Merge remote-tracking branch 'origin/master' into staging-next

2025-06-11 05:13:32 +02:00
parent cbf41825bb c8a2be1d50
commit 8cfa86cf70
117 changed files with 7040 additions and 1838 deletions
@@ -76,7 +76,13 @@ in
  inherit pkgs fmt;
  requestReviews = pkgs.callPackage ./request-reviews { };
  codeownersValidator = pkgs.callPackage ./codeowners-validator { };
-  eval = pkgs.callPackage ./eval { };
+
+  # FIXME(lf-): it might be useful to test other Nix implementations
+  # (nixVersions.stable and Lix) here somehow at some point to ensure we don't
+  # have eval divergence.
+  eval = pkgs.callPackage ./eval {
+    nix = pkgs.nixVersions.latest;
+  };

  # CI jobs
  lib-tests = import ../lib/tests/release.nix { inherit pkgs; };
@@ -1,15 +1,23 @@
+# Evaluates all the accessible paths in nixpkgs.
+# *This only builds on Linux* since it requires the Linux sandbox isolation to
+# be able to write in various places while evaluating inside the sandbox.
+#
+# This file is used by nixpkgs CI (see .github/workflows/eval.yml) as well as
+# being used directly as an entry point in Lix's CI (in `flake.nix` in the Lix
+# repo).
+#
+# If you know you are doing a breaking API change, please ping the nixpkgs CI
+# maintainers and the Lix maintainers (`nix eval -f . lib.teams.lix`).
 {
  callPackage,
  lib,
  runCommand,
  writeShellScript,
-  writeText,
  symlinkJoin,
  time,
  procps,
-  nixVersions,
+  nix,
  jq,
-  python3,
 }:

 let
@@ -31,8 +39,6 @@ let
      );
    };

-  nix = nixVersions.latest;
-
  supportedSystems = builtins.fromJSON (builtins.readFile ../supportedSystems.json);

  attrpathsSuperset =
@@ -433,6 +433,8 @@ let
        pathHasContext
        canCleanSource
        pathIsGitRepo
+        revOrTag
+        repoRevToName
        ;
      inherit (self.modules)
        evalModules
@@ -3,7 +3,7 @@

 # Tested in lib/tests/sources.sh
 let
-  inherit (builtins)
+  inherit (lib.strings)
    match
    split
    storeDir
@@ -403,6 +403,101 @@ let
      };
    };

+  # urlToName : (URL | Path | String) -> String
+  #
+  # Transform a URL (or path, or string) into a clean package name.
+  urlToName =
+    url:
+    let
+      inherit (lib.strings) stringLength;
+      base = baseNameOf (lib.removeSuffix "/" (lib.last (lib.splitString ":" (toString url))));
+      # chop away one git or archive-related extension
+      removeExt =
+        name:
+        let
+          matchExt = match "(.*)\\.(git|tar|zip|gz|tgz|bz|tbz|bz2|tbz2|lzma|txz|xz|zstd)$" name;
+        in
+        if matchExt != null then lib.head matchExt else name;
+      # apply function f to string x while the result shrinks
+      shrink =
+        f: x:
+        let
+          v = f x;
+        in
+        if stringLength v < stringLength x then shrink f v else x;
+    in
+    shrink removeExt base;
+
+  # shortRev : (String | Integer) -> String
+  #
+  # Given a package revision (like "refs/tags/v12.0"), produce a short revision ("12.0").
+  shortRev =
+    rev:
+    let
+      baseRev = baseNameOf (toString rev);
+      matchHash = match "[a-f0-9]+" baseRev;
+      matchVer = match "([A-Za-z]+[-_. ]?)*(v)?([0-9.]+.*)" baseRev;
+    in
+    if matchHash != null then
+      builtins.substring 0 7 baseRev
+    else if matchVer != null then
+      lib.last matchVer
+    else
+      baseRev;
+
+  # revOrTag : String -> String -> String
+  #
+  # Turn git `rev` and `tag` pair into a revision usable in `repoRevToName*`.
+  revOrTag =
+    rev: tag:
+    if tag != null then
+      tag
+    else if rev != null then
+      rev
+    else
+      "HEAD";
+
+  # repoRevToNameFull : (URL | Path | String) -> (String | Integer | null) -> (String | null) -> String
+  #
+  # See `repoRevToName` below.
+  repoRevToNameFull =
+    repo_: rev_: suffix_:
+    let
+      repo = urlToName repo_;
+      rev = if rev_ != null then "-${shortRev rev_}" else "";
+      suffix = if suffix_ != null then "-${suffix_}" else "";
+    in
+    "${repo}${rev}${suffix}-source";
+
+  # repoRevToName : String -> (URL | Path | String) -> (String | Integer | null) -> String -> String
+  #
+  # Produce derivation.name attribute for a given repository URL/path/name and (optionally) its revision/version tag.
+  #
+  # This is used by fetch(zip|git|FromGitHub|hg|svn|etc) to generate discoverable
+  # /nix/store paths.
+  #
+  # This uses a different implementation depending on the `pretty` argument:
+  #  "source" -> name everything as "source"
+  #  "versioned" -> name everything as "${repo}-${rev}-source"
+  #  "full" -> name everything as "${repo}-${rev}-${fetcher}-source"
+  repoRevToName =
+    kind:
+    # match on `kind` first to minimize the thunk
+    if kind == "source" then
+      (
+        repo: rev: suffix:
+        "source"
+      )
+    else if kind == "versioned" then
+      (
+        repo: rev: suffix:
+        repoRevToNameFull repo rev null
+      )
+    else if kind == "full" then
+      repoRevToNameFull
+    else
+      throw "repoRevToName: invalid kind";
+
 in
 {

@@ -431,6 +526,11 @@ in
    pathHasContext
    canCleanSource

+    urlToName
+    shortRev
+    revOrTag
+    repoRevToName
+
    sourceByRegex
    sourceFilesBySuffices

@@ -3,9 +3,10 @@

  IMPORTANT:
  This is used by the github.com/NixOS/nix CI.
+  This is used by Lix's CI (see flake.nix in the Lix repo).

  Try not to change the interface of this file, or if you need to, ping the
-  Nix maintainers for help. Thank you!
+  Nix AND Lix maintainers (`nix eval -f . lib.teams.lix`) for help. Thank you!
 */
 {
  pkgs,
@@ -6770,6 +6770,13 @@
    githubId = 11205987;
    name = "Daniel Salazar";
  };
+  dsalwasser = {
+    name = "Daniel Salwasser";
+    email = "daniel.salwasser@outlook.com";
+    github = "dsalwasser";
+    githubId = 148379503;
+    keys = [ { fingerprint = "DBA9 AE6B 84A9 C08E C4AD  1E46 6CD2 0B2D 0655 BDF6"; } ];
+  };
  dschrempf = {
    name = "Dominik Schrempf";
    email = "dominik.schrempf@gmail.com";
@@ -62,6 +62,22 @@ in
        description = "Log level for Pinchflat.";
      };

+      user = lib.mkOption {
+        type = lib.types.str;
+        default = "pinchflat";
+        description = ''
+          User account under which Pinchflat runs.
+        '';
+      };
+
+      group = lib.mkOption {
+        type = lib.types.str;
+        default = "pinchflat";
+        description = ''
+          Group under which Pinchflat runs.
+        '';
+      };
+
      extraConfig = mkOption {
        type =
          with types;
@@ -125,7 +141,9 @@ in

      serviceConfig = {
        Type = "simple";
-        DynamicUser = true;
+        User = cfg.user;
+        Group = cfg.group;
+
        StateDirectory = baseNameOf stateDir;
        Environment =
          [
@@ -151,6 +169,17 @@ in
      };
    };

+    users.users = lib.mkIf (cfg.user == "pinchflat") {
+      pinchflat = {
+        group = cfg.group;
+        isSystemUser = true;
+      };
+    };
+
+    users.groups = lib.mkIf (cfg.group == "pinchflat") {
+      pinchflat = { };
+    };
+
    networking.firewall = mkIf cfg.openFirewall {
      allowedTCPPorts = [ cfg.port ];
    };
@@ -4241,8 +4241,8 @@ let
        mktplcRef = {
          name = "sas-lsp";
          publisher = "SAS";
-          version = "1.14.0";
-          hash = "sha256-layaVQGcIOS8tToHt99yjaFlrw0hsOoiUW66FPJz+AY=";
+          version = "1.15.0";
+          hash = "sha256-BprmYUQhjXoqk21NxsmlrU8XiFuyWZa//JyIUoEa1Tc=";
        };
        meta = {
          changelog = "https://marketplace.visualstudio.com/items/SAS.sas-lsp/changelog";
@@ -4489,8 +4489,8 @@ let
        mktplcRef = {
          publisher = "sonarsource";
          name = "sonarlint-vscode";
-          version = "4.23.0";
-          hash = "sha256-ki9Dbj8g6rArjJxVm5OhB2mYFR/PUA96szNyWBtbfxc=";
+          version = "4.24.0";
+          hash = "sha256-ZOQmCy5JGLOOqqiOOt7rz0xAC0eObhO0KUz+Bb95tLY=";
        };
        meta.license = lib.licenses.lgpl3Only;
      };
@@ -10,11 +10,11 @@
 buildMozillaMach rec {
  pname = "firefox-beta";
  binaryName = pname;
-  version = "140.0b4";
+  version = "140.0b7";
  applicationName = "Firefox Beta";
  src = fetchurl {
    url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "ec3d3377db8629742d428cceded3c7c92ba952f1b9cb6a15eae7f053213c3a377287a577c33b291a5e4d3cbbf918be52a31c3f4ac5f6d06c1f5edfc6312656fe";
+    sha512 = "51a9dad564bc20aaacec5bc8cfe05f7213d6fbc826783790bcb1067cbea7349a88f479df70f73501357625c6a239d33a10a840e7287d077771dc08b0fd9b076b";
  };

  meta = {
@@ -9,10 +9,10 @@

 buildMozillaMach rec {
  pname = "firefox";
-  version = "139.0.1";
+  version = "139.0.4";
  src = fetchurl {
    url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "78ae10fc14900eb1273b7ff798a159504f68166c39b1f12ef9ea04243debc78472c24499da01641590feb5d2b28475131d2ec94d6f28fd4f2f644a721f7f40ba";
+    sha512 = "fa5ae798b0cd485e0a56b0c57ed7f33e0d0ef921302dc0169eac91926194abe2070beb54239c81924f819a60b589f305f923970d753c07ba50acc36e1a492db4";
  };

  meta = {
@@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "helm-diff";
-  version = "3.12.1";
+  version = "3.12.2";

  src = fetchFromGitHub {
    owner = "databus23";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-wI4D8C9NkI6fgNqleLTRFmj/g/8eTUGOQtMoh6+LKlQ=";
+    hash = "sha256-N7n9/MjZR9jCRk2iZmFBOxwn6GVUNuUBaQHJqcgOQc4=";
  };

-  vendorHash = "sha256-mGb3FsCNMsnG1+VE4ZplrJ1T9XHvi88c5HnYyqjdVXc=";
+  vendorHash = "sha256-uJxLpbFKdH5t08wZD/zPS5UPZO7YPtiBqcdN6997ik4=";

  ldflags = [
    "-s"
@@ -99,13 +99,13 @@
    "vendorHash": "sha256-YIn8akPW+DCVF0eYZxsmJxmrJuYhK4QLG/uhmmrXd4c="
  },
  "auth0": {
-    "hash": "sha256-85U2EFC8defpag89zssO4nd5JovdwkyyobgH1t85/jY=",
+    "hash": "sha256-QYP/VyMp4veJenA/bTlEGnKAc1NB+pVWJa7jPieOZ9A=",
    "homepage": "https://registry.terraform.io/providers/auth0/auth0",
    "owner": "auth0",
    "repo": "terraform-provider-auth0",
-    "rev": "v1.20.1",
+    "rev": "v1.21.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-eMnWzin7lTMHQ0NEvt8KiMqJz+ihxKBwXniAyWkkqd0="
+    "vendorHash": "sha256-AmRdgQVREU+uN8FFMAogXVdaEG0DMPaBYqKW0yJWJJM="
  },
  "avi": {
    "hash": "sha256-e8yzc3nRP0ktcuuKyBXydS9NhoceYZKzJcqCWOfaPL0=",
@@ -144,11 +144,11 @@
    "vendorHash": null
  },
  "azurerm": {
-    "hash": "sha256-dd/PAMkdnVlcjOk8Q5i4TsfmSWJgG25FgI/lF0OrVXI=",
+    "hash": "sha256-NghMNvsCRtgZjOTnnSYGn53KhP8ZY0hizkgEmI/+P6A=",
    "homepage": "https://registry.terraform.io/providers/hashicorp/azurerm",
    "owner": "hashicorp",
    "repo": "terraform-provider-azurerm",
-    "rev": "v4.31.0",
+    "rev": "v4.32.0",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
@@ -651,13 +651,13 @@
    "vendorHash": null
  },
  "ibm": {
-    "hash": "sha256-5AYTRuZ9hhi5AgAT3woHTv3vMmqUUXUjZKZjaBRf9H8=",
+    "hash": "sha256-ivy9RuScV4MxrJVBtZoX3wfnwva17FRpkspG5KvhGkQ=",
    "homepage": "https://registry.terraform.io/providers/IBM-Cloud/ibm",
    "owner": "IBM-Cloud",
    "repo": "terraform-provider-ibm",
-    "rev": "v1.78.4",
+    "rev": "v1.79.1",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-ug5TAuOJCk2wmhhwLQLYXVL3xxODUum6oEK/8A6ojIA="
+    "vendorHash": "sha256-lphCy2RTpA0kwjlr52VfXUqNH7IKB36ublRqjRCpXDg="
  },
  "icinga2": {
    "hash": "sha256-Y/Oq0aTzP+oSKPhHiHY9Leal4HJJm7TNDpcdqkUsCmk=",
@@ -922,22 +922,22 @@
    "vendorHash": "sha256-LRIfxQGwG988HE5fftGl6JmBG7tTknvmgpm4Fu1NbWI="
  },
  "oci": {
-    "hash": "sha256-aV69aOYkHQwD8JVFC9zD+pV0Wwjx5ZqG1PoP20aED8o=",
+    "hash": "sha256-byNyMIfebQYBZMO46+F2A4xf8ONy67JI+wgfp1TCs7A=",
    "homepage": "https://registry.terraform.io/providers/oracle/oci",
    "owner": "oracle",
    "repo": "terraform-provider-oci",
-    "rev": "v7.2.0",
+    "rev": "v7.4.0",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
  "okta": {
-    "hash": "sha256-8dFl39q8GTLGFR2O7ZIstA957x6gkAxL0qauXUxVMcI=",
+    "hash": "sha256-nHeFvCquh+xEAJZxuUmmPYacDpK+uwStGRHCCLhlUm8=",
    "homepage": "https://registry.terraform.io/providers/okta/okta",
    "owner": "okta",
    "repo": "terraform-provider-okta",
-    "rev": "v4.19.0",
+    "rev": "v4.20.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-5BkKjne3r3V8T+SkqjfHVEpXXK8sKTYMc23g1EaLoOE="
+    "vendorHash": "sha256-XmTIyHZOWgoE3+9KVgv8CY//rc62PSddn2iRTBUdkSs="
  },
  "oktaasa": {
    "hash": "sha256-2LhxgowqKvDDDOwdznusL52p2DKP+UiXALHcs9ZQd0U=",
@@ -8,6 +8,7 @@
  qtimageformats,
  qtsvg,
  qtwayland,
+  kimageformats,
  wrapGAppsHook3,
  wrapQtAppsHook,
  glib-networking,
@@ -33,6 +34,7 @@ stdenv.mkDerivation (finalAttrs: {
      qtbase
      qtimageformats
      qtsvg
+      kimageformats
    ]
    ++ lib.optionals stdenv.hostPlatform.isLinux [
      qtwayland
@@ -10,12 +10,7 @@
  python3,
  tdlib,
  tg_owt ? callPackage ./tg_owt.nix { inherit stdenv; },
-  libavif,
-  libheif,
-  libjxl,
-  kimageformats,
  qtbase,
-  qtimageformats,
  qtsvg,
  qtwayland,
  kcoreaddons,
@@ -51,14 +46,14 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "telegram-desktop-unwrapped";
-  version = "5.15.2";
+  version = "5.15.3";

  src = fetchFromGitHub {
    owner = "telegramdesktop";
    repo = "tdesktop";
    rev = "v${finalAttrs.version}";
    fetchSubmodules = true;
-    hash = "sha256-T+gzNY3jPfCWjV9yFEGlz8kNGeAioyDUD2qazM/j05I=";
+    hash = "sha256-ATGzh9zJezIOZ3uSm3rIV+KQ4XFWJvf5NaJ0ptjzYGc=";
  };

  postPatch = lib.optionalString stdenv.hostPlatform.isLinux ''
@@ -86,7 +81,6 @@ stdenv.mkDerivation (finalAttrs: {
  buildInputs =
    [
      qtbase
-      qtimageformats
      qtsvg
      lz4
      xxHash
@@ -102,17 +96,6 @@ stdenv.mkDerivation (finalAttrs: {
      boost
      ada
      (tdlib.override { tde2eOnly = true; })
-      # even though the last 3 dependencies are already in `kimageformats`,
-      # because of a logic error in the cmake files, in td 5.15.{1,2} it
-      # doesn't link when you don't add them explicitly
-      #
-      # this has been fixed
-      # (https://github.com/desktop-app/cmake_helpers/pull/413), remove next
-      # release
-      kimageformats
-      libavif
-      libheif
-      libjxl
    ]
    ++ lib.optionals stdenv.hostPlatform.isLinux [
      protobuf
@@ -21,13 +21,13 @@ in

 stdenv.mkDerivation rec {
  pname = "qdmr";
-  version = "0.12.1";
+  version = "0.12.3";

  src = fetchFromGitHub {
    owner = "hmatuschek";
    repo = "qdmr";
    rev = "v${version}";
-    hash = "sha256-6eg2w2h1ot7Cklt5UAiaFqJZjC6EM1VtEAwy3HgH4CE=";
+    hash = "sha256-rb59zbYpIziqXWTjTApWXnkcpRiAUIqPiInEJdsYd48=";
  };

  nativeBuildInputs = [
@@ -2,95 +2,107 @@
  lib,
  stdenv,
  glibcLocales,
-  # The GraalVM derivation to use
-  graalvmDrv,
  removeReferencesTo,
-  executable ? args.pname,
-  # JAR used as input for GraalVM derivation, defaults to src
-  jar ? args.src,
-  dontUnpack ? (jar == args.src),
-  # Default native-image arguments. You probably don't want to set this,
-  # except in special cases. In most cases, use extraNativeBuildArgs instead
-  nativeImageBuildArgs ? [
-    (lib.optionalString stdenv.hostPlatform.isDarwin "-H:-CheckToolchain")
-    (lib.optionalString (
-      stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64
-    ) "-H:PageSize=64K")
-    "-H:Name=${executable}"
-    "-march=compatibility"
-    "--verbose"
-  ],
-  # Extra arguments to be passed to the native-image
-  extraNativeImageBuildArgs ? [ ],
-  # XMX size of GraalVM during build
-  graalvmXmx ? "-J-Xmx6g",
-  meta ? { },
-  LC_ALL ? "en_US.UTF-8",
-  ...
-}@args:
+  graalvmPackages,
+}:

-let
-  extraArgs = builtins.removeAttrs args [
-    "lib"
-    "stdenv"
-    "glibcLocales"
-    "jar"
-    "dontUnpack"
-    "LC_ALL"
-    "meta"
-    "buildPhase"
-    "nativeBuildInputs"
-    "installPhase"
-    "postInstall"
+lib.extendMkDerivation {
+  constructDrv = stdenv.mkDerivation;
+
+  excludeDrvArgNames = [
+    "executable"
+    "extraNativeImageBuildArgs"
+    "graalvmDrv"
+    "graalvmXmx"
+    "nativeImageBuildArgs"
  ];
-in
-stdenv.mkDerivation (
-  {
-    inherit dontUnpack jar;

-    env = { inherit LC_ALL; };
+  extendDrvArgs =
+    finalAttrs:
+    {
+      dontUnpack ? true,
+      strictDeps ? true,
+      __structuredAttrs ? true,

-    nativeBuildInputs = (args.nativeBuildInputs or [ ]) ++ [
-      graalvmDrv
-      glibcLocales
-      removeReferencesTo
-    ];
+      # The GraalVM derivation to use
+      graalvmDrv ? graalvmPackages.graalvm-ce,

-    nativeImageBuildArgs = nativeImageBuildArgs ++ extraNativeImageBuildArgs ++ [ graalvmXmx ];
+      executable ? finalAttrs.meta.mainProgram,

-    buildPhase =
-      args.buildPhase or ''
-        runHook preBuild
+      # Default native-image arguments. You probably don't want to set this,
+      # except in special cases. In most cases, use extraNativeBuildArgs instead
+      nativeImageBuildArgs ? [
+        (lib.optionalString stdenv.hostPlatform.isDarwin "-H:-CheckToolchain")
+        (lib.optionalString (
+          stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64
+        ) "-H:PageSize=64K")
+        "-H:Name=${executable}"
+        "-march=compatibility"
+        "--verbose"
+      ],

-        native-image -jar "$jar" ''${nativeImageBuildArgs[@]}
+      # Extra arguments to be passed to the native-image
+      extraNativeImageBuildArgs ? [ ],

-        runHook postBuild
+      # XMX size of GraalVM during build
+      graalvmXmx ? "-J-Xmx6g",
+
+      env ? { },
+      meta ? { },
+      passthru ? { },
+      ...
+    }@args:
+    {
+      env = {
+        LC_ALL = "en_US.UTF-8";
+      } // env;
+
+      inherit dontUnpack strictDeps __structuredAttrs;
+
+      nativeBuildInputs = (args.nativeBuildInputs or [ ]) ++ [
+        graalvmDrv
+        glibcLocales
+        removeReferencesTo
+      ];
+
+      # `nativeBuildInputs` does not allow `graalvmDrv`'s propagatedBuildInput to reach here this package.
+      # As its `propagatedBuildInputs` is required for the build process with `native-image`, we must add it here as well.
+      buildInputs = [ graalvmDrv ];
+
+      nativeImageArgs = nativeImageBuildArgs ++ extraNativeImageBuildArgs ++ [ graalvmXmx ];
+
+      buildPhase =
+        args.buildPhase or ''
+          runHook preBuild
+
+          native-image -jar "$src" ''${nativeImageArgs[@]}
+
+          runHook postBuild
+        '';
+
+      installPhase =
+        args.installPhase or ''
+          runHook preInstall
+
+          install -Dm755 ${executable} -t $out/bin
+
+          runHook postInstall
+        '';
+
+      postInstall = ''
+        remove-references-to -t ${graalvmDrv} $out/bin/${executable}
+        ${args.postInstall or ""}
      '';

-    installPhase =
-      args.installPhase or ''
-        runHook preInstall
+      disallowedReferences = [ graalvmDrv ];

-        install -Dm755 ${executable} -t $out/bin
+      passthru = {
+        inherit graalvmDrv;
+      } // passthru;

-        runHook postInstall
-      '';
-
-    postInstall = ''
-      remove-references-to -t ${graalvmDrv} $out/bin/${executable}
-      ${args.postInstall or ""}
-    '';
-
-    disallowedReferences = [ graalvmDrv ];
-
-    passthru = { inherit graalvmDrv; };
-
-    meta = {
-      # default to graalvm's platforms
-      platforms = graalvmDrv.meta.platforms;
-      # default to executable name
-      mainProgram = executable;
-    } // meta;
-  }
-  // extraArgs
-)
+      meta = {
+        # default to graalvm's platforms
+        inherit (graalvmDrv.meta) platforms;
+      } // meta;
+    };
+}
@@ -1,11 +1,15 @@
-{ fetchzip, lib }:
+{
+  lib,
+  repoRevToNameMaybe,
+  fetchzip,
+}:

 lib.makeOverridable (
  {
    owner,
    repo,
    rev,
-    name ? "source",
+    name ? repoRevToNameMaybe repo rev "bitbucket",
    ... # For hash agility
  }@args:
  fetchzip (
@@ -5,29 +5,26 @@
  git-lfs,
  cacert,
 }:
+
 let
  urlToName =
    url: rev:
    let
-      inherit (lib) removeSuffix splitString last;
-      base = last (splitString ":" (baseNameOf (removeSuffix "/" url)));
-
-      matched = builtins.match "(.*)\\.git" base;
-
-      short = builtins.substring 0 7 rev;
-
-      appendShort = lib.optionalString ((builtins.match "[a-f0-9]*" rev) != null) "-${short}";
+      shortRev = lib.sources.shortRev rev;
+      appendShort = lib.optionalString ((builtins.match "[a-f0-9]*" rev) != null) "-${shortRev}";
    in
-    "${if matched == null then base else builtins.head matched}${appendShort}";
+    "${lib.sources.urlToName url}${appendShort}";
 in
+
 lib.makeOverridable (
  lib.fetchers.withNormalizedHash { } (
    # NOTE Please document parameter additions or changes in
-    #   doc/build-helpers/fetchers.chapter.md
+    #   ../../../doc/build-helpers/fetchers.chapter.md
    {
      url,
      tag ? null,
      rev ? null,
+      name ? urlToName url (lib.revOrTag rev tag),
      leaveDotGit ? deepClone || fetchTags,
      outputHash ? lib.fakeHash,
      outputHashAlgo ? null,
@@ -36,7 +33,6 @@ lib.makeOverridable (
      branchName ? null,
      sparseCheckout ? [ ],
      nonConeMode ? false,
-      name ? null,
      nativeBuildInputs ? [ ],
      # Shell code executed before the file has been fetched.  This, in
      # particular, can do things like set NIX_PREFETCH_GIT_CHECKOUT_HOOK to
@@ -108,7 +104,7 @@ lib.makeOverridable (
        "Please provide directories/patterns for sparse checkout as a list of strings. Passing a (multi-line) string is not supported any more."
    else
      stdenvNoCC.mkDerivation {
-        name = if name != null then name else urlToName url revWithTag;
+        inherit name;

        builder = ./builder.sh;
        fetcher = ./nix-prefetch-git;
@@ -1,5 +1,6 @@
 {
  lib,
+  repoRevToNameMaybe,
  fetchgit,
  fetchzip,
 }:
@@ -10,7 +11,7 @@ lib.makeOverridable (
    repo,
    tag ? null,
    rev ? null,
-    name ? "source",
+    name ? repoRevToNameMaybe repo (lib.revOrTag rev tag) "github",
    fetchSubmodules ? false,
    leaveDotGit ? null,
    deepClone ? false,
@@ -1,11 +1,15 @@
-{ fetchzip, lib }:
+{
+  fetchzip,
+  repoRevToNameMaybe,
+  lib,
+}:

 lib.makeOverridable (
  {
    url,
    rev ? null,
    tag ? null,
-    name ? "source",
+    name ? repoRevToNameMaybe url (lib.revOrTag rev tag) "gitiles",
    ...
  }@args:

@@ -1,5 +1,6 @@
 {
  lib,
+  repoRevToNameMaybe,
  fetchgit,
  fetchzip,
 }:
@@ -11,9 +12,9 @@ lib.makeOverridable (
    repo,
    rev ? null,
    tag ? null,
+    name ? repoRevToNameMaybe repo (lib.revOrTag rev tag) "gitlab",
    protocol ? "https",
    domain ? "gitlab.com",
-    name ? "source",
    group ? null,
    fetchSubmodules ? false,
    leaveDotGit ? false,
@@ -1,10 +1,14 @@
-{ fetchzip }:
+{
+  lib,
+  repoRevToNameMaybe,
+  fetchzip,
+}:

 # gitweb example, snapshot support is optional in gitweb
 {
  repo,
  rev,
-  name ? "source",
+  name ? repoRevToNameMaybe repo rev "repoorcz",
  ... # For hash agility
 }@args:
 fetchzip (
@@ -1,11 +1,15 @@
-{ fetchzip, lib }:
+{
+  lib,
+  repoRevToNameMaybe,
+  fetchzip,
+}:

 lib.makeOverridable (
  # cgit example, snapshot support is optional in cgit
  {
    repo,
    rev,
-    name ? "source",
+    name ? repoRevToNameMaybe repo rev "savannah",
    ... # For hash agility
  }@args:
  fetchzip (
@@ -1,8 +1,9 @@
 {
+  lib,
+  repoRevToNameMaybe,
  fetchgit,
  fetchhg,
  fetchzip,
-  lib,
 }:

 let
@@ -18,9 +19,9 @@ makeOverridable (
    owner,
    repo,
    rev,
+    name ? repoRevToNameMaybe repo rev "sourcehut",
    domain ? "sr.ht",
    vc ? "git",
-    name ? "source",
    fetchSubmodules ? false,
    ... # For hash agility
  }@args:
@@ -9,51 +9,55 @@
  openssh ? null,
 }:

+let
+  repoToName =
+    url: rev:
+    let
+      inherit (lib)
+        removeSuffix
+        splitString
+        reverseList
+        head
+        last
+        elemAt
+        ;
+      base = removeSuffix "/" (last (splitString ":" url));
+      path = reverseList (splitString "/" base);
+      repoName =
+        # ../repo/trunk -> repo
+        if head path == "trunk" then
+          elemAt path 1
+        # ../repo/branches/branch -> repo-branch
+        else if elemAt path 1 == "branches" then
+          "${elemAt path 2}-${head path}"
+        # ../repo/tags/tag -> repo-tag
+        else if elemAt path 1 == "tags" then
+          "${elemAt path 2}-${head path}"
+        # ../repo (no trunk) -> repo
+        else
+          head path;
+    in
+    "${repoName}-r${toString rev}";
+in
+
 {
  url,
  rev ? "HEAD",
+  name ? repoToName url rev,
  sha256 ? "",
  hash ? "",
  ignoreExternals ? false,
  ignoreKeywords ? false,
-  name ? null,
  preferLocalBuild ? true,
 }:

 assert sshSupport -> openssh != null;

-let
-  repoName =
-    let
-      fst = lib.head;
-      snd = l: lib.head (lib.tail l);
-      trd = l: lib.head (lib.tail (lib.tail l));
-      path_ =
-        (p: if lib.head p == "" then lib.tail p else p) # ~ drop final slash if any
-          (lib.reverseList (lib.splitString "/" url));
-      path = [ (lib.removeSuffix "/" (lib.head path_)) ] ++ (lib.tail path_);
-    in
-    # ../repo/trunk -> repo
-    if fst path == "trunk" then
-      snd path
-    # ../repo/branches/branch -> repo-branch
-    else if snd path == "branches" then
-      "${trd path}-${fst path}"
-    # ../repo/tags/tag -> repo-tag
-    else if snd path == "tags" then
-      "${trd path}-${fst path}"
-    # ../repo (no trunk) -> repo
-    else
-      fst path;
-
-  name_ = if name == null then "${repoName}-r${toString rev}" else name;
-in
-
 if hash != "" && sha256 != "" then
  throw "Only one of sha256 or hash can be set"
 else
  stdenvNoCC.mkDerivation {
-    name = name_;
+    inherit name;
    builder = ./builder.sh;
    nativeBuildInputs = [
      cacert
@@ -7,6 +7,7 @@

 {
  lib,
+  repoRevToNameMaybe,
  fetchurl,
  withUnzip ? true,
  unzip,
@@ -14,9 +15,9 @@
 }:

 {
-  name ? "source",
  url ? "",
  urls ? [ ],
+  name ? repoRevToNameMaybe (if url != "" then url else builtins.head urls) null "unpacked",
  nativeBuildInputs ? [ ],
  postFetch ? "",
  extraPostFetch ? "",
@@ -1,32 +1,40 @@
 {
-  cmake,
-  crocoddyl,
-  doxygen,
-  fetchFromGitHub,
-  fmt,
-  fontconfig,
-  gbenchmark,
-  graphviz,
  lib,
+  fetchFromGitHub,
+  fontconfig,
  llvmPackages,
-  pinocchio,
-  pkg-config,
-  proxsuite-nlp,
+  nix-update-script,
  python3Packages,
  pythonSupport ? false,
  stdenv,
+
+  # nativeBuildInputs
+  doxygen,
+  cmake,
+  graphviz,
+  pkg-config,
+
+  # buildInputs
+  fmt,
+
+  # propagatedBuildInputs
  suitesparse,
+  crocoddyl,
+  pinocchio,
+
+  # checkInputs
+  gbenchmark,
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "aligator";
-  version = "0.12.0";
+  version = "0.14.0";

  src = fetchFromGitHub {
    owner = "Simple-Robotics";
    repo = "aligator";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-oy2qcJbIGr5pe+XYWKntfsc6Ie7oEU1qqrPXjuqULmY=";
+    hash = "sha256-SkhFV/a3A6BqzoicQa7MUgsEuDzd+JfgYvL4ztHg/K0=";
  };

  outputs = [
@@ -44,6 +52,7 @@ stdenv.mkDerivation (finalAttrs: {
      pkg-config
    ]
    ++ lib.optionals pythonSupport [
+      python3Packages.python
      python3Packages.pythonImportsCheckHook
    ];
  buildInputs =
@@ -57,12 +66,10 @@ stdenv.mkDerivation (finalAttrs: {
      python3Packages.crocoddyl
      python3Packages.matplotlib
      python3Packages.pinocchio
-      python3Packages.proxsuite-nlp
    ]
    ++ lib.optionals (!pythonSupport) [
      crocoddyl
      pinocchio
-      proxsuite-nlp
    ];
  checkInputs =
    [ gbenchmark ]
@@ -99,6 +106,8 @@ stdenv.mkDerivation (finalAttrs: {
  doCheck = true;
  pythonImportsCheck = [ "aligator" ];

+  passthru.updateScript = nix-update-script { };
+
  meta = {
    description = "Versatile and efficient framework for constrained trajectory optimization";
    homepage = "https://github.com/Simple-Robotics/aligator";
@@ -11,14 +11,14 @@

 python3Packages.buildPythonApplication rec {
  pname = "backblaze-b2";
-  version = "4.3.2";
+  version = "4.3.3";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "Backblaze";
    repo = "B2_Command_Line_Tool";
    tag = "v${version}";
-    hash = "sha256-I6baipQDQft5bi352W9YXFAVuVqIkEqEfmD9iP2LBqs=";
+    hash = "sha256-EMdExF+5BJDIozAwJ/tqnq5X20uGvteDHTKsgvPEnK0=";
  };

  nativeBuildInputs = with python3Packages; [
@@ -10,13 +10,13 @@

 buildGoModule (finalAttrs: {
  pname = "boring";
-  version = "0.11.4";
+  version = "0.11.5";

  src = fetchFromGitHub {
    owner = "alebeck";
    repo = "boring";
    tag = finalAttrs.version;
-    hash = "sha256-N0GVXtw6Gp6iHKBD2Lk6FX8XaUnkPgZduPaczYdApAs=";
+    hash = "sha256-s/mkC/6FvzytKJ9wpAIU36HhClGqEO0XFaAyErhD3Mo=";
  };

  nativeBuildInputs = [
@@ -9,13 +9,13 @@
 buildGoModule rec {
  pname = "bosh-cli";

-  version = "7.9.6";
+  version = "7.9.7";

  src = fetchFromGitHub {
    owner = "cloudfoundry";
    repo = "bosh-cli";
    rev = "v${version}";
-    sha256 = "sha256-jWT34XdphNrkUwJq72EkvWLNoLVOc8rGf6SY4/CUvc0=";
+    sha256 = "sha256-Y3wk05IeWoH5YCrA+CJEtqvwCUxAvYdoYD+qDwTJo5Q=";
  };
  vendorHash = null;

@@ -5,18 +5,18 @@
  buildGraalvmNativeImage,
 }:

-let
+buildGraalvmNativeImage (finalAttrs: {
  pname = "certificate-ripper";
  version = "2.4.1";

-  jar = maven.buildMavenPackage {
-    pname = "${pname}-jar";
-    inherit version;
+  src = maven.buildMavenPackage {
+    pname = "certificate-ripper-jar";
+    inherit (finalAttrs) version;

    src = fetchFromGitHub {
      owner = "Hakky54";
      repo = "certificate-ripper";
-      tag = version;
+      tag = finalAttrs.version;
      hash = "sha256-qQ5BHH+DT1sGNDGzSbclqc6+byBxyP16qvm3k9E/Yks=";
    };

@@ -46,13 +46,6 @@ let
      install -Dm644 target/crip.jar $out
    '';
  };
-in
-buildGraalvmNativeImage {
-  inherit pname version;
-
-  src = jar;
-
-  executable = "crip";

  # Copied from pom.xml
  extraNativeImageBuildArgs = [
@@ -62,10 +55,11 @@ buildGraalvmNativeImage {
  ];

  meta = {
-    changelog = "https://github.com/Hakky54/certificate-ripper/releases/tag/${jar.src.tag}";
+    changelog = "https://github.com/Hakky54/certificate-ripper/releases/tag/${finalAttrs.version}";
    description = "CLI tool to extract server certificates";
    homepage = "https://github.com/Hakky54/certificate-ripper";
    license = lib.licenses.asl20;
    maintainers = with lib.maintainers; [ tomasajt ];
+    mainProgram = "crip";
  };
-}
+})
@@ -18,19 +18,19 @@
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cinny-desktop";
  # We have to be using the same version as cinny-web or this isn't going to work.
-  version = "4.8.0";
+  version = "4.8.1";

  src = fetchFromGitHub {
    owner = "cinnyapp";
    repo = "cinny-desktop";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-cixpsn0jMufd6VrBCsCH9t3bpkKdgi1i0qnkBlLgLG0=";
+    hash = "sha256-Q9iCEJu/HgWnMqiT0EjtJUk7dp7o0hbLoamlkFEaR4M=";
  };

  sourceRoot = "${finalAttrs.src.name}/src-tauri";

  useFetchCargoVendor = true;
-  cargoHash = "sha256-twfRuoA4z+Xgyyn7aIRy6MV1ozN2+qhSLh8i+qOTa2Q=";
+  cargoHash = "sha256-lWU1NrUwcAXQR6mEiCr6Ze3TzpDYvCx5/fBIef9ao5I=";

  postPatch =
    let
@@ -1,21 +1,18 @@
 {
  lib,
  buildGraalvmNativeImage,
-  graalvmPackages,
  fetchurl,
 }:

-buildGraalvmNativeImage rec {
+buildGraalvmNativeImage (finalAttrs: {
  pname = "clj-kondo";
  version = "2025.06.05";

  src = fetchurl {
-    url = "https://github.com/clj-kondo/${pname}/releases/download/v${version}/${pname}-${version}-standalone.jar";
+    url = "https://github.com/clj-kondo/clj-kondo/releases/download/v${finalAttrs.version}/clj-kondo-${finalAttrs.version}-standalone.jar";
    sha256 = "sha256-jmQFiL8MFIuMrHPSxW27E7yZIGf+k8J5nFVXgNGIKoM=";
  };

-  graalvmDrv = graalvmPackages.graalvm-ce;
-
  extraNativeImageBuildArgs = [
    "-H:+ReportExceptionStackTraces"
    "--no-fallback"
@@ -26,10 +23,11 @@ buildGraalvmNativeImage rec {
    homepage = "https://github.com/clj-kondo/clj-kondo";
    sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
    license = lib.licenses.epl10;
-    changelog = "https://github.com/clj-kondo/clj-kondo/blob/v${version}/CHANGELOG.md";
+    changelog = "https://github.com/clj-kondo/clj-kondo/blob/v${finalAttrs.version}/CHANGELOG.md";
    maintainers = with lib.maintainers; [
      jlesquembre
      bandresen
    ];
+    mainProgram = "clj-kondo";
  };
-}
+})
@@ -4,15 +4,14 @@
  fetchurl,
  nix-update-script,
  testers,
-  cljfmt,
 }:

-buildGraalvmNativeImage rec {
+buildGraalvmNativeImage (finalAttrs: {
  pname = "cljfmt";
  version = "0.13.1";

  src = fetchurl {
-    url = "https://github.com/weavejester/cljfmt/releases/download/${version}/cljfmt-${version}-standalone.jar";
+    url = "https://github.com/weavejester/cljfmt/releases/download/${finalAttrs.version}/cljfmt-${finalAttrs.version}-standalone.jar";
    hash = "sha256-Dj1g6hMzRhqm0pJggODVFgEkayB2Wdh3d0z6RglHbgY=";
  };

@@ -28,8 +27,8 @@ buildGraalvmNativeImage rec {
  passthru.updateScript = nix-update-script { };

  passthru.tests.version = testers.testVersion {
-    inherit version;
-    package = cljfmt;
+    inherit (finalAttrs) version;
+    package = finalAttrs.finalPackage;
    command = "cljfmt --version";
  };

@@ -39,7 +38,7 @@ buildGraalvmNativeImage rec {
    homepage = "https://github.com/weavejester/cljfmt";
    sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
    license = lib.licenses.epl10;
-    changelog = "https://github.com/weavejester/cljfmt/blob/${version}/CHANGELOG.md";
+    changelog = "https://github.com/weavejester/cljfmt/blob/${finalAttrs.version}/CHANGELOG.md";
    maintainers = with lib.maintainers; [ sg-qwt ];
  };
-}
+})
@@ -3,50 +3,44 @@
  buildGraalvmNativeImage,
  fetchMavenArtifact,
  fetchurl,
-  graalvmPackages,
  versionCheckHook,
 }:

-let
+buildGraalvmNativeImage (finalAttrs: {
  pname = "cljstyle";
  version = "0.17.642";

-  # must be on classpath to build native image
-  graal-build-time = fetchMavenArtifact {
-    repos = [ "https://repo.clojars.org/" ];
-    groupId = "com.github.clj-easy";
-    artifactId = "graal-build-time";
-    version = "1.0.5";
-    hash = "sha256-M6/U27a5n/QGuUzGmo8KphVnNa2K+LFajP5coZiFXoY=";
-  };
-in
-buildGraalvmNativeImage {
-  inherit pname version;
-
  src = fetchurl {
-    url = "https://github.com/greglook/${pname}/releases/download/${version}/${pname}-${version}.jar";
+    url = "https://github.com/greglook/cljstyle/releases/download/${finalAttrs.version}/cljstyle-${finalAttrs.version}.jar";
    hash = "sha256-AkCuTZeDXbNBuwPZEMhYGF/oOGIKq5zVDwL8xwnj+mE=";
  };

-  graalvmDrv = graalvmPackages.graalvm-ce;
-
  extraNativeImageBuildArgs = [
    "-H:+ReportExceptionStackTraces"
    "--no-fallback"
-    "-cp ${graal-build-time.passthru.jar}"
+    "-cp ${finalAttrs.finalPackage.passthru.graal-build-time.passthru.jar}"
  ];

  doInstallCheck = true;
  nativeInstallCheckInputs = [ versionCheckHook ];
  versionCheckProgramArg = [ "version" ];

+  # must be on classpath to build native image
+  passthru.graal-build-time = fetchMavenArtifact {
+    repos = [ "https://repo.clojars.org/" ];
+    groupId = "com.github.clj-easy";
+    artifactId = "graal-build-time";
+    version = "1.0.5";
+    hash = "sha256-M6/U27a5n/QGuUzGmo8KphVnNa2K+LFajP5coZiFXoY=";
+  };
+
  meta = {
    description = "Tool for formatting Clojure code";
    homepage = "https://github.com/greglook/cljstyle";
    sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
    license = lib.licenses.epl10;
-    changelog = "https://github.com/greglook/cljstyle/blob/${version}/CHANGELOG.md";
+    changelog = "https://github.com/greglook/cljstyle/blob/${finalAttrs.version}/CHANGELOG.md";
    maintainers = with lib.maintainers; [ psyclyx ];
    mainProgram = "cljstyle";
  };
-}
+})
@@ -1,27 +1,20 @@
 {
  lib,
+  stdenvNoCC,
  buildGraalvmNativeImage,
  fetchurl,
  fetchFromGitHub,
  writeScript,
  testers,
-  clojure-lsp,
 }:

-buildGraalvmNativeImage rec {
+buildGraalvmNativeImage (finalAttrs: {
  pname = "clojure-lsp";
-  version = "2025.03.27-20.21.36";
+  version = "2025.05.27-13.56.57";

-  src = fetchFromGitHub {
-    owner = "clojure-lsp";
-    repo = "clojure-lsp";
-    rev = version;
-    hash = "sha256-xS/WVTJFCdktYxBvey855PW5Heqlx4EhpDAMHQ5Bj5M=";
-  };
-
-  jar = fetchurl {
-    url = "https://github.com/clojure-lsp/clojure-lsp/releases/download/${version}/clojure-lsp-standalone.jar";
-    hash = "sha256-g8jX+41gojvoJHV/xMcP+4ROc9LewCUTuDTQcpHQ6+E=";
+  src = fetchurl {
+    url = "https://github.com/clojure-lsp/clojure-lsp/releases/download/${finalAttrs.version}/clojure-lsp-standalone.jar";
+    hash = "sha256-CIly8eufuI/ENgiamKfhnFe+0dssDKEl4MYDJf4Sm/k=";
  };

  extraNativeImageBuildArgs = [
@@ -33,22 +26,18 @@ buildGraalvmNativeImage rec {
  ];

  doCheck = true;
-  checkPhase =
-    ''
-      runHook preCheck
+  checkPhase = ''
+    runHook preCheck

-      export HOME="$(mktemp -d)"
-      ./clojure-lsp --version | fgrep -q '${version}'
-    ''
-    # TODO: fix classpath issue per https://github.com/NixOS/nixpkgs/pull/153770
-    #${babashka}/bin/bb integration-test ./clojure-lsp
-    + ''
-      runHook postCheck
-    '';
+    export HOME="$(mktemp -d)"
+    ./clojure-lsp --version | fgrep -q '${finalAttrs.version}'
+
+    runHook postCheck
+  '';

  passthru.tests.version = testers.testVersion {
-    inherit version;
-    package = clojure-lsp;
+    inherit (finalAttrs) version;
+    package = finalAttrs.finalPackage;
    command = "clojure-lsp --version";
  };

@@ -57,28 +46,33 @@ buildGraalvmNativeImage rec {
    #!nix-shell -i bash -p curl common-updater-scripts gnused jq nix

    set -eu -o pipefail
+    source "${stdenvNoCC}/setup"

-    latest_version=$(curl -s https://api.github.com/repos/clojure-lsp/clojure-lsp/releases/latest | jq --raw-output .tag_name)
+    old_version="$(nix-instantiate --strict --json --eval -A clojure-lsp.version | jq -r .)"
+    latest_version="$(curl -s https://api.github.com/repos/clojure-lsp/clojure-lsp/releases/latest | jq -r .tag_name)"

-    old_jar_hash=$(nix-instantiate --eval --strict -A "clojure-lsp.jar.drvAttrs.outputHash" | tr -d '"' | sed -re 's|[+]|\\&|g')
+    if [[ $latest_version == $old_version ]]; then
+      echo "Already at latest version $old_version"
+      exit 0
+    fi

-    curl -o clojure-lsp-standalone.jar -sL https://github.com/clojure-lsp/clojure-lsp/releases/download/$latest_version/clojure-lsp-standalone.jar
-    new_jar_hash=$(nix-hash --flat --type sha256 clojure-lsp-standalone.jar | sed -re 's|[+]|\\&|g')
+    old_jar_hash="$(nix-instantiate --strict --json --eval -A clojure-lsp.jar.drvAttrs.outputHash | jq -r .)"
+
+    curl -o clojure-lsp-standalone.jar -sL "https://github.com/clojure-lsp/clojure-lsp/releases/download/$latest_version/clojure-lsp-standalone.jar"
+    new_jar_hash="$(nix-hash --flat --type sha256 clojure-lsp-standalone.jar | xargs -n1 nix hash convert --hash-algo sha256)"

    rm -f clojure-lsp-standalone.jar

-    nixFile=$(nix-instantiate --eval --strict -A "clojure-lsp.meta.position" | sed -re 's/^"(.*):[0-9]+"$/\1/')
-
-    sed -i "$nixFile" -re "s|\"$old_jar_hash\"|\"$new_jar_hash\"|"
-    update-source-version clojure-lsp "$latest_version"
+    update-source-version clojure-lsp "$latest_version" "$new_jar_hash"
  '';

  meta = {
    description = "Language Server Protocol (LSP) for Clojure";
    homepage = "https://github.com/clojure-lsp/clojure-lsp";
-    changelog = "https://github.com/clojure-lsp/clojure-lsp/releases/tag/${version}";
+    changelog = "https://github.com/clojure-lsp/clojure-lsp/releases/tag/${finalAttrs.version}";
    sourceProvenance = [ lib.sourceTypes.binaryBytecode ];
    license = lib.licenses.mit;
    maintainers = [ lib.maintainers.ericdallo ];
+    mainProgram = "clojure-lsp";
  };
-}
+})
@@ -0,0 +1,38 @@
+{
+  lib,
+  buildNpmPackage,
+  fetchFromGitHub,
+  nix-update-script,
+}:
+
+buildNpmPackage (finalAttrs: {
+  pname = "corestore";
+  version = "7.1.0";
+
+  src = fetchFromGitHub {
+    owner = "holepunchto";
+    repo = "corestore";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-lbbjYWJah1A2/ySBTI2Mg78dRjLyt/TJ5rhqBPxWOps=";
+  };
+
+  npmDepsHash = "sha256-3WfcomAOE+u/ZIn5M+sP/GkxArXx5IRFzf0IG4ykaiU=";
+
+  dontNpmBuild = true;
+
+  # ERROR: Missing package-lock.json from src
+  # Copy vendored package-lock.json to src via postPatch
+  postPatch = ''
+    cp ${./package-lock.json} ./package-lock.json
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Simple corestore that wraps a random-access-storage module";
+    homepage = "https://github.com/holepunchto/corestore";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ themadbit ];
+    teams = with lib.teams; [ ngi ];
+  };
+})
@@ -6,42 +6,39 @@
  graalvmPackages,
 }:

-buildGraalvmNativeImage rec {
+buildGraalvmNativeImage (finalAttrs: {
  pname = "cq";
  version = "2024.06.24-12.10";

  # we need both src (the prebuild jar)
  src = fetchurl {
-    url = "https://github.com/markus-wa/cq/releases/download/${version}/cq.jar";
+    url = "https://github.com/markus-wa/cq/releases/download/${finalAttrs.version}/cq.jar";
    hash = "sha256-iULV+j/AuGVYPYhbOTQTKd3n+VZhWQYBRE6cRiaa1/M=";
  };

  # and build-src (for the native-image build process)
-  build-src = fetchFromGitHub {
+  passthru.build-src = fetchFromGitHub {
    owner = "markus-wa";
    repo = "cq";
-    rev = version;
+    tag = finalAttrs.version;
    hash = "sha256-yjAC2obipdmh+JlHzVUTMtTXN2VKe4WKkyJyu2Q93c8=";
  };

-  graalvmDrv = graalvmPackages.graalvm-ce;
-
-  executable = "cq";
-
  # copied verbatim from the upstream build script https://github.com/markus-wa/cq/blob/main/package/build-native.sh#L5
  extraNativeImageBuildArgs = [
    "--report-unsupported-elements-at-runtime"
    "--initialize-at-build-time"
    "--no-server"
-    "-H:ReflectionConfigurationFiles=${build-src}/package/reflection-config.json"
+    "-H:ReflectionConfigurationFiles=${finalAttrs.finalPackage.build-src}/package/reflection-config.json"
  ];

  meta = {
    description = "Clojure Query: A Command-line Data Processor for JSON, YAML, EDN, XML and more";
    homepage = "https://github.com/markus-wa/cq";
-    changelog = "https://github.com/markus-wa/cq/releases/releases/tag/${version}";
+    changelog = "https://github.com/markus-wa/cq/releases/releases/tag/${finalAttrs.version}";
    license = lib.licenses.epl20;
    maintainers = with lib.maintainers; [ farcaller ];
    platforms = lib.platforms.unix;
+    mainProgram = "cq";
  };
-}
+})
@@ -8,16 +8,16 @@

 buildGoModule rec {
  pname = "docker-language-server";
-  version = "0.9.0";
+  version = "0.10.2";

  src = fetchFromGitHub {
    owner = "docker";
    repo = "docker-language-server";
    tag = "v${version}";
-    hash = "sha256-d3lGCIssrQqZNYyQ0RlXfjp1/z5tNtNTy6LkCC77qpA=";
+    hash = "sha256-IFHwlunenIeTJUMIgMSi/xFbIMjrC3sABxow5Toxi50=";
  };

-  vendorHash = "sha256-6wngmwVtHSTPfsJQJ+swGM9H+yCbXDPLGCcTys1Zb4A=";
+  vendorHash = "sha256-yb/GdwgEwv6ybb1CkBivCC6WKc/DX9FXxz+7WLr3scw=";

  nativeCheckInputs = [
    docker
@@ -10,13 +10,13 @@

 buildGoModule rec {
  pname = "gh";
-  version = "2.74.0";
+  version = "2.74.1";

  src = fetchFromGitHub {
    owner = "cli";
    repo = "cli";
    tag = "v${version}";
-    hash = "sha256-jnS2S21iHBmi+AZAKs6QgJWsmZGc4ly8bIGSMg+cNCA=";
+    hash = "sha256-9Mc0AuwR9F7XU6yjIJ5Z7m7e0b3o7ZjpDdkTc6JMNnQ=";
  };

  vendorHash = "sha256-S1s+Es7vOvyiPY7RJaMs6joy8QIZ1xY9mR6WvNIs0OY=";
@@ -130,13 +130,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "hydra";
-  version = "0-unstable-2025-04-23";
+  version = "0-unstable-2025-05-27";

  src = fetchFromGitHub {
    owner = "NixOS";
    repo = "hydra";
-    rev = "455f1a0665c6ca55df2a17679f6103402a9e9431";
-    hash = "sha256-rn9ZE4ERml8ZkT9ziDrqGEJfzr0rJlzYfu2PHL71oiI=";
+    rev = "2e3c168ec49fb78554247bf1aa7d11fbf716e107";
+    hash = "sha256-S3gG8xXItXdefeSIaR4tTzjHv+pceu/i5s+wGQNHAWQ=";
  };

  outputs = [
@@ -1,93 +0,0 @@
-diff --git a/internal/server/firewall/drivers/drivers_consts.go b/internal/server/firewall/drivers/drivers_consts.go
-index 2790e07a605..944bca5930e 100644
--- a/internal/server/firewall/drivers/drivers_consts.go
-+++ b/internal/server/firewall/drivers/drivers_consts.go
-@@ -1,8 +1,6 @@
- package drivers
- 
- import (
-	"encoding/json"
-	"fmt"
- 	"net"
- )
- 
-@@ -67,62 +65,12 @@ type NftListSetsOutput struct {
- 
- // NftListSetsEntry structure to read JSON output of nft set listing.
- type NftListSetsEntry struct {
-	Metainfo *NftMetainfo `json:"metainfo,omitempty"`
-	Set      *NftSet      `json:"set,omitempty"`
-}
-
-// NftMetainfo structure representing metainformation returned by nft.
-type NftMetainfo struct {
-	Version           string `json:"version"`
-	ReleaseName       string `json:"release_name"`
-	JSONSchemaVersion int    `json:"json_schema_version"`
-+	Set *NftSet `json:"set,omitempty"`
- }
- 
- // NftSet structure to parse the JSON of a set returned by nft -j list sets.
- type NftSet struct {
-	Family string    `json:"family"`
-	Name   string    `json:"name"`
-	Table  string    `json:"table"`
-	Type   string    `json:"type"`
-	Handle int       `json:"handle"`
-	Flags  []string  `json:"flags"`
-	Elem   ElemField `json:"elem"`
-}
-
-// ElemField supports both string elements (IP, MAC) and dictionary-based CIDR elements.
-// In order to parse it correctly a custom unsmarshalling is defined in drivers_nftables.go .
-type ElemField struct {
-	Addresses []string // Stores plain addresses and CIDR notations as strings.
-}
-
-// UnmarshalJSON handles both plain strings and CIDR dictionaries inside `elem`.
-func (e *ElemField) UnmarshalJSON(data []byte) error {
-	var rawElems []any
-	err := json.Unmarshal(data, &rawElems)
-	if err != nil {
-		return err
-	}
-
-	for _, elem := range rawElems {
-		switch v := elem.(type) {
-		case string:
-			// Plain address (IPv4, IPv6, or MAC).
-			e.Addresses = append(e.Addresses, v)
-		case map[string]any:
-			// CIDR notation (prefix dictionary).
-			prefix, ok := v["prefix"].(map[string]any)
-			if ok {
-				addr, addrOk := prefix["addr"].(string)
-				lenFloat, lenOk := prefix["len"].(float64) // JSON numbers are float64 by default.
-				if addrOk && lenOk {
-					e.Addresses = append(e.Addresses, fmt.Sprintf("%s/%d", addr, int(lenFloat)))
-				}
-			}
-
-		default:
-			return fmt.Errorf("Unsupported element type in NFTables set: %v", elem)
-		}
-	}
-
-	return nil
-+	Family string `json:"family"`
-+	Name   string `json:"name"`
-+	Table  string `json:"table"`
- }
-diff --git a/internal/server/firewall/drivers/drivers_nftables.go b/internal/server/firewall/drivers/drivers_nftables.go
-index fd9be2e2fbb..f803de9dff5 100644
--- a/internal/server/firewall/drivers/drivers_nftables.go
-+++ b/internal/server/firewall/drivers/drivers_nftables.go
-@@ -387,7 +387,7 @@ func (d Nftables) NetworkClear(networkName string, _ bool, _ []uint) error {
- 		return fmt.Errorf("Failed clearing nftables rules for network %q: %w", networkName, err)
- 	}
- 
-	err = d.RemoveIncusAddressSets("inet")
-+	err = d.RemoveIncusAddressSets("bridge")
- 	if err != nil {
- 		return fmt.Errorf("Error in deletion of address sets: %w", err)
- 	}
@@ -1,11 +1,8 @@
 import ./generic.nix {
-  hash = "sha256-hgZc30SRnmALTvuD32dNuO0r4pfpXXvN4CtJqn2fGuk=";
-  version = "6.12.0";
-  vendorHash = "sha256-/GwJG6kmjbiUUh0AWQ+IUbeK1kRcuWrwmNdTzH5LT38=";
-  patches = [
-    # fix nft, remove 6.13
-    ./1995.diff
-  ];
+  hash = "sha256-f02BBEZ9EqLWJNxJ+Qj8PtcgkRT2Dy/hwUA/1aAZXC8=";
+  version = "6.13.0";
+  vendorHash = "sha256-g71ORfg/BMucohBfPWwSbyLdmo5SpkStUKbszZFFaKQ=";
+  patches = [ ];
  nixUpdateExtraArgs = [
    "--override-filename=pkgs/by-name/in/incus/package.nix"
  ];
@@ -1,8 +1,6 @@
 {
-  dbus,
  fetchFromGitHub,
  lib,
-  iwd,
  rustPlatform,
 }:

@@ -19,11 +17,6 @@ rustPlatform.buildRustPackage rec {

  cargoHash = "sha256-NjA8n11pOytXsotEQurYxDHPhwXG5vpdlyscmVUIzfA=";

-  buildInputs = [
-    dbus
-    iwd
-  ];
-
  meta = {
    homepage = "https://github.com/e-tho/iwmenu";
    description = "Launcher-driven Wi-Fi manager for Linux";
@@ -7,13 +7,13 @@

 stdenvNoCC.mkDerivation {
  pname = "jawiki-all-titles-in-ns0";
-  version = "0-unstable-2025-05-01";
+  version = "0-unstable-2025-06-01";

  src = fetchFromGitHub {
    owner = "musjj";
    repo = "jawiki-archive";
-    rev = "11011d2a5a27251a75a0ce822ed05fa9be7bf878";
-    hash = "sha256-ZTCW14kHfewzCJuT6afGgSi3ZwC4cGiqecEma8Fj2mk=";
+    rev = "044d308be473f2e57eb011fbd3f771bf5ac46e05";
+    hash = "sha256-gVTr1IZqeq8mjktoOW4nZVQWePjMirCKpM4Hbb4xW1A=";
  };

  installPhase = ''
@@ -3,15 +3,14 @@
  buildGraalvmNativeImage,
  fetchurl,
  testers,
-  jet,
 }:

-buildGraalvmNativeImage rec {
+buildGraalvmNativeImage (finalAttrs: {
  pname = "jet";
  version = "0.7.27";

  src = fetchurl {
-    url = "https://github.com/borkdude/${pname}/releases/download/v${version}/${pname}-${version}-standalone.jar";
+    url = "https://github.com/borkdude/jet/releases/download/v${finalAttrs.version}/jet-${finalAttrs.version}-standalone.jar";
    sha256 = "sha256-250/1DBNCXlU1b4jjLUUOXI+uSbOyPXtBN1JJRpdmFc=";
  };

@@ -23,16 +22,17 @@ buildGraalvmNativeImage rec {
  ];

  passthru.tests.version = testers.testVersion {
-    inherit version;
-    package = jet;
+    inherit (finalAttrs) version;
+    package = finalAttrs.finalPackage;
    command = "jet --version";
  };

-  meta = with lib; {
+  meta = {
    description = "CLI to transform between JSON, EDN, YAML and Transit, powered with a minimal query language";
    homepage = "https://github.com/borkdude/jet";
-    sourceProvenance = with sourceTypes; [ binaryBytecode ];
-    license = licenses.epl10;
-    maintainers = with maintainers; [ ericdallo ];
+    sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
+    license = lib.licenses.epl10;
+    maintainers = with lib.maintainers; [ ericdallo ];
+    mainProgram = "jet";
  };
-}
+})
@@ -7,13 +7,13 @@

 stdenv.mkDerivation {
  pname = "jrl-cmakemodules";
-  version = "0-unstable-2025-01-29";
+  version = "0-unstable-2025-05-04";

  src = fetchFromGitHub {
    owner = "jrl-umi3218";
    repo = "jrl-cmakemodules";
-    rev = "2ede15d1cb9d66401ba96788444ad64c44ffccd8";
-    hash = "sha256-0o5DKt9BxZlAYTHp/BjzF6eJRP/d6lVlaV5P4xlzKnA=";
+    rev = "2dd858f5a71d8224f178fb3dc0bcd95256ba10e7";
+    hash = "sha256-Iq9IuhEJBmDd14FhQ3wb94AoJDUjJ1h1D3qCdQYCnUc=";
  };

  nativeBuildInputs = [ cmake ];
@@ -0,0 +1,88 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  fetchpatch2,
+  cmake,
+  numactl,
+  mpi,
+  sparsehash,
+  tbb_2022_0,
+  gtest,
+  mpiCheckPhaseHook,
+}:
+let
+  kassert-src = fetchFromGitHub {
+    owner = "kamping-site";
+    repo = "kassert";
+    rev = "988b7d54b79ae6634f2fcc53a0314fb1cf2c6a23";
+
+    fetchSubmodules = true;
+    hash = "sha256-CBglUfVl9lgEa1t95G0mG4CCj0OWnIBwk7ep62rwIAA=";
+  };
+
+  kagen-src = fetchFromGitHub {
+    owner = "KarlsruheGraphGeneration";
+    repo = "KaGen";
+    rev = "70386f48e513051656f020360c482ce6bff9a24f";
+
+    fetchSubmodules = true;
+    hash = "sha256-5EvRPpjUZpmAIEgybXjNU/mO0+gsAyhlwbT+syDUr48=";
+  };
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "kaminpar";
+  version = "3.5.1";
+
+  src = fetchFromGitHub {
+    owner = "KaHIP";
+    repo = "KaMinPar";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-1azBj1DSEb7b8u+S51Sncn6EVMgu+SuFJcK4QVVhRk4=";
+  };
+
+  patches = [
+    # require gtest to be preinstalled by default if building tests
+    (fetchpatch2 {
+      url = "https://github.com/KaHip/KaMinPar/commit/9cb9883eea076d11cffcf4b0d14bf1f4f95a00e4.patch?full_index=1";
+      hash = "sha256-aUO5E0HTZqjfu5BUzyRdSZgyQYcE4PGqZaJvLD40sn8=";
+    })
+  ];
+
+  nativeBuildInputs = [ cmake ];
+
+  buildInputs = lib.optional stdenv.hostPlatform.isLinux numactl;
+
+  propagatedBuildInputs = [
+    mpi
+    sparsehash
+    tbb_2022_0
+  ];
+
+  cmakeFlags = [
+    (lib.cmakeBool "BUILD_SHARED_LIBS" (!stdenv.hostPlatform.isStatic))
+    (lib.cmakeBool "KAMINPAR_BUILD_DISTRIBUTED" true)
+    (lib.cmakeBool "KAMINPAR_BUILD_WITH_MTUNE_NATIVE" false)
+    (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_KASSERT" "${kassert-src}")
+    (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_KAGEN" "${kagen-src}")
+  ];
+
+  doCheck = true;
+
+  __darwinAllowLocalNetworking = true;
+
+  nativeCheckInputs = [
+    gtest
+    mpiCheckPhaseHook
+  ];
+
+  meta = {
+    description = "Parallel heuristic solver for the balanced k-way graph partitioning problem";
+    homepage = "https://github.com/KaHIP/KaMinPar";
+    changelog = "https://github.com/KaHIP/KaMinPar/releases/tag/v${finalAttrs.version}";
+    mainProgram = "KaMinPar";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [ dsalwasser ];
+  };
+})
@@ -7,15 +7,15 @@

 buildGoModule rec {
  pname = "konstraint";
-  version = "0.42.0";
+  version = "0.43.0";

  src = fetchFromGitHub {
    owner = "plexsystems";
    repo = "konstraint";
    rev = "v${version}";
-    sha256 = "sha256-DwfBevCGDndMfQiwiuV+J95prhbxT20siMrEY2T7h1w=";
+    sha256 = "sha256-PzJTdSkobcgg04C/sdHJF9IAZxK62axwkkI2393SFbg=";
  };
-  vendorHash = "sha256-iCth5WrX0XG218PfbXt4jeA3MZuZ68eNaV+RtzMhXP0=";
+  vendorHash = "sha256-nq1bHOOSNXcANTV0g8VCjcRKUCgfoMIHFgPqnJ+V4Bw=";

  # Exclude go within .github folder
  excludedPackages = ".github";
@@ -11,13 +11,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "libmsquic";
-  version = "2.4.11";
+  version = "2.4.12";

  src = fetchFromGitHub {
    owner = "microsoft";
    repo = "msquic";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-ZI5tutVYs3myjRdsXGOq48F9fce2YUsMcI1Sqg7nyh0=";
+    hash = "sha256-zWg5h5+wguBiAYPN8nZU/lQv1do2b87yyvuFm3445Ys=";
    fetchSubmodules = true;
  };

@@ -5,13 +5,13 @@
 }:
 python3Packages.buildPythonApplication rec {
  pname = "mcp-proxy";
-  version = "0.7.0";
+  version = "0.8.0";

  src = fetchFromGitHub {
    owner = "sparfenyuk";
    repo = "mcp-proxy";
    tag = "v${version}";
-    hash = "sha256-xHy+IwnUoyICSTusqTzGf/kOvT0FvJYcTT9Do0C5DiY=";
+    hash = "sha256-3KGBQyiI6hbDfl37lhhnGYHixHYGsKAgTJH/PSe3UFs=";
  };

  pyproject = true;
@@ -6,16 +6,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "mdfried";
-  version = "0.12.1";
+  version = "0.12.2";

  src = fetchFromGitHub {
    owner = "benjajaja";
    repo = "mdfried";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-pSJexHOfGB8KGTpPrqw+dgymDXyux0uH6CDsZcnsHlE=";
+    hash = "sha256-k40Ir/GQeJ08h11b8u/VEx89lPFQ0sLNGG1Bmx+tKPI=";
  };

-  cargoHash = "sha256-ZcWoYfvYmesi7JPOeSmIj0L9qlsoOYf6SMO0XQy6KwA=";
+  cargoHash = "sha256-IUmPQozLjaaFlcmEjZQ9IyvSRUlIZUxQDPWrpvaDArk=";

  doCheck = true;

@@ -7,14 +7,14 @@

 python3Packages.buildPythonApplication {
  pname = "memtree";
-  version = "0-unstable-2024-01-04";
+  version = "0-unstable-2025-06-06";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "nbraud";
    repo = "memtree";
-    rev = "97615952eabdc5e8e1a4bd590dd1f4971f3c5a24";
-    hash = "sha256-Ifp8hwkuyBw57fGer3GbDiJaRjL4TD3hzj+ecGXWqI0=";
+    rev = "279f1fa0a811de86c278ce74830bd8aa1b00db58";
+    hash = "sha256-gUULox3QSx68x8lb1ytanY36cw/I9L4HdpR8OPOsxuc=";
  };

  pythonRelaxDeps = [ "rich" ];
@@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "misconfig-mapper";
-  version = "1.14.3";
+  version = "1.14.4";

  src = fetchFromGitHub {
    owner = "intigriti";
    repo = "misconfig-mapper";
    tag = "v${version}";
-    hash = "sha256-ZYTPXzqQ0jKRjjpw0HFExNWjXBG3xopBhD2SoUEvdIE=";
+    hash = "sha256-HLGBQugGg66wH3NFPDvFRRGdDscd+Vz6LHG8CYHqgYw=";
  };

-  vendorHash = "sha256-A+71QaSmF7fzGeqmNOBvlZz5irJGxfO8+pR+1uxsiiU=";
+  vendorHash = "sha256-GY3eRMj7YtuP/Bibf2e4fAOwGNe9TTadmOBpOxK4S6c=";

  ldflags = [
    "-s"
@@ -7,14 +7,14 @@
 }:

 stdenv.mkDerivation rec {
-  version = "1.43";
+  version = "1.44";
  pname = "mxt-app";

  src = fetchFromGitHub {
    owner = "atmel-maxtouch";
    repo = "mxt-app";
    rev = "v${version}";
-    sha256 = "sha256-kj6OLuK88KFZKJ7cV6bJNsB67WvB3lS5BRPJZvH+aIQ=";
+    sha256 = "sha256-JE8rI1dkbrPXCbJI9cK/w5ugndPj6rO0hpyfwiSqmLc=";
  };

  nativeBuildInputs = [ autoreconfHook ];
@@ -10,16 +10,16 @@

 buildGoModule rec {
  pname = "myks";
-  version = "4.8.3";
+  version = "4.8.4";

  src = fetchFromGitHub {
    owner = "mykso";
    repo = "myks";
    tag = "v${version}";
-    hash = "sha256-heAIVvQdb69XO3xP6Xq7+5/FqaKrie/1JxJ8FyFXw/U=";
+    hash = "sha256-WMedmDw4AlM8XAwbnFBiNFHd9ocBJhXq8qVQTOm9aDI=";
  };

-  vendorHash = "sha256-G+wr4mDuQoZEgdyHohDSVUJza70eZc+zrmQ79d/49lE=";
+  vendorHash = "sha256-IZopDehj8y7I4EDkiWGod5bexj8vzIS7eLx22UscXOs=";

  subPackages = ".";

@@ -2,20 +2,28 @@
  lib,
  fetchFromGitHub,
  buildGoModule,
+  versionCheckHook,
+  nix-update-script,
 }:

 buildGoModule (finalAttrs: {
  pname = "opencode";
-  version = "0.0.46";
+  version = "0.0.52";

  src = fetchFromGitHub {
-    owner = "opencode-ai";
+    owner = "sst";
    repo = "opencode";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Q7ArUsFMpe0zayUMBJd+fC1K4jTGElIFep31Qa/L1jY=";
+    hash = "sha256-wniGu8EXOI2/sCI7gv2luQgODRdes7tt1CoJ6Gs09ig=";
  };

-  vendorHash = "sha256-MVpluFTF/2S6tRQQAXE3ujskQZ3njBkfve0RQgk3IkQ=";
+  vendorHash = "sha256-pnev0o2/jirTqG67amCeI49XUdMCCulpGq/jYqGqzRY=";
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/sst/opencode/internal/version.Version=${finalAttrs.version}"
+  ];

  checkFlags =
    let
@@ -24,13 +32,25 @@ buildGoModule (finalAttrs: {
        "TestBashTool_Run"
        "TestSourcegraphTool_Run"
        "TestLsTool_Run"
+
+        # Difference with snapshot
+        "TestGetContextFromPaths"
      ];
    in
    [ "-skip=^${lib.concatStringsSep "$|^" skippedTests}$" ];

+  nativeCheckInputs = [
+    versionCheckHook
+  ];
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { };
+
  meta = {
    description = "Powerful terminal-based AI assistant providing intelligent coding assistance";
    homepage = "https://github.com/opencode-ai/opencode";
+    changelog = "https://github.com/sst/opencode/releases/tag/v${finalAttrs.version}";
    mainProgram = "opencode";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [
@@ -6,13 +6,13 @@

 stdenv.mkDerivation rec {
  pname = "openseachest";
-  version = "25.05";
+  version = "25.05.1";

  src = fetchFromGitHub {
    owner = "Seagate";
    repo = "openSeaChest";
    rev = "v${version}";
-    hash = "sha256-rxy+A2HV20RbCF6rnl04RwAP7LHm1jM9Y78N08pBr6E=";
+    hash = "sha256-kd2JRtqnxfYRJcr1yKSB0LZAR96j2WW4tR1iRTvVANs=";
    fetchSubmodules = true;
  };

@@ -7,11 +7,11 @@

 stdenv.mkDerivation rec {
  pname = "plantuml-server";
-  version = "1.2025.2";
+  version = "1.2025.3";

  src = fetchurl {
    url = "https://github.com/plantuml/plantuml-server/releases/download/v${version}/plantuml-v${version}.war";
-    hash = "sha256-Qwaqt2Tlc5ruo0nnhepBXHOHVPqwcIP2Ec6GL+EyGTU=";
+    hash = "sha256-q4fgA3pbKg13q/J5CJ1vshNFdBtTQ3QyRKyD3STshcc=";
  };

  dontUnpack = true;
@@ -4,22 +4,21 @@
  fetchFromGitHub,
 }:

-let
+stdenv.mkDerivation (finalAttrs: {
  pname = "pngpaste";
  version = "0.2.3";
-in
-stdenv.mkDerivation {
-  inherit pname version;
+
  src = fetchFromGitHub {
    owner = "jcsalterego";
-    repo = pname;
-    rev = version;
+    repo = "pngpaste";
+    tag = finalAttrs.version;
    sha256 = "uvajxSelk1Wfd5is5kmT2fzDShlufBgC0PDCeabEOSE=";
  };

  installPhase = ''
-    mkdir -p $out/bin
-    cp pngpaste $out/bin
+    runHook preInstall
+    install -Dm555 pngpaste $out/bin
+    runHook postInstall
  '';

  meta = {
@@ -32,9 +31,9 @@ stdenv.mkDerivation {
      falling back to PNG.
    '';
    homepage = "https://github.com/jcsalterego/pngpaste";
-    changelog = "https://github.com/jcsalterego/pngpaste/raw/${version}/CHANGELOG.md";
+    changelog = "https://github.com/jcsalterego/pngpaste/raw/${finalAttrs.version}/CHANGELOG.md";
    platforms = lib.platforms.darwin;
    license = lib.licenses.bsd2;
    maintainers = with lib.maintainers; [ samw ];
  };
-}
+})
@@ -8,7 +8,7 @@

 python3Packages.buildPythonApplication rec {
  pname = "prefect";
-  version = "3.4.2";
+  version = "3.4.5";
  pyproject = true;

  # Trying to install from source is challenging
@@ -17,7 +17,7 @@ python3Packages.buildPythonApplication rec {
  # Source will be missing sdist, uv.lock, ui artefacts ...
  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-BORFXIikiX5Cu1rT8jUijkjAnncTACr8lEs/k2fC5Mk=";
+    hash = "sha256-jS/r5LskvgWLIiMSVMM6jgxVbuolI+w+g5Xq/xPYXOU=";
  };

  pythonRelaxDeps = [
@@ -2,39 +2,37 @@
  lib,
  stdenv,
  fetchFromGitHub,
-  fetchpatch,
-  cereal_1_3_2,
-  cmake,
-  doxygen,
-  eigen,
  fontconfig,
-  graphviz,
-  jrl-cmakemodules,
-  simde,
-  matio,
+  nix-update-script,
  pythonSupport ? false,
  python3Packages,
+
+  # nativeBuildInputs
+  cmake,
+  doxygen,
+  graphviz,
+
+  # propagatedBuildInputs
+  cereal_1_3_2,
+  eigen,
+  jrl-cmakemodules,
+  simde,
+
+  # checkInputs
+  matio,
+
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "proxsuite";
-  version = "0.6.7";
+  version = "0.7.2";

  src = fetchFromGitHub {
    owner = "simple-robotics";
    repo = "proxsuite";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-iKc55WDHArmmIM//Wir6FHrNV84HnEDcBUlwnsbtMME=";
+    hash = "sha256-1+a5tFOlEwzhGZtll35EMFceD0iUOOQCbwJd9NcFDlk=";
  };

-  patches = [
-    # Fix use of system cereal
-    # This was merged upstream and can be removed on next release
-    (fetchpatch {
-      url = "https://github.com/Simple-Robotics/proxsuite/pull/352/commits/8305864f13ca7dff7210f89004a56652b71f8891.patch";
-      hash = "sha256-XMS/zHFVrEp1P6aDlGrLbrcmuKq42+GdZRH9ObewNCY=";
-    })
-  ];
-
  outputs = [
    "doc"
    "out"
@@ -52,17 +50,24 @@ stdenv.mkDerivation (finalAttrs: {

  strictDeps = true;

-  nativeBuildInputs = [
-    cmake
-    doxygen
-    graphviz
-  ] ++ lib.optional pythonSupport python3Packages.pythonImportsCheckHook;
+  nativeBuildInputs =
+    [
+      cmake
+      doxygen
+      graphviz
+    ]
+    ++ lib.optionals pythonSupport [
+      python3Packages.python
+      python3Packages.pythonImportsCheckHook
+    ];
+
  propagatedBuildInputs = [
    cereal_1_3_2
    eigen
    jrl-cmakemodules
    simde
-  ] ++ lib.optionals pythonSupport [ python3Packages.pybind11 ];
+  ] ++ lib.optionals pythonSupport [ python3Packages.nanobind ];
+
  checkInputs =
    [ matio ]
    ++ lib.optionals pythonSupport [
@@ -85,11 +90,13 @@ stdenv.mkDerivation (finalAttrs: {
  doCheck = true;
  pythonImportsCheck = [ "proxsuite" ];

+  passthru.updateScript = nix-update-script { };
+
  meta = {
    description = "Advanced Proximal Optimization Toolbox";
    homepage = "https://github.com/Simple-Robotics/proxsuite";
    license = lib.licenses.bsd2;
    maintainers = with lib.maintainers; [ nim65s ];
-    platforms = lib.platforms.unix;
+    platforms = lib.platforms.unix ++ lib.platforms.windows;
  };
 })
@@ -31,13 +31,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "roxterm";
-  version = "3.16.2";
+  version = "3.16.3";

  src = fetchFromGitHub {
    owner = "realh";
    repo = "roxterm";
    rev = finalAttrs.version;
-    hash = "sha256-j1DVQd8OD7k9KWfCbYUDaKevabIQXdWjMNJXyC57+Ns=";
+    hash = "sha256-aS15oFLJVsUDzBtisnHS9S92cZs4w8mqhwrpJJm+6lQ=";
  };

  nativeBuildInputs = [
@@ -1,33 +1,17 @@
 {
  lib,
-  stdenv,
+  stdenvNoCC,
  coursier,
  buildGraalvmNativeImage,
 }:

-let
-  baseName = "scala-update";
+buildGraalvmNativeImage (finalAttrs: {
+  pname = "scala-update";
  version = "0.2.2";
-  deps = stdenv.mkDerivation {
-    name = "${baseName}-deps-${version}";
-    buildCommand = ''
-      export COURSIER_CACHE=$(pwd)
-      ${coursier}/bin/cs fetch io.github.kitlangton:scala-update_2.13:${version} > deps
-      mkdir -p $out/share/java
-      cp $(< deps) $out/share/java/
-    '';
-    outputHashMode = "recursive";
-    outputHashAlgo = "sha256";
-    outputHash = "kNnFzzHn+rFq4taqRYjBYaDax0MHW+vIoSFVN3wxA8M=";
-  };
-in
-buildGraalvmNativeImage {
-  pname = baseName;
-  inherit version;

-  buildInputs = [ deps ];
+  buildInputs = [ finalAttrs.finalPackage.passthru.deps ];

-  src = "${deps}/share/java/${baseName}_2.13-${version}.jar";
+  src = "${finalAttrs.finalPackage.passthru.deps}/share/java/scala-update_2.13-${finalAttrs.version}.jar";

  extraNativeImageBuildArgs = [
    "--no-fallback"
@@ -38,19 +22,37 @@ buildGraalvmNativeImage {
  buildPhase = ''
    runHook preBuild

-    native-image ''${nativeImageBuildArgs[@]} -cp $(JARS=("${deps}/share/java"/*.jar); IFS=:; echo "''${JARS[*]}")
+    native-image ''${nativeImageArgs[@]} -cp $(JARS=("${finalAttrs.finalPackage.passthru.deps}/share/java"/*.jar); IFS=:; echo "''${JARS[*]}")

    runHook postBuild
  '';

  installCheckPhase = ''
-    $out/bin/${baseName} --version | grep -q "${version}"
+    runHook preInstallCheck
+
+    $out/bin/scala-update --version | grep -q "${finalAttrs.version}"
+
+    runHook postInstallCheck
  '';

-  meta = with lib; {
+  passthru.deps = stdenvNoCC.mkDerivation {
+    name = "scala-update-deps-${finalAttrs.version}";
+    buildCommand = ''
+      export COURSIER_CACHE=$(pwd)
+      ${lib.getExe coursier} fetch io.github.kitlangton:scala-update_2.13:${finalAttrs.version} > deps
+      mkdir -p $out/share/java
+      cp $(< deps) $out/share/java/
+    '';
+    outputHashMode = "recursive";
+    outputHashAlgo = "sha256";
+    outputHash = "kNnFzzHn+rFq4taqRYjBYaDax0MHW+vIoSFVN3wxA8M=";
+  };
+
+  meta = {
    description = "Update your Scala dependencies interactively";
    homepage = "https://github.com/kitlangton/scala-update";
-    license = licenses.asl20;
-    maintainers = [ maintainers.rtimush ];
+    license = lib.licenses.asl20;
+    maintainers = [ lib.maintainers.rtimush ];
+    mainProgram = "scala-update";
  };
-}
+})
@@ -14,14 +14,14 @@

 python3Packages.buildPythonApplication rec {
  pname = "seagoat";
-  version = "0.54.18";
+  version = "1.0.6";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "kantord";
    repo = "SeaGOAT";
    tag = "v${version}";
-    hash = "sha256-vRaC6YrqejtRs8NHoTj6DB0CAYMSygRMDOTaJyk1BZc=";
+    hash = "sha256-7GUCWg82zBe5a4HV6t8NCuGR93KX2vMlvHA6fh9TPuE=";
  };

  build-system = [ python3Packages.poetry-core ];
@@ -52,13 +52,13 @@ let
    '';
  });

-  version = "7.56.0";
+  version = "7.56.1";

  src = fetchFromGitHub {
    owner = "signalapp";
    repo = "Signal-Desktop";
    tag = "v${version}";
-    hash = "sha256-BrgBlDEgb08oX7Mh/P4nuoM+dkSDpB45zOtDNMYeZr0=";
+    hash = "sha256-zPoZ76ujS8H4ls7RW4bojRIKOrPRJPjdHJVAl1cH9vY=";
  };

  sticker-creator = stdenv.mkDerivation (finalAttrs: {
@@ -128,7 +128,7 @@ stdenv.mkDerivation (finalAttrs: {
  env = {
    ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
    SIGNAL_ENV = "production";
-    SOURCE_DATE_EPOCH = 1748456277;
+    SOURCE_DATE_EPOCH = 1749072888;
  };

  preBuild = ''
@@ -9,16 +9,16 @@

 buildGoModule rec {
  pname = "spacectl";
-  version = "1.14.1";
+  version = "1.14.2";

  src = fetchFromGitHub {
    owner = "spacelift-io";
    repo = "spacectl";
    rev = "v${version}";
-    hash = "sha256-53c/FCLYTlqZGJEEcsQXeoFqU/+aEDNyVwb82OpbfNQ=";
+    hash = "sha256-5qdKOv/kso+VTpJjxs3Vq1LhBr2Ww/Y+/Fu5Mwux6Po=";
  };

-  vendorHash = "sha256-3ejwdzSA/MOR7Mosvl+Hyqty+0pIpkHdXUD7zPQ9/Bk=";
+  vendorHash = "sha256-u0Ms3veABPPteCclJr3rFyyM9660dmno8h2XF/s8T5Y=";

  nativeBuildInputs = [ installShellFiles ];

@@ -39,13 +39,13 @@ stdenv.mkDerivation {
  pname = binName;
  # versions are specified in `squeezelite.h`
  # see https://github.com/ralph-irving/squeezelite/issues/29
-  version = "2.0.0.1533";
+  version = "2.0.0.1541";

  src = fetchFromGitHub {
    owner = "ralph-irving";
    repo = "squeezelite";
-    rev = "bb7ae0615f6e661c217a1c77fdff70122859c3c5";
-    hash = "sha256-R3yCJJMsrD3dkrfkm4q69YkqfjBdZTiB9UXIriyPawA=";
+    rev = "72e1fd8abfa9b2f8e9636f033247526920878718";
+    hash = "sha256-1uzkf7vkzfHdsWvWcXnUv279kgtzrHLU0hAPaTKRWI8=";
  };

  buildInputs =
@@ -7,13 +7,13 @@

 buildGoModule (finalAttrs: {
  pname = "tinfoil-cli";
-  version = "0.0.21";
+  version = "0.0.22";

  src = fetchFromGitHub {
    owner = "tinfoilsh";
    repo = "tinfoil-cli";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-wgXiu5RcWPWINQ4iepxncU6lpJOedV722uNmGliCuW0=";
+    hash = "sha256-6gWzAd1EgKXtwqxThEi4fpL8qUpFX7YqKfze1ybLlsM=";
  };

  vendorHash = "sha256-MriCtyjWr4tJ9H+2z4KmnZw7ssqOEM3GL9ZGxUTm11k=";
@@ -6,22 +6,23 @@
  unstableGitUpdater,
 }:

-buildGoModule {
-  pname = "opentofu-ls";
-  version = "0-unstable-2025-02-26";
+buildGoModule (finalAttrs: {
+  pname = "tofu-ls";
+  version = "0.0.2";

  src = fetchFromGitHub {
    owner = "opentofu";
-    repo = "opentofu-ls";
-    rev = "978a5fb56519a9f17833709119d2eb5fe604784e";
-    hash = "sha256-xBJkIuYqqUan2fo+s426vEIr5Qri8dM5arJACvKFjws=";
+    repo = "tofu-ls";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-ioUhESBnGhVxeJQ+0lZ4tjfCWbc3mS2o584EXuXIqso=";
  };

-  vendorHash = "sha256-CrbLqcwPXHB80m4VhqrC8j5VhU2BUeuNy87+bc+Bq6I=";
+  vendorHash = "sha256-rUvqIebAhnR9b/RAiW8Md/D8NgDDKro1XodXSCtstjA=";

  ldflags = [
    "-s"
    "-w"
+    "-X 'main.rawVersion=${finalAttrs.version}'"
  ];

  checkFlags =
@@ -41,15 +42,19 @@ buildGoModule {

  __darwinAllowLocalNetworking = true;

+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+  versionCheckProgramArg = "--version";
+
  passthru = {
    updateScript = unstableGitUpdater { };
  };

  meta = {
    description = "OpenTofu Language Server";
-    homepage = "https://github.com/opentofu/opentofu-ls";
+    homepage = "https://github.com/opentofu/tofu-ls";
    license = lib.licenses.mpl20;
    maintainers = with lib.maintainers; [ GaetanLepage ];
-    mainProgram = "opentofu-ls";
+    mainProgram = "tofu-ls";
  };
-}
+})
@@ -124,7 +124,6 @@ python3Packages.buildPythonApplication rec {
    mainProgram = "ulauncher";
    maintainers = with maintainers; [
      aaronjanse
-      sebtm
    ];
  };
 }
@@ -0,0 +1,71 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  nix-update-script,
+  makeWrapper,
+  testers,
+  libpulseaudio,
+  dotool,
+  stdenv,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "voxinput";
+  version = "0.3.0";
+
+  src = fetchFromGitHub {
+    owner = "richiejp";
+    repo = "VoxInput";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-ykWb5I3cd3DMDVqYrcmOtCKhLpmob7HBXs5Ek5E7/do=";
+  };
+
+  vendorHash = "sha256-OserWlRhKyTvLrYSikNCjdDdTATIcWTfqJi9n4mHVLE=";
+
+  nativeBuildInputs = [
+    makeWrapper
+  ];
+
+  buildInputs = [
+    libpulseaudio
+    dotool
+  ];
+
+  # To take advantage of the udev rule something like `services.udev.packages = [ nixpkgs.voxinput ]`
+  # needs to be added to your configuration.nix
+  postInstall =
+    ''
+      mv $out/bin/VoxInput $out/bin/voxinput_tmp ; mv $out/bin/voxinput_tmp $out/bin/voxinput
+    ''
+    + lib.optionalString stdenv.hostPlatform.isLinux ''
+      wrapProgram $out/bin/voxinput \
+        --prefix PATH : ${lib.makeBinPath [ dotool ]}
+      mkdir -p $out/lib/udev/rules.d
+      echo 'KERNEL=="uinput", GROUP="input", MODE="0620", OPTIONS+="static_node=uinput"' > $out/lib/udev/rules.d/99-voxinput.rules
+    '';
+
+  postFixup = lib.optionalString stdenv.hostPlatform.isLinux ''
+    patchelf $out/bin/.voxinput-wrapped \
+      --add-rpath ${lib.makeLibraryPath [ libpulseaudio ]}
+  '';
+
+  passthru = {
+    updateScript = nix-update-script { };
+    tests.version = testers.testVersion {
+      package = finalAttrs.finalPackage;
+      command = "voxinput ver";
+      version = "v${finalAttrs.version}";
+    };
+  };
+
+  meta = {
+    homepage = "https://github.com/richiejp/VoxInput";
+    description = "Voice to text for any Linux app via dotool/uinput and the LocalAI/OpenAI transcription API";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.richiejp ];
+    platforms = lib.platforms.unix;
+    changelog = "https://github.com/richiejp/VoxInput/releases/tag/v${finalAttrs.version}";
+    mainProgram = "voxinput";
+  };
+})
@@ -4,31 +4,29 @@
  fetchFromGitHub,
 }:

-buildGoModule rec {
+buildGoModule (finalAttrs: {
  pname = "vt-cli";
-  version = "1.0.1";
+  version = "1.1.1";

  src = fetchFromGitHub {
    owner = "VirusTotal";
    repo = "vt-cli";
-    tag = version;
-    hash = "sha256-NB5eo+6IwIxhQX1lwJzPOZ0pSeFVo7LYIEEmDqE4A7Y=";
+    tag = finalAttrs.version;
+    hash = "sha256-zeJGXJ1l+Vl/0IT/LVSOuSodnejFukCPIkrg4suKQsk=";
  };

  vendorHash = "sha256-s90a35fFHO8Tt7Zjf9bk1VVD2xhG1g4rKmtIuMl0bMQ=";

-  ldflags = [
-    "-X github.com/VirusTotal/vt-cli/cmd.Version=${version}"
-  ];
+  ldflags = [ "-X github.com/VirusTotal/vt-cli/cmd.Version=${finalAttrs.version}" ];

  subPackages = [ "vt" ];

  meta = {
    description = "VirusTotal Command Line Interface";
    homepage = "https://github.com/VirusTotal/vt-cli";
-    changelog = "https://github.com/VirusTotal/vt-cli/releases/tag/${version}";
+    changelog = "https://github.com/VirusTotal/vt-cli/releases/tag/${finalAttrs.version}";
    license = lib.licenses.asl20;
    mainProgram = "vt";
    maintainers = with lib.maintainers; [ dit7ya ];
  };
-}
+})
@@ -7,14 +7,14 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "vunnel";
-  version = "0.32.0";
+  version = "0.33.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "anchore";
    repo = "vunnel";
    tag = "v${version}";
-    hash = "sha256-5zO1/lfB5ULJqSt14by9OYFT/0H9ZGSkA90wmf7dB5U=";
+    hash = "sha256-NmU+84hgKryn1zX7vk0ixy2msxeqwGwuTm1H44Lue7I=";
    leaveDotGit = true;
  };

@@ -81,7 +81,7 @@ python3.pkgs.buildPythonApplication rec {
  meta = {
    description = "Tool for collecting vulnerability data from various sources";
    homepage = "https://github.com/anchore/vunnel";
-    changelog = "https://github.com/anchore/vunnel/releases/tag/v${version}";
+    changelog = "https://github.com/anchore/vunnel/releases/tag/${src.tag}";
    license = lib.licenses.asl20;
    maintainers = with lib.maintainers; [ fab ];
    mainProgram = "vunnel";
@@ -7,18 +7,18 @@

 rustPlatform.buildRustPackage rec {
  pname = "wasmi";
-  version = "0.46.0";
+  version = "0.47.0";

  src = fetchFromGitHub {
    owner = "paritytech";
    repo = "wasmi";
    tag = "v${version}";
-    hash = "sha256-H/nuV4OMj2xCVej1u8zh9c9sp+XH+Zdpb080ZoA3xvc=";
+    hash = "sha256-N2zEc+++286FBJl6cGh8ibOvHHwMnh4PcOLaRhB/rC0=";
    fetchSubmodules = true;
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-IDoZ6A5c/ayCusdb9flR3S/CBxJIWHQlEYP8ILRWXFw=";
+  cargoHash = "sha256-asl8saHlZ5A05QFs2pSs6jMM6AI29c4DTPu4zw+FMug=";
  passthru.updateScript = nix-update-script { };

  meta = with lib; {
@@ -1,20 +1,20 @@
 {
  "aarch64-darwin": {
-    "version": "1.9.2",
-    "vscodeVersion": "1.99.1",
-    "url": "https://windsurf-stable.codeiumdata.com/darwin-arm64/stable/8cb7f313303c8b35844a56b6fe0f76e508261569/Windsurf-darwin-arm64-1.9.2.zip",
-    "sha256": "b3edf57d19fab5ceac0cd3daee3c54052e503b052efebad0b6bfeac3b9f5a979"
+    "version": "1.10.1",
+    "vscodeVersion": "1.99.3",
+    "url": "https://windsurf-stable.codeiumdata.com/darwin-arm64/stable/1c62a60cfa8be3ea8c2f98e0b2e3440d30b508dd/Windsurf-darwin-arm64-1.10.1.zip",
+    "sha256": "26bad53b1a37e82471d6f95f0967d0e7a64b9a98715477e299a3ccddefe62f59"
  },
  "x86_64-darwin": {
-    "version": "1.9.2",
-    "vscodeVersion": "1.99.1",
-    "url": "https://windsurf-stable.codeiumdata.com/darwin-x64/stable/8cb7f313303c8b35844a56b6fe0f76e508261569/Windsurf-darwin-x64-1.9.2.zip",
-    "sha256": "227ed7b01b9f7637d126ef880b6e0c07daa263b0740e6394e32ad4ebedd05d78"
+    "version": "1.10.1",
+    "vscodeVersion": "1.99.3",
+    "url": "https://windsurf-stable.codeiumdata.com/darwin-x64/stable/1c62a60cfa8be3ea8c2f98e0b2e3440d30b508dd/Windsurf-darwin-x64-1.10.1.zip",
+    "sha256": "bbec36bbe725909a0ca310c9f753abe5def3d13aac9cdf70c7bd84831d333361"
  },
  "x86_64-linux": {
-    "version": "1.9.2",
-    "vscodeVersion": "1.99.1",
-    "url": "https://windsurf-stable.codeiumdata.com/linux-x64/stable/8cb7f313303c8b35844a56b6fe0f76e508261569/Windsurf-linux-x64-1.9.2.tar.gz",
-    "sha256": "ee5a4ac38f9a2518a54429cb235bae76d74b3fff0f5947dbfc29738d78f28542"
+    "version": "1.10.1",
+    "vscodeVersion": "1.99.3",
+    "url": "https://windsurf-stable.codeiumdata.com/linux-x64/stable/1c62a60cfa8be3ea8c2f98e0b2e3440d30b508dd/Windsurf-linux-x64-1.10.1.tar.gz",
+    "sha256": "c054599887b0a69446187e4e777c634b248f812d6240ee6b765425494847fd1a"
  }
 }
@@ -22,16 +22,18 @@
  wayland,
  wayland-scanner,
  zlib,
+  nix-update-script,
 }:
+
 stdenv.mkDerivation {
  pname = "wlvncc";
-  version = "unstable-2024-11-23";
+  version = "0-unstable-2025-04-21";

  src = fetchFromGitHub {
    owner = "any1";
    repo = "wlvncc";
-    rev = "0489e29fba374a08be8ba4a64d492a3c74018f41";
-    hash = "sha256-jFP4O6zo1fYULOVX9+nuTNAy4NuBKsDKOy+WUQRUjdI=";
+    rev = "a6a5463a9c69ce4db04d8d699dd58e1ba8560a0a";
+    hash = "sha256-8p2IOQvcjOV5xe0c/RWP6aRHtQnu9tYI7QgcC13sg4k=";
  };

  nativeBuildInputs = [
@@ -60,12 +62,14 @@ stdenv.mkDerivation {
    zlib
  ];

-  meta = with lib; {
+  passthru.updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; };
+
+  meta = {
    description = "Wayland Native VNC Client";
    homepage = "https://github.com/any1/wlvncc";
-    license = licenses.gpl2Only;
-    maintainers = with maintainers; [ teutat3s ];
-    platforms = platforms.linux;
+    license = lib.licenses.gpl2Only;
+    maintainers = with lib.maintainers; [ teutat3s ];
+    platforms = lib.platforms.linux;
    mainProgram = "wlvncc";
  };
 }
@@ -6,11 +6,11 @@

 appimageTools.wrapType2 rec {
  pname = "xlights";
-  version = "2025.05";
+  version = "2025.06";

  src = fetchurl {
    url = "https://github.com/smeighan/xLights/releases/download/${version}/xLights-${version}-x86_64.AppImage";
-    hash = "sha256-uutiM/kLsvNdDi08e5DyyTYGYwUe4UZMyTS1P0ijUP0=";
+    hash = "sha256-8j/52VQP/w/Y/NDAsSnhFXUwpFQ5YrINocmzGsnJ6Rs=";
  };

  meta = {
@@ -4,17 +4,15 @@
  fetchurl,
 }:

-buildGraalvmNativeImage rec {
+buildGraalvmNativeImage (finalAttrs: {
  pname = "yamlscript";
  version = "0.1.96";

  src = fetchurl {
-    url = "https://github.com/yaml/yamlscript/releases/download/${version}/yamlscript.cli-${version}-standalone.jar";
+    url = "https://github.com/yaml/yamlscript/releases/download/${finalAttrs.version}/yamlscript.cli-${finalAttrs.version}-standalone.jar";
    hash = "sha256-nwqZhGOtNEJ0qzOTFdHFWBSyt4hmLhn6nhdCz2jyUbg=";
  };

-  executable = "ys";
-
  extraNativeImageBuildArgs = [
    "--native-image-info"
    "--no-fallback"
@@ -30,15 +28,19 @@ buildGraalvmNativeImage rec {
  doInstallCheck = true;

  installCheckPhase = ''
-    $out/bin/ys  -e 'say: (+ 1 2)' | fgrep 3
+    runHook preInstallCheck
+
+    $out/bin/ys -e 'say: (+ 1 2)' | fgrep 3
+
+    runHook postInstallCheck
  '';

-  meta = with lib; {
+  meta = {
    description = "Programming in YAML";
    homepage = "https://github.com/yaml/yamlscript";
-    sourceProvenance = with sourceTypes; [ binaryBytecode ];
-    license = licenses.mit;
+    sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
+    license = lib.licenses.mit;
    mainProgram = "ys";
-    maintainers = with maintainers; [ sgo ];
+    maintainers = with lib.maintainers; [ sgo ];
  };
-}
+})
@@ -4,19 +4,20 @@
  fetchFromGitHub,
 }:

-buildGoModule rec {
+buildGoModule (finalAttrs: {
  pname = "zoraxy";
-  version = "3.1.9";
+  version = "3.2.2";
+
  src = fetchFromGitHub {
    owner = "tobychui";
    repo = "zoraxy";
-    tag = "v${version}";
-    hash = "sha256-zE8ksuZhoi/wPTpo/jq7c5sx0B6hwBr8djvzo9ea9DI=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-CGSGxiMnWI26t5fD5s74PgrL7nkJXxO3CNCK0ZHpR4I=";
  };

-  sourceRoot = "${src.name}/src";
+  sourceRoot = "${finalAttrs.src.name}/src";

-  vendorHash = "sha256-XHnDlGIb2K28udWHdkfXt0dPUGmGAjfULB9fykAlsJU=";
+  vendorHash = "sha256-Bl3FI8lodSV5kzHvM8GHbQsep0W8s2BG8IbGf2AahZc=";

  checkFlags =
    let
@@ -29,6 +30,9 @@ buildGoModule rec {
        "TestHandlePing"
        "TestListTable"
        "TestWriteAndRead"
+        "TestHTTP1p1KeepAlive"
+        "TestGetPluginListFromURL"
+        "TestUpdateDownloadablePluginList"
      ];
    in
    [ "-skip=^${builtins.concatStringsSep "$|^" skippedTests}$" ];
@@ -36,10 +40,10 @@ buildGoModule rec {
  meta = {
    description = "General purpose HTTP reverse proxy and forwarding tool written in Go";
    homepage = "https://zoraxy.arozos.com/";
-    changelog = "https://github.com/tobychui/zoraxy/blob/v${version}/CHANGELOG.md";
+    changelog = "https://github.com/tobychui/zoraxy/blob/v${finalAttrs.version}/CHANGELOG.md";
    license = lib.licenses.agpl3Only;
    maintainers = [ lib.maintainers.luftmensch-luftmensch ];
    mainProgram = "zoraxy";
    platforms = lib.platforms.linux;
  };
-}
+})
@@ -3,15 +3,14 @@
  buildGraalvmNativeImage,
  fetchurl,
  testers,
-  zprint,
 }:

-buildGraalvmNativeImage rec {
+buildGraalvmNativeImage (finalAttrs: {
  pname = "zprint";
  version = "1.3.0";

  src = fetchurl {
-    url = "https://github.com/kkinnear/${pname}/releases/download/${version}/${pname}-filter-${version}";
+    url = "https://github.com/kkinnear/zprint/releases/download/${finalAttrs.version}/zprint-filter-${finalAttrs.version}";
    sha256 = "sha256-0ogZkC8j+ja0aWvFgNhygof4GZ78aqQA75lRxYfu6do=";
  };

@@ -25,12 +24,12 @@ buildGraalvmNativeImage rec {
  ];

  passthru.tests.version = testers.testVersion {
-    inherit version;
-    package = zprint;
+    inherit (finalAttrs) version;
+    package = finalAttrs.finalPackage;
    command = "zprint --version";
  };

-  meta = with lib; {
+  meta = {
    description = "Clojure/EDN source code formatter and pretty printer";
    longDescription = ''
      Library and command line tool providing a variety of pretty printing capabilities
@@ -38,8 +37,8 @@ buildGraalvmNativeImage rec {
      As such, it supports a number of major source code formatting approaches
    '';
    homepage = "https://github.com/kkinnear/zprint";
-    license = licenses.mit;
-    maintainers = with maintainers; [ stelcodes ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ stelcodes ];
    mainProgram = "zprint";
  };
-}
+})
@@ -52,6 +52,11 @@ let
      # BEAM-based languages.
      elixir = elixir_1_18;

+      elixir_1_19 = lib'.callElixir ../interpreters/elixir/1.19.nix {
+        inherit erlang;
+        debugInfo = true;
+      };
+
      elixir_1_18 = lib'.callElixir ../interpreters/elixir/1.18.nix {
        inherit erlang;
        debugInfo = true;
@@ -1,116 +1,113 @@
 {
  lib,
  buildGraalvmNativeImage,
-  graalvmPackages,
  fetchurl,
  writeScript,
  installShellFiles,
 }:

-let
-  babashka-unwrapped = buildGraalvmNativeImage rec {
-    pname = "babashka-unwrapped";
-    version = "1.12.200";
+buildGraalvmNativeImage (finalAttrs: {
+  pname = "babashka-unwrapped";
+  version = "1.12.200";

-    src = fetchurl {
-      url = "https://github.com/babashka/babashka/releases/download/v${version}/babashka-${version}-standalone.jar";
-      sha256 = "sha256-hxcoVUaL19RM56fG8oxSKQwPHXDzaoSdCdHXSTXQ9fI=";
-    };
-
-    graalvmDrv = graalvmPackages.graalvm-ce;
-
-    executable = "bb";
-
-    nativeBuildInputs = [ installShellFiles ];
-
-    extraNativeImageBuildArgs = [
-      "-H:+ReportExceptionStackTraces"
-      "--no-fallback"
-      "--native-image-info"
-      "--enable-preview"
-    ];
-
-    doInstallCheck = true;
-
-    installCheckPhase = ''
-      $out/bin/bb --version | fgrep '${version}'
-      $out/bin/bb '(+ 1 2)' | fgrep '3'
-      $out/bin/bb '(vec (dedupe *input*))' <<< '[1 1 1 1 2]' | fgrep '[1 2]'
-      $out/bin/bb '(prn "bépo àê")' | fgrep 'bépo àê'
-      $out/bin/bb '(:out (babashka.process/sh "echo" "ä"))' | fgrep 'ä'
-      $out/bin/bb '(into-array [:f])'
-    '';
-
-    postInstall = ''
-      installShellCompletion --cmd bb --bash ${./completions/bb.bash}
-      installShellCompletion --cmd bb --zsh ${./completions/bb.zsh}
-      installShellCompletion --cmd bb --fish ${./completions/bb.fish}
-    '';
-
-    passthru.updateScript = writeScript "update-babashka" ''
-      #!/usr/bin/env nix-shell
-      #!nix-shell -i bash -p curl common-updater-scripts jq libarchive
-
-      set -euo pipefail
-      shopt -s inherit_errexit
-
-      latest_version="$(curl \
-        ''${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} \
-        -fsL "https://api.github.com/repos/babashka/babashka/releases/latest" \
-        | jq -r '.tag_name')"
-
-      if [ "$(update-source-version babashka-unwrapped "''${latest_version/v/}" --print-changes)" = "[]" ]; then
-        # no need to update babashka.clojure-tools when babashka-unwrapped wasn't updated
-        exit 0
-      fi
-
-      clojure_tools_version=$(curl \
-        -fsL \
-        "https://github.com/babashka/babashka/releases/download/''${latest_version}/babashka-''${latest_version/v/}-standalone.jar" \
-        | bsdtar -qxOf - borkdude/deps.clj \
-        | ${babashka-unwrapped}/bin/bb -I -o -e "(or (some->> *input* (filter #(= '(def version) (take 2 %))) first last last last) (throw (ex-info \"Couldn't find expected '(def version ...)' form in 'borkdude/deps.clj'.\" {})))")
-
-      update-source-version babashka.clojure-tools "$clojure_tools_version" \
-        --file="pkgs/development/interpreters/babashka/clojure-tools.nix"
-    '';
-
-    meta = with lib; {
-      description = "Clojure babushka for the grey areas of Bash";
-      longDescription = ''
-        The main idea behind babashka is to leverage Clojure in places where you
-        would be using bash otherwise.
-
-        As one user described it:
-
-            I’m quite at home in Bash most of the time, but there’s a substantial
-            grey area of things that are too complicated to be simple in bash, but
-            too simple to be worth writing a clj/s script for. Babashka really
-            seems to hit the sweet spot for those cases.
-
-        Goals:
-
-        - Low latency Clojure scripting alternative to JVM Clojure.
-        - Easy installation: grab the self-contained binary and run. No JVM needed.
-        - Familiarity and portability:
-          - Scripts should be compatible with JVM Clojure as much as possible
-          - Scripts should be platform-independent as much as possible. Babashka
-            offers support for linux, macOS and Windows.
-        - Allow interop with commonly used classes like java.io.File and System
-        - Multi-threading support (pmap, future, core.async)
-        - Batteries included (tools.cli, cheshire, ...)
-        - Library support via popular tools like the clojure CLI
-      '';
-      homepage = "https://github.com/babashka/babashka";
-      changelog = "https://github.com/babashka/babashka/blob/v${version}/CHANGELOG.md";
-      sourceProvenance = with sourceTypes; [ binaryBytecode ];
-      license = licenses.epl10;
-      maintainers = with maintainers; [
-        bandresen
-        bhougland
-        DerGuteMoritz
-        jlesquembre
-      ];
-    };
+  src = fetchurl {
+    url = "https://github.com/babashka/babashka/releases/download/v${finalAttrs.version}/babashka-${finalAttrs.version}-standalone.jar";
+    sha256 = "sha256-hxcoVUaL19RM56fG8oxSKQwPHXDzaoSdCdHXSTXQ9fI=";
  };
-in
-babashka-unwrapped
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  extraNativeImageBuildArgs = [
+    "-H:+ReportExceptionStackTraces"
+    "--no-fallback"
+    "--native-image-info"
+    "--enable-preview"
+  ];
+
+  doInstallCheck = true;
+
+  installCheckPhase = ''
+    runHook preInstallCheck
+
+    $out/bin/bb --version | fgrep '${finalAttrs.version}'
+    $out/bin/bb '(+ 1 2)' | fgrep '3'
+    $out/bin/bb '(vec (dedupe *input*))' <<< '[1 1 1 1 2]' | fgrep '[1 2]'
+    $out/bin/bb '(prn "bépo àê")' | fgrep 'bépo àê'
+    $out/bin/bb '(:out (babashka.process/sh "echo" "ä"))' | fgrep 'ä'
+    $out/bin/bb '(into-array [:f])'
+
+    runHook postInstallCheck
+  '';
+
+  postInstall = ''
+    installShellCompletion --cmd bb --bash ${./completions/bb.bash}
+    installShellCompletion --cmd bb --zsh ${./completions/bb.zsh}
+    installShellCompletion --cmd bb --fish ${./completions/bb.fish}
+  '';
+
+  passthru.updateScript = writeScript "update-babashka" ''
+    #!/usr/bin/env nix-shell
+    #!nix-shell -i bash -p curl common-updater-scripts jq libarchive
+
+    set -euo pipefail
+    shopt -s inherit_errexit
+
+    latest_version="$(curl \
+      ''${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} \
+      -fsL "https://api.github.com/repos/babashka/babashka/releases/latest" \
+      | jq -r '.tag_name')"
+
+    if [ "$(update-source-version babashka-unwrapped "''${latest_version/v/}" --print-changes)" = "[]" ]; then
+      # no need to update babashka.clojure-tools when babashka-unwrapped wasn't updated
+      exit 0
+    fi
+
+    clojure_tools_version=$(curl \
+      -fsL \
+      "https://github.com/babashka/babashka/releases/download/''${latest_version}/babashka-''${latest_version/v/}-standalone.jar" \
+      | bsdtar -qxOf - borkdude/deps.clj \
+      | ${lib.getExe finalAttrs.finalPackage} -I -o -e "(or (some->> *input* (filter #(= '(def version) (take 2 %))) first last last last) (throw (ex-info \"Couldn't find expected '(def version ...)' form in 'borkdude/deps.clj'.\" {})))")
+
+    update-source-version babashka.clojure-tools "$clojure_tools_version" \
+      --file="pkgs/development/interpreters/babashka/clojure-tools.nix"
+  '';
+
+  meta = {
+    description = "Clojure babushka for the grey areas of Bash";
+    longDescription = ''
+      The main idea behind babashka is to leverage Clojure in places where you
+      would be using bash otherwise.
+
+      As one user described it:
+
+          I’m quite at home in Bash most of the time, but there’s a substantial
+          grey area of things that are too complicated to be simple in bash, but
+          too simple to be worth writing a clj/s script for. Babashka really
+          seems to hit the sweet spot for those cases.
+
+      Goals:
+
+      - Low latency Clojure scripting alternative to JVM Clojure.
+      - Easy installation: grab the self-contained binary and run. No JVM needed.
+      - Familiarity and portability:
+        - Scripts should be compatible with JVM Clojure as much as possible
+        - Scripts should be platform-independent as much as possible. Babashka
+          offers support for linux, macOS and Windows.
+      - Allow interop with commonly used classes like java.io.File and System
+      - Multi-threading support (pmap, future, core.async)
+      - Batteries included (tools.cli, cheshire, ...)
+      - Library support via popular tools like the clojure CLI
+    '';
+    homepage = "https://github.com/babashka/babashka";
+    changelog = "https://github.com/babashka/babashka/blob/v${finalAttrs.version}/CHANGELOG.md";
+    sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
+    license = lib.licenses.epl10;
+    mainProgram = "bb";
+    maintainers = with lib.maintainers; [
+      bandresen
+      bhougland
+      DerGuteMoritz
+      jlesquembre
+    ];
+  };
+})
@@ -0,0 +1,8 @@
+{ mkDerivation }:
+mkDerivation {
+  version = "1.19.0-rc.0";
+  sha256 = "sha256-9Upk3DLxFVetK3fChLr0UjRi2WnvSndVvBW0RfM5hTk=";
+  # https://hexdocs.pm/elixir/1.19.0-rc.0/compatibility-and-deprecations.html#table-of-deprecations
+  minimumOTPVersion = "26";
+  escriptPath = "lib/elixir/scripts/generate_app.escript";
+}
@@ -5,6 +5,7 @@
  fetchFromGitHub,
  erlang,
  makeWrapper,
+  nix-update-script,
  coreutils,
  curl,
  bash,
@@ -117,6 +118,15 @@ stdenv.mkDerivation ({
      --replace "/usr/bin/env elixir" "${elixirShebang}"
  '';

+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--version-regex"
+      "v(${lib.versions.major version}\\.${lib.versions.minor version}\\.[0-9\\-rc.]+)"
+      "--override-filename"
+      "pkgs/development/interpreters/elixir/${lib.versions.major version}.${lib.versions.minor version}.nix"
+    ];
+  };
+
  pos = builtins.unsafeGetAttrPos "sha256" args;
  meta = with lib; {
    homepage = "https://elixir-lang.org/";
@@ -1,60 +0,0 @@
-{
-  lib,
-  buildDunePackage,
-  fetchFromGitHub,
-  fetchpatch,
-  ounit,
-  async,
-  base64,
-  camlzip,
-  cfstream,
-  core,
-  ppx_jane,
-  ppx_sexp_conv,
-  rresult,
-  uri,
-  xmlm,
-}:
-
-buildDunePackage rec {
-  pname = "biocaml";
-  version = "0.11.2";
-
-  minimalOCamlVersion = "4.11";
-  duneVersion = "3";
-
-  src = fetchFromGitHub {
-    owner = "biocaml";
-    repo = pname;
-    rev = "v${version}";
-    sha256 = "01yw12yixs45ya1scpb9jy2f7dw1mbj7741xib2xpq3kkc1hc21s";
-  };
-
-  patches = fetchpatch {
-    url = "https://github.com/biocaml/biocaml/commit/3ef74d0eb4bb48d2fb7dd8b66fb3ad8fe0aa4d78.patch";
-    sha256 = "0rcvf8gwq7sz15mghl9ing722rl2zpnqif9dfxrnpdxiv0rl0731";
-  };
-
-  buildInputs = [
-    ppx_jane
-    ppx_sexp_conv
-  ];
-  checkInputs = [ ounit ];
-  propagatedBuildInputs = [
-    async
-    base64
-    camlzip
-    cfstream
-    core
-    rresult
-    uri
-    xmlm
-  ];
-
-  meta = with lib; {
-    description = "Bioinformatics library for Ocaml";
-    homepage = "http://${pname}.org";
-    maintainers = [ maintainers.bcdarwin ];
-    license = licenses.gpl2;
-  };
-}
@@ -44,7 +44,7 @@

 buildPythonPackage rec {
  pname = "django";
-  version = "5.1.10";
+  version = "5.1.11";
  pyproject = true;

  disabled = pythonOlder "3.10";
@@ -53,7 +53,7 @@ buildPythonPackage rec {
    owner = "django";
    repo = "django";
    rev = "refs/tags/${version}";
-    hash = "sha256-+VsTrlff1eBGaVBqRHNOivVXqBkfjZvY2dzawE1sOOQ=";
+    hash = "sha256-yHoK7NGa91QEVFLeHqJo126qNg1pTE7W6LEtbCLy4sw=";
  };

  patches =
@@ -44,7 +44,7 @@

 buildPythonPackage rec {
  pname = "django";
-  version = "5.2.2";
+  version = "5.2.3";
  pyproject = true;

  disabled = pythonOlder "3.10";
@@ -53,7 +53,7 @@ buildPythonPackage rec {
    owner = "django";
    repo = "django";
    rev = "refs/tags/${version}";
-    hash = "sha256-x5PTE8oYA1VzErYXfuRzT4xNiMRnfEd6H9lEtB+HBkc=";
+    hash = "sha256-P2WnWkQbzqHNzlIac8boe2VIe2IBdCIB5J6av6J0nvg=";
  };

  patches =
@@ -57,32 +57,21 @@ let
 in
 buildPythonPackage rec {
  pname = "firedrake";
-  version = "2025.4.0.post0";
+  version = "2025.4.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "firedrakeproject";
    repo = "firedrake";
    tag = version;
-    hash = "sha256-wQOS4v/YkIwXdQq6JMvRbmyhnzvx6wj0O6aszNa5ZMw=";
+    hash = "sha256-p/yquIKWynGY7UESDNBCf1cM8zpy8beuuRxSrSMvj7c=";
  };

-  patches = [
-    (fetchpatch2 {
-      url = "https://github.com/firedrakeproject/firedrake/commit/b358e33ab12b3c4bc3819c9c6e9ed0930082b750.patch?full_index=1";
-      hash = "sha256-y00GB8njhmHgtAVvlv8ImsJe+hMCU1QFtbB8llEhv/I=";
-    })
-  ];
-
  postPatch =
+    # relax build-dependency petsc4py
    ''
-      # relax build-dependency petsc4py
      substituteInPlace pyproject.toml --replace-fail \
-        "petsc4py==3.23.0" "petsc4py"
-
-      # These scripts are used by official source distribution only,
-      # and do not make sense in our binary distribution.
-      sed -i '/firedrake-\(check\|status\|run-split-tests\)/d' pyproject.toml
+        "petsc4py==3.23.3" "petsc4py"
    ''
    + lib.optionalString stdenv.hostPlatform.isLinux ''
      substituteInPlace firedrake/petsc.py --replace-fail \
@@ -97,6 +86,7 @@ buildPythonPackage rec {

  pythonRelaxDeps = [
    "decorator"
+    "slepc4py"
  ];

  build-system = [
@@ -162,6 +152,11 @@ buildPythonPackage rec {
    writableTmpDirAsHomeHook
  ];

+  # These scripts are used by official sdist/editable_wheel only
+  postInstall = ''
+    rm $out/bin/firedrake-{check,status,run-split-tests}
+  '';
+
  preCheck = ''
    rm -rf firedrake pyop2 tinyasm tsfc
  '';
@@ -15,7 +15,7 @@

 buildPythonPackage rec {
  pname = "globus-sdk";
-  version = "3.56.1";
+  version = "3.57.0";
  pyproject = true;

  disabled = pythonOlder "3.7";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
    owner = "globus";
    repo = "globus-sdk-python";
    tag = version;
-    hash = "sha256-M7ZOtj8zekKrouiipOafKBQP/EhPY4hGODXAovBF5ew=";
+    hash = "sha256-pwAr8Z8Qoc+LjRtF2NRu4lAN/7ha7jogw1RnDhuobZs=";
  };

  build-system = [ setuptools ];
@@ -22,7 +22,7 @@

 buildPythonPackage rec {
  pname = "httpx-socks";
-  version = "0.10.0";
+  version = "0.10.1";
  pyproject = true;

  disabled = pythonOlder "3.7";
@@ -31,7 +31,7 @@ buildPythonPackage rec {
    owner = "romis2012";
    repo = "httpx-socks";
    tag = "v${version}";
-    hash = "sha256-H+A6203XMM7MaIdwtjQScyOBRJNpTx9NsSMIoov8hg8=";
+    hash = "sha256-1NDsIKJ8lWpjaTnlv5DrwTsEJU4gYwEUuqKpn+2QVhg=";
  };

  build-system = [ setuptools ];
@@ -14,7 +14,7 @@

 buildPythonPackage rec {
  pname = "inkbird-ble";
-  version = "0.16.2";
+  version = "1.0.0";
  pyproject = true;

  disabled = pythonOlder "3.11";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
    owner = "Bluetooth-Devices";
    repo = "inkbird-ble";
    tag = "v${version}";
-    hash = "sha256-A/ho+tnGcFFL60r4aq1UOyP/e32Lqn+IbPOAZ75PeKk=";
+    hash = "sha256-J3BT4KZ5Kzoc8vwbsXbhZJ+qkeggYomGE0JedxNTPaQ=";
  };

  build-system = [ poetry-core ];
@@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "llama-index-llms-openai";
-  version = "0.3.42";
+  version = "0.3.44";
  pyproject = true;

  disabled = pythonOlder "3.8";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    pname = "llama_index_llms_openai";
    inherit version;
-    hash = "sha256-O1yLSwbtod1743ATe215OI+dIcan7d2HK15jNuYYsjU=";
+    hash = "sha256-BJUGpYQYi2xWXYca624RpsUiln1LT18ZE+tG/Xuz1zE=";
  };

  pythonRemoveDeps = [
@@ -1,33 +1,53 @@
 {
  lib,
  buildPythonPackage,
-  fetchPypi,
-  future,
-  six,
+  fetchFromGitHub,
+  setuptools,
+  decorator,
  numpy,
  scipy,
  matplotlib,
+  pytestCheckHook,
+  pytest-cov-stub,
+  pytest-mpl,
 }:

 buildPythonPackage rec {
  pname = "mir-eval";
  version = "0.8.2";
-  format = "setuptools";
+  pyproject = true;

-  src = fetchPypi {
-    pname = "mir_eval";
-    inherit version;
-    hash = "sha256-FBo+EZMnaIn8MukRVH5z3LPoKe6M/qYPe7zWM8B5JWk=";
+  src = fetchFromGitHub {
+    owner = "mir-evaluation";
+    repo = "mir_eval";
+    tag = version;
+    hash = "sha256-Dq/kqoTY8YGATsr6MSgfQxkWvFpmH/Pf1pKBLPApylY=";
  };

-  propagatedBuildInputs = [
-    future
-    six
+  build-system = [ setuptools ];
+
+  dependencies = [
+    decorator
    numpy
    scipy
-    matplotlib
  ];

+  optional-dependencies.display = [ matplotlib ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    pytest-cov-stub
+    pytest-mpl
+  ] ++ lib.flatten (lib.attrValues optional-dependencies);
+
+  preCheck = ''
+    pushd tests
+  '';
+
+  postCheck = ''
+    popd
+  '';
+
  pythonImportsCheck = [ "mir_eval" ];

  meta = with lib; {
@@ -2,15 +2,10 @@
  lib,
  buildPythonPackage,
  fetchFromGitHub,
-
-  # build-system
-  poetry-core,
-
-  # dependencies
+  hatchling,
+  hatch-vcs,
  httpx,
  pydantic,
-
-  # tests
  pillow,
  pytest-asyncio,
  pytest-httpserver,
@@ -19,24 +14,22 @@

 buildPythonPackage rec {
  pname = "ollama";
-  version = "0.4.8";
+  version = "0.5.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "ollama";
    repo = "ollama-python";
    tag = "v${version}";
-    hash = "sha256-ZhSbd7Um3+jG3yL3FwCm0lUdi5EQXVjJk0UMLRKeLOQ=";
+    hash = "sha256-XCsBdU8dUJIcfbvwUB6UNP2AhAmBxnk0kiFkOYcd1zY=";
  };

-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace-fail "0.0.0" "${version}"
-  '';
-
  pythonRelaxDeps = [ "httpx" ];

-  build-system = [ poetry-core ];
+  build-system = [
+    hatchling
+    hatch-vcs
+  ];

  dependencies = [
    httpx
@@ -54,6 +47,11 @@ buildPythonPackage rec {

  pythonImportsCheck = [ "ollama" ];

+  disabledTestPaths = [
+    # Don't test the examples
+    "examples/"
+  ];
+
  meta = {
    description = "Ollama Python library";
    homepage = "https://github.com/ollama/ollama-python";
@@ -46,7 +46,7 @@

 buildPythonPackage rec {
  pname = "openai";
-  version = "1.79.0";
+  version = "1.86.0";
  pyproject = true;

  disabled = pythonOlder "3.8";
@@ -55,7 +55,7 @@ buildPythonPackage rec {
    owner = "openai";
    repo = "openai-python";
    tag = "v${version}";
-    hash = "sha256-exOE3Ha0SB4Q7OrWVUGOgELpfyHZVdtvgxyFyFncDm4=";
+    hash = "sha256-PDYyuvCkDfQrbkSz0CPfJr++WUu5mODY2nVzTanwqjo=";
  };

  postPatch = ''substituteInPlace pyproject.toml --replace-fail "hatchling==1.26.3" "hatchling"'';
@@ -6,10 +6,11 @@
  pythonAtLeast,
  python,
  onnx,
+  paddlepaddle,
 }:
 let
  pname = "paddle2onnx";
-  version = "2.0.0";
+  version = "2.0.1";
  format = "wheel";
  pyShortVersion = "cp${builtins.replaceStrings [ "." ] [ "" ] python.pythonVersion}";
  src = fetchPypi {
@@ -17,8 +18,8 @@ let
    dist = pyShortVersion;
    python = pyShortVersion;
    abi = pyShortVersion;
-    platform = "manylinux_2_12_x86_64.manylinux2010_x86_64";
-    hash = "sha256-9lkQLBHd/EWiuRu40Z6bBCrmqCgCW3xAx/bxmeSJJ8g=";
+    platform = "manylinux_2_24_x86_64.manylinux_2_28_x86_64";
+    hash = "sha256-RCD6iTvzhGrFjW02lasTwQoM+Xa68Q5b6Ito3KvqdHg=";
  };
 in
 buildPythonPackage {
@@ -29,16 +30,20 @@ buildPythonPackage {
    format
    ;

-  disabled = pythonOlder "3.8" || pythonAtLeast "3.11";
+  disabled = pythonOlder "3.12" || pythonAtLeast "3.13";

-  propagatedBuildInputs = [ onnx ];
+  dependencies = [
+    onnx
+    paddlepaddle
+  ];

-  meta = with lib; {
+  meta = {
    description = "ONNX Model Exporter for PaddlePaddle";
    homepage = "https://github.com/PaddlePaddle/Paddle2ONNX";
    changelog = "https://github.com/PaddlePaddle/Paddle2ONNX/releases/tag/v${version}";
-    license = licenses.asl20;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ happysalada ];
+    mainProgram = "paddle2onnx";
+    license = lib.licenses.asl20;
+    platforms = [ "x86_64-linux" ];
+    maintainers = with lib.maintainers; [ happysalada ];
  };
 }
@@ -2,6 +2,8 @@
  lib,
  buildPythonPackage,
  fetchFromGitHub,
+  setuptools,
+  setuptools-scm,
  attrdict,
  beautifulsoup4,
  cython,
@@ -24,21 +26,20 @@
  paddlepaddle,
  lanms-neo,
  polygon3,
+  paddlex,
+  pyyaml,
 }:

-let
-  version = "2.9.1";
-in
 buildPythonPackage rec {
  pname = "paddleocr";
-  inherit version;
-  format = "setuptools";
+  version = "3.0.1";
+  pyproject = true;

  src = fetchFromGitHub {
    owner = "PaddlePaddle";
    repo = "PaddleOCR";
    tag = "v${version}";
-    hash = "sha256-QCddxgVdLaAJLfKCy+tnQsxownfl1Uv0TXhFRiFi9cY=";
+    hash = "sha256-B8zIiRpvT0oa/Gg2dLXTqBZmM+XDH3sOzODvleN638E=";
  };

  patches = [
@@ -53,6 +54,16 @@ buildPythonPackage rec {
    ./remove-import-imaug.patch
  ];

+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail "==72.1.0" ""
+  '';
+
+  build-system = [
+    setuptools
+    setuptools-scm
+  ];
+
  # trying to relax only pymupdf makes the whole build fail
  pythonRelaxDeps = true;
  pythonRemoveDeps = [
@@ -61,7 +72,7 @@ buildPythonPackage rec {
    "opencv-contrib-python"
  ];

-  propagatedBuildInputs = [
+  dependencies = [
    attrdict
    beautifulsoup4
    cython
@@ -84,6 +95,8 @@ buildPythonPackage rec {
    paddlepaddle
    lanms-neo
    polygon3
+    paddlex
+    pyyaml
  ];

  # TODO: The tests depend, among possibly other things, on `cudatoolkit`.
@@ -92,16 +105,16 @@ buildPythonPackage rec {
  # nativeCheckInputs = with pkgs; [ which cudatoolkit ];
  doCheck = false;

-  meta = with lib; {
+  meta = {
    homepage = "https://github.com/PaddlePaddle/PaddleOCR";
-    license = licenses.asl20;
+    license = lib.licenses.asl20;
    description = "Multilingual OCR toolkits based on PaddlePaddle";
    longDescription = ''
      PaddleOCR aims to create multilingual, awesome, leading, and practical OCR
      tools that help users train better models and apply them into practice.
    '';
    changelog = "https://github.com/PaddlePaddle/PaddleOCR/releases/tag/${src.tag}";
-    maintainers = with maintainers; [ happysalada ];
+    maintainers = with lib.maintainers; [ happysalada ];
    platforms = [
      "x86_64-linux"
      "x86_64-darwin"
--- a/Show More
+++ b/Show More