From 232e7b6df081108480e0a2c0a4df8db8f1e5f944 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Sun, 23 Feb 2025 17:57:03 +0100
Subject: [PATCH 001/146] nixos/vaultwarden: relax hardening when using
 sendmail

---
 .../services/security/vaultwarden/default.nix  | 18 +++++++++++-------
 1 file changed, 11 insertions(+), 7 deletions(-)

diff --git a/nixos/modules/services/security/vaultwarden/default.nix b/nixos/modules/services/security/vaultwarden/default.nix
index 285dbc5d7046..613b81b297d2 100644
--- a/nixos/modules/services/security/vaultwarden/default.nix
+++ b/nixos/modules/services/security/vaultwarden/default.nix
@@ -65,6 +65,7 @@ let
 
   vaultwarden = cfg.package.override { inherit (cfg) dbBackend; };
 
+  useSendmail = configEnv.USE_SENDMAIL or null == "true";
 in
 {
   imports = [
@@ -236,10 +237,10 @@ in
         DevicePolicy = "closed";
         LockPersonality = true;
         MemoryDenyWriteExecute = true;
-        NoNewPrivileges = true;
-        PrivateDevices = true;
+        NoNewPrivileges = !useSendmail;
+        PrivateDevices = !useSendmail;
         PrivateTmp = true;
-        PrivateUsers = true;
+        PrivateUsers = !useSendmail;
         ProcSubset = "pid";
         ProtectClock = true;
         ProtectControlGroups = true;
@@ -262,10 +263,13 @@ in
         inherit StateDirectory;
         StateDirectoryMode = "0700";
         SystemCallArchitectures = "native";
-        SystemCallFilter = [
-          "@system-service"
-          "~@privileged"
-        ];
+        SystemCallFilter =
+          [
+            "@system-service"
+          ]
+          ++ lib.optionals (!useSendmail) [
+            "~@privileged"
+          ];
         Restart = "always";
         UMask = "0077";
       };

From eaec6a5eaffafa7929531f81a5c9df4995c439a5 Mon Sep 17 00:00:00 2001
From: thiloho <123883702+thiloho@users.noreply.github.com>
Date: Mon, 24 Mar 2025 11:41:04 +0100
Subject: [PATCH 002/146] archtika: fix update script by passing src to
 passthru

---
 pkgs/by-name/ar/archtika/package.nix | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ar/archtika/package.nix b/pkgs/by-name/ar/archtika/package.nix
index c59c95e9516e..979126012985 100644
--- a/pkgs/by-name/ar/archtika/package.nix
+++ b/pkgs/by-name/ar/archtika/package.nix
@@ -9,13 +9,13 @@
 }:
 
 let
-  version = "1.2.0";
+  version = "1.2.1";
 
   src = fetchFromGitHub {
     owner = "archtika";
     repo = "archtika";
     tag = "v${version}";
-    hash = "sha256-ba9da7LqCE/e2lhRVHD7GOhwOj1fNTBbN/pARPMzIg4=";
+    hash = "sha256-GffYAtLs12v2Lt1WoKJOG5dZsmzDcySZKFBQwCT9nnY=";
   };
 
   web = buildNpmPackage {
@@ -50,7 +50,10 @@ symlinkJoin {
     api
   ];
 
-  passthru.updateScript = nix-update-script { };
+  passthru = {
+    inherit src;
+    updateScript = nix-update-script { };
+  };
 
   meta = {
     description = "Modern, performant and lightweight CMS";

From 6cc803093ca90f4f8885fb513eae10f4e44f5470 Mon Sep 17 00:00:00 2001
From: thiloho <123883702+thiloho@users.noreply.github.com>
Date: Mon, 24 Mar 2025 11:45:34 +0100
Subject: [PATCH 003/146] nixos/archtika: fix mkEnableOption naming

---
 nixos/modules/services/web-apps/archtika.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/services/web-apps/archtika.nix b/nixos/modules/services/web-apps/archtika.nix
index cfd80dfb064f..0367d52451cb 100644
--- a/nixos/modules/services/web-apps/archtika.nix
+++ b/nixos/modules/services/web-apps/archtika.nix
@@ -17,7 +17,7 @@ let
 in
 {
   options.services.archtika = {
-    enable = mkEnableOption "Whether to enable the archtika service";
+    enable = mkEnableOption "the archtika CMS";
 
     package = mkPackageOption pkgs "archtika" { };
 

From 2c916c0352c301253c75233232673290f5db76ce Mon Sep 17 00:00:00 2001
From: thiloho <123883702+thiloho@users.noreply.github.com>
Date: Mon, 24 Mar 2025 12:12:44 +0100
Subject: [PATCH 004/146] archtika: also pass web to passthru to update
 npmDepsHash

---
 pkgs/by-name/ar/archtika/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ar/archtika/package.nix b/pkgs/by-name/ar/archtika/package.nix
index 979126012985..51d948b6c7d3 100644
--- a/pkgs/by-name/ar/archtika/package.nix
+++ b/pkgs/by-name/ar/archtika/package.nix
@@ -21,7 +21,7 @@ let
   web = buildNpmPackage {
     name = "web-app";
     src = "${src}/web-app";
-    npmDepsHash = "sha256-RTyo7K/Hr1hBGtcBKynrziUInl91JqZl84NkJg16ufA=";
+    npmDepsHash = "sha256-2udi8vLLvdoZxIyRKLOCfEpEMsooxsIrM1wiua1QPAI=";
     npmFlags = [ "--legacy-peer-deps" ];
     installPhase = ''
       mkdir -p $out/web-app
@@ -51,7 +51,7 @@ symlinkJoin {
   ];
 
   passthru = {
-    inherit src;
+    inherit src web;
     updateScript = nix-update-script { };
   };
 

From 851518527041028a696f065481e40f292f1b3821 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 27 Mar 2025 22:43:56 +0000
Subject: [PATCH 005/146] yafc-ce: 2.10.0 -> 2.11.0

---
 pkgs/by-name/ya/yafc-ce/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ya/yafc-ce/package.nix b/pkgs/by-name/ya/yafc-ce/package.nix
index 164cd559b1e4..0d8ebe02570f 100644
--- a/pkgs/by-name/ya/yafc-ce/package.nix
+++ b/pkgs/by-name/ya/yafc-ce/package.nix
@@ -12,13 +12,13 @@ let
 in
 buildDotnetModule (finalAttrs: {
   pname = "yafc-ce";
-  version = "2.10.0";
+  version = "2.11.0";
 
   src = fetchFromGitHub {
     owner = "shpaass";
     repo = "yafc-ce";
     rev = finalAttrs.version;
-    hash = "sha256-AFFu4yqnBq0OD3XY1V97zxAIfZuXswT9KOJzU8GqQuU";
+    hash = "sha256-jWJOJ00VXBaHogm3xUsV9Shvv9islRA+Z4fkln5VuWM=";
   };
 
   projectFile = [ "Yafc/Yafc.csproj" ];

From 3029bd758b4ff3a240bead21c3491a51759a6ccd Mon Sep 17 00:00:00 2001
From: Rebecca Turner <rbt@sent.as>
Date: Wed, 19 Mar 2025 17:59:53 -0700
Subject: [PATCH 006/146] lixPackageSets.lix_2_92: init

This adapts #375030 now that #391402 is merged, as are the `editline`
(#391425, #391426) and `capnproto` (#391424) packaging updates.

This introduces https://lix.systems/blog/2025-01-18-lix-2.92-release/ in
nixpkgs.

This new release introduces a bunch of changes at the packaging level,
reliant on new features of Meson, new features of some of our
dependencies which are done in previous commits (editline & capnproto).

The approach taken here is that it's OK to add more dependencies than
required for older versions but not OK to break them.

Moreover, Lix is now load-bearing dependent on the Clang stdenv, it
cannot be compiled with GCC anymore.

An escape hatch is included but if this escape hatch is used, the user
is on its own and should probably work with GCC upstream to fix
miscompilations.
---
 .../package-management/lix/common-lix.nix     | 88 +++++++++++++++++--
 .../lix/common-nix-eval-jobs.nix              |  5 +-
 pkgs/tools/package-management/lix/default.nix | 56 +++++++++++-
 3 files changed, 136 insertions(+), 13 deletions(-)

diff --git a/pkgs/tools/package-management/lix/common-lix.nix b/pkgs/tools/package-management/lix/common-lix.nix
index 2e23c9c9e049..b9077e7672d4 100644
--- a/pkgs/tools/package-management/lix/common-lix.nix
+++ b/pkgs/tools/package-management/lix/common-lix.nix
@@ -3,11 +3,22 @@
   suffix ? "",
   version,
   src,
-  docCargoDeps,
+  # For Lix versions >= 2.92, Rust sources are in the Lix repository root.
+  cargoDeps ? null,
+  # For previous versions, Rust sources are only in a subdirectory for
+  # `lix-doc`.
+  docCargoDeps ? null,
   patches ? [ ],
   maintainers ? lib.teams.lix.members,
 }@args:
 
+assert lib.assertMsg (
+  lib.versionOlder version "2.92" -> docCargoDeps != null
+) "`lix-doc` `cargoDeps` must be set for Lix < 2.92";
+assert lib.assertMsg (
+  lib.versionAtLeast version "2.92" -> cargoDeps != null
+) "`cargoDeps` must be set for Lix ≥ 2.92";
+
 {
   stdenv,
   meson,
@@ -18,6 +29,8 @@
   busybox-sandbox-shell,
   bzip2,
   callPackage,
+  capnproto,
+  cargo,
   curl,
   cmake,
   doxygen,
@@ -30,6 +43,7 @@
   libarchive,
   libcpuid,
   libsodium,
+  llvmPackages,
   lowdown,
   lowdown-unsandboxed,
   lsof,
@@ -39,6 +53,7 @@
   nlohmann_json,
   ninja,
   openssl,
+  rustc,
   toml11,
   pegtl,
   python3,
@@ -47,8 +62,11 @@
   Security,
   sqlite,
   util-linuxMinimal,
+  removeReferencesTo,
   xz,
   nixosTests,
+  rustPlatform,
+  # Only used for versions before 2.92.
   lix-doc ? callPackage ./doc {
     inherit src;
     version = "${version}${suffix}";
@@ -57,6 +75,7 @@
 
   enableDocumentation ? stdenv.hostPlatform == stdenv.buildPlatform,
   enableStatic ? stdenv.hostPlatform.isStatic,
+  enableStrictLLVMChecks ? true,
   withAWS ? !enableStatic && (stdenv.hostPlatform.isLinux || stdenv.hostPlatform.isDarwin),
   aws-sdk-cpp,
   # RISC-V support in progress https://github.com/seccomp/libseccomp/pull/50
@@ -67,11 +86,16 @@
   stateDir,
   storeDir,
 }:
-
 let
+  isLLVMOnly = lib.versionAtLeast version "2.92";
+  hasExternalLixDoc = lib.versionOlder version "2.92";
   isLegacyParser = lib.versionOlder version "2.91";
 in
-stdenv.mkDerivation {
+# gcc miscompiles coroutines at least until 13.2, possibly longer
+# do not remove this check unless you are sure you (or your users) will not report bugs to Lix upstream about GCC miscompilations.
+assert lib.assertMsg (enableStrictLLVMChecks && isLLVMOnly -> stdenv.cc.isClang)
+  "Lix upstream strongly discourage the usage of GCC to compile Lix as there's known miscompilations in important places. If you are a compiler developer, please get in touch with us.";
+stdenv.mkDerivation (finalAttrs: {
   pname = "lix";
 
   version = "${version}${suffix}";
@@ -91,9 +115,24 @@ stdenv.mkDerivation {
     ];
 
   strictDeps = true;
+  disallowedReferences = lib.optionals isLLVMOnly [
+    # We don't want the Clang.
+    stdenv.cc.cc
+    # We don't want the underlying GCC neither!
+    stdenv.cc.cc.stdenv.cc.cc
+  ];
+
+  # We only include CMake so that Meson can locate toml11, which only ships CMake dependency metadata.
+  dontUseCmakeConfigure = true;
 
   nativeBuildInputs =
     [
+      # python3.withPackages does not splice properly, see https://github.com/NixOS/nixpkgs/issues/305858
+      (python3.pythonOnBuildForHost.withPackages (p: [
+        p.pytest
+        p.pytest-xdist
+        p.python-frontmatter
+      ]))
       pkg-config
       flex
       jq
@@ -101,6 +140,8 @@ stdenv.mkDerivation {
       ninja
       cmake
       python3
+      # Required for libstd++ assertions that leaks inside of the final binary.
+      removeReferencesTo
 
       # Tests
       git
@@ -108,6 +149,11 @@ stdenv.mkDerivation {
       jq
       lsof
     ]
+    ++ lib.optionals isLLVMOnly [
+      rustc
+      cargo
+      rustPlatform.cargoSetupHook
+    ]
     ++ lib.optionals isLegacyParser [ bison ]
     ++ lib.optionals enableDocumentation [
       (lib.getBin lowdown-unsandboxed)
@@ -123,6 +169,7 @@ stdenv.mkDerivation {
       brotli
       bzip2
       curl
+      capnproto
       editline
       libsodium
       openssl
@@ -133,14 +180,31 @@ stdenv.mkDerivation {
       lowdown
       rapidcheck
       toml11
-      lix-doc
     ]
+    ++ lib.optionals hasExternalLixDoc [ lix-doc ]
     ++ lib.optionals (!isLegacyParser) [ pegtl ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [ Security ]
+    # NOTE(Raito): I'd have expected that the LLVM packaging would inject the
+    # libunwind library path directly in the wrappers, but it does inject
+    # -lunwind without injecting the library path...
+    ++ lib.optionals stdenv.hostPlatform.isStatic [ llvmPackages.libunwind ]
     ++ lib.optionals (stdenv.hostPlatform.isx86_64) [ libcpuid ]
     ++ lib.optionals withLibseccomp [ libseccomp ]
     ++ lib.optionals withAWS [ aws-sdk-cpp ];
 
+  inherit cargoDeps;
+
+  env = {
+    # Meson allows referencing a /usr/share/cargo/registry shaped thing for subproject sources.
+    # Turns out the Nix-generated Cargo dependencies are named the same as they
+    # would be in a Cargo registry cache.
+    MESON_PACKAGE_CACHE_DIR =
+      if finalAttrs.cargoDeps != null then
+        finalAttrs.cargoDeps
+      else
+        "lix: no `MESON_PACKAGE_CACHE_DIR`, set `cargoDeps`";
+  };
+
   propagatedBuildInputs = [
     boehmgc
     nlohmann_json
@@ -179,8 +243,9 @@ stdenv.mkDerivation {
   mesonFlags =
     [
       # Enable LTO, since it improves eval performance a fair amount
-      # LTO is disabled on static due to strange linking errors
-      (lib.mesonBool "b_lto" (!stdenv.hostPlatform.isStatic && stdenv.cc.isGNU))
+      # LTO is disabled on:
+      # - static builds (strange linkage errors)
+      (lib.mesonBool "b_lto" (!stdenv.hostPlatform.isStatic && (isLLVMOnly || stdenv.cc.isGNU)))
       (lib.mesonEnable "gc" true)
       (lib.mesonBool "enable-tests" true)
       (lib.mesonBool "enable-docs" enableDocumentation)
@@ -208,6 +273,11 @@ stdenv.mkDerivation {
       mkdir -p $devdoc/nix-support
       echo "devdoc internal-api $devdoc/share/doc/nix/internal-api" >> $devdoc/nix-support/hydra-build-products
     ''
+    + lib.optionalString (!hasExternalLixDoc) ''
+      # We do not need static archives.
+      # FIXME(Raito): why are they getting installed _at all_ ?
+      rm $out/lib/liblix_doc.a
+    ''
     + lib.optionalString stdenv.hostPlatform.isStatic ''
       mkdir -p $out/nix-support
       echo "file binary-dist $out/bin/nix" >> $out/nix-support/hydra-build-products
@@ -219,6 +289,10 @@ stdenv.mkDerivation {
           "$out/lib/libboost_context.dylib" \
           "$out/lib/$lib"
       done
+    ''
+    + ''
+      # Drop all references to libstd++ include files due to `__FILE__` leaking in libstd++ assertions.
+      find "$out" -type f -exec remove-references-to -t ${stdenv.cc.cc.stdenv.cc.cc} '{}' +
     '';
 
   # This needs to run after _multioutDocs moves the docs to $doc
@@ -299,4 +373,4 @@ stdenv.mkDerivation {
     outputsToInstall = [ "out" ] ++ lib.optional enableDocumentation "man";
     mainProgram = "nix";
   };
-}
+})
diff --git a/pkgs/tools/package-management/lix/common-nix-eval-jobs.nix b/pkgs/tools/package-management/lix/common-nix-eval-jobs.nix
index f80353d1754f..d3be7a626d97 100644
--- a/pkgs/tools/package-management/lix/common-nix-eval-jobs.nix
+++ b/pkgs/tools/package-management/lix/common-nix-eval-jobs.nix
@@ -17,7 +17,7 @@
   pkg-config,
   ninja,
   cmake,
-  clang-tools,
+  buildPackages,
 }:
 
 stdenv.mkDerivation {
@@ -35,7 +35,7 @@ stdenv.mkDerivation {
     ninja
     # nlohmann_json can be only discovered via cmake files
     cmake
-  ] ++ (lib.optional stdenv.cc.isClang [ clang-tools ]);
+  ] ++ (lib.optional stdenv.cc.isClang [ buildPackages.clang-tools ]);
 
   # point 'nix edit' and ofborg at the file that defines the attribute,
   # not this common file.
@@ -52,5 +52,6 @@ stdenv.mkDerivation {
     license = lib.licenses.gpl3;
     inherit maintainers;
     platforms = lib.platforms.unix;
+    broken = stdenv.hostPlatform.isStatic;
   };
 }
diff --git a/pkgs/tools/package-management/lix/default.nix b/pkgs/tools/package-management/lix/default.nix
index 5c351b2542a2..30025e74b3bb 100644
--- a/pkgs/tools/package-management/lix/default.nix
+++ b/pkgs/tools/package-management/lix/default.nix
@@ -8,6 +8,10 @@
   rustPlatform,
   Security,
   newScope,
+  editline,
+  ncurses,
+  stdenv,
+  clangStdenv,
 
   storeDir ? "/nix/store",
   stateDir ? "/nix/var",
@@ -19,6 +23,10 @@ let
       lix-args,
       nix-eval-jobs-args,
     }:
+    let
+      # GCC 13.2 is known to miscompile Lix coroutines (introduced in 2.92).
+      lixStdenv = if lib.versionAtLeast lix-args.version "2.92" then clangStdenv else stdenv;
+    in
     lib.makeScope newScope (
       self:
       lib.recurseIntoAttrs {
@@ -58,6 +66,11 @@ let
               requiredSystemFeatures = [ ];
             };
 
+        editline = editline.override {
+          inherit ncurses;
+          enableTermcap = true;
+        };
+
         # NOTE: The `common-*.nix` helpers contain a top-level function which
         # takes the Lix source to build and version information. We use the
         # outer `callPackage` for that.
@@ -65,12 +78,15 @@ let
         # That *returns* another function which takes the actual build
         # dependencies, and that uses the new scope's `self.callPackage` so
         # that `nix-eval-jobs` can be built against the correct `lix` version.
-        lix = self.callPackage (callPackage ./common-lix.nix lix-args) { };
+        lix = self.callPackage (callPackage ./common-lix.nix lix-args) {
+          stdenv = lixStdenv;
+        };
 
-        nix-eval-jobs = self.callPackage (callPackage ./common-nix-eval-jobs.nix nix-eval-jobs-args) { };
+        nix-eval-jobs = self.callPackage (callPackage ./common-nix-eval-jobs.nix nix-eval-jobs-args) {
+          stdenv = lixStdenv;
+        };
       }
     );
-
 in
 lib.makeExtensible (self: {
   inherit makeLixScope;
@@ -137,7 +153,39 @@ lib.makeExtensible (self: {
     };
   };
 
-  latest = self.lix_2_91;
+  lix_2_92 = self.makeLixScope {
+    lix-args = rec {
+      version = "2.92.0";
+
+      src = fetchFromGitHub {
+        owner = "lix-project";
+        repo = "lix";
+        rev = version;
+        hash = "sha256-CCKIAE84dzkrnlxJCKFyffAxP3yfsOAbdvydUGqq24g=";
+      };
+
+      cargoDeps = rustPlatform.fetchCargoVendor {
+        name = "lix-${version}";
+        inherit src;
+        allowGitDependencies = false;
+        hash = "sha256-YMyNOXdlx0I30SkcmdW/6DU0BYc3ZOa2FMJSKMkr7I8=";
+      };
+    };
+
+    nix-eval-jobs-args = rec {
+      version = "2.92.0";
+      src = fetchgit {
+        url = "https://git.lix.systems/lix-project/nix-eval-jobs.git";
+        rev = version;
+        hash = "sha256-tPr61X9v/OMVt7VXOs1RRStciwN8gDGxEKx+h0/Fg48=";
+      };
+    };
+  };
+
+  latest = self.lix_2_92;
+
+  # Note: This is not yet 2.92 because of a non-deterministic `curl` error.
+  # See: https://git.lix.systems/lix-project/lix/issues/662
   stable = self.lix_2_91;
 
   # Previously, `nix-eval-jobs` was not packaged here, so we export an

From 0d079338b2f5e681304215e901eebf9e9cb1dd58 Mon Sep 17 00:00:00 2001
From: Raito Bezarius <masterancpp@gmail.com>
Date: Sun, 16 Feb 2025 17:52:58 +0100
Subject: [PATCH 007/146] nixos/tests/installer: introduce `lix-simple` variant

An installer tests exacerbates the distribution packaging but in the
case of NixOS: the Nix package manager implementation.

As part of our classical release management process, the Lix team tests
whether a NixOS system installs just fine with Lix or not.

To avoid bloating the CI needlessly and keeping it simple, we only
introduce it on the simple variant and give a general way to pipe a Nix
implementation inside of an installer test.

Change-Id: I781da14475867dc2d946b740bad10af5de79ec5a
Signed-off-by: Raito Bezarius <masterancpp@gmail.com>
---
 nixos/tests/installer.nix                        | 5 +++++
 pkgs/tools/package-management/lix/common-lix.nix | 1 +
 2 files changed, 6 insertions(+)

diff --git a/nixos/tests/installer.nix b/nixos/tests/installer.nix
index 6be3346d9850..db9fccaa2bb4 100644
--- a/nixos/tests/installer.nix
+++ b/nixos/tests/installer.nix
@@ -638,6 +638,7 @@ let
       clevisTest ? false,
       clevisFallbackTest ? false,
       disableFileSystems ? false,
+      selectNixPackage ? pkgs: pkgs.nixStable,
     }:
     let
       isEfi = bootLoader == "systemd-boot" || (bootLoader == "grub" && grubUseEfi);
@@ -701,6 +702,7 @@ let
             virtualisation.rootDevice = "/dev/vdb";
 
             hardware.enableAllFirmware = mkForce false;
+            nix.package = selectNixPackage pkgs;
 
             # The test cannot access the network, so any packages we
             # need must be included in the VM.
@@ -1101,6 +1103,9 @@ in
   # The (almost) simplest partitioning scheme: a swap partition and
   # one big filesystem partition.
   simple = makeInstallerTest "simple" simple-test-config;
+  lix-simple = makeInstallerTest "simple" simple-test-config // {
+    selectNixPackage = pkgs: pkgs.lix;
+  };
 
   switchToFlake = makeInstallerTest "switch-to-flake" simple-test-config-flake;
 
diff --git a/pkgs/tools/package-management/lix/common-lix.nix b/pkgs/tools/package-management/lix/common-lix.nix
index b9077e7672d4..6f819fb734ef 100644
--- a/pkgs/tools/package-management/lix/common-lix.nix
+++ b/pkgs/tools/package-management/lix/common-lix.nix
@@ -351,6 +351,7 @@ stdenv.mkDerivation (finalAttrs: {
     inherit aws-sdk-cpp boehmgc;
     tests = {
       misc = nixosTests.nix-misc.lix;
+      installer = nixosTests.installer.lix-simple;
     };
   };
 

From e34de710576078bf6fef73c82f365a62bce7a679 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Simon=20=C5=BDlender?= <pub.git@zlender.si>
Date: Sat, 29 Mar 2025 09:48:07 +0100
Subject: [PATCH 008/146] rdkafka: fix cross-compilation

---
 pkgs/by-name/rd/rdkafka/package.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/by-name/rd/rdkafka/package.nix b/pkgs/by-name/rd/rdkafka/package.nix
index c07800cebd6d..104c967406ab 100644
--- a/pkgs/by-name/rd/rdkafka/package.nix
+++ b/pkgs/by-name/rd/rdkafka/package.nix
@@ -8,6 +8,7 @@
   curl,
   cmake,
   ninja,
+  deterministic-host-uname,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -29,6 +30,8 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [
     cmake
     ninja
+    # cross: build system uses uname to determine host system
+    deterministic-host-uname
   ];
 
   buildInputs = [

From 5929ce550c80c947820835faa4d31137b70ca39d Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 29 Mar 2025 11:18:06 +0000
Subject: [PATCH 009/146] mapproxy: 3.1.3 -> 4.0.1

* drop python 3.8 support
* drop Riak warnings (support dropped by upstream)
* avoid usage of top level `with`
---
 pkgs/by-name/ma/mapproxy/package.nix | 18 ++++++++----------
 1 file changed, 8 insertions(+), 10 deletions(-)

diff --git a/pkgs/by-name/ma/mapproxy/package.nix b/pkgs/by-name/ma/mapproxy/package.nix
index 75a6ecac099c..8c81b04f3b8b 100644
--- a/pkgs/by-name/ma/mapproxy/package.nix
+++ b/pkgs/by-name/ma/mapproxy/package.nix
@@ -1,26 +1,27 @@
 {
   lib,
-  python3,
   fetchFromGitHub,
+
+  python3Packages,
 }:
 
-with python3.pkgs;
-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "mapproxy";
-  version = "3.1.3";
+  version = "4.0.1";
+  disabled = python3Packages.pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "mapproxy";
     repo = "mapproxy";
     tag = version;
-    hash = "sha256-Dltr4JlgE1aJfSybTbAxlUyjqkfaobupNNSj90j9taE=";
+    hash = "sha256-bqM25exBPUB7hFtseWMw4Q1W6IeHLx+JrplOkZVEIl0=";
   };
 
   prePatch = ''
     substituteInPlace mapproxy/util/ext/serving.py --replace "args = [sys.executable] + sys.argv" "args = sys.argv"
   '';
 
-  dependencies = [
+  dependencies = with python3Packages; [
     boto3 # needed for caches service
     future
     jsonschema
@@ -33,13 +34,10 @@ buildPythonApplication rec {
     setuptools
     werkzeug
   ];
+
   # Tests are disabled:
   # 1) Dependency list is huge.
   #    https://github.com/mapproxy/mapproxy/blob/master/requirements-tests.txt
-  #
-  # 2) There are security issues with package Riak
-  #    https://github.com/NixOS/nixpkgs/issues/33876
-  #    https://github.com/NixOS/nixpkgs/pull/56480
   doCheck = false;
 
   meta = {

From d5b45a40334e00d5dee76ff04ff68091ab93b24c Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 31 Mar 2025 01:47:47 +0000
Subject: [PATCH 010/146] kanata-with-cmd: 1.8.0 -> 1.8.1

---
 pkgs/by-name/ka/kanata/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ka/kanata/package.nix b/pkgs/by-name/ka/kanata/package.nix
index e7521b252862..1b949d4efc1d 100644
--- a/pkgs/by-name/ka/kanata/package.nix
+++ b/pkgs/by-name/ka/kanata/package.nix
@@ -12,17 +12,17 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "kanata";
-  version = "1.8.0";
+  version = "1.8.1";
 
   src = fetchFromGitHub {
     owner = "jtroo";
     repo = "kanata";
     rev = "v${version}";
-    sha256 = "sha256-RTFP063NGNfjlOlZ4wghpcUQEmmj73Xlu3KPIxeUI/I=";
+    sha256 = "sha256-w/PeSqj51gJOWmAV5UPMprntdzinX/IL49D2ZUMfeSM=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-/r4u7pM7asCvG3LkbuP1Y63WVls1uZtV/L3cSOzUXr4=";
+  cargoHash = "sha256-T9fZxv3aujYparzVphfYBJ+5ti/T1VkeCeCqWPyllY8=";
 
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
     apple-sdk_13

From 5b59c0e893303e92ffd0cccd504bd5bef699d0cf Mon Sep 17 00:00:00 2001
From: emaryn <emaryn@users.noreply.github.com>
Date: Tue, 1 Apr 2025 03:30:27 +0800
Subject: [PATCH 011/146] lnav: 0.12.3 -> 0.12.4

---
 pkgs/by-name/ln/lnav/package.nix | 29 +++++++++++++++++------------
 1 file changed, 17 insertions(+), 12 deletions(-)

diff --git a/pkgs/by-name/ln/lnav/package.nix b/pkgs/by-name/ln/lnav/package.nix
index 9af958ac6723..3cf636be8240 100644
--- a/pkgs/by-name/ln/lnav/package.nix
+++ b/pkgs/by-name/ln/lnav/package.nix
@@ -19,24 +19,28 @@
   cargo,
   rustPlatform,
   rustc,
+  libunistring,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "lnav";
-  version = "0.12.3";
+  version = "0.12.4";
 
   src = fetchFromGitHub {
     owner = "tstack";
     repo = "lnav";
-    rev = "v${version}";
-    sha256 = "sha256-m0r7LAo9pYFpS+oimVCNCipojxPzMMsLLjhjkitEwow=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-XS3/km2sJwRnWloLKu9X9z07+qBFRfUsaRpZVYjoclI=";
   };
 
   enableParallelBuilding = true;
+
   separateDebugInfo = true;
 
   strictDeps = true;
+
   depsBuildBuild = [ buildPackages.stdenv.cc ];
+
   nativeBuildInputs = [
     autoconf
     automake
@@ -47,6 +51,7 @@ stdenv.mkDerivation rec {
     rustPlatform.cargoSetupHook
     rustc
   ];
+
   buildInputs =
     [
       bzip2
@@ -56,14 +61,15 @@ stdenv.mkDerivation rec {
       sqlite
       curl
       libarchive
+      libunistring
     ]
     ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [
       gpm
     ];
 
   cargoDeps = rustPlatform.fetchCargoVendor {
-    src = "${src}/src/third-party/prqlc-c";
-    hash = "sha256-jfmr6EuNW2mEHTEVHn6YnBDMzKxKI097vEFHXC4NT2Y=";
+    src = "${finalAttrs.src}/src/third-party/prqlc-c";
+    hash = "sha256-svi+C3ELw6Ly0mtji8xOv+DDqR0z5shFNazHa3kDQVg=";
   };
 
   cargoRoot = "src/third-party/prqlc-c";
@@ -74,7 +80,7 @@ stdenv.mkDerivation rec {
 
   passthru.updateScript = nix-update-script { };
 
-  meta = with lib; {
+  meta = {
     homepage = "https://github.com/tstack/lnav";
     description = "Logfile Navigator";
     longDescription = ''
@@ -87,14 +93,13 @@ stdenv.mkDerivation rec {
       will allow the user to quickly and efficiently zero in on problems.
     '';
     downloadPage = "https://github.com/tstack/lnav/releases";
-    license = licenses.bsd2;
-    maintainers = with maintainers; [
+    license = lib.licenses.bsd2;
+    maintainers = with lib.maintainers; [
       dochang
       symphorien
       pcasaretto
     ];
-    platforms = platforms.unix;
+    platforms = lib.platforms.unix;
     mainProgram = "lnav";
   };
-
-}
+})

From 922a4ab7808146b40563a9b433723f949a9b8635 Mon Sep 17 00:00:00 2001
From: Guy Chronister <guychronister@outlook.com>
Date: Mon, 31 Mar 2025 15:51:43 -0500
Subject: [PATCH 012/146] zdoom: Migrate to by-name

Remove zdoom and related packages from all-packages.nix
---
 .../zdoom => by-name/do/doom-bcc}/bcc-warning-fix.patch     | 0
 .../zdoom/bcc-git.nix => by-name/do/doom-bcc/package.nix}   | 0
 .../zdoom/zdbsp.nix => by-name/zd/zdbsp/package.nix}        | 0
 .../zdoom/default.nix => by-name/zd/zdoom/package.nix}      | 0
 pkgs/top-level/all-packages.nix                             | 6 ------
 5 files changed, 6 deletions(-)
 rename pkgs/{games/doom-ports/zdoom => by-name/do/doom-bcc}/bcc-warning-fix.patch (100%)
 rename pkgs/{games/doom-ports/zdoom/bcc-git.nix => by-name/do/doom-bcc/package.nix} (100%)
 rename pkgs/{games/doom-ports/zdoom/zdbsp.nix => by-name/zd/zdbsp/package.nix} (100%)
 rename pkgs/{games/doom-ports/zdoom/default.nix => by-name/zd/zdoom/package.nix} (100%)

diff --git a/pkgs/games/doom-ports/zdoom/bcc-warning-fix.patch b/pkgs/by-name/do/doom-bcc/bcc-warning-fix.patch
similarity index 100%
rename from pkgs/games/doom-ports/zdoom/bcc-warning-fix.patch
rename to pkgs/by-name/do/doom-bcc/bcc-warning-fix.patch
diff --git a/pkgs/games/doom-ports/zdoom/bcc-git.nix b/pkgs/by-name/do/doom-bcc/package.nix
similarity index 100%
rename from pkgs/games/doom-ports/zdoom/bcc-git.nix
rename to pkgs/by-name/do/doom-bcc/package.nix
diff --git a/pkgs/games/doom-ports/zdoom/zdbsp.nix b/pkgs/by-name/zd/zdbsp/package.nix
similarity index 100%
rename from pkgs/games/doom-ports/zdoom/zdbsp.nix
rename to pkgs/by-name/zd/zdbsp/package.nix
diff --git a/pkgs/games/doom-ports/zdoom/default.nix b/pkgs/by-name/zd/zdoom/package.nix
similarity index 100%
rename from pkgs/games/doom-ports/zdoom/default.nix
rename to pkgs/by-name/zd/zdoom/package.nix
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 30280ebb977d..5d8d79fd0ecc 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -15612,12 +15612,6 @@ with pkgs;
 
   fmodex = callPackage ../games/doom-ports/zandronum/fmod.nix { };
 
-  doom-bcc = callPackage ../games/doom-ports/zdoom/bcc-git.nix { };
-
-  zdbsp = callPackage ../games/doom-ports/zdoom/zdbsp.nix { };
-
-  zdoom = callPackage ../games/doom-ports/zdoom { };
-
   pro-office-calculator = libsForQt5.callPackage ../games/pro-office-calculator { };
 
   qgo = libsForQt5.callPackage ../games/qgo { };

From 6a64f899e1a685bbb5e70135bb57452a72eb4f56 Mon Sep 17 00:00:00 2001
From: Paul Meyer <katexochen0@gmail.com>
Date: Tue, 1 Apr 2025 08:15:34 +0200
Subject: [PATCH 013/146] 
 python3Packages.microsoft-security-utilities-secret-masker: 1.0.0b3 ->
 1.0.0b4

Signed-off-by: Paul Meyer <katexochen0@gmail.com>
---
 .../microsoft-security-utilities-secret-masker/default.nix    | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/microsoft-security-utilities-secret-masker/default.nix b/pkgs/development/python-modules/microsoft-security-utilities-secret-masker/default.nix
index ef2012371dd3..47b82bbac73c 100644
--- a/pkgs/development/python-modules/microsoft-security-utilities-secret-masker/default.nix
+++ b/pkgs/development/python-modules/microsoft-security-utilities-secret-masker/default.nix
@@ -8,13 +8,13 @@
 
 buildPythonPackage rec {
   pname = "microsoft-security-utilities-secret-masker";
-  version = "1.0.0b3";
+  version = "1.0.0b4";
   pyproject = true;
 
   src = fetchPypi {
     pname = "microsoft_security_utilities_secret_masker";
     inherit version;
-    hash = "sha256-0EVIIwxno70stGCyjnH+bKwWj0jwbXapadnKR732c0M=";
+    hash = "sha256-owvTYawYyLUvaEQHa8JkZTNZSeqcegBNlfUZbsb97z4=";
   };
 
   build-system = [

From 0fdc2760084db2b6159696f39d13beffd591feed Mon Sep 17 00:00:00 2001
From: Paul Meyer <katexochen0@gmail.com>
Date: Tue, 1 Apr 2025 08:16:25 +0200
Subject: [PATCH 014/146] python3Packages.azure-mgmt-containerservice: 34.1.0
 -> 34.2.0

Signed-off-by: Paul Meyer <katexochen0@gmail.com>
---
 .../python-modules/azure-mgmt-containerservice/default.nix    | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/azure-mgmt-containerservice/default.nix b/pkgs/development/python-modules/azure-mgmt-containerservice/default.nix
index b246540e020d..b43388a22be4 100644
--- a/pkgs/development/python-modules/azure-mgmt-containerservice/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-containerservice/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "azure-mgmt-containerservice";
-  version = "34.1.0";
+  version = "34.2.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "azure_mgmt_containerservice";
     inherit version;
-    hash = "sha256-Y3ps+PBmNsAWrRUddvnHunW9BdQzSz3Xg364tRfzDb4=";
+    hash = "sha256-FB4F8UbyjNRiioMCfVFb0lPzsvhSO+Q7mEFwcRjvWoQ=";
   };
 
   build-system = [ setuptools ];

From fff8479088ded41cbc59a0051efe4484a2d4ef66 Mon Sep 17 00:00:00 2001
From: Paul Meyer <katexochen0@gmail.com>
Date: Tue, 1 Apr 2025 08:16:59 +0200
Subject: [PATCH 015/146] python3Packages.azure-mgmt-keyvault: 10.3.1 -> 11.0.0

Signed-off-by: Paul Meyer <katexochen0@gmail.com>
---
 .../python-modules/azure-mgmt-keyvault/default.nix         | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/azure-mgmt-keyvault/default.nix b/pkgs/development/python-modules/azure-mgmt-keyvault/default.nix
index 4213abd86353..eeaeb6fb85b3 100644
--- a/pkgs/development/python-modules/azure-mgmt-keyvault/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-keyvault/default.nix
@@ -11,14 +11,15 @@
 
 buildPythonPackage rec {
   pname = "azure-mgmt-keyvault";
-  version = "10.3.1";
+  version = "11.0.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-NLkpVq773VccrloD9weOA32Ah7LADPpnSINdxzq7WjA=";
+    pname = "azure_mgmt_keyvault";
+    inherit version;
+    hash = "sha256-/PsTZoUpJvKjEeG8bmp4brioof1G5gJdTBFO3iy0ZC4=";
   };
 
   build-system = [ setuptools ];

From 2e0c384c45603051e69f0eba71e5590d6c620f4a Mon Sep 17 00:00:00 2001
From: Paul Meyer <katexochen0@gmail.com>
Date: Tue, 1 Apr 2025 08:17:25 +0200
Subject: [PATCH 016/146] python3Packages.azure-multiapi-storage: 1.3.0 ->
 1.4.0

Signed-off-by: Paul Meyer <katexochen0@gmail.com>
---
 .../python-modules/azure-multiapi-storage/default.nix         | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/azure-multiapi-storage/default.nix b/pkgs/development/python-modules/azure-multiapi-storage/default.nix
index 600b5e515259..17d1a30156c2 100644
--- a/pkgs/development/python-modules/azure-multiapi-storage/default.nix
+++ b/pkgs/development/python-modules/azure-multiapi-storage/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "azure-multiapi-storage";
-  version = "1.3.0";
+  version = "1.4.0";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-tlKogIs39tIoMVl3p/YConfPdPrpX9oc9WqQ+FuhgQk=";
+    hash = "sha256-RfFd+1xL2ouWJ3NLXMcsRfQ215bi4ha+iCOcYXjND3E=";
   };
 
   build-system = [ setuptools ];

From 5ea3b8d92e2ab477b455175419d3162fe8592b31 Mon Sep 17 00:00:00 2001
From: Paul Meyer <katexochen0@gmail.com>
Date: Tue, 1 Apr 2025 08:17:40 +0200
Subject: [PATCH 017/146] azure-cli: 2.70.0 -> 2.71.0

Signed-off-by: Paul Meyer <katexochen0@gmail.com>
---
 pkgs/by-name/az/azure-cli/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/az/azure-cli/package.nix b/pkgs/by-name/az/azure-cli/package.nix
index 36adc81b5c16..65f4d5153f02 100644
--- a/pkgs/by-name/az/azure-cli/package.nix
+++ b/pkgs/by-name/az/azure-cli/package.nix
@@ -26,14 +26,14 @@
 }:
 
 let
-  version = "2.70.0";
+  version = "2.71.0";
 
   src = fetchFromGitHub {
     name = "azure-cli-${version}-src";
     owner = "Azure";
     repo = "azure-cli";
     rev = "azure-cli-${version}";
-    hash = "sha256-vvX/LkG8qA53AxVlvq7FSTqbVblvE5xbDq4V0SINCAk=";
+    hash = "sha256-vtuDgj3UJCmKxYg0OgG59ezQh7HlscNywz61BHDzJF8=";
   };
 
   # put packages that needs to be overridden in the py package scope

From e8dd02fe7906f53d57bf238dc178cdb80c8654ed Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 1 Apr 2025 12:39:53 +0000
Subject: [PATCH 018/146] rssguard: 4.8.1 -> 4.8.2

---
 pkgs/applications/networking/feedreaders/rssguard/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/feedreaders/rssguard/default.nix b/pkgs/applications/networking/feedreaders/rssguard/default.nix
index 4a4ecd52c73e..70c1f17bcfd1 100644
--- a/pkgs/applications/networking/feedreaders/rssguard/default.nix
+++ b/pkgs/applications/networking/feedreaders/rssguard/default.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "rssguard";
-  version = "4.8.1";
+  version = "4.8.2";
 
   src = fetchFromGitHub {
     owner = "martinrotter";
     repo = pname;
     tag = version;
-    sha256 = "sha256-qWxcjGl4EaLXZ0q6RVy+IKyBcqlx/yYojlGivSXy5Io=";
+    sha256 = "sha256-C5iA5qK8+FhCUeFtyskY/vd4evaYS3TY1SHAc83/36w=";
   };
 
   buildInputs = [

From e2fa2553f16654a38c92b7312e32ac6bb7a3f5b9 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 2 Apr 2025 01:07:06 +0000
Subject: [PATCH 019/146] mill: 0.12.9 -> 0.12.10

---
 pkgs/by-name/mi/mill/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/mi/mill/package.nix b/pkgs/by-name/mi/mill/package.nix
index 10dfb82e2190..105a0b306a7d 100644
--- a/pkgs/by-name/mi/mill/package.nix
+++ b/pkgs/by-name/mi/mill/package.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mill";
-  version = "0.12.9";
+  version = "0.12.10";
 
   src = fetchurl {
     url = "https://repo1.maven.org/maven2/com/lihaoyi/mill-dist/${finalAttrs.version}/mill-dist-${finalAttrs.version}-assembly.jar";
-    hash = "sha256-Ntqzivy8dfsRlBclPNsWOZ4h1Xk7D3UJV7GLVGIEcAU=";
+    hash = "sha256-TESwISFz4Xf/F4kgnaTQbi/uVrc75bearih8mydPqHM=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

From c59bac08bd6fe608eac0083a68ec96819a32662d Mon Sep 17 00:00:00 2001
From: Timothy Gallion <timbama@gmail.com>
Date: Sun, 30 Mar 2025 01:52:11 -0400
Subject: [PATCH 020/146] python3: Fixing excessive memory usage for overriden
 python

An attempt to address #338231. The current release of nixpkgs takes over
20GB of memory to evaluate python when the interpreter is overriden.
This adds memoization to the spliced python packages to avoid
evaluating all the commbinations of overrides.
---
 .../interpreters/python/cpython/default.nix   | 35 ++++++++++++++-----
 1 file changed, 27 insertions(+), 8 deletions(-)

diff --git a/pkgs/development/interpreters/python/cpython/default.nix b/pkgs/development/interpreters/python/cpython/default.nix
index 977dd577fc90..56c4fe09fdce 100644
--- a/pkgs/development/interpreters/python/cpython/default.nix
+++ b/pkgs/development/interpreters/python/cpython/default.nix
@@ -55,6 +55,7 @@
   pkgsBuildTarget,
   pkgsHostHost,
   pkgsTargetTarget,
+  __splices ? { },
 
   # build customization
   sourceVersion,
@@ -145,10 +146,28 @@ let
       # When we override the interpreter we also need to override the spliced versions of the interpreter
       # bluez is excluded manually to break an infinite recursion.
       inputs' = lib.filterAttrs (n: v: n != "bluez" && n != "passthruFun" && !lib.isDerivation v) inputs;
+      # Memoization of the splices to avoid re-evaluating this function for all combinations of splices e.g.
+      # python3.pythonOnBuildForHost.pythonOnBuildForTarget == python3.pythonOnBuildForTarget by consuming
+      # __splices as an arg and using the cache if populated.
+      splices = {
+        pythonOnBuildForBuild = override pkgsBuildBuild.${pythonAttr};
+        pythonOnBuildForHost = override pkgsBuildHost.${pythonAttr};
+        pythonOnBuildForTarget = override pkgsBuildTarget.${pythonAttr};
+        pythonOnHostForHost = override pkgsHostHost.${pythonAttr};
+        pythonOnTargetForTarget = lib.optionalAttrs (lib.hasAttr pythonAttr pkgsTargetTarget) (
+          override pkgsTargetTarget.${pythonAttr}
+        );
+      } // __splices;
       override =
         attr:
         let
-          python = attr.override (inputs' // { self = python; });
+          python = attr.override (
+            inputs'
+            // {
+              self = python;
+              __splices = splices;
+            }
+          );
         in
         python;
     in
@@ -160,13 +179,13 @@ let
       pythonVersion = with sourceVersion; "${major}.${minor}";
       sitePackages = "lib/${libPrefix}/site-packages";
       inherit hasDistutilsCxxPatch pythonAttr;
-      pythonOnBuildForBuild = override pkgsBuildBuild.${pythonAttr};
-      pythonOnBuildForHost = override pkgsBuildHost.${pythonAttr};
-      pythonOnBuildForTarget = override pkgsBuildTarget.${pythonAttr};
-      pythonOnHostForHost = override pkgsHostHost.${pythonAttr};
-      pythonOnTargetForTarget = lib.optionalAttrs (lib.hasAttr pythonAttr pkgsTargetTarget) (
-        override pkgsTargetTarget.${pythonAttr}
-      );
+      inherit (splices)
+        pythonOnBuildForBuild
+        pythonOnBuildForHost
+        pythonOnBuildForTarget
+        pythonOnHostForHost
+        pythonOnTargetForTarget
+        ;
     };
 
   version = with sourceVersion; "${major}.${minor}.${patch}${suffix}";

From 0ce0b01c126b892d2f334e3c926f46b62cf52c25 Mon Sep 17 00:00:00 2001
From: Timothy Gallion <timbama@gmail.com>
Date: Sun, 30 Mar 2025 16:10:39 -0400
Subject: [PATCH 021/146] python3: Remove unneeded override in `passthruFun`

`pythonOnBuildForHost` is already overriden when it is passed to
`passthruFun` remove redundant override. Performace is slightly better
~200MB less memory.
---
 pkgs/development/interpreters/python/passthrufun.nix | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/pkgs/development/interpreters/python/passthrufun.nix b/pkgs/development/interpreters/python/passthrufun.nix
index d4e20aa24fc9..be5d8a11add5 100644
--- a/pkgs/development/interpreters/python/passthrufun.nix
+++ b/pkgs/development/interpreters/python/passthrufun.nix
@@ -106,10 +106,6 @@ let
           python = self;
         }
     );
-  pythonOnBuildForHost_overridden = pythonOnBuildForHost.override {
-    inherit packageOverrides;
-    self = pythonOnBuildForHost_overridden;
-  };
 in
 rec {
   isPy27 = pythonVersion == "2.7";
@@ -144,7 +140,7 @@ rec {
   pythonAtLeast = lib.versionAtLeast pythonVersion;
   pythonOlder = lib.versionOlder pythonVersion;
   inherit hasDistutilsCxxPatch;
-  pythonOnBuildForHost = pythonOnBuildForHost_overridden;
+  inherit pythonOnBuildForHost;
 
   tests = callPackage ./tests.nix {
     python = self;

From 9d035c1db1f66b5ec1ee0a361f4dfc10ee1df206 Mon Sep 17 00:00:00 2001
From: Alexis Hildebrandt <afh@surryhill.net>
Date: Wed, 12 Mar 2025 19:25:39 +0100
Subject: [PATCH 022/146] metabase: migrate to by-name

---
 .../metabase/default.nix => by-name/me/metabase/package.nix}  | 0
 pkgs/top-level/all-packages.nix                               | 4 ----
 2 files changed, 4 deletions(-)
 rename pkgs/{servers/metabase/default.nix => by-name/me/metabase/package.nix} (100%)

diff --git a/pkgs/servers/metabase/default.nix b/pkgs/by-name/me/metabase/package.nix
similarity index 100%
rename from pkgs/servers/metabase/default.nix
rename to pkgs/by-name/me/metabase/package.nix
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 01cee5c744ab..9af2936b224b 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2618,10 +2618,6 @@ with pkgs;
           throw "mesonEmulatorHook may only be added to nativeBuildInputs when the target binaries can't be executed; however you are attempting to use it in a situation where ${stdenv.hostPlatform.config} can execute ${stdenv.targetPlatform.config}. Consider only adding mesonEmulatorHook according to a conditional based canExecute in your package expression."
       );
 
-  metabase = callPackage ../servers/metabase {
-    jdk11 = jdk11_headless;
-  };
-
   mkspiffs = callPackage ../tools/filesystems/mkspiffs { };
 
   mkspiffs-presets = recurseIntoAttrs (callPackages ../tools/filesystems/mkspiffs/presets.nix { });

From 19356993bd0755a9b95a40468605270f632fbf73 Mon Sep 17 00:00:00 2001
From: Alexis Hildebrandt <afh@surryhill.net>
Date: Wed, 12 Mar 2025 19:29:07 +0100
Subject: [PATCH 023/146] metabase: modernize

---
 pkgs/by-name/me/metabase/package.nix | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/pkgs/by-name/me/metabase/package.nix b/pkgs/by-name/me/metabase/package.nix
index d6cac37c3e2d..0ccd46c00454 100644
--- a/pkgs/by-name/me/metabase/package.nix
+++ b/pkgs/by-name/me/metabase/package.nix
@@ -3,16 +3,19 @@
   stdenv,
   fetchurl,
   makeWrapper,
-  jdk11,
+  jdk11_headless,
   nixosTests,
 }:
 
-stdenv.mkDerivation rec {
+let
+  jdk11 = jdk11_headless;
+in
+stdenv.mkDerivation (finalAttrs: {
   pname = "metabase";
   version = "0.52.8";
 
   src = fetchurl {
-    url = "https://downloads.metabase.com/v${version}/metabase.jar";
+    url = "https://downloads.metabase.com/v${finalAttrs.version}/metabase.jar";
     hash = "sha256-Z14BuKaSAMzlgdtqppc/3ItCxVZwE4E1EQUVMVR6JwQ=";
   };
 
@@ -22,12 +25,12 @@ stdenv.mkDerivation rec {
 
   installPhase = ''
     runHook preInstall
-    makeWrapper ${jdk11}/bin/java $out/bin/metabase --add-flags "-jar $src"
+    makeWrapper ${lib.getExe jdk11} $out/bin/metabase --add-flags "-jar $src"
     runHook postInstall
   '';
 
   meta = with lib; {
-    description = "Easy, open source way for everyone in your company to ask questions and learn from data";
+    description = "Business Intelligence and Embedded Analytics tool";
     homepage = "https://metabase.com";
     sourceProvenance = with sourceTypes; [ binaryBytecode ];
     license = licenses.agpl3Only;
@@ -42,4 +45,4 @@ stdenv.mkDerivation rec {
   passthru.tests = {
     inherit (nixosTests) metabase;
   };
-}
+})

From f7907c177e54006c2e80aefe7c704d233eb1bd1b Mon Sep 17 00:00:00 2001
From: Alexis Hildebrandt <afh@surryhill.net>
Date: Wed, 12 Mar 2025 19:41:26 +0100
Subject: [PATCH 024/146] metabase: switch to jre from jdk11_headless

---
 pkgs/by-name/me/metabase/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/me/metabase/package.nix b/pkgs/by-name/me/metabase/package.nix
index 0ccd46c00454..6510f0dda84d 100644
--- a/pkgs/by-name/me/metabase/package.nix
+++ b/pkgs/by-name/me/metabase/package.nix
@@ -3,12 +3,12 @@
   stdenv,
   fetchurl,
   makeWrapper,
-  jdk11_headless,
+  jre_headless,
   nixosTests,
 }:
 
 let
-  jdk11 = jdk11_headless;
+  jre = jre_headless;
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "metabase";
@@ -25,7 +25,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   installPhase = ''
     runHook preInstall
-    makeWrapper ${lib.getExe jdk11} $out/bin/metabase --add-flags "-jar $src"
+    makeWrapper ${lib.getExe jre} $out/bin/metabase --add-flags "-jar $src"
     runHook postInstall
   '';
 

From 96c25d43d417f2afd6845e6acf91850466b6c374 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 2 Apr 2025 19:03:32 +0000
Subject: [PATCH 025/146] plemoljp: 2.0.3 -> 2.0.4

---
 pkgs/by-name/pl/plemoljp/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/pl/plemoljp/package.nix b/pkgs/by-name/pl/plemoljp/package.nix
index ec13bfaaf936..59d92b848bab 100644
--- a/pkgs/by-name/pl/plemoljp/package.nix
+++ b/pkgs/by-name/pl/plemoljp/package.nix
@@ -6,11 +6,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "plemoljp";
-  version = "2.0.3";
+  version = "2.0.4";
 
   src = fetchzip {
     url = "https://github.com/yuru7/PlemolJP/releases/download/v${version}/PlemolJP_v${version}.zip";
-    hash = "sha256-cT2BpD2PoAd38uYCQlq5fv9NYgwInblrYdK/XDEmOWI=";
+    hash = "sha256-pajE86IK05mm3Z507bvoMGy8JJwuGWZnUiSrXndiBTk=";
   };
 
   installPhase = ''

From d5477d94fc99bfed79faba3088df24f00874bc92 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 2 Apr 2025 19:03:43 +0000
Subject: [PATCH 026/146] plemoljp-hs: 2.0.3 -> 2.0.4

---
 pkgs/by-name/pl/plemoljp-hs/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/pl/plemoljp-hs/package.nix b/pkgs/by-name/pl/plemoljp-hs/package.nix
index bc736de3bf7c..20ec33ee1253 100644
--- a/pkgs/by-name/pl/plemoljp-hs/package.nix
+++ b/pkgs/by-name/pl/plemoljp-hs/package.nix
@@ -6,11 +6,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "plemoljp-hs";
-  version = "2.0.3";
+  version = "2.0.4";
 
   src = fetchzip {
     url = "https://github.com/yuru7/PlemolJP/releases/download/v${version}/PlemolJP_HS_v${version}.zip";
-    hash = "sha256-rKWZMIK6TP6IV6KjFGuZE2S6IiMtjtHZeWM44tULduk=";
+    hash = "sha256-+pRbMgRaIbsXo8e7rQre377F8LhbK9rBjG/vYrdeFQM=";
   };
 
   installPhase = ''

From 837ff226bbd44c29303611703a4085d48f0957c9 Mon Sep 17 00:00:00 2001
From: Cole Helbling <cole.e.helbling@outlook.com>
Date: Wed, 2 Apr 2025 07:55:32 -0700
Subject: [PATCH 027/146] flake: fix `nix flake check --all-systems --no-build`
 again

This regressed in be4d27febe7776aac010f1ce11e1ff1f60f09bdd, because
sphinx-issues depends on pandoc at build-time (which depends on GHC).

Previously fixed in https://github.com/NixOS/nixpkgs/pull/349076.
---
 flake.nix | 31 +++++++++++++++++++++++++------
 1 file changed, 25 insertions(+), 6 deletions(-)

diff --git a/flake.nix b/flake.nix
index a82bb383c062..3bd0a48a5cce 100644
--- a/flake.nix
+++ b/flake.nix
@@ -98,15 +98,26 @@
 
       checks = forAllSystems (
         system:
-        {
-          tarball = jobs.${system}.tarball;
-        }
+        { }
+        //
+          lib.optionalAttrs
+            (
+              # Exclude x86_64-freebsd because "Failed to evaluate rustc-wrapper-1.85.0: «broken»: is marked as broken"
+              system != "x86_64-freebsd"
+            )
+            {
+              tarball = jobs.${system}.tarball;
+            }
         //
           lib.optionalAttrs
             (
               self.legacyPackages.${system}.stdenv.hostPlatform.isLinux
               # Exclude power64 due to "libressl is not available on the requested hostPlatform" with hostPlatform being power64
               && !self.legacyPackages.${system}.targetPlatform.isPower64
+              # Exclude armv6l-linux because "cannot bootstrap GHC on this platform ('armv6l-linux' with libc 'defaultLibc')"
+              && system != "armv6l-linux"
+              # Exclude riscv64-linux because "cannot bootstrap GHC on this platform ('riscv64-linux' with libc 'defaultLibc')"
+              && system != "riscv64-linux"
             )
             {
               # Test that ensures that the nixosSystem function can accept a lib argument
@@ -156,8 +167,8 @@
               system != "armv6l-linux"
               # Exclude riscv64-linux because "Package ‘ghc-9.6.6’ in .../pkgs/development/compilers/ghc/common-hadrian.nix:579 is not available on the requested hostPlatform"
               && system != "riscv64-linux"
-              # Exclude FreeBSD because "Package ‘ghc-9.6.6’ in .../pkgs/development/compilers/ghc/common-hadrian.nix:579 is not available on the requested hostPlatform"
-              && !self.legacyPackages.${system}.stdenv.hostPlatform.isFreeBSD
+              # Exclude x86_64-freebsd because "Package ‘ghc-9.6.6’ in .../pkgs/development/compilers/ghc/common-hadrian.nix:579 is not available on the requested hostPlatform"
+              && system != "x86_64-freebsd"
             )
             {
               /**
@@ -167,7 +178,15 @@
             }
       );
 
-      formatter = forAllSystems (system: (import ./ci { inherit system; }).fmt.pkg);
+      formatter = lib.filterAttrs (
+        system: _:
+        # Exclude armv6l-linux because "cannot bootstrap GHC on this platform ('armv6l-linux' with libc 'defaultLibc')"
+        system != "armv6l-linux"
+        # Exclude riscv64-linux because "cannot bootstrap GHC on this platform ('riscv64-linux' with libc 'defaultLibc')"
+        && system != "riscv64-linux"
+        # Exclude x86_64-freebsd because "Package ‘go-1.22.12-freebsd-amd64-bootstrap’ in /nix/store/0yw40qnrar3lvc5hax5n49abl57apjbn-source/pkgs/development/compilers/go/binary.nix:50 is not available on the requested hostPlatform"
+        && system != "x86_64-freebsd"
+      ) (forAllSystems (system: (import ./ci { inherit system; }).fmt.pkg));
 
       /**
         A nested structure of [packages](https://nix.dev/manual/nix/latest/glossary#package-attribute-set) and other values.

From 06b7e29907477081045d9e563c2c3fe61f61e063 Mon Sep 17 00:00:00 2001
From: Cole Helbling <cole.e.helbling@outlook.com>
Date: Wed, 2 Apr 2025 07:55:32 -0700
Subject: [PATCH 028/146] ci/eval: check that flake outputs on all systems
 still evaluate

---
 .github/workflows/eval.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/eval.yml b/.github/workflows/eval.yml
index 82781f96c736..01149578af78 100644
--- a/.github/workflows/eval.yml
+++ b/.github/workflows/eval.yml
@@ -75,6 +75,9 @@ jobs:
         with:
           extra_nix_config: sandbox = true
 
+      - name: Ensure flake outputs on all systems still evaluate
+        run: nix --experimental-features 'nix-command flakes' flake check --all-systems --no-build ./nixpkgs
+
       - name: Query nixpkgs with aliases enabled to check for basic syntax errors
         run: |
           time nix-env -I ./nixpkgs -f ./nixpkgs -qa '*' --option restrict-eval true --option allow-import-from-derivation false >/dev/null

From 8dc9adb7e6b3046d992cbf1ecea88de7d5028114 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Gutyina=20Gerg=C5=91?= <gutyina.gergo.2@gmail.com>
Date: Thu, 13 Feb 2025 01:38:05 +0100
Subject: [PATCH 029/146] pocket-id: init at 0.42.1

Co-authored-by: ymstnt <21342713+YMSTNT@users.noreply.github.com>

s: 0.42.1 -> 0.44.0

s: 0.44.0 -> 0.45.0
---
 pkgs/by-name/po/pocket-id/package.nix | 115 ++++++++++++++++++++++++++
 1 file changed, 115 insertions(+)
 create mode 100644 pkgs/by-name/po/pocket-id/package.nix

diff --git a/pkgs/by-name/po/pocket-id/package.nix b/pkgs/by-name/po/pocket-id/package.nix
new file mode 100644
index 000000000000..f29410a8e3c5
--- /dev/null
+++ b/pkgs/by-name/po/pocket-id/package.nix
@@ -0,0 +1,115 @@
+{
+  lib,
+  fetchFromGitHub,
+  buildGoModule,
+  buildNpmPackage,
+  fetchurl,
+  makeWrapper,
+  nodejs,
+  stdenvNoCC,
+  nix-update-script,
+}:
+
+let
+  version = "0.45.0";
+  src = fetchFromGitHub {
+    owner = "pocket-id";
+    repo = "pocket-id";
+    tag = "v${version}";
+    hash = "sha256-x5Y3ArkIPxiE6avk9DNyFdfkc/pY6h3JH3PZCS8U/GM=";
+  };
+
+  backend = buildGoModule {
+    pname = "pocket-id-backend";
+    inherit version src;
+
+    sourceRoot = "${src.name}/backend";
+
+    vendorHash = "sha256-mqpBP+A2X5ome1Ppg/Kki0C+A77jFtWzUjI/RN+ZCzg=";
+
+    preFixup = ''
+      mv $out/bin/cmd $out/bin/pocket-id-backend
+    '';
+  };
+
+  frontend = buildNpmPackage (finalAttrs: {
+    pname = "pocket-id-frontend";
+    inherit version src;
+
+    sourceRoot = "${src.name}/frontend";
+
+    npmDepsHash = "sha256-cpmZzlz+wusfRLN4iIGdk+I4SWrX/gk2fbhg+Gg3paw=";
+    npmFlags = [ "--legacy-peer-deps" ];
+
+    nativeBuildInputs = [
+      makeWrapper
+    ];
+
+    installPhase = ''
+      runHook preInstall
+
+      # even though vite build creates most of the minified js files,
+      # it still needs a few packages from node_modules, try to strip that
+      npm prune --omit=dev --omit=optional $npmFlags
+      # larger seemingly unused packages
+      rm -r node_modules/{lucide-svelte,bits-ui,jiti,@swc,.bin}
+      # unused file types
+      for pattern in '*.map' '*.map.js' '*.ts'; do
+        find . -type f -name "$pattern" -exec rm {} +
+      done
+
+      mkdir -p $out/{bin,lib/pocket-id-frontend}
+      cp -r build $out/lib/pocket-id-frontend/dist
+      cp -r node_modules $out/lib/pocket-id-frontend/node_modules
+      makeWrapper ${lib.getExe nodejs} $out/bin/pocket-id-frontend \
+        --add-flags $out/lib/pocket-id-frontend/dist/index.js
+
+      runHook postInstall
+    '';
+  });
+
+in
+stdenvNoCC.mkDerivation rec {
+  pname = "pocket-id";
+  inherit
+    version
+    src
+    backend
+    frontend
+    ;
+
+  dontUnpack = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+    ln -s ${backend}/bin/pocket-id-backend $out/bin/pocket-id-backend
+    ln -s ${frontend}/bin/pocket-id-frontend $out/bin/pocket-id-frontend
+
+    runHook postInstall
+  '';
+
+  passthru = {
+    updateScript = nix-update-script {
+      extraArgs = [
+        "--subpackage"
+        "backend"
+        "--subpackage"
+        "frontend"
+      ];
+    };
+  };
+
+  meta = {
+    description = "OIDC provider with passkeys support";
+    homepage = "https://pocket-id.org";
+    changelog = "https://github.com/pocket-id/pocket-id/releases/tag/v${version}";
+    license = lib.licenses.bsd2;
+    maintainers = with lib.maintainers; [
+      gepbird
+      ymstnt
+    ];
+    platforms = lib.platforms.unix;
+  };
+}

From 01be6580d38ccc3755bbe8408bf7b38bf075d746 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Gutyina=20Gerg=C5=91?= <gutyina.gergo.2@gmail.com>
Date: Thu, 3 Apr 2025 06:49:33 +0200
Subject: [PATCH 030/146] nixos/pocket-id: init

Co-authored-by: ymstnt <21342713+YMSTNT@users.noreply.github.com>
---
 .../manual/release-notes/rl-2505.section.md   |   2 +
 nixos/modules/module-list.nix                 |   1 +
 nixos/modules/services/security/pocket-id.nix | 278 ++++++++++++++++++
 nixos/tests/all-tests.nix                     |   1 +
 nixos/tests/pocket-id.nix                     |  47 +++
 pkgs/by-name/po/pocket-id/package.nix         |   4 +
 6 files changed, 333 insertions(+)
 create mode 100644 nixos/modules/services/security/pocket-id.nix
 create mode 100644 nixos/tests/pocket-id.nix

diff --git a/nixos/doc/manual/release-notes/rl-2505.section.md b/nixos/doc/manual/release-notes/rl-2505.section.md
index f531ff61af86..9d05c32c697d 100644
--- a/nixos/doc/manual/release-notes/rl-2505.section.md
+++ b/nixos/doc/manual/release-notes/rl-2505.section.md
@@ -166,6 +166,8 @@
 
 - [mqtt-exporter](https://github.com/kpetremann/mqtt-exporter/), a Prometheus exporter for exposing messages from MQTT. Available as [services.prometheus.exporters.mqtt](#opt-services.prometheus.exporters.mqtt.enable).
 
+- [pocket-id](https://pocket-id.org/), an OIDC provider with passkeys support. Available as [services.pocket-id](#opt-services.pocket-id.enable).
+
 - [nvidia-gpu](https://github.com/utkuozdemir/nvidia_gpu_exporter), a Prometheus exporter that scrapes `nvidia-smi` for GPU metrics. Available as [services.prometheus.exporters.nvidia-gpu](#opt-services.prometheus.exporters.nvidia-gpu.enable).
 
 - [OpenGamepadUI](https://github.com/ShadowBlip/OpenGamepadUI/), an open source gamepad-native game launcher and overlay for Linux. Available as [programs.opengamepadui](#opt-programs.opengamepadui.enable).
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 0a23a0d0d653..5aa0af4c442c 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1419,6 +1419,7 @@
   ./services/security/paretosecurity.nix
   ./services/security/pass-secret-service.nix
   ./services/security/physlock.nix
+  ./services/security/pocket-id.nix
   ./services/security/shibboleth-sp.nix
   ./services/security/sks.nix
   ./services/security/sshguard.nix
diff --git a/nixos/modules/services/security/pocket-id.nix b/nixos/modules/services/security/pocket-id.nix
new file mode 100644
index 000000000000..87c13b638dcb
--- /dev/null
+++ b/nixos/modules/services/security/pocket-id.nix
@@ -0,0 +1,278 @@
+{
+  lib,
+  pkgs,
+  config,
+  ...
+}:
+
+let
+  inherit (lib)
+    mkEnableOption
+    mkIf
+    mkOption
+    optionalAttrs
+    optional
+    mkPackageOption
+    ;
+  inherit (lib.types)
+    bool
+    path
+    str
+    submodule
+    ;
+
+  cfg = config.services.pocket-id;
+
+  format = pkgs.formats.keyValue { };
+  settingsFile = format.generate "pocket-id-env-vars" cfg.settings;
+in
+{
+  meta.maintainers = with lib.maintainers; [
+    gepbird
+    ymstnt
+  ];
+
+  options.services.pocket-id = {
+    enable = mkEnableOption "Pocket ID server";
+
+    package = mkPackageOption pkgs "pocket-id" { };
+
+    environmentFile = mkOption {
+      type = path;
+      description = ''
+        Path to an environment file loaded for the Pocket ID service.
+
+        This can be used to securely store tokens and secrets outside of the world-readable Nix store.
+
+        Example contents of the file:
+        MAXMIND_LICENSE_KEY=your-license-key
+      '';
+      default = "/dev/null";
+      example = "/var/lib/secrets/pocket-id";
+    };
+
+    settings = mkOption {
+      type = submodule {
+        freeformType = format.type;
+
+        options = {
+          PUBLIC_APP_URL = mkOption {
+            type = str;
+            description = ''
+              The URL where you will access the app.
+            '';
+            default = "http://localhost";
+          };
+
+          TRUST_PROXY = mkOption {
+            type = bool;
+            description = ''
+              Whether the app is behind a reverse proxy.
+            '';
+            default = false;
+          };
+        };
+      };
+
+      default = { };
+
+      description = ''
+        Environment variables that will be passed to Pocket ID, see
+        [configuration options](https://pocket-id.org/docs/configuration/environment-variables)
+        for supported values.
+      '';
+    };
+
+    dataDir = mkOption {
+      type = path;
+      default = "/var/lib/pocket-id";
+      description = ''
+        The directory where Pocket ID will store its data, such as the database.
+      '';
+    };
+
+    user = mkOption {
+      type = str;
+      default = "pocket-id";
+      description = "User account under which Pocket ID runs.";
+    };
+
+    group = mkOption {
+      type = str;
+      default = "pocket-id";
+      description = "Group account under which Pocket ID runs.";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    warnings = (
+      optional (cfg.settings ? MAXMIND_LICENSE_KEY)
+        "config.services.pocket-id.settings.MAXMIND_LICENSE_KEY will be stored as plaintext in the Nix store. Use config.services.pocket-id.environmentFile instead."
+    );
+
+    systemd.tmpfiles.rules = [
+      "d ${cfg.dataDir} 0755 ${cfg.user} ${cfg.group}"
+    ];
+
+    systemd.services = {
+      pocket-id-backend = {
+        description = "Pocket ID backend";
+        after = [ "network.target" ];
+        wantedBy = [ "multi-user.target" ];
+        restartTriggers = [
+          cfg.package
+          cfg.environmentFile
+          settingsFile
+        ];
+
+        serviceConfig = {
+          Type = "simple";
+          User = cfg.user;
+          Group = cfg.group;
+          WorkingDirectory = cfg.dataDir;
+          ExecStart = "${cfg.package}/bin/pocket-id-backend";
+          Restart = "always";
+          EnvironmentFile = [
+            cfg.environmentFile
+            settingsFile
+          ];
+
+          # Hardening
+          AmbientCapabilities = "";
+          CapabilityBoundingSet = "";
+          DeviceAllow = "";
+          DevicePolicy = "closed";
+          #IPAddressDeny = "any"; # communicates with the frontend
+          LockPersonality = true;
+          MemoryDenyWriteExecute = true;
+          NoNewPrivileges = true;
+          PrivateDevices = true;
+          PrivateNetwork = false; # communicates with the frontend
+          PrivateTmp = true;
+          PrivateUsers = true;
+          ProcSubset = "pid";
+          ProtectClock = true;
+          ProtectControlGroups = true;
+          ProtectHome = true;
+          ProtectHostname = true;
+          ProtectKernelLogs = true;
+          ProtectKernelModules = true;
+          ProtectKernelTunables = true;
+          ProtectProc = "invisible";
+          ProtectSystem = "full"; # needs to write in cfg.dataDir
+          RemoveIPC = true;
+          RestrictAddressFamilies = [
+            "AF_INET"
+            "AF_INET6"
+          ];
+          RestrictNamespaces = true;
+          RestrictRealtime = true;
+          RestrictSUIDSGID = true;
+          SystemCallArchitectures = "native";
+          SystemCallFilter = lib.concatStringsSep " " [
+            "~"
+            "@clock"
+            "@cpu-emulation"
+            "@debug"
+            "@module"
+            "@mount"
+            "@obsolete"
+            "@privileged"
+            "@raw-io"
+            "@reboot"
+            #"@resources" # vm test segfaults
+            "@swap"
+          ];
+          UMask = "0077";
+        };
+      };
+
+      pocket-id-frontend = {
+        description = "Pocket ID frontend";
+        after = [
+          "network.target"
+          "pocket-id-backend.service"
+        ];
+        wantedBy = [ "multi-user.target" ];
+        restartTriggers = [
+          cfg.package
+          cfg.environmentFile
+          settingsFile
+        ];
+
+        serviceConfig = {
+          Type = "simple";
+          User = cfg.user;
+          Group = cfg.group;
+          ExecStart = "${cfg.package}/bin/pocket-id-frontend";
+          Restart = "always";
+          EnvironmentFile = [
+            cfg.environmentFile
+            settingsFile
+          ];
+
+          # Hardening
+          AmbientCapabilities = "";
+          CapabilityBoundingSet = "";
+          DeviceAllow = "";
+          DevicePolicy = "closed";
+          #IPAddressDeny = "any"; # communicates with the backend and client
+          LockPersonality = true;
+          MemoryDenyWriteExecute = false; # V8_Fatal segfault
+          NoNewPrivileges = true;
+          PrivateDevices = true;
+          PrivateNetwork = false; # communicates with the backend and client
+          PrivateTmp = true;
+          PrivateUsers = true;
+          ProcSubset = "pid";
+          ProtectClock = true;
+          ProtectControlGroups = true;
+          ProtectHome = true;
+          ProtectHostname = true;
+          ProtectKernelLogs = true;
+          ProtectKernelModules = true;
+          ProtectKernelTunables = true;
+          ProtectProc = "invisible";
+          ProtectSystem = "strict";
+          RemoveIPC = true;
+          RestrictAddressFamilies = [
+            "AF_INET"
+            "AF_INET6"
+          ];
+          RestrictNamespaces = true;
+          RestrictRealtime = true;
+          RestrictSUIDSGID = true;
+          SystemCallArchitectures = "native";
+          SystemCallFilter = lib.concatStringsSep " " [
+            "~"
+            "@clock"
+            "@cpu-emulation"
+            "@debug"
+            "@module"
+            "@mount"
+            "@obsolete"
+            "@privileged"
+            "@raw-io"
+            "@reboot"
+            "@resources"
+            "@swap"
+          ];
+          UMask = "0077";
+        };
+      };
+    };
+
+    users.users = optionalAttrs (cfg.user == "pocket-id") {
+      pocket-id = {
+        isSystemUser = true;
+        group = cfg.group;
+        description = "Pocket ID backend user";
+        home = cfg.dataDir;
+      };
+    };
+
+    users.groups = optionalAttrs (cfg.group == "pocket-id") {
+      pocket-id = { };
+    };
+  };
+}
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index cc8eecddf778..186e078c8451 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -1039,6 +1039,7 @@ in
   pleroma = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./pleroma.nix { };
   plikd = handleTest ./plikd.nix { };
   plotinus = handleTest ./plotinus.nix { };
+  pocket-id = handleTest ./pocket-id.nix { };
   podgrab = handleTest ./podgrab.nix { };
   podman = handleTestOn [ "aarch64-linux" "x86_64-linux" ] ./podman/default.nix { };
   podman-tls-ghostunnel = handleTestOn [
diff --git a/nixos/tests/pocket-id.nix b/nixos/tests/pocket-id.nix
new file mode 100644
index 000000000000..753fa251473f
--- /dev/null
+++ b/nixos/tests/pocket-id.nix
@@ -0,0 +1,47 @@
+import ./make-test-python.nix (
+  { lib, ... }:
+
+  {
+    name = "pocket-id";
+    meta.maintainers = with lib.maintainers; [
+      gepbird
+      ymstnt
+    ];
+
+    nodes = {
+      machine =
+        { ... }:
+        {
+          services.pocket-id = {
+            enable = true;
+            settings = {
+              PORT = 10001;
+              INTERNAL_BACKEND_URL = "http://localhost:10002";
+              BACKEND_PORT = 10002;
+            };
+          };
+        };
+    };
+
+    testScript =
+      { nodes, ... }:
+      let
+        inherit (nodes.machine.services.pocket-id) settings;
+        inherit (builtins) toString;
+      in
+      ''
+        machine.wait_for_unit("pocket-id-backend.service")
+        machine.wait_for_open_port(${toString settings.BACKEND_PORT})
+        machine.wait_for_unit("pocket-id-frontend.service")
+        machine.wait_for_open_port(${toString settings.PORT})
+
+        backend_status = machine.succeed("curl -L -o /tmp/backend-output -w '%{http_code}' http://localhost:${toString settings.BACKEND_PORT}/api/users/me")
+        assert backend_status == "401"
+        machine.succeed("grep 'You are not signed in' /tmp/backend-output")
+
+        frontend_status = machine.succeed("curl -L -o /tmp/frontend-output -w '%{http_code}' http://localhost:${toString settings.PORT}")
+        assert frontend_status == "200"
+        machine.succeed("grep 'Sign in to Pocket ID' /tmp/frontend-output")
+      '';
+  }
+)
diff --git a/pkgs/by-name/po/pocket-id/package.nix b/pkgs/by-name/po/pocket-id/package.nix
index f29410a8e3c5..0fd97ab64c86 100644
--- a/pkgs/by-name/po/pocket-id/package.nix
+++ b/pkgs/by-name/po/pocket-id/package.nix
@@ -7,6 +7,7 @@
   makeWrapper,
   nodejs,
   stdenvNoCC,
+  nixosTests,
   nix-update-script,
 }:
 
@@ -91,6 +92,9 @@ stdenvNoCC.mkDerivation rec {
   '';
 
   passthru = {
+    tests = {
+      inherit (nixosTests) pocket-id;
+    };
     updateScript = nix-update-script {
       extraArgs = [
         "--subpackage"

From 8a512d5e646722fd19b6bdc6a37ca810ee2faa91 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 3 Apr 2025 08:25:43 +0000
Subject: [PATCH 031/146] erlang_language_platform: 2025-02-13 -> 2025-04-02

---
 pkgs/by-name/er/erlang-language-platform/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/er/erlang-language-platform/package.nix b/pkgs/by-name/er/erlang-language-platform/package.nix
index 1450966030a1..da80e66bec07 100644
--- a/pkgs/by-name/er/erlang-language-platform/package.nix
+++ b/pkgs/by-name/er/erlang-language-platform/package.nix
@@ -14,14 +14,14 @@ let
 
   hashes = {
     linux-aarch64-unknown-linux-gnu = "sha256-i6XsOK8csrJ/9TDzltA7mGjdutLZONFiYGV5tqSCy8o=";
-    linux-x86_64-unknown-linux-gnu = "sha256-gBIzG0LaP9qxivkr47JpBu1z9km7o/1Wppk/6k2WslE=";
+    linux-x86_64-unknown-linux-gnu = "sha256-XK3DPWIdPDoIL10EATa8p1bnlpZaOzOdU0LnuKbj++E=";
     macos-aarch64-apple-darwin = "sha256-8e5duQYDVFyZejMjuZPuWhg1on3CBku9eBuilG5p1BY=";
     macos-x86_64-apple-darwin = "sha256-dnouUBUUAkMr1h+IJWYamxmk8IC7JdeIUS9/YI0GzOU=";
   };
 in
 stdenv.mkDerivation rec {
   pname = "erlang-language-platform";
-  version = "2025-02-13";
+  version = "2025-04-02";
 
   src = fetchurl {
     url = "https://github.com/WhatsApp/erlang-language-platform/releases/download/${version}/elp-${release}-otp-26.2.tar.gz";

From 28fcb980fdd69611cc3e82ecf0d9566a1343951b Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 3 Apr 2025 08:29:37 +0000
Subject: [PATCH 032/146] rabbitmq-server: 4.0.7 -> 4.0.8

---
 pkgs/by-name/ra/rabbitmq-server/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ra/rabbitmq-server/package.nix b/pkgs/by-name/ra/rabbitmq-server/package.nix
index 236533dcc3a2..c1bcbd99b138 100644
--- a/pkgs/by-name/ra/rabbitmq-server/package.nix
+++ b/pkgs/by-name/ra/rabbitmq-server/package.nix
@@ -42,12 +42,12 @@ in
 
 stdenv.mkDerivation rec {
   pname = "rabbitmq-server";
-  version = "4.0.7";
+  version = "4.0.8";
 
   # when updating, consider bumping elixir version in all-packages.nix
   src = fetchurl {
     url = "https://github.com/rabbitmq/rabbitmq-server/releases/download/v${version}/${pname}-${version}.tar.xz";
-    hash = "sha256-ScqNRa1itxawGyRruNihA60xbltw7Lek36SP9Nd+LfI=";
+    hash = "sha256-FWB5riSCb8WsGLfNJO6SZRtQxvHpwea+YosvvU8iqng=";
   };
 
   nativeBuildInputs = [

From e51150d79daecc8ec500435e6ea59f061b4bf2f2 Mon Sep 17 00:00:00 2001
From: Pratham Patel <prathampatel@thefossguy.com>
Date: Thu, 3 Apr 2025 17:28:23 +0530
Subject: [PATCH 033/146] nixos/cosmic-greeter: add autologin support

---
 nixos/modules/services/display-managers/cosmic-greeter.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/nixos/modules/services/display-managers/cosmic-greeter.nix b/nixos/modules/services/display-managers/cosmic-greeter.nix
index aa4243cfa700..e7aa9da63321 100644
--- a/nixos/modules/services/display-managers/cosmic-greeter.nix
+++ b/nixos/modules/services/display-managers/cosmic-greeter.nix
@@ -12,6 +12,7 @@
 
 let
   cfg = config.services.displayManager.cosmic-greeter;
+  cfgAutoLogin = config.services.displayManager.autoLogin;
 in
 
 {
@@ -35,6 +36,10 @@ in
           user = "cosmic-greeter";
           command = ''${lib.getExe' pkgs.coreutils "env"} XCURSOR_THEME="''${XCURSOR_THEME:-Pop}" systemd-cat -t cosmic-greeter ${lib.getExe pkgs.cosmic-comp} ${lib.getExe cfg.package}'';
         };
+        initial_session = lib.mkIf (cfgAutoLogin.enable && (cfgAutoLogin.user != null)) {
+          user = cfgAutoLogin.user;
+          command = ''${lib.getExe' pkgs.coreutils "env"} XCURSOR_THEME="''${XCURSOR_THEME:-Pop}" systemd-cat -t cosmic-session ${lib.getExe pkgs.cosmic-session}'';
+        };
       };
     };
 

From ff079b35b5a79d09dfab3cdecf3fead21631f470 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 3 Apr 2025 12:37:59 +0000
Subject: [PATCH 034/146] cariddi: 1.3.5 -> 1.3.6

---
 pkgs/by-name/ca/cariddi/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ca/cariddi/package.nix b/pkgs/by-name/ca/cariddi/package.nix
index 443623316b53..4c2e59842534 100644
--- a/pkgs/by-name/ca/cariddi/package.nix
+++ b/pkgs/by-name/ca/cariddi/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "cariddi";
-  version = "1.3.5";
+  version = "1.3.6";
 
   src = fetchFromGitHub {
     owner = "edoardottt";
     repo = "cariddi";
     tag = "v${version}";
-    hash = "sha256-mRrUTRknax3b4hs3frQMzg0GyB3WjMDZJk0RQSAC88U=";
+    hash = "sha256-ixjHPO0FXKbWOfjMVz1YD+wWpL8wcn2CCO46KF1zb0U=";
   };
 
-  vendorHash = "sha256-ML1aLbrYhs2IxnN2ywKFOpvAV6yuYb8GI+dtoxwJl4A=";
+  vendorHash = "sha256-7v92+iDAYG0snJjVCX35rLKV/ZEzaVX2au4HOwa/ILU=";
 
   ldflags = [
     "-w"

From 08fdacb5a7e9c1eb320c58a9b812d8cb7086cd4a Mon Sep 17 00:00:00 2001
From: "Adam C. Stephens" <adam@valkor.net>
Date: Tue, 1 Apr 2025 18:25:56 +0000
Subject: [PATCH 035/146] pythonPackages.canonical-sphinx-extensions: init at
 0.0.27

---
 .../canonical-sphinx-extensions/default.nix   | 44 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  4 ++
 2 files changed, 48 insertions(+)
 create mode 100644 pkgs/development/python-modules/canonical-sphinx-extensions/default.nix

diff --git a/pkgs/development/python-modules/canonical-sphinx-extensions/default.nix b/pkgs/development/python-modules/canonical-sphinx-extensions/default.nix
new file mode 100644
index 000000000000..1ad27acb2833
--- /dev/null
+++ b/pkgs/development/python-modules/canonical-sphinx-extensions/default.nix
@@ -0,0 +1,44 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  setuptools,
+  beautifulsoup4,
+  docutils,
+  gitpython,
+  requests,
+  sphinx,
+}:
+
+buildPythonPackage rec {
+  pname = "canonical-sphinx-extensions";
+  version = "0.0.27";
+  pyproject = true;
+
+  src = fetchPypi {
+    pname = "canonical_sphinx_extensions";
+    inherit version;
+    hash = "sha256-ZorSmn+PAVS8xO7X3zk6u3W7pn3JB9w0PhFAXzv6l78=";
+  };
+
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
+    beautifulsoup4
+    docutils
+    gitpython
+    requests
+    sphinx
+  ];
+
+  doCheck = false;
+
+  meta = {
+    description = "A collection of Sphinx extensions used by Canonical documentation";
+    homepage = "https://pypi.org/project/canonical-sphinx-extensions";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 6d1b37581114..d7ac01cb0adf 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -2192,6 +2192,10 @@ self: super: with self; {
 
   canmatrix = callPackage ../development/python-modules/canmatrix { };
 
+  canonical-sphinx-extensions =
+    callPackage ../development/python-modules/canonical-sphinx-extensions
+      { };
+
   canonicaljson = callPackage ../development/python-modules/canonicaljson { };
 
   canopen = callPackage ../development/python-modules/canopen { };

From d8187600ca4bbf5bc61c33728616bda4337acf33 Mon Sep 17 00:00:00 2001
From: Alexis Hildebrandt <afh@surryhill.net>
Date: Wed, 12 Mar 2025 19:43:20 +0100
Subject: [PATCH 036/146] metabase: 0.52.8 -> 0.54.1

---
 pkgs/by-name/me/metabase/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/me/metabase/package.nix b/pkgs/by-name/me/metabase/package.nix
index 6510f0dda84d..1a7af0ffce8f 100644
--- a/pkgs/by-name/me/metabase/package.nix
+++ b/pkgs/by-name/me/metabase/package.nix
@@ -12,11 +12,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "metabase";
-  version = "0.52.8";
+  version = "0.54.1";
 
   src = fetchurl {
     url = "https://downloads.metabase.com/v${finalAttrs.version}/metabase.jar";
-    hash = "sha256-Z14BuKaSAMzlgdtqppc/3ItCxVZwE4E1EQUVMVR6JwQ=";
+    hash = "sha256-gHLugoL3wCvlCzN2fNJtCt+1iSW+kKPzWPpqqHAn/D0=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

From 95f5b2d446f04db328d9a3dfe495d9e9188d93cc Mon Sep 17 00:00:00 2001
From: WeetHet <stas.ale66@gmail.com>
Date: Thu, 3 Apr 2025 17:32:02 +0300
Subject: [PATCH 037/146] koji: add WeetHet to maintainers

---
 pkgs/by-name/ko/koji/package.nix | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/ko/koji/package.nix b/pkgs/by-name/ko/koji/package.nix
index fb3729958667..a8790f348275 100644
--- a/pkgs/by-name/ko/koji/package.nix
+++ b/pkgs/by-name/ko/koji/package.nix
@@ -34,12 +34,15 @@ rustPlatform.buildRustPackage rec {
     openssl.dev
   ];
 
-  meta = with lib; {
+  meta = {
     description = "Interactive CLI for creating conventional commits";
     homepage = "https://github.com/its-danny/koji";
-    license = with licenses; [ mit ];
-    maintainers = with maintainers; [ ByteSudoer ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [
+      ByteSudoer
+      WeetHet
+    ];
     mainProgram = "koji";
-    platforms = platforms.unix;
+    platforms = lib.platforms.unix;
   };
 }

From 4c0eb34244eb2270b31901968dec7642df4eee61 Mon Sep 17 00:00:00 2001
From: WeetHet <stas.ale66@gmail.com>
Date: Thu, 3 Apr 2025 17:34:57 +0300
Subject: [PATCH 038/146] koji: 2.2.0 -> 3.2.0

---
 pkgs/by-name/ko/koji/package.nix | 30 +++++++++++++++++++++---------
 1 file changed, 21 insertions(+), 9 deletions(-)

diff --git a/pkgs/by-name/ko/koji/package.nix b/pkgs/by-name/ko/koji/package.nix
index a8790f348275..414d9623131e 100644
--- a/pkgs/by-name/ko/koji/package.nix
+++ b/pkgs/by-name/ko/koji/package.nix
@@ -1,39 +1,51 @@
 {
   lib,
+  stdenv,
   rustPlatform,
   fetchFromGitHub,
   pkg-config,
   perl,
   udev,
   openssl,
+  gitMinimal,
+  writableTmpDirAsHomeHook,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "koji";
-  version = "2.2.0";
+  version = "3.2.0";
 
   src = fetchFromGitHub {
-    owner = "its-danny";
+    owner = "cococonscious";
     repo = "koji";
-    rev = version;
-    hash = "sha256-2kBjHX7izo4loJ8oyPjE9FtCvUODC3Sm4T8ETIdeGZM=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-+xtq4btFbOfiyFMDHXo6riSBMhAwTLQFuE91MUHtg5Q=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-ZHti7nMfHiYur1kjxj+ySIF4/l0UU9q2urabUWZyk6E=";
+  cargoHash = "sha256-WiFXDXLJc2ictv29UoRFRpIpAqeJlEBEOvThXhLXLJA=";
 
   OPENSSL_NO_VENDOR = 1;
 
   nativeBuildInputs = [
     pkg-config
     perl
-    udev
   ];
 
   buildInputs = [
-    openssl.dev
+    openssl
+  ] ++ lib.optionals stdenv.hostPlatform.isLinux [ udev ];
+
+  nativeCheckInputs = [
+    gitMinimal
+    writableTmpDirAsHomeHook
   ];
 
+  preCheck = ''
+    git config --global user.name 'nix-user'
+    git config --global user.email 'nix-user@example.com'
+  '';
+
   meta = {
     description = "Interactive CLI for creating conventional commits";
     homepage = "https://github.com/its-danny/koji";
@@ -45,4 +57,4 @@ rustPlatform.buildRustPackage rec {
     mainProgram = "koji";
     platforms = lib.platforms.unix;
   };
-}
+})

From 798b0863a6a6d3feaf1dabda9bdc6d14c211c979 Mon Sep 17 00:00:00 2001
From: WeetHet <stas.ale66@gmail.com>
Date: Thu, 3 Apr 2025 17:35:50 +0300
Subject: [PATCH 039/146] koji: install completions, check version

---
 pkgs/by-name/ko/koji/package.nix | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/pkgs/by-name/ko/koji/package.nix b/pkgs/by-name/ko/koji/package.nix
index 414d9623131e..42f605d553c1 100644
--- a/pkgs/by-name/ko/koji/package.nix
+++ b/pkgs/by-name/ko/koji/package.nix
@@ -9,6 +9,8 @@
   openssl,
   gitMinimal,
   writableTmpDirAsHomeHook,
+  installShellFiles,
+  versionCheckHook,
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
@@ -30,6 +32,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   nativeBuildInputs = [
     pkg-config
     perl
+    installShellFiles
   ];
 
   buildInputs = [
@@ -46,6 +49,17 @@ rustPlatform.buildRustPackage (finalAttrs: {
     git config --global user.email 'nix-user@example.com'
   '';
 
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    installShellCompletion --cmd koji \
+      --bash <($out/bin/koji completions bash) \
+      --fish <($out/bin/koji completions fish) \
+      --zsh <($out/bin/koji completions zsh)
+  '';
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgram = "${placeholder "out"}/bin/${finalAttrs.meta.mainProgram}";
+
   meta = {
     description = "Interactive CLI for creating conventional commits";
     homepage = "https://github.com/its-danny/koji";

From bc519cfdb8c61ddbf8e5fc427fb504e529913291 Mon Sep 17 00:00:00 2001
From: Defelo <mail@defelo.de>
Date: Tue, 1 Apr 2025 21:33:16 +0200
Subject: [PATCH 040/146] jnv: use finalAttrs pattern

---
 pkgs/by-name/jn/jnv/package.nix | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/jn/jnv/package.nix b/pkgs/by-name/jn/jnv/package.nix
index e42b7fb671f9..908956c6dc9a 100644
--- a/pkgs/by-name/jn/jnv/package.nix
+++ b/pkgs/by-name/jn/jnv/package.nix
@@ -5,14 +5,15 @@
   stdenv,
   darwin,
 }:
-rustPlatform.buildRustPackage rec {
+
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "jnv";
   version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "ynqa";
     repo = "jnv";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
     hash = "sha256-HKZ+hF5Y7vTA4EODSAd9xYJHaipv5YukTl470ejPLtM=";
   };
 
@@ -37,4 +38,4 @@ rustPlatform.buildRustPackage rec {
       nshalman
     ];
   };
-}
+})

From a8300afe2dbfe36d72f9089434b50f648375d327 Mon Sep 17 00:00:00 2001
From: Defelo <mail@defelo.de>
Date: Tue, 1 Apr 2025 21:33:34 +0200
Subject: [PATCH 041/146] jnv: use tag in fetchFromGitHub

---
 pkgs/by-name/jn/jnv/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/jn/jnv/package.nix b/pkgs/by-name/jn/jnv/package.nix
index 908956c6dc9a..a59702ed9ad7 100644
--- a/pkgs/by-name/jn/jnv/package.nix
+++ b/pkgs/by-name/jn/jnv/package.nix
@@ -13,7 +13,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   src = fetchFromGitHub {
     owner = "ynqa";
     repo = "jnv";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-HKZ+hF5Y7vTA4EODSAd9xYJHaipv5YukTl470ejPLtM=";
   };
 

From c197699159fd1ed3cd3be0cab664a67853c91952 Mon Sep 17 00:00:00 2001
From: Defelo <mail@defelo.de>
Date: Tue, 1 Apr 2025 21:34:34 +0200
Subject: [PATCH 042/146] jnv: remove `with lib;`

---
 pkgs/by-name/jn/jnv/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/jn/jnv/package.nix b/pkgs/by-name/jn/jnv/package.nix
index a59702ed9ad7..42b0d20bb625 100644
--- a/pkgs/by-name/jn/jnv/package.nix
+++ b/pkgs/by-name/jn/jnv/package.nix
@@ -28,12 +28,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
     ]
   );
 
-  meta = with lib; {
+  meta = {
     description = "Interactive JSON filter using jq";
     mainProgram = "jnv";
     homepage = "https://github.com/ynqa/jnv";
-    license = with licenses; [ mit ];
-    maintainers = with maintainers; [
+    license = with lib.licenses; [ mit ];
+    maintainers = with lib.maintainers; [
       nealfennimore
       nshalman
     ];

From afcb71c4817cddc454fdeb13d5801069b206c1ef Mon Sep 17 00:00:00 2001
From: Defelo <mail@defelo.de>
Date: Tue, 1 Apr 2025 21:48:43 +0200
Subject: [PATCH 043/146] jnv: remove obsolete buildInputs

---
 pkgs/by-name/jn/jnv/package.nix | 10 ----------
 1 file changed, 10 deletions(-)

diff --git a/pkgs/by-name/jn/jnv/package.nix b/pkgs/by-name/jn/jnv/package.nix
index 42b0d20bb625..1b03847a1c83 100644
--- a/pkgs/by-name/jn/jnv/package.nix
+++ b/pkgs/by-name/jn/jnv/package.nix
@@ -2,8 +2,6 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
@@ -20,14 +18,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
   useFetchCargoVendor = true;
   cargoHash = "sha256-VLVoURqmUhhekNZ0a75bwjvSiLfaQ79IlltbmWVyBrI=";
 
-  buildInputs = lib.optional stdenv.hostPlatform.isDarwin (
-    with darwin.apple_sdk.frameworks;
-    [
-      CoreGraphics
-      AppKit
-    ]
-  );
-
   meta = {
     description = "Interactive JSON filter using jq";
     mainProgram = "jnv";

From 2843b39e60c86fd9962bc2e208b7e2df12aebc3e Mon Sep 17 00:00:00 2001
From: Defelo <mail@defelo.de>
Date: Tue, 1 Apr 2025 21:50:44 +0200
Subject: [PATCH 044/146] jnv: add versionCheckHook

---
 pkgs/by-name/jn/jnv/package.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/by-name/jn/jnv/package.nix b/pkgs/by-name/jn/jnv/package.nix
index 1b03847a1c83..b5b4140e1b31 100644
--- a/pkgs/by-name/jn/jnv/package.nix
+++ b/pkgs/by-name/jn/jnv/package.nix
@@ -2,6 +2,7 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
+  versionCheckHook,
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
@@ -18,6 +19,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
   useFetchCargoVendor = true;
   cargoHash = "sha256-VLVoURqmUhhekNZ0a75bwjvSiLfaQ79IlltbmWVyBrI=";
 
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
+
   meta = {
     description = "Interactive JSON filter using jq";
     mainProgram = "jnv";

From 5b86a3c7cbb0b79577807c7c59a4edc5f4119965 Mon Sep 17 00:00:00 2001
From: Defelo <mail@defelo.de>
Date: Tue, 1 Apr 2025 21:50:56 +0200
Subject: [PATCH 045/146] jnv: add updateScript

---
 pkgs/by-name/jn/jnv/package.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/by-name/jn/jnv/package.nix b/pkgs/by-name/jn/jnv/package.nix
index b5b4140e1b31..819bbeb3abd5 100644
--- a/pkgs/by-name/jn/jnv/package.nix
+++ b/pkgs/by-name/jn/jnv/package.nix
@@ -3,6 +3,7 @@
   rustPlatform,
   fetchFromGitHub,
   versionCheckHook,
+  nix-update-script,
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
@@ -23,6 +24,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
   versionCheckProgramArg = "--version";
   doInstallCheck = true;
 
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     description = "Interactive JSON filter using jq";
     mainProgram = "jnv";

From 9d55c960ba2c44941d18d0b6815987667b492fad Mon Sep 17 00:00:00 2001
From: "Adam C. Stephens" <adam@valkor.net>
Date: Tue, 1 Apr 2025 18:25:56 +0000
Subject: [PATCH 046/146] pythonPackages.sphinx-reredirects: init at 0.1.6

---
 .../sphinx-reredirects/default.nix            | 41 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 +
 2 files changed, 43 insertions(+)
 create mode 100644 pkgs/development/python-modules/sphinx-reredirects/default.nix

diff --git a/pkgs/development/python-modules/sphinx-reredirects/default.nix b/pkgs/development/python-modules/sphinx-reredirects/default.nix
new file mode 100644
index 000000000000..8fc57ab6d1f0
--- /dev/null
+++ b/pkgs/development/python-modules/sphinx-reredirects/default.nix
@@ -0,0 +1,41 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  setuptools,
+  sphinx,
+}:
+
+buildPythonPackage rec {
+  pname = "sphinx-reredirects";
+  version = "0.1.6";
+  pyproject = true;
+
+  src = fetchPypi {
+    pname = "sphinx_reredirects";
+    inherit version;
+    hash = "sha256-xJHLpUX2e+lpdQhyeBjYYmYmNmJFrmRFb+KfN+m76mQ=";
+  };
+
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
+    sphinx
+  ];
+
+  pythonImportsCheck = [
+    "sphinx_reredirects"
+  ];
+
+  meta = {
+    description = "Handles redirects for moved pages in Sphinx documentation projects";
+    homepage = "https://pypi.org/project/sphinx-reredirects";
+    license = with lib.licenses; [
+      bsd3
+      mit
+    ];
+    maintainers = with lib.maintainers; [ ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index d7ac01cb0adf..d638ae3aba7b 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -16171,6 +16171,8 @@ self: super: with self; {
 
   sphinx-pytest = callPackage ../development/python-modules/sphinx-pytest { };
 
+  sphinx-reredirects = callPackage ../development/python-modules/sphinx-reredirects { };
+
   sphinx-rtd-dark-mode = callPackage ../development/python-modules/sphinx-rtd-dark-mode { };
 
   sphinx-rtd-theme = callPackage ../development/python-modules/sphinx-rtd-theme { };

From e06dd5475e7bd5ea408a5797b9a21311e569a7e7 Mon Sep 17 00:00:00 2001
From: "Adam C. Stephens" <adam@valkor.net>
Date: Tue, 1 Apr 2025 18:25:56 +0000
Subject: [PATCH 047/146] pythonPackages.pyspelling: init at 2.10

---
 .../python-modules/pyspelling/default.nix     | 49 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 +
 2 files changed, 51 insertions(+)
 create mode 100644 pkgs/development/python-modules/pyspelling/default.nix

diff --git a/pkgs/development/python-modules/pyspelling/default.nix b/pkgs/development/python-modules/pyspelling/default.nix
new file mode 100644
index 000000000000..78b5871c07b1
--- /dev/null
+++ b/pkgs/development/python-modules/pyspelling/default.nix
@@ -0,0 +1,49 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  hatchling,
+  beautifulsoup4,
+  html5lib,
+  lxml,
+  markdown,
+  pyyaml,
+  soupsieve,
+  wcmatch,
+}:
+
+buildPythonPackage rec {
+  pname = "pyspelling";
+  version = "2.10";
+  pyproject = true;
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-rNZxM8G3zs1BDj1EieYfLksfC2rPGubEjCQPuyFynDc=";
+  };
+
+  build-system = [
+    hatchling
+  ];
+
+  dependencies = [
+    beautifulsoup4
+    html5lib
+    lxml
+    markdown
+    pyyaml
+    soupsieve
+    wcmatch
+  ];
+
+  pythonImportsCheck = [
+    "pyspelling"
+  ];
+
+  meta = {
+    description = "Spell checker";
+    homepage = "https://pypi.org/project/pyspelling";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index d638ae3aba7b..18b328e3f7c8 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -13326,6 +13326,8 @@ self: super: with self; {
 
   pyspellchecker = callPackage ../development/python-modules/pyspellchecker { };
 
+  pyspelling = callPackage ../development/python-modules/pyspelling { };
+
   pyspf = callPackage ../development/python-modules/pyspf { };
 
   pyspice = callPackage ../development/python-modules/pyspice { };

From 923ae1752801ed0be8adb897237c66c1afbf2845 Mon Sep 17 00:00:00 2001
From: "Adam C. Stephens" <adam@valkor.net>
Date: Tue, 1 Apr 2025 18:25:56 +0000
Subject: [PATCH 048/146] pythonPackages.sphinx-remove-toctrees: init at
 1.0.0.post1

---
 .../sphinx-remove-toctrees/default.nix        | 60 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 +
 2 files changed, 62 insertions(+)
 create mode 100644 pkgs/development/python-modules/sphinx-remove-toctrees/default.nix

diff --git a/pkgs/development/python-modules/sphinx-remove-toctrees/default.nix b/pkgs/development/python-modules/sphinx-remove-toctrees/default.nix
new file mode 100644
index 000000000000..7f381ff997bd
--- /dev/null
+++ b/pkgs/development/python-modules/sphinx-remove-toctrees/default.nix
@@ -0,0 +1,60 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  hatchling,
+  sphinx,
+  pre-commit,
+  ipython,
+  myst-parser,
+  sphinx-book-theme,
+  pytest,
+}:
+
+buildPythonPackage rec {
+  pname = "sphinx-remove-toctrees";
+  version = "1.0.0.post1";
+  pyproject = true;
+
+  src = fetchPypi {
+    pname = "sphinx_remove_toctrees";
+    inherit version;
+    hash = "sha256-SAjR7fFRwG7/bSw5Iux+vJ/Tqhdi3hsuFnSjf1rJzi0=";
+  };
+
+  build-system = [
+    hatchling
+  ];
+
+  dependencies = [
+    sphinx
+  ];
+
+  optional-dependencies = {
+    code_style = [
+      pre-commit
+    ];
+    docs = [
+      ipython
+      myst-parser
+      sphinx-book-theme
+    ];
+    tests = [
+      ipython
+      myst-parser
+      pytest
+      sphinx-book-theme
+    ];
+  };
+
+  pythonImportsCheck = [
+    "sphinx_remove_toctrees"
+  ];
+
+  meta = {
+    description = "Reduce your documentation build size by selectively removing toctrees from pages";
+    homepage = "https://pypi.org/project/sphinx-remove-toctrees/";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 18b328e3f7c8..49d580780596 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -16175,6 +16175,8 @@ self: super: with self; {
 
   sphinx-reredirects = callPackage ../development/python-modules/sphinx-reredirects { };
 
+  sphinx-remove-toctrees = callPackage ../development/python-modules/sphinx-remove-toctrees { };
+
   sphinx-rtd-dark-mode = callPackage ../development/python-modules/sphinx-rtd-dark-mode { };
 
   sphinx-rtd-theme = callPackage ../development/python-modules/sphinx-rtd-theme { };

From 21197daa39ee07363242a7211145db641b40d879 Mon Sep 17 00:00:00 2001
From: "Adam C. Stephens" <adam@valkor.net>
Date: Tue, 1 Apr 2025 18:25:56 +0000
Subject: [PATCH 049/146] incus: build and expose documentation

---
 nixos/modules/virtualisation/incus.nix |  1 +
 nixos/tests/incus/ui.nix               |  4 +++
 pkgs/by-name/in/incus/docs.patch       | 26 +++++++++++++++
 pkgs/by-name/in/incus/generic.nix      | 45 ++++++++++++++++++++++----
 4 files changed, 70 insertions(+), 6 deletions(-)
 create mode 100644 pkgs/by-name/in/incus/docs.patch

diff --git a/nixos/modules/virtualisation/incus.nix b/nixos/modules/virtualisation/incus.nix
index 136cd20eee55..6637141d0330 100644
--- a/nixos/modules/virtualisation/incus.nix
+++ b/nixos/modules/virtualisation/incus.nix
@@ -129,6 +129,7 @@ let
 
   environment = lib.mkMerge [
     {
+      INCUS_DOCUMENTATION = "${cfg.package.doc}/html";
       INCUS_EDK2_PATH = ovmf;
       INCUS_LXC_HOOK = "${cfg.lxcPackage}/share/lxc/hooks";
       INCUS_LXC_TEMPLATE_CONFIG = "${pkgs.lxcfs}/share/lxc/config";
diff --git a/nixos/tests/incus/ui.nix b/nixos/tests/incus/ui.nix
index 27b90c218d78..300388a19f93 100644
--- a/nixos/tests/incus/ui.nix
+++ b/nixos/tests/incus/ui.nix
@@ -66,6 +66,7 @@ import ../make-test-python.nix (
 
     testScript = ''
       machine.wait_for_unit("incus.service")
+      machine.wait_for_unit("incus-preseed.service")
 
       # Check that the INCUS_UI environment variable is populated in the systemd unit
       machine.succeed("systemctl cat incus.service | grep 'INCUS_UI'")
@@ -73,6 +74,9 @@ import ../make-test-python.nix (
       # Ensure the endpoint returns an HTML page with 'Incus UI' in the title
       machine.succeed("curl -kLs https://localhost:8443/ui | grep '<title>Incus UI</title>'")
 
+      # Ensure the documentation is rendering correctly
+      machine.succeed("curl -kLs https://localhost:8443/documentation/ | grep '<title>Incus documentation</title>'")
+
       # Ensure the application is actually rendered by the Javascript
       machine.succeed("PYTHONUNBUFFERED=1 selenium-script")
     '';
diff --git a/pkgs/by-name/in/incus/docs.patch b/pkgs/by-name/in/incus/docs.patch
new file mode 100644
index 000000000000..6857df48e230
--- /dev/null
+++ b/pkgs/by-name/in/incus/docs.patch
@@ -0,0 +1,26 @@
+diff --git i/doc/conf.py w/doc/conf.py
+index 8d042818b..b4f0572bd 100644
+--- i/doc/conf.py
++++ w/doc/conf.py
+@@ -8,10 +8,6 @@ import yaml
+ from git import Repo
+ import filecmp
+ 
+-# Download and link swagger-ui files
+-if not os.path.isdir('.sphinx/deps/swagger-ui'):
+-    Repo.clone_from('https://github.com/swagger-api/swagger-ui', '.sphinx/deps/swagger-ui', depth=1)
+-
+ os.makedirs('.sphinx/_static/swagger-ui/', exist_ok=True)
+ 
+ if not os.path.islink('.sphinx/_static/swagger-ui/swagger-ui-bundle.js'):
+@@ -151,10 +147,6 @@ if os.path.exists("./related_topics.yaml"):
+     with open("./related_topics.yaml", "r") as fd:
+         myst_substitutions.update(yaml.safe_load(fd.read()))
+ 
+-intersphinx_mapping = {
+-    'cloud-init': ('https://cloudinit.readthedocs.io/en/latest/', None)
+-}
+-
+ if ("LOCAL_SPHINX_BUILD" in os.environ) and (os.environ["LOCAL_SPHINX_BUILD"] == "True"):
+     swagger_url_scheme = "/api/#{{path}}"
+ else:
diff --git a/pkgs/by-name/in/incus/generic.nix b/pkgs/by-name/in/incus/generic.nix
index be969c84e4a6..2620ea098c24 100644
--- a/pkgs/by-name/in/incus/generic.nix
+++ b/pkgs/by-name/in/incus/generic.nix
@@ -13,6 +13,7 @@
   buildGoModule,
   fetchFromGitHub,
   acl,
+  buildPackages,
   cowsql,
   incus-ui-canonical,
   libcap,
@@ -27,11 +28,30 @@
 
 let
   pname = "incus${lib.optionalString lts "-lts"}";
+  docsPython = buildPackages.python3.withPackages (
+    py: with py; [
+      furo
+      gitpython
+      linkify-it-py
+      canonical-sphinx-extensions
+      myst-parser
+      pyspelling
+      sphinx
+      sphinx-autobuild
+      sphinx-copybutton
+      sphinx-design
+      sphinx-notfound-page
+      sphinx-remove-toctrees
+      sphinx-reredirects
+      sphinx-tabs
+      sphinxcontrib-jquery
+      sphinxext-opengraph
+    ]
+  );
 in
 
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   inherit
-    patches
     pname
     vendorHash
     version
@@ -40,15 +60,18 @@ buildGoModule rec {
   outputs = [
     "out"
     "agent_loader"
+    "doc"
   ];
 
   src = fetchFromGitHub {
     owner = "lxc";
     repo = "incus";
-    rev = "refs/tags/v${version}";
+    tag = "v${version}";
     inherit hash;
   };
 
+  patches = [ ./docs.patch ] ++ patches;
+
   excludedPackages = [
     # statically compile these
     "cmd/incus-agent"
@@ -61,6 +84,7 @@ buildGoModule rec {
   nativeBuildInputs = [
     installShellFiles
     pkg-config
+    docsPython
   ];
 
   buildInputs = [
@@ -82,6 +106,13 @@ buildGoModule rec {
   CGO_LDFLAGS_ALLOW = "(-Wl,-wrap,pthread_create)|(-Wl,-z,now)";
 
   postBuild = ''
+    # build docs
+    mkdir -p .sphinx/deps
+    ln -s ${buildPackages.python3.pkgs.swagger-ui-bundle.src} .sphinx/deps/swagger-ui
+    substituteInPlace Makefile --replace-fail '. $(SPHINXENV) ; ' ""
+    make doc-incremental
+
+    # build some static executables
     make incus-agent incus-migrate
   '';
 
@@ -111,18 +142,20 @@ buildGoModule rec {
     cp internal/server/instance/drivers/agent-loader/systemd/incus-agent.service $agent_loader/etc/systemd/system/
     cp internal/server/instance/drivers/agent-loader/systemd/incus-agent.rules $agent_loader/lib/udev/rules.d/99-incus-agent.rules
     substituteInPlace $agent_loader/etc/systemd/system/incus-agent.service --replace-fail 'TARGET/systemd' "$agent_loader/bin"
+
+    mkdir $doc
+    cp -R doc/html $doc/
   '';
 
   passthru = {
     client = callPackage ./client.nix {
       inherit
         lts
-        meta
         patches
-        src
         vendorHash
         version
         ;
+      inherit (finalAttrs) meta src;
     };
 
     tests = if lts then nixosTests.incus-lts.all else nixosTests.incus.all;
@@ -143,4 +176,4 @@ buildGoModule rec {
     platforms = lib.platforms.linux;
     mainProgram = "incus";
   };
-}
+})

From 366ca58cb9349fbcce25d8cae6aa4ba7a21b78c8 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 3 Apr 2025 18:01:32 +0000
Subject: [PATCH 050/146] cozette: 1.27.0 -> 1.28.0

---
 pkgs/by-name/co/cozette/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/co/cozette/package.nix b/pkgs/by-name/co/cozette/package.nix
index d62f7930f3b5..ad640a6a6077 100644
--- a/pkgs/by-name/co/cozette/package.nix
+++ b/pkgs/by-name/co/cozette/package.nix
@@ -6,13 +6,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "cozette";
-  version = "1.27.0";
+  version = "1.28.0";
 
   src = fetchzip {
     url = "https://github.com/slavfox/Cozette/releases/download/v.${version}/CozetteFonts-v-${
       builtins.replaceStrings [ "." ] [ "-" ] version
     }.zip";
-    hash = "sha256-L/C1fohaLSVbrxAr4v3R83x1/Yt8fI3Lo+c84cZvEHY=";
+    hash = "sha256-KxlChsydFtm26CFugbWqeJi5DQP0BxONSz5mOcyiE28=";
   };
 
   installPhase = ''

From 1c3ad78889350f176b1bc9a3ce0b641b3de8c95b Mon Sep 17 00:00:00 2001
From: Defelo <mail@defelo.de>
Date: Thu, 3 Apr 2025 18:21:39 +0000
Subject: [PATCH 051/146] uiua: 0.14.1 -> 0.15.0

---
 pkgs/by-name/ui/uiua/stable.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ui/uiua/stable.nix b/pkgs/by-name/ui/uiua/stable.nix
index 59cb86f7329d..a46416c8c21c 100644
--- a/pkgs/by-name/ui/uiua/stable.nix
+++ b/pkgs/by-name/ui/uiua/stable.nix
@@ -1,7 +1,7 @@
 rec {
-  version = "0.14.1";
+  version = "0.15.0";
   tag = version;
-  hash = "sha256-+FiJYxB2Lb1B7l9QEuB/XzdEYgJZmYAQpKimRIhWwhc=";
-  cargoHash = "sha256-bDj7pvZORP1cc2PXd1W9TWptWCvIKW9TXzaQAmni6hg=";
+  hash = "sha256-XjU8XPi8jTydJ439X6hjyZhXho2zbtt4Fqq3uIQg09M=";
+  cargoHash = "sha256-tMNIk52nq4dYfJU+nP2IKW21ex13YdrDvrEm2GSAAF4=";
   updateScript = ./update-stable.sh;
 }

From 9c04c26f4c9fb795d2580539cf708128d2a900d6 Mon Sep 17 00:00:00 2001
From: Defelo <mail@defelo.de>
Date: Thu, 3 Apr 2025 18:22:21 +0000
Subject: [PATCH 052/146] uiua-unstable: 0.15.0-rc.2 -> 0.15.0

---
 pkgs/by-name/ui/uiua/unstable.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ui/uiua/unstable.nix b/pkgs/by-name/ui/uiua/unstable.nix
index 8212d238c290..a245509ec20c 100644
--- a/pkgs/by-name/ui/uiua/unstable.nix
+++ b/pkgs/by-name/ui/uiua/unstable.nix
@@ -1,7 +1,7 @@
 rec {
-  version = "0.15.0-rc.2";
+  version = "0.15.0";
   tag = version;
-  hash = "sha256-nGuSofBDstaBJNRS6MHdSD6nXyUqkGE/rcnAjaJICtk=";
-  cargoHash = "sha256-FzO5YOYrnwfcdrQHMJR5dR2qdFNL3Jfmyqpu1iPeN2o=";
+  hash = "sha256-XjU8XPi8jTydJ439X6hjyZhXho2zbtt4Fqq3uIQg09M=";
+  cargoHash = "sha256-tMNIk52nq4dYfJU+nP2IKW21ex13YdrDvrEm2GSAAF4=";
   updateScript = ./update-unstable.sh;
 }

From 4c7653cc3928aa05fd79ddd4e01ef915b40ed43c Mon Sep 17 00:00:00 2001
From: Defelo <mail@defelo.de>
Date: Thu, 3 Apr 2025 18:27:22 +0000
Subject: [PATCH 053/146] vscode-extensions.uiua-lang.uiua-vscode: 0.0.61 ->
 0.0.62

---
 pkgs/applications/editors/vscode/extensions/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index af8b2895dd41..5ffe51880b44 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -5038,8 +5038,8 @@ let
         mktplcRef = {
           name = "uiua-vscode";
           publisher = "uiua-lang";
-          version = "0.0.61";
-          hash = "sha256-cKiIva4nzROp+bbwkMxBvguLMXVe/9uGcdhVhLxmae0=";
+          version = "0.0.62";
+          hash = "sha256-Fq3NmCL17QVAmOmFWSkxc0qRwCRDsRbkeRzwyP02Nq4=";
         };
         meta = {
           description = "VSCode language extension for Uiua";

From 17f460f50e178cd4fb76f2d2815270aad7ab405b Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 3 Apr 2025 18:39:49 +0000
Subject: [PATCH 054/146] python312Packages.mailsuite: 1.9.20 -> 1.10.0

---
 pkgs/development/python-modules/mailsuite/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/mailsuite/default.nix b/pkgs/development/python-modules/mailsuite/default.nix
index 52700d5c168a..46a9888eccd1 100644
--- a/pkgs/development/python-modules/mailsuite/default.nix
+++ b/pkgs/development/python-modules/mailsuite/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "mailsuite";
-  version = "1.9.20";
+  version = "1.10.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-1DS0TzEejvviF3BPBiiCVJLOOi8RQuGoDIpKRm+CNHo=";
+    hash = "sha256-xYM4/Ou91WtYwiobE9ihlYGu8ViNTVbSLFGi8Y9yPc4=";
   };
 
   pythonRelaxDeps = [ "mail-parser" ];

From b02b1e2bf0e19970cd613c4d735018dc5af90bc1 Mon Sep 17 00:00:00 2001
From: Seth Flynn <getchoo@tuta.io>
Date: Thu, 3 Apr 2025 18:35:41 +0000
Subject: [PATCH 055/146] concessio: 0.1.9 -> 0.1.10

---
 pkgs/by-name/co/concessio/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/co/concessio/package.nix b/pkgs/by-name/co/concessio/package.nix
index 803182fc4686..c8fa52d89ce4 100644
--- a/pkgs/by-name/co/concessio/package.nix
+++ b/pkgs/by-name/co/concessio/package.nix
@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "concessio";
-  version = "0.1.9";
+  version = "0.1.10";
 
   src = fetchFromGitHub {
     owner = "ronniedroid";
     repo = "concessio";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-XH+4oEZSKa6lAS0zXxdlCsVJcGDglKSgaD+zoRM6Pws=";
+    hash = "sha256-GDiwpErxz6GiYajcRBOnX0RO1jeaSmpLLxqEsB3nJLA=";
   };
 
   strictDeps = true;

From 98a4fdc45ff9061f7b1e9a7d6ffa1bbaea48b0b6 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 3 Apr 2025 18:59:46 +0000
Subject: [PATCH 056/146] rmfakecloud: 0.0.23 -> 0.0.24

---
 pkgs/by-name/rm/rmfakecloud/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/rm/rmfakecloud/package.nix b/pkgs/by-name/rm/rmfakecloud/package.nix
index b76e3a3b9567..30a1709b67a5 100644
--- a/pkgs/by-name/rm/rmfakecloud/package.nix
+++ b/pkgs/by-name/rm/rmfakecloud/package.nix
@@ -10,16 +10,16 @@
 
 buildGoModule rec {
   pname = "rmfakecloud";
-  version = "0.0.23";
+  version = "0.0.24";
 
   src = fetchFromGitHub {
     owner = "ddvk";
     repo = "rmfakecloud";
     rev = "v${version}";
-    hash = "sha256-XlKqh6GKGreWLPjS8XfEUJCMMxiOw8pP2qX8otD+RCo=";
+    hash = "sha256-ZsYq1+Bb6SyMGdbiy5UzanDiUiFOt4uhttiPKC0ESis=";
   };
 
-  vendorHash = "sha256-9tfxE03brUvCYusmewiqNpCkKyIS9qePqylrzDWrJLY=";
+  vendorHash = "sha256-S2P80uhX86IVUVEoR4tZ7e6qMe7CK+6bmmjBgjXGZmo=";
 
   # if using webUI build it
   # use env because of https://github.com/NixOS/nixpkgs/issues/358844

From f1857d70a4ba723f4750899ca73be75414d53935 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 3 Apr 2025 19:18:20 +0000
Subject: [PATCH 057/146] obs-studio-plugins.obs-move-transition: 3.1.1 ->
 3.1.2

---
 .../video/obs-studio/plugins/obs-move-transition.nix          | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/video/obs-studio/plugins/obs-move-transition.nix b/pkgs/applications/video/obs-studio/plugins/obs-move-transition.nix
index bdedeeed9c78..9e542067069d 100644
--- a/pkgs/applications/video/obs-studio/plugins/obs-move-transition.nix
+++ b/pkgs/applications/video/obs-studio/plugins/obs-move-transition.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "obs-move-transition";
-  version = "3.1.1";
+  version = "3.1.2";
 
   src = fetchFromGitHub {
     owner = "exeldro";
     repo = "obs-move-transition";
     rev = version;
-    sha256 = "sha256-kCiRgfpcFdxoK6e8jtrtzkBD4w5B/ilO1YyBHCG13gg=";
+    sha256 = "sha256-BCivYK18T4b+lRo6Qf9qFwmjAyjCPZDekQVi03QBLHc=";
   };
 
   nativeBuildInputs = [ cmake ];

From 207fdeebe7bea68443ce897ef9b0b6191abe49bf Mon Sep 17 00:00:00 2001
From: Seth Flynn <getchoo@tuta.io>
Date: Thu, 3 Apr 2025 18:36:41 +0000
Subject: [PATCH 058/146] mangojuice: 0.8.2 -> 0.8.3

Diff: https://github.com/radiolamp/mangojuice/compare/0.8.2...0.8.3

Changelog: https://github.com/radiolamp/mangojuice/releases/tag/0.8.3
---
 pkgs/by-name/ma/mangojuice/package.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ma/mangojuice/package.nix b/pkgs/by-name/ma/mangojuice/package.nix
index aab7000014e8..5c2908802ff9 100644
--- a/pkgs/by-name/ma/mangojuice/package.nix
+++ b/pkgs/by-name/ma/mangojuice/package.nix
@@ -25,13 +25,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "mangojuice";
-  version = "0.8.2";
+  version = "0.8.3";
 
   src = fetchFromGitHub {
     owner = "radiolamp";
     repo = "mangojuice";
     tag = finalAttrs.version;
-    hash = "sha256-NpNsYwktcce9R1LpoIL2vh5UzsgDqdPyS0D3mhM3F0w=";
+    hash = "sha256-373Ws+U7fuwWLrKOnj1dD9gIJPKOd1b6I78VWOtOjTM=";
   };
 
   patches = [
@@ -80,6 +80,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     description = "Convenient alternative to GOverlay for setting up MangoHud";
     homepage = "https://github.com/radiolamp/mangojuice";
+    changelog = "https://github.com/radiolamp/mangojuice/releases/tag/${finalAttrs.version}";
     license = with lib.licenses; [ gpl3Only ];
     platforms = lib.platforms.linux;
     maintainers = with lib.maintainers; [

From e910c0a547ecf1c4202fc2b2d49a066568af8da0 Mon Sep 17 00:00:00 2001
From: Seth Flynn <getchoo@tuta.io>
Date: Thu, 3 Apr 2025 18:37:07 +0000
Subject: [PATCH 059/146] refine: 0.5.5 -> 0.5.6

Diff: https://gitlab.gnome.org/TheEvilSkeleton/Refine/-/compare/0.5.5..0.5.6
---
 pkgs/by-name/re/refine/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/re/refine/package.nix b/pkgs/by-name/re/refine/package.nix
index 648818481f40..c5bee1e438de 100644
--- a/pkgs/by-name/re/refine/package.nix
+++ b/pkgs/by-name/re/refine/package.nix
@@ -34,7 +34,7 @@ in
 
 python3Packages.buildPythonApplication rec {
   pname = "refine";
-  version = "0.5.5";
+  version = "0.5.6";
   pyproject = false; # uses meson
 
   src = fetchFromGitLab {
@@ -42,7 +42,7 @@ python3Packages.buildPythonApplication rec {
     owner = "TheEvilSkeleton";
     repo = "Refine";
     tag = version;
-    hash = "sha256-b2dNhd5UJqH/l5BOEgcOUZrhCZa8ErdBzNw5g4VjtM8=";
+    hash = "sha256-cIJWTzeLm2YP8Pm/nzcYHIGzBOmQlPe0lQ+b6BufIMg=";
   };
 
   nativeBuildInputs = [

From b3f5d1adb3a8317d78db9c27cd6dd34d1e234bae Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 3 Apr 2025 19:35:21 +0000
Subject: [PATCH 060/146] krep: 0.3.4 -> 0.3.6

---
 pkgs/by-name/kr/krep/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/kr/krep/package.nix b/pkgs/by-name/kr/krep/package.nix
index b94232de2330..12426c953ed1 100644
--- a/pkgs/by-name/kr/krep/package.nix
+++ b/pkgs/by-name/kr/krep/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "krep";
-  version = "0.3.4";
+  version = "0.3.6";
 
   src = fetchFromGitHub {
     owner = "davidesantangelo";
     repo = "krep";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-kAsOAcEFjfxlJs6fJvB0viCMxGFCG1BUs9qPgGMvBpM=";
+    hash = "sha256-wfMNyqZgqoEkp51gompWUn65kaeVZIMfvo0VStW4EPA=";
   };
 
   makeFlags = [

From 828bbb775a200eaff1a49a034ad694a2d23cf2e8 Mon Sep 17 00:00:00 2001
From: John Garcia <jgarcia3788@yahoo.co.uk>
Date: Thu, 3 Apr 2025 22:25:20 +0100
Subject: [PATCH 061/146] remnote: 1.18.49 -> 1.19.8

---
 pkgs/by-name/re/remnote/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/re/remnote/package.nix b/pkgs/by-name/re/remnote/package.nix
index b63543b59cad..9e00c8711a80 100644
--- a/pkgs/by-name/re/remnote/package.nix
+++ b/pkgs/by-name/re/remnote/package.nix
@@ -6,10 +6,10 @@
 }:
 let
   pname = "remnote";
-  version = "1.18.49";
+  version = "1.19.8";
   src = fetchurl {
     url = "https://download2.remnote.io/remnote-desktop2/RemNote-${version}.AppImage";
-    hash = "sha256-LSjPQbRYl61c7I/TT0ePSoXkXqiVuCD8RdaFFJsK02M=";
+    hash = "sha256-xMr+UftIWxtlYzzdOtidCJWisSwJd+xEtaKyoZnyVXc=";
   };
   appimageContents = appimageTools.extractType2 { inherit pname version src; };
 in

From c0803d8a14895a99134cd1015a03fa14bc40ffc9 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 4 Apr 2025 00:34:08 +0000
Subject: [PATCH 062/146] ab-av1: 0.9.3 -> 0.9.4

---
 pkgs/by-name/ab/ab-av1/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ab/ab-av1/package.nix b/pkgs/by-name/ab/ab-av1/package.nix
index bf0bdb0bc06f..436e38f35b79 100644
--- a/pkgs/by-name/ab/ab-av1/package.nix
+++ b/pkgs/by-name/ab/ab-av1/package.nix
@@ -8,17 +8,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "ab-av1";
-  version = "0.9.3";
+  version = "0.9.4";
 
   src = fetchFromGitHub {
     owner = "alexheretic";
     repo = "ab-av1";
     rev = "v${version}";
-    hash = "sha256-rj02Opkwi4M249Ya4uBl4u1l8Mx+FBcRcxDgD6ng9kg=";
+    hash = "sha256-dDD0hnKov5cgNoc1m/0rG/cx2ZaB7TmLfcXdm8myRUQ=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-Vi38eNn+SnhQx7Gp1T2RPIBeu3bUAZ74dr0mMG5Mha0=";
+  cargoHash = "sha256-01tH5uvfrPIKRv+iYJWm/5QyQZtz1d/nEtN/tmGXD14=";
 
   nativeBuildInputs = [ installShellFiles ];
 

From 36d62f0c85a45c3500b14834549a1485549a5c59 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 4 Apr 2025 00:35:37 +0000
Subject: [PATCH 063/146] azurehound: 2.3.0 -> 2.3.1

---
 pkgs/by-name/az/azurehound/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/az/azurehound/package.nix b/pkgs/by-name/az/azurehound/package.nix
index e21a59cc6f69..74ed95caac07 100644
--- a/pkgs/by-name/az/azurehound/package.nix
+++ b/pkgs/by-name/az/azurehound/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "azurehound";
-  version = "2.3.0";
+  version = "2.3.1";
 
   src = fetchFromGitHub {
     owner = "SpecterOps";
     repo = "AzureHound";
     tag = "v${version}";
-    hash = "sha256-BbwQ3u1SD4AjNjHzT6QB0x7QJAZ59m1DtvhjZapLIx4=";
+    hash = "sha256-12ae0y3hjeNPwB33J+XP26h+JfFN5M8+bF8CSon1jp4=";
   };
 
   vendorHash = "sha256-FG3207OTzkMEoSvQsTH7Ky9T3ur7glG7k0ERfd12SO0=";

From 17360ac80fc3535b746ca9727c1d6888d9a2248a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 4 Apr 2025 00:39:40 +0000
Subject: [PATCH 064/146] fabric-installer: 1.0.1 -> 1.0.3

---
 pkgs/by-name/fa/fabric-installer/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/fa/fabric-installer/package.nix b/pkgs/by-name/fa/fabric-installer/package.nix
index 21fdd3945316..09b9f44f225e 100644
--- a/pkgs/by-name/fa/fabric-installer/package.nix
+++ b/pkgs/by-name/fa/fabric-installer/package.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation rec {
   pname = "fabric-installer";
-  version = "1.0.1";
+  version = "1.0.3";
 
   src = fetchurl {
     url = "https://maven.fabricmc.net/net/fabricmc/fabric-installer/${version}/fabric-installer-${version}.jar";
-    sha256 = "sha256-Yu3xcL3MQe3qhdM6zz64VHQlhpmz1B+UGNKGyDbLCI0=";
+    sha256 = "sha256-OKqCqx74KbeqPyFD/Mk7unBqjhiDW+cx0P3yMdJ0sH8=";
   };
 
   dontUnpack = true;

From 7b3259fbe9ada59d6edd616d891a242bc805fe41 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 4 Apr 2025 01:26:45 +0000
Subject: [PATCH 065/146] trufflehog: 3.88.20 -> 3.88.21

---
 pkgs/tools/security/trufflehog/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/security/trufflehog/default.nix b/pkgs/tools/security/trufflehog/default.nix
index b82459d22d84..847e42feaf2f 100644
--- a/pkgs/tools/security/trufflehog/default.nix
+++ b/pkgs/tools/security/trufflehog/default.nix
@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "trufflehog";
-  version = "3.88.20";
+  version = "3.88.21";
 
   src = fetchFromGitHub {
     owner = "trufflesecurity";
     repo = "trufflehog";
     tag = "v${version}";
-    hash = "sha256-JLBHg1hCTOOBRTJbjXJitILD/HSmH1WDuzm0t3/OJaA=";
+    hash = "sha256-hUBUpsfVKifeQ9DpeNKwBGnoLH1OK2T4IOb7yFWxz+Q=";
   };
 
   vendorHash = "sha256-vJl2gIS14NA9nV9j+81xKv3NnsDce4V7XoeipOZV+wI=";

From 9e05bbe161e79f4e65833636a2650ca0714b4a7e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 4 Apr 2025 02:13:14 +0000
Subject: [PATCH 066/146] tfswitch: 1.4.2 -> 1.4.3

---
 pkgs/by-name/tf/tfswitch/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/tf/tfswitch/package.nix b/pkgs/by-name/tf/tfswitch/package.nix
index c62723fe880b..b4558be4d273 100644
--- a/pkgs/by-name/tf/tfswitch/package.nix
+++ b/pkgs/by-name/tf/tfswitch/package.nix
@@ -5,16 +5,16 @@
 }:
 buildGoModule rec {
   pname = "tfswitch";
-  version = "1.4.2";
+  version = "1.4.3";
 
   src = fetchFromGitHub {
     owner = "warrensbox";
     repo = "terraform-switcher";
     rev = "v${version}";
-    sha256 = "sha256-y9MoDtF0104HRjDqpRuMfBbsNqseynq2azKnXNdRhso=";
+    sha256 = "sha256-5Zyu0SLF+xjemFKInzRKCcDZs72gwAJN7bacO+5StMg=";
   };
 
-  vendorHash = "sha256-m3QzNSAcUrI4Pg7LMDZftlBbk4Uhjirc6eNSrQxxwLA=";
+  vendorHash = "sha256-EjbS+1osM6Qauoi95JHLOdxeLOz0Jgz6ZaTFtfs6IgM=";
 
   # Disable tests since it requires network access and relies on the
   # presence of release.hashicorp.com

From 3564baaf75199b4c6c35703c492e0056e1741c4d Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 4 Apr 2025 02:46:47 +0000
Subject: [PATCH 067/146] zwave-js-ui: 9.32.0 -> 10.1.2

---
 pkgs/by-name/zw/zwave-js-ui/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/zw/zwave-js-ui/package.nix b/pkgs/by-name/zw/zwave-js-ui/package.nix
index d8dd3c074eb1..fc38ef746f90 100644
--- a/pkgs/by-name/zw/zwave-js-ui/package.nix
+++ b/pkgs/by-name/zw/zwave-js-ui/package.nix
@@ -7,15 +7,15 @@
 
 buildNpmPackage rec {
   pname = "zwave-js-ui";
-  version = "9.32.0";
+  version = "10.1.2";
 
   src = fetchFromGitHub {
     owner = "zwave-js";
     repo = "zwave-js-ui";
     tag = "v${version}";
-    hash = "sha256-DZm3IoLc28YMbwWL6+qHd5BSyRQswRatEvGmwuIzBZM=";
+    hash = "sha256-j56kDnMw/YX6ONkIjPjopsu6xE2Kt1cZV5u+tX2TqlM=";
   };
-  npmDepsHash = "sha256-FZ/iStpC5DiNthV42/QAzek261ZUAL1DOEIixVlArZ0=";
+  npmDepsHash = "sha256-hkfDztDtLug9qdxi9NRWnzCN6Parv27stVknZ0cSYpo=";
 
   passthru.tests.zwave-js-ui = nixosTests.zwave-js-ui;
 

From a2e886428b4a52bd908a3eccd5c4a6f48993dccf Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihar.hrachyshka@gmail.com>
Date: Thu, 3 Apr 2025 23:18:10 -0400
Subject: [PATCH 068/146] firefox: copy *.dylibs on darwin

Without these, some functionality seems broken (e.g. Crypto API).

Resolves #394029

Signed-off-by: Ihar Hrachyshka <ihar.hrachyshka@gmail.com>
---
 pkgs/applications/networking/browsers/firefox/wrapper.nix | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/browsers/firefox/wrapper.nix b/pkgs/applications/networking/browsers/firefox/wrapper.nix
index c753b04fb700..f6244310858a 100644
--- a/pkgs/applications/networking/browsers/firefox/wrapper.nix
+++ b/pkgs/applications/networking/browsers/firefox/wrapper.nix
@@ -405,10 +405,12 @@ let
         + lib.optionalString isDarwin ''
           cd "${appPath}"
 
-          # These files have to be copied and not symlinked, otherwise tabs crash.
+          # The omni.ja files have to be copied and not symlinked, otherwise tabs crash.
           # Maybe related to how omni.ja file is mmapped into memory. See:
           # https://github.com/mozilla/gecko-dev/blob/b1662b447f306e6554647914090d4b73ac8e1664/modules/libjar/nsZipArchive.cpp#L204
-          for file in $(find . -type l -name "omni.ja"); do
+          #
+          # The *.dylib files are copied, otherwise some basic functionality, e.g. Crypto API, is broken.
+          for file in $(find . -name "omni.ja" -o -name "*.dylib"); do
             rm "$file"
             cp "${browser}/${appPath}/$file" "$file"
           done

From b559c1b2bf6c8b59329765998f4a2b61dd3d8c74 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 4 Apr 2025 03:52:54 +0000
Subject: [PATCH 069/146] python312Packages.pure-protobuf: 3.1.3 -> 3.1.4

---
 pkgs/development/python-modules/pure-protobuf/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/pure-protobuf/default.nix b/pkgs/development/python-modules/pure-protobuf/default.nix
index 5b481b09f7d9..0ea2944d77d1 100644
--- a/pkgs/development/python-modules/pure-protobuf/default.nix
+++ b/pkgs/development/python-modules/pure-protobuf/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "pure-protobuf";
-  version = "3.1.3";
+  version = "3.1.4";
 
   format = "pyproject";
   # < 3.10 requires get-annotations which isn't packaged yet
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "eigenein";
     repo = "protobuf";
     tag = version;
-    hash = "sha256-AsiJDi3SF3nlWKFvZujUsoHY8AJ21JKzEuTdR9FtFQI=";
+    hash = "sha256-k67AvY9go62BZN7kCg+kFo9+bQB3wGJVbLra5pOhkPU=";
   };
 
   build-system = [
@@ -49,7 +49,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python implementation of Protocol Buffers with dataclass-based schemas";
     homepage = "https://github.com/eigenein/protobuf";
-    changelog = "https://github.com/eigenein/protobuf/releases/tag/${version}";
+    changelog = "https://github.com/eigenein/protobuf/releases/tag/${src.tag}";
     license = licenses.mit;
     maintainers = with maintainers; [ chuangzhu ];
   };

From ce0c3c7649eb88d3f61551c924000e76720ea38a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 4 Apr 2025 04:43:03 +0000
Subject: [PATCH 070/146] python312Packages.mkdocs-awesome-nav: 3.0.0 -> 3.1.0

---
 .../python-modules/mkdocs-awesome-nav/default.nix           | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/mkdocs-awesome-nav/default.nix b/pkgs/development/python-modules/mkdocs-awesome-nav/default.nix
index 2bb5cb2c1644..a84bacb4a974 100644
--- a/pkgs/development/python-modules/mkdocs-awesome-nav/default.nix
+++ b/pkgs/development/python-modules/mkdocs-awesome-nav/default.nix
@@ -16,14 +16,14 @@
 }:
 buildPythonPackage rec {
   pname = "mkdocs-awesome-nav";
-  version = "3.0.0";
+  version = "3.1.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "lukasgeiter";
     repo = "mkdocs-awesome-nav";
     tag = "v${version}";
-    hash = "sha256-EgHiphpMAL+1ZC+I8PxRHMk1gcyAgHcUm4eoVu67+Qc=";
+    hash = "sha256-UxqOaAXy5Sc41FYE3mSKDBpWWJ3g0YwkRkOeSXwqz7o=";
   };
 
   build-system = [ flit-core ];
@@ -57,7 +57,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Plugin for customizing the navigation structure of your MkDocs site";
     homepage = "https://github.com/lukasgeiter/mkdocs-awesome-nav";
-    changelog = "https://github.com/lukasgeiter/mkdocs-awesome-nav/blob/v${version}/CHANGELOG";
+    changelog = "https://github.com/lukasgeiter/mkdocs-awesome-nav/blob/${src.tag}/CHANGELOG";
     license = licenses.mit;
     maintainers = with maintainers; [ phaer ];
   };

From 0c02d1f7c81dc43510c698289af20e41ed70b07a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 4 Apr 2025 05:25:15 +0000
Subject: [PATCH 071/146] cobalt: 0.19.8 -> 0.19.9

---
 pkgs/by-name/co/cobalt/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/co/cobalt/package.nix b/pkgs/by-name/co/cobalt/package.nix
index 7ee588a34ef1..fc3e31e941e6 100644
--- a/pkgs/by-name/co/cobalt/package.nix
+++ b/pkgs/by-name/co/cobalt/package.nix
@@ -9,17 +9,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cobalt";
-  version = "0.19.8";
+  version = "0.19.9";
 
   src = fetchFromGitHub {
     owner = "cobalt-org";
     repo = "cobalt.rs";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-neOJ3UqRisCcyarRIXfHyl9nAe2Wl9IXVDNwIYEQYys=";
+    hash = "sha256-T88XyrMVCLfhsz3RWD85ErHxAmuTXprOAiS5B8GkH9s=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-j2xmEoMV7lVhqj4lKWA3QdEDEGUpRlZc4ikZoDQJlB8=";
+  cargoHash = "sha256-0BJAbxBbw6wfnDcZkOic13iuWTBEslJ2mQ9nfq+/RXc=";
 
   nativeInstallCheckInputs = [ versionCheckHook ];
   versionCheckProgramArg = "--version";

From af2ef85a8049794e1a79fda30a0d26e1a4dfafde Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 4 Apr 2025 05:54:48 +0000
Subject: [PATCH 072/146] python312Packages.xiaomi-ble: 0.35.0 -> 0.36.0

---
 pkgs/development/python-modules/xiaomi-ble/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/xiaomi-ble/default.nix b/pkgs/development/python-modules/xiaomi-ble/default.nix
index b0c8020c06e4..b24845d9b3d1 100644
--- a/pkgs/development/python-modules/xiaomi-ble/default.nix
+++ b/pkgs/development/python-modules/xiaomi-ble/default.nix
@@ -19,7 +19,7 @@
 
 buildPythonPackage rec {
   pname = "xiaomi-ble";
-  version = "0.35.0";
+  version = "0.36.0";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
     owner = "Bluetooth-Devices";
     repo = "xiaomi-ble";
     tag = "v${version}";
-    hash = "sha256-+mXn5R9zRjTPKqzB0vFHSO2+Jx+61K7/Ksp+jmMUDo4=";
+    hash = "sha256-qk8eoPuyU8deEuQkRRtTt1AxIpjaXaS/byDxMfZnLgI=";
   };
 
   build-system = [ poetry-core ];
@@ -57,7 +57,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Library for Xiaomi BLE devices";
     homepage = "https://github.com/Bluetooth-Devices/xiaomi-ble";
-    changelog = "https://github.com/Bluetooth-Devices/xiaomi-ble/releases/tag/v${version}";
+    changelog = "https://github.com/Bluetooth-Devices/xiaomi-ble/releases/tag/${src.tag}";
     license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };

From 1af9e80c8614f6ec38798f01010587a17d382289 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 4 Apr 2025 06:16:55 +0000
Subject: [PATCH 073/146] python312Packages.ihm: 2.3 -> 2.4

---
 pkgs/development/python-modules/ihm/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/ihm/default.nix b/pkgs/development/python-modules/ihm/default.nix
index 65d839375f15..902bdf44b985 100644
--- a/pkgs/development/python-modules/ihm/default.nix
+++ b/pkgs/development/python-modules/ihm/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "ihm";
-  version = "2.3";
+  version = "2.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ihmwg";
     repo = "python-ihm";
     tag = version;
-    hash = "sha256-oznORD5iN0izC19NeHo1G1nORJQgiC4iZNlThHJyd/8=";
+    hash = "sha256-vlt1YDF8TiWOfql/pasHU1Q7N0EU1wz60yh3+KAVnvM=";
   };
 
   nativeBuildInputs = [ swig ];

From 4a9e0387dda2318814eb13b6d3db04fae978d522 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 4 Apr 2025 07:13:21 +0000
Subject: [PATCH 074/146] go-judge: 1.9.2 -> 1.9.3

---
 pkgs/by-name/go/go-judge/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/go/go-judge/package.nix b/pkgs/by-name/go/go-judge/package.nix
index 7a96e9827c25..c94afc6622b9 100644
--- a/pkgs/by-name/go/go-judge/package.nix
+++ b/pkgs/by-name/go/go-judge/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "go-judge";
-  version = "1.9.2";
+  version = "1.9.3";
 
   src = fetchFromGitHub {
     owner = "criyle";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-4KBMDqHw8EJGSDK9+jCZvaxkQymhw4RRGByrFngiIug=";
+    hash = "sha256-AmbhfCKUpvZt/me73EhBQqw8yDnItn1zKiemf/JRz24=";
   };
 
-  vendorHash = "sha256-FnX3u6DLB9qPE4+Hy/+00mD4U/6Pa+CsZoEroi7cNO0=";
+  vendorHash = "sha256-eUtkelLucf11ANT6vkWuBOaL5bgb+9D8YsVsZTMMjmg=";
 
   tags = [
     "nomsgpack"

From 698726164206845f48bfd024efb31ccde858c33b Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 4 Apr 2025 07:13:56 +0000
Subject: [PATCH 075/146] hyprlandPlugins.hyprsplit: 0.48.0 -> 0.48.1

---
 .../window-managers/hyprwm/hyprland-plugins/hyprsplit.nix     | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/window-managers/hyprwm/hyprland-plugins/hyprsplit.nix b/pkgs/applications/window-managers/hyprwm/hyprland-plugins/hyprsplit.nix
index 03f3f6453386..2ddb895e7fbb 100644
--- a/pkgs/applications/window-managers/hyprwm/hyprland-plugins/hyprsplit.nix
+++ b/pkgs/applications/window-managers/hyprwm/hyprland-plugins/hyprsplit.nix
@@ -9,13 +9,13 @@
 }:
 mkHyprlandPlugin hyprland rec {
   pluginName = "hyprsplit";
-  version = "0.48.0";
+  version = "0.48.1";
 
   src = fetchFromGitHub {
     owner = "shezdy";
     repo = "hyprsplit";
     rev = "refs/tags/v${version}";
-    hash = "sha256-FTp5mkrrgo/plCFHuFnx+EtDnQQoChq0mdKpb2a4LrQ=";
+    hash = "sha256-MN7eipww5r/I4tlEPTN6U+RZAkXPyf1YYx/YSCqVmoU=";
   };
 
   nativeBuildInputs = [

From 7236ac70cbc0b3ff08c18dce12ae1f7315581b60 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 4 Apr 2025 08:33:40 +0000
Subject: [PATCH 076/146] tagparser: 12.4.0 -> 12.5.0

---
 pkgs/by-name/ta/tagparser/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ta/tagparser/package.nix b/pkgs/by-name/ta/tagparser/package.nix
index 6910a8f1900d..5bd6c959a538 100644
--- a/pkgs/by-name/ta/tagparser/package.nix
+++ b/pkgs/by-name/ta/tagparser/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "tagparser";
-  version = "12.4.0";
+  version = "12.5.0";
 
   src = fetchFromGitHub {
     owner = "Martchus";
     repo = "tagparser";
     rev = "v${version}";
-    hash = "sha256-wVdE1lgSQsH4g10/lxa8bZlYT141Vd7gRhefxyz8kRM=";
+    hash = "sha256-Xu6pvqyBWew3xD0nD5k7QKUOEpDchF1FiuSN7oHfYME=";
   };
 
   nativeBuildInputs = [ cmake ];

From ed26b7b0c374e946dbd774e00d7f0aa1b8fde87f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Fri, 4 Apr 2025 11:37:33 +0200
Subject: [PATCH 077/146] nixos/onlyoffice: misc cleanup

---
 nixos/modules/services/web-apps/onlyoffice.nix | 16 ++++++----------
 1 file changed, 6 insertions(+), 10 deletions(-)

diff --git a/nixos/modules/services/web-apps/onlyoffice.nix b/nixos/modules/services/web-apps/onlyoffice.nix
index 5d2e03147a68..48e51b13bb39 100644
--- a/nixos/modules/services/web-apps/onlyoffice.nix
+++ b/nixos/modules/services/web-apps/onlyoffice.nix
@@ -114,7 +114,7 @@ in
               proxy_pass http://onlyoffice-docservice/$2$3;
             '';
             # /etc/nginx/includes/ds-docservice.conf
-            #disable caching for api.js
+            # disable caching for api.js
             "~ ^(\\/[\\d]+\\.[\\d]+\\.[\\d]+[\\.|-][\\w]+)?\\/(web-apps\\/apps\\/api\\/documents\\/api\\.js)$".extraConfig =
               ''
                 expires -1;
@@ -124,26 +124,23 @@ in
             "~ ^(\\/[\\d]+\\.[\\d]+\\.[\\d]+[\\.|-][\\w]+)?\\/(document_editor_service_worker\\.js)$".extraConfig =
               ''
                 expires 365d;
-                # gzip_static on;
-                alias  ${cfg.package}/var/www/onlyoffice/documentserver/sdkjs/common/serviceworker/$2;
+                alias ${cfg.package}/var/www/onlyoffice/documentserver/sdkjs/common/serviceworker/$2;
               '';
-            #suppress logging the unsupported locale error in web-apps
+            # suppress logging the unsupported locale error in web-apps
             "~ ^(\\/[\\d]+\\.[\\d]+\\.[\\d]+[\\.|-][\\w]+)?\\/(web-apps)(\\/.*\\.json)$".extraConfig = ''
               expires 365d;
               error_log /dev/null crit;
               alias ${cfg.package}/var/www/onlyoffice/documentserver/$2$3;
             '';
-            #suppress logging the unsupported locale error in plugins
+            # suppress logging the unsupported locale error in plugins
             "~ ^(\\/[\\d]+\\.[\\d]+\\.[\\d]+[\\.|-][\\w]+)?\\/(sdkjs-plugins)(\\/.*\\.json)$".extraConfig = ''
               expires 365d;
               error_log /dev/null crit;
-              # gzip_static on;
               alias ${cfg.package}/var/www/onlyoffice/documentserver/$2$3;
             '';
             "~ ^(\\/[\\d]+\\.[\\d]+\\.[\\d]+[\\.|-][\\w]+)?\\/(web-apps|sdkjs|sdkjs-plugins|fonts|dictionaries)(\\/.*)$".extraConfig =
               ''
                 expires 365d;
-                # gzip_static on;
                 alias ${cfg.package}/var/www/onlyoffice/documentserver/$2$3;
               '';
             "~* ^(\\/cache\\/files.*)(\\/.*)".extraConfig = ''
@@ -302,9 +299,8 @@ in
               ' /run/onlyoffice/config/default.json | sponge /run/onlyoffice/config/default.json
 
             chmod u+w /run/onlyoffice/config/production-linux.json
-            jq '
-              .FileConverter.converter.x2tPath = "${cfg.x2t}/bin/x2t"
-              ' /run/onlyoffice/config/production-linux.json | sponge /run/onlyoffice/config/production-linux.json
+            jq '.FileConverter.converter.x2tPath = "${cfg.x2t}/bin/x2t"' \
+              /run/onlyoffice/config/production-linux.json | sponge /run/onlyoffice/config/production-linux.json
 
             if psql -d onlyoffice -c "SELECT 'task_result'::regclass;" >/dev/null; then
               psql -f ${cfg.package}/var/www/onlyoffice/documentserver/server/schema/postgresql/removetbl.sql

From dbb3bdb4d4d981692cefe88436eb36f3a59f9d96 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Fri, 4 Apr 2025 11:37:49 +0200
Subject: [PATCH 078/146] onlyoffice-documentserver: fail loudly when
 HASH_POSTFIX would change

---
 pkgs/by-name/on/onlyoffice-documentserver/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/on/onlyoffice-documentserver/package.nix b/pkgs/by-name/on/onlyoffice-documentserver/package.nix
index a86bf31a641f..0d828b87580c 100644
--- a/pkgs/by-name/on/onlyoffice-documentserver/package.nix
+++ b/pkgs/by-name/on/onlyoffice-documentserver/package.nix
@@ -61,9 +61,9 @@ let
       mkdir -p var/lib/onlyoffice/ var/www/onlyoffice/documentserver/fonts/
 
       # see usr/bin/documentserver-flush-cache.sh
-      cp var/www/onlyoffice/documentserver/web-apps/apps/api/documents/api.js.tpl var/www/onlyoffice/documentserver/web-apps/apps/api/documents/api.js
-      HASH=$(basename $out | cut -d '-' -f 1)
-      sed -i "s/{{HASH_POSTFIX}}/$HASH/g" var/www/onlyoffice/documentserver/web-apps/apps/api/documents/api.js
+      cp var/www/onlyoffice/documentserver/web-apps/apps/api/documents/api.js{.tpl,}
+      substituteInPlace var/www/onlyoffice/documentserver/web-apps/apps/api/documents/api.js \
+        --replace-fail '{{HASH_POSTFIX}}' "$(basename $out | cut -d '-' -f 1)"
 
       mv * $out/
     '';

From 915d70217de01d00d365369abf64c5be6fa2139d Mon Sep 17 00:00:00 2001
From: Zexin Yuan <git@yzx9.xyz>
Date: Fri, 4 Apr 2025 17:54:55 +0800
Subject: [PATCH 079/146] aider-chat: 0.80.0 -> 0.81.0, enable update script

---
 pkgs/development/python-modules/aider-chat/default.nix | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/aider-chat/default.nix b/pkgs/development/python-modules/aider-chat/default.nix
index 5cd871b868d3..519738bfad42 100644
--- a/pkgs/development/python-modules/aider-chat/default.nix
+++ b/pkgs/development/python-modules/aider-chat/default.nix
@@ -112,6 +112,7 @@
   torch,
   nltk,
   boto3,
+  nix-update-script,
 }:
 
 let
@@ -123,7 +124,7 @@ let
     ];
   };
 
-  version = "0.80.0";
+  version = "0.81.0";
   aider-chat = buildPythonPackage {
     pname = "aider-chat";
     inherit version;
@@ -136,7 +137,7 @@ let
       owner = "Aider-AI";
       repo = "aider";
       tag = "v${version}";
-      hash = "sha256-W3GO5+0rprQHmn1upL3pcXuv2e9Wir6TW0tUnvZj48E=";
+      hash = "sha256-xWOXsffLAVBZvJM8PuAJ12IrmNLfXuqHrbIMtPM1leE=";
     };
 
     pythonRelaxDeps = true;
@@ -365,6 +366,8 @@ let
             makeWrapperArgs = makeWrapperArgs ++ playwrightArgs ++ helpArgs;
           }
         );
+
+      updateScript = nix-update-script { };
     };
 
     meta = {

From 36be2e2a525ac379085673ad47901299f1bca402 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 4 Apr 2025 09:56:31 +0000
Subject: [PATCH 080/146] rain: 1.21.0 -> 1.22.0

---
 pkgs/by-name/ra/rain/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ra/rain/package.nix b/pkgs/by-name/ra/rain/package.nix
index 05b2b0189e8b..eb1a8ec4d010 100644
--- a/pkgs/by-name/ra/rain/package.nix
+++ b/pkgs/by-name/ra/rain/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "rain";
-  version = "1.21.0";
+  version = "1.22.0";
 
   src = fetchFromGitHub {
     owner = "aws-cloudformation";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-2yb965fDzNgrPXT2xMRdqD/inyvlwdKlkMj16YSFHBk=";
+    sha256 = "sha256-0FjJXOmLHM0At0TJdcsYTafgDbw+C37BH11ft+UjEl0=";
   };
 
-  vendorHash = "sha256-TlS9SfqMJa5w+JMUx+7ZMF0xk/VsnjOScSGXEw1dVkU=";
+  vendorHash = "sha256-A+fQCiA2jArnhxbKxNmRQB6wY5mcmrY+fMtZQX5aBmU=";
 
   subPackages = [ "cmd/rain" ];
 

From edef4448e8c89b8a8acfc0b91cb5304b77363006 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 4 Apr 2025 10:03:54 +0000
Subject: [PATCH 081/146] tippecanoe: 2.75.1 -> 2.77.0

---
 pkgs/by-name/ti/tippecanoe/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ti/tippecanoe/package.nix b/pkgs/by-name/ti/tippecanoe/package.nix
index e298a641dc70..e7d7ab976153 100644
--- a/pkgs/by-name/ti/tippecanoe/package.nix
+++ b/pkgs/by-name/ti/tippecanoe/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "tippecanoe";
-  version = "2.75.1";
+  version = "2.77.0";
 
   src = fetchFromGitHub {
     owner = "felt";
     repo = "tippecanoe";
     tag = finalAttrs.version;
-    hash = "sha256-rBuk34lOrp9aW7yK0LOTRqFJg3J8IogR01kcFhgK12Y=";
+    hash = "sha256-7yRrUn1U0iERlix/8/oaMaizlpzqdiSIHj298ykaJjE=";
   };
 
   buildInputs = [

From 81758d399f9bc7e3c666464dfd4e24734be78cec Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 4 Apr 2025 10:21:39 +0000
Subject: [PATCH 082/146] moosefs: 4.57.5 -> 4.57.6

---
 pkgs/by-name/mo/moosefs/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/mo/moosefs/package.nix b/pkgs/by-name/mo/moosefs/package.nix
index 56944ad6be76..37dc19b74b25 100644
--- a/pkgs/by-name/mo/moosefs/package.nix
+++ b/pkgs/by-name/mo/moosefs/package.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "moosefs";
-  version = "4.57.5";
+  version = "4.57.6";
 
   src = fetchFromGitHub {
     owner = "moosefs";
     repo = "moosefs";
     rev = "v${version}";
-    sha256 = "sha256-5sVnr+bUbmIc4qYC/h+d/s1ow3cxeL2Yo/JitCs6cbE=";
+    sha256 = "sha256-vCwRM6UIcT71e6u5QZzcTW6LK/VNlVG/19XxsHnn2a8=";
   };
 
   nativeBuildInputs = [

From bc073b4c29e4fb4f5757144e04096e0c16c81932 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 4 Apr 2025 10:39:53 +0000
Subject: [PATCH 083/146] lokalise2-cli: 3.1.1 -> 3.1.2

---
 pkgs/by-name/lo/lokalise2-cli/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/lo/lokalise2-cli/package.nix b/pkgs/by-name/lo/lokalise2-cli/package.nix
index 6614c9a3382d..32cfb4202228 100644
--- a/pkgs/by-name/lo/lokalise2-cli/package.nix
+++ b/pkgs/by-name/lo/lokalise2-cli/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "lokalise2-cli";
-  version = "3.1.1";
+  version = "3.1.2";
 
   src = fetchFromGitHub {
     owner = "lokalise";
     repo = "lokalise-cli-2-go";
     rev = "v${version}";
-    sha256 = "sha256-CFZB1nELQOBNOuISTjes4vhXMr8Pjq4Rj83nq/FfpMY=";
+    sha256 = "sha256-R8vzHuWkNznq/eeXUVHm9SJJmRV2B2WXKQFEHil+HiY=";
   };
 
-  vendorHash = "sha256-sM4v1EWxXPUFKFWcl9EBc8ZTmm2STOVoeGH9Zv+KEng=";
+  vendorHash = "sha256-thD8NtG9uVI4KwNQiNsVCUdyUcgAmnr+szsUQ2Ika1c=";
 
   doCheck = false;
 

From ed7eae38b4598bd4787aaf198e7c5b89773fdd7e Mon Sep 17 00:00:00 2001
From: Mitsuo HEIJO <mitsuo.heijo@gmail.com>
Date: Fri, 4 Apr 2025 20:11:45 +0900
Subject: [PATCH 084/146] gojq: install zsh completion

---
 pkgs/by-name/go/gojq/package.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pkgs/by-name/go/gojq/package.nix b/pkgs/by-name/go/gojq/package.nix
index bc2f9dea992c..365b7bc336c0 100644
--- a/pkgs/by-name/go/gojq/package.nix
+++ b/pkgs/by-name/go/gojq/package.nix
@@ -4,6 +4,7 @@
   fetchFromGitHub,
   testers,
   gojq,
+  installShellFiles,
 }:
 
 buildGoModule rec {
@@ -24,6 +25,12 @@ buildGoModule rec {
     "-w"
   ];
 
+  nativeBuildInputs = [ installShellFiles ];
+
+  postInstall = ''
+    installShellCompletion --cmd gojq --zsh _gojq
+  '';
+
   passthru.tests.version = testers.testVersion {
     package = gojq;
   };

From 8807f45da070cec9c6b5bb10da865a128cfde570 Mon Sep 17 00:00:00 2001
From: Piotr Kwiecinski <2151333+piotrkwiecinski@users.noreply.github.com>
Date: Fri, 4 Apr 2025 13:44:11 +0200
Subject: [PATCH 085/146] nixosTests.librenms: migrate to runTest

Part of #386873
---
 nixos/tests/all-tests.nix |   2 +-
 nixos/tests/librenms.nix  | 178 +++++++++++++++++++-------------------
 2 files changed, 89 insertions(+), 91 deletions(-)

diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 5ffcaccf17f9..8176aeaccbc3 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -691,7 +691,7 @@ in
   leaps = handleTest ./leaps.nix { };
   lemmy = handleTest ./lemmy.nix { };
   libinput = handleTest ./libinput.nix { };
-  librenms = handleTest ./librenms.nix { };
+  librenms = runTest ./librenms.nix;
   libresprite = handleTest ./libresprite.nix { };
   libreswan = runTest ./libreswan.nix;
   libreswan-nat = runTest ./libreswan-nat.nix;
diff --git a/nixos/tests/librenms.nix b/nixos/tests/librenms.nix
index 05821dfa1000..d8d3e5eb92fa 100644
--- a/nixos/tests/librenms.nix
+++ b/nixos/tests/librenms.nix
@@ -1,106 +1,104 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
+{ pkgs, lib, ... }:
 
-  let
-    api_token = "f87f42114e44b63ad1b9e3c3d33d6fbe"; # random md5 hash
-    wrong_api_token = "e68ba041fcf1eab923a7a6de3af5f726"; # another random md5 hash
-  in
-  {
-    name = "librenms";
-    meta.maintainers = lib.teams.wdz.members;
+let
+  api_token = "f87f42114e44b63ad1b9e3c3d33d6fbe"; # random md5 hash
+  wrong_api_token = "e68ba041fcf1eab923a7a6de3af5f726"; # another random md5 hash
+in
+{
+  name = "librenms";
+  meta.maintainers = lib.teams.wdz.members;
 
-    nodes.librenms = {
-      time.timeZone = "Europe/Berlin";
+  nodes.librenms = {
+    time.timeZone = "Europe/Berlin";
 
-      environment.systemPackages = with pkgs; [
-        curl
-        jq
-      ];
+    environment.systemPackages = with pkgs; [
+      curl
+      jq
+    ];
 
-      services.librenms = {
-        enable = true;
-        hostname = "librenms";
-        database = {
-          createLocally = true;
-          host = "localhost";
-          database = "librenms";
-          username = "librenms";
-          passwordFile = pkgs.writeText "librenms-db-pass" "librenmsdbpass";
-        };
-        nginx = {
-          default = true;
-        };
-        enableOneMinutePolling = true;
-        settings = {
-          enable_billing = true;
-        };
+    services.librenms = {
+      enable = true;
+      hostname = "librenms";
+      database = {
+        createLocally = true;
+        host = "localhost";
+        database = "librenms";
+        username = "librenms";
+        passwordFile = pkgs.writeText "librenms-db-pass" "librenmsdbpass";
       };
-
-      # systemd oneshot to create a dummy admin user and a API token for testing
-      systemd.services.lnms-api-init = {
-        description = "LibreNMS API init";
-        after = [ "librenms-setup.service" ];
-        wantedBy = [ "multi-user.target" ];
-        serviceConfig = {
-          Type = "oneshot";
-          RemainAfterExit = true;
-          User = "root";
-          Group = "root";
-        };
-        script = ''
-          API_USER_NAME=api
-          API_TOKEN=${api_token} # random md5 hash
-
-          # seeding database to get the admin roles
-          ${pkgs.librenms}/artisan db:seed --force --no-interaction
-
-          # we don't need to know the password, it just has to exist
-          API_USER_PASS=$(${pkgs.pwgen}/bin/pwgen -s 64 1)
-          ${pkgs.librenms}/artisan user:add $API_USER_NAME -r admin -p $API_USER_PASS
-          API_USER_ID=$(${pkgs.mariadb}/bin/mysql -D librenms -N -B -e "SELECT user_id FROM users WHERE username = '$API_USER_NAME';")
-
-          ${pkgs.mariadb}/bin/mysql -D librenms -e "INSERT INTO api_tokens (user_id, token_hash, description) VALUES ($API_USER_ID, '$API_TOKEN', 'API User')"
-        '';
+      nginx = {
+        default = true;
+      };
+      enableOneMinutePolling = true;
+      settings = {
+        enable_billing = true;
       };
     };
 
-    nodes.snmphost = {
-
-      services.snmpd = {
-        enable = true;
-        openFirewall = true;
-
-        configText = ''
-          com2sec readonly default public
-
-          group MyROGroup v2c        readonly
-          view all    included  .1                               80
-          access MyROGroup ""      any       noauth    exact  all    none   none
-
-          syslocation Testcity, Testcountry
-          syscontact Testi mc Test <test@example.com>
-        '';
-
+    # systemd oneshot to create a dummy admin user and a API token for testing
+    systemd.services.lnms-api-init = {
+      description = "LibreNMS API init";
+      after = [ "librenms-setup.service" ];
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        Type = "oneshot";
+        RemainAfterExit = true;
+        User = "root";
+        Group = "root";
       };
+      script = ''
+        API_USER_NAME=api
+        API_TOKEN=${api_token} # random md5 hash
+
+        # seeding database to get the admin roles
+        ${pkgs.librenms}/artisan db:seed --force --no-interaction
+
+        # we don't need to know the password, it just has to exist
+        API_USER_PASS=$(${pkgs.pwgen}/bin/pwgen -s 64 1)
+        ${pkgs.librenms}/artisan user:add $API_USER_NAME -r admin -p $API_USER_PASS
+        API_USER_ID=$(${pkgs.mariadb}/bin/mysql -D librenms -N -B -e "SELECT user_id FROM users WHERE username = '$API_USER_NAME';")
+
+        ${pkgs.mariadb}/bin/mysql -D librenms -e "INSERT INTO api_tokens (user_id, token_hash, description) VALUES ($API_USER_ID, '$API_TOKEN', 'API User')"
+      '';
     };
+  };
 
-    testScript = ''
-      start_all()
+  nodes.snmphost = {
 
-      snmphost.wait_for_unit("snmpd.service")
+    services.snmpd = {
+      enable = true;
+      openFirewall = true;
 
-      librenms.wait_for_unit("lnms-api-init.service")
-      librenms.wait_for_open_port(80)
+      configText = ''
+        com2sec readonly default public
 
-      # Test that we can authenticate against the API
-      librenms.succeed("curl --fail -H 'X-Auth-Token: ${api_token}' http://localhost/api/v0")
-      librenms.fail("curl --fail -H 'X-Auth-Token: ${wrong_api_token}' http://localhost/api/v0")
+        group MyROGroup v2c        readonly
+        view all    included  .1                               80
+        access MyROGroup ""      any       noauth    exact  all    none   none
 
-      # add snmphost as a device
-      librenms.succeed("curl --fail -X POST -d '{\"hostname\":\"snmphost\",\"version\":\"v2c\",\"community\":\"public\"}' -H 'X-Auth-Token: ${api_token}' http://localhost/api/v0/devices")
+        syslocation Testcity, Testcountry
+        syscontact Testi mc Test <test@example.com>
+      '';
 
-      # wait until snmphost gets polled
-      librenms.wait_until_succeeds("test $(curl -H 'X-Auth-Token: ${api_token}' http://localhost/api/v0/devices/snmphost | jq -Mr .devices[0].last_polled) != 'null'")
-    '';
-  }
-)
+    };
+  };
+
+  testScript = ''
+    start_all()
+
+    snmphost.wait_for_unit("snmpd.service")
+
+    librenms.wait_for_unit("lnms-api-init.service")
+    librenms.wait_for_open_port(80)
+
+    # Test that we can authenticate against the API
+    librenms.succeed("curl --fail -H 'X-Auth-Token: ${api_token}' http://localhost/api/v0")
+    librenms.fail("curl --fail -H 'X-Auth-Token: ${wrong_api_token}' http://localhost/api/v0")
+
+    # add snmphost as a device
+    librenms.succeed("curl --fail -X POST -d '{\"hostname\":\"snmphost\",\"version\":\"v2c\",\"community\":\"public\"}' -H 'X-Auth-Token: ${api_token}' http://localhost/api/v0/devices")
+
+    # wait until snmphost gets polled
+    librenms.wait_until_succeeds("test $(curl -H 'X-Auth-Token: ${api_token}' http://localhost/api/v0/devices/snmphost | jq -Mr .devices[0].last_polled) != 'null'")
+  '';
+}

From 470a936f46fed1e6dd699fd286757592b3b5f95d Mon Sep 17 00:00:00 2001
From: Piotr Kwiecinski <2151333+piotrkwiecinski@users.noreply.github.com>
Date: Fri, 4 Apr 2025 13:55:33 +0200
Subject: [PATCH 086/146] nixosTests.tuxguitar: migrate to runTest

Part of #386873
---
 nixos/tests/all-tests.nix |  2 +-
 nixos/tests/tuxguitar.nix | 50 ++++++++++++++++++---------------------
 2 files changed, 24 insertions(+), 28 deletions(-)

diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 9ee7f01fef1b..0de678f814b1 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -1350,7 +1350,7 @@ in
   tuptime = handleTest ./tuptime.nix { };
   turbovnc-headless-server = handleTest ./turbovnc-headless-server.nix { };
   turn-rs = handleTest ./turn-rs.nix { };
-  tuxguitar = handleTest ./tuxguitar.nix { };
+  tuxguitar = runTest ./tuxguitar.nix;
   twingate = runTest ./twingate.nix;
   typesense = handleTest ./typesense.nix { };
   ucarp = handleTest ./ucarp.nix { };
diff --git a/nixos/tests/tuxguitar.nix b/nixos/tests/tuxguitar.nix
index e491f96a89ce..d0df7d5c5bb5 100644
--- a/nixos/tests/tuxguitar.nix
+++ b/nixos/tests/tuxguitar.nix
@@ -1,29 +1,25 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "tuxguitar";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ ];
+{ ... }:
+{
+  name = "tuxguitar";
+  meta.maintainers = [ ];
+
+  nodes.machine =
+    { config, pkgs, ... }:
+    {
+      imports = [
+        ./common/x11.nix
+      ];
+
+      services.xserver.enable = true;
+
+      environment.systemPackages = [ pkgs.tuxguitar ];
     };
 
-    nodes.machine =
-      { config, pkgs, ... }:
-      {
-        imports = [
-          ./common/x11.nix
-        ];
-
-        services.xserver.enable = true;
-
-        environment.systemPackages = [ pkgs.tuxguitar ];
-      };
-
-    testScript = ''
-      machine.wait_for_x()
-      machine.succeed("tuxguitar >&2 &")
-      machine.wait_for_window("TuxGuitar - Untitled.tg")
-      machine.sleep(1)
-      machine.screenshot("tuxguitar")
-    '';
-  }
-)
+  testScript = ''
+    machine.wait_for_x()
+    machine.succeed("tuxguitar >&2 &")
+    machine.wait_for_window("TuxGuitar - Untitled.tg")
+    machine.sleep(1)
+    machine.screenshot("tuxguitar")
+  '';
+}

From e6067eeed96dd759fa6e49701e9b4dd77b96e549 Mon Sep 17 00:00:00 2001
From: Silvan Mosberger <silvan.mosberger@moduscreate.com>
Date: Fri, 4 Apr 2025 14:06:16 +0200
Subject: [PATCH 087/146] nixfmt-rfc-style: 2025-03-03 -> 2025-04-04

Probably the last unstable update before stabilising nixfmt. Includes:
- Crucial fixes for the merge tool: https://github.com/NixOS/nixfmt/pull/291
- Recursive mode deprecation warning informing of nixfmt-tree: https://github.com/NixOS/nixfmt/pull/287
---
 pkgs/by-name/ni/nixfmt-rfc-style/date.txt              | 2 +-
 pkgs/by-name/ni/nixfmt-rfc-style/generated-package.nix | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ni/nixfmt-rfc-style/date.txt b/pkgs/by-name/ni/nixfmt-rfc-style/date.txt
index 323e1df227fb..24a34eca600b 100644
--- a/pkgs/by-name/ni/nixfmt-rfc-style/date.txt
+++ b/pkgs/by-name/ni/nixfmt-rfc-style/date.txt
@@ -1 +1 @@
-2025-03-03
+2025-04-04
diff --git a/pkgs/by-name/ni/nixfmt-rfc-style/generated-package.nix b/pkgs/by-name/ni/nixfmt-rfc-style/generated-package.nix
index 95e0871add42..1da633e8999d 100644
--- a/pkgs/by-name/ni/nixfmt-rfc-style/generated-package.nix
+++ b/pkgs/by-name/ni/nixfmt-rfc-style/generated-package.nix
@@ -25,8 +25,8 @@ mkDerivation {
   pname = "nixfmt";
   version = "0.6.0";
   src = fetchzip {
-    url = "https://github.com/nixos/nixfmt/archive/3261d1016ecc753c59ff92767a257f91b587e705.tar.gz";
-    sha256 = "0jk6mgp710iwxyc7wa5kzz0p0rpcwbbs21smnv14cyii0jniz42s";
+    url = "https://github.com/nixos/nixfmt/archive/65af4b69133d19f534d97746c97c2d5b464f43b4.tar.gz";
+    sha256 = "0l0w3janvss1n1j7qkcml97zndm2jm2gbrzzs9d8l0ixnrw0cd5r";
   };
   isLibrary = true;
   isExecutable = true;

From 8f0d4225d4aca60386844933164e92b6660d00b3 Mon Sep 17 00:00:00 2001
From: Piotr Kwiecinski <2151333+piotrkwiecinski@users.noreply.github.com>
Date: Fri, 4 Apr 2025 14:14:45 +0200
Subject: [PATCH 088/146] nixosTests.lighttpd: migrate to runTest

Part of #386873
---
 nixos/tests/all-tests.nix |  2 +-
 nixos/tests/lighttpd.nix  | 42 +++++++++++++++++++--------------------
 2 files changed, 21 insertions(+), 23 deletions(-)

diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 9ee7f01fef1b..2c6fa25761a4 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -703,7 +703,7 @@ in
   libvirtd = handleTest ./libvirtd.nix { };
   lidarr = handleTest ./lidarr.nix { };
   lightdm = handleTest ./lightdm.nix { };
-  lighttpd = handleTest ./lighttpd.nix { };
+  lighttpd = runTest ./lighttpd.nix;
   limesurvey = handleTest ./limesurvey.nix { };
   limine = import ./limine { inherit runTest; };
   listmonk = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./listmonk.nix { };
diff --git a/nixos/tests/lighttpd.nix b/nixos/tests/lighttpd.nix
index 271dc19ef68c..db08fdf3de22 100644
--- a/nixos/tests/lighttpd.nix
+++ b/nixos/tests/lighttpd.nix
@@ -1,25 +1,23 @@
-import ./make-test-python.nix (
-  { lib, pkgs, ... }:
-  {
-    name = "lighttpd";
-    meta.maintainers = with lib.maintainers; [ bjornfor ];
+{ lib, pkgs, ... }:
+{
+  name = "lighttpd";
+  meta.maintainers = with lib.maintainers; [ bjornfor ];
 
-    nodes = {
-      server = {
-        services.lighttpd.enable = true;
-        services.lighttpd.document-root = pkgs.runCommand "document-root" { } ''
-          mkdir -p "$out"
-          echo "hello nixos test" > "$out/file.txt"
-        '';
-      };
+  nodes = {
+    server = {
+      services.lighttpd.enable = true;
+      services.lighttpd.document-root = pkgs.runCommand "document-root" { } ''
+        mkdir -p "$out"
+        echo "hello nixos test" > "$out/file.txt"
+      '';
     };
+  };
 
-    testScript = ''
-      start_all()
-      server.wait_for_unit("lighttpd.service")
-      res = server.succeed("curl --fail http://localhost/file.txt")
-      assert "hello nixos test" in res, f"bad server response: '{res}'"
-      server.succeed("systemctl reload lighttpd")
-    '';
-  }
-)
+  testScript = ''
+    start_all()
+    server.wait_for_unit("lighttpd.service")
+    res = server.succeed("curl --fail http://localhost/file.txt")
+    assert "hello nixos test" in res, f"bad server response: '{res}'"
+    server.succeed("systemctl reload lighttpd")
+  '';
+}

From d86c274b99b9c40ac54e0423cc99e9ab44105497 Mon Sep 17 00:00:00 2001
From: Piotr Kwiecinski <2151333+piotrkwiecinski@users.noreply.github.com>
Date: Fri, 4 Apr 2025 14:23:09 +0200
Subject: [PATCH 089/146] nixosTests.starship: migrate to runTest

Part of #386873
---
 nixos/tests/all-tests.nix |  2 +-
 nixos/tests/starship.nix  | 92 +++++++++++++++++++--------------------
 2 files changed, 46 insertions(+), 48 deletions(-)

diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 9ee7f01fef1b..c4928d9e52e5 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -1202,7 +1202,7 @@ in
   sssd-ldap = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./sssd-ldap.nix { };
   stalwart-mail = handleTest ./stalwart-mail.nix { };
   stargazer = runTest ./web-servers/stargazer.nix;
-  starship = handleTest ./starship.nix { };
+  starship = runTest ./starship.nix;
   stash = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./stash.nix { };
   static-web-server = handleTest ./web-servers/static-web-server.nix { };
   step-ca = handleTestOn [ "x86_64-linux" ] ./step-ca.nix { };
diff --git a/nixos/tests/starship.nix b/nixos/tests/starship.nix
index 23e103fc000e..382666d8f176 100644
--- a/nixos/tests/starship.nix
+++ b/nixos/tests/starship.nix
@@ -1,53 +1,51 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "starship";
-    meta.maintainers = pkgs.starship.meta.maintainers;
+{ pkgs, ... }:
+{
+  name = "starship";
+  meta.maintainers = pkgs.starship.meta.maintainers;
 
-    nodes.machine = {
-      programs = {
-        fish.enable = true;
-        zsh.enable = true;
+  nodes.machine = {
+    programs = {
+      fish.enable = true;
+      zsh.enable = true;
 
-        starship = {
-          enable = true;
-          settings.format = "<starship>";
-        };
+      starship = {
+        enable = true;
+        settings.format = "<starship>";
       };
-
-      environment.systemPackages =
-        map
-          (
-            shell:
-            pkgs.writeScriptBin "expect-${shell}" ''
-              #!${pkgs.expect}/bin/expect -f
-
-              spawn env TERM=xterm ${shell} -i
-
-              expect "<starship>" {
-                send "exit\n"
-              } timeout {
-                send_user "\n${shell} failed to display Starship\n"
-                exit 1
-              }
-
-              expect eof
-            ''
-          )
-          [
-            "bash"
-            "fish"
-            "zsh"
-          ];
     };
 
-    testScript = ''
-      start_all()
-      machine.wait_for_unit("default.target")
+    environment.systemPackages =
+      map
+        (
+          shell:
+          pkgs.writeScriptBin "expect-${shell}" ''
+            #!${pkgs.expect}/bin/expect -f
 
-      machine.succeed("expect-bash")
-      machine.succeed("expect-fish")
-      machine.succeed("expect-zsh")
-    '';
-  }
-)
+            spawn env TERM=xterm ${shell} -i
+
+            expect "<starship>" {
+              send "exit\n"
+            } timeout {
+              send_user "\n${shell} failed to display Starship\n"
+              exit 1
+            }
+
+            expect eof
+          ''
+        )
+        [
+          "bash"
+          "fish"
+          "zsh"
+        ];
+  };
+
+  testScript = ''
+    start_all()
+    machine.wait_for_unit("default.target")
+
+    machine.succeed("expect-bash")
+    machine.succeed("expect-fish")
+    machine.succeed("expect-zsh")
+  '';
+}

From 3c6b1cf6f60dd2e786c6ed11a22eab790863d41b Mon Sep 17 00:00:00 2001
From: Neyts Zupan <zupo@users.noreply.github.com>
Date: Thu, 3 Apr 2025 20:25:28 +0100
Subject: [PATCH 090/146] paretosecurity: 0.0.96 -> 0.1.3

Also:
 * Fix PATH for systemd services
 * Make UI tests faster and more robust by setting low resolution
---
 nixos/modules/services/security/paretosecurity.nix | 14 ++++++++++++++
 nixos/tests/paretosecurity.nix                     | 11 +++++++++--
 pkgs/by-name/pa/paretosecurity/package.nix         |  6 +++---
 3 files changed, 26 insertions(+), 5 deletions(-)

diff --git a/nixos/modules/services/security/paretosecurity.nix b/nixos/modules/services/security/paretosecurity.nix
index 9ec196eee6a0..a1080ede8431 100644
--- a/nixos/modules/services/security/paretosecurity.nix
+++ b/nixos/modules/services/security/paretosecurity.nix
@@ -24,6 +24,17 @@
     # dependencies here. This creates the necessary symlinks in the proper locations.
     systemd.sockets.paretosecurity.wantedBy = [ "sockets.target" ];
 
+    # In NixOS, systemd services are configured with minimal PATH. However,
+    # paretosecurity helper looks for installed software to do its job, so
+    # it needs the full system PATH. For example, it runs `iptables` to see if
+    # firewall is configured. And it looks for various password managers to see
+    # if one is installed.
+    # The `paretosecurity-user` timer service that is configured lower has
+    # the same need.
+    systemd.services.paretosecurity.serviceConfig.Environment = [
+      "PATH=${config.system.path}/bin:${config.system.path}/sbin"
+    ];
+
     # Enable the tray icon and timer services if the trayIcon option is enabled
     systemd.user = lib.mkIf config.services.paretosecurity.trayIcon {
       services.paretosecurity-trayicon = {
@@ -31,6 +42,9 @@
       };
       services.paretosecurity-user = {
         wantedBy = [ "graphical-session.target" ];
+        serviceConfig.Environment = [
+          "PATH=${config.system.path}/bin:${config.system.path}/sbin"
+        ];
       };
       timers.paretosecurity-user = {
         wantedBy = [ "timers.target" ];
diff --git a/nixos/tests/paretosecurity.nix b/nixos/tests/paretosecurity.nix
index a2b9317c678f..bf9af17e2f5e 100644
--- a/nixos/tests/paretosecurity.nix
+++ b/nixos/tests/paretosecurity.nix
@@ -29,6 +29,8 @@
         package = patchedPareto;
       };
 
+      networking.firewall.enable = true;
+
     };
 
   nodes.dashboard =
@@ -64,6 +66,12 @@
       services.displayManager.autoLogin = {
         enable = true;
         user = "alice";
+
+      };
+
+      virtualisation.resolution = {
+        x = 640;
+        y = 480;
       };
 
       environment.systemPackages = [ pkgs.xdotool ];
@@ -94,7 +102,6 @@
       + " --skip 21830a4e-84f1-48fe-9c5b-beab436b2cdb"  # Disk encryption
       + " --skip 44e4754a-0b42-4964-9cc2-b88b2023cb1e"  # Pareto Security is up to date
       + " --skip f962c423-fdf5-428a-a57a-827abc9b253e"  # Password manager installed
-      + " --skip 2e46c89a-5461-4865-a92e-3b799c12034a"  # Firewall is enabled
       + "'"
     )
 
@@ -117,7 +124,7 @@
     ]:
         status, out = xfce.systemctl("is-enabled " + unit, "alice")
         assert status == 0, f"Unit {unit} is not enabled (status: {status}): {out}"
-    xfce.succeed("xdotool mousemove 850 10")
+    xfce.succeed("xdotool mousemove 460 10")
     xfce.wait_for_text("Pareto Security")
     xfce.succeed("xdotool click 1")
     xfce.wait_for_text("Run Checks")
diff --git a/pkgs/by-name/pa/paretosecurity/package.nix b/pkgs/by-name/pa/paretosecurity/package.nix
index e6b5232d75cb..25728d4e32a3 100644
--- a/pkgs/by-name/pa/paretosecurity/package.nix
+++ b/pkgs/by-name/pa/paretosecurity/package.nix
@@ -9,16 +9,16 @@
 
 buildGoModule rec {
   pname = "paretosecurity";
-  version = "0.0.96";
+  version = "0.1.3";
 
   src = fetchFromGitHub {
     owner = "ParetoSecurity";
     repo = "agent";
     rev = version;
-    hash = "sha256-SyeIGSDvrnOvyOJ0zC8CulpaMa+iZeRaMTJUSydz2tw=";
+    hash = "sha256-ovyfHqLCf5U3UR1HfoA+UQhqLZ6IaILcpqptPRQsb60=";
   };
 
-  vendorHash = "sha256-O/OF3Y6HiiikMxf657k9eIM7UfkicIImAUxVVf/TgR8=";
+  vendorHash = "sha256-7mKAFkKGpBOjXc3J/sfF3k3pJF53tFybXZgbfJInuSY=";
   proxyVendor = true;
 
   ldflags = [

From 2c525864bcd332763cd839457b6aaf28998df46d Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 4 Apr 2025 13:14:30 +0000
Subject: [PATCH 091/146] libmt32emu: 2.7.1 -> 2.7.2

---
 pkgs/applications/audio/munt/libmt32emu.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/audio/munt/libmt32emu.nix b/pkgs/applications/audio/munt/libmt32emu.nix
index 31db8595ca10..7015d978d394 100644
--- a/pkgs/applications/audio/munt/libmt32emu.nix
+++ b/pkgs/applications/audio/munt/libmt32emu.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libmt32emu";
-  version = "2.7.1";
+  version = "2.7.2";
 
   src = fetchFromGitHub {
     owner = "munt";
     repo = "munt";
     rev = "${pname}_${lib.replaceStrings [ "." ] [ "_" ] version}";
-    sha256 = "sha256-zY1AFcm8uvFkrKUZHsqtKY2CYTY4bWmkTJ7bZPqXoxk=";
+    sha256 = "sha256-wXIvdGoup/AOQggkeXvtbi3pXhyKUKWmyt/ZbGzufds=";
   };
 
   outputs = [

From 0f8342b5f490334c96e2f2984c089a6d21b01032 Mon Sep 17 00:00:00 2001
From: Moritz Sanft <58110325+msanft@users.noreply.github.com>
Date: Fri, 4 Apr 2025 15:15:34 +0200
Subject: [PATCH 092/146] mkosi: rename python3 -> python

---
 pkgs/tools/virtualization/mkosi/default.nix | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/pkgs/tools/virtualization/mkosi/default.nix b/pkgs/tools/virtualization/mkosi/default.nix
index 6f2fdc6eefe4..1163a909fec3 100644
--- a/pkgs/tools/virtualization/mkosi/default.nix
+++ b/pkgs/tools/virtualization/mkosi/default.nix
@@ -2,6 +2,7 @@
   lib,
   fetchFromGitHub,
   stdenv,
+  python,
   systemd,
   pandoc,
   kmod,
@@ -15,13 +16,11 @@
   replaceVars,
 
   # Python packages
-  python,
   setuptools,
   setuptools-scm,
   wheel,
   buildPythonApplication,
   pytestCheckHook,
-  pefile,
 
   # Optional dependencies
   withQemu ? false,
@@ -46,7 +45,7 @@ let
     withKernelInstall = true;
   };
 
-  python3pefile = python.withPackages (_: [ pefile ]);
+  pythonWithPefile = python.withPackages (ps: [ ps.pefile ]);
 
   deps =
     [
@@ -85,7 +84,7 @@ buildPythonApplication rec {
     [
       (replaceVars ./0001-Use-wrapped-binaries-instead-of-Python-interpreter.patch {
         UKIFY = "${systemdForMkosi}/lib/systemd/ukify";
-        PYTHON_PEFILE = "${python3pefile}/bin/python3.12";
+        PYTHON_PEFILE = lib.getExe pythonWithPefile;
         NIX_PATH = toString (lib.makeBinPath deps);
         MKOSI_SANDBOX = null; # will be replaced in postPatch
       })

From 2789c83e9c0d696bc44516c80c599c87c8279316 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 4 Apr 2025 13:54:00 +0000
Subject: [PATCH 093/146] gosec: 2.22.2 -> 2.22.3

---
 pkgs/by-name/go/gosec/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/go/gosec/package.nix b/pkgs/by-name/go/gosec/package.nix
index c066b645df68..79b2d9bfd682 100644
--- a/pkgs/by-name/go/gosec/package.nix
+++ b/pkgs/by-name/go/gosec/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "gosec";
-  version = "2.22.2";
+  version = "2.22.3";
 
   src = fetchFromGitHub {
     owner = "securego";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-j9MRMtINGPn4Hn9Z3+19/Q+Weu277WVONXKtJf9x5Cc=";
+    hash = "sha256-MQ/dDK2t9H7bSsr5MMtlKySLAJIDimRbpATHyOYxrBo=";
   };
 
-  vendorHash = "sha256-lZFTmf4/J3NDdawfp2WpPoaVxepbyazIyC8ahOwPcZo=";
+  vendorHash = "sha256-R1w+dHx3Aond6DmwCHRVZXmUABWfpsbLgcDW67Ukz0E=";
 
   subPackages = [
     "cmd/gosec"

From 9fbc4bf2d3c2f8c8339e536c1abd69c7c89617fe Mon Sep 17 00:00:00 2001
From: Yohann Boniface <edhyjox@gmail.com>
Date: Fri, 4 Apr 2025 15:56:11 +0200
Subject: [PATCH 094/146] linux-doc: fix build (#395281)

---
 pkgs/os-specific/linux/kernel/htmldocs.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/os-specific/linux/kernel/htmldocs.nix b/pkgs/os-specific/linux/kernel/htmldocs.nix
index f6c02fc5ea7e..bfd7de475e17 100644
--- a/pkgs/os-specific/linux/kernel/htmldocs.nix
+++ b/pkgs/os-specific/linux/kernel/htmldocs.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation {
     patchShebangs \
       Documentation/sphinx/parse-headers.pl \
       scripts/{get_abi.pl,get_feat.pl,kernel-doc,sphinx-pre-install} \
-      tools/net/ynl/ynl-gen-rst.py
+      tools/net/ynl/pyynl/ynl_gen_rst.py
   '';
 
   FONTCONFIG_FILE = makeFontsConf {

From 57ddd56634b85ea00171bc58b2c59d1c9b3c47cd Mon Sep 17 00:00:00 2001
From: "Adam C. Stephens" <adam@valkor.net>
Date: Fri, 4 Apr 2025 13:56:45 +0000
Subject: [PATCH 095/146] grafana-loki: 3.4.2 -> 3.4.3

https://github.com/grafana/loki/releases/tag/v3.4.3
---
 pkgs/by-name/gr/grafana-loki/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/gr/grafana-loki/package.nix b/pkgs/by-name/gr/grafana-loki/package.nix
index 8aeda3eb7495..69f76cdf2946 100644
--- a/pkgs/by-name/gr/grafana-loki/package.nix
+++ b/pkgs/by-name/gr/grafana-loki/package.nix
@@ -12,14 +12,14 @@
 }:
 
 buildGoModule rec {
-  version = "3.4.2";
+  version = "3.4.3";
   pname = "grafana-loki";
 
   src = fetchFromGitHub {
     owner = "grafana";
     repo = "loki";
     rev = "v${version}";
-    hash = "sha256-GE92NlFCOk6qFtrgeBvLDI0OkmWaJ1j07Q14+jgi9+w=";
+    hash = "sha256-1tI9X2eIKuWEWJBbN4UAw8yeRrjgfqcenJyTNMk5rqU=";
   };
 
   vendorHash = null;

From 428cee5acf1970b3aa0f5710de38d3ef5af492b8 Mon Sep 17 00:00:00 2001
From: "Adam C. Stephens" <adam@valkor.net>
Date: Fri, 4 Apr 2025 14:00:02 +0000
Subject: [PATCH 096/146] erlang_27: 27.3.1 -> 27.3.2

https://github.com/erlang/otp/releases/tag/OTP-27.3.2
---
 pkgs/development/interpreters/erlang/27.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/interpreters/erlang/27.nix b/pkgs/development/interpreters/erlang/27.nix
index 8a2955813656..8acd7815772c 100644
--- a/pkgs/development/interpreters/erlang/27.nix
+++ b/pkgs/development/interpreters/erlang/27.nix
@@ -1,6 +1,6 @@
 { mkDerivation }:
 
 mkDerivation {
-  version = "27.3.1";
-  sha256 = "sha256-VuVRwcS2TgDYT7buLMHOe8r0AWM+R9DxydcHErAy8xw=";
+  version = "27.3.2";
+  sha256 = "sha256-Pybkcm3pLt0wV+S9ia/BAmM1AKp/nVSAckEzNn4KjSg=";
 }

From b494878375c609b59ec0d09855e775f5ced90a01 Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Fri, 4 Apr 2025 16:06:36 +0200
Subject: [PATCH 097/146] nix-update: 1.10.0 -> 1.11.0

Diff: https://github.com/Mic92/nix-update/compare/refs/tags/1.10.0...1.11.0

Changelog: https://github.com/Mic92/nix-update/releases/tag/1.11.0
---
 pkgs/by-name/ni/nix-update/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ni/nix-update/package.nix b/pkgs/by-name/ni/nix-update/package.nix
index 6e32a46cbe6c..fd0194e180f6 100644
--- a/pkgs/by-name/ni/nix-update/package.nix
+++ b/pkgs/by-name/ni/nix-update/package.nix
@@ -11,14 +11,14 @@
 let
   self = python3Packages.buildPythonApplication {
     pname = "nix-update";
-    version = "1.10.0";
+    version = "1.11.0";
     pyproject = true;
 
     src = fetchFromGitHub {
       owner = "Mic92";
       repo = "nix-update";
       tag = self.version;
-      hash = "sha256-fGs/EdCEoDA9N5gPtHU6CaDZo9e/aqW6pm6atsjK7PI=";
+      hash = "sha256-G5YehePEMhTgxCnLp8Dg+bDHvOe+QltlCkQHVwMtYx0=";
     };
 
     build-system = [ python3Packages.setuptools ];

From 991ddfebd8539981f77c2567ac99b394935a2f4a Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Fri, 4 Apr 2025 16:11:25 +0200
Subject: [PATCH 098/146] nix-update: simplify expression

---
 pkgs/by-name/ni/nix-update/package.nix | 98 +++++++++++++-------------
 1 file changed, 48 insertions(+), 50 deletions(-)

diff --git a/pkgs/by-name/ni/nix-update/package.nix b/pkgs/by-name/ni/nix-update/package.nix
index fd0194e180f6..ce343a85db56 100644
--- a/pkgs/by-name/ni/nix-update/package.nix
+++ b/pkgs/by-name/ni/nix-update/package.nix
@@ -6,57 +6,55 @@
   nix-prefetch-git,
   nixpkgs-review,
   python3Packages,
+  nix-update,
 }:
 
-let
-  self = python3Packages.buildPythonApplication {
-    pname = "nix-update";
-    version = "1.11.0";
-    pyproject = true;
+python3Packages.buildPythonApplication rec {
+  pname = "nix-update";
+  version = "1.11.0";
+  pyproject = true;
 
-    src = fetchFromGitHub {
-      owner = "Mic92";
-      repo = "nix-update";
-      tag = self.version;
-      hash = "sha256-G5YehePEMhTgxCnLp8Dg+bDHvOe+QltlCkQHVwMtYx0=";
-    };
-
-    build-system = [ python3Packages.setuptools ];
-
-    makeWrapperArgs = [
-      "--prefix"
-      "PATH"
-      ":"
-      (lib.makeBinPath [
-        nix
-        nix-prefetch-git
-        nixpkgs-review
-      ])
-    ];
-
-    checkPhase = ''
-      runHook preCheck
-
-      $out/bin/nix-update --help >/dev/null
-
-      runHook postCheck
-    '';
-
-    passthru = {
-      nix-update-script = callPackage ./nix-update-script.nix { nix-update = self; };
-    };
-
-    meta = {
-      description = "Swiss-knife for updating nix packages";
-      homepage = "https://github.com/Mic92/nix-update/";
-      changelog = "https://github.com/Mic92/nix-update/releases/tag/${self.version}";
-      license = lib.licenses.mit;
-      maintainers = with lib.maintainers; [
-        figsoda
-        mic92
-      ];
-      mainProgram = "nix-update";
-    };
+  src = fetchFromGitHub {
+    owner = "Mic92";
+    repo = "nix-update";
+    tag = version;
+    hash = "sha256-G5YehePEMhTgxCnLp8Dg+bDHvOe+QltlCkQHVwMtYx0=";
   };
-in
-self
+
+  build-system = [ python3Packages.setuptools ];
+
+  makeWrapperArgs = [
+    "--prefix"
+    "PATH"
+    ":"
+    (lib.makeBinPath [
+      nix
+      nix-prefetch-git
+      nixpkgs-review
+    ])
+  ];
+
+  checkPhase = ''
+    runHook preCheck
+
+    $out/bin/nix-update --help >/dev/null
+
+    runHook postCheck
+  '';
+
+  passthru = {
+    nix-update-script = callPackage ./nix-update-script.nix { inherit nix-update; };
+  };
+
+  meta = {
+    description = "Swiss-knife for updating nix packages";
+    homepage = "https://github.com/Mic92/nix-update/";
+    changelog = "https://github.com/Mic92/nix-update/releases/tag/${version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [
+      figsoda
+      mic92
+    ];
+    mainProgram = "nix-update";
+  };
+}

From e6629c356440121a45d6c7d5b3effb1acda8b215 Mon Sep 17 00:00:00 2001
From: Artturin <Artturin@artturin.com>
Date: Fri, 4 Apr 2025 17:25:56 +0300
Subject: [PATCH 099/146] bluespec: Fix wrong executable name for `bsc`

and also use `makeBinaryWrapper` because it inherits argv0 better.
Wrapping `/bin/bsc` with `makeBinaryWrapper` didn't fix the scriptname
issue.

```
Error Bluespec executable not found: /nix/store/nhsa69in3vhyjx2hxnilzkqmb8j2m2mp-bluespec-2024.07/bin/core/.bsc-wrapped
```
---
 pkgs/by-name/bl/bluespec/package.nix | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/bl/bluespec/package.nix b/pkgs/by-name/bl/bluespec/package.nix
index 766bc20cfdaf..13ac23bcd26b 100644
--- a/pkgs/by-name/bl/bluespec/package.nix
+++ b/pkgs/by-name/bl/bluespec/package.nix
@@ -22,7 +22,7 @@
   asciidoctor,
   texliveFull,
   which,
-  makeWrapper,
+  makeBinaryWrapper,
   cctools,
   targetPackages,
   # install -m 644 lib/libstp.dylib /private/tmp/nix-build-bluespec-2024.07.drv-5/source/inst/lib/SAT
@@ -168,7 +168,7 @@ stdenv.mkDerivation rec {
       pkg-config
       texliveFull
       tcl
-      makeWrapper
+      makeBinaryWrapper
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       # https://github.com/B-Lang-org/bsc/blob/main/src/comp/bsc.hs#L1838
@@ -212,9 +212,12 @@ stdenv.mkDerivation rec {
 
   postFixup = ''
     # https://github.com/B-Lang-org/bsc/blob/65e3a87a17f6b9cf38cbb7b6ad7a4473f025c098/src/comp/bsc.hs#L1839
-    wrapProgram $out/bin/bsc --prefix PATH : ${
-      lib.makeBinPath (if stdenv.hostPlatform.isDarwin then [ cctools ] else [ targetPackages.stdenv.cc ])
-    }
+    # `/bin/bsc` is a bash script which the script name to call the binary in the `/bin/core` directory
+    # thus wrapping `/bin/bsc` messes up the scriptname detection in it.
+    wrapProgram $out/bin/core/bsc \
+      --prefix PATH : ${
+        lib.makeBinPath (if stdenv.hostPlatform.isDarwin then [ cctools ] else [ targetPackages.stdenv.cc ])
+      }
   '';
 
   doCheck = true;

From 366a24706ebccb15b1d7c4eaae528bddc3da2864 Mon Sep 17 00:00:00 2001
From: Artturin <Artturin@artturin.com>
Date: Fri, 4 Apr 2025 17:28:15 +0300
Subject: [PATCH 100/146] bluespec: Conditionalize `withDocs` deps

---
 pkgs/by-name/bl/bluespec/package.nix | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/bl/bluespec/package.nix b/pkgs/by-name/bl/bluespec/package.nix
index 13ac23bcd26b..3a7ca3d8d7be 100644
--- a/pkgs/by-name/bl/bluespec/package.nix
+++ b/pkgs/by-name/bl/bluespec/package.nix
@@ -160,16 +160,18 @@ stdenv.mkDerivation rec {
     [
       automake
       autoconf
-      asciidoctor
       bison
       flex
       ghcWithPackages
       perl
       pkg-config
-      texliveFull
       tcl
       makeBinaryWrapper
     ]
+    ++ lib.optionals withDocs [
+      texliveFull
+      asciidoctor
+    ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       # https://github.com/B-Lang-org/bsc/blob/main/src/comp/bsc.hs#L1838
       # /nix/store/7y0vlsf6l8lr3vjsbrirqrsbx4mwqiwf-cctools-binutils-darwin-1010.6/bin/strip: error: unknown argument '-u'

From c4500a94e4676ae4520af302430da88a84ad2169 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 4 Apr 2025 14:34:55 +0000
Subject: [PATCH 101/146] python312Packages.posthog: 3.18.1 -> 3.23.0

---
 pkgs/development/python-modules/posthog/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/posthog/default.nix b/pkgs/development/python-modules/posthog/default.nix
index 98496c26958f..d3ffd2b75a3c 100644
--- a/pkgs/development/python-modules/posthog/default.nix
+++ b/pkgs/development/python-modules/posthog/default.nix
@@ -19,14 +19,14 @@
 
 buildPythonPackage rec {
   pname = "posthog";
-  version = "3.18.1";
+  version = "3.23.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "PostHog";
     repo = "posthog-python";
     tag = "v${version}";
-    hash = "sha256-1jJACzDf8J4Vsrvtj0PgeK1Ck2Bzy5ThHm0Ohd+LyYs=";
+    hash = "sha256-+nmCmO1vPnNgZJdZSWwapeFfckNXEcdc/129yaLygf8=";
   };
 
   build-system = [ setuptools ];

From 4bbc09a1d0a044f2e894a4b42e5d5c485aefa36b Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 4 Apr 2025 14:41:15 +0000
Subject: [PATCH 102/146] beam26Packages.erlfmt: 1.6.0 -> 1.6.1

---
 pkgs/development/beam-modules/erlfmt/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/beam-modules/erlfmt/default.nix b/pkgs/development/beam-modules/erlfmt/default.nix
index 8a51cd792009..405aec021fc3 100644
--- a/pkgs/development/beam-modules/erlfmt/default.nix
+++ b/pkgs/development/beam-modules/erlfmt/default.nix
@@ -6,12 +6,12 @@
 
 rebar3Relx rec {
   pname = "erlfmt";
-  version = "1.6.0";
+  version = "1.6.1";
   releaseType = "escript";
   src = fetchFromGitHub {
     owner = "WhatsApp";
     repo = "erlfmt";
-    sha256 = "sha256-p4cdnKDY02XqdFOkijhOo527eZenfMF8J2dbuvH/hcY=";
+    sha256 = "sha256-O7+7dMgmnNd9hHuRcJqMAI0gmONz5EO3qSlUC3tufh0=";
     rev = "v${version}";
   };
   meta = with lib; {

From fd4d38d9315327da30f7a3cd81ad4fa3eeb0305d Mon Sep 17 00:00:00 2001
From: Artturin <Artturin@artturin.com>
Date: Fri, 4 Apr 2025 18:07:39 +0300
Subject: [PATCH 103/146] bluespec: Add a simple `installCheckPhase`

---
 pkgs/by-name/bl/bluespec/package.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/pkgs/by-name/bl/bluespec/package.nix b/pkgs/by-name/bl/bluespec/package.nix
index 3a7ca3d8d7be..5f9fd46c3aa0 100644
--- a/pkgs/by-name/bl/bluespec/package.nix
+++ b/pkgs/by-name/bl/bluespec/package.nix
@@ -223,6 +223,7 @@ stdenv.mkDerivation rec {
   '';
 
   doCheck = true;
+  doInstallCheck = true;
 
   # TODO To fix check-suite:
   # On darwin
@@ -281,6 +282,13 @@ stdenv.mkDerivation rec {
     )
   '';
 
+  installCheckPhase = ''
+    output="$($out/bin/bsc 2>&1 || true)"
+    echo "bsc output:"
+    echo "$output"
+    echo "$output" | grep -q "to get help"
+  '';
+
   meta = {
     description = "Toolchain for the Bluespec Hardware Definition Language";
     homepage = "https://github.com/B-Lang-org/bsc";

From f7f726bc891ed71c5cd9be7d46c4572697c31249 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 4 Apr 2025 15:08:34 +0000
Subject: [PATCH 104/146] all-the-package-names: 2.0.2117 -> 2.0.2128

---
 pkgs/by-name/al/all-the-package-names/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/al/all-the-package-names/package.nix b/pkgs/by-name/al/all-the-package-names/package.nix
index 2b578f86bb47..545cdc0548ed 100644
--- a/pkgs/by-name/al/all-the-package-names/package.nix
+++ b/pkgs/by-name/al/all-the-package-names/package.nix
@@ -7,16 +7,16 @@
 
 buildNpmPackage rec {
   pname = "all-the-package-names";
-  version = "2.0.2117";
+  version = "2.0.2128";
 
   src = fetchFromGitHub {
     owner = "nice-registry";
     repo = "all-the-package-names";
     tag = "v${version}";
-    hash = "sha256-jcExEGUtBMeKesdYVkkJSlJ59HhHZUAqhVvXkJVZp8g=";
+    hash = "sha256-x//g+TetH8wT6RP3W4f+exPOpiTBMTfEIJr2SgxyrmE=";
   };
 
-  npmDepsHash = "sha256-2SrPy3OybchYATCs0bmU1dZGBCKGhto1M1fPk68V/h8=";
+  npmDepsHash = "sha256-MUDeXJk+WqKGEuUlEqb3SUdh3P/gQMWgF78SboksJ2M=";
 
   passthru.updateScript = nix-update-script { };
 

From 7afa349ea8b05e500c37e72e5e70f15e35a242eb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Mon, 23 Dec 2024 04:43:33 +0100
Subject: [PATCH 105/146] nixos/paperless: mirror upstream admin user creation
 more closely

Closes #249767

Before we only created the admin user when passwordFile was set.
Now it is possible to set PAPERLESS_ADMIN_USER and
PAPERLESS_ADMIN_PASSWORD directly to create the admin user, like in the
upstream Docker image.
---
 nixos/modules/services/misc/paperless.nix | 20 +++++++++++---------
 1 file changed, 11 insertions(+), 9 deletions(-)

diff --git a/nixos/modules/services/misc/paperless.nix b/nixos/modules/services/misc/paperless.nix
index db703ce77883..c1f35526bd9b 100644
--- a/nixos/modules/services/misc/paperless.nix
+++ b/nixos/modules/services/misc/paperless.nix
@@ -421,8 +421,7 @@ in
           };
           environment = env;
 
-          preStart =
-            ''
+          preStart = ''
               # remove old papaerless-manage symlink
               # TODO: drop with NixOS 25.11
               [[ -L '${cfg.dataDir}/paperless-manage' ]] && rm '${cfg.dataDir}/paperless-manage'
@@ -448,13 +447,15 @@ in
                   ${cfg.package}/bin/paperless-ngx document_index reindex
                 fi
 
-                echo ${cfg.package.version} > "$versionFile"
-              fi
-            ''
-            + lib.optionalString (cfg.passwordFile != null) ''
+              echo ${cfg.package.version} > "$versionFile"
+            fi
+
+            if ${lib.boolToString (cfg.passwordFile != null)} || [[ -n $PAPERLESS_ADMIN_PASSWORD ]]; then
               export PAPERLESS_ADMIN_USER="''${PAPERLESS_ADMIN_USER:-admin}"
-              PAPERLESS_ADMIN_PASSWORD=$(cat "$CREDENTIALS_DIRECTORY/PAPERLESS_ADMIN_PASSWORD")
-              export PAPERLESS_ADMIN_PASSWORD
+              if [[ -e $CREDENTIALS_DIRECTORY/PAPERLESS_ADMIN_PASSWORD ]]; then
+                PAPERLESS_ADMIN_PASSWORD=$(cat "$CREDENTIALS_DIRECTORY/PAPERLESS_ADMIN_PASSWORD")
+                export PAPERLESS_ADMIN_PASSWORD
+              fi
               superuserState="$PAPERLESS_ADMIN_USER:$PAPERLESS_ADMIN_PASSWORD"
               superuserStateFile="${cfg.dataDir}/superuser-state"
 
@@ -462,7 +463,8 @@ in
                 ${cfg.package}/bin/paperless-ngx manage_superuser
                 echo "$superuserState" > "$superuserStateFile"
               fi
-            '';
+            fi
+          '';
           requires = lib.optional cfg.database.createLocally "postgresql.service";
           after =
             lib.optional enableRedis "redis-paperless.service"

From 895df12b3fcbc96ed756ad9577813344a1c87afb Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Fri, 4 Apr 2025 18:19:59 +0200
Subject: [PATCH 106/146] python312Packages.mypy-boto3-chime-sdk-voice: 1.37.0
 -> 1.37.27

---
 pkgs/development/python-modules/mypy-boto3/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/mypy-boto3/default.nix b/pkgs/development/python-modules/mypy-boto3/default.nix
index 5195b54bc1e5..a4541aee42f8 100644
--- a/pkgs/development/python-modules/mypy-boto3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3/default.nix
@@ -206,8 +206,8 @@ rec {
       "sha256-c7p/kch9H2Skn48ue8emfMkt5+mTmLZWEeuAuAhvX0w=";
 
   mypy-boto3-chime-sdk-voice =
-    buildMypyBoto3Package "chime-sdk-voice" "1.37.0"
-      "sha256-FINgDMmIhMn5M/qVGE3rzZJZEU121rDXNQYa39veAYk=";
+    buildMypyBoto3Package "chime-sdk-voice" "1.37.27"
+      "sha256-j7HoSHz0ZBmVBruvlMNFfYMgGrYYvKSPVy/NoGXsE70=";
 
   mypy-boto3-cleanrooms =
     buildMypyBoto3Package "cleanrooms" "1.37.25"

From 40bd63a475c362475ef10d4ff3a3dcce4d166fe8 Mon Sep 17 00:00:00 2001
From: Qiming Chu <cchuqiming@gmail.com>
Date: Fri, 4 Apr 2025 23:39:58 +0800
Subject: [PATCH 107/146] home-assistant: pin jellyfin-apiclient-python to
 version 1.10.0

Signed-off-by: Qiming Chu <cchuqiming@gmail.com>
---
 pkgs/servers/home-assistant/default.nix | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index 78eff4e2231f..1a25a9bf1007 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -151,6 +151,18 @@ let
         ];
       });
 
+      # Pinned due to home-assistant still needing 1.10.0 verison
+      # Remove this when home-assistant upates the jellyfin-apiclient-python version
+      jellyfin-apiclient-python = super.jellyfin-apiclient-python.overridePythonAttrs (oldAttrs: rec {
+        version = "1.10.0";
+        src = fetchFromGitHub {
+          owner = "jellyfin";
+          repo = "jellyfin-apiclient-python";
+          tag = "v${version}";
+          hash = "sha256-H1FqypNuVIZ17cFdNDEmmKICswxJkUGq2LhlingbCVk=";
+        };
+      });
+
       # acme and thus hass-nabucasa doesn't support josepy v2
       # https://github.com/certbot/certbot/issues/10185
       josepy = super.josepy.overridePythonAttrs (old: rec {

From ff43a052bc34d339405a7d08d033eb0c7168b967 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Fri, 4 Apr 2025 18:20:45 +0200
Subject: [PATCH 108/146] python312Packages.mypy-boto3-opensearch: 1.37.0 ->
 1.37.27

---
 pkgs/development/python-modules/mypy-boto3/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/mypy-boto3/default.nix b/pkgs/development/python-modules/mypy-boto3/default.nix
index a4541aee42f8..49ea86bfbb56 100644
--- a/pkgs/development/python-modules/mypy-boto3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3/default.nix
@@ -970,8 +970,8 @@ rec {
       "sha256-L+XFhueTb9fq32oyVVbysBMXgds1UlXryqRwiDOI+Io=";
 
   mypy-boto3-opensearch =
-    buildMypyBoto3Package "opensearch" "1.37.0"
-      "sha256-i+EBCV4AIOaSam0MYrtnqD+BPvr5CraDzOownJ18VmI=";
+    buildMypyBoto3Package "opensearch" "1.37.27"
+      "sha256-I6WTuWXwC7c8LcRUTKn2VRNntm5DYmxnT8NEjha0LGA=";
 
   mypy-boto3-opensearchserverless =
     buildMypyBoto3Package "opensearchserverless" "1.37.0"

From 81ee1f148c22de39cb0c9b47e38d47fcdf9a1ade Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Fri, 4 Apr 2025 18:20:55 +0200
Subject: [PATCH 109/146] python312Packages.mypy-boto3-route53: 1.37.15 ->
 1.37.27

---
 pkgs/development/python-modules/mypy-boto3/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/mypy-boto3/default.nix b/pkgs/development/python-modules/mypy-boto3/default.nix
index 49ea86bfbb56..ecfb97eb817e 100644
--- a/pkgs/development/python-modules/mypy-boto3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3/default.nix
@@ -1134,8 +1134,8 @@ rec {
       "sha256-axaTu4XmHGc3a/Uzs1/0IqLJdZFBfEQ9pzi42XW11y0=";
 
   mypy-boto3-route53 =
-    buildMypyBoto3Package "route53" "1.37.15"
-      "sha256-sXSxaqe0kqx1ZCinJKI67ekBZW81RwoC1fSEDrlCDc4=";
+    buildMypyBoto3Package "route53" "1.37.27"
+      "sha256-9K+1O7X5Ey2xED7rFT5Qfv8XGAxzGYIdf2SGqb95KqE=";
 
   mypy-boto3-route53-recovery-cluster =
     buildMypyBoto3Package "route53-recovery-cluster" "1.37.0"

From 8266265f6960c54101c73ada862afba988883385 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Fri, 4 Apr 2025 18:20:58 +0200
Subject: [PATCH 110/146] python312Packages.mypy-boto3-sagemaker: 1.37.25 ->
 1.37.27

---
 pkgs/development/python-modules/mypy-boto3/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/mypy-boto3/default.nix b/pkgs/development/python-modules/mypy-boto3/default.nix
index ecfb97eb817e..3fd6545374cc 100644
--- a/pkgs/development/python-modules/mypy-boto3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3/default.nix
@@ -1174,8 +1174,8 @@ rec {
       "sha256-c0vXkW5sR7JkdzvsS/rMFme9EwY1x5eZAbRWYKew0v4=";
 
   mypy-boto3-sagemaker =
-    buildMypyBoto3Package "sagemaker" "1.37.25"
-      "sha256-HDTInC3myzlGgbJ/mSUmcSdoUuRxC0RP/D1BicDy0P8=";
+    buildMypyBoto3Package "sagemaker" "1.37.27"
+      "sha256-DgY+LFW6PzwYsFbJ7Fjs4fzlWe45ZEAa2zo1is87a8Y=";
 
   mypy-boto3-sagemaker-a2i-runtime =
     buildMypyBoto3Package "sagemaker-a2i-runtime" "1.37.0"

From efa192cc9b97f60919e7ae50d459be98ec15c050 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Fri, 4 Apr 2025 18:21:03 +0200
Subject: [PATCH 111/146] python312Packages.mypy-boto3-sesv2: 1.37.24 ->
 1.37.27

---
 pkgs/development/python-modules/mypy-boto3/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/mypy-boto3/default.nix b/pkgs/development/python-modules/mypy-boto3/default.nix
index 3fd6545374cc..ca0f359deae8 100644
--- a/pkgs/development/python-modules/mypy-boto3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3/default.nix
@@ -1254,8 +1254,8 @@ rec {
       "sha256-hD2HVQKPSoNJ/t8VVOkaz+kVV3bF9DXLvYh6vG15GvM=";
 
   mypy-boto3-sesv2 =
-    buildMypyBoto3Package "sesv2" "1.37.24"
-      "sha256-g0RNkpXVarw0EbB04cby6HLjCuyPwWEeN9pjI3/jL2U=";
+    buildMypyBoto3Package "sesv2" "1.37.27"
+      "sha256-rJ0eb2xRnLf0LO1DW7L955QcCBdE3LtWjsvDUN+HFi8=";
 
   mypy-boto3-shield =
     buildMypyBoto3Package "shield" "1.37.0"

From a38c7fd8bef26c21973a84bceb844dc9e7f7a85e Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Fri, 4 Apr 2025 18:21:11 +0200
Subject: [PATCH 112/146] python312Packages.mypy-boto3-transcribe: 1.37.5 ->
 1.37.27

---
 pkgs/development/python-modules/mypy-boto3/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/mypy-boto3/default.nix b/pkgs/development/python-modules/mypy-boto3/default.nix
index ca0f359deae8..5e6e21d41b90 100644
--- a/pkgs/development/python-modules/mypy-boto3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3/default.nix
@@ -1366,8 +1366,8 @@ rec {
       "sha256-mGqJUJF826MADOYCDXwPNbk+x82zumHRb+cTazCEzAY=";
 
   mypy-boto3-transcribe =
-    buildMypyBoto3Package "transcribe" "1.37.5"
-      "sha256-UonLSCWk8CUYjVBkxwbwxnR+NdQnsFTx11dZXIesDv0=";
+    buildMypyBoto3Package "transcribe" "1.37.27"
+      "sha256-UW0b40n+M8za5guDPxhU5cRvtbkqzX6G7M2UaxNq5ws=";
 
   mypy-boto3-transfer =
     buildMypyBoto3Package "transfer" "1.37.24"

From b0871fb1ed4ef24ebeeb4e3016ce202a770ee1f4 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Fri, 4 Apr 2025 18:21:18 +0200
Subject: [PATCH 113/146] python313Packages.botocore-stubs: 1.37.26 -> 1.37.27

---
 pkgs/development/python-modules/botocore-stubs/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/botocore-stubs/default.nix b/pkgs/development/python-modules/botocore-stubs/default.nix
index eb51061c0cb5..3dec178205d4 100644
--- a/pkgs/development/python-modules/botocore-stubs/default.nix
+++ b/pkgs/development/python-modules/botocore-stubs/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "botocore-stubs";
-  version = "1.37.26";
+  version = "1.37.27";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "botocore_stubs";
     inherit version;
-    hash = "sha256-EwXFEbYgeQgh36bosFKAXELob5jnwBe/isZQKuYqU1U=";
+    hash = "sha256-ezb+79/Sp0VwQNQ0MiJa3ws0xGMk9dECkbNPoVWHsSM=";
   };
 
   nativeBuildInputs = [ setuptools ];

From edb3bdd29947dd590fdba9aa4abd26d4fa00a955 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Fri, 4 Apr 2025 18:21:22 +0200
Subject: [PATCH 114/146] python313Packages.boto3-stubs: 1.37.26 -> 1.37.27

---
 pkgs/development/python-modules/boto3-stubs/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/boto3-stubs/default.nix b/pkgs/development/python-modules/boto3-stubs/default.nix
index 8e533813fbe1..bd67e851476d 100644
--- a/pkgs/development/python-modules/boto3-stubs/default.nix
+++ b/pkgs/development/python-modules/boto3-stubs/default.nix
@@ -359,7 +359,7 @@
 
 buildPythonPackage rec {
   pname = "boto3-stubs";
-  version = "1.37.26";
+  version = "1.37.27";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -367,7 +367,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "boto3_stubs";
     inherit version;
-    hash = "sha256-GdIYvWcTsvcxbIauQAg6xVSL7RmFA8YM+YhqTQGJZeI=";
+    hash = "sha256-qzErE4igpVsgwKCnm+etOUux6ueK4TofCe8aE0Mwf3E=";
   };
 
   build-system = [ setuptools ];

From fdcba6e9d5358959436f4ced8c362d5f96533a5c Mon Sep 17 00:00:00 2001
From: Victor Rodriguez <awtgerry@gmail.com>
Date: Fri, 4 Apr 2025 10:57:33 -0600
Subject: [PATCH 115/146] ytui-music: replace youtube-dl with yt-dlp

---
 pkgs/by-name/yt/ytui-music/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/yt/ytui-music/package.nix b/pkgs/by-name/yt/ytui-music/package.nix
index 8bc1d7e5334f..53ca6814919d 100644
--- a/pkgs/by-name/yt/ytui-music/package.nix
+++ b/pkgs/by-name/yt/ytui-music/package.nix
@@ -8,7 +8,7 @@
   stdenv,
   darwin,
   mpv,
-  youtube-dl,
+  yt-dlp,
   makeBinaryWrapper,
 }:
 
@@ -49,7 +49,7 @@ rustPlatform.buildRustPackage rec {
 
   postInstall = ''
     wrapProgram $out/bin/ytui_music \
-      --prefix PATH : ${lib.makeBinPath [ youtube-dl ]}
+      --prefix PATH : ${lib.makeBinPath [ yt-dlp ]}
   '';
 
   doInstallCheck = true;

From 249b8edca06f58cd5ac3a16950bb6d6c724f35ca Mon Sep 17 00:00:00 2001
From: Mirza Arnaut <mirza.arnaut45@gmail.com>
Date: Fri, 4 Apr 2025 18:58:21 +0200
Subject: [PATCH 116/146] copilot-language-server: add fhs version (#393260)

---
 .../co/copilot-language-server/package.nix    | 29 +++++++++++++++----
 pkgs/top-level/all-packages.nix               |  2 ++
 2 files changed, 26 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/co/copilot-language-server/package.nix b/pkgs/by-name/co/copilot-language-server/package.nix
index c0d97ed5723a..f03224ab18f4 100644
--- a/pkgs/by-name/co/copilot-language-server/package.nix
+++ b/pkgs/by-name/co/copilot-language-server/package.nix
@@ -1,6 +1,7 @@
 {
   lib,
   stdenvNoCC,
+  buildFHSEnv,
   fetchzip,
   nix-update-script,
 }:
@@ -24,8 +25,24 @@ let
     }
     ."${stdenvNoCC.hostPlatform.system}"
       or (throw "Unsupported system: ${stdenvNoCC.hostPlatform.system}");
-in
 
+  executableName = "copilot-language-server";
+  fhs =
+    { package }:
+    buildFHSEnv {
+      name = package.meta.mainProgram;
+      version = package.version;
+      targetPkgs = pkgs: [ pkgs.stdenv.cc.cc.lib ];
+      runScript = lib.getExe package;
+
+      meta = package.meta // {
+        description =
+          package.meta.description
+          + " (FHS-wrapped, expand package details for further information when to use it)";
+        longDescription = "Use this version if you encounter an error like `Could not start dynamically linked executable` or `SyntaxError: Invalid or unexpected token` (see nixpkgs issue [391730](https://github.com/NixOS/nixpkgs/issues/391730)).";
+      };
+    };
+in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "copilot-language-server";
   version = "1.294.0";
@@ -36,18 +53,20 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     stripRoot = false;
   };
 
-  npmDepsHash = "sha256-PLX/mN7xu8gMh2BkkyTncP3+rJ3nBmX+pHxl0ONXbe4=";
   installPhase = ''
     runHook preInstall
 
-    install -Dt "$out"/bin "${os}-${arch}"/copilot-language-server
+    install "${os}-${arch}/${executableName}" -Dm755 -t "$out"/bin
 
     runHook postInstall
   '';
 
   dontStrip = true;
 
-  passthru.updateScript = nix-update-script { };
+  passthru = {
+    updateScript = nix-update-script { };
+    fhs = fhs { package = finalAttrs.finalPackage; };
+  };
 
   meta = {
     description = "Use GitHub Copilot with any editor or IDE via the Language Server Protocol";
@@ -60,7 +79,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
       shortName = "GitHub Copilot License";
       url = "https://github.com/customer-terms/github-copilot-product-specific-terms";
     };
-    mainProgram = "copilot-language-server";
+    mainProgram = executableName;
     platforms = [
       "x86_64-linux"
       "aarch64-linux"
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 11a44028da68..e7687e393439 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -359,6 +359,8 @@ with pkgs;
 
   coolercontrol = recurseIntoAttrs (callPackage ../applications/system/coolercontrol { });
 
+  copilot-language-server-fhs = copilot-language-server.fhs;
+
   curv = callPackage ../by-name/cu/curv/package.nix {
     openexr = openexr_3;
   };

From 4822953468408717d9e2bdbda559038c7767c611 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 4 Apr 2025 10:00:05 -0700
Subject: [PATCH 117/146] python313Packages.libpass: init at 1.9.0

---
 .../python-modules/libpass/default.nix        | 60 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 +
 2 files changed, 62 insertions(+)
 create mode 100644 pkgs/development/python-modules/libpass/default.nix

diff --git a/pkgs/development/python-modules/libpass/default.nix b/pkgs/development/python-modules/libpass/default.nix
new file mode 100644
index 000000000000..552635219bd7
--- /dev/null
+++ b/pkgs/development/python-modules/libpass/default.nix
@@ -0,0 +1,60 @@
+{
+  argon2-cffi,
+  bcrypt,
+  buildPythonPackage,
+  cryptography,
+  fetchFromGitHub,
+  hatchling,
+  lib,
+  pytest-archon,
+  pytest-xdist,
+  pytestCheckHook,
+  typing-extensions,
+}:
+
+buildPythonPackage rec {
+  pname = "libpass";
+  version = "1.9.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "ThirVondukr";
+    repo = "passlib";
+    tag = version;
+    hash = "sha256-Q5OEQkty0/DugRvF5LA+PaDDlF/6ysx4Nel5K2kH5s4=";
+  };
+
+  build-system = [ hatchling ];
+
+  dependencies = [
+    typing-extensions
+  ];
+
+  optional-dependencies = {
+    argon2 = [ argon2-cffi ];
+    bcrypt = [ bcrypt ];
+    totp = [ cryptography ];
+  };
+
+  nativeCheckInputs = [
+    pytest-archon
+    pytest-xdist
+    pytestCheckHook
+  ] ++ lib.flatten (lib.attrValues optional-dependencies);
+
+  pythonImportsCheck = [ "passlib" ];
+
+  disabledTests = [
+    # timming sensitive
+    "test_dummy_verify"
+    "test_encrypt_cost_timing"
+  ];
+
+  meta = {
+    changelog = "https://github.com/ThirVondukr/passlib/blob/${src.tag}/CHANGELOG.md";
+    description = "Comprehensive password hashing framework supporting over 30 schemes";
+    homepage = "https://github.com/ThirVondukr/passlib";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ dotlambda ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 0759a9bdd1e0..344f93c65830 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -7718,6 +7718,8 @@ self: super: with self; {
     }
   );
 
+  libpass = callPackage ../development/python-modules/libpass { };
+
   libpcap = callPackage ../development/python-modules/libpcap {
     pkgsLibpcap = pkgs.libpcap; # Needs the C library
   };

From 917afc5683bc86e7a6e63c3adda2cef68904b307 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 4 Apr 2025 08:39:01 -0700
Subject: [PATCH 118/146] python313Packages.passlib: turn into wrapper around
 libpass

---
 .../python-modules/passlib/default.nix        | 58 +++----------------
 1 file changed, 7 insertions(+), 51 deletions(-)

diff --git a/pkgs/development/python-modules/passlib/default.nix b/pkgs/development/python-modules/passlib/default.nix
index a82f16db5f26..a835196935f8 100644
--- a/pkgs/development/python-modules/passlib/default.nix
+++ b/pkgs/development/python-modules/passlib/default.nix
@@ -1,58 +1,14 @@
 {
-  lib,
-  buildPythonPackage,
-  fetchFromGitHub,
-  argon2-cffi,
-  bcrypt,
-  cryptography,
-  hatchling,
-  pytestCheckHook,
-  pytest-archon,
-  pytest-xdist,
-  typing-extensions,
+  libpass,
+  mkPythonMetaPackage,
 }:
 
-buildPythonPackage rec {
+mkPythonMetaPackage {
   pname = "passlib";
-  version = "1.9.0";
-  pyproject = true;
-
-  src = fetchFromGitHub {
-    owner = "ThirVondukr";
-    repo = "passlib";
-    tag = version;
-    hash = "sha256-Q5OEQkty0/DugRvF5LA+PaDDlF/6ysx4Nel5K2kH5s4=";
-  };
-
-  build-system = [ hatchling ];
-
-  dependencies = [ typing-extensions ];
-
-  optional-dependencies = {
-    argon2 = [ argon2-cffi ];
-    bcrypt = [ bcrypt ];
-    totp = [ cryptography ];
-  };
-
-  nativeCheckInputs = [
-    pytestCheckHook
-    pytest-archon
-    pytest-xdist
-  ] ++ lib.flatten (lib.attrValues optional-dependencies);
-
-  pythonImportsCheck = [ "passlib" ];
-
-  disabledTests = [
-    # timming sensitive
-    "test_dummy_verify"
-    "test_encrypt_cost_timing"
-  ];
-
+  inherit (libpass) version;
+  dependencies = [ libpass ];
+  optional-dependencies = libpass.optional-dependencies or { };
   meta = {
-    changelog = "https://github.com/ThirVondukr/passlib/blob/${src.tag}/CHANGELOG.md";
-    description = "Password hashing library for Python";
-    homepage = "https://github.com/ThirVondukr/passlib";
-    license = lib.licenses.bsd3;
-    maintainers = with lib.maintainers; [ dotlambda ];
+    inherit (libpass.meta) changelog description homepage;
   };
 }

From ff5687c783bd98543c581314228e477e1b7bd1fe Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 4 Apr 2025 08:39:45 -0700
Subject: [PATCH 119/146] Revert "python313Packages.bundlewrap: drop passlib
 constraint"

This reverts commit a97b72577880b9658ed83dc5da5595582a9ed7a7.
---
 pkgs/development/python-modules/bundlewrap/default.nix | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/pkgs/development/python-modules/bundlewrap/default.nix b/pkgs/development/python-modules/bundlewrap/default.nix
index 05efac3ed97c..98d07040218b 100644
--- a/pkgs/development/python-modules/bundlewrap/default.nix
+++ b/pkgs/development/python-modules/bundlewrap/default.nix
@@ -31,12 +31,6 @@ buildPythonPackage rec {
   };
 
   build-system = [ setuptools ];
-
-  pythonRemoveDeps = [
-    # distinfo renamed to libpass, but still imports as passlib
-    "passlib"
-  ];
-
   dependencies = [
     setuptools
     cryptography

From fa3bc563c86d85aabcac79a149958623e34953ee Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 4 Apr 2025 08:42:33 -0700
Subject: [PATCH 120/146] python313Packages.mitmproxy: relax h2 version
 constraint

---
 pkgs/development/python-modules/mitmproxy/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/python-modules/mitmproxy/default.nix b/pkgs/development/python-modules/mitmproxy/default.nix
index 0b24d3e1a41b..cc2a56ea2544 100644
--- a/pkgs/development/python-modules/mitmproxy/default.nix
+++ b/pkgs/development/python-modules/mitmproxy/default.nix
@@ -51,6 +51,7 @@ buildPythonPackage rec {
   };
 
   pythonRelaxDeps = [
+    "h2"
     "passlib"
     "protobuf"
     "pyparsing"

From 8924a056516219d7100ac0f76bd6a79857271e0c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 4 Apr 2025 09:27:29 -0700
Subject: [PATCH 121/146] Revert "mailman: remove passlib constraint"

This reverts commit 0c1b9474d86bbca1fad0ce7288115b6547aaaf9e.
---
 pkgs/servers/mail/mailman/package.nix | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/pkgs/servers/mail/mailman/package.nix b/pkgs/servers/mail/mailman/package.nix
index 6e0df870b378..cb5dc354cf74 100644
--- a/pkgs/servers/mail/mailman/package.nix
+++ b/pkgs/servers/mail/mailman/package.nix
@@ -26,11 +26,6 @@ buildPythonPackage rec {
     setuptools
   ];
 
-  pythonRemoveDeps = [
-    # distinfo renamed to libpass
-    "passlib"
-  ];
-
   dependencies = with python3.pkgs; [
     aiosmtpd
     alembic

From 20d81559e36235edd3324a4455baa9c59e98b62f Mon Sep 17 00:00:00 2001
From: Chris Moultrie <821688+tebriel@users.noreply.github.com>
Date: Fri, 4 Apr 2025 10:55:58 -0400
Subject: [PATCH 122/146] rssguard: move package to by-name scheme

---
 .../rssguard/default.nix => by-name/rs/rssguard/package.nix}    | 0
 pkgs/top-level/all-packages.nix                                 | 2 --
 2 files changed, 2 deletions(-)
 rename pkgs/{applications/networking/feedreaders/rssguard/default.nix => by-name/rs/rssguard/package.nix} (100%)

diff --git a/pkgs/applications/networking/feedreaders/rssguard/default.nix b/pkgs/by-name/rs/rssguard/package.nix
similarity index 100%
rename from pkgs/applications/networking/feedreaders/rssguard/default.nix
rename to pkgs/by-name/rs/rssguard/package.nix
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 11a44028da68..d5ab629e7342 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -15592,8 +15592,6 @@ with pkgs;
   roxctl = callPackage ../applications/networking/cluster/roxctl {
   };
 
-  rssguard = libsForQt5.callPackage ../applications/networking/feedreaders/rssguard { };
-
   scx = recurseIntoAttrs (callPackage ../os-specific/linux/scx { });
 
   shogun = callPackage ../applications/science/machine-learning/shogun {

From a44e3553f776154baba862e12c22e64c7303d2d7 Mon Sep 17 00:00:00 2001
From: Thibault Gagnaux <thibault.gagnaux@bit.admin.ch>
Date: Fri, 4 Apr 2025 17:19:52 +0200
Subject: [PATCH 123/146] bashunit: init at 0.19.0

Co-authored-by: emaryn <197520219+emaryn@users.noreply.github.com>
---
 pkgs/by-name/ba/bashunit/package.nix | 78 ++++++++++++++++++++++++++++
 1 file changed, 78 insertions(+)
 create mode 100644 pkgs/by-name/ba/bashunit/package.nix

diff --git a/pkgs/by-name/ba/bashunit/package.nix b/pkgs/by-name/ba/bashunit/package.nix
new file mode 100644
index 000000000000..d458858dfdd0
--- /dev/null
+++ b/pkgs/by-name/ba/bashunit/package.nix
@@ -0,0 +1,78 @@
+{
+  stdenvNoCC,
+  lib,
+  fetchFromGitHub,
+  bash,
+  which,
+  versionCheckHook,
+  coreutils,
+  makeBinaryWrapper,
+  nix-update-script,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "bashunit";
+  version = "0.19.0";
+  src = fetchFromGitHub {
+    owner = "TypedDevs";
+    repo = "bashunit";
+    tag = finalAttrs.version;
+    hash = "sha256-EoCCqESzmCW12AuAqA3qh2VcE8gyUPIGJEoCcZhMA/Y=";
+    forceFetchGit = true; # needed to include the tests directory for the check phase
+  };
+
+  nativeBuildInputs = [ makeBinaryWrapper ];
+
+  postConfigure = ''
+    patchShebangs src tests build.sh bashunit
+    substituteInPlace Makefile \
+      --replace-fail "SHELL=/bin/bash" "SHELL=${lib.getExe bash}"
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+    ./build.sh
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    install -m755 -D bin/bashunit $out/bin/bashunit
+    runHook postInstall
+  '';
+
+  # some tests are currently broken on linux and it is not easy to disable them
+  # reenable them after https://github.com/TypedDevs/bashunit/pull/397 has been merged
+  doCheck = false;
+  nativeCheckInputs = [ which ];
+  checkPhase = ''
+    runHook preCheck
+    make test
+    runHook postCheck
+  '';
+
+  postFixup = ''
+    wrapProgram $out/bin/bashunit \
+      --prefix PATH : "${
+        lib.makeBinPath [
+          coreutils
+          which
+        ]
+      }"
+  '';
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+  versionCheckProgramArg = "--version";
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Simple testing framework for bash scripts";
+    homepage = "https://bashunit.typeddevs.com";
+    changelog = "https://github.com/TypedDevs/bashunit/releases/tag/${finalAttrs.version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ tricktron ];
+    mainProgram = "bashunit";
+  };
+})

From e6ee7d8b116d3e0ebe8bcc9cb93bad88f39e2e86 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 4 Apr 2025 18:41:57 +0000
Subject: [PATCH 124/146] vscode-extensions.ms-python.isort: 2023.13.13171013
 -> 2025.0.0

---
 .../editors/vscode/extensions/ms-python.isort/default.nix     | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/editors/vscode/extensions/ms-python.isort/default.nix b/pkgs/applications/editors/vscode/extensions/ms-python.isort/default.nix
index 06b7c1dceab7..599216b831ea 100644
--- a/pkgs/applications/editors/vscode/extensions/ms-python.isort/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/ms-python.isort/default.nix
@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     publisher = "ms-python";
     name = "isort";
-    version = "2023.13.13171013";
-    hash = "sha256-UBV9i3LPVv60+toy+kJvESAuJHRmH/uEIwjTidYUXLc=";
+    version = "2025.0.0";
+    hash = "sha256-nwt9Pv084jt9nWvxSXLIWu7981UGSbCgVRTrFfJA6q4=";
   };
   meta = with lib; {
     description = "Import sorting extension for Visual Studio Code using isort";

From d395872e2b8904e8061f1e7d675a4f76c9f20463 Mon Sep 17 00:00:00 2001
From: Tanya <tanyaarora1866@gmail.com>
Date: Sat, 5 Apr 2025 00:12:36 +0530
Subject: [PATCH 125/146] fangfrisch 1.9.0 -> 1.9.2

---
 pkgs/by-name/fa/fangfrisch/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/fa/fangfrisch/package.nix b/pkgs/by-name/fa/fangfrisch/package.nix
index 529b57f48f16..48e1726c7518 100644
--- a/pkgs/by-name/fa/fangfrisch/package.nix
+++ b/pkgs/by-name/fa/fangfrisch/package.nix
@@ -4,7 +4,7 @@
   fetchFromGitHub,
 }:
 let
-  version = "1.9.0";
+  version = "1.9.2";
 in
 python3.pkgs.buildPythonApplication {
   pname = "fangfrisch";
@@ -15,7 +15,7 @@ python3.pkgs.buildPythonApplication {
     owner = "rseichter";
     repo = "fangfrisch";
     tag = version;
-    hash = "sha256-B2fVXVYzrtWMh/WjgFBOqrq8Jt+jqudbtpY/w4rJG08=";
+    hash = "sha256-8upIh9Z+ismvuKcuEe+gJ4W9NLw/Wq15zjFpy8X9yVo=";
   };
 
   nativeBuildInputs = [

From 1ae8dc30ed63051529618f5c055eb8f64f81923d Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 4 Apr 2025 18:42:47 +0000
Subject: [PATCH 126/146] vscode-extensions.mongodb.mongodb-vscode: 1.12.1 ->
 1.13.0

---
 .../vscode/extensions/mongodb.mongodb-vscode/default.nix      | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/editors/vscode/extensions/mongodb.mongodb-vscode/default.nix b/pkgs/applications/editors/vscode/extensions/mongodb.mongodb-vscode/default.nix
index 531be9bba85e..4d5cbbc44878 100644
--- a/pkgs/applications/editors/vscode/extensions/mongodb.mongodb-vscode/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/mongodb.mongodb-vscode/default.nix
@@ -4,8 +4,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "mongodb-vscode";
     publisher = "mongodb";
-    version = "1.12.1";
-    hash = "sha256-jbR6NGYgDYArCHqMHKPXuht7UViw0Ii3Uc8IqTGTe8k=";
+    version = "1.13.0";
+    hash = "sha256-xOwffd2//P7wS+uuUmuIU0ITOH1pj35h53F1HhvGNMo=";
   };
 
   meta = {

From 43023159f699aa8e9787d78300030eeadf04be76 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 4 Apr 2025 18:46:27 +0000
Subject: [PATCH 127/146] trdl-client: 0.8.7 -> 0.9.0

---
 pkgs/by-name/tr/trdl-client/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/tr/trdl-client/package.nix b/pkgs/by-name/tr/trdl-client/package.nix
index 121c792fbc58..b0ba4f81af4e 100644
--- a/pkgs/by-name/tr/trdl-client/package.nix
+++ b/pkgs/by-name/tr/trdl-client/package.nix
@@ -8,18 +8,18 @@
 
 buildGoModule rec {
   pname = "trdl-client";
-  version = "0.8.7";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner = "werf";
     repo = "trdl";
     rev = "v${version}";
-    hash = "sha256-4RN2vrTP4horjDvuuFJbQhToL/4boIuaG+efoTbmebI=";
+    hash = "sha256-f7gyGGClMk/5+FCivuLasiIG/Ty17yeJ8qQ/GVEbC14=";
   };
 
   sourceRoot = "${src.name}/client";
 
-  vendorHash = "sha256-f7FPeR+us3WvwqzcSQLbkKv905CCIAAm+HNV2FFF8OY=";
+  vendorHash = "sha256-veSgWyk1ytHRNHuuZJBV+1rqGDsdEb01CImm+EexFCk=";
 
   subPackages = [ "cmd/trdl" ];
 

From 0d2a3fe1b3f910322e283ab3a56932712d4dc64c Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 4 Apr 2025 18:49:07 +0000
Subject: [PATCH 128/146] svd2rust: 0.36.0 -> 0.36.1

---
 pkgs/by-name/sv/svd2rust/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/sv/svd2rust/package.nix b/pkgs/by-name/sv/svd2rust/package.nix
index 1dd1dda5dbd7..62d524001654 100644
--- a/pkgs/by-name/sv/svd2rust/package.nix
+++ b/pkgs/by-name/sv/svd2rust/package.nix
@@ -6,15 +6,15 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "svd2rust";
-  version = "0.36.0";
+  version = "0.36.1";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-HdE4XWAM1e25kRwryMzGqo2sUpzgwk2aiWsi+qXZ7bU=";
+    hash = "sha256-+wVcUpSlJsd6GAZgBor7eAu6IYnlfJwzZDYKqUKpa9M=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-JiGTGdrudmDCNmJOtHgIBwTVCLB3m4RCqxlypa2KdDQ=";
+  cargoHash = "sha256-rZusngSIwdDfNe7tIA2WtIzzje6UBxyz/hfeRLqJHUY=";
 
   # error: linker `aarch64-linux-gnu-gcc` not found
   postPatch = ''

From 92d438cec90b6fab400335306ab38b72780a76f5 Mon Sep 17 00:00:00 2001
From: Piotr Kwiecinski <2151333+piotrkwiecinski@users.noreply.github.com>
Date: Fri, 4 Apr 2025 20:49:57 +0200
Subject: [PATCH 129/146] nixosTests.moodle: migrate to runTest

Part of #386873
---
 nixos/tests/all-tests.nix |  2 +-
 nixos/tests/moodle.nix    | 44 +++++++++++++++++++--------------------
 2 files changed, 22 insertions(+), 24 deletions(-)

diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 132bd5d64d22..dda3a6df7667 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -795,7 +795,7 @@ in
       defaults.services.mongodb.package = config.node.pkgs.mongodb-ce;
     }
   );
-  moodle = handleTest ./moodle.nix { };
+  moodle = runTest ./moodle.nix;
   moonraker = handleTest ./moonraker.nix { };
   mopidy = handleTest ./mopidy.nix { };
   morph-browser = runTest ./morph-browser.nix;
diff --git a/nixos/tests/moodle.nix b/nixos/tests/moodle.nix
index 4bf1c5e6c702..f3eee04b0d62 100644
--- a/nixos/tests/moodle.nix
+++ b/nixos/tests/moodle.nix
@@ -1,26 +1,24 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "moodle";
-    meta.maintainers = [ lib.maintainers.aanderse ];
+{ lib, ... }:
+{
+  name = "moodle";
+  meta.maintainers = [ lib.maintainers.aanderse ];
 
-    nodes.machine =
-      { ... }:
-      {
-        services.moodle.enable = true;
-        services.moodle.virtualHost.hostName = "localhost";
-        services.moodle.virtualHost.adminAddr = "root@example.com";
-        services.moodle.initialPassword = "correcthorsebatterystaple";
+  nodes.machine =
+    { ... }:
+    {
+      services.moodle.enable = true;
+      services.moodle.virtualHost.hostName = "localhost";
+      services.moodle.virtualHost.adminAddr = "root@example.com";
+      services.moodle.initialPassword = "correcthorsebatterystaple";
 
-        # Ensure the virtual machine has enough memory to avoid errors like:
-        # Fatal error: Out of memory (allocated 152047616) (tried to allocate 33554440 bytes)
-        virtualisation.memorySize = 2000;
-      };
+      # Ensure the virtual machine has enough memory to avoid errors like:
+      # Fatal error: Out of memory (allocated 152047616) (tried to allocate 33554440 bytes)
+      virtualisation.memorySize = 2000;
+    };
 
-    testScript = ''
-      start_all()
-      machine.wait_for_unit("phpfpm-moodle.service", timeout=1800)
-      machine.wait_until_succeeds("curl http://localhost/ | grep 'You are not logged in'")
-    '';
-  }
-)
+  testScript = ''
+    start_all()
+    machine.wait_for_unit("phpfpm-moodle.service", timeout=1800)
+    machine.wait_until_succeeds("curl http://localhost/ | grep 'You are not logged in'")
+  '';
+}

From 10de31a04d457bcc78663d3fa2891cd4ea189718 Mon Sep 17 00:00:00 2001
From: Piotr Kwiecinski <2151333+piotrkwiecinski@users.noreply.github.com>
Date: Fri, 4 Apr 2025 20:57:18 +0200
Subject: [PATCH 130/146] nixosTests.bind: migrate to runTest

Part of #386873
---
 nixos/tests/all-tests.nix | 2 +-
 nixos/tests/bind.nix      | 3 ++-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 132bd5d64d22..e7046842e22a 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -243,7 +243,7 @@ in
     imports = [ ./binary-cache.nix ];
     _module.args.compression = "xz";
   };
-  bind = handleTest ./bind.nix { };
+  bind = runTest ./bind.nix;
   bird = handleTest ./bird.nix { };
   birdwatcher = handleTest ./birdwatcher.nix { };
   bitbox-bridge = runTest ./bitbox-bridge.nix;
diff --git a/nixos/tests/bind.nix b/nixos/tests/bind.nix
index 5eb75392a382..3b2edec9d19e 100644
--- a/nixos/tests/bind.nix
+++ b/nixos/tests/bind.nix
@@ -1,4 +1,5 @@
-import ./make-test-python.nix {
+{ ... }:
+{
   name = "bind";
 
   nodes.machine =

From a832ea381b38bd4c717966b40ecda595ec8958fb Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Fri, 4 Apr 2025 21:57:57 +0300
Subject: [PATCH 131/146] rustc: fix fastCross

1.86 changed the naming scheme of the stamp files.
---
 pkgs/development/compilers/rust/rustc.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/compilers/rust/rustc.nix b/pkgs/development/compilers/rust/rustc.nix
index ffaa711e7cd2..d7a0e3d97873 100644
--- a/pkgs/development/compilers/rust/rustc.nix
+++ b/pkgs/development/compilers/rust/rustc.nix
@@ -243,8 +243,8 @@ stdenv.mkDerivation (finalAttrs: {
         ln -s ${rustc.unwrapped}/lib/rustlib/${stdenv.hostPlatform.rust.rustcTargetSpec}/libstd-*.so build/${stdenv.hostPlatform.rust.rustcTargetSpec}/stage0-std/${stdenv.hostPlatform.rust.rustcTargetSpec}/release/libstd.so
         ln -s ${rustc.unwrapped}/lib/rustlib/${stdenv.hostPlatform.rust.rustcTargetSpec}/librustc_driver-*.so build/${stdenv.hostPlatform.rust.rustcTargetSpec}/stage0-rustc/${stdenv.hostPlatform.rust.rustcTargetSpec}/release/librustc.so
         ln -s ${rustc.unwrapped}/bin/rustc build/${stdenv.hostPlatform.rust.rustcTargetSpec}/stage0-rustc/${stdenv.hostPlatform.rust.rustcTargetSpec}/release/rustc-main
-        touch build/${stdenv.hostPlatform.rust.rustcTargetSpec}/stage0-std/${stdenv.hostPlatform.rust.rustcTargetSpec}/release/.libstd.stamp
-        touch build/${stdenv.hostPlatform.rust.rustcTargetSpec}/stage0-rustc/${stdenv.hostPlatform.rust.rustcTargetSpec}/release/.librustc.stamp
+        touch build/${stdenv.hostPlatform.rust.rustcTargetSpec}/stage0-std/${stdenv.hostPlatform.rust.rustcTargetSpec}/release/.libstd-stamp
+        touch build/${stdenv.hostPlatform.rust.rustcTargetSpec}/stage0-rustc/${stdenv.hostPlatform.rust.rustcTargetSpec}/release/.librustc-stamp
         python ./x.py --keep-stage=0 --stage=1 build library
 
         runHook postBuild

From 5b5017d5cef8b5ccfc3d9c7760b03fe7c05f4da5 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 4 Apr 2025 14:15:50 +0000
Subject: [PATCH 132/146] lighttpd: 1.4.78 -> 1.4.79

---
 pkgs/by-name/li/lighttpd/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/lighttpd/package.nix b/pkgs/by-name/li/lighttpd/package.nix
index 5abe45061795..edfd21231602 100644
--- a/pkgs/by-name/li/lighttpd/package.nix
+++ b/pkgs/by-name/li/lighttpd/package.nix
@@ -34,11 +34,11 @@
 
 stdenv.mkDerivation rec {
   pname = "lighttpd";
-  version = "1.4.78";
+  version = "1.4.79";
 
   src = fetchurl {
     url = "https://download.lighttpd.net/lighttpd/releases-${lib.versions.majorMinor version}.x/${pname}-${version}.tar.xz";
-    sha256 = "sha256-PAc56Lx1yen8HPqJ4cME3UsOSruHrcZGodILxqLbKj4=";
+    sha256 = "sha256-OymmJbOtiHAtH+pPX0K7fYdIjy5O/Jd9fxhTKcpghL0=";
   };
 
   separateDebugInfo = true;

From 8504b83df5cb799c49088529be63a64446dccd72 Mon Sep 17 00:00:00 2001
From: Sarah Clark <seclark@nextquestion.net>
Date: Fri, 4 Apr 2025 12:00:19 -0700
Subject: [PATCH 133/146] python312Packages.langgraph: rm
 langgraph-checkpoint-duckdb

---
 pkgs/development/python-modules/langgraph/default.nix | 2 --
 1 file changed, 2 deletions(-)

diff --git a/pkgs/development/python-modules/langgraph/default.nix b/pkgs/development/python-modules/langgraph/default.nix
index f99b92d1de14..855d854f3d8c 100644
--- a/pkgs/development/python-modules/langgraph/default.nix
+++ b/pkgs/development/python-modules/langgraph/default.nix
@@ -17,7 +17,6 @@
   dataclasses-json,
   grandalf,
   httpx,
-  langgraph-checkpoint-duckdb,
   langgraph-checkpoint-postgres,
   langgraph-checkpoint-sqlite,
   langsmith,
@@ -142,7 +141,6 @@ buildPythonPackage rec {
     dataclasses-json
     grandalf
     httpx
-    langgraph-checkpoint-duckdb
     langgraph-checkpoint-postgres
     langgraph-checkpoint-sqlite
     langsmith

From 33f2784b7c7feb227c67b2d90b7de312a60b7b57 Mon Sep 17 00:00:00 2001
From: Piotr Kwiecinski <2151333+piotrkwiecinski@users.noreply.github.com>
Date: Fri, 4 Apr 2025 21:08:27 +0200
Subject: [PATCH 134/146] nixosTests.cgit: migrate to runTest

Part of #386873
---
 nixos/tests/all-tests.nix |   2 +-
 nixos/tests/cgit.nix      | 192 +++++++++++++++++++-------------------
 2 files changed, 96 insertions(+), 98 deletions(-)

diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 132bd5d64d22..b9e35151dec5 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -294,7 +294,7 @@ in
   ] ./ceph-single-node-bluestore-dmcrypt.nix { };
   certmgr = handleTest ./certmgr.nix { };
   cfssl = handleTestOn [ "aarch64-linux" "x86_64-linux" ] ./cfssl.nix { };
-  cgit = handleTest ./cgit.nix { };
+  cgit = runTest ./cgit.nix;
   charliecloud = handleTest ./charliecloud.nix { };
   chromadb = runTest ./chromadb.nix;
   chromium = (handleTestOn [ "aarch64-linux" "x86_64-linux" ] ./chromium.nix { }).stable or { };
diff --git a/nixos/tests/cgit.nix b/nixos/tests/cgit.nix
index fce3dc16b854..2c48e6bde47d 100644
--- a/nixos/tests/cgit.nix
+++ b/nixos/tests/cgit.nix
@@ -1,113 +1,111 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  let
-    robotsTxt = pkgs.writeText "cgit-robots.txt" ''
-      User-agent: *
-      Disallow: /
-    '';
-  in
-  {
-    name = "cgit";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ schnusch ];
-    };
+{ pkgs, ... }:
+let
+  robotsTxt = pkgs.writeText "cgit-robots.txt" ''
+    User-agent: *
+    Disallow: /
+  '';
+in
+{
+  name = "cgit";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ schnusch ];
+  };
 
-    nodes = {
-      server =
-        { ... }:
-        {
-          services.cgit."localhost" = {
-            enable = true;
-            package = pkgs.cgit.overrideAttrs (
-              { postInstall, ... }:
-              {
-                postInstall = ''
-                  ${postInstall}
-                  cp ${robotsTxt} "$out/cgit/robots.txt"
-                '';
-              }
-            );
-            nginx.location = "/(c)git/";
-            repos = {
-              some-repo = {
-                path = "/tmp/git/some-repo";
-                desc = "some-repo description";
-              };
-            };
-            settings = {
-              readme = [
-                ":README.md"
-                ":date.txt"
-              ];
+  nodes = {
+    server =
+      { ... }:
+      {
+        services.cgit."localhost" = {
+          enable = true;
+          package = pkgs.cgit.overrideAttrs (
+            { postInstall, ... }:
+            {
+              postInstall = ''
+                ${postInstall}
+                cp ${robotsTxt} "$out/cgit/robots.txt"
+              '';
+            }
+          );
+          nginx.location = "/(c)git/";
+          repos = {
+            some-repo = {
+              path = "/tmp/git/some-repo";
+              desc = "some-repo description";
             };
           };
-
-          environment.systemPackages = [ pkgs.git ];
+          settings = {
+            readme = [
+              ":README.md"
+              ":date.txt"
+            ];
+          };
         };
-    };
 
-    testScript =
-      { nodes, ... }:
-      ''
-        start_all()
+        environment.systemPackages = [ pkgs.git ];
+      };
+  };
 
-        server.wait_for_unit("nginx.service")
-        server.wait_for_unit("network.target")
-        server.wait_for_open_port(80)
+  testScript =
+    { nodes, ... }:
+    ''
+      start_all()
 
-        server.succeed("curl -fsS http://localhost/%28c%29git/cgit.css")
+      server.wait_for_unit("nginx.service")
+      server.wait_for_unit("network.target")
+      server.wait_for_open_port(80)
 
-        server.succeed("curl -fsS http://localhost/%28c%29git/robots.txt | diff -u - ${robotsTxt}")
+      server.succeed("curl -fsS http://localhost/%28c%29git/cgit.css")
 
-        server.succeed(
-            "curl -fsS http://localhost/%28c%29git/ | grep -F 'some-repo description'"
-        )
+      server.succeed("curl -fsS http://localhost/%28c%29git/robots.txt | diff -u - ${robotsTxt}")
 
-        server.fail("curl -fsS http://localhost/robots.txt")
+      server.succeed(
+          "curl -fsS http://localhost/%28c%29git/ | grep -F 'some-repo description'"
+      )
 
-        server.succeed("sudo -u cgit ${pkgs.writeShellScript "setup-cgit-test-repo" ''
-          set -e
-          git init --bare -b master /tmp/git/some-repo
-          git init -b master reference
-          cd reference
-          git remote add origin /tmp/git/some-repo
-          { echo -n "cgit NixOS Test at "; date; } > date.txt
-          git add date.txt
-          git -c user.name=test -c user.email=test@localhost commit -m 'add date'
-          git push -u origin master
-        ''}")
+      server.fail("curl -fsS http://localhost/robots.txt")
 
-        # test web download
-        server.succeed(
-            "curl -fsS 'http://localhost/%28c%29git/some-repo/plain/date.txt?id=master' | diff -u reference/date.txt -"
-        )
+      server.succeed("sudo -u cgit ${pkgs.writeShellScript "setup-cgit-test-repo" ''
+        set -e
+        git init --bare -b master /tmp/git/some-repo
+        git init -b master reference
+        cd reference
+        git remote add origin /tmp/git/some-repo
+        { echo -n "cgit NixOS Test at "; date; } > date.txt
+        git add date.txt
+        git -c user.name=test -c user.email=test@localhost commit -m 'add date'
+        git push -u origin master
+      ''}")
 
-        # test http clone
-        server.succeed(
-           "git clone http://localhost/%28c%29git/some-repo && diff -u reference/date.txt some-repo/date.txt"
-        )
+      # test web download
+      server.succeed(
+          "curl -fsS 'http://localhost/%28c%29git/some-repo/plain/date.txt?id=master' | diff -u reference/date.txt -"
+      )
 
-        # test list settings by greping for the fallback readme
-        server.succeed(
-            "curl -fsS 'http://localhost/%28c%29git/some-repo/about/' | grep -F 'cgit NixOS Test at'"
-        )
+      # test http clone
+      server.succeed(
+         "git clone http://localhost/%28c%29git/some-repo && diff -u reference/date.txt some-repo/date.txt"
+      )
 
-        # add real readme
-        server.succeed("sudo -u cgit ${pkgs.writeShellScript "cgit-commit-readme" ''
-          set -e
-          echo '# cgit NixOS test README' > reference/README.md
-          git -C reference add README.md
-          git -C reference -c user.name=test -c user.email=test@localhost commit -m 'add readme'
-          git -C reference push
-        ''}")
+      # test list settings by greping for the fallback readme
+      server.succeed(
+          "curl -fsS 'http://localhost/%28c%29git/some-repo/about/' | grep -F 'cgit NixOS Test at'"
+      )
 
-        # test list settings by greping for the real readme
-        server.succeed(
-            "curl -fsS 'http://localhost/%28c%29git/some-repo/about/' | grep -F '# cgit NixOS test README'"
-        )
-        server.fail(
-            "curl -fsS 'http://localhost/%28c%29git/some-repo/about/' | grep -F 'cgit NixOS Test at'"
-        )
-      '';
-  }
-)
+      # add real readme
+      server.succeed("sudo -u cgit ${pkgs.writeShellScript "cgit-commit-readme" ''
+        set -e
+        echo '# cgit NixOS test README' > reference/README.md
+        git -C reference add README.md
+        git -C reference -c user.name=test -c user.email=test@localhost commit -m 'add readme'
+        git -C reference push
+      ''}")
+
+      # test list settings by greping for the real readme
+      server.succeed(
+          "curl -fsS 'http://localhost/%28c%29git/some-repo/about/' | grep -F '# cgit NixOS test README'"
+      )
+      server.fail(
+          "curl -fsS 'http://localhost/%28c%29git/some-repo/about/' | grep -F 'cgit NixOS Test at'"
+      )
+    '';
+}

From 8717786cc3f3cf2721e7860e11a5a9f826553a60 Mon Sep 17 00:00:00 2001
From: Peder Bergebakken Sundt <pbsds@hotmail.com>
Date: Fri, 4 Apr 2025 21:11:12 +0200
Subject: [PATCH 135/146] vale: 3.11.0 -> 3.11.1

Diff: https://github.com/errata-ai/vale/compare/v3.11.0...v3.11.1

Changelog: https://github.com/errata-ai/vale/releases/tag/v3.11.1
---
 pkgs/by-name/va/vale/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/va/vale/package.nix b/pkgs/by-name/va/vale/package.nix
index b75fe852fb43..33bf556a4031 100644
--- a/pkgs/by-name/va/vale/package.nix
+++ b/pkgs/by-name/va/vale/package.nix
@@ -11,7 +11,7 @@
 
 buildGoModule rec {
   pname = "vale";
-  version = "3.11.0";
+  version = "3.11.1";
 
   subPackages = [ "cmd/vale" ];
 
@@ -19,7 +19,7 @@ buildGoModule rec {
     owner = "errata-ai";
     repo = "vale";
     rev = "v${version}";
-    hash = "sha256-NJ8QmF2ZGlbkHhc0OQSVl11pQDHO88KL/MLr+8ABLYs=";
+    hash = "sha256-UPbeml7W90ICmbDjvNIy+DmolAAYF6Tci4R/kZa5cr8=";
   };
 
   vendorHash = "sha256-Zhhp/qbwGTQEZ28S+p7GJodwQcnkFNqNU7WCZKdeoz0=";

From 492cc1d81eff6673aae527493e7d6da35f20e81d Mon Sep 17 00:00:00 2001
From: Elis Hirwing <elis@hirwing.se>
Date: Sat, 30 Nov 2024 12:42:02 +0100
Subject: [PATCH 136/146] opencascade-occt: Build with rapidjson to enable glTF
 export in FreeCAD

This is to enable glTF export support in FreeCAD. FreeCAD depends on
the JSON support in OpenCascade to be able to export to
glTF (https://forum.freecad.org/viewtopic.php?t=63440).

And it turns out that OpenCascade doesn't default to having this
enabled by default:
https://dev.opencascade.org/content/building-linux-rapidjson
---
 pkgs/by-name/op/opencascade-occt/package.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/by-name/op/opencascade-occt/package.nix b/pkgs/by-name/op/opencascade-occt/package.nix
index 85ee2f4d1683..293eac8660b2 100644
--- a/pkgs/by-name/op/opencascade-occt/package.nix
+++ b/pkgs/by-name/op/opencascade-occt/package.nix
@@ -5,6 +5,7 @@
   fetchpatch,
   cmake,
   ninja,
+  rapidjson,
   tcl,
   tk,
   libGL,
@@ -48,9 +49,11 @@ stdenv.mkDerivation rec {
     libXext
     libXmu
     libXi
+    rapidjson
   ] ++ lib.optional stdenv.hostPlatform.isDarwin darwin.apple_sdk.frameworks.Cocoa;
 
   NIX_CFLAGS_COMPILE = [ "-fpermissive" ];
+  cmakeFlags = [ "-DUSE_RAPIDJSON=ON" ];
 
   meta = with lib; {
     description = "Open CASCADE Technology, libraries for 3D modeling and numerical simulation";

From 8fbb437033d8c44c2075b340bc2af9aa35453170 Mon Sep 17 00:00:00 2001
From: Piotr Kwiecinski <2151333+piotrkwiecinski@users.noreply.github.com>
Date: Fri, 4 Apr 2025 21:16:05 +0200
Subject: [PATCH 137/146] nixosTests.homepage-dashboard: migrate to runTest

Part of #386873
---
 nixos/tests/all-tests.nix          |  2 +-
 nixos/tests/homepage-dashboard.nix | 44 ++++++++++++++----------------
 2 files changed, 22 insertions(+), 24 deletions(-)

diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 132bd5d64d22..cb41b17e77a4 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -584,7 +584,7 @@ in
   herbstluftwm = handleTest ./herbstluftwm.nix { };
   homebox = handleTest ./homebox.nix { };
   homer = handleTest ./homer { };
-  homepage-dashboard = handleTest ./homepage-dashboard.nix { };
+  homepage-dashboard = runTest ./homepage-dashboard.nix;
   honk = runTest ./honk.nix;
   installed-tests = pkgs.recurseIntoAttrs (handleTest ./installed-tests { });
   invidious = handleTest ./invidious.nix { };
diff --git a/nixos/tests/homepage-dashboard.nix b/nixos/tests/homepage-dashboard.nix
index ed70ead01820..d654dcaf53df 100644
--- a/nixos/tests/homepage-dashboard.nix
+++ b/nixos/tests/homepage-dashboard.nix
@@ -1,28 +1,26 @@
-import ./make-test-python.nix (
-  { lib, ... }:
-  {
-    name = "homepage-dashboard";
-    meta.maintainers = with lib.maintainers; [ jnsgruk ];
+{ lib, ... }:
+{
+  name = "homepage-dashboard";
+  meta.maintainers = with lib.maintainers; [ jnsgruk ];
 
-    nodes.machine = _: {
-      services.homepage-dashboard = {
-        enable = true;
-        settings.title = "test title rodUsEagid"; # something random/unique
-      };
+  nodes.machine = _: {
+    services.homepage-dashboard = {
+      enable = true;
+      settings.title = "test title rodUsEagid"; # something random/unique
     };
+  };
 
-    testScript = ''
-      # Ensure the services are started on managed machine
-      machine.wait_for_unit("homepage-dashboard.service")
-      machine.wait_for_open_port(8082)
-      machine.succeed("curl --fail http://localhost:8082/")
+  testScript = ''
+    # Ensure the services are started on managed machine
+    machine.wait_for_unit("homepage-dashboard.service")
+    machine.wait_for_open_port(8082)
+    machine.succeed("curl --fail http://localhost:8082/")
 
-      # Ensure /etc/homepage-dashboard is created.
-      machine.succeed("test -d /etc/homepage-dashboard")
+    # Ensure /etc/homepage-dashboard is created.
+    machine.succeed("test -d /etc/homepage-dashboard")
 
-      # Ensure that we see the custom title *only in the managed config*
-      page = machine.succeed("curl --fail http://localhost:8082/")
-      assert "test title rodUsEagid" in page, "Custom title not found"
-    '';
-  }
-)
+    # Ensure that we see the custom title *only in the managed config*
+    page = machine.succeed("curl --fail http://localhost:8082/")
+    assert "test title rodUsEagid" in page, "Custom title not found"
+  '';
+}

From 5f62a3f0a711c81264fc09d27a4d19555105cc25 Mon Sep 17 00:00:00 2001
From: Sarah Clark <seclark@nextquestion.net>
Date: Fri, 4 Apr 2025 11:31:37 -0700
Subject: [PATCH 138/146] python312Packages.langgraph-checkpoint-duckdb:
 removed

---
 .../langgraph-checkpoint-duckdb/default.nix   | 64 -------------------
 pkgs/top-level/python-aliases.nix             |  1 +
 pkgs/top-level/python-packages.nix            |  4 --
 3 files changed, 1 insertion(+), 68 deletions(-)
 delete mode 100644 pkgs/development/python-modules/langgraph-checkpoint-duckdb/default.nix

diff --git a/pkgs/development/python-modules/langgraph-checkpoint-duckdb/default.nix b/pkgs/development/python-modules/langgraph-checkpoint-duckdb/default.nix
deleted file mode 100644
index a0ca4c328599..000000000000
--- a/pkgs/development/python-modules/langgraph-checkpoint-duckdb/default.nix
+++ /dev/null
@@ -1,64 +0,0 @@
-{
-  lib,
-  buildPythonPackage,
-  fetchFromGitHub,
-  langgraph-checkpoint,
-  aiosqlite,
-  duckdb,
-  pytest-asyncio,
-  pytestCheckHook,
-  langgraph-sdk,
-  poetry-core,
-}:
-
-buildPythonPackage rec {
-  pname = "langgraph-checkpoint-duckdb";
-  version = "2.0.2";
-  pyproject = true;
-
-  src = fetchFromGitHub {
-    owner = "langchain-ai";
-    repo = "langgraph";
-    tag = "checkpointduckdb==${version}";
-    hash = "sha256-ppgViNRkkCTOGPfdB04DOnEzFgHN1KGDLLVjuwhRgNE=";
-  };
-
-  sourceRoot = "${src.name}/libs/checkpoint-duckdb";
-
-  build-system = [ poetry-core ];
-
-  dependencies = [
-    aiosqlite
-    duckdb
-    langgraph-checkpoint
-  ];
-
-  # Checkpoint clients are lagging behind langgraph-checkpoint
-  pythonRelaxDeps = [ "langgraph-checkpoint" ];
-
-  pythonImportsCheck = [ "langgraph.checkpoint.duckdb" ];
-
-  nativeCheckInputs = [
-    pytest-asyncio
-    pytestCheckHook
-  ];
-
-  disabledTests = [ "test_basic_store_ops" ]; # depends on networking
-
-  passthru = {
-    inherit (langgraph-sdk) updateScript;
-
-    skipBulkUpdate = true; # Broken, see https://github.com/NixOS/nixpkgs/issues/379898
-  };
-
-  meta = {
-    changelog = "https://github.com/langchain-ai/langgraph/releases/tag/checkpointduckdb==${version}";
-    description = "Library with a DuckDB implementation of LangGraph checkpoint saver";
-    homepage = "https://github.com/langchain-ai/langgraph/tree/main/libs/checkpoint-duckdb";
-    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [
-      drupol
-      sarahec
-    ];
-  };
-}
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index 478748b31ff4..75fbb300afc2 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -349,6 +349,7 @@ mapAliases ({
   lammps-cython = throw "lammps-cython no longer builds and is unmaintained"; # added 2021-07-04
   langchain-standard-tests = langchain-tests; # added 2025-01-22
   langchainplus-sdk = langsmith; # added 2023-08-01
+  langgraph-checkpoint-duckdb = throw "langgraph-checkpoint-duckdb has been removed as of langgraph 0.2.63"; # added 2025-04-04
   lazr_config = lazr-config; # added 2023-11-03
   lazr_delegates = lazr-delegates; # added 2023-11-03
   lazy_import = lazy-import; # added 2024-01-07
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 7270fd25d512..1356cb3ff171 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -7450,10 +7450,6 @@ self: super: with self; {
 
   langgraph-checkpoint = callPackage ../development/python-modules/langgraph-checkpoint { };
 
-  langgraph-checkpoint-duckdb =
-    callPackage ../development/python-modules/langgraph-checkpoint-duckdb
-      { };
-
   langgraph-checkpoint-postgres =
     callPackage ../development/python-modules/langgraph-checkpoint-postgres
       { };

From c4ccaa61681b8685f805794a82f2eb321b571f72 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Thu, 3 Apr 2025 22:26:17 +0100
Subject: [PATCH 139/146] love_0_10: add missing xorg.libX11 depend

SDL2 intentionally dropped xorg.libX11 propagated build depend.
This broke `love_0_10` as:

    In file included from modules/window/sdl/Window.cpp:43:
    /nix/store/nhq38i6s7zyhaa4l9csp5d1f1hyfzdqa-sdl2-compat-2.32.52-dev/include/SDL2/SDL_syswm.h:68:10: fatal error: X11/Xlib.h: No such file or directory
       68 | #include <X11/Xlib.h>

Let's add the dependency to `love_0_10` instead.
---
 pkgs/development/interpreters/love/0.10.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/interpreters/love/0.10.nix b/pkgs/development/interpreters/love/0.10.nix
index 2120ac516a3f..dcb84a90da22 100644
--- a/pkgs/development/interpreters/love/0.10.nix
+++ b/pkgs/development/interpreters/love/0.10.nix
@@ -20,6 +20,7 @@
   autoconf,
   automake,
   libtool,
+  xorg,
 }:
 
 stdenv.mkDerivation rec {
@@ -40,6 +41,7 @@ stdenv.mkDerivation rec {
   ];
   buildInputs = [
     SDL2
+    xorg.libX11 # SDl2 optional depend, for SDL_syswm.h
     libGLU
     libGL
     openal

From e2e5759330fc247b93d6fc627f5b74863a345d8d Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Fri, 4 Apr 2025 22:20:48 +0200
Subject: [PATCH 140/146] zigbee2mqtt_2: 2.2.0 -> 2.2.1

https://github.com/Koenkk/zigbee2mqtt/releases/tag/2.2.1
---
 pkgs/by-name/zi/zigbee2mqtt_2/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/zi/zigbee2mqtt_2/package.nix b/pkgs/by-name/zi/zigbee2mqtt_2/package.nix
index b52d9615b64a..795565e78913 100644
--- a/pkgs/by-name/zi/zigbee2mqtt_2/package.nix
+++ b/pkgs/by-name/zi/zigbee2mqtt_2/package.nix
@@ -16,18 +16,18 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "zigbee2mqtt";
-  version = "2.2.0";
+  version = "2.2.1";
 
   src = fetchFromGitHub {
     owner = "Koenkk";
     repo = "zigbee2mqtt";
     tag = finalAttrs.version;
-    hash = "sha256-Tkfly1icG/T/szkziXABtG0tvvgq/evJ3qN7ShYtdAM=";
+    hash = "sha256-hct761D92PqgiXUtclk/X2ifySSSta7dgDQEibqPBaM=";
   };
 
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-uFFLXEByK9fpMQone7hodrQyAtRBc5Tk3u+Jtq0MkyA=";
+    hash = "sha256-0ophLiyTbdYEZcm4nO63OCRxENr5X2CXepHkfy1+QJM=";
   };
 
   nativeBuildInputs = [

From 338792101e893ac2b92e2671bed35d7f3e9a009b Mon Sep 17 00:00:00 2001
From: emilylange <git@emilylange.de>
Date: Fri, 4 Apr 2025 22:46:48 +0200
Subject: [PATCH 141/146] ungoogled-chromium: 134.0.6998.165-1 ->
 135.0.7049.52-1

https://chromereleases.googleblog.com/2025/04/stable-channel-update-for-desktop.html

This update includes 14 security fixes.

CVEs:
CVE-2025-3066 CVE-2025-3067 CVE-2025-3068 CVE-2025-3069 CVE-2025-3070
CVE-2025-3071 CVE-2025-3072 CVE-2025-3073 CVE-2025-3074
---
 .../networking/browsers/chromium/info.json    | 288 +++++++++---------
 1 file changed, 144 insertions(+), 144 deletions(-)

diff --git a/pkgs/applications/networking/browsers/chromium/info.json b/pkgs/applications/networking/browsers/chromium/info.json
index b687e910b4b7..29f084a35e29 100644
--- a/pkgs/applications/networking/browsers/chromium/info.json
+++ b/pkgs/applications/networking/browsers/chromium/info.json
@@ -787,27 +787,27 @@
     }
   },
   "ungoogled-chromium": {
-    "version": "134.0.6998.165",
+    "version": "135.0.7049.52",
     "deps": {
       "depot_tools": {
-        "rev": "e42fac3e9c1726ab14a61a25e6291d9ccc49e688",
-        "hash": "sha256-BvEkk15Rm4nSoV/uWiwmQW/+gg2vpLQ187TbBAHl9Rk="
+        "rev": "85ec2718b5a29990c7eb67778348c9f76a00f392",
+        "hash": "sha256-eWlHnSRfLFcd3OoyCTIFewDf0eC9KQowScQOnphgfg8="
       },
       "gn": {
-        "rev": "ed1abc107815210dc66ec439542bee2f6cbabc00",
-        "hash": "sha256-EqbwCLkseND1v3UqM+49N7GuoXJ3PlJjWOes4OijQ3U="
+        "rev": "4a8016dc391553fa1644c0740cc04eaac844121e",
+        "hash": "sha256-8NynNvLNCHxy8EYmsnPovKhXu9DcDcYBhg4A6d2QIfY="
       },
       "ungoogled-patches": {
-        "rev": "134.0.6998.165-1",
-        "hash": "sha256-Uia8tI3ZpryD+YVV9duH6sAmB/gKvsFg9RZVKYo/HX0="
+        "rev": "135.0.7049.52-1",
+        "hash": "sha256-i7fSJsbuXgzDvh/4RJwHvVEalS134SoRzvcJZbYsIIo="
       },
-      "npmHash": "sha256-oVoTruhxTymYiGkELd2Oa1wOfjGLtChQZozP4GzOO1A="
+      "npmHash": "sha256-wNrZaugdKJCyV1WchkKXzr/I1OW1AtjiC2p7qTZZOqU="
     },
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "fd886e2cb29dd984c13deec032832dee68d8abe3",
-        "hash": "sha256-xD06hGSrccTGB6fUGw0b7RrGNBQjNmdGKPaRqhXVVOY=",
+        "rev": "9ba7e609d28c509a8ce9265c2247065d8d251173",
+        "hash": "sha256-PjvfckdlaMq9HWefGxFppgBumlqh7xoCoxYFwk/r630=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {
@@ -817,23 +817,23 @@
       },
       "src/third_party/libc++/src": {
         "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxx.git",
-        "rev": "2e25154d49c29fa9aa42c30ad4a027bd30123434",
-        "hash": "sha256-QxEbtsEKCs2Xgulq7nVWtAeOGkIYFOy/L1ROfXa5u8U="
+        "rev": "7f8b68f91ca8b192375f5e71cd81fb3ed9650ef3",
+        "hash": "sha256-1P+p5MPXm0WkeYgzIxG2SBKZVPWplUlEo7xYI//Y0uw="
       },
       "src/third_party/libc++abi/src": {
         "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxxabi.git",
-        "rev": "634228a732a1d9ae1a6d459556e8fc58707cf961",
-        "hash": "sha256-ln/DCNYJXVksbwdDBnxCfc4VwtjQlJXF7ktl/NxLupg="
+        "rev": "94c5d7a8edc09f0680aee57548c0b5d400c2840d",
+        "hash": "sha256-wMMfj3E2AQJxovoSEIuT2uTyrcGBurS1HrHZOmP36+g="
       },
       "src/third_party/libunwind/src": {
         "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libunwind.git",
-        "rev": "e55d8cf51c6db1fdd4bb56c158945ec59772c8ee",
-        "hash": "sha256-JazjgI+ch9RgnsDgu6p4cT4UmCBor4x4sRi1ClLISAY="
+        "rev": "62e217a12ee1133833d9890b2f7adde900e4efbd",
+        "hash": "sha256-FBMrvCCVwm0mmaQHDvKXljxxLwthpsFqhPE8yqBx5Aw="
       },
       "src/third_party/llvm-libc/src": {
         "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libc.git",
-        "rev": "6d0c8ee02e2fd44e69ac30e721e13be463035ee5",
-        "hash": "sha256-bF4hV9fY0GLYAHUnxSXkCxdZLMKR3wYWaqYJaM9aQiE="
+        "rev": "a02de4d0d992b110c8b180fdec91258e7b60265f",
+        "hash": "sha256-LtxaimMmnman7BKLKpSR8rJtbEvHsmGVeHvzEukB4EY="
       },
       "src/chrome/test/data/perf/canvas_bench": {
         "url": "https://chromium.googlesource.com/chromium/canvas_bench.git",
@@ -852,8 +852,8 @@
       },
       "src/docs/website": {
         "url": "https://chromium.googlesource.com/website.git",
-        "rev": "600fc3a0b121d5007b4bb97b001e756625e6d418",
-        "hash": "sha256-f3Tdz0ykxQ2FHbNweJwPdAZHA8eVpjPuxqRpxwhYtRM="
+        "rev": "441c86221443f48e818335d51f84cf1880c35aa4",
+        "hash": "sha256-nMLn2wTAr+3U1VpqWWq93zJHrlT+f1Yky8ONKk0kWjg="
       },
       "src/media/cdm/api": {
         "url": "https://chromium.googlesource.com/chromium/cdm.git",
@@ -862,8 +862,8 @@
       },
       "src/net/third_party/quiche/src": {
         "url": "https://quiche.googlesource.com/quiche.git",
-        "rev": "e7d001c82ee5bead5140481671828d5e156a525a",
-        "hash": "sha256-5YFqWgkyQ/PUKTkk1j3mAFD8JMbI+E4XRdSq34HFMWA="
+        "rev": "25a56e315359eaebb2ff4213771016a4978a346d",
+        "hash": "sha256-ZkrAaNgCqG09CufQN35wFi09TVxvbf/U4jGNNMRLY0M="
       },
       "src/testing/libfuzzer/fuzzers/wasm_corpus": {
         "url": "https://chromium.googlesource.com/v8/fuzzer_wasm_corpus.git",
@@ -877,13 +877,13 @@
       },
       "src/third_party/angle": {
         "url": "https://chromium.googlesource.com/angle/angle.git",
-        "rev": "914c97c116e09ef01a99fbbbe9cd28cda56552c7",
-        "hash": "sha256-Y4eX8YHwVXiXW4U8KGbFd4fTU/v/EAUpfwv6lB127Y4="
+        "rev": "079266db445215380befce453b1ab3bbdfeaf73d",
+        "hash": "sha256-Bcm9wxlLqp/ANg+cPvsuwAlaxVmef6g+12L5ZE4uCGA="
       },
       "src/third_party/angle/third_party/glmark2/src": {
         "url": "https://chromium.googlesource.com/external/github.com/glmark2/glmark2",
-        "rev": "cb550a25c75a99ae0def91a02e16ae29d73e6d1e",
-        "hash": "sha256-kqBpWHCxUl1ekmrbdPn6cL2y75nK4FxECJ5mo83Zgf4="
+        "rev": "6edcf02205fd1e8979dc3f3964257a81959b80c8",
+        "hash": "sha256-VebUALLFKwEa4+oE+jF8mBSzhJd6aflphPmcK1Em8bw="
       },
       "src/third_party/angle/third_party/rapidjson/src": {
         "url": "https://chromium.googlesource.com/external/github.com/Tencent/rapidjson",
@@ -892,8 +892,8 @@
       },
       "src/third_party/angle/third_party/VK-GL-CTS/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/VK-GL-CTS",
-        "rev": "48e7f3020f52ef9adc31aa0f5db01dc42cc487cd",
-        "hash": "sha256-g59uC7feByGR1Ema8LqUCr5XWKpDMeXXvlS2thOo5Ks="
+        "rev": "ba86fb95004331f2cf571dd9adefe2458290ee11",
+        "hash": "sha256-wl/T/WxVNctM4m4VSFFqqtJ0xkEBiuILYywAylqa0Oo="
       },
       "src/third_party/anonymous_tokens/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/anonymous-tokens.git",
@@ -907,13 +907,13 @@
       },
       "src/third_party/dav1d/libdav1d": {
         "url": "https://chromium.googlesource.com/external/github.com/videolan/dav1d.git",
-        "rev": "42b2b24fb8819f1ed3643aa9cf2a62f03868e3aa",
-        "hash": "sha256-qcs9QoZ/uWEQ8l1ChZ8nYctZnnWJ0VvCw1q2rEktC9g="
+        "rev": "7d4b789f55389dad1820d6caf6a650038dad06e2",
+        "hash": "sha256-O6WOm6qTSgRmDR+yY2wH6t+7ob+TtZIA5Gax1ysEZh0="
       },
       "src/third_party/dawn": {
         "url": "https://dawn.googlesource.com/dawn.git",
-        "rev": "7056f50fdefc6bc46aa442e720d0336e2855b570",
-        "hash": "sha256-aYlcplXSGjFov9dqql6d+a1PxJWtZJNQaaezof0u9QQ="
+        "rev": "bdc68b25b620d7302a955e2c38c548ebfe74ef31",
+        "hash": "sha256-R9SQiKUjLkLmPJwuWpw7fcibrWxSlXWkDsCra7Ci0UQ="
       },
       "src/third_party/dawn/third_party/glfw": {
         "url": "https://chromium.googlesource.com/external/github.com/glfw/glfw",
@@ -922,8 +922,8 @@
       },
       "src/third_party/dawn/third_party/dxc": {
         "url": "https://chromium.googlesource.com/external/github.com/microsoft/DirectXShaderCompiler",
-        "rev": "c2ed9ad4ee775f3de903ce757c994aecc59a5306",
-        "hash": "sha256-jecGwARtdSr2OEC68749mpFUAHuYP/IzYUZyj23CwJE="
+        "rev": "0a1143572d107c8b6980df092b84a79190ec1fbd",
+        "hash": "sha256-sUSQTOi0EuIHX9h27RXb5HnbcdfkG/U1K6EbBdjSto8="
       },
       "src/third_party/dawn/third_party/dxheaders": {
         "url": "https://chromium.googlesource.com/external/github.com/microsoft/DirectX-Headers",
@@ -942,8 +942,8 @@
       },
       "src/third_party/dawn/third_party/webgpu-cts": {
         "url": "https://chromium.googlesource.com/external/github.com/gpuweb/cts",
-        "rev": "24d5dfa7725d6ece31941c3f3343ba6362986d6b",
-        "hash": "sha256-AEGYE2rSsPcRzJSm97DGsrPVbhCH+lyVI61Z4qavKc8="
+        "rev": "ce91fc1d085136f9c7ddca684d1764689d49b337",
+        "hash": "sha256-SsxohjLb+uoN5cMXU5DJDrtF1QVk8EWK/qvTLxCleUI="
       },
       "src/third_party/highway/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/highway.git",
@@ -957,8 +957,8 @@
       },
       "src/third_party/boringssl/src": {
         "url": "https://boringssl.googlesource.com/boringssl.git",
-        "rev": "ea42fe28775844ec8fe0444fc421398be42d51fe",
-        "hash": "sha256-g9i5v11uZy/3Smn8zSCFmC27Gdp5VP2b0ROrj+VmP1k="
+        "rev": "673e61fc215b178a90c0e67858bbf162c8158993",
+        "hash": "sha256-8Dl6Aol33o2FYID3oIw9grB0jY9VJnnnhmiNdyycTlU="
       },
       "src/third_party/breakpad/breakpad": {
         "url": "https://chromium.googlesource.com/breakpad/breakpad.git",
@@ -967,13 +967,13 @@
       },
       "src/third_party/cast_core/public/src": {
         "url": "https://chromium.googlesource.com/cast_core/public",
-        "rev": "fbc5e98031e1271a0a566fcd4d9092b2d3275d05",
-        "hash": "sha256-o5/Lbhh6HHSWCVCEyDwDCgs+PLm67si981w0HuIWY7c="
+        "rev": "dcb3d2e87cebe20b6dda06d8b29abb9af27ca422",
+        "hash": "sha256-e8+rQhEU5+FfwjyEE1TM6emO0cUntuS4GN7y/BuC/U8="
       },
       "src/third_party/catapult": {
         "url": "https://chromium.googlesource.com/catapult.git",
-        "rev": "d5166861902b565df446e15181eba270fe168275",
-        "hash": "sha256-xkvz743+w0xsI0w4reAo2rfC4J7opl1biA3eNYuRn+o="
+        "rev": "93e56257a5089dc49f1dfd1240c527f5fe1b237f",
+        "hash": "sha256-K5sOlXx72YmXlm7cc7jWf3lKmHcMdVHTwVueJo5CoHY="
       },
       "src/third_party/ced/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/compact_enc_det.git",
@@ -982,8 +982,8 @@
       },
       "src/third_party/chromium-variations": {
         "url": "https://chromium.googlesource.com/chromium-variations.git",
-        "rev": "84c18c7a0205fbd0a27b0214b16ded7fc44dc062",
-        "hash": "sha256-zXAmoKyj104BaIe4Rug18WbVKkyAsyWPCTPPEerinVo="
+        "rev": "270a25f8795caf0a798ebf5a7d69284e3d830d19",
+        "hash": "sha256-ZkETD+Pka5vItN70nhlGQelycFAEnb1Qfv9k2aDXZSE="
       },
       "src/third_party/cld_3/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/cld_3.git",
@@ -1002,8 +1002,8 @@
       },
       "src/third_party/cpuinfo/src": {
         "url": "https://chromium.googlesource.com/external/github.com/pytorch/cpuinfo.git",
-        "rev": "8a1772a0c5c447df2d18edf33ec4603a8c9c04a6",
-        "hash": "sha256-dKmZ5YXLhvVdxaJ4PefR+SWlh+MTFHNxOMeM6Vj7Gvo="
+        "rev": "aaac07ee499895770c89163ce0920ef8bb41ed23",
+        "hash": "sha256-A86nAbKs7trVwwa1HFUNbV//6O1minvlHTpZR3vabrU="
       },
       "src/third_party/crc32c/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/crc32c.git",
@@ -1012,23 +1012,23 @@
       },
       "src/third_party/cros_system_api": {
         "url": "https://chromium.googlesource.com/chromiumos/platform2/system_api.git",
-        "rev": "ea21b22629965105426f3df5e58190513e95a17e",
-        "hash": "sha256-xUaGf4MaEXg2RHgrGS1Uuz97vq5Vbt4HFV/AXYB4lCA="
+        "rev": "b8d797a61689892adb182c9bec457c9bd24b26d2",
+        "hash": "sha256-44bD1nG7CRrvBcd9NbU4yksn7Ly9WYsWETXat/L3f0I="
       },
       "src/third_party/crossbench": {
         "url": "https://chromium.googlesource.com/crossbench.git",
-        "rev": "0391f0d11cbf3cf3c5bcf82e19e9d9839b1936ed",
-        "hash": "sha256-EL+lOTe1Vzg4JW2q7t3UoXzHHiEmLjf7khH9fXdplbo="
+        "rev": "bf8d1d3aaf469343576db89f81df26aeb16bd62b",
+        "hash": "sha256-XscXxoCUSVGsBCB8xymEsaLc4WgzZPXu6zkRbv8ZQZw="
       },
       "src/third_party/depot_tools": {
         "url": "https://chromium.googlesource.com/chromium/tools/depot_tools.git",
-        "rev": "e42fac3e9c1726ab14a61a25e6291d9ccc49e688",
-        "hash": "sha256-BvEkk15Rm4nSoV/uWiwmQW/+gg2vpLQ187TbBAHl9Rk="
+        "rev": "85ec2718b5a29990c7eb67778348c9f76a00f392",
+        "hash": "sha256-eWlHnSRfLFcd3OoyCTIFewDf0eC9KQowScQOnphgfg8="
       },
       "src/third_party/devtools-frontend/src": {
         "url": "https://chromium.googlesource.com/devtools/devtools-frontend",
-        "rev": "65b3f414b81ffe4df49202af6fc75bc26a3cb109",
-        "hash": "sha256-rdBpJWdQ5VtFnIfbr/Vq1q1euSvkbY8iIqyuTMAS2KM="
+        "rev": "ad4e2fc82183b1463ac870818c28680bbc3de889",
+        "hash": "sha256-HS5O+r0GFe3Dfh+86JQlsEC+5Gcs1xmUkDyZ7qixqXw="
       },
       "src/third_party/dom_distiller_js/dist": {
         "url": "https://chromium.googlesource.com/chromium/dom-distiller/dist.git",
@@ -1037,8 +1037,8 @@
       },
       "src/third_party/eigen3/src": {
         "url": "https://chromium.googlesource.com/external/gitlab.com/libeigen/eigen.git",
-        "rev": "2a35a917be47766a895be610bedd66006980b7e6",
-        "hash": "sha256-WG7uiduuMnXrvEpXJNGksrYkBsim+l7eiu5N+mx0Yr0="
+        "rev": "4c38131a16803130b66266a912029504f2cf23cd",
+        "hash": "sha256-dOq8RJ/V8kulSMK0OUWzHruiwJSP3f/86ih5gk2MMWQ="
       },
       "src/third_party/farmhash/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/farmhash.git",
@@ -1052,8 +1052,8 @@
       },
       "src/third_party/ffmpeg": {
         "url": "https://chromium.googlesource.com/chromium/third_party/ffmpeg.git",
-        "rev": "d10a0f8bf5ddcce572df95105152bc74041cae0c",
-        "hash": "sha256-OXumpRb9XB38dOCJmL3jDcabiJ08wAvydVlJwMgpCoQ="
+        "rev": "fbce2a76c00cd2e5aeffe3c2e71d44c284ec52d6",
+        "hash": "sha256-bGa0BCvzNxEKu9VZEwJ1NLt+b2KKWUxshpKSN2FHNEM="
       },
       "src/third_party/flac": {
         "url": "https://chromium.googlesource.com/chromium/deps/flac.git",
@@ -1080,15 +1080,10 @@
         "rev": "13d57703abca3005d97b19df1f2db731607a7dc2",
         "hash": "sha256-O5wD8wxgis0qYMaY+xZ21GBDVQFphMRvInCOswS6inA="
       },
-      "src/third_party/grpc/src": {
-        "url": "https://chromium.googlesource.com/external/github.com/grpc/grpc.git",
-        "rev": "a363b6c001139b9c8ffb7cd63f60a72f15349c3b",
-        "hash": "sha256-RKGZWtH2JmP2mXN+4ln/nCJvOyzynrYcfrxSY8k1vVg="
-      },
       "src/third_party/freetype/src": {
         "url": "https://chromium.googlesource.com/chromium/src/third_party/freetype2.git",
-        "rev": "b1f47850878d232eea372ab167e760ccac4c4e32",
-        "hash": "sha256-YxWz3O9see1dktqZnC551V12yU5jcOERTB1Hn1lwUNM="
+        "rev": "5d4e649f740c675426fbe4cdaffc53ee2a4cb954",
+        "hash": "sha256-DxLHuzIvw7WIKKMCRBz4ne97j9DufoohXQZV6yZ5zfY="
       },
       "src/third_party/freetype-testing/src": {
         "url": "https://chromium.googlesource.com/external/github.com/freetype/freetype2-testing.git",
@@ -1102,8 +1097,8 @@
       },
       "src/third_party/harfbuzz-ng/src": {
         "url": "https://chromium.googlesource.com/external/github.com/harfbuzz/harfbuzz.git",
-        "rev": "6d8035a99c279e32183ad063f0de201ef1b2f05c",
-        "hash": "sha256-isQvwaVdL4cM465A8Gs06VioAu8RvZFrwXDsXhfOoFo="
+        "rev": "8efd2d85c78fbba6ca09a3e454f77525f3b296ce",
+        "hash": "sha256-/WNGrvyvJ+FGqoIoHapaux1iu63zjID0yR30HYPpxaw="
       },
       "src/third_party/ink/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/ink.git",
@@ -1137,8 +1132,8 @@
       },
       "src/third_party/googletest/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/googletest.git",
-        "rev": "e235eb34c6c4fed790ccdad4b16394301360dcd4",
-        "hash": "sha256-jpXIcz5Uy6fDEvxTq8rTFx/M+0+SQ6TCDaqnp7nMtng="
+        "rev": "24a9e940d481f992ba852599c78bb2217362847b",
+        "hash": "sha256-oLknxClUh7l72ZAx7sxNDM6dUhMT0vUE2IdDjRLDKtk="
       },
       "src/third_party/hunspell_dictionaries": {
         "url": "https://chromium.googlesource.com/chromium/deps/hunspell_dictionaries.git",
@@ -1167,8 +1162,8 @@
       },
       "src/third_party/fuzztest/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/fuzztest.git",
-        "rev": "44ac6c2594a880edbb9cb1e4e197c2b53d078130",
-        "hash": "sha256-AKXKxXqOMUb3APf5r15NmIMyhJ4ZmW5+t7y5XdgdZkw="
+        "rev": "a32ca113e3b050693e4bb379525dfae519ebd0d9",
+        "hash": "sha256-eoV+g/QVzcI7PqDmAic5Ra9K/ba4IV1wXE4RFecuMuk="
       },
       "src/third_party/domato/src": {
         "url": "https://chromium.googlesource.com/external/github.com/googleprojectzero/domato.git",
@@ -1182,18 +1177,18 @@
       },
       "src/third_party/libaom/source/libaom": {
         "url": "https://aomedia.googlesource.com/aom.git",
-        "rev": "3990233fc06a35944d6d33797e63931802122a95",
-        "hash": "sha256-4NOQug0MlWZ18527V3IDuGcxGEJ4b+mZZbdzugWoBgQ="
+        "rev": "99fcd816eeaa7da46688bc4b9f4f9e71be13c2e8",
+        "hash": "sha256-SOIvGkR3k7TAs9KFA3mFbBSq5h4eJghKo38IVioOK3U="
       },
       "src/third_party/crabbyavif/src": {
         "url": "https://chromium.googlesource.com/external/github.com/webmproject/CrabbyAvif.git",
-        "rev": "c5938b119ef52f9ff628436c1e66c9a5322ece83",
-        "hash": "sha256-+6339vcd0KJj5V11dvJvs0YpQpTxsLmDuBoYVzyn9Ec="
+        "rev": "a75457c637a365910508f3c2c2b986a701b03a2e",
+        "hash": "sha256-v3+Rj3jS/lCYZNjjAXB6zohdvM45PKayB43jX37ntsU="
       },
       "src/third_party/nearby/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/nearby-connections.git",
-        "rev": "97690c6996f683a6f3e07d75fc4557958c55ac7b",
-        "hash": "sha256-d1D9/6d7a1+27nD8VijhzRMglE2PqvAMK8+GbMeesSQ="
+        "rev": "45d6317a64aad3d5060b800db267f7cea3f27198",
+        "hash": "sha256-SmU+c9YveQ4N13bteuhtmo0uvySeCnmZYpC5NYiMJuo="
       },
       "src/third_party/beto-core/src": {
         "url": "https://beto-core.googlesource.com/beto-core.git",
@@ -1210,21 +1205,26 @@
         "rev": "d6b5ffea959ad31e231c203d7446bf8b39e987ce",
         "hash": "sha256-lCwGk4Q+OXwO8vOlOQrkgygYqLrwpku/PkR03oEdX3Y="
       },
+      "src/third_party/speedometer/v3.1": {
+        "url": "https://chromium.googlesource.com/external/github.com/WebKit/Speedometer.git",
+        "rev": "cc9ee085ae18f05961ff3dfa1ee1a90d67b7f8ee",
+        "hash": "sha256-28vGPZLaD9xSwursTRRK1xndedeBUZ5TF/4hdy0RjFc="
+      },
       "src/third_party/speedometer/v3.0": {
         "url": "https://chromium.googlesource.com/external/github.com/WebKit/Speedometer.git",
         "rev": "8d67f28d0281ac4330f283495b7f48286654ad7d",
         "hash": "sha256-qMQ4naX+4uUu3vtzzinjkhxX9/dNoTwj6vWCu4FdQmU="
       },
-      "src/third_party/speedometer/v2.0": {
-        "url": "https://chromium.googlesource.com/external/github.com/WebKit/Speedometer.git",
-        "rev": "732af0dfe867f8815e662ac637357e55f285dbbb",
-        "hash": "sha256-p7WUS8gZUaS+LOm7pNmRkwgxjx+V8R6yy7bbaEHaIs4="
-      },
       "src/third_party/speedometer/v2.1": {
         "url": "https://chromium.googlesource.com/external/github.com/WebKit/Speedometer.git",
         "rev": "8bf7946e39e47c875c00767177197aea5727e84a",
         "hash": "sha256-0z5tZlz32fYh9I1ALqfLm2WWO8HiRBwt0hcmgKQhaeM="
       },
+      "src/third_party/speedometer/v2.0": {
+        "url": "https://chromium.googlesource.com/external/github.com/WebKit/Speedometer.git",
+        "rev": "732af0dfe867f8815e662ac637357e55f285dbbb",
+        "hash": "sha256-p7WUS8gZUaS+LOm7pNmRkwgxjx+V8R6yy7bbaEHaIs4="
+      },
       "src/third_party/ukey2/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/ukey2.git",
         "rev": "0275885d8e6038c39b8a8ca55e75d1d4d1727f47",
@@ -1232,8 +1232,8 @@
       },
       "src/third_party/cros-components/src": {
         "url": "https://chromium.googlesource.com/external/google3/cros_components.git",
-        "rev": "1f1c782f06956a2deb5d33f09c466e4852099c71",
-        "hash": "sha256-80WqSMP5Vlc4OY+gfpU3SRGavs7fJbTQVW1AIhq6jmE="
+        "rev": "97dc8c7a1df880206cc54d9913a7e9d73677072a",
+        "hash": "sha256-CT9c4LqTwhldsxoEny8MesULwQC4k95F4tfCtRZErGM="
       },
       "src/third_party/libdrm/src": {
         "url": "https://chromium.googlesource.com/chromiumos/third_party/libdrm.git",
@@ -1267,8 +1267,8 @@
       },
       "src/third_party/libprotobuf-mutator/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/libprotobuf-mutator.git",
-        "rev": "a304ec48dcf15d942607032151f7e9ee504b5dcf",
-        "hash": "sha256-ZyPweW+V5foxFQwjjMLkaRUo+FNV+kEDGIH/4oRV614="
+        "rev": "7bf98f78a30b067e22420ff699348f084f802e12",
+        "hash": "sha256-EaEC6R7SzqLw4QjEcWXFXhZc84lNBp6RSa9izjGnWKE="
       },
       "src/third_party/libsrtp": {
         "url": "https://chromium.googlesource.com/chromium/deps/libsrtp.git",
@@ -1287,8 +1287,8 @@
       },
       "src/third_party/libvpx/source/libvpx": {
         "url": "https://chromium.googlesource.com/webm/libvpx.git",
-        "rev": "7b3fa8114cf8ef23cbf91e50c368c1ca768d95d5",
-        "hash": "sha256-2FgBb0HzgMihGsWbEtQqyN2EXZs/y5+ToWL1ZXG35W0="
+        "rev": "2bfb9f9e0a9cca18cd5a0045e931b49dac390c79",
+        "hash": "sha256-BWid6iU7CDEElh8j13a+S767vwnO8qQg26Vp5nQGEHc="
       },
       "src/third_party/libwebm/source": {
         "url": "https://chromium.googlesource.com/webm/libwebm.git",
@@ -1302,8 +1302,8 @@
       },
       "src/third_party/libyuv": {
         "url": "https://chromium.googlesource.com/libyuv/libyuv.git",
-        "rev": "5a9a6ea936085310f3b9fbd4a774868e6a984ec4",
-        "hash": "sha256-E5ePVHrEXMM8mS1qaUwPTqYO0BdP7TYuUhfX+BCiq/0="
+        "rev": "ccdf870348764e4b77fa3b56accb2a896a901bad",
+        "hash": "sha256-8sH11psWPXLMy3Q0tAizCZ/woUWvTCCUf44jcr2C4Xs="
       },
       "src/third_party/lss": {
         "url": "https://chromium.googlesource.com/linux-syscall-support.git",
@@ -1332,18 +1332,18 @@
       },
       "src/third_party/openh264/src": {
         "url": "https://chromium.googlesource.com/external/github.com/cisco/openh264",
-        "rev": "33f7f48613258446decb33b3575fc0a3c9ed14e3",
-        "hash": "sha256-lZlZjX8GCJOc77VJ9i1fSWn63pfVOEcwwlzh0UpIgy4="
+        "rev": "652bdb7719f30b52b08e506645a7322ff1b2cc6f",
+        "hash": "sha256-tf0lnxATCkoq+xRti6gK6J47HwioAYWnpEsLGSA5Xdg="
       },
       "src/third_party/openscreen/src": {
         "url": "https://chromium.googlesource.com/openscreen",
-        "rev": "38d1445b41d1eb597fcd100688dbaff98aa072ed",
-        "hash": "sha256-KGVFyGp7ItKeapub3Bd+htXH/gMaaBd+k8iC7hLtvl0="
+        "rev": "b756f3c04ba53983a94cd12eb29b7f22e472fd58",
+        "hash": "sha256-P6vAoVF1/geM6MjihcEBQtbf8CxE8sPSKTRLz8/c2yE="
       },
       "src/third_party/openscreen/src/buildtools": {
         "url": "https://chromium.googlesource.com/chromium/src/buildtools",
-        "rev": "56013b77b6c0a650d00bde40e750e7c3b7c6bc3d",
-        "hash": "sha256-Dz7wMYQHVR7sjCGaQe2nxIxZsAxsK6GGDNpDvypPefo="
+        "rev": "00459762409cb29cecf398a23cdb0cae918b7515",
+        "hash": "sha256-QXGJRGyyuN0EPDAF7CAzcTSbjHkz8FRjhqd1JEFF/1o="
       },
       "src/third_party/openscreen/src/third_party/tinycbor/src": {
         "url": "https://chromium.googlesource.com/external/github.com/intel/tinycbor.git",
@@ -1352,23 +1352,23 @@
       },
       "src/third_party/pdfium": {
         "url": "https://pdfium.googlesource.com/pdfium.git",
-        "rev": "12f7715a6390050c5cffb7e4c9b2be1c2f2956d0",
-        "hash": "sha256-/u+HYjmxSIX2GlriEWYZQJ8TDFNfzSufATGq1j9zx9w="
+        "rev": "9afffebfa895ea6cdcc05516908c50bd7fe72797",
+        "hash": "sha256-89rJdhwUJtJCMO7FvVoTYO80swFRkoWUB/ZYs1tOLzE="
       },
       "src/third_party/perfetto": {
         "url": "https://android.googlesource.com/platform/external/perfetto.git",
-        "rev": "0d78d85c2bfb993ab8dd9a85b6fee6caa6a0f357",
-        "hash": "sha256-bjgSwq4LPz9qN9rVqIJUTHetRguCx67Uq5oe1ksPqGE="
+        "rev": "aa4d8267bafad6782a1f2c8d979104f2aaa622a0",
+        "hash": "sha256-smVQykQVZdhybEUz7BlRLc+FVNH0UyGh+0eSxP8Jzrc="
       },
       "src/third_party/protobuf-javascript/src": {
         "url": "https://chromium.googlesource.com/external/github.com/protocolbuffers/protobuf-javascript",
-        "rev": "e34549db516f8712f678fcd4bc411613b5cc5295",
-        "hash": "sha256-TmP6xftUVTD7yML7UEM/DB8bcsL5RFlKPyCpcboD86U="
+        "rev": "426b2e025aa59c23a1b6e19fbacd6b4a11bfad16",
+        "hash": "sha256-5uieIE6ygM4Ooz9xbu1NVKCHHsPn6Ekz6OzqfWiA7/M="
       },
       "src/third_party/pthreadpool/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/pthreadpool.git",
-        "rev": "e1469417238e13eebaa001779fa031ed25c59def",
-        "hash": "sha256-cFRELaRtWspZaqtmdKmVPqM7HVskHlFMAny+Zv/Zflw="
+        "rev": "f94ab76fe99754960035d520dce28e15b647e8cf",
+        "hash": "sha256-NdKKMnXZ6rYOC2wA6a1bPNStxpemzGckN6PPWom6mFA="
       },
       "src/third_party/pyelftools": {
         "url": "https://chromium.googlesource.com/chromiumos/third_party/pyelftools.git",
@@ -1387,8 +1387,8 @@
       },
       "src/third_party/re2/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/re2.git",
-        "rev": "6dcd83d60f7944926bfd308cc13979fc53dd69ca",
-        "hash": "sha256-IeANwJlJl45yf8iu/AZNDoiyIvTCZIeK1b74sdCfAIc="
+        "rev": "c84a140c93352cdabbfb547c531be34515b12228",
+        "hash": "sha256-f/k2rloV2Nwb0KuJGUX4SijFxAx69EXcsXOG4vo+Kis="
       },
       "src/third_party/ruy/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/ruy.git",
@@ -1397,13 +1397,13 @@
       },
       "src/third_party/search_engines_data/resources": {
         "url": "https://chromium.googlesource.com/external/search_engines_data.git",
-        "rev": "6dc3b54b420e6e03a34ee7259fcd2b1978fac5f3",
-        "hash": "sha256-8RY3AU2V4iZKEmVwT7Z1Q3QlcTXDIdeyYwnQoyJcAUY="
+        "rev": "48ba13bfb5488755a5d72aa60ff4a47069be498f",
+        "hash": "sha256-//z0HlMOkGTcp1IjbS0m+0dmgVYsG7EkfCiK2vvG2wU="
       },
       "src/third_party/skia": {
         "url": "https://skia.googlesource.com/skia.git",
-        "rev": "aefbd9403c1b3032ad4cd0281ef312ed262c7125",
-        "hash": "sha256-tP6DnMeOoVqfTSn6bYXMLiCb4wg5f9uB28KzYMAeBUw="
+        "rev": "b99f146a03d3c98049768fd91c2bbe6594b02b2c",
+        "hash": "sha256-tl1GDmcStkuKMmzzsYuRG6Nrk4xDqgYYBoa1VsQNOwY="
       },
       "src/third_party/smhasher/src": {
         "url": "https://chromium.googlesource.com/external/smhasher.git",
@@ -1422,8 +1422,8 @@
       },
       "src/third_party/swiftshader": {
         "url": "https://swiftshader.googlesource.com/SwiftShader.git",
-        "rev": "86cf34f50cbe5a9f35da7eedad0f4d4127fb8342",
-        "hash": "sha256-PSkIU8zC+4AVcYu0vaYo6I1SSykrHgcgGVMBJanux8o="
+        "rev": "c12c13839d689f411911326b1f72e96eb525686c",
+        "hash": "sha256-C8y5ShwMffNZpFuILYNw3WOMVJp/jPen/wNbFl1vqBY="
       },
       "src/third_party/text-fragments-polyfill/src": {
         "url": "https://chromium.googlesource.com/external/github.com/GoogleChromeLabs/text-fragments-polyfill.git",
@@ -1432,18 +1432,18 @@
       },
       "src/third_party/tflite/src": {
         "url": "https://chromium.googlesource.com/external/github.com/tensorflow/tensorflow.git",
-        "rev": "51c6eed226abcfeeb46864e837d01563cc5b907b",
-        "hash": "sha256-qXHENS/6NwHAr1/16eb079XzmwAnpLtVZuva8uGCf+8="
+        "rev": "d120e39920c0e61cc1227bc1abe50fd6ecd3ce66",
+        "hash": "sha256-9p0/tR3bPvCJn+6eofmQXKbyfzxfbeVexdvuHpn50wk="
       },
       "src/third_party/vulkan-deps": {
         "url": "https://chromium.googlesource.com/vulkan-deps",
-        "rev": "2e4b45a53a0e2e66bcb6540ae384c53a517218d0",
-        "hash": "sha256-9ebWETg/fsS4MYZg74XHs/Nz3nX6BXBNVRN2PmyWXWM="
+        "rev": "c1c31f4d17a9e4b2af40d85c89d573eb43187e0d",
+        "hash": "sha256-uEsy4PBhO3EBJF6YdWj32GmMabgKWQJUeW3cWInAinE="
       },
       "src/third_party/glslang/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/glslang",
-        "rev": "0549c7127c2fbab2904892c9d6ff491fa1e93751",
-        "hash": "sha256-LwspMo771iaV5YeEJWgdb8xi37KMa0rsSdvO3uqMOAI="
+        "rev": "8b822ee8ac2c3e52926820f46ad858532a895951",
+        "hash": "sha256-hPd5roeHOgMiz2VUx13bUsKKDSvgQAXRdk7wfdi6e48="
       },
       "src/third_party/spirv-cross/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/SPIRV-Cross",
@@ -1452,38 +1452,38 @@
       },
       "src/third_party/spirv-headers/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/SPIRV-Headers",
-        "rev": "e7294a8ebed84f8c5bd3686c68dbe12a4e65b644",
-        "hash": "sha256-/p7kBW7mwpG/Uz0goMM7L3zjpOMBzGiuN+0ZBEOpORo="
+        "rev": "54a521dd130ae1b2f38fef79b09515702d135bdd",
+        "hash": "sha256-PScDq8HhQPFUs78N75QyL9oEykmjZmAhdxCAqQ0LJds="
       },
       "src/third_party/spirv-tools/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/SPIRV-Tools",
-        "rev": "ce37fd67f83cd1e8793b988d2e4126bbf72b19dd",
-        "hash": "sha256-SJcxmKdzOjg6lOJk/3m8qo7puvtci1YEU6dXKjthx0Q="
+        "rev": "f289d047f49fb60488301ec62bafab85573668cc",
+        "hash": "sha256-2Wv0dxVQ8NvuDRTcsXkH1GKmuA6lsIuwTl0j6kbTefo="
       },
       "src/third_party/vulkan-headers/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Headers",
-        "rev": "39f924b810e561fd86b2558b6711ca68d4363f68",
-        "hash": "sha256-twJJVBfnZbH/8Wn273h45K3BOnlAicqL2zJl6OfLm2E="
+        "rev": "952f776f6573aafbb62ea717d871cd1d6816c387",
+        "hash": "sha256-LfJ7um+rzc4HdkJerHWkuPWeEc7ZFSBafbP+svAjklk="
       },
       "src/third_party/vulkan-loader/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Loader",
-        "rev": "0508dee4ff864f5034ae6b7f68d34cb2822b827d",
-        "hash": "sha256-QqFC3Iyhw9Pq6TwBHxa0Ss7SW0bHo0Uz5N18oxl2ROg="
+        "rev": "809941a4ca137df69dc9c6e8eb456bd70309197c",
+        "hash": "sha256-FPXAofnMfgUkwwRGh8rqtXrmLjouP5A8umXV1pHm1ck="
       },
       "src/third_party/vulkan-tools/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Tools",
-        "rev": "c52931f012cb7b48e42bbf2050a7fb2183b76406",
-        "hash": "sha256-nIzrishMMxWzOuD3aX8B6Iuq2kPsUF0Uuvz7GijTulY="
+        "rev": "fb8f5a5d69f4590ff1f5ecacb5e3957b6d11daee",
+        "hash": "sha256-fO6fkWOMYbf/um7gKFyjtrFE21g1kYx3lLvPv4gY7qw="
       },
       "src/third_party/vulkan-utility-libraries/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Utility-Libraries",
-        "rev": "fe7a09b13899c5c77d956fa310286f7a7eb2c4ed",
-        "hash": "sha256-zI3y5aoP4QcYp677Oxj5Ef7lJyJwOMdGsaRBe+X9vpI="
+        "rev": "2d8f273ebd4b843c402d9ee881616895b854e42f",
+        "hash": "sha256-nD/WTBTwCnfZdwdNKldDVpcuirSghCIeJRBeX+uQXBk="
       },
       "src/third_party/vulkan-validation-layers/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-ValidationLayers",
-        "rev": "a30aa23cfaff4f28f039c025c159128a6c336a7e",
-        "hash": "sha256-foa5hzqf1hPwOj3k57CloCe/j0qXW3zCQ4mwCT4epF4="
+        "rev": "4e7b0c905b1a0401e24333800937cc8792efa037",
+        "hash": "sha256-CCpfWpyGki9klgHInjs6gAhw5shPXlzmFgccCHNfGQY="
       },
       "src/third_party/vulkan_memory_allocator": {
         "url": "https://chromium.googlesource.com/external/github.com/GPUOpen-LibrariesAndSDKs/VulkanMemoryAllocator.git",
@@ -1492,8 +1492,8 @@
       },
       "src/third_party/wasm_tts_engine/src": {
         "url": "https://chromium.googlesource.com/chromium/wasm-tts-engine",
-        "rev": "7a91dbfddd93afa096a69fb7d292e22d4afecad2",
-        "hash": "sha256-bV+1YFEtCyTeZujsZtZiexT/aUTN3MaVerR2UdkUPBY="
+        "rev": "6ab3e63276a2d66ba3e7db4f87c5b7cb00e22130",
+        "hash": "sha256-ZcnKKnHsN1UyztAXClc2EUwfeX3yuLtMM2Zjwpnh62U="
       },
       "src/third_party/wayland/src": {
         "url": "https://chromium.googlesource.com/external/anongit.freedesktop.org/git/wayland/wayland.git",
@@ -1527,8 +1527,8 @@
       },
       "src/third_party/webgpu-cts/src": {
         "url": "https://chromium.googlesource.com/external/github.com/gpuweb/cts.git",
-        "rev": "fb2b951ac3c23e453335edf35c9b3bad431d9009",
-        "hash": "sha256-tjY5ADd5tMFsYHk6xT+TXwsDYV5eI2oOywmyTjjAxYc="
+        "rev": "dcfb0d153f1e19905b0af26e640470c9ec5578e7",
+        "hash": "sha256-726p6OfKAzHtnjz/8WtMcsRxuq4wqyJv3+DHOHDTeYY="
       },
       "src/third_party/webpagereplay": {
         "url": "https://chromium.googlesource.com/webpagereplay.git",
@@ -1537,8 +1537,8 @@
       },
       "src/third_party/webrtc": {
         "url": "https://webrtc.googlesource.com/src.git",
-        "rev": "8d78f5de6c27b2c793039989ea381f1428fb0100",
-        "hash": "sha256-IsjTrEnxIqINYYjWJmDp7rlubl5dJ2YMpJf/DrG/mRM="
+        "rev": "04413d62f754a7b1a3a2d8c3df23bcde040112b2",
+        "hash": "sha256-sFoBgpPeMJQNSjNp8dDEUlB/7lJUpIXTpu0eRq94cGk="
       },
       "src/third_party/wuffs/src": {
         "url": "https://skia.googlesource.com/external/github.com/google/wuffs-mirror-release-c.git",
@@ -1557,18 +1557,18 @@
       },
       "src/third_party/xnnpack/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/XNNPACK.git",
-        "rev": "0824e2965f6edc2297e55c8dff5a8ac4cb12aaad",
-        "hash": "sha256-eb9B9lXPB2GiC4qehB/HOU36W1e9RZ0N2oEbIifyrHE="
+        "rev": "7702e723fa25102db8b633ead4e3c221a5121487",
+        "hash": "sha256-n3FxY4HESzNyccQLENbuisU29v79c2x+7fYOsUrQnFg="
       },
       "src/third_party/zstd/src": {
         "url": "https://chromium.googlesource.com/external/github.com/facebook/zstd.git",
-        "rev": "ea0aa030cdf31f7897c5bfc153f0d36e92768095",
-        "hash": "sha256-UJsuaSzR4V8alLdtxzpla1v9WYHPKPp13YrgA4Y6/yA="
+        "rev": "ef2bf5781112a4cd6b62ac1817f7842bbdc7ea8f",
+        "hash": "sha256-hDDNrUXGxG/o1oZnypAnuLyIeM16Hy6x1KacGu9Hhmw="
       },
       "src/v8": {
         "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "4f282ae4acae85cdcc8c167cbc296a86d24c1cf6",
-        "hash": "sha256-wpz9W/ZurpCT/dGIHGpmdkI3dsXbP8TPNeee2w9zBU8="
+        "rev": "e2591684c45463aa1e46ebefc3fd35deee63f37c",
+        "hash": "sha256-tbGzFdqmkoSiVGk1WMRroWC3NR5GaHRuMwGzPhVodxk="
       }
     }
   }

From 08e64d47792410ae1115219b1cee55e3cd047e93 Mon Sep 17 00:00:00 2001
From: Francesco Gazzetta <fgaz@fgaz.me>
Date: Fri, 15 Nov 2024 10:13:41 +0100
Subject: [PATCH 142/146] zrc: init at 2.1

---
 pkgs/by-name/zr/zrc/package.nix | 36 +++++++++++++++++++++++++++++++++
 1 file changed, 36 insertions(+)
 create mode 100644 pkgs/by-name/zr/zrc/package.nix

diff --git a/pkgs/by-name/zr/zrc/package.nix b/pkgs/by-name/zr/zrc/package.nix
new file mode 100644
index 000000000000..d28906026580
--- /dev/null
+++ b/pkgs/by-name/zr/zrc/package.nix
@@ -0,0 +1,36 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  bison,
+  flex,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "zrc";
+  version = "2.1";
+
+  src = fetchFromGitHub {
+    owner = "Edd12321";
+    repo = "zrc";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-prUbuXyhIJczCvjqwm9pp2n75LY10+6SzYaOHd+S748=";
+  };
+
+  nativeBuildInputs = [
+    bison
+    flex
+  ];
+
+  makeFlags = [ "PREFIX=$(out)" ];
+
+  meta = {
+    description = "UNIX shell and scripting language with syntax similar to Tcl";
+    homepage = "https://github.com/Edd12321/zrc";
+    license = lib.licenses.bsd2;
+    maintainers = with lib.maintainers; [ fgaz ];
+    mainProgram = "zrc";
+    platforms = lib.platforms.all;
+    broken = stdenv.hostPlatform.isDarwin;
+  };
+})

From f3a10f311dd2914c083f914bc87a5960abae5d95 Mon Sep 17 00:00:00 2001
From: Francesco Gazzetta <fgaz@fgaz.me>
Date: Wed, 26 Mar 2025 11:10:22 +0100
Subject: [PATCH 143/146] drawpile: 2.2.1 -> 2.2.2

Diff: https://github.com/drawpile/drawpile/compare/2.2.1...2.2.2
---
 pkgs/applications/graphics/drawpile/default.nix | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/graphics/drawpile/default.nix b/pkgs/applications/graphics/drawpile/default.nix
index 2b51e4cf207b..82362ee6d90c 100644
--- a/pkgs/applications/graphics/drawpile/default.nix
+++ b/pkgs/applications/graphics/drawpile/default.nix
@@ -19,6 +19,7 @@
   qtsvg,
   qttools,
   libsecret,
+  libwebp,
 
   # optional client deps
   giflib,
@@ -51,6 +52,7 @@ let
     qtsvg
     qttools
     libsecret
+    libwebp
     # optional:
     giflib # gif animation export support
     kdnssd # local server discovery with Zeroconf
@@ -67,18 +69,18 @@ let
 in
 mkDerivation rec {
   pname = "drawpile";
-  version = "2.2.1";
+  version = "2.2.2";
 
   src = fetchFromGitHub {
     owner = "drawpile";
     repo = "drawpile";
     rev = version;
-    sha256 = "sha256-NS1aQlWpn3f+SW0oUjlYwHtOS9ZgbjFTrE9grjK5REM=";
+    sha256 = "sha256-xcutcSpbFt+pb7QP1E/RG6iNnZwpfhIZTxr+1usLKHc=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit src;
-    hash = "sha256-rY4zWSCBfVXvl6p9GvtDg/PFZfLkWTl8FTYdlKTzWYM=";
+    hash = "sha256-VUX6J7TfxWpa07HPFZ8JzpltIwJUYAl5TABIpBmGYYo=";
   };
 
   nativeBuildInputs = [

From f5af80763364a4b5613da6fda0c302c01155e4bb Mon Sep 17 00:00:00 2001
From: Francesco Gazzetta <fgaz@fgaz.me>
Date: Fri, 7 Mar 2025 16:52:47 +0100
Subject: [PATCH 144/146] tower-pixel-dungeon: 0.3.2 -> 0.5.4

---
 .../tower-pixel-dungeon/default.nix                      | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/pkgs/games/shattered-pixel-dungeon/tower-pixel-dungeon/default.nix b/pkgs/games/shattered-pixel-dungeon/tower-pixel-dungeon/default.nix
index e51f7d067f52..c17d6d1507b9 100644
--- a/pkgs/games/shattered-pixel-dungeon/tower-pixel-dungeon/default.nix
+++ b/pkgs/games/shattered-pixel-dungeon/tower-pixel-dungeon/default.nix
@@ -6,22 +6,23 @@
 
 callPackage ../generic.nix rec {
   pname = "tower-pixel-dungeon";
-  version = "0.3.2";
+  version = "0.5.4";
 
   src = fetchFromGitHub {
     owner = "FixAkaTheFix";
     repo = "Tower-Pixel-Dungeon";
-    rev = "TPDv${lib.replaceStrings [ "." ] [ "" ] version}";
-    hash = "sha256-ZyqrrSuA++L7FOUj6Ytk2lld0YMY4B7WOCzpohOKhdU=";
+    tag = "TPDv${lib.replaceStrings [ "." ] [ "" ] version}";
+    hash = "sha256-6b7EC7rye7nSevMJhRwSKJU7zuzta6KUCgzizWPFk8I=";
   };
 
   sourceRoot = src.name + "/pixel-towers-master";
 
   desktopName = "Tower Pixel Dungeon";
 
-  # Sprite sources (Paint.NET files) interfere with the build process.
+  # Sprite sources (Paint.NET files) and other files interfere with the build process.
   postPatch = ''
     rm core/src/main/assets/{levelsplashes,sprites}/*.pdn
+    rm core/src/main/assets/environment/*.lnk
   '';
 
   meta = {

From f9f91492042402e41a4894d0e356da6c0b62c524 Mon Sep 17 00:00:00 2001
From: "R. RyanTM" <ryantm-bot@ryantm.com>
Date: Sat, 5 Apr 2025 08:53:38 +1000
Subject: [PATCH 145/146] hyprprop: 0.1-unstable-2025-03-17 ->
 0.1-unstable-2025-03-31 (#395882)

---
 pkgs/by-name/hy/hyprprop/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/hy/hyprprop/package.nix b/pkgs/by-name/hy/hyprprop/package.nix
index d37a8e05b0c6..8552abed3d0a 100644
--- a/pkgs/by-name/hy/hyprprop/package.nix
+++ b/pkgs/by-name/hy/hyprprop/package.nix
@@ -14,13 +14,13 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "hyprprop";
-  version = "0.1-unstable-2025-03-17";
+  version = "0.1-unstable-2025-03-31";
 
   src = fetchFromGitHub {
     owner = "hyprwm";
     repo = "contrib";
-    rev = "bd81329944be53b0ffb99e05864804b95f1d7c65";
-    hash = "sha256-I8JVdQRu8eWvY5W8XWYZkdd5pojDHkxeqQV7mMIsbhs=";
+    rev = "bc2ad24e0b2e66c3e164994c4897cd94a933fd10";
+    hash = "sha256-YItzk1pj8Kz+b7VlC9zN1pSZ6CuX35asYy3HuMQ3lBQ=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/hyprprop";

From 8e79d17301e3abea13093fea64f0b0a573ad9439 Mon Sep 17 00:00:00 2001
From: offset---cyan <offsetcyan@proton.me>
Date: Fri, 4 Apr 2025 21:29:18 +0100
Subject: [PATCH 146/146] erlang_language_platform: rename to
 erlang-language-platform

erlang_language_platform using underscores in all-packages.nix but
hypens in by-name seems to trigger r-ryantm to open PRs for both package
names. this PR fixes the naming and creates an alias.
---
 pkgs/top-level/aliases.nix      | 2 ++
 pkgs/top-level/all-packages.nix | 2 --
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 042b02d713a4..6010ea721ff8 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -580,6 +580,8 @@ mapAliases {
   erlangR26_javac = throw "erlangR26_javac has been removed in favor of erlang_26_javac"; # added 2024-05-24
   erlangR26_odbc_javac = throw "erlangR26_odbc_javac has been removed in favor of erlang_26_odbc_javac"; # added 2024-05-24
 
+  erlang_language_platform = throw "erlang_language_platform has been renamed erlang-language-platform"; # added 2025-04-04
+
   ethabi = throw "ethabi has been removed due to lack of maintainence upstream and no updates in Nixpkgs"; # Added 2024-07-16
   eww-wayland = lib.warnOnInstantiate "eww now can build for X11 and wayland simultaneously, so `eww-wayland` is deprecated, use the normal `eww` package instead." eww;
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 398bd086ccfb..3ab5698e8162 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -7424,8 +7424,6 @@ with pkgs;
   # 28 is pre-release
   beamMinimal28Packages = dontRecurseIntoAttrs beam_minimal.packages.erlang_28.beamPackages;
 
-  erlang_language_platform = callPackage ../by-name/er/erlang-language-platform/package.nix { };
-
   gnudatalanguage = callPackage ../development/interpreters/gnudatalanguage {
     inherit (llvmPackages) openmp;
     inherit (darwin.apple_sdk.frameworks) Cocoa;