Merge staging-next into staging

2026-02-12 12:15:26 +00:00
parent 677c3558ee bf24c89df2
commit 8110409973
58 changed files with 1249 additions and 751 deletions
@@ -99,7 +99,7 @@ In addition to numerous new and upgraded packages, this release has the followin

 - [input-remapper](https://github.com/sezanzeb/input-remapper), an easy to use tool to change the mapping of your input device buttons. Available at [services.input-remapper](#opt-services.input-remapper.enable).

- [InvoicePlane](https://invoiceplane.com), web application for managing and creating invoices. Available at `services.invoiceplane`.
+- [InvoicePlane](https://invoiceplane.com), web application for managing and creating invoices. Available at [services.invoiceplane](#opt-services.invoiceplane.sites._name_.enable).

 - [k3b](https://userbase.kde.org/K3b), the KDE disk burning application. Available as [programs.k3b](#opt-programs.k3b.enable).

@@ -1658,6 +1658,7 @@
  ./services/web-apps/immich.nix
  ./services/web-apps/immichframe.nix
  ./services/web-apps/invidious.nix
+  ./services/web-apps/invoiceplane.nix
  ./services/web-apps/isso.nix
  ./services/web-apps/jirafeau.nix
  ./services/web-apps/jitsi-meet.nix
@@ -47,10 +47,7 @@ let
    );

  driverPaths = [
-    # opengl:
-    # NOTE: Since driverLink is just a symlink, we need to include its target as well.
    pkgs.addDriverRunpath.driverLink
-    config.systemd.tmpfiles.settings.graphics-driver."/run/opengl-driver"."L+".argument

    # mesa:
    config.hardware.graphics.package
@@ -62,7 +59,9 @@ let
  defaults = {
    nvidia-gpu.onFeatures = package.allowedPatterns.nvidia-gpu.onFeatures;
    nvidia-gpu.paths = package.allowedPatterns.nvidia-gpu.paths ++ driverPaths;
-    nvidia-gpu.unsafeFollowSymlinks = false;
+    # TODO: Refactor `hardware.graphics` to ease referencing the closure
+    # NOTE: A naive implementation may e.g. introduce a conditional infinite recursion (https://github.com/NixOS/nixpkgs/pull/488199)
+    nvidia-gpu.unsafeFollowSymlinks = true;
  };
 in
 {
@@ -112,6 +111,7 @@ in
    lib.mkMerge [
      { nix.settings.pre-build-hook = lib.getExe cfg.package; }
      (lib.mkIf cfg.presets.nvidia-gpu.enable {
+        hardware.graphics.enable = lib.mkDefault true;
        nix.settings.system-features = cfg.allowedPatterns.nvidia-gpu.onFeatures;
        programs.nix-required-mounts.allowedPatterns = {
          inherit (defaults) nvidia-gpu;
@@ -442,10 +442,6 @@ in
      Consider migrating or switching to Incus, or remove from your configuration.
      https://linuxcontainers.org/incus/docs/main/howto/server_migrate_lxd/
    '')
-    (mkRemovedOptionModule [ "services" "invoiceplane" ] ''
-      services.invoiceplane has been removed since the service only supported PHP 8.1 which is EOL
-      and removed from nixpkgs.
-    '')
    (mkRemovedOptionModule [ "services" "filesender" ] ''
      services.filesender has been removed since it depends on simplesamlphp which was severely unmaintained.
    '')
@@ -937,6 +937,7 @@ in
          StateDirectory = "kanidm";
          StateDirectoryMode = "0700";
          RuntimeDirectory = "kanidmd";
+          ExecStartPre = "${cfg.package}/bin/kanidmd domain rename -c ${serverConfigFile}";
          ExecStart = "${cfg.package}/bin/kanidmd server -c ${serverConfigFile}";
          ExecStartPost = mkIf cfg.provision.enable postStartScript;
          User = "kanidm";
@@ -0,0 +1,491 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+
+with lib;
+
+let
+  cfg = config.services.invoiceplane;
+  eachSite = cfg.sites;
+  user = "invoiceplane";
+  webserver = config.services.${cfg.webserver};
+
+  invoiceplane-config =
+    hostName: cfg:
+    pkgs.writeText "ipconfig.php" ''
+      # <?php exit('No direct script access allowed'); ?>
+
+      IP_URL=http://${hostName}
+      ENABLE_DEBUG=false
+      DISABLE_SETUP=false
+      REMOVE_INDEXPHP=false
+      DB_HOSTNAME=${cfg.database.host}
+      DB_USERNAME=${cfg.database.user}
+      # NOTE: file_get_contents adds newline at the end of returned string
+      DB_PASSWORD=${
+        optionalString (
+          cfg.database.passwordFile != null
+        ) "trim(file_get_contents('${cfg.database.passwordFile}'), \"\\r\\n\")"
+      }
+      DB_DATABASE=${cfg.database.name}
+      DB_PORT=${toString cfg.database.port}
+      SESS_EXPIRATION=864000
+      ENABLE_INVOICE_DELETION=false
+      DISABLE_READ_ONLY=false
+      ENCRYPTION_KEY=
+      ENCRYPTION_CIPHER=AES-256
+      SETUP_COMPLETED=false
+      REMOVE_INDEXPHP=true
+    '';
+
+  mkPhpValue =
+    v:
+    if isString v then
+      escapeShellArg v
+    # NOTE: If any value contains a , (comma) this will not get escaped
+    else if isList v && strings.isConvertibleWithToString v then
+      escapeShellArg (concatMapStringsSep "," toString v)
+    else if isInt v then
+      toString v
+    else if isBool v then
+      boolToString v
+    else
+      abort "The Invoiceplane config value ${lib.generators.toPretty { } v} can not be encoded.";
+
+  extraConfig =
+    hostName: cfg:
+    let
+      settings = mapAttrsToList (k: v: "${k}=${mkPhpValue v}") cfg.settings;
+    in
+    pkgs.writeText "extraConfig.php" (concatStringsSep "\n" settings);
+
+  pkg =
+    hostName: cfg:
+    pkgs.stdenv.mkDerivation rec {
+      pname = "invoiceplane-${hostName}";
+      version = src.version;
+      src = pkgs.invoiceplane;
+
+      postPatch = ''
+        # Patch index.php file to load additional config file
+        substituteInPlace index.php \
+          --replace-fail "require __DIR__ . '/vendor/autoload.php';" "require('vendor/autoload.php'); \$dotenv = Dotenv\Dotenv::createImmutable(__DIR__, 'extraConfig.php'); \$dotenv->load();";
+      '';
+
+      installPhase = ''
+        mkdir -p $out
+        cp -r * $out/
+
+        # symlink uploads and log directories
+        rm -r $out/uploads $out/application/logs $out/vendor/mpdf/mpdf/tmp
+        ln -sf ${cfg.stateDir}/uploads $out/
+        ln -sf ${cfg.stateDir}/logs $out/application/
+        ln -sf ${cfg.stateDir}/tmp $out/vendor/mpdf/mpdf/
+
+        # symlink the InvoicePlane config
+        ln -s ${cfg.stateDir}/ipconfig.php $out/ipconfig.php
+
+        # symlink the extraConfig file
+        ln -s ${extraConfig hostName cfg} $out/extraConfig.php
+
+        # symlink additional templates
+        ${concatMapStringsSep "\n" (
+          template: "cp -r ${template}/. $out/application/views/invoice_templates/pdf/"
+        ) cfg.invoiceTemplates}
+        ${concatMapStringsSep "\n" (
+          template: "cp -r ${template}/. $out/application/views/quote_templates/pdf/"
+        ) cfg.quoteTemplates}
+      '';
+    };
+
+  siteOpts =
+    { lib, name, ... }:
+    {
+      options = {
+
+        enable = mkEnableOption "InvoicePlane web application";
+
+        stateDir = mkOption {
+          type = types.path;
+          default = "/var/lib/invoiceplane/${name}";
+          description = ''
+            This directory is used for uploads of attachments and cache.
+            The directory passed here is automatically created and permissions
+            adjusted as required.
+          '';
+        };
+
+        database = {
+          host = mkOption {
+            type = types.str;
+            default = "localhost";
+            description = "Database host address.";
+          };
+
+          port = mkOption {
+            type = types.port;
+            default = 3306;
+            description = "Database host port.";
+          };
+
+          name = mkOption {
+            type = types.str;
+            default = "invoiceplane";
+            description = "Database name.";
+          };
+
+          user = mkOption {
+            type = types.str;
+            default = "invoiceplane";
+            description = "Database user.";
+          };
+
+          passwordFile = mkOption {
+            type = types.nullOr types.path;
+            default = null;
+            example = "/run/keys/invoiceplane-dbpassword";
+            description = ''
+              A file containing the password corresponding to
+              {option}`database.user`.
+            '';
+          };
+
+          createLocally = mkOption {
+            type = types.bool;
+            default = true;
+            description = "Create the database and database user locally.";
+          };
+        };
+
+        invoiceTemplates = mkOption {
+          type = types.listOf types.path;
+          default = [ ];
+          description = ''
+            List of path(s) to respective template(s) which are copied from the 'invoice_templates/pdf' directory.
+
+            ::: {.note}
+            These templates need to be packaged before use, see example.
+            :::
+          '';
+          example = literalExpression ''
+            let
+              # Let's package an example template
+              template-vtdirektmarketing = pkgs.stdenv.mkDerivation {
+                name = "vtdirektmarketing";
+                # Download the template from a public repository
+                src = pkgs.fetchgit {
+                  url = "https://git.project-insanity.org/onny/invoiceplane-vtdirektmarketing.git";
+                  sha256 = "1hh0q7wzsh8v8x03i82p6qrgbxr4v5fb05xylyrpp975l8axyg2z";
+                };
+                sourceRoot = ".";
+                # Installing simply means copying template php file to the output directory
+                installPhase = ""
+                  mkdir -p $out
+                  cp invoiceplane-vtdirektmarketing/vtdirektmarketing.php $out/
+                "";
+              };
+            # And then pass this package to the template list like this:
+            in [ template-vtdirektmarketing ]
+          '';
+        };
+
+        quoteTemplates = mkOption {
+          type = types.listOf types.path;
+          default = [ ];
+          description = ''
+            List of path(s) to respective template(s) which are copied from the 'quote_templates/pdf' directory.
+
+            ::: {.note}
+            These templates need to be packaged before use, see example.
+            :::
+          '';
+          example = literalExpression ''
+            let
+              # Let's package an example template
+              template-vtdirektmarketing = pkgs.stdenv.mkDerivation {
+                name = "vtdirektmarketing";
+                # Download the template from a public repository
+                src = pkgs.fetchgit {
+                  url = "https://git.project-insanity.org/onny/invoiceplane-vtdirektmarketing.git";
+                  sha256 = "1hh0q7wzsh8v8x03i82p6qrgbxr4v5fb05xylyrpp975l8axyg2z";
+                };
+                sourceRoot = ".";
+                # Installing simply means copying template php file to the output directory
+                installPhase = ""
+                  mkdir -p $out
+                  cp invoiceplane-vtdirektmarketing/vtdirektmarketing.php $out/
+                "";
+              };
+            # And then pass this package to the template list like this:
+            in [ template-vtdirektmarketing ]
+          '';
+        };
+
+        poolConfig = mkOption {
+          type =
+            with types;
+            attrsOf (oneOf [
+              str
+              int
+              bool
+            ]);
+          default = {
+            "pm" = "dynamic";
+            "pm.max_children" = 32;
+            "pm.start_servers" = 2;
+            "pm.min_spare_servers" = 2;
+            "pm.max_spare_servers" = 4;
+            "pm.max_requests" = 500;
+          };
+          description = ''
+            Options for the InvoicePlane PHP pool. See the documentation on `php-fpm.conf`
+            for details on configuration directives.
+          '';
+        };
+
+        settings = mkOption {
+          type = types.attrsOf types.anything;
+          default = { };
+          description = ''
+            Structural InvoicePlane configuration. Refer to
+            <https://github.com/InvoicePlane/InvoicePlane/blob/master/ipconfig.php.example>
+            for details and supported values.
+          '';
+          example = literalExpression ''
+            {
+              SETUP_COMPLETED = true;
+              DISABLE_SETUP = true;
+              IP_URL = "https://invoice.example.com";
+            }
+          '';
+        };
+
+        cron = {
+          enable = mkOption {
+            type = types.bool;
+            default = false;
+            description = ''
+              Enable cron service which periodically runs Invoiceplane tasks.
+              Requires key taken from the administration page. Refer to
+              <https://wiki.invoiceplane.com/en/1.0/modules/recurring-invoices>
+              on how to configure it.
+            '';
+          };
+          key = mkOption {
+            type = types.str;
+            description = "Cron key taken from the administration page.";
+          };
+        };
+
+      };
+
+    };
+in
+{
+  # interface
+  options = {
+    services.invoiceplane = mkOption {
+      type = types.submodule {
+
+        options.sites = mkOption {
+          type = types.attrsOf (types.submodule siteOpts);
+          default = { };
+          description = "Specification of one or more InvoicePlane sites to serve";
+        };
+
+        options.webserver = mkOption {
+          type = types.enum [
+            "caddy"
+            "nginx"
+          ];
+          default = "caddy";
+          example = "nginx";
+          description = ''
+            Which webserver to use for virtual host management.
+          '';
+        };
+      };
+      default = { };
+      description = "InvoicePlane configuration.";
+    };
+
+  };
+
+  # implementation
+  config = mkIf (eachSite != { }) (mkMerge [
+    {
+
+      assertions = flatten (
+        mapAttrsToList (hostName: cfg: [
+          {
+            assertion = cfg.database.createLocally -> cfg.database.user == user;
+            message = ''services.invoiceplane.sites."${hostName}".database.user must be ${user} if the database is to be automatically provisioned'';
+          }
+          {
+            assertion = cfg.database.createLocally -> cfg.database.passwordFile == null;
+            message = ''services.invoiceplane.sites."${hostName}".database.passwordFile cannot be specified if services.invoiceplane.sites."${hostName}".database.createLocally is set to true.'';
+          }
+          {
+            assertion = cfg.cron.enable -> cfg.cron.key != null;
+            message = ''services.invoiceplane.sites."${hostName}".cron.key must be set in order to use cron service.'';
+          }
+        ]) eachSite
+      );
+
+      services.mysql = mkIf (any (v: v.database.createLocally) (attrValues eachSite)) {
+        enable = true;
+        package = mkDefault pkgs.mariadb;
+        ensureDatabases = mapAttrsToList (hostName: cfg: cfg.database.name) eachSite;
+        ensureUsers = mapAttrsToList (hostName: cfg: {
+          name = cfg.database.user;
+          ensurePermissions = {
+            "${cfg.database.name}.*" = "ALL PRIVILEGES";
+          };
+        }) eachSite;
+      };
+
+      services.phpfpm = {
+        pools = mapAttrs' (
+          hostName: cfg:
+          (nameValuePair "invoiceplane-${hostName}" {
+            inherit user;
+            group = webserver.group;
+            settings = {
+              "listen.owner" = webserver.user;
+              "listen.group" = webserver.group;
+            }
+            // cfg.poolConfig;
+          })
+        ) eachSite;
+      };
+
+    }
+
+    {
+
+      systemd.tmpfiles.rules = flatten (
+        mapAttrsToList (hostName: cfg: [
+          "d ${cfg.stateDir} 0750 ${user} ${webserver.group} - -"
+          "f ${cfg.stateDir}/ipconfig.php 0750 ${user} ${webserver.group} - -"
+          "d ${cfg.stateDir}/logs 0750 ${user} ${webserver.group} - -"
+          "d ${cfg.stateDir}/uploads 0750 ${user} ${webserver.group} - -"
+          "d ${cfg.stateDir}/uploads/archive 0750 ${user} ${webserver.group} - -"
+          "d ${cfg.stateDir}/uploads/customer_files 0750 ${user} ${webserver.group} - -"
+          "d ${cfg.stateDir}/uploads/temp 0750 ${user} ${webserver.group} - -"
+          "d ${cfg.stateDir}/uploads/temp/mpdf 0750 ${user} ${webserver.group} - -"
+          "d ${cfg.stateDir}/tmp 0750 ${user} ${webserver.group} - -"
+        ]) eachSite
+      );
+
+      systemd.services.invoiceplane-config = {
+        serviceConfig.Type = "oneshot";
+        script = concatStrings (
+          mapAttrsToList (hostName: cfg: ''
+            mkdir -p ${cfg.stateDir}/logs \
+                     ${cfg.stateDir}/uploads
+            if ! grep -q IP_URL "${cfg.stateDir}/ipconfig.php"; then
+              cp "${invoiceplane-config hostName cfg}" "${cfg.stateDir}/ipconfig.php"
+            fi
+            if ! grep -q 'php exit' "${cfg.stateDir}/ipconfig.php"; then
+              sed -i "1i # <?php exit('No direct script access allowed'); ?>" "${cfg.stateDir}/ipconfig.php"
+            fi
+          '') eachSite
+        );
+        wantedBy = [ "multi-user.target" ];
+      };
+
+      users.users.${user} = {
+        group = webserver.group;
+        isSystemUser = true;
+      };
+
+    }
+    {
+
+      # Cron service implementation
+
+      systemd.timers = mapAttrs' (
+        hostName: cfg:
+        (nameValuePair "invoiceplane-cron-${hostName}" (
+          mkIf cfg.cron.enable {
+            wantedBy = [ "timers.target" ];
+            timerConfig = {
+              OnBootSec = "5m";
+              OnUnitActiveSec = "5m";
+              Unit = "invoiceplane-cron-${hostName}.service";
+            };
+          }
+        ))
+      ) eachSite;
+
+      systemd.services = mapAttrs' (
+        hostName: cfg:
+        (nameValuePair "invoiceplane-cron-${hostName}" (
+          mkIf cfg.cron.enable {
+            serviceConfig = {
+              Type = "oneshot";
+              User = user;
+              ExecStart = "${pkgs.curl}/bin/curl --header 'Host: ${hostName}' http://localhost/invoices/cron/recur/${cfg.cron.key}";
+            };
+          }
+        ))
+      ) eachSite;
+
+    }
+
+    (mkIf (cfg.webserver == "caddy") {
+      services.caddy = {
+        enable = true;
+        virtualHosts = mapAttrs' (
+          hostName: cfg:
+          (nameValuePair "http://${hostName}" {
+            extraConfig = ''
+              root * ${pkg hostName cfg}
+              file_server
+              php_fastcgi unix/${config.services.phpfpm.pools."invoiceplane-${hostName}".socket}
+            '';
+          })
+        ) eachSite;
+      };
+    })
+
+    (mkIf (cfg.webserver == "nginx") {
+      services.nginx = {
+        enable = true;
+        virtualHosts = mapAttrs' (
+          hostName: cfg:
+          (nameValuePair hostName {
+            root = pkg hostName cfg;
+            extraConfig = ''
+              index index.php index.html index.htm;
+
+              if (!-e $request_filename){
+                rewrite ^(.*)$ /index.php break;
+              }
+            '';
+
+            locations = {
+              "/setup".extraConfig = ''
+                rewrite ^(.*)$ http://${hostName}/ redirect;
+              '';
+
+              "~ .php$" = {
+                extraConfig = ''
+                  fastcgi_split_path_info ^(.+\.php)(/.+)$;
+                  fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+                  fastcgi_pass unix:${config.services.phpfpm.pools."invoiceplane-${hostName}".socket};
+                  include ${config.services.nginx.package}/conf/fastcgi_params;
+                  include ${config.services.nginx.package}/conf/fastcgi.conf;
+                '';
+              };
+            };
+          })
+        ) eachSite;
+      };
+    })
+
+  ]);
+}
@@ -788,6 +788,7 @@ in
  installer-systemd-stage-1 = handleTest ./installer-systemd-stage-1.nix { };
  intune = runTest ./intune.nix;
  invidious = runTest ./invidious.nix;
+  invoiceplane = runTest ./invoiceplane.nix;
  iodine = runTest ./iodine.nix;
  iosched = runTest ./iosched.nix;
  ipget = runTest ./ipget.nix;
@@ -0,0 +1,116 @@
+{ pkgs, ... }:
+
+{
+  name = "invoiceplane";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [
+      onny
+    ];
+  };
+
+  nodes = {
+    invoiceplane_caddy =
+      { ... }:
+      {
+        services.invoiceplane.webserver = "caddy";
+        services.invoiceplane.sites = {
+          "site1.local" = {
+            database.name = "invoiceplane1";
+            database.createLocally = true;
+            enable = true;
+          };
+          "site2.local" = {
+            database.name = "invoiceplane2";
+            database.createLocally = true;
+            enable = true;
+          };
+        };
+
+        networking.firewall.allowedTCPPorts = [ 80 ];
+        networking.hosts."127.0.0.1" = [
+          "site1.local"
+          "site2.local"
+        ];
+      };
+
+    invoiceplane_nginx =
+      { ... }:
+      {
+        services.invoiceplane.webserver = "nginx";
+        services.invoiceplane.sites = {
+          "site1.local" = {
+            database.name = "invoiceplane1";
+            database.createLocally = true;
+            enable = true;
+          };
+          "site2.local" = {
+            database.name = "invoiceplane2";
+            database.createLocally = true;
+            enable = true;
+          };
+        };
+
+        networking.firewall.allowedTCPPorts = [ 80 ];
+        networking.hosts."127.0.0.1" = [
+          "site1.local"
+          "site2.local"
+        ];
+      };
+  };
+
+  testScript = ''
+    start_all()
+
+    invoiceplane_caddy.wait_for_unit("caddy")
+    invoiceplane_nginx.wait_for_unit("nginx")
+
+    site_names = ["site1.local", "site2.local"]
+
+    machines = [invoiceplane_caddy, invoiceplane_nginx]
+
+    for machine in machines:
+      machine.wait_for_open_port(80)
+      machine.wait_for_open_port(3306)
+
+      for site_name in site_names:
+          machine.wait_for_unit(f"phpfpm-invoiceplane-{site_name}")
+
+          with subtest("Website returns welcome screen"):
+              assert "Please install InvoicePlane" in machine.succeed(f"curl -L {site_name}")
+
+          with subtest("Finish InvoicePlane setup"):
+            machine.succeed(
+              f"curl -sSfL --cookie-jar cjar {site_name}/setup/language"
+            )
+            csrf_token = machine.succeed(
+              "grep ip_csrf_cookie cjar | cut -f 7 | tr -d '\n'"
+            )
+            machine.succeed(
+              f"curl -sSfL --cookie cjar --cookie-jar cjar -d '_ip_csrf={csrf_token}&ip_lang=english&btn_continue=Continue' {site_name}/setup/language"
+            )
+            csrf_token = machine.succeed(
+              "grep ip_csrf_cookie cjar | cut -f 7 | tr -d '\n'"
+            )
+            machine.succeed(
+              f"curl -sSfL --cookie cjar --cookie-jar cjar -d '_ip_csrf={csrf_token}&btn_continue=Continue' {site_name}/setup/prerequisites"
+            )
+            csrf_token = machine.succeed(
+              "grep ip_csrf_cookie cjar | cut -f 7 | tr -d '\n'"
+            )
+            machine.succeed(
+              f"curl -sSfL --cookie cjar --cookie-jar cjar -d '_ip_csrf={csrf_token}&btn_continue=Continue' {site_name}/setup/configure_database"
+            )
+            csrf_token = machine.succeed(
+              "grep ip_csrf_cookie cjar | cut -f 7 | tr -d '\n'"
+            )
+            machine.succeed(
+              f"curl -sSfl --cookie cjar --cookie-jar cjar -d '_ip_csrf={csrf_token}&btn_continue=Continue' {site_name}/setup/install_tables"
+            )
+            csrf_token = machine.succeed(
+              "grep ip_csrf_cookie cjar | cut -f 7 | tr -d '\n'"
+            )
+            machine.succeed(
+              f"curl -sSfl --cookie cjar --cookie-jar cjar -d '_ip_csrf={csrf_token}&btn_continue=Continue' {site_name}/setup/upgrade_tables"
+            )
+  '';
+}
@@ -36,20 +36,20 @@ let

  hash =
    {
-      x86_64-linux = "sha256-N8dBXYpBbaymuGWFb8+77/4yJ6Meo5eqoYpnlsjGlN8=";
-      x86_64-darwin = "sha256-li+29ukZXvwBihnHti+AntMNwhr3g1tOOdmalZchL40=";
-      aarch64-linux = "sha256-ASzpE721RBAiVFxnGCRMCWj/RFa+TpxA4gaZJFxk7I0=";
-      aarch64-darwin = "sha256-afaADPPWJlW3HdWGAMDuibGhBtR7toEm2T58jR/nsic=";
-      armv7l-linux = "sha256-BgG1RglSISrKm+KRq7AXhp7EUOssts2LSLCVqSD7E/Q=";
+      x86_64-linux = "sha256-ST5i8gvNtAaBbmcpcg9GJipr8e5d0A0qbdG1P9QViek=";
+      x86_64-darwin = "sha256-BRGXLasiHZSKsijq02bCa2RbaBc7iC1ZtLe29u4KTH0=";
+      aarch64-linux = "sha256-7plpHWoi8eYDKQZVV3OCXZJUk8j173M1xpRgTOTsPZ0=";
+      aarch64-darwin = "sha256-RgfhGjVFmaIAAotTYNPUDrJZ8qj8e4yR9bVfal/Hl6o=";
+      armv7l-linux = "sha256-Zzz4HsmiWcKiBRE19pGll8BRQy26wbmpuYSi89PDoBo=";
    }
    .${system} or throwSystem;

  # Please backport all compatible updates to the stable release.
  # This is important for the extension ecosystem.
-  version = "1.109.0";
+  version = "1.109.2";

  # This is used for VS Code - Remote SSH test
-  rev = "bdd88df003631aaa0bcbe057cb0a940b80a476fa";
+  rev = "591199df409fbf59b4b52d5ad4ee0470152a9b31";
 in
 buildVscode {
  pname = "vscode" + lib.optionalString isInsiders "-insiders";
@@ -82,7 +82,7 @@ buildVscode {
    src = fetchurl {
      name = "vscode-server-${rev}.tar.gz";
      url = "https://update.code.visualstudio.com/commit:${rev}/server-linux-x64/stable";
-      hash = "sha256-qdXYNkc7u1s/HexmK3Dwc4H/nsfoyhL0/c8TgK94JwU=";
+      hash = "sha256-CbU8VdJETTzpwCpzVgavoeSQMdz3RdwDYJ7wUqs8LJ8=";
    };
    stdenv = stdenvNoCC;
  };
@@ -36,6 +36,7 @@
  libusb1,
  libuv,
  libwebsockets,
+  libxi,
  libxml2,
  libxslt,
  lilv,
@@ -71,14 +72,14 @@ stdenv.mkDerivation (
  in
  {
    pname = "ardour";
-    version = "8.12";
+    version = "9.0";

    # We can't use `fetchFromGitea` here, as attempting to fetch release archives from git.ardour.org
    # result in an empty archive. See https://tracker.ardour.org/view.php?id=7328 for more info.
    src = fetchgit {
      url = "git://git.ardour.org/ardour/ardour.git";
      rev = finalAttrs.version;
-      hash = "sha256-4IgBQ53cwPA35YwNQyo+qBqsMGv+TLn6w1zaDX97erE=";
+      hash = "sha256-zgWNKYN45qa2xLWnL3W/UWfRVBJN3+hya9dpIZLLJvo=";
    };

    bundledContent = fetchzip {
@@ -146,6 +147,7 @@ stdenv.mkDerivation (
      libusb1
      libuv
      libwebsockets
+      libxi
      libxml2
      libxslt
      lilv
@@ -190,6 +192,15 @@ stdenv.mkDerivation (
    ]
    ++ lib.optional optimize "--optimize";

+    env.NIX_CFLAGS_COMPILE = toString [
+      # 'ioprio_set' syscall support:
+      "-D_GNU_SOURCE"
+      # compiler doesn't find headers without these:
+      "-I${lib.getDev serd}/include/serd-0"
+      "-I${lib.getDev sratom}/include/sratom-0"
+      "-I${lib.getDev sord}/include/sord-0"
+    ];
+
    postInstall = ''
      # wscript does not install these for some reason
      install -vDm 644 "build/gtk2_ardour/ardour.xml" \
@@ -231,7 +242,7 @@ stdenv.mkDerivation (
      '';
      homepage = "https://ardour.org/";
      license = lib.licenses.gpl2Plus;
-      mainProgram = "ardour8";
+      mainProgram = "ardour9";
      platforms = lib.platforms.linux;
      maintainers = with lib.maintainers; [
        magnetophon
@@ -0,0 +1,12 @@
+--- a/libs/ardour/wscript
+++ b/libs/ardour/wscript
+@@ -379,8 +379,7 @@ def build(bld):
+
+     # remove '${DEFINES_ST:DEFINES}' from run_str.
+     # x86_64-w64-mingw32-as (mingw) -D flag is for debug messages
+-    if bld.env['build_target'] == 'mingw':
+-        class asm(Task.classes['asm']): run_str = '${AS} ${ASFLAGS} ${ASMPATH_ST:INCPATHS} ${AS_SRC_F}${SRC} ${AS_TGT_F}${TGT}'
+    class asm(Task.classes['asm']): run_str = '${AS} ${ASFLAGS} ${ASMPATH_ST:INCPATHS} ${AS_SRC_F}${SRC} ${AS_TGT_F}${TGT}'
+
+     # operate on copy to avoid adding sources twice
+     sources = list(libardour_sources)
@@ -0,0 +1,55 @@
+From 1217722e4bf6c65b5c24da17a7de4bf712ca6775 Mon Sep 17 00:00:00 2001
+From: Tamara Schmitz <tamara.zoe.schmitz@posteo.de>
+Date: Sat, 17 Jun 2023 14:05:53 +0200
+Subject: [PATCH] add NixOS plugin paths as default search paths
+
+Since NixOS uses unusual paths, we should tell Ardour about this. During
+first launch, Ardour does indeed check for environmentals but not when
+you press the "Reset to Defaults" button in the Settings menu. This
+path fixes this by including NixOS paths in the defaults.
+---
+ libs/ardour/plugin_manager.cc | 5 +++--
+ libs/ardour/search_paths.cc   | 4 ++++
+ 2 files changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/libs/ardour/plugin_manager.cc b/libs/ardour/plugin_manager.cc
+index a572ed55dd..3dd6c2fda6 100644
+--- a/libs/ardour/plugin_manager.cc
+++ b/libs/ardour/plugin_manager.cc
+@@ -305,7 +305,8 @@ PluginManager::PluginManager ()
+ 	if (lxvst_path.length() == 0) {
+ 		lxvst_path = "/usr/local/lib64/lxvst:/usr/local/lib/lxvst:/usr/lib64/lxvst:/usr/lib/lxvst:"
+ 			"/usr/local/lib64/linux_vst:/usr/local/lib/linux_vst:/usr/lib64/linux_vst:/usr/lib/linux_vst:"
+-			"/usr/lib/vst:/usr/local/lib/vst";
+			"/usr/lib/vst:/usr/local/lib/vst:$HOME/.nix-profile/lib/vst:"
+			"$HOME/.lxvst:$HOME/.nix-profile/lib/lxvst:/run/current-system/sw/lib/lxvst:/etc/profiles/per-user/$USER/lib/lxvst";
+ 	}
+ 
+ 	/* first time setup, use 'default' path */
+@@ -2040,7 +2041,7 @@ PluginManager::vst3_refresh (bool cache_only)
+ 	std::string prog = PBD::get_win_special_folder_path (CSIDL_PROGRAM_FILES);
+ 	vst3_discover_from_path (Glib::build_filename (prog, "Common Files", "VST3"), cache_only);
+ #else
+-	vst3_discover_from_path ("~/.vst3:/usr/local/lib/vst3:/usr/lib/vst3", cache_only);
+	vst3_discover_from_path ("~/.vst3:/usr/local/lib/vst3:/usr/lib/vst3:~/.nix-profile/lib/vst3:/run/current-system/sw/lib/vst3:/etc/profiles/per-user/$USER/lib/vst3", cache_only);
+ #endif
+ }
+ 
+diff --git a/libs/ardour/search_paths.cc b/libs/ardour/search_paths.cc
+index e6d8744369..b9774cb006 100644
+--- a/libs/ardour/search_paths.cc
+++ b/libs/ardour/search_paths.cc
+@@ -112,6 +112,10 @@ ladspa_search_path ()
+ 	spath.push_back ("/usr/local/lib/ladspa");
+ 	spath.push_back ("/usr/lib64/ladspa");
+ 	spath.push_back ("/usr/lib/ladspa");
+	spath.push_back ("/run/current-system/sw/lib/ladspa");
+	spath.push_back (path_expand ("$HOME/.ladspa"));
+	spath.push_back (path_expand ("$HOME/.nix-profile/lib/ladspa"));
+	spath.push_back (path_expand ("/etc/profiles/per-user/$USER/lib/ladspa"));
+ #endif
+ 
+ #ifdef __APPLE__
+-- 
+2.40.1
+
@@ -0,0 +1,243 @@
+{
+  lib,
+  stdenv,
+  fetchgit,
+  fetchzip,
+  alsa-lib,
+  aubio,
+  boost,
+  cairomm,
+  cppunit,
+  curl,
+  dbus,
+  doxygen,
+  ffmpeg,
+  fftw,
+  fftwSinglePrec,
+  flac,
+  fluidsynth,
+  glibc,
+  glibmm,
+  graphviz,
+  harvid,
+  hidapi,
+  itstool,
+  kissfft,
+  libarchive,
+  libjack2,
+  liblo,
+  libltc,
+  libogg,
+  libpulseaudio,
+  librdf_rasqal,
+  libsamplerate,
+  libsigcxx,
+  libsndfile,
+  libusb1,
+  libuv,
+  libwebsockets,
+  libxml2,
+  libxslt,
+  lilv,
+  lrdf,
+  lv2,
+  makeWrapper,
+  pango,
+  pangomm,
+  perl,
+  pkg-config,
+  python3,
+  qm-dsp,
+  readline,
+  rubberband,
+  serd,
+  sord,
+  soundtouch,
+  sratom,
+  suil,
+  taglib,
+  vamp-plugin-sdk,
+  wafHook,
+  xjadeo,
+  libxrandr,
+  libxinerama,
+  optimize ? true, # disable to print Lua DSP script output to stdout
+  videoSupport ? true,
+}:
+stdenv.mkDerivation (
+  finalAttrs:
+  let
+    majorVersion = lib.versions.major finalAttrs.version;
+  in
+  {
+    pname = "ardour";
+    version = "8.12";
+
+    # We can't use `fetchFromGitea` here, as attempting to fetch release archives from git.ardour.org
+    # result in an empty archive. See https://tracker.ardour.org/view.php?id=7328 for more info.
+    src = fetchgit {
+      url = "git://git.ardour.org/ardour/ardour.git";
+      rev = finalAttrs.version;
+      hash = "sha256-4IgBQ53cwPA35YwNQyo+qBqsMGv+TLn6w1zaDX97erE=";
+    };
+
+    bundledContent = fetchzip {
+      url = "https://web.archive.org/web/20221026200824/http://stuff.ardour.org/loops/ArdourBundledMedia.zip";
+      hash = "sha256-IbPQWFeyMuvCoghFl1ZwZNNcSvLNsH84rGArXnw+t7A=";
+      # archive does not contain a single folder at the root
+      stripRoot = false;
+    };
+
+    patches = [
+      # AS=as in the environment causes build failure https://tracker.ardour.org/view.php?id=8096
+      ./as-flags.patch
+      ./default-plugin-search-paths.patch
+    ];
+
+    # Ardour's wscript requires git revision and date to be available.
+    # Since they are not, let's generate the file manually.
+    postPatch = ''
+      printf '#include "libs/ardour/ardour/revision.h"\nnamespace ARDOUR { const char* revision = "${finalAttrs.version}"; const char* date = ""; }\n' > libs/ardour/revision.cc
+      sed 's|/usr/include/libintl.h|${glibc.dev}/include/libintl.h|' -i wscript
+      patchShebangs ./tools/
+      substituteInPlace libs/ardour/video_tools_paths.cc \
+        --replace-fail 'ffmpeg_exe = X_("");' 'ffmpeg_exe = X_("${ffmpeg}/bin/ffmpeg");' \
+        --replace-fail 'ffprobe_exe = X_("");' 'ffprobe_exe = X_("${ffmpeg}/bin/ffprobe");'
+    '';
+
+    nativeBuildInputs = [
+      doxygen
+      graphviz # for dot
+      itstool
+      makeWrapper
+      perl
+      pkg-config
+      python3
+      wafHook
+    ];
+
+    buildInputs = [
+      alsa-lib
+      aubio
+      boost
+      cairomm
+      cppunit
+      curl
+      dbus
+      ffmpeg
+      fftw
+      fftwSinglePrec
+      flac
+      fluidsynth
+      glibmm
+      hidapi
+      itstool
+      kissfft
+      libarchive
+      libjack2
+      liblo
+      libltc
+      libogg
+      libpulseaudio
+      librdf_rasqal
+      libsamplerate
+      libsigcxx
+      libsndfile
+      libusb1
+      libuv
+      libwebsockets
+      libxml2
+      libxslt
+      lilv
+      lrdf
+      lv2
+      pango
+      pangomm
+      perl
+      python3
+      qm-dsp
+      readline
+      rubberband
+      serd
+      sord
+      soundtouch
+      sratom
+      suil
+      taglib
+      vamp-plugin-sdk
+      libxinerama
+      libxrandr
+    ]
+    ++ lib.optionals videoSupport [
+      harvid
+      xjadeo
+    ];
+
+    wafConfigureFlags = [
+      "--cxx17"
+      "--docs"
+      "--freedesktop"
+      "--no-phone-home"
+      "--ptformat"
+      "--run-tests"
+      "--test"
+      # since we don't have https://github.com/agfline/LibAAF yet,
+      # we need to use some of ardours internal libs, see:
+      # https://discourse.ardour.org/t/ardour-8-2-released/109615/6
+      # and
+      # https://discourse.ardour.org/t/ardour-8-2-released/109615/8
+      # "--use-external-libs"
+    ]
+    ++ lib.optional optimize "--optimize";
+
+    postInstall = ''
+      # wscript does not install these for some reason
+      install -vDm 644 "build/gtk2_ardour/ardour.xml" \
+        -t "$out/share/mime/packages"
+      install -vDm 644 "build/gtk2_ardour/ardour${majorVersion}.desktop" \
+        -t "$out/share/applications"
+      for size in 16 22 32 48 256 512; do
+        install -vDm 644 "gtk2_ardour/resources/Ardour-icon_''${size}px.png" \
+          "$out/share/icons/hicolor/''${size}x''${size}/apps/ardour${majorVersion}.png"
+      done
+      install -vDm 644 "ardour.1"* -t "$out/share/man/man1"
+
+      # install additional bundled beats, chords and progressions
+      cp -rp "${finalAttrs.bundledContent}"/* "$out/share/ardour${majorVersion}/media"
+    ''
+    + lib.optionalString videoSupport ''
+      # `harvid` and `xjadeo` must be accessible in `PATH` for video to work.
+      wrapProgram "$out/bin/ardour${majorVersion}" \
+        --prefix PATH : "${
+          lib.makeBinPath [
+            harvid
+            xjadeo
+          ]
+        }"
+    '';
+
+    LINKFLAGS = "-lpthread";
+
+    meta = {
+      description = "Multi-track hard disk recording software";
+      longDescription = ''
+        Ardour is a digital audio workstation (DAW), You can use it to
+        record, edit and mix multi-track audio and midi. Produce your
+        own CDs. Mix video soundtracks. Experiment with new ideas about
+        music and sound.
+
+        Please consider supporting the ardour project financially:
+        https://community.ardour.org/donate
+      '';
+      homepage = "https://ardour.org/";
+      license = lib.licenses.gpl2Plus;
+      mainProgram = "ardour8";
+      platforms = lib.platforms.linux;
+      maintainers = with lib.maintainers; [
+        magnetophon
+        mitchmindtree
+        ryand56
+      ];
+    };
+  }
+)
@@ -36,7 +36,7 @@ stdenv.mkDerivation (finalAttrs: {
    ./dont-clone-git-repo.patch
  ];

-  sourceRoot = finalAttrs.src.name;
+  sourceRoot = "source";

  buildFlags = [ "install-git" ];
  GIT_REPO_PATH = finalAttrs.src;
@@ -7,7 +7,7 @@
 }:

 let
-  version = "18.8.3";
+  version = "18.8.4";
  package_version = "v${lib.versions.major version}";
  gitaly_package = "gitlab.com/gitlab-org/gitaly/${package_version}";

@@ -21,7 +21,7 @@ let
      owner = "gitlab-org";
      repo = "gitaly";
      rev = "v${version}";
-      hash = "sha256-ALUOgSPl+tNh/hmnYq2Mfw7R0ECQ/ohUZZNnBeItQds=";
+      hash = "sha256-/zl25h2kYP4nUOJoNkOs3Tp1QsY5YcOutykchPEVa1I=";
    };

    vendorHash = "sha256-CSjsxwumKUbp/tSewE8iAp4c3DH6V6fNY4OCgzjvHP0=";
@@ -6,14 +6,14 @@

 buildGoModule (finalAttrs: {
  pname = "gitlab-pages";
-  version = "18.8.3";
+  version = "18.8.4";

  # nixpkgs-update: no auto update
  src = fetchFromGitLab {
    owner = "gitlab-org";
    repo = "gitlab-pages";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-OmIhZwNmuOGYpBe32EYXVw4nX7XArkxdj3uoP9qurN4=";
+    hash = "sha256-cGl/Huhy9RJxP786MVlzbMNjgBfEQzZTdHt+KRElXoA=";
  };

  vendorHash = "sha256-AZIv/CU01OAbn5faE4EkSuDCakYzDjRprB5ox5tIlck=";
@@ -1,17 +1,17 @@
 {
-  "version": "18.8.3",
-  "repo_hash": "sha256-c9e6HhJ1ERXSMHYW+MHTVzxpqtUIfVHrlIUlCJ+zX0A=",
+  "version": "18.8.4",
+  "repo_hash": "sha256-gX5Cy3CxNqLj4HFgqGmFKLrvAhdcgag+XcQMEB9UNZ4=",
  "yarn_hash": "sha256-s4+NpzynaR5ab1DlXRMmtOeFZCwpexMoWjwX00hnx5o=",
  "frontend_islands_yarn_hash": "sha256-DiGj3eJMLnlWBTePwGmEvmY9d1Li3p/Y6h3GtZnsvhg=",
  "owner": "gitlab-org",
  "repo": "gitlab",
-  "rev": "v18.8.3-ee",
+  "rev": "v18.8.4-ee",
  "passthru": {
-    "GITALY_SERVER_VERSION": "18.8.3",
-    "GITLAB_KAS_VERSION": "18.8.3",
-    "GITLAB_PAGES_VERSION": "18.8.3",
+    "GITALY_SERVER_VERSION": "18.8.4",
+    "GITLAB_KAS_VERSION": "18.8.4",
+    "GITLAB_PAGES_VERSION": "18.8.4",
    "GITLAB_SHELL_VERSION": "14.45.5",
    "GITLAB_ELASTICSEARCH_INDEXER_VERSION": "5.12.2",
-    "GITLAB_WORKHORSE_VERSION": "18.8.3"
+    "GITLAB_WORKHORSE_VERSION": "18.8.4"
  }
 }
@@ -10,7 +10,7 @@ in
 buildGoModule (finalAttrs: {
  pname = "gitlab-workhorse";

-  version = "18.8.3";
+  version = "18.8.4";

  # nixpkgs-update: no auto update
  src = fetchFromGitLab {
@@ -747,7 +747,7 @@ gem 'paper_trail', '~> 16.0', feature_category: :workspaces

 gem "i18n_data", "~> 0.13.1", feature_category: :system_access

-gem "gitlab-cloud-connector", "~> 1.40", require: 'gitlab/cloud_connector', feature_category: :plan_provisioning
+gem "gitlab-cloud-connector", "~> 1.43", require: 'gitlab/cloud_connector', feature_category: :plan_provisioning

 gem "gvltools", "~> 0.4.0", feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839

@@ -743,7 +743,7 @@ GEM
      terminal-table (>= 1.5.1)
    gitlab-chronic (0.10.6)
      numerizer (~> 0.2)
-    gitlab-cloud-connector (1.40.0)
+    gitlab-cloud-connector (1.43.0)
      activesupport (>= 7.0)
      jwt (~> 2.9)
    gitlab-crystalball (1.1.1)
@@ -2191,7 +2191,7 @@ DEPENDENCIES
  gitlab-active-context!
  gitlab-backup-cli!
  gitlab-chronic (~> 0.10.5)
-  gitlab-cloud-connector (~> 1.40)
+  gitlab-cloud-connector (~> 1.43)
  gitlab-crystalball (~> 1.1.0)
  gitlab-dangerfiles (~> 4.10.0)
  gitlab-duo-workflow-service-client (~> 0.6)!
@@ -2886,10 +2886,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0wkffbl793jvkjw3qdfqfb1j4adsvyakdv7sc0g3cdp2q6lrrmah";
+      sha256 = "1cjn1vqnvr3lhbdqfpy88aq7qmvd1j7i08gd8cly91914cd22pi9";
      type = "gem";
    };
-    version = "1.40.0";
+    version = "1.43.0";
  };
  gitlab-crystalball = {
    dependencies = [
@@ -0,0 +1,19 @@
+diff --git a/yarn.lock b/yarn.lock
+index 227d51e2..11c80f04 100644
+--- a/yarn.lock
+++ b/yarn.lock
+@@ -1397,10 +1397,10 @@ safe-json-parse@~1.0.1:
+   resolved "https://registry.yarnpkg.com/safer-buffer/-/safer-buffer-2.1.2.tgz#44fa161b0187b9549dd84bb91802f9bd8385cd6a"
+   integrity sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==
+ 
+-sass@^1.89.2:
+-  version "1.97.2"
+-  resolved "https://registry.yarnpkg.com/sass/-/sass-1.97.2.tgz#e515a319092fd2c3b015228e3094b40198bff0da"
+-  integrity sha512-y5LWb0IlbO4e97Zr7c3mlpabcbBtS+ieiZ9iwDooShpFKWXf62zz5pEPdwrLYm+Bxn1fnbwFGzHuCLSA9tBmrw==
+sass@^1.97:
+  version "1.97.3"
+  resolved "https://registry.yarnpkg.com/sass/-/sass-1.97.3.tgz#9cb59339514fa7e2aec592b9700953ac6e331ab2"
+  integrity sha512-fDz1zJpd5GycprAbu4Q2PV/RprsRtKC/0z82z0JLgdytmcq0+ujJbJ/09bPGDxCLkKY3Np5cRAOcWiVkLXJURg==
+   dependencies:
+     chokidar "^4.0.0"
+     immutable "^5.0.2"
@@ -0,0 +1,80 @@
+{
+  lib,
+  fetchFromGitHub,
+  nixosTests,
+  fetchYarnDeps,
+  applyPatches,
+  php,
+  yarnConfigHook,
+  yarnBuildHook,
+  yarnInstallHook,
+  grunt-cli,
+  fetchzip,
+}:
+let
+  version = "1.7.0";
+  # Fetch release tarball which contains language files
+  # https://github.com/InvoicePlane/InvoicePlane/issues/1170
+  languages = fetchzip {
+    #url = "https://github.com/InvoicePlane/InvoicePlane/releases/download/v${version}/v${version}.zip";
+    url = "https://github.com/InvoicePlane/InvoicePlane/releases/download/v1.7.0/v1.7.0.zip";
+    hash = "sha256-D5wZg745xjbBsEPUbvle8ynErFB4xn9zdxOGh0xKCCU=";
+  };
+in
+php.buildComposerProject2 (finalAttrs: {
+  pname = "invoiceplane";
+  inherit version;
+
+  src = fetchFromGitHub {
+    owner = "InvoicePlane";
+    repo = "InvoicePlane";
+    tag = "v${version}";
+    hash = "sha256-6fuUmXe8mFSnLYwQCwBzxmSQxM06rQXe00IKUZvWnpM=";
+  };
+
+  # Fixes error: Couldn't find any versions for "sass" that matches "^1.97" in our cache
+  patches = [ ./fix-yarn-lockfile.patch ];
+
+  # Composer.lock validation currently fails for unknown reason
+  composerStrictValidation = false;
+
+  vendorHash = "sha256-/fNVq3WJCr9f/NE0s1x8N48W3ZMRUxdh1Qf3pLl0Lpg=";
+
+  nativeBuildInputs = [
+    yarnConfigHook
+    yarnBuildHook
+    yarnInstallHook
+    # Needed for executing package.json scripts
+    grunt-cli
+  ];
+
+  offlineCache = fetchYarnDeps {
+    inherit (finalAttrs) src patches;
+    hash = "sha256-YDknkQzdRKRRMXS6/cPRSrfhhIyTIDRnFPNGQueu74A=";
+  };
+
+  postBuild = ''
+    grunt build
+  '';
+
+  # Cleanup and language files
+  postInstall = ''
+    chmod -R u+w $out/share
+    mv $out/share/php/invoiceplane/* $out/
+    cp -r ${languages}/application/language $out/application/
+    rm -r $out/{composer.json,composer.lock,CONTRIBUTING.md,docker-compose.yml,Gruntfile.js,package.json,node_modules,yarn.lock,share}
+  '';
+
+  passthru.tests = {
+    inherit (nixosTests) invoiceplane;
+  };
+
+  meta = {
+    description = "Self-hosted open source application for managing your invoices, clients and payments";
+    changelog = "https://github.com/InvoicePlane/InvoicePlane/releases/tag/v${version}";
+    homepage = "https://www.invoiceplane.com";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ onny ];
+  };
+})
@@ -9,13 +9,13 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "kanboard";
-  version = "1.2.49";
+  version = "1.2.50";

  src = fetchFromGitHub {
    owner = "kanboard";
    repo = "kanboard";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-d74XjURu7vJwn+6p/br76jp4zJiYhYJLSjvxLamt48Q=";
+    hash = "sha256-/nC+V8KfVdEFEBozFFsyinUfXzZbu7h8/ROpjJoDchI=";
  };

  dontBuild = true;
@@ -10,14 +10,14 @@
 let
  soext = stdenv.hostPlatform.extensions.sharedLibrary;
 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "mimalloc";
  version = "3.1.5";

  src = fetchFromGitHub {
    owner = "microsoft";
    repo = "mimalloc";
-    rev = "v${version}";
+    tag = "v${finalAttrs.version}";
    sha256 = "sha256-fk6nfyBFS1G0sJwUJVgTC1+aKd0We/JjsIYTO+IOfyg=";
  };

@@ -34,16 +34,29 @@ stdenv.mkDerivation rec {
    cmake
    ninja
  ];
-  cmakeFlags = [
-    "-DMI_INSTALL_TOPLEVEL=ON"
-  ]
-  ++ lib.optionals secureBuild [ "-DMI_SECURE=ON" ]
-  ++ lib.optionals stdenv.hostPlatform.isStatic [ "-DMI_BUILD_SHARED=OFF" ]
-  ++ lib.optionals (!doCheck) [ "-DMI_BUILD_TESTS=OFF" ];
+  cmakeFlags = lib.mapAttrsToList lib.cmakeBool {
+    MI_INSTALL_TOPLEVEL = true;
+    MI_SECURE = secureBuild;
+    MI_BUILD_SHARED = stdenv.hostPlatform.hasSharedLibraries;
+    MI_LIBC_MUSL = stdenv.hostPlatform.libc == "musl";
+    MI_BUILD_TESTS = finalAttrs.doCheck;
+
+    # MI_OPT_ARCH is inaccurate (e.g. it assumes aarch64 == armv8.1-a).
+    # Nixpkgs's native platform configuration does a better job.
+    MI_NO_OPT_ARCH = true;
+  };
+
+  postPatch = ''
+    substituteInPlace cmake/mimalloc-config.cmake \
+      --replace-fail 'string(REPLACE "/lib/cmake" "/lib" MIMALLOC_LIBRARY_DIR "''${MIMALLOC_CMAKE_DIR}")' \
+                     "set(MIMALLOC_LIBRARY_DIR \"$out/lib\")" \
+      --replace-fail 'string(REPLACE "/lib/cmake/" "/lib/" MIMALLOC_OBJECT_DIR "''${CMAKE_CURRENT_LIST_DIR}")' \
+                     "set(MIMALLOC_OBJECT_DIR \"$out/lib\")"
+  '';

  postInstall =
    let
-      rel = lib.versions.majorMinor version;
+      rel = lib.versions.majorMinor finalAttrs.version;
      suffix = if stdenv.hostPlatform.isLinux then "${soext}.${rel}" else ".${rel}${soext}";
    in
    ''
@@ -76,4 +89,4 @@ stdenv.mkDerivation rec {
      thoughtpolice
    ];
  };
-}
+})
@@ -0,0 +1,26 @@
+{
+  nixos,
+  lib,
+  runCommand,
+}:
+let
+  base = nixos {
+    services.userborn.enable = true;
+    programs.nix-required-mounts = {
+      enable = true;
+      presets.nvidia-gpu.enable = true;
+    };
+    fileSystems."/".device = "/dev/null";
+    boot.loader.grub.enable = false;
+    system.stateVersion = lib.trivial.release;
+  };
+  machine = base.extendModules {
+    modules = [ { hardware.graphics.enable = true; } ];
+  };
+in
+runCommand "nix-required-mounts-eval-nvidia-gpu-preset" { } ''
+  echo "Successfully evaluated ${base.config.system.build.toplevel}"
+  echo "Successfully evaluated ${machine.config.system.build.toplevel}"
+  echo "This means that combining nix-required-mounts with userborn no longer causes infinite recursion (#488199)"
+  touch $out
+''
@@ -55,6 +55,7 @@ python3Packages.buildPythonApplication {
    inherit allowedPatterns;
    tests = {
      inherit (nixosTests) nix-required-mounts;
+      eval-nvidia-gpu-preset = callPackage ./eval-test.nix { };
    };
  };
  meta = {
@@ -176,18 +176,19 @@ buildGoModule (finalAttrs: {
      name = "podman-helper-binary-wrapper";

      # this only works for some binaries, others may need to be added to `binPath` or in the modules
-      paths = [
-        gvproxy
-      ]
-      ++ lib.optionals stdenv.hostPlatform.isLinux [
-        aardvark-dns
-        catatonit # added here for the pause image and also set in `containersConf` for `init_path`
-        netavark
-        passt
-        conmon
-        crun
-      ]
-      ++ extraRuntimes;
+      paths =
+        lib.optionals stdenv.hostPlatform.isDarwin [
+          gvproxy
+        ]
+        ++ lib.optionals stdenv.hostPlatform.isLinux [
+          aardvark-dns
+          catatonit # added here for the pause image and also set in `containersConf` for `init_path`
+          netavark
+          passt
+          conmon
+          crun
+        ]
+        ++ extraRuntimes;
    };
  };

@@ -9,14 +9,14 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "secretspec";
-  version = "0.6.2";
+  version = "0.7.0";

  src = fetchCrate {
    inherit (finalAttrs) pname version;
-    hash = "sha256-ZbyeYol8TaQz4ljTHTIHIlQwxmi/fr/ReILIOtilfEY=";
+    hash = "sha256-ik4ieQifB5MFvyr6cmcwvcyr3HyUB5aHpVIhnpVB1i8=";
  };

-  cargoHash = "sha256-UcSHFf9afU+2gl6K7XkYNEkJvslTkEO9u7qkNOKSNxg=";
+  cargoHash = "sha256-3xaJySTsGPjU8sDL7j0biEdpcrNuOspdf41iHH6BE4o=";

  nativeBuildInputs = [ pkg-config ];
  buildInputs = [ dbus ];
@@ -11,19 +11,19 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "vue-language-server";
-  version = "3.2.2";
+  version = "3.2.4";

  src = fetchFromGitHub {
    owner = "vuejs";
    repo = "language-tools";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-oVIWRCnJkJK1CsgNp7l95uuILeXv2XuwwfGElGnOEyU=";
+    hash = "sha256-GxIIqRK8wBVlo8jvCox6Fdp705EMg1YoHB46bvs5kkE=";
  };

  pnpmDeps = fetchPnpmDeps {
    inherit (finalAttrs) pname version src;
    fetcherVersion = 1;
-    hash = "sha256-lxRify3uJnqYH6btmXU9yaO8LJDGBZcyONLUHv2rLqg=";
+    hash = "sha256-QLey523pqhjOBn4xhN9mZTKRAC96imVka+li7C4BXQY=";
  };

  nativeBuildInputs = [
@@ -8,7 +8,7 @@

 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "zensical";
-  version = "0.0.21";
+  version = "0.0.23";
  pyproject = true;

  # We fetch from PyPi, because GitHub repo does not contain all sources.
@@ -16,12 +16,12 @@ python3Packages.buildPythonApplication (finalAttrs: {
  # We could combine sources, but then nix-update won't work.
  src = fetchPypi {
    inherit (finalAttrs) pname version;
-    hash = "sha256-wTVjg2+mOjyr7/2D/jp3DKdAz6Wue4XfhdiYN+MbO0o=";
+    hash = "sha256-XE/DqvB135nYz0G58lZuTViBgNmolJMBTTYH3+UKxLw=";
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
    inherit (finalAttrs) pname version src;
-    hash = "sha256-zkF0Yf7EPFHmkWy3FEhTKYFlWW4pLFG1OZPi1z7vZXU=";
+    hash = "sha256-cS8gxMPRpMMHwrjqXjyxBl4dbwll01Y+G4eOBZ3/vdM=";
  };

  nativeBuildInputs = with rustPlatform; [
@@ -50,19 +50,32 @@ let
          ;

        dart =
-          (dart.overrideAttrs (_: {
-            # This overrideAttrs is used to replace the version in src.url
-            version = dartVersion;
-            __intentionallyOverridingVersion = true;
-          })).overrideAttrs
-            (oldAttrs: {
-              src = fetchzip {
-                inherit (oldAttrs.src) url;
-                hash =
-                  dartHash.${stdenv.hostPlatform.system}
-                    or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
-              };
-            });
+          let
+            hash =
+              dartHash.${stdenv.hostPlatform.system}
+                or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
+          in
+          (
+            if lib.versionAtLeast version "3.41" then
+              (dart.overrideAttrs (oldAttrs: {
+                version = dartVersion;
+                src = oldAttrs.src.overrideAttrs (_: {
+                  inherit hash;
+                });
+              }))
+            else
+              (dart.overrideAttrs (_: {
+                # This overrideAttrs is used to replace the version in src.url
+                version = dartVersion;
+                __intentionallyOverridingVersion = true;
+              })).overrideAttrs
+                (oldAttrs: {
+                  src = fetchzip {
+                    inherit (oldAttrs.src) url;
+                    inherit hash;
+                  };
+                })
+          );
        src =
          let
            source = fetchFromGitHub {
@@ -1,29 +1,22 @@
 {
  lib,
-  fetchzip,
+  fetchurl,
 }:

 let
  dartVersion = "@dart_version@";
-  platform = "@platform@";
-  channel = if lib.strings.hasSuffix ".beta" dartVersion then "beta" else "stable";
+  system =
+    {
+      x86_64-linux = "linux-x64";
+      aarch64-linux = "linux-arm64";
+      x86_64-darwin = "macos-x64";
+      aarch64-darwin = "macos-arm64";
+    }
+    ."@platform@";
 in
-{
-  x86_64-linux = fetchzip {
-    url = "https://storage.googleapis.com/dart-archive/channels/${channel}/release/${dartVersion}/sdk/dartsdk-linux-x64-release.zip";
-    hash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
-  };
-  aarch64-linux = fetchzip {
-    url = "https://storage.googleapis.com/dart-archive/channels/${channel}/release/${dartVersion}/sdk/dartsdk-linux-arm64-release.zip";
-    hash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
-  };
-  x86_64-darwin = fetchzip {
-    url = "https://storage.googleapis.com/dart-archive/channels/${channel}/release/${dartVersion}/sdk/dartsdk-macos-x64-release.zip";
-    hash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
-  };
-  aarch64-darwin = fetchzip {
-    url = "https://storage.googleapis.com/dart-archive/channels/${channel}/release/${dartVersion}/sdk/dartsdk-macos-arm64-release.zip";
-    hash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
-  };
+fetchurl {
+  url = "https://storage.googleapis.com/dart-archive/channels/${
+    if lib.strings.hasSuffix ".beta" dartVersion then "beta" else "stable"
+  }/release/${dartVersion}/sdk/dartsdk-${system}-release.zip";
+  hash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
 }
-.${platform}
@@ -1,73 +1,73 @@
 {
-  "version": "3.41.0-0.3.pre",
-  "engineVersion": "492bf6df86d056e47d05a3d5404f3d78939b3dae",
+  "version": "3.41.0",
+  "engineVersion": "3452d735bd38224ef2db85ca763d862d6326b17f",
  "engineSwiftShaderHash": "sha256-qbtCl2nTpmtp9dnaoXc7rF3RqLnAZEmzw1BzPoCRWrc=",
  "engineSwiftShaderRev": "794b0cfce1d828d187637e6d932bae484fbe0976",
-  "channel": "beta",
+  "channel": "stable",
  "engineHashes": {
    "aarch64-linux": {
-      "aarch64-linux": "sha256-sL+RfXTdy5qAzgbSdfxeZHDcHSBzBLsbJ0Q8qLC9KMU=",
-      "x86_64-linux": "sha256-sL+RfXTdy5qAzgbSdfxeZHDcHSBzBLsbJ0Q8qLC9KMU="
+      "aarch64-linux": "sha256-XZvyhT3X4MBehSxWdceVFCNH9teXuGYjTaquuoiVp0w=",
+      "x86_64-linux": "sha256-XZvyhT3X4MBehSxWdceVFCNH9teXuGYjTaquuoiVp0w="
    },
    "x86_64-linux": {
-      "aarch64-linux": "sha256-82KrH53pKiLCwdwzxlFRCD/IKe0RcP8NEnjItA2whdA=",
-      "x86_64-linux": "sha256-82KrH53pKiLCwdwzxlFRCD/IKe0RcP8NEnjItA2whdA="
+      "aarch64-linux": "sha256-u2JDoBxDdOIj7no+9Ym+JLwAQZxTKXmOjrRtaDlktuc=",
+      "x86_64-linux": "sha256-u2JDoBxDdOIj7no+9Ym+JLwAQZxTKXmOjrRtaDlktuc="
    }
  },
-  "dartVersion": "3.11.0-296.5.beta",
+  "dartVersion": "3.11.0",
  "dartHash": {
-    "x86_64-linux": "sha256-7EJPXQQrViX66lnpdqapSuTYrcT2uNwpqZClpjvNzRY=",
-    "aarch64-linux": "sha256-2xgSEH9HQj8oJNH8eNs0NYxK3UGGaVBWnyuDbdam7XQ=",
-    "x86_64-darwin": "sha256-cz7VM3lBWxnpFNaOI3ERZXVOgtEPVa6LVpvnvqFcw2M=",
-    "aarch64-darwin": "sha256-eSTSzsjaIQUoTHqdwc3ZVkSKcXeiz+MIc0fh2XW935Q="
+    "x86_64-linux": "sha256-8xcptWe+MYx8wjva/muamX+n3b+CnfUBbwZiJ7aqDJk=",
+    "aarch64-linux": "sha256-dr/vXICcCCF332xRu/SADY1NdV8ulvt1Fiv40rAy74M=",
+    "x86_64-darwin": "sha256-Wlwpx6g4EmkzKAEyaxHMrc8M/nMB7QGj8G6BdmvLjXQ=",
+    "aarch64-darwin": "sha256-IjJFpC6rG4EeUC4VYluGcHX/4BLenrU3Skzd4u4IdTQ="
  },
-  "flutterHash": "sha256-dCfrPq1oJOmDb3bP24D2rmDQzoB8uI3qJF2hqWmXywI=",
+  "flutterHash": "sha256-/rgmV0BMOF3Mlw/9DVEQkptDUXzJCNEYmQX+BIXlyxY=",
  "artifactHashes": {
    "android": {
-      "aarch64-darwin": "sha256-+HRucNf5J3fb1uVcYEte5zw4LcnfbmBL0kmeSQBHBlw=",
-      "aarch64-linux": "sha256-7t3r/mq8KnWEbY2CVCv7l2HAV2dncrJj18vb2QxTh+8=",
-      "x86_64-darwin": "sha256-+HRucNf5J3fb1uVcYEte5zw4LcnfbmBL0kmeSQBHBlw=",
-      "x86_64-linux": "sha256-7t3r/mq8KnWEbY2CVCv7l2HAV2dncrJj18vb2QxTh+8="
+      "aarch64-darwin": "sha256-9bjCiMYvcwMMWU8lJdJB+f2P0WxZzzjfs/pUD4qr74g=",
+      "aarch64-linux": "sha256-u8O8uDaGrmAPexC+TIq0/dlnt3+B5+RQNiyk2GnVWLM=",
+      "x86_64-darwin": "sha256-9bjCiMYvcwMMWU8lJdJB+f2P0WxZzzjfs/pUD4qr74g=",
+      "x86_64-linux": "sha256-u8O8uDaGrmAPexC+TIq0/dlnt3+B5+RQNiyk2GnVWLM="
    },
    "fuchsia": {
-      "aarch64-darwin": "sha256-8MjxukMuB31krOuTaQdFw3uy57bNg053xFgwVZUr9qg=",
-      "aarch64-linux": "sha256-8MjxukMuB31krOuTaQdFw3uy57bNg053xFgwVZUr9qg=",
-      "x86_64-darwin": "sha256-8MjxukMuB31krOuTaQdFw3uy57bNg053xFgwVZUr9qg=",
-      "x86_64-linux": "sha256-8MjxukMuB31krOuTaQdFw3uy57bNg053xFgwVZUr9qg="
+      "aarch64-darwin": "sha256-hFiXjW34BhtPsw5jC22SqDsfMQzuZVidci6a6b63L4o=",
+      "aarch64-linux": "sha256-hFiXjW34BhtPsw5jC22SqDsfMQzuZVidci6a6b63L4o=",
+      "x86_64-darwin": "sha256-hFiXjW34BhtPsw5jC22SqDsfMQzuZVidci6a6b63L4o=",
+      "x86_64-linux": "sha256-hFiXjW34BhtPsw5jC22SqDsfMQzuZVidci6a6b63L4o="
    },
    "ios": {
-      "aarch64-darwin": "sha256-2gOpJcPdzSY1q1SAs8oUJHkKTVQluFSrS3M4U3Mh9/o=",
-      "aarch64-linux": "sha256-2gOpJcPdzSY1q1SAs8oUJHkKTVQluFSrS3M4U3Mh9/o=",
-      "x86_64-darwin": "sha256-2gOpJcPdzSY1q1SAs8oUJHkKTVQluFSrS3M4U3Mh9/o=",
-      "x86_64-linux": "sha256-2gOpJcPdzSY1q1SAs8oUJHkKTVQluFSrS3M4U3Mh9/o="
+      "aarch64-darwin": "sha256-lPCidjKmqgotphFvjWUL2t3o6NBIFos1lfh958pCATQ=",
+      "aarch64-linux": "sha256-lPCidjKmqgotphFvjWUL2t3o6NBIFos1lfh958pCATQ=",
+      "x86_64-darwin": "sha256-lPCidjKmqgotphFvjWUL2t3o6NBIFos1lfh958pCATQ=",
+      "x86_64-linux": "sha256-lPCidjKmqgotphFvjWUL2t3o6NBIFos1lfh958pCATQ="
    },
    "linux": {
-      "aarch64-darwin": "sha256-NouPte/10GE7QctNlMpDXP/Yl3dDEjC52cf3Zd8Si40=",
-      "aarch64-linux": "sha256-NouPte/10GE7QctNlMpDXP/Yl3dDEjC52cf3Zd8Si40=",
-      "x86_64-darwin": "sha256-ELqekEn0ofBiDMh+cUXYhYTweu81k7Qc2f3WlO0fZzE=",
-      "x86_64-linux": "sha256-ELqekEn0ofBiDMh+cUXYhYTweu81k7Qc2f3WlO0fZzE="
+      "aarch64-darwin": "sha256-RwXbextfT+342Zg19z0k1EykHo6flPYPHuHE5czDs+4=",
+      "aarch64-linux": "sha256-RwXbextfT+342Zg19z0k1EykHo6flPYPHuHE5czDs+4=",
+      "x86_64-darwin": "sha256-J9cGfpF5LIjY17lVJlmlcyucLCpT49jt5P8jAWyeoiU=",
+      "x86_64-linux": "sha256-J9cGfpF5LIjY17lVJlmlcyucLCpT49jt5P8jAWyeoiU="
    },
    "macos": {
-      "aarch64-darwin": "sha256-Aj3FdXENj5fWleC/QaWQ5qWn+RNdFzq+lQoy3UgMF84=",
-      "aarch64-linux": "sha256-Aj3FdXENj5fWleC/QaWQ5qWn+RNdFzq+lQoy3UgMF84=",
-      "x86_64-darwin": "sha256-Aj3FdXENj5fWleC/QaWQ5qWn+RNdFzq+lQoy3UgMF84=",
-      "x86_64-linux": "sha256-Aj3FdXENj5fWleC/QaWQ5qWn+RNdFzq+lQoy3UgMF84="
+      "aarch64-darwin": "sha256-xHoNZrOn5yu734jDEE0RN+cNO/DCuiNqwlEG1br82fY=",
+      "aarch64-linux": "sha256-xHoNZrOn5yu734jDEE0RN+cNO/DCuiNqwlEG1br82fY=",
+      "x86_64-darwin": "sha256-xHoNZrOn5yu734jDEE0RN+cNO/DCuiNqwlEG1br82fY=",
+      "x86_64-linux": "sha256-xHoNZrOn5yu734jDEE0RN+cNO/DCuiNqwlEG1br82fY="
    },
    "universal": {
-      "aarch64-darwin": "sha256-ymXBamYKnmhcTwgc2rX/RgFdQml7obiYOpBh5ghKhlU=",
-      "aarch64-linux": "sha256-bULGcWqxjolrksGQYFXEx6zmlcDSD6ngw0L9kDoIVvY=",
-      "x86_64-darwin": "sha256-+erTasrFkQTXPQtuu8YzvfFspEVb0wIVX5jKPp9RXBE=",
-      "x86_64-linux": "sha256-8foy5AZZwTBPn2WrUiG8qgc+H/0bajCgSApJ/vIlVIw="
+      "aarch64-darwin": "sha256-OKUry7x+5lrGzElLnmltaIaLyq5tHtNR40z33FgL+Z0=",
+      "aarch64-linux": "sha256-ZqmkJ5KGnKU4FGAOBGTF7vU7XZ7UmgCML0Pdg0bXNn4=",
+      "x86_64-darwin": "sha256-orb4XUtX9Uq3Uq1xwoZAzrd+GgkOKGiOek3NEEDVQR4=",
+      "x86_64-linux": "sha256-uN/wDyFnMLxqEfFR2PWesRGnigbsnqzs+mPDxEMZ+1g="
    },
    "web": {
-      "aarch64-darwin": "sha256-jFESLAj61eOQJh++mycJWjO6pPe9Icjhpr8c9qiVmv0=",
-      "aarch64-linux": "sha256-jFESLAj61eOQJh++mycJWjO6pPe9Icjhpr8c9qiVmv0=",
-      "x86_64-darwin": "sha256-jFESLAj61eOQJh++mycJWjO6pPe9Icjhpr8c9qiVmv0=",
-      "x86_64-linux": "sha256-jFESLAj61eOQJh++mycJWjO6pPe9Icjhpr8c9qiVmv0="
+      "aarch64-darwin": "sha256-sQNM2Hx+NEMKtbCv2tX9kh45TB/NH9yaRm4eZqDfJQE=",
+      "aarch64-linux": "sha256-sQNM2Hx+NEMKtbCv2tX9kh45TB/NH9yaRm4eZqDfJQE=",
+      "x86_64-darwin": "sha256-sQNM2Hx+NEMKtbCv2tX9kh45TB/NH9yaRm4eZqDfJQE=",
+      "x86_64-linux": "sha256-sQNM2Hx+NEMKtbCv2tX9kh45TB/NH9yaRm4eZqDfJQE="
    },
    "windows": {
-      "x86_64-darwin": "sha256-J+N6ADOB3SF298uxN0hPydslw3k+5+nwHln2NwTQTgc=",
-      "x86_64-linux": "sha256-J+N6ADOB3SF298uxN0hPydslw3k+5+nwHln2NwTQTgc="
+      "x86_64-darwin": "sha256-YZ7HehFv90UHmv0hfcyv0YsQxsNRRzOitPdf5BqaJJM=",
+      "x86_64-linux": "sha256-YZ7HehFv90UHmv0hfcyv0YsQxsNRRzOitPdf5BqaJJM="
    }
  },
  "pubspecLock": {
@@ -1,6 +1,7 @@
 {
  stdenv,
  pkgs,
+  config,
  lib,
  fetchurl,
  gfortran,
@@ -207,6 +208,7 @@ stdenv.mkDerivation (finalAttrs: {
    octavePackages = import ../../../top-level/octave-packages.nix {
      pkgs = allPkgs;
      inherit
+        config
        lib
        stdenv
        fetchurl
@@ -44,6 +44,11 @@ stdenv.mkDerivation rec {
      url = "https://gitlab.gnome.org/GNOME/libsoup/-/commit/2316e56a5502ac4c41ef4ff56a3266e680aca129.patch";
      hash = "sha256-6TOM6sygVPpBWjTNgFG37JFbJDl0t2f9Iwidvh/isa4=";
    })
+    (fetchpatch {
+      name = "CVE-2025-11021.patch";
+      url = "https://gitlab.gnome.org/GNOME/libsoup/-/commit/9e1a427d2f047439d0320defe1593e6352595788.patch";
+      hash = "sha256-08WiDnqg4//y8uPhIcV6svWdpRo27FmW+6DHy4OEZk8=";
+    })
  ];

  depsBuildBuild = [
@@ -6,8 +6,6 @@
  ounit2,
  dune-configurator,
  eqaf,
-  withFreestanding ? false,
-  ocaml-freestanding,
 }:

 buildDunePackage (finalAttrs: {
@@ -30,9 +28,6 @@ buildDunePackage (finalAttrs: {
  buildInputs = [ dune-configurator ];
  propagatedBuildInputs = [
    eqaf
-  ]
-  ++ lib.optionals withFreestanding [
-    ocaml-freestanding
  ];

  meta = {
@@ -1,5 +1,4 @@
 {
-  lib,
  buildDunePackage,
  mirage-crypto,
  dune-configurator,
@@ -12,8 +11,6 @@
  ppx_deriving_yojson,
  ppx_deriving,
  yojson,
-  withFreestanding ? false,
-  ocaml-freestanding,
 }:

 buildDunePackage {
@@ -31,9 +28,6 @@ buildDunePackage {
  propagatedBuildInputs = [
    mirage-crypto
    mirage-crypto-rng
-  ]
-  ++ lib.optionals withFreestanding [
-    ocaml-freestanding
  ];

  doCheck = true;
@@ -1,49 +0,0 @@
-commit b273c9f7ab10475787db4d6e09bd4b71b374d0ec
-Author: sternenseemann <0rpkxez4ksa01gb3typccl0i@systemli.org>
-Date:   Thu Mar 18 01:28:46 2021 +0100
-
-    Let user specify solo5-binding to use
-    
-    This is a little feature for the configure script I wanted to have for
-    the NixOS package: It allows the user to set PKG_CONFIG_DEPS before
-    running configure.sh to disable the autodetection mechanism. This is
-    useful for NixOS as we have all bindings bundled in the solo5 package,
-    so the result would also be solo5-bindings-xen. Additionally, it allows
-    us to do the binding selection declaratively and minimize the risk of
-    accidentally switching backend.
-    
-    PKG_CONFIG_DEPS seems like a bit of an unappropriate variable name for a
-    user “interface”, let me know if you want a dedicated environment
-    variable for this in case there will be more PKG_CONFIG_DEPS.
-
-diff --git a/configure.sh b/configure.sh
-index c254f7b..c675a02 100755
--- a/configure.sh
-+++ b/configure.sh
-@@ -11,13 +11,19 @@ if pkg_exists solo5-bindings-hvt solo5-bindings-spt solo5-bindings-virtio solo5-
-     echo "ERROR: Only one of solo5-bindings-hvt, solo5-bindings-spt, solo5-bindings-virtio, solo5-bindings-muen, solo5-bindings-genode, solo5-bindings-xen can be installed." 1>&2
-     exit 1
- fi
-PKG_CONFIG_DEPS=
-pkg_exists solo5-bindings-hvt && PKG_CONFIG_DEPS=solo5-bindings-hvt
-pkg_exists solo5-bindings-spt && PKG_CONFIG_DEPS=solo5-bindings-spt
-pkg_exists solo5-bindings-muen && PKG_CONFIG_DEPS=solo5-bindings-muen
-pkg_exists solo5-bindings-virtio && PKG_CONFIG_DEPS=solo5-bindings-virtio
-pkg_exists solo5-bindings-genode && PKG_CONFIG_DEPS=solo5-bindings-genode
-pkg_exists solo5-bindings-xen && PKG_CONFIG_DEPS=solo5-bindings-xen
-+if [ -z "${PKG_CONFIG_DEPS}" ]; then
-+    PKG_CONFIG_DEPS=
-+    pkg_exists solo5-bindings-hvt && PKG_CONFIG_DEPS=solo5-bindings-hvt
-+    pkg_exists solo5-bindings-spt && PKG_CONFIG_DEPS=solo5-bindings-spt
-+    pkg_exists solo5-bindings-muen && PKG_CONFIG_DEPS=solo5-bindings-muen
-+    pkg_exists solo5-bindings-virtio && PKG_CONFIG_DEPS=solo5-bindings-virtio
-+    pkg_exists solo5-bindings-genode && PKG_CONFIG_DEPS=solo5-bindings-genode
-+    pkg_exists solo5-bindings-xen && PKG_CONFIG_DEPS=solo5-bindings-xen
-+else
-+    pkg_exists "${PKG_CONFIG_DEPS}" \
-+        || (echo "ERROR: ${PKG_CONFIG_DEPS} is not installed" 1>&2; exit 1) \
-+        || exit 1
-+fi
- if [ -z "${PKG_CONFIG_DEPS}" ]; then
-     echo "ERROR: No supported Solo5 bindings package found." 1>&2
-     echo "ERROR: solo5-bindings-hvt, solo5-bindings-spt, solo5-bindings-virtio, solo5-bindings-muen, solo5-bindings-genode or solo5-bindings-xen must be installed." 1>&2
@@ -1,93 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  ocaml,
-  pkg-config,
-  solo5,
-  target ? "xen",
-}:
-
-# note: this is not technically an ocaml-module,
-# but can be built with different compilers, so
-# the ocamlPackages set is very useful.
-
-let
-  pname = "ocaml-freestanding";
-in
-
-if lib.versionOlder ocaml.version "4.08" then
-  throw "${pname} is not available for OCaml ${ocaml.version}"
-else
-
-  stdenv.mkDerivation rec {
-    name = "ocaml${ocaml.version}-${pname}-${version}";
-    inherit pname;
-    version = "0.6.5";
-
-    src = fetchFromGitHub {
-      owner = "mirage";
-      repo = pname;
-      rev = "v${version}";
-      sha256 = "sha256:1mbyjzwcs64n7i3xkkyaxgl3r46drbl0gkqf3fqgm2kh3q03638l";
-    };
-
-    postUnpack = ''
-      # get ocaml-src from the ocaml drv instead of via ocamlfind
-      mkdir -p "${src.name}/ocaml"
-      tar --strip-components=1 -xf ${ocaml.src} -C "${src.name}/ocaml"
-    '';
-
-    patches = [
-      ./no-opam.patch
-      ./configurable-binding.patch
-    ];
-
-    strictDeps = true;
-
-    nativeBuildInputs = [
-      ocaml
-      pkg-config
-    ];
-
-    propagatedBuildInputs = [ solo5 ];
-
-    configurePhase = ''
-      runHook preConfigure
-      env PKG_CONFIG_DEPS=solo5-bindings-${target} sh configure.sh
-      runHook postConfigure
-    '';
-
-    installPhase = ''
-      runHook preInstall
-      ./install.sh "$out"
-      runHook postInstall
-    '';
-
-    meta = {
-      broken = true; # Not compatible with solo5 ≥ 0.7
-      description = "Freestanding OCaml runtime";
-      license = lib.licenses.mit;
-      maintainers = [ lib.maintainers.sternenseemann ];
-      homepage = "https://github.com/mirage/ocaml-freestanding";
-      platforms = map ({ arch, os }: "${arch}-${os}") (
-        lib.cartesianProduct {
-          arch = [
-            "aarch64"
-            "x86_64"
-          ];
-          os = [ "linux" ];
-        }
-        ++ [
-          {
-            arch = "x86_64";
-            os = "freebsd";
-          }
-          {
-            arch = "x86_64";
-            os = "openbsd";
-          }
-        ]
-      );
-    };
-  }
@@ -1,47 +0,0 @@
-commit 637b7ce639d54e617170433aa9596176b167d085
-Author: sternenseemann <0rpkxez4ksa01gb3typccl0i@systemli.org>
-Date:   Thu Mar 18 01:07:49 2021 +0100
-
-    Allow building without ocamlfind and opam
-    
-    This change is the result of my first go at packaging ocaml-freestanding
-    for NixOS. Our build infrastructure for ocaml there is completely
-    independent of opam at the moment, so depending on opam for the build
-    time is not an option, especially in this case where the information it
-    would give us would be garbage.
-    
-    Fortunately the build environment plays nicely with pkg-config which is
-    already heavily used by ocaml-freestanding. This patch leaves pkg-config
-    to its own devices if opam is not present (it can be assisted by a
-    manually set PKG_CONFIG_PATH environment variable).
-    
-    Additionally, in configure.sh we check if the target ocaml source
-    directory already exists. This allows for building ocaml-freestanding
-    without the ocaml-src package (which would be unnecessarily cumbersome
-    to package for NixOS) and ocamlfind (one less dependency is always a
-    nice bonus). The Makefile needs no fix since the target ocaml/Makefile
-    won't be built if it's already present.
-
-diff --git a/configure.sh b/configure.sh
-index 4d154ed..c254f7b 100755
--- a/configure.sh
-+++ b/configure.sh
-@@ -1,6 +1,8 @@
- #!/bin/sh
- 
-export PKG_CONFIG_PATH=$(opam config var prefix)/lib/pkgconfig
-+if command -v opam &> /dev/null; then
-+    export PKG_CONFIG_PATH=$(opam config var prefix)/lib/pkgconfig
-+fi
- pkg_exists() {
-     pkg-config --exists "$@"
- }
-@@ -21,7 +23,7 @@ if [ -z "${PKG_CONFIG_DEPS}" ]; then
-     echo "ERROR: solo5-bindings-hvt, solo5-bindings-spt, solo5-bindings-virtio, solo5-bindings-muen, solo5-bindings-genode or solo5-bindings-xen must be installed." 1>&2
-     exit 1
- fi
-ocamlfind query ocaml-src >/dev/null || exit 1
-+[ -e "$(dirname "$0")/ocaml" ] || ocamlfind query ocaml-src >/dev/null || exit 1
- 
- FREESTANDING_CFLAGS="$(pkg-config --cflags ${PKG_CONFIG_DEPS})"
- BUILD_ARCH="$(uname -m)"
@@ -26,8 +26,6 @@
  ipaddr-cstruct,
  lru,
  metrics,
-  withFreestanding ? false,
-  ocaml-freestanding,
 }:

 buildDunePackage rec {
@@ -64,9 +62,6 @@ buildDunePackage rec {
    metrics
    arp
    mirage-flow
-  ]
-  ++ lib.optionals withFreestanding [
-    ocaml-freestanding
  ];

  doCheck = true;
@@ -1,70 +0,0 @@
-{
-  lib,
-  stdenv,
-  buildDunePackage,
-  fetchFromGitHub,
-  fetchpatch,
-  cmdliner,
-  ctypes,
-  ctypes-foreign,
-  dune-configurator,
-  npy,
-  ocaml-compiler-libs,
-  ppx_custom_printf,
-  ppx_expect,
-  ppx_sexp_conv,
-  sexplib,
-  stdio,
-  torch,
-}:
-
-buildDunePackage rec {
-  pname = "torch";
-  version = "0.17";
-
-  minimalOCamlVersion = "4.08";
-
-  src = fetchFromGitHub {
-    owner = "LaurentMazare";
-    repo = "ocaml-${pname}";
-    rev = version;
-    hash = "sha256-z/9NUBjeFWE63Z/e8OyzDiy8hrn6qzjaiBH8G9MPeos=";
-  };
-
-  patches = [
-    # Pytorch 2.0 support. Drop when it reaches a release
-    (fetchpatch {
-      url = "https://github.com/LaurentMazare/ocaml-torch/commit/ef7ef30cafecb09e45ec1ed8ce4bedae5947cfa5.patch";
-      hash = "sha256-smdwKy40iIISp/25L2J4az6KmqFS1soeChBElUyhl5A=";
-    })
-  ];
-
-  buildInputs = [ dune-configurator ];
-
-  propagatedBuildInputs = [
-    cmdliner
-    ctypes
-    ctypes-foreign
-    npy
-    ocaml-compiler-libs
-    ppx_custom_printf
-    ppx_expect
-    ppx_sexp_conv
-    sexplib
-    stdio
-    torch
-    torch.dev
-  ];
-
-  preBuild = "export LIBTORCH=${torch.dev}/";
-
-  doCheck = !stdenv.hostPlatform.isAarch64;
-
-  meta = {
-    inherit (src.meta) homepage;
-    description = "Ocaml bindings to Pytorch";
-    maintainers = [ lib.maintainers.bcdarwin ];
-    license = lib.licenses.asl20;
-    broken = true; # Not compatible with libtorch ≥ 2.3.0
-  };
-}
@@ -1,36 +0,0 @@
-{
-  buildOctavePackage,
-  lib,
-  fetchurl,
-  dolfin,
-  ffc,
-  pkg-config,
-}:
-
-buildOctavePackage rec {
-  pname = "fem-fenics";
-  version = "0.0.5";
-
-  src = fetchurl {
-    url = "mirror://sourceforge/octave/${pname}-${version}.tar.gz";
-    sha256 = "1xd80nnkschldvrqx0wvrg3fzbf8sck8bvq24phr5x49xs7b8x78";
-  };
-
-  nativeBuildInputs = [
-    pkg-config
-  ];
-
-  propagatedBuildInputs = [
-    dolfin
-    ffc
-  ];
-
-  meta = {
-    homepage = "https://gnu-octave.github.io/packages/fem-fenics/";
-    license = lib.licenses.gpl3Plus;
-    maintainers = with lib.maintainers; [ KarlJoad ];
-    description = "Package for the resolution of partial differential equations based on fenics";
-    # Lots of compilation errors for newer octave versions and syntax errors
-    broken = true;
-  };
-}
@@ -1,57 +0,0 @@
-{
-  buildOctavePackage,
-  lib,
-  fetchgit,
-  automake,
-  autoconf,
-  autoconf-archive,
-  parallel,
-}:
-
-buildOctavePackage rec {
-  pname = "level-set";
-  version = "2019-04-13";
-
-  src = fetchgit {
-    url = "https://git.code.sf.net/p/octave/${pname}";
-    rev = "dbf46228a7582eef4fe5470fd00bc5b421dd33a5";
-    sha256 = "14qwa4j24m2j7njw8gbagkgmp040h6k0h7kyrrzgb9y0jm087qkl";
-    fetchSubmodules = false;
-  };
-
-  # The monstrosity of a regex below is to ensure that only error() calls are
-  # corrected to have a %s format specifier. However, logic_error() also
-  # exists, (a simple regex also matches that), but logic_error() doesn't
-  # require a format specifier. So, this regex was born to handle that...
-  postPatch = ''
-    substituteInPlace build.sh --replace "level-set-0.3.1" "${pname}-${version}" \
-                               --replace "\`pwd\`" '/build'
-    sed -i -E 's#[^[:graph:]]error \(# error \(\"%s\", #g' src/*.cpp
-  '';
-
-  nativeBuildInputs = [
-    automake
-    autoconf
-    autoconf-archive
-  ];
-
-  requiredOctavePackages = [
-    parallel
-  ];
-
-  preBuild = ''
-    mkdir -p $out
-    source ./build.sh
-    cd -
-  '';
-
-  meta = {
-    name = "Level Set";
-    homepage = "https://gnu-octave.github.io/packages/level-set/";
-    license = lib.licenses.gpl3Plus;
-    maintainers = with lib.maintainers; [ KarlJoad ];
-    description = "Routines for calculating the time-evolution of the level-set equation and extracting geometric information from the level-set function";
-    # Got broke with octave 8.x update, and wasn't updated since 2019
-    broken = true;
-  };
-}
@@ -1,43 +0,0 @@
-{
-  buildOctavePackage,
-  lib,
-  fetchurl,
-  struct,
-  gnutls,
-  pkg-config,
-}:
-
-buildOctavePackage rec {
-  pname = "parallel";
-  version = "4.0.1";
-
-  src = fetchurl {
-    url = "mirror://sourceforge/octave/${pname}-${version}.tar.gz";
-    sha256 = "1h8vw2r42393px6dk10y3lhpxl168r9d197f9whz6lbk2rg571pa";
-  };
-  patches = [
-    ../database/c_verror.patch
-  ];
-
-  nativeBuildInputs = [
-    pkg-config
-  ];
-
-  buildInputs = [
-    gnutls
-  ];
-
-  requiredOctavePackages = [
-    struct
-  ];
-
-  meta = {
-    homepage = "https://gnu-octave.github.io/packages/parallel/";
-    license = lib.licenses.gpl3Plus;
-    maintainers = with lib.maintainers; [ KarlJoad ];
-    description = "Parallel execution package";
-    # Although upstream has added an identical patch to that of ../database, it
-    # still won't build with octave>8.1
-    broken = true;
-  };
-}
@@ -1,29 +0,0 @@
-{
-  buildOctavePackage,
-  lib,
-  fetchurl,
-  librsb,
-}:
-
-buildOctavePackage rec {
-  pname = "sparsersb";
-  version = "1.0.9";
-
-  src = fetchurl {
-    url = "mirror://sourceforge/octave/${pname}-${version}.tar.gz";
-    sha256 = "0jyy2m7wylzyjqj9n6mjizhj0ccq8xnxm2g6pdlrmncxq1401khd";
-  };
-
-  propagatedBuildInputs = [
-    librsb
-  ];
-
-  meta = {
-    homepage = "https://gnu-octave.github.io/packages/sparsersb/";
-    license = lib.licenses.gpl3Plus;
-    maintainers = with lib.maintainers; [ KarlJoad ];
-    description = "Interface to the librsb package implementing the RSB sparse matrix format for fast shared-memory sparse matrix computations";
-    # Broken since octave>8.x
-    broken = true;
-  };
-}
@@ -1,36 +0,0 @@
-{
-  buildOctavePackage,
-  lib,
-  fetchurl,
-  # Octave dependencies
-  signal, # >= 1.3.0
-  # Build dependencies
-  gfortran,
-}:
-
-buildOctavePackage rec {
-  pname = "tisean";
-  version = "0.2.3";
-
-  src = fetchurl {
-    url = "mirror://sourceforge/octave/${pname}-${version}.tar.gz";
-    sha256 = "0nc2d9h91glxzmpizxdrc2dablw4bqhqhzs37a394c36myk4xjdv";
-  };
-
-  nativeBuildInputs = [
-    gfortran
-  ];
-
-  requiredOctavePackages = [
-    signal
-  ];
-
-  meta = {
-    homepage = "https://gnu-octave.github.io/packages/tisean/";
-    license = lib.licenses.gpl3Plus;
-    maintainers = with lib.maintainers; [ KarlJoad ];
-    description = "Port of TISEAN 3.0.1";
-    # Broken since octave 8.x update, and wasn't updated since 2021
-    broken = true;
-  };
-}
@@ -1,43 +0,0 @@
-{
-  buildOctavePackage,
-  lib,
-  fetchurl,
-  vibes,
-}:
-
-buildOctavePackage rec {
-  pname = "vibes";
-  version = "0.2.0";
-
-  src = fetchurl {
-    url = "mirror://sourceforge/octave/${pname}-${version}.tar.gz";
-    sha256 = "1zn86rcsjkqg67hphz5inxc5xkgr18sby8za68zhppc2z7pd91ng";
-  };
-
-  buildInputs = [
-    vibes
-  ];
-
-  meta = {
-    homepage = "https://gnu-octave.github.io/packages/vibes/";
-    license = with lib.licenses; [
-      gpl3Plus
-      mit
-    ];
-    maintainers = with lib.maintainers; [ KarlJoad ];
-    description = "Easily display results (boxes, pavings) from interval methods";
-    longDescription = ''
-      The VIBes API allows one to easily display results (boxes, pavings) from
-      interval methods. VIBes consists in two parts: (1) the VIBes application
-      that features viewing, annotating and exporting figures, and (2) the
-      VIBes API that enables your program to communicate with the viewer in order
-      to draw figures. This package integrates the VIBes API into Octave. The
-      VIBes application is required for operation and must be installed
-      separately. Data types from third-party interval arithmetic libraries for
-      Octave are also supported.
-    '';
-    # Marked this way until KarlJoad gets around to packaging the vibes program.
-    # https://github.com/ENSTABretagneRobotics/VIBES
-    broken = true;
-  };
-}
@@ -1,45 +0,0 @@
-{
-  buildOctavePackage,
-  lib,
-  fetchurl,
-  # Octave dependencies
-  linear-algebra,
-  miscellaneous,
-  struct,
-  statistics,
-  # Runtime dependencies
-  freewrl,
-}:
-
-buildOctavePackage rec {
-  pname = "vrml";
-  version = "1.0.14";
-
-  src = fetchurl {
-    url = "mirror://sourceforge/octave/${pname}-${version}.tar.gz";
-    sha256 = "sha256-Vfj0Q2CyOi7CrphZSl10Xv7QxTSvWdGk0Ya+SiewqV4=";
-  };
-
-  propagatedBuildInputs = [
-    freewrl
-  ];
-
-  requiredOctavePackages = [
-    linear-algebra
-    miscellaneous
-    struct
-    statistics
-  ];
-
-  meta = {
-    homepage = "https://gnu-octave.github.io/packages/vrml/";
-    license = with lib.licenses; [
-      gpl3Plus
-      fdl12Plus
-    ];
-    maintainers = with lib.maintainers; [ KarlJoad ];
-    description = "3D graphics using VRML";
-    # Marked this way until KarlJoad gets freewrl as a runtime dependency.
-    broken = true;
-  };
-}
@@ -16,7 +16,7 @@

 buildPythonPackage (finalAttrs: {
  pname = "homematicip";
-  version = "2.5.0";
+  version = "2.6.0";
  pyproject = true;

  disabled = pythonOlder "3.12";
@@ -25,7 +25,7 @@ buildPythonPackage (finalAttrs: {
    owner = "hahn-th";
    repo = "homematicip-rest-api";
    tag = finalAttrs.version;
-    hash = "sha256-UdVOYJyWLtqJaZgiRa3M9JL+gPzZeecZwElBXqrAdFM=";
+    hash = "sha256-0i3sXtwEBd9rXOEcoL7E3pCwviCcMcIQcTFFLSV3s+0=";
  };

  build-system = [
@@ -51,14 +51,14 @@

 buildPythonPackage rec {
  pname = "openai";
-  version = "2.15.0";
+  version = "2.18.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "openai";
    repo = "openai-python";
    tag = "v${version}";
-    hash = "sha256-FmOmWtkp+Pe3pICi0uvzsb1nsP4M4yc/34U3Bd2q/KE=";
+    hash = "sha256-38CX7KFhjq8e6Y/65qy24/zi4cI6HjJYwUTaMfiowUg=";
  };

  postPatch = ''substituteInPlace pyproject.toml --replace-fail "hatchling==1.26.3" "hatchling"'';
@@ -28,14 +28,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "sagemaker-core";
-  version = "1.0.75";
+  version = "1.0.76";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "aws";
    repo = "sagemaker-core";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-yRXnXGH4BoURohty/daPYd6FDGsAk9a1AiXtyCkKxug=";
+    hash = "sha256-IAgHAmmN00nyE1rcPV09DMb/LFCZnwrD0OhXTeNuTik=";
  };

  build-system = [
@@ -23,9 +23,9 @@ let
    };
    # ./update-zen.py lqx
    lqx = {
-      version = "6.18.8"; # lqx
+      version = "6.18.9"; # lqx
      suffix = "lqx1"; # lqx
-      sha256 = "1fdrsq4rbr4l90qzj0qdh55n9y8859v6ixdp9bdms123l8f4iqr3"; # lqx
+      sha256 = "014kixm8p8xfpwsf6bk21dypknv29h5qac79n306z56mg3q79qhd"; # lqx
      isLqx = true;
    };
  };
@@ -887,6 +887,7 @@ mapAliases {
  hspellDicts = throw "'hspellDicts' has been removed due to being broken for more than a year; see RFC 180"; # Added 2026-02-05
  http-prompt = throw "'http-prompt' has been removed as it was broken and unmaintained upstream"; # Added 2025-11-26
  hydra_unstable = throw "'hydra_unstable' has been renamed to/replaced by 'hydra'"; # Converted to throw 2025-10-27
+  hydraAntLogger = warnAlias "'hydraAntLogger' has been renamed to 'hydra-ant-logger'" hydra-ant-logger; # Added 2026-02-08
  i3-gaps = throw "'i3-gaps' has been renamed to/replaced by 'i3'"; # Converted to throw 2025-10-27
  i3lock-pixeled = throw "'i3lock-pixeled' has been unmaintained for several years now."; # Converted to throw 2026-01-24
  ibm-sw-tpm2 = throw "ibm-sw-tpm2 has been removed, as it was broken"; # Added 2025-08-25
@@ -901,7 +902,6 @@ mapAliases {
  inotifyTools = throw "'inotifyTools' has been renamed to/replaced by 'inotify-tools'"; # Converted to throw 2025-10-27
  insync-emblem-icons = throw "'insync-emblem-icons' has been removed, use 'insync-nautilus' instead"; # Added 2025-05-14
  invalidateFetcherByDrvHash = throw "'invalidateFetcherByDrvHash' has been renamed to/replaced by 'testers.invalidateFetcherByDrvHash'"; # Converted to throw 2025-10-27
-  invoiceplane = throw "'invoiceplane' doesn't support non-EOL PHP versions"; # Added 2025-10-03
  ioccheck = throw "ioccheck was dropped since it was unmaintained."; # Added 2025-07-06
  ipfs = throw "'ipfs' has been renamed to/replaced by 'kubo'"; # Converted to throw 2025-10-27
  ipfs-migrator = throw "'ipfs-migrator' has been renamed to/replaced by 'kubo-migrator'"; # Converted to throw 2025-10-27
@@ -1445,8 +1445,6 @@ let

        ocaml_expat = callPackage ../development/ocaml-modules/expat { };

-        ocaml-freestanding = callPackage ../development/ocaml-modules/ocaml-freestanding { };
-
        ocaml_gettext = callPackage ../development/ocaml-modules/ocaml-gettext { };

        ocaml_libvirt = callPackage ../development/ocaml-modules/ocaml-libvirt { };
@@ -2128,10 +2126,6 @@ let

        topkg = callPackage ../development/ocaml-modules/topkg { };

-        torch = callPackage ../development/ocaml-modules/torch {
-          torch = pkgs.libtorch-bin;
-        };
-
        trace = callPackage ../development/ocaml-modules/trace { };

        trace-tef = callPackage ../development/ocaml-modules/trace/tef.nix { };
@@ -2336,8 +2330,10 @@ let
        dune_2 = pkgs.dune_2; # Added 2025-12-08
        dune_3 = pkgs.dune_3; # Added 2025-12-08
        gd4o = throw "ocamlPackages.gd4o is not maintained, use ocamlPackages.gd instead";
+        ocaml-freestanding = throw "ocamlPackages.ocaml-freestanding has been removed due to being broken for more than a year; see RFC 180"; # Added 2026-02-05
        ocaml-vdom = throw "2023-10-09: ocamlPackages.ocaml-vdom was renamed to ocamlPackages.vdom";
        ocaml_lwt = throw "ocamlPackages.ocaml_lwt has been renamed to ocamlPackages.lwt"; # Added 2025-12-05
+        torch = throw "ocamlPackages.torch has been removed due to being broken for more than a year; see RFC 180"; # Added 2026-02-05
      }
    )).overrideScope
      liftJaneStreet;
@@ -13,6 +13,7 @@
 # from outside, we can `inherit` them from `pkgs`.
 {
  pkgs,
+  config,
  lib,
  stdenv,
  fetchurl,
@@ -91,12 +92,6 @@ makeScope newScope (

    econometrics = callPackage ../development/octave-modules/econometrics { };

-    fem-fenics = callPackage ../development/octave-modules/fem-fenics {
-      # PLACEHOLDER until KarlJoad gets dolfin packaged.
-      dolfin = null;
-      ffc = null;
-    };
-
    fits = callPackage ../development/octave-modules/fits { };

    financial = callPackage ../development/octave-modules/financial { };
@@ -131,8 +126,6 @@ makeScope newScope (

    interval = callPackage ../development/octave-modules/interval { };

-    level-set = callPackage ../development/octave-modules/level-set { };
-
    linear-algebra = callPackage ../development/octave-modules/linear-algebra { };

    lssa = callPackage ../development/octave-modules/lssa { };
@@ -182,8 +175,6 @@ makeScope newScope (

    optiminterp = callPackage ../development/octave-modules/optiminterp { };

-    parallel = callPackage ../development/octave-modules/parallel { };
-
    quaternion = callPackage ../development/octave-modules/quaternion { };

    queueing = callPackage ../development/octave-modules/queueing { };
@@ -192,8 +183,6 @@ makeScope newScope (

    sockets = callPackage ../development/octave-modules/sockets { };

-    sparsersb = callPackage ../development/octave-modules/sparsersb { };
-
    stk = callPackage ../development/octave-modules/stk { };

    splines = callPackage ../development/octave-modules/splines { };
@@ -208,22 +197,10 @@ makeScope newScope (
      inherit (octave) python;
    };

-    tisean = callPackage ../development/octave-modules/tisean { };
-
    tsa = callPackage ../development/octave-modules/tsa { };

-    vibes = callPackage ../development/octave-modules/vibes {
-      vibes = null;
-      # TODO: Need to package vibes:
-      # https://github.com/ENSTABretagneRobotics/VIBES
-    };
-
    video = callPackage ../development/octave-modules/video { };

-    vrml = callPackage ../development/octave-modules/vrml {
-      freewrl = null;
-    };
-
    windows = callPackage ../development/octave-modules/windows { };

    zeromq = callPackage ../development/octave-modules/zeromq {
@@ -231,4 +208,13 @@ makeScope newScope (
    };

  }
+  // lib.optionalAttrs config.allowAliases {
+    fem-fenics = throw "octavePackages.fem-fenics has been removed due to being broken for more than a year; see RFC 180"; # Added 2026-02-05
+    level-set = throw "octavePackages.level-set has been removed due to being broken for more than a year; see RFC 180"; # Added 2026-02-05
+    parallel = throw "octavePackages.parallel has been removed due to being broken for more than a year; see RFC 180"; # Added 2026-02-05
+    sparsersb = throw "octavePackages.sparsersb has been removed due to being broken for more than a year; see RFC 180"; # Added 2026-02-05
+    tisean = throw "octavePackages.tisean has been removed due to being broken for more than a year; see RFC 180"; # Added 2026-02-05
+    vibes = throw "octavePackages.vibes has been removed due to being broken for more than a year; see RFC 180"; # Added 2026-02-05
+    vrml = throw "octavePackages.vrml has been removed due to being broken for more than a year; see RFC 180"; # Added 2026-02-05
+  }
 )