Merge master into staging-next

2025-12-24 00:18:15 +00:00
parent adba4fe2bc 10ca7c2598
commit a2302e778c
74 changed files with 1697 additions and 1070 deletions
@@ -15158,6 +15158,12 @@
    name = "Jan Schmitt";
    keys = [ { fingerprint = "1763 9903 2D7C 5B82 5D5A  0EAD A2BC 3C6F 1435 1991"; } ];
  };
+  locnide = {
+    email = "locnide@alpaga.dev";
+    github = "locnide";
+    githubId = 49921473;
+    name = "locnide";
+  };
  locochoco = {
    email = "contact@locochoco.dev";
    github = "loco-choco";
@@ -16619,11 +16625,6 @@
    githubId = 22836301;
    name = "Mateusz Mazur";
  };
-  mbaeten = {
-    github = "mbaeten";
-    githubId = 2649304;
-    name = "M. Baeten";
-  };
  mbaillie = {
    email = "martin@baillie.id";
    github = "martinbaillie";
@@ -1,3 +1,4 @@
+# Tests in: nixos/tests/ec2-image.nix
 {
  config,
  lib,
@@ -89,12 +89,11 @@ in
        "crc32c"
      ]
      ++ optionals (config.boot.kernelPackages.kernel.kernelAtLeast "5.5") [
-        # Needed for mounting filesystems with new checksums
-        "xxhash_generic"
-        "blake2b_generic"
-
-        # `sha256` is always available, whereas `sha256_generic` is not available from 6.17 onwards
+        # The canonical names of these modules are not very stable, so use the algorithm names that the btrfs module expects.
+        # See: https://github.com/torvalds/linux/blob/v6.19-rc1/fs/btrfs/super.c#L2705-L2708
+        "xxhash64"
        "sha256" # Should be baked into our kernel, just to be sure
+        "blake2b-256"
      ];

      boot.initrd.extraUtilsCommands = mkIf (!config.boot.initrd.systemd.enable) ''
@@ -1,3 +1,5 @@
+# Tests in: nixos/tests/ec2-image.nix
+
 # This module defines a systemd service that sets the SSH host key and
 # authorized client key and host name of virtual machines running on
 # Amazon EC2, Eucalyptus and OpenStack Compute (Nova).
@@ -85,11 +87,25 @@ with lib;
        # Print the host public key on the console so that the user
        # can obtain it securely by parsing the output of
        # ec2-get-console-output.
+        #
+        # Format follows cloud-init conventions. The delimiters are based on:
+        # - cloud-init write-ssh-key-fingerprints tool:
+        #   https://github.com/canonical/cloud-init/blob/main/tools/write-ssh-key-fingerprints
+        #
+        # FINGERPRINTS section: for pre-26.05 tooling and human interactive consumption
        echo "-----BEGIN SSH HOST KEY FINGERPRINTS-----" > /dev/console
        for i in /etc/ssh/ssh_host_*_key.pub; do
            ${config.programs.ssh.package}/bin/ssh-keygen -l -f "$i" > /dev/console || true
        done
        echo "-----END SSH HOST KEY FINGERPRINTS-----" > /dev/console
+
+        # KEYS section: full public keys for provisioning tools
+        # Keys can be converted directly into SSH known_hosts files
+        echo "-----BEGIN SSH HOST KEY KEYS-----" > /dev/console
+        for i in /etc/ssh/ssh_host_*_key.pub; do
+            cat "$i" > /dev/console
+        done
+        echo "-----END SSH HOST KEY KEYS-----" > /dev/console
      '';
      serviceConfig.Type = "oneshot";
      serviceConfig.RemainAfterExit = true;
@@ -42,7 +42,7 @@ while [ $try -le 3 ]; do
 done

 if [ "$IMDS_TOKEN" == "" ]; then
-  echo "failed to fetch an IMDS2v token."
+  echo "failed to fetch an IMDSv2 token."
 fi

 try=1
@@ -498,6 +498,7 @@ in
  earlyoom = runTestOn [ "x86_64-linux" ] ./earlyoom.nix;
  easytier = runTest ./easytier.nix;
  ec2-config = (handleTestOn [ "x86_64-linux" ] ./ec2.nix { }).boot-ec2-config or { };
+  ec2-image = runTest ./ec2-image.nix;
  ec2-nixops = (handleTestOn [ "x86_64-linux" ] ./ec2.nix { }).boot-ec2-nixops or { };
  echoip = runTest ./echoip.nix;
  ecryptfs = runTest ./ecryptfs.nix;
@@ -0,0 +1,263 @@
+# Run with:
+#   cd nixpkgs
+#   nix-build -A nixosTests.ec2-image
+
+{
+  config,
+  lib,
+  hostPkgs,
+  ...
+}:
+
+let
+  inherit (lib) mkAfter mkForce;
+  pkgs = config.node.pkgs;
+
+  # Build an EC2 image configuration
+  imageCfg =
+    (import ../lib/eval-config.nix {
+      system = null;
+      modules = [
+        ../maintainers/scripts/ec2/amazon-image.nix
+        ../modules/testing/test-instrumentation.nix
+        ../modules/profiles/qemu-guest.nix
+        {
+          amazonImage.format = "qcow2";
+
+          # In a NixOS test the serial console is occupied by the "backdoor"
+          # (see testing/test-instrumentation.nix) and is incompatible with
+          # the configuration in virtualisation/amazon-image.nix.
+          systemd.services."serial-getty@ttyS0".enable = mkForce false;
+
+          # Make /dev/console point to serial console for proper capture
+          # test-instrumentation.nix adds console=tty0, so we need to add console=ttyS0 AFTER it
+          # The last console= parameter takes precedence for /dev/console
+          boot.kernelParams = mkAfter [ "console=ttyS0" ];
+
+          # Configure VLAN networking to match test framework setup
+          networking.interfaces.eth0 = {
+            ipv4.addresses = [
+              {
+                address = config.nodes.machine.networking.primaryIPAddress;
+                prefixLength = 24;
+              }
+            ];
+          };
+
+          nixpkgs.pkgs = pkgs;
+        }
+      ];
+    }).config;
+
+  image = "${imageCfg.system.build.amazonImage}/${imageCfg.image.fileName}";
+
+in
+{
+  name = "ec2-image";
+  meta = {
+    maintainers = with lib.maintainers; [
+      roberth
+      arianvp
+    ];
+    timeout = 600;
+  };
+  nodes = {
+    machine = { ... }: { }; # Dummy node for network config - won't be launched
+    client =
+      { ... }:
+      {
+        # Configure SSH client for non-interactive, strict authentication
+        programs.ssh.extraConfig = ''
+          Host *
+            PasswordAuthentication no
+            ChallengeResponseAuthentication no
+            HostbasedAuthentication no
+            BatchMode yes
+            PubkeyAuthentication yes
+            StrictHostKeyChecking yes
+        '';
+      };
+  };
+
+  testScript = ''
+    import os
+    import re
+    import subprocess
+    import tempfile
+
+    # Instance Metadata Service (IMDSv2 with 1.0 metadata version)
+    # TODO: Use 'latest' metadata version instead of '1.0'
+    #       - Consider https://github.com/aws/amazon-ec2-metadata-mock
+    #         - Blocked on https://github.com/aws/amazon-ec2-metadata-mock/issues/234
+    #       - Consider https://github.com/purpleclay/imds-mock
+    #       - [Test matrix] also test providing the host key through IMDS
+    #         - i.e. a test module argument to select between writing or reading the host key
+    def create_ec2_metadata_dir(temp_dir, client_pubkey):
+        """Create fake EC2 metadata directory structure with mock data"""
+        metadata_dir = os.path.join(temp_dir.name, "ec2-metadata")
+
+        # Create directory structure
+        os.makedirs(os.path.join(metadata_dir, "1.0", "meta-data", "public-keys", "0"), exist_ok=True)
+        os.makedirs(os.path.join(metadata_dir, "latest", "api"), exist_ok=True)
+
+        # Metadata version 1.0 endpoints (what fetch-ec2-metadata.sh actually fetches)
+        with open(os.path.join(metadata_dir, "1.0", "meta-data", "hostname"), "w") as f:
+            f.write("test-instance")
+        with open(os.path.join(metadata_dir, "1.0", "meta-data", "ami-manifest-path"), "w") as f:
+            f.write("(test)")
+        with open(os.path.join(metadata_dir, "1.0", "meta-data", "instance-id"), "w") as f:
+            f.write("i-1234567890abcdef0")
+        with open(os.path.join(metadata_dir, "1.0", "user-data"), "w") as f:
+            f.write("")
+        with open(os.path.join(metadata_dir, "1.0", "meta-data", "public-keys", "0", "openssh-key"), "w") as f:
+            f.write(client_pubkey)
+
+        # IMDSv2 token endpoint - return a fake token
+        with open(os.path.join(metadata_dir, "latest", "api", "token"), "w") as f:
+            f.write("test-token-12345")
+
+        return metadata_dir
+
+    def generate_client_ssh_key():
+        """Generate SSH key pair on VM host for client authentication"""
+        # Use temporary directory for key generation
+        import tempfile
+        with tempfile.TemporaryDirectory() as key_dir:
+            private_key = os.path.join(key_dir, "id_ed25519")
+            public_key = os.path.join(key_dir, "id_ed25519.pub")
+
+            # Generate key pair using host SSH tools
+            ret = os.system(f"${hostPkgs.openssh}/bin/ssh-keygen -t ed25519 -f {private_key} -N \"\"")
+            if ret != 0:
+                raise Exception("Failed to generate SSH key pair")
+
+            # Read the generated public key
+            with open(public_key, "r") as f:
+                client_pubkey = f.read().strip()
+
+            # Read the private key
+            with open(private_key, "r") as f:
+                client_private_key = f.read()
+
+            return client_pubkey, client_private_key
+
+    def setup_client_ssh_key(client, client_private_key):
+        """Install the pre-generated SSH private key on client"""
+        client.succeed("mkdir -p /root/.ssh")
+        client.succeed(f"cat > /root/.ssh/id_ed25519 << 'EOF'\n{client_private_key}\nEOF")
+        client.succeed("chmod 600 /root/.ssh/id_ed25519")
+
+    def setup_machine(temp_dir, client_pubkey):
+        """Initialize EC2 machine with disk image, metadata server, and networking"""
+        # Set up disk image
+        image_dir = os.path.join(
+            os.environ.get("TMPDIR", tempfile.gettempdir()), "tmp", "vm-state-machine"
+        )
+        os.makedirs(image_dir, mode=0o700, exist_ok=True)
+        disk_image = os.path.join(image_dir, "machine.qcow2")
+        subprocess.check_call([
+            "qemu-img", "create", "-f", "qcow2", "-F", "qcow2",
+            "-o", "backing_file=${image}", disk_image
+        ])
+        subprocess.check_call(["qemu-img", "resize", disk_image, "10G"])
+
+        # Create fake EC2 metadata in temporary directory with client's public key
+        metadata_dir = create_ec2_metadata_dir(temp_dir, client_pubkey)
+
+        # Add both VLAN networking (matching test framework) and EC2 metadata server
+        vlan_net = (
+            " -device virtio-net-pci,netdev=vlan1,mac=52:54:00:12:01:02"
+            + ' -netdev vde,id=vlan1,sock="$QEMU_VDE_SOCKET_1"'
+        )
+        metadata_net = (
+            " -device virtio-net-pci,netdev=ec2meta"
+            + f" -netdev 'user,id=ec2meta,net=169.0.0.0/8,guestfwd=tcp:169.254.169.254:80-cmd:${pkgs.micro-httpd}/bin/micro_httpd {metadata_dir}'"
+        )
+
+        start_command = (
+            "qemu-kvm -m 1024"
+            + f" -drive file={disk_image},if=virtio,werror=report"
+            + vlan_net
+            + metadata_net
+            + " $QEMU_OPTS"
+        )
+
+        return create_machine(start_command)
+
+    # Create temporary directory for metadata (scoped for cleanup)
+    temp_dir = tempfile.TemporaryDirectory()
+
+    # Start client first (but don't wait for it to boot)
+    client.start()
+
+    # Generate SSH key pair on VM host before starting machine
+    client_pubkey, client_private_key = generate_client_ssh_key()
+
+    # Set up machine with client's public key in metadata service
+    machine = setup_machine(temp_dir, client_pubkey)
+
+    try:
+        machine.start()
+
+        # Wait for services to be ready
+        machine.wait_for_unit("sshd.service")
+        machine.wait_for_unit("print-host-key.service")
+        machine.wait_for_unit("apply-ec2-data.service")
+
+        # Extract shared variables outside subtests
+        machine_ip = "${config.nodes.machine.networking.primaryIPAddress}"
+
+        with subtest("EC2 metadata service connectivity"):
+            hostname_response = machine.succeed("curl --fail -s http://169.254.169.254/1.0/meta-data/hostname")
+            assert "test-instance" in hostname_response, f"Expected 'test-instance', got: {hostname_response}"
+
+        with subtest("SSH host key extraction from console"):
+            console_log = machine.get_console_log()
+            assert "-----BEGIN SSH HOST KEY FINGERPRINTS-----" in console_log
+            assert "-----END SSH HOST KEY FINGERPRINTS-----" in console_log
+            assert "-----BEGIN SSH HOST KEY KEYS-----" in console_log
+            assert "-----END SSH HOST KEY KEYS-----" in console_log
+
+            keys_pattern = r"-----BEGIN SSH HOST KEY KEYS-----(.*?)-----END SSH HOST KEY KEYS-----"
+            keys_match = re.search(keys_pattern, console_log, re.DOTALL)
+            assert keys_match, "Could not find SSH host keys section"
+            keys_content = keys_match.group(1).strip()
+            assert "ssh-" in keys_content, "SSH keys should contain ssh- prefix"
+
+        with subtest("Network connectivity"):
+            client.succeed(f"ping -c 1 {machine_ip}")
+
+        with subtest("SSH connectivity with strict host key checking"):
+            # Install the pre-generated private key on client
+            setup_client_ssh_key(client, client_private_key)
+
+            # Get console log and extract host keys
+            console_log = machine.get_console_log()
+            keys_pattern = r"-----BEGIN SSH HOST KEY KEYS-----(.*?)-----END SSH HOST KEY KEYS-----"
+            keys_match = re.search(keys_pattern, console_log, re.DOTALL)
+            assert keys_match, "Could not find SSH host keys section"
+
+            # Create known_hosts file from console-extracted host keys
+            keys_content = keys_match.group(1).strip()
+            known_hosts_entries = []
+            for line in keys_content.split('\n'):
+                if line.strip() and line.startswith('ssh-'):
+                    known_hosts_entries.append(f"{machine_ip} {line.strip()}")
+
+            assert known_hosts_entries, "No SSH host keys found for known_hosts generation"
+
+            known_hosts_content = '\n'.join(known_hosts_entries)
+            client.succeed(f"cat > /root/.ssh/known_hosts << 'EOF'\n{known_hosts_content}\nEOF")
+
+            # Test SSH connectivity with strict host key checking
+            ssh_result = client.succeed(f"ssh -o ConnectTimeout=60 -o BatchMode=yes -i /root/.ssh/id_ed25519 root@{machine_ip} 'echo Hello from $(hostname)'")
+            assert "Hello from test-instance" in ssh_result, f"Unexpected SSH result: {ssh_result}"
+
+        with subtest("Basic EC2 functionality"):
+            machine.succeed("findmnt / -o SIZE -n | grep -E '[0-9]+G'")
+
+    finally:
+        machine.shutdown()
+        temp_dir.cleanup()
+  '';
+}
@@ -16,6 +16,7 @@ let
        environment.systemPackages = [
          pkgs.dig
          pkgs.nebula
+          pkgs.jq
        ];
        users.users.root.openssh.authorizedKeys.keys = [ snakeOilPublicKey ];
        services.openssh.enable = true;
@@ -28,7 +29,7 @@ let
          cert = "/etc/nebula/${name}.crt";
          key = "/etc/nebula/${name}.key";
          listen = {
-            host = "0.0.0.0";
+            host = "::";
            port =
              if
                (
@@ -54,12 +55,20 @@ in
      { ... }@args:
      makeNebulaNode args "lighthouse" {
        networking.firewall.allowedUDPPorts = [ 53 ];
-        networking.interfaces.eth1.ipv4.addresses = lib.mkForce [
-          {
-            address = "192.168.1.1";
-            prefixLength = 24;
-          }
-        ];
+        networking.interfaces.eth1 = {
+          ipv4.addresses = lib.mkForce [
+            {
+              address = "192.168.1.1";
+              prefixLength = 24;
+            }
+          ];
+          ipv6.addresses = lib.mkForce [
+            {
+              address = "3fff::1";
+              prefixLength = 64;
+            }
+          ];
+        };

        services.nebula.networks.smoke = {
          isLighthouse = true;
@@ -93,16 +102,27 @@ in
    allowAny =
      { ... }@args:
      makeNebulaNode args "allowAny" {
-        networking.interfaces.eth1.ipv4.addresses = lib.mkForce [
-          {
-            address = "192.168.1.2";
-            prefixLength = 24;
-          }
-        ];
+        networking.interfaces.eth1 = {
+          ipv4.addresses = lib.mkForce [
+            {
+              address = "192.168.1.2";
+              prefixLength = 24;
+            }
+          ];
+          ipv6.addresses = lib.mkForce [
+            {
+              address = "3fff::2";
+              prefixLength = 64;
+            }
+          ];
+        };

        services.nebula.networks.smoke = {
          staticHostMap = {
-            "10.0.100.1" = [ "192.168.1.1:4242" ];
+            "10.0.100.1" = [
+              "192.168.1.1:4242"
+              "[3fff::1]:4242"
+            ];
          };
          isLighthouse = false;
          lighthouses = [ "10.0.100.1" ];
@@ -129,16 +149,21 @@ in
    allowFromLighthouse =
      { ... }@args:
      makeNebulaNode args "allowFromLighthouse" {
-        networking.interfaces.eth1.ipv4.addresses = lib.mkForce [
-          {
-            address = "192.168.1.3";
-            prefixLength = 24;
-          }
-        ];
+        networking.interfaces.eth1 = {
+          ipv6.addresses = lib.mkForce [
+            {
+              address = "3fff::3";
+              prefixLength = 64;
+            }
+          ];
+        };

        services.nebula.networks.smoke = {
          staticHostMap = {
-            "10.0.100.1" = [ "192.168.1.1:4242" ];
+            "10.0.100.1" = [
+              "192.168.1.1:4242"
+              "[3fff::1]:4242"
+            ];
          };
          isLighthouse = false;
          lighthouses = [ "10.0.100.1" ];
@@ -175,7 +200,10 @@ in
        services.nebula.networks.smoke = {
          enable = true;
          staticHostMap = {
-            "10.0.100.1" = [ "192.168.1.1:4242" ];
+            "10.0.100.1" = [
+              "192.168.1.1:4242"
+              "[3fff::1]:4242"
+            ];
          };
          isLighthouse = false;
          lighthouses = [ "10.0.100.1" ];
@@ -212,7 +240,9 @@ in
        services.nebula.networks.smoke = {
          enable = false;
          staticHostMap = {
-            "10.0.100.1" = [ "192.168.1.1:4242" ];
+            "10.0.100.1" = [
+              "192.168.1.1:4242"
+            ];
          };
          isLighthouse = false;
          lighthouses = [ "10.0.100.1" ];
@@ -270,7 +300,7 @@ in
            "scp ${sshOpts} /etc/nebula/${name}.pub root@192.168.1.1:/root/${name}.pub",
        )
        lighthouse.succeed(
-            'nebula-cert sign -duration $((365*24*60))m -ca-crt /etc/nebula/ca.crt -ca-key /etc/nebula/ca.key -name "${name}" -groups "${name}" -ip "${ip}" -in-pub /root/${name}.pub -out-crt /root/${name}.crt'
+            'nebula-cert sign -duration $((365*24*60))m -ca-crt /etc/nebula/ca.crt -ca-key /etc/nebula/ca.key -name "${name}" -groups "${name}" -networks "${ip}" -in-pub /root/${name}.pub -out-crt /root/${name}.crt'
        )
        ${name}.succeed(
            "scp ${sshOpts} root@192.168.1.1:/root/${name}.crt /etc/nebula/${name}.crt",
@@ -279,28 +309,57 @@ in
        )
      '';

-      getPublicIp = node: ''
-        ${node}.succeed("ip --brief addr show eth1 | awk '{print $3}' | tail -n1 | cut -d/ -f1").strip()
+      getPublicIpv4 = node: ''
+        ${node}.succeed("ip --json addr show eth1 | jq -r '.[0].addr_info | map(select(.family == \"inet\")) | map(.local) | join(\",\")'").strip()
+      '';
+
+      getPublicIpv6 = node: ''
+        ${node}.succeed("ip --json addr show eth1 | jq -r '.[0].addr_info | map(select(.family == \"inet6\")) | map(.local) | join(\",\")'").strip()
      '';

      # Never do this for anything security critical! (Thankfully it's just a test.)
      # Restart Nebula right after the mutual block and/or restore so the state is fresh.
-      blockTrafficBetween = nodeA: nodeB: ''
-        node_a = ${getPublicIp nodeA}
-        node_b = ${getPublicIp nodeB}
-        ${nodeA}.succeed("iptables -I INPUT -s " + node_b + " -j DROP")
-        ${nodeB}.succeed("iptables -I INPUT -s " + node_a + " -j DROP")
+      blockTrafficBetweenV4 = nodeA: nodeB: ''
+        node_a_4 = ${getPublicIpv4 nodeA}
+        node_b_4 = ${getPublicIpv4 nodeB}
+        ${nodeA}.succeed("iptables -I INPUT -s " + node_b_4 + " -j DROP")
+        ${nodeB}.succeed("iptables -I INPUT -s " + node_a_4 + " -j DROP")
        ${nodeA}.systemctl("restart nebula@smoke.service")
        ${nodeB}.systemctl("restart nebula@smoke.service")
      '';
-      allowTrafficBetween = nodeA: nodeB: ''
-        node_a = ${getPublicIp nodeA}
-        node_b = ${getPublicIp nodeB}
-        ${nodeA}.succeed("iptables -D INPUT -s " + node_b + " -j DROP")
-        ${nodeB}.succeed("iptables -D INPUT -s " + node_a + " -j DROP")
+      allowTrafficBetweenV4 = nodeA: nodeB: ''
+        node_a_4 = ${getPublicIpv4 nodeA}
+        node_b_4 = ${getPublicIpv4 nodeB}
+        ${nodeA}.succeed("iptables -D INPUT -s " + node_b_4 + " -j DROP")
+        ${nodeB}.succeed("iptables -D INPUT -s " + node_a_4 + " -j DROP")
        ${nodeA}.systemctl("restart nebula@smoke.service")
        ${nodeB}.systemctl("restart nebula@smoke.service")
      '';
+      blockTrafficBetweenV6 = nodeA: nodeB: ''
+        node_a_6 = ${getPublicIpv6 nodeA}
+        node_b_6 = ${getPublicIpv6 nodeB}
+        ${nodeA}.succeed("ip6tables -I INPUT -i eth1 -s " + node_b_6 + " -j DROP")
+        ${nodeB}.succeed("ip6tables -I INPUT -i eth1 -s " + node_a_6 + " -j DROP")
+        ${nodeA}.systemctl("restart nebula@smoke.service")
+        ${nodeB}.systemctl("restart nebula@smoke.service")
+      '';
+      allowTrafficBetweenV6 = nodeA: nodeB: ''
+        node_a_6 = ${getPublicIpv6 nodeA}
+        node_b_6 = ${getPublicIpv6 nodeB}
+        ${nodeA}.succeed("ip6tables -D INPUT -i eth1 -s " + node_b_6 + " -j DROP")
+        ${nodeB}.succeed("ip6tables -D INPUT -i eth1 -s " + node_a_6 + " -j DROP")
+        ${nodeA}.systemctl("restart nebula@smoke.service")
+        ${nodeB}.systemctl("restart nebula@smoke.service")
+      '';
+
+      blockTrafficBetween = nodeA: nodeB: ''
+        ${blockTrafficBetweenV4 nodeA nodeB}
+        ${blockTrafficBetweenV6 nodeA nodeB}
+      '';
+      allowTrafficBetween = nodeA: nodeB: ''
+        ${allowTrafficBetweenV4 nodeA nodeB}
+        ${allowTrafficBetweenV6 nodeA nodeB}
+      '';
    in
    ''
      # Create the certificate and sign the lighthouse's keys.
@@ -308,7 +367,7 @@ in
      lighthouse.succeed(
          "mkdir -p /etc/nebula",
          'nebula-cert ca -duration $((10*365*24*60))m -name "Smoke Test" -out-crt /etc/nebula/ca.crt -out-key /etc/nebula/ca.key',
-          'nebula-cert sign -duration $((365*24*60))m -ca-crt /etc/nebula/ca.crt -ca-key /etc/nebula/ca.key -name "lighthouse" -groups "lighthouse" -ip "10.0.100.1/24" -out-crt /etc/nebula/lighthouse.crt -out-key /etc/nebula/lighthouse.key',
+          'nebula-cert sign -duration $((365*24*60))m -ca-crt /etc/nebula/ca.crt -ca-key /etc/nebula/ca.key -name "lighthouse" -groups "lighthouse" -networks "10.0.100.1/24,2001:db8::1/64" -out-crt /etc/nebula/lighthouse.crt -out-key /etc/nebula/lighthouse.key',
          'chown -R nebula-smoke:nebula-smoke /etc/nebula'
      )

@@ -318,6 +377,7 @@ in
      lighthouse.start()
      lighthouse.wait_for_unit("nebula@smoke.service")
      lighthouse.wait_until_succeeds("ping -c1 -W1 10.0.100.1", timeout=10)
+      lighthouse.wait_until_succeeds("ping -c1 -W1 2001:db8::1", timeout=10)

      # Start all the machines to be set up
      allowAny.start()
@@ -327,101 +387,157 @@ in

      # Create keys for allowAny's nebula service and test that it comes up.
      ${setUpPrivateKey "allowAny"}
-      ${signKeysFor "allowAny" "10.0.100.2/24"}
+      ${signKeysFor "allowAny" "10.0.100.2/24,2001:db8::2/64"}
      ${restartAndCheckNebula "allowAny" "10.0.100.2"}
+      ${restartAndCheckNebula "allowAny" "2001:db8::2"}

      # Create keys for allowFromLighthouse's nebula service and test that it comes up.
      ${setUpPrivateKey "allowFromLighthouse"}
-      ${signKeysFor "allowFromLighthouse" "10.0.100.3/24"}
+      ${signKeysFor "allowFromLighthouse" "10.0.100.3/24,2001:db8::3/64"}
      ${restartAndCheckNebula "allowFromLighthouse" "10.0.100.3"}
+      ${restartAndCheckNebula "allowFromLighthouse" "2001:db8::3"}

      # Create keys for allowToLighthouse's nebula service and test that it comes up.
      ${setUpPrivateKey "allowToLighthouse"}
-      ${signKeysFor "allowToLighthouse" "10.0.100.4/24"}
+      ${signKeysFor "allowToLighthouse" "10.0.100.4/24,2001:db8::4/64"}
      ${restartAndCheckNebula "allowToLighthouse" "10.0.100.4"}
+      ${restartAndCheckNebula "allowToLighthouse" "2001:db8::4"}

      # Create keys for disabled's nebula service and test that it does not come up.
      ${setUpPrivateKey "disabled"}
-      ${signKeysFor "disabled" "10.0.100.5/24"}
+      ${signKeysFor "disabled" "10.0.100.5/24,2001:db8::5/64"}
      disabled.fail("systemctl status nebula@smoke.service")
      disabled.fail("ping -c3 -W1 10.0.100.5")
+      disabled.fail("ping -c3 -W1 2001:db8::5")

      # The lighthouse can ping allowAny and allowFromLighthouse but not disabled
      lighthouse.wait_until_succeeds("ping -c1 -W1 10.0.100.2", timeout=10)
+      lighthouse.wait_until_succeeds("ping -c1 -W1 2001:db8::2", timeout=10)
      lighthouse.wait_until_succeeds("ping -c1 -W1 10.0.100.3", timeout=10)
+      lighthouse.wait_until_succeeds("ping -c1 -W1 2001:db8::3", timeout=10)
      lighthouse.fail("ping -c3 -W1 10.0.100.5")
+      lighthouse.fail("ping -c3 -W1 2001:db8::5")

      # allowAny can ping the lighthouse, but not allowFromLighthouse because of its inbound firewall
      allowAny.wait_until_succeeds("ping -c1 -W1 10.0.100.1", timeout=10)
+      allowAny.wait_until_succeeds("ping -c1 -W1 2001:db8::1", timeout=10)
      allowAny.fail("ping -c3 -W1 10.0.100.3")
+      allowAny.fail("ping -c3 -W1 2001:db8::3")
      # allowAny can also resolve DNS on lighthouse
-      allowAny.succeed("dig @10.0.100.1 allowToLighthouse | grep -E 'allowToLighthouse\.\s+[0-9]+\s+IN\s+A\s+10\.0\.100\.4'")
+      allowAny.succeed("dig @10.0.100.1 allowToLighthouse A | grep -E 'allowToLighthouse\.\s+[0-9]+\s+IN\s+A\s+10\.0\.100\.4'")
+      allowAny.succeed("dig @10.0.100.1 allowToLighthouse AAAA | grep -E 'allowToLighthouse\.\s+[0-9]+\s+IN\s+AAAA\s+2001:db8::4'")

      # allowFromLighthouse can ping the lighthouse and allowAny
      allowFromLighthouse.wait_until_succeeds("ping -c1 -W1 10.0.100.1", timeout=10)
+      allowFromLighthouse.wait_until_succeeds("ping -c1 -W1 2001:db8::1", timeout=10)
      allowFromLighthouse.wait_until_succeeds("ping -c1 -W1 10.0.100.2", timeout=10)
+      allowFromLighthouse.wait_until_succeeds("ping -c1 -W1 2001:db8::2", timeout=10)
+
+      # allowAny does IPv6 -> IPv4 and IPv4 -> IPv6 switchover for the underlay network
+      ${blockTrafficBetweenV4 "lighthouse" "allowAny"}
+      ${blockTrafficBetweenV6 "lighthouse" "allowToLighthouse"}
+      ${blockTrafficBetweenV6 "allowAny" "allowToLighthouse"}
+      allowAny.wait_until_succeeds("ping -c1 -W1 10.0.100.1", timeout=10)
+      allowAny.wait_until_succeeds("ping -c1 -W1 2001:db8::1", timeout=10)
+      allowAny.wait_until_succeeds("ping -c1 -W1 10.0.100.4", timeout=10)
+      allowAny.wait_until_succeeds("ping -c1 -W1 2001:db8::4", timeout=10)
+      ${blockTrafficBetweenV6 "lighthouse" "allowAny"}
+      allowAny.fail("ping -c3 -W1 10.0.100.1")
+      allowAny.fail("ping -c3 -W1 2001:db8::4")
+      ${allowTrafficBetweenV4 "lighthouse" "allowAny"}
+      allowAny.wait_until_succeeds("ping -c1 -W1 10.0.100.1", timeout=10)
+      allowAny.wait_until_succeeds("ping -c1 -W1 10.0.100.4", timeout=10)
+      ${allowTrafficBetweenV6 "lighthouse" "allowAny"}
+      ${allowTrafficBetweenV6 "lighthouse" "allowToLighthouse"}
+      ${allowTrafficBetweenV6 "allowAny" "allowToLighthouse"}

      # block allowFromLighthouse <-> allowAny, and allowFromLighthouse -> allowAny should still work.
      ${blockTrafficBetween "allowFromLighthouse" "allowAny"}
+      allowFromLighthouse.wait_until_succeeds("ping -c1 -W1 2001:db8::2", timeout=10)
      allowFromLighthouse.wait_until_succeeds("ping -c1 -W1 10.0.100.2", timeout=10)
      ${allowTrafficBetween "allowFromLighthouse" "allowAny"}
      allowFromLighthouse.wait_until_succeeds("ping -c1 -W1 10.0.100.2", timeout=10)
+      allowFromLighthouse.wait_until_succeeds("ping -c1 -W1 2001:db8::2", timeout=10)

      # allowToLighthouse can ping the lighthouse but not allowAny or allowFromLighthouse
      allowToLighthouse.wait_until_succeeds("ping -c1 -W1 10.0.100.1", timeout=10)
+      allowToLighthouse.wait_until_succeeds("ping -c1 -W1 2001:db8::1", timeout=10)
      allowToLighthouse.fail("ping -c3 -W1 10.0.100.2")
+      allowToLighthouse.fail("ping -c3 -W1 2001:db8::2")
      allowToLighthouse.fail("ping -c3 -W1 10.0.100.3")
+      allowToLighthouse.fail("ping -c3 -W1 2001:db8::3")

      # allowAny can ping allowFromLighthouse now that allowFromLighthouse pinged it first
      allowAny.wait_until_succeeds("ping -c1 -W1 10.0.100.3", timeout=10)
+      allowAny.wait_until_succeeds("ping -c1 -W1 2001:db8::3", timeout=10)

      # block allowAny <-> allowFromLighthouse, and allowAny -> allowFromLighthouse should still work.
      ${blockTrafficBetween "allowAny" "allowFromLighthouse"}
      allowFromLighthouse.wait_until_succeeds("ping -c1 -W1 10.0.100.2", timeout=10)
+      allowFromLighthouse.wait_until_succeeds("ping -c1 -W1 2001:db8::2", timeout=10)
      allowAny.wait_until_succeeds("ping -c1 -W1 10.0.100.3", timeout=10)
+      allowAny.wait_until_succeeds("ping -c1 -W1 2001:db8::3", timeout=10)
      ${allowTrafficBetween "allowAny" "allowFromLighthouse"}
      allowFromLighthouse.wait_until_succeeds("ping -c1 -W1 10.0.100.2", timeout=10)
+      allowFromLighthouse.wait_until_succeeds("ping -c1 -W1 2001:db8::2", timeout=10)
      allowAny.wait_until_succeeds("ping -c1 -W1 10.0.100.3", timeout=10)
+      allowAny.wait_until_succeeds("ping -c1 -W1 2001:db8::3", timeout=10)

      # allowToLighthouse can ping allowAny if allowAny pings it first
      allowAny.wait_until_succeeds("ping -c1 -W1 10.0.100.4", timeout=10)
+      allowAny.wait_until_succeeds("ping -c1 -W1 2001:db8::4", timeout=10)
      allowToLighthouse.wait_until_succeeds("ping -c1 -W1 10.0.100.2", timeout=10)
+      allowToLighthouse.wait_until_succeeds("ping -c1 -W1 2001:db8::2", timeout=10)

      # block allowToLighthouse <-> allowAny, and allowAny <-> allowToLighthouse should still work.
      ${blockTrafficBetween "allowAny" "allowToLighthouse"}
      allowAny.wait_until_succeeds("ping -c1 -W1 10.0.100.4", timeout=10)
+      allowAny.wait_until_succeeds("ping -c1 -W1 2001:db8::4", timeout=10)
      allowToLighthouse.wait_until_succeeds("ping -c1 -W1 10.0.100.2", timeout=10)
+      allowToLighthouse.wait_until_succeeds("ping -c1 -W1 2001:db8::2", timeout=10)
      ${allowTrafficBetween "allowAny" "allowToLighthouse"}
      allowAny.wait_until_succeeds("ping -c1 -W1 10.0.100.4", timeout=10)
+      allowAny.wait_until_succeeds("ping -c1 -W1 2001:db8::4", timeout=10)
      allowToLighthouse.wait_until_succeeds("ping -c1 -W1 10.0.100.2", timeout=10)
+      allowToLighthouse.wait_until_succeeds("ping -c1 -W1 2001:db8::2", timeout=10)

      # block lighthouse <-> allowFromLighthouse and allowAny <-> allowFromLighthouse; allowFromLighthouse won't get to allowAny
      ${blockTrafficBetween "allowFromLighthouse" "lighthouse"}
      ${blockTrafficBetween "allowFromLighthouse" "allowAny"}
      allowFromLighthouse.fail("ping -c3 -W1 10.0.100.2")
+      allowFromLighthouse.fail("ping -c3 -W1 2001:db8::2")
      ${allowTrafficBetween "allowFromLighthouse" "lighthouse"}
      ${allowTrafficBetween "allowFromLighthouse" "allowAny"}
      allowFromLighthouse.wait_until_succeeds("ping -c1 -W1 10.0.100.2", timeout=10)
+      allowFromLighthouse.wait_until_succeeds("ping -c1 -W1 2001:db8::2", timeout=10)

      # block lighthouse <-> allowAny, allowAny <-> allowFromLighthouse, and allowAny <-> allowToLighthouse; it won't get to allowFromLighthouse or allowToLighthouse
      ${blockTrafficBetween "allowAny" "lighthouse"}
      ${blockTrafficBetween "allowAny" "allowFromLighthouse"}
      ${blockTrafficBetween "allowAny" "allowToLighthouse"}
      allowFromLighthouse.fail("ping -c3 -W1 10.0.100.2")
+      allowFromLighthouse.fail("ping -c3 -W1 2001:db8::2")
      allowAny.fail("ping -c3 -W1 10.0.100.3")
+      allowAny.fail("ping -c3 -W1 2001:db8::3")
      allowAny.fail("ping -c3 -W1 10.0.100.4")
+      allowAny.fail("ping -c3 -W1 2001:db8::4")
      ${allowTrafficBetween "allowAny" "lighthouse"}
      ${allowTrafficBetween "allowAny" "allowFromLighthouse"}
      ${allowTrafficBetween "allowAny" "allowToLighthouse"}
      allowFromLighthouse.wait_until_succeeds("ping -c1 -W1 10.0.100.2", timeout=10)
+      allowFromLighthouse.wait_until_succeeds("ping -c1 -W1 2001:db8::2", timeout=10)
      allowAny.wait_until_succeeds("ping -c1 -W1 10.0.100.3", timeout=10)
+      allowAny.wait_until_succeeds("ping -c1 -W1 2001:db8::3", timeout=10)
      allowAny.wait_until_succeeds("ping -c1 -W1 10.0.100.4", timeout=10)
+      allowAny.wait_until_succeeds("ping -c1 -W1 2001:db8::4", timeout=10)

      # block lighthouse <-> allowToLighthouse and allowToLighthouse <-> allowAny; it won't get to allowAny
      ${blockTrafficBetween "allowToLighthouse" "lighthouse"}
      ${blockTrafficBetween "allowToLighthouse" "allowAny"}
      allowAny.fail("ping -c3 -W1 10.0.100.4")
+      allowAny.fail("ping -c3 -W1 2001:db8::4")
      allowToLighthouse.fail("ping -c3 -W1 10.0.100.2")
+      allowToLighthouse.fail("ping -c3 -W1 2001:db8::2")
      ${allowTrafficBetween "allowToLighthouse" "lighthouse"}
      ${allowTrafficBetween "allowToLighthouse" "allowAny"}
      allowAny.wait_until_succeeds("ping -c1 -W1 10.0.100.4", timeout=10)
@@ -66,7 +66,7 @@ in
      lighthouse.succeed(
          "mkdir -p /etc/nebula",
          'nebula-cert ca -duration $((10*365*24*60))m -name "Smoke Test" -out-crt /etc/nebula/ca.crt -out-key /etc/nebula/ca.key',
-          'nebula-cert sign -duration $((365*24*60))m -ca-crt /etc/nebula/ca.crt -ca-key /etc/nebula/ca.key -name "lighthouse" -groups "lighthouse" -ip "10.0.100.1/24" -out-crt /etc/nebula/lighthouse.crt -out-key /etc/nebula/lighthouse.key',
+          'nebula-cert sign -duration $((365*24*60))m -ca-crt /etc/nebula/ca.crt -ca-key /etc/nebula/ca.key -name "lighthouse" -groups "lighthouse" -networks "10.0.100.1/24" -out-crt /etc/nebula/lighthouse.crt -out-key /etc/nebula/lighthouse.key',
          'chown -R nebula-smoke:nebula-smoke /etc/nebula'
      )

@@ -24,8 +24,8 @@ let
    sha256Hash = "sha256-ciu+To5Kcus8FPDz1D43AD+qOqfPHaW4JsEBr9fx2PE=";
  };
  latestVersion = {
-    version = "2025.2.3.4"; # "Android Studio Otter 3 Feature Drop | 2025.2.3 Canary 4"
-    sha256Hash = "sha256-Oi+sGK8d7ms/BYt7F9xwEFGPdQUEHhfdclKQi9vAxgU=";
+    version = "2025.2.3.5"; # "Android Studio Otter 3 Feature Drop | 2025.2.3 Canary 5"
+    sha256Hash = "sha256-gqJXOO7kW4orfsfCn5xOqLSpGu5apH4MpDhLAuOAG5w=";
  };
 in
 {
@@ -82,11 +82,11 @@
    "vendorHash": "sha256-2UfA1QHpVgRKi6PtZ5cHHuO4m5cN6KWlLt3hmPca6HY="
  },
  "aviatrixsystems_aviatrix": {
-    "hash": "sha256-V1JRVOMHQu5KlPFw7q/qZuHlJjdVSQotI9w7s88v8GM=",
+    "hash": "sha256-46djOfAj/5kfeoKLQHbeKefzdGbmlBATR+uN/IaAn8I=",
    "homepage": "https://registry.terraform.io/providers/AviatrixSystems/aviatrix",
    "owner": "AviatrixSystems",
    "repo": "terraform-provider-aviatrix",
-    "rev": "v8.1.10",
+    "rev": "v8.2.0",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
@@ -128,13 +128,13 @@
    "vendorHash": "sha256-/dOiXO2aPkuZaFiwv/6AXJdIADgx8T7eOwvJfBBoqg8="
  },
  "buildkite_buildkite": {
-    "hash": "sha256-tADvbxvLl0PgttK6x4Ngjs5UtteR9BCKJOSoX9oc/w8=",
+    "hash": "sha256-oQyhrDpxjCckqq+mtViswP1rPcgowEq4ZN5jHWa7UpY=",
    "homepage": "https://registry.terraform.io/providers/buildkite/buildkite",
    "owner": "buildkite",
    "repo": "terraform-provider-buildkite",
-    "rev": "v1.27.1",
+    "rev": "v1.28.0",
    "spdx": "MIT",
-    "vendorHash": "sha256-IsviKF349jAXs55wadqWgjJMgwcAhU5MqZ0Tg9eGjeI="
+    "vendorHash": "sha256-e9RWvfhn/jO44ljfzNjo2qCQZfVISg8DWQdvnTXbf8o="
  },
  "camptocamp_pass": {
    "hash": "sha256-GQ2g7VyK+eeBqW3LMR4U0gMYsvQnG3y+KEKKkvnmfsk=",
@@ -400,13 +400,13 @@
    "vendorHash": null
  },
  "fastly_fastly": {
-    "hash": "sha256-HP3pl1KLW8vPKI9FYZKViFQvslGuNmEJTw/nvjsDQRk=",
+    "hash": "sha256-FZNwWjgxdJ/g3ByjbsD5isMan7e7QUX2w5ZHR4qHJKw=",
    "homepage": "https://registry.terraform.io/providers/fastly/fastly",
    "owner": "fastly",
    "repo": "terraform-provider-fastly",
-    "rev": "v8.5.0",
+    "rev": "v8.6.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-khWWD2JCiVnDQiz9AXAOaqHfYwCdmSq5Yj+AyrBc8Go="
+    "vendorHash": "sha256-YgmjUSKq9wAkixq9oL5dXwNY2Yt/QRdOLj75M8UWj1w="
  },
  "flexibleenginecloud_flexibleengine": {
    "hash": "sha256-yEZ9JiUSqFFbfqzOOD59ZBv4yFCeUBBKlp6aiUqDqiM=",
@@ -526,11 +526,11 @@
    "vendorHash": null
  },
  "hashicorp_azurerm": {
-    "hash": "sha256-C/uh67joPBOaPZ/9q4KdxSIb8KF4tU0j6j2Uw6n5XvU=",
+    "hash": "sha256-aLBq+kMycLom6a+R5R+FxXzohHTX4yUHANXA1NGQ51k=",
    "homepage": "https://registry.terraform.io/providers/hashicorp/azurerm",
    "owner": "hashicorp",
    "repo": "terraform-provider-azurerm",
-    "rev": "v4.56.0",
+    "rev": "v4.57.0",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
@@ -715,11 +715,11 @@
    "vendorHash": "sha256-BUxnKxr0htpdSSTMzb3ix1nNlX7PTBv38ozDjnZ2eK8="
  },
  "huaweicloud_huaweicloud": {
-    "hash": "sha256-7Wj+JinSLsz+4UNaAM1YOQ6obGIrpctlD6BPAPpnSHQ=",
+    "hash": "sha256-MQq3fbDXJdULy0xutWmWRmgKa3STny3qsklxgL/z/28=",
    "homepage": "https://registry.terraform.io/providers/huaweicloud/huaweicloud",
    "owner": "huaweicloud",
    "repo": "terraform-provider-huaweicloud",
-    "rev": "v1.82.2",
+    "rev": "v1.82.4",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
@@ -1301,13 +1301,13 @@
    "vendorHash": "sha256-Hzq97ElAjs7Y4tmJ2x7+g4j74MEdEvI2bD8pkvi5ZXg="
  },
  "temporalio_temporalcloud": {
-    "hash": "sha256-hHHZ+5LF5AoDB2JZyPRce6oEtOZOGi8lYNgbTlAqTuA=",
+    "hash": "sha256-Lwb/T2yz8/hfV8/WrD/AXunoUNg/QbF9VzWtxSBlUX0=",
    "homepage": "https://registry.terraform.io/providers/temporalio/temporalcloud",
    "owner": "temporalio",
    "repo": "terraform-provider-temporalcloud",
-    "rev": "v1.1.1",
+    "rev": "v1.1.2",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-9GjhP/Oh2HlVuMcuXFhS7MUmF3eS4qlUsW5XhugaK14="
+    "vendorHash": "sha256-omxEb+ntQuHDfS2Rmt0rj0BF0Q2T8DLhobLua2uU/0o="
  },
  "tencentcloudstack_tencentcloud": {
    "hash": "sha256-VpaGrpwILnJroZ+4mAM9eVhxXAUl8QMShAwgCzNAi4Q=",
@@ -2,6 +2,7 @@
  lib,
  buildGoModule,
  fetchFromGitHub,
+  versionCheckHook,
 }:

 buildGoModule rec {
@@ -17,17 +18,20 @@ buildGoModule rec {

  vendorHash = "sha256-EFbEd1UwrBnH6pSh+MvupYdie8SnKr8y6K9lQflBSlk=";

+  nativeInstallCheckInputs = [ versionCheckHook ];
+
  modPostBuild = ''
    patch -d vendor/github.com/docker/cli/ -p1 < ${./cli-system-plugin-dir-from-env.patch}
  '';

  ldflags = [
-    "-X github.com/docker/compose/v2/internal.Version=${version}"
+    "-X github.com/docker/compose/v5/internal.Version=${version}"
    "-s"
    "-w"
  ];

  doCheck = false;
+  doInstallCheck = true;
  installPhase = ''
    runHook preInstall
    install -D $GOPATH/bin/cmd $out/libexec/docker/cli-plugins/docker-compose
@@ -430,14 +430,14 @@ in

  docker_29 =
    let
-      version = "29.1.2";
+      version = "29.1.3";
    in
    callPackage dockerGen {
      inherit version;
      cliRev = "v${version}";
-      cliHash = "sha256-dmoCHxXOYalJCaqq32MdsAEJ+xq0aH/8fOpJHVnBxxU=";
+      cliHash = "sha256-8VpFDYn9mRFv7BnHek2+HvIu6jNPYNC1asozJvRX/A4=";
      mobyRev = "docker-v${version}";
-      mobyHash = "sha256-SRMaPAdg2nlWuKKQILZEGHZO6TGLh2Ci1UIWqcyo6IM=";
+      mobyHash = "sha256-yB6FF4tzi6R+wH6U0JS8PMZGVRl1gWCY2Cjb/JR+62w=";
      runcRev = "v1.3.4";
      runcHash = "sha256-1IfY08sBoDpbLrwz1AKBRSTuCZyOgQzYPHTDUI6fOZ8=";
      containerdRev = "v2.2.0";
@@ -15,12 +15,12 @@

 let
  pname = "autobrr";
-  version = "1.69.0";
+  version = "1.71.0";
  src = fetchFromGitHub {
    owner = "autobrr";
    repo = "autobrr";
    tag = "v${version}";
-    hash = "sha256-16C160Wg7pm3BoJyyC5tuHdp4H1BDO7GfnA5u0HJ8YM=";
+    hash = "sha256-JAWnH0S7gDBwmQXpogiTCIWWfQkrI5wOjWkV6+ANcnc=";
  };

  autobrr-web = stdenvNoCC.mkDerivation {
@@ -65,7 +65,7 @@ buildGoModule rec {
    src
    ;

-  vendorHash = "sha256-7gmF3yQFRqN7Oro/f+jhmxCUU9CltobY6EAoskCZISQ=";
+  vendorHash = "sha256-avgMRD5WSjXVVJ8r0Rq0IhfwPvxc/Sq9JxzX0rQimWI=";

  preBuild = ''
    cp -r ${autobrr-web}/* web/dist
@@ -14,17 +14,17 @@
 }:
 buildGoModule (finalAttrs: {
  pname = "avalanche-cli";
-  version = "1.9.5";
+  version = "1.9.6";

  src = fetchFromGitHub {
    owner = "ava-labs";
    repo = "avalanche-cli";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-jNDzN2kWjnY9yQaGjhIEvpoc+k1Q1tnDQkQtZvxBTSw=";
+    hash = "sha256-bAZJRFlry7vYTTf95kTOJwcjYelN40n264oeykx7nxc=";
  };

  proxyVendor = true;
-  vendorHash = "sha256-reL1ZJc/Wuh0LH+S+ZV4eVgVP5gvv3tFqLWNNTL5CDI=";
+  vendorHash = "sha256-0+YwlCHjiU46y333RSuaha4pLKFTYlj+M9+TFAALamY=";

  # Fix error: 'Caught SIGILL in blst_cgo_init'
  # https://github.com/bnb-chain/bsc/issues/1521
@@ -0,0 +1,121 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  fetchYarnDeps,
+  nodejs,
+  yarnBuildHook,
+  yarnConfigHook,
+  yarnInstallHook,
+  diffutils,
+  zip,
+  jq,
+  unzip,
+  testers,
+  nix-update-script,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "aws-cdk-cli";
+  version = "2.1100.1";
+
+  src = fetchFromGitHub {
+    owner = "aws";
+    repo = "aws-cdk-cli";
+    tag = "cdk@v${finalAttrs.version}";
+    hash = "sha256-GIW6y2njqZExAiegDXNWUQB0HzNvXlg02L9DBo4oQnI=";
+  };
+
+  yarnOfflineCache = fetchYarnDeps {
+    yarnLock = "${finalAttrs.src}/yarn.lock";
+    hash = "sha256-oUsH7ccuHFgZw9cnwhIq/mbEgNdJJv9GzBh6HsJT+kU=";
+  };
+
+  nativeBuildInputs = [
+    yarnConfigHook
+    yarnBuildHook
+    yarnInstallHook
+    nodejs
+    zip
+    jq
+    # tests
+    diffutils
+    unzip
+  ];
+
+  env = {
+    NX_DISABLE_REMOTE_CACHE = "true";
+    NX_TASKS_RUNNER_DYNAMIC_OUTPUT = "false";
+    NX_VERBOSE_LOGGING = "true";
+    # Needed to properly embed version info
+    CODEBUILD_RESOLVED_SOURCE_VERSION = finalAttrs.version;
+  };
+
+  # Regular "build" is very heavy and does things we don't need.
+  yarnBuildScript = "compile";
+
+  postPatch =
+    let
+      cliVersionJson = builtins.toJSON {
+        inherit (finalAttrs) version;
+      };
+    in
+    ''
+      echo '${cliVersionJson}' > packages/@aws-cdk/cloud-assembly-schema/cli-version.json
+    '';
+
+  preBuild = ''
+    export NX_PARALLEL="$NIX_BUILD_CORES"
+    pushd packages/@aws-cdk/integ-runner
+    patchShebangs build-tools/generate.sh
+    build-tools/generate.sh
+    popd
+    pushd packages/aws-cdk
+    patchShebangs generate.sh
+    ./generate.sh
+    popd
+  '';
+
+  postInstall = ''
+    # Manually bundle non-bundled dependencies
+    cp -r packages/@aws-cdk/cloud-assembly-schema/node_modules/jsonschema $out/lib/node_modules/aws-cdk-cli/node_modules/jsonschema
+    cp -r packages/aws-cdk/node_modules/decamelize $out/lib/node_modules/aws-cdk-cli/node_modules/decamelize
+
+    patchShebangs "$out/lib/node_modules/aws-cdk-cli/node_modules/aws-cdk/bin"
+    ln -s "$out/lib/node_modules/aws-cdk-cli/node_modules/aws-cdk/bin" "$out/bin"
+    # Delete broken symlinks
+    find "$out/lib/node_modules" -xtype l -delete
+
+    # Fix version
+    pushd $out/lib/node_modules/aws-cdk-cli/packages/aws-cdk
+    mv package.json package.json.bak
+    jq '.version = "${finalAttrs.version}"' < package.json.bak > package.json
+    rm package.json.bak
+    mv build-info.json bi.json
+    jq '.commit = "nixpkgs"' < bi.json > build-info.json
+    rm bi.json
+    popd
+  '';
+
+  # Fixup takes an absurdly long time, so disable it
+  dontFixup = true;
+
+  passthru = {
+    tests.version = testers.testVersion { package = finalAttrs.package; };
+    updateScript = nix-update-script {
+      extraArgs = [
+        "--version-regex"
+        "cdk@v(.*)"
+      ];
+    };
+  };
+
+  meta = {
+    description = "AWS CDK Toolkit";
+    homepage = "https://docs.aws.amazon.com/cdk/v2/guide/cli.html";
+    license = lib.licenses.asl20;
+    maintainers = [ ];
+    mainProgram = "cdk";
+    platforms = lib.platforms.all;
+  };
+})
@@ -13,13 +13,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "darkly-qt${qtMajorVersion}";
-  version = "0.5.29";
+  version = "0.5.30";

  src = fetchFromGitHub {
    owner = "Bali10050";
    repo = "Darkly";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-OT1QEHVcwz10ZUbEgvXnS/o28kvElKvswaJR6rW+PxI=";
+    hash = "sha256-REpIGNEntVGSffMhK1d3vz3QRfxjMiPpOLSuA1LOU74=";
  };

  nativeBuildInputs = [
@@ -8,16 +8,16 @@

 buildGoModule rec {
  pname = "fabric-ai";
-  version = "1.4.345";
+  version = "1.4.357";

  src = fetchFromGitHub {
    owner = "danielmiessler";
    repo = "fabric";
    tag = "v${version}";
-    hash = "sha256-X4qdFSAO4bE3yVdpmq1r7rAEVAIOeQ4+YY/w4F86Fs8=";
+    hash = "sha256-h4BcHZHKseI+L3oabvLhs9NePZTZziQdBseYDSehJqc=";
  };

-  vendorHash = "sha256-qWaMBhjt20WAIhDcjY4oOFBT+neJiXg0N2WsPasuHSU=";
+  vendorHash = "sha256-jseTLfBGUmwXz63+jTgv6k4RHh1cJVPQA/DI5OYlsdA=";

  # Fabric introduced plugin tests that fail in the nix build sandbox.
  doCheck = false;
@@ -1,7 +1,7 @@
 {
  lib,
  stdenv,
-  flutter335,
+  flutter338,
  mpv-unwrapped,
  patchelf,
  fetchFromGitHub,
@@ -9,16 +9,16 @@
  makeDesktopItem,
 }:
 let
-  version = "0.9.20-beta";
+  version = "0.9.21-beta";
 in
-flutter335.buildFlutterApplication {
+flutter338.buildFlutterApplication {
  inherit version;
  pname = "finamp";
  src = fetchFromGitHub {
    owner = "jmshrv";
    repo = "finamp";
    rev = version;
-    hash = "sha256-YuqYuUse6xugvc2hckZBc9kx+ryBmRQhoZzjwkpoNfo=";
+    hash = "sha256-Mb9oC9SJnZovcqjOJzh0bpWxZhbkfQWzFG9moghCmrw=";
  };
  pubspecLock = lib.importJSON ./pubspec.lock.json;

@@ -37,6 +37,8 @@ flutter335.buildFlutterApplication {
    split_view = "sha256-unTJQDXUUPVDudlk0ReOPNYrsyEpbd/UMg1tHZsmg+k=";
    flutter_user_certificates_android = "sha256-HL1Qd0D3CLYJysWLX2jqWt1FJRGm/BE8EjVFPztOIPo=";
    smtc_windows = "sha256-ESR6qw8ciJvo1YG3wNK7Uy/N0zzl6OX6q40Dmgsvx6A=";
+    just_audio = "sha256-I+HTDx3IpaQw3VBVO7KGzl0vDcFrNZhN5455i7TNxxs=";
+    just_audio_media_kit = "sha256-dSlZETFqNQs7jxNN+8MWQzval31zA7zCs+7WiPPPZMw=";
  };

  postFixup = ''
@@ -154,11 +154,11 @@
      "dependency": "direct main",
      "description": {
        "name": "audio_session",
-        "sha256": "2b7fff16a552486d078bfc09a8cde19f426dc6d6329262b684182597bec5b1ac",
+        "sha256": "8f96a7fecbb718cb093070f868b4cdcb8a9b1053dce342ff8ab2fde10eb9afb7",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "0.1.25"
+      "version": "0.2.2"
    },
    "auto_size_text": {
      "dependency": "direct main",
@@ -174,11 +174,11 @@
      "dependency": "direct main",
      "description": {
        "name": "background_downloader",
-        "sha256": "a22acfa37aa06ba5cfe6eb7b1aa700c78af64770ff450c73dd3d279d7c37d4ac",
+        "sha256": "a3b340e42bc45598918944e378dc6a05877e587fcd0e1b8d2ea26339de87bdf9",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "9.2.6"
+      "version": "9.4.0"
    },
    "balanced_text": {
      "dependency": "direct main",
@@ -211,6 +211,16 @@
      "source": "hosted",
      "version": "2.0.1"
    },
+    "bits": {
+      "dependency": "direct main",
+      "description": {
+        "name": "bits",
+        "sha256": "30dee12524a00943b2f5d99056a6fd5b2f42d10cecee97d15119def6d350c1a7",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "1.4.0"
+    },
    "boolean_selector": {
      "dependency": "transitive",
      "description": {
@@ -255,11 +265,11 @@
      "dependency": "transitive",
      "description": {
        "name": "build_daemon",
-        "sha256": "8e928697a82be082206edb0b9c99c5a4ad6bc31c9e9b8b2f291ae65cd4a25daa",
+        "sha256": "bf05f6e12cfea92d3c09308d7bcdab1906cd8a179b023269eed00c071004b957",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "4.0.4"
+      "version": "4.1.1"
    },
    "build_resolvers": {
      "dependency": "transitive",
@@ -305,11 +315,11 @@
      "dependency": "transitive",
      "description": {
        "name": "built_value",
-        "sha256": "a30f0a0e38671e89a492c44d005b5545b830a961575bbd8336d42869ff71066d",
+        "sha256": "426cf75afdb23aa74bd4e471704de3f9393f3c7b04c1e2d9c6f1073ae0b8b139",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "8.12.0"
+      "version": "8.12.1"
    },
    "characters": {
      "dependency": "transitive",
@@ -465,21 +475,21 @@
      "dependency": "transitive",
      "description": {
        "name": "cross_file",
-        "sha256": "7caf6a750a0c04effbb52a676dce9a4a592e10ad35c34d6d2d0e4811160d5670",
+        "sha256": "701dcfc06da0882883a2657c445103380e53e647060ad8d9dfb710c100996608",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "0.3.4+2"
+      "version": "0.3.5+1"
    },
    "crypto": {
      "dependency": "transitive",
      "description": {
        "name": "crypto",
-        "sha256": "1e445881f28f22d6140f181e07737b22f1e099a5e1ff94b0af2f9e4a463f4855",
+        "sha256": "c8ea0233063ba03258fbcf2ca4d6dadfefe14f02fab57702265467a19f27fadf",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "3.0.6"
+      "version": "3.0.7"
    },
    "custom_lint": {
      "dependency": "direct dev",
@@ -542,7 +552,7 @@
      "version": "1.2.0"
    },
    "dbus": {
-      "dependency": "transitive",
+      "dependency": "direct main",
      "description": {
        "name": "dbus",
        "sha256": "79e0c23480ff85dc68de79e2cd6334add97e48f7f4865d17686dd6ea81a47e8c",
@@ -555,11 +565,11 @@
      "dependency": "direct main",
      "description": {
        "name": "device_info_plus",
-        "sha256": "49413c8ca514dea7633e8def233b25efdf83ec8522955cc2c0e3ad802927e7c6",
+        "sha256": "4df8babf73058181227e18b08e6ea3520cf5fc5d796888d33b7cb0f33f984b7c",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "12.1.0"
+      "version": "12.3.0"
    },
    "device_info_plus_platform_interface": {
      "dependency": "transitive",
@@ -571,6 +581,16 @@
      "source": "hosted",
      "version": "7.0.3"
    },
+    "dynamic_color": {
+      "dependency": "direct main",
+      "description": {
+        "name": "dynamic_color",
+        "sha256": "43a5a6679649a7731ab860334a5812f2067c2d9ce6452cf069c5e0c25336c17c",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "1.8.1"
+    },
    "equatable": {
      "dependency": "transitive",
      "description": {
@@ -625,11 +645,11 @@
      "dependency": "direct main",
      "description": {
        "name": "file_picker",
-        "sha256": "f2d9f173c2c14635cc0e9b14c143c49ef30b4934e8d1d274d6206fcb0086a06f",
+        "sha256": "7872545770c277236fd32b022767576c562ba28366204ff1a5628853cf8f2200",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "10.3.3"
+      "version": "10.3.7"
    },
    "file_sizes": {
      "dependency": "direct main",
@@ -655,21 +675,21 @@
      "dependency": "direct main",
      "description": {
        "name": "flex_color_picker",
-        "sha256": "8f753a1a026a13ea5cc5eddbae3ceb886f2537569ab2e5208efb1e3bb5af72ff",
+        "sha256": "f5b0b53d4ae0d59b1e28dfc21d5398e5028cf8e764518e491a52fd050aa23881",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "3.7.1"
+      "version": "3.7.2"
    },
    "flex_seed_scheme": {
      "dependency": "transitive",
      "description": {
        "name": "flex_seed_scheme",
-        "sha256": "b06d8b367b84cbf7ca5c5603c858fa5edae88486c4e4da79ac1044d73b6c62ec",
+        "sha256": "828291a5a4d4283590541519d8b57821946660ac61d2e07d955f81cfcab22e5d",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "3.5.1"
+      "version": "3.6.1"
    },
    "flutter": {
      "dependency": "direct main",
@@ -757,11 +777,11 @@
      "dependency": "transitive",
      "description": {
        "name": "flutter_plugin_android_lifecycle",
-        "sha256": "b0694b7fb1689b0e6cc193b3f1fcac6423c4f93c74fb20b806c6b6f196db0c31",
+        "sha256": "ee8068e0e1cd16c4a82714119918efdeed33b3ba7772c54b5d094ab53f9b7fd1",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "2.0.30"
+      "version": "2.0.33"
    },
    "flutter_riverpod": {
      "dependency": "direct main",
@@ -807,11 +827,11 @@
      "dependency": "direct main",
      "description": {
        "name": "flutter_svg",
-        "sha256": "b9c2ad5872518a27507ab432d1fb97e8813b05f0fc693f9d40fad06d073e0678",
+        "sha256": "87fbd7c534435b6c5d9d98b01e1fd527812b82e68ddd8bd35fc45ed0fa8f0a95",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "2.2.1"
+      "version": "2.2.3"
    },
    "flutter_tabler_icons": {
      "dependency": "direct main",
@@ -900,11 +920,11 @@
      "dependency": "direct main",
      "description": {
        "name": "get_it",
-        "sha256": "a4292e7cf67193f8e7c1258203104eb2a51ec8b3a04baa14695f4064c144297b",
+        "sha256": "ae78de7c3f2304b8d81f2bb6e320833e5e81de942188542328f074978cc0efa9",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "8.2.0"
+      "version": "8.3.0"
    },
    "glob": {
      "dependency": "transitive",
@@ -950,21 +970,21 @@
      "dependency": "direct main",
      "description": {
        "name": "hive_ce",
-        "sha256": "89746b555109029a30780e0a601978460b8065643592667f6e43a238faccb8a4",
+        "sha256": "81d39a03c4c0ba5938260a8c3547d2e71af59defecea21793d57fc3551f0d230",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "2.13.2"
+      "version": "2.15.1"
    },
    "hive_ce_flutter": {
      "dependency": "direct main",
      "description": {
        "name": "hive_ce_flutter",
-        "sha256": "f5bd57fda84402bca7557fedb8c629c96c8ea10fab4a542968d7b60864ca02cc",
+        "sha256": "26d656c9e8974f0732f1d09020e2d7b08ba841b8961a02dbfb6caf01474b0e9a",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "2.3.2"
+      "version": "2.3.3"
    },
    "hive_ce_generator": {
      "dependency": "direct dev",
@@ -990,11 +1010,11 @@
      "dependency": "direct main",
      "description": {
        "name": "http",
-        "sha256": "bb2ce4590bc2667c96f318d68cac1b5a7987ec819351d32b1c987239a815e007",
+        "sha256": "87721a4a50b19c7f1d49001e51409bddc46303966ce89a65af4f4e6004896412",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "1.5.0"
+      "version": "1.6.0"
    },
    "http_multi_server": {
      "dependency": "transitive",
@@ -1141,21 +1161,23 @@
    "just_audio": {
      "dependency": "direct main",
      "description": {
-        "name": "just_audio",
-        "sha256": "f978d5b4ccea08f267dae0232ec5405c1b05d3f3cd63f82097ea46c015d5c09e",
-        "url": "https://pub.dev"
+        "path": "just_audio",
+        "ref": "6dfdd07d19f6f037d3f4ff04c397639e4632c687",
+        "resolved-ref": "6dfdd07d19f6f037d3f4ff04c397639e4632c687",
+        "url": "https://github.com/LennartEnns/just_audio_fork.git"
      },
-      "source": "hosted",
-      "version": "0.9.46"
+      "source": "git",
+      "version": "0.10.6"
    },
    "just_audio_media_kit": {
      "dependency": "direct main",
      "description": {
-        "name": "just_audio_media_kit",
-        "sha256": "f3cf04c3a50339709e87e90b4e841eef4364ab4be2bdbac0c54cc48679f84d23",
-        "url": "https://pub.dev"
+        "path": ".",
+        "ref": "feat/queue-shuffle",
+        "resolved-ref": "f5237393a63da702426e4e20c6800b706a0b159f",
+        "url": "https://github.com/Komodo5197/just_audio_media_kit.git"
      },
-      "source": "hosted",
+      "source": "git",
      "version": "2.1.0"
    },
    "just_audio_platform_interface": {
@@ -1238,6 +1260,16 @@
      "source": "hosted",
      "version": "1.3.0"
    },
+    "lzstring": {
+      "dependency": "transitive",
+      "description": {
+        "name": "lzstring",
+        "sha256": "3aa966276ef903485732ac1306598556451ff31a342378510f110304bcf2be27",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.0.0+2"
+    },
    "marquee": {
      "dependency": "direct main",
      "description": {
@@ -1272,11 +1304,11 @@
      "dependency": "transitive",
      "description": {
        "name": "media_kit",
-        "sha256": "48c10c3785df5d88f0eef970743f8c99b2e5da2b34b9d8f9876e598f62d9e776",
+        "sha256": "ae9e79597500c7ad6083a3c7b7b7544ddabfceacce7ae5c9709b0ec16a5d6643",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "1.2.0"
+      "version": "1.2.6"
    },
    "media_kit_libs_linux": {
      "dependency": "direct main",
@@ -1292,8 +1324,8 @@
      "dependency": "direct main",
      "description": {
        "path": "libs/windows/media_kit_libs_windows_audio",
-        "ref": "bfbcea1976093311d6b0ab6bc004a0cc7cd25811",
-        "resolved-ref": "bfbcea1976093311d6b0ab6bc004a0cc7cd25811",
+        "ref": "9659892e095266beffeb71969db733afe9b6c424",
+        "resolved-ref": "9659892e095266beffeb71969db733afe9b6c424",
        "url": "https://github.com/Komodo5197/media-kit.git"
      },
      "source": "git",
@@ -1303,11 +1335,11 @@
      "dependency": "direct main",
      "description": {
        "name": "meta",
-        "sha256": "e3641ec5d63ebf0d9b41bd43201a66e3fc79a65db5f61fc181f04cd27aab950c",
+        "sha256": "23f08335362185a5ea2ad3a4e597f1375e78bce8a040df5c600c8d3552ef2394",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "1.16.0"
+      "version": "1.17.0"
    },
    "mime": {
      "dependency": "transitive",
@@ -1434,21 +1466,21 @@
      "dependency": "transitive",
      "description": {
        "name": "path_provider_android",
-        "sha256": "993381400e94d18469750e5b9dcb8206f15bc09f9da86b9e44a9b0092a0066db",
+        "sha256": "f2c65e21139ce2c3dad46922be8272bb5963516045659e71bb16e151c93b580e",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "2.2.18"
+      "version": "2.2.22"
    },
    "path_provider_foundation": {
      "dependency": "transitive",
      "description": {
        "name": "path_provider_foundation",
-        "sha256": "16eef174aacb07e09c351502740fa6254c165757638eba1e9116b0a781201bbd",
+        "sha256": "6d13aece7b3f5c5a9731eaf553ff9dcbc2eff41087fd2df587fd0fed9a3eb0c4",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "2.4.2"
+      "version": "2.5.1"
    },
    "path_provider_linux": {
      "dependency": "transitive",
@@ -1634,11 +1666,11 @@
      "dependency": "transitive",
      "description": {
        "name": "qs_dart",
-        "sha256": "23e435223d985630e3880fd667128f520237059ca3af0cc2dc029d5365ce9ec1",
+        "sha256": "27da57e8b394163f96b74bccb6eb6115bfd2585de4b9ad6241bdf1a9797ab54f",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "1.5.6"
+      "version": "1.6.0"
    },
    "riverpod": {
      "dependency": "transitive",
@@ -1774,11 +1806,11 @@
      "dependency": "direct main",
      "description": {
        "name": "share_plus",
-        "sha256": "3424e9d5c22fd7f7590254ba09465febd6f8827c8b19a44350de4ac31d92d3a6",
+        "sha256": "14c8860d4de93d3a7e53af51bff479598c4e999605290756bbbe45cf65b37840",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "12.0.0"
+      "version": "12.0.1"
    },
    "share_plus_platform_interface": {
      "dependency": "transitive",
@@ -1804,21 +1836,21 @@
      "dependency": "transitive",
      "description": {
        "name": "shared_preferences_android",
-        "sha256": "bd14436108211b0d4ee5038689a56d4ae3620fd72fd6036e113bf1345bc74d9e",
+        "sha256": "83af5c682796c0f7719c2bbf74792d113e40ae97981b8f266fa84574573556bc",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "2.4.13"
+      "version": "2.4.18"
    },
    "shared_preferences_foundation": {
      "dependency": "transitive",
      "description": {
        "name": "shared_preferences_foundation",
-        "sha256": "6a52cfcdaeac77cad8c97b539ff688ccfc458c007b4db12be584fbe5c0e49e03",
+        "sha256": "4e7eaffc2b17ba398759f1151415869a34771ba11ebbccd1b0145472a619a64f",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "2.5.4"
+      "version": "2.5.6"
    },
    "shared_preferences_linux": {
      "dependency": "transitive",
@@ -1958,16 +1990,6 @@
      "source": "git",
      "version": "3.2.1"
    },
-    "sprintf": {
-      "dependency": "transitive",
-      "description": {
-        "name": "sprintf",
-        "sha256": "1fc9ffe69d4df602376b52949af107d8f5703b77cda567c4d7d86a0693120f23",
-        "url": "https://pub.dev"
-      },
-      "source": "hosted",
-      "version": "7.0.0"
-    },
    "sqflite": {
      "dependency": "transitive",
      "description": {
@@ -2092,11 +2114,21 @@
      "dependency": "transitive",
      "description": {
        "name": "test_api",
-        "sha256": "522f00f556e73044315fa4585ec3270f1808a4b186c936e612cab0b565ff1e00",
+        "sha256": "ab2726c1a94d3176a45960b6234466ec367179b87dd74f1611adb1f3b5fb9d55",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "0.7.6"
+      "version": "0.7.7"
+    },
+    "threshold": {
+      "dependency": "transitive",
+      "description": {
+        "name": "threshold",
+        "sha256": "0a1585947eb84bfbe7ca6a6598c9075d3d71fe969e81668cd6d2122be664fd39",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "1.0.5"
    },
    "time": {
      "dependency": "transitive",
@@ -2132,11 +2164,11 @@
      "dependency": "transitive",
      "description": {
        "name": "universal_io",
-        "sha256": "1722b2dcc462b4b2f3ee7d188dad008b6eb4c40bbd03a3de451d82c78bba9aad",
+        "sha256": "f63cbc48103236abf48e345e07a03ce5757ea86285ed313a6a032596ed9301e2",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "2.2.2"
+      "version": "2.3.1"
    },
    "universal_platform": {
      "dependency": "transitive",
@@ -2162,11 +2194,11 @@
      "dependency": "transitive",
      "description": {
        "name": "uri_parser",
-        "sha256": "ff4d2c720aca3f4f7d5445e23b11b2d15ef8af5ddce5164643f38ff962dcb270",
+        "sha256": "051c62e5f693de98ca9f130ee707f8916e2266945565926be3ff20659f7853ce",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "3.0.0"
+      "version": "3.0.2"
    },
    "url_launcher": {
      "dependency": "direct main",
@@ -2182,41 +2214,41 @@
      "dependency": "transitive",
      "description": {
        "name": "url_launcher_android",
-        "sha256": "199bc33e746088546a39cc5f36bac5a278c5e53b40cb3196f99e7345fdcfae6b",
+        "sha256": "767344bf3063897b5cf0db830e94f904528e6dd50a6dfaf839f0abf509009611",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "6.3.22"
+      "version": "6.3.28"
    },
    "url_launcher_ios": {
      "dependency": "transitive",
      "description": {
        "name": "url_launcher_ios",
-        "sha256": "d80b3f567a617cb923546034cc94bfe44eb15f989fe670b37f26abdb9d939cb7",
+        "sha256": "cfde38aa257dae62ffe79c87fab20165dfdf6988c1d31b58ebf59b9106062aad",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "6.3.4"
+      "version": "6.3.6"
    },
    "url_launcher_linux": {
      "dependency": "transitive",
      "description": {
        "name": "url_launcher_linux",
-        "sha256": "4e9ba368772369e3e08f231d2301b4ef72b9ff87c31192ef471b380ef29a4935",
+        "sha256": "d5e14138b3bc193a0f63c10a53c94b91d399df0512b1f29b94a043db7482384a",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "3.2.1"
+      "version": "3.2.2"
    },
    "url_launcher_macos": {
      "dependency": "transitive",
      "description": {
        "name": "url_launcher_macos",
-        "sha256": "c043a77d6600ac9c38300567f33ef12b0ef4f4783a2c1f00231d2b1941fea13f",
+        "sha256": "368adf46f71ad3c21b8f06614adb38346f193f3a59ba8fe9a2fd74133070ba18",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "3.2.3"
+      "version": "3.2.5"
    },
    "url_launcher_platform_interface": {
      "dependency": "transitive",
@@ -2242,21 +2274,21 @@
      "dependency": "transitive",
      "description": {
        "name": "url_launcher_windows",
-        "sha256": "3284b6d2ac454cf34f114e1d3319866fdd1e19cdc329999057e44ffe936cfa77",
+        "sha256": "712c70ab1b99744ff066053cbe3e80c73332b38d46e5e945c98689b2e66fc15f",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "3.1.4"
+      "version": "3.1.5"
    },
    "uuid": {
      "dependency": "direct main",
      "description": {
        "name": "uuid",
-        "sha256": "a5be9ef6618a7ac1e964353ef476418026db906c4facdedaa299b7a2e71690ff",
+        "sha256": "a11b666489b1954e01d992f3d601b1804a33937b5a8fe677bd26b8a9f96f96e8",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "4.5.1"
+      "version": "4.5.2"
    },
    "value_layout_builder": {
      "dependency": "transitive",
@@ -2352,11 +2384,11 @@
      "dependency": "transitive",
      "description": {
        "name": "watcher",
-        "sha256": "5bf046f41320ac97a469d506261797f35254fa61c641741ef32dacda98b7d39c",
+        "sha256": "592ab6e2892f67760543fb712ff0177f4ec76c031f02f5b4ff8d3fc5eb9fb61a",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "1.1.3"
+      "version": "1.1.4"
    },
    "weak_map": {
      "dependency": "transitive",
@@ -2402,11 +2434,11 @@
      "dependency": "transitive",
      "description": {
        "name": "win32",
-        "sha256": "66814138c3562338d05613a6e368ed8cfb237ad6d64a9e9334be3f309acfca03",
+        "sha256": "d7cb55e04cd34096cd3a79b3330245f54cb96a370a1c27adb3c84b917de8b08e",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "5.14.0"
+      "version": "5.15.0"
    },
    "win32_registry": {
      "dependency": "transitive",
@@ -33,7 +33,7 @@
 }:

 let
-  version = "2024.1.1";
+  version = "2024.1.3";
  data = stdenv.mkDerivation rec {
    pname = "flightgear-data";
    inherit version;
@@ -41,8 +41,8 @@ let
    src = fetchFromGitLab {
      owner = "flightgear";
      repo = "fgdata";
-      tag = "v${version}";
-      hash = "sha256-PdqsIZw9mSrvnqqB/fVFjWPW9njhXLWR/2LQCMoBLQI=";
+      tag = "${version}";
+      hash = "sha256-LNHO/W8p4b8fYcehdfVecldKQ9uJp1zlg60xdgDC45c=";
    };

    dontUnpack = true;
@@ -62,8 +62,8 @@ stdenv.mkDerivation rec {
  src = fetchFromGitLab {
    owner = "flightgear";
    repo = "flightgear";
-    tag = "v${version}";
-    hash = "sha256-h4N18VAbJGQSBKA+eEQxej5e5MEwAcZpvH+dpTypM+k=";
+    tag = "${version}";
+    hash = "sha256-m4bbWwMXwKJrMkb6svGrIZhcsPghrTMgFs8JCx3Wn/A=";
  };

  nativeBuildInputs = [
@@ -104,6 +104,11 @@ stdenv.mkDerivation rec {

  qtWrapperArgs = [ "--set FG_ROOT ${data}/share/FlightGear" ];

+  postInstall = ''
+    # Remove redundant AppImage artifacts
+    rm -rf "$out/appdir"
+  '';
+
  meta = {
    description = "Flight simulator";
    maintainers = with lib.maintainers; [ raskin ];
@@ -3,63 +3,68 @@
  stdenv,
  fetchFromGitHub,
  rustPlatform,
-  appstream-glib,
-  cargo,
-  desktop-file-utils,
-  glib,
-  libadwaita,
-  meson,
-  ninja,
+  fontconfig,
+  libxkbcommon,
+  openssl,
  pkg-config,
-  rustc,
-  wrapGAppsHook4,
-  dbus,
-  gtk4,
-  sqlite,
+  xorg,
+  vulkan-loader,
+  wayland,
 }:
-
-stdenv.mkDerivation (finalAttrs: {
+rustPlatform.buildRustPackage (finalAttrs: {
  pname = "furtherance";
-  version = "1.8.3";
+  version = "25.3.0";

  src = fetchFromGitHub {
-    owner = "lakoliu";
+    owner = "unobserved-io";
    repo = "Furtherance";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-TxYARpCqqjjwinoRU2Wjihp+FYIvcI0YCGlOuumX6To=";
+    rev = finalAttrs.version;
+    hash = "sha256-LyGO+fbsu16Us0+sK0T6HlGq7EwZWSetd+gCIKKEbkk=";
  };

-  cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit (finalAttrs) pname version src;
-    hash = "sha256-SFp9YCmneOll2pItWmg2b2jrpRqPnvV9vwz4mjjvwM4=";
-  };
+  cargoHash = "sha256-j/5O40k12rl/gmRc1obo9ImdkZ0Mdrke2PCf6tFCWIo=";

  nativeBuildInputs = [
-    appstream-glib
-    desktop-file-utils
-    meson
-    ninja
    pkg-config
-    rustPlatform.cargoSetupHook
-    cargo
-    rustc
-    wrapGAppsHook4
  ];

  buildInputs = [
-    dbus
-    glib
-    gtk4
-    libadwaita
-    sqlite
+    fontconfig
+    openssl
+    libxkbcommon
+    xorg.libX11
+    xorg.libXScrnSaver
+    xorg.libXcursor
+    xorg.libXi
+    vulkan-loader
+    wayland
  ];

+  checkFlags = [
+    # panicked at src/tests/timer_tests.rs:30:9
+    "--skip=tests::timer_tests::timer_tests::test_split_task_input_basic"
+  ];
+
+  postFixup = lib.optionalString stdenv.hostPlatform.isLinux ''
+    patchelf $out/bin/${finalAttrs.pname} \
+      --add-rpath ${
+        lib.makeLibraryPath [
+          vulkan-loader
+          libxkbcommon
+          wayland
+        ]
+      }
+  '';
+
  meta = {
    description = "Track your time without being tracked";
    mainProgram = "furtherance";
-    homepage = "https://github.com/lakoliu/Furtherance";
+    homepage = "https://github.com/unobserved-io/Furtherance";
    license = lib.licenses.gpl3Plus;
    platforms = lib.platforms.linux;
-    maintainers = with lib.maintainers; [ CaptainJawZ ];
+    maintainers = with lib.maintainers; [
+      CaptainJawZ
+      locnide
+    ];
  };
 })
@@ -18,16 +18,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "halloy";
-  version = "2025.11";
+  version = "2025.12";

  src = fetchFromGitHub {
    owner = "squidowl";
    repo = "halloy";
    tag = version;
-    hash = "sha256-5cYTHb3KK5EiPv5P8GZOoQwSSIe0FO+qBnpvLZtuByI=";
+    hash = "sha256-rVeh0nvmRjfOErwUhiWBx3hHla9bA2mSOORNSqSOrfw=";
  };

-  cargoHash = "sha256-gGVclMEcvgdl3ZTiEdhW48xhC9/eONeHp0KX1lHKKxU=";
+  cargoHash = "sha256-lxRLTVtc2Gu3x3bt4po4q5/sfmRXb7CslEQIP8hX0+Q=";

  nativeBuildInputs = [
    copyDesktopItems
@@ -3,6 +3,7 @@
  stdenv,
  cmake,
  libSrc,
+  compressStep,
  stepreduce,
  parallel,
  zip,
@@ -27,9 +28,9 @@ let

      postInstall =
        lib.optionalString (name == "packages3d") ''
-          find $out -type f -name '*.step' | parallel 'stepreduce {} {} && zip -9 {.}.stpZ {} && rm {}'
+          find $out -type f -name '*.step' | parallel 'stepreduce {} {} ${lib.optionalString compressStep "&& zip -9 {.}.stpZ {} && rm {}"}'
        ''
-        + lib.optionalString (name == "footprints") ''
+        + lib.optionalString ((name == "footprints") && compressStep) ''
          grep -rl '\.step' $out | xargs sed -i 's/\.step/.stpZ/g'
        '';

@@ -23,6 +23,7 @@

  pname ? "kicad",
  stable ? true,
+  compressStep ? true,
  testing ? false,
  withNgspice ? !stdenv.hostPlatform.isDarwin,
  libngspice,
@@ -177,7 +178,7 @@ in
 stdenv.mkDerivation rec {

  # Common libraries, referenced during runtime, via the wrapper.
-  passthru.libraries = callPackages ./libraries.nix { inherit libSrc; };
+  passthru.libraries = callPackages ./libraries.nix { inherit libSrc compressStep; };
  passthru.callPackage = newScope { inherit addonPath python3; };
  base = callPackage ./base.nix {
    inherit stable testing;
@@ -6,14 +6,14 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "knowsmore";
-  version = "0.1.49";
+  version = "0.1.50";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "helviojunior";
    repo = "knowsmore";
    tag = "v${version}";
-    hash = "sha256-1qWbDf5lh9HogjjPoI51znpcQrriB2Eg4eA4xDQDYA8=";
+    hash = "sha256-D3WhlReBwQLU+U/389r5gR73+DNvFiVuSr6NQgG2oFY=";
  };

  pythonRelaxDeps = [
@@ -7,13 +7,13 @@

 stdenvNoCC.mkDerivation {
  pname = "libretro-shaders-slang";
-  version = "0-unstable-2025-12-13";
+  version = "0-unstable-2025-12-22";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "slang-shaders";
-    rev = "b80bba0c71e98250717acc5f4e6b9bb9f75bd091";
-    hash = "sha256-CSe7tP8N1ubZ5igjoLpi/w3XmbH3tGpbjBfI4i9pd5o=";
+    rev = "92ec9ff8c2d53d397b6d943788c748c073ee1fe8";
+    hash = "sha256-p2CmXbgd0oKibZa2PiS3xI6KXfsIWtJ+QyvLrc9PFWY=";
  };

  dontConfigure = true;
@@ -15,11 +15,11 @@

 stdenv.mkDerivation rec {
  pname = "log4cxx";
-  version = "1.5.0";
+  version = "1.6.0";

  src = fetchurl {
    url = "mirror://apache/logging/log4cxx/${version}/apache-${pname}-${version}.tar.gz";
-    hash = "sha256-qiP0fDFkqiz4SMIli0tLw3Lnlk1KPtR8K0pKkVxd+jc=";
+    hash = "sha256-R9doxXZcVyHPJ9Ug+H7ycikboPTg0yHHJzXVrshwGKc=";
  };

  postPatch = ''
@@ -25,13 +25,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "mangojuice";
-  version = "0.8.8";
+  version = "0.8.9";

  src = fetchFromGitHub {
    owner = "radiolamp";
    repo = "mangojuice";
    tag = finalAttrs.version;
-    hash = "sha256-M8aKS360AsgoSKCyZXdtD7SbMDvK6OgAuNoGa68NZRQ=";
+    hash = "sha256-+qcYtUAszfL54vsKkwHfhMamPvWUJkpgK1CktVgsoLA=";
  };

  patches = [
@@ -11,8 +11,8 @@ mattermost.override {
    # and make sure the version regex is up to date here.
    # Ensure you also check ../mattermost/package.nix for ESR releases.
    regex = "^v(11\\.[0-9]+\\.[0-9]+)$";
-    version = "11.2.0";
-    srcHash = "sha256-XVv0cmKkfA5MyZr/VuS7tGEteoSzhaKWq0Ae05jkRiQ=";
+    version = "11.2.1";
+    srcHash = "sha256-y92zzL8yHlDxOStvAr1Mu+PPhTVlVQueBNtm4dhC/4w=";
    vendorHash = "sha256-mvQivHijLEdfTk7QzlfWQQn9S/9lMfrI+jSKKz0bh3M=";
    npmDepsHash = "sha256-YuJ0IfvhWb6kzBoTMYWV3mUhMuhrAelKoyXlmnQJovo=";
    lockfileOverlay = ''
@@ -1,7 +1,7 @@
 {
  lib,
  mdbook,
-  nodePackages,
+  nodejs,
  python3,
  util-linux,
  rustPlatform,
@@ -21,7 +21,7 @@ rustPlatform.buildRustPackage {

  nativeCheckInputs = [
    mdbook # used by tests/book.rs
-    nodePackages.nodejs # used by tests/regression/inline_call/input.md
+    nodejs # used by tests/regression/inline_call/input.md
    python3 # used by tests/regression/py_*
    util-linux # used by tests/regression/shell/input.md
  ];
@@ -4,15 +4,12 @@ src: version:
  fetchFromGitHub,
  fetchYarnDeps,
  dart-sass,
-  nodePackages_latest,
+  nodejs,
  fixup-yarn-lock,
  stdenv,
  yarn,
  writableTmpDirAsHomeHook,
 }:
-let
-  nodejs = nodePackages_latest.nodejs;
-in
 stdenv.mkDerivation {
  name = "mealie-frontend";
  inherit version;
@@ -8,13 +8,13 @@

 crystal.buildCrystalPackage rec {
  pname = "mint";
-  version = "0.24.1";
+  version = "0.28.1";

  src = fetchFromGitHub {
    owner = "mint-lang";
    repo = "mint";
    tag = version;
-    hash = "sha256-gMR/FUp/pOC0TQy6ENH3pIxK43hrHEciT17aGqXVKc8=";
+    hash = "sha256-CC3+ygs2JnqtKRGOlP5hZqnVARrgLjV5EewAP+jDM0M=";
  };

  format = "shards";
@@ -6,8 +6,8 @@
  };
  ameba = {
    url = "https://github.com/crystal-ameba/ameba.git";
-    rev = "v1.6.4";
-    sha256 = "1kzr4ynd4r5w87y2czzrlir1dvqmv43ijm07804kgsy1g20k00fs";
+    rev = "37fe65d0d86477ecd6cf0bab2d519f2235fea6b5";
+    sha256 = "135jlnxqgg5haxfp5wprw3s0hqhhay2k22vgy2fy6vilk8rlcy7w";
  };
  ansi-escapes = {
    url = "https://github.com/gtramontina/ansi-escapes.cr.git";
@@ -12,17 +12,18 @@

 stdenv.mkDerivation rec {
  pname = "moosefs";
-  version = "4.58.2";
+  version = "4.58.3";

  src = fetchFromGitHub {
    owner = "moosefs";
    repo = "moosefs";
    rev = "v${version}";
-    sha256 = "sha256-eywJ7MmCrwxqlbTDYEEPs6ego9Ivn+ziXCBNhcDfcmY=";
+    sha256 = "sha256-lEnCP+ORWdW52SVO7K3WxcjlFMrQFR9VT8fjquI/fZg=";
  };

  nativeBuildInputs = [
    pkg-config
+    python3
  ];

  buildInputs = [
@@ -50,10 +51,6 @@ stdenv.mkDerivation rec {
      "#undef HAVE_STRUCT_STAT_ST_BIRTHTIME"
  '';

-  postInstall = ''
-    substituteInPlace $out/sbin/mfscgiserv --replace "datapath=\"$out" "datapath=\""
-  '';
-
  doCheck = true;

  passthru.tests = {
@@ -7,7 +7,7 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "nlohmann_json_schema_validator";
-  version = "2.3.0";
+  version = "2.4.0";

  outputs = [
    "out"
@@ -18,7 +18,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "pboettch";
    repo = "json-schema-validator";
    rev = finalAttrs.version;
-    hash = "sha256-Ybr5dNmjBBPTYPvgorJ6t2+zvAjxYQISWXJmgUVHBVE=";
+    hash = "sha256-VTRnlkcSPMCRQiu5H2P44nHG1JMV9gl04xYjppstsk4=";
  };

  buildInputs = [ nlohmann_json ];
@@ -7,7 +7,7 @@
  nix-update-script,
 }:
 let
-  version = "2.7.5";
+  version = "2.8";
 in
 python3.pkgs.buildPythonApplication {
  pname = "novelwriter";
@@ -18,7 +18,7 @@ python3.pkgs.buildPythonApplication {
    owner = "vkbo";
    repo = "novelWriter";
    tag = "v${version}";
-    hash = "sha256-qCbtQwV+dU/ypnb5UruTsXas9XUqlJweaxnfqTHsT+I=";
+    hash = "sha256-6OIDsmPVbpU90bbj4O2CO5YXNtz0bCrG2ygruxsl9Ec=";
  };

  nativeBuildInputs = [ qt6.wrapQtAppsHook ];
@@ -13,17 +13,17 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "oxigraph";
-  version = "0.5.2";
+  version = "0.5.3";

  src = fetchFromGitHub {
    owner = "oxigraph";
    repo = "oxigraph";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-ptTrJbLGS7GkLGO40mbpdPkrcspaUE33kRZ8g9Qtb0o=";
+    hash = "sha256-hIB4/6D7AogEpNYyB95nDotspUyaiOW8X6KuVgyjj5Y=";
    fetchSubmodules = true;
  };

-  cargoHash = "sha256-AuUGra9ejPRKWWpXWLmcwGuZRKIuCYTdifpnwuuHnnQ=";
+  cargoHash = "sha256-EhJQgYeeSln1bLLH3nEUFJ7q+PWA/DHAswh4ei4bHWY=";

  nativeBuildInputs = [
    rustPlatform.bindgenHook
@@ -119,7 +119,7 @@ stdenv.mkDerivation (finalAttrs: {
    mainProgram = "pragha";
    homepage = "https://pragha-music-player.github.io/";
    license = lib.licenses.gpl3Plus;
-    maintainers = with lib.maintainers; [ mbaeten ];
+    maintainers = [ ];
    platforms = lib.platforms.unix;
  };
 })
@@ -0,0 +1,13 @@
+diff --git a/pyrefly/lib/test/lsp/lsp_interaction/configuration.rs b/pyrefly/lib/test/lsp/lsp_interaction/configuration.rs
+index edc2db09f..ce33a2774 100644
+--- a/pyrefly/lib/test/lsp/lsp_interaction/configuration.rs
+++ b/pyrefly/lib/test/lsp/lsp_interaction/configuration.rs
+@@ -56,7 +56,7 @@ fn setup_dummy_interpreter(custom_interpreter_path: &Path) -> PathBuf {
+     // Create a mock Python interpreter script that returns the environment info
+     // This simulates what a real Python interpreter would return when queried with the env script
+     let python_script = format!(
+-        r#"#!/usr/bin/env bash
+        r#"#!@bash@
+ if [[ "$1" == "-c" && "$2" == *"import json, sys"* ]]; then
+     cat << 'EOF'
+ {{"python_platform": "linux", "python_version": "3.12.0", "site_package_path": ["{site_packages}"]}}
@@ -1,5 +1,7 @@
 {
  lib,
+  bash,
+  replaceVars,
  rustPlatform,
  fetchFromGitHub,
  versionCheckHook,
@@ -8,17 +10,17 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "pyrefly";
-  version = "0.44.2";
+  version = "0.46.0";

  src = fetchFromGitHub {
    owner = "facebook";
    repo = "pyrefly";
    tag = finalAttrs.version;
-    hash = "sha256-d0aZQkCt2Yypj2CSav585M6TuoUEwPXpz1oKLjFo6NI=";
+    hash = "sha256-Owsma92bEwjyYFOb2AOzdLmAYIY398NrR9ztZ0bYhMc=";
  };

  buildAndTestSubdir = "pyrefly";
-  cargoHash = "sha256-gXKLzD5JbG62pc0pW5sRQJvBwr1ftu/ZOOXsQ7ZdWIU=";
+  cargoHash = "sha256-U3VlzjnsPmFlgaXdogqWOyJAv63vpPDULfcmcB5IHXc=";

  buildInputs = [ rust-jemalloc-sys ];

@@ -26,18 +28,15 @@ rustPlatform.buildRustPackage (finalAttrs: {
  versionCheckProgramArg = "--version";
  doInstallCheck = true;

+  patches = [
+    (replaceVars ./fix-shebang.patch { bash = lib.getExe bash; })
+  ];
+
  # redirect tests writing to /tmp
  preCheck = ''
    export TMPDIR=$(mktemp -d)
  '';

-  checkFlags = [
-    # FIX: tracking on https://github.com/facebook/pyrefly/issues/1667
-    "--skip=test::lsp::lsp_interaction::configuration::test_pythonpath_change"
-    "--skip=test::lsp::lsp_interaction::configuration::test_workspace_pythonpath_ignored_when_set_in_config_file"
-    "--skip=test::lsp::lsp_interaction::notebook_sync::test_notebook_publish_diagnostics"
-  ];
-
  # requires unstable rust features
  env.RUSTC_BOOTSTRAP = 1;

@@ -11,13 +11,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "qdl";
-  version = "2.2";
+  version = "2.4";

  src = fetchFromGitHub {
    owner = "linux-msm";
    repo = "qdl";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-aC5c22gSrQ6EKEZ0vNdfBQF+ZKRN3jrgTB1KUXGLEPA=";
+    hash = "sha256-8jkuSNK7xTBUkBWzh766zKOlh+7pTr+e0xT1w3xifsw=";
  };

  postPatch = ''
@@ -67,6 +67,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
    export PATH=$PATH:$PWD/target/${stdenv.hostPlatform.rust.rustcTargetSpec}/release
    # Tests want to open many files.
    ulimit -n 4096
+    # Cap test threads to avoid timing issues on loaded builders (sync timeout is 5s)
+    max_threads=4
+    if [[ -n "$NIX_BUILD_CORES" && "$NIX_BUILD_CORES" -lt "$max_threads" ]]; then
+      max_threads=$NIX_BUILD_CORES
+    fi
+    export RUST_TEST_THREADS=$max_threads
  '';
  checkFlags = [
    "--skip=service::message::tests::test_node_announcement_validate"
@@ -17,15 +17,22 @@
  chromium,
 }:

+let
+  yarnLock = ./yarn.lock;
+  offlineCache = fetchYarnDeps {
+    inherit yarnLock;
+    hash = "sha256-MRCrBvqDpPpwMg4A50RVKGp4GqRHNjNJzSpJz+14OG4=";
+  };
+in
 stdenvNoCC.mkDerivation rec {
  pname = "Sharedown";
-  version = "5.3.6";
+  version = "5.3.6-unstable-2025-12-06";

  src = fetchFromGitHub {
    owner = "kylon";
    repo = "Sharedown";
-    tag = version;
-    hash = "sha256-5t/71T/eBg4vkDZTj7mtCkXhS+AuiVhBmx0Zzrry5Lg=";
+    rev = "c39f0c5bbf694c2cdfce4ef0b4381342fb535ecc";
+    hash = "sha256-PsfE7v9yEeGC8rUzhj/klhqtKKzxCV+thwLnQlgfDxI=";
  };

  nativeBuildInputs = [
@@ -58,7 +65,12 @@ stdenvNoCC.mkDerivation rec {

      modules = yarn2nix-moretea.mkYarnModules rec {
        name = "Sharedown-modules-${version}";
-        inherit pname version;
+        inherit
+          pname
+          version
+          offlineCache
+          yarnLock
+          ;

        yarnFlags = [ "--production" ];

@@ -93,12 +105,6 @@ stdenvNoCC.mkDerivation rec {
        '';

        packageJSON = "${src}/package.json";
-        yarnLock = ./yarn.lock;
-
-        offlineCache = fetchYarnDeps {
-          inherit yarnLock;
-          hash = "sha256-9Mdn18jJTXyAVQMGl9ImIEbzlkK6walPrgkGzupLPFQ=";
-        };
      };
    in
    ''
@@ -121,7 +127,10 @@ stdenvNoCC.mkDerivation rec {
      runHook postInstall
    '';

-  passthru.updateScript = ./update.sh;
+  passthru = {
+    inherit offlineCache;
+    updateScript = ./update.sh;
+  };

  meta = {
    description = "Application to save your Sharepoint videos for offline usage";
@@ -1,24 +1,28 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p common-updater-scripts curl jq yarn yarn2nix-moretea.yarn2nix nodejs
+#!nix-shell -i bash -p common-updater-scripts curl gnugrep jq yarn yarn2nix-moretea.yarn2nix nix-update nodejs
+# See git history for the version of this script that updated to tagged versions.

 set -euo pipefail

-latestVersion=$(curl ${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} -sL "https://api.github.com/repos/kylon/Sharedown/releases/latest" | jq -r '.tag_name')
-currentVersion=$(nix-instantiate --eval --expr 'with import ./. {}; sharedown.version' | tr -d '"')
+nixpkgsDir="$PWD"

-if [[ "$currentVersion" == "$latestVersion" && "${BUMP_LOCK-}" != "1" ]]; then
+currentRev=$(nix-instantiate --eval --expr 'with import ./. {}; sharedown.src.rev' | tr -d '"')
+nix-update --version=branch --src-only sharedown
+
+latestRev=$(nix-instantiate --eval --expr 'with import ./. {}; sharedown.src.rev' | tr -d '"')
+dirname="$(realpath "$(dirname "$0")")"
+sourceDir="$(nix-build -A sharedown.src --no-out-link)"
+tempDir="$(mktemp -d)"
+trap 'chmod -R u+w $tempDir && rm -rf $tempDir' EXIT
+
+if [[ "$currentRev" == "$latestRev" && "${BUMP_LOCK-}" != "1" ]]; then
    # Skip update when already on the latest version.
    exit 0
 fi

-update-source-version sharedown "$latestVersion"
-
-dirname="$(realpath "$(dirname "$0")")"
-sourceDir="$(nix-build -A sharedown.src --no-out-link)"
-tempDir="$(mktemp -d)"
-
 cp -r "$sourceDir"/* "$tempDir"
 cd "$tempDir"
-PUPPETEER_SKIP_DOWNLOAD=1 yarn install
-yarn2nix >"$dirname/yarndeps.nix"
-cp -r yarn.lock "$dirname"
+PUPPETEER_SKIP_DOWNLOAD=1 yarn install --mode update-lockfile
+cp yarn.lock "$dirname"
+cd "$nixpkgsDir"
+update-source-version sharedown --ignore-same-version --source-key=offlineCache
@@ -25,9 +25,10 @@
  apr,
  xz,
  curl,
+  c-ares,
 }:
 let
-  version = "2024.1.1";
+  version = "2024.1.3";
 in
 stdenv.mkDerivation rec {
  pname = "simgear";
@@ -36,8 +37,8 @@ stdenv.mkDerivation rec {
  src = fetchFromGitLab {
    owner = "flightgear";
    repo = "simgear";
-    tag = "v${version}";
-    hash = "sha256-hOA/q/cTsqRy82rTAXRxyHBDdw93TW9UL+K5Jq5b/08=";
+    tag = "${version}";
+    hash = "sha256-1zbw/lIjTbVwhxHPvXRlxPmYJeWmKvPE/RDrTL0PXb4=";
  };

  nativeBuildInputs = [ cmake ];
@@ -66,6 +67,8 @@ stdenv.mkDerivation rec {
    xz
  ];

+  propagatedBuildInputs = [ c-ares ];
+
  meta = {
    description = "Simulation construction toolkit";
    homepage = "https://wiki.flightgear.org/SimGear";
@@ -0,0 +1,49 @@
+{
+  lib,
+  stdenv,
+  buildGoModule,
+  fetchFromGitHub,
+  apple-sdk_15,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "snitch";
+  version = "0.1.9";
+
+  src = fetchFromGitHub {
+    owner = "karol-broda";
+    repo = "snitch";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-/0MYXKBat+OumuXnS8XSiMslNHUopVDFO4RdYGECfI8=";
+  };
+
+  vendorHash = "sha256-fX3wOqeOgjH7AuWGxPQxJ+wbhp240CW8tiF4rVUUDzk=";
+
+  # these below settings (env, buildInputs, ldflags) copied from
+  # https://github.com/karol-broda/snitch/blob/master/flake.nix
+
+  env = {
+    # darwin requires cgo for libproc, linux uses pure go with /proc
+    CGO_ENABLED = if stdenv.hostPlatform.isDarwin then 1 else 0;
+  };
+
+  # darwin: use macOS 15 SDK for SecTrustCopyCertificateChain (Go 1.25 crypto/x509)
+  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ apple-sdk_15 ];
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X snitch/cmd.Version=${finalAttrs.version}"
+    "-X snitch/cmd.Commit=v${finalAttrs.version}"
+    "-X snitch/cmd.Date=1970-01-01"
+  ];
+
+  meta = {
+    description = "friendlier ss / netstat for humans";
+    homepage = "https://github.com/karol-broda/snitch";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.DieracDelta ];
+    platforms = lib.platforms.unix;
+    mainProgram = "snitch";
+  };
+})
@@ -10,16 +10,16 @@
 }:
 rustPlatform.buildRustPackage rec {
  pname = "squawk";
-  version = "2.26.0";
+  version = "2.32.0";

  src = fetchFromGitHub {
    owner = "sbdchd";
    repo = "squawk";
    tag = "v${version}";
-    hash = "sha256-X1vr2WAWkv9puO5CCM6TrFg/5H5buemcplvIeYtk6Qo=";
+    hash = "sha256-k1UvK8OTY0CEjVFJ761jb52j05r/rzUDd+Jca/tVX1g=";
  };

-  cargoHash = "sha256-eyQQ7bdbu/o5UQ7edjgs3ZLiya/q5c+jgLSWQfAs5ck=";
+  cargoHash = "sha256-QEbBfy4QqKfWO3SDq35HlUvB8FIbXVByM2c0OphfEsk=";

  nativeBuildInputs = [
    pkg-config
@@ -14,14 +14,14 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "ty";
-  version = "0.0.5";
+  version = "0.0.6";

  src = fetchFromGitHub {
    owner = "astral-sh";
    repo = "ty";
    tag = finalAttrs.version;
    fetchSubmodules = true;
-    hash = "sha256-G9sVPg1fe35CNYJlRO/1zm3gOY78qfmU/RwKw2iG7o8=";
+    hash = "sha256-bmzbEbpr7ZF0p9cqNf04v0Ql3PWaQByf0UCHArffhzI=";
  };

  # For Darwin platforms, remove the integration test for file notifications,
@@ -35,7 +35,7 @@ rustPlatform.buildRustPackage (finalAttrs: {

  cargoBuildFlags = [ "--package=ty" ];

-  cargoHash = "sha256-NyNXR1PGds+GXAha9u4DglUyy7T+yqLjNpGnchYn6oc=";
+  cargoHash = "sha256-d5F9xp770b4M5T5k04/1DiMsXm9RwkL6IZuaSrACfvM=";

  nativeBuildInputs = [ installShellFiles ];

@@ -103,15 +103,14 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "${optionalString onlyLibVLC "lib"}vlc";
-  version = "3.0.23";
+  version = "3.0.23-2";

  src = fetchFromGitLab {
    domain = "code.videolan.org";
    owner = "videolan";
    repo = "vlc";
-    # 3.0.23 was retagged (3697ebcb2716cb4f9c7824b11ce33afefb0212ab -> 578d28f6c9f2379164516e689418f92ac74a3445)
-    rev = "578d28f6c9f2379164516e689418f92ac74a3445";
-    hash = "sha256-/gopvzgtvbaIHq7VG8/edAelhSApQT7GxD5mN9nvfOw=";
+    rev = finalAttrs.version;
+    hash = "sha256-vg/kKNrIpGF7Olz8EiA1ZsW5SB4iHlvFbREDp4JokB0=";
  };

  depsBuildBuild = optionals waylandSupport [ pkg-config ];
@@ -10,20 +10,20 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "wayscriber";
-  version = "0.8.9";
+  version = "0.9.1";

  src = fetchFromGitHub {
    owner = "devmobasa";
    repo = "wayscriber";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-NQmi9JozGOD/EQ8dMiBCgIziUmjwhInxypX9dyk3TTY=";
+    hash = "sha256-lhETehKxu4mdQDzM0Lj0FMlrvBfrvEP1T4URyrDFEJ0=";
  };
  nativeBuildInputs = [ pkg-config ];
  buildInputs = [
    pango
    libxkbcommon
  ];
-  cargoHash = "sha256-c/eSzYyAELeP8zU1nnkbmx1E8U1EY5zAR55Wp2zLn9k=";
+  cargoHash = "sha256-pnw6QNukzykYyNSJxG5gcnlOyGJOJrzfQJa5eb+mQmE=";
  passthru.updateScript = nix-update-script { };

  meta = {
@@ -11,13 +11,13 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "wgpu-native";
-  version = "27.0.2.0";
+  version = "27.0.4.0";

  src = fetchFromGitHub {
    owner = "gfx-rs";
    repo = "wgpu-native";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-sJEDCt8DTP6FjtbROVCZVD0we0OA07wjkiLnXoQfTuc=";
+    hash = "sha256-XOT6Wx5TfbFzwcSjoyqUwv7mbN0RShaMf99qADmCKxg=";
    fetchSubmodules = true;
  };

@@ -26,7 +26,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    "dev"
  ];

-  cargoHash = "sha256-ZQiX7IZsbjlDzRNlYgpRnLfCKGAYnSwvACRMNkZPjbE=";
+  cargoHash = "sha256-PZHS2lUX6PbIG1xF6jhreGjdtCbS/GWeY1pHhRPo2aU=";

  nativeBuildInputs = [
    rustPlatform.bindgenHook
@@ -54,7 +54,7 @@ rustPlatform.buildRustPackage rec {

  postInstall = ''
    mkdir -p $out/lib/xrizer/$platformPath
-    ln -s "$out/lib/libxrizer.so" "$out/lib/xrizer/$platformPath/vrclient.so"
+    mv "$out/lib/libxrizer.so" "$out/lib/xrizer/$platformPath/vrclient.so"
  '';

  platformPath =
@@ -15,7 +15,7 @@
  qttools,
  wrapQtAppsHook,
  gitUpdater,
-  version ? "2.3.0",
+  version ? "2.3.1",
  qtx11extras ? null,
 }:

@@ -30,7 +30,7 @@ stdenv.mkDerivation (finalAttrs: {
    hash =
      {
        "1.4.0" = "sha256-QxPYSA7537K+/dRTxIYyg+Q/kj75rZOdzlUsmSdQcn4=";
-        "2.3.0" = "sha256-A0kBwLiPvHIsJWQvg6lwb5lrojU8oDDQYHuC2pTXdPc=";
+        "2.3.1" = "sha256-2PDVNMBwzDpUOkZ7GnrWDMlXBeUgCyZ6vHXurW6fr4s=";
      }
      ."${finalAttrs.version}";
  };
@@ -18,13 +18,13 @@

 stdenv.mkDerivation rec {
  pname = "lxqt-notificationd";
-  version = "2.3.0";
+  version = "2.3.1";

  src = fetchFromGitHub {
    owner = "lxqt";
    repo = "lxqt-notificationd";
    rev = version;
-    hash = "sha256-VmPVGqCmkTkib2T5ysov1hUY3J74GTuXdJsn5Sivreo=";
+    hash = "sha256-TfTOuarMq2m5rAdcfiKqjyGeJzKyUSvhkJ2EoGUMTUQ=";
  };

  nativeBuildInputs = [
@@ -35,13 +35,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "lxqt-panel";
-  version = "2.3.0";
+  version = "2.3.2";

  src = fetchFromGitHub {
    owner = "lxqt";
    repo = "lxqt-panel";
    tag = finalAttrs.version;
-    hash = "sha256-cwemHe092vNRDeseXkGoWAEXawNTVbSiB87owfaLeAo=";
+    hash = "sha256-n/U2EgEZfh8mJWtEX+HByqHqtm9NqIXnURqUzSOcvns=";
  };

  nativeBuildInputs = [
@@ -1,68 +1,73 @@
 {
-  "version": "3.38.4",
-  "engineVersion": "a5cb96369ef86c7e85abf5d662a1ca5d89775053",
+  "version": "3.38.5",
+  "engineVersion": "1527ae0ec577a4ef50e65f6fefcfc1326707d9bf",
  "engineSwiftShaderHash": "sha256-ATVcuxqPHqHOWYyO7DoX9LdgUiO3INUi7m9Mc6ccc1M=",
  "engineSwiftShaderRev": "d040a5bab638bf7c226235c95787ba6288bb6416",
  "channel": "stable",
  "engineHashes": {
    "aarch64-linux": {
-      "x86_64-linux": "sha256-ILLZMfXZ3p9fKMqyaectcaq9MCLWdEEoevKze+HDkyk="
+      "aarch64-linux": "sha256-7eYbNWoKY9JYMAAJ+5cYPXnn15Mvahm6OeL0QVlhtXs=",
+      "x86_64-linux": "sha256-7eYbNWoKY9JYMAAJ+5cYPXnn15Mvahm6OeL0QVlhtXs="
+    },
+    "x86_64-linux": {
+      "aarch64-linux": "sha256-qrOzazP0ZrrzBpkt5dDJIFrHDvoLYcXOR6BqKxgr+h8=",
+      "x86_64-linux": "sha256-qrOzazP0ZrrzBpkt5dDJIFrHDvoLYcXOR6BqKxgr+h8="
    }
  },
-  "dartVersion": "3.10.3",
+  "dartVersion": "3.10.4",
  "dartHash": {
-    "x86_64-linux": "sha256-6Ov/vyLRHKVaUQ7cQPWUC44Rz/jUo0UpsYKXtnBz0wM=",
-    "aarch64-linux": "sha256-gxmQJaaBwcfjdYDCeFJM49AK9ZMRRV2JY7ME5xwpSMA=",
-    "x86_64-darwin": "sha256-UbNAcVUGsbNGnPpmFt/49vJcAXLpcZp7rSFiR7yJZMo=",
-    "aarch64-darwin": "sha256-Mb8sgvT6UsSmoGhh5tcqjRXcnDQPCXl/0SOon9jVNBM="
+    "x86_64-linux": "sha256-ZePB4yLGh5TJVrgXPTv6EY1l5uHhpnD6j8AaErWVP8c=",
+    "aarch64-linux": "sha256-ALgFAnqBXK9NalTnypszhEz+yoUdW8nWU2IN6gWyOBI=",
+    "x86_64-darwin": "sha256-d3Q0hxTu5Q0i3XxKc7HMvq1X8gpHm744Q8HCh/E6JS8=",
+    "aarch64-darwin": "sha256-ha0VitYy4MIZE3U+Vy3bbZiH+0BAetH8CmPMmV8RRUQ="
  },
-  "flutterHash": "sha256-HuFi01uUgYFfghe5h7/Y6LoF6ikQGEXg0v9wTGeURvw=",
+  "flutterHash": "sha256-qIvmxEUHtahABuPFUR+JWfg6yHgNK/i//tnDCZ/aFTE=",
  "artifactHashes": {
    "android": {
-      "aarch64-darwin": "sha256-bzQDGeHb/RA4+t80TMTKExGutKXOeS2NoaMjE0nUnT4=",
-      "aarch64-linux": "sha256-hoFcKAv51lvwhreiEuOq4wbAGXPGIDDMyUrCGWbH+LQ=",
-      "x86_64-darwin": "sha256-bzQDGeHb/RA4+t80TMTKExGutKXOeS2NoaMjE0nUnT4=",
-      "x86_64-linux": "sha256-hoFcKAv51lvwhreiEuOq4wbAGXPGIDDMyUrCGWbH+LQ="
+      "aarch64-darwin": "sha256-G3wi3eSoTKsiLw/GanLX62xMwjT5hVhbDZhhAUe9J7Q=",
+      "aarch64-linux": "sha256-uCtzsKrJtL6USbTS8z3xizoUJmxJuLq1fBDAT/exzOQ=",
+      "x86_64-darwin": "sha256-G3wi3eSoTKsiLw/GanLX62xMwjT5hVhbDZhhAUe9J7Q=",
+      "x86_64-linux": "sha256-uCtzsKrJtL6USbTS8z3xizoUJmxJuLq1fBDAT/exzOQ="
    },
    "fuchsia": {
-      "aarch64-darwin": "sha256-FKjIaWi5z7D+DMgJ1ZBOxawyGMSNdJewshiKjKy6wL8=",
-      "aarch64-linux": "sha256-FKjIaWi5z7D+DMgJ1ZBOxawyGMSNdJewshiKjKy6wL8=",
-      "x86_64-darwin": "sha256-FKjIaWi5z7D+DMgJ1ZBOxawyGMSNdJewshiKjKy6wL8=",
-      "x86_64-linux": "sha256-FKjIaWi5z7D+DMgJ1ZBOxawyGMSNdJewshiKjKy6wL8="
+      "aarch64-darwin": "sha256-nEcdKKVAWMFjY3HkrHp1/oPDW347DXtdtWy6A/oBZxo=",
+      "aarch64-linux": "sha256-nEcdKKVAWMFjY3HkrHp1/oPDW347DXtdtWy6A/oBZxo=",
+      "x86_64-darwin": "sha256-nEcdKKVAWMFjY3HkrHp1/oPDW347DXtdtWy6A/oBZxo=",
+      "x86_64-linux": "sha256-nEcdKKVAWMFjY3HkrHp1/oPDW347DXtdtWy6A/oBZxo="
    },
    "ios": {
-      "aarch64-darwin": "sha256-ifkntEB5z3ZF0PJXAFOQyiM85NFHFwhS576/LTOJX4s=",
-      "aarch64-linux": "sha256-ifkntEB5z3ZF0PJXAFOQyiM85NFHFwhS576/LTOJX4s=",
-      "x86_64-darwin": "sha256-ifkntEB5z3ZF0PJXAFOQyiM85NFHFwhS576/LTOJX4s=",
-      "x86_64-linux": "sha256-ifkntEB5z3ZF0PJXAFOQyiM85NFHFwhS576/LTOJX4s="
+      "aarch64-darwin": "sha256-CCN8JVZ1yIn1H6QtOs4XmkIg6CzzO6wMS8Qe7ziNnoo=",
+      "aarch64-linux": "sha256-CCN8JVZ1yIn1H6QtOs4XmkIg6CzzO6wMS8Qe7ziNnoo=",
+      "x86_64-darwin": "sha256-CCN8JVZ1yIn1H6QtOs4XmkIg6CzzO6wMS8Qe7ziNnoo=",
+      "x86_64-linux": "sha256-CCN8JVZ1yIn1H6QtOs4XmkIg6CzzO6wMS8Qe7ziNnoo="
    },
    "linux": {
-      "aarch64-darwin": "sha256-2/Te39U1JFMZp1eOvXdilOcxr2MldG56Rtf4yN2mB1A=",
-      "aarch64-linux": "sha256-2/Te39U1JFMZp1eOvXdilOcxr2MldG56Rtf4yN2mB1A=",
-      "x86_64-darwin": "sha256-SztFHRYhuuDHnD8YHX/V4CCZe2gSA3Y0iHZKfdPSnWU=",
-      "x86_64-linux": "sha256-SztFHRYhuuDHnD8YHX/V4CCZe2gSA3Y0iHZKfdPSnWU="
+      "aarch64-darwin": "sha256-AzRBBnfcJ/AipXsvX3DO+D2bSy7dzooWXvAEOsj4Jsw=",
+      "aarch64-linux": "sha256-AzRBBnfcJ/AipXsvX3DO+D2bSy7dzooWXvAEOsj4Jsw=",
+      "x86_64-darwin": "sha256-IFHSkU99MKm9WSMCtR+uDfYX/UdgxzF3kYRdyHzAEO8=",
+      "x86_64-linux": "sha256-IFHSkU99MKm9WSMCtR+uDfYX/UdgxzF3kYRdyHzAEO8="
    },
    "macos": {
-      "aarch64-darwin": "sha256-hJvArMT4lEkD6dQeCMsN6E6+CPdvZn+SRRsyWId3HI8=",
-      "aarch64-linux": "sha256-hJvArMT4lEkD6dQeCMsN6E6+CPdvZn+SRRsyWId3HI8=",
-      "x86_64-darwin": "sha256-hJvArMT4lEkD6dQeCMsN6E6+CPdvZn+SRRsyWId3HI8=",
-      "x86_64-linux": "sha256-hJvArMT4lEkD6dQeCMsN6E6+CPdvZn+SRRsyWId3HI8="
+      "aarch64-darwin": "sha256-BZuho0vvpWHCBxlf5bqcpV0CxwgD1JkQlumCgOSir/A=",
+      "aarch64-linux": "sha256-BZuho0vvpWHCBxlf5bqcpV0CxwgD1JkQlumCgOSir/A=",
+      "x86_64-darwin": "sha256-BZuho0vvpWHCBxlf5bqcpV0CxwgD1JkQlumCgOSir/A=",
+      "x86_64-linux": "sha256-BZuho0vvpWHCBxlf5bqcpV0CxwgD1JkQlumCgOSir/A="
    },
    "universal": {
-      "aarch64-darwin": "sha256-5e70BNMP5Gv+HM1WJEGyY2UFEf883y2lCbizbbxdoDM=",
-      "aarch64-linux": "sha256-VBkvDDHBDXxv69R3RXTMlmP29+vJCEq8/u9wlT60ib4=",
-      "x86_64-darwin": "sha256-+sgwalym3dreG8f8GYgSqIMjLK6yYPMOs74iyMk/y04=",
-      "x86_64-linux": "sha256-ugQmK2LbpF1v3v1Cd3VAFc6g/+NYEB/LcoZNp4FKCkA="
+      "aarch64-darwin": "sha256-/hyLfGgHWAHE5W7IM533RMmqRLceSKBOEsC3t71cSQA=",
+      "aarch64-linux": "sha256-you7n+Z1uhZ1ZP1abSFGaUPZIcNstdz9Q6omn5F15z4=",
+      "x86_64-darwin": "sha256-wp5rokG074cPBFV5hzEpCumeatZ7Zsrp49b9imSNTyQ=",
+      "x86_64-linux": "sha256-8Sf61AZe+lMiXi2+R039tYKG9Y3/s5NxZIO65AehymU="
    },
    "web": {
-      "aarch64-darwin": "sha256-go3VRPPT1iwPJeh2WV/Q2nuPDOotkukR2B8d0ltF7To=",
-      "aarch64-linux": "sha256-go3VRPPT1iwPJeh2WV/Q2nuPDOotkukR2B8d0ltF7To=",
-      "x86_64-darwin": "sha256-go3VRPPT1iwPJeh2WV/Q2nuPDOotkukR2B8d0ltF7To=",
-      "x86_64-linux": "sha256-go3VRPPT1iwPJeh2WV/Q2nuPDOotkukR2B8d0ltF7To="
+      "aarch64-darwin": "sha256-HT5EyBvHhOpR7OS2XQRSRsLH7AQQAo1u4Stn7NELnEU=",
+      "aarch64-linux": "sha256-HT5EyBvHhOpR7OS2XQRSRsLH7AQQAo1u4Stn7NELnEU=",
+      "x86_64-darwin": "sha256-HT5EyBvHhOpR7OS2XQRSRsLH7AQQAo1u4Stn7NELnEU=",
+      "x86_64-linux": "sha256-HT5EyBvHhOpR7OS2XQRSRsLH7AQQAo1u4Stn7NELnEU="
    },
    "windows": {
-      "x86_64-darwin": "sha256-CSaPe7IX34uTOJOHnRlGNujs4LoFWDGvNzHWlPjCzqE=",
-      "x86_64-linux": "sha256-CSaPe7IX34uTOJOHnRlGNujs4LoFWDGvNzHWlPjCzqE="
+      "x86_64-darwin": "sha256-NkkcN9NTL8fQQqBldg0BDZvmg3f+BBMqyMq+X3SZaq0=",
+      "x86_64-linux": "sha256-NkkcN9NTL8fQQqBldg0BDZvmg3f+BBMqyMq+X3SZaq0="
    }
  },
  "pubspecLock": {
@@ -24,7 +24,9 @@ let
  # Parses a list of versions, substituting "latest" with the latest version.
  parseVersions =
    repo: key: versions:
-    lib.unique (map (parseVersion repo key) versions);
+    lib.sort (a: b: lib.strings.compareVersions (toString a) (toString b) > 0) (
+      lib.unique (map (parseVersion repo key) versions)
+    );
 in
 {
  repoJson ? ./repo.json,
@@ -98,14 +100,27 @@ in
  numLatestPlatformVersions ? 1,
  platformVersions ?
    if minPlatformVersion != null && maxPlatformVersion != null then
+      # Range between min and max, inclusive.
      let
-        minPlatformVersionInt = coerceIntVersion (parseVersion repo "platforms" minPlatformVersion);
-        maxPlatformVersionInt = coerceIntVersion (parseVersion repo "platforms" maxPlatformVersion);
+        minPlatformVersion' = parseVersion repo "platforms" minPlatformVersion;
+        maxPlatformVersion' = parseVersion repo "platforms" maxPlatformVersion;
+        minPlatformVersionInt = coerceIntVersion minPlatformVersion';
+        maxPlatformVersionInt = coerceIntVersion maxPlatformVersion';
+        range = lib.range (lib.min minPlatformVersionInt maxPlatformVersionInt) (
+          lib.max minPlatformVersionInt maxPlatformVersionInt
+        );
      in
-      lib.range (lib.min minPlatformVersionInt maxPlatformVersionInt) (
-        lib.max minPlatformVersionInt maxPlatformVersionInt
-      )
+      # Don't use the actual latest version in lieu of the rounded version here,
+      # since when Google upgrades it would have the nasty side effect of being
+      # unstable and picking 35 -> 36 -> 37 instead of 35 -> 36.1 -> 37.
+      # Best to stay consistent.
+      #
+      # However, if only one platform is requested and it's the latest (which is the default),
+      # we should use it.
+      if lib.length range == 1 then lib.singleton maxPlatformVersion' else range
    else
+      # Use numLatestPlatformVersions with a lower cutoff of minPlatformVersion (defaulting to 1)
+      # to determine how many of the latest *major* versions we should pick.
      let
        minPlatformVersionInt =
          if minPlatformVersion == null then
@@ -116,8 +131,10 @@ in
        firstPlatformVersionInt = lib.max minPlatformVersionInt (
          latestPlatformVersionInt - (lib.max 1 numLatestPlatformVersions) + 1
        );
+        range = lib.range firstPlatformVersionInt latestPlatformVersionInt;
      in
-      lib.range firstPlatformVersionInt latestPlatformVersionInt,
+      # Ditto, see above.
+      if lib.length range == 1 then lib.singleton repo.latest.platforms else range,
  includeSources ? false,
  includeSystemImages ? false,
  systemImageTypes ? [
@@ -144,7 +161,7 @@ in

 let
  # Resolve all the platform versions.
-  platformVersions' = map coerceIntVersion (parseVersions repo "platforms" platformVersions);
+  platformVersions' = parseVersions repo "platforms" platformVersions;

  # Determine the Android os identifier from Nix's system identifier
  os =
@@ -220,28 +237,6 @@ let
    extras = fetchArchives repo.extras;
  };

-  # Latest packages that are typically keyed by the API level.
-  archivesByApiLevel =
-    let
-      # Transforms the given attrset mapping API levels (with possible suffixes and minor versions)
-      # into the latest API level for each major version.
-      mkLatestByApiLevel =
-        packages:
-        lib.filterAttrs (_: value: value != null) (
-          lib.mapAttrs (
-            _: value:
-            (lib.findFirst (x: x.name == lib.versions.majorMinor x.name) { value = null; } (
-              lib.lists.sort (x: y: lib.strings.versionOlder y.name x.name) value
-            )).value
-          ) (lib.groupBy (x: lib.versions.major x.name) (lib.attrsToList packages))
-        );
-    in
-    {
-      platforms = mkLatestByApiLevel allArchives.packages.platforms;
-      sources = mkLatestByApiLevel allArchives.packages.sources;
-      system-images = mkLatestByApiLevel allArchives.system-images;
-    };
-
  # Lift the archives to the package level for easy search,
  # and add recurseIntoAttrs to all of them.
  allPackages =
@@ -547,17 +542,14 @@ lib.recurseIntoAttrs rec {
  platforms = map (
    version:
    deployAndroidPackage {
-      package = checkVersion [ archivesByApiLevel allArchives.packages ] "platforms" version;
+      package = checkVersion allArchives.packages "platforms" version;
    }
  ) platformVersions';

-  # This exposes the version strings (e.g. "36.1" for API 36).
-  platformVersionStrings = map (platform: platform.version) platforms;
-
  sources = map (
    version:
    deployAndroidPackage {
-      package = checkVersion [ archivesByApiLevel allArchives.packages ] "sources" version;
+      package = checkVersion allArchives.packages "sources" version;
    }
  ) platformVersions';

@@ -576,12 +568,7 @@ lib.recurseIntoAttrs rec {
        # ```
        let
          availablePackages =
-            map
-              (
-                abiVersion:
-                archivesByApiLevel.system-images.${toString apiVersion}.${type}.${abiVersion}
-                or allArchives.system-images.${toString apiVersion}.${type}.${abiVersion}
-              )
+            map (abiVersion: allArchives.system-images.${toString apiVersion}.${type}.${abiVersion})
              (
                builtins.filter (
                  abiVersion: lib.hasAttrByPath [ (toString apiVersion) type abiVersion ] allArchives.system-images
@@ -39,6 +39,8 @@ let
    };
  */

+  inherit (pkgs) lib;
+
  # Otherwise, just use the in-tree androidenv:
  androidEnv = pkgs.callPackage ./.. {
    inherit pkgs licenseAccepted;
@@ -77,10 +79,9 @@ let
  };
  androidSdk = androidComposition.androidsdk;
  platformTools = androidComposition.platform-tools;
-  latestSdk = pkgs.lib.foldl' pkgs.lib.max 0 androidComposition.platformVersions;
-  latestSdkVersion = pkgs.lib.foldl' (
-    s: x: if pkgs.lib.strings.compareVersions x s > 0 then x else s
-  ) "0" androidComposition.platformVersionStrings;
+  latestSdkVersion = lib.foldl' (
+    s: x: if lib.strings.compareVersions (toString x) s > 0 then toString x else s
+  ) "0" androidComposition.platformVersions;
  jdk = pkgs.jdk;
 in
 pkgs.mkShell rec {
@@ -129,7 +130,7 @@ pkgs.mkShell rec {
            "platform-tools" "platforms;android-${toString latestSdkVersion}" \
            "system-images;android-${toString latestSdkVersion};google_apis;x86_64"
          )
-          ${pkgs.lib.optionalString emulatorSupported ''packages+=("emulator")''}
+          ${lib.optionalString emulatorSupported ''packages+=("emulator")''}

          for package in "''${packages[@]}"; do
            if [[ ! $installed_packages_section =~ "$package" ]]; then
@@ -154,7 +155,7 @@ pkgs.mkShell rec {
          installed_packages_section=$(echo "''${output%%Available Packages*}" | awk 'NR>4 {print $1}')

          excluded_packages=(ndk)
-          for x in $(seq 1 ${toString latestSdk}); do
+          for x in $(seq 1 ${lib.versions.major (toString latestSdkVersion)}); do
            excluded_packages+=(
              "platforms;android-$x"
              "sources;android-$x"
@@ -182,7 +183,7 @@ pkgs.mkShell rec {
          ];
        }
        (
-          pkgs.lib.optionalString emulatorSupported ''
+          lib.optionalString emulatorSupported ''
            export ANDROID_USER_HOME=$PWD/.android
            mkdir -p $ANDROID_USER_HOME

@@ -38,6 +38,8 @@ let
    };
  */

+  inherit (pkgs) lib;
+
  # Otherwise, just use the in-tree androidenv:
  androidEnv = pkgs.callPackage ./.. {
    inherit pkgs licenseAccepted;
@@ -48,7 +50,13 @@ let
    includeSystemImages = false;
    includeEmulator = false;

-    platformVersions = [ "latest" ];
+    platformVersions = [
+      "UpsideDownCake"
+      "36"
+      "36x"
+      "latest"
+      "CANARY"
+    ];

    # Accepting more licenses declaratively:
    extraLicenses = [
@@ -70,7 +78,9 @@ let
  androidComposition = androidEnv.composeAndroidPackages sdkArgs;
  androidSdk = androidComposition.androidsdk;
  platformTools = androidComposition.platform-tools;
-  latestSdk = pkgs.lib.foldl' pkgs.lib.max 0 androidComposition.platformVersions;
+  latestSdkVersion = lib.foldl' (
+    s: x: if lib.strings.compareVersions (toString x) s > 0 then toString x else s
+  ) "0" androidComposition.platformVersions;
  jdk = pkgs.jdk;
 in
 pkgs.mkShell {
@@ -97,7 +107,6 @@ pkgs.mkShell {
  '';

  passthru.tests = {
-
    shell-without-emulator-sdkmanager-packages-test =
      pkgs.runCommand "shell-without-emulator-sdkmanager-packages-test"
        {
@@ -113,7 +122,7 @@ pkgs.mkShell {

          packages=(
            "build-tools" "cmdline-tools" \
-            "platform-tools" "platforms;android-${toString latestSdk}"
+            "platform-tools" "platforms;android-${toString latestSdkVersion}"
          )

          for package in "''${packages[@]}"; do
@@ -37,6 +37,8 @@ let
    };
  */

+  inherit (pkgs) lib;
+
  # Otherwise, just use the in-tree androidenv:
  androidEnv = pkgs.callPackage ./.. {
    inherit pkgs licenseAccepted;
@@ -109,8 +111,12 @@ let

  androidSdk = androidComposition.androidsdk;
  platformTools = androidComposition.platform-tools;
-  firstSdk = pkgs.lib.foldl' pkgs.lib.min 100 androidComposition.platformVersions;
-  latestSdk = pkgs.lib.foldl' pkgs.lib.max 0 androidComposition.platformVersions;
+  firstSdkVersion = lib.foldl' (
+    s: x: if lib.strings.compareVersions (toString x) s < 0 then toString x else s
+  ) "100" androidComposition.platformVersions;
+  latestSdkVersion = lib.foldl' (
+    s: x: if lib.strings.compareVersions (toString x) s > 0 then toString x else s
+  ) "0" androidComposition.platformVersions;
  jdk = pkgs.jdk;
 in
 pkgs.mkShell rec {
@@ -181,15 +187,11 @@ pkgs.mkShell rec {
            "extras;google;gcm"
          )

-          for x in $(seq ${toString firstSdk} ${toString latestSdk}); do
-            if [ $x -ne 34 ]; then
-              # FIXME couldn't find platforms;android-34, even though it's in the correct directory!! sdkmanager's bug?!
-              packages+=("platforms;android-$x")
-            fi
+          for x in $(seq ${toString firstSdkVersion} ${toString latestSdkVersion}); do
            packages+=("sources;android-$x")
          done

-          ${pkgs.lib.optionalString includeAuto ''packages+=("extras;google;auto")''}
+          ${lib.optionalString includeAuto ''packages+=("extras;google;auto")''}

          for package in "''${packages[@]}"; do
            if [[ ! $installed_packages_section =~ "$package" ]]; then
@@ -73,6 +73,7 @@ mapAliases {
  inherit (pkgs) asar; # added 2023-08-26
  inherit (pkgs) auto-changelog; # added 2024-06-25
  inherit (pkgs) aws-azure-login; # added 2023-09-30
+  aws-cdk = pkgs.aws-cdk-cli; # Added 2025-12-23
  awesome-lint = throw "'awesome-lint' has been removed because it was unmaintainable in nixpkgs"; # Added 2025-11-17
  balanceofsatoshis = pkgs.balanceofsatoshis; # added 2023-07-31
  inherit (pkgs) bash-language-server; # added 2024-06-07
@@ -5,7 +5,6 @@

  # Packages that provide a single executable.
  "@angular/cli" = "ng";
-  aws-cdk = "cdk";
  grunt-cli = "grunt";
  gulp-cli = "gulp";
 }
@@ -6,7 +6,6 @@
 , "@tailwindcss/line-clamp"
 , "@tailwindcss/typography"
 , "alex"
-, "aws-cdk"
 , "browserify"
 , "browser-sync"
 , "coc-go"
@@ -19471,24 +19471,6 @@ in
    bypassCache = true;
    reconstructLock = true;
  };
-  aws-cdk = nodeEnv.buildNodePackage {
-    name = "aws-cdk";
-    packageName = "aws-cdk";
-    version = "2.1004.0";
-    src = fetchurl {
-      url = "https://registry.npmjs.org/aws-cdk/-/aws-cdk-2.1004.0.tgz";
-      sha512 = "3E5ICmSc7ZCZCwLX7NY+HFmmdUYgRaL+67h/BDoDQmkhx9StC8wG4xgzHFY9k8WQS0+ib/MP28f2d9yzHtQLlQ==";
-    };
-    buildInputs = globalBuildInputs;
-    meta = {
-      description = "AWS CDK CLI, the command line tool for CDK apps";
-      homepage = "https://github.com/aws/aws-cdk";
-      license = "Apache-2.0";
-    };
-    production = true;
-    bypassCache = true;
-    reconstructLock = true;
-  };
  browserify = nodeEnv.buildNodePackage {
    name = "browserify";
    packageName = "browserify";
@@ -1,5 +1,6 @@
 {
  lib,
+  stdenv,
  buildPythonPackage,
  fetchFromGitHub,
  rustPlatform,
@@ -73,6 +74,10 @@ buildPythonPackage rec {
  disabledTests = [
    # Exception: DataFusion error (requires internet access)
    "test_register_http_csv"
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    # Flaky: Failed: Query was not interrupted; got error: None
+    "test_collect_interrupted"
  ];

  meta = {
@@ -105,10 +105,11 @@ buildPythonPackage rec {

  disabledTestMarks = [ "slow" ];

-  disabledTests = [
-    # polars.exceptions.ComputeError: TypeError: _scan_pyarrow_dataset_impl() got multiple values for argument 'batch_size'
-    # https://github.com/lancedb/lancedb/issues/1539
-    "test_polars"
+  disabledTests = lib.optionals stdenv.hostPlatform.isDarwin [
+    # Flaky (even when the sandbox is disabled):
+    # FileNotFoundError: [Errno 2] Cannot delete directory '/nix/var/nix/builds/nix-41395-654732360/.../test.lance/_indices/fts':
+    # Cannot get information for path '/nix/var/nix/builds/nix-41395-654732360/.../test.lance/_indices/fts/.tmppyKXfw'
+    "test_create_index_from_table"
  ];

  disabledTestPaths = [
@@ -12,19 +12,19 @@
 buildPythonPackage rec {
  pname = "pyoxigraph";
  pyproject = true;
-  version = "0.5.2";
+  version = "0.5.3";

  src = fetchFromGitHub {
    owner = "oxigraph";
    repo = "oxigraph";
    tag = "v${version}";
    fetchSubmodules = true;
-    hash = "sha256-ptTrJbLGS7GkLGO40mbpdPkrcspaUE33kRZ8g9Qtb0o=";
+    hash = "sha256-hIB4/6D7AogEpNYyB95nDotspUyaiOW8X6KuVgyjj5Y=";
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
    inherit pname version src;
-    hash = "sha256-AuUGra9ejPRKWWpXWLmcwGuZRKIuCYTdifpnwuuHnnQ=";
+    hash = "sha256-EhJQgYeeSln1bLLH3nEUFJ7q+PWA/DHAswh4ei4bHWY=";
  };

  buildAndTestSubdir = "python";
@@ -12,14 +12,14 @@

 buildPythonPackage rec {
  pname = "smp";
-  version = "4.0.1";
+  version = "4.0.2";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "JPHutchins";
    repo = "smp";
    tag = version;
-    hash = "sha256-UpzVyZxZjCOWJsQGaRXVwnKjuFISpxNidk0YkNQBqKM=";
+    hash = "sha256-dATsVGG0b5SBZh7R7NT1deJFDRYi7BwtWzT7/QPjkJw=";
  };

  build-system = [
@@ -120,6 +120,11 @@ buildPythonPackage rec {

    # RuntimeError: required keyword attribute 'value' has the wrong type
    "test_utils_benchmarks"
+
+    # RuntimeError: Dataset 'https://github.com/ultralytics/assets/releases/download/v0.0.0/coco8-ndjson.ndjson'
+    # error <E2><9D><8C> [Errno 13] Permission denied:
+    # '/nix/store/rnns5r21nibx26f2c2gxdk3h8l0jcg68-python3.12-ultralytics-8.3.221/datasets/coco8-ndjson/labels/train/000000000009.txt'
+    "test_train_ndjson"
  ];

  meta = {
@@ -22,6 +22,9 @@ stdenv.mkDerivation rec {
  };

  patches = [
+    # Fix PATH forwarding to child processes.
+    # See #126681 issue for more information
+    ./interception-tools-udevmon-path-fix.patch
    (fetchpatch {
      name = "Bump-CMake-minimum-version-to-3.10";
      url = "https://gitlab.com/interception/linux/tools/-/commit/110c9b39b54eae9acd16fa6d64539ce9886b5684.patch";
@@ -0,0 +1,28 @@
+diff --git a/udevmon.cpp b/udevmon.cpp
+index 70a28be..60fcbe2 100644
+--- a/udevmon.cpp
+++ b/udevmon.cpp
+@@ -101,7 +101,11 @@ struct cmd {
+                     for (size_t j = 0; j < cmds[i].size(); ++j)
+                         command[j] = const_cast<char *>(cmds[i][j].c_str());
+                     command[cmds[i].size()] = nullptr;
+-                    char *environment[]     = {nullptr};
+                    std::string path_env = "PATH=";
+                    path_env += std::getenv("PATH");
+                    char *environment[]     = {
+                        const_cast<char *>(path_env.c_str()),
+                        nullptr};
+                     setpgid(0, 0);
+                     execvpe(command[0], command.get(), environment);
+                     std::string e = "exec failed for \"";
+@@ -348,7 +352,10 @@ struct job {
+                         command[j] = const_cast<char *>(cmds[i][j].c_str());
+                     command[cmds[i].size()] = nullptr;
+                     std::string variables   = "DEVNODE=" + devnode;
+                    std::string path_env = "PATH=";
+                    path_env += std::getenv("PATH");
+                     char *environment[]     = {
+                        const_cast<char *>(path_env.c_str()),
+                         const_cast<char *>(variables.c_str()), nullptr};
+                     setpgid(0, 0);
+                     execvpe(command[0], command.get(), environment);
@@ -18,7 +18,9 @@
  fetchurl,
  fetchpatch,
  autoreconfHook,
+  withAudit ? false,
  audit,
+  libcap_ng,
  zlib,
  openssl,
  softhsm,
@@ -46,6 +48,9 @@
  isNixos ? stdenv.hostPlatform.isLinux,
 }:

+# libaudit support requires Linux
+assert withAudit -> stdenv.hostPlatform.isLinux;
+
 # FIDO support requires SK support
 assert withFIDO -> withSecurityKey;

@@ -125,7 +130,10 @@ stdenv.mkDerivation (finalAttrs: {
  ++ lib.optional withKerberos krb5
  ++ lib.optional withLdns ldns
  ++ lib.optional withPAM pam
-  ++ lib.optional stdenv.hostPlatform.isStatic audit;
+  ++ lib.optionals withAudit [
+    audit
+    libcap_ng
+  ];

  preConfigure = ''
    # Setting LD causes `configure' and `make' to disagree about which linker
@@ -133,11 +141,22 @@ stdenv.mkDerivation (finalAttrs: {
    unset LD
  '';

-  env = lib.optionalAttrs isNixos {
-    # openssh calls passwd to allow the user to reset an expired password, but nixos
-    # doesn't ship it at /usr/bin/passwd.
-    PATH_PASSWD_PROG = "/run/wrappers/bin/passwd";
-  };
+  env =
+    lib.optionalAttrs isNixos {
+      # openssh calls passwd to allow the user to reset an expired password, but nixos
+      # doesn't ship it at /usr/bin/passwd.
+      PATH_PASSWD_PROG = "/run/wrappers/bin/passwd";
+    }
+    // lib.optionalAttrs stdenv.hostPlatform.isStatic {
+      NIX_LDFLAGS = lib.concatStringsSep " " (
+        lib.optional withKerberos "-lkeyutils"
+        ++ lib.optional withLdns "-lcrypto"
+        ++ lib.optionals withAudit [
+          "-laudit"
+          "-lcap-ng"
+        ]
+      );
+    };

  # I set --disable-strip because later we strip anyway. And it fails to strip
  # properly when cross building.
@@ -162,14 +181,9 @@ stdenv.mkDerivation (finalAttrs: {
  ++ lib.optional withLdns "--with-ldns"
  ++ lib.optional stdenv.hostPlatform.isOpenBSD "--with-bsd-auth"
  ++ lib.optional withLinuxMemlock "--with-linux-memlock-onfault"
+  ++ lib.optional withAudit "--with-audit=linux"
  ++ extraConfigureFlags;

-  ${if stdenv.hostPlatform.isStatic then "NIX_LDFLAGS" else null} = [
-    "-laudit"
-  ]
-  ++ lib.optional withKerberos "-lkeyutils"
-  ++ lib.optional withLdns "-lcrypto";
-
  buildFlags = [ "SSH_KEYSIGN=ssh-keysign" ];

  enableParallelBuilding = true;