Merge commit '803c334e054de82093d74d01ce0ae215f171b793' into haskell-updates

2026-03-31 16:41:17 +02:00
parent d300005877 803c334e05
commit 764e9289bf
745 changed files with 12216 additions and 13525 deletions
@@ -13,7 +13,7 @@ inputs:
 runs:
  using: composite
  steps:
-    - uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+    - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
      env:
        MERGED_SHA: ${{ inputs.merged-as-untrusted-at }}
        TARGET_SHA: ${{ inputs.target-as-trusted-at }}
@@ -62,6 +62,7 @@ jobs:
              '.github/workflows/merge-group.yml',
              '.github/workflows/test.yml',
              'ci/github-script/supportedSystems.js',
+              'ci/pinned.json',
              'ci/supportedBranches.js',
            ].includes(file))) core.setOutput('merge-group', true)

@@ -85,6 +86,7 @@ jobs:
              'ci/github-script/reviews.js',
              'ci/github-script/supportedSystems.js',
              'ci/github-script/withRateLimit.js',
+              'ci/pinned.json',
              'ci/supportedBranches.js',
            ].includes(file))) core.setOutput('pr', true)

@@ -519,3 +519,7 @@ pkgs/by-name/wa/warp-terminal/  @emilytrau @imadnyc @FlameFlag @johnrtitor
 /pkgs/build-support/build-nim-package.nix @NixOS/nim
 /pkgs/build-support/build-nim-sbom.nix    @NixOS/nim
 /pkgs/top-level/nim-overrides.nix         @NixOS/nim
+
+# Radicle
+/pkgs/build-support/fetchradicle/      @NixOS/radicle
+/pkgs/build-support/fetchradiclepatch/ @NixOS/radicle
@@ -99,7 +99,7 @@ Then when building the frontend you can just symlink the node_modules directory.

 ### buildNpmPackage {#javascript-buildNpmPackage}

-`buildNpmPackage` allows you to package npm-based projects in Nixpkgs without the use of an auto-generated dependencies file (as used in [node2nix](#javascript-node2nix)).
+`buildNpmPackage` allows you to package npm-based projects in Nixpkgs without the use of an auto-generated dependencies file.
 It works by utilizing npm's cache functionality -- creating a reproducible cache that contains the dependencies of a project, and pointing npm to it.

 Here's an example:
@@ -306,25 +306,6 @@ It's recommended to set `package-lock-only = true` in your project-local [`.npmr

 This package puts the corepack wrappers for pnpm and yarn in your PATH, and they will honor the `packageManager` setting in the `package.json`.

-### node2nix {#javascript-node2nix}
-
-#### Preparation {#javascript-node2nix-preparation}
-
-You will need to generate a Nix expression for the dependencies. Don't forget the `-l package-lock.json` if there is a lock file. Most probably you will need the `--development` to include the `devDependencies`
-
-So the command will most likely be:
-```sh
-node2nix --development -l package-lock.json
-```
-
-See `node2nix` [docs](https://github.com/svanderburg/node2nix) for more info.
-
-#### Pitfalls {#javascript-node2nix-pitfalls}
-
- If upstream package.json does not have a "version" attribute, `node2nix` will crash. You will need to add it like shown in [the package.json section](#javascript-upstream-package-json).
- `node2nix` has some [bugs](https://github.com/svanderburg/node2nix/issues/238) related to working with lock files from npm distributed with `nodejs_16`.
- `node2nix` does not like missing packages from npm. If you see something like `Cannot resolve version: vue-loader-v16@undefined` then you might want to try another tool. The package might have been pulled off of npm.
-
 ### pnpm {#javascript-pnpm}

 pnpm is available as the top-level package `pnpm`. Additionally, there are variants pinned to certain major versions, like `pnpm_8`, `pnpm_9` and `pnpm_10`, which support different sets of lock file versions.
@@ -170,8 +170,6 @@ Sometimes plugins require an override that must be changed when the plugin is up

 To add a new plugin, run `nix-shell -p vimPluginsUpdater --run 'vim-plugins-updater add "[owner]/[name]"'`. **NOTE**: This script automatically commits to your git repository. Be sure to check out a fresh branch before running.

-Finally, there are some plugins that are also packaged in nodePackages because they have Javascript-related build steps, such as running webpack. Those plugins are not listed in `vim-plugin-names` or managed by `vimPluginsUpdater` at all, and are included separately in `overrides.nix`. Currently, all these plugins are related to the `coc.nvim` ecosystem of the Language Server Protocol integration with Vim/Neovim.
-
 ## Updating plugins in nixpkgs {#updating-plugins-in-nixpkgs}

 Run the update script with a GitHub API token that has at least `public_repo` access. Running the script without the token is likely to result in rate-limiting (429 errors). For steps on creating an API token, please refer to [GitHub's token documentation](https://docs.github.com/en/free-pro-team@latest/github/authenticating-to-github/creating-a-personal-access-token).
@@ -430,7 +430,10 @@
    "index.html#katamari-tarballs",
    "index.html#individual-tarballs",
    "index.html#generating-nix-expressions",
-    "index.html#overriding-the-generator"
+    "index.html#overriding-the-generator",
+    "index.html#javascript-node2nix",
+    "index.html#javascript-node2nix-preparation",
+    "index.html#javascript-node2nix-pitfalls"
  ],
  "sec-nixpkgs-release-26.05-lib": [
    "release-notes.html#sec-nixpkgs-release-26.05-lib"
@@ -3642,15 +3645,6 @@
  "javascript-corepack": [
    "index.html#javascript-corepack"
  ],
-  "javascript-node2nix": [
-    "index.html#javascript-node2nix"
-  ],
-  "javascript-node2nix-preparation": [
-    "index.html#javascript-node2nix-preparation"
-  ],
-  "javascript-node2nix-pitfalls": [
-    "index.html#javascript-node2nix-pitfalls"
-  ],
  "javascript-pnpm": [
    "index.html#javascript-pnpm"
  ],
@@ -74,6 +74,12 @@

 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->

+- The `nodePackages` package set has been removed entirely from nixpkgs. This package set was created to ease the maintenance burden of maintaining lots of
+  NodeJS-based packages within nixpkgs, but became a burden itself. Over the past several releases, there has been a focus on removing it in favor of the more modern nixpkgs packaging strategies.
+  After a long time, this package set has been deprecated and removed. If you are using its package set in your own config, please use the top-level packages instead.(i.e `pkgs.package-name` instead of `pkgs.nodePackages.package-name`).
+
+- Note that the above `nodePackages` removal also coincides with the removal of `node2nix` and its tooling, which have been deprecated for a long time.
+
 - `xfce.mkXfceDerivation` has been deprecated (i.e. conditioned behind `nixpkgs.config.allowAliases`)
  and will be removed in NixOS 26.11, please use `stdenv.mkDerivation` directly. You can migrate by
  adding `pkg-config`, `xfce4-dev-tools`, and `wrapGAppsHook3` to your `nativeBuildInputs` and
@@ -632,8 +632,6 @@ rec {
    else if platform.isPower64 then
      if platform.isLittleEndian then powernv else ppc64

-    else if platform.isLoongArch64 then
-      loongarch64-multiplatform
    else
      { };
 }
@@ -278,7 +278,7 @@
    "name": "darwin-maintainers"
  },
  "documentation-team": {
-    "description": "Maintain nixpkgs/NixOS documentation and tools for building it. https://nixos.org/community/teams/documentation",
+    "description": "Owns the standards, tooling, and processes that keep NixOS documentation reliable.",
    "id": 6590023,
    "maintainers": {
      "hsjobeki": 50398876
@@ -839,6 +839,19 @@
    },
    "name": "Qt-KDE"
  },
+  "radicle": {
+    "description": "Maintain Radicle related packages, modules, and tests",
+    "id": 16784086,
+    "maintainers": {
+      "Defelo": 41747605,
+      "lorenzleutgeb": 542154
+    },
+    "members": {
+      "ju1m": 21160136,
+      "matthiasbeyer": 427866
+    },
+    "name": "Radicle"
+  },
  "reproducible": {
    "description": "Team that is interested in reproducible builds",
    "id": 7625643,
@@ -1539,13 +1539,6 @@
    github = "amerinor01";
    githubId = 22280447;
  };
-  amesgen = {
-    email = "amesgen@amesgen.de";
-    github = "amesgen";
-    githubId = 15369874;
-    name = "Alexander Esgen";
-    matrix = "@amesgen:amesgen.de";
-  };
  ametrine = {
    name = "Matilde Ametrine";
    email = "matilde@diffyq.xyz";
@@ -2814,6 +2807,12 @@
    github = "azazak123";
    githubId = 50211158;
  };
+  azban = {
+    name = "azban";
+    matrix = "@azban:matrix.org";
+    github = "azban";
+    githubId = 714931;
+  };
  azd325 = {
    email = "tim.kleinschmidt@gmail.com";
    github = "Azd325";
@@ -8529,12 +8528,6 @@
    name = "Fang-Pen Lin";
    keys = [ { fingerprint = "7130 3454 A7CD 0F0A 941A  F9A3 2A26 9964 AD29 2131"; } ];
  };
-  farcaller = {
-    name = "Vladimir Pouzanov";
-    email = "farcaller@gmail.com";
-    github = "farcaller";
-    githubId = 693;
-  };
  fare = {
    email = "fahree@gmail.com";
    github = "fare";
@@ -10101,12 +10094,6 @@
    keys = [ { fingerprint = "D1D3 37F6 CB32 02DC B9BA  337B F9D8 EABC F57E ED58"; } ];
    name = "Gabriel Santos";
  };
-  gschwartz = {
-    email = "gsch@pennmedicine.upenn.edu";
-    github = "GregorySchwartz";
-    githubId = 2490088;
-    name = "Gregory Schwartz";
-  };
  gtrunsec = {
    email = "gtrunsec@hardenedlinux.org";
    github = "GTrunSec";
@@ -13319,6 +13306,12 @@
    name = "Joshua Suskalo";
    githubId = 27734541;
  };
+  jtamagnan = {
+    email = "jtamagnan@gmail.com";
+    github = "jtamagnan";
+    githubId = 5892061;
+    name = "Jules Tamagnan";
+  };
  jtbx = {
    email = "jeremy@baxters.nz";
    name = "Jeremy Baxter";
@@ -13745,6 +13738,12 @@
    githubId = 15855440;
    name = "Keanu Ashwell";
  };
+  kasifrasi = {
+    name = "Ardit Abrashi";
+    github = "Kasifrasi";
+    githubId = 73264146;
+    email = "ardit.abrashi03@gmail.com";
+  };
  katanallama = {
    github = "katanallama";
    githubId = 70604257;
@@ -14366,6 +14365,12 @@
    githubId = 659440;
    name = "Kornelijus";
  };
+  korny666 = {
+    email = "korny@publicgrave.de";
+    github = "korny666";
+    githubId = 12656521;
+    name = "Korny";
+  };
  koschi13 = {
    email = "maximilian.konter@protonmail.com";
    github = "koschi13";
@@ -14724,6 +14729,14 @@
    github = "kxxt";
    githubId = 18085551;
  };
+  kybe236 = {
+    name = "kybe236";
+    github = "kybe236";
+    githubId = 118068228;
+    email = "kybe@kybe.xyz";
+    matrix = "@kybe:kybe.xyz";
+    keys = [ { fingerprint = "4B20 67C3 BD6D 410F 13E5  36A3 43CE 4393 8A3C 7A8F"; } ];
+  };
  kyehn = {
    name = "kyehn";
    github = "kyehn";
@@ -15511,6 +15524,11 @@
    githubId = 516527;
    name = "Lukas Werling";
  };
+  lnk3 = {
+    github = "lnk3";
+    githubId = 23727619;
+    name = "Luca Ruperto";
+  };
  lnl7 = {
    email = "daiderd@gmail.com";
    github = "LnL7";
@@ -24276,13 +24294,6 @@
    githubId = 149248;
    name = "Christian Rackerseder";
  };
-  Scriptkiddi = {
-    email = "nixos@scriptkiddi.de";
-    matrix = "@fritz.otlinghaus:helsinki-systems.de";
-    github = "Scriptkiddi";
-    githubId = 3598650;
-    name = "Fritz Otlinghaus";
-  };
  Scrumplex = {
    name = "Sefa Eyeoglu";
    email = "contact@scrumplex.net";
@@ -65,7 +65,8 @@ lua-resty-jwt,,,,,,
 lua-resty-openidc,,,,,,
 lua-resty-openssl,,,,,,
 lua-resty-session,,,,,,
-lua-rtoml,https://raw.githubusercontent.com/lblasc/lua-rtoml/main/lua-rtoml-0.2-0.rockspec,,,,,lblasc
+# we have to set url because luarocks.org lua-rtoml is squatted by another package
+lua-rtoml,https://raw.githubusercontent.com/lblasc/lua-rtoml/eb89439070c72ccf05efb8576abae7643abab354/lua-rtoml-0.3-0.rockspec,,,,,lblasc
 lua-subprocess,https://raw.githubusercontent.com/0x0ade/lua-subprocess/master/subprocess-scm-1.rockspec,,,,5.1,scoder12
 lua-term,,,,,,
 lua-toml,,,,,,
@@ -687,6 +687,10 @@ with lib.maintainers;
    enableFeatureFreezePing = true;
  };

+  radicle = {
+    github = "radicle";
+  };
+
  rocm = {
    github = "rocm";
  };
@@ -44,10 +44,8 @@ let
  drivers = [
    "razerkbd"
    "razermouse"
-    "razerfirefly"
    "razerkraken"
-    "razermug"
-    "razercore"
+    "razeraccessory"
  ];
 in
 {
@@ -957,6 +957,7 @@
  ./services/misc/servarr/sonarr.nix
  ./services/misc/servarr/whisparr.nix
  ./services/misc/serviio.nix
+  ./services/misc/shelfmark.nix
  ./services/misc/shoko.nix
  ./services/misc/sickbeard.nix
  ./services/misc/snapper.nix
@@ -9,8 +9,6 @@ let
  cfg = config.programs.bazecor;
 in
 {
-  meta.maintainers = with lib.maintainers; [ amesgen ];
-
  options = {
    programs.bazecor = {
      enable = lib.mkEnableOption "Bazecor, the graphical configurator for Dygma Products";
@@ -15,7 +15,7 @@ let
 in

 {
-  meta.maintainers = with lib.maintainers; [ defelo ];
+  meta.teams = [ lib.teams.radicle ];

  options.services.radicle.ci.adapters.native = {
    instances = lib.mkOption {
@@ -37,7 +37,7 @@ let
 in

 {
-  meta.maintainers = with lib.maintainers; [ defelo ];
+  meta.teams = [ lib.teams.radicle ];

  options.services.radicle.ci.broker = {
    enable = lib.mkEnableOption "radicle-ci-broker";
@@ -81,6 +81,9 @@ in
          IPC_EXIT_ON_DISCONNECT = mkDefault "off";
          # Needed to avoid libbasalt.so: cannot open shared object file: No such file or directory
          VIT_SYSTEM_LIBRARY_PATH = mkDefault "${pkgs.basalt-monado}/lib/libbasalt.so";
+          # Improves performance
+          # https://gitlab.com/gabmus/envision/-/blob/2f731053537044b1f72b259bea795473ea0c205a/src/profiles/lighthouse.rs#L19
+          U_PACING_APP_USE_MIN_FRAME_PERIOD = mkDefault "1";
        };

        preStart = mkIf cfg.forceDefaultRuntime ''
@@ -145,10 +145,16 @@ in
      after = [ "network.target" ];
      wantedBy = [ "multi-user.target" ];
      path = [ pkgs.git ];
-
      preStart = ''
-        # This is safe to be run on an existing repo
-        git init ${cfg.stateDir}
+        # Check if it's a bare repository.
+        IS_BARE=$(git -C "${cfg.stateDir}" rev-parse --is-bare-repository 2>/dev/null || echo "false")
+
+        if [ "$IS_BARE" = "true" ]; then
+          echo "Directory is a bare repository. Skipping initialization."
+        else
+          echo "Directory is not a bare repository. Initializing..."
+          git init "${cfg.stateDir}"
+        fi
      '';

      serviceConfig = {
@@ -437,9 +437,5 @@ in
    ]
  );

-  meta.maintainers = with lib.maintainers; [
-    defelo
-    julm
-    lorenzleutgeb
-  ];
+  meta.teams = [ lib.teams.radicle ];
 }
@@ -0,0 +1,131 @@
+{
+  lib,
+  pkgs,
+  config,
+  ...
+}:
+let
+  cfg = config.services.shelfmark;
+in
+{
+  options.services.shelfmark = {
+
+    enable = lib.mkEnableOption "Shelfmark, a self-hosted book and audiobook search and download interface";
+
+    package = lib.mkPackageOption pkgs "shelfmark" { };
+
+    openFirewall = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = "Open the appropriate ports in the firewall for Shelfmark.";
+    };
+
+    environment = lib.mkOption {
+      type = lib.types.submodule {
+        freeformType = lib.types.attrsOf lib.types.str;
+        options = {
+          FLASK_HOST = lib.mkOption {
+            type = lib.types.str;
+            default = "127.0.0.1";
+            example = "0.0.0.0";
+            description = "The IP address to bind the Shelfmark server to.";
+          };
+
+          FLASK_PORT = lib.mkOption {
+            type = lib.types.port;
+            default = 8084;
+            apply = toString;
+            description = "TCP port for the Shelfmark web interface.";
+          };
+
+          ENABLE_LOGGING = lib.mkOption {
+            type = lib.types.bool;
+            apply = toString;
+            default = false;
+            description = "Whether to enable file logging. Disabled by default since systemd captures console output via journald.";
+          };
+
+          CONFIG_DIR = lib.mkOption {
+            type = lib.types.path;
+            default = "/var/lib/shelfmark";
+            description = "Directory for Shelfmark configuration, database, and artwork cache.";
+          };
+        };
+      };
+      default = { };
+      example = {
+        SEARCH_MODE = "universal";
+        LOG_LEVEL = "DEBUG";
+      };
+      description = ''
+        Environment variables to pass to the Shelfmark service.
+        See <https://github.com/calibrain/shelfmark/blob/main/docs/environment-variables.md>
+        for available options.
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+
+    systemd.services.shelfmark = {
+      description = "Shelfmark - book and audiobook search and download interface";
+      after = [ "network-online.target" ];
+      wants = [ "network-online.target" ];
+      wantedBy = [ "multi-user.target" ];
+      inherit (cfg) environment;
+      serviceConfig = {
+        DynamicUser = true;
+        ExecStart = "${lib.getExe cfg.package} -b ${cfg.environment.FLASK_HOST}:${cfg.environment.FLASK_PORT}";
+        StateDirectory = "shelfmark";
+
+        ProtectSystem = "strict";
+        ProtectHome = true;
+        PrivateTmp = true;
+        PrivateDevices = true;
+        PrivateMounts = true;
+        ProtectControlGroups = true;
+        ProtectKernelTunables = true;
+        RestrictSUIDSGID = true;
+        RemoveIPC = true;
+        UMask = "0077";
+
+        CapabilityBoundingSet = [ "" ];
+        NoNewPrivileges = true;
+
+        ProtectKernelModules = true;
+        ProtectKernelLogs = true;
+        ProtectClock = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged"
+          "~@resources"
+        ];
+
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+          "AF_UNIX"
+        ];
+
+        PrivateUsers = true;
+
+        LockPersonality = true;
+        ProtectHostname = true;
+        RestrictRealtime = true;
+        RestrictNamespaces = true;
+        ProtectProc = "invisible";
+        ProcSubset = "pid";
+        DeviceAllow = [ "" ];
+      };
+    };
+
+    networking.firewall = lib.mkIf cfg.openFirewall {
+      allowedTCPPorts = [ (lib.toInt cfg.environment.FLASK_PORT) ];
+    };
+  };
+
+  meta = {
+    maintainers = with lib.maintainers; [ jamiemagee ];
+  };
+}
@@ -771,6 +771,15 @@ in
                        }
                      ))
                    ]);
+                  example = [
+                    {
+                      port = 9000;
+                      target = {
+                        addr = "127.0.0.1";
+                        port = 9123;
+                      };
+                    }
+                  ];
                  apply = map (
                    v:
                    if lib.isInt v then
@@ -36,7 +36,18 @@ in
    ];

    systemd.packages = [ cfg.package ];
-    systemd.services."systemd-zram-setup@".path = [ pkgs.util-linux ]; # for mkswap
+    systemd.services."systemd-zram-setup@" = {
+      path = [ pkgs.util-linux ]; # for mkswap
+      # Restart on switch does swapoff -> reset -> reconfigure -> swapon.
+      # Besides risking OOM when swap is in use, the reset races with udev
+      # still holding /dev/zramN open after swapoff: the kernel rejects the
+      # reset with EBUSY (disk_openers > 0), the device stays initialized,
+      # and the following ExecStart fails to write comp_algorithm/disksize
+      # (systemd/zram-generator#226). The unit only "changes" due to store
+      # path churn, so keep the device across switches; real config changes
+      # need a reboot or manual restart.
+      restartIfChanged = false;
+    };

    environment.etc."systemd/zram-generator.conf".source =
      settingsFormat.generate "zram-generator.conf" cfg.settings;
@@ -7,6 +7,9 @@

 let
  cfg = config.virtualisation.incus;
+
+  acmeHostDir = config.security.acme.certs."${cfg.useACMEHost}".directory;
+
  preseedFormat = pkgs.formats.yaml { };

  nvidiaEnabled = (lib.elem "nvidia" config.services.xserver.videoDrivers);
@@ -292,6 +295,17 @@ in

        package = lib.mkPackageOption pkgs [ "incus-ui-canonical" ] { };
      };
+      useACMEHost = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
+        default = null;
+        example = "incus.example.com";
+        description = ''
+          Host of an existing Let's Encrypt certificate to use for TLS.
+          *Note that this option does not create any certificates and it
+          doesn't add subdomains to existing ones – you will need to create
+          them manually using {option}`security.acme.certs`.*
+        '';
+      };
    };
  };

@@ -391,6 +405,10 @@ in
      '';
    };

+    security.acme.certs = lib.mkIf (cfg.useACMEHost != null) {
+      "${cfg.useACMEHost}".reloadServices = [ "incus.service" ];
+    };
+
    systemd.services.incus = {
      description = "Incus Container and Virtual Machine Management Daemon";

@@ -402,7 +420,8 @@ in
        "lxcfs.service"
        "incus.socket"
      ]
-      ++ lib.optionals config.virtualisation.vswitch.enable [ "ovs-vswitchd.service" ];
+      ++ lib.optionals config.virtualisation.vswitch.enable [ "ovs-vswitchd.service" ]
+      ++ lib.optionals (cfg.useACMEHost != null) [ "acme-${cfg.useACMEHost}.service" ];

      requires = [
        "lxcfs.service"
@@ -410,7 +429,10 @@ in
      ]
      ++ lib.optionals config.virtualisation.vswitch.enable [ "ovs-vswitchd.service" ];

-      wants = [ "network-online.target" ];
+      wants = [
+        "network-online.target"
+      ]
+      ++ lib.optionals (cfg.useACMEHost != null) [ "acme-${cfg.useACMEHost}.service" ];

      serviceConfig = {
        ExecStart = "${cfg.package}/bin/incusd --group incus-admin";
@@ -427,6 +449,11 @@ in
        Restart = "on-failure";
        TimeoutStartSec = "${cfg.startTimeout}s";
        TimeoutStopSec = "30s";
+
+        BindReadOnlyPaths = lib.mkIf (cfg.useACMEHost != null) [
+          "${acmeHostDir}/fullchain.pem:/var/lib/incus/server.crt"
+          "${acmeHostDir}/key.pem:/var/lib/incus/server.key"
+        ];
      };
    };

@@ -643,7 +643,7 @@ in
      '';
    };

-    system.nssModules = optional (cfg.nss.enable or cfg.nss.enableGuest) cfg.package;
+    system.nssModules = optional (cfg.nss.enable || cfg.nss.enableGuest) cfg.package;
    system.nssDatabases.hosts = mkMerge [
      # ensure that the NSS modules come between mymachines (which is 400) and resolve (which is 501)
      (mkIf cfg.nss.enable (mkOrder 430 [ "libvirt" ]))
@@ -1461,6 +1461,7 @@ in
  shadps4 = runTest ./shadps4.nix;
  sharkey = runTest ./web-apps/sharkey.nix;
  shattered-pixel-dungeon = runTest ./shattered-pixel-dungeon.nix;
+  shelfmark = runTest ./shelfmark.nix;
  shiori = runTest ./shiori.nix;
  shoko = import ./shoko.nix { inherit runTest; };
  signal-desktop = runTest ./signal-desktop.nix;
@@ -61,9 +61,6 @@
      h2o_postgresql.wait_for_open_port(80)

      for machine in (nginx_mysql, h2o_postgresql):
-        # Sanity checks on URLs.
-        machine.succeed("curl -fL http://localhost/index.php")
-        machine.succeed("curl -fL http://localhost/")
        # Perform installation.
        machine.succeed('curl -fL -X POST http://localhost/install/check.php -F selectlang=auto')
        machine.succeed('curl -fL -X POST http://localhost/install/fileconf.php -F selectlang=auto')
@@ -86,7 +86,7 @@ in
    ''
      def curl(command: str, proxy: bool = False):
          if proxy:
-              command = "curl --proxy 127.0.0.1:8080 --cacert ~/.mitmproxy/mitmproxy-ca-cert.pem " + command
+              command = "curl --proxy 127.0.0.1:8080 --cacert ~/.mitmproxy/mitmproxy-ca.pem " + command
          else:
              command = "curl " + command
          return machine.succeed(command)
@@ -20,7 +20,7 @@
                  from selenium import webdriver
                  from selenium.webdriver.common.by import By
                  from selenium.webdriver.firefox.options import Options
-                  from selenium.webdriver.support.relative_locator import locate_with
+                  from selenium.webdriver.support import expected_conditions as EC
                  from selenium.webdriver.support.ui import WebDriverWait

                  options = Options()
@@ -35,13 +35,12 @@
                  wait = WebDriverWait(driver, 60)

                  # There should have been a redirect
-                  url = driver.current_url
-                  assert url == "http://prometheus:9090/query"
+                  wait.until(EC.url_to_be("http://prometheus:9090/query"))

-                  assert len(driver.find_elements(
-                    By.CLASS_NAME, "mantine-AppShell-header")) > 0
-                  assert len(driver.find_elements(
-                    By.CLASS_NAME, "mantine-AppShell-main")) > 0
+                  wait.until(EC.presence_of_element_located(
+                    (By.CLASS_NAME, "mantine-AppShell-header")))
+                  wait.until(EC.presence_of_element_located(
+                    (By.CLASS_NAME, "mantine-AppShell-main")))

                  # Do a Prometheus query
                  query_box = driver.find_element(
@@ -53,10 +52,9 @@
                  driver.find_element(
                    By.XPATH, "//span[contains(text(),'Execute')]").click()

-                  # Find query result table
-                  table_tr_elements = driver.find_elements(
-                    By.CLASS_NAME, "mantine-Table-tr")
-                  assert len(table_tr_elements) == 1
+                  # Wait for query result table
+                  wait.until(EC.presence_of_element_located(
+                    (By.CLASS_NAME, "mantine-Table-tr")))

                  # Navigate to target health page
                  driver.find_element(
@@ -65,16 +63,14 @@
                  driver.find_element(
                    By.LINK_TEXT, "Target health").click()

-                  url = driver.current_url
-                  assert url == "http://prometheus:9090/targets"
+                  wait.until(EC.url_to_be("http://prometheus:9090/targets"))

                  # Click on the prometheus job dropdown button
-                  prometheus_job_dropdown = driver.find_element(
+                  driver.find_element(
                    By.CLASS_NAME, "mantine-Accordion-chevron").click()

-                  targets_healthy = len(driver.find_elements(
-                    By.CSS_SELECTOR, "div[class^='_healthOk']"))
-                  assert targets_healthy == 1
+                  wait.until(EC.presence_of_element_located(
+                    (By.CSS_SELECTOR, "div[class^='_healthOk']")))

                  targets_errored = len(driver.find_elements(
                    By.CSS_SELECTOR, "div[class^='_healthErr']"))
@@ -92,15 +88,13 @@
                  driver.find_element(
                    By.LINK_TEXT, "Runtime & build information").click()

-                  url = driver.current_url
-                  assert url == "http://prometheus:9090/status"
+                  wait.until(EC.url_to_be("http://prometheus:9090/status"))

-                  # Find table
-                  version_th_element = driver.find_element(
-                    By.XPATH, "//th[text()='version']")
-                  version_td_element = driver.find_element(
-                    locate_with(By.TAG_NAME, "td").near(version_th_element))
-                  assert version_td_element.text == "${pkgs.prometheus.version}"
+                  # Find table and verify version
+                  wait.until(EC.text_to_be_present_in_element(
+                    (By.XPATH,
+                     "//tr[th[text()='version']]/td"),
+                    "${pkgs.prometheus.version}"))

                  driver.close()
                '';
@@ -16,7 +16,7 @@ in

 {
  name = "radicle-ci-broker";
-  meta.maintainers = with lib.maintainers; [ defelo ];
+  meta.maintainers = lib.teams.radicle.members;

  nodes.seed = {
    virtualisation.credentials = {
@@ -2,7 +2,7 @@
 # and verifies that an alice peer can host a repository on the seed,
 # and that a bob peer can send alice a patch via the seed.

-{ pkgs, ... }:
+{ lib, pkgs, ... }:

 let
  # The Node ID depends on nodes.seed.services.radicle.privateKeyFile
@@ -63,13 +63,7 @@ in
 {
  name = "radicle";

-  meta = with pkgs.lib.maintainers; {
-    maintainers = [
-      defelo
-      julm
-      lorenzleutgeb
-    ];
-  };
+  meta.maintainers = lib.teams.radicle.members;

  nodes = {
    seed =
@@ -0,0 +1,20 @@
+{ lib, ... }:
+{
+  name = "shelfmark";
+  meta.maintainers = with lib.maintainers; [ jamiemagee ];
+
+  nodes.machine = {
+    services.shelfmark = {
+      enable = true;
+      environment.FLASK_HOST = "0.0.0.0";
+    };
+  };
+
+  testScript = ''
+    machine.wait_for_unit("shelfmark.service")
+    machine.wait_for_open_port(8084)
+
+    with subtest("Health endpoint responds"):
+        machine.succeed("curl --fail http://localhost:8084/api/health")
+  '';
+}
@@ -28,13 +28,13 @@ in

 stdenv.mkDerivation (finalAttrs: {
  pname = "tiled";
-  version = "1.12.0";
+  version = "1.12.1";

  src = fetchFromGitHub {
    owner = "mapeditor";
    repo = "tiled";
    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-SDsz7IAxCJde21CIL9DrZMJkEim6syHD5kn9/dwpZXs=";
+    sha256 = "sha256-7Z6ibZyfFWdsxvz6rlGOqB9toULr4h2qa2uX9QXh1uU=";
  };

  nativeBuildInputs = [
@@ -22902,6 +22902,19 @@ final: prev: {
    meta.hydraPlatforms = [ ];
  };

+  vivify-vim = buildVimPlugin {
+    pname = "vivify.vim";
+    version = "0-unstable-2025-08-08";
+    src = fetchFromGitHub {
+      owner = "jannis-baum";
+      repo = "vivify.vim";
+      rev = "99a1539a440633ee7a164e094a736c04acc2335d";
+      hash = "sha256-tF77R2WHSc+YXltWkntNFC8mouaEYn640PqCfis0zW0=";
+    };
+    meta.homepage = "https://github.com/jannis-baum/vivify.vim/";
+    meta.hydraPlatforms = [ ];
+  };
+
  vs-tasks-nvim = buildVimPlugin {
    pname = "vs-tasks.nvim";
    version = "0-unstable-2025-10-27";
@@ -23344,19 +23357,6 @@ final: prev: {
    meta.hydraPlatforms = [ ];
  };

-  yanky-nvim = buildVimPlugin {
-    pname = "yanky.nvim";
-    version = "2.0.0-unstable-2026-03-12";
-    src = fetchFromGitHub {
-      owner = "gbprod";
-      repo = "yanky.nvim";
-      rev = "784188e0a7363e762e53140f39124d786aec0832";
-      hash = "sha256-oGiXbSXo48NbaImzIKquEvplPCotLeIs4scvbhO6wyA=";
-    };
-    meta.homepage = "https://github.com/gbprod/yanky.nvim/";
-    meta.hydraPlatforms = [ ];
-  };
-
  yank-path-nvim = buildVimPlugin {
    pname = "yank-path.nvim";
    version = "0-unstable-2025-12-11";
@@ -23370,6 +23370,19 @@ final: prev: {
    meta.hydraPlatforms = [ ];
  };

+  yanky-nvim = buildVimPlugin {
+    pname = "yanky.nvim";
+    version = "2.0.0-unstable-2026-03-12";
+    src = fetchFromGitHub {
+      owner = "gbprod";
+      repo = "yanky.nvim";
+      rev = "784188e0a7363e762e53140f39124d786aec0832";
+      hash = "sha256-oGiXbSXo48NbaImzIKquEvplPCotLeIs4scvbhO6wyA=";
+    };
+    meta.homepage = "https://github.com/gbprod/yanky.nvim/";
+    meta.hydraPlatforms = [ ];
+  };
+
  yats-vim = buildVimPlugin {
    pname = "yats.vim";
    version = "0-unstable-2025-12-09";
@@ -1759,6 +1759,7 @@ https://github.com/vim-scripts/vis/,,
 https://github.com/navicore/vissort.vim/,,
 https://github.com/liuchengxu/vista.vim/,,
 https://github.com/mcauley-penney/visual-whitespace.nvim/,HEAD,
+https://github.com/jannis-baum/vivify.vim/,HEAD,
 https://github.com/EthanJWright/vs-tasks.nvim/,HEAD,
 https://github.com/Mofiqul/vscode.nvim/,,
 https://github.com/dylanaraps/wal.vim/,,
@@ -1793,8 +1794,8 @@ https://github.com/guns/xterm-color-table.vim/,,
 https://github.com/y9san9/y9nika.nvim/,HEAD,
 https://github.com/someone-stole-my-name/yaml-companion.nvim/,HEAD,
 https://github.com/cwrau/yaml-schema-detect.nvim/,HEAD,
-https://github.com/gbprod/yanky.nvim/,HEAD,
 https://github.com/ywpkwon/yank-path.nvim/,HEAD,
+https://github.com/gbprod/yanky.nvim/,HEAD,
 https://github.com/HerringtonDarkholme/yats.vim/,,
 https://github.com/mikavilpas/yazi.nvim/,HEAD,
 https://github.com/lucasew/yescapsquit.vim/,HEAD,
@@ -8,8 +8,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
  mktplcRef = {
    name = "claude-code";
    publisher = "anthropic";
-    version = "2.1.84";
-    hash = "sha256-WIpgj3qZN/YtX0zTpcw5gKktD+D9MnbrVGSVbvD9MnQ=";
+    version = "2.1.87";
+    hash = "sha256-0brafiNuo6wRGWlGAOax3My9CrGKiGpDjFswuHFWt4M=";
  };

  postInstall = ''
@@ -1902,8 +1902,8 @@ let
        mktplcRef = {
          publisher = "github";
          name = "codespaces";
-          version = "1.18.8";
-          hash = "sha256-rhtf1JJMi8eGYmuKFUA1TAnf2gdMbckQ8Vke2owMoyI=";
+          version = "1.18.11";
+          hash = "sha256-Jd0J7/8amQ1pLjvk+YXp6GbSrRgWhyKBw1TKr+h4OrI=";
        };

        meta = {
@@ -2293,8 +2293,8 @@ let
        mktplcRef = {
          name = "vscode-vibrancy-continued";
          publisher = "illixion";
-          version = "1.1.62";
-          hash = "sha256-Urfa4XligTfFk6+GIuGabm5EFeQe+gRhdtb8IoXz+Ak=";
+          version = "1.1.65";
+          hash = "sha256-0DUKDBhabh8vOgPw5p6ZFavRLIuy4vPgOfAa6fLtJRA=";
        };
        meta = {
          downloadPage = "https://marketplace.visualstudio.com/items?itemName=illixion.vscode-vibrancy-continued";
@@ -4008,8 +4008,8 @@ let
        mktplcRef = {
          name = "partial-diff";
          publisher = "ryu1kn";
-          version = "1.4.3";
-          sha256 = "0x3lkvna4dagr7s99yykji3x517cxk5kp7ydmqa6jb4bzzsv1s6h";
+          version = "1.4.4";
+          sha256 = "sha256-T+C/C2DBh05mgoFUdnSGcmhf9JXfMYc/JvG0aX0vEoU=";
        };
        meta = {
          license = lib.licenses.mit;
@@ -4458,8 +4458,8 @@ let
        mktplcRef = {
          name = "vscode-stylelint";
          publisher = "stylelint";
-          version = "2.1.0";
-          hash = "sha256-cL86Gv2HAtvqNd+2vJPuKAgKVrp5pg6IECFm1Di8Eqk=";
+          version = "2.2.0";
+          hash = "sha256-N23nzAI0cBNeX7txsgxKXhSUrcOGM9rjnMIJNK4OYFY=";
        };
        meta = {
          description = "Official Stylelint extension for Visual Studio Code";
@@ -14,8 +14,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
  mktplcRef = {
    name = "r";
    publisher = "reditorsupport";
-    version = "2.8.7";
-    hash = "sha256-pA3/81UYrieDfGYn1fVI6KY9B7A5KAhGIzftZtzXQVc=";
+    version = "2.8.8";
+    hash = "sha256-mt2bes7aHcAHLMngSLW/zI3kSIzNKALqX+g0UXo84uI=";
  };
  nativeBuildInputs = [
    jq
@@ -8,13 +8,13 @@
 }:
 mkLibretroCore {
  core = "mednafen-psx" + lib.optionalString withHw "-hw";
-  version = "0-unstable-2026-03-20";
+  version = "0-unstable-2026-03-28";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "beetle-psx-libretro";
-    rev = "8b5dea564b687dd07d91cea48615fab213d1e2c9";
-    hash = "sha256-vIEjwhE86TsXbAPk6IbMlWWFWE2Nn6R/+gBe9mMmio4=";
+    rev = "8fcb04d617b55c00f3255287c530242acf3855dc";
+    hash = "sha256-ihS0F/mbHkhrrEiI3bERQxwIgupBiZo2irpzSSWtexE=";
  };

  extraBuildInputs = lib.optionals withHw [
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "mednafen-wswan";
-  version = "0-unstable-2024-10-21";
+  version = "0-unstable-2026-03-31";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "beetle-wswan-libretro";
-    rev = "2aeb47d3a58bf0360c686f842d9bb5bd201306fe";
-    hash = "sha256-LrF9p5tPtUamVLC41bJxcYDKvHmhVfwMieyIAdHaGmU=";
+    rev = "392db084316475411f3f24bd1ea54dba72ecbe51";
+    hash = "sha256-GbjE2PqfZGrP9tp4TgyIzdyyC1PatGiQRSscsmcIbPQ=";
  };

  makefile = "Makefile";
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "fbneo";
-  version = "0-unstable-2026-03-17";
+  version = "0-unstable-2026-03-28";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "fbneo";
-    rev = "baafb100b487f2ac06f9e78ac322e3ecf36b8924";
-    hash = "sha256-46hVbQN8QO1FNm56wJ7Q323blUWV9sn529tMwdAOhW8=";
+    rev = "7290e95232faacb0c31b0b12cb0884bb9f6e8cfc";
+    hash = "sha256-vYryEUrYauVGGjmePCUnGdCpOGKUFxSI4tkFCt7wKs8=";
  };

  makefile = "Makefile";
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "fceumm";
-  version = "0-unstable-2025-09-13";
+  version = "0-unstable-2026-03-31";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "libretro-fceumm";
-    rev = "5cd4a43e16a7f3cd35628d481c347a0a98cfdfa2";
-    hash = "sha256-/FvXQlp20QMFg1uPmj2HSJFXhzBunygOmGEtGNGJyxk=";
+    rev = "dbf1f2eb83ebde54a32fbe4f906b5ad89a863c0b";
+    hash = "sha256-UGssF6x/H5met7f2hC6str2urvCZRj/Oqp2R0rv2RUw=";
  };

  meta = {
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "genesis-plus-gx";
-  version = "0-unstable-2026-03-06";
+  version = "0-unstable-2026-03-31";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "Genesis-Plus-GX";
-    rev = "d446078a385a5acae701f4b3b6b3fd58476d73d3";
-    hash = "sha256-jw8vj3fTHwBH6h+OelVJHNqy86DKFlohhIeQ9TLkGjc=";
+    rev = "ee71e47c8d4b3b73b596dea1d8a6bf8d2cac7662";
+    hash = "sha256-f7Ox204WmvPwwLce5/ztADr5P5Z5JhVOn04vt7Ww1Ns=";
  };

  meta = {
@@ -9,13 +9,13 @@
 }:
 mkLibretroCore {
  core = "mame";
-  version = "0-unstable-2026-02-27";
+  version = "0-unstable-2026-03-26";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "mame";
-    rev = "74731455f45c08d4f303c6d07c4f1cbf791d52b6";
-    hash = "sha256-f0f0ajliLM2ZJjOpA7sk3pgA7LZ2JTEIl7+w/3TpFK0=";
+    rev = "a10380b436c2103cad06826d64e10ca90692a08b";
+    hash = "sha256-M9/GTOiXcZc5J2SxSDzDEYDMBC1zMR/zAhvbgZEwBlk=";
    fetchSubmodules = true;
  };

@@ -7,13 +7,13 @@
 }:
 mkLibretroCore {
  core = "mame2015";
-  version = "0-unstable-2023-10-31";
+  version = "0-unstable-2026-03-31";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "mame2015-libretro";
-    rev = "316cd06349f2b34b4719f04f7c0d07569a74c764";
-    hash = "sha256-CBN04Jf26SIk8mKWlui5spQGokBvgFUCvFiC8NoBGw0=";
+    rev = "48fdf6532f31e3bb8b58b9ae10198b047cd8de42";
+    hash = "sha256-z/SjAx615RZUOytoDPFFXl89E5063cbc0OFIV2/HZBo=";
  };

  patches = [ ./patches/mame2015-python311.patch ];
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "nxengine";
-  version = "0-unstable-2024-10-21";
+  version = "0-unstable-2026-03-31";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "nxengine-libretro";
-    rev = "9adc032a5f6aa913d71d22042bb72cb11cf0f4a2";
-    hash = "sha256-8XjZp18lQU3xFNDjIuNsSHn7Mhba8Lze/IeRsy8/U1U=";
+    rev = "990bdaacd6ed9db735ea625c948252d0b8a2100a";
+    hash = "sha256-41f2iHQi3gwla1gM2/rFvzTKhSIrJqYLZN+5f9Ylu7A=";
  };

  makefile = "Makefile";
@@ -151,9 +151,9 @@ rec {

  unstable = fetchurl rec {
    # NOTE: Don't forget to change the hash for staging as well.
-    version = "11.1";
+    version = "11.5";
    url = "https://dl.winehq.org/wine/source/11.x/wine-${version}.tar.xz";
-    hash = "sha256-v0x8j7XYwfZW8wor6pOHDIXxP/gxGrL2Hd75AOsoy48=";
+    hash = "sha256-ETcLV+pdVIpU2Syc1l0LpjX08cPq2s4J7RxBn3BeGdE=";

    patches = [
      # Also look for root certificates at $NIX_SSL_CERT_FILE
@@ -163,7 +163,7 @@ rec {
    # see https://gitlab.winehq.org/wine/wine-staging
    staging = fetchFromGitLab {
      inherit version;
-      hash = "sha256-KBiESkLVEEWyUPzv1I7j8U9zjqfYdF+FL6wRCcIE290=";
+      hash = "sha256-tkx1LB/iZoFvarMvc9QofuQLrZwZyaoL0FUh3nsvYjs=";
      domain = "gitlab.winehq.org";
      owner = "wine";
      repo = "wine-staging";
@@ -186,9 +186,9 @@ rec {

    ## see http://wiki.winehq.org/Mono
    mono = fetchurl rec {
-      version = "10.3.0";
+      version = "11.0.0";
      url = "https://dl.winehq.org/wine/wine-mono/${version}/wine-mono-${version}-x86.msi";
-      hash = "sha256-zs5cYxgAlN/98B0PvjYqS2BuUoC5jN/RuFaM35tXL5g=";
+      hash = "sha256-1+/t4Lm9z1ITT4zWztWdn+zpdvcLEaQAvbR7hkVpzSc=";
    };

    updateScript = writeShellScript "update-wine-unstable" ''
@@ -1,4 +1,6 @@
 {
+  lib,
+  stdenv,
  makeWrapper,
  nixosTests,
  symlinkJoin,
@@ -40,7 +42,8 @@ symlinkJoin {
        --prefix PATH : $program_PATH \
        --set PYTHONPATH $program_PYTHONPATH
    done
-
+  ''
+  + lib.optionalString (!stdenv.hostPlatform.isDarwin) ''
    ln -s ${qgis-unwrapped.man} $man
  '';

@@ -1,4 +1,6 @@
 {
+  lib,
+  stdenv,
  makeWrapper,
  nixosTests,
  symlinkJoin,
@@ -14,15 +16,13 @@
 }:
 let
  qgis-ltr-unwrapped = libsForQt5.callPackage ./unwrapped-ltr.nix {
-    withGrass = withGrass;
-    withServer = withServer;
-    withWebKit = withWebKit;
+    inherit withGrass withServer withWebKit;
  };
 in

 symlinkJoin {
-  inherit (qgis-ltr-unwrapped) version src;
-  pname = "qgis";
+  inherit (qgis-ltr-unwrapped) version outputs src;
+  pname = "qgis-ltr";

  paths = [ qgis-ltr-unwrapped ];

@@ -43,6 +43,9 @@ symlinkJoin {
        --prefix PATH : $program_PATH \
        --set PYTHONPATH $program_PYTHONPATH
    done
+  ''
+  + lib.optionalString (!stdenv.hostPlatform.isDarwin) ''
+    ln -s ${qgis-ltr-unwrapped.man} $man
  '';

  passthru = {
@@ -1,6 +1,8 @@
 {
  lib,
+  stdenv,
  fetchFromGitHub,
+  lndir,
  makeWrapper,
  mkDerivation,
  replaceVars,
@@ -11,6 +13,8 @@
  withServer,
  withWebKit,

+  darwin,
+  libtasn1,
  bison,
  cmake,
  draco,
@@ -40,6 +44,7 @@
  qtmultimedia,
  qtsensors,
  qtserialport,
+  qtsvg,
  qtwebkit,
  qtxmlpatterns,
  qwt,
@@ -68,6 +73,7 @@ let
    psycopg2
    pygments
    pyqt5
+    pyqt5-sip
    pyqt-builder
    python-dateutil
    pytz
@@ -83,6 +89,7 @@ in
 mkDerivation rec {
  version = "3.40.15";
  pname = "qgis-ltr-unwrapped";
+  outputs = [ "out" ] ++ lib.optional (!stdenv.hostPlatform.isDarwin) "man";

  src = fetchFromGitHub {
    owner = "qgis";
@@ -105,6 +112,10 @@ mkDerivation rec {
    cmake
    flex
    ninja
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    darwin.autoSignDarwinBinariesHook
+    lndir
  ];

  buildInputs = [
@@ -131,6 +142,7 @@ mkDerivation rec {
    qtmultimedia
    qtsensors
    qtserialport
+    qtsvg
    qtxmlpatterns
    qwt
    sqlite
@@ -139,6 +151,7 @@ mkDerivation rec {
  ]
  ++ lib.optional withGrass grass
  ++ lib.optional withWebKit qtwebkit
+  ++ lib.optional stdenv.hostPlatform.isDarwin libtasn1
  ++ pythonBuildInputs;

  patches = [
@@ -168,6 +181,10 @@ mkDerivation rec {
    # See https://github.com/libspatialindex/libspatialindex/issues/276
    "-DWITH_INTERNAL_SPATIALINDEX=True"
  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    "-DQGIS_MACAPP_BUNDLE=0" # Don't copy Qt into bundle; we fix paths in postFixup
+    "-DSQLITE3_INCLUDE_DIR=${sqlite.dev}/include" # FindSqlite3.cmake incorrectly assumes framework
+  ]
  ++ lib.optional (!withWebKit) "-DWITH_QTWEBKIT=OFF"
  ++ lib.optional withServer [
    "-DWITH_SERVER=True"
@@ -186,18 +203,102 @@ mkDerivation rec {
  ];

  dontWrapGApps = true; # wrapper params passed below
+  dontWrapQtApps = stdenv.hostPlatform.isDarwin;

-  postFixup = lib.optionalString withGrass ''
-    # GRASS has to be availble on the command line even though we baked in
-    # the path at build time using GRASS_PREFIX.
-    # Using wrapGAppsHook also prevents file dialogs from crashing the program
-    # on non-NixOS.
-    for program in $out/bin/*; do
-      wrapProgram $program \
-        "''${gappsWrapperArgs[@]}" \
-        --prefix PATH : ${lib.makeBinPath [ grass ]}
-    done
-  '';
+  postFixup =
+    lib.optionalString (withGrass && stdenv.hostPlatform.isLinux) ''
+      # GRASS has to be available on the command line even though we baked in
+      # the path at build time using GRASS_PREFIX.
+      # Using wrapGAppsHook also prevents file dialogs from crashing the program
+      # on non-NixOS.
+      for program in $out/bin/*; do
+        wrapProgram $program \
+          "''${gappsWrapperArgs[@]}" \
+          --prefix PATH : ${lib.makeBinPath [ grass ]}
+      done
+    ''
+    + lib.optionalString stdenv.hostPlatform.isDarwin ''
+            mkdir -p $out/Applications $out/bin
+            mv $out/QGIS.app $out/Applications/
+            ln -s $out/Applications/QGIS.app/Contents/MacOS/QGIS $out/bin/qgis
+
+            SHORT_VERSION=$(echo "${version}" | cut -d. -f1,2)
+            BUNDLE="$out/Applications/QGIS.app"
+            FRAMEWORKS="$BUNDLE/Contents/Frameworks"
+
+            fix_binary() {
+              local f="$1"
+              [[ -f "$f" ]] || return 0
+              file "$f" | grep -q "Mach-O" || return 0
+
+              install_name_tool \
+                -change "@loader_path/../lib/libqscintilla2_qt5.dylib" "${qscintilla}/lib/libqscintilla2_qt5.dylib" \
+                -change "@loader_path/../lib/libqt5keychain.dylib" "${qtkeychain}/lib/libqt5keychain.dylib" \
+                -change "@loader_path/../lib/libqwt.dylib" "${qwt}/lib/libqwt.dylib" \
+                -change "@loader_path/../../Frameworks/qca-qt5.framework/qca-qt5" "${qca-qt5}/lib/qca-qt5.framework/qca-qt5" \
+                -change "@loader_path/../../../qca-qt5.framework/qca-qt5" "${qca-qt5}/lib/qca-qt5.framework/qca-qt5" \
+                -change "@loader_path/../../../../MacOS/lib/libqscintilla2_qt5.dylib" "${qscintilla}/lib/libqscintilla2_qt5.dylib" \
+                -change "@loader_path/../../../../MacOS/lib/libqt5keychain.dylib" "${qtkeychain}/lib/libqt5keychain.dylib" \
+                -change "@loader_path/../../../../MacOS/lib/libqwt.dylib" "${qwt}/lib/libqwt.dylib" \
+                -change "@executable_path/lib/libqwt.dylib" "${qwt}/lib/libqwt.dylib" \
+                -change "@executable_path/lib/libqscintilla2_qt5.dylib" "${qscintilla}/lib/libqscintilla2_qt5.dylib" \
+                -change "@executable_path/lib/libqt5keychain.dylib" "${qtkeychain}/lib/libqt5keychain.dylib" \
+                -change "@executable_path/../Frameworks/qca-qt5.framework/qca-qt5" "${qca-qt5}/lib/qca-qt5.framework/qca-qt5" \
+                -change "@loader_path/../../../qgis_core.framework/qgis_core" "$FRAMEWORKS/qgis_core.framework/Versions/$SHORT_VERSION/qgis_core" \
+                -change "@loader_path/../../../qgis_gui.framework/qgis_gui" "$FRAMEWORKS/qgis_gui.framework/Versions/$SHORT_VERSION/qgis_gui" \
+                -change "@loader_path/../../../qgis_analysis.framework/qgis_analysis" "$FRAMEWORKS/qgis_analysis.framework/Versions/$SHORT_VERSION/qgis_analysis" \
+                -change "@loader_path/../../../qgis_3d.framework/qgis_3d" "$FRAMEWORKS/qgis_3d.framework/Versions/$SHORT_VERSION/qgis_3d" \
+                -change "@loader_path/../../../qgis_native.framework/qgis_native" "$FRAMEWORKS/qgis_native.framework/Versions/$SHORT_VERSION/qgis_native" \
+                "$f" 2>/dev/null || true
+            }
+
+            fix_binary "$BUNDLE/Contents/MacOS/QGIS"
+            for lib in "$BUNDLE/Contents/MacOS/lib"/*.dylib; do fix_binary "$lib"; done
+            for fw in qgis_core qgis_gui qgis_analysis qgis_3d qgis_native; do
+              fix_binary "$FRAMEWORKS/$fw.framework/Versions/$SHORT_VERSION/$fw"
+              [[ -f "$FRAMEWORKS/$fw.framework/$fw" && ! -L "$FRAMEWORKS/$fw.framework/$fw" ]] && \
+                fix_binary "$FRAMEWORKS/$fw.framework/$fw"
+            done
+            for plugin in "$BUNDLE/Contents/PlugIns/qgis"/*.so; do fix_binary "$plugin"; done
+
+            ${lib.optionalString withGrass ''
+              fix_binary "$FRAMEWORKS/qgisgrass8.framework/Versions/$SHORT_VERSION/qgisgrass8"
+              install_name_tool \
+                -change "@loader_path/../../../qgisgrass8.framework/qgisgrass8" "$FRAMEWORKS/qgisgrass8.framework/Versions/$SHORT_VERSION/qgisgrass8" \
+                "$BUNDLE/Contents/MacOS/QGIS" 2>/dev/null || true
+              for lib in "$BUNDLE/Contents/MacOS/lib"/*.dylib; do
+                install_name_tool \
+                  -change "@loader_path/../../../qgisgrass8.framework/qgisgrass8" "$FRAMEWORKS/qgisgrass8.framework/Versions/$SHORT_VERSION/qgisgrass8" \
+                  "$lib" 2>/dev/null || true
+              done
+            ''}
+
+            ${lib.optionalString withServer ''
+              fix_binary "$BUNDLE/Contents/MacOS/lib/libqgis_server.${version}.dylib"
+            ''}
+
+            # Merge Python packages (lndir handles namespace packages correctly)
+            QGIS_PYTHON="$BUNDLE/Contents/Resources/python"
+            for pkg in ${
+              lib.concatMapStringsSep " " (p: "${p}/${py.pkgs.python.sitePackages}") (
+                py.pkgs.requiredPythonModules pythonBuildInputs
+              )
+            }; do
+              [[ -d "$pkg" ]] && lndir -silent "$pkg" "$QGIS_PYTHON"
+            done
+            # Remove broken symlinks
+            find "$QGIS_PYTHON" -type l ! -exec test -e {} \; -delete
+
+            # Create merged Qt plugins directory in the bundle (LSEnvironment is unreliable)
+            mkdir -p "$BUNDLE/Contents/PlugIns"
+            lndir -silent "${qtbase}/${qtbase.qtPluginPrefix}" "$BUNDLE/Contents/PlugIns"
+            lndir -silent "${qtsvg.bin}/${qtbase.qtPluginPrefix}" "$BUNDLE/Contents/PlugIns"
+
+            cat > "$BUNDLE/Contents/Resources/qt.conf" << 'EOF'
+      [Paths]
+      Plugins = PlugIns
+      EOF
+    '';

  # >9k objects, >3h build time on a normal build slot
  requiredSystemFeatures = [ "big-parallel" ];
@@ -207,6 +308,6 @@ mkDerivation rec {
    homepage = "https://www.qgis.org";
    license = lib.licenses.gpl2Plus;
    teams = [ lib.teams.geospatial ];
-    platforms = with lib.platforms; linux;
+    platforms = lib.platforms.unix;
  };
 }
@@ -1,6 +1,8 @@
 {
  lib,
+  stdenv,
  fetchFromGitHub,
+  lndir,
  makeWrapper,
  mkDerivation,
  replaceVars,
@@ -11,6 +13,8 @@
  withServer,
  withWebKit,

+  darwin,
+  libtasn1,
  bison,
  cmake,
  draco,
@@ -40,6 +44,7 @@
  qtmultimedia,
  qtsensors,
  qtserialport,
+  qtsvg,
  qtwebkit,
  qtxmlpatterns,
  qwt,
@@ -68,6 +73,7 @@ let
    psycopg2
    pygments
    pyqt5
+    pyqt5-sip
    pyqt-builder
    python-dateutil
    pytz
@@ -83,10 +89,7 @@ in
 mkDerivation rec {
  version = "3.44.7";
  pname = "qgis-unwrapped";
-  outputs = [
-    "out"
-    "man"
-  ];
+  outputs = [ "out" ] ++ lib.optional (!stdenv.hostPlatform.isDarwin) "man";

  src = fetchFromGitHub {
    owner = "qgis";
@@ -109,6 +112,10 @@ mkDerivation rec {
    cmake
    flex
    ninja
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    darwin.autoSignDarwinBinariesHook
+    lndir
  ];

  buildInputs = [
@@ -135,6 +142,7 @@ mkDerivation rec {
    qtmultimedia
    qtsensors
    qtserialport
+    qtsvg
    qtxmlpatterns
    qwt
    sqlite
@@ -143,6 +151,7 @@ mkDerivation rec {
  ]
  ++ lib.optional withGrass grass
  ++ lib.optional withWebKit qtwebkit
+  ++ lib.optional stdenv.hostPlatform.isDarwin libtasn1
  ++ pythonBuildInputs;

  patches = [
@@ -168,6 +177,10 @@ mkDerivation rec {
    # See https://github.com/libspatialindex/libspatialindex/issues/276
    "-DWITH_INTERNAL_SPATIALINDEX=True"
  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    "-DQGIS_MACAPP_BUNDLE=0" # Don't copy Qt into bundle; we fix paths in postFixup
+    "-DSQLITE3_INCLUDE_DIR=${sqlite.dev}/include" # FindSqlite3.cmake incorrectly assumes framework
+  ]
  ++ lib.optional (!withWebKit) "-DWITH_QTWEBKIT=OFF"
  ++ lib.optional withServer [
    "-DWITH_SERVER=True"
@@ -186,18 +199,102 @@ mkDerivation rec {
  ];

  dontWrapGApps = true; # wrapper params passed below
+  dontWrapQtApps = stdenv.hostPlatform.isDarwin;

-  postFixup = lib.optionalString withGrass ''
-    # GRASS has to be available on the command line even though we baked in
-    # the path at build time using GRASS_PREFIX.
-    # Using wrapGAppsHook also prevents file dialogs from crashing the program
-    # on non-NixOS.
-    for program in $out/bin/*; do
-      wrapProgram $program \
-        "''${gappsWrapperArgs[@]}" \
-        --prefix PATH : ${lib.makeBinPath [ grass ]}
-    done
-  '';
+  postFixup =
+    lib.optionalString (withGrass && stdenv.hostPlatform.isLinux) ''
+      # GRASS has to be available on the command line even though we baked in
+      # the path at build time using GRASS_PREFIX.
+      # Using wrapGAppsHook also prevents file dialogs from crashing the program
+      # on non-NixOS.
+      for program in $out/bin/*; do
+        wrapProgram $program \
+          "''${gappsWrapperArgs[@]}" \
+          --prefix PATH : ${lib.makeBinPath [ grass ]}
+      done
+    ''
+    + lib.optionalString stdenv.hostPlatform.isDarwin ''
+            mkdir -p $out/Applications $out/bin
+            mv $out/QGIS.app $out/Applications/
+            ln -s $out/Applications/QGIS.app/Contents/MacOS/QGIS $out/bin/qgis
+
+            SHORT_VERSION=$(echo "${version}" | cut -d. -f1,2)
+            BUNDLE="$out/Applications/QGIS.app"
+            FRAMEWORKS="$BUNDLE/Contents/Frameworks"
+
+            fix_binary() {
+              local f="$1"
+              [[ -f "$f" ]] || return 0
+              file "$f" | grep -q "Mach-O" || return 0
+
+              install_name_tool \
+                -change "@loader_path/../lib/libqscintilla2_qt5.dylib" "${qscintilla}/lib/libqscintilla2_qt5.dylib" \
+                -change "@loader_path/../lib/libqt5keychain.dylib" "${qtkeychain}/lib/libqt5keychain.dylib" \
+                -change "@loader_path/../lib/libqwt.dylib" "${qwt}/lib/libqwt.dylib" \
+                -change "@loader_path/../../Frameworks/qca-qt5.framework/qca-qt5" "${qca-qt5}/lib/qca-qt5.framework/qca-qt5" \
+                -change "@loader_path/../../../qca-qt5.framework/qca-qt5" "${qca-qt5}/lib/qca-qt5.framework/qca-qt5" \
+                -change "@loader_path/../../../../MacOS/lib/libqscintilla2_qt5.dylib" "${qscintilla}/lib/libqscintilla2_qt5.dylib" \
+                -change "@loader_path/../../../../MacOS/lib/libqt5keychain.dylib" "${qtkeychain}/lib/libqt5keychain.dylib" \
+                -change "@loader_path/../../../../MacOS/lib/libqwt.dylib" "${qwt}/lib/libqwt.dylib" \
+                -change "@executable_path/lib/libqwt.dylib" "${qwt}/lib/libqwt.dylib" \
+                -change "@executable_path/lib/libqscintilla2_qt5.dylib" "${qscintilla}/lib/libqscintilla2_qt5.dylib" \
+                -change "@executable_path/lib/libqt5keychain.dylib" "${qtkeychain}/lib/libqt5keychain.dylib" \
+                -change "@executable_path/../Frameworks/qca-qt5.framework/qca-qt5" "${qca-qt5}/lib/qca-qt5.framework/qca-qt5" \
+                -change "@loader_path/../../../qgis_core.framework/qgis_core" "$FRAMEWORKS/qgis_core.framework/Versions/$SHORT_VERSION/qgis_core" \
+                -change "@loader_path/../../../qgis_gui.framework/qgis_gui" "$FRAMEWORKS/qgis_gui.framework/Versions/$SHORT_VERSION/qgis_gui" \
+                -change "@loader_path/../../../qgis_analysis.framework/qgis_analysis" "$FRAMEWORKS/qgis_analysis.framework/Versions/$SHORT_VERSION/qgis_analysis" \
+                -change "@loader_path/../../../qgis_3d.framework/qgis_3d" "$FRAMEWORKS/qgis_3d.framework/Versions/$SHORT_VERSION/qgis_3d" \
+                -change "@loader_path/../../../qgis_native.framework/qgis_native" "$FRAMEWORKS/qgis_native.framework/Versions/$SHORT_VERSION/qgis_native" \
+                "$f" 2>/dev/null || true
+            }
+
+            fix_binary "$BUNDLE/Contents/MacOS/QGIS"
+            for lib in "$BUNDLE/Contents/MacOS/lib"/*.dylib; do fix_binary "$lib"; done
+            for fw in qgis_core qgis_gui qgis_analysis qgis_3d qgis_native; do
+              fix_binary "$FRAMEWORKS/$fw.framework/Versions/$SHORT_VERSION/$fw"
+              [[ -f "$FRAMEWORKS/$fw.framework/$fw" && ! -L "$FRAMEWORKS/$fw.framework/$fw" ]] && \
+                fix_binary "$FRAMEWORKS/$fw.framework/$fw"
+            done
+            for plugin in "$BUNDLE/Contents/PlugIns/qgis"/*.so; do fix_binary "$plugin"; done
+
+            ${lib.optionalString withGrass ''
+              fix_binary "$FRAMEWORKS/qgisgrass8.framework/Versions/$SHORT_VERSION/qgisgrass8"
+              install_name_tool \
+                -change "@loader_path/../../../qgisgrass8.framework/qgisgrass8" "$FRAMEWORKS/qgisgrass8.framework/Versions/$SHORT_VERSION/qgisgrass8" \
+                "$BUNDLE/Contents/MacOS/QGIS" 2>/dev/null || true
+              for lib in "$BUNDLE/Contents/MacOS/lib"/*.dylib; do
+                install_name_tool \
+                  -change "@loader_path/../../../qgisgrass8.framework/qgisgrass8" "$FRAMEWORKS/qgisgrass8.framework/Versions/$SHORT_VERSION/qgisgrass8" \
+                  "$lib" 2>/dev/null || true
+              done
+            ''}
+
+            ${lib.optionalString withServer ''
+              fix_binary "$BUNDLE/Contents/MacOS/lib/libqgis_server.${version}.dylib"
+            ''}
+
+            # Merge Python packages (lndir handles namespace packages correctly)
+            QGIS_PYTHON="$BUNDLE/Contents/Resources/python"
+            for pkg in ${
+              lib.concatMapStringsSep " " (p: "${p}/${py.pkgs.python.sitePackages}") (
+                py.pkgs.requiredPythonModules pythonBuildInputs
+              )
+            }; do
+              [[ -d "$pkg" ]] && lndir -silent "$pkg" "$QGIS_PYTHON"
+            done
+            # Remove broken symlinks
+            find "$QGIS_PYTHON" -type l ! -exec test -e {} \; -delete
+
+            # Create merged Qt plugins directory in the bundle (LSEnvironment is unreliable)
+            mkdir -p "$BUNDLE/Contents/PlugIns"
+            lndir -silent "${qtbase}/${qtbase.qtPluginPrefix}" "$BUNDLE/Contents/PlugIns"
+            lndir -silent "${qtsvg.bin}/${qtbase.qtPluginPrefix}" "$BUNDLE/Contents/PlugIns"
+
+            cat > "$BUNDLE/Contents/Resources/qt.conf" << 'EOF'
+      [Paths]
+      Plugins = PlugIns
+      EOF
+    '';

  # >9k objects, >3h build time on a normal build slot
  requiredSystemFeatures = [ "big-parallel" ];
@@ -207,6 +304,6 @@ mkDerivation rec {
    homepage = "https://www.qgis.org";
    license = lib.licenses.gpl2Plus;
    teams = [ lib.teams.geospatial ];
-    platforms = with lib.platforms; linux;
+    platforms = lib.platforms.unix;
  };
 }
@@ -5,7 +5,7 @@
  runCommand,
  inkcut,
  callPackage,
-  texlive,
+  texliveBasic,
 }:

 {
@@ -51,7 +51,7 @@
  inkstitch = callPackage ./extensions/inkstitch { };
  silhouette = callPackage ./extensions/silhouette { };
  textext = callPackage ./extensions/textext {
-    pdflatex = texlive.combined.scheme-basic;
-    lualatex = texlive.combined.scheme-basic;
+    pdflatex = texliveBasic;
+    lualatex = texliveBasic;
  };
 }
@@ -393,6 +393,10 @@ buildGoModule (finalAttrs: {
      --replace-fail '"$LDFLAGS $STATIC" -o' \
                '"$LDFLAGS" -o'

+    # Ensure the embedded tarball is reproducible: sort file order and clamp timestamps
+    substituteInPlace scripts/package-cli \
+      --replace-fail 'tar cvf' 'tar c --sort=name --mtime=@0 -vf'
+
    # Add the -e flag to process "errornous" packages. We need to modify this because the upstream
    # build-time version detection doesn't work with a vendor directory.
    substituteInPlace scripts/version.sh \
@@ -4,87 +4,29 @@
  buildGoModule,
  fetchFromGitHub,
  installShellFiles,
+  callPackage,
 }:
 let
-  generic =
-    {
-      version,
-      sha256,
-      rev ? version,
-      ...
-    }@attrs:
-    let
-      attrs' = removeAttrs attrs [
-        "version"
-        "sha256"
-        "rev"
-      ];
-    in
-    buildGoModule {
-      pname = "kops";
-      inherit version;
-
-      src = fetchFromGitHub {
-        rev = rev;
-        owner = "kubernetes";
-        repo = "kops";
-        inherit sha256;
-      };
-
-      vendorHash = null;
-
-      nativeBuildInputs = [ installShellFiles ];
-
-      subPackages = [ "cmd/kops" ];
-
-      ldflags = [
-        "-s"
-        "-w"
-        "-X k8s.io/kops.Version=${version}"
-        "-X k8s.io/kops.GitVersion=${version}"
-      ];
-
-      doCheck = false;
-
-      postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
-        installShellCompletion --cmd kops \
-          --bash <($GOPATH/bin/kops completion bash) \
-          --fish <($GOPATH/bin/kops completion fish) \
-          --zsh <($GOPATH/bin/kops completion zsh)
-      '';
-
-      meta = {
-        description = "Easiest way to get a production Kubernetes up and running";
-        mainProgram = "kops";
-        homepage = "https://github.com/kubernetes/kops";
-        changelog = "https://github.com/kubernetes/kops/tree/master/docs/releases";
-        license = lib.licenses.asl20;
-        maintainers = with lib.maintainers; [
-          zimbatm
-          yurrriq
-        ];
-      };
-    }
-    // attrs';
+  mkKops = callPackage ./mkkops.nix { };
 in
-rec {
-  mkKops = generic;
+{
+  inherit mkKops;

-  kops_1_31 = mkKops rec {
+  kops_1_31 = mkKops (finalAttrs: {
    version = "1.31.0";
    sha256 = "sha256-q9megrNXXKJ/YqP/fjPHh8Oji4dPK5M3HLHa+ufwRAM=";
-    rev = "v${version}";
-  };
+    rev = "v${finalAttrs.version}";
+  });

-  kops_1_32 = mkKops rec {
+  kops_1_32 = mkKops (finalAttrs: {
    version = "1.32.1";
    sha256 = "sha256-nQKeTDajtUffPBhPrPuaJ+1XWgLDUltwDQDZHkylys4=";
-    rev = "v${version}";
-  };
+    rev = "v${finalAttrs.version}";
+  });

-  kops_1_33 = mkKops rec {
+  kops_1_33 = mkKops (finalAttrs: {
    version = "1.33.0";
    sha256 = "sha256-VnnKWcU83yqsKW54Q1tr99/Ln8ppMyB7GLl70rUFGDY=";
-    rev = "v${version}";
-  };
+    rev = "v${finalAttrs.version}";
+  });
 }
@@ -0,0 +1,68 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  installShellFiles,
+  stdenv,
+}:
+lib.extendMkDerivation {
+  constructDrv = buildGoModule;
+
+  excludeDrvArgNames = [
+    "sha256"
+    "rev"
+  ];
+
+  extendDrvArgs =
+    finalAttrs:
+    {
+      version,
+      sha256,
+      rev ? version,
+      ...
+    }:
+    {
+      pname = "kops";
+
+      src = fetchFromGitHub {
+        rev = rev;
+        owner = "kubernetes";
+        repo = "kops";
+        inherit sha256;
+      };
+
+      vendorHash = null;
+
+      nativeBuildInputs = [ installShellFiles ];
+
+      subPackages = [ "cmd/kops" ];
+
+      ldflags = [
+        "-s"
+        "-w"
+        "-X k8s.io/kops.Version=${finalAttrs.version}"
+        "-X k8s.io/kops.GitVersion=${finalAttrs.version}"
+      ];
+
+      doCheck = false;
+
+      postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+        installShellCompletion --cmd kops \
+          --bash <($GOPATH/bin/kops completion bash) \
+          --fish <($GOPATH/bin/kops completion fish) \
+          --zsh <($GOPATH/bin/kops completion zsh)
+      '';
+
+      meta = {
+        description = "Easiest way to get a production Kubernetes up and running";
+        mainProgram = "kops";
+        homepage = "https://github.com/kubernetes/kops";
+        changelog = "https://github.com/kubernetes/kops/tree/master/docs/releases";
+        license = lib.licenses.asl20;
+        maintainers = with lib.maintainers; [
+          zimbatm
+          yurrriq
+        ];
+      };
+    };
+}
@@ -219,13 +219,13 @@
    "vendorHash": "sha256-6MKWpiDq4yI3mfIJyzEsWLa7gi0+DScI5jKcOcM6Qs0="
  },
  "cloudposse_utils": {
-    "hash": "sha256-Fjb+9NG+p+oTvKziRYHaNdAZaUv8Rs/FYLXmtwrfkOI=",
+    "hash": "sha256-Pf2UHxGEacmtIlSIKACC0MULAZMj5EGKq2q8Tsv79F8=",
    "homepage": "https://registry.terraform.io/providers/cloudposse/utils",
    "owner": "cloudposse",
    "repo": "terraform-provider-utils",
-    "rev": "v2.4.0",
+    "rev": "v2.5.0",
    "spdx": "Apache-2.0",
-    "vendorHash": "sha256-LNsJygeBSpY4xawhWfIcYOB0TEVK4DMeyiSgyn8PJ2A="
+    "vendorHash": "sha256-F4vFlhpPQUa1q7cFfjRooK4krISfpPxdj8uhvDmZQuY="
  },
  "cloudscale-ch_cloudscale": {
    "hash": "sha256-Ynuyn0L5B7d81WXEHoTI03zFzlEP3LGY4yQIl/WBr/8=",
@@ -571,13 +571,13 @@
    "vendorHash": "sha256-xIagZvWtlNpz5SQfxbA7r9ojAeS3CW2pwV337ObKOwU="
  },
  "hashicorp_google": {
-    "hash": "sha256-OF5Sa7ccS5z5d1hBKm43xmUQ8EibNMpOoBLa65EtTJg=",
+    "hash": "sha256-MAdeRuAHphIpvaEQhH38zMtw5F9Rbik82tzsJFgz14Y=",
    "homepage": "https://registry.terraform.io/providers/hashicorp/google",
    "owner": "hashicorp",
    "repo": "terraform-provider-google",
-    "rev": "v7.24.0",
+    "rev": "v7.25.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-v/XHGUEpAIpGHErv7GPqfosVLL3xaqBwZHbJKS8fkn4="
+    "vendorHash": "sha256-znm43JcwFf/NpGIaayyiOazAa7yCStrbuSNnGkyxzFA="
  },
  "hashicorp_google-beta": {
    "hash": "sha256-WOeYK5uti8NYhR3j8BgxwnlybEGOJryIPPTEgM23Fp0=",
@@ -1049,11 +1049,11 @@
    "vendorHash": null
  },
  "oracle_oci": {
-    "hash": "sha256-Luh2NB1+dKTbYnvU3o+rkta8wmqHuJRLv+lroM6/LcQ=",
+    "hash": "sha256-04K1EQe9twN3fk3GfG1lnSqUZuVmIlO24syeLd3c86E=",
    "homepage": "https://registry.terraform.io/providers/oracle/oci",
    "owner": "oracle",
    "repo": "terraform-provider-oci",
-    "rev": "v8.5.0",
+    "rev": "v8.7.0",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
@@ -43,14 +43,14 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "gajim";
-  version = "2.4.4";
+  version = "2.4.5";

  src = fetchFromGitLab {
    domain = "dev.gajim.org";
    owner = "gajim";
    repo = "gajim";
    tag = version;
-    hash = "sha256-buHCwrG3S28AgzBqJN/a0uBDDq2IM8LdE51baGFGLwM=";
+    hash = "sha256-5daPMlC2Ejfi5UXsRLaLWwEZHHEC0szbfkqavIisoUQ=";
  };

  pyproject = true;
@@ -148,6 +148,7 @@ python3.pkgs.buildPythonApplication rec {
    maintainers = with lib.maintainers; [
      raskin
      hlad
+      vbgl
    ];
    downloadPage = "http://gajim.org/download/";
    platforms = lib.platforms.linux;
@@ -105,11 +105,11 @@ assert lib.all (p: p.enabled -> !(builtins.elem null p.buildInputs)) plugins;

 stdenv.mkDerivation rec {
  pname = "weechat";
-  version = "4.8.1";
+  version = "4.8.2";

  src = fetchurl {
    url = "https://weechat.org/files/src/weechat-${version}.tar.xz";
-    hash = "sha256-56wfvMcUWO1keq2odHmQkFy1v7k/2MzMvCqWlnOkKFo=";
+    hash = "sha256-fi9hnU3NKNnYaGR2NYGhtFNJn43QZSr4Y7VARaiWTWw=";
  };

  # Why is this needed? https://github.com/weechat/weechat/issues/2031
@@ -46,7 +46,7 @@ assert (!blas.isILP64) && (!lapack.isILP64);

 stdenv.mkDerivation (finalAttrs: {
  pname = "R";
-  version = "4.5.2";
+  version = "4.5.3";

  src =
    let
@@ -54,7 +54,7 @@ stdenv.mkDerivation (finalAttrs: {
    in
    fetchurl {
      url = "https://cran.r-project.org/src/base/R-${lib.versions.major version}/${pname}-${version}.tar.gz";
-      hash = "sha256-DXH/cQbsac18Z+HpXtGjzuNViAkx8ut4xTABSp43nyA=";
+      hash = "sha256-qlwe1Ck8cnGsUT1lRnA1asDopq1eQr4BQ2XREVC1uPI=";
    };

  outputs = [
@@ -41,6 +41,7 @@ installFonts() {
  installFont 'bdf' "$out/share/fonts/misc"
  installFont 'otb' "$out/share/fonts/misc"
  installFont 'psf' "$out/share/consolefonts"
+  installFont 'psfu' "$out/share/consolefonts"

  if [ -n "${webfont-}" ]; then
    installFont 'woff' "$webfont/share/fonts/woff"
@@ -1,28 +1,28 @@
 {
  "stable": {
    "linux": {
-      "version": "8.12.6",
+      "version": "8.12.8",
      "sources": {
        "x86_64": {
-          "url": "https://downloads.1password.com/linux/tar/stable/x86_64/1password-8.12.6.x64.tar.gz",
-          "hash": "sha256-OLAPOgt5xgHudTUbu+XjpiN1lACWHZ86rYPZeX2idaw="
+          "url": "https://downloads.1password.com/linux/tar/stable/x86_64/1password-8.12.8.x64.tar.gz",
+          "hash": "sha256-WMApavYGR4TX1/gx8yjzaI0SHf1CEC+Ay9nAyxCOLs0="
        },
        "aarch64": {
-          "url": "https://downloads.1password.com/linux/tar/stable/aarch64/1password-8.12.6.arm64.tar.gz",
-          "hash": "sha256-dhSn/wPzny7eO2/5huEqBfus/TIkVAei7eqJVY0HdPI="
+          "url": "https://downloads.1password.com/linux/tar/stable/aarch64/1password-8.12.8.arm64.tar.gz",
+          "hash": "sha256-Uqt44otc40/v7/f90r2BS0yK1TuctOO0VUcWGhjv0pI="
        }
      }
    },
    "darwin": {
-      "version": "8.12.6",
+      "version": "8.12.8",
      "sources": {
        "x86_64": {
-          "url": "https://downloads.1password.com/mac/1Password-8.12.6-x86_64.zip",
-          "hash": "sha256-fL0KXi4+4fZfLX0sChWz7T//AdW9SCQF3mZvd92brIE="
+          "url": "https://downloads.1password.com/mac/1Password-8.12.8-x86_64.zip",
+          "hash": "sha256-w4gfs8Ctpe73TNaXebwUoa0cEOuZfiBUWN+qngSNcj4="
        },
        "aarch64": {
-          "url": "https://downloads.1password.com/mac/1Password-8.12.6-aarch64.zip",
-          "hash": "sha256-1N5bKMFSuyZ5KHXhmLevewsCLZvjunWTObBw5QMfbcY="
+          "url": "https://downloads.1password.com/mac/1Password-8.12.8-aarch64.zip",
+          "hash": "sha256-tT7VG6KlIv4Q+UtG9pzkyBRnISzvAdrqOeO8zdlZPb4="
        }
      }
    }
@@ -6,7 +6,7 @@

 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "20kly";
-  version = "1.5.0";
+  version = "1.5.2";

  pyproject = false;

@@ -14,7 +14,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
    owner = "20kly";
    repo = "20kly";
    tag = "v${finalAttrs.version}";
-    sha256 = "1zxsxg49a02k7zidx3kgk2maa0vv0n1f9wrl5vch07sq3ghvpphx";
+    sha256 = "sha256-7i1tHylnXWlTvfu9CbStTcA0qsFFqQcGX6bUUTUcYBw=";
  };

  patchPhase = ''
@@ -5,6 +5,7 @@
  autoreconfHook,
  glpk,
  gmp,
+  which,
 }:

 stdenv.mkDerivation (finalAttrs: {
@@ -18,6 +19,12 @@ stdenv.mkDerivation (finalAttrs: {
    hash = "sha256-bFvq90hLLGty7p6NLxOARVvKdizg3bp2NkP9nZpVFzQ=";
  };

+  postPatch = ''
+    substituteInPlace src/{groebner/script.template.in,zsolve/{graver,hilbert}.template} \
+      --replace-fail 'SCRIPT=$(realpath $(which "$0"))' \
+                     'SCRIPT=$(realpath $(${lib.getExe which} "$0"))'
+  '';
+
  nativeBuildInputs = [
    autoreconfHook
  ];
@@ -0,0 +1,26 @@
+{
+  lib,
+  rustPlatform,
+  fetchCrate,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "aasvg-rs";
+  version = "1.0.0";
+
+  src = fetchCrate {
+    inherit (finalAttrs) version;
+    pname = "aasvg-cli";
+    hash = "sha256-0qGCXHSCTg2yXLxREOfY7lOA3ZQCNFvST6GTBIsG/f4=";
+  };
+
+  cargoHash = "sha256-zl3IPKKG738cr1Au4Vw9SRstgOp57hM/JhPRNl0VsII=";
+
+  meta = {
+    description = "CLI tool to convert ASCII art diagrams to SVG";
+    homepage = "https://github.com/bearcove/aasvg-rs";
+    license = lib.licenses.bsd2;
+    maintainers = with lib.maintainers; [ chillcicada ];
+    mainProgram = "aasvg";
+  };
+})
@@ -0,0 +1,40 @@
+{
+  lib,
+  buildNpmPackage,
+  fetchFromGitHub,
+  versionCheckHook,
+  nix-update-script,
+}:
+
+buildNpmPackage (finalAttrs: {
+  pname = "aasvg";
+  version = "0.5.2";
+
+  src = fetchFromGitHub {
+    owner = "martinthomson";
+    repo = "aasvg";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Le6ZbJY7ZkqblZx4TkHWIiRKn1foi8jB+rldhu95NQ0=";
+  };
+
+  # the project has no dependencies
+  preInstall = "mkdir node_modules/";
+  forceEmptyCache = true;
+  dontNpmBuild = true;
+
+  npmDepsHash = "sha256-FdVXR2Myit3GiA1/VXzHBRSihKAQlh+Zd1gzSMuYi6c=";
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Convert ASCII art diagrams into SVG";
+    homepage = "https://github.com/martinthomson/aasvg";
+    platforms = lib.platforms.all;
+    license = lib.licenses.bsd2;
+    maintainers = with lib.maintainers; [ chillcicada ];
+    mainProgram = "aasvg";
+  };
+})
@@ -6,14 +6,14 @@
 }:
 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "actool";
-  version = "1.3.0";
+  version = "1.3.2";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "viraptor";
    repo = "actool";
    tag = finalAttrs.version;
-    hash = "sha256-8v2P6Z1ZOP65M30+7dTtfXvD0dvaKYSLA9aaP2uzA7E=";
+    hash = "sha256-4g4Uex6eE5ULKi9JGaOIlyTAzwuK0cPKdYMxTnvKN3U=";
  };

  build-system = with python3Packages; [
@@ -14,7 +14,7 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "agate";
-  version = "3.3.20";
+  version = "3.3.21";

  __darwinAllowLocalNetworking = true;

@@ -22,10 +22,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
    owner = "mbrubeck";
    repo = "agate";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-MV0fZo5tpRA5mkxzo5bGM5ASh+zxQbqrg1lL65IcUg8=";
+    hash = "sha256-eOeLbc7jlJ4OHY+Gce7JR4VaBsP+pBG3uiB7wsgtSyk=";
  };

-  cargoHash = "sha256-gteG7Oa15MtQPTu5/fZCmul1cDz7Lf19jEt7jELR6X4=";
+  cargoHash = "sha256-fDgsoI/SkDzHcQHQYJNguy7el7vLqpt5r05YoBR7FzY=";

  nativeBuildInputs = [ pkg-config ];
  buildInputs = [ openssl ];
@@ -24,7 +24,7 @@ buildGoModule (finalAttrs: {
    changelog = "https://github.com/nakabonne/ali/releases/tag/v${finalAttrs.version}";
    license = lib.licenses.mit;
    platforms = lib.platforms.linux ++ lib.platforms.darwin;
-    maintainers = with lib.maintainers; [ farcaller ];
+    maintainers = [ ];
    mainProgram = "ali";
    # Broken on darwin for Go toolchain > 1.22, with error:
    # 'link: golang.org/x/net/internal/socket: invalid reference to syscall.recvmsg'
@@ -11,7 +11,7 @@
  brotli,
  bzip2,
  celt,
-  ffmpeg,
+  ffmpeg_7,
  gmp,
  jack2,
  lame,
@@ -56,7 +56,7 @@ rustPlatform.buildRustPackage (finalAttrs: {

  patches = [
    (replaceVars ./fix-finding-libs.patch {
-      ffmpeg = lib.getDev ffmpeg;
+      ffmpeg = lib.getDev ffmpeg_7;
      x264 = lib.getDev x264;
    })
  ];
@@ -107,7 +107,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    brotli
    bzip2
    celt
-    ffmpeg
+    ffmpeg_7
    gmp
    jack2
    lame
@@ -5,13 +5,13 @@
  "packages": {
    "": {
      "dependencies": {
-        "@sourcegraph/amp": "^0.0.1773907698-g6757dd"
+        "@sourcegraph/amp": "^0.0.1774699422-ga16517"
      }
    },
    "node_modules/@napi-rs/keyring": {
-      "version": "1.1.9",
-      "resolved": "https://registry.npmjs.org/@napi-rs/keyring/-/keyring-1.1.9.tgz",
-      "integrity": "sha512-qjg04yaJ/gFqgG7wDqLlWBvZpsjvYDtwL+xOr2vSM2JrhojuIKsw7pH013U7xJOradTVGeQqhwqgZtt2IblgOw==",
+      "version": "1.1.10",
+      "resolved": "https://registry.npmjs.org/@napi-rs/keyring/-/keyring-1.1.10.tgz",
+      "integrity": "sha512-PTMyX7FVZGP4s0LcjgrFonek7Sr9ZTdi0TgpR4/4RQmC2TiDcjpdZOXxRMe2aP+5N89Ix9RG9QWclgqRHLk/Xw==",
      "license": "MIT",
      "engines": {
        "node": ">= 10"
@@ -21,24 +21,24 @@
        "url": "https://github.com/sponsors/Brooooooklyn"
      },
      "optionalDependencies": {
-        "@napi-rs/keyring-darwin-arm64": "1.1.9",
-        "@napi-rs/keyring-darwin-x64": "1.1.9",
-        "@napi-rs/keyring-freebsd-x64": "1.1.9",
-        "@napi-rs/keyring-linux-arm-gnueabihf": "1.1.9",
-        "@napi-rs/keyring-linux-arm64-gnu": "1.1.9",
-        "@napi-rs/keyring-linux-arm64-musl": "1.1.9",
-        "@napi-rs/keyring-linux-riscv64-gnu": "1.1.9",
-        "@napi-rs/keyring-linux-x64-gnu": "1.1.9",
-        "@napi-rs/keyring-linux-x64-musl": "1.1.9",
-        "@napi-rs/keyring-win32-arm64-msvc": "1.1.9",
-        "@napi-rs/keyring-win32-ia32-msvc": "1.1.9",
-        "@napi-rs/keyring-win32-x64-msvc": "1.1.9"
+        "@napi-rs/keyring-darwin-arm64": "1.1.10",
+        "@napi-rs/keyring-darwin-x64": "1.1.10",
+        "@napi-rs/keyring-freebsd-x64": "1.1.10",
+        "@napi-rs/keyring-linux-arm-gnueabihf": "1.1.10",
+        "@napi-rs/keyring-linux-arm64-gnu": "1.1.10",
+        "@napi-rs/keyring-linux-arm64-musl": "1.1.10",
+        "@napi-rs/keyring-linux-riscv64-gnu": "1.1.10",
+        "@napi-rs/keyring-linux-x64-gnu": "1.1.10",
+        "@napi-rs/keyring-linux-x64-musl": "1.1.10",
+        "@napi-rs/keyring-win32-arm64-msvc": "1.1.10",
+        "@napi-rs/keyring-win32-ia32-msvc": "1.1.10",
+        "@napi-rs/keyring-win32-x64-msvc": "1.1.10"
      }
    },
    "node_modules/@napi-rs/keyring-darwin-arm64": {
-      "version": "1.1.9",
-      "resolved": "https://registry.npmjs.org/@napi-rs/keyring-darwin-arm64/-/keyring-darwin-arm64-1.1.9.tgz",
-      "integrity": "sha512-/lVnrSFrut+8pQC6IcqlfHKzcEmf2XvQDOZPB5X4vI23GrNXBd56EuBlFPdTBtx46A8Bn+Aqi6pS8cnprHtcCw==",
+      "version": "1.1.10",
+      "resolved": "https://registry.npmjs.org/@napi-rs/keyring-darwin-arm64/-/keyring-darwin-arm64-1.1.10.tgz",
+      "integrity": "sha512-qdXBVypPNgTzso5F/YXWy5dOfFEb9eo43uROMlvwlhj7Aw137iwqwHiqlxR0teFKA33cWnem+ZKeVSIPoobtNA==",
      "cpu": [
        "arm64"
      ],
@@ -52,9 +52,9 @@
      }
    },
    "node_modules/@napi-rs/keyring-darwin-x64": {
-      "version": "1.1.9",
-      "resolved": "https://registry.npmjs.org/@napi-rs/keyring-darwin-x64/-/keyring-darwin-x64-1.1.9.tgz",
-      "integrity": "sha512-G3PiFZTAFTzUnpSB31A/UaPjl48/3sDTLmLxaAZBEk7HcOyBnL31gA1YqhDCO7F2y5sD5TWiFiuID9MyqYOcjw==",
+      "version": "1.1.10",
+      "resolved": "https://registry.npmjs.org/@napi-rs/keyring-darwin-x64/-/keyring-darwin-x64-1.1.10.tgz",
+      "integrity": "sha512-53DgSzhTAJwxR3KCyggHWcLwp+cw2v1zAhBiqNn1P8XwSJSba7HzFwsei6zZMn7bn3UY1ngIHEtaA74UUJVJyw==",
      "cpu": [
        "x64"
      ],
@@ -68,9 +68,9 @@
      }
    },
    "node_modules/@napi-rs/keyring-freebsd-x64": {
-      "version": "1.1.9",
-      "resolved": "https://registry.npmjs.org/@napi-rs/keyring-freebsd-x64/-/keyring-freebsd-x64-1.1.9.tgz",
-      "integrity": "sha512-R4XbvRhEzQyOy4yM+SMDgk8BgkLPkIzXGwR6QR0wJ2YrPeBx3F2TrgdHfsIGSn/X5Axg/2UlrCiZVciZ5BmusA==",
+      "version": "1.1.10",
+      "resolved": "https://registry.npmjs.org/@napi-rs/keyring-freebsd-x64/-/keyring-freebsd-x64-1.1.10.tgz",
+      "integrity": "sha512-pI6lect/Dp8NnV+g3w1hmYLt69FbSwKFAHn77vjeUaIT5H9C0ikAgwLk89Sd8/Ei/AHHldGkrLeWkNjnIiHfoQ==",
      "cpu": [
        "x64"
      ],
@@ -84,9 +84,9 @@
      }
    },
    "node_modules/@napi-rs/keyring-linux-arm-gnueabihf": {
-      "version": "1.1.9",
-      "resolved": "https://registry.npmjs.org/@napi-rs/keyring-linux-arm-gnueabihf/-/keyring-linux-arm-gnueabihf-1.1.9.tgz",
-      "integrity": "sha512-UrKy110I+zQyBtw4HLVUqZ1jDq11K3PmQIYgWAJNwB5VQOj4IQ63zLxk4V01Jx4bNOJmGNlvHDJUAyh/lC5Yww==",
+      "version": "1.1.10",
+      "resolved": "https://registry.npmjs.org/@napi-rs/keyring-linux-arm-gnueabihf/-/keyring-linux-arm-gnueabihf-1.1.10.tgz",
+      "integrity": "sha512-w4psOx5m1ltvNLABT/BpIzP5roVcglR1kDhzZgSEOIIrf2i4FKPQqUIo5UQtjsu+AqhhYwnlnketKDf4h+D06g==",
      "cpu": [
        "arm"
      ],
@@ -100,9 +100,9 @@
      }
    },
    "node_modules/@napi-rs/keyring-linux-arm64-gnu": {
-      "version": "1.1.9",
-      "resolved": "https://registry.npmjs.org/@napi-rs/keyring-linux-arm64-gnu/-/keyring-linux-arm64-gnu-1.1.9.tgz",
-      "integrity": "sha512-yOrhVpNGexDYzybe3dhmHQRPBDjlZPtJDE+eGSi1JwEqYlWDB+4IWjRsetxnO63DhnMFRLeMTdwWghsYrA7VwA==",
+      "version": "1.1.10",
+      "resolved": "https://registry.npmjs.org/@napi-rs/keyring-linux-arm64-gnu/-/keyring-linux-arm64-gnu-1.1.10.tgz",
+      "integrity": "sha512-YMC+ZLj3RldGD2Q5wzlZbc8vTh5Fteln+FpB2lw7EbDib3mmIribNH1NG21E4SwculFRDkVJqYGzwIhafloT8Q==",
      "cpu": [
        "arm64"
      ],
@@ -116,9 +116,9 @@
      }
    },
    "node_modules/@napi-rs/keyring-linux-arm64-musl": {
-      "version": "1.1.9",
-      "resolved": "https://registry.npmjs.org/@napi-rs/keyring-linux-arm64-musl/-/keyring-linux-arm64-musl-1.1.9.tgz",
-      "integrity": "sha512-82EcuzoV/+Dxwi1HHhrEEprN5Ou7OsRKyTJSaRqiVuGvLaQDUhZX/4zXTTh4Pz24m22Q4aoJogafS31w8iKGGw==",
+      "version": "1.1.10",
+      "resolved": "https://registry.npmjs.org/@napi-rs/keyring-linux-arm64-musl/-/keyring-linux-arm64-musl-1.1.10.tgz",
+      "integrity": "sha512-X/Gr5q2vJW7HMpcWRKj7eXer00a1PYb3zt3xsEG/VbcEo5A973pJANTBhYuoW098O/b7ORkunFt9WSbCgenw2A==",
      "cpu": [
        "arm64"
      ],
@@ -132,9 +132,9 @@
      }
    },
    "node_modules/@napi-rs/keyring-linux-riscv64-gnu": {
-      "version": "1.1.9",
-      "resolved": "https://registry.npmjs.org/@napi-rs/keyring-linux-riscv64-gnu/-/keyring-linux-riscv64-gnu-1.1.9.tgz",
-      "integrity": "sha512-Q1ar7DszC1X8FW6w7Ql7b72GFeAUxkTiOuxXChCFBy7eWCQSDrr52ZLroIowp82RmkQLZebnK+IwSssD2Ntoag==",
+      "version": "1.1.10",
+      "resolved": "https://registry.npmjs.org/@napi-rs/keyring-linux-riscv64-gnu/-/keyring-linux-riscv64-gnu-1.1.10.tgz",
+      "integrity": "sha512-vA3R4NVBlU0TVDHavwr5hSqePSs9OwTzzzFlTbZzqgh9s7OqcSwNT096nbr5dRjuQfG9o4/xvjfvVJ4v5z0Egg==",
      "cpu": [
        "riscv64"
      ],
@@ -148,9 +148,9 @@
      }
    },
    "node_modules/@napi-rs/keyring-linux-x64-gnu": {
-      "version": "1.1.9",
-      "resolved": "https://registry.npmjs.org/@napi-rs/keyring-linux-x64-gnu/-/keyring-linux-x64-gnu-1.1.9.tgz",
-      "integrity": "sha512-LMvrYt1ho3pEDECssA7ATbcMDgayEUwwSD+UfrC7Hj1+C6dlvipwt5njwUDCno2OeXbjjisCo4CR9fDmXa4sZA==",
+      "version": "1.1.10",
+      "resolved": "https://registry.npmjs.org/@napi-rs/keyring-linux-x64-gnu/-/keyring-linux-x64-gnu-1.1.10.tgz",
+      "integrity": "sha512-qbKE72UeVOrIoiYYHh7joTpDIgQCZpW5OJHG4Ir19GHLdQwNZGKLfFxrTT2DvZ5EXwFJWbOp4Dew4OvvQ0E63g==",
      "cpu": [
        "x64"
      ],
@@ -164,9 +164,9 @@
      }
    },
    "node_modules/@napi-rs/keyring-linux-x64-musl": {
-      "version": "1.1.9",
-      "resolved": "https://registry.npmjs.org/@napi-rs/keyring-linux-x64-musl/-/keyring-linux-x64-musl-1.1.9.tgz",
-      "integrity": "sha512-x2i/TgS2/fM+6LRj1MrtVC580sepz5GcxbSCXpttx2H58uZKBF0vVM9HDPHoKP2w5++fyrA17eltJNYN3Ob46A==",
+      "version": "1.1.10",
+      "resolved": "https://registry.npmjs.org/@napi-rs/keyring-linux-x64-musl/-/keyring-linux-x64-musl-1.1.10.tgz",
+      "integrity": "sha512-niLWyjD/JxQwlOTPeldIx8Xnf03Mp4ooorpWJMWbMuVz/6hSyLVghY/BDYu2Oaxhc+XlTEjmqwhoTWYhmti5eA==",
      "cpu": [
        "x64"
      ],
@@ -180,9 +180,9 @@
      }
    },
    "node_modules/@napi-rs/keyring-win32-arm64-msvc": {
-      "version": "1.1.9",
-      "resolved": "https://registry.npmjs.org/@napi-rs/keyring-win32-arm64-msvc/-/keyring-win32-arm64-msvc-1.1.9.tgz",
-      "integrity": "sha512-14t6p8CTBNfGzLO5LXqurT+pAOf/ocGjOM/qiG/LW+jPkhyJYBNI9e3HKq3QX+ObbnxVpt4fAY02b4XLt7EWig==",
+      "version": "1.1.10",
+      "resolved": "https://registry.npmjs.org/@napi-rs/keyring-win32-arm64-msvc/-/keyring-win32-arm64-msvc-1.1.10.tgz",
+      "integrity": "sha512-VBlqZ0MF5ksc/Z+yxoL2+p6TDu2rqBOcgZ+HwXzSfgFnfnuPds7xOVdFwwaiJbj9CsCrgnByr1jtHRvfEQ6Iiw==",
      "cpu": [
        "arm64"
      ],
@@ -196,9 +196,9 @@
      }
    },
    "node_modules/@napi-rs/keyring-win32-ia32-msvc": {
-      "version": "1.1.9",
-      "resolved": "https://registry.npmjs.org/@napi-rs/keyring-win32-ia32-msvc/-/keyring-win32-ia32-msvc-1.1.9.tgz",
-      "integrity": "sha512-7+7aXz5op6PtOnWYcK1GYXWQlk2zfpdPt9taLqmCCVpk1g4m3Gw1wyKyQxjrg9clHWdNhdWxhFEA0osDxG8/Eg==",
+      "version": "1.1.10",
+      "resolved": "https://registry.npmjs.org/@napi-rs/keyring-win32-ia32-msvc/-/keyring-win32-ia32-msvc-1.1.10.tgz",
+      "integrity": "sha512-0AvwivxgtjdpTCZCFAQUCxFA45DNKXOsdZYXBCIDfPIpUPgLxhIAsg6q7NJK00r1M24StwwfD+AzZDu14J1PKQ==",
      "cpu": [
        "ia32"
      ],
@@ -212,9 +212,9 @@
      }
    },
    "node_modules/@napi-rs/keyring-win32-x64-msvc": {
-      "version": "1.1.9",
-      "resolved": "https://registry.npmjs.org/@napi-rs/keyring-win32-x64-msvc/-/keyring-win32-x64-msvc-1.1.9.tgz",
-      "integrity": "sha512-P1wsSrSqDqvcXLL7yiH2RsO3De65wuEQj1ZjV9s1MHfEP5dIdriNYZfFsRBlOsl32GoK3qFzsuH5DTVviGEHSw==",
+      "version": "1.1.10",
+      "resolved": "https://registry.npmjs.org/@napi-rs/keyring-win32-x64-msvc/-/keyring-win32-x64-msvc-1.1.10.tgz",
+      "integrity": "sha512-T02DfUUvp3epOJ5lC7hcM5ff6xaLhIfymBf0LEa0oQMi+yCVoDrgjeKeGCUGwtVJWfphu58Tf9twX+hRiAD0dg==",
      "cpu": [
        "x64"
      ],
@@ -228,12 +228,12 @@
      }
    },
    "node_modules/@sourcegraph/amp": {
-      "version": "0.0.1773907698-g6757dd",
-      "resolved": "https://registry.npmjs.org/@sourcegraph/amp/-/amp-0.0.1773907698-g6757dd.tgz",
-      "integrity": "sha512-yCY1M8D42FBRdq3MwNHHmrKngH/nNKOWRHLgBehR9gt3w7cv9BaD2cPA/+eQgjcNMCpL7w7YcGGkXapOc1EiqA==",
+      "version": "0.0.1774699422-ga16517",
+      "resolved": "https://registry.npmjs.org/@sourcegraph/amp/-/amp-0.0.1774699422-ga16517.tgz",
+      "integrity": "sha512-Y5Y3H2iDgCkuqISWFqlpyT9lTPyXQzhjBOT9TwzvR9z0mHMmq+EDQnyXXfp2u9GTV4yaBsFGHZFzqJXWH5VdMw==",
      "license": "Amp Commercial License",
      "dependencies": {
-        "@napi-rs/keyring": "1.1.9"
+        "@napi-rs/keyring": "1.1.10"
      },
      "bin": {
        "amp": "dist/main.js"
@@ -9,11 +9,11 @@

 buildNpmPackage (finalAttrs: {
  pname = "amp-cli";
-  version = "0.0.1773907698-g6757dd";
+  version = "0.0.1774699422-ga16517";

  src = fetchzip {
    url = "https://registry.npmjs.org/@sourcegraph/amp/-/amp-${finalAttrs.version}.tgz";
-    hash = "sha256-Lyl53DH2qnl7HaHDDrPjVI7OoppQ41vL85mAstyGBD4=";
+    hash = "sha256-nM1U5RyQ+wa5RHR4GxPGeoP/93U1G47NIAm2BXRk0y8=";
  };

  postPatch = ''
@@ -45,7 +45,7 @@ buildNpmPackage (finalAttrs: {
    chmod +x bin/amp-wrapper.js
  '';

-  npmDepsHash = "sha256-X7DxJ6gLr5AhuGrWyp/PI+NglFgbZSiGxIqD1FiW9do=";
+  npmDepsHash = "sha256-USrhTsSRh/j2kR7i20ttr3QN/qv+45w9trJAgYd4axQ=";

  propagatedBuildInputs = [
    ripgrep
@@ -66,9 +66,13 @@ stdenv.mkDerivation (finalAttrs: {

    LOCALCLASSPATH="\$ANT_HOME/lib/ant-launcher.jar\''${LOCALCLASSPATH:+:}\$LOCALCLASSPATH"

-    exec \$NIX_JVM \$NIX_ANT_OPTS \$ANT_OPTS -classpath "\$LOCALCLASSPATH" \
-        -Dant.home=\$ANT_HOME -Dant.library.dir="\$ANT_LIB" \
-        org.apache.tools.ant.launch.Launcher \$NIX_ANT_ARGS \$ANT_ARGS \
+    if [ -n "\$ANT_LIB" ]; then
+        ANT_LIB_ARG="-Dant.library.dir=\$ANT_LIB"
+    fi
+
+    exec \$NIX_JVM \$NIX_ANT_OPTS \$ANT_OPTS -classpath "\$LOCALCLASSPATH" \\
+        -Dant.home=\$ANT_HOME \''${ANT_LIB_ARG:+"\$ANT_LIB_ARG"} \\
+        org.apache.tools.ant.launch.Launcher \$NIX_ANT_ARGS \$ANT_ARGS \\
        -cp "\$CLASSPATH" "\$@"
    EOF

@@ -30,18 +30,19 @@
  zstd,
  withDocs ? true,
  withNLS ? true,
+  nix-update-script,
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "apt";
-  version = "3.1.15";
+  version = "3.1.16";

  src = fetchFromGitLab {
    domain = "salsa.debian.org";
    owner = "apt-team";
    repo = "apt";
    rev = finalAttrs.version;
-    hash = "sha256-PnI7Ggqc/Go5p+eXf93d5qhG61TKO2/8ZSjML37pyzY=";
+    hash = "sha256-4n7QocfpAlDtJGpswV0LtwzWV1xtr7dLuLvAF5kBbAk=";
  };

  # cycle detection; lib can't be split
@@ -101,13 +102,15 @@ stdenv.mkDerivation (finalAttrs: {
    (lib.cmakeBool "WITH_DOC" withDocs)
  ];

+  passthru.updateScript = nix-update-script { };
+
  meta = {
    homepage = "https://salsa.debian.org/apt-team/apt";
    description = "Command-line package management tools used on Debian-based systems";
    changelog = "https://salsa.debian.org/apt-team/apt/-/raw/${finalAttrs.version}/debian/changelog";
    license = with lib.licenses; [ gpl2Plus ];
    mainProgram = "apt";
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ VZstless ];
    platforms = lib.platforms.linux;
  };
 })
@@ -5,16 +5,16 @@
 }:
 buildNpmPackage rec {
  pname = "arrpc";
-  version = "3.6.0";
+  version = "3.7.0";

  src = fetchFromGitHub {
    owner = "OpenAsar";
    repo = "arrpc";
    tag = version;
-    hash = "sha256-WSwnCE3hs3Rj42XDbPtxuYL8tAlfzuWPkIypKzCu8EQ=";
+    hash = "sha256-2SYlCOgeaPsYIQmGj4/fdme0S36COolXxER3rDjIe20=";
  };

-  npmDepsHash = "sha256-A98oNT1rGctSlJG9yLaa6i0VsGMIo1r2NoNk00SVupk=";
+  npmDepsHash = "sha256-GNXQLOTuu+7QWjx1Y+eaAon70jj7XC3p5a7z7qJOB+Q=";

  dontNpmBuild = true;

@@ -2,20 +2,25 @@
  lib,
  fetchCrate,
  rustPlatform,
+  nix-update-script,
 }:

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "asahi-bless";
-  version = "0.4.1";
+  version = "0.4.3";

  src = fetchCrate {
    inherit (finalAttrs) pname version;
-    hash = "sha256-SNaA+CEuCBwo4c54qWGs5AdkBYb9IWY1cQ0dRd/noe8=";
+    hash = "sha256-JBd1YPTJ2ZqcGZ+FTGR2hqXWYd+kJ/0snWrn4uEpXWg=";
  };

-  cargoHash = "sha256-nfSJ9RkzFAWlxlfoUKk8ZmIXDJXoSyHCGgRgMy9FDkw=";
+  cargoHash = "sha256-DN5PRUO0M0/ExIkuR+Iwk3SW1jzIaFnzvLOBuFoJ360=";
  cargoDepsName = finalAttrs.pname;

+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
  meta = {
    description = "Tool to select active boot partition on ARM Macs";
    homepage = "https://crates.io/crates/asahi-bless";
@@ -2,20 +2,30 @@
  lib,
  fetchCrate,
  rustPlatform,
+  nix-update-script,
+  pkg-config,
+  dbus,
 }:

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "asahi-btsync";
-  version = "0.2.0";
+  version = "0.2.5";

  src = fetchCrate {
    inherit (finalAttrs) pname version;
-    hash = "sha256-jp05WcwY1cWh4mBQj+3jRCZoG32OhDvTB84hOAGemX8=";
+    hash = "sha256-lAfbr2D6dITdlFCbz++OVz2SxYGapiZtrNjeBruBDJ8=";
  };

-  cargoHash = "sha256-gGWhi0T7xDIsbzfw/KL3TSneLvQaiz/2xbpHeZt1i3I=";
+  cargoHash = "sha256-80B47vRUgb+QWYoxqPWk1gCdWFM5bIxq0tR5FpssRQ4=";
  cargoDepsName = finalAttrs.pname;

+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ dbus ];
+
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
  meta = {
    description = "Tool to sync Bluetooth pairing keys with macos on ARM Macs";
    homepage = "https://crates.io/crates/asahi-btsync";
@@ -10,14 +10,14 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "asahi-fwextract";
-  version = "0.7.9";
+  version = "0.8.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "AsahiLinux";
    repo = "asahi-installer";
    tag = "v${version}";
-    hash = "sha256-vbhepoZ52k5tW2Gd7tfQTZ5CLqzhV7dUcVh6+AYwECk=";
+    hash = "sha256-UMzmQ3buXousCR8t0eSf6m+OTvqp3mEQ73aZ9UznuOI=";
  };

  postPatch = ''
@@ -2,20 +2,25 @@
  lib,
  fetchCrate,
  rustPlatform,
+  nix-update-script,
 }:

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "asahi-nvram";
-  version = "0.2.3";
+  version = "0.2.4";

  src = fetchCrate {
    inherit (finalAttrs) pname version;
-    hash = "sha256-zfUvPHAPrYhzgeiirGuqZaWnLBH0PHsqOUy2e972bWM=";
+    hash = "sha256-wRlKTMzckygRkZoAT3ZDYnAF3owWEziAGNl4jteCf+A=";
  };

-  cargoHash = "sha256-NW/puo/Xoum7DjSQjBgilQcKbY3mAfVgXxUK6+1H1JI=";
+  cargoHash = "sha256-Syc4QgKUJM37FW3JQqVNN9WEMFwCSoo/BaI55k2HFRY=";
  cargoDepsName = finalAttrs.pname;

+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
  meta = {
    description = "Tool to read and write nvram variables on ARM Macs";
    homepage = "https://crates.io/crates/asahi-nvram";
@@ -2,20 +2,25 @@
  lib,
  fetchCrate,
  rustPlatform,
+  nix-update-script,
 }:

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "asahi-wifisync";
-  version = "0.2.0";
+  version = "0.2.3";

  src = fetchCrate {
    inherit (finalAttrs) pname version;
-    hash = "sha256-wKd6rUUnegvl6cHODVQlllaOXuAGlmwx9gr73I/2l/c=";
+    hash = "sha256-YO7Yq3S7F7WuW79MR1wrViw3tTBZi8XIsXrd4f0xCzs=";
  };

-  cargoHash = "sha256-ZxgRxQyDID3mBpr8dhHScctk14Pm9V51Gn24d24JyVk=";
+  cargoHash = "sha256-cfgsY34wFeBTy0CYwVRZN22Ndifn6ZPs2t6f8DS3S2k=";
  cargoDepsName = finalAttrs.pname;

+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
  meta = {
    description = "Tool to sync Wifi passwords with macos on ARM Macs";
    homepage = "https://crates.io/crates/asahi-wifisync";
@@ -63,6 +63,13 @@ stdenv.mkDerivation (finalAttrs: {
  # There's only the Makefile
  dontConfigure = true;

+  outputs = [
+    "out"
+    "man"
+    "tex"
+    "texdoc"
+  ];
+
  makeFlags = [
    "PERLPATH=${perlWithPackages}/bin/perl"
    # We *need* to set DESTDIR as empty and use absolute paths below,
@@ -74,8 +81,8 @@ stdenv.mkDerivation (finalAttrs: {
    "BINDIR=${placeholder "out"}/bin"
    "PERLDIR=${placeholder "out"}/share/perl5"
    "MODSDIR=${placeholder "out"}/lib"
-    "TEXDIR=${placeholder "out"}/tex/latex/" # what texlive.combine expects
-    "TEXDOCDIR=${placeholder "out"}/share/doc/texmf/" # TODO where to put this?
+    "TEXDIR=${placeholder "tex"}/tex/latex/auto-multiple-choice/" # what texlive.withPackages expects
+    "TEXDOCDIR=${placeholder "texdoc"}/doc/latex/auto-multiple-choice/"
    "MAN1DIR=${placeholder "out"}/share/man/man1"
    "DESKTOPDIR=${placeholder "out"}/share/applications"
    "METAINFODIR=${placeholder "out"}/share/metainfo"
@@ -109,7 +116,7 @@ stdenv.mkDerivation (finalAttrs: {
        netpbm
      ]
    } \
-    --set TEXINPUTS ".:$out/tex/latex:"
+    --set TEXINPUTS ".:$tex/tex/latex:"
  '';

  nativeBuildInputs = [
@@ -161,10 +168,7 @@ stdenv.mkDerivation (finalAttrs: {
      …
      environment.systemPackages = with pkgs; [
        auto-multiple-choice
-        (texlive.combine {
-          inherit (pkgs.texlive) scheme-full;
-          inherit auto-multiple-choice;
-        })
+        (texliveFull.withPackages (_: [auto-multiple-choice.tex]))
      ];
      </screen>

@@ -10,16 +10,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "avbroot";
-  version = "3.26.0";
+  version = "3.29.0";

  src = fetchFromGitHub {
    owner = "chenxiaolong";
    repo = "avbroot";
    tag = "v${version}";
-    hash = "sha256-KNNVCn9a49HuiWACFkrdHd9BHBZ1zRJZgjtrYWpcY8w=";
+    hash = "sha256-/c3jYaNGQP4mZA2/MJFWBgaXpTmylgrF3555qdhtr2E=";
  };

-  cargoHash = "sha256-bdumthxBNqgZ3kxyvxUPo2GDCFboA/qQ1VwdvXTG388=";
+  cargoHash = "sha256-H39Gi2Y3T9PA78ARkJ3i6qHWJSzV/a+TGwXOicEduKQ=";

  nativeBuildInputs = [
    pkg-config
@@ -27,7 +27,7 @@ in

 python.pkgs.buildPythonApplication (finalAttrs: {
  pname = "awsebcli";
-  version = "3.27";
+  version = "3.27.1";
  pyproject = true;
  doInstallCheck = true;

@@ -35,7 +35,7 @@ python.pkgs.buildPythonApplication (finalAttrs: {
    owner = "aws";
    repo = "aws-elastic-beanstalk-cli";
    tag = finalAttrs.version;
-    hash = "sha256-bqGed3LCOAG5+bSwdaenxM3HtNXI6iRq191XS5Aau8c=";
+    hash = "sha256-5SmV+V+B3GYDnuOH8abh+NzGTZpMId41ZrJ7Fr6cXZo=";
  };

  pythonRelaxDeps = [
@@ -1,6 +1,6 @@
 {
  lib,
-  fetchFromGitHub,
+  fetchFromGitea,
  rustPlatform,
  pkg-config,
  lz4,
@@ -14,17 +14,18 @@
 }:

 rustPlatform.buildRustPackage (finalAttrs: {
-  pname = "swww";
-  version = "0.11.2";
+  pname = "awww";
+  version = "0.12.0";

-  src = fetchFromGitHub {
+  src = fetchFromGitea {
+    domain = "codeberg.org";
    owner = "LGFae";
-    repo = "swww";
+    repo = "awww";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-X2ptpXRo6ps5RxDe5RS7qfTaHWqBbBNw/aSdC2tzUG8=";
+    hash = "sha256-bvO+gfuUOVUiBEwAJ5A2RjpysPzCfyXD+DM8piOa1+4=";
  };

-  cargoHash = "sha256-5KZWsdo37NbFFkK8XFc0XI9iwBkpV8KsOaOc0y287Io=";
+  cargoHash = "sha256-4ApaMiVqXD4RlyWFMk2wKsyo37FT/OeVly/H88pF7oc=";

  buildInputs = [
    lz4
@@ -49,10 +50,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
      installManPage "$page"
    done

-    installShellCompletion --cmd swww \
-      --bash completions/swww.bash \
-      --fish completions/swww.fish \
-      --zsh completions/_swww
+    installShellCompletion --cmd awww \
+      --bash completions/awww.bash \
+      --fish completions/awww.fish \
+      --zsh completions/_awww
  '';

  postFixup = ''
@@ -64,13 +65,13 @@ rustPlatform.buildRustPackage (finalAttrs: {

  meta = {
    description = "Efficient animated wallpaper daemon for wayland, controlled at runtime";
-    homepage = "https://github.com/LGFae/swww";
+    homepage = "https://codeberg.org/LGFae/awww";
    license = lib.licenses.gpl3;
    maintainers = with lib.maintainers; [
      mateodd25
      donovanglover
    ];
    platforms = lib.platforms.linux;
-    mainProgram = "swww";
+    mainProgram = "awww";
  };
 })
@@ -7,7 +7,7 @@
  doxygen,
  dynarmic,
  enet,
-  fetchzip,
+  fetchFromGitHub,
  fmt,
  ffmpeg_6-headless,
  glslang,
@@ -19,6 +19,7 @@
  libusb1,
  moltenvk,
  nlohmann_json,
+  oaknut,
  openal,
  openssl,
  pipewire,
@@ -30,6 +31,7 @@
  soundtouch,
  stdenv,
  vulkan-headers,
+  vulkan-memory-allocator,
  xbyak,
  libxext,
  libx11,
@@ -47,6 +49,7 @@
  enableGamemode ? lib.meta.availableOn stdenv.hostPlatform gamemode,
  nix-update-script,
  darwinMinVersionHook,
+  fetchpatch,
 }:
 let
  inherit (lib)
@@ -58,11 +61,20 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "azahar";
-  version = "2124.3";
+  version = "2125.0.1";

-  src = fetchzip {
-    url = "https://github.com/azahar-emu/azahar/releases/download/${finalAttrs.version}/azahar-unified-source-${finalAttrs.version}.tar.xz";
-    hash = "sha256-JpqEJIKdmSJ5D9Q+a6YbHMJNTCK3+vDaSCSI23i60pk=";
+  src = fetchFromGitHub {
+    owner = "azahar-emu";
+    repo = "azahar";
+    tag = finalAttrs.version;
+    postCheckout = ''
+      git -C "$out/externals" submodule update --init \
+        teakra zstd discord-rpc spirv-headers spirv-tools sirit xxHash \
+        faad2/faad2 lodepng/lodepng dds-ktx nihstro "$out/dist/compatibility_list"
+      echo "${finalAttrs.version}" > "$out/GIT-TAG"
+      git -C "$out" rev-parse HEAD > "$out/GIT-COMMIT"
+    '';
+    hash = "sha256-KzM2FWJPxZtkpwvK4DSdfNuxE8yy1OVaioVegQbBSWk=";
  };

  strictDeps = true;
@@ -100,7 +112,7 @@ stdenv.mkDerivation (finalAttrs: {
    soundtouch
    SDL2
    vulkan-headers
-    xbyak
+    vulkan-memory-allocator

    # https://github.com/azahar-emu/azahar/issues/1283
    # spirv-tools
@@ -109,6 +121,8 @@ stdenv.mkDerivation (finalAttrs: {
    # Azahar uses zstd_seekable which is not currently packaged in nixpkgs
    # zstd
  ]
+  ++ optionals stdenv.hostPlatform.isx86_64 [ xbyak ]
+  ++ optionals stdenv.hostPlatform.isAarch64 [ oaknut ]
  ++ optionals enableQtTranslations [ qt6.qttools ]
  ++ optionals enableCubeb [ cubeb ]
  ++ optionals useDiscordRichPresence [ rapidjson ]
@@ -124,6 +138,14 @@ stdenv.mkDerivation (finalAttrs: {
    (darwinMinVersionHook "13.4")
  ];

+  patches = [
+    (fetchpatch {
+      name = "cmake-Add-option-to-use-system-oaknut.patch";
+      url = "https://github.com/azahar-emu/azahar/commit/6201256e15ee4d4fc053933545abf50fc46be178.patch";
+      hash = "sha256-03eIubAJ65W9clI9iaLcLNAAMbkX4E507nYNV8DVwZc=";
+    })
+  ];
+
  postPatch = ''
    # We already know the submodules are present
    substituteInPlace CMakeLists.txt \
@@ -7,12 +7,12 @@

 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "b4";
-  version = "0.15.0";
+  version = "0.15.1";
  pyproject = true;

  src = fetchPypi {
    inherit (finalAttrs) pname version;
-    hash = "sha256-TP2Zonr5yr4xn+Ibogr2lfaMZZBMY3McT8WjDqONp8g=";
+    hash = "sha256-5IxEu1efraux/D8Vvxh0r9chvBpj+6EMlvVovB9HzLM=";
  };

  # tests make dns requests and fails
@@ -2,6 +2,8 @@
  lib,
  rustPlatform,
  fetchFromGitHub,
+  versionCheckHook,
+  nix-update-script,
 }:

 rustPlatform.buildRustPackage (finalAttrs: {
@@ -17,12 +19,17 @@ rustPlatform.buildRustPackage (finalAttrs: {

  cargoHash = "sha256-qVE4MOFr0YO+9rAbfnz92h0KocaLu+v2u5ompwY/o6k=";

+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  passthru.updateScript = nix-update-script { };
+
  meta = {
    description = "File deduplicator";
    homepage = "https://github.com/Canop/backdown";
-    changelog = "https://github.com/Canop/backdown/blob/${finalAttrs.src.rev}/CHANGELOG.md";
+    changelog = "https://github.com/Canop/backdown/blob/v${finalAttrs.version}/CHANGELOG.md";
    license = lib.licenses.mit;
-    maintainers = [ ];
+    maintainers = [ lib.maintainers.progrm_jarvis ];
    mainProgram = "backdown";
  };
 })
@@ -26,6 +26,6 @@ buildGoModule (finalAttrs: {
    homepage = "https://github.com/dgraph-io/badger";
    license = lib.licenses.asl20;
    mainProgram = "badger";
-    maintainers = with lib.maintainers; [ farcaller ];
+    maintainers = [ ];
  };
 })
@@ -60,7 +60,6 @@ appimageTools.wrapAppImage {
    sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
    license = lib.licenses.gpl3Only;
    maintainers = with lib.maintainers; [
-      amesgen
      gcleroux
    ];
    platforms = [ "x86_64-linux" ];
@@ -5,14 +5,14 @@
 }:
 python3Packages.buildPythonApplication rec {
  pname = "BeatPrints";
-  version = "1.1.5";
+  version = "1.1.6";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "TrueMyst";
    repo = "BeatPrints";
    rev = "v${version}";
-    hash = "sha256-7h2MbU6wPqcRhWijdMyd7sTf3UVNCX+5JUNytKr5/EM=";
+    hash = "sha256-ExeNNN2ce3XB9dpNR4RUZTXWVI0dPdFT7/FvSFAWBw4=";
  };

  build-system = with python3Packages; [
@@ -19,13 +19,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "bella";
-  version = "0.1.7";
+  version = "0.1.8";

  src = fetchFromGitHub {
    owner = "josephmawa";
    repo = "Bella";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-ePzDnaoGPa5Hku7Rpced989QB6uOXN/jfXgTwtlE7rQ=";
+    hash = "sha256-IjRjo5zKoXFK+4F7OtSYuk62Pif7HDAi0E/3+t9rjv4=";
  };

  strictDeps = true;
@@ -8,13 +8,13 @@

 buildGoModule (finalAttrs: {
  pname = "betteralign";
-  version = "0.9.0";
+  version = "0.9.1";

  src = fetchFromGitHub {
    owner = "dkorunic";
    repo = "betteralign";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-NZBGcgI2SLkCUb4v7Tdm6QQd5dqtDmp+dhCTZEovU2Y=";
+    hash = "sha256-WoT1/MpL4Q26u5X8n7N128apnP8D4QJSkyAYmBzb4EM=";

    # Trick for getting accurate commit, source date and timestamp for ldflags
    # Required by upstream https://github.com/dkorunic/betteralign/blob/346baa9c9dd024bfe55302c9d7d0ca46b2734c1c/.goreleaser.yml
@@ -28,7 +28,7 @@ buildGoModule (finalAttrs: {
    '';
  };

-  vendorHash = "sha256-F9SCMJNu8XnkvYPYfuMGFLgbn9sFDn63ao7ExYXSOaM=";
+  vendorHash = "sha256-BfHxti4jILEvAamwMht6PQmWlR8PMzO2aywGAE/trIA=";

  env.CGO_ENABLED = 0;

@@ -9,6 +9,8 @@
  libxcursor,
  libx11,
  vulkan-loader,
+  versionCheckHook,
+  nix-update-script,
 }:

 rustPlatform.buildRustPackage (finalAttrs: {
@@ -41,14 +43,20 @@ rustPlatform.buildRustPackage (finalAttrs: {
      }
  '';

+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  passthru.updateScript = nix-update-script { };
+
  meta = {
    description = "Graphical tool to visualize binary data";
    mainProgram = "binocle";
    homepage = "https://github.com/sharkdp/binocle";
+    changelog = "https://github.com/sharkdp/binocle/releases/tag/v0.3.2";
    license = with lib.licenses; [
      asl20 # or
      mit
    ];
-    maintainers = [ ];
+    maintainers = [ lib.maintainers.progrm_jarvis ];
  };
 })
@@ -16,6 +16,11 @@ stdenv.mkDerivation {

  strictDeps = true;

+  postPatch = ''
+    substituteInPlace Makefile \
+      --replace-fail "CC=g++" "CC=c++"
+  '';
+
  installPhase = ''
    runHook preInstall
    install -Dm555 {blobpack,blobunpack} -t $out/bin
@@ -0,0 +1,15 @@
+diff --git a/js/desktop.js b/js/desktop.js
+index f3fcb25..a92a884 100644
+--- a/js/desktop.js
+++ b/js/desktop.js
+@@ -123,7 +123,9 @@ export function loadOpenWithBlockbenchFile() {
+ 	})
+ 	if (electron.process.argv.length >= 2) {
+ 		let path = electron.process.argv.last();
+-		load(path);
+		if (!path.endsWith("app.asar")) {
+			load(path);
+		}
+ 	}
+ }
+ console.log('Electron '+process.versions.electron+', Node '+process.versions.node)
@@ -3,7 +3,6 @@
  stdenv,
  buildNpmPackage,
  fetchFromGitHub,
-  fetchpatch,
  makeWrapper,
  imagemagick,
  copyDesktopItems,
@@ -13,15 +12,22 @@

 buildNpmPackage rec {
  pname = "blockbench";
-  version = "5.0.7";
+  version = "5.1.1";

  src = fetchFromGitHub {
    owner = "JannisX11";
    repo = "blockbench";
    tag = "v${version}";
-    hash = "sha256-JXOO2+UPMOGSuvez8ektbD5waPKatMggKn+MuH9Qkrs=";
+    hash = "sha256-bvstexoBQylLmTMzAhId+1HvC3iiL3tPahGhwZ5Yroo=";
  };

+  patches = [
+    # On linux we're running Blockbench by giving the path to the app.asar file to the electron executable,
+    # but Blockbench assumes paths at the and og the argv are files to be opened
+    # This patch disables trying to open the app.asar file
+    ./dont-assume-opening-app-asar.patch
+  ];
+
  nativeBuildInputs = [
    makeWrapper
  ]
@@ -30,16 +36,7 @@ buildNpmPackage rec {
    copyDesktopItems
  ];

-  patches = [
-    (fetchpatch {
-      # fixes https://github.com/JannisX11/blockbench/issues/3237
-      name = "bump-electron-builder.patch";
-      url = "https://github.com/JannisX11/blockbench/commit/dee9ae271f252d4bb3f98c13c4a1abaaeedd1feb.patch";
-      hash = "sha256-XpdqeCKoWsUieOMWhxVsEQ2r0qR+iiXKnVRfNYERDQs=";
-    })
-  ];
-
-  npmDepsHash = "sha256-T3yenZCkOrGOWJBxqe0RG39jWYfpsXStblf5Jx4dtF0=";
+  npmDepsHash = "sha256-1CCYk3cKFdLhx8oC5XreFCf5sL/7eKjOfXCmHt7hZrM=";
  makeCacheWritable = true;

  env.ELECTRON_SKIP_BINARY_DOWNLOAD = 1;
@@ -11,13 +11,13 @@

 buildGoModule (finalAttrs: {
  pname = "bootdev-cli";
-  version = "1.24.0";
+  version = "1.26.0";

  src = fetchFromGitHub {
    owner = "bootdotdev";
    repo = "bootdev";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-/vVT2daJCxJDmJr9Xi27POCAKURCS171ORb7UJp/CqU=";
+    hash = "sha256-hr8mqnX4mv6P8WpXCpP678lLUaanUu6X4jL5GJeBdzo=";
  };

  vendorHash = "sha256-ZDioEU5uPCkd+kC83cLlpgzyOsnpj2S7N+lQgsQb8uY=";
@@ -33,10 +33,9 @@ buildGoModule (finalAttrs: {
  ];

  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
-    installShellCompletion --cmd bootdev \
-      --bash <($out/bin/bootdev completion bash) \
-      --zsh <($out/bin/bootdev completion zsh) \
-      --fish <($out/bin/bootdev completion fish)
+    for shell in bash fish zsh; do
+      installShellCompletion --cmd bootdev --"$shell" <($out/bin/bootdev completion "$shell")
+    done
  '';

  nativeInstallCheckInputs = [ versionCheckHook ];
@@ -8,13 +8,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "bstring";
-  version = "1.0.3";
+  version = "1.1.0";

  src = fetchFromGitHub {
    owner = "msteinert";
    repo = "bstring";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-efXMSRcPgo+WlOdbS1kY2PYQqSVwcsVSyU1JfsU8OOo=";
+    hash = "sha256-zmBymVdfm1uKTg6quWIf0tdec98SuLHEA7q3q34XJtc=";
  };

  nativeBuildInputs = [
@@ -9,20 +9,20 @@
 }:

 let
-  version = "2026.3";
+  version = "2026.3.1";

  product =
    if proEdition then
      {
        productName = "pro";
        productDesktop = "Burp Suite Professional Edition";
-        hash = "sha256-iGSXyF6Jh3eSuokzu8DNK6wIUw7a0px/Hg5QwzgMQY4=";
+        hash = "sha256-jRVRvqFRsRO+vbEoV35bX4vi9XEYl737L0umt61ACtk=";
      }
    else
      {
        productName = "community";
        productDesktop = "Burp Suite Community Edition";
-        hash = "sha256-kr4Fa6NjaCiN6ulwr+HR6KN/DpYWFlzwnyO4E34x4yY=";
+        hash = "sha256-wjXzFXE+cIHw8tXuitsN4emH5varOTWQxiohwFGKZvc=";
      };

  src = fetchurl {
@@ -41,14 +41,14 @@ assert lib.assertMsg (

 stdenv.mkDerivation (finalAttrs: {
  pname = "cadabra2";
-  version = "2.5.14";
+  version = "2.5.14-p1";

  src = fetchFromGitHub {
    owner = "kpeeters";
    repo = "cadabra2";
    tag = finalAttrs.version;
    fetchSubmodules = true;
-    hash = "sha256-lQ/xGxWa126EzxDIsXoi3brnECcXLXxzzUizLpRjZOg=";
+    hash = "sha256-Pbk9SmJ64CZ+yxMj53JpxULBQye2ETDi8xNKw38cC9k=";
  };

  postPatch = ''
@@ -118,7 +118,8 @@ stdenv.mkDerivation (finalAttrs: {

  nativeInstallCheckInputs = [ versionCheckHook ];
  versionCheckProgramArg = "--version";
-  doInstallCheck = !enableBuildAsCppLibrary;
+  #doInstallCheck = !enableBuildAsCppLibrary;
+  doInstallCheck = false; # FIXME: remove this line and uncomment the above after next release

  passthru.updateScript = nix-update-script { };

@@ -11,16 +11,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cargo-binstall";
-  version = "1.17.8";
+  version = "1.17.9";

  src = fetchFromGitHub {
    owner = "cargo-bins";
    repo = "cargo-binstall";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-VQ7+NNKlT/Jrt7e3PW+rvkoo0ketw7KV9PptA0hkp9A=";
+    hash = "sha256-GTyMnbPHB7+E8IEdUd7bHBmCTcMI6UqYBysGqzDs8MA=";
  };

-  cargoHash = "sha256-0KHPiO+cgAVrhPtr2CtOaqiA+q9xtrIHZvPfHKbD8Cw=";
+  cargoHash = "sha256-38KqQcpOtSkV0eYQsXRdte8Pzabv2nU0ipxqzQFHgtg=";

  nativeBuildInputs = [
    pkg-config
--- a/Show More
+++ b/Show More