Merge staging-next into staging

2026-04-29 00:38:17 +00:00
parent 08dfe0c627 96694b91df
commit 8286387431
157 changed files with 1630 additions and 1761 deletions
@@ -7259,12 +7259,6 @@
    githubId = 187309685;
    name = "Drew Council";
  };
-  dritter = {
-    email = "dritter03@googlemail.com";
-    github = "dritter";
-    githubId = 1544760;
-    name = "Dominik Ritter";
-  };
  drperceptron = {
    github = "drperceptron";
    githubId = 92106371;
@@ -231,6 +231,72 @@ with lib;
        || partitionTableType == "legacy+gpt";
      hasBootPartition = partitionTableType == "efi" || partitionTableType == "hybrid";
      hasNoFsPartition = partitionTableType == "hybrid" || partitionTableType == "legacy+gpt";
+      postVM =
+        let
+          # Build qemu with PVE's patch that adds support for the VMA format
+          vma =
+            (pkgs.qemu_kvm.override {
+              alsaSupport = false;
+              pulseSupport = false;
+              sdlSupport = false;
+              jackSupport = false;
+              gtkSupport = false;
+              vncSupport = false;
+              smartcardSupport = false;
+              spiceSupport = false;
+              ncursesSupport = false;
+              libiscsiSupport = false;
+              tpmSupport = false;
+              numaSupport = false;
+              seccompSupport = false;
+              guestAgentSupport = false;
+            }).overrideAttrs
+              (super: rec {
+                # Check https://github.com/proxmox/pve-qemu/tree/master for the version
+                # of qemu and patch to use
+                version = "9.0.0";
+                src = pkgs.fetchurl {
+                  url = "https://download.qemu.org/qemu-${version}.tar.xz";
+                  hash = "sha256-MnCKxmww2MiSYz6paMdxwcdtWX1w3erSGg0izPOG2mk=";
+                };
+                patches = [
+                  # Proxmox' VMA tool is published as a particular patch upon QEMU
+                  "${
+                    pkgs.fetchFromGitHub {
+                      owner = "proxmox";
+                      repo = "pve-qemu";
+                      rev = "14afbdd55f04d250bd679ca1ad55d3f47cd9d4c8";
+                      hash = "sha256-lSJQA5SHIHfxJvMLIID2drv2H43crTPMNIlIT37w9Nc=";
+                    }
+                  }/debian/patches/pve/0027-PVE-Backup-add-vma-backup-format-code.patch"
+                ];
+
+                buildInputs = super.buildInputs ++ [ pkgs.libuuid ];
+                nativeBuildInputs = super.nativeBuildInputs ++ [ pkgs.perl ];
+
+              });
+        in
+        ''
+          ${vma}/bin/vma create "${config.image.baseName}.vma" \
+            -c ${
+              cfgFile "qemu-server.conf" (cfg.qemuConf // cfg.qemuExtraConf)
+            }/qemu-server.conf drive-virtio0=$diskImage
+          rm $diskImage
+          ${pkgs.zstd}/bin/zstd "${config.image.baseName}.vma"
+          mv "${config.image.fileName}" $out/
+
+          mkdir -p $out/nix-support
+          echo "file vma $out/${config.image.fileName}" > $out/nix-support/hydra-build-products
+        '';
+      pveBaseConfigs = {
+        name = config.image.baseName;
+        baseName = config.image.baseName;
+        inherit (cfg) partitionTableType;
+        inherit (cfg.qemuConf) additionalSpace bootSize;
+        inherit (config.virtualisation) diskSize;
+        format = "raw";
+        inherit config lib pkgs;
+      };
    in
    {
      assertions = [
@@ -253,72 +319,15 @@ with lib;
      ];
      image.baseName = lib.mkDefault "vzdump-qemu-${cfg.filenameSuffix}";
      image.extension = "vma.zst";
-      system.build.image = config.system.build.VMA;
-      system.build.VMA = import ../../lib/make-disk-image.nix {
-        name = "proxmox-${cfg.filenameSuffix}";
-        baseName = config.image.baseName;
-        inherit (cfg) partitionTableType;
-        postVM =
-          let
-            # Build qemu with PVE's patch that adds support for the VMA format
-            vma =
-              (pkgs.qemu_kvm.override {
-                alsaSupport = false;
-                pulseSupport = false;
-                sdlSupport = false;
-                jackSupport = false;
-                gtkSupport = false;
-                vncSupport = false;
-                smartcardSupport = false;
-                spiceSupport = false;
-                ncursesSupport = false;
-                libiscsiSupport = false;
-                tpmSupport = false;
-                numaSupport = false;
-                seccompSupport = false;
-                guestAgentSupport = false;
-              }).overrideAttrs
-                (super: rec {
-                  # Check https://github.com/proxmox/pve-qemu/tree/master for the version
-                  # of qemu and patch to use
-                  version = "9.0.0";
-                  src = pkgs.fetchurl {
-                    url = "https://download.qemu.org/qemu-${version}.tar.xz";
-                    hash = "sha256-MnCKxmww2MiSYz6paMdxwcdtWX1w3erSGg0izPOG2mk=";
-                  };
-                  patches = [
-                    # Proxmox' VMA tool is published as a particular patch upon QEMU
-                    "${
-                      pkgs.fetchFromGitHub {
-                        owner = "proxmox";
-                        repo = "pve-qemu";
-                        rev = "14afbdd55f04d250bd679ca1ad55d3f47cd9d4c8";
-                        hash = "sha256-lSJQA5SHIHfxJvMLIID2drv2H43crTPMNIlIT37w9Nc=";
-                      }
-                    }/debian/patches/pve/0027-PVE-Backup-add-vma-backup-format-code.patch"
-                  ];
-
-                  buildInputs = super.buildInputs ++ [ pkgs.libuuid ];
-                  nativeBuildInputs = super.nativeBuildInputs ++ [ pkgs.perl ];
-
-                });
-          in
-          ''
-            ${vma}/bin/vma create "${config.image.baseName}.vma" \
-              -c ${
-                cfgFile "qemu-server.conf" (cfg.qemuConf // cfg.qemuExtraConf)
-              }/qemu-server.conf drive-virtio0=$diskImage
-            rm $diskImage
-            ${pkgs.zstd}/bin/zstd "${config.image.baseName}.vma"
-            mv "${config.image.fileName}" $out/
-
-            mkdir -p $out/nix-support
-            echo "file vma $out/${config.image.fileName}" > $out/nix-support/hydra-build-products
-          '';
-        inherit (cfg.qemuConf) additionalSpace bootSize;
-        inherit (config.virtualisation) diskSize;
-        format = "raw";
-        inherit config lib pkgs;
+      system.build = {
+        cloudImage = import ../../lib/make-disk-image.nix pveBaseConfigs;
+        VMA = import ../../lib/make-disk-image.nix (
+          pveBaseConfigs
+          // {
+            inherit postVM;
+          }
+        );
+        image = config.system.build.VMA;
      };

      boot = {
@@ -307,7 +307,7 @@ rec {
  );

  # KVM image for proxmox in VMA format
-  proxmoxImage = forMatchingSystems [ "x86_64-linux" ] (
+  proxmoxVMA = forMatchingSystems [ "x86_64-linux" ] (
    system:
    with import ./.. { inherit system; };

@@ -321,6 +321,25 @@ rec {
    )
  );

+  # Keeping the old name for compatibility
+  proxmoxImage = proxmoxVMA;
+
+  # cloud-init image compatible with instructions given here:
+  # https://pve.proxmox.com/wiki/Cloud-Init_Support
+  proxmoxCloudImage = forMatchingSystems [ "x86_64-linux" ] (
+    system:
+    with import ./.. { inherit system; };
+
+    hydraJob (
+      (import lib/eval-config.nix {
+        inherit system;
+        modules = [
+          ./modules/virtualisation/proxmox-image.nix
+        ];
+      }).config.system.build.cloudImage
+    )
+  );
+
  # LXC tarball for proxmox
  proxmoxLXC = forMatchingSystems [ "x86_64-linux" ] (
    system:
@@ -54,10 +54,7 @@ mkJetBrainsProduct {
    homepage = "https://www.jetbrains.com/phpstorm/";
    description = "PHP IDE from JetBrains";
    longDescription = "PhpStorm provides an editor for PHP, HTML and JavaScript with on-the-fly code analysis, error prevention and automated refactorings for PHP and JavaScript code.";
-    maintainers = with lib.maintainers; [
-      dritter
-      tymscar
-    ];
+    maintainers = with lib.maintainers; [ tymscar ];
    license = lib.licenses.unfree;
    sourceProvenance =
      if stdenv.hostPlatform.isDarwin then
@@ -291,8 +291,8 @@ let
        mktplcRef = {
          publisher = "antfu";
          name = "slidev";
-          version = "52.14.2";
-          hash = "sha256-Y9vAbdklsnWgLjEV6sLpWiJaKf8AOES0qgM/Hx+4UE4=";
+          version = "52.15.0";
+          hash = "sha256-iCOLP2ZOm/kwmNFrmc9NJi1nU+301y2Jgnj9FbUSbm0=";
        };
        meta = {
          license = lib.licenses.mit;
@@ -1760,8 +1760,8 @@ let
        mktplcRef = {
          name = "foam-vscode";
          publisher = "foam";
-          version = "0.38.0";
-          hash = "sha256-SJozi2AlV+wHD0wuhpgkG6Ve5AGIhsVDC37eE8/bnKM=";
+          version = "0.39.0";
+          hash = "sha256-kOzr8YjwHdA3Tgo4JeEAWda4tBrXjMQNBITNhmy9cP4=";
        };
        meta = {
          changelog = "https://marketplace.visualstudio.com/items/foam.foam-vscode/changelog";
@@ -3799,8 +3799,8 @@ let
        mktplcRef = {
          name = "prisma";
          publisher = "Prisma";
-          version = "31.9.0";
-          hash = "sha256-ubUVFFfjrtoz+hI8/epCcbrU4WfQdVYy4dPHighFpK0=";
+          version = "31.10.0";
+          hash = "sha256-2KJdvzIKrNcFwxvTmXKl3z7AkClfJhyl0ZUmdUcMnzg=";
        };
        meta = {
          changelog = "https://marketplace.visualstudio.com/items/Prisma.prisma/changelog";
@@ -5240,8 +5240,8 @@ let
        mktplcRef = {
          name = "csharp-ls";
          publisher = "vytautassurvila";
-          version = "0.0.31";
-          hash = "sha256-d2vHhM+/hzT/JdFzu2WtJiWY2BHGk8SicleHxwm8ciY=";
+          version = "0.0.32";
+          hash = "sha256-dc7aIUb+5fdmqVeHrysy8jjk0Sx6ThIsO9KagdQpx+M=";
        };
        meta = {
          changelog = "https://github.com/vytautassurvila/vscode-csharp-ls/blob/master/CHANGELOG.md";
@@ -25,7 +25,6 @@ vscode-utils.buildVscodeMarketplaceExtension {
  '';

  meta = {
-    changelog = "https://marketplace.visualstudio.com/items/gplane.wasm-language-tools/changelog";
    description = "Language support of WebAssembly";
    downloadPage = "https://marketplace.visualstudio.com/items?itemName=gplane.wasm-language-tools";
    homepage = "https://github.com/g-plane/vscode-wasm";
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "mednafen-lynx";
-  version = "0-unstable-2026-03-31";
+  version = "0-unstable-2026-04-20";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "beetle-lynx-libretro";
-    rev = "40226b7b4fdd2604aa817fb7ded895b665282e25";
-    hash = "sha256-HjqNFfx4e1+DPq05Ii3scNocMn2FLA/LcI1vfT3TUes=";
+    rev = "fcdefcfb3c11d6d2e71be076a5d3df2e88ab73ed";
+    hash = "sha256-yucZWgJiqlfsgd/gQSPxSdZjt+9UfJe1Jq4vMLypDhg=";
  };

  makefile = "Makefile";
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "mednafen-vb";
-  version = "0-unstable-2026-03-31";
+  version = "0-unstable-2026-04-20";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "beetle-vb-libretro";
-    rev = "734205c5ead87a89cd1d53fe086f8f8fe660cf1d";
-    hash = "sha256-32l0CZmP1n/HGuTheaBIWoNuMWw/wMdiN9z4F5fhawI=";
+    rev = "1275bd7bddf2166be5a10e45c26c5c2a61370658";
+    hash = "sha256-3JTcAITogWP9yQ4sLZl8YlUHzu9LvWor9liQRIwf2b8=";
  };

  makefile = "Makefile";
@@ -1,15 +1,15 @@
 {
  "chromium": {
-    "version": "147.0.7727.116",
+    "version": "147.0.7727.137",
    "chromedriver": {
-      "version": "147.0.7727.117",
-      "hash_darwin": "sha256-FiP2cEz2DVnpZpqC4mrIPKeyP45nEvGhwuokfz/KUCQ=",
-      "hash_darwin_aarch64": "sha256-RckHAtsSLwh2IfT4Re/3pkUxvL8PwzfG8OtUHF1G0lU="
+      "version": "147.0.7727.138",
+      "hash_darwin": "sha256-d2dEPcR2mlfkL6XGhzMsgH/OwAI+yLXdS0dF4luPRfM=",
+      "hash_darwin_aarch64": "sha256-6rguKqpJJd058DQbiLVKVd/t+E7yYe1FHHB6zlwD6bU="
    },
    "deps": {
      "depot_tools": {
-        "rev": "f16c2eb7bfe77c7354a75ac2460bdd18ac2f59d2",
-        "hash": "sha256-VnmcmfAZq2sIFvPXaV3BtAjzDDPB6/h5Jz68qB124bE="
+        "rev": "d0e1a84d5b0c3c556b0fbdbeb77908d9817e6bbb",
+        "hash": "sha256-mc/W0D9MEtNQPeJ66X9T28IB+pvYqDRXj9UYb9hLlvA="
      },
      "gn": {
        "version": "0-unstable-2026-03-05",
@@ -21,8 +21,8 @@
    "DEPS": {
      "src": {
        "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "dbcf1b1bfb506cc580859bcb5ff9460a8443af90",
-        "hash": "sha256-pcrElIGFOcPQjJUF1ceHMRjS3YLjbTa9cM3Qg/G3u6I=",
+        "rev": "68ba233a543d25e75c30f1228dd3bafa2da96937",
+        "hash": "sha256-ktIkQRYWcyKnZKEhvxFGssMZ///ctd/Ue3VIYPvQzuM=",
        "recompress": true
      },
      "src/third_party/clang-format/script": {
@@ -92,8 +92,8 @@
      },
      "src/third_party/angle": {
        "url": "https://chromium.googlesource.com/angle/angle.git",
-        "rev": "82ab43bfda5a3f59e1876fd3c828f047c689bc12",
-        "hash": "sha256-6WjecQRoyCLUoSbqDMpmsJ5tZazPF171KWnjxxK8hd4="
+        "rev": "534e0d1c1d0fcb4b57fd6a3fb9284cd14eaa28cd",
+        "hash": "sha256-o3UV8X27G7wpaDiKDzgMZN64+d9JQrvcQXpSybxi/h4="
      },
      "src/third_party/angle/third_party/glmark2/src": {
        "url": "https://chromium.googlesource.com/external/github.com/glmark2/glmark2",
@@ -132,8 +132,8 @@
      },
      "src/third_party/dawn": {
        "url": "https://dawn.googlesource.com/dawn.git",
-        "rev": "ff7b4f6c5d964879b5f4356ef6e732adeed2f627",
-        "hash": "sha256-pURclm6gi0am32tohZTB4iT2BWa55uRBJNRVW0gjDcY="
+        "rev": "049880d58d6636a819168c00f44f8a4ed1e33e51",
+        "hash": "sha256-AHUos4ejvcsHTDdretkDHAeyLugtI6Jg14Hb9MbbPPs="
      },
      "src/third_party/dawn/third_party/glfw": {
        "url": "https://chromium.googlesource.com/external/github.com/glfw/glfw",
@@ -657,8 +657,8 @@
      },
      "src/third_party/skia": {
        "url": "https://skia.googlesource.com/skia.git",
-        "rev": "f8cd2da0256752afb0059bf17e4bf2bec422967e",
-        "hash": "sha256-dtSWBpCaewkKMW3Jc1PNDQh0jSQHIPduaXsIU9rcTa0="
+        "rev": "6e0fbe154ccaf018b2dd1f0e42eec285e7d79d00",
+        "hash": "sha256-oqfNOSQB+5sbAnw4tPBXn22rk6Ai5b2aZNLJUyM181k="
      },
      "src/third_party/smhasher/src": {
        "url": "https://chromium.googlesource.com/external/smhasher.git",
@@ -792,8 +792,8 @@
      },
      "src/third_party/webrtc": {
        "url": "https://webrtc.googlesource.com/src.git",
-        "rev": "997079137283f693a0fac6a5350ae7f6f2cf3b59",
-        "hash": "sha256-SOV9YS8Dk1HFCo00Qe6zttJOP0PEBS4B6Ah79OXmTew="
+        "rev": "28452dff1bf86fec881a47949d4dedd4a2fe1f09",
+        "hash": "sha256-KBz94jvdVgxWuTuSoeHKNdY7wEJDGqG3xVsSVB3ubRQ="
      },
      "src/third_party/wuffs/src": {
        "url": "https://skia.googlesource.com/external/github.com/google/wuffs-mirror-release-c.git",
@@ -822,8 +822,8 @@
      },
      "src/v8": {
        "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "9b21082faf16a5f029a4316272c9a627d8b33eb4",
-        "hash": "sha256-dT1f9Df1K1ZLp346Tpqn6Lkq2HDYWWQIAuhqXMIIydk="
+        "rev": "c152c31c55cd54fd239772532a86c802d95b4617",
+        "hash": "sha256-7qEPh9l94LqyaA9qW0ZfFmmFyMNTjTJaeunLgDhtFuM="
      }
    }
  },
@@ -526,11 +526,11 @@
    "vendorHash": null
  },
  "hashicorp_azurerm": {
-    "hash": "sha256-dLapX7pWRKR90D19e7DZZki+VTgKLP2n9ADww2CIQg8=",
+    "hash": "sha256-YQV1akoUREn2FHtX+L9DixHo4ghm4wLSrQsAUv1nqaQ=",
    "homepage": "https://registry.terraform.io/providers/hashicorp/azurerm",
    "owner": "hashicorp",
    "repo": "terraform-provider-azurerm",
-    "rev": "v4.69.0",
+    "rev": "v4.70.0",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
@@ -1274,11 +1274,11 @@
    "vendorHash": "sha256-IR6KjFW5GbsOIm3EEFyx3ctwhbifZlcNaZeGhbeK/Wo="
  },
  "sysdiglabs_sysdig": {
-    "hash": "sha256-+rP7HnEF+J5NjwgnYEnFbSBdV/fyq7s2A0Xt4maLy7k=",
+    "hash": "sha256-g1al4OJTbnnOIT6ZsjMhEzB+dXvMrBUzctw+Jh2uFYI=",
    "homepage": "https://registry.terraform.io/providers/sysdiglabs/sysdig",
    "owner": "sysdiglabs",
    "repo": "terraform-provider-sysdig",
-    "rev": "v3.7.1",
+    "rev": "v3.7.2",
    "spdx": "MPL-2.0",
    "vendorHash": "sha256-HjrB7C0KaLJz9NVLfZdq5EZbNbF9lJPxSkQwnWUF978="
  },
@@ -88,7 +88,7 @@ let
          fetchurl {
            url = "https://www.mrc-lmb.cam.ac.uk/harry/imosflm/ver${
              builtins.replaceStrings [ "." ] [ "" ] version
-            }/downloads/mosflm-${version}-osx-64.zip";
+            }/downloads/imosflm-${version}-osx-64.zip";
            hash = "sha256-0sXgA3zSIjhy9+zTiv+K/51yZsIgGorMtKVjdRjW+AM=";
          }
        else
@@ -130,9 +130,7 @@ buildNpmPackage (finalAttrs: {
  meta = {
    description = "P2P note-taking tool";
    homepage = "https://anytype.io/";
-    changelog = "https://community.anytype.io/t/anytype-desktop-${
-      builtins.replaceStrings [ "." ] [ "-" ] (lib.versions.majorMinor finalAttrs.version)
-    }-0-released";
+    changelog = "https://github.com/anyproto/anytype-ts/releases/tag/${finalAttrs.src.tag}";
    license = lib.licenses.unfreeRedistributable;
    mainProgram = "anytype";
    maintainers = with lib.maintainers; [
@@ -18,13 +18,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "attyx";
-  version = "0.3.6";
+  version = "0.3.15";

  src = fetchFromGitHub {
    owner = "semos-labs";
    repo = "attyx";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-FfHU+XZnMN3HqQFtNEZtYu3YMvBk32QcEP71plDtvjY=";
+    hash = "sha256-w71MyTlnuJBdC9HtXm9hdYNv+ONnh8Ii3i2BhmmcXz4=";
  };

  deps = callPackage ./build.zig.zon.nix { };
@@ -38,6 +38,8 @@ python3Packages.buildPythonPackage rec {
  postPatch = ''
    substituteInPlace auto_cpufreq/core.py \
      --replace-fail "/opt/auto-cpufreq/override.pickle" "/var/run/override.pickle"
+    substituteInPlace auto_cpufreq/core.py \
+      --replace-fail "/opt/auto-cpufreq/turbo-override.pickle" "/var/run/turbo-override.pickle"
    substituteInPlace scripts/org.auto-cpufreq.pkexec.policy \
      --replace-fail "/opt/auto-cpufreq/venv/bin/auto-cpufreq" "$out/bin/auto-cpufreq"
    substituteInPlace auto_cpufreq/gui/app.py auto_cpufreq/gui/objects.py \
@@ -20,13 +20,13 @@ let
 in
 buildBazelPackage rec {
  pname = "bant";
-  version = "0.2.5";
+  version = "0.2.6";

  src = fetchFromGitHub {
    owner = "hzeller";
    repo = "bant";
    rev = "v${version}";
-    hash = "sha256-qS2oKQ9/vNX58PftEjHD+3ApXtWL90YVBHnifLtDTcU=";
+    hash = "sha256-aGm/SiHogz9LSK2LQkEOkeQWBVOHDRvUK0YEU9Tuznw=";
  };

  bazelFlags = [
@@ -8,18 +8,18 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "bob";
-  version = "4.1.6";
+  version = "4.1.7";

  src = fetchFromGitHub {
    owner = "MordechaiHadad";
    repo = "bob";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-XI/oNGKLXQ/fpB6MojhTsEgmmPH1pHECD5oZgc1r4rQ=";
+    hash = "sha256-2TrmLN9VPjueRRL7kcnfH+eBpEdAOAKGP8N9KZE8bH0=";
  };

  nativeBuildInputs = [ installShellFiles ];

-  cargoHash = "sha256-YSZcYTGnMnN/srh8Z15toq+GIyRKfFd+pGkFQl5gCuo=";
+  cargoHash = "sha256-Akn0p8NBZV3M+pM91W01GIX9mF8nL7dt/kk0ufES8T0=";

  doCheck = false;

@@ -11,16 +11,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cargo-codspeed";
-  version = "4.5.0";
+  version = "4.6.0";

  src = fetchFromGitHub {
    owner = "CodSpeedHQ";
    repo = "codspeed-rust";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-2xKTn+fiRyXyH6womZPJoSpBC7nMH9+rBuoZrWL2kQU=";
+    hash = "sha256-Hfqh9kKTiRTWhKbsdXAK/DqBeAKxXQaYdWoZN55lcLo=";
  };

-  cargoHash = "sha256-jN70cNOYLPtIPEji2JF8r/6zphvekRc9y0UNR3xNAUo=";
+  cargoHash = "sha256-ix8Q+GbazKC5HIIUUVYjLTlufOQLxppqmVGznbTAXEI=";

  nativeBuildInputs = [
    curl
@@ -8,16 +8,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cargo-deb";
-  version = "3.6.3";
+  version = "3.6.4";

  src = fetchFromGitHub {
    owner = "kornelski";
    repo = "cargo-deb";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-qYLJNhxBfSopfaNEh9FnKoKdq1Uu8nfWPOhpqzQH288=";
+    hash = "sha256-De4ouk+tub/sDSoIuEaoWYd9qjpLDA05xvuuQlaHF6M=";
  };

-  cargoHash = "sha256-VC116dm4XeR8ofvP3H0R5LiZOMqlUPpVGzZvTc9DhDk=";
+  cargoHash = "sha256-jac3VFOCeYKuedFHt4lEfBHlErHdfczRF6Mrs8Se88o=";

  nativeBuildInputs = [
    makeWrapper
@@ -83,7 +83,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
      You can sort and hide games or download cover art from SteamGridDB.
    '';
    homepage = "https://apps.gnome.org/Cartridges/";
-    changelog = "https://github.com/kra-mo/cartridges/releases/tag/${finalAttrs.version}";
+    changelog = "https://github.com/kra-mo/cartridges/releases/tag/v${finalAttrs.version}";
    license = lib.licenses.gpl3Plus;
    teams = [ lib.teams.gnome-circle ];
    mainProgram = "cartridges";
@@ -8,13 +8,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "ceph-csi";
-  version = "3.16.1";
+  version = "3.16.2";

  src = fetchFromGitHub {
    owner = "ceph";
    repo = "ceph-csi";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-dp/dSZG+kaX2S78KxreSNERZJ2BmF0oSknA62U9UT78=";
+    hash = "sha256-jdBBRSkmNgwYzNUDY9Aarp0HNHsUcSNkZD+Fvv8drHQ=";
  };

  preConfigure = ''
@@ -6,18 +6,18 @@

 buildGoModule (finalAttrs: {
  pname = "cnspec";
-  version = "13.5.0";
+  version = "13.6.0";

  src = fetchFromGitHub {
    owner = "mondoohq";
    repo = "cnspec";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-B78wdVa3GrD7eXG0RKnO2/F/FXV3jwaul2Ag1P76s2g=";
+    hash = "sha256-edapPCYa1CtJS4p8+5Imi0G13qrs3S46QIZmnCNe+rQ=";
  };

  proxyVendor = true;

-  vendorHash = "sha256-yb89NhE3d7Wx26ZzjadNTlOWauHVpT7Q4ScPauLcnlU=";
+  vendorHash = "sha256-eqdT/znugXvGuZeecwaVFXNSJspnVYo3nJPnf2HKkqY=";

  subPackages = [ "apps/cnspec" ];

@@ -24,13 +24,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "cubeb";
-  version = "0-unstable-2026-04-06";
+  version = "0-unstable-2026-04-22";

  src = fetchFromGitHub {
    owner = "mozilla";
    repo = "cubeb";
-    rev = "626d7d9f906e9f3cfb70be9e58af0f5a5f399a74";
-    hash = "sha256-qo3gVlYGxKef7RVGngFDKuSODoVbSCaFZwoKY4RDaAk=";
+    rev = "a37dadd1ed5949ab0accd7087b7c5c57800eab43";
+    hash = "sha256-JUHuigIhXDF1pFGbkIp6ZKQhCpa/w2LL7HK4IpCYiek=";
  };

  outputs = [
@@ -27,7 +27,7 @@
 }:
 stdenv.mkDerivation rec {
  pname = "curl-impersonate";
-  version = "1.5.2";
+  version = "1.5.5";

  outputs = [
    "out"
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
    owner = "lexiforest";
    repo = "curl-impersonate";
    tag = "v${version}";
-    hash = "sha256-ca6YZBYN9WMaXL9nFC5TdX/rRTclu6i0ssQlSBMlteM=";
+    hash = "sha256-iKtNdBjAflg9evd/CmKJd8pXGPUM5sMBJEgJAbJ6vws=";
  };

  # Disable blanket -Werror to fix build on `gcc-13` related to minor
@@ -2,6 +2,7 @@
  buildGoModule,
  fetchFromGitHub,
  lib,
+  makeWrapper,
  nixosTests,
  nix-update-script,
 }:
@@ -25,6 +26,13 @@ buildGoModule (finalAttrs: {

  subPackages = [ "cmd/ddns-updater" ];

+  nativeBuildInputs = [ makeWrapper ];
+
+  postInstall = ''
+    wrapProgram $out/bin/ddns-updater \
+      --set GODEBUG "netdns=go"
+  '';
+
  passthru = {
    tests = {
      inherit (nixosTests) ddns-updater;
@@ -55,6 +55,7 @@ let
    kirigami-addons
    qqc2-desktop-style
    ;
+  speexdsp' = speexdsp.override { withFftw3 = false; };
 in

 stdenv.mkDerivation (finalAttrs: {
@@ -109,7 +110,7 @@ stdenv.mkDerivation (finalAttrs: {
    rnnoise
    rubberband
    soundtouch
-    speexdsp
+    speexdsp'
    onetbb
    webrtc-audio-processing
    zita-convolver
@@ -100,10 +100,7 @@ let
        "x86_64-linux"
        "i686-linux"
      ];
-      maintainers = with lib.maintainers; [
-        ewok
-        dritter
-      ];
+      maintainers = with lib.maintainers; [ ewok ];
    };

    nativeBuildInputs = [ makeWrapper ];
@@ -6,16 +6,20 @@
  makeWrapper,
  makeDesktopItem,
  copyDesktopItems,
-  electron,
+  electron_40,
  python3Packages,
  pipewire,
  libpulseaudio,
+  jq,
  autoPatchelfHook,
  bun,
  nodejs,
  withTTS ? true,
  withMiddleClickScroll ? false,
 }:
+let
+  electron = electron_40;
+in
 stdenv.mkDerivation (finalAttrs: {
  pname = "equibop";
  version = "3.1.9";
@@ -40,6 +44,7 @@ stdenv.mkDerivation (finalAttrs: {

  nativeBuildInputs = [
    bun
+    jq
    nodejs
    # XXX: Equibop *does not* ship venmic as a prebuilt node module. The package
    # seems to build with or without this hook, but I (NotAShelf) don't have the
@@ -67,15 +72,22 @@ stdenv.mkDerivation (finalAttrs: {
  '';

  # electron builds must be writable to support electron fuses
-  preBuild =
-    lib.optionalString stdenv.hostPlatform.isDarwin ''
-      cp -r ${electron.dist}/Electron.app .
-      chmod -R u+w Electron.app
-    ''
-    + lib.optionalString stdenv.hostPlatform.isLinux ''
-      cp -r ${electron.dist} electron-dist
-      chmod -R u+w electron-dist
-    '';
+  preBuild = ''
+    # Validate electron version matches upstream package.json
+    if [ "`jq -r '.devDependencies.electron' < package.json | cut -d. -f1 | tr -d '^'`" != "${lib.versions.major electron.version}" ]
+    then
+      echo "ERROR: electron version mismatch between package.json and nixpkgs"
+      exit 1
+    fi
+  ''
+  + lib.optionalString stdenv.hostPlatform.isDarwin ''
+    cp -r ${electron.dist}/Electron.app .
+    chmod -R u+w Electron.app
+  ''
+  + lib.optionalString stdenv.hostPlatform.isLinux ''
+    cp -r ${electron.dist} electron-dist
+    chmod -R u+w electron-dist
+  '';

  buildPhase = ''
    runHook preBuild
@@ -119,10 +131,12 @@ stdenv.mkDerivation (finalAttrs: {
  postFixup = ''
    makeWrapper ${electron}/bin/electron $out/bin/equibop \
      --add-flags $out/opt/Equibop/resources/app.asar \
-      ${lib.optionalString withTTS "--add-flags \"--enable-speech-dispatcher\""} \
+      ${lib.optionalString withTTS ''
+        --run 'if [[ "''${NIXOS_SPEECH:-default}" != "False" ]]; then NIXOS_SPEECH=True; else unset NIXOS_SPEECH; fi' \
+        --add-flags "\''${NIXOS_SPEECH:+--enable-speech-dispatcher}" \
+      ''} \
      ${lib.optionalString withMiddleClickScroll "--add-flags \"--enable-blink-features=MiddleClickAutoscroll\""} \
-      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime=true}}" \
-      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ (lib.getLib stdenv.cc.cc) ]}"
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime=true}}"
  '';

  desktopItems = makeDesktopItem {
@@ -8,16 +8,16 @@

 buildGoModule (finalAttrs: {
  pname = "fabric-ai";
-  version = "1.4.448";
+  version = "1.4.451";

  src = fetchFromGitHub {
    owner = "danielmiessler";
    repo = "fabric";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-4soF/1a5w9Wm8sGUZlDO4Y0JaKV9ro4F8mXxV8HtG3A=";
+    hash = "sha256-5eKARPLPD24MQLMlSIa76R7YoR1axCmn5vL9V7Zly5o=";
  };

-  vendorHash = "sha256-MxQfHrF9iwoQEa0p24FnmdfHyiCOYpMRv3EukV3Onzo=";
+  vendorHash = "sha256-oSHrn2Oad6XuIFjrqeC4NGC/rasCu+49xADY15YNSbc=";

  # Fabric introduced plugin tests that fail in the nix build sandbox.
  doCheck = false;
@@ -10,7 +10,7 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "ffizer";
-  version = "2.13.9";
+  version = "2.13.10";

  buildFeatures = [ "cli" ];

@@ -18,10 +18,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
    owner = "ffizer";
    repo = "ffizer";
    rev = finalAttrs.version;
-    hash = "sha256-7nTtyCtppUZ3vEtiDfDMCvDztZRVDFH43bl5fgZtfFM=";
+    hash = "sha256-BaTqkfNiRLHgg3In/5zh4u5ThD+wfW7R3tjy/qsPVag=";
  };

-  cargoHash = "sha256-/BdODBhF+ikre/U1TzB+/DqSs7LYn7NhPKgMJT80TUM=";
+  cargoHash = "sha256-QbT6QxYP6ykDKtEWfFva16ms7b2wNOS+TrvPJV9ys2A=";

  nativeBuildInputs = [
    pkg-config
@@ -6,16 +6,16 @@

 buildGoModule (finalAttrs: {
  pname = "gat";
-  version = "0.27.0";
+  version = "0.27.1";

  src = fetchFromGitHub {
    owner = "koki-develop";
    repo = "gat";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-xydy+iKBfO1np/jtzWHFNUmXqb545ldWtwqMymaah2c=";
+    hash = "sha256-8+IpVMbV+1aXNZoIWVZF/GDsLh2G1rHudkyifguGl0g=";
  };

-  vendorHash = "sha256-0kNtZOTpWpeFVyRHFIf6ybM7gAWb5/JWVljm0FO5fK8=";
+  vendorHash = "sha256-UUFfM51toafSxK+x7Q7c9wPDiO22f7YfLc05u3uWLAE=";

  env.CGO_ENABLED = 0;

@@ -8,13 +8,13 @@

 buildGoModule (finalAttrs: {
  pname = "gatekeeper";
-  version = "3.22.1";
+  version = "3.22.2";

  src = fetchFromGitHub {
    owner = "open-policy-agent";
    repo = "gatekeeper";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-lYLII1aJwrYmoyVYf08KDyvIVuCJIya/97hLQyGKz44=";
+    hash = "sha256-fW5aSZ9/X/oQM8r1NWkNHlK+pd+ji7GTWPGx0NEW9gk=";
  };

  vendorHash = "sha256-PnBWUvpq7d3yQP50fgACWx/zcYobIGC+KiuzLqpKDcI=";
@@ -8,10 +8,11 @@
  patch-package,
  stdenv,
  versionCheckHook,
+  ripgrep,
 }:
 buildNpmPackage (finalAttrs: {
  pname = "gitlab-duo";
-  version = "8.67.0";
+  version = "8.89.0";

  # DOCS https://gitlab.com/gitlab-org/editor-extensions/gitlab-lsp#node-version
  nodejs = nodejs_22;
@@ -21,7 +22,7 @@ buildNpmPackage (finalAttrs: {
    owner = "editor-extensions";
    repo = "gitlab-lsp";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-GnL3720MwiWtC7lHA4CrfiZUTeOV+ytWFii16OKGbAM=";
+    hash = "sha256-AiC0xxk8d/2rvRGm31vWqRuJ7nzMrITTGabv7v1LpOA=";
  };

  patches = [
@@ -30,13 +31,9 @@ buildNpmPackage (finalAttrs: {
    ./missing-hashes.patch
  ];

-  # PATCH: Only build for the current platform, not all targets
-  postPatch = ''
-    sed -i 's/SUPPORTED_TARGETS=".\+"/SUPPORTED_TARGETS="bun-$TARGET"/' packages/cli/scripts/compile_executables.sh
-  '';
-
  npmFlags = [ "--install-links" ];
-  npmDepsHash = "sha256-9b73NGu3GO5Sgus7BZ7WvOaXBvQ3UrW9BUTk6NwH+uY=";
+  npmDepsHash = "sha256-U/dwfYZqy/1CM+Emz1w44mAzY24Z8vKWBXSzSqeVmnY=";
+  npmRebuildFlags = [ "--ignore-scripts" ];
  npmBuildScript = "build:binary";
  npmWorkspace = "@gitlab/duo-cli";
  nativeBuildInputs = [
@@ -48,6 +45,8 @@ buildNpmPackage (finalAttrs: {
  env.ELECTRON_SKIP_BINARY_DOWNLOAD = "true";
  env.PUPPETEER_SKIP_DOWNLOAD = "true";
  env.TARGET = "${stdenv.targetPlatform.node.platform}-${stdenv.targetPlatform.node.arch}";
+  env.SUPPORTED_TARGETS = "bun-${stdenv.targetPlatform.node.platform}-${stdenv.targetPlatform.node.arch}";
+  env.SKIP_RIPGREP_BUNDLE = 1;

  postConfigure = ''
    patchShebangs --build ./packages/cli/scripts
@@ -59,6 +58,9 @@ buildNpmPackage (finalAttrs: {

    install -Dm755 packages/cli/bin/duo-$TARGET $out/bin/duo

+    wrapProgram $out/bin/duo \
+      --prefix PATH : ${lib.getExe ripgrep}
+
    runHook postInstall
  '';

@@ -69,7 +71,6 @@ buildNpmPackage (finalAttrs: {
  passthru.updateScript = ./update.sh;

  meta = {
-    broken = stdenv.hostPlatform.isDarwin;
    changelog = "https://gitlab.com/gitlab-org/editor-extensions/gitlab-lsp/-/blob/main/CHANGELOG.md";
    description = "CLI for GitLab AI assistant";
    downloadPage = "https://gitlab.com/gitlab-org/editor-extensions/gitlab-lsp";
@@ -1,5 +1,5 @@
 #! /usr/bin/env nix-shell
-#! nix-shell -I nixpkgs=./. -i bash -p git jaq prefetch-npm-deps nix-update npm-lockfile-fix
+#! nix-shell -I nixpkgs=./. -i bash -p git jaq prefetch-npm-deps nix-update npm-lockfile-fix nodejs_22
 set -euo pipefail

 # Get new Gitlab Duo release
@@ -45,7 +45,7 @@ npm install --package-lock-only --ignore-scripts
 npm-lockfile-fix package-lock.json
 npmDepsHash="$(prefetch-npm-deps package-lock.json)"
 git add -A
-patch="$(git diff --cached)"
+patch="$(git diff --cached --no-ext-diff)"
 popd

 # Update nix expression with new hashes
@@ -6,16 +6,16 @@

 buildGoModule (finalAttrs: {
  pname = "gosec";
-  version = "2.25.0";
+  version = "2.26.1";

  src = fetchFromGitHub {
    owner = "securego";
    repo = "gosec";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-ssRSI8RPwC+VSW6tPRLr4q5BE0hixWf4O92Fgu0P1aE=";
+    hash = "sha256-/iurQn0fNTonpSSFf1llmFA5+CYSb/vYFGE0JKbcL90=";
  };

-  vendorHash = "sha256-wXR5EMI7bvPFudAtw2/z4O//Zkbop71XAS3uyXx3iQs=";
+  vendorHash = "sha256-57fYXBbir4jPiYPtTH1iVNFPWZWfq/Sx21Z4jC3fEWs=";

  subPackages = [
    "cmd/gosec"
@@ -17,10 +17,18 @@ rustPlatform.buildRustPackage (finalAttrs: {
    hash = "sha256-9AA2uln9cnMzFvPbxiD05sfdAZKO7xzoJSfQbeRNE9Y=";
  };

-  buildAndTestSubdir = "harper-ls";
-
  cargoHash = "sha256-P90qKrV4YK1ATwclbJ8wX+rcCdE1QetNNL96/IXeIMA=";

+  cargoBuildFlags = [
+    "--package=harper-cli"
+    "--package=harper-ls"
+  ];
+
+  cargoTestFlags = [
+    "--package=harper-cli"
+    "--package=harper-ls"
+  ];
+
  passthru.updateScript = nix-update-script { };

  nativeInstallCheckInputs = [
@@ -13,8 +13,8 @@
      tree-sitter-beancount = prev.tree-sitter-beancount.override {
        excludeBrokenTreeSitterJson = false;
      };
-      tree-sitter-dart = prev.tree-sitter-dart.overrideAttrs {
-        patches = [ ];
+      tree-sitter-git-rebase = prev.tree-sitter-git-rebase.overrideAttrs {
+        dontPatch = true;
      };
      tree-sitter-glimmer = prev.tree-sitter-glimmer.override {
        excludeBrokenTreeSitterJson = false;
@@ -22,18 +22,12 @@
      tree-sitter-janet-simple = prev.tree-sitter-janet-simple.override {
        excludeBrokenTreeSitterJson = false;
      };
-      tree-sitter-latex = prev.tree-sitter-latex.override {
-        generate = false;
-      };
      tree-sitter-qmljs = prev.tree-sitter-qmljs.overrideAttrs {
        dontCheckForBrokenSymlinks = true;
      };
      tree-sitter-sql = prev.tree-sitter-sql.override {
        generate = false;
      };
-      tree-sitter-tlaplus = prev.tree-sitter-tlaplus.overrideAttrs {
-        patches = [ ];
-      };
    }
  ),
 }:
@@ -148,7 +148,7 @@ stdenv.mkDerivation rec {
  meta = {
    description = "LLVM-based compiler for OpenCL targeting Intel Gen graphics hardware";
    homepage = "https://github.com/intel/intel-graphics-compiler";
-    changelog = "https://github.com/intel/intel-graphics-compiler/releases/tag/${version}";
+    changelog = "https://github.com/intel/intel-graphics-compiler/releases/tag/v${version}";
    license = lib.licenses.mit;
    platforms = lib.platforms.linux;
    maintainers = with lib.maintainers; [ SuperSandro2000 ];
@@ -9,13 +9,13 @@
 }:
 buildGoModule (finalAttrs: {
  pname = "ipp-usb";
-  version = "0.9.31";
+  version = "0.9.32";

  src = fetchFromGitHub {
    owner = "openprinting";
    repo = "ipp-usb";
    rev = finalAttrs.version;
-    sha256 = "sha256-WoJa00dSTXknoEjRO/L1yZc6pA0SfAhKsG6QqS6aDSc=";
+    sha256 = "sha256-spXp9la5FV8J/cb/1IDQM29QqzFCDzgRKwPk1f3LgkM=";
  };

  postPatch = ''
@@ -15,13 +15,13 @@

 stdenvNoCC.mkDerivation rec {
  pname = "iterm2";
-  version = "3.6.6";
+  version = "3.6.10";

  src = fetchzip {
    url = "https://iterm2.com/downloads/stable/iTerm2-${
      lib.replaceStrings [ "." ] [ "_" ] version
    }.zip";
-    hash = "sha256-n3VoRxMOBQK/8mbVbORSBz73tsuKAUMG7dFZIbaqdHU=";
+    hash = "sha256-igdExoh3d8EZBuKkqyNqF087jUISax07rSWG3eenUbw=";
  };

  dontFixup = true;
@@ -9,7 +9,7 @@
 let
  pname = "jai";
  minor = "2";
-  patch = "026";
+  patch = "029";
  version = "0.${minor}.${patch}";
  zipName = "jai-beta-${minor}-${patch}.zip";
  jai = stdenv.mkDerivation {
@@ -20,7 +20,7 @@ let
          nix-store --add-fixed sha256 ${zipName}
      '';
      name = zipName;
-      sha256 = "sha256-iWPMVGzcDlR3cP4ruPZJBAAdvFLZeM8+pCxbsSk2ZLw=";
+      sha256 = "sha256-LH49sPgtn4TccDQa1080cnCnH/zlyZa1Jc4Y1DScJOc=";
    };
    nativeBuildInputs = [ unzip ];
    buildCommand = "unzip $src -d $out";
@@ -10,13 +10,7 @@
 }:

 let
-  # josh-ui requires javascript dependencies, haven't tried to figure it out yet
-  cargoFlags = [
-    "--workspace"
-    "--exclude"
-    "josh-ui"
-  ];
-  version = "24.10.04";
+  version = "26.04.19";
 in

 rustPlatform.buildRustPackage {
@@ -27,10 +21,10 @@ rustPlatform.buildRustPackage {
    owner = "josh-project";
    repo = "josh";
    rev = "r${version}";
-    hash = "sha256-6rfNEWNeC0T/OXhCReaV5npcJjQoH6XhsZzHXGnnxOo=";
+    hash = "sha256-tWU7ZGs148fmCXJxUM1RiDIgJONMZnFXO7ksaqqoT9I=";
  };

-  cargoHash = "sha256-Kb0EKWae1sldDg+F3ccoztI3zbQ/BJjy+4ojnqiqKA4=";
+  cargoHash = "sha256-Ksl3dFeEpwhpiotNuM9/vg7aD2TUuHKvqUaZkbceCdY=";

  nativeBuildInputs = [
    pkg-config
@@ -42,12 +36,18 @@ rustPlatform.buildRustPackage {
    openssl
  ];

-  cargoBuildFlags = cargoFlags;
-  cargoTestFlags = cargoFlags;
+  cargoBuildFlags = [ "--workspace" ];
+  # josh-proxy's inline tests need to interact with a specific test environment
+  cargoTestFlags = [
+    "--workspace"
+    "--exclude"
+    "josh-proxy"
+  ];

  # used to teach josh itself about its version number
  env.JOSH_VERSION = "r${version}";

+  # josh and josh-filter are used interactively, so git is likely already in PATH
  postInstall = ''
    wrapProgram "$out/bin/josh-proxy" --prefix PATH : "${git}/bin"
  '';
@@ -56,7 +56,7 @@ rustPlatform.buildRustPackage {
    description = "Just One Single History";
    homepage = "https://josh-project.github.io/josh/";
    downloadPage = "https://github.com/josh-project/josh";
-    changelog = "https://github.com/josh-project/josh/releases/tag/${version}";
+    changelog = "https://github.com/josh-project/josh/releases/tag/r${version}";
    license = lib.licenses.mit;
    maintainers = [
      lib.maintainers.sternenseemann
@@ -6,16 +6,16 @@

 buildGoModule (finalAttrs: {
  pname = "jwx";
-  version = "4.0.0";
+  version = "4.0.1";

  src = fetchFromGitHub {
    owner = "lestrrat-go";
    repo = "jwx";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-b/Bc+pZeFbdqB/Sp0bGvDU/MHE0r1rPPcj96SHdfcAg=";
+    hash = "sha256-tVvesVrsbFONhmpFo59c/kC3vxAjWpQwnbaUmrx8O5E=";
  };

-  vendorHash = "sha256-RBv86IfoCQDeQQfTU74oLpMOwU0JRJc0dcr3VMKX8CA=";
+  vendorHash = "sha256-jCAHyCfTEcbtGEkxPLJvXJ90mVDyijWOoHJ5dbJouCs=";

  sourceRoot = "${finalAttrs.src.name}/cmd/jwx";

@@ -1,6 +1,6 @@
 {
  "audio_service_mpris": "sha256-IVv1ioBpiK0VbnOFqnc9NbNn3Z+l9VN2clpCQjckBRo=",
-  "desktop_webview_window": "sha256-4nTulOxPTV7sePokTY7xJTwulyucvf4JZKw860P8pbA=",
+  "desktop_webview_window": "sha256-KWON5aTPlVVrLidmnfpV+syWPYEngChOvkN7miIFjvE=",
  "media_kit": "sha256-75fNdeaGtpGMOsK+oiLoIdqJe3+5cTO/8ftS0r7AU6I=",
  "media_kit_libs_android_video": "sha256-75fNdeaGtpGMOsK+oiLoIdqJe3+5cTO/8ftS0r7AU6I=",
  "media_kit_libs_ios_video": "sha256-75fNdeaGtpGMOsK+oiLoIdqJe3+5cTO/8ftS0r7AU6I=",
@@ -10,5 +10,5 @@
  "media_kit_libs_video": "sha256-75fNdeaGtpGMOsK+oiLoIdqJe3+5cTO/8ftS0r7AU6I=",
  "media_kit_libs_windows_video": "sha256-75fNdeaGtpGMOsK+oiLoIdqJe3+5cTO/8ftS0r7AU6I=",
  "media_kit_video": "sha256-75fNdeaGtpGMOsK+oiLoIdqJe3+5cTO/8ftS0r7AU6I=",
-  "webview_windows": "sha256-YMOv3wRqsXqoccdDCv4dj10Pc1UkO9OuJWckNujMr5A="
+  "webview_windows": "sha256-5iNB/h6TzMOTxp98flg7jt2XZn0bFU6wSvYjjUXt3bk="
 }
@@ -18,13 +18,13 @@
 }:

 let
-  version = "2.0.7";
+  version = "2.0.8";

  src = fetchFromGitHub {
    owner = "Predidit";
    repo = "Kazumi";
    tag = version;
-    hash = "sha256-r3nV7XhwvPoNqobRz/1n6iGjcjGPvcFYch5DQCP6RLE=";
+    hash = "sha256-ph9VFRBGwkEjKJGjnPGldLDOwIdHpZtEWydW80hKOFg=";
  };
 in
 flutter338.buildFlutterApplication {
@@ -445,8 +445,8 @@
      "dependency": "direct main",
      "description": {
        "path": ".",
-        "ref": "297b39532c426263d2fa9fde4d70d2b5bdfc8059",
-        "resolved-ref": "297b39532c426263d2fa9fde4d70d2b5bdfc8059",
+        "ref": "b429f8ba6b8a99cd0f7eb5fe8d1621f325635c3d",
+        "resolved-ref": "b429f8ba6b8a99cd0f7eb5fe8d1621f325635c3d",
        "url": "https://github.com/Predidit/linux_webview_window.git"
      },
      "source": "git",
@@ -1365,6 +1365,16 @@
      "source": "hosted",
      "version": "7.0.2"
    },
+    "photo_view": {
+      "dependency": "direct main",
+      "description": {
+        "name": "photo_view",
+        "sha256": "1fc3d970a91295fbd1364296575f854c9863f225505c28c46e0a03e48960c75e",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "0.15.0"
+    },
    "platform": {
      "dependency": "transitive",
      "description": {
@@ -2145,8 +2155,8 @@
      "dependency": "direct main",
      "description": {
        "path": ".",
-        "ref": "1b9e83371356c04d8b0fb7ab1d20ebacf5cf9764",
-        "resolved-ref": "1b9e83371356c04d8b0fb7ab1d20ebacf5cf9764",
+        "ref": "d9bbeabe51562e727850fe3f60407cf0f6239a8e",
+        "resolved-ref": "d9bbeabe51562e727850fe3f60407cf0f6239a8e",
        "url": "https://github.com/Predidit/flutter-webview-windows.git"
      },
      "source": "git",
@@ -2235,6 +2245,6 @@
  },
  "sdks": {
    "dart": ">=3.10.3 <4.0.0",
-    "flutter": ">=3.41.6"
+    "flutter": ">=3.41.7"
  }
 }
@@ -10,11 +10,11 @@

 stdenvNoCC.mkDerivation rec {
  pname = "komga";
-  version = "1.24.3";
+  version = "1.24.4";

  src = fetchurl {
    url = "https://github.com/gotson/${pname}/releases/download/${version}/${pname}-${version}.jar";
-    sha256 = "sha256-+MZ2Rr/QYJuKBZdQtuQaq1crRRqBPo3LGRHjkl1Gupo=";
+    sha256 = "sha256-O06bHt4MgGL4Ffz0llUyX0VM/6MmnjSNGFjy3R8/J1I=";
  };

  nativeBuildInputs = [
@@ -2,30 +2,21 @@
  lib,
  buildGoModule,
  fetchFromGitHub,
-  fetchpatch,
 }:

 buildGoModule (finalAttrs: {
  pname = "massren";
-  version = "1.5.6";
+  version = "1.5.7";

  src = fetchFromGitHub {
    owner = "laurent22";
    repo = "massren";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-17y+vmspvZKKRRaEwzP3Zya4r/z+2aSGG6oNZiA8D64=";
+    hash = "sha256-PjF7ani4NdM0Avz0/4D04CZLdvkQHg91E/eFoDXD6ks=";
  };

  vendorHash = null;

-  patches = [
-    # Add Go Modules support
-    (fetchpatch {
-      url = "https://github.com/laurent22/massren/commit/83df215b6e112d1ec375b08d8c44dadc5107155d.patch";
-      hash = "sha256-FMTmUrv6zGq11vexUirAuK3H6r78RtoipqyWoh+pzrs=";
-    })
-  ];
-
  ldflags = [
    "-s"
    "-w"
@@ -15,16 +15,16 @@ in
 buildGo126Module (finalAttrs: {
  pname = "mediamtx";
  # check for hls.js version updates in internal/servers/hls/hlsjsdownloader/VERSION
-  version = "1.17.1";
+  version = "1.18.0";

  src = fetchFromGitHub {
    owner = "bluenviron";
    repo = "mediamtx";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-KI6JSyhbraynwwuNp6rBH/VN9/oIJYGC8rTqyTvfDOU=";
+    hash = "sha256-DScZKan8PnEF0znAxJVx8fgbEskw73tv35v38d2jJtM=";
  };

-  vendorHash = "sha256-4UFSiPDslVHp6olB3c1AEm1ZxgCdeUKTp3KwqEo152I=";
+  vendorHash = "sha256-FJqERr/rC4y8nBFKh8luwm9pOeVEiKPHorZ5z57wD1E=";

  postPatch = ''
    cp ${hlsJs} internal/servers/hls/hls.min.js
@@ -28,7 +28,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
  meta = {
    description = "Tool that sends random MQTT messages to random topics";
    homepage = "https://github.com/fabaff/mqtt-randompub";
-    changelog = "https://github.com/fabaff/mqtt-randompub/blob/${finalAttrs.src.rev}/ChangeLog";
+    changelog = "https://github.com/fabaff/mqtt-randompub/blob/${finalAttrs.src.tag}/ChangeLog";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ fab ];
    mainProgram = "mqtt-randompub";
@@ -8,14 +8,14 @@

 python3.pkgs.buildPythonApplication (finalAttrs: {
  pname = "nb-cli";
-  version = "1.7.3";
+  version = "1.7.4";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "nonebot";
    repo = "nb-cli";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-/OZHDMfwaajePiQ7Nb6BsQcpUPybP5SDWHWG/tVUxCo=";
+    hash = "sha256-Vo+MmbaC+i/FZfrZywb2vgNQotafLyXpdBo6pDlZeaE=";
  };

  pythonRemoveDeps = [ "pip" ];
@@ -1,61 +1,25 @@
 {
  lib,
-  stdenv,
-  fetchFromGitHub,
-  autoconf,
-  automake,
-  libtool,
-  m4,
-  bison,
+  clangStdenv,
+  fetchurl,
+  libevent,
 }:
+# Use clang instead of gcc because that issues way less warnings.
+# Besides, OpenBSD devs generally prefer clang over gcc, so it is more likely
+# that the entire compilation is more tested using clang from an upstream POV.
+clangStdenv.mkDerivation (finalAttrs: {
+  pname = "openbgpd";
+  version = "9.0";

-let
-  openbsd_version = "OPENBSD_6_8"; # This has to be equal to ${src}/OPENBSD_BRANCH
-  openbsd = fetchFromGitHub {
-    name = "portable";
-    owner = "openbgpd-portable";
-    repo = "openbgpd-openbsd";
-    rev = openbsd_version;
-    sha256 = "sha256-vCVK5k4g6aW2z2fg7Kv0uvkX7f34aRc8K2myb3jjl6w=";
-  };
-in
-stdenv.mkDerivation rec {
-  pname = "opengpd";
-  version = "6.8p0";
-
-  src = fetchFromGitHub {
-    owner = "openbgpd-portable";
-    repo = "openbgpd-portable";
-    rev = version;
-    sha256 = "sha256-TKs6tt/SCWes6kYAGIrSShZgOLf7xKh26xG3Zk7wCCw=";
+  src = fetchurl {
+    url = "https://cdn.openbsd.org/pub/OpenBSD/OpenBGPD/openbgpd-${finalAttrs.version}.tar.gz";
+    hash = "sha256-4JfE81Gibx3lM5IS2eENTPWrxLgQXk8cSI7wZakD9hU=";
  };

-  nativeBuildInputs = [
-    autoconf
-    automake
-    libtool
-    m4
-    bison
+  buildInputs = [
+    libevent
  ];

-  preConfigure = ''
-    mkdir ./openbsd
-    cp -r ${openbsd}/* ./openbsd/
-    chmod -R +w ./openbsd
-    openbsd_version=$(cat ./OPENBSD_BRANCH)
-    if [ "$openbsd_version" != "${openbsd_version}" ]; then
-      echo "OPENBSD VERSION does not match"
-      exit 1
-    fi
-    ./autogen.sh
-  '';
-
-  # Workaround build failure on -fno-common toolchains like upstream
-  # gcc-10. Otherwise build fails as:
-  #   ld: bgpd-rde_peer.o:/build/source/src/bgpd/bgpd.h:133: multiple definition of `bgpd_process';
-  #     bgpd-bgpd.o:/build/source/src/bgpd/bgpd.h:133: first defined here
-  env.NIX_CFLAGS_COMPILE = "-fcommon";
-
  meta = {
    description = "Free implementation of the Border Gateway Protocol, Version 4. It allows ordinary machines to be used as routers exchanging routes with other systems speaking the BGP protocol";
    license = lib.licenses.isc;
@@ -63,4 +27,4 @@ stdenv.mkDerivation rec {
    maintainers = with lib.maintainers; [ cvengler ];
    platforms = lib.platforms.linux;
  };
-}
+})
@@ -1,11 +1,12 @@
 {
  stdenv,
  lib,
-  buildGoModule,
+  buildGo125Module,
  fetchFromGitHub,
+  installShellFiles,
  fuse,
 }:
-buildGoModule (finalAttrs: {
+buildGo125Module (finalAttrs: {
  pname = "plakar";
  version = "1.0.6";

@@ -22,6 +23,10 @@ buildGoModule (finalAttrs: {
    fuse
  ];

+  nativeBuildInputs = [
+    installShellFiles
+  ];
+
  checkFlags =
    let
      skippedTests = [
@@ -31,10 +36,15 @@ buildGoModule (finalAttrs: {
      ++ lib.optionals stdenv.isDarwin [
        "TestBTreeScanMemory"
        "TestBTreeScanPebble"
+        "TestExecuteCmdServerDefault"
      ];
    in
    [ "-skip=^${builtins.concatStringsSep "$|^" skippedTests}$" ];

+  postInstall = ''
+    installManPage $(find $src -regex '.*\.[0-9]$')
+  '';
+
  meta = {
    mainProgram = "plakar";
    description = "Encrypted, queryable backups for engineers based on an immutable data store and portable archives";
@@ -8,16 +8,16 @@

 buildGoModule (finalAttrs: {
  pname = "plow";
-  version = "1.3.2";
+  version = "1.4.0";

  src = fetchFromGitHub {
    owner = "six-ddc";
    repo = "plow";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-q9k5GzhYPOP8p8VKrqpoHc3B9Qak+4DtZAZZuFlkED0=";
+    hash = "sha256-0/nMF9fqRMzN4bfK6EsTi5MW+OUG/dv4UKr5j/AhRoM=";
  };

-  vendorHash = "sha256-KfnDJI6M6tzfoI7krKId5FXUw27eV6cEoz3UaNrlXWk=";
+  vendorHash = "sha256-nGAPuyS95bHPkQMdHdtbdVWQ+MBOOHnHPh7bkSHji4E=";

  ldflags = [
    "-s"
@@ -6,16 +6,16 @@

 buildGoModule (finalAttrs: {
  pname = "pluto";
-  version = "5.23.6";
+  version = "5.24.0";

  src = fetchFromGitHub {
    owner = "FairwindsOps";
    repo = "pluto";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-P/N36LCoXLRDD4ASN4YQovgQFrW2WgS+tKRUlWTNZIs=";
+    hash = "sha256-s46O/lSrF7kNaUWOrWnxQpLxWh/jbvI9k+t2jZqOAjU=";
  };

-  vendorHash = "sha256-EAgfzwGt/kHMP5mJ9D+WW6KMV7P0r/gUf6EYTppLWIA=";
+  vendorHash = "sha256-mNY1BmugJ7OauR3nSoiD7EpJ8dlk5PKPL/4urvPtOIY=";

  ldflags = [
    "-w"
@@ -102,8 +102,15 @@ stdenv.mkDerivation (finalAttrs: {

  # Replace hardcoded /etc when copying and reading the default config.
  postPatch = ''
-    substituteInPlace CMakeLists.txt --replace "/etc" $out
+    substituteInPlace CMakeLists.txt --replace-fail "/etc" $out
    substituteAllInPlace src/utils/file.cpp
+    # Fix gcc15 build: i3ipcpp forces -std=c++11 but the jsoncpp library was
+    # compiled with C++17 (JSONCPP_HAS_STRING_VIEW=1), causing ABI mismatch.
+    # The i3ipcpp code resolves operator[](const char*) but the library only
+    # exports operator[](std::string_view). Bump i3ipcpp to C++17 to match.
+    substituteInPlace lib/i3ipcpp/CMakeLists.txt --replace-fail \
+      "-std=c++11" \
+      "-std=c++17"
  '';

  postInstall = ''
@@ -18,15 +18,15 @@ let
 in
 buildGoModule rec {
  pname = "pomerium";
-  version = "0.32.4";
+  version = "0.32.6";
  src = fetchFromGitHub {
    owner = "pomerium";
    repo = "pomerium";
    rev = "v${version}";
-    hash = "sha256-XTj0ZLPRe8I3a5be0oRTxRUuT2wHnbsms7wIvLUg9ms=";
+    hash = "sha256-VwmjuXlYsh2dGKf7ux8DyLZec7xMISuQ7SSb9+LwzfU=";
  };

-  vendorHash = "sha256-EYXmeS4jtueI9FwVQdMlsYX3CSRGH9Dft0Syf88nf7o=";
+  vendorHash = "sha256-b4H7gAMG7DXEbvkZFsoEZrKpuvPW0vkfv1qqBPBaGAM=";

  ui = buildNpmPackage {
    pname = "pomerium-ui";
@@ -8,16 +8,16 @@

 buildGoModule (finalAttrs: {
  pname = "pop";
-  version = "0.2.0";
+  version = "0.2.1";

  src = fetchFromGitHub {
    owner = "charmbracelet";
    repo = "pop";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-ZGJkpa1EIw3tt1Ww2HFFoYsnnmnSAiv86XEB5TPf4/k=";
+    hash = "sha256-e1xkUXFC1C18nj/eTo2PmHGORKZ1cmz+s0I47SOcTiM=";
  };

-  vendorHash = "sha256-8YcJXvR0cdL9PlP74Qh6uN2XZoN16sz/yeeZlBsk5N8=";
+  vendorHash = "sha256-r2kKHwjUqls1nEOF0HwBMOZksSYp2UcjN+B0c1i8MmQ=";

  env.GOWORK = "off";

@@ -7,13 +7,13 @@

 buildGoModule (finalAttrs: {
  pname = "postfix-tlspol";
-  version = "1.9.1";
+  version = "1.10.0";

  src = fetchFromGitHub {
    owner = "Zuplu";
    repo = "postfix-tlspol";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-oS1U987pS365EQcf96w8RNGWGImFA/uRmv/Oh2HLyuo=";
+    hash = "sha256-JwggXJM8FDMG4oGRcVjVw1J/toTzc/kxrjdENFT9oGs=";
  };

  vendorHash = null;
@@ -51,13 +51,13 @@ let
  };

  pname = "pretix";
-  version = "2026.3.1";
+  version = "2026.4.0";

  src = fetchFromGitHub {
    owner = "pretix";
    repo = "pretix";
    tag = "v${version}";
-    hash = "sha256-E/WJRuugcfy/r6USS37G73PiHg8DuYRFSq0e19XIRJg=";
+    hash = "sha256-M5ty2kcIyVAFzGiieLx1FHIRXnl4jCR/O2IU7kztV3U=";
  };

  npmDeps = buildNpmPackage {
@@ -65,7 +65,7 @@ let
    inherit version src;

    sourceRoot = "${src.name}/src/pretix/static/npm_dir";
-    npmDepsHash = "sha256-+84WFNs0iPhMb4YIKfHYByYeFQHITyWeF5yIM8pvQSs=";
+    npmDepsHash = "sha256-U4oXGir53h7R3z4p371PJGm2EU+arsqe/abn6GvSGXs=";

    dontBuild = true;

@@ -94,6 +94,7 @@ python.pkgs.buildPythonApplication rec {
    "bleach"
    "celery"
    "css-inline"
+    "cryptography"
    "django-bootstrap3"
    "django-compressor"
    "django-filter"
@@ -8,14 +8,14 @@

 buildPythonPackage rec {
  pname = "pretix-mollie";
-  version = "2.5.3";
+  version = "2.5.4";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "pretix";
    repo = "pretix-mollie";
    tag = "v${version}";
-    hash = "sha256-fWfevPhwpdHkpvuedf16b/f2QfHLy1/FAS3nVV4utwM=";
+    hash = "sha256-lDICcpO8Qod++eM2okq4CJirIBM18zYnbM6Bbwb9e34=";
  };

  build-system = [
@@ -11,13 +11,13 @@
 # function correctly.
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "prisma-engines_7";
-  version = "7.7.0";
+  version = "7.8.0";

  src = fetchFromGitHub {
    owner = "prisma";
    repo = "prisma-engines";
    tag = finalAttrs.version;
-    hash = "sha256-NMoAaiTa68i51lR6iMCyHyCAsFuuhPx2+tHFSSoqWqA=";
+    hash = "sha256-nquIcOmFz+ikD0x/YEPZ5NVKCFPCdR5MSCHldn+b9jI=";
  };

  cargoHash = "sha256-uiFvzxwVJXCW9LUDFRC6ZkzSa7LQk+9ZJcaJw8mrBX4=";
@@ -15,13 +15,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "prisma_7";
-  version = "7.7.0";
+  version = "7.8.0";

  src = fetchFromGitHub {
    owner = "prisma";
    repo = "prisma";
    tag = finalAttrs.version;
-    hash = "sha256-GdS70TdHOlI0OatLvu/laBJzBraS/KWuWwpwQGTIEEU=";
+    hash = "sha256-89q5433z54h3oGX+lEYDQykN2mNltGz4+LWlYSE75/E=";
  };

  nativeBuildInputs = [
@@ -37,7 +37,7 @@ stdenv.mkDerivation (finalAttrs: {
    inherit (finalAttrs) pname version src;
    pnpm = pnpm_10;
    fetcherVersion = 3;
-    hash = "sha256-lfvRw+F0X1BPw3Njiri602HCiyDJOpyXQ5Dgh9f1hfc=";
+    hash = "sha256-mrFU5SAF4QuTBJj5TP8tUkYDG4zchttjcQMLtx6OBnI=";
  };

  patchPhase = ''
@@ -6,7 +6,7 @@
 }:

 let
-  version = "0.5.0";
+  version = "0.6.0";
 in
 buildGoModule {
  pname = "unbound_exporter";
@@ -16,10 +16,10 @@ buildGoModule {
    owner = "letsencrypt";
    repo = "unbound_exporter";
    tag = "v${version}";
-    hash = "sha256-xVc6xES3YdKIaP6rwAzI0/RLoer7bcq7VAmfjYii8VI=";
+    hash = "sha256-XsiQGVYBEXM8DQtQWEA2wk/19TGGZaIBt7Vc4HHfIBY=";
  };

-  vendorHash = "sha256-6ZiBXQRsmlUU7h9Dvlb5WHnYAjrrhbw0rypP5ChoKPs=";
+  vendorHash = "sha256-2M7s9YPAFxCQcIgF+HDKu6kztHBvbl/S2BmaBngeBFI=";

  passthru.tests = {
    inherit (nixosTests.prometheus-exporters) unbound;
@@ -10,9 +10,9 @@
 }:
 let
  mainProgram = "proton-mail";
-  version = "1.12.1";
-  linuxHash = "sha256-CNrL/O2PMXaUVgvXbmrLFZphz7yV4BlRlr388nbMsoE=";
-  darwinHash = "sha256-y8KgHm8pIbLQAb1/pIApNBbsaEi5ldInY4VXNBiTQlI=";
+  version = "1.13.0";
+  linuxHash = "sha256-ehvDkemVmKQuNm9FgKtUM/M/z4YMjXA8qtLt94SN73U=";
+  darwinHash = "sha256-YtLlW+fSRd3hJMjHOA3kXKKq2j71Edc8NW/55zTLywY=";
 in
 stdenv.mkDerivation {
  pname = "protonmail-desktop";
@@ -18,9 +18,9 @@
 }:

 let
-  version = "0.31.0";
-  apalacheVersion = "0.51.1";
-  evaluatorVersion = "0.5.0";
+  version = "0.32.0";
+  apalacheVersion = "0.56.1";
+  evaluatorVersion = "0.6.0";

  metaCommon = {
    description = "Formal specification language with TLA+ semantics";
@@ -34,7 +34,7 @@ let
    owner = "informalsystems";
    repo = "quint";
    tag = "v${version}";
-    hash = "sha256-d1iCkpUh5z+Gr2AbjpyfwiR4XZ6vYk96UHCeippC6iw=";
+    hash = "sha256-GTbphBmALx/gDc/iV/wtE1ovpK43VtCQoneN5AqUmvg=";
  };

  # Build the Quint CLI from source
@@ -44,7 +44,7 @@ let

    sourceRoot = "${src.name}/quint";

-    npmDepsHash = "sha256-UZbATCXqyAulEX+oxLEsT5VPm7y4NiCgnAwyugbzc9g=";
+    npmDepsHash = "sha256-6vKu9OTw68A92uhk1vHYDld5ixUln2tZav8pi55/l4c=";

    npmBuildScript = "compile";

@@ -90,7 +90,7 @@ let
  # Download Apalache. It runs on the JVM, so no need to build it from source.
  apalacheDist = fetchzip {
    url = "https://github.com/apalache-mc/apalache/releases/download/v${apalacheVersion}/apalache.tgz";
-    hash = "sha256-xYQQH9XxPwf3+YmjiRs7XlW49LdHrEnMeuvd16Ir0B4=";
+    hash = "sha256-2Gy+wQOUyuauiGedDNPPHatwcphll3BuL3SD4D12XMI=";
  };
 in
 stdenv.mkDerivation (finalAttrs: {
@@ -10,16 +10,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "rbspy";
-  version = "0.45.0";
+  version = "0.46.0";

  src = fetchFromGitHub {
    owner = "rbspy";
    repo = "rbspy";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-o4YSvPOVi+Q6Nf3PfT0ZqKnC+VQadiCkmVtb8q/os54=";
+    hash = "sha256-TC/0Y/+4rUO+cvZttgJCmDym47bRWW3TvZhJ6MFU+7U=";
  };

-  cargoHash = "sha256-s5MeEEGuz+kCJJ7XAKNbJHfJlqsh/oUCcXw1590CHrc=";
+  cargoHash = "sha256-dxloiguD1u/6khqeorBaozxdLnJiE7KL4/oU4uxJmIU=";

  doCheck = true;

@@ -34,14 +34,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
      --replace-fail "/usr/bin/ruby" "${lib.getExe ruby}"
  '';

-  checkFlags = [
-    "--skip=test_get_trace"
-    "--skip=test_get_trace_when_process_has_exited"
-    "--skip=test_sample_single_process"
-    "--skip=test_sample_single_process_with_time_limit"
-    "--skip=test_sample_subprocesses"
-  ];
-
  nativeBuildInputs = lib.optional stdenv.hostPlatform.isDarwin rustPlatform.bindgenHook;

  nativeCheckInputs = [
@@ -6,13 +6,13 @@

 buildGoModule (finalAttrs: {
  pname = "sem";
-  version = "0.33.1";
+  version = "0.34.0";

  src = fetchFromGitHub {
    owner = "semaphoreci";
    repo = "cli";
    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-+MNl+JOpC3FgzWBVybTDqV6VE4cdBafQ77IYcXO4j48=";
+    sha256 = "sha256-FJn1oTtECPZpBi2LsoAxA2kyS3RY1/5oJGOTZiwitsA=";
  };

  vendorHash = "sha256-XEr/vXamJ7GTRpXNdcVQ9PcUVvQ8EW3pmq/tEZMHSDo=";
@@ -10,13 +10,13 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "shpool";
-  version = "0.9.5";
+  version = "0.9.6";

  src = fetchFromGitHub {
    owner = "shell-pool";
    repo = "shpool";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-4+4R0RnynU8AF6FL+zmokRux7SzDANwLAhbg35okUBQ=";
+    hash = "sha256-Q2sIHOiFP/xj6wO3GNDc53eRwGygAz6nijsUqa3n9v0=";
  };

  postPatch = lib.optionalString stdenv.hostPlatform.isLinux ''
@@ -24,7 +24,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
      --replace-fail '/usr/bin/shpool' "$out/bin/shpool"
  '';

-  cargoHash = "sha256-RHObvJs8hgM3jMLh7sG0EzQcWTRR2vy9e2rS5dUKEeg=";
+  cargoHash = "sha256-SkMPP3FwVMmHnsTIYqZjrjdliWk3YbPHsaRe1rx8sIg=";

  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [ linux-pam ];

@@ -82,7 +82,10 @@ stdenv.mkDerivation (finalAttrs: {
    homepage = "https://sioyek.info/";
    description = "PDF viewer designed for research papers and technical books";
    mainProgram = "sioyek";
-    changelog = "https://github.com/ahrm/sioyek/releases/tag/v${finalAttrs.version}";
+    # no changelog for unstable version, change back to
+    # https://github.com/ahrm/sioyek/releases/tag/v${finalAttrs.version}
+    # once stable again
+    changelog = "https://github.com/ahrm/sioyek/releases";
    license = lib.licenses.gpl3Only;
    maintainers = with lib.maintainers; [
      podocarp
@@ -8,16 +8,16 @@

 buildGoModule (finalAttrs: {
  pname = "zed";
-  version = "0.36.1";
+  version = "1.0.0";

  src = fetchFromGitHub {
    owner = "authzed";
    repo = "zed";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-42c2utcrUOhLwFS7AdsR2/6vtBLo7Vitx3i9k7pFs7o=";
+    hash = "sha256-kF16ZmIOw80esknKJvHYFWrx4FG/kn+Il5xnC1JmAn4=";
  };

-  vendorHash = "sha256-WgTOwXdH1jgK7Un8UA/PX9iYt0VyAGMdpxYVXM6KyWE=";
+  vendorHash = "sha256-e/VrFEKVVAAtClAzFw2XV3cWVmto90qzMKVLpZjKZ8o=";

  ldflags = [ "-X 'github.com/jzelinskie/cobrautil/v2.Version=${finalAttrs.src.tag}'" ];

@@ -1,20 +1,22 @@
 {
  lib,
  rustPlatform,
-  fetchCrate,
+  fetchFromGitHub,
  versionCheckHook,
 }:

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "stylance-cli";
-  version = "0.7.4";
+  version = "0.8.0";

-  src = fetchCrate {
-    inherit (finalAttrs) pname version;
-    hash = "sha256-lGgKmNqZ0nflVAM3GMDwGgxnXyLCqVz1bTUsvabXmj8=";
+  src = fetchFromGitHub {
+    owner = "basro";
+    repo = "stylance-rs";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-YMC7pldkabU669CKeXX5QQOcN974/cZ42nTPphZPq5U=";
  };

-  cargoHash = "sha256-HWZQNEKTyNnmA1twN5cfo5RY2tOeCnL6zEp+M4F+Tqg=";
+  cargoHash = "sha256-hn1nEnihgWtj1JaRcUZTm6lrThnugUMs6mAs0lsWpbU=";

  nativeInstallCheckInputs = [ versionCheckHook ];
  doInstallCheck = true;
@@ -12,7 +12,7 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "sydbox";
-  version = "3.49.1";
+  version = "3.51.2";

  outputs = [
    "out"
@@ -24,10 +24,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
    owner = "Sydbox";
    repo = "sydbox";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-TFPN0KvzO+tNlt9EWEx7MC3DNC3+CzHJn2MfMWpwOp4=";
+    hash = "sha256-tOHd+E68LXK5AZzcNcf2p/ONyO4EXjF+xYDWftLG/pU=";
  };

-  cargoHash = "sha256-yrsJrZ4rDBYlapz/O+1l4h6MIAgZ0PpYm68OFfeHb8A=";
+  cargoHash = "sha256-wkrbj553N5icVndoXwCvFGCWYnU+qg3gcADgoFHLeZc=";

  nativeBuildInputs = [
    mandoc
@@ -34,8 +34,8 @@ stdenv.mkDerivation (finalAttrs: {

  env = {
    # By no known reason libtirpc is not detected
-    NIX_CFLAGS_COMPILE = toString [ "-I${libtirpc.dev}/include/tirpc" ];
-    NIX_LDFLAGS = [ "-ltirpc" ];
+    NIX_CFLAGS_COMPILE = "-I${lib.getDev libtirpc}/include/tirpc";
+    NIX_LDFLAGS = "-ltirpc";
  };

  postPatch = ''
@@ -9,13 +9,13 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "thin-provisioning-tools";
-  version = "1.3.1";
+  version = "1.3.2";

  src = fetchFromGitHub {
    owner = "jthornber";
    repo = "thin-provisioning-tools";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-hOwW2zda/KdA22A+94A5r2LIezQTZ71eewhkc72u5kI=";
+    hash = "sha256-hRGelBHFbyWHwV3fRecGXIEhoDzVQ+Rdj/VHGxcDH1k=";
  };

  strictDeps = true;
@@ -32,7 +32,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    udev
  ];

-  cargoHash = "sha256-f417GApMA1R7nX75Zkfv28aZskbpTkUHWePX30X22FU=";
+  cargoHash = "sha256-y3uvPwLps8edzO9GtJ1CpB55kieclk06PjOYsYs64go=";

  passthru.tests = {
    inherit (nixosTests.lvm2) lvm-thinpool-linux-latest;
@@ -161,10 +161,10 @@
  };

  blueprint = {
-    version = "0-unstable-2025-06-17";
+    version = "0-unstable-2026-04-18";
    url = "github:smrtrfszm/tree-sitter-blueprint";
-    rev = "de66f283c6c9b7c270d766c2e4cf95535650ec48";
-    hash = "sha256-zmMJZAxyKO42gIK3cWP/LuoPIo2+xr6fEDeHXknqa7M=";
+    rev = "f2b043912ffbfcf4e9e8d09709b86ab39a4b78ea";
+    hash = "sha256-tcy4FIQ/59PeSHIXX8YmbBX5lK0acKahePT2/xKzYyM=";
    meta = {
      license = lib.licenses.mit;
      maintainers = with lib.maintainers; [
@@ -198,10 +198,10 @@
  };

  caddyfile = {
-    version = "0-unstable-2025-12-16";
+    version = "0-unstable-2026-04-06";
    url = "github:caddyserver/tree-sitter-caddyfile";
-    rev = "2b816940b5bf4f86c650aded24500cb5b682f1a1";
-    hash = "sha256-C/dTDm4X+VxtNZaqb2AHgcDZyGeBN9VMwZjSzJVEHGo=";
+    rev = "6e62b4e297c955f050a6542a8d24df2f223a90e8";
+    hash = "sha256-a/ioYTQBFueZTtzoDre7UD6h5NluZ8gQc+8yTrj2Goc=";
    meta = {
      license = lib.licenses.mit;
      maintainers = with lib.maintainers; [
@@ -237,10 +237,10 @@
  };

  cel = {
-    version = "0-unstable-2024-02-13";
+    version = "0-unstable-2026-03-04";
    url = "github:bufbuild/tree-sitter-cel";
-    rev = "df0585025e6f50cdb07347f5009ae3f47c652890";
-    hash = "sha256-Fyq56kzu1bL44QhrF3ZnKWgsoPRh3tjTRi2CynNQGfw=";
+    rev = "fd2e8efaa07e71e46dcc1d5c4c85556a742d8c36";
+    hash = "sha256-f/Gpsp+Se3lSguz89vWDf3gGaefnwpHCp4Bzfz6y29I=";
    meta = {
      license = lib.licenses.asl20;
      maintainers = with lib.maintainers; [
@@ -410,20 +410,13 @@
  };

  dart = {
-    version = "0-unstable-2025-10-04";
+    version = "0-unstable-2026-03-14";
    url = "github:usernobody14/tree-sitter-dart";
-    rev = "d4d8f3e337d8be23be27ffc35a0aef972343cd54";
-    hash = "sha256-1ftYqCor1A0PsQ0AJLVqtxVRZxaXqE/NZ5yy7SizZCY=";
+    rev = "0fc19c3a57b1109802af41d2b8f60d8835c5da3a";
+    hash = "sha256-yK4XfjVPABFHf8MjoDge6bmapcybhdIF+49rlXFP+pw=";
    meta = {
      license = lib.licenses.mit;
    };
-    patches = [
-      (fetchpatch {
-        name = "Fix invalid `tree-sitter.json`";
-        url = "https://github.com/UserNobody14/tree-sitter-dart/commit/81638dbbdb76a0e88ea8c31b95ec76b9625ddb84.diff";
-        hash = "sha256-oaxuKQPN/gprO4OFWYItkj5dqd2xlq3SV6qr4YkSFjM=";
-      })
-    ];
  };

  dbml = {
@@ -487,7 +480,7 @@

  djot = {
    version = "0-unstable-2025-09-15";
-    url = "github:treeman/tree-sitter-djot";
+    url = "codeberg:treeman/tree-sitter-djot";
    rev = "74fac1f53c6d52aeac104b6874e5506be6d0cfe6";
    hash = "sha256-HfEZHNhxEbH07gDzLPdl6n2Pf//o8tbJvwE+tesJDC8=";
    meta = {
@@ -667,10 +660,10 @@
  };

  fga = {
-    version = "0-unstable-2025-12-17";
+    version = "0-unstable-2026-03-19";
    url = "github:matoous/tree-sitter-fga";
-    rev = "e763d12cfd8569494215f304bc2b0074c84709e9";
-    hash = "sha256-d1gvEoJosBcEiq4fxb+1LFcdSkuOWGXyG1cC44Lo19o=";
+    rev = "ce72d1c484ba133a18e966d67be66bce85695451";
+    hash = "sha256-8op8IFKh3dZY02Yiehvqz1XyeOw9qSoe0f31M4yzw1U=";
    meta = {
      license = lib.licenses.mit;
      maintainers = with lib.maintainers; [
@@ -820,10 +813,14 @@
  };

  git-rebase = {
-    version = "0-unstable-2024-07-22";
+    version = "1.0.0";
    url = "github:the-mikedavis/tree-sitter-git-rebase";
-    rev = "bff4b66b44b020d918d67e2828eada1974a966aa";
-    hash = "sha256-k4C7dJUkvQxIxcaoVmG2cBs/CeYzVqrip2+2mRvHtZc=";
+    hash = "sha256-EV/Ecfzu3jZ5BQynRxn8NJ+lfi9i5ixs+u1e72uZBJA=";
+    postPatch = ''
+      # The funding url is empty, which will result in failing tests for the python package
+      # tree-sitter-grammars.tree-sitter.git-rebase.
+      jq 'del(.metadata.links.funding)' tree-sitter.json > tree-sitter.json.tmp && mv tree-sitter.json.tmp tree-sitter.json
+    '';
    meta = {
      license = lib.licenses.mit;
      maintainers = with lib.maintainers; [
@@ -1028,10 +1025,10 @@
  };

  groovy = {
-    version = "0-unstable-2025-01-22";
+    version = "0-unstable-2026-04-11";
    url = "github:murtaza64/tree-sitter-groovy";
-    rev = "86911590a8e46d71301c66468e5620d9faa5b6af";
-    hash = "sha256-652wluH2C3pYmhthaj4eWDVLtEvvVIuu70bJNnt5em0=";
+    rev = "deb0dcf8c4544f07564060f6e9b9f6e4b0bfc27d";
+    hash = "sha256-x7PawYYtgsduh60KNnS4LgB7SvoBV9aOJ9cHNsLBBhc=";
    meta = {
      license = lib.licenses.mit;
      maintainers = with lib.maintainers; [
@@ -1465,20 +1462,20 @@
  };

  ledger = {
-    version = "0-unstable-2025-05-04";
+    version = "0-unstable-2026-03-20";
    url = "github:cbarrete/tree-sitter-ledger";
-    rev = "96c92d4908a836bf8f661166721c98439f8afb80";
-    hash = "sha256-L2xUTItnQ/bcieasItrozjAEJLm/fsUUyMex2juCnjw=";
+    rev = "22a1ab8195c1f6e808679f803007756fe7638c6f";
+    hash = "sha256-62xgcEavI5RKi77sbEnx9f3hA4faFeUCw0/uec8Nx3k=";
    meta = {
      license = lib.licenses.mit;
    };
  };

  llvm = {
-    version = "0-unstable-2024-10-07";
+    version = "0-unstable-2025-08-22";
    url = "github:benwilliamgraham/tree-sitter-llvm";
-    rev = "c14cb839003348692158b845db9edda201374548";
-    hash = "sha256-L3XwPhvwIR/mUbugMbaHS9dXyhO7bApv/gdlxQ+2Bbo=";
+    rev = "2914786ae6774d4c4e25a230f4afe16aa68fe1c1";
+    hash = "sha256-jBSotMFsBUcgQrWH5p8EiywG00+v9QqePcUTI6ZqAkw=";
    meta = {
      license = lib.licenses.mit;
    };
@@ -1547,10 +1544,10 @@
  };

  mail = {
-    version = "0-unstable-2025-04-09";
+    version = "0-unstable-2026-03-08";
    url = "github:ficcdaf/tree-sitter-mail";
-    rev = "c84126474aee00ce67c32229710a4e1e09827a08";
-    hash = "sha256-qqy7jsqsWVUlRuk+Cv+n3sEiH/SlO5/4Q+mrcftFKP4=";
+    rev = "5eddbfdbec4c893182c79047499901c196332e78";
+    hash = "sha256-ax9MlBuat3SmYJE5lkuTSula0A/RKoHljSqi9UZ2wO8=";
    meta = {
      license = lib.licenses.mit;
      maintainers = with lib.maintainers; [
@@ -1643,10 +1640,10 @@
  };

  mojo = {
-    version = "0-unstable-2024-12-07";
+    version = "0-unstable-2025-12-25";
    url = "github:lsh/tree-sitter-mojo";
-    rev = "564d5a8489e20e5f723020ae40308888699055c0";
-    hash = "sha256-UY4gTG9HI/agpD+2syb7lUqfZpw6I6UnKzs9zE9JFwA=";
+    rev = "03966fb3f209bea86844aab3bd0f2158a5a8bb8d";
+    hash = "sha256-Ofc8Z1q0Rxb3q4iYMtnKanUdnpGetE8A8sl+Sr1t3PA=";
    meta = {
      license = lib.licenses.mit;
      maintainers = with lib.maintainers; [
@@ -1753,10 +1750,10 @@
  };

  nu = {
-    version = "0-unstable-2025-12-13";
+    version = "0-unstable-2026-04-22";
    url = "github:nushell/tree-sitter-nu";
-    rev = "4c149627cc592560f77ead1c384e27ec85926407";
-    hash = "sha256-h02kb3VxSK/fxQENtj2yaRmAQ5I8rt5s5R8VrWOQWeo=";
+    rev = "348b787d8b0409091d85fe9d4eb007fe9f3406bb";
+    hash = "sha256-OL3fqHjimJ9VrR2UoeIdLxKKcsA1J80A9T8GSBO9KwE=";
    meta = {
      license = lib.licenses.mit;
    };
@@ -2202,10 +2199,10 @@
  };

  razor = {
-    version = "0-unstable-2025-02-17";
+    version = "0-unstable-2026-04-20";
    url = "github:tris203/tree-sitter-razor";
-    rev = "fe46ce5ea7d844e53d59bc96f2175d33691c61c5";
-    hash = "sha256-E4fgy588g6IP258TS2DvoILc1Aikvpfbtq20VIhBE4U=";
+    rev = "a3399c26610817c6d32c7643793caf3729cfb6d2";
+    hash = "sha256-hH3qIp5IKwOyxiQXlS2NnuTbt/ssNMEV8PaL1xDMi+g=";
    meta = {
      license = lib.licenses.mit;
      maintainers = with lib.maintainers; [
@@ -2236,10 +2233,10 @@
  };

  rego = {
-    version = "0-unstable-2024-06-12";
+    version = "0-unstable-2026-01-14";
    url = "github:FallenAngel97/tree-sitter-rego";
-    rev = "20b5a5958c837bc9f74b231022a68a594a313f6d";
-    hash = "sha256-XwlVsOlxYzB0x+T05iuIp7nFAoQkMByKiHXZ0t5QsjI=";
+    rev = "ddd39af81fe8b0288102a7cb97959dfce723e0f3";
+    hash = "sha256-I6jZ5jsJUAdjQti/lj4d11+GRSHjbN/hoGYO7ezGKv8=";
    meta = {
      license = lib.licenses.mit;
    };
@@ -2375,10 +2372,10 @@
  };

  slint = {
-    version = "0-unstable-2025-12-09";
+    version = "0-unstable-2026-04-17";
    url = "github:slint-ui/tree-sitter-slint";
-    rev = "10fb0f188d7950400773c06ba6c31075866e14bf";
-    hash = "sha256-60DfIx7aQqe0/ocxbpr00eU3IPs23E8TUILcVGrBYVs=";
+    rev = "68b25244cec6eb9d7f8f790ef781c29c822d8f84";
+    hash = "sha256-ugdB7gN3zTAGLm9Jk2hjuuZWxIYxEWYXW72qLpXM+1Q=";
    meta = {
      license = lib.licenses.mit;
    };
@@ -2796,10 +2793,10 @@
  };

  typespec = {
-    version = "0-unstable-2025-06-21";
+    version = "0-unstable-2026-01-01";
    url = "github:happenslol/tree-sitter-typespec";
-    rev = "814c98283fd92a248ba9d49ebfe61bc672a35875";
-    hash = "sha256-3/zNoawx1DsKmG0KFvJD+o80IMBsJd2VV2ng+fSrV1c=";
+    rev = "395bef1e1eb4dd18365401642beb534e8a244056";
+    hash = "sha256-N+clb40CgGzjyvC9b/qMhbSUZ6VsLJzK7N1k5iq2seY=";
    meta = {
      license = lib.licenses.mit;
      maintainers = with lib.maintainers; [
@@ -2892,10 +2889,10 @@
  };

  vento = {
-    version = "0-unstable-2024-12-30";
+    version = "0-unstable-2026-02-23";
    url = "github:ventojs/tree-sitter-vento";
-    rev = "3b32474bc29584ea214e4e84b47102408263fe0e";
-    hash = "sha256-h8yC+MJIAH7DM69UQ8moJBmcmrSZkxvWrMb+NqtYB2Y=";
+    rev = "4569bc1fb81f050ca4ef3ceefdd31cfeb35c4f0a";
+    hash = "sha256-qD+O3gV/PGCdhv0nAlAi1ZeUmGSEfcKcbnipfZyex4g=";
    meta = {
      license = lib.licenses.mit;
      maintainers = with lib.maintainers; [
@@ -7,14 +7,14 @@

 python3.pkgs.buildPythonApplication (finalAttrs: {
  pname = "troubadix";
-  version = "26.4.4";
+  version = "26.4.6";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "greenbone";
    repo = "troubadix";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-OByl6SYPgM6pFp2OQyHMZHGr3JJ4kTJTZByWjdEnF7c=";
+    hash = "sha256-wZpxwgIGvl4cVpPNrsYa5eGbAUgdf4lOxP2f537FYQI=";
  };

  pythonRelaxDeps = [
@@ -8,13 +8,13 @@
 }:
 buildGoModule (finalAttrs: {
  pname = "turso-cli";
-  version = "1.0.20";
+  version = "1.0.21";

  src = fetchFromGitHub {
    owner = "tursodatabase";
    repo = "turso-cli";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-Vby81LYVEqysUmPU1P5d+VEME/SVYch14m1Mj7YvOXc=";
+    hash = "sha256-EO8j5XMwezSpTYVPpgoonTlNph7fCINXQoByUhlljDc=";
  };

  vendorHash = "sha256-Cb4/KA9jfI/pNHbJqLWtm9oEXfMHGBS46J9o3lL4/Tk=";
@@ -39,7 +39,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
  '';

  meta = {
-    changelog = "https://github.com/AndyCappDev/tuxbox/releases/tag/${finalAttrs.version}";
+    changelog = "https://github.com/AndyCappDev/tuxbox/releases/tag/v${finalAttrs.version}";
    description = "Linux driver for all TourBox models - Native feel with USB, Bluetooth, haptics and graphical configuration GUI";
    homepage = "https://github.com/AndyCappDev/tuxbox";
    license = lib.licenses.mit;
@@ -0,0 +1,70 @@
+{
+  lib,
+  stdenv,
+  rustPlatform,
+  fetchFromGitHub,
+  installShellFiles,
+  pkg-config,
+  withBubblewrap ? stdenv.isLinux,
+  makeBinaryWrapper,
+  xz,
+  zstd,
+  writableTmpDirAsHomeHook,
+  bubblewrap,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "unnix";
+  version = "0.1.1";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "figsoda";
+    repo = "unnix";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-ZmCagknLEJlAtoVfHrQZeb3CbxpT37J6Mvyxn/qQRmQ=";
+  };
+
+  cargoHash = "sha256-NXyB1Ic2EnLJPpFDn1idb5WYfS8gXzgvIRbQoJ3bsS8=";
+
+  nativeBuildInputs = [
+    installShellFiles
+    pkg-config
+  ]
+  ++ lib.optionals withBubblewrap [
+    makeBinaryWrapper
+  ];
+
+  buildInputs = [
+    xz
+    zstd
+  ];
+
+  # tests try to access ~/.cache/unnix
+  nativeCheckInputs = [
+    writableTmpDirAsHomeHook
+  ];
+
+  env = {
+    GENERATE_ARTIFACTS = "artifacts";
+    ZSTD_SYS_USE_PKG_CONFIG = true;
+  };
+
+  postInstall = ''
+    installManPage artifacts/*.1
+    installShellCompletion artifacts/unnix.{bash,fish} --zsh artifacts/_unnix
+  ''
+  + lib.optionalString withBubblewrap ''
+    wrapProgram $out/bin/unnix \
+      --prefix PATH : ${lib.makeBinPath [ bubblewrap ]}
+  '';
+
+  meta = {
+    description = "Reproducible Nix environments without installing Nix";
+    homepage = "https://github.com/figsoda/unnix";
+    changelog = "https://github.com/figsoda/unnix/blob/${finalAttrs.src.rev}/CHANGELOG.md";
+    license = lib.licenses.mpl20;
+    maintainers = with lib.maintainers; [ figsoda ];
+    mainProgram = "unnix";
+  };
+})
@@ -10,15 +10,15 @@
 }:
 buildGo125Module (finalAttrs: {
  pname = "usque";
-  version = "2.0.1";
+  version = "3.0.0";
  src = fetchFromGitHub {
    owner = "Diniboy1123";
    repo = "usque";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-veAUc2LeH2NoOs3AHj8GUr7zBPidHtr+JlUQjgo/WQQ=";
+    hash = "sha256-xgndE4kfR7LVLBvcxJ68Yq0NLN+8zyciMYaP9K+qS9M=";
  };

-  vendorHash = "sha256-pilBazQcrfCcgBCo9U9jGo/ZcuXLBR3kT8l+mad+umg=";
+  vendorHash = "sha256-29f/5PnmqaVS8PP1xVksgszFk3GyYZXXGDD1hjE/iSA=";

  ldflags = [
    "-s"
@@ -43,11 +43,11 @@ let
    # fat binary
    aarch64-darwin = x86_64-darwin;
  };
-  unpackIso =
-    runCommand "ut1999-iso"
+  baseGame =
+    runCommand "ut1999-iso1"
      {
        # This upload of the game is officially sanctioned by OldUnreal (who has received permission from Epic Games to link to archive.org) and the UT99.org community
-        # This is a copy of the original Unreal Tournament: Game of the Year Edition (also known as UT or UT99).
+        # This is a copy of the original Unreal Tournament: Game of the Year Edition (also known as UT or UT99). The first ISO contains the base game.
        src = fetchurl {
          url = "https://archive.org/download/ut-goty/UT_GOTY_CD1.iso";
          hash = "sha256-4YSYTKiPABxd3VIDXXbNZOJm4mx0l1Fhte1yNmx0cE8=";
@@ -59,6 +59,21 @@ let
        mkdir $out
        cp -r Music Sounds Textures Maps $out
      '';
+  bonusPacks =
+    runCommand "ut1999-iso2"
+      {
+        # The second ISO contains bonus maps and game modes
+        src = fetchurl {
+          url = "https://archive.org/download/ut-goty/UT_GOTY_CD2.iso";
+          hash = "sha256-2V2O4c+VVi7gI/1UA17IgT1CdfY9GEdCMiCYbtyNANg=";
+        };
+        nativeBuildInputs = [ libarchive ];
+      }
+      ''
+        bsdtar -xvf "$src"
+        mkdir $out
+        cp -r System Sounds Textures maps $out
+      '';
  systemDir =
    rec {
      x86_64-linux = "System64";
@@ -137,26 +152,33 @@ stdenv.mkDerivation (finalAttrs: {
      # NOTE: OldUnreal patch doesn't include these folders on linux but could in the future
      # on darwin it does, but they are empty
      rm -rf ./{Music,Sounds}
-      ln -s ${unpackIso}/{Music,Sounds} .
+      cp -r ${baseGame}/{Music,Sounds} .
+      chmod u+w ./Sounds
+      cp -n ${bonusPacks}/Sounds/* ./Sounds
+      cp -n ${bonusPacks}/System/*.{u,int} ./System
    ''
    + lib.optionalString (stdenv.hostPlatform.isLinux) ''
-      # maps need no post-processing on linux, therefore linking them is ok
+      # maps need no post-processing on linux
      rm -rf ./Maps
-      ln -s ${unpackIso}/Maps .
+      cp -r ${baseGame}/Maps .
+      chmod u+w ./Maps
+      cp -n ${bonusPacks}/maps/* ./Maps
    ''
    + lib.optionalString (stdenv.hostPlatform.isDarwin) ''
-      # Maps need post-processing on darwin, therefore need to be copied
-      cp -n ${unpackIso}/Maps/* ./Maps || true
+      # Maps need post-processing on darwin
+      cp -n ${baseGame}/Maps/* ./Maps || true
+      cp -n ${bonusPacks}/maps/* ./Maps || true
      # unpack compressed maps with ucc (needs absolute paths)
      for map in $PWD/Maps/*.uz; do ./UCC decompress $map; done
      mv ${systemDir}/*.unr ./Maps || true
      rm ./Maps/*.uz
    ''
    + ''
-      cp -n ${unpackIso}/Textures/* ./Textures || true
+      cp -n ${baseGame}/Textures/* ./Textures || true
+      cp -n ${bonusPacks}/Textures/* ./Textures || true
    ''
    + lib.optionalString (stdenv.hostPlatform.isLinux) ''
-      cp -n ${unpackIso}/System/*.{u,int} ./System || true
+      cp -n ${baseGame}/System/*.{u,int} ./System || true
      ln -s "$out/${systemDir}/ut-bin" "$out/bin/ut1999"
      ln -s "$out/${systemDir}/ucc-bin" "$out/bin/ut1999-ucc"

@@ -11,16 +11,16 @@

 buildNpmPackage (finalAttrs: {
  pname = "vega-lite";
-  version = "6.4.2";
+  version = "6.4.3";

  src = fetchFromGitHub {
    owner = "vega";
    repo = "vega-lite";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-UQEgZk9SZTSKiAfOvBxnpkyiih9QcSv08O8vt4ooeYQ=";
+    hash = "sha256-bsPnvUleHrihsoOL98O8KTbiONx3FNuQjH9vrZ/bLTw=";
  };

-  npmDepsHash = "sha256-EOJGMmIObN4XCC4ZbZQQ89X12+STKejt6vugyIb7v0A=";
+  npmDepsHash = "sha256-dni2tEYzE/AzgGldCAtBpmQK24kIRck0KQXvD2e5xfw=";

  nativeBuildInputs = [
    pkg-config
@@ -20,16 +20,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "walker";
-  version = "2.16.0";
+  version = "2.16.1";

  src = fetchFromGitHub {
    owner = "abenz1267";
    repo = "walker";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-ugacgbPxYM68pAcQRceuSlCWtUEuddltMUzAWrnWlHA=";
+    hash = "sha256-ZoLkqwPVw8SdW+f9Raf15/ttyKqmC6vtKd5R+orNN/g=";
  };

-  cargoHash = "sha256-MPjMB5TsrJd28QuEoIDRJjM+SE0cTNCO5PRW+I+/CHE=";
+  cargoHash = "sha256-LoQiovL1DsM63VBFiIPoizaEbH3yFjN9DLUh4wXsRvQ=";

  nativeBuildInputs = [
    gobject-introspection
@@ -6,16 +6,16 @@

 buildGoModule (finalAttrs: {
  pname = "webdav";
-  version = "5.11.6";
+  version = "5.11.7";

  src = fetchFromGitHub {
    owner = "hacdias";
    repo = "webdav";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-iTBh6cH7is7UnbbXhn+z/Tnvq5//Jdt1OlPHNfICVUw=";
+    hash = "sha256-xvkkOesOFcgT1OTm0X87eKFdKjEZpMu8Pw+YRTGjJlI=";
  };

-  vendorHash = "sha256-L98EShwiysMYXhI6aQut5bfMr76CwY1U06iOgG+jtCY=";
+  vendorHash = "sha256-fSFVqZZXkhFeJPompd6mg+zNV40k5C3pJSjrXiiaPJ8=";

  __darwinAllowLocalNetworking = true;

@@ -10,13 +10,13 @@

 stdenv.mkDerivation rec {
  pname = "libdbusmenu-lxqt";
-  version = "0.3.0";
+  version = "0.4.0";

  src = fetchFromGitHub {
    owner = "lxqt";
    repo = "libdbusmenu-lxqt";
    rev = version;
-    hash = "sha256-PqX8ShSu3CYN9XIRp6IjVmr/eKH+oLNhXvwiudUH660=";
+    hash = "sha256-5X73kRUtOYeqBEIw2ctUnwXnWKPHDaoT489yT5nugZw=";
  };

  nativeBuildInputs = [
@@ -15,7 +15,7 @@
  qttools,
  wrapQtAppsHook,
  gitUpdater,
-  version ? "2.3.1",
+  version ? "2.4.0",
  qtx11extras ? null,
 }:

@@ -30,7 +30,7 @@ stdenv.mkDerivation (finalAttrs: {
    hash =
      {
        "1.4.0" = "sha256-QxPYSA7537K+/dRTxIYyg+Q/kj75rZOdzlUsmSdQcn4=";
-        "2.3.1" = "sha256-2PDVNMBwzDpUOkZ7GnrWDMlXBeUgCyZ6vHXurW6fr4s=";
+        "2.4.0" = "sha256-gfyskv/TpAdBES0+O1MrrkQqTDqtAGtDMIwv3NF7pnE=";
      }
      ."${finalAttrs.version}";
  };
@@ -16,13 +16,13 @@

 stdenv.mkDerivation rec {
  pname = "liblxqt";
-  version = "2.3.0";
+  version = "2.4.0";

  src = fetchFromGitHub {
    owner = "lxqt";
    repo = "liblxqt";
    rev = version;
-    hash = "sha256-KAteTQRJ7xfh21tYcNoZjvLfWSiUYboasqL5D4YKARo=";
+    hash = "sha256-kGKgKpgiK40933O3T/astH0X1Y4oIH6kEKjjMBh43MA=";
  };

  nativeBuildInputs = [
@@ -8,7 +8,7 @@
  lxqt-build-tools,
  wrapQtAppsHook,
  gitUpdater,
-  version ? "4.3.0",
+  version ? "4.4.0",
 }:

 stdenv.mkDerivation (finalAttrs: {
@@ -22,7 +22,7 @@ stdenv.mkDerivation (finalAttrs: {
    hash =
      {
        "3.12.0" = "sha256-y+3noaHubZnwUUs8vbMVvZPk+6Fhv37QXUb//reedCU=";
-        "4.3.0" = "sha256-aec+NjKkaH8dI0cFVxGehdRGO2aH6BD+aix+IvD+2LI=";
+        "4.4.0" = "sha256-9Hj5RnPWtqRkzhrAuXoHnMAQloFbnF/8koPT8ExfSAs=";
      }
      ."${finalAttrs.version}";
  };
@@ -21,13 +21,13 @@

 stdenv.mkDerivation rec {
  pname = "lximage-qt";
-  version = "2.3.0";
+  version = "2.4.0";

  src = fetchFromGitHub {
    owner = "lxqt";
    repo = "lximage-qt";
    rev = version;
-    hash = "sha256-RJKXcaZJe5gyDubdglOmzmJ9XCH0gAW4fc7OR3anCoU=";
+    hash = "sha256-ThP7MuAKysJ/Q/JSO12CuwCt6mCU5tZ2DiKEO0Nfg3U=";
  };

  nativeBuildInputs = [
@@ -16,13 +16,13 @@

 stdenv.mkDerivation rec {
  pname = "lxqt-about";
-  version = "2.3.0";
+  version = "2.4.0";

  src = fetchFromGitHub {
    owner = "lxqt";
    repo = "lxqt-about";
    rev = version;
-    hash = "sha256-EP0Sd/VvLufqtn/7ZQwdI/h+BJhkGks7jTlEoEqYWgk=";
+    hash = "sha256-wJ4KJ+gSj0sdlO1l68RzAaOM8HxdPP6S1gWCoRfRZ3c=";
  };

  nativeBuildInputs = [
@@ -18,13 +18,13 @@

 stdenv.mkDerivation rec {
  pname = "lxqt-admin";
-  version = "2.3.0";
+  version = "2.4.0";

  src = fetchFromGitHub {
    owner = "lxqt";
    repo = "lxqt-admin";
    rev = version;
-    hash = "sha256-FzYKmqCd61jLfbyPknsWuf7KpdF+SoAMqeSEZPOYc8w=";
+    hash = "sha256-SNEOqyLIDlOio4LttsCUgC/EnGcCSDTwPxhJo1lEvJE=";
  };

  nativeBuildInputs = [
@@ -18,13 +18,13 @@

 stdenv.mkDerivation rec {
  pname = "lxqt-archiver";
-  version = "1.3.0";
+  version = "1.4.0";

  src = fetchFromGitHub {
    owner = "lxqt";
    repo = "lxqt-archiver";
    rev = version;
-    hash = "sha256-57ufvirD1YYEVoFtX/JY8EnMRWZ4ouhbxNm8przg5XA=";
+    hash = "sha256-f8s29INIJeqmPr6BWqQxYWWkjbG1wy+bUYZSy2OECKg=";
  };

  nativeBuildInputs = [
@@ -9,7 +9,7 @@
  perl,
  wrapQtAppsHook,
  gitUpdater,
-  version ? "2.3.0",
+  version ? "2.4.0",
 }:

 stdenv.mkDerivation rec {
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
    hash =
      {
        "0.13.0" = "sha256-4/hVlEdqqqd6CNitCRkIzsS1R941vPJdirIklp4acXA=";
-        "2.3.0" = "sha256-lbDcIOrOkGU/n0bPPAlZSsdBYMlBh3afXwwTkTWQLpo=";
+        "2.4.0" = "sha256-PvDXL4hHaHeHt7CXeNCj8L2bv3YYY78ZDTxsctc73fo=";
      }
      ."${version}";
  };
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
    substituteInPlace cmake/modules/LXQtCompilerSettings.cmake \
      --replace-fail AppleClang Clang
  ''
-  + lib.optionalString (lib.versionOlder version "2.3.0") ''
+  + lib.optionalString (lib.versionOlder version "2.4.0") ''
    substituteInPlace CMakeLists.txt \
      --replace-fail "cmake_minimum_required(VERSION 3.1.0 FATAL_ERROR)" "cmake_minimum_required(VERSION 3.10)"
  '';
@@ -28,13 +28,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "lxqt-config";
-  version = "2.3.1";
+  version = "2.4.0";

  src = fetchFromGitHub {
    owner = "lxqt";
    repo = "lxqt-config";
    tag = finalAttrs.version;
-    hash = "sha256-2fviPhSBwUU9jg3217PLbREh8MkArd2Uc4bhFXo2J7U=";
+    hash = "sha256-BG3+/QZkqCZp7kdaHgiruOMq506l8+9KKNq+IUgoTPw=";
  };

  nativeBuildInputs = [
@@ -16,13 +16,13 @@

 stdenv.mkDerivation rec {
  pname = "lxqt-globalkeys";
-  version = "2.3.0";
+  version = "2.4.0";

  src = fetchFromGitHub {
    owner = "lxqt";
    repo = "lxqt-globalkeys";
    rev = version;
-    hash = "sha256-ahRKkWmr6BkSByE5Vm5oqkkgQQ0Hyh4Ka7PYI8Es7AY=";
+    hash = "sha256-VhySpJYHdi17U4yJBWXEWE2KEyG7AVcWYLpYXr2iCyc=";
  };

  nativeBuildInputs = [
@@ -11,13 +11,13 @@

 stdenv.mkDerivation rec {
  pname = "lxqt-menu-data";
-  version = "2.3.0";
+  version = "2.4.0";

  src = fetchFromGitHub {
    owner = "lxqt";
    repo = "lxqt-menu-data";
    rev = version;
-    hash = "sha256-9TYW3VA4qGlrkUzgZGkxf8RkIW2cTLkY6H8JHGDnoLg=";
+    hash = "sha256-Bu/M88VInCD6DzKFLjE3gZ5odJa0tvJ0EXHeLCBlgLw=";
  };

  nativeBuildInputs = [
@@ -18,13 +18,13 @@

 stdenv.mkDerivation rec {
  pname = "lxqt-notificationd";
-  version = "2.3.1";
+  version = "2.4.0";

  src = fetchFromGitHub {
    owner = "lxqt";
    repo = "lxqt-notificationd";
    rev = version;
-    hash = "sha256-TfTOuarMq2m5rAdcfiKqjyGeJzKyUSvhkJ2EoGUMTUQ=";
+    hash = "sha256-o+J7xg60T0WsznDOrfg7EjNlT9FQFbniNkvgkF12N0Q=";
  };

  nativeBuildInputs = [
@@ -17,13 +17,13 @@

 stdenv.mkDerivation rec {
  pname = "lxqt-openssh-askpass";
-  version = "2.3.0";
+  version = "2.4.0";

  src = fetchFromGitHub {
    owner = "lxqt";
    repo = "lxqt-openssh-askpass";
    rev = version;
-    hash = "sha256-f8v9HBuL78YOauipCnMRIEydudFilpFJz+KgMlnJWGU=";
+    hash = "sha256-87soVKVcC3B6Wm7iRy15k/rjLb9OX/2se0btIOyKA6Q=";
  };

  nativeBuildInputs = [
@@ -35,13 +35,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "lxqt-panel";
-  version = "2.3.2";
+  version = "2.4.0";

  src = fetchFromGitHub {
    owner = "lxqt";
    repo = "lxqt-panel";
    tag = finalAttrs.version;
-    hash = "sha256-n/U2EgEZfh8mJWtEX+HByqHqtm9NqIXnURqUzSOcvns=";
+    hash = "sha256-6A22/zBeR04KQXfEMOHefNABB//qWhFSZ8c+6CA3Ni4=";
  };

  nativeBuildInputs = [
--- a/Show More
+++ b/Show More