Merge master into staging-nixos

2026-01-23 18:08:19 +00:00
parent 8e90e95f75 fa4e65ad7a
commit 76cca98d33
138 changed files with 2944 additions and 1588 deletions
@@ -105,6 +105,22 @@ let
      # network
      network = callLibs ./network;

+      inherit (builtins)
+        getContext
+        hasContext
+        convertHash
+        hashString
+        hasFile
+        parseDrvName
+        placeholder
+        fromJSON
+        fromTOML
+        toFile
+        toJSON
+        toString
+        toXML
+        tryEval
+        ;
      inherit (self.trivial)
        id
        const
@@ -112,6 +128,8 @@ let
        concat
        "or"
        and
+        mul
+        div
        xor
        bitAnd
        bitOr
@@ -163,6 +181,8 @@ let
        pathExists
        genericClosure
        readFile
+        ceil
+        floor
        ;
      inherit (self.fixedPoints)
        fix
@@ -327,7 +347,6 @@ let
        escape
        escapeShellArg
        escapeShellArgs
-        isPath
        isStorePath
        isStringLike
        isValidPosixName
@@ -420,6 +439,9 @@ let
        pathType
        pathIsDirectory
        pathIsRegularFile
+        baseNameOf
+        dirOf
+        isPath
        packagesFromDirectoryRecursive
        ;
      inherit (self.sources)
@@ -434,6 +456,7 @@ let
        pathIsGitRepo
        revOrTag
        repoRevToName
+        filterSource
        ;
      inherit (self.modules)
        evalModules
@@ -564,6 +587,7 @@ let
        imap
        ;
      inherit (self.versions)
+        compareVersions
        splitVersion
        ;
      inherit (self.network.ipv6)
@@ -25,6 +25,11 @@ let
 in

 {
+  inherit (builtins)
+    baseNameOf
+    dirOf
+    isPath
+    ;

  /**
    The type of a path. The path needs to exist and be accessible.
@@ -529,4 +529,6 @@ in

    trace
    ;
+
+  inherit (builtins) filterSource;
 }
@@ -27,6 +27,8 @@ in
    isFloat
    add
    sub
+    mul
+    div
    lessThan
    seq
    deepSeq
@@ -34,6 +36,8 @@ in
    bitAnd
    bitOr
    bitXor
+    ceil
+    floor
    ;

  ## Simple (higher order) functions
@@ -3,6 +3,8 @@

 rec {

+  inherit (builtins) compareVersions;
+
  /**
    Break a version string into its component parts.

@@ -4930,6 +4930,11 @@
    githubId = 114656678;
    name = "Gabriel Hosquet";
  };
+  cizordj = {
+    github = "cizordj";
+    githubId = 32869222;
+    name = "Cézar Augusto";
+  };
  cizra = {
    email = "todurov+nix@gmail.com";
    github = "cizra";
@@ -18196,6 +18201,14 @@
    githubId = 254145391;
    name = "n3tshift";
  };
+  N4CH723HR3R = {
+    email = "n4ch7@n3831.net";
+    github = "N4CH723HR3R";
+    githubId = 221765713;
+    keys = [ { fingerprint = "C5A6 76E5 DFDD 076B 9B59  ABEC D783 89DC 24B6 4620"; } ];
+    matrix = "@n4ch7:n3831.net";
+    name = "N4CH723HR3R";
+  };
  n8henrie = {
    name = "Nathan Henrie";
    email = "nate@n8henrie.com";
@@ -85,6 +85,11 @@ of pulling the upstream container image from Docker Hub. If you want the old beh

 - Support for `reiserfs` in nixpkgs has been removed, following the removal in Linux 6.13.

+- `services.tor` no longer bind mounts Unix sockets of onion services into its chroot
+because it was not reliable. Users should do it themselves using either `JoinsNamespaceOf=` and Unix sockets in `/tmp`
+or `BindPaths=` from a persistent parent directory of each Unix socket.
+See <https://github.com/NixOS/nixpkgs/issues/481673>.
+
 - support for `ecryptfs` in nixpkgs has been removed.

 - The `networking.wireless` module has been security hardened: the `wpa_supplicant` daemon now runs under an unprivileged user with restricted access to the system.
@@ -19,6 +19,29 @@ in
    openFirewall = (lib.mkEnableOption "") // {
      description = "Whether to open the firewall port (default 45876).";
    };
+    smartmon = {
+      enable = lib.mkOption {
+        default = false;
+        example = true;
+        description = "Include services.beszel.agent.smartmon.package in the Beszel agent path for disk monitoring and add the agent to the disk group.";
+        type = lib.types.bool;
+      };
+      package = lib.mkPackageOption pkgs "smartmontools" { };
+      deviceAllow = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+        default = [ ];
+        example = [
+          "/dev/sda"
+          "/dev/sdb"
+          "/dev/nvme0"
+        ];
+        description = ''
+          List of device paths to allow access to for SMART monitoring.
+          This is only needed if the ambient capabilities are not sufficient.
+          Devices will be granted read-only access.
+        '';
+      };
+    };

    environment = lib.mkOption {
      type = lib.types.attrsOf lib.types.str;
@@ -47,6 +70,11 @@ in
  };

  config = lib.mkIf cfg.enable {
+    services.udev.extraRules = lib.optionalString cfg.smartmon.enable ''
+      # Change NVMe devices to disk group ownership for S.M.A.R.T. monitoring
+      KERNEL=="nvme[0-9]*", GROUP="disk", MODE="0660"
+    '';
+
    systemd.services.beszel-agent = {
      description = "Beszel Server Monitoring Agent";

@@ -57,6 +85,7 @@ in
      environment = cfg.environment;
      path =
        cfg.extraPath
+        ++ lib.optionals cfg.smartmon.enable [ cfg.smartmon.package ]
        ++ lib.optionals (builtins.elem "nvidia" config.services.xserver.videoDrivers) [
          (lib.getBin config.hardware.nvidia.package)
        ]
@@ -79,14 +108,32 @@ in
          lib.optionals config.virtualisation.docker.enable [ "docker" ]
          ++ lib.optionals (
            config.virtualisation.podman.enable && config.virtualisation.podman.dockerSocket.enable
-          ) [ "podman" ];
+          ) [ "podman" ]
+          ++ lib.optionals cfg.smartmon.enable [ "disk" ];

        DynamicUser = true;
        User = "beszel-agent";
+
+        # Capabilities needed for SMART monitoring
+        AmbientCapabilities = lib.mkIf cfg.smartmon.enable [
+          "CAP_SYS_RAWIO"
+          "CAP_SYS_ADMIN"
+        ];
+        CapabilityBoundingSet = lib.mkIf cfg.smartmon.enable [
+          "CAP_SYS_RAWIO"
+          "CAP_SYS_ADMIN"
+        ];
+
+        # Device access for SMART monitoring
+        DeviceAllow = lib.mkIf (cfg.smartmon.enable && cfg.smartmon.deviceAllow != [ ]) (
+          map (device: "${device} r") cfg.smartmon.deviceAllow
+        );
+
        LockPersonality = true;
-        NoNewPrivileges = true;
+        NoNewPrivileges = !cfg.smartmon.enable;
+        PrivateDevices = !cfg.smartmon.enable;
        PrivateTmp = true;
-        PrivateUsers = true;
+        PrivateUsers = !cfg.smartmon.enable;
        ProtectClock = true;
        ProtectControlGroups = "strict";
        ProtectHome = "read-only";
@@ -237,10 +237,12 @@ in
          type = lib.types.enum [
            "local"
            "redis"
+            "postgres"
          ];
          default = "local";
          description = ''
-            Lock backend to use: 'local' (single instance), 'redis' (distributed).
+            Lock backend to use: 'local' (single instance), 'redis'
+            (distributed), or 'postgres' (distributed, requires PostgreSQL).
          '';
        };

@@ -636,7 +636,31 @@ in
        };

        onionServices = lib.mkOption {
-          description = (descriptionGeneric "HiddenServiceDir");
+          description = descriptionGeneric "HiddenServiceDir" + ''
+            :::{.warning}
+            Because `tor.service` runs in its own `RootDirectory=`,
+            when using a onion service to reverse-proxy to a Unix socket,
+            you need to make that Unix socket available
+            within the mount namespace of `tor.service`.
+
+            When you can configure your service to create its socket in `/tmp`,
+            this can be done with:
+            ```nix
+            systemd.services.''${your-service} = {
+              unitConfig.JoinsNamespaceOf = [ "tor.service" ];`
+              serviceConfig.PrivateTmp = true;
+            };
+            ```
+            Otherwise, you can use:
+            ```nix
+            systemd.services.tor.serviceConfig.BindPaths = [ "/path/to/your-service/socket/directory" ];
+            ```
+            but you have to be sure that `/path/to/socket/directory`
+            exists before `tor.service` is started
+            and is not deleted and recreated between restarts of `your-service`,
+            or you'll need to restart `tor.service` to refresh the `BindPaths=`.
+            :::
+          '';
          default = { };
          example = {
            "example.org/www" = {
@@ -1416,22 +1440,10 @@ in
        RootDirectoryStartOnly = true;
        #InaccessiblePaths = [ "-+${runDir}/root" ];
        UMask = "0066";
-        BindPaths = [
-          stateDir
-        ]
-        ++ lib.filter (x: x != null) (
-          lib.catAttrs "unix" (
-            lib.filter (x: x != null) (
-              lib.catAttrs "target" (
-                lib.concatMap (onionService: onionService.map) (lib.attrValues cfg.relay.onionServices)
-              )
-            )
-          )
-        );
        BindReadOnlyPaths = [
-          builtins.storeDir
          "/etc"
        ]
+        ++ lib.optional (!config.systemd.services.tor.confinement.enable) builtins.storeDir
        ++ lib.optionals config.services.resolved.enable [
          "/run/systemd/resolve/stub-resolv.conf"
          "/run/systemd/resolve/resolv.conf"
@@ -1485,7 +1497,6 @@ in
          "~@timer"
        ];
        SystemCallArchitectures = "native";
-        SystemCallErrorNumber = "EPERM";
      };
    };

@@ -7,10 +7,6 @@
 let
  cfg = config.services.nextcloud;

-  overridePackage = cfg.package.override {
-    inherit (config.security.pki) caBundle;
-  };
-
  fpm = config.services.phpfpm.pools.nextcloud;

  jsonFormat = pkgs.formats.json { };
@@ -53,13 +49,13 @@ let
  };

  webroot =
-    pkgs.runCommand "${overridePackage.name or "nextcloud"}-with-apps"
+    pkgs.runCommand "${cfg.package.name or "nextcloud"}-with-apps"
      {
        preferLocalBuild = true;
      }
      ''
        mkdir $out
-        ln -sfv "${overridePackage}"/* "$out"
+        ln -sfv "${cfg.package}"/* "$out"
        ${lib.concatStrings (
          lib.mapAttrsToList (
            name: store:
@@ -1221,13 +1217,13 @@ in
            If you have an existing installation with a custom table prefix, make sure it is
            set correctly in `config.php` and remove the option from your NixOS config.
          '')
-          ++ (lib.optional (lib.versionOlder overridePackage.version "26") (upgradeWarning 25 "23.05"))
-          ++ (lib.optional (lib.versionOlder overridePackage.version "27") (upgradeWarning 26 "23.11"))
-          ++ (lib.optional (lib.versionOlder overridePackage.version "28") (upgradeWarning 27 "24.05"))
-          ++ (lib.optional (lib.versionOlder overridePackage.version "29") (upgradeWarning 28 "24.11"))
-          ++ (lib.optional (lib.versionOlder overridePackage.version "30") (upgradeWarning 29 "24.11"))
-          ++ (lib.optional (lib.versionOlder overridePackage.version "31") (upgradeWarning 30 "25.05"))
-          ++ (lib.optional (lib.versionOlder overridePackage.version "32") (upgradeWarning 31 "25.11"));
+          ++ (lib.optional (lib.versionOlder cfg.package.version "26") (upgradeWarning 25 "23.05"))
+          ++ (lib.optional (lib.versionOlder cfg.package.version "27") (upgradeWarning 26 "23.11"))
+          ++ (lib.optional (lib.versionOlder cfg.package.version "28") (upgradeWarning 27 "24.05"))
+          ++ (lib.optional (lib.versionOlder cfg.package.version "29") (upgradeWarning 28 "24.11"))
+          ++ (lib.optional (lib.versionOlder cfg.package.version "30") (upgradeWarning 29 "24.11"))
+          ++ (lib.optional (lib.versionOlder cfg.package.version "31") (upgradeWarning 30 "25.05"))
+          ++ (lib.optional (lib.versionOlder cfg.package.version "32") (upgradeWarning 31 "25.11"));

        services.nextcloud.package = lib.mkDefault (
          if pkgs ? nextcloud then
@@ -1289,7 +1285,7 @@ in
          }
          {
            assertion =
-              lib.versionAtLeast overridePackage.version "32.0.0"
+              lib.versionAtLeast cfg.package.version "32.0.0"
              || (cfg.config.adminuser != null && cfg.config.adminpassFile != null);
            message = ''
              Disabling initial admin user creation is only available on Nextcloud >= 32.0.0.
@@ -1622,6 +1618,7 @@ in
              "upgrade.disable-web" = true;
              # NixOS already provides its own integrity check and the nix store is read-only, therefore Nextcloud does not need to do its own integrity checks.
              "integrity.check.disabled" = true;
+              "default_certificates_bundle_path" = config.security.pki.caBundle;
            }
            (lib.mkIf cfg.configureRedis {
              "memcache.distributed" = ''\OC\Memcache\Redis'';
@@ -20,43 +20,8 @@ let

  mkDefaultAttrs = mapAttrs (n: v: mkDefault v);

-  # Basically a tinkered lib.generators.mkKeyValueDefault
-  # It either serializes a top-level definition "key: { values };"
-  # or an expression "key = { values };"
-  mkAttrsString =
-    top:
-    mapAttrsToList (
-      k: v:
-      let
-        sep = if (top && isAttrs v) then ":" else "=";
-      in
-      "${escape [ sep ] k}${sep}${mkValueString v};"
-    );
-
-  # This serializes a Nix expression to the libconfig format.
-  mkValueString =
-    v:
-    if types.bool.check v then
-      boolToString v
-    else if types.int.check v then
-      toString v
-    else if types.float.check v then
-      toString v
-    else if types.str.check v then
-      "\"${escape [ "\"" ] v}\""
-    else if builtins.isList v then
-      "[ ${concatMapStringsSep " , " mkValueString v} ]"
-    else if types.attrs.check v then
-      "{ ${concatStringsSep " " (mkAttrsString false v)} }"
-    else
-      throw ''
-        invalid expression used in option services.picom.settings:
-        ${v}
-      '';
-
-  toConf = attrs: concatStringsSep "\n" (mkAttrsString true cfg.settings);
-
-  configFile = pkgs.writeText "picom.conf" (toConf cfg.settings);
+  libconfig = pkgs.formats.libconfig { };
+  configFile = libconfig.generate "picom.conf" cfg.settings;

 in
 {
@@ -279,56 +244,22 @@ in
      '';
    };

-    settings =
-      with types;
-      let
-        scalar =
-          oneOf [
-            bool
-            int
-            float
-            str
-          ]
-          // {
-            description = "scalar types";
+    settings = mkOption {
+      type = libconfig.type;
+      default = { };
+      example = literalExpression ''
+        blur =
+          { method = "gaussian";
+            size = 10;
+            deviation = 5.0;
          };
-
-        libConfig =
-          oneOf [
-            scalar
-            (listOf libConfig)
-            (attrsOf libConfig)
-          ]
-          // {
-            description = "libconfig type";
-          };
-
-        topLevel = attrsOf libConfig // {
-          description = ''
-            libconfig configuration. The format consists of an attributes
-            set (called a group) of settings. Each setting can be a scalar type
-            (boolean, integer, floating point number or string), a list of
-            scalars or a group itself
-          '';
-        };
-
-      in
-      mkOption {
-        type = topLevel;
-        default = { };
-        example = literalExpression ''
-          blur =
-            { method = "gaussian";
-              size = 10;
-              deviation = 5.0;
-            };
-        '';
-        description = ''
-          Picom settings. Use this option to configure Picom settings not exposed
-          in a NixOS option or to bypass one.  For the available options see the
-          CONFIGURATION FILES section at {manpage}`picom(1)`.
-        '';
-      };
+      '';
+      description = ''
+        Picom settings. Use this option to configure Picom settings not exposed
+        in a NixOS option or to bypass one.  For the available options see the
+        CONFIGURATION FILES section at {manpage}`picom(1)`.
+      '';
+    };
  };

  config = mkIf cfg.enable {
@@ -43,7 +43,6 @@ let
 in
 {
  name = "squid";
-  meta.maintainers = with lib.maintainers; [ cobalt ];

  node.pkgsReadOnly = false;

@@ -8,8 +8,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
  mktplcRef = {
    name = "claude-code";
    publisher = "anthropic";
-    version = "2.1.15";
-    hash = "sha256-BtVxSVp80qlZhMrh872+0DQ7sTskEdP/5p5T7n9jeGU=";
+    version = "2.1.17";
+    hash = "sha256-m8uRQeTyM0iM7sCSwKABnQH2dxMo/CGqC97ybW6Oq7g=";
  };

  postInstall = ''
@@ -1,11 +1,11 @@
 {
-  "packageVersion": "147.0-1",
+  "packageVersion": "147.0.1-3",
  "source": {
-    "rev": "147.0-1",
-    "hash": "sha256-LZE4d1z4djtGSrnFsh1i9GXvFbK55RQMcqyID9ui0Ng="
+    "rev": "147.0.1-3",
+    "hash": "sha256-0BeC3zlL5cvnpTaPnKn26lT1XlvqBQuMc4rauNbeIIk="
  },
  "firefox": {
-    "version": "147.0",
-    "hash": "sha512-rJAXsaLaey8Tk5LDlMNjQf00duPU6ho8fl578QDcMNGFEy75JWvn5rD52/xpI0rFceofxtudhFQ7FXcvTshRYQ=="
+    "version": "147.0.1",
+    "hash": "sha512-8eG8SGRRJU8zsAD7RRP9lIpaboSEGYDudnxC0ybhhW9EqEN8j9v/LLNNF3/qKxkH/Nct0zvOw/Bt242IFRhTqA=="
  }
 }
@@ -121,7 +121,7 @@ let
 in
 runCommand "${unwrapped.name}-wrapped"
  {
-    inherit (unwrapped) meta;
+    inherit (unwrapped) meta pname version;
    paths = [ unwrapped ];
    nativeBuildInputs = [
      makeWrapper
@@ -7,16 +7,16 @@

 buildGoModule rec {
  pname = "docker-compose";
-  version = "5.0.1";
+  version = "5.0.2";

  src = fetchFromGitHub {
    owner = "docker";
    repo = "compose";
    tag = "v${version}";
-    hash = "sha256-lX891L9EPT8FQ4h69t345IuIrbagaKPnnYQogR2DjZ8=";
+    hash = "sha256-2lyjTNd4jf+wTtnFZaRT10ga0MHZondzb+0cM0ftCuY=";
  };

-  vendorHash = "sha256-zuzepwTiYJhiqrOxPxYX0b/ffwAVhUfj0RtfXzrhG8o=";
+  vendorHash = "sha256-A9RHSM6BmcaIVHWOou50T1+N/Vh8H1+KtSKeh/ZJ2JQ=";

  nativeInstallCheckInputs = [ versionCheckHook ];

@@ -9,29 +9,15 @@
  pkg-config,
  alsa-lib,
  xorg,
+  fontconfig,
  freetype,
-  libGLU,
  libjack2,
  juce,
-  webkitgtk_4_1,
-  libsysprof-capture,
-  pcre2,
-  util-linux,
-  libselinux,
-  libsepol,
-  libthai,
-  libxkbcommon,
-  libdatrie,
-  libepoxy,
  libsoup_3,
-  lerc,
-  sqlite,
  libdeflate,
  xz,
  libwebp,
  glib,
-  gtk3-x11,
-  curl,
  vcv-rack,
  jansson,
  glew,
@@ -56,7 +42,7 @@ let

  vcvRackSdk = srcOnly vcv-rack;
  pname = "airwin2rack";
-  version = "2.13.0-unstable-2025-12-07";
+  version = "2.13.0-unstable-2026-01-19";
 in
 stdenv.mkDerivation {
  inherit pname;
@@ -65,8 +51,8 @@ stdenv.mkDerivation {
  src = fetchFromGitHub {
    owner = "baconpaul";
    repo = "airwin2rack";
-    rev = "a797d6c7a453006c6a08db32d7bb373ecccb572b";
-    hash = "sha256-+xGLVp4eR7Xb2dSEyfyHfAcoZGRSzL49l/U89N2VX+w=";
+    rev = "ed3700c223be0fd5eddf6d57b66216fff8389c2c";
+    hash = "sha256-JHARxie6y3mD/ZLEMGmfK8/b5GBcN/7lHpm7kI5BpTs=";
    fetchSubmodules = true;
  };

@@ -105,27 +91,11 @@ stdenv.mkDerivation {
    xorg.libXinerama
    xorg.libXrandr
    xorg.libXrender
-    xorg.libXtst
-    xorg.libXdmcp
-    libGLU
+    fontconfig
    libjack2
    freetype
-    webkitgtk_4_1
    glib
-    gtk3-x11
-    curl
-    libsysprof-capture
-    pcre2
-    util-linux
-    libselinux
-    libsepol
-    libthai
-    libxkbcommon
-    libdatrie
-    libepoxy
    libsoup_3
-    lerc
-    sqlite
    libdeflate
    xz # liblzma
    libwebp
@@ -208,14 +178,12 @@ stdenv.mkDerivation {
      "-lXinerama"
      "-lXrandr"
      "-lXrender"
-      "-lXtst"
-      "-lXdmcp"
    ]
  );

  meta = {
    description = "JUCE Plugin Version of Airwindows Consolidated";
-    homepage = "https://airwindows.com/";
+    homepage = "https://github.com/baconpaul/airwin2rack";
    platforms = [ "x86_64-linux" ];
    license =
      with lib.licenses;
@@ -7,16 +7,16 @@

 buildNpmPackage rec {
  pname = "all-the-package-names";
-  version = "2.0.2328";
+  version = "2.0.2334";

  src = fetchFromGitHub {
    owner = "nice-registry";
    repo = "all-the-package-names";
    tag = "v${version}";
-    hash = "sha256-6+rb7eNPkifuIMsFs2YO0v27CY6RNWnHrzHYoVhtYCw=";
+    hash = "sha256-4/GKOjUSlj+upjGg0B642HRolCA46N+B2fM3fL1ip6Y=";
  };

-  npmDepsHash = "sha256-Q0vdon6Qbt5FOjKZJqB5ufiLcG18DPgL4EN9PSkoXDE=";
+  npmDepsHash = "sha256-fBoHOmMvmNSmldwME8i7Xo2C2koYcAo4aTsU+JIptcs=";

  passthru.updateScript = nix-update-script { };

@@ -11,12 +11,12 @@
 let
  bigpemu-unwrapped = stdenv.mkDerivation rec {
    pname = "BigPEmu";
-    version = "1.19";
+    version = "1.21";
    src = fetchurl {
      url = "https://www.richwhitehouse.com/jaguar/builds/BigPEmu_Linux64_v${
        builtins.replaceStrings [ "." ] [ "" ] version
      }.tar.gz";
-      hash = "sha256-kiZ9yzDRkDLzd5EtjIn32TL27Y2GG8ysG0zTM1JRyTU=";
+      hash = "sha256-DCHgGZMmi2R0PFhAgxNh/jzuT1ONjrofFgO04cgacrA=";
    };

    installPhase = ''
@@ -0,0 +1,9 @@
+{ fetchurl }:
+
+fetchurl (finalAttrs: {
+  name = "${finalAttrs.pname}-${finalAttrs.version}.jar";
+  pname = "bsh";
+  version = "2.0b5";
+  url = "http://www.beanshell.org/bsh-${finalAttrs.version}.jar";
+  hash = "sha256-YjIZlWOAc1SzvLWs6z3BNlAvAixrDvdDmHqD9m/uWlw=";
+})
@@ -7,13 +7,13 @@

 buildGoModule rec {
  pname = "buildkit";
-  version = "0.26.3";
+  version = "0.27.0";

  src = fetchFromGitHub {
    owner = "moby";
    repo = "buildkit";
    rev = "v${version}";
-    hash = "sha256-2Utxan85hHmyt+7anfbjFxBHhKzmZb7k9K025vA76Ys=";
+    hash = "sha256-v2/ODT7uwqirrWG3NrMEKYItjhm6f/IlPogCwJi23Rw=";
  };

  vendorHash = null;
@@ -7,16 +7,16 @@

 buildGo125Module (finalAttrs: {
  pname = "chezmoi";
-  version = "2.68.1";
+  version = "2.69.3";

  src = fetchFromGitHub {
    owner = "twpayne";
    repo = "chezmoi";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-VJGT6sQhrLHqTJOcLknHj/Wz04Pj2/CBUqI5R6xPdQ4=";
+    hash = "sha256-+VEFQgUYrsjzZR9BzTFwbBuMO2OJ8tOKqCt+5jFld5A=";
  };

-  vendorHash = "sha256-yNEx2/Vw5kjC428SObBCQ+OI7XwLUicbCvCpmVkdOtQ=";
+  vendorHash = "sha256-WNsAOcm+pfNIU96x49xHz1sWs0CNuosJL70QZ43fVb4=";

  nativeBuildInputs = [
    installShellFiles
@@ -1,12 +1,12 @@
 {
  "name": "@anthropic-ai/claude-code",
-  "version": "2.1.15",
+  "version": "2.1.17",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "@anthropic-ai/claude-code",
-      "version": "2.1.15",
+      "version": "2.1.17",
      "license": "SEE LICENSE IN README.md",
      "bin": {
        "claude": "cli.js"
@@ -15,14 +15,14 @@
 }:
 buildNpmPackage (finalAttrs: {
  pname = "claude-code";
-  version = "2.1.15";
+  version = "2.1.17";

  src = fetchzip {
    url = "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-${finalAttrs.version}.tgz";
-    hash = "sha256-3zhjeAwKj1fMLuriX1qpVA8zaCk1oekJ1UmeEdDx4Xg=";
+    hash = "sha256-cLJ8qKa8OhGpjdB7l1KAcG73EvH5T+OUww3flAKWihI=";
  };

-  npmDepsHash = "sha256-K5re0co3Tkz5peXHe/UUlsqAWq4YzSULdY9+xncfL5A=";
+  npmDepsHash = "sha256-aUqPXF5L78wZ34pNRvpEJi6l2wl15Og1yCEvVoeV0tE=";

  strictDeps = true;

@@ -6,18 +6,18 @@

 buildGoModule rec {
  pname = "cnspec";
-  version = "12.18.0";
+  version = "12.19.2";

  src = fetchFromGitHub {
    owner = "mondoohq";
    repo = "cnspec";
    tag = "v${version}";
-    hash = "sha256-U3nCL87fdlLkZLnRmJizGyQVGc7xCja2+hRLFGWkSUk=";
+    hash = "sha256-tP3JtuiQJeLmN5YbRgUiuzCvtE690n3O2jHCWbxcBLE=";
  };

  proxyVendor = true;

-  vendorHash = "sha256-HwlJq48wC/c8VeUQFSH/bBVZiSq2fH9E/JXfaHjSYIM=";
+  vendorHash = "sha256-AyhnFjUzbT54JhmUEX045EiTCLuMTqXiA/ofl7HpJQM=";

  subPackages = [ "apps/cnspec" ];

@@ -11,13 +11,13 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "code";
-  version = "0.6.45";
+  version = "0.6.49";

  src = fetchFromGitHub {
    owner = "just-every";
    repo = "code";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Ycl+r0fcopsWhT2QsRYPKWGRcXRyylgUalFBOgFF800=";
+    hash = "sha256-iklIQPs44SjJlQq+qkuyuCQLfv+xcmvmBDSIweFsSTs=";
  };

  sourceRoot = "${finalAttrs.src.name}/code-rs";
@@ -6,7 +6,7 @@
  installShellFiles,
  nixosTests,
  externalPlugins ? [ ],
-  vendorHash ? "sha256-bnNpJgy54wvTST1Jtfbd1ldLJrIzTW62TL7wyHeqz28=",
+  vendorHash ? "sha256-3cY4Nd2RX5OKnJaQ7StYDsyq27qE1VY4wGaY4wiDeFQ=",
 }:

 let
@@ -14,13 +14,13 @@ let
 in
 buildGoModule (finalAttrs: {
  pname = "coredns";
-  version = "1.13.2";
+  version = "1.14.1";

  src = fetchFromGitHub {
    owner = "coredns";
    repo = "coredns";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-9ggyFixdNy0t4UA8ZxU5oMUzA/8EB/k1jors4f8Q6YE=";
+    hash = "sha256-WcRX2BCWIQ8e0FYCIAzCdexz+Nl+/kKicQkhEw2AVMs=";
  };

  inherit vendorHash;
@@ -76,9 +76,9 @@ buildGoModule (finalAttrs: {
    }
    diff -u plugin.cfg.orig plugin.cfg || true
    for src in ${toString (attrsToSources externalPlugins)}; do go get $src; done
+    go mod vendor
    CC= GOOS= GOARCH= go generate
    go mod tidy
-    go mod vendor
  '';

  modInstallPhase = ''
@@ -102,10 +102,21 @@ buildGoModule (finalAttrs: {
    substituteInPlace test/readme_test.go \
      --replace-fail "TestReadme" "SkipReadme"

+    substituteInPlace test/metrics_test.go \
+      --replace-fail "TestMetricsRewriteRequestSize" "SkipMetricsRewriteRequestSize"
+
+    substituteInPlace test/quic_test.go \
+      --replace-fail "TestQUICReloadDoesNotPanic" "SkipQUICReloadDoesNotPanic"
+
    # this test fails if any external plugins were imported.
    # it's a lint rather than a test of functionality, so it's safe to disable.
    substituteInPlace test/presubmit_test.go \
      --replace-fail "TestImportOrdering" "SkipImportOrdering"
+
+    substituteInPlace plugin/pkg/parse/transport_test.go \
+      --replace-fail \
+        "TestTransport" \
+        "SkipTransport"
  ''
  + lib.optionalString stdenv.hostPlatform.isDarwin ''
    # loopback interface is lo0 on macos
@@ -12,13 +12,13 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "corepack";
-  version = "0.34.4";
+  version = "0.34.6";

  src = fetchFromGitHub {
    owner = "nodejs";
    repo = "corepack";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-AE2tDeDs1wzDdTrkG/ic2ydQC8G2wcaKD6s7ec7p+Ew=";
+    hash = "sha256-Wht1w6irfjj4cG4O1mWaP+uWvi794CsxoQPhk3uoKcw=";
  };

  patches = [
@@ -45,7 +45,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
      patches
      src
      ;
-    hash = "sha256-Yzm3PtdbR9Tx2bisdzTw0XGD6rAc/KUCzmhjGuXdft4=";
+    hash = "sha256-kngfdPGent5u231BFOzDLZFLp+EueDrm88iLbSoo5+g=";
  };

  postPatch = ''
@@ -1,35 +1,25 @@
 diff --git a/package.json b/package.json
-index fc8f2469ed5..7b3881e2a5d 100644
+index f2778bc2031..10496858378 100644
 --- a/package.json
 +++ b/package.json
-@@ -26,7 +26,6 @@
-     "@yarnpkg/eslint-config": "^3.0.0",
-     "@yarnpkg/fslib": "^3.0.0-rc.48",
+@@ -28,3 +28,2 @@
     "@zkochan/cmd-shim": "^6.0.0",
 -    "better-sqlite3": "^11.7.2",
     "clipanion": "patch:clipanion@npm%3A3.2.1#~/.yarn/patches/clipanion-npm-3.2.1-fc9187f56c.patch",
-     "debug": "^4.1.1",
-     "esbuild": "^0.25.0",
 diff --git a/tests/recordRequests.js b/tests/recordRequests.js
 index b78edad0e44..27667abbae4 100644
 --- a/tests/recordRequests.js
 +++ b/tests/recordRequests.js
-@@ -1,7 +1,7 @@
- "use strict";
- const path = require(`node:path`);
+@@ -3,3 +3,3 @@ const path = require(`node:path`);
 const crypto = require(`node:crypto`);
 -const SQLite3 = require(`better-sqlite3`);
 +const { DatabaseSync: SQLite3 } = require(`node:sqlite`);
 
- const db = new SQLite3(path.join(__dirname, `nocks.db`));
- process.once(`exit`, () => {
 diff --git a/yarn.lock b/yarn.lock
-index fc5bd2b1248..46777cbe979 100644
+index a2f193d1ee0..74f52dc46d9 100644
 --- a/yarn.lock
 +++ b/yarn.lock
-@@ -1145,44 +1145,6 @@ __metadata:
-   languageName: node
-   linkType: hard
+@@ -1147,40 +1147,2 @@ __metadata:
 
 -"base64-js@npm:^1.3.1":
 -  version: 1.5.1
@@ -70,11 +60,7 @@ index fc5bd2b1248..46777cbe979 100644
 -  linkType: hard
 -
 "brace-expansion@npm:^1.1.7":
-   version: 1.1.12
-   resolution: "brace-expansion@npm:1.1.12"
-@@ -1211,16 +1173,6 @@ __metadata:
-   languageName: node
-   linkType: hard
+@@ -1213,12 +1175,2 @@ __metadata:
 
 -"buffer@npm:^5.5.0":
 -  version: 5.7.1
@@ -87,11 +73,7 @@ index fc5bd2b1248..46777cbe979 100644
 -  linkType: hard
 -
 "cac@npm:^6.7.14":
-   version: 6.7.14
-   resolution: "cac@npm:6.7.14"
-@@ -1316,13 +1268,6 @@ __metadata:
-   languageName: node
-   linkType: hard
+@@ -1318,9 +1270,2 @@ __metadata:
 
 -"chownr@npm:^1.1.1":
 -  version: 1.1.4
@@ -101,19 +83,11 @@ index fc5bd2b1248..46777cbe979 100644
 -  linkType: hard
 -
 "chownr@npm:^3.0.0":
-   version: 3.0.0
-   resolution: "chownr@npm:3.0.0"
-@@ -1394,7 +1339,6 @@ __metadata:
-     "@yarnpkg/eslint-config": "npm:^3.0.0"
-     "@yarnpkg/fslib": "npm:^3.0.0-rc.48"
+@@ -1396,3 +1341,2 @@ __metadata:
     "@zkochan/cmd-shim": "npm:^6.0.0"
 -    better-sqlite3: "npm:^11.7.2"
     clipanion: "patch:clipanion@npm%3A3.2.1#~/.yarn/patches/clipanion-npm-3.2.1-fc9187f56c.patch"
-     debug: "npm:^4.1.1"
-     esbuild: "npm:^0.25.0"
-@@ -1468,15 +1412,6 @@ __metadata:
-   languageName: node
-   linkType: hard
+@@ -1470,11 +1414,2 @@ __metadata:
 
 -"decompress-response@npm:^6.0.0":
 -  version: 6.0.0
@@ -125,11 +99,7 @@ index fc5bd2b1248..46777cbe979 100644
 -  linkType: hard
 -
 "deep-eql@npm:^5.0.1":
-   version: 5.0.2
-   resolution: "deep-eql@npm:5.0.2"
-@@ -1484,13 +1419,6 @@ __metadata:
-   languageName: node
-   linkType: hard
+@@ -1486,9 +1421,2 @@ __metadata:
 
 -"deep-extend@npm:^0.6.0":
 -  version: 0.6.0
@@ -139,11 +109,7 @@ index fc5bd2b1248..46777cbe979 100644
 -  linkType: hard
 -
 "deep-is@npm:^0.1.3":
-   version: 0.1.4
-   resolution: "deep-is@npm:0.1.4"
-@@ -1520,13 +1448,6 @@ __metadata:
-   languageName: node
-   linkType: hard
+@@ -1522,9 +1450,2 @@ __metadata:
 
 -"detect-libc@npm:^2.0.0":
 -  version: 2.1.2
@@ -153,11 +119,7 @@ index fc5bd2b1248..46777cbe979 100644
 -  linkType: hard
 -
 "doctrine@npm:^2.1.0":
-   version: 2.1.0
-   resolution: "doctrine@npm:2.1.0"
-@@ -1577,15 +1498,6 @@ __metadata:
-   languageName: node
-   linkType: hard
+@@ -1579,11 +1500,2 @@ __metadata:
 
 -"end-of-stream@npm:^1.1.0, end-of-stream@npm:^1.4.1":
 -  version: 1.4.5
@@ -169,11 +131,7 @@ index fc5bd2b1248..46777cbe979 100644
 -  linkType: hard
 -
 "env-paths@npm:^2.2.0":
-   version: 2.2.1
-   resolution: "env-paths@npm:2.2.1"
-@@ -2004,13 +1916,6 @@ __metadata:
-   languageName: node
-   linkType: hard
+@@ -2006,9 +1918,2 @@ __metadata:
 
 -"expand-template@npm:^2.0.3":
 -  version: 2.0.3
@@ -183,11 +141,7 @@ index fc5bd2b1248..46777cbe979 100644
 -  linkType: hard
 -
 "expect-type@npm:^1.2.1":
-   version: 1.2.2
-   resolution: "expect-type@npm:1.2.2"
-@@ -2089,13 +1994,6 @@ __metadata:
-   languageName: node
-   linkType: hard
+@@ -2091,9 +1996,2 @@ __metadata:
 
 -"file-uri-to-path@npm:1.0.0":
 -  version: 1.0.0
@@ -197,11 +151,7 @@ index fc5bd2b1248..46777cbe979 100644
 -  linkType: hard
 -
 "fill-range@npm:^7.1.1":
-   version: 7.1.1
-   resolution: "fill-range@npm:7.1.1"
-@@ -2151,13 +2049,6 @@ __metadata:
-   languageName: node
-   linkType: hard
+@@ -2153,9 +2051,2 @@ __metadata:
 
 -"fs-constants@npm:^1.0.0":
 -  version: 1.0.0
@@ -211,11 +161,7 @@ index fc5bd2b1248..46777cbe979 100644
 -  linkType: hard
 -
 "fs-minipass@npm:^3.0.0":
-   version: 3.0.3
-   resolution: "fs-minipass@npm:3.0.3"
-@@ -2272,13 +2163,6 @@ __metadata:
-   languageName: node
-   linkType: hard
+@@ -2274,9 +2165,2 @@ __metadata:
 
 -"github-from-package@npm:0.0.0":
 -  version: 0.0.0
@@ -225,11 +171,7 @@ index fc5bd2b1248..46777cbe979 100644
 -  linkType: hard
 -
 "glob-parent@npm:^5.1.2":
-   version: 5.1.2
-   resolution: "glob-parent@npm:5.1.2"
-@@ -2451,13 +2335,6 @@ __metadata:
-   languageName: node
-   linkType: hard
+@@ -2453,9 +2337,2 @@ __metadata:
 
 -"ieee754@npm:^1.1.13":
 -  version: 1.2.1
@@ -239,11 +181,7 @@ index fc5bd2b1248..46777cbe979 100644
 -  linkType: hard
 -
 "ignore@npm:^5.2.0":
-   version: 5.3.2
-   resolution: "ignore@npm:5.3.2"
-@@ -2489,20 +2366,6 @@ __metadata:
-   languageName: node
-   linkType: hard
+@@ -2491,16 +2368,2 @@ __metadata:
 
 -"inherits@npm:^2.0.3, inherits@npm:^2.0.4":
 -  version: 2.0.4
@@ -260,11 +198,7 @@ index fc5bd2b1248..46777cbe979 100644
 -  linkType: hard
 -
 "internal-slot@npm:^1.1.0":
-   version: 1.1.0
-   resolution: "internal-slot@npm:1.1.0"
-@@ -2982,13 +2845,6 @@ __metadata:
-   languageName: node
-   linkType: hard
+@@ -2984,9 +2847,2 @@ __metadata:
 
 -"mimic-response@npm:^3.1.0":
 -  version: 3.1.0
@@ -273,12 +207,8 @@ index fc5bd2b1248..46777cbe979 100644
 -  languageName: node
 -  linkType: hard
 -
- "minimatch@npm:^10.0.3":
-   version: 10.1.1
-   resolution: "minimatch@npm:10.1.1"
-@@ -3016,13 +2872,6 @@ __metadata:
-   languageName: node
-   linkType: hard
+ "minimatch@npm:^10.1.1":
+@@ -3018,9 +2874,2 @@ __metadata:
 
 -"minimist@npm:^1.2.0, minimist@npm:^1.2.3":
 -  version: 1.2.8
@@ -288,11 +218,7 @@ index fc5bd2b1248..46777cbe979 100644
 -  linkType: hard
 -
 "minipass-collect@npm:^2.0.1":
-   version: 2.0.1
-   resolution: "minipass-collect@npm:2.0.1"
-@@ -3099,13 +2948,6 @@ __metadata:
-   languageName: node
-   linkType: hard
+@@ -3101,9 +2950,2 @@ __metadata:
 
 -"mkdirp-classic@npm:^0.5.2, mkdirp-classic@npm:^0.5.3":
 -  version: 0.5.3
@@ -302,11 +228,7 @@ index fc5bd2b1248..46777cbe979 100644
 -  linkType: hard
 -
 "ms@npm:^2.1.3":
-   version: 2.1.3
-   resolution: "ms@npm:2.1.3"
-@@ -3122,13 +2964,6 @@ __metadata:
-   languageName: node
-   linkType: hard
+@@ -3124,9 +2966,2 @@ __metadata:
 
 -"napi-build-utils@npm:^2.0.0":
 -  version: 2.0.0
@@ -316,11 +238,7 @@ index fc5bd2b1248..46777cbe979 100644
 -  linkType: hard
 -
 "natural-compare@npm:^1.4.0":
-   version: 1.4.0
-   resolution: "natural-compare@npm:1.4.0"
-@@ -3143,15 +2978,6 @@ __metadata:
-   languageName: node
-   linkType: hard
+@@ -3145,11 +2980,2 @@ __metadata:
 
 -"node-abi@npm:^3.3.0":
 -  version: 3.85.0
@@ -332,11 +250,7 @@ index fc5bd2b1248..46777cbe979 100644
 -  linkType: hard
 -
 "node-gyp@npm:latest":
-   version: 12.1.0
-   resolution: "node-gyp@npm:12.1.0"
-@@ -3254,15 +3080,6 @@ __metadata:
-   languageName: node
-   linkType: hard
+@@ -3256,11 +3082,2 @@ __metadata:
 
 -"once@npm:^1.3.1, once@npm:^1.4.0":
 -  version: 1.4.0
@@ -348,11 +262,7 @@ index fc5bd2b1248..46777cbe979 100644
 -  linkType: hard
 -
 "optionator@npm:^0.9.3":
-   version: 0.9.4
-   resolution: "optionator@npm:0.9.4"
-@@ -3413,28 +3230,6 @@ __metadata:
-   languageName: node
-   linkType: hard
+@@ -3415,24 +3232,2 @@ __metadata:
 
 -"prebuild-install@npm:^7.1.1":
 -  version: 7.1.3
@@ -377,11 +287,7 @@ index fc5bd2b1248..46777cbe979 100644
 -  linkType: hard
 -
 "prelude-ls@npm:^1.2.1":
-   version: 1.2.1
-   resolution: "prelude-ls@npm:1.2.1"
-@@ -3477,16 +3272,6 @@ __metadata:
-   languageName: node
-   linkType: hard
+@@ -3479,12 +3274,2 @@ __metadata:
 
 -"pump@npm:^3.0.0":
 -  version: 3.0.3
@@ -394,11 +300,7 @@ index fc5bd2b1248..46777cbe979 100644
 -  linkType: hard
 -
 "punycode@npm:^2.1.0":
-   version: 2.3.1
-   resolution: "punycode@npm:2.3.1"
-@@ -3501,20 +3286,6 @@ __metadata:
-   languageName: node
-   linkType: hard
+@@ -3503,16 +3288,2 @@ __metadata:
 
 -"rc@npm:^1.2.7":
 -  version: 1.2.8
@@ -415,11 +317,7 @@ index fc5bd2b1248..46777cbe979 100644
 -  linkType: hard
 -
 "react-is@npm:^16.13.1":
-   version: 16.13.1
-   resolution: "react-is@npm:16.13.1"
-@@ -3522,17 +3293,6 @@ __metadata:
-   languageName: node
-   linkType: hard
+@@ -3524,13 +3295,2 @@ __metadata:
 
 -"readable-stream@npm:^3.1.1, readable-stream@npm:^3.4.0":
 -  version: 3.6.2
@@ -433,11 +331,7 @@ index fc5bd2b1248..46777cbe979 100644
 -  linkType: hard
 -
 "reflect.getprototypeof@npm:^1.0.6, reflect.getprototypeof@npm:^1.0.9":
-   version: 1.0.10
-   resolution: "reflect.getprototypeof@npm:1.0.10"
-@@ -3720,13 +3480,6 @@ __metadata:
-   languageName: node
-   linkType: hard
+@@ -3722,9 +3482,2 @@ __metadata:
 
 -"safe-buffer@npm:^5.0.1, safe-buffer@npm:~5.2.0":
 -  version: 5.2.1
@@ -447,11 +341,7 @@ index fc5bd2b1248..46777cbe979 100644
 -  linkType: hard
 -
 "safe-push-apply@npm:^1.0.0":
-   version: 1.0.0
-   resolution: "safe-push-apply@npm:1.0.0"
-@@ -3888,24 +3641,6 @@ __metadata:
-   languageName: node
-   linkType: hard
+@@ -3890,20 +3643,2 @@ __metadata:
 
 -"simple-concat@npm:^1.0.0":
 -  version: 1.0.1
@@ -472,11 +362,7 @@ index fc5bd2b1248..46777cbe979 100644
 -  linkType: hard
 -
 "smart-buffer@npm:^4.2.0":
-   version: 4.2.0
-   resolution: "smart-buffer@npm:4.2.0"
-@@ -4074,15 +3809,6 @@ __metadata:
-   languageName: node
-   linkType: hard
+@@ -4076,11 +3811,2 @@ __metadata:
 
 -"string_decoder@npm:^1.1.1":
 -  version: 1.3.0
@@ -488,11 +374,7 @@ index fc5bd2b1248..46777cbe979 100644
 -  linkType: hard
 -
 "strip-ansi-cjs@npm:strip-ansi@^6.0.1, strip-ansi@npm:^6.0.0, strip-ansi@npm:^6.0.1":
-   version: 6.0.1
-   resolution: "strip-ansi@npm:6.0.1"
-@@ -4108,13 +3834,6 @@ __metadata:
-   languageName: node
-   linkType: hard
+@@ -4110,9 +3836,2 @@ __metadata:
 
 -"strip-json-comments@npm:~2.0.1":
 -  version: 2.0.1
@@ -502,11 +384,7 @@ index fc5bd2b1248..46777cbe979 100644
 -  linkType: hard
 -
 "strip-literal@npm:^3.0.0":
-   version: 3.1.0
-   resolution: "strip-literal@npm:3.1.0"
-@@ -4147,31 +3866,6 @@ __metadata:
-   languageName: node
-   linkType: hard
+@@ -4149,27 +3868,2 @@ __metadata:
 
 -"tar-fs@npm:^2.0.0":
 -  version: 2.1.4
@@ -533,12 +411,8 @@ index fc5bd2b1248..46777cbe979 100644
 -  languageName: node
 -  linkType: hard
 -
- "tar@npm:^7.4.0, tar@npm:^7.5.2":
-   version: 7.5.2
-   resolution: "tar@npm:7.5.2"
-@@ -4271,15 +3965,6 @@ __metadata:
-   languageName: node
-   linkType: hard
+ "tar@npm:^7.5.2, tar@npm:^7.5.4":
+@@ -4273,11 +3967,2 @@ __metadata:
 
 -"tunnel-agent@npm:^0.6.0":
 -  version: 0.6.0
@@ -550,11 +424,7 @@ index fc5bd2b1248..46777cbe979 100644
 -  linkType: hard
 -
 "typanion@npm:^3.8.0":
-   version: 3.14.0
-   resolution: "typanion@npm:3.14.0"
-@@ -4422,13 +4107,6 @@ __metadata:
-   languageName: node
-   linkType: hard
+@@ -4424,9 +4109,2 @@ __metadata:
 
 -"util-deprecate@npm:^1.0.1":
 -  version: 1.0.2
@@ -564,11 +434,7 @@ index fc5bd2b1248..46777cbe979 100644
 -  linkType: hard
 -
 "v8-compile-cache@npm:^2.3.0":
-   version: 2.4.0
-   resolution: "v8-compile-cache@npm:2.4.0"
-@@ -4697,13 +4375,6 @@ __metadata:
-   languageName: node
-   linkType: hard
+@@ -4699,9 +4377,2 @@ __metadata:
 
 -"wrappy@npm:1":
 -  version: 1.0.2
@@ -578,5 +444,3 @@ index fc5bd2b1248..46777cbe979 100644
 -  linkType: hard
 -
 "yallist@npm:^4.0.0":
-   version: 4.0.0
-   resolution: "yallist@npm:4.0.0"
@@ -24,13 +24,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "cubeb";
-  version = "0-unstable-2025-12-04";
+  version = "0-unstable-2026-01-23";

  src = fetchFromGitHub {
    owner = "mozilla";
    repo = "cubeb";
-    rev = "bed368eb0d901ec4b7921a8d704ca469b7fb4e19";
-    hash = "sha256-Y9qSqU8BsAcD+uBmAvKYzlZFJ7LZAdbtSt1Lc59iOG0=";
+    rev = "484857522c73318c06f18ba0a3e17525fa98c608";
+    hash = "sha256-Uq+UINIXc3uuqS7MwbTQ5pL72KmknM33/3CLH21Od/Y=";
  };

  outputs = [
@@ -23,13 +23,13 @@ let
 in
 buildDartApplication rec {
  pname = "dart-sass";
-  version = "1.97.2";
+  version = "1.97.3";

  src = fetchFromGitHub {
    owner = "sass";
    repo = "dart-sass";
    tag = version;
-    hash = "sha256-/T3kD2Xu9JESEbbeEhXwZRzN1uo/jgnfjmxjv6hZ/7o=";
+    hash = "sha256-9yhjqkWmtSqdLcmZWvHcz46xqN7yd27Quygg/I+WHag=";
  };

  pubspecLock = lib.importJSON ./pubspec.lock.json;
@@ -374,11 +374,11 @@
      "dependency": "direct main",
      "description": {
        "name": "meta",
-        "sha256": "23f08335362185a5ea2ad3a4e597f1375e78bce8a040df5c600c8d3552ef2394",
+        "sha256": "1741988757a65eb6b36abe716829688cf01910bbf91c34354ff7ec1c3de2b349",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "1.17.0"
+      "version": "1.18.0"
    },
    "mime": {
      "dependency": "transitive",
@@ -494,21 +494,21 @@
      "dependency": "direct main",
      "description": {
        "name": "protobuf",
-        "sha256": "2fcc8a202ca7ec17dab7c97d6b6d91cf03aa07fe6f65f8afbb6dfa52cc5bd902",
+        "sha256": "75ec242d22e950bdcc79ee38dd520ce4ee0bc491d7fadc4ea47694604d22bf06",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "5.1.0"
+      "version": "6.0.0"
    },
    "protoc_plugin": {
      "dependency": "direct dev",
      "description": {
        "name": "protoc_plugin",
-        "sha256": "d43d92eeec74bf1da8e790570c1ef7cf00cdc47566ad62e2455f1deaab03a22b",
+        "sha256": "d1ea363e9118f954d9d482c2f7281c5ff5149b059e68672d1faa564d49091f05",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "24.0.0"
+      "version": "25.0.0"
    },
    "pub_api_client": {
      "dependency": "direct dev",
@@ -6,13 +6,13 @@

 buildGoModule rec {
  pname = "amazon-ecs-agent";
-  version = "1.101.1";
+  version = "1.101.2";

  src = fetchFromGitHub {
    rev = "v${version}";
    owner = "aws";
    repo = "amazon-ecs-agent";
-    hash = "sha256-bD+gA9uPtHNDcg/QC+O9sQk7G4und5dViqS6f7pV0rU=";
+    hash = "sha256-J4gjkULtkU1LMHBNcm/QQ407uWMZ6jREP9MdSK0Js44=";
  };

  vendorHash = null;
@@ -0,0 +1,40 @@
+{
+  rustPlatform,
+  fetchFromGitHub,
+  lib,
+  pkg-config,
+  openssl,
+  fontconfig,
+}:
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "emissary";
+  version = "0.3.0";
+
+  src = fetchFromGitHub {
+    owner = "altonen";
+    repo = "emissary";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-A3Kkod2oQdprswoEY9Z6A5r2PsHMUEwqyDB8ycSEUqQ=";
+  };
+  cargoHash = "sha256-alruzRWeLGwfiX/kj7grC7+fgu6i0/T/EJwrF/0VDtw=";
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    openssl
+    fontconfig
+  ];
+
+  __darwinAllowLocalNetworking = true;
+
+  meta = {
+    changelog = "https://github.com/altonen/emissary/releases/tag/${finalAttrs.version}";
+    description = "Rust implementation of the I2P protocol stack";
+    homepage = "https://altonen.github.io/emissary/";
+    license = lib.licenses.mit; # https://github.com/altonen/emissary/blob/master/LICENSE (found an apache2 as well but thats for https://github.com/altonen/emissary/commit/c4a1c849ebfceba892adce53f512f1f099721de2)
+    mainProgram = "emissary";
+    maintainers = [ lib.maintainers.N4CH723HR3R ];
+  };
+})
@@ -12,16 +12,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "examine";
-  version = "1.0.0";
+  version = "2.0.0";

  src = fetchFromGitHub {
    owner = "cosmic-utils";
    repo = "examine";
    tag = finalAttrs.version;
-    hash = "sha256-9xYUJeAYqnDYZzjWM21HuSNDY+ZcUlTdj/g/MUH2A54=";
+    hash = "sha256-6U8reOzeqamX/MG/mWbso+kjuZQ6cK8j9XhuEtGZ1q4=";
  };

-  cargoHash = "sha256-BcBCPkahV6+xw+K+Vk4QjwX5QI1j4hNkD9YTyL24iRA=";
+  cargoHash = "sha256-V+ClzaG7LnkOl84j5mVGJPTLVfaVqxaSH7ufmjXdwyM=";

  nativeBuildInputs = [
    just
@@ -24,6 +24,11 @@ stdenv.mkDerivation rec {
    file
  ];

+  outputs = [
+    "out"
+    "man"
+  ];
+
  meta = {
    description = "exFAT filesystem userspace utilities";
    homepage = "https://github.com/exfatprogs/exfatprogs";
@@ -14,14 +14,14 @@
      },
      "stable": {
        "candidateHashFilenames": [
-          "factorio_linux_2.0.72.tar.xz"
+          "factorio_linux_2.0.73.tar.xz"
        ],
-        "name": "factorio_alpha_x64-2.0.72.tar.xz",
+        "name": "factorio_alpha_x64-2.0.73.tar.xz",
        "needsAuth": true,
-        "sha256": "87d9f593569cbdf2f7a160f6a573f4939cbf01206209fbcdbaebf0385c2c7331",
+        "sha256": "68280b39bd01d7647df0cfa0e291d82c8123ffc2d522c8565860f6d52a7673eb",
        "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/2.0.72/alpha/linux64",
-        "version": "2.0.72"
+        "url": "https://factorio.com/get-download/2.0.73/alpha/linux64",
+        "version": "2.0.73"
      }
    },
    "demo": {
@@ -38,14 +38,14 @@
      },
      "stable": {
        "candidateHashFilenames": [
-          "factorio-demo_linux_2.0.69.tar.xz"
+          "factorio-demo_linux_2.0.73.tar.xz"
        ],
-        "name": "factorio_demo_x64-2.0.69.tar.xz",
+        "name": "factorio_demo_x64-2.0.73.tar.xz",
        "needsAuth": false,
-        "sha256": "a670a4cd2fa59cb8dc6db10d969867266080f171e47ebed78880ccd5ed42356c",
+        "sha256": "1c04ab58fe5e47eb83ba984014e355e8edbc7f941f655bad0b1ff0c5e68bd0f2",
        "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/2.0.69/demo/linux64",
-        "version": "2.0.69"
+        "url": "https://factorio.com/get-download/2.0.73/demo/linux64",
+        "version": "2.0.73"
      }
    },
    "expansion": {
@@ -62,14 +62,14 @@
      },
      "stable": {
        "candidateHashFilenames": [
-          "factorio-space-age_linux_2.0.72.tar.xz"
+          "factorio-space-age_linux_2.0.73.tar.xz"
        ],
-        "name": "factorio_expansion_x64-2.0.72.tar.xz",
+        "name": "factorio_expansion_x64-2.0.73.tar.xz",
        "needsAuth": true,
-        "sha256": "9a667dd899ad4c8c410739a1da3a9318b46a5f34ee190e8b75ec22beac708249",
+        "sha256": "85d7223258f0001cd943004f30cb4d4f4c1a05d1f0fd3d19e05bc42c42b0d7a4",
        "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/2.0.72/expansion/linux64",
-        "version": "2.0.72"
+        "url": "https://factorio.com/get-download/2.0.73/expansion/linux64",
+        "version": "2.0.73"
      }
    },
    "headless": {
@@ -87,15 +87,15 @@
      },
      "stable": {
        "candidateHashFilenames": [
-          "factorio-headless_linux_2.0.72.tar.xz",
-          "factorio_headless_x64_2.0.72.tar.xz"
+          "factorio-headless_linux_2.0.73.tar.xz",
+          "factorio_headless_x64_2.0.73.tar.xz"
        ],
-        "name": "factorio_headless_x64-2.0.72.tar.xz",
+        "name": "factorio_headless_x64-2.0.73.tar.xz",
        "needsAuth": false,
-        "sha256": "cf3057340dbc9d82bd5161949ae3e7b8fad912ec7ca07b8a3151e0424a5568cd",
+        "sha256": "752025f81b5ec1229919edc869f9c8773db4bb548a90d370f85938236c857d9a",
        "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/2.0.72/headless/linux64",
-        "version": "2.0.72"
+        "url": "https://factorio.com/get-download/2.0.73/headless/linux64",
+        "version": "2.0.73"
      }
    }
  }
@@ -4,7 +4,7 @@
  lib,
 }:
 stdenv.mkDerivation (finalAttrs: {
-  name = "filterpath";
+  pname = "filterpath";
  version = "1.0.4";

  src = fetchFromGitHub {
@@ -0,0 +1,95 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  pkg-config,
+  alsa-lib,
+  fontconfig,
+  freetype,
+  libX11,
+  libXcomposite,
+  libXcursor,
+  libXdmcp,
+  libXext,
+  libXinerama,
+  libXrandr,
+  libXtst,
+  writableTmpDirAsHomeHook,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "filtr";
+  version = "1.1.0";
+
+  src = fetchFromGitHub {
+    owner = "tiagolr";
+    repo = "filtr";
+    tag = "v${finalAttrs.version}";
+    fetchSubmodules = true;
+    hash = "sha256-LRVwJ/Eh+XeNGnlbd2c56hWV8StHZGhxy0XLjGZ0toY=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    writableTmpDirAsHomeHook # fontconfig cache
+  ];
+
+  buildInputs = [
+    fontconfig
+    freetype
+  ]
+  ++ lib.optionals stdenv.isLinux [
+    alsa-lib
+    libX11
+    libXcomposite
+    libXcursor
+    libXdmcp
+    libXext
+    libXinerama
+    libXrandr
+    libXtst
+  ];
+
+  enableParallelBuilding = true;
+
+  cmakeFlags = [
+    (lib.cmakeBool "COPY_PLUGIN_AFTER_BUILD" false)
+    (lib.cmakeFeature "BUILD_STANDALONE" "OFF")
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    "-DCMAKE_OSX_ARCHITECTURES=${stdenv.hostPlatform.darwinArch}"
+  ];
+
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isLinux (toString [
+    # juce, compiled in this build as part of a Git submodule, uses `-flto` as
+    # a Link Time Optimization flag, and instructs the plugin compiled here to
+    # use this flag to. This breaks the build for us. Using _fat_ LTO allows
+    # successful linking while still providing LTO benefits. If our build of
+    # `juce` was used as a dependency, we could have patched that `-flto` line
+    # in our juce's source, but that is not possible because it is used as a
+    # Git Submodule.
+    "-ffat-lto-objects"
+  ]);
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/lib/vst3 $out/lib/lv2
+
+    cp -r "FILTR_artefacts/Release/LV2/FILT-R.lv2" $out/lib/lv2
+    cp -r "FILTR_artefacts/Release/VST3/FILT-R.vst3" $out/lib/vst3
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Envelope based filter modulator";
+    homepage = "https://github.com/tiagolr/filtr";
+    changelog = "https://github.com/tiagolr/filtr/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ magnetophon ];
+    platforms = lib.platforms.all;
+  };
+})
@@ -9,7 +9,7 @@
  makeDesktopItem,
 }:
 let
-  version = "0.9.21-beta";
+  version = "0.9.22-beta";
 in
 flutter338.buildFlutterApplication {
  inherit version;
@@ -18,7 +18,7 @@ flutter338.buildFlutterApplication {
    owner = "jmshrv";
    repo = "finamp";
    rev = version;
-    hash = "sha256-Mb9oC9SJnZovcqjOJzh0bpWxZhbkfQWzFG9moghCmrw=";
+    hash = "sha256-SPt1p9+uyvfSry8Ry2BJyLC7HyWZe43wfAPK9BVkcnc=";
  };
  pubspecLock = lib.importJSON ./pubspec.lock.json;

@@ -29,7 +29,7 @@ flutter338.buildFlutterApplication {
  buildInputs = [ mpv-unwrapped ];

  gitHashes = {
-    balanced_text = "sha256-lSDR5dDjZ4garRbBPI+wSxC5iScg8wVSD5kymmLbYbk=";
+    balanced_text = "sha256-U+gtC9AaUFp3gVkUzYMWAUSuUV7kYB8ZE2BsclnxwkA=";
    isar_generator = "sha256-EthUFM+YI3bnM0U0sECoNOCRXpo4qjP71VXYBuO/u+I=";
    isar_flutter_libs = "sha256-Z5IdfiaZ7348XwYSQb81z0YZEoIHWmsSZr6mYqqz4Oo=";
    media_kit_libs_windows_audio = "sha256-p3hRq79whLFJLNUgL9atXyTGvOIqCbTRKVk1ie0Euqs=";
@@ -16,13 +16,13 @@

 rustPlatform.buildRustPackage {
  pname = "forecast";
-  version = "0-unstable-2025-11-06";
+  version = "0-unstable-2026-01-22";

  src = fetchFromGitHub {
    owner = "cosmic-utils";
    repo = "forecast";
-    rev = "51814ecac320185911743986e8ab0211140fa456";
-    hash = "sha256-XOqV9Z4l4aTgm2Abec7IE2bk8oX3RsAA8UxZuo6S5l8=";
+    rev = "c9d170dbf397d977346a61492612f2f2c5acb6a7";
+    hash = "sha256-tOp79Qx7U5q1mFZy4Wh0BOu8+G42j5zGLQ79r+U4Qx8=";
  };

  cargoHash = "sha256-di7zjwI0/6NB2cAih3d7iqwSb+o/607jbgJN1MtbZX8=";
@@ -49,17 +49,17 @@ let
 in
 buildGoModule rec {
  pname = "forgejo-runner";
-  version = "12.5.3";
+  version = "12.6.0";

  src = fetchFromGitea {
    domain = "code.forgejo.org";
    owner = "forgejo";
    repo = "runner";
    rev = "v${version}";
-    hash = "sha256-qCk2GvPWKIQfEjYtx2Uc7GcVDehUu0/u4LP88FxoA9A=";
+    hash = "sha256-Otvv8NSGfze/WKN78nipVWkycqHh94ReHkVjYR8L0/E=";
  };

-  vendorHash = "sha256-pGLZmSW7MKEy/K+njgcPv5a+7Qtf8mqUI4OwKhfEZXY=";
+  vendorHash = "sha256-fvSiEIE4XSJ8Ot4Tcmt8chD11fHVsECD2/8xrgIKhJs=";

  nativeBuildInputs = [ makeWrapper ];

@@ -7,7 +7,7 @@ let
  version = "2.3.1";
 in
 buildGoModule {
-  name = "fork-cleaner";
+  pname = "fork-cleaner";
  inherit version;

  src = fetchFromGitHub {
@@ -6,22 +6,21 @@
  openssl,
  gzip,
  gitMinimal,
-  deno,
  nix-update-script,
  versionCheckHook,
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "fresh";
-  version = "0.1.86";
+  version = "0.1.87";

  src = fetchFromGitHub {
    owner = "sinelaw";
    repo = "fresh";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-o67oowSU1V9Cy2RvLEaZ5J3CPX2kD7qByDOc+8gpDq8=";
+    hash = "sha256-th4wlkGP9WNdRRhJy3pBC5dcqRbkUooM65FoftQHqBE=";
  };

-  cargoHash = "sha256-I78sdf/p5TZZufMZF8rETRb91veklwNHHByHF1WbLgk=";
+  cargoHash = "sha256-6b4iDXJme3uanEfz/e4jI1kqljaH8iOqS+7p1MPwhY4=";

  nativeBuildInputs = [
    pkg-config
@@ -37,10 +36,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
    openssl
  ];

-  # The v8 package will try to download a `librusty_v8.a` release at build time to our read-only filesystem
-  # To avoid this we pre-download the file and export it via RUSTY_V8_ARCHIVE
-  env.RUSTY_V8_ARCHIVE = deno.librusty_v8;
-
  preBuild = ''
    mkdir -p $out/share/fresh-editor/plugins/
  '';
@@ -0,0 +1,95 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  pkg-config,
+  alsa-lib,
+  fontconfig,
+  freetype,
+  libX11,
+  libXcomposite,
+  libXcursor,
+  libXdmcp,
+  libXext,
+  libXinerama,
+  libXrandr,
+  libXtst,
+  writableTmpDirAsHomeHook,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "gate12";
+  version = "1.3.3";
+
+  src = fetchFromGitHub {
+    owner = "tiagolr";
+    repo = "gate12";
+    tag = "v${finalAttrs.version}";
+    fetchSubmodules = true;
+    hash = "sha256-dyeIWD315+aKZRwtkRYaWNOS8bNDFboMVPHHe7l+IIY=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    writableTmpDirAsHomeHook # fontconfig cache
+  ];
+
+  buildInputs = [
+    fontconfig
+    freetype
+  ]
+  ++ lib.optionals stdenv.isLinux [
+    alsa-lib
+    libX11
+    libXcomposite
+    libXcursor
+    libXdmcp
+    libXext
+    libXinerama
+    libXrandr
+    libXtst
+  ];
+
+  enableParallelBuilding = true;
+
+  cmakeFlags = [
+    (lib.cmakeBool "COPY_PLUGIN_AFTER_BUILD" false)
+    (lib.cmakeFeature "BUILD_STANDALONE" "OFF")
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    "-DCMAKE_OSX_ARCHITECTURES=${stdenv.hostPlatform.darwinArch}"
+  ];
+
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isLinux (toString [
+    # juce, compiled in this build as part of a Git submodule, uses `-flto` as
+    # a Link Time Optimization flag, and instructs the plugin compiled here to
+    # use this flag to. This breaks the build for us. Using _fat_ LTO allows
+    # successful linking while still providing LTO benefits. If our build of
+    # `juce` was used as a dependency, we could have patched that `-flto` line
+    # in our juce's source, but that is not possible because it is used as a
+    # Git Submodule.
+    "-ffat-lto-objects"
+  ]);
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/lib/vst3 $out/lib/lv2
+
+    cp -r "GATE12_artefacts/Release/LV2/GATE-12.lv2" $out/lib/lv2
+    cp -r "GATE12_artefacts/Release/VST3/GATE-12.vst3" $out/lib/vst3
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Trance gate / volume shaper";
+    homepage = "https://github.com/tiagolr/gate12";
+    changelog = "https://github.com/tiagolr/gate12/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ magnetophon ];
+    platforms = lib.platforms.all;
+  };
+})
@@ -7,16 +7,16 @@

 buildGoModule rec {
  pname = "gcsfuse";
-  version = "3.5.6";
+  version = "3.6.0";

  src = fetchFromGitHub {
    owner = "googlecloudplatform";
    repo = "gcsfuse";
    rev = "v${version}";
-    hash = "sha256-lmvIj0Omq/gJoF/d2byzyYoBsaJXxlMLp3v3QULFUWU=";
+    hash = "sha256-E2xjJ0zy32fI34d/RcPNNwdQR4+V+jB45UehgJt2LpM=";
  };

-  vendorHash = "sha256-v+71MA4x+WUj6ROuIbuhP1S+f8UbKFjkS8XpFFM3qyk=";
+  vendorHash = "sha256-Ftkrb94g9w5o64EX4dKIw0jkinaaH5G8MFfbvCWS80k=";

  subPackages = [
    "."
@@ -8,7 +8,7 @@
 }:

 stdenv.mkDerivation (finalAttrs: {
-  name = "gdb-dashboard";
+  pname = "gdb-dashboard";
  version = "0.17.4";

  src = fetchFromGitHub {
@@ -7,7 +7,7 @@
 }:

 let
-  version = "18.6.3";
+  version = "18.6.4";
  package_version = "v${lib.versions.major version}";
  gitaly_package = "gitlab.com/gitlab-org/gitaly/${package_version}";

@@ -21,7 +21,7 @@ let
      owner = "gitlab-org";
      repo = "gitaly";
      rev = "v${version}";
-      hash = "sha256-zZho0cN/ePViLo4KtBNIHIHUbpbPI8jj88zY8cCacaU=";
+      hash = "sha256-SH1NXP5OcJF2MCCSCEjCT2GXjHxy1i9QtPZZCJ92rY8=";
    };

    vendorHash = "sha256-+5CTncYwtGlScFvVc3QaEScfuqMqvsjnGhggM1HMhNU=";
@@ -6,7 +6,7 @@

 buildGo124Module rec {
  pname = "gitlab-container-registry";
-  version = "4.33.0";
+  version = "4.34.0";
  rev = "v${version}-gitlab";

  # nixpkgs-update: no auto update
@@ -14,10 +14,10 @@ buildGo124Module rec {
    owner = "gitlab-org";
    repo = "container-registry";
    inherit rev;
-    hash = "sha256-6FcnzlQQSeM8l2jH5dG9g0rmnEvAg2FWB8ZpKYBBhE4=";
+    hash = "sha256-KGw9kVsAePhEQ+kINgcMhGw7pSioOnqNWFnjQKu/XmY=";
  };

-  vendorHash = "sha256-YfpqspLh+lV+MVZtn8iHQuE+DkZrcOq6hDt20SqkKfw=";
+  vendorHash = "sha256-g4h1m7b7dkdTcSfwTZH4Z5P9RBKme441Ucg4aPIqLSY=";

  checkFlags =
    let
@@ -6,14 +6,14 @@

 buildGoModule rec {
  pname = "gitlab-pages";
-  version = "18.6.3";
+  version = "18.6.4";

  # nixpkgs-update: no auto update
  src = fetchFromGitLab {
    owner = "gitlab-org";
    repo = "gitlab-pages";
    rev = "v${version}";
-    hash = "sha256-+MxG6cWZfNN1Kfx0eLEevWR8q23pnsmS73B4aquKrSc=";
+    hash = "sha256-FMXfF/NpwivtfZh+r7gcVXKFCeshxHBKRNFnbCxSz1U=";
  };

  vendorHash = "sha256-AL6V2LPzCGo/7IuY8msip35OScfocp3zO2ZzM8cZfnU=";
@@ -1,17 +1,17 @@
 {
-  "version": "18.6.3",
-  "repo_hash": "1ims6fy3zjnrappy1kkb02b8s2vldr18dz7ick176ljk042lqa5g",
+  "version": "18.6.4",
+  "repo_hash": "0jj2wfh37p92dj6fnwv098qaaph9sblqc09mjrz6f5142ijlmxj9",
  "yarn_hash": "19fhh3457mvls3g4swyzr2dh9q46z2zinjyw5v6sjjhfmrqs921d",
  "frontend_islands_yarn_hash": "0m64xhlybjlax33k5rmj9kxcj1vzqqygybyz1yzzx9pd87570k2h",
  "owner": "gitlab-org",
  "repo": "gitlab",
-  "rev": "v18.6.3-ee",
+  "rev": "v18.6.4-ee",
  "passthru": {
-    "GITALY_SERVER_VERSION": "18.6.3",
-    "GITLAB_KAS_VERSION": "18.6.3",
-    "GITLAB_PAGES_VERSION": "18.6.3",
+    "GITALY_SERVER_VERSION": "18.6.4",
+    "GITLAB_KAS_VERSION": "18.6.4",
+    "GITLAB_PAGES_VERSION": "18.6.4",
    "GITLAB_SHELL_VERSION": "14.45.3",
    "GITLAB_ELASTICSEARCH_INDEXER_VERSION": "5.10.1",
-    "GITLAB_WORKHORSE_VERSION": "18.6.3"
+    "GITLAB_WORKHORSE_VERSION": "18.6.4"
  }
 }
@@ -10,7 +10,7 @@ in
 buildGoModule rec {
  pname = "gitlab-workhorse";

-  version = "18.6.3";
+  version = "18.6.4";

  # nixpkgs-update: no auto update
  src = fetchFromGitLab {
@@ -12,13 +12,13 @@

 buildGoModule rec {
  pname = "go-ios";
-  version = "1.0.192";
+  version = "1.0.193";

  src = fetchFromGitHub {
    owner = "danielpaulus";
    repo = "go-ios";
    rev = "v${version}";
-    sha256 = "sha256-2M53jcAZXzUjV53YdENjLpK9o26Xr/gFniuS0T2NZ0E=";
+    sha256 = "sha256-l5ob2wnUOHgR8awPkCBKPCFBEQhrDflN+scUXm7290o=";
  };

  proxyVendor = true;
@@ -8,10 +8,10 @@
 }:
 stdenv.mkDerivation rec {
  pname = "halo";
-  version = "2.21.10";
+  version = "2.22.10";
  src = fetchurl {
    url = "https://github.com/halo-dev/halo/releases/download/v${version}/halo-${version}.jar";
-    hash = "sha256-AvQbD+1mlAV73WJ3uM/vIwwv/aiEkovUkxatH54chNA=";
+    hash = "sha256-3FrATqUGKSYfwYmDne8mbYGgPyG7+uyZtYVn4Bx+Pl0=";
  };

  nativeBuildInputs = [
@@ -0,0 +1,49 @@
+{
+  lib,
+  fetchFromGitHub,
+  buildGoModule,
+  installShellFiles,
+  stdenv,
+}:
+buildGoModule (finalAttrs: {
+  pname = "hyprdynamicmonitors";
+  version = "1.4.0";
+
+  src = fetchFromGitHub {
+    owner = "fiffeek";
+    repo = "hyprdynamicmonitors";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-msAgix63TsGgETwJajdr//F19+UUhGCbrjinNbgMPHo=";
+  };
+
+  vendorHash = "sha256-WBK1PhhxaRa0FUAfSxtKOiesw71wy0753FYIgSlo0bE=";
+
+  subPackages = [ "." ];
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/fiffeek/hyprdynamicmonitors/cmd.Version=${finalAttrs.version}"
+    "-X github.com/fiffeek/hyprdynamicmonitors/cmd.Commit=unknown"
+    "-X github.com/fiffeek/hyprdynamicmonitors/cmd.BuildDate=1970-01-01T00:00:00Z"
+  ];
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    installShellCompletion --cmd hyprdynamicmonitors \
+      --bash <($out/bin/hyprdynamicmonitors completion bash) \
+      --fish <($out/bin/hyprdynamicmonitors completion fish) \
+      --zsh <($out/bin/hyprdynamicmonitors completion zsh)
+  '';
+
+  meta = {
+    description = "Dynamic monitor configuration for Hyprland";
+    homepage = "https://github.com/fiffeek/hyprdynamicmonitors";
+    changelog = "https://github.com/fiffeek/hyprdynamicmonitors/releases/tag/v${finalAttrs.version}";
+    mainProgram = "hyprdynamicmonitors";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ nukdokplex ];
+  };
+})
@@ -25,13 +25,13 @@

 gcc15Stdenv.mkDerivation (finalAttrs: {
  pname = "hyprtoolkit";
-  version = "0.5.2";
+  version = "0.5.3";

  src = fetchFromGitHub {
    owner = "hyprwm";
    repo = "hyprtoolkit";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-AEnLjthDHNqD1uPBsVWdo7Pb+Xveh4DzwAPFM2stzNM=";
+    hash = "sha256-kf7Q31BXRZsiNuQjkvRbGkM1aGj9u8HwyOCIUtwKS0o=";
  };

  nativeBuildInputs = [
@@ -9,18 +9,18 @@ buildGoModule (finalAttrs: {
  # "chatgpt-cli" is taken by another package with the same upsteam name.
  # To keep "pname" and "package attribute name" identical, the owners name (kardolus) gets prefixed as identifier.
  pname = "kardolus-chatgpt-cli";
-  version = "1.10.2";
+  version = "1.10.9";

  src = fetchFromGitHub {
    owner = "kardolus";
    repo = "chatgpt-cli";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-Oc4r2cAE2y9WH0Tii8yIsLI7qR+Bhy4iqg1w0xe1EoY=";
+    hash = "sha256-FcDFRYzr+67SoBNQJSJSrLv1DS7Gm1Zjj4wllvY+I/I=";
  };

  vendorHash = null;
  # The tests of kardolus/chatgpt-cli require an OpenAI API Key to be present in the environment,
-  # (e.g. https://github.com/kardolus/chatgpt-cli/blob/v1.10.2/test/contract/contract_test.go#L35)
+  # (e.g. https://github.com/kardolus/chatgpt-cli/blob/v1.10.9/test/contract/contract_test.go#L35)
  # which will not be the case in the pipeline.
  # Therefore, tests must be skipped.
  doCheck = false;
@@ -16,16 +16,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "komac";
-  version = "2.14.0";
+  version = "2.15.0";

  src = fetchFromGitHub {
    owner = "russellbanks";
    repo = "Komac";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-BZzEt/aqAogWAWXEyVPY77hZp3VE1FUyg2uAjQuwxEE=";
+    hash = "sha256-yNUHtYH8gVLjznDaQMuvcTFvK3smuuSLg3uKVVgcUfs=";
  };

-  cargoHash = "sha256-KrMGZvgMtkfeF4dHUJzxtSqB0nea5ru4sLgnjAoQkYk=";
+  cargoHash = "sha256-W3CL8lObRHkbTwNKZjbN0ErpXGn5KADCGfFTJDw1vfo=";

  nativeBuildInputs = [
    pkg-config
@@ -76,6 +76,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    license = lib.licenses.gpl3Plus;
    maintainers = with lib.maintainers; [
      HeitorAugustoLN
+      dvdznf
    ];
    mainProgram = "komac";
  };
@@ -9,13 +9,13 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "korrect";
-  version = "0.3.4";
+  version = "0.3.5";

  src = fetchCrate {
    inherit (finalAttrs) pname version;
-    hash = "sha256-AOYwknKVtvw/gQ10gwHTNFQ2KvPuldRk8UxRcbkO6tE=";
+    hash = "sha256-2NzfMCMIIZM9/Z7MM8cenqtNCZsbivrjhBFlBQSgV8s=";
  };
-  cargoHash = "sha256-2od1FlV7yx9bAV1eSvTVeJfm7FsGtFGTzsBPh6Of+SU=";
+  cargoHash = "sha256-Xjbc/QpcL6U8z+YwK5UjLRkHThqTIccjQc86nlOMEqE=";

  # Tests create a local http server to check the download functionality
  __darwinAllowLocalNetworking = true;
@@ -9,16 +9,16 @@

 buildGoModule (finalAttrs: {
  pname = "lazyworktree";
-  version = "1.26.0";
+  version = "1.26.2";

  src = fetchFromGitHub {
    owner = "chmouel";
    repo = "lazyworktree";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-NEZ8bMI7FxiHuCmFy7sjDlZv4aoX431VRQHQXigaHOM=";
+    hash = "sha256-TLQEqHcDEiASe4MzSRVmbpHd0RsMz+nTY05LFH6nCC0=";
  };

-  vendorHash = "sha256-6Fxri3Ge2iaMluc5h5tL03yXeJcHT6kG3O2ewDG7Acs=";
+  vendorHash = "sha256-esZcuFWSztJvQUgK4rX8nu0UB8UCSuzoOkbUigH0Em0=";

  nativeBuildInputs = [ installShellFiles ];

@@ -21,13 +21,13 @@
 #     "${edids}/lib/firmware/edid/PG278Q_2014.bin";
 stdenv.mkDerivation rec {
  pname = "linuxhw-edid-fetcher";
-  version = "0-unstable-2025-01-06";
+  version = "0-unstable-2026-01-08";

  src = fetchFromGitHub {
    owner = "linuxhw";
    repo = "EDID";
-    rev = "cc83e52221a9a6d98632f00b54be64fd0bee0394";
-    hash = "sha256-qwTHQOEeFG7SOM2JG9mNpJEoPI8M7GHuwYPWWfU/ID4=";
+    rev = "9c0c1bffc9c0f1cb2044115149a5ecb1652803f8";
+    hash = "sha256-kdGUAbdlS736iB9oGo46HLK3ne3BV4LmUv/3fliyQBA=";
  };

  fetch = lib.getExe (writeShellApplication {
@@ -74,13 +74,13 @@ let
 in
 effectiveStdenv.mkDerivation (finalAttrs: {
  pname = "llama-cpp";
-  version = "7772";
+  version = "7815";

  src = fetchFromGitHub {
    owner = "ggml-org";
    repo = "llama.cpp";
    tag = "b${finalAttrs.version}";
-    hash = "sha256-qARA75QjtqBiRI4Hjr+dHs4Kr+Gk9n1DxRk401y+m68=";
+    hash = "sha256-KeLi/DsbSbTNK7EwDOugsJaYEAU3JLOYno59hgJgXhc=";
    leaveDotGit = true;
    postFetch = ''
      git -C "$out" rev-parse --short HEAD > $out/COMMIT
@@ -6,14 +6,14 @@
 }:

 stdenv.mkDerivation rec {
-  version = "20251207";
+  version = "20260122";
  pname = "m4ri";

  src = fetchFromGitHub {
    owner = "malb";
    repo = "m4ri";
    rev = version;
-    hash = "sha256-8cO4mPPZj/QUnSJmsqTFQ+THdrnZnCa6wFACKOk78UQ=";
+    hash = "sha256-/M/DVl2tRXIz5l3LFwY8Bvxnzjeoluy+zVgBVpPSdZM=";
  };

  doCheck = true;
@@ -54,7 +54,7 @@ stdenv.mkDerivation rec {
    install -Dm444 -t $out/share/licenses/masscan LICENSE

    wrapProgram $out/bin/masscan \
-      --prefix LD_LIBRARY_PATH : "${libpcap}/lib"
+      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ libpcap ]}"
  '';

  doInstallCheck = true;
@@ -6,16 +6,16 @@

 buildGoModule (finalAttrs: {
  pname = "mcphost";
-  version = "0.32.0";
+  version = "0.33.2";

  src = fetchFromGitHub {
    owner = "mark3labs";
    repo = "mcphost";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-zTSU7phEvoiw64V9QQI3IrHA9seStjOZadWaYwjlY9w=";
+    hash = "sha256-AQ+qKbvi3TywDrvc2xnw3gTwEi/Qxb3EJdT+1TWjVpM=";
  };

-  vendorHash = "sha256-NBxJim9Abm9dHADXita5NHQf4hbR/IUz4VyeYpHYN2I=";
+  vendorHash = "sha256-oQEMrd1Lp9oMUCoQc674AyftMx7Tb+1rUoEGhu/ck7U=";

  doCheck = false;

@@ -8,14 +8,14 @@

 rustPlatform.buildRustPackage rec {
  pname = "mdbook-pdf";
-  version = "0.1.11";
+  version = "0.1.13";

  src = fetchCrate {
    inherit pname version;
-    hash = "sha256-1VMVobiRCCUv8aWLxNbaDSvNs1Pt2jlsVPzfrieOudc=";
+    hash = "sha256-aADHRlIVWVc43DEfZx8ha/E4FaiAoKtjHccx+LAghtU=";
  };

-  cargoHash = "sha256-t3dlmeJNaHySIhJdJmSaeS0mXM7TgAUa/0hcG06lHvo=";
+  cargoHash = "sha256-aHpycw9WmaNsI0VAYxI89KnB7fC31FxH+8ONnMEGtTM=";

  nativeBuildInputs = [ pkg-config ];

@@ -5,7 +5,7 @@
 }:

 let
-  version = "4.0";
+  version = "4.2.1";
  relArtifact =
    name: hash:
    fetchurl {
@@ -18,9 +18,9 @@ stdenvNoCC.mkDerivation {
  inherit version;

  srcs = [
-    (relArtifact "Monocraft.ttc" "sha256-SBzl/X2PQOq1cY4dlqO89BDwCrP+/LYwZ9X24p2LDCs=")
-    (relArtifact "Monocraft-no-ligatures.ttc" "sha256-jFZ5Fr/cBwGVsdy7lPqLiLlKtzjF5OIWVkwZI6gR3W4=")
-    (relArtifact "Monocraft-nerd-fonts-patched.ttc" "sha256-lYAb8hgmv4VyrzeHr4LnfuSN9L+4fpDEMX/P++fq8Dc=")
+    (relArtifact "Monocraft.ttc" "sha256-DqGuoS8D1VKkafwBfxnqkntTv50h5gpBxcR2w/rzx/k=")
+    (relArtifact "Monocraft-no-ligatures.ttc" "sha256-k+55umK30KZT39kNXFGflJ461k7EgwRrQX8sxpQ4MdA=")
+    (relArtifact "Monocraft-nerd-fonts-patched.ttc" "sha256-Z/iP+efGVg9s9g+wYv01OnL2LcJlRGKVDGW2PtU9l1Q=")
  ];

  dontUnpack = true;
@@ -41,6 +41,9 @@ stdenvNoCC.mkDerivation {
    homepage = "https://github.com/IdreesInc/Monocraft";
    license = lib.licenses.ofl;
    platforms = lib.platforms.all;
-    maintainers = with lib.maintainers; [ zhaofengli ];
+    maintainers = with lib.maintainers; [
+      zhaofengli
+      coca
+    ];
  };
 }
@@ -10,13 +10,13 @@
 }:
 buildLua {
  pname = "videoclip";
-  version = "0-unstable-2025-11-20";
+  version = "0-unstable-2026-01-19";

  src = fetchFromGitHub {
    owner = "Ajatt-Tools";
    repo = "videoclip";
-    rev = "1c6531b649d3ee526cc7aa360e726aeedf43beb9";
-    hash = "sha256-lBXlvFrDC1Drz5JIiI6488UoFsXz18LAxqRpQmy1G0k=";
+    rev = "d2278972a5aac714b27c65f8acd92f0aee84cc77";
+    hash = "sha256-OZLPKwBoFPo/1lHnUeGIwdLjkE3eogYLMLaFd2NqSV4=";
  };

  patchPhase = ''
@@ -1,11 +1,11 @@
 {
  lib,
  fetchFromGitHub,
-  php83,
+  php,
  versionCheckHook,
 }:

-php83.buildComposerProject2 (finalAttrs: {
+php.buildComposerProject2 (finalAttrs: {
  pname = "n98-magerun2";
  version = "9.2.1";

@@ -33,20 +33,20 @@ let

  finalAttrs = {
    pname = "ncps";
-    version = "0.6.3";
+    version = "0.7.1";

    src = fetchFromGitHub {
      owner = "kalbasit";
      repo = "ncps";
      tag = "v${finalAttrs.version}";
-      hash = "sha256-7fLtVloiTNOmPoVpESpiSUl7i+5SMLXRHbGPk9SilBc=";
+      hash = "sha256-U+97wTN7CxJZ+jOWxZHkN2IiNblb5WTPpnN5v98D2o8=";
    };

    ldflags = [
      "-X github.com/kalbasit/ncps/cmd.Version=v${finalAttrs.version}"
    ];

-    vendorHash = "sha256-GuUhJ0Zf2Zjfgstxcy6/DAs0Eq7PU4aiiJMSNcNqsqI=";
+    vendorHash = "sha256-nnt4HIG4Fs7RhHjVb7mYJ39UgvFKc46Cu42cURMmr1s=";

    subPackages = [ "." ];

@@ -25,13 +25,13 @@ let
 in
 buildGoModule rec {
  pname = "nixos-facter";
-  version = "0.4.2";
+  version = "0.4.3";

  src = fetchFromGitHub {
    owner = "numtide";
    repo = "nixos-facter";
    tag = "v${version}";
-    hash = "sha256-oMOiZhppyUwyhLMtTofmeQINi8rHwsuQ1cD8Kr1/KwM=";
+    hash = "sha256-bbF16siqAqokXOHwLmBL61p/C7YiDGqBJhhJiF08pHk=";
  };

  vendorHash = "sha256-5duwAxAgbPZIbbgzZE2m574TF/0+jF/TvTKI4YBH6jM=";
@@ -7,16 +7,16 @@

 buildGoModule rec {
  pname = "oauth2-proxy";
-  version = "7.13.0";
+  version = "7.14.0";

  src = fetchFromGitHub {
    repo = "oauth2-proxy";
    owner = "oauth2-proxy";
-    sha256 = "sha256-o5wJVi8TJ7Qfzn2JzoMSLNhDWSRC7HcrfrQOlMlQr/0=";
+    sha256 = "sha256-lFyEfSOJwzuLgHnVGEUbLTWauboUYxBNF6iTV06vmOw=";
    rev = "v${version}";
  };

-  vendorHash = "sha256-35eJ+vw8V5/nSYsBjlkWvQg2xyvmT5PTDtzZA7b/KkU=";
+  vendorHash = "sha256-HMuQSpUUnMmhsawy2PD8QONLRkJ1vi2LhJnYQzj/TJ4=";

  # Taken from https://github.com/oauth2-proxy/oauth2-proxy/blob/master/Makefile
  ldflags = [ "-X github.com/oauth2-proxy/oauth2-proxy/v7/pkg/version.VERSION=v${version}" ];
@@ -317,28 +317,29 @@ effectiveStdenv.mkDerivation (finalAttrs: {
    (lib.cmakeBool "onnxruntime_USE_COMPOSABLE_KERNEL_CK_TILE" false)
  ];

-  env = {
-    NIX_LDFLAGS = "-z,noexecstack";
-  }
-  // lib.optionalAttrs rocmSupport {
-    MIOPEN_PATH = rocmPackages.miopen;
-    # HIP steps fail to find ROCm libs when not in HIPFLAGS, causing
-    # fatal error: 'rocrand/rocrand.h' file not found
-    HIPFLAGS = lib.concatMapStringsSep " " (pkg: "-I${lib.getInclude pkg}/include") [
-      rocmPackages.hipblas
-      rocmPackages.hipcub
-      rocmPackages.hiprand
-      rocmPackages.hipsparse
-      rocmPackages.rocblas
-      rocmPackages.rocprim
-      rocmPackages.rocrand
-      rocmPackages.rocthrust
-    ];
-  }
-  // lib.optionalAttrs effectiveStdenv.hostPlatform.isMusl {
-    NIX_CFLAGS_COMPILE = "-DFLATBUFFERS_LOCALE_INDEPENDENT=0";
-    GTEST_FILTER = "*:-ContribOpTest.StringNormalizer*";
-  };
+  env =
+    lib.optionalAttrs effectiveStdenv.hostPlatform.isLinux {
+      NIX_LDFLAGS = "-z,noexecstack";
+    }
+    // lib.optionalAttrs rocmSupport {
+      MIOPEN_PATH = rocmPackages.miopen;
+      # HIP steps fail to find ROCm libs when not in HIPFLAGS, causing
+      # fatal error: 'rocrand/rocrand.h' file not found
+      HIPFLAGS = lib.concatMapStringsSep " " (pkg: "-I${lib.getInclude pkg}/include") [
+        rocmPackages.hipblas
+        rocmPackages.hipcub
+        rocmPackages.hiprand
+        rocmPackages.hipsparse
+        rocmPackages.rocblas
+        rocmPackages.rocprim
+        rocmPackages.rocrand
+        rocmPackages.rocthrust
+      ];
+    }
+    // lib.optionalAttrs effectiveStdenv.hostPlatform.isMusl {
+      NIX_CFLAGS_COMPILE = "-DFLATBUFFERS_LOCALE_INDEPENDENT=0";
+      GTEST_FILTER = "*:-ContribOpTest.StringNormalizer*";
+    };

  doCheck =
    !(
@@ -169,7 +169,10 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    description = "AI coding agent built for the terminal";
    homepage = "https://github.com/anomalyco/opencode";
    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ delafthi ];
+    maintainers = with lib.maintainers; [
+      delafthi
+      graham33
+    ];
    sourceProvenance = with lib.sourceTypes; [ fromSource ];
    platforms = [
      "aarch64-linux"
@@ -2,6 +2,7 @@
  lib,
  stdenv,
  fetchFromGitHub,
+  yaml-cpp,

  # nativeBuildInputs
  bison,
@@ -13,12 +14,13 @@
  libsForQt5,
  pkg-config,
  swig,
+  versionCheckHook,

  # buildInputs
-  boost186, # 1.87.0 broken https://github.com/boostorg/asio/issues/442
-  cbc, # for clp
+  boost,
+  cbc,
  cimg,
-  clp, # for or-tools
+  clp,
  cudd,
  eigen,
  glpk,
@@ -28,7 +30,7 @@
  or-tools,
  pcre,
  python3,
-  re2, # for or-tools
+  re2,
  readline,
  spdlog,
  tcl,
@@ -39,16 +41,16 @@
  llvmPackages,
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "openroad";
-  version = "2.0-unstable-2025-03-01";
+  version = "26Q1";

  src = fetchFromGitHub {
    owner = "The-OpenROAD-Project";
    repo = "OpenROAD";
-    rev = "e794373d44ac5421f0633d8dda7e5c59e8fe79bf";
+    tag = finalAttrs.version;
    fetchSubmodules = true;
-    hash = "sha256-a/X4FHkbiqHeblse2ZkLT56gYP+LCrAIZVCdsWF59jM=";
+    hash = "sha256-DMyoqDse9W6ahOajEINzFpgLsSKam/I1mQkRSSKepI8=";
  };

  nativeBuildInputs = [
@@ -64,7 +66,7 @@ stdenv.mkDerivation rec {
  ];

  buildInputs = [
-    boost186
+    boost
    cbc
    cimg
    clp
@@ -88,63 +90,70 @@ stdenv.mkDerivation rec {
    tclPackages.tclreadline
    yosys
    zlib
+    yaml-cpp
  ]
  ++ lib.optionals stdenv.hostPlatform.isLinux [ xorg.libX11 ]
  ++ lib.optionals stdenv.hostPlatform.isDarwin [ llvmPackages.openmp ];

  postPatch = ''
-    patchShebangs --build etc/find_messages.py
-    # Disable two tests that are failing curently.
-    sed 's/^.*partition_gcd/# \0/g' -i src/par/test/CMakeLists.txt
-    # fix build with gcc15
+    patchShebangs etc/
+
+    # C++20 Fixes
    sed -e '39i #include <cstdint>' -i src/gpl/src/placerBase.h
    sed -e '37i #include <cstdint>' -i src/gpl/src/routeBase.h
+  ''
+  # Disable failing PSM tests on aarch64
+  + lib.optionalString stdenv.hostPlatform.isAarch64 ''
+    if [ -f src/psm/test/CMakeLists.txt ]; then
+      echo "Patching PSM tests for aarch64..."
+      sed -i -E 's/^[[:space:]]+(gcd_all_vss|gcd_em_test_vdd|insert_decap1|insert_decap_with_padding1)/    # \1/' src/psm/test/CMakeLists.txt
+    fi
  '';

  cmakeFlags = [
-    (lib.cmakeBool "ENABLE_TESTS" true)
+    # Disable tests on Darwin to avoid discovery timeouts during build
+    (lib.cmakeBool "ENABLE_TESTS" finalAttrs.finalPackage.doCheck)
    (lib.cmakeBool "USE_SYSTEM_BOOST" true)
    (lib.cmakeBool "USE_SYSTEM_ABC" false)
-    (lib.cmakeBool "ABC_SKIP_TESTS" true) # it attempts to download gtest
+    (lib.cmakeBool "ABC_SKIP_TESTS" true)
    (lib.cmakeBool "USE_SYSTEM_OPENSTA" false)
-    (lib.cmakeFeature "OPENROAD_VERSION" "${version}_${src.rev}")
+    (lib.cmakeFeature "OPENROAD_VERSION" finalAttrs.version)
    (lib.cmakeBool "CMAKE_RULE_MESSAGES" false)
    (lib.cmakeFeature "TCL_HEADER" "${tcl}/include/tcl.h")
    (lib.cmakeFeature "TCL_LIBRARY" "${tcl}/lib/libtcl${stdenv.hostPlatform.extensions.sharedLibrary}")
+    (lib.cmakeFeature "BOOST_ROOT" "${boost}")
  ]
  ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    (lib.cmakeFeature "CMAKE_CXX_FLAGS" "-DBOOST_STACKTRACE_GNU_SOURCE_NOT_REQUIRED")
+    (lib.cmakeFeature "CMAKE_CXX_FLAGS" "-DBOOST_STACKTRACE_GNU_SOURCE_NOT_REQUIRED -Wno-error=deprecated-declarations")
  ];

-  # Resynthesis needs access to the Yosys binaries.
  qtWrapperArgs = [ "--prefix PATH : ${lib.makeBinPath [ yosys ]}" ];

-  # Upstream uses vendored package versions for some dependencies, so regression testing is prudent
-  # to see if there are any breaking changes in unstable that should be vendored as well.
-  doCheck = !stdenv.hostPlatform.isDarwin; # it seems to hang on darwin
+  # Some tests are unstable on Darwin
+  doCheck = !stdenv.hostPlatform.isDarwin;
+
  checkPhase = ''
+    runHook preCheck
    make test
-    ../test/regression
+    runHook postCheck
  '';

+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+
  doInstallCheck = true;
-  installCheckPhase = ''
-    runHook preInstallCheck
-
-    $out/bin/openroad -version
-    $out/bin/sta -version
-
-    runHook postInstallCheck
-  '';
+  versionCheckProgramArg = "-version";

  meta = {
    description = "OpenROAD's unified application implementing an RTL-to-GDS flow";
    homepage = "https://theopenroadproject.org";
    license = lib.licenses.bsd3;
+    mainProgram = "openroad";
    maintainers = with lib.maintainers; [
      trepetti
      hzeller
    ];
    platforms = lib.platforms.linux ++ lib.platforms.darwin;
  };
-}
+})
@@ -4,27 +4,31 @@
  go,
  fetchFromGitHub,
  makeWrapper,
+  pkg-config,
+  gpgme,
 }:

 buildGoModule rec {
  pname = "operator-sdk";
-  version = "1.39.2";
+  version = "1.42.0";

  src = fetchFromGitHub {
    owner = "operator-framework";
    repo = "operator-sdk";
    tag = "v${version}";
-    hash = "sha256-2Kv6mDC1MndUgttRYODnI8DZ84RVz8jn3+RpXmOemq0=";
+    hash = "sha256-iXLAFFO7PCxA8QuQ9pMmQ/GBbVM5wBy9cVzSQRHHPrg=";
  };

-  vendorHash = "sha256-W+q9K2003dJfcjyoN4YMoY98cwBy+nfZCi3tHNLbm1w=";
+  vendorHash = "sha256-F2ZYEEFG8hqCcy16DUmP9ilG6e20nXBiJnB6U+wezAo=";

  nativeBuildInputs = [
    makeWrapper
+    pkg-config
  ];

  buildInputs = [
    go
+    gpgme
  ];

  doCheck = false;
@@ -26,16 +26,9 @@ stdenv.mkDerivation rec {
    owner = "owncloud";
    repo = "client";
    tag = "v${version}";
-    hash = "sha256-11ZqCqFKJexMRH73IEBRuNx5Dxf4aMHlShwull0z4hI=";
+    hash = "sha256-RNa3i+Qf/cPE+TvYFt5FjbQcHgep3z/XBzno/EyJ3EQ==";
  };

-  patches = [
-    (fetchpatch {
-      url = "https://github.com/owncloud/client/commit/ef0791a727051191f0c0ff7bca78b10d5dd97e1e.patch";
-      hash = "sha256-r/TlRjmnZdPWXZ8Kn/9GgcisWiF/qOO5X8m2ReooKWo=";
-    })
-  ];
-
  nativeBuildInputs = [
    pkg-config
    cmake
@@ -0,0 +1,14 @@
+diff --git a/src/ssg/ssgLoadFLT.cxx b/src/ssg/ssgLoadFLT.cxx
+--- a/src/ssg/ssgLoadFLT.cxx
+++ b/src/ssg/ssgLoadFLT.cxx
+@@ -112,6 +112,10 @@
+ # include <sys/stat.h>
+ # include <sys/mman.h>
+ #endif
+#if defined(__APPLE__)
+typedef unsigned int uint;
+typedef unsigned short ushort;
+#endif
+ #ifdef UL_MSVC
+ # include <io.h>
+ #endif
@@ -37,9 +37,15 @@ stdenv.mkDerivation rec {
      url = "https://sources.debian.org/data/main/p/plib/1.8.5-13/debian/patches/08_CVE-2021-38714.patch";
      sha256 = "sha256-3f1wZn0QqK/hPWCg1KEzbB95IGoxBjLZoCOFlW98t5w=";
    })
+    ./darwin-ssgloadflt-uint.patch
  ];

-  propagatedBuildInputs = [
+  configureFlags = lib.optionals stdenv.hostPlatform.isDarwin [
+    "--disable-sl"
+    "--disable-pw"
+  ];
+
+  propagatedBuildInputs = lib.optionals stdenv.hostPlatform.isLinux [
    libGLU
    libGL
    libglut
@@ -70,6 +76,6 @@ stdenv.mkDerivation rec {
    license = lib.licenses.lgpl2Plus;

    homepage = "https://plib.sourceforge.net/";
-    platforms = lib.platforms.linux;
+    platforms = lib.platforms.unix;
  };
 }
@@ -4,22 +4,25 @@
  rustPlatform,
  pkg-config,
  openssl,
+  libxcrypt,
+  libisoburn,
  versionCheckHook,
 }:

 rustPlatform.buildRustPackage {
  pname = "proxmox-auto-install-assistant";
-  version = "9.0.7";
+  version = "9.1.6";

  src = fetchgit {
    url = "git://git.proxmox.com/git/pve-installer.git";
-    rev = "cfcaceacb797bfdbff8c7e8fed76e56642390b20";
-    hash = "sha256-tXwNuT25GzQhdDtYiiQKPu6EPZQffUOZhBqkLZK/+DY=";
+    rev = "eab66c74a79663008ab12990bd27195a8d5c4204";
+    hash = "sha256-nMyi3GfdQv/L05hpReSIoFrvmpbs4+5t/lUXXgP0bUs=";
  };

  postPatch = ''
    rm -v .cargo/config.toml
    cp -v ${./Cargo.lock} Cargo.lock
+    chmod u+w Cargo.lock
    # pre-generated using `make locale-info.json`
    # depends on non-packaged perl modules and debian-specific files
    cp -v ${./locale-info.json} locale-info.json
@@ -27,23 +30,32 @@ rustPlatform.buildRustPackage {

  buildAndTestSubdir = "proxmox-auto-install-assistant";

-  cargoLock.lockFile = ./Cargo.lock;
+  cargoLock = {
+    lockFile = ./Cargo.lock;
+    outputHashes = {
+      "proxmox-io-1.2.1" = "sha256-1F5PJKJ/Ys1EfFPqpP08pRiiTKOAt9IHZ/fbeYxH7SQ=";
+      "proxmox-lang-1.5.0" = "sha256-1F5PJKJ/Ys1EfFPqpP08pRiiTKOAt9IHZ/fbeYxH7SQ=";
+      "proxmox-sys-1.0.0" = "sha256-1F5PJKJ/Ys1EfFPqpP08pRiiTKOAt9IHZ/fbeYxH7SQ=";
+    };
+  };

  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ openssl.dev ];
+  buildInputs = [
+    libxcrypt
+    openssl.dev
+  ];
+
+  propagatedBuildInputs = [ libisoburn ];

  postFixup = ''
    # these libraries are not actually necessary, only linked in by cargo
    # through crate dependencies (unfortunately)
    patchelf \
      --remove-needed libcrypto.so.3 \
-      --remove-needed libssl.so.3 \
      $out/bin/proxmox-auto-install-assistant
    patchelf --shrink-rpath $out/bin/proxmox-auto-install-assistant
  '';

-  disallowedReferences = [ openssl.out ];
-
  doInstallCheck = true;
  nativeInstallCheckInputs = [ versionCheckHook ];

@@ -12,13 +12,13 @@

 stdenv.mkDerivation rec {
  pname = "pspg";
-  version = "5.8.14";
+  version = "5.8.15";

  src = fetchFromGitHub {
    owner = "okbob";
    repo = "pspg";
    rev = version;
-    sha256 = "sha256-DZsMZZO5NMutlzLT+wwtPNdnzAnka32ZMqgMvEuw9ag=";
+    sha256 = "sha256-wYGU9vaAgY87RTbOXOGBVV37ZN/+NceXWgoEaY95md4=";
  };

  nativeBuildInputs = [
@@ -44,6 +44,12 @@ python3Packages.buildPythonApplication rec {

  postInstall = ''
    installManPage *.1
+
+    install -Dm644 $src/devel/pyradio.desktop \
+      "$out/share/applications/pyradio.desktop"
+
+    install -Dm644 "$src/pyradio/icons/pyradio.png" \
+      "$out/share/icons/hicolor/512x512/apps/pyradio.png"
  '';

  meta = {
@@ -54,6 +60,7 @@ python3Packages.buildPythonApplication rec {
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [
      contrun
+      magicquark
      yayayayaka
    ];
  };
@@ -20,14 +20,14 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "qdelay";
-  version = "1.0.6";
+  version = "1.0.7";

  src = fetchFromGitHub {
    owner = "tiagolr";
    repo = "qdelay";
    tag = "v${finalAttrs.version}";
    fetchSubmodules = true;
-    hash = "sha256-2fu2eF1SjM1qSwKx/oEAx6EWNbNZ8VeJrtnmvxm/0yU=";
+    hash = "sha256-Pnta6KyvOPKsKp9wfofc6BnBGJdV7Of6tFeTgaCTu7c=";
  };

  nativeBuildInputs = [
@@ -55,7 +55,8 @@ stdenv.mkDerivation (finalAttrs: {
  enableParallelBuilding = true;

  cmakeFlags = [
-    "-DCOPY_PLUGIN_AFTER_BUILD=FALSE"
+    (lib.cmakeBool "COPY_PLUGIN_AFTER_BUILD" false)
+    (lib.cmakeFeature "BUILD_STANDALONE" "OFF")
  ]
  ++ lib.optionals stdenv.hostPlatform.isDarwin [
    "-DCMAKE_OSX_ARCHITECTURES=${stdenv.hostPlatform.darwinArch}"
@@ -75,30 +76,9 @@ stdenv.mkDerivation (finalAttrs: {
  installPhase = ''
    runHook preInstall

-    mkdir -p $out/bin $out/lib/vst3
+    mkdir -p $out/lib/vst3 $out/lib/lv2

-  ''
-  + (
-    if stdenv.hostPlatform.isDarwin then
-      ''
-        mkdir -p $out/Applications
-        cp -R QDelay_artefacts/Release/Standalone/QDelay.app \
-          $out/Applications/QDelay.app
-        ln -s \
-          $out/Applications/QDelay.app/Contents/MacOS/QDelay \
-          $out/bin/QDelay
-      ''
-    else
-      ''
-        install -Dm755 \
-          QDelay_artefacts/Release/Standalone/QDelay \
-          $out/bin/QDelay
-
-        mkdir -p $out/bin $out/lib/lv2
-        cp -r "QDelay_artefacts/Release/LV2/QDelay.lv2" $out/lib/lv2
-      ''
-  )
-  + ''
+    cp -r "QDelay_artefacts/Release/LV2/QDelay.lv2" $out/lib/lv2
    cp -r "QDelay_artefacts/Release/VST3/QDelay.vst3" $out/lib/vst3

    runHook postInstall
@@ -110,7 +90,6 @@ stdenv.mkDerivation (finalAttrs: {
    changelog = "https://github.com/tiagolr/qdelay/releases/tag/v${finalAttrs.version}";
    license = lib.licenses.gpl3Plus;
    maintainers = with lib.maintainers; [ magnetophon ];
-    mainProgram = "QDelay";
    platforms = lib.platforms.all;
  };
 })
@@ -0,0 +1,95 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  pkg-config,
+  alsa-lib,
+  fontconfig,
+  freetype,
+  libX11,
+  libXcomposite,
+  libXcursor,
+  libXdmcp,
+  libXext,
+  libXinerama,
+  libXrandr,
+  libXtst,
+  writableTmpDirAsHomeHook,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "reevr";
+  version = "1.4.0";
+
+  src = fetchFromGitHub {
+    owner = "tiagolr";
+    repo = "reevr";
+    tag = "v${finalAttrs.version}";
+    fetchSubmodules = true;
+    hash = "sha256-uOaImmc8MXhH6P3IN53LGntsWAbsVnqkz8TUk67aYcU=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    writableTmpDirAsHomeHook # fontconfig cache
+  ];
+
+  buildInputs = [
+    fontconfig
+    freetype
+  ]
+  ++ lib.optionals stdenv.isLinux [
+    alsa-lib
+    libX11
+    libXcomposite
+    libXcursor
+    libXdmcp
+    libXext
+    libXinerama
+    libXrandr
+    libXtst
+  ];
+
+  enableParallelBuilding = true;
+
+  cmakeFlags = [
+    (lib.cmakeBool "COPY_PLUGIN_AFTER_BUILD" false)
+    (lib.cmakeFeature "BUILD_STANDALONE" "OFF")
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    (lib.cmakeFeature "CMAKE_OSX_ARCHITECTURES" "${stdenv.hostPlatform.darwinArch}")
+  ];
+
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isLinux (toString [
+    # juce, compiled in this build as part of a Git submodule, uses `-flto` as
+    # a Link Time Optimization flag, and instructs the plugin compiled here to
+    # use this flag to. This breaks the build for us. Using _fat_ LTO allows
+    # successful linking while still providing LTO benefits. If our build of
+    # `juce` was used as a dependency, we could have patched that `-flto` line
+    # in our juce's source, but that is not possible because it is used as a
+    # Git Submodule.
+    "-ffat-lto-objects"
+  ]);
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/lib/vst3 $out/lib/lv2
+
+    cp -r "REEVR_artefacts/Release/LV2/REEV-R.lv2" $out/lib/lv2
+    cp -r "REEVR_artefacts/Release/VST3/REEV-R.vst3" $out/lib/vst3
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Convolution reverb with pre and post modulation";
+    homepage = "https://github.com/tiagolr/reevr";
+    changelog = "https://github.com/tiagolr/reevr/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ magnetophon ];
+    platforms = lib.platforms.all;
+  };
+})
@@ -8,13 +8,13 @@

 buildGoModule (finalAttrs: {
  pname = "resterm";
-  version = "0.18.5";
+  version = "0.19.1";

  src = fetchFromGitHub {
    owner = "unkn0wn-root";
    repo = "resterm";
    tag = "v${finalAttrs.version}";
-    sha256 = "sha256-YAicTu83IKw2reZefdCjNfhRwiOCtKieyq0vPJ510lQ=";
+    sha256 = "sha256-vpFwiVLF3ekPgjxTEl4UlY/oGK03prHRtt15k5i+M6I=";
  };

  vendorHash = "sha256-E/Y4kW5xy7YamUP5bxFmDCAK6RqiqGN7DpEPG1MaCHc=";
@@ -11,14 +11,14 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "ruqola";
-  version = "2.5.1";
+  version = "2.5.3";

  src = fetchFromGitLab {
    domain = "invent.kde.org";
    owner = "network";
    repo = "ruqola";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Oeea+IX2H9UvLZnq6X4AjwH5O4VPCg/RHRwohidPalo=";
+    hash = "sha256-OX4eATqcV7k+TIHQINujT5opItDwffIxC577M9q5ef8=";
  };

  nativeBuildInputs = [
@@ -5,23 +5,22 @@
  nix-update-script,
  installShellFiles,
  rustPlatform,
+  sqlite,
  pkg-config,
 }:

-rustPlatform.buildRustPackage rec {
-  pname = "sequoia-sqop";
-  version = "0.35.0";
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "sequoia-sop";
+  version = "0.37.3";

  src = fetchFromGitLab {
    owner = "sequoia-pgp";
-    # From some reason the repository is not sequoia-sqop - like the command
-    # generated etc
    repo = "sequoia-sop";
-    rev = "v${version}";
-    hash = "sha256-JgLozj9LZwk6TRHj2d4kiq8j3aILBUWaE9ldzvlTBNs=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-7fyItwtzNia97fbLJ1YkpkS7KmCo3I81uksh3lNvxwU=";
  };

-  cargoHash = "sha256-Cg07SlNmG6ELZmoQfkr6ADrGJirbFm0D1Iko1WVNfl0=";
+  cargoHash = "sha256-NrJYFf2bK/QwfFpIrPD8Zc9N/tKVbN2I48jA2B0rNWk=";

  nativeBuildInputs = [
    pkg-config
@@ -31,17 +30,20 @@ rustPlatform.buildRustPackage rec {

  buildInputs = [
    nettle
+    sqlite
  ];
+
  buildFeatures = [ "cli" ];

+  env.ASSET_OUT_DIR = "/tmp/";
+
  # Install manual pages
  postInstall = ''
-    mkdir -p $out/share/man
-    cp -r man-sqop $out/share/man/man1
+    installManPage /tmp/man-pages/*.*
    installShellCompletion --cmd sqop \
-      --bash target/*/release/build/sequoia-sop*/out/sqop.bash \
-      --fish target/*/release/build/sequoia-sop*/out/sqop.fish \
-      --zsh target/*/release/build/sequoia-sop*/out/_sqop
+      --bash /tmp/shell-completions/sqop.bash \
+      --fish /tmp/shell-completions/sqop.fish \
+      --zsh /tmp/shell-completions/_sqop
    # Also elv and powershell are generated there
  '';

@@ -52,8 +54,9 @@ rustPlatform.buildRustPackage rec {
  meta = {
    description = "Implementation of the Stateless OpenPGP Command Line Interface using Sequoia";
    homepage = "https://gitlab.com/sequoia-pgp/sequoia-sop";
+    changelog = "https://gitlab.com/sequoia-pgp/sequoia-sop/-/blob/v${finalAttrs.src.tag}/NEWS";
    license = lib.licenses.gpl2Plus;
    maintainers = with lib.maintainers; [ doronbehar ];
    mainProgram = "sqop";
  };
-}
+})
@@ -18,13 +18,13 @@

 stdenv.mkDerivation {
  pname = "solanum";
-  version = "0-unstable-2026-01-11";
+  version = "0-unstable-2026-01-22";

  src = fetchFromGitHub {
    owner = "solanum-ircd";
    repo = "solanum";
-    rev = "e2a499f7192fa5e966dab03b7980e3240111d7b3";
-    hash = "sha256-F+CtxubdNz+B/a9sAoZW4tIvj72Mms/0bUKmvm14wHg=";
+    rev = "fd89d4e837fe2e98cb273c340ddf4762ce1eb070";
+    hash = "sha256-QMGbNCWbg6ODZHVM+A2hwm/okIXGYULCS2nZrGX2xco=";
  };

  patches = [
@@ -16,17 +16,17 @@

 maven.buildMavenPackage rec {
  pname = "sonarlint-ls";
-  version = "3.25.0.76263";
+  version = "4.8.0.77946";

  src = fetchFromGitHub {
    owner = "SonarSource";
    repo = "sonarlint-language-server";
    rev = version;
-    hash = "sha256-bnR6h2NRdGwmx04ydQIlE2VMe/C23YRqNxdbbb19yzE=";
+    hash = "sha256-kwgkRCVcEFGv18zVK9y0JhIx6Cb6XBrnwGbzf2uDdZE=";
  };

  mvnJdk = jdk17;
-  mvnHash = "sha256-Fk6JPMmzz7YnPWOdWKOXQ8z6bdYuXSgQdWBOaIlpd4A=";
+  mvnHash = "sha256-KyA2/ABdT35DqzEhE5P+aSGJfu60o6T4+ofQNiQTPFg=";

  # Disables failing tests which either need network access or are flaky.
  mvnParameters = lib.escapeShellArgs [
@@ -103,6 +103,9 @@ maven.buildMavenPackage rec {
    mainProgram = "sonarlint-ls";
    homepage = "https://github.com/SonarSource/sonarlint-language-server";
    license = lib.licenses.lgpl3;
-    maintainers = with lib.maintainers; [ tricktron ];
+    maintainers = with lib.maintainers; [
+      tricktron
+      cizordj
+    ];
  };
 }
@@ -0,0 +1,16 @@
+diff --git a/src/libs/tgfclient/guiscreen.cpp b/src/libs/tgfclient/guiscreen.cpp
+--- a/src/libs/tgfclient/guiscreen.cpp
+++ b/src/libs/tgfclient/guiscreen.cpp
+@@ -426,9 +426,9 @@ bool GfScrInitSDL2(int nWinWidth, int nWinHeight, int nFullScreen)
+ 
+ #ifdef __APPLE__
+     // Version d'OpenGL
+-    SDL_GL_SetAttribute(SDL_GL_CONTEXT_MAJOR_VERSION, 3);
+-    SDL_GL_SetAttribute(SDL_GL_CONTEXT_MINOR_VERSION, 2);
+-    SDL_GL_SetAttribute(SDL_GL_CONTEXT_PROFILE_MASK, SDL_GL_CONTEXT_PROFILE_CORE);
+    SDL_GL_SetAttribute(SDL_GL_CONTEXT_MAJOR_VERSION, 2);
+    SDL_GL_SetAttribute(SDL_GL_CONTEXT_MINOR_VERSION, 1);
+    SDL_GL_SetAttribute(SDL_GL_CONTEXT_PROFILE_MASK, SDL_GL_CONTEXT_PROFILE_COMPATIBILITY);
+ #else
+     // Version d'OpenGL
+     SDL_GL_SetAttribute(SDL_GL_CONTEXT_MAJOR_VERSION, 2);
@@ -29,15 +29,52 @@
  cmake,
  pkg-config,
  libvorbis,
-  runtimeShell,
  curl,
  fetchgit,
  cjson,
  minizip,
  rhash,
  copyDesktopItems,
+  makeWrapper,
 }:

+let
+  glLibs = lib.optionals stdenv.isLinux [
+    libGL
+    libGLU
+    libglut
+  ];
+  runtimeLibs = glLibs ++ [
+    libX11
+    plib
+    openal
+    freealut
+    libXrandr
+    libXext
+    libSM
+    libICE
+    libXi
+    libXt
+    libXrender
+    libXxf86vm
+    openscenegraph
+    expat
+    libpng12
+    zlib
+    SDL2
+    SDL2_mixer
+    enet
+    libjpeg
+    libvorbis
+    curl
+    cjson
+    minizip
+    rhash
+    stdenv.cc.cc.lib
+  ];
+  runtimeLibPath = lib.makeLibraryPath runtimeLibs;
+  libPathVar = if stdenv.isDarwin then "DYLD_LIBRARY_PATH" else "LD_LIBRARY_PATH";
+in
 stdenv.mkDerivation rec {
  version = "2.4.2";
  pname = "speed-dreams";
@@ -50,58 +87,29 @@ stdenv.mkDerivation rec {
  };
  NIX_CFLAGS_COMPILE = "-I${src}/src/libs/tgf -I${src}/src/libs/tgfdata -I${src}/src/interfaces -I${src}/src/libs/math -I${src}/src/libs/portability";

-  postInstall = ''
-    mkdir -p "$out/bin"
-    # Wrapper for main executable
-    cat > "$out/bin/speed-dreams" <<EOF
-    #!${runtimeShell}
-    export LD_LIBRARY_PATH="$out/lib/games/speed-dreams-2/lib:$out/lib:${
-      lib.makeLibraryPath [
-        libGL
-        libGLU
-        libglut
-        libX11
-        plib
-        openal
-        freealut
-        libXrandr
-        libXext
-        libSM
-        libICE
-        libXi
-        libXt
-        libXrender
-        libXxf86vm
-        openscenegraph
-        expat
-        libpng12
-        zlib
-        SDL2
-        SDL2_mixer
-        enet
-        libjpeg
-        libvorbis
-        curl
-        cjson
-        minizip
-        rhash
-        stdenv.cc.cc.lib
-      ]
-    }"
-    if [ -e "${libGL}/lib/libGL.so.1" ]; then
-      export LD_PRELOAD="${libGL}/lib/libGL.so.1''${LD_PRELOAD:+:$LD_PRELOAD}"
-    fi
-    export SDL_VIDEODRIVER="x11"
-    exec "$out/games/speed-dreams-2" "$@"
-    EOF
-    chmod a+x "$out/bin/speed-dreams"
+  patches = [
+    ./darwin-gl-compat.patch
+  ];

-    # Symlink for desktop icon
-    mkdir -p $out/share/pixmaps/
-    ln -s "$out/share/games/speed-dreams-2/data/icons/icon.png" "$out/share/pixmaps/speed-dreams-2.png"
+  postInstall = ''
    substituteInPlace "$out/share/applications/speed-dreams.desktop" \
-      --replace-fail "Exec=$out/games/speed-dreams-2" "Exec=$out/bin/speed-dreams" \
-      --replace-fail "Icon=/build/speed-dreams-code/speed-dreams-data/data/data/icons/icon.png" "Icon=$out/share/pixmaps/speed-dreams-2.png"
+      --replace-fail "Exec=$out/games/speed-dreams-2" "Exec=$out/bin/speed-dreams"
+    ${lib.optionalString stdenv.isLinux ''
+      # Symlink for desktop icon
+      mkdir -p $out/share/pixmaps/
+      ln -s "$out/share/games/speed-dreams-2/data/icons/icon.png" "$out/share/pixmaps/speed-dreams-2.png"
+      substituteInPlace "$out/share/applications/speed-dreams.desktop" \
+        --replace-fail "Icon=/build/speed-dreams-code/speed-dreams-data/data/data/icons/icon.png" "Icon=$out/share/pixmaps/speed-dreams-2.png"
+    ''}
+  '';
+
+  postFixup = ''
+    mkdir -p "$out/bin"
+    makeWrapperArgs=(
+      --prefix ${libPathVar} : "$out/lib/games/speed-dreams-2/lib:$out/lib:${runtimeLibPath}"
+    )
+    ${lib.optionalString stdenv.isLinux "makeWrapperArgs+=(--set SDL_VIDEODRIVER x11)"}
+    makeWrapper "$out/games/speed-dreams-2" "$out/bin/speed-dreams" "''${makeWrapperArgs[@]}"
  '';

  # RPATH of binary /nix/store/.../lib64/games/speed-dreams-2/drivers/shadow_sc/shadow_sc.so contains a forbidden reference to /build/
@@ -113,13 +121,11 @@ stdenv.mkDerivation rec {
    pkg-config
    cmake
    copyDesktopItems
+    makeWrapper
  ];

  buildInputs = [
    libpng12
-    libGLU
-    libGL
-    libglut
    libX11
    plib
    openal
@@ -146,6 +152,11 @@ stdenv.mkDerivation rec {
    cjson
    minizip
    rhash
+  ]
+  ++ lib.optionals stdenv.isLinux [
+    libGL
+    libGLU
+    libglut
  ];

  meta = {
@@ -156,7 +167,7 @@ stdenv.mkDerivation rec {
      raskin
      mio
    ];
-    platforms = lib.platforms.linux;
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
    mainProgram = "speed-dreams";
  };
 }
@@ -25,14 +25,14 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "stevia";
-  version = "0.52.0";
+  version = "0.52.1";

  src = fetchFromGitLab {
    domain = "gitlab.gnome.org";
    owner = "World/Phosh";
    repo = "stevia";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-LE2+1RkxD8Sj2H/3NFzcYXZktlVGoNzWrE0UO5sJCAM=";
+    hash = "sha256-GdAKy7F8SRGtfmN6as6AAg6p/WJrcDPp338OHUXoORM=";
  };

  mesonFlags = [
@@ -32,13 +32,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "swayimg";
-  version = "4.6";
+  version = "4.7";

  src = fetchFromGitHub {
    owner = "artemsen";
    repo = "swayimg";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Q5TqY5UgSGZVVoARcz1ig0UkZBKgRoT9Ndvg/f1T38Q=";
+    hash = "sha256-1dJf339lM8ETcYyjtWCJEyNmwmoxt72+rXdTH/48s6Q=";
  };

  strictDeps = true;
@@ -9,7 +9,7 @@
 }:

 let
-  version = "2.0.2";
+  version = "2.0.2-unstable-2025-01-15";
 in
 rustPlatform.buildRustPackage {
  pname = "system76-scheduler";
@@ -17,11 +17,11 @@ rustPlatform.buildRustPackage {
  src = fetchFromGitHub {
    owner = "pop-os";
    repo = "system76-scheduler";
-    rev = version;
-    hash = "sha256-5GiHmu++YRCewDHm/qxKmQwDIAZwlW5Eya/fDriVSdA=";
+    rev = "b0b7e98b0dbd2cd05e9fe80829e7083048202da7";
+    hash = "sha256-I+LN7Q5/VQ203Vk0eKM4HZw8oSS0bkcY/wIWbu4hPnI=";
  };

-  cargoHash = "sha256-o2Ma9WNmBz+18SSMBPXYK4BXzHFLQwa3JWhq4S7jSBg=";
+  cargoHash = "sha256-rTe016jxRdL3xOw6yHz8btyfnecGuPTIashKQustYP0=";

  nativeBuildInputs = [
    pkg-config
@@ -10,13 +10,13 @@

 buildGoModule (finalAttrs: {
  pname = "tektoncd-cli-pac";
-  version = "0.40.0";
+  version = "0.41.0";

  src = fetchFromGitHub {
    owner = "openshift-pipelines";
    repo = "pipelines-as-code";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-FHhJyOHaYaYvizNZ3iKsWy+CH9VWa8LXBmaawVdcaFo=";
+    hash = "sha256-j3HVaaW7fhaFK+Uv/zJXUBmylHV04QCFRr/V7cfeSNg=";
  };

  vendorHash = null;
@@ -0,0 +1,95 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  pkg-config,
+  alsa-lib,
+  fontconfig,
+  freetype,
+  libX11,
+  libXcomposite,
+  libXcursor,
+  libXdmcp,
+  libXext,
+  libXinerama,
+  libXrandr,
+  libXtst,
+  writableTmpDirAsHomeHook,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "time12";
+  version = "1.2.3";
+
+  src = fetchFromGitHub {
+    owner = "tiagolr";
+    repo = "time12";
+    tag = "v${finalAttrs.version}";
+    fetchSubmodules = true;
+    hash = "sha256-/siQGQRHPqIP17NE4e/IGEQIzLPnBAXXzU6ucL1y5os=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    writableTmpDirAsHomeHook # fontconfig cache
+  ];
+
+  buildInputs = [
+    fontconfig
+    freetype
+  ]
+  ++ lib.optionals stdenv.isLinux [
+    alsa-lib
+    libX11
+    libXcomposite
+    libXcursor
+    libXdmcp
+    libXext
+    libXinerama
+    libXrandr
+    libXtst
+  ];
+
+  enableParallelBuilding = true;
+
+  cmakeFlags = [
+    (lib.cmakeBool "COPY_PLUGIN_AFTER_BUILD" false)
+    (lib.cmakeFeature "BUILD_STANDALONE" "OFF")
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    "-DCMAKE_OSX_ARCHITECTURES=${stdenv.hostPlatform.darwinArch}"
+  ];
+
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isLinux (toString [
+    # juce, compiled in this build as part of a Git submodule, uses `-flto` as
+    # a Link Time Optimization flag, and instructs the plugin compiled here to
+    # use this flag to. This breaks the build for us. Using _fat_ LTO allows
+    # successful linking while still providing LTO benefits. If our build of
+    # `juce` was used as a dependency, we could have patched that `-flto` line
+    # in our juce's source, but that is not possible because it is used as a
+    # Git Submodule.
+    "-ffat-lto-objects"
+  ]);
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/lib/vst3 $out/lib/lv2
+
+    cp -r "TIME12_artefacts/Release/LV2/TIME-12.lv2" $out/lib/lv2
+    cp -r "TIME12_artefacts/Release/VST3/TIME-12.vst3" $out/lib/vst3
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "An envelope based delay modulator";
+    homepage = "https://github.com/tiagolr/time12";
+    changelog = "https://github.com/tiagolr/time12/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ magnetophon ];
+    platforms = lib.platforms.all;
+  };
+})
@@ -9,16 +9,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "tomat";
-  version = "2.8.0";
+  version = "2.8.1";

  src = fetchFromGitHub {
    owner = "jolars";
    repo = "tomat";
    tag = "v${version}";
-    hash = "sha256-Jj/ObyFRvsdwxEvTQCIbkFkR3Zrs7SsU11rOZxclA7E=";
+    hash = "sha256-91/yCWjuLOpeY0APJviElhLBWDM4a8ytUEYkp0oKuRk=";
  };

-  cargoHash = "sha256-zmQ7Dk6a0F7XpD3BcOFU87to48j6J5+xNI2XGRx1u/E=";
+  cargoHash = "sha256-/EYSk7bsCnKNRGe/f6RH0L2h0KKU2uEQPSKgqi2a58g=";

  nativeBuildInputs = [
    pkg-config
--- a/Show More
+++ b/Show More