Merge staging-next into staging

2025-10-12 18:05:53 +00:00
parent 13c9e5fb30 543be3b14a
commit 9d4602f5fe
100 changed files with 11577 additions and 299 deletions
@@ -21429,6 +21429,12 @@
    githubId = 14829269;
    name = "Ram Kromberg";
  };
+  ramonacat = {
+    email = "ramona@luczkiewi.cz";
+    github = "ramonacat";
+    githubId = 303398;
+    name = "ramona";
+  };
  rampoina = {
    email = "rampoina@protonmail.com";
    matrix = "@rampoina:matrix.org";
@@ -21482,12 +21488,6 @@
    githubId = 11351304;
    name = "Ricardo Ardissone";
  };
-  raroh73 = {
-    email = "me@raroh73.com";
-    github = "Raroh73";
-    githubId = 96078496;
-    name = "Raroh73";
-  };
  rasendubi = {
    email = "rasen.dubi@gmail.com";
    github = "rasendubi";
@@ -72,6 +72,8 @@

 - [boot.kernel.sysfs](options.html#opt-boot.kernel.sysfs) allows setting of sysfs attributes.

+- [local-content-share](https://github.com/Tanq16/local-content-share), a simple web-app for storing/sharing text snippets and files in your local network. Available as [services.local-content-share](#opt-services.local-content-share.enable).
+
 - Docker now defaults to 28.x, because version 27.x stopped receiving security updates and bug fixes after [May 2, 2025](https://github.com/moby/moby/pull/49910).

 - [Corteza](https://cortezaproject.org/), a low-code platform. Available as [services.corteza](#opt-services.corteza.enable).
@@ -132,6 +134,8 @@

 - [lemurs](https://github.com/coastalwhite/lemurs), a customizable TUI display/login manager. Available at [services.displayManager.lemurs](#opt-services.displayManager.lemurs.enable).

+- [docuseal](https://github.com/docusealco/docuseal), a DocuSign alternative. Create, fill, and sign digital documents. Available at [services.docuseal](#opt-services.docuseal.enable).
+
 - [paisa](https://github.com/ananthakumaran/paisa), a personal finance tracker and dashboard. Available as [services.paisa](#opt-services.paisa.enable).

 - [conman](https://github.com/dun/conman), a serial console management program. Available as [services.conman](#opt-services.conman.enable).
@@ -868,6 +868,7 @@
  ./services/misc/lifecycled.nix
  ./services/misc/litellm.nix
  ./services/misc/llama-cpp.nix
+  ./services/misc/local-content-share.nix
  ./services/misc/logkeys.nix
  ./services/misc/mame.nix
  ./services/misc/mbpfan.nix
@@ -1570,6 +1571,7 @@
  ./services/web-apps/dex.nix
  ./services/web-apps/discourse.nix
  ./services/web-apps/documize.nix
+  ./services/web-apps/docuseal.nix
  ./services/web-apps/dokuwiki.nix
  ./services/web-apps/dolibarr.nix
  ./services/web-apps/drupal.nix
@@ -156,7 +156,7 @@ let

        # Verify all the udev rules
        echo "Verifying udev rules using udevadm verify..."
-        udevadm verify --resolve-names=never --no-style $out
+        udevadm verify --resolve-names=late --no-style $out
        echo "OK"

        # If auto-configuration is disabled, then remove
@@ -0,0 +1,63 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+let
+  cfg = config.services.local-content-share;
+in
+{
+  options.services.local-content-share = {
+    enable = lib.mkEnableOption "Local-Content-Share";
+
+    package = lib.mkPackageOption pkgs "local-content-share" { };
+
+    listenAddress = lib.mkOption {
+      type = lib.types.str;
+      default = "";
+      example = "127.0.0.1";
+      description = ''
+        Address on which the service will be available.
+
+        The service will listen on all interfaces if set to an empty string.
+      '';
+    };
+
+    port = lib.mkOption {
+      type = lib.types.port;
+      default = 8080;
+      description = "Port on which the service will be available";
+    };
+
+    openFirewall = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = "Whether to automatically open the specified port in the firewall";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.services.local-content-share = {
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+
+      serviceConfig = {
+        Type = "simple";
+        DynamicUser = true;
+        User = "local-content-share";
+        StateDirectory = "local-content-share";
+        StateDirectoryMode = "0700";
+        WorkingDirectory = "/var/lib/local-content-share";
+        ExecStart = "${lib.getExe' cfg.package "local-content-share"} -listen=${cfg.listenAddress}:${toString cfg.port}";
+        Restart = "on-failure";
+      };
+    };
+
+    networking.firewall = lib.mkIf cfg.openFirewall {
+      allowedTCPPorts = [ cfg.port ];
+    };
+  };
+
+  meta.maintainers = with lib.maintainers; [ e-v-o-l-v-e ];
+}
@@ -0,0 +1,38 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+let
+  cfg = config.services.a2boot;
+in
+{
+  options.services.a2boot = {
+    enable = lib.mkEnableOption "the a2boot daemon";
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.services.netatalk.partOf = [ "a2boot.service" ];
+    systemd.services.a2boot = {
+      description = "a2boot daemon";
+      unitConfig.Documentation = "man:a2boot(8)";
+      after = [
+        "network.target"
+        "netatalk.service"
+      ];
+      wantedBy = [ "multi-user.target" ];
+
+      path = [ pkgs.netatalk ];
+
+      serviceConfig = {
+        Type = "forking";
+        DynamicUser = true;
+        RuntimeDirectory = "a2boot";
+        ExecStart = "${pkgs.netatalk}/bin/a2boot";
+        Restart = "always";
+      };
+    };
+  };
+  meta.maintainers = with lib.maintainers; [ matthewcroughan ];
+}
@@ -111,5 +111,5 @@ in
    };
  };

-  meta.maintainers = [ lib.maintainers.raroh73 ];
+  meta.maintainers = [ ];
 }
@@ -0,0 +1,196 @@
+{
+  lib,
+  pkgs,
+  config,
+  ...
+}:
+
+let
+  cfg = config.services.docuseal;
+
+  env = {
+    RAILS_ENV = "production";
+    NODE_ENV = "production";
+    WORKDIR = "/var/lib/docuseal";
+
+    PORT = toString (cfg.port);
+    HOST = cfg.host;
+
+    REDIS_URL = "redis://${cfg.redis.host}:${toString cfg.redis.port}";
+  }
+  // cfg.extraConfig;
+in
+{
+  options.services.docuseal = {
+    enable = lib.mkEnableOption "DocuSeal, open source document signing";
+
+    package = lib.mkPackageOption pkgs "docuseal" { };
+
+    secretKeyBaseFile = lib.mkOption {
+      description = ''
+        Path to file containing the secret key base.
+        A new secret key base can be generated by running:
+
+        `openssl rand -hex 64`
+
+        If this file does not exist, it will be created with a new secret key base.
+      '';
+      default = "/var/lib/docuseal/secrets/secret-key-base";
+      type = lib.types.path;
+    };
+
+    host = lib.mkOption {
+      description = "DocuSeal host.";
+      type = lib.types.str;
+      default = "127.0.0.1";
+    };
+
+    port = lib.mkOption {
+      description = "DocuSeal port.";
+      type = lib.types.port;
+      default = 3000;
+    };
+
+    extraConfig = lib.mkOption {
+      type = lib.types.attrs;
+      default = { };
+      description = ''
+        Extra environment variables to pass to DocuSeal services.
+      '';
+    };
+
+    extraEnvFiles = lib.mkOption {
+      type = with lib.types; listOf path;
+      default = [ ];
+      description = ''
+        Extra environment files to pass to DocuSeal services. Useful for passing down environmental secrets.
+        e.g. DATABASE_URL
+      '';
+      example = [ "/etc/docuseal/s3config.env" ];
+    };
+
+    redis = {
+      createLocally = lib.mkOption {
+        type = lib.types.bool;
+        default = true;
+        description = "Whether to create a local redis automatically.";
+      };
+
+      name = lib.mkOption {
+        type = lib.types.str;
+        default = "docuseal";
+        description = ''
+          Name of the redis server. Only used if `createLocally` is set to true.
+        '';
+      };
+
+      host = lib.mkOption {
+        type = lib.types.str;
+        default = "localhost";
+        description = ''
+          Redis server address.
+        '';
+      };
+
+      port = lib.mkOption {
+        type = lib.types.port;
+        default = 6379;
+        description = "Port of the redis server.";
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+
+    assertions = [
+      {
+        assertion = cfg.redis.createLocally -> cfg.redis.host == "localhost";
+        message = "the redis host must be localhost if services.docuseal.redis.createLocally is set to true";
+      }
+    ];
+
+    systemd.services.docuseal = {
+      description = "DocuSeal server";
+      wantedBy = [ "multi-user.target" ];
+      environment = env;
+      serviceConfig = {
+        Type = "simple";
+        ExecStartPre = pkgs.writeShellScript "docuseal-pre-script" ''
+          cat > /var/lib/docuseal/docuseal.env <<EOF
+          SECRET_KEY_BASE="$(cat ${cfg.secretKeyBaseFile})"
+          EOF
+        '';
+        ExecStart = "${cfg.package}/bin/rails server --pid=/var/lib/docuseal/docuseal.pids";
+        Restart = "always";
+        EnvironmentFile = [ "docuseal.env" ] ++ cfg.extraEnvFiles;
+        # Runtime directory and mode
+        RuntimeDirectory = "docuseal";
+        RuntimeDirectoryMode = "0750";
+        # System Call Filtering
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged"
+        ];
+        # User and group
+        DynamicUser = true;
+        # Working directory
+        WorkingDirectory = "/var/lib/docuseal";
+        # State directory and mode
+        StateDirectory = "docuseal";
+        StateDirectoryMode = "0750";
+        # Logs directory and mode
+        LogsDirectory = "docuseal";
+        LogsDirectoryMode = "0750";
+        # Proc filesystem
+        ProcSubset = "pid";
+        ProtectProc = "invisible";
+        # Access write directories
+        UMask = "0027";
+        # Capabilities
+        CapabilityBoundingSet = "";
+        # Security
+        NoNewPrivileges = true;
+        # Sandboxing
+        ProtectSystem = "strict";
+        ProtectHome = true;
+        PrivateTmp = true;
+        PrivateDevices = true;
+        PrivateUsers = (cfg.port >= 1024);
+        ProtectClock = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectControlGroups = true;
+        RestrictAddressFamilies = [
+          "AF_UNIX"
+          "AF_INET"
+          "AF_INET6"
+          "AF_NETLINK"
+        ];
+        RestrictNamespaces = true;
+        LockPersonality = true;
+        MemoryDenyWriteExecute = false;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        RemoveIPC = true;
+        PrivateMounts = true;
+        # System Call Filtering
+        SystemCallArchitectures = "native";
+      }
+      // lib.optionalAttrs (cfg.port < 1024) {
+        AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
+        CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
+      };
+    };
+
+    services.redis = lib.optionalAttrs cfg.redis.createLocally {
+      servers."${cfg.redis.name}" = {
+        enable = true;
+        port = cfg.redis.port;
+      };
+    };
+  };
+
+  meta.maintainers = with lib.maintainers; [ stunkymonkey ];
+}
@@ -24,7 +24,15 @@ in
    assertions = [
      {
        assertion = config.boot.initrd.systemd.enable;
-        message = "nixos-init can only be used with systemd initrd";
+        message = "nixos-init can only be used with boot.initrd.systemd.enable";
+      }
+      {
+        assertion = config.system.etc.overlay.enable;
+        message = "nixos-init can only be used with system.etc.overlay.enable";
+      }
+      {
+        assertion = config.services.userborn.enable || config.systemd.sysusers.enable;
+        message = "nixos-init can only be used with services.userborn.enable or systemd.sysusers.enable";
      }
    ];
  };
@@ -83,19 +83,17 @@ let
      '';

      copyExtraFiles = pkgs.writeShellScript "copy-extra-files" ''
-        empty_file=$(${pkgs.coreutils}/bin/mktemp)
-
        ${concatStrings (
          mapAttrsToList (n: v: ''
            ${pkgs.coreutils}/bin/install -Dp "${v}" "${bootMountPoint}/"${escapeShellArg n}
-            ${pkgs.coreutils}/bin/install -D $empty_file "${bootMountPoint}/${nixosDir}/.extra-files/"${escapeShellArg n}
+            ${pkgs.coreutils}/bin/install -D /dev/null "${bootMountPoint}/${nixosDir}/.extra-files/"${escapeShellArg n}
          '') cfg.extraFiles
        )}

        ${concatStrings (
          mapAttrsToList (n: v: ''
            ${pkgs.coreutils}/bin/install -Dp "${pkgs.writeText n v}" "${bootMountPoint}/loader/entries/"${escapeShellArg n}
-            ${pkgs.coreutils}/bin/install -D $empty_file "${bootMountPoint}/${nixosDir}/.extra-files/loader/entries/"${escapeShellArg n}
+            ${pkgs.coreutils}/bin/install -D /dev/null "${bootMountPoint}/${nixosDir}/.extra-files/loader/entries/"${escapeShellArg n}
          '') cfg.extraEntries
        )}
      '';
@@ -8,11 +8,9 @@
  nodes.machine =
    { modulesPath, ... }:
    {
-      imports = [
-        "${modulesPath}/profiles/perlless.nix"
-      ];
-      virtualisation.mountHostNixStore = false;
-      virtualisation.useNixStoreImage = true;
+      boot.initrd.systemd.enable = true;
+      system.etc.overlay.enable = true;
+      services.userborn.enable = true;

      system.nixos-init.enable = true;
      # Forcibly set this to only these specific values.
@@ -468,6 +468,8 @@ in
  docling-serve = runTest ./docling-serve.nix;
  documentation = pkgs.callPackage ../modules/misc/documentation/test.nix { inherit nixosLib; };
  documize = runTest ./documize.nix;
+  docuseal-psql = runTest ./docuseal-postgres.nix;
+  docuseal-sqlite = runTest ./docuseal-sqlite.nix;
  doh-proxy-rust = runTest ./doh-proxy-rust.nix;
  dokuwiki = runTest ./dokuwiki.nix;
  dolibarr = runTest ./dolibarr.nix;
@@ -843,6 +845,7 @@ in
  lk-jwt-service = runTest ./matrix/lk-jwt-service.nix;
  llama-swap = runTest ./web-servers/llama-swap.nix;
  lldap = runTest ./lldap.nix;
+  local-content-share = runTest ./local-content-share.nix;
  localsend = runTest ./localsend.nix;
  locate = runTest ./locate.nix;
  login = runTest ./login.nix;
@@ -15,5 +15,5 @@
    server.succeed("curl --fail --silent http://localhost:8082")
  '';

-  meta.maintainers = [ lib.maintainers.raroh73 ];
+  meta.maintainers = [ ];
 }
@@ -0,0 +1,46 @@
+{ lib, ... }:
+{
+  name = "docuseal";
+  meta.maintainers = with lib.maintainers; [
+    etu
+    stunkymonkey
+  ];
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      services.docuseal = {
+        enable = true;
+        port = 80;
+        secretKeyBaseFile = pkgs.writeText "secret" "23bec595a1658d136d532af1365b40024b662c0862e9cdf14fd22c0afaeb0dd6322b114fa35bd82e564bae44a896b5abef3a66afd61e1382b8ebd579e2c5c17f";
+        extraConfig.DATABASEURL = "postgresql://docuseal:db-secret@127.0.0.1:5432/docuseal";
+      };
+      services.postgresql = {
+        package = pkgs.postgresql;
+        enable = true;
+        ensureDatabases = [ "docuseal" ];
+        ensureUsers = [
+          {
+            name = "docuseal";
+            ensureDBOwnership = true;
+          }
+        ];
+        initialScript = pkgs.writeText "postgresql-password" ''
+          CREATE ROLE docuseal WITH LOGIN PASSWORD 'db-secret' CREATEDB;
+        '';
+      };
+
+      systemd.services."docuseal-config" = {
+        requires = [ "postgresql.service" ];
+        after = [ "postgresql.service" ];
+      };
+    };
+
+  testScript = ''
+    machine.wait_for_unit("multi-user.target")
+    machine.wait_for_unit("docuseal.service")
+    machine.wait_for_open_port(80)
+    response = machine.succeed("curl -vvv -s -H 'Host: docuseal' http://127.0.0.1:80/setup")
+    assert "<title>\n  DocuSeal | Open Source Document Signing\n</title>" in response, "page didn't load successfully"
+  '';
+}
@@ -0,0 +1,26 @@
+{ lib, ... }:
+{
+  name = "docuseal";
+  meta.maintainers = with lib.maintainers; [
+    etu
+    stunkymonkey
+  ];
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      services.docuseal = {
+        enable = true;
+        port = 80;
+        secretKeyBaseFile = pkgs.writeText "secret" "23bec595a1658d136d532af1365b40024b662c0862e9cdf14fd22c0afaeb0dd6322b114fa35bd82e564bae44a896b5abef3a66afd61e1382b8ebd579e2c5c17f";
+      };
+    };
+
+  testScript = ''
+    machine.wait_for_unit("multi-user.target")
+    machine.wait_for_unit("docuseal.service")
+    machine.wait_for_open_port(80)
+    response = machine.succeed("curl -vvv -s -H 'Host: docuseal' http://127.0.0.1:80/setup")
+    assert "<title>\n  DocuSeal | Open Source Document Signing\n</title>" in response, "page didn't load successfully"
+  '';
+}
@@ -0,0 +1,25 @@
+{ pkgs, lib, ... }:
+{
+  name = "local-content-share";
+  meta.maintainers = pkgs.local-content-share.meta.maintainers;
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      services.local-content-share = {
+        enable = true;
+        port = 8081;
+      };
+    };
+
+  testScript =
+    { nodes, ... }:
+    let
+      cfg = nodes.machine.services.local-content-share;
+    in
+    ''
+      machine.wait_for_unit("local-content-share.service")
+      machine.wait_for_open_port(${toString cfg.port})
+      machine.wait_until_succeeds("curl -sS -f http://127.0.0.1:${toString cfg.port}/", timeout=300)
+    '';
+}
@@ -41,10 +41,7 @@ vscode-utils.buildVscodeMarketplaceExtension {
    downloadPage = "https://marketplace.visualstudio.com/items?itemName=Continue.continue";
    homepage = "https://github.com/continuedev/continue";
    license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [
-      raroh73
-      flacks
-    ];
+    maintainers = with lib.maintainers; [ flacks ];
    platforms = [
      "x86_64-linux"
      "x86_64-darwin"
@@ -3871,7 +3871,7 @@ let
          downloadPage = "https://marketplace.visualstudio.com/items?itemName=redhat.vscode-yaml";
          homepage = "https://github.com/redhat-developer/vscode-yaml";
          license = lib.licenses.mit;
-          maintainers = [ lib.maintainers.raroh73 ];
+          maintainers = [ ];
        };
      };

@@ -5386,7 +5386,7 @@ let
          downloadPage = "https://marketplace.visualstudio.com/items?itemName=yzhang.markdown-all-in-one";
          homepage = "https://github.com/yzhang-gh/vscode-markdown";
          license = lib.licenses.mit;
-          maintainers = [ lib.maintainers.raroh73 ];
+          maintainers = [ ];
        };
      };

@@ -26,6 +26,6 @@ vscode-utils.buildVscodeMarketplaceExtension {
    downloadPage = "https://marketplace.visualstudio.com/items?itemName=timonwong.shellcheck";
    homepage = "https://github.com/vscode-shellcheck/vscode-shellcheck";
    license = lib.licenses.mit;
-    maintainers = [ lib.maintainers.raroh73 ];
+    maintainers = [ ];
  };
 }
@@ -102,7 +102,7 @@ buildFHSEnv {
      gettext
      portaudio
      miniupnpc
-      mbedtls_2
+      mbedtls
      lzo
      sfml
      gsm
@@ -7,14 +7,14 @@

 python3Packages.buildPythonApplication rec {
  pname = "rmview";
-  version = "3.1.3";
+  version = "3.1.4";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "bordaigorl";
    repo = "rmview";
    tag = "v${version}";
-    sha256 = "sha256-V26zmu8cQkLs0IMR7eFO8x34McnT3xYyzlZfntApYkk=";
+    sha256 = "sha256-yae86PR/TZKApqrMP7MdS8941J9wqlKzkOnFyIhUk4o=";
  };

  nativeBuildInputs = with python3Packages; [
@@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "helm-diff";
-  version = "3.13.0";
+  version = "3.13.1";

  src = fetchFromGitHub {
    owner = "databus23";
    repo = "helm-diff";
    rev = "v${version}";
-    hash = "sha256-U1lNCOYix+7aPNq4U0A7KU4Cr+AqQsTUrYTg/0Zg5cs=";
+    hash = "sha256-7LkXoPhLqZtc1jy8JOkZrHWSIqB2oZLHsEyeNk3vl60=";
  };

-  vendorHash = "sha256-nwL6n0pthW12ij9iqmS404r0m9xv0qh8RYiQhqvJC2U=";
+  vendorHash = "sha256-QSbml6M+ftQy4n+ybYWf2gCsbVmrnhX09w3ffW/JgUM=";

  ldflags = [
    "-s"
@@ -507,11 +507,11 @@
    "vendorHash": "sha256-29uvPCepGHRPohGY7viaPD9VQPPj9XB/plragACC4e4="
  },
  "google": {
-    "hash": "sha256-463G4/NtViaBH1B1XVzHT6KVQu+4HnqGWX7hw4CjgNA=",
+    "hash": "sha256-lJ5XBL983pKdZdN8scof+uJ16CJAOXp1NIxWmJCa4O0=",
    "homepage": "https://registry.terraform.io/providers/hashicorp/google",
    "owner": "hashicorp",
    "repo": "terraform-provider-google",
-    "rev": "v7.5.0",
+    "rev": "v7.6.0",
    "spdx": "MPL-2.0",
    "vendorHash": "sha256-cQybnUaDLVmQrtFkiI5k3OwqN9Oks+J1H2kbkNjO4jc="
  },
@@ -1209,13 +1209,13 @@
    "vendorHash": "sha256-skswuFKhN4FFpIunbom9rM/FVRJVOFb1WwHeAIaEjn8="
  },
  "sops": {
-    "hash": "sha256-SBg46q9kggwXR142MpzwM5R4L2WfM07aJkGSLngAcFk=",
+    "hash": "sha256-0dYL/4R3nb9pjAjooilRNEgUmDwxCNLUwxdsMyHfTgc=",
    "homepage": "https://registry.terraform.io/providers/carlpett/sops",
    "owner": "carlpett",
    "repo": "terraform-provider-sops",
-    "rev": "v1.2.1",
+    "rev": "v1.3.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-4gtM8U//RXpYc4klCgpZS/3ZRzAHfcbOPTnNqlX4H7M="
+    "vendorHash": "sha256-iEQdSvQOCwvxhqh+veQ59uDVoXjCxsysxzkF4DHAf1E="
  },
  "spacelift": {
    "hash": "sha256-pYe8xmqudCkRvXNHJ4bSm9uitcDfpRlaGij7CrjQjd8=",
@@ -14,13 +14,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "${lib.optionalString enablePython "py"}abpoa";
-  version = "1.5.4";
+  version = "1.5.5";

  src = fetchFromGitHub {
    owner = "yangao07";
    repo = "abPOA";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-E6XdiRULgJy9rf4NfXGBqUC+m0pMZKMsA5pHvCNNLJk=";
+    hash = "sha256-engVVKYES8mAZMRNmBOs2BZ83xTcQGGQSdIuYJe14LY=";
  };

  patches = [ ./simd-arch.patch ];
@@ -7,13 +7,13 @@
 }:
 buildGoModule rec {
  pname = "beszel";
-  version = "0.12.3";
+  version = "0.13.2";

  src = fetchFromGitHub {
    owner = "henrygd";
    repo = "beszel";
    tag = "v${version}";
-    hash = "sha256-rthaufUL0JX3sE2hdrcJ8J73DLK4/2wMR+uOs8GoX2A=";
+    hash = "sha256-5akfgX3533NkeszP/by9ZfwTmMPdG5/JKFjswP1FRp8=";
  };

  webui = buildNpmPackage {
@@ -45,18 +45,16 @@ buildGoModule rec {
      runHook postInstall
    '';

-    sourceRoot = "${src.name}/beszel/site";
+    sourceRoot = "${src.name}/internal/site";

-    npmDepsHash = "sha256-6J1LwRzwbQyXVBHNgG7k8CQ67JZIDqYreDbgfm6B4w4=";
+    npmDepsHash = "sha256-7+3K8MhA+FXWRXQR5edUYbL/XcxPmUqWQPxl5k8u1xs=";
  };

-  sourceRoot = "${src.name}/beszel";
-
-  vendorHash = "sha256-Nd2jDlq+tdGrgxU6ZNgj9awAb+G/yDqY1J15dpMcjtw=";
+  vendorHash = "sha256-IfwgL4Ms5Uho1l0yGCyumbr1N/SN+j5HaFl4hACkTsQ=";

  preBuild = ''
-    mkdir -p site/dist
-    cp -r ${webui}/* site/dist
+    mkdir -p internal/site/dist
+    cp -r ${webui}/* internal/site/dist
  '';

  postInstall = ''
@@ -64,7 +62,12 @@ buildGoModule rec {
    mv $out/bin/hub $out/bin/beszel-hub
  '';

-  passthru.updateScript = nix-update-script { };
+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--subpackage"
+      "webui"
+    ];
+  };

  meta = {
    homepage = "https://github.com/henrygd/beszel";
@@ -7,20 +7,20 @@

 buildGoModule rec {
  pname = "blocky";
-  version = "0.26.2";
+  version = "0.27.0";

  src = fetchFromGitHub {
    owner = "0xERR0R";
    repo = "blocky";
    rev = "v${version}";
-    hash = "sha256-yo21f12BLINXb8HWdR3ZweV5+cTZN07kxCxO1FMJq/4=";
+    hash = "sha256-N0zQb30PHTbTsQQgljuIW/We1i9ITLFdonOX4L+vk+o=";
  };

  # needs network connection and fails at
  # https://github.com/0xERR0R/blocky/blob/development/resolver/upstream_resolver_test.go
  doCheck = false;

-  vendorHash = "sha256-cIDKUzOAs6XsyuUbnR2MRIeH3LI4QuohUZovh/DVJzA=";
+  vendorHash = "sha256-YwwqGLfMnlQGRkTPfSmRnzUzu8+O5JzOPev6aSxBXbQ=";

  ldflags = [
    "-s"
@@ -7,12 +7,12 @@

 let
  pname = "cables";
-  version = "0.7.1";
+  version = "0.7.2";
  name = "${pname}-${version}";

  src = fetchurl {
    url = "https://github.com/cables-gl/cables_electron/releases/download/v${version}/cables-${version}-linux-x64.AppImage";
-    sha256 = "sha256-CsKwb9anK7yHM+1mf9tPyjQ1GLYiUkrO7oP+GxFTqx0=";
+    sha256 = "sha256-IvJAMNn5srlMZqVE8rGtOewTDLkmUkuPQoECMijkdI8=";
  };

  appimageContents = appimageTools.extract {
@@ -11,14 +11,14 @@

 python3Packages.buildPythonApplication {
  pname = "chirp";
-  version = "0.4.0-unstable-2025-10-02";
+  version = "0.4.0-unstable-2025-10-09";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "kk7ds";
    repo = "chirp";
-    rev = "bf848935eef3a739948a4a6c3ef8b5a31807481e";
-    hash = "sha256-8hQmH62yplZ5xao7nVwRdmyPQj3x5eitSBmFJYU3mb4=";
+    rev = "abd542d16e7351ae7fff3c56b40172315dcf690c";
+    hash = "sha256-ncO+/M4ZU0yZOd2DeL9ZCmZS+FhrByeiOtlY/By7bmQ=";
  };

  nativeBuildInputs = [
@@ -7,17 +7,17 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "codebook";
-  version = "0.3.11";
+  version = "0.3.13";

  src = fetchFromGitHub {
    owner = "blopker";
    repo = "codebook";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-4jK5wmYnkQ0WDSSBmWL155fqFwG3SQENWvQuKdsfHF0=";
+    hash = "sha256-46RSHbr9vVyVYXAV/+A6PSz2qokDwQjY51jnIQ11Dls=";
  };

  buildAndTestSubdir = "crates/codebook-lsp";
-  cargoHash = "sha256-FV7Ux+UuM57McQLqKYjgSvCbPCnM7ZOzX/jFEmtOz2o=";
+  cargoHash = "sha256-/7ci8of8KfD7ne3XjXA+tVq1x3HmQWKWh1wO4zA0Elg=";

  # Integration tests require internet access for dictionaries
  doCheck = false;
@@ -101,6 +101,6 @@ maven.buildMavenPackage {
    homepage = "https://github.com/Athou/commafeed";
    license = lib.licenses.asl20;
    mainProgram = "commafeed";
-    maintainers = [ lib.maintainers.raroh73 ];
+    maintainers = [ ];
  };
 }
@@ -6,13 +6,13 @@

 buildGoModule rec {
  pname = "do-agent";
-  version = "3.18.3";
+  version = "3.18.4";

  src = fetchFromGitHub {
    owner = "digitalocean";
    repo = "do-agent";
    rev = version;
-    sha256 = "sha256-YYckleFnWt7Wttmkb20g5fs9DOoL9VNDmOWdP3qNstU=";
+    sha256 = "sha256-Pn53zNp3D0NcEQqfiv4ZceLT2Pgvz7oZYZAhk2D1SCc=";
  };

  ldflags = [
@@ -0,0 +1,77 @@
+# frozen_string_literal: true
+
+source 'https://rubygems.org'
+
+
+gem 'arabic-letter-connector', require: 'arabic-letter-connector/logic'
+gem 'aws-sdk-s3', require: false
+gem 'aws-sdk-secretsmanager', require: false
+gem 'azure-storage-blob', require: false
+gem 'bootsnap', require: false
+gem 'cancancan'
+gem 'csv'
+gem 'csv-safe'
+gem 'devise'
+gem 'devise-two-factor'
+gem 'dotenv', require: false
+gem 'email_typo'
+gem 'faraday'
+gem 'faraday-follow_redirects'
+gem 'google-cloud-storage', require: false
+gem 'hexapdf'
+gem 'image_processing'
+gem 'jwt'
+gem 'lograge'
+gem 'mysql2', require: false
+gem 'oj'
+gem 'pagy'
+gem 'pg', require: false
+gem 'premailer-rails'
+gem 'pretender'
+gem 'puma', require: false
+gem 'rack'
+gem 'rails'
+gem 'rails_autolink'
+gem 'rails-i18n'
+gem 'rotp'
+gem 'rouge', require: false
+gem 'rqrcode'
+gem 'ruby-vips'
+gem 'rubyXL'
+gem 'shakapacker'
+gem 'sidekiq'
+gem 'sqlite3', require: false
+gem 'strip_attributes'
+gem 'turbo-rails'
+gem 'twitter_cldr', require: false
+gem 'tzinfo-data'
+
+group :development, :test do
+  gem 'better_html'
+  gem 'bullet'
+  gem 'debug'
+  gem 'erb_lint', require: false
+  gem 'factory_bot_rails'
+  gem 'faker'
+  gem 'pry-rails'
+  gem 'rspec-rails'
+  gem 'rubocop', require: false
+  gem 'rubocop-performance', require: false
+  gem 'rubocop-rails', require: false
+  gem 'rubocop-rspec', require: false
+  gem 'simplecov', require: false
+end
+
+group :development do
+  gem 'annotaterb'
+  gem 'brakeman', require: false
+  gem 'foreman', require: false
+  gem 'letter_opener_web'
+  gem 'web-console'
+end
+
+group :test do
+  gem 'capybara'
+  gem 'cuprite'
+  gem 'webmock'
+end
@@ -0,0 +1,660 @@
+GEM
+  remote: https://rubygems.org/
+  specs:
+    actioncable (8.0.2.1)
+      actionpack (= 8.0.2.1)
+      activesupport (= 8.0.2.1)
+      nio4r (~> 2.0)
+      websocket-driver (>= 0.6.1)
+      zeitwerk (~> 2.6)
+    actionmailbox (8.0.2.1)
+      actionpack (= 8.0.2.1)
+      activejob (= 8.0.2.1)
+      activerecord (= 8.0.2.1)
+      activestorage (= 8.0.2.1)
+      activesupport (= 8.0.2.1)
+      mail (>= 2.8.0)
+    actionmailer (8.0.2.1)
+      actionpack (= 8.0.2.1)
+      actionview (= 8.0.2.1)
+      activejob (= 8.0.2.1)
+      activesupport (= 8.0.2.1)
+      mail (>= 2.8.0)
+      rails-dom-testing (~> 2.2)
+    actionpack (8.0.2.1)
+      actionview (= 8.0.2.1)
+      activesupport (= 8.0.2.1)
+      nokogiri (>= 1.8.5)
+      rack (>= 2.2.4)
+      rack-session (>= 1.0.1)
+      rack-test (>= 0.6.3)
+      rails-dom-testing (~> 2.2)
+      rails-html-sanitizer (~> 1.6)
+      useragent (~> 0.16)
+    actiontext (8.0.2.1)
+      actionpack (= 8.0.2.1)
+      activerecord (= 8.0.2.1)
+      activestorage (= 8.0.2.1)
+      activesupport (= 8.0.2.1)
+      globalid (>= 0.6.0)
+      nokogiri (>= 1.8.5)
+    actionview (8.0.2.1)
+      activesupport (= 8.0.2.1)
+      builder (~> 3.1)
+      erubi (~> 1.11)
+      rails-dom-testing (~> 2.2)
+      rails-html-sanitizer (~> 1.6)
+    activejob (8.0.2.1)
+      activesupport (= 8.0.2.1)
+      globalid (>= 0.3.6)
+    activemodel (8.0.2.1)
+      activesupport (= 8.0.2.1)
+    activerecord (8.0.2.1)
+      activemodel (= 8.0.2.1)
+      activesupport (= 8.0.2.1)
+      timeout (>= 0.4.0)
+    activestorage (8.0.2.1)
+      actionpack (= 8.0.2.1)
+      activejob (= 8.0.2.1)
+      activerecord (= 8.0.2.1)
+      activesupport (= 8.0.2.1)
+      marcel (~> 1.0)
+    activesupport (8.0.2.1)
+      base64
+      benchmark (>= 0.3)
+      bigdecimal
+      concurrent-ruby (~> 1.0, >= 1.3.1)
+      connection_pool (>= 2.2.5)
+      drb
+      i18n (>= 1.6, < 2)
+      logger (>= 1.4.2)
+      minitest (>= 5.1)
+      securerandom (>= 0.3)
+      tzinfo (~> 2.0, >= 2.0.5)
+      uri (>= 0.13.1)
+    addressable (2.8.7)
+      public_suffix (>= 2.0.2, < 7.0)
+    annotaterb (4.14.0)
+    arabic-letter-connector (0.1.1)
+    ast (2.4.2)
+    aws-eventstream (1.3.0)
+    aws-partitions (1.1027.0)
+    aws-sdk-core (3.214.0)
+      aws-eventstream (~> 1, >= 1.3.0)
+      aws-partitions (~> 1, >= 1.992.0)
+      aws-sigv4 (~> 1.9)
+      jmespath (~> 1, >= 1.6.1)
+    aws-sdk-kms (1.96.0)
+      aws-sdk-core (~> 3, >= 3.210.0)
+      aws-sigv4 (~> 1.5)
+    aws-sdk-s3 (1.176.1)
+      aws-sdk-core (~> 3, >= 3.210.0)
+      aws-sdk-kms (~> 1)
+      aws-sigv4 (~> 1.5)
+    aws-sdk-secretsmanager (1.110.0)
+      aws-sdk-core (~> 3, >= 3.210.0)
+      aws-sigv4 (~> 1.5)
+    aws-sigv4 (1.10.1)
+      aws-eventstream (~> 1, >= 1.0.2)
+    azure-storage-blob (2.0.3)
+      azure-storage-common (~> 2.0)
+      nokogiri (~> 1, >= 1.10.8)
+    azure-storage-common (2.0.4)
+      faraday (~> 1.0)
+      faraday_middleware (~> 1.0, >= 1.0.0.rc1)
+      net-http-persistent (~> 4.0)
+      nokogiri (~> 1, >= 1.10.8)
+    base64 (0.3.0)
+    bcrypt (3.1.20)
+    benchmark (0.4.1)
+    better_html (2.1.1)
+      actionview (>= 6.0)
+      activesupport (>= 6.0)
+      ast (~> 2.0)
+      erubi (~> 1.4)
+      parser (>= 2.4)
+      smart_properties
+    bigdecimal (3.2.2)
+    bindex (0.8.1)
+    bootsnap (1.18.4)
+      msgpack (~> 1.2)
+    brakeman (7.0.0)
+      racc
+    builder (3.3.0)
+    bullet (8.0.0)
+      activesupport (>= 3.0.0)
+      uniform_notifier (~> 1.11)
+    camertron-eprun (1.1.1)
+    cancancan (3.6.1)
+    capybara (3.40.0)
+      addressable
+      matrix
+      mini_mime (>= 0.1.3)
+      nokogiri (~> 1.11)
+      rack (>= 1.6.0)
+      rack-test (>= 0.6.3)
+      regexp_parser (>= 1.5, < 3.0)
+      xpath (~> 3.2)
+    childprocess (5.1.0)
+      logger (~> 1.5)
+    chunky_png (1.4.0)
+    cldr-plurals-runtime-rb (1.1.0)
+    cmdparse (3.0.7)
+    coderay (1.1.3)
+    concurrent-ruby (1.3.5)
+    connection_pool (2.5.3)
+    crack (1.0.0)
+      bigdecimal
+      rexml
+    crass (1.0.6)
+    css_parser (1.21.0)
+      addressable
+    csv (3.3.2)
+    csv-safe (3.3.1)
+      csv (~> 3.0)
+    cuprite (0.15.1)
+      capybara (~> 3.0)
+      ferrum (~> 0.15.0)
+    date (3.4.1)
+    debug (1.10.0)
+      irb (~> 1.10)
+      reline (>= 0.3.8)
+    declarative (0.0.20)
+    devise (4.9.4)
+      bcrypt (~> 3.0)
+      orm_adapter (~> 0.1)
+      railties (>= 4.1.0)
+      responders
+      warden (~> 1.2.3)
+    devise-two-factor (6.1.0)
+      activesupport (>= 7.0, < 8.1)
+      devise (~> 4.0)
+      railties (>= 7.0, < 8.1)
+      rotp (~> 6.0)
+    diff-lcs (1.5.1)
+    digest-crc (0.6.5)
+      rake (>= 12.0.0, < 14.0.0)
+    docile (1.4.1)
+    dotenv (3.1.7)
+    drb (2.2.3)
+    email_typo (0.2.3)
+    erb (5.0.2)
+    erb_lint (0.7.0)
+      activesupport
+      better_html (>= 2.0.1)
+      parser (>= 2.7.1.4)
+      rainbow
+      rubocop (>= 1)
+      smart_properties
+    erubi (1.13.1)
+    factory_bot (6.5.0)
+      activesupport (>= 5.0.0)
+    factory_bot_rails (6.4.4)
+      factory_bot (~> 6.5)
+      railties (>= 5.0.0)
+    faker (3.5.1)
+      i18n (>= 1.8.11, < 2)
+    faraday (1.10.4)
+      faraday-em_http (~> 1.0)
+      faraday-em_synchrony (~> 1.0)
+      faraday-excon (~> 1.1)
+      faraday-httpclient (~> 1.0)
+      faraday-multipart (~> 1.0)
+      faraday-net_http (~> 1.0)
+      faraday-net_http_persistent (~> 1.0)
+      faraday-patron (~> 1.0)
+      faraday-rack (~> 1.0)
+      faraday-retry (~> 1.0)
+      ruby2_keywords (>= 0.0.4)
+    faraday-em_http (1.0.0)
+    faraday-em_synchrony (1.0.0)
+    faraday-excon (1.1.0)
+    faraday-follow_redirects (0.3.0)
+      faraday (>= 1, < 3)
+    faraday-httpclient (1.0.1)
+    faraday-multipart (1.1.0)
+      multipart-post (~> 2.0)
+    faraday-net_http (1.0.2)
+    faraday-net_http_persistent (1.2.0)
+    faraday-patron (1.0.0)
+    faraday-rack (1.0.0)
+    faraday-retry (1.0.3)
+    faraday_middleware (1.2.1)
+      faraday (~> 1.0)
+    ferrum (0.15)
+      addressable (~> 2.5)
+      concurrent-ruby (~> 1.1)
+      webrick (~> 1.7)
+      websocket-driver (~> 0.7)
+    ffi (1.17.1)
+    ffi (1.17.1-aarch64-linux-musl)
+    ffi (1.17.1-arm64-darwin)
+    ffi (1.17.1-x86_64-linux-musl)
+    foreman (0.88.1)
+    geom2d (0.4.1)
+    globalid (1.2.1)
+      activesupport (>= 6.1)
+    google-apis-core (0.15.1)
+      addressable (~> 2.5, >= 2.5.1)
+      googleauth (~> 1.9)
+      httpclient (>= 2.8.3, < 3.a)
+      mini_mime (~> 1.0)
+      mutex_m
+      representable (~> 3.0)
+      retriable (>= 2.0, < 4.a)
+    google-apis-iamcredentials_v1 (0.22.0)
+      google-apis-core (>= 0.15.0, < 2.a)
+    google-apis-storage_v1 (0.49.0)
+      google-apis-core (>= 0.15.0, < 2.a)
+    google-cloud-core (1.7.1)
+      google-cloud-env (>= 1.0, < 3.a)
+      google-cloud-errors (~> 1.0)
+    google-cloud-env (2.2.1)
+      faraday (>= 1.0, < 3.a)
+    google-cloud-errors (1.4.0)
+    google-cloud-storage (1.54.0)
+      addressable (~> 2.8)
+      digest-crc (~> 0.4)
+      google-apis-core (~> 0.13)
+      google-apis-iamcredentials_v1 (~> 0.18)
+      google-apis-storage_v1 (~> 0.38)
+      google-cloud-core (~> 1.6)
+      googleauth (~> 1.9)
+      mini_mime (~> 1.0)
+    google-logging-utils (0.1.0)
+    googleauth (1.12.2)
+      faraday (>= 1.0, < 3.a)
+      google-cloud-env (~> 2.2)
+      google-logging-utils (~> 0.1)
+      jwt (>= 1.4, < 3.0)
+      multi_json (~> 1.11)
+      os (>= 0.9, < 2.0)
+      signet (>= 0.16, < 2.a)
+    hashdiff (1.1.2)
+    hexapdf (1.4.0)
+      cmdparse (~> 3.0, >= 3.0.3)
+      geom2d (~> 0.4, >= 0.4.1)
+      openssl (>= 2.2.1)
+      strscan (>= 3.1.2)
+    htmlentities (4.3.4)
+    httpclient (2.8.3)
+    i18n (1.14.7)
+      concurrent-ruby (~> 1.0)
+    image_processing (1.13.0)
+      mini_magick (>= 4.9.5, < 5)
+      ruby-vips (>= 2.0.17, < 3)
+    io-console (0.8.1)
+    irb (1.15.2)
+      pp (>= 0.6.0)
+      rdoc (>= 4.0.0)
+      reline (>= 0.4.2)
+    jmespath (1.6.2)
+    json (2.13.2)
+    jwt (2.9.3)
+      base64
+    language_server-protocol (3.17.0.3)
+    launchy (3.0.1)
+      addressable (~> 2.8)
+      childprocess (~> 5.0)
+    letter_opener (1.10.0)
+      launchy (>= 2.2, < 4)
+    letter_opener_web (3.0.0)
+      actionmailer (>= 6.1)
+      letter_opener (~> 1.9)
+      railties (>= 6.1)
+      rexml
+    logger (1.7.0)
+    lograge (0.14.0)
+      actionpack (>= 4)
+      activesupport (>= 4)
+      railties (>= 4)
+      request_store (~> 1.0)
+    loofah (2.24.1)
+      crass (~> 1.0.2)
+      nokogiri (>= 1.12.0)
+    mail (2.8.1)
+      mini_mime (>= 0.1.1)
+      net-imap
+      net-pop
+      net-smtp
+    marcel (1.0.4)
+    matrix (0.4.2)
+    method_source (1.1.0)
+    mini_magick (4.13.2)
+    mini_mime (1.1.5)
+    mini_portile2 (2.8.9)
+    minitest (5.25.5)
+    msgpack (1.7.5)
+    multi_json (1.15.0)
+    multipart-post (2.4.1)
+    mutex_m (0.3.0)
+    mysql2 (0.5.6)
+    net-http-persistent (4.0.5)
+      connection_pool (~> 2.2)
+    net-imap (0.5.9)
+      date
+      net-protocol
+    net-pop (0.1.2)
+      net-protocol
+    net-protocol (0.2.2)
+      timeout
+    net-smtp (0.5.1)
+      net-protocol
+    nio4r (2.7.4)
+    nokogiri (1.18.9)
+      mini_portile2 (~> 2.8.2)
+      racc (~> 1.4)
+    nokogiri (1.18.9-aarch64-linux-musl)
+      racc (~> 1.4)
+    nokogiri (1.18.9-arm64-darwin)
+      racc (~> 1.4)
+    nokogiri (1.18.9-x86_64-linux-musl)
+      racc (~> 1.4)
+    oj (3.16.11)
+      bigdecimal (>= 3.0)
+      ostruct (>= 0.2)
+    openssl (3.3.0)
+    orm_adapter (0.5.0)
+    os (1.1.4)
+    ostruct (0.6.3)
+    package_json (0.1.0)
+    pagy (9.3.3)
+    parallel (1.26.3)
+    parser (3.3.6.0)
+      ast (~> 2.4.1)
+      racc
+    pg (1.5.9)
+    pp (0.6.2)
+      prettyprint
+    premailer (1.27.0)
+      addressable
+      css_parser (>= 1.19.0)
+      htmlentities (>= 4.0.0)
+    premailer-rails (1.12.0)
+      actionmailer (>= 3)
+      net-smtp
+      premailer (~> 1.7, >= 1.7.9)
+    pretender (0.5.0)
+      actionpack (>= 6.1)
+    prettyprint (0.2.0)
+    pry (0.15.0)
+      coderay (~> 1.1)
+      method_source (~> 1.0)
+    pry-rails (0.3.11)
+      pry (>= 0.13.0)
+    psych (5.2.6)
+      date
+      stringio
+    public_suffix (6.0.1)
+    puma (6.5.0)
+      nio4r (~> 2.0)
+    racc (1.8.1)
+    rack (3.2.0)
+    rack-proxy (0.7.7)
+      rack
+    rack-session (2.1.1)
+      base64 (>= 0.1.0)
+      rack (>= 3.0.0)
+    rack-test (2.2.0)
+      rack (>= 1.3)
+    rackup (2.2.1)
+      rack (>= 3)
+    rails (8.0.2.1)
+      actioncable (= 8.0.2.1)
+      actionmailbox (= 8.0.2.1)
+      actionmailer (= 8.0.2.1)
+      actionpack (= 8.0.2.1)
+      actiontext (= 8.0.2.1)
+      actionview (= 8.0.2.1)
+      activejob (= 8.0.2.1)
+      activemodel (= 8.0.2.1)
+      activerecord (= 8.0.2.1)
+      activestorage (= 8.0.2.1)
+      activesupport (= 8.0.2.1)
+      bundler (>= 1.15.0)
+      railties (= 8.0.2.1)
+    rails-dom-testing (2.3.0)
+      activesupport (>= 5.0.0)
+      minitest
+      nokogiri (>= 1.6)
+    rails-html-sanitizer (1.6.2)
+      loofah (~> 2.21)
+      nokogiri (>= 1.15.7, != 1.16.7, != 1.16.6, != 1.16.5, != 1.16.4, != 1.16.3, != 1.16.2, != 1.16.1, != 1.16.0.rc1, != 1.16.0)
+    rails-i18n (8.0.1)
+      i18n (>= 0.7, < 2)
+      railties (>= 8.0.0, < 9)
+    rails_autolink (1.1.8)
+      actionview (> 3.1)
+      activesupport (> 3.1)
+      railties (> 3.1)
+    railties (8.0.2.1)
+      actionpack (= 8.0.2.1)
+      activesupport (= 8.0.2.1)
+      irb (~> 1.13)
+      rackup (>= 1.0.0)
+      rake (>= 12.2)
+      thor (~> 1.0, >= 1.2.2)
+      zeitwerk (~> 2.6)
+    rainbow (3.1.1)
+    rake (13.3.0)
+    rdoc (6.14.2)
+      erb
+      psych (>= 4.0.0)
+    redis-client (0.23.0)
+      connection_pool
+    regexp_parser (2.9.3)
+    reline (0.6.2)
+      io-console (~> 0.5)
+    representable (3.2.0)
+      declarative (< 0.1.0)
+      trailblazer-option (>= 0.1.1, < 0.2.0)
+      uber (< 0.2.0)
+    request_store (1.7.0)
+      rack (>= 1.4)
+    responders (3.1.1)
+      actionpack (>= 5.2)
+      railties (>= 5.2)
+    retriable (3.1.2)
+    rexml (3.4.4)
+    rotp (6.3.0)
+    rouge (4.5.2)
+    rqrcode (2.2.0)
+      chunky_png (~> 1.0)
+      rqrcode_core (~> 1.0)
+    rqrcode_core (1.2.0)
+    rspec-core (3.13.2)
+      rspec-support (~> 3.13.0)
+    rspec-expectations (3.13.3)
+      diff-lcs (>= 1.2.0, < 2.0)
+      rspec-support (~> 3.13.0)
+    rspec-mocks (3.13.2)
+      diff-lcs (>= 1.2.0, < 2.0)
+      rspec-support (~> 3.13.0)
+    rspec-rails (7.1.0)
+      actionpack (>= 7.0)
+      activesupport (>= 7.0)
+      railties (>= 7.0)
+      rspec-core (~> 3.13)
+      rspec-expectations (~> 3.13)
+      rspec-mocks (~> 3.13)
+      rspec-support (~> 3.13)
+    rspec-support (3.13.2)
+    rubocop (1.69.2)
+      json (~> 2.3)
+      language_server-protocol (>= 3.17.0)
+      parallel (~> 1.10)
+      parser (>= 3.3.0.2)
+      rainbow (>= 2.2.2, < 4.0)
+      regexp_parser (>= 2.9.3, < 3.0)
+      rubocop-ast (>= 1.36.2, < 2.0)
+      ruby-progressbar (~> 1.7)
+      unicode-display_width (>= 2.4.0, < 4.0)
+    rubocop-ast (1.37.0)
+      parser (>= 3.3.1.0)
+    rubocop-performance (1.23.0)
+      rubocop (>= 1.48.1, < 2.0)
+      rubocop-ast (>= 1.31.1, < 2.0)
+    rubocop-rails (2.27.0)
+      activesupport (>= 4.2.0)
+      rack (>= 1.1)
+      rubocop (>= 1.52.0, < 2.0)
+      rubocop-ast (>= 1.31.1, < 2.0)
+    rubocop-rspec (3.3.0)
+      rubocop (~> 1.61)
+    ruby-progressbar (1.13.0)
+    ruby-vips (2.2.2)
+      ffi (~> 1.12)
+      logger
+    ruby2_keywords (0.0.5)
+    rubyXL (3.4.33)
+      nokogiri (>= 1.10.8)
+      rubyzip (>= 1.3.0)
+    rubyzip (2.3.2)
+    securerandom (0.4.1)
+    semantic_range (3.1.0)
+    shakapacker (8.0.2)
+      activesupport (>= 5.2)
+      package_json
+      rack-proxy (>= 0.6.1)
+      railties (>= 5.2)
+      semantic_range (>= 2.3.0)
+    sidekiq (7.3.7)
+      connection_pool (>= 2.3.0)
+      logger
+      rack (>= 2.2.4)
+      redis-client (>= 0.22.2)
+    signet (0.19.0)
+      addressable (~> 2.8)
+      faraday (>= 0.17.5, < 3.a)
+      jwt (>= 1.5, < 3.0)
+      multi_json (~> 1.10)
+    simplecov (0.22.0)
+      docile (~> 1.1)
+      simplecov-html (~> 0.11)
+      simplecov_json_formatter (~> 0.1)
+    simplecov-html (0.13.1)
+    simplecov_json_formatter (0.1.4)
+    smart_properties (1.17.0)
+    sqlite3 (2.5.0)
+      mini_portile2 (~> 2.8.0)
+    sqlite3 (2.5.0-aarch64-linux-musl)
+    sqlite3 (2.5.0-arm64-darwin)
+    sqlite3 (2.5.0-x86_64-linux-musl)
+    stringio (3.1.7)
+    strip_attributes (1.14.1)
+      activemodel (>= 3.0, < 9.0)
+    strscan (3.1.5)
+    thor (1.4.0)
+    timeout (0.4.3)
+    trailblazer-option (0.1.2)
+    turbo-rails (2.0.11)
+      actionpack (>= 6.0.0)
+      railties (>= 6.0.0)
+    twitter_cldr (6.12.1)
+      camertron-eprun
+      cldr-plurals-runtime-rb (~> 1.1)
+      tzinfo
+    tzinfo (2.0.6)
+      concurrent-ruby (~> 1.0)
+    tzinfo-data (1.2024.2)
+      tzinfo (>= 1.0.0)
+    uber (0.1.0)
+    unicode-display_width (3.1.2)
+      unicode-emoji (~> 4.0, >= 4.0.4)
+    unicode-emoji (4.0.4)
+    uniform_notifier (1.16.0)
+    uri (1.0.3)
+    useragent (0.16.11)
+    warden (1.2.9)
+      rack (>= 2.0.9)
+    web-console (4.2.1)
+      actionview (>= 6.0.0)
+      activemodel (>= 6.0.0)
+      bindex (>= 0.4.0)
+      railties (>= 6.0.0)
+    webmock (3.24.0)
+      addressable (>= 2.8.0)
+      crack (>= 0.3.2)
+      hashdiff (>= 0.4.0, < 2.0.0)
+    webrick (1.9.1)
+    websocket-driver (0.8.0)
+      base64
+      websocket-extensions (>= 0.1.0)
+    websocket-extensions (0.1.5)
+    xpath (3.2.0)
+      nokogiri (~> 1.8)
+    zeitwerk (2.7.3)
+
+PLATFORMS
+  aarch64-linux-musl
+  arm64-darwin
+  ruby
+  x86_64-linux-musl
+
+DEPENDENCIES
+  annotaterb
+  arabic-letter-connector
+  aws-sdk-s3
+  aws-sdk-secretsmanager
+  azure-storage-blob
+  better_html
+  bootsnap
+  brakeman
+  bullet
+  cancancan
+  capybara
+  csv
+  csv-safe
+  cuprite
+  debug
+  devise
+  devise-two-factor
+  dotenv
+  email_typo
+  erb_lint
+  factory_bot_rails
+  faker
+  faraday
+  faraday-follow_redirects
+  foreman
+  google-cloud-storage
+  hexapdf
+  image_processing
+  jwt
+  letter_opener_web
+  lograge
+  mysql2
+  oj
+  pagy
+  pg
+  premailer-rails
+  pretender
+  pry-rails
+  puma
+  rack
+  rails
+  rails-i18n
+  rails_autolink
+  rotp
+  rouge
+  rqrcode
+  rspec-rails
+  rubocop
+  rubocop-performance
+  rubocop-rails
+  rubocop-rspec
+  ruby-vips
+  rubyXL
+  shakapacker
+  sidekiq
+  simplecov
+  sqlite3
+  strip_attributes
+  turbo-rails
+  twitter_cldr
+  tzinfo-data
+  web-console
+  webmock
+
+BUNDLED WITH
+   2.6.9
@@ -0,0 +1,134 @@
+{
+  stdenv,
+  lib,
+  fetchFromGitHub,
+  bundlerEnv,
+  nixosTests,
+  ruby_3_4,
+  pdfium-binaries,
+  makeWrapper,
+  bundler,
+  fetchYarnDeps,
+  yarn,
+  fixup-yarn-lock,
+  nodejs,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "docuseal";
+  version = "2.1.7";
+
+  bundler = bundler.override { ruby = ruby_3_4; };
+
+  src = fetchFromGitHub {
+    owner = "docusealco";
+    repo = "docuseal";
+    tag = finalAttrs.version;
+    hash = "sha256-zNfxQPJjobYrx/YPGRn5QKwUd1VXetFqtBeII0wlmk4=";
+    # https://github.com/docusealco/docuseal/issues/505#issuecomment-3153802333
+    postFetch = "rm $out/db/schema.rb";
+  };
+
+  rubyEnv = bundlerEnv {
+    name = "docuseal-gems";
+    ruby = ruby_3_4;
+    inherit (finalAttrs) bundler;
+    gemdir = ./.;
+  };
+
+  docusealWeb = stdenv.mkDerivation {
+    pname = "docuseal-web";
+    inherit (finalAttrs)
+      version
+      src
+      meta
+      ;
+
+    offlineCache = fetchYarnDeps {
+      yarnLock = ./yarn.lock;
+      hash = "sha256-IQOWLkVueuRs0CBv3lEdj6DOiumC4ZPuQRDxQHFh5fQ=";
+    };
+
+    nativeBuildInputs = [
+      yarn
+      fixup-yarn-lock
+      nodejs
+      finalAttrs.rubyEnv
+    ];
+
+    RAILS_ENV = "production";
+    NODE_ENV = "production";
+
+    # no idea how to patch ./bin/shakapacker. instead we execute the two bundle exec commands manually
+    buildPhase = ''
+      runHook preBuild
+
+      export HOME=$(mktemp -d)
+      fixup-yarn-lock yarn.lock
+
+      yarn config --offline set yarn-offline-mirror $offlineCache
+
+      yarn install --offline --frozen-lockfile --ignore-engines --ignore-scripts --no-progress
+      patchShebangs node_modules
+
+      bundle exec rails assets:precompile
+      bundle exec rails shakapacker:compile
+
+      runHook postBuild
+    '';
+
+    installPhase = ''
+      runHook preInstall
+
+      cp -r public/packs $out
+
+      runHook postInstall
+    '';
+  };
+
+  buildInputs = [ finalAttrs.rubyEnv ];
+  propagatedBuildInputs = [ finalAttrs.rubyEnv.wrappedRuby ];
+  nativeBuildInputs = [ makeWrapper ];
+
+  RAILS_ENV = "production";
+  BUNDLE_WITHOUT = "development:test";
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/public/packs
+    cp -r ${finalAttrs.src}/* $out
+    cp -r ${finalAttrs.docusealWeb}/* $out/public/packs
+
+    bundle exec bootsnap precompile --gemfile app/ lib/
+
+    runHook postInstall
+  '';
+
+  # create empty folder which are needed, but never used
+  postInstall = ''
+    chmod +w $out/tmp/
+    mkdir -p $out/tmp/{cache,sockets}
+  '';
+
+  postFixup = ''
+    wrapProgram $out/bin/rails \
+      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ pdfium-binaries ]}"
+  '';
+
+  passthru = {
+    tests = {
+      inherit (nixosTests) docuseal-postgresql docuseal-sqlite;
+    };
+    updateScript = ./update.sh;
+  };
+
+  meta = {
+    description = "Open source tool for creating, filling and signing digital documents";
+    homepage = "https://www.docuseal.co/";
+    license = lib.licenses.agpl3Only;
+    maintainers = with lib.maintainers; [ stunkymonkey ];
+    platforms = lib.platforms.unix;
+    broken = stdenv.hostPlatform.isDarwin;
+  };
+})
@@ -0,0 +1,46 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl jq bundix ruby_3_4 prefetch-yarn-deps nix-update nixfmt
+
+set -eu -o pipefail
+dir="$(dirname "$(readlink -f "$0")")"
+
+current=$(nix --extra-experimental-features nix-command eval --raw -f . docuseal.src.tag)
+latest=$(curl ${GITHUB_TOKEN:+" -u \":$GITHUB_TOKEN\""} "https://api.github.com/repos/docusealco/docuseal/tags?per_page=1" | jq -r '.[0].name')
+
+if [[ "$current" == "$latest" ]]; then
+  echo "'docuseal' is up-to-date ($current == $latest)"
+  exit 0
+fi
+
+echo "Updating docuseal to $latest"
+
+repo=$(mktemp -d /tmp/docuseal-update.XXX)
+
+rm -f "$dir/gemset.nix" "$dir/Gemfile" "$dir/Gemfile.lock" "$dir/yarn.lock"
+
+docuseal_storepath=$(nix --extra-experimental-features "nix-command flakes" flake prefetch github:docusealco/docuseal/"$latest" --json | jq -r '.storePath')
+
+cp -r  --no-preserve=mode,ownership $docuseal_storepath/* $repo/
+
+# patch ruby version
+sed -i "/^ruby '[0-9]\+\.[0-9]\+\.[0-9]\+'$/d" "$repo/Gemfile"
+
+# fix: https://github.com/nix-community/bundix/issues/88
+BUNDLE_GEMFILE="$repo/Gemfile" bundler lock --remove-platform x86_64-linux --lockfile="$repo/Gemfile.lock"
+BUNDLE_GEMFILE="$repo/Gemfile" bundler lock --remove-platform aarch64-linux --lockfile="$repo/Gemfile.lock"
+# generate gemset.nix
+bundix --lock --lockfile="$repo/Gemfile.lock" --gemfile="$repo/Gemfile" --gemset="$dir/gemset.nix"
+
+# patch yarn.lock
+sed -i 's$, "@hotwired/turbo@https://github.com/docusealco/turbo#main"$$g' "$repo/yarn.lock"
+
+# calc yarn hash
+YARN_HASH="$(prefetch-yarn-deps "$repo/yarn.lock")"
+YARN_HASH="$(nix --extra-experimental-features nix-command hash to-sri --type sha256 "$YARN_HASH")"
+
+# update
+cp "$repo/Gemfile" "$repo/Gemfile.lock" "$repo/yarn.lock" "$dir/"
+nix-update docuseal --version "$latest"
+nix-update docuseal --subpackage "docusealWeb"
+
+nixfmt "$dir/gemset.nix"
@@ -26,7 +26,7 @@
  libusb1,
  lz4,
  lzo,
-  mbedtls_2,
+  mbedtls,
  miniupnpc,
  minizip-ng,
  openal,
@@ -98,7 +98,7 @@ stdenv.mkDerivation (finalAttrs: {
    libusb1
    lz4
    lzo
-    mbedtls_2
+    mbedtls
    miniupnpc
    minizip-ng
    openal
@@ -14,13 +14,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "doublecmd";
-  version = "1.1.28";
+  version = "1.1.29";

  src = fetchFromGitHub {
    owner = "doublecmd";
    repo = "doublecmd";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-RbDAWpJy4+7VNJkuY+LB27nQFbThUCaH+Bcsqdrlp5g=";
+    hash = "sha256-WEBCP5l9XZhule26thiti/NQpT0FPSu7b6ZffouHipQ=";
  };

  nativeBuildInputs = [
@@ -8,7 +8,7 @@

 let
  themeName = "Dracula";
-  version = "4.0.0-unstable-2025-09-18";
+  version = "4.0.0-unstable-2025-10-06";
 in
 stdenvNoCC.mkDerivation {
  pname = "dracula-theme";
@@ -17,8 +17,8 @@ stdenvNoCC.mkDerivation {
  src = fetchFromGitHub {
    owner = "dracula";
    repo = "gtk";
-    rev = "ec0442da9551a4a71801dab101a38fd6972da649";
-    hash = "sha256-P6164Tl9C80QaUXmHaOX+OIRIQPKpwI8o9yiO+o5KNc=";
+    rev = "7fda0087e2f0781e6aa340b15851830fddcb708d";
+    hash = "sha256-1/gSV5hdWouW3yMgbtR2tDRA/bdPiYibMFtFhNyz8KQ=";
  };

  propagatedUserEnvPkgs = [
@@ -8,16 +8,16 @@

 buildGoModule rec {
  pname = "eksctl";
-  version = "0.214.0";
+  version = "0.215.0";

  src = fetchFromGitHub {
    owner = "weaveworks";
    repo = "eksctl";
    rev = version;
-    hash = "sha256-JsVW1JC3VdxCJpngPCkrIbH5B/YlAKOc/SOIEo7s8mo=";
+    hash = "sha256-4voPrM5HNEcM0Xa5rVt18pgTSFcgPii3MZo1+QZ9PwE=";
  };

-  vendorHash = "sha256-0tdhi2uqC1aIK9Nkfr9OuV0mCWiT0sNX1W3hgz1vslU=";
+  vendorHash = "sha256-+fAmY932lvD/4Jiq7vd2N/rcKw5Q2pkPnQFD1P2mU8w=";

  doCheck = false;

@@ -4,6 +4,8 @@
  fetchFromGitHub,
  gitUpdater,
  cmake,
+  gtest,
+  nlohmann_json,
  pdal,
  curl,
  openssl,
@@ -11,16 +13,18 @@

 stdenv.mkDerivation rec {
  pname = "entwine";
-  version = "3.1.1";
+  version = "3.2.0";

  src = fetchFromGitHub {
    owner = "connormanning";
    repo = "entwine";
    rev = version;
-    sha256 = "sha256-1dy5NafKX0E4MwFIggnr7bQIeB1KvqnNaQQUUAs6Bq8=";
+    hash = "sha256-RpUV75Dlyd3wTWGC3btpAFSjqpgK9zLXTl670Oh0Z2o=";
  };

  buildInputs = [
+    gtest
+    nlohmann_json
    openssl
    pdal
    curl
@@ -9,14 +9,14 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "git-machete";
-  version = "3.36.4";
+  version = "3.37.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "virtuslab";
    repo = "git-machete";
    tag = "v${version}";
-    hash = "sha256-9xJCwu2TeWsxut6y4VJV6Qou4G81kXcGPHJPrOrsGuc=";
+    hash = "sha256-sTeztSdMqTJYBNKnDPnlVHeEIyUodiL6sZiQvyWQBmE=";
  };

  build-system = with python3.pkgs; [ setuptools ];
@@ -1,7 +1,7 @@
 {
  stdenv,
  coreutils,
-  fetchFromGitHub,
+  fetchFromGitea,
  git,
  lib,
  makeWrapper,
@@ -10,14 +10,15 @@
  nixosTests,
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "gitolite";
  version = "3.6.14";

-  src = fetchFromGitHub {
+  src = fetchFromGitea {
+    domain = "codeberg.org";
    owner = "sitaramc";
    repo = "gitolite";
-    rev = "v${version}";
+    tag = "v${finalAttrs.version}";
    hash = "sha256-BwpqvjpHzoypV91W/QReAgiNrmpxZ0IE3W/bpCVO1GE=";
  };

@@ -55,7 +56,7 @@ stdenv.mkDerivation rec {
  installPhase = ''
    mkdir -p $out/bin
    perl ./install -to $out/bin
-    echo ${version} > $out/bin/VERSION
+    echo ${finalAttrs.version} > $out/bin/VERSION
  '';

  passthru.tests = {
@@ -73,4 +74,4 @@ stdenv.mkDerivation rec {
      maintainers.tomberek
    ];
  };
-}
+})
@@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "go-licence-detector";
-  version = "0.9.1";
+  version = "0.10.0";

  src = fetchFromGitHub {
    owner = "elastic";
    repo = "go-licence-detector";
    rev = "v${version}";
-    hash = "sha256-Mo4eBBP9UueLEMVnxndatizDaxVyZuHACvFoV38dRVI=";
+    hash = "sha256-/94rUYWS8r8rRTmMyNs93voLdK3WlzJlIQWxgGE6eaQ=";
  };

-  vendorHash = "sha256-quFa2gBPsyRMOBde+KsIF8NCHYSF+X9skvIWnpm2Nss=";
+  vendorHash = "sha256-wJ6jB8MxyYOlOpABRv5GmULofWuPQR8yClj63qsr/tg=";

  meta = with lib; {
    description = "Detect licences in Go projects and generate documentation";
@@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "goctl";
-  version = "1.9.1";
+  version = "1.9.2";

  src = fetchFromGitHub {
    owner = "zeromicro";
    repo = "go-zero";
    tag = "v${version}";
-    hash = "sha256-iTkxfMzrKbSRMyG1VWV5VbnDNwpE9t+YQzmL6DwRGHQ=";
+    hash = "sha256-wS8Hb0sqP2iPjF3EgkmmsE6aHpyiRw4kcYpDPmJvpic=";
  };

-  vendorHash = "sha256-rARM93I+m8I99Vdevd/v/h8CB+fQ+Abj4J//KOu6+Pc=";
+  vendorHash = "sha256-HTLpgrKDm+Sw7Y5VV13kitqF6mn479JxQbCAFMy0tTU=";

  modRoot = "tools/goctl";
  subPackages = [ "." ];
@@ -10,13 +10,13 @@

 buildGoModule rec {
  pname = "godns";
-  version = "3.3.3";
+  version = "3.3.4";

  src = fetchFromGitHub {
    owner = "TimothyYe";
    repo = "godns";
    tag = "v${version}";
-    hash = "sha256-go6LUVr53ioCpzWwShe7Ol2p57HH/cAcsD+g7I0ix2E=";
+    hash = "sha256-udGbWbrYCPEF/iGvpH2YyGPlDEYr3/a9NmZE1JkkDT4=";
  };

  vendorHash = "sha256-FHao4E0hhmnM224f8CowcHFAN2fmcR7TN08ldKZ5DUw=";
@@ -5,10 +5,10 @@
 }:
 let
  pname = "heptabase";
-  version = "1.74.3";
+  version = "1.75.3";
  src = fetchurl {
    url = "https://github.com/heptameta/project-meta/releases/download/v${version}/Heptabase-${version}.AppImage";
-    hash = "sha256-PzWQmDNji3dl24U9yIKelW7ge9w4rosgjj55RbCHI/Q=";
+    hash = "sha256-PtRc5Rkytt53FnEfu48sRgamze4a4zNyeFfh6UB5qqs=";
  };

  appimageContents = appimageTools.extractType2 { inherit pname version src; };
@@ -12,16 +12,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "hyprviz";
-  version = "0.6.1";
+  version = "0.7.0";

  src = fetchFromGitHub {
    owner = "timasoft";
    repo = "hyprviz";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-xiAP5Xy30IokRcR25ObXLeM7qKjVXgEv9fQZA2KDxOA=";
+    hash = "sha256-voOfiiNJi6igBqkvG1zy5dakDSGHteStd2bqh6VLgU4=";
  };

-  cargoHash = "sha256-FW0FGoJ/OPlujgB8OXsO+Y6J1piA7FywsuDm8MU4KfI=";
+  cargoHash = "sha256-CZcBiTyIeWS7DFWXruXM7Lvzr4qEDALvfNCnprbyKOg=";

  nativeBuildInputs = [
    pkg-config
@@ -11,12 +11,12 @@

 buildGoModule rec {
  pname = "imgproxy";
-  version = "3.30.0";
+  version = "3.30.1";

  src = fetchFromGitHub {
    owner = "imgproxy";
    repo = "imgproxy";
-    hash = "sha256-vT+Nyjx2TTOCzosCV/EfMLEnyT6RCebBFNu0/IRuwak=";
+    hash = "sha256-UaJ02TQ8jbebRDF5K3zFy+4ho+dt1o/o3cEDzUQY3iU=";
    rev = "v${version}";
  };

@@ -29,13 +29,13 @@
 stdenv.mkDerivation (finalAttrs: {
  strictDeps = true;
  name = "isle-portable";
-  version = "0-unstable-2025-09-24";
+  version = "0-unstable-2025-10-06";

  src = fetchFromGitHub {
    owner = "isledecomp";
    repo = "isle-portable";
-    rev = "d890e3db58a898dbcea9ae801f5346308b4b62ea";
-    hash = "sha256-LRpyO7XoIJuMf6KzCNWBRkRxxUu5+kru0ufYLl0zDcM=";
+    rev = "6ea82ae144b91874bd41fe32e9ffb82507a87ef0";
+    hash = "sha256-5BWMGjvAxyaI2KepbHgy9lYKorb5tWbqlZw2YkbQ7L0=";
    fetchSubmodules = true;
  };

@@ -12,13 +12,13 @@

 buildGoModule (finalAttrs: {
  pname = "k9s";
-  version = "0.50.13";
+  version = "0.50.15";

  src = fetchFromGitHub {
    owner = "derailed";
    repo = "k9s";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-X1AZArXeqfn+YSkj3c4gIVJrFvA4U3oV/XtvpsNhutg=";
+    hash = "sha256-rTG2UtrVLlF+dFFJiNErYG6GL4ZQdwPlj1kdaLxh6TI=";
  };

  ldflags = [
@@ -32,7 +32,7 @@ buildGoModule (finalAttrs: {

  proxyVendor = true;

-  vendorHash = "sha256-6IYMrh1wIiU2jy9RMpFWfjlerpfW/luFcusmlWBS7RE=";
+  vendorHash = "sha256-Djz23/Ef7T7giE/KDsnbWnihwW37o40jevwVt8CbiQE=";

  # TODO investigate why some config tests are failing
  doCheck = !(stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64);
@@ -39,13 +39,13 @@ let
 in
 effectiveStdenv.mkDerivation (finalAttrs: {
  pname = "koboldcpp";
-  version = "1.98.1";
+  version = "1.99.4";

  src = fetchFromGitHub {
    owner = "LostRuins";
    repo = "koboldcpp";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-CJM97DRSIq2d3X6aR096+9QwBeI4kQNzxufdSoEydco=";
+    hash = "sha256-ilBrTMtY6bhns2GcwDckGq4+RqzgzBCg0HJJ4QUx8Co=";
  };

  enableParallelBuilding = true;
@@ -10,16 +10,16 @@

 buildGoModule rec {
  pname = "kubelogin";
-  version = "0.2.10";
+  version = "0.2.11";

  src = fetchFromGitHub {
    owner = "Azure";
    repo = "kubelogin";
    rev = "v${version}";
-    sha256 = "sha256-pi2dzIf48mqD3S7QqaZZ5sgcgPRtQZ10KpfojLVYCZA=";
+    sha256 = "sha256-MbWplD4u5qrLKLF1stQK4SHNAxQYnFNKJmdq25zsZwU=";
  };

-  vendorHash = "sha256-tuqWg7z9YJygEW3XwBXDwXHUNwaJeTAxRS1xv6bQpj4=";
+  vendorHash = "sha256-0tZ96t2Yeghe8xvEL9vjBS/gEUUIhyy61olqOlLD6q8=";

  ldflags = [
    "-X main.gitTag=v${version}"
@@ -2,11 +2,9 @@
  lib,
  stdenv,
  fetchurl,
-  mono,
  libmediainfo,
  sqlite,
  curl,
-  chromaprint,
  makeWrapper,
  icu,
  dotnet-runtime,
@@ -27,20 +25,21 @@ let
    ."${stdenv.hostPlatform.system}" or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
  hash =
    {
-      x64-linux_hash = "sha256-24bNK4iHgaobxYpy+OJAocGugV0CwF3q1ND6maEaYSY=";
-      arm64-linux_hash = "sha256-ck2AspRkKm8hdzO70acTGUUd8WTOevIJF50YwQf/R20=";
-      x64-osx_hash = "sha256-ut/4154i/yKlm2JacgW9jvevDniedzLudfeuUXV9XzM=";
-      arm64-osx_hash = "sha256-/aIusVUmsqLCNNhosCAVbR5oN6oLROEuJKnH22cRXfo=";
+      x64-linux_hash = "sha256-LeJBed6Zo2+r6ZdgBTkcg+3ORoohvDpx37gOOorg9wY=";
+      arm64-linux_hash = "sha256-eS4MccKhISJBc68lhrYwbESV0FcqtAI/b4ojfQO/9m8=";
+      x64-osx_hash = "sha256-l3hi+X91DQNmGZKNJ4Y/DkB7ohu0/HTTnhSInIBiPlo=";
+      arm64-osx_hash = "sha256-ehZJZKxEiupLyBZCgz2subtD7BICXjAqIdnOnh+OMe4=";
    }
    ."${arch}-${os}_hash";
 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "lidarr";
-  version = "2.13.3.4711";
+  version = "2.14.5.4836";

  src = fetchurl {
-    url = "https://github.com/lidarr/Lidarr/releases/download/v${version}/Lidarr.master.${version}.${os}-core-${arch}.tar.gz";
-    sha256 = hash;
+    inherit hash;
+
+    url = "https://github.com/lidarr/Lidarr/releases/download/v${finalAttrs.version}/Lidarr.master.${finalAttrs.version}.${os}-core-${arch}.tar.gz";
  };

  nativeBuildInputs = [ makeWrapper ];
@@ -48,10 +47,10 @@ stdenv.mkDerivation rec {
  installPhase = ''
    runHook preInstall

-    mkdir -p $out/{bin,share/${pname}-${version}}
-    cp -r * $out/share/${pname}-${version}/.
+    mkdir -p $out/{bin,share/${finalAttrs.pname}-${finalAttrs.version}}
+    cp -r * $out/share/${finalAttrs.pname}-${finalAttrs.version}/.
    makeWrapper "${dotnet-runtime}/bin/dotnet" $out/bin/Lidarr \
-      --add-flags "$out/share/${pname}-${version}/Lidarr.dll" \
+      --add-flags "$out/share/${finalAttrs.pname}-${finalAttrs.version}/Lidarr.dll" \
      --prefix LD_LIBRARY_PATH : ${
        lib.makeLibraryPath [
          curl
@@ -71,11 +70,11 @@ stdenv.mkDerivation rec {
    tests.smoke-test = nixosTests.lidarr;
  };

-  meta = with lib; {
+  meta = {
    description = "Usenet/BitTorrent music downloader";
    homepage = "https://lidarr.audio/";
-    license = licenses.gpl3;
-    maintainers = [ ];
+    license = lib.licenses.gpl3;
+    maintainers = with lib.maintainers; [ ramonacat ];
    mainProgram = "Lidarr";
    platforms = [
      "x86_64-linux"
@@ -84,4 +83,4 @@ stdenv.mkDerivation rec {
      "aarch64-darwin"
    ];
  };
-}
+})
@@ -8,16 +8,16 @@

 buildNpmPackage rec {
  pname = "lint-staged";
-  version = "16.2.3";
+  version = "16.2.4";

  src = fetchFromGitHub {
    owner = "okonet";
    repo = "lint-staged";
    rev = "v${version}";
-    hash = "sha256-kfirpw0wSOvq4C+O9gQpG4caqPCjRV47rAylKWmrfy4=";
+    hash = "sha256-r4BJVY4PoBItIpCOQO5eTVyOGnIqV1fJ/cbrNyjvhAs=";
  };

-  npmDepsHash = "sha256-TW90pvkKEs5s2nvjkNyf5xQFmM6UueMSm8Ov03I3Nls=";
+  npmDepsHash = "sha256-0lVx2s58XFa9xj2fiP6P5jCfVeUZ8pFkmdy/J6yDK9A=";

  dontNpmBuild = true;

@@ -2,6 +2,7 @@
  lib,
  buildGoModule,
  fetchFromGitHub,
+  nixosTests,
 }:

 buildGoModule (finalAttrs: {
@@ -20,6 +21,8 @@ buildGoModule (finalAttrs: {
  # no test file in upstream
  doCheck = false;

+  passthru.tests.nixos = nixosTests.local-content-share;
+
  meta = {
    description = "Storing/sharing text/files in your local network with no setup on client devices";
    homepage = "https://github.com/Tanq16/local-content-share";
@@ -11,16 +11,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "lsd";
-  version = "1.1.5";
+  version = "1.2.0";

  src = fetchFromGitHub {
    owner = "lsd-rs";
    repo = "lsd";
    rev = "v${version}";
-    hash = "sha256-LlMcBMb40yN+rlvGVsh7JaC3j9sF60YxitQQXe1q/oI=";
+    hash = "sha256-BDwptBRGy2IGc3FrgFZ1rt/e1bpKs1Y0C3H4JfqRqHc=";
  };

-  cargoHash = "sha256-yOJKXfPtzaYF012YCyW3m+9ffag4En4ZfTaiVh/85dM=";
+  cargoHash = "sha256-TcC8ZY8Xv0076bLrprXGPh5nyGnR2NRnGeuTSEK4+Gg=";

  nativeBuildInputs = [
    installShellFiles
@@ -9,13 +9,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "luau";
-  version = "0.694";
+  version = "0.695";

  src = fetchFromGitHub {
    owner = "luau-lang";
    repo = "luau";
    tag = finalAttrs.version;
-    hash = "sha256-PA7wcrbGRfrMYgT9vWcpPEgZot+HNkQrptPuEArVM3Q=";
+    hash = "sha256-7ByLeKSUvaKVGJUwDb1tkxfScw8B9K6abTNk0gD2CqI=";
  };

  nativeBuildInputs = [ cmake ];
@@ -1,6 +1,6 @@
 {
-  version = "1.27.9";
-  hash = "sha256-COPNi7AoHYyY8pfTSJYKxUG2Mh08czBjiD0VzLu0V6I=";
-  npmDepsHash = "sha256-QEjfCHqE8r41fgylNRY5Gk0tYQSYuFxHrHT6/7vtLxg=";
-  vendorHash = "sha256-Nmupbw8ouxsc7/CEAWz4Cj0cyEMP4WFPZ+P5ornf1AI=";
+  version = "1.27.10";
+  hash = "sha256-O/gU5EKeEoyQDsO1aJh3twbZzSnKb1pLt9t4GfYlHEE=";
+  npmDepsHash = "sha256-r4hategU6aE05fvpXkgMNtFyWTv6eumLzlevjOT0/dM=";
+  vendorHash = "sha256-TM8b16Y+629gBz5XlXXimDWBAfOq9w8es4v984zVUbk=";
 }
@@ -7,16 +7,16 @@

 buildNpmPackage rec {
  pname = "markdown-link-check";
-  version = "3.13.6";
+  version = "3.14.1";

  src = fetchFromGitHub {
    owner = "tcort";
    repo = "markdown-link-check";
    rev = "v${version}";
-    hash = "sha256-UuzfIJL3nHIbGFQrs9ya+QiS/sM0z1GCHbJGLQBN5pE=";
+    hash = "sha256-g0264lQGIcurm+qnVFu2sZw11sSzoyAvhALDvXkrfts=";
  };

-  npmDepsHash = "sha256-Lxywr3M/4+DwVWxkWZHHn02K7RNWSI5LyMm12lyZT8w=";
+  npmDepsHash = "sha256-Qw7s/IyPjOkgDLWSMSnMekRjBs9Hg/x/9JKVHqz+W6E=";

  dontNpmBuild = true;

@@ -13,7 +13,7 @@

 buildPythonPackage rec {
  pname = "matrix-synapse-s3-storage-provider";
-  version = "1.5.0";
+  version = "1.6.0";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
    owner = "matrix-org";
    repo = "synapse-s3-storage-provider";
    rev = "refs/tags/v${version}";
-    hash = "sha256-Nv8NkzOcUDX17N7Lyx/NT1vXztiRNaTYIAWNPHxgxJ4=";
+    hash = "sha256-aeacw6Fpv4zFhZI4LdsJiV2pcOAMv3aV5CicnwYRxw8=";
  };

  postPatch = ''
@@ -9,13 +9,13 @@

 buildGoModule rec {
  pname = "nfpm";
-  version = "2.43.2";
+  version = "2.43.4";

  src = fetchFromGitHub {
    owner = "goreleaser";
    repo = "nfpm";
    rev = "v${version}";
-    hash = "sha256-RHYGVSR/hMekaNoIxBP2zw3RZi/SSj4RlSMJNvgbigw=";
+    hash = "sha256-mLss9uh/yTU6aJDTBDGdfL0M6A3AIVOfuWR8r0KsyOk=";
  };

  vendorHash = "sha256-7OhiaB0PpwvFj+yLyoN0+/qpF+p/c/Vw+7Tn2XVYYjg=";
@@ -8,16 +8,16 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "nnd";
-  version = "0.50";
+  version = "0.51";

  src = fetchFromGitHub {
    owner = "al13n321";
    repo = "nnd";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-PxSiAjciRHhRd0UHlRh7ondvYk9ytTSruO7f7CIYA6w=";
+    hash = "sha256-OjD7UiwVF/Be8Mqf2CT06ScqDIikiL4jLVxGj5ejiqc=";
  };

-  cargoHash = "sha256-zTQlqtg1pdLGnAOvl5hN9mKf3bg7jnjrVJYmRgSzcNw=";
+  cargoHash = "sha256-rxq/5DqEpXzX/dXy1NKZSQw3Dy8NrvtOPNSskxEjEBM=";

  meta = {
    description = "Debugger for Linux";
@@ -11,13 +11,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "osqp-eigen";
-  version = "0.10.3";
+  version = "0.11.0";

  src = fetchFromGitHub {
    owner = "robotology";
    repo = "osqp-eigen";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-2H7B+e6/AUjAxMmRe2OEBImV/FOBxv9tZQLoEg7mmGg=";
+    hash = "sha256-SrQxRyzbheotCTSF7eBFr6nxJxWdze1hFhP/F06cb7g=";
  };

  cmakeFlags = [
@@ -0,0 +1,52 @@
+{
+  "@esbuild/aix-ppc64@npm:0.25.0": "f9a1263789c799c54255f102aa7e5eb92ff2938e5f1e28d7270ae9388d7f0b07a89c6928201089e9917da3531c3370675cbdf3ee213dbb46c219168826dcbf07",
+  "@esbuild/android-arm64@npm:0.25.0": "b935e4909cfecaf6166268edb337ac481eb79760230efe9893d09dfffc242915307edc890220ff1fe6378f9a6dc88043971a8282929e21ee92d5bb32d1ff33ad",
+  "@esbuild/android-arm@npm:0.25.0": "109a800ac79c78770cbc5f76c6ba8d2c3a3324c408748016429b5c8aad211463e33d8c0ed7a740f55d8df7a1bac4e78bc5029521f07e740731b7564c688c2206",
+  "@esbuild/android-x64@npm:0.25.0": "033e21f87df0b0a50b6f54de5ba2dc20c232f008fc62c377c8a359dc27c6d96eaaf57fab8c87c829e36fb49249811bcb0dfb0df958fc2cd1a2311fe443db7a2c",
+  "@esbuild/darwin-arm64@npm:0.25.0": "d82d5f8b724a77ee7d65b7d47159930015135c7fb0fc7dc3ad056203bb97a1a933f516fd91f0213420a80c0a9ddfec954c952c554edf00629d9bc964313a3836",
+  "@esbuild/darwin-x64@npm:0.25.0": "ae029503666bfa48c6cbcbc991ac9d841e1f03f056f71782b78e57ac4083022eb505deab330651ee05deab76688cf3139bdbea84caea6491fcaf5caa2b912946",
+  "@esbuild/freebsd-arm64@npm:0.25.0": "9f72aaa0c1845f3ada5a6a1cffa43c7683c25313455aa997ca8b233316a87d163722d8c26a0e86663c5ebbdca6ab91cf1975f0c0e7fbe062087cbef92c666b04",
+  "@esbuild/freebsd-x64@npm:0.25.0": "b96749a6d7da71fff98309655eb85b09de84416ae5c09a02e803342bba25c81e0ac181212bac49fa8d8cc28bfa5e1fbb8d349f2b4722e2ca2df2e4a383d17935",
+  "@esbuild/linux-arm64@npm:0.25.0": "1dbf78595fed87287eccde8fb9a5e35d448ab3b7cd84c03fdfa47c250701a62160d7aa45b4de9ca5e11039975680829644529636bbe254e1627836c5227efca2",
+  "@esbuild/linux-arm@npm:0.25.0": "b1a165678166d006b32f965cb51719403fdea18c9ec2e498807f0b273b46a3a555b214d5d5f832393471180e1d39ca9f06e7bfe3c2c97c0cbc30314a38b422c0",
+  "@esbuild/linux-ia32@npm:0.25.0": "21a136d8301fac7f23724061832426efddc2f9769b29b37e88443245ed0406f0b1f9bc05a02b6d0cf7b3e2e8ec2c8e1e8d99b3178a01ace6974369930f0020f6",
+  "@esbuild/linux-loong64@npm:0.25.0": "f87baa1534a52b24198d9d845821f37bec9c4afb08307ee66c3f1d223d3c684151749f4a0eeb96f3905d365bea9f6256787256ff35b9f80fdd51ed7d4f8356b6",
+  "@esbuild/linux-mips64el@npm:0.25.0": "2bfdec2d2730879795f6884d8f8a38a0297f0cd46bc3357c568fc59432d49d7e26c723d9b8111c799517628cafb469e30fa968387105079aa4b4b4d4192638bf",
+  "@esbuild/linux-ppc64@npm:0.25.0": "bca7b660b91939b5d9f4942b4f2e404efad88fa166c51ba49474b3b5ba200213e1c44499c419d2b13c5afe01b560f361b46d201acc146d76515b953be497bd4f",
+  "@esbuild/linux-riscv64@npm:0.25.0": "dfb00cd66f717315b9afab667a484c67a69a7a3f6bb9e4662cd3dd0b7465da3feb5182bca414ce0ad0f7a95d0a1fd248c792561c63008d483146eff8af6e678c",
+  "@esbuild/linux-s390x@npm:0.25.0": "4c5872f244ade04c71f1d0f14bd0d3ef0cd24c5404e55e33964fa5ce7b6f2e1283e9d9adb5356db76468cd85724f6cfdb1cd9674ad630344a7d01ca614bf59e3",
+  "@esbuild/linux-x64@npm:0.25.0": "22f6bfbb856653ee8cff0a93ce63947fd3bd4565c8bc7e9d437845fc4b44a2b3954b5e412b4aa4b63e62977beca12e0214b2607c7bc8c4ce359bd10118755df4",
+  "@esbuild/netbsd-arm64@npm:0.25.0": "a8286e8b687857779047d005d4a540a693a2e173893a34273773d0272e9908006e10085a52788f54775ca231ad231e8a7af9270dbd8203b9182dbe2c7fee68b6",
+  "@esbuild/netbsd-x64@npm:0.25.0": "e618540e5e086cabc260010e62110a8afb5b0dfc445e5cd6db843d8a7541403decee971265c5cf59e6f1268b03e8fb50e27b65f709faf647c4e20e0916f19621",
+  "@esbuild/openbsd-arm64@npm:0.25.0": "60cc4ce058e03389155dd34f777d4d5cae1fb62f9bb9659c615ce5d70e8093a58aa89a9ebb8fde4d2dba56e5771c6aaf4442db45f4a1c9d54d6c36a149b857d0",
+  "@esbuild/openbsd-x64@npm:0.25.0": "7ba16accc220c711d1bcbb17ada40de4503f9ed54b8a42957345a8a9b9a7c55eac550b234c6a5a812acf50386f2972fb6a5b0381b38f76cff4b3c44ba38ae1ac",
+  "@esbuild/sunos-x64@npm:0.25.0": "e6cbfb0a93b9f78ef991ff43af2ab33faacf382d9b8db44bf53a80b3fc27a9d0f598061b9a77de1db9481d69fd43a3fd4b20a40a2938923fa52cabdcac84e972",
+  "@esbuild/win32-arm64@npm:0.25.0": "47bd8e32c90da8472515ddc625e6284cf745b1b9eeecf16e2e699b94b3d11c2d773b16944c8de33d857a8e59426601063a3df04433cb670ed3e8421def07d96b",
+  "@esbuild/win32-ia32@npm:0.25.0": "072874686fe049446bba0ec18285414275ac74e8232307a856966ede8a822e72ab9f6119f7352f8feb51c629a20065dbc88f4412120480fe5bcc039dd439d0a7",
+  "@esbuild/win32-x64@npm:0.25.0": "ce021c1bb895345ee30f363d89e1f3631040fb44d2e27e614b65dc697090c30c5b66b80aa9d6e5e3b3153010b37e523d6ef34c7b4f2248192b1b4bdd30701b3f",
+  "@msgpackr-extract/msgpackr-extract-darwin-arm64@npm:3.0.2": "b46ad6990e54c55d47b12db146e3e293915b0f5621b9a0ddbe62e2d53b7415818b51ff137e65b58c1227fb35fa6a4820fc715814338d8529d40466f7f594b16c",
+  "@msgpackr-extract/msgpackr-extract-darwin-x64@npm:3.0.2": "6ede5ae1fe02ef9b5200e7f5afc2fdfdd1e099dd0294d6b7701cb5a6602d21a414fb22360e2909aea5879c56aee179df56dd9eb28329f6e74570dfb72780288b",
+  "@msgpackr-extract/msgpackr-extract-linux-arm64@npm:3.0.2": "ab083dc883c37b259c420875e7cd7b1386d0b37a83df89327ee9c341b144127e502f7b7e5800b682741dbbc93ded52d0fd839b65c1570dd5353e7856dd5abccb",
+  "@msgpackr-extract/msgpackr-extract-linux-arm@npm:3.0.2": "a65e847f6a53a74d5b91d10f8a575c43724a6b6530918ca8f71784ba763e1e0e2e2ce5f02a8709273d033a5a8b1361026adce08f69c0fcf778c3f1aae1aa9099",
+  "@msgpackr-extract/msgpackr-extract-linux-x64@npm:3.0.2": "d5af7600096b93294d5e2c8a75661979996e7d0a7eaddfa3fd45a1b41c54f2c4a21765f0852ce6ef28506309c1f19761310e345613edb2d74d5582a205e1514e",
+  "@msgpackr-extract/msgpackr-extract-win32-x64@npm:3.0.2": "10ab009b2032b638ad9c00c87b91af09e96d85991806bc73ae3bf5c956fe8172057515df4265b0d13e8b46bd5b74fff0682b5b513e3c2cf52bfac42268f6ab94",
+  "@rollup/rollup-android-arm-eabi@npm:4.35.0": "6608c59811f515fd3817c7b891d34ad042e9a3f4c0edd94fb8af839f17b1748eb5c27b7b12e2431406acd9d174abb60e8e520310d1a8add31046852651b96431",
+  "@rollup/rollup-android-arm64@npm:4.35.0": "51e6a45d4bd1048c7a6be7b4a091a9af063388f5731d455100a6e090ec6c84d44d927aa0bf8ea508a19f2f8343eaae319db06df0acfdb51eeb708d1a314ae611",
+  "@rollup/rollup-darwin-arm64@npm:4.35.0": "844a8ae0b0ab412fcc98979f0a91965a93fb60c5cce6edc7971792acf08d592fe42413eab0692ae1880dc118b669897a28c2896bfe0a9c272f1b481db662d71c",
+  "@rollup/rollup-darwin-x64@npm:4.35.0": "cbcd6d74096e9732db56444d79f4cc739ade75f4a4768e14b259829b2b2905b7e2e5c5811f6294632ae035e813b36a7ee9edf57f529449ae128ce7b4f83f6e80",
+  "@rollup/rollup-freebsd-arm64@npm:4.35.0": "0a29880358b751650db7ab294131572c3952288169d88919510ad7f1e7534cf2f46ea561c600fba27d89fff0cdabe5efb8c19cf6572d08bc0c126832d52d95d8",
+  "@rollup/rollup-freebsd-x64@npm:4.35.0": "fed915fc432c395645bbcbc9f2a88bae25c8e5ba4fb7f813e7d11c007954767ae8b78fcfc445d1c1f4f95d637745e27dcfe3acc710022d7c999c80da32f70fae",
+  "@rollup/rollup-linux-arm-gnueabihf@npm:4.35.0": "47336911b4c51a55c21a9197593acb8e7b578c9e30b4a4e446e6d4ea3aeedc4afca8d2dfa46002d076d4c456a43065eea89dcf863b80daa0b840f95717579a2f",
+  "@rollup/rollup-linux-arm-musleabihf@npm:4.35.0": "66cb126a20e735224c1caf23531f6d8a6e0f377e5be2ea4943c3043b8d0345eafecfa7d02a763b09c057ca682d4e43fdad8d79c62b3f366d1c4dbadad9758bfd",
+  "@rollup/rollup-linux-arm64-gnu@npm:4.35.0": "ad2cb0b631f3163709706d77d9ef111bc2bd2cefe9484b89ab00069a150df7d84ddfb3d0bec0e488363f8dcb0dacc1333533e5223ddf818af3d5da84201a1952",
+  "@rollup/rollup-linux-arm64-musl@npm:4.35.0": "c757a761365e717b2cc48b136d7ba1d0bb298ab475639dbe9393328354afde574248ee278ed66fd7715e72bd56b82f5a84e280dd5358d98736e6f6eaabad6509",
+  "@rollup/rollup-linux-loongarch64-gnu@npm:4.35.0": "44c1b076ebdea504f1bf64fe17770a1702e833fc84f1fb47a5263d03c965dbae3a18573c594fbacc1a618088dcba42f5dc004bd85c694e72317b84b8e76c0d26",
+  "@rollup/rollup-linux-powerpc64le-gnu@npm:4.35.0": "24cd93ccc079d4c5af42f06b3b7ce065056ec143720ccf54002e9539934863fda88771fdd62c6dc6388e6d35f15e5e562e372eda86a1a68232b33744e75b8917",
+  "@rollup/rollup-linux-riscv64-gnu@npm:4.35.0": "2ef06fd488795343cd8f91fb684679a08c5ecc2084e831335358e668d3ea02e121dca662cb8685f2ad16802b6c04eadb0891b1036e800eff1d4b3de258f7011c",
+  "@rollup/rollup-linux-s390x-gnu@npm:4.35.0": "37a11392d357debd1c9d3c03540028dc4d733e91e1f11525951fb76b572cadfadac821062436bf72100e4cea83e796d1d34c9331834d56cdae9b5fb1cf676ed7",
+  "@rollup/rollup-linux-x64-gnu@npm:4.35.0": "6406cd583d15a9b6862ed8baa70b90de271663127a9729456efec31b8647d882f3ed3ea5d630cfa46b7330e5795babfa090874feb5a832b9b0964eb01fba1e79",
+  "@rollup/rollup-linux-x64-musl@npm:4.35.0": "102d679f7347ec8986eb5ceb7eaed73f1948b53f8867ae90f2e60b0efa04acc462d6d7f32ee14c73194e965fca15edcb629bb323865f3ad7953695fcd2e7aaca",
+  "@rollup/rollup-win32-arm64-msvc@npm:4.35.0": "5344cd7bebdea17e5b8cd517e5ef590df7db23e1589d1bc1665839cb9fea82e331b69fd06859efad00544bf24a5b2af33e3f3f08e1c1a58322cddf52d5b3829a",
+  "@rollup/rollup-win32-ia32-msvc@npm:4.35.0": "30bd40356401961443c5e2a9c2e96d086d491e7cd956de34bd073a0cbcc8f3a4c87c4e29601b8b27ef1f7d3a13f89e4a59fd6458bd7ef43565b7ac72b2ff30b0",
+  "@rollup/rollup-win32-x64-msvc@npm:4.35.0": "c684bf21414814a3f7d451be07c1716fc85bf340bcc87eb37ed3f5ea0adbef869af533392971fdc44c932de8b43b9161237cd093a47e233caf66c7be76f54a9d"
+}
@@ -0,0 +1,91 @@
+{
+  lib,
+  fetchFromGitHub,
+  stdenv,
+  nodejs,
+  yarn-berry_4,
+  makeWrapper,
+}:
+
+let
+  yarn-berry = yarn-berry_4;
+in
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "peacock";
+  version = "8.3.0";
+
+  src = fetchFromGitHub {
+    owner = "thepeacockproject";
+    repo = "Peacock";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-AegJ5h2sxs8iheBLbIBwZXjjZLk5GdcDVLbF4ldcmZ0=";
+  };
+
+  nativeBuildInputs = [
+    nodejs
+    yarn-berry.yarnBerryConfigHook
+    yarn-berry
+    makeWrapper
+  ];
+
+  buildPhase = ''
+    runHook preBuild
+
+    yarn build
+    yarn optimize
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    node chunk0.js noop
+
+    # Keep more or less in sync with https://github.com/thepeacockproject/Peacock/blob/master/packaging/ciAssemble.sh
+    # Not all output files are required.
+
+    OUT_DIR="$out/share/peacock"
+    mkdir -p "$OUT_DIR" "$out/bin"
+
+    cp packaging/HOW_TO_USE.html "$OUT_DIR"
+    cp chunk*.js "$OUT_DIR"
+
+    mkdir "$OUT_DIR"/resources
+    cp resources/dynamic_resources_h3.rpkg "$OUT_DIR"/resources/dynamic_resources_h3.rpkg
+    cp resources/dynamic_resources_h2.rpkg "$OUT_DIR"/resources/dynamic_resources_h2.rpkg
+    cp resources/dynamic_resources_h1.rpkg "$OUT_DIR"/resources/dynamic_resources_h1.rpkg
+
+    cp -r resources/challenges "$OUT_DIR"/resources/challenges
+    cp -r resources/mastery "$OUT_DIR"/resources/mastery
+    cp resources/contracts.prp "$OUT_DIR"/resources/contracts.prp
+    mkdir "$OUT_DIR"/webui
+    mkdir "$OUT_DIR"/webui/dist
+    cp webui/dist/*.html "$OUT_DIR"/webui/dist
+    cp -r webui/dist/assets "$OUT_DIR"/webui/dist/assets
+    cp webui/dist/THIRDPARTYNOTICES.txt "$OUT_DIR"/webui/dist/THIRDPARTYNOTICES.txt
+    cp options.ini "$OUT_DIR"
+
+    makeWrapper ${lib.getExe nodejs} "$out/bin/peacock" \
+      --add-flags "$OUT_DIR/chunk0.js"
+
+    runHook postInstall
+  '';
+
+  missingHashes = ./missing-hashes.json;
+  offlineCache = yarn-berry.fetchYarnBerryDeps {
+    inherit (finalAttrs) src missingHashes;
+    hash = "sha256-sB0oag0sheimho8pn25HSc8GMeuS1RTmHLZUPiSSDqE=";
+  };
+
+  meta = {
+    description = "Server replacement for the HITMAN™ World of Assassination trilogy";
+    homepage = "https://thepeacockproject.org/";
+    changelog = "https://github.com/thepeacockproject/Peacock/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.agpl3Only;
+    maintainers = with lib.maintainers; [ marie ];
+    mainProgram = "peacock";
+    platforms = lib.platforms.linux;
+  };
+})
@@ -7,16 +7,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "polarity";
-  version = "latest-unstable-2025-09-25";
+  version = "latest-unstable-2025-10-09";

  src = fetchFromGitHub {
    owner = "polarity-lang";
    repo = "polarity";
-    rev = "e582716daae20d534f7c7ecc58569bfd28d679f2";
-    hash = "sha256-L9eBD8rA8cBdd2FFeyFKSl8/lse1OlgogEOTkVYkxHo=";
+    rev = "08e5ab1593ec2658bcd87b8e915098c218112691";
+    hash = "sha256-cJDdPUNx7greggrNXuRJ+vq+cr8FlacaSNGIamJSdck=";
  };

-  cargoHash = "sha256-EB6DlhD+0oneAGhLHi3bWnnFUIfNdKeW52umWHZEP7c=";
+  cargoHash = "sha256-ikjFczHc7iPUAksbo9URQN4YCz6DP61p5HhOEhZTqo0=";

  passthru.updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; };

@@ -11,16 +11,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "prqlc";
-  version = "0.13.4";
+  version = "0.13.5";

  src = fetchFromGitHub {
    owner = "prql";
    repo = "prql";
    rev = version;
-    hash = "sha256-lJkZXiwZUr/qACb9X52EGR0FBOicuPMmyA1105G7gZU=";
+    hash = "sha256-XMxwxg7ij8PBKDWgEfyqCNNPz+a2D5GjIwIS8TMDSHo=";
  };

-  cargoHash = "sha256-Dq5jfj5Z4W9x43LncgWspOWVtGnsJPQ8xvC1gGYiPYw=";
+  cargoHash = "sha256-Rw3BZ+l6NiFIhH2zD4UG2hW9st0XP5/UPl1xtvm0XzE=";

  nativeBuildInputs = [
    pkg-config
@@ -6,11 +6,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "pv";
-  version = "1.9.34";
+  version = "1.9.42";

  src = fetchurl {
    url = "https://www.ivarch.com/programs/sources/pv-${finalAttrs.version}.tar.gz";
-    hash = "sha256-wGJr7Wy+9QBrU9MoHo465LKDhylGKyHszygUDu/va7E=";
+    hash = "sha256-+9fRsE7+5iyCQSVaP+HF9SNvGm4e2F8CcwsMZEiBAXU=";
  };

  meta = {
@@ -1,12 +1,12 @@
 # Generated by ./update.sh - do not update manually!
-# Last updated: 2025-09-22
+# Last updated: 2025-10-11
 { fetchurl }:
 let
  any-darwin = {
-    version = "6.9.80-2025-09-04";
+    version = "6.9.81-2025-09-29";
    src = fetchurl {
-      url = "https://dldir1v6.qq.com/qqfile/qq/QQNT/Mac/QQ_6.9.80_250904_01.dmg";
-      hash = "sha256-VUjgWQIxabjXkXJhxQiQJlYDkbLDNLaVQeRaZ4WGOIs=";
+      url = "https://dldir1v6.qq.com/qqfile/qq/QQNT/Mac/QQ_6.9.81_250929_01.dmg";
+      hash = "sha256-OfHkY+hf1ZOKWnq+YewuweFz0+Qiib4KB37SuA2p7yg=";
    };
  };
 in
@@ -10,13 +10,13 @@

 buildGoModule rec {
  pname = "remote-touchpad";
-  version = "1.5.0";
+  version = "1.5.2";

  src = fetchFromGitHub {
    owner = "unrud";
    repo = "remote-touchpad";
    rev = "v${version}";
-    sha256 = "sha256-UZjbU9Ti5+IjcxIf+LDWlcqxb4kMIwa8zHmZDdZbnw8=";
+    sha256 = "sha256-mIPBUREv2uIiIiucPyKLBmf8OJPVPsbc8QI9v3NTBIQ=";
  };

  buildInputs = [
@@ -27,7 +27,7 @@ buildGoModule rec {
  ];
  tags = [ "portal,x11" ];

-  vendorHash = "sha256-4TJ9Nok1P3qze69KvrwFo5sMJ4nDYhDNuApsNlZLWCI=";
+  vendorHash = "sha256-d2kKF13ESntZ0pRTYs5eFpkCTuOhei/bTyTmdYWvvRY=";

  meta = with lib; {
    description = "Control mouse and keyboard from the web browser of a smartphone";
@@ -27,13 +27,13 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "ruffle";
-  version = "0.2.0-nightly-2025-10-05";
+  version = "0.2.0-nightly-2025-10-12";

  src = fetchFromGitHub {
    owner = "ruffle-rs";
    repo = "ruffle";
    tag = lib.strings.removePrefix "0.2.0-" finalAttrs.version;
-    hash = "sha256-u12Qfc0fmcs7TU35/gqfRxjSpw9SDbc4+ebR7lGpvJI=";
+    hash = "sha256-QJ1Mz1CR/2NIKiNA7DfjYrurHAtQxvZephJQCLxbmwc=";
  };

  postPatch =
@@ -49,7 +49,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
                       "OpenH264Version(${major}, ${minor}, ${patch})"
    '';

-  cargoHash = "sha256-v/3vf7YYJiz+PMBsznvOJsNLtv6bEQ9pffAI33rLVuw=";
+  cargoHash = "sha256-zFmGusWYN0PJ+3Q89JMixehWYigYqmWZCG+lgyLkUhE=";
  cargoBuildFlags = lib.optional withRuffleTools "--workspace";

  env =
@@ -13,13 +13,13 @@

 buildGoModule rec {
  pname = "runme";
-  version = "3.15.2";
+  version = "3.15.4";

  src = fetchFromGitHub {
    owner = "runmedev";
    repo = "runme";
    rev = "v${version}";
-    hash = "sha256-NtFKzObi0mIdzhRiu7CCZ3e4yIhI2gHMtVsdf5TEb/s=";
+    hash = "sha256-RU2VU+yLBrnj9Gf1p0kB2Y6rfPaXIDQ8oMs2MaoJ5kM=";
  };

  vendorHash = "sha256-Uw5igaQpKKI4y7EoznFdmyTXfex350Pps6nt3lvKeAM=";
@@ -1,19 +1,14 @@
 {
-  stdenv,
  lib,
+  stdenv,
  fetchFromGitHub,
-  wrapQtAppsHook,
+  autoPatchelfHook,
  makeDesktopItem,
  copyDesktopItems,
  cmake,
  pkg-config,
  catch2_3,
-  qtbase,
-  qtsvg,
-  qttools,
-  qtwayland,
-  qwt,
-  qscintilla,
+  kdePackages,
  kissfftFloat,
  crossguid,
  reproc,
@@ -31,7 +26,6 @@
  parallel,

  withTauWidget ? false,
-  qtwebengine,

  withImGui ? false,
  gl3w,
@@ -44,29 +38,30 @@ let
  ruby = ruby_3_2;
 in

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "sonic-pi";
-  version = "4.5.1";
+  version = "4.6.0";

  src = fetchFromGitHub {
    owner = "sonic-pi-net";
    repo = "sonic-pi";
-    rev = "v${version}";
-    hash = "sha256-JMextQY0jLShWmqRQoVAbqIzDhA1mOzI7vfsG7+jjX0=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-sF/ksVhUzSV5P3Oe/T8hAiFMFiuOMEPmuBlUZtPSvtk=";
  };

  mixFodDeps = beamPackages.fetchMixDeps {
-    inherit version;
+    inherit (finalAttrs) version;
    pname = "mix-deps-sonic-pi";
    mixEnv = "test";
-    src = "${src}/app/server/beam/tau";
-    hash = "sha256-7wqFI3f0CRVrXK2IUguqHNANwKMmTak/Xh9nr624TXc=";
+    src = "${finalAttrs.src}/app/server/beam/tau";
+    hash = "sha256-UoETv6X/Q/RmKb0uCsu59DH7OF0H+A9e7+4uRM/B1Wk=";
  };

  strictDeps = true;

  nativeBuildInputs = [
-    wrapQtAppsHook
+    autoPatchelfHook
+    kdePackages.wrapQtAppsHook
    copyDesktopItems
    cmake
    pkg-config
@@ -77,12 +72,12 @@ stdenv.mkDerivation rec {
  ];

  buildInputs = [
-    qtbase
-    qtsvg
-    qttools
-    qtwayland
-    qwt
-    qscintilla
+    kdePackages.qtbase
+    kdePackages.qtsvg
+    kdePackages.qttools
+    kdePackages.qtwayland
+    kdePackages.qwt
+    kdePackages.qscintilla
    kissfftFloat
    catch2_3
    crossguid
@@ -95,7 +90,7 @@ stdenv.mkDerivation rec {
    aubio
  ]
  ++ lib.optionals withTauWidget [
-    qtwebengine
+    kdePackages.qtwebengine
  ]
  ++ lib.optionals withImGui [
    gl3w
@@ -118,57 +113,63 @@ stdenv.mkDerivation rec {

  doCheck = true;

+  # Fix shebangs on files in app and bin scripts
  postPatch = ''
-    # Fix shebangs on files in app and bin scripts
    patchShebangs app bin
  '';

-  preConfigure = ''
+  preConfigure =
    # Set build environment
-    export SONIC_PI_HOME="$TMPDIR/spi"
-
-    export HEX_HOME="$TEMPDIR/hex"
-    export HEX_OFFLINE=1
-    export MIX_REBAR3='${beamPackages.rebar3}/bin/rebar3'
-    export REBAR_GLOBAL_CONFIG_DIR="$TEMPDIR/rebar3"
-    export REBAR_CACHE_DIR="$TEMPDIR/rebar3.cache"
-    export MIX_HOME="$TEMPDIR/mix"
-    export MIX_DEPS_PATH="$TEMPDIR/deps"
-    export MIX_ENV=prod
+    ''
+      export SONIC_PI_HOME="$TMPDIR/spi"

+      export HEX_HOME="$TEMPDIR/hex"
+      export HEX_OFFLINE=1
+      export MIX_REBAR3='${beamPackages.rebar3}/bin/rebar3'
+      export REBAR_GLOBAL_CONFIG_DIR="$TEMPDIR/rebar3"
+      export REBAR_CACHE_DIR="$TEMPDIR/rebar3.cache"
+      export MIX_HOME="$TEMPDIR/mix"
+      export MIX_DEPS_PATH="$TEMPDIR/deps"
+      export MIX_ENV=prod
+    ''
    # Copy Mix dependency sources
-    echo 'Copying ${mixFodDeps} to Mix deps'
-    cp --no-preserve=mode -R '${mixFodDeps}' "$MIX_DEPS_PATH"
-
+    + ''
+      echo 'Copying ${finalAttrs.mixFodDeps} to Mix deps'
+      cp --no-preserve=mode -R '${finalAttrs.mixFodDeps}' "$MIX_DEPS_PATH"
+    ''
    # Change to project base directory
-    cd app
-
+    + ''
+      cd app
+    ''
    # Prebuild Ruby vendored dependencies and Qt docs
-    ./linux-prebuild.sh -o
-  '';
+    + ''
+      ./linux-prebuild.sh -o
+    '';

+  # Build BEAM server
  postBuild = ''
-    # Build BEAM server
    ../linux-post-tau-prod-release.sh -o
  '';

  checkPhase = ''
    runHook preCheck
-
-    # BEAM tests
+  ''
+  # BEAM tests
+  + ''
    pushd ../server/beam/tau
-      MIX_ENV=test TAU_ENV=test mix test
+    MIX_ENV=test TAU_ENV=test mix test
    popd
-
-    # Ruby tests
+  ''
+  # Ruby tests
+  + ''
    pushd ../server/ruby
-      rake test
+    rake test
    popd
-
-    # API tests
+  ''
+  # API tests, run JACK parallel to tests and quit both when one exits
+  + ''
    pushd api-tests
-      # run JACK parallel to tests and quit both when one exits
-      SONIC_PI_ENV=test parallel --no-notice -j2 --halt now,done=1 ::: 'jackd -rd dummy' 'ctest --verbose'
+    SONIC_PI_ENV=test parallel --no-notice -j2 --halt now,done=1 ::: 'jackd -rd dummy' 'ctest --verbose'
    popd

    runHook postCheck
@@ -176,16 +177,19 @@ stdenv.mkDerivation rec {

  installPhase = ''
    runHook preInstall
-
-    # Run Linux release script
+  ''
+  # Run Linux release script
+  + ''
    ../linux-release.sh
-
-    # Copy dist directory to output
+  ''
+  # Copy dist directory to output
+  + ''
    mkdir $out
    cp -r linux_dist/* $out/
-
-    # Copy icon
-    install -Dm644 ../gui/qt/images/icon-smaller.png $out/share/icons/hicolor/256x256/apps/sonic-pi.png
+  ''
+  # Copy icon
+  + ''
+    install -D --mode=0644 ../gui/images/icon-smaller.png $out/share/icons/hicolor/256x256/apps/sonic-pi.png

    runHook postInstall
  '';
@@ -193,7 +197,10 @@ stdenv.mkDerivation rec {
  # $out/bin/sonic-pi is a shell script, and wrapQtAppsHook doesn't wrap them.
  dontWrapQtApps = true;
  preFixup = ''
-    # Wrap Qt GUI (distributed binary)
+    patchelf --shrink-rpath --allowed-rpath-prefixes "$NIX_STORE" $out/app/build/gui/sonic-pi
+  ''
+  # Wrap Qt GUI (distributed binary)
+  + ''
    wrapQtApp $out/bin/sonic-pi \
      --prefix PATH : ${
        lib.makeBinPath [
@@ -204,10 +211,10 @@ stdenv.mkDerivation rec {
          pipewire.jack
        ]
      }
-
-    # If ImGui was built
+  ''
+  # If ImGui was built, Wrap ImGui into bin
+  + ''
    if [ -e $out/app/build/gui/imgui/sonic-pi-imgui ]; then
-      # Wrap ImGui into bin
      makeWrapper $out/app/build/gui/imgui/sonic-pi-imgui $out/bin/sonic-pi-imgui \
        --inherit-argv0 \
        --prefix PATH : ${
@@ -220,10 +227,11 @@ stdenv.mkDerivation rec {
          ]
        }
    fi
-
-    # Remove runtime Erlang references
+  ''
+  # Remove runtime Erlang references
+  + ''
    for file in $(grep -FrIl '${beamPackages.erlang}/lib/erlang' $out/app/server/beam/tau); do
-      substituteInPlace "$file" --replace '${beamPackages.erlang}/lib/erlang' $out/app/server/beam/tau/_build/prod/rel/tau
+      substituteInPlace "$file" --replace-fail '${beamPackages.erlang}/lib/erlang' $out/app/server/beam/tau/_build/prod/rel/tau
    done
  '';

@@ -238,7 +246,7 @@ stdenv.mkDerivation rec {
      exec = "sonic-pi";
      icon = "sonic-pi";
      desktopName = "Sonic Pi";
-      comment = meta.description;
+      comment = finalAttrs.meta.description;
      categories = [
        "Audio"
        "AudioVideo"
@@ -249,16 +257,16 @@ stdenv.mkDerivation rec {

  passthru.updateScript = ./update.sh;

-  meta = with lib; {
+  meta = {
    homepage = "https://sonic-pi.net/";
    description = "Free live coding synth for everyone originally designed to support computing and music lessons within schools";
-    license = licenses.mit;
-    maintainers = with maintainers; [
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [
      Phlogistique
      kamilchm
      c0deaddict
      sohalt
    ];
-    platforms = platforms.linux;
+    platforms = lib.platforms.linux;
  };
-}
+})
@@ -11,7 +11,7 @@
 stdenv.mkDerivation {
  inherit pname;

-  version = "1.2.72.438";
+  version = "1.2.74.477";

  src =
    # WARNING: This Wayback Machine URL redirects to the closest timestamp.
@@ -20,13 +20,13 @@ stdenv.mkDerivation {
    # https://web.archive.org/web/*/https://download.scdn.co/Spotify.dmg
    if stdenv.hostPlatform.isAarch64 then
      (fetchurl {
-        url = "https://web.archive.org/web/20250912003756/https://download.scdn.co/SpotifyARM64.dmg";
-        hash = "sha256-K+dwlT4hd/SWbQT23ESZY8gGQ8bf5x5CpepMz5Wd6Ng=";
+        url = "https://web.archive.org/web/20251010104459/https://download.scdn.co/SpotifyARM64.dmg";
+        hash = "sha256-0gwoptqLBJBM0qJQ+dGAZdCD6WXzDJEs0BfOxz7f2nQ=";
      })
    else
      (fetchurl {
-        url = "https://web.archive.org/web/20250912003614/https://download.scdn.co/Spotify.dmg";
-        hash = "sha256-qGoU8wWfuGvAZR4/998kvoPTqkaJPHASTRyZL8Kitzs=";
+        url = "https://web.archive.org/web/20251010104433/https://download.scdn.co/Spotify.dmg";
+        hash = "sha256-8CrhLbnswbuAjRMaan2cTnnOMsr3vpW92IQ00KwPUHo=";
      });

  nativeBuildInputs = [ undmg ];
@@ -48,6 +48,7 @@ stdenv.mkDerivation {
    maintainers = with lib.maintainers; [
      matteopacini
      Enzime
+      iedame
    ];
  };
 }
@@ -10,13 +10,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "superhtml";
-  version = "0.6.0";
+  version = "0.6.1";

  src = fetchFromGitHub {
    owner = "kristoff-it";
    repo = "superhtml";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-EWxnozmYTvkX7mn+pVel083Cte1uzvHaes1c7iXPMUg=";
+    hash = "sha256-jwyhTD3QP017W6sjWhujeSo0C/kPRKyaJqSiSWIsqdc=";
  };

  nativeBuildInputs = [
@@ -10,16 +10,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "surface-control";
-  version = "0.4.8-1";
+  version = "0.4.9-1";

  src = fetchFromGitHub {
    owner = "linux-surface";
    repo = "surface-control";
    tag = "v${version}";
-    hash = "sha256-ZooqPlvxx+eBFEIf9Y1iU6zhhgafGUw28G5cwdF/E78=";
+    hash = "sha256-CcLHaakWhrzfDrNoXGQom9LkdlkTUkTui7djn3m+vhI=";
  };

-  cargoHash = "sha256-gv/ipOQ1kmLc9YxxwuXc/rq6YUdVw2FhrI9C+DHxIDM=";
+  cargoHash = "sha256-46JqH3FIO1zMeWqNEL8NcfU+Tiaanr99EBMjnr9tE+g=";

  nativeBuildInputs = [
    pkg-config
@@ -7,16 +7,16 @@

 buildGoModule (finalAttrs: {
  pname = "tinfoil-cli";
-  version = "0.1.3";
+  version = "0.1.4";

  src = fetchFromGitHub {
    owner = "tinfoilsh";
    repo = "tinfoil-cli";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-yOFlQxMRxrdC1w8r8D9b0qrwGLjEflgcvLX5Q8ntMJY=";
+    hash = "sha256-prLp9IpBINFNfam23ErvcwlOrLZ4pFoZn8C7/w3kdZs=";
  };

-  vendorHash = "sha256-L4wdnxm5fOtGymIZfr/YYTDnXpREgZmEthcZV1ploI4=";
+  vendorHash = "sha256-wZlpxAwWgFpuLhbG6EBhBbFMgyZ7yZxCaiBYz4utCto=";

  # The attestation test requires internet access
  checkFlags = [ "-skip=TestAttestationVerifySEV" ];
@@ -9,19 +9,19 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "tombi";
-  version = "0.6.19";
+  version = "0.6.25";

  src = fetchFromGitHub {
    owner = "tombi-toml";
    repo = "tombi";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-ILW9U+K3DRYsBjqmTd6diUfP441wa6qwjjBgfwObnHo=";
+    hash = "sha256-J7H7m6Z6CpzvZuX2PF2DAvw4UT6GIs1qGWZ5xJmQUO8=";
  };

  # Tests relies on the presence of network
  doCheck = false;
  cargoBuildFlags = [ "--package tombi-cli" ];
-  cargoHash = "sha256-BCBnrIG35RMeqVEltxgtacsKzJ/0nxKiMpLiWoDpv/g=";
+  cargoHash = "sha256-BN9jduAGLPkfnphCqjXZ7Tgcwnh2bA/zghkmR2kwDe4=";

  postPatch = ''
    substituteInPlace Cargo.toml \
@@ -23,13 +23,13 @@ assert lib.elem lineEditingLibrary [
 ];
 stdenv.mkDerivation (finalAttrs: {
  pname = "trealla";
-  version = "2.83.13";
+  version = "2.83.17";

  src = fetchFromGitHub {
    owner = "trealla-prolog";
    repo = "trealla";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-hDInThx2RhpIOzw+OA2ZpW0pSxWf4IafUDrubZKFadU=";
+    hash = "sha256-mJuafIfRfyhD8yMqAjM749qbLqX4n+Gq53YZKCibB7A=";
  };

  postPatch = ''
@@ -18,14 +18,14 @@

 python3Packages.buildPythonApplication rec {
  pname = "video-downloader";
-  version = "0.12.27";
+  version = "0.12.28";
  pyproject = false; # Built with meson

  src = fetchFromGitHub {
    owner = "Unrud";
    repo = "video-downloader";
    tag = "v${version}";
-    hash = "sha256-OSu2I+c78We7C7OaPaqA09uilnIwQcNN1oNxL8v0kF0=";
+    hash = "sha256-8BEKlg0k4vqgnbG737waKcEqWAnxeL+Vr6bD/1zFVdg=";
  };

  propagatedBuildInputs = with python3Packages; [
@@ -70,13 +70,13 @@ let
 in
 effectiveStdenv.mkDerivation (finalAttrs: {
  pname = "whisper-cpp";
-  version = "1.8.0";
+  version = "1.8.1";

  src = fetchFromGitHub {
    owner = "ggml-org";
    repo = "whisper.cpp";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-6mEBhxZNAXu+Ya/jbI0G0tb6Wf5Wqz4KxPEZSrfsgv8=";
+    hash = "sha256-lE25O/C55INo4xufCSzrPFX2kyodXiKwf80kknIy1Os=";
  };

  # The upstream download script tries to download the models to the
@@ -9,13 +9,13 @@

 buildGoModule rec {
  pname = "xk6";
-  version = "1.1.5";
+  version = "1.1.6";

  src = fetchFromGitHub {
    owner = "grafana";
    repo = "xk6";
    tag = "v${version}";
-    hash = "sha256-+hWZWWrFkenzmaXAgzuZ9eWB4DmhQZNAQV+FYQdEg2U=";
+    hash = "sha256-9sCf4EOYsyOv1OZbFOU/O6B0GN4JVz3bUi75IDveceA=";
  };

  vendorHash = null;
@@ -2,6 +2,7 @@
  lib,
  stdenv,
  fetchFromGitHub,
+  fetchpatch,
  cmake,
 }:

@@ -16,6 +17,14 @@ stdenv.mkDerivation (finalAttrs: {
    hash = "sha256-79yyOGKgqUR1KI2+ngZd7jfVcz4Dw1IxaYfBJyjsxYc=";
  };

+  patches = [
+    # upgrade cmake minimum version
+    (fetchpatch {
+      url = "https://github.com/HardySimpson/zlog/commit/3715879775f725260aeda14f94887bbc7a007e29.patch?full_index=1";
+      hash = "sha256-RCI+jZauSO0O0ETjs0nUd4CC2wLLVsjH8iuOmIgWhck=";
+    })
+  ];
+
  nativeBuildInputs = [ cmake ];

  meta = {
@@ -12,13 +12,13 @@

 stdenvNoCC.mkDerivation rec {
  pname = "numix-icon-theme";
-  version = "25.01.31";
+  version = "25.10.04.2";

  src = fetchFromGitHub {
    owner = "numixproject";
    repo = "numix-icon-theme";
    rev = version;
-    sha256 = "sha256-LON73XRVZQxbEMJ32qKXU/TYf6Q8nWU9wms7eT/DHa8=";
+    sha256 = "sha256-im3stA90tyn1JOx8ygF0nnPk+xeJMQB6sShYy8Kk3Hw=";
  };

  nativeBuildInputs = [
@@ -5,17 +5,21 @@
  standard-library,
 }:

-mkDerivation rec {
+mkDerivation {
  pname = "agdarsec";
-  version = "0.4.1";
+  version = "0.5.0-unstable-2025-08-05";

  src = fetchFromGitHub {
    owner = "gallais";
    repo = "agdarsec";
-    rev = "v${version}";
-    sha256 = "02fqkycvicw6m2xsz8p01aq8n3gj2d2gyx8sgj15l46f8434fy0x";
+    rev = "28c5233e905474f3b02cb97fe410beb60364ba80";
+    sha256 = "sha256-IMxRqZQ7XtPT2cDkoP5mBAj2ovMf5cHcN4U4V5FMEaQ=";
  };

+  postPatch = ''
+    sed -Ei 's/standard-library-[0-9.]+/standard-library/' agdarsec.agda-lib
+  '';
+
  buildInputs = [ standard-library ];

  meta = with lib; {
@@ -24,6 +28,5 @@ mkDerivation rec {
    license = licenses.gpl3;
    platforms = platforms.unix;
    maintainers = with maintainers; [ turion ];
-    broken = true;
  };
 }
@@ -87,7 +87,15 @@ let
        substituteInPlace Configurations/unix-Makefile.tmpl \
          --replace 'ENGINESDIR=$(libdir)/engines-{- $sover_dirname -}' \
                    'ENGINESDIR=$(OPENSSLDIR)/engines-{- $sover_dirname -}'
-      '';
+      ''
+      # This test will fail if the error strings between the build libc and host
+      # libc mismatch, e.g. when cross-compiling from glibc to musl
+      +
+        lib.optionalString
+          (finalAttrs.finalPackage.doCheck && stdenv.hostPlatform.libc != stdenv.buildPlatform.libc)
+          ''
+            rm test/recipes/02-test_errstr.t
+          '';

      outputs = [
        "bin"
@@ -62,6 +62,9 @@ stdenv.mkDerivation rec {
  cmakeFlags = [
    "-DGLIB_SCHEMAS_DIR=${glib.getSchemaPath gsettings-desktop-schemas}"
    "-DQT_PLUGINS_DIR=${placeholder "out"}/${qtbase.qtPluginPrefix}"
+
+    # Workaround CMake 4 compat
+    (lib.cmakeFeature "CMAKE_POLICY_VERSION_MINIMUM" "3.31")
  ]
  ++ lib.optionals useQt6 [
    "-DUSE_QT6=true"
@@ -9,7 +9,7 @@

 buildPythonPackage rec {
  pname = "airportsdata";
-  version = "20250909.5";
+  version = "20251008";
  pyproject = true;

  disabled = pythonOlder "3.9";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
    owner = "mborsetti";
    repo = "airportsdata";
    tag = "v${version}";
-    hash = "sha256-c6OFzYI6YOIZvpEsYbzLqT6q0CYNczRcKLb+6cKy2fQ=";
+    hash = "sha256-9Y4W5yhICiB5Py36RoVTe7obVtKUaUf0du2i1AihFdE=";
  };

  build-system = [ setuptools ];
@@ -80,7 +80,7 @@
 }:

 let
-  version = "1.4.25";
+  version = "1.4.26";
  aws = [ fs-s3fs ];
  grpc = [
    grpcio
@@ -130,7 +130,7 @@ let
    owner = "bentoml";
    repo = "BentoML";
    tag = "v${version}";
-    hash = "sha256-07LR0Q2inKRKn6NHHldv8kSFtCBcZvGd+VfEEhxc2Ac=";
+    hash = "sha256-ORddC+rbK1vWwgY2vGNPoR9ot/a0EhU72HHubYTk+ac=";
  };
 in
 buildPythonPackage {
@@ -19,14 +19,14 @@

 buildPythonPackage rec {
  pname = "cashews";
-  version = "7.4.1";
+  version = "7.4.3";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "Krukov";
    repo = "cashews";
    tag = version;
-    hash = "sha256-EQBILaNg7bJhKMz+raWWfsXmaBmJlcE8niXp8BnfzUE=";
+    hash = "sha256-L6EpSZ6ssRV9fQLuJ6SxKB8QS9fo4qAQ3YKcc1u7sHY=";
  };

  build-system = [ setuptools ];
@@ -12,7 +12,7 @@

 buildPythonPackage rec {
  pname = "cryptg";
-  version = "0.5.1";
+  version = "0.5.2";
  pyproject = true;

  disabled = pythonOlder "3.7";
@@ -21,12 +21,12 @@ buildPythonPackage rec {
    owner = "cher-nov";
    repo = "cryptg";
    rev = "v${version}";
-    hash = "sha256-jrJy51AfMmLjAyi9FXT3mCi8q1OIpuAdrSS9tmrv3fA=";
+    hash = "sha256-4WerXUEkdkIkVEyZB4EzM1HITvNbO7a1Cfi3bpJGUVA=";
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
    inherit src;
-    hash = "sha256-yOfpFGAy7VsDQrkd13H+ha0AzfXQmzmkIuvzsvY9rfk=";
+    hash = "sha256-kR92lvyBCFxEvIlzRX796XQn71ARrlsfK+fAKrwimEo=";
  };

  build-system = [
@@ -10,14 +10,14 @@

 buildPythonPackage rec {
  pname = "metaflow";
-  version = "2.18.10";
+  version = "2.18.11";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "Netflix";
    repo = "metaflow";
    tag = version;
-    hash = "sha256-kDq+w3BWC8ug4PeLhkXe3JUy2pBLaKqceRBqhtkCGN4=";
+    hash = "sha256-MR/QMweDwfvZiG0WqaP1xELnnpiz3zRBvedOtrQnGZM=";
  };

  build-system = [
@@ -19,14 +19,14 @@

 buildPythonPackage rec {
  pname = "x-transformers";
-  version = "2.8.2";
+  version = "2.8.4";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "lucidrains";
    repo = "x-transformers";
    tag = version;
-    hash = "sha256-ItMa5CPe53g9XlB2LZsdQJ3s0m0oF6ZQnAInajZeq/w=";
+    hash = "sha256-EmZW57xWt62RTOGZ7vYE2YcyUqx1vldsb2874XR9UOo=";
  };

  build-system = [ hatchling ];
@@ -101,11 +101,11 @@ rec {
  # Vulkan developer beta driver
  # See here for more information: https://developer.nvidia.com/vulkan-driver
  vulkan_beta = generic rec {
-    version = "580.94.02";
+    version = "580.94.03";
    persistencedVersion = "580.95.05";
    settingsVersion = "580.95.05";
-    sha256_64bit = "sha256-fhN062tzZq7OwkeRr1lRjhwkX6CH7fJ+oAKXdRTapGE=";
-    openSha256 = "sha256-MbxIJNBGYMesnero5VauMt5cKiNLw3cM9GxD4PnXM/o=";
+    sha256_64bit = "sha256-RYU50xfIyrvk57o7/SIsVr34nkLaMm5WZPXQfWTreIE=";
+    openSha256 = "sha256-PEHr6heOBP+0JjcmUpDv6JlT0aAvzoWijsEsm/DD3rs=";
    settingsSha256 = "sha256-F2wmUEaRrpR1Vz0TQSwVK4Fv13f3J9NJLtBe4UP2f14=";
    persistencedSha256 = "sha256-QCwxXQfG/Pa7jSTBB0xD3lsIofcerAWWAHKvWjWGQtg=";
    url = "https://developer.nvidia.com/downloads/vulkan-beta-${lib.concatStrings (lib.splitVersion version)}-linux";
@@ -6,11 +6,11 @@

 stdenv.mkDerivation rec {
  pname = "advanced-camera-card";
-  version = "7.18.1";
+  version = "7.18.3";

  src = fetchzip {
    url = "https://github.com/dermotduffy/advanced-camera-card/releases/download/v${version}/advanced-camera-card.zip";
-    hash = "sha256-aUoXkoDhAEzKl6YbrSXPnItf0rAYNKa6/PA7mjVnXvo=";
+    hash = "sha256-eNyfXRSF2nSct4+iQoOCkbcN3vmzmIenlO/ng7ThPzM=";
  };

  # TODO: build from source once yarn berry support lands in nixpkgs
@@ -19,7 +19,7 @@ php.buildComposerProject2 (finalAttrs: {

  composerNoDev = false;

-  vendorHash = "sha256-H+yxviMYc6AuerhYtcHRluRWdS1mmqcSMlN2Q24G1m8=";
+  vendorHash = "sha256-KWvHgPeTLy/a6NusLpKBgYJWjSzc+MNF7cE5u31JqKs=";

  postInstall = ''
    chmod -R u+w $out/share
@@ -31,7 +31,7 @@ php.buildComposerProject2 (finalAttrs: {
    description = "Development Nextcloud app to enable apps to use hot module reloading";
    homepage = "https://github.com/nextcloud/hmr_enabler";
    changelog = "https://github.com/nextcloud/hmr_enabler/blob/master/CHANGELOG.md";
-    license = lib.licenses.agpl3Only;
+    license = lib.licenses.agpl3Plus;
    maintainers = with lib.maintainers; [ onny ];
  };

@@ -12443,8 +12443,6 @@ with pkgs;

  spotify-qt = qt6Packages.callPackage ../applications/audio/spotify-qt { };

-  sonic-pi = libsForQt5.callPackage ../applications/audio/sonic-pi { };
-
  stag = callPackage ../applications/misc/stag {
    curses = ncurses;
  };