Merge staging-next into staging

2025-11-26 18:06:24 +00:00
parent b280feb4f6 155069affa
commit a4ce35fd24
105 changed files with 5651 additions and 671 deletions
@@ -266,6 +266,8 @@

 - The main binary of `tomlq` has been renamed from `tomlq` to `tq`.

+- `odoo16` has been dropped due to end of support by upstream, consider upgrading supported version.
+
 - `opensoldat` binaries and user configuration directory names have been prefixed by 'open', becoming opensoldat and opensoldatserver. Configuration will be moved automatically before launch when possible.

 - `emacs-macport` has been moved to a fork of Mitsuharu Yamamoto's patched source code starting with Emacs v30 as the original project seems to be currently dormant. All older versions of this package have been dropped.
@@ -13,6 +13,8 @@

 - All Log4Shell vulnerability scanners were removed, as they were all unmaintained upstream and are no longer relevant given that the vulnerability has been fixed upstream for several years.

+- `python3packages.pillow-avif-plugin` has been removed as the functionality is included in `python3packages.pillow` directly since version 11.3.
+
 ## Other Notable Changes {#sec-nixpkgs-release-26.05-notable-changes}

 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
@@ -7544,6 +7544,13 @@
    githubId = 103082;
    name = "Ed Brindley";
  };
+  eleonora = {
+    email = "leonsch@protonmail.com";
+    github = "42LoCo42";
+    githubId = 39183040;
+    matrix = "@me:eleonora.gay";
+    name = "Eleonora";
+  };
  elesiuta = {
    email = "elesiuta@gmail.com";
    github = "elesiuta";
@@ -21170,6 +21177,12 @@
    matrix = "@pschmitt:one.ems.host";
    keys = [ { fingerprint = "9FBF 2ABF FB37 F7F3 F502  44E5 DC43 9C47 EACB 17F9"; } ];
  };
+  pseudocc = {
+    email = "pseudoc@163.com";
+    github = "pseudocc";
+    githubId = 85104110;
+    name = "Atlas Yu";
+  };
  pshirshov = {
    email = "pshirshov@eml.cc";
    github = "pshirshov";
@@ -0,0 +1,31 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.hardware.cpu.intel.npu;
+in
+{
+  options = {
+    hardware.cpu.intel.npu = {
+      enable = lib.mkEnableOption "Intel NPU support";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [
+      pkgs.intel-npu-driver.validation
+      pkgs.level-zero
+    ];
+
+    hardware = {
+      firmware = [ pkgs.intel-npu-driver.firmware ];
+      graphics = {
+        enable = true;
+        extraPackages = [ pkgs.intel-npu-driver ];
+      };
+    };
+  };
+}
@@ -205,6 +205,11 @@ sub pciCheck {
        ($device eq "0x4229" || $device eq "0x4230" ||
         $device eq "0x4222" || $device eq "0x4227");

+    push @attrs, "hardware.cpu.intel.npu.enable = true;" if
+        $vendor eq "0x8086" &&
+        ($device eq "0x7d1d" || $device eq "0xad1d" ||
+         $device eq "0x643e" || $device eq "0xb03e");
+
    # Assume that all NVIDIA cards are supported by the NVIDIA driver.
    # There may be exceptions (e.g. old cards).
    # FIXME: do we want to enable an unfree driver here?
@@ -1011,6 +1011,7 @@ let
                      modulePath = "${config.boot.zfs.package}/lib/security/pam_zfs_key.so";
                      settings = {
                        inherit (config.security.pam.zfs) homes;
+                        mount_recursively = config.security.pam.zfs.mountRecursively;
                      };
                    }
                    {
@@ -1202,6 +1203,7 @@ let
                modulePath = "${config.boot.zfs.package}/lib/security/pam_zfs_key.so";
                settings = {
                  inherit (config.security.pam.zfs) homes;
+                  mount_recursively = config.security.pam.zfs.mountRecursively;
                };
              }
              {
@@ -1362,6 +1364,7 @@ let
                settings = {
                  inherit (config.security.pam.zfs) homes;
                  nounmount = config.security.pam.zfs.noUnmount;
+                  mount_recursively = config.security.pam.zfs.mountRecursively;
                };
              }
              {
@@ -2195,6 +2198,14 @@ in
          Do not unmount home dataset on logout.
        '';
      };
+
+      mountRecursively = lib.mkOption {
+        default = false;
+        type = lib.types.bool;
+        description = ''
+          Mount child datasets of home dataset.
+        '';
+      };
    };

    security.pam.enableEcryptfs = lib.mkEnableOption "eCryptfs PAM module (mounting ecryptfs home directory on login)";
@@ -193,6 +193,7 @@ in
        pantheon.gala
        pantheon.gnome-settings-daemon
        pantheon.elementary-session-settings
+        pantheon.elementary-settings-daemon
      ];
      programs.dconf.enable = true;
      networking.networkmanager.enable = mkDefault true;
@@ -7,6 +7,7 @@

 let
  cfg = config.services.angrr;
+  direnvCfg = config.programs.direnv.angrr;
 in
 {
  meta.maintainers = pkgs.angrr.meta.maintainers;
@@ -77,6 +78,20 @@ in
        };
      };
    };
+    programs.direnv.angrr = {
+      enable = lib.mkEnableOption "angrr direnv integration" // {
+        default = true;
+        example = false;
+      };
+      autoUse = lib.mkOption {
+        type = lib.types.bool;
+        default = true;
+        example = false;
+        description = ''
+          Whether to automatically use angrr before loading .envrc.
+        '';
+      };
+    };
  };

  config = lib.mkIf cfg.enable (
@@ -106,6 +121,8 @@ in
            Type = "oneshot";
          };
        };
+
+        environment.systemPackages = [ cfg.package ];
      }

      (lib.mkIf cfg.timer.enable {
@@ -123,6 +140,13 @@ in
          before = [ "nix-gc.service" ];
        };
      })
+
+      (lib.mkIf (config.programs.direnv.enable && direnvCfg.enable) {
+        environment.etc."direnv/lib/angrr.sh".source = "${cfg.package}/share/direnv/lib/angrr.sh";
+        programs.direnv.direnvrcExtra = lib.mkIf direnvCfg.autoUse ''
+          use angrr
+        '';
+      })
    ]
  );
 }
@@ -118,6 +118,8 @@ in
      configFile = lib.mkOption {
        type = lib.types.package;
        readOnly = true;
+        default = dnsmasqConf;
+        defaultText = lib.literalExpression "Path of dnsmasq config file";
        description = ''
          Path to the configuration file of dnsmasq.
        '';
@@ -137,8 +139,6 @@ in
        conf-file = lib.mkDefault (lib.optional cfg.resolveLocalQueries "/etc/dnsmasq-conf.conf");
        resolv-file = lib.mkDefault (lib.optional cfg.resolveLocalQueries "/etc/dnsmasq-resolv.conf");
      };
-
-      configFile = dnsmasqConf;
    };

    networking.nameservers = lib.optional cfg.resolveLocalQueries "127.0.0.1";
@@ -270,6 +270,7 @@ in
          gnome-calendar
          gnome-screenshot
          file-roller
+          gucharmap
        ] config.environment.cinnamon.excludePackages;
    })
  ];
@@ -76,7 +76,7 @@ in
      mask = ''\xff\xff\xff\xff\xff\xfe\xfe\x00\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff\xff'';
      fixBinary = true;
      matchCredentials = true;
-      preserveArgvZero = false;
+      preserveArgvZero = true;

      # Remove the shell wrapper and call the runtime directly
      wrapInterpreterInShell = false;
@@ -15,6 +15,11 @@
      # For `nix build /run/current-system --out-link`,
      # `nix-build` does not support this use case.
      nix.settings.experimental-features = [ "nix-command" ];
+
+      # Test direnv integration
+      programs.direnv.enable = true;
+      # Verbose logging for angrr in direnv
+      environment.variables.ANGRR_DIRENV_LOG = "angrr=debug";
    };
  };

@@ -59,5 +64,25 @@
    # All auto GC roots are removed
    machine.succeed("test ! -f /tmp/root-auto-gc-root-2")
    machine.succeed("test ! -f /tmp/user-auto-gc-root-2")
+
+    # Direnv integration test
+    machine.succeed("mkdir /tmp/test-direnv")
+    machine.succeed("echo >/tmp/test-direnv/.envrc") # Simply create an empty .envrc
+    machine.succeed("nix build /run/current-system --out-link /tmp/test-direnv/.direnv/gc-root")
+    machine.succeed("cd /tmp/test-direnv; direnv allow; direnv exec . true")
+
+    # The root will be removed if we does not use the direnv recently
+    machine.succeed("date -s '8 days'")
+    machine.systemctl("start nix-gc.service")
+    machine.succeed("test ! -f /tmp/test-direnv/.direnv/gc-root")
+
+    # Recreate the root
+    machine.succeed("nix build /run/current-system --out-link /tmp/test-direnv/.direnv/gc-root")
+
+    # The root will not be remove if we use the direnv recently
+    machine.succeed("date -s '8 days'")
+    machine.succeed("cd /tmp/test-direnv; direnv exec . true")
+    machine.systemctl("start nix-gc.service")
+    machine.succeed("readlink /tmp/test-direnv/.direnv/gc-root")
  '';
 }
@@ -2,4 +2,5 @@

 {
  basic = runTest ./basic.nix;
+  dnsmasq = runTest ./dnsmasq.nix;
 }
@@ -0,0 +1,20 @@
+let
+  port = "9077";
+in
+{
+  name = "pihole-ftl-dnsmasq";
+
+  nodes.machine = {
+    services.pihole-ftl = {
+      enable = true;
+      useDnsmasqConfig = true;
+      settings.webserver.port = port;
+    };
+  };
+
+  testScript = ''
+    start_all()
+    machine.wait_for_unit("pihole-ftl.service")
+    machine.wait_for_open_port(${port})
+  '';
+}
@@ -426,13 +426,13 @@
    "vendorHash": "sha256-FcxAh8EOvnT8r1GHu0Oj2C5Jgbr2WPwD7/vY4/qIvTA="
  },
  "gitlabhq_gitlab": {
-    "hash": "sha256-MeOpJGcYwOLReHFjsQe3dpgd96sNc825V1pZQbJCKdE=",
+    "hash": "sha256-XVOvtRj+MIrBtZQ6GJHOeLUu5Xjp6ZdGbRveXfZKEQc=",
    "homepage": "https://registry.terraform.io/providers/gitlabhq/gitlab",
    "owner": "gitlabhq",
    "repo": "terraform-provider-gitlab",
-    "rev": "v18.5.0",
+    "rev": "v18.6.1",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-rCL9TzEMe7zyJFmNvgNpyMiT8x0MCrUsdSQ9zU1c4pQ="
+    "vendorHash": "sha256-/TJRnVktc1PwtlPgHuyAi/mUx16h7j5cCF9rhF8Goag="
  },
  "go-gandi_gandi": {
    "hash": "sha256-fsCtmwyxkXfOtiZG27VEb010jglK35yr4EynnUWlFog=",
@@ -768,13 +768,13 @@
    "vendorHash": "sha256-mnKXYT0GfIS+ODzBCS9l4rLF1ugadesmpgdOgj74nLg="
  },
  "jianyuan_sentry": {
-    "hash": "sha256-b5a0++mu6roN6VuJaBZEczfqA6Stt+a7fTOLGLvqPeQ=",
+    "hash": "sha256-/OzoGlUaL7o4O5DejTdEeAJctB85udOCy4BntSTYJLo=",
    "homepage": "https://registry.terraform.io/providers/jianyuan/sentry",
    "owner": "jianyuan",
    "repo": "terraform-provider-sentry",
-    "rev": "v0.14.6",
+    "rev": "v0.14.7",
    "spdx": "MIT",
-    "vendorHash": "sha256-67xoILi88FEN005tk8Z3ggc3ggfuS1AHthYglqvOLE4="
+    "vendorHash": "sha256-wbU9RTNvUVJbLkoTGMeGxh9ilZQMKc9tpBkldMdfReA="
  },
  "joneshf_openwrt": {
    "hash": "sha256-z78IceF2VJtiQpVqC+rTUDsph73LZawIK+az3rEhljA=",
@@ -886,13 +886,13 @@
    "vendorHash": "sha256-I8yMdS+yOk5doWGU9VPdl5ITGNrPhs5tGwluwXSrnI0="
  },
  "metio_migadu": {
-    "hash": "sha256-ZTaibLqcmbKYFbk497Z/fwYhx7LKH2LHkmQYvY+Lkm0=",
+    "hash": "sha256-wz74VlScxOqkRAok6/4pDSEb15ubwR6ogcHMqDMSvVY=",
    "homepage": "https://registry.terraform.io/providers/metio/migadu",
    "owner": "metio",
    "repo": "terraform-provider-migadu",
-    "rev": "2025.11.13",
+    "rev": "2025.11.20",
    "spdx": "0BSD",
-    "vendorHash": "sha256-chCFJXf0M2w9oxan9Jj/gwphnN3T/5v7PZKv5H0bcLI="
+    "vendorHash": "sha256-eyapSniZ96V/Eqov0PENbNZYXntPH0JIGERQ/TVsH70="
  },
  "mongey_kafka": {
    "hash": "sha256-rTa6c7jAMH027V7h/yUGVGz6TS0PDdObilxU0Vpr6FI=",
@@ -106,17 +106,7 @@ stdenv.mkDerivation {
  passthru = {
    # make it possible to run disableBreakingUpdates standalone
    inherit disableBreakingUpdates;
-    updateScript = writeScript "discord-update-script" ''
-      #!/usr/bin/env nix-shell
-      #!nix-shell -i bash -p curl gnugrep common-updater-scripts
-      set -x
-      set -eou pipefail;
-      url=$(curl -sI -o /dev/null -w '%header{location}' "https://discord.com/api/download/${branch}?platform=osx&format=dmg")
-      version=$(echo $url | grep -oP '/\K(\d+\.){2}\d+')
-      update-source-version ${
-        lib.optionalString (!stdenv.buildPlatform.isDarwin) "pkgsCross.aarch64-darwin."
-      }${pname} "$version" --file=./pkgs/applications/networking/instant-messengers/discord/default.nix --version-key=${branch}
-    '';
+    updateScript = ./update.py;

    tests = {
      withVencord = self.override {
@@ -12,52 +12,24 @@ let
  variants = rec {
    x86_64-linux = {
      discord = rec {
-        version = "0.0.115";
-
-        src = fetchurl {
-          url = "https://stable.dl2.discordapp.net/apps/linux/${version}/discord-${version}.tar.gz";
-          hash = "sha256-DXGlo9qdmJTqm6ResvspauQ0awIFSuYalcpVXEfTxK4=";
-        };
-
        branch = "stable";
        binaryName = desktopName;
        desktopName = "Discord";
        self = discord;
      };
-      discord-ptb = rec {
-        version = "0.0.167";
-
-        src = fetchurl {
-          url = "https://ptb.dl2.discordapp.net/apps/linux/${version}/discord-ptb-${version}.tar.gz";
-          hash = "sha256-Q4IrmvoP//49GN2L9kRQ/zG28XjicJEXZpVG6RklFB8=";
-        };
-
+      discord-ptb = {
        branch = "ptb";
        binaryName = "DiscordPTB";
        desktopName = "Discord PTB";
        self = discord-ptb;
      };
-      discord-canary = rec {
-        version = "0.0.811";
-
-        src = fetchurl {
-          url = "https://canary.dl2.discordapp.net/apps/linux/${version}/discord-canary-${version}.tar.gz";
-          hash = "sha256-kg0o5KyBohmnk/czUQLVsA1GV2P6DUQLy0KhMaj80Sk=";
-        };
-
+      discord-canary = {
        branch = "canary";
        binaryName = "DiscordCanary";
        desktopName = "Discord Canary";
        self = discord-canary;
      };
-      discord-development = rec {
-        version = "0.0.92";
-
-        src = fetchurl {
-          url = "https://development.dl2.discordapp.net/apps/linux/${version}/discord-development-${version}.tar.gz";
-          hash = "sha256-oG50YrXQUCnbn+rO0EeRjixeqvXYBdnyqdomdPfxfos=";
-        };
-
+      discord-development = {
        branch = "development";
        binaryName = "DiscordDevelopment";
        desktopName = "Discord Development";
@@ -66,52 +38,24 @@ let
    };
    x86_64-darwin = {
      discord = rec {
-        version = "0.0.362";
-
-        src = fetchurl {
-          url = "https://stable.dl2.discordapp.net/apps/osx/${version}/Discord.dmg";
-          hash = "sha256-DHe0WwJOB3mm1HbQwEOJ9NWqxzhOBQynhjJXYSNvA/k=";
-        };
-
        branch = "stable";
        binaryName = desktopName;
        desktopName = "Discord";
        self = discord;
      };
      discord-ptb = rec {
-        version = "0.0.192";
-
-        src = fetchurl {
-          url = "https://ptb.dl2.discordapp.net/apps/osx/${version}/DiscordPTB.dmg";
-          hash = "sha256-AZ9enKJf6WZLELFLKrzeyAR/Q/pzD8SGvCPcInS8vsk=";
-        };
-
        branch = "ptb";
        binaryName = desktopName;
        desktopName = "Discord PTB";
        self = discord-ptb;
      };
      discord-canary = rec {
-        version = "0.0.867";
-
-        src = fetchurl {
-          url = "https://canary.dl2.discordapp.net/apps/osx/${version}/DiscordCanary.dmg";
-          hash = "sha256-67B2wZRZEOKutMPsrRlc96UZWShYLAgwOoF2/QzBgzE=";
-        };
-
        branch = "canary";
        binaryName = desktopName;
        desktopName = "Discord Canary";
        self = discord-canary;
      };
      discord-development = rec {
-        version = "0.0.100";
-
-        src = fetchurl {
-          url = "https://development.dl2.discordapp.net/apps/osx/${version}/DiscordDevelopment.dmg";
-          hash = "sha256-PknNHr9txxp3+nO7FgHH7n04qx6p6Jzbs92/Hcfh13Y=";
-        };
-
        branch = "development";
        binaryName = desktopName;
        desktopName = "Discord Development";
@@ -144,16 +88,25 @@ let
    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
  };
  package = if stdenv.hostPlatform.isLinux then ./linux.nix else ./darwin.nix;
+
+  sources = lib.importJSON ./sources.json;
 in
 lib.genAttrs [ "discord" "discord-ptb" "discord-canary" "discord-development" ] (
  pname:
  let
    args = (variants.${stdenv.hostPlatform.system} or variants.default).${pname};
+    platformName = if stdenv.hostPlatform.isDarwin then "osx" else "linux";
+    source = sources."${platformName}-${args.branch}";
  in
  callPackage package (
    args
    // {
      inherit pname;
+      inherit (source) version;
+
+      src = fetchurl {
+        inherit (source) url hash;
+      };

      meta = meta // {
        mainProgram = args.binaryName;
@@ -253,14 +253,7 @@ stdenv.mkDerivation (finalAttrs: {
  passthru = {
    # make it possible to run disableBreakingUpdates standalone
    inherit disableBreakingUpdates;
-    updateScript = writeScript "discord-update-script" ''
-      #!/usr/bin/env nix-shell
-      #!nix-shell -i bash -p curl gnugrep common-updater-scripts
-      set -eou pipefail;
-      url=$(curl -sI -o /dev/null -w '%header{location}' "https://discord.com/api/download/${branch}?platform=linux&format=tar.gz")
-      version=$(echo $url | grep -oP '/\K(\d+\.){2}\d+')
-      update-source-version ${pname} "$version" --file=./pkgs/applications/networking/instant-messengers/discord/default.nix --version-key=${branch}
-    '';
+    updateScript = ./update.py;

    tests = {
      withVencord = self.override {
@@ -0,0 +1,42 @@
+{
+  "linux-canary": {
+    "hash": "sha256-+MD6P9h5G6r5Vn/zwToJlHKFCvhPtUZ7HQwz2AF5EbM=",
+    "url": "https://canary.dl2.discordapp.net/apps/linux/0.0.812/discord-canary-0.0.812.tar.gz",
+    "version": "0.0.812"
+  },
+  "linux-development": {
+    "hash": "sha256-oG50YrXQUCnbn+rO0EeRjixeqvXYBdnyqdomdPfxfos=",
+    "url": "https://development.dl2.discordapp.net/apps/linux/0.0.92/discord-development-0.0.92.tar.gz",
+    "version": "0.0.92"
+  },
+  "linux-ptb": {
+    "hash": "sha256-Q4IrmvoP//49GN2L9kRQ/zG28XjicJEXZpVG6RklFB8=",
+    "url": "https://ptb.dl2.discordapp.net/apps/linux/0.0.167/discord-ptb-0.0.167.tar.gz",
+    "version": "0.0.167"
+  },
+  "linux-stable": {
+    "hash": "sha256-DXGlo9qdmJTqm6ResvspauQ0awIFSuYalcpVXEfTxK4=",
+    "url": "https://stable.dl2.discordapp.net/apps/linux/0.0.115/discord-0.0.115.tar.gz",
+    "version": "0.0.115"
+  },
+  "osx-canary": {
+    "hash": "sha256-gKBXZgoZKLja2iu5DAJsumm2u3mXH5fiUq6qIGfhrvo=",
+    "url": "https://canary.dl2.discordapp.net/apps/osx/0.0.917/DiscordCanary.dmg",
+    "version": "0.0.917"
+  },
+  "osx-development": {
+    "hash": "sha256-x4i/bbaR4XjzyZGkVerUl8oxxhm01A+2tpN+UEtKwwc=",
+    "url": "https://development.dl2.discordapp.net/apps/osx/0.0.105/DiscordDevelopment.dmg",
+    "version": "0.0.105"
+  },
+  "osx-ptb": {
+    "hash": "sha256-b+OrmbBf9S82plpN6FEsr+p6aekAvIKtBtCmWPLcrgY=",
+    "url": "https://ptb.dl2.discordapp.net/apps/osx/0.0.199/DiscordPTB.dmg",
+    "version": "0.0.199"
+  },
+  "osx-stable": {
+    "hash": "sha256-YT3EPVd12aAXTFU0y+IiYF5HlW+tJXjGrZajpjsxcAA=",
+    "url": "https://stable.dl2.discordapp.net/apps/osx/0.0.367/Discord.dmg",
+    "version": "0.0.367"
+  }
+}
@@ -0,0 +1,110 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i python3 -p python3
+
+from enum import StrEnum
+from typing import List, Tuple
+from subprocess import PIPE, Popen
+import json
+import urllib.request
+import re
+import os.path
+
+SRC_NAME = "source"
+
+VERSION_REGEX = re.compile(r"\/([\d.]+)\/")
+
+
+class Platform(StrEnum):
+    LINUX = "linux"
+    MACOS = "osx"
+
+    def format_type(self):
+        if self.value == Platform.LINUX.value:
+            return "tar.gz"
+        elif self.value == Platform.MACOS.value:
+            return "dmg"
+        raise RuntimeError("Invalid platform")
+
+
+class Branch(StrEnum):
+    STABLE = "stable"
+    PTB = "ptb"
+    CANARY = "canary"
+    DEVELOPMENT = "development"
+
+
+Variant = Tuple[Platform, Branch]
+
+
+def serialize_variant(variant: Variant) -> str:
+    platform, branch = variant
+    return f"{platform}-{branch}"
+
+
+def url_for_variant(variant: Variant) -> str:
+    platform, branch = variant
+
+    return f"https://discord.com/api/download/{branch.value}?platform={platform.value}&format={platform.format_type()}"
+
+
+def fetch_redirect_url(url: str) -> str:
+    headers = {"user-agent": "Nixpkgs-Discord-Update-Script/0.0.0"}
+    # note that urllib follows redirects by default. So we can extract the final url from the response object
+    req = urllib.request.Request(url, headers=headers)
+    with urllib.request.urlopen(req) as response:
+        return response.url
+
+
+def version_from_url(url: str) -> str:
+    matches = VERSION_REGEX.search(url)
+    assert matches, f"Url {url} must contain version number"
+    version = matches.group(1)
+    assert version
+    return version
+
+
+def prefetch(url: str) -> str:
+    with Popen(["nix-prefetch-url", "--name", "source", url], stdout=PIPE) as p:
+        assert p.stdout
+        b32_hash = p.stdout.read().decode("utf-8").strip()
+    with Popen(
+        ["nix-hash", "--to-sri", "--type", "sha256", b32_hash], stdout=PIPE
+    ) as p:
+        assert p.stdout
+        sri_hash = p.stdout.read().decode("utf-8").strip()
+    return sri_hash
+
+
+def main():
+    variants: List[Variant] = [
+        (Platform.LINUX, Branch.STABLE),
+        (Platform.LINUX, Branch.PTB),
+        (Platform.LINUX, Branch.CANARY),
+        (Platform.LINUX, Branch.DEVELOPMENT),
+        (Platform.MACOS, Branch.STABLE),
+        (Platform.MACOS, Branch.PTB),
+        (Platform.MACOS, Branch.CANARY),
+        (Platform.MACOS, Branch.DEVELOPMENT),
+    ]
+
+    sources = {}
+
+    for v in variants:
+        url = url_for_variant(v)
+        url = fetch_redirect_url(url)
+        version = version_from_url(url)
+        sri_hash = prefetch(url)
+
+        sources[serialize_variant(v)] = {
+            "url": url,
+            "version": version,
+            "hash": sri_hash,
+        }
+
+    with open(os.path.join(os.path.dirname(__file__), "sources.json"), "w") as f:
+        json.dump(sources, f, indent=2, sort_keys=True)
+        f.write("\n")
+
+
+if __name__ == "__main__":
+    main()
@@ -132,16 +132,16 @@ if [ -z "$final_path" ]; then
 	else
 		darcs clone $clone_args "$repository" "$name" >/dev/null
 	fi
-	cd "$tmp_clone/$name"
 	# Will put the current Darcs context into the store.
 	new_context="$tmp_clone/${name}-context.txt"
-	darcs log --context > "$new_context"
+	darcs log --repodir="$tmp_clone/$name" --context > "$new_context"
 	final_context="$(nix-store --add-fixed "$hash_algo" "$new_context")"
 	# Darcs has a weak hash using the XOR of the patch hashes which is useful
 	# for other scripts
 	# https://darcs.net/Internals/Hashes
-	weak_hash="$(darcs show repo | grep '^ *Weak Hash:' | cut -d: -f2- | tr -d "[:space:]")"
-	cd - >/dev/null
+	weak_hash="$(darcs show repo --repodir="$tmp_clone/$name" | awk '/^[[:space:]]*Weak Hash:/ { sub(/^[[:space:]]*Weak Hash:[[:space:]]*/, "", $0); printf $0 }')"
+	date="$(darcs log --repodir="$tmp_clone/$name" --max-count 1 | awk '/^Date:/ { sub(/^Date:[[:space:]]*/, "", $0); printf $0 }')"
+	date="$(date -u -d "$date" "+%Y-%m-%dT%H:%M:%SZ")"
 	rm -rf "$tmp_clone/$name/_darcs"

 	hash="$(nix-hash --type "$hash_algo" "$hash_format" "$tmp_clone/$name")"
@@ -176,6 +176,7 @@ fi; if [ -s "$final_context" ]; then cat <<EOF
 	"context": $(json_escape "$final_context"),
 EOF
 fi; cat <<EOF
+	"date": "$date",
 	"path": "$final_path",
 	$(json_escape "$hash_algo"): $(json_escape "$hash"),
 	"hash": "$(nix-hash --to-sri --type "$hash_algo" "$hash")"
@@ -6,6 +6,7 @@ remote=
 channel="main"
 change=
 state=
+date=
 exp_hash=

 usage() {
@@ -100,11 +101,15 @@ if [ -z "$final_path" ]; then

 	cd "$tmp_clone"
 	pijul clone $clone_args "$remote" "$name"
+	latest_log="$(pijul log --repository "$tmp_clone/$name" --limit 1)"
 	# State is a stable reference is a stable reference for the patchset that
 	# doesn't depend on patch order. As a result, it will always be included.
 	if [ -z "$state" ]; then
-		state="$(pijul log --repository "$tmp_clone/$name" --state --limit 1 | awk '/^State:/ {printf $2}')"
+		state="$(printf "%s" "$latest_log" | awk '/^State:/ {printf $2}')"
 	fi
+	date="$(printf "%s" "$latest_log" | awk '/^Date:/ { sub(/^Date:[[:space:]]*/, "", $0); printf $0 }')"
+	date="$(date -u -d "$date" "+%Y-%m-%dT%H:%M:%SZ")"
+
 	rm -rf "$tmp_clone/$name/.pijul"

 	hash="$(nix-hash --type "$hash_algo" "$hash_format" "$tmp_clone/$name")"
@@ -132,6 +137,7 @@ if [ -n "$change" ]; then cat <<EOF
 EOF
 fi; cat <<EOF
 	"state": $(json_escape "$state"),
+	"date": $(json_escape "$date"),
 	"path": "$final_path",
 	$(json_escape "$hash_algo"): $(json_escape "$hash"),
 	"hash": "$(nix-hash --to-sri --type "$hash_algo" "$hash")"
@@ -11,19 +11,22 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "angrr";
-  version = "0.1.1";
+  version = "0.1.3";

  src = fetchFromGitHub {
    owner = "linyinfeng";
    repo = "angrr";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-SL4UBDoD0pvpCKokQvKLAcS9cQJaFiA+IjswFARswdM=";
+    hash = "sha256-pBVbzrTy/IWIo6WlhM1qgowfxSU31awyHcRDHNArBMo=";
  };

-  cargoHash = "sha256-lo9JpsHkvyrEqFnIiGlU2o4rREeQeqWpe9WMwisvw+4=";
+  cargoHash = "sha256-DoQIJCs36ZmTxdsDCzquKAeOSIUBbo2V+DTx68FZiu4=";

  nativeBuildInputs = [ installShellFiles ];
-  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+  postInstall = ''
+    install -m400 -D ./direnv/angrr.sh $out/share/direnv/lib/angrr.sh
+  ''
+  + lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
    installShellCompletion --cmd angrr \
      --bash <($out/bin/angrr completion bash) \
      --fish <($out/bin/angrr completion fish) \
@@ -23,13 +23,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "aquamarine";
-  version = "0.9.5";
+  version = "0.10.0";

  src = fetchFromGitHub {
    owner = "hyprwm";
    repo = "aquamarine";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-UNzYHLWfkSzLHDep5Ckb5tXc0fdxwPIrT+MY4kpQttM=";
+    hash = "sha256-XnkWjCpeXfip9tqYdL0b0zzBDjq+dgdISvEdSVGdVyA=";
  };

  nativeBuildInputs = [
@@ -0,0 +1,42 @@
+diff --git a/cmd/ui/package.json b/cmd/ui/package.json
+index e061ece8e3..e80f144399 100644
+--- a/cmd/ui/package.json
+++ b/cmd/ui/package.json
+@@ -34,7 +34,7 @@
+         "@react-sigma/core": "^3.4.1",
+         "@reduxjs/toolkit": "^1.8.5",
+         "bh-shared-ui": "workspace:*",
+-        "dagrejs": "git@github.com:BloodHoundAD/dagre.git",
+        "dagrejs": "https://github.com/BloodHoundAD/dagre/archive/3e217cedd8c540c10f9282c2f87d9d4f88dd8185.tar.gz",
+         "downshift": "^6.1.7",
+         "graphology": "^0.25.1",
+         "graphology-layout": "^0.6.1",
+diff --git a/yarn.lock b/yarn.lock
+index d1da73ceb6..f9efa7a893 100644
+--- a/yarn.lock
+++ b/yarn.lock
+@@ -4884,7 +4884,7 @@
+     "@vitest/coverage-v8": ^2.1.9
+     autoprefixer: ^10.4.20
+     bh-shared-ui: "workspace:*"
+-    dagrejs: "git@github.com:BloodHoundAD/dagre.git"
+    dagrejs: "https://github.com/BloodHoundAD/dagre/archive/3e217cedd8c540c10f9282c2f87d9d4f88dd8185.tar.gz"
+     downshift: ^6.1.7
+     eslint: ^8.57.0
+     eslint-config-prettier: ^9.1.0
+@@ -5572,12 +5572,12 @@
+   languageName: node
+   linkType: hard
+ 
+-"dagrejs@git@github.com:BloodHoundAD/dagre.git":
+"dagrejs@https://github.com/BloodHoundAD/dagre/archive/3e217cedd8c540c10f9282c2f87d9d4f88dd8185.tar.gz":
+   version: 1.0.1-pre
+-  resolution: "dagrejs@git@github.com:BloodHoundAD/dagre.git#commit=3e217cedd8c540c10f9282c2f87d9d4f88dd8185"
+  resolution: "dagrejs@https://github.com/BloodHoundAD/dagre/archive/3e217cedd8c540c10f9282c2f87d9d4f88dd8185.tar.gz"
+   dependencies:
+     "@dagrejs/graphlib": 2.1.12
+-  checksum: 7c93c58f7f3c32d990f3136ea90802619cf254106755ac8aa09baf3d772b71a39264ce39fa961b1f9b65dcba04b5c229cace129eb74b411087e85f40d7c2008d
+  checksum: 3c6e8873a5598b87ca6adb1da33a0f0a324bae325e946efa08af2e1e138ac48bbe6dbd9ffe9f6026185aa0b71268947237b63e7aceacf603409560bff4998b11
+   languageName: node
+   linkType: hard
+ 
@@ -0,0 +1,44 @@
+{
+  "@esbuild/aix-ppc64@npm:0.21.5": "97ede19d9e192ba1697ce1d1ea898d7b055605a49f78812abc2c9ee3429d46b30ac0bf064437bbfdf231e4ed484fb1093f30dd65c5f6b21fa3530be1e6ac739b",
+  "@esbuild/android-arm64@npm:0.21.5": "46f84da8656aca18906d8d92469b6a9012c08e3b709002e8711160a07ca993c111cf82966b317ee508bbe73e15efec3c4e0211ad74d5ca0e5795bfa19c1163ab",
+  "@esbuild/android-arm@npm:0.21.5": "082023508d5e46a81ccb3a8bac3ca693bc3832bcb89a32a8cdfd1d643029381e8d4995a8ebcaece03eeb68ebf3a10c5f11f8604e99ea1d6acb1ca8d4eab2f62c",
+  "@esbuild/android-x64@npm:0.21.5": "1141ef28c967dae1b44e921c83bfcc67186d6cde2dcca16909dd34fc84a40852389a99716e603cd348780ade7d9901e054c88a06906e3bfa703f3701d742d86a",
+  "@esbuild/darwin-arm64@npm:0.21.5": "50d5d633be3d0fe0fce54c4740171ae6d2e8f5220280a6f6996f234c718de25535e50a31cee1745b5b80f2cc9e336c42c7fc2b49f3ea38b5f3ff5d8c97ef4123",
+  "@esbuild/darwin-x64@npm:0.21.5": "7f3657b7e76ea593eea37ac6738ed5cc10e97fda333f1b6c7bbf2f7c2e292e7ffe7fa8f214ffd9298f4a748ac6e421e061605e6a5e87333311fbe33f255f39df",
+  "@esbuild/freebsd-arm64@npm:0.21.5": "7efa374aa1a57e6473acda817fcac4b1f9da953a9d945f5a051f7451c1f31ae34af1855b67c3bfcbb8a49e04c10083ec112f3eacaeb0114d3b1a5576bced8fa6",
+  "@esbuild/freebsd-x64@npm:0.21.5": "e365444f5ff8b64dfccc065cee72cb30223f8075be0ea4323578a5677bfd9f114935823cebc2d4f40739288a6e46a1c963d7c68cd5b334eac3e7e38eefdaea77",
+  "@esbuild/linux-arm64@npm:0.21.5": "cdd25895394a13db376a2c4bff1f800642d5d5c2b502e6b96ed989d5386b5d0c00b437c04fd5ac1e30d71727d2d7382981d51154b2ae27692288a7cc02148f1b",
+  "@esbuild/linux-arm@npm:0.21.5": "d08c2f7cf878ef3e0e541dbe8dd4a5ef9cf5f8328ad703353aaf3dfec533e61beb69bb59b6c26022b7ff777c5db39968f4cf60fe4133400e98d1c546a3a0990a",
+  "@esbuild/linux-ia32@npm:0.21.5": "274b528e979f87f106ff306793e4a5d788c4d5de14914e25e784e4b7cb67f2da93227e2f65315b66b79e271b48cec4b2442226bd32f139acb77bb4f492cc4de2",
+  "@esbuild/linux-loong64@npm:0.21.5": "5016b6ff58667dfa026d6911e5d04a644f56bb0dc8385a84e5ca83eb231d9b570d24d6da79542b94cfd7f164a7da7c40b26c8e7ea32d050d1476035dde1f5c59",
+  "@esbuild/linux-mips64el@npm:0.21.5": "540c8e3bdfc380ee07c72b7df3583e0a0c236144cc84ce33b0a906075ac81ab357429023ba2ef4823dd0247edbc7843cfa41b878ae665e62d3d0ef107fdfe27d",
+  "@esbuild/linux-ppc64@npm:0.21.5": "929a04c785fa9dcced848b14f060b514418f7e4cde17b12232027dead1ea9fd91b47e080887e6d0a431bb7222f7f0184664edea0f9ae8fe17a611450ff07c52c",
+  "@esbuild/linux-riscv64@npm:0.21.5": "ad4d6743d9d266700c9e874bc12787be4425de7ea4f5192863adca27f7cefa583ec573b4e6f1f5cc6dfd9bb3542d9ddbe9c9e661e113da2c54ce4a7296f455a1",
+  "@esbuild/linux-s390x@npm:0.21.5": "d5ba16e3d434c109f740d5d31e037c07685b8f989f20eb4295db658057cf03c1363001991258e8d8f523153f7f6e993314ac086b3434acfb067bc39701a54c53",
+  "@esbuild/linux-x64@npm:0.21.5": "91c202dca064909b2c56522f98e3a3b24bc5d43405506b4e67923ecb5d0cc2b78dcee8d815f705d71395402f8532670a391777a3cf6a08894049e453becf07a0",
+  "@esbuild/netbsd-x64@npm:0.21.5": "f42c8c96699fe3cb5ae258d075d437ebf0cb19bdca3b99431be4377f9dbcb9a154f3106e4e85a587b491f2a5c31e15d58f2b1505de5fc23379bf9c5535db9f2d",
+  "@esbuild/openbsd-x64@npm:0.21.5": "7d11f7a371fa438a0e3cf3f6d626e698b773c4f0b2577b0a0b9d303d13ad1cd6821473df0dc96dc09f2cfe12f7502a6011f000292fcf750c1b7b1ad6a93e49ca",
+  "@esbuild/sunos-x64@npm:0.21.5": "1d3b0f316fcca3e22b055c1f459b618adea8c70d9ea996845fb231489c7a4f6dde547666b7a257710245f4b312c57c4bc3006789e4a37735ba626aeab069e253",
+  "@esbuild/win32-arm64@npm:0.21.5": "eaa7a03d70828e806db8010d497e716c49c3fbd72ab7af3de1604726de1ce292b4441aa4bcaa693fb234d9e0054e81daed6f3e1f794a160282c31be424f45789",
+  "@esbuild/win32-ia32@npm:0.21.5": "7a42a116d954eb7920e0713a2cddc605275b36dda91ef34a41d16461d3e1dabad1942742b742c37d0d9d981975445c2acb3cc079628bc415bd94284342c5abe0",
+  "@esbuild/win32-x64@npm:0.21.5": "59f53cdd81340d48479bd4998fc2c11c7018964ca4c41efe3e00fa56b94e4b2e11c9606bac6cf92384a2268d2a9f7621a8d441d456ea42200c91f8a38c03e476",
+  "@rollup/rollup-android-arm-eabi@npm:4.35.0": "63b8af67e4db20b58719c2e7a4e1a8252e591ce3f621c3b254c80ae413127d18dce7a9ba1be157068efe511af99170d519613ca6e005c273ed1bfb37d46e8d9a",
+  "@rollup/rollup-android-arm64@npm:4.35.0": "69f8bcb2123fd201e3db6f828bccec8b2ca3c707b06fd82e0792d1af615214c104b835669601e4dfddf50f77eb3036de8abfe0bb30d2eaa237c3e1006ef10f9c",
+  "@rollup/rollup-darwin-arm64@npm:4.35.0": "559080459c32778aa481745f9a3ee35fa6cec2e3d2cd16246515e7554830571b35c8a334f7a264337a9cede422a8f86e94bfb5daf77ecc07fa5d0384f099b767",
+  "@rollup/rollup-darwin-x64@npm:4.35.0": "ad7e081f4fe82274cebb89ed34cb6bb7c9e2eb30d03fd4cd2c9d4217c76227ec370d7065a1778791a5fe82d3ee7e9e9a04a77714cf65fe36c9e43202a49198b4",
+  "@rollup/rollup-freebsd-arm64@npm:4.35.0": "a685691f78693b8b5052a7fe4fbf89361b2001115b14c14cd156ad84b621e67c7b67171aee05d3a659f4148df31fd9a4460b3ac27627bacbda185fa2576e1f45",
+  "@rollup/rollup-freebsd-x64@npm:4.35.0": "6202f1e61d0d92a0232b46a98c6ca9d71782803d2ffe5c7b99b04230ecdc1d822408b2833c5889804c27bb364897708676ed9853e8c4cae19f7ea9a9afa291ef",
+  "@rollup/rollup-linux-arm-gnueabihf@npm:4.35.0": "b05e7aee3c388a2902bc282952c3d8ebf7d72a6ecebb44bc76bbcf86c399294f471f59fcaf32750b8ae885f17c6f707f75dc698883aaeb3424e5a9b4a2ff9416",
+  "@rollup/rollup-linux-arm-musleabihf@npm:4.35.0": "74fa64b7d9891770ef305f64e7cf10684252819f77e7e6b6bd9480aede21e4a6050989840cb3a3d471b17adf6186755ae11c9c6da31a64c3df362c6b3477ef74",
+  "@rollup/rollup-linux-arm64-gnu@npm:4.35.0": "64774108822fe5a03dbfcc956988a6ad649a1de284878b395778fef72fd28103112d30fc4478cad0f8f738fee43a1f9d53847a76a6003881a6850e43c868ce72",
+  "@rollup/rollup-linux-arm64-musl@npm:4.35.0": "51c3785b65767c1345359fdf738e88dacfe7394787ec275245e0d2db94b487bfd57c0461b38239afdbc276d8428fe6e688d716c76012c97a4b5ec21f86482cb5",
+  "@rollup/rollup-linux-loongarch64-gnu@npm:4.35.0": "42ecbbe666cfbe20c1a6ff81f10318524c0b2cb0aaeda5ad41ce02f13bba29c72352b75b5a0bfe0a600a2e4daeca616e2ad4b874c3066a130612c7e1518c9ffa",
+  "@rollup/rollup-linux-powerpc64le-gnu@npm:4.35.0": "00d07f1f4d41ad965554c32aafd7409f651749b62570fbb41442f72264a2df841be37deb9a11409d399727d9c16d740204ae8f280c2f0bbcada5ec65e70a0f61",
+  "@rollup/rollup-linux-riscv64-gnu@npm:4.35.0": "1ce600dcd78e5de15f0f10f21c2378c5469250c0fb00c610e1f218a62855a17a425631afffc84e8d526070d82c96980da86aa8b9a8fce400e79cd030027ec995",
+  "@rollup/rollup-linux-s390x-gnu@npm:4.35.0": "f0e568e47e2d4675afc139c2d13cb0258ffe08414b8ac75372454c7179f74364fb06504666cf22c824f18e12e5c1dc774a1a2e2bb3201689ec116e4e6e5570db",
+  "@rollup/rollup-linux-x64-gnu@npm:4.35.0": "d07781b3fcef75ca3989ff5f179d03a7ca0e93dd478b001557b5950d8883ac2104a63688cbf3d8d085baea4a676d73dd04ef053914e5c8839d6295eb682c06b4",
+  "@rollup/rollup-linux-x64-musl@npm:4.35.0": "7052cd1dbf44674da9a57d453435693456ad1cdbf079307f6ff9ceecc92c654c194c7b06a5692f34690bc2f73397d6f7f5dc93710403bff11d4082818d9b4ff4",
+  "@rollup/rollup-win32-arm64-msvc@npm:4.35.0": "0259f2acfbc1bfea042e235fbc8d8862e2c06cb394106e16b1ca980e66002d002cc55dc463fedb28feda49375f605d2aa8ceff52e78d4db2ca8e2921a5c89806",
+  "@rollup/rollup-win32-ia32-msvc@npm:4.35.0": "2ec41e203aee7eaa42eceb2853c0e7cce0613034d0e086d3eca4073b0565769c674f7563cb0f05d90900cf08bc486b57c16cb184b1e8d68ee57c60fc0a54f18a",
+  "@rollup/rollup-win32-x64-msvc@npm:4.35.0": "253b4421e708bde3f848d5165619f0301cd65da6d359ba1f23c6e2a42466d1a793baf35df46fb3574a8a6e74b0439511c397624742dd9abcb3a11256a9599007"
+}
@@ -0,0 +1,201 @@
+{
+  buildGoModule,
+  fetchFromGitHub,
+  fetchurl,
+  lib,
+  makeWrapper,
+  nodejs_22,
+  p7zip,
+  python3,
+  stdenv,
+  yarn-berry_3,
+}:
+let
+  inherit (lib) concatLines pipe;
+  inherit (lib.versions) major minor patch;
+
+  # reference: https://github.com/SpecterOps/BloodHound/blob/main/dockerfiles/bloodhound.Dockerfile
+
+  pname = "bloodhound-ce";
+  version = "8.3.1";
+
+  src = fetchFromGitHub {
+    owner = "SpecterOps";
+    repo = "BloodHound";
+    tag = "v${version}";
+    hash = "sha256-mIoQkxUxv2BktFGSLKo5RVEF/7JByiyCWC2o9GWS9w4=";
+  };
+
+  yarn-berry = yarn-berry_3;
+
+  frontend = stdenv.mkDerivation (finalAttrs: {
+    pname = "bloodhound-ce-frontend";
+    inherit version src;
+
+    patches = [
+      # cmd/ui/package.json includes "git@github.com:BloodHoundAD/dagre.git"
+      # which requires a valid SSH credential to fetch
+      ./fetch-dagrejs-via-https.patch
+    ];
+
+    nativeBuildInputs = [
+      nodejs_22
+      yarn-berry
+      yarn-berry.yarnBerryConfigHook
+
+      # for node-gyp builds
+      (python3.withPackages (
+        p: with p; [
+          distutils
+        ]
+      ))
+    ];
+
+    missingHashes = ./missing-hashes.json;
+
+    offlineCache = yarn-berry.fetchYarnBerryDeps {
+      inherit (finalAttrs) src patches missingHashes;
+      hash = "sha256-0OXOZ9QVpOxqE4r1Gj0dOlEijY+JAqOvanntp5D5t1M=";
+    };
+
+    preConfigure = ''
+      export JOBS=$NIX_BUILD_CORES
+    '';
+
+    buildPhase = ''
+      runHook preBuild
+      yarn build
+      runHook postBuild
+    '';
+
+    installPhase = ''
+      runHook preInstall
+      cp -r cmd/ui/dist $out
+      runHook postInstall
+    '';
+  });
+
+  collectors =
+    let
+      azver = "v2.8.1";
+      shver = "v2.8.0";
+
+      sharphound = fetchurl {
+        url = "https://github.com/SpecterOps/SharpHound/releases/download/${shver}/sharphound_${shver}_windows_x86.zip";
+        hash = "sha256-BjBOxjhQYpqD/qUy9EsuXplK8JAuPU/LE2O0Ooxr+r4=";
+      };
+    in
+    pipe
+      [
+        {
+          os = "darwin";
+          arch = "amd64";
+          hash = "sha256-HD5vMc6vt71wj5ST6On417iY3DJZQXdG8Il73H22m9Q=";
+        }
+        {
+          os = "darwin";
+          arch = "arm64";
+          hash = "sha256-57i+/9gV17pqQqqnEianJdJ6Jtg4DsExMkfAEqaeNns=";
+        }
+        {
+          os = "linux";
+          arch = "amd64";
+          hash = "sha256-8wrEef0+ik5WAsIV7tInyUlNnsUBw6Ux9LE7gVS3Fhs=";
+        }
+        {
+          os = "linux";
+          arch = "arm64";
+          hash = "sha256-23lokcbd2Yp9pWibsb5SNW/YE/eHpHCFZv2PbBlw0Xo=";
+        }
+        {
+          os = "windows";
+          arch = "amd64";
+          hash = "sha256-IkEfEh2VFNTnuUAez6/vMY7sMv4rtDR3Paerev/xoqs=";
+        }
+        {
+          os = "windows";
+          arch = "arm64";
+          hash = "sha256-qEgmO7oNy/pUXH7lbOoJxNznl2mPofj2R5RGBZdOoUI=";
+        }
+      ]
+      [
+        (map (
+          x:
+          "cp ${
+            fetchurl {
+              url = "https://github.com/SpecterOps/AzureHound/releases/download/${azver}/azurehound_${azver}_${x.os}_${x.arch}.zip";
+              inherit (x) hash;
+            }
+          } azurehound_${azver}_${x.os}_${x.arch}.zip"
+        ))
+        concatLines
+        (
+          copyAzurehoundZips:
+          stdenv.mkDerivation {
+            pname = "bloodhound-ce-collectors";
+            inherit version src;
+
+            nativeBuildInputs = [ p7zip ];
+
+            installPhase = ''
+              mkdir -p $out/{azurehound,sharphound}
+
+              ${copyAzurehoundZips}
+              7z x 'azurehound_*.zip' '-oartifacts/*'
+              (cd artifacts; 7z a -tzip -mx9 $out/azurehound/azurehound-${azver}.zip *)
+
+              cp ${sharphound} $out/sharphound/sharphound-${shver}.zip
+              for i in $out/*/*.zip; do sha256sum "$i" > "$i.sha256"; done
+            '';
+          }
+        )
+      ];
+in
+buildGoModule {
+  inherit pname version src;
+
+  nativeBuildInputs = [
+    makeWrapper
+  ];
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/specterops/bloodhound/cmd/api/src/version.majorVersion=${major version}"
+    "-X github.com/specterops/bloodhound/cmd/api/src/version.minorVersion=${minor version}"
+    "-X github.com/specterops/bloodhound/cmd/api/src/version.patchVersion=${patch version}"
+  ];
+
+  subPackages = [
+    "cmd/api/src/cmd/bhapi"
+  ];
+
+  vendorHash = "sha256-Lm6g0pxGVIuns6mUwnkbnBQQQp1V0TvEakX5fAo8qMo=";
+
+  preBuild = ''
+    rm -rf            cmd/api/src/api/static/assets
+    cp -r ${frontend} cmd/api/src/api/static/assets
+  '';
+
+  postInstall = ''
+    mv $out/bin/{bhapi,bloodhound-ce}
+
+    wrapProgram $out/bin/bloodhound-ce \
+      --set BHE_COLLECTORS_BASE_PATH ${collectors}
+  '';
+
+  passthru = {
+    inherit frontend collectors;
+  };
+
+  meta = with lib; {
+    description = "Six Degrees of Domain Admin";
+    homepage = "https://github.com/SpecterOps/BloodHound";
+    changelog = "https://github.com/SpecterOps/BloodHound/releases/tag/v${version}";
+    downloadPage = "https://github.com/SpecterOps/BloodHound/releases";
+    license = licenses.asl20;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ eleonora ];
+    mainProgram = "bloodhound-ce";
+  };
+}
@@ -15,21 +15,27 @@
  libadwaita,
  gtksourceview5,
  openssl,
+  python313,
+  gtk4,
+  shared-mime-info,
+  glib,
+  hicolor-icon-theme,
+  pango,
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "cartero";
-  version = "0.2.2";
+  version = "0.2.4";

  src = fetchFromGitHub {
    owner = "danirod";
    repo = "cartero";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-WQ1pGAIFOwXZ+cokHTBPkFrTGikqpEYxK7J5LFqoeH0=";
+    hash = "sha256-l6UYsidMqTsEiabviWGAsEOFyDslpP2wIws0Yk10se4=";
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
    inherit (finalAttrs) pname version src;
-    hash = "sha256-vmpBZqRo3Wc7E1d/UzZWDfV96cI9WaSykdxEOTN9KvU=";
+    hash = "sha256-HUwIbrWt9coPjUKRL1nnt0NurwkEGV/Z07BHySnVfQo=";
  };

  nativeBuildInputs = [
@@ -42,15 +48,26 @@ stdenv.mkDerivation (finalAttrs: {
    blueprint-compiler
    wrapGAppsHook4
    desktop-file-utils
-    libxml2 # xmllint
+    libxml2
+    python313
+    gtk4
+    shared-mime-info
+    glib
+    hicolor-icon-theme
  ];

  buildInputs = [
    libadwaita
    gtksourceview5
    openssl
+    pango
+    libadwaita
  ];

+  postPatch = ''
+    patchShebangs --build build-aux/gen-version.py
+  '';
+
  meta = {
    description = "Make HTTP requests and test APIs";
    longDescription = ''
@@ -14,6 +14,7 @@
  removeReferencesTo,
  testers,
  yarn,
+  versionCheckHook,
 }:

 stdenv.mkDerivation (finalAttrs: {
@@ -101,6 +102,8 @@ stdenv.mkDerivation (finalAttrs: {
  buildPhase = ''
    runHook preBuild

+    bash ./tools/align-version.sh
+
    faketty yarn --offline build

    runHook postBuild
@@ -139,6 +142,9 @@ stdenv.mkDerivation (finalAttrs: {
      "$out/lib/node_modules/cdktf-cli/node_modules/@cdktf/hcl2json/main.wasm"
  '';

+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+
  passthru = {
    tests.version = testers.testVersion {
      package = finalAttrs.finalPackage;
@@ -6,13 +6,13 @@
 }:
 buildGoModule rec {
  pname = "certstream-server-go";
-  version = "1.8.1";
+  version = "1.8.2";

  src = fetchFromGitHub {
    owner = "d-Rickyy-b";
    repo = "certstream-server-go";
    tag = "v${version}";
-    hash = "sha256-ashuwJjWrKjVtjPzBLmXX7EMFX0nlxs4B53pBP2G3Bo=";
+    hash = "sha256-06CoeGPOsJItqUuXbBo2Wxhn2KwqbjpCA8GE1Ng7978=";
  };

  vendorHash = "sha256-+7wL6JA5sNRNJQKelVkEVCZ5pqOlmn8o7Um2g6rsIlc=";
@@ -1,6 +1,6 @@
 import ./generic.nix {
-  version = "25.10.2.65-stable";
-  rev = "4ff630944f84ed44067d3fb37d5435de8ced10ce";
-  hash = "sha256-JbnuzEcL6cz/UKjWjZj4KoRyeoheOIaTswuzaIiem4g=";
+  version = "25.10.3.100-stable";
+  rev = "1e703eae565a020b055213f9cecd60fb277263d2";
+  hash = "sha256-cElRzd/NLPpmNl/J89hmsg4JtFY4jmFLIbK6F8tuYnA=";
  lts = false;
 }
@@ -106,6 +106,7 @@ stdenv.mkDerivation rec {
    inherit (nixosTests) dnscrypt-proxy;
    kubernetes-dns-single = nixosTests.kubernetes.dns-single-node;
    kubernetes-dns-multi = nixosTests.kubernetes.dns-multi-node;
+    pihole-ftl-dnsmasq = nixosTests.pihole-ftl.dnsmasq;
  };

  meta = with lib; {
@@ -6,16 +6,16 @@

 buildNpmPackage rec {
  pname = "eask-cli";
-  version = "0.11.8";
+  version = "0.11.9";

  src = fetchFromGitHub {
    owner = "emacs-eask";
    repo = "cli";
    rev = version;
-    hash = "sha256-OGgXlszN+us6Wi6U2d2M6vOQ88kk/ZORmXoz5CNoCWo=";
+    hash = "sha256-yI227/ZC+4qyg/H+4yuv1imuwIyCB8wDZ7Z3f0OPqXI=";
  };

-  npmDepsHash = "sha256-X5v4ZZmcd0Cc41dFCKRX15uEnbQs2/ZQkPjB7V0k/OY=";
+  npmDepsHash = "sha256-v1o9ZSA+WRYjj2bH+w3lOCXbzqHvsHuvOejU8Ea9PR8=";

  dontBuild = true;

@@ -17,16 +17,16 @@
 }:

 let
-  version = "0.209.8";
+  version = "0.210.1";

  src = fetchFromGitHub {
    owner = "evcc-io";
    repo = "evcc";
    tag = version;
-    hash = "sha256-FQIv4TnBcP7zqGbPkf9/BSjA+FpABGnyZ+fvj55TaJE=";
+    hash = "sha256-F2gRuvu/WCQp+Kac8nwjmoevSuVkg40pN3zVOY9EnWs=";
  };

-  vendorHash = "sha256-hRIgDduxpRIpHtIUobW806/sfBafyiOb/x8uptrrLns=";
+  vendorHash = "sha256-arrEWH3rspwynRXf43sElliEJ2kBxhikz1ZGS1+gDes=";

  commonMeta = with lib; {
    license = licenses.mit;
@@ -52,7 +52,7 @@ buildGo125Module rec {

  npmDeps = fetchNpmDeps {
    inherit src;
-    hash = "sha256-MiIRAceqdBAtrpityS9oPTbztffDpGcO0QclpFNYJLs=";
+    hash = "sha256-vDMDyMEf6kWn1UFHvzmIxnY/ofh6YwwVFlCeKExfEy4=";
  };

  nativeBuildInputs = [
@@ -1,5 +1,6 @@
 {
  lib,
+  stdenv,
  python3,
  fetchFromGitHub,
  writableTmpDirAsHomeHook,
@@ -7,14 +8,14 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "fromager";
-  version = "0.68.1";
+  version = "0.71.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "python-wheel-build";
    repo = "fromager";
    tag = version;
-    hash = "sha256-7NM8hRsMnnHWxzjwNv/cLIm9iOUsUEzoCwPuFUN8+hk=";
+    hash = "sha256-3zz37BZx8FcKNl8mSmClIrZxvL+2AS0hJDct6K7BhBE=";
  };

  build-system = with python3.pkgs; [
@@ -65,6 +66,11 @@ python3.pkgs.buildPythonApplication rec {
    # Accessing pypi.org (not allowed in sandbox)
    "test_get_build_backend_dependencies"
    "test_get_build_sdist_dependencies"
+  ]
+  ++ lib.optionals (stdenv.hostPlatform.isAarch64 && stdenv.hostPlatform.isLinux) [
+    # Assumes platform.machine() returns 'arm64' on ARM64, which is not true for Linux.
+    # Re-enable once https://github.com/python-wheel-build/fromager/pull/849 is merged.
+    "test_add_constraint_conflict"
  ];

  meta = {
@@ -6,7 +6,7 @@

 let
  pname = "gate";
-  version = "0.58.1";
+  version = "0.59.0";
 in
 buildGoModule {
  inherit pname version;
@@ -15,10 +15,10 @@ buildGoModule {
    owner = "minekube";
    repo = "gate";
    tag = "v${version}";
-    hash = "sha256-EOiLoZgIKRobULHOKoUVLws+KRK1XhJvCWjQmKjvjcM=";
+    hash = "sha256-SB1rl5JjxFoA32Jyg6/ESuiOOS6RYsGp0HfL9O4tjyA=";
  };

-  vendorHash = "sha256-2ZRfvjIGUznHjn7KA20uzEpVbI7EByNUYu6xALJEUfo=";
+  vendorHash = "sha256-f7SkECS80Lwkd0xSzHq+x05ZBjBYKXsA4rPidyIAYak=";

  ldflags = [
    "-s"
@@ -0,0 +1,36 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "gatus-cli";
+  version = "1.0.0";
+
+  src = fetchFromGitHub {
+    owner = "TwiN";
+    repo = "gatus-cli";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-0acFtEIZCZMXDpYVW26u6DDwymKNJ1l9urNMgFlVXrU=";
+  };
+
+  vendorHash = "sha256-LNcGNPupeyztuq5hpyDt/tIxMEI/yemhFhJHsh3ZzOU=";
+
+  subPackages = [ "." ];
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X main.version=${finalAttrs.version}"
+  ];
+
+  meta = {
+    description = "Client for Gatus, an automated developer-oriented status page";
+    homepage = "https://github.com/TwiN/gatus-cli";
+    changelog = "https://github.com/TwiN/gatus-cli/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.giorgiga ];
+    mainProgram = "gatus-cli";
+  };
+})
@@ -75,6 +75,11 @@ stdenv.mkDerivation (finalAttrs: {
        ]
        ++ [
          "logging" # works around segfaults for now
+        ]
+        ++ lib.optionals (stdenv.hostPlatform.isPower64 && stdenv.hostPlatform.isBigEndian) [
+          # CHECK_STREQ failed: symbol == "non_inline_func" ((/build/source/build/symbolize_unittest+0x1000b840) vs. non_inline_func)
+          # TestWithPCInsideNonInlineFunction doesn't use TEST(), so can't exclude via GTEST_FILTER
+          "symbolize"
        ];
      excludedTestsRegex = lib.optionalString (
        excludedTests != [ ]
@@ -4,6 +4,7 @@
  fetchFromGitHub,
  replaceVars,
  xapp,
+  xapp-symbolic-icons,
  circle-flags,
  gettext,
  gobject-introspection,
@@ -15,13 +16,13 @@

 stdenv.mkDerivation rec {
  pname = "hypnotix";
-  version = "5.3";
+  version = "5.4";

  src = fetchFromGitHub {
    owner = "linuxmint";
    repo = "hypnotix";
    tag = version;
-    hash = "sha256-KJqGdBqeNtXYO3XOQvRJs4ie8jK4Hyv+YS86PB0dnOM=";
+    hash = "sha256-aLcuRg6I1PaHBKyHMEV+TYOM82wb1hPVzMuF0SZixs8=";
  };

  patches = [
@@ -81,6 +82,7 @@ stdenv.mkDerivation rec {
    wrapProgram $out/bin/hypnotix \
      --prefix PATH : "${lib.makeBinPath [ yt-dlp ]}" \
      --prefix PYTHONPATH : "$program_PYTHONPATH" \
+      --prefix XDG_DATA_DIRS : "${lib.makeSearchPath "share" [ xapp-symbolic-icons ]}" \
      ''${gappsWrapperArgs[@]}
  '';

@@ -10,13 +10,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "hyprutils";
-  version = "0.10.2";
+  version = "0.10.3";

  src = fetchFromGitHub {
    owner = "hyprwm";
    repo = "hyprutils";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-nuJoIbG1DeXaoj9LtSRqfCBzM0dJ2uzTwQgO5B2Kj/8=";
+    hash = "sha256-Q4ZfdlEGQU2LJ/Dif0qzF88xgIkpD6/uRsGfxOpu9jc=";
  };

  nativeBuildInputs = [
@@ -13,13 +13,13 @@
 }:

 let
-  version = "2.2.0";
+  version = "2.2.1";
  src = fetchFromGitea {
    domain = "codeberg.org";
    owner = "liske";
    repo = "ifstate";
    tag = version;
-    hash = "sha256-Q06lGGGQxJ7ntgXRzfnsJN+A/08AIOsOkz3cg2xZGr4=";
+    hash = "sha256-L79DZbkf+Yob1kfIKvHeUEvPfSbWfS0TTP0UYlkLzjI=";
  };
  docs = stdenv.mkDerivation {
    pname = "ifstate-docs";
@@ -0,0 +1,80 @@
+{
+  lib,
+  stdenv,
+  udev,
+  openssl,
+  boost,
+  cmake,
+  git,
+  level-zero,
+  fetchFromGitHub,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "intel-npu-driver";
+  version = "1.26.0";
+
+  src = fetchFromGitHub {
+    owner = "intel";
+    repo = "linux-npu-driver";
+    tag = "v${version}";
+    fetchSubmodules = true;
+    hash = "sha256-f3GxvYBfCCK6EGASuHrevFEVcBAyKyWXaIvSNcNcSZQ=";
+  };
+
+  buildInputs = [
+    udev
+    openssl
+    boost
+    level-zero
+  ];
+
+  nativeBuildInputs = [
+    cmake
+  ];
+
+  outputs = [
+    "out"
+    "validation"
+    "firmware"
+  ];
+
+  postPatch = ''
+    rm -rf third_party/level-zero
+    rm third_party/cmake/level-zero.cmake
+    rm third_party/cmake/FindLevelZero.cmake
+
+    substituteInPlace third_party/yaml-cpp/CMakeLists.txt --replace-fail \
+      "cmake_minimum_required" \
+      "# cmake_minimum_required"
+
+    substituteInPlace third_party/CMakeLists.txt --replace-fail \
+      "include(cmake/level-zero.cmake)" \
+      ""
+    substituteInPlace third_party/level-zero-npu-extensions/ze_graph_ext.h --replace-fail \
+    "#include \"ze_api.h\"" \
+    "#include <level_zero/ze_api.h>"
+
+    substituteInPlace validation/{kmd-test,umd-test}/CMakeLists.txt --replace-fail \
+      "COMPONENT validation-npu" \
+      "DESTINATION $validation/bin COMPONENT validation-npu"
+
+    substituteInPlace firmware/CMakeLists.txt --replace-fail \
+      "DESTINATION /lib/firmware/updates/intel/vpu/" \
+      "DESTINATION $firmware/lib/firmware/intel/vpu/"
+  '';
+
+  installPhase = ''
+    cmake --install . --component level-zero-npu
+    cmake --install . --component validation-npu
+    cmake --install . --component fw-npu
+  '';
+
+  meta = {
+    homepage = "https://github.com/intel/linux-npu-driver";
+    description = "Intel NPU (Neural Processing Unit) Standalone Driver";
+    platforms = [ "x86_64-linux" ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ pseudocc ];
+  };
+}
@@ -0,0 +1,68 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  makeWrapper,
+  wrapGAppsHook4,
+  autoPatchelfHook,
+  btar,
+  icu,
+  gtk4,
+  webkitgtk_6_0,
+  openssl,
+}:
+
+let
+  libraries = [
+    icu
+    (lib.getLib stdenv.cc.cc)
+    gtk4
+    webkitgtk_6_0
+    openssl
+  ];
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "kreya";
+  version = "1.18.0";
+
+  src = fetchurl {
+    url = "https://stable-downloads.kreya.app/${finalAttrs.version}/Kreya-linux-x64.tar.gz";
+    hash = "sha256-oXDR1vwU0ikDq4eHFOXTlDgpODH6kVQu/2Ghed9c508=";
+  };
+
+  nativeBuildInputs = [
+    makeWrapper
+    autoPatchelfHook
+    wrapGAppsHook4
+  ];
+
+  buildInputs = libraries;
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm755 kreya -t $out/bin
+    install -Dm755 *.so -t $out/lib
+
+    mkdir -p $out/share/kreya/
+    cp -r example-project $out/share/kreya/
+    cp -r protoc $out/share/kreya/
+    cp kreya.xml $out/share/kreya/
+
+    wrapProgram $out/bin/kreya \
+      --set LD_LIBRARY_PATH "$out/lib:${lib.makeLibraryPath libraries}"
+
+    runHook postInstall
+  '';
+
+  dontStrip = true;
+
+  meta = {
+    description = "Kreya is a GUI client for gRPC and REST APIs";
+    homepage = "https://kreya.app/";
+    license = lib.licenses.unfree;
+    platforms = [ "x86_64-linux" ];
+    sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
+    maintainers = with lib.maintainers; [ maxmosk ];
+  };
+})
@@ -0,0 +1,68 @@
+diff --git a/client/package.json b/client/package.json
+index f96aefa2d..ef3050f72 100644
+--- a/client/package.json
+++ b/client/package.json
+@@ -121,7 +121,7 @@
+     "@tanstack/react-query-devtools": "^4.29.0",
+     "@testing-library/dom": "^9.3.0",
+     "@testing-library/jest-dom": "^5.16.5",
+-    "@testing-library/react": "^14.0.0",
+    "@testing-library/react": "^14.3.1",
+     "@testing-library/user-event": "^14.4.3",
+     "@types/jest": "^29.5.14",
+     "@types/js-cookie": "^3.0.6",
+diff --git a/package-lock.json b/package-lock.json
+index 5b484fd55..7cbc13f49 100644
+--- a/package-lock.json
+++ b/package-lock.json
+@@ -20,6 +20,7 @@
+         "@eslint/js": "^9.20.0",
+         "@microsoft/eslint-formatter-sarif": "^3.1.0",
+         "@playwright/test": "^1.50.1",
+        "@testing-library/react": "^14.3.1",
+         "@types/react-virtualized": "^9.22.0",
+         "caniuse-lite": "^1.0.30001741",
+         "cross-env": "^7.0.3",
+@@ -2718,7 +2719,7 @@
+         "@tanstack/react-query-devtools": "^4.29.0",
+         "@testing-library/dom": "^9.3.0",
+         "@testing-library/jest-dom": "^5.16.5",
+-        "@testing-library/react": "^14.0.0",
+        "@testing-library/react": "^14.3.1",
+         "@testing-library/user-event": "^14.4.3",
+         "@types/jest": "^29.5.14",
+         "@types/js-cookie": "^3.0.6",
+@@ -51744,7 +51745,7 @@
+         "@rollup/plugin-replace": "^5.0.5",
+         "@rollup/plugin-terser": "^0.4.4",
+         "@tanstack/react-query": "^4.28.0",
+-        "@testing-library/react": "^14.0.0",
+        "@testing-library/react": "^16.3.0",
+         "@types/react": "^18.2.11",
+         "@types/react-dom": "^18.2.4",
+         "caniuse-lite": "^1.0.30001741",
+diff --git a/package.json b/package.json
+index 693de111d..5e58ab1f0 100644
+--- a/package.json
+++ b/package.json
+@@ -99,6 +99,7 @@
+     "@eslint/js": "^9.20.0",
+     "@microsoft/eslint-formatter-sarif": "^3.1.0",
+     "@playwright/test": "^1.50.1",
+    "@testing-library/react": "^14.3.1",
+     "@types/react-virtualized": "^9.22.0",
+     "caniuse-lite": "^1.0.30001741",
+     "cross-env": "^7.0.3",
+diff --git a/packages/client/package.json b/packages/client/package.json
+index 71aac0c29..ab6fabca1 100644
+--- a/packages/client/package.json
+++ b/packages/client/package.json
+@@ -75,7 +75,7 @@
+     "@rollup/plugin-replace": "^5.0.5",
+     "@rollup/plugin-terser": "^0.4.4",
+     "@tanstack/react-query": "^4.28.0",
+-    "@testing-library/react": "^14.0.0",
+    "@testing-library/react": "^16.3.0",
+     "@types/react": "^18.2.11",
+     "@types/react-dom": "^18.2.4",
+     "caniuse-lite": "^1.0.30001741",
@@ -1,6 +1,7 @@
 {
  lib,
  buildNpmPackage,
+  fetchNpmDeps,
  fetchFromGitHub,
  pkg-config,
  node-gyp,
@@ -10,13 +11,13 @@

 buildNpmPackage rec {
  pname = "librechat";
-  version = "0.7.8";
+  version = "0.8.0";

  src = fetchFromGitHub {
    owner = "danny-avila";
    repo = "LibreChat";
    tag = "v${version}";
-    hash = "sha256-bo26EzpRjE2hbbx6oUo0tDsLMdVpWcazCIzA5sm5L34=";
+    hash = "sha256-DTmb9J2nsMy6f+V6BgRtFgpTwOi9OQnvikSx4QZQ0HI=";
  };

  patches = [
@@ -35,9 +36,20 @@ buildNpmPackage rec {
    # directory as well. Again, we patch this to be relative to the current working
    # directory instead.
    ./0003-upload-paths.patch
+    # The npm dependencies are causing issues with the build. The package @testing-library/react
+    # appears to not be included in NPM deps, even though it is present in the project
+    # This patch fixes this by placing the dependency in different files and regenerating the
+    # lock file.
+    ./0004-fix-deps-v080.patch
  ];

-  npmDepsHash = "sha256-knmS2I6AiSdV2bSnNBThbVHdkpk6iXiRuk4adciDK1M=";
+  npmDepsHash = "sha256-97cEw6VD7FoVayrxClHuS1iUcQmDw7/aUoUV6ektvOY=";
+  npmDeps = fetchNpmDeps {
+    inherit src;
+    name = "${pname}-${version}-npm-deps-patched";
+    hash = npmDepsHash;
+    patches = [ ./0004-fix-deps-v080.patch ];
+  };

  nativeBuildInputs = [
    pkg-config
@@ -52,7 +64,18 @@ buildNpmPackage rec {
  makeCacheWritable = true;

  npmBuildScript = "frontend";
-  npmPruneFlags = [ "--omit=dev" ];
+  npmPruneFlags = [ "--production" ];
+
+  # For reasons beyond my understanding, the api and client directory disappears after the build finishes.
+  # Hence, the build fails with broken symlinks and if the symlink is removed,
+  # starting LibreChat fails with a "module not found" error.
+  # This is a fixup that copies the missing files to the appropriate location.
+  preFixup = ''
+    mkdir -p $out/lib/node_modules/LibreChat/packages/api
+    cp -R packages/api/dist/. $out/lib/node_modules/LibreChat/packages/api
+    mkdir -p $out/lib/node_modules/LibreChat/packages/client
+    cp -R packages/client/dist/. $out/lib/node_modules/LibreChat/packages/client
+  '';

  passthru = {
    updateScript = nix-update-script {
@@ -81,7 +81,6 @@ stdenv.mkDerivation (finalAttrs: {
    "ETCDIR=${placeholder "out"}/etc"
    "PREFIX=${placeholder "out"}"
    "SHAREDDIR=${placeholder "out"}/share"
-    "SUB_FEATURES=${lib.concatStringsSep " " subFeatures}"
  ];

  env.NIX_CFLAGS_COMPILE = "-DLSP_NO_EXPERIMENTAL";
@@ -89,7 +88,7 @@ stdenv.mkDerivation (finalAttrs: {
  configurePhase = ''
    runHook preConfigure

-    make $makeFlags config
+    make $makeFlags config SUB_FEATURES="${lib.concatStringsSep " " subFeatures}"

    runHook postConfigure
  '';
@@ -8,13 +8,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "melodeon";
-  version = "0.4.5";
+  version = "0.5.0";

  src = fetchFromGitHub {
    owner = "CDrummond";
    repo = "melodeon";
    tag = finalAttrs.version;
-    hash = "sha256-qIqCk6nMwbJv1stXwZoK89IQjbD0Wv6jmK2g+zyCpNU=";
+    hash = "sha256-WfDPmOysM3ya7PACROCxHjInF0q5AIJ3G4bdJsh8RxA=";
    fetchSubmodules = true;
  };

@@ -10,14 +10,14 @@

 stdenvNoCC.mkDerivation {
  pname = "mint-l-icons";
-  version = "1.7.8";
+  version = "1.7.9";

  src = fetchFromGitHub {
    owner = "linuxmint";
    repo = "mint-l-icons";
    # They don't really do tags, this is just a named commit.
-    rev = "5d96655e37a85aa5e3d20bc7b38c9675a6145d13";
-    hash = "sha256-9MdGMbxJKZTchYKEc/cV4m4M4tgraF1XlSNVT5PInVY=";
+    rev = "fa88b00e10b0978e0309acccfa95d80005422b1a";
+    hash = "sha256-XXy1eO0a/5bBnP/inaUa/c09D/6QDmnik1LH382NGIw=";
  };

  propagatedBuildInputs = [
@@ -12,13 +12,13 @@

 stdenvNoCC.mkDerivation rec {
  pname = "mint-x-icons";
-  version = "1.7.4";
+  version = "1.7.5";

  src = fetchFromGitHub {
    owner = "linuxmint";
    repo = "mint-x-icons";
    rev = version;
-    hash = "sha256-Ea0NkN9vnfqqqXpE+aM6zca1m7ri4mP1DMTQhvx9guQ=";
+    hash = "sha256-UNta7sj5xzZglYJekhxa0N/2RJU4cyqjX2fCFdWqoiY=";
  };

  propagatedBuildInputs = [
@@ -10,13 +10,13 @@

 stdenvNoCC.mkDerivation rec {
  pname = "mint-y-icons";
-  version = "1.8.8";
+  version = "1.8.9";

  src = fetchFromGitHub {
    owner = "linuxmint";
    repo = "mint-y-icons";
    rev = version;
-    hash = "sha256-PFq0NVUD6uQtHtObJfIsn/wPSwYMT6267UWjBnIpWAQ=";
+    hash = "sha256-eUMBn+2qnU6mgDPM6i2ebwEq3mSV3Uo6bXveVew3j9U=";
  };

  propagatedBuildInputs = [
@@ -1,21 +1,21 @@
 {
-  "version": "3.173.2",
+  "version": "3.174.0",
  "assets": {
    "x86_64-linux": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.173.2/mirrord_linux_x86_64",
-      "hash": "sha256-EO+tPHF8+Nlo2JILPRU6/DvtUHBdhfhPfL3AV+ZN8Vw="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.174.0/mirrord_linux_x86_64",
+      "hash": "sha256-ZhI5ZC54mD2QbX3LDZJablJDZV7bE25acVLYo1AB/GY="
    },
    "aarch64-linux": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.173.2/mirrord_linux_aarch64",
-      "hash": "sha256-jJtkC6FxPV26h/FMtNt3aqoTx/t8Bx6Oq5DQe5JZvfw="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.174.0/mirrord_linux_aarch64",
+      "hash": "sha256-Kdpdk+yOgJAtz7CwOc5mudbzRyPrtT46mABOXjySb/Y="
    },
    "aarch64-darwin": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.173.2/mirrord_mac_universal",
-      "hash": "sha256-mLy6bMpvLu9evv+sTYMG6FMUAvDg8J1XCF3mjfWMMWA="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.174.0/mirrord_mac_universal",
+      "hash": "sha256-k4JMnoG1GwSKz4Drw5BNa5lbsiZPdJzvEmVaQ0rLqGg="
    },
    "x86_64-darwin": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.173.2/mirrord_mac_universal",
-      "hash": "sha256-mLy6bMpvLu9evv+sTYMG6FMUAvDg8J1XCF3mjfWMMWA="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.174.0/mirrord_mac_universal",
+      "hash": "sha256-k4JMnoG1GwSKz4Drw5BNa5lbsiZPdJzvEmVaQ0rLqGg="
    }
  }
 }
@@ -2,7 +2,10 @@
  lib,
  stdenv,
  fetchFromGitHub,
+  cmake,
+  ninja,
  pkg-config,
+  boost,
  qt6Packages,
  mpv,
  gitUpdater,
@@ -10,18 +13,20 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "mpc-qt";
-  version = "24.12.1-flatpak";
+  version = "25.07";

  src = fetchFromGitHub {
    owner = "mpc-qt";
    repo = "mpc-qt";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-gn94kVs3Lbd+ggj4jTacHpmnVO2lH/QDhFk+hJC1N/c=";
+    hash = "sha256-apZR3PgU+Fq1whnWQHhmHPZKAZBKdrVCWaGfu+H7A4s=";
  };

  nativeBuildInputs = [
+    boost
+    ninja
+    cmake
    pkg-config
-    qt6Packages.qmake
    qt6Packages.qttools
    qt6Packages.wrapQtAppsHook
  ];
@@ -30,16 +35,8 @@ stdenv.mkDerivation (finalAttrs: {
    mpv
  ];

-  postPatch = ''
-    substituteInPlace lconvert.pri --replace "qtPrepareTool(LCONVERT, lconvert)" "qtPrepareTool(LCONVERT, lconvert, , , ${qt6Packages.qttools}/bin)"
-  '';
-
-  postConfigure = ''
-    substituteInPlace Makefile --replace ${qt6Packages.qtbase}/bin/lrelease ${qt6Packages.qttools.dev}/bin/lrelease
-  '';
-
-  qmakeFlags = [
-    "MPCQT_VERSION=${finalAttrs.version}"
+  cmakeFlags = [
+    "-DMPCQT_VERSION=${finalAttrs.version}"
  ];

  passthru.updateScript = gitUpdater { rev-prefix = "v"; };
@@ -21,97 +21,143 @@
  libglvnd,
  systemd,
  nix-update-script,
+  undmg,
+  makeWrapper,
 }:
-
-stdenv.mkDerivation (finalAttrs: {
+let
  pname = "nextcloud-talk-desktop";
  version = "2.0.3";

-  # Building from source would require building also building Server and Talk components
-  # See https://github.com/nextcloud/talk-desktop?tab=readme-ov-file#%EF%B8%8F-prerequisites
-  src = fetchzip {
-    url = "https://github.com/nextcloud-releases/talk-desktop/releases/download/v${finalAttrs.version}/Nextcloud.Talk-linux-x64.zip";
-    hash = "sha256-QKbg5vHLuxLpngrHom/odWw9RK43jhZsEg7Df5c7db0=";
-    stripRoot = false;
+  # Only x86_64-linux is supported with Darwin support being universal
+  sources = {
+    # Building from source would require building also building Server and Talk components
+    # See https://github.com/nextcloud/talk-desktop?tab=readme-ov-file#%EF%B8%8F-prerequisites
+    linux = fetchzip {
+      url = "https://github.com/nextcloud-releases/talk-desktop/releases/download/v${version}/Nextcloud.Talk-linux-x64.zip";
+      hash = "sha256-QKbg5vHLuxLpngrHom/odWw9RK43jhZsEg7Df5c7db0=";
+      stripRoot = false;
+    };
+    darwin = fetchurl {
+      url = "https://github.com/nextcloud-releases/talk-desktop/releases/download/v${version}/Nextcloud.Talk-macos-universal.dmg";
+      hash = "sha256-FgiUb2MNEqmbK4BphHQ7M2IeN7Vg1NQ9FR9UO4AfvNs=";
+    };
  };

-  icon = fetchurl {
-    url = "https://raw.githubusercontent.com/nextcloud/talk-desktop/refs/tags/v1.0.0/img/icons/icon.png";
-    hash = "sha256-DteSSuxIs0ukIJrvUO/3Mrh5F2GG5UAVvGRZUuZonkg=";
-  };
-
-  nativeBuildInputs = [
-    autoPatchelfHook
-    copyDesktopItems
-  ];
-
-  buildInputs = [
-    nss
-    cairo
-    alsa-lib
-    at-spi2-core
-    pango
-    libdrm
-    libxkbcommon
-    gtk3
-    vivaldi-ffmpeg-codecs
-    libgbm
-    libGL
-    libglvnd
-  ]
-  ++ (with xorg; [
-    libX11
-    libXcomposite
-    libXdamage
-    libXrandr
-    libXfixes
-    libXcursor
-  ]);
-
-  # Required to launch the application and proceed past the zygote_linux fork() process
-  # Fixes `Zygote could not fork`
-  runtimeDependencies = [ systemd ];
-
-  desktopItems = [
-    (makeDesktopItem {
-      type = "Application";
-      name = "nextcloud-talk-desktop";
-      desktopName = "Nextcloud Talk";
-      comment = finalAttrs.meta.description;
-      exec = finalAttrs.meta.mainProgram;
-      icon = "nextcloud-talk-desktop";
-      categories = [ "Chat" ];
-    })
-  ];
-
-  preInstall = ''
-    mkdir -p $out/bin
-    mkdir -p $out/opt
-
-    cp -r $src/* $out/opt/
-  '';
-
-  installPhase = ''
-    runHook preInstall
-
-    # Link the application in $out/bin away from contents of `preInstall`
-    ln -s "$out/opt/Nextcloud Talk-linux-x64/Nextcloud Talk" $out/bin/nextcloud-talk-desktop
-    mkdir -p $out/share/icons/hicolor/512x512/apps
-    cp $icon $out/share/icons/hicolor/512x512/apps/nextcloud-talk-desktop.png
-
-    runHook postInstall
-  '';
-
-  passthru.updateScript = nix-update-script { };
-
  meta = {
    description = "Nextcloud Talk Desktop Client";
    homepage = "https://github.com/nextcloud/talk-desktop";
-    changelog = "https://github.com/nextcloud/talk-desktop/blob/${finalAttrs.version}/CHANGELOG.md";
+    changelog = "https://github.com/nextcloud/talk-desktop/blob/${version}/CHANGELOG.md";
    license = lib.licenses.agpl3Only;
    maintainers = with lib.maintainers; [ kashw2 ];
-    mainProgram = "nextcloud-talk-desktop";
    sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
-    platforms = [ "x86_64-linux" ];
+    mainProgram = "nextcloud-talk-desktop";
  };
-})
+
+  linux = stdenv.mkDerivation (finalAttrs: {
+    inherit pname version;
+
+    src = sources.linux;
+
+    icon = fetchurl {
+      url = "https://raw.githubusercontent.com/nextcloud/talk-desktop/refs/tags/v${version}/img/icons/icon.png";
+      hash = "sha256-DteSSuxIs0ukIJrvUO/3Mrh5F2GG5UAVvGRZUuZonkg=";
+    };
+
+    nativeBuildInputs = [
+      autoPatchelfHook
+      copyDesktopItems
+    ];
+
+    buildInputs = [
+      nss
+      cairo
+      alsa-lib
+      at-spi2-core
+      pango
+      libdrm
+      libxkbcommon
+      gtk3
+      vivaldi-ffmpeg-codecs
+      libgbm
+      libGL
+      libglvnd
+    ]
+    ++ (with xorg; [
+      libX11
+      libXcomposite
+      libXdamage
+      libXrandr
+      libXfixes
+      libXcursor
+    ]);
+
+    # Required to launch the application and proceed past the zygote_linux fork() process
+    # Fixes `Zygote could not fork`
+    runtimeDependencies = [ systemd ];
+
+    desktopItems = [
+      (makeDesktopItem {
+        type = "Application";
+        name = "nextcloud-talk-desktop";
+        desktopName = "Nextcloud Talk";
+        comment = finalAttrs.meta.description;
+        exec = finalAttrs.meta.mainProgram;
+        icon = "nextcloud-talk-desktop";
+        categories = [ "Chat" ];
+      })
+    ];
+
+    preInstall = ''
+      mkdir -p $out/bin
+      mkdir -p $out/opt
+
+      cp -r $src/* $out/opt/
+    '';
+
+    installPhase = ''
+      runHook preInstall
+
+      # Link the application in $out/bin away from contents of `preInstall`
+      ln -s "$out/opt/Nextcloud Talk-linux-x64/Nextcloud Talk" $out/bin/nextcloud-talk-desktop
+      mkdir -p $out/share/icons/hicolor/512x512/apps
+      cp $icon $out/share/icons/hicolor/512x512/apps/nextcloud-talk-desktop.png
+
+      runHook postInstall
+    '';
+
+    passthru.updateScript = nix-update-script { };
+
+    meta = meta // {
+      platforms = lib.intersectLists lib.platforms.linux lib.platforms.x86_64;
+    };
+  });
+
+  darwin = stdenv.mkDerivation (finalAttrs: {
+    inherit pname version;
+
+    src = sources.darwin;
+
+    nativeBuildInputs = [
+      undmg
+      makeWrapper
+    ];
+
+    sourceRoot = ".";
+
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p $out/{Applications,bin}
+      mv Nextcloud\ Talk.app/Contents $out/Applications/
+
+      makeWrapper $out/Applications/Contents/MacOS/Nextcloud\ Talk $out/bin/nextcloud-talk-desktop
+
+      runHook postInstall
+    '';
+
+    meta = meta // {
+      platforms = lib.platforms.darwin;
+    };
+  });
+in
+if stdenv.hostPlatform.isDarwin then darwin else linux
@@ -1,22 +0,0 @@
-diff --git a/odoo/http.py b/odoo/http.py
-index f26dd52db235c..9689fc894b2b1 100644
--- a/odoo/http.py
-+++ b/odoo/http.py
-@@ -117,6 +117,7 @@
- import glob
- import hashlib
- import hmac
-+import importlib.metadata
- import inspect
- import json
- import logging
-@@ -256,7 +257,7 @@ def get_default_session():
-     'alias', 'host', 'methods',
- }
- 
-if parse_version(werkzeug.__version__) >= parse_version('2.0.2'):
-+if parse_version(importlib.metadata.version('werkzeug')) >= parse_version('2.0.2'):
-     # Werkzeug 2.0.2 adds the websocket option. If a websocket request
-     # (ws/wss) is trying to access an HTTP route, a WebsocketMismatch
-     # exception is raised. On the other hand, Werkzeug 0.16 does not
-
@@ -1,105 +0,0 @@
-{
-  lib,
-  fetchzip,
-  python311,
-  rtlcss,
-  wkhtmltopdf,
-  nixosTests,
-}:
-
-let
-  odoo_version = "16.0";
-  odoo_release = "20250506";
-  python = python311.override {
-    self = python;
-  };
-in
-python.pkgs.buildPythonApplication rec {
-  pname = "odoo";
-  version = "${odoo_version}.${odoo_release}";
-
-  format = "setuptools";
-
-  # latest release is at https://github.com/odoo/docker/blob/master/16.0/Dockerfile
-  src = fetchzip {
-    url = "https://nightly.odoo.com/${odoo_version}/nightly/src/odoo_${version}.zip";
-    name = "odoo-${version}";
-    hash = "sha256-dBqRZ3cf4/udP9hm+u9zhuUCkH176uG2NPAy5sujyNc="; # odoo
-  };
-
-  patches = [ ./fix-test.patch ];
-
-  makeWrapperArgs = [
-    "--prefix"
-    "PATH"
-    ":"
-    "${lib.makeBinPath [
-      wkhtmltopdf
-      rtlcss
-    ]}"
-  ];
-
-  propagatedBuildInputs = with python.pkgs; [
-    babel
-    chardet
-    cryptography
-    decorator
-    docutils
-    ebaysdk
-    freezegun
-    gevent
-    greenlet
-    idna
-    jinja2
-    libsass
-    lxml
-    lxml-html-clean
-    markupsafe
-    num2words
-    ofxparse
-    passlib
-    pillow
-    polib
-    psutil
-    psycopg2
-    pydot
-    pyopenssl
-    pypdf2
-    pyserial
-    python-dateutil
-    python-ldap
-    python-stdnum
-    pytz
-    pyusb
-    qrcode
-    reportlab
-    requests
-    urllib3
-    vobject
-    werkzeug
-    xlrd
-    xlsxwriter
-    xlwt
-    zeep
-
-    setuptools
-    mock
-  ];
-
-  # takes 5+ minutes and there are not files to strip
-  dontStrip = true;
-
-  passthru = {
-    updateScript = ./update.sh;
-    tests = {
-      inherit (nixosTests) odoo16;
-    };
-  };
-
-  meta = {
-    description = "Open Source ERP and CRM";
-    homepage = "https://www.odoo.com/";
-    license = lib.licenses.lgpl3Only;
-    maintainers = with lib.maintainers; [ mkg20001 ];
-  };
-}
@@ -1,32 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i bash -p curl gnused nix coreutils nix-prefetch
-# shellcheck shell=bash
-
-set -euo pipefail
-
-SCRIPT_DIR="$(dirname "${BASH_SOURCE[0]}")"
-PKG=$(basename "$SCRIPT_DIR")
-
-LATEST="18" # increment manually
-VERSION="${PKG/#odoo}"
-VERSION="${VERSION:-$LATEST}.0"
-
-RELEASE="$(
-    curl "https://nightly.odoo.com/$VERSION/nightly/src/" |
-        sed -nE 's/.*odoo_'"$VERSION"'.(20[0-9]{6}).tar.gz.*/\1/p' |
-        tail -n 1
-)"
-
-latestVersion="$VERSION.$RELEASE"
-currentVersion=$(nix-instantiate --eval -E "with import ./. {}; $PKG.version or (lib.getVersion $PKG)" | tr -d '"')
-
-if [[ "$currentVersion" == "$latestVersion" ]]; then
-    echo "$PKG is up-to-date: $currentVersion"
-    exit 0
-fi
-
-cd "$SCRIPT_DIR"
-
-sed -ri "s| hash.+ # odoo| hash = \"$(nix-prefetch -q fetchzip --option extra-experimental-features flakes --url "https://nightly.odoo.com/${VERSION}/nightly/src/odoo_${latestVersion}.zip")\"; # odoo|g" package.nix
-sed -ri "s|odoo_version = .+|odoo_version = \"$VERSION\";|" package.nix
-sed -ri "s|odoo_release = .+|odoo_release = \"$RELEASE\";|" package.nix
@@ -13,12 +13,12 @@
 }:
 let
  pname = "opencode";
-  version = "1.0.105";
+  version = "1.0.114";
  src = fetchFromGitHub {
    owner = "sst";
    repo = "opencode";
    tag = "v${version}";
-    hash = "sha256-mwiEOsJ2prQYzN0gd0+iEfelNt1qv+K7slbF2Rk9eng=";
+    hash = "sha256-Ng+6FAbqQBpqxet/09WLL+iOMwVrf2pfC5XdKdrCfEc=";
  };

  node_modules = stdenvNoCC.mkDerivation {
@@ -62,12 +62,7 @@ let
      runHook preInstall

      mkdir -p $out
-      while IFS= read -r dir; do
-        rel="''${dir#./}"
-        dest="$out/$rel"
-        mkdir -p "$(dirname "$dest")"
-        cp -R "$dir" "$dest"
-      done < <(find . -type d -name node_modules -prune | sort)
+      find . -type d -name node_modules -exec cp -R --parents {} $out \;

      runHook postInstall
    '';
@@ -75,7 +70,7 @@ let
    # NOTE: Required else we get errors that our fixed-output derivation references store paths
    dontFixup = true;

-    outputHash = "sha256-3N7iWxc5vt81EhyTDWYHMVTZ1KbLz1y4wzSYJt5fQCE=";
+    outputHash = "sha256-BjaGENHexbcIwo2cEaMFM4IoxtUVaOsjizX5KaWfZ+k=";
    outputHashAlgo = "sha256";
    outputHashMode = "recursive";
  };
@@ -3,7 +3,7 @@
  rustPlatform,
  fetchFromGitHub,
  pkg-config,
-  ffmpeg,
+  ffmpeg_7,
  vulkan-loader,
  versionCheckHook,
  nix-update-script,
@@ -28,7 +28,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
  ];

  buildInputs = [
-    ffmpeg
+    ffmpeg_7
    vulkan-loader
  ];

@@ -21,13 +21,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "pantum-driver";
-  version = "1.1.123";
+  version = "1.1.167";

  src = fetchzip {
-    url = "https://github.com/ArticExploit/pantum-driver/releases/download/${version}/Pantum.Ubuntu.Driver.V${
+    url = "https://github.com/osguot/pantum-universal-driver/releases/download/release/Pantum.Linux.Driver.V${
      builtins.replaceStrings [ "." ] [ "_" ] version
    }.zip";
-    hash = "sha256-TUk6CTnWlSvyG8MOpDRhg/eblAo6X/MDUFOiWuOuro0=";
+    hash = "sha256-0RyCgU00ZwGwcUhCkod971noVB7G10xnbH64/AdIFMA=";
  };

  buildInputs = [
@@ -77,8 +77,11 @@ stdenv.mkDerivation (finalAttrs: {
    runHook postInstall
  '';

-  passthru.settingsTemplate = ./pihole.toml;
-  passthru.tests = nixosTests.pihole-ftl;
+  passthru = {
+    settingsTemplate = ./pihole.toml;
+
+    tests = nixosTests.pihole-ftl;
+  };

  meta = {
    description = "Pi-hole FTL engine";
@@ -30,18 +30,18 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "pipeline";
-  version = "3.0.1";
+  version = "3.1.1";

  src = fetchFromGitLab {
    owner = "schmiddi-on-mobile";
    repo = "pipeline";
    rev = finalAttrs.version;
-    hash = "sha256-AF34En1MKlwyOd4zKQjGAeb/c6ElJipreBTCJhbbJuI=";
+    hash = "sha256-iMBdyjN6fMDOSE110tA9i6+D4UaNGG2aBoq+4s0YyJI=";
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
    inherit (finalAttrs) src;
-    hash = "sha256-oO0c6DMmEmeP7Q2LoTDTNeEHUgRT0c3cJnZBVo2cX1U=";
+    hash = "sha256-w+q90i6FQRPFceniUfwouU2p673O4sVnsRfowCu2fWY=";
  };

  nativeBuildInputs = [
@@ -7,16 +7,16 @@

 buildGoModule rec {
  pname = "pocketbase";
-  version = "0.33.0";
+  version = "0.34.0";

  src = fetchFromGitHub {
    owner = "pocketbase";
    repo = "pocketbase";
    rev = "v${version}";
-    hash = "sha256-j7Df+pl1pzSUQAbglnrAB/kat4TMFdm2ch2ZNeJDi68=";
+    hash = "sha256-kMj/JXPBsu30K0P7rCnAqb8xBTmBctGvVucDVwgKjjY=";
  };

-  vendorHash = "sha256-KhHW79vON4Kkw7TbNObKQtftBAlQepyFMpUjrRhUQh8=";
+  vendorHash = "sha256-Ri9fgCMfWqc/TBteSm8gAUkjserhfg4ZZ8CpofQJOdI=";

  # This is the released subpackage from upstream repo
  subPackages = [ "examples/base" ];
@@ -4,7 +4,7 @@
  fetchFromGitHub,
  makeBinaryWrapper,
  copyDesktopItems,
-  electron_38,
+  electron_39,
  nodejs,
  pnpm_10,
  makeDesktopItem,
@@ -19,12 +19,12 @@
 }:

 let
-  electron = electron_38;
+  electron = electron_39;
  appName = "Podman Desktop";
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "podman-desktop";
-  version = "1.22.1";
+  version = "1.23.1";

  passthru.updateScript = _experimental-update-script-combinators.sequence [
    (nix-update-script { })
@@ -57,13 +57,13 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "containers";
    repo = "podman-desktop";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-+YM1fiY2bH5nY1L/xWjMbWe5lH1LfyKW47OzCROB3nE=";
+    hash = "sha256-08boCPsuT09OileZUWhB8awXWHrlJzoER2Bx0WXeOHU=";
  };

  pnpmDeps = pnpm_10.fetchDeps {
    inherit (finalAttrs) pname version src;
-    fetcherVersion = 1;
-    hash = "sha256-2Cja6CQxjOlxjhsjGQ5C9a/C/2RfzKdvtRCKO7VztwQ=";
+    fetcherVersion = 2;
+    hash = "sha256-nBjAmXzjR0qGCM91UAonQKP0NG7+DXImueSbhbnMK/k=";
  };

  patches = [
@@ -121,6 +121,8 @@ stdenv.mkDerivation (finalAttrs: {
        wrapProgram "$out/Applications/${appName}.app/Contents/MacOS/${appName}" \
          ${commonWrapperArgs}
      ''
+      # Enforce X11 to avoid the Wayland dashboard issue.
+      # Revisit this once issue https://github.com/podman-desktop/podman-desktop/issues/14388 is resolved.
      + lib.optionalString (!stdenv.hostPlatform.isDarwin) ''
        mkdir -p "$out/share/lib/podman-desktop"
        cp -r dist/*-unpacked/{locales,resources{,.pak}} "$out/share/lib/podman-desktop"
@@ -129,7 +131,7 @@ stdenv.mkDerivation (finalAttrs: {

        makeWrapper '${electron}/bin/electron' "$out/bin/podman-desktop" \
          --add-flags "$out/share/lib/podman-desktop/resources/app.asar" \
-          --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime=true}}" \
+          --set XDG_SESSION_TYPE 'x11' \
          ${commonWrapperArgs} \
          --inherit-argv0
      ''
@@ -35,6 +35,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    # FIX: tracking on https://github.com/facebook/pyrefly/issues/1667
    "--skip=test::lsp::lsp_interaction::configuration::test_pythonpath_change"
    "--skip=test::lsp::lsp_interaction::configuration::test_workspace_pythonpath_ignored_when_set_in_config_file"
+    "--skip=test::lsp::lsp_interaction::notebook_sync::test_notebook_publish_diagnostics"
  ];

  # requires unstable rust features
@@ -5,16 +5,16 @@
 }:
 buildGoModule rec {
  pname = "tfswitch";
-  version = "1.9.0";
+  version = "1.10.0";

  src = fetchFromGitHub {
    owner = "warrensbox";
    repo = "terraform-switcher";
    rev = "v${version}";
-    sha256 = "sha256-0yK4/eQ2WNnNopA2dMbvMr5mv3w9vQhfQuJExQM2gvc=";
+    sha256 = "sha256-c1ueznf3ihsZeLmhD35NZ3pvK79LaonIymu2/2KwbZM=";
  };

-  vendorHash = "sha256-4qZ5egtNN0O+ESkvavprNd6Xtxh/eyD5INolqKXo674=";
+  vendorHash = "sha256-MF+P+t+8xVRB4AicuVSqs1VEmBBo180bz2IdHi58vWc=";

  # Disable tests since it requires network access and relies on the
  # presence of release.hashicorp.com
@@ -20,7 +20,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "tmux";
-  version = "3.5a";
+  version = "3.6";

  outputs = [
    "out"
@@ -31,7 +31,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "tmux";
    repo = "tmux";
    rev = finalAttrs.version;
-    hash = "sha256-Z9XHpyh4Y6iBI4+SfFBCGA8huFJpRFZy9nEB7+WQVJE=";
+    hash = "sha256-jIHnwidzqt+uDDFz8UVHihTgHJybbVg3pQvzlMzOXPE=";
  };

  nativeBuildInputs = [
@@ -6,13 +6,13 @@

 buildGoModule rec {
  pname = "trickest-cli";
-  version = "2.1.7";
+  version = "2.1.8";

  src = fetchFromGitHub {
    owner = "trickest";
    repo = "trickest-cli";
    tag = "v${version}";
-    hash = "sha256-LDroWDGTYUFtkZkooWCEL59f+iu8izUcSyqr3Jzch7o=";
+    hash = "sha256-AAaVwdvhQZPIXLs2ec8UtVWbcjb3CPI6V+zzkYe6KK4=";
  };

  vendorHash = "sha256-Ae0fNzYOAeCMrNFVhw4VvG/BkOMcguIMiBvLGt7wxEo=";
@@ -68,7 +68,7 @@ stdenv.mkDerivation (finalAttrs: {
    homepage = "https://wiki.xxiivv.com/site/uxn.html";
    description = "Assembler and emulator for the Uxn stack machine";
    license = lib.licenses.mit;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ jleightcap ];
    mainProgram = "uxnemu";
    inherit (SDL2.meta) platforms;
  };
@@ -0,0 +1,37 @@
+{
+  lib,
+  stdenv,
+  fetchFromSourcehut,
+  xorg,
+}:
+
+stdenv.mkDerivation {
+  pname = "uxn11";
+  version = "1.0-unstable-2025-09-27";
+
+  src = fetchFromSourcehut {
+    owner = "~rabbits";
+    repo = "uxn11";
+    rev = "3c16d2acecfe4784dfe75de520e6229fa809b634";
+    hash = "sha256-NKFaj/7V8S+W7c5v4uzPT9hpNHAmP/J7LGR6/0lQ3ds=";
+  };
+
+  buildInputs = [
+    xorg.libX11
+  ];
+
+  makeFlags = [ "PREFIX=$(out)" ];
+
+  strictDeps = true;
+
+  doCheck = true;
+
+  meta = {
+    homepage = "https://git.sr.ht/~rabbits/uxn11";
+    description = "X11 and standalone text-mode emulators for the Uxn virtual machine";
+    license = lib.licenses.mit;
+    mainProgram = "uxn11";
+    maintainers = with lib.maintainers; [ jleightcap ];
+    inherit (xorg.libX11.meta) platforms;
+  };
+}
@@ -3,66 +3,71 @@
  stdenv,
  fetchFromGitHub,
  nix-update-script,
+  writeText,
+
  cmake,
  pkg-config,
-  check,
-  openssl,
  python3,
-  subunit,
-  mbedtls_2,
+
+  # optional dependencies
+  withStackTraces ? true,
+  libiberty,
+  libunwind,
+
+  withOpenssl ? true, # tls/quic/wireguard plugins
+  openssl,
+
+  withLibPcap ? true, # bpf_trace_filter plugin
  libpcap,
+
+  withNetlinkLibs ? true, # linux-cp plugin
  libnl,
  libmnl,
-  libelf,
+
+  withRdma ? true,
+  rdma-core,
+
+  withDpdk ? true,
  dpdk,
  jansson,
-  zlib,
-  rdma-core,
-  libbpf,
-  xdp-tools,
-  writeText,
-  enableDpdk ? true,
-  enableRdma ? true,
-  enableAfXdp ? true,
-}:

+  withAfXdp ? true,
+  xdp-tools,
+  libbpf,
+  # Support for all network cards, but slower than native XDP
+  enableAfXdpSkbMode ? false,
+
+  libelf,
+  zlib,
+}:
 let
  dpdk' = dpdk.overrideAttrs (old: {
    mesonFlags = old.mesonFlags ++ [ "-Denable_driver_sdk=true" ];
  });

-  rdma-core' = rdma-core.overrideAttrs (old: {
-    cmakeFlags = old.cmakeFlags ++ [
-      "-DENABLE_STATIC=1"
-      "-DBUILD_SHARED_LIBS:BOOL=false"
-    ];
-  });
-
-  # in 25.02 only ID seems to be of interest, so keep it simple
-  os-release-fake = writeText "os-release-fake" ''
-    ID=nixos
-  '';
+  # >=25.02 uses /etc/os-release, so we substitute it
+  osRelease = writeText "os-release" "ID=nixos";
 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "vpp";
-  version = "25.06";
+  version = "25.10";

  src = fetchFromGitHub {
    owner = "FDio";
    repo = "vpp";
-    rev = "v${version}";
-    hash = "sha256-BuHKPQA4qHoADqBg2IztlzUMpbvYKK5uH7ktChSW5vk=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-J+aJXzq9jKzcFKpUNBskX3KccwKtZhK+m8NTbrGjsXw=";
  };

  postPatch = ''
    patchShebangs scripts/
    substituteInPlace pkg/CMakeLists.txt \
-      --replace-fail "/etc/os-release" "${os-release-fake}"
+      --replace-fail "/etc/os-release" "${osRelease}"
  '';

  preConfigure = ''
-    echo "${version}-nixos" > scripts/.version
-    scripts/version
+    echo "${finalAttrs.version}-nixos" > scripts/.version
+    ./scripts/version
  '';

  postConfigure = ''
@@ -70,7 +75,7 @@ stdenv.mkDerivation rec {
    patchShebangs ../vpp-api/
  '';

-  sourceRoot = "${src.name}/src";
+  sourceRoot = "${finalAttrs.src.name}/src";

  enableParallelBuilding = true;
  env.NIX_CFLAGS_COMPILE = "-Wno-error -Wno-array-bounds -Wno-maybe-uninitialized";
@@ -78,55 +83,57 @@ stdenv.mkDerivation rec {
  cmakeFlags = [
    "-DVPP_PLATFORM=default"
    "-DVPP_LIBRARY_DIR=lib"
+    "-DVPP_BUILD_PYTHON_API=false" # fails to build as of 25.10
  ]
-  ++ lib.optional enableDpdk "-DVPP_USE_SYSTEM_DPDK=ON";
+  ++ lib.optional withDpdk "-DVPP_USE_SYSTEM_DPDK=ON";

  nativeBuildInputs = [
    cmake
    pkg-config
-  ]
-  ++ lib.optional enableDpdk dpdk'
-  ++ lib.optional enableRdma rdma-core'.dev;
-
-  buildInputs = [
-    check
-    openssl
    (python3.withPackages (ps: [ ps.ply ]))
-
-    subunit # vapi tests
-    mbedtls_2 # tlsmbed plugin
-    libpcap # bpf_trace_filter plugin
-
-    # linux-cp plugin
-    libnl
-    libmnl
-  ]
-  ++ lib.optionals enableDpdk [
-    # dpdk plugin
-    libelf
-    jansson
-    zlib
-  ]
-  ++ lib.optionals enableAfXdp [
-    # af_xdp plugin
-    libelf
-    libbpf
-    xdp-tools
-    zlib
  ];

-  patches = lib.optionals enableAfXdp [
-    ./use-dynamic-libxdp-libbpf.patch
-  ];
+  buildInputs =
+    lib.optionals withStackTraces [
+      libiberty
+      libunwind
+    ]
+    ++ lib.optional withOpenssl openssl
+    ++ lib.optional withLibPcap libpcap
+    ++ lib.optionals withNetlinkLibs [
+      libnl
+      libmnl
+    ]
+    ++ lib.optionals withDpdk [
+      dpdk'
+      jansson
+      libelf
+      zlib
+    ]
+    ++ lib.optional withRdma rdma-core
+    ++ lib.optionals withAfXdp [
+      libelf
+      libbpf
+      xdp-tools
+      zlib
+    ];
+
+  strictDeps = true;
+
+  patches = [
+    # VPP links to static RDMA/XDP by default
+    ./use-dynamic-libs.patch
+  ]
+  ++ lib.optional enableAfXdpSkbMode ./xdp-skb-mode.patch;

  passthru.updateScript = nix-update-script { };

  meta = {
    description = "Fast, scalable layer 2-4 multi-platform network stack running in user space";
-    homepage = "https://s3-docs.fd.io/vpp/${version}/";
-    license = [ lib.licenses.asl20 ];
-    maintainers = with lib.maintainers; [ azey7f ];
-    mainProgram = "vpp";
+    homepage = "https://s3-docs.fd.io/vpp/${finalAttrs.version}/";
+    license = lib.licenses.asl20;
    platforms = lib.platforms.linux;
+    mainProgram = "vpp";
+    maintainers = with lib.maintainers; [ azey7f ];
  };
-}
+})
@@ -11,3 +11,17 @@
 vpp_plugin_find_library(af_xdp ELF_LIB elf)
 vpp_plugin_find_library(af_xdp Z_LIB z)
 if (NOT XDP_LIB OR NOT BPF_LIB OR NOT ELF_LIB OR NOT Z_LIB)
+
+--- a/plugins/rdma/CMakeLists.txt
+++ b/plugins/rdma/CMakeLists.txt
+@@ -18,8 +18,8 @@ if (NOT IBVERBS_INCLUDE_DIR)
+   return()
+ endif()
+ 
+-vpp_plugin_find_library(rdma IBVERBS_LIB libibverbs.a)
+-vpp_plugin_find_library(rdma MLX5_LIB libmlx5.a)
+vpp_plugin_find_library(rdma IBVERBS_LIB ibverbs)
+vpp_plugin_find_library(rdma MLX5_LIB mlx5)
+ 
+ if (NOT IBVERBS_LIB OR NOT MLX5_LIB)
+   message(WARNING "rdma plugin - ibverbs not found - rdma plugin disabled")
@@ -0,0 +1,10 @@
+--- a/plugins/af_xdp/device.c
+++ b/plugins/af_xdp/device.c
+@@ -330,6 +330,7 @@
+   sock_config.rx_size = args->rxq_size;
+   sock_config.tx_size = args->txq_size;
+   sock_config.bind_flags = XDP_USE_NEED_WAKEUP;
+  sock_config.xdp_flags = XDP_FLAGS_SKB_MODE;
+   switch (args->mode)
+     {
+     case AF_XDP_MODE_AUTO:
@@ -0,0 +1,75 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  makeWrapper,
+  versionCheckHook,
+  bash,
+  gnuplot,
+  gitUpdater,
+}:
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "vtebench";
+  version = "0.3.1";
+
+  src = fetchFromGitHub {
+    owner = "alacritty";
+    repo = "vtebench";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-2uuH7JTilKC+yVY+sMG0lMzLFzRefqEyM/L5gnMDIJw=";
+  };
+  cargoHash = "sha256-3PQA5rw5eiqHfQCZPAgN7FF/mPK2YeZd3TT4SCnBp3I=";
+
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ bash ];
+  strictDeps = true;
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  postInstall = ''
+    mkdir -p $out/share/vtebench
+    cp -r benchmarks gnuplot{,_summary}.sh -t $out/share/vtebench
+  '';
+
+  postFixup = ''
+    # The benchmarks and gnuplot helpers are all shell scripts
+    patchShebangs $out/share/vtebench
+
+    # vtebench tries to look for the benchmarks in the `benchmarks` folder
+    # in the current directory by default, but we patch it here to use
+    # the packaged benchmarks instead
+    wrapProgram $out/bin/vtebench \
+      --add-flags "--benchmarks $out/share/vtebench/benchmarks"
+
+    # Neither gnuplot wrapper script is included with vtebench itself,
+    # so we have to make them available as wrapped binaries to avoid users
+    # having to obtain them on their own
+    makeWrapper $out/share/vtebench/gnuplot.sh $out/bin/vtebench-gnuplot \
+      --suffix PATH : ${lib.makeBinPath [ gnuplot ]}
+    makeWrapper $out/share/vtebench/gnuplot_summary.sh $out/bin/vtebench-gnuplot-summary \
+      --suffix PATH : ${lib.makeBinPath [ gnuplot ]}
+  '';
+
+  passthru.updateScript = gitUpdater { rev-prefix = "v"; };
+
+  meta = {
+    description = "Generate benchmarks for terminal emulators";
+    longDescription = ''
+      A tool for benchmarking terminal emulator PTY read performance.
+
+      The `vtebench` binary has been patched to use the default benchmarks
+      automatically. Run `vtebench-gnuplot` or `vtebench-gnuplot-summary`
+      to run the `gnuplot.sh` and `gnuplot_summary.sh` scripts respectively.
+    '';
+    homepage = "https://github.com/alacritty/vtebench";
+    license = with lib.licenses; [
+      asl20
+      mit
+    ];
+    maintainers = with lib.maintainers; [
+      pluiedev
+    ];
+    mainProgram = "vtebench";
+  };
+})
@@ -126,6 +126,47 @@ let

    meta.license = lib.licenses.unfree;
  };
+
+  # Fix for Wayland crash when XSetInputFocus is called
+  wemeet-x11-fix = stdenv.mkDerivation {
+    pname = "wemeet-x11-fix";
+    version = "0-unstable-2025-11-07";
+
+    src = ./wemeet-x11-fix.c;
+
+    dontUnpack = true;
+    dontWrapQtApps = true;
+
+    nativeBuildInputs = [ pkg-config ];
+
+    buildInputs = [
+      xorg.libX11
+    ];
+
+    buildPhase = ''
+      runHook preBuild
+
+      $CC $CFLAGS -Wall -Wextra -fPIC -shared \
+        -o libwemeet-x11-fix.so $src \
+        -ldl -lX11
+
+      runHook postBuild
+    '';
+
+    installPhase = ''
+      runHook preInstall
+
+      install -Dm755 ./libwemeet-x11-fix.so $out/lib/libwemeet-x11-fix.so
+
+      runHook postInstall
+    '';
+
+    meta = {
+      description = "Fix for wemeet Wayland XSetInputFocus crash";
+      license = lib.licenses.mit;
+    };
+  };
+
  selectSystem =
    attrs:
    attrs.${stdenv.hostPlatform.system}
@@ -237,7 +278,7 @@ stdenv.mkDerivation {
        "--prefix QT_PLUGIN_PATH : $out/app/wemeet/plugins"
      ];
      commonWrapperArgs = baseWrapperArgs ++ [
-        "--prefix LD_PRELOAD : ${libwemeetwrap}/lib/libwemeetwrap.so"
+        "--prefix LD_PRELOAD : ${libwemeetwrap}/lib/libwemeetwrap.so:${wemeet-x11-fix}/lib/libwemeet-x11-fix.so"
        "--run 'if [[ $XDG_SESSION_TYPE == \"wayland\" ]]; then export LD_PRELOAD=${wemeet-wayland-screenshare}/lib/wemeet/libhook.so\${LD_PRELOAD:+:$LD_PRELOAD}; fi'"
      ];
      xwaylandWrapperArgs = baseWrapperArgs ++ [
@@ -0,0 +1,54 @@
+/*
+ * wemeet-x11-fix.c
+ *
+ * This library intercepts X11 functions that cause crashes in Wayland mode.
+ * Specifically, it prevents XSetInputFocus from crashing when called in
+ * pure Wayland environment.
+ *
+ * Compile: gcc -shared -fPIC -o libwemeet-x11-fix.so wemeet-x11-fix.c -ldl
+ * Usage: LD_PRELOAD=./libwemeet-x11-fix.so wemeet
+ */
+
+#define _GNU_SOURCE
+#include <dlfcn.h>
+#include <X11/Xlib.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+// Original XSetInputFocus function pointer
+static int (*orig_XSetInputFocus)(Display*, Window, int, Time) = NULL;
+
+// Hooked XSetInputFocus that safely handles Wayland environment
+int XSetInputFocus(Display *display, Window focus, int revert_to, Time time) {
+    // Check if we're in a Wayland session
+    const char *session_type = getenv("XDG_SESSION_TYPE");
+    const char *wayland_display = getenv("WAYLAND_DISPLAY");
+
+    if ((session_type && strcmp(session_type, "wayland") == 0) || wayland_display) {
+        // In pure Wayland, XSetInputFocus can crash due to invalid X11 display
+        // Just return success and skip the actual call
+        fprintf(stderr, "wemeet-x11-fix: Blocking XSetInputFocus in Wayland mode\n");
+        return Success;
+    }
+
+    // Load original function if not already loaded
+    if (!orig_XSetInputFocus) {
+        orig_XSetInputFocus = dlsym(RTLD_NEXT, "XSetInputFocus");
+        if (!orig_XSetInputFocus) {
+            fprintf(stderr, "wemeet-x11-fix: Failed to load XSetInputFocus\n");
+            return BadWindow;
+        }
+    }
+
+    // Call original function in X11 mode
+    return orig_XSetInputFocus(display, focus, revert_to, time);
+}
+
+// Also intercept _XGetRequest to add error handling
+static Status (*orig_XGetRequest)(Display*,  _Xconst char*, size_t, int) = NULL;
+
+__attribute__((constructor))
+static void init_x11_fix(void) {
+    fprintf(stderr, "wemeet-x11-fix: Loaded X11 compatibility fix for Wayland\n");
+}
@@ -8,6 +8,7 @@
  SDL2,
  wget,
  which,
+  ffmpeg,
  autoAddDriverRunpath,
  makeWrapper,
  nix-update-script,
@@ -29,10 +30,13 @@
  vulkan-loader,

  withSDL ? true,
+
+  withFFmpegSupport ? false,
 }:

 assert metalSupport -> stdenv.hostPlatform.isDarwin;
 assert coreMLSupport -> stdenv.hostPlatform.isDarwin;
+assert withFFmpegSupport -> stdenv.hostPlatform.isLinux;

 let
  # It's necessary to consistently use backendStdenv when building with CUDA support,
@@ -108,6 +112,7 @@ effectiveStdenv.mkDerivation (finalAttrs: {

  buildInputs =
    optional withSDL SDL2
+    ++ optional withFFmpegSupport ffmpeg
    ++ optionals cudaSupport cudaBuildInputs
    ++ optionals rocmSupport rocmBuildInputs
    ++ optionals vulkanSupport vulkanBuildInputs;
@@ -122,6 +127,9 @@ effectiveStdenv.mkDerivation (finalAttrs: {
    (cmakeBool "GGML_NATIVE" false)
    (cmakeBool "BUILD_SHARED_LIBS" (!effectiveStdenv.hostPlatform.isStatic))
  ]
+  ++ optionals effectiveStdenv.hostPlatform.isLinux [
+    (cmakeBool "WHISPER_FFMPEG" withFFmpegSupport)
+  ]
  ++ optionals (effectiveStdenv.hostPlatform.isx86 && !effectiveStdenv.hostPlatform.isStatic) [
    (cmakeBool "GGML_BACKEND_DL" true)
    (cmakeBool "GGML_CPU_ALL_VARIANTS" true)
@@ -156,6 +164,10 @@ effectiveStdenv.mkDerivation (finalAttrs: {

    wrapProgram "$out/bin/whisper-cpp-download-ggml-model" \
      --prefix PATH : ${lib.makeBinPath [ wget ]}
+  ''
+  + lib.optionalString withFFmpegSupport ''
+    wrapProgram "$out/bin/whisper-server" \
+      --prefix PATH : ${lib.makeBinPath [ ffmpeg ]}
  '';

  requiredSystemFeatures = optionals rocmSupport [ "big-parallel" ]; # rocmSupport multiplies build time by the number of GPU targets, which takes arround 30 minutes on a 16-cores system to build
@@ -9,13 +9,13 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "xapp-symbolic-icons";
-  version = "1.0.2";
+  version = "1.0.4";

  src = fetchFromGitHub {
    owner = "xapp-project";
    repo = "xapp-symbolic-icons";
    tag = finalAttrs.version;
-    hash = "sha256-Z5edMCjw1/LO0+Ms5KCfFJ/iAANO2MihVZmLcJd5d3A=";
+    hash = "sha256-W5sgzy/2N7Nz1L0uUGCYtocbRIa3zxqMJy/aZ4JcxEs=";
  };

  nativeBuildInputs = [
@@ -27,20 +27,19 @@
  lightdm,
  gdk-pixbuf,
  dbus,
-  accountsservice,
  wayland-scanner,
  wrapGAppsHook3,
 }:

 stdenv.mkDerivation rec {
  pname = "elementary-greeter";
-  version = "8.1.0";
+  version = "8.1.1";

  src = fetchFromGitHub {
    owner = "elementary";
    repo = "greeter";
    tag = version;
-    hash = "sha256-lOk5H1uuaf2Q+z+hRLyhtKAHq+3ibtBzWI7r87KpKgQ=";
+    hash = "sha256-eoZ4WkIUesWTFipC6ji1QdU0dy9iMGCbQSkI74c0VRA=";
  };

  patches = [
@@ -64,7 +63,6 @@ stdenv.mkDerivation rec {
  ];

  buildInputs = [
-    accountsservice
    elementary-icon-theme
    elementary-settings-daemon
    gala # for io.elementary.desktop.background
@@ -107,13 +105,8 @@ stdenv.mkDerivation rec {
  '';

  postFixup = ''
-    # Use NixOS default wallpaper
-    substituteInPlace $out/etc/lightdm/io.elementary.greeter.conf \
-      --replace "#default-wallpaper=/usr/share/backgrounds/elementaryos-default" \
-      "default-wallpaper=${nixos-artwork.wallpapers.simple-dark-gray.gnomeFilePath}"
-
    substituteInPlace $out/share/xgreeters/io.elementary.greeter.desktop \
-      --replace "Exec=io.elementary.greeter" "Exec=$out/bin/io.elementary.greeter"
+      --replace-fail "Exec=io.elementary.greeter" "Exec=$out/bin/io.elementary.greeter"
  '';

  passthru = {
@@ -21,13 +21,13 @@

 stdenv.mkDerivation rec {
  pname = "elementary-onboarding";
-  version = "8.0.3";
+  version = "8.0.4";

  src = fetchFromGitHub {
    owner = "elementary";
    repo = "onboarding";
    rev = version;
-    sha256 = "sha256-e8eYBGQ+qTXsp+E3l0g5UI1nYD75z0ibTtzm0WbqlU4=";
+    sha256 = "sha256-d/8kVAvEUKNlpXRsKQrA0LCJetut2MlQlLq7MgIKlhk=";
  };

  nativeBuildInputs = [
@@ -18,13 +18,13 @@

 stdenv.mkDerivation rec {
  pname = "wingpanel-indicator-network";
-  version = "8.0.0";
+  version = "8.0.1";

  src = fetchFromGitHub {
    owner = "elementary";
    repo = "wingpanel-indicator-network";
-    rev = version;
-    sha256 = "sha256-7zp/GwM+aSQie82asX6yFPSPUxtzeyxCwdr8DWc0LQk=";
+    tag = version;
+    hash = "sha256-tmtd+lV/7aofH1xsYy5oG82HwEE1TyzP0ZP6nGY0prA=";
  };

  nativeBuildInputs = [
@@ -18,13 +18,13 @@

 stdenv.mkDerivation rec {
  pname = "elementary-notifications";
-  version = "8.1.1";
+  version = "8.1.2";

  src = fetchFromGitHub {
    owner = "elementary";
    repo = "notifications";
    tag = version;
-    hash = "sha256-V884jv7bleDMsuZDkodyeNBhStIoNPNxfT6mz1YjHXE=";
+    hash = "sha256-qod76RSsCO9NvjnYTLRW6P1UyR1K6Uu9fEjU2WgHUWk=";
  };

  strictDeps = true;
@@ -15,6 +15,7 @@
  geoclue2,
  gexiv2,
  glib,
+  gnome-settings-daemon,
  gobject-introspection,
  gtk3,
  granite,
@@ -26,13 +27,13 @@

 stdenv.mkDerivation rec {
  pname = "elementary-settings-daemon";
-  version = "8.3.1";
+  version = "8.4.0";

  src = fetchFromGitHub {
    owner = "elementary";
    repo = "settings-daemon";
    rev = version;
-    sha256 = "sha256-bYwgxUrPMDaxv/Vv+DuMUzOT1/GRcvNHZW+fjiN5Kdo=";
+    sha256 = "sha256-VdvwrkafZJ0+z2MYWT83POdo8dZrSAOL5RhAiwGEc2g=";
  };

  nativeBuildInputs = [
@@ -53,6 +54,7 @@ stdenv.mkDerivation rec {
    geoclue2
    gexiv2
    glib
+    gnome-settings-daemon # org.gnome.settings-daemon.* gschema
    gtk3
    granite
    libgee
@@ -249,4 +249,8 @@ in
    aspnetcore
    ;

+  packages = lib.recurseIntoAttrs (
+    # recursion can't handle . in the attribute names
+    lib.genAttrs' packages (p: lib.nameValuePair (lib.replaceString "." "-" p.pname) p)
+  );
 }
@@ -3,33 +3,36 @@
  lib,
  fetchFromGitHub,
  unstableGitUpdater,
-  dosbox,

  # Docs cause an immense increase in build time, up to 2 additional hours
  withDocs ? false,
+  dosbox,
+  mesa,
  ghostscript,
-  withGUI ? false,
+
+  # GUI tools aren't ported to non-MS platforms, building them usually just wastes time
+  withGUI ? stdenv.hostPlatform.isWindows,
 }:

-stdenv.mkDerivation rec {
-  pname = "${passthru.prettyName}-unwrapped";
+stdenv.mkDerivation (finalAttrs: {
+  pname = "${finalAttrs.passthru.prettyName}-unwrapped";
  # nixpkgs-update: no auto update
-  version = "0-unstable-2025-05-07";
+  version = "0-unstable-2025-11-15";

  src = fetchFromGitHub {
    owner = "open-watcom";
    repo = "open-watcom-v2";
-    rev = "b168de07a7c32ad82b77dd56671b6a51a11dab70";
-    hash = "sha256-9NNJcDHxOo+NKZraGqsHqK5whO3nL0QTeh+imzhThTg=";
+    rev = "fe2ddbd2e5833a85d9ccd3937b304f3f41e44f98";
+    hash = "sha256-jv7d5DopGZDnVFQX/t0D9cZSTwgMvcb4kqCnLJSWmNI=";
  };

  postPatch = ''
    patchShebangs *.sh
-
-    for dateSource in bld/wipfc/configure; do
-      substituteInPlace $dateSource \
-        --replace-fail '`date ' '`date -ud "@$SOURCE_DATE_EPOCH" '
-    done
+  ''
+  # Patch references to current time & date into SOURCE_DATE_EPOCH-respecting ones
+  + ''
+    substituteInPlace bld/wipfc/configure \
+      --replace-fail '`date ' '`date -ud "@$SOURCE_DATE_EPOCH" '

    substituteInPlace bld/watcom/h/banner.h \
      --replace-fail '__DATE__' "\"$(date -ud "@$SOURCE_DATE_EPOCH" +'%b %d %Y')\"" \
@@ -38,29 +41,40 @@ stdenv.mkDerivation rec {
    substituteInPlace build/makeinit \
      --replace-fail '$+$(%__CYEAR__)$-' "$(date -ud "@$SOURCE_DATE_EPOCH" +'%Y')"
  ''
+  # (SDL? DOSBox?) needs OpenGL now, and that doesn't seem to play nicely anymore with the dummy driver
+  + ''
+    substituteInPlace build/mif/wgmlcmd.mif \
+      --replace-fail 'SDL_VIDEODRIVER=dummy' 'SDL_VIDEODRIVER=offscreen'
+  ''
  + lib.optionalString (!stdenv.hostPlatform.isDarwin) ''
    substituteInPlace build/mif/local.mif \
      --replace-fail '-static' ""
  '';

-  nativeBuildInputs = [
-    dosbox
-  ]
-  ++ lib.optionals withDocs [
+  nativeBuildInputs = lib.optionals withDocs [
+    dosbox # running prebuilt WGML tool to create docs
    ghostscript
+    mesa.llvmpipeHook # DOSBox doesn't seem to launch without OpenGL available, even on SDL dummy platform
  ];

  configurePhase = ''
    runHook preConfigure

    export OWROOT=$(realpath $PWD)
-    export OWTOOLS=${if stdenv.cc.isClang then "CLANG" else "GCC"}
+    export OWTOOLS=${
+      if stdenv.cc.isClang then
+        "CLANG"
+      else if stdenv.cc.isGNU then
+        "GCC"
+      else
+        throw "Don't know what compiler ID to use for ${stdenv.cc.name} in open-watcom-v2 build"
+    }
    export OWDOCBUILD=${if withDocs then "1" else "0"}
-    export OWGHOSTSCRIPTPATH=${lib.optionalString withDocs "${ghostscript}/bin"}
+    export OWGHOSTSCRIPTPATH=${lib.optionalString withDocs "${lib.makeBinPath [ ghostscript ]}"}
    export OWGUINOBUILD=${if withGUI then "0" else "1"}
    export OWNOBUILD=
    export OWDISTRBUILD=0
-    export OWDOSBOX=${dosbox}/bin/dosbox
+    export OWDOSBOX=${lib.getExe dosbox}
    export OWVERBOSE=0
    export OWRELROOT=$out

@@ -97,7 +111,7 @@ stdenv.mkDerivation rec {
    };
  };

-  meta = with lib; {
+  meta = {
    description = "V2 fork of the Open Watcom suite of compilers and tools";
    longDescription = ''
      A fork of Open Watcom: A C/C++/Fortran compiler and assembler suite
@@ -128,13 +142,13 @@ stdenv.mkDerivation rec {
      https://github.com/open-watcom/open-watcom-v2/wiki/Open-Watcom-Documentation
    '';
    homepage = "https://open-watcom.github.io";
-    license = licenses.watcom;
-    platforms = with platforms; windows ++ unix;
-    badPlatforms = platforms.riscv ++ [
+    license = lib.licenses.watcom;
+    platforms = with lib.platforms; windows ++ unix;
+    badPlatforms = lib.platforms.riscv ++ [
      "powerpc64-linux"
      "powerpc64le-linux"
      "mips64el-linux"
    ];
-    maintainers = with maintainers; [ OPNA2608 ];
+    maintainers = with lib.maintainers; [ OPNA2608 ];
  };
-}
+})
@@ -151,15 +151,15 @@ let

                  echo "Test file format"
                  file ./linux
-                  file ./linux | grep "32-bit" | grep -q "Linux"
+                  file ./linux | grep "ELF 32-bit" | grep -q "Linux"
                  file ./nt.exe
-                  file ./nt.exe | grep "PE32" | grep -q "Windows"
+                  file ./nt.exe | grep "PE32 executable" | grep -q "Windows"
                  file ./dos4g.exe
-                  file ./dos4g.exe | grep "MS-DOS" | grep -q "executable, LE"
+                  file ./dos4g.exe | grep "MS-DOS executable" | grep -q "LE executable"
                  file ./windows.exe
-                  file ./windows.exe | grep "MS-DOS" | grep -q "Windows 3.00"
+                  file ./windows.exe | grep "MS-DOS executable" | grep -q "NE for MS Windows 3."
                  file ./dos.exe
-                  file ./dos.exe | grep "MS-DOS" | grep -v "LE" | grep -qv "Windows 3."
+                  file ./dos.exe | grep "MS-DOS executable" | grep -q "MZ for MS-DOS"
                  touch $out
                '';
          };
@@ -4,7 +4,9 @@
  lib,
  fetchFromGitHub,
  pkg-config,
-  ffmpeg,
+  autoconf,
+  automake,
+  ffmpeg_7,
 }:

 buildOctavePackage rec {
@@ -14,16 +16,28 @@ buildOctavePackage rec {
  src = fetchFromGitHub {
    owner = "Andy1978";
    repo = "octave-video";
-    rev = "refs/tags/${version}";
+    tag = version;
    hash = "sha256-fn9LNfuS9dSStBfzBjRRkvP50JJ5K+Em02J9+cHqt6w=";
  };

+  preBuild = ''
+    pushd src
+    patchShebangs bootstrap configure
+    ./bootstrap
+    ./configure
+    popd
+
+    tar --transform 's,^,video-${version}/,' -cz * -f video-${version}.tar.gz
+  '';
+
  nativeBuildInputs = [
    pkg-config
+    autoconf
+    automake
  ];

  propagatedBuildInputs = [
-    ffmpeg
+    ffmpeg_7
  ];

  meta = {
@@ -29,14 +29,14 @@

 buildPythonPackage rec {
  pname = "ax-platform";
-  version = "1.2.0";
+  version = "1.2.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "facebook";
    repo = "ax";
    tag = version;
-    hash = "sha256-HZRo7jo5f3nnAha3evLTmI3caLhz7kIbP9CA6zaH4Zg=";
+    hash = "sha256-WjJhBSj5lKt1ygrJ2QdxUxEvCrfnanLY8yWs7qy/GIY=";
  };

  env.ALLOW_BOTORCH_LATEST = "1";
@@ -1,40 +0,0 @@
-{
-  lib,
-  buildPythonPackage,
-  fetchFromGitHub,
-  setuptools,
-  pkg-config,
-  cython,
-  ffmpeg,
-}:
-
-buildPythonPackage rec {
-  pname = "basswood-av";
-  version = "15.2.1";
-  pyproject = true;
-
-  src = fetchFromGitHub {
-    owner = "basswood-io";
-    repo = "BasswoodAV";
-    tag = version;
-    hash = "sha256-GWNMPiNk8nSSm45EaRm1Te0PpCNPSYf62WbPYFY/9H8=";
-  };
-
-  build-system = [
-    setuptools
-    cython
-  ];
-
-  nativeBuildInputs = [ pkg-config ];
-
-  buildInputs = [ ffmpeg ];
-
-  pythonImportsCheck = [ "bv" ];
-
-  meta = {
-    description = "Python bindings for ffmpeg libraries";
-    homepage = "https://github.com/basswood-io/BasswoodAV";
-    license = lib.licenses.bsd3;
-    maintainers = [ ];
-  };
-}
@@ -358,13 +358,13 @@

 buildPythonPackage rec {
  pname = "boto3-stubs";
-  version = "1.41.3";
+  version = "1.41.4";
  pyproject = true;

  src = fetchPypi {
    pname = "boto3_stubs";
    inherit version;
-    hash = "sha256-x8yXBqyWnI6ihMLUXsRbY3F0VmbQh8bF58nTna/dSLw=";
+    hash = "sha256-3hzThIpkfZpuj18QAKxWnncGZLAy2aplrY7Q5fKsfyI=";
  };

  build-system = [ setuptools ];
@@ -9,13 +9,13 @@

 buildPythonPackage rec {
  pname = "botocore-stubs";
-  version = "1.41.3";
+  version = "1.41.4";
  pyproject = true;

  src = fetchPypi {
    pname = "botocore_stubs";
    inherit version;
-    hash = "sha256-us0WR82VJZqo/EzNtbGziT9JUnDBIM2g19IQ4K5qQXA=";
+    hash = "sha256-aZyBYWUOu4C0wDxIgvQUHj5ir7wK0njrOzOJwDtwVCY=";
  };

  nativeBuildInputs = [ setuptools ];
@@ -0,0 +1,62 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  # build-system
+  setuptools,
+  # dependencies
+  colcon,
+  packaging,
+  # tests
+  pytestCheckHook,
+  pytest-cov-stub,
+  scspell,
+  writableTmpDirAsHomeHook,
+}:
+
+buildPythonPackage rec {
+  pname = "colcon-devtools";
+  version = "0.3.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "colcon";
+    repo = "colcon-devtools";
+    tag = version;
+    hash = "sha256-QBkShQ58QHhYtlKtYaj9/Zs8KMy/Cw55lJHM16uNoxI=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    colcon
+    packaging
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    pytest-cov-stub
+    scspell
+    writableTmpDirAsHomeHook
+  ];
+
+  disabledTestPaths = [
+    # Skip the linter tests that require additional dependencies
+    "test/test_flake8.py"
+  ];
+
+  pythonImportsCheck = [ "colcon_devtools" ];
+
+  pythonRemoveDeps = [
+    # We use pytest-cov-stub instead (and it is not a runtime dependency anyways)
+    "pytest-cov"
+  ];
+
+  meta = {
+    description = "Extension for colcon to provide information about all extension points and extensions";
+    homepage = "https://colcon.readthedocs.io/en/released/";
+    downloadPage = "https://github.com/colcon/colcon-devtools";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ guelakais ];
+  };
+}
@@ -0,0 +1,53 @@
+{
+  lib,
+  buildPythonPackage,
+  colcon,
+  fetchFromGitHub,
+  pytestCheckHook,
+  pytest-cov-stub,
+  pyyaml,
+  scspell,
+  setuptools,
+  writableTmpDirAsHomeHook,
+}:
+buildPythonPackage rec {
+  pname = "colcon-metadata";
+  version = "0.2.5";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "colcon";
+    repo = "colcon-metadata";
+    tag = version;
+    hash = "sha256-CCyhtTsSjaeY/OKO8F1zYpk8yA4HlUoXVTVkyYEpVU8=";
+  };
+  build-system = [ setuptools ];
+
+  dependencies = [
+    colcon
+    pyyaml
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    pytest-cov-stub
+    scspell
+    writableTmpDirAsHomeHook
+  ];
+
+  disabledTestPaths = [
+    "test/test_flake8.py"
+  ];
+
+  pythonImportsCheck = [
+    "colcon_metadata"
+  ];
+
+  meta = {
+    description = "Extension for colcon-core to read package metadata from files";
+    homepage = "http://colcon.readthedocs.io/";
+    downloadPage = "https://github.com/colcon/colcon-metadata";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ guelakais ];
+  };
+}
@@ -0,0 +1,53 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  colcon,
+  pytest-cov-stub,
+  pytestCheckHook,
+  setuptools,
+  scspell,
+  writableTmpDirAsHomeHook,
+}:
+
+buildPythonPackage rec {
+  pname = "colcon-package-selection";
+  version = "0.2.10";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "colcon";
+    repo = "colcon-package-selection";
+    tag = version;
+    hash = "sha256-27Kk1l/Zvc18d4EfFPdUR/yeCS9fU1VJuHglyjPwnh0=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    colcon
+  ];
+
+  nativeCheckInputs = [
+    pytest-cov-stub
+    pytestCheckHook
+    scspell
+    writableTmpDirAsHomeHook
+  ];
+
+  pythonImportsCheck = [
+    "colcon_package_selection"
+  ];
+
+  disabledTestPaths = [
+    "test/test_flake8.py"
+  ];
+
+  meta = {
+    description = "Extension for colcon to select the packages to process";
+    homepage = "http://colcon.readthedocs.io/";
+    downloadPage = "https://github.com/colcon/colcon-package-selection";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ guelakais ];
+  };
+}
@@ -0,0 +1,53 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  colcon,
+  pytest-cov-stub,
+  pytestCheckHook,
+  setuptools,
+  scspell,
+  writableTmpDirAsHomeHook,
+}:
+
+buildPythonPackage rec {
+  pname = "colcon-python-setup-py";
+  version = "0.2.9";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "colcon";
+    repo = "colcon-python-setup-py";
+    tag = version;
+    hash = "sha256-N+OL0rSoWwZZioMV9JRvrQHdahE3fY7kKjfflUiRVL8=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    colcon
+  ];
+
+  nativeCheckInputs = [
+    pytest-cov-stub
+    pytestCheckHook
+    scspell
+    writableTmpDirAsHomeHook
+  ];
+
+  pythonImportsCheck = [
+    "colcon_python_setup_py"
+  ];
+
+  disabledTestPaths = [
+    "test/test_flake8.py"
+  ];
+
+  meta = {
+    description = "Extension for colcon-core to support Python packages with the metadata in the setup.py file";
+    homepage = "https://colcon.readthedocs.io/";
+    downloadPage = "https://github.com/colcon/colcon-python-setup-py";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ guelakais ];
+  };
+}
@@ -0,0 +1,53 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  colcon,
+  pytest-cov-stub,
+  pytestCheckHook,
+  setuptools,
+  scspell,
+  writableTmpDirAsHomeHook,
+}:
+
+buildPythonPackage rec {
+  pname = "colcon-zsh";
+  version = "0.5.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "colcon";
+    repo = "colcon-zsh";
+    tag = version;
+    hash = "sha256-8aXmPxYFeqcLUNO4+md2lyk2/SnVu21HPBRZGrB/HHM=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    colcon
+  ];
+
+  nativeCheckInputs = [
+    pytest-cov-stub
+    pytestCheckHook
+    scspell
+    writableTmpDirAsHomeHook
+  ];
+
+  pythonImportsCheck = [
+    "colcon_zsh"
+  ];
+
+  disabledTestPaths = [
+    "test/test_flake8.py"
+  ];
+
+  meta = {
+    description = "Extension for colcon-core to provide Z shell scripts";
+    homepage = "http://colcon.readthedocs.io/";
+    downloadPage = "https://github.com/colcon/colcon-zsh#";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ guelakais ];
+  };
+}
@@ -446,8 +446,8 @@ in
      "sha256-8fFnQpctLyNEZrsKI94tcpy7XAN8+ULGsih2oihHcyg=";

  mypy-boto3-ec2 =
-    buildMypyBoto3Package "ec2" "1.41.2"
-      "sha256-kypq0vZuo4Z5uX/D8EygX1nnp4qTnzaD8n2q52AhReE=";
+    buildMypyBoto3Package "ec2" "1.41.4"
+      "sha256-HK0keScSTKQHCP7jMHT2RPPZuS+Yz1Si4+3vHTXULnc=";

  mypy-boto3-ec2-instance-connect =
    buildMypyBoto3Package "ec2-instance-connect" "1.41.0"
@@ -949,8 +949,8 @@ in
      "sha256-C/z9M2aQFWjZVY34bz6D7PbUpkKv3qd7DqByt48FRnk=";

  mypy-boto3-network-firewall =
-    buildMypyBoto3Package "network-firewall" "1.41.0"
-      "sha256-0rtTR067/fJ9ZocM6QNDqA5x0CEqjO4uKA8WMB/wOtE=";
+    buildMypyBoto3Package "network-firewall" "1.41.4"
+      "sha256-iv7MyS9Y2XOR+IpiGvx2mRv2VCaOotymzqCp7mNTJeo=";

  mypy-boto3-networkmanager =
    buildMypyBoto3Package "networkmanager" "1.41.1"
@@ -985,8 +985,8 @@ in
      "sha256-JEuEjo0htTuDCZx2nNJK2Zq59oSUqkMf4BrNamerfVk=";

  mypy-boto3-organizations =
-    buildMypyBoto3Package "organizations" "1.41.2"
-      "sha256-UMEF3/xgRCMSS68sRFSx2wRVtdGaPtPg6TvKT247Loc=";
+    buildMypyBoto3Package "organizations" "1.41.4"
+      "sha256-b18Pyrr4d6Dk4eKDVGoSRzel7VYPsdi0WYDQ7nfMKMY=";

  mypy-boto3-osis =
    buildMypyBoto3Package "osis" "1.41.0"
@@ -1133,8 +1133,8 @@ in
      "sha256-wcYk7NsqlkHelo0ai/ZdsRz+HVANcf+kWYFbnGpOdzE=";

  mypy-boto3-route53 =
-    buildMypyBoto3Package "route53" "1.41.0"
-      "sha256-+TVcIYCzHq1BxuyfRtih8EYpr5WIth4vl+i9UfIPFcE=";
+    buildMypyBoto3Package "route53" "1.41.4"
+      "sha256-r8UZFvlCMHoKJOCUN28kb9OSYNBi0bX7aNp7UZdbkFU=";

  mypy-boto3-route53-recovery-cluster =
    buildMypyBoto3Package "route53-recovery-cluster" "1.41.0"
@@ -1,37 +0,0 @@
-{
-  lib,
-  buildPythonPackage,
-  fetchFromGitHub,
-  setuptools,
-  libavif,
-  pillow,
-  pytestCheckHook,
-}:
-
-buildPythonPackage rec {
-  pname = "pillow-avif-plugin";
-  version = "1.5.2";
-  pyproject = true;
-
-  src = fetchFromGitHub {
-    owner = "fdintino";
-    repo = "pillow-avif-plugin";
-    tag = "v${version}";
-    hash = "sha256-gdDVgVNympxlTzj1VUqO+aU1/xWNjDm97a0biOTlKtA=";
-  };
-
-  build-system = [ setuptools ];
-
-  buildInputs = [ libavif ];
-
-  dependencies = [ pillow ];
-
-  nativeCheckInputs = [ pytestCheckHook ];
-
-  meta = {
-    description = "Pillow plugin that adds support for AVIF files";
-    homepage = "https://github.com/fdintino/pillow-avif-plugin";
-    license = lib.licenses.bsd2;
-    maintainers = with lib.maintainers; [ ratcornu ];
-  };
-}
@@ -10,12 +10,12 @@

 buildPythonPackage rec {
  pname = "publicsuffixlist";
-  version = "1.0.2.20251119";
+  version = "1.0.2.20251126";
  pyproject = true;

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-oDVCjz8oIk6PetfQLSl10r1uCW8O995or5bmHdMKy/Q=";
+    hash = "sha256-4leRLqzBF326f4/VkOBhnQVhtDeUYAoqJ7ro5EkWsgg=";
  };

  build-system = [ setuptools ];
@@ -38,7 +38,7 @@
        downloadPage
        license
        ;
-      platforms = lib.platforms.unix ++ lib.platforms.windows;
+      platforms = lib.platforms.cygwin;
      maintainers = [ lib.maintainers.corngood ];
    };
  }
--- a/Show More
+++ b/Show More