Merge master into staging-next

2025-05-29 12:06:54 +00:00
parent 233ccf6b48 adfe0268d8
commit 96ecef502b
87 changed files with 1846 additions and 1404 deletions
@@ -14,7 +14,7 @@ in

    defaultEditor = lib.mkEnableOption "vim as the default editor";

-    package = lib.mkPackageOption pkgs "vim" { example = "vim-full"; };
+    package = lib.mkPackageOption pkgs "vim" { example = [ "vim-full" ]; };
  };

  # TODO: convert it into assert after 24.11 release
@@ -45,6 +45,11 @@ in
        nixos-icons # needed for gnome and pantheon about dialog, nixos-manual and maybe more
        xdg-utils
      ];
+      # needed for some display managers to locate desktop manager sessions
+      pathsToLink = [
+        "/share/xsessions"
+        "/share/wayland-sessions"
+      ];
    };

    fonts.enableDefaultPackages = lib.mkDefault true;
@@ -631,6 +631,7 @@ in
          psql -tAc "SELECT 1 FROM pg_roles WHERE rolname='keycloak'" | grep -q 1 || psql -tA --file="$create_role"
          psql -tAc "SELECT 1 FROM pg_database WHERE datname = 'keycloak'" | grep -q 1 || psql -tAc 'CREATE DATABASE "keycloak" OWNER "keycloak"'
        '';
+        enableStrictShellChecks = true;
      };

      systemd.services.keycloakMySQLInit = mkIf createLocalMySQL {
@@ -662,6 +663,7 @@ in
            echo "GRANT ALL PRIVILEGES ON keycloak.* TO 'keycloak'@'localhost';"
          ) | mysql -N
        '';
+        enableStrictShellChecks = true;
      };

      systemd.tmpfiles.settings."10-keycloak" =
@@ -699,7 +701,7 @@ in
              [ ];
          secretPaths = catAttrs "_secret" (collect isSecret cfg.settings);
          mkSecretReplacement = file: ''
-            replace-secret ${hashString "sha256" file} $CREDENTIALS_DIRECTORY/${baseNameOf file} /run/keycloak/conf/keycloak.conf
+            replace-secret ${hashString "sha256" file} "$CREDENTIALS_DIRECTORY/${baseNameOf file}" /run/keycloak/conf/keycloak.conf
          '';
          secretReplacements = lib.concatMapStrings mkSecretReplacement secretPaths;
        in
@@ -760,11 +762,12 @@ in
            ''
            + optionalString (cfg.sslCertificate != null && cfg.sslCertificateKey != null) ''
              mkdir -p /run/keycloak/ssl
-              cp $CREDENTIALS_DIRECTORY/ssl_{cert,key} /run/keycloak/ssl/
+              cp "$CREDENTIALS_DIRECTORY"/ssl_{cert,key} /run/keycloak/ssl/
            ''
            + ''
              kc.sh --verbose start --optimized ${lib.optionalString (cfg.realmFiles != [ ]) "--import-realm"}
            '';
+          enableStrictShellChecks = true;
        };

      services.postgresql.enable = mkDefault createLocalPostgreSQL;
@@ -634,7 +634,7 @@ in
        {
          where = "/sysroot/run";
          what = "/run";
-          options = "bind";
+          options = "rbind";
          unitConfig = {
            # See the comment on the mount unit for /run/etc-metadata
            DefaultDependencies = false;
@@ -46,6 +46,10 @@
        "overlay"
      ];

+      system.requiredKernelConfig = with config.lib.kernelConfig; [
+        (isEnabled "EROFS_FS")
+      ];
+
      boot.initrd.systemd = {
        mounts = [
          {
@@ -22,7 +22,8 @@
        && lib.isDerivation o.value
        && o.value ? outputs
        && builtins.elem "terminfo" o.value.outputs
-        && !o.value.meta.broken;
+        && !o.value.meta.broken
+        && lib.meta.availableOn pkgs.stdenv.hostPlatform o.value;
      terminfos = lib.filterAttrs infoFilter pkgs;
      excludedTerminfos = lib.filterAttrs (
        _: drv: !(builtins.elem drv.terminfo config.environment.systemPackages)
@@ -1302,6 +1302,7 @@ in
  systemd-escaping = runTest ./systemd-escaping.nix;
  systemd-initrd-bridge = runTest ./systemd-initrd-bridge.nix;
  systemd-initrd-btrfs-raid = runTest ./systemd-initrd-btrfs-raid.nix;
+  systemd-initrd-credentials = runTest ./systemd-initrd-credentials.nix;
  systemd-initrd-luks-fido2 = runTest ./systemd-initrd-luks-fido2.nix;
  systemd-initrd-luks-keyfile = runTest ./systemd-initrd-luks-keyfile.nix;
  systemd-initrd-luks-empty-passphrase = runTest {
@@ -0,0 +1,32 @@
+{ lib, pkgs, ... }:
+{
+  name = "systemd-initrd-credentials";
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      virtualisation = {
+        qemu.options = [
+          "-smbios type=11,value=io.systemd.credential:cred-smbios=secret-smbios"
+        ];
+      };
+
+      boot.initrd.availableKernelModules = [ "dmi_sysfs" ];
+
+      boot.kernelParams = [ "systemd.set_credential=cred-cmdline:secret-cmdline" ];
+
+      boot.initrd.systemd = {
+        enable = true;
+      };
+    };
+
+  testScript = ''
+    machine.wait_for_unit("multi-user.target")
+
+    # Check credential passed via kernel command line
+    assert "secret-cmdline" in machine.succeed("systemd-creds --system cat cred-cmdline")
+
+    # Check credential passed via SMBIOS
+    assert "secret-smbios" in machine.succeed("systemd-creds --system cat cred-smbios")
+  '';
+}
@@ -1,251 +0,0 @@
-{
-  lib,
-  stdenv,
-  coreutils,
-  fetchurl,
-  zlib,
-  libX11,
-  libXext,
-  libSM,
-  libICE,
-  libxkbcommon,
-  libxshmfence,
-  libXfixes,
-  libXt,
-  libXi,
-  libXcursor,
-  libXScrnSaver,
-  libXcomposite,
-  libXdamage,
-  libXtst,
-  libXrandr,
-  alsa-lib,
-  dbus,
-  cups,
-  libexif,
-  ffmpeg,
-  systemd,
-  libva,
-  libGL,
-  freetype,
-  fontconfig,
-  libXft,
-  libXrender,
-  libxcb,
-  expat,
-  libuuid,
-  libxml2,
-  glib,
-  gtk3,
-  pango,
-  gdk-pixbuf,
-  cairo,
-  atk,
-  at-spi2-atk,
-  at-spi2-core,
-  qt5,
-  libdrm,
-  libgbm,
-  vulkan-loader,
-  nss,
-  nspr,
-  patchelf,
-  makeWrapper,
-  wayland,
-  pipewire,
-  isSnapshot ? false,
-  proprietaryCodecs ? false,
-  vivaldi-ffmpeg-codecs ? null,
-  enableWidevine ? false,
-  widevine-cdm ? null,
-  commandLineArgs ? "",
-  pulseSupport ? stdenv.hostPlatform.isLinux,
-  libpulseaudio,
-  kerberosSupport ? true,
-  libkrb5,
-}:
-
-let
-  branch = if isSnapshot then "snapshot" else "stable";
-  vivaldiName = if isSnapshot then "vivaldi-snapshot" else "vivaldi";
-in
-stdenv.mkDerivation rec {
-  pname = "vivaldi";
-  version = "7.4.3684.38";
-
-  suffix =
-    {
-      aarch64-linux = "arm64";
-      x86_64-linux = "amd64";
-    }
-    .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
-
-  src = fetchurl {
-    url = "https://downloads.vivaldi.com/${branch}/vivaldi-${branch}_${version}-1_${suffix}.deb";
-    hash =
-      {
-        aarch64-linux = "sha256-SmmmEFSzAGgm9eKeTKpUFuW/UVNyXw8x8c1uRp69fbw=";
-        x86_64-linux = "sha256-h/ZcJq51gsb03V5KFlPOE9H0NonYxJNeWVg2UCQEBPs=";
-      }
-      .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
-  };
-
-  unpackPhase = ''
-    ar vx $src
-    tar -xvf data.tar.xz
-  '';
-
-  nativeBuildInputs = [
-    patchelf
-    makeWrapper
-    qt5.wrapQtAppsHook
-  ];
-
-  dontWrapQtApps = true;
-
-  buildInputs =
-    [
-      stdenv.cc.cc
-      stdenv.cc.libc
-      zlib
-      libX11
-      libXt
-      libXext
-      libSM
-      libICE
-      libxcb
-      libxkbcommon
-      libxshmfence
-      libXi
-      libXft
-      libXcursor
-      libXfixes
-      libXScrnSaver
-      libXcomposite
-      libXdamage
-      libXtst
-      libXrandr
-      atk
-      at-spi2-atk
-      at-spi2-core
-      alsa-lib
-      dbus
-      cups
-      gtk3
-      gdk-pixbuf
-      libexif
-      ffmpeg
-      systemd
-      libva
-      qt5.qtbase
-      qt5.qtwayland
-      freetype
-      fontconfig
-      libXrender
-      libuuid
-      expat
-      glib
-      nss
-      nspr
-      libGL
-      libxml2
-      pango
-      cairo
-      libdrm
-      libgbm
-      vulkan-loader
-      wayland
-      pipewire
-    ]
-    ++ lib.optional proprietaryCodecs vivaldi-ffmpeg-codecs
-    ++ lib.optional pulseSupport libpulseaudio
-    ++ lib.optional kerberosSupport libkrb5;
-
-  libPath =
-    lib.makeLibraryPath buildInputs
-    + lib.optionalString (stdenv.hostPlatform.is64bit) (
-      ":" + lib.makeSearchPathOutput "lib" "lib64" buildInputs
-    )
-    + ":$out/opt/${vivaldiName}/lib";
-
-  buildPhase =
-    ''
-      runHook preBuild
-      echo "Patching Vivaldi binaries"
-      for f in chrome_crashpad_handler vivaldi-bin vivaldi-sandbox ; do
-        patchelf \
-          --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
-          --set-rpath "${libPath}" \
-          opt/${vivaldiName}/$f
-      done
-
-      for f in libGLESv2.so libqt5_shim.so ; do
-        patchelf --set-rpath "${libPath}" opt/${vivaldiName}/$f
-      done
-    ''
-    + lib.optionalString proprietaryCodecs ''
-      ln -s ${vivaldi-ffmpeg-codecs}/lib/libffmpeg.so opt/${vivaldiName}/libffmpeg.so.''${version%\.*\.*}
-    ''
-    + ''
-      echo "Finished patching Vivaldi binaries"
-      runHook postBuild
-    '';
-
-  dontPatchELF = true;
-  dontStrip = true;
-
-  installPhase =
-    ''
-      runHook preInstall
-      mkdir -p "$out"
-      cp -r opt "$out"
-      mkdir "$out/bin"
-      ln -s "$out/opt/${vivaldiName}/${vivaldiName}" "$out/bin/vivaldi"
-      mkdir -p "$out/share"
-      cp -r usr/share/{applications,xfce4} "$out"/share
-      substituteInPlace "$out"/share/applications/*.desktop \
-        --replace /usr/bin/${vivaldiName} "$out"/bin/vivaldi
-      substituteInPlace "$out"/share/applications/*.desktop \
-        --replace vivaldi-stable vivaldi
-      local d
-      for d in 16 22 24 32 48 64 128 256; do
-        mkdir -p "$out"/share/icons/hicolor/''${d}x''${d}/apps
-        ln -s \
-          "$out"/opt/${vivaldiName}/product_logo_''${d}.png \
-          "$out"/share/icons/hicolor/''${d}x''${d}/apps/vivaldi.png
-      done
-      wrapProgram "$out/bin/vivaldi" \
-        --add-flags ${lib.escapeShellArg commandLineArgs} \
-        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime=true}}" \
-        --set-default FONTCONFIG_FILE "${fontconfig.out}/etc/fonts/fonts.conf" \
-        --set-default FONTCONFIG_PATH "${fontconfig.out}/etc/fonts" \
-        --suffix XDG_DATA_DIRS : ${gtk3}/share/gsettings-schemas/${gtk3.name}/ \
-        --prefix PATH : ${coreutils}/bin \
-        ''${qtWrapperArgs[@]} \
-        ${lib.optionalString enableWidevine "--suffix LD_LIBRARY_PATH : ${libPath}"}
-    ''
-    + lib.optionalString enableWidevine ''
-      ln -sf ${widevine-cdm}/share/google/chrome/WidevineCdm $out/opt/${vivaldiName}/WidevineCdm
-    ''
-    + ''
-      runHook postInstall
-    '';
-
-  passthru.updateScript = ./update-vivaldi.sh;
-
-  meta = with lib; {
-    description = "Browser for our Friends, powerful and personal";
-    homepage = "https://vivaldi.com";
-    license = licenses.unfree;
-    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
-    mainProgram = "vivaldi";
-    maintainers = with maintainers; [
-      otwieracz
-      badmutex
-    ];
-    platforms = [
-      "x86_64-linux"
-      "aarch64-linux"
-    ];
-  };
-}
@@ -1,15 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i bash -p curl common-updater-scripts
-
-set -eu -o pipefail
-
-version=$(curl -sS https://vivaldi.com/download/ | sed -rne 's/.*vivaldi-stable_([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+)-1_amd64\.deb.*/\1/p')
-
-update_hash() {
-    url="https://downloads.vivaldi.com/stable/vivaldi-stable_$version-1_$2.deb"
-    hash=$(nix hash to-sri --type sha256 $(nix-prefetch-url --type sha256 "$url"))
-    update-source-version vivaldi "$version" "$hash" --system=$1 --ignore-same-version
-}
-
-update_hash aarch64-linux arm64
-update_hash x86_64-linux amd64
@@ -1,47 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i bash -p libarchive curl common-updater-scripts
-
-set -eu -o pipefail
-
-cd "$(dirname "${BASH_SOURCE[0]}")"
-root=../../../../..
-export NIXPKGS_ALLOW_UNFREE=1
-
-version() {
-  (cd "$root" && nix-instantiate --eval --strict -A "$1.version" | tr -d '"')
-}
-
-vivaldi_version_old=$(version vivaldi)
-vivaldi_version=$(curl -sS https://vivaldi.com/download/ | sed -rne 's/.*vivaldi-stable_([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+)-1_amd64\.deb.*/\1/p')
-
-if [[ ! "$vivaldi_version" = "$vivaldi_version_old" ]]; then
-  echo "vivaldi is not up-to-date, not updating codecs"
-  (cd "$root" && nix-shell maintainers/scripts/update.nix --argstr package vivaldi)
-  exit
-fi
-
-echo "vivaldi is up-to-date, updating codecs"
-
-# Download vivaldi and save file path.
-url="https://downloads.vivaldi.com/stable/vivaldi-stable_${vivaldi_version}-1_amd64.deb"
-mapfile -t prefetch < <(nix-prefetch-url --print-path "$url")
-path=${prefetch[1]}
-
-nixpkgs="$(git rev-parse --show-toplevel)"
-default_nix="$nixpkgs/pkgs/applications/networking/browsers/vivaldi/default.nix"
-ffmpeg_nix="$nixpkgs/pkgs/applications/networking/browsers/vivaldi/ffmpeg-codecs.nix"
-
-# Check vivaldi-ffmpeg-codecs version.
-chromium_version_old=$(version vivaldi-ffmpeg-codecs)
-ffmpeg_update_script=$(bsdtar xOf "$path" data.tar.xz | bsdtar xOf - ./opt/vivaldi/update-ffmpeg)
-chromium_version=$(sed -rne 's/^FFMPEG_VERSION_DEB\=([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+).*/\1/p' <<< $ffmpeg_update_script)
-download_subdir=$(sed -rne 's/.*FFMPEG_URL_DEB\=https:\/\/launchpadlibrarian\.net\/([0-9]+)\/.*_amd64\.deb/\1/p' <<< $ffmpeg_update_script)
-
-if [[ "$chromium_version" != "$chromium_version_old" ]]; then
-  # replace the download prefix
-  sed -i $ffmpeg_nix -e "s/\(https:\/\/launchpadlibrarian\.net\/\)[0-9]\+/\1$download_subdir/g"
-  (cd "$root" && update-source-version vivaldi-ffmpeg-codecs "$chromium_version")
-
-  git add "${ffmpeg_nix}"
-  git commit -m "vivaldi-ffmpeg-codecs: $chromium_version_old -> $chromium_version"
-fi
@@ -20,14 +20,14 @@

 python3Packages.buildPythonApplication rec {
  pname = "alpaca";
-  version = "5.2.0";
+  version = "6.0.5";
  pyproject = false; # Built with meson

  src = fetchFromGitHub {
    owner = "Jeffser";
    repo = "Alpaca";
    tag = version;
-    hash = "sha256-uUGsdHrqzA5fZ4LNtX04H4ue9n4JQrkTYW2PCCFYFHc=";
+    hash = "sha256-faxqSUYqf3vRZYeuXAzv+n1inMVwl5KmnndABF77Sus=";
  };

  nativeBuildInputs = [
@@ -51,7 +51,6 @@ python3Packages.buildPythonApplication rec {
    pygobject3
    requests
    pillow
-    pypdf
    html2text
    youtube-transcript-api
    pydbus
@@ -59,8 +58,13 @@ python3Packages.buildPythonApplication rec {
    pyicu
    matplotlib
    openai
+    markitdown
  ];

+  optional-dependencies = {
+    speech-to-text = [ python3Packages.openai-whisper ];
+  };
+
  dontWrapGApps = true;

  makeWrapperArgs = [
@@ -12,15 +12,14 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "workspacesclient";
-  version = "2024.8.5191";
+  version = "2025.0.5296";

  src = fetchurl {
    urls = [
      # Check new version at https://d3nt0h4h6pmmc4.cloudfront.net/ubuntu/dists/jammy/main/binary-amd64/Packages
      "https://d3nt0h4h6pmmc4.cloudfront.net/ubuntu/dists/jammy/main/binary-amd64/workspacesclient_${finalAttrs.version}_amd64.deb"
-      "https://d3nt0h4h6pmmc4.cloudfront.net/new_workspacesclient_jammy_amd64.deb"
    ];
-    hash = "sha256-BDxMycVgWciJZe8CtElXaWVnqYDQO5NmawK10GvP2+k=";
+    hash = "sha256-VPNZN9AsrGJ56O8B5jxlgLMvrUViTv6yto8c5pGQc0A=";
  };

  nativeBuildInputs = [
@@ -6,7 +6,7 @@
  lz4,
  nixosTests,
  pkg-config,
-  rocksdb_7_10,
+  rocksdb_9_10,
  snappy,
  stdenv,
  zeromq,
@@ -14,23 +14,23 @@
 }:

 let
-  rocksdb = rocksdb_7_10;
+  rocksdb = rocksdb_9_10;
 in
 buildGoModule rec {
  pname = "blockbook";
-  version = "0.4.0";
-  commit = "b227dfe";
+  version = "0.5.0";
+  commit = "657cbcf";

  src = fetchFromGitHub {
    owner = "trezor";
    repo = "blockbook";
    rev = "v${version}";
-    hash = "sha256-98tp3QYaHfhVIiJ4xkA3bUanXwK1q05t+YNroFtBUxE=";
+    hash = "sha256-8/tyqmZE9NJWGg7zYcdei0f1lpXfehy6LM6k5VHW33g=";
  };

  proxyVendor = true;

-  vendorHash = "sha256-n03eWWy+58KAbYnKxI3/ulWIpmR+ivtImQSqbe2kpYU=";
+  vendorHash = "sha256-W29AvzfleCYC2pgHj2OB00PWBTcD2UUDbDH/z5A3bQ4=";

  nativeBuildInputs = [ pkg-config ];

@@ -49,8 +49,6 @@ buildGoModule rec {
    "-X github.com/trezor/blockbook/common.buildDate=unknown"
  ];

-  tags = [ "rocksdb_7_10" ];
-
  CGO_LDFLAGS = [
    "-L${lib.getLib stdenv.cc.cc}/lib"
    "-lrocksdb"
@@ -84,7 +82,6 @@ buildGoModule rec {
    license = licenses.agpl3Only;
    maintainers = with maintainers; [
      mmahut
-      _1000101
    ];
    platforms = platforms.unix;
    mainProgram = "blockbook";
@@ -5,13 +5,13 @@
  "packages": {
    "": {
      "dependencies": {
-        "@anthropic-ai/claude-code": "^1.0.3"
+        "@anthropic-ai/claude-code": "^1.0.5"
      }
    },
    "node_modules/@anthropic-ai/claude-code": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-1.0.3.tgz",
-      "integrity": "sha512-a4aBhcXGG7k4YtyF2aYVKt08h48BG+F12RA/G3K1vb6unl9CAvWDP/A7xudtCOzxFKxLwxctrn74pHEdpmHSPw==",
+      "version": "1.0.5",
+      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-1.0.5.tgz",
+      "integrity": "sha512-A4RkIuHktcNygeZXfj/EcF1M5KXlPSwBBXLQLldUNyX4DFAeCpKh9b0UqnLlMd519QBmfmRYDvZqUlt7Fx0a7g==",
      "hasInstallScript": true,
      "license": "SEE LICENSE IN README.md",
      "bin": {
@@ -7,16 +7,16 @@

 buildNpmPackage rec {
  pname = "claude-code";
-  version = "1.0.3";
+  version = "1.0.5";

  nodejs = nodejs_20; # required for sandboxed Nix builds on Darwin

  src = fetchzip {
    url = "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-${version}.tgz";
-    hash = "sha256-LjDxVv6KSTuRZhCHztvf81E5DQbkqs8cbrnbbGkCeQU=";
+    hash = "sha256-bvfP1fkfRURLjgJ3mu5a+Rq9IqcU/Y/LkDp4MXzudww=";
  };

-  npmDepsHash = "sha256-muMukVEj6uXkupSoyp41FihsLth0ENgfzBlD5CwlE2w=";
+  npmDepsHash = "sha256-u7coCE1bu5Z8r59vaoQOaWfXTRytX4HH3QIA6vf3DNc=";

  postPatch = ''
    cp ${./package-lock.json} package-lock.json
@@ -40,6 +40,8 @@ py.pkgs.buildPythonApplication rec {
      --replace-fail "prov == 1.5.1" "prov" \
      --replace-fail '"schema-salad >= 8.7, < 9",' '"schema-salad",' \
      --replace-fail "PYTEST_RUNNER + " ""
+    substituteInPlace pyproject.toml \
+      --replace-fail "mypy==1.14.1" "mypy"
  '';

  build-system = with py.pkgs; [
@@ -2,11 +2,11 @@
 { fetchLibrustyV8 }:

 fetchLibrustyV8 {
-  version = "135.1.0";
+  version = "137.1.0";
  shas = {
-    x86_64-linux = "sha256-QGpFNkVHO9j4uagYNC5X3JVif80RVazp63oqrdWYUoU=";
-    aarch64-linux = "sha256-J4E32qZNyqmJyFKBuU+6doRYL3ZSaEMSBlML+hSkj+o=";
-    x86_64-darwin = "sha256-UnulsDS1LlrVR2+cz+4zgWxKqbkB5ch3T9UofGCZduQ=";
-    aarch64-darwin = "sha256-mU7N/1vXzCP+mwjzLTsDkT+8YOJifwNju3Rv9Cq5Loo=";
+    x86_64-linux = "sha256-Tiscfy2bzYGR3s0T+SC1IB3xWvTVpVcSEdjq3MCRoRw=";
+    aarch64-linux = "sha256-2GYc+fgZLGUMQCXXSiyYUNKxZM4Mb788by+cWPdA9+4=";
+    x86_64-darwin = "sha256-yOJWfwIdl+uF7z7K6RzTcwnlgkDE8NM+e1tbWshx8+k=";
+    aarch64-darwin = "sha256-QQaC74Itb3D9EaN6PTxrjAGd/F9d6HY6PiLp+8jHK24=";
  };
 }
@@ -21,17 +21,17 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "deno";
-  version = "2.2.12";
+  version = "2.3.3";

  src = fetchFromGitHub {
    owner = "denoland";
    repo = "deno";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-/5KCwWyPdx/OKjoKgHZ8BAih7dh21VrbC+N1U74B/KI=";
+    hash = "sha256-KfgxKmxkF5/BrAsXkpmyWXV2H+vwX31dnzQORtt3A90=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-3I1yplJjVH7Mf2wjwk8qSdbHTcR20QSJGF9MHtnu+q8=";
+  cargoHash = "sha256-DWODuTslGvx9PHUMsxY+MS15IcECcq7Ne7IUEovWoa0=";

  postPatch = ''
    # Use patched nixpkgs libffi in order to fix https://github.com/libffi/libffi/pull/857
@@ -3,12 +3,13 @@
  stdenv,
  fetchFromGitHub,
  nix-update-script,
-  pnpm_9,
+  # Pinned, because our FODs are not guaranteed to be stable between major versions.
+  pnpm_10,
  nodejs,
  python3,
  makeWrapper,
-  # Upstream uses EOL Electron 31.  Use next oldest version.
-  electron_34,
+  # Electron updates frequently break Heroic, so pin same version as upstream, or newest non-EOL.
+  electron_36,
  vulkan-helper,
  gogdl,
  legendary-heroic,
@@ -17,27 +18,27 @@
 }:

 let
-  electron = electron_34;
+  electron = electron_36;
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "heroic-unwrapped";
-  version = "2.16.1";
+  version = "2.17.0";

  src = fetchFromGitHub {
    owner = "Heroic-Games-Launcher";
    repo = "HeroicGamesLauncher";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-BnBzbbyi9cdO6W59cnY13hnhH+tjrTryTp9XIcERwh4=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Tjme43vw+aIjyXBIsaNE8+bWrLKpIDJZpQaKb/bJYFQ=";
  };

-  pnpmDeps = pnpm_9.fetchDeps {
+  pnpmDeps = pnpm_10.fetchDeps {
    inherit (finalAttrs) pname version src;
-    hash = "sha256-2IQyXULgFoz0rFQ8SwERgMDzzo7pZ3DbqhwrWNYSwRo=";
+    hash = "sha256-cV0+HZb6g65kGu1zOBueY954ol1bLGW8ddCniwAVWcw=";
  };

  nativeBuildInputs = [
    nodejs
-    pnpm_9.configHook
+    pnpm_10.configHook
    python3
    makeWrapper
  ];
@@ -7,13 +7,13 @@

 buildNpmPackage (finalAttrs: {
  pname = "hypercore";
-  version = "11.7.0";
+  version = "11.8.3";

  src = fetchFromGitHub {
    owner = "holepunchto";
    repo = "hypercore";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-ZAKWFSOIAQysK9+4YxbUiL0fVsqnGFqhwe9ps6ZXYv0=";
+    hash = "sha256-3b1Q2fDEGEqI/HW/zKgxbzqFn368V5kHVETqRcJF+1U=";
  };

  npmDepsHash = "sha256-ZJxVmQWKgHyKkuYfGIlANXFcROjI7fibg6mxIhDZowM=";
@@ -13,17 +13,17 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "laze";
-  version = "0.1.35";
+  version = "0.1.36";

  src = fetchFromGitHub {
    owner = "kaspar030";
    repo = "laze";
    tag = finalAttrs.version;
-    hash = "sha256-/ACHYaAR9xtC7r5+bn1mXGr1eM3kV0L68+YMRIgxAsI=";
+    hash = "sha256-516VJ6yzQOn8a1ufpxbJ8lCHcs09PVzPmXyWU7F+REk=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-xiJz+JEF5feytwYgml+mfrarmLPntKbxCAQQvBnwAkI=";
+  cargoHash = "sha256-vLlkgF8vfL4RbFH7S3pQaAgHs08glHJaIkFIBYLoAWE=";

  passthru.updateScript = nix-update-script { };

@@ -8,11 +8,11 @@

 let
  pname = "ledger-live-desktop";
-  version = "2.113.0";
+  version = "2.113.2";

  src = fetchurl {
    url = "https://download.live.ledger.com/${pname}-${version}-linux-x86_64.AppImage";
-    hash = "sha256-mF6YwgbqZF5ccJCABoagtEq5WpnhDNFcvij1wL+buF0=";
+    hash = "sha256-jJvIncD1vGZ2t0Rpl42AoVGKPlLGhMsoU91//rxOWnw=";
  };

  appimageContents = appimageTools.extractType2 {
@@ -16,19 +16,19 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "libeufin";
-  version = "0.13.0";
+  version = "1.0.2";

  src = fetchgit {
    url = "https://git.taler.net/libeufin.git/";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-whGcFZYuyeFfhu+mIi7oUNJRXjaVGuL67sfUrHF85Fs=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-ZjZo0oCsrnc413OY7ElU95Vto9Smp6fuPI3RzJzC3Zk=";
    fetchSubmodules = true;
    leaveDotGit = true; # required for correct submodule fetching
-    # Delete .git folder for reproducibility (otherwise, the hash changes unexpectedly after fetching submodules)
    # Save the HEAD short commit hash in a file so it can be retrieved later for versioning.
+    # Delete .git folder for reproducibility (otherwise, the hash changes unexpectedly after fetching submodules)
    postFetch = ''
      pushd $out
-      git rev-parse --short HEAD > ./common/src/main/resources/HEAD.txt
+      git rev-parse HEAD > ./common/src/main/resources/HEAD.txt
      rm -rf .git
      popd
    '';
@@ -116,6 +116,7 @@ stdenv.mkDerivation (finalAttrs: {
    description = "Integration and sandbox testing for FinTech APIs and data formats";
    license = lib.licenses.agpl3Plus;
    maintainers = with lib.maintainers; [ atemu ];
+    teams = with lib.teams; [ ngi ];
    mainProgram = "libeufin-bank";
    sourceProvenance = with lib.sourceTypes; [
      fromSource
@@ -140,6 +140,10 @@ mattermost.overrideAttrs (
        "TestElasticSearchIndexerJobIsEnabled"
        "TestElasticSearchIndexerPending"

+        # Broken in the sandbox.
+        "TestVersion"
+        "TestRunServerNoSystemd"
+
        # Appear to be broken.
        "TestSessionStore/MySQL/SessionGetWithDeviceId"
        "TestSessionStore/MySQL/GetMobileSessionMetadata"
@@ -4,14 +4,14 @@
  fetchFromGitHub,
 }:

-buildGoModule rec {
+buildGoModule (finalAttrs: {
  pname = "mesos-dns";
  version = "0.9.3";

  src = fetchFromGitHub {
    owner = "m3scluster";
    repo = "mesos-dns";
-    rev = "v${version}";
+    tag = "v${finalAttrs.version}";
    hash = "sha256-/zcjQ2AxZ17rAxrRmfztj5gH1pu2QswJgaCE022FieU=";
  };

@@ -26,10 +26,10 @@ buildGoModule rec {

  meta = {
    homepage = "https://m3scluster.github.io/mesos-dns/";
-    changelog = "https://github.com/m3scluster/mesos-dns/releases/tag/v${version}";
+    changelog = "https://github.com/m3scluster/mesos-dns/releases/tag/v${finalAttrs.version}";
    description = "DNS-based service discovery for Mesos";
    license = lib.licenses.asl20;
    maintainers = with lib.maintainers; [ aaronjheng ];
    mainProgram = "mesos-dns";
  };
-}
+})
@@ -19,6 +19,7 @@ let
    x86_64-darwin = "darwin-amd64";
    x86_64-linux = "linux-amd64";
  };
+  inherit (platformMap.${stdenv.system}) os arch;
 in

 maven.buildMavenPackage rec {
@@ -30,10 +31,11 @@ maven.buildMavenPackage rec {
    rev = version;
    sha256 = "sha256-c1jD7m4cOdPWQEoaUMcNap2zvvX7H9VaWQv8JSgAnRU=";
  };
+  patches = [ ./patches/0001-update-groovy-for-compatibility-with-Java-24.patch ];

  # need graalvm at build-time for the `native-image` tool
  mvnJdk = graalvmPackages.graalvm-ce;
-  mvnHash = "sha256-Bx0XSnpHNxNX07uVPc18py9qbnG5b3b7J4vs44ty034=";
+  mvnHash = "sha256-/Ful6v3hfm+0aa0vBQhqMK6VE+93L3o7pwZ6wmeXzQY=";

  nativeBuildInputs = [
    graalvmPackages.graalvm-ce
@@ -101,7 +103,7 @@ maven.buildMavenPackage rec {
    description = "The Apache Maven Daemon";
    homepage = "https://maven.apache.org/";
    license = lib.licenses.asl20;
-    platforms = lib.platforms.unix;
+    platforms = builtins.attrNames platformMap;
    maintainers = with lib.maintainers; [ nathanregner ];
    mainProgram = "mvnd";
  };
@@ -0,0 +1,34 @@
+From 4d92b26f6cfc7c5f164caf11c1d5325815058624 Mon Sep 17 00:00:00 2001
+From: Nathan Regner <nathanregner@gmail.com>
+Date: Fri, 16 May 2025 23:28:13 -0600
+Subject: [PATCH] build: update groovy for compatibility with Java 24
+
+---
+ pom.xml | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/pom.xml b/pom.xml
+index c1cec38b..7534ffd5 100644
+--- a/pom.xml
+++ b/pom.xml
+@@ -80,7 +80,7 @@
+     <!-- cannot upgrade graalvm to 23.0.0 which requires JDK >= 20 -->
+     <graalvm.version>24.0.2</graalvm.version>
+     <graalvm.plugin.version>0.10.2</graalvm.plugin.version>
+-    <groovy.version>4.0.22</groovy.version>
+    <groovy.version>4.0.24</groovy.version>
+     <jakarta.inject.version>1.0</jakarta.inject.version>
+     <jline.version>3.26.3</jline.version>
+     <maven.version>3.9.9</maven.version>
+@@ -91,7 +91,7 @@
+ 
+     <!-- plugin versions a..z -->
+     <buildnumber-maven-plugin.version>3.2.0</buildnumber-maven-plugin.version>
+-    <groovy-maven-plugin.version>3.0.2</groovy-maven-plugin.version>
+    <groovy-maven-plugin.version>4.2.0</groovy-maven-plugin.version>
+     <mrm.version>1.6.0</mrm.version>
+     <junit-platform-launcher.version>1.10.3</junit-platform-launcher.version>
+     <takari-provisio.version>1.0.25</takari-provisio.version>
+-- 
+2.49.0
+
@@ -10,14 +10,14 @@

 python3Packages.buildPythonApplication rec {
  pname = "nix-fast-build";
-  version = "1.1.0";
+  version = "1.2.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "Mic92";
    repo = "nix-fast-build";
    rev = "refs/tags/${version}";
-    hash = "sha256-HkaJeIFgxncLm8MC1BaWRTkge9b1/+mjPcbzXTRshoM=";
+    hash = "sha256-lOouOgusUU3x97wClX8+WdbzpneMiRTdCqDSxGc/RlU=";
  };

  build-system = [ python3Packages.setuptools ];
@@ -6,18 +6,18 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "oniux";
-  version = "0.4.0";
+  version = "0.5.0";

  src = fetchFromGitLab {
    domain = "gitlab.torproject.org";
    owner = "tpo/core";
    repo = "oniux";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-wWB/ch8DB2tO4+NuNDaGv8K4AbV5/MbyY01oRGai86A=";
+    hash = "sha256-rtQUHTDPQXL4gT8/Nl0hV/F06ybPIfemibCzH3mFHaY=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-tUOxs9bTcXS3Gq6cHYe+eAGAEYSRvf3JVGugBImbvJM=";
+  cargoHash = "sha256-79KNytAXxuYi9VBmkkOJg2ugjjoKJ/BPBqWa7Z72HGI=";

  passthru.updateScript = nix-update-script { };

@@ -9,13 +9,13 @@
 }:
 let
  pname = "open-webui";
-  version = "0.6.11";
+  version = "0.6.12";

  src = fetchFromGitHub {
    owner = "open-webui";
    repo = "open-webui";
    tag = "v${version}";
-    hash = "sha256-G5rbSClztrphQwVYoBvfFTZ/dPHCuxL1PdZZhSy2RbQ=";
+    hash = "sha256-q8pb+XIBKzU8zWohBtKNQhYBwcQF51/uqgVrMxcKcUc=";
  };

  frontend = buildNpmPackage rec {
@@ -32,7 +32,7 @@ let
      url = "https://github.com/pyodide/pyodide/releases/download/${pyodideVersion}/pyodide-${pyodideVersion}.tar.bz2";
    };

-    npmDepsHash = "sha256-qQzAehIXMWyXmz7jT0aU6zsSXi3WVcOjchcA+3M7tAU=";
+    npmDepsHash = "sha256-576Cd7I4CzOItSycQH8CwLAelLoNnQcJVZ338IhMb/k=";

    # Disabling `pyodide:fetch` as it downloads packages during `buildPhase`
    # Until this is solved, running python packages from the browser will not work.
@@ -8,18 +8,18 @@

 buildGoModule (finalAttrs: {
  pname = "opkssh";
-  version = "0.6.1";
+  version = "0.7.0";

  src = fetchFromGitHub {
    owner = "openpubkey";
    repo = "opkssh";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-BK34zw/VYv6mAn68U8tRoOU6Obz3P+6Hw12fsKBuUf8=";
+    hash = "sha256-8fbOhyrHgNG9ulu/DZvUHzIojvoHG/gb5+Ft/RmMHXk=";
  };

  ldflags = [ "-X main.Version=${finalAttrs.version}" ];

-  vendorHash = "sha256-6nTRiybsNtP/BiDaNrFEGEGM41BAjGpOyQ0AlQimSE4=";
+  vendorHash = "sha256-bkTQqtlZhZ2/WnQNRdZzfblkGKjaAS22RFl6I1O3/yA=";

  nativeInstallCheckInputs = [
    versionCheckHook
@@ -10,17 +10,17 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "pixi-pack";
-  version = "0.6.2";
+  version = "0.6.6";

  src = fetchFromGitHub {
    owner = "Quantco";
    repo = "pixi-pack";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-ccKJtGKhfYiJm8/2yOlCZtRECvax1dTgtNOtabzfhI4=";
+    hash = "sha256-U5I/wc0HDoi+EHQ3JIs2S/ky/uH5pA1KaTuTo6Bllus=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-+rwG9lPK0Ec7CCtVccwGrFOqfZqeXNA3WsN1QivABQA=";
+  cargoHash = "sha256-RqTaBs+kU8j6TmeX7cROZPEN4CeTKojwRJtXvfj2f8w=";

  buildInputs = [ openssl ];

@@ -16,13 +16,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "pkg";
-  version = "2.1.2";
+  version = "2.1.4";

  src = fetchFromGitHub {
    owner = "freebsd";
    repo = "pkg";
    rev = finalAttrs.version;
-    hash = "sha256-mIuUewuW+aw0ZDGstUadfHkjamDxPRp1O/YVZ9JuCtg=";
+    hash = "sha256-aqNJGor6gH/7XjwuT2uD7L89wn1kzsFKBMlitSVjUCM=";
  };

  setOutputFlags = false;
@@ -7,13 +7,13 @@

 buildGoModule {
  pname = "pkgsite";
-  version = "0-unstable-2025-05-06";
+  version = "0-unstable-2025-05-23";

  src = fetchFromGitHub {
    owner = "golang";
    repo = "pkgsite";
-    rev = "1bc9132f566501f5f66bfcb147479cf741704cf4";
-    hash = "sha256-FfgwHiqbDhVp31YQzalveG+JVe93gXUq/XvTwPV7zsI=";
+    rev = "0e6de173c6b5ef31749de2ae384bb05ddc6726ba";
+    hash = "sha256-WRNw+BjUY8/gj7tcPs0Ifz47JtBlU+SEIt12EZmtOjw=";
  };

  vendorHash = "sha256-s8uYvMQENqeUN8DbZ/jNhcTe2dJeiE9UYPCPGeScO10=";
@@ -17,13 +17,13 @@ let
 in
 rustPlatform.buildRustPackage rec {
  pname = "polkadot";
-  version = "2503-2";
+  version = "2503-5";

  src = fetchFromGitHub {
    owner = "paritytech";
    repo = "polkadot-sdk";
    rev = "polkadot-stable${version}";
-    hash = "sha256-sUBUWFAJ8PwWUVSqPef0SMJcvSt+bGruTW+GmJGTLdE=";
+    hash = "sha256-hQ0tXPore1kbezBCsacAsSZAB1GHXEp5BJatxdi19eI=";

    # the build process of polkadot requires a .git folder in order to determine
    # the git commit hash that is being built and add it to the version string.
@@ -45,7 +45,7 @@ rustPlatform.buildRustPackage rec {
  '';

  useFetchCargoVendor = true;
-  cargoHash = "sha256-U3roe7rQL1BaHr3rKV1Dl7Lhjic3pZlxo2DpD9C2ong=";
+  cargoHash = "sha256-fK8EBgIdXHfxpNWUyquEutZpkTGSe11ZsLwe13ZZ1+0=";

  buildType = "production";
  buildAndTestSubdir = "polkadot";
@@ -9,13 +9,13 @@

 buildGoModule (finalAttrs: {
  pname = "scotty";
-  version = "0.5.2";
+  version = "0.6.0";

  src = fetchFromSourcehut {
    owner = "~phw";
    repo = "scotty";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-3SIgsAdcG44dhEZnoE1FE0prI8aVKtkeYYsmwK+UvUI=";
+    hash = "sha256-VvBnTnW4ngJ0yPT2CV7t7HEUwJlBfWNE3coTHxGcAs4=";
  };

  # Otherwise checks fail with `panic: open /etc/protocols: operation not permitted` when sandboxing is enabled on Darwin
@@ -25,7 +25,7 @@ buildGoModule (finalAttrs: {
      --replace-fail '!os.IsNotExist(err)' '!os.IsNotExist(err) && !os.IsPermission(err)'
  '';

-  vendorHash = "sha256-9LkWoep4R8Mii34m5wkLCw6AAMP92I1lgQnHajgzae8=";
+  vendorHash = "sha256-5mDY3vlRzoqJleNukB8NcPaAcDLX/UNegUSBYFMzGGA=";

  env = {
    # *Some* locale is required to be set
@@ -11,17 +11,17 @@
 }:
 rustPlatform.buildRustPackage rec {
  pname = "surrealdb";
-  version = "2.3.2";
+  version = "2.3.3";

  src = fetchFromGitHub {
    owner = "surrealdb";
    repo = "surrealdb";
    tag = "v${version}";
-    hash = "sha256-D7eujFJiFHmWlEoVkMkUSIdJt5fx+jTTqDwZs0JJw4o=";
+    hash = "sha256-1qdO9uRuR/s7j58HjA9k3XQWoqdPMRVcReTqIWTdWGc=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-dXLJKwwNIv4QcbROJyWB9oGBqh6bztz37tXMzc5jYUM=";
+  cargoHash = "sha256-OfSSrHwjqIZ8DYE2XAPnHBsPy4ILS+57hLXJdDgafGk=";

  # error: linker `aarch64-linux-gnu-gcc` not found
  postPatch = ''
@@ -10,13 +10,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "tailwindcss-language-server";
-  version = "0.14.18";
+  version = "0.14.19";

  src = fetchFromGitHub {
    owner = "tailwindlabs";
    repo = "tailwindcss-intellisense";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-CdjlioWLDvEG1G76zZ9lPmOPV1Y88VdwTXxrdIr28fE=";
+    hash = "sha256-lAZ3BoecPB3+zmI8RataAcbk32avV9Ie+Ek6q/JcXnU=";
  };

  pnpmDeps = pnpm_9.fetchDeps {
@@ -21,12 +21,12 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "taler-challenger";
-  version = "0.14.3-unstable-2025-02-17";
+  version = "1.0.0";

  src = fetchgit {
    url = "https://git.taler.net/challenger.git";
-    rev = "e49e33a13df92c6a1d6f119775baa31778163531";
-    hash = "sha256-AOtCx/r6JzwOSF3b3lDeY0/S+dGGNrJELerFoQ/K4tA=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-ZKRqNlva3LZCuAva7h6Wk2NIuHF3rReR+yNETqbCv1k=";
  };

  # https://git.taler.net/challenger.git/tree/bootstrap
@@ -76,6 +76,7 @@ stdenv.mkDerivation (finalAttrs: {
    homepage = "https://git.taler.net/challenger.git";
    license = lib.licenses.agpl3Plus;
    maintainers = with lib.maintainers; [ wegank ];
+    teams = with lib.teams; [ ngi ];
    platforms = lib.platforms.linux;
  };
 })
@@ -23,13 +23,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "taler-exchange";
-  version = "0.14.6-unstable-2025-03-02";
+  version = "1.0.4";

  src = fetchgit {
    url = "https://git.taler.net/exchange.git";
-    rev = "13e058a902a3dbee9d7fe327030b88c2d126675b";
+    tag = "v${finalAttrs.version}";
    fetchSubmodules = true;
-    hash = "sha256-fqlYpFggQkB/IqD6V01ec+G4EtoNaA/FXigM+jqIMe0=";
+    hash = "sha256-k2e9pzy7vSIjCVGOVif9ntYvLcvoJA6J63vB/lg3iwA=";
  };

  patches = [ ./0001-add-TALER_TEMPLATING_init_path.patch ];
@@ -125,6 +125,7 @@ stdenv.mkDerivation (finalAttrs: {
    changelog = "https://git.taler.net/exchange.git/tree/ChangeLog";
    license = lib.licenses.agpl3Plus;
    maintainers = with lib.maintainers; [ astro ];
+    teams = with lib.teams; [ ngi ];
    platforms = lib.platforms.linux;
  };
 })
@@ -18,13 +18,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "taler-merchant";
-  version = "0.14.6-unstable-2025-03-02";
+  version = "1.0.1";

  src = fetchgit {
    url = "https://git.taler.net/merchant.git";
-    rev = "c84ed905e2d4af60162a7def5c0fc430394930e6";
+    tag = "v${finalAttrs.version}";
    fetchSubmodules = true;
-    hash = "sha256-LXmrY8foiYOxCik23d3f4t9+tldbm7bVGG8eQOLsm+A=";
+    hash = "sha256-H/JqMGLP0u68g/bMqsollAk6sKL73TCZ9no49psYST0=";
  };

  postUnpack = ''
@@ -104,6 +104,7 @@ stdenv.mkDerivation (finalAttrs: {
    changelog = "https://git.taler.net/merchant.git/tree/ChangeLog";
    license = lib.licenses.agpl3Plus;
    maintainers = with lib.maintainers; [ astro ];
+    teams = with lib.teams; [ ngi ];
    platforms = lib.platforms.linux;
  };
 })
@@ -19,12 +19,12 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "taler-sync";
-  version = "0.14.2-unstable-2025-03-02";
+  version = "1.0.0";

  src = fetchgit {
    url = "https://git.taler.net/sync.git";
-    rev = "10d0e97f191a8bd7de07049559a2eccb29a78507";
-    hash = "sha256-aihxgknPCE8tbRfncbMO/zHGg395LHVuXWyln2ryiCw=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-di+AgCCgOTvzR6Fberz1ISo6ZT+OsKikeNCU2HZHSz4=";
  };

  strictDeps = true;
@@ -58,6 +58,7 @@ stdenv.mkDerivation (finalAttrs: {
    homepage = "https://git.taler.net/sync.git";
    license = lib.licenses.agpl3Plus;
    maintainers = with lib.maintainers; [ wegank ];
+    teams = with lib.teams; [ ngi ];
    platforms = lib.platforms.linux;
  };
 })
@@ -37,12 +37,12 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "taler-wallet-core";
-  version = "0.14.1";
+  version = "1.0.12";

  src = fetchgit {
-    url = "https://git.taler.net/wallet-core.git";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-Sae83qGPqVwuxKf30zHCmdOoo5rDPBHKSOE1hxNn7Xo=";
+    url = "https://git.taler.net/taler-typescript-core.git";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-lTFiaIgkPw0FhrpYPwg5/MMl8Yo1MfkDPYEDSJ11rQ8=";
  };

  nativeBuildInputs = [
@@ -56,7 +56,7 @@ stdenv.mkDerivation (finalAttrs: {

  pnpmDeps = pnpm_9.fetchDeps {
    inherit (finalAttrs) pname version src;
-    hash = "sha256-BVVmv0VVvQ2YhL0zOKiM1oVKJKvqwMGNR47DkcCj874=";
+    hash = "sha256-pLe5smsXdzSBgz/OYNO5FVEI2L6y/p+jMxEkzqUaX34=";
  };

  buildInputs = [ nodejs_20 ];
@@ -6,20 +6,17 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "theharvester";
-  version = "4.7.1";
+  version = "4.8.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "laramies";
    repo = "theharvester";
    tag = version;
-    hash = "sha256-IBisnQGdhPCoVPPH/GHLJg5qoh08KfMuMxbsqF3jjpE=";
+    hash = "sha256-zKytU80jmZl5TwY5ti6YZ85DbJnXIMqFLKjMN9jfw7E=";
  };

-  postPatch = ''
-    # Requirements are pinned
-    sed -i 's/==.*//' requirements/base.txt
-  '';
+  pythonRelaxDeps = true;

  pythonRemoveDeps = [ "winloop" ];

@@ -5,7 +5,9 @@
  installShellFiles,
  pkg-config,
  openssl,
-  nix-update-script,
+  writeShellScript,
+  nix-update,
+  gitMinimal,
  versionCheckHook,
  callPackage,
 }:
@@ -60,7 +62,25 @@ rustPlatform.buildRustPackage (finalAttrs: {
  versionCheckProgramArg = "--version";

  passthru = {
-    updateScript = nix-update-script { };
+    updateScript = {
+      command = [
+        (writeShellScript "update-typst.sh" ''
+          currentVersion=$(nix-instantiate --eval -E "with import ./. {}; typst.version or (lib.getVersion typst)" | tr -d '"')
+          ${lib.getExe nix-update} typst > /dev/null
+          latestVersion=$(nix-instantiate --eval -E "with import ./. {}; typst.version or (lib.getVersion typst)" | tr -d '"')
+          changes=()
+          if [[ "$currentVersion" != "$latestVersion" ]]; then
+            changes+=("{\"attrPath\":\"typst\",\"oldVersion\":\"$currentVersion\",\"newVersion\":\"$latestVersion\",\"files\":[\"pkgs/by-name/ty/typst/package.nix\"]}")
+          fi
+          maintainers/scripts/update-typst-packages.py --output pkgs/by-name/ty/typst/typst-packages-from-universe.toml > /dev/null
+          ${lib.getExe gitMinimal} diff --quiet HEAD -- pkgs/by-name/ty/typst/typst-packages-from-universe.toml || changes+=("{\"attrPath\":\"typstPackages\",\"oldVersion\":\"0\",\"newVersion\":\"1\",\"files\":[\"pkgs/by-name/ty/typst/typst-packages-from-universe.toml\"]}")
+          echo -n "["
+            IFS=,; echo -n "''${changes[*]}"
+          echo "]"
+        '')
+      ];
+      supportedFeatures = [ "commit" ];
+    };
    packages = callPackage ./typst-packages.nix { };
    withPackages = callPackage ./with-packages.nix { };
  };
@@ -0,0 +1,57 @@
+{
+  lib,
+  cmake,
+  fetchFromGitHub,
+  fetchpatch2,
+  libuv,
+  nix-update-script,
+  stdenv,
+  testers,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "uvwasi";
+  version = "0.0.21";
+
+  src = fetchFromGitHub {
+    owner = "nodejs";
+    repo = "uvwasi";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-po2Pwqf97JXGKY8WysvyR1vSkqQ4XIF0VQG+83yV9nM=";
+  };
+
+  # Patch was sent upstream: https://github.com/nodejs/uvwasi/pull/302.
+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail 'DESTINATION ''${CMAKE_INSTALL_INCLUDEDIR}/uvwasi' 'DESTINATION ''${CMAKE_INSTALL_INCLUDEDIR}'
+  '';
+
+  outputs = [
+    "out"
+  ];
+
+  nativeBuildInputs = [
+    cmake
+  ];
+  buildInputs = [
+    libuv
+  ];
+
+  passthru = {
+    updateScript = nix-update-script { };
+
+    tests.pkg-config = testers.hasPkgConfigModules {
+      package = finalAttrs.finalPackage;
+      moduleNames = [ "uvwasi" ];
+    };
+  };
+
+  meta = {
+    description = "WASI syscall API built atop libuv";
+    homepage = "https://github.com/nodejs/uvwasi";
+    changelog = "https://github.com/nodejs/uvwasi/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ aduh95 ];
+    platforms = lib.platforms.all;
+  };
+})
@@ -10,7 +10,7 @@
 }:
 maven.buildMavenPackage rec {
  pname = "verapdf";
-  version = "1.26.4";
+  version = "1.26.5";

  mvnParameters = "-pl '!installer' -Dverapdf.timestamp=1980-01-01T00:00:02Z -Dproject.build.outputTimestamp=1980-01-01T00:00:02Z";

@@ -23,7 +23,8 @@ maven.buildMavenPackage rec {

  patches = [ ./stable-maven-plugins.patch ];

-  mvnHash = "sha256-VXivLGt440MfloWedtQlGukuZk0yui1QhjrpXGNNzqY=";
+  # FIXME: this hash keeps changing over time??
+  mvnHash = "sha256-uFY92BFsIu9B6clwQV3l718DsBxvswANrKEBIFGNXN4=";

  nativeBuildInputs = [
    makeWrapper
@@ -22,11 +22,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "webull-desktop";
-  version = "8.2.0";
+  version = "8.9.0";

  src = fetchurl {
-    url = "https://u1sweb.webullfintech.com/us/Webull%20Desktop_8.2.0_800200_global_x64signed.deb";
-    hash = "sha256-/KVY6I9gYWWZSJhsTW5GECCeOsx+6XAVIRpghlJUK4k=";
+    url = "https://u1sweb.webullfintech.com/us/Webull%20Desktop_8.9.0_80009000_global_x64signed.deb";
+    hash = "sha256-brt5EXUE9g72vN2Kx9/jf4P/lkVfWLsbzJIf13phgdI=";
  };

  nativeBuildInputs = [
@@ -1,13 +0,0 @@
-diff --git a/configure b/configure
-index 271c370..33aabfa 100755
--- a/configure
-+++ b/configure
-@@ -97,7 +97,7 @@ check_toolchain()
-         EMACS=""
-     else
-         emacs_version=$($EMACS --version 2>/dev/null | head -n 1)
-        if echo $emacs_version | grep -Eq 'GNU Emacs 2[6789]'; then
-+        if echo $emacs_version | grep -Eq 'GNU Emacs (2[6789]|30)'; then
-             echo "using emacs: $emacs_version"
-         else
-             echo "not using emacs: $emacs_version"
@@ -16,22 +16,15 @@
 }:
 stdenv.mkDerivation rec {
  pname = "xdp-tools";
-  version = "1.5.2";
+  version = "1.5.5";

  src = fetchFromGitHub {
    owner = "xdp-project";
    repo = "xdp-tools";
    rev = "v${version}";
-    hash = "sha256-NJawacCrmTuRXsOiAOMD8RaljPnuPFISoWEgiDcInw8=";
+    hash = "sha256-dK+ZpD1wv20iU51dsMUiW/Z9jojuwC8P3rrjU3LEB1Y=";
  };

-  patches = [
-    # Allow building with emacs 30
-    # Submitted upstream: https://github.com/xdp-project/xdp-tools/pull/484
-    # FIXME: remove when merged
-    ./emacs-30.patch
-  ];
-
  outputs = [
    "out"
    "lib"
@@ -8,14 +8,14 @@
 }:
 python3Packages.buildPythonApplication rec {
  pname = "ytdl-sub";
-  version = "2025.05.05";
+  version = "2025.05.23";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "jmbannon";
    repo = "ytdl-sub";
    tag = version;
-    hash = "sha256-zLYP3iGbTcWuffed7o5RuoYjlUvVFRt8FUOhL1vbW/U=";
+    hash = "sha256-296lizseyBJdpu80MnquPB1ldGgpAcey3iDwiaLqpOQ=";
  };

  postPatch = ''
@@ -2088,6 +2088,26 @@ self: super:
  gi-gtk_4 = self.gi-gtk_4_0_12;
  gi-gdk_4 = self.gi-gdk_4_0_10;

+  # Missing dependency on gi-gdkpixbuf
+  # https://github.com/haskell-gi/haskell-gi/commit/889f478456b38425eca7df42b01f85fae626f113
+  # Fixed in 2.91.35
+  gi-vte = overrideCabal (
+    oldAttrs:
+    assert lib.versionOlder oldAttrs.version "2.91.35";
+    {
+      # This is implemented as a sed expression instead of pulling a patch
+      # from upstream because the gi-vte repo doesn't actually contain a
+      # gi-vte.cabal file. The gi-vte.cabal file is generated from metadata in
+      # the repo.
+      postPatch =
+        (oldAttrs.postPatch or "")
+        + ''
+          sed -i 's/\(gi-gtk == .*\),/\1, gi-gdkpixbuf == 2.0.*,/' ./gi-vte.cabal
+        '';
+      buildDepends = (oldAttrs.buildDepends or [ ]) ++ [ self.gi-gdkpixbuf ];
+    }
+  ) super.gi-vte;
+
  # 2023-04-09: haskell-ci needs Cabal-syntax 3.10
  # 2024-03-21: pins specific version of ShellCheck
  # 2025-03-10: jailbreak, https://github.com/haskell-CI/haskell-ci/issues/771
@@ -0,0 +1,32 @@
+{
+  lib,
+  fetchFromGitHub,
+  buildDunePackage,
+  yojson,
+  melange,
+  ppxlib,
+}:
+
+buildDunePackage rec {
+  pname = "melange-json";
+  version = "2.0.0";
+  src = fetchFromGitHub {
+    owner = "melange-community";
+    repo = "melange-json";
+    tag = version;
+    hash = "sha256-vgcvPRc2vEHE1AtHyttvs1T0LcoeTOFfmPUCz95goT0=";
+  };
+
+  nativeBuildInputs = [ melange ];
+  buildInputs = [
+    melange
+    yojson
+    ppxlib
+  ];
+  meta = {
+    description = "Compositional JSON encode/decode library and PPX for Melange and OCaml";
+    homepage = "https://github.com/melange-community/melange-json";
+    license = lib.licenses.lgpl3;
+    maintainers = [ lib.maintainers.GirardR1006 ];
+  };
+}
@@ -15,7 +15,7 @@

 buildPythonPackage rec {
  pname = "aiogithubapi";
-  version = "24.6.0";
+  version = "25.5.0";
  pyproject = true;

  disabled = pythonOlder "3.8";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
    owner = "ludeeus";
    repo = "aiogithubapi";
    tag = version;
-    hash = "sha256-z7l7Qx9Kg1FZ9nM0V2NzTyi3gbE2hakbc/GZ1CzDmKw=";
+    hash = "sha256-zl9QpFpkvSTs0BUDMBmwTeLY1YvNRSqbkIZ5LDUP3zw=";
  };

  __darwinAllowLocalNetworking = true;
@@ -11,7 +11,7 @@

 buildPythonPackage rec {
  pname = "asdf-coordinates-schemas";
-  version = "0.3.0";
+  version = "0.4.0";
  pyproject = true;

  disabled = pythonOlder "3.10";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
    owner = "asdf-format";
    repo = "asdf-coordinates-schemas";
    tag = version;
-    hash = "sha256-LuC0m25OqQwivK/Z3OfoCtdhBV87rk16XrkJxUxG07o=";
+    hash = "sha256-ZE86W93PzKWdLrI+LNvxzrwMjOTy1fBV2AVJAaFWDMo=";
  };

  build-system = [
@@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "asdf-transform-schemas";
-  version = "0.5.0";
+  version = "0.6.0";
  pyproject = true;

  disabled = pythonOlder "3.8";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    pname = "asdf_transform_schemas";
    inherit version;
-    hash = "sha256-gs9MeCV1c0qJUyfyX/WDzpSZ1+K4Nv6IgLLXlhxrRis=";
+    hash = "sha256-D1D44Jb//S0UucgplZASZu8lsj0N/8MK1Bu6RoUalzI=";
  };

  build-system = [ setuptools-scm ];
@@ -15,7 +15,7 @@

 buildPythonPackage rec {
  pname = "bthome-ble";
-  version = "3.12.5";
+  version = "3.13.0";
  pyproject = true;

  disabled = pythonOlder "3.9";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
    owner = "Bluetooth-Devices";
    repo = "bthome-ble";
    tag = "v${version}";
-    hash = "sha256-SuGmNcx+z/4GOxgAsupY7NW+2ni7vLaAEC3EKn6ctpw=";
+    hash = "sha256-e6R3Qjj82z0E+gIxqDVM08Op3KlK9ZG1iNmkqqIEjWY=";
  };

  build-system = [ poetry-core ];
@@ -19,7 +19,7 @@

 buildPythonPackage rec {
  pname = "cwl-utils";
-  version = "0.37";
+  version = "0.38";
  pyproject = true;

  disabled = pythonOlder "3.8";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
    owner = "common-workflow-language";
    repo = "cwl-utils";
    tag = "v${version}";
-    hash = "sha256-OD8Nz8SIqB0Ie3S5663sQg3GjlCkC+qBvOXM9HZNuQU=";
+    hash = "sha256-goeMlyHYiS4JLOVBFjcLSzdYrdoIZ904hJHFPGZyxKo=";
  };

  build-system = [ setuptools ];
@@ -65,6 +65,15 @@ buildPythonPackage rec {
    "test_cwl_inputs_to_jsonschema"
  ];

+  disabledTestPaths = [
+    # Tests require podman
+    "tests/test_docker_extract.py"
+    # Tests requires singularity
+    "tests/test_js_sandbox.py"
+    # Circular dependencies
+    "tests/test_graph_split.py"
+  ];
+
  meta = with lib; {
    description = "Utilities for CWL";
    homepage = "https://github.com/common-workflow-language/cwl-utils";
@@ -1,42 +1,46 @@
 {
  lib,
-  fetchFromGitHub,
  buildPythonPackage,
-  pythonOlder,
+  fetchFromGitHub,
+  pytest-mock,
+  pytestCheckHook,
+  python-dotenv,
  pythonAtLeast,
+  pythonOlder,
  pytimeparse,
  pyyaml,
-  pytestCheckHook,
-  pytest-mock,
+  setuptools,
  typing-extensions,
+  tomli-w,
 }:

 buildPythonPackage rec {
  pname = "dataclass-wizard";
-  version = "0.22.2";
-  format = "setuptools";
+  version = "0.35.0";
+  pyproject = true;

  src = fetchFromGitHub {
    owner = "rnag";
    repo = "dataclass-wizard";
-    rev = "v${version}";
-    hash = "sha256-Ufi4lZc+UkM6NZr4bS2OibpOmMjyiBEoVKxmrqauW50=";
+    tag = "v${version}";
+    hash = "sha256-Ed9/y2blOGYfNcmCCAe4TPWssKWUS0gxvRXKMf+cJh0=";
  };

-  propagatedBuildInputs = [ ] ++ lib.optionals (pythonOlder "3.9") [ typing-extensions ];
+  build-system = [ setuptools ];
+
+  dependencies = [ typing-extensions ];

  optional-dependencies = {
+    dotenv = [ python-dotenv ];
    timedelta = [ pytimeparse ];
+    toml = [ tomli-w ];
    yaml = [ pyyaml ];
  };

-  nativeCheckInputs =
-    [
-      pytestCheckHook
-      pytest-mock
-    ]
-    ++ optional-dependencies.timedelta
-    ++ optional-dependencies.yaml;
+  nativeCheckInputs = [
+    pytestCheckHook
+    pytest-mock
+  ] ++ lib.flatten (builtins.attrValues optional-dependencies);

  disabledTests =
    [ ]
@@ -53,11 +57,11 @@ buildPythonPackage rec {
  pythonImportsCheck = [ "dataclass_wizard" ];

  meta = with lib; {
-    description = "Set of simple, yet elegant wizarding tools for interacting with the Python dataclasses module";
-    mainProgram = "wiz";
+    description = "Wizarding tools for interacting with the Python dataclasses module";
    homepage = "https://github.com/rnag/dataclass-wizard";
-    changelog = "https://github.com/rnag/dataclass-wizard/releases/tag/v${version}";
+    changelog = "https://github.com/rnag/dataclass-wizard/releases/tag/${src.tag}";
    license = licenses.asl20;
    maintainers = with maintainers; [ codifryed ];
+    mainProgram = "wiz";
  };
 }
@@ -84,6 +84,7 @@ buildPythonPackage rec {
            "x86_64-linux" = "-shared -o attach_linux_amd64.so";
            "i686-linux" = "-shared -o attach_linux_x86.so";
            "aarch64-linux" = "-shared -o attach_linux_arm64.so";
+            "riscv64-linux" = "-shared -o attach_linux_riscv64.so";
            "x86_64-darwin" = "-D_REENTRANT -dynamiclib -lc -o attach_x86_64.dylib";
            "aarch64-darwin" = "-D_REENTRANT -dynamiclib -lc -o attach_arm64.dylib";
          }
@@ -154,6 +155,7 @@ buildPythonPackage rec {
      "aarch64-linux"
      "x86_64-darwin"
      "aarch64-darwin"
+      "riscv64-linux"
    ];
  };
 }
@@ -38,12 +38,6 @@ buildPythonPackage rec {
    hash = "sha256-0mVMhJHlF6EZ3D9fuNrzkoHm9vIAKxbuajmUs1JL0HY=";
  };

-  postPatch = ''
-    substituteInPlace setup.py --replace \
-      "websockets>=10,<11;python_version>'3.6'" \
-      "websockets>=10,<12;python_version>'3.6'"
-  '';
-
  build-system = [ setuptools ];

  dependencies = [
@@ -115,11 +109,13 @@ buildPythonPackage rec {

  pythonImportsCheck = [ "gql" ];

+  __darwinAllowLocalNetworking = true;
+
  meta = with lib; {
    description = "GraphQL client in Python";
    homepage = "https://github.com/graphql-python/gql";
    changelog = "https://github.com/graphql-python/gql/releases/tag/${src.tag}";
-    license = with licenses; [ mit ];
+    license = licenses.mit;
    maintainers = with maintainers; [ fab ];
    mainProgram = "gql-cli";
  };
@@ -1,5 +1,6 @@
 {
  lib,
+  stdenv,
  buildPythonPackage,
  fetchurl,
  fetchpatch,
@@ -78,6 +79,10 @@ buildPythonPackage rec {
  # https://github.com/NixOS/nixpkgs/issues/47390
  installCheckPhase = "meson test --print-errorlogs";

+  preCheck = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    export DYLD_LIBRARY_PATH="${gst_all_1.gst-plugins-base}/lib"
+  '';
+
  passthru = {
    updateScript = directoryListingUpdater { };
  };
@@ -13,14 +13,14 @@

 buildPythonPackage rec {
  pname = "libtmux";
-  version = "0.46.1";
+  version = "0.46.2";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "tmux-python";
    repo = "libtmux";
    tag = "v${version}";
-    hash = "sha256-x+zEfHFTAF0m6j/WFmelcBVOzh7oJE02BdB3bz/EcNM=";
+    hash = "sha256-M3su+bDFuvmNEDVK+poWfxwbpsw/0L1/R6Z4CL0mvZ4=";
  };

  postPatch = ''
@@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "llama-cloud";
-  version = "0.1.22";
+  version = "0.1.23";
  pyproject = true;

  disabled = pythonOlder "3.8";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    pname = "llama_cloud";
    inherit version;
-    hash = "sha256-XZOCc2ktpQ9zMBqt/tG0sQ+U3767nx4THAMeAz67Kn8=";
+    hash = "sha256-PYSiSoYPBG05oQbAZ0LsDqOaV0rEK7+RcG/gJfROIz4=";
  };

  build-system = [ poetry-core ];
@@ -2,7 +2,7 @@
  lib,
  buildPythonPackage,
  fetchPypi,
-  poetry-core,
+  hatchling,
  llama-cloud,
  llama-index-core,
  pythonOlder,
@@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "llama-index-indices-managed-llama-cloud";
-  version = "0.6.11";
+  version = "0.7.1";
  pyproject = true;

  disabled = pythonOlder "3.8";
@@ -18,10 +18,10 @@ buildPythonPackage rec {
  src = fetchPypi {
    pname = "llama_index_indices_managed_llama_cloud";
    inherit version;
-    hash = "sha256-klUy92DNLrsllIKNoxGtrD1UzSyuPf8pCEke67K4vQ8=";
+    hash = "sha256-+GtifVEN1PvlFEdzTxmBG9ipVcQtUx8jeoVpi50eQUA=";
  };

-  build-system = [ poetry-core ];
+  build-system = [ hatchling ];

  dependencies = [
    llama-cloud
@@ -3,8 +3,8 @@
  beautifulsoup4,
  buildPythonPackage,
  fetchPypi,
+  hatchling,
  llama-index-core,
-  poetry-core,
  pymupdf,
  pypdf,
  pythonOlder,
@@ -13,7 +13,7 @@

 buildPythonPackage rec {
  pname = "llama-index-readers-file";
-  version = "0.4.7";
+  version = "0.4.8";
  pyproject = true;

  disabled = pythonOlder "3.8";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    pname = "llama_index_readers_file";
    inherit version;
-    hash = "sha256-iadlI4oQavDx4xq41Ms+4zrIlwgChbzOWRAbQgJl69E=";
+    hash = "sha256-0oIbFkwRRTt5k0VjVabFRGMaCuhlamRt+fwAnxbPuZ8=";
  };

  pythonRelaxDeps = [
@@ -30,7 +30,7 @@ buildPythonPackage rec {
    "striprtf"
  ];

-  build-system = [ poetry-core ];
+  build-system = [ hatchling ];

  dependencies = [
    beautifulsoup4
@@ -14,14 +14,14 @@

 buildPythonPackage rec {
  pname = "mkdocstrings-python";
-  version = "1.16.10";
+  version = "1.16.11";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "mkdocstrings";
    repo = "python";
    tag = version;
-    hash = "sha256-HwGo+o78SDo+RM2UxQB4A8OTY5FVuav1TS6J+aVVWdc=";
+    hash = "sha256-Vee8pNslf/nELnIeMPkuBsbMVLLcK5CyIAaKTh/OEMM=";
  };

  build-system = [ pdm-backend ];
@@ -51,7 +51,7 @@ buildPythonPackage rec {
  meta = {
    description = "Python handler for mkdocstrings";
    homepage = "https://github.com/mkdocstrings/python";
-    changelog = "https://github.com/mkdocstrings/python/blob/${version}/CHANGELOG.md";
+    changelog = "https://github.com/mkdocstrings/python/blob/${src.tag}/CHANGELOG.md";
    license = lib.licenses.isc;
    maintainers = with lib.maintainers; [ fab ];
  };
@@ -0,0 +1,239 @@
+diff --git a/opensfm/exif.py b/opensfm/exif.py
+--- a/opensfm/exif.py
+++ b/opensfm/exif.py
+@@ -509,7 +509,7 @@ class EXIF:
+                     )
+                 )
+ 
+-            if np.all(ypr) is not None:
+            if np.all(ypr != None):
+                 ypr = np.radians(ypr)
+ 
+                 # Convert YPR --> OPK
+diff --git a/opensfm/transformations.py b/opensfm/transformations.py
+--- a/opensfm/transformations.py
+++ b/opensfm/transformations.py
+@@ -232,7 +232,7 @@ def translation_from_matrix(matrix: numpy.ndarray) -> numpy.ndarray:
+     True
+ 
+     """
+-    return numpy.array(matrix, copy=False)[:3, 3].copy()
+    return numpy.asarray(matrix)[:3, 3].copy()
+ 
+ 
+ def reflection_matrix(point: numpy.ndarray, normal: numpy.ndarray) -> numpy.ndarray:
+@@ -275,7 +275,7 @@ def reflection_from_matrix(
+     True
+ 
+     """
+-    M = numpy.array(matrix, dtype=numpy.float64, copy=False)
+    M = numpy.asarray(matrix, dtype=numpy.float64)
+     # normal: unit eigenvector corresponding to eigenvalue -1
+     w, V = numpy.linalg.eig(M[:3, :3])
+     i = numpy.where(abs(numpy.real(w) + 1.0) < 1e-8)[0]
+@@ -339,7 +339,7 @@ def rotation_matrix(
+     M[:3, :3] = R
+     if point is not None:
+         # rotation not around origin
+-        point = numpy.array(point[:3], dtype=numpy.float64, copy=False)
+        point = numpy.asarray(point[:3], dtype=numpy.float64)
+         M[:3, 3] = point - numpy.dot(R, point)
+     return M
+ 
+@@ -359,7 +359,7 @@ def rotation_from_matrix(
+     True
+ 
+     """
+-    R = numpy.array(matrix, dtype=numpy.float64, copy=False)
+    R = numpy.asarray(matrix, dtype=numpy.float64)
+     R33 = R[:3, :3]
+     # direction: unit eigenvector of R33 corresponding to eigenvalue of 1
+     w, W = numpy.linalg.eig(R33.T)
+@@ -444,7 +444,7 @@ def scale_from_matrix(
+     True
+ 
+     """
+-    M = numpy.array(matrix, dtype=numpy.float64, copy=False)
+    M = numpy.asarray(matrix, dtype=numpy.float64)
+     M33 = M[:3, :3]
+     factor = numpy.trace(M33) - 2.0
+     try:
+@@ -505,11 +505,11 @@ def projection_matrix(
+ 
+     """
+     M = numpy.identity(4)
+-    point = numpy.array(point[:3], dtype=numpy.float64, copy=False)
+    point = numpy.asarray(point[:3], dtype=numpy.float64)
+     normal = unit_vector(normal[:3])
+     if perspective is not None:
+         # perspective projection
+-        perspective = numpy.array(perspective[:3], dtype=numpy.float64, copy=False)
+        perspective = numpy.asarray(perspective[:3], dtype=numpy.float64)
+         M[0, 0] = M[1, 1] = M[2, 2] = numpy.dot(perspective - point, normal)
+         M[:3, :3] -= numpy.outer(perspective, normal)
+         if pseudo:
+@@ -522,7 +522,7 @@ def projection_matrix(
+         M[3, 3] = numpy.dot(perspective, normal)
+     elif direction is not None:
+         # parallel projection
+-        direction = numpy.array(direction[:3], dtype=numpy.float64, copy=False)
+        direction = numpy.asarray(direction[:3], dtype=numpy.float64)
+         scale = numpy.dot(direction, normal)
+         M[:3, :3] -= numpy.outer(direction, normal) / scale
+         M[:3, 3] = direction * (numpy.dot(point, normal) / scale)
+@@ -569,7 +569,7 @@ def projection_from_matrix(
+     True
+ 
+     """
+-    M = numpy.array(matrix, dtype=numpy.float64, copy=False)
+    M = numpy.asarray(matrix, dtype=numpy.float64)
+     M33 = M[:3, :3]
+     w, V = numpy.linalg.eig(M)
+     i = numpy.where(abs(numpy.real(w) - 1.0) < 1e-8)[0]
+@@ -726,7 +726,7 @@ def shear_from_matrix(
+     True
+ 
+     """
+-    M = numpy.array(matrix, dtype=numpy.float64, copy=False)
+    M = numpy.asarray(matrix, dtype=numpy.float64)
+     M33 = M[:3, :3]
+     # normal: cross independent eigenvectors corresponding to the eigenvalue 1
+     w, V = numpy.linalg.eig(M33)
+@@ -790,7 +790,7 @@ def decompose_matrix(
+     True
+ 
+     """
+-    M = numpy.array(matrix, dtype=numpy.float64, copy=True).T
+    M = numpy.asarray(matrix, dtype=numpy.float64, copy=True).T
+     if abs(M[3, 3]) < _EPS:
+         raise ValueError("M[3, 3] is zero")
+     M /= M[3, 3]
+@@ -982,8 +982,8 @@ def affine_matrix_from_points(
+     More examples in superimposition_matrix()
+ 
+     """
+-    v0 = numpy.array(v0, dtype=numpy.float64, copy=True)
+-    v1 = numpy.array(v1, dtype=numpy.float64, copy=True)
+    v0 = numpy.asarray(v0, dtype=numpy.float64, copy=True)
+    v1 = numpy.asarray(v1, dtype=numpy.float64, copy=True)
+ 
+     ndims = v0.shape[0]
+     if ndims < 2 or v0.shape[1] < ndims or v0.shape != v1.shape:
+@@ -1099,8 +1099,8 @@ def superimposition_matrix(
+     True
+ 
+     """
+-    v0 = numpy.array(v0, dtype=numpy.float64, copy=False)[:3]
+-    v1 = numpy.array(v1, dtype=numpy.float64, copy=False)[:3]
+    v0 = numpy.asarray(v0, dtype=numpy.float64)[:3]
+    v1 = numpy.asarray(v1, dtype=numpy.float64)[:3]
+     return affine_matrix_from_points(v0, v1, shear=False, scale=scale, usesvd=usesvd)
+ 
+ 
+@@ -1198,7 +1198,7 @@ def euler_from_matrix(
+     j = _NEXT_AXIS[i + parity]
+     k = _NEXT_AXIS[i - parity + 1]
+ 
+-    M = numpy.array(matrix, dtype=numpy.float64, copy=False)[:3, :3]
+    M = numpy.asarray(matrix, dtype=numpy.float64)[:3, :3]
+     if repetition:
+         sy = math.sqrt(M[i, j] * M[i, j] + M[i, k] * M[i, k])
+         if sy > _EPS:
+@@ -1329,7 +1329,7 @@ def quaternion_matrix(quaternion: numpy.ndarray) -> numpy.ndarray:
+     True
+ 
+     """
+-    q = numpy.array(quaternion, dtype=numpy.float64, copy=True)
+    q = numpy.asarray(quaternion, dtype=numpy.float64, copy=True)
+     n = numpy.dot(q, q)
+     if n < _EPS:
+         return numpy.identity(4)
+@@ -1379,7 +1379,7 @@ def quaternion_from_matrix(
+     True
+ 
+     """
+-    M = numpy.array(matrix, dtype=numpy.float64, copy=False)[:4, :4]
+    M = numpy.asarray(matrix, dtype=numpy.float64)[:4, :4]
+     if isprecise:
+         q = numpy.empty((4,))
+         t = numpy.trace(M)
+@@ -1460,7 +1460,7 @@ def quaternion_conjugate(quaternion: numpy.ndarray) -> numpy.ndarray:
+     True
+ 
+     """
+-    q = numpy.array(quaternion, dtype=numpy.float64, copy=True)
+    q = numpy.asarray(quaternion, dtype=numpy.float64, copy=True)
+     numpy.negative(q[1:], q[1:])
+     return q
+ 
+@@ -1474,7 +1474,7 @@ def quaternion_inverse(quaternion: numpy.ndarray) -> numpy.ndarray:
+     True
+ 
+     """
+-    q = numpy.array(quaternion, dtype=numpy.float64, copy=True)
+    q = numpy.asarray(quaternion, dtype=numpy.float64, copy=True)
+     numpy.negative(q[1:], q[1:])
+     return q / numpy.dot(q, q)
+ 
+@@ -1496,7 +1496,7 @@ def quaternion_imag(quaternion: numpy.ndarray) -> numpy.ndarray:
+     array([ 0.,  1.,  2.])
+ 
+     """
+-    return numpy.array(quaternion[1:4], dtype=numpy.float64, copy=True)
+    return numpy.asarray(quaternion[1:4], dtype=numpy.float64, copy=True)
+ 
+ 
+ def quaternion_slerp(
+@@ -1654,7 +1654,7 @@ def vector_norm(
+     1.0
+ 
+     """
+-    data = numpy.array(data, dtype=numpy.float64, copy=True)
+    data = numpy.asarray(data, dtype=numpy.float64, copy=True)
+     if out is None:
+         if data.ndim == 1:
+             return math.sqrt(numpy.dot(data, data))
+@@ -1697,13 +1697,13 @@ def unit_vector(
+ 
+     """
+     if out is None:
+-        data = numpy.array(data, dtype=numpy.float64, copy=True)
+        data = numpy.asarray(data, dtype=numpy.float64, copy=True)
+         if data.ndim == 1:
+             data /= math.sqrt(numpy.dot(data, data))
+             return data
+     else:
+         if out is not data:
+-            out[:] = numpy.array(data, copy=False)
+            out[:] = numpy.asarray(data)
+         data = out
+     length = numpy.atleast_1d(numpy.sum(data * data, axis))
+     numpy.sqrt(length, length)
+@@ -1777,8 +1777,8 @@ def angle_between_vectors(
+     True
+ 
+     """
+-    v0 = numpy.array(v0, dtype=numpy.float64, copy=False)
+-    v1 = numpy.array(v1, dtype=numpy.float64, copy=False)
+    v0 = numpy.asarray(v0, dtype=numpy.float64)
+    v1 = numpy.asarray(v1, dtype=numpy.float64)
+     dot = numpy.sum(v0 * v1, axis=axis)
+     dot /= vector_norm(v0, axis=axis) * vector_norm(v1, axis=axis)
+     dot = numpy.clip(dot, -1.0, 1.0)
+@@ -1826,9 +1826,9 @@ def is_same_transform(matrix0: numpy.ndarray, matrix1: numpy.ndarray) -> numpy.n
+     False
+ 
+     """
+-    matrix0 = numpy.array(matrix0, dtype=numpy.float64, copy=True)
+    matrix0 = numpy.asarray(matrix0, dtype=numpy.float64, copy=True)
+     matrix0 /= matrix0[3, 3]
+-    matrix1 = numpy.array(matrix1, dtype=numpy.float64, copy=True)
+    matrix1 = numpy.asarray(matrix1, dtype=numpy.float64, copy=True)
+     matrix1 /= matrix1[3, 3]
+     return numpy.allclose(matrix0, matrix1)
+ 
+@@ -1874,3 +1874,4 @@ if __name__ == "__main__":
+ 
+     numpy.set_printoptions(suppress=True, precision=5)
+     doctest.testmod()
+
@@ -9,6 +9,7 @@
  suitesparse,
  metis,
  eigen,
+  setuptools,
  pkg-config,
  pybind11,
  numpy,
@@ -27,6 +28,7 @@
  joblib,
  repoze-lru,
  xmltodict,
+  distutils,
  cloudpickle,
  scipy,
  sphinx,
@@ -34,13 +36,10 @@
  fpdf,
 }:

-let
-  ceresSplit = (builtins.length ceres-solver.outputs) > 1;
-  ceres' = if ceresSplit then ceres-solver.dev else ceres-solver;
-in
 buildPythonPackage rec {
  pname = "opensfm";
  version = "unstable-2023-12-09";
+  pyproject = true;

  src = fetchFromGitHub {
    owner = "mapillary";
@@ -48,12 +47,15 @@ buildPythonPackage rec {
    rev = "7f170d0dc352340295ff480378e3ac37d0179f8e";
    sha256 = "sha256-l/HTVenC+L+GpMNnDgnSGZ7+Qd2j8b8cuTs3SmORqrg=";
  };
+
  patches = [
    ./0002-cmake-find-system-distributed-gtest.patch
    ./0003-cmake-use-system-pybind11.patch
    ./0004-pybind_utils.h-conflicts-with-nixpkgs-pybind.patch
+    ./0005-fix-numpy-2-test-failures.patch # not upstreamed due to cla, but you're free upstream it -@pbsds
    ./fix-scripts.patch
  ];
+
  postPatch = ''
    rm opensfm/src/cmake/FindGlog.cmake
    rm opensfm/src/cmake/FindGflags.cmake
@@ -64,16 +66,22 @@ buildPythonPackage rec {
    echo 'feature_type: SIFT' >> data/berlin/config.yaml
    echo 'feature_type: HAHOG' >> data/lund/config.yaml

+    # make opensfm correctly import glog headers
+    export CXXFLAGS=-DGLOG_USE_GLOG_EXPORT
+
    sed -i -e 's/^.*BuildDoc.*$//' setup.py
  '';

+  build-system = [ setuptools ];
+
  nativeBuildInputs = [
    cmake
    pkg-config
    sphinx
  ];
+
  buildInputs = [
-    ceres'
+    ceres-solver
    suitesparse
    metis
    eigen
@@ -83,7 +91,8 @@ buildPythonPackage rec {
    glog
    pybind11
  ];
-  propagatedBuildInputs = [
+
+  dependencies = [
    numpy
    scipy
    pyyaml
@@ -101,7 +110,11 @@ buildPythonPackage rec {
    xmltodict
    cloudpickle
  ];
-  nativeCheckInputs = [ pytestCheckHook ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    distutils
+  ];

  dontUseCmakeBuildDir = true;
  cmakeFlags = [
@@ -122,7 +135,10 @@ buildPythonPackage rec {

  meta = {
    broken = stdenv.hostPlatform.isDarwin;
-    maintainers = [ lib.maintainers.SomeoneSerge ];
+    maintainers = [
+      lib.maintainers.pbsds
+      lib.maintainers.SomeoneSerge
+    ];
    license = lib.licenses.bsd2;
    changelog = "https://github.com/mapillary/OpenSfM/blob/${src.rev}/CHANGELOG.md";
    description = "Open source Structure-from-Motion pipeline from Mapillary";
@@ -15,7 +15,7 @@

 buildPythonPackage rec {
  pname = "pylamarzocco";
-  version = "2.0.4";
+  version = "2.0.7";
  pyproject = true;

  disabled = pythonOlder "3.12";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
    owner = "zweckj";
    repo = "pylamarzocco";
    tag = "v${version}";
-    hash = "sha256-ING00Xz+ipEnwX+u4M6upN5aYX2JrKZS/ho6b72QyFw=";
+    hash = "sha256-IFac66zBGvRASXJDa/Y6F3BxZhRD9tG8yAB2l2IsDVk=";
  };

  build-system = [ setuptools ];
@@ -13,7 +13,7 @@

 buildPythonPackage rec {
  pname = "reolink-aio";
-  version = "0.13.3";
+  version = "0.13.4";
  pyproject = true;

  disabled = pythonOlder "3.11";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
    owner = "starkillerOG";
    repo = "reolink_aio";
    tag = version;
-    hash = "sha256-VOVVUDcjSn8BkXEIRJKHiPkDoFE+4w2iI/uNkY7I8Yg=";
+    hash = "sha256-/r7aMZqX7JxvG/3FVXLABPP9zDOWhEmWaxzgIsb5SAk=";
  };

  build-system = [ setuptools ];
@@ -21,14 +21,14 @@

 buildPythonPackage rec {
  pname = "spsdk-pyocd";
-  version = "0.3.1";
+  version = "0.3.2";
  pyproject = true;

  # Latest tag missing on GitHub
  src = fetchPypi {
    pname = "spsdk_pyocd";
    inherit version;
-    hash = "sha256-yVQtX2T1l0TmFwaZDSFCXMuoFxTalfOr3b4CCTeteKI=";
+    hash = "sha256-OcRGYZ1U5jQyRv2OSKwS3uJpvRQRW6Fbm/rDxlzyxPg=";
  };

  build-system = [
@@ -1,45 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  kernel,
-}:
-
-stdenv.mkDerivation rec {
-  name = "asus-wmi-sensors-${version}-${kernel.version}";
-  version = "unstable-2019-11-07";
-
-  # The original was deleted from github, but this seems to be an active fork
-  src = fetchFromGitHub {
-    owner = "electrified";
-    repo = "asus-wmi-sensors";
-    rev = "8daafd45d1b860cf5b17eee1c94d93feb04164a9";
-    sha256 = "0kc0xlrsmf783ln5bqyj6qxzmrhdxdfdd2b9ygf2lbl2153i04vc";
-  };
-
-  hardeningDisable = [ "pic" ];
-
-  nativeBuildInputs = kernel.moduleBuildDependencies;
-
-  preConfigure = ''
-    sed -i 's|depmod|#depmod|' Makefile
-  '';
-
-  makeFlags = [
-    "TARGET=${kernel.modDirVersion}"
-    "KERNEL_MODULES=${kernel.dev}/lib/modules/${kernel.modDirVersion}"
-    "MODDESTDIR=${placeholder "out"}/lib/modules/${kernel.modDirVersion}/kernel/drivers/hwmon"
-  ];
-
-  meta = with lib; {
-    description = "Linux HWMON (lmsensors) sensors driver for various ASUS Ryzen and Threadripper motherboards";
-    homepage = "https://github.com/electrified/asus-wmi-sensors";
-    license = licenses.gpl2Only;
-    platforms = [
-      "x86_64-linux"
-      "i686-linux"
-    ];
-    maintainers = with maintainers; [ Frostman ];
-    broken = versionOlder kernel.version "4.12";
-  };
-}
@@ -36,6 +36,6 @@ stdenv.mkDerivation rec {
    license = licenses.publicDomain;
    maintainers = with maintainers; [ aacebedo ];
    platforms = platforms.linux;
-    broken = kernel.kernelOlder "5.9";
+    broken = kernel.kernelOlder "5.9" || kernel.kernelAtLeast "6.10";
  };
 }
@@ -8,7 +8,7 @@
 }:

 let
-  version = "0.13.2";
+  version = "0.15.0";

 in
 stdenv.mkDerivation {
@@ -19,7 +19,7 @@ stdenv.mkDerivation {
    owner = "umlaeute";
    repo = "v4l2loopback";
    rev = "v${version}";
-    hash = "sha256-rcwgOXnhRPTmNKUppupfe/2qNUBDUqVb3TeDbrP5pnU=";
+    hash = "sha256-fa3f8GDoQTkPppAysrkA7kHuU5z2P2pqI8dKhuKYh04=";
  };

  hardeningDisable = [
@@ -20,8 +20,8 @@ let
 in
 buildMongoDB {
  inherit avxSupport;
-  version = "6.0.19";
-  sha256 = "sha256-qcf+6hMg0LASeOoZJPoRCQ9ajCJBqSsBDg2Wp+2SMKY=";
+  version = "6.0.23";
+  sha256 = "sha256-E87l73bA2i/wEPkzYBX70UptX7tWqBRyhb4fIyrwHZk=";
  patches = [
    # Patches a bug that it couldn't build MongoDB 6.0 on gcc 13 because a include in ctype.h was missing
    ./fix-gcc-13-ctype-6_0.patch
@@ -2,6 +2,7 @@
  lib,
  stdenv,
  fetchurl,
+  fetchpatch,
  gitUpdater,
  bison,
  cmake,
@@ -61,6 +62,15 @@ stdenv.mkDerivation (finalAttrs: {
  ] ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [ rpcsvc-proto ];

  patches = [
+    # adapted from mysql80's llvm 19 fixes
+    ./libcpp-fixes.patch
+    # fixes using -DWITH_SSL=system with CMAKE_PREFIX_PATH on darwin
+    # https://github.com/Homebrew/homebrew-core/pull/204799
+    (fetchpatch {
+      name = "fix-system-ssl-darwin.patch";
+      url = "https://github.com/percona/percona-server/pull/5537/commits/a693e5d67abf6f27f5284c86361604babec529c6.patch";
+      hash = "sha256-fFBy3AYTMLvHvbsh0g0UvuPkmVMKZzxPsxeBKbsN8Ho=";
+    })
    ./no-force-outline-atomics.patch # Do not force compilers to turn on -moutline-atomics switch
    ./coredumper-explicitly-import-unistd.patch # fix build on aarch64-linux
  ];
@@ -0,0 +1,207 @@
+diff --git a/include/my_char_traits.h b/include/my_char_traits.h
+new file mode 100644
+index 00000000000..6336bc039c8
+--- /dev/null
+++ b/include/my_char_traits.h
+@@ -0,0 +1,65 @@
+/* Copyright (c) 2024, Oracle and/or its affiliates.
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License, version 2.0,
+   as published by the Free Software Foundation.
+
+   This program is designed to work with certain software (including
+   but not limited to OpenSSL) that is licensed under separate terms,
+   as designated in a particular file or component or in included license
+   documentation.  The authors of MySQL hereby grant you an additional
+   permission to link the program and your derivative works with the
+   separately licensed software that they have either included with
+   the program or referenced in the documentation.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License, version 2.0, for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program; if not, write to the Free Software
+   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301  USA */
+
+#ifndef MY_CHAR_TRAITS_INCLUDED
+#define MY_CHAR_TRAITS_INCLUDED
+
+#include <cstring>
+
+template <class CharT>
+struct my_char_traits;
+
+/*
+  This is a standards-compliant, drop-in replacement for
+    std::char_traits<unsigned char>
+  We need this because clang libc++ is removing support for it in clang 19.
+  It is not a complete implementation. Rather we implement just enough to
+  compile any usage of char_traits<uchar> we have in our codebase.
+ */
+template <>
+struct my_char_traits<unsigned char> {
+  using char_type = unsigned char;
+  using int_type = unsigned int;
+
+  static void assign(char_type &c1, const char_type &c2) { c1 = c2; }
+
+  static char_type *assign(char_type *s, std::size_t n, char_type a) {
+    return static_cast<char_type *>(memset(s, a, n));
+  }
+
+  static int compare(const char_type *s1, const char_type *s2, std::size_t n) {
+    return memcmp(s1, s2, n);
+  }
+
+  static char_type *move(char_type *s1, const char_type *s2, std::size_t n) {
+    if (n == 0) return s1;
+    return static_cast<char_type *>(memmove(s1, s2, n));
+  }
+
+  static char_type *copy(char_type *s1, const char_type *s2, std::size_t n) {
+    if (n == 0) return s1;
+    return static_cast<char_type *>(memcpy(s1, s2, n));
+  }
+};
+
+#endif  // MY_CHAR_TRAITS_INCLUDED
+diff --git a/sql/mdl_context_backup.h b/sql/mdl_context_backup.h
+index 89e7e23df34..cf9c307ec2d 100644
+--- a/sql/mdl_context_backup.h
+++ b/sql/mdl_context_backup.h
+@@ -28,6 +28,7 @@
+ #include <map>
+ #include <memory>
+ 
+#include "my_char_traits.h"
+ #include "sql/malloc_allocator.h"
+ #include "sql/mdl.h"
+ 
+@@ -47,7 +48,8 @@ class MDL_context_backup_manager {
+   /**
+     Key for uniquely identifying MDL_context in the MDL_context_backup map.
+   */
+-  typedef std::basic_string<uchar> MDL_context_backup_key;
+  using MDL_context_backup_key =
+      std::basic_string<uchar, my_char_traits<uchar>>;
+ 
+   class MDL_context_backup;
+ 
+diff --git a/sql/range_optimizer/index_range_scan_plan.cc b/sql/range_optimizer/index_range_scan_plan.cc
+index 74fbb100397..8ed1f50da33 100644
+--- a/sql/range_optimizer/index_range_scan_plan.cc
+++ b/sql/range_optimizer/index_range_scan_plan.cc
+@@ -54,6 +54,8 @@
+ #include "sql/thr_malloc.h"
+ #include "sql_string.h"
+ 
+#include "my_char_traits.h"
+
+ using opt_range::null_element;
+ using std::max;
+ using std::min;
+@@ -1025,8 +1027,8 @@ static bool null_part_in_key(KEY_PART *key_part, const uchar *key,
+ 
+ // TODO(sgunders): This becomes a bit simpler with C++20's string_view
+ // constructors.
+-static inline std::basic_string_view<uchar> make_string_view(const uchar *start,
+-                                                             const uchar *end) {
+static inline std::basic_string_view<uchar, my_char_traits<uchar>>
+make_string_view(const uchar *start, const uchar *end) {
+   return {start, static_cast<size_t>(end - start)};
+ }
+ 
+diff --git a/sql/stream_cipher.h b/sql/stream_cipher.h
+index 606d40645c6..358fbb41959 100644
+--- a/sql/stream_cipher.h
+++ b/sql/stream_cipher.h
+@@ -28,6 +28,8 @@
+ #include <memory>
+ #include <string>
+ 
+#include "my_char_traits.h"
+
+ /**
+   @file stream_cipher.h
+ 
+@@ -35,7 +37,8 @@
+          binary log files.
+ */
+ 
+-typedef std::basic_string<unsigned char> Key_string;
+using Key_string =
+    std::basic_string<unsigned char, my_char_traits<unsigned char>>;
+ 
+ /**
+   @class Stream_cipher
+diff --git a/unittest/gunit/binlogevents/transaction_compression-t.cc b/unittest/gunit/binlogevents/transaction_compression-t.cc
+index ba13f979aa3..01af0e3a360 100644
+--- a/unittest/gunit/binlogevents/transaction_compression-t.cc
+++ b/unittest/gunit/binlogevents/transaction_compression-t.cc
+@@ -23,6 +23,7 @@
+ */
+ 
+ #include <array>
+#include <string>
+ 
+ #include <gtest/gtest.h>
+ #include "libbinlogevents/include/binary_log.h"
+@@ -51,14 +52,13 @@ class TransactionPayloadCompressionTest : public ::testing::Test {
+   using Managed_buffer_t = Decompressor_t::Managed_buffer_t;
+   using Size_t = Decompressor_t::Size_t;
+   using Char_t = Decompressor_t::Char_t;
+-  using String_t = std::basic_string<Char_t>;
+   using Decompress_status_t =
+       binary_log::transaction::compression::Decompress_status;
+   using Compress_status_t =
+       binary_log::transaction::compression::Compress_status;
+ 
+-  static String_t constant_data(Size_t size) {
+-    return String_t(size, (Char_t)'a');
+  static std::string constant_data(Size_t size) {
+    return std::string(size, (Char_t)'a');
+   }
+ 
+  protected:
+@@ -69,7 +69,7 @@ class TransactionPayloadCompressionTest : public ::testing::Test {
+   void TearDown() override {}
+ 
+   static void compression_idempotency_test(Compressor_t &c, Decompressor_t &d,
+-                                           String_t data) {
+                                           const std::string &data) {
+     auto debug_string = concat(
+         binary_log::transaction::compression::type_to_string(c.get_type_code()),
+         " ", data.size());
+@@ -104,8 +104,8 @@ class TransactionPayloadCompressionTest : public ::testing::Test {
+ 
+     // Check decompressed data
+     ASSERT_EQ(managed_buffer.read_part().size(), data.size()) << debug_string;
+-    ASSERT_EQ(data, String_t(managed_buffer.read_part().begin(),
+-                             managed_buffer.read_part().end()))
+    ASSERT_EQ(data, std::string(managed_buffer.read_part().begin(),
+                                managed_buffer.read_part().end()))
+         << debug_string;
+ 
+     // Check that we reached EOF
+@@ -118,7 +118,7 @@ TEST_F(TransactionPayloadCompressionTest, CompressDecompressZstdTest) {
+   for (auto size : buffer_sizes) {
+     binary_log::transaction::compression::Zstd_dec d;
+     binary_log::transaction::compression::Zstd_comp c;
+-    String_t data{TransactionPayloadCompressionTest::constant_data(size)};
+    std::string data{TransactionPayloadCompressionTest::constant_data(size)};
+     TransactionPayloadCompressionTest::compression_idempotency_test(c, d, data);
+     c.set_compression_level(22);
+     TransactionPayloadCompressionTest::compression_idempotency_test(c, d, data);
+@@ -129,7 +129,7 @@ TEST_F(TransactionPayloadCompressionTest, CompressDecompressNoneTest) {
+   for (auto size : buffer_sizes) {
+     binary_log::transaction::compression::None_dec d;
+     binary_log::transaction::compression::None_comp c;
+-    String_t data{TransactionPayloadCompressionTest::constant_data(size)};
+    std::string data{TransactionPayloadCompressionTest::constant_data(size)};
+     TransactionPayloadCompressionTest::compression_idempotency_test(c, d, data);
+   }
+ }
@@ -7,13 +7,13 @@

 postgresqlBuildExtension (finalAttrs: {
  pname = "pg_ivm";
-  version = "1.10";
+  version = "1.11";

  src = fetchFromGitHub {
    owner = "sraoss";
    repo = "pg_ivm";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-4/ftJkm2ZInm9lkjJG7y4ZULwlyVC19lP0wGXu56SGw=";
+    hash = "sha256-fPtDwP+IZ/RQOriRklSvpUnJ8qEwJaxIrcfnAReRQeQ=";
  };

  meta = {
@@ -46,13 +46,13 @@
 }@args:

 let
-  version = "3.4.3";
+  version = "3.4.4";

  src = fetchFromGitHub {
    owner = "discourse";
    repo = "discourse";
    rev = "v${version}";
-    sha256 = "sha256-TvJKQAdtKuyiWuFrG67NkO/KiXeTjOOQrAnLeyPZ9K8=";
+    sha256 = "sha256-rA42fOhSJVrNPcFSB2+On7JVeZch8t2yNo+36UK+QcA=";
  };

  ruby = ruby_3_3;
@@ -2003,6 +2003,7 @@ mapAliases {
  vistafonts = vista-fonts; # Added 2025-02-03
  vistafonts-chs = vista-fonts-chs; # Added 2025-02-03
  vistafonts-cht = vista-fonts-cht; # Added 2025-02-03
+  vivaldi = throw "'vivaldi' has been removed due to lack of maintenance in nixpkgs"; # Added 2025-05-29
  vkBasalt = vkbasalt; # Added 2022-11-22
  vkdt-wayland = vkdt; # Added 2024-04-19
  vocal = throw "'vocal' has been archived upstream. Consider using 'gnome-podcasts' or 'kasts' instead."; # Added 2025-04-12
@@ -9540,6 +9540,17 @@ with pkgs;
    jvm = jre8;
  };

+  rocksdb_9_10 = rocksdb.overrideAttrs rec {
+    pname = "rocksdb";
+    version = "9.10.0";
+    src = fetchFromGitHub {
+      owner = "facebook";
+      repo = pname;
+      rev = "v${version}";
+      hash = "sha256-G+DlQwEUyd7JOCjS1Hg1cKWmA/qAiK8UpUIKcP+riGQ=";
+    };
+  };
+
  rocksdb_8_11 = rocksdb.overrideAttrs rec {
    pname = "rocksdb";
    version = "8.11.4";
@@ -13615,8 +13626,6 @@ with pkgs;

  organicmaps = qt6Packages.callPackage ../applications/misc/organicmaps { };

-  vivaldi = callPackage ../applications/networking/browsers/vivaldi { };
-
  openrazer-daemon = python3Packages.toPythonApplication python3Packages.openrazer-daemon;

  orpie = callPackage ../applications/misc/orpie {
@@ -470,8 +470,6 @@ in

        asus-ec-sensors = callPackage ../os-specific/linux/asus-ec-sensors { };

-        asus-wmi-sensors = callPackage ../os-specific/linux/asus-wmi-sensors { };
-
        ena = callPackage ../os-specific/linux/ena { };

        lenovo-legion-module = callPackage ../os-specific/linux/lenovo-legion { };
@@ -1196,6 +1196,8 @@ let

        melange = callPackage ../development/tools/ocaml/melange { };

+        melange-json = callPackage ../development/ocaml-modules/melange-json { };
+
        memprof-limits = callPackage ../development/ocaml-modules/memprof-limits { };

        memtrace = callPackage ../development/ocaml-modules/memtrace { };
@@ -456,6 +456,10 @@ with self;
      url = "mirror://cpan/authors/id/R/RU/RUZ/Alien-LibGumbo-0.05.tar.gz";
      hash = "sha256-D76RarEfaA5cKM0ayAA3IyPioOBq/8bIs2J5/GTXZRc=";
    };
+    # Fix linker detection broken by exported LD (see nixpkgs#9f2a89f)
+    preBuild = ''
+      export LD="${lib.getExe' stdenv.cc.bintools "${stdenv.cc.bintools.targetPrefix}ld"}"
+    '';
    buildInputs = [ AlienBaseModuleBuild ];
    propagatedBuildInputs = [
      AlienBuild
@@ -468,7 +472,7 @@ with self;
        artistic1
        gpl1Plus
      ];
-      broken = stdenv.hostPlatform.isLinux; # Fails with: cannot find ./.libs/libgumbo.so
+      broken = stdenv.hostPlatform.isDarwin; # Fails with: ld: unknown option
    };
  };