Merge e3e90b8e62 into haskell-updates

2025-02-11 00:17:52 +00:00
parent ed1a9eb863 e3e90b8e62
commit a9df14cc6a
207 changed files with 2258 additions and 803 deletions
@@ -19,7 +19,7 @@ jobs:
    steps:
      # Use a GitHub App to create the PR so that CI gets triggered
      # The App is scoped to Repository > Contents and Pull Requests: write for Nixpkgs
-      - uses: actions/create-github-app-token@c1a285145b9d317df6ced56c09f525b5c2b6f755 # v1.11.1
+      - uses: actions/create-github-app-token@67e27a7eb7db372a1c61a7f9bdab8699e9ee57f7 # v1.11.3
        id: app-token
        with:
          app-id: ${{ vars.NIXPKGS_CI_APP_ID }}
@@ -63,7 +63,7 @@ jobs:
      - name: Build codeowners validator
        run: nix-build base/ci -A codeownersValidator

-      - uses: actions/create-github-app-token@c1a285145b9d317df6ced56c09f525b5c2b6f755 # v1.11.1
+      - uses: actions/create-github-app-token@67e27a7eb7db372a1c61a7f9bdab8699e9ee57f7 # v1.11.3
        id: app-token
        with:
          app-id: ${{ vars.OWNER_RO_APP_ID }}
@@ -96,7 +96,7 @@ jobs:
      # This is intentional, because we need to request the review of owners as declared in the base branch.
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

-      - uses: actions/create-github-app-token@c1a285145b9d317df6ced56c09f525b5c2b6f755 # v1.11.1
+      - uses: actions/create-github-app-token@67e27a7eb7db372a1c61a7f9bdab8699e9ee57f7 # v1.11.3
        id: app-token
        with:
          app-id: ${{ vars.OWNER_APP_ID }}
@@ -241,7 +241,7 @@ jobs:
    steps:
      # See ./codeowners-v2.yml, reuse the same App because we need the same permissions
      # Can't use the token received from permissions above, because it can't get enough permissions
-      - uses: actions/create-github-app-token@c1a285145b9d317df6ced56c09f525b5c2b6f755 # v1.11.1
+      - uses: actions/create-github-app-token@67e27a7eb7db372a1c61a7f9bdab8699e9ee57f7 # v1.11.3
        id: app-token
        with:
          app-id: ${{ vars.OWNER_APP_ID }}
@@ -19,7 +19,7 @@ jobs:
    steps:
      # Use a GitHub App to create the PR so that CI gets triggered
      # The App is scoped to Repository > Contents and Pull Requests: write for Nixpkgs
-      - uses: actions/create-github-app-token@c1a285145b9d317df6ced56c09f525b5c2b6f755 # v1.11.1
+      - uses: actions/create-github-app-token@67e27a7eb7db372a1c61a7f9bdab8699e9ee57f7 # v1.11.3
        id: app-token
        with:
          app-id: ${{ vars.NIXPKGS_CI_APP_ID }}
@@ -86,6 +86,9 @@
    "index.html#building-a-titanium-app",
    "index.html#emulating-or-simulating-the-app"
  ],
+  "sec-nixpkgs-release-25.05-incompatibilities-nexusmods-app-upgraded": [
+    "release-notes.html#sec-nixpkgs-release-25.05-incompatibilities-nexusmods-app-upgraded"
+  ],
  "sec-nixpkgs-release-25.05-lib": [
    "release-notes.html#sec-nixpkgs-release-25.05-lib"
  ],
@@ -18,6 +18,16 @@

 - `titaniumenv`, `titanium`, and `titanium-alloy` have been removed due to lack of maintenance in Nixpkgs.

+### NexusMods.App upgraded {#sec-nixpkgs-release-25.05-incompatibilities-nexusmods-app-upgraded}
+
+- `nexusmods-app` has been upgraded from version 0.6.3 to 0.7.3.
+
+  - Before upgrading, you **must reset all app state** (mods, games, settings, etc). NexusMods.App will crash if any state from a version older than 0.7.0 is still present.
+
+  - Typically, you can can reset to a clean state by running `NexusMods.App uninstall-app`. See Nexus Mod's [how to uninstall the app](https://nexus-mods.github.io/NexusMods.App/users/Uninstall) documentation for more detail and alternative methods.
+
+  - This should not be necessary going forward, because loading app state from 0.7.0 or newer is now supported. This is documented in the [0.7.1 changelog](https://github.com/Nexus-Mods/NexusMods.App/releases/tag/v0.7.1).
+
 ## Nixpkgs Library {#sec-nixpkgs-release-25.05-lib}

 ### Breaking changes {#sec-nixpkgs-release-25.05-lib-breaking}
@@ -2612,4 +2612,45 @@ runTests {
    };
    expected = "c";
  };
+
+  testMergeTypesSimple =
+    let
+      mergedType = types.mergeTypes types.str types.str;
+    in
+  {
+    expr = mergedType.name;
+    expected = "str";
+  };
+
+  testMergeTypesFail =
+    let
+      mergedType = types.mergeTypes types.str types.int;
+    in
+  {
+    expr = types.isType "merge-error" mergedType;
+    expected = true;
+  };
+
+  testMergeTypesEnum =
+    let
+      enumAB = lib.types.enum ["A" "B"];
+      enumXY = lib.types.enum ["X" "Y"];
+      merged = lib.types.mergeTypes enumAB enumXY; # -> enum [ "A" "B" "X" "Y" ]
+    in
+  {
+    expr = {
+      checkA = merged.check "A";
+      checkB = merged.check "B";
+      checkX = merged.check "X";
+      checkY = merged.check "Y";
+      checkC = merged.check "C";
+    };
+    expected = {
+      checkA = true;
+      checkB = true;
+      checkX = true;
+      checkY = true;
+      checkC = false;
+    };
+  };
 }
@@ -1125,6 +1125,53 @@ rec {
    addCheck = elemType: check: elemType // { check = x: elemType.check x && check x; };

  };
+
+  /**
+    Merges two option types together.
+
+    :::{.note}
+    Uses the type merge function of the first type, to merge it with the second type.
+
+    Usually types can only be merged if they are of the same type
+    :::
+
+    # Inputs
+
+    : `a` (option type): The first option type.
+    : `b` (option type): The second option type.
+
+    # Returns
+
+    - The merged option type.
+    - `{ _type = "merge-error"; error = "Cannot merge types"; }` if the types can't be merged.
+
+    # Examples
+    :::{.example}
+    ## `lib.types.mergeTypes` usage example
+    ```nix
+    let
+      enumAB = lib.types.enum ["A" "B"];
+      enumXY = lib.types.enum ["X" "Y"];
+      # This operation could be notated as: [ A ] | [ B ] -> [ A B ]
+      merged = lib.types.mergeTypes enumAB enumXY; # -> enum [ "A" "B" "X" "Y" ]
+    in
+      assert merged.check "A"; # true
+      assert merged.check "B"; # true
+      assert merged.check "X"; # true
+      assert merged.check "Y"; # true
+      merged.check "C" # false
+    ```
+    :::
+  */
+  mergeTypes = a: b:
+    assert isOptionType a && isOptionType b;
+    let
+      merged = a.typeMerge b.functor;
+    in
+    if merged == null then
+      setType "merge-error" { error = "Cannot merge types"; }
+    else
+      merged;
 };

 in outer_types // outer_types.types
@@ -121,6 +121,7 @@ neotest,,,,,,mrcjkb
 nlua,,,,,,teto
 nui.nvim,,,,,,mrcjkb
 nvim-cmp,https://raw.githubusercontent.com/hrsh7th/nvim-cmp/main/nvim-cmp-scm-1.rockspec,,,,,
+nvim-dbee,,,,,,perchun
 nvim-nio,,,,,,mrcjkb
 orgmode,,,,,,
 papis-nvim,,,,,,GaetanLepage
@@ -1922,6 +1922,9 @@
    "index.html#building-a-titanium-app",
    "index.html#emulating-or-simulating-the-app"
  ],
+  "sec-nixpkgs-release-25.05-incompatibilities-nexusmods-app-upgraded": [
+    "release-notes.html#sec-nixpkgs-release-25.05-incompatibilities-nexusmods-app-upgraded"
+  ],
  "sec-nixpkgs-release-25.05-lib": [
    "release-notes.html#sec-nixpkgs-release-25.05-lib"
  ],
@@ -116,6 +116,8 @@

 - [waagent](https://github.com/Azure/WALinuxAgent), the Microsoft Azure Linux Agent (waagent) manages Linux provisioning and VM interaction with the Azure Fabric Controller. Available with [services.waagent](options.html#opt-services.waagent.enable).

+- [nfc-nci](https://github.com/StarGate01/ifdnfc-nci), an alternative NFC stack and PC/SC driver for the NXP PN54x chipset, commonly found in Lenovo systems as NXP1001 (NPC300). Available as [hardware.nfc-nci](#opt-hardware.nfc-nci.enable).
+
 - [duckdns](https://www.duckdns.org), free dynamic DNS. Available with [services.duckdns](options.html#opt-services.duckdns.enable)

 - [nostr-rs-relay](https://git.sr.ht/~gheartsfield/nostr-rs-relay/), This is a nostr relay, written in Rust. Available as [services.nostr-rs-relay](options.html#opt-services.nostr-rs-relay.enable).
@@ -772,7 +772,7 @@ class Machine:
            retry(tty_matches, timeout)

    def send_chars(self, chars: str, delay: float | None = 0.01) -> None:
-        """
+        r"""
        Simulate typing a sequence of characters on the virtual keyboard,
        e.g., `send_chars("foobar\n")` will type the string `foobar`
        followed by the Enter key.
@@ -0,0 +1,205 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.hardware.nfc-nci;
+
+  # To understand these settings in more detail, refer to the upstream configuration templates
+  # available at https://github.com/NXPNFCLinux/linux_libnfc-nci/tree/master/conf .
+  # Settings in curly braces are NCI commands, the "NFC Controller Interface Specification"
+  # as well as the "NFC Digital Protocol Technical Specification" can be found online.
+  # These default settings have been specifically engineered for the Lenovo NXP1001 (NPC300) chipset.
+  defaultSettings = {
+    # This block will be emitted into /etc/libnfc-nci.conf
+    nci = {
+      # Set up general logging
+      APPL_TRACE_LEVEL = "0x01";
+      PROTOCOL_TRACE_LEVEL = "0x01";
+      # Set up which NFC technologies are enabled (due to e.g. local regulation or patent law)
+      HOST_LISTEN_TECH_MASK = "0x07";
+      POLLING_TECH_MASK = "0xEF";
+      P2P_LISTEN_TECH_MASK = "0xC5";
+    };
+    # This block will be emitted into /etc/libnfc-nxp-init.conf
+    init = {
+      # Setup logging of the individual userland library components
+      NXPLOG_GLOBAL_LOGLEVEL = "0x01";
+      NXPLOG_EXTNS_LOGLEVEL = "0x01";
+      NXPLOG_NCIHAL_LOGLEVEL = "0x01";
+      NXPLOG_NCIX_LOGLEVEL = "0x01";
+      NXPLOG_NCIR_LOGLEVEL = "0x01";
+      NXPLOG_FWDNLD_LOGLEVEL = "0x00";
+      NXPLOG_TML_LOGLEVEL = "0x01";
+      # Where to find the kernel device node
+      NXP_NFC_DEV_NODE = ''"/dev/pn544"'';
+      # Enable the NXP proprietary features of the chip
+      NXP_ACT_PROP_EXTN = "{2F, 02, 00}";
+      # Configure the NFC Forum profile:
+      # 0xA0 0x44: POLL_PROFILE_SEL_CFG = 0x00 (Use NFC Forum profile default configuration values. Specifically, not EMVCo.)
+      NXP_NFC_PROFILE_EXTN = ''
+        {20, 02, 05, 01,
+          A0, 44, 01, 00
+        }
+      '';
+      # Enable chip standby mode
+      NXP_CORE_STANDBY = "{2F, 00, 01, 01}";
+      # Enable NCI packet fragmentation on the I2C bus
+      NXP_I2C_FRAGMENTATION_ENABLED = "0x01";
+    };
+    # This block will be emitted into /etc/libnfc-nxp-pn547.conf as well as /etc/libnfc-nxp-pn548.conf
+    # Which file is actually used is decided by the library at runtime depending on chip variant, both files are required.
+    pn54x = {
+      # Enable Mifare Classic reader functionality
+      MIFARE_READER_ENABLE = "0x01";
+      # Configure clock source - use XTAL (hardware crystal) instead of PLL (synthetic clock)
+      NXP_SYS_CLK_SRC_SEL = "0x01";
+      NXP_SYS_CLK_FREQ_SEL = "0x00";
+      NXP_SYS_CLOCK_TO_CFG = "0x01";
+      # Configure the non-propriety NCI settings in EEPROM:
+      # 0x28: PN_NFC_DEP_SPEED = 0x00 (Data exchange: Highest Available Bit Rates)
+      # 0x21: PI_BIT_RATE = 0x00 (Maximum allowed bit rate: 106 Kbit/s)
+      # 0x30: LA_BIT_FRAME_SDD = 0x08 (Bit Frame SDD value to be sent in Byte 1 of SENS_RES)
+      # 0x31: LA_PLATFORM_CONFIG = 0x03 (Platform Configuration value to be sent in Byte 2 of SENS_RES)
+      # 0x33: LA_NFCID1 = [ 0x04 0x03 0x02 0x01 ] ("Unique" NFCID1 ID in SENS_RES)
+      # 0x54: LF_CON_BITR_F = 0x06 (Bit rates to listen for: Both)
+      # 0x50: LF_PROTOCOL_TYPE = 0x02 (Protocols supported in Listen Mode for NFC-F: NFC-DEP)
+      # 0x5B: LI_BIT_RATE = 0x00 (Maximum supported bit rate: 106 Kbit/s)
+      # 0x60: LN_WT = 0x0E (Waiting Time NFC-DEP WT_MAX default for Initiator)
+      # 0x80: RF_FIELD_INFO = 0x01 (Chip is allowed to emit RF Field Information Notifications)
+      # 0x81: RF_NFCEE_ACTION = 0x01 (Chip should send trigger notification for the default set of NFCEE actions)
+      # 0x82: NFCDEP_OP = 0x0E (NFC-DEP protocol behavior: Default flags, but also enable RTOX requests)
+      # 0x18: PF_BIT_RATE = 0x01 (NFC-F discovery polling initial bit rate: 106 Kbit/s)
+      NXP_CORE_CONF = ''
+        {20, 02, 2B, 0D,
+          28, 01, 00,
+          21, 01, 00,
+          30, 01, 08,
+          31, 01, 03,
+          33, 04, 04, 03, 02, 01,
+          54, 01, 06,
+          50, 01, 02,
+          5B, 01, 00,
+          60, 01, 0E,
+          80, 01, 01,
+          81, 01, 01,
+          82, 01, 0E,
+          18, 01, 01
+        }
+      '';
+      # Configure the proprietary NXP extension to the NCI standard in EEPROM:
+      # 0xA0 0x5E: JEWEL_RID_CFG = 0x01 (Enable sending RID to T1T on RF)
+      # 0xA0 0x40: TAG_DETECTOR_CFG = 0x00 (Tag detector: Disable both AGC based detection and trace mode)
+      # 0xA0 0x43: TAG_DETECTOR_FALLBACK_CNT_CFG = 0x00 (Tag detector: Disable hybrid mode, only use LPCD to initiate polling)
+      # 0xA0 0x0F: DH_EEPROM_AREA_1 = [ 32 bytes of opaque Lenovo data ] (Custom configuration for the Lenovo customized chip firmware)
+      # See also https://github.com/nfc-tools/libnfc/issues/455#issuecomment-2221979571
+      NXP_CORE_CONF_EXTN = ''
+        {20, 02, 30, 04,
+          A0, 5E, 01, 01,
+          A0, 40, 01, 00,
+          A0, 43, 01, 00,
+          A0, 0F, 20,
+          00, 03, 1D, 01, 03, 00, 02, 00,
+          01, 00, 01, 00, 00, 00, 00, 00,
+          00, 00, 00, 00, 00, 00, 00, 00,
+          00, 00, 00, 00, 00, 00, 00, 00
+        }
+      '';
+      # Firmware-specific protocol configuration parameters (one byte per protocol)
+      NXP_NFC_PROPRIETARY_CFG = "{05:FF:FF:06:81:80:70:FF:FF}";
+      # Configure power supply of chip, use Lenovo driver configuration, which deviates a bit from the spec:
+      # 0xA0 0x0E: PMU_CFG = [ 0x16, 0x09, 0x00 ] (VBAT1 connected to 5V, TVDD monitoring: 3.6V, TxLDO Voltage in reader and card mode: 3.3V)
+      NXP_EXT_TVDD_CFG = "0x01";
+      NXP_EXT_TVDD_CFG_1 = ''
+        {20, 02, 07, 01,
+          A0, 0E, 03, 16, 09, 00
+        }
+      '';
+      # Use the default for NFA_EE_MAX_EE_SUPPORTED stack size (concerns HCI)
+      NXP_NFC_MAX_EE_SUPPORTED = "0x00";
+    };
+  };
+
+  generateSettings =
+    cfgName:
+    let
+      toKeyValueLines =
+        obj: builtins.concatStringsSep "\n" (map (key: "${key}=${obj.${key}}") (builtins.attrNames obj));
+    in
+    toKeyValueLines (defaultSettings.${cfgName} // (cfg.settings.${cfgName} or { }));
+in
+{
+  options.hardware.nfc-nci = {
+    enable = lib.mkEnableOption "PN5xx kernel module with udev rules, libnfc-nci userland, and optional ifdnfc-nci PC/SC driver";
+
+    settings = lib.mkOption {
+      default = defaultSettings;
+      description = ''
+        Configuration to be written to the libncf-nci configuration files.
+        To understand the configuration format, refer to https://github.com/NXPNFCLinux/linux_libnfc-nci/tree/master/conf.
+      '';
+      type = lib.types.attrs;
+    };
+
+    enableIFD = lib.mkOption {
+      type = lib.types.bool;
+      default = true;
+      description = ''
+        Register ifdnfc-nci as a serial reader with pcscd.
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages =
+      [
+        pkgs.libnfc-nci
+      ]
+      ++ lib.optionals cfg.enableIFD [
+        pkgs.ifdnfc-nci
+      ];
+
+    environment.etc = {
+      "libnfc-nci.conf".text = generateSettings "nci";
+      "libnfc-nxp-init.conf".text = generateSettings "init";
+      "libnfc-nxp-pn547.conf".text = generateSettings "pn54x";
+      "libnfc-nxp-pn548.conf".text = generateSettings "pn54x";
+    };
+
+    services.udev.packages = [
+      config.boot.kernelPackages.nxp-pn5xx
+    ];
+
+    boot.blacklistedKernelModules = [
+      "nxp_nci_i2c"
+      "nxp_nci"
+    ];
+
+    boot.extraModulePackages = [
+      config.boot.kernelPackages.nxp-pn5xx
+    ];
+
+    boot.kernelModules = [
+      "nxp-pn5xx"
+    ];
+
+    services.pcscd.readerConfigs = lib.mkIf cfg.enableIFD [
+      ''
+        FRIENDLYNAME "NFC NCI"
+        LIBPATH      ${pkgs.ifdnfc-nci}/lib/libifdnfc-nci.so
+        CHANNELID    0
+      ''
+    ];
+
+    # NFC chip looses power when system goes to sleep / hibernate,
+    # and needs to be re-initialized upon wakeup
+    powerManagement.resumeCommands = lib.mkIf cfg.enableIFD ''
+      systemctl restart pcscd.service
+    '';
+  };
+
+  meta.maintainers = with lib.maintainers; [ stargate01 ];
+}
@@ -85,6 +85,7 @@
  ./hardware/network/eg25-manager.nix
  ./hardware/network/intel-2200bg.nix
  ./hardware/new-lg4ff.nix
+  ./hardware/nfc-nci.nix
  ./hardware/nitrokey.nix
  ./hardware/onlykey/default.nix
  ./hardware/openrazer.nix
@@ -159,7 +159,7 @@ in
      # https://github.com/emersion/xdg-desktop-portal-wlr/pull/315
      xdg.portal.config.sway = {
        # Use xdg-desktop-portal-gtk for every portal interface...
-        default = "gtk";
+        default = [ "gtk" ];
        # ... except for the ScreenCast, Screenshot and Secret
        "org.freedesktop.impl.portal.ScreenCast" = "wlr";
        "org.freedesktop.impl.portal.Screenshot" = "wlr";
@@ -1,11 +1,16 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 let
  cfg = config.services.pcscd;
-  cfgFile = pkgs.writeText "reader.conf" config.services.pcscd.readerConfig;
+  cfgFile = pkgs.writeText "reader.conf" (
+    builtins.concatStringsSep "\n\n" config.services.pcscd.readerConfigs
+  );

-  package = if config.security.polkit.enable
-              then pkgs.pcscliteWithPolkit
-              else pkgs.pcsclite;
+  package = if config.security.polkit.enable then pkgs.pcscliteWithPolkit else pkgs.pcsclite;

  pluginEnv = pkgs.buildEnv {
    name = "pcscd-plugins";
@@ -14,6 +19,20 @@ let

 in
 {
+  imports = [
+    (lib.mkChangedOptionModule
+      [ "services" "pcscd" "readerConfig" ]
+      [ "services" "pcscd" "readerConfigs" ]
+      (
+        config:
+        let
+          readerConfig = lib.getAttrFromPath [ "services" "pcscd" "readerConfig" ] config;
+        in
+        [ readerConfig ]
+      )
+    )
+  ];
+
  options.services.pcscd = {
    enable = lib.mkEnableOption "PCSC-Lite daemon, to access smart cards using SCard API (PC/SC)";

@@ -24,15 +43,17 @@ in
      description = "Plugin packages to be used for PCSC-Lite.";
    };

-    readerConfig = lib.mkOption {
-      type = lib.types.lines;
-      default = "";
-      example = ''
-        FRIENDLYNAME      "Some serial reader"
-        DEVICENAME        /dev/ttyS0
-        LIBPATH           /path/to/serial_reader.so
-        CHANNELID         1
-      '';
+    readerConfigs = lib.mkOption {
+      type = lib.types.listOf lib.types.lines;
+      default = [ ];
+      example = [
+        ''
+          FRIENDLYNAME      "Some serial reader"
+          DEVICENAME        /dev/ttyS0
+          LIBPATH           /path/to/serial_reader.so
+          CHANNELID         1
+        ''
+      ];
      description = ''
        Configuration for devices that aren't hotpluggable.

@@ -68,7 +89,10 @@ in
      # around it, we force the path to the cfgFile.
      #
      # https://github.com/NixOS/nixpkgs/issues/121088
-      serviceConfig.ExecStart = [ "" "${lib.getExe package} -f -x -c ${cfgFile} ${lib.escapeShellArgs cfg.extraArgs}" ];
+      serviceConfig.ExecStart = [
+        ""
+        "${lib.getExe package} -f -x -c ${cfgFile} ${lib.escapeShellArgs cfg.extraArgs}"
+      ];
    };
  };
 }
@@ -17,14 +17,17 @@ let

  validateConfig =
    file:
-    pkgs.runCommand "validate-nats-conf"
-      {
-        nativeBuildInputs = [ pkgs.nats-server ];
-      }
-      ''
-        nats-server --config "${configFile}" -t
-        ln -s "${configFile}" "$out"
-      '';
+    pkgs.callPackage (
+      { runCommand, nats-server }:
+      runCommand "validate-nats-conf"
+        {
+          nativeBuildInputs = [ nats-server ];
+        }
+        ''
+          nats-server --config "${configFile}" -t
+          ln -s "${configFile}" "$out"
+        ''
+    ) { };
 in
 {

@@ -2,6 +2,7 @@
  config,
  lib,
  pkgs,
+  utils,
  ...
 }:
 let
@@ -78,6 +79,23 @@ in
      '';
    };

+    services.journald.audit = lib.mkOption {
+      default = null;
+      type = lib.types.nullOr lib.types.bool;
+      description = ''
+        If enabled systemd-journald will turn on auditing on start-up.
+        If disabled it will turn it off. If unset it will neither enable nor disable it, leaving the previous state unchanged.
+
+        NixOS defaults to leaving this unset as enabling audit without auditd running leads to spamming /dev/kmesg with random messages
+        and if you enable auditd then auditd is responsible for turning auditing on.
+
+        If you want to have audit logs in journald and do not mind audit logs also ending up in /dev/kmesg you can set this option to true.
+
+        If you want to for some ununderstandable reason disable auditing if auditd enabled it then you can set this option to false.
+        It is of NixOS' opinion that setting this to false is definitely the wrong thing to do - but it's an option.
+      '';
+    };
+
    services.journald.extraConfig = lib.mkOption {
      default = "";
      type = lib.types.lines;
@@ -116,6 +134,11 @@ in
        "syslog.socket"
      ];

+    systemd.sockets.systemd-journald-audit.wantedBy = [
+      "systemd-journald.service"
+      "sockets.target"
+    ];
+
    environment.etc = {
      "systemd/journald.conf".text = ''
        [Journal]
@@ -129,6 +152,7 @@ in
        ${lib.optionalString (cfg.forwardToSyslog) ''
          ForwardToSyslog=yes
        ''}
+        Audit=${utils.systemdUtils.lib.toOption cfg.audit}
        ${cfg.extraConfig}
      '';
    };
@@ -7,12 +7,49 @@ import ./make-test-python.nix (
      maintainers = [ lewo ];
    };

-    nodes.machine = { };
+    nodes.machine = {
+      environment.systemPackages = [ pkgs.audit ];
+    };
+    nodes.auditd = {
+      security.auditd.enable = true;
+      environment.systemPackages = [ pkgs.audit ];
+    };
+    nodes.journaldAudit = {
+      services.journald.audit = true;
+      environment.systemPackages = [ pkgs.audit ];
+    };

    testScript = ''
      machine.wait_for_unit("multi-user.target")
-
      machine.succeed("journalctl --grep=systemd")
+
+      with subtest("no audit messages"):
+        machine.fail("journalctl _TRANSPORT=audit --grep 'unit=systemd-journald'")
+        machine.fail("journalctl _TRANSPORT=kernel --grep 'unit=systemd-journald'")
+
+      with subtest("auditd enabled"):
+        auditd.wait_for_unit("multi-user.target")
+
+        # logs should end up in the journald
+        auditd.succeed("journalctl _TRANSPORT=audit --grep 'unit=systemd-journald'")
+        # logs should end up in the auditd audit log
+        auditd.succeed("grep 'unit=systemd-journald' /var/log/audit/audit.log")
+        # logs should not end up in kmesg
+        machine.fail("journalctl _TRANSPORT=kernel --grep 'unit=systemd-journald'")
+
+
+      with subtest("journald audit"):
+        journaldAudit.wait_for_unit("multi-user.target")
+
+        # logs should end up in the journald
+        journaldAudit.succeed("journalctl _TRANSPORT=audit --grep 'unit=systemd-journald'")
+        # logs should NOT end up in audit log
+        journaldAudit.fail("grep 'unit=systemd-journald' /var/log/audit/audit.log")
+        # FIXME: If systemd fixes #15324 this test will start failing.
+        # You can fix this text by removing the below line.
+        # logs ideally should NOT end up in kmesg, but they do due to
+        # https://github.com/systemd/systemd/issues/15324
+        journaldAudit.succeed("journalctl _TRANSPORT=kernel --grep 'unit=systemd-journald'")
    '';
  }
 )
@@ -69,14 +69,13 @@ let

              driver.find_element(By.XPATH, "//button[contains(., 'Continue')]").click()

-              driver.find_element(By.CSS_SELECTOR, 'input#login_input_master-password').send_keys(
+              driver.find_element(By.XPATH, '//input[@type="password"]').send_keys(
                  '${userPassword}'
              )
-              driver.find_element(By.XPATH, "//button[contains(., 'Log in')]").click()
+              driver.find_element(By.XPATH, "//button[contains(., 'Log in with master password')]").click()

-              wait.until(EC.title_contains("Vaults"))
-
-              driver.find_element(By.XPATH, "//button[contains(., 'New item')]").click()
+              wait.until(EC.presence_of_element_located((By.CSS_SELECTOR, 'button#newItemDropdown'))).click()
+              driver.find_element(By.XPATH, "//button[contains(., 'Item')]").click()

              driver.find_element(By.CSS_SELECTOR, 'input#name').send_keys(
                  'secrets'
@@ -103,6 +103,13 @@ let
      ${pkgs.perl}/bin/perl -pe "s|\Q$NIX_STORE\E/[a-z0-9]{32}-|$NIX_STORE/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-|g" < "$luarc" > "$luarcGeneric"
    '' + buildCommand);

+  nvim_with_rocks_nvim = (
+    wrapNeovimUnstable neovim-unwrapped {
+      extraName = "with-rocks-nvim";
+      wrapperArgs = "--set NVIM_APPNAME test-rocks-nvim";
+      plugins = [ vimPlugins.rocks-nvim ];
+    }
+  );
 in
  pkgs.recurseIntoAttrs (rec {

@@ -367,5 +374,10 @@ in
    ${nvim-with-luasnip}/bin/nvim -i NONE --cmd "lua require'jsregexp'" -e +quitall!
  '';

+  inherit nvim_with_rocks_nvim;
+  rocks_install_plenary = runTest nvim_with_rocks_nvim ''
+    ${nvim_with_rocks_nvim}/bin/nvim -V3log.txt -i NONE +'Rocks install plenary.nvim' +quit! -e
+  '';
+
  inherit (vimPlugins) corePlugins;
 })
@@ -6,7 +6,7 @@
 }:
 vimUtils.buildVimPlugin {
  pname = "gitlab.vim";
-  version = "unstable-2025-01-23";
+  version = "0.1.1";

  src = fetchFromGitLab {
    owner = "gitlab-org/editor-extensions";
@@ -6,7 +6,7 @@
 }:
 vimUtils.buildVimPlugin {
  pname = "lsp_lines.nvim";
-  version = "unstable-2024-12-10";
+  version = "3.0.0";

  src = fetchFromSourcehut {
    owner = "~whynothugo";
@@ -1,9 +1,9 @@
 {
  lib,
  fetchFromGitHub,
-  nix-update-script,
+
+  # sniprun-bin
  rustPlatform,
-  vimUtils,
  makeWrapper,
  bashInteractive,
  coreutils,
@@ -11,21 +11,26 @@
  gnugrep,
  gnused,
  procps,
+
+  # sniprun
+  vimUtils,
+  substituteAll,
+  nix-update-script,
 }:
 let
-  version = "1.3.16";
+  version = "1.3.17";
  src = fetchFromGitHub {
    owner = "michaelb";
    repo = "sniprun";
    tag = "v${version}";
-    hash = "sha256-2rVeBUkdLXUiHkd8slyiLTYQBKwgMQvIi/uyCToVBYA=";
+    hash = "sha256-o8U3GXg61dfEzQxrs9zCgRDWonhr628aSPd/l+HxS70=";
  };
  sniprun-bin = rustPlatform.buildRustPackage {
    pname = "sniprun-bin";
    inherit version src;

    useFetchCargoVendor = true;
-    cargoHash = "sha256-j3i86I5Lmt0+fQONikHnxfeLEbiyFSairgjHXmjZfTk=";
+    cargoHash = "sha256-HLPTt0JCmCM4SRmP8o435ilM1yxoxpAnf8hg3+8C54I=";

    nativeBuildInputs = [ makeWrapper ];

@@ -44,17 +49,20 @@ let
    '';

    doCheck = false;
+
+    meta.mainProgram = "sniprun";
  };
 in
 vimUtils.buildVimPlugin {
  pname = "sniprun";
  inherit version src;

-  patches = [ ./fix-paths.patch ];
-
-  postPatch = ''
-    substituteInPlace lua/sniprun.lua --replace '@sniprun_bin@' ${sniprun-bin}
-  '';
+  patches = [
+    (substituteAll {
+      src = ./fix-paths.patch;
+      sniprun = lib.getExe sniprun-bin;
+    })
+  ];

  propagatedBuildInputs = [ sniprun-bin ];

@@ -69,7 +77,7 @@ vimUtils.buildVimPlugin {

  meta = {
    homepage = "https://github.com/michaelb/sniprun/";
-    changelog = "https://github.com/michaelb/sniprun/blob/${src.tag}/CHANGELOG.md";
+    changelog = "https://github.com/michaelb/sniprun/blob/v${version}/CHANGELOG.md";
    maintainers = with lib.maintainers; [ GaetanLepage ];
    license = lib.licenses.mit;
  };
@@ -1,5 +1,5 @@
 diff --git a/lua/sniprun.lua b/lua/sniprun.lua
-index 49be442..1834566 100644
+index 49be442..9342351 100644
 --- a/lua/sniprun.lua
 +++ b/lua/sniprun.lua
@@ -3,9 +3,7 @@ M.ping_anwsered = 0
@@ -9,7 +9,7 @@ index 49be442..1834566 100644
 -local binary_path = vim.fn.fnamemodify(
 -        vim.api.nvim_get_runtime_file("lua/sniprun.lua", false)[1], ":h:h")
 -    .. "/target/release/sniprun"
-+local binary_path = "@sniprun_bin@/bin/sniprun"
+local binary_path = "@sniprun@"
 
 local sniprun_path = vim.fn.fnamemodify(vim.api.nvim_get_runtime_file("lua/sniprun.lua", false)[1], ":p:h") .. "/.."
 
@@ -1761,6 +1761,13 @@ in
    dependencies = [ self.plenary-nvim ];
  };

+  mini-nvim = super.mini-nvim.overrideAttrs {
+    # reduce closure size
+    postInstall = ''
+      rm -rf $out/{Makefile,benchmarks,readmes,tests,scripts}
+    '';
+  };
+
  git-conflict-nvim = super.git-conflict-nvim.overrideAttrs {
    # TODO: Remove after next fixed version
    # https://github.com/akinsho/git-conflict.nvim/issues/103
@@ -2396,40 +2403,6 @@ in
    passthru.python3Dependencies = [ python3.pkgs.mwclient ];
  };

-  nvim-dbee = super.nvim-dbee.overrideAttrs (
-    oa:
-    let
-      dbee-go = buildGoModule {
-        name = "nvim-dbee";
-        src = "${oa.src}/dbee";
-        vendorHash = "sha256-U/3WZJ/+Bm0ghjeNUILsnlZnjIwk3ySaX3Rd4L9Z62A=";
-        buildInputs = [
-          arrow-cpp
-          duckdb
-        ];
-      };
-    in
-    {
-      dependencies = [ self.nui-nvim ];
-
-      # nvim-dbee looks for the go binary in paths returned bu M.dir() and M.bin() defined in lua/dbee/install/init.lua
-      postPatch = ''
-        substituteInPlace lua/dbee/install/init.lua \
-          --replace-fail 'return vim.fn.stdpath("data") .. "/dbee/bin"' 'return "${dbee-go}/bin"'
-      '';
-
-      preFixup = ''
-        mkdir $target/bin
-        ln -s ${dbee-go}/bin/dbee $target/bin/dbee
-      '';
-
-      meta.platforms = lib.platforms.linux;
-    }
-  );
-
-  nvim-impairative = super.nvim-impairative.overrideAttrs {
-  };
-
  nvim-navic = super.nvim-navic.overrideAttrs {
    dependencies = [ self.nvim-lspconfig ];
  };
@@ -4040,12 +4013,12 @@ in
      "neotest"
      "nui-nvim"
      "nvim-cmp"
+      "nvim-dbee"
      "nvim-nio"
      "orgmode"
      "papis-nvim"
      "rest-nvim"
      "rocks-config-nvim"
-      "rocks-nvim"
      "rtp-nvim"
      "telescope-manix"
      "telescope-nvim"
@@ -4058,3 +4031,20 @@ in
  in
  lib.genAttrs luarocksPackageNames toVimPackage
 )
+// {
+
+  rocks-nvim =
+    (neovimUtils.buildNeovimPlugin {
+      luaAttr = luaPackages.rocks-nvim;
+    }).overrideAttrs
+      (oa: {
+        passthru = oa.passthru // {
+          initLua = ''
+            vim.g.rocks_nvim = {
+              luarocks_binary = "${neovim-unwrapped.lua.pkgs.luarocks_bootstrap}/bin/luarocks"
+              }
+          '';
+        };
+
+      });
+}
@@ -12,17 +12,18 @@
  qtbase,
  qtimageformats,
  qtsvg,
+  qttools,
 }:

 mkDerivation rec {
  pname = "qimgv";
-  version = "1.0.3-alpha";
+  version = "1.0.3-unstable-2024-10-11";

  src = fetchFromGitHub {
    owner = "easymodo";
    repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-fHMSo8zlOl9Lt8nYwClUzON4TPB9Ogwven+TidsesxY=";
+    rev = "a4d475fae07847be7c106cb628fb97dad51ab920";
+    sha256 = "sha256-iURUJiPe8hbCnpaf6lk8OVSzVqrJKGab889yOic5yLI=";
  };

  nativeBuildInputs = [
@@ -41,6 +42,7 @@ mkDerivation rec {
    qtbase
    qtimageformats
    qtsvg
+    qttools
  ];

  postPatch = ''
@@ -85,20 +85,31 @@ python3.pkgs.buildPythonApplication rec {

  postPatch =
    ''
+      # fix compatibility with recent aiorpcx version
+      # (remove as soon as https://github.com/spesmilo/electrum/commit/171aa5ee5ad4e25b9da10f757d9d398e905b4945 is included in source tarball)
+      substituteInPlace ./contrib/requirements/requirements.txt \
+        --replace-fail "aiorpcx>=0.22.0,<0.24" "aiorpcx>=0.22.0,<0.25"
+      substituteInPlace ./run_electrum \
+        --replace-fail "if not ((0, 22, 0) <= aiorpcx._version < (0, 24)):" "if not ((0, 22, 0) <= aiorpcx._version < (0, 25)):" \
+        --replace-fail "aiorpcX version {aiorpcx._version} does not match required: 0.22.0<=ver<0.24" "aiorpcX version {aiorpcx._version} does not match required: 0.22.0<=ver<0.25"
+      substituteInPlace ./electrum/electrum \
+        --replace-fail "if not ((0, 22, 0) <= aiorpcx._version < (0, 24)):" "if not ((0, 22, 0) <= aiorpcx._version < (0, 25)):" \
+        --replace-fail "aiorpcX version {aiorpcx._version} does not match required: 0.22.0<=ver<0.24" "aiorpcX version {aiorpcx._version} does not match required: 0.22.0<=ver<0.25"
+
      # make compatible with protobuf4 by easing dependencies ...
      substituteInPlace ./contrib/requirements/requirements.txt \
-        --replace "protobuf>=3.20,<4" "protobuf>=3.20"
+        --replace-fail "protobuf>=3.20,<4" "protobuf>=3.20"
      # ... and regenerating the paymentrequest_pb2.py file
      protoc --python_out=. electrum/paymentrequest.proto

      substituteInPlace ./electrum/ecc_fast.py \
-        --replace ${libsecp256k1_name} ${secp256k1}/lib/libsecp256k1${stdenv.hostPlatform.extensions.sharedLibrary}
+        --replace-fail ${libsecp256k1_name} ${secp256k1}/lib/libsecp256k1${stdenv.hostPlatform.extensions.sharedLibrary}
    ''
    + (
      if enableQt then
        ''
          substituteInPlace ./electrum/qrscanner.py \
-            --replace ${libzbar_name} ${zbar.lib}/lib/libzbar${stdenv.hostPlatform.extensions.sharedLibrary}
+            --replace-fail ${libzbar_name} ${zbar.lib}/lib/libzbar${stdenv.hostPlatform.extensions.sharedLibrary}
        ''
      else
        ''
@@ -108,10 +119,8 @@ python3.pkgs.buildPythonApplication rec {

  postInstall = lib.optionalString stdenv.hostPlatform.isLinux ''
    substituteInPlace $out/share/applications/electrum.desktop \
-      --replace 'Exec=sh -c "PATH=\"\\$HOME/.local/bin:\\$PATH\"; electrum %u"' \
-                "Exec=$out/bin/electrum %u" \
-      --replace 'Exec=sh -c "PATH=\"\\$HOME/.local/bin:\\$PATH\"; electrum --testnet %u"' \
-                "Exec=$out/bin/electrum --testnet %u"
+      --replace-fail "Exec=electrum %u" "Exec=$out/bin/electrum %u" \
+      --replace-fail "Exec=electrum --testnet %u" "Exec=$out/bin/electrum --testnet %u"
  '';

  postFixup = lib.optionalString enableQt ''
@@ -95,6 +95,7 @@ let
 self = stdenv.mkDerivation {
  pname = "coq";
  inherit (fetched) version src;
+  exact-version = args.version;

  passthru = {
    inherit coq-version;
@@ -233,7 +234,8 @@ self = stdenv.mkDerivation {
 }; in
 if coqAtLeast "8.21" then self.overrideAttrs(o: {
  # coq-core is now a shim for rocq
-  propagatedBuildInputs = o.propagatedBuildInputs ++ [ rocq-core ];
+  propagatedBuildInputs = o.propagatedBuildInputs
+    ++ [ (rocq-core.override { version = o.exact-version; }) ];
  buildPhase = ''
    runHook preBuild
    dune build -p coq-core,coqide-server${lib.optionalString buildIde ",rocqide"} -j $NIX_BUILD_CORES
@@ -11,13 +11,13 @@

 buildPythonApplication rec {
  pname = "git-machete";
-  version = "3.31.1";
+  version = "3.32.1";

  src = fetchFromGitHub {
    owner = "virtuslab";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-OirzHEAHDiImgQoniBNaTjUgNm0I2azaPhjEnAavbNg=";
+    hash = "sha256-G62KCL0l1WTJoSXfJoQd1HXWleKPC8OjX39AD9NOgV0=";
  };

  nativeBuildInputs = [ installShellFiles ];
@@ -96,9 +96,23 @@ composerVendorInstallHook() {
    mkdir -p $out

    cp -ar composer.json $(composer config vendor-dir) $out/
+    mapfile -t installer_paths < <(jq -r 'try((.extra."installer-paths") | keys[])' composer.json)
+
+    for installer_path in "${installer_paths[@]}"; do
+        # Remove everything after {$name} placeholder
+        installer_path="${installer_path/\{\$name\}*/}";
+        out_installer_path="$out/${installer_path/\{\$name\}*/}";
+        # Copy the installer path if it exists
+        if [[ -d "$installer_path" ]]; then
+            mkdir -p $(dirname "$out_installer_path")
+            cp -ar "$installer_path" "$out_installer_path"
+            # Strip out the git repositories
+            find $out_installer_path -name .git -type d -prune -print -exec rm -rf {} ";"
+        fi
+    done

    if [[ -f "composer.lock" ]]; then
-        cp -ar composer.lock $(composer config vendor-dir) $out/
+        cp -ar composer.lock $out/
    fi

    echo "Finished composerVendorInstallHook"
@@ -40,13 +40,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "389-ds-base";
-  version = "3.0.5";
+  version = "3.1.2";

  src = fetchFromGitHub {
    owner = "389ds";
    repo = "389-ds-base";
    rev = "389-ds-base-${finalAttrs.version}";
-    hash = "sha256-OPtyeF1D46X6DslP3NewbjVgqPXngWUz943UsTqgWRo=";
+    hash = "sha256-FIx+ZW3K5KevU+wAiwPbDAQ6q7rPFEHFa+5eKqtgzpQ=";
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
@@ -97,8 +97,7 @@ stdenv.mkDerivation (finalAttrs: {
  '';

  preBuild = ''
-    mkdir -p ./vendor
-    tar -xzf ${finalAttrs.cargoDeps} -C ./vendor --strip-components=1
+    ln -s ${finalAttrs.cargoDeps} ./vendor
  '';

  configureFlags =
@@ -6,17 +6,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "adrs";
-  version = "0.2.9";
+  version = "0.3.0";

  src = fetchFromGitHub {
    owner = "joshrotenberg";
    repo = "adrs";
    rev = "v${version}";
-    hash = "sha256-a1vxo2Zw2fvCJeGaatNqf2h74t7pvWppYS2l2gbCF5k=";
+    hash = "sha256-BnbI5QsrnyEQFpTWqOPrbZnVa7J3vaByO9fnKd5t64o=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-VtMgvUifHddSncsKxtT5v44sDhihLgpbq38szvHVrVk=";
+  cargoHash = "sha256-Ep1Y2PDNesaDzEc2JNoKZjFSay1utZiNR5eQYhdqiUU=";

  meta = {
    description = "Command-line tool for managing Architectural Decision Records";
@@ -27,13 +27,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "amdvlk";
-  version = "2024.Q4.3";
+  version = "2025.Q1.1";

  src = fetchRepoProject {
    name = "amdvlk-src";
    manifest = "https://github.com/GPUOpen-Drivers/AMDVLK.git";
    rev = "refs/tags/v-${finalAttrs.version}";
-    hash = "sha256-PQxTRCSOk8E6y7pXyqxt1QKtRsqnrj/9dQZ8NjnUbhA=";
+    hash = "sha256-snwNyi/8voptLhZkXLK0QNh7pKo4SFx1iQojNzVr1Ms=";
  };

  buildInputs =
@@ -1,5 +1,6 @@
 {
  lib,
+  stdenv,
  buildGoModule,
  fetchFromGitHub,
  stdenvNoCC,
@@ -12,12 +13,12 @@

 let
  pname = "autobrr";
-  version = "1.57.0";
+  version = "1.58.0";
  src = fetchFromGitHub {
    owner = "autobrr";
    repo = "autobrr";
    tag = "v${version}";
-    hash = "sha256-RVkeSrL3ZfEz+oCICi8JFJ6AaOBBumi5mnnQYE5Gjt8=";
+    hash = "sha256-NH3BVD/wZH5L6x6GcXZrynKFiirLRC6u434EBYQs4qQ=";
  };

  autobrr-web = stdenvNoCC.mkDerivation {
@@ -39,7 +40,7 @@ let
        src
        sourceRoot
        ;
-      hash = "sha256-mABHRuZfjq9qNanfGGv+xDhs3bSufaWRecJypic8SWo=";
+      hash = "sha256-ESMrd+2oqytC1dQDQvncoqHGAvIFlH/1sTLrUTuSyDg=";
    };

    postBuild = ''
@@ -59,7 +60,7 @@ buildGoModule rec {
    src
    ;

-  vendorHash = "sha256-rCtUE2/IwR6AnXQNgeH0TQ0BL7g6vi9L128xP0PwOXc=";
+  vendorHash = "sha256-ifi4KFectr4UC1e+VJKnAWsx0f19XN2T3Paf2ud2/To=";

  preBuild = ''
    cp -r ${autobrr-web}/* web/dist
@@ -70,7 +71,10 @@ buildGoModule rec {
    "-X main.commit=${src.tag}"
  ];

-  doInstallCheck = true;
+  # In darwin, tests try to access /etc/protocols, which is not permitted.
+  doCheck = !stdenv.hostPlatform.isDarwin;
+  doInstallCheck = !stdenv.hostPlatform.isDarwin;
+
  nativeInstallCheckInputs = [
    versionCheckHook
  ];
@@ -8,11 +8,11 @@

 stdenv.mkDerivation rec {
  pname = "bdf2psf";
-  version = "1.233";
+  version = "1.234";

  src = fetchurl {
    url = "mirror://debian/pool/main/c/console-setup/bdf2psf_${version}_all.deb";
-    sha256 = "sha256-DCP8kswoc/zQqf+C/S41f6LyuxoAkG39Oi5y9A56S3k=";
+    sha256 = "sha256-NML5KphZqTko6ez6NaTEXvbA1D9saPBYKGk8TD/HvRc=";
  };

  nativeBuildInputs = [ dpkg ];
@@ -13,13 +13,13 @@

 buildNpmPackage rec {
  pname = "bitwarden-cli";
-  version = "2024.12.0";
+  version = "2025.1.2";

  src = fetchFromGitHub {
    owner = "bitwarden";
    repo = "clients";
    rev = "cli-v${version}";
-    hash = "sha256-3aN2t8/qhN0sjACvtip45efHQJl8nEMNre0+oBL1/go=";
+    hash = "sha256-Ibf25+aaEKFUCp5uiqmHySfdZq2JPAu2nBzfiS4Sc/k=";
  };

  postPatch = ''
@@ -29,7 +29,7 @@ buildNpmPackage rec {

  nodejs = nodejs_20;

-  npmDepsHash = "sha256-EtIcqbubAYN9I9wbw17oHiVshd3GtQayFtdgqWP7Pgg=";
+  npmDepsHash = "sha256-+LpF5zxC4TG5tF+RNgimLyEmGYyUfFDXHqs2RH9oQLY=";

  nativeBuildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
    cctools
@@ -50,6 +50,14 @@ buildNpmPackage rec {

  npmFlags = [ "--legacy-peer-deps" ];

+  # FIXME temporarily disable the symlink check as there are symlink after the build in the `node_modules/@bitwarden` directory linking to `../../`.
+  dontCheckForBrokenSymlinks = true;
+
+  npmRebuildFlags = [
+    # FIXME one of the esbuild versions fails to download @esbuild/linux-x64
+    "--ignore-scripts"
+  ];
+
  postConfigure = ''
    # we want to build everything from source
    shopt -s globstar
@@ -9,13 +9,13 @@

 stdenv.mkDerivation rec {
  pname = "brlaser";
-  version = "6-unstable-2023-02-30";
+  version = "6.2.7";

  src = fetchFromGitHub {
-    owner = "pdewacht";
+    owner = "Owl-Maintain";
    repo = "brlaser";
-    rev = "2a49e3287c70c254e7e3ac9dabe9d6a07218c3fa";
-    sha256 = "sha256-1fvO9F7ifbYQHAy54mOx052XutfKXSK6iT/zj4Mhbww=";
+    tag = "v${version}";
+    hash = "sha256-a+TjLmjqBz0b7v6kW1uxh4BGzrYOQ8aMdVo4orZeMT4=";
  };

  nativeBuildInputs = [
@@ -38,42 +38,13 @@ stdenv.mkDerivation rec {
    longDescription = ''
      Although most Brother printers support a standard printer language such as PCL or PostScript, not all do. If you have a monochrome Brother laser printer (or multi-function device) and the other open source drivers don't work, this one might help.

-      This driver is known to work with these printers:
-
-          Brother DCP-1510
-          Brother DCP-1602
-          Brother DCP-7030
-          Brother DCP-7040
-          Brother DCP-7055
-          Brother DCP-7055W
-          Brother DCP-7060D
-          Brother DCP-7065DN
-          Brother DCP-7080
-          Brother DCP-L2500D
-          Brother DCP-L2520D
-          Brother DCP-L2540DW
-          Brother HL-1110
-          Brother HL-1200
-          Brother HL-2030
-          Brother HL-2140
-          Brother HL-2220
-          Brother HL-2270DW
-          Brother HL-5030
-          Brother HL-L2300D
-          Brother HL-L2320D
-          Brother HL-L2340D
-          Brother HL-L2360D
-          Brother MFC-1910W
-          Brother MFC-7240
-          Brother MFC-7360N
-          Brother MFC-7365DN
-          Brother MFC-7840W
-          Brother MFC-L2710DW
-          Lenovo M7605D
+      This driver is known to work with many printers in the DCP, HL and MFC series, along with a few others.
+      See the homepage for a full list.
    '';
-    homepage = "https://github.com/pdewacht/brlaser";
+    homepage = "https://github.com/Owl-Maintain/brlaser";
+    changelog = "https://github.com/Owl-Maintain/brlaser/releases/tag/v${version}";
    license = lib.licenses.gpl2Plus;
    platforms = lib.platforms.linux;
-    maintainers = with lib.maintainers; [ StijnDW ];
+    maintainers = with lib.maintainers; [ onny ];
  };
 }
@@ -6,17 +6,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "cargo-mutants";
-  version = "25.0.0";
+  version = "25.0.1";

  src = fetchFromGitHub {
    owner = "sourcefrog";
    repo = "cargo-mutants";
    rev = "v${version}";
-    hash = "sha256-JwRMXFXYXPg/grFqeGIcWpDPI5/wFIldx4ORE8ODyk8=";
+    hash = "sha256-aTGuCkPk1GYUlRXCdNIy94d5zHxUPpNNFN4aapf8s0U=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-K3O5o69ogkCFs6sjTPLLRq2CmBaH2eeFXBjvvwBBhQE=";
+  cargoHash = "sha256-Vrh8N29EWIwVgAR6aEQcnkbrs/+llCx+GfiV0WlZOqw=";

  # too many tests require internet access
  doCheck = false;
@@ -2,17 +2,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "cargo-temp";
-  version = "0.3.1";
+  version = "0.3.2";

  src = fetchFromGitHub {
    owner = "yozhgoor";
    repo = "cargo-temp";
    rev = "v${version}";
-    hash = "sha256-fy4bG+UoN/51hiveYecl3ciJPV1g8/fC2dTFnUJZqAY=";
+    hash = "sha256-ejcqgfnvIGUhidhJpAh6uJrm8oFb8rS98wRI3iQBP9I=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-E7msh553ijldpVI2OJ6PL0Wp+Z4eLbv8Oexl7NtBdYc=";
+  cargoHash = "sha256-lfahdQtv35VH9XTApcu/GIR2QOqXKlb8Gpy6X58LmpA=";

  meta = with lib; {
    description = "CLI tool that allow you to create a temporary new Rust project using cargo with already installed dependencies";
@@ -0,0 +1,48 @@
+{
+  lib,
+  stdenvNoCC,
+  darwin,
+  fetchurl,
+  _7zz,
+  undmg,
+}:
+
+let
+  source = import ./source.nix;
+in
+stdenvNoCC.mkDerivation {
+  pname = "chatgpt";
+  inherit (source) version;
+
+  src = fetchurl source.src;
+
+  nativeBuildInputs = [
+    undmg
+  ];
+
+  sourceRoot = ".";
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p "$out/Applications"
+    mkdir -p "$out/bin"
+    cp -a ChatGPT.app "$out/Applications"
+    ln -s "$out/Applications/ChatGPT.app/Contents/MacOS/ChatGPT" "$out/bin/ChatGPT"
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = ./update.sh;
+
+  meta = {
+    description = "Desktop application for ChatGPT";
+    homepage = "https://openai.com/chatgpt/desktop/";
+    changelog = "https://help.openai.com/en/articles/9703738-macos-app-release-notes";
+    license = lib.licenses.unfree;
+    maintainers = with lib.maintainers; [ wattmto ];
+    platforms = lib.platforms.darwin;
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+    mainProgram = "ChatGPT";
+  };
+}
@@ -0,0 +1,7 @@
+{
+  version = "1.2025.014";
+  src = {
+    url = "https://persistent.oaistatic.com/sidekick/public/ChatGPT_Desktop_public_1.2025.014_1737150122.dmg";
+    hash = "sha256-NxCkrsPaptYNTZ+urkJqYeC4a0nGaEOFO/7SQL1Jmpc=";
+  };
+}
@@ -0,0 +1,21 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl libxml2
+
+XML_URL="https://persistent.oaistatic.com/sidekick/public/sparkle_public_appcast.xml"
+
+XML_DATA=$(curl -s $XML_URL)
+
+LATEST_VERSION=$(echo "$XML_DATA" | xmllint --xpath '/rss/channel/item[1]/*[local-name()="shortVersionString"]/text()' -)
+DOWNLOAD_URL=$(echo "$XML_DATA" | xmllint --xpath 'string(//item[1]/enclosure/@url)' -)
+
+HASH=$(nix-prefetch-url $DOWNLOAD_URL | xargs nix hash convert --hash-algo sha256)
+
+cat > source.nix << _EOF_
+{
+  version = "$LATEST_VERSION";
+  src = fetchurl {
+    url = "$DOWNLOAD_URL";
+    sha256 = "$HASH";
+  };
+}
+_EOF_
@@ -76,13 +76,13 @@ in
 # TODO (after 25.05 branch-off): Rename to pkgs.cinnamon
 stdenv.mkDerivation rec {
  pname = "cinnamon-common";
-  version = "6.4.6";
+  version = "6.4.7";

  src = fetchFromGitHub {
    owner = "linuxmint";
    repo = "cinnamon";
    rev = version;
-    hash = "sha256-hvQINRvEqTDWV0ja1tHzkpJMexc0htL0IlCHuy8QCQk=";
+    hash = "sha256-WBdzlourYf2oEXUMbzNcNNsc8lBo6ujAy/K1Y6nGOjU=";
  };

  patches = [
@@ -19,12 +19,12 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "circt";
-  version = "1.104.0";
+  version = "1.105.0";
  src = fetchFromGitHub {
    owner = "llvm";
    repo = "circt";
    rev = "firtool-${version}";
-    hash = "sha256-r5UYoeqrXSWvWtR0IgjrH67RIgul3vpNoN+4lWlGrHw=";
+    hash = "sha256-1LnCvXcGDQ1pBEux2yX6crPaWdcoWbLHFALtjoGJGL0=";
    fetchSubmodules = true;
  };

@@ -7,16 +7,16 @@

 buildGoModule rec {
  pname = "cirrus-cli";
-  version = "0.135.0";
+  version = "0.137.3";

  src = fetchFromGitHub {
    owner = "cirruslabs";
    repo = "cirrus-cli";
    rev = "v${version}";
-    hash = "sha256-s7nJ6fhmVZf/+uuN7rW+lq0Xvlz9p425yQNzoTRxTLo=";
+    hash = "sha256-7yI0dcE6hxfAZeZ5ylw5s6CBye1hTSW/nLtFZs4k/xw=";
  };

-  vendorHash = "sha256-FMUBwrY5PJLsd507340PC+f0f9PzPblFYpnNi6hiNeM=";
+  vendorHash = "sha256-GjCwH0Xe9wyacfokI5EzF2TKUnSMKCdOljahChPBlso=";

  ldflags = [
    "-X github.com/cirruslabs/cirrus-cli/internal/version.Version=v${version}"
@@ -8,13 +8,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "clap";
-  version = "1.2.2";
+  version = "1.2.3";

  src = fetchFromGitHub {
    owner = "free-audio";
    repo = "clap";
    rev = finalAttrs.version;
-    hash = "sha256-W3cvAtBrd+zyGj7xNSuFFChUUVjRadH6aCv5Zcvq/qs=";
+    hash = "sha256-c8mG6X++13yO+Ggdlw9YOtDes1XaT00C16evv7swsoU=";
  };

  postPatch = ''
@@ -6,11 +6,11 @@

 stdenvNoCC.mkDerivation rec {
  pname = "cppreference-doc";
-  version = "20241110";
+  version = "20250209";

  src = fetchurl {
    url = "https://github.com/PeterFeicht/${pname}/releases/download/v${version}/html-book-${version}.tar.xz";
-    hash = "sha256-Qx6Ahi63D9R5OmDX07bBPIYFKEl4+eoFKVcuj9FWLMY=";
+    hash = "sha256-rFBnGh9S1/CrCRHRRFDrNejC+BLt0OQmss0ePZ25HW8=";
  };

  sourceRoot = ".";
@@ -0,0 +1,12 @@
+diff --git a/src/lib/map/Mapper.cpp b/src/lib/map/Mapper.cpp
+index 6eaa2c5..781988c 100644
+--- a/src/lib/map/Mapper.cpp
+++ b/src/lib/map/Mapper.cpp
+@@ -22,6 +22,7 @@
+ //#include "common/Crc32Hw.hpp"
+ #include "common/DragenLogger.hpp"
+ #include "map/Mapper.hpp"
+#include <boost/range/iterator_range.hpp>
+ 
+ namespace dragenos {
+ namespace map {
@@ -33,6 +33,10 @@ stdenv.mkDerivation (finalAttrs: {
    # Add missing include cstdint.  Upstream does not accept PR. Issue opened at
    # https://github.com/Illumina/DRAGMAP/issues/63
    ./cstdint.patch
+
+    # Missing import in Mapper.cpp
+    # Issue opened upstream https://github.com/Illumina/DRAGMAP/pull/66
+    ./boost-iterator-range.patch
  ];

  env = {
@@ -53,7 +57,7 @@ stdenv.mkDerivation (finalAttrs: {
  # Tests are launched by default from makefile
  doCheck = false;

-  meta = with lib; {
+  meta = {
    description = "Open Source version of Dragen mapper for genomics";
    mainProgram = "dragen-os";
    longDescription = ''
@@ -61,8 +65,10 @@ stdenv.mkDerivation (finalAttrs: {
      which the Illumina team created to procude the same results as their
      proprietary DRAGEN hardware.
    '';
-    license = licenses.gpl3;
-    platforms = platforms.unix;
-    maintainers = with maintainers; [ apraga ];
+    homepage = "https://github.com/Illumina/DRAGMAP";
+    changelog = "https://github.com/Illumina/DRAGMAP/releases/tag/${finalAttrs.version}";
+    license = lib.licenses.gpl3;
+    platforms = [ "x86_64-linux" ];
+    maintainers = with lib.maintainers; [ apraga ];
  };
 })
@@ -8,10 +8,10 @@
 }:
 stdenv.mkDerivation rec {
  pname = "ephemeralpg";
-  version = "3.3";
+  version = "3.4";
  src = fetchurl {
    url = "https://eradman.com/ephemeralpg/code/${pname}-${version}.tar.gz";
-    hash = "sha256-pVQrfSpwJnxCRXAUpZQZsb0Z/wlLbjdaYmhVevgHrgo=";
+    hash = "sha256-IwAIJFW/ahDXGgINi4N9mG3XKw74JXK6+SLxGMZ8tS0=";
  };
  nativeBuildInputs = [ makeWrapper ];
  installPhase = ''
@@ -17,7 +17,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "erofs-utils";
-  version = "1.8.4";
+  version = "1.8.5";
  outputs = [
    "out"
    "man"
@@ -25,7 +25,7 @@ stdenv.mkDerivation (finalAttrs: {

  src = fetchurl {
    url = "https://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs-utils.git/snapshot/erofs-utils-${finalAttrs.version}.tar.gz";
-    hash = "sha256-eRWHqgdLufn6IYx2LMH2CwFeL1G8ss6R9oLwQ4VqtJQ=";
+    hash = "sha256-zYYRJw6chv4GL2RxA8pq2p7XEORDD91ZYNUUd3kZIA0=";
  };

  nativeBuildInputs = [
@@ -45,13 +45,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "fastfetch";
-  version = "2.35.0";
+  version = "2.36.0";

  src = fetchFromGitHub {
    owner = "fastfetch-cli";
    repo = "fastfetch";
    tag = finalAttrs.version;
-    hash = "sha256-ChuK5DHRj1qJIjRo3oB5gdCxox2mDffCVM0wRGc5t1o=";
+    hash = "sha256-pSPXSvomvQBps8ctF/PXaOP+7xBIRxNlRVIFVy8nxwY=";
  };

  outputs = [
@@ -11,13 +11,13 @@

 buildGoModule rec {
  pname = "flintlock";
-  version = "0.8.0";
+  version = "0.8.1";

  src = fetchFromGitHub {
    owner = "weaveworks";
    repo = "flintlock";
    rev = "v${version}";
-    sha256 = "sha256-dBwuguOSIc4+cdxfW91kdyprayYu2m2WjBg3qBnVM98=";
+    sha256 = "sha256-Kbk94sqj0aPsVonPsiu8kbjhIOURB1kX9Lt3NURL+jk=";
  };

  vendorHash = "sha256-Iv1qHEQLgw6huCA/6PKNmm+dS2yHgOvY/oy2fKjwEpY=";
@@ -17,17 +17,17 @@ let
 in
 buildGoModule rec {
  pname = "forgejo-runner";
-  version = "6.2.0";
+  version = "6.2.2";

  src = fetchFromGitea {
    domain = "code.forgejo.org";
    owner = "forgejo";
    repo = "runner";
    rev = "v${version}";
-    hash = "sha256-2+/PJZPqKbxeWbIVx2647/xK5CqVUUvsdd67YFwjhms=";
+    hash = "sha256-vyJ5Fr38YvR8jjw/Tnih6c+GoctnVpgiaX7Bl+YNti0=";
  };

-  vendorHash = "sha256-wvvzD2lD1TPXEriNaI6nzNGR/Kg94zC58pAR42/DlMA=";
+  vendorHash = "sha256-KITZV8U4Hhdg9nXYd83p0joYOXulCsJ0sakiP2Q8gi0=";

  ldflags = [
    "-s"
@@ -26,7 +26,6 @@ let
  python = python312.override {
    self = python;
    packageOverrides = self: super: {
-      paho-mqtt = super.paho-mqtt_2;
    };
  };

@@ -1,7 +1,7 @@
 GEM
  remote: https://rubygems.org/
  specs:
-    fusuma (3.5.0)
+    fusuma (3.7.0)
    fusuma-plugin-appmatcher (0.7.1)
      fusuma (>= 3.0)
      rexml
@@ -4,10 +4,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0vxlfda4mgff9kindrmr47xvn6b591hzvzzsx2y88zq20sn340vy";
+      sha256 = "1h8lj3g5q6cg6lf5axnbw4bpvml3xkf3ipbviw5mg1jh9r3apk5m";
      type = "gem";
    };
-    version = "3.5.0";
+    version = "3.7.0";
  };
  fusuma-plugin-appmatcher = {
    dependencies = [
@@ -5,16 +5,16 @@

 buildGoModule rec {
  pname = "gat";
-  version = "0.20.0";
+  version = "0.20.3";

  src = fetchFromGitHub {
    owner = "koki-develop";
    repo = "gat";
    tag = "v${version}";
-    hash = "sha256-xO0MUbryuglbRIbBEbKJGYPPaJD8j4hNpIR+Kqc302s=";
+    hash = "sha256-97rFnJPdnLv8RLI5ZGMpdEX2UwLUNBVn3Fe4vv5MFRY=";
  };

-  vendorHash = "sha256-z2Hbn1debyJn/nTKVC2y3vd6V7XQyHFPNA6hCVuYzgU=";
+  vendorHash = "sha256-C3iUsS1p/+8U1KO/B5htYwCKnQThOusjE/jhOqoCFQo=";

  env.CGO_ENABLED = 0;

@@ -7,16 +7,16 @@

 buildGoModule rec {
  pname = "goat-cli";
-  version = "1.3.0";
+  version = "1.4.0";

  src = fetchFromGitHub {
    repo = "goat";
    owner = "studio-b12";
    rev = "v${version}";
-    hash = "sha256-g5iS0XCRv97uX45BMqyFNodjjZ3Q9OeMJXAdsPwLCEg=";
+    hash = "sha256-7inoRBVR7zmt0jUFAGYjoYT2cdda0qgzyXLL+GiBFMg=";
  };

-  vendorHash = "sha256-MOsxM8CSjK5j/guEwRFWHZ4+gdAHa5txVXw67jzwyLQ=";
+  vendorHash = "sha256-b/v27pHA9LcFe4TC/EpelJVSkAg4sq7b8p2gk0bWsQc=";

  ldflags = [
    "-s"
@@ -7,18 +7,18 @@

 buildGoModule rec {
  pname = "google-alloydb-auth-proxy";
-  version = "1.12.0";
+  version = "1.12.1";

  src = fetchFromGitHub {
    owner = "GoogleCloudPlatform";
    repo = "alloydb-auth-proxy";
    tag = "v${version}";
-    hash = "sha256-Z1sTArR6usEkoI/Dp5FUXhjsPeDHVG88GaSbrb9KaaA=";
+    hash = "sha256-FnYVkZxdWFxY0aIUbHTSDLJ+AgYE2L03vNya1K2e3SI=";
  };

  subPackages = [ "." ];

-  vendorHash = "sha256-jEs1oI4Ka87vbFbxt7cLm042wO2Rl5NaISmHBrCHZGw=";
+  vendorHash = "sha256-0VksnkdN7E6VEzzxSIc6AfOvxlPm67vEj+HVR6N+BqA=";

  checkFlags = [
    "-short"
@@ -8,13 +8,13 @@

 buildGoModule rec {
  pname = "gowall";
-  version = "0.1.9";
+  version = "0.2.0";

  src = fetchFromGitHub {
    owner = "Achno";
    repo = "gowall";
    rev = "v${version}";
-    hash = "sha256-BBalJADhQ7D7p5PeafddkqQmHGhLsq1DlF1FUoazJGg=";
+    hash = "sha256-QKukWA8TB0FoNHu0Wyco55x4oBY+E33qdoT/SaXW6DE=";
  };

  vendorHash = "sha256-H2Io1K2LEFmEPJYVcEaVAK2ieBrkV6u+uX82XOvNXj4=";
@@ -55,6 +55,7 @@ stdenv.mkDerivation (finalAttrs: {
      toastal
      thoughtpolice
    ];
+    mainProgram = "h2o";
    platforms = platforms.linux;
  };
 })
@@ -4,7 +4,16 @@
  python3,
 }:

-python3.pkgs.buildPythonApplication rec {
+let
+  python = python3.override {
+    self = python;
+    packageOverrides = self: super: {
+      # https://github.com/unixorn/ha-mqtt-discoverable/pull/310
+      paho-mqtt = self.paho-mqtt_1;
+    };
+  };
+in
+python.pkgs.buildPythonApplication rec {
  pname = "ha-mqtt-discoverable-cli";
  version = "0.16.4.1";
  pyproject = true;
@@ -18,9 +27,9 @@ python3.pkgs.buildPythonApplication rec {

  pythonRelaxDeps = [ "ha-mqtt-discoverable" ];

-  build-system = with python3.pkgs; [ poetry-core ];
+  build-system = with python.pkgs; [ poetry-core ];

-  dependencies = with python3.pkgs; [ ha-mqtt-discoverable ];
+  dependencies = with python.pkgs; [ ha-mqtt-discoverable ];

  # Project has no real tests
  doCheck = false;
@@ -0,0 +1,39 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  pkg-config,
+  cmake,
+  pcsclite,
+  libnfc-nci,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "ifdnfc-nci";
+  version = "0.2.1";
+
+  src = fetchFromGitHub {
+    owner = "StarGate01";
+    repo = "ifdnfc-nci";
+    tag = "v${finalAttrs.version}";
+    sha256 = "sha256-I2MNzmaxQUh4bN3Uytf2bQRthByEaFWM7c79CKZJQZA=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+  ];
+
+  buildInputs = [
+    pcsclite
+    libnfc-nci
+  ];
+
+  meta = {
+    description = "PC/SC IFD Handler based on linux_libnfc-nci";
+    homepage = "https://github.com/StarGate01/ifdnfc-nci";
+    license = lib.licenses.gpl3Only;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ stargate01 ];
+  };
+})
@@ -8,17 +8,17 @@
 }:
 buildNpmPackage rec {
  pname = "immich-public-proxy";
-  version = "1.6.3";
+  version = "1.7.2";
  src = fetchFromGitHub {
    owner = "alangrainger";
    repo = "immich-public-proxy";
    tag = "v${version}";
-    hash = "sha256-nhVU3CVexXV+WCUP8E1tGvwwjy+PCTL9v3/3KI1tDus=";
+    hash = "sha256-G08xucggEdO+iwW7m1D53nr4Rah9D/qD4xlyLwWwBq0=";
  };

  sourceRoot = "${src.name}/app";

-  npmDepsHash = "sha256-NQgxAHNMPp2eDoiMqjqBOZ3364XjW3WtvrK/ciqg1DI=";
+  npmDepsHash = "sha256-aXTdKGlF2mK8I+vQMd+V6JNTG49S4jJd1kTNBai6sZE=";

  # patch in absolute nix store paths so the process doesn't need to cwd in $out
  postPatch = ''
@@ -115,8 +115,6 @@ let
    preBuild = ''
      rm node_modules/@immich/sdk
      ln -s ${openapi} node_modules/@immich/sdk
-      # Rollup does not find the dependency otherwise
-      ln -s node_modules/@immich/sdk/node_modules/@oazapfts node_modules/
    '';

    installPhase = ''
@@ -16,7 +16,7 @@ stdenv.mkDerivation {
  };

  installPhase = ''
-    install -m644 --target $out/share/fonts/truetype/inconsolata -D $src/ofl/inconsolata/static/*.ttf
+    install -m644 --target $out/share/fonts/truetype/inconsolata -D $src/ofl/inconsolata/static/*.ttf $src/ofl/inconsolata/*.ttf
  '';

  meta = with lib; {
@@ -26,6 +26,8 @@ python3.pkgs.buildPythonApplication rec {
    lzallright
  ];

+  pythonRelaxDeps = [ "cstruct" ];
+
  pythonImportsCheck = [
    "jefferson"
  ];
@@ -18,11 +18,11 @@

 stdenv.mkDerivation rec {
  pname = "jenkins";
-  version = "2.479.3";
+  version = "2.492.1";

  src = fetchurl {
    url = "https://get.jenkins.io/war-stable/${version}/jenkins.war";
-    hash = "sha256-MEyFkoYNWwPewnyWteiexY/HRPeBYcU/ejRKC/fOkgM=";
+    hash = "sha256-wFNPna+QJa5AVOwwUYsbifxdl7Mvr9tVa5s6YOn//8g=";
  };

  nativeBuildInputs = [ makeWrapper ];
@@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "controller-tools";
-  version = "0.17.1";
+  version = "0.17.2";

  src = fetchFromGitHub {
    owner = "kubernetes-sigs";
-    repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-6tqUWsI8SJsBOUO9i+czilOJWlflZ8Sj/rdnZaLJeSQ=";
+    repo = "controller-tools";
+    tag = "v${version}";
+    sha256 = "sha256-AUYduzIEWCJDskoChXmQViR5ON4YZr4MKvFys03hBkY=";
  };

-  vendorHash = "sha256-NX4e//77G+jTL2309x6+UEmFarsNWO/n0Pex2pJ+S/s=";
+  vendorHash = "sha256-Y7xYmD3fxAIo/NyLzBuSdbHIrduJ33SpK2I6LfOzNac=";

  ldflags = [
    "-s"
@@ -13,6 +13,9 @@ stdenv.mkDerivation rec {
    sha256 = "1a0jdyga1zfi4wgkg3905y6inghy3s4xfs5m4x7pal08m0llkmab";
  };

+  # needed for cross builds
+  configureFlags = [ "ac_cv_func_memcmp_working=yes" ];
+
  meta = {
    description = "Musepack SV7 decoder library";
    platforms = lib.platforms.unix;
@@ -0,0 +1,47 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  autoreconfHook,
+  pkg-config,
+  config,
+  debug ? config.libnfc-nci.debug or false,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libnfc-nci";
+  version = "2.4.1-unstable-2024-08-05";
+
+  src = fetchFromGitHub {
+    owner = "StarGate01";
+    repo = "linux_libnfc-nci";
+    rev = "7ce9c8aad0e37850a49b6d8dcc22ae5c783268e7";
+    sha256 = "sha256-iSvDiae+A2hUok426Lj5TMn3Q9G+vH1G0jajP48PehQ=";
+  };
+
+  buildInputs = [
+    pkg-config
+    autoreconfHook
+  ];
+
+  configureFlags =
+    [
+      "--enable-i2c"
+    ]
+    ++ lib.optionals debug [
+      "--enable-debug"
+    ];
+  dontStrip = debug;
+
+  postInstall = ''
+    rm -rf $out/etc
+  '';
+
+  meta = {
+    description = "Linux NFC stack for NCI based NXP NFC Controllers";
+    homepage = "https://github.com/NXPNFCLinux/linux_libnfc-nci";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ stargate01 ];
+    platforms = lib.platforms.linux;
+  };
+})
@@ -25,6 +25,7 @@ stdenv.mkDerivation rec {
  nativeBuildInputs = [
    autoreconfHook
    pkg-config
+    python3.pythonOnBuildForHost
  ];

  buildInputs = [
@@ -35,6 +36,26 @@ stdenv.mkDerivation rec {
    zlib
  ];

+  preCheck =
+    ''
+      patchShebangs test/python
+    ''
+    + lib.optionalString stdenv.hostPlatform.isDarwin ''
+      export DYLD_LIBRARY_PATH=$DYLD_LIBRARY_PATH''${DYLD_LIBRARY_PATH:+:}${
+        lib.concatMapStringsSep ":" (d: "$(pwd)/src/${d}/.libs") [
+          "liborcus"
+          "parser"
+          "python"
+          "spreadsheet"
+        ]
+      }
+    '';
+
+  strictDeps = true;
+  doCheck = true;
+  enableParallelBuilding = true;
+  enableParallelChecking = true;
+
  meta = with lib; {
    description = "Collection of parsers and import filters for spreadsheet documents";
    homepage = "https://gitlab.com/orcus/orcus";
@@ -12,7 +12,7 @@
 }:

 let
-  version = "2.0.10";
+  version = "2.0.11";

  # Make sure we override python, so the correct version is chosen
  boostPython = boost.override {
@@ -29,7 +29,7 @@ stdenv.mkDerivation {
    owner = "arvidn";
    repo = "libtorrent";
    rev = "v${version}";
-    hash = "sha256-JrAYtoS8wNmmhbgnprD7vNz1N64ekIryjK77rAKTyaQ=";
+    hash = "sha256-iph42iFEwP+lCWNPiOJJOejISFF6iwkGLY9Qg8J4tyo=";
    fetchSubmodules = true;
  };

@@ -7,17 +7,17 @@
 }:
 rustPlatform.buildRustPackage rec {
  pname = "limbo";
-  version = "0.0.13";
+  version = "0.0.14";

  src = fetchFromGitHub {
    owner = "tursodatabase";
    repo = "limbo";
    tag = "v${version}";
-    hash = "sha256-zIjtuATXlqFh2IoM9cqWysZdRFaVgJTcZFWUsK+NtsQ=";
+    hash = "sha256-t3bIW+HuuZzj3NOw2lnTZw9qxj7lGWtR8RbZF0rVbQ4=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-Bb293Amn1S4QARtWrtRkWFHF5FisIcbrfJTsOV6aUQo=";
+  cargoHash = "sha256-DDUl/jojhDmSQY7iI/Dn+Lg4eNuNhj8jyakPtgg4d2k=";

  cargoBuildFlags = [
    "-p"
@@ -1,56 +1 @@
-{
-  python3Packages,
-  lib,
-  fetchFromGitHub,
-}:
-
-python3Packages.buildPythonApplication rec {
-  pname = "litestar";
-  version = "2.13.0";
-  pyproject = true;
-
-  build-system = with python3Packages; [
-    hatchling
-  ];
-
-  src = fetchFromGitHub {
-    owner = "litestar-org";
-    repo = "litestar";
-    tag = "v${version}";
-    hash = "sha256-PR2DVNRtILHs7XwVi9/ZCVRJQFqfGLn1x2gpYtYjHDo=";
-  };
-
-  dependencies = with python3Packages; [
-    anyio
-    click
-    redis
-    httpx
-    msgspec
-    multidict
-    jinja2
-    pyyaml
-    rich
-    rich-click
-    typing-extensions
-    psutil
-    polyfactory
-    litestar-htmx
-    trio
-    cryptography
-    psycopg
-    fsspec
-    mako
-    time-machine
-    asyncpg
-    picologging
-  ];
-
-  meta = {
-    homepage = "https://litestar.dev/";
-    platforms = lib.platforms.unix;
-    maintainers = with lib.maintainers; [ bot-wxt1221 ];
-    changelog = "https://github.com/litestar-org/litestar/releases/tag/v${version}";
-    description = "Production-ready, Light, Flexible and Extensible ASGI API framework";
-    license = lib.licenses.mit;
-  };
-}
+{ python3Packages }: with python3Packages; toPythonApplication litestar
@@ -7,16 +7,16 @@

 buildGoModule rec {
  pname = "lprobe";
-  version = "0.1.4";
+  version = "0.1.5";

  src = fetchFromGitHub {
    owner = "fivexl";
    repo = "lprobe";
    tag = "v${version}";
-    hash = "sha256-WC0MDTyd5tRtSQ1LQsYJgV9CwJwtvnIO6tQnPrjpfcY=";
+    hash = "sha256-1VoZIZQDEYVQg8cMacpHPRUffu+1+bAt7O3MZSi6+2A=";
  };

-  vendorHash = "sha256-Ot9eePv/bjOZJfOjTCOJGXCaM8hoO4ZUPrpec8lT/JY=";
+  vendorHash = "sha256-wrxIHb296YOszgK9GnCTpSHz2kSd89zT/90/CrPely8=";

  buildInputs = [
    libpcap
@@ -10,20 +10,20 @@

 buildGoModule rec {
  pname = "mackerel-agent";
-  version = "0.83.0";
+  version = "0.84.0";

  src = fetchFromGitHub {
    owner = "mackerelio";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-hxABrgUdEQDj8NJxZgChGgB2/3J1/ChTdIYkFQtGsuY=";
+    sha256 = "sha256-kLrZ+oTb27g2Lzb65cVyxu1Ou5wGXXMSUvod+IBnoPA=";
  };

  nativeBuildInputs = [ makeWrapper ];
  nativeCheckInputs = lib.optionals (!stdenv.hostPlatform.isDarwin) [ nettools ];
  buildInputs = lib.optionals (!stdenv.hostPlatform.isDarwin) [ iproute2 ];

-  vendorHash = "sha256-JIqQXS2iw3opeotpfqC16w7hdu+7XjxhIyVj2M+98ec=";
+  vendorHash = "sha256-DPxkZp46AsUiThQC9OwL24uKfJrUhgo8IvvE4fLo1yg=";

  subPackages = [ "." ];

@@ -0,0 +1,31 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  nix-update-script,
+  ...
+}:
+buildGoModule rec {
+  pname = "maildir-rank-addr";
+  version = "1.4.1";
+
+  src = fetchFromGitHub {
+    owner = "ferdinandyb";
+    repo = "maildir-rank-addr";
+    tag = "v${version}";
+    hash = "sha256-3iDvVeiQjyck4+/IvxOe6w2ebR7yju2dV1ijVpajsKU=";
+  };
+
+  vendorHash = "sha256-Wl7KfvNYtvSUiYS1LpN027SrU+K3Uq0UQHv7slC2Xwc=";
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Generate a ranked addressbook from a maildir folder";
+    homepage = "https://github.com/ferdinandyb/maildir-rank-addr";
+    changelog = "https://github.com/ferdinandyb/maildir-rank-addr/blob/v${version}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    mainProgram = "maildir-rank-addr";
+    maintainers = with lib.maintainers; [ antonmosich ];
+  };
+}
@@ -2,27 +2,44 @@
  lib,
  stdenvNoCC,
  fetchurl,
-  installShellFiles,
+  libarchive,
+  p7zip,
  testers,
  mas,
 }:

 stdenvNoCC.mkDerivation rec {
  pname = "mas";
-  version = "1.8.6";
+  version = "1.9.0";

  src = fetchurl {
-    # Use the tarball until https://github.com/mas-cli/mas/issues/452 is fixed.
-    # Even though it looks like an OS/arch specific build it is actually a universal binary.
-    url = "https://github.com/mas-cli/mas/releases/download/v${version}/mas-${version}.monterey.bottle.tar.gz";
-    sha256 = "0q4skdhymgn5xrwafyisfshx327faia682yv83mf68r61m2jl10d";
+    url = "https://github.com/mas-cli/mas/releases/download/v${version}/mas-${version}.pkg";
+    hash = "sha256-MiSrCHLby3diTAzDPCYX1ZwdmzcHwOx/UJuWrlRJe54=";
  };

-  nativeBuildInputs = [ installShellFiles ];
+  nativeBuildInputs = [
+    libarchive
+    p7zip
+  ];
+
+  unpackPhase = ''
+    runHook preUnpack
+
+    7z x $src
+    bsdtar -xf Payload~
+
+    runHook postUnpack
+  '';
+
+  dontBuild = true;

  installPhase = ''
-    install -D './${version}/bin/mas' "$out/bin/mas"
-    installShellCompletion --cmd mas --bash './${version}/etc/bash_completion.d/mas'
+    runHook preInstall
+
+    mkdir -p $out/bin
+    cp mas $out/bin
+
+    runHook postInstall
  '';

  passthru.tests = {
@@ -86,7 +86,9 @@ buildNpmPackage rec {
      # Invoking with `--version` insists on being able to write to a log file.
      command = "env HOME=/tmp ${meta.mainProgram} --version";
    };
-    updateScript = nix-update-script { };
+    updateScript = nix-update-script {
+      extraArgs = [ "--version-regex=^(\\d+\\.\\d+\\.\\d+)$" ];
+    };
  };

  meta = {
@@ -7,17 +7,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "mdbook-d2";
-  version = "0.3.1";
+  version = "0.3.2";

  src = fetchFromGitHub {
    owner = "danieleades";
    repo = "mdbook-d2";
    rev = "v${version}";
-    hash = "sha256-5/vChjSYMlCcieA10jncoXZw9Gpeol+Am7mUo78Zqho=";
+    hash = "sha256-d3PKwvTpOpqp6J1i53T7FYSEGO+yuL+wtpAwNjrPZcQ=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-MxeSgSwBOQ5Eb/2mPtacNNX8MBSToon31egrbfxZjZg=";
+  cargoHash = "sha256-nV0VBbAivS6Qj62H1Uk/alDEPnryRmEfY3LZIIvDEKE=";
  doCheck = false;

  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
@@ -7,16 +7,16 @@

 buildGoModule rec {
  pname = "mihomo";
-  version = "1.19.1";
+  version = "1.19.2";

  src = fetchFromGitHub {
    owner = "MetaCubeX";
    repo = "mihomo";
    rev = "v${version}";
-    hash = "sha256-leeD/lra0ZA7in5ZX+uZwWRyHEaE9WzC8UEigI+Z+aA=";
+    hash = "sha256-lTrUM4/t7GP8IhuyMqit7Iv4AX2I8tlMJWvgx2tDbgE=";
  };

-  vendorHash = "sha256-0CStTmN2+bXJuoolVM8Spfj2HKYK7a8krxlA0uwHOOw=";
+  vendorHash = "sha256-/YW3IRdDHcOrwUkXt/ORhN3OrwwV5H63WP6ioTFDR+c=";

  excludedPackages = [ "./test" ];

@@ -9,17 +9,17 @@
 }:
 rustPlatform.buildRustPackage rec {
  pname = "mini-calc";
-  version = "3.3.5";
+  version = "3.4.1";

  src = fetchFromGitHub {
    owner = "vanilla-extracts";
    repo = "calc";
    rev = version;
-    hash = "sha256-A5nD1SuV2p2o+WRTHr9tqhyqfeZMiGWi9QUXFSSM7C0=";
+    hash = "sha256-p3McMsMo+l9fqLd6PZz4GBxoac4aZkJ3b4bQdmnooKI=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-TFAt0JcPX8EKTSwyxF5efYJC5LbSPBr2f9L4DaQ1ebI=";
+  cargoHash = "sha256-VOv1CqUpsvRY0Zln7grGBRLegtJ3NhiuIxiEoBKe2eQ=";

  nativeBuildInputs = [ makeWrapper ];
  postFixup = ''
@@ -8,6 +8,14 @@
    "aarch64-linux": {
      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.131.2/mirrord_linux_aarch64",
      "hash": "sha256-2SC/6Q43AhUjx2i3kwCLHIMEnxp23qbUuFXYKZBLin8="
+    },
+    "aarch64-darwin": {
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.131.2/mirrord_mac_universal",
+      "hash": "sha256-uR7k9bE0J6Ald2joM+d51IbEIKBsigD+D5hAUeR17hk="
+    },
+    "x86_64-darwin": {
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.131.2/mirrord_mac_universal",
+      "hash": "sha256-uR7k9bE0J6Ald2joM+d51IbEIKBsigD+D5hAUeR17hk="
    }
  }
 }
@@ -11,6 +11,8 @@ import httpx
 platforms = {
    "x86_64-linux": "linux_x86_64",
    "aarch64-linux": "linux_aarch64",
+    "aarch64-darwin": "mac_universal",
+    "x86_64-darwin": "mac_universal",
 }

 if __name__ == "__main__":
@@ -21,7 +21,7 @@ python3.pkgs.buildPythonApplication rec {
  build-system = with python3.pkgs; [ setuptools ];

  dependencies = with python3.pkgs; [
-    paho-mqtt_2
+    paho-mqtt
    prometheus-client
  ];

@@ -12,13 +12,13 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "nezha-theme-nazhua";
-  version = "0.5.6";
+  version = "0.5.7";

  src = fetchFromGitHub {
    owner = "hi2shark";
    repo = "nazhua";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-HqNiXkj3GLw5MlQu2fREwUYpT35txopli9SZcFCM90w=";
+    hash = "sha256-DkM+BV0Qw8vpSjxiHFcYUauP9SaiSDhAgKz+13tEsDI=";
  };

  yarnOfflineCache = fetchYarnDeps {
@@ -8,17 +8,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "nvidia_oc";
-  version = "0.1.16";
+  version = "0.1.18";

  src = fetchFromGitHub {
    owner = "Dreaming-Codes";
    repo = "nvidia_oc";
    tag = version;
-    hash = "sha256-9FNulyXLHDQ/FQBAGaINRW0F3KZdRcgmDHn7vQX2L2U=";
+    hash = "sha256-4dXdOwo7RidYEwKkoJp3+IvkGcXuS+irRbOlsfOKqIQ=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-DuuHqBhL25ghgcYxcOtWRArUqL9+c3d5mBrAcWTAFW8=";
+  cargoHash = "sha256-CxiKkm4NyYtKqSf/FtE7Pp3myCYxMMaV0h3Khd6HgTY=";

  nativeBuildInputs = [
    autoAddDriverRunpath
@@ -48,7 +48,7 @@ stdenv.mkDerivation rec {
    chmod -R +w templates

    # Change the path to oh-my-zsh dir and disable auto-updating.
-    sed -i -e "s#ZSH=\$HOME/.oh-my-zsh#ZSH=$outdir#" \
+    sed -i -e "s#ZSH=\"\$HOME/.oh-my-zsh\"#ZSH=\"$outdir\"#" \
           -e 's/\# \(DISABLE_AUTO_UPDATE="true"\)/\1/' \
     $template

@@ -7,16 +7,16 @@

 buildGoModule rec {
  pname = "omnictl";
-  version = "0.46.0";
+  version = "0.46.3";

  src = fetchFromGitHub {
    owner = "siderolabs";
    repo = "omni";
    rev = "v${version}";
-    hash = "sha256-3ew/iyMR1BI5/4Rct+DqY0Tqy0lg1kv7rCTck7i+C70=";
+    hash = "sha256-pVi27A8U3+nDMMmVAV/7HXXXydWFxB8M/PiEJCnqdwo=";
  };

-  vendorHash = "sha256-VR2k1r1bP9QSkcjwGnFUER+E3WIKrdCID4zewJyDd9A=";
+  vendorHash = "sha256-5+15d7QcjajZ6yOSQgN4D0Lzy2Bljk0ih/KKG1SGtX8=";

  ldflags = [
    "-s"
@@ -7,19 +7,19 @@
 }:
 let
  pname = "open-webui";
-  version = "0.5.9";
+  version = "0.5.10";

  src = fetchFromGitHub {
    owner = "open-webui";
    repo = "open-webui";
    tag = "v${version}";
-    hash = "sha256-r4jl1WNI8tyhwyYbTZ+Q52xvv3PJY2FvhexMYHIIDPg=";
+    hash = "sha256-zwVrDdCMapuHKmtlEUnCwxXCBU93C5uT9eqDk5Of2BE=";
  };

  frontend = buildNpmPackage {
    inherit pname version src;

-    npmDepsHash = "sha256-PAX3aa0WdvCBvAD8AGQYqnx5Sd/85luMqP6hAyICyhA=";
+    npmDepsHash = "sha256-G08r+2eelxV3ottsNEZ6xysu13AbzPNTwkwZdY1qadg=";

    # Disabling `pyodide:fetch` as it downloads packages during `buildPhase`
    # Until this is solved, running python packages from the browser will not work.
@@ -9,11 +9,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "proton-ge-bin";
-  version = "GE-Proton9-24";
+  version = "GE-Proton9-25";

  src = fetchzip {
    url = "https://github.com/GloriousEggroll/proton-ge-custom/releases/download/${finalAttrs.version}/${finalAttrs.version}.tar.gz";
-    hash = "sha256-L0GkzpSn4f6dLDOm2iDJr8D1DINTHNW9Kkn1xFTuqfo=";
+    hash = "sha256-cMN/U09NAsghx0A8dy+mjuvSFZxgvETmkigeOLskiQs=";
  };

  dontUnpack = true;
@@ -34,8 +34,8 @@ stdenvNoCC.mkDerivation (finalAttrs: {

    mkdir $steamcompattool
    ln -s $src/* $steamcompattool
-    rm $steamcompattool/{compatibilitytool.vdf,proton,version}
-    cp $src/{compatibilitytool.vdf,proton,version} $steamcompattool
+    rm $steamcompattool/compatibilitytool.vdf
+    cp $src/compatibilitytool.vdf $steamcompattool

    runHook postInstall
  '';
@@ -43,8 +43,6 @@ stdenvNoCC.mkDerivation (finalAttrs: {
  preFixup = ''
    substituteInPlace "$steamcompattool/compatibilitytool.vdf" \
      --replace-fail "${finalAttrs.version}" "${steamDisplayName}"
-    substituteInPlace "$steamcompattool/proton" \
-      --replace-fail "${finalAttrs.version}" "${steamDisplayName}"
  '';

  /*
@@ -30,18 +30,18 @@

 stdenv.mkDerivation (finalAttrs: rec {
  pname = "q2pro";
-  version = "0-unstable-2025-01-02";
+  version = "0-unstable-2025-02-05";

  src = fetchFromGitHub {
    owner = "skullernet";
    repo = "q2pro";
-    rev = "5b2d9f29aa9fb07cfe2b4ba9ee628a0153e759c2";
-    hash = "sha256-vz7f6isv3pcMtr3hO96sV1G2F94/w431FxtB6DcpCVU=";
+    rev = "6e505b11f570c6f3fcce05959d789cec5da87c2d";
+    hash = "sha256-ioqUCNulUs7oSQVc9ElJu72sY838bEFvAbFZV+2UFRU=";
  };

  # build date and rev number is displayed in the game's console
-  revCount = "3660"; # git rev-list --count ${src.rev}
-  SOURCE_DATE_EPOCH = "1735838714"; # git show -s --format=%ct ${src.rev}
+  revCount = "3671"; # git rev-list --count ${src.rev}
+  SOURCE_DATE_EPOCH = "1738774402"; # git show -s --format=%ct ${src.rev}

  nativeBuildInputs =
    [
@@ -7,12 +7,12 @@
  stdenv,
 }:
 let
-  version = "24.3.4";
+  version = "24.3.5";
  src = fetchFromGitHub {
    owner = "redpanda-data";
    repo = "redpanda";
    rev = "v${version}";
-    sha256 = "sha256-2VBichdsUM5cBAyRjMP2bECeMIQ60EYp832QNQ9UClk=";
+    sha256 = "sha256-Ev0eEZ3EHtSoNUr6MsYsd71riWq77+XrU5EPano08Rc=";
  };
 in
 buildGoModule rec {
@@ -20,7 +20,7 @@ buildGoModule rec {
  inherit doCheck src version;
  modRoot = "./src/go/rpk";
  runVend = false;
-  vendorHash = "sha256-RoUrLJqGpXgFGMG5kLdwIxGTePiOFCM9QeX68vq/HrI=";
+  vendorHash = "sha256-D+hDDJb01LCyD6IjlycsRD5kqtQeavNbl4MaAVAVA14=";

  ldflags = [
    ''-X "github.com/redpanda-data/redpanda/src/go/rpk/pkg/cli/cmd/version.version=${version}"''
@@ -8,16 +8,16 @@

 buildNpmPackage rec {
  pname = "repomix";
-  version = "0.2.24";
+  version = "0.2.25";

  src = fetchFromGitHub {
    owner = "yamadashy";
    repo = "repomix";
    tag = "v${version}";
-    hash = "sha256-AP9wwx836AoIMnOc8JB06Kl9vfk9CQArLTsoYYdv3Rs=";
+    hash = "sha256-Iuf2BJjJGYLw8J2UQzbAK50BZPaMa/3E3gXswWVRxn0=";
  };

-  npmDepsHash = "sha256-TYDqy2itdgCO0N3WyE56txLmiTE+ZhUeWRgxHf+mvec=";
+  npmDepsHash = "sha256-p/8/8o0BiHBsBaMtduEd1z6HYi3TerU6wuzOTq3oitg=";

  nativeInstallCheckInputs = [ versionCheckHook ];
  doInstallCheck = true;
@@ -43,9 +43,9 @@
  },
  {
    "pname": "Microsoft.AspNetCore.Razor.ExternalAccess.RoslynWorkspace",
-    "version": "9.0.0-preview.24555.12",
-    "hash": "sha256-SMOU22F2xZkFM6KRRETeRR79BuVccALMGH+zcgyqq4M=",
-    "url": "https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/d1622942-d16f-48e5-bc83-96f4539e7601/nuget/v3/flat2/microsoft.aspnetcore.razor.externalaccess.roslynworkspace/9.0.0-preview.24555.12/microsoft.aspnetcore.razor.externalaccess.roslynworkspace.9.0.0-preview.24555.12.nupkg"
+    "version": "9.0.0-preview.25064.4",
+    "hash": "sha256-w6gQZ702lMi2lI/9hIKbeaxW4K42YlDkDnGiD5+cgFo=",
+    "url": "https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/d1622942-d16f-48e5-bc83-96f4539e7601/nuget/v3/flat2/microsoft.aspnetcore.razor.externalaccess.roslynworkspace/9.0.0-preview.25064.4/microsoft.aspnetcore.razor.externalaccess.roslynworkspace.9.0.0-preview.25064.4.nupkg"
  },
  {
    "pname": "Microsoft.Bcl.AsyncInterfaces",
@@ -193,9 +193,9 @@
  },
  {
    "pname": "Microsoft.DotNet.Arcade.Sdk",
-    "version": "9.0.0-beta.24572.2",
-    "hash": "sha256-dTYFN1KH3grxcf/On6GLW5WdFliq91Y37DeWDCwiryM=",
-    "url": "https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/1a5f89f6-d8da-4080-b15f-242650c914a8/nuget/v3/flat2/microsoft.dotnet.arcade.sdk/9.0.0-beta.24572.2/microsoft.dotnet.arcade.sdk.9.0.0-beta.24572.2.nupkg"
+    "version": "9.0.0-beta.25065.2",
+    "hash": "sha256-8LCKwRGoa0plL1IzZzPR8prayboN7gulS4EC6HWL+5E=",
+    "url": "https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/1a5f89f6-d8da-4080-b15f-242650c914a8/nuget/v3/flat2/microsoft.dotnet.arcade.sdk/9.0.0-beta.25065.2/microsoft.dotnet.arcade.sdk.9.0.0-beta.25065.2.nupkg"
  },
  {
    "pname": "Microsoft.DotNet.XliffTasks",
@@ -1,5 +1,5 @@
 diff --git a/eng/targets/TargetFrameworks.props b/eng/targets/TargetFrameworks.props
-index 2dddaff1560..bc8fd1938d5 100644
+index 58f90114f4d..8eb23c25067 100644
 --- a/eng/targets/TargetFrameworks.props
 +++ b/eng/targets/TargetFrameworks.props
@@ -17,7 +17,7 @@
@@ -11,10 +11,10 @@ index 2dddaff1560..bc8fd1938d5 100644
     <NetRoslynNext>net9.0</NetRoslynNext>
   </PropertyGroup>
 
-diff --git a/src/Workspaces/Core/MSBuild.BuildHost/Microsoft.CodeAnalysis.Workspaces.MSBuild.BuildHost.csproj b/src/Workspaces/Core/MSBuild.BuildHost/Microsoft.CodeAnalysis.Workspaces.MSBuild.BuildHost.csproj
+diff --git a/src/Workspaces/MSBuild/BuildHost/Microsoft.CodeAnalysis.Workspaces.MSBuild.BuildHost.csproj b/src/Workspaces/MSBuild/BuildHost/Microsoft.CodeAnalysis.Workspaces.MSBuild.BuildHost.csproj
 index 8101f56b8be..1733955dc3d 100644
--- a/src/Workspaces/Core/MSBuild.BuildHost/Microsoft.CodeAnalysis.Workspaces.MSBuild.BuildHost.csproj
-+++ b/src/Workspaces/Core/MSBuild.BuildHost/Microsoft.CodeAnalysis.Workspaces.MSBuild.BuildHost.csproj
+--- a/src/Workspaces/MSBuild/BuildHost/Microsoft.CodeAnalysis.Workspaces.MSBuild.BuildHost.csproj
+++ b/src/Workspaces/MSBuild/BuildHost/Microsoft.CodeAnalysis.Workspaces.MSBuild.BuildHost.csproj
@@ -28,6 +28,12 @@
     -->
     <_MsbuildVersion>17.3.4</_MsbuildVersion>
@@ -43,3 +43,4 @@ index 8101f56b8be..1733955dc3d 100644
   </ItemGroup>
   <ItemGroup>
     <PackageReference Include="Microsoft.Build.Locator" PrivateAssets="All" />
+
@@ -32,18 +32,18 @@ in
 buildDotnetModule rec {
  inherit pname dotnet-sdk dotnet-runtime;

-  vsVersion = "2.62.18";
+  vsVersion = "2.64.7";
  src = fetchFromGitHub {
    owner = "dotnet";
    repo = "roslyn";
    rev = "VSCode-CSharp-${vsVersion}";
-    hash = "sha256-oy1xYM6Kd/8uAQQdvsxLNkycs9OOs7SEe+dzYc4RMeM=";
+    hash = "sha256-HWcVb2vpZxZWSxvWYRc91iUNaNGYDGEgKzHtD3yoyXs=";
  };

  # versioned independently from vscode-csharp
  # "roslyn" in here:
  # https://github.com/dotnet/vscode-csharp/blob/main/package.json
-  version = "4.14.0-1.25060.2";
+  version = "4.14.0-1.25074.7";
  projectFile = "src/LanguageServer/${project}/${project}.csproj";
  useDotnetFromEnv = true;
  nugetDeps = ./deps.json;
--- a/Show More
+++ b/Show More