Merge master into staging-next

2025-05-17 12:06:18 +00:00
parent ee66135327 2c25b7b552
commit 91587a9a0c
87 changed files with 1282 additions and 7016 deletions
@@ -533,7 +533,7 @@ Names of files and directories should be in lowercase, with dashes between words

 ### Formatting

-CI [enforces](./.github/workflows/check-nix-format.yml) all Nix files to be
+CI [enforces](./.github/workflows/check-format.yml) all Nix files to be
 formatted using the [official Nix formatter](https://github.com/NixOS/nixfmt).

 You can ensure this locally using either of these commands:
@@ -30,8 +30,8 @@ rustPlatform.buildRustPackage (finalAttrs: {

  # Assuming our app's frontend uses `npm` as a package manager
  npmDeps = fetchNpmDeps {
-    name = "${finalAttrs.pname}-npm-deps-${finalAttrs.version}";
-    inherit src;
+    name = "${finalAttrs.pname}-${finalAttrs.version}-npm-deps";
+    inherit (finalAttrs) src;
    hash = "...";
  };

@@ -51,17 +51,16 @@ rustPlatform.buildRustPackage (finalAttrs: {
      wrapGAppsHook4
    ];

-  buildInputs =
-    [ openssl ]
-    ++ lib.optionals stdenv.hostPlatform.isLinux [
-      glib-networking # Most Tauri apps need networking
-      webkitgtk_4_1
-    ];
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
+    glib-networking # Most Tauri apps need networking
+    openssl
+    webkitgtk_4_1
+  ];

  # Set our Tauri source directory
  cargoRoot = "src-tauri";
  # And make sure we build there too
-  buildAndTestSubdir = cargoRoot;
+  buildAndTestSubdir = finalAttrs.cargoRoot;

  # ...
 })
@@ -11132,6 +11132,7 @@
    name = "Jappie Klooster";
  };
  jappie3 = {
+    email = "jappie3+git@jappie.dev";
    name = "Jappie3";
    matrix = "@jappie:jappie.dev";
    github = "Jappie3";
@@ -25640,6 +25641,11 @@
    github = "deviant";
    githubId = 68829907;
  };
+  vaavaav = {
+    name = "Pedro Peixoto";
+    github = "vaavaav";
+    githubId = 56087034;
+  };
  vaci = {
    email = "vaci@vaci.org";
    github = "vaci";
@@ -638,6 +638,8 @@
  They are still expected to be working until future version 5.0.0, but will generate warnings in logs.
  Read the [release notes](https://www.authelia.com/blog/4.39-release-notes/) for human readable summaries of the changes.

+- `security.acme` now supports renewal using CSRs (Certificate Signing Request) through the options `security.acme.*.csr` and `security.acme.*.csrKey`.
+
 - `programs.fzf.keybindings` now supports the fish shell.

 - `gerbera` now has wavpack support.
@@ -236,13 +236,16 @@ let

      # Create hashes for cert data directories based on configuration
      # Flags are separated to avoid collisions
-      hashData = with builtins; ''
-        ${lib.concatStringsSep " " data.extraLegoFlags} -
-        ${lib.concatStringsSep " " data.extraLegoRunFlags} -
-        ${lib.concatStringsSep " " data.extraLegoRenewFlags} -
-        ${toString acmeServer} ${toString data.dnsProvider}
-        ${toString data.ocspMustStaple} ${data.keyType}
-      '';
+      hashData =
+        with builtins;
+        ''
+          ${lib.concatStringsSep " " data.extraLegoFlags} -
+          ${lib.concatStringsSep " " data.extraLegoRunFlags} -
+          ${lib.concatStringsSep " " data.extraLegoRenewFlags} -
+          ${toString acmeServer} ${toString data.dnsProvider}
+          ${toString data.ocspMustStaple} ${data.keyType}
+        ''
+        + (lib.optionalString (data.csr != null) (" - " + data.csr));
      certDir = mkHash hashData;
      # TODO remove domainHash usage entirely. Waiting on go-acme/lego#1532
      domainHash = mkHash "${lib.concatStringsSep " " extraDomains} ${data.domain}";
@@ -286,18 +289,24 @@ let
          "--accept-tos" # Checking the option is covered by the assertions
          "--path"
          "."
-          "-d"
-          data.domain
          "--email"
          data.email
-          "--key-type"
-          data.keyType
        ]
        ++ protocolOpts
        ++ lib.optionals (acmeServer != null) [
          "--server"
          acmeServer
        ]
+        ++ lib.optionals (data.csr != null) [
+          "--csr"
+          data.csr
+        ]
+        ++ lib.optionals (data.csr == null) [
+          "--key-type"
+          data.keyType
+          "-d"
+          data.domain
+        ]
        ++ lib.concatMap (name: [
          "-d"
          name
@@ -327,6 +336,8 @@ let
      webroots = lib.remove null (
        lib.unique (builtins.map (certAttrs: certAttrs.webroot) (lib.attrValues config.security.acme.certs))
      );
+
+      certificateKey = if data.csrKey != null then "${data.csrKey}" else "certificates/${keyName}.key";
    in
    {
      inherit accountHash cert selfsignedDeps;
@@ -529,7 +540,7 @@ let
          # Check if we can renew.
          # We can only renew if the list of domains has not changed.
          # We also need an account key. Avoids #190493
-          if cmp -s domainhash.txt certificates/domainhash.txt && [ -e 'certificates/${keyName}.key' ] && [ -e 'certificates/${keyName}.crt' ] && [ -n "$(find accounts -name '${data.email}.key')" ]; then
+          if cmp -s domainhash.txt certificates/domainhash.txt && [ -e '${certificateKey}' ] && [ -e 'certificates/${keyName}.crt' ] && [ -n "$(find accounts -name '${data.email}.key')" ]; then

            # Even if a cert is not expired, it may be revoked by the CA.
            # Try to renew, and silently fail if the cert is not expired.
@@ -564,7 +575,7 @@ let
            touch out/renewed
            echo Installing new certificate
            cp -vp 'certificates/${keyName}.crt' out/fullchain.pem
-            cp -vp 'certificates/${keyName}.key' out/key.pem
+            cp -vp '${certificateKey}' out/key.pem
            cp -vp 'certificates/${keyName}.issuer.crt' out/chain.pem
            ln -sf fullchain.pem out/cert.pem
            cat out/key.pem out/fullchain.pem > out/full.pem
@@ -845,6 +856,18 @@ let
          description = "Domain to fetch certificate for (defaults to the entry name).";
        };

+        csr = lib.mkOption {
+          type = lib.types.nullOr lib.types.str;
+          default = null;
+          description = "Path to a certificate signing request to apply when fetching the certificate.";
+        };
+
+        csrKey = lib.mkOption {
+          type = lib.types.nullOr lib.types.str;
+          default = null;
+          description = "Path to the private key to the matching certificate signing request.";
+        };
+
        extraDomainNames = lib.mkOption {
          type = lib.types.listOf lib.types.str;
          default = [ ];
@@ -1113,6 +1136,17 @@ in
                used for variables suffixed by "_FILE".
              '';
            }
+
+            {
+              assertion = lib.all (
+                certOpts:
+                (certOpts.csr == null && certOpts.csrKey == null)
+                || (certOpts.csr != null && certOpts.csrKey != null)
+              ) certs;
+              message = ''
+                When passing a certificate signing request both `security.acme.certs.${cert}.csr` and `security.acme.certs.${cert}.csrKey` need to be set.
+              '';
+            }
          ]) cfg.certs
        ));

@@ -99,6 +99,45 @@ in
              "builtin-3.${domain}".listenHTTP = ":80";
            };
          };
+
+          csr.configuration =
+            let
+              conf = pkgs.writeText "openssl.csr.conf" ''
+                [req]
+                default_bits = 2048
+                prompt = no
+                default_md = sha256
+                req_extensions = req_ext
+                distinguished_name = dn
+
+                [ dn ]
+                CN = ${config.networking.fqdn}
+
+                [ req_ext ]
+                subjectAltName = @alt_names
+
+                [ alt_names ]
+                DNS.1 = ${config.networking.fqdn}
+              '';
+              csrData =
+                pkgs.runCommandNoCC "csr-and-key"
+                  {
+                    buildInputs = [ pkgs.openssl ];
+                  }
+                  ''
+                    mkdir -p $out
+                    openssl req -new -newkey rsa:2048 -nodes \
+                      -keyout $out/key.pem \
+                      -out $out/request.csr \
+                      -config ${conf}
+                  '';
+            in
+            {
+              security.acme.certs."${config.networking.fqdn}" = {
+                csr = "${csrData}/request.csr";
+                csrKey = "${csrData}/key.pem";
+              };
+            };
        };
      };
  };
@@ -211,5 +250,10 @@ in

      with subtest("Validate permissions (self-signed)"):
          check_permissions(builtin, cert, "acme")
+
+      with subtest("Can renew using a CSR"):
+          builtin.succeed(f"systemctl clean acme-{cert}.service --what=state")
+          switch_to(builtin, "csr")
+          check_issuer(builtin, cert, "pebble")
    '';
 }
@@ -1,112 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  cmake,
-  pkg-config,
-  wrapQtAppsHook,
-
-  bluez,
-  libnotify,
-  libXdmcp,
-  libXtst,
-  opencv,
-  qtbase,
-  qtmultimedia,
-  qtscript,
-  qttools,
-  qtx11extras,
-  qtxmlpatterns,
-
-  # Running with TTS support causes the program to freeze for a few seconds every time at startup,
-  # so it is disabled by default
-  textToSpeechSupport ? false,
-  qtspeech,
-}:
-
-let
-  # For some reason qtscript wants to use the same version of qtbase as itself
-  # This override makes it think that they are the same version
-  qtscript' = qtscript.overrideAttrs (oldAttrs: {
-    inherit (qtbase) version;
-    postPatch = ''
-      substituteInPlace .qmake.conf \
-          --replace-fail ${oldAttrs.version} ${qtbase.version}
-    '';
-  });
-in
-stdenv.mkDerivation (finalAttrs: {
-  pname = "actiona";
-  version = "3.10.2";
-
-  src = fetchFromGitHub {
-    owner = "Jmgr";
-    repo = "actiona";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-4RKCNEniBBx0kDwdHVZOqXYeGCsH8g6SfVc8JdDV0hI=";
-    fetchSubmodules = true;
-  };
-
-  patches =
-    [
-      # Sets the proper search location for the `.so` files and the translations
-      ./fix-paths.patch
-    ]
-    ++ lib.optionals (!textToSpeechSupport) [
-      # Removes TTS support
-      ./disable-tts.patch
-    ];
-
-  postPatch = ''
-    substituteInPlace gui/src/mainwindow.cpp executer/src/executer.cpp tools/src/languages.cpp \
-        --subst-var out
-  '';
-
-  nativeBuildInputs = [
-    cmake
-    pkg-config
-    wrapQtAppsHook
-  ];
-
-  buildInputs = [
-    bluez
-    libnotify
-    libXdmcp
-    libXtst
-    opencv
-    qtbase
-    qtmultimedia
-    qtscript'
-    qttools
-    qtx11extras
-    qtxmlpatterns
-  ] ++ lib.optionals textToSpeechSupport [ qtspeech ];
-
-  # RPATH of binary /nix/store/.../bin/... contains a forbidden reference to /build/
-  cmakeFlags = [ (lib.cmakeBool "CMAKE_SKIP_BUILD_RPATH" true) ];
-
-  # udev is used by the system-actionpack
-  env.NIX_LDFLAGS = "-ludev";
-
-  installPhase = ''
-    runHook preInstall
-
-    install -Dm755 {execution,actiontools,tools}/*.so -t $out/lib
-    install -Dm755 actions/actionpack*.so -t $out/lib/actions
-    install -Dm755 actiona actexec -t $out/bin
-    install -Dm644 translations/*.qm -t $out/share/actiona/translations
-    install -Dm644 $src/actiona.desktop -t $out/share/applications
-    install -Dm644 $src/gui/icons/actiona.png -t $out/share/icons/hicolor/48x48/apps
-
-    runHook postInstall
-  '';
-
-  meta = {
-    description = "Cross-platform automation tool";
-    homepage = "https://github.com/Jmgr/actiona";
-    license = lib.licenses.gpl3Only;
-    mainProgram = "actiona";
-    maintainers = with lib.maintainers; [ tomasajt ];
-    platforms = lib.platforms.linux;
-  };
-})
@@ -1,54 +0,0 @@
-diff --git a/actions/system/CMakeLists.txt b/actions/system/CMakeLists.txt
-index ca861145..3e3d3d3b 100644
--- a/actions/system/CMakeLists.txt
-+++ b/actions/system/CMakeLists.txt
-@@ -66,8 +66,6 @@ set(HEADERS
-     ${HEADERS_PREFIX}/actions/playsoundinstance.hpp
-     ${HEADERS_PREFIX}/actions/systemdefinition.hpp
-     ${HEADERS_PREFIX}/actions/systeminstance.hpp
-    ${HEADERS_PREFIX}/actions/texttospeechdefinition.hpp
-    ${HEADERS_PREFIX}/actions/texttospeechinstance.hpp
-     ${HEADERS_PREFIX}/code/mediaplaylist.hpp
-     ${HEADERS_PREFIX}/code/notify.hpp
-     ${HEADERS_PREFIX}/code/process.hpp
-@@ -131,7 +129,6 @@ find_package(Qt5 ${ACT_MINIMUM_QT_VERSION} COMPONENTS
-     DBus
-     Multimedia
-     MultimediaWidgets
-    TextToSpeech
- REQUIRED)
- 
- target_include_directories(${PROJECT}
-@@ -153,7 +150,6 @@ target_link_libraries(${PROJECT}
-     Qt5::DBus
-     Qt5::Multimedia
-     Qt5::MultimediaWidgets
-    Qt5::TextToSpeech
-     ${LIBNOTIFY_LIBRARIES}
-     ${BLUEZ_LIBRARIES}
-     ${UDEV_LIBRARIES}
-diff --git a/actions/system/src/actionpacksystem.hpp b/actions/system/src/actionpacksystem.hpp
-index c5768415..27a899d6 100644
--- a/actions/system/src/actionpacksystem.hpp
-+++ b/actions/system/src/actionpacksystem.hpp
-@@ -31,10 +31,6 @@
- #include "actions/playsounddefinition.hpp"
- #include "actions/findimagedefinition.hpp"
- 
-#if QT_VERSION >= QT_VERSION_CHECK(5, 10, 0)
-#include "actions/texttospeechdefinition.hpp"
-#endif
-
- #include "code/system.hpp"
- #include "code/mediaplaylist.hpp"
- #include "code/notify.hpp"
-@@ -67,9 +63,6 @@ public:
- 		addActionDefinition(new Actions::DetachedCommandDefinition(this));
- 		addActionDefinition(new Actions::PlaySoundDefinition(this));
- 		addActionDefinition(new Actions::FindImageDefinition(this));
-#if QT_VERSION >= QT_VERSION_CHECK(5, 10, 0)
-        addActionDefinition(new Actions::TextToSpeechDefinition(this));
-#endif
- 	}
- 
- 	QString id() const override							{ return QStringLiteral("system"); }
@@ -1,39 +0,0 @@
-diff --git a/executer/src/executer.cpp b/executer/src/executer.cpp
-index da848dad..5bd7e986 100644
--- a/executer/src/executer.cpp
-+++ b/executer/src/executer.cpp
-@@ -45,7 +45,7 @@ bool Executer::start(QIODevice *device, const QString &filename)
- 	QSettings settings;
- 	QString locale = settings.value(QStringLiteral("gui/locale"), QLocale::system().name()).toString();
- 
-    mActionFactory->loadActionPacks(QApplication::applicationDirPath() + QStringLiteral("/actions"), locale);
-+    mActionFactory->loadActionPacks(QStringLiteral("@out@/lib/actions"), locale);
- #ifndef Q_OS_WIN
- 	if(mActionFactory->actionPackCount() == 0)
- 		mActionFactory->loadActionPacks(QStringLiteral("actiona/actions/"), locale);
-diff --git a/gui/src/mainwindow.cpp b/gui/src/mainwindow.cpp
-index 6052648e..3c802d93 100644
--- a/gui/src/mainwindow.cpp
-+++ b/gui/src/mainwindow.cpp
-@@ -322,7 +322,7 @@ void MainWindow::postInit()
- 	if(mSplashScreen)
- 		mSplashScreen->showMessage(tr("Loading actions..."));
- 
-    mActionFactory->loadActionPacks(QApplication::applicationDirPath() + QStringLiteral("/actions"), mUsedLocale);
-+    mActionFactory->loadActionPacks(QStringLiteral("@out@/lib/actions"), mUsedLocale);
- #ifndef Q_OS_WIN
- 	if(mActionFactory->actionPackCount() == 0)
- 		mActionFactory->loadActionPacks(QStringLiteral("actiona/actions/"), mUsedLocale);
-diff --git a/tools/src/languages.cpp b/tools/src/languages.cpp
-index 4926936e..18e9aabb 100644
--- a/tools/src/languages.cpp
-+++ b/tools/src/languages.cpp
-@@ -79,7 +79,7 @@ namespace Tools
-     void Languages::installTranslator(const QString &componentName, const QString &locale)
-     {
-         auto translator = new QTranslator(QCoreApplication::instance());
-		if(!translator->load(QStringLiteral("%1/translations/%2_%3").arg(QCoreApplication::applicationDirPath()).arg(componentName).arg(locale)))
-+		if(!translator->load(QStringLiteral("@out@/share/actiona/translations/%1_%2").arg(componentName).arg(locale)))
-         {
-             auto path = QStringLiteral("%1/translations/%2_%3").arg(QDir::currentPath()).arg(componentName).arg(locale);
-             if(!translator->load(path))
@@ -1,19 +0,0 @@
-GEM
-  remote: https://rubygems.org/
-  specs:
-    chronic (0.10.2)
-    sequel (5.30.0)
-    sqlite3 (1.4.2)
-    timetrap (1.15.2)
-      chronic (~> 0.10.2)
-      sequel (~> 5.30.0)
-      sqlite3 (~> 1.4.2)
-
-PLATFORMS
-  ruby
-
-DEPENDENCIES
-  timetrap
-
-BUNDLED WITH
-   2.1.4
@@ -1,47 +0,0 @@
-{
-  chronic = {
-    groups = [ "default" ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "1hrdkn4g8x7dlzxwb1rfgr8kw3bp4ywg5l4y4i9c2g5cwv62yvvn";
-      type = "gem";
-    };
-    version = "0.10.2";
-  };
-  sequel = {
-    groups = [ "default" ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "0gqqnqrfayhwhkp0vy3frv68sgc7klyd6mfisx1j3djjvlyc7hmr";
-      type = "gem";
-    };
-    version = "5.30.0";
-  };
-  sqlite3 = {
-    groups = [ "default" ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "0lja01cp9xd5m6vmx99zwn4r7s97r1w5cb76gqd8xhbm1wxyzf78";
-      type = "gem";
-    };
-    version = "1.4.2";
-  };
-  timetrap = {
-    dependencies = [
-      "chronic"
-      "sequel"
-      "sqlite3"
-    ];
-    groups = [ "default" ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "0pfg5c3kmh1jfaaszw253bi93ixa6cznqmsafrcpccrdg9r8j2k8";
-      type = "gem";
-    };
-    version = "1.15.2";
-  };
-}
@@ -3,23 +3,23 @@
 {
  "kicad" = {
    kicadVersion = {
-      version = "9.0.1";
+      version = "9.0.2";
      src = {
-        rev = "eb0a9f7b5b8f26024310bd02367f8414d6c80734";
-        sha256 = "14g4ns2fxigzz1z4chcnaz2b8f4jkdmd56mnlpdq8nld8q84hywk";
+        rev = "bf9b9242aea7832d140dc25ff897fe01e2f36e41";
+        sha256 = "1v3nvp5ifa36hx3iw3whlp3j7hiy91fzihc0jc1daw0hnps7qy24";
      };
    };
    libVersion = {
-      version = "9.0.1";
+      version = "9.0.2";
      libSources = {
-        symbols.rev = "f8789bb729b5ed7ddc6a45b68563157e3a070944";
-        symbols.sha256 = "1q8vq4dwnhryizidx0s3x8p4yjhj3hbjhd40zy1pynkf1p174d7n";
-        templates.rev = "793b29a36c6b11a11d3bb417cf508a48b8c6ebb8";
+        symbols.rev = "9eab1c9c90a8aa84b0f7eec73076329d91764583";
+        symbols.sha256 = "134x4d5w89aahl4k9zai6vwcazibz17gsgzy04l9xn4zcf6v11qp";
+        templates.rev = "f93acff0f8c8c8e215ea125db060c86bf4b1f5d3";
        templates.sha256 = "0zs29zn8qjgxv0w1vyr8yxmj02m8752zagn4vcraqgik46dwg2id";
-        footprints.rev = "b5974927427a886128e5ba7a8adc285a751261d1";
-        footprints.sha256 = "0xqjnvbf032l191spfdh6g579jfhlpyr7pg53pkqdhzz053j3rlz";
-        packages3d.rev = "b1fd04f841f0d88b025be7357482cf7f48de4dae";
-        packages3d.sha256 = "1xgwd9srp93pj4pnskk3cnkbx57n6kvmlk7qwi3fl6wim3kxfcj2";
+        footprints.rev = "855079c1514bbdf38565fedcacee7fb05ffad5aa";
+        footprints.sha256 = "0w44b7dzx6d3xw2vbw37k34zxy25bq46rsnv21x10227313vr2wm";
+        packages3d.rev = "26e8886b3049a07e8b2b0bed82634ff755783352";
+        packages3d.sha256 = "18cxlp5grvv5m63c3sb6m9l9cmijqqcjmxrkdzg63d5jp7w73smn";
      };
    };
  };
@@ -27,7 +27,7 @@ stdenvNoCC.mkDerivation {
  dontConfigure = true;
  dontBuild = true;
  checkPhase = ''
-    find "$src" -type f -print0 | xargs -0 shellcheck
+    find "$src" -type f -print0 | xargs -0 shellcheck --source-path="$src"
  '';
  installPhase = ''
    touch "$out"
@@ -0,0 +1,96 @@
+diff --git a/actexec/CMakeLists.txt b/actexec/CMakeLists.txt
+index 49d8128..e8bfa16 100644
+--- a/actexec/CMakeLists.txt
+++ b/actexec/CMakeLists.txt
+@@ -40,7 +40,7 @@ endif()
+ 
+ setup_target(${PROJECT})
+ 
+-find_package(Qt6 ${ACT_MINIMUM_QT_VERSION} COMPONENTS Qml Network Widgets Core5Compat Multimedia TextToSpeech REQUIRED)
+find_package(Qt6 ${ACT_MINIMUM_QT_VERSION} COMPONENTS Qml Network Widgets Core5Compat Multimedia REQUIRED)
+ 
+ target_link_directories(${PROJECT}
+     PRIVATE
+@@ -75,7 +75,6 @@ target_link_libraries(
+     Qt6::Widgets
+     Qt6::Core5Compat
+     Qt6::Multimedia
+-    Qt6::TextToSpeech
+     ${LIBNOTIFY_LIBRARIES}
+ )
+ 
+diff --git a/actiona/CMakeLists.txt b/actiona/CMakeLists.txt
+index d03d650..222b2f9 100644
+--- a/actiona/CMakeLists.txt
+++ b/actiona/CMakeLists.txt
+@@ -125,7 +125,7 @@ endif()
+ 
+ setup_target(${PROJECT})
+ 
+-find_package(Qt6 ${ACT_MINIMUM_QT_VERSION} COMPONENTS Qml Network Widgets Core5Compat Multimedia TextToSpeech REQUIRED)
+find_package(Qt6 ${ACT_MINIMUM_QT_VERSION} COMPONENTS Qml Network Widgets Core5Compat Multimedia REQUIRED)
+ 
+ target_link_directories(${PROJECT}
+     PRIVATE
+@@ -162,7 +162,6 @@ target_link_libraries(
+     Qt6::Widgets
+     Qt6::Core5Compat
+     Qt6::Multimedia
+-    Qt6::TextToSpeech
+     ${LIBNOTIFY_LIBRARIES}
+     ${LIBX11_LIBRARIES}
+     $<$<PLATFORM_ID:Windows>:shlwapi>
+diff --git a/actions/system/CMakeLists.txt b/actions/system/CMakeLists.txt
+index a3019b1..6d9430c 100644
+--- a/actions/system/CMakeLists.txt
+++ b/actions/system/CMakeLists.txt
+@@ -67,8 +67,6 @@ set(HEADERS
+     ${HEADERS_PREFIX}/actions/playsoundinstance.hpp
+     ${HEADERS_PREFIX}/actions/systemdefinition.hpp
+     ${HEADERS_PREFIX}/actions/systeminstance.hpp
+-    ${HEADERS_PREFIX}/actions/texttospeechdefinition.hpp
+-    ${HEADERS_PREFIX}/actions/texttospeechinstance.hpp
+     ${HEADERS_PREFIX}/code/mediaplaylist.hpp
+     ${HEADERS_PREFIX}/code/notify.hpp
+     ${HEADERS_PREFIX}/code/process.hpp
+@@ -140,7 +138,6 @@ find_package(Qt6 ${ACT_MINIMUM_QT_VERSION} COMPONENTS
+     DBus
+     Multimedia
+     MultimediaWidgets
+-    TextToSpeech
+ REQUIRED)
+ 
+ target_link_directories(${PROJECT}
+@@ -167,7 +164,6 @@ target_link_libraries(${PROJECT}
+     Qt6::DBus
+     Qt6::Multimedia
+     Qt6::MultimediaWidgets
+-    Qt6::TextToSpeech
+     ${LIBNOTIFY_LIBRARIES}
+     ${BLUEZ_LIBRARIES}
+     $<$<PLATFORM_ID:Windows>:Bthprops>
+diff --git a/actions/system/src/actionpacksystem.hpp b/actions/system/src/actionpacksystem.hpp
+index ea045e3..a5af35a 100644
+--- a/actions/system/src/actionpacksystem.hpp
+++ b/actions/system/src/actionpacksystem.hpp
+@@ -32,10 +32,6 @@
+ #include "actions/playsounddefinition.hpp"
+ #include "actions/findimagedefinition.hpp"
+ 
+-#if QT_VERSION >= QT_VERSION_CHECK(5, 10, 0)
+-#include "actions/texttospeechdefinition.hpp"
+-#endif
+-
+ #include "code/system.hpp"
+ #include "code/mediaplaylist.hpp"
+ #include "code/notify.hpp"
+@@ -64,9 +60,6 @@ public:
+ 		addActionDefinition(new Actions::DetachedCommandDefinition(this));
+ 		addActionDefinition(new Actions::PlaySoundDefinition(this));
+ 		addActionDefinition(new Actions::FindImageDefinition(this));
+-#if QT_VERSION >= QT_VERSION_CHECK(5, 10, 0)
+-        addActionDefinition(new Actions::TextToSpeechDefinition(this));
+-#endif
+ 	}
+ 
+ 	QString id() const override							{ return QStringLiteral("system"); }
@@ -0,0 +1,62 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+
+  cmake,
+  pkg-config,
+
+  bluez,
+  libnotify,
+  opencv,
+  qt6,
+
+  # Running with TTS support causes the program to freeze for a few seconds every time at startup,
+  # so it is disabled by default
+  textToSpeechSupport ? false,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "actiona";
+  version = "3.11.1";
+
+  src = fetchFromGitHub {
+    owner = "Jmgr";
+    repo = "actiona";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-sJlzrrpmo2CbzChCtiyxqDtjoN58BN4Ptjm4sH83zAw=";
+    fetchSubmodules = true;
+  };
+
+  patches = lib.optionals (!textToSpeechSupport) [
+    # Removes TTS support
+    ./disable-tts.patch
+  ];
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    qt6.wrapQtAppsHook
+  ];
+
+  buildInputs = [
+    bluez
+    libnotify
+    opencv
+    qt6.qtbase
+    qt6.qtmultimedia
+    qt6.qttools
+    qt6.qt5compat
+  ] ++ lib.optionals textToSpeechSupport [ qt6.qtspeech ];
+
+  meta = {
+    description = "Cross-platform automation tool";
+    homepage = "https://github.com/Jmgr/actiona";
+    license = lib.licenses.gpl3Only;
+    mainProgram = "actiona";
+    maintainers = with lib.maintainers; [ tomasajt ];
+    platforms = lib.platforms.linux;
+  };
+})
@@ -5,39 +5,29 @@
  fetchPypi,
 }:

-let
-  tzdata = python3.pkgs.tzdata.overrideAttrs rec {
-    version = "2023.4";
-
-    src = fetchPypi {
-      pname = "tzdata";
-      inherit version;
-      hash = "sha256-3VTJTylHZVIsdzmWSbT+/ZVSJHmmZKDOyH9BvrxhSMk=";
-    };
-  };
-in
 python3.pkgs.buildPythonApplication rec {
  pname = "annextimelog";
-  version = "0.14.0";
+  version = "0.15.0";
  format = "pyproject";

  src = fetchFromGitLab {
    owner = "nobodyinperson";
    repo = "annextimelog";
    rev = "v${version}";
-    hash = "sha256-+3PkG33qKckagSVvVdqkypulO7uu5AMOv8fQiP8IUbs=";
+    hash = "sha256-RfqBtbfArFva3TVJGF4STx0QTio62qxXaM23lsLYLUg=";
  };

  pythonRelaxDeps = [ "rich" ];

-  nativeBuildInputs =
-    with python3.pkgs;
-    [
-      setuptools
-      wheel
-      poetry-core
-    ]
-    ++ [ tzdata ];
+  nativeBuildInputs = with python3.pkgs; [
+    unittestCheckHook
+    setuptools
+    wheel
+    poetry-core
+    tzdata
+  ];
+
+  unittestFlags = [ "-vb" ];

  propagatedBuildInputs = with python3.pkgs; [
    rich
@@ -13,14 +13,14 @@

 python3Packages.buildPythonApplication rec {
  pname = "ascii-draw";
-  version = "1.0.0";
+  version = "1.1.0";
  pyproject = false;

  src = fetchFromGitHub {
    owner = "Nokse22";
    repo = "ascii-draw";
    tag = "v${version}";
-    hash = "sha256-+K9th1LbESVzAiJqIplWpj2QHt7zDidENs7jHOuJ2S0=";
+    hash = "sha256-ed8RSS9anU5gstWTrJc2APx7PLmTzVVWXg8Sif8tySM=";
  };

  nativeBuildInputs = [
@@ -31,13 +31,13 @@

 python3Packages.buildPythonApplication rec {
  pname = "bottles-unwrapped";
-  version = "51.17";
+  version = "51.21";

  src = fetchFromGitHub {
    owner = "bottlesdevs";
    repo = "bottles";
    tag = version;
-    hash = "sha256-m4ATWpAZxIBp1X0cNeyNGmt6aIBo/cHH+DpOMkLia0E=";
+    hash = "sha256-rUS2LRr7NqTvNd706AC/U/QUDcF8tzwkHDuS3R0O1KY=";
  };

  patches =
@@ -45,7 +45,6 @@ python3Packages.buildPythonApplication rec {
      ./vulkan_icd.patch
      ./redirect-bugtracker.patch
      ./remove-flatpak-check.patch
-      ./remove-core-tab.patch
    ]
    ++ (
      if removeWarningPopup then
@@ -132,6 +131,7 @@ python3Packages.buildPythonApplication rec {
      psydvl
      shamilton
      Gliczy
+      XBagon
    ];
    platforms = lib.platforms.linux;
    mainProgram = "bottles";
@@ -1,76 +0,0 @@
-diff --git a/bottles/frontend/ui/preferences.blp b/bottles/frontend/ui/preferences.blp
-index 9dd12a16..c1fcf649 100644
--- a/bottles/frontend/ui/preferences.blp
-+++ b/bottles/frontend/ui/preferences.blp
-@@ -284,20 +284,6 @@ template $PreferencesWindow: Adw.PreferencesWindow {
-     }
-   }
- 
-  Adw.PreferencesPage pref_core {
-    icon-name: "application-x-addon-symbolic";
-    title: _("Core");
-    visible: false;
-
-    Adw.PreferencesGroup list_runtimes {
-      title: _("Runtime");
-    }
-
-    Adw.PreferencesGroup list_winebridge {
-      title: _("WineBridge");
-    }
-  }
-
-   Adw.PreferencesPage {
-     icon-name: "applications-science-symbolic";
-     title: _("Experiments");
-diff --git a/bottles/frontend/views/preferences.py b/bottles/frontend/views/preferences.py
-index ce7ec958..f46c6e5b 100644
--- a/bottles/frontend/views/preferences.py
-+++ b/bottles/frontend/views/preferences.py
-@@ -53,8 +53,6 @@ class PreferencesWindow(Adw.PreferencesWindow):
-     switch_steam_programs = Gtk.Template.Child()
-     switch_epic_games = Gtk.Template.Child()
-     switch_ubisoft_connect = Gtk.Template.Child()
-    list_winebridge = Gtk.Template.Child()
-    list_runtimes = Gtk.Template.Child()
-     list_runners = Gtk.Template.Child()
-     list_dxvk = Gtk.Template.Child()
-     list_vkd3d = Gtk.Template.Child()
-@@ -66,7 +64,6 @@ class PreferencesWindow(Adw.PreferencesWindow):
-     btn_bottles_path_reset = Gtk.Template.Child()
-     label_bottles_path = Gtk.Template.Child()
-     btn_steam_proton_doc = Gtk.Template.Child()
-    pref_core = Gtk.Template.Child()
- 
-     # endregion
- 
-@@ -170,10 +167,6 @@ class PreferencesWindow(Adw.PreferencesWindow):
-             self.installers_stack.set_visible_child_name("installers_offline")
-             self.dlls_stack.set_visible_child_name("dlls_offline")
- 
-        # populate components lists
-        self.populate_runtimes_list()
-        self.populate_winebridge_list()
-
-         RunAsync(self.ui_update)
- 
-         # connect signals
-@@ -319,18 +312,6 @@ class PreferencesWindow(Adw.PreferencesWindow):
-             list_component.add(_entry)
-             self.__registry.append(_entry)
- 
-    def populate_runtimes_list(self):
-        for runtime in self.manager.supported_runtimes.items():
-            self.list_runtimes.add(
-                ComponentEntry(self.window, runtime, "runtime", is_upgradable=True)
-            )
-
-    def populate_winebridge_list(self):
-        for bridge in self.manager.supported_winebridge.items():
-            self.list_winebridge.add(
-                ComponentEntry(self.window, bridge, "winebridge", is_upgradable=True)
-            )
-
-     def populate_dxvk_list(self):
-         self.__populate_component_list(
-             "dxvk", self.manager.supported_dxvk, self.list_dxvk
@@ -15,3 +15,80 @@ index 6ff7c011..c26ea0b9 100644
 bottles_sources = [
   '__init__.py',
   'main.py',
+diff --git a/bottles/frontend/views/bottle_details.py b/bottles/frontend/views/bottle_details.py
+index 65667ea9..7ae1eb19 100644
+--- a/bottles/frontend/views/bottle_details.py
+++ b/bottles/frontend/views/bottle_details.py
+@@ -436,20 +436,19 @@ class BottleView(Adw.PreferencesPage):
+             dialog.connect("response", execute)
+             dialog.show()
+ 
+-        if Xdp.Portal.running_under_sandbox():
+-            if self.window.settings.get_boolean("show-sandbox-warning"):
+-                dialog = Adw.MessageDialog.new(
+-                    self.window,
+-                    _("Be Aware of Sandbox"),
+-                    _(
+-                        "Bottles is running in a sandbox, a restricted permission environment needed to keep you safe. If the program won't run, consider moving inside the bottle (3 dots icon on the top), then launch from there."
+-                    ),
+-                )
+-                dialog.add_response("dismiss", _("_Dismiss"))
+-                dialog.connect("response", show_chooser)
+-                dialog.present()
+-            else:
+-                show_chooser()
+        if self.window.settings.get_boolean("show-sandbox-warning"):
+            dialog = Adw.MessageDialog.new(
+                self.window,
+                _("Be Aware of Sandbox"),
+                _(
+                    "Bottles is running in a sandbox, a restricted permission environment needed to keep you safe. If the program won't run, consider moving inside the bottle (3 dots icon on the top), then launch from there."
+                ),
+            )
+            dialog.add_response("dismiss", _("_Dismiss"))
+            dialog.connect("response", show_chooser)
+            dialog.present()
+        else:
+            show_chooser()
+ 
+     def __backup(self, widget, backup_type):
+         """
+diff --git a/bottles/frontend/views/bottle_preferences.py b/bottles/frontend/views/bottle_preferences.py
+index 288e693b..b8b57618 100644
+--- a/bottles/frontend/views/bottle_preferences.py
+++ b/bottles/frontend/views/bottle_preferences.py
+@@ -139,7 +139,7 @@ class PreferencesView(Adw.PreferencesPage):
+         self.queue = details.queue
+         self.details = details
+ 
+-        if not gamemode_available or not Xdp.Portal.running_under_sandbox():
+        if not gamemode_available:
+             return
+ 
+         _not_available = _("This feature is unavailable on your system.")
+diff --git a/bottles/frontend/views/list.py b/bottles/frontend/views/list.py
+index 43ab9c22..a283b178 100644
+--- a/bottles/frontend/views/list.py
+++ b/bottles/frontend/views/list.py
+@@ -82,8 +82,6 @@ class BottlesBottleRow(Adw.ActionRow):
+ 
+     def run_executable(self, *_args):
+         """Display file dialog for executable"""
+-        if not Xdp.Portal.running_under_sandbox():
+-            return
+ 
+         def set_path(_dialog, response):
+             if response != Gtk.ResponseType.ACCEPT:
+diff --git a/bottles/frontend/views/new_bottle_dialog.py b/bottles/frontend/views/new_bottle_dialog.py
+index a8b007d4..c6f0a156 100644
+--- a/bottles/frontend/views/new_bottle_dialog.py
+++ b/bottles/frontend/views/new_bottle_dialog.py
+@@ -80,7 +80,7 @@ class BottlesNewBottleDialog(Adw.Dialog):
+         super().__init__(**kwargs)
+         # common variables and references
+         self.window = GtkUtils.get_parent_window()
+-        if not self.window or not Xdp.Portal.running_under_sandbox():
+        if not self.window:
+             return
+ 
+         self.app = self.window.get_application()
@@ -1,7 +1,7 @@
-diff --git a/bottles/frontend/windows/main_window.py b/bottles/frontend/windows/main_window.py
+diff --git a/bottles/frontend/windows/window.py b/bottles/frontend/windows/window.py
 index 79bf0d72..e3a15cb5 100644
--- a/bottles/frontend/windows/main_window.py
-+++ b/bottles/frontend/windows/main_window.py
+--- a/bottles/frontend/windows/window.py
+++ b/bottles/frontend/windows/window.py
@@ -104,29 +104,29 @@ class MainWindow(Adw.ApplicationWindow):
 
             def response(dialog, response, *args):
@@ -0,0 +1,32 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}:
+
+buildGoModule rec {
+  pname = "cerca";
+  version = "0-unstable-2025-05-06";
+
+  src = fetchFromGitHub {
+    owner = "cblgh";
+    repo = "cerca";
+    rev = "a2706a35e3efc8b816b4374e24493548429041db";
+    hash = "sha256-FDlASFjI+D/iOH0r2Yd638aS0na19TxkN7Z1kD/o/fY";
+  };
+
+  vendorHash = "sha256-yfsI0nKfzyzmtbS9bSHRaD2pEgxN6gOKAA/FRDxJx40=";
+
+  ldflags = [
+    "-s"
+    "-w"
+  ];
+
+  meta = {
+    description = "Lean forum software";
+    homepage = "https://github.com/cblgh/cerca";
+    license = lib.licenses.agpl3Only;
+    maintainers = with lib.maintainers; [ dansbandit ];
+    mainProgram = "cerca";
+  };
+}
@@ -7,11 +7,8 @@
  cinny,
  desktop-file-utils,
  wrapGAppsHook3,
-  makeBinaryWrapper,
  pkg-config,
  openssl,
-  dbus,
-  glib,
  glib-networking,
  webkitgtk_4_0,
  jq,
@@ -64,31 +61,29 @@ rustPlatform.buildRustPackage rec {
        --set-key="Categories" --set-value="Network;InstantMessaging;" \
        $out/share/applications/cinny.desktop
    '';
-  postFixup = lib.optionalString stdenv.hostPlatform.isLinux ''
-    wrapProgram "$out/bin/cinny" \
-      --inherit-argv0 \
+
+  preFixup = ''
+    gappsWrapperArgs+=(
      --set-default WEBKIT_DISABLE_DMABUF_RENDERER "1"
+    )
  '';

-  nativeBuildInputs = [
-    wrapGAppsHook3
-    pkg-config
-    cargo-tauri_1.hook
-    desktop-file-utils
-    makeBinaryWrapper
-  ];
-
-  buildInputs =
+  nativeBuildInputs =
    [
-      openssl
+      cargo-tauri_1.hook
    ]
    ++ lib.optionals stdenv.hostPlatform.isLinux [
-      dbus
-      glib
-      glib-networking
-      webkitgtk_4_0
+      desktop-file-utils
+      pkg-config
+      wrapGAppsHook3
    ];

+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
+    glib-networking
+    openssl
+    webkitgtk_4_0
+  ];
+
  meta = {
    description = "Yet another matrix client for desktop";
    homepage = "https://github.com/cinnyapp/cinny-desktop";
@@ -8,8 +8,6 @@
  wrapGAppsHook3,
  v2ray-geoip,
  v2ray-domain-list-community,
-  copyDesktopItems,
-  makeDesktopItem,
  libsoup,
 }:
 let
@@ -31,7 +29,7 @@ let
  };

  service-cargo-hash = "sha256-lMOQznPlkHIMSm5nOLuGP9qJXt3CXnd+q8nCu+Xbbt8=";
-  npm-hash = "sha256-v9+1NjXo/1ogmep+4IP+9qoUR1GJz87VGeOoMzQ1Rfw=";
+  pnpm-hash = "sha256-v9+1NjXo/1ogmep+4IP+9qoUR1GJz87VGeOoMzQ1Rfw=";
  vendor-hash = "sha256-y3XVHi00mnuVFxSd02YBgfWuXYRVIs+e0tITXNOFRsA=";

  service = callPackage ./service.nix {
@@ -44,23 +42,13 @@ let
      ;
  };

-  webui = callPackage ./webui.nix {
-    inherit
-      version
-      src
-      pname
-      meta
-      npm-hash
-      ;
-  };
-
  unwrapped = callPackage ./unwrapped.nix {
    inherit
      pname
      version
      src
+      pnpm-hash
      vendor-hash
-      webui
      meta
      libsoup
      ;
@@ -92,20 +80,6 @@ stdenv.mkDerivation {

  nativeBuildInputs = [
    wrapGAppsHook3
-    copyDesktopItems
-  ];
-
-  desktopItems = [
-    (makeDesktopItem {
-      name = "clash-verge";
-      exec = "clash-verge";
-      comment = "Clash Verge Rev";
-      type = "Application";
-      icon = "clash-verge";
-      desktopName = "Clash Verge Rev";
-      terminal = false;
-      categories = [ "Network" ];
-    })
  ];

  installPhase = ''
@@ -121,6 +95,7 @@ stdenv.mkDerivation {
    ln -s ${v2ray-geoip}/share/v2ray/geoip.dat $out/lib/Clash\ Verge/resources/geoip.dat
    ln -s ${v2ray-domain-list-community}/share/v2ray/geosite.dat $out/lib/Clash\ Verge/resources/geosite.dat
    ln -s ${dbip-country-lite.mmdb} $out/lib/Clash\ Verge/resources/Country.mmdb
+
    runHook postInstall
  '';
 }
@@ -2,35 +2,53 @@
  pname,
  version,
  src,
-  libayatana-appindicator,
-  vendor-hash,
-  glib,
-  webui,
-  pkg-config,
-  libsoup,
-  rustPlatform,
-  makeDesktopItem,
-  libsForQt5,
-  kdePackages,
  meta,
-  webkitgtk_4_1,
-  openssl,
+
+  pnpm-hash,
+  vendor-hash,
+
+  rustPlatform,
+
+  cargo-tauri,
  jq,
+  moreutils,
+  nodejs,
+  pkg-config,
+  pnpm_9,
+
+  glib,
+  kdePackages,
+  libayatana-appindicator,
+  libsForQt5,
+  libsoup,
+  openssl,
+  webkitgtk_4_1,
 }:

 rustPlatform.buildRustPackage {
  inherit version src meta;
  pname = "${pname}-unwrapped";
-  sourceRoot = "${src.name}/src-tauri";
+
+  cargoRoot = "src-tauri";
+  buildAndTestSubdir = "src-tauri";

  useFetchCargoVendor = true;
  cargoHash = vendor-hash;

+  pnpmDeps = pnpm_9.fetchDeps {
+    inherit pname version src;
+    hash = pnpm-hash;
+  };
+
  env = {
    OPENSSL_NO_VENDOR = 1;
  };

  postPatch = ''
+    # We disable the option to try to use the bleeding-edge version of mihomo
+    # If you need a newer version, you can override the mihomo input of the wrapped package
+    sed -i -e '/Mihomo Alpha/d' ./src/components/setting/mods/clash-core-viewer.tsx
+
    substituteInPlace $cargoDepsCopy/libappindicator-sys-*/src/lib.rs \
      --replace-fail "libayatana-appindicator3.so.1" "${libayatana-appindicator}/lib/libayatana-appindicator3.so.1"

@@ -41,48 +59,38 @@ rustPlatform.buildRustPackage {
      --replace-fail '"kwriteconfig5"' '"${libsForQt5.kconfig}/bin/kwriteconfig5"' \
      --replace-fail '"kwriteconfig6"' '"${kdePackages.kconfig}/bin/kwriteconfig6"'

-    cat tauri.conf.json | jq 'del(.bundle.resources) | del(.bundle.externalBin) | .build.frontendDist = "${webui}" | .build.beforeBuildCommand = ""' > tauri.conf.json.2
-    mv tauri.conf.json.2 tauri.conf.json
-    cat tauri.linux.conf.json | jq 'del(.bundle.externalBin)' > tauri.linux.conf.json.2
-    mv tauri.linux.conf.json.2 tauri.linux.conf.json
-    chmod 777 ../.cargo
-    rm ../.cargo/config.toml
+    # this file tries to override the linker used when compiling for certain platforms
+    rm .cargo/config.toml
+
+    # disable updater and don't try to bundle helper binaries
+    jq '
+      .bundle.createUpdaterArtifacts = false |
+      del(.bundle.resources) |
+      del(.bundle.externalBin)
+    ' src-tauri/tauri.conf.json | sponge src-tauri/tauri.conf.json
+
+    jq 'del(.bundle.externalBin)' src-tauri/tauri.linux.conf.json | sponge src-tauri/tauri.linux.conf.json

    # As a side effect of patching the service to fix the arbitrary file overwrite issue,
    # we also need to update the timestamp format in the filename to the second level.
    # This ensures that the Clash kernel can still be restarted within one minute without problems.
-    substituteInPlace src/utils/dirs.rs \
+    substituteInPlace src-tauri/src/utils/dirs.rs \
      --replace-fail '%Y-%m-%d-%H%M' '%Y-%m-%d-%H%M%S'
  '';

  nativeBuildInputs = [
-    pkg-config
-    rustPlatform.cargoSetupHook
+    cargo-tauri.hook
    jq
+    moreutils
+    nodejs
+    pkg-config
+    pnpm_9.configHook
  ];

  buildInputs = [
-    openssl
+    libayatana-appindicator
    libsoup
+    openssl
    webkitgtk_4_1
  ];
-
-  postInstall = ''
-    install -DT icons/128x128@2x.png $out/share/icons/hicolor/128x128@2/apps/clash-verge.png
-    install -DT icons/128x128.png $out/share/icons/hicolor/128x128/apps/clash-verge.png
-    install -DT icons/32x32.png $out/share/icons/hicolor/32x32/apps/clash-verge.png
-  '';
-
-  desktopItems = [
-    (makeDesktopItem {
-      name = "clash-verge-rev";
-      exec = "clash-verge %u";
-      icon = "clash-verge-rev";
-      desktopName = "Clash Verge Rev";
-      genericName = meta.description;
-      mimeTypes = [ "x-scheme-handler/clash" ];
-      type = "Application";
-      terminal = false;
-    })
-  ];
 }
@@ -1,45 +0,0 @@
-{
-  version,
-  src,
-  pname,
-  pnpm_9,
-  nodejs,
-  stdenv,
-  meta,
-  npm-hash,
-}:
-stdenv.mkDerivation {
-  inherit version src meta;
-  pname = "${pname}-webui";
-  pnpmDeps = pnpm_9.fetchDeps {
-    inherit pname version src;
-    hash = npm-hash;
-  };
-
-  nativeBuildInputs = [
-    nodejs
-    pnpm_9.configHook
-  ];
-
-  postPatch = ''
-    chmod -R +644 -- ./src/components/setting/mods/clash-core-viewer.tsx
-    chmod -R +644 -- ./src/components/setting/mods
-    sed -i -e '/Mihomo Alpha/d' ./src/components/setting/mods/clash-core-viewer.tsx
-  '';
-
-  buildPhase = ''
-    runHook preBuild
-
-    node --max_old_space_size=1024000 ./node_modules/vite/bin/vite.js build
-
-    runHook postBuild
-  '';
-
-  installPhase = ''
-    runHook preInstall
-
-    cp -r dist $out
-
-    runHook postInstall
-  '';
-}
@@ -22,14 +22,14 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "curtail";
-  version = "1.12.0";
+  version = "1.13.0";
  format = "other";

  src = fetchFromGitHub {
    owner = "Huluti";
    repo = "Curtail";
    tag = version;
-    sha256 = "sha256-+TnGCLRJsdqdChqonHGuA4kUEiB9Mfc2aQttyt+uFnM=";
+    sha256 = "sha256-JfioWtd0jGTyaD5uELAqH6J+h04MOrfEqdR7GWgXyMw=";
  };

  nativeBuildInputs = [
@@ -2,6 +2,7 @@
  lib,
  stdenv,
  fetchFromGitHub,
+  fetchpatch2,
  cmake,
  fuse,
  zlib,
@@ -25,6 +26,15 @@ stdenv.mkDerivation {
    hash = "sha256-QM75GuFHl2gRlRw1BmTexUE1d9YNnhG0qmTqmE9kMX4=";
  };

+  patches = [
+    # Fix compilation
+    (fetchpatch2 {
+      name = "cmake-cxx-standard-17.patch";
+      url = "https://github.com/darlinghq/darling-dmg/pull/105/commits/b7c620f76a5f76748b3d14dd2a58e77f8b6ed0c0.patch";
+      hash = "sha256-i1lisEiwYm4IxgKmBYnjscvW6ObT7XGLVbjW2i5yXV4=";
+    })
+  ];
+
  nativeBuildInputs = [ cmake ];
  buildInputs = [
    fuse
@@ -6,11 +6,11 @@
 }:

 stdenv.mkDerivation rec {
-  version = "1.99.8";
+  version = "1.99.21";
  pname = "dd_rescue";

  src = fetchurl {
-    sha256 = "1gbxm8gr9sx5g1q9dycs21hkxikcy97q09lp1lvs59pnd9qpdnwh";
+    hash = "sha256-YB3gyUX/8dsFfIbGUWX5rvRuIa2q9E4LOCtEOz+z/bk=";
    url = "http://www.garloff.de/kurt/linux/ddrescue/${pname}-${version}.tar.bz2";
  };

@@ -44,5 +44,6 @@ stdenv.mkDerivation rec {
    platforms = platforms.linux;
    homepage = "http://www.garloff.de/kurt/linux/ddrescue/";
    license = licenses.gpl2Plus;
+    mainProgram = "dd_rescue";
  };
 }
@@ -0,0 +1,100 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  meson,
+  glib,
+  gjs,
+  ninja,
+  gtk4,
+  gsettings-desktop-schemas,
+  wrapGAppsHook4,
+  desktop-file-utils,
+  gobject-introspection,
+  glib-networking,
+  pkg-config,
+  libadwaita,
+  appstream,
+  blueprint-compiler,
+  gettext,
+  libportal-gtk4,
+  languagetool,
+  libsoup_3,
+  openjdk,
+  xdg-desktop-portal,
+  dbus,
+  nix-update-script,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "eloquent";
+  version = "1.2";
+
+  src = fetchFromGitHub {
+    owner = "sonnyp";
+    repo = "Eloquent";
+    tag = "v${finalAttrs.version}";
+    fetchSubmodules = true;
+    hash = "sha256-I4AQZl1zoZPhOwDR1uYNJTMRq5vQHPvyimC8OUAe+vY=";
+  };
+
+  nativeBuildInputs = [
+    appstream
+    blueprint-compiler
+    desktop-file-utils
+    gjs
+    gobject-introspection
+    libportal-gtk4
+    meson
+    ninja
+    pkg-config
+    wrapGAppsHook4
+  ];
+
+  buildInputs = [
+    dbus
+    gettext
+    gjs
+    glib
+    glib-networking
+    gsettings-desktop-schemas
+    gtk4
+    libadwaita
+    libportal-gtk4
+    libsoup_3
+    xdg-desktop-portal
+  ];
+
+  postPatch = ''
+    substituteInPlace troll/gjspack/bin/gjspack \
+      --replace-fail "/usr/bin/env -S gjs" "${gjs}/bin/gjs"
+
+    substituteInPlace src/languagetool.js \
+      --replace-fail "/app/LanguageTool/languagetool-server.jar" "${languagetool}/share/languagetool-server.jar" \
+      --replace-fail "--config" "" \
+      --replace-fail "/app/share/server.properties" ""
+
+    sed -i "1 a imports.package._findEffectiveEntryPointName = () => 're.sonny.Eloquent';" src/bin.js
+    patchShebangs .
+  '';
+
+  strictDeps = true;
+
+  preFixup = ''
+    gappsWrapperArgs+=(
+      --set JAVA_HOME ${openjdk}
+      --prefix PATH : ${openjdk}/bin
+    )
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Proofreading software for English, Spanish, French, German, and more than 20 other languages";
+    homepage = "https://github.com/sonnyp/eloquent";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ thtrf ];
+    mainProgram = "eloquent";
+    platforms = lib.platforms.linux;
+  };
+})
@@ -0,0 +1,79 @@
+{
+  lib,
+  stdenv,
+  buildGoModule,
+  fetchFromGitHub,
+  fetchNpmDeps,
+  npmHooks,
+  nodejs,
+  withUI ? true,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "exatorrent";
+  version = "1.3.0";
+
+  src = fetchFromGitHub {
+    owner = "varbhat";
+    repo = "exatorrent";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-FvL3ekpj1HwARgY3vj0xAwCgDBa97OqtFFY4rSBKr50=";
+  };
+
+  nativeBuildInputs = lib.optionals withUI [
+    npmHooks.npmConfigHook
+    nodejs
+  ];
+
+  npmRoot = "internal/web";
+
+  npmDeps =
+    if withUI then
+      fetchNpmDeps {
+        name = "${finalAttrs.pname}-${finalAttrs.version}-npm-deps";
+        inherit (finalAttrs) src;
+        sourceRoot = "${finalAttrs.src.name}/${finalAttrs.npmRoot}";
+        hash = "sha256-eNrBKTW4KlLNf/Y9NTvGt5r28MG7SLGzUi+p9mOyrmI=";
+      }
+    else
+      null;
+
+  preBuild = lib.optionalString withUI ''
+    pushd "$npmRoot"
+    npm run build
+    popd
+  '';
+
+  # I dislike the fact that buildGoModule's fetcher FOD automatically inherits some attrs from the non-FOD part
+  overrideModAttrs = prev: {
+    nativeBuildInputs = lib.filter (e: e != npmHooks.npmConfigHook) prev.nativeBuildInputs;
+    preBuild = "";
+  };
+
+  vendorHash = "sha256-fE+GVQ2HAfElO1UDmDMeu2ca7t5yNs83CXhqgT0t1Js=";
+
+  tags = lib.optionals (!withUI) [ "noui" ];
+
+  ldflags =
+    [
+      "-s"
+      "-w"
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isGnu [
+      # upstream also tries to compile statically if possible
+      "-extldflags '-static'"
+    ];
+
+  buildInputs = lib.optionals stdenv.hostPlatform.isGnu [
+    stdenv.cc.libc.static
+  ];
+
+  meta = {
+    changelog = "https://github.com/varbhat/exatorrent/releases/tag/${finalAttrs.src.tag}";
+    description = "Self-hostable, easy-to-use, lightweight, and feature-rich torrent client written in Go";
+    homepage = "https://github.com/varbhat/exatorrent/";
+    license = lib.licenses.gpl3Only;
+    mainProgram = "exatorrent";
+    maintainers = with lib.maintainers; [ tomasajt ];
+  };
+})
@@ -15,65 +15,39 @@
  webkitgtk_4_1,
  openssl,
 }:
+
 let
  pnpm = pnpm_10;
+in
+rustPlatform.buildRustPackage (finalAttrs: {
  pname = "fedistar";
  version = "1.11.3";
+
  src = fetchFromGitHub {
    owner = "h3poteto";
    repo = "fedistar";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
    hash = "sha256-Q2j6K4ys/z77+n3kdGJ15rWbFlbbIHBWB9hOARsgg2A=";
  };
-  fedistar-frontend = stdenvNoCC.mkDerivation (finalAttrs: {
-    pname = "fedistar-frontend";
-    inherit version src;
-    pnpmDeps = pnpm.fetchDeps {
-      inherit pname version src;
-      hash = "sha256-xXVsjAXmrsOp+mXrYAxSKz4vX5JApLZ+Rh6hrYlnJDI=";
-    };
-    nativeBuildInputs = [
-      pnpm.configHook
-      pnpm
-      nodejs
-    ];

-    buildPhase = ''
-      runHook preBuild
-      pnpm run build
-      runHook postBuild
-    '';
-
-    installPhase = ''
-      runHook preInstall
-      mkdir -p $out
-      cp -r out/* $out/
-      runHook postInstall
-    '';
-  });
-
-in
-rustPlatform.buildRustPackage {
-  inherit
-    pname
-    version
-    src
-    fedistar-frontend
-    ;
-  sourceRoot = "${src.name}/src-tauri";
+  cargoRoot = "src-tauri";
+  buildAndTestSubdir = "src-tauri";

  useFetchCargoVendor = true;
  cargoHash = "sha256-ZJgyrFDtzAH3XqDdnJ27Yn+WsTMrZR2+lnkZ6bw6hzg=";

-  postPatch = ''
-    substituteInPlace ./tauri.conf.json \
-      --replace-fail '"frontendDist": "../out",' '"frontendDist": "${fedistar-frontend}",' \
-      --replace-fail '"beforeBuildCommand": "pnpm build",' '"beforeBuildCommand": "",'
-  '';
+  pnpmDeps = pnpm.fetchDeps {
+    inherit (finalAttrs) pname version src;
+    hash = "sha256-xXVsjAXmrsOp+mXrYAxSKz4vX5JApLZ+Rh6hrYlnJDI=";
+  };

  nativeBuildInputs = [
    cargo-tauri.hook

+    pnpm.configHook
+    pnpm
+    nodejs
+
    pkg-config
    wrapGAppsHook4
  ];
@@ -107,6 +81,6 @@ rustPlatform.buildRustPackage {
    mainProgram = "fedistar";
    license = lib.licenses.gpl3Only;
    maintainers = with lib.maintainers; [ noodlez1232 ];
-    changelog = "https://github.com/h3poteto/fedistar/releases/tag/v${version}";
+    changelog = "https://github.com/h3poteto/fedistar/releases/tag/v${finalAttrs.version}";
  };
-}
+})
@@ -6,10 +6,10 @@

 let
  pname = "fflogs";
-  version = "8.17.1";
+  version = "8.17.13";
  src = fetchurl {
    url = "https://github.com/RPGLogs/Uploaders-fflogs/releases/download/v${version}/fflogs-v${version}.AppImage";
-    hash = "sha256-ky9MsRo6/wxNNHrAC8BcWkBBgJTtSmssKiU4cADW3kk=";
+    hash = "sha256-mCHycRks9HXWhHOA/LbhjPCRjEuyGklgBuvY7e+KXnc=";
  };
  extracted = appimageTools.extractType2 { inherit pname version src; };
 in
@@ -20,13 +20,13 @@

 stdenv.mkDerivation rec {
  pname = "foliate";
-  version = "3.2.1";
+  version = "3.3.0";

  src = fetchFromGitHub {
    owner = "johnfactotum";
    repo = "foliate";
    tag = version;
-    hash = "sha256-NU4lM+J5Tpd9Fl+eVbBy7WnCQ6LJ7oeWVkBxp6euTHU=";
+    hash = "sha256-QpWJDwatT4zOAPF+dn+Sm5xivk9SIZOvexj0M/Nyu24=";
    fetchSubmodules = true;
  };

@@ -16,17 +16,17 @@

 rustPlatform.buildRustPackage {
  pname = "forecast";
-  version = "0-unstable-2025-04-12";
+  version = "0-unstable-2025-05-15";

  src = fetchFromGitHub {
    owner = "cosmic-utils";
    repo = "forecast";
-    rev = "2dc599ff9a4417d511305d910367dd195aa1378a";
-    hash = "sha256-sD6aGpU1gET+0YPCD8wtxJWEJgWE/xYTWQAaIu2+e/8=";
+    rev = "7e10d602788c2da526c85cafdc5b167a8bfc2e2c";
+    hash = "sha256-HsnQll+xqLXA3vRjsiYKkXLKw+uZZoJsSOfms4+fQg0=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-mqZ2tIZzQWU39SMj8UBnScsGAg4xGhkcm51aXx3UBSk=";
+  cargoHash = "sha256-cLObhwMVnaj1HvMhCgSQOYN7IRPKcSeYuAfIy2V5Fns=";

  nativeBuildInputs = [
    libcosmicAppHook
@@ -44,6 +44,7 @@ stdenv.mkDerivation rec {
    meson
    ninja
    gettext
+    glib # for glib-genmarshal
    libxslt
    docbook-xsl-nons
    docbook_xml_dtd_43
@@ -87,6 +88,7 @@ stdenv.mkDerivation rec {
  # - https://github.com/NixOS/nixpkgs/issues/51121
  # - At least “gnome-keyring:gkm::xdg-store / xdg-trust” is still flaky on 48.beta.
  doCheck = false;
+  strictDeps = true;

  checkPhase = ''
    runHook postCheck
@@ -8,25 +8,19 @@

 buildGoModule rec {
  pname = "jfrog-cli";
-  version = "2.73.0";
+  version = "2.75.1";

  src = fetchFromGitHub {
    owner = "jfrog";
    repo = "jfrog-cli";
    tag = "v${version}";
-    hash = "sha256-GzxJAatMI7H4XaRgza8+nq4JtIlPN9H3WkdKr0PfXWM=";
+    hash = "sha256-2vJiT0gr+Ix91KeM+wlldDHkrWN4Zug7RmuxJ5XfSGQ=";
  };

  proxyVendor = true;
-  vendorHash = "sha256-tblmLEYHZt8manxuu5OpHeuAW18+0/kSvZIJmhEfQYQ=";
+  vendorHash = "sha256-1SLzXB9lw5U9xJtUqI5nSoeDEa2IT8FbRH11yEY8kS4=";

-  postPatch = ''
-    # Patch out broken test cleanup.
-    substituteInPlace artifactory_test.go \
-      --replace-fail \
-      'deleteReceivedReleaseBundle(t, "cli-tests", "2")' \
-      '// deleteReceivedReleaseBundle(t, "cli-tests", "2")'
-  '';
+  checkFlags = "-skip=^TestReleaseBundle";

  postInstall = ''
    # Name the output the same way as the original build script does
@@ -1,3 +1,5 @@
 source 'https://rubygems.org'

 gem 'ledger_web'
+
+gem "csv", "~> 3.3"
@@ -24,14 +24,15 @@ GEM
    benchmark (0.4.0)
    bigdecimal (3.1.9)
    concurrent-ruby (1.3.5)
-    connection_pool (2.5.0)
+    connection_pool (2.5.3)
+    csv (3.3.4)
    database_cleaner (2.1.0)
      database_cleaner-active_record (>= 2, < 3)
    database_cleaner-active_record (2.2.0)
      activerecord (>= 5.a)
      database_cleaner-core (~> 2.0.0)
    database_cleaner-core (2.0.1)
-    diff-lcs (1.6.0)
+    diff-lcs (1.6.1)
    directory_watcher (1.5.1)
    drb (2.2.1)
    i18n (1.14.7)
@@ -46,18 +47,18 @@ GEM
      sinatra
      sinatra-contrib
      sinatra-session
-    logger (1.6.6)
-    minitest (5.25.4)
+    logger (1.7.0)
+    minitest (5.25.5)
    multi_json (1.15.0)
    mustermann (3.0.3)
      ruby2_keywords (~> 0.0.1)
    pg (1.5.9)
-    rack (3.1.12)
+    rack (3.1.14)
    rack-protection (4.1.1)
      base64 (>= 0.1.0)
      logger (>= 1.6.0)
      rack (>= 3.0.0, < 4)
-    rack-session (2.1.0)
+    rack-session (2.1.1)
      base64 (>= 0.1.0)
      rack (>= 3.0.0)
    rspec (3.13.0)
@@ -66,16 +67,16 @@ GEM
      rspec-mocks (~> 3.13.0)
    rspec-core (3.13.3)
      rspec-support (~> 3.13.0)
-    rspec-expectations (3.13.3)
+    rspec-expectations (3.13.4)
      diff-lcs (>= 1.2.0, < 2.0)
      rspec-support (~> 3.13.0)
-    rspec-mocks (3.13.2)
+    rspec-mocks (3.13.4)
      diff-lcs (>= 1.2.0, < 2.0)
      rspec-support (~> 3.13.0)
-    rspec-support (3.13.2)
+    rspec-support (3.13.3)
    ruby2_keywords (0.0.5)
    securerandom (0.4.1)
-    sequel (5.90.0)
+    sequel (5.92.0)
      bigdecimal
    sinatra (4.1.1)
      logger (>= 1.6.0)
@@ -102,7 +103,8 @@ PLATFORMS
  ruby

 DEPENDENCIES
+  csv (~> 3.3)
  ledger_web

 BUNDLED WITH
-   2.6.2
+   2.6.6
@@ -94,10 +94,20 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1z7bag6zb2vwi7wp2bkdkmk7swkj6zfnbsnc949qq0wfsgw94fr3";
+      sha256 = "0nrhsk7b3sjqbyl1cah6ibf1kvi3v93a7wf4637d355hp614mmyg";
      type = "gem";
    };
-    version = "2.5.0";
+    version = "2.5.3";
+  };
+  csv = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1kfqg0m6vqs6c67296f10cr07im5mffj90k2b5dsm51liidcsvp9";
+      type = "gem";
+    };
+    version = "3.3.4";
  };
  database_cleaner = {
    dependencies = [ "database_cleaner-active_record" ];
@@ -139,10 +149,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0bnss89lcm3b1k3xcjd35grxqz5q040d12imd73qybwnfarggrx1";
+      sha256 = "1m3cv0ynmxq93axp6kiby9wihpsdj42y6s3j8bsf5a1p7qzsi98j";
      type = "gem";
    };
-    version = "1.6.0";
+    version = "1.6.1";
  };
  directory_watcher = {
    groups = [ "default" ];
@@ -201,20 +211,20 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "05s008w9vy7is3njblmavrbdzyrwwc1fsziffdr58w9pwqj8sqfx";
+      sha256 = "00q2zznygpbls8asz5knjvvj2brr3ghmqxgr83xnrdj4rk3xwvhr";
      type = "gem";
    };
-    version = "1.6.6";
+    version = "1.7.0";
  };
  minitest = {
    groups = [ "default" ];
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0izrg03wn2yj3gd76ck7ifbm9h2kgy8kpg4fk06ckpy4bbicmwlw";
+      sha256 = "0mn7q9yzrwinvfvkyjiz548a4rmcwbmz2fn9nyzh4j1snin6q6rr";
      type = "gem";
    };
-    version = "5.25.4";
+    version = "5.25.5";
  };
  multi_json = {
    groups = [ "default" ];
@@ -252,10 +262,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0h65a1f9gsqx2ryisdy4lrd9a9l8gdv65dcscw9ynwwjr1ak1n00";
+      sha256 = "0i2bjh42cmlkwxjrldqj8g5sfrasdp64xhfr25kvp4ziilm3qqc4";
      type = "gem";
    };
-    version = "3.1.12";
+    version = "3.1.14";
  };
  rack-protection = {
    dependencies = [
@@ -281,10 +291,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1452c1bhh6fdnv17s1z65ajwh08axqnlmkhnr1qyyn2vacb3jz23";
+      sha256 = "1sg4laz2qmllxh1c5sqlj9n1r7scdn08p3m4b0zmhjvyx9yw0v8b";
      type = "gem";
    };
-    version = "2.1.0";
+    version = "2.1.1";
  };
  rspec = {
    dependencies = [
@@ -321,10 +331,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0n3cyrhsa75x5wwvskrrqk56jbjgdi2q1zx0irllf0chkgsmlsqf";
+      sha256 = "1n7cb6szws90hxbzqrfybs4rj1xb0vhn24xa4l5r1vnzcnblahsf";
      type = "gem";
    };
-    version = "3.13.3";
+    version = "3.13.4";
  };
  rspec-mocks = {
    dependencies = [
@@ -335,20 +345,20 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1vxxkb2sf2b36d8ca2nq84kjf85fz4x7wqcvb8r6a5hfxxfk69r3";
+      sha256 = "14xr5bq7s80hm97fcp3pvk4v515qfw3lrlsf20idalwwf6h5icbb";
      type = "gem";
    };
-    version = "3.13.2";
+    version = "3.13.4";
  };
  rspec-support = {
    groups = [ "default" ];
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1v6v6xvxcpkrrsrv7v1xgf7sl0d71vcfz1cnrjflpf6r7x3a58yf";
+      sha256 = "0hrzdcklbl8pv721cq906yfl38fmqmlnh33ff8l752z1ys9y6q9a";
      type = "gem";
    };
-    version = "3.13.2";
+    version = "3.13.3";
  };
  ruby2_keywords = {
    groups = [ "default" ];
@@ -376,10 +386,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1s5qhylirrmfbjhdjdfqaiksjlaqmgixl25sxd8znq8dqwqlrydz";
+      sha256 = "0ga49hliy5alb1x42mvpkmasqv71rhm4081zv5gpwr5q8lcsc1nb";
      type = "gem";
    };
-    version = "5.90.0";
+    version = "5.92.0";
  };
  sinatra = {
    dependencies = [
@@ -0,0 +1,23 @@
+diff --git a/plugin/httpgetter/html_meta_test.go b/plugin/httpgetter/html_meta_test.go
+index d0b0d903..d1668db1 100644
+--- a/plugin/httpgetter/html_meta_test.go
+++ b/plugin/httpgetter/html_meta_test.go
+@@ -2,7 +2,6 @@ package httpgetter
+ 
+ import (
+ 	"errors"
+-	"strings"
+ 	"testing"
+ 
+ 	"github.com/stretchr/testify/require"
+@@ -30,10 +29,4 @@ func TestGetHTMLMetaForInternal(t *testing.T) {
+ 	if _, err := GetHTMLMeta("http://localhost"); !errors.Is(err, ErrInternalIP) {
+ 		t.Errorf("Expected error for resolved internal IP, got %v", err)
+ 	}
+-
+-	// test for redirected internal IP
+-	// 49.232.126.226:1110 will redirects to 127.0.0.1
+-	if _, err := GetHTMLMeta("http://49.232.126.226:1110"); !(errors.Is(err, ErrInternalIP) && strings.Contains(err.Error(), "redirect")) {
+-		t.Errorf("Expected error for redirected internal IP, got %v", err)
+-	}
+ }
@@ -0,0 +1,122 @@
+{
+  fetchFromGitHub,
+  buildGoModule,
+  stdenvNoCC,
+  nix-update-script,
+  nodejs,
+  lib,
+  pnpm,
+  buf,
+  cacert,
+  grpc-gateway,
+  protoc-gen-go,
+  protoc-gen-go-grpc,
+  protoc-gen-validate,
+}:
+let
+  version = "0.24.2";
+  src = fetchFromGitHub {
+    owner = "usememos";
+    repo = "memos";
+    rev = "v${version}";
+    hash = "sha256-DWOJ6+lUTbOzMLsfTDNZfhgNomajNCnNi7U1A+tqXm4=";
+  };
+
+  protobufsGenerated = stdenvNoCC.mkDerivation {
+    name = "memos-protobuf-gen";
+    inherit src;
+
+    nativeBuildInputs = [
+      buf
+      cacert
+      grpc-gateway
+      protoc-gen-go
+      protoc-gen-go-grpc
+      protoc-gen-validate
+    ];
+
+    buildPhase = ''
+      runHook preBuild
+      pushd proto
+      HOME=$TMPDIR buf generate
+      popd
+      runHook postBuild
+    '';
+    installPhase = ''
+      runHook preInstall
+      mkdir -p $out/{proto,web/src/types}
+      cp -r {.,$out}/proto/gen
+      cp -r {.,$out}/web/src/types/proto
+      runHook postInstall
+    '';
+
+    outputHashMode = "recursive";
+    outputHashAlgo = "sha256";
+    outputHash = "sha256-u+Wq/fXvWTjXdhC2h6RCsn7pjdFJ+gUdTPRvrn9cZ+k=";
+  };
+
+  frontend = stdenvNoCC.mkDerivation (finalAttrs: {
+    pname = "memos-web";
+    inherit version src;
+    pnpmDeps = pnpm.fetchDeps {
+      inherit (finalAttrs) pname version src;
+      sourceRoot = "${finalAttrs.src.name}/web";
+      hash = "sha256-lopCa7F/foZ42cAwCxE+TWAnglTZg8jY8eRWmeck/W8=";
+    };
+    pnpmRoot = "web";
+    nativeBuildInputs = [
+      nodejs
+      pnpm.configHook
+    ];
+    preBuild = ''
+      cp -r {${protobufsGenerated},.}/web/src/types/proto
+    '';
+    buildPhase = ''
+      runHook preBuild
+      pnpm -C web build
+      runHook postBuild
+    '';
+    installPhase = ''
+      runHook preInstall
+      cp -r web/dist $out
+      runHook postInstall
+    '';
+  });
+in
+buildGoModule {
+  pname = "memos";
+  inherit version src;
+
+  vendorHash = "sha256-hdL4N0tg/lYGTeiKl9P2QsV8HTxlvHfsSqsqq/C0cg8=";
+
+  preBuild = ''
+    rm -rf server/router/frontend/dist
+    cp -r ${frontend} server/router/frontend/dist
+    cp -r {${protobufsGenerated},.}/proto/gen
+  '';
+
+  patches = [
+    # to be removed in next release (test was removed upstream as part of a bigger commit)
+    ./nixbuild-check.patch
+  ];
+
+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--subpackage"
+      "memos-web"
+      "--subpackage"
+      "memos-protobuf-gen"
+    ];
+  };
+
+  meta = {
+    homepage = "https://usememos.com";
+    description = "Lightweight, self-hosted memo hub";
+    maintainers = with lib.maintainers; [
+      indexyz
+      kuflierl
+    ];
+    license = lib.licenses.mit;
+    mainProgram = "memos";
+  };
+}
@@ -6,18 +6,18 @@

 rustPlatform.buildRustPackage rec {
  pname = "mitra";
-  version = "4.1.1";
+  version = "4.2.1";

  src = fetchFromGitea {
    domain = "codeberg.org";
    owner = "silverpill";
    repo = "mitra";
    rev = "v${version}";
-    hash = "sha256-GKatTwdgBhhYtnKm+UNTJpcspG5pQBqHA616ELGGucg=";
+    hash = "sha256-rT29QByrg/rn13Hj4UTzwA22xLsQhNESQPM0lb/dsf8=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-E6Sdu5QmALroJ6QLLy7QZOjieGut41lcoHwHuZftXvs=";
+  cargoHash = "sha256-whAUofVJgqhwasOaYNmrWcZVyg0YpvNemt7/LJHxgCs=";

  # require running database
  doCheck = false;
@@ -8,13 +8,13 @@

 stdenv.mkDerivation {
  pname = "ogdf";
-  version = "2022.02";
+  version = "2023.09";

  src = fetchFromGitHub {
    owner = "ogdf";
    repo = "ogdf";
-    rev = "dogwood-202202";
-    sha256 = "sha256-zkQ6sS0EUmiigv3T7To+tG3XbFbR3XEbFo15oQ0bWf0=";
+    tag = "elderberry-202309";
+    hash = "sha256-vnhPuMhz+pE4ExhRhjwHy4OilIkJ/kXc2LWU+9auY9k=";
  };

  nativeBuildInputs = [
@@ -28,12 +28,12 @@ stdenv.mkDerivation {
    "-DOGDF_WARNING_ERRORS=OFF"
  ];

-  meta = with lib; {
+  meta = {
    description = "Open Graph Drawing Framework/Open Graph algorithms and Data structure Framework";
    homepage = "http://www.ogdf.net";
-    license = licenses.gpl2;
-    maintainers = [ maintainers.ianwookim ];
-    platforms = platforms.all;
+    license = lib.licenses.gpl2;
+    maintainers = [ lib.maintainers.ianwookim ];
+    platforms = lib.platforms.all;
    longDescription = ''
      OGDF stands both for Open Graph Drawing Framework (the original name) and
      Open Graph algorithms and Data structures Framework.
@@ -0,0 +1,50 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  autoreconfHook,
+  pkg-config,
+  help2man,
+  gengetopt,
+  openssl,
+  nix-update-script,
+}:
+stdenv.mkDerivation rec {
+  pname = "openpace";
+  version = "1.1.3";
+
+  src = fetchFromGitHub {
+    owner = "frankmorgner";
+    repo = "openpace";
+    tag = version;
+    hash = "sha256-KsgCTHvbqxNOcf9HWgXGxagpIjHEcQ5Kryjq71F8XRk=";
+  };
+
+  nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
+    help2man
+    gengetopt
+  ];
+
+  buildInputs = [ openssl ];
+
+  preConfigure = ''
+    autoreconf --verbose --install
+  '';
+
+  preFixup = ''
+    rm $out/bin/example
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Cryptographic library for EAC version 2";
+    homepage = "https://github.com/frankmorgner/openpace";
+    license = lib.licenses.gpl3Plus;
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [ vaavaav ];
+    broken = !stdenv.buildPlatform.canExecute stdenv.hostPlatform; # help2man
+  };
+}
@@ -13,14 +13,14 @@

 python3Packages.buildPythonApplication rec {
  pname = "plattenalbum";
-  version = "2.2.2";
+  version = "2.3.0";
  pyproject = false;

  src = fetchFromGitHub {
    owner = "SoongNoonien";
    repo = "plattenalbum";
    tag = "v${version}";
-    hash = "sha256-IuyEy6w1JxuuA+domZ+XNIq5vmcOVs0sHO4dp1dyE6k=";
+    hash = "sha256-5/4t7tnMGuy5TIIdGN5hm0I0O0oC3FC503PNpnUHkV8=";
  };

  nativeBuildInputs = [
@@ -2,30 +2,32 @@
  lib,
  stdenv,
  fetchgit,
+
  ant,
  jdk,
-  stripJavaArchivesHook,
  makeWrapper,
-  jre,
+  stripJavaArchivesHook,
+
  coreutils,
+  jre,
  which,
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "projectlibre";
-  version = "1.9.3";
+  version = "1.9.8";

  src = fetchgit {
    url = "https://git.code.sf.net/p/projectlibre/code";
-    rev = "20814e88dc83694f9fc6780c2550ca5c8a87aa16"; # version 1.9.3 was not tagged
-    hash = "sha256-yXgYyy3jWxYMXKsNCRWdO78gYRmjKpO9U5WWU6PtwMU=";
+    rev = "0530be227f4a10c5545cce8d3db20ac5a4d76a66"; # version 1.9.8 was not tagged
+    hash = "sha256-eGoPtHy1XfPLnJXNDOMcek4spNKkNyZdby0IsZFZfME=";
  };

  nativeBuildInputs = [
    ant
    jdk
-    stripJavaArchivesHook
    makeWrapper
+    stripJavaArchivesHook
  ];

  runtimeDeps = [
@@ -34,8 +36,6 @@ stdenv.mkDerivation (finalAttrs: {
    which
  ];

-  env.JAVA_TOOL_OPTIONS = "-Dfile.encoding=UTF8";
-
  buildPhase = ''
    runHook preBuild
    ant -f projectlibre_build/build.xml
@@ -57,10 +57,10 @@ stdenv.mkDerivation (finalAttrs: {
    popd

    substituteInPlace $out/bin/projectlibre \
-        --replace-fail "/usr/share/projectlibre" "$out/share/projectlibre"
+      --replace-fail "/usr/share/projectlibre" "$out/share/projectlibre"

    wrapProgram $out/bin/projectlibre \
-        --prefix PATH : ${lib.makeBinPath finalAttrs.runtimeDeps}
+      --prefix PATH : ${lib.makeBinPath finalAttrs.runtimeDeps}

    runHook postInstall
  '';
@@ -1,21 +1,9 @@
-commit 070bf216bacf6ce1b473f2819a017d1be29716d0
+commit 58bdfa7ef92ba07dc41a07aeef6d790ecd8f888c
 Author: kuflierl <41301536+kuflierl@users.noreply.github.com>
-Date:   Sun Apr 13 19:56:58 2025 +0200
+Date:   Sat May 3 21:02:26 2025 +0200

-    add support for nix-build-system for tests
+    fix(tests): add support for nix-build-system for tests

-diff --git a/Cargo.toml b/Cargo.toml
-index eba0ef8..9153f00 100644
--- a/Cargo.toml
-+++ b/Cargo.toml
-@@ -58,6 +58,7 @@ default = []
- as-root = [] # for tests only
- gen-man-pages = ["dep:clap_mangen"]
- nightly = [] # for benchmarks only
-+nix-build-env = [] # perform checks in a way compatable with nix build
- 
- [lints.rust]
- # https://doc.rust-lang.org/rustc/lints/listing/allowed-by-default.html
 diff --git a/src/systemd/resolver.rs b/src/systemd/resolver.rs
 index e2abbb7..1151592 100644
 --- a/src/systemd/resolver.rs
@@ -44,7 +32,7 @@ index e2abbb7..1151592 100644
         let actions = vec![ProgramAction::Read("/var/data".into())];
         let candidates = resolve(&opts, &actions, &hardening_opts);
 diff --git a/tests/options.rs b/tests/options.rs
-index 835ee14..cac55e5 100644
+index 835ee14..a9c9973 100644
 --- a/tests/options.rs
 +++ b/tests/options.rs
@@ -24,7 +24,7 @@ fn run_true() {
@@ -116,7 +104,7 @@ index 835ee14..cac55e5 100644
             BoxPredicate::new(predicate::str::contains("ProtectHome=true\n").count(1))
         } else {
             BoxPredicate::new(predicate::str::contains("ProtectHome=").not())
-@@ -227,11 +227,12 @@ fn run_read_kallsyms() {
+@@ -227,7 +227,7 @@ fn run_read_kallsyms() {
         .stdout(predicate::str::contains("LockPersonality=true\n").count(1))
         .stdout(predicate::str::contains("RestrictRealtime=true\n").count(1))
         .stdout(predicate::str::contains("ProtectClock=true\n").count(1))
@@ -125,30 +113,7 @@ index 835ee14..cac55e5 100644
         .stdout(predicate::str::contains("CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_BPF CAP_CHOWN CAP_MKNOD CAP_NET_RAW CAP_PERFMON CAP_SYS_BOOT CAP_SYS_CHROOT CAP_SYS_MODULE CAP_SYS_NICE CAP_SYS_PACCT CAP_SYS_PTRACE CAP_SYS_TIME CAP_SYS_TTY_CONFIG CAP_SYSLOG CAP_WAKE_ALARM\n").count(1));
 }
 
- #[test]
-+#[cfg_attr(feature = "nix-build-env", ignore)]
- fn run_ls_modules() {
-     Command::cargo_bin("shh")
-         .unwrap()
-@@ -240,7 +241,7 @@ fn run_ls_modules() {
-         .assert()
-         .success()
-         .stdout(predicate::str::contains("ProtectSystem=strict\n").count(1))
-        .stdout(if Uid::effective().is_root() {
-+        .stdout(if Uid::effective().is_root() || !env::current_exe().unwrap().starts_with("/home") {
-             BoxPredicate::new(predicate::str::contains("ProtectHome=true\n").count(1))
-         } else {
-             BoxPredicate::new(predicate::str::contains("ProtectHome=").not())
-@@ -304,7 +305,7 @@ fn run_dmesg() {
- }
- 
- #[test]
-#[cfg_attr(feature = "as-root", ignore)]
-+#[cfg_attr(any(feature = "nix-build-env", feature = "as-root"), ignore)]
- fn run_systemctl() {
-     assert!(!Uid::effective().is_root());
- 
-@@ -344,6 +345,7 @@ fn run_systemctl() {
+@@ -344,6 +344,7 @@ fn run_systemctl() {
         .stdout(predicate::str::contains("CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_BPF CAP_CHOWN CAP_MKNOD CAP_NET_RAW CAP_PERFMON CAP_SYS_BOOT CAP_SYS_CHROOT CAP_SYS_MODULE CAP_SYS_NICE CAP_SYS_PACCT CAP_SYS_PTRACE CAP_SYS_TIME CAP_SYS_TTY_CONFIG CAP_SYSLOG CAP_WAKE_ALARM\n").count(1));
 }
 
@@ -156,7 +121,7 @@ index 835ee14..cac55e5 100644
 #[test]
 fn run_ss() {
     Command::cargo_bin("shh")
-@@ -353,7 +355,7 @@ fn run_ss() {
+@@ -353,7 +354,7 @@ fn run_ss() {
         .assert()
         .success()
         .stdout(predicate::str::contains("ProtectSystem=strict\n").count(1))
@@ -165,7 +130,7 @@ index 835ee14..cac55e5 100644
             BoxPredicate::new(predicate::str::contains("ProtectHome=true\n").count(1))
         } else {
             BoxPredicate::new(predicate::str::contains("ProtectHome=").not())
-@@ -369,7 +371,7 @@ fn run_ss() {
+@@ -369,7 +370,7 @@ fn run_ss() {
         .stdout(predicate::str::contains("ProtectKernelModules=true\n").count(1))
         .stdout(predicate::str::contains("ProtectKernelLogs=true\n").count(1))
         .stdout(predicate::str::contains("ProtectControlGroups=true\n").count(1))
@@ -174,7 +139,7 @@ index 835ee14..cac55e5 100644
         .stdout(predicate::str::contains("MemoryDenyWriteExecute=true\n").count(1))
         .stdout(predicate::str::contains("RestrictAddressFamilies=AF_NETLINK AF_UNIX\n").count(1).or(predicate::str::contains("RestrictAddressFamilies=AF_NETLINK\n").count(1)))
         .stdout(predicate::str::contains("SocketBindDeny=ipv4:tcp\n").count(1))
-@@ -379,7 +381,7 @@ fn run_ss() {
+@@ -379,7 +380,7 @@ fn run_ss() {
         .stdout(predicate::str::contains("LockPersonality=true\n").count(1))
         .stdout(predicate::str::contains("RestrictRealtime=true\n").count(1))
         .stdout(predicate::str::contains("ProtectClock=true\n").count(1))
@@ -183,19 +148,3 @@ index 835ee14..cac55e5 100644
         .stdout(predicate::str::contains("CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_BPF CAP_CHOWN CAP_MKNOD CAP_NET_RAW CAP_PERFMON CAP_SYS_BOOT CAP_SYS_CHROOT CAP_SYS_MODULE CAP_SYS_NICE CAP_SYS_PACCT CAP_SYS_PTRACE CAP_SYS_TIME CAP_SYS_TTY_CONFIG CAP_SYSLOG CAP_WAKE_ALARM\n").count(1));
 }
 
-@@ -741,6 +743,7 @@ fn run_mknod() {
- }
- 
- #[test]
-+#[cfg_attr(feature = "nix-build-env", ignore)] // no raw socket cap in nix build
- fn run_ping_4() {
-     Command::cargo_bin("shh")
-         .unwrap()
-@@ -759,6 +762,7 @@ fn run_ping_4() {
- }
- 
- #[test]
-+#[cfg_attr(feature = "nix-build-env", ignore)] // no raw socket cap in nix build
- fn run_ping_6() {
-     Command::cargo_bin("shh")
-         .unwrap()
@@ -2,12 +2,21 @@
  lib,
  rustPlatform,
  fetchFromGitHub,
+  nix-update-script,
+  fetchpatch,
+  installShellFiles,
  python3,
  strace,
  systemd,
  iproute2,
+  stdenv,
+  enableDocumentationFeature ? true,
+  enableDocumentationGeneration ? true,
 }:
-
+let
+  isNativeDocgen =
+    (stdenv.buildPlatform.canExecute stdenv.hostPlatform) && enableDocumentationFeature;
+in
 rustPlatform.buildRustPackage rec {
  pname = "shh";
  version = "2025.4.12";
@@ -19,36 +28,101 @@ rustPlatform.buildRustPackage rec {
    hash = "sha256-+JWz0ya6gi8pPERnpAcQIe7zZUzWGxha+9/gizMVtEw=";
  };

-  cargoHash = "sha256-TdP+1sb1GEFM57z+rc+gqhoWQhPAXzvMt/FCWf3wpr8=";
+  cargoHash = "sha256-rrOH76LHYSEeuNiMIICpAO7U/sz5V0JRO22mbIICQWw=";
+
+  # needs to be done this way to bypass patch conflicts
+  cargoPatches = [
+    (fetchpatch {
+      # to be removed after next release
+      name = "refactor-man-page-generation-command.patch";
+      url = "https://github.com/desbma/shh/commit/849b9a6646981c83a72a977b6398371e29d3b928.patch";
+      hash = "sha256-LZlUFfPtt2ScTxQbQ9j3Kzvp7T4MCFs92cJiI3YbWns=";
+    })
+    (fetchpatch {
+      # to be removed after next release
+      name = "support-shell-auto-complete.patch";
+      url = "https://github.com/desbma/shh/commit/74914dc8cfd74dbd7e051a090cc4c1f561b8cdde.patch";
+      hash = "sha256-WgKRQAEwSpXdQUnrZC1Bp4RfKg2J9kPkT1k6R2wwgT8=";
+    })
+  ];

  patches = [
    ./fix_run_checks.patch
-    ./pr13-profile-path-fix-strace.patch
+    (fetchpatch {
+      # to be removed after next release
+      name = "feat-static-strace-path-support-at-compile-time.patch";
+      url = "https://github.com/desbma/shh/commit/da62ceeb227de853be06610721744667c6fe994b.patch";
+      hash = "sha256-p/W7HRZZ4TpIwrWN8wQB/SH3C8x3ZLXzwGV50oK/znQ=";
+    })
  ];

-  # buildFeatures = [ /*"gen-man-pages"*/ ];
+  env = {
+    SHH_STRACE_BIN_PATH = lib.getExe strace;
+  };

-  checkFeatures = [ "nix-build-env" ];
+  buildFeatures = lib.optional enableDocumentationFeature "generate-extra";
+
+  checkFlags = [
+    # no access to system modules in build env
+    "--skip=run_ls_modules"
+    # missing systemd daemon in build env
+    "--skip=run_systemctl"
+    # no raw socket cap in nix build
+    "--skip=run_ping_4"
+    "--skip=run_ping_6"
+  ];

  buildInputs = [
    strace
    systemd
  ];

-  nativeCheckInputs = [
-    strace
+  nativeBuildInputs = [
+    installShellFiles
    systemd
+    strace
+  ];
+
+  nativeCheckInputs = [
    python3
    iproute2
  ];

+  # todo elvish
+  postInstall = lib.optionalString enableDocumentationGeneration ''
+    mkdir -p target/{mangen,shellcomplete}
+
+    ${
+      if isNativeDocgen then
+        ''
+          $out/bin/shh gen-man-pages target/mangen
+          $out/bin/shh gen-shell-complete target/shellcomplete
+        ''
+      else
+        ''
+          unset SHH_STRACE_BIN_PATH
+          cargo run --features generate-extra -- gen-man-pages target/mangen
+          cargo run --features generate-extra -- gen-shell-complete target/shellcomplete
+        ''
+    }
+
+    installManPage target/mangen/*
+
+    installShellCompletion --cmd ${pname} \
+      target/shellcomplete/${pname}.{bash,fish} \
+      --zsh target/shellcomplete/_${pname}
+  '';
+
  # RUST_BACKTRACE = 1;

+  passthru.updateScript = nix-update-script { };
+
  meta = {
    description = "Automatic systemd service hardening guided by strace profiling";
    homepage = "https://github.com/desbma/shh";
    license = lib.licenses.gpl3Only;
    platforms = lib.platforms.linux;
+    changelog = "https://github.com/desbma/shh/blob/v${version}/CHANGELOG.md";
    mainProgram = "shh";
    maintainers = with lib.maintainers; [
      erdnaxe
@@ -1,83 +0,0 @@
-commit 4d2c1556d769695770c95a982e0dcda4d70eee57
-Author: kuflierl <41301536+kuflierl@users.noreply.github.com>
-Date:   Sun Apr 13 19:57:50 2025 +0200
-
-    service.rs: profile path fix for strace
-    Enable path env fixing when path env doesn't have strace to unbreak tool on unique systems and units.
-    This fixes handling on non FHS operating systems and systemd units that define their own PATH that doesn't include strace.
-
-diff --git a/src/systemd/service.rs b/src/systemd/service.rs
-index 908fdf0..e9294cf 100644
--- a/src/systemd/service.rs
-+++ b/src/systemd/service.rs
-@@ -7,6 +7,7 @@ use std::{
-     ops::RangeInclusive,
-     path::{Path, PathBuf},
-     process::{Command, Stdio},
-+    ffi::OsString,
- };
- 
- use anyhow::Context as _;
-@@ -99,6 +100,41 @@ impl Service {
-         )
-     }
- 
-+    // A function for locating the parent directory i.e. PATH of an executable
-+    fn resolve_exec_path<P>(exe_name: &P, path_env: OsString) -> Option<PathBuf>
-+    where P: AsRef<Path> + ?Sized,
-+    {
-+        env::split_paths(&path_env).filter_map(|dir| {
-+            let full_path = dir.join(&exe_name);
-+            if full_path.is_file() {
-+                Some(dir)
-+            } else {
-+                None
-+            }
-+        }).next()
-+    }
-+
-+    // determine PATH env used for unit
-+    pub(crate) fn get_exec_path(config_paths: &Vec<&Path>) -> anyhow::Result<String> {
-+        let old_path_env_option = Self::config_vals("Environment", &config_paths)?
-+        .into_iter().filter(|x| x.starts_with("\"PATH=")).last().map(|x| x.trim_matches('\"').get(5..).unwrap().to_owned());
-+        Ok(match old_path_env_option {
-+            Some(path_env) => {
-+                log::info!("Found hard coded PATH environment in unit: {path_env}");
-+                path_env
-+            },
-+            None => {
-+                let output = Command::new("systemd-path").arg("search-binaries-default").output()?;
-+                if !output.status.success() {
-+                    anyhow::bail!("systemd-path invocation failed with code {:?}", output.status);
-+                }
-+                let default_systemd_path = output.stdout.lines().next().ok_or_else(|| anyhow::anyhow!("Unable to get global systemd default PATH"))??;
-+                log::info!("Could not find hard coded PATH environment in unit, using systemd default: {default_systemd_path}");
-+                default_systemd_path
-+            }
-+        })
-+    }
-+
-     /// Get systemd "exposure level" for the service (0-100).
-     /// 100 means extremely exposed (no hardening), 0 means so sandboxed it can't do much.
-     /// Although this is a very crude heuristic, below 40-50 is generally good.
-@@ -170,6 +206,20 @@ impl Service {
-         writeln!(fragment_file, "KillMode=control-group")?;
-         writeln!(fragment_file, "StandardOutput=journal")?;
- 
-+        // Modifying Env Path for strace availability if needed
-+        let old_path_env = Self::get_exec_path(&config_paths)?;
-+        match Self::resolve_exec_path("strace", (&old_path_env).into()) {
-+            Some(_) => log::info!("Found strace in previous path, no correction needed"),
-+            None => {
-+                let path_with_strace = Self::resolve_exec_path("strace", env::var_os("PATH").unwrap()).unwrap();
-+                log::info!("Found strace from local PATH in {}, inserting it into unit config!", path_with_strace.display());
-+                let mut paths = env::split_paths(&old_path_env).collect::<Vec<_>>();
-+                paths.push(path_with_strace);
-+                let new_path = env::join_paths(paths)?;
-+                writeln!(fragment_file, "Environment=\"PATH={}\"", new_path.to_str().unwrap())?;
-+            },
-+        }
-+
-         // Profile data dir
-         let mut rng = rand::rng();
-         let profile_data_dir = PathBuf::from(format!(
@@ -25,6 +25,7 @@ let

  jre' = jre_minimal.override {
    jdk = jdk17_headless;
+    jdkOnBuild = jdk17_headless;
    # from https://gitlab.com/signald/signald/-/blob/0.23.0/build.gradle#L173
    modules = [
      "java.base"
@@ -0,0 +1,23 @@
+GEM
+  remote: https://rubygems.org/
+  specs:
+    bigdecimal (3.1.9)
+    chronic (0.10.2)
+    mini_portile2 (2.8.8)
+    sequel (5.90.0)
+      bigdecimal
+    sqlite3 (1.7.3)
+      mini_portile2 (~> 2.8.0)
+    timetrap (1.15.5)
+      chronic (~> 0.10.2)
+      sequel (~> 5.90.0)
+      sqlite3 (~> 1.4)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  timetrap
+
+BUNDLED WITH
+   2.6.6
@@ -0,0 +1,69 @@
+{
+  bigdecimal = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1k6qzammv9r6b2cw3siasaik18i6wjc5m0gw5nfdc6jj64h79z1g";
+      type = "gem";
+    };
+    version = "3.1.9";
+  };
+  chronic = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1hrdkn4g8x7dlzxwb1rfgr8kw3bp4ywg5l4y4i9c2g5cwv62yvvn";
+      type = "gem";
+    };
+    version = "0.10.2";
+  };
+  mini_portile2 = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0x8asxl83msn815lwmb2d7q5p29p7drhjv5va0byhk60v9n16iwf";
+      type = "gem";
+    };
+    version = "2.8.8";
+  };
+  sequel = {
+    dependencies = [ "bigdecimal" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1s5qhylirrmfbjhdjdfqaiksjlaqmgixl25sxd8znq8dqwqlrydz";
+      type = "gem";
+    };
+    version = "5.90.0";
+  };
+  sqlite3 = {
+    dependencies = [ "mini_portile2" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "073hd24qwx9j26cqbk0jma0kiajjv9fb8swv9rnz8j4mf0ygcxzs";
+      type = "gem";
+    };
+    version = "1.7.3";
+  };
+  timetrap = {
+    dependencies = [
+      "chronic"
+      "sequel"
+      "sqlite3"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0gcs9vyg1i3nsiiwrkqza14qj7h3chlg6w5icbf0ggjzswz3rwd2";
+      type = "gem";
+    };
+    version = "1.15.5";
+  };
+}
@@ -34,18 +34,18 @@ stdenv.mkDerivation {
  nativeBuildInputs = [ installShellFiles ];

  installPhase = ''
-    mkdir $out;
-    cd $out;
+    mkdir $out
+    cd $out

-    mkdir bin; pushd bin;
-    ln -vs ${ttBundlerApp}/bin/t;
-    ln -vs ${ttBundlerApp}/bin/timetrap;
-    popd;
+    mkdir bin; pushd bin
+    ln -vs ${ttBundlerApp}/bin/t
+    ln -vs ${ttBundlerApp}/bin/timetrap
+    popd

    for c in t timetrap; do
-      installShellCompletion --cmd $c --bash ${ttGem}/lib/ruby/gems/*/gems/timetrap*/completions/bash/*;
-      installShellCompletion --cmd $c --zsh ${ttGem}/lib/ruby/gems/*/gems/timetrap*/completions/zsh/*;
-    done;
+      installShellCompletion --cmd $c --bash ${ttGem}/lib/ruby/gems/*/gems/timetrap*/completions/bash/*
+      installShellCompletion --cmd $c --zsh ${ttGem}/lib/ruby/gems/*/gems/timetrap*/completions/zsh/*
+    done
  '';

  meta = with lib; {
@@ -59,4 +59,8 @@ stdenv.mkDerivation {
    ];
    platforms = platforms.unix;
  };
+
+  passthru = {
+    updateScript = ttBundlerApp.passthru.updateScript;
+  };
 }
@@ -15,14 +15,14 @@

 python3Packages.buildPythonApplication rec {
  pname = "varia";
-  version = "2025.1.24-1";
+  version = "2025.4.22";
  pyproject = false;

  src = fetchFromGitHub {
    owner = "giantpinkrobots";
    repo = "varia";
    tag = "v${version}";
-    hash = "sha256-ZTsp2nVqNe+7uEk6HH95AtJMbdKHmKMy3l6q1Xpx4FY=";
+    hash = "sha256-y14I/K1fw7Skiuq+CglTRsotqafpP9yabuHhywB2WXE=";
  };

  postPatch = ''
@@ -15,13 +15,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "vencord";
-  version = "1.12.1";
+  version = "1.12.2";

  src = fetchFromGitHub {
    owner = "Vendicated";
    repo = "Vencord";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-Vs6S8N3q5JzXfeogfD0JrVIhMnYIio7+Dfy12gUJrlU=";
+    hash = "sha256-a4lbeuXEHDMDko8wte7jUdJ0yUcjfq3UPQAuSiz1UQU=";
  };

  pnpmDeps = pnpm_10.fetchDeps {
@@ -6,20 +6,20 @@

 rustPlatform.buildRustPackage rec {
  pname = "wasm-tools";
-  version = "1.229.0";
+  version = "1.230.0";

  src = fetchFromGitHub {
    owner = "bytecodealliance";
    repo = "wasm-tools";
    rev = "v${version}";
-    hash = "sha256-fJQN5AKhILP7d+0GEtnHKuZtZEr/61TfGwpH1EbbSg4=";
+    hash = "sha256-xtGPZXb/tgReshmpW5zzG0EOVYPMoXU+avnO5uLKJnI=";
    fetchSubmodules = true;
  };

  # Disable cargo-auditable until https://github.com/rust-secure-code/cargo-auditable/issues/124 is solved.
  auditable = false;
  useFetchCargoVendor = true;
-  cargoHash = "sha256-OqQJ2jvceHPoSx7Iic/hsJWv8vJnEo9F1bbpqfL5HsM=";
+  cargoHash = "sha256-P+5g1ynZVFIU2bgait+2rwJoVYClF7lyq4j2roV/w2o=";
  cargoBuildFlags = [
    "--package"
    "wasm-tools"
@@ -229,10 +229,11 @@ if [[ -n "$newUrl" ]]; then
        die "Couldn't evaluate source url from '$attr.$sourceKey'!"
    fi

-    # Escape regex metacharacter that are allowed in store path names
-    oldUrlEscaped=$(echo "$oldUrl" | sed -re 's|[${}.+?]|\\&|g')
+    # Escape regex metacharacter that may appear in URLs
+    oldUrlEscaped=$(echo "$oldUrl" | sed -e 's|[*.^$[\|]|\\&|g')
+    newUrlEscaped=$(echo "$newUrl" | sed -e 's|[&\|]|\\&|g')

-    sed -i.cmp "$nixFile" -re "s|\"$oldUrlEscaped\"|\"$newUrl\"|"
+    sed -i.cmp "$nixFile" -e "s|\"$oldUrlEscaped\"|\"$newUrlEscaped\"|"
    if cmp -s "$nixFile" "$nixFile.cmp"; then
        die "Failed to replace source URL '$oldUrl' to '$newUrl' in '$attr'!"
    fi
@@ -77,3 +77,22 @@ Instead of applying the patches to the worktree per the above instructions, one
 For newer LLVM versions, enough has has been upstreamed,
 (see https://reviews.llvm.org/differential/query/5UAfpj_9zHwY/ for my progress upstreaming),
 that I have just assembled new gnu-install-dirs patches from the remaining unmerged patches instead of rebasing from the prior LLVM's gnu install dirs patch.
+
+## Adding a patch
+
+To add an LLVM patch in the Nixpkgs tree,
+
+1. Put the patch in the corresponding directory (`<VERSION>/<PACKAGE>`).
+
+   _Example_: If you want your patch to apply to clang version 12 (and, optionally, later versions), put it in `./12/clang`.
+2. Add the patch to the `patches` argument of the corresponding package in `./common`, guarded by a `lib.optionals` with the desired version constraints, passed through the `getVersionFile` function.
+
+   _Example_: If you want the patch `./12/llvm/fix-llvm-issue-49955.patch` to apply to LLVM 12, add `lib.optional (lib.versions.major release_version == "12") (getVersionFile "llvm/fix-llvm-issue-49955.patch")` to `./common/llvm/default.nix`.
+3. If you wish for this single patch to apply to multiple versions of the package, extend the conditions in the `lib.optional` guard and add the corresponding constraints to `./common/patches.nix`; note that `after` is inclusive and `before` is exclusive.
+
+   _Example_:
+   If you want the patch `./12/clang/purity.patch` to apply to versions 12, 13 and 14, you have to
+   - Modify the guard in `./common/clang/default.nix` as follows: `lib.optional (lib.versionAtLeast release_version "12" && lib.versionOlder release_version "15")`
+   - Add `{ "clang/purity.patch" = [ { after = 12; before = 15; path = ../12; } ]; }` to `common/patches.nix`.
+   You may have multiple different patches with the same name that would apply to different versions; in that case, add the necessary constraints to `common/patches.nix`.
+
@@ -0,0 +1,16 @@
+diff --git a/t/core_surface.t b/t/core_surface.t
+index 897536b6..03efa859 100644
+--- a/t/core_surface.t
+++ b/t/core_surface.t
+@@ -51,7 +51,10 @@ is( $image->h, 32, 'image has height' );
+ 
+ my $pixel_format = $image->format;
+ isa_ok( $pixel_format, 'SDL::PixelFormat' );
+-is( $pixel_format->BitsPerPixel,  8,   ' BitsPerPixel' );
+# the bitmap has a bitdepth of 4
+# SDL_classic could not allocate less than full bytes per pixel
+# sdl12-compat returns the actual bit depth of the image here
+is( $pixel_format->BitsPerPixel,  4,   ' BitsPerPixel' );
+ is( $pixel_format->BytesPerPixel, 1,   ' BytesPerPixel' );
+ is( $pixel_format->Rloss,         8,   ' Rloss' );
+ is( $pixel_format->Gloss,         8,   ' Gloss' );
@@ -18,7 +18,7 @@

 buildPythonPackage rec {
  pname = "aiodiscover";
-  version = "2.6.1";
+  version = "2.7.0";
  pyproject = true;

  disabled = pythonOlder "3.9";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
    owner = "bdraco";
    repo = "aiodiscover";
    tag = "v${version}";
-    hash = "sha256-dgmRgokHDw0ooxD8Ksxb8QKeAdUhYj/WO85EC57MeNg=";
+    hash = "sha256-zJOsf4oZbZgaiaaPM0HfR0GNwxvGoR6fgkJB5ZFY0O8=";
  };

  build-system = [ poetry-core ];
@@ -20,7 +20,7 @@

 buildPythonPackage rec {
  pname = "deebot-client";
-  version = "13.1.0";
+  version = "13.2.0";
  pyproject = true;

  disabled = pythonOlder "3.13";
@@ -29,12 +29,12 @@ buildPythonPackage rec {
    owner = "DeebotUniverse";
    repo = "client.py";
    tag = version;
-    hash = "sha256-EIhefThzHC9hpI4bGkTu+TskdzajI7cc90DhrfDlbcs=";
+    hash = "sha256-0DGOdfr6vqtgYwabhJWfxV2kACzixiCnqPNssPHyLhw=";
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
    inherit pname version src;
-    hash = "sha256-WYWrfNigmu18yEa2QstJ5RfjLWS/Tckem48j8JK2NHk=";
+    hash = "sha256-A/axIsDfpWNLQXeExshzlJfKWh5yFZYqxDQYPn1+fHg=";
  };

  pythonRelaxDeps = [
@@ -17,7 +17,7 @@

 buildPythonPackage rec {
  pname = "ical";
-  version = "9.2.2";
+  version = "9.2.4";
  pyproject = true;

  disabled = pythonOlder "3.11";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
    owner = "allenporter";
    repo = "ical";
    tag = version;
-    hash = "sha256-eh8XOKn7Xo4JprMwVVdsBWdXajn2URYVR5tz2y2wKrg=";
+    hash = "sha256-R9BuCLuVYuUvrmF/arEDsUPPUeSLjpqiEJ/ovvGIsYQ=";
  };

  build-system = [ setuptools ];
@@ -1,25 +0,0 @@
-{
-  lib,
-  buildPythonPackage,
-  fetchPypi,
-}:
-
-buildPythonPackage rec {
-  pname = "oauth";
-  version = "1.0.1";
-  format = "setuptools";
-
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "0pdgi35hczsslil4890xqawnbpdazkgf2v1443847h5hy2gq2sg7";
-  };
-
-  # No tests included in archive
-  doCheck = false;
-
-  meta = with lib; {
-    homepage = "https://code.google.com/archive/p/oauth/";
-    description = "Library for OAuth version 1.0a";
-    license = licenses.mit;
-  };
-}
@@ -1,36 +0,0 @@
-{
-  lib,
-  buildPythonPackage,
-  fetchPypi,
-  httplib2,
-  mock,
-  coverage,
-}:
-
-buildPythonPackage rec {
-  pname = "oauth2";
-  version = "1.9.0.post1";
-  format = "setuptools";
-
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "c006a85e7c60107c7cc6da1b184b5c719f6dd7202098196dfa6e55df669b59bf";
-  };
-
-  propagatedBuildInputs = [ httplib2 ];
-  buildInputs = [
-    mock
-    coverage
-  ];
-
-  # ServerNotFoundError: Unable to find the server at oauth-sandbox.sevengoslings.net
-  doCheck = false;
-
-  meta = with lib; {
-    homepage = "https://github.com/simplegeo/python-oauth2";
-    description = "Library for OAuth version 1.0";
-    license = licenses.mit;
-    maintainers = [ ];
-    platforms = platforms.unix;
-  };
-}
@@ -29,6 +29,10 @@ buildPythonPackage rec {

  propagatedBuildInputs = [ numpy ];

+  # Fix GCC 14 build.
+  # from incompatible pointer type [-Wincompatible-pointer-types
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=incompatible-pointer-types";
+
  patches = [
    # make sure X11 and OpenGL can be found at runtime
    ./static-libs.patch
@@ -9,14 +9,14 @@

 buildPythonPackage rec {
  pname = "pysensibo";
-  version = "1.1.0";
+  version = "1.2.1";
  pyproject = true;

  disabled = pythonOlder "3.11";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-yITcVEBtqH1B+MyhQweOzmdgPgWrueAkczp/UsT4J/4=";
+    hash = "sha256-Otk5W3VTbOAeZOVnXvW8VSxU1nHa8zUvmvduRTdlwVs=";
  };

  build-system = [ poetry-core ];
@@ -18,7 +18,7 @@

 buildPythonPackage rec {
  pname = "pysmartthings";
-  version = "3.2.1";
+  version = "3.2.2";
  pyproject = true;

  disabled = pythonOlder "3.12";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
    owner = "andrewsayre";
    repo = "pysmartthings";
    tag = "v${version}";
-    hash = "sha256-KgwNXIzQWae91R0qmInlm6m+NwrSJgP9SY80WSneTY4=";
+    hash = "sha256-tQ+AQDHwr9JO4AQ+2ZAGQbSrfnuzPUEi2F19wLijv1Y=";
  };

  build-system = [ poetry-core ];
@@ -180,9 +180,9 @@
    "hash": "sha256-mwN0b9AIUEqW9Wnzetj/kCzHFJXn4SPao8beef8qzEU="
  },
  "kirigami": {
-    "version": "6.14.0",
-    "url": "mirror://kde/stable/frameworks/6.14/kirigami-6.14.0.tar.xz",
-    "hash": "sha256-Fixim6UOfa5EOe9QJyoMFQy6s3FBWn0esWDb42OPYZo="
+    "version": "6.14.1",
+    "url": "mirror://kde/stable/frameworks/6.14/kirigami-6.14.1.tar.xz",
+    "hash": "sha256-LJG04pUURPfW89at2W3EHGK/nb90eoWU1dL8kY0nMJ8="
  },
  "kitemmodels": {
    "version": "6.14.0",
@@ -290,9 +290,9 @@
    "hash": "sha256-JKzW0rhYK91q6b/KlyeKlnY+4YSmzey8Dc1k/U/COLI="
  },
  "kwallet": {
-    "version": "6.14.0",
-    "url": "mirror://kde/stable/frameworks/6.14/kwallet-6.14.0.tar.xz",
-    "hash": "sha256-p0d+Tl58y0NJHFoOzK32oz6WIIjVrzLEtrSqy5IPWeM="
+    "version": "6.14.1",
+    "url": "mirror://kde/stable/frameworks/6.14/kwallet-6.14.1.tar.xz",
+    "hash": "sha256-70gr4tUhH3EdV4qh0fN/ceZBpqUv034RMn4ZkV/UISc="
  },
  "kwidgetsaddons": {
    "version": "6.14.0",
@@ -10,13 +10,13 @@

 stdenv.mkDerivation rec {
  name = "rtl8189es-${kernel.version}-${version}";
-  version = "2024-01-21";
+  version = "2025-04-29";

  src = fetchFromGitHub {
    owner = "jwrdegoede";
    repo = "rtl8189ES_linux";
-    rev = "eb51e021b0e1b6f94a4b49da3f4ee5c5fb20b715";
-    sha256 = "sha256-n7Bsstr1H1RvguAyJnVqk/JgEx8WEZWaVg7ZfEYykR0=";
+    rev = "7b43c5c7971eabea263dc2b6cc0928b84323f310";
+    sha256 = "sha256-1BCrMJlXswVZrnbulrF2m0lh7jw8PgHzYPkLk6Stbx8=";
  };

  nativeBuildInputs = [
@@ -8,13 +8,13 @@
 # rtl8189fs is a branch of the rtl8189es driver
 rtl8189es.overrideAttrs (drv: rec {
  name = "rtl8189fs-${kernel.version}-${version}";
-  version = "2024-01-22";
+  version = "2025-05-04";

  src = fetchFromGitHub {
    owner = "jwrdegoede";
    repo = "rtl8189ES_linux";
-    rev = "5d523593f41c0b8d723c6aa86b217ee1d0965786";
-    sha256 = "sha256-pziaUM6XfF4Tt9yfWUnLUiTw+sw6uZrr1HcaXdRQ31E=";
+    rev = "06e89edce6817616d963414825dccf87094a7e54";
+    sha256 = "sha256-W+gBpK17PmF8BdmBoUHPX7hZoSNOyGe3W1NypR8bc6A=";
  };

  meta = with lib; {
@@ -2,7 +2,7 @@
 # Do not edit!

 {
-  version = "2025.5.1";
+  version = "2025.5.2";
  components = {
    "3_day_blinds" =
      ps: with ps; [
@@ -194,6 +194,16 @@ let
        doCheck = false; # no tests
      });

+      plexapi = super.plexapi.overrideAttrs (oldAttrs: rec {
+        version = "4.15.16";
+        src = fetchFromGitHub {
+          owner = "pkkid";
+          repo = "python-plexapi";
+          tag = version;
+          hash = "sha256-NwGGNN6LC3gvE8zoVL5meNWMbqZjJ+6PcU2ebJTfJmU=";
+        };
+      });
+
      # Pinned due to API changes in 0.1.0
      poolsense = super.poolsense.overridePythonAttrs (oldAttrs: rec {
        version = "0.0.8";
@@ -367,7 +377,7 @@ let
  extraBuildInputs = extraPackages python.pkgs;

  # Don't forget to run update-component-packages.py after updating
-  hassVersion = "2025.5.1";
+  hassVersion = "2025.5.2";

 in
 python.pkgs.buildPythonApplication rec {
@@ -388,13 +398,13 @@ python.pkgs.buildPythonApplication rec {
    owner = "home-assistant";
    repo = "core";
    tag = version;
-    hash = "sha256-/ItMm6/SV0MazK16NfW53XPcIV7ERUUabjcwHBC4c7Y=";
+    hash = "sha256-el5s82R4MuTjUnMVXRQj4PhPxJxHoL6Jqvc6XRnJl8w=";
  };

  # Secondary source is pypi sdist for translations
  sdist = fetchPypi {
    inherit pname version;
-    hash = "sha256-zllQ0h1Ws+HNyfBvAAoKtovQtwkr0fNNtnF2pAjRrqM=";
+    hash = "sha256-lddnAM3fja9enPYRSonwSe1aG8t55jSJQNveWPwrhOE=";
  };

  build-system = with python.pkgs; [
@@ -8,7 +8,7 @@ buildPythonPackage rec {
  # the frontend version corresponding to a specific home-assistant version can be found here
  # https://github.com/home-assistant/home-assistant/blob/master/homeassistant/components/frontend/manifest.json
  pname = "home-assistant-frontend";
-  version = "20250509.0";
+  version = "20250516.0";
  format = "wheel";

  src = fetchPypi {
@@ -16,7 +16,7 @@ buildPythonPackage rec {
    pname = "home_assistant_frontend";
    dist = "py3";
    python = "py3";
-    hash = "sha256-tlBdUA3Gj7P6KTjY2UNnWjQqpnwgvAlXC09P7QFR0r0=";
+    hash = "sha256-KyZE9SmEoAKgaZMRvs83BK73Yo3fqD8O+vMBO4JE+Ng=";
  };

  # there is nothing to strip in this package
@@ -18,7 +18,7 @@

 buildPythonPackage rec {
  pname = "pytest-homeassistant-custom-component";
-  version = "0.13.244";
+  version = "0.13.245";
  pyproject = true;

  disabled = pythonOlder "3.13";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
    owner = "MatthewFlamm";
    repo = "pytest-homeassistant-custom-component";
    rev = "refs/tags/${version}";
-    hash = "sha256-jYKPkhOKxi3Ue4Q/FHaBn/3p8b1VYsje1/awvOCBDfk=";
+    hash = "sha256-l/NStiw2tajXydNv9EDqRZ1ku2CeRdDOsHDFIEA9vdM=";
  };

  build-system = [ setuptools ];
@@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "homeassistant-stubs";
-  version = "2025.5.1";
+  version = "2025.5.2";
  pyproject = true;

  disabled = python.version != home-assistant.python.version;
@@ -19,7 +19,7 @@ buildPythonPackage rec {
    owner = "KapJI";
    repo = "homeassistant-stubs";
    tag = version;
-    hash = "sha256-esKI8bqTI2ov5i0vrUDTjCPWKp7PG/Pay/lvYbvMQkU=";
+    hash = "sha256-jvXsGWVXviwC2KjMuRPdLy2uY5fkqsMALG1RZ3XvzvU=";
  };

  build-system = [
@@ -63,6 +63,17 @@ let
  };

  extraDisabledTests = {
+    sensor = [
+      # Failed: Translation not found for sensor
+      "test_validate_unit_change_convertible"
+      "test_validate_statistics_unit_change_no_device_class"
+      "test_validate_statistics_state_class_removed"
+      "test_validate_statistics_state_class_removed_issue_cleaned_up"
+      "test_validate_statistics_unit_change_no_conversion"
+      "test_validate_statistics_unit_change_equivalent_units_2"
+      "test_update_statistics_issues"
+      "test_validate_statistics_mean_type_changed"
+    ];
    shell_command = [
      # tries to retrieve file from github
      "test_non_text_stdout_capture"
@@ -75,6 +86,10 @@ let
      # AssertionError: assert 'unknown_error' == 'template_error'
      "test_render_template_with_timeout"
    ];
+    zeroconf = [
+      # multicast socket bind, not possible in the sandbox
+      "test_subscribe_discovery"
+    ];
  };

  extraPytestFlagsArray = {
@@ -84,7 +99,7 @@ let
    ];
    bmw_connected_drive = [
      # outdated snapshot
-      "--deselect tests/components/bmw_connected_drive/test_select.py::test_entity_state_attrs"
+      "--deselect tests/components/bmw_connected_drive/test_binary_sensor.py::test_entity_state_attrs"
    ];
    dnsip = [
      # Tries to resolve DNS entries
@@ -104,6 +119,14 @@ let
      # aioserial mock produces wrong state
      "--deselect tests/components/modem_callerid/test_init.py::test_setup_entry"
    ];
+    openai_conversation = [
+      # outdated snapshot
+      "--deselect tests/components/openai_conversation/test_conversation.py::test_function_call"
+    ];
+    technove = [
+      # outdated snapshot
+      "--deselect tests/components/technove/test_switch.py::test_switches"
+    ];
  };
 in
 lib.listToAttrs (
@@ -16,13 +16,13 @@

 stdenv.mkDerivation {
  pname = "solanum";
-  version = "0-unstable-2025-02-25";
+  version = "0-unstable-2025-05-11";

  src = fetchFromGitHub {
    owner = "solanum-ircd";
    repo = "solanum";
-    rev = "1669c6406cea5092f5ac25634136341a92c6373b";
-    hash = "sha256-Y/fXtBgqzt9tRxL4Xs0KM9nX7Os9QBHBjoDuiaHOsfY=";
+    rev = "b3d3796e690ce2482c1365d99e3329d5587b75d5";
+    hash = "sha256-hRiBcX2KDAdtx4G3jJyQlLvhfUutHoy85Upni1RfOHY=";
  };

  patches = [
@@ -1,61 +0,0 @@
-{
-  fetchFromGitHub,
-  buildGoModule,
-  jq,
-  buildNpmPackage,
-  lib,
-  makeWrapper,
-}:
-
-let
-  version = "0.13.2";
-  src = fetchFromGitHub {
-    owner = "usememos";
-    repo = "memos";
-    rev = "v${version}";
-    hash = "sha256-lcOZg5mlFPp04ZCm5GDhQfSwE2ahSmGhmdAw+pygK0A=";
-  };
-
-  frontend = buildNpmPackage {
-    pname = "memos-web";
-    inherit version;
-
-    src = "${src}/web";
-
-    npmDepsHash = "sha256-36UcHE98dsGvYQWLIc/xgP8Q0IyJ7la0Qoo3lZqUcmw=";
-
-    postPatch = ''
-      cp ${./package-lock.json} package-lock.json
-    '';
-
-    installPhase = ''
-      cp -r dist $out
-    '';
-  };
-in
-buildGoModule {
-  pname = "memos";
-  inherit version src;
-
-  # check will unable to access network in sandbox
-  doCheck = false;
-  vendorHash = "sha256-UM/xeRvfvlq+jGzWpc3EU5GJ6Dt7RmTbSt9h3da6f8w=";
-
-  # Inject frontend assets into go embed
-  prePatch = ''
-    rm -rf server/dist
-    cp -r ${frontend} server/dist
-  '';
-
-  passthru = {
-    updateScript = ./update.sh;
-  };
-
-  meta = with lib; {
-    homepage = "https://usememos.com";
-    description = "Lightweight, self-hosted memo hub";
-    maintainers = with maintainers; [ indexyz ];
-    license = licenses.mit;
-    mainProgram = "memos";
-  };
-}
@@ -1,56 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i bash -p nix wget nix-prefetch-github moreutils jq prefetch-npm-deps nodejs
-
-set -euo pipefail
-
-TARGET_VERSION_REMOTE=$(curl -s https://api.github.com/repos/usememos/memos/releases/latest | jq -r ".tag_name")
-TARGET_VERSION=${TARGET_VERSION_REMOTE#v}
-
-if [[ "$UPDATE_NIX_OLD_VERSION" == "$TARGET_VERSION" ]]; then
-  echo "memos is up-to-date: ${UPDATE_NIX_OLD_VERSION}"
-  exit 0
-fi
-
-extractVendorHash() {
-  original="${1?original hash missing}"
-  result="$(nix-build -A memos.goModules 2>&1 | tail -n3 | grep 'got:' | cut -d: -f2- | xargs echo || true)"
-  [ -z "$result" ] && { echo "$original"; } || { echo "$result"; }
-}
-
-replaceHash() {
-  old="${1?old hash missing}"
-  new="${2?new hash missing}"
-  awk -v OLD="$old" -v NEW="$new" '{
-    if (i=index($0, OLD)) {
-      $0 = substr($0, 1, i-1) NEW substr($0, i+length(OLD));
-    }
-    print $0;
-  }' ./pkgs/servers/memos/default.nix | sponge ./pkgs/servers/memos/default.nix
-}
-
-# change version number
-sed -e "s/version =.*;/version = \"$TARGET_VERSION\";/g" \
-    -i ./pkgs/servers/memos/default.nix
-
-# update hash
-SRC_HASH="$(nix-instantiate --eval -A memos.src.outputHash | tr -d '"')"
-NEW_HASH="$(nix-prefetch-github usememos memos --rev v$TARGET_VERSION | jq -r .hash)"
-
-replaceHash "$SRC_HASH" "$NEW_HASH"
-
-GO_HASH="$(nix-instantiate --eval -A memos.vendorHash | tr -d '"')"
-EMPTY_HASH="$(nix-instantiate --eval -A lib.fakeHash | tr -d '"')"
-replaceHash "$GO_HASH" "$EMPTY_HASH"
-replaceHash "$EMPTY_HASH" "$(extractVendorHash "$GO_HASH")"
-
-# update src yarn lock
-SRC_FILE_BASE="https://raw.githubusercontent.com/usememos/memos/v$TARGET_VERSION"
-
-trap 'rm -rf ./pkgs/servers/memos/package.json' EXIT
-pushd ./pkgs/servers/memos
-wget -q "$SRC_FILE_BASE/web/package.json"
-npm install --package-lock-only
-NPM_HASH=$(prefetch-npm-deps ./package-lock.json)
-popd
-
-sed -i -E -e "s#npmDepsHash = \".*\"#npmDepsHash = \"$NPM_HASH\"#" ./pkgs/servers/memos/default.nix
@@ -1125,8 +1125,6 @@ with pkgs;
    };
  };

-  memos = callPackage ../servers/memos { };
-
  mkosi = python3Packages.callPackage ../tools/virtualization/mkosi { inherit systemd; };

  mkosi-full = mkosi.override { withQemu = true; };
@@ -4236,11 +4234,6 @@ with pkgs;

  polaris-web = callPackage ../servers/polaris/web.nix { };

-  projectlibre = callPackage ../applications/misc/projectlibre {
-    jre = jre8;
-    jdk = jdk8;
-  };
-
  projectm_3 = libsForQt5.callPackage ../applications/audio/projectm_3 { };

  proxmark3 = libsForQt5.callPackage ../tools/security/proxmark3/default.nix { };
@@ -4581,8 +4574,6 @@ with pkgs;

  tiled = libsForQt5.callPackage ../applications/editors/tiled { };

-  timetrap = callPackage ../applications/office/timetrap { };
-
  tinc = callPackage ../tools/networking/tinc { };

  tikzit = libsForQt5.callPackage ../tools/typesetting/tikzit { };
@@ -6821,8 +6812,6 @@ with pkgs;

  ### DEVELOPMENT / TOOLS

-  actiona = libsForQt5.callPackage ../applications/misc/actiona { };
-
  inherit (callPackage ../development/tools/alloy { })
    alloy5
    alloy6
@@ -13204,8 +13193,6 @@ with pkgs;
  libutp = callPackage ../applications/networking/p2p/libutp { };
  libutp_3_4 = callPackage ../applications/networking/p2p/libutp/3.4.nix { };

-  ledger-web = callPackage ../applications/office/ledger-web { };
-
  linphone = libsForQt5.callPackage ../applications/networking/instant-messengers/linphone { };

  lmms = libsForQt5.callPackage ../applications/audio/lmms {
@@ -30215,6 +30215,9 @@ with self;
    patches = [
      # https://github.com/PerlGameDev/SDL/pull/304
      ../development/perl-modules/sdl-modern-perl.patch
+      # sdl-compat correctly reports the bit depth of the test image,
+      # while SDL_classic rounded to the next byte
+      ../development/perl-modules/sdl-compat-bit-depth.patch
      (fetchpatch {
        url = "https://aur.archlinux.org/cgit/aur.git/plain/surface-xs-declare-calc-offset-earlier.diff?h=perl-sdl&id=d4b6da86d33046cde0e84fa2cd6eaccff1667cab";
        hash = "sha256-dQ2O4dO18diSAilSZrZj6II+mBuKKI3cx9fR1SJqUvo=";
@@ -455,6 +455,8 @@ mapAliases ({
  notifymuch = throw "notifymuch has been promoted to a top-level attribute name: `pkgs.notifymuch`"; # added 2022-10-02
  Nuitka = nuitka; # added 2023-02-19
  ntlm-auth = throw "ntlm-auth has been removed, because it relies on the md4 implementation provided by openssl. Use pyspnego instead.";
+  oauth = throw "oauth has been removed as it is unmaintained"; # added 2025-05-16
+  oauth2 = throw "oauth2 has been removed as it is unmaintained"; # added 2025-05-16
  openai-triton = triton; # added 2024-07-18
  openai-triton-bin = triton-bin; # added 2024-07-18
  openai-triton-cuda = triton-cuda; # added 2024-07-18
@@ -10181,10 +10181,6 @@ self: super: with self; {

  oath = callPackage ../development/python-modules/oath { };

-  oauth = callPackage ../development/python-modules/oauth { };
-
-  oauth2 = callPackage ../development/python-modules/oauth2 { };
-
  oauth2client = callPackage ../development/python-modules/oauth2client { };

  oauthenticator = callPackage ../development/python-modules/oauthenticator { };