      axe-core-api (= 4.10.3)
      dumb_delegator
      ostruct
      virtus
@@ -369,7 +385,7 @@ GEM
    base64 (0.2.0)
    batch-loader (2.0.5)
    bcrypt (3.1.20)
-    benchmark (0.2.0)
+    benchmark (0.4.0)
    benchmark-ips (2.14.0)
    benchmark-malloc (0.2.0)
    benchmark-memory (0.2.0)
@@ -391,7 +407,7 @@ GEM
    bullet (7.2.0)
      activesupport (>= 3.0.0)
      uniform_notifier (~> 1.11)
-    byebug (11.1.3)
+    byebug (12.0.0)
    capybara (3.40.0)
      addressable
      matrix
@@ -435,7 +451,7 @@ GEM
    colored2 (3.1.2)
    commonmarker (0.23.11)
    concurrent-ruby (1.2.3)
-    connection_pool (2.5.0)
+    connection_pool (2.5.3)
    console (1.29.2)
      fiber-annotation
      fiber-local (~> 1.1)
@@ -448,14 +464,13 @@ GEM
    countries (4.0.1)
      i18n_data (~> 0.13.0)
      sixarm_ruby_unaccent (~> 1.1)
-    coverband (6.1.4)
+    coverband (6.1.5)
+      base64
      redis (>= 3.0)
    crack (0.4.3)
      safe_yaml (~> 1.0.0)
    crass (1.0.6)
    creole (0.5.0)
-    crystalball (0.7.0)
-      git
    css_parser (1.14.0)
      addressable
    cssbundling-rails (1.4.3)
@@ -489,8 +504,8 @@ GEM
      html-pipeline (~> 2.0)
    declarative (0.0.20)
    declarative_policy (1.1.0)
-    deprecation_toolkit (1.5.1)
-      activesupport (>= 4.2)
+    deprecation_toolkit (2.2.3)
+      activesupport (>= 6.1)
    derailed_benchmarks (2.2.1)
      base64
      benchmark-ips (~> 2)
@@ -511,7 +526,7 @@ GEM
      thor (>= 0.19, < 2)
    descendants_tracker (0.0.4)
      thread_safe (~> 0.3, >= 0.3.1)
-    devfile (0.4.3)
+    devfile (0.4.4)
    device_detector (1.0.0)
    devise (4.9.4)
      bcrypt (~> 3.0)
@@ -534,7 +549,7 @@ GEM
    docile (1.4.0)
    domain_name (0.5.20190701)
      unf (>= 0.0.5, < 1.0.0)
-    doorkeeper (5.8.1)
+    doorkeeper (5.8.2)
      railties (>= 5)
    doorkeeper-device_authorization_grant (1.0.3)
      doorkeeper (~> 5.5)
@@ -561,8 +576,7 @@ GEM
      zeitwerk (~> 2.6)
    dumb_delegator (1.0.0)
    duo_api (1.4.0)
-    e2mmap (0.1.0)
-    ed25519 (1.3.0)
+    ed25519 (1.4.0)
    elasticsearch (7.17.11)
      elasticsearch-api (= 7.17.11)
      elasticsearch-transport (= 7.17.11)
@@ -627,9 +641,11 @@ GEM
      aws-sigv4 (~> 1.0)
      faraday (>= 2.0, < 3)
    fast_blank (1.0.1)
-    fast_gettext (2.3.0)
+    fast_gettext (4.1.0)
+      prime
+      racc
    ffaker (2.24.0)
-    ffi (1.17.1)
+    ffi (1.17.2)
    ffi-compiler (1.0.1)
      ffi (>= 1.0.0)
      rake
@@ -683,7 +699,7 @@ GEM
      multi_json (~> 1.10)
    fog-local (0.8.0)
      fog-core (>= 1.27, < 3.0)
-    fog-xml (0.1.3)
+    fog-xml (0.1.5)
      fog-core
      nokogiri (>= 1.5.11, < 2.0.0)
    formatador (0.2.5)
@@ -724,10 +740,12 @@ GEM
      terminal-table (>= 1.5.1)
    gitlab-chronic (0.10.6)
      numerizer (~> 0.2)
-    gitlab-cloud-connector (1.6.0)
+    gitlab-cloud-connector (1.12.0)
      activesupport (~> 7.0)
      jwt (~> 2.9.3)
-    gitlab-dangerfiles (4.8.1)
+    gitlab-crystalball (0.7.2)
+      git (< 4)
+    gitlab-dangerfiles (4.9.1)
      danger (>= 9.3.0)
      danger-gitlab (>= 8.0.0)
      rake (~> 13.0)
@@ -743,9 +761,9 @@ GEM
      mime-types
      net-http-persistent (~> 4.0)
      nokogiri (~> 1, >= 1.10.8)
-    gitlab-glfm-markdown (0.0.29)
+    gitlab-glfm-markdown (0.0.30)
      rb_sys (~> 0.9.109)
-    gitlab-kas-grpc (17.9.1)
+    gitlab-kas-grpc (17.11.2)
      grpc (~> 1.0)
    gitlab-labkit (0.37.0)
      actionpack (>= 5.0.0, < 8.1.0)
@@ -763,14 +781,14 @@ GEM
      redis (>= 5, < 6)
      redis-namespace (>= 1.8.2)
    gitlab-markup (2.0.0)
-    gitlab-net-dns (0.10.0)
+    gitlab-net-dns (0.12.0)
+      logger
    gitlab-sdk (0.3.1)
      activesupport (>= 5.2.0)
      rake (~> 13.0)
      snowplow-tracker (~> 0.8.0)
-    gitlab-secret_detection (0.23.0)
+    gitlab-secret_detection (0.26.1)
      grpc (~> 1.63.0)
-      grpc-tools (~> 1.63)
      grpc_reflection (~> 0.1)
      parallel (~> 1)
      re2 (~> 2.7)
@@ -796,8 +814,8 @@ GEM
      omniauth (>= 1.3, < 3)
      pyu-ruby-sasl (>= 0.0.3.3, < 0.1)
      rubyntlm (~> 0.5)
-    gitlab_quality-test_tooling (2.8.0)
-      activesupport (>= 7.0, < 7.2)
+    gitlab_quality-test_tooling (2.10.0)
+      activesupport (>= 7.0, < 7.3)
      amatch (~> 0.4.1)
      fog-google (~> 1.24, >= 1.24.1)
      gitlab (>= 4.19, < 6.0)
@@ -891,12 +909,12 @@ GEM
    google-cloud-storage_transfer-v1 (0.8.0)
      gapic-common (>= 0.20.0, < 2.a)
      google-cloud-errors (~> 1.0)
-    google-protobuf (3.25.6)
+    google-protobuf (3.25.7)
    googleapis-common-protos (1.4.0)
      google-protobuf (~> 3.14)
      googleapis-common-protos-types (~> 1.2)
      grpc (~> 1.27)
-    googleapis-common-protos-types (1.18.0)
+    googleapis-common-protos-types (1.19.0)
      google-protobuf (>= 3.18, < 5.a)
    googleauth (1.8.1)
      faraday (>= 0.17.3, < 3.a)
@@ -950,7 +968,6 @@ GEM
      google-protobuf (~> 3.18)
      googleapis-common-protos (~> 1.4)
      grpc (~> 1.41)
-    grpc-tools (1.69.0)
    grpc_reflection (0.1.1)
      grpc
    gssapi (1.3.1)
@@ -972,7 +989,7 @@ GEM
    haml (5.2.2)
      temple (>= 0.8.0)
      tilt
-    haml_lint (0.61.0)
+    haml_lint (0.62.0)
      haml (>= 5.0)
      parallel (~> 1.10)
      rainbow
@@ -1024,12 +1041,17 @@ GEM
      csv
    invisible_captcha (2.1.0)
      rails (>= 5.2)
+    io-console (0.8.0)
    io-event (1.9.0)
    ipaddress (0.8.3)
+    irb (1.15.1)
+      pp (>= 0.6.0)
+      rdoc (>= 4.0.0)
+      reline (>= 0.4.2)
    jaeger-client (1.1.0)
      opentracing (~> 0.3)
      thrift
-    jaro_winkler (1.5.6)
+    jaro_winkler (1.6.0)
    jira-ruby (2.3.0)
      activesupport
      atlassian-jwt
@@ -1040,7 +1062,7 @@ GEM
      character_set (~> 1.4)
      regexp_parser (~> 2.5)
      regexp_property_values (~> 1.0)
-    json (2.10.2)
+    json (2.11.3)
    json-jwt (1.16.6)
      activesupport (>= 4.2)
      aes_key_wrap
@@ -1087,7 +1109,7 @@ GEM
    language_server-protocol (3.17.0.3)
    launchy (2.5.2)
      addressable (~> 2.8)
-    lefthook (1.11.2)
+    lefthook (1.11.5)
    letter_opener (1.10.0)
      launchy (>= 2.2, < 4)
    letter_opener_web (3.0.0)
@@ -1104,10 +1126,10 @@ GEM
      tomlrb (>= 1.3, < 2.1)
      with_env (= 1.1.0)
      xml-simple (~> 1.1.9)
-    licensee (9.17.1)
+    licensee (9.18.0)
      dotenv (>= 2, < 4)
      octokit (>= 4.20, < 10.0)
-      reverse_markdown (>= 1, < 3)
+      reverse_markdown (>= 1, < 4)
      rugged (>= 0.24, < 2.0)
      thor (>= 0.19, < 2.0)
    listen (3.7.1)
@@ -1165,7 +1187,8 @@ GEM
    mixlib-cli (2.1.8)
    mixlib-config (3.0.27)
      tomlrb
-    mixlib-log (3.0.9)
+    mixlib-log (3.2.3)
+      ffi (>= 1.15.5)
    mixlib-shellout (3.2.7)
      chef-utils
    mize (0.6.1)
@@ -1203,7 +1226,7 @@ GEM
    nio4r (2.7.0)
    nkf (0.2.0)
    no_proxy_fix (0.1.2)
-    nokogiri (1.18.7)
+    nokogiri (1.18.8)
      mini_portile2 (~> 2.8.2)
      racc (~> 1.4)
    notiffany (0.1.3)
@@ -1218,6 +1241,7 @@ GEM
      rack (>= 1.2, < 4)
      snaky_hash (~> 2.0)
      version_gem (~> 1.1)
+    observer (0.1.2)
    octokit (9.2.0)
      faraday (>= 1, < 3)
      sawyer (~> 0.9)
@@ -1424,16 +1448,17 @@ GEM
      diff-lcs (~> 1.5)
      expgen (~> 0.1)
      rainbow (~> 3.1.1)
-    paper_trail (15.1.0)
+    paper_trail (16.0.0)
      activerecord (>= 6.1)
      request_store (~> 1.4)
    parallel (1.26.3)
-    parser (3.3.7.1)
+    parser (3.3.8.0)
      ast (~> 2.4.1)
      racc
    parslet (1.8.2)
    pastel (0.8.0)
      tty-color (~> 0.5)
+    pdf-core (0.10.0)
    peek (1.1.0)
      railties (>= 4.0.0)
    pg (1.5.9)
@@ -1441,6 +1466,17 @@ GEM
      google-protobuf (>= 3.25.3)
    plist (3.7.0)
    png_quantizator (0.2.1)
+    pp (0.6.2)
+      prettyprint
+    prawn (2.5.0)
+      matrix (~> 0.4)
+      pdf-core (~> 0.10.0)
+      ttfunk (~> 1.8)
+    prawn-svg (0.37.0)
+      css_parser (~> 1.6)
+      matrix (~> 0.4.2)
+      prawn (>= 0.11.1, < 3)
+      rexml (>= 3.3.9, < 4)
    premailer (1.23.0)
      addressable
      css_parser (>= 1.12.0)
@@ -1449,6 +1485,7 @@ GEM
      actionmailer (>= 3)
      net-smtp
      premailer (~> 1.7, >= 1.7.9)
+    prettyprint (0.2.0)
    prime (0.1.3)
      forwardable
      singleton
@@ -1465,15 +1502,18 @@ GEM
    pry (0.14.2)
      coderay (~> 1.1)
      method_source (~> 1.0)
-    pry-byebug (3.10.1)
-      byebug (~> 11.0)
-      pry (>= 0.13, < 0.15)
+    pry-byebug (3.11.0)
+      byebug (~> 12.0)
+      pry (>= 0.13, < 0.16)
    pry-rails (0.3.11)
      pry (>= 0.13.0)
    pry-shell (0.6.4)
      pry (>= 0.13.0)
      tty-markdown
      tty-prompt
+    psych (5.2.3)
+      date
+      stringio
    public_suffix (6.0.1)
    puma (6.5.0)
      nio4r (~> 2.0)
@@ -1503,26 +1543,30 @@ GEM
    rack-test (2.1.0)
      rack (>= 1.3)
    rack-timeout (0.7.0)
-    rails (7.0.8.7)
-      actioncable (= 7.0.8.7)
-      actionmailbox (= 7.0.8.7)
-      actionmailer (= 7.0.8.7)
-      actionpack (= 7.0.8.7)
-      actiontext (= 7.0.8.7)
-      actionview (= 7.0.8.7)
-      activejob (= 7.0.8.7)
-      activemodel (= 7.0.8.7)
-      activerecord (= 7.0.8.7)
-      activestorage (= 7.0.8.7)
-      activesupport (= 7.0.8.7)
+    rackup (1.0.1)
+      rack (< 3)
+      webrick
+    rails (7.1.5.1)
+      actioncable (= 7.1.5.1)
+      actionmailbox (= 7.1.5.1)
+      actionmailer (= 7.1.5.1)
+      actionpack (= 7.1.5.1)
+      actiontext (= 7.1.5.1)
+      actionview (= 7.1.5.1)
+      activejob (= 7.1.5.1)
+      activemodel (= 7.1.5.1)
+      activerecord (= 7.1.5.1)
+      activestorage (= 7.1.5.1)
+      activesupport (= 7.1.5.1)
      bundler (>= 1.15.0)
-      railties (= 7.0.8.7)
+      railties (= 7.1.5.1)
    rails-controller-testing (1.0.5)
      actionpack (>= 5.0.1.rc1)
      actionview (>= 5.0.1.rc1)
      activesupport (>= 5.0.1.rc1)
-    rails-dom-testing (2.0.3)
-      activesupport (>= 4.2.0)
+    rails-dom-testing (2.2.0)
+      activesupport (>= 5.0.0)
+      minitest
      nokogiri (>= 1.6)
    rails-html-sanitizer (1.6.1)
      loofah (~> 2.21)
@@ -1530,13 +1574,14 @@ GEM
    rails-i18n (7.0.10)
      i18n (>= 0.7, < 2)
      railties (>= 6.0.0, < 8)
-    railties (7.0.8.7)
-      actionpack (= 7.0.8.7)
-      activesupport (= 7.0.8.7)
-      method_source
+    railties (7.1.5.1)
+      actionpack (= 7.1.5.1)
+      activesupport (= 7.1.5.1)
+      irb
+      rackup (>= 1.0.0)
      rake (>= 12.2)
-      thor (~> 1.0)
-      zeitwerk (~> 2.5)
+      thor (~> 1.0, >= 1.2.2)
+      zeitwerk (~> 2.6)
    rainbow (3.1.1)
    rake (13.0.6)
    rake-compiler-dock (1.9.1)
@@ -1552,6 +1597,8 @@ GEM
      msgpack (>= 0.4.3)
      optimist (>= 3.0.0)
    rchardet (1.8.0)
+    rdoc (6.13.0)
+      psych (>= 4.0.0)
    re2 (2.15.0)
      mini_portile2 (~> 2.8.7)
    recaptcha (5.12.3)
@@ -1580,6 +1627,8 @@ GEM
      redis (>= 4, < 6)
    regexp_parser (2.10.0)
    regexp_property_values (1.0.0)
+    reline (0.6.0)
+      io-console (~> 0.5)
    representable (3.2.0)
      declarative (< 0.1.0)
      trailblazer-option (>= 0.1.1, < 0.2.0)
@@ -1595,7 +1644,7 @@ GEM
      mime-types (>= 1.16, < 4.0)
      netrc (~> 0.8)
    retriable (3.1.2)
-    reverse_markdown (1.4.0)
+    reverse_markdown (3.0.0)
      nokogiri
    rexml (3.4.1)
    rinku (2.0.0)
@@ -1684,7 +1733,7 @@ GEM
    ruby-fogbugz (0.3.0)
      crack (~> 0.4)
      multipart-post (~> 2.0)
-    ruby-lsp (0.23.13)
+    ruby-lsp (0.23.15)
      language_server-protocol (~> 3.17.0)
      prism (>= 1.2, < 2.0)
      rbs (>= 3, < 4)
@@ -1718,6 +1767,7 @@ GEM
      addressable (>= 2.3.5)
      faraday (>= 0.17.3, < 3)
    sd_notify (0.1.1)
+    securerandom (0.4.1)
    seed-fu (2.3.9)
      activerecord (>= 3.1)
      activesupport (>= 3.1)
@@ -1727,19 +1777,19 @@ GEM
      rexml (~> 3.2, >= 3.2.5)
      rubyzip (>= 1.2.2, < 3.0)
      websocket (~> 1.0)
-    semver_dialects (3.6.0)
+    semver_dialects (3.7.0)
      deb_version (~> 1.0.1)
      pastel (~> 0.8.0)
      thor (~> 1.3)
      tty-command (~> 0.10.1)
-    sentry-rails (5.22.1)
+    sentry-rails (5.23.0)
      railties (>= 5.0)
-      sentry-ruby (~> 5.22.1)
-    sentry-ruby (5.22.1)
+      sentry-ruby (~> 5.23.0)
+    sentry-ruby (5.23.0)
      bigdecimal
      concurrent-ruby (~> 1.0, >= 1.0.2)
-    sentry-sidekiq (5.22.1)
-      sentry-ruby (~> 5.22.1)
+    sentry-sidekiq (5.23.0)
+      sentry-ruby (~> 5.23.0)
      sidekiq (>= 3.0)
    shellany (0.0.1)
    shoulda-matchers (6.4.0)
@@ -1780,21 +1830,27 @@ GEM
      hashie
      version_gem (~> 1.1)
    snowplow-tracker (0.8.0)
-    solargraph (0.47.2)
+    solargraph (0.54.2)
      backport (~> 1.2)
-      benchmark
-      bundler (>= 1.17.2)
+      benchmark (~> 0.4)
+      bundler (~> 2.0)
      diff-lcs (~> 1.4)
-      e2mmap
-      jaro_winkler (~> 1.5)
+      jaro_winkler (~> 1.6)
      kramdown (~> 2.3)
      kramdown-parser-gfm (~> 1.1)
+      logger (~> 1.6)
+      observer (~> 0.1)
+      ostruct (~> 0.6)
      parser (~> 3.0)
-      reverse_markdown (>= 1.0.5, < 3)
-      rubocop (>= 0.52)
+      rbs (~> 3.3)
+      reverse_markdown (~> 3.0)
+      rubocop (~> 1.38)
      thor (~> 1.0)
      tilt (~> 2.0)
      yard (~> 0.9, >= 0.9.24)
+      yard-solargraph (~> 0.1)
+    solargraph-rspec (0.5.1)
+      solargraph (~> 0.52, >= 0.52.0)
    sorbet-runtime (0.5.11647)
    spamcheck (1.3.3)
      grpc (~> 1.63)
@@ -1819,6 +1875,11 @@ GEM
    state_machines-activerecord (0.8.0)
      activerecord (>= 5.1)
      state_machines-activemodel (>= 0.8.0)
+    state_machines-rspec (0.6.0)
+      activesupport
+      rspec (~> 3.3)
+      state_machines
+    stringio (3.1.7)
    strings (0.2.1)
      strings-ansi (~> 0.2)
      unicode-display_width (>= 1.5, < 3.0)
@@ -1878,6 +1939,8 @@ GEM
    truncato (0.7.13)
      htmlentities (~> 4.3.1)
      nokogiri (>= 1.7.0, <= 2.0)
+    ttfunk (1.8.0)
+      bigdecimal (~> 3.1)
    tty-color (0.6.0)
    tty-command (0.10.1)
      pastel (~> 0.8)
@@ -1943,7 +2006,7 @@ GEM
    vite_rails (3.0.19)
      railties (>= 5.1, < 9)
      vite_ruby (~> 3.0, >= 3.2.2)
-    vite_ruby (3.9.1)
+    vite_ruby (3.9.2)
      dry-cli (>= 0.7, < 2)
      logger (~> 1.6)
      mutex_m
@@ -1970,7 +2033,7 @@ GEM
      addressable (>= 2.8.0)
      crack (>= 0.3.2)
      hashdiff (>= 0.4.0, < 2.0.0)
-    webrick (1.8.2)
+    webrick (1.9.1)
    websocket (1.2.10)
    websocket-driver (0.7.6)
      websocket-extensions (>= 0.1.0)
@@ -1988,6 +2051,8 @@ GEM
      nokogiri (~> 1.8)
    yajl-ruby (1.4.3)
    yard (0.9.37)
+    yard-solargraph (0.1.0)
+      yard (~> 0.9)
    zeitwerk (2.6.7)

 PLATFORMS
@@ -2013,8 +2078,8 @@ DEPENDENCIES
  attr_encrypted (~> 3.2.4)!
  awesome_print
  aws-sdk-cloudformation (~> 1)
-  aws-sdk-core (~> 3.215.0)
-  aws-sdk-s3 (~> 1.177.0)
+  aws-sdk-core (~> 3.223.0)
+  aws-sdk-s3 (~> 1.185.0)
  axe-core-rspec (~> 4.10.0)
  babosa (~> 2.0)
  base32 (~> 0.3.0)
@@ -2038,18 +2103,17 @@ DEPENDENCIES
  concurrent-ruby (~> 1.1)
  connection_pool (~> 2.4)
  countries (~> 4.0.0)
-  coverband (= 6.1.4)
+  coverband (= 6.1.5)
  creole (~> 0.5.0)
-  crystalball (~> 0.7.0)
  cssbundling-rails (= 1.4.3)
  csv_builder!
  cvss-suite (~> 3.3.0)
  database_cleaner-active_record (~> 2.2.0)
  deckar01-task_list (= 2.3.4)
  declarative_policy (~> 1.1.0)
-  deprecation_toolkit (~> 1.5.1)
+  deprecation_toolkit (~> 2.2.3)
  derailed_benchmarks
-  devfile (~> 0.4.3)
+  devfile (~> 0.4.4)
  device_detector
  devise (~> 4.9.3)
  devise-pbkdf2-encryptable (~> 0.0.0)!
@@ -2062,7 +2126,7 @@ DEPENDENCIES
  doorkeeper-openid_connect (~> 1.8.10)
  drb (~> 2.2)
  duo_api (~> 1.3)
-  ed25519 (~> 1.3.0)
+  ed25519 (~> 1.4.0)
  elasticsearch-api (= 7.17.11)
  elasticsearch-model (~> 7.2)
  elasticsearch-rails (~> 7.2)
@@ -2095,20 +2159,21 @@ DEPENDENCIES
  gitlab-active-context!
  gitlab-backup-cli!
  gitlab-chronic (~> 0.10.5)
-  gitlab-cloud-connector (~> 1.5)
-  gitlab-dangerfiles (~> 4.8.0)
+  gitlab-cloud-connector (~> 1.11)
+  gitlab-crystalball (~> 0.7.2)
+  gitlab-dangerfiles (~> 4.9.0)
  gitlab-duo-workflow-service-client (~> 0.1)!
  gitlab-experiment (~> 0.9.1)
  gitlab-fog-azure-rm (~> 2.2.0)
-  gitlab-glfm-markdown (~> 0.0.29)
+  gitlab-glfm-markdown (~> 0.0.30)
  gitlab-housekeeper!
  gitlab-http!
-  gitlab-kas-grpc (~> 17.9.0.pre.rc2)
+  gitlab-kas-grpc (~> 17.11.0)
  gitlab-labkit (~> 0.37.0)
  gitlab-license (~> 2.6)
  gitlab-mail_room (~> 0.0.24)
  gitlab-markup (~> 2.0.0)
-  gitlab-net-dns (~> 0.10.0)
+  gitlab-net-dns (~> 0.12.0)
  gitlab-rspec!
  gitlab-rspec_flaky!
  gitlab-safe_request_store!
@@ -2122,7 +2187,7 @@ DEPENDENCIES
  gitlab-utils!
  gitlab_chronic_duration (~> 0.12)
  gitlab_omniauth-ldap (~> 2.2.0)
-  gitlab_quality-test_tooling (~> 2.8.0)
+  gitlab_quality-test_tooling (~> 2.10.0)
  gon (~> 6.4.0)
  google-apis-androidpublisher_v3 (~> 0.34.0)
  google-apis-cloudbilling_v1 (~> 0.22.0)
@@ -2168,7 +2233,7 @@ DEPENDENCIES
  ipynbdiff!
  jira-ruby (~> 2.3.0)
  js_regex (~> 3.8)
-  json (~> 2.10.0)
+  json (~> 2.11.0)
  json_schemer (~> 2.3.0)
  jsonb_accessor (~> 1.4)
  jwt (~> 2.9.3)
@@ -2249,14 +2314,16 @@ DEPENDENCIES
  org-ruby (~> 0.9.12)
  os (~> 1.1, >= 1.1.4)
  pact (~> 1.64)
-  paper_trail (~> 15.0)
+  paper_trail (~> 16.0)
  parallel (~> 1.19)
-  parser (= 3.3.7.1)
+  parser (= 3.3.8.0)
  parslet (~> 1.8)
  peek (~> 1.1)
  pg (~> 1.5.6)
  pg_query (~> 6.1.0)
  png_quantizator (~> 0.2.1)
+  prawn
+  prawn-svg
  premailer-rails (~> 1.12.0)
  prometheus-client-mmap (~> 1.2.9)
  pry-byebug
@@ -2269,7 +2336,7 @@ DEPENDENCIES
  rack-oauth2 (~> 2.2.1)
  rack-proxy (~> 0.7.7)
  rack-timeout (~> 0.7.0)
-  rails (~> 7.0.8.7)
+  rails (~> 7.1.5.1)
  rails-controller-testing
  rails-i18n (~> 7.0, >= 7.0.9)
  rainbow (~> 3.0)
@@ -2305,10 +2372,10 @@ DEPENDENCIES
  sd_notify (~> 0.1.0)
  seed-fu (~> 2.3.7)
  selenium-webdriver (~> 4.21, >= 4.21.1)
-  semver_dialects (~> 3.6)
-  sentry-rails (~> 5.22.0)
-  sentry-ruby (~> 5.22.0)
-  sentry-sidekiq (~> 5.22.0)
+  semver_dialects (~> 3.7)
+  sentry-rails (~> 5.23.0)
+  sentry-ruby (~> 5.23.0)
+  sentry-sidekiq (~> 5.23.0)
  shoulda-matchers (~> 6.4.0)
  sidekiq (~> 7.3.9)
  sidekiq-cron (~> 1.12.0)
@@ -2319,7 +2386,8 @@ DEPENDENCIES
  simplecov-lcov (~> 0.8.0)
  slack-messenger (~> 2.3.5)
  snowplow-tracker (~> 0.8.0)
-  solargraph (~> 0.47.2)
+  solargraph (~> 0.54.0)
+  solargraph-rspec (~> 0.5.1)
  spamcheck (~> 1.3.0)
  spring (~> 4.3.0)
  spring-commands-rspec (~> 1.0.4)
@@ -2329,6 +2397,7 @@ DEPENDENCIES
  ssh_data (~> 1.3)
  stackprof (~> 0.2.26)
  state_machines-activerecord (~> 0.8.0)
+  state_machines-rspec (~> 0.6)
  sys-filesystem (~> 1.4.3)
  tanuki_emoji (~> 0.13)
  telesignenterprise (~> 2.2)
@@ -2355,7 +2424,7 @@ DEPENDENCIES
  warning (~> 1.5.0)
  webauthn (~> 3.0)
  webmock (~> 3.25.0)
-  webrick (~> 1.8.1)
+  webrick (~> 1.9.0)
  wikicloth (= 0.8.1)
  yajl-ruby (~> 1.4.3)
  yard (~> 0.9)
@@ -242,7 +242,7 @@ def update_rubyenv():
    subprocess.check_output(["rm", "-rf", "vendor", "gems"], cwd=rubyenv_dir)

    # Reformat gemset.nix
-    subprocess.check_output(["nix-shell", "--run", "treefmt pkgs/applications/version-management/gitlab"], cwd=NIXPKGS_PATH)
+    subprocess.check_output(["nix-shell", "--run", "treefmt pkgs/by-name/gi/gitlab"], cwd=NIXPKGS_PATH)


@cli.command("update-gitaly")
@@ -378,7 +378,7 @@ def commit_gitlab(old_version: str, new_version: str, new_rev: str) -> None:
        [
            "git",
            "add",
-            "pkgs/applications/version-management/gitlab",
+            "pkgs/by-name/gi/gitlab",
            "pkgs/by-name/gi/gitaly",
            "pkgs/by-name/gi/gitlab-elasticsearch-indexer",
            "pkgs/by-name/gi/gitlab-pages",
@@ -6,13 +6,13 @@
 }:
 buildGoModule rec {
  pname = "goverter";
-  version = "1.8.2";
+  version = "1.8.3";

  src = fetchFromGitHub {
    owner = "jmattheis";
    repo = "goverter";
    tag = "v${version}";
-    hash = "sha256-f+rTEbr4Cr5PjXZg+E2235opxbakoYkJqEGRtyWrngE=";
+    hash = "sha256-ytW52raI4MV6cX/ThR6p9hohtngwBYuvSrtOfjnqwXc=";
  };

  vendorHash = "sha256-YOtcidMhtQqw/KxY1R3L3XnrhayGQBvHkRdbvYyCQFM=";
@@ -23,13 +23,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "h2o";
-  version = "2.3.0.20250430";
+  version = "2.3.0.20250519";

  src = fetchFromGitHub {
    owner = "h2o";
    repo = "h2o";
-    rev = "f1918a5b9f75f4da9db801b442886cb13b3c7bcd";
-    sha256 = "sha256-sfOkyEhlLGmXjYqRoI/8pD6/NBY7q6K9y2vS7qwJmrw=";
+    rev = "87e2aa634f2c0d9f3d9429f7a3cf273f98db0058";
+    sha256 = "sha256-/9YnaOqvYmFme4/mFq8Sx78FMDyGwnErEW45qPVELjU=";
  };

  outputs = [
@@ -7,15 +7,15 @@
 }:
 rustPlatform.buildRustPackage rec {
  pname = "hadolint-sarif";
-  version = "0.7.0";
+  version = "0.8.0";

  src = fetchCrate {
    inherit pname version;
-    hash = "sha256-HPGVqAk1bXzeblTc4AnCLsHB60CKFV8ImO+MFqM10YI=";
+    hash = "sha256-7xvo194lCQpDtLgwX6rZEkwG3hYTp5czjw4GrEaivsI=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-1nl5Myr8o1gyvkpsdMVLjZqnLkULOmxUOT0NmVe+0Oo=";
+  cargoHash = "sha256-R4fGlo65/suNozEzRaQ3k6Ys4CMBheT2+rHZZZuIstM=";

  nativeInstallCheckInputs = [ versionCheckHook ];
  doInstallCheck = true;
@@ -4,7 +4,7 @@
  lib,
 }:
 let
-  version = "0.16.1";
+  version = "0.16.2";
 in
 buildGoModule {
  pname = "heimdall-proxy";
@@ -15,10 +15,10 @@ buildGoModule {
    owner = "dadrus";
    repo = "heimdall";
    tag = "v${version}";
-    hash = "sha256-HP2YuipqqToTD44FreKtdJErtF4CWxnMf2JRmjgLuv0=";
+    hash = "sha256-RzRjcg9GocqXpBh8C34LrSLbSrJWd9y4+YEWJaAD8d0=";
  };

-  vendorHash = "sha256-9AOUgQEhOUzzT+qJLE7NlPqiQDQHJnLOT9JSwpetQXA=";
+  vendorHash = "sha256-GVUO5a6m85C7JRJ9WBTB7JDHRaiU2Nq3clWQUedKp98=";

  tags = [ "sqlite" ];

@@ -5,7 +5,7 @@
 }:

 let
-  version = "0.9.7";
+  version = "0.9.8";
 in
 rustPlatform.buildRustPackage {
  inherit version;
@@ -15,11 +15,11 @@ rustPlatform.buildRustPackage {
    owner = "sectordistrict";
    repo = "intentrace";
    tag = "v${version}";
-    hash = "sha256-24w5EQ3LQ7OxuVaqoLlUrYi2TmSLAfWGLNrkPcxMQMM=";
+    hash = "sha256-5QARHw9Z4+wYrxaAuSt9WjGR6qvSWAFIMdNOzE6FqfU=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-pLGWXwpgTh/7SaDhs63jr+5Fpsiep1tfl9VlCEBrK1s=";
+  cargoHash = "sha256-m4kLpJeqAvDI8/1gjqRVkbOvyfcLfwi0y2iavvm25jw=";

  meta = {
    description = "Prettified Linux syscall tracing tool (like strace)";
@@ -6,7 +6,7 @@

 buildGoModule rec {
  pname = "ipfs-cluster";
-  version = "1.1.3";
+  version = "1.1.4";

  vendorHash = "sha256-VVejr6B7eDNNQF34PS/PaQ50mBNZgzJS50aNzbLJgCg=";

@@ -14,7 +14,7 @@ buildGoModule rec {
    owner = "ipfs-cluster";
    repo = "ipfs-cluster";
    rev = "v${version}";
-    hash = "sha256-C3bBtZsDcYy6I0wmaYIDwhmGJVNcWq+rCdi5WHUzvB8=";
+    hash = "sha256-mdLrLiRNudpQ8i0lvwoNAqhSWJ8VMEC1ZRxXHWHpqLY=";
  };

  meta = with lib; {
@@ -9,7 +9,7 @@
 let
  pname = "jai";
  minor = "2";
-  patch = "011";
+  patch = "012";
  version = "0.${minor}.${patch}";
  zipName = "jai-beta-${minor}-${patch}.zip";
  jai = stdenv.mkDerivation {
@@ -20,7 +20,7 @@ let
          nix-store --add-fixed sha256 ${zipName}
      '';
      name = zipName;
-      sha256 = "sha256-Du4rTA2g7hjlsUA/hvPY6O6L34e/MmnUN8rzi1jF/dY";
+      sha256 = "sha256-1cUEQ+C3qwo3v4E2ioH2NcIH864Cay2dxQT+Yo/fZJ8=";
    };
    nativeBuildInputs = [ unzip ];
    buildCommand = "unzip $src -d $out";
@@ -7,13 +7,13 @@

 buildGoModule rec {
  pname = "kubevpn";
-  version = "2.7.5";
+  version = "2.7.11";

  src = fetchFromGitHub {
    owner = "KubeNetworks";
    repo = "kubevpn";
    rev = "v${version}";
-    hash = "sha256-WB3Qths9Lg48KfmRYg6O+fZIQ97n+Q7LgudT4Npqnl8=";
+    hash = "sha256-PqKgBJugibgG/4gGBINuFxWAxSYEKRpPXpofiOKmmIs=";
  };

  vendorHash = null;
@@ -18,17 +18,17 @@ let
 in
 rustPlatform.buildRustPackage rec {
  pname = "lockbook-desktop";
-  version = "0.9.22";
+  version = "0.9.23";

  src = fetchFromGitHub {
    owner = "lockbook";
    repo = "lockbook";
    tag = version;
-    hash = "sha256-akCtnPLJupoo7n3Vfyl37fjCmK4dHB0bt92rie6k0dQ=";
+    hash = "sha256-1SHAlhcQFuhwiYQReVOILX2T0gufNBojuy/E/EcECNw=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-xH3GIwh3zaLbpZqvzM+KM+K14fWj241RTwUM7dWRCKA=";
+  cargoHash = "sha256-TAa/HuRDwRr5GBObcQwxebTiBjRrWeq52HFYT9h6Rq4=";

  nativeBuildInputs = [
    pkg-config
@@ -10,14 +10,14 @@

 buildPythonPackage rec {
  pname = "synapse-http-antispam";
-  version = "0.3.0";
+  version = "0.4.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "maunium";
    repo = "synapse-http-antispam";
    tag = "v${version}";
-    hash = "sha256-wWm23+3o+/nx3xGkyShJm28mDPTbOhPbKgW3WfuB0Ng=";
+    hash = "sha256-YvgHIZ5Kr9WsX30QN8W5OJ4sxLB7EsLqUmCye3x+JQA=";
  };

  build-system = [ hatchling ];
@@ -27,13 +27,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "melonDS";
-  version = "1.0rc-unstable-2025-04-09";
+  version = "1.0rc-unstable-2025-05-15";

  src = fetchFromGitHub {
    owner = "melonDS-emu";
    repo = "melonDS";
-    rev = "9ed7e5803e55c5eeb29ec560c8659b38ed331749";
-    hash = "sha256-wLCaGnaMYaPjFzYTph16WTdE89j4MFaO4FuIQdH9R80=";
+    rev = "0e64a06c84f9b9428f8647c2aafde110c9d917f3";
+    hash = "sha256-T+AcpAITNALtZbuwY+oh4RnMgjCAi7n2HPyDjFqpQPI=";
  };

  nativeBuildInputs = [
@@ -1,21 +1,24 @@
 {
  lib,
  stdenv,
-  fetchurl,
+  fetchFromGitHub,
 }:

 stdenv.mkDerivation rec {
  pname = "mt-st";
-  version = "1.3";
+  version = "1.8";

-  src = fetchurl {
-    url = "https://github.com/iustin/mt-st/releases/download/mt-st-${version}/mt-st-${version}.tar.gz";
-    sha256 = "b552775326a327cdcc076c431c5cbc4f4e235ac7c41aa931ad83f94cccb9f6de";
+  src = fetchFromGitHub {
+    owner = "iustin";
+    repo = "mt-st";
+    tag = "v${version}";
+    hash = "sha256-Sl+/v+ko3K4npY/M49H1YDxqOMy923qcAkTohi5Xg70=";
  };

  installFlags = [
-    "PREFIX=$(out)"
-    "EXEC_PREFIX=$(out)"
+    "PREFIX="
+    "DESTDIR=$(out)"
+    "COMPLETIONINSTALLDIR=$(out)/share/bash-completion/completions"
  ];

  meta = {
@@ -5,7 +5,7 @@ import os
 import sys
 from pathlib import Path
 from subprocess import CalledProcessError, run
-from typing import assert_never
+from typing import Final, assert_never

 from . import nix, tmpdir
 from .constants import EXECUTABLE, WITH_NIX_2_18, WITH_REEXEC, WITH_SHELL_FILES
@@ -13,7 +13,7 @@ from .models import Action, BuildAttr, Flake, ImageVariants, NRError, Profile
 from .process import Remote, cleanup_ssh
 from .utils import Args, LogFormatter, tabulate

-logger = logging.getLogger()
+logger: Final = logging.getLogger()
 logger.setLevel(logging.INFO)


@@ -1,9 +1,11 @@
+from typing import Final
+
 # Build-time flags
 # Use strings to avoid breaking standalone (e.g.: `python -m nixos_rebuild`)
 # usage
-EXECUTABLE = "@executable@"
+EXECUTABLE: Final[str] = "@executable@"
 # Use either `== "true"` if the default (e.g.: `python -m nixos_rebuild`) is
 # `False` or `!= "false"` if the default is `True`
-WITH_NIX_2_18 = "@withNix218@" != "false"  # type: ignore
-WITH_REEXEC = "@withReexec@" == "true"  # type: ignore
-WITH_SHELL_FILES = "@withShellFiles@" == "true"  # type: ignore
+WITH_NIX_2_18: Final[bool] = "@withNix218@" != "false"
+WITH_REEXEC: Final[bool] = "@withReexec@" == "true"
+WITH_SHELL_FILES: Final[bool] = "@withShellFiles@" == "true"
@@ -45,7 +45,7 @@ SWITCH_TO_CONFIGURATION_CMD_PREFIX: Final = [
    "--service-type=exec",
    "--unit=nixos-rebuild-switch-to-configuration",
 ]
-logger = logging.getLogger(__name__)
+logger: Final = logging.getLogger(__name__)


 def build(
@@ -1,6 +1,7 @@
 import atexit
 import logging
 import os
+import re
 import shlex
 import subprocess
 from collections.abc import Sequence
@@ -10,7 +11,7 @@ from typing import Final, Self, TypedDict, Unpack

 from . import tmpdir

-logger = logging.getLogger(__name__)
+logger: Final = logging.getLogger(__name__)

 SSH_DEFAULT_OPTS: Final = [
    "-o",
@@ -21,6 +22,8 @@ SSH_DEFAULT_OPTS: Final = [
    "ControlPersist=60",
 ]

+type Args = Sequence[str | bytes | os.PathLike[str] | os.PathLike[bytes]]
+

@dataclass(frozen=True)
 class Remote:
@@ -82,7 +85,7 @@ atexit.register(cleanup_ssh)


 def run_wrapper(
-    args: Sequence[str | bytes | os.PathLike[str] | os.PathLike[bytes]],
+    args: Args,
    *,
    check: bool = True,
    extra_env: dict[str, str] | None = None,
@@ -93,6 +96,8 @@ def run_wrapper(
    "Wrapper around `subprocess.run` that supports extra functionality."
    env = None
    process_input = None
+    run_args = args
+
    if remote:
        if extra_env:
            extra_env_args = [f"{env}={value}" for env, value in extra_env.items()]
@@ -103,7 +108,7 @@ def run_wrapper(
                process_input = remote.sudo_password + "\n"
            else:
                args = ["sudo", *args]
-        args = [
+        run_args = [
            "ssh",
            *remote.opts,
            *SSH_DEFAULT_OPTS,
@@ -119,32 +124,39 @@ def run_wrapper(
        if extra_env:
            env = os.environ | extra_env
        if sudo:
-            args = ["sudo", *args]
+            run_args = ["sudo", *run_args]

    logger.debug(
        "calling run with args=%r, kwargs=%r, extra_env=%r",
-        args,
+        run_args,
        kwargs,
        extra_env,
    )

    try:
        r = subprocess.run(
-            args,
+            run_args,
            check=check,
            env=env,
            input=process_input,
-            # Hope nobody is using NixOS with non-UTF8 encodings, but "surrogateescape"
-            # should still work in those systems.
+            # Hope nobody is using NixOS with non-UTF8 encodings, but
+            # "surrogateescape" should still work in those systems.
            text=True,
            errors="surrogateescape",
            **kwargs,
        )

        if kwargs.get("capture_output") or kwargs.get("stderr") or kwargs.get("stdout"):
-            logger.debug("captured output stdout=%r, stderr=%r", r.stdout, r.stderr)
+            logger.debug(
+                "captured output with stdout=%r, stderr=%r", r.stdout, r.stderr
+            )

        return r
+    except KeyboardInterrupt:
+        # sudo commands are activation only and unlikely to be long running
+        if remote and not sudo:
+            _kill_long_running_ssh_process(args, remote)
+        raise
    except subprocess.CalledProcessError:
        if sudo and remote and remote.sudo_password is None:
            logger.error(
@@ -152,3 +164,55 @@ def run_wrapper(
                + "--ask-sudo-password?"
            )
        raise
+
+
+# SSH does not send the signals to the process when running without usage of
+# pseudo-TTY (that causes a whole other can of worms), so if the process is
+# long running (e.g.: a build) this will result in the underlying process
+# staying alive.
+# See: https://stackoverflow.com/a/44354466
+# Issue: https://github.com/NixOS/nixpkgs/issues/403269
+def _kill_long_running_ssh_process(args: Args, remote: Remote) -> None:
+    logger.info("cleaning-up remote process, please wait...")
+
+    # We need to escape both the shell and regex here (since pkill interprets
+    # its arguments as regex)
+    quoted_args = re.escape(shlex.join(str(a) for a in args))
+    logger.debug("killing remote process using pkill with args=%r", quoted_args)
+    cleanup_interrupted = False
+
+    try:
+        r = subprocess.run(
+            [
+                "ssh",
+                *remote.opts,
+                *SSH_DEFAULT_OPTS,
+                remote.host,
+                "--",
+                "pkill",
+                "--signal",
+                "SIGINT",
+                "--full",
+                "--",
+                quoted_args,
+            ],
+            check=False,
+            capture_output=True,
+            text=True,
+        )
+        logger.debug(
+            "remote pkill captured output with stdout=%r, stderr=%r, returncode=%s",
+            r.stdout,
+            r.stderr,
+            r.returncode,
+        )
+    except KeyboardInterrupt:
+        cleanup_interrupted = True
+        raise
+    finally:
+        if cleanup_interrupted or r.returncode:
+            logger.warning(
+                "could not clean-up remote process, the command %s may still be running in host '%s'",
+                args,
+                remote.host,
+            )
@@ -96,6 +96,37 @@ def test_run(mock_run: Any) -> None:
    )


+@patch(get_qualified_name(p.subprocess.run), autospec=True)
+def test__kill_long_running_ssh_process(mock_run: Any) -> None:
+    p._kill_long_running_ssh_process(
+        [
+            "nix",
+            "--extra-experimental-features",
+            "nix-command flakes",
+            "build",
+            "/nix/store/la0c8nmpr9xfclla0n4f3qq9iwgdrq4g-nixos-system-sankyuu-nixos-25.05.20250424.f771eb4.drv^*",
+        ],
+        m.Remote("user@localhost", opts=[], sudo_password=None),
+    )
+    mock_run.assert_called_with(
+        [
+            "ssh",
+            *p.SSH_DEFAULT_OPTS,
+            "user@localhost",
+            "--",
+            "pkill",
+            "--signal",
+            "SIGINT",
+            "--full",
+            "--",
+            r"nix\ \-\-extra\-experimental\-features\ 'nix\-command\ flakes'\ build\ '/nix/store/la0c8nmpr9xfclla0n4f3qq9iwgdrq4g\-nixos\-system\-sankyuu\-nixos\-25\.05\.20250424\.f771eb4\.drv\^\*'",
+        ],
+        check=False,
+        capture_output=True,
+        text=True,
+    )
+
+
 def test_remote_from_name(monkeypatch: MonkeyPatch) -> None:
    monkeypatch.setenv("NIX_SSHOPTS", "")
    assert m.Remote.from_arg("user@localhost", None, False) == m.Remote(
@@ -7,13 +7,13 @@

 stdenvNoCC.mkDerivation {
  pname = "nu_scripts";
-  version = "0-unstable-2025-05-05";
+  version = "0-unstable-2025-05-15";

  src = fetchFromGitHub {
    owner = "nushell";
    repo = "nu_scripts";
-    rev = "4ecbb0e04e0a944145c86ec8bf3e4fc7ca3958a5";
-    hash = "sha256-ssqSZnc8YnCB/62eN9KQzf+cm686/NFKcj4M2sd0XxM=";
+    rev = "b2d512f6c67f68895a26136c6ce552281efbec6e";
+    hash = "sha256-iC5Qmyn9vDr4b1BWtJkC3pl2dOam2Se51+ENvRdXlvA=";
  };

  installPhase = ''
@@ -13,16 +13,16 @@

 let
  pname = "nwg-drawer";
-  version = "0.6.5";
+  version = "0.7.0";

  src = fetchFromGitHub {
    owner = "nwg-piotr";
    repo = "nwg-drawer";
    rev = "v${version}";
-    hash = "sha256-fWh2htmLIM0IHRYOs8fzrjwq1IRLDJpWniY24BVFtFE=";
+    hash = "sha256-M0+4/lr79CYBy2+ysB1Wb1obD7B/Qi8MBwNhIsiIDak=";
  };

-  vendorHash = "sha256-iUFOWPr306CteR+5Cz/kE+XoG/qr3BBdM9duZm4TOU4=";
+  vendorHash = "sha256-1uZTZ7/p1l4Rue3mxlaMRSDfyARo94wR4KIKkQXBUMQ=";
 in
 buildGoModule {
  inherit
@@ -28,13 +28,13 @@
 stdenv.mkDerivation rec {
  pname = "openvpn3";
  # also update openvpn3-core
-  version = "24";
+  version = "24.1";

  src = fetchFromGitHub {
    owner = "OpenVPN";
    repo = "openvpn3-linux";
    tag = "v${version}";
-    hash = "sha256-e3NRLrznTEolTzMO+kGEh48MCrcEr8p7JG3hG889aK4=";
+    hash = "sha256-E6SBVPHmejXB18RuNCNq62yWOJslZfIjVbNUdRIk5Sw=";
    # `openvpn3-core` is a submodule.
    # TODO: make it into a separate package
    fetchSubmodules = true;
@@ -8,17 +8,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "ord";
-  version = "0.23.1";
+  version = "0.23.2";

  src = fetchFromGitHub {
    owner = "ordinals";
    repo = "ord";
    rev = version;
-    hash = "sha256-jYu9NPvs7nwgiqMCvZlLQqoYESwjKAYlhJ9ehev70EY=";
+    hash = "sha256-p9WjZ8QsY5fvL91zPUKnK8p0ZJvAxzmPbN/UVWSNjqk=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-U5bGNgiy98PK2Le5BbzCOAajeEKb/zYTIID1uOE6p3c=";
+  cargoHash = "sha256-c3+yM7jJyIl2XpSOeqdeQP2OdRc7/t/epDTMoOa/66A=";

  nativeBuildInputs = [
    pkg-config
@@ -8,15 +8,15 @@
 }:
 rustPlatform.buildRustPackage rec {
  pname = "sarif-fmt";
-  version = "0.7.0";
+  version = "0.8.0";

  src = fetchCrate {
    inherit pname version;
-    hash = "sha256-uQQ/UbmyPJbilxP2R+6KyBkf2dzGohN22xCCtU31y0s=";
+    hash = "sha256-Xc9uc//5wTBWJ89mcaC/4c8/xtTvnu8g2Aa1viUhluo=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-naABVC4z5tYfe/Y2Gw4wp2Ye9wIF0Wq7jqhelcRQY30=";
+  cargoHash = "sha256-h4g4+2yiqr3CTkSgv8fTHEVQwSunFfYFhIczSGA+M5U=";

  # `test_clippy` (the only test we enable) is broken on Darwin
  # because `--enable-profiler` is not enabled in rustc on Darwin
@@ -1,32 +0,0 @@
-diff --git a/sdl2-config.cmake.in b/sdl2-config.cmake.in
-index db864aab9..b94e16043 100644
--- a/sdl2-config.cmake.in
-+++ b/sdl2-config.cmake.in
-@@ -26,7 +26,9 @@ set_and_check(SDL2_EXEC_PREFIX    "${exec_prefix}")
- set_and_check(SDL2_BINDIR         "${bindir}")
- set_and_check(SDL2_INCLUDE_DIR    "${includedir}/SDL2")
- set_and_check(SDL2_LIBDIR         "${libdir}")
-set(SDL2_INCLUDE_DIRS             "${includedir};${SDL2_INCLUDE_DIR}")
-+
-+set(SDL2_INCLUDE_DIRS "${includedir};${SDL2_INCLUDE_DIR}" $ENV{SDL2_PATH})
-+separate_arguments(SDL2_INCLUDE_DIRS)
- 
- set(SDL2_LIBRARIES SDL2::SDL2)
- set(SDL2_STATIC_LIBRARIES SDL2::SDL2-static)
-diff --git a/sdl2-config.in b/sdl2-config.in
-index f6eca7668..c0cd94590 100644
--- a/sdl2-config.in
-+++ b/sdl2-config.in
-@@ -46,7 +46,11 @@ while test $# -gt 0; do
-       echo @SDL_VERSION@
-       ;;
-     --cflags)
-      echo -I@includedir@/SDL2 @SDL_CFLAGS@
-+      SDL_CFLAGS=""
-+      for i in @includedir@/SDL2 $SDL2_PATH; do
-+        SDL_CFLAGS="$SDL_CFLAGS -I$i"
-+      done
-+      echo $SDL_CFLAGS @SDL_CFLAGS@
-       ;;
- @ENABLE_SHARED_TRUE@    --libs)
- @ENABLE_SHARED_TRUE@      echo -L@libdir@ @SDL_RLD_FLAGS@ @SDL_LIBS@
--- a/Show More
+++ b/Show More