Merge master into staging-next

2026-06-23 00:18:52 +00:00
parent 2233f6ec1b 6449758226
commit 78696e761c
180 changed files with 2388 additions and 1361 deletions
@@ -13,7 +13,6 @@ For new packages please briefly describe the package or provide a link to its ho
 - Built on platform:
  - [ ] x86_64-linux
  - [ ] aarch64-linux
-  - [ ] x86_64-darwin
  - [ ] aarch64-darwin
 - Tested, as applicable:
  - [ ] [NixOS tests] in [nixos/tests].
@@ -34,21 +34,18 @@ jobs:
      matrix:
        include:
          - runner: ubuntu-24.04
-            name: x86_64-linux
-            systems: x86_64-linux
+            system: x86_64-linux
            builds: [shell, manual-nixos, lib-tests, tarball]
            desc: shell, docs, lib, tarball
          - runner: ubuntu-24.04-arm
-            name: aarch64-linux
-            systems: aarch64-linux
+            system: aarch64-linux
            builds: [shell, manual-nixos, manual-nixpkgs]
            desc: shell, docs
          - runner: macos-14
-            name: darwin
-            systems: aarch64-darwin x86_64-darwin
+            system: aarch64-darwin
            builds: [shell]
            desc: shell
-    name: '${{ matrix.name }}: ${{ matrix.desc }}'
+    name: '${{ matrix.system }}: ${{ matrix.desc }}'
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 60
    steps:
@@ -80,7 +77,9 @@ jobs:

      - name: Build shell
        if: contains(matrix.builds, 'shell')
-        run: echo "${{ matrix.systems }}" | xargs -n1 nix-build-uncached nixpkgs/untrusted/ci --arg nixpkgs ./nixpkgs/untrusted-pinned -A shell --argstr system
+        env:
+          system: ${{ matrix.system }}
+        run: nix-build-uncached nixpkgs/untrusted/ci --arg nixpkgs ./nixpkgs/untrusted-pinned -A shell --argstr system "$system"

      - name: Build NixOS manual
        if: |
@@ -108,5 +107,5 @@ jobs:
          contains(fromJSON(inputs.baseBranch).type, 'primary')
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
-          name: ${{ inputs.artifact-prefix }}nixos-manual-${{ matrix.name }}
+          name: ${{ inputs.artifact-prefix }}nixos-manual-${{ matrix.system }}
          path: nixos-manual
@@ -18,6 +18,9 @@

 - `libgdata` has been removed, as it was archived upstream and relied on the insecure libsoup 2.4.

+- `services.mysql` now sets `root@localhost` authentication to `auth_socket` when used with `mysql` or `percona-server`.
+  Existing deployments will also be adjusted if possible. See the [security advisory GHSA-6qxx-6rg8-c4p8](https://github.com/NixOS/nixpkgs/security/advisories/GHSA-6qxx-6rg8-c4p8) for more information.
+
 - `uhttpmock` providing 0.0 ABI was removed. `uhttpmock_1_0` providing 1.0 ABI was renamed to `uhttpmock` and `uhttpmock_1_0` was kept as an alias.

 - Linux kernel configuration has been moved out of the `linux-kernel` field of the platform structure into the kernel builders:
@@ -10209,6 +10209,11 @@
    githubId = 13297896;
    name = "David Isaksson";
  };
+  grandjeanlab = {
+    github = "grandjeanlab";
+    githubId = 22633767;
+    name = "grandjeanlab";
+  };
  gravndal = {
    email = "gaute.ravndal+nixos@gmail.com";
    github = "gravndal";
@@ -14627,8 +14632,7 @@
  };
  koi = {
    name = "june";
-    email = "me@koi.rip";
-    matrix = "@koi:nelliel.cv";
+    email = "packages@koi.rip";
    github = "koibtw";
    githubId = 75480869;
    keys = [
@@ -26094,6 +26098,12 @@
    githubId = 13762043;
    matrix = "@sophie:nue.soopy.moe";
  };
+  sophiebsw = {
+    name = "Sophia";
+    email = "nixpkgs@drifter.dev";
+    github = "sophiebsw";
+    githubId = 4594464;
+  };
  sophronesis = {
    email = "oleksandr.buzynnyi@gmail.com";
    github = "sophronesis";
@@ -62,4 +62,8 @@

 - `security.polkit.settings` added for RFC42 style configuration of the polkitd daemon.

+- `services.plausible` can now again seed an initial admin user declaratively via [`services.plausible.adminUser.email`](#opt-services.plausible.adminUser.email).
+  This makes fully declarative deployments safer: Otherwise the user needed to either accept Plausible's unauthenticated "first launch" setup wizard, which lets anyone reaching the instance create the first admin account, or do more work (deploying with NixOS's default binding to `localhost` without exposing it publicly, going through the wizard, and then deploying Plausible exposed to the Internet).
+  This option was previously removed with NixOS 25.05 due to an upstream Plausible change making declarative admin creation more difficult, but this change re-implements the admin creation directly.
+
 - The `newuidmap` and `newgidmap` security wrappers are now installed with `cap_setuid`/`cap_setgid` file capabilities instead of the setuid-root bit, matching shadow's `--with-fcaps` install mode and other major distributions. Rootless containers (podman, docker-rootless, unprivileged user namespaces) are unaffected. The only behavioural change is that mapping host uid 0 via `/etc/subuid` (which NixOS never configures by default) additionally requires `cap_setfcap`; users who explicitly grant uid 0 in a subuid range can restore the previous behaviour with `security.wrappers.newuidmap.capabilities = lib.mkForce "cap_setuid,cap_setfcap+ep";`.
@@ -293,6 +293,19 @@ in
        '';
      };

+      secureSuperUserByDefault = lib.mkOption {
+        type = lib.types.bool;
+        default = true;
+        description = ''
+          Whether to automatically secure the root@localhost user with auth_socket authentication.
+
+          ::: {.note}
+          When enabled (default), the module will ensure root@localhost uses socket authentication,
+          preventing any local user from connecting as root without proper credentials.
+          :::
+        '';
+      };
+
      replication = {
        role = lib.mkOption {
          type = lib.types.enum [
@@ -411,6 +424,10 @@ in
        assertion = !cfg.galeraCluster.enable || isMariaDB;
        message = "'services.mysql.galeraCluster.enable' expect services.mysql.package to be an mariadb variant";
      }
+      {
+        assertion = !isMariaDB || cfg.secureSuperUserByDefault == true;
+        message = "'services.mysql.secureSuperUserByDefault' has no effect on MariaDB (which is already secure by default)";
+      }
    ]
    # galeraCluster options checks
    ++ lib.optionals cfg.galeraCluster.enable [
@@ -571,6 +588,7 @@ in
        let
          # The super user account to use on *first* run of MySQL server
          superUser = if isMariaDB then cfg.user else "root";
+          isStateVersion2611Plus = lib.versionAtLeast config.system.stateVersion "26.11";
        in
        ''
          ${lib.optionalString isMariaDB ''
@@ -644,6 +662,11 @@ in
                ) | ${cfg.package}/bin/mysql -u ${superUser} -N
              ''}

+              # Secure root@localhost for MySQL/Percona on first initialization
+              ${lib.optionalString (cfg.secureSuperUserByDefault && !isMariaDB) ''
+                echo "ALTER USER root@localhost IDENTIFIED WITH auth_socket;" | ${cfg.package}/bin/mysql -u ${superUser} -N
+              ''}
+
              ${lib.optionalString (cfg.initialScript != null) ''
                # Execute initial script
                # using toString to avoid copying the file to nix store if given as path instead of string,
@@ -654,6 +677,27 @@ in
              rm ${cfg.dataDir}/mysql_init
          fi

+          ${lib.optionalString (cfg.secureSuperUserByDefault && !isMariaDB) ''
+            # We try to detect if we are in the default insecure auth mode for MySQL (all users can connect with password)
+            # If the configuration has been moved to the socket-peer credential authentication we do nothing
+            # If we are not able to connect it also means the default setup has been adjusted, so we also skip and do not do any changes
+            if plugin_info=$(${cfg.package}/bin/mysql -u ${superUser} --skip-column-names 2>/dev/null -e "SELECT plugin FROM mysql.user WHERE user = 'root' AND host = 'localhost';"); then
+              case "$plugin_info" in
+                *auth_socket*) ;;
+                *)
+                  ${lib.optionalString isStateVersion2611Plus ''
+                    # Attempt to auto-fix to prevent local authentication without a password
+                    echo "Securing root@localhost with auth_socket to local connection without password, see https://github.com/NixOS/nixpkgs/security/advisories/GHSA-6qxx-6rg8-c4p8" >&2
+                    echo "ALTER USER root@localhost IDENTIFIED WITH auth_socket;" | ${cfg.package}/bin/mysql -u ${superUser} -N
+                  ''}
+                  ${lib.optionalString (!isStateVersion2611Plus) ''
+                    echo "Security warning: root@localhost seems to have open authentication, consider adjusting your configuration. See https://github.com/NixOS/nixpkgs/security/advisories/GHSA-6qxx-6rg8-c4p8" >&2
+                  ''}
+                  ;;
+              esac
+            fi
+          ''}
+
          ${lib.optionalString (cfg.ensureDatabases != [ ]) ''
            (
            ${lib.concatMapStrings (database: ''
@@ -20,6 +20,19 @@ After that, `plausible` can be deployed like this:
      # secretKeybaseFile is a path to the file which contains the secret generated
      # with openssl as described above.
      secretKeybaseFile = "/run/secrets/plausible-secret-key-base";
+      # With an admin user seeded (below), registration can be locked down
+      # so only invited users (or nobody) can create further accounts.
+      disableRegistration = "invite_only";
+    };
+    # If you do not declare `adminUser`, Plausible shows an unauthenticated
+    # "first launch" setup wizard where anybody reaching the instance can create
+    # the first admin account. That may be convenient, but is also a security
+    # risk if somebody else uses it before you do.
+    adminUser = {
+      email = "admin@analytics.example.org";
+      # passwordHashFile is a path to a file containing the bcrypt hash of the
+      # admin user's password, e.g. generated with `mkpasswd -m bcrypt`.
+      passwordHashFile = "/run/secrets/plausible-admin-password-hash";
    };
  };
 }
@@ -10,6 +10,68 @@ with lib;
 let
  cfg = config.services.plausible;

+  seedAdminEnabled = cfg.adminUser.email != null;
+
+  # Note [plausible-seed-admin-no-wizard-race]:
+  # Plausible Community Edition shows an unauthenticated "first launch" setup
+  # wizard to create the admin user whenever no user exists in the database
+  # (`Plausible.Release.should_be_first_launch?` is
+  # `not Repo.exists?(Plausible.Auth.User)`, and `PlausibleWeb.FirstLaunchPlug`
+  # 302-redirects every page to `/register` while that is true). On an instance
+  # reachable over the network this lets any stranger create the first admin
+  # account.
+  #
+  # `DISABLE_REGISTRATION` does NOT gate this wizard (it must not, otherwise the
+  # first user could never be created), so the only robust fix is to ensure a
+  # user already exists before the web server accepts any connection.
+  #
+  # We therefore seed the admin user inside the service's main `script`, after
+  # the DB migrations and strictly before `exec plausible start`. This
+  # guarantees there is no time window in which the wizard is reachable. The
+  # seed is idempotent (it only inserts when no user exists), so it is safe to
+  # run on every (re)start.
+  #
+  # We insert the precomputed bcrypt `password_hash` directly rather than going
+  # through `Plausible.Auth.User.new/1`, so the plaintext password never has to
+  # be stored on disk. `email_verified` is set to `true` because self-hosted
+  # Plausible does not require email verification by default.
+  #
+  # This Elixir script may need updating as newer Plausible versions get
+  # released (e.g. if the `Plausible.Auth.User` schema changes). The NixOS VM
+  # test `nixos/tests/plausible.nix` validates that the wizard is unreachable
+  # once an admin user is configured.
+  seedAdminScript = pkgs.writeText "plausible-seed-admin.exs" ''
+    # This script runs via `plausible eval`, which evaluates it WITHOUT
+    # starting the `:plausible` application or its Ecto repos. We therefore
+    # start them ourselves before querying/inserting, mirroring the private
+    # `Plausible.Release.prepare/0` (the same startup the release uses for its
+    # `migrate`/`seed` commands): load the app, start the DB-related apps and
+    # start each Ecto repo. Otherwise `Repo.exists?/1` raises
+    # `could not lookup Ecto repo Plausible.Repo because it was not started`.
+    :ok = Application.ensure_loaded(:plausible)
+    Enum.each([:ssl, :postgrex, :ch, :ecto], &Application.ensure_all_started/1)
+    Enum.each(Application.fetch_env!(:plausible, :ecto_repos), & &1.start_link(pool_size: 2))
+
+    alias Plausible.Repo
+    alias Plausible.Auth.User
+
+    unless Repo.exists?(User) do
+      email = System.fetch_env!("SEED_ADMIN_USER_EMAIL")
+      name = System.fetch_env!("SEED_ADMIN_USER_NAME")
+      password_hash = System.fetch_env!("SEED_ADMIN_USER_PASSWORD_HASH")
+
+      %User{
+        email: email,
+        name: name,
+        password_hash: password_hash,
+        email_verified: true
+      }
+      |> Repo.insert!()
+
+      IO.puts("plausible: seeded admin user #{email}")
+    end
+  '';
+
 in
 {
  options.services.plausible = {
@@ -51,6 +113,57 @@ in
      };
    };

+    adminUser = {
+      email = mkOption {
+        default = null;
+        type = types.nullOr types.str;
+        description = ''
+          Email address of an admin user to seed into the database before the
+          Plausible web server starts accepting connections.
+
+          Plausible Community Edition shows an unauthenticated "first launch"
+          setup wizard whenever no user exists in the database, which redirects
+          every page to `/register` and lets anyone reaching the instance over
+          the network create the first admin account. Setting this option (and
+          {option}`services.plausible.adminUser.passwordHashFile`) seeds an
+          admin user before the port is opened, so the wizard is never reachable
+          by strangers.
+
+          When `null`, no user is seeded and Plausible's setup wizard is used as
+          usual.
+
+          Seeding is idempotent: if any user already exists, no user is created.
+        '';
+        example = "admin@example.org";
+      };
+
+      name = mkOption {
+        default = "Admin";
+        type = types.str;
+        description = ''
+          Display name of the seeded admin user (see
+          {option}`services.plausible.adminUser.email`).
+        '';
+      };
+
+      passwordHashFile = mkOption {
+        default = null;
+        type = with types; nullOr (either str path);
+        description = ''
+          Path to a file containing the bcrypt hash of the seeded admin user's
+          password (see {option}`services.plausible.adminUser.email`).
+
+          Using a hash file (rather than the plaintext password) means the
+          plaintext never has to be stored on disk or in the Nix store. Generate
+          a hash e.g. with `mkpasswd -m bcrypt` (the resulting `$2b$...` string).
+
+          This file is read via systemd's `LoadCredential`, so it does not enter
+          the Nix store.
+        '';
+        example = "/run/secrets/plausible-admin-password-hash";
+      };
+    };
+
    server = {
      disableRegistration = mkOption {
        default = true;
@@ -150,33 +263,34 @@ in
    (mkRemovedOptionModule [ "services" "plausible" "releaseCookiePath" ]
      "Plausible uses no distributed Erlang features, so this option is no longer necessary and was removed"
    )
-    (mkRemovedOptionModule [
-      "services"
-      "plausible"
-      "adminUser"
-      "name"
-    ] "Admin user is now created using first start wizard")
-    (mkRemovedOptionModule [
-      "services"
-      "plausible"
-      "adminUser"
-      "email"
-    ] "Admin user is now created using first start wizard")
-    (mkRemovedOptionModule [
-      "services"
-      "plausible"
-      "adminUser"
-      "passwordFile"
-    ] "Admin user is now created using first start wizard")
-    (mkRemovedOptionModule [
-      "services"
-      "plausible"
-      "adminUser"
-      "activate"
-    ] "Admin user is now created using first start wizard")
+    (mkRemovedOptionModule
+      [
+        "services"
+        "plausible"
+        "adminUser"
+        "passwordFile"
+      ]
+      "Use services.plausible.adminUser.passwordHashFile instead, which keeps the plaintext password out of the Nix store"
+    )
+    (mkRemovedOptionModule
+      [
+        "services"
+        "plausible"
+        "adminUser"
+        "activate"
+      ]
+      "The seeded admin user is always created as email-verified; self-hosted Plausible does not require email verification"
+    )
  ];

  config = mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = seedAdminEnabled -> (cfg.adminUser.passwordHashFile != null);
+        message = "services.plausible.adminUser.passwordHashFile must be set when services.plausible.adminUser.email is set.";
+      }
+    ];
+
    services.postgresql = mkIf cfg.database.postgres.setup {
      enable = true;
    };
@@ -285,6 +399,18 @@ in
            ''}

            ${cfg.package}/migrate.sh
+
+            ${lib.optionalString seedAdminEnabled ''
+              # Seed the admin user before the web server starts, so the
+              # unauthenticated "first launch" setup wizard is never reachable;
+              # see note [plausible-seed-admin-no-wizard-race].
+              export SEED_ADMIN_USER_EMAIL=${lib.escapeShellArg cfg.adminUser.email}
+              export SEED_ADMIN_USER_NAME=${lib.escapeShellArg cfg.adminUser.name}
+              SEED_ADMIN_USER_PASSWORD_HASH="$(< "$CREDENTIALS_DIRECTORY/ADMIN_USER_PASSWORD_HASH" )"
+              export SEED_ADMIN_USER_PASSWORD_HASH
+              plausible eval "$(< ${seedAdminScript} )"
+            ''}
+
            export IP_GEOLOCATION_DB=${pkgs.dbip-country-lite}/share/dbip/dbip-country-lite.mmdb

            exec plausible start
@@ -300,6 +426,9 @@ in
            ]
            ++ lib.optionals (cfg.mail.smtp.passwordFile != null) [
              "SMTP_USER_PWD:${cfg.mail.smtp.passwordFile}"
+            ]
+            ++ lib.optionals seedAdminEnabled [
+              "ADMIN_USER_PASSWORD_HASH:${cfg.adminUser.passwordHashFile}"
            ];
          };
        };
@@ -1061,6 +1061,7 @@ in
  mysql-autobackup = handleTest ./mysql/mysql-autobackup.nix { };
  mysql-backup = handleTest ./mysql/mysql-backup.nix { };
  mysql-replication = handleTest ./mysql/mysql-replication.nix { };
+  mysql-secure-root = handleTest ./mysql/mysql-secure-root.nix { };
  n8n = runTest ./n8n.nix;
  nagios = runTestOn [ "x86_64-linux" "aarch64-linux" ] ./nagios.nix;
  nar-serve = runTest ./nar-serve.nix;
@@ -1341,7 +1342,7 @@ in
  pixelfed = import ./web-apps/pixelfed { inherit runTestOn; };
  plantuml-server = runTest ./plantuml-server.nix;
  plasma6 = runTest ./plasma6.nix;
-  plausible = runTest ./plausible.nix;
+  plausible = import ./plausible.nix { inherit runTest; };
  playwright-python = runTest ./playwright-python.nix;
  please = runTest ./please.nix;
  pleroma = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./pleroma.nix { };
@@ -0,0 +1,94 @@
+{
+  system ? builtins.currentSystem,
+  config ? { },
+  pkgs ? import ../../.. { inherit system config; },
+  lib ? pkgs.lib,
+}:
+
+let
+  makeTest = import ./../make-test-python.nix;
+  inherit (import ./common.nix { inherit pkgs lib; })
+    mysqlPackages
+    ;
+
+  makeSecureRootTest =
+    {
+      package,
+      name ? "mysql_secure_root_" + (builtins.replaceStrings [ "-" "." ] [ "_" "" ] package.pname),
+    }:
+    makeTest {
+      inherit name;
+
+      nodes.${name} = { pkgs, ... }: {
+        services.mysql = {
+          enable = true;
+          package = package;
+        };
+      };
+
+      testScript = ''
+        start_all()
+
+        machine = ${name}
+        machine.wait_for_unit("mysql")
+
+        # Verify that non-root user cannot connect as root
+        machine.fail("sudo -u nobody mysql -u root -e 'SELECT 1;' 2>&1")
+
+        # Verify that system root can connect as root via socket
+        machine.succeed("mysql -u root -e 'SELECT 1;'")
+
+        # Verify that root@localhost has auth_socket plugin
+        machine.succeed("[ \"$(mysql -u root -N -e \"SELECT plugin FROM mysql.user WHERE user = 'root' AND host = 'localhost';\")\" = \"auth_socket\" ]")
+
+        # Test service restart - verify it still works
+        machine.succeed("systemctl restart mysql")
+        machine.wait_for_unit("mysql")
+
+        # After restart, verify non-root user still cannot connect as root
+        machine.fail("sudo -u nobody mysql -u root -e 'SELECT 1;' 2>&1")
+
+        # After restart, verify system root can still connect
+        machine.succeed("mysql -u root -e 'SELECT 1;'")
+
+        # After restart, verify root@localhost still has auth_socket
+        machine.succeed("[ \"$(mysql -u root -N -e \"SELECT plugin FROM mysql.user WHERE user = 'root' AND host = 'localhost';\")\" = \"auth_socket\" ]")
+      '';
+    };
+
+  makeInsecureRootTest =
+    {
+      package,
+      name ? "mysql_insecure_root_" + (builtins.replaceStrings [ "-" "." ] [ "_" "" ] package.pname),
+    }:
+    makeTest {
+      inherit name;
+
+      nodes.${name} = { pkgs, ... }: {
+        services.mysql = {
+          enable = true;
+          package = package;
+          secureSuperUserByDefault = false;
+        };
+      };
+
+      testScript = ''
+        start_all()
+
+        machine = ${name}
+        machine.wait_for_unit("mysql")
+
+        # With secureRootByDefault = false, anyone can connect as root (default --initialize-insecure behavior)
+        machine.succeed("sudo -u nobody mysql -u root -e 'SELECT 1;' 2>&1")
+      '';
+    };
+
+in
+{
+  "secure-by-default" = lib.mapAttrs (
+    _: package: makeSecureRootTest { inherit package; }
+  ) mysqlPackages;
+  "can-be-insecure" = lib.mapAttrs (
+    _: package: makeInsecureRootTest { inherit package; }
+  ) mysqlPackages;
+}
@@ -1,34 +1,142 @@
-{ lib, ... }:
-{
-  name = "plausible";
-  meta = {
-    maintainers = [ ];
-  };
+{ runTest }:

-  nodes.machine =
-    { pkgs, ... }:
+let
+  secretKeybase = "nannannannannannannannannannannannannannannannannannannan_batman!";
+
+  # A fixed bcrypt password hash is fine for a test; the plaintext is never
+  # needed because the test only checks that an admin user exists (and thus the
+  # "first launch" setup wizard is unreachable), not that login with the
+  # password works.
+  adminEmail = "admin@localhost";
+
+  mkPlausibleTest =
    {
-      virtualisation.memorySize = 4096;
-      services.plausible = {
-        enable = true;
-        server = {
-          baseUrl = "http://localhost:8000";
-          secretKeybaseFile = "${pkgs.writeText "dont-try-this-at-home" "nannannannannannannannannannannannannannannannannannannan_batman!"}";
+      seedAdmin ? false,
+    }:
+    runTest (
+      { lib, pkgs, ... }:
+      let
+        adminPassword = "correct-horse-battery-staple";
+        adminPasswordHashFile = pkgs.runCommand "plausible-admin-password-hash" { } ''
+          ${lib.getExe pkgs.mkpasswd} -m bcrypt ${lib.escapeShellArg adminPassword} > "$out"
+        '';
+      in
+      {
+        name = "plausible" + lib.optionalString seedAdmin "-declarative-admin-user";
+        meta = {
+          maintainers = with lib.maintainers; [
+            nh2
+            stepbrobd
+          ];
        };
-      };
-    };

-  testScript = ''
-    start_all()
-    machine.wait_for_unit("plausible.service")
-    machine.wait_for_open_port(8000)
+        nodes.machine = {
+          # On first boot, the ClickHouse migrations run by Plausible's
+          # `migrate.sh` intermittently fail with `(Mint.TransportError) socket
+          # closed`, which aborts startup before the web server opens its port.
+          # The failure is transient and succeeds on a subsequent attempt, so
+          # retry startup without a rate limit until the port opens. (Without
+          # this, the test is flaky.)
+          systemd.services.plausible.serviceConfig.Restart = lib.mkForce "always";
+          systemd.services.plausible.serviceConfig.RestartSec = 1;
+          systemd.services.plausible.unitConfig.StartLimitIntervalSec = 0;

-    # Ensure that the software does not make not make the machine
-    # listen on any public interfaces by default.
-    machine.fail("ss -tlpn 'src = 0.0.0.0 or src = [::]' | grep LISTEN")
+          services.plausible = {
+            enable = true;
+            adminUser = lib.mkIf seedAdmin {
+              email = adminEmail;
+              name = "Test Admin";
+              passwordHashFile = "${adminPasswordHashFile}";
+            };
+            server = {
+              baseUrl = "http://localhost:8000";
+              secretKeybaseFile = builtins.toFile "plausible-test-secret-keybase-file" secretKeybase;
+            };
+          };
+        };

-    machine.succeed("curl -f localhost:8000 >&2")
+        testScript = ''
+          machine.wait_for_unit("plausible.service")
+          machine.wait_for_open_port(8000)

-    machine.succeed("curl -f localhost:8000/js/script.js >&2")
-  '';
+          # Ensure that the software does not make the machine
+          # listen on any public interfaces by default.
+          machine.fail("ss -tlpn 'src = 0.0.0.0 or src = [::]' | grep LISTEN")
+
+          machine.succeed("curl -f localhost:8000 >&2")
+          machine.succeed("curl -f localhost:8000/js/script.js >&2")
+
+          def user_count():
+            # Plausible's "first launch" state is defined as "no user exists"
+            # (`Plausible.Release.should_be_first_launch?` is
+            # `not Repo.exists?(Plausible.Auth.User)`), so we inspect the `users`
+            # table directly. Local Postgres connections use `trust` auth in this
+            # VM, so the `postgres` superuser can query without a password.
+            return machine.succeed(
+              "sudo -u postgres psql --dbname plausible --tuples-only --no-align "
+              "--command 'SELECT count(*) FROM users'"
+            ).strip()
+
+          def login_redirect_url():
+            return machine.succeed(
+              "curl -s -o /dev/null -w '%{redirect_url}' localhost:8000/login"
+            ).strip()
+        ''
+        + (
+          if seedAdmin then
+            ''
+              with subtest("the admin user is seeded"):
+                assert user_count() == "1", "expected exactly one seeded admin user"
+                email = machine.succeed(
+                  "sudo -u postgres psql --dbname plausible --tuples-only --no-align "
+                  "--command 'SELECT email FROM users'"
+                ).strip()
+                assert email == "${adminEmail}", f"unexpected seeded admin email: {email!r}"
+
+              with subtest("the setup wizard is NOT reachable"):
+                # `/login` must render normally (HTTP 200) and must not redirect
+                # to the first-launch `/register` wizard.
+                status = machine.succeed(
+                  "curl -s -o /dev/null -w '%{http_code}' localhost:8000/login"
+                ).strip()
+                assert status == "200", f"expected /login to render (200), got: {status!r}"
+                location = login_redirect_url()
+                assert "/register" not in location, (
+                  f"/login unexpectedly redirected to the setup wizard: {location!r}"
+                )
+
+              with subtest("seeding is idempotent across restarts"):
+                machine.succeed("systemctl restart plausible.service")
+                machine.wait_for_open_port(8000)
+                assert user_count() == "1", "expected still exactly one user after restart"
+            ''
+          else
+            ''
+              with subtest("without an admin user, the setup wizard is reachable"):
+                assert user_count() == "0", "expected no users in first-launch state"
+                # With no user seeded, `should_be_first_launch?` is true and the
+                # browser pipeline's `FirstLaunchPlug` 302-redirects every page to
+                # `/register`.
+                location = login_redirect_url()
+                assert "/register" in location, (
+                  f"expected /login to redirect to the setup wizard /register, but redirect was: {location!r}"
+                )
+            ''
+        );
+      }
+    );
+in
+{
+  # Basic test: Plausible without a declaratively configured admin user is in
+  # the "first launch" state, so the unauthenticated setup wizard is reachable.
+  # This also asserts that the way the `declarative-admin-user` test detects
+  # "wizard reachable" actually fires for this Plausible version, so a future
+  # Plausible change that breaks the detection would make that test fail rather
+  # than silently pass.
+  basic = mkPlausibleTest { seedAdmin = false; };
+
+  # Tests that a declaratively configured admin user is seeded before the web
+  # server accepts connections, so the unauthenticated "first launch" setup
+  # wizard is never reachable.
+  declarative-admin-user = mkPlausibleTest { seedAdmin = true; };
 }
@@ -21,26 +21,26 @@ vscode-utils.buildVscodeMarketplaceExtension (finalAttrs: {
      sources = {
        "x86_64-linux" = {
          arch = "linux-x64";
-          hash = "sha256-hjj2PRcpRsC6kWqwhGlBt071rHVq9ZN+OcNsT78IuWc=";
+          hash = "sha256-tCasNLg/Tu3uP69Mve9Kcqam1+JQkA/XyCMPy6aNPJM=";
        };
        "aarch64-linux" = {
          arch = "linux-arm64";
-          hash = "sha256-7lhfn95LI8vg2MvzTuQw57bmhJOXInl+T/e3ZSLNMKA=";
+          hash = "sha256-o+y3Oz/lZd9gEQL3q+ivzkWchQ/dJ5QuU9fJwRpEYrE=";
        };
        "x86_64-darwin" = {
          arch = "darwin-x64";
-          hash = "sha256-/aSCQP6yQ30qmgz1ZcgZ91MiLwpxkr77m3NIlidfgnw=";
+          hash = "sha256-vovdNDX0m55a7sazBCixnun89gb/dknzUbeMSU5q8KU=";
        };
        "aarch64-darwin" = {
          arch = "darwin-arm64";
-          hash = "sha256-uDVR6Y1GoY8G8OLBoAGY6YMLL2Qj7eHpZ6p0Z0OCN/4=";
+          hash = "sha256-JbLeoeAzOUVbmpM1CN5QajsK8QT8KjZRUD4UxR6C7bU=";
        };
      };
    in
    {
      name = "claude-code";
      publisher = "anthropic";
-      version = "2.1.179";
+      version = "2.1.185";
    }
    // sources.${stdenvNoCC.hostPlatform.system}
      or (throw "Unsupported system ${stdenvNoCC.hostPlatform.system}");
@@ -1145,8 +1145,8 @@ let
        mktplcRef = {
          name = "vscode-database-client2";
          publisher = "cweijan";
-          version = "8.5.1";
-          hash = "sha256-adpTh4tNlWFdAGultTLZ9SfN9sMOpMaMWq8x6diGzBg=";
+          version = "9.0.1";
+          hash = "sha256-P2GoE92SwGMb45On5ziTZ9dBjPb0VnFSo+4TEwrcWuM=";
        };
        meta = {
          description = "Database Client For Visual Studio Code";
@@ -1884,8 +1884,8 @@ let
        mktplcRef = {
          name = "godot-tools";
          publisher = "geequlim";
-          version = "2.6.1";
-          hash = "sha256-x+u5t4HB+uM2CbhSw0h/zoYPgBPTZNFaMuzL+KB9mAM=";
+          version = "2.7.1";
+          hash = "sha256-TNCMSmZdBXxAHkcFLpTDkCzaXNO4yvkCfQ8Xrb9gquo=";
        };
        meta = {
          description = "VS Code extension for game development with Godot Engine and GDScript";
@@ -2015,8 +2015,8 @@ let
        mktplcRef = {
          name = "gitlab-workflow";
          publisher = "gitlab";
-          version = "6.81.0";
-          hash = "sha256-0IN00IpgON/2nNl5/eQn+KABNtmG2ymVULOBPvi2dYA=";
+          version = "6.83.2";
+          hash = "sha256-IsiK3A+aVlYKnTSkgeTz4ZZc1rXiYCKDXPVrJsnSFRk=";
        };
        meta = {
          description = "GitLab extension for Visual Studio Code";
@@ -2906,8 +2906,8 @@ let
        mktplcRef = {
          name = "vscode-ltex-plus";
          publisher = "ltex-plus";
-          version = "15.6.1";
-          hash = "sha256-UOiYjA11P7xqPFgdR7eS63wOQl9dqWAqBxz3nklapqo=";
+          version = "15.7.1";
+          hash = "sha256-wOwOD/rsUdwGJ24n6NkH1XY5Hf4T6LE34nFDOteubLY=";
        };
        meta = {
          description = "VS Code extension for grammar/spell checking using LanguageTool with support for LaTeX, Markdown, and others";
@@ -5266,8 +5266,8 @@ let
        mktplcRef = {
          name = "csharp-ls";
          publisher = "vytautassurvila";
-          version = "0.0.32";
-          hash = "sha256-dc7aIUb+5fdmqVeHrysy8jjk0Sx6ThIsO9KagdQpx+M=";
+          version = "0.0.33";
+          hash = "sha256-VsNjdPmnstXgmgxzbC7+IGFggfLtYlQFsH3tGWjdUhM=";
        };
        meta = {
          changelog = "https://github.com/vytautassurvila/vscode-csharp-ls/blob/master/CHANGELOG.md";
@@ -1,4 +1,5 @@
 {
+  stdenvNoCC,
  lib,
  vscode-utils,
  vscode-extension-update-script,
@@ -13,7 +14,12 @@ vscode-utils.buildVscodeMarketplaceExtension {
    name = "harper";
    publisher = "elijah-potter";
    version = harper.version;
-    hash = "sha256-nK97C9ZYSI6dh4w1ntDP0mbmv6ez3pyAfv/4D30I2sA=";
+
+    # Because the binary is removed in favor of the harper package,
+    # it does not matter which binary is fetched. Using only a single
+    # hash makes this easier to maintain.
+    arch = "linux-x64";
+    hash = "sha256-xCkGgDc2XfM1A2RkXC4CiMadVCuizrCqR7ZKAjh34RE=";
  };

  nativeBuildInputs = [
@@ -23,8 +29,11 @@ vscode-utils.buildVscodeMarketplaceExtension {

  postInstall = ''
    cd "$out/$installPrefix"
-    jq '.contributes.configuration.properties."harper.path".default = "${harper}/bin/harper-ls"' package.json | sponge package.json
+    jq '.contributes.configuration.properties."harper.path".default = "${lib.getExe harper}"' package.json | sponge package.json
+
+    rm ./bin/harper-ls
  '';
+
  passthru.updateScript = vscode-extension-update-script { };

  meta = {
@@ -34,5 +43,11 @@ vscode-utils.buildVscodeMarketplaceExtension {
    homepage = "https://github.com/automattic/harper";
    license = lib.licenses.asl20;
    maintainers = with lib.maintainers; [ MasterEvarior ];
+    platforms = [
+      "x86_64-linux"
+      "aarch64-linux"
+      "x86_64-darwin"
+      "aarch64-darwin"
+    ];
  };
 }
@@ -13,26 +13,26 @@ vscode-utils.buildVscodeMarketplaceExtension {
      sources = {
        "x86_64-linux" = {
          arch = "linux-x64";
-          hash = "sha256-VZKvoTJ/IKxYsEJl0XhtglsggmrYdaRUlXCpDv/9fQ0=";
+          hash = "sha256-htZGjy7ZnQLGZUncokGaGHyLpvPM5jzWUvCdnfN1vbM=";
        };
        "x86_64-darwin" = {
          arch = "darwin-x64";
-          hash = "sha256-jo+fET/IyOl2zI/xxYy3KwnyOegTOXFhO1hDg5QtWrQ=";
+          hash = "sha256-OFdrXunh63xBZW/HwDDjj17TTiOLGY1Enb6ARxNc4bI=";
        };
        "aarch64-linux" = {
          arch = "linux-arm64";
-          hash = "sha256-HOSKZjozJlWn++P5bSwWdK3I+fgsPtS8kyvDWHMJQAY=";
+          hash = "sha256-rgeNJbl6G2yKAWYW7NarQwVLmd3oZ4YTOVeCUat6ZqQ=";
        };
        "aarch64-darwin" = {
          arch = "darwin-arm64";
-          hash = "sha256-ABBYsSR3HQgSnnXUJXsg1DwqwFj9W6CT59/1fuqWsTc=";
+          hash = "sha256-YBapB9XZ1/fUOflFDxZGT9rnPTumHQR/PfmyISHAAkY=";
        };
      };
    in
    {
      name = "visualjj";
      publisher = "visualjj";
-      version = "0.29.0";
+      version = "0.30.0";
    }
    // sources.${stdenvNoCC.hostPlatform.system}
      or (throw "Unsupported system ${stdenvNoCC.hostPlatform.system}");
@@ -48,8 +48,9 @@ vscode-utils.buildVscodeMarketplaceExtension {

  meta = {
    description = "Jujutsu version control integration, for simpler Git workflow";
-    downloadPage = "https://www.visualjj.com";
    homepage = "https://www.visualjj.com";
+    downloadPage = "https://marketplace.visualstudio.com/items?itemName=visualjj.visualjj";
+    changelog = "https://marketplace.visualstudio.com/items/visualjj.visualjj/changelog";
    license = lib.licenses.unfree;
    platforms = [
      "aarch64-linux"
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "fbneo";
-  version = "0-unstable-2026-06-12";
+  version = "0-unstable-2026-06-22";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "fbneo";
-    rev = "9723c47c2d782ccb8cf48f96568a89a44631e6ba";
-    hash = "sha256-zYIC0up0tkvq0TLjSiypxwSTYAF1XnmHXsUTKsUQejA=";
+    rev = "845a1fd30f895ab69669f03c97eb5cfbf0f8d97a";
+    hash = "sha256-fy6LSeOlIQkrLGnMQhXSR4EwC+4crAirQKnWt+7S1cI=";
  };

  makefile = "Makefile";
@@ -9,13 +9,13 @@
 }:
 mkLibretroCore {
  core = "mame";
-  version = "0-unstable-2026-06-10";
+  version = "0-unstable-2026-06-16";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "mame";
-    rev = "e126237dcf44622deaf18e7668f07ba96c363673";
-    hash = "sha256-6M4revCs32ffmUjhl10nL/MsVl8QRn6JQmC7NzDW1Mo=";
+    rev = "0108c5ef3a2261a20c54186ce76cfb4d9ea384a4";
+    hash = "sha256-O/L6+JFCOZtRec40S4xMaKh7A8HteZ5L8GQjrhhRfUw=";
    fetchSubmodules = true;
  };

@@ -7,13 +7,13 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "alacritty-theme";
-  version = "0-unstable-2026-05-01";
+  version = "0-unstable-2026-06-12";

  src = fetchFromGitHub {
    owner = "alacritty";
    repo = "alacritty-theme";
-    rev = "2749b407b597790e6f08b218c2bc2acdf66210a0";
-    hash = "sha256-vcacyCQ8XqnDUQ/rx+FBdcKHDfvkxUszIJRZZsvauag=";
+    rev = "659d2e1d669cd5722f11e58c44fd45dc26a6ffcd";
+    hash = "sha256-1GMpnDdfzBIMm9fzQjxYgLNUGA3amvGYgO3VRcd49ro=";
    sparseCheckout = [ "themes" ];
  };

@@ -7,16 +7,16 @@

 buildNpmPackage rec {
  pname = "all-the-package-names";
-  version = "2.0.2469";
+  version = "2.0.2479";

  src = fetchFromGitHub {
    owner = "nice-registry";
    repo = "all-the-package-names";
    tag = "v${version}";
-    hash = "sha256-niA8ruXOnYXrjJcciwtl1oYTuYze7ii78XxBviTJ4LE=";
+    hash = "sha256-qaqqzlAV1l43CKZq3mDEwzG1MSrrvdtI8xjo+pe8cMQ=";
  };

-  npmDepsHash = "sha256-DXm6gsQltoqo7A2rRwRO6d7XtlHVf1hotAZ1BYvOqSA=";
+  npmDepsHash = "sha256-QjOHebjiF1R24NVM/2u+UHEplzlyQdjzJKQbzltHTkM=";

  passthru.updateScript = nix-update-script { };

@@ -12,13 +12,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "anytone-emu";
-  version = "0.4.1";
+  version = "0.4.2";

  src = fetchFromGitHub {
    owner = "dmr-tools";
    repo = "anytone-emu";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-RTYLtVCKP2TW7Ery51POEZuCtyRhkgKhoDhJPe18y80=";
+    hash = "sha256-MdxnToDWnF7bLEv9wQpHUCo58RJi54q2tn2ToXOB954=";
  };

  nativeBuildInputs = [
@@ -0,0 +1,33 @@
+{
+  lib,
+  appimageTools,
+  fetchurl,
+  nix-update-script,
+}:
+let
+  pname = "archon-lite";
+  version = "9.3.85";
+  src = fetchurl {
+    url = "https://github.com/RPGLogs/Uploaders-archon-lite/releases/download/v${version}/archon-lite-v${version}.AppImage";
+    hash = "sha256-ooNvgbtV6HKgzRLgHZul92NLnEB8oX6fHL6iwfHajVA=";
+  };
+in
+appimageTools.wrapType2 {
+  inherit pname version src;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Application for uploading MMORPG combat logs";
+    homepage = "https://www.archon.gg/download";
+    downloadPage = "https://github.com/RPGLogs/Uploaders-archon-lite/releases/tag/v${version}";
+    license = lib.licenses.unfree; # no license listed
+    mainProgram = "archon-lite";
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [
+      hekazu
+      sophiebsw
+    ];
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+  };
+}
@@ -7,13 +7,13 @@

 buildGoModule (finalAttrs: {
  pname = "bobgen";
-  version = "0.45.0";
+  version = "0.46.0";

  src = fetchFromGitHub {
    owner = "stephenafamo";
    repo = "bob";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-dmZ9aOiVn0QEBvPwulvFEisZRw0PIid7NH22gD3Yzuc=";
+    hash = "sha256-pWuX6TDwf8JcOamDImx/0knN1lx4lkovouRmEA2fTWA=";
  };

  vendorHash = "sha256-WzSUUgfWGz5XXq3iQrtpF91yOEr0QypTWq1rOJMntGQ=";
@@ -24,19 +24,19 @@
  unar,
  unzip,
  vala,
-  # webkitgtk_4_0,
+  webkitgtk_4_1,
  wrapGAppsHook3,
 }:

 stdenv.mkDerivation {
  pname = "bookworm";
-  version = "unstable-2022-01-09";
+  version = "unstable-2026-05-28";

  src = fetchFromGitHub {
    owner = "babluboy";
    repo = "bookworm";
-    rev = "f3df858ce748a6bbc43f03a6e261ff76a6d7d303";
-    hash = "sha256-mLyJfblF5WnWBV3rX1ZRupccou4t5mBpo3W7+ECNMVI=";
+    rev = "fa06f1b80bb2372c1f20b0cfb21dc88eed410e29";
+    hash = "sha256-xml6jOE0tJBz1CwE+0ecSbiGAajh398bw+leFapctiE=";
  };

  nativeBuildInputs = [
@@ -60,12 +60,18 @@ stdenv.mkDerivation {
    poppler
    python3
    sqlite
-    # webkitgtk_4_0
+    webkitgtk_4_1
  ];

  postPatch = ''
    chmod +x meson/post_install.py
    patchShebangs meson/post_install.py
+    substituteInPlace meson.build \
+      --replace-fail "webkit2gtk-4.0" "webkit2gtk-4.1"
+    substituteInPlace src/window.vala \
+      --replace-fail "Soup.URI.decode" "Uri.unescape_string"
+    substituteInPlace src/utils.vala \
+      --replace-fail "Soup.URI.decode" "Uri.unescape_string"
  '';

  # These programs are expected in PATH from the source code and scripts
@@ -92,8 +98,6 @@ stdenv.mkDerivation {
  '';

  meta = {
-    # webkitgtk_4_0 was removed
-    broken = true;
    description = "Simple, focused eBook reader";
    mainProgram = "com.github.babluboy.bookworm";
    longDescription = ''
@@ -11,13 +11,13 @@

 buildGoModule (finalAttrs: {
  pname = "boring";
-  version = "0.15.0";
+  version = "0.16.0";

  src = fetchFromGitHub {
    owner = "alebeck";
    repo = "boring";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-WdohrSeq2N1zDQlYnwIMn1FF3IIb3zAiLSuOOf2GioU=";
+    hash = "sha256-PU/DwYgP8pcBc21GwuMMiQIzdU4BhBvHzk9YrktYo1Y=";
  };

  nativeBuildInputs = [
@@ -14,16 +14,16 @@
 }:
 buildGoModule (finalAttrs: {
  pname = "buildkite-agent";
-  version = "3.127.2";
+  version = "3.128.0";

  src = fetchFromGitHub {
    owner = "buildkite";
    repo = "agent";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-dSG/F/KtV4nBpm2EeXjGI/2uM2/CgRkjYq5uq7+vZVw=";
+    hash = "sha256-fBiIp9EyzIfoW4IbUZkePuBDyZRRWLGRClL57nio22E=";
  };

-  vendorHash = "sha256-N4m7Dak0EBkbJtOjatv0GQKsdxt0B/fZn08T9HpAXDA=";
+  vendorHash = "sha256-lRh5cAbg2yr+nvIaSRg3tG0tLvl7aDjyIoIjS1BvXNM=";

  postPatch = ''
    substituteInPlace clicommand/agent_start.go --replace /bin/bash ${bash}/bin/bash
@@ -6,13 +6,13 @@

 buildGoModule (finalAttrs: {
  pname = "cdncheck";
-  version = "1.2.40";
+  version = "1.2.41";

  src = fetchFromGitHub {
    owner = "projectdiscovery";
    repo = "cdncheck";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-awlLfO9YvsRwLRguCB+qDBYuqRkQb2Z+8gdTvzwDQYs=";
+    hash = "sha256-8mlF05SlLp0z2hzMFynt/sEi/Uc+Z4eLBP2usacEcH4=";
  };

  vendorHash = "sha256-iJ1agL7sZ3ZKbW1wMA+qi8FgHdPa6gZLQ5BBPKJTNaQ=";
@@ -8,17 +8,17 @@
 }:

 maven.buildMavenPackage (finalAttrs: {
-  version = "13.5.0";
+  version = "13.6.0";
  pname = "checkstyle";

  src = fetchFromGitHub {
    owner = "checkstyle";
    repo = "checkstyle";
    tag = "checkstyle-${finalAttrs.version}";
-    hash = "sha256-2v6ccNG4t8cXObMdztX+Y+PVuiqt4Fd5IR7j5bk5IaA=";
+    hash = "sha256-5E3GTE4fPmJYoSm2lK4tW1Dcu+SuyQKL396JLg3J22E=";
  };

-  mvnHash = "sha256-M830+mpd7fAbzZGUQiTJZUKPe64zYUKp6QRqTrSOy7w=";
+  mvnHash = "sha256-r0adD/80UguRCIznE6hGdhRifm29GxMhQRSmd2/nabc=";

  nativeBuildInputs = [
    maven
@@ -19,14 +19,14 @@

 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "cine";
-  version = "1.4.1";
+  version = "1.5.1";
  pyproject = false;

  src = fetchFromGitHub {
    owner = "diegopvlk";
    repo = "Cine";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-XB7DrFASIivCDvcNnuiVRI4xnkj0rOzHnD5z1AugGdQ=";
+    hash = "sha256-p+jlza4FKXfONYLXQKIxoP62KLKau9A8qVmHRQHq2GM=";
    fetchSubmodules = true;
  };

@@ -1,47 +1,47 @@
 {
-  "version": "2.1.179",
-  "commit": "8c865e06ae1320b1c9b005bdeb6f6589ada9d0b3",
-  "buildDate": "2026-06-16T02:06:40Z",
+  "version": "2.1.185",
+  "commit": "9d0bb50cc439a8bbfdbf96567a55bd0e353e9333",
+  "buildDate": "2026-06-20T06:46:16Z",
  "platforms": {
    "darwin-arm64": {
      "binary": "claude",
-      "checksum": "af2a2d0cb99b0e8b094bc5dbe114ed2d5b2d27ba440987ef6f2f209da9954253",
-      "size": 226082208
+      "checksum": "a280c23b210525218f5bd86f001c9dbc89b9e07410175c5a9355044bfadc0af1",
+      "size": 215952608
    },
    "darwin-x64": {
      "binary": "claude",
-      "checksum": "a0ad60761294bd208eda6cb0fd8e896c64397c8d317546a696c5e627782ec8cb",
-      "size": 228600496
+      "checksum": "ade7a13c3027f754b4cdac80bcdd6ba470f7becb27cdcf8b6ba9a70cf9e77af7",
+      "size": 223491328
    },
    "linux-arm64": {
      "binary": "claude",
-      "checksum": "25d2eba2351df153f872a8e19289f5042a26b430cd446564bd92a0dec5d681cd",
-      "size": 251311752
+      "checksum": "db880812272504455df73160d92fadf9370eda684c219cebf8e62b0a262cb2f8",
+      "size": 230930144
    },
    "linux-x64": {
      "binary": "claude",
-      "checksum": "6d8422de5ac8ac2077b20e2a6307083f85609aaf45f8c783ec2f7d71e8781e70",
-      "size": 251418320
+      "checksum": "e1246338699f04ee0e627dee3f6d4ed7a0bab48e0514bde69c6dad43bc303952",
+      "size": 233584424
    },
    "linux-arm64-musl": {
      "binary": "claude",
-      "checksum": "8273ab58b79a6324fa8d56361cd394a4ffa5d30f28be3abecaafb2596d7ae2ee",
-      "size": 244166488
+      "checksum": "eada6422a437a112d1928cb9e80203180b58b3d0c0c6aee1edb6f041fda39415",
+      "size": 224309448
    },
    "linux-x64-musl": {
      "binary": "claude",
-      "checksum": "891b13f5aa5a798c209b13ce9c556c9a9162b6ad574eea97b223c80e4ee1d9dd",
-      "size": 245828656
+      "checksum": "5f12eea1e3fd35bfa3f75db0647189bdfe64f45ab0d69e76a427d38ce684dd38",
+      "size": 228568464
    },
    "win32-x64": {
      "binary": "claude.exe",
-      "checksum": "1025f57fb260a3adac9517eb643c78c67e756c1ef5514d9ad8c57d5d784f8be3",
-      "size": 246756512
+      "checksum": "0206cfb94a323d91e0ff51edf63c9e4d9951c8e48dbdee627fefa6f6a0b56643",
+      "size": 225108640
    },
    "win32-arm64": {
      "binary": "claude.exe",
-      "checksum": "0320d4b49e3d434fcf94cf1a73e4d7e95df831a22c2c94d2a0cd471a59a27eac",
-      "size": 242721440
+      "checksum": "b42889d60c89cb0a65dd4d047ad4396304f01368693f968d1827c08474eccc59",
+      "size": 219771552
    }
  }
 }
@@ -7,16 +7,16 @@

 buildGoModule (finalAttrs: {
  pname = "cloud-nuke";
-  version = "0.51.0";
+  version = "0.52.0";

  src = fetchFromGitHub {
    owner = "gruntwork-io";
    repo = "cloud-nuke";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-tJi3SFBp/zuBB+0S0IOIWqvZRWdlSyJra8K4meJHXnY=";
+    hash = "sha256-UW6n1TFKkricWX71/zHGwLY+0fLtZRkAUU8bQQc5Lwg=";
  };

-  vendorHash = "sha256-1DMwVJvr3zU96yAV2Vb4v58VNt7xg9dLCH7XGEMopjQ=";
+  vendorHash = "sha256-ztaQ4PnBk5lr5PXK6O0MYt+dUNKIxB+/gpGZ4izaqWs=";

  nativeBuildInputs = [
    makeBinaryWrapper
@@ -7,16 +7,16 @@

 buildNpmPackage {
  pname = "coc-clangd";
-  version = "0-unstable-2026-06-02";
+  version = "0-unstable-2026-06-13";

  src = fetchFromGitHub {
    owner = "clangd";
    repo = "coc-clangd";
-    rev = "93926afd0beb4ac9beabddbac8b14743e2762fa9";
-    hash = "sha256-03VgcaJ+EZmRXxKcWaHO9kVb9dmIGI30CiJNDkjp3CY=";
+    rev = "45d66ce2ed6caf5f5ced672d6b45a41e90dd623f";
+    hash = "sha256-QmC8USEHBzuC2NcVjjAsPXpg9ClW28+E+cadNhdXLg0=";
  };

-  npmDepsHash = "sha256-YoFfBQjWvJZ1Xj9dkNmtb7jZI43eFf9O/WZDwOBejdo=";
+  npmDepsHash = "sha256-2tpijK2jAPZNrS2h5beUgEsPE2UXAodvE496K2kKz3w=";

  passthru.updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; };

@@ -7,16 +7,16 @@

 buildNpmPackage {
  pname = "coc-markdownlint";
-  version = "0-unstable-2026-06-02";
+  version = "0-unstable-2026-06-17";

  src = fetchFromGitHub {
    owner = "fannheyward";
    repo = "coc-markdownlint";
-    rev = "9722582fc3dbff43535d6ba643df6f1c1211f2a7";
-    hash = "sha256-oOGLxK9A46HVaqmmdHN9SisplhOkvegAunx5IWvOyDo=";
+    rev = "56458cb4ffe81f70e23fafef276dc5eaf8e74061";
+    hash = "sha256-FUWJoT8h/Hz8cOUY71TLDYCsWXPxWdT0NNdrhryOlWA=";
  };

-  npmDepsHash = "sha256-s8MXIzIbq24UZ+SbLummedG6+4rvTRadCeWB8UiPlXM=";
+  npmDepsHash = "sha256-MuWfnvRWJXEnIa46WBrnhqKHzPe0TAOWuBOMK3XsxcM=";

  passthru.updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; };

@@ -7,16 +7,16 @@

 buildNpmPackage {
  pname = "coc-rust-analyzer";
-  version = "0-unstable-2026-06-09";
+  version = "0-unstable-2026-06-16";

  src = fetchFromGitHub {
    owner = "fannheyward";
    repo = "coc-rust-analyzer";
-    rev = "cadaeed1edf1bc289c616d21f5818cf835ae45b2";
-    hash = "sha256-eo+3K40JhktADVN2SWJg8AQAXBndx6u2L56ZXGbhqdE=";
+    rev = "832db4c7c99b526bf3608ea40a5a904cae77b691";
+    hash = "sha256-bf3pA4JOCN+BhtIFIHBplHkLqvtdwYKZObrdkw+2v4E=";
  };

-  npmDepsHash = "sha256-4AdpOBXLqWzFQrI7MyWdEqkiE8BuxOV+SmHcFMKlkBk=";
+  npmDepsHash = "sha256-5yOJwuqeW9tyXRmp/G1gEsv4h2OIr3QFYCXZC8pbJQI=";

  passthru.updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; };

@@ -36,18 +36,18 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "coc-texlab";
-  version = "0-unstable-2026-03-11";
+  version = "0-unstable-2026-06-20";

  src = fetchFromGitHub {
    owner = "fannheyward";
    repo = "coc-texlab";
-    rev = "4b0e8626f06a9396767468edd800501929483eda";
-    hash = "sha256-HOZBojd6pqPPeOKeki2Fr23B5ew86ruEvPt9IAOJdMk=";
+    rev = "bd18d69dcc43c95b0cca4b1a75d8b9d7894c19a2";
+    hash = "sha256-gOCs0ztJLlBdLpzzdC72UEXk01RO2d2vSXTawllPLX0=";
  };

  yarnOfflineCache = fetchYarnDeps {
    inherit (finalAttrs) src;
-    hash = "sha256-iAEGe0QZrt+iSkR0MbjsrwpvJz89bP4Xj+NQfsOnL5s=";
+    hash = "sha256-2tjoLsmHDDnmC6f0d9IeK/bWprQJXrwEnGEFK9V4Lg0=";
  };

  nativeBuildInputs = [
@@ -6,16 +6,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cpc";
-  version = "3.0.0";
+  version = "3.1.0";

  src = fetchFromGitHub {
    owner = "probablykasper";
    repo = "cpc";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-DjJIXV5rJxQOiMH8/0yZQBvDh+jbejzADt4WSGyhozI=";
+    hash = "sha256-t9dAk0hIk8P/vt5wfQ5KvLU6f2DAllPy4BfB0q7F7CA=";
  };

-  cargoHash = "sha256-2k+aFrP/PQmlGr3gIF1queDjuo/+3KtnrOrx1+wrqEg=";
+  cargoHash = "sha256-Zb6rnJjhYruoQ7MxCfrx9doDr+hnhCDqhq23xWtdhUY=";

  meta = {
    mainProgram = "cpc";
@@ -7,7 +7,7 @@

 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "daktari";
-  version = "0.0.334";
+  version = "0.0.335";
  pyproject = true;
  __structuredAttrs = true;

@@ -15,7 +15,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
    owner = "genio-learn";
    repo = "daktari";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-UmfR64zG7UHTCp1rh0LWoWNqPTaBqrT/eShggrmW2Yg=";
+    hash = "sha256-yIhtP5k1qoy59qR10Pv6dqh7X8MACvQRsSAJR/6kEJ4=";
  };

  patches = [ ./optional-pyclip.patch ];
@@ -9,13 +9,13 @@

 buildGoModule (finalAttrs: {
  pname = "deck";
-  version = "1.62.1";
+  version = "1.63.0";

  src = fetchFromGitHub {
    owner = "Kong";
    repo = "deck";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-14M0MTfELHvCmkGhzghXTSg1n2gl7S6a4yoGgjLfHzI=";
+    hash = "sha256-WmzjFMOOyx65EGnHdn9pWItFh1HVIp1DbNNwtQrPnPQ=";
  };

  nativeBuildInputs = [ installShellFiles ];
@@ -28,7 +28,7 @@ buildGoModule (finalAttrs: {
  ];

  proxyVendor = true; # darwin/linux hash mismatch
-  vendorHash = "sha256-pUA8GhDX6oQ1z1VvuAZyRf0trDFip5BfqnNcc37tAng=";
+  vendorHash = "sha256-YJ8Q/m+yL9x5CYnIOtYWNYcVUy4lHm/IYSm7kNZqqt4=";

  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
    installShellCompletion --cmd deck \
@@ -1,92 +1,87 @@
 [
  {
    "pname": "AdvancedStringBuilder",
-    "version": "0.1.1",
-    "sha256": "1qc5b9vlh42yyw00kppkrdz0cji0cxslh97794km9nid8wcv3f54"
+    "version": "0.2.0",
+    "hash": "sha256-66bPgNGU/wLpGs9mydkBBlTEJRpvfHDwWEysUsufZJY="
  },
  {
    "pname": "AngleSharp",
-    "version": "1.1.2",
-    "sha256": "0rfild46lmqhxkfh6nhy7a9m8zzv25lj29riav5j6dmzw07l7wif"
+    "version": "1.4.0",
+    "hash": "sha256-xHpoMkhYSj7ejeMmI2e7ygef84QGZhttPjYOnLjITd0="
  },
  {
    "pname": "AsyncKeyedLock",
-    "version": "6.4.2",
-    "sha256": "1pghspgz9xis139b5v8h2y40gp14x6qfcam27zawq6cp278gnjhi"
+    "version": "8.0.2",
+    "hash": "sha256-0NKdC+oxdYxS3Uz1lak5RpdTWyKYT7C3hkCdm5T0D84="
  },
  {
    "pname": "CliFx",
-    "version": "2.3.5",
-    "sha256": "0rlbv93ssw0d8kvhnvrz2f06ka66gz4gbz1va2q135dab99cmrin"
+    "version": "3.0.0",
+    "hash": "sha256-RMHRAQ2SQB8G3GLzG5WGKNkWNJdLCwkedSoT0iKv9gk="
  },
  {
    "pname": "CSharpier.MsBuild",
-    "version": "0.28.2",
-    "sha256": "10c3v3pqv49y5wi0slswfzkwjh9q93diihpmkbfp3r7yjpv6871d"
+    "version": "1.2.6",
+    "hash": "sha256-jvY05AmHK0MO9cbSTwAvAXf4urL+6Df2ug4IKwcleDw="
  },
  {
    "pname": "Deorcify",
-    "version": "1.0.2",
-    "sha256": "0nwxyrl4rd5x621i2hs5fl3w7fxpm13lkdssxr9fd5042px2gqbm"
+    "version": "1.1.0",
+    "hash": "sha256-R3V/9z/dP0LyhMNh+SiHD5j+XGr/DxPo4qwaKB+Fbak="
  },
  {
    "pname": "Gress",
-    "version": "2.1.1",
-    "sha256": "1svz1flhyl26h3xjch0acjjinympgf6bhj5vpb188njfih3ip4ck"
+    "version": "2.2.0",
+    "hash": "sha256-2vzffEFC2NHH5KGXssvlR4rH+e1DrsFMHN+zQcOgyGI="
  },
  {
    "pname": "JsonExtensions",
    "version": "1.2.0",
-    "sha256": "0g54hibabbqqfhxjlnxwv1rxagpali5agvnpymp2w3dk8h6q66xy"
+    "hash": "sha256-vhuDDUSzDS5u9dfup0qk6j7Vc9i8Wyo7dBivpVaEpDw="
  },
  {
    "pname": "Polly",
-    "version": "8.4.0",
-    "sha256": "1zpq6590zpj3sibdhrn3fydqrm9ga43xdxvjv3rwzhigrkddg9zl"
+    "version": "8.6.6",
+    "hash": "sha256-0BrOttCw+HQYB24Y2uMy2vo0P5/txUlhELC8FlyLKps="
  },
  {
    "pname": "Polly.Core",
-    "version": "8.4.0",
-    "sha256": "1gp66r03zqvwwr4nw96n49bfv08bk54qpdbiqgxg93yhfsbsmkg8"
+    "version": "8.6.6",
+    "hash": "sha256-y6/a4OWrUlRfe0J8qdhBRmYRDi6K2y+kwhEVCIUOjvU="
+  },
+  {
+    "pname": "PowerKit",
+    "version": "1.2.0",
+    "hash": "sha256-93mls5CuiOsNRqH+E+MQ/LSV7X2W8o+jOnPP1vvgdp0="
  },
  {
    "pname": "RazorBlade",
-    "version": "0.6.0",
-    "sha256": "11k2j7d7ddb47sj4lkply8v4aqrfxl0b314cv0l4f5syi4ilfa6s"
+    "version": "1.0.0",
+    "hash": "sha256-ieuGwqM8HHtD+llYO3CdVB+fHHvQ6QnQiajttREFOXM="
  },
  {
    "pname": "Spectre.Console",
-    "version": "0.49.1",
-    "sha256": "0fhl96p3xjd5k1wwvhs80cp35rrlgnza6mw9vy0knhmf7ji9b95n"
+    "version": "0.55.2",
+    "hash": "sha256-PmvyqWWej8pT0X/J80Yr9ClMoO96zq7QlJme8AuQ6Tc="
+  },
+  {
+    "pname": "Spectre.Console.Ansi",
+    "version": "0.55.2",
+    "hash": "sha256-ha2TNW1IOgtkr1NUEs6sSlN6t+hwCEccUUiCGwEen9U="
  },
  {
    "pname": "Superpower",
-    "version": "3.0.0",
-    "sha256": "0p6riay4732j1fahc081dzgs9q4z3n2fpxrin4zfpj6q2226dhz4"
-  },
-  {
-    "pname": "System.Text.Encoding.CodePages",
-    "version": "8.0.0",
-    "sha256": "1lgdd78cik4qyvp2fggaa0kzxasw6kc9a6cjqw46siagrm0qnc3y"
-  },
-  {
-    "pname": "System.Text.Encodings.Web",
-    "version": "8.0.0",
-    "sha256": "1wbypkx0m8dgpsaqgyywz4z760xblnwalb241d5qv9kx8m128i11"
-  },
-  {
-    "pname": "System.Text.Json",
-    "version": "8.0.3",
-    "sha256": "0jkl986gnh2a39v5wbab47qyh1g9a64dgh5s67vppcay8hd42c4n"
+    "version": "3.1.0",
+    "hash": "sha256-krsT4LFDHeCjwS0BbkgpBYggpr5Nmc1RXYyOjLqRifQ="
  },
  {
    "pname": "WebMarkupMin.Core",
-    "version": "2.16.0",
-    "sha256": "0cbkgrrkam76bhygrjzd4nj4mpzpgbnsddfzwry1933rcvjlqh6m"
+    "version": "2.21.0",
+    "hash": "sha256-k51tTFcdL9Bwsg3gA51ZswGxDtdBFb22BAj9wbyZu1E="
  },
  {
    "pname": "YoutubeExplode",
-    "version": "6.3.16",
-    "sha256": "1f6d47g1qmmahx6pn2sp0fff7hsmdqwm7z09j47hs6r1yn9a7kyj"
+    "version": "6.6.0",
+    "hash": "sha256-53mPbr8IVmJH2C3euhSz56Bl6fJt5yN0CU6vCmzUs4I="
  }
 ]
@@ -9,19 +9,19 @@

 buildDotnetModule rec {
  pname = "discordchatexporter-cli";
-  version = "2.43.3";
+  version = "2.47.2";

  src = fetchFromGitHub {
    owner = "tyrrrz";
    repo = "discordchatexporter";
    rev = version;
-    hash = "sha256-r9bvTgqKQY605BoUlysSz4WJMxn2ibNh3EhoMYCfV3c=";
+    hash = "sha256-2Sft+8K74vVTpNEgAJ0Y13pn+KiTUdd/5prR1aT6ET4=";
  };

  projectFile = "DiscordChatExporter.Cli/DiscordChatExporter.Cli.csproj";
  nugetDeps = ./deps.json;
-  dotnet-sdk = dotnetCorePackages.sdk_8_0;
-  dotnet-runtime = dotnetCorePackages.runtime_8_0;
+  dotnet-sdk = dotnetCorePackages.sdk_10_0;
+  dotnet-runtime = dotnetCorePackages.runtime_10_0;

  dotnetBuildFlags = [
    # workaround for https://github.com/belav/csharpier/pull/1696
@@ -7,16 +7,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "dumbpipe";
-  version = "0.33.0";
+  version = "0.39.0";

  src = fetchFromGitHub {
    owner = "n0-computer";
    repo = "dumbpipe";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-8iubiYZTOCGD7BjqMDnOi3Or1b7cYffL2HBEikUCXF8=";
+    hash = "sha256-AoWWFlMjo1bZUq5RY4gjpEMydULHaCKSSxBh45a7pdI=";
  };

-  cargoHash = "sha256-nc/xGi+9kX9OAGLs2uTHMp8Z9+6DLKTvVki2RgNAUV0=";
+  cargoHash = "sha256-je2/GjCCDymYGhho6yf7SNQ3YkLCLQ5nEqHPNdDXjbQ=";

  __darwinAllowLocalNetworking = true;

@@ -10,16 +10,16 @@

 buildGoModule (finalAttrs: {
  pname = "dutctl";
-  version = "1.0.0-alpha.1-unstable-2026-06-03";
+  version = "1.0.0-alpha.1-unstable-2026-06-11";

  src = fetchFromGitHub {
    owner = "BlindspotSoftware";
    repo = "dutctl";
-    rev = "f2b5ea834299c5716a90662549fcef64408df0f9";
-    hash = "sha256-lw8qkhXt2ZpgyZdfpJVLxr/7UxTcmhFg3fXKI/z9F40=";
+    rev = "416a8d169880883345531a2f67ec71a65f41b474";
+    hash = "sha256-Y4bILPe7PBCHsBbgI6ckqdh0S4UBh1z8vpDs/CIyYxg=";
  };

-  vendorHash = "sha256-vOBz9gi/cnUJ04ns1ZOgfNqzbVBE3Fd3oOfV04VSmFQ=";
+  vendorHash = "sha256-s0pRzcueJCwUP5+ckRMYTc9FPYGqQiILGIuwQ83EhIM=";

  ldflags = [
    "-s"
@@ -107,7 +107,7 @@ buildDotnetModule (finalAttrs: {
    cp src/Lib.Platform.Linux.Native/bin/libLib.Platform.Linux.Native.so $out/lib/eddie-ui
    cp src/App.Forms.Linux.Tray/bin/eddie-tray $out/lib/eddie-ui

-    ln -s $out/lib/eddie-ui/eddie-cli-elevated $out/lib/eddie/eddie-cli-elevated
+    cp $out/lib/eddie-ui/eddie-cli-elevated $out/lib/eddie/eddie-cli-elevated
    ln -s $out/lib/eddie-ui/libLib.Platform.Linux.Native.so $out/lib/eddie/Lib.Platform.Linux.Native.so

    cp -r src/App.Forms.Linux/bin/*/Release/* $out/lib/eddie-ui
@@ -7,12 +7,12 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "eliza";
-  version = "0-unstable-2026-06-09";
+  version = "0-unstable-2026-06-13";
  src = fetchFromGitHub {
    owner = "anthay";
    repo = "ELIZA";
-    rev = "ed26676c8903892945c549ae58722c4d355555b0";
-    hash = "sha256-M2Qy+QeBPkQNx9hn2FZ2d5cUh532e+C/x8EJSgntO9Q=";
+    rev = "8e93cb50107a4c6c854e96b533a36958ac934d3f";
+    hash = "sha256-KRw5ow/34A0GANUoCLM3xOhMc4dlzTWpVqWcsgruTCE=";
  };

  doCheck = true;
@@ -7,13 +7,13 @@
 }:
 llvmPackages.stdenv.mkDerivation rec {
  pname = "enzyme";
-  version = "0.0.267";
+  version = "0.0.271";

  src = fetchFromGitHub {
    owner = "EnzymeAD";
    repo = "Enzyme";
    rev = "v${version}";
-    hash = "sha256-FoL4m7dxGS05f4fksOYmVyFoS9tlFTc6/v+lB497hog=";
+    hash = "sha256-R3hdy6VSTHBe2ei4aysJhrc++ptQioVe88p/c2CuUP4=";
  };

  postPatch = ''
@@ -3,33 +3,36 @@
  buildNpmPackage,
  fetchFromGitHub,
  nix-update-script,
+  # webpack,
 }:
 buildNpmPackage (finalAttrs: {
  pname = "eslint";
-  version = "10.4.1";
+  version = "10.5.0";

  src = fetchFromGitHub {
    owner = "eslint";
    repo = "eslint";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-/gNNO8r2QmvfVS28aF3hsWqCz157pInDVlPxy+xq0hA=";
+    hash = "sha256-mhDOWOp9l42wwMFOFGZwI0Voc1+e5slcXVGh82Nebwg=";
  };

  # NOTE: Generating lock-file
-  # arch = [ x64 arm64 ]
-  # platform = [ darwin linux]
-  # npm install --package-lock-only --arch=<arch> --platform=<os>
-  # darwin seems to generate a cross platform compatible lockfile
+  # npm install --package-lock-only
  postPatch = ''
    cp ${./package-lock.json} package-lock.json
  '';

-  npmDepsHash = "sha256-OJ/xO2zJk0N4SmKYXCjiqcBc8B+wJKTKDE52ag6ODeo=";
+  npmDepsHash = "sha256-0quy/i4PeyDwNqQsbeebFxz616c/a+1f0XT7tbHgVXM=";
  npmInstallFlags = [ "--omit=dev" ];

  dontNpmBuild = true;
  dontNpmPrune = true;

+  # Delete dangling symlinks
+  preFixup = ''
+    rm $out/lib/node_modules/eslint/node_modules/{eslint-config-eslint,@eslint/js}
+  '';
+
  passthru.updateScript = nix-update-script {
    extraArgs = [ "--generate-lockfile" ];
  };
@@ -28,13 +28,13 @@

 stdenv.mkDerivation rec {
  pname = "fcitx5-gtk";
-  version = "5.1.6";
+  version = "5.1.7";

  src = fetchFromGitHub {
    owner = "fcitx";
    repo = pname;
    rev = version;
-    hash = "sha256-4v3XWXXlTYOO2/SKnEBTr5WsGxqFLjsPgCE7goVrFGY=";
+    hash = "sha256-ddXMkk1pQhFCOSzDbRWi/VDWtxqqKhMM4AnVFBGCOyA=";
  };

  outputs = [
@@ -16,7 +16,7 @@ in

 stdenv.mkDerivation (finalAttrs: {
  pname = "fcitx5-lua";
-  version = "5.0.16";
+  version = "5.0.17";

  __structuredAttrs = true;

@@ -24,7 +24,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "fcitx";
    repo = "fcitx5-lua";
    tag = finalAttrs.version;
-    hash = "sha256-df0BjORGT+zx/8kg/nGPDa9MBAXpPtdfx8S5O+E31wE=";
+    hash = "sha256-uEWa1wprWT8vDSHKXHUHEmXBtNHgj94hFuKvBm5GXqc=";
  };

  nativeBuildInputs = [
@@ -16,11 +16,11 @@

 stdenv.mkDerivation rec {
  pname = "fcitx5-rime";
-  version = "5.1.13";
+  version = "5.1.14";

  src = fetchurl {
    url = "https://download.fcitx-im.org/fcitx5/${pname}/${pname}-${version}.tar.zst";
-    hash = "sha256-KB4IOLq6mRB1ZnOPg4Avpk6vp29xbLkDGYXvCdtrjA8=";
+    hash = "sha256-dHiBH74dTnzabm23TrDAXV/oHSGMqdyBtrf0uyuwjWI=";
  };

  cmakeFlags = [
@@ -13,13 +13,13 @@

 stdenv.mkDerivation rec {
  pname = "fcitx5-table-extra";
-  version = "5.1.11";
+  version = "5.1.12";

  src = fetchFromGitHub {
    owner = "fcitx";
    repo = pname;
    rev = version;
-    hash = "sha256-Oigygr486SNYssre8rMDRDzn28hVI8pabm+0/eoR94Y=";
+    hash = "sha256-PNljzjvT5WWoEPH7HbOcO9lDRkZHqiNXbaCifBKw5LI=";
  };

  nativeBuildInputs = [
@@ -12,13 +12,13 @@

 stdenv.mkDerivation rec {
  pname = "fcitx5-table-other";
-  version = "5.1.6";
+  version = "5.1.7";

  src = fetchFromGitHub {
    owner = "fcitx";
    repo = pname;
    rev = version;
-    hash = "sha256-hqFui1Ycxih7I7VjUjfJe6V5I9RyamyNi6aZKcWGrWU=";
+    hash = "sha256-PoYDy0p/vflwVr5yCox2uSvr4ir6k2Yn1AQHmTw03Zk=";
  };

  nativeBuildInputs = [
@@ -11,17 +11,17 @@

 buildNpmPackage rec {
  pname = "firebase-tools";
-  version = "15.19.1";
+  version = "15.22.0";
  nodejs = nodejs_22;

  src = fetchFromGitHub {
    owner = "firebase";
    repo = "firebase-tools";
    tag = "v${version}";
-    hash = "sha256-ofKgbByTlQgU0qVxsAdnOLruZwboHqEmBIOHmptEUcY=";
+    hash = "sha256-5T6JTuKS/SvFUTabMGoH7okIkxwZOcxlDAEBGWZ4VyU=";
  };

-  npmDepsHash = "sha256-1F1jMl8JFWf/f6smd30W3GQvuoxHtappDOnh3P67/08=";
+  npmDepsHash = "sha256-hNe46VmfSQx7XwxYWaox+FF15AagRTJk7OjP8y8j8Jo=";

  # No more package-lock.json in upstream src
  postPatch = ''
@@ -80,7 +80,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "flatpak";
-  version = "1.16.6";
+  version = "1.18.0";

  # TODO: split out lib once we figure out what to do with triggerdir
  outputs = [
@@ -98,7 +98,7 @@ stdenv.mkDerivation (finalAttrs: {

  src = fetchurl {
    url = "https://github.com/flatpak/flatpak/releases/download/${finalAttrs.version}/flatpak-${finalAttrs.version}.tar.xz";
-    hash = "sha256-HmPn8/5EtgLzTZKm/kb9ijvGvpRgwDwmgeV5dsZY7sM=";
+    hash = "sha256-pYV6ZsQDndoF2SvcsrAz14jNJYlhAWfw7F8OyNT6xvI=";
  };

  patches = [
@@ -67,6 +67,7 @@ buildGoModule (finalAttrs: {
    libraryPath = symlinkJoin {
      name = "eduroam-gui-puregotk-lib";
      # based on https://github.com/jwijenbergh/puregotk/blob/bc1a52f44fd4c491947f7af85296c66173da17ba/internal/core/core.go#L41
+      # cat "$(nix-build . -A geteduroam.goModules)"/*/*/puregotk/v4/*/*.go | grep -E 'SetSharedLibraries\(.*\)' -o | cut -d'"' -f4 | sort -u
      paths = [
        cairo
        gdk-pixbuf
@@ -13,13 +13,13 @@

 buildGoModule (finalAttrs: {
  pname = "git-town";
-  version = "23.0.2";
+  version = "23.0.3";

  src = fetchFromGitHub {
    owner = "git-town";
    repo = "git-town";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-FwwyX/Ncl8zCR1+/A49VIugESU1YFgDcQYbO8w84Lm0=";
+    hash = "sha256-vw8S1Y9yXERL9Ddt70Elz0pZZHAuC+C9231Y8o1mb9k=";
  };

  vendorHash = null;
@@ -18,16 +18,16 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "gitoxide";
-  version = "0.54.0";
+  version = "0.55.0";

  src = fetchFromGitHub {
    owner = "GitoxideLabs";
    repo = "gitoxide";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-MkOmxvACroJAB1nQZT1pcJ/Fn9gWNFwKiwVNb9iUlgY=";
+    hash = "sha256-UtdXlIvX82UUhc4RWZZTBV5kz4YqfOTd4D/pGhDUfSI=";
  };

-  cargoHash = "sha256-bYgGQa8Gym4dzkuTrOSu3NwUhYdZNtq7ACwVwhdKQRI=";
+  cargoHash = "sha256-Kv0NKA3OdHBn2M8DmcGyjcN2acGJYOdbczOb/nRsvDs=";

  nativeBuildInputs = [
    cmake
@@ -6,16 +6,16 @@

 buildGoModule (finalAttrs: {
  pname = "go-audit";
-  version = "1.2.1";
+  version = "1.2.2";

  src = fetchFromGitHub {
    owner = "slackhq";
    repo = "go-audit";
    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-VzxFhaeETmhjYWBLQil10OhV4k8w6EHfV0qnun73gb0=";
+    sha256 = "sha256-Si8OuvQOyRN17DJC3mvFS7xkpbID8zcAD8n44VSLsTA=";
  };

-  vendorHash = "sha256-g5NP5QY8kNPQLLT9GGqHIQXkaBoZ+Wqna7KknCIwBNM=";
+  vendorHash = "sha256-eUuLLpF8p7nTiddRy0hlqZ+n+OyvyJ1D20X1jvqKVC8=";

  # Tests need network access
  doCheck = false;
@@ -6,16 +6,16 @@

 buildGoModule (finalAttrs: {
  pname = "gosec";
-  version = "2.27.0";
+  version = "2.27.1";

  src = fetchFromGitHub {
    owner = "securego";
    repo = "gosec";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-X+jF98POuFlHY6PjTn3t3GQHwNDgHKW4ZnzN9LjjunE=";
+    hash = "sha256-k4zroP/kqOJe8xdbOSC26cfHGqUoXlJY66MP5s/Saq0=";
  };

-  vendorHash = "sha256-kgUM93dbZMdj039kmtjo/DGQdVCe0UhSb1ucZF3Xjeg=";
+  vendorHash = "sha256-lkaIDS7jrRIXxIvE2/EfM3tTP0cAb58AnzCsrBO955A=";

  subPackages = [
    "cmd/gosec"
@@ -4,6 +4,7 @@
  fetchFromGitHub,
  nix-update-script,
  versionCheckHook,
+  vscode-extensions,
 }:

 rustPlatform.buildRustPackage (finalAttrs: {
@@ -29,7 +30,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
    "--package=harper-ls"
  ];

-  passthru.updateScript = nix-update-script { };
+  passthru = {
+    tests = vscode-extensions.elijah-potter.harper;
+    updateScript = nix-update-script { };
+  };

  nativeInstallCheckInputs = [
    versionCheckHook
@@ -9,13 +9,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "highscore-bsnes";
-  version = "0-unstable-2026-02-17";
+  version = "0-unstable-2026-05-27";

  src = fetchFromGitHub {
    owner = "highscore-emu";
    repo = "bsnes";
-    rev = "db1f255622b3410485a54c7c0097c747e7144091";
-    hash = "sha256-SZugEb/vzFlzHjgHE/5ha03ULB95886N0b15iIlTsqA=";
+    rev = "d4ced9599ac8ffcd006104783c5e7e7e6a1d5a29";
+    hash = "sha256-F9YELVKl/6rBOHaec79kSZ+/6fewbFVBZW8HNGr8ts4=";
  };

  sourceRoot = "${finalAttrs.src.name}/bsnes";
@@ -10,13 +10,13 @@

 stdenv.mkDerivation {
  pname = "highscore-mgba";
-  version = "0-unstable-2026-06-02";
+  version = "0-unstable-2026-06-19";

  src = fetchFromGitHub {
    owner = "highscore-emu";
    repo = "mgba";
-    rev = "0a595ca5728ed740fa94b705a49eda304d1217a8";
-    hash = "sha256-ALtMF2SOhR+/00NFFWNy4jII2zCFtPunhndOY04il5g=";
+    rev = "cd3561415f98421e3369c47d6da1baca2bc85f75";
+    hash = "sha256-Ek76XTB5y/COiiOCz4v11+TqMus2qrngoVsdya6lJ6k=";
  };

  outputs = [
@@ -12,13 +12,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "highscore-sameboy";
-  version = "0-unstable-2026-04-01";
+  version = "0-unstable-2026-06-16";

  src = fetchFromGitHub {
    owner = "highscore-emu";
    repo = "SameBoy";
-    rev = "f59693cc4f1f3ac547eaf25856574fb850c1da61";
-    hash = "sha256-GzBTB3lqWi+Cw24fFVN9YBa3ecOA5G9756RWM6mMxvA=";
+    rev = "10703e58fde906df5cd80b81a104b959880bed42";
+    hash = "sha256-jpMY40f3xUMl2ZJPH815F0hRqnYiEtm17KYHHLVk4jk=";
  };

  sourceRoot = "${finalAttrs.src.name}/highscore";
@@ -8,7 +8,7 @@

 buildGoModule (finalAttrs: {
  pname = "k8sgpt";
-  version = "0.4.33";
+  version = "0.4.34";

  nativeBuildInputs = [
    installShellFiles
@@ -18,10 +18,10 @@ buildGoModule (finalAttrs: {
    owner = "k8sgpt-ai";
    repo = "k8sgpt";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-nr/Cl416ENwrbVGYaAxuOQsYkRWpx/CCM2gIZ2z/I9c=";
+    hash = "sha256-EmbNlvZh6Vk4qnmOjMN0F8sqVyNF3WXSme/F4fHGHYs=";
  };

-  vendorHash = "sha256-7Kvj1BaiR4wrGjzR54f+Qe+PdOrLjD2noaRPaX/Yuos=";
+  vendorHash = "sha256-tkS38PK86jp2uEWiB8eh4jQGWPirAilmgIqt1TOAPL8=";

  # https://nixos.org/manual/nixpkgs/stable/#var-go-CGO_ENABLED
  env.CGO_ENABLED = 0;
@@ -6,16 +6,16 @@

 buildGoModule (finalAttrs: {
  pname = "kubefwd";
-  version = "1.25.15";
+  version = "1.25.16";

  src = fetchFromGitHub {
    owner = "txn2";
    repo = "kubefwd";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-OlmaKXw3SRa+7wXGBD6hEjdccBbdUXp67SM9bHduNEs=";
+    hash = "sha256-+2RdT4SbXc7Ir9ChG+ps11WAMGno4vKOwc9VTXFijHE=";
  };

-  vendorHash = "sha256-t6JaUKHpNrf9E8NTFFWwrJJI9b0HyYNQeUoV7II2ocQ=";
+  vendorHash = "sha256-MIz2pZerUjKjcViEPZQeduzga3d6fYPlWo7dGQ+OdR4=";

  subPackages = [ "cmd/kubefwd" ];

@@ -7,18 +7,18 @@

 buildGo126Module (finalAttrs: {
  pname = "lakectl";
-  version = "1.80.0";
+  version = "1.82.0";

  src = fetchFromGitHub {
    owner = "treeverse";
    repo = "lakeFS";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-fco+t73cmoXc3Irf6owloxtldAVfBHCNfYRMitiGeTY=";
+    hash = "sha256-78M0625BhNPx8q2+x2tVzngmF5OmYa9ACDIeRr0qNrc=";
  };

  subPackages = [ "cmd/lakectl" ];
  proxyVendor = true;
-  vendorHash = "sha256-7sQMvpY+1RT2m1B14UPGCb60HQ9De5rErvoyj95Fkbc=";
+  vendorHash = "sha256-VjFfzVf2cmS+ZYdAnouLejQwwCbkv/mgHAcrTQ6taZE=";

  ldflags = [
    "-s"
@@ -6,18 +6,18 @@
  pkg-config,
 }:

-rustPlatform.buildRustPackage {
+rustPlatform.buildRustPackage (finalAttrs: {
  pname = "leftwm-theme";
-  version = "unstable-2024-03-05";
+  version = "0.1.3";

  src = fetchFromGitHub {
    owner = "leftwm";
    repo = "leftwm-theme";
-    rev = "b394824ff874b269a90c29e2d45b0cacc4d209f5";
-    hash = "sha256-cV4tY1qKNluSSGf+WwKFK3iVE7cMevafl6qQvhy1flE=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-TPzmopH9RBM/BBrEL9/NWO3qjVa6SSWCp34tHxjLtBI=";
  };

-  cargoHash = "sha256-v3PHMaXJCEBiCd+78b/BXRooZC4Py82gDcvA/efNJ7w=";
+  cargoHash = "sha256-ZfNVpepTm6/JgJJB+qDVI2gVz36PRBpUL8/ba20xQhk=";

  checkFlags = [
    # direct writing /tmp
@@ -40,4 +40,4 @@ rustPlatform.buildRustPackage {
    platforms = lib.platforms.linux;
    maintainers = with lib.maintainers; [ denperidge ];
  };
-}
+})
@@ -16,38 +16,38 @@
  },
  {
    "pname": "MailKit",
-    "version": "4.15.1",
-    "hash": "sha256-ZI2ASxX1dY53YxWRii0Dow4aojR8VCEWzCWZLrH7wPw="
+    "version": "4.17.0",
+    "hash": "sha256-LGruedMrHrI0AXHcXOFxsYP2awwPbrC9Q41AeQk4+9U="
  },
  {
    "pname": "Microsoft.IdentityModel.Abstractions",
-    "version": "8.17.0",
-    "hash": "sha256-AU+EMOZArc3rTdsnKYzAufFAtspuYQM3XYi8/VsQAio="
+    "version": "8.18.0",
+    "hash": "sha256-mkguJA4aXIVVQvSJ9Duq9mivbGXAIkLQp3a8PKy223A="
  },
  {
    "pname": "Microsoft.IdentityModel.JsonWebTokens",
-    "version": "8.17.0",
-    "hash": "sha256-MH7vdhCNAae32p6UTvaDtmyvFDxa/W71qTsEQ6yC9xM="
+    "version": "8.18.0",
+    "hash": "sha256-MdqY9CGRs+fTLb3HYYcSfuzqDFo4Dpho4McFWWferjA="
  },
  {
    "pname": "Microsoft.IdentityModel.Logging",
-    "version": "8.17.0",
-    "hash": "sha256-IM6jsPMz+l9JA0cye/v2ke51xlfP0u5HtWBqc2aKDYM="
+    "version": "8.18.0",
+    "hash": "sha256-09WyYskyL8gjjVDzoZBQAGXgsPmyagWftALSBCdt4gg="
  },
  {
    "pname": "Microsoft.IdentityModel.Tokens",
-    "version": "8.17.0",
-    "hash": "sha256-XcA0KXJbqMWt0I5LuHHMRLpgVQ18KcBej1BoySHeA1A="
+    "version": "8.18.0",
+    "hash": "sha256-sFhonZW9G6H4ooQ6N/78fkZvADZ2Hf5WAS3FKd/ue1E="
  },
  {
    "pname": "MimeKit",
-    "version": "4.15.1",
-    "hash": "sha256-MI4Wr+JWoxR9wsYhKmW8j1EdJ59W/O4jv5D9Zb8mEUw="
+    "version": "4.17.0",
+    "hash": "sha256-GpWv+8shoprshuPNB+H+C5saffiKQ6Pek3zhLUGklRo="
  },
  {
    "pname": "Npgsql",
-    "version": "9.0.4",
-    "hash": "sha256-YH2QYLe56dH6NNGgSwLIaHefjkKQLh0Sf4vMWoJciyU="
+    "version": "9.0.5",
+    "hash": "sha256-5AF0qiVQwfKUqCXSFb+oJhe3Q1wwK9F9+Q9/A4RTIdo="
  },
  {
    "pname": "System.Security.Cryptography.Pkcs",
@@ -3,17 +3,18 @@
  buildDotnetModule,
  dotnetCorePackages,
  fetchFromGitHub,
+  nix-update-script,
 }:

 buildDotnetModule rec {
  pname = "lubelogger";
-  version = "1.6.4";
+  version = "1.6.7";

  src = fetchFromGitHub {
    owner = "hargata";
    repo = "lubelog";
    rev = "v${version}";
-    hash = "sha256-w1UxnmuMBPi5Ov+3h7R0I0EIiZShsZm+TgXmfKdc1BU=";
+    hash = "sha256-goj9xGHZaX6XMYqlvOpabTXTT3/GcuvcRjr6GwVTFA4=";
  };

  projectFile = "CarCareTracker.sln";
@@ -28,6 +29,8 @@ buildDotnetModule rec {

  executables = [ "CarCareTracker" ]; # This wraps "$out/lib/$pname/foo" to `$out/bin/foo`.

+  passthru.updateScript = nix-update-script { };
+
  meta = {
    description = "Vehicle service records and maintainence tracker";
    longDescription = ''
@@ -6,11 +6,11 @@

 stdenvNoCC.mkDerivation rec {
  pname = "lxgw-neoxihei";
-  version = "1.302";
+  version = "1.303";

  src = fetchurl {
    url = "https://github.com/lxgw/LxgwNeoXiHei/releases/download/v${version}/LXGWNeoXiHei.ttf";
-    hash = "sha256-7YRfB+nDHUhzPuWyjuZUIwx7tLKjjhP9JutNWRnAw3w=";
+    hash = "sha256-uksTXdA6UPJfaQxyqzjurDfMy7ecEzzSIpkCqG4DA3Y=";
  };

  dontUnpack = true;
@@ -1,86 +0,0 @@
-Based on upstream https://sourceforge.net/p/maxima/code/ci/51704ccb090f6f971b641e4e0b7c1c22c4828bf7/
-adjusted to apply to 5.47.0
-
-diff --git a/src/gnuplot_def.lisp b/src/gnuplot_def.lisp
-index 80c174bd5..6fdc8da6d 100644
--- a/src/gnuplot_def.lisp
-+++ b/src/gnuplot_def.lisp
-@@ -286,7 +286,7 @@
-                (format nil "set term postscript eps color solid lw 2 size 16.4 cm, 12.3 cm font \",24\" ~a" gstrings)))
-      (if (getf plot-options :gnuplot_out_file)
-          (setq out-file (getf plot-options :gnuplot_out_file))
-         (setq out-file "maxplot.ps")))
-+         (setq out-file (format nil "~a.ps" (random-name 16)))))
-     ((eq (getf plot-options :gnuplot_term) '$dumb)
-      (if (getf plot-options :gnuplot_dumb_term_command)
-          (setq terminal-command
-@@ -294,7 +294,7 @@
-          (setq terminal-command "set term dumb 79 22"))
-      (if (getf plot-options :gnuplot_out_file)
-          (setq out-file (getf plot-options :gnuplot_out_file))
-         (setq out-file "maxplot.txt")))
-+         (setq out-file (format nil "~a.txt" (random-name 16)))))
-     ((eq (getf plot-options :gnuplot_term) '$default)
-      (if (getf plot-options :gnuplot_default_term_command)
-          (setq terminal-command
-diff --git a/src/plot.lisp b/src/plot.lisp
-index fb2b3136b..8877f7025 100644
--- a/src/plot.lisp
-+++ b/src/plot.lisp
-@@ -1755,16 +1755,24 @@ plot3d([cos(y)*(10.0+6*cos(x)), sin(y)*(10.0+6*cos(x)),-6*sin(x)],
- 
- (defvar $xmaxima_plot_command "xmaxima")
- 
-+;; random-file-name
-+;; Creates a random word of 'count' alphanumeric characters
-+(defun random-name (count)
-+  (let ((chars "0123456789abcdefghijklmnopqrstuvwxyz") (name ""))
-+    (setf *random-state* (make-random-state t))
-+    (dotimes (i count)
-+      (setq name (format nil "~a~a" name (aref chars (random 36)))))
-+    name))
-+
- (defun plot-set-gnuplot-script-file-name (options)
-   (let ((gnuplot-term (getf options :gnuplot_term))
- 	(gnuplot-out-file (getf options :gnuplot_out_file)))
-     (if (and (find (getf options :plot_format) '($gnuplot_pipes $gnuplot))
-              (eq gnuplot-term '$default) gnuplot-out-file)
- 	(plot-file-path gnuplot-out-file t options)
-      (plot-file-path
-       (format nil "maxout~d.~(~a~)"
-	       (getpid)
-               (ensure-string (getf options :plot_format))) nil options))))
-+      (plot-file-path (format nil "~a.~a" (random-name 16)
-+                              (ensure-string (getf options :plot_format)))
-+                      nil options))))
- 
- (defun plot-temp-file0 (file &optional (preserve-file nil))
-   (let ((filename 
-@@ -2577,9 +2585,13 @@ plot2d ( x^2+y^2 = 1, [x, -2, 2], [y, -2 ,2]);
-        (format dest "}~%"))
-   (format dest "}~%"))
- 
-+; TODO: Check whether this function is still being used (villate 20240325)
- (defun show-open-plot (ans file)
-   (cond ($show_openplot
-         (with-open-file (st1 (plot-temp-file (format nil "maxout~d.xmaxima" (getpid))) :direction :output :if-exists :supersede)
-+         (with-open-file
-+          (st1 (plot-temp-file
-+                (format nil "~a.xmaxima" (random-name 16)))
-+               :direction :output :if-exists :supersede)
-            (princ  ans st1))
-          ($system (concatenate 'string *maxima-prefix* 
-                                (if (string= *autoconf-windows* "true") "\\bin\\" "/bin/") 
-diff --git a/src/xmaxima_def.lisp b/src/xmaxima_def.lisp
-index b6513b564..5a13b6141 100644
--- a/src/xmaxima_def.lisp
-+++ b/src/xmaxima_def.lisp
-@@ -431,7 +431,7 @@
-         (format $pstream "}~%"))))))
- 
- (defmethod plot-shipout ((plot xmaxima-plot) options &optional output-file)
-  (let ((file (plot-file-path (format nil "maxout~d.xmaxima" (getpid)))))
-+  (let ((file (plot-file-path (format nil "~a.xmaxima" (random-name 16)))))
-     (cond ($show_openplot
-            (with-open-file (fl
-                             #+sbcl (sb-ext:native-namestring file)
@@ -28,11 +28,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "maxima";
-  version = "5.47.0";
+  version = "5.49.0";

  src = fetchurl {
    url = "mirror://sourceforge/maxima/maxima-${finalAttrs.version}.tar.gz";
-    sha256 = "sha256-kQQCGyT9U+jAOpg1CctC6TepJejAyFwzXXcJoU/UD3o=";
+    hash = "sha256-bUAaSqMHzTpanK3KT6lsTvDiT/laGLtqj4A+PSEUre4=";
  };

  nativeBuildInputs = [
@@ -85,8 +85,6 @@ stdenv.mkDerivation (finalAttrs: {
      url = "https://raw.githubusercontent.com/sagemath/sage/07d6c37d18811e2b377a9689790a7c5e24da16ba/build/pkgs/maxima/patches/undoing_true_false_printing_patch.patch";
      sha256 = "0fvi3rcjv6743sqsbgdzazy9jb6r1p1yq63zyj9fx42wd1hgf7yx";
    })
-
-    ./5.47.0-CVE-2024-34490.patch
  ];

  # The test suite is disabled since 5.42.2 because of the following issues:
@@ -110,6 +108,7 @@ stdenv.mkDerivation (finalAttrs: {
  };

  meta = {
+    changelog = "https://sourceforge.net/p/maxima/code/ci/master/tree/changelogs/ChangeLog-${lib.versions.majorMinor finalAttrs.version}.md";
    description = "Computer algebra system";
    homepage = "http://maxima.sourceforge.net";
    license = lib.licenses.gpl2Plus;
@@ -52,6 +52,10 @@ buildGoModule (finalAttrs: {

  vendorHash = "sha256-6oJgxhGS7aD3I0umTQuVMLzcOhzf53g4TZcCtkKrrc8=";

+  ldflags = [
+    "-X github.com/usememos/memos/internal/version.Version=${finalAttrs.version}"
+  ];
+
  preBuild = ''
    rm -rf server/router/frontend/dist
    cp -r ${finalAttrs.memos-web} server/router/frontend/dist
@@ -39,7 +39,7 @@ let
 in
 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "mistral-vibe";
-  version = "2.16.1";
+  version = "2.17.1";
  pyproject = true;
  __structuredAttrs = true;

@@ -47,7 +47,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
    owner = "mistralai";
    repo = "mistral-vibe";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-sv0gaEA7dvf4trxlsRQS9xA5Hiike5i/aLI3qYKP/lY=";
+    hash = "sha256-JrUepzbJupeyHiNz9gbX+C3kc2tJaNkxCldMELKeXcU=";
  };

  build-system = with python3Packages; [
@@ -172,6 +172,13 @@ python3Packages.buildPythonApplication (finalAttrs: {
  versionCheckKeepEnvironment = [ "HOME" ];

  disabledTests = [
+    # vibe is spawned in a sub-process and fails to import `mcp`
+    # ModuleNotFoundError: No module named 'mcp'
+    "TestMCPConnectionPoolIntegration"
+
+    # AssertionError: assert '32:2617357:1782120467963161870:7' != '32:2617357:1782120467963161870:7'
+    "test_changes_when_file_changes"
+
    # vibe.core.llm.exceptions.BackendError: LLM backend error [mock-provider]
    # reason: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Missing Authority Key Identifier (_ssl.c:1032)
    "test_generic_backend_streaming_uses_ssl_cert_file"
@@ -7,16 +7,16 @@

 buildNpmPackage (finalAttrs: {
  pname = "mocha";
-  version = "11.7.6";
+  version = "11.7.7";

  src = fetchFromGitHub {
    owner = "mochajs";
    repo = "mocha";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-pY6LYMitbhOfjNf00UuUbLgdZii7Nr/8/SlBgM5pYMI=";
+    hash = "sha256-U05dHIIk9MwMY2mV9WZZl2ibS0e35tkJg/EV3EHa6C4=";
  };

-  npmDepsHash = "sha256-1uisNcDlv/EY+Mq24rM7BgA8GREKKvxX/gHt8dHlX2Q=";
+  npmDepsHash = "sha256-crMuMnLJXVSzDMiZDtWXVW0x4XtZ4QXkK7qL90/kkHA=";

  postInstall = ''
    # Installed only for backwards compat, but should just be removed.
@@ -25,16 +25,16 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "motrix-next";
-  version = "3.9.4";
+  version = "3.9.6";

  src = fetchFromGitHub {
    owner = "AnInsomniacy";
    repo = "motrix-next";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-iubiVegDnOOczeYqMIU65RX43te91TbSdw2UdN/p6qQ=";
+    hash = "sha256-ynLi+biCdjU7EOq556YuFonghWaxDV7UtHWiKImq7WE=";
  };

-  cargoHash = "sha256-cZJ6KE28QC3WT9h8KMOmgvTMjwJLNCZ4ml+q2q7cH2c=";
+  cargoHash = "sha256-c17GTD9Wcy9LYLfBcwECNS1Tek5hTWPmie2lXtrbtFc=";

  pnpmDeps = fetchPnpmDeps {
    inherit (finalAttrs)
@@ -43,7 +43,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
      src
      ;
    inherit pnpm;
-    hash = "sha256-lpb98qIA6DZLLfUoiv0gAvMWS6QYvbL6zW0z75tcDCM=";
+    hash = "sha256-WAuHoLAnFLP6i+rJSegt/hI6sb1SDhm7LWgsup70o9E=";
    fetcherVersion = 3;
  };

@@ -23,6 +23,7 @@
  libtirpc,
  rpcsvc-proto,
  curl,
+  nixosTests,
 }:

 stdenv.mkDerivation (finalAttrs: {
@@ -111,6 +112,10 @@ stdenv.mkDerivation (finalAttrs: {
    connector-c = finalAttrs.finalPackage;
    server = finalAttrs.finalPackage;
    mysqlVersion = lib.versions.majorMinor finalAttrs.version;
+    tests.mysql-secure-root-by-default =
+      nixosTests.mysql-secure-root.secure-by-default."mysql${lib.versions.major finalAttrs.version}${lib.versions.minor finalAttrs.version}";
+    tests.mysql-root-can-be-kept-insecure =
+      nixosTests.mysql-secure-root.can-be-insecure."mysql${lib.versions.major finalAttrs.version}${lib.versions.minor finalAttrs.version}";
  };

  meta = {
@@ -2,22 +2,24 @@
  lib,
  buildGoModule,
  fetchFromGitHub,
+  pkg-config,
+  fuse,
  versionCheckHook,
  nix-update-script,
 }:

 buildGoModule (finalAttrs: {
  pname = "nak";
-  version = "0.17.4";
+  version = "0.19.13";

  src = fetchFromGitHub {
    owner = "fiatjaf";
    repo = "nak";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-rljH4uh8NSvJTwEVvk53oYzE2+U5dHeI9f5YZ75a1KA=";
+    hash = "sha256-bM91nnwQxcqzWFFFJXEmCJ1DKBIKb/o/qTwRjxCc15Q=";
  };

-  vendorHash = "sha256-c1XSy3guyueiCSVRnRYEkFypzGuMj7/7eOYFluFyeG8=";
+  vendorHash = "sha256-hpvBJXtzKWY5Kuy72qMtw8wuS9ejGy1wT+h28gACsXw=";

  ldflags = [
    "-s"
@@ -25,6 +27,14 @@ buildGoModule (finalAttrs: {
    "-X main.version=${finalAttrs.version}"
  ];

+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    fuse
+  ];
+
  # Integration tests fail (requires connection to relays)
  doCheck = false;

@@ -36,7 +46,7 @@ buildGoModule (finalAttrs: {
  meta = {
    description = "Command-line tool for Nostr things";
    homepage = "https://github.com/fiatjaf/nak";
-    changelog = "https://github.com/fiatjaf/nak/releases/tag/v${finalAttrs.version}";
+    changelog = "https://github.com/fiatjaf/nak/releases/tag/${finalAttrs.src.tag}";
    license = lib.licenses.unlicense;
    maintainers = with lib.maintainers; [ nartsiss ];
    mainProgram = "nak";
@@ -6,16 +6,16 @@

 buildGoModule (finalAttrs: {
  pname = "namespace-cli";
-  version = "0.0.520";
+  version = "0.0.525";

  src = fetchFromGitHub {
    owner = "namespacelabs";
    repo = "foundation";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-4qx3FFpdaiRCjzcF6/gnC4MQ9W74A4z1rzvSWS9trx0=";
+    hash = "sha256-jGb1PKFxh1f542Gzb0CImmhVYNdrFwRiYAo862h8qoU=";
  };

-  vendorHash = "sha256-rLP+djBDM1EJWFfC8s9e34Wz8EUDCzU23iJel5gscUs=";
+  vendorHash = "sha256-3bbXWIiAqGn2twfCSTcYrpbwTOXJC0r8UgDs6iAkX1U=";

  subPackages = [
    "cmd/nsc"
@@ -7,13 +7,13 @@

 buildGoModule rec {
  pname = "netfoil";
-  version = "0.4.0";
+  version = "0.5.0";

  src = fetchFromGitHub {
    owner = "tinfoil-factory";
    repo = "netfoil";
    tag = "v${version}";
-    hash = "sha256-HWAw3CxuVOinYhcJS5KjkscFURSamsiu4oLNU+z16zc=";
+    hash = "sha256-iea76gzkbLKguqkFh1QzTiYu2aKkdW6FAOkMcp34P1M=";
  };

  __structuredAttrs = true;
@@ -35,13 +35,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "netgen";
-  version = "6.2.2505";
+  version = "6.2.2605";

  src = fetchFromGitHub {
    owner = "ngsolve";
    repo = "netgen";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-MPnibhDzNjqmpW5C76KdeYoZGfKLU0KJ20EnjrK1S+Y=";
+    hash = "sha256-067PzJymS6ayVoenaXEdvK3fraLTKPJTC54Aok1UUtg=";
  };

  patches = [
@@ -61,11 +61,6 @@ stdenv.mkDerivation (finalAttrs: {
      url = "${patchSource}/include_stdlib.patch";
      hash = "sha256-W+NgGBuy/UmzVbPTSqR8FRUlyN/9dl9l9e9rxKklmIc=";
    })
-    # Fix build with pybind11 3.x.
-    (fetchpatch2 {
-      url = "https://github.com/NGSolve/netgen/commit/ceacae3844ed2f0c48c8b6a3a82904b16c594f41.patch?full_index=1";
-      hash = "sha256-uSlkKxuOoUt4n601vadEZogSF47zdWNOIk1Nr9Ra3AU=";
-    })
    ./ensure_python_before_getting_gil.patch
    ./macos_use_tk_default_color_map.patch
  ];
@@ -147,6 +142,10 @@ stdenv.mkDerivation (finalAttrs: {
    (lib.cmakeBool "ENABLE_UNIT_TESTS" finalAttrs.finalPackage.doInstallCheck)
  ];

+  env.NIX_CFLAGS_COMPILE = lib.optionalString (
+    stdenv.hostPlatform.isAarch64 && stdenv.hostPlatform.isLinux
+  ) "-flax-vector-conversions";
+
  __darwinAllowLocalNetworking = true;

  desktopItems = [
@@ -13,13 +13,13 @@ let
 in
 buildNpmPackage (finalAttrs: {
  pname = "nezha-theme-user";
-  version = "2.2.1";
+  version = "2.3.1";

  src = fetchFromGitHub {
    owner = "hamster1963";
    repo = "nezha-dash-v2";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-X7NRpDeZqLijgbUQOEdML00TPRM2D55zlJkzWB2TKfM=";
+    hash = "sha256-/2G0KhlXIvVM8db4nATJHiwPsvKXh8SNE+9DpllfSTs=";
  };

  postPatch = ''
@@ -37,7 +37,7 @@ buildNpmPackage (finalAttrs: {
    inherit (finalAttrs) pname version src;
    inherit pnpm;
    fetcherVersion = 4;
-    hash = "sha256-4Zfiw//9w16I2CXOEy/ocAI5frK5w4g3b8pxguGWOdA=";
+    hash = "sha256-k/05ccqV72kC9E9MX+os8R0wmgIhnDYIwRNmIbedL1I=";
  };
  npmConfigHook = pnpmConfigHook;

@@ -49,13 +49,13 @@ let
 in
 buildGoModule (finalAttrs: {
  pname = "nezha";
-  version = "2.2.3";
+  version = "2.2.6";

  src = fetchFromGitHub {
    owner = "nezhahq";
    repo = "nezha";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Vj9vgLT38HbdF4mWQkv3Yrshdv/kQpWk51teyl9qzF0=";
+    hash = "sha256-HsDymQ1y4ouUMpcpSycSfbwJm+hzct7U0Wjm/ouorO0=";
  };

  proxyVendor = true;
@@ -21,11 +21,12 @@
  ceph,
  useDbus ? true,
  dbus,
+  rdma-core,
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "nfs-ganesha";
-  version = "9.14";
+  version = "9.16";

  outputs = [
    "out"
@@ -37,7 +38,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "nfs-ganesha";
    repo = "nfs-ganesha";
    tag = "V${finalAttrs.version}";
-    hash = "sha256-aeZDXr6vUFyFhVQO31ttZ04W8KP8iKN0u17McULtQUM=";
+    hash = "sha256-y5rsQjhmfhqZXQ7jXsItbNe/3Gq4lswIXUq7nnyQIcs=";
  };

  patches = lib.optional useDbus ./allow-bypassing-dbus-pkg-config-test.patch;
@@ -54,6 +55,7 @@ stdenv.mkDerivation (finalAttrs: {
    "-DCMAKE_BUILD_WITH_INSTALL_RPATH=ON"
    "-DUSE_MAN_PAGE=ON"
    "-DUSE_MONITORING=ON"
+    "-DUSE_NFS_RDMA=ON"
  ]
  ++ lib.optionals useCeph [
    "-DUSE_RADOS_RECOV=ON"
@@ -90,6 +92,7 @@ stdenv.mkDerivation (finalAttrs: {
    liburcu
    nfs-utils
    prometheus-cpp-lite
+    rdma-core
  ]
  ++ lib.optional useCeph ceph;

@@ -8,28 +8,30 @@
  libtirpc,
  libnsl,
  prometheus-cpp-lite,
+  rdma-core,
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "ntirpc";
-  version = "7.2";
+  version = "9.16";

  src = fetchFromGitHub {
    owner = "nfs-ganesha";
    repo = "ntirpc";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-4E6wDAwinCNn7arRgBulg7e0x9S/steh+mjwNY4X3Vc=";
+    hash = "sha256-ZpjP1ugT9gN3TW7roBfJJBA6Y6FCkaOl31WRoRqPvTU=";
  };

  outputs = [
    "out"
    "dev"
  ];
-  postPatch = ''
-    substituteInPlace CMakeLists.txt --replace-fail \
-      "cmake_minimum_required(VERSION 2.6.3)" \
-      "cmake_minimum_required(VERSION 3.10)"

+  patches = [
+    ./pkg-config.patch
+  ];
+
+  postPatch = ''
    substituteInPlace ntirpc/netconfig.h --replace-fail \
      "/etc/netconfig" "$out/etc/netconfig"
  '';
@@ -40,10 +42,12 @@ stdenv.mkDerivation (finalAttrs: {
    liburcu
    libnsl
    prometheus-cpp-lite
+    rdma-core
  ];

  cmakeFlags = [
    "-DUSE_MONITORING=ON"
+    "-DUSE_RPC_RDMA=ON"
  ];

  postInstall = ''
@@ -0,0 +1,12 @@
+diff --git a/libntirpc.pc.in.cmake b/libntirpc.pc.in.cmake
+index 6650568..3aaea1d 100644
+--- a/libntirpc.pc.in.cmake
+++ b/libntirpc.pc.in.cmake
+@@ -1,6 +1,6 @@
+ prefix=@CMAKE_INSTALL_PREFIX@
+ exec_prefix=${prefix}
+-libdir=${prefix}/@CMAKE_INSTALL_LIBDIR@
+libdir=@CMAKE_INSTALL_FULL_LIBDIR@
+ includedir=${prefix}/include/ntirpc
+ 
+ Name: libntirpc
@@ -16,13 +16,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "nvc";
-  version = "1.21.0";
+  version = "1.21.1";

  src = fetchFromGitHub {
    owner = "nickg";
    repo = "nvc";
    tag = "r${finalAttrs.version}";
-    hash = "sha256-aGRN12QL+ODcCpxRXK8RtjT7Zk+rd1ld1gjxlubPFgI=";
+    hash = "sha256-l4eGEDZrAXOhN5hPQLy2TcQEsQ+TTSNZVBFVwNsoQCo=";
  };

  nativeBuildInputs = [
@@ -11,14 +11,14 @@

 buildPythonPackage rec {
  pname = "octodns-cloudflare";
-  version = "1.1.0";
+  version = "1.2.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "octodns";
    repo = "octodns-cloudflare";
    tag = "v${version}";
-    hash = "sha256-xVuUmadVhPrsfdEwShacWuf6HvFy280RrBeDjU+869M=";
+    hash = "sha256-h3NgzqKgUlzUYN8QycHQE7V1YoBe8fWzHWQPv+Afplo=";
  };

  build-system = [
@@ -7,14 +7,14 @@

 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "oelint-adv";
-  version = "9.8.4";
+  version = "9.9.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "priv-kweihmann";
    repo = "oelint-adv";
    tag = finalAttrs.version;
-    hash = "sha256-bQFjf+BAmJKsjcjZcTc34+4bcSq4hgSBKgHRcYA1ai0=";
+    hash = "sha256-c25opp+T1E3LiB6YUb393ar+pLiswpwTuR9fJezewTY=";
  };

  postPatch = ''
@@ -7,16 +7,16 @@

 buildGoModule (finalAttrs: {
  pname = "openfga";
-  version = "1.17.1";
+  version = "1.18.0";

  src = fetchFromGitHub {
    owner = "openfga";
    repo = "openfga";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-wRK+EhjJh0OlNTLKYRohQyaFtsNL8vPPfppgiw/xDGI=";
+    hash = "sha256-C4EgMOOW0Aw8h5kpvfLIKChVA+giCs02sK60jJ5snCo=";
  };

-  vendorHash = "sha256-F8XHaUGmaeMCE2eLWafyvPDuc3YiBGda55/fycMv5KQ=";
+  vendorHash = "sha256-CeYNV1jRqUERS6qpZQtlJu68gr1qDFwl4u2n9im2EgU=";

  nativeBuildInputs = [ installShellFiles ];

@@ -6,14 +6,14 @@

 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "ciel";
-  version = "2.5.0";
+  version = "2.5.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "fossi-foundation";
    repo = "ciel";
    tag = finalAttrs.version;
-    hash = "sha256-EDXsR2cBU8+Z4h/Pkac5An9/TVI9LkZqLB3xAjrQq78=";
+    hash = "sha256-O2HgkRzTWd8GjMEkQZw9F4Re7zYIxZ+gPjs3gwy4DqE=";
  };

  build-system = [ python3Packages.poetry-core ];
@@ -160,9 +160,7 @@ beamPackages.mixRelease rec {
  '';

  passthru = {
-    tests = {
-      inherit (nixosTests) plausible;
-    };
+    tests = nixosTests.plausible;
    updateScript = nix-update-script {
      extraArgs = [
        "-s"
@@ -217,7 +215,10 @@ beamPackages.mixRelease rec {
    changelog = "https://github.com/plausible/analytics/blob/${src.rev}/CHANGELOG.md";
    description = "Simple, open-source, lightweight (< 1 KB) and privacy-friendly web analytics alternative to Google Analytics";
    mainProgram = "plausible";
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [
+      stepbrobd
+      nh2
+    ];
    platforms = lib.platforms.unix;
  };
 }
@@ -16,14 +16,14 @@ let
    mapAttrsToList
    ;

-  version = "0.32.8";
+  version = "0.32.9";
  src = fetchFromGitHub {
    owner = "pomerium";
    repo = "pomerium";
    rev = "v${version}";
-    hash = "sha256-Kqv3wbqiOnqEQiaz0J2P8Y2TToX5WiuKCZCbsl1bopM=";
+    hash = "sha256-TGsbAAGt0nvARgMrYMMFEUA24I0z8aOeB9p2y5FhU3I=";
  };
-  vendorHash = "sha256-ST33a/YNJiE70ORWNxS9gFNfHcNGGiQhOpUwqgbEJiQ=";
+  vendorHash = "sha256-R5YSMHTaBKzHzrVm586QYeMqc6hILr8CLjp1QDupyGY=";

  getEnvoy = buildGoModule {
    pname = "pomerium-get-envoy";
@@ -6,16 +6,16 @@

 pkgsStatic.rustPlatform.buildRustPackage (finalAttrs: {
  pname = "rcp";
-  version = "0.32.0";
+  version = "0.35.0";

  src = fetchFromGitHub {
    owner = "wykurz";
    repo = "rcp";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-ZMp1ZMuHdTcJ7iORq9a62pGQo5cGRueuAQy+AjSOY5g=";
+    hash = "sha256-toO+gVPHfc/drP9Xj0vJOJvOxsH/0VqXKSwfYvkZfnE=";
  };

-  cargoHash = "sha256-ZXPG429qgiAaxZxnDNiMIXiP1d0pkdWEblZuRU8+BSU=";
+  cargoHash = "sha256-lbS67Hiv0ay0DzzoZsFRxc9EKl9sw+pYJwn9FmXquos=";

  env.RUSTFLAGS = "--cfg tokio_unstable";

@@ -41,6 +41,17 @@ pkgsStatic.rustPlatform.buildRustPackage (finalAttrs: {
    "--skip=version::tests::test_current_version"
    "--skip=test_protocol_version_has_git_info"
    "--skip=test_rcpd_protocol_version_has_git_info"
+    # these tests shell out to `getent` to resolve real user/group names, which isn't available in the sandbox
+    "--skip=chmod::tests::getent_real_resolves_root"
+    "--skip=chmod::tests::getent_real_option_like_name_fails_closed_no_injection"
+    "--skip=rejects_unknown_group"
+    # these tests change ownership and set setuid/setgid bits (fchown / chmod / chgrp),
+    # which the unprivileged sandbox build user isn't permitted to do (EPERM)
+    "--skip=safedir::tests::set_dir_metadata_fd_applies"
+    "--skip=safedir::tests::set_file_metadata_fd_ordering_preserves_setuid"
+    "--skip=applies_per_type_modes_recursively"
+    "--skip=group_change_preserves_setgid_across_chgrp"
+    "--skip=preserves_setgid_through_mode_change"
  ];

  meta = {
@@ -8,19 +8,15 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "refinery-cli";
-  version = "0.8.14";
+  version = "0.9.2";

  src = fetchCrate {
    pname = "refinery_cli";
    inherit (finalAttrs) version;
-    hash = "sha256-gHW+5WWzk1H2O5B2sWdl6QcOeUbNvbdZZBD10SmE1GA=";
+    hash = "sha256-KBwEefttkIy8+NN16K6qnvOJxEe9DH+oGXuFx2/ziCw=";
  };

-  # The `time` crate doesn't build on Rust 1.80+
-  # https://github.com/NixOS/nixpkgs/issues/332957
-  cargoPatches = [ ./time-crate.patch ];
-
-  cargoHash = "sha256-gcPVbKcPkV0H+BpErTokvLKFxpSXhxNoptxOeuhH1FU=";
+  cargoHash = "sha256-PulFXZw/ouaYP7FWWLv7R/hemN4IatXH+2wIBJjd3oc=";

  nativeBuildInputs = [ pkg-config ];

@@ -1,83 +0,0 @@
-diff --git a/Cargo.lock b/Cargo.lock
-index 59dad7c..eb5b122 100644
--- a/Cargo.lock
-+++ b/Cargo.lock
-@@ -460,9 +460,12 @@ dependencies = [
-
- [[package]]
- name = "deranged"
-version = "0.3.8"
-+version = "0.3.11"
- source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2696e8a945f658fd14dc3b87242e6b80cd0f36ff04ea560fa39082368847946"
-+checksum = "b42b6fa04a440b495c8b04d0e71b707c585f83cb9cb28cf8cd0d976c315e31b4"
-+dependencies = [
-+ "powerfmt",
-+]
-
- [[package]]
- name = "derive_utils"
-@@ -1236,6 +1239,12 @@ dependencies = [
-  "num-traits",
- ]
-
-+[[package]]
-+name = "num-conv"
-+version = "0.1.0"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "51d515d32fb182ee37cda2ccdcb92950d6a3c2893aa280e540671c2cd0f3b1d9"
-+
- [[package]]
- name = "num-integer"
- version = "0.1.45"
-@@ -1414,6 +1423,12 @@ dependencies = [
-  "postgres-protocol",
- ]
-
-+[[package]]
-+name = "powerfmt"
-+version = "0.2.0"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
-+
- [[package]]
- name = "ppv-lite86"
- version = "0.2.17"
-@@ -1900,12 +1915,14 @@ dependencies = [
-
- [[package]]
- name = "time"
-version = "0.3.28"
-+version = "0.3.37"
- source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "17f6bb557fd245c28e6411aa56b6403c689ad95061f50e4be16c274e70a17e48"
-+checksum = "35e7868883861bd0e56d9ac6efcaaca0d6d5d82a2a7ec8209ff492c07cf37b21"
- dependencies = [
-  "deranged",
-  "itoa",
-+ "num-conv",
-+ "powerfmt",
-  "serde",
-  "time-core",
-  "time-macros",
-@@ -1913,16 +1930,17 @@ dependencies = [
-
- [[package]]
- name = "time-core"
-version = "0.1.1"
-+version = "0.1.2"
- source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7300fbefb4dadc1af235a9cef3737cea692a9d97e1b9cbcd4ebdae6f8868e6fb"
-+checksum = "ef927ca75afb808a4d64dd374f00a2adf8d0fcff8e7b184af886c3c87ec4a3f3"
-
- [[package]]
- name = "time-macros"
-version = "0.2.14"
-+version = "0.2.19"
- source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1a942f44339478ef67935ab2bbaec2fb0322496cf3cbe84b261e06ac3814c572"
-+checksum = "2834e6017e3e5e4b9834939793b282bc03b37a3336245fa820e35e233e2a85de"
- dependencies = [
-+ "num-conv",
-  "time-core",
- ]
@@ -25,13 +25,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "reframe";
-  version = "1.17.0";
+  version = "1.17.1";

  src = fetchFromGitHub {
    owner = "AlynxZhou";
    repo = "reframe";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-xm5vrrxao7sUKq+yWnlZ71KixiShtjQSDG9I5R3/ja8=";
+    hash = "sha256-gZSvNoVY2gDGcN/EFbK6vH7PghfR1GXzZt2JXPBhLuo=";
    fetchSubmodules = true;
  };

@@ -7,7 +7,7 @@

 buildGoModule (finalAttrs: {
  pname = "reticulum-go";
-  version = "0.9.5";
+  version = "0.9.6";
  strictDeps = true;
  __structuredAttrs = true;

@@ -15,9 +15,15 @@ buildGoModule (finalAttrs: {
    owner = "Quad4-Software";
    repo = "Reticulum-Go";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-LszknSPyZRE/uGy5jSmKAmi+oBargjN+AgbT8QJ3hug=";
+    hash = "sha256-Rji6MJQAN48zKsLHQS8ukbi9pWjHPEbezXJu/700HZs=";
  };

+  # TODO: Remove this when https://github.com/NixOS/nixpkgs/pull/527289 has landed in `master`
+  postPatch = ''
+    substituteInPlace go.mod \
+      --replace-fail "1.26.4" "1.26.3"
+  '';
+
  vendorHash = null;

  subPackages = [ "cmd/reticulum-go" ];
@@ -38,5 +44,6 @@ buildGoModule (finalAttrs: {
    homepage = "https://github.com/Quad4-Software/Reticulum-Go";
    license = lib.licenses.asl20;
    mainProgram = "reticulum-go";
+    maintainers = with lib.maintainers; [ drupol ];
  };
 })
@@ -7,13 +7,13 @@

 buildGoModule (finalAttrs: {
  pname = "routedns";
-  version = "0.1.208";
+  version = "0.1.209";

  src = fetchFromGitHub {
    owner = "folbricht";
    repo = "routedns";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-u1P+i8WXRDzoElvjnNr57ybuDGWBZ6qYF4wBPBYLv4I=";
+    hash = "sha256-fzBiF0xIArHchV2umdiO6Q2LPe/nZ7QUVKa2w7onO/0=";
  };

  vendorHash = "sha256-e19ZqeVA+WQOILZrju7xFDii/lxmZceXk30tWY74cmM=";
@@ -99,6 +99,13 @@ stdenv.mkDerivation rec {
      url = "https://github.com/sagemath/sage/commit/f1cf1552c2c7636fa069fbc47c5bfc937753f7b2.patch?full_index=1";
      hash = "sha256-Z3SU6cSCnnaTZLcTh0LNb672HyBqhBd6+iYUEeK1cGQ=";
    })
+
+    # https://github.com/sagemath/sage/pull/40679, rebased by void linux
+    (fetchpatch2 {
+      name = "maxima-5.49-update.patch";
+      url = "https://raw.githubusercontent.com/void-linux/void-packages/f8951eacbdc6538af3330d17d5587a0c208ab349/srcpkgs/sagemath/patches/40679-Update_to_maxima_5.49.patch";
+      hash = "sha256-n6YSVNomLM7f5kRAGzhijag8QnlXxKJz9RHFLVtZpdk=";
+    })
  ];

  patches = nixPatches ++ bugfixPatches ++ packageUpgradePatches;
@@ -10,16 +10,16 @@

 buildGo126Module (finalAttrs: {
  pname = "scaleway-cli";
-  version = "2.56.3";
+  version = "2.57.0";

  src = fetchFromGitHub {
    owner = "scaleway";
    repo = "scaleway-cli";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Sq/uTl7in/rrujY9UXoeAIbqgEowy3WeEROrxM5gV4I=";
+    hash = "sha256-5inoRcHXw6xOAkm2O0k9q3fO2KtFJtac1odSEvsq8Nc=";
  };

-  vendorHash = "sha256-ekQxkenKpVpzhj1n/HHXITCXDQUV9t9YxE6iUosQJlo=";
+  vendorHash = "sha256-b5Zn4Jz251oTy92BunBK/5pbP5Mw/45qZn6bKH451t8=";

  env.CGO_ENABLED = 0;

--- a/Show More
+++ b/Show More