Merge master into staging-next

2025-10-18 00:15:17 +00:00
parent 03e8920ce4 a1e822ab3b
commit 94e79f47bf
96 changed files with 2334 additions and 1172 deletions
@@ -214,6 +214,12 @@ code, while others choose not to.

 In Nix, there are multiple approaches to building a Composer-based project.

+::: {.warning}
+`buildComposerProject2` has a [known bug](https://github.com/NixOS/nixpkgs/issues/451395)
+where the `vendorHash` changes every time a Composer release happens that changes the
+`autoload.php` or vendored composer code.
+:::
+
 One such method is the `php.buildComposerProject2` helper function, which serves
 as a wrapper around `mkDerivation`.

@@ -7880,6 +7880,12 @@
    githubId = 21313906;
    name = "EsAu";
  };
+  esch = {
+    name = "Austin Eschweiler";
+    github = "Eschguy";
+    githubId = 8880292;
+    email = "austin.eschweiler@gmail.com";
+  };
  esclear = {
    github = "esclear";
    githubId = 7432848;
@@ -824,12 +824,6 @@
  "module-services-glance-quickstart": [
    "index.html#module-services-glance-quickstart"
  ],
-  "module-services-filesender": [
-    "index.html#module-services-filesender"
-  ],
-  "module-services-filesender-quickstart": [
-    "index.html#module-services-filesender-quickstart"
-  ],
  "module-services-discourse": [
    "index.html#module-services-discourse"
  ],
@@ -92,7 +92,7 @@ The pre-existing `services.ankisyncd` has been marked deprecated and will be dro

 - [FCast Receiver](https://fcast.org), an open-source alternative to Chromecast and AirPlay. Available as [programs.fcast-receiver](#opt-programs.fcast-receiver.enable).

- [FileSender](https://filesender.org/), a file sharing software. Available as [services.filesender](#opt-services.filesender.enable).
+- [FileSender](https://filesender.org/), a file sharing software. Available as `services.filesender`.

 - [Firefly-iii](https://www.firefly-iii.org), a free and open source personal finance manager. Available as [services.firefly-iii](#opt-services.firefly-iii.enable).

@@ -178,7 +178,7 @@ The pre-existing `services.ankisyncd` has been marked deprecated and will be dro

 - [Scrutiny](https://github.com/AnalogJ/scrutiny), a S.M.A.R.T monitoring tool for hard disks with a web frontend. Available as [services.scrutiny](#opt-services.scrutiny.enable).

- [SimpleSAMLphp](https://simplesamlphp.org/), an application written in native PHP that deals with authentication (SQL, .htpasswd, YubiKey, LDAP, PAPI, Radius). Available as [services.simplesamlphp](#opt-services.simplesamlphp).
+- [SimpleSAMLphp](https://simplesamlphp.org/), an application written in native PHP that deals with authentication (SQL, .htpasswd, YubiKey, LDAP, PAPI, Radius). Available as `services.simplesamlphp`.

 - `systemd`'s `gateway`, `upload`, and `remote` services, which provide ways of sending journals across the network. Enable using [services.journald.gateway](#opt-services.journald.gateway.enable), [services.journald.upload](#opt-services.journald.upload.enable), and [services.journald.remote](#opt-services.journald.remote.enable).

@@ -346,8 +346,12 @@

 - `bcachefs` file systems will now use the out-of-tree module for supported kernels. The in-tree module is unmaintained and users are strongly recommended to switch to kernels that support the out-of-tree module.

+- `services.filesender` and the package `filesender` have been removed because they depend on `simplesamlphp`.
+
 - `services.gitea` supports sending notifications with sendmail again. To do this, activate the parameter `services.gitea.mailerUseSendmail` and configure SMTP server.

+- `simplesamlphp` has been removed since the package was severely outdated, unmaintained in nixpkgs and having known vulnerabilities.
+
 - `networking.wireless.networks.<name>` now has an option to specify SSID, hence allowing duplicated SSID setup. The BSSID option is added along side with this.

 - Revamp of the ACME certificate acquisication and renewal process to help scale systems with lots (100+) of certificates.
@@ -96,8 +96,8 @@ let
    only one of {option}`hashedPassword`, {option}`password`, or
    {option}`hashedPasswordFile` will be set.

-    In a system where [](#opt-systemd.sysusers.enable) is `true`, typically
-    only one of {option}`initialPassword`, {option}`initialHashedPassword`,
+    In a system where [](#opt-systemd.sysusers.enable) or [](#opt-services.userborn.enable) is `true`,
+    typically only one of {option}`initialPassword`, {option}`initialHashedPassword`,
    or {option}`hashedPasswordFile` will be set.

    If the option {option}`users.mutableUsers` is true, the password defined
@@ -875,7 +875,7 @@ in
      };

      system.activationScripts.users =
-        if !config.systemd.sysusers.enable then
+        if !config.systemd.sysusers.enable && !config.services.userborn.enable then
          {
            supportsDryActivation = true;
            text = ''
@@ -926,7 +926,7 @@ in
      # This does not work when the users and groups are created by
      # systemd-sysusers because the users are created too late then.
      system.activationScripts.hashes =
-        if !config.systemd.sysusers.enable then
+        if !config.systemd.sysusers.enable && !config.services.userborn.enable then
          {
            deps = [ "users" ];
            text = ''
@@ -1587,7 +1587,6 @@
  ./services/web-apps/fediwall.nix
  ./services/web-apps/fider.nix
  ./services/web-apps/filebrowser.nix
-  ./services/web-apps/filesender.nix
  ./services/web-apps/firefly-iii-data-importer.nix
  ./services/web-apps/firefly-iii.nix
  ./services/web-apps/flarum.nix
@@ -1705,7 +1704,6 @@
  ./services/web-apps/shiori.nix
  ./services/web-apps/sillytavern.nix
  ./services/web-apps/silverbullet.nix
-  ./services/web-apps/simplesamlphp.nix
  ./services/web-apps/slskd.nix
  ./services/web-apps/snipe-it.nix
  ./services/web-apps/snips-sh.nix
@@ -401,10 +401,16 @@ in
      services.invoiceplane has been removed since the service only supported PHP 8.1 which is EOL
      and removed from nixpkgs.
    '')
+    (mkRemovedOptionModule [ "services" "filesender" ] ''
+      services.filesender has been removed since it depends on simplesamlphp which was severely unmaintained.
+    '')
    (mkRemovedOptionModule [ "services" "postfixadmin" ] ''
      services.postfixadmin has been removed since it was unmaintained in nixpkgs and the version
      available only supported PHP 8.1 which is EOL.
    '')
+    (mkRemovedOptionModule [ "services" "simplesamlphp" ] ''
+      services.simplesamlphp has been vulnerable and unmaintained in nixpkgs.
+    '')
    # Do NOT add any option renames here, see top of the file
  ];
 }
@@ -21,6 +21,14 @@ let
      })
    );

+  bindRndcMacType = "hmac-sha256";
+
+  bindRndcKeyFile = "/etc/bind/rndc.key";
+
+  bindNamedExe = lib.getExe' bindPkg "named";
+
+  bindRndcExe = lib.getExe' bindPkg "rndc";
+
  bindZoneOptions =
    { name, config, ... }:
    {
@@ -63,68 +71,90 @@ let
      };
    };

-  confFile = pkgs.writeText "named.conf" ''
-    include "/etc/bind/rndc.key";
-    controls {
-      inet 127.0.0.1 allow {localhost;} keys {"rndc-key";};
+  testRndcKey = pkgs.writeTextFile {
+    name = "testrndc.key";
+    text = ''
+      key "rndc-key" {
+        algorithm ${bindRndcMacType};
+        secret "0123456789abcdefghijklmnopqrstuvw=";
+      };
+    '';
+  };
+
+  confFile = pkgs.writeTextFile {
+    name = "named.conf";
+    checkPhase = ''
+      runHook preCheck
+      echo "Checking named configuration file...";
+      ${lib.getExe' bindPkg "named-checkconf"} -z $target -t ${cfg.directory}
+      runHook postCheck
+    '';
+    derivationArgs = {
+      doCheck = true;
+      postCheck = ''
+        substituteInPlace $target --replace-fail ${testRndcKey} ${bindRndcKeyFile}
+      '';
    };

-    acl cachenetworks { ${lib.concatMapStrings (entry: " ${entry}; ") cfg.cacheNetworks} };
-    acl badnetworks { ${lib.concatMapStrings (entry: " ${entry}; ") cfg.blockedNetworks} };
+    # The include path in the first line will be replaced in the postCheck hook.
+    text = ''
+      include "${testRndcKey}";
+      controls {
+        inet 127.0.0.1 allow {localhost;} keys {"rndc-key";};
+      };

-    options {
-      listen-on port ${toString cfg.listenOnPort} { ${
-        lib.concatMapStrings (entry: " ${entry}; ") cfg.listenOn
-      } };
-      listen-on-v6 port ${toString cfg.listenOnIpv6Port} { ${
-        lib.concatMapStrings (entry: " ${entry}; ") cfg.listenOnIpv6
-      } };
-      allow-query-cache { cachenetworks; };
-      blackhole { badnetworks; };
-      forward ${cfg.forward};
-      forwarders { ${lib.concatMapStrings (entry: " ${entry}; ") cfg.forwarders} };
-      directory "${cfg.directory}";
-      pid-file "/run/named/named.pid";
-      ${cfg.extraOptions}
-    };
+      acl cachenetworks { ${lib.concatMapStrings (entry: " ${entry}; ") cfg.cacheNetworks} };
+      acl badnetworks { ${lib.concatMapStrings (entry: " ${entry}; ") cfg.blockedNetworks} };

-    ${cfg.extraConfig}
+      options {
+        listen-on { ${lib.concatMapStrings (entry: " ${entry}; ") cfg.listenOn} };
+        listen-on-v6 { ${lib.concatMapStrings (entry: " ${entry}; ") cfg.listenOnIpv6} };
+        allow-query-cache { cachenetworks; };
+        blackhole { badnetworks; };
+        forward ${cfg.forward};
+        forwarders { ${lib.concatMapStrings (entry: " ${entry}; ") cfg.forwarders} };
+        directory "${cfg.directory}";
+        pid-file "/run/named/named.pid";
+        ${cfg.extraOptions}
+      };

-    ${lib.concatMapStrings (
-      {
-        name,
-        file,
-        master ? true,
-        slaves ? [ ],
-        masters ? [ ],
-        allowQuery ? [ ],
-        extraConfig ? "",
-      }:
-      ''
-        zone "${name}" {
-          type ${if master then "master" else "slave"};
-          file "${file}";
-          ${
-            if master then
-              ''
-                allow-transfer {
-                  ${lib.concatMapStrings (ip: "${ip};\n") slaves}
-                };
-              ''
-            else
-              ''
-                masters {
-                  ${lib.concatMapStrings (ip: "${ip};\n") masters}
-                };
-              ''
-          }
-          allow-query { ${lib.concatMapStrings (ip: "${ip}; ") allowQuery}};
-          ${extraConfig}
-        };
-      ''
-    ) (lib.attrValues cfg.zones)}
-  '';
+      ${cfg.extraConfig}

+      ${lib.concatMapStrings (
+        {
+          name,
+          file,
+          master ? true,
+          slaves ? [ ],
+          masters ? [ ],
+          allowQuery ? [ ],
+          extraConfig ? "",
+        }:
+        ''
+          zone "${name}" {
+            type ${if master then "master" else "slave"};
+            file "${file}";
+            ${
+              if master then
+                ''
+                  allow-transfer {
+                    ${lib.concatMapStrings (ip: "${ip};\n") slaves}
+                  };
+                ''
+              else
+                ''
+                  masters {
+                    ${lib.concatMapStrings (ip: "${ip};\n") masters}
+                  };
+                ''
+            }
+            allow-query { ${lib.concatMapStrings (ip: "${ip}; ") allowQuery}};
+            ${extraConfig}
+          };
+        ''
+      ) (lib.attrValues cfg.zones)}
+    '';
+  };
 in

 {
@@ -284,7 +314,8 @@ in
        defaultText = lib.literalExpression "confFile";
        description = ''
          Overridable config file to use for named. By default, that
-          generated by nixos.
+          generated by nixos. If overriden, it will not be checked by
+          named-checkconf.
        '';
      };

@@ -320,16 +351,16 @@ in
      wantedBy = [ "multi-user.target" ];

      preStart = ''
-        if ! [ -f "/etc/bind/rndc.key" ]; then
-          ${bindPkg.out}/sbin/rndc-confgen -c /etc/bind/rndc.key -a -A hmac-sha256 2>/dev/null
+        if ! [ -f ${bindRndcKeyFile} ]; then
+          ${lib.getExe' bindPkg "rndc-confgen"} -c ${bindRndcKeyFile} -a -A ${bindRndcMacType} 2>/dev/null
        fi
      '';

      serviceConfig = {
        Type = "forking"; # Set type to forking, see https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=900788
-        ExecStart = "${bindPkg.out}/sbin/named ${lib.optionalString cfg.ipv4Only "-4"} -c ${cfg.configFile} ${lib.concatStringsSep " " cfg.extraArgs}";
-        ExecReload = "${bindPkg.out}/sbin/rndc -k '/etc/bind/rndc.key' reload";
-        ExecStop = "${bindPkg.out}/sbin/rndc -k '/etc/bind/rndc.key' stop";
+        ExecStart = "${bindNamedExe} ${lib.optionalString cfg.ipv4Only "-4"} -c ${cfg.configFile} ${lib.concatStringsSep " " cfg.extraArgs}";
+        ExecReload = "${bindRndcExe} -k '${bindRndcKeyFile}' reload";
+        ExecStop = "${bindRndcExe} -k '${bindRndcKeyFile}' stop";
        User = bindUser;
        RuntimeDirectory = "named";
        RuntimeDirectoryPreserve = "yes";
@@ -88,9 +88,6 @@ in
      }
    ];

-    system.activationScripts.users = lib.mkForce "";
-    system.activationScripts.hashes = lib.mkForce "";
-
    systemd = {

      # Create home directories, do not create /var/empty even if that's a user's
@@ -1,55 +0,0 @@
-# FileSender {#module-services-filesender}
-
-[FileSender](https://filesender.org/software/) is a software that makes it easy to send and receive big files.
-
-## Quickstart {#module-services-filesender-quickstart}
-
-FileSender uses [SimpleSAMLphp](https://simplesamlphp.org/) for authentication, which needs to be configured separately.
-
-Minimal working instance of FileSender that uses password-authentication would look like this:
-
-```nix
-let
-  format = pkgs.formats.php { };
-in
-{
-  networking.firewall.allowedTCPPorts = [
-    80
-    443
-  ];
-  services.filesender = {
-    enable = true;
-    localDomain = "filesender.example.com";
-    configureNginx = true;
-    database.createLocally = true;
-
-    settings = {
-      auth_sp_saml_authentication_source = "default";
-      auth_sp_saml_uid_attribute = "uid";
-      storage_filesystem_path = "<STORAGE PATH FOR UPLOADED FILES>";
-      admin = "admin";
-      admin_email = "admin@example.com";
-      email_reply_to = "noreply@example.com";
-    };
-  };
-  services.simplesamlphp.filesender = {
-    settings = {
-      "module.enable".exampleauth = true;
-    };
-    authSources = {
-      admin = [ "core:AdminPassword" ];
-      default = format.lib.mkMixedArray [ "exampleauth:UserPass" ] {
-        "admin:admin123" = {
-          uid = [ "admin" ];
-          cn = [ "admin" ];
-          mail = [ "admin@example.com" ];
-        };
-      };
-    };
-  };
-}
-```
-
-::: {.warning}
-Example above uses hardcoded clear-text password, in production you should use other authentication method like LDAP. You can check supported authentication methods [in SimpleSAMLphp documentation](https://simplesamlphp.org/docs/stable/simplesamlphp-idp.html).
-:::
@@ -1,254 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-let
-  format = pkgs.formats.php { finalVariable = "config"; };
-
-  cfg = config.services.filesender;
-  simpleSamlCfg = config.services.simplesamlphp.filesender;
-  fpm = config.services.phpfpm.pools.filesender;
-
-  filesenderConfigDirectory = pkgs.runCommand "filesender-config" { } ''
-    mkdir $out
-    cp ${format.generate "config.php" cfg.settings} $out/config.php
-  '';
-in
-{
-  meta = {
-    maintainers = with lib.maintainers; [ nhnn ];
-    doc = ./filesender.md;
-  };
-
-  options.services.filesender = with lib; {
-    enable = mkEnableOption "FileSender";
-    package = mkPackageOption pkgs "filesender" { };
-    user = mkOption {
-      description = "User under which filesender runs.";
-      type = types.str;
-      default = "filesender";
-    };
-    database = {
-      createLocally = mkOption {
-        type = types.bool;
-        default = true;
-        description = ''
-          Create the PostgreSQL database and database user locally.
-        '';
-      };
-      hostname = mkOption {
-        type = types.str;
-        default = "/run/postgresql";
-        description = "Database hostname.";
-      };
-      port = mkOption {
-        type = types.port;
-        default = 5432;
-        description = "Database port.";
-      };
-      name = mkOption {
-        type = types.str;
-        default = "filesender";
-        description = "Database name.";
-      };
-      user = mkOption {
-        type = types.str;
-        default = "filesender";
-        description = "Database user.";
-      };
-      passwordFile = mkOption {
-        type = types.nullOr types.path;
-        default = null;
-        example = "/run/keys/filesender-dbpassword";
-        description = ''
-          A file containing the password corresponding to
-          [](#opt-services.filesender.database.user).
-        '';
-      };
-    };
-    settings = mkOption {
-      type = types.submodule {
-        freeformType = format.type;
-        options = {
-          site_url = mkOption {
-            type = types.str;
-            description = "Site URL. Used in emails, to build URLs for logging in, logging out, build URL for upload endpoint for web workers, to include scripts etc.";
-          };
-          admin = mkOption {
-            type = types.commas;
-            description = ''
-              UIDs (as per the configured saml_uid_attribute) of FileSender administrators.
-              Accounts with these UIDs can access the Admin page through the web UI.
-            '';
-          };
-          admin_email = mkOption {
-            type = types.commas;
-            description = ''
-              Email address of FileSender administrator(s).
-              Emails regarding disk full etc. are sent here.
-              You should use a role-address here.
-            '';
-          };
-          storage_filesystem_path = mkOption {
-            type = types.nullOr types.str;
-            description = "When using storage type filesystem this is the absolute path to the file system where uploaded files are stored until they expire. Your FileSender storage root.";
-          };
-          log_facilities = mkOption {
-            type = format.type;
-            default = [ { type = "error_log"; } ];
-            description = "Defines where FileSender logging is sent. You can sent logging to a file, to syslog or to the default PHP log facility (as configured through your webserver's PHP module). The directive takes an array of one or more logging targets. Logging can be sent to multiple targets simultaneously. Each logging target is a list containing the name of the logging target and a number of attributes which vary per log target. See below for the exact definiation of each log target.";
-          };
-        };
-      };
-      default = { };
-      description = ''
-        Configuration options used by FileSender.
-        See [](https://docs.filesender.org/filesender/v2.0/admin/configuration/)
-        for available options.
-      '';
-    };
-    configureNginx = mkOption {
-      type = types.bool;
-      default = true;
-      description = "Configure nginx as a reverse proxy for FileSender.";
-    };
-    localDomain = mkOption {
-      type = types.str;
-      example = "filesender.example.org";
-      description = "The domain serving your FileSender instance.";
-    };
-    poolSettings = mkOption {
-      type =
-        with types;
-        attrsOf (oneOf [
-          str
-          int
-          bool
-        ]);
-      default = {
-        "pm" = "dynamic";
-        "pm.max_children" = "32";
-        "pm.start_servers" = "2";
-        "pm.min_spare_servers" = "2";
-        "pm.max_spare_servers" = "4";
-        "pm.max_requests" = "500";
-      };
-      description = ''
-        Options for FileSender's PHP pool. See the documentation on `php-fpm.conf` for details on configuration directives.
-      '';
-    };
-  };
-  config = lib.mkIf cfg.enable {
-    services.simplesamlphp.filesender = {
-      phpfpmPool = "filesender";
-      localDomain = cfg.localDomain;
-      settings.baseurlpath = lib.mkDefault "https://${cfg.localDomain}/saml";
-    };
-
-    services.phpfpm = {
-      pools.filesender = {
-        user = cfg.user;
-        group = config.services.nginx.group;
-        phpEnv = {
-          FILESENDER_CONFIG_DIR = toString filesenderConfigDirectory;
-          SIMPLESAMLPHP_CONFIG_DIR = toString simpleSamlCfg.configDir;
-        };
-        settings = {
-          "listen.owner" = config.services.nginx.user;
-          "listen.group" = config.services.nginx.group;
-        }
-        // cfg.poolSettings;
-      };
-    };
-
-    services.nginx = lib.mkIf cfg.configureNginx {
-      enable = true;
-      virtualHosts.${cfg.localDomain} = {
-        root = "${cfg.package}/www";
-        extraConfig = ''
-          index index.php;
-        '';
-        locations = {
-          "/".extraConfig = ''
-            try_files $uri $uri/ /index.php?args;
-          '';
-          "~ [^/]\\.php(/|$)" = {
-            extraConfig = ''
-              fastcgi_split_path_info  ^(.+\.php)(/.+)$;
-              fastcgi_pass  unix:${fpm.socket};
-              include ${pkgs.nginx}/conf/fastcgi.conf;
-              fastcgi_intercept_errors on;
-              fastcgi_param PATH_INFO       $fastcgi_path_info;
-              fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
-            '';
-          };
-          "~ /\\.".extraConfig = "deny all;";
-        };
-      };
-    };
-
-    services.postgresql = lib.mkIf cfg.database.createLocally {
-      enable = true;
-      ensureDatabases = [ cfg.database.name ];
-      ensureUsers = [
-        {
-          name = cfg.database.user;
-          ensureDBOwnership = true;
-        }
-      ];
-    };
-
-    services.filesender.settings = lib.mkMerge [
-      (lib.mkIf cfg.database.createLocally {
-        db_host = "/run/postgresql";
-        db_port = "5432";
-        db_password = "."; # FileSender requires it even when on UNIX socket auth.
-      })
-      (lib.mkIf (!cfg.database.createLocally) {
-        db_host = cfg.database.hostname;
-        db_port = toString cfg.database.port;
-        db_password = format.lib.mkRaw "file_get_contents('${cfg.database.passwordFile}')";
-      })
-      {
-        site_url = lib.mkDefault "https://${cfg.localDomain}";
-        db_type = "pgsql";
-        db_username = cfg.database.user;
-        db_database = cfg.database.name;
-        "auth_sp_saml_simplesamlphp_url" = "/saml";
-        "auth_sp_saml_simplesamlphp_location" = "${simpleSamlCfg.libDir}";
-      }
-    ];
-
-    systemd.services.filesender-initdb = {
-      description = "Init filesender DB";
-
-      wantedBy = [
-        "multi-user.target"
-        "phpfpm-filesender.service"
-      ];
-      after = [ "postgresql.target" ];
-
-      restartIfChanged = true;
-
-      serviceConfig = {
-        Environment = [
-          "FILESENDER_CONFIG_DIR=${toString filesenderConfigDirectory}"
-          "SIMPLESAMLPHP_CONFIG_DIR=${toString simpleSamlCfg.configDir}"
-        ];
-        Type = "oneshot";
-        Group = config.services.nginx.group;
-        User = "filesender";
-        ExecStart = "${fpm.phpPackage}/bin/php ${cfg.package}/scripts/upgrade/database.php";
-      };
-    };
-
-    users.extraUsers.filesender = lib.mkIf (cfg.user == "filesender") {
-      home = "/var/lib/filesender";
-      group = config.services.nginx.group;
-      createHome = true;
-      isSystemUser = true;
-    };
-  };
-}
@@ -1,128 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-let
-  cfg = config.services.simplesamlphp;
-
-  format = pkgs.formats.php { finalVariable = "config"; };
-
-  generateConfig =
-    opts:
-    pkgs.runCommand "simplesamlphp-config" { } ''
-      mkdir $out
-      cp ${format.generate "config.php" opts.settings} $out/config.php
-      cp ${format.generate "authsources.php" opts.authSources} $out/authsources.php
-    '';
-in
-{
-  meta = {
-    maintainers = with lib.maintainers; [ nhnn ];
-  };
-
-  options.services.simplesamlphp =
-    with lib;
-    mkOption {
-      type = types.attrsOf (
-        types.submodule (
-          { config, ... }:
-          {
-            options = {
-              package = mkPackageOption pkgs "simplesamlphp" { };
-              configureNginx = mkOption {
-                type = types.bool;
-                default = true;
-                description = "Configure nginx as a reverse proxy for SimpleSAMLphp.";
-              };
-              phpfpmPool = mkOption {
-                type = types.str;
-                description = "The PHP-FPM pool that serves SimpleSAMLphp instance.";
-              };
-              localDomain = mkOption {
-                type = types.str;
-                description = "The domain serving your SimpleSAMLphp instance. This option modifies only /saml route.";
-              };
-              settings = mkOption {
-                type = types.submodule {
-                  freeformType = format.type;
-                  options = {
-                    baseurlpath = mkOption {
-                      type = types.str;
-                      example = "https://filesender.example.com/saml/";
-                      description = "URL where SimpleSAMLphp can be reached.";
-                    };
-                  };
-                };
-                default = { };
-                description = ''
-                  Configuration options used by SimpleSAMLphp.
-                  See [](https://simplesamlphp.org/docs/stable/simplesamlphp-install)
-                  for available options.
-                '';
-              };
-
-              authSources = mkOption {
-                type = format.type;
-                default = { };
-                description = ''
-                  Auth sources options used by SimpleSAMLphp.
-                '';
-              };
-
-              libDir = mkOption {
-                type = types.str;
-                readOnly = true;
-                description = ''
-                  Path to the SimpleSAMLphp library directory.
-                '';
-              };
-              configDir = mkOption {
-                type = types.str;
-                readOnly = true;
-                description = ''
-                  Path to the SimpleSAMLphp config directory.
-                '';
-              };
-            };
-            config = {
-              libDir = "${config.package}/share/php/simplesamlphp/";
-              configDir = "${generateConfig config}";
-            };
-          }
-        )
-      );
-      default = { };
-      description = "Instances of SimpleSAMLphp. This module is designed to work with already existing PHP-FPM pool and NGINX virtualHost.";
-    };
-
-  config = lib.mkIf (cfg != { }) {
-    services.phpfpm.pools = lib.mapAttrs' (
-      phpfpmName: opts:
-      lib.nameValuePair opts.phpfpmPool { phpEnv.SIMPLESAMLPHP_CONFIG_DIR = "${generateConfig opts}"; }
-    ) cfg;
-
-    services.nginx.virtualHosts = lib.mapAttrs' (
-      phpfpmName: opts:
-      lib.nameValuePair opts.localDomain (
-        lib.mkIf opts.configureNginx {
-          locations."^~ /saml/" = {
-            alias = "${opts.package}/share/php/simplesamlphp/www/";
-            extraConfig = ''
-                location ~ ^(?<prefix>/saml)(?<phpfile>.+?\.php)(?<pathinfo>/.*)?$ {
-                  include ${pkgs.nginx}/conf/fastcgi.conf;
-                  fastcgi_split_path_info  ^(.+\.php)(/.+)$;
-                  fastcgi_pass  unix:${config.services.phpfpm.pools.${phpfpmName}.socket};
-                  fastcgi_intercept_errors on;
-                  fastcgi_param SCRIPT_FILENAME $document_root$phpfile;
-                  fastcgi_param SCRIPT_NAME /saml$phpfile;
-                  fastcgi_param PATH_INFO $pathinfo if_not_empty;
-              }
-            '';
-          };
-        }
-      )
-    ) cfg;
-  };
-}
@@ -532,7 +532,6 @@ in
  ferretdb = import ./ferretdb.nix { inherit pkgs runTest; };
  fider = runTest ./fider.nix;
  filebrowser = runTest ./filebrowser.nix;
-  filesender = runTest ./filesender.nix;
  filesystems-overlayfs = runTest ./filesystems-overlayfs.nix;
  firefly-iii = runTest ./firefly-iii.nix;
  firefly-iii-data-importer = runTest ./firefly-iii-data-importer.nix;
@@ -1,146 +0,0 @@
-{ pkgs, lib, ... }:
-{
-  name = "filesender";
-  meta = {
-    maintainers = with lib.maintainers; [ nhnn ];
-    broken = pkgs.stdenv.hostPlatform.isAarch64; # selenium.common.exceptions.WebDriverException: Message: Unsupported platform/architecture combination: linux/aarch64
-  };
-
-  nodes.filesender =
-    { ... }:
-    let
-      format = pkgs.formats.php { };
-    in
-    {
-      networking.firewall.allowedTCPPorts = [ 80 ];
-
-      services.filesender.enable = true;
-      services.filesender.localDomain = "filesender";
-      services.filesender.settings = {
-        auth_sp_saml_authentication_source = "default";
-        auth_sp_saml_uid_attribute = "uid";
-        storage_filesystem_path = "/tmp";
-        site_url = "http://filesender";
-        force_ssl = false;
-        admin = "";
-        admin_email = "admin@localhost";
-        email_reply_to = "noreply@localhost";
-      };
-      services.simplesamlphp.filesender = {
-        settings = {
-          baseurlpath = "http://filesender/saml";
-          "module.enable".exampleauth = true;
-        };
-        authSources = {
-          admin = [ "core:AdminPassword" ];
-          default = format.lib.mkMixedArray [ "exampleauth:UserPass" ] {
-            "user:password" = {
-              uid = [ "user" ];
-              cn = [ "user" ];
-              mail = [ "user@nixos.org" ];
-            };
-          };
-        };
-      };
-    };
-
-  nodes.client =
-    {
-      pkgs,
-      nodes,
-      ...
-    }:
-    let
-      filesenderIP = (builtins.head (nodes.filesender.networking.interfaces.eth1.ipv4.addresses)).address;
-    in
-    {
-      networking.hosts.${filesenderIP} = [ "filesender" ];
-
-      environment.systemPackages =
-        let
-          username = "user";
-          password = "password";
-          browser-test =
-            pkgs.writers.writePython3Bin "browser-test"
-              {
-                libraries = [ pkgs.python3Packages.selenium ];
-                flakeIgnore = [
-                  "E124"
-                  "E501"
-                ];
-              }
-              ''
-                from selenium.webdriver.common.by import By
-                from selenium.webdriver import Firefox
-                from selenium.webdriver.firefox.options import Options
-                from selenium.webdriver.firefox.firefox_profile import FirefoxProfile
-                from selenium.webdriver.firefox.service import Service
-                from selenium.webdriver.support.ui import WebDriverWait
-                from selenium.webdriver.support import expected_conditions as EC
-                from subprocess import STDOUT
-                import string
-                import random
-                import logging
-                import time
-                selenium_logger = logging.getLogger("selenium")
-                selenium_logger.setLevel(logging.DEBUG)
-                selenium_logger.addHandler(logging.StreamHandler())
-                profile = FirefoxProfile()
-                profile.set_preference("browser.download.folderList", 2)
-                profile.set_preference("browser.download.manager.showWhenStarting", False)
-                profile.set_preference("browser.download.dir", "/tmp/firefox")
-                profile.set_preference("browser.helperApps.neverAsk.saveToDisk", "text/plain;text/txt")
-                options = Options()
-                options.profile = profile
-                options.add_argument('--headless')
-                service = Service(log_output=STDOUT)
-                driver = Firefox(options=options)
-                driver.set_window_size(1024, 768)
-                driver.implicitly_wait(30)
-                driver.get('http://filesender/')
-                wait = WebDriverWait(driver, 20)
-                wait.until(EC.title_contains("FileSender"))
-                driver.find_element(By.ID, "btn_logon").click()
-                wait.until(EC.title_contains("Enter your username and password"))
-                driver.find_element(By.ID, 'username').send_keys(
-                    '${username}'
-                )
-                driver.find_element(By.ID, 'password').send_keys(
-                    '${password}'
-                )
-                driver.find_element(By.ID, "submit_button").click()
-                wait.until(EC.title_contains("FileSender"))
-                wait.until(EC.presence_of_element_located((By.ID, "topmenu_logoff")))
-                test_string = "".join(random.choices(string.ascii_uppercase + string.digits, k=20))
-                with open("/tmp/test_file.txt", "w") as file:
-                    file.write(test_string)
-                driver.find_element(By.ID, "files").send_keys("/tmp/test_file.txt")
-                time.sleep(2)
-                driver.find_element(By.CSS_SELECTOR, '.start').click()
-                wait.until(EC.presence_of_element_located((By.CSS_SELECTOR, ".download_link")))
-                download_link = driver.find_element(By.CSS_SELECTOR, '.download_link > textarea').get_attribute('value').strip()
-                driver.get(download_link)
-                wait.until(EC.presence_of_element_located((By.CSS_SELECTOR, ".download")))
-                driver.find_element(By.CSS_SELECTOR, '.download').click()
-                wait.until(EC.presence_of_element_located((By.CSS_SELECTOR, ".ui-dialog-buttonset > button:nth-child(2)")))
-                driver.find_element(By.CSS_SELECTOR, ".ui-dialog-buttonset > button:nth-child(2)").click()
-                driver.close()
-                driver.quit()
-              '';
-        in
-        [
-          pkgs.firefox-unwrapped
-          pkgs.geckodriver
-          browser-test
-        ];
-    };
-
-  testScript = ''
-    start_all()
-    filesender.wait_for_file("/run/phpfpm/filesender.sock")
-    filesender.wait_for_open_port(80)
-    if "If you have received an invitation to access this site as a guest" not in client.wait_until_succeeds("curl -sS -f http://filesender"):
-      raise Exception("filesender returned invalid html")
-    client.succeed("browser-test")
-  '';
-}
@@ -279,3 +279,89 @@
  "bytes",
  "futures-util",
  "http 1.3.1",
+
+--- a/pagefind_web/Cargo.lock
+++ b/pagefind_web/Cargo.lock
+@@ -89,6 +89,12 @@ dependencies = [
+  "proc-macro2",
+ ]
+ 
+[[package]]
+name = "rustversion"
+version = "1.0.22"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d"
+
+ [[package]]
+ name = "syn"
+ version = "2.0.55"
+@@ -108,23 +114,25 @@ checksum = "3354b9ac3fae1ff6755cb6db53683adb661634f67557942dea4facebec0fee4b"
+ 
+ [[package]]
+ name = "wasm-bindgen"
+-version = "0.2.92"
+version = "0.2.104"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "4be2531df63900aeb2bca0daaaddec08491ee64ceecbee5076636a3b026795a8"
+checksum = "c1da10c01ae9f1ae40cbfac0bac3b1e724b320abfcf52229f80b547c0d250e2d"
+ dependencies = [
+  "cfg-if",
+ "once_cell",
+ "rustversion",
+  "wasm-bindgen-macro",
+ "wasm-bindgen-shared",
+ ]
+ 
+ [[package]]
+ name = "wasm-bindgen-backend"
+-version = "0.2.92"
+version = "0.2.104"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "614d787b966d3989fa7bb98a654e369c762374fd3213d212cfc0251257e747da"
+checksum = "671c9a5a66f49d8a47345ab942e2cb93c7d1d0339065d4f8139c486121b43b19"
+ dependencies = [
+  "bumpalo",
+  "log",
+- "once_cell",
+  "proc-macro2",
+  "quote",
+  "syn",
+@@ -133,9 +141,9 @@ dependencies = [
+ 
+ [[package]]
+ name = "wasm-bindgen-macro"
+-version = "0.2.92"
+version = "0.2.104"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "a1f8823de937b71b9460c0c34e25f3da88250760bec0ebac694b49997550d726"
+checksum = "7ca60477e4c59f5f2986c50191cd972e3a50d8a95603bc9434501cf156a9a119"
+ dependencies = [
+  "quote",
+  "wasm-bindgen-macro-support",
+@@ -143,9 +151,9 @@ dependencies = [
+ 
+ [[package]]
+ name = "wasm-bindgen-macro-support"
+-version = "0.2.92"
+version = "0.2.104"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "e94f17b526d0a461a191c78ea52bbce64071ed5c04c9ffe424dcb38f74171bb7"
+checksum = "9f07d2f20d4da7b26400c9f4a0511e6e0345b040694e8a75bd41d578fa4421d7"
+ dependencies = [
+  "proc-macro2",
+  "quote",
+@@ -156,9 +164,12 @@ dependencies = [
+ 
+ [[package]]
+ name = "wasm-bindgen-shared"
+-version = "0.2.92"
+version = "0.2.104"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "af190c94f2773fdb3729c55b007a722abb5384da03bc0986df4c289bf5567e96"
+checksum = "bad67dc8b2a1a6e5448428adec4c3e84c43e561d8c9ee8a9e5aabeb193ec41d1"
+dependencies = [
+ "unicode-ident",
+]
+ 
+ [[package]]
+ name = "write-json" "http 1.3.1",
@@ -12,7 +12,7 @@
  python3,
  rustc,
  versionCheckHook,
-  wasm-bindgen-cli_0_2_92,
+  wasm-bindgen-cli_0_2_104,
  wasm-pack,
 }:

@@ -72,8 +72,9 @@ rustPlatform.buildRustPackage (finalAttrs: {
  env.cargoDeps_web = rustPlatform.fetchCargoVendor {
    name = "cargo-deps-web-${finalAttrs.version}";
    inherit (finalAttrs) src;
+    patches = [ ./web-cargo-lock.patch ];
    sourceRoot = "${finalAttrs.src.name}/pagefind_web";
-    hash = "sha256-DaipINtwePA03YdbSzh6EjH4Q13P3CB9lwcmTOR54dM=";
+    hash = "sha256-TdbNvDF4WQ2xgkKGVmmZ8R2Wga21OUaGmey/2HVWVcQ=";
  };
  env.npmDeps_web_js = fetchNpmDeps {
    name = "pagefind-npm-deps-web-js-${finalAttrs.version}";
@@ -165,7 +166,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    nodejs
    rustc
    rustc.llvmPackages.lld
-    wasm-bindgen-cli_0_2_92
+    wasm-bindgen-cli_0_2_104
    wasm-pack
  ]
  ++ lib.optionals stdenv.buildPlatform.isDarwin [
@@ -0,0 +1,85 @@
+--- a/Cargo.lock
+++ b/Cargo.lock
+@@ -89,6 +89,12 @@ dependencies = [
+  "proc-macro2",
+ ]
+ 
+[[package]]
+name = "rustversion"
+version = "1.0.22"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d"
+
+ [[package]]
+ name = "syn"
+ version = "2.0.55"
+@@ -108,23 +114,25 @@ checksum = "3354b9ac3fae1ff6755cb6db53683adb661634f67557942dea4facebec0fee4b"
+ 
+ [[package]]
+ name = "wasm-bindgen"
+-version = "0.2.92"
+version = "0.2.104"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "4be2531df63900aeb2bca0daaaddec08491ee64ceecbee5076636a3b026795a8"
+checksum = "c1da10c01ae9f1ae40cbfac0bac3b1e724b320abfcf52229f80b547c0d250e2d"
+ dependencies = [
+  "cfg-if",
+ "once_cell",
+ "rustversion",
+  "wasm-bindgen-macro",
+ "wasm-bindgen-shared",
+ ]
+ 
+ [[package]]
+ name = "wasm-bindgen-backend"
+-version = "0.2.92"
+version = "0.2.104"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "614d787b966d3989fa7bb98a654e369c762374fd3213d212cfc0251257e747da"
+checksum = "671c9a5a66f49d8a47345ab942e2cb93c7d1d0339065d4f8139c486121b43b19"
+ dependencies = [
+  "bumpalo",
+  "log",
+- "once_cell",
+  "proc-macro2",
+  "quote",
+  "syn",
+@@ -133,9 +141,9 @@ dependencies = [
+ 
+ [[package]]
+ name = "wasm-bindgen-macro"
+-version = "0.2.92"
+version = "0.2.104"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "a1f8823de937b71b9460c0c34e25f3da88250760bec0ebac694b49997550d726"
+checksum = "7ca60477e4c59f5f2986c50191cd972e3a50d8a95603bc9434501cf156a9a119"
+ dependencies = [
+  "quote",
+  "wasm-bindgen-macro-support",
+@@ -143,9 +151,9 @@ dependencies = [
+ 
+ [[package]]
+ name = "wasm-bindgen-macro-support"
+-version = "0.2.92"
+version = "0.2.104"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "e94f17b526d0a461a191c78ea52bbce64071ed5c04c9ffe424dcb38f74171bb7"
+checksum = "9f07d2f20d4da7b26400c9f4a0511e6e0345b040694e8a75bd41d578fa4421d7"
+ dependencies = [
+  "proc-macro2",
+  "quote",
+@@ -156,9 +164,12 @@ dependencies = [
+ 
+ [[package]]
+ name = "wasm-bindgen-shared"
+-version = "0.2.92"
+version = "0.2.104"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "af190c94f2773fdb3729c55b007a722abb5384da03bc0986df4c289bf5567e96"
+checksum = "bad67dc8b2a1a6e5448428adec4c3e84c43e561d8c9ee8a9e5aabeb193ec41d1"
+dependencies = [
+ "unicode-ident",
+]
+ 
+ [[package]]
+ name = "write-json" "http 1.3.1",
@@ -28,13 +28,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "xdg-desktop-portal-hyprland";
-  version = "1.3.10";
+  version = "1.3.11";

  src = fetchFromGitHub {
    owner = "hyprwm";
    repo = "xdg-desktop-portal-hyprland";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-js2sLRtsOUA/aT10OCDaTjO80yplqwOIaLUqEe0nMx0=";
+    hash = "sha256-5HXelmz2x/uO26lvW7MudnadbAfoBnve4tRBiDVLtOM=";
  };

  depsBuildBuild = [
@@ -27,7 +27,7 @@ php82.buildComposerProject2 (finalAttrs: {
    runHook postInstall
  '';

-  vendorHash = "sha256-tBB3Zl/N1XqPTD84at5WoGrD0G5rJbobk4E8BFOSm+M=";
+  vendorHash = "sha256-cg9OIBvWX69yU6U6Ag/T3jScG2OUdpTqc+KwP6VyUHo=";
  composerStrictValidation = false;

  passthru.updateScript = nix-update-script { };
@@ -17,14 +17,14 @@
 }:
 python3.pkgs.buildPythonApplication rec {
  pname = "alacarte";
-  version = "3.56.0";
+  version = "3.58.0";

  src = fetchFromGitLab {
    domain = "gitlab.gnome.org";
    owner = "GNOME";
    repo = "alacarte";
    tag = version;
-    hash = "sha256-sH/2ULI1QEqmgFIFFnOwsx2/+TMt+bPu0l0LUcnBgWg=";
+    hash = "sha256-U3shnQ1GlDvOQFfjYVfAhCVRVQpTyLwEzHqKIbBChas=";
  };

  format = "other";
@@ -21,5 +21,7 @@ php.buildComposerProject2 (finalAttrs: {
    homepage = "https://sabre.io/baikal/";
    license = lib.licenses.gpl3Only;
    maintainers = with lib.maintainers; [ wrvsrx ];
+    # vendorHash non-reproducible
+    broken = true;
  };
 })
@@ -9,16 +9,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "bulletty";
-  version = "0.1.8";
+  version = "0.1.9";

  src = fetchFromGitHub {
    owner = "CrociDB";
    repo = "bulletty";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-MVXz3ozAL26EYWAsarFbRR0cmAtaRpxcQROsLye56yE=";
+    hash = "sha256-fNMUdZ5WoDUVShiKl4pitkcOlHYTKXUVfiAHVqpdWmo=";
  };

-  cargoHash = "sha256-Q9h9VUTeFvP6pkQKj7y2pKVpoeg1hyoAbXMhAaO5zh8=";
+  cargoHash = "sha256-ZdJtFPEjPDQSUEtdPv3uIH44wa6mGPzm/KRp5VTOb1Y=";

  # perl is required for bulletty package build for openssl
  nativeBuildInputs = with pkgs; [
@@ -16,7 +16,7 @@ php.buildComposerProject2 (finalAttrs: {
    hash = "sha256-UAofdc8mqSnJXhCTABSf9JZERqur86lzNDI66EHgEQE=";
  };

-  vendorHash = "sha256-bNeQEfwXly3LFuEKeSK6J6pRfQF6TNwUqu3SdTswmFI=";
+  vendorHash = "sha256-TlBrL4KyMVHaxqlfvnTkj3TkmU8h5/0BRC5e8yWrhCI=";

  doInstallCheck = true;
  nativeInstallCheckInputs = [ versionCheckHook ];
@@ -15,7 +15,7 @@ php.buildComposerProject2 (finalAttrs: {
    hash = "sha256-wtkixHexsJNKsLnnlHssh0IzxwWYMPKDcaf/D0zUNKk=";
  };

-  vendorHash = "sha256-0uBI30n31W0eDVA9/W366O0Qo2jWZBqEL+YbJx4J7P0=";
+  vendorHash = "sha256-/bf1rvoG1N6GNqisBwMqY05qhTsy7gMeWXarXgElU/M=";

  meta = {
    changelog = "https://github.com/deployphp/deployer/releases/tag/v${finalAttrs.version}";
@@ -9,13 +9,13 @@

 buildDotnetModule (finalAttrs: {
  pname = "empire-compiler";
-  version = "0.4.0";
+  version = "0.4.1";

  src = fetchFromGitHub {
    owner = "bc-security";
    repo = "empire-compiler";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-DzX78ks+fWjv170c7IGZHWnWhhBnrI8ueTL7hxIhJb0=";
+    hash = "sha256-BuNg5RetGEV/YAZnZP7rkMHif9NczOx2e4OAVDjafuI=";
  };

  postPatch = ''
@@ -23,7 +23,7 @@ php.buildComposerProject2 (finalAttrs: {

  inherit php;

-  vendorHash = "sha256-0Mv48mB/pTQtYd2do6wTdhD/c2zwbU1gTYsdU7rELPY=";
+  vendorHash = "sha256-ODJgsvECw+q3sAA6pWNw4X2Png7f4G2Jty9AQSj/SgE=";
  composoerNoDev = true;
  composerStrictValidation = false;

@@ -1,43 +0,0 @@
-{
-  stdenv,
-  fetchFromGitHub,
-  lib,
-  nixosTests,
-}:
-stdenv.mkDerivation (finalAttrs: {
-  pname = "filesender";
-  version = "2.57";
-
-  src = fetchFromGitHub {
-    owner = "filesender";
-    repo = "filesender";
-    tag = "filesender-${finalAttrs.version}";
-    hash = "sha256-I/9Y64jWm7QdQ1yhjCHkLfkKrzV6y0Rp+wkZbDP86fw=";
-  };
-
-  patches = [
-    # /nix/store is read-only, but filesender searches config and logs inside of installation directory.
-    # This patch changes search directories to FILESENDER_CONFIG_DIR and FILESENDER_LOG_DIR environment variables.
-    ./separate_mutable_paths.patch
-  ];
-
-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p $out/
-    cp -R . $out/
-
-    runHook postInstall
-  '';
-
-  passthru.tests = {
-    inherit (nixosTests) filesender;
-  };
-
-  meta = {
-    description = "Web application for sending large files to other users";
-    homepage = "https://filesender.org/";
-    license = lib.licenses.bsd3;
-    maintainers = with lib.maintainers; [ nhnn ];
-  };
-})
@@ -1,122 +0,0 @@
-diff --git a/classes/utils/Config.class.php b/classes/utils/Config.class.php
-index a4d819bc..318defdf 100644
--- a/classes/utils/Config.class.php
-+++ b/classes/utils/Config.class.php
-@@ -30,7 +30,7 @@
-  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-  */
- 
-if (!defined('FILESENDER_BASE')) {        // Require environment (fatal)
-+if (!defined('FILESENDER_BASE') || !defined("FILESENDER_CONFIG_DIR")) {        // Require environment (fatal)
-     die('Missing environment');
- }
- 
-@@ -116,7 +116,7 @@ class Config
-         }
-         
-         // Check if main config exists
-        $main_config_file = FILESENDER_BASE.'/config/config.php';
-+        $main_config_file = FILESENDER_CONFIG_DIR.'/config.php';
-         if (!file_exists($main_config_file)) {
-             throw new ConfigFileMissingException($main_config_file);
-         }
-@@ -136,7 +136,7 @@ class Config
- 
- 
-         // load password file if it is there
-        $pass_config_file = FILESENDER_BASE.'/config/config-passwords.php';
-+        $pass_config_file = FILESENDER_CONFIG_DIR.'/config-passwords.php';
-         if (file_exists($pass_config_file)) {
-             $config = array();
-             include_once($pass_config_file);
-@@ -153,7 +153,7 @@ class Config
-                 throw new ConfigBadParameterException('virtualhost');
-             }
-             
-            $config_file = FILESENDER_BASE.'/config/'.$virtualhost.'/config.php';
-+            $config_file = FILESENDER_CONFIG_DIR.$virtualhost.'/config.php';
-             if (!file_exists($config_file)) {
-                 throw new ConfigFileMissingException($config_file);
-             } // Should exist even if empty
-@@ -175,7 +175,7 @@ class Config
-                         }
-                         foreach ($regex_and_configs as $regex => $extra_config_name) {
-                                 if (preg_match('`'.$regex.'`', $auth_attrs[$attr])) {
-                                        $extra_config_file = FILESENDER_BASE.'/config/config-' . $extra_config_name . '.php';
-+                                        $extra_config_file = FILESENDER_CONFIG_DIR.'/config-' . $extra_config_name . '.php';
-                                         if (file_exists($extra_config_file)) {
-                                                 $config = array();
-                                                 include_once($extra_config_file);
-@@ -204,7 +204,7 @@ class Config
-         // Load config overrides if any
-         $overrides_cfg = self::get('config_overrides');
-         if ($overrides_cfg) {
-            $overrides_file = FILESENDER_BASE.'/config/'.($virtualhost ? $virtualhost.'/' : '').'config_overrides.json';
-+            $overrides_file = FILESENDER_CONFIG_DIR.($virtualhost ? $virtualhost.'/' : '').'config_overrides.json';
-             
-             $overrides = file_exists($overrides_file) ? json_decode(trim(file_get_contents($overrides_file))) : new StdClass();
-             
-@@ -431,7 +431,7 @@ class Config
-     public static function getVirtualhosts()
-     {
-         $virtualhosts = array();
-        foreach (scandir(FILESENDER_BASE.'/config') as $item) {
-+        foreach (scandir(FILESENDER_CONFIG_DIR) as $item) {
-             if (!preg_match('`^(.+)\.conf\.php$`', $item, $match)) {
-                 continue;
-             }
-diff --git a/config/csrf-protector-config.php b/config/csrf-protector-config.php
-index 83759ca4..ea4a3173 100755
--- a/config/csrf-protector-config.php
-+++ b/config/csrf-protector-config.php
-@@ -40,7 +40,7 @@ return array(
- 	 // The following should be set correctly from your config.php
- 	 // information
- 	"jsUrl" => $config['site_url'] . "/js/csrfprotector.js",
-	"logDirectory" => FILESENDER_BASE.'/log/',
-+	"logDirectory" => FILESENDER_LOG_DIR,
- 
-         // I found that leaving this with the _ as default
-         // caused the implicit token to be stripped
-diff --git a/includes/ConfigDefaults.php b/includes/ConfigDefaults.php
-index 733550e7..8d99b5f0 100644
--- a/includes/ConfigDefaults.php
-+++ b/includes/ConfigDefaults.php
-@@ -224,7 +224,7 @@ $default = array(
-     'log_facilities' => array(
-         array(
-             'type' => 'file',
-            'path' => FILESENDER_BASE.'/log/',
-+            'path' => FILESENDER_LOG_DIR,
-             'rotate' => 'hourly'
-         )
-     ),
-diff --git a/includes/ConfigValidation.php b/includes/ConfigValidation.php
-index 5c1e7f61..b1fb57e4 100644
--- a/includes/ConfigValidation.php
-+++ b/includes/ConfigValidation.php
-@@ -31,9 +31,9 @@
-  */
- 
- // Require environment (fatal)
-if(!defined('FILESENDER_BASE')) die('Missing environment');
-+if(!defined('FILESENDER_BASE') || !defined("FILESENDER_CONFIG_DIR")) die('Missing environment');
- 
-if(!file_exists(FILESENDER_BASE.'/config/config.php'))
-+if(!file_exists(FILESENDER_CONFIG_DIR.'/config.php'))
-     die('Configuration file not found');
- 
- ConfigValidator::addCheck('site_url', 'string');
-diff --git a/includes/init.php b/includes/init.php
-index ba7fa82f..31812c54 100644
--- a/includes/init.php
-+++ b/includes/init.php
-@@ -35,6 +35,8 @@ if(PHP_INT_SIZE !== 8) {
- }
- 
- define('FILESENDER_BASE', dirname( __DIR__ ));
-+define('FILESENDER_CONFIG_DIR', getenv('FILESENDER_CONFIG_DIR', true) ?: (FILESENDER_BASE.'/config'));
-+define('FILESENDER_LOG_DIR', getenv('FILESENDER_LOG_DIR', true) ?: (FILESENDER_BASE.'/log'));
- 
- // Include classes autoloader
- require_once(FILESENDER_BASE.'/classes/autoload.php');
@@ -17,7 +17,7 @@ php.buildComposerProject2 (finalAttrs: {

  composerLock = ./composer.lock;
  composerStrictValidation = false;
-  vendorHash = "sha256-pup+ZfPEnqoA3wEXQNn4pWTYXri6d4XzMfuc8k1SeQk=";
+  vendorHash = "sha256-4wB8MRnqnruo9VXupMmAqiRSZx8F2i+8zcOphTeDp1g=";

  meta = with lib; {
    changelog = "https://github.com/flarum/framework/blob/main/CHANGELOG.md";
@@ -26,6 +26,7 @@
  stdenv,
  fetchFromGitea,
  buildNpmPackage,
+  writableTmpDirAsHomeHook,
 }:

 let
@@ -77,6 +78,7 @@ buildGoModule rec {
  nativeCheckInputs = [
    git
    openssh
+    writableTmpDirAsHomeHook
  ];

  patches = [
@@ -103,14 +105,12 @@ buildGoModule rec {
    export ldflags+=" -X main.ForgejoVersion=$(GITEA_VERSION=${version} make show-version-api)"
  '';

+  # expose and use the GO_TEST_PACKAGES var from the Makefile
+  # instead of manually copying over the entire list:
+  # https://codeberg.org/forgejo/forgejo/src/tag/v11.0.6/Makefile#L128
+  # https://codeberg.org/forgejo/forgejo/src/tag/v13.0.0/Makefile#L290
  preCheck = ''
-    # $HOME is required for ~/.ssh/authorized_keys and such
-    export HOME="$TMPDIR/home"
-
-    # expose and use the GO_TEST_PACKAGES var from the Makefile
-    # instead of manually copying over the entire list:
-    # https://codeberg.org/forgejo/forgejo/src/tag/v7.0.4/Makefile#L124
-    echo -e 'show-backend-tests:\n\t@echo ''${GO_TEST_PACKAGES}' >> Makefile
+    echo -e 'show-backend-tests:${lib.optionalString (lib.versionAtLeast version "13") " | compute-go-test-packages"}\n\t@echo ''${GO_TEST_PACKAGES}' >> Makefile
    getGoDirs() {
      make show-backend-tests
    }
@@ -1,6 +1,6 @@
 import ./generic.nix {
-  version = "13.0.0";
-  hash = "sha256-8NRUJpf25Bai0NtzYf2APmOt3rqpP9mPM13KMjNLl2M=";
+  version = "13.0.1";
+  hash = "sha256-P8ZIBV0pVo3cn9Yroe67Bt+/7KEdz/gBGSypmUz5V2g=";
  npmDepsHash = "sha256-7WjcMsKPtKUWJfDrJc65ZXq2tjK8+8DnqwINj+0XyiQ=";
  vendorHash = "sha256-PHItbU27d9ouykUlhr9owylMpF+3wz2vc8c0UTR1RVU=";
  lts = false;
@@ -11,16 +11,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "fzf-make";
-  version = "0.63.0";
+  version = "0.65.0";

  src = fetchFromGitHub {
    owner = "kyu08";
    repo = "fzf-make";
    rev = "v${version}";
-    hash = "sha256-waSi5zqUy9Rfb/knoKACPLJy7qEWdZa/AX6xGFUYhoU=";
+    hash = "sha256-KL2dRyfwwa365hEMeVixAP9DFx3QObJVeesj95tOUmo=";
  };

-  cargoHash = "sha256-KniWZ/ASfStUodUfNSDtPmScR/egOkGABVMcUuIdUM0=";
+  cargoHash = "sha256-QaR0Se8ecNKj7OcngwEOrK63VT200D+/Xm3RaIiLdec=";

  nativeBuildInputs = [ makeBinaryWrapper ];

@@ -6,6 +6,7 @@
  pkg-config,
  perl,
  webkitgtk_4_1,
+  stdenv,
 }:

 rustPlatform.buildRustPackage rec {
@@ -29,10 +30,12 @@ rustPlatform.buildRustPackage rec {
  ];
  buildInputs = [
    openssl
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [
    webkitgtk_4_1
  ];

-  meta = with lib; {
+  meta = {
    changelog = "https://github.com/${src.owner}/${src.repo}/blob/${src.rev}/changelog.md";
    description = "CLI for GlobalProtect VPN, based on OpenConnect, supports the SSO authentication method";
    longDescription = ''
@@ -43,14 +46,11 @@ rustPlatform.buildRustPackage rec {
      the same features as the GUI version.
    '';
    homepage = "https://github.com/${src.owner}/${src.repo}";
-    license = with licenses; [ gpl3Only ];
-    maintainers = with maintainers; [
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [
      binary-eater
      m1dugh
    ];
-    platforms = [
-      "aarch64-linux"
-      "x86_64-linux"
-    ];
+    platforms = with lib.platforms; linux ++ darwin;
  };
 }
@@ -19,7 +19,7 @@ php.buildComposerProject2 (finalAttrs: {
    hash = "sha256-MnN6TIkNZWT+pAQf0+z5l3hj/7K/d3BfI7VAaUEKG8s=";
  };

-  vendorHash = "sha256-n+6yNXqarWRZt6VEuHrFe3nrTiGeHnkURmO2UuB/BVc=";
+  vendorHash = "sha256-6vWV8+4tETUFBLeEoG7d8lHKILXvM7ezWbDiG11GA/s=";

  offlineCache = fetchYarnDeps {
    yarnLock = finalAttrs.src + "/yarn.lock";
@@ -0,0 +1,63 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchzip,
+  writeShellApplication,
+  curl,
+  gnugrep,
+  common-updater-scripts,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "ipamjfont";
+  version = "006.01";
+
+  src =
+    let
+      suffix = lib.strings.replaceString "." "" finalAttrs.version;
+    in
+    fetchzip {
+      url = "https://dforest.watch.impress.co.jp/library/i/ipamjfont/10750/ipamjm${suffix}.zip";
+      hash = "sha256-Rft8hmxm3D4hOaLaSYDfD14oarDIHUQkMZX+/ZDD4m0=";
+      stripRoot = false;
+    };
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm444 *.ttf -t "$out/share/fonts/truetype/"
+
+    runHook postInstall
+  '';
+
+  passthru = {
+    updateScript = lib.getExe (writeShellApplication {
+      name = "${finalAttrs.pname}-updater";
+
+      runtimeInputs = [
+        curl
+        gnugrep
+        common-updater-scripts
+      ];
+
+      text = ''
+        suffix="$(
+          curl --fail --silent 'https://forest.watch.impress.co.jp/library/software/ipamjfont/download_10750.html' | \
+            grep --perl-regexp --only-matching 'meta.+?ipamjm\K[0-9]+'
+        )"
+        version="''${suffix:0:3}.''${suffix:3:2}"
+        update-source-version '${finalAttrs.pname}' "$version" --ignore-same-version --print-changes
+      '';
+    });
+  };
+
+  meta = {
+    description = "Japanese Mincho font implementing IVS compliant with Hanyo-Denshi collection";
+    downloadPage = "https://forest.watch.impress.co.jp/library/software/ipamjfont/";
+    homepage = "https://moji.or.jp/mojikiban/font/";
+    license = lib.licenses.ipa;
+    maintainers = with lib.maintainers; [
+      kachick
+    ];
+  };
+})
@@ -20,13 +20,13 @@

 stdenv.mkDerivation rec {
  pname = "libdeltachat";
-  version = "2.20.0";
+  version = "2.22.0";

  src = fetchFromGitHub {
    owner = "chatmail";
    repo = "core";
    tag = "v${version}";
-    hash = "sha256-QPKy88c/GLeazGCjNYHj5kOxwiuvjJ/+pM4SQ4TZ1sw=";
+    hash = "sha256-DKqqdcG3C7/RF/wz2SqaiPUjZ/7vMFJTR5DIGTXjoTY=";
  };

  patches = [
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
  cargoDeps = rustPlatform.fetchCargoVendor {
    pname = "chatmail-core";
    inherit version src;
-    hash = "sha256-2Js4VQsXf1ApRq9Vf1xwX/1BXiFUQgykvofb2ykOdcc=";
+    hash = "sha256-x71vytk9ytIhHlRR0lDhDcIaDNJGDdPwb6fkB1SI+NQ=";
  };

  nativeBuildInputs = [
@@ -70,13 +70,13 @@ lib.checkListOfEnum "${pname}: colorVariants" colorVariantList colorVariants lib
  stdenvNoCC.mkDerivation
  {
    inherit pname;
-    version = "0-unstable-2025-07-28";
+    version = "0-unstable-2025-10-15";

    src = fetchFromGitHub {
      owner = "D3vil0p3r";
      repo = "Matrix-GTK-Theme";
-      rev = "fe8152fff81630efca6dedefe4b7f766fb2700f9";
-      hash = "sha256-maGRPw9qeKTy5JzDvrQIYe2zi4plhDu4NgjevizTAEE=";
+      rev = "d76d8c69cb1fca0f050009ee5893c65954f3ddfe";
+      hash = "sha256-RJKHSBj33QR9ahkMd2HwG7FCUB8gtfTzIp0174TPHPE=";
    };

    propagatedUserEnvPkgs = [ gtk-engine-murrine ];
@@ -88,7 +88,7 @@ php.buildComposerProject2 (finalAttrs: {
    ++ lib.optional minify.style.enable lightningcss
    ++ lib.optional minify.svg.enable scour;

-  vendorHash = "sha256-xkFyjs3jW7j+8WosRaxBEYQU2dwQlDr4/nrdtW03xvA=";
+  vendorHash = "sha256-Ke+bh/mvKUk5qxjlBZo4jJhLneyFRq0HYXTwK/KZMBs=";

  postPatch = ''
    # Our modules are already wrapped, removes missing *.so warnings;
@@ -17,7 +17,7 @@ php.buildComposerProject2 (finalAttrs: {
  };

  composerLock = ./composer.lock;
-  vendorHash = "sha256-szKVZhWcd8p4307irNqgSAK2+hl8AW+gCPyf0EEco8A=";
+  vendorHash = "sha256-uK+nJFXDVPYFbosAUxqu+mmNsD7AnZ18NnIN9FYAaPQ=";

  nativeInstallCheckInputs = [ versionCheckHook ];
  doInstallCheck = true;
@@ -16,7 +16,7 @@ php.buildComposerProject2 (finalAttrs: {
  };

  composerLock = ./composer.lock;
-  vendorHash = "sha256-rOJ6PFp4Xfe89usoH455EAT30d2Tu3zd3+C/6K/kGBw=";
+  vendorHash = "sha256-4CpyerXmfXbwsNsK16V+GY3Rzo4BfavGpOVITD14p8w=";

  meta = {
    changelog = "https://github.com/pestphp/pest/releases/tag/v${finalAttrs.version}";
@@ -13,13 +13,13 @@

 stdenv.mkDerivation rec {
  pname = "pgmodeler";
-  version = "1.2.1";
+  version = "1.2.2";

  src = fetchFromGitHub {
    owner = "pgmodeler";
    repo = "pgmodeler";
    rev = "v${version}";
-    sha256 = "sha256-DIyqUewP8q9O6O/v82a2DNgyrBffWkBmyhBm3pA1qVY=";
+    sha256 = "sha256-gDhH6b+8zFIsosdecUUkwAQMP1HME4EbJZsFyTzvGcE=";
  };

  nativeBuildInputs = [
@@ -16,7 +16,7 @@ php.buildComposerProject2 (finalAttrs: {
    hash = "sha256-9XWlWwq+xvqPgKIc7IGoMVTxajjYsrPo/ra/0JIE168=";
  };

-  vendorHash = "sha256-3xkt0QjytW4BOCgZdevat7zkSuZTPPvwz3yptiq5zoo=";
+  vendorHash = "sha256-91Yz78nh4r+Gr7gKSwelTdO436ehENVTPUWcnDaU7zg=";

  nativeBuildInputs = [ installShellFiles ];

@@ -17,7 +17,7 @@ php.buildComposerProject2 (finalAttrs: {
    hash = "sha256-iQA19FrXvVLzg+LaY1BcNmG8amMfKPVFwYbZ7dr+H9Q=";
  };

-  vendorHash = "sha256-sFRy9Hy9CVNjjYqbPbKH0XhoUdu4HlkiuHDDovTGono=";
+  vendorHash = "sha256-iXkj0Pa4ln8GX/ARCpnijaWdFM4VYZuj42RP0GS2LW8=";

  nativeBuildInputs = [ makeBinaryWrapper ];

@@ -6,14 +6,14 @@
 }:
 python3Packages.buildPythonApplication rec {
  pname = "posting";
-  version = "2.9.1";
+  version = "2.9.2";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "darrenburns";
    repo = "posting";
    tag = version;
-    hash = "sha256-YaN7kuGRZ6UJTuf2vYDnIinyzMzsKDQEA4B5SmmggA4=";
+    hash = "sha256-BX1D9XgBqRIfavDxAQH7mPP/dnayQu3xSSAF6/JSM54=";
  };

  pythonRelaxDeps = true;
@@ -8,7 +8,7 @@

 python3Packages.buildPythonApplication rec {
  pname = "prefect";
-  version = "3.4.23";
+  version = "3.4.24";
  pyproject = true;

  # Trying to install from source is challenging
@@ -17,7 +17,7 @@ python3Packages.buildPythonApplication rec {
  # Source will be missing sdist, uv.lock, ui artefacts ...
  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-XGgAc3vVd+3gcPo4UvYII1xxXnKol9Qf07kxf2f96MM=";
+    hash = "sha256-jBDHgGNZRl1nr5qpj/5r5+D7o1skFFPcd6yTe60uMlE=";
  };

  pythonRelaxDeps = [
@@ -15,7 +15,7 @@ php.buildComposerProject2 (finalAttrs: {
    hash = "sha256-zBhxuEViLxeQ9m3u1L0wYqeL+YEWWwvJS7PtsFPO5QU=";
  };

-  vendorHash = "sha256-vnmp/HLzaOzHu22lzugRXIHL43YQ/hm223gcUbIiLT4=";
+  vendorHash = "sha256-Y1/wNFPXza2aO07ZFybpwI3XbTVBhEvFHs9ygHQbcSo=";

  passthru = {
    tests.version = testers.testVersion {
@@ -11,13 +11,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "protoc-gen-swift";
-  version = "1.29.0";
+  version = "1.32.0";

  src = fetchFromGitHub {
    owner = "apple";
    repo = "swift-protobuf";
    rev = "${finalAttrs.version}";
-    hash = "sha256-UPYwu8SiBUHofqHdUT6uxdeY2WUXYqbkLj+h4chSCa4=";
+    hash = "sha256-YirKJjEA5zFVVs8U1/D3TYCgv+3FMO7dusCZ7ZuIeZs=";
  };

  nativeBuildInputs = [
@@ -58,6 +58,7 @@ php.buildComposerProject2 (finalAttrs: {
    mainProgram = "psysh";
    license = lib.licenses.mit;
    homepage = "https://psysh.org/";
-    teams = [ lib.teams.php ];
+    # `composerVendor` doesn't build
+    broken = true;
  };
 })
@@ -20,6 +20,13 @@ stdenv.mkDerivation {
    cmake
  ];

+  postPatch = ''
+    # Inline https://github.com/liuq/QuadProgpp/pull/32
+    substituteInPlace CMakeLists.txt --replace-fail \
+      'cmake_minimum_required(VERSION 3.0)' \
+      'cmake_minimum_required(VERSION 3.10)'
+  '';
+
  meta = with lib; {
    description = "C++ library for Quadratic Programming";
    longDescription = ''
@@ -6,10 +6,10 @@
 }:
 let
  pname = "remnote";
-  version = "1.21.8";
+  version = "1.21.9";
  src = fetchurl {
    url = "https://download2.remnote.io/remnote-desktop2/RemNote-${version}.AppImage";
-    hash = "sha256-KJHdLHmLGYYxv4eKCDoUsTn3bhWg3h8QOlwmtxNFC6Y=";
+    hash = "sha256-ywVNcB15Qp150gdhnweNMjYyI8w80tNxVXNDvv01Dpg=";
  };
  appimageContents = appimageTools.extractType2 { inherit pname version src; };
 in
@@ -16,7 +16,7 @@ php.buildComposerProject2 (finalAttrs: {
    hash = "sha256-4rhIaPdyyLiIhVYC4KNKbPAbVsHKnK6BOsebFjmmDeI=";
  };

-  vendorHash = "sha256-k+zFpBHE+r0a67gqUry+luMIhJZ5wo1RpEaF4c7vAmI=";
+  vendorHash = "sha256-uZqstfVp5uY7Sec32XLK7RvuUtP8Hj21W7tayhhuf2g=";

  nativeInstallCheckInputs = [
    versionCheckHook
@@ -16,7 +16,7 @@ php82.buildComposerProject2 (finalAttrs: {
    hash = "sha256-bAT4jHvqWeYcACeyGtBwVBA2Rz+AvkZcUGLDwSf+fLg=";
  };

-  vendorHash = "sha256-vketnTu5VEgt3HBbtnTppWl3+sSSIsCB2MpvL27bxv4=";
+  vendorHash = "sha256-Rg8WTZUnWA4bemNmE7hxFwfnlMtYyPkeltAQEWJ2VDU=";

  nativeInstallCheckInputs = [
    versionCheckHook
@@ -0,0 +1,66 @@
+{
+  lib,
+  fetchFromGitHub,
+  rustPlatform,
+  versionCheckHook,
+  nix-update-script,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "rumdl";
+  version = "0.0.156";
+
+  src = fetchFromGitHub {
+    owner = "rvben";
+    repo = "rumdl";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-yHOfrX3iOq1oGwHtHchMyQblqLXreoUKLBTpxxh2FEE=";
+  };
+
+  cargoHash = "sha256-U8kb3fQjA3Prrpn1KmhsQl4S0hvhcY+5qlqT5ovbUZE=";
+
+  cargoBuildFlags = [
+    "--bin=rumdl"
+  ];
+
+  __darwinAllowLocalNetworking = true; # required for LSP tests
+
+  useNextest = true;
+
+  cargoTestFlags = [
+    "--profile ci"
+  ];
+
+  checkFlags = [
+    # Skip Windows tests
+    "--skip comprehensive_windows_tests"
+    "--skip windows_vscode_tests"
+  ];
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  versionCheckProgramArg = "--version";
+
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "Markdown linter and formatter";
+    longDescription = ''
+      rumdl is a high-performance Markdown linter and formatter
+      that helps ensure consistency and best practices in your Markdown files.
+    '';
+    homepage = "https://github.com/rvben/rumdl";
+    changelog = "https://github.com/rvben/rumdl/blob/v${finalAttrs.version}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [
+      kachick
+      hasnep
+    ];
+    mainProgram = "rumdl";
+    platforms = with lib.platforms; unix ++ windows;
+  };
+})
@@ -7,7 +7,6 @@
  meson,
  ninja,
  pkg-config,
-  runtimeShell,
  installShellFiles,

  android-tools,
@@ -17,12 +16,12 @@
 }:

 let
-  version = "3.3.2";
+  version = "3.3.3";
  prebuilt_server = fetchurl {
    name = "scrcpy-server";
    inherit version;
    url = "https://github.com/Genymobile/scrcpy/releases/download/v${version}/scrcpy-server-v${version}";
-    hash = "sha256-LuXKCGPvRA9bfHWFa7R1xSg9CoNZyzcLHBYTFP0p39k=";
+    hash = "sha256-fnAyO6fyWWSd1KzOl6xP77roECssbZHi575hP9U1S+A=";
  };
 in
 stdenv.mkDerivation rec {
@@ -33,7 +32,7 @@ stdenv.mkDerivation rec {
    owner = "Genymobile";
    repo = "scrcpy";
    tag = "v${version}";
-    hash = "sha256-rwEsJlYlOIdgQfniAXdE2sg0WdI1ZxWxZV6MTFQoueg=";
+    hash = "sha256-1kCAqb/12fkKlp9MOsgw9ukp0lwJqTxD0gWN0IqvQJQ=";
  };

  #   display.c: When run without a hardware accelerator, this allows the command to continue working rather than failing unexpectedly.
@@ -69,10 +68,6 @@ stdenv.mkDerivation rec {

    # runtime dep on `adb` to push the server
    wrapProgram "$out/bin/scrcpy" --prefix PATH : "${android-tools}/bin"
-  ''
-  + lib.optionalString stdenv.hostPlatform.isLinux ''
-    substituteInPlace $out/share/applications/scrcpy-console.desktop \
-      --replace "/bin/bash" "${runtimeShell}"
  '';

  meta = {
@@ -33,6 +33,10 @@ buildGoModule rec {
    scdoc < doc/senpai.1.scd > doc/senpai.1
    scdoc < doc/senpai.5.scd > doc/senpai.5
    installManPage doc/senpai.*
+    install -D -m 444 -t $out/share/applications contrib/senpai.desktop
+    install -D -m 444 res/icon.48.png $out/share/icons/hicolor/48x48/apps/senpai.png
+    install -D -m 444 res/icon.128.png $out/share/icons/hicolor/128x128/apps/senpai.png
+    install -D -m 444 res/icon.svg $out/share/icons/hicolor/scalable/apps/senpai.svg
  '';

  passthru.updateScript = nix-update-script { };
@@ -1,25 +0,0 @@
-{
-  php,
-  fetchFromGitHub,
-  lib,
-}:
-php.buildComposerProject2 (finalAttrs: {
-  pname = "simplesamlphp";
-  version = "1.19.7";
-
-  src = fetchFromGitHub {
-    owner = "simplesamlphp";
-    repo = "simplesamlphp";
-    tag = "v${finalAttrs.version}";
-    hash = "sha256-Qmy9fuZq8MBqvYV6/u3Dg92pHHicuUhdNeB22u4hwwA=";
-  };
-
-  vendorHash = "sha256-kFRvOxSfqlM+xzFFlEm9YrbQDOvC4AA0BtztFQ1xxDU=";
-
-  meta = {
-    description = "Application written in native PHP that deals with authentication (SQL, .htpasswd, YubiKey, LDAP, PAPI, Radius)";
-    homepage = "https://simplesamlphp.org";
-    license = lib.licenses.lgpl21;
-    maintainers = with lib.maintainers; [ nhnn ];
-  };
-})
@@ -24,6 +24,8 @@ rustPlatform.buildRustPackage rec {
      --bash <($out/bin/trash completions bash) \
      --fish <($out/bin/trash completions fish) \
      --zsh <($out/bin/trash completions zsh) \
+
+    installManPage --name trashy.1 <($out/bin/trash manpage)
  '';

  meta = {
@@ -0,0 +1,47 @@
+{
+  lib,
+  flutter329,
+  makeDesktopItem,
+  copyDesktopItems,
+  fetchFromGitHub,
+}:
+
+flutter329.buildFlutterApplication rec {
+  pname = "tts-mod-vault";
+  version = "1.3.0";
+
+  src = fetchFromGitHub {
+    owner = "markomijic";
+    repo = "TTS-Mod-Vault";
+    tag = "v${version}";
+    hash = "sha256-BTs+4QeyVJeg415uiNXww8twQwUInHfB8voWJjeVs20=";
+  };
+
+  pubspecLock = lib.importJSON ./pubspec.lock.json;
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "tts-mod-vault";
+      exec = "tts-mod-vault";
+      icon = "tts-mod-vault";
+      comment = "Tabletop Simulator Mod Vault";
+      desktopName = "TTS Mod Vault";
+      categories = [ "Utility" ];
+    })
+  ];
+
+  nativeBuildInputs = [ copyDesktopItems ];
+
+  postInstall = ''
+    install -m 444 -D assets/icon/tts_mod_vault_icon.png $out/share/icons/hicolor/1024x1024/apps/tts-mod-vault.png
+  '';
+
+  meta = {
+    description = "Download and backup assets for your Tabletop Simulator mods";
+    homepage = "https://github.com/markomijic/TTS-Mod-Vault";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ esch ];
+    mainProgram = "tts-mod-vault";
+    platforms = lib.platforms.linux;
+  };
+}
@@ -1,19 +0,0 @@
-{
-  buildWasmBindgenCli,
-  fetchCrate,
-  rustPlatform,
-}:
-
-buildWasmBindgenCli rec {
-  src = fetchCrate {
-    pname = "wasm-bindgen-cli";
-    version = "0.2.92";
-    hash = "sha256-1VwY8vQy7soKEgbki4LD+v259751kKxSxmo/gqE6yV0=";
-  };
-
-  cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit src;
-    inherit (src) pname version;
-    hash = "sha256-81vQkKubMWaX0M3KAwpYgMA1zUQuImFGvh5yTW+rIAs=";
-  };
-}
@@ -1,20 +1,20 @@
 {
  "aarch64-darwin": {
-    "version": "1.12.16",
+    "version": "1.12.21",
    "vscodeVersion": "1.100.3",
-    "url": "https://windsurf-stable.codeiumdata.com/darwin-arm64/stable/6a266ac3a91f80e64147aaf1e7640a92571474cf/Windsurf-darwin-arm64-1.12.16.zip",
-    "sha256": "c18f78671472b03bf06f48f966f4674c2a3adf1b55febf4ea6dddd87d455255d"
+    "url": "https://windsurf-stable.codeiumdata.com/darwin-arm64/stable/e070c40b16843043362e035ebe6169be63af2af9/Windsurf-darwin-arm64-1.12.21.zip",
+    "sha256": "6fefd31c02779b26938fcba1ca999311ee5ef6844e2dac81d504f2b4d6a0248e"
  },
  "x86_64-darwin": {
-    "version": "1.12.16",
+    "version": "1.12.21",
    "vscodeVersion": "1.100.3",
-    "url": "https://windsurf-stable.codeiumdata.com/darwin-x64/stable/6a266ac3a91f80e64147aaf1e7640a92571474cf/Windsurf-darwin-x64-1.12.16.zip",
-    "sha256": "c23ef27510bb321cba5cdefdba4a4118f2b3f1904caf521981d514e16fa14667"
+    "url": "https://windsurf-stable.codeiumdata.com/darwin-x64/stable/e070c40b16843043362e035ebe6169be63af2af9/Windsurf-darwin-x64-1.12.21.zip",
+    "sha256": "eabd42f053f2d36ac1ac58c03d44cf22250d9fa064e625408db6356582a24812"
  },
  "x86_64-linux": {
-    "version": "1.12.16",
+    "version": "1.12.21",
    "vscodeVersion": "1.100.3",
-    "url": "https://windsurf-stable.codeiumdata.com/linux-x64/stable/6a266ac3a91f80e64147aaf1e7640a92571474cf/Windsurf-linux-x64-1.12.16.tar.gz",
-    "sha256": "e335bfbcdec5a919ea1bf8fdc0acde52df8a8a95ea0019c7c8c56513b119d3e5"
+    "url": "https://windsurf-stable.codeiumdata.com/linux-x64/stable/e070c40b16843043362e035ebe6169be63af2af9/Windsurf-linux-x64-1.12.21.tar.gz",
+    "sha256": "62323e395ec5981f45ecfdbc95eb875b712365b211cdf173596eed782f66da0f"
  }
 }
@@ -2,6 +2,7 @@
  lib,
  stdenv,
  fetchFromGitHub,
+  fetchpatch,
  cmake,
  openssl,
  libusb1,
@@ -25,6 +26,13 @@ stdenv.mkDerivation rec {
    hash = "sha256-ymGS35kjhNlFee3FEXF8n6Jm7NVaynjv+lpix6F75BQ=";
  };

+  patches = [
+    (fetchpatch {
+      url = "https://github.com/Yubico/yubihsm-shell/pull/493.patch";
+      hash = "sha256-mM4ef1GV7BJT+EZ8B7+ejleTocglhxCWO/RKHZN69GE=";
+    })
+  ];
+
  postPatch = ''
    # Can't find libyubihsm at runtime because of dlopen() in C code
    substituteInPlace lib/yubihsm.c \
@@ -65,7 +73,10 @@ stdenv.mkDerivation rec {
  meta = with lib; {
    description = "Thin wrapper around libyubihsm providing both an interactive and command-line interface to a YubiHSM";
    homepage = "https://github.com/Yubico/yubihsm-shell";
-    maintainers = with maintainers; [ matthewcroughan ];
+    maintainers = with maintainers; [
+      matthewcroughan
+      numinit
+    ];
    license = licenses.asl20;
    platforms = platforms.all;
  };
@@ -0,0 +1,41 @@
+{
+  lib,
+  fetchFromGitHub,
+  buildGoModule,
+}:
+buildGoModule (finalAttrs: {
+  pname = "zeno";
+  version = "2.0.15";
+
+  src = fetchFromGitHub {
+    owner = "internetarchive";
+    repo = "Zeno";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-NLvpPM5AQx4svAFrZ+be+Xr0bErOg3Q8y2YxdpX9lYs=";
+  };
+
+  vendorHash = "sha256-sUd4rRq5KEbdj5Z6igmDeN1E2q9NXgyed0F4hW8De6E=";
+
+  env.CGO_ENABLED = true;
+  ldFlags = [
+    "-s"
+    "-w"
+  ];
+
+  # Attempts to access internet
+  doCheck = false;
+
+  meta = {
+    description = "State-of-the-art web crawler";
+    longDescription = ''
+      Zeno is a web crawler designed to operate wide crawls or to simply
+      archive one web page. Zeno's key concepts are: portability,
+      performance, simplicity. With an emphasis on performance.
+    '';
+    homepage = "https://github.com/internetarchive/Zeno";
+    changelog = "https://github.com/internetarchive/Zeno/releases/tag/v${finalAttrs.version}";
+    mainProgram = "Zeno";
+    license = lib.licenses.agpl3Only;
+    maintainers = [ lib.maintainers.RossSmyth ];
+  };
+})
@@ -17,9 +17,19 @@ python3Packages.buildPythonApplication {
    sha256 = "0r2d1drg2zvwmn3zg0qb32i9mh03r5di9q1yszx23r32rsax9mxh";
  };

+  # SafeConfigParser was deprecated in Python 3.12: https://github.com/infertux/zeyple/issues/76
+  postPatch = ''
+    substituteInPlace zeyple/zeyple.py \
+      --replace-fail 'from configparser import SafeConfigParser' 'from configparser import ConfigParser as SafeConfigParser'
+  '';
+
  propagatedBuildInputs = [ python3Packages.gpgme ];
  installPhase = ''
-    install -Dm755 $src/zeyple/zeyple.py $out/bin/zeyple
+    runHook preInstall
+
+    install -Dm755 zeyple/zeyple.py $out/bin/zeyple
+
+    runHook postInstall
  '';

  meta = with lib; {
@@ -18,7 +18,7 @@
  coqPackages,
  version ?
    if lib.versionAtLeast ocaml.version "4.13" then
-      "3.4.1"
+      "3.4.2"
    else if lib.versionAtLeast ocaml.version "4.08" then
      "1.20.0"
    else
@@ -34,6 +34,7 @@ in

 let
  fetched = coqPackages.metaFetch {
+    release."3.4.2".sha256 = "sha256-w7GjKYZrVrfezJN0NLmzpVm6CFGVKxXszHADFGCw5cc=";
    release."3.4.1".sha256 = "sha256-3rQPw91dHAqp61KTHk1UOEqh5syWrZZ1V1/1eE8cyI8=";
    release."3.3.0".sha256 = "sha256:963f95eea48b8f853cca9cbe4db49f22343c58e88dc961bc1da303356ef50dcd";
    release."3.0.1".sha256 = "sha256-r4B0xn6UCVslVW4dHiqq8NBMGfNz44kZy48KDWeGquc=";
@@ -27,14 +27,14 @@ lib.throwIf (lib.versionAtLeast ocaml.version "5.0")
  "ulex is not available for OCaml ${ocaml.version}"

  stdenv.mkDerivation
-  rec {
-    name = "ocaml${ocaml.version}-${pname}-${version}";
+  {
+    pname = "ocaml${ocaml.version}-${pname}";
    inherit (param) version;

    src = fetchFromGitHub {
-      owner = "whitequark";
+      owner = "ocaml-community";
      repo = pname;
-      rev = "v${version}";
+      rev = "v${param.version}";
      inherit (param) sha256;
    };

@@ -56,7 +56,7 @@ lib.throwIf (lib.versionAtLeast ocaml.version "5.0")
    ];

    meta = {
-      inherit (src.meta) homepage;
+      homepage = "https://opam.ocaml.org/packages/ulex/";
      description = "Lexer generator for Unicode and OCaml";
      license = lib.licenses.mit;
      inherit (ocaml.meta) platforms;
@@ -16,7 +16,7 @@ php82.buildComposerProject2 (finalAttrs: {
    hash = "sha256-giJAcH2R9hAlUTbwRi7rbmUP+WV8Nfb9XmoHHs4RcbI=";
  };

-  vendorHash = "sha256-7oZtuQ7PhB7q9vNO2TLI46kg2q9BgdLjGUduGXAHc0E=";
+  vendorHash = "sha256-A/hAw0J4Q3kun6soxI6h7kpyGef9q0EFg8HAQHHZUro=";

  doInstallCheck = true;
  nativeInstallCheckInputs = [ versionCheckHook ];
@@ -14,6 +14,13 @@
  versionCheckHook,
 }:

+/*
+    XXX IMPORTANT
+
+    Make sure to check if the `vendorHash` of `buildComposerProject2` changes when updating!
+    See https://github.com/NixOS/nixpkgs/issues/451395
+*/
+
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "composer";
  version = "2.8.12";
@@ -17,7 +17,7 @@
      hash = "sha256-gY6ocmkd7eJIMaBrewfxYL7gTr+1qNHTkuAp+w9ApUU=";
    };

-    vendorHash = "sha256-3frpoQzHtJA2/jJpZT+yIRatEwiY6LIUGzEZBa8hXbM=";
+    vendorHash = "sha256-zrHOw7Uyq8H7AyxrfCo5VthX1EeoSB44ynrRt38u3Sk=";

    nativeInstallCheckInputs = [
      versionCheckHook
@@ -15,7 +15,7 @@ php.buildComposerProject2 (finalAttrs: {
    hash = "sha256-dv9v1KCLNheFmrRQ7cID5WFvoiH0OWVPWSrN023dEqA=";
  };

-  vendorHash = "sha256-H1QJ+ML0tbZzEBKknP0GHhUhw+ujiIH/QNmEgA2zSmM=";
+  vendorHash = "sha256-U6BHAd4tWQKm6uCJ5sM51PltXhF3J4ieTnbC060+8Jg=";

  meta = {
    changelog = "https://github.com/phar-io/phive/releases/tag/${finalAttrs.version}";
@@ -17,7 +17,7 @@ php.buildComposerProject2 (finalAttrs: {
  };

  composerLock = ./composer.lock;
-  vendorHash = "sha256-ySdLlqlGKZ6LgmAOBMkBNoCAqWrgMwE/Cj6ZEPEsCko=";
+  vendorHash = "sha256-AQAASj5vrSE1xkJ/SZHU4GwOWNobe9ES0Yo+YrLH354=";

  nativeInstallCheckInputs = [ versionCheckHook ];
  doInstallCheck = true;
@@ -17,7 +17,7 @@ php.buildComposerProject2 (finalAttrs: {
  };

  composerLock = ./composer.lock;
-  vendorHash = "sha256-CwIfRmwJREz24Qj6J2PKQp+ix+/ZXo1oamcHc1fPUoc=";
+  vendorHash = "sha256-uy8/bkgjDXnt544S70IOwX9I8U0lMLAkbiBDYXyJBcY=";

  nativeInstallCheckInputs = [
    versionCheckHook
@@ -19,7 +19,7 @@ php.buildComposerProject2 (finalAttrs: {
  # Missing `composer.lock` from the repository.
  # Issue open at https://github.com/phpmd/phpmd/issues/1056
  composerLock = ./composer.lock;
-  vendorHash = "sha256-AahAs3Gq1OQ+CW3+rU8NnWcR3hKzVNq7s3llsO4mQ38=";
+  vendorHash = "sha256-tiL8PL6Muc/i4Il1rCeEKenCmIEVn3rHFZInbUGQW9o=";

  nativeInstallCheckInputs = [ versionCheckHook ];
  versionCheckProgramArg = "--version";
@@ -1,68 +0,0 @@
-{
-  lib,
-  buildPythonPackage,
-  fetchPypi,
-  fetchpatch,
-  findutils,
-  pytestCheckHook,
-  pythonOlder,
-  pip,
-  setuptools,
-  setuptools-scm,
-  tomli,
-  wheel,
-}:
-
-buildPythonPackage rec {
-  pname = "extension-helpers";
-  version = "1.1.0";
-  pyproject = true;
-
-  disabled = pythonOlder "3.7";
-
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-SUYMeKP40fjOwXRHn16FrURZSMzEFgM8WqPm3fLFAik=";
-  };
-
-  patches = [
-    # Not needed to allow this package to build, but meant for it's dependent
-    # packages, like astropy. See explanation at:
-    # https://github.com/astropy/extension-helpers/pull/59
-    (fetchpatch {
-      url = "https://github.com/astropy/extension-helpers/commit/796f3e7831298df2d26b6d994b13fd57061a56d1.patch";
-      hash = "sha256-NnqK9HQq1hQ66RUJf9gTCuLyA0BVqVtL292mSXJ9860=";
-    })
-  ];
-
-  nativeBuildInputs = [
-    setuptools
-    setuptools-scm
-    wheel
-  ];
-
-  propagatedBuildInputs = [ tomli ];
-
-  nativeCheckInputs = [
-    findutils
-    pip
-    pytestCheckHook
-  ];
-
-  # avoid import mismatch errors, as conftest.py is copied to build dir
-  enabledTestPaths = [ "extension_helpers" ];
-
-  disabledTests = [
-    # https://github.com/astropy/extension-helpers/issues/43
-    "test_write_if_different"
-  ];
-
-  pythonImportsCheck = [ "extension_helpers" ];
-
-  meta = with lib; {
-    description = "Utilities for building and installing packages in the Astropy ecosystem";
-    homepage = "https://github.com/astropy/extension-helpers";
-    license = licenses.bsd3;
-    maintainers = with maintainers; [ rmcgibbo ];
-  };
-}
@@ -5,7 +5,7 @@
  fetchPypi,
  numpy,
  astropy,
-  astropy-extension-helpers,
+  extension-helpers,
  setuptools,
  setuptools-scm,
  pytestCheckHook,
@@ -25,7 +25,7 @@ buildPythonPackage rec {
  };

  nativeBuildInputs = [
-    astropy-extension-helpers
+    extension-helpers
    numpy
    setuptools
    setuptools-scm
@@ -14,7 +14,7 @@

 buildPythonPackage rec {
  pname = "check-manifest";
-  version = "0.50";
+  version = "0.51";
  pyproject = true;

  disabled = pythonOlder "3.7";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
    owner = "mgedmin";
    repo = "check-manifest";
    tag = version;
-    hash = "sha256-wZ0mx2b3QkwTOPMLQ03SFVwnbsVO5RezOSX50ZOYvw8=";
+    hash = "sha256-tT6xQZwqJIsyrO9BjWweIeNgYaopziewerVBk0mFVYg=";
  };

  build-system = [ setuptools ];
@@ -0,0 +1,38 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  pytestCheckHook,
+}:
+
+buildPythonPackage rec {
+  pname = "columnize";
+  version = "0.3.11";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "rocky";
+    repo = "pycolumnize";
+    tag = "3.11";
+    hash = "sha256-YJEIujoRpLvUM4H4CB1nEJaYStFOSVKIGzchnptlt7M=";
+  };
+
+  build-system = [
+    setuptools
+  ];
+
+  pythonImportsCheck = [ "columnize" ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  meta = {
+    description = "Python module to align a simple (not nested) list in columns";
+    homepage = "https://github.com/rocky/pycolumnize";
+    changelog = "https://github.com/rocky/pycolumnize/blob/${src.tag}/ChangeLog";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ GaetanLepage ];
+  };
+}
@@ -4,6 +4,8 @@
  fetchFromGitHub,
  build,
  cython,
+  findutils,
+  pip,
  pytestCheckHook,
  pythonOlder,
  setuptools-scm,
@@ -17,8 +19,6 @@ buildPythonPackage rec {
  version = "1.4.0";
  pyproject = true;

-  disabled = pythonOlder "3.8";
-
  src = fetchFromGitHub {
    owner = "astropy";
    repo = "extension-helpers";
@@ -36,6 +36,8 @@ buildPythonPackage rec {
  nativeCheckInputs = [
    build
    cython
+    findutils
+    pip
    pytestCheckHook
    wheel
  ];
@@ -45,10 +47,8 @@ buildPythonPackage rec {
  enabledTestPaths = [ "extension_helpers/tests" ];

  disabledTests = [
-    # Test require network access
-    "test_only_pyproject"
-    # ModuleNotFoundError
-    "test_no_setup_py"
+    # https://github.com/astropy/extension-helpers/issues/43
+    "test_write_if_different"
  ];

  meta = with lib; {
@@ -36,6 +36,7 @@
  sympy,
  islpy,
  matplotlib,
+  immutabledict,

  # tests
  pytest,
@@ -129,6 +130,8 @@ buildPythonPackage rec {
    sympy
    # required by script spydump
    matplotlib
+    # required by pyop2
+    immutabledict
  ]
  ++ lib.optionals stdenv.hostPlatform.isDarwin [
    islpy
@@ -0,0 +1,60 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+
+  # build-system
+  hatch-vcs,
+  hatchling,
+
+  # dependencies
+  sphinx,
+
+  # tests
+  pytestCheckHook,
+}:
+
+buildPythonPackage rec {
+  pname = "hatch-sphinx";
+  version = "0.0.4";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "llimeht";
+    repo = "hatch-sphinx";
+    tag = "v${version}";
+    hash = "sha256-8g0UkDMf05CVd2VbnV30pZpQ9chJhCkKfci7zmcIOoQ=";
+  };
+
+  build-system = [
+    hatch-vcs
+    hatchling
+  ];
+
+  dependencies = [
+    hatchling
+    sphinx
+  ];
+
+  pythonImportsCheck = [ "hatch_sphinx" ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  disabledTests = [
+    # /nix/store/62fdlzq1x1ak2lsxp4ij7ip5k9nia3hc-python3-3.13.7/bin/python3.13: No module named build
+    "test_tool_apidoc"
+    "test_tool_build"
+    "test_tool_custom_lists_globs"
+    "test_tool_custom_lists_noglobs"
+    "test_tool_custom_strings"
+  ];
+
+  meta = {
+    description = "Hatchling build plugin for Sphinx documentation";
+    homepage = "https://github.com/llimeht/hatch-sphinx";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ GaetanLepage ];
+  };
+}
@@ -1,15 +1,23 @@
 {
+  lib,
+  stdenv,
  buildPythonPackage,
  fetchFromGitHub,
+
+  # build system
+  setuptools,
+
+  # dependencies
  jupyterlab,
-  lib,
  numpy,
  pandas,
  plotly,
  pydot,
-  pytestCheckHook,
-  setuptools,
  torch,
+
+  # tests
+  pytestCheckHook,
+  writableTmpDirAsHomeHook,
 }:

 buildPythonPackage rec {
@@ -35,7 +43,26 @@ buildPythonPackage rec {
    torch
  ];

-  nativeCheckInputs = [ pytestCheckHook ];
+  nativeCheckInputs = [
+    pytestCheckHook
+    writableTmpDirAsHomeHook
+  ];
+
+  disabledTests = lib.optionals stdenv.hostPlatform.isDarwin [
+    # Permission denied: '/tmp/my_saved_cp_graph/trace_data.csv'
+    "test_critical_path_breakdown_and_save_restore"
+    # Fails under Python 3.12 on Darwin with I/O errors
+    # Permission denied: '/tmp/path_does_not_exist/...'
+    "test_critical_path_overlaid_trace"
+  ];
+
+  disabledTestPaths = lib.optionals stdenv.hostPlatform.isDarwin [
+    # Makes assumptions about the filesystem layout
+    "tests/test_config.py"
+    # EOFError -- makes assumptions about file I/O under Python 3.12
+    # https://github.com/facebookresearch/HolisticTraceAnalysis/issues/300
+    "tests/test_symbol_table.py"
+  ];

  pythonImportsCheck = [ "hta" ];

@@ -2,11 +2,11 @@
  lib,
  buildPythonPackage,
  fetchPypi,
-  pythonOlder,
  setuptools,
  ipython,
  ipython-genutils,
  prettytable,
+  six,
  sqlalchemy,
  sqlparse,
 }:
@@ -15,19 +15,18 @@ buildPythonPackage rec {
  version = "0.5.0";
  pyproject = true;

-  disabled = pythonOlder "3.7";
-
  src = fetchPypi {
    inherit pname version;
    hash = "sha256-PbPOf5qV369Dh2+oCxa9u5oE3guhIELKsT6fWW/P/b4=";
  };

-  nativeBuildInputs = [ setuptools ];
+  build-system = [ setuptools ];

-  propagatedBuildInputs = [
+  dependencies = [
    ipython
    ipython-genutils
    prettytable
+    six
    sqlalchemy
    sqlparse
  ];
@@ -31,14 +31,14 @@

 buildPythonPackage rec {
  pname = "langsmith";
-  version = "0.4.34";
+  version = "0.4.37";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "langchain-ai";
    repo = "langsmith-sdk";
    tag = "v${version}";
-    hash = "sha256-vuet4/Y5MW2Ob4zISl9vf3PD/OlmA/4/v7awVuvhk8E=";
+    hash = "sha256-NIEzzcWKNHNx0AJyEoC+laWFXhf1Ejp9zQvYMiYqCXI=";
  };

  sourceRoot = "${src.name}/python";
@@ -5,8 +5,8 @@
  poetry-core,
  pybluez,
  pytestCheckHook,
-  pythonOlder,
  pyusb,
+  pillow,
 }:

 buildPythonPackage rec {
@@ -14,8 +14,6 @@ buildPythonPackage rec {
  version = "3.5.1";
  pyproject = true;

-  disabled = pythonOlder "3.7";
-
  src = fetchFromGitHub {
    owner = "schodet";
    repo = "nxt-python";
@@ -25,7 +23,10 @@ buildPythonPackage rec {

  build-system = [ poetry-core ];

-  dependencies = [ pyusb ];
+  dependencies = [
+    pyusb
+    pillow
+  ];

  optional-dependencies = {
    bluetooth = [ pybluez ];
@@ -35,11 +36,11 @@ buildPythonPackage rec {

  pythonImportsCheck = [ "nxt" ];

-  meta = with lib; {
+  meta = {
    description = "Python driver/interface for Lego Mindstorms NXT robot";
    homepage = "https://github.com/schodet/nxt-python";
    changelog = "https://github.com/schodet/nxt-python/releases/tag/${src.tag}";
-    license = licenses.gpl3Only;
-    maintainers = with maintainers; [ ibizaman ];
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ ibizaman ];
  };
 }
@@ -7,8 +7,9 @@
  hatchling,

  # dependencies
-  immutabledict,
+  constantdict,
  pytools,
+  typing-extensions,

  # optional-dependencies
  matchpy,
@@ -20,21 +21,22 @@

 buildPythonPackage rec {
  pname = "pymbolic";
-  version = "2024.2.2";
+  version = "2025.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "inducer";
    repo = "pymbolic";
    tag = "v${version}";
-    hash = "sha256-07RWdEPhO+n9/FOvIWe4nm9fGekut9X6Tz4HlIkBSpo=";
+    hash = "sha256-cn2EdhMn5qjK854AF5AY4Hv4M5Ib6gPRJk+kQvsFWRk=";
  };

  build-system = [ hatchling ];

  dependencies = [
-    immutabledict
+    constantdict
    pytools
+    typing-extensions
  ];

  optional-dependencies = {
@@ -51,6 +53,6 @@ buildPythonPackage rec {
    homepage = "https://documen.tician.de/pymbolic/";
    changelog = "https://github.com/inducer/pymbolic/releases/tag/v${version}";
    license = lib.licenses.mit;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ qbisi ];
  };
 }
@@ -12,19 +12,19 @@
 buildPythonPackage rec {
  pname = "pyoxigraph";
  pyproject = true;
-  version = "0.5.0";
+  version = "0.5.1";

  src = fetchFromGitHub {
    owner = "oxigraph";
    repo = "oxigraph";
    tag = "v${version}";
    fetchSubmodules = true;
-    hash = "sha256-Q/wMRDTlz7xH59Mc+G+DOH0GYzE3KYPFvBZtVYVOeQI=";
+    hash = "sha256-58PGRQlDziVENgm7OKPAzXXi4BkOJqytGCxxIXB2smc=";
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
    inherit pname version src;
-    hash = "sha256-qk4NloQU0am8yqoViXZy9TmGvQ6RJt3otzaVugoF4mc=";
+    hash = "sha256-GQ+7dyQ1LyYK8RYImsqVMEQvIC5pRQUVYYgO4FOShaE=";
  };

  buildAndTestSubdir = "python";
@@ -2,8 +2,16 @@
  lib,
  fetchFromGitHub,
  buildPythonPackage,
-  setuptools,
-  pytestCheckHook,
+
+  # build-system
+  columnize,
+  hatch-requirements-txt,
+  hatch-sphinx,
+  hatch-vcs,
+  hatchling,
+  siphash24,
+  sphinx,
+
  numpy,
  scipy,
  bumps,
@@ -12,27 +20,46 @@
  opencl-headers,
  pycuda,
  pyopencl,
-  pythonOlder,
+
+  # optional-dependencies
+
+  # tests
+  pytestCheckHook,
+  writableTmpDirAsHomeHook,
 }:

 buildPythonPackage rec {
  pname = "sasmodels";
-  version = "1.0.10";
+  version = "1.0.11";
  pyproject = true;

-  disabled = pythonOlder "3.7";
-
  src = fetchFromGitHub {
    owner = "SasView";
    repo = "sasmodels";
    tag = "v${version}";
-    hash = "sha256-cTXFlTCm521+xhcggFvDqVZrTJuDiVZ8PazBwA3mKJU=";
+    hash = "sha256-AtFkcW7h2hMnQAeAk0fGsARXwpuaSb7ERBhdnAH4pCY=";
  };

-  build-system = [ setuptools ];
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail '"tccbox",' ""
+  '';
+
+  build-system = [
+    columnize
+    hatch-requirements-txt
+    hatch-sphinx
+    hatch-vcs
+    hatchling
+    siphash24
+    sphinx
+  ];

  buildInputs = [ opencl-headers ];

+  pythonRemoveDeps = [
+    "tccbox" # unpackaged
+  ];
  dependencies = [
    numpy
    scipy
@@ -43,25 +70,26 @@ buildPythonPackage rec {
      docutils
      bumps
      matplotlib
-      # columnize
+      columnize
    ];
    server = [ bumps ];
    opencl = [ pyopencl ];
    cuda = [ pycuda ];
  };

-  nativeCheckInputs = [ pytestCheckHook ] ++ optional-dependencies.full;
-
-  preCheck = ''
-    export HOME=$TMPDIR
-  '';
+  nativeCheckInputs = [
+    pytestCheckHook
+    writableTmpDirAsHomeHook
+  ]
+  ++ optional-dependencies.full;

  pythonImportsCheck = [ "sasmodels" ];

-  meta = with lib; {
+  meta = {
    description = "Library of small angle scattering models";
    homepage = "https://github.com/SasView/sasmodels";
-    license = licenses.bsd3;
-    maintainers = with maintainers; [ rprospero ];
+    changelog = "https://github.com/SasView/sasmodels/blob/${src.tag}/CHANGES.rst";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ rprospero ];
  };
 }
@@ -1,67 +1,103 @@
 {
  lib,
-  stdenv,
  asdf,
+  asdf-astropy,
  astropy,
-  astropy-extension-helpers,
-  astropy-helpers,
  beautifulsoup4,
  buildPythonPackage,
+  contourpy,
+  dask,
  drms,
-  fetchPypi,
+  extension-helpers,
+  fetchFromGitHub,
+  fsspec,
  glymur,
  h5netcdf,
+  h5py,
  hypothesis,
  lxml,
  matplotlib,
  numpy,
+  opencv-python,
+  packaging,
  pandas,
  parfive,
+  pyerfa,
  pytest-astropy,
  pytestCheckHook,
  pytest-mock,
  python-dateutil,
  pythonOlder,
+  reproject,
+  requests,
  scikit-image,
  scipy,
+  setuptools,
  setuptools-scm,
-  sqlalchemy,
  tqdm,
+  writableTmpDirAsHomeHook,
  zeep,
 }:

 buildPythonPackage rec {
  pname = "sunpy";
-  version = "7.0.1";
-  format = "setuptools";
+  version = "7.0.2";
+  pyproject = true;

-  disabled = pythonOlder "3.8";
+  disabled = pythonOlder "3.11";

-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-9ZCG9CtTpgGGlqtXcl2epRBzFcbVvIMzZcXk5CQ5/+A=";
+  src = fetchFromGitHub {
+    owner = "sunpy";
+    repo = "sunpy";
+    tag = "v${version}";
+    hash = "sha256-1LT6Dr9OZYIZkOICSYD8lt5v3Gn1gZGN4GWeJL6IH5w=";
  };

-  nativeBuildInputs = [
-    astropy-extension-helpers
-    setuptools-scm
+  # As of 2025-10-15, this requires numpy >=1.25.0,<2.3.
+  # (The >=1.25.0 constraint is in dependencies, the <2.3 in build-system)
+  # We can't use 1.x because it's not supported on Python 3.13+.
+  # And since numpy 2.x is at 2.3.2, it's not supported.
+  # However, the upper bound is "for matching the numpy deprecation policy",
+  # so relaxing it should be OK. (It silently was overridden previously,
+  # due to the use of `format = "setuptools"` instead of `pyproject = true`)
+  postPatch = ''
+    substituteInPlace pyproject.toml --replace-fail "numpy>=2.0.0rc1,<2.3" "numpy"
+  '';
+
+  build-system = [
+    extension-helpers
+    setuptools
+    setuptools-scm # Technically needs setuptools-scm[toml], but that's our default.
+    numpy
  ];

-  propagatedBuildInputs = [
+  dependencies = [
    astropy
-    astropy-helpers
+    fsspec
    numpy
+    packaging
    parfive
-  ];
+    pyerfa
+    requests
+  ]
+  ++ parfive.optional-dependencies.ftp;

  optional-dependencies = {
    asdf = [
      asdf
-      # asdf-astropy
+      asdf-astropy
    ];
-    database = [ sqlalchemy ];
-    image = [
-      scikit-image
+    dask = [ dask ] ++ dask.optional-dependencies.array;
+    image = [ scipy ];
+    jpeg2000 = [
+      glymur
+      lxml
+    ];
+    map = [
+      contourpy
+      matplotlib
+      # mpl-animators
+      reproject
      scipy
    ];
    net = [
@@ -71,93 +107,103 @@ buildPythonPackage rec {
      tqdm
      zeep
    ];
-    jpeg2000 = [
-      glymur
-      lxml
-    ];
+    opencv = [ opencv-python ];
+    scikit-image = [ scikit-image ];
+    # spice = [ spiceypy ];
    timeseries = [
      # cdflib
      h5netcdf
-      # h5py
+      h5py
      matplotlib
      pandas
    ];
+    visualization = [
+      matplotlib
+      # mpl-animators
+    ];
+
+    # We can't use `with` here because "map" would still be the builtin, and
+    # we can't below because scikit-image would still be this package's argument.
+    core = lib.concatLists [
+      optional-dependencies.image
+      optional-dependencies.map
+      optional-dependencies.net
+      optional-dependencies.timeseries
+      optional-dependencies.visualization
+    ];
+    all = lib.concatLists [
+      optional-dependencies.core
+      optional-dependencies.asdf
+      optional-dependencies.jpeg2000
+      optional-dependencies.opencv
+      # optional-dependencies.spice
+      optional-dependencies.scikit-image
+    ];
  };

  nativeCheckInputs = [
    hypothesis
    pytest-astropy
-    pytest-mock
    pytestCheckHook
+    pytest-mock
+    writableTmpDirAsHomeHook
  ]
-  ++ optional-dependencies.asdf
-  ++ optional-dependencies.database
-  ++ optional-dependencies.image
-  ++ optional-dependencies.net
-  ++ optional-dependencies.timeseries;
-
-  postPatch = ''
-    substituteInPlace setup.cfg \
-      --replace " --dist no" ""
-  '';
-
-  # darwin has write permission issues
-  doCheck = stdenv.hostPlatform.isLinux;
-
-  preCheck = ''
-    export HOME=$(mktemp -d)
-  '';
+  ++ optional-dependencies.all;

  disabledTests = [
-    "rst"
-    "test_sunpy_warnings_logging"
+    "rst" # Docs
+    "test_print_params" # Needs to be online
+    "test_find_dependencies" # Needs cdflib
+    # Needs mpl-animators
+    "sunpy.coordinates.utils.GreatArc"
+    "test_expand_list_generator_map"
+    "test_great_arc_different_observer"
+    "test_great_arc_points_differentiates"
+    "test_great_arc_wrongly_formatted_points"
+    "test_main_exclude_remote_data"
+    "test_main_include_remote_data"
    "test_main_nonexisting_module"
+    "test_main_only_remote_data"
    "test_main_stdlib_module"
-    "test_find_dependencies"
+    "test_main_submodule_map"
+    "test_tai_seconds"
+    "test_utime"
  ];

  disabledTestPaths = [
    # Tests are very slow
    "sunpy/net/tests/test_fido.py"
+    "sunpy/net/tests/test_scraper.py"
    # asdf.extensions plugin issue
+    "sunpy/io/special/asdf/resources/manifests/*.yaml"
    "sunpy/io/special/asdf/resources/schemas/"
-    "sunpy/io/special/asdf/resources/manifests/sunpy-1.0.0.yaml"
-    # Requires mpl-animators package
-    "sunpy/map/tests/test_compositemap.py"
-    "sunpy/map/tests/test_mapbase.py"
-    "sunpy/map/tests/test_mapsequence.py"
-    "sunpy/map/tests/test_plotting.py"
-    "sunpy/map/tests/test_reproject_to.py"
-    "sunpy/net/tests/test_helioviewer.py"
-    "sunpy/timeseries/tests/test_timeseriesbase.py"
-    "sunpy/visualization/animator/tests/test_basefuncanimator.py"
-    "sunpy/visualization/animator/tests/test_mapsequenceanimator.py"
-    "sunpy/visualization/animator/tests/test_wcs.py"
-    "sunpy/visualization/colormaps/tests/test_cm.py"
-    # Requires cdflib package
-    "sunpy/timeseries/tests/test_timeseries_factory.py"
-    # Requires jplephem
+    # Requires mpl-animators
+    "sunpy/coordinates/tests/test_wcs_utils.py"
+    "sunpy/image/tests/test_resample.py"
    "sunpy/image/tests/test_transform.py"
-    "sunpy/io/special/asdf/tests/test_coordinate_frames.py"
    "sunpy/io/special/asdf/tests/test_genericmap.py"
-    # distutils is deprecated
-    "sunpy/io/setup_package.py"
+    "sunpy/map"
+    "sunpy/net/jsoc/tests/test_jsoc.py"
+    "sunpy/physics/differential_rotation.py"
+    "sunpy/physics/tests/test_differential_rotation.py"
+    "sunpy/visualization"
+    # Requires cdflib
+    "sunpy/io/tests/test_cdf.py"
+    "sunpy/timeseries"
+    # Requires jplephem
+    "sunpy/io/special/asdf/tests/test_coordinate_frames.py"
+    # Requires spiceypy
+    "sunpy/coordinates/tests/test_spice.py"
  ];

-  pytestFlags = [
-    "-Wignore::DeprecationWarning"
-  ];
+  pytestFlags = [ "-Wignore::DeprecationWarning" ];

-  # Wants a configuration file
-  # pythonImportsCheck = [
-  #   "sunpy"
-  # ];
+  pythonImportsCheck = [ "sunpy" ];

  meta = with lib; {
    description = "Python for Solar Physics";
    homepage = "https://sunpy.org";
    license = licenses.bsd2;
    maintainers = [ ];
-    broken = true;
  };
 }
@@ -0,0 +1,52 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+
+  # build-system
+  setuptools,
+
+  # dependencies
+  jinja2,
+  packaging,
+  pyyaml,
+}:
+
+buildPythonPackage rec {
+  pname = "swagger-ui-py";
+  version = "25.7.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "PWZER";
+    repo = "swagger-ui-py";
+    tag = "v${version}";
+    hash = "sha256-yPGt7EG8KvGoI7Unz0E7fn7nG9Ei/h8Q3TDKnuVVRkQ=";
+  };
+
+  env.VERSION = version;
+
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
+    jinja2
+    packaging
+    pyyaml
+  ];
+
+  doCheck = false; # huge dependency closure on all sorts of web frameworks, http clients, etc.
+
+  pythonImportsCheck = [
+    "swagger_ui"
+  ];
+
+  meta = {
+    changelog = "https://github.com/PWZER/swagger-ui-py/releases/tag/${src.tag}";
+    description = "Swagger UI for Python web framework, such Tornado, Flask and Sanic. https://pwzer.github.io/swagger-ui-py";
+    homepage = "https://github.com/PWZER/swagger-ui-py";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ hexa ];
+  };
+}
@@ -282,7 +282,7 @@ buildPythonPackage rec {
    owner = "vllm-project";
    repo = "vllm";
    tag = "v${version}";
-    hash = "sha256-uYK/e9McEyrDTACMk5S0cGCjai9rf6HMR9dpPL7ISYc=";
+    hash = "sha256-47TPvvPQvVbh6Gm2yvi+xhWZ8tSma91rp9hp/SBrEY8=";
  };

  patches = [
@@ -7,9 +7,13 @@
  setuptools,

  # optional-dependencies
+  flask,
+  swagger-ui-py,
  zeroconf,

  # tests
+  pytest-asyncio,
+  pytestCheckHook,
  wyoming-faster-whisper,
  wyoming-openwakeword,
  wyoming-piper,
@@ -17,35 +21,42 @@

 buildPythonPackage rec {
  pname = "wyoming";
-  version = "1.7.2";
+  version = "1.8.0";
  pyproject = true;

  src = fetchFromGitHub {
-    owner = "rhasspy";
+    owner = "OHF-Voice";
    repo = "wyoming";
-    tag = version;
-    hash = "sha256-tLwMysBxNPk5ztkwuuOhChhGgY+uEE9uA4S5ZVlVtY0=";
+    tag = "v${version}";
+    hash = "sha256-s1wYGqoTIsKj3u99/9KdKZmzUGzGeYq1TJHOkOVwkHQ=";
  };

  build-system = [ setuptools ];

  optional-dependencies = {
+    http = [
+      flask
+      swagger-ui-py
+    ];
    zeroconf = [ zeroconf ];
  };

  pythonImportsCheck = [ "wyoming" ];

-  # no tests
-  doCheck = false;
+  nativeCheckInputs = [
+    pytest-asyncio
+    pytestCheckHook
+  ]
+  ++ lib.flatten (lib.attrValues optional-dependencies);

  passthru.tests = {
    inherit wyoming-faster-whisper wyoming-openwakeword wyoming-piper;
  };

  meta = with lib; {
-    changelog = "https://github.com/rhasspy/wyoming/releases/tag/${src.tag}";
+    changelog = "https://github.com/OHF-Voice/wyoming/releases/tag/${src.tag}";
    description = "Protocol for Rhasspy Voice Assistant";
-    homepage = "https://github.com/rhasspy/wyoming";
+    homepage = "https://github.com/OHF-Voice/wyoming";
    license = licenses.mit;
    maintainers = with maintainers; [ hexa ];
  };
@@ -17,7 +17,7 @@ let
      in
      with lib.versions;
      lib.switch rocq-core.rocq-version [
-        (case (range "9.0" "9.1") "3.4.1")
+        (case (range "9.0" "9.1") "3.4.2")
        (case (range "9.0" "9.1") "2.0.7")
      ] { };
  elpi = rocq-core.ocamlPackages.elpi.override { version = default-elpi-version; };
@@ -916,6 +916,7 @@ mapAliases {
  ffmpeg_5-full = throw "ffmpeg_5-full has been removed, please use another version"; # Added 2024-07-12
  FIL-plugins = fil-plugins; # Added 2024-06-12
  fileschanged = throw "'fileschanged' has been removed as it is unmaintained upstream"; # Added 2024-04-19
+  filesender = throw "'filesender' has been removed because of its simplesamlphp dependency"; # Added 2025-10-17
  filet = throw "'filet' has been removed as the upstream repo has been deleted"; # Added 2025-02-07
  finger_bsd = bsd-finger; # Added 2022-03-14
  fingerd_bsd = bsd-fingerd; # Added 2022-03-14
@@ -2398,6 +2399,7 @@ mapAliases {
  signal-desktop-source = lib.warnOnInstantiate "'signal-desktop-source' is now exposed at 'signal-desktop'." signal-desktop; # Added 2025-04-16
  silc_server = throw "'silc_server' has been removed because it is unmaintained"; # Added 2025-05-12
  silc_client = throw "'silc_client' has been removed because it is unmaintained"; # Added 2025-05-12
+  simplesamlphp = throw "'simplesamlphp' was removed because it was unmaintained in nixpkgs"; # Added 2025-10-17
  siproxd = throw "'siproxd' has been removed as it was unmaintained and incompatible with newer libosip versions"; # Added 2025-05-18
  sisco.lv2 = throw "'sisco.lv2' has been removed as it was unmaintained and broken"; # Added 2025-08-26
  sipwitch = throw "'sipwitch' has been removed because it has been marked as broken since at least November 2024."; # Added 2025-10-01
@@ -87,6 +87,7 @@ mapAliases {
  argon2_cffi = argon2-cffi; # added 2022-05-09
  arnparse = throw "arnparse has been removed because the upstream repository was archived in 2023"; # Added 2024-10-04
  APScheduler = apscheduler; # added 2023-02-19
+  astropy-extension-helpers = extension-helpers; # Added 2025-10-15
  async_generator = async-generator; # added 2023-08-08
  async_stagger = async-stagger; # added 2023-08-08
  asyncio-mqtt = throw "asyncio-mqtt has been replaced by aiomqtt, which is not API compatible."; # added 2024-07-07
@@ -998,8 +998,6 @@ self: super: with self; {

  astropy = callPackage ../development/python-modules/astropy { };

-  astropy-extension-helpers = callPackage ../development/python-modules/astropy-extension-helpers { };
-
  astropy-healpix = callPackage ../development/python-modules/astropy-healpix { };

  astropy-helpers = callPackage ../development/python-modules/astropy-helpers { };
@@ -2883,6 +2881,8 @@ self: super: with self; {

  colout = callPackage ../development/python-modules/colout { };

+  columnize = callPackage ../development/python-modules/columnize { };
+
  comet-ml = callPackage ../development/python-modules/comet-ml { };

  cometblue-lite = callPackage ../development/python-modules/cometblue-lite { };
@@ -6556,6 +6556,8 @@ self: super: with self; {

  hatch-requirements-txt = callPackage ../development/python-modules/hatch-requirements-txt { };

+  hatch-sphinx = callPackage ../development/python-modules/hatch-sphinx { };
+
  hatch-vcs = callPackage ../development/python-modules/hatch-vcs { };

  hatchling = callPackage ../development/python-modules/hatchling { };
@@ -17929,6 +17931,8 @@ self: super: with self; {

  swagger-ui-bundle = callPackage ../development/python-modules/swagger-ui-bundle { };

+  swagger-ui-py = callPackage ../development/python-modules/swagger-ui-py { };
+
  swcgeom = callPackage ../development/python-modules/swcgeom { };

  swh-auth = callPackage ../development/python-modules/swh-auth { };