Merge master into staging-next

2025-07-22 12:07:03 +00:00
parent 651cfeec11 d04876e8e9
commit a7eea679d1
67 changed files with 2488 additions and 1072 deletions
@@ -593,10 +593,7 @@ with lib.maintainers;
  };

  infisical = {
-    members = [
-      akhilmhdh
-      mahyarmirrashed
-    ];
+    members = [ akhilmhdh ];
    scope = "Maintain Infisical";
    shortName = "Infisical";
  };
@@ -27,6 +27,8 @@

 - Options under [networking.getaddrinfo](#opt-networking.getaddrinfo.enable) are now allowed to declaratively configure address selection and sorting behavior of `getaddrinfo` in dual-stack networks.

+- [Homebridge](https://github.com/homebridge/homebridge), a lightweight Node.js server you can run on your home network that emulates the iOS HomeKit API. Available as [services.homebridge](#opt-services.homebridge.enable).
+
 - [LACT](https://github.com/ilya-zlobintsev/LACT), a GPU monitoring and configuration tool, can now be enabled through [services.lact.enable](#opt-services.lact.enable).
  Note that for LACT to work properly on AMD GPU systems, you need to enable [hardware.amdgpu.overdrive.enable](#opt-hardware.amdgpu.overdrive.enable).

@@ -50,6 +52,8 @@

 - [Newt](https://github.com/fosrl/newt), a fully user space WireGuard tunnel client and TCP/UDP proxy, designed to securely expose private resources controlled by Pangolin. Available as [services.newt](options.html#opt-services.newt.enable).

+- [qBittorrent](https://www.qbittorrent.org/), is a bittorrent client programmed in C++ / Qt that uses libtorrent by Arvid Norberg. Available as [services.qbittorrent](#opt-services.qbittorrent.enable).
+
 - [Szurubooru](https://github.com/rr-/szurubooru), an image board engine inspired by services such as Danbooru, dedicated for small and medium communities. Available as [services.szurubooru](#opt-services.szurubooru.enable).

 - The [Neat IP Address Planner](https://spritelink.github.io/NIPAP/) (NIPAP) can now be enabled through [services.nipap.enable](#opt-services.nipap.enable).
@@ -696,6 +696,7 @@
  ./services/home-automation/evcc.nix
  ./services/home-automation/govee2mqtt.nix
  ./services/home-automation/home-assistant.nix
+  ./services/home-automation/homebridge.nix
  ./services/home-automation/matter-server.nix
  ./services/home-automation/wyoming/faster-whisper.nix
  ./services/home-automation/wyoming/openwakeword.nix
@@ -1501,6 +1502,7 @@
  ./services/torrent/magnetico.nix
  ./services/torrent/opentracker.nix
  ./services/torrent/peerflix.nix
+  ./services/torrent/qbittorrent.nix
  ./services/torrent/rtorrent.nix
  ./services/torrent/torrentstream.nix
  ./services/torrent/transmission.nix
@@ -0,0 +1,433 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.homebridge;
+
+  restartCommand = "sudo -n systemctl restart homebridge";
+
+  defaultConfigUIPlatform = {
+    inherit (cfg.uiSettings)
+      platform
+      name
+      port
+      restart
+      log
+      ;
+  };
+
+  defaultConfig = {
+    description = "Homebridge";
+    bridge = {
+      inherit (cfg.settings.bridge) name port;
+      # These have to be set at least once, otherwise the homebridge will not work
+      username = "CC:22:3D:E3:CE:30";
+      pin = "031-45-154";
+    };
+    platforms = [
+      defaultConfigUIPlatform
+    ];
+  };
+
+  defaultConfigFile = settingsFormat.generate "config.json" defaultConfig;
+
+  nixOverrideConfig = cfg.settings // {
+    platforms = [ cfg.uiSettings ] ++ cfg.settings.platforms;
+  };
+
+  nixOverrideConfigFile = settingsFormat.generate "nixOverrideConfig.json" nixOverrideConfig;
+
+  # Create a single jq filter that updates all fields at once
+  # Platforms need to be unique by "platform"
+  # Accessories need to be unique by "name"
+  jqMergeFilter = ''
+    reduce .[] as $item (
+      {};
+      . * $item + {
+        "platforms": (
+          ((.platforms // []) + ($item.platforms // [])) |
+          group_by(.platform) |
+          map(reduce .[] as $platform ({}; . * $platform))
+        ),
+        "accessories": (
+          ((.accessories // []) + ($item.accessories // [])) |
+          group_by(.name) |
+          map(reduce .[] as $accessory ({}; . * $accessory))
+        )
+      }
+    )
+  '';
+
+  jqMergeFilterFile = pkgs.writeTextFile {
+    name = "jqMergeFilter.jq";
+    text = jqMergeFilter;
+  };
+
+  # Validation function to ensure no platform has the platform "config".
+  # We want to make sure settings for the "config" platform are set in uiSettings.
+  validatePlatforms =
+    platforms:
+    let
+      conflictingPlatforms = builtins.filter (p: p.platform == "config") platforms;
+    in
+    if builtins.length conflictingPlatforms > 0 then
+      throw "The platforms list must not contain any platform with platform type 'config'.  Use the uiSettings attribute instead."
+    else
+      platforms;
+
+  settingsFormat = pkgs.formats.json { };
+in
+{
+  options.services.homebridge = with lib.types; {
+
+    # Basic Example
+    # {
+    #   services.homebridge = {
+    #     enable = true;
+    #     # Necessary for service to be reachable
+    #     openFirewall = true;
+    #   };
+    # }
+
+    enable = lib.mkEnableOption "Homebridge: Homekit home automation";
+
+    user = lib.mkOption {
+      type = str;
+      default = "homebridge";
+      description = "User to run homebridge as.";
+    };
+
+    group = lib.mkOption {
+      type = str;
+      default = "homebridge";
+      description = "Group to run homebridge as.";
+    };
+
+    openFirewall = lib.mkEnableOption "" // {
+      description = ''
+        Open ports in the firewall for the Homebridge web interface and service.
+      '';
+    };
+
+    userStoragePath = lib.mkOption {
+      type = str;
+      default = "/var/lib/homebridge";
+      description = ''
+        Path to store homebridge user files (needs to be writeable).
+      '';
+    };
+
+    pluginPath = lib.mkOption {
+      type = str;
+      default = "/var/lib/homebridge/node_modules";
+      description = ''
+        Path to the plugin download directory (needs to be writeable).
+        Seems this needs to end with node_modules, as Homebridge will run npm
+        on the parent directory.
+      '';
+    };
+
+    environmentFile = lib.mkOption {
+      type = types.nullOr types.str;
+      default = null;
+      description = ''
+        Path to an environment-file which may contain secrets.
+      '';
+    };
+
+    settings = lib.mkOption {
+      default = { };
+      description = ''
+        Configuration options for homebridge.
+
+        For more details, see [the homebridge documentation](https://github.com/homebridge/homebridge/wiki/Homebridge-Config-JSON-Explained).
+      '';
+      type = submodule {
+        freeformType = settingsFormat.type;
+        options = {
+          description = lib.mkOption {
+            type = str;
+            default = "Homebridge";
+            description = "Description of the homebridge instance.";
+            readOnly = true;
+          };
+
+          bridge.name = lib.mkOption {
+            type = str;
+            default = "Homebridge";
+            description = "Name of the homebridge";
+          };
+
+          bridge.port = lib.mkOption {
+            type = port;
+            default = 51826;
+            description = "The port homebridge listens on";
+          };
+
+          platforms = lib.mkOption {
+            description = "Homebridge Platforms";
+            default = [ ];
+            apply = validatePlatforms;
+            type = listOf (submodule {
+              freeformType = settingsFormat.type;
+              options = {
+                name = lib.mkOption {
+                  type = str;
+                  description = "Name of the platform";
+                };
+                platform = lib.mkOption {
+                  type = str;
+                  description = "Platform type";
+                };
+              };
+            });
+          };
+
+          accessories = lib.mkOption {
+            description = "Homebridge Accessories";
+            default = [ ];
+            type = listOf (submodule {
+              freeformType = settingsFormat.type;
+              options = {
+                name = lib.mkOption {
+                  type = str;
+                  description = "Name of the accessory";
+                };
+                accessory = lib.mkOption {
+                  type = str;
+                  description = "Accessory type";
+                };
+              };
+            });
+          };
+        };
+      };
+    };
+
+    # Defines the parameters for the Homebridge UI Plugin.
+    # This submodule will get merged into the "platforms" array
+    # inside settings.
+    uiSettings = lib.mkOption {
+      # Full list of UI settings can be found here: https://github.com/homebridge/homebridge-config-ui-x/wiki/Config-Options
+      default = { };
+      description = ''
+        Configuration options for homebridge config UI plugin.
+
+        For more details, see [the homebridge-config-ui-x documentation](https://github.com/homebridge/homebridge-config-ui-x/wiki/Config-Options).
+      '';
+      type = submodule {
+        freeformType = settingsFormat.type;
+        options = {
+          ## Following parameters must be set, and can't be changed.
+
+          # Must be "config" for UI service to see its config
+          platform = lib.mkOption {
+            type = str;
+            default = "config";
+            description = "Type of the homebridge UI platform";
+            readOnly = true;
+          };
+
+          name = lib.mkOption {
+            type = str;
+            default = "Config";
+            description = "Name of the homebridge UI platform";
+            readOnly = true;
+          };
+
+          # Homebridge can be installed many ways, but we're forcing a double service systemd setup
+          # This command will restart both services
+          restart = lib.mkOption {
+            type = str;
+            default = restartCommand;
+            description = "Command to restart the homebridge UI service";
+            readOnly = true;
+          };
+
+          # We're using systemd, so make sure logs is setup to pull from systemd
+          log.method = lib.mkOption {
+            type = str;
+            default = "systemd";
+            description = "Method to use for logging";
+            readOnly = true;
+          };
+
+          log.service = lib.mkOption {
+            type = str;
+            default = "homebridge";
+            description = "Name of the systemd service to log to";
+            readOnly = true;
+          };
+
+          # The following options are allowed to be changed.
+          port = lib.mkOption {
+            type = port;
+            default = 8581;
+            description = "The port the UI web service should listen on";
+          };
+        };
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.services.homebridge = {
+      description = "Homebridge";
+      wants = [ "network-online.target" ];
+      after = [
+        "syslog.target"
+        "network-online.target"
+      ];
+      wantedBy = [ "multi-user.target" ];
+
+      # On start, if the config file is missing, create a default one
+      # Otherwise, ensure that the config file is using the
+      # properties as specified by nix.
+      # Not sure if there is a better way to do this than to use jq
+      # to replace sections of json.
+      preStart = ''
+        # If the user storage path does not exist, create it
+        if [ ! -d "${cfg.userStoragePath}" ]; then
+          install -d -m 700 -o ${cfg.user} -g ${cfg.group} "${cfg.userStoragePath}"
+        fi
+        # If there is no config file, create a placeholder default
+        if [ ! -e "${cfg.userStoragePath}/config.json" ]; then
+          install -D -m 600 -o ${cfg.user} -g ${cfg.group} "${defaultConfigFile}" "${cfg.userStoragePath}/config.json"
+        fi
+
+        # Apply all nix override settings to config.json in a single jq operation
+        ${pkgs.jq}/bin/jq -s -f "${jqMergeFilterFile}" "${cfg.userStoragePath}/config.json" "${nixOverrideConfigFile}" | ${pkgs.jq}/bin/jq . > "${cfg.userStoragePath}/config.json.tmp"
+        install -D -m 600 -o ${cfg.user} -g ${cfg.group} "${cfg.userStoragePath}/config.json.tmp" "${cfg.userStoragePath}/config.json"
+
+        # Remove temporary files
+        rm "${cfg.userStoragePath}/config.json.tmp"
+
+        # Make sure plugin directory exists
+        install -d -m 755 -o ${cfg.user} -g ${cfg.group} "${cfg.pluginPath}"
+
+        # In order for hb-service to detect the homebridge installation, we need to create a folder structure
+        # where homebridge and homebrdige-config-ui-x node modules are side by side, and then point
+        # UIX_BASE_PATH_OVERRIDE at the homebridge-config-ui-x node module in the service environment.
+        # So, first create a directory to symlink these packages to
+        install -d -m 755 -o ${cfg.user} -g ${cfg.group} "${cfg.userStoragePath}/homebridge-packages"
+
+        # Then, symlink in the homebridge and homebridge-config-ui-x packages
+        rm -rf "${cfg.userStoragePath}/homebridge-packages/homebridge"
+        ln -s "${pkgs.homebridge}/lib/node_modules/homebridge" "${cfg.userStoragePath}/homebridge-packages/homebridge"
+        rm -rf "${cfg.userStoragePath}/homebridge-packages/homebridge-config-ui-x"
+        ln -s "${pkgs.homebridge-config-ui-x}/lib/node_modules/homebridge-config-ui-x" "${cfg.userStoragePath}/homebridge-packages/homebridge-config-ui-x"
+      '';
+
+      # hb-service environment variables based on source code analysis
+      environment = {
+        HOMEBRIDGE_CONFIG_UI_TERMINAL = "1";
+        DISABLE_OPENCOLLECTIVE = "true";
+        # Required or homebridge will search the global npm namespace
+        UIX_STRICT_PLUGIN_RESOLUTION = "1";
+        # Workaround to ensure homebridge does not run in sudo mode
+        HOMEBRIDGE_APT_PACKAGE = "1";
+        # Required to get the service to detect the homebridge install correctly
+        UIX_BASE_PATH_OVERRIDE = "${cfg.userStoragePath}/homebridge-packages/homebridge-config-ui-x";
+      };
+
+      path = with pkgs; [
+        # Tools listed in homebridge's installation documentations:
+        # https://github.com/homebridge/homebridge/wiki/Install-Homebridge-on-Arch-Linux
+        nodejs
+        nettools
+        gcc
+        gnumake
+        # Required for access to systemctl and journalctl
+        systemd
+        # Required for access to sudo
+        "/run/wrappers"
+        # Some plugins need bash to download tools
+        bash
+      ];
+
+      # Settings from https://github.com/homebridge/homebridge-config-ui-x/blob/latest/src/bin/platforms/linux.ts
+      serviceConfig = {
+        Type = "simple";
+        User = cfg.user;
+        PermissionsStartOnly = true;
+        StateDirectory = "homebridge";
+        EnvironmentFile = lib.mkIf (cfg.environmentFile != null) [ cfg.environmentFile ];
+        ExecStart = "${pkgs.homebridge-config-ui-x}/bin/hb-service run -U ${cfg.userStoragePath} -P ${cfg.pluginPath}";
+        Restart = "always";
+        RestartSec = 3;
+        KillMode = "process";
+        CapabilityBoundingSet = [
+          "CAP_IPC_LOCK"
+          "CAP_NET_ADMIN"
+          "CAP_NET_BIND_SERVICE"
+          "CAP_NET_RAW"
+          "CAP_SETGID"
+          "CAP_SETUID"
+          "CAP_SYS_CHROOT"
+          "CAP_CHOWN"
+          "CAP_FOWNER"
+          "CAP_DAC_OVERRIDE"
+          "CAP_AUDIT_WRITE"
+          "CAP_SYS_ADMIN"
+        ];
+        AmbientCapabilities = [
+          "CAP_NET_RAW"
+          "CAP_NET_BIND_SERVICE"
+        ];
+      };
+    };
+
+    # Create a user whose home folder is the user storage path
+    users.users = lib.mkIf (cfg.user == "homebridge") {
+      homebridge = {
+        inherit (cfg) group;
+        # Necessary so that this user can run journalctl
+        extraGroups = [ "systemd-journal" ];
+        description = "homebridge user";
+        isSystemUser = true;
+        home = cfg.userStoragePath;
+      };
+    };
+
+    users.groups = lib.mkIf (cfg.group == "homebridge") {
+      homebridge = { };
+    };
+
+    # Need passwordless sudo for a few commands
+    # homebridge-config-ui-x needs for some features
+    security.sudo.extraRules = [
+      {
+        users = [ cfg.user ];
+        commands = [
+          {
+            # Ability to restart homebridge service
+            command = "${pkgs.systemd}/bin/systemctl restart homebridge";
+            options = [ "NOPASSWD" ];
+          }
+          {
+            # Ability to shutdown server
+            command = "${pkgs.systemd}/bin/shutdown -h now";
+            options = [ "NOPASSWD" ];
+          }
+          {
+            # Ability to restart server
+            command = "${pkgs.systemd}/bin/shutdown -r now";
+            options = [ "NOPASSWD" ];
+          }
+        ];
+      }
+    ];
+
+    networking.firewall = {
+      allowedTCPPorts = lib.mkIf cfg.openFirewall [
+        cfg.settings.bridge.port
+        cfg.uiSettings.port
+      ];
+      allowedUDPPorts = lib.mkIf cfg.openFirewall [ 5353 ];
+    };
+  };
+}
@@ -161,7 +161,7 @@ in
      group = "knot-resolver";
      description = "Knot-resolver daemon user";
    };
-    users.groups.knot-resolver.gid = null;
+    users.groups.knot-resolver = { };

    systemd.packages = [ cfg.package ]; # the units are patched inside the package a bit

@@ -0,0 +1,238 @@
+{
+  config,
+  pkgs,
+  lib,
+  utils,
+  ...
+}:
+let
+  cfg = config.services.qbittorrent;
+  inherit (builtins) concatStringsSep isAttrs isString;
+  inherit (lib)
+    literalExpression
+    getExe
+    mkEnableOption
+    mkOption
+    mkPackageOption
+    mkIf
+    maintainers
+    escape
+    collect
+    mapAttrsRecursive
+    optionals
+    ;
+  inherit (lib.types)
+    str
+    port
+    path
+    nullOr
+    listOf
+    attrsOf
+    anything
+    submodule
+    ;
+  inherit (lib.generators) toINI mkKeyValueDefault mkValueStringDefault;
+  gendeepINI = toINI {
+    mkKeyValue =
+      let
+        sep = "=";
+      in
+      k: v:
+      if isAttrs v then
+        concatStringsSep "\n" (
+          collect isString (
+            mapAttrsRecursive (
+              path: value:
+              "${escape [ sep ] (concatStringsSep "\\" ([ k ] ++ path))}${sep}${mkValueStringDefault { } value}"
+            ) v
+          )
+        )
+      else
+        mkKeyValueDefault { } sep k v;
+  };
+  configFile = pkgs.writeText "qBittorrent.conf" (gendeepINI cfg.serverConfig);
+in
+{
+  options.services.qbittorrent = {
+    enable = mkEnableOption "qbittorrent, BitTorrent client";
+
+    package = mkPackageOption pkgs "qbittorrent-nox" { };
+
+    user = mkOption {
+      type = str;
+      default = "qbittorrent";
+      description = "User account under which qbittorrent runs.";
+    };
+
+    group = mkOption {
+      type = str;
+      default = "qbittorrent";
+      description = "Group under which qbittorrent runs.";
+    };
+
+    profileDir = mkOption {
+      type = path;
+      default = "/var/lib/qBittorrent/";
+      description = "the path passed to qbittorrent via --profile.";
+    };
+
+    openFirewall = mkEnableOption "opening both the webuiPort and torrentPort over TCP in the firewall";
+
+    webuiPort = mkOption {
+      default = 8080;
+      type = nullOr port;
+      description = "the port passed to qbittorrent via `--webui-port`";
+    };
+
+    torrentingPort = mkOption {
+      default = null;
+      type = nullOr port;
+      description = "the port passed to qbittorrent via `--torrenting-port`";
+    };
+
+    serverConfig = mkOption {
+      default = { };
+      type = submodule {
+        freeformType = attrsOf (attrsOf anything);
+      };
+      description = ''
+        Free-form settings mapped to the `qBittorrent.conf` file in the profile.
+        Refer to [Explanation-of-Options-in-qBittorrent](https://github.com/qbittorrent/qBittorrent/wiki/Explanation-of-Options-in-qBittorrent).
+        The Password_PBKDF2 format is oddly unique, you will likely want to use [this tool](https://codeberg.org/feathecutie/qbittorrent_password) to generate the format.
+        Alternatively you can run qBittorrent independently first and use its webUI to generate the format.
+
+        Optionally an alternative webUI can be easily set. VueTorrent for example:
+        ```nix
+        {
+          Preferences = {
+            WebUI = {
+              AlternativeUIEnabled = true;
+              RootFolder = "''${pkgs.vuetorrent}/share/vuetorrent";
+            };
+          };
+        }
+        ];
+        ```
+      '';
+      example = literalExpression ''
+        {
+          LegalNotice.Accepted = true;
+          Preferences = {
+            WebUI = {
+              Username = "user";
+              Password_PBKDF2 = "generated ByteArray.";
+            };
+            General.Locale = "en";
+          };
+        }
+      '';
+    };
+
+    extraArgs = mkOption {
+      type = listOf str;
+      default = [ ];
+      description = ''
+        Extra arguments passed to qbittorrent. See `qbittorrent -h`, or the [source code](https://github.com/qbittorrent/qBittorrent/blob/master/src/app/cmdoptions.cpp), for the available arguments.
+      '';
+      example = [
+        "--confirm-legal-notice"
+      ];
+    };
+  };
+  config = mkIf cfg.enable {
+    systemd = {
+      tmpfiles.settings = {
+        qbittorrent = {
+          "${cfg.profileDir}/qBittorrent/"."d" = {
+            mode = "755";
+            inherit (cfg) user group;
+          };
+          "${cfg.profileDir}/qBittorrent/config/"."d" = {
+            mode = "755";
+            inherit (cfg) user group;
+          };
+          "${cfg.profileDir}/qBittorrent/config/qBittorrent.conf"."L+" = mkIf (cfg.serverConfig != { }) {
+            mode = "1400";
+            inherit (cfg) user group;
+            argument = "${configFile}";
+          };
+        };
+      };
+      services.qbittorrent = {
+        description = "qbittorrent BitTorrent client";
+        wants = [ "network-online.target" ];
+        after = [
+          "local-fs.target"
+          "network-online.target"
+          "nss-lookup.target"
+        ];
+        wantedBy = [ "multi-user.target" ];
+        restartTriggers = optionals (cfg.serverConfig != { }) [ configFile ];
+
+        serviceConfig = {
+          Type = "simple";
+          User = cfg.user;
+          Group = cfg.group;
+          ExecStart = utils.escapeSystemdExecArgs (
+            [
+              (getExe cfg.package)
+              "--profile=${cfg.profileDir}"
+            ]
+            ++ optionals (cfg.webuiPort != null) [ "--webui-port=${toString cfg.webuiPort}" ]
+            ++ optionals (cfg.torrentingPort != null) [ "--torrenting-port=${toString cfg.torrentingPort}" ]
+            ++ cfg.extraArgs
+          );
+          TimeoutStopSec = 1800;
+
+          # https://github.com/qbittorrent/qBittorrent/pull/6806#discussion_r121478661
+          PrivateTmp = false;
+
+          PrivateNetwork = false;
+          RemoveIPC = true;
+          NoNewPrivileges = true;
+          PrivateDevices = true;
+          PrivateUsers = true;
+          ProtectHome = "yes";
+          ProtectProc = "invisible";
+          ProcSubset = "pid";
+          ProtectSystem = "full";
+          ProtectClock = true;
+          ProtectHostname = true;
+          ProtectKernelLogs = true;
+          ProtectKernelModules = true;
+          ProtectKernelTunables = true;
+          ProtectControlGroups = true;
+          RestrictAddressFamilies = [
+            "AF_INET"
+            "AF_INET6"
+            "AF_NETLINK"
+          ];
+          RestrictNamespaces = true;
+          RestrictRealtime = true;
+          RestrictSUIDSGID = true;
+          LockPersonality = true;
+          MemoryDenyWriteExecute = true;
+          SystemCallArchitectures = "native";
+          CapabilityBoundingSet = "";
+          SystemCallFilter = [ "@system-service" ];
+        };
+      };
+    };
+
+    users = {
+      users = mkIf (cfg.user == "qbittorrent") {
+        qbittorrent = {
+          inherit (cfg) group;
+          isSystemUser = true;
+        };
+      };
+      groups = mkIf (cfg.group == "qbittorrent") { qbittorrent = { }; };
+    };
+
+    networking.firewall.allowedTCPPorts = mkIf cfg.openFirewall (
+      optionals (cfg.webuiPort != null) [ cfg.webuiPort ]
+      ++ optionals (cfg.torrentingPort != null) [ cfg.torrentingPort ]
+    );
+  };
+  meta.maintainers = with maintainers; [ fsnkty ];
+}
@@ -700,6 +700,7 @@ in
  hledger-web = runTest ./hledger-web.nix;
  hockeypuck = runTest ./hockeypuck.nix;
  home-assistant = runTest ./home-assistant.nix;
+  homebridge = runTest ./homebridge.nix;
  hostname = handleTest ./hostname.nix { };
  hound = runTest ./hound.nix;
  hub = runTest ./git/hub.nix;
@@ -1221,6 +1222,7 @@ in
  public-inbox = runTest ./public-inbox.nix;
  pufferpanel = runTest ./pufferpanel.nix;
  pulseaudio = discoverTests (import ./pulseaudio.nix);
+  qbittorrent = runTest ./qbittorrent.nix;
  qboot = handleTestOn [ "x86_64-linux" "i686-linux" ] ./qboot.nix { };
  qemu-vm-restrictnetwork = handleTest ./qemu-vm-restrictnetwork.nix { };
  qemu-vm-volatile-root = runTest ./qemu-vm-volatile-root.nix;
@@ -0,0 +1,88 @@
+{
+  lib,
+  ...
+}:
+
+let
+  userStoragePath = "/var/lib/foobar";
+  pluginPath = "${userStoragePath}/node_modules";
+in
+{
+  name = "homebridge";
+  meta.maintainers = with lib.maintainers; [ fmoda3 ];
+
+  nodes.homebridge =
+    { pkgs, ... }:
+    {
+      services.homebridge = {
+        enable = true;
+        inherit userStoragePath pluginPath;
+
+        settings = {
+          bridge = {
+            name = "Homebridge";
+            port = 51826;
+          };
+        };
+
+        uiSettings = {
+          port = 8581;
+        };
+      };
+
+      # Cause a configuration change inside `config.json` and verify that the process is being reloaded.
+      specialisation.differentName = {
+        inheritParentConfig = true;
+        configuration.services.homebridge.settings.bridge.name = lib.mkForce "Test Home";
+      };
+    };
+
+  testScript =
+    { nodes, ... }:
+    let
+      system = nodes.homebridge.system.build.toplevel;
+    in
+    ''
+      import json
+
+      start_all()
+
+
+      def get_homebridge_journal_cursor() -> str:
+          exit, out = homebridge.execute("journalctl -u homebridge.service -n1 -o json-pretty --output-fields=__CURSOR")
+          assert exit == 0
+          return json.loads(out)["__CURSOR"]
+
+
+      def wait_for_homebridge(cursor):
+          homebridge.wait_until_succeeds(f"journalctl --after-cursor='{cursor}' -u homebridge.service | grep -q 'Logging to'")
+
+
+      homebridge.wait_for_unit("homebridge.service")
+      homebridge_cursor = get_homebridge_journal_cursor()
+
+      with subtest("Check that JSON configuration file is in place"):
+          homebridge.succeed("test -f ${userStoragePath}/config.json")
+
+      with subtest("Check that Homebridge's web interface and API can be reached"):
+          wait_for_homebridge(homebridge_cursor)
+          homebridge.wait_for_open_port(51826)
+          homebridge.wait_for_open_port(8581)
+          homebridge.succeed("curl --fail http://localhost:8581/")
+
+      with subtest("Check service restart from SIGHUP"):
+          homebridge_pid = homebridge.succeed("systemctl show --property=MainPID homebridge.service")
+          homebridge_cursor = get_homebridge_journal_cursor()
+          homebridge.succeed("${system}/specialisation/differentName/bin/switch-to-configuration test")
+          wait_for_homebridge(homebridge_cursor)
+          new_homebridge_pid = homebridge.succeed("systemctl show --property=MainPID homebridge.service")
+          assert homebridge_pid != new_homebridge_pid, "The PID of the homebridge process must change after sending SIGHUP"
+
+      with subtest("Check that no errors were logged"):
+          homebridge.fail("journalctl -u homebridge -o cat | grep -q ERROR")
+
+      with subtest("Check systemd unit hardening"):
+          homebridge.log(homebridge.succeed("systemctl cat homebridge.service"))
+          homebridge.log(homebridge.succeed("systemd-analyze security homebridge.service"))
+    '';
+}
@@ -0,0 +1,190 @@
+{ pkgs, lib, ... }:
+{
+  name = "qbittorrent";
+
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ fsnkty ];
+  };
+
+  nodes = {
+    simple = {
+      services.qbittorrent.enable = true;
+
+      specialisation.portChange.configuration = {
+        services.qbittorrent = {
+          enable = true;
+          webuiPort = 5555;
+          torrentingPort = 44444;
+        };
+      };
+
+      specialisation.openPorts.configuration = {
+        services.qbittorrent = {
+          enable = true;
+          openFirewall = true;
+          webuiPort = 8080;
+          torrentingPort = 55555;
+        };
+      };
+
+      specialisation.serverConfig.configuration = {
+        services.qbittorrent = {
+          enable = true;
+          webuiPort = null;
+          serverConfig.Preferences.WebUI.Port = "8181";
+        };
+      };
+    };
+    # Seperate vm because it's not possible to reboot into a specialisation with
+    # switch-to-configuration: https://github.com/NixOS/nixpkgs/issues/82851
+    # For one of the test we check if manual changes are overridden during
+    # reboot, therefore it's necessary to reboot into a declarative setup.
+    declarative = {
+      services.qbittorrent = {
+        enable = true;
+        webuiPort = null;
+        serverConfig = {
+          Preferences = {
+            WebUI = {
+              Username = "user";
+              # Default password: adminadmin
+              Password_PBKDF2 = "@ByteArray(6DIf26VOpTCYbgNiO6DAFQ==:e6241eaAWGzRotQZvVA5/up9fj5wwSAThLgXI2lVMsYTu1StUgX9MgmElU3Sa/M8fs+zqwZv9URiUOObjqJGNw==)";
+              Port = lib.mkDefault "8181";
+            };
+          };
+        };
+      };
+
+      specialisation.serverConfigChange.configuration = {
+        services.qbittorrent = {
+          enable = true;
+          webuiPort = null;
+          serverConfig.Preferences.WebUI.Port = "7171";
+        };
+      };
+    };
+  };
+
+  testScript =
+    { nodes, ... }:
+    let
+      simpleSpecPath = "${nodes.simple.system.build.toplevel}/specialisation";
+      declarativeSpecPath = "${nodes.declarative.system.build.toplevel}/specialisation";
+      portChange = "${simpleSpecPath}/portChange";
+      openPorts = "${simpleSpecPath}/openPorts";
+      serverConfig = "${simpleSpecPath}/serverConfig";
+      serverConfigChange = "${declarativeSpecPath}/serverConfigChange";
+    in
+    ''
+      simple.start(allow_reboot=True)
+      declarative.start(allow_reboot=True)
+
+
+      def test_webui(machine, port):
+          machine.wait_for_unit("qbittorrent.service")
+          machine.wait_for_open_port(port)
+          machine.wait_until_succeeds(f"curl --fail http://localhost:{port}")
+
+
+      # To simulate an interactive change in the settings
+      def setPreferences_api(machine, port, post_creds, post_data):
+          qb_url = f"http://localhost:{port}"
+          api_url = f"{qb_url}/api/v2"
+          cookie_path = "/tmp/qbittorrent.cookie"
+
+          machine.succeed(
+              f'curl --header "Referer: {qb_url}" \
+              --data "{post_creds}" {api_url}/auth/login \
+              -c {cookie_path}'
+          )
+          machine.succeed(
+              f'curl --header "Referer: {qb_url}" \
+              --data "{post_data}" {api_url}/app/setPreferences \
+              -b {cookie_path}'
+          )
+
+
+      # A randomly generated password is printed in the service log when no
+      # password it set
+      def get_temp_pass(machine):
+          _, password = machine.execute(
+              "journalctl -u qbittorrent.service |\
+              grep 'The WebUI administrator password was not set.' |\
+              awk '{ print $NF }' | tr -d '\n'"
+          )
+          return password
+
+
+      # Non declarative tests
+
+      with subtest("webui works with all default settings"):
+          test_webui(simple, 8080)
+
+      with subtest("check if manual changes in settings are saved correctly"):
+          temp_pass = get_temp_pass(simple)
+
+          ## Change some settings
+          api_post = [r"json={\"listen_port\": 33333}", r"json={\"web_ui_port\": 9090}"]
+          for x in api_post:
+              setPreferences_api(
+                  machine=simple,
+                  port=8080,
+                  post_creds=f"username=admin&password={temp_pass}",
+                  post_data=x,
+              )
+
+          simple.wait_for_open_port(33333)
+          test_webui(simple, 9090)
+
+          ## Test which settings are reset
+          ## As webuiPort is passed as an cli it should reset after reboot
+          ## As torrentingPort is not passed as an cli it should not reset after
+          ## reboot
+          simple.reboot()
+          test_webui(simple, 8080)
+          simple.wait_for_open_port(33333)
+
+      with subtest("ports are changed on config change"):
+          simple.succeed("${portChange}/bin/switch-to-configuration test")
+          test_webui(simple, 5555)
+          simple.wait_for_open_port(44444)
+
+      with subtest("firewall is opened correctly"):
+          simple.succeed("${openPorts}/bin/switch-to-configuration test")
+          test_webui(simple, 8080)
+          declarative.wait_until_succeeds("curl --fail http://simple:8080")
+          declarative.wait_for_open_port(55555, "simple")
+
+      with subtest("switching from simple to declarative works"):
+          simple.succeed("${serverConfig}/bin/switch-to-configuration test")
+          test_webui(simple, 8181)
+
+
+      # Declarative tests
+
+      with subtest("serverConfig is applied correctly"):
+          test_webui(declarative, 8181)
+
+      with subtest("manual changes are overridden during reboot"):
+          ## Change some settings
+          setPreferences_api(
+              machine=declarative,
+              port=8181, # as set through serverConfig
+              post_creds="username=user&password=adminadmin",
+              post_data=r"json={\"web_ui_port\": 9191}",
+          )
+
+          test_webui(declarative, 9191)
+
+          ## Test which settings are reset
+          ## The generated qBittorrent.conf is, apparently, reapplied after reboot.
+          ## Because the port is set in `serverConfig` this overrides the manually
+          ## set port.
+          declarative.reboot()
+          test_webui(declarative, 8181)
+
+      with subtest("changes in serverConfig are applied correctly"):
+          declarative.succeed("${serverConfigChange}/bin/switch-to-configuration test")
+          test_webui(declarative, 7171)
+    '';
+}
@@ -5243,6 +5243,19 @@ final: prev: {
    meta.hydraPlatforms = [ ];
  };

+  fyler-nvim = buildVimPlugin {
+    pname = "fyler.nvim";
+    version = "2025-07-21";
+    src = fetchFromGitHub {
+      owner = "A7Lavinraj";
+      repo = "fyler.nvim";
+      rev = "6595c9ef272797aeb92aacdc392cf670c994e467";
+      sha256 = "14fbmhxw7xyg618g3pv7hq64ppcas997qvkbdnl2z0lqrk2nn3zy";
+    };
+    meta.homepage = "https://github.com/A7Lavinraj/fyler.nvim/";
+    meta.hydraPlatforms = [ ];
+  };
+
  fzf-checkout-vim = buildVimPlugin {
    pname = "fzf-checkout.vim";
    version = "2023-10-05";
@@ -1245,6 +1245,15 @@ in
    ];
  };

+  fyler-nvim = super.fyler-nvim.overrideAttrs {
+    nvimSkipModules = [
+      # Requires setup call
+      "fyler.views.explorer.init"
+      "fyler.views.explorer.actions"
+      "fyler.views.explorer.ui"
+    ];
+  };
+
  fzf-checkout-vim = super.fzf-checkout-vim.overrideAttrs {
    # The plugin has a makefile which tries to run tests in a docker container.
    # This prevents it.
@@ -401,6 +401,7 @@ https://github.com/shumphrey/fugitive-gitlab.vim/,,
 https://github.com/BeneCollyridam/futhark-vim/,,
 https://github.com/tzachar/fuzzy.nvim/,HEAD,
 https://github.com/rktjmp/fwatch.nvim/,,
+https://github.com/A7Lavinraj/fyler.nvim/,stable,
 https://github.com/stsewd/fzf-checkout.vim/,,
 https://github.com/monkoose/fzf-hoogle.vim/,HEAD,
 https://github.com/gfanto/fzf-lsp.nvim/,,
@@ -1343,96 +1343,6 @@ let

      detachhead.basedpyright = callPackage ./detachhead.basedpyright { };

-      devsense.composer-php-vscode = buildVscodeMarketplaceExtension {
-        mktplcRef = {
-          name = "composer-php-vscode";
-          publisher = "devsense";
-          version = "1.59.17515";
-          hash = "sha256-unqWaEtShJHqol0tV4ocb0nI81rWFQuv/W1i+2zMeZM=";
-        };
-        meta = {
-          changelog = "https://marketplace.visualstudio.com/items/DEVSENSE.composer-php-vscode/changelog";
-          description = "Visual studio code extension for full development integration for Composer, the PHP package manager";
-          downloadPage = "https://marketplace.visualstudio.com/items?itemName=DEVSENSE.composer-php-vscode";
-          homepage = "https://github.com/DEVSENSE/phptools-docs";
-          license = lib.licenses.unfree;
-          maintainers = [ ];
-        };
-      };
-
-      devsense.phptools-vscode = buildVscodeMarketplaceExtension {
-        mktplcRef =
-          let
-            sources = {
-              "x86_64-linux" = {
-                arch = "linux-x64";
-                hash = "sha256-8i5nRlzd+LnpEh9trWECxfiC1W4S0ekBab5vo18OlsA=";
-              };
-              "x86_64-darwin" = {
-                arch = "darwin-x64";
-                sha256 = "14crw56277rdwhigabb3nsndkfcs3yzzf7gw85jvryxviq32chgy";
-              };
-              "aarch64-linux" = {
-                arch = "linux-arm64";
-                sha256 = "1j1xlvbg3nrfmdd9zm6kywwicdwdkrq0si86lcndaii8m7sj5pfp";
-              };
-              "aarch64-darwin" = {
-                arch = "darwin-arm64";
-                sha256 = "0nlks6iqxkx1xlicsa8lrb1319rgznlxkv2gg7wkwgzph97ik8bi";
-              };
-            };
-          in
-          {
-            name = "phptools-vscode";
-            publisher = "devsense";
-            version = "1.41.14332";
-          }
-          // sources.${stdenv.system} or (throw "Unsupported system: ${stdenv.system}");
-
-        nativeBuildInputs = [ autoPatchelfHook ];
-
-        buildInputs = [
-          zlib
-          (lib.getLib stdenv.cc.cc)
-        ];
-
-        postInstall = ''
-          chmod +x $out/share/vscode/extensions/devsense.phptools-vscode/out/server/devsense.php.ls
-        '';
-
-        meta = {
-          changelog = "https://marketplace.visualstudio.com/items/DEVSENSE.phptools-vscode/changelog";
-          description = "Visual studio code extension for full development integration for the PHP language";
-          downloadPage = "https://marketplace.visualstudio.com/items?itemName=DEVSENSE.phptools-vscode";
-          homepage = "https://github.com/DEVSENSE/phptools-docs";
-          license = lib.licenses.unfree;
-          maintainers = [ ];
-          platforms = [
-            "x86_64-linux"
-            "x86_64-darwin"
-            "aarch64-darwin"
-            "aarch64-linux"
-          ];
-        };
-      };
-
-      devsense.profiler-php-vscode = buildVscodeMarketplaceExtension {
-        mktplcRef = {
-          name = "profiler-php-vscode";
-          publisher = "devsense";
-          version = "1.59.17515";
-          hash = "sha256-Y2y1vpqKEOjg4eniG0myhaAkJLdEIAT1UdEdbr04MrA=";
-        };
-        meta = {
-          changelog = "https://marketplace.visualstudio.com/items/DEVSENSE.profiler-php-vscode/changelog";
-          description = "Visual studio code extension for PHP and XDebug profiling and inspecting";
-          downloadPage = "https://marketplace.visualstudio.com/items?itemName=DEVSENSE.profiler-php-vscode";
-          homepage = "https://github.com/DEVSENSE/phptools-docs";
-          license = lib.licenses.unfree;
-          maintainers = [ ];
-        };
-      };
-
      dhall.dhall-lang = buildVscodeMarketplaceExtension {
        mktplcRef = {
          name = "dhall-lang";
@@ -15,8 +15,8 @@ vscode-utils.buildVscodeMarketplaceExtension rec {
  mktplcRef = {
    name = "python";
    publisher = "ms-python";
-    version = "2025.10.0";
-    hash = "sha256-uD6NWGD5GyYwd7SeoGsgYEH26NI+hDxCx3f2EhqoOXk=";
+    version = "2025.10.1";
+    hash = "sha256-3hd940mfxnvqoblIrx/S0A8KwHtYLFuonu52/HGGfak=";
  };

  buildInputs = [ icu ];
@@ -9,20 +9,20 @@
 }:

 let
-  version = "2025.7";
+  version = "2025.7.1";

  product =
    if proEdition then
      {
        productName = "pro";
        productDesktop = "Burp Suite Professional Edition";
-        hash = "sha256-JnsaMo6QixmC1SzW6I/iX7YOZLxWaU7AlvqsZ66cPeg=";
+        hash = "sha256-qyTvvEEiZFtiRvPM8IcuRlzBKOO40Fe9g8l9wrsIY84=";
      }
    else
      {
        productName = "community";
        productDesktop = "Burp Suite Community Edition";
-        hash = "sha256-M8/Fy8yZH+WuF34IautU2fnFKOWI4/tPCzRKRIkxagY=";
+        hash = "sha256-y34WlQtGZNBn1StoWhQh02EHbCVxYMoOQMH4cGbviXg=";
      };

  src = fetchurl {
@@ -5,7 +5,7 @@
  yarn-berry_4,
  nodejs,
  python3,
-  electron,
+  electron_35,
  makeWrapper,
  writableTmpDirAsHomeHook,
  makeDesktopItem,
@@ -14,6 +14,7 @@
 }:

 let
+  electron = electron_35;
  yarn-berry = yarn-berry_4;
 in
 stdenv.mkDerivation (finalAttrs: {
@@ -2,12 +2,13 @@
  lib,
  buildNpmPackage,
  fetchFromGitHub,
-  electron,
+  electron_35,
  nix-update-script,
  makeBinaryWrapper,
  python3,
 }:
 let
+  electron = electron_35;
  version = "2.2.0";
 in
 buildNpmPackage {
@@ -1,40 +1,64 @@
 {
  lib,
  stdenv,
+  buildPackages,
+  buildGoModule,
  fetchFromGitHub,
-  coreutils,
-  findutils,
-  git,
+  nix-update-script,
+  versionCheckHook,
+  installShellFiles,
+  writableTmpDirAsHomeHook,
 }:
-
-stdenv.mkDerivation rec {
+buildGoModule (finalAttrs: {
  pname = "gibo";
-  version = "1.0.6";
+  version = "3.0.14";

  src = fetchFromGitHub {
    owner = "simonwhitaker";
    repo = "gibo";
-    rev = version;
-    sha256 = "07j3sv9ar9l074krajw8nfmsfmdp836irsbd053dbqk2v880gfm6";
+    tag = "v${finalAttrs.version}";
+    sha256 = "sha256-6w+qhwOHkfKt0hgKO98L6Si0RNJN+CXOOFzGlvxFjcA=";
  };

-  installPhase = ''
-    mkdir -p $out/bin $out/share/bash-completion/completions
-    cp gibo $out/bin
-    cp gibo-completion.bash $out/share/bash-completion/completions
+  vendorHash = "sha256-pD+7yvBydg1+BQFP0G8rRYTCO//Wg/6pzY19DLs42Gk=";

-    sed -e 's|\<git |${git}/bin/git |g' \
-        -e 's|\<basename |${coreutils}/bin/basename |g' \
-        -i "$out/bin/gibo"
-    sed -e 's|\<find |${findutils}/bin/find |g' \
-        -i "$out/share/bash-completion/completions/gibo-completion.bash"
-  '';
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/simonwhitaker/gibo/cmd.version=${finalAttrs.version}"
+  ];
+
+  nativeBuildInputs = [
+    installShellFiles
+  ];
+
+  postInstall = lib.optionalString (stdenv.hostPlatform.emulatorAvailable buildPackages) (
+    let
+      emulator = stdenv.hostPlatform.emulator buildPackages;
+    in
+    ''
+      installShellCompletion --cmd gibo \
+        --bash <(${emulator} $out/bin/gibo completion bash) \
+        --fish <(${emulator} $out/bin/gibo completion fish) \
+        --zsh <(${emulator} $out/bin/gibo completion zsh)
+    ''
+  );
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [
+    versionCheckHook
+    writableTmpDirAsHomeHook
+  ];
+  versionCheckProgramArg = "version";
+  versionCheckKeepEnvironment = [ "HOME" ];
+
+  passthru.updateScript = nix-update-script { };

  meta = {
    homepage = "https://github.com/simonwhitaker/gibo";
-    license = lib.licenses.publicDomain;
+    license = lib.licenses.unlicense;
    description = "Shell script for easily accessing gitignore boilerplates";
    platforms = lib.platforms.unix;
    mainProgram = "gibo";
  };
-}
+})
@@ -7,7 +7,7 @@
 }:

 let
-  version = "18.1.2";
+  version = "18.2.0";
  package_version = "v${lib.versions.major version}";
  gitaly_package = "gitlab.com/gitlab-org/gitaly/${package_version}";

@@ -21,10 +21,10 @@ let
      owner = "gitlab-org";
      repo = "gitaly";
      rev = "v${version}";
-      hash = "sha256-ErA04W6rWsjSay02bst0ur1mztrdo8SW/mpGtln4unI=";
+      hash = "sha256-e78kokFzVqFGgurlqThxHhfrGiRuZ+XG2g5hRrCuF3Y=";
    };

-    vendorHash = "sha256-BTpcnaHNyLgdAA9KqqA+mBo18fmQ0+OwLGNOPHRJ/IE=";
+    vendorHash = "sha256-RjDV4NGmmdT9STQBHiYf3UUYwPmuSg6970/W/ekxin0=";

    ldflags = [
      "-X ${gitaly_package}/internal/version.version=${version}"
@@ -6,7 +6,7 @@

 buildGoModule rec {
  pname = "gitlab-container-registry";
-  version = "4.24.0";
+  version = "4.25.0";
  rev = "v${version}-gitlab";

  # nixpkgs-update: no auto update
@@ -14,10 +14,10 @@ buildGoModule rec {
    owner = "gitlab-org";
    repo = "container-registry";
    inherit rev;
-    hash = "sha256-GNL7L6DKIKEgDEZQkeHNOn4R5SnWnHvNoUIs2YLjoR8=";
+    hash = "sha256-7jzKFC29NAHi5iag6aA/5LzH6IyqMa3yAxtzV9OsBnQ=";
  };

-  vendorHash = "sha256-zisadCxyfItD/n7VGbtbvhl8MRHiqdw0Kkrg6ebgS/8=";
+  vendorHash = "sha256-z9IlfyJ48FQzhbY38GbZaeQjg3cMDU8tLCXKhazP64A=";

  checkFlags =
    let
@@ -8,17 +8,17 @@

 buildGoModule rec {
  pname = "gitlab-elasticsearch-indexer";
-  version = "5.6.0";
+  version = "5.7.0";

  # nixpkgs-update: no auto update
  src = fetchFromGitLab {
    owner = "gitlab-org";
    repo = "gitlab-elasticsearch-indexer";
    rev = "v${version}";
-    hash = "sha256-XerIPK+s0OWYAqKVqE3HSSI+D4cXixYqRHmf9/4C2eg=";
+    hash = "sha256-Qlz8YT6lGUtnMXCrfZZjzmSz0AivzcCVEd/tEKzfoYg=";
  };

-  vendorHash = "sha256-qNGACM5DKufyNVKhJyakmMRbaMXi+JJUfojhWdk0ptU=";
+  vendorHash = "sha256-C0B9fe/S5TODgVTMGBBD5oGH/DsxAvCB6tBLaRdswCA=";

  buildInputs = [ icu ];
  nativeBuildInputs = [ pkg-config ];
@@ -6,17 +6,17 @@

 buildGoModule rec {
  pname = "gitlab-pages";
-  version = "18.1.2";
+  version = "18.2.0";

  # nixpkgs-update: no auto update
  src = fetchFromGitLab {
    owner = "gitlab-org";
    repo = "gitlab-pages";
    rev = "v${version}";
-    hash = "sha256-XY/WK19nujQPdsicGDHS5gEZf3uJZdW41R4xK9hDML0=";
+    hash = "sha256-TcDk816n4483SzTuz5bc8e2efrd2eJdM8jWXpM3DMvY=";
  };

-  vendorHash = "sha256-6ZHKwPhC3N813kiw1NnPOMVc2CBSIClwc4MunDi0gCk=";
+  vendorHash = "sha256-OubXCpvGtGqegQmdb6R1zw/0DfQ4FdbJGt7qYYRnWnA=";
  subPackages = [ "." ];

  meta = {
@@ -8,14 +8,14 @@

 buildGoModule rec {
  pname = "gitlab-shell";
-  version = "14.42.0";
+  version = "14.43.0";

  # nixpkgs-update: no auto update
  src = fetchFromGitLab {
    owner = "gitlab-org";
    repo = "gitlab-shell";
    rev = "v${version}";
-    hash = "sha256-U42xSb9kZpxBIE+tua5m3iNMBfcLRlujSI3K5eWiuME=";
+    hash = "sha256-JBcfsOLutxHUk5z+vXP8CnVSmJazhqJk4fZ0vONIswo=";
  };

  buildInputs = [
@@ -27,7 +27,7 @@ buildGoModule rec {
    ./remove-hardcoded-locations.patch
  ];

-  vendorHash = "sha256-aBANgvo9kWiHoytaB10J3hf9vOWVsz/vJApVHet93xg=";
+  vendorHash = "sha256-zuxgWBrrftkNjMhAXs8cAcQmb8RLQqvnFhU0HnUUcTA=";

  subPackages = [
    "cmd/gitlab-shell"
@@ -1,15 +1,15 @@
 {
-  "version": "18.1.2",
-  "repo_hash": "072ib6rc7mw9pdzql8514k4z76i1ahssyj5kypgyvf9qj4naym0b",
-  "yarn_hash": "0c5pp3dpvw0q0nfl6w1lpdmk7dvkfinwb7z7a3vq22wgzca23x2m",
+  "version": "18.2.0",
+  "repo_hash": "0wkxnhrxq3x2ahbb1hffd2c321mz3y1wi7qh89drg8rn4qgz09cd",
+  "yarn_hash": "04mqinnbhr6zgab2p1bq6y6b20bf4c4cynkgfc67mzm9xhybr3fk",
  "owner": "gitlab-org",
  "repo": "gitlab",
-  "rev": "v18.1.2-ee",
+  "rev": "v18.2.0-ee",
  "passthru": {
-    "GITALY_SERVER_VERSION": "18.1.2",
-    "GITLAB_PAGES_VERSION": "18.1.2",
-    "GITLAB_SHELL_VERSION": "14.42.0",
-    "GITLAB_ELASTICSEARCH_INDEXER_VERSION": "5.6.0",
-    "GITLAB_WORKHORSE_VERSION": "18.1.2"
+    "GITALY_SERVER_VERSION": "18.2.0",
+    "GITLAB_PAGES_VERSION": "18.2.0",
+    "GITLAB_SHELL_VERSION": "14.43.0",
+    "GITLAB_ELASTICSEARCH_INDEXER_VERSION": "5.7.0",
+    "GITLAB_WORKHORSE_VERSION": "18.2.0"
  }
 }
@@ -10,7 +10,7 @@ in
 buildGoModule rec {
  pname = "gitlab-workhorse";

-  version = "18.1.2";
+  version = "18.2.0";

  # nixpkgs-update: no auto update
  src = fetchFromGitLab {
@@ -22,7 +22,7 @@ buildGoModule rec {

  sourceRoot = "${src.name}/workhorse";

-  vendorHash = "sha256-jsp68duGIW1p8ltfSlK0jPd22iscjiIOyrxfsr+2QY0=";
+  vendorHash = "sha256-fJ1QqVn2t591ZQv9ilwgk+sPwNZNy6bHvpdCPs7S0+s=";
  buildInputs = [ git ];
  ldflags = [ "-X main.Version=${version}" ];
  doCheck = false;
@@ -7,7 +7,7 @@ end
 source 'https://rubygems.org'

 if ENV.fetch('BUNDLER_CHECKSUM_VERIFICATION_OPT_IN', 'false') != 'false' # this verification is still experimental
-  $LOAD_PATH.unshift(File.expand_path("vendor/gems/bundler-checksum/lib", __dir__))
+  $LOAD_PATH.unshift(File.expand_path("gems/bundler-checksum/lib", __dir__))
  require 'bundler-checksum'
  BundlerChecksum.patch!
 end
@@ -21,7 +21,7 @@ end

 extend ignore_feature_category

-gem 'bundler-checksum', '~> 0.1.0', path: 'vendor/gems/bundler-checksum', require: false, feature_category: :shared
+gem 'bundler-checksum', '~> 0.1.0', path: 'gems/bundler-checksum', require: false, feature_category: :shared

 # See https://docs.gitlab.com/ee/development/gemfile.html#upgrade-rails for guidelines when upgrading Rails

@@ -37,7 +37,7 @@ gem 'mutex_m', '~> 0.3', feature_category: :shared
 # Need by Rails
 gem 'drb', '~> 2.2', feature_category: :shared

-gem 'bootsnap', '~> 1.18.3', require: false, feature_category: :shared
+gem 'bootsnap', '~> 1.18.6', require: false, feature_category: :shared

 # Avoid the precompiled native gems because Omnibus needs to build this to ensure
 # LD_LIBRARY_PATH is correct: https://gitlab.com/gitlab-org/omnibus-gitlab/-/merge_requests/7730
@@ -344,9 +344,6 @@ gem 'atlassian-jwt', '~> 0.2.1', feature_category: :integrations
 # Slack integration
 gem 'slack-messenger', '~> 2.3.5', feature_category: :integrations

-# FogBugz integration
-gem 'ruby-fogbugz', '~> 0.3.0', feature_category: :importers
-
 # Kubernetes integration
 gem 'kubeclient', '~> 4.11.0', feature_category: :shared

@@ -404,7 +401,7 @@ gem 'gitlab-schema-validation', path: 'gems/gitlab-schema-validation', feature_c
 gem 'gitlab-http', path: 'gems/gitlab-http', feature_category: :shared

 gem 'premailer-rails', '~> 1.12.0', feature_category: :notifications
-gem 'gitlab-labkit', '~> 0.37.0', feature_category: :shared
+gem 'gitlab-labkit', '~> 0.39.0', feature_category: :shared
 gem 'thrift', '>= 0.16.0', feature_category: :shared

 # I18n
@@ -422,10 +419,6 @@ gem 'tty-prompt', '~> 0.23', require: false, feature_category: :shared
 # Perf bar
 gem 'peek', '~> 1.1', feature_category: :shared

-# Google Cloud Profiler support
-gem 'cloud_profiler_agent', '~> 0.0.0', path: 'vendor/gems/cloud_profiler_agent', require: false,
-  feature_category: :shared
-
 # Snowplow events trackin
 gem 'snowplow-tracker', '~> 0.8.0', feature_category: :product_analytics

@@ -438,7 +431,7 @@ gem 'prometheus-client-mmap', '~> 1.2.9', require: 'prometheus/client', feature_
 gem 'async', '~> 2.24.0', require: false, feature_category: :shared

 # Security report schemas used to validate CI job artifacts of security jobs
-gem 'gitlab-security_report_schemas', '0.1.2.min15.0.0.max15.2.1', feature_category: :vulnerability_management
+gem 'gitlab-security_report_schemas', '0.1.3.min15.0.0.max15.2.2', feature_category: :vulnerability_management

 # OpenTelemetry
 group :opentelemetry do
@@ -515,7 +508,7 @@ group :development, :test do

  gem 'database_cleaner-active_record', '~> 2.2.0', feature_category: :database
  gem 'rspec-rails', '~> 7.1.0', feature_category: :shared
-  gem 'factory_bot_rails', '~> 6.4.3', feature_category: :tooling
+  gem 'factory_bot_rails', '~> 6.5.0', feature_category: :tooling

  # Prevent occasions where minitest is not bundled in packaged versions of ruby (see #3826)
  gem 'minitest', '~> 5.11.0', feature_category: :shared
@@ -565,7 +558,7 @@ group :development, :test, :coverage do
  gem 'simplecov', '~> 0.22', require: false, feature_category: :tooling
  gem 'simplecov-lcov', '~> 0.8.0', require: false, feature_category: :tooling
  gem 'simplecov-cobertura', '~> 2.1.0', require: false, feature_category: :tooling
-  gem 'undercover', '~> 0.6.0', require: false, feature_category: :tooling
+  gem 'undercover', '~> 0.7.0', require: false, feature_category: :tooling
 end

 # Gems required in omnibus-gitlab pipeline
@@ -646,7 +639,7 @@ gem 'spamcheck', '~> 1.3.0', feature_category: :insider_threat
 gem 'gitaly', '~> 18.1.0.pre.rc1', feature_category: :gitaly

 # KAS GRPC protocol definitions
-gem 'gitlab-kas-grpc', '~> 17.11.0', feature_category: :deployment_management
+gem 'gitlab-kas-grpc', '~> 18.1.0', feature_category: :deployment_management

 # Lock until 1.74.0 is available
 # https://gitlab.com/gitlab-com/gl-infra/production/-/issues/20067
@@ -728,6 +721,7 @@ gem 'arr-pm', '~> 0.0.12', feature_category: :package_registry

 # Remote Development
 gem 'devfile', '~> 0.4.4', feature_category: :workspaces
+gem 'hashdiff', '~> 1.2.0', feature_category: :workspaces

 # Apple plist parsing
 gem 'CFPropertyList', '~> 3.0.0', feature_category: :mobile_devops
@@ -758,4 +752,4 @@ gem 'paper_trail', '~> 16.0', feature_category: :shared

 gem "i18n_data", "~> 0.13.1", feature_category: :system_access

-gem "gitlab-cloud-connector", "~> 1.14", require: 'gitlab/cloud_connector', feature_category: :cloud_connector
+gem "gitlab-cloud-connector", "~> 1.21", require: 'gitlab/cloud_connector', feature_category: :plan_provisioning
@@ -4,6 +4,12 @@ PATH
    activerecord-gitlab (0.2.0)
      activerecord (>= 7)

+PATH
+  remote: gems/bundler-checksum
+  specs:
+    bundler-checksum (0.1.0)
+      bundler
+
 PATH
  remote: gems/click_house-client
  specs:
@@ -126,21 +132,6 @@ PATH
      diffy (~> 3.4)
      oj (~> 3.16, >= 3.16.10)

-PATH
-  remote: vendor/gems/bundler-checksum
-  specs:
-    bundler-checksum (0.1.0)
-      bundler
-
-PATH
-  remote: vendor/gems/cloud_profiler_agent
-  specs:
-    cloud_profiler_agent (0.0.1.pre)
-      google-cloud-profiler-v2 (~> 0.3)
-      google-protobuf (~> 3.25)
-      googleauth (>= 0.14)
-      stackprof (~> 0.2)
-
 PATH
  remote: vendor/gems/devise-pbkdf2-encryptable
  specs:
@@ -217,8 +208,8 @@ GEM
      nkf
      rexml
    RedCloth (4.3.4)
-    acme-client (2.0.21)
-      base64 (~> 0.2.0)
+    acme-client (2.0.22)
+      base64 (~> 0.2)
      faraday (>= 1.0, < 3.0.0)
      faraday-retry (>= 1.0, < 3.0.0)
    actioncable (7.1.5.1)
@@ -343,8 +334,8 @@ GEM
    awrence (1.2.1)
    aws-eventstream (1.3.0)
    aws-partitions (1.1001.0)
-    aws-sdk-cloudformation (1.131.0)
-      aws-sdk-core (~> 3, >= 3.216.0)
+    aws-sdk-cloudformation (1.133.0)
+      aws-sdk-core (~> 3, >= 3.225.0)
      aws-sigv4 (~> 1.5)
    aws-sdk-core (3.225.0)
      aws-eventstream (~> 1, >= 1.3.0)
@@ -446,7 +437,7 @@ GEM
      descendants_tracker (~> 0.0.1)
    colored2 (3.1.2)
    commonmarker (0.23.11)
-    concurrent-ruby (1.2.3)
+    concurrent-ruby (1.3.5)
    connection_pool (2.5.3)
    console (1.29.2)
      fiber-annotation
@@ -489,7 +480,7 @@ GEM
    danger-gitlab (8.0.0)
      danger
      gitlab (~> 4.2, >= 4.2.0)
-    database_cleaner-active_record (2.2.0)
+    database_cleaner-active_record (2.2.1)
      activerecord (>= 5.a)
      database_cleaner-core (~> 2.0.0)
    database_cleaner-core (2.0.1)
@@ -552,7 +543,7 @@ GEM
      jwt (>= 2.5)
      ostruct (>= 0.5)
    dotenv (2.7.6)
-    drb (2.2.1)
+    drb (2.2.3)
    dry-cli (1.0.0)
    dry-core (1.0.1)
      concurrent-ruby (~> 1.0)
@@ -608,9 +599,9 @@ GEM
      html-pipeline (~> 2.9)
    factory_bot (6.5.0)
      activesupport (>= 5.0.0)
-    factory_bot_rails (6.4.4)
+    factory_bot_rails (6.5.0)
      factory_bot (~> 6.5)
-      railties (>= 5.0.0)
+      railties (>= 6.1.0)
    faraday (2.13.1)
      faraday-net_http (>= 2.0, < 3.5)
      json
@@ -619,7 +610,7 @@ GEM
      faraday (>= 1, < 3)
    faraday-http-cache (2.5.0)
      faraday (>= 0.8)
-    faraday-multipart (1.1.0)
+    faraday-multipart (1.1.1)
      multipart-post (~> 2.0)
    faraday-net_http (3.1.0)
      net-http
@@ -734,10 +725,10 @@ GEM
      terminal-table (>= 1.5.1)
    gitlab-chronic (0.10.6)
      numerizer (~> 0.2)
-    gitlab-cloud-connector (1.17.0)
+    gitlab-cloud-connector (1.21.0)
      activesupport (~> 7.0)
      jwt (~> 2.9.3)
-    gitlab-crystalball (1.1.0)
+    gitlab-crystalball (1.1.1)
      git (< 4)
      ostruct (< 1)
    gitlab-dangerfiles (4.9.2)
@@ -758,15 +749,17 @@ GEM
      nokogiri (~> 1, >= 1.10.8)
    gitlab-glfm-markdown (0.0.31)
      rb_sys (~> 0.9.109)
-    gitlab-kas-grpc (17.11.3)
+    gitlab-kas-grpc (18.1.0)
      grpc (~> 1.0)
-    gitlab-labkit (0.37.0)
+    gitlab-labkit (0.39.0)
      actionpack (>= 5.0.0, < 8.1.0)
      activesupport (>= 5.0.0, < 8.1.0)
+      google-protobuf (~> 3)
      grpc (>= 1.62)
      jaeger-client (~> 1.1.0)
      opentracing (~> 0.4)
-      pg_query (>= 5.1.0, < 7.0)
+      pg_query (>= 6.1.0, < 7.0)
+      prometheus-client-mmap (~> 1.2.9)
      redis (> 3.0.0, < 6.0.0)
    gitlab-license (2.6.0)
    gitlab-mail_room (0.0.27)
@@ -782,7 +775,7 @@ GEM
      activesupport (>= 5.2.0)
      rake (~> 13.0)
      snowplow-tracker (~> 0.8.0)
-    gitlab-secret_detection (0.29.1)
+    gitlab-secret_detection (0.33.0)
      grpc (>= 1.63.0, < 2)
      grpc_reflection (~> 0.1)
      parallel (~> 1)
@@ -790,9 +783,10 @@ GEM
      sentry-ruby (~> 5.22)
      stackprof (~> 0.2.27)
      toml-rb (~> 2.2)
-    gitlab-security_report_schemas (0.1.2.min15.0.0.max15.2.1)
+    gitlab-security_report_schemas (0.1.3.min15.0.0.max15.2.2)
      activesupport (>= 6, < 8)
      json_schemer (~> 2.3.0)
+      mutex_m (~> 0.3.0)
    gitlab-styles (13.1.0)
      rubocop (= 1.71.1)
      rubocop-capybara (~> 2.21.0)
@@ -887,9 +881,6 @@ GEM
    google-cloud-location (0.6.0)
      gapic-common (>= 0.20.0, < 2.a)
      google-cloud-errors (~> 1.0)
-    google-cloud-profiler-v2 (0.4.0)
-      gapic-common (>= 0.18.0, < 2.a)
-      google-cloud-errors (~> 1.0)
    google-cloud-storage (1.45.0)
      addressable (~> 2.8)
      digest-crc (~> 0.4)
@@ -995,7 +986,7 @@ GEM
      thor
      tilt
    hana (1.3.7)
-    hashdiff (1.1.0)
+    hashdiff (1.2.0)
    hashie (5.0.0)
    health_check (3.1.0)
      railties (>= 5.0)
@@ -1104,7 +1095,7 @@ GEM
    language_server-protocol (3.17.0.3)
    launchy (2.5.2)
      addressable (~> 2.8)
-    lefthook (1.11.13)
+    lefthook (1.11.16)
    letter_opener (1.10.0)
      launchy (>= 2.2, < 4)
    letter_opener_web (3.0.0)
@@ -1259,7 +1250,7 @@ GEM
      ostruct (>= 0.2)
    oj-introspect (0.8.0)
      oj (>= 3.16.10)
-    omniauth (2.1.2)
+    omniauth (2.1.3)
      hashie (>= 3.4.6)
      rack (>= 2.2.3)
      rack-protection
@@ -1312,7 +1303,7 @@ GEM
    opensearch-ruby (3.4.0)
      faraday (>= 1.0, < 3)
      multi_json (>= 1.0)
-    openssl (3.2.0)
+    openssl (3.3.0)
    openssl-signature_algorithm (1.3.0)
      openssl (> 2.0)
    opentelemetry-api (1.2.5)
@@ -1516,7 +1507,7 @@ GEM
    pyu-ruby-sasl (0.0.3.3)
    raabro (1.4.0)
    racc (1.8.1)
-    rack (2.2.13)
+    rack (2.2.17)
    rack-accept (0.4.5)
      rack (>= 0.4)
    rack-attack (6.7.0)
@@ -1588,7 +1579,7 @@ GEM
      rake-compiler-dock (= 1.9.1)
    rbs (3.6.1)
      logger
-    rbtrace (0.5.1)
+    rbtrace (0.5.2)
      ffi (>= 1.0.6)
      msgpack (>= 0.4.3)
      optimist (>= 3.0.0)
@@ -1726,9 +1717,6 @@ GEM
    rubocop-rspec_rails (2.30.0)
      rubocop (~> 1.61)
      rubocop-rspec (~> 3, >= 3.0.1)
-    ruby-fogbugz (0.3.0)
-      crack (~> 0.4)
-      multipart-post (~> 2.0)
    ruby-lsp (0.23.20)
      language_server-protocol (~> 3.17.0)
      prism (>= 1.2, < 2.0)
@@ -1736,7 +1724,7 @@ GEM
      sorbet-runtime (>= 0.5.10782)
    ruby-lsp-rails (0.3.31)
      ruby-lsp (>= 0.23.0, < 0.24.0)
-    ruby-lsp-rspec (0.1.23)
+    ruby-lsp-rspec (0.1.24)
      ruby-lsp (~> 0.23.19)
    ruby-magic (0.6.0)
      mini_portile2 (~> 2.8)
@@ -1845,7 +1833,7 @@ GEM
      tilt (~> 2.0)
      yard (~> 0.9, >= 0.9.24)
      yard-solargraph (~> 0.1)
-    solargraph-rspec (0.5.1)
+    solargraph-rspec (0.5.2)
      solargraph (~> 0.52, >= 0.52.0)
    sorbet-runtime (0.5.11647)
    spamcheck (1.3.3)
@@ -1854,7 +1842,8 @@ GEM
    spring-commands-rspec (1.0.4)
      spring (>= 0.9.1)
    sprite-factory (1.7.1)
-    sprockets (3.7.2)
+    sprockets (3.7.5)
+      base64
      concurrent-ruby (~> 1.0)
      rack (> 1, < 3)
    sprockets-rails (3.5.2)
@@ -1961,12 +1950,14 @@ GEM
    tzinfo (2.0.6)
      concurrent-ruby (~> 1.0)
    uber (0.1.0)
-    undercover (0.6.4)
+    undercover (0.7.0)
      base64
      bigdecimal
      imagen (>= 0.2.0)
      rainbow (>= 2.1, < 4.0)
      rugged (>= 0.27, < 1.10)
+      simplecov
+      simplecov_json_formatter
    unf (0.1.4)
      unf_ext
    unf_ext (0.0.8.2)
@@ -2084,7 +2075,7 @@ DEPENDENCIES
  benchmark-ips (~> 2.14.0)
  benchmark-memory (~> 0.1)
  better_errors (~> 2.10.1)
-  bootsnap (~> 1.18.3)
+  bootsnap (~> 1.18.6)
  browser (~> 5.3.1)
  bullet (~> 8.0.0)
  bundler-checksum (~> 0.1.0)!
@@ -2094,7 +2085,6 @@ DEPENDENCIES
  charlock_holmes (~> 0.7.9)
  circuitbox (= 2.0.0)
  click_house-client!
-  cloud_profiler_agent (~> 0.0.0)!
  commonmarker (~> 0.23.10)
  concurrent-ruby (~> 1.1)
  connection_pool (~> 2.5.3)
@@ -2128,7 +2118,7 @@ DEPENDENCIES
  email_reply_trimmer (~> 0.1)
  email_spec (~> 2.3.0)
  error_tracking_open_api!
-  factory_bot_rails (~> 6.4.3)
+  factory_bot_rails (~> 6.5.0)
  faraday (~> 2)
  faraday-multipart (~> 1.0)
  faraday-retry (~> 2)
@@ -2154,7 +2144,7 @@ DEPENDENCIES
  gitlab-active-context!
  gitlab-backup-cli!
  gitlab-chronic (~> 0.10.5)
-  gitlab-cloud-connector (~> 1.14)
+  gitlab-cloud-connector (~> 1.21)
  gitlab-crystalball (~> 1.1.0)
  gitlab-dangerfiles (~> 4.9.0)
  gitlab-duo-workflow-service-client (~> 0.2)!
@@ -2163,8 +2153,8 @@ DEPENDENCIES
  gitlab-glfm-markdown (~> 0.0.31)
  gitlab-housekeeper!
  gitlab-http!
-  gitlab-kas-grpc (~> 17.11.0)
-  gitlab-labkit (~> 0.37.0)
+  gitlab-kas-grpc (~> 18.1.0)
+  gitlab-labkit (~> 0.39.0)
  gitlab-license (~> 2.6)
  gitlab-mail_room (~> 0.0.24)
  gitlab-markup (~> 2.0.0)
@@ -2175,7 +2165,7 @@ DEPENDENCIES
  gitlab-schema-validation!
  gitlab-sdk (~> 0.3.0)
  gitlab-secret_detection (< 1.0)
-  gitlab-security_report_schemas (= 0.1.2.min15.0.0.max15.2.1)
+  gitlab-security_report_schemas (= 0.1.3.min15.0.0.max15.2.2)
  gitlab-sidekiq-fetcher!
  gitlab-styles (~> 13.1.0)
  gitlab-topology-service-client (~> 0.1)!
@@ -2215,6 +2205,7 @@ DEPENDENCIES
  guard-rspec
  haml_lint (~> 0.58)
  hamlit (~> 2.15.0)
+  hashdiff (~> 1.2.0)
  hashie (~> 5.0.0)
  health_check (~> 3.0)
  html-pipeline (~> 2.14.3)
@@ -2354,7 +2345,6 @@ DEPENDENCIES
  rspec_junit_formatter
  rspec_profiling (~> 0.0.9)
  rubocop
-  ruby-fogbugz (~> 0.3.0)
  ruby-lsp (~> 0.23.0)
  ruby-lsp-rails (~> 0.3.6)
  ruby-lsp-rspec (~> 0.1.10)
@@ -2405,7 +2395,7 @@ DEPENDENCIES
  truncato (~> 0.7.13)
  tty-prompt (~> 0.23)
  typhoeus (~> 1.4.0)
-  undercover (~> 0.6.0)
+  undercover (~> 0.7.0)
  unicode-emoji (~> 4.0)
  unleash (~> 3.2.2)
  uri (= 0.13.2)
@@ -9,10 +9,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0hbn563v0rc85md0fcx3z968dvq7n2ra64wbgyxg09ndjgwl9870";
+      sha256 = "1xvnj58nln2xa8vlxc1v4zgyda4n387npbcd94z3pjg28fvk8xc1";
      type = "gem";
    };
-    version = "2.0.21";
+    version = "2.0.22";
  };
  actioncable = {
    dependencies = [
@@ -557,10 +557,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1bkkx0sz1lkqhzkrpklnalpv2dshvrdi12yq47xmv0nflhgzysmp";
+      sha256 = "08d3khg5bpi73vmghphr5w4acds2vr8gcdpm93fsaj38wvb960s9";
      type = "gem";
    };
-    version = "1.131.0";
+    version = "1.133.0";
  };
  aws-sdk-core = {
    dependencies = [
@@ -925,7 +925,7 @@ src: {
    groups = [ "default" ];
    platforms = [ ];
    source = {
-      path = "${src}/vendor/gems/bundler-checksum";
+      path = "${src}/gems/bundler-checksum";
      type = "path";
    };
    version = "0.1.0";
@@ -1145,21 +1145,6 @@ src: {
    };
    version = "0.1.0";
  };
-  cloud_profiler_agent = {
-    dependencies = [
-      "google-cloud-profiler-v2"
-      "google-protobuf"
-      "googleauth"
-      "stackprof"
-    ];
-    groups = [ "default" ];
-    platforms = [ ];
-    source = {
-      path = "${src}/vendor/gems/cloud_profiler_agent";
-      type = "path";
-    };
-    version = "0.0.1.pre";
-  };
  coderay = {
    groups = [
      "default"
@@ -1232,10 +1217,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1qh1b14jwbbj242klkyz5fc7npd4j0mvndz62gajhvl1l3wd7zc2";
+      sha256 = "1ipbrgvf0pp6zxdk5ascp6i29aybz2bx9wdrlchjmpx6mhvkwfw1";
      type = "gem";
    };
-    version = "1.2.3";
+    version = "1.3.5";
  };
  connection_pool = {
    groups = [
@@ -1478,10 +1463,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1iz1hv2b1z7509dxvxdwzay1hhs24glxls5ldbyh688zxkcdca1j";
+      sha256 = "1jxzgg3yccp3gjncl5ih0y13dcappmy0y8pq85wgjj0yx5fh0ixy";
      type = "gem";
    };
-    version = "2.2.0";
+    version = "2.2.1";
  };
  database_cleaner-core = {
    groups = [
@@ -1809,15 +1794,17 @@ src: {
  drb = {
    groups = [
      "default"
+      "development"
+      "monorepo"
      "test"
    ];
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0h5kbj9hvg5hb3c7l425zpds0vb42phvln2knab8nmazg2zp5m79";
+      sha256 = "0wrkl7yiix268s2md1h6wh91311w95ikd8fy8m5gx589npyxc00b";
      type = "gem";
    };
-    version = "2.2.1";
+    version = "2.2.3";
  };
  dry-cli = {
    groups = [ "default" ];
@@ -2192,10 +2179,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "122wkrc3d2q1dlca27794hh3arw0kvrf3rgmvn7hj3y5lb51g7hk";
+      sha256 = "18n06y5ww7d08w296b6fpzx05yywp5r8p88j0k37r994aiin2ysa";
      type = "gem";
    };
-    version = "6.4.4";
+    version = "6.5.0";
  };
  faraday = {
    dependencies = [
@@ -2250,10 +2237,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0l87r9jg06nsh24gwwd1jdnxb1zq89ffybnxab0dd90nfcf0ysw5";
+      sha256 = "00w9imp55hi81q0wsgwak90ldkk7gbyb8nzmmv8hy0s907s8z8bp";
      type = "gem";
    };
-    version = "1.1.0";
+    version = "1.1.1";
  };
  faraday-net_http = {
    dependencies = [ "net-http" ];
@@ -2857,10 +2844,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0d5zrz5vgb8zrnri42awqfvcq9kfzlrc032nprknddpb9iagbsmr";
+      sha256 = "02bpl0jz8m7kfa5alkc90cbajkxy5fggva10zh7cgii3y912msqn";
      type = "gem";
    };
-    version = "1.17.0";
+    version = "1.21.0";
  };
  gitlab-crystalball = {
    dependencies = [
@@ -2874,10 +2861,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1a42qg2m7w0qn7as3zrc4v7lrxig532izi7yb2w8rbcwm114fcdx";
+      sha256 = "1vdqa11dchcmlkph9almmxjq9qsgcfv0n460lyghx7l0n09s2r04";
      type = "gem";
    };
-    version = "1.1.0";
+    version = "1.1.1";
  };
  gitlab-dangerfiles = {
    dependencies = [
@@ -2994,29 +2981,31 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0lsz61cr7i3d72i6rxvbfqbq6f5anzbbmhmrmr7mprna4dy93d7q";
+      sha256 = "07d5jav33nvl83s83yd9fg6vv636n65ybni6m6k3yvlfxygpb3wn";
      type = "gem";
    };
-    version = "17.11.3";
+    version = "18.1.0";
  };
  gitlab-labkit = {
    dependencies = [
      "actionpack"
      "activesupport"
+      "google-protobuf"
      "grpc"
      "jaeger-client"
      "opentracing"
      "pg_query"
+      "prometheus-client-mmap"
      "redis"
    ];
    groups = [ "default" ];
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0w7szxnvh9hvxcragnqvn37c6jpm4gf7aadzxslajj91vdh0mpfj";
+      sha256 = "07jpj78nnjmgz9brxxzqbx7l9fajyfq74l4vjavqmnff18vgr0gf";
      type = "gem";
    };
-    version = "0.37.0";
+    version = "0.39.0";
  };
  gitlab-license = {
    groups = [ "default" ];
@@ -3156,24 +3145,25 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0b4908vic675qq1mh1i45vh5z9vdg1ynanxdbdzaazxvjkakdwzd";
+      sha256 = "14ds4l7802ypxx56pid7xlhnlbk5ir9zc8adfm96yy9k2sgfmdnf";
      type = "gem";
    };
-    version = "0.29.1";
+    version = "0.33.0";
  };
  gitlab-security_report_schemas = {
    dependencies = [
      "activesupport"
      "json_schemer"
+      "mutex_m"
    ];
    groups = [ "default" ];
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1bl0qrmb6xci719zxnaizja2pf0wabzi91b49y0immf9gr43f01h";
+      sha256 = "0v4sfh2497g5w5hhf89wjgvjbasa13hfgm0r05myzd5hbv7v2h3f";
      type = "gem";
    };
-    version = "0.1.2.min15.0.0.max15.2.1";
+    version = "0.1.3.min15.0.0.max15.2.2";
  };
  gitlab-sidekiq-fetcher = {
    dependencies = [
@@ -3589,20 +3579,6 @@ src: {
    };
    version = "0.6.0";
  };
-  google-cloud-profiler-v2 = {
-    dependencies = [
-      "gapic-common"
-      "google-cloud-errors"
-    ];
-    groups = [ "default" ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "1qyknlvwji7vqhani490cacsrzlqfza10hv47him93yhfnqjmz2k";
-      type = "gem";
-    };
-    version = "0.4.0";
-  };
  google-cloud-storage = {
    dependencies = [
      "addressable"
@@ -4050,10 +4026,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1jf9dxgjz6z7fvymyz2acyvn9iyvwkn6d9sk7y4fxwbmfc75yimm";
+      sha256 = "1da0w5v7ppxrgvh58bafjklzv73nknyq73if6d9rkz2v24zg3169";
      type = "gem";
    };
-    version = "1.1.0";
+    version = "1.2.0";
  };
  hashie = {
    groups = [ "default" ];
@@ -4697,10 +4673,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "18msiw0b3krm9krxrahiladblh6pjpj395wcjjw2fvsimwyy7vk4";
+      sha256 = "11g6iqlsck4ypjfg1b7pkcisy5qbm774rwbwdz2rka5lcccky9qs";
      type = "gem";
    };
-    version = "1.11.13";
+    version = "1.11.16";
  };
  letter_opener = {
    dependencies = [ "launchy" ];
@@ -5672,10 +5648,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1km0wqx9pj609jidvrqfsvzbzfgdnlpdnv7i7xfqm3wb55vk5w6y";
+      sha256 = "1hjnb5b5m549irs0h1455ipzsv82pikdagx9wjb6r4j1bkjy494d";
      type = "gem";
    };
-    version = "2.1.2";
+    version = "2.1.3";
  };
  omniauth-alicloud = {
    dependencies = [ "omniauth-oauth2" ];
@@ -5920,10 +5896,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "054d6ybgjdzxw567m7rbnd46yp6gkdbc5ihr536vxd3p15vbhjrw";
+      sha256 = "0ygfbbs3c61d32ymja2k6sznj5pr540cip9z91lhzcvsr4zmffpz";
      type = "gem";
    };
-    version = "3.2.0";
+    version = "3.3.0";
  };
  openssl-signature_algorithm = {
    dependencies = [ "openssl" ];
@@ -6960,10 +6936,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1yzhcwvfkrlb8l79w24yjclv636jn6rnznp95shmssk934bi1vnc";
+      sha256 = "1pcr8sn02lwzv3z6vx5n41b6ybcnw9g9h05s3lkv4vqdm0f2mq2z";
      type = "gem";
    };
-    version = "2.2.13";
+    version = "2.2.17";
  };
  rack-accept = {
    dependencies = [ "rack" ];
@@ -7314,10 +7290,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1p65p6f917al0f07sn5ca9yj92f7mk52xgnp0ahqpyrb8r6sdjz8";
+      sha256 = "158qydqnrn1r0gm806j0bn439y0dyzdpscwi1sm3ldl1mcid5mx2";
      type = "gem";
    };
-    version = "0.5.1";
+    version = "0.5.2";
  };
  rchardet = {
    groups = [
@@ -8063,20 +8039,6 @@ src: {
    };
    version = "2.30.0";
  };
-  ruby-fogbugz = {
-    dependencies = [
-      "crack"
-      "multipart-post"
-    ];
-    groups = [ "default" ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "0mznsnhsgh1yg57j5gighr9vjricnix1l7ngf654k3v4fkjcs12y";
-      type = "gem";
-    };
-    version = "0.3.0";
-  };
  ruby-lsp = {
    dependencies = [
      "language_server-protocol"
@@ -8110,10 +8072,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1lv886262vzmjpgcd0759zn86yaidjn1wznnscn75saj4d81bafj";
+      sha256 = "08m2fw4f784lkbyz5rbzdhj57p0x2pfygk66ls0qsn5avnv7izs1";
      type = "gem";
    };
-    version = "0.1.23";
+    version = "0.1.24";
  };
  ruby-magic = {
    dependencies = [ "mini_portile2" ];
@@ -8704,10 +8666,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1kpsdfkj6yvd5ndhj5vbll4591lwg4gjrf5c61ffj8vvy4j93z0d";
+      sha256 = "1wxzz7580h6k2sghj9p1ss33i6nlmpmwqawi6ilr87si233rwgxc";
      type = "gem";
    };
-    version = "0.5.1";
+    version = "0.5.2";
  };
  sorbet-runtime = {
    groups = [
@@ -8772,21 +8734,18 @@ src: {
  };
  sprockets = {
    dependencies = [
+      "base64"
      "concurrent-ruby"
      "rack"
    ];
-    groups = [
-      "default"
-      "development"
-      "test"
-    ];
+    groups = [ "default" ];
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "182jw5a0fbqah5w9jancvfmjbk88h8bxdbwnl4d3q809rpxdg8ay";
+      sha256 = "10ykzsa76cf8kvbfkszlvbyn4ckcx1mxjhfvwxzs7y28cljhzhkj";
      type = "gem";
    };
-    version = "3.7.2";
+    version = "3.7.5";
  };
  sprockets-rails = {
    dependencies = [
@@ -9475,6 +9434,8 @@ src: {
      "imagen"
      "rainbow"
      "rugged"
+      "simplecov"
+      "simplecov_json_formatter"
    ];
    groups = [
      "coverage"
@@ -9484,10 +9445,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "06pc56qly4c8ygwg9hyay1vmxq75clm62ljw0s9ljamm57qzqd1w";
+      sha256 = "0kd7rk9qf9gx53i8jrkc1fjl2bjjxyw9cd1i784ipnfl3dc0da8s";
      type = "gem";
    };
-    version = "0.6.4";
+    version = "0.7.0";
  };
  unf = {
    dependencies = [ "unf_ext" ];
@@ -171,11 +171,11 @@ let

  linux = stdenvNoCC.mkDerivation (finalAttrs: {
    inherit pname meta passthru;
-    version = "138.0.7204.100";
+    version = "138.0.7204.157";

    src = fetchurl {
      url = "https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-stable/google-chrome-stable_${finalAttrs.version}-1_amd64.deb";
-      hash = "sha256-H22aDTMvbUsbBWasGjCP1dUKmYzD9/6TIzfBpahAnA8=";
+      hash = "sha256-QmWevU4cYmUc6lUbFG4bQ1aKFuUyIUorJjMMF14bzZ4=";
    };

    # With strictDeps on, some shebangs were not being patched correctly
@@ -276,11 +276,11 @@ let

  darwin = stdenvNoCC.mkDerivation (finalAttrs: {
    inherit pname meta passthru;
-    version = "138.0.7204.101";
+    version = "138.0.7204.158";

    src = fetchurl {
-      url = "http://dl.google.com/release2/chrome/h7v73czgelyzwk2xfcs2gkpkwm_138.0.7204.101/GoogleChrome-138.0.7204.101.dmg";
-      hash = "sha256-gG20H5QsVmnfRi+Zo+OiLTLlPP2cLp6W+JaJoRE0QtI=";
+      url = "http://dl.google.com/release2/chrome/adskeulizkrq3h2yvus65pybna6a_138.0.7204.158/GoogleChrome-138.0.7204.158.dmg";
+      hash = "sha256-D7Iik+R9PIfvL1QEASfip5M2pE+nco90dKet4Fehq/8=";
    };

    dontPatch = true;
@@ -2,51 +2,23 @@
  lib,
  fetchFromGitHub,
  fetchPypi,
-  python3,
+  python3Packages,
 }:

-let
-  py = python3.override {
-    self = py;
-    packageOverrides = self: super: {
-      # not compatible with prompt_toolkit >=2.0
-      prompt-toolkit = super.prompt-toolkit.overridePythonAttrs (oldAttrs: rec {
-        name = "${oldAttrs.pname}-${version}";
-        version = "1.0.18";
-        src = oldAttrs.src.override {
-          inherit version;
-          hash = "sha256-3U/KAsgGlJetkxotCZFMaw0bUBUc6Ha8Fb3kx0cJASY=";
-        };
-      });
-      # Use click 7
-      click = super.click.overridePythonAttrs (old: rec {
-        version = "7.1.2";
-        src = fetchPypi {
-          pname = "click";
-          inherit version;
-          hash = "sha256-0rUlXHxjSbwb0eWeCM0SrLvWPOZJ8liHVXg6qU37axo=";
-        };
-        disabledTests = [ "test_bytes_args" ];
-      });
-    };
-  };
-in
-with py.pkgs;
-
-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
  pname = "haxor-news";
-  version = "unstable-2020-10-20";
+  version = "unstable-2022-04-22";
  format = "setuptools";

  # haven't done a stable release in 3+ years, but actively developed
  src = fetchFromGitHub {
    owner = "donnemartin";
    repo = "haxor-news";
-    rev = "811a5804c09406465b2b02eab638c08bf5c4fa7f";
-    hash = "sha256-5v61b49ttwqPOvtoykJBBzwVSi7S8ARlakccMr12bbw=";
+    rev = "8294e4498858f036a344b06e82f08b834c2a8270";
+    hash = "sha256-0eVk5zj7F3QDFvV0Kv9aeV1oeKxr/Kza6M3pK6hyYuY=";
  };

-  propagatedBuildInputs = [
+  propagatedBuildInputs = with python3Packages; [
    click
    colorama
    requests
@@ -58,7 +30,7 @@ buildPythonApplication rec {
  # will fail without pre-seeded config files
  doCheck = false;

-  nativeCheckInputs = [
+  nativeCheckInputs = with python3Packages; [
    unittestCheckHook
    mock
  ];
@@ -0,0 +1,69 @@
+{
+  lib,
+  stdenv,
+  buildNpmPackage,
+  fetchFromGitHub,
+  fetchNpmDeps,
+  npmHooks,
+  python3,
+  cacert,
+}:
+
+buildNpmPackage (finalAttrs: {
+  pname = "homebridge-config-ui-x";
+  version = "5.1.0";
+
+  src = fetchFromGitHub {
+    owner = "homebridge";
+    repo = "homebridge-config-ui-x";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-asyNIiNv0bGD6fT4VTSp1W6f3dudkdZsVOc3KKOi4OY=";
+  };
+
+  # Deps hash for the root package
+  npmDepsHash = "sha256-XkdpR8yDNuP+681JIsKwHnY/Us83JGaAXJNBnGIU2UI=";
+
+  # Deps src and hash for ui subdirectory
+  npmDeps_ui = fetchNpmDeps {
+    name = "npm-deps-ui";
+    src = "${finalAttrs.src}/ui";
+    hash = "sha256-vwJcls72nzbbtC4YXasgGWtgIVV4AMuNwIkEJuubP2Q=";
+  };
+
+  # Need to also run npm ci in the ui subdirectory
+  preBuild = ''
+    # Tricky way to run npmConfigHook multiple times
+    (
+      source ${npmHooks.npmConfigHook}/nix-support/setup-hook
+      npmRoot=ui npmDeps=${finalAttrs.npmDeps_ui} makeCacheWritable= npmConfigHook
+    )
+    # Required to prevent "ng build" from failing due to
+    # prompting user for autocompletion
+    export CI=true
+  '';
+
+  # On darwin, the build failed because openpty() is not declared
+  # Uses the prebuild version of @homebridge/node-pty-prebuilt-multiarch instead
+  # Remove this (and the makeCacheWritable in preBuild), once we fix
+  # compiling node-pty on darwin
+  makeCacheWritable = stdenv.hostPlatform.isDarwin;
+
+  nativeBuildInputs = [
+    python3
+  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ cacert ];
+
+  meta = {
+    description = "Configure Homebridge, monitor and backup from a browser";
+    homepage = "https://github.com/homebridge/homebridge-config-ui-x";
+    license = lib.licenses.mit;
+    mainProgram = "homebridge-config-ui-x";
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
+    maintainers = with lib.maintainers; [ fmoda3 ];
+    # Works on darwin when not in sandbox because it downloads a prebuilt binary
+    # for node-pty at build time, which does not work in sandbox.
+    # Need to figure out why this error occurs:
+    # ../src/unix/pty.cc:478:13: error: use of undeclared identifier 'openpty'
+    # int ret = openpty(&master, &slave, nullptr, NULL, static_cast<winsize*>(&winp));
+    broken = stdenv.hostPlatform.isDarwin;
+  };
+})
@@ -0,0 +1,37 @@
+{
+  lib,
+  buildNpmPackage,
+  fetchFromGitHub,
+  jq,
+}:
+
+buildNpmPackage (finalAttrs: {
+  pname = "homebridge";
+  version = "1.11.0";
+
+  src = fetchFromGitHub {
+    owner = "homebridge";
+    repo = "homebridge";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-95wd3pVumz/KGZNjOHrSOUtI4vipeHRWK7D8e9Nzpyo=";
+  };
+
+  npmDepsHash = "sha256-fcahrKJXvEMosLbcZY6x/hklmAy4Dyf65xNfFPa4OpU=";
+
+  # Homebridge's clean phase attempts to install rimraf directly, which fails in nix builds
+  # rimraf is already in the declared dependencies, so we just don't need to do it.
+  # This will replace "npm install rimraf && rimraf lib/" with "rimraf lib/".
+  preBuild = ''
+    cat package.json | ${jq}/bin/jq '.scripts.clean = "rimraf lib/"' > package.json.tmp
+    mv package.json.tmp package.json
+  '';
+
+  meta = {
+    description = "Lightweight emulator of iOS HomeKit API";
+    homepage = "https://github.com/homebridge/homebridge";
+    license = lib.licenses.asl20;
+    mainProgram = "homebridge";
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
+    maintainers = with lib.maintainers; [ fmoda3 ];
+  };
+})
@@ -6,10 +6,12 @@
  makeWrapper,
  makeDesktopItem,
  copyDesktopItems,
-  electron,
+  electron_35,
  httptoolkit-server,
 }:
-
+let
+  electron = electron_35;
+in
 buildNpmPackage rec {
  pname = "httptoolkit";
  version = "1.20.1";
@@ -9,14 +9,14 @@

 python3Packages.buildPythonApplication rec {
  pname = "icloudpd";
-  version = "1.28.2";
+  version = "1.29.2";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "icloud-photos-downloader";
    repo = "icloud_photos_downloader";
    tag = "v${version}";
-    hash = "sha256-5zuV32AOorkRqt3wiUt2ndo+4j1FQ9JBSc8wY+v01OA=";
+    hash = "sha256-V6y/JRRfvxfQE5+ZuM8N/jciWxRr9HI6PGjnzyJ2aP8=";
  };

  pythonRelaxDeps = true;
@@ -7,16 +7,16 @@
 }:
 buildGoModule (finalAttrs: {
  pname = "jjui";
-  version = "0.8.12";
+  version = "0.9.0";

  src = fetchFromGitHub {
    owner = "idursun";
    repo = "jjui";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-KqW5XwQxKF11qWXpqhcREVZHSVqPNnJCceaW0uvgpFg=";
+    hash = "sha256-FTFryzlU7PsrU2SkOdxYLunVrRKUauAwmzIkJe3xKlk=";
  };

-  vendorHash = "sha256-2nUU5rrVWBk+9ljC+OiAVLcRnWghPPfpvq5yoNSRdVk=";
+  vendorHash = "sha256-oswFlMuoaTHfgpr2+o8EX80hl82H9JewPFk3khm8Il4=";

  ldflags = [ "-X main.Version=${finalAttrs.version}" ];

@@ -33,13 +33,13 @@ in

 stdenv.mkDerivation (finalAttrs: {
  pname = "kew";
-  version = "3.3.3";
+  version = "3.4.0";

  src = fetchFromGitHub {
    owner = "ravachol";
    repo = "kew";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-1PUvUFlRhGrZLjLwQrNb0kE695m5poSqrAIOBAnm3xk=";
+    hash = "sha256-dKjAv93NgP0iB5VMWWisvISXQOmx3lyUXG2zKCz2+Bc=";
  };

  postPatch = ''
@@ -1,8 +1,8 @@
 {
-  stdenv,
  lib,
+  stdenv,
  fetchzip,
-  makeWrapper,
+  makeBinaryWrapper,
  jre_headless,
  nixosTests,
  callPackage,
@@ -22,17 +22,17 @@ let
    ) "--features-disabled=${lib.concatStringsSep "," disabledFeatures}"}
  '';
 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "keycloak";
  version = "26.3.1";

  src = fetchzip {
-    url = "https://github.com/keycloak/keycloak/releases/download/${version}/keycloak-${version}.zip";
+    url = "https://github.com/keycloak/keycloak/releases/download/${finalAttrs.version}/keycloak-${finalAttrs.version}.zip";
    hash = "sha256-M3YbS/aK9y4N2kZrm1wNT1ZaWAaUwaRn9QQ8fMdOV5g=";
  };

  nativeBuildInputs = [
-    makeWrapper
+    makeBinaryWrapper
    jre_headless
  ];

@@ -104,5 +104,4 @@ stdenv.mkDerivation rec {
      leona
    ];
  };
-
-}
+})
@@ -12,8 +12,6 @@
  readline,
 }:

-assert libuuid != null;
-
 stdenv.mkDerivation rec {
  pname = "lash";
  version = "0.5.4";
@@ -40,7 +38,9 @@ stdenv.mkDerivation rec {
    libxml2
    readline
  ];
-  propagatedBuildInputs = [ libuuid ];
+  propagatedBuildInputs =
+    assert libuuid != null;
+    [ libuuid ];
  NIX_LDFLAGS = "-lm -lpthread -luuid";

  postInstall = ''
@@ -6,13 +6,13 @@
  autoreconfHook,
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "libpff";
-  version = "20211114";
+  version = "20231205";

  src = fetchzip {
-    url = "https://github.com/libyal/libpff/releases/download/${version}/libpff-alpha-${version}.tar.gz";
-    sha256 = "sha256-UmGRBgi78nDSuuOXi/WmODojWU5AbQGKNQwLseoh714=";
+    url = "https://github.com/libyal/libpff/releases/download/${finalAttrs.version}/libpff-alpha-${finalAttrs.version}.tar.gz";
+    hash = "sha256-VrdfZRC2iwTfv3YrObQvIH9QZPTi9pUQoAyUcBVJyes=";
  };

  nativeBuildInputs = [
@@ -29,8 +29,8 @@ stdenv.mkDerivation rec {
    description = "Library and tools to access the Personal Folder File (PFF) and the Offline Folder File (OFF) format";
    homepage = "https://github.com/libyal/libpff";
    downloadPage = "https://github.com/libyal/libpff/releases";
-    changelog = "https://github.com/libyal/libpff/blob/${version}/ChangeLog";
+    changelog = "https://github.com/libyal/libpff/blob/${finalAttrs.version}/ChangeLog";
    license = lib.licenses.lgpl3Only;
    maintainers = with lib.maintainers; [ hacker1024 ];
  };
-}
+})
@@ -17,16 +17,20 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "misskey";
-  version = "2025.6.3";
+  version = "2025.7.0";

  src = fetchFromGitHub {
    owner = "misskey-dev";
    repo = "misskey";
    tag = finalAttrs.version;
-    hash = "sha256-6UZcIZlfcYcQgjR/jrNhsoLNQGml2tjK3LYLI0fdgMU=";
+    hash = "sha256-LtBggq60buNPnGPSbh+TcFODxCoqX+rFdX0P7dYMYI0=";
    fetchSubmodules = true;
  };

+  patches = [
+    ./pnpm-lock.yaml.patch
+  ];
+
  nativeBuildInputs = [
    nodejs
    pnpm_9.configHook
@@ -36,9 +40,14 @@ stdenv.mkDerivation (finalAttrs: {

  # https://nixos.org/manual/nixpkgs/unstable/#javascript-pnpm
  pnpmDeps = pnpm_9.fetchDeps {
-    inherit (finalAttrs) pname version src;
-    fetcherVersion = 1;
-    hash = "sha256-T8LwpEjeWNmkIo3Dn1BCFHBsTzA/Dt6/pk/NMtvT0N4=";
+    inherit (finalAttrs)
+      pname
+      version
+      src
+      patches
+      ;
+    fetcherVersion = 2;
+    hash = "sha256-5yuM56sLDSo4M5PDl3gUZOdSexW1YjfYBR3BJMqNHzU=";
  };

  buildPhase = ''
@@ -0,0 +1,270 @@
+--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
+@@ -11,7 +11,7 @@
+ 
+ patchedDependencies:
+   typeorm:
+-    hash: 2677b97a423e157945c154e64183d3ae2eb44dfa9cb0e5ce731a7612f507bb56
+    hash: i7ls76affxbomopkwkccq5jvsu
+     path: patches/typeorm.patch
+ 
+ importers:
+@@ -51,6 +51,10 @@
+       typescript:
+         specifier: 5.8.3
+         version: 5.8.3
+    optionalDependencies:
+      '@tensorflow/tfjs-core':
+        specifier: 4.22.0
+        version: 4.22.0(encoding@0.1.13)
+     devDependencies:
+       '@misskey-dev/eslint-plugin':
+         specifier: 2.1.0
+@@ -85,10 +89,6 @@
+       start-server-and-test:
+         specifier: 2.0.12
+         version: 2.0.12
+-    optionalDependencies:
+-      '@tensorflow/tfjs-core':
+-        specifier: 4.22.0
+-        version: 4.22.0(encoding@0.1.13)
+ 
+   packages/backend:
+     dependencies:
+@@ -427,7 +427,7 @@
+         version: 4.2.0
+       typeorm:
+         specifier: 0.3.24
+-        version: 0.3.24(patch_hash=2677b97a423e157945c154e64183d3ae2eb44dfa9cb0e5ce731a7612f507bb56)(ioredis@5.6.1)(pg@8.16.0)(reflect-metadata@0.2.2)
+        version: 0.3.24(patch_hash=i7ls76affxbomopkwkccq5jvsu)(ioredis@5.6.1)(pg@8.16.0)(reflect-metadata@0.2.2)
+       typescript:
+         specifier: 5.8.3
+         version: 5.8.3
+@@ -446,6 +446,94 @@
+       xev:
+         specifier: 3.0.2
+         version: 3.0.2
+    optionalDependencies:
+      '@swc/core-android-arm64':
+        specifier: 1.3.11
+        version: 1.3.11
+      '@swc/core-darwin-arm64':
+        specifier: 1.12.0
+        version: 1.12.0
+      '@swc/core-darwin-x64':
+        specifier: 1.12.0
+        version: 1.12.0
+      '@swc/core-freebsd-x64':
+        specifier: 1.3.11
+        version: 1.3.11
+      '@swc/core-linux-arm-gnueabihf':
+        specifier: 1.12.0
+        version: 1.12.0
+      '@swc/core-linux-arm64-gnu':
+        specifier: 1.12.0
+        version: 1.12.0
+      '@swc/core-linux-arm64-musl':
+        specifier: 1.12.0
+        version: 1.12.0
+      '@swc/core-linux-x64-gnu':
+        specifier: 1.12.0
+        version: 1.12.0
+      '@swc/core-linux-x64-musl':
+        specifier: 1.12.0
+        version: 1.12.0
+      '@swc/core-win32-arm64-msvc':
+        specifier: 1.12.0
+        version: 1.12.0
+      '@swc/core-win32-ia32-msvc':
+        specifier: 1.12.0
+        version: 1.12.0
+      '@swc/core-win32-x64-msvc':
+        specifier: 1.12.0
+        version: 1.12.0
+      '@tensorflow/tfjs':
+        specifier: 4.22.0
+        version: 4.22.0(encoding@0.1.13)(seedrandom@3.0.5)
+      '@tensorflow/tfjs-node':
+        specifier: 4.22.0
+        version: 4.22.0(encoding@0.1.13)(seedrandom@3.0.5)
+      bufferutil:
+        specifier: 4.0.9
+        version: 4.0.9
+      slacc-android-arm-eabi:
+        specifier: 0.0.10
+        version: 0.0.10
+      slacc-android-arm64:
+        specifier: 0.0.10
+        version: 0.0.10
+      slacc-darwin-arm64:
+        specifier: 0.0.10
+        version: 0.0.10
+      slacc-darwin-universal:
+        specifier: 0.0.10
+        version: 0.0.10
+      slacc-darwin-x64:
+        specifier: 0.0.10
+        version: 0.0.10
+      slacc-freebsd-x64:
+        specifier: 0.0.10
+        version: 0.0.10
+      slacc-linux-arm-gnueabihf:
+        specifier: 0.0.10
+        version: 0.0.10
+      slacc-linux-arm64-gnu:
+        specifier: 0.0.10
+        version: 0.0.10
+      slacc-linux-arm64-musl:
+        specifier: 0.0.10
+        version: 0.0.10
+      slacc-linux-x64-gnu:
+        specifier: 0.0.10
+        version: 0.0.10
+      slacc-linux-x64-musl:
+        specifier: 0.0.10
+        version: 0.0.10
+      slacc-win32-arm64-msvc:
+        specifier: 0.0.10
+        version: 0.0.10
+      slacc-win32-x64-msvc:
+        specifier: 0.0.10
+        version: 0.0.10
+      utf-8-validate:
+        specifier: 6.0.5
+        version: 6.0.5
+     devDependencies:
+       '@jest/globals':
+         specifier: 29.7.0
+@@ -612,94 +700,6 @@
+       supertest:
+         specifier: 7.1.1
+         version: 7.1.1
+-    optionalDependencies:
+-      '@swc/core-android-arm64':
+-        specifier: 1.3.11
+-        version: 1.3.11
+-      '@swc/core-darwin-arm64':
+-        specifier: 1.12.0
+-        version: 1.12.0
+-      '@swc/core-darwin-x64':
+-        specifier: 1.12.0
+-        version: 1.12.0
+-      '@swc/core-freebsd-x64':
+-        specifier: 1.3.11
+-        version: 1.3.11
+-      '@swc/core-linux-arm-gnueabihf':
+-        specifier: 1.12.0
+-        version: 1.12.0
+-      '@swc/core-linux-arm64-gnu':
+-        specifier: 1.12.0
+-        version: 1.12.0
+-      '@swc/core-linux-arm64-musl':
+-        specifier: 1.12.0
+-        version: 1.12.0
+-      '@swc/core-linux-x64-gnu':
+-        specifier: 1.12.0
+-        version: 1.12.0
+-      '@swc/core-linux-x64-musl':
+-        specifier: 1.12.0
+-        version: 1.12.0
+-      '@swc/core-win32-arm64-msvc':
+-        specifier: 1.12.0
+-        version: 1.12.0
+-      '@swc/core-win32-ia32-msvc':
+-        specifier: 1.12.0
+-        version: 1.12.0
+-      '@swc/core-win32-x64-msvc':
+-        specifier: 1.12.0
+-        version: 1.12.0
+-      '@tensorflow/tfjs':
+-        specifier: 4.22.0
+-        version: 4.22.0(encoding@0.1.13)(seedrandom@3.0.5)
+-      '@tensorflow/tfjs-node':
+-        specifier: 4.22.0
+-        version: 4.22.0(encoding@0.1.13)(seedrandom@3.0.5)
+-      bufferutil:
+-        specifier: 4.0.9
+-        version: 4.0.9
+-      slacc-android-arm-eabi:
+-        specifier: 0.0.10
+-        version: 0.0.10
+-      slacc-android-arm64:
+-        specifier: 0.0.10
+-        version: 0.0.10
+-      slacc-darwin-arm64:
+-        specifier: 0.0.10
+-        version: 0.0.10
+-      slacc-darwin-universal:
+-        specifier: 0.0.10
+-        version: 0.0.10
+-      slacc-darwin-x64:
+-        specifier: 0.0.10
+-        version: 0.0.10
+-      slacc-freebsd-x64:
+-        specifier: 0.0.10
+-        version: 0.0.10
+-      slacc-linux-arm-gnueabihf:
+-        specifier: 0.0.10
+-        version: 0.0.10
+-      slacc-linux-arm64-gnu:
+-        specifier: 0.0.10
+-        version: 0.0.10
+-      slacc-linux-arm64-musl:
+-        specifier: 0.0.10
+-        version: 0.0.10
+-      slacc-linux-x64-gnu:
+-        specifier: 0.0.10
+-        version: 0.0.10
+-      slacc-linux-x64-musl:
+-        specifier: 0.0.10
+-        version: 0.0.10
+-      slacc-win32-arm64-msvc:
+-        specifier: 0.0.10
+-        version: 0.0.10
+-      slacc-win32-x64-msvc:
+-        specifier: 0.0.10
+-        version: 0.0.10
+-      utf-8-validate:
+-        specifier: 6.0.5
+-        version: 6.0.5
+ 
+   packages/frontend:
+     dependencies:
+@@ -11221,8 +11221,8 @@
+   vue-component-type-helpers@2.2.12:
+     resolution: {integrity: sha512-YbGqHZ5/eW4SnkPNR44mKVc6ZKQoRs/Rux1sxC6rdwXb4qpbOSYfDr9DsTHolOTGmIKgM9j141mZbBeg05R1pw==}
+ 
+-  vue-component-type-helpers@3.0.1:
+-    resolution: {integrity: sha512-j23mCB5iEbGsyIhnVdXdWUOg+UdwmVxpKnYYf2j+4ppCt5VSFXKjwu9YFt0QYxUaf5G99PuHsVfRScjHCRSsGQ==}
+  vue-component-type-helpers@3.0.3:
+    resolution: {integrity: sha512-koiBu7lO8e6w/UlbZAAIW11qcFQocYIl7Nh/SVwGZ804ej5KrncU32bRxi2zfU2Kyf6HWuk1CeeVP2rhIL+vyQ==}
+ 
+   vue-demi@0.14.7:
+     resolution: {integrity: sha512-EOG8KXDQNwkJILkx/gPcoL/7vH+hORoBaKgGe+6W7VFMvCYJfmF2dGbvgDroVnI8LU7/kTu8mbjRZGBU1z9NTA==}
+@@ -14955,7 +14955,7 @@
+       ts-dedent: 2.2.0
+       type-fest: 2.19.0
+       vue: 3.5.17(typescript@5.8.3)
+-      vue-component-type-helpers: 3.0.1
+      vue-component-type-helpers: 3.0.3
+ 
+   '@stylistic/eslint-plugin@2.13.0(eslint@9.31.0)(typescript@5.8.3)':
+     dependencies:
+@@ -23034,7 +23034,7 @@
+ 
+   typedarray@0.0.6: {}
+ 
+-  typeorm@0.3.24(patch_hash=2677b97a423e157945c154e64183d3ae2eb44dfa9cb0e5ce731a7612f507bb56)(ioredis@5.6.1)(pg@8.16.0)(reflect-metadata@0.2.2):
+  typeorm@0.3.24(patch_hash=i7ls76affxbomopkwkccq5jvsu)(ioredis@5.6.1)(pg@8.16.0)(reflect-metadata@0.2.2):
+     dependencies:
+       '@sqltools/formatter': 1.2.5
+       ansis: 3.17.0
+@@ -23371,7 +23371,7 @@
+ 
+   vue-component-type-helpers@2.2.12: {}
+ 
+-  vue-component-type-helpers@3.0.1: {}
+  vue-component-type-helpers@3.0.3: {}
+ 
+   vue-demi@0.14.7(vue@3.5.17(typescript@5.8.3)):
+     dependencies:
@@ -0,0 +1,48 @@
+{
+  lib,
+  stdenv,
+  cmake,
+  fetchFromGitHub,
+  imath,
+  python3,
+  rapidjson,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "otio";
+  version = "0.17.0";
+
+  src = fetchFromGitHub {
+    owner = "AcademySoftwareFoundation";
+    repo = "OpenTimelineIO";
+    tag = "v${finalAttrs.version}";
+    sha256 = "sha256-53KXjbhHxuEtu6iRGWrirvFamuZ/WbOTcKCfs1iqKmM=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    python3
+  ];
+
+  buildInputs = [
+    imath
+    rapidjson
+  ];
+
+  cmakeFlags = [
+    (lib.cmakeBool "OTIO_PYTHON_INSTALL" false)
+    (lib.cmakeBool "OTIO_DEPENDENCIES_INSTALL" false)
+    (lib.cmakeBool "OTIO_FIND_IMATH" true)
+    (lib.cmakeBool "OTIO_SHARED_LIBS" true)
+    (lib.cmakeBool "OTIO_AUTOMATIC_SUBMODULES" false)
+  ];
+
+  meta = {
+    description = "Interchange format and API for editorial cut information";
+    homepage = "http://opentimeline.io/";
+    changelog = "https://github.com/AcademySoftwareFoundation/OpenTimelineIO/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ liberodark ];
+    platforms = lib.platforms.linux;
+  };
+})
@@ -120,12 +120,12 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "pike";
-  version = "v8.0.2020";
+  version = "8.0.2020";

  src = fetchFromGitHub {
    owner = "pikelang";
    repo = "Pike";
-    rev = finalAttrs.version;
+    tag = "v${finalAttrs.version}";
    hash = "sha256-VHfMfICtvCHdFTIjiYw9tR5g9KycR7jqdg3wT+T37mA=";
  };

@@ -0,0 +1,21 @@
+diff --git a/Data/testsuite/src/DataTest.cpp b/Data/testsuite/src/DataTest.cpp
+index a78c4e5..e8d9335 100644
+--- a/Data/testsuite/src/DataTest.cpp
+++ b/Data/testsuite/src/DataTest.cpp
+@@ -1652 +1652 @@ CppUnit::Test* DataTest::suite()
+-	CppUnit_addTest(pSuite, DataTest, testSQLChannel);
+	// CppUnit_addTest(pSuite, DataTest, testSQLChannel);
+diff --git a/Net/testsuite/src/HTTPClientSessionTest.cpp b/Net/testsuite/src/HTTPClientSessionTest.cpp
+index 31de150..b5c0d13 100644
+--- a/Net/testsuite/src/HTTPClientSessionTest.cpp
+++ b/Net/testsuite/src/HTTPClientSessionTest.cpp
+@@ -406 +406 @@ CppUnit::Test* HTTPClientSessionTest::suite()
+-	CppUnit_addTest(pSuite, HTTPClientSessionTest, testGetSmallUnix);
+	// CppUnit_addTest(pSuite, HTTPClientSessionTest, testGetSmallUnix);
+diff --git a/Net/testsuite/src/SocketTest.cpp b/Net/testsuite/src/SocketTest.cpp
+index 27c1800..9bd684b 100644
+--- a/Net/testsuite/src/SocketTest.cpp
+++ b/Net/testsuite/src/SocketTest.cpp
+@@ -900 +900 @@ CppUnit::Test* SocketTest::suite()
+-	CppUnit_addTest(pSuite, SocketTest, testEchoUnixLocal);
+	// CppUnit_addTest(pSuite, SocketTest, testEchoUnixLocal);
@@ -0,0 +1,28 @@
+diff --git a/Data/testsuite/src/DataTest.cpp b/Data/testsuite/src/DataTest.cpp
+index a78c4e5..e8d9335 100644
+--- a/Data/testsuite/src/DataTest.cpp
+++ b/Data/testsuite/src/DataTest.cpp
+@@ -1652 +1652 @@ CppUnit::Test* DataTest::suite()
+-	CppUnit_addTest(pSuite, DataTest, testSQLChannel);
+	// CppUnit_addTest(pSuite, DataTest, testSQLChannel);
+diff --git a/Net/testsuite/src/DatagramSocketTest.cpp b/Net/testsuite/src/DatagramSocketTest.cpp
+index e765de2..cec4867 100644
+--- a/Net/testsuite/src/DatagramSocketTest.cpp
+++ b/Net/testsuite/src/DatagramSocketTest.cpp
+@@ -830 +830 @@ CppUnit::Test* DatagramSocketTest::suite()
+-	CppUnit_addTest(pSuite, DatagramSocketTest, testBroadcast);
+	// CppUnit_addTest(pSuite, DatagramSocketTest, testBroadcast);
+diff --git a/Net/testsuite/src/SocketReactorTest.cpp b/Net/testsuite/src/SocketReactorTest.cpp
+index a07576c..b3236c5 100644
+--- a/Net/testsuite/src/SocketReactorTest.cpp
+++ b/Net/testsuite/src/SocketReactorTest.cpp
+@@ -706 +706 @@ CppUnit::Test* SocketReactorTest::suite()
+-	CppUnit_addTest(pSuite, SocketReactorTest, testSocketConnectorFail);
+	// CppUnit_addTest(pSuite, SocketReactorTest, testSocketConnectorFail);
+diff --git a/Net/testsuite/src/SocketTest.cpp b/Net/testsuite/src/SocketTest.cpp
+index 27c1800..9bd684b 100644
+--- a/Net/testsuite/src/SocketTest.cpp
+++ b/Net/testsuite/src/SocketTest.cpp
+@@ -900 +900 @@ CppUnit::Test* SocketTest::suite()
+-	CppUnit_addTest(pSuite, SocketTest, testEchoUnixLocal);
+	// CppUnit_addTest(pSuite, SocketTest, testEchoUnixLocal);
@@ -0,0 +1,18 @@
+diff --git a/Foundation/testsuite/src/ExpireLRUCacheTest.cpp b/Foundation/testsuite/src/ExpireLRUCacheTest.cpp
+--- a/Foundation/testsuite/src/ExpireLRUCacheTest.cpp
+++ b/Foundation/testsuite/src/ExpireLRUCacheTest.cpp
+@@ -336 +336 @@
+-	CppUnit_addTest(pSuite, ExpireLRUCacheTest, testExpireN);
+	// CppUnit_addTest(pSuite, ExpireLRUCacheTest, testExpireN);
+diff --git a/Foundation/testsuite/src/TimestampTest.cpp b/Foundation/testsuite/src/TimestampTest.cpp
+--- a/Foundation/testsuite/src/TimestampTest.cpp
+++ b/Foundation/testsuite/src/TimestampTest.cpp
+@@ -97 +97 @@
+-	CppUnit_addTest(pSuite, TimestampTest, testTimestamp);
+	// CppUnit_addTest(pSuite, TimestampTest, testTimestamp);
+diff --git a/Foundation/testsuite/src/UniqueExpireCacheTest.cpp b/Foundation/testsuite/src/UniqueExpireCacheTest.cpp
+--- a/Foundation/testsuite/src/UniqueExpireCacheTest.cpp
+++ b/Foundation/testsuite/src/UniqueExpireCacheTest.cpp
+@@ -248 +248 @@
+-	CppUnit_addTest(pSuite, UniqueExpireCacheTest, testExpireN);
+	// CppUnit_addTest(pSuite, UniqueExpireCacheTest, testExpireN);
@@ -13,6 +13,7 @@
  openssl,
  unixODBC,
  libmysqlclient,
+  writableTmpDirAsHomeHook,
 }:

 stdenv.mkDerivation rec {
@@ -54,25 +55,56 @@ stdenv.mkDerivation rec {
  MYSQL_DIR = libmysqlclient;
  MYSQL_INCLUDE_DIR = "${MYSQL_DIR}/include/mysql";

-  cmakeFlags = [
-    # use nix provided versions of sqlite, zlib, pcre, expat, ... instead of bundled versions
-    (lib.cmakeBool "POCO_UNBUNDLED" true)
-  ];
+  cmakeFlags =
+    let
+      excludeTestsRegex = lib.concatStringsSep "|" [
+        # These tests require running services, which the checkPhase is ill equipeed to provide
+        # TODO get them running in a nixosTest
+        "Redis"
+        "DataODBC"
+        "MongoDB"
+        "DataMySQL"
+        # network not accessible from nix sandbox
+        "NetSSL" # around 25 test failures
+        "Net" # could be made to work when public network access is patched out
+      ];
+    in
+    [
+      # use nix provided versions of sqlite, zlib, pcre, expat, ... instead of bundled versions
+      (lib.cmakeBool "POCO_UNBUNDLED" true)
+      (lib.cmakeBool "ENABLE_TESTS" true)
+      (lib.cmakeFeature "CMAKE_CTEST_ARGUMENTS" "--exclude-regex;'${excludeTestsRegex}'")
+    ];

-  patches = [
-    # Remove on next release
-    (fetchpatch {
-      name = "disable-included-pcre-if-pcre-is-linked-staticly";
-      # this happens when building pkgsStatic.poco
-      url = "https://patch-diff.githubusercontent.com/raw/pocoproject/poco/pull/4879.patch";
-      hash = "sha256-VFWuRuf0GPYFp43WKI8utl+agP+7a5biLg7m64EMnVo=";
-    })
+  patches =
+    [
+      # Remove on next release
+      (fetchpatch {
+        name = "disable-included-pcre-if-pcre-is-linked-staticly";
+        # this happens when building pkgsStatic.poco
+        url = "https://patch-diff.githubusercontent.com/raw/pocoproject/poco/pull/4879.patch";
+        hash = "sha256-VFWuRuf0GPYFp43WKI8utl+agP+7a5biLg7m64EMnVo=";
+      })
+      # https://github.com/pocoproject/poco/issues/4977
+      ./disable-flaky-tests.patch
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      ./disable-broken-tests-darwin.patch
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isLinux [
+      ./disable-broken-tests-linux.patch
+    ];
+
+  doCheck = true;
+  nativeCheckInputs = [
+    # workaround for some tests trying to write to /homeless-shelter
+    writableTmpDirAsHomeHook
  ];

  postFixup = ''
    grep -rlF INTERFACE_INCLUDE_DIRECTORIES "$dev/lib/cmake/Poco" | while read -r f; do
      substituteInPlace "$f" \
-        --replace "$"'{_IMPORT_PREFIX}/include' ""
+        --replace-quiet "$"'{_IMPORT_PREFIX}/include' ""
    done
  '';

@@ -8,13 +8,13 @@

 buildGoModule rec {
  pname = "protonmail-bridge";
-  version = "3.21.1";
+  version = "3.21.2";

  src = fetchFromGitHub {
    owner = "ProtonMail";
    repo = "proton-bridge";
    rev = "v${version}";
-    hash = "sha256-HGBECDidHFixFOb/ze+3elckpt1JghEtPbWHq7QU1Qg=";
+    hash = "sha256-IQgP+eWUCyViEBi0WFIOW2rXZLtoyVlrQrtAaqaLOv0=";
  };

  vendorHash = "sha256-aW7N6uacoP99kpvw9E5WrHaQ0fZ4P5WGsNvR/FAZ+cA=";
@@ -16,6 +16,7 @@
  webuiSupport ? true,
  wrapGAppsHook3,
  zlib,
+  nixosTests,
 }:

 stdenv.mkDerivation (finalAttrs: {
@@ -74,7 +75,10 @@ stdenv.mkDerivation (finalAttrs: {
    qtWrapperArgs+=("''${gappsWrapperArgs[@]}")
  '';

-  passthru.updateScript = nix-update-script { extraArgs = [ "--version-regex=release-(.*)" ]; };
+  passthru = {
+    updateScript = nix-update-script { extraArgs = [ "--version-regex=release-(.*)" ]; };
+    tests.testService = nixosTests.qbittorrent;
+  };

  meta = {
    description = "Featureful free software BitTorrent client";
@@ -5,7 +5,7 @@
  fetchurl,
  makeBinaryWrapper,
  # use specific electron since it has to load a compiled module
-  electron_36,
+  electron_37,
  autoPatchelfHook,
  makeDesktopItem,
  copyDesktopItems,
@@ -15,10 +15,10 @@

 let
  pname = "trilium-next-desktop";
-  version = "0.95.0";
+  version = "0.97.1";

  triliumSource = os: arch: sha256: {
-    url = "https://github.com/TriliumNext/Notes/releases/download/v${version}/TriliumNextNotes-v${version}-${os}-${arch}.zip";
+    url = "https://github.com/TriliumNext/Trilium/releases/download/v${version}/TriliumNotes-v${version}-${os}-${arch}.zip";
    inherit sha256;
  };

@@ -26,10 +26,10 @@ let
  darwinSource = triliumSource "macos";

  # exposed like this for update.sh
-  x86_64-linux.sha256 = "1lykzd1spvl6x6xm2qhw5bzcs9pbcars686gwbirscr53fb7q841";
-  aarch64-linux.sha256 = "0bxrsj1g8dgg9rd6s0aj9jm2w6nk9yn6b1xgiab8kn298p3iqz64";
-  x86_64-darwin.sha256 = "16cv52c6jn5ah5ccdfxffwrmf6vz8d4q4rj0v5ny4m0g0al78isg";
-  aarch64-darwin.sha256 = "0v388frd4skpilxn8i5isd9xgn0qs9zszfs3h75q3qpx4xz355ps";
+  x86_64-linux.sha256 = "1lb1mp031pa4wg6wrp8l84vw1glmqc27l4gf85a47bi4b63das2l";
+  aarch64-linux.sha256 = "1yrxk8q2aafgcvipwhkwmjidymwia0dgqnhchhngmris6zrbb3wj";
+  x86_64-darwin.sha256 = "0d8li5h2rn3iyzxsbs4g7a98zzdn58x4iwhzvxcjxy7b6h4hldvg";
+  aarch64-darwin.sha256 = "07r1rw84mlszr2bzjwz62lsy14j9xm22li2ksdc4ra93q58kmip1";

  sources = {
    x86_64-linux = linuxSource "x64" x86_64-linux.sha256;
@@ -111,7 +111,7 @@ let
      asar pack $tmp/ $out/share/trilium/resources/app.asar
      rm -rf $tmp

-      makeWrapper ${lib.getExe electron_36} $out/bin/trilium \
+      makeWrapper ${lib.getExe electron_37} $out/bin/trilium \
        "''${gappsWrapperArgs[@]}" \
        --set-default ELECTRON_IS_DEV 0 \
        --add-flags $out/share/trilium/resources/app.asar
@@ -8,22 +8,22 @@ setKV () {
    sed -i "s|$2 = \".*\"|$2 = \"${3:-}\"|" $1
 }

-version=$(curl -s --show-error "https://api.github.com/repos/TriliumNext/Notes/releases/latest" | jq -r '.tag_name' | tail -c +2)
+version=$(curl -s --show-error "https://api.github.com/repos/TriliumNext/Trilium/releases/latest" | jq -r '.tag_name' | tail -c +2)
 setKV ./package.nix version $version

 # Update desktop application
-sha256_linux64=$(nix-prefetch-url --quiet https://github.com/TriliumNext/Notes/releases/download/v${version}/TriliumNextNotes-v${version}-linux-x64.zip)
-sha256_linux64_arm=$(nix-prefetch-url --quiet https://github.com/TriliumNext/Notes/releases/download/v${version}/TriliumNextNotes-v${version}-linux-arm64.zip)
-sha256_darwin64=$(nix-prefetch-url --quiet https://github.com/TriliumNext/Notes/releases/download/v${version}/TriliumNextNotes-v${version}-macos-x64.zip)
-sha256_darwin64_arm=$(nix-prefetch-url --quiet https://github.com/TriliumNext/Notes/releases/download/v${version}/TriliumNextNotes-v${version}-macos-arm64.zip)
+sha256_linux64=$(nix-prefetch-url --quiet https://github.com/TriliumNext/Trilium/releases/download/v${version}/TriliumNotes-v${version}-linux-x64.zip)
+sha256_linux64_arm=$(nix-prefetch-url --quiet https://github.com/TriliumNext/Trilium/releases/download/v${version}/TriliumNotes-v${version}-linux-arm64.zip)
+sha256_darwin64=$(nix-prefetch-url --quiet https://github.com/TriliumNext/Trilium/releases/download/v${version}/TriliumNotes-v${version}-macos-x64.zip)
+sha256_darwin64_arm=$(nix-prefetch-url --quiet https://github.com/TriliumNext/Trilium/releases/download/v${version}/TriliumNotes-v${version}-macos-arm64.zip)
 setKV ./package.nix x86_64-linux.sha256 $sha256_linux64
 setKV ./package.nix aarch64-linux.sha256 $sha256_linux64_arm
 setKV ./package.nix x86_64-darwin.sha256 $sha256_darwin64
 setKV ./package.nix aarch64-darwin.sha256 $sha256_darwin64_arm

 # Update server
-sha256_linux64_server=$(nix-prefetch-url --quiet https://github.com/TriliumNext/Notes/releases/download/v${version}/TriliumNextNotes-Server-v${version}-linux-x64.tar.xz)
-sha256_linux64_server_arm=$(nix-prefetch-url --quiet https://github.com/TriliumNext/Notes/releases/download/v${version}/TriliumNextNotes-Server-v${version}-linux-arm64.tar.xz)
+sha256_linux64_server=$(nix-prefetch-url --quiet https://github.com/TriliumNext/Trilium/releases/download/v${version}/TriliumNotes-Server-v${version}-linux-x64.tar.xz)
+sha256_linux64_server_arm=$(nix-prefetch-url --quiet https://github.com/TriliumNext/Trilium/releases/download/v${version}/TriliumNotes-Server-v${version}-linux-arm64.tar.xz)
 setKV ../trilium-next-server/package.nix version $version
 setKV ../trilium-next-server/package.nix serverSource_x64.sha256 $sha256_linux64_server
 setKV ../trilium-next-server/package.nix serverSource_arm64.sha256 $sha256_linux64_server_arm
@@ -7,12 +7,12 @@
 }:

 let
-  version = "0.95.0";
+  version = "0.97.1";

-  serverSource_x64.url = "https://github.com/TriliumNext/Notes/releases/download/v${version}/TriliumNextNotes-Server-v${version}-linux-x64.tar.xz";
-  serverSource_x64.sha256 = "1rjl38i6l894kwpmc925amf9zbwyjlc4sqh3skm1f13vhv9pj9dx";
-  serverSource_arm64.url = "https://github.com/TriliumNext/Notes/releases/download/v${version}/TriliumNextNotes-Server-v${version}-linux-arm64.tar.xz";
-  serverSource_arm64.sha256 = "1rpzc13vdp5b3iwwc1l6h78nb5iairlxbflwvjwhy1149lpqnn8m";
+  serverSource_x64.url = "https://github.com/TriliumNext/Trilium/releases/download/v${version}/TriliumNotes-Server-v${version}-linux-x64.tar.xz";
+  serverSource_x64.sha256 = "1y0ass5b3c8qx28b31x2h7i1rlvdyjimsklgjpv8d47micsg6m7z";
+  serverSource_arm64.url = "https://github.com/TriliumNext/Trilium/releases/download/v${version}/TriliumNotes-Server-v${version}-linux-arm64.tar.xz";
+  serverSource_arm64.sha256 = "12bnmbm1p98633xsyxq6rr05jl79bn820915a0gmq14np7vskhmp";

  serverSource =
    if stdenv.hostPlatform.isx86_64 then
@@ -1,15 +1,17 @@
 {
  lib,
  python3Packages,
-  fetchPypi,
+  fetchFromGitHub,
  ffmpeg-headless,
  rtmpdump,
  atomicparsley,
+  pandoc,
+  installShellFiles,
  atomicparsleySupport ? true,
  ffmpegSupport ? true,
  rtmpSupport ? true,
  withAlias ? false, # Provides bin/youtube-dl for backcompat
-  update-python-libraries,
+  nix-update-script,
 }:

 python3Packages.buildPythonApplication rec {
@@ -17,17 +19,21 @@ python3Packages.buildPythonApplication rec {
  # The websites yt-dlp deals with are a very moving target. That means that
  # downloads break constantly. Because of that, updates should always be backported
  # to the latest stable release.
-  version = "2025.6.30";
+  version = "2025.06.30";
  pyproject = true;

-  src = fetchPypi {
-    inherit version;
-    pname = "yt_dlp";
-    hash = "sha256-bQroVcClW/zCjf+6gE7IUlublV00pBGRoVYaTOwD2L0=";
+  src = fetchFromGitHub {
+    owner = "yt-dlp";
+    repo = "yt-dlp";
+    tag = version;
+    hash = "sha256-dwBe6oXh7G67kfiI6BqiC0ZHzleR7QlfMiTVXWYW85I=";
  };

-  build-system = with python3Packages; [
-    hatchling
+  build-system = with python3Packages; [ hatchling ];
+
+  nativeBuildInputs = [
+    installShellFiles
+    pandoc
  ];

  # expose optional-dependencies, but provide all features
@@ -52,6 +58,21 @@ python3Packages.buildPythonApplication rec {

  pythonRelaxDeps = [ "websockets" ];

+  preBuild = ''
+    python devscripts/make_lazy_extractors.py
+  '';
+
+  postBuild = ''
+    python devscripts/prepare_manpage.py yt-dlp.1.temp.md
+    pandoc -s -f markdown-smart -t man yt-dlp.1.temp.md -o yt-dlp.1
+    rm yt-dlp.1.temp.md
+
+    mkdir -p completions/{bash,fish,zsh}
+    python devscripts/bash-completion.py completions/bash/yt-dlp
+    python devscripts/zsh-completion.py completions/zsh/_yt-dlp
+    python devscripts/fish-completion.py completions/fish/yt-dlp.fish
+  '';
+
  # Ensure these utilities are available in $PATH:
  # - ffmpeg: post-processing & transcoding support
  # - rtmpdump: download files over RTMP
@@ -68,25 +89,31 @@ python3Packages.buildPythonApplication rec {
      ''--prefix PATH : "${lib.makeBinPath packagesToBinPath}"''
    ];

-  setupPyBuildFlags = [
-    "build_lazy_extractors"
-  ];
-
  # Requires network
  doCheck = false;

-  postInstall = lib.optionalString withAlias ''
-    ln -s "$out/bin/yt-dlp" "$out/bin/youtube-dl"
-  '';
+  postInstall =
+    ''
+      installManPage yt-dlp.1

-  passthru.updateScript = [
-    update-python-libraries
-    (toString ./.)
-  ];
+      installShellCompletion \
+        --bash completions/bash/yt-dlp \
+        --fish completions/fish/yt-dlp.fish \
+        --zsh completions/zsh/_yt-dlp

-  meta = with lib; {
-    homepage = "https://github.com/yt-dlp/yt-dlp/";
+      install -Dm644 Changelog.md README.md -t "$out/share/doc/yt_dlp"
+    ''
+    + lib.optionalString withAlias ''
+      ln -s "$out/bin/yt-dlp" "$out/bin/youtube-dl"
+    '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    changelog = "https://github.com/yt-dlp/yt-dlp/blob/${version}/Changelog.md";
    description = "Command-line tool to download videos from YouTube.com and other sites (youtube-dl fork)";
+    homepage = "https://github.com/yt-dlp/yt-dlp/";
+    license = lib.licenses.unlicense;
    longDescription = ''
      yt-dlp is a youtube-dl fork based on the now inactive youtube-dlc.

@@ -95,12 +122,10 @@ python3Packages.buildPythonApplication rec {
      youtube-dl is released to the public domain, which means
      you can modify it, redistribute it or use it however you like.
    '';
-    changelog = "https://github.com/yt-dlp/yt-dlp/blob/HEAD/Changelog.md";
-    license = licenses.unlicense;
-    maintainers = with maintainers; [
+    mainProgram = "yt-dlp";
+    maintainers = with lib.maintainers; [
      SuperSandro2000
      donteatoreo
    ];
-    mainProgram = "yt-dlp";
  };
 }
@@ -24,22 +24,29 @@ buildPythonPackage rec {
    hash = "sha256-U20mBg+428kkka6NY9qc7X8jH8A5bKa++g2+PTn/MYg=";
  };

-  postPatch = ''
-    # default to store ffmpeg
-    substituteInPlace ffmpy/ffmpy.py \
-      --replace-fail \
-        'executable: str = "ffmpeg",' \
-        'executable: str = "${ffmpeg-headless}/bin/ffmpeg",'
-
-    #  The tests test a mock that does not behave like ffmpeg. If we default to the nix-store ffmpeg they fail.
-    for fname in tests/*.py; do
-      echo >>"$fname" 'FFmpeg.__init__.__defaults__ = ("ffmpeg", *FFmpeg.__init__.__defaults__[1:])'
-    done
-  '';
+  postPatch =
+    # Default to store ffmpeg.
+    ''
+      substituteInPlace ffmpy/ffmpy.py \
+        --replace-fail \
+          'executable: str = "ffmpeg",' \
+          'executable: str = "${lib.getExe ffmpeg-headless}",'
+    ''
+    # The tests test a mock that does not behave like ffmpeg. If we default to the nix-store ffmpeg they fail.
+    + ''
+      for fname in tests/*.py; do
+        echo >>"$fname" 'FFmpeg.__init__.__defaults__ = ("ffmpeg", *FFmpeg.__init__.__defaults__[1:])'
+      done
+    ''
+    # uv-build in nixpkgs is now at 0.8.0, which otherwise breaks the constraint set by the package.
+    + ''
+      substituteInPlace pyproject.toml \
+        --replace-fail 'requires = ["uv_build>=0.7.9,<0.8.0"]' 'requires = ["uv_build>=0.7.9,<0.9.0"]'
+    '';

  pythonImportsCheck = [ "ffmpy" ];

-  nativeBuildInputs = [ uv-build ];
+  build-system = [ uv-build ];

  nativeCheckInputs = [
    pytestCheckHook
@@ -39,14 +39,14 @@ let
 in
 buildPythonPackage rec {
  pname = "llama-cpp-python";
-  version = "0.3.12";
+  version = "0.3.14";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "abetlen";
    repo = "llama-cpp-python";
    tag = "v${version}";
-    hash = "sha256-TTGweGfav1uI2+87iUYc1Esmuor9sEZdZqSU2YVPCdQ=";
+    hash = "sha256-RJP2QkelqxZuEoxI3CHyenqUJdjw2MsZKUKM+UUxJB8=";
    fetchSubmodules = true;
  };
  # src = /home/gaetan/llama-cpp-python;
@@ -26,7 +26,7 @@
 }:
 buildPythonPackage rec {
  pname = "nanobind";
-  version = "2.7.0";
+  version = "2.8.0";
  pyproject = true;

  src = fetchFromGitHub {
@@ -34,7 +34,7 @@ buildPythonPackage rec {
    repo = "nanobind";
    tag = "v${version}";
    fetchSubmodules = true;
-    hash = "sha256-ex5svqDp9XJtiNCxu0249ORL6LbG679U6PvKQaWANmE=";
+    hash = "sha256-GGYnyO8eILYNu7va2tMB0QJkBCRDMIfRQO4a9geV49Y=";
  };

  build-system = [
@@ -17,20 +17,18 @@

 buildPythonPackage rec {
  pname = "pysilero-vad";
-  version = "2.1.0";
+  version = "2.1.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "rhasspy";
    repo = "pysilero-vad";
    tag = "v${version}";
-    hash = "sha256-h49AD3ICh0NYyh2EDogynQ0qgkKCAQTVKS9rbXbrqPE=";
+    hash = "sha256-zxvYvPnL99yIVHrzbRbKmTazzlefOS+s2TAWLweRSYE=";
  };

  build-system = [ setuptools ];

-  pythonRelaxDeps = [ "numpy" ];
-
  dependencies = [
    numpy
    onnxruntime
@@ -28,14 +28,14 @@

 buildPythonPackage rec {
  pname = "sagemaker-core";
-  version = "1.0.42";
+  version = "1.0.45";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "aws";
    repo = "sagemaker-core";
    tag = "v${version}";
-    hash = "sha256-To4VjTuE9fkVQSXR1k6NMAjrByzFhAidvui8w+etOQc=";
+    hash = "sha256-/NXSuDQAhRQ5RuYV1Eaat0TjMzqj1IYp3LECmTISoK8=";
  };

  build-system = [
@@ -17,7 +17,7 @@

 buildPythonPackage rec {
  pname = "scim2-client";
-  version = "0.5.1";
+  version = "0.5.2";

  pyproject = true;

@@ -26,7 +26,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    inherit version;
    pname = "scim2_client";
-    hash = "sha256-g2RR+Ruvjw88cGHcwEPoktTmB8VcWAPnea3BErS8JyI=";
+    hash = "sha256-viIriAFyfJVrJRr04GBD3dhaQ+iUVujigsx1ucSSeqA=";
  };

  build-system = [ hatchling ];
@@ -94,8 +94,6 @@ let
    # cgit) that are needed here should be included directly in Nixpkgs as
    # files.

-    assert stdenv.hostPlatform.isLinux;
-
    let
      # Dirty hack to make sure that `version` & `src` have
      # `<nixpkgs/pkgs/os-specific/linux/kernel/linux-x.y.nix>` as position
@@ -23,9 +23,9 @@ let
    };
    # ./update-zen.py lqx
    lqx = {
-      version = "6.15.6"; # lqx
+      version = "6.15.7"; # lqx
      suffix = "lqx1"; # lqx
-      sha256 = "092yz6r6wzkafr0rafb1qdapghjwr33dlx3id5jn03jkq4g8jgmd"; # lqx
+      sha256 = "05pr17hqrlf4jfw3fxja9n0lfs4piy03fh4wqjhbd601sjif6akh"; # lqx
      isLqx = true;
    };
  };
@@ -55,5 +55,6 @@ stdenv.mkDerivation rec {
      mic92
      mbbx6spp
    ];
+    platforms = lib.platforms.linux;
  };
 }
@@ -0,0 +1,25 @@
+{
+  lib,
+  buildHomeAssistantComponent,
+  fetchFromGitHub,
+}:
+
+buildHomeAssistantComponent rec {
+  owner = "Lash-L";
+  domain = "roborock_custom_map";
+  version = "0.1.1";
+
+  src = fetchFromGitHub {
+    owner = "Lash-L";
+    repo = "RoborockCustomMap";
+    tag = version;
+    hash = "sha256-ZKaUTUTN0tTW8bks0TYixfmbEa7A7ERdJ+xZ365HEbU=";
+  };
+
+  meta = {
+    description = "This allows you to use the core Roborock integration with the Xiaomi Map Card";
+    homepage = "https://github.com/Lash-L/RoborockCustomMap";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ kranzes ];
+  };
+}
@@ -6,11 +6,11 @@

 stdenv.mkDerivation rec {
  pname = "advanced-camera-card";
-  version = "7.14.2";
+  version = "7.14.3";

  src = fetchzip {
    url = "https://github.com/dermotduffy/advanced-camera-card/releases/download/v${version}/advanced-camera-card.zip";
-    hash = "sha256-I4ZrkhrwP+b7IHNWbGpGPmlH9CP7o2mFTfN5J1fOY/E=";
+    hash = "sha256-pbca+z0abg2aeffBZ3yqfz7nbR+sqQgvRUML2DH0tIY=";
  };

  # TODO: build from source once yarn berry support lands in nixpkgs
@@ -21,14 +21,14 @@ let
    label = "test";
  };
 in
-pkgs.recurseIntoAttrs {
-
-  nixos-test =
-    (pkgs.nixos {
-      system.nixos = dummyVersioning;
-      boot.loader.grub.enable = false;
-      fileSystems."/".device = "/dev/null";
-      system.stateVersion = lib.trivial.release;
-    }).toplevel;
-
-}
+lib.optionalAttrs (stdenv.hostPlatform.isLinux) (
+  pkgs.recurseIntoAttrs {
+    nixos-test =
+      (pkgs.nixos {
+        system.nixos = dummyVersioning;
+        boot.loader.grub.enable = false;
+        fileSystems."/".device = "/dev/null";
+        system.stateVersion = lib.trivial.release;
+      }).toplevel;
+  }
+)
@@ -6855,9 +6855,9 @@ with pkgs;
      electron-source.electron_37
    else
      electron_37-bin;
-  electron = electron_35;
-  electron-bin = electron_35-bin;
-  electron-chromedriver = electron-chromedriver_35;
+  electron = electron_37;
+  electron-bin = electron_37-bin;
+  electron-chromedriver = electron-chromedriver_37;

  autoconf = callPackage ../development/tools/misc/autoconf { };
  autoconf213 = callPackage ../development/tools/misc/autoconf/2.13.nix { };