Merge staging-next into staging

2025-09-16 18:06:57 +00:00
parent bcbb45d9b8 fa344c55d9
commit 7ae9347dfb
79 changed files with 2902 additions and 1830 deletions
@@ -48,6 +48,9 @@
  backend even if NCG is available. In this case, it is best to use the `forceLlvmCodegenBackend` helper.
  In all other cases, like linking against `libLLVM`, Haskell packages should use the appropriate version of `llvmPackages` from `pkgs`.

+- `uw-ttyp0` has been updated to version 2.1. The filenames of the OTB and PSF fonts have been changed to match the upstream naming convention.
+  If you were loading a font by path, for example in the `console.font` NixOS option, remember to update the filename accordingly.
+
 - `base16-builder` node package has been removed due to lack of upstream maintenance.

 - `python3Packages.bjoern` has been removed, as the upstream is unmaintained and it depends on a 14-year-old version of http-parser with numerous vulnerabilities.
@@ -11620,6 +11620,11 @@
    github = "jasonxue1";
    githubId = 103628493;
    name = "jasonxue";
+    keys = [
+      {
+        fingerprint = "067A 9B58 DAC4 1C31 D688  81A9 EC23 DBDD B617 6861";
+      }
+    ];
  };
  jaspersurmont = {
    email = "jasper@surmont.dev";
@@ -104,6 +104,8 @@

 - [fw-fanctrl](https://github.com/TamtamHero/fw-fanctrl), a simple systemd service to better control Framework Laptop's fan(s). Available as [hardware.fw-fanctrl](#opt-hardware.fw-fanctrl.enable).

+- [SillyTavern](https://sillytavern.app/), LLM Frontend for Power Users. Available as [services.sillytavern](#opt-services.sillytavern.enable).
+
 - [mautrix-discord](https://github.com/mautrix/discord), a Matrix-Discord puppeting/relay bridge. Available as [services.mautrix-discord](#opt-services.mautrix-discord.enable).

 - [Timekpr-nExT](https://mjasnik.gitlab.io/timekpr-next/), a time managing application that helps optimizing time spent at computer for your subordinates, children or even for yourself. Available as [](#opt-services.timekpr.enable).
@@ -1693,6 +1693,7 @@
  ./services/web-apps/sftpgo.nix
  ./services/web-apps/sharkey.nix
  ./services/web-apps/shiori.nix
+  ./services/web-apps/sillytavern.nix
  ./services/web-apps/silverbullet.nix
  ./services/web-apps/simplesamlphp.nix
  ./services/web-apps/slskd.nix
@@ -270,7 +270,11 @@ in
        "multi-user.target"
        "ollama.service"
      ];
-      after = [ "ollama.service" ];
+      wants = [ "network-online.target" ];
+      after = [
+        "ollama.service"
+        "network-online.target"
+      ];
      bindsTo = [ "ollama.service" ];
      environment = config.systemd.services.ollama.environment;
      serviceConfig = {
@@ -17,6 +17,10 @@ in
    services.qdrant = {
      enable = lib.mkEnableOption "Vector Search Engine for the next generation of AI applications";

+      package = lib.mkPackageOption pkgs "qdrant" { };
+
+      webUIPackage = lib.mkPackageOption pkgs "qdrant-web-ui" { };
+
      settings = lib.mkOption {
        description = ''
          Configuration for Qdrant
@@ -64,7 +68,7 @@ in

  config = lib.mkIf cfg.enable {
    services.qdrant.settings = {
-      service.static_content_dir = lib.mkDefault pkgs.qdrant-web-ui;
+      service.static_content_dir = lib.mkDefault cfg.webUIPackage;
      storage.storage_path = lib.mkDefault "/var/lib/qdrant/storage";
      storage.snapshots_path = lib.mkDefault "/var/lib/qdrant/snapshots";
      # The following default values are the same as in the default config,
@@ -106,7 +110,7 @@ in

      serviceConfig = {
        LimitNOFILE = 65536;
-        ExecStart = "${pkgs.qdrant}/bin/qdrant --config-path ${configFile}";
+        ExecStart = "${cfg.package}/bin/qdrant --config-path ${configFile}";
        DynamicUser = true;
        Restart = "on-failure";
        StateDirectory = "qdrant";
@@ -0,0 +1,170 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.sillytavern;
+  defaultUser = "sillytavern";
+  defaultGroup = "sillytavern";
+in
+{
+  meta.maintainers = [
+    lib.maintainers.wrvsrx
+    lib.maintainers.A1ca7raz
+  ];
+
+  options = {
+    services.sillytavern = {
+      enable = lib.mkEnableOption "sillytavern";
+
+      user = lib.mkOption {
+        type = lib.types.str;
+        default = defaultUser;
+        description = ''
+          User account under which the web-application run.
+        '';
+      };
+      group = lib.mkOption {
+        type = lib.types.str;
+        default = defaultGroup;
+        description = ''
+          Group account under which the web-application run.
+        '';
+      };
+
+      package = lib.mkPackageOption pkgs "sillytavern" { };
+
+      configFile = lib.mkOption {
+        type = lib.types.path;
+        default = "${pkgs.sillytavern}/lib/node_modules/sillytavern/config.yaml";
+        defaultText = lib.literalExpression "\${pkgs.sillytavern}/lib/node_modules/sillytavern/config.yaml";
+        description = ''
+          Path to the SillyTavern configuration file.
+        '';
+      };
+
+      port = lib.mkOption {
+        type = lib.types.nullOr lib.types.port;
+        default = null;
+        example = 8045;
+        description = ''
+          Port on which SillyTavern will listen.
+        '';
+      };
+
+      listenAddressIPv4 = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
+        default = null;
+        example = "127.0.0.1";
+        description = ''
+          Specific IPv4 address to listen to.
+        '';
+      };
+
+      listenAddressIPv6 = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
+        default = null;
+        example = "::1";
+        description = ''
+          Specific IPv6 address to listen to.
+        '';
+      };
+
+      listen = lib.mkOption {
+        type = lib.types.nullOr lib.types.bool;
+        default = null;
+        example = true;
+        description = ''
+          Whether to listen on all network interfaces.
+        '';
+      };
+
+      whitelist = lib.mkOption {
+        type = lib.types.nullOr lib.types.bool;
+        default = null;
+        example = true;
+        description = ''
+          Enables whitelist mode.
+        '';
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.services.sillytavern = {
+      description = "Silly Tavern";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      # required by sillytavern's extension manager
+      path = [ pkgs.git ];
+      environment.XDG_DATA_HOME = "%S";
+      serviceConfig = {
+        Type = "simple";
+        ExecStart =
+          let
+            f = x: name: lib.optional (x != null) "--${name}=${builtins.toString x}";
+          in
+          lib.concatStringsSep " " (
+            [
+              "${lib.getExe pkgs.sillytavern}"
+            ]
+            ++ f cfg.port "port"
+            ++ f cfg.listen "listen"
+            ++ f cfg.listenAddressIPv4 "listenAddressIPv4"
+            ++ f cfg.listenAddressIPv6 "listenAddressIPv6"
+            ++ f cfg.whitelist "whitelist"
+          );
+        User = cfg.user;
+        Group = cfg.group;
+        Restart = "always";
+        StateDirectory = "SillyTavern";
+        BindPaths = [
+          "%S/SillyTavern/extensions:${pkgs.sillytavern}/lib/node_modules/sillytavern/public/scripts/extensions/third-party"
+        ];
+
+        # Security hardening
+        CapabilityBoundingSet = [ "" ];
+        LockPersonality = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateTmp = true;
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ProtectSystem = "strict";
+      };
+    };
+
+    users.users.${cfg.user} = lib.mkIf (cfg.user == defaultUser) {
+      description = "sillytavern service user";
+      isSystemUser = true;
+      inherit (cfg) group;
+    };
+
+    users.groups.${cfg.group} = lib.mkIf (cfg.group == defaultGroup) { };
+
+    systemd.tmpfiles.settings.sillytavern = {
+      "/var/lib/SillyTavern/data".d = {
+        mode = "0700";
+        inherit (cfg) user group;
+      };
+      "/var/lib/SillyTavern/extensions".d = {
+        mode = "0700";
+        inherit (cfg) user group;
+      };
+      "/var/lib/SillyTavern/config.yaml"."L+" = {
+        mode = "0600";
+        argument = cfg.configFile;
+        inherit (cfg) user group;
+      };
+    };
+  };
+}
@@ -6,6 +6,7 @@ let
  common = {
    services.userborn.enable = true;
    boot.initrd.systemd.enable = true;
+    networking.useNetworkd = true;
    system.etc.overlay = {
      enable = true;
      mutable = false;
@@ -1,43 +0,0 @@
-{
-  mkDerivation,
-  lib,
-  fetchFromGitHub,
-  qtbase,
-  qtserialport,
-  qmake,
-}:
-
-mkDerivation rec {
-  pname = "candle";
-  version = "1.1";
-
-  src = fetchFromGitHub {
-    owner = "Denvi";
-    repo = "Candle";
-    rev = "v${version}";
-    sha256 = "1gpx08gdz8awbsj6lsczwgffp19z3q0r2fvm72a73qd9az29pmm0";
-  };
-
-  nativeBuildInputs = [ qmake ];
-
-  sourceRoot = "${src.name}/src";
-
-  installPhase = ''
-    runHook preInstall
-    install -Dm755 Candle $out/bin/candle
-    runHook postInstall
-  '';
-
-  buildInputs = [
-    qtbase
-    qtserialport
-  ];
-
-  meta = with lib; {
-    description = "GRBL controller application with G-Code visualizer written in Qt";
-    mainProgram = "candle";
-    homepage = "https://github.com/Denvi/Candle";
-    license = licenses.gpl3;
-    maintainers = with maintainers; [ matti-kariluoma ];
-  };
-}
@@ -10,11 +10,11 @@
 buildMozillaMach rec {
  pname = "firefox-beta";
  binaryName = pname;
-  version = "143.0b9";
+  version = "144.0b1";
  applicationName = "Firefox Beta";
  src = fetchurl {
    url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "b014e343ddba2e3750a0f50925c9b7f07237593c299604d96275f45332063f1487a47234411f7c952ee50ffaeb385a22dedbc4f924e4e0fc89668172b06c78fd";
+    sha512 = "a5a13bcb819523e936dadcb3d31ba6b24905f9b37104afd23ab267caf15d692bb048542b542012bd95048e0fb42aefd48e92bd38b536be9dd273c468c9def428";
  };

  meta = {
@@ -10,13 +10,13 @@
 buildMozillaMach rec {
  pname = "firefox-devedition";
  binaryName = pname;
-  version = "143.0b9";
+  version = "144.0b1";
  applicationName = "Firefox Developer Edition";
  requireSigning = false;
  branding = "browser/branding/aurora";
  src = fetchurl {
    url = "mirror://mozilla/devedition/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "a323bbcc7c8898073e320f3c2701881d849cff31a01a8bad34df7f08945dd7fb7e8cc9afd8aceb209198e8932b7b1d835af45b87459f4454f9a7f48bc85ef690";
+    sha512 = "f50d5ef185f77ab70b43bc52d8d7e5d2e4be731505b8b53fa5a28c18d7e8fb59b4c1d9af3a18b2a2f0a1047133face63ba52991995a848a3c1d956907ef4d926";
  };

  # buildMozillaMach sets MOZ_APP_REMOTINGNAME during configuration, but
@@ -9,11 +9,11 @@

 buildMozillaMach rec {
  pname = "firefox";
-  version = "140.2.0esr";
+  version = "140.3.0esr";
  applicationName = "Firefox ESR";
  src = fetchurl {
    url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "e4597c4d83ae1a84fce9248fe6ca652af6c3615607fc8973bd917bfdbd2abbceca937fe4c629c0cdc89fa0a5c846b5e2d8a4b44dabf7feb201deb382de0ccc5b";
+    sha512 = "f2a45352372a7c54bfc3a07652098b55634d111ea88550d33e7e2710d15524d689ee39fbd3b2049643436530e13c237d03e05fb7abd3970c9c18b66e5a84c85a";
  };

  meta = {
@@ -9,10 +9,10 @@

 buildMozillaMach rec {
  pname = "firefox";
-  version = "142.0.1";
+  version = "143.0";
  src = fetchurl {
    url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "fca1b9c67a0b2f216f1f11fd5e3a08920998921e3d61eb633f1dde7fe69cb40cdbb63a41a1dfc4f1022509da643e3791467d88e62e7ea30b293ebf69d87bb585";
+    sha512 = "49fe5e5dbb7539be3e4c517d3cac453ea9b739e61040c4ac1abcf3d6665732fba5ff91fb040f3c0294af0f8c2824235a94e60ac9c26e25cb14d89d4b50c8a911";
  };

  meta = {
@@ -90,6 +90,7 @@ in
  nspr,
  nss_esr,
  nss_3_114,
+  nss_3_115,
  nss_latest,
  onnxruntime,
  pango,
@@ -573,8 +574,10 @@ buildStdenv.mkDerivation {
      xorg.xorgproto
      zlib
      (
-        if (lib.versionAtLeast version "143") then
+        if (lib.versionAtLeast version "144") then
          nss_latest
+        else if (lib.versionAtLeast version "143") then
+          nss_3_115
        else if (lib.versionAtLeast version "141") then
          nss_3_114
        else
@@ -10,13 +10,13 @@

 rustPlatform.buildRustPackage {
  pname = "artichoke";
-  version = "0-unstable-2025-08-18";
+  version = "0-unstable-2025-09-07";

  src = fetchFromGitHub {
    owner = "artichoke";
    repo = "artichoke";
-    rev = "2dc4c45dc3f925b9aaefc44c33e75dec7586b6ad";
-    hash = "sha256-miZWT1oMyKJLA+6zO881cy4kJrkkmOpfm/l7Su/ECUw=";
+    rev = "8227e6dbb298631c67b4ca2cc4c911d0ef87f38a";
+    hash = "sha256-Pyffs4QB/SkayRwlMmIVagNiamznJp4Dt3nqRDJYfqU=";
  };

  cargoHash = "sha256-JD+qt0pu5wxIuLa3Bd9eadQFE7dyKzqxsAKPebG7+Zg=";
@@ -9,20 +9,20 @@
 }:

 let
-  version = "2025.8.2";
+  version = "2025.9.1";

  product =
    if proEdition then
      {
        productName = "pro";
        productDesktop = "Burp Suite Professional Edition";
-        hash = "sha256-WTIl3HKnZ97TYh6aHdtXx+I/1KLrU3+AwgStiwH6Mrc=";
+        hash = "sha256-24XijVTFmDshv7TYDW05igUOWfJeHT7z8F8fTCBONoM=";
      }
    else
      {
        productName = "community";
        productDesktop = "Burp Suite Community Edition";
-        hash = "sha256-PUT2X9j+Ng33Zj02o3VstDO4rlWYpdj+j/j4P8AZxvU=";
+        hash = "sha256-z65+1erFeO3ZOJRGZ+vdbDxfNpo36eIp6yQskItBl1A=";
      };

  src = fetchurl {
@@ -0,0 +1,182 @@
+From 43eb409b4854eab40fe627fa8266946a64508083 Mon Sep 17 00:00:00 2001
+From: Keith Packard <keithp@keithp.com>
+Date: Mon, 9 Jun 2025 16:19:21 -0700
+Subject: [PATCH 1/3] Let Qt pick how to store settings
+
+Apply target-specific Qt code about how to store application
+preference values by specifying the organization and application name
+rather than a file name
+
+Signed-off-by: Keith Packard <keithp@keithp.com>
+---
+ src/frmmain.cpp | 9 +++++----
+ src/frmmain.h   | 3 ++-
+ 2 files changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/src/frmmain.cpp b/src/frmmain.cpp
+index cab86028..52602d8f 100644
+--- a/src/frmmain.cpp
+++ b/src/frmmain.cpp
+@@ -85,7 +85,8 @@ frmMain::frmMain(QWidget *parent) :
+                        << "black";
+ 
+     // Loading settings
+-    m_settingsFileName = qApp->applicationDirPath() + "/settings.ini";
+    m_settingsOrg = "Candle";
+    m_settingsApp = "candle";
+     preloadSettings();
+ 
+     m_settings = new frmSettings(this);
+@@ -315,7 +316,7 @@ double frmMain::toolZPosition()
+ 
+ void frmMain::preloadSettings()
+ {
+-    QSettings set(m_settingsFileName, QSettings::IniFormat);
+    QSettings set(m_settingsOrg, m_settingsApp);
+     set.setIniCodec("UTF-8");
+ 
+     qApp->setStyleSheet(QString(qApp->styleSheet()).replace(QRegExp("font-size:\\s*\\d+"), "font-size: " + set.value("fontSize", "8").toString()));
+@@ -328,7 +329,7 @@ void frmMain::preloadSettings()
+ 
+ void frmMain::loadSettings()
+ {
+-    QSettings set(m_settingsFileName, QSettings::IniFormat);
+    QSettings set(m_settingsOrg, m_settingsApp);
+     set.setIniCodec("UTF-8");
+ 
+     m_settingsLoading = true;
+@@ -482,7 +483,7 @@ void frmMain::loadSettings()
+ 
+ void frmMain::saveSettings()
+ {
+-    QSettings set(m_settingsFileName, QSettings::IniFormat);
+    QSettings set(m_settingsOrg, m_settingsApp);
+     set.setIniCodec("UTF-8");
+ 
+     set.setValue("port", m_settings->port());
+diff --git a/src/frmmain.h b/src/frmmain.h
+index c1f0ef94..b18d4bbb 100644
+--- a/src/frmmain.h
+++ b/src/frmmain.h
+@@ -236,7 +236,8 @@ private slots:
+     frmSettings *m_settings;
+     frmAbout m_frmAbout;
+ 
+-    QString m_settingsFileName;
+    QString m_settingsOrg;
+    QString m_settingsApp;
+     QString m_programFileName;
+     QString m_heightMapFileName;
+     QString m_lastFolder;
+
+From 7e5e6405d87fe238300b7f632e06053d8f6c7329 Mon Sep 17 00:00:00 2001
+From: Keith Packard <keithp@keithp.com>
+Date: Mon, 9 Jun 2025 16:20:23 -0700
+Subject: [PATCH 2/3] Apply default settings on first run
+
+If there are no application settings available, then
+apply the default values.
+
+Signed-off-by: Keith Packard <keithp@keithp.com>
+---
+ src/frmmain.cpp     |  8 ++++++++
+ src/frmsettings.cpp | 13 +++++++++----
+ src/frmsettings.h   |  1 +
+ 3 files changed, 18 insertions(+), 4 deletions(-)
+
+diff --git a/src/frmmain.cpp b/src/frmmain.cpp
+index 52602d8f..3714253a 100644
+--- a/src/frmmain.cpp
+++ b/src/frmmain.cpp
+@@ -479,6 +479,13 @@ void frmMain::loadSettings()
+     ui->cboCommand->setCurrentIndex(-1);
+ 
+     m_settingsLoading = false;
+
+    if (!set.value("valid", false).toBool()) {
+	m_settings->setDefaults();
+	applySettings();
+	show();
+	ui->scrollArea->updateMinimumWidth();
+    }
+ }
+ 
+ void frmMain::saveSettings()
+@@ -593,6 +600,7 @@ void frmMain::saveSettings()
+ 
+     for (int i = 0; i < ui->cboCommand->count(); i++) list.append(ui->cboCommand->itemText(i));
+     set.setValue("recentCommands", list);
+    set.setValue("valid", true);
+ }
+ 
+ bool frmMain::saveChanges(bool heightMapMode)
+diff --git a/src/frmsettings.cpp b/src/frmsettings.cpp
+index cdc87371..988965f6 100644
+--- a/src/frmsettings.cpp
+++ b/src/frmsettings.cpp
+@@ -621,11 +621,8 @@ void frmSettings::on_cboToolType_currentIndexChanged(int index)
+     ui->txtToolAngle->setEnabled(index == 1);
+ }
+ 
+-void frmSettings::on_cmdDefaults_clicked()
+void frmSettings::setDefaults()
+ {
+-    if (QMessageBox::warning(this, qApp->applicationDisplayName(), tr("Reset settings to default values?"),
+-                             QMessageBox::Yes | QMessageBox::No | QMessageBox::Cancel) != QMessageBox::Yes) return;
+-
+     setPort("");
+     setBaud(115200);
+ 
+@@ -688,6 +685,14 @@ void frmSettings::on_cmdDefaults_clicked()
+     setFontSize(9);
+ }
+ 
+void frmSettings::on_cmdDefaults_clicked()
+{
+    if (QMessageBox::warning(this, qApp->applicationDisplayName(), tr("Reset settings to default values?"),
+                             QMessageBox::Yes | QMessageBox::No | QMessageBox::Cancel) != QMessageBox::Yes) return;
+
+    setDefaults();
+}
+
+ void frmSettings::on_cboFontSize_currentTextChanged(const QString &arg1)
+ {
+     qApp->setStyleSheet(QString(qApp->styleSheet()).replace(QRegExp("font-size:\\s*\\d+"), "font-size: " + arg1));
+diff --git a/src/frmsettings.h b/src/frmsettings.h
+index fc44eb81..b6f2bf0f 100644
+--- a/src/frmsettings.h
+++ b/src/frmsettings.h
+@@ -117,6 +117,7 @@ class frmSettings : public QDialog
+     void setIgnoreErrors(bool value);
+     bool autoLine();
+     void setAutoLine(bool value);
+    void setDefaults();
+ 
+ protected:
+     void showEvent(QShowEvent *se);
+
+From 4ea46db51a0578c94082e4c381dade76a7c44a2b Mon Sep 17 00:00:00 2001
+From: Keith Packard <keithp@keithp.com>
+Date: Mon, 9 Jun 2025 16:21:16 -0700
+Subject: [PATCH 3/3] Try to load any file provided on the command line
+
+Don't filter based upon assumptions about gcode file extensions
+
+Signed-off-by: Keith Packard <keithp@keithp.com>
+---
+ src/frmmain.cpp | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/frmmain.cpp b/src/frmmain.cpp
+index 3714253a..42cf901e 100644
+--- a/src/frmmain.cpp
+++ b/src/frmmain.cpp
+@@ -282,7 +282,7 @@ frmMain::frmMain(QWidget *parent) :
+     m_timerStateQuery.start();
+ 
+     // Handle file drop
+-    if (qApp->arguments().count() > 1 && isGCodeFile(qApp->arguments().last())) {
+    if (qApp->arguments().count() > 1) {
+         loadFile(qApp->arguments().last());
+     }
+ }
@@ -0,0 +1,58 @@
+{
+  stdenv,
+  lib,
+  fetchFromGitHub,
+  nix-update-script,
+  qt5,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "candle";
+  version = "1.1.8";
+
+  src = fetchFromGitHub {
+    owner = "Denvi";
+    repo = "Candle";
+    rev = "v${finalAttrs.version}";
+    sha256 = "sha256-A53rHlabcuw/nWS7jsCyVrP3CUkmUI/UMRqpogyFOCM=";
+  };
+
+  sourceRoot = "${finalAttrs.src.name}/src";
+
+  patches = [
+    # Store application settings in ~/.config/Candle
+    # https://github.com/Denvi/Candle/pull/658
+    ./658.patch
+  ];
+
+  patchFlags = [ "-p2" ];
+
+  nativeBuildInputs = [
+    qt5.qmake
+    qt5.wrapQtAppsHook
+  ];
+
+  buildInputs = [
+    qt5.qtbase
+    qt5.qtserialport
+  ];
+
+  installPhase = ''
+    runHook preInstall
+    install -Dm755 Candle $out/bin/candle
+    runHook postInstall
+  '';
+
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "GRBL controller application with G-Code visualizer written in Qt";
+    mainProgram = "candle";
+    homepage = "https://github.com/Denvi/Candle";
+    license = lib.licenses.gpl3;
+    maintainers = with lib.maintainers; [ matti-kariluoma ];
+    platforms = qt5.qtbase.meta.platforms;
+  };
+})
@@ -75,13 +75,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "cinnamon";
-  version = "6.4.11";
+  version = "6.4.12";

  src = fetchFromGitHub {
    owner = "linuxmint";
    repo = "cinnamon";
    rev = version;
-    hash = "sha256-Hqjsi07qkVGobVwiXgLwZexjssQN0UN1BJo8b8JlpkY=";
+    hash = "sha256-fEi/dUPnHC0OFqefclf0gQsZZNRVzBLaIR41prUfNP8=";
  };

  patches = [
@@ -37,7 +37,7 @@ buildGoModule rec {
          buildPackages.diffoci;
    in
    ''
-      installShellCompletion --cmd trivy \
+      installShellCompletion --cmd diffoci \
        --bash <(${diffoci}/bin/diffoci completion bash) \
        --fish <(${diffoci}/bin/diffoci completion fish) \
        --zsh <(${diffoci}/bin/diffoci completion zsh)
@@ -9,16 +9,16 @@

 buildGo125Module rec {
  pname = "dnscontrol";
-  version = "4.24.0";
+  version = "4.25.0";

  src = fetchFromGitHub {
    owner = "StackExchange";
    repo = "dnscontrol";
    tag = "v${version}";
-    hash = "sha256-DAH6XpRZz6KnkUYcQVWqLc3GP//dgojYH5AUvJ/X7v8=";
+    hash = "sha256-8VNo2IPchplTlI97BzsGcc6i0z7V79oHkSVtCLY8558=";
  };

-  vendorHash = "sha256-lY4E0ediBPsOXL/1KKu0QeYC0llswzYYV4JvtxMQ+PE=";
+  vendorHash = "sha256-Ob6TP81pnsX/uzEh0ekz+koVoC/tqC/3P4wAShnQOVc=";

  nativeBuildInputs = [ installShellFiles ];

@@ -1,7 +1,7 @@
 {
-  "version" = "1.11.111";
+  "version" = "1.11.112";
  "hashes" = {
-    "desktopSrcHash" = "sha256-QRnMHlq/gBoptJ/0iBdKUXbnR/oLVeA+ybF/0YFVBlo=";
+    "desktopSrcHash" = "sha256-L4/2VwPHBusVTCi8DzxmAUbvW0p1d/ffbz9ZwUmgzEo=";
    "desktopYarnHash" = "sha256-U+MuOe0N29AFrLCi7Xa9bDW70SmhQqqtjim+x7QAiJg=";
  };
 }
@@ -1,7 +1,7 @@
 {
-  "version" = "1.11.111";
+  "version" = "1.11.112";
  "hashes" = {
-    "webSrcHash" = "sha256-dNkt8fybwTM0/27L+6o3QuhQJiwTDAN2ez+hUG/0VwE=";
-    "webYarnHash" = "sha256-2QKZu/HObwW1ugUUuSAn2zV3OESgLa6PNizL6hhCBjg=";
+    "webSrcHash" = "sha256-rWbn3ibylEchBZR8ZF6lrPBSjJvF8Ezl/+7ZzgVhz7g=";
+    "webYarnHash" = "sha256-ItrmxNlaRijNpp+gk1g3tTLw4roHuTqW2SnpapIH1Uk=";
  };
 }
@@ -8,13 +8,13 @@

 buildGo125Module (finalAttrs: {
  pname = "f2";
-  version = "2.2.0";
+  version = "2.2.1";

  src = fetchFromGitHub {
    owner = "ayoisaiah";
    repo = "f2";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-eIsy7YYWAiP4Oqla/wsJW2hQ1LgG+QkFxtUPagbmAuM=";
+    hash = "sha256-zAhJ1giOhAhcDlRO/M+pf275m6lVydet1WCSiBIUkjw=";
  };

  vendorHash = "sha256-DHUX+8gw+pmjEQRUeukzTimfYo0iHyN90MjrOlpjoJg=";
@@ -9,13 +9,13 @@

 buildGoModule (finalAttrs: {
  pname = "grype";
-  version = "0.99.1";
+  version = "0.100.0";

  src = fetchFromGitHub {
    owner = "anchore";
    repo = "grype";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-LCwsQERYXoNBuN0w89c+9Yk6ICfCLcd8jW8juSnt2RA=";
+    hash = "sha256-POGGhZ2uTqWjUsl1zR4eirb+Daji+igTtUNwTte7gPA=";
    # populate values that require us to use git. By doing this in postFetch we
    # can delete .git afterwards and maintain better reproducibility of the src.
    leaveDotGit = true;
@@ -30,7 +30,7 @@ buildGoModule (finalAttrs: {

  proxyVendor = true;

-  vendorHash = "sha256-Wh3u5imIOXAiSguKeRUz/qdz4Ox2Bucqqz5DYsxcdFA=";
+  vendorHash = "sha256-QGGY88CELV9e5UxtfDXKmShnKiP8i+0f8iA9pOTirzc=";

  nativeBuildInputs = [ installShellFiles ];

@@ -131,14 +131,14 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "hydra";
-  version = "0-unstable-2025-08-12";
+  version = "0-unstable-2025-09-13";
  # nixpkgs-update: no auto update

  src = fetchFromGitHub {
    owner = "NixOS";
    repo = "hydra";
-    rev = "f7bda020c6144913f134ec616783e57817f7686f";
-    hash = "sha256-5fHXCFSCe2XQoXjqk25AIQo/5aUfaORf9lIszQ9KTyU=";
+    rev = "274027eb504c7fe090e00c16fd94f4b832981095";
+    hash = "sha256-d2e+WCO5vNIgSd7bzm4JD5zU3gZ8mepXKCvt5NGv0Zw=";
  };

  outputs = [
@@ -12,13 +12,13 @@

 stdenv.mkDerivation rec {
  pname = "intel-compute-runtime";
-  version = "25.31.34666.3";
+  version = "25.35.35096.9";

  src = fetchFromGitHub {
    owner = "intel";
    repo = "compute-runtime";
    tag = version;
-    hash = "sha256-eijW4VYKUbiC7izaocadIxFvdZ3neaM3dewPnQDCLYc=";
+    hash = "sha256-GAFbpf5ZUpq+jpVECa5buauCYdpPBOBrREkgrGyhxPA=";
  };

  nativeBuildInputs = [
@@ -12,13 +12,13 @@

 stdenv.mkDerivation rec {
  pname = "ipv6calc";
-  version = "4.3.3";
+  version = "4.4.0";

  src = fetchFromGitHub {
    owner = "pbiering";
    repo = "ipv6calc";
    rev = version;
-    sha256 = "sha256-+oh9sXcww9S2WtOgLXP7mSGGnGmaSSixZIQk5CZwqyU=";
+    sha256 = "sha256-+u+7XdW0bS3nE5djdy7I1/NHZdXU9QKukZAvTkWsCK0=";
  };

  buildInputs = [
@@ -0,0 +1,52 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchurl,
+}:
+let
+  inherit (stdenvNoCC.hostPlatform) system;
+  version = "17.2.17";
+  source =
+    {
+      x86_64-linux = {
+        url = "https://github.com/frida/frida/releases/download/${version}/frida-core-devkit-${version}-linux-x86_64.tar.xz";
+        hash = "sha256-9elOokCY1bxzG2iL4iOODC/7qavwn77a0zOEBpAtT8Q=";
+      };
+      aarch64-linux = {
+        url = "https://github.com/frida/frida/releases/download/${version}/frida-core-devkit-${version}-linux-arm64.tar.xz";
+        hash = "sha256-jk8BKmp3VNvCYK6kgGouFOBECoDaGiWQ8EzZvBwL7cc=";
+      };
+    }
+    .${system} or (throw "Unsupported system: ${system}");
+in
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "libfrida-core";
+  inherit version;
+
+  src = fetchurl {
+    inherit (source) url hash;
+  };
+  dontUnpack = true;
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/include $out/lib
+    tar -xf $src -C .
+    install -Dm755 libfrida-core.a -t $out/lib
+    install -Dm644 frida-core.h -t $out/include
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Frida core library intended for static linking into bindings";
+    homepage = "https://frida.re/";
+    changelog = "https://frida.re/news/";
+    license = lib.licenses.wxWindowsException31;
+    maintainers = with lib.maintainers; [ nilathedragon ];
+    platforms = [
+      "x86_64-linux"
+      "aarch64-linux"
+    ];
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+  };
+})
@@ -8,13 +8,13 @@

 buildGoModule (finalAttrs: {
  pname = "metal-cli";
-  version = "0.25.0";
+  version = "0.26.0";

  src = fetchFromGitHub {
    owner = "equinix";
    repo = "metal-cli";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-+hpsGFZHuVhh+fKVcap0vhoUmRs3xPgUwW8SD56m6uI=";
+    hash = "sha256-x4Q1MKgcamGYb3/0ksbHEaL1mjedx0Tu9IZJ5dTgRpQ=";
  };

  vendorHash = "sha256-X+GfM73LAWk2pT4ZOPT2pg8YaKyT+SNjQ14LgB+C7Wo=";
@@ -50,7 +50,6 @@ buildGoModule (finalAttrs: {
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [
      Br1ght0ne
-      nshalman
      teutat3s
    ];
    mainProgram = "metal";
@@ -9,13 +9,13 @@

 stdenvNoCC.mkDerivation rec {
  pname = "mint-l-theme";
-  version = "2.0.1";
+  version = "2.0.2";

  src = fetchFromGitHub {
    owner = "linuxmint";
    repo = "mint-l-theme";
    rev = version;
-    hash = "sha256-3suLa8el58t5J6aJaH3Z4+tTqoCpD1Uvy2uzaVgIfVo=";
+    hash = "sha256-QPTU/wCOytleuiQAodGzZ1MGWD2Sk7eoeXWpi6nS5As=";
  };

  nativeBuildInputs = [
@@ -1,16 +0,0 @@
--- a/data/meson.build
-+++ b/data/meson.build
-@@ -1,10 +1,13 @@
- dataconf = configuration_data()
- dataconf.set('VERSION', meson.project_version())
-
-+schemadir = get_option('prefix') / get_option('datadir') / 'glib-2.0' / 'schemas'
-+
- install_data(
-     'org.nemo.plugins.seahorse.gschema.xml',
-     'org.nemo.plugins.seahorse.window.gschema.xml',
-     install_dir: get_option('datadir') / 'glib-2.0' / 'schemas',
- )
-
-+meson.add_install_script('glib-compile-schemas', schemadir)
- install_man('nemo-seahorse-tool.1')
@@ -8,14 +8,12 @@
  glib,
  gtk3,
  nemo,
-  cmake,
  dbus-glib,
  libcryptui,
  gcr,
  libnotify,
  gnupg,
  gpgme,
-  nix-update-script,
 }:

 stdenv.mkDerivation rec {
@@ -31,13 +29,11 @@ stdenv.mkDerivation rec {

  sourceRoot = "${src.name}/nemo-seahorse";

-  patches = [ ./fix-schemas.patch ];
-
  nativeBuildInputs = [
+    glib
    meson
    pkg-config
    ninja
-    cmake
  ];

  buildInputs = [
@@ -52,9 +48,11 @@ stdenv.mkDerivation rec {
    gnupg
  ];

-  PKG_CONFIG_LIBNEMO_EXTENSION_EXTENSIONDIR = "${placeholder "out"}/${nemo.extensiondir}";
+  postInstall = ''
+    glib-compile-schemas $out/share/glib-2.0/schemas
+  '';

-  passthru.updateScript = nix-update-script { };
+  env.PKG_CONFIG_LIBNEMO_EXTENSION_EXTENSIONDIR = "${placeholder "out"}/${nemo.extensiondir}";

  meta = {
    homepage = "https://github.com/linuxmint/nemo-extensions/tree/master/nemo-seahorse";
@@ -5,9 +5,9 @@
    },
    "osquery": {
        "fetchSubmodules": true,
-        "hash": "sha256-oNH+mDTtg4m6wnE5XBWRQHWhBasy9ssSrxA/TPCd2pI=",
+        "hash": "sha256-O5FfbPZt0cxl7Zia8gSn4xLhLyTlA9Z0SDDvGSgTTyw=",
        "owner": "osquery",
        "repo": "osquery",
-        "rev": "5.18.1"
+        "rev": "5.19.0"
    }
 }
@@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "pgscv";
-  version = "0.14.2";
+  version = "0.15.0";

  src = fetchFromGitHub {
    owner = "CHERTS";
    repo = "pgscv";
    tag = "v${version}";
-    hash = "sha256-ON1/ShMnBIC7t1b8ejZR74BtEZNG/0EhgwurhkGoIxA=";
+    hash = "sha256-5n2HANuWQT1eQfz+cP0AlKLVe/aNJmGrTJ9l7l40T0k=";
  };

-  vendorHash = "sha256-T4XlNhLgPE28S+TUWM+f38iVumxkk3Ku9qFzPJ2zQY4=";
+  vendorHash = "sha256-epQCbmfa2qlgEp0ta3FqjUlkEkq1duE0a20CSTLrS28=";

  ldflags = [
    "-X=main.appName=pgscv"
@@ -7,14 +7,14 @@
  versionCheckHook,
 }:

-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage {
  pname = "proxmox-auto-install-assistant";
-  version = "8.4.6";
+  version = "9.0.7";

  src = fetchgit {
    url = "git://git.proxmox.com/git/pve-installer.git";
-    rev = "fcd13b1503bec573da9db4bfad42b2478e97d9ce";
-    hash = "sha256-fPl6qxWTaqumtnAFUfEBTChTIe+94fWCZv8s7Sq9zSk=";
+    rev = "cfcaceacb797bfdbff8c7e8fed76e56642390b20";
+    hash = "sha256-tXwNuT25GzQhdDtYiiQKPu6EPZQffUOZhBqkLZK/+DY=";
  };

  postPatch = ''
@@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "pwdsafety";
-  version = "0.4.0";
+  version = "0.4.1";

  src = fetchFromGitHub {
    owner = "edoardottt";
    repo = "pwdsafety";
    tag = "v${version}";
-    hash = "sha256-cKxTcfNjvwcDEw0Z1b50A4u0DUYXlGMMfGWJLPaSkcw=";
+    hash = "sha256-qFYy22d8DqzsphdO1pCYiIKf1P2yQ4w+R1+K2sHI2kk=";
  };

-  vendorHash = "sha256-RoRq9JZ8lOMtAluz8TB2RRuDEWFOBtWVhz21aTkXXy4=";
+  vendorHash = "sha256-CUwgAkCYc3U86QJo4RyWGqTYdx21Ysct0HBnU9w4YyU=";

  ldflags = [
    "-w"
@@ -7,14 +7,14 @@

 python3Packages.buildPythonApplication rec {
  pname = "pyradio";
-  version = "0.9.3.11.16";
+  version = "0.9.3.11.18";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "coderholic";
    repo = "pyradio";
    tag = version;
-    hash = "sha256-PogdBixxr50M5J4hp158KAhs6+2E3ILCC44MAh222QY=";
+    hash = "sha256-/JUNA3gbnmJBFMVxffSmbngiHRlzjzMHCPTfJq0TqLA=";
  };

  nativeBuildInputs = [
@@ -15,6 +15,7 @@
  ragel,
  fasttext,
  icu,
+  hyperscan,
  vectorscan,
  jemalloc,
  blas,
@@ -27,10 +28,15 @@
  # Enabling blas support breaks bayes filter training from dovecot in nixos-mailserver tests
  # https://gitlab.com/simple-nixos-mailserver/nixos-mailserver/-/issues/321
  withBlas ? false,
+  withHyperscan ? false,
  withLuaJIT ? stdenv.hostPlatform.isx86_64,
+  withVectorscan ? true,
  nixosTests,
 }:

+assert withHyperscan -> stdenv.hostPlatform.isx86_64;
+assert (!withHyperscan) || (!withVectorscan);
+
 stdenv.mkDerivation rec {
  pname = "rspamd";
  version = "3.12.1";
@@ -66,14 +72,15 @@ stdenv.mkDerivation rec {
    xxHash
    zstd
    libarchive
-    vectorscan
  ]
  ++ lib.optionals withBlas [
    blas
    lapack
  ]
+  ++ lib.optional withHyperscan hyperscan
  ++ lib.optional withLuaJIT luajit
-  ++ lib.optional (!withLuaJIT) lua;
+  ++ lib.optional (!withLuaJIT) lua
+  ++ lib.optional withVectorscan vectorscan;

  cmakeFlags = [
    # pcre2 jit seems to cause crashes: https://github.com/NixOS/nixpkgs/pull/181908
@@ -22,13 +22,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "saunafs";
-  version = "4.11.0";
+  version = "5.1.2";

  src = fetchFromGitHub {
    owner = "leil-io";
    repo = "saunafs";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-ZQ0+jiVpHZhAOdYneKkPi3M45LU9xj2FBbqo6VcD0JY=";
+    hash = "sha256-56PlUeXHqNhKYokKWqLCeaP3FZBdefhQFQQoP8YytQQ=";
  };

  patches = [
@@ -9,14 +9,14 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "secretspec";
-  version = "0.3.1";
+  version = "0.3.3";

  src = fetchCrate {
    inherit (finalAttrs) pname version;
-    hash = "sha256-g1mpdA024fy56aFk35iLnKdk75e+uFkXP1or9P5agbY=";
+    hash = "sha256-vbGUnYLL8U9CZmMLGfBxk3+0cjZR62Ug1rsis4O4iNk=";
  };

-  cargoHash = "sha256-uqolUCR2cBR3YFbOQzuSbi88a9ioKmFLsGwBhtBpHDI=";
+  cargoHash = "sha256-q5d+8QsyS5eMVeuwn3AYY3Mxs5nWiYtLeAJzY7SAuuQ=";

  nativeBuildInputs = [ pkg-config ];
  buildInputs = [ dbus ];
@@ -32,6 +32,7 @@ buildGoModule rec {
    xorg.libX11
    xorg.libXcursor
    xorg.libXfixes
+    xorg.libxcb
    libGL
    sqlite
  ];
@@ -1,13 +0,0 @@
-diff --git a/Makefile.in b/Makefile.in
-index b9736cd..5740412 100644
--- a/Makefile.in
-+++ b/Makefile.in
-@@ -76,7 +76,7 @@ bdf : $(bdf)
- 
- genpcf/%.pcf.gz : genbdf/%.bdf
- 	$(BDFTOPCF) $< > $(@:.pcf.gz=.pcf)
-	gzip -9 -f $(@:.pcf.gz=.pcf)
-+	gzip -n -9 -f $(@:.pcf.gz=.pcf)
- 
- genbdf/t0-11-uni.bdf : bdf/t0-11.bdf bdf/t0-12.bdf VARIANTS.dat mgl/unicode.mgl
- 	$(MKSHALLOW) bdf/t0-12.bdf | cat - bdf/t0-11.bdf | $(BDFMANGLE) - VARIANTS.dat mgl/unicode.mgl > $@
@@ -12,16 +12,13 @@

 stdenv.mkDerivation rec {
  pname = "uw-ttyp0";
-  version = "1.3";
+  version = "2.1";

  src = fetchurl {
    url = "https://people.mpi-inf.mpg.de/~uwe/misc/${pname}/${pname}-${version}.tar.gz";
-    sha256 = "1vp053bwv8sr40p3pn4sjaiq570zp7knh99z9ynk30v7ml4cz2i8";
+    hash = "sha256-mVBt2HlOGl1c1YEebB5V7u+Yn4w1Af25Jlvalyq6FjA=";
  };

-  # remove for version >1.3
-  patches = [ ./determinism.patch ];
-
  nativeBuildInputs = [
    perl
    bdftopcf
@@ -39,6 +36,9 @@ stdenv.mkDerivation rec {
          SIZES = 11 12 13 14 15 16 17 18 22 \
          11b 12b 13b 14b 15b 16b 17b 18b 22b 15i 16i 17i 18i
          ENCODINGS = uni
+          GEN_PCF = 1
+          GEN_OTB = 1
+          GEN_CONS_LINUX = 1
          EOF
        ''
      else
@@ -57,43 +57,13 @@ stdenv.mkDerivation rec {
        ''cp "${variantsDat}" VARIANTS.dat''
    );

-  postBuild = ''
-    # convert bdf fonts to psf
-    build=$(pwd)
-    mkdir {psf,otb}
-    cd ${bdf2psf}/share/bdf2psf
-    for i in $build/genbdf/*.bdf; do
-      name="$(basename $i .bdf)"
-      bdf2psf \
-        --fb "$i" standard.equivalents \
-        ascii.set+useful.set+linux.set 512 \
-        "$build/psf/$name.psf"
-    done
-    cd -
-
-    # convert unicode bdf fonts to otb
-    for i in $build/genbdf/*-uni.bdf; do
-      name="$(basename $i .bdf)"
-      fonttosfnt -v -o "$build/otb/$name.otb" "$i"
-    done
-  '';
-
-  postInstall = ''
-    # install psf fonts
-    fontDir="$out/share/consolefonts"
-    install -m 644 -D psf/*.psf -t "$fontDir"
-
-    # install otb fonts
-    fontDir="$out/share/fonts/X11/misc"
-    install -m 644 -D otb/*.otb -t "$fontDir"
-    mkfontdir "$fontDir"
-  '';
-
-  # Nix with multiple outputs adds several flags
-  # that the ./configure script doesn't understand.
  configurePhase = ''
    runHook preConfigure
-    ./configure --prefix="$out"
+    ./configure \
+      --prefix="$out" \
+      --otbdir="$out/share/fonts/X11/misc" \
+      --pcfdir="$out/share/fonts/X11/misc" \
+      --conslinuxdir="$out/share/consolefonts"
    runHook postConfigure
  '';

@@ -13,13 +13,13 @@

 buildGoModule (finalAttrs: {
  pname = "VictoriaMetrics";
-  version = "1.125.1";
+  version = "1.126.0";

  src = fetchFromGitHub {
    owner = "VictoriaMetrics";
    repo = "VictoriaMetrics";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-pRYazo13K5mjdwQD3VJcX9Js4xEG9dgz7MbM8HvxWV0=";
+    hash = "sha256-QVeg/F7oPPgSRTi5jcfTj15bD/7fQoPopahpUP9b0UA=";
  };

  vendorHash = null;
@@ -6,16 +6,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "watchlog";
-  version = "1.248.0";
+  version = "1.250.0";

  src = fetchFromGitLab {
    owner = "kevincox";
    repo = "watchlog";
    rev = "v${version}";
-    hash = "sha256-zi1tfndcjDoAT5IPj1ydjqeQyKAocR0O/jLeZTZAfO0=";
+    hash = "sha256-a8x1fEYuHZu2Z/CE835HEqkNr7Mtbdtuq1vDRKfEl5U=";
  };

-  cargoHash = "sha256-/yUXaHGnhx/eOeXmAhLg9zWWHOuLGqbBBLjAJsB6JZw=";
+  cargoHash = "sha256-b+xuMUt9btrfKLUluxtSFXdFKtOHmKVV0m1fPM5cNRA=";

  meta = {
    description = "Easier monitoring of live logs";
@@ -32,13 +32,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "xemu";
-  version = "0.8.97";
+  version = "0.8.98";

  src = fetchFromGitHub {
    owner = "xemu-project";
    repo = "xemu";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-xx3f4khNV4CwtM9R2NQ2usDc/ScGEaZ3EbyDv1jaHtQ=";
+    hash = "sha256-kqNZFRkLZ7MiniV2kg+FJ6E4Ms/8+pQLHe8MvhZYC0I=";

    nativeBuildInputs = [
      git
@@ -2,25 +2,21 @@
  lib,
  python3,
  fetchFromGitHub,
+  gitUpdater,
 }:

 python3.pkgs.buildPythonApplication rec {
  pname = "yaralyzer";
-  version = "1.0.6";
+  version = "1.0.9";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "michelcrypt4d4mus";
    repo = "yaralyzer";
    tag = "v${version}";
-    hash = "sha256-zaC33dlwjMNvvXnxqrEJvk3Umh+4hYsbDWoW6n6KmCk=";
+    hash = "sha256-OGMvDPwR4WFINKJpoP242Xhi3mhDzrUypClVGgIIHJI=";
  };

-  pythonRelaxDeps = [
-    "python-dotenv"
-    "rich"
-  ];
-
  build-system = with python3.pkgs; [
    poetry-core
  ];
@@ -37,6 +33,10 @@ python3.pkgs.buildPythonApplication rec {
    "yaralyzer"
  ];

+  passthru = {
+    updateScript = gitUpdater { rev-prefix = "v"; };
+  };
+
  meta = {
    description = "Tool to visually inspect and force decode YARA and regex matches";
    homepage = "https://github.com/michelcrypt4d4mus/yaralyzer";
@@ -5,13 +5,13 @@
 }:
 mkYaziPlugin {
  pname = "recycle-bin.yazi";
-  version = "0-unstable-2025-09-08";
+  version = "0-unstable-2025-09-15";

  src = fetchFromGitHub {
    owner = "uhs-robert";
    repo = "recycle-bin.yazi";
-    rev = "728c0af4111ad043f9361ce6373949b5f9dec4a3";
-    hash = "sha256-XnDiWuKLyI1jszwKTaVnPR8AX3+9mdkkof+V6E8RkR4=";
+    rev = "2bd3c588adee5388afe08faea59e8e5437f5adb6";
+    hash = "sha256-hc3K8WUWeptLloDYsZzZfKJyk5J6iyVjuijnUe1fUCM=";
  };

  meta = {
@@ -6,13 +6,13 @@

 stdenv.mkDerivation rec {
  pname = "zsh-vi-mode";
-  version = "0.11.0";
+  version = "0.12.0";

  src = fetchFromGitHub {
    owner = "jeffreytse";
    repo = "zsh-vi-mode";
    rev = "v${version}";
-    sha256 = "sha256-xbchXJTFWeABTwq6h4KWLh+EvydDrDzcY9AQVK65RS8=";
+    sha256 = "sha256-EYr/jInRGZSDZj+QVAc9uLJdkKymx1tjuFBWgpsaCFw=";
  };

  strictDeps = true;
@@ -0,0 +1,220 @@
+This patch introduces an intermediate Gradle build step to alter the behavior
+of flutter_tools' Gradle project, specifically moving the creation of `build`
+and `.gradle` directories from within the Nix Store to somewhere in `$HOME/.cache/flutter/nix-flutter-tools-gradle/$engineShortRev`.
+
+Without this patch, flutter_tools' Gradle project tries to generate `build` and `.gradle`
+directories within the Nix Store. Resulting in read-only errors when trying to build a
+Flutter Android app at runtime.
+
+This patch takes advantage of the fact settings.gradle takes priority over settings.gradle.kts to build the intermediate Gradle project
+when a Flutter app runs `includeBuild("${settings.ext.flutterSdkPath}/packages/flutter_tools/gradle")`
+
+`rootProject.buildFileName = "/dev/null"` so that the intermediate project doesn't use `build.gradle.kts` that's in the same directory.
+
+The intermediate project makes a `settings.gradle` file in `$HOME/.cache/flutter/nix-flutter-tools-gradle/<short engine rev>/` and `includeBuild`s it.
+This Gradle project will build the actual `packages/flutter_tools/gradle` project by setting
+`rootProject.projectDir = new File("$settingsDir")` and `apply from: new File("$settingsDir/settings.gradle.kts")`.
+
+To move `build` to `$HOME/.cache/flutter/nix-flutter-tools-gradle/<short engine rev>/`, we need to set `buildDirectory`.
+To move `.gradle` as well, the `--project-cache-dir` argument must be passed to the Gradle wrapper.
+Changing the `GradleUtils.getExecutable` function signature is a delibarate choice, to ensure that no new unpatched usages slip in.
+--- /dev/null
+++ b/packages/flutter_tools/gradle/settings.gradle
+@@ -0,0 +1,19 @@
+rootProject.buildFileName = "/dev/null"
+
+def engineShortRev = (new File("$settingsDir/../../../bin/internal/engine.version")).text.take(10)
+def dir = new File("$System.env.HOME/.cache/flutter/nix-flutter-tools-gradle/$engineShortRev")
+dir.mkdirs()
+def file = new File(dir, "settings.gradle")
+
+file.text = """
+rootProject.projectDir = new File("$settingsDir")
+apply from: new File("$settingsDir/settings.gradle.kts")
+
+gradle.allprojects { project ->
+  project.beforeEvaluate {
+    project.layout.buildDirectory = new File("$dir/build")
+  }
+}
+"""
+
+includeBuild(dir)
+--- a/packages/flutter_tools/gradle/build.gradle.kts
+++ b/packages/flutter_tools/gradle/build.gradle.kts
+@@ -4,6 +4,11 @@
+ 
+ import org.jetbrains.kotlin.gradle.dsl.JvmTarget
+ 
+// While flutter_tools runs Gradle with a --project-cache-dir, this startParameter
+// is not passed correctly to the Kotlin Gradle plugin for some reason, and so
+// must be set here as well.
+gradle.startParameter.projectCacheDir = layout.buildDirectory.dir("cache").get().asFile
+
+ plugins {
+     `java-gradle-plugin`
+     groovy
+--- a/packages/flutter_tools/lib/src/android/gradle.dart
+++ b/packages/flutter_tools/lib/src/android/gradle.dart
+@@ -474,9 +474,9 @@ class AndroidGradleBuilder implements AndroidBuilder {
+     // from the local.properties file.
+     updateLocalProperties(project: project, buildInfo: androidBuildInfo.buildInfo);
+ 
+-    final options = <String>[];
+-
+-    final String gradleExecutablePath = _gradleUtils.getExecutable(project);
+    final [String gradleExecutablePath, ...List<String> options] = _gradleUtils.getExecutable(
+      project,
+    );
+ 
+     // All automatically created files should exist.
+     if (configOnly) {
+@@ -797,7 +797,7 @@ class AndroidGradleBuilder implements AndroidBuilder {
+       'aar_init_script.gradle',
+     );
+     final command = <String>[
+-      _gradleUtils.getExecutable(project),
+      ..._gradleUtils.getExecutable(project),
+       '-I=$initScript',
+       '-Pflutter-root=$flutterRoot',
+       '-Poutput-dir=${outputDirectory.path}',
+@@ -912,6 +912,10 @@ class AndroidGradleBuilder implements AndroidBuilder {
+     final results = <String>[];
+ 
+     try {
+      final [String gradleExecutablePath, ...List<String> options] = _gradleUtils.getExecutable(
+        project,
+      );
+
+       exitCode = await _runGradleTask(
+         _kBuildVariantTaskName,
+         preRunTask: () {
+@@ -927,10 +931,10 @@ class AndroidGradleBuilder implements AndroidBuilder {
+             ),
+           );
+         },
+-        options: const <String>['-q'],
+        options: <String>[...options, '-q'],
+         project: project,
+         localGradleErrors: gradleErrors,
+-        gradleExecutablePath: _gradleUtils.getExecutable(project),
+        gradleExecutablePath: gradleExecutablePath,
+         outputParser: (String line) {
+           if (_kBuildVariantRegex.firstMatch(line) case final RegExpMatch match) {
+             results.add(match.namedGroup(_kBuildVariantRegexGroupName)!);
+@@ -964,6 +968,10 @@ class AndroidGradleBuilder implements AndroidBuilder {
+     late Stopwatch sw;
+     var exitCode = 1;
+     try {
+      final [String gradleExecutablePath, ...List<String> options] = _gradleUtils.getExecutable(
+        project,
+      );
+
+       exitCode = await _runGradleTask(
+         taskName,
+         preRunTask: () {
+@@ -979,10 +987,10 @@ class AndroidGradleBuilder implements AndroidBuilder {
+             ),
+           );
+         },
+-        options: <String>['-q', '-PoutputPath=$outputPath'],
+        options: <String>[...options, '-q', '-PoutputPath=$outputPath'],
+         project: project,
+         localGradleErrors: gradleErrors,
+-        gradleExecutablePath: _gradleUtils.getExecutable(project),
+        gradleExecutablePath: gradleExecutablePath,
+       );
+     } on Error catch (error) {
+       _logger.printError(error.toString());
+--- a/packages/flutter_tools/lib/src/android/gradle_errors.dart
+++ b/packages/flutter_tools/lib/src/android/gradle_errors.dart
+@@ -228,7 +228,12 @@ final flavorUndefinedHandler = GradleHandledError(
+   },
+   handler: ({required String line, required FlutterProject project, required bool usesAndroidX}) async {
+     final RunResult tasksRunResult = await globals.processUtils.run(
+-      <String>[globals.gradleUtils!.getExecutable(project), 'app:tasks', '--all', '--console=auto'],
+      <String>[
+        ...globals.gradleUtils!.getExecutable(project),
+        'app:tasks',
+        '--all',
+        '--console=auto',
+      ],
+       throwOnError: true,
+       workingDirectory: project.android.hostAppGradleRoot.path,
+       environment: globals.java?.environment,
+--- a/packages/flutter_tools/lib/src/android/gradle_utils.dart
+++ b/packages/flutter_tools/lib/src/android/gradle_utils.dart
+@@ -3,6 +3,7 @@
+ // found in the LICENSE file.
+ 
+ import 'package:meta/meta.dart';
+import 'package:path/path.dart';
+ import 'package:process/process.dart';
+ import 'package:unified_analytics/unified_analytics.dart';
+ 
+@@ -197,9 +198,29 @@ class GradleUtils {
+   final Logger _logger;
+   final OperatingSystemUtils _operatingSystemUtils;
+ 
+  List<String> get _requiredArguments {
+    final String cacheDir = join(
+      switch (globals.platform.environment['XDG_CACHE_HOME']) {
+        final String cacheHome => cacheHome,
+        _ => join(
+          globals.fsUtils.homeDirPath ?? throwToolExit('No cache directory has been specified.'),
+          '.cache',
+        ),
+      },
+      'flutter',
+      'nix-flutter-tools-gradle',
+      globals.flutterVersion.engineRevision.substring(0, 10),
+    );
+
+    return <String>[
+      '--project-cache-dir=${join(cacheDir, 'cache')}',
+      '-Pkotlin.project.persistent.dir=${join(cacheDir, 'kotlin')}',
+    ];
+  }
+
+   /// Gets the Gradle executable path and prepares the Gradle project.
+   /// This is the `gradlew` or `gradlew.bat` script in the `android/` directory.
+-  String getExecutable(FlutterProject project) {
+  List<String> getExecutable(FlutterProject project) {
+     final Directory androidDir = project.android.hostAppGradleRoot;
+     injectGradleWrapperIfNeeded(androidDir);
+ 
+@@ -210,7 +231,7 @@ class GradleUtils {
+       // If the Gradle executable doesn't have execute permission,
+       // then attempt to set it.
+       _operatingSystemUtils.makeExecutable(gradle);
+-      return gradle.absolute.path;
+      return <String>[gradle.absolute.path, ..._requiredArguments];
+     }
+     throwToolExit(
+       'Unable to locate gradlew script. Please check that ${gradle.path} '
+--- a/packages/flutter_tools/test/general.shard/android/android_gradle_builder_test.dart
+++ b/packages/flutter_tools/test/general.shard/android/android_gradle_builder_test.dart
+@@ -2606,8 +2606,8 @@ Gradle Crashed
+ 
+ class FakeGradleUtils extends Fake implements GradleUtils {
+   @override
+-  String getExecutable(FlutterProject project) {
+-    return 'gradlew';
+  List<String> getExecutable(FlutterProject project) {
+    return const <String>['gradlew'];
+   }
+ }
+ 
+--- a/packages/flutter_tools/test/general.shard/android/gradle_errors_test.dart
+++ b/packages/flutter_tools/test/general.shard/android/gradle_errors_test.dart
+@@ -1633,8 +1633,8 @@ Platform fakePlatform(String name) {
+ 
+ class FakeGradleUtils extends Fake implements GradleUtils {
+   @override
+-  String getExecutable(FlutterProject project) {
+-    return 'gradlew';
+  List<String> getExecutable(FlutterProject project) {
+    return const <String>['gradlew'];
+   }
+ }
+ 
@@ -23,11 +23,9 @@ lib.makeScope pkgs.newScope (

    truffleruby = self.callPackage ./community-edition/truffleruby { };

-    graalvm-oracle_25-ea =
-      (self.callPackage ./graalvm-oracle { version = "25-ea-36"; }).overrideAttrs
-        (prev: {
-          autoPatchelfIgnoreMissingDeps = [ "libonnxruntime.so.1" ];
-        });
+    graalvm-oracle_25 = (self.callPackage ./graalvm-oracle { version = "25"; }).overrideAttrs (prev: {
+      autoPatchelfIgnoreMissingDeps = [ "libonnxruntime.so.1" ];
+    });
    graalvm-oracle_24 = (self.callPackage ./graalvm-oracle { version = "24"; }).overrideAttrs (prev: {
      autoPatchelfIgnoreMissingDeps = [ "libonnxruntime.so.1.18.0" ];
    });
@@ -37,5 +35,6 @@ lib.makeScope pkgs.newScope (
  // lib.optionalAttrs config.allowAliases {
    graalvm-oracle_22 = throw "GraalVM 22 is EOL, use a newer version instead";
    graalvm-oracle_23 = throw "GraalVM 23 is EOL, use a newer version instead";
+    graalvm-oracle_25-ea = throw "GraalVM 25-ea has been replaced by GraalVM 25";
  }
 )
@@ -4,22 +4,22 @@
 # $ rg -No "(https://.+)\"" -r '$1' pkgs/development/compilers/graalvm/graalvm-oracle/hashes.nix | \
 #   parallel -k 'echo {}; nix --extra-experimental-features nix-command hash convert --hash-algo sha256 --to sri $(curl -s {}.sha256)'
 {
-  "25-ea-36" = {
+  "25" = {
    "aarch64-linux" = {
-      hash = "sha256-NbN5UYIRgyqMXuGZcf0OQhghBa1v4/jpMJvOih8+7Nk=";
-      url = "https://github.com/graalvm/oracle-graalvm-ea-builds/releases/download/jdk-25.0.0-ea.36/graalvm-jdk-25.0.0-ea.36_linux-aarch64_bin.tar.gz";
+      hash = "sha256-pGirVIPXTz0p39qpybKbKSYaOp5JeG0hxKnACwbBVuo=";
+      url = "https://download.oracle.com/graalvm/25/latest/graalvm-jdk-25_linux-aarch64_bin.tar.gz";
    };
    "x86_64-linux" = {
-      hash = "sha256-LQCwzhYDsbhR+ij8zYh37H7xhxbfxzZxAVFNLBzmFVs=";
-      url = "https://github.com/graalvm/oracle-graalvm-ea-builds/releases/download/jdk-25.0.0-ea.36/graalvm-jdk-25.0.0-ea.36_linux-x64_bin.tar.gz";
+      hash = "sha256-BNuoXdzg33UtbWngR2Z2/a0JmLfaXToPmq0f5uP/ocU=";
+      url = "https://download.oracle.com/graalvm/25/latest/graalvm-jdk-25_linux-x64_bin.tar.gz";
    };
    "x86_64-darwin" = {
-      hash = "sha256-GU57RhQJK4SHOigRMsCPwXkLo9SKJ/73GVZw2QzcIVM=";
-      url = "https://github.com/graalvm/oracle-graalvm-ea-builds/releases/download/jdk-25.0.0-ea.36/graalvm-jdk-25.0.0-ea.36_macos-x64_bin.tar.gz";
+      hash = "sha256-+Z4+6kgIoLc7VZ4oxGRs8JHfEtakwGX+80ZkqxcpkTc=";
+      url = "https://download.oracle.com/graalvm/25/latest/graalvm-jdk-25_macos-x64_bin.tar.gz";
    };
    "aarch64-darwin" = {
-      hash = "sha256-nOJ6Ngsy/EMZ93R1WIQ6AMD//QSaKBvNqAd3CxLdJ74=";
-      url = "https://github.com/graalvm/oracle-graalvm-ea-builds/releases/download/jdk-25.0.0-ea.36/graalvm-jdk-25.0.0-ea.36_macos-aarch64_bin.tar.gz";
+      hash = "sha256-bnfxewEInf2wxUzOiqk2hH4qAZ4BEEGIE7SbO9l03JA=";
+      url = "https://download.oracle.com/graalvm/25/latest/graalvm-jdk-25_macos-aarch64_bin.tar.gz";
    };
  };
  "24" = {
@@ -1,5 +1,6 @@
 {
  fetchurl,
+  fetchDebianPatch,
  lib,
  stdenv,
  makeWrapper,
@@ -43,6 +44,16 @@ stdenv.mkDerivation {
        sha256 = "035f92vni0vqmgj9hq2i7vwasz7crx52wll4823vhfkm1qdv5ywc";
      };

+  patches = [
+    (fetchDebianPatch {
+      pname = "mit-scheme";
+      version = "12.1";
+      debianRevision = "4";
+      patch = "0006-texi2any-_html-fix.patch";
+      hash = "sha256-tTAK/xRGubQeiqe1Nbo+m3CYmscXxQ8HAlIl4kSZxk8=";
+    })
+  ];
+
  buildInputs = [ ncurses ] ++ lib.optionals enableX11 [ libX11 ];

  configurePhase = ''
@@ -532,6 +532,7 @@ stdenv.mkDerivation {
    # - We can further reduce targets to just our targetPlatform.
    cmakeFlags="
      -GNinja
+      -DLLVM_BUILD_TOOLS=NO
      -DLLVM_ENABLE_PROJECTS=clang
      -DLLVM_TARGETS_TO_BUILD=${
        {
@@ -0,0 +1,120 @@
+{
+  coq,
+  mkCoqDerivation,
+  mathcomp,
+  bignums,
+  flocq,
+  coquelicot,
+  interval,
+  mathcomp-reals-stdlib,
+  multinomials,
+  coqeal,
+  lib,
+  version ? null,
+}:
+
+let
+  repo = "validsdp";
+  owner = "validsdp";
+
+  inherit version;
+  defaultVersion =
+    let
+      case = coq: mc: out: {
+        cases = [
+          coq
+          mc
+        ];
+        inherit out;
+      };
+    in
+    with lib.versions;
+    lib.switch
+      [ coq.coq-version mathcomp.version ]
+      [
+        (case (range "9.0" "9.1") (isGe "2.3.0") "1.1.0")
+      ]
+      null;
+  release = {
+    "1.1.0".sha256 = "sha256-lbESAFBEBpOShNFh6RZQYPLRhdqYvdKBrxJOMy2L+Ws=";
+  };
+  releaseRev = v: "v${v}";
+
+  # list of packages sorted by dependency order
+  packages = {
+    "libvalidsdp" = [ ];
+    "validsdp" = [ "libvalidsdp" ];
+  };
+
+  validsdp_ =
+    package:
+    let
+      libvalidsdp-deps = [
+        mathcomp.field
+        bignums
+        flocq
+        coquelicot
+        interval
+        mathcomp-reals-stdlib
+      ];
+      validsdp-deps = [
+        mathcomp.field
+        bignums
+        flocq
+        interval
+        mathcomp-reals-stdlib
+        multinomials
+        coqeal
+        coq.ocamlPackages.osdp
+        coq.ocamlPackages.ocplib-simplex
+      ];
+      intra-deps = map validsdp_ packages.${package};
+      pkgpath = lib.switch package [
+        {
+          case = "libvalidsdp";
+          out = "libvalidsdp";
+        }
+        {
+          case = "validsdp";
+          out = ".";
+        }
+      ] package;
+      pname = package;
+
+      derivation = mkCoqDerivation ({
+        inherit
+          version
+          pname
+          defaultVersion
+          release
+          releaseRev
+          repo
+          owner
+          ;
+
+        namePrefix = [
+          "coq"
+        ];
+
+        mlPlugin = package == "validsdp";
+
+        propagatedBuildInputs =
+          intra-deps
+          ++ lib.optionals (package == "libvalidsdp") libvalidsdp-deps
+          ++ lib.optionals (package == "validsdp") validsdp-deps;
+
+        preBuild = ''
+          cd ${pkgpath}
+        '';
+
+        meta = {
+          description = "ValidSDP";
+          license = lib.licenses.lgpl21Plus;
+        };
+
+        passthru = lib.mapAttrs (package: deps: validsdp_ package) packages;
+      });
+    in
+    derivation;
+in
+validsdp_ "validsdp"
@@ -3,10 +3,12 @@
  stdenv,
  replaceVars,
  fetchurl,
+  autoconf,
  zlibSupport ? true,
  zlib,
  bzip2,
  pkg-config,
+  lndir,
  libffi,
  sqlite,
  openssl,
@@ -80,7 +82,10 @@ stdenv.mkDerivation rec {
    inherit hash;
  };

-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [
+    pkg-config
+    lndir
+  ];
  buildInputs = [
    bzip2
    openssl
@@ -120,16 +125,18 @@ stdenv.mkDerivation rec {
  dontPatchShebangs = true;
  disallowedReferences = [ python ];

-  env = {
-    # fix compiler error in curses cffi module, where char* != const char*
-    NIX_CFLAGS_COMPILE =
-      if stdenv.cc.isClang then "-Wno-error=incompatible-function-pointer-types" else null;
-    C_INCLUDE_PATH = lib.makeSearchPathOutput "dev" "include" buildInputs;
-    LIBRARY_PATH = lib.makeLibraryPath buildInputs;
-    LD_LIBRARY_PATH = lib.makeLibraryPath (
-      builtins.filter (x: x.outPath != stdenv.cc.libc.outPath or "") buildInputs
-    );
-  };
+  env =
+    lib.optionalAttrs stdenv.cc.isClang {
+      # fix compiler error in curses cffi module, where char* != const char*
+      NIX_CFLAGS_COMPILE = "-Wno-error=incompatible-function-pointer-types";
+    }
+    // {
+      C_INCLUDE_PATH = lib.makeSearchPathOutput "dev" "include" buildInputs;
+      LIBRARY_PATH = lib.makeLibraryPath buildInputs;
+      LD_LIBRARY_PATH = lib.makeLibraryPath (
+        builtins.filter (x: x.outPath != stdenv.cc.libc.outPath or "") buildInputs
+      );
+    };

  patches = [
    ./dont_fetch_vendored_deps.patch
@@ -148,7 +155,7 @@ stdenv.mkDerivation rec {
    # 3. ld -t (where it attaches the values in $LD_LIBRARY_PATH as -L arguments)
    # The first is disabled in Nix (and wouldn't work in the build sandbox or on NixOS anyway), and
    # the third was only introduced in Python 3.6 (see bugs.python.org/issue9998), so is not
-    # available when buliding PyPy (which is built using Python/PyPy 2.7).
+    # available when building PyPy (which is built using Python/PyPy 2.7).
    # The second requires SONAME to be set for the dynamic library for the second part not to fail.
    # As libsqlite3 stopped shipping with SONAME after the switch to autosetup (>= 3.50 in Nixpkgs;
    # see https://www.sqlite.org/src/forumpost/5a3b44f510df8ded). This makes the Python CFFI module
@@ -175,7 +182,9 @@ stdenv.mkDerivation rec {
    ${pythonForPypy.interpreter} rpython/bin/rpython \
      --make-jobs="$NIX_BUILD_CORES" \
      -O${optimizationLevel} \
-      --batch pypy/goal/targetpypystandalone.py
+      --batch \
+      pypy/goal/targetpypystandalone.py \
+      ${lib.optionalString ((toString optimizationLevel) == "1") "--withoutmod-cpyext"}

    runHook postBuild
  '';
@@ -183,16 +192,17 @@ stdenv.mkDerivation rec {
  installPhase = ''
    runHook preInstall

-    mkdir -p $out/{bin,include,lib,${executable}-c}
+    mkdir -p $out/{bin,lib/${libPrefix}}

-    cp -R {include,lib_pypy,lib-python,${executable}-c} $out/${executable}-c
-    cp lib${executable}-c${stdenv.hostPlatform.extensions.sharedLibrary} $out/lib/
-    ln -s $out/${executable}-c/${executable}-c $out/bin/${executable}
+    cp -R {include,lib_pypy,lib-python} $out
+    install -Dm755 lib${executable}-c${stdenv.hostPlatform.extensions.sharedLibrary} $out/lib/
+    install -Dm755 ${executable}-c $out/bin/${executable}
    ${lib.optionalString isPy39OrNewer "ln -s $out/bin/${executable} $out/bin/pypy3"}

    # other packages expect to find stuff according to libPrefix
-    ln -s $out/${executable}-c/include $out/include/${libPrefix}
-    ln -s $out/${executable}-c/lib-python/${if isPy3k then "3" else pythonVersion} $out/lib/${libPrefix}
+    ln -s $out/include $out/include/${libPrefix}
+    lndir $out/lib-python/${if isPy3k then "3" else pythonVersion} $out/lib/${libPrefix}
+    lndir $out/lib_pypy $out/lib/${libPrefix}

    # Include a sitecustomize.py file
    cp ${../sitecustomize.py} $out/${
@@ -206,10 +216,17 @@ stdenv.mkDerivation rec {
    lib.optionalString (stdenv.hostPlatform.isDarwin) ''
      install_name_tool -change @rpath/lib${executable}-c.dylib $out/lib/lib${executable}-c.dylib $out/bin/${executable}
    ''
-    + lib.optionalString (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64) ''
-      mkdir -p $out/${executable}-c/pypy/bin
-      mv $out/bin/${executable} $out/${executable}-c/pypy/bin/${executable}
-      ln -s $out/${executable}-c/pypy/bin/${executable} $out/bin/${executable}
+    # Create platform specific _sysconfigdata__*.py (eg: _sysconfigdata__linux_x86_64-linux-gnu.py)
+    # Can be tested by building: pypy3Packages.bcrypt
+    # Based on the upstream build code found here:
+    # https://github.com/pypy/pypy/blob/release-pypy3.11-v7.3.20/pypy/tool/release/package.py#L176-L189
+    # Upstream is not shipping config.guess, just take one from autoconf
+    + lib.optionalString isPy3k ''
+      $out/bin/pypy3 -m sysconfig --generate-posix-vars HOST_GNU_TYPE "$(${autoconf}/share/autoconf/build-aux/config.guess)"
+      buildir="$(cat pybuilddir.txt)"
+      quadruplet=$(ls $buildir | sed -E 's/_sysconfigdata__(.*).py/\1/')
+      cp "$buildir/_sysconfigdata__$quadruplet.py" $out/lib_pypy/
+      ln -rs "$out/lib_pypy/_sysconfigdata__$quadruplet.py" $out/lib/pypy*/
    ''
    # _testcapi is compiled dynamically, into the store.
    # This would fail if we don't do it here.
@@ -1,4 +1,4 @@
 import ./common.nix {
-  version = "115.27.0";
-  hash = "sha512-owhm6oQaRPSQ/F7xoEDCbvT6zBGACf98zbJitUxbf3XXS0FqHlwB7rkAQ+GVeAnoClfts6yOY8F/H8NFBBEF8w==";
+  version = "115.28.0";
+  hash = "sha512-lnfF4YA/aGV9GKTlsmXsjqiL/J778qbEKQuTW/PG7jsMMcp4ACacAmxRISKvw2MPmCFd7JYzNvJhpXNDK6umnw==";
 }
@@ -1,4 +1,4 @@
 import ./common.nix {
-  version = "140.2.0";
-  hash = "sha512-5Fl8TYOuGoT86SSP5splKvbDYVYH/IlzvZF7/b0qu87Kk3/kxinAzcifoKXIRrXi2KS0Tav3/rIB3rOC3gzMWw==";
+  version = "140.3.0";
+  hash = "sha512-8qRTUjcqfFS/w6B2UgmLVWNNER6ohVDTPn4nENFVJNaJ7jn707IElkNDZTDhPCN9A+Bft6vTlwycGLZuWoTIWg==";
 }
@@ -0,0 +1,6 @@
+import ./generic.nix {
+  version = "3.115.1";
+  hash = "sha256-SuXNqRW0lBPioYxmoGa3ZbfxC7ud6TW3xVpakVwtm14=";
+  filename = "3_115.nix";
+  versionRegex = "NSS_(3)_(115)(?:_(\\d+))?_RTM";
+}
@@ -5,8 +5,8 @@
 #       Example: nix-shell ./maintainers/scripts/update.nix --argstr package cacert

 import ./generic.nix {
-  version = "3.115.1";
-  hash = "sha256-SuXNqRW0lBPioYxmoGa3ZbfxC7ud6TW3xVpakVwtm14=";
+  version = "3.116";
+  hash = "sha256-df/xzelMk6IvcmZvzc69WhEaO3SQzSfEy0xXKhSo/Nk=";
  filename = "latest.nix";
  versionRegex = "NSS_(\\d+)_(\\d+)(?:_(\\d+))?_RTM";
 }
@@ -0,0 +1,46 @@
+{
+  lib,
+  buildDunePackage,
+  fetchurl,
+  ocaml,
+  findlib,
+  zarith,
+  ocplib-simplex,
+  csdp,
+  autoconf,
+}:
+
+lib.throwIf (lib.versionAtLeast ocaml.version "5.0")
+  "osdp is not available for OCaml ${ocaml.version}"
+
+  buildDunePackage
+  {
+    pname = "osdp";
+    version = "1.1.1";
+
+    src = fetchurl {
+      url = "https://github.com/Embedded-SW-VnV/osdp/releases/download/v1.1.1/osdp-1.1.1.tgz";
+      hash = "sha256-X7CS2g+MyQPDjhUCvFS/DoqcCXTEw8SCsSGED64TGKQ=";
+    };
+
+    preConfigure = ''
+      autoconf
+    '';
+
+    nativeBuildInputs = [
+      autoconf
+      findlib
+      csdp
+    ];
+    propagatedBuildInputs = [
+      zarith
+      ocplib-simplex
+      csdp
+    ];
+
+    meta = {
+      description = "OCaml Interface to SDP solvers";
+      homepage = "https://github.com/Embedded-SW-VnV/osdp";
+      license = lib.licenses.lgpl3Plus;
+    };
+  }
@@ -4,7 +4,7 @@
        "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
        "This file is @generated automatically"
    ],
-    "content-hash": "15260b2971e763e6e3373cac310ce6e9",
+    "content-hash": "026109755af214f462cb5feed5943054",
    "packages": [
        {
            "name": "clue/ndjson-react",
@@ -3408,16 +3408,16 @@
        },
        {
            "name": "justinrainbow/json-schema",
-            "version": "6.5.1",
+            "version": "6.5.2",
            "source": {
                "type": "git",
                "url": "https://github.com/jsonrainbow/json-schema.git",
-                "reference": "b5ab21e431594897e5bb86343c01f140ba862c26"
+                "reference": "ac0d369c09653cf7af561f6d91a705bc617a87b8"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/jsonrainbow/json-schema/zipball/b5ab21e431594897e5bb86343c01f140ba862c26",
-                "reference": "b5ab21e431594897e5bb86343c01f140ba862c26",
+                "url": "https://api.github.com/repos/jsonrainbow/json-schema/zipball/ac0d369c09653cf7af561f6d91a705bc617a87b8",
+                "reference": "ac0d369c09653cf7af561f6d91a705bc617a87b8",
                "shasum": ""
            },
            "require": {
@@ -3477,9 +3477,9 @@
            ],
            "support": {
                "issues": "https://github.com/jsonrainbow/json-schema/issues",
-                "source": "https://github.com/jsonrainbow/json-schema/tree/6.5.1"
+                "source": "https://github.com/jsonrainbow/json-schema/tree/6.5.2"
            },
-            "time": "2025-08-29T10:58:11+00:00"
+            "time": "2025-09-09T09:42:27+00:00"
        },
        {
            "name": "keradus/cli-executor",
@@ -3529,16 +3529,16 @@
        },
        {
            "name": "marc-mabe/php-enum",
-            "version": "v4.7.1",
+            "version": "v4.7.2",
            "source": {
                "type": "git",
                "url": "https://github.com/marc-mabe/php-enum.git",
-                "reference": "7159809e5cfa041dca28e61f7f7ae58063aae8ed"
+                "reference": "bb426fcdd65c60fb3638ef741e8782508fda7eef"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/marc-mabe/php-enum/zipball/7159809e5cfa041dca28e61f7f7ae58063aae8ed",
-                "reference": "7159809e5cfa041dca28e61f7f7ae58063aae8ed",
+                "url": "https://api.github.com/repos/marc-mabe/php-enum/zipball/bb426fcdd65c60fb3638ef741e8782508fda7eef",
+                "reference": "bb426fcdd65c60fb3638ef741e8782508fda7eef",
                "shasum": ""
            },
            "require": {
@@ -3596,9 +3596,9 @@
            ],
            "support": {
                "issues": "https://github.com/marc-mabe/php-enum/issues",
-                "source": "https://github.com/marc-mabe/php-enum/tree/v4.7.1"
+                "source": "https://github.com/marc-mabe/php-enum/tree/v4.7.2"
            },
-            "time": "2024-11-28T04:54:44+00:00"
+            "time": "2025-09-14T11:18:39+00:00"
        },
        {
            "name": "mikey179/vfsstream",
@@ -4050,53 +4050,6 @@
            },
            "time": "2025-05-12T08:35:27+00:00"
        },
-        {
-            "name": "php-cs-fixer/accessible-object",
-            "version": "v1.2.0",
-            "source": {
-                "type": "git",
-                "url": "https://github.com/PHP-CS-Fixer/AccessibleObject.git",
-                "reference": "5f77857a0fedf1a24b4877de2852338b3b2f4433"
-            },
-            "dist": {
-                "type": "zip",
-                "url": "https://api.github.com/repos/PHP-CS-Fixer/AccessibleObject/zipball/5f77857a0fedf1a24b4877de2852338b3b2f4433",
-                "reference": "5f77857a0fedf1a24b4877de2852338b3b2f4433",
-                "shasum": ""
-            },
-            "require": {
-                "php": "^5.6 || ^7.0 || ^8.0"
-            },
-            "require-dev": {
-                "phpunit/phpunit": "^9.6.24 || ^10.5.52 || ^11.5.33"
-            },
-            "type": "application",
-            "autoload": {
-                "psr-4": {
-                    "PhpCsFixer\\AccessibleObject\\": "src/"
-                }
-            },
-            "notification-url": "https://packagist.org/downloads/",
-            "license": [
-                "MIT"
-            ],
-            "authors": [
-                {
-                    "name": "Fabien Potencier",
-                    "email": "fabien@symfony.com"
-                },
-                {
-                    "name": "Dariusz Rumiński",
-                    "email": "dariusz.ruminski@gmail.com"
-                }
-            ],
-            "description": "A library to reveal object internals.",
-            "support": {
-                "issues": "https://github.com/PHP-CS-Fixer/AccessibleObject/issues",
-                "source": "https://github.com/PHP-CS-Fixer/AccessibleObject/tree/v1.2.0"
-            },
-            "time": "2025-08-20T20:33:51+00:00"
-        },
        {
            "name": "php-cs-fixer/phpunit-constraint-isidenticalstring",
            "version": "v1.6.0",
@@ -4527,16 +4480,16 @@
        },
        {
            "name": "phpunit/phpunit",
-            "version": "11.5.35",
+            "version": "11.5.39",
            "source": {
                "type": "git",
                "url": "https://github.com/sebastianbergmann/phpunit.git",
-                "reference": "d341ee94ee5007b286fc7907b383aae6b5b3cc91"
+                "reference": "ad5597f79d8489d2870073ac0bc0dd0ad1fa9931"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/sebastianbergmann/phpunit/zipball/d341ee94ee5007b286fc7907b383aae6b5b3cc91",
-                "reference": "d341ee94ee5007b286fc7907b383aae6b5b3cc91",
+                "url": "https://api.github.com/repos/sebastianbergmann/phpunit/zipball/ad5597f79d8489d2870073ac0bc0dd0ad1fa9931",
+                "reference": "ad5597f79d8489d2870073ac0bc0dd0ad1fa9931",
                "shasum": ""
            },
            "require": {
@@ -4608,7 +4561,7 @@
            "support": {
                "issues": "https://github.com/sebastianbergmann/phpunit/issues",
                "security": "https://github.com/sebastianbergmann/phpunit/security/policy",
-                "source": "https://github.com/sebastianbergmann/phpunit/tree/11.5.35"
+                "source": "https://github.com/sebastianbergmann/phpunit/tree/11.5.39"
            },
            "funding": [
                {
@@ -4632,7 +4585,7 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2025-08-28T05:13:54+00:00"
+            "time": "2025-09-14T06:20:41+00:00"
        },
        {
            "name": "psr/http-client",
@@ -7,17 +7,17 @@

 php.buildComposerProject2 (finalAttrs: {
  pname = "php-cs-fixer";
-  version = "3.86.0";
+  version = "3.87.2";

  src = fetchFromGitHub {
    owner = "PHP-CS-Fixer";
    repo = "PHP-CS-Fixer";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-b68m8FVGf3qUbG1otRAQ8mnY0k3IBRBvigLYowgVH1g=";
+    hash = "sha256-IPBMi8Bln99zcCxkNPGKWSUQMvtxHlRq4BwuoMCXkYw=";
  };

  composerLock = ./composer.lock;
-  vendorHash = "sha256-JNtAMvuz9lFA+5c0O9XnI3Pid8TD1HaBqW2V2YDzkGw=";
+  vendorHash = "sha256-I4F6WDnWDEmLJFRGMS2QV62jaNAtZoTNQBoH3gT3OAw=";

  doInstallCheck = true;
  nativeInstallCheckInputs = [ versionCheckHook ];
@@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "botocore-stubs";
-  version = "1.40.29";
+  version = "1.40.31";
  pyproject = true;

  disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    pname = "botocore_stubs";
    inherit version;
-    hash = "sha256-MkZp1e17X3Jxvzw+pyCBkbHRg/F9fnM5jxH+9KMf32s=";
+    hash = "sha256-AXvOpZGSQrZ+gOaicRSdZ8rR0GvXraxatY4yKZ26g9w=";
  };

  nativeBuildInputs = [ setuptools ];
@@ -11,14 +11,14 @@

 buildPythonPackage rec {
  pname = "django-guardian";
-  version = "3.1.0";
+  version = "3.1.3";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "django-guardian";
    repo = "django-guardian";
    tag = version;
-    hash = "sha256-fiC3IGZwQbSCz6vVJXdSd2BpELEiYfKW1vsf+6xL4ck=";
+    hash = "sha256-cQw4bFcblq80ss64rQpg1VyS7rKiheEBJvmRRPyAn9Y=";
  };

  build-system = [ setuptools ];
@@ -0,0 +1,11 @@
+diff --git a/setup.cfg b/setup.cfg
+--- a/setup.cfg
+++ b/setup.cfg
+@@ -30,6 +30,7 @@ classifiers =
+ [options]
+ zip_safe = True
+ include_package_data = True
+packages = kaitai/compress
+ py_modules = kaitaistruct
+ python_requires = >=2.7,!=3.0.*,!=3.1.*,!=3.2.*,!=3.3.*
+ install_requires =
@@ -18,17 +18,18 @@ let
 in
 buildPythonPackage rec {
  pname = "kaitaistruct";
-  version = "0.10";
+  version = "0.11";
  pyproject = true;

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-oETe4pFz1q+6zye8rDna+JtlTdQYz6AJq4LZF4qa5So=";
+    hash = "sha256-BT7nZCiOeLjlOs90jpczJorL1Xm42CpCexgFRTYl10s=";
  };

+  patches = [ ./01-add-kaitai-compress.patch ];
+
  preBuild = ''
    ln -s ${kaitai_compress}/python/kaitai kaitai
-    sed '32ipackages = kaitai/compress' -i setup.cfg
  '';

  build-system = [ setuptools ];
@@ -52,6 +52,7 @@ buildPythonPackage rec {
    "cryptography"
    "flask"
    "h2"
+    "kaitaistruct"
    "passlib"
    "pyopenssl"
    "tornado"
@@ -182,8 +182,8 @@ rec {
      "sha256-6kCRDur13G+GTZK8R7gknc1J3L/E3YA4/xi+9qQhVp0=";

  mypy-boto3-ce =
-    buildMypyBoto3Package "ce" "1.40.0"
-      "sha256-O42YFgtlQoivQquLiQqHoHiT5NtQH8I4z6H+A41rrSE=";
+    buildMypyBoto3Package "ce" "1.40.31"
+      "sha256-7tuIhj+Kz01F4sPhL8N6g+e0CcdWwtAl7jF0Xii3c0Q=";

  mypy-boto3-chime =
    buildMypyBoto3Package "chime" "1.40.19"
@@ -893,8 +893,8 @@ rec {
      "sha256-1uTPx4K0dGJfRPupXqkRKTOifmVzNhDgvaBYPpd0A4c=";

  mypy-boto3-medical-imaging =
-    buildMypyBoto3Package "medical-imaging" "1.40.0"
-      "sha256-FT2lYxXXUxPssxPqinwIbEj1YEhRTyDZz44LyKr6jCc=";
+    buildMypyBoto3Package "medical-imaging" "1.40.31"
+      "sha256-loONT/aOVY0IFNGgP7doBtHPp+U9TEzI4SAmdXvrc2Q=";

  mypy-boto3-memorydb =
    buildMypyBoto3Package "memorydb" "1.40.16"
@@ -1001,8 +1001,8 @@ rec {
      "sha256-PgXa3veO1qGxxUBwZe2bxauFNT3nc0j8vEVk0Q4NtVU=";

  mypy-boto3-payment-cryptography =
-    buildMypyBoto3Package "payment-cryptography" "1.40.28"
-      "sha256-kVtSgmoVmZ2QJ1qSBlXLrFxob3ZbO3qvoJoM/1zlSYk=";
+    buildMypyBoto3Package "payment-cryptography" "1.40.30"
+      "sha256-JSLXvrURvUhb83Oeb5b+hlDpOoiFMayDtDXGJsx8Hsw=";

  mypy-boto3-payment-cryptography-data =
    buildMypyBoto3Package "payment-cryptography-data" "1.40.0"
@@ -1165,8 +1165,8 @@ rec {
      "sha256-jSv9EFKJTQ6EyfuTWNg4ug7tAmUHbH3X9FYix3AnXJk=";

  mypy-boto3-s3control =
-    buildMypyBoto3Package "s3control" "1.40.12"
-      "sha256-lC5XVPtSUMab52QRqv6o9+2grzETdFjpscjDwvqGNvE=";
+    buildMypyBoto3Package "s3control" "1.40.31"
+      "sha256-4D9yv4nmCrc75l/QEqeP5FFNU4JPq5tAPtZi9dikcUY=";

  mypy-boto3-s3outposts =
    buildMypyBoto3Package "s3outposts" "1.40.15"
@@ -27,7 +27,7 @@ buildPythonPackage rec {
    description = "Netbox plugin to add context buttons to the links, making navigating less clicky";
    homepage = "https://github.com/PieterL75/netbox_contextmenus/";
    changelog = "https://github.com/PieterL75/netbox_contextmenus/releases/tag/${src.tag}";
-    license = lib.licenses.unfree;
+    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ felbinger ];
  };
 }
@@ -8,17 +8,17 @@

 buildPythonPackage rec {
  pname = "pypng";
-  version = "0.20220715.0";
+  version = "0.20231004.0";
  pyproject = true;

  src = fetchFromGitLab {
    owner = "drj11";
    repo = "pypng";
-    rev = "refs/tags/${pname}-${version}";
+    tag = "pypng-${version}";
    hash = "sha256-tTnsGCAmHexDWm/T5xpHpcBaQcBEqMfTFaoOAeC+pDs=";
  };

-  nativeBuildInputs = [ setuptools ];
+  build-system = [ setuptools ];

  patches = [
    # pngsuite is imported by code/test_png.py but is not defined in
@@ -40,7 +40,7 @@ buildPythonPackage rec {

  meta = with lib; {
    description = "Pure Python library for PNG image encoding/decoding";
-    homepage = "https://github.com/drj11/pypng";
+    homepage = "https://gitlab.com/drj11/pypng";
    license = licenses.mit;
    maintainers = with maintainers; [ prusnak ];
  };
@@ -1878,8 +1878,6 @@ with pkgs;
      '';
    });

-  candle = libsForQt5.callPackage ../applications/misc/candle { };
-
  capstone = callPackage ../development/libraries/capstone { };
  capstone_4 = callPackage ../development/libraries/capstone/4.nix { };

@@ -4096,6 +4094,13 @@ with pkgs;

  sasview = libsForQt5.callPackage ../applications/science/misc/sasview { };

+  saunafs = callPackage ../by-name/sa/saunafs/package.nix {
+    fmt = fmt_11;
+    spdlog = spdlog.override {
+      fmt = fmt_11;
+    };
+  };
+
  scfbuild = python3.pkgs.callPackage ../tools/misc/scfbuild { };

  segger-jlink-headless = callPackage ../by-name/se/segger-jlink/package.nix { headless = true; };
@@ -5432,9 +5437,7 @@ with pkgs;
    jdk_headless = openjdk8_headless; # TODO: remove override https://github.com/NixOS/nixpkgs/pull/89731
  };

-  mitscheme = callPackage ../development/compilers/mit-scheme {
-    texinfo = texinfo6;
-  };
+  mitscheme = callPackage ../development/compilers/mit-scheme { };

  mitschemeX11 = mitscheme.override {
    enableX11 = true;
@@ -8442,6 +8445,7 @@ with pkgs;
  };

  nss_latest = callPackage ../development/libraries/nss/latest.nix { };
+  nss_3_115 = callPackage ../development/libraries/nss/3_115.nix { };
  nss_3_114 = callPackage ../development/libraries/nss/3_114.nix { };
  nss_esr = callPackage ../development/libraries/nss/esr.nix { };
  nss = nss_esr;
@@ -128,6 +128,7 @@ let
      json = callPackage ../development/coq-modules/json { };
      lemma-overloading = callPackage ../development/coq-modules/lemma-overloading { };
      LibHyps = callPackage ../development/coq-modules/LibHyps { };
+      libvalidsdp = self.validsdp.libvalidsdp;
      ltac2 = callPackage ../development/coq-modules/ltac2 { };
      math-classes = callPackage ../development/coq-modules/math-classes { };
      mathcomp = callPackage ../development/coq-modules/mathcomp { };
@@ -211,6 +212,7 @@ let
      topology = callPackage ../development/coq-modules/topology { };
      trakt = callPackage ../development/coq-modules/trakt { };
      unicoq = callPackage ../development/coq-modules/unicoq { };
+      validsdp = callPackage ../development/coq-modules/validsdp { };
      vcfloat = callPackage ../development/coq-modules/vcfloat (
        lib.optionalAttrs (lib.versions.range "8.16" "8.18" self.coq.version) {
          interval = self.interval.override { version = "4.9.0"; };
@@ -1,27 +1,49 @@
 { nixpkgs, pkgs }:

-with pkgs;
+let
+  inherit (pkgs) lib stdenvNoCC;
+  evalSystem = "x86_64-linux";
+in
+
+stdenvNoCC.mkDerivation {
+  name = "nixpkgs-metrics";
+
+  # Use structured attrs to pass in relevant information.
+  __structuredAttrs = true;
+  inherit evalSystem nixpkgs;
+
+  outputs = [
+    "out"
+    "raw"
+  ];
+
+  nativeBuildInputs = map lib.getBin [
+    pkgs.nixVersions.latest
+    pkgs.time
+    pkgs.jq
+  ];
+
+  # see https://github.com/NixOS/nixpkgs/issues/52436
+  #requiredSystemFeatures = [ "benchmark" ]; # dedicated `t2a` machine, by @vcunat
+
+  # Required because this derivation doesn't have a `src`.
+  dontUnpack = true;
+
+  configurePhase = ''
+    runHook preConfigure

-runCommand "nixpkgs-metrics"
-  {
-    nativeBuildInputs =
-      with pkgs.lib;
-      map getBin [
-        nix
-        time
-        jq
-      ];
-    # see https://github.com/NixOS/nixpkgs/issues/52436
-    #requiredSystemFeatures = [ "benchmark" ]; # dedicated `t2a` machine, by @vcunat
-  }
-  ''
    export NIX_STORE_DIR=$TMPDIR/store
    export NIX_STATE_DIR=$TMPDIR/state
    export NIX_PAGER=
    nix-store --init

-    mkdir -p $out/nix-support
-    touch $out/nix-support/hydra-build-products
+    runHook postConfigure
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+
+    release="$nixpkgs/nixos/release.nix"

    run() {
      local name="$1"
@@ -29,58 +51,172 @@ runCommand "nixpkgs-metrics"

      echo "running $@"

-      case "$name" in
-        # Redirect stdout to /dev/null to avoid hitting "Output Limit
-        # Exceeded" on Hydra.
-        nix-env.qaDrv|nix-env.qaDrvAggressive)
-          NIX_SHOW_STATS=1 NIX_SHOW_STATS_PATH=stats-nix time -o stats-time "$@" >/dev/null ;;
-        *)
-          NIX_SHOW_STATS=1 NIX_SHOW_STATS_PATH=stats-nix time -o stats-time "$@" ;;
-      esac
+      mkdir -p "metrics/$name"
+      local output="metrics/$name/output"
+      local nix_stats="metrics/$name/nix-stats.json"
+      local time_stats="metrics/$name/time-stats.json"

-      cat stats-nix; echo; cat stats-time; echo
+      NIX_SHOW_STATS=1 NIX_SHOW_STATS_PATH="$nix_stats" command time -o "$time_stats" -- "$@" > "$output"

-      x=$(jq '.cpuTime' < stats-nix)
-      [[ -n $x ]] || exit 1
-      echo "$name.time $x s" >> $out/nix-support/hydra-metrics
+      # Show the Nix statistics and the `time` statistics.
+      echo "Nix statistics for $@"
+      jq . "$nix_stats"
+      echo
+      echo "Time statistics for $@"
+      jq . "$time_stats"
+      echo

-      x=$(sed -e 's/.* \([0-9]\+\)maxresident.*/\1/ ; t ; d' < stats-time)
-      [[ -n $x ]] || exit 1
-      echo "$name.maxresident $x KiB" >> $out/nix-support/hydra-metrics
+      cpuTime="$(jq '.cpuTime' < "$nix_stats")"
+      [[ -n $cpuTime ]] || exit 1
+      echo "$name.time $cpuTime s" >> hydra-metrics

-      # nix-2.2 also outputs .symbols.bytes but that wasn't summed originally
-      # https://github.com/NixOS/nix/pull/2392/files#diff-8e6ba8c21672fc1a5f6f606e1e101c74L1762
-      x=$(jq '[.envs,.list,.values,.sets] | map(.bytes) | add' < stats-nix)
-      [[ -n $x ]] || exit 1
-      echo "$name.allocations $x B" >> $out/nix-support/hydra-metrics
+      maxresident="$(jq '.max_resident_set_kb' < "$time_stats")"
+      [[ -n $maxresident ]] || exit 1
+      echo "$name.maxresident $maxresident KiB" >> hydra-metrics

-      x=$(jq '.values.number' < stats-nix)
-      [[ -n $x ]] || exit 1
-      echo "$name.values $x" >> $out/nix-support/hydra-metrics
+      # Nix also outputs `.symbols.bytes` but since that wasn't summed originally, we don't count it here.
+      allocations="$(jq '[.envs,.list,.values,.sets] | map(.bytes) | add' < "$nix_stats")"
+      [[ -n $allocations ]] || exit 1
+      echo "$name.allocations $allocations B" >> hydra-metrics
+
+      values="$(jq '.values.number' < "$nix_stats")"
+      [[ -n $values ]] || exit 1
+      echo "$name.values $values" >> hydra-metrics
    }

-    run nixos.smallContainer nix-instantiate --dry-run ${nixpkgs}/nixos/release.nix \
-      -A closures.smallContainer.x86_64-linux --show-trace
-    run nixos.kde nix-instantiate --dry-run ${nixpkgs}/nixos/release.nix \
-      -A closures.kde.x86_64-linux --show-trace
-    run nixos.lapp nix-instantiate --dry-run ${nixpkgs}/nixos/release.nix \
-      -A closures.lapp.x86_64-linux --show-trace
-    run nix-env.qa nix-env -f ${nixpkgs} -qa
-    run nix-env.qaDrv nix-env -f ${nixpkgs} -qa --drv-path --meta --xml
+    run nixos.smallContainer nix-instantiate --option eval-system "$evalSystem" --dry-run "$release" -A closures.smallContainer.x86_64-linux --show-trace --no-gc-warning
+    run nixos.kde nix-instantiate --option eval-system "$evalSystem" --dry-run "$release" -A closures.kde.x86_64-linux --show-trace --no-gc-warning
+    run nixos.lapp nix-instantiate --option eval-system "$evalSystem" --dry-run "$release" -A closures.lapp.x86_64-linux --show-trace --no-gc-warning
+    run nix-env.qa nix-env --option eval-system "$evalSystem" -f "$nixpkgs" -qa
+    run nix-env.qaDrv nix-env --option eval-system "$evalSystem" -f "$nixpkgs" -qa --drv-path --meta --json

    # It's slightly unclear which of the set to track: qaCount, qaCountDrv, qaCountBroken.
-    num=$(nix-env -f ${nixpkgs} -qa | wc -l)
-    echo "nix-env.qaCount $num" >> $out/nix-support/hydra-metrics
-    qaCountDrv=$(nix-env -f ${nixpkgs} -qa --drv-path | wc -l)
-    num=$((num - $qaCountDrv))
-    echo "nix-env.qaCountBroken $num" >> $out/nix-support/hydra-metrics
+    num="$(wc -l < metrics/nix-env.qa/output)"
+    echo "nix-env.qaCount $num" >> hydra-metrics
+    qaCountDrv="$(jq -r 'reduce .[].drvPath as $d (0; .+1)' metrics/nix-env.qaDrv/output)"
+    numBroken="$((num - $qaCountDrv))"
+    echo "nix-env.qaCountBroken $numBroken" >> hydra-metrics

-    # TODO: this has been ignored for some time
-    # GC Warning: Bad initial heap size 128k - ignoring it.
-    #export GC_INITIAL_HEAP_SIZE=128k
-    run nix-env.qaAggressive nix-env -f ${nixpkgs} -qa
-    run nix-env.qaDrvAggressive nix-env -f ${nixpkgs} -qa --drv-path --meta --xml
+    lines="$(find "$nixpkgs" -name "*.nix" -type f -print0 | xargs -0 cat | wc -l)"
+    echo "loc $lines" >> hydra-metrics

-    lines=$(find ${nixpkgs} -name "*.nix" -type f | xargs cat | wc -l)
-    echo "loc $lines" >> $out/nix-support/hydra-metrics
-  ''
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/nix-support
+    touch $out/nix-support/hydra-build-products
+    mv hydra-metrics $out/nix-support/hydra-metrics
+
+    # Save and compress the raw output
+    mv metrics $raw
+    xz -v $raw/*/output
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Metrics tracked by Hydra about Nixpkgs";
+    homepage = "https://hydra.nixos.org/job/nixpkgs/trunk/metrics";
+    longDescription = ''
+      View the metrics for Nixpkgs evaluation over time at these URLs.
+
+      These are all produced from running `nix` with `NIX_SHOW_STATS=1`.
+      See `EvalState::printStatistics` in the Nix source code for the implementation.
+      None of these metrics are inherently meaningful on their own.
+      Exercise caution in interpreting them as "bad" or "good".
+
+      # Total repository statistics
+
+      - [Lines of code in Nixpkgs](https://hydra.nixos.org/job/nixpkgs/trunk/metrics/metric/loc)
+      - [Count of broken packages using `nix-env -qa`](https://hydra.nixos.org/job/nixpkgs/trunk/metrics/metric/nix-env.qaCountBroken)
+      - [Count of packages using `nix-env -qa`](https://hydra.nixos.org/job/nixpkgs/trunk/metrics/metric/nix-env.qaCount)
+
+      # Statistics about representative commands
+
+      These are statistics gathered by running commands against Nixpkgs.
+
+      | Name | Command |
+      |------|---------|
+      | `nix-env.qaDrv` | `nix-env -f ${nixpkgs} -qa --drv-path --meta --json` |
+      | `nix-env.qa` | `nix-env -f ${nixpkgs} -qa` |
+      | `nixos.kde` | `nix-instantiate --dry-run ${nixpkgs}/nixos/release.nix -A closures.kde.x86_64-linux --show-trace` |
+      | `nixos.lapp` | `nix-instantiate --dry-run ${nixpkgs}/nixos/release.nix -A closures.lapp.x86_64-linux --show-trace` |
+      | `nixos.smallContainer` | `nix-instantiate --dry-run ${nixpkgs}/nixos/release.nix -A closures.smallContainer.x86_64-linux --show-trace`|
+
+      ## Allocations performed (in bytes)
+
+      This counts `envs.bytes`, `list.bytes`, `values.bytes`, and `sets.bytes` from the Nix statistics.
+
+      - [nix-env.qa.allocations](https://hydra.nixos.org/job/nixpkgs/trunk/metrics/metric/nix-env.qa.allocations)
+      - [nix-env.qaDrv.allocations](https://hydra.nixos.org/job/nixpkgs/trunk/metrics/metric/nix-env.qaDrv.allocations)
+      - [nixos.kde.allocations](https://hydra.nixos.org/job/nixpkgs/trunk/metrics/metric/nixos.kde.allocations)
+      - [nixos.lapp.allocations](https://hydra.nixos.org/job/nixpkgs/trunk/metrics/metric/nixos.lapp.allocations)
+      - [nixos.smallContainer.allocations](https://hydra.nixos.org/job/nixpkgs/trunk/metrics/metric/nixos.smallContainer.allocations)
+
+      ## Maximum resident size (in number of KiB)
+
+      This counts `maxresident` KiB (`%M`) from the `time` command on Linux.
+
+      - [nix-env.qa.maxresident](https://hydra.nixos.org/job/nixpkgs/trunk/metrics/metric/nix-env.qa.maxresident)
+      - [nix-env.qaDrv.maxresident](https://hydra.nixos.org/job/nixpkgs/trunk/metrics/metric/nix-env.qaDrv.maxresident)
+      - [nixos.kde.maxresident](https://hydra.nixos.org/job/nixpkgs/trunk/metrics/metric/nixos.kde.maxresident)
+      - [nixos.lapp.maxresident](https://hydra.nixos.org/job/nixpkgs/trunk/metrics/metric/nixos.lapp.maxresident)
+      - [nixos.smallContainer.maxresident](https://hydra.nixos.org/job/nixpkgs/trunk/metrics/metric/nixos.smallContainer.maxresident)
+
+      ## Time taken (in seconds)
+
+      This counts `cpuTime` as reported in the Nix statistics. On Linux, this resolves to [`getrusage(RUSAGE_SELF)`](https://man7.org/linux/man-pages/man2/getrusage.2.html).
+
+      - [nix-env.qa.time](https://hydra.nixos.org/job/nixpkgs/trunk/metrics/metric/nix-env.qa.time)
+      - [nix-env.qaDrv.time](https://hydra.nixos.org/job/nixpkgs/trunk/metrics/metric/nix-env.qaDrv.time)
+      - [nixos.kde.time](https://hydra.nixos.org/job/nixpkgs/trunk/metrics/metric/nixos.kde.time)
+      - [nixos.lapp.time](https://hydra.nixos.org/job/nixpkgs/trunk/metrics/metric/nixos.lapp.time)
+      - [nixos.smallContainer.time](https://hydra.nixos.org/job/nixpkgs/trunk/metrics/metric/nixos.smallContainer.time)
+
+      ## Number of values
+
+      This counts the total number of values allocated in Nix (see `EvalState::allocValue` in the Nix source code).
+
+      - [nix-env.qa.values](https://hydra.nixos.org/job/nixpkgs/trunk/metrics/metric/nix-env.qa.values)
+      - [nix-env.qaDrv.values](https://hydra.nixos.org/job/nixpkgs/trunk/metrics/metric/nix-env.qaDrv.values)
+      - [nixos.kde.values](https://hydra.nixos.org/job/nixpkgs/trunk/metrics/metric/nixos.kde.values)
+      - [nixos.lapp.values](https://hydra.nixos.org/job/nixpkgs/trunk/metrics/metric/nixos.lapp.values)
+      - [nixos.smallContainer.values](https://hydra.nixos.org/job/nixpkgs/trunk/metrics/metric/nixos.smallContainer.values)
+    '';
+  };
+
+  # Convince `time` to output in JSON
+  env.TIME = builtins.toJSON {
+    real_time = "%e";
+    user_time = "%U";
+    sys_time = "%S";
+    cpu_percent = "%P";
+    max_resident_set_kb = "%M";
+    avg_resident_set_kb = "%t";
+    avg_total_mem_kb = "%K";
+    avg_data_kb = "%D";
+    avg_stack_kb = "%p";
+    avg_unshared_data_kb = "%X";
+    avg_shared_text_kb = "%Z";
+    page_faults_major = "%F";
+    page_faults_minor = "%R";
+    swaps = "%W";
+    context_switches_voluntary = "%c";
+    context_switches_involuntary = "%w";
+    io_reads = "%I";
+    io_writes = "%O";
+    signals_received = "%k";
+    exit_status = "%x";
+    command = "%C";
+  };
+
+  # Don't allow aliases anywhere in Nixpkgs for the metrics.
+  env.NIXPKGS_CONFIG = builtins.toFile "nixpkgs-config.nix" ''
+    {
+      allowAliases = false;
+    }
+  '';
+}
@@ -1590,6 +1590,8 @@ let

        ordering = callPackage ../development/ocaml-modules/ordering { };

+        osdp = callPackage ../development/ocaml-modules/osdp { };
+
        oseq = callPackage ../development/ocaml-modules/oseq { };

        otfed = callPackage ../development/ocaml-modules/otfed { };