Merge master into staging-next

2025-12-13 06:05:59 +00:00
parent 23191133d4 145c17c55d
commit 971bd73ccc
54 changed files with 1254 additions and 739 deletions
@@ -22688,6 +22688,12 @@
    keys = [ { fingerprint = "7DCA 5615 8AB2 621F 2F32  9FF4 1C7C E491 479F A273"; } ];
    name = "Rahul Butani";
  };
+  rrvsh = {
+    email = "rafiq@rrv.sh";
+    github = "rrvsh";
+    githubId = 20300874;
+    name = "Mohammad Rafiq";
+  };
  rseichter = {
    email = "nixos.org@seichter.de";
    github = "rseichter";
@@ -23975,7 +23981,7 @@
  };
  shikanime = {
    name = "William Phetsinorath";
-    email = "deva.shikanime@protonmail.com";
+    email = "william.phetsinorath@shikanime.studio";
    github = "shikanime";
    githubId = 22115108;
  };
@@ -18,6 +18,8 @@

 - [ImmichFrame](https://immichframe.dev/), display your photos from Immich as a digital photo frame. Available as `services.immichframe`.

+- [LibreChat](https://www.librechat.ai/), open-source self-hostable ChatGPT clone with Agents and RAG APIs. Available as [services.librechat](#opt-services.librechat.enable).
+
 - [udp-over-tcp](https://github.com/mullvad/udp-over-tcp), a tunnel for proxying UDP traffic over a TCP stream. Available as `services.udp-over-tcp`.

 ## Backward Incompatibilities {#sec-release-26.05-incompatibilities}
@@ -1655,6 +1655,7 @@
  ./services/web-apps/lasuite-docs.nix
  ./services/web-apps/lasuite-meet.nix
  ./services/web-apps/lemmy.nix
+  ./services/web-apps/librechat.nix
  ./services/web-apps/librespeed.nix
  ./services/web-apps/libretranslate.nix
  ./services/web-apps/limesurvey.nix
@@ -913,11 +913,12 @@ in
        ]
        ++ lib.optional (useSendmail && config.services.postfix.enable) "/var/lib/postfix/queue/maildrop";
        UMask = "0027";
-        # Capabilities
-        CapabilityBoundingSet = "";
-        # Security
-        NoNewPrivileges = !useSendmail;
+        # one mid size deployments, Gitea already gets killed when doing DB migrations
+        TimeoutStartSec = "3m";
+
        # Sandboxing
+        CapabilityBoundingSet = "";
+        NoNewPrivileges = !useSendmail;
        ProtectSystem = "strict";
        ProtectHome = true;
        PrivateTmp = true;
@@ -20,6 +20,8 @@ in
  options.services.n8n = {
    enable = lib.mkEnableOption "n8n server";

+    package = lib.mkPackageOption pkgs "n8n" { };
+
    openFirewall = lib.mkOption {
      type = lib.types.bool;
      default = false;
@@ -89,7 +91,7 @@ in
      };
      serviceConfig = {
        Type = "simple";
-        ExecStart = "${pkgs.n8n}/bin/n8n";
+        ExecStart = lib.getExe cfg.package;
        Restart = "on-failure";
        StateDirectory = "n8n";

@@ -0,0 +1,259 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.librechat;
+  format = pkgs.formats.yaml { };
+  configFile = format.generate "librechat.yaml" cfg.settings;
+  exportCredentials = n: _: ''export ${n}="$(${pkgs.systemd}/bin/systemd-creds cat ${n}_FILE)"'';
+  exportAllCredentials = vars: lib.concatStringsSep "\n" (lib.mapAttrsToList exportCredentials vars);
+  getLoadCredentialList = lib.mapAttrsToList (n: v: "${n}_FILE:${v}") cfg.credentials;
+in
+{
+  options.services.librechat = {
+    enable = lib.mkEnableOption "the LibreChat server";
+
+    package = lib.mkPackageOption pkgs "librechat" { };
+
+    openFirewall = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = ''
+        Whether to open the port in the firewall.
+      '';
+    };
+
+    dataDir = lib.mkOption {
+      type = lib.types.path;
+      default = "/var/lib/librechat";
+      example = "/persist/librechat";
+      description = "Absolute path for where the LibreChat server will use as its data directory to store logs, user uploads, and generated images.";
+    };
+
+    user = lib.mkOption {
+      type = lib.types.str;
+      default = "librechat";
+      example = "alice";
+      description = "The user to run the service as.";
+    };
+
+    group = lib.mkOption {
+      type = lib.types.str;
+      default = "librechat";
+      example = "users";
+      description = "The group to run the service as.";
+    };
+
+    credentials = lib.mkOption {
+      type = lib.types.attrsOf lib.types.path;
+      default = { };
+      example = {
+        CREDS_KEY = "/run/secrets/creds_key";
+      };
+      description = ''
+        Environment variables which are loaded from the contents of files at a file paths, mainly used for secrets.
+        See [LibreChat environment variables](https://www.librechat.ai/docs/configuration/dotenv).
+        Alternatively you can use `services.librechat.credentialsFile` to define all the variables in a single file.
+      '';
+    };
+
+    env = lib.mkOption {
+      type = lib.types.submodule {
+        freeformType =
+          with lib.types;
+          attrsOf (oneOf [
+            str
+            path
+            (coercedTo int toString str)
+            (coercedTo float toString str)
+            (coercedTo port toString str)
+            (coercedTo bool (x: if x then "true" else "false") str)
+          ]);
+        options = {
+          CONFIG_PATH = lib.mkOption {
+            default = configFile;
+            internal = true;
+            readOnly = true;
+          };
+          PORT = lib.mkOption {
+            type = with lib.types; coercedTo port toString str;
+            default = 3080;
+            example = 2309;
+            description = "The value that will be passed to the PORT environment variable, telling LibreChat what to listen on.";
+          };
+        };
+      };
+      example = {
+        ALLOW_REGISTRATION = true;
+        HOST = "0.0.0.0";
+        PORT = 2309;
+        CONSOLE_JSON_STRING_LENGTH = 255;
+      };
+      description = ''
+        Environment variables that will be set for the service.
+        See [LibreChat environment variables](https://www.librechat.ai/docs/configuration/dotenv).
+      '';
+    };
+
+    credentialsFile = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
+      description = ''
+        Path to a file that contains environment variables.
+        See [LibreChat environment variables](https://www.librechat.ai/docs/configuration/dotenv).
+
+        Example content of the file:
+        ```
+        CREDS_KEY=6d6deb03cdfb27ea454f6b9ddd42494bdce4af25d50d8aee454ddce583690cc5
+        ```
+
+        Alternatively you can use `services.librechat.credentials` to define the value of each variable in a separate file.
+      '';
+      default = "/dev/null";
+      example = "/run/secrets/librechat";
+    };
+
+    settings = lib.mkOption {
+      type = lib.types.submodule {
+        freeformType = format.type;
+      };
+      default = { };
+      example = {
+        version = "1.0.8";
+        cache = true;
+        interface = {
+          privacyPolicy = {
+            externalUrl = "https://librechat.ai/privacy-policy";
+            openNewTab = true;
+          };
+        };
+        endpoints = {
+          custom = [
+            {
+              name = "OpenRouter";
+              apiKey = "\${OPENROUTER_KEY}";
+              baseURL = "https://openrouter.ai/api/v1";
+              models = {
+                default = [ "meta-llama/llama-3-70b-instruct" ];
+                fetch = true;
+              };
+              titleConvo = true;
+              titleModule = "meta-llama/llama-3-70b-instruct";
+              dropParams = [ "stop" ];
+              modelDisplayLabel = "OpenRouter";
+            }
+          ];
+        };
+      };
+      description = ''
+        A free-form attribute set that will be written to librechat.yaml.
+        See the [LibreChat configuration options](https://www.librechat.ai/docs/configuration/librechat_yaml).
+        You can use environment variables by wrapping them in $\{}. Take care to escape the \$ character.
+      '';
+    };
+
+    enableLocalDB = lib.mkEnableOption "a local mongodb instance";
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = cfg.env ? MONGO_URI || cfg.credentials ? MONGO_URI;
+        message = "MongoDB is not configured, either set `services.librechat.enableLocalDB = true` or provide your own MongoDB instance by setting `services.librechat.env.MONGO_URI` or `services.credentials.MONGO_URI`.";
+      }
+      {
+        assertion =
+          cfg.credentialsFile != "/dev/null"
+          || (
+            (cfg.env ? CREDS_KEY || cfg.credentials ? CREDS_KEY)
+            && (cfg.env ? CREDS_IV || cfg.credentials ? CREDS_IV)
+            && (cfg.env ? JWT_SECRET || cfg.credentials ? JWT_SECRET)
+            && (cfg.env ? JWT_REFRESH_SECRET || cfg.credentials ? JWT_REFRESH_SECRET)
+          );
+        message = ''
+          CREDS_KEY, CREDS_IV, JWT_SECRET, and JWT_REFRESH_SECRET must be defined in `services.librechat.credentials` and point to locations of files on the host or in a file that `services.credentialsFile` is pointing to.
+          Alternatively it can be defined in `services.librechat.env` with literal values but they will be saved within the world-readable nix store.;
+          You can use https://www.librechat.ai/toolkit/creds_generator to generate these.
+        '';
+      }
+    ];
+
+    networking.firewall.allowedTCPPorts = lib.optional cfg.openFirewall cfg.port;
+
+    systemd.tmpfiles.settings."10-librechat"."${cfg.dataDir}".d = {
+      mode = "0755";
+      inherit (cfg) user group;
+    };
+
+    systemd.services.librechat = {
+      wantedBy = [ "multi-user.target" ];
+      after = [
+        "tmpfiles.target"
+      ]
+      ++ lib.optional cfg.enableLocalDB "mongodb.service";
+      description = "Open-source app for all your AI conversations, fully customizable and compatible with any AI provider";
+      environment = cfg.env;
+      script = # sh
+        ''
+          ${exportAllCredentials cfg.credentials}
+          cd ${cfg.dataDir}
+          ${lib.getExe cfg.package}
+        '';
+      serviceConfig = {
+        Type = "simple";
+        User = cfg.user;
+        Group = cfg.group;
+        StateDirectory = builtins.baseNameOf cfg.dataDir;
+        WorkingDirectory = cfg.dataDir;
+        LoadCredential = getLoadCredentialList;
+        EnvironmentFile = cfg.credentialsFile;
+        Restart = "on-failure";
+        RestartSec = 10;
+
+        # Hardening
+        CapabilityBoundingSet = "";
+        NoNewPrivileges = true;
+        PrivateUsers = true;
+        PrivateTmp = true;
+        PrivateDevices = true;
+        PrivateMounts = true;
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+          "AF_UNIX"
+        ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        UMask = "0077";
+      };
+    };
+
+    users.users.librechat = lib.mkIf (cfg.user == "librechat") {
+      name = "librechat";
+      isSystemUser = true;
+      group = "librechat";
+      description = "LibreChat server user";
+    };
+
+    users.groups.librechat = lib.mkIf (cfg.user == "librechat") { };
+
+    services.librechat.env.MONGO_URI = lib.mkIf cfg.enableLocalDB "mongodb://localhost:27017";
+    services.mongodb.enable = lib.mkIf cfg.enableLocalDB true;
+  };
+
+  meta.maintainers = with lib.maintainers; [
+    gepbird
+    niklaskorz
+    rrvsh
+  ];
+}
@@ -857,6 +857,7 @@ in
  lemurs-xorg = runTest ./lemurs/lemurs-xorg.nix;
  lemurs-xorg-script = runTest ./lemurs/lemurs-xorg-script.nix;
  libinput = runTest ./libinput.nix;
+  librechat = runTest ./librechat.nix;
  librenms = runTest ./librenms.nix;
  libresprite = runTest ./libresprite.nix;
  libreswan = runTest ./libreswan.nix;
@@ -0,0 +1,50 @@
+# Run this test with NIXPKGS_ALLOW_UNFREE=1
+{ lib, ... }:
+{
+  name = "librechat";
+
+  meta.maintainers = with lib.maintainers; [
+    gepbird
+    niklaskorz
+    rrvsh
+  ];
+
+  nodes.machine =
+    { pkgs, ... }:
+    let
+      # !!! Don't do this with real keys. The /nix store is world-readable!
+      credsKeyFile = pkgs.writeText "librechat-creds-key" "6d6deb03cdfb27ea454f6b9ddd42494bdce4af25d50d8aee454ddce583690cc5";
+      credsIvFile = pkgs.writeText "librechat-creds-iv" "7c09a571f65ac793611685cc9ab1dbe7";
+      jwtSecret = pkgs.writeText "librechat-jwt-secret" "29c4dc7f7de15306accf5eddb4cb8a70eb233d9fba4301f8f47f14c8c047ac81";
+      jwtRefreshSecret = pkgs.writeText "librechat-jwt-refresh-secret" "f2c1685561f2f570b3e7955df267b5c602ee099f14dc5caa0dacc320580ea180";
+    in
+    {
+      services.librechat = {
+        enable = true;
+        env = {
+          ALLOW_REGISTRATION = true;
+        };
+        credentials = {
+          # The following were randomly generated with https://www.librechat.ai/toolkit/creds_generator
+          CREDS_KEY = credsKeyFile;
+          CREDS_IV = credsIvFile;
+          JWT_SECRET = jwtSecret;
+          JWT_REFRESH_SECRET = jwtRefreshSecret;
+        };
+        enableLocalDB = true;
+      };
+    };
+
+  testScript = ''
+    machine.start()
+
+    machine.succeed("grep -qF 'ALLOW_REGISTRATION=true' /etc/systemd/system/librechat.service")
+
+    machine.wait_for_unit("librechat.service")
+    machine.wait_for_open_port(3080)
+
+    machine.succeed("curl --fail http://localhost:3080/")
+
+    machine.shutdown()
+  '';
+}
@@ -561,13 +561,13 @@
    "vendorHash": "sha256-xIagZvWtlNpz5SQfxbA7r9ojAeS3CW2pwV337ObKOwU="
  },
  "hashicorp_google": {
-    "hash": "sha256-d9rFR5ND72GIqwjusfKgzUozSJY/Dg+yL3AoPxIVExI=",
+    "hash": "sha256-gjhIhDhGils0tveTam00vX3MIXi2HSOHdLUX59R9US8=",
    "homepage": "https://registry.terraform.io/providers/hashicorp/google",
    "owner": "hashicorp",
    "repo": "terraform-provider-google",
-    "rev": "v7.12.0",
+    "rev": "v7.13.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-bpyTtuK3kcntk9hzCU2d+RZ0K0jfFtUlEZezyZHvFW8="
+    "vendorHash": "sha256-4Nx3iDeuXfzC6DOAr2fSdnaMt5txLR0EEhmLnWryX4g="
  },
  "hashicorp_google-beta": {
    "hash": "sha256-ZcSd232jOol7fVsPFHaKq1+0Mzg/FwiTF1zoM5nJUxE=",
@@ -28,6 +28,8 @@
  libngspice,
  withScripting ? true,
  python3,
+  withJava ? false,
+  jre,
  addons ? [ ],
  debug ? false,
  sanitizeAddress ? false,
@@ -204,6 +206,8 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [ makeWrapper ] ++ optionals withScripting [ python.pkgs.wrapPython ];

+  buildInputs = optionals withJava [ jre ];
+
  # KICAD7_TEMPLATE_DIR only works with a single path (it does not handle : separated paths)
  # but it's used to find both the templates and the symbol/footprint library tables
  # https://gitlab.com/kicad/code/kicad/-/issues/14792
@@ -285,6 +289,7 @@ stdenv.mkDerivation rec {
        tool:
        "makeWrapper ${base}/${bin}/${tool} $out/bin/${tool} $makeWrapperArgs"
        + optionalString withScripting " --set PYTHONPATH \"$program_PYTHONPATH\""
+        + optionalString withJava " --set JAVA_HOME \"${jre}\""
      ) tools)

      # link in the CLI utils
@@ -8,16 +8,16 @@
 }:

 let
-  openShiftVersion = "4.20.1";
-  okdVersion = "4.20.0-okd-scos.7";
+  openShiftVersion = "4.20.5";
+  okdVersion = "4.20.0-okd-scos.11";
  microshiftVersion = "4.20.0";
  writeKey = "$(MODULEPATH)/pkg/crc/segment.WriteKey=cvpHsNcmGCJqVzf6YxrSnVlwFSAZaYtp";
-  gitCommit = "cb4c9175d15c1fae26734da75806f8d436b6799a";
-  gitHash = "sha256-QdsknUcc9ugpwiyJerxUuf70vtLMXhc3Pz+f2+sPceI=";
+  gitCommit = "ae41f68e34a463bfb6a72dc06c51f2b809c99724";
+  gitHash = "sha256-O8O3O+RoBieOdsAqLAomZ2lPIHEta6j2yhNOfXwtrVA=";
 in
 buildGoModule (finalAttrs: {
  pname = "crc";
-  version = "2.56.0";
+  version = "2.57.0";

  src = fetchFromGitHub {
    owner = "crc-org";
@@ -11,13 +11,13 @@

 buildNpmPackage rec {
  pname = "ghostfolio";
-  version = "2.221.0";
+  version = "2.222.0";

  src = fetchFromGitHub {
    owner = "ghostfolio";
    repo = "ghostfolio";
    tag = version;
-    hash = "sha256-hcFzcaa8SpwecyPeDbKE2/hnANUFP4EiUzJCs5Ybkyc=";
+    hash = "sha256-pMkmjGRdJjkEDMf9k7QqYIwkUX9LaeovQYG2i+vmOtE=";
    # populate values that require us to use git. By doing this in postFetch we
    # can delete .git afterwards and maintain better reproducibility of the src.
    leaveDotGit = true;
@@ -27,7 +27,7 @@ buildNpmPackage rec {
    '';
  };

-  npmDepsHash = "sha256-fzY/gf65u5iQe/J+7p46lSp4uAEZ21nr+L0OB9GyWxk=";
+  npmDepsHash = "sha256-7Xf3Yn4fC+Jjc/UFu+cg9cVwiYK/VMasZwPOIJu771o=";

  nativeBuildInputs = [
    prisma
@@ -4,7 +4,7 @@
  fetchFromGitHub,
 }:

-python3.pkgs.buildPythonApplication {
+python3.pkgs.buildPythonApplication rec {
  pname = "ghstack";
  version = "0.12.0";
  pyproject = true;
@@ -12,11 +12,16 @@ python3.pkgs.buildPythonApplication {
  src = fetchFromGitHub {
    owner = "ezyang";
    repo = "ghstack";
-    rev = "fa7e7023d798aad6b115b88c5ad67ce88a4fc2a6";
-    hash = "sha256-Ywwjeupa8eE/vkrbl5SIbvQs53xaLnq9ieWRFwzmuuc=";
+    tag = version;
+    hash = "sha256-pLKwDezkwGrqYgP4WnIl5nAam6bMNO6BK+xbxhp7Aq8=";
  };

-  build-system = [ python3.pkgs.poetry-core ];
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail 'requires = ["uv_build>=0.6,<0.7"]' 'requires = ["uv_build>=0.6"]'
+  '';
+
+  build-system = [ python3.pkgs.uv-build ];

  dependencies = with python3.pkgs; [
    aiohttp
@@ -27,13 +32,16 @@ python3.pkgs.buildPythonApplication {
    typing-extensions
  ];

-  pythonImportsCheck = [ "ghstack" ];
+  pythonImportsCheck = [ "ghstack.cli" ];

  meta = {
    description = "Submit stacked diffs to GitHub on the command line";
    homepage = "https://github.com/ezyang/ghstack";
    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ munksgaard ];
+    maintainers = with lib.maintainers; [
+      munksgaard
+      shikanime
+    ];
    mainProgram = "ghstack";
  };
 }
@@ -77,7 +77,6 @@ stdenv.mkDerivation {
  '';

  meta = {
-    broken = (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64);
    description = "Interactive theorem prover based on Higher-Order Logic";
    longDescription = ''
      HOL4 is the latest version of the HOL interactive proof
@@ -9,13 +9,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "kokkos";
-  version = "4.7.01";
+  version = "5.0.0";

  src = fetchFromGitHub {
    owner = "kokkos";
    repo = "kokkos";
    rev = finalAttrs.version;
-    hash = "sha256-l5vSYaUtavQLjBSbKHGK2/JtgKzO2KD5+mcPPnWKNkI=";
+    hash = "sha256-l8KE8lW0P5loOMfi6OAB4iMOA8z3JxYaiB07Smp6HSo=";
  };

  nativeBuildInputs = [
@@ -13,20 +13,20 @@

 stdenv.mkDerivation rec {
  pname = "lasuite-docs-collaboration-server";
-  version = "4.0.0";
+  version = "4.1.0";

  src = fetchFromGitHub {
    owner = "suitenumerique";
    repo = "docs";
    tag = "v${version}";
-    hash = "sha256-rhbS6NYk8sZmtrNpKJrm24vOwAJGEDVS9fpFWuyvPGA=";
+    hash = "sha256-vZkqHlZ1aDOXcrdyV8BXmI95AmMalXOuVLS9XWB/YxU=";
  };

  sourceRoot = "source/src/frontend";

  offlineCache = fetchYarnDeps {
    yarnLock = "${src}/src/frontend/yarn.lock";
-    hash = "sha256-ZMeLHpwM0yZvYmA/HSuWbcdqxOH707NNzXppEzV2wEw=";
+    hash = "sha256-3yRKWIOPBRrOxBWUW3C5xFjb2dcA6c3cMOD8PZWjHNA=";
  };

  nativeBuildInputs = [
@@ -12,20 +12,20 @@

 stdenv.mkDerivation rec {
  pname = "lasuite-docs-frontend";
-  version = "4.0.0";
+  version = "4.1.0";

  src = fetchFromGitHub {
    owner = "suitenumerique";
    repo = "docs";
    tag = "v${version}";
-    hash = "sha256-rhbS6NYk8sZmtrNpKJrm24vOwAJGEDVS9fpFWuyvPGA=";
+    hash = "sha256-vZkqHlZ1aDOXcrdyV8BXmI95AmMalXOuVLS9XWB/YxU=";
  };

  sourceRoot = "source/src/frontend";

  offlineCache = fetchYarnDeps {
    yarnLock = "${src}/src/frontend/yarn.lock";
-    hash = "sha256-ZMeLHpwM0yZvYmA/HSuWbcdqxOH707NNzXppEzV2wEw=";
+    hash = "sha256-3yRKWIOPBRrOxBWUW3C5xFjb2dcA6c3cMOD8PZWjHNA=";
  };

  nativeBuildInputs = [
@@ -4,7 +4,6 @@
  python3,
  fetchFromGitHub,
  nixosTests,
-  fetchPypi,
  fetchYarnDeps,
  nodejs,
  yarnBuildHook,
@@ -15,23 +14,15 @@ let
    self = python3;
    packageOverrides = self: super: {
      django = super.django_5_2;
-      django-csp = super.django-csp.overridePythonAttrs rec {
-        version = "4.0";
-        src = fetchPypi {
-          inherit version;
-          pname = "django_csp";
-          hash = "sha256-snAQu3Ausgo9rTKReN8rYaK4LTOLcPvcE8OjvShxKDM=";
-        };
-      };
    };
  };

-  version = "4.0.0";
+  version = "4.1.0";
  src = fetchFromGitHub {
    owner = "suitenumerique";
    repo = "docs";
    tag = "v${version}";
-    hash = "sha256-rhbS6NYk8sZmtrNpKJrm24vOwAJGEDVS9fpFWuyvPGA=";
+    hash = "sha256-vZkqHlZ1aDOXcrdyV8BXmI95AmMalXOuVLS9XWB/YxU=";
  };

  mail-templates = stdenv.mkDerivation {
@@ -71,46 +62,51 @@ python.pkgs.buildPythonApplication rec {

  build-system = with python.pkgs; [ setuptools ];

-  dependencies = with python.pkgs; [
-    beautifulsoup4
-    boto3
-    celery
-    django
-    django-configurations
-    django-cors-headers
-    django-countries
-    django-csp
-    django-extensions
-    django-filter
-    django-lasuite
-    django-parler
-    django-redis
-    django-storages
-    django-timezone-field
-    django-treebeard
-    djangorestframework
-    drf-spectacular
-    drf-spectacular-sidecar
-    dockerflow
-    easy-thumbnails
-    factory-boy
-    gunicorn
-    jsonschema
-    lxml
-    markdown
-    mozilla-django-oidc
-    nested-multipart-parser
-    openai
-    psycopg
-    pycrdt
-    pyjwt
-    pyopenssl
-    python-magic
-    redis
-    requests
-    sentry-sdk
-    whitenoise
-  ];
+  dependencies =
+    with python.pkgs;
+    [
+      beautifulsoup4
+      boto3
+      celery
+      django
+      django-configurations
+      django-cors-headers
+      django-countries
+      django-csp
+      django-extensions
+      django-filter
+      django-lasuite
+      django-parler
+      django-redis
+      django-storages
+      django-timezone-field
+      django-treebeard
+      djangorestframework
+      drf-spectacular
+      drf-spectacular-sidecar
+      dockerflow
+      easy-thumbnails
+      factory-boy
+      gunicorn
+      jsonschema
+      lxml
+      markdown
+      mozilla-django-oidc
+      nested-multipart-parser
+      openai
+      psycopg
+      pycrdt
+      pyjwt
+      pyopenssl
+      python-magic
+      redis
+      requests
+      sentry-sdk
+      whitenoise
+    ]
+    ++ celery.optional-dependencies.redis
+    ++ django-lasuite.optional-dependencies.all
+    ++ django-storages.optional-dependencies.s3;

  pythonRelaxDeps = true;

@@ -32,44 +32,49 @@ python.pkgs.buildPythonApplication rec {

  build-system = with python.pkgs; [ setuptools ];

-  dependencies = with python.pkgs; [
-    aiohttp
-    boto3
-    brevo-python
-    brotli
-    celery
-    django
-    django-configurations
-    django-cors-headers
-    django-countries
-    django-extensions
-    django-lasuite
-    django-parler
-    django-redis
-    django-storages
-    django-timezone-field
-    djangorestframework
-    dockerflow
-    drf-spectacular
-    drf-spectacular-sidecar
-    easy-thumbnails
-    factory-boy
-    gunicorn
-    jsonschema
-    june-analytics-python
-    livekit-api
-    markdown
-    mozilla-django-oidc
-    nested-multipart-parser
-    psycopg
-    pyjwt
-    pyopenssl
-    python-frontmatter
-    redis
-    requests
-    sentry-sdk
-    whitenoise
-  ];
+  dependencies =
+    with python.pkgs;
+    [
+      aiohttp
+      boto3
+      brevo-python
+      brotli
+      celery
+      django
+      django-configurations
+      django-cors-headers
+      django-countries
+      django-extensions
+      django-lasuite
+      django-parler
+      django-redis
+      django-storages
+      django-timezone-field
+      djangorestframework
+      dockerflow
+      drf-spectacular
+      drf-spectacular-sidecar
+      easy-thumbnails
+      factory-boy
+      gunicorn
+      jsonschema
+      june-analytics-python
+      livekit-api
+      markdown
+      mozilla-django-oidc
+      nested-multipart-parser
+      psycopg
+      pyjwt
+      pyopenssl
+      python-frontmatter
+      redis
+      requests
+      sentry-sdk
+      whitenoise
+    ]
+    ++ celery.optional-dependencies.redis
+    ++ django-lasuite.optional-dependencies.all
+    ++ django-storages.optional-dependencies.s3;

  pythonRelaxDeps = true;

@@ -40,6 +40,11 @@ stdenv.mkDerivation rec {
      --replace '$'{prefix}/@CMAKE_INSTALL_LIBDIR@ @CMAKE_INSTALL_FULL_LIBDIR@
  '';

+  postFixup = ''
+    substituteInPlace $dev/lib/cmake/cnats/cnats-config.cmake \
+      --replace-fail "_IMPORT_PREFIX \"$out\"" "_IMPORT_PREFIX \"$dev\""
+  '';
+
  meta = {
    description = "C API for the NATS messaging system";
    homepage = "https://github.com/nats-io/nats.c";
@@ -7,6 +7,7 @@
  node-gyp,
  vips,
  nix-update-script,
+  nixosTests,
 }:

 buildNpmPackage rec {
@@ -84,6 +85,9 @@ buildNpmPackage rec {
        "^v(\\d+\\.\\d+\\.\\d+)$"
      ];
    };
+    tests = {
+      inherit (nixosTests) librechat;
+    };
  };

  meta = {
@@ -2,7 +2,6 @@
  binaryen,
  fetchFromGitHub,
  lib,
-  lldap,
  makeWrapper,
  nixosTests,
  rustPlatform,
@@ -15,57 +14,51 @@
  curl,
  staticAssetsHash ? "sha256-xVbHD9s3ofbtHCDvjYwmsWXDEJ9z9vRxQDRR6pW6rt8=",
 }:
-
-let
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "lldap";
  version = "0.6.2";

-  commonDerivationAttrs = {
-    pname = "lldap";
-    inherit version;
-
-    src = fetchFromGitHub {
-      owner = "lldap";
-      repo = "lldap";
-      rev = "v${version}";
-      hash = "sha256-UBQWOrHika8X24tYdFfY8ETPh9zvI7/HV5j4aK8Uq+Y=";
-    };
-
-    cargoHash = "sha256-SO7+HiiXNB/KF3fjzSMeiTPjRQq/unEfsnplx4kZv9c=";
+  src = fetchFromGitHub {
+    owner = "lldap";
+    repo = "lldap";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-UBQWOrHika8X24tYdFfY8ETPh9zvI7/HV5j4aK8Uq+Y=";
  };

-  staticAssets =
-    src:
-    runCommand "${commonDerivationAttrs.pname}-static-assets"
-      {
-        outputHash = staticAssetsHash;
-        outputHashAlgo = "sha256";
-        outputHashMode = "recursive";
+  cargoHash = "sha256-SO7+HiiXNB/KF3fjzSMeiTPjRQq/unEfsnplx4kZv9c=";
+  ## workaround for overrideAttrs on buildRustPackage
+  ## see https://discourse.nixos.org/t/is-it-possible-to-override-cargosha256-in-buildrustpackage/4393/3
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    name = "${finalAttrs.pname}-cargo-deps";
+    inherit (finalAttrs) src patches;
+    hash = finalAttrs.cargoHash;
+  };

-        inherit src;
+  cargoBuildFlags = [
+    "-p"
+    "lldap"
+    "-p"
+    "lldap_migration_tool"
+    "-p"
+    "lldap_set_password"
+  ];

-        nativeBuildInputs = [
-          curl
-        ];
+  nativeBuildInputs = [ makeWrapper ];
+  postInstall = ''
+    wrapProgram $out/bin/lldap \
+      --set LLDAP_ASSETS_PATH ${finalAttrs.finalPackage.frontend}
+  '';

-        env.SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";
-      }
-      ''
-        mkdir $out
-        mkdir $out/fonts
-        for file in $(cat ${src}/app/static/libraries.txt); do
-          curl $file --location --remote-name --output-dir $out
-        done
-        for file in $(cat ${src}/app/static/fonts/fonts.txt); do
-          curl $file --location --remote-name --output-dir $out/fonts
-        done
-      '';
-
-  frontend = rustPlatform.buildRustPackage (
-    finalAttrs:
-    commonDerivationAttrs
-    // {
-      pname = commonDerivationAttrs.pname + "-frontend";
+  passthru = {

+    frontend = rustPlatform.buildRustPackage {
+      inherit (finalAttrs)
+        version
+        src
+        cargoDeps
+        patches
+        ;
+      pname = finalAttrs.pname + "-frontend";
      nativeBuildInputs = [
        wasm-pack
        wasm-bindgen-cli_0_2_100
@@ -74,70 +67,62 @@ let
        rustc
        rustc.llvmPackages.lld
      ];
-
      buildPhase = ''
        runHook preBuild
-
        HOME=`pwd` ./app/build.sh
-
        runHook postBuild
      '';
-
      installPhase = ''
        runHook preInstall
-
        mkdir -p $out
        cp -R app/{pkg,static} $out/
        cp app/index_local.html $out/index.html
-        cp -R ${staticAssets finalAttrs.src}/* $out/static
+        cp -R ${finalAttrs.finalPackage.staticAssets}/* $out/static
        rm $out/static/libraries.txt $out/static/fonts/fonts.txt
-
        runHook postInstall
      '';
-
      doCheck = false;
-    }
-  );
+    };

-in
-rustPlatform.buildRustPackage (
-  finalAttrs:
-  commonDerivationAttrs
-  // {
-    cargoBuildFlags = [
-      "-p"
-      "lldap"
-      "-p"
-      "lldap_migration_tool"
-      "-p"
-      "lldap_set_password"
+    staticAssets =
+      runCommand "${finalAttrs.pname}-static-assets"
+        {
+          outputHash = staticAssetsHash;
+          outputHashAlgo = "sha256";
+          outputHashMode = "recursive";
+          inherit (finalAttrs) src;
+          nativeBuildInputs = [
+            curl
+          ];
+          env.SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";
+        }
+        ''
+          mkdir $out
+          mkdir $out/fonts
+          for file in $(cat $src/app/static/libraries.txt); do
+            curl $file --location --remote-name --output-dir $out
+          done
+          for file in $(cat $src/app/static/fonts/fonts.txt); do
+            curl $file --location --remote-name --output-dir $out/fonts
+          done
+        '';
+
+    tests = {
+      inherit (nixosTests) lldap;
+    };
+
+  };
+
+  meta = {
+    description = "Lightweight authentication server that provides an opinionated, simplified LDAP interface for authentication";
+    homepage = "https://github.com/lldap/lldap";
+    changelog = "https://github.com/lldap/lldap/blob/v${finalAttrs.version}/CHANGELOG.md";
+    license = lib.licenses.gpl3Only;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [
+      bendlas
+      ibizaman
    ];
-
-    nativeBuildInputs = [ makeWrapper ];
-    postInstall = ''
-      wrapProgram $out/bin/lldap \
-        --set LLDAP_ASSETS_PATH ${finalAttrs.finalPackage.frontend}
-    '';
-
-    passthru = {
-      inherit frontend;
-      tests = {
-        inherit (nixosTests) lldap;
-      };
-    };
-
-    meta = {
-      description = "Lightweight authentication server that provides an opinionated, simplified LDAP interface for authentication";
-      homepage = "https://github.com/lldap/lldap";
-      changelog = "https://github.com/lldap/lldap/blob/v${lldap.version}/CHANGELOG.md";
-      license = lib.licenses.gpl3Only;
-      platforms = lib.platforms.linux;
-      maintainers = with lib.maintainers; [
-        bendlas
-        ibizaman
-      ];
-      mainProgram = "lldap";
-    };
-  }
-
-)
+    mainProgram = "lldap";
+  };
+})
@@ -1,12 +1,14 @@
-{ fetchurl, libiconv }:
+{ fetchFromGitHub, libiconv }:

 finalAttrs: {
  version = "0.996";

-  src = fetchurl {
-    url = "https://drive.google.com/uc?export=download&id=0B4y35FiV1wh7cENtOXlicTFaRUE";
-    name = "mecab-${finalAttrs.version}.tar.gz";
-    hash = "sha256-4HMyV4MTW3LmZhRceBu0j62lg9UiT7JJD7bBQDumnFk=";
+  src = fetchFromGitHub {
+    owner = "taku910";
+    repo = "mecab";
+    rev = "5a7db65493a0b57d5fc31734e65300320aaf94c8";
+    hash = "sha256-elB0Zr8DDkw3IZvvqVG+OBspZxFLPnvUSM9SRSILYWs=";
+    rootDir = "mecab";
  };

  buildInputs = [ libiconv ];
@@ -1,19 +1,24 @@
 {
  lib,
  stdenv,
-  fetchurl,
-  mecab-nodic,
+  fetchFromGitHub,
  buildPackages,
+  callPackage,
 }:

+let
+  mecab-nodic = callPackage ./nodic.nix { };
+in
 stdenv.mkDerivation (finalAttrs: {
  pname = "mecab-ipadic";
  version = "2.7.0-20070801";

-  src = fetchurl {
-    url = "https://drive.google.com/uc?export=download&id=0B4y35FiV1wh7MWVlSDBCSXZMTXM";
-    name = "mecab-ipadic-${finalAttrs.version}.tar.gz";
-    hash = "sha256-ti9SfYgcUEV2uu2cbvZWFVRlixdc5q4AlqYDB+SeNSM=";
+  src = fetchFromGitHub {
+    owner = "taku910";
+    repo = "mecab";
+    rev = "2fd29256c6d5e1b10211cac838069ee9ede8c77a";
+    hash = "sha256-FKRm4bIBhmE4gafg9JeMnpjXbAu4c7l7XIJVbnsRVi8=";
+    rootDir = "mecab-ipadic";
  };

  buildInputs = [ mecab-nodic ];
@@ -1,11 +1,11 @@
 {
  stdenv,
-  fetchurl,
+  fetchFromGitHub,
  libiconv,
 }:

 let
-  mecab-base = import ./base.nix { inherit fetchurl libiconv; };
+  mecab-base = import ./base.nix { inherit fetchFromGitHub libiconv; };
 in
 stdenv.mkDerivation (
  finalAttrs:
@@ -1,13 +1,14 @@
 {
  lib,
  stdenv,
-  fetchurl,
-  mecab-ipadic,
  libiconv,
+  callPackage,
+  fetchFromGitHub,
 }:

 let
-  mecab-base = import ./base.nix { inherit fetchurl libiconv; };
+  mecab-base = import ./base.nix { inherit fetchFromGitHub libiconv; };
+  mecab-ipadic = callPackage ./ipadic.nix { };
 in
 stdenv.mkDerivation (
  finalAttrs:
@@ -10,13 +10,13 @@

 buildGoModule (finalAttrs: {
  pname = "moor";
-  version = "2.9.4";
+  version = "2.9.5";

  src = fetchFromGitHub {
    owner = "walles";
    repo = "moor";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-HOnm991rMuAed4t8Z10HN17w89p1WVUjSGGc/w9UUlg=";
+    hash = "sha256-oyxDVhP2pzHqaDyGrKPNRGzvMH3Bwdi6tYYCjo+CweQ=";
  };

  vendorHash = "sha256-l1XeVZ4FyQDu2sKo4/SieBbwUicq3gNE3D/0m6fcGt8=";
@@ -21,13 +21,17 @@
  libglvnd,
  systemd,
  patchelf,
-  nix-update-script,
  undmg,
  makeWrapper,
 }:
 let
  pname = "nextcloud-talk-desktop";
-  version = "2.0.4";
+  version = "2.0.4"; # Ensure both hashes (Linux and Darwin) are updated!
+
+  hashes = {
+    linux = "sha256-Nky3ws1UV0F4qjbBog53BjXkZ/ttTER/32NlB2ONJaE=";
+    darwin = "sha256-N/v1842rheqrjG4pAwrSDYNWhQDgWinTiZPusD1dvaM=";
+  };

  # Only x86_64-linux is supported with Darwin support being universal
  sources = {
@@ -35,15 +39,20 @@ let
    # See https://github.com/nextcloud/talk-desktop?tab=readme-ov-file#%EF%B8%8F-prerequisites
    linux = fetchzip {
      url = "https://github.com/nextcloud-releases/talk-desktop/releases/download/v${version}/Nextcloud.Talk-linux-x64.zip";
-      hash = "sha256-Nky3ws1UV0F4qjbBog53BjXkZ/ttTER/32NlB2ONJaE=";
+      hash = hashes.linux;
      stripRoot = false;
    };
    darwin = fetchurl {
      url = "https://github.com/nextcloud-releases/talk-desktop/releases/download/v${version}/Nextcloud.Talk-macos-universal.dmg";
-      hash = "sha256-FgiUb2MNEqmbK4BphHQ7M2IeN7Vg1NQ9FR9UO4AfvNs=";
+      hash = hashes.darwin;
    };
  };

+  passthru = {
+    inherit hashes; # needed by updateScript
+    updateScript = ./update.py;
+  };
+
  meta = {
    description = "Nextcloud Talk Desktop Client";
    homepage = "https://github.com/nextcloud/talk-desktop";
@@ -55,7 +64,7 @@ let
  };

  linux = stdenv.mkDerivation (finalAttrs: {
-    inherit pname version;
+    inherit pname version passthru;

    src = sources.linux;

@@ -127,19 +136,17 @@ let
    '';

    postFixup = ''
-      patchelf --add-needed libGL.so.1 --add-needed libEGL.so.1 \
+      ${lib.getExe patchelf} --add-needed libGL.so.1 --add-needed libEGL.so.1 \
        "$out/opt/Nextcloud Talk-linux-x64/Nextcloud Talk"
    '';

-    passthru.updateScript = nix-update-script { };
-
    meta = meta // {
      platforms = lib.intersectLists lib.platforms.linux lib.platforms.x86_64;
    };
  });

  darwin = stdenv.mkDerivation (finalAttrs: {
-    inherit pname version;
+    inherit pname version passthru;

    src = sources.darwin;

@@ -0,0 +1,39 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i python3 -p python3 bash nix-update jq
+
+import subprocess
+from os.path import join, dirname
+
+# This will set the version correctly,
+# and will also set the hash for x86_64-linux.
+subprocess.run(["nix-update", "nextcloud-talk-desktop"])
+
+# Now get the hash for Darwin.
+# (It's the same for both Darwin platforms, and we don't support aarch64-linux).
+newVer = subprocess.run(
+  ["nix-instantiate", "--eval", "--raw", "-A", "nextcloud-talk-desktop.version"], capture_output=True, encoding="locale"
+).stdout
+
+darwinUrl = (
+  f"https://github.com/nextcloud-releases/talk-desktop/releases/download/v{newVer}/Nextcloud.Talk-macos-universal.dmg"
+)
+
+oldDarwinHash = subprocess.run(
+  ["nix-instantiate", "--eval", "--raw", "-A", f"nextcloud-talk-desktop.passthru.hashes.darwin"],
+  capture_output=True,
+  encoding="locale",
+).stdout
+
+newDarwinHash = subprocess.run(
+  ["bash", "-c", f"nix store prefetch-file {darwinUrl} --json | jq -r '.hash'"],
+  capture_output=True,
+  encoding="locale",
+).stdout.strip()  # Has a newline
+
+with open(join(dirname(__file__), "package.nix"), "r") as f:
+  txt = f.read()
+
+txt = txt.replace(oldDarwinHash, newDarwinHash)
+
+with open(join(dirname(__file__), "package.nix"), "w") as f:
+  f.write(txt)
@@ -1,64 +0,0 @@
-From a94104a0c419a5049712f7372690dab10f54ab2f Mon Sep 17 00:00:00 2001
-From: Ihar Hrachyshka <ihar.hrachyshka@gmail.com>
-Date: Sun, 12 Oct 2025 18:46:14 -0400
-Subject: [PATCH ovn] build: Fix race condition when installing ovn-detrace.
-
-When running parallel make install (-j), ovn-detrace-install could
-trigger before ovn_detrace.py is installed. In this case, `ln` will
-fail.
-
-When it happens, make fails with:
-
-```
-ln: failed to create symbolic link '[...]/bin/ovn-detrace': No such file or directory
-make[2]: *** [Makefile:3852: ovn-detrace-install] Error 1
-```
-
-Automake install-*-local targets are not guaranteed any order. In
-contrast, install-*-hook does [1]. This patch switches the make target
-to use the latter.
-
-[1] https://www.gnu.org/software/automake/manual/html_node/Extending-Installation.html
-
-Signed-off-by: Ihar Hrachyshka <ihar.hrachyshka@gmail.com>
---
- Makefile.am           | 2 ++
- utilities/automake.mk | 2 +-
- 2 files changed, 3 insertions(+), 1 deletion(-)
-
-diff --git a/Makefile.am b/Makefile.am
-index 6119ef510..060d3189d 100644
--- a/Makefile.am
-+++ b/Makefile.am
-@@ -128,6 +128,7 @@ dist_scripts_SCRIPTS =
- dist_scripts_DATA =
- EXTRA_PROGRAMS =
- INSTALL_DATA_LOCAL =
-+INSTALL_DATA_HOOK =
- UNINSTALL_LOCAL =
- man_MANS =
- MAN_FRAGMENTS =
-@@ -487,6 +488,7 @@ dist-hook: $(DIST_HOOKS)
- all-local: $(ALL_LOCAL)
- clean-local: $(CLEAN_LOCAL)
- install-data-local: $(INSTALL_DATA_LOCAL)
-+install-data-hook: $(INSTALL_DATA_HOOK)
- uninstall-local: $(UNINSTALL_LOCAL)
- .PHONY: $(DIST_HOOKS) $(CLEAN_LOCAL) $(INSTALL_DATA_LOCAL) $(UNINSTALL_LOCAL)
- 
-diff --git a/utilities/automake.mk b/utilities/automake.mk
-index 1de33614f..ec955f6bf 100644
--- a/utilities/automake.mk
-+++ b/utilities/automake.mk
-@@ -106,7 +106,7 @@ utilities_ovn_appctl_SOURCES = utilities/ovn-appctl.c
- utilities_ovn_appctl_LDADD = lib/libovn.la $(OVSDB_LIBDIR)/libovsdb.la $(OVS_LIBDIR)/libopenvswitch.la
- 
- # ovn-detrace
-INSTALL_DATA_LOCAL += ovn-detrace-install
-+INSTALL_DATA_HOOK += ovn-detrace-install
- ovn-detrace-install:
- 	ln -sf ovn_detrace.py $(DESTDIR)$(bindir)/ovn-detrace
- 
-- 
-2.51.0
-
@@ -0,0 +1,246 @@
+From cbb90f0c9f4b684d1934380288553cc22f95babe Mon Sep 17 00:00:00 2001
+From: Ihar Hrachyshka <ihar.hrachyshka@gmail.com>
+Date: Fri, 12 Dec 2025 21:40:50 -0500
+Subject: [PATCH ovn] tests: Ignore AT_CHECK stderr for `grep ... | grep -q`.
+
+When `grep -q` is used in a pipeline, it will exit on a first match and
+not wait for its upstream pipeline component to complete. The upstream
+command may keep producing stdout. If the upstream command attempts to
+write to its stdout after `grep -q` exited, it will receive SIGPIPE. In
+this scenario, the upstream command may print an error to stderr.
+
+Specifically, `grep` may write: `grep: write error: Broken pipe`.
+
+Since AT_CHECK with implicit stderr argument expects empty stderr,
+running AT_CHECK on a pipeline that chains multiple `grep` calls, with
+the last component being `grep -q`, may result in a spurious test
+failure, depending on the order of `close` calls on stdin and stdout of
+the pipeline component commands.
+
+When `grep -q` is used and we expect it to return 0, we usually don't
+care if its upstream command produces more output (either stdout or
+stderr). As long as there's a match, `grep -q` - and the AT_CHECK check
+- should succeed.
+
+This patch updates all AT_CHECK calls that:
+
+- use a pipeline with multiple `grep` components;
+- with the last pipeline component being `grep -q`;
+- expect a match (making `grep -q` exit early).
+
+These calls are updated to explicitly `[ignore]` stderr from the
+pipeline.
+
+Signed-off-by: Ihar Hrachyshka <ihar.hrachyshka@gmail.com>
+---
+ tests/ovn-controller.at  | 14 +++++++-------
+ tests/ovn-northd.at      | 28 ++++++++++++++--------------
+ tests/system-ovn-kmod.at |  6 +++---
+ 3 files changed, 24 insertions(+), 24 deletions(-)
+
+diff --git a/tests/ovn-controller.at b/tests/ovn-controller.at
+index 0ba1357b2..d7cc06d00 100644
+--- a/tests/ovn-controller.at
+++ b/tests/ovn-controller.at
+@@ -862,7 +862,7 @@ check ovn-nbctl meter-add event-elb drop 100 pktps 10
+ check ovn-nbctl --wait=hv copp-add copp0 event-elb event-elb
+ check ovn-nbctl --wait=hv ls-copp-add copp0 ls1
+ 
+-AT_CHECK([as hv1 ovs-ofctl dump-flows br-int | grep controller | grep userdata=00.00.00.0f | grep -q meter_id=1])
+AT_CHECK([as hv1 ovs-ofctl dump-flows br-int | grep controller | grep userdata=00.00.00.0f | grep -q meter_id=1], [0], [], [ignore])
+ 
+ check ovn-nbctl copp-del copp0
+ AT_CHECK([ovn-nbctl copp-list copp0], [0], [dnl
+@@ -875,13 +875,13 @@ check ovn-nbctl --wait=hv copp-add copp1 reject acl-meter
+ check ovn-nbctl ls-copp-add copp1 ls1
+ check ovn-nbctl --wait=hv acl-add ls1 from-lport 1002 'inport == "lsp1" && ip && udp' reject
+ 
+-AT_CHECK([as hv1 ovs-ofctl dump-flows br-int | grep controller | grep userdata=00.00.00.16 | grep -q meter_id=1])
+AT_CHECK([as hv1 ovs-ofctl dump-flows br-int | grep controller | grep userdata=00.00.00.16 | grep -q meter_id=1], [0], [], [ignore])
+ 
+ # arp metering
+ check ovn-nbctl meter-add arp-meter drop 200 pktps 0
+ check ovn-nbctl --wait=hv copp-add copp2 arp-resolve arp-meter
+ check ovn-nbctl --wait=hv lr-copp-add copp2 lr1
+-AT_CHECK([as hv1 ovs-ofctl dump-flows br-int | grep controller | grep userdata=00.00.00.00 | grep -q meter_id=2])
+AT_CHECK([as hv1 ovs-ofctl dump-flows br-int | grep controller | grep userdata=00.00.00.00 | grep -q meter_id=2], [0], [], [ignore])
+ 
+ OVN_CLEANUP([hv1])
+ AT_CLEANUP
+@@ -2099,7 +2099,7 @@ check ovn-nbctl --wait=hv sync
+ check ovn-nbctl remove address_set as1 addresses 10.0.0.1/32
+ check ovn-nbctl --wait=hv sync
+ 
+-AT_CHECK([grep "already references desired flow" hv1/ovn-controller.log | grep -q "nw_src=10.0.0.1"])
+AT_CHECK([grep "already references desired flow" hv1/ovn-controller.log | grep -q "nw_src=10.0.0.1"], [0], [], [ignore])
+ 
+ # Same for duplicate IPv6 addresses.
+ check ovn-nbctl add address_set as2 addresses '["::01"]'
+@@ -2107,7 +2107,7 @@ check ovn-nbctl --wait=hv sync
+ check ovn-nbctl remove address_set as2 addresses '["::01"]'
+ check ovn-nbctl --wait=hv sync
+ 
+-AT_CHECK([grep "already references desired flow" hv1/ovn-controller.log | grep -q "ipv6_src=::1"])
+AT_CHECK([grep "already references desired flow" hv1/ovn-controller.log | grep -q "ipv6_src=::1"], [0], [], [ignore])
+ 
+ OVN_CLEANUP([hv1
+ /already references desired flow/d
+@@ -2471,8 +2471,8 @@ AT_CHECK([ovn-nbctl --wait=hv sync])
+ # Check if ovn-controller is still alive
+ AT_CHECK([ps $pid], [0], [ignore])
+ # Check if we got warnings for invalid
+-AT_CHECK([grep "Parsing of ovn-chassis-mac-mappings failed" hv1/ovn-controller.log | grep -q invalid1])
+-AT_CHECK([grep "Parsing of ovn-chassis-mac-mappings failed" hv1/ovn-controller.log | grep -q invalid2])
+AT_CHECK([grep "Parsing of ovn-chassis-mac-mappings failed" hv1/ovn-controller.log | grep -q invalid1], [0], [], [ignore])
+AT_CHECK([grep "Parsing of ovn-chassis-mac-mappings failed" hv1/ovn-controller.log | grep -q invalid2], [0], [], [ignore])
+ AT_CHECK([grep "Parsing of ovn-chassis-mac-mappings failed" hv1/ovn-controller.log | grep -q br1], [1])
+ 
+ OVN_CLEANUP([hv1
+diff --git a/tests/ovn-northd.at b/tests/ovn-northd.at
+index d425cfb7a..5b1a8b6f8 100644
+--- a/tests/ovn-northd.at
+++ b/tests/ovn-northd.at
+@@ -4151,7 +4151,7 @@ check as northd ovn-appctl -t ovn-northd inc-engine/clear-stats
+ 
+ check ovn-nbctl --bfd=$uuid lr-route-add r0 100.0.0.0/8 192.168.1.2
+ wait_column down bfd status logical_port=r0-sw1
+-AT_CHECK([ovn-nbctl lr-route-list r0 | grep 192.168.1.2 | grep -q bfd],[0])
+AT_CHECK([ovn-nbctl lr-route-list r0 | grep 192.168.1.2 | grep -q bfd], [0], [], [ignore])
+ 
+ check_engine_stats northd recompute nocompute
+ check_engine_stats bfd recompute nocompute
+@@ -4163,11 +4163,11 @@ check as northd ovn-appctl -t ovn-northd inc-engine/clear-stats
+ 
+ check ovn-nbctl --bfd lr-route-add r0 200.0.0.0/8 192.168.2.2
+ wait_column down bfd status logical_port=r0-sw2
+-AT_CHECK([ovn-nbctl lr-route-list r0 | grep 192.168.2.2 | grep -q bfd],[0])
+AT_CHECK([ovn-nbctl lr-route-list r0 | grep 192.168.2.2 | grep -q bfd], [0], [], [ignore])
+ 
+ check ovn-nbctl --bfd lr-route-add r0 240.0.0.0/8 192.168.5.2 r0-sw5
+ wait_column down bfd status logical_port=r0-sw5
+-AT_CHECK([ovn-nbctl lr-route-list r0 | grep 192.168.5.2 | grep -q bfd],[0])
+AT_CHECK([ovn-nbctl lr-route-list r0 | grep 192.168.5.2 | grep -q bfd], [0], [], [ignore])
+ 
+ check_engine_stats northd recompute nocompute
+ check_engine_stats bfd recompute nocompute
+@@ -4179,7 +4179,7 @@ check as northd ovn-appctl -t ovn-northd inc-engine/clear-stats
+ 
+ check ovn-nbctl --bfd --policy=src-ip lr-route-add r0 192.168.6.1/32 192.168.10.10 r0-sw6
+ wait_column down bfd status logical_port=r0-sw6
+-AT_CHECK([ovn-nbctl lr-route-list r0 | grep 192.168.6.1 | grep -q bfd],[0])
+AT_CHECK([ovn-nbctl lr-route-list r0 | grep 192.168.6.1 | grep -q bfd], [0], [], [ignore])
+ 
+ check_engine_stats northd recompute nocompute
+ check_engine_stats bfd recompute nocompute
+@@ -4191,7 +4191,7 @@ check as northd ovn-appctl -t ovn-northd inc-engine/clear-stats
+ 
+ check ovn-nbctl --bfd --policy=src-ip lr-route-add r0 192.168.7.1/32 192.168.10.10 r0-sw7
+ wait_column down bfd status logical_port=r0-sw7
+-AT_CHECK([ovn-nbctl lr-route-list r0 | grep 192.168.7.1 | grep -q bfd],[0])
+AT_CHECK([ovn-nbctl lr-route-list r0 | grep 192.168.7.1 | grep -q bfd], [0], [], [ignore])
+ 
+ route_uuid=$(fetch_column nb:logical_router_static_route _uuid ip_prefix="100.0.0.0/8")
+ check ovn-nbctl clear logical_router_static_route $route_uuid bfd
+@@ -4266,7 +4266,7 @@ AT_CHECK([ovn-nbctl copp-list copp0], [0], [dnl
+ event-elb: meter0
+ ])
+ 
+-AT_CHECK([ovn-sbctl list logical_flow | grep trigger_event -A 2 | grep -q meter0])
+AT_CHECK([ovn-sbctl list logical_flow | grep trigger_event -A 2 | grep -q meter0], [0], [], [ignore])
+ 
+ check ovn-nbctl --wait=hv meter-add meter1 drop 300 pktps 10
+ AT_CHECK([ovn-nbctl meter-list |grep meter1 -A 1], [0], [dnl
+@@ -4284,7 +4284,7 @@ AT_CHECK([ovn-nbctl copp-list copp1], [0], [dnl
+ arp: meter1
+ ])
+ 
+-AT_CHECK([ovn-sbctl list logical_flow | grep arp -A 2 | grep -q meter1])
+AT_CHECK([ovn-sbctl list logical_flow | grep arp -A 2 | grep -q meter1], [0], [], [ignore])
+ 
+ check ovn-nbctl --wait=hv copp-del copp1 arp
+ AT_CHECK([ovn-nbctl copp-list copp1], [0], [dnl
+@@ -4298,7 +4298,7 @@ AT_CHECK([ovn-nbctl copp-list copp2], [0], [dnl
+ icmp4-error: meter2
+ ])
+ 
+-AT_CHECK([ovn-sbctl list logical_flow | grep icmp4 -A 2 | grep -q meter2])
+AT_CHECK([ovn-sbctl list logical_flow | grep icmp4 -A 2 | grep -q meter2], [0], [], [ignore])
+ 
+ check ovn-nbctl --wait=hv copp-del copp2 icmp4-error
+ AT_CHECK([ovn-nbctl copp-list copp2], [0], [dnl
+@@ -4310,7 +4310,7 @@ AT_CHECK([ovn-nbctl copp-list copp3], [0], [dnl
+ icmp6-error: meter2
+ ])
+ 
+-AT_CHECK([ovn-sbctl list logical_flow | grep icmp6 -A 2 | grep -q meter2])
+AT_CHECK([ovn-sbctl list logical_flow | grep icmp6 -A 2 | grep -q meter2], [0], [], [ignore])
+ 
+ check ovn-nbctl --wait=hv copp-del copp3 icmp6-error
+ AT_CHECK([ovn-nbctl copp-list copp3], [0], [dnl
+@@ -4322,7 +4322,7 @@ AT_CHECK([ovn-nbctl copp-list copp4], [0], [dnl
+ tcp-reset: meter2
+ ])
+ 
+-AT_CHECK([ovn-sbctl list logical_flow | grep tcp -A 2 | grep -q meter2])
+AT_CHECK([ovn-sbctl list logical_flow | grep tcp -A 2 | grep -q meter2], [0], [], [ignore])
+ 
+ check ovn-nbctl --wait=hv copp-del copp4 tcp-reset
+ AT_CHECK([ovn-nbctl copp-list copp4], [0], [dnl
+@@ -4351,7 +4351,7 @@ check ovn-nbctl --wait=hv lr-copp-add copp7 r0
+ AT_CHECK([ovn-nbctl copp-list copp7], [0], [dnl
+ bfd: meter0
+ ])
+-AT_CHECK([ovn-sbctl list logical_flow | grep bfd -A 2 | grep -q meter0])
+AT_CHECK([ovn-sbctl list logical_flow | grep bfd -A 2 | grep -q meter0],[0],[],[ignore])
+ 
+ check ovn-nbctl --wait=hv set Logical_Switch sw1 \
+     other_config:mcast_querier="false" \
+@@ -4361,7 +4361,7 @@ check ovn-nbctl --wait=hv ls-copp-add copp8 sw1
+ AT_CHECK([ovn-nbctl copp-list copp8], [0], [dnl
+ igmp: meter1
+ ])
+-AT_CHECK([ovn-sbctl list logical_flow | grep igmp -A 2 | grep -q meter1])
+AT_CHECK([ovn-sbctl list logical_flow | grep igmp -A 2 | grep -q meter1],[0],[],[ignore])
+ 
+ check ovn-nbctl copp-del copp8
+ AT_CHECK([ovn-nbctl copp-list copp8], [0], [dnl
+@@ -7901,7 +7901,7 @@ AT_CHECK([ovn-sbctl lflow-list S1 | grep ls_in_l2_lkup | grep -q 'match=(eth.mca
+ check ovn-nbctl --wait=sb set Logical_Switch S1 \
+     other_config:broadcast-arps-to-all-routers=false
+ 
+-AT_CHECK([ovn-sbctl lflow-list S1 | grep ls_in_l2_lkup | grep -q 'match=(eth.mcast && (arp.op == 1 || nd_ns)), action=(outport = "_MC_flood_l2"; output;)'], [0])
+AT_CHECK([ovn-sbctl lflow-list S1 | grep ls_in_l2_lkup | grep -q 'match=(eth.mcast && (arp.op == 1 || nd_ns)), action=(outport = "_MC_flood_l2"; output;)'], [0], [], [ignore])
+ 
+ check ovn-nbctl --wait=sb set Logical_Switch S1 \
+     other_config:broadcast-arps-to-all-routers=true
+@@ -17201,7 +17201,7 @@ check ovn-nbctl --wait=sb sync
+ 
+ ovn-sbctl dump-flows lr0 > lrflows
+ AT_CAPTURE_FILE([lrflows])
+-AT_CHECK([! ovn_strip_lflows < lrflows | grep priority=105 | grep -q "flags.force_snat_for_lb == 1"])
+AT_CHECK([! ovn_strip_lflows < lrflows | grep priority=105 | grep -q "flags.force_snat_for_lb == 1"], [0], [], [ignore])
+ 
+ check ovn-nbctl lrp-del lrp0 -- lrp-add lr0 lrp0 02:00:00:00:00:01 4242::4242/64
+ check ovn-nbctl --wait=sb sync
+diff --git a/tests/system-ovn-kmod.at b/tests/system-ovn-kmod.at
+index 4e264cca8..53fc45734 100644
+--- a/tests/system-ovn-kmod.at
+++ b/tests/system-ovn-kmod.at
+@@ -1641,11 +1641,11 @@ check_flow_assured() {
+     echo Check if a conntrack entry exists for src=$src_ip, dst=$dst_ip, zone=$zone
+ 
+     if test -n "$src_ip" && test -n "$dst_ip"; then
+-        AT_CHECK([grep -F "$src_ip" conntrack_file | grep -F "$dst_ip" | grep "zone=$zone" | grep -q "ASSURED"])
+        AT_CHECK([grep -F "$src_ip" conntrack_file | grep -F "$dst_ip" | grep "zone=$zone" | grep -q "ASSURED"], [0], [], [ignore])
+     elif test -n "$src_ip"; then
+-        AT_CHECK([grep -F "$src_ip" conntrack_file | grep "zone=$zone" | grep -q "ASSURED"])
+        AT_CHECK([grep -F "$src_ip" conntrack_file | grep "zone=$zone" | grep -q "ASSURED"], [0], [], [ignore])
+     else
+-        AT_CHECK([grep -F "$dst_ip" conntrack_file | grep "zone=$zone" | grep -q "ASSURED"])
+        AT_CHECK([grep -F "$dst_ip" conntrack_file | grep "zone=$zone" | grep -q "ASSURED"], [0], [], [ignore])
+     fi
+ }
+ 
+-- 
+2.51.2
+
@@ -26,13 +26,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "ovn";
-  version = "25.09.0";
+  version = "25.09.1";

  src = fetchFromGitHub {
    owner = "ovn-org";
    repo = "ovn";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-DNaf3vWb6tlzViMEI02+3st/0AiMVAomSaiGplcjkIc=";
+    hash = "sha256-utNMWYMjm511+mkHC/Fe6wJ11vk1HAi0dHlk9JwBYl0=";
    fetchSubmodules = true;
  };

@@ -45,19 +45,26 @@ stdenv.mkDerivation (finalAttrs: {
  ];

  patches = [
-    # Fix test failure with musl libc.
-    (fetchpatch {
-      url = "https://github.com/ovn-org/ovn/commit/d0b187905c45ce039163d18cc82869918946a41c.patch";
-      hash = "sha256-mTpNpH1ZSSMLtpZmy6jKjGDu84jL0ECr+HVh1PQzaVA=";
-    })
-    # Fix sandbox test failure.
-    (fetchpatch {
-      url = "https://github.com/ovn-org/ovn/commit/b396babaa54ea0c8d943bbfef751dbdbf288c7af.patch";
-      hash = "sha256-RjWxT3EYKjGhtvCq3bAhKN9PrPTkSR72xPkQQ4SPWWU=";
-    })
    # Fix build failure due to make install race condition.
-    # Posted at: https://patchwork.ozlabs.org/project/ovn/patch/20251012225908.37855-1-ihar.hrachyshka@gmail.com/
-    ./0001-build-Fix-race-condition-when-installing-ovn-detrace.patch
+    (fetchpatch {
+      url = "https://github.com/ovn-org/ovn/commit/d7c46f5d1f9b804ebc7b20b0edad4e11469a41da.patch";
+      hash = "sha256-P3XNZ2YXSa9s3DdlKX9C243bMovDbIsmapdrXaQS7go=";
+    })
+
+    # Disable scapy tests that were not marked with HAVE_SCAPY requirement -
+    # they hang indefinitely if scapy is not installed.
+    (fetchpatch {
+      url = "https://github.com/ovn-org/ovn/commit/df99035f88e43a3b80f4c58dc530fd3f45766c54.patch";
+      hash = "sha256-l+t1zZ3FEmcRa+G2qfDVaVTBRsFOPd6iceqDmRT+d7k=";
+    })
+    (fetchpatch {
+      url = "https://github.com/ovn-org/ovn/commit/f353dbd03cd7a3c06b1b728321749e5e276aafc0.patch";
+      hash = "sha256-hXH2/tFFtVfrOFQZxmbS7grQeQnTejESU8w10E484PE=";
+    })
+
+    # Fix test failures due to spurious Broken pipe on AT_CHECK stderr.
+    # Posted: https://patchwork.ozlabs.org/project/ovn/patch/20251213030322.91112-1-ihar.hrachyshka@gmail.com/
+    ./0001-tests-Ignore-AT_CHECK-stderr-for-grep-.-grep-q.patch
  ];

  nativeBuildInputs = [
@@ -147,6 +154,18 @@ stdenv.mkDerivation (finalAttrs: {
    touch $OVS_RESOLV_CONF
  '';

+  checkPhase = ''
+    runHook preCheck
+
+    if ! make check; then
+      echo "Some tests failed. Collecting logs for analysis..."
+      find tests/testsuite.dir -type f -exec echo "==== Contents of {} ====" \; -exec cat {} \;
+      exit 1
+    fi
+
+    runHook postCheck
+  '';
+
  passthru.updateScript = nix-update-script { };

  meta = {
@@ -0,0 +1,41 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  pkg-config,
+  openssl,
+  nix-update-script,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "ownserver";
+  version = "0.7.1";
+
+  src = fetchFromGitHub {
+    owner = "Kumassy";
+    repo = "ownserver";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-bseDssSMerBlzlCvL3rD3X6ku5qDRYvI1wxq2W7As5k=";
+  };
+
+  cargoHash = "sha256-SJm66CDrg6ZpIeKx27AnZAVs/Z25E/KmHYuZ9G4UwHQ=";
+
+  nativeBuildInputs = [
+    pkg-config
+    rustPlatform.bindgenHook
+  ];
+
+  buildInputs = [
+    openssl
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Expose your local game server to the Internet";
+    homepage = "https://github.com/Kumassy/ownserver";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ jaredmontoya ];
+    mainProgram = "ownserver";
+  };
+})
@@ -164,7 +164,7 @@ stdenv.mkDerivation rec {

  meta = {
    description = "Pony is an Object-oriented, actor-model, capabilities-secure, high performance programming language";
-    homepage = "https://www.ponylang.org";
+    homepage = "https://www.ponylang.io";
    license = lib.licenses.bsd2;
    maintainers = with lib.maintainers; [
      kamilchm
@@ -2,85 +2,31 @@
  lib,
  fetchFromGitHub,
  buildNpmPackage,
-  fetchNpmDeps,
  nodejs_20,
-  replaceVars,
 }:

-let
-  # Build fails on node 22, presumably because of esm.
-  # https://github.com/NixOS/nixpkgs/issues/371649
-  nodejs = nodejs_20;
-  version = "2.27.1";
+buildNpmPackage (finalAttrs: {
+  pname = "scanservjs";
+  version = "3.0.4";
+
  src = fetchFromGitHub {
    owner = "sbs20";
    repo = "scanservjs";
-    # rev = "v${version}";
-    # 2.27.1 doesn't have a tag
-    rev = "b15adc6f97fb152fd9819371bb1a9b8118baf55b";
-    hash = "sha256-ne9fEF/eurWPXzmJQzBn5jiy+JgxMWiCXsOdmu2fj6E=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-qCJyQO/hSDF4NOupV7sepwvpNyjSElnqT71LJuIKe+A=";
  };

-  depsHashes = {
-    server = "sha256-M8t+TrE+ntZaI9X7hEel94bz34DPtW32n0KKMSoCfIs=";
-    client = "sha256-C31WBYE8ba0t4mfKFAuYWrCZtSdN7tQIYmCflDRKuBM=";
-  };
+  npmDepsHash = "sha256-HIWT09G8gqSFt9CIjsjJaDRnj2GO0G6JOGeI0p4/1vw=";

-  serverDepsForClient = fetchNpmDeps {
-    inherit src nodejs;
-    sourceRoot = "${src.name}/packages/server";
-    name = "scanservjs";
-    hash = depsHashes.server or lib.fakeHash;
-  };
-
-  # static client files
-  client = buildNpmPackage {
-    pname = "scanservjs-client";
-    inherit version src nodejs;
-
-    sourceRoot = "${src.name}/packages/client";
-    npmDepsHash = depsHashes.client or lib.fakeHash;
-
-    preBuild = ''
-      cd ../server
-      chmod +w package-lock.json . /build/source/
-      npmDeps=${serverDepsForClient} npmConfigHook
-      cd ../client
-    '';
-
-    env.NODE_OPTIONS = "--openssl-legacy-provider";
-
-    dontNpmInstall = true;
-    installPhase = ''
-      mv /build/source/dist/client $out
-    '';
-  };
-
-in
-buildNpmPackage {
-  pname = "scanservjs";
-  inherit version src nodejs;
-
-  sourceRoot = "${src.name}/packages/server";
-  npmDepsHash = depsHashes.server or lib.fakeHash;
-
-  # can't use "patches" since they change the server deps' hash for building the client
-  # (I don't want to maintain one more hash)
-  preBuild = ''
-    chmod +w /build/source
-    patch -p3 <${
-      replaceVars ./decouple-from-source-tree.patch {
-        inherit client;
-      }
-    }
-    substituteInPlace src/api.js --replace 'NIX_OUT_PLACEHOLDER' "$out"
-  '';
+  # Build fails on node 22, presumably because of esm.
+  # https://github.com/NixOS/nixpkgs/issues/371649
+  nodejs = nodejs_20;

  postInstall = ''
-    mkdir -p $out/bin
-    makeWrapper ${lib.getExe nodejs} $out/bin/scanservjs \
+    mkdir $out/bin
+    makeWrapper ${lib.getExe finalAttrs.nodejs} $out/bin/scanservjs \
      --set NODE_ENV production \
-      --add-flags "'$out/lib/node_modules/scanservjs-api/src/server.js'"
+      --add-flags "'$out/lib/node_modules/scanservjs/app-server/src/server.js'"
  '';

  meta = {
@@ -92,4 +38,4 @@ buildNpmPackage {
    maintainers = with lib.maintainers; [ chayleaf ];
    platforms = lib.platforms.linux;
  };
-}
+})
@@ -2,7 +2,6 @@
  lib,
  stdenv,
  fetchFromGitHub,
-  fetchurl,
  autoreconfHook,
  gettext,
  libev,
@@ -11,28 +10,18 @@
  udns,
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "sniproxy";
-  version = "0.6.1";
+  version = "0.7.0";

  src = fetchFromGitHub {
    owner = "dlundquist";
    repo = "sniproxy";
-    rev = version;
-    sha256 = "sha256-htM9CrzaGnn1dnsWQ+0V6N65Og7rsFob3BlSc4UGfFU=";
+    tag = finalAttrs.version;
+    hash = "sha256-TUXwixnBFdegYRzeXlLVno2M3gVXyCw5Jdfb9ulOROs=";
  };

-  patches = [
-    ./gettext-0.25.patch
-    (fetchurl {
-      name = "compat-pcre2.patch";
-      # Using Arch Linux patch because the following upstream patches do not apply cleanly:
-      # https://github.com/dlundquist/sniproxy/commit/62e621f050f79eb78598b1296a089ef88a19ea91
-      # https://github.com/dlundquist/sniproxy/commit/7fdd86c054a21f7ac62343010de20f28645b14d2
-      url = "https://gitlab.archlinux.org/archlinux/packaging/packages/sniproxy/-/raw/3272f9f0d406c51122f90708bfcc7b4ba0eb38c9/sniproxy-0.6.1-pcre2.patch?inline=false";
-      hash = "sha256-v6qdBAWXit0Zg43OsgzCTb4cSPm7gsEXVd7W8LvBgMk=";
-    })
-  ];
+  patches = [ ./gettext-0.25.patch ];

  nativeBuildInputs = [
    autoreconfHook
@@ -56,5 +45,4 @@ stdenv.mkDerivation rec {
    platforms = lib.platforms.linux;
    mainProgram = "sniproxy";
  };
-
-}
+})
@@ -3,19 +3,33 @@
  stdenv,
  fetchurl,
  steam-run,
-  bash,
  coreutils,
-  steamRoot ? "~/.local/share/Steam",
+  steamRoot ? "$HOME/.local/share/Steam",
 }:
-
+let
+  srcs =
+    let
+      url =
+        platform:
+        "https://web.archive.org/web/20240521141411/https://steamcdn-a.akamaihd.net/client/installer/steamcmd_${platform}.tar.gz";
+    in
+    {
+      x86_64-darwin = fetchurl {
+        url = url "osx";
+        hash = "sha256-jswXyJiOWsrcx45jHEhJD3YVDy36ps+Ne0tnsJe9dTs=";
+      };
+      x86_64-linux = fetchurl {
+        url = url "linux";
+        hash = "sha256-zr8ARr/QjPRdprwJSuR6o56/QVXl7eQTc7V5uPEHHnw=";
+      };
+    };
+in
 stdenv.mkDerivation {
  pname = "steamcmd";
  version = "20180104"; # According to steamcmd_linux.tar.gz mtime

-  src = fetchurl {
-    url = "https://web.archive.org/web/20240521141411/https://steamcdn-a.akamaihd.net/client/installer/steamcmd_linux.tar.gz";
-    hash = "sha256-zr8ARr/QjPRdprwJSuR6o56/QVXl7eQTc7V5uPEHHnw=";
-  };
+  src =
+    srcs.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");

  # The source tarball does not have a single top-level directory.
  preUnpack = ''
@@ -24,24 +38,18 @@ stdenv.mkDerivation {
    sourceRoot=.
  '';

-  buildInputs = [
-    bash
-    steam-run
-  ];
-
  dontBuild = true;

  installPhase = ''
-    mkdir -p $out/share/steamcmd/linux32
-    install -Dm755 steamcmd.sh $out/share/steamcmd/steamcmd.sh
-    install -Dm755 linux32/* $out/share/steamcmd/linux32
+    mkdir -p $out/share/steamcmd
+    find . -type f -exec install -Dm 755 "{}" "$out/share/steamcmd/{}" \;

    mkdir -p $out/bin
    substitute ${./steamcmd.sh} $out/bin/steamcmd \
      --subst-var out \
      --subst-var-by coreutils ${coreutils} \
-      --subst-var-by steamRoot "${steamRoot}" \
-      --subst-var-by steamRun ${steam-run}
+      --subst-var-by steamRoot '${steamRoot}' \
+      --subst-var-by steamRun ${if stdenv.hostPlatform.isLinux then (lib.getExe steam-run) else "exec"}
    chmod 0755 $out/bin/steamcmd
  '';

@@ -49,7 +57,10 @@ stdenv.mkDerivation {
    homepage = "https://developer.valvesoftware.com/wiki/SteamCMD";
    description = "Steam command-line tools";
    mainProgram = "steamcmd";
-    platforms = lib.platforms.linux;
+    platforms = [
+      "x86_64-linux"
+      "x86_64-darwin"
+    ];
    license = lib.licenses.unfreeRedistributable;
    maintainers = with lib.maintainers; [ tadfisher ];
  };
@@ -20,8 +20,8 @@ fi
 if [ ! -e "$STEAMROOT/steamcmd.sh" ]; then
  mkdir -p "$STEAMROOT/linux32"
  # steamcmd.sh will replace these on first use
-  cp @out@/share/steamcmd/steamcmd.sh "$STEAMROOT/."
-  cp @out@/share/steamcmd/linux32/* "$STEAMROOT/linux32/."
+  cd @out@/share/steamcmd
+  find . -type f -exec install -Dm 755 "{}" "$STEAMROOT/{}" \;
 fi

-@steamRun@/bin/steam-run "$STEAMROOT/steamcmd.sh" "$@"
+@steamRun@ "$STEAMROOT/steamcmd.sh" "$@"
@@ -115,7 +115,7 @@ python3.pkgs.buildPythonApplication {
  '';

  postInstall = ''
-    ln -s ${tribler-webui} $out/lib/python*/site-packages/tribler/ui
+    ln -s ${tribler-webui} $out/${python312.sitePackages}/tribler/ui
  '';

  preFixup = ''
@@ -1,20 +1,20 @@
 {
  "aarch64-darwin": {
-    "version": "1.12.39",
-    "vscodeVersion": "1.105.0",
-    "url": "https://windsurf-stable.codeiumdata.com/darwin-arm64/stable/10ebfa84f4e8b018ef2459063f0293b8e9ac01da/Windsurf-darwin-arm64-1.12.39.zip",
-    "sha256": "1f1af7d5dcaf1314f86a8082dcc28406bca86b92a29048ef296107cdea72a74e"
+    "version": "1.12.43",
+    "vscodeVersion": "1.106.0",
+    "url": "https://windsurf-stable.codeiumdata.com/darwin-arm64/stable/8b6a7c68fb76075b29a085605ef19c1d660a258e/Windsurf-darwin-arm64-1.12.43.zip",
+    "sha256": "17c080308b63ee72ba70655082f0a9e586755cc6616038b72d2b362450bc7cad"
  },
  "x86_64-darwin": {
-    "version": "1.12.39",
-    "vscodeVersion": "1.105.0",
-    "url": "https://windsurf-stable.codeiumdata.com/darwin-x64/stable/10ebfa84f4e8b018ef2459063f0293b8e9ac01da/Windsurf-darwin-x64-1.12.39.zip",
-    "sha256": "f422f2148be8e1d824abcd5ed18c86838d5edbb7f91244dcc51e142e9b5ac743"
+    "version": "1.12.43",
+    "vscodeVersion": "1.106.0",
+    "url": "https://windsurf-stable.codeiumdata.com/darwin-x64/stable/8b6a7c68fb76075b29a085605ef19c1d660a258e/Windsurf-darwin-x64-1.12.43.zip",
+    "sha256": "87d53b2dc977975a7876eaac3fe2306520e40ffb1e022dd11585ffedc68721c8"
  },
  "x86_64-linux": {
-    "version": "1.12.39",
-    "vscodeVersion": "1.105.0",
-    "url": "https://windsurf-stable.codeiumdata.com/linux-x64/stable/10ebfa84f4e8b018ef2459063f0293b8e9ac01da/Windsurf-linux-x64-1.12.39.tar.gz",
-    "sha256": "ce36ec8697ca7c9768678b99b9b8b364d33a044afed242931fea14f544581c68"
+    "version": "1.12.43",
+    "vscodeVersion": "1.106.0",
+    "url": "https://windsurf-stable.codeiumdata.com/linux-x64/stable/8b6a7c68fb76075b29a085605ef19c1d660a258e/Windsurf-linux-x64-1.12.43.tar.gz",
+    "sha256": "c7f3c83561e40c63b36eff39bcfe8591250e735da3ecc2b29c277b8e04856825"
  }
 }
@@ -15,7 +15,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "zenn-dev";
    repo = "zenn-editor";
    tag = finalAttrs.version;
-    hash = "sha256-H46wFDSxG5Fg9HuJOLulBXoXR+osf4gJEa+ZMUMWT5Q=";
+    hash = "sha256-wItKDLAJHIyxUUaLIFM+sNYWtXKWC4P6GkCKn2Wh2JA=";
  };

  nativeBuildInputs = [
@@ -34,7 +34,7 @@ stdenv.mkDerivation (finalAttrs: {
      pnpmWorkspaces
      ;
    fetcherVersion = 1;
-    hash = "sha256-QEOGL/FK0Vq8opPu7NeTTrk/rwWlMgisx+A7edMN9fw=";
+    hash = "sha256-WXsS5/J08n/dWV5MbyX4vK7j1mfiUoLdzwmzyqoX3FA=";
  };

  preBuild = ''
@@ -5,8 +5,10 @@
  gitUpdater,
  nixosTests,
  cmake,
+  ctestCheckHook,
  gettext,
  libapparmor,
+  libpsl,
  lomiri-action-api,
  lomiri-content-hub,
  lomiri-ui-extras,
@@ -29,13 +31,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "morph-browser";
-  version = "1.1.2";
+  version = "1.99.1";

  src = fetchFromGitLab {
    owner = "ubports";
    repo = "development/core/morph-browser";
    tag = finalAttrs.version;
-    hash = "sha256-CW+8HEGxeDDfqbBtNHDKTvsZkbu0tCmD6OEDW07KG2k=";
+    hash = "sha256-RCyauz7qBNzq7Aqr22NBSAgVSBsFpXpNb+aVo73CBQU=";
  };

  outputs = [
@@ -44,7 +46,10 @@ stdenv.mkDerivation (finalAttrs: {
  ];

  postPatch = ''
-    substituteInPlace src/{Morph,Ubuntu}/CMakeLists.txt \
+    substituteInPlace src/Morph/CMakeLists.txt \
+      --replace-fail '/usr/lib/''${CMAKE_LIBRARY_ARCHITECTURE}/qt''${QT_VERSION_MAJOR}/qml' "\''${CMAKE_INSTALL_PREFIX}/${qtbase.qtQmlPrefix}"
+
+    substituteInPlace src/Ubuntu/CMakeLists.txt \
      --replace-fail '/usr/lib/''${CMAKE_LIBRARY_ARCHITECTURE}/qt5/qml' "\''${CMAKE_INSTALL_PREFIX}/${qtbase.qtQmlPrefix}"

    substituteInPlace src/app/webbrowser/morph-browser.desktop.in.in \
@@ -52,11 +57,12 @@ stdenv.mkDerivation (finalAttrs: {
      --replace-fail 'X-Lomiri-Splash-Image=@CMAKE_INSTALL_FULL_DATADIR@/morph-browser/morph-browser-splash.svg' 'X-Lomiri-Splash-Image=lomiri-app-launch/splash/morph-browser.svg'

    substituteInPlace doc/CMakeLists.txt \
-      --replace-fail 'COMMAND ''${QDOC_EXECUTABLE} -qt5' 'COMMAND ''${QDOC_EXECUTABLE}'
+      --replace-fail 'COMMAND ''${QDOC_BIN} -qt5' 'COMMAND ''${QDOC_BIN}'
  ''
-  + lib.optionalString (!finalAttrs.finalPackage.doCheck) ''
+  # Being worked on upstream and temporarily disabled, but they still mostly work fine right now
+  + lib.optionalString (finalAttrs.finalPackage.doCheck) ''
    substituteInPlace CMakeLists.txt \
-      --replace-fail 'add_subdirectory(tests)' ""
+      --replace-fail '#add_subdirectory(tests)' 'add_subdirectory(tests)'
  '';

  strictDeps = true;
@@ -71,6 +77,7 @@ stdenv.mkDerivation (finalAttrs: {

  buildInputs = [
    libapparmor
+    libpsl
    qtbase
    qtdeclarative
    qtwebengine
@@ -86,27 +93,30 @@ stdenv.mkDerivation (finalAttrs: {
  ];

  nativeCheckInputs = [
+    ctestCheckHook
    mesa.llvmpipeHook # ShapeMaterial needs an OpenGL context: https://gitlab.com/ubports/development/core/lomiri-ui-toolkit/-/issues/35
    xvfb-run
  ];

  cmakeFlags = [
-    (lib.cmakeFeature "CMAKE_CTEST_ARGUMENTS" (
-      lib.concatStringsSep ";" [
-        # Exclude tests
-        "-E"
-        (lib.strings.escapeShellArg "(${
-          lib.concatStringsSep "|" [
-            # Don't care about linter failures
-            "^flake8"
-          ]
-        })")
-      ]
-    ))
+    (lib.cmakeBool "CLICK_MODE" false)
+    (lib.cmakeBool "ENABLE_QT6" (lib.strings.versionAtLeast qtbase.version "6"))
+    (lib.cmakeBool "WERROR" true)
  ];

  doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;

+  disabledTests = [
+    # Don't care about linter failures
+    "flake8"
+
+    # Temporarily broken while upstream is working on porting to Qt6
+    "tst_QmlTests"
+
+    # Flaky
+    "tst_HistoryModelTests"
+  ];
+
  preCheck = ''
    export HOME=$TMPDIR
    export QT_PLUGIN_PATH=${listToQtVar qtbase.qtPluginPrefix [ qtbase ]}
@@ -129,6 +139,17 @@ stdenv.mkDerivation (finalAttrs: {

    ln -s $out/share/{morph-browser,icons/hicolor/scalable/apps}/morph-browser.svg
    ln -s $out/share/{morph-browser/morph-browser-splash.svg,lomiri-app-launch/splash/morph-browser.svg}
+  ''
+  # This got broken when QML files got duplicated & split into Qt version-specific subdirs in source tree
+  # Symlinks get installed as-is, and they currently point relatively to the versioned subdirs
+  + ''
+    for link in $(find $out/${qtbase.qtQmlPrefix}/Ubuntu -type l); do
+      ln -vfs "$(readlink "$link" | sed -e 's|/qml-qt5||g')" "$link"
+    done
+  ''
+  # Link target for this one just doesn't get installed ever it seems, yeet it
+  + ''
+    rm -v $out/${qtbase.qtQmlPrefix}/Ubuntu/Web/handle@27.png
  '';

  passthru = {
@@ -45,13 +45,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "lomiri-ui-toolkit";
-  version = "1.3.5110";
+  version = "1.3.5901";

  src = fetchFromGitLab {
    owner = "ubports";
    repo = "development/core/lomiri-ui-toolkit";
    rev = finalAttrs.version;
-    hash = "sha256-j2Fowwj+ArdfJacqBSWksPk+wXRoTpL/Jrgme2tUSC8=";
+    hash = "sha256-adKCk8iYExKHTkWtzh6cF4AlIsbMoKg1SE7udhLo+ss=";
  };

  outputs = [
@@ -178,6 +178,8 @@ stdenv.mkDerivation (finalAttrs: {
    export QT_PLUGIN_PATH=${qtPluginPaths}
    export XDG_DATA_DIRS=${suru-icon-theme}/share

+    export UITK_BUILD_ROOT=$PWD
+
    tests/xvfb.sh make check ''${enableParallelChecking:+-j''${NIX_BUILD_CORES}}

    runHook postCheck
@@ -15,20 +15,21 @@
  pytest-django,
  responses,
  celery,
+  freezegun,
  pytestCheckHook,
  nixosTests,
 }:

 buildPythonPackage rec {
  pname = "django-lasuite";
-  version = "0.0.18";
+  version = "0.0.22";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "suitenumerique";
    repo = "django-lasuite";
    tag = "v${version}";
-    hash = "sha256-kXRaoVOyabGPCnO8uyWHbpE0zOIYZkHcqmWNSz0BHZY=";
+    hash = "sha256-T9FLxgWePifYIiD2Ivbfir2dlpUvZl2jj8y86VbxVDk=";
  };

  build-system = [ hatchling ];
@@ -44,15 +45,22 @@ buildPythonPackage rec {
    requests-toolbelt
  ];

+  optional-dependencies = lib.fix (self: {
+    all = with self; configuration ++ malware_detection;
+    configuration = [ django-configurations ];
+    malware_detection = [ celery ];
+  });
+
  pythonRelaxDeps = true;

  nativeCheckInputs = [
-    celery
+    factory-boy
+    freezegun
    pytestCheckHook
    pytest-django
-    factory-boy
    responses
-  ];
+  ]
+  ++ lib.concatAttrValues optional-dependencies;

  preCheck = ''
    export PYTHONPATH=tests:$PYTHONPATH
@@ -0,0 +1,67 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+
+  # build-system
+  setuptools,
+
+  # dependencies
+  onnx,
+  optimum,
+  transformers,
+
+  # optional-dependencies
+  onnxruntime,
+  # onnxruntime-gpu, unpackaged
+  ruff,
+}:
+
+buildPythonPackage rec {
+  pname = "optimum-onnx";
+  version = "0.0.2";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "huggingface";
+    repo = "optimum-onnx";
+    tag = "v${version}";
+    hash = "sha256-wT3yqS64LMuq76Yxs6V6nHfD8vgSfPoJm3hbW7E2zpk=";
+  };
+
+  build-system = [
+    setuptools
+  ];
+
+  pythonRelaxDeps = [
+    "transformers"
+  ];
+  dependencies = [
+    onnx
+    optimum
+    transformers
+  ];
+
+  optional-dependencies = {
+    onnxruntime = [
+      onnxruntime
+    ];
+    # onnxruntime-gpu = [ onnxruntime-gpu ];
+    quality = [
+      ruff
+    ];
+  };
+
+  pythonImportsCheck = [ "optimum.onnxruntime" ];
+
+  # Almost all tests need internet access
+  doCheck = false;
+
+  meta = {
+    description = "Export your model to ONNX and run inference with ONNX Runtime";
+    homepage = "https://github.com/huggingface/optimum-onnx";
+    changelog = "https://github.com/huggingface/optimum-onnx/releases/tag/${src.tag}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ GaetanLepage ];
+  };
+}
@@ -8,11 +8,7 @@
  setuptools,

  # dependencies
-  accelerate,
-  datasets,
  huggingface-hub,
-  optimum,
-  pillow,
  scikit-learn,
  scipy,
  torch,
@@ -20,6 +16,15 @@
  transformers,
  typing-extensions,

+  # optional-dependencies
+  # image
+  pillow,
+  # train
+  accelerate,
+  datasets,
+  # onnx
+  optimum-onnx,
+
  # tests
  pytestCheckHook,
  pytest-cov-stub,
@@ -27,21 +32,20 @@

 buildPythonPackage rec {
  pname = "sentence-transformers";
-  version = "5.1.2";
+  version = "5.2.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "huggingface";
    repo = "sentence-transformers";
    tag = "v${version}";
-    hash = "sha256-FNJ4mWBcgy3J8ZJtHt+uBgNmvMnqphj+sLMmBvgdB1k=";
+    hash = "sha256-WD5uTfAbDYYeSXlgznSs4XyN1fAILxILmmSHmLosmV4=";
  };

  build-system = [ setuptools ];

  dependencies = [
    huggingface-hub
-    pillow
    scikit-learn
    scipy
    torch
@@ -51,12 +55,15 @@ buildPythonPackage rec {
  ];

  optional-dependencies = {
+    image = [
+      pillow
+    ];
    train = [
      accelerate
      datasets
    ];
-    onnx = [ optimum ] ++ optimum.optional-dependencies.onnxruntime;
-    # onnx-gpu = [ optimum ] ++ optimum.optional-dependencies.onnxruntime-gpu;
+    onnx = [ optimum-onnx ] ++ optimum-onnx.optional-dependencies.onnxruntime;
+    # onnx-gpu = [ optimum-onnx ] ++ optimum-onnx.optional-dependencies.onnxruntime-gpu;
    # openvino = [ optimum-intel ] ++ optimum-intel.optional-dependencies.openvino;
  };

@@ -66,6 +66,9 @@ stdenv.mkDerivation rec {

      bundle exec rails assets:precompile

+      # Install packages for streaming server while remove others
+      rm -rf node_modules/*
+      yarn workspaces focus --production @mastodon/streaming
      rm -rf node_modules/.cache

      # Remove workspace "package" as it contains broken symlinks
@@ -1222,80 +1222,6 @@ self: with self; {
    })
  ) { };

-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  xf86videoglide = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      xorgproto,
-      xorgserver,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "xf86-video-glide";
-      version = "1.2.2";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/driver/xf86-video-glide-1.2.2.tar.bz2";
-        sha256 = "1vaav6kx4n00q4fawgqnjmbdkppl0dir2dkrj4ad372mxrvl9c4y";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [
-        xorgproto
-        xorgserver
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  xf86videoglint = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      libpciaccess,
-      xorgproto,
-      xorgserver,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "xf86-video-glint";
-      version = "1.2.9";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/driver/xf86-video-glint-1.2.9.tar.bz2";
-        sha256 = "1lkpspvrvrp9s539bhfdjfh4andaqyk63l6zjn8m3km95smk6a45";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [
-        libpciaccess
-        xorgproto
-        xorgserver
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
  # THIS IS A GENERATED FILE.  DO NOT EDIT!
  xf86videoi128 = callPackage (
    {
@@ -1520,42 +1446,6 @@ self: with self; {
    })
  ) { };

-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  xf86videonewport = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      xorgproto,
-      xorgserver,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "xf86-video-newport";
-      version = "0.2.4";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/driver/xf86-video-newport-0.2.4.tar.bz2";
-        sha256 = "1yafmp23jrfdmc094i6a4dsizapsc9v0pl65cpc8w1kvn7343k4i";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [
-        xorgproto
-        xorgserver
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
  # THIS IS A GENERATED FILE.  DO NOT EDIT!
  xf86videonouveau = callPackage (
    {
@@ -2146,44 +2036,6 @@ self: with self; {
    })
  ) { };

-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  xf86videotga = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      xorgproto,
-      libpciaccess,
-      xorgserver,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "xf86-video-tga";
-      version = "1.2.2";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/driver/xf86-video-tga-1.2.2.tar.bz2";
-        sha256 = "0cb161lvdgi6qnf1sfz722qn38q7kgakcvj7b45ba3i0020828r0";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [
-        xorgproto
-        libpciaccess
-        xorgserver
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
  # THIS IS A GENERATED FILE.  DO NOT EDIT!
  xf86videotrident = callPackage (
    {
@@ -2418,42 +2270,6 @@ self: with self; {
    })
  ) { };

-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  xf86videowsfb = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      xorgserver,
-      xorgproto,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "xf86-video-wsfb";
-      version = "0.4.0";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/driver/xf86-video-wsfb-0.4.0.tar.bz2";
-        sha256 = "0hr8397wpd0by1hc47fqqrnaw3qdqd8aqgwgzv38w5k3l3jy6p4p";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [
-        xorgserver
-        xorgproto
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
  # THIS IS A GENERATED FILE.  DO NOT EDIT!
  xfd = callPackage (
    {
@@ -221,55 +221,33 @@ self: super:
  xf86inputvoid = brokenOnDarwin super.xf86inputvoid; # never worked: https://hydra.nixos.org/job/nixpkgs/trunk/xorg.xf86inputvoid.x86_64-darwin
  xf86videodummy = brokenOnDarwin super.xf86videodummy; # never worked: https://hydra.nixos.org/job/nixpkgs/trunk/xorg.xf86videodummy.x86_64-darwin

-  # Obsolete drivers that don't compile anymore.
  xf86videoark = super.xf86videoark.overrideAttrs (attrs: {
    meta = attrs.meta // {
-      broken = true;
+      badPlatforms = lib.platforms.aarch64;
    };
  });
+
  xf86videogeode = super.xf86videogeode.overrideAttrs (attrs: {
    meta = attrs.meta // {
-      broken = true;
-    };
-  });
-  xf86videoglide = super.xf86videoglide.overrideAttrs (attrs: {
-    meta = attrs.meta // {
-      broken = true;
+      badPlatforms = lib.platforms.aarch64;
    };
  });
+
  xf86videoi128 = super.xf86videoi128.overrideAttrs (attrs: {
    meta = attrs.meta // {
-      broken = true;
-    };
-  });
-  xf86videonewport = super.xf86videonewport.overrideAttrs (attrs: {
-    meta = attrs.meta // {
-      broken = true;
+      badPlatforms = lib.platforms.aarch64;
    };
  });
+
  xf86videos3virge = super.xf86videos3virge.overrideAttrs (attrs: {
    meta = attrs.meta // {
-      broken = true;
-    };
-  });
-  xf86videotga = super.xf86videotga.overrideAttrs (attrs: {
-    meta = attrs.meta // {
-      broken = true;
+      badPlatforms = lib.platforms.aarch64;
    };
  });
+
  xf86videov4l = super.xf86videov4l.overrideAttrs (attrs: {
    meta = attrs.meta // {
-      broken = true;
-    };
-  });
-  xf86videovoodoo = super.xf86videovoodoo.overrideAttrs (attrs: {
-    meta = attrs.meta // {
-      broken = true;
-    };
-  });
-  xf86videowsfb = super.xf86videowsfb.overrideAttrs (attrs: {
-    meta = attrs.meta // {
-      broken = true;
+      platforms = lib.platforms.linux;
    };
  });

@@ -291,15 +269,6 @@ self: super:
    NIX_CFLAGS_COMPILE = "-Wno-error=implicit-function-declaration";
  });

-  xf86videoglint = super.xf86videoglint.overrideAttrs (attrs: {
-    nativeBuildInputs = attrs.nativeBuildInputs ++ [ autoreconfHook ];
-    buildInputs = attrs.buildInputs ++ [ xorg.utilmacros ];
-    # https://gitlab.freedesktop.org/xorg/driver/xf86-video-glint/-/issues/1
-    meta = attrs.meta // {
-      broken = true;
-    };
-  });
-
  xf86videosuncg6 = super.xf86videosuncg6.overrideAttrs (attrs: {
    meta = attrs.meta // {
      broken = isDarwin;
@@ -754,4 +723,12 @@ self: super:
 # deprecate some packages
 // lib.optionalAttrs config.allowAliases {
  fontbitstreamspeedo = throw "Bitstream Speedo is an obsolete font format that hasn't been supported by Xorg since 2005"; # added 2025-09-24
+  xf86videoglide = throw "The Xorg Glide video driver has been archived upstream due to being obsolete"; # added 2025-12-13
+  xf86videoglint = throw ''
+    The Xorg GLINT/Permedia video driver has been broken since xorg 21.
+    see https://gitlab.freedesktop.org/xorg/driver/xf86-video-glint/-/issues/1
+  ''; # added 2025-12-13
+  xf86videonewport = throw "The Xorg Newport video driver is broken and hasn't had a release since 2012"; # added 2025-12-13
+  xf86videotga = throw "The Xorg TGA (aka DEC 21030) video driver is broken and hasn't had a release since 2012"; # added 2025-12-13
+  xf86videowsfb = throw "The Xorg BSD wsdisplay framebuffer video driver is broken and hasn't had a release since 2012"; # added 2025-12-13
 }
@@ -31,14 +31,11 @@ mirror://xorg/individual/driver/xf86-video-cirrus-1.6.0.tar.xz
 mirror://xorg/individual/driver/xf86-video-dummy-0.4.1.tar.xz
 mirror://xorg/individual/driver/xf86-video-fbdev-0.5.1.tar.xz
 mirror://xorg/individual/driver/xf86-video-geode-2.18.1.tar.xz
-mirror://xorg/individual/driver/xf86-video-glide-1.2.2.tar.bz2
-mirror://xorg/individual/driver/xf86-video-glint-1.2.9.tar.bz2
 mirror://xorg/individual/driver/xf86-video-i128-1.4.1.tar.xz
 mirror://xorg/individual/driver/xf86-video-i740-1.4.0.tar.bz2
 mirror://xorg/individual/driver/xf86-video-intel-2.99.917.tar.bz2
 mirror://xorg/individual/driver/xf86-video-mga-2.1.0.tar.xz
 mirror://xorg/individual/driver/xf86-video-neomagic-1.3.1.tar.xz
-mirror://xorg/individual/driver/xf86-video-newport-0.2.4.tar.bz2
 https://gitlab.freedesktop.org/xorg/driver/xf86-video-nouveau/-/archive/3ee7cbca8f9144a3bb5be7f71ce70558f548d268/xf86-video-nouveau-3ee7cbca8f9144a3bb5be7f71ce70558f548d268.tar.bz2
 mirror://xorg/individual/driver/xf86-video-nv-2.1.23.tar.xz
 mirror://xorg/individual/driver/xf86-video-omap-0.4.5.tar.bz2
@@ -54,13 +51,11 @@ mirror://xorg/individual/driver/xf86-video-suncg6-1.1.3.tar.xz
 mirror://xorg/individual/driver/xf86-video-sunffb-1.2.3.tar.xz
 mirror://xorg/individual/driver/xf86-video-sunleo-1.2.3.tar.xz
 mirror://xorg/individual/driver/xf86-video-tdfx-1.5.0.tar.bz2
-mirror://xorg/individual/driver/xf86-video-tga-1.2.2.tar.bz2
 mirror://xorg/individual/driver/xf86-video-trident-1.4.0.tar.xz
 mirror://xorg/individual/driver/xf86-video-v4l-0.3.0.tar.bz2
 mirror://xorg/individual/driver/xf86-video-vboxvideo-1.0.1.tar.xz
 mirror://xorg/individual/driver/xf86-video-vesa-2.6.0.tar.xz
 mirror://xorg/individual/driver/xf86-video-vmware-13.4.0.tar.xz
 mirror://xorg/individual/driver/xf86-video-voodoo-1.2.6.tar.xz
-mirror://xorg/individual/driver/xf86-video-wsfb-0.4.0.tar.bz2
 mirror://xorg/individual/lib/libXTrap-1.0.1.tar.bz2
 mirror://xorg/individual/xserver/xorg-server-21.1.20.tar.xz
@@ -860,12 +860,23 @@ let
      # for a fixed-output derivation, the corresponding inputDerivation should
      # *not* be fixed-output. To achieve this we simply delete the attributes that
      # would make it fixed-output.
-      deleteFixedOutputRelatedAttrs = lib.flip removeAttrs [
+      fixedOutputRelatedAttrs = [
        "outputHashAlgo"
        "outputHash"
        "outputHashMode"
      ];

+      # inputDerivation produces the inputs; not the outputs, so any
+      # restrictions on what used to be the outputs don't serve a purpose
+      # anymore.
+      outputCheckAttrs = [
+        "allowedReferences"
+        "allowedRequisites"
+        "disallowedReferences"
+        "disallowedRequisites"
+        "outputChecks"
+      ];
+
    in

    extendDerivation validity.handled (
@@ -876,10 +887,10 @@ let
        # needed to enter a nix-shell with
        #   nix-build shell.nix -A inputDerivation
        inputDerivation = derivation (
-          deleteFixedOutputRelatedAttrs derivationArg
+          removeAttrs derivationArg (fixedOutputRelatedAttrs ++ outputCheckAttrs)
          // {
            # Add a name in case the original drv didn't have one
-            name = derivationArg.name or "inputDerivation";
+            name = "inputDerivation" + lib.optionalString (derivationArg ? name) "-${derivationArg.name}";
            # This always only has one output
            outputs = [ "out" ];

@@ -911,25 +922,6 @@ let
              ''
            ];
          }
-          // (
-            let
-              sharedOutputChecks = {
-                # inputDerivation produces the inputs; not the outputs, so any
-                # restrictions on what used to be the outputs don't serve a purpose
-                # anymore.
-                allowedReferences = null;
-                allowedRequisites = null;
-                disallowedReferences = [ ];
-                disallowedRequisites = [ ];
-              };
-            in
-            if __structuredAttrs then
-              {
-                outputChecks.out = sharedOutputChecks;
-              }
-            else
-              sharedOutputChecks
-          )
        );

        inherit passthru overrideAttrs;
@@ -216,6 +216,22 @@ let
        touch $out
      '';
    };
+
+  testInputDerivationDep = stdenv.mkDerivation {
+    name = "test-input-derivation-dependency";
+    buildCommand = "touch $out";
+  };
+  testInputDerivation =
+    attrs:
+    (stdenv.mkDerivation (
+      attrs
+      // {
+        buildInputs = [ testInputDerivationDep ];
+      }
+    )).inputDerivation
+    // {
+      meta = { };
+    };
 in

 {
@@ -356,6 +372,55 @@ in
        touch $out
      '';

+  test-inputDerivation-structured = testInputDerivation {
+    name = "test-inDrv-structured";
+    __structuredAttrs = true;
+  };
+
+  test-inputDerivation-allowedReferences = testInputDerivation {
+    name = "test-inDrv-allowedReferences";
+    allowedReferences = [ ];
+  };
+
+  test-inputDerivation-disallowedReferences = testInputDerivation {
+    name = "test-inDrv-disallowedReferences";
+    disallowedReferences = [ "${testInputDerivationDep}" ];
+  };
+
+  test-inputDerivation-allowedRequisites = testInputDerivation {
+    name = "test-inDrv-allowedRequisites";
+    allowedRequisites = [ ];
+  };
+
+  test-inputDerivation-disallowedRequisites = testInputDerivation {
+    name = "test-inDrv-disallowedRequisites";
+    disallowedRequisites = [ "${testInputDerivationDep}" ];
+  };
+
+  test-inputDerivation-structured-allowedReferences = testInputDerivation {
+    name = "test-inDrv-structured-allowedReferences";
+    __structuredAttrs = true;
+    outputChecks.out.allowedReferences = [ ];
+  };
+
+  test-inputDerivation-structured-disallowedReferences = testInputDerivation {
+    name = "test-inDrv-structured-disallowedReferences";
+    __structuredAttrs = true;
+    outputChecks.out.disallowedReferences = [ "${testInputDerivationDep}" ];
+  };
+
+  test-inputDerivation-structured-allowedRequisites = testInputDerivation {
+    name = "test-inDrv-structured-allowedRequisites";
+    __structuredAttrs = true;
+    outputChecks.out.allowedRequisites = [ ];
+  };
+
+  test-inputDerivation-structured-disallowedRequisites = testInputDerivation {
+    name = "test-inDrv-structured-disallowedRequisites";
+    __structuredAttrs = true;
+    outputChecks.out.disallowedRequisites = [ "${testInputDerivationDep}" ];
+  };
+
  test-prepend-append-to-var = testPrependAndAppendToVar {
    name = "test-prepend-append-to-var";
    stdenv' = bootStdenv;
@@ -3330,16 +3330,6 @@ with pkgs;

  marimo = with python3Packages; toPythonApplication marimo;

-  mecab =
-    let
-      mecab-nodic = callPackage ../tools/text/mecab/nodic.nix { };
-    in
-    callPackage ../tools/text/mecab {
-      mecab-ipadic = callPackage ../tools/text/mecab/ipadic.nix {
-        inherit mecab-nodic;
-      };
-    };
-
  mbutil = python310Packages.callPackage ../applications/misc/mbutil { };

  mcstatus = with python3Packages; toPythonApplication mcstatus;
@@ -11438,6 +11438,8 @@ self: super: with self; {

  optimum = callPackage ../development/python-modules/optimum { };

+  optimum-onnx = callPackage ../development/python-modules/optimum-onnx { };
+
  optree = callPackage ../development/python-modules/optree { };

  optuna = callPackage ../development/python-modules/optuna { };