Merge master into staging-next

2026-04-25 00:30:13 +00:00
parent 1d08340340 3766f4c3d6
commit 8ef6acf65a
74 changed files with 727 additions and 563 deletions
@@ -49,7 +49,7 @@ jobs:

      - name: Create backport PRs
        id: backport
-        uses: korthout/backport-action@3c06f323a58619da1e8522229ebc8d5de2633e46 # v4.3.0
+        uses: korthout/backport-action@ad30f01dbe543be4a24431001c38f3617af8c745 # v4.4.0
        with:
          # Config README: https://github.com/korthout/backport-action#backport-action
          add_author_as_reviewer: true
@@ -62,7 +62,7 @@ jobs:
          merged-as-untrusted-at: ${{ inputs.mergedSha }}
          target-as-trusted-at: ${{ inputs.targetSha }}

-      - uses: cachix/install-nix-action@616559265b40713947b9c190a8ff4b507b5df49b # v31.10.4
+      - uses: cachix/install-nix-action@ab739621df7a23f52766f9ccc97f38da6b7af14f # v31.10.5
        with:
          # Sandbox is disabled on MacOS by default.
          extra_nix_config: sandbox = true
@@ -120,7 +120,7 @@ jobs:
          merged-as-untrusted-at: ${{ inputs.mergedSha }}
          target-as-trusted-at: ${{ inputs.targetSha }}

-      - uses: cachix/install-nix-action@616559265b40713947b9c190a8ff4b507b5df49b # v31.10.4
+      - uses: cachix/install-nix-action@ab739621df7a23f52766f9ccc97f38da6b7af14f # v31.10.5

      - uses: cachix/cachix-action@1eb2ef646ac0255473d23a5907ad7b04ce94065c # v17
        continue-on-error: true
@@ -132,7 +132,7 @@ jobs:
            core.info(`Found pinned.json commit: ${ciPinBumpCommit}`)

      - name: Install Nix
-        uses: cachix/install-nix-action@616559265b40713947b9c190a8ff4b507b5df49b # v31.10.4
+        uses: cachix/install-nix-action@ab739621df7a23f52766f9ccc97f38da6b7af14f # v31.10.5

      - name: Load supported versions
        id: versions
@@ -180,7 +180,7 @@ jobs:
          target-as-trusted-at: ${{ inputs.targetSha }}

      - name: Install Nix
-        uses: cachix/install-nix-action@616559265b40713947b9c190a8ff4b507b5df49b # v31.10.4
+        uses: cachix/install-nix-action@ab739621df7a23f52766f9ccc97f38da6b7af14f # v31.10.5

      - uses: cachix/cachix-action@1eb2ef646ac0255473d23a5907ad7b04ce94065c # v17
        continue-on-error: true
@@ -270,7 +270,7 @@ jobs:
          merge-multiple: true

      - name: Install Nix
-        uses: cachix/install-nix-action@616559265b40713947b9c190a8ff4b507b5df49b # v31.10.4
+        uses: cachix/install-nix-action@ab739621df7a23f52766f9ccc97f38da6b7af14f # v31.10.5

      - name: Combine all output paths and eval stats
        run: |
@@ -465,7 +465,7 @@ jobs:
          merged-as-untrusted-at: ${{ inputs.mergedSha }}

      - name: Install Nix
-        uses: cachix/install-nix-action@616559265b40713947b9c190a8ff4b507b5df49b # v31.10.4
+        uses: cachix/install-nix-action@ab739621df7a23f52766f9ccc97f38da6b7af14f # v31.10.5

      - name: Ensure flake outputs on all systems still evaluate
        run: nix flake check --all-systems --no-build './nixpkgs/untrusted?shallow=1'
@@ -35,7 +35,7 @@ jobs:
        with:
          merged-as-untrusted-at: ${{ inputs.mergedSha }}

-      - uses: cachix/install-nix-action@616559265b40713947b9c190a8ff4b507b5df49b # v31.10.4
+      - uses: cachix/install-nix-action@ab739621df7a23f52766f9ccc97f38da6b7af14f # v31.10.5

      # TODO: Figure out how to best enable caching for the treefmt job. Cachix won't work well,
      # because the cache would be invalidated on every commit - treefmt checks every file.
@@ -70,7 +70,7 @@ jobs:
        with:
          merged-as-untrusted-at: ${{ inputs.mergedSha }}

-      - uses: cachix/install-nix-action@616559265b40713947b9c190a8ff4b507b5df49b # v31.10.4
+      - uses: cachix/install-nix-action@ab739621df7a23f52766f9ccc97f38da6b7af14f # v31.10.5

      - uses: cachix/cachix-action@1eb2ef646ac0255473d23a5907ad7b04ce94065c # v17
        continue-on-error: true
@@ -100,7 +100,7 @@ jobs:
          merged-as-untrusted-at: ${{ inputs.mergedSha }}
          target-as-trusted-at: ${{ inputs.targetSha }}

-      - uses: cachix/install-nix-action@616559265b40713947b9c190a8ff4b507b5df49b # v31.10.4
+      - uses: cachix/install-nix-action@ab739621df7a23f52766f9ccc97f38da6b7af14f # v31.10.5

      - uses: cachix/cachix-action@1eb2ef646ac0255473d23a5907ad7b04ce94065c # v17
        continue-on-error: true
@@ -145,6 +145,12 @@
    githubId = 67933444;
    keys = [ { fingerprint = "B39E B98E 8860 DAFB 0567  0073 A614 B7D2 5134 987A"; } ];
  };
+  _0xgsvs = {
+    email = "venkat.subrahmanyam.34@gmail.com";
+    name = "0xgsvs";
+    github = "0xgsvs";
+    githubId = 161702876;
+  };
  _0xMillyByte = {
    email = "emilia.daelman@gmail.com";
    name = "Emilia Daelman";
@@ -47,7 +47,7 @@ in
    includeFileList = lib.mkOption {
      type = lib.types.nullOr lib.types.path;
      default = null;
-      example = /path/to/fileList.txt;
+      example = "/path/to/fileList.txt";
      description = ''
        File containing newline-separated list of paths to include into the
        backups. See the FILE SELECTION section in {manpage}`duplicity(1)` for
@@ -58,7 +58,7 @@ in
    excludeFileList = lib.mkOption {
      type = lib.types.nullOr lib.types.path;
      default = null;
-      example = /path/to/fileList.txt;
+      example = "/path/to/fileList.txt";
      description = ''
        File containing newline-separated list of paths to exclude into the
        backups. See the FILE SELECTION section in {manpage}`duplicity(1)` for
@@ -41,7 +41,7 @@ in
    environmentFile = mkOption {
      type = nullOr path;
      default = null;
-      example = /run/keys/evcc;
+      example = "/run/keys/evcc";
      description = ''
        File with environment variables to pass into the runtime environment.

@@ -329,8 +329,8 @@ in
          This option does not delete accounts which are not (anymore) listed.
        '';
        example = {
-          "user1@localhost".passwordFile = /secrets/user1-localhost;
-          "user2@localhost".passwordFile = /secrets/user2-localhost;
+          "user1@localhost".passwordFile = "/secrets/user1-localhost";
+          "user2@localhost".passwordFile = "/secrets/user2-localhost";
        };
        type = lib.types.attrsOf (
          lib.types.submodule {
@@ -93,6 +93,8 @@ in
  config = lib.mkIf cfg.enable {
    environment.systemPackages = [ cfg.package ];

+    services.epmd.enable = true;
+
    users.users = lib.optionalAttrs (cfg.user == "ejabberd") {
      ejabberd = {
        group = cfg.group;
@@ -109,7 +111,11 @@ in
    systemd.services.ejabberd = {
      description = "ejabberd server";
      wantedBy = [ "multi-user.target" ];
-      after = [ "network.target" ];
+      after = [
+        "network.target"
+        "epmd.socket"
+      ];
+      wants = [ "epmd.socket" ];
      path = [
        pkgs.findutils
        pkgs.coreutils
@@ -132,8 +132,8 @@ let
          default = [ ];
          description = "Environment files for this container.";
          example = [
-            /path/to/.env
-            /path/to/.env.secret
+            "/path/to/.env"
+            "/path/to/.env.secret"
          ];
        };

@@ -8,8 +8,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
  mktplcRef = {
    name = "claude-code";
    publisher = "anthropic";
-    version = "2.1.118";
-    hash = "sha256-ic7GcsVcmy1pbiqn5mzdoak9sUqHTCotjOjw7NVfsjQ=";
+    version = "2.1.119";
+    hash = "sha256-/KqOJ8dvv6PhQJyfuOFEgKx6U8hH/WoUnocmWxsLLUk=";
  };

  postInstall = ''
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "fceumm";
-  version = "0-unstable-2026-03-31";
+  version = "0-unstable-2026-04-20";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "libretro-fceumm";
-    rev = "dbf1f2eb83ebde54a32fbe4f906b5ad89a863c0b";
-    hash = "sha256-UGssF6x/H5met7f2hC6str2urvCZRj/Oqp2R0rv2RUw=";
+    rev = "448a231618186b2af0bb9d6e37aeca05467e112f";
+    hash = "sha256-Kr3DEAk8dsFnUT73pOp5qwkCbcDItQwrRMI8hobrCuI=";
  };

  meta = {
@@ -7,13 +7,13 @@
 }:
 mkLibretroCore {
  core = "sameboy";
-  version = "0-unstable-2024-06-28";
+  version = "0-unstable-2026-04-20";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "sameboy";
-    rev = "51433012a871a44555492273fd22f29867d12655";
-    hash = "sha256-vPT2uRGbXmJ62yig/yk485/TxEEKHJeWdNrM2c0IjKw=";
+    rev = "06c184f0b186f161bcdfec50ebd604fe789ed04a";
+    hash = "sha256-sGEISpIGTHsUr4/DxMf5qxyTVdjmvWfqa2hUhj05jBA=";
  };

  extraNativeBuildInputs = [
@@ -828,11 +828,11 @@
    }
  },
  "ungoogled-chromium": {
-    "version": "147.0.7727.101",
+    "version": "147.0.7727.116",
    "deps": {
      "depot_tools": {
-        "rev": "442cbd6d584d2c992ca9bcc19ecbd2235bea772e",
-        "hash": "sha256-CgEu3y/MNRcCN2EmtcVgmGW/bEPKypeyLaANtiplDJU="
+        "rev": "3d94d7c3056847db821c6451be61054c36d7c6d5",
+        "hash": "sha256-hWfmidLPY0bXI58xAwkGnmb3GnSsKIUlDM91MYWfgpM="
      },
      "gn": {
        "version": "0-unstable-2026-03-05",
@@ -840,16 +840,16 @@
        "hash": "sha256-3AfExm7NL5GJXyC5JCPbGC70D59doRfIZIgpt6MLy9Y="
      },
      "ungoogled-patches": {
-        "rev": "147.0.7727.101-1",
-        "hash": "sha256-w/9bzbYHZM3Ot26ZcYWB51z7T+I4OBOxflo1dWxghyQ="
+        "rev": "147.0.7727.116-1",
+        "hash": "sha256-MmVLgbT+uzFzRt7faNvnWrlDwChDPth5eVqcGBXwUu4="
      },
      "npmHash": "sha256-ByB1Ea5tduIJZXyydeBWsoS8OPABOgwHe+dNXRssdvc="
    },
    "DEPS": {
      "src": {
        "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "56536d2a8034c51b0e68e1a0483ab9f1a0165ae3",
-        "hash": "sha256-94TMvPkcWm+IEVYwTh+m1ys5du75bvJcc1RpkSKpAwc=",
+        "rev": "dbcf1b1bfb506cc580859bcb5ff9460a8443af90",
+        "hash": "sha256-pcrElIGFOcPQjJUF1ceHMRjS3YLjbTa9cM3Qg/G3u6I=",
        "recompress": true
      },
      "src/third_party/clang-format/script": {
@@ -919,8 +919,8 @@
      },
      "src/third_party/angle": {
        "url": "https://chromium.googlesource.com/angle/angle.git",
-        "rev": "cbc4f074126e6f1acf72ad620a28cd4a8dd86f2a",
-        "hash": "sha256-MUgLUj2L0vmpAoxt/TJy1clsJfvYkQqe3Xm2+e4Y6tw="
+        "rev": "82ab43bfda5a3f59e1876fd3c828f047c689bc12",
+        "hash": "sha256-6WjecQRoyCLUoSbqDMpmsJ5tZazPF171KWnjxxK8hd4="
      },
      "src/third_party/angle/third_party/glmark2/src": {
        "url": "https://chromium.googlesource.com/external/github.com/glmark2/glmark2",
@@ -959,8 +959,8 @@
      },
      "src/third_party/dawn": {
        "url": "https://dawn.googlesource.com/dawn.git",
-        "rev": "2c681aed02b0add6bcf6724175660c4b35ece843",
-        "hash": "sha256-io3X9zu6tHgqJGXjygUXMa98rXELRNl6Y330U2nRc/M="
+        "rev": "ff7b4f6c5d964879b5f4356ef6e732adeed2f627",
+        "hash": "sha256-pURclm6gi0am32tohZTB4iT2BWa55uRBJNRVW0gjDcY="
      },
      "src/third_party/dawn/third_party/glfw": {
        "url": "https://chromium.googlesource.com/external/github.com/glfw/glfw",
@@ -1089,8 +1089,8 @@
      },
      "src/third_party/devtools-frontend/src": {
        "url": "https://chromium.googlesource.com/devtools/devtools-frontend",
-        "rev": "82a48c1595e5aefc899ed4528dbd7da0ac9e40e2",
-        "hash": "sha256-nlpFDS04LenRcQqnCkSdX/cUoC/gJcHaGUq+zrrkLSY="
+        "rev": "854a02be78c7ffea104cb523636efa991bef5c5b",
+        "hash": "sha256-CzzUueh2QXX+ExGqh5+JpnDoWF8DiFDff7fWmC01xfg="
      },
      "src/third_party/dom_distiller_js/dist": {
        "url": "https://chromium.googlesource.com/chromium/dom-distiller/dist.git",
@@ -1619,8 +1619,8 @@
      },
      "src/third_party/webrtc": {
        "url": "https://webrtc.googlesource.com/src.git",
-        "rev": "9179833d210d105aede5d4ec516734a6bd1ef2e8",
-        "hash": "sha256-DuHZimj7Zbx0QGH2ZrdGiSJg2PTwZUipyY06ZWr2fxg="
+        "rev": "997079137283f693a0fac6a5350ae7f6f2cf3b59",
+        "hash": "sha256-SOV9YS8Dk1HFCo00Qe6zttJOP0PEBS4B6Ah79OXmTew="
      },
      "src/third_party/wuffs/src": {
        "url": "https://skia.googlesource.com/external/github.com/google/wuffs-mirror-release-c.git",
@@ -1649,8 +1649,8 @@
      },
      "src/v8": {
        "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "c207e34c08865143dc6774c1c624f3cea07f7420",
-        "hash": "sha256-5rc28tPK9mOJDO3HA3F1ZgsRQmWXhoLZGeKTzxWSISw="
+        "rev": "9b21082faf16a5f029a4316272c9a627d8b33eb4",
+        "hash": "sha256-dT1f9Df1K1ZLp346Tpqn6Lkq2HDYWWQIAuhqXMIIydk="
      }
    }
  }
@@ -679,13 +679,13 @@
    "vendorHash": "sha256-OvotUEh+P2b3ngaD/8lVbemnM3lrtwqduPXPjF/bqVA="
  },
  "hashicorp_vault": {
-    "hash": "sha256-e0BcPLQFUjdZPlKAnuxBB3se+MjDSj78KJy5zNlsHKA=",
+    "hash": "sha256-k/S1ez6q70vvnHMfU2aweTFzRnLlYbxUEh4xZumT1mo=",
    "homepage": "https://registry.terraform.io/providers/hashicorp/vault",
    "owner": "hashicorp",
    "repo": "terraform-provider-vault",
-    "rev": "v5.8.0",
+    "rev": "v5.9.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-XBXkDvblC/u3lYq/dfjm38Hw8uGwumz4ZAiG+kJkNUQ="
+    "vendorHash": "sha256-0TJbC7gG5yduWrzp7MN5WWDjsdyL6RqXmOlIDs3OtaU="
  },
  "hashicorp_vsphere": {
    "hash": "sha256-vRO6vxzi4d0hNc0MmQLhN7roONnsjxPBtFt0fyvxWd8=",
@@ -833,13 +833,13 @@
    "vendorHash": "sha256-SJUlHerlt7Z3g1UJ7QKoCwEYolKL7SZp2O537poje3I="
  },
  "launchdarkly_launchdarkly": {
-    "hash": "sha256-lcemT7kpBlZX35Sb+ujHzSdakBQkUSmYAxTVsJkRW6A=",
+    "hash": "sha256-sFCms2grd7R52ILnRhVubLSEBTaeryS5WBL6+rcTZ/k=",
    "homepage": "https://registry.terraform.io/providers/launchdarkly/launchdarkly",
    "owner": "launchdarkly",
    "repo": "terraform-provider-launchdarkly",
-    "rev": "v2.27.0",
+    "rev": "v2.28.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-BxMhu2gcRuOlYWgx5ZOUBGdfB28+87SG1T/KAPDyei8="
+    "vendorHash": "sha256-OgKOjLwDQxJiv+VWdOzjMcUDPu9LOuhyTRyLyM39vLM="
  },
  "linode_linode": {
    "hash": "sha256-nrNyOcaC5wKJijfubBBuEBKA6dT6Ajo33MR4P80j29k=",
@@ -12,16 +12,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "arnis";
-  version = "2.6.0";
+  version = "2.7.0";

  src = fetchFromGitHub {
    owner = "louis-e";
    repo = "arnis";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-FO/8cQkw6CZWMjWgjx0/2KbfnYgIbHHWdgc4c5t4AEk=";
+    hash = "sha256-7Fh/jhKVNeAlJn2PATEMkPROhsyUYTtUp+Dv0FXoIfs=";
  };

-  cargoHash = "sha256-R7dW2/7UInK3yLz5YHb6UYhLukPrv8NZ8lRYhQwsiMw=";
+  cargoHash = "sha256-ZKr+BBcn6vKq3JuLkHqaVHM6Ug7BfUUTEmnePs7RKyc=";

  nativeBuildInputs = [
    cargo-tauri.hook
@@ -21,13 +21,13 @@

 buildNpmPackage rec {
  pname = "bruno";
-  version = "3.2.0";
+  version = "3.3.0";

  src = fetchFromGitHub {
    owner = "usebruno";
    repo = "bruno";
    tag = "v${version}";
-    hash = "sha256-lDsgAOCUrxhmlmYgObDwUR6gbms/q/rNIkTEwJckMyA=";
+    hash = "sha256-YVZPXrYfOFd9lUdZ0rwWnbSDO91Bn1vZyO3AwnE2pZE=";

    postFetch = ''
      ${lib.getExe npm-lockfile-fix} $out/package-lock.json
@@ -36,7 +36,7 @@ buildNpmPackage rec {

  nodejs = nodejs_22;

-  npmDepsHash = "sha256-vz2I+0+eQk6A4SsiACipTGrYF8LtvWfGhgxqu7mChLE=";
+  npmDepsHash = "sha256-IH2AVyHwMZuyZOUsAP7qoxm5Em32hk90Tp7uvSE9bIE=";
  npmFlags = [ "--legacy-peer-deps" ];

  nativeBuildInputs = [
@@ -1,47 +1,47 @@
 {
-  "version": "2.1.118",
-  "commit": "ef88b5f0a79aac989f53fd18178939a54a48624a",
-  "buildDate": "2026-04-22T22:43:30Z",
+  "version": "2.1.119",
+  "commit": "6f68554839756189e277b8285a18fe47acd9a5a1",
+  "buildDate": "2026-04-23T20:45:14Z",
  "platforms": {
    "darwin-arm64": {
      "binary": "claude",
-      "checksum": "54e5d3f65109b89c6046f47440944d52906c662d1e51748f620a430d26ad3665",
-      "size": 207690848
+      "checksum": "31db3444309d5d0f8b85e8782e2dcd86f31f7e48c1a1e83d69b09268c7b4f9a2",
+      "size": 213404000
    },
    "darwin-x64": {
      "binary": "claude",
-      "checksum": "2cd554070f0588de05e9efd88c1f073770cb620ed3e5f45ba7df833fc3414c1b",
-      "size": 209238608
+      "checksum": "52b3b75cfe80c626982b2ffb3a6ce1c797824f257dc275cf0a3c32c202b6a3df",
+      "size": 214951760
    },
    "linux-arm64": {
      "binary": "claude",
-      "checksum": "b77b22fe93c15409f3c64be67950fe11e5fc17d1cd327891596cb87dd9be0492",
-      "size": 239798848
+      "checksum": "382aa73ea4b07fd8d698e3159b5ef9e1b8739fae7505ba8ddd28b8a6a62819ce",
+      "size": 245500480
    },
    "linux-x64": {
      "binary": "claude",
-      "checksum": "ba363b2410a47120d2d4b8ece2e11fe0bbc5d59adb1329e8fb87ea0f370f4e46",
-      "size": 239573632
+      "checksum": "cca43053f062949495596b11b6fd1b59cf79102adb13bacbe66997e6fae41e4a",
+      "size": 245230208
    },
    "linux-arm64-musl": {
      "binary": "claude",
-      "checksum": "dcb27938ed10b7da586b6f7ba0dde768980b5e3d38b258c1f4e9a94e7b3dd6d2",
-      "size": 232524224
+      "checksum": "e09bfaedd8bfdeaebe5f1cf9bb81ebeb718312c68fffce379fb51786263143d0",
+      "size": 238225856
    },
    "linux-x64-musl": {
      "binary": "claude",
-      "checksum": "bd05142de3e3ead48313d4215577c9a9c89f05ca286d771cdff025544c52ae29",
-      "size": 233839040
+      "checksum": "ef41a11653b39c14db2d343f1f5e2a3af7eb9871c63e64deb6e65919670a4e0b",
+      "size": 239495616
    },
    "win32-x64": {
      "binary": "claude.exe",
-      "checksum": "5a05b03b880de26bb78fb9824bacf08e99dcf05c02e3c66546cccaf2f2930b2e",
-      "size": 249035936
+      "checksum": "e18c7dcfad4a3f5d33d202ec2dde630b648cf5b41622154d6210e793c7cceadc",
+      "size": 254478496
    },
    "win32-arm64": {
      "binary": "claude.exe",
-      "checksum": "b3d8942b49f672ef2e1394e004f0f53e197caefe30890620b6974a3e8dba63ec",
-      "size": 245760672
+      "checksum": "9e0deb10c45108612484ce558fad378206d5ac23feb203067450e6c38d001241",
+      "size": 251203232
    }
  }
 }
@@ -1,30 +0,0 @@
-{
-  buildNpmPackage,
-  fetchFromGitHub,
-  gitUpdater,
-  lib,
-}:
-
-buildNpmPackage rec {
-  pname = "defuddle-cli";
-  version = "0.6.4";
-
-  src = fetchFromGitHub {
-    owner = "kepano";
-    repo = "defuddle-cli";
-    tag = version;
-    hash = "sha256-28XmpFKzBKNhRkPOGaacJVw8hjQUZq2nwuR0vNo8aW0=";
-  };
-
-  npmDepsHash = "sha256-rRo+ty/E09OS+cWDnKQkROEdDc0hiB5g1h/+NbJe+/M=";
-
-  passthru.updateScript = gitUpdater { };
-
-  meta = {
-    description = "Command line utility to extract clean html, markdown and metadata from web pages";
-    homepage = "https://github.com/kepano/defuddle-cli";
-    license = lib.licenses.mit;
-    mainProgram = "defuddle";
-    maintainers = with lib.maintainers; [ surfaceflinger ];
-  };
-}
@@ -0,0 +1,36 @@
+{
+  buildNpmPackage,
+  fetchFromGitHub,
+  lib,
+  nix-update-script,
+}:
+
+buildNpmPackage rec {
+  pname = "defuddle";
+  version = "0.17.0";
+
+  src = fetchFromGitHub {
+    owner = "kepano";
+    repo = "defuddle";
+    tag = version;
+    hash = "sha256-w1V2xdaE8Htl6NeDyfKLFHOt3UEUuI4eBPW433qD1WI=";
+  };
+
+  npmDepsHash = "sha256-D+Gn9Dcc+YNeRonnKjEcp3BzpxIdwy7J4lJvxefJSvs=";
+
+  # jsdom is both a peerDependency and devDependency; pruning
+  # devDependencies removes it, but the CLI needs it at runtime.
+  dontNpmPrune = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  __structuredAttrs = true;
+
+  meta = {
+    description = "Command line utility to extract clean html, markdown and metadata from web pages";
+    homepage = "https://github.com/kepano/defuddle";
+    license = lib.licenses.mit;
+    mainProgram = "defuddle";
+    maintainers = with lib.maintainers; [ surfaceflinger ];
+  };
+}
@@ -16,6 +16,9 @@ stdenv.mkDerivation (finalAttrs: {
    hash = "sha256-dFj/QaGdTJYdcxKlS9tES6OHae8xPMnrG9ccRNM/hi8=";
  };

+  strictDeps = true;
+  __structuredAttrs = true;
+
  nativeBuildInputs = [
    cmake
  ];
@@ -18,13 +18,13 @@
  nix-update-script,
 }:
 let
-  version = "1.0.70";
+  version = "1.0.71";
  src = fetchFromGitHub {
    name = "exo";
    owner = "exo-explore";
    repo = "exo";
    tag = "v${version}";
-    hash = "sha256-ytxP5x8PyAPVne2c6OIvhdCuF68zffxypXSTlDAFnro=";
+    hash = "sha256-k3jtrJCxLx8nq1R70CtZWFyNVXEa5Ltw0MgdA0qFVXA=";
  };

  pyo3-bindings = python3Packages.buildPythonPackage (finalAttrs: {
@@ -24,18 +24,18 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "flare";
-  version = "0.20.2";
+  version = "0.20.4";

  src = fetchFromGitLab {
    owner = "schmiddi-on-mobile";
    repo = "flare";
    tag = finalAttrs.version;
-    hash = "sha256-LjUd+tq4nBJtBXeOH1SyjKS37R8f5rVvDk+jTR/Mdvs=";
+    hash = "sha256-Py5NKH8kBIBMfq3tz59fz5MZdPE6DC6NS2m5HlhSf5M=";
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
    inherit (finalAttrs) pname version src;
-    hash = "sha256-dXPCyHc6+iS4YMIVy0vOkPG57GEW1ce5sSgyw6k0M3U=";
+    hash = "sha256-DD6bqw0RUClkjClS2QjYOt3PMKy3d9uRZVBf7bVR4hg=";
  };

  nativeBuildInputs = [
@@ -4,6 +4,7 @@
  fetchFromGitHub,
  versionCheckHook,
  nix-update-script,
+  stdenv,
 }:

 buildGoModule (finalAttrs: {
@@ -33,7 +34,13 @@ buildGoModule (finalAttrs: {

  passthru.updateScript = nix-update-script { };

+  __structuredAttrs = true;
+
  meta = {
+    # Networking failures in tests, even with __darwinAllowLocalNetworking on
+    # and sandbox disabled.
+    # Unclear as of 2026-04-24 whether the program works if tests are disabled.
+    broken = stdenv.hostPlatform.isDarwin;
    description = "Tunneling client for Pangolin";
    homepage = "https://github.com/fosrl/newt";
    changelog = "https://github.com/fosrl/newt/releases/tag/${finalAttrs.src.tag}";
@@ -24,6 +24,8 @@ buildGoModule (finalAttrs: {

  doInstallCheck = true;

+  __structuredAttrs = true;
+
  meta = {
    description = "Tunneling client for Pangolin";
    homepage = "https://github.com/fosrl/olm";
@@ -16,14 +16,14 @@

 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "hydrus";
-  version = "666";
+  version = "668";
  pyproject = false;

  src = fetchFromGitHub {
    owner = "hydrusnetwork";
    repo = "hydrus";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Ikj1COV9eIp6UBk5zmxF1hwTY12K7Ut8hLM2Nvw7jis=";
+    hash = "sha256-F6sQ2AyAIE7z7GH942sgzVbufA5GHEazoG+4YN8cFxQ=";
  };

  nativeBuildInputs = [
@@ -7,18 +7,21 @@
  python3,
  qt6Packages,
  radare2,
+  xvfb-run,
+  breakpointHook,
+  writableTmpDirAsHomeHook,
  stdenv,
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "iaito";
-  version = "6.1.0";
+  version = "6.1.4";

  srcs = [
    (fetchFromGitHub {
      owner = "radareorg";
      repo = "iaito";
      tag = finalAttrs.version;
-      hash = "sha256-nvMx0zbfsphfBgxdQnk+EhRpQnJ2Qv05rF7w+zQUUQg=";
+      hash = "sha256-HKh5D96Dwo6YttWcOMlFy4H9OS3FbQvQ5RK+aOY4V5s=";
      name = "main";
    })
    (fetchFromGitHub {
@@ -47,6 +50,7 @@ stdenv.mkDerivation (finalAttrs: {
    python3
    qt6Packages.qttools
    qt6Packages.wrapQtAppsHook
+    breakpointHook
  ];

  buildInputs = [
@@ -79,6 +83,22 @@ stdenv.mkDerivation (finalAttrs: {
    runHook postInstall
  '';

+  nativeInstallCheckInputs = [
+    xvfb-run
+    writableTmpDirAsHomeHook
+  ];
+
+  # `iaito -v` does only work with GUI access
+  installCheckPhase = ''
+    runHook preCheck
+    xvfb-run -a ${placeholder "out"}/bin/iaito -v | grep "${finalAttrs.version}"
+    runHook postCheck
+  '';
+
+  doInstallCheck = true;
+
+  passthru.updateScript = ./update.sh;
+
  meta = {
    description = "Official radare2 GUI";
    longDescription = ''
@@ -0,0 +1,54 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i sh -p curl jq nix-prefetch-github coreutils gnused gnugrep
+# shellcheck shell=sh
+set -eu
+
+# Directory of this script / the iaito package
+SCRIPT_DIR="$(readlink -f "$(dirname "$0")")"
+NIXFILE="$SCRIPT_DIR/package.nix"
+
+# Determine latest release version: use $1 if provided, otherwise auto-detect
+if [ -n "${1:-}" ]; then
+    LATEST_VERSION="$1"
+    echo "Using provided iaito version: $LATEST_VERSION"
+else
+    LATEST_VERSION=$(curl -s https://api.github.com/repos/radareorg/iaito/releases/latest | jq -r '.tag_name')
+    echo "Latest iaito version: $LATEST_VERSION"
+fi
+
+CURRENT_VERSION=$(grep 'version = ' "$NIXFILE" | head -1 | sed 's/.*"\(.*\)".*/\1/')
+echo "Current iaito version: $CURRENT_VERSION"
+
+if [ "$LATEST_VERSION" = "$CURRENT_VERSION" ]; then
+    echo "iaito is already up to date"
+    exit 0
+fi
+
+# Update main source version and hash
+echo "Updating main source to $LATEST_VERSION..."
+MAIN_HASH=$(nix-prefetch-github radareorg iaito --rev "$LATEST_VERSION" --json | jq -r '.hash')
+echo "  New main hash: $MAIN_HASH"
+
+sed -i "s|version = \"$CURRENT_VERSION\"|version = \"$LATEST_VERSION\"|" "$NIXFILE"
+sed -i "/repo = \"iaito\";$/,/})/{s|hash = \".*\"|hash = \"$MAIN_HASH\"|}" "$NIXFILE"
+
+# Update translations to latest master revision
+echo "Updating iaito-translations to latest master..."
+LATEST_TRANS_REV=$(curl -s https://api.github.com/repos/radareorg/iaito-translations/commits/master | jq -r '.sha')
+echo "  Latest translations rev: $LATEST_TRANS_REV"
+
+CURRENT_TRANS_REV=$(grep -A3 'repo = "iaito-translations"' "$NIXFILE" | grep 'rev = ' | sed 's/.*"\(.*\)".*/\1/')
+echo "  Current translations rev: $CURRENT_TRANS_REV"
+
+if [ "$LATEST_TRANS_REV" = "$CURRENT_TRANS_REV" ]; then
+    echo "  Translations unchanged"
+else
+    echo "  Updating translations: $CURRENT_TRANS_REV -> $LATEST_TRANS_REV"
+    TRANS_HASH=$(nix-prefetch-github radareorg iaito-translations --rev "$LATEST_TRANS_REV" --json | jq -r '.hash')
+    echo "  New translations hash: $TRANS_HASH"
+
+    sed -i "/repo = \"iaito-translations\"/,/})/{s|rev = \"$CURRENT_TRANS_REV\"|rev = \"$LATEST_TRANS_REV\"|}" "$NIXFILE"
+    sed -i "/repo = \"iaito-translations\"/,/})/{s|hash = \".*\"|hash = \"$TRANS_HASH\"|}" "$NIXFILE"
+fi
+
+echo "Update complete. Please verify with: nix build .#iaito"
@@ -7,13 +7,13 @@

 php.buildComposerProject2 (finalAttrs: {
  pname = "kimai";
-  version = "2.52.0";
+  version = "2.55.0";

  src = fetchFromGitHub {
    owner = "kimai";
    repo = "kimai";
    tag = finalAttrs.version;
-    hash = "sha256-lh+12X85MM3Efp2DUQ22itXnqnNzPzxqxQ1GNbDaaPQ=";
+    hash = "sha256-p4Y5hCWr5BVOGYUJtFJhhDftm+A/CWxbdBhPgOR1TcY=";
  };

  php = php.buildEnv {
@@ -38,7 +38,7 @@ php.buildComposerProject2 (finalAttrs: {
    '';
  };

-  vendorHash = "sha256-P+YCKz6j30Xtt0BAViUCHoU6xdrzFQFHqK1PTEp4vQg=";
+  vendorHash = "sha256-Vlaqe3FTItRZDiYWzOVDL+q7HZ8TgpiLPFTDzUyL4LY=";

  composerNoPlugins = false;
  postInstall = ''
@@ -41,7 +41,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
  meta = {
    description = "Kerberos AP-REQ hijacking tool with DNS unsecure updates abuse";
    homepage = "https://github.com/almandin/krbjack";
-    changelog = "https://github.com/almandin/krbjack/releases/tag/${finalAttrs.version}}";
+    changelog = "https://github.com/almandin/krbjack/releases/tag/${finalAttrs.version}";
    license = lib.licenses.beerware;
    maintainers = with lib.maintainers; [ fab ];
    mainProgram = "krbjack";
@@ -1,254 +0,0 @@
-diff --git a/package-lock.json b/package-lock.json
-index 5ddd914..8d4a12a 100644
--- a/package-lock.json
-+++ b/package-lock.json
-@@ -9,11 +9,11 @@
-       "version": "0.0.0",
-       "dependencies": {
-         "@tanstack/vue-virtual": "^3.1.2",
-        "@tauri-apps/api": "^2.1.1",
-        "@tauri-apps/plugin-dialog": "^2.2.0",
-        "@tauri-apps/plugin-global-shortcut": "^2.2.0",
-        "@tauri-apps/plugin-os": "^2.2.0",
-        "@tauri-apps/plugin-shell": "^2.2.0",
-+        "@tauri-apps/api": "2.8.0",
-+        "@tauri-apps/plugin-dialog": "2.4.0",
-+        "@tauri-apps/plugin-global-shortcut": "^2.3.0",
-+        "@tauri-apps/plugin-os": "^2.3.0",
-+        "@tauri-apps/plugin-shell": "^2.3.0",
-         "codemirror": "^6.0.1",
-         "floating-vue": "^5.2.2",
-         "lodash": "^4.17.21",
-@@ -381,9 +381,9 @@
-       }
-     },
-     "node_modules/@tauri-apps/api": {
-      "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/@tauri-apps/api/-/api-2.1.1.tgz",
-      "integrity": "sha512-fzUfFFKo4lknXGJq8qrCidkUcKcH2UHhfaaCNt4GzgzGaW2iS26uFOg4tS3H4P8D6ZEeUxtiD5z0nwFF0UN30A==",
-+      "version": "2.8.0",
-+      "resolved": "https://registry.npmjs.org/@tauri-apps/api/-/api-2.8.0.tgz",
-+      "integrity": "sha512-ga7zdhbS2GXOMTIZRT0mYjKJtR9fivsXzsyq5U3vjDL0s6DTMwYRm0UHNjzTY5dh4+LSC68Sm/7WEiimbQNYlw==",
-       "license": "Apache-2.0 OR MIT",
-       "funding": {
-         "type": "opencollective",
-@@ -590,39 +590,39 @@
-       }
-     },
-     "node_modules/@tauri-apps/plugin-dialog": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@tauri-apps/plugin-dialog/-/plugin-dialog-2.2.0.tgz",
-      "integrity": "sha512-6bLkYK68zyK31418AK5fNccCdVuRnNpbxquCl8IqgFByOgWFivbiIlvb79wpSXi0O+8k8RCSsIpOquebusRVSg==",
-+      "version": "2.4.0",
-+      "resolved": "https://registry.npmjs.org/@tauri-apps/plugin-dialog/-/plugin-dialog-2.4.0.tgz",
-+      "integrity": "sha512-OvXkrEBfWwtd8tzVCEXIvRfNEX87qs2jv6SqmVPiHcJjBhSF/GUvjqUNIDmKByb5N8nvDqVUM7+g1sXwdC/S9w==",
-       "license": "MIT OR Apache-2.0",
-       "dependencies": {
-        "@tauri-apps/api": "^2.0.0"
-+        "@tauri-apps/api": "^2.8.0"
-       }
-     },
-     "node_modules/@tauri-apps/plugin-global-shortcut": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@tauri-apps/plugin-global-shortcut/-/plugin-global-shortcut-2.2.0.tgz",
-      "integrity": "sha512-clI9Bg/BcxWXNDK+ij601o1qC2WxMEy8ovhGgEW5Ai17oPy0KK8uwzmc59KiVnOYKpBWHCUPqBxG+KBNUFXgzw==",
-+      "version": "2.3.1",
-+      "resolved": "https://registry.npmjs.org/@tauri-apps/plugin-global-shortcut/-/plugin-global-shortcut-2.3.1.tgz",
-+      "integrity": "sha512-vr40W2N6G63dmBPaha1TsBQLLURXG538RQbH5vAm0G/ovVZyXJrmZR1HF1W+WneNloQvwn4dm8xzwpEXRW560g==",
-       "license": "MIT OR Apache-2.0",
-       "dependencies": {
-        "@tauri-apps/api": "^2.0.0"
-+        "@tauri-apps/api": "^2.8.0"
-       }
-     },
-     "node_modules/@tauri-apps/plugin-os": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@tauri-apps/plugin-os/-/plugin-os-2.2.0.tgz",
-      "integrity": "sha512-HszbCdbisMlu5QhCNAN8YIWyz2v33abAWha6+uvV2CKX8P5VSct/y+kEe22JeyqrxCnWlQ3DRx7s49Byg7/0EA==",
-+      "version": "2.3.2",
-+      "resolved": "https://registry.npmjs.org/@tauri-apps/plugin-os/-/plugin-os-2.3.2.tgz",
-+      "integrity": "sha512-n+nXWeuSeF9wcEsSPmRnBEGrRgOy6jjkSU+UVCOV8YUGKb2erhDOxis7IqRXiRVHhY8XMKks00BJ0OAdkpf6+A==",
-       "license": "MIT OR Apache-2.0",
-       "dependencies": {
-        "@tauri-apps/api": "^2.0.0"
-+        "@tauri-apps/api": "^2.8.0"
-       }
-     },
-     "node_modules/@tauri-apps/plugin-shell": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@tauri-apps/plugin-shell/-/plugin-shell-2.2.0.tgz",
-      "integrity": "sha512-iC3Ic1hLmasoboG7BO+7p+AriSoqAwKrIk+Hpk+S/bjTQdXqbl2GbdclghI4gM32X0bls7xHzIFqhRdrlvJeaA==",
-+      "version": "2.3.4",
-+      "resolved": "https://registry.npmjs.org/@tauri-apps/plugin-shell/-/plugin-shell-2.3.4.tgz",
-+      "integrity": "sha512-ktsRWf8wHLD17aZEyqE8c5x98eNAuTizR1FSX475zQ4TxaiJnhwksLygQz+AGwckJL5bfEP13nWrlTNQJUpKpA==",
-       "license": "MIT OR Apache-2.0",
-       "dependencies": {
-        "@tauri-apps/api": "^2.0.0"
-+        "@tauri-apps/api": "^2.8.0"
-       }
-     },
-     "node_modules/@types/web-bluetooth": {
-@@ -1043,6 +1043,7 @@
-           "url": "https://tidelift.com/funding/github/npm/browserslist"
-         }
-       ],
-+      "peer": true,
-       "dependencies": {
-         "caniuse-lite": "^1.0.30001400",
-         "electron-to-chromium": "^1.4.251",
-@@ -1124,6 +1125,7 @@
-       "version": "6.0.1",
-       "resolved": "https://registry.npmjs.org/codemirror/-/codemirror-6.0.1.tgz",
-       "integrity": "sha512-J8j+nZ+CdWmIeFIGXEFbFPtpiYacFMDR8GlHK3IyHQJMCaVRfGx9NT+Hxivv1ckLWPvNdZqndbr/7lVhrf/Svg==",
-+      "peer": true,
-       "dependencies": {
-         "@codemirror/autocomplete": "^6.0.0",
-         "@codemirror/commands": "^6.0.0",
-@@ -1681,6 +1683,7 @@
-       "version": "7.6.2",
-       "resolved": "https://registry.npmjs.org/focus-trap/-/focus-trap-7.6.2.tgz",
-       "integrity": "sha512-9FhUxK1hVju2+AiQIDJ5Dd//9R2n2RAfJ0qfhF4IHGHgcoEUTMpbTeG/zbEuwaiYXfuAH6XE0/aCyxDdRM+W5w==",
-+      "peer": true,
-       "dependencies": {
-         "tabbable": "^6.2.0"
-       }
-@@ -2147,6 +2150,7 @@
-           "url": "https://github.com/sponsors/ai"
-         }
-       ],
-+      "peer": true,
-       "dependencies": {
-         "nanoid": "^3.3.7",
-         "picocolors": "^1.1.0",
-@@ -2721,6 +2725,7 @@
-       "resolved": "https://registry.npmjs.org/vite/-/vite-3.1.8.tgz",
-       "integrity": "sha512-m7jJe3nufUbuOfotkntGFupinL/fmuTNuQmiVE7cH2IZMuf4UbfbGYMUT3jVWgGYuRVLY9j8NnrRqgw5rr5QTg==",
-       "dev": true,
-+      "peer": true,
-       "dependencies": {
-         "esbuild": "^0.15.9",
-         "postcss": "^8.4.16",
-@@ -2761,6 +2766,7 @@
-       "version": "3.5.10",
-       "resolved": "https://registry.npmjs.org/vue/-/vue-3.5.10.tgz",
-       "integrity": "sha512-Vy2kmJwHPlouC/tSnIgXVg03SG+9wSqT1xu1Vehc+ChsXsRd7jLkKgMltVEFOzUdBr3uFwBCG+41LJtfAcBRng==",
-+      "peer": true,
-       "dependencies": {
-         "@vue/compiler-dom": "3.5.10",
-         "@vue/compiler-sfc": "3.5.10",
-@@ -3221,9 +3227,9 @@
-       }
-     },
-     "@tauri-apps/api": {
-      "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/@tauri-apps/api/-/api-2.1.1.tgz",
-      "integrity": "sha512-fzUfFFKo4lknXGJq8qrCidkUcKcH2UHhfaaCNt4GzgzGaW2iS26uFOg4tS3H4P8D6ZEeUxtiD5z0nwFF0UN30A=="
-+      "version": "2.8.0",
-+      "resolved": "https://registry.npmjs.org/@tauri-apps/api/-/api-2.8.0.tgz",
-+      "integrity": "sha512-ga7zdhbS2GXOMTIZRT0mYjKJtR9fivsXzsyq5U3vjDL0s6DTMwYRm0UHNjzTY5dh4+LSC68Sm/7WEiimbQNYlw=="
-     },
-     "@tauri-apps/cli": {
-       "version": "2.1.0",
-@@ -3314,35 +3320,35 @@
-       "optional": true
-     },
-     "@tauri-apps/plugin-dialog": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@tauri-apps/plugin-dialog/-/plugin-dialog-2.2.0.tgz",
-      "integrity": "sha512-6bLkYK68zyK31418AK5fNccCdVuRnNpbxquCl8IqgFByOgWFivbiIlvb79wpSXi0O+8k8RCSsIpOquebusRVSg==",
-+      "version": "2.4.0",
-+      "resolved": "https://registry.npmjs.org/@tauri-apps/plugin-dialog/-/plugin-dialog-2.4.0.tgz",
-+      "integrity": "sha512-OvXkrEBfWwtd8tzVCEXIvRfNEX87qs2jv6SqmVPiHcJjBhSF/GUvjqUNIDmKByb5N8nvDqVUM7+g1sXwdC/S9w==",
-       "requires": {
-        "@tauri-apps/api": "^2.0.0"
-+        "@tauri-apps/api": "^2.8.0"
-       }
-     },
-     "@tauri-apps/plugin-global-shortcut": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@tauri-apps/plugin-global-shortcut/-/plugin-global-shortcut-2.2.0.tgz",
-      "integrity": "sha512-clI9Bg/BcxWXNDK+ij601o1qC2WxMEy8ovhGgEW5Ai17oPy0KK8uwzmc59KiVnOYKpBWHCUPqBxG+KBNUFXgzw==",
-+      "version": "2.3.1",
-+      "resolved": "https://registry.npmjs.org/@tauri-apps/plugin-global-shortcut/-/plugin-global-shortcut-2.3.1.tgz",
-+      "integrity": "sha512-vr40W2N6G63dmBPaha1TsBQLLURXG538RQbH5vAm0G/ovVZyXJrmZR1HF1W+WneNloQvwn4dm8xzwpEXRW560g==",
-       "requires": {
-        "@tauri-apps/api": "^2.0.0"
-+        "@tauri-apps/api": "^2.8.0"
-       }
-     },
-     "@tauri-apps/plugin-os": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@tauri-apps/plugin-os/-/plugin-os-2.2.0.tgz",
-      "integrity": "sha512-HszbCdbisMlu5QhCNAN8YIWyz2v33abAWha6+uvV2CKX8P5VSct/y+kEe22JeyqrxCnWlQ3DRx7s49Byg7/0EA==",
-+      "version": "2.3.2",
-+      "resolved": "https://registry.npmjs.org/@tauri-apps/plugin-os/-/plugin-os-2.3.2.tgz",
-+      "integrity": "sha512-n+nXWeuSeF9wcEsSPmRnBEGrRgOy6jjkSU+UVCOV8YUGKb2erhDOxis7IqRXiRVHhY8XMKks00BJ0OAdkpf6+A==",
-       "requires": {
-        "@tauri-apps/api": "^2.0.0"
-+        "@tauri-apps/api": "^2.8.0"
-       }
-     },
-     "@tauri-apps/plugin-shell": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@tauri-apps/plugin-shell/-/plugin-shell-2.2.0.tgz",
-      "integrity": "sha512-iC3Ic1hLmasoboG7BO+7p+AriSoqAwKrIk+Hpk+S/bjTQdXqbl2GbdclghI4gM32X0bls7xHzIFqhRdrlvJeaA==",
-+      "version": "2.3.4",
-+      "resolved": "https://registry.npmjs.org/@tauri-apps/plugin-shell/-/plugin-shell-2.3.4.tgz",
-+      "integrity": "sha512-ktsRWf8wHLD17aZEyqE8c5x98eNAuTizR1FSX475zQ4TxaiJnhwksLygQz+AGwckJL5bfEP13nWrlTNQJUpKpA==",
-       "requires": {
-        "@tauri-apps/api": "^2.0.0"
-+        "@tauri-apps/api": "^2.8.0"
-       }
-     },
-     "@types/web-bluetooth": {
-@@ -3586,6 +3592,7 @@
-       "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.21.4.tgz",
-       "integrity": "sha512-CBHJJdDmgjl3daYjN5Cp5kbTf1mUhZoS+beLklHIvkOWscs83YAhLlF3Wsh/lciQYAcbBJgTOD44VtG31ZM4Hw==",
-       "dev": true,
-+      "peer": true,
-       "requires": {
-         "caniuse-lite": "^1.0.30001400",
-         "electron-to-chromium": "^1.4.251",
-@@ -3636,6 +3643,7 @@
-       "version": "6.0.1",
-       "resolved": "https://registry.npmjs.org/codemirror/-/codemirror-6.0.1.tgz",
-       "integrity": "sha512-J8j+nZ+CdWmIeFIGXEFbFPtpiYacFMDR8GlHK3IyHQJMCaVRfGx9NT+Hxivv1ckLWPvNdZqndbr/7lVhrf/Svg==",
-+      "peer": true,
-       "requires": {
-         "@codemirror/autocomplete": "^6.0.0",
-         "@codemirror/commands": "^6.0.0",
-@@ -3965,6 +3973,7 @@
-       "version": "7.6.2",
-       "resolved": "https://registry.npmjs.org/focus-trap/-/focus-trap-7.6.2.tgz",
-       "integrity": "sha512-9FhUxK1hVju2+AiQIDJ5Dd//9R2n2RAfJ0qfhF4IHGHgcoEUTMpbTeG/zbEuwaiYXfuAH6XE0/aCyxDdRM+W5w==",
-+      "peer": true,
-       "requires": {
-         "tabbable": "^6.2.0"
-       }
-@@ -4285,6 +4294,7 @@
-       "version": "8.4.47",
-       "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.4.47.tgz",
-       "integrity": "sha512-56rxCq7G/XfB4EkXq9Egn5GCqugWvDFjafDOThIdMBsI15iqPqR5r15TfSr1YPYeEI19YeaXMCbY6u88Y76GLQ==",
-+      "peer": true,
-       "requires": {
-         "nanoid": "^3.3.7",
-         "picocolors": "^1.1.0",
-@@ -4638,6 +4648,7 @@
-       "resolved": "https://registry.npmjs.org/vite/-/vite-3.1.8.tgz",
-       "integrity": "sha512-m7jJe3nufUbuOfotkntGFupinL/fmuTNuQmiVE7cH2IZMuf4UbfbGYMUT3jVWgGYuRVLY9j8NnrRqgw5rr5QTg==",
-       "dev": true,
-+      "peer": true,
-       "requires": {
-         "esbuild": "^0.15.9",
-         "fsevents": "~2.3.2",
-@@ -4650,6 +4661,7 @@
-       "version": "3.5.10",
-       "resolved": "https://registry.npmjs.org/vue/-/vue-3.5.10.tgz",
-       "integrity": "sha512-Vy2kmJwHPlouC/tSnIgXVg03SG+9wSqT1xu1Vehc+ChsXsRd7jLkKgMltVEFOzUdBr3uFwBCG+41LJtfAcBRng==",
-+      "peer": true,
-       "requires": {
-         "@vue/compiler-dom": "3.5.10",
-         "@vue/compiler-sfc": "3.5.10",
-- 
-2.51.2
-
@@ -22,27 +22,24 @@

 rustPlatform.buildRustPackage rec {
  pname = "lrcget";
-  version = "1.0.2";
+  version = "2.0.1";

  src = fetchFromGitHub {
    owner = "tranxuanthang";
    repo = "lrcget";
    tag = version;
-    hash = "sha256-4XeOIOV8QyJheVN98u/jo8H+n9AIzvVJITCk9d+kpFA=";
+    hash = "sha256-3dqE64IVvsrY33v3LoLUDJ+g6T5CvePIINWdqidDPdQ=";
  };

  patches = [
    # needed to not attempt codesigning on darwin
    ./remove-signing-identity.patch
-
-    # Update npm package versions to fix https://github.com/tranxuanthang/lrcget/issues/309
-    ./fix-tauri-version-mismatch.patch
  ];

  cargoRoot = "src-tauri";
  buildAndTestSubdir = "src-tauri";

-  cargoHash = "sha256-EjciD794MqUnp3CVloOPugbSfcxgfy7TdCUOlK6P+sk=";
+  cargoHash = "sha256-YRPMzFChmk5laah8yyRtMaUYH/uSOLUIAtl7wTl/qU0=";

  # FIXME: This is a workaround, because we have a git dependency node_modules/lrc-kit contains install scripts
  # but has no lockfile, which is something that will probably break.
@@ -51,7 +48,7 @@ rustPlatform.buildRustPackage rec {
  npmDeps = fetchNpmDeps {
    name = "lrcget-${version}-npm-deps";
    inherit src forceGitDeps patches;
-    hash = "sha256-iaxNrZLcb9qM5EPRtzoXw6izZBeS/rqgGaZpA2A2oho=";
+    hash = "sha256-yXRbQ6xM23VrVaS8Hb5sxPPic1yawKtFi2rCGkplgw4=";
  };

  nativeBuildInputs = [
@@ -8,16 +8,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "lurk";
-  version = "0.3.12";
+  version = "0.3.14";

  src = fetchFromGitHub {
    owner = "jakwai01";
    repo = "lurk";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-gVxul9LeNbsP2eP0j5T6AL7pQh8Ls2lht3ki5JQ9kZM=";
+    hash = "sha256-Q7lxPjEfzbGPes11fP7qJY4cYetem7tKQasQcy67oRU=";
  };

-  cargoHash = "sha256-NNwcc4rUol9M59XzoQBNw/MfHw3LP6pUtNjw6OY6bMc=";
+  cargoHash = "sha256-QOdqA3gHfhBUWL5CHA5p4ueKwZusE5NBlGezBG//3FA=";

  postPatch = ''
    substituteInPlace src/lib.rs \
@@ -12,7 +12,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "man-pages";
-  version = "6.17";
+  version = "6.18";

  # `man` is first: most people installing `man-pages` want man pages.
  # The binaries could be split to a seperate package (as upstream suggests),
@@ -25,7 +25,7 @@ stdenv.mkDerivation (finalAttrs: {

  src = fetchurl {
    url = "mirror://kernel/linux/docs/man-pages/man-pages-${finalAttrs.version}.tar.xz";
-    hash = "sha256-0Y8hpgKwl3ilqQlr8b6EQbdzPpmBUEdKzPcD0WX06/Q=";
+    hash = "sha256-yTT63ItZdIxoIno09lgdLd+Cgrc83NUlRsjNiLdLJNE=";
  };

  # See https://git.kernel.org/pub/scm/docs/man-pages/man-pages.git/tree/man/man7/man.7,
@@ -16,13 +16,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "neatvnc";
-  version = "0.9.5";
+  version = "0.9.6";

  src = fetchFromGitHub {
    owner = "any1";
    repo = "neatvnc";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-wAIifLw2rlu44jXMu/k31B7qePdJt6pT6TOhNxcyfLw=";
+    hash = "sha256-VStlTsfXbFxTnRGdK1y7MLtCzxbHzraw5GGph3sS/kI=";
  };

  strictDeps = true;
@@ -16,13 +16,13 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "opencode";
-  version = "1.14.20";
+  version = "1.14.24";

  src = fetchFromGitHub {
    owner = "anomalyco";
    repo = "opencode";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-9nxxvCkeTW3MasXaOhWaQqxqJeq9Q1+5TGULITjhV2Q=";
+    hash = "sha256-4GL+Lsdzea5nrLNq5Ld0EuiVVuiwTJUIrxdAdAJme1I=";
  };

  node_modules = stdenvNoCC.mkDerivation {
@@ -75,7 +75,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    # NOTE: Required else we get errors that our fixed-output derivation references store paths
    dontFixup = true;

-    outputHash = "sha256-70F15j+YokvQGzvtniUSeIrdl6/tgpcEzDXrbCnZd6E=";
+    outputHash = "sha256-wQmsgZQGoedvn2RHINfKh9cVwSNYgkGaBOdV/AD70jQ=";
    outputHashAlgo = "sha256";
    outputHashMode = "recursive";
  };
@@ -23,14 +23,14 @@

 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "patroni";
-  version = "4.1.0";
+  version = "4.1.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "zalando";
    repo = "patroni";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-iY5QLbJXfQtfkzpQxvqSOzYQwgfFsBh8HPYujqxU44k=";
+    hash = "sha256-IEoO50MaEnXevS0HOzend19UHNA12CjDAUBB8fZxTkI=";
  };

  build-system = with python3Packages; [ setuptools ];
@@ -7,13 +7,13 @@

 buildGoModule (finalAttrs: {
  pname = "pdnsgrep";
-  version = "1.2.0";
+  version = "1.3.0";

  src = fetchFromGitHub {
    owner = "akquinet";
    repo = "pdnsgrep";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-bkCd5fIXj3qdbXmHCsnA9yi1LMYbIFdei72kaj2Uxzs=";
+    hash = "sha256-V5Im75vYQYZmAedx4TKGkuoXI0noOfH7wMDoJRWA1hs=";
  };

  vendorHash = "sha256-hTlweJAWWrcaYhTH8IuCxDmqNd1qWTYK5F8NQhBbKt0=";
@@ -31,7 +31,7 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "powershell";
-  version = "7.6.0";
+  version = "7.6.1";

  src =
    passthru.sources.${stdenv.hostPlatform.system}
@@ -96,19 +96,19 @@ stdenv.mkDerivation rec {
    sources = {
      aarch64-darwin = fetchurl {
        url = "https://github.com/PowerShell/PowerShell/releases/download/v${version}/powershell-${version}-osx-arm64.tar.gz";
-        hash = "sha256-u1LbkOlk7guR6T9VmzUIeMayfBL9UYMNjsoXk3Erljk=";
+        hash = "sha256-nhB49wsRxA4Q9LrRNU2xzcrzjNZ3X89A4HOOP1rGgH4=";
      };
      aarch64-linux = fetchurl {
        url = "https://github.com/PowerShell/PowerShell/releases/download/v${version}/powershell-${version}-linux-arm64.tar.gz";
-        hash = "sha256-3d91ZPs7UtwmvlWA/FtOCOs/plsJRIiq5tSzytX+pGA=";
+        hash = "sha256-c0mIExlOoNhJ1ZQjMu5uUWV+pm2gghaqEFB4jVxSt0E=";
      };
      x86_64-darwin = fetchurl {
        url = "https://github.com/PowerShell/PowerShell/releases/download/v${version}/powershell-${version}-osx-x64.tar.gz";
-        hash = "sha256-fGJ5z+rQYyRFGhD/dBiDCGyaAPAkuuqSS7nTwQb+DII=";
+        hash = "sha256-tfh0qDK+wrp4zT5E/bywTBthRNnqtCuYgcuLlAC8xQQ=";
      };
      x86_64-linux = fetchurl {
        url = "https://github.com/PowerShell/PowerShell/releases/download/v${version}/powershell-${version}-linux-x64.tar.gz";
-        hash = "sha256-BFF0cs9X1/nL2TiX2pvtRnxzymBjwp12VevCCqHWAj8=";
+        hash = "sha256-38lCKXZ5IWA/fD4csaxaqTFEivdJbM9ldyO2J4BXxBU=";
      };
    };
    tests.version = testers.testVersion {
@@ -0,0 +1,86 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  fetchzip,
+  pkg-config,
+  versionCheckHook,
+  openssl,
+}:
+
+let
+  studioUiVersion = "v0.1.0";
+  studioUi = fetchzip {
+    url = "https://github.com/solana-foundation/surfpool-web-ui/releases/download/${studioUiVersion}/studio-dist.zip";
+    hash = "sha256-uZZpaAIg7f+ji5yonwNbAxbxi+4x7g5V4xKWUXNn1UI=";
+    stripRoot = false;
+  };
+in
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "surfpool-cli";
+  version = "1.2.0";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "solana-foundation";
+    repo = "surfpool";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-PGCzlnu7YxueQ16uae2818I9vXWdMRFRGaFzg2DIIgo=";
+    fetchSubmodules = true;
+  };
+
+  cargoHash = "sha256-ephKNAJ9PtTz/EN9dGFn6LnIySU0g/GNz8Jg9JDKTSI=";
+
+  postPatch = ''
+    # instead of downloading the surfpool-web-ui at build time, we fetch it beforehand and use it
+    # https://github.com/solana-foundation/surfpool/pull/628
+    substituteInPlace crates/studio/build.rs \
+      --replace-fail \
+        'let url = match env::var("STUDIO_UI_VERSION") {' \
+        'if let Ok(dist_path) = env::var("STUDIO_UI_DIST") {
+            let src = std::path::Path::new(&dist_path);
+            fn copy_dir(s: &std::path::Path, d: &std::path::Path) {
+                std::fs::create_dir_all(d).unwrap();
+                for e in std::fs::read_dir(s).unwrap() {
+                    let e = e.unwrap();
+                    if e.file_type().unwrap().is_dir() { copy_dir(&e.path(), &d.join(e.file_name())); }
+                    else { std::fs::copy(e.path(), d.join(e.file_name())).unwrap(); }
+                }
+            }
+            copy_dir(src, &asset_dir);
+            return;
+        }
+        let url = match env::var("STUDIO_UI_VERSION") {'
+  '';
+
+  env = {
+    RUSTFLAGS = "-Aunused";
+    OPENSSL_NO_VENDOR = 1;
+    STUDIO_UI_DIST = "${studioUi}";
+  };
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [ openssl ];
+
+  doInstallCheck = true;
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  meta = {
+    description = "Surfpool is where developers start their Solana journey";
+    homepage = "https://www.surfpool.run/";
+    longDescription = ''
+      Surfpool is a drop-in replacement for solana-test-validator that lets
+      developers spin up local Solana networks mirroring mainnet state without
+      downloading the entire chain. It includes a built-in web UI (Surfpool Studio)
+      served directly from the binary, Infrastructure as Code for declarative
+      program deployment, transaction inspection, time travel, cheatcodes, and
+      an MCP server for agentic workflows
+    '';
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ _0xgsvs ];
+    mainProgram = "surfpool";
+  };
+})
@@ -1,69 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchurl,
-  pkg-config,
-  gtk2,
-  openssl ? null,
-  gpgme ? null,
-  gpgSupport ? true,
-  sslSupport ? true,
-  fetchpatch,
-}:
-
-assert gpgSupport -> gpgme != null;
-assert sslSupport -> openssl != null;
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "sylpheed";
-  version = "3.7.0";
-
-  src = fetchurl {
-    url = "https://sylpheed.sraoss.jp/sylpheed/v3.7/sylpheed-${finalAttrs.version}.tar.xz";
-    sha256 = "0j9y5vdzch251s264diw9clrn88dn20bqqkwfmis9l7m8vmwasqd";
-  };
-
-  patches = [
-    (fetchpatch {
-      # patch upstream bug https://sylpheed.sraoss.jp/redmine/issues/306
-      name = "patch-libsylph_ssl_c.patch";
-      extraPrefix = "";
-      url = "https://cvsweb.openbsd.org/cgi-bin/cvsweb/~checkout~/ports/mail/sylpheed/patches/patch-libsylph_ssl_c?rev=1.4&content-type=text/plain";
-      sha256 = "sha256-+FetU5vrfvE78nYAjKK/QFZnFw+Zr2PvoUGRWCuZczs=";
-    })
-    (fetchpatch {
-      name = "CVE-2021-37746.patch";
-      url = "https://git.claws-mail.org/?p=claws.git;a=patch;h=ac286a71ed78429e16c612161251b9ea90ccd431";
-      sha256 = "sha256-oLmUShtvO6io3jibKT67eO0O58vEDZEeaB51QTd3UkU=";
-    })
-    (fetchurl {
-      name = "0013-fix-FTBFS-GCC-14.patch";
-      url = "https://salsa.debian.org/sylpheed-team/sylpheed/-/raw/22984c6d2bf76b0667256a9e8b660447497e1220/debian/patches/0013-fix-FTBFS-GCC-14.patch?inline=false";
-      sha256 = "sha256-ZfQKiOK8pMrN87hrP0/2LxYZZdnaciBoa0khG1Djelo=";
-    })
-  ];
-
-  nativeBuildInputs = [ pkg-config ];
-
-  buildInputs = [
-    gtk2
-  ]
-  ++ lib.optionals gpgSupport [ gpgme ]
-  ++ lib.optionals sslSupport [ openssl ];
-
-  configureFlags = lib.optional gpgSupport "--enable-gpgme" ++ lib.optional sslSupport "--enable-ssl";
-
-  # Undefined symbols for architecture arm64: "_OBJC_CLASS_$_NSAutoreleasePool"
-  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
-    NIX_LDFLAGS = "-framework Foundation";
-  };
-
-  meta = {
-    homepage = "https://sylpheed.sraoss.jp/en/";
-    description = "Lightweight and user-friendly e-mail client";
-    mainProgram = "sylpheed";
-    maintainers = [ ];
-    platforms = lib.platforms.linux ++ lib.platforms.darwin;
-    license = lib.licenses.gpl2;
-  };
-})
@@ -0,0 +1,21 @@
+diff --git a/source/main.c b/source/main.c
+index 2d817e5..9dfeb3d 100644
+--- a/source/main.c
+++ b/source/main.c
+@@ -28,6 +28,7 @@
+ #include <unistd.h>
+ #include <errno.h>
+ #include <libgen.h>
+#include <stdbool.h>
+ #ifndef _WIN32
+ #include <sys/socket.h>
+ #include <netinet/in.h>
+@@ -62,8 +63,6 @@ typedef signed short s16;
+ typedef signed int s32;
+ typedef signed long long s64;
+
+-typedef enum { false, true } bool;
+-
+ #ifndef __WIN32__
+ static const char *desc_export = "export";
+ #ifndef __APPLE__
@@ -23,6 +23,11 @@ stdenv.mkDerivation (finalAttrs: {
    sha256 = "sha256-pZdZzCAPfAVucuiV/q/ROY3cz/wxQWep6dCTGNn2fSo=";
  };

+  patches = [
+    # https://github.com/devkitPro/wiiload/pull/4
+    ./fix-gcc15.patch
+  ];
+
  preConfigure = "./autogen.sh";

  meta = {
@@ -10,33 +10,41 @@
 }:

 stdenv.mkDerivation (finalAttrs: {
-  pname = "hyprfreeze";
-  version = "1.2.0";
+  pname = "wl-freeze";
+  version = "2.0.2";
+
+  strictDeps = true;
+  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "Zerodya";
-    repo = "hyprfreeze";
+    repo = "wl-freeze";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-omwAWBEnb14ZBux7bvXSJyi7FI1LZ5GaZFn46/bWJA4=";
+    hash = "sha256-miyDiUN86Zy9RfVm1MefKrYihX4+bFv6Jr4Cl4GzGz8=";
  };

+  dontConfigure = true;
+  dontBuild = true;
+
  nativeBuildInputs = [ makeWrapper ];

  installPhase = ''
    runHook preInstall

-    install -Dm755 hyprfreeze $out/bin/hyprfreeze
+    install -Dm755 wl-freeze $out/bin/wl-freeze

    # Install shell completions
-    install -Dm444 completions/bash/hyprfreeze $out/share/bash-completion/completions/hyprfreeze
-    install -Dm444 completions/zsh/_hyprfreeze $out/share/zsh/site-functions/_hyprfreeze
-    install -Dm444 completions/fish/hyprfreeze.fish $out/share/fish/completions/hyprfreeze.fish
+    installShellCompletion \
+      --cmd wl-freeze \
+      --bash completions/bash/wl-freeze \
+      --zsh completions/zsh/_wl-freeze \
+      --fish completions/fish/wl-freeze.fish

    runHook postInstall
  '';

  postFixup = ''
-    wrapProgram $out/bin/hyprfreeze \
+    wrapProgram $out/bin/wl-freeze \
      --prefix PATH : ${
        lib.makeBinPath [
          jq
@@ -48,11 +56,11 @@ stdenv.mkDerivation (finalAttrs: {
  '';

  meta = {
-    description = "Utility to suspend a game process (and other programs) in Hyprland";
-    homepage = "https://github.com/Zerodya/hyprfreeze";
+    description = "Utility to suspend a game process (and other programs) in Wayland compositors";
+    homepage = "https://github.com/Zerodya/wl-freeze";
    license = lib.licenses.gpl3Only;
    maintainers = with lib.maintainers; [ zerodya ];
    platforms = lib.platforms.linux;
-    mainProgram = "hyprfreeze";
+    mainProgram = "wl-freeze";
  };
 })
@@ -17,7 +17,11 @@ stdenv.mkDerivation (finalAttrs: {
    sha256 = "1ngnp5f5zl3v35vhbdyjpymy6mwrs0476fm5nd7dzkba7n841jdh";
  };

-  prePatch = "substituteInPlace ./Makefile --replace /usr $out";
+  prePatch = ''
+    substituteInPlace Makefile --replace-fail /usr $out
+    # gcc15
+    substituteInPlace main.c --replace-fail 'handler ()' 'handler (int sig)'
+  '';

  buildInputs = [
    libx11
@@ -1,25 +1,30 @@
 {
+  _experimental-update-script-combinators,
  erlang,
  fetchFromGitHub,
-  mixRelease,
-  lib,
  fetchMixDeps,
+  gnused,
+  lib,
+  mixRelease,
+  nix-update-script,
+  nurl,
+  writeShellApplication,
 }:
 let
-  version = "0.1.0";
+  version = "0.1.1";

  src = fetchFromGitHub {
    owner = "elixir-lang";
    repo = "expert";
    tag = "v${version}";
-    hash = "sha256-r/SovUjU12ENT6OqbYuGK7XAmoxchUgiHTswlON/WeI=";
+    hash = "sha256-J38+ESTrygj62wcOOAaq1ERM/ze3+p8Ec369Cz0F1Sg=";
  };

  engineDeps = fetchMixDeps {
    pname = "mix-deps-expert-engine";

    inherit src version;
-    hash = "sha256-2QCaY4TlscRmklPQ897xjjree7N8cLl7O83syfqPmng=";
+    hash = "sha256-relCdTBialz4Z/BpXZxmuhSYrvJqLINg/AVGfEhuDGo=";

    preConfigure = ''
      cd apps/engine
@@ -58,6 +63,24 @@ mixRelease rec {

  passthru = {
    inherit engineDeps;
+
+    updateScript = _experimental-update-script-combinators.sequence [
+      (nix-update-script { })
+      (lib.getExe (writeShellApplication {
+        name = "expert-update-engine";
+        runtimeInputs = [
+          gnused
+          nurl
+        ];
+        text = ''
+          nixpkgs="$(git rev-parse --show-toplevel)"
+          engineHashOld=${engineDeps.hash}
+          engineHashNew=$(nurl -e "(import $nixpkgs/. { }).$UPDATE_NIX_ATTR_PATH.engineDeps")
+          echo "$UPDATE_NIX_ATTR_PATH.engineDeps.hash" >&2
+          sed -i "s|$engineHashOld|$engineHashNew|" "$nixpkgs"/pkgs/development/beam-modules/expert/default.nix
+        '';
+      }))
+    ];
  };

  meta = {
@@ -3,6 +3,7 @@
  buildPythonPackage,
  fetchFromGitHub,
  setuptools-scm,
+  encutils,
  more-itertools,
  cssselect,
  jaraco-test,
@@ -13,19 +14,27 @@

 buildPythonPackage rec {
  pname = "cssutils";
-  version = "2.11.1";
+  version = "2.14.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "jaraco";
    repo = "cssutils";
    tag = "v${version}";
-    hash = "sha256-U9myMfKz1HpYVJXp85izRBpm2wjLHYZj8bUVt3ROTEg=";
+    hash = "sha256-kuqHfwJn+GT1VIC2PWu5Oj1X6SGn/bi2QPN8kfposVs=";
  };

+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail '"coherent.licensed",' ""
+  '';
+
  build-system = [ setuptools-scm ];

-  dependencies = [ more-itertools ];
+  dependencies = [
+    encutils
+    more-itertools
+  ];

  nativeCheckInputs = [
    cssselect
@@ -37,7 +46,6 @@ buildPythonPackage rec {

  disabledTests = [
    # access network
-    "encutils"
    "website.logging"
  ];

@@ -41,14 +41,14 @@

 buildPythonPackage rec {
  pname = "django-allauth";
-  version = "65.16.0";
+  version = "65.16.1";
  pyproject = true;

  src = fetchFromCodeberg {
    owner = "allauth";
    repo = "django-allauth";
    tag = version;
-    hash = "sha256-uYJErt7RElFrSMyVtnUgdkoIVIBzuAENZZHn/7kmfDE=";
+    hash = "sha256-ZtrbIklik0GmVMNtZegXJ8ot+5LKjO0B5ioo5nArKMk=";
  };

  nativeBuildInputs = [ gettext ];
@@ -0,0 +1,39 @@
+{
+  buildPythonPackage,
+  chardet,
+  fetchPypi,
+  flit-core,
+  lib,
+  pytestCheckHook,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "encutils";
+  version = "1.0.0";
+  pyproject = true;
+
+  # pyproject.toml on GitHub uses coherent.build as build-system
+  src = fetchPypi {
+    inherit (finalAttrs) pname version;
+    hash = "sha256-OOylrxjOur2L5DwX8UydP7uoPMX3rI46schuJMSyuRo=";
+  };
+
+  build-system = [ flit-core ];
+
+  dependencies = [
+    chardet
+  ];
+
+  pythonImportsCheck = [ "encutils" ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  meta = {
+    description = "Collection of helper functions to detect encodings of text files";
+    homepage = "https://github.com/coherent-oss/encutils";
+    license = lib.licenses.lgpl3Plus;
+    maintainers = [ lib.maintainers.dotlambda ];
+  };
+})
@@ -0,0 +1,85 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+
+  # build
+  poetry-core,
+
+  # deps
+  httpcore,
+  httpx,
+  openai,
+  pydantic,
+  python-dotenv,
+  requests,
+  typing-extensions,
+
+  # tests
+  pytest-asyncio,
+  pytest-cov-stub,
+  pytest-mock,
+  pytestCheckHook,
+
+  # passthru
+  unstableGitUpdater,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "exa-py";
+  version = "2.12.0-unstable-2026-04-15";
+  pyproject = true;
+  __structuredAttrs = true;
+
+  # pypi doesn't include tests but there aren't any upstream git tags
+  src = fetchFromGitHub {
+    owner = "exa-labs";
+    repo = "exa-py";
+    rev = "af7f88999763f1cb7e3c4a67f4aa24cef5f6eb11";
+    hash = "sha256-7rLEvjngSRObFdT1DcrZfqWBCsvWVxdNIgxBNhNNk+4=";
+  };
+
+  # https://github.com/pytest-dev/pytest-asyncio/issues/658
+  # default behaviour changes with new python version.
+  # planning on trying to vendor upstream
+  postPatch = ''
+    substituteInPlace tests/unit/test_search_monitors.py --replace-fail \
+      'get_event_loop().run_until_complete' 'run'
+  '';
+
+  build-system = [
+    poetry-core
+  ];
+
+  dependencies = [
+    httpcore
+    httpx
+    openai
+    pydantic
+    python-dotenv
+    requests
+    typing-extensions
+  ];
+
+  pythonImportsCheck = [
+    "exa_py"
+  ];
+
+  nativeCheckInputs = [
+    pytest-asyncio
+    pytest-cov-stub
+    pytest-mock
+    pytestCheckHook
+  ];
+
+  pytestFlags = [ "tests/" ];
+
+  passthru.updateScript = unstableGitUpdater { };
+
+  meta = {
+    description = "Official Python SDK for Exa, the web search API for AI";
+    homepage = "https://github.com/exa-labs/exa-py/";
+    maintainers = with lib.maintainers; [ ethancedwards8 ];
+    license = lib.licenses.mit;
+  };
+})
@@ -20,19 +20,20 @@

 buildPythonPackage (finalAttrs: {
  pname = "fastexcel";
-  version = "0.19.0";
+  version = "0.20.1";
  pyproject = true;
+  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "ToucanToco";
    repo = "fastexcel";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-BMFZOduKN6D3y9aRkt9VAG2T9oNFBUcnmux1qTKgY5c=";
+    hash = "sha256-YL8EkV6IuqAMxooOMbqCrTfDM4uhH9A+v7UFw1f/iek=";
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
    inherit (finalAttrs) pname version src;
-    hash = "sha256-aTYwXJN2hncZsEAGSlQzK5cX4uWpNoS0wpsXL0I6pZo=";
+    hash = "sha256-TK/5eES+RlSDFIbhVjzbPgdrDRRKZlCiuqtLRm8R/go=";
  };

  nativeBuildInputs = [
@@ -42,10 +43,6 @@ buildPythonPackage (finalAttrs: {
    rustc
  ];

-  maturinBuildFlags = [
-    "--features __maturin"
-  ];
-
  optional-dependencies = {
    pyarrow = [
      pyarrow
@@ -2,29 +2,36 @@
  lib,
  buildPythonPackage,
  fetchFromGitHub,
+
+  # build-system
  setuptools,
+
+  # dependencies
+  aiohttp,
+  decorator,
+  fsspec,
  google-auth,
  google-auth-oauthlib,
  google-cloud-storage,
  google-cloud-storage-control,
  requests,
-  decorator,
-  fsspec,
+
+  # optional-dependencies
  fusepy,
-  aiohttp,
  crcmod,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "gcsfs";
  version = "2026.3.0";
  pyproject = true;
+  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "fsspec";
    repo = "gcsfs";
-    tag = version;
-    hash = "sha256-eTIAGPin7Ej+aar5ZXATeYfqQJrGnyWfUdBIfq5eq/c=";
+    tag = finalAttrs.version;
+    hash = "sha256-RLh3xFW/0qX5labJeUDsRRmQtnTdkvBS+gzJUJ1IP7k=";
  };

  build-system = [
@@ -55,8 +62,8 @@ buildPythonPackage rec {
  meta = {
    description = "Convenient Filesystem interface over GCS";
    homepage = "https://github.com/fsspec/gcsfs";
-    changelog = "https://github.com/fsspec/gcsfs/raw/${src.tag}/docs/source/changelog.rst";
+    changelog = "https://github.com/fsspec/gcsfs/raw/${finalAttrs.src.tag}/docs/source/changelog.rst";
    license = lib.licenses.bsd3;
    maintainers = with lib.maintainers; [ nbren12 ];
  };
-}
+})
@@ -7,14 +7,14 @@

 buildPythonPackage rec {
  pname = "knx-frontend";
-  version = "2026.3.28.223133";
+  version = "2026.4.22.141111";
  pyproject = true;

  # TODO: source build, uses yarn.lock
  src = fetchPypi {
    pname = "knx_frontend";
    inherit version;
-    hash = "sha256-U/lHc4SZcUEG1yq2sMkSzM9n/n6TuNhbx4U2ZmMqAY0=";
+    hash = "sha256-2gzQETX2YayiahCGw9sSS6mCo5DmApBZB54ISQBm43M=";
  };

  build-system = [ setuptools ];
@@ -24,14 +24,15 @@

 buildPythonPackage (finalAttrs: {
  pname = "mlx-lm";
-  version = "0.31.2";
+  version = "0.31.3";
  pyproject = true;
+  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "ml-explore";
    repo = "mlx-lm";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Ujt0KMs4dzIlbg7cg72TudAvlwJ4uWEG5Lx7+5j8cOU=";
+    hash = "sha256-DPOJfsIucG8mWt4ZKenymCJo/i9Jw+a+iuIygIIYkA8=";
  };

  build-system = [
@@ -20,6 +20,7 @@

  # tests
  numpy,
+  psutil,
  pytestCheckHook,
  python,
  runCommand,
@@ -41,14 +42,15 @@ let
 in
 buildPythonPackage (finalAttrs: {
  pname = "mlx";
-  version = "0.31.1";
+  version = "0.31.2";
  pyproject = true;
+  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "ml-explore";
    repo = "mlx";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-PiNk/MdMw9Vpat2KuslBTyaFuK+mJ4UvwJqBnysvvUU=";
+    hash = "sha256-0Oxacz61WGWZrpWw+fMQjEQfwOx1l1L2d0kWl54/LrQ=";
  };

  patches = [
@@ -120,6 +122,7 @@ buildPythonPackage (finalAttrs: {
  # Run the mlx Python test suite.
  nativeCheckInputs = [
    numpy
+    psutil
    pytestCheckHook
  ];

@@ -1,8 +1,8 @@
 diff --git a/CMakeLists.txt b/CMakeLists.txt
-index 2451aa65..f88d4889 100644
+index 6d24df02..113629ba 100644
 --- a/CMakeLists.txt
 +++ b/CMakeLists.txt
-@@ -241,14 +241,6 @@ else()
+@@ -313,14 +313,6 @@ else()
   set(MLX_BUILD_ACCELERATE OFF)
 endif()
 
@@ -14,7 +14,6 @@ index 2451aa65..f88d4889 100644
 -target_include_directories(
 -  mlx PRIVATE $<BUILD_INTERFACE:${json_SOURCE_DIR}/single_include/nlohmann>)
 -
- add_subdirectory(${CMAKE_CURRENT_LIST_DIR}/mlx)
- 
- target_include_directories(
-
+ # Add standalone JACCL library (RDMA over Thunderbolt distributed backend)
+ if(MLX_BUILD_CPU
+    AND ${CMAKE_SYSTEM_NAME} MATCHES "Darwin"
@@ -1,15 +1,15 @@
 diff --git a/CMakeLists.txt b/CMakeLists.txt
-index 0ed30932..e5842707 100644
+index a2395d02..6d24df02 100644
 --- a/CMakeLists.txt
 +++ b/CMakeLists.txt
-@@ -339,13 +339,7 @@ if(MLX_BUILD_PYTHON_BINDINGS)
+@@ -354,13 +354,7 @@ if(MLX_BUILD_PYTHON_BINDINGS)
     Python 3.10
     COMPONENTS Interpreter Development.Module
     REQUIRED)
 -  FetchContent_Declare(
 -    nanobind
 -    GIT_REPOSITORY https://github.com/wjakob/nanobind.git
-    GIT_TAG v2.10.2
+-    GIT_TAG v2.12.0
 -    GIT_SHALLOW TRUE
 -    EXCLUDE_FROM_ALL)
 -  FetchContent_MakeAvailable(nanobind)
@@ -3,6 +3,7 @@
  buildPythonPackage,
  fetchFromGitHub,
  pythonAtLeast,
+  stdenv,
  hatchling,
  hatch-vcs,
  numpy,
@@ -28,14 +29,14 @@

 buildPythonPackage rec {
  pname = "mne";
-  version = "1.11.0";
+  version = "1.12.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "mne-tools";
    repo = "mne-python";
    tag = "v${version}";
-    hash = "sha256-lssSHlWUj3TU0F/31jTFc+oFdBx1C+9aolee6M8mJtw=";
+    hash = "sha256-j5PpUF7Yle8mFtIjawDaulq1s7zzVPpT3Y4+xNbQ+fk=";
  };

  postPatch = ''
@@ -92,9 +93,10 @@ buildPythonPackage rec {
    "test_fine_cal_systems"
    "test_simulate_raw_bem"
  ]
-  ++ lib.optionals (pythonAtLeast "3.14") [
-    #https://github.com/mne-tools/mne-python/issues/13577
-    "test_set_montage_artinis_basic"
+  ++ lib.optionals (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64) [
+    # Fails when no "model name" is present in /proc/cpuinfo,
+    # which is common on Arm Linux systems
+    "test_sys_info_basic"
  ];

  pytestFlag = [
@@ -25,14 +25,15 @@

 buildPythonPackage (finalAttrs: {
  pname = "onnx-ir";
-  version = "0.2.0";
+  version = "0.2.1";
  pyproject = true;
+  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "onnx";
    repo = "ir-py";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-U6N1vnsvp2Tr2qSIl9gsUnrKDjeUuUXAXx6ZyRnUTKM=";
+    hash = "sha256-vdo8BiE7m9Qr3JktgcPGDZfykjcf/VYY39tfhtzOrpA=";
  };

  build-system = [
@@ -30,14 +30,15 @@

 buildPythonPackage (finalAttrs: {
  pname = "onnxscript";
-  version = "0.6.2";
+  version = "0.7.0";
  pyproject = true;
+  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "microsoft";
    repo = "onnxscript";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-raeNa/OY9c8g+kHNxSAdLxhj+iwaMf/wrjUaKfW4E2s=";
+    hash = "sha256-PktzMtG8GpeRy3XUz8MFbOSISVzAIubpeOS0ESbVvrI=";
  };

  env = {
@@ -20,14 +20,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "pydantic-ai-slim";
-  version = "1.84.1";
+  version = "1.86.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "pydantic";
    repo = "pydantic-ai";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-LMfRGmLr51DzgJO97I/mJvyrVYD9tsF9OkCfw0ABWfw=";
+    hash = "sha256-4kDZzotCty40undBQoRXIzAFBufPIj3QSvhDjlG+Y6E=";
  };

  sourceRoot = "${finalAttrs.src.name}/pydantic_ai_slim";
@@ -16,14 +16,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "pydantic-graph";
-  version = "1.84.1";
+  version = "1.86.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "pydantic";
    repo = "pydantic-ai";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-LMfRGmLr51DzgJO97I/mJvyrVYD9tsF9OkCfw0ABWfw=";
+    hash = "sha256-4kDZzotCty40undBQoRXIzAFBufPIj3QSvhDjlG+Y6E=";
  };

  sourceRoot = "${finalAttrs.src.name}/pydantic_graph";
@@ -9,14 +9,14 @@

 buildPythonPackage rec {
  pname = "pyeclib";
-  version = "1.7.0";
+  version = "1.8.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "openstack";
    repo = "pyeclib";
    tag = version;
-    hash = "sha256-wYzZUtr80KgVTznD0ISy7qhGngm4Xmt8Mauu9lP+2T4=";
+    hash = "sha256-v7pkV5s10AxU+vgp+gcQF8lJmm6yzDwkqunWuT0zU4c=";
  };

  build-system = [
@@ -29,7 +29,7 @@ buildPythonPackage rec {
  pythonImportsCheck = [ "pyexpect" ];

  meta = {
-    changelog = "https://dwt/pyexpect/releases/tag/${version}";
+    changelog = "https://github.com/dwt/pyexpect/releases/tag/${version}";
    description = "Minimal but very flexible implementation of the expect pattern";
    homepage = "https://github.com/dwt/pyexpect";
    license = lib.licenses.isc;
@@ -34,14 +34,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "pylance";
-  version = "4.0.0";
+  version = "4.0.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "lancedb";
    repo = "lance";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Z7lgK7sIeZCL8VXfmwC8G1f7cBqG2nfFM3oyJZfmNQ4=";
+    hash = "sha256-bQnPa+5w5/WXw0i+D8jhk12Q/iKOFieKwZ9NPjAf5VQ=";
  };

  sourceRoot = "${finalAttrs.src.name}/python";
@@ -53,7 +53,7 @@ buildPythonPackage (finalAttrs: {
      src
      sourceRoot
      ;
-    hash = "sha256-hZEcTo4B3+viRwWExkaguq+c7DejjaouNf0+L96rms4=";
+    hash = "sha256-Hr3qrCVNpLpEiHKFOaA0gf5wRY3Tn2pBwZf292jmoSU=";
  };

  nativeBuildInputs = [
@@ -73,8 +73,9 @@

 buildPythonPackage (finalAttrs: {
  pname = "ray";
-  version = "2.55.0";
+  version = "2.55.1";
  format = "wheel";
+  __structuredAttres = true;

  disabled = pythonAtLeast "3.15";

@@ -90,22 +91,22 @@ buildPythonPackage (finalAttrs: {
      # Results are in ./ray-hashes.nix
      hashes = {
        x86_64-linux = {
-          cp311 = "sha256-UiSRRs/c92ns/+VPWyyvJVUb9up42d2JeIwKZpynabc=";
-          cp312 = "sha256-zUYL2/iopLt2iiDDixxTTYT+Y7wOXzWAxcDvcwK5hrM=";
-          cp313 = "sha256-8W3qMuXMWO1AbA7w3UvmnWDOd6B17bXwOANWpIv4WrM=";
-          cp314 = "sha256-6wpheWQbxCCmbuhcybOC5Y8i7/vTYpfjaDp5PlzcCJg=";
+          cp311 = "sha256-1TgtoYHAPuL1Au9Gzwrku8MBV7W9mmfXZR9qJyUoqFo=";
+          cp312 = "sha256-JjcF9rqynnYiqU+C2iX9f5zq12zfiaB6qyj3nN+PnZU=";
+          cp313 = "sha256-E4DgQ+tXzeabfpGZxvJVjO648PxByX0dXlDqBCEV8wI=";
+          cp314 = "sha256-FW7T5yrZW2RdIAbNcajd28yJtWv8AAJ/YiWt94vZy3Q=";
        };
        aarch64-linux = {
-          cp311 = "sha256-sf1zQnCT0a7x+3vTxUMKTmhtXhD6BAiXVxY6TCpRfes=";
-          cp312 = "sha256-t39AYHKsDOkEMaxDaCjzZMGDq1e6FcOg5oinSuPC0/M=";
-          cp313 = "sha256-zu6HqIRgKqs02xCUFeaDmm6RafR1DKtye36hYQ31uR8=";
-          cp314 = "sha256-t0OQ8gHyjwXI8lAGnf7VTW1qAQn/5IJCXXbBG+gg4wk=";
+          cp311 = "sha256-DqL2cKdyWDOtIzOoxGq2mGWtBsjl3p9laV4PjzUzHOw=";
+          cp312 = "sha256-JlQfabtVYH74M1uqx1su0S/yzgLVYxMhmyntoAMDkiE=";
+          cp313 = "sha256-tBXVkOBi8kiQfg/kKZSUPxFya3F4/PSxz1VGch+xpfg=";
+          cp314 = "sha256-TmGNYeGxS2/emlhhUfP9nUNbC4UEi5l7yqf0pTN0eys=";
        };
        aarch64-darwin = {
-          cp311 = "sha256-JCbpxFE8tIQr+vcKrt9LntwwL7Ad5cGQb2i5tCegwkM=";
-          cp312 = "sha256-bwuN+jcWzJvl/OO1Ppv9tzzqNgJb/m8dJ5KND4TP1pU=";
-          cp313 = "sha256-Hai4dVtuT94D23i2ziu87Pz70g05uTgz0kbFFdru3zw=";
-          cp314 = "sha256-1IvEUzs7dtWe0/nqsea3MipTp83vuPZX2bRu661W2+4=";
+          cp311 = "sha256-AFP9W0APesViY6obvT1o+3k0Gwi43Gl8iHgtWsp7PtQ=";
+          cp312 = "sha256-E3+QBu7ijKq4JggDzKMU83u9o/yU/foxx3C10Bliatg=";
+          cp313 = "sha256-+YRKknLvLm61dxAlhmByz0I0z0x8waMeI1t95xEYZL4=";
+          cp314 = "sha256-sGIEXGTCvOOaUWYWJPcpLHu/MPKp2Hhieq4x1G2lcS0=";
        };
      };
    in
@@ -4,12 +4,13 @@
  fetchFromGitHub,
  numpy,
  pytestCheckHook,
+  hatchling,
 }:

 buildPythonPackage rec {
  pname = "sdds";
  version = "0.4.3";
-  format = "setuptools";
+  pyproject = true;

  src = fetchFromGitHub {
    owner = "pylhc";
@@ -18,7 +19,9 @@ buildPythonPackage rec {
    hash = "sha256-2lsim4FlOKBZ4Lk/iKIcItE/hvqiAK4XTkoxm52At/8=";
  };

-  propagatedBuildInputs = [ numpy ];
+  build-system = [ hatchling ];
+
+  dependencies = [ numpy ];

  nativeCheckInputs = [ pytestCheckHook ];

@@ -10,14 +10,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "tuya-device-handlers";
-  version = "0.0.17";
+  version = "0.0.18";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "home-assistant-libs";
    repo = "tuya-device-handlers";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-T3jwUeRVSAiRSzyIOo7M046C+Dul1/1I9kZj0OzIIcs=";
+    hash = "sha256-ZzK6IV6AF+5+oOW9ADM/zgwFTmKNT2CzaEuXXK2hyVo=";
  };

  build-system = [ poetry-core ];
@@ -13,7 +13,7 @@

  # dependencies
  numpy,
-  pynvml,
+  nvidia-ml-py,

  # tests
  einops,
@@ -102,7 +102,7 @@ buildPythonPackage.override { stdenv = effectiveStdenv; } (finalAttrs: {
    torch
  ]
  ++ lib.optionals cudaSupport [
-    pynvml
+    nvidia-ml-py
  ];

  pythonImportsCheck = [
@@ -21,6 +21,7 @@
  python3,
  readline,
  ruby,
+  versionCheckHook,
  vte,
  xxhash,
  zlib,
@@ -46,19 +47,19 @@ let
  qjs = fetchFromGitHub {
    owner = "quickjs-ng";
    repo = "quickjs";
-    rev = "e2b100e8c5fa7131e9fb22b8a0e9ca0f16eb9892"; # https://github.com/radareorg/radare2/blob/master/subprojects/qjs.wrap
-    hash = "sha256-vq+K93MuvFC+JKw4623gKs53ngw1097l5Kf/RBGU+mA=";
+    rev = "3087a2ce5bcb66cc1fcd9f34d3e5ce3bd43a67d9"; # https://github.com/radareorg/radare2/blob/master/subprojects/qjs.wrap
+    hash = "sha256-Z6DUe/W1+3SYPRPCiL3oNL5ovXCsW3dsFuGkA9WF3W4=";
  };
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "radare2";
-  version = "6.1.2";
+  version = "6.1.4";

  src = fetchFromGitHub {
    owner = "radare";
    repo = "radare2";
    tag = finalAttrs.version;
-    hash = "sha256-YiKbXKKwbeAUkeq4LcUwOxTHU1Hua4YhcwDULiHVmrQ=";
+    hash = "sha256-3MwBtjR3XQMhbJHnD30OVedUEKcje5jDPszNynkGCT8=";
  };

  mesonFlags = [
@@ -133,6 +134,12 @@ stdenv.mkDerivation (finalAttrs: {
    install_name_tool -add_rpath $out/lib $out/lib/libr_io.${finalAttrs.version}.dylib
  '';

+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "-v";
+  doInstallCheck = true;
+
+  passthru.updateScript = ./update.sh;
+
  meta = {
    description = "UNIX-like reverse engineering framework and command-line toolset";
    longDescription = ''
@@ -163,7 +170,7 @@ stdenv.mkDerivation (finalAttrs: {
      mic92
      raskin
    ];
-    mainProgram = "radare2";
+    mainProgram = "r2";
    platforms = lib.platforms.unix;
  };
 })
@@ -0,0 +1,78 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i sh -p curl jq nix-prefetch-github nix coreutils gnused gnugrep
+# shellcheck shell=sh
+set -eu
+
+# Directory of this script / the radare2 package
+SCRIPT_DIR="$(readlink -f "$(dirname "$0")")"
+NIXFILE="$SCRIPT_DIR/default.nix"
+
+# Determine latest release version
+LATEST_VERSION=$(curl -s https://api.github.com/repos/radareorg/radare2/releases/latest | jq -r '.tag_name')
+echo "Latest radare2 version: $LATEST_VERSION"
+
+CURRENT_VERSION=$(grep 'version = ' "$NIXFILE" | head -1 | sed 's/.*"\(.*\)".*/\1/')
+echo "Current radare2 version: $CURRENT_VERSION"
+
+if [ "$LATEST_VERSION" = "$CURRENT_VERSION" ]; then
+    echo "radare2 is already up to date"
+    exit 0
+fi
+
+# Update main package version and hash
+echo "Updating main source to $LATEST_VERSION..."
+MAIN_HASH=$(nix-prefetch-github radare radare2 --rev "$LATEST_VERSION" --json | jq -r '.hash')
+echo "  New main hash: $MAIN_HASH"
+
+sed -i "s|version = \"$CURRENT_VERSION\"|version = \"$LATEST_VERSION\"|" "$NIXFILE"
+sed -i "/src = fetchFromGitHub/,/};/{s|hash = \".*\"|hash = \"$MAIN_HASH\"|}" "$NIXFILE"
+
+# Update a single subproject
+# Arguments: name owner repo wrap_file ref_type
+update_subproject() {
+    name=$1
+    owner=$2
+    repo=$3
+    wrap_file=$4
+    ref_type=$5
+
+    echo "Checking subproject $name..."
+
+    # Fetch the wrap file from the new version
+    wrap_content=$(curl -sL "https://raw.githubusercontent.com/radareorg/radare2/$LATEST_VERSION/subprojects/$wrap_file")
+    new_rev=$(echo "$wrap_content" | grep '^revision' | sed 's/revision = //')
+
+    # Get the current revision from the nix file
+    current_rev=$(grep -A3 "repo = \"$repo\"" "$NIXFILE" | grep "$ref_type = " | sed 's/.*"\(.*\)".*/\1/')
+
+    if [ "$new_rev" = "$current_rev" ]; then
+        echo "  $name is unchanged at $current_rev"
+        return
+    fi
+
+    echo "  Updating $name: $current_rev -> $new_rev"
+
+    # Prefetch new hash
+    new_hash=$(nix-prefetch-github "$owner" "$repo" --rev "$new_rev" --json | jq -r '.hash')
+    echo "  New hash: $new_hash"
+
+    # Update revision and hash in the nix file
+    sed -i "/repo = \"$repo\"/,/};/{s|$ref_type = \"$current_rev\"|$ref_type = \"$new_rev\"|}" "$NIXFILE"
+    sed -i "/repo = \"$repo\"/,/};/{s|hash = \".*\"|hash = \"$new_hash\"|}" "$NIXFILE"
+}
+
+update_subproject binaryninja Vector35 binaryninja-api binaryninja.wrap rev
+update_subproject sdb radareorg sdb sdb.wrap tag
+update_subproject qjs quickjs-ng quickjs qjs.wrap rev
+
+echo "Update iaito to follow new radare2 version '$LATEST_VERSION'"
+IAITO_UPDATE_SCRIPT="$(readlink -f "$(dirname "$SCRIPT_DIR")/../../../by-name/ia/iaito/update.sh")"
+if "$IAITO_UPDATE_SCRIPT" "$LATEST_VERSION";then
+    echo "iaito updated to $LATEST_VERSION"
+else
+    # iaito release may not have been published yet, release dates are not in sync
+    # sometimes, iaito is released earlier than radare2
+    echo "failed to update iaito to $LATEST_VERSION, continuing"
+fi
+
+echo "Update complete. Please verify with: nix build .#radare2 .#iaito"
@@ -594,6 +594,7 @@ mapAliases {
  deco = throw "'deco' has been removed as it is unused"; # Added 2025-12-18
  deepin = throw "the Deepin desktop environment and associated tools have been removed from nixpkgs due to lack of maintenance"; # Added 2025-08-21
  deepsea = throw "deepsea has been removed because it has been marked as broken since at least November 2024."; # Added 2025-09-28
+  defuddle-cli = warnAlias "defuddle-cli has been renamed to/replaced by 'defuddle'" defuddle; # Added 2026-04-16
  degit-rs = throw "'degit-rs' has been removed because it is unmaintained upstream and has vulnerable dependencies."; # Added 2025-07-11
  deltachat-cursed = throw "'deltachat-cursed' has been renamed to/replaced by 'arcanechat-tui'"; # Converted to throw 2025-10-27
  devdocs-desktop = throw "'devdocs-desktop' has been removed as it is unmaintained upstream and vendors insecure dependencies"; # Added 2025-06-11
@@ -926,6 +927,7 @@ mapAliases {
  http-prompt = throw "'http-prompt' has been removed as it was broken and unmaintained upstream"; # Added 2025-11-26
  hydra_unstable = throw "'hydra_unstable' has been renamed to/replaced by 'hydra'"; # Converted to throw 2025-10-27
  hydraAntLogger = warnAlias "'hydraAntLogger' has been renamed to 'hydra-ant-logger'" hydra-ant-logger; # Added 2026-02-08
+  hyprfreeze = warnAlias "'hyprfreeze' has been renamed to 'wl-freeze'" wl-freeze; # Added 2026-04-10
  i3-gaps = throw "'i3-gaps' has been renamed to/replaced by 'i3'"; # Converted to throw 2025-10-27
  i3lock-pixeled = throw "'i3lock-pixeled' has been unmaintained for several years now."; # Converted to throw 2026-01-24
  ibm-sw-tpm2 = throw "ibm-sw-tpm2 has been removed, as it was broken"; # Added 2025-08-25
@@ -1932,6 +1934,7 @@ mapAliases {
  swiPrologWithGui = throw "'swiPrologWithGui' has been renamed to/replaced by 'swi-prolog-gui'"; # Converted to throw 2025-10-27
  swww = warnAlias "'swww' has been renamed to 'awww'" awww; # Added 2026-03-22
  Sylk = throw "'Sylk' has been renamed to/replaced by 'sylk'"; # Converted to throw 2025-10-27
+  sylpheed = throw "'sylpheed' has been removed because it is broken and unmaintained, please use 'claws-mail' instead"; # Added 2026-04-22
  symbiyosys = throw "'symbiyosys' has been renamed to/replaced by 'sby'"; # Converted to throw 2025-10-27
  syn2mas = throw "'syn2mas' has been removed. It has been integrated into the main matrix-authentication-service CLI as a subcommand: 'mas-cli syn2mas'."; # Added 2025-07-07
  synapse-admin-etkecc = warnAlias "'synapse-admin-etkecc' has been renamed to 'ketesa'" ketesa; # Added 2026-04-03
@@ -5016,6 +5016,8 @@ self: super: with self; {

  encodec = callPackage ../development/python-modules/encodec { };

+  encutils = callPackage ../development/python-modules/encutils { };
+
  energyflip-client = callPackage ../development/python-modules/energyflip-client { };

  energyflow = callPackage ../development/python-modules/energyflow { };
@@ -5194,6 +5196,8 @@ self: super: with self; {

  ewmhlib = callPackage ../development/python-modules/ewmhlib { };

+  exa-py = callPackage ../development/python-modules/exa-py { };
+
  example-robot-data = callPackage ../development/python-modules/example-robot-data {
    inherit (pkgs) example-robot-data;
  };