Merge remote-tracking branch 'origin/staging-next' into staging

2025-09-19 07:49:55 +03:00
parent cc4aa62220 3c410e220c
commit be0b9e1bff
101 changed files with 725 additions and 402 deletions
@@ -24421,6 +24421,12 @@
    name = "sportshead";
    keys = [ { fingerprint = "A6B6 D031 782E BDF7 631A  8E7E A874 DB2C BFD3 CFD0"; } ];
  };
+  spreetin = {
+    email = "spreetin@protonmail.com";
+    name = "David Falk";
+    github = "spreetin";
+    githubId = 7392173;
+  };
  sprock = {
    email = "rmason@mun.ca";
    github = "sprock";
@@ -137,12 +137,8 @@ in

      cleanupSettings = lib.mkOption {
        inherit (settingsFormat) type;
-        default = {
-          # required by json schema
-          interfaces = { };
-          # https://codeberg.org/liske/ifstate/issues/118
-          namespaces = { };
-        };
+        # required by json schema
+        default.interfaces = { };
        description = "Content of IfState's initrd cleanup configuration file. See <https://ifstate.net/2.0/schema/> for details. This configuration gets applied before systemd switches to stage two. The goas is to deconfigurate the whole network in order to prevent access to services, before the firewall is configured. The stage two IfState configuration will start after the firewall is configured.";
      };
    };
@@ -283,8 +283,8 @@ in
      };

      cutoffPackages = mkOption {
-        default = [ config.system.build.initialRamdisk ];
-        defaultText = literalExpression "[ config.system.build.initialRamdisk ]";
+        default = lib.optionals config.boot.initrd.enable [ config.system.build.initialRamdisk ];
+        defaultText = literalExpression "lib.optionals config.boot.initrd.enable [ config.system.build.initialRamdisk ]";
        type = types.listOf types.package;
        description = ''
          Packages to which no replacements should be applied.
@@ -208,6 +208,10 @@ let
  ++ [
    "systemd-exit.service"
    "systemd-update-done.service"
+
+    # Capsule support
+    "capsule@.service"
+    "capsule.slice"
  ]
  ++ cfg.additionalUpstreamSystemUnits;

@@ -30,6 +30,7 @@ let
    "background.slice"
    "basic.target"
    "bluetooth.target"
+    "capsule@.target"
    "default.target"
    "exit.target"
    "graphical-session-pre.target"
@@ -1411,6 +1411,7 @@ in
  systemd-binfmt = handleTestOn [ "x86_64-linux" ] ./systemd-binfmt.nix { };
  systemd-boot = handleTest ./systemd-boot.nix { };
  systemd-bpf = runTest ./systemd-bpf.nix;
+  systemd-capsules = runTest ./systemd-capsules.nix;
  systemd-confinement = handleTest ./systemd-confinement { };
  systemd-coredump = runTest ./systemd-coredump.nix;
  systemd-credentials-tpm2 = runTest ./systemd-credentials-tpm2.nix;
@@ -0,0 +1,47 @@
+{ lib, ... }:
+{
+  name = "systemd-capsules";
+
+  meta.maintainers = with lib.maintainers; [ fpletz ];
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      environment.systemPackages = [ pkgs.hello ];
+      systemd.user.services.alice-sleep = {
+        wantedBy = [ "capsule@alice.target" ];
+        serviceConfig = {
+          ExecStart = "${pkgs.coreutils}/bin/sleep 999";
+        };
+      };
+    };
+
+  testScript = # python
+    ''
+      machine.wait_for_unit("multi-user.target")
+
+      with subtest("capsule setup"):
+        machine.succeed("systemctl start capsule@alice.service")
+
+      with subtest("imperative user service in capsule"):
+        machine.succeed("systemd-run --capsule=alice --unit=sleeptest.service /run/current-system/sw/bin/sleep 999")
+        machine.succeed("systemctl --capsule=alice status sleeptest.service")
+
+      with subtest("declarative user service in capsule"):
+        machine.succeed("systemctl --capsule=alice status alice-sleep.service")
+        machine.succeed("systemctl --capsule=alice stop alice-sleep.service")
+        machine.fail("systemctl --capsule=alice status alice-sleep.service")
+        machine.succeed("systemctl --capsule=alice start alice-sleep.service")
+        machine.succeed("systemctl --capsule=alice status alice-sleep.service")
+
+      with subtest("interactive shell with terminal in capsule"):
+        hello_output = machine.succeed("systemd-run -t --capsule=alice /run/current-system/sw/bin/bash -i -c 'hello | tee ~/hello'")
+        assert hello_output == "Hello, world!\r\n"
+        machine.copy_from_vm("/var/lib/capsules/alice/hello")
+
+      with subtest("capsule cleanup"):
+        machine.succeed("systemctl --capsule=alice stop sleeptest.service")
+        machine.succeed("systemctl stop capsule@alice.service")
+        machine.succeed("systemctl clean --all capsule@alice.service")
+    '';
+}
@@ -1,4 +1,4 @@
-{ pkgs, ... }:
+{ lib, pkgs, ... }:
 {
  name = "systemd";

@@ -108,6 +108,14 @@
      # Will not succeed unless ConditionFirstBoot=yes
      machine.wait_for_unit("first-boot-complete.target")

+      machine.succeed(
+        "journalctl --system -o cat --grep 'systemd ${lib.escapeRegex pkgs.systemd.version} running'"
+      )
+
+      assert "systemd ${lib.versions.major pkgs.systemd.version} (${pkgs.systemd.version})" in machine.succeed(
+        "systemctl --version"
+      )
+
      # Make sure, a subsequent boot isn't a ConditionFirstBoot=yes.
      machine.reboot()
      machine.wait_for_x()
@@ -1,90 +1,90 @@
 {
  "platform_major": "4",
-  "platform_minor": "36",
-  "version": "4.36",
+  "platform_minor": "37",
+  "version": "4.37",
  "year": "2025",
-  "month": "06",
-  "buildmonth": "05",
-  "dayHourMinute": "281830",
+  "month": "09",
+  "buildmonth": "09",
+  "dayHourMinute": "050730",
  "eclipses": {
    "cpp": {
      "description": "Eclipse IDE for C/C++ Developers",
      "dropUrl": false,
      "hashes": {
-        "x86_64": "sha256-UEiL8AlghabRlAy29Blx7s+RAYSsfS1C1AozqBB11Sg=",
-        "aarch64": "sha256-MxRd2H+JSXPwGZjWuKWS1ocayQSFsinuYk21qBU+EzI="
+        "x86_64": "sha256-La+sX7ouIfvgbXPNIlmkpDzwwiT5VJfkl4ma4eFKjqw=",
+        "aarch64": "sha256-U1kFulGX7apNrlY3WPeu/FqQqu3SoxfsHHErbAscFtE="
      }
    },
    "dsl": {
      "description": "Eclipse IDE for Java and DSL Developers",
      "dropUrl": false,
      "hashes": {
-        "x86_64": "sha256-SoaX7jWQ6CtirHh8yq5neZs3b36HCkzGDjQIiRJmKSM=",
-        "aarch64": "sha256-Bi/HxncUPitaWKxntdQjVNlGcU8/kn2QxC3M3rejxXM="
+        "x86_64": "sha256-8zXSMxKKTPnL8rqW7YT+6Gtud1pyHFmcLKOSihJWjCA=",
+        "aarch64": "sha256-7nsn3iWBp9N/mdcpyPH7j5tfV+sL/jCTuhvpDHmKx8I="
      }
    },
    "embedcpp": {
      "description": "Eclipse IDE for Embedded C/C++ Developers",
      "dropUrl": false,
      "hashes": {
-        "x86_64": "sha256-8B0qiKNRSl8PPzYDoura6t8vsFVjg5mNVrzvWwf1UFQ=",
-        "aarch64": "sha256-NzzvijvwcW6jyy3QvwIRqLlNtHHdTsv79utkRMUfvew="
+        "x86_64": "sha256-48cEpt11ndShjxUCQDX2ObI+cx9frGloJ7EICjmErC8=",
+        "aarch64": "sha256-zSMDR+Y4JIdu+PoYFyk+FPNKcYbRiika2TeGg3g88pg="
      }
    },
    "modeling": {
      "description": "Eclipse Modeling Tools",
      "dropUrl": false,
      "hashes": {
-        "x86_64": "sha256-r6cRPy4PgThRzVgMXpJS2X4m+tU6MFh7fLW8SGaYvGw=",
-        "aarch64": "sha256-cM0OQdcbVeOYl+IgsdwSU52+jobGIECFc1pnI2Y4dwY="
+        "x86_64": "sha256-9Qq5ziLa2vjX6bJjZ67qwF4nVNdqTQ80kz9GANtJCIw=",
+        "aarch64": "sha256-6//g6G3U1fC5mGgOci6Zgxx3YTJEZQ2pMBVjbJ9/mPE="
      }
    },
    "platform": {
      "description": "Eclipse Platform ${year}-${month}",
      "dropUrl": true,
      "hashes": {
-        "x86_64": "sha256-n5DtlmBqHUuzvuND0NLlDZxeHY7YvhHF5Sp4JdzvFYA=",
-        "aarch64": "sha256-OgGjb5TtqnAfiTs9PgF1h+W+lr32+okYC/3I513VPa4="
+        "x86_64": "sha256-C8P9x7C0tMYFQwJiBlF5JycWvWcF71ZWsDEwXPl1K34=",
+        "aarch64": "sha256-8qpNqHpi1BEHQt3nkFbeLzQccPSwu0op2THyWulhnLU="
      }
    },
    "SDK": {
      "description": "Eclipse ${year}-${month} Classic",
      "dropUrl": true,
      "hashes": {
-        "x86_64": "sha256-Wd90SkwUBSAOEMh+Qw7ATaPmHw98rVmyLak0M10h1Lw=",
-        "aarch64": "sha256-YwC/7rmd/mVyJITz8xYaYrMZtjdIlHmp6sos9lcnLig="
+        "x86_64": "sha256-Kx9WEpu4UbCeeKfmWV0iIyAd09xh9ffHm39dahlIlW8=",
+        "aarch64": "sha256-MWI2KpZQPTbw7Ro0+3Ab+nnIzbSTPGwqjhBfeu4tmE8="
      }
    },
    "java": {
      "description": "Eclipse IDE for Java Developers",
      "dropUrl": false,
      "hashes": {
-        "x86_64": "sha256-H3t1yYPqWYrPd3k6MwUwj86I4GDwlBhamqrbCYcSKOw=",
-        "aarch64": "sha256-vzV8OvYPJJwJQ/NxXF0u3htSgqQZbPEHv2KZcHp1eqA="
+        "x86_64": "sha256-L5vqC+jboYQAR+CtNAEXgDACxEG0r1rlx4ruc264cUc=",
+        "aarch64": "sha256-xxZjwmF24CbKeK7IQXkgylFTTGIHo1Wz6FnL/EUmCaQ="
      }
    },
    "jee": {
      "description": "Eclipse IDE for Enterprise Java and Web Developers",
      "dropUrl": false,
      "hashes": {
-        "x86_64": "sha256-5mYH71A/pCDQcjT7SZHacK5wl0k3n/sSfzrh5mE+r0E=",
-        "aarch64": "sha256-grKXfdIN3xSsyEScmKnDumLqH7fiNpbLmHyD8sPlhIA="
+        "x86_64": "sha256-bFCbFLRtltZ/GJwAoFd3MH/FknDF6hnvX9LQHQs9eKg=",
+        "aarch64": "sha256-DXw/dt4Gjz0e7szjJUaKB3wsUdnNj3wCX8cVpMlYkCc="
      }
    },
    "committers": {
      "description": "Eclipse IDE for Eclipse Committers and Eclipse Platform Plugin Developers",
      "dropUrl": false,
      "hashes": {
-        "x86_64": "sha256-BuXTbz4JaQw3GS7vnr+H0lBSJICbTTjqkYxl45mJfSw=",
-        "aarch64": "sha256-wpZwKN9gjb5r0yi8wNcN599KG9dWrIHHW5LhWWYWLzs="
+        "x86_64": "sha256-HF1RuiuDGFxwxFQrXXUcpssA4SnioTYGSjQrF0H/F2Q=",
+        "aarch64": "sha256-ZZ7Wy6Nua4sKPlFv/LaiM+pRrF23PEuUVK4I5rA40Sk="
      }
    },
    "rcp": {
      "description": "Eclipse IDE for RCP and RAP Developers",
      "dropUrl": false,
      "hashes": {
-        "x86_64": "sha256-fUVoq4h3nJ573CWREUJplEocz+f9ql5fa8AoC0B2ugs=",
-        "aarch64": "sha256-YAYMTzPXEGfmeNIQ1bnHyR/b3Jm6XvGbeaezNtBl2wU="
+        "x86_64": "sha256-jxLIw4MaLqAi+b6l6lf56cb9z7J8NBUJYbbxhv65uSc=",
+        "aarch64": "sha256-A+3dk2FZaXBO/pb9F/33imO0Fk6j4zszLfnDsP+znG4="
      }
    }
  }
@@ -3427,8 +3427,8 @@ let
        mktplcRef = {
          name = "remote-containers";
          publisher = "ms-vscode-remote";
-          version = "0.422.1";
-          hash = "sha256-UT0vveuvdw47Bko05kHrIQzqtJX96xFtlGDKrWlULos=";
+          version = "0.427.0";
+          hash = "sha256-aSwC8NLJxelv2B+FnF8rmA5pnowugmdF+gnm+A0qSiE=";
        };
        meta = {
          description = "Open any folder or repository inside a Docker container";
@@ -3461,8 +3461,8 @@ let
        mktplcRef = {
          name = "remote-wsl";
          publisher = "ms-vscode-remote";
-          version = "0.99.0";
-          hash = "sha256-zwM4gj11sM00HjaOUFEZ77Vm07iCDwwPmEqiJ97kXL8=";
+          version = "0.104.2";
+          hash = "sha256-kkMrsElu+QrIJXWpSHwKtJF+E5lpkVUVFO090DwXmM8=";
        };
        meta = {
          changelog = "https://marketplace.visualstudio.com/items/ms-vscode-remote.remote-wsl/changelog";
@@ -5034,8 +5034,8 @@ let
        mktplcRef = {
          name = "vscode-gradle";
          publisher = "vscjava";
-          version = "3.16.2024111106";
-          hash = "sha256-w+3YJCEoq8WZSozo5AGL9Ux/MSSKxwcrB7701qQ6XVE=";
+          version = "3.17.0";
+          hash = "sha256-SZRSSgi4/8cEHGvhoGf9J8hrSIQWn1sFTh4NSsJcMDg=";
        };

        meta = {
@@ -8,8 +8,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
  mktplcRef = {
    publisher = "RooVeterinaryInc";
    name = "roo-cline";
-    version = "3.27.0";
-    hash = "sha256-Lkn0yoe/Oy3bbhIWf+qj0pNYTQHDiFfNRSFHSGAqPVc=";
+    version = "3.28.3";
+    hash = "sha256-aBS6T8S8+D9FGIAPi5dELKyqt3/oqFVa6XNDcTMYkoM=";
  };

  passthru.updateScript = vscode-extension-update-script { };
@@ -798,7 +798,7 @@
    }
  },
  "ungoogled-chromium": {
-    "version": "140.0.7339.127",
+    "version": "140.0.7339.185",
    "deps": {
      "depot_tools": {
        "rev": "7d1e2bdb9168718566caba63a170a67cdab2356b",
@@ -810,16 +810,16 @@
        "hash": "sha256-Z7bTto8BHnJzjvmKmcVAZ0/BrXimcAETV6YGKNTorQw="
      },
      "ungoogled-patches": {
-        "rev": "140.0.7339.127-1",
-        "hash": "sha256-mhMudxJU2arMcmECS9+3ne9X66zyKq5WGc8PSx9RfLc="
+        "rev": "140.0.7339.185-1",
+        "hash": "sha256-hhmjjlir2g4RmHKkibmY1e/Ayabyy82jeQXvxQq9gJ4="
      },
      "npmHash": "sha256-R2gOpfPOUAmnsnUTIvzDPHuHNzL/b2fwlyyfTrywEcI="
    },
    "DEPS": {
      "src": {
        "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "9412745860d8c3dfed9cf38f5daa943b163f8c69",
-        "hash": "sha256-rAyS5AhWHL9+6N4+2PFYKPJjzErj8LfIm5ptcsTTV8E=",
+        "rev": "eeea00e459e8b6cd69698eda5b236a0d4cb3234d",
+        "hash": "sha256-BjjFH7/HhPBw/b7XmRZVNUrJYAUkWgCR0upHBn+Q5Ec=",
        "recompress": true
      },
      "src/third_party/clang-format/script": {
@@ -929,8 +929,8 @@
      },
      "src/third_party/dawn": {
        "url": "https://dawn.googlesource.com/dawn.git",
-        "rev": "8550f9c1ff8859d25cc49bdfacef083cff2c5121",
-        "hash": "sha256-gDtFhalOMFWR25XLVbYB/GE1lSQd1ClZ8h175qkC6PU="
+        "rev": "67be7fddacc4f4bcb21d0cf7bf8bb18752d8fb08",
+        "hash": "sha256-ulw+gDGpUn8uWuNedlfQADwnSYYbPWpHN5Q+pJbwKGc="
      },
      "src/third_party/dawn/third_party/glfw": {
        "url": "https://chromium.googlesource.com/external/github.com/glfw/glfw",
@@ -1589,8 +1589,8 @@
      },
      "src/v8": {
        "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "fdb12b460f148895f6af2ff0e0d870ff8889f154",
-        "hash": "sha256-x8a8VYFrAZ0huj3WRlczrhg0quXx4cztz8nDs9ToWYg="
+        "rev": "6d56a0bd0840ce46c80ada63f8c962bd1bb336aa",
+        "hash": "sha256-VtW/nwKo3jCYfLBHvpAVdLJIRNxw27RAP1K+WgaO5Uc="
      }
    }
  }
@@ -552,13 +552,13 @@
    "vendorHash": "sha256-fqVBnAivVekV+4tpkl+E6eNA3wi8mhLevJRCs3W7L2g="
  },
  "grafana": {
-    "hash": "sha256-z/XV4HMbwTAmAUDerFpukvapEHuWGGT/LPE/phtykIU=",
+    "hash": "sha256-HmHqRFdyzJLxkTIqde+NCv3FHILL4xjYFqlOiVCQprs=",
    "homepage": "https://registry.terraform.io/providers/grafana/grafana",
    "owner": "grafana",
    "repo": "terraform-provider-grafana",
-    "rev": "v4.5.3",
+    "rev": "v4.8.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-LkWUyuQYJYK5RK5DNKhbOQyfrg0qcM5Z+0oB65La3GQ="
+    "vendorHash": "sha256-0l2Y8mWsJzZ/j7isUullkZ48z/MyDYFid4crH8b0Hp8="
  },
  "gridscale": {
    "hash": "sha256-zD3KiTLKALVOvFOewWyrd65p0XmLOi/bSIP27dXwveU=",
@@ -597,11 +597,11 @@
    "vendorHash": "sha256-sPvX69R2BmlY/KhXZgxCunzseoOkz1h2b8yqekBBn0k="
  },
  "heroku": {
-    "hash": "sha256-Kc9/k+PyUHXj3F3YnqlPI+d7eroscBkdHt68nUbwyX8=",
+    "hash": "sha256-/2XfqyyoxwcFKgbLli1i7PX58OD0iczTPxVVz8Rkeoc=",
    "homepage": "https://registry.terraform.io/providers/heroku/heroku",
    "owner": "heroku",
    "repo": "terraform-provider-heroku",
-    "rev": "v5.2.11",
+    "rev": "v5.2.13",
    "spdx": null,
    "vendorHash": null
  },
@@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "air";
-  version = "1.62.0";
+  version = "1.63.0";

  src = fetchFromGitHub {
    owner = "air-verse";
    repo = "air";
    tag = "v${version}";
-    hash = "sha256-egduQyC/f8La39pWvVfDuQ2l5oRz5ZPiCqH8wAAS1OA=";
+    hash = "sha256-S8ARa6vZzKQTUhGt2eEdRDXCFyspSNLdGqhlIy0RjDc=";
  };

-  vendorHash = "sha256-ESrIn06Uhmq4qP1fdgIcao6ha1ZCqeu3cxJ1vvjRNKk=";
+  vendorHash = "sha256-1HUWdJc2YaLtszAswQTWn3bevDFJwY5xTCMlYM8j+GU=";

  ldflags = [
    "-s"
@@ -7,13 +7,13 @@

 buildGoModule (finalAttrs: {
  pname = "atlantis";
-  version = "0.35.1";
+  version = "0.36.0";

  src = fetchFromGitHub {
    owner = "runatlantis";
    repo = "atlantis";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-xYj6qu5bXpryuh2vqtYF+8HP/JRM5Cc8ctT+1S1gS2Q=";
+    hash = "sha256-STw7qQHLyST5eyr3siBY1adO2vyUEH1xlwatj3Oyp0U=";
  };

  ldflags = [
@@ -21,7 +21,7 @@ buildGoModule (finalAttrs: {
    "-X=main.date=1970-01-01T00:00:00Z"
  ];

-  vendorHash = "sha256-ac2IGN+wtDAXei1uxCIZQGOmwJ3+AhIX2qq0RMqO0G8=";
+  vendorHash = "sha256-GeO+T8PUrN1zX0S6roeles5sB68KwStiuQ65k+tNf68=";

  subPackages = [ "." ];

@@ -8,21 +8,25 @@

  # Required dependencies for autoPatchelfHook
  alsa-lib,
+  asar,
  gtk3,
  libgbm,
+  libGL,
  nspr,
  nss,
+  widevine-cdm,
 }:
 stdenv.mkDerivation rec {
  pname = "cider-2";
-  version = "3.0.0";
+  version = "3.1.1";

  src = fetchurl {
    url = "https://repo.cider.sh/apt/pool/main/cider-v${version}-linux-x64.deb";
-    hash = "sha256-XKyzt8QkPNQlgFxR12KA5t+PCJki7UuFpn4SGmoGkpg=";
+    hash = "sha256-2gd/ThI59GFU/lMKFLtwHeRWSqp14jFd8YMrV8Cu/oQ=";
  };

  nativeBuildInputs = [
+    asar
    dpkg
    autoPatchelfHook
    makeWrapper
@@ -32,6 +36,7 @@ stdenv.mkDerivation rec {
    alsa-lib
    gtk3
    libgbm
+    libGL
    nspr
    nss
  ];
@@ -54,10 +59,25 @@ stdenv.mkDerivation rec {
    runHook postInstall
  '';

+  postInstall = ''
+    ${lib.getExe asar} extract $out/lib/cider/resources/app.asar ./cider-build
+
+    # Patch login popup webview creation
+    substituteInPlace ./cider-build/.vite/build/events-*.js \
+      --replace-fail 'else if(c.includes(r))return{action:"allow"}' 'else if(c.includes(r))return{action:"allow",overrideBrowserWindowOptions:{webPreferences:{devTools:!0,nodeIntegration:!1,contextIsolation:!0,webSecurity:!1,sandbox:!1,experimentalFeatures:!0}}}'
+
+    ${lib.getExe asar} pack ./cider-build $out/lib/cider/resources/app.asar
+    rm -rf ./cider-build
+
+    # Install Widevine CDM for DRM support
+    ln -sf ${widevine-cdm}/share/google/chrome/WidevineCdm $out/lib/cider/
+  '';
+
  postFixup = ''
    makeWrapper $out/lib/cider/Cider $out/bin/${pname} \
      --add-flags "\$\{NIXOS_OZONE_WL:+\$\{WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime=true\}\}" \
-      --add-flags "--no-sandbox --disable-gpu-sandbox"
+      --add-flags "--no-sandbox --disable-gpu-sandbox" \
+      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ libGL ]}"

    mv $out/share/applications/cider.desktop $out/share/applications/${pname}.desktop
    substituteInPlace $out/share/applications/${pname}.desktop \
@@ -29,7 +29,7 @@ fi
 cd ../../../..

 if [[ "${1-default}" != "--deps-only" ]]; then
-    SHA="$(nix-prefetch-url --quiet --unpack --type sha256 $DEB_URL)"
+    SHA="$(nix-prefetch-url --quiet --type sha256 $DEB_URL)"
    SRI=$(nix --experimental-features nix-command hash to-sri "sha256:$SHA")
    update-source-version cider-2 "$NEW_VERSION" "$SRI"
 fi
@@ -10,16 +10,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "clipcat";
-  version = "0.21.0";
+  version = "0.21.1";

  src = fetchFromGitHub {
    owner = "xrelkd";
    repo = "clipcat";
    tag = "v${version}";
-    hash = "sha256-CIqV5V7NN2zsqBwheJrcBnOTOBEncIwqqXdsZ9DLAog=";
+    hash = "sha256-MYWkUb9v8hnW6gUTpIcz0+jhlc8y3hZxsEQxRIZVVxI=";
  };

-  cargoHash = "sha256-UA+NTtZ2qffUPUmvCidnTHwFzD3WOPTlxHR2e2vKwPQ=";
+  cargoHash = "sha256-7ntsq6x/8QFaU6Hl4tk+Rtvc8ttcK9Mp00nlirNlUKY=";

  patches = [
    # Fix compilation errors caused by stricter restrictions on unused code in Rust 1.89.
@@ -59,7 +59,7 @@ buildGoModule (finalAttrs: {
    changelog = "https://github.com/srl-labs/containerlab/releases/tag/v${finalAttrs.version}";
    license = lib.licenses.bsd3;
    platforms = lib.platforms.linux;
-    maintainers = with lib.maintainers; [ aaronjheng ];
+    maintainers = with lib.maintainers; [ ];
    mainProgram = "containerlab";
  };
 })
@@ -13,11 +13,11 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "copybara";
-  version = "20250901";
+  version = "20250915";

  src = fetchurl {
    url = "https://github.com/google/copybara/releases/download/v${finalAttrs.version}/copybara_deploy.jar";
-    hash = "sha256-yewUQIfQIMQMX92l2Cth76zfsMErpfhSa3/pZ8FZEYA=";
+    hash = "sha256-vDyLBavzdVzhX3fPpVUpc7Y6Dn9UGQpfoISyUX9ixek=";
  };

  nativeBuildInputs = [
@@ -10,13 +10,13 @@

 buildGoModule rec {
  pname = "ddev";
-  version = "1.24.7";
+  version = "1.24.8";

  src = fetchFromGitHub {
    owner = "ddev";
    repo = "ddev";
    rev = "v${version}";
-    hash = "sha256-1BlipTmpjoHjzDz5ueCYn410qzsVePikA1c5Z93Rboo=";
+    hash = "sha256-z0rxRY/Jxo+0aLj1vfODBVlmZYb3SOufctS7R9d/3gs=";
  };

  nativeBuildInputs = [
@@ -0,0 +1,32 @@
+diff --git a/src/main/versions.ts b/src/main/versions.ts
+index 501ba1a..0c11ff7 100644
+--- a/src/main/versions.ts
+++ b/src/main/versions.ts
+@@ -5,7 +5,6 @@ import { IpcMainInvokeEvent, app } from 'electron';
+ import fs from 'fs-extra';
+ 
+ import { ipcMainManager } from './ipc';
+-import releases from '../../static/releases.json';
+ import { InstallState, Version } from '../interfaces';
+ import { IpcEvents } from '../ipc-events';
+ 
+@@ -72,7 +71,6 @@ export async function fetchVersions(): Promise<Version[]> {
+ 
+ export async function setupVersions() {
+   knownVersions = await ElectronVersions.create({
+-    initialVersions: releases,
+     paths: {
+       versionsCache: path.join(app.getPath('userData'), 'releases.json'),
+     },
+diff --git a/tools/fetch-releases.ts b/tools/fetch-releases.ts
+index 744b814..94fd971 100644
+--- a/tools/fetch-releases.ts
+++ b/tools/fetch-releases.ts
+@@ -6,6 +6,7 @@ import { ElectronVersions } from '@electron/fiddle-core';
+ const file = path.join(__dirname, '..', 'static', 'releases.json');
+ 
+ export async function populateReleases() {
+  return;
+   const elves = await ElectronVersions.create({ ignoreCache: true });
+   const releases = elves.versions.map(({ version }) =>
+     elves.getReleaseInfo(version),
@@ -3,7 +3,6 @@
  electron_36,
  fetchFromGitHub,
  fetchYarnDeps,
-  fetchurl,
  git,
  lib,
  makeDesktopItem,
@@ -17,32 +16,26 @@

 let
  pname = "electron-fiddle";
-  version = "0.36.5-unstable-2025-07-17";
+  version = "0.37.2";

  src = fetchFromGitHub {
    owner = "electron";
    repo = "fiddle";
-    rev = "0f3cd3007a336562a3c49ce95469022e6a729121"; # a revision that uses electron_36 instead of electron_33
-    hash = "sha256-1q8bDpEPrQNbngrGZj6/AQFFo06ED6uJ4Z/XVg6KNXw=";
+    tag = "v${version}";
+    hash = "sha256-e9PLgkqWBNLBw7uuNpPluOQ6+aGLYQLyTzcLa+LMOzs=";
  };

  electron = electron_36;

-  # As of https://github.com/electron/fiddle/pull/1316 this is fetched
-  # from the network and has no stable hash.  Grab an old version from
-  # the repository.
-  releasesJson = fetchurl {
-    url = "https://raw.githubusercontent.com/electron/fiddle/v0.32.4~18/static/releases.json";
-    hash = "sha256-1sxd3eJ6/WjXS6XQbrgKUTNUmrhuc1dAvy+VAivGErg=";
-  };
-
  unwrapped = stdenvNoCC.mkDerivation {
    pname = "${pname}-unwrapped";
    inherit version src;

+    patches = [ ./dont-use-initial-releases-json.patch ];
+
    offlineCache = fetchYarnDeps {
-      yarnLock = "${src}/yarn.lock";
-      hash = "sha256-n6rzi4VohVaX+IIE1NITDsxXGyw0Z6Fx1WJb15YT9Sg=";
+      inherit src;
+      hash = "sha256-mB8WG6tX204u6AJ8qLbWrA+pSN3oDihHqj0t3bWcuAI=";
    };

    nativeBuildInputs = [
@@ -67,9 +60,7 @@ let

      # force @electron/packager to use our electron instead of downloading it, even if it is a different version
      substituteInPlace node_modules/@electron/packager/dist/packager.js \
-          --replace-fail 'await this.getElectronZipPath(downloadOpts)' '"electron.zip"'
-
-      ln -s ${releasesJson} static/releases.json
+        --replace-fail 'await this.getElectronZipPath(downloadOpts)' '"electron.zip"'
    '';

    yarnBuildScript = "package";
@@ -105,7 +96,7 @@ let
 in
 buildFHSEnv {
  inherit pname version;
-  runScript = "${electron}/bin/electron ${unwrapped}/lib/electron-fiddle/resources/app.asar";
+  runScript = "${lib.getExe electron} ${unwrapped}/lib/electron-fiddle/resources/app.asar";

  extraInstallCommands = ''
    mkdir -p "$out/share/icons/hicolor/scalable/apps"
@@ -10,7 +10,7 @@

 rustPlatform.buildRustPackage rec {
  pname = "ffizer";
-  version = "2.13.3";
+  version = "2.13.5";

  buildFeatures = [ "cli" ];

@@ -18,10 +18,10 @@ rustPlatform.buildRustPackage rec {
    owner = "ffizer";
    repo = "ffizer";
    rev = version;
-    hash = "sha256-S5iF2xjOw1g6scxUMGn6ghr3iASlLlz6IUYjsLo1wRk=";
+    hash = "sha256-kYsHhNW9UkttKVNEY9+Z9EZWDNIuhCWTmRJytaZVgKc=";
  };

-  cargoHash = "sha256-VYjxSZUFgdrYiL0yzHVLH3MgUx4geypxDV2h8lpqc0o=";
+  cargoHash = "sha256-zsJ5RjqxzCwRJQvWi65NwZ/w3lIvZvkE80EdmNeJUdg=";

  nativeBuildInputs = [
    pkg-config
@@ -6,15 +6,15 @@
 }:
 rustPlatform.buildRustPackage rec {
  pname = "firezone-gateway";
-  version = "1.4.15";
+  version = "1.4.16";
  src = fetchFromGitHub {
    owner = "firezone";
    repo = "firezone";
    tag = "gateway-${version}";
-    hash = "sha256-eIef5csbrZdh2e2fxBSBYAgHSpSfHCMTbatTsHZR8DY=";
+    hash = "sha256-Tu0Bq/Axj05dCRCd1eB7CiOXQ5n4i8hnE3ZiGCQ5ZdY=";
  };

-  cargoHash = "sha256-OAWPO18s9749nfkyPEaArRkxdqnCKo69k8ZSRS2Tyw0=";
+  cargoHash = "sha256-wlf+TtrRG7hHNav7WqLn2DSX9QkKFVzyiKP5CRdXlNY=";
  sourceRoot = "${src.name}/rust";
  buildAndTestSubdir = "gateway";
  RUSTFLAGS = "--cfg system_certs";
@@ -9,13 +9,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "gambit-project";
-  version = "16.3.1";
+  version = "16.4.0";

  src = fetchFromGitHub {
    owner = "gambitproject";
    repo = "gambit";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-yGA8w7Mz8D96Cci+LO1KUvTZDVc9V5b/0t7Q+UndHXI=";
+    hash = "sha256-fiWGRL7U4A7FKmAvzYt6WjlkOe0jSq3U2VfxPFvc+FA=";
  };

  nativeBuildInputs = [ autoreconfHook ] ++ lib.optional withGui wxGTK31;
@@ -6,13 +6,13 @@

 buildGoModule rec {
  pname = "github-commenter";
-  version = "0.28.0";
+  version = "0.29.0";

  src = fetchFromGitHub {
    owner = "cloudposse";
    repo = "github-commenter";
    rev = version;
-    hash = "sha256-x3/ae22ub9Us3mvSmvq9ohlkujvZCUfSrmZeQNvIWzE=";
+    hash = "sha256-ZQEiDY+gOnUMxolgreDWkm9Uuc72WxcysAkT5DK/XLc=";
  };

  vendorHash = "sha256-DS2cTYQasIKmyqHS3kTpNMA4fuLxSv4n7ZQjeRWE0gI=";
@@ -0,0 +1,39 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  llvmPackages,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "gklib";
+  version = "5.1.1-unstable-2025-07-15";
+
+  src = fetchFromGitHub {
+    owner = "KarypisLab";
+    repo = "GKlib";
+    rev = "6e7951358fd896e2abed7887196b6871aac9f2f8";
+    hash = "sha256-jT0hT5Y3E8GnE8OJWzDj5rtz9s59sMEXLduUnBV0I0Y=";
+  };
+
+  nativeBuildInputs = [ cmake ];
+
+  buildInputs = lib.optional stdenv.cc.isClang llvmPackages.openmp;
+
+  cmakeFlags = [
+    (lib.cmakeBool "OPENMP" true)
+    (lib.cmakeBool "BUILD_SHARED_LIBS" (!stdenv.hostPlatform.isStatic))
+    # Turns off using clflush/sfence insns in gkuniq test app
+    # https://github.com/KarypisLab/GKlib/issues/11#issuecomment-1532597211
+    (lib.cmakeBool "NO_X86" (!stdenv.hostPlatform.isx86))
+  ];
+
+  meta = {
+    description = "Library of various helper routines and frameworks used by many of the lab's software";
+    homepage = "https://github.com/KarypisLab/GKlib";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ qbisi ];
+    platforms = lib.platforms.all;
+  };
+})
@@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "go-dnscollector";
-  version = "1.10.0";
+  version = "1.11.0";

  src = fetchFromGitHub {
    owner = "dmachard";
    repo = "go-dnscollector";
    rev = "v${version}";
-    sha256 = "sha256-99mVCuoog9ZkJoCCcUWkRJ2vA0IwftEcsSl6I02Qd4A=";
+    sha256 = "sha256-2NHJs2KdSDw36ePG8s/YSU4wlWG+14NQ6oWJYqMv2Wk=";
  };

-  vendorHash = "sha256-se4vNVydYFYk07Shb3eRLnVmE82HG36cwFRYCdZiZPM=";
+  vendorHash = "sha256-N0gaDyOlRvFR1Buj/SKoOjwkVMRxd8Uj7iT/cDBfM9A=";

  subPackages = [ "." ];

@@ -8,13 +8,13 @@

 buildGoModule (finalAttrs: {
  pname = "gofumpt";
-  version = "0.9.0";
+  version = "0.9.1";

  src = fetchFromGitHub {
    owner = "mvdan";
    repo = "gofumpt";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-5+dc60PyU41NBKOmkp6IwhN+dPliaT38eUcyBNbPIbg=";
+    hash = "sha256-2JahPQQfiYfctMi7AqNB9Y1dS1Pg8usLtzM2wSlC5E0=";
  };

  vendorHash = "sha256-ziqhBWkfWQ0T+gLFqv352PtNcpyCTRFHBfV6iilVGLs=";
@@ -0,0 +1,57 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  yt-dlp,
+  mpv,
+  fzf,
+  chafa,
+  makeBinaryWrapper,
+  versionCheckHook,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "gophertube";
+  version = "2.8.0";
+
+  src = fetchFromGitHub {
+    owner = "KrishnaSSH";
+    repo = "GopherTube";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-0TStXYghfRR11ETJcK2lnkBtS2IUy/YgeFFn0wXpeOU=";
+  };
+
+  vendorHash = "sha256-WfVoCxzMk+h4AP1zgTNRXTpj8Ltu71YrsQ7OoU3Y4tg=";
+
+  ldflags = [
+    "-X gophertube/internal/app.version=${finalAttrs.version}"
+  ];
+
+  nativeBuildInputs = [ makeBinaryWrapper ];
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+  versionCheckProgramArg = "-v";
+
+  propagatedUserEnvPkgs = [
+    yt-dlp
+    mpv
+    fzf
+    chafa
+  ];
+
+  postInstall = ''
+    wrapProgram $out/bin/gophertube \
+      --suffix PATH : ${lib.makeBinPath finalAttrs.propagatedUserEnvPkgs}
+  '';
+
+  meta = {
+    description = "Terminal user interface for search and watching YouTube videos using mpv and chafa";
+    homepage = "https://github.com/KrishnaSSh/GopherTube";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [
+      spreetin
+      yiyu
+    ];
+    mainProgram = "gophertube";
+  };
+})
@@ -7,13 +7,13 @@
  lib,
 }:
 let
-  version = "0.11.2";
+  version = "0.11.3";

  src = fetchFromGitHub {
    repo = "gose";
    owner = "stv0g";
    tag = "v${version}";
-    hash = "sha256-AeGrnRnKThv29wFopx91BSep22WFkkKkUsTa7qFQOzs=";
+    hash = "sha256-dcx1uLLLFepqGTIJQNf3I1GzbXwrVPt7Jb8TW3AGnhU=";
  };

  frontend = buildNpmPackage {
@@ -37,7 +37,7 @@ buildGoModule {
  inherit version;
  inherit src;

-  vendorHash = "sha256-9qQXk8XyvVsussu5YfoSrjEul0E1301W019vTVSgnkk=";
+  vendorHash = "sha256-cvZLR5c8WqarhnXBFAyxUUQtqX2fhveonUtsrFjFmq0=";

  env.CGO_ENABLED = 0;

@@ -7,13 +7,13 @@

 buildGoModule rec {
  pname = "greenmask";
-  version = "0.2.13";
+  version = "0.2.14";

  src = fetchFromGitHub {
    owner = "GreenmaskIO";
    repo = "greenmask";
    tag = "v${version}";
-    hash = "sha256-aV/H2UuMm66No2J1t7VnO0s/WozacmCYsSgKb0SAupQ=";
+    hash = "sha256-AHZJWYHfUKYNXPP6vFIM5tdr5aQ8q2pkqB/M1lhxUic=";
  };

  vendorHash = "sha256-t2U65GAGBGdMRXPTkCQCuXfLuqohA6erTlvAN/xx/ek=";
@@ -14,7 +14,7 @@
 let
  self = python3Packages.buildPythonApplication rec {
    pname = "ifstate";
-    version = "2.0.0";
+    version = "2.0.1";
    pyproject = true;

    src = fetchFromGitea {
@@ -22,7 +22,7 @@ let
      owner = "liske";
      repo = "ifstate";
      tag = version;
-      hash = "sha256-YxLyiTVLN4nxc2ppqGGnYCGudbdPLSLV8EwDURtpO0U=";
+      hash = "sha256-QxjziDlkbTxAVd3qA8u4+JT8NWJxBMVAp7G5Zma9d10=";
    };

    postPatch = ''
@@ -6,16 +6,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "jsonwatch";
-  version = "0.8.0";
+  version = "0.9.0";

  src = fetchFromGitHub {
    owner = "dbohdan";
    repo = "jsonwatch";
    tag = "v${version}";
-    hash = "sha256-/DYKjhHjfXPWpU1RFmRUbartSxIBgVP59nbgwKMd0jg=";
+    hash = "sha256-HSyavdH3zhzEvk5qW5fiv8wqmgYsLUyx6Q6oEIOk5to=";
  };

-  cargoHash = "sha256-QVS+b/mH7hnzaZjnGg8rw6k11uOuKGFeiPoXyqwD8tk=";
+  cargoHash = "sha256-2CtB8TEn0bieT0S2w3cm4nLZWdFcIymvWSOnWDTXEJc=";

  meta = with lib; {
    description = "Like watch -d but for JSON";
@@ -27,6 +27,7 @@ rustPlatform.buildRustPackage rec {
      differences when the data changes.
    '';
    homepage = "https://github.com/dbohdan/jsonwatch";
+    changelog = "https://github.com/dbohdan/jsonwatch/releases/tag/${src.tag}";
    license = licenses.mit;
    maintainers = with maintainers; [ fab ];
    mainProgram = "jsonwatch";
@@ -5,7 +5,7 @@
  nix-update-script,
 }:
 let
-  version = "0.7.9";
+  version = "0.8.0";
 in
 buildGoModule {
  pname = "lazyjournal";
@@ -15,10 +15,10 @@ buildGoModule {
    owner = "Lifailon";
    repo = "lazyjournal";
    tag = version;
-    hash = "sha256-ohMcTu4sK5M11FY2QkJcHnNxx6pmscdH3S2MbWorUVM=";
+    hash = "sha256-dQKd7u4IGQWw8ExoHLd5qRenE07UQz69GNqGIAWN7ok=";
  };

-  vendorHash = "sha256-faMGgTJuD/6CqR+OfGknE0dGdDOSwoODySNcb3kBLv8=";
+  vendorHash = "sha256-Wl8DmEBt1YtTk9QEvWybSWRQm0Lnfd5q3C/wg+gP33g=";

  ldflags = [
    "-s"
@@ -6,14 +6,14 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "ldeep";
-  version = "1.0.87";
+  version = "1.0.88";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "franc-pentest";
    repo = "ldeep";
    tag = version;
-    hash = "sha256-ym26uCWJU5fEbOyPxI8qUvorWj3HzCcHSmBk8kXPQUQ=";
+    hash = "sha256-Auh9KCyPO1bWKY1wd9As5eycJfUhj0IhX/9xp99skhA=";
  };

  pythonRelaxDeps = [
@@ -19,7 +19,6 @@
  icu,
  spdlog,
  onetbb,
-  yaml-cpp,
 }:

 stdenv.mkDerivation (finalAttrs: {
@@ -72,7 +71,6 @@ stdenv.mkDerivation (finalAttrs: {
    spdlog
    onetbb

-    finalAttrs.passthru.yaml-cpp # has merge-key support
    finalAttrs.passthru.libloadorder
    finalAttrs.passthru.esplugin
    finalAttrs.passthru.loot-condition-interpreter
@@ -83,6 +81,7 @@ stdenv.mkDerivation (finalAttrs: {
    (lib.cmakeFeature "LIBLOADORDER_LIBRARIES" "loadorder_ffi")
    (lib.cmakeFeature "LCI_LIBRARIES" "loot_condition_interpreter_ffi")
    (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_TESTING-PLUGINS" "../testing-plugins")
+    (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_YAML-CPP" "${finalAttrs.passthru.yaml-cpp-src}")
    (lib.cmakeBool "LIBLOOT_BUILD_TESTS" finalAttrs.finalPackage.doCheck)
    (lib.cmakeBool "LIBLOOT_INSTALL_DOCS" withDocs)
  ];
@@ -116,6 +115,13 @@ stdenv.mkDerivation (finalAttrs: {
      hash = "sha256-3Aa98EwqpuGA3YlsRF8luWzXVEFO/rs6JXisXdLyIK4=";
    };

+    yaml-cpp-src = fetchFromGitHub {
+      owner = "loot";
+      repo = "yaml-cpp";
+      tag = "0.8.0+merge-key-support.2";
+      hash = "sha256-whYorebrLiDeO75LC2SMUX/8OD528BR0+DEgnJxxpoQ=";
+    };
+
    buildRustFFIPackage =
      args:
      rustPlatform.buildRustPackage (
@@ -185,16 +191,6 @@ stdenv.mkDerivation (finalAttrs: {
      lang = "c";
      header = "loot_condition_interpreter.h";
    };
-
-    yaml-cpp = yaml-cpp.overrideAttrs rec {
-      version = "0.8.0+merge-key-support.2";
-      src = fetchFromGitHub {
-        owner = "loot";
-        repo = "yaml-cpp";
-        tag = version;
-        hash = "sha256-whYorebrLiDeO75LC2SMUX/8OD528BR0+DEgnJxxpoQ=";
-      };
-    };
  };

  meta = {
@@ -7,10 +7,10 @@
 let
  pname = "lmstudio";

-  version_aarch64-darwin = "0.3.25-2";
-  hash_aarch64-darwin = "sha256-tbV7b59+98hf0eqkciGz0Zihx8I0+I+Y7gg+sg5fMqc=";
-  version_x86_64-linux = "0.3.25-2";
-  hash_x86_64-linux = "sha256-5KYZpQt0Y7oRIkXZ5Nyv2FkCl0T+KHsoC1zL4TjbcN4=";
+  version_aarch64-darwin = "0.3.26-6";
+  hash_aarch64-darwin = "sha256-2ss6lMU4vb3m23v1qQWFn4U1p+fZ2mSGVVkKw3ETgXc=";
+  version_x86_64-linux = "0.3.26-6";
+  hash_x86_64-linux = "sha256-UKdopw/sMuXY460KA9Oj8ckANdFDt2VApEsSZ1Gh1Wo=";

  meta = {
    description = "LM Studio is an easy to use desktop app for experimenting with local and open-source Large Language Models (LLMs)";
@@ -7,13 +7,13 @@

 buildGoModule rec {
  pname = "melange";
-  version = "0.31.1";
+  version = "0.31.4";

  src = fetchFromGitHub {
    owner = "chainguard-dev";
    repo = "melange";
    rev = "v${version}";
-    hash = "sha256-yCBzeGvGKjYFTkWSPGuFSDH4j+NhfooZgTAVkMHTHsI=";
+    hash = "sha256-ONPQi7QNDyh/KVPFn9YNaMBSi205S7lgM6m3wWXb424=";
    # populate values that require us to use git. By doing this in postFetch we
    # can delete .git afterwards and maintain better reproducibility of the src.
    leaveDotGit = true;
@@ -26,7 +26,7 @@ buildGoModule rec {
    '';
  };

-  vendorHash = "sha256-izOOa98/cKom0PIttwuzInCvAg4zP0SxbLblKKB5oBI=";
+  vendorHash = "sha256-52wU1icjR70EASU5DIu7Dpu8jEQv0vu69Qoibp6uB1o=";

  subPackages = [ "." ];

@@ -1,34 +1,56 @@
 {
  lib,
  stdenv,
-  fetchurl,
-  unzip,
+  fetchFromGitHub,
+  fetchpatch,
  cmake,
+  gklib,
+  llvmPackages,
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "metis";
-  version = "5.1.0";
+  version = "5.2.1";

-  src = fetchurl {
-    url = "http://glaros.dtc.umn.edu/gkhome/fetch/sw/metis/metis-${version}.tar.gz";
-    sha256 = "1cjxgh41r8k6j029yxs8msp3z6lcnpm16g5pvckk35kc7zhfpykn";
+  src = fetchFromGitHub {
+    owner = "KarypisLab";
+    repo = "METIS";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-eddLR6DvZ+2LeR0DkknN6zzRvnW+hLN2qeI+ETUPcac=";
  };

-  cmakeFlags = [
-    "-DGKLIB_PATH=../GKlib"
-    # remove once updated past https://github.com/KarypisLab/METIS/commit/521a2c360dc21ace5c4feb6dc0b7992433e3cb0f
-    "-DCMAKE_SKIP_BUILD_RPATH=ON"
+  patches = [
+    # fix gklib link error
+    (fetchpatch {
+      url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/sci-libs/metis/files/metis-5.2.1-add-gklib-as-required.patch?id=c78ecbd3fdf9b33e307023baf0de12c4448dd283";
+      hash = "sha256-uoXMi6pMs5VrzUmjsLlQYFLob1A8NAt9CbFi8qhQXVQ=";
+    })
+    # cmake 4 compatibility
+    (fetchpatch {
+      name = "metis-cmake-minimum-required-bump.patch";
+      url = "https://github.com/KarypisLab/METIS/commit/350931887dfc00c2e3cb7551c5abf30e0297126a.patch";
+      hash = "sha256-vX1GSZOLDxO9IIAQmNa9ADreEWSHCU9eF9L8qiSHye8=";
+    })
  ];
-  nativeBuildInputs = [
-    unzip
-    cmake
+
+  nativeBuildInputs = [ cmake ];
+
+  buildInputs = [ gklib ] ++ lib.optional stdenv.cc.isClang llvmPackages.openmp;
+
+  preConfigure = ''
+    make config
+  '';
+
+  cmakeFlags = [
+    (lib.cmakeBool "OPENMP" true)
+    (lib.cmakeBool "SHARED" (!stdenv.hostPlatform.isStatic))
  ];

  meta = {
    description = "Serial graph partitioning and fill-reducing matrix ordering";
-    homepage = "http://glaros.dtc.umn.edu/gkhome/metis/metis/overview";
+    homepage = "https://github.com/KarypisLab/METIS";
    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ qbisi ];
    platforms = lib.platforms.all;
  };
-}
+})
@@ -21,16 +21,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "mise";
-  version = "2025.8.20";
+  version = "2025.9.10";

  src = fetchFromGitHub {
    owner = "jdx";
    repo = "mise";
    rev = "v${version}";
-    hash = "sha256-zjb0ND6U/fe/1h+0LdTDYLIpsSPTvGhWOhFOb4vmiT0=";
+    hash = "sha256-CPi0scFKv8+K/s7wh6cdURyzKA3frSPf59kq6Y2XDV0=";
  };

-  cargoHash = "sha256-kebXsDAtQjEtAVCD76n5/A9hB1Sj+ww9MoHcfm/ucBs=";
+  cargoHash = "sha256-lbSGcnkiJYTI0VyUskxH+sxAUr+loI2mhyWaK/DgMN8=";

  nativeBuildInputs = [
    installShellFiles
@@ -6,17 +6,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "mitra";
-  version = "4.9.0";
+  version = "4.10.0";

  src = fetchFromGitea {
    domain = "codeberg.org";
    owner = "silverpill";
    repo = "mitra";
    rev = "v${version}";
-    hash = "sha256-2/BQ0AScDCns9ddmr3VdFn6+eDnfzFoDHdxLVKvFEL8=";
+    hash = "sha256-r3sV066IzJ/dQomt/HPxWPcUYXohoOhP4g3Jn/5HXyg=";
  };

-  cargoHash = "sha256-kwFoPnR8Wq/iqnc3TG/foqhMmRQk7VQ1UF50jyp970w=";
+  cargoHash = "sha256-zGyWj1SgaoCT4OvMrhMgOD49glBBYQKLGoeanhl8W9U=";

  # require running database
  doCheck = false;
@@ -16,13 +16,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "opensoundmeter";
-  version = "1.5.1";
+  version = "1.5.2";

  src = fetchFromGitHub {
    owner = "psmokotnin";
    repo = "osm";
    rev = "v${version}";
-    hash = "sha256-Yj/1XbQQtAWub+ZPFAtyFyAgjdjX+sCvIL7W2dnEc4s=";
+    hash = "sha256-jM9tkfNjPNHcPOG0n7NeohC/O3E6CUspOF3UTkQ2rs8=";
  };

  patches = [ ./build.patch ];
@@ -3,23 +3,21 @@
  buildGoModule,
  fetchFromGitHub,
  installShellFiles,
-  testers,
-  oras,
  versionCheckHook,
 }:

 buildGoModule (finalAttrs: {
  pname = "oras";
-  version = "1.2.3";
+  version = "1.3.0";

  src = fetchFromGitHub {
    owner = "oras-project";
    repo = "oras";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-IXIw2prApg5iL3BPbOY4x09KjyhFvKofgfz2L6UXKR8=";
+    hash = "sha256-kGPHW+SSmCJhvhGxpzKFlc80sjYqeCEmwr/f0ltILE4=";
  };

-  vendorHash = "sha256-PLGWPoMCsmdnsKD/FdaRHGO0X9/0Y/8DWV21GsCBR04=";
+  vendorHash = "sha256-TDYvYmzAgkL+ZrYKt9HTW7NQAGxd/cYu7e7MRYbW8ho=";

  nativeBuildInputs = [ installShellFiles ];

@@ -3,31 +3,35 @@
  stdenv,
  fetchFromGitHub,
  cmake,
+  gklib,
  metis,
  mpi,
 }:

 stdenv.mkDerivation {
  pname = "parmetis";
-  version = "4.0.3";
+  version = "4.0.3-unstable-2023-03-26";

  src = fetchFromGitHub {
    owner = "KarypisLab";
    repo = "ParMETIS";
-    rev = "d90a2a6cf08d1d35422e060daa28718376213659";
-    hash = "sha256-22YQxwC0phdMLX660wokRgmAif/9tRbUmQWwNMZ//7M=";
+    rev = "8ee6a372ca703836f593e3c450ca903f04be14df";
+    hash = "sha256-L9SLyr7XuBUniMH3JtaBrUHIGzVTF5pr014xovQf2cI=";
  };

  nativeBuildInputs = [ cmake ];
  enableParallelBuilding = true;
-  buildInputs = [ mpi ];
+  buildInputs = [
+    gklib
+    metis
+    mpi
+  ];

  configurePhase = ''
    runHook preConfigure

-    tar xf ${metis.src}
-    mv metis-* metis
-    make config metis_path=metis gklib_path=metis/GKlib prefix=$out
+    make config metis_path=${metis} gklib_path=${gklib} prefix=$out \
+       shared=${if stdenv.hostPlatform.isStatic then "0" else "1"}

    runHook postConfigure
  '';
@@ -8,16 +8,16 @@

 buildNpmPackage rec {
  pname = "repomix";
-  version = "1.4.2";
+  version = "1.5.0";

  src = fetchFromGitHub {
    owner = "yamadashy";
    repo = "repomix";
    tag = "v${version}";
-    hash = "sha256-65A8HN0Mp8QOEfIjiDZwr/qgWe57XTCdd1eBd3mm9fE=";
+    hash = "sha256-fAno9fGmr+iEFDWRxDgX+QICxvQxiPv9o15+lH4I50Y=";
  };

-  npmDepsHash = "sha256-PfElq+C8kazP3OLF5LFAZitIXhVpWdj/fCyH2S7d/zg=";
+  npmDepsHash = "sha256-qF4GvgyEAZSrgCYVhX1FbD2UG1M/tXG/R0bQrOiECU8=";

  nativeInstallCheckInputs = [ versionCheckHook ];
  doInstallCheck = true;
@@ -8,12 +8,12 @@

 python3Packages.buildPythonApplication rec {
  pname = "sacad";
-  version = "2.8.0";
+  version = "2.8.1";
  format = "setuptools";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-/NyRnQSqDZv+LJ1bPO35T9icQ2PN9Oa+nSmrLkQimnQ=";
+    hash = "sha256-WHxZZrKPTsTaIJGxD7ZUYQNz9ua024MXoflEVGNE9Jc=";
  };

  propagatedBuildInputs = with python3Packages; [
@@ -10,13 +10,13 @@

 stdenv.mkDerivation rec {
  pname = "sentry-native";
-  version = "0.10.1";
+  version = "0.11.0";

  src = fetchFromGitHub {
    owner = "getsentry";
    repo = "sentry-native";
    tag = version;
-    hash = "sha256-99C4Nd2YdUElMpbKrNIBjicaWHR2MVqHUu5KryYAT/I=";
+    hash = "sha256-PEm6Vu5MTT+T28jNnsRkHQo2k3o1ZbHQV8hOo7VKNbQ=";
  };

  nativeBuildInputs = [
@@ -28,24 +28,27 @@
  sdl3,
  sndio,
  stb,
+  toml11,
  vulkan-headers,
  vulkan-loader,
  vulkan-memory-allocator,
+  xbyak,
  xorg,
  xxHash,
  zlib-ng,
+  zydis,
  nix-update-script,
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "shadps4";
-  version = "0.10.0";
+  version = "0.11.0";

  src = fetchFromGitHub {
    owner = "shadps4-emu";
    repo = "shadPS4";
    tag = "v.${finalAttrs.version}";
-    hash = "sha256-0wvxvKw2XHhnXiM5DiiiY+nWPoze0fvNCJeTsKzoCn0=";
+    hash = "sha256-ZHgwFWSoEaWILTafet5iQvaLwLtXy3HuCxjkQMt4PBA=";
    fetchSubmodules = true;
  };

@@ -79,11 +82,14 @@ stdenv.mkDerivation (finalAttrs: {
    sdl3
    sndio
    stb
+    toml11
    vulkan-headers
    vulkan-loader
    vulkan-memory-allocator
+    xbyak
    xxHash
    zlib-ng
+    zydis
  ];

  nativeBuildInputs = [
@@ -0,0 +1,7 @@
+{
+  "permission_handler": "sha256-b2igh231BkLe/vkCACVyWg8SxR5V6wjmhPljEs9Ue3o=",
+  "permission_handler_windows": "sha256-b2igh231BkLe/vkCACVyWg8SxR5V6wjmhPljEs9Ue3o=",
+  "sideswap_logger": "sha256-cTJfSODRmIJXctLQ++BfvJ6OKflau94AjQdXg7j95B0=",
+  "sideswap_websocket": "sha256-vsG5eUFu/WJvY3y6jaWD/5GfULwpqh3bO4EZmmBSkbs=",
+  "window_size": "sha256-+lqY46ZURT0qcqPvHFXUnd83Uvfq79Xr+rw1AHqrpak="
+}
@@ -9,17 +9,17 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "libsideswap-client";
-  version = "0-unstable-2025-06-05";
+  version = "0-unstable-2025-06-24";

  # This version is pinned in https://github.com/sideswap-io/sideswapclient/blob/v1.8.0/deploy/build_linux.sh
  src = fetchFromGitHub {
    owner = "sideswap-io";
    repo = "sideswap_rust";
-    rev = "0ba7485f77c86d1a6ae64a0cfedba22afe4ed98a";
-    hash = "sha256-6qfFpCE6DMZlKuhQbXjJmmb8rPxFB2TA7CpOk06tuDk=";
+    rev = "91791efbceb3fac4774d1e42a519e70b14b876cf";
+    hash = "sha256-SUAmmKnL/thGLfPU22UxzO+LVXgrHh+lZVdXuAJ4q1E=";
  };

-  cargoHash = "sha256-ecftCyNMRWdFP5SDEmLnssTVSfg9mo/TQEqyeDj4VpQ=";
+  cargoHash = "sha256-bbNFi0cmFFf66IDKi0V8HC/lSU3JLRpgZ+NHeMJog8c=";

  # sideswap_client uses vergen to detect Git commit hash at build time. It
  # tries to access .git directory which is not present in Nix build dir.
@@ -2,11 +2,16 @@
  lib,
  fetchFromGitHub,
  flutter332,
-  mesa,
-  libglvnd,
  callPackage,
  makeDesktopItem,
  copyDesktopItems,
+
+  # Needed for update script.
+  _experimental-update-script-combinators,
+  gitUpdater,
+  runCommand,
+  sideswap,
+  yq,
 }:

 let
@@ -16,29 +21,22 @@ in

 flutter332.buildFlutterApplication rec {
  pname = "sideswap";
-  version = "1.8.0";
+  version = "1.8.2";

  src = fetchFromGitHub {
    owner = "sideswap-io";
    repo = "sideswapclient";
    tag = "v${version}";
-    hash = "sha256-IUUMlaEIUil07nhjep1I+F1WEWakQZfhy42ZlnyRLcQ=";
+    hash = "sha256-+zaQJCMKQZOrZ7i6CzgGTa+rJqpglaufUvYWSWMWTEw=";
  };

  pubspecLock = lib.importJSON ./pubspec.lock.json;
-
-  gitHashes = {
-    sideswap_logger = "sha256-cTJfSODRmIJXctLQ++BfvJ6OKflau94AjQdXg7j95B0=";
-    sideswap_websocket = "sha256-vsG5eUFu/WJvY3y6jaWD/5GfULwpqh3bO4EZmmBSkbs=";
-    window_size = "sha256-+lqY46ZURT0qcqPvHFXUnd83Uvfq79Xr+rw1AHqrpak=";
-  };
+  gitHashes = lib.importJSON ./gitHashes.json;

  # Provide OpenGL and libsideswap_client.so for the Flutter application.
  extraWrapProgramArgs = ''
-    --set LD_LIBRARY_PATH ${
+    --prefix LD_LIBRARY_PATH : ${
      lib.makeLibraryPath [
-        mesa
-        libglvnd
        libsideswap-client
      ]
    }
@@ -72,6 +70,40 @@ flutter332.buildFlutterApplication rec {
    copyDesktopItems
  ];

+  passthru = {
+    # Expose lib to access it via sideswap.lib from the update script.
+    lib = libsideswap-client;
+
+    pubspecSource =
+      runCommand "pubspec.lock.json"
+        {
+          nativeBuildInputs = [ yq ];
+          inherit (sideswap) src;
+        }
+        ''
+          cat $src/pubspec.lock | yq > $out
+        '';
+
+    # Usage: nix-shell maintainers/scripts/update.nix --argstr package sideswap
+    updateScript = _experimental-update-script-combinators.sequence [
+      # Update sideswap to new release.
+      (gitUpdater { rev-prefix = "v"; })
+
+      # Update pubspec.lock.json file and related gitHashes attribute.
+      (_experimental-update-script-combinators.copyAttrOutputToFile "sideswap.pubspecSource" ./pubspec.lock.json)
+      {
+        command = [ ./update-gitHashes.py ];
+        supportedFeatures = [ "silent" ];
+      }
+
+      # Update libsideswap-client sub-package.
+      {
+        command = [ ./update-libsideswap-client.sh ];
+        supportedFeatures = [ "silent" ];
+      }
+    ];
+  };
+
  meta = {
    description = "Cross‑platform, non‑custodial wallet and atomic swap marketplace for the Liquid Network";
    homepage = "https://sideswap.io/";
@@ -14,11 +14,11 @@
      "dependency": "transitive",
      "description": {
        "name": "_flutterfire_internals",
-        "sha256": "214e6f07e2a44f45972e0365c7b537eaeaddb4598db0778dd4ac64b4acd3f5b1",
+        "sha256": "dda4fd7909a732a014239009aa52537b136f8ce568de23c212587097887e2307",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "1.3.55"
+      "version": "1.3.56"
    },
    "analyzer": {
      "dependency": "transitive",
@@ -154,11 +154,11 @@
      "dependency": "transitive",
      "description": {
        "name": "build",
-        "sha256": "cef23f1eda9b57566c81e2133d196f8e3df48f244b317368d65c5943d91148f0",
+        "sha256": "486337d40a48d75049f2a01efceefc1412e3a6d6342d39624753e7d5a4e70016",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "2.4.2"
+      "version": "2.5.1"
    },
    "build_config": {
      "dependency": "transitive",
@@ -184,31 +184,31 @@
      "dependency": "transitive",
      "description": {
        "name": "build_resolvers",
-        "sha256": "b9e4fda21d846e192628e7a4f6deda6888c36b5b69ba02ff291a01fd529140f0",
+        "sha256": "abe6e4b5b36ce2bf01aec8f2a59424d1ecfc3cb340e7145a64359adc7233a0d1",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "2.4.4"
+      "version": "2.5.1"
    },
    "build_runner": {
      "dependency": "direct dev",
      "description": {
        "name": "build_runner",
-        "sha256": "058fe9dce1de7d69c4b84fada934df3e0153dd000758c4d65964d0166779aa99",
+        "sha256": "398ec7898b9b60be126067835a8202240b26dc54aa34d91d0198a539dcd5942e",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "2.4.15"
+      "version": "2.5.1"
    },
    "build_runner_core": {
      "dependency": "transitive",
      "description": {
        "name": "build_runner_core",
-        "sha256": "22e3aa1c80e0ada3722fe5b63fd43d9c8990759d0a2cf489c8c5d7b2bdebc021",
+        "sha256": "9821dbf604ed74a6dabeaba0c33ac58190332ea238862a62cdf25fc8eba226b8",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "8.0.0"
+      "version": "9.0.1"
    },
    "built_collection": {
      "dependency": "transitive",
@@ -263,11 +263,11 @@
      "dependency": "transitive",
      "description": {
        "name": "checked_yaml",
-        "sha256": "feb6bed21949061731a7a75fc5d2aa727cf160b91af9a3e464c5e3a32e28b5ff",
+        "sha256": "959525d3162f249993882720d52b7e0c833978df229be20702b33d48d91de70f",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "2.0.3"
+      "version": "2.0.4"
    },
    "ci": {
      "dependency": "transitive",
@@ -433,11 +433,11 @@
      "dependency": "direct main",
      "description": {
        "name": "decimal",
-        "sha256": "28239b8b929c1bd8618702e6dbc96e2618cf99770bbe9cb040d6cf56a11e4ec3",
+        "sha256": "6c2041df7caefc9393ae0b0dcc4abc700831014a2c252dd10e3952499673f0b2",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "3.2.1"
+      "version": "3.2.2"
    },
    "delayed_display": {
      "dependency": "direct main",
@@ -453,21 +453,21 @@
      "dependency": "transitive",
      "description": {
        "name": "device_info_plus",
-        "sha256": "0c6396126421b590089447154c5f98a5de423b70cfb15b1578fd018843ee6f53",
+        "sha256": "98f28b42168cc509abc92f88518882fd58061ea372d7999aecc424345c7bff6a",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "11.4.0"
+      "version": "11.5.0"
    },
    "device_info_plus_platform_interface": {
      "dependency": "transitive",
      "description": {
        "name": "device_info_plus_platform_interface",
-        "sha256": "0b04e02b30791224b31969eb1b50d723498f402971bff3630bca2ba839bd1ed2",
+        "sha256": "e1ea89119e34903dca74b883d0dd78eb762814f97fb6c76f35e9ff74d261a18f",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "7.0.2"
+      "version": "7.0.3"
    },
    "dotted_line": {
      "dependency": "direct main",
@@ -653,11 +653,11 @@
      "dependency": "transitive",
      "description": {
        "name": "firebase_core",
-        "sha256": "8cfe3c900512399ce8d50fcc817e5758ff8615eeb6fa5c846a4cc47bbf6353b6",
+        "sha256": "420d9111dcf095341f1ea8fdce926eef750cf7b9745d21f38000de780c94f608",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "3.13.1"
+      "version": "3.14.0"
    },
    "firebase_core_platform_interface": {
      "dependency": "transitive",
@@ -683,31 +683,31 @@
      "dependency": "transitive",
      "description": {
        "name": "firebase_messaging",
-        "sha256": "38111089e511f03daa2c66b4c3614c16421b7d78c84ee04331a0a65b47df4542",
+        "sha256": "758461f67b96aa5ad27625aaae39882fd6d1961b1c7e005301f9a74b6336100b",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "15.2.6"
+      "version": "15.2.7"
    },
    "firebase_messaging_platform_interface": {
      "dependency": "transitive",
      "description": {
        "name": "firebase_messaging_platform_interface",
-        "sha256": "ba254769982e5f439e534eed68856181c74e2b3f417c8188afad2bb440807cc7",
+        "sha256": "614db1b0df0f53e541e41cc182b6d7ede5763c400f6ba232a5f8d0e1b5e5de32",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "4.6.6"
+      "version": "4.6.7"
    },
    "firebase_messaging_web": {
      "dependency": "transitive",
      "description": {
        "name": "firebase_messaging_web",
-        "sha256": "dba89137272aac39e95f71408ba25c33fb8ed903cd5fa8d1e49b5cd0d96069e0",
+        "sha256": "b5fbbcdd3e0e7f3fde72b0c119410f22737638fed5fc428b54bba06bc1455d81",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "3.10.6"
+      "version": "3.10.7"
    },
    "fixnum": {
      "dependency": "direct main",
@@ -925,11 +925,11 @@
      "dependency": "direct main",
      "description": {
        "name": "flutter_svg",
-        "sha256": "d44bf546b13025ec7353091516f6881f1d4c633993cb109c3916c3a0159dadf1",
+        "sha256": "cd57f7969b4679317c17af6fd16ee233c1e60a82ed209d8a475c54fd6fd6f845",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "2.1.0"
+      "version": "2.2.0"
    },
    "flutter_switch": {
      "dependency": "direct main",
@@ -1397,11 +1397,11 @@
      "dependency": "direct main",
      "description": {
        "name": "mobile_scanner",
-        "sha256": "72f06a071aa8b14acea3ab43ea7949eefe4a2469731ae210e006ba330a033a8c",
+        "sha256": "54005bdea7052d792d35b4fef0f84ec5ddc3a844b250ecd48dc192fb9b4ebc95",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "7.0.0"
+      "version": "7.0.1"
    },
    "mocktail": {
      "dependency": "direct main",
@@ -1526,11 +1526,12 @@
    "permission_handler": {
      "dependency": "transitive",
      "description": {
-        "name": "permission_handler",
-        "sha256": "2d070d8684b68efb580a5997eb62f675e8a885ef0be6e754fb9ef489c177470f",
-        "url": "https://pub.dev"
+        "path": "permission_handler",
+        "ref": "main",
+        "resolved-ref": "0486bb15754240c1b8bc79e78f68c9f6ef9e9b92",
+        "url": "https://github.com/malcolmpl/flutter-permission-handler"
      },
-      "source": "hosted",
+      "source": "git",
      "version": "12.0.0+1"
    },
    "permission_handler_android": {
@@ -1576,11 +1577,12 @@
    "permission_handler_windows": {
      "dependency": "transitive",
      "description": {
-        "name": "permission_handler_windows",
-        "sha256": "1a790728016f79a41216d88672dbc5df30e686e811ad4e698bfc51f76ad91f1e",
-        "url": "https://pub.dev"
+        "path": "permission_handler_windows",
+        "ref": "main",
+        "resolved-ref": "0486bb15754240c1b8bc79e78f68c9f6ef9e9b92",
+        "url": "https://github.com/malcolmpl/flutter-permission-handler"
      },
-      "source": "hosted",
+      "source": "git",
      "version": "0.2.1"
    },
    "petitparser": {
@@ -1991,7 +1993,7 @@
        "relative": true
      },
      "source": "path",
-      "version": "0.1.22"
+      "version": "0.1.24"
    },
    "sideswap_notifications_platform_interface": {
      "dependency": "direct main",
@@ -2000,7 +2002,7 @@
        "relative": true
      },
      "source": "path",
-      "version": "0.0.25"
+      "version": "0.0.27"
    },
    "sideswap_permissions": {
      "dependency": "direct main",
@@ -2009,7 +2011,7 @@
        "relative": true
      },
      "source": "path",
-      "version": "0.0.18"
+      "version": "0.0.20"
    },
    "sideswap_protobuf": {
      "dependency": "direct main",
@@ -2018,7 +2020,7 @@
        "relative": true
      },
      "source": "path",
-      "version": "0.0.14"
+      "version": "0.0.15"
    },
    "sideswap_websocket": {
      "dependency": "direct main",
@@ -2381,11 +2383,11 @@
      "dependency": "transitive",
      "description": {
        "name": "vector_graphics",
-        "sha256": "44cc7104ff32563122a929e4620cf3efd584194eec6d1d913eb5ba593dbcf6de",
+        "sha256": "a4f059dc26fc8295b5921376600a194c4ec7d55e72f2fe4c7d2831e103d461e6",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "1.1.18"
+      "version": "1.1.19"
    },
    "vector_graphics_codec": {
      "dependency": "transitive",
@@ -2431,11 +2433,11 @@
      "dependency": "transitive",
      "description": {
        "name": "watcher",
-        "sha256": "69da27e49efa56a15f8afe8f4438c4ec02eff0a117df1b22ea4aad194fe1c104",
+        "sha256": "0b7fd4a0bbc4b92641dbf20adfd7e3fd1398fe17102d94b674234563e110088a",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "1.1.1"
+      "version": "1.1.2"
    },
    "web": {
      "dependency": "transitive",
@@ -2481,11 +2483,11 @@
      "dependency": "transitive",
      "description": {
        "name": "win32",
-        "sha256": "329edf97fdd893e0f1e3b9e88d6a0e627128cc17cc316a8d67fda8f1451178ba",
+        "sha256": "66814138c3562338d05613a6e368ed8cfb237ad6d64a9e9334be3f309acfca03",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "5.13.0"
+      "version": "5.14.0"
    },
    "win32_registry": {
      "dependency": "transitive",
@@ -2561,6 +2563,6 @@
  },
  "sdks": {
    "dart": ">=3.8.1 <4.0.0",
-    "flutter": ">=3.32.1"
+    "flutter": ">=3.32.5"
  }
 }
@@ -0,0 +1,51 @@
+#! /usr/bin/env nix-shell
+#! nix-shell -i python3 -p python3 nix-prefetch-git
+
+import json
+import subprocess
+import sys
+from pathlib import Path
+
+THIS_FOLDER = Path(__file__).parent.resolve()
+PUBSPEC_LOCK = THIS_FOLDER / "pubspec.lock.json"
+GIT_HASHES = THIS_FOLDER / "gitHashes.json"
+
+
+def fetch_git_hash(url: str, rev: str) -> str:
+    result = subprocess.run(
+        ["nix-prefetch-git", "--url", url, "--rev", rev],
+        capture_output=True,
+        text=True,
+        check=True,
+    )
+    return json.loads(result.stdout)["hash"]
+
+
+def main() -> None:
+    if not PUBSPEC_LOCK.exists():
+        sys.exit(1)
+    try:
+        data = json.loads(PUBSPEC_LOCK.read_text())
+    except json.JSONDecodeError:
+        sys.exit(1)
+    output: dict[str, str] = {}
+    for name, info in data.get("packages", {}).items():
+        if info.get("source") != "git":
+            continue
+        desc = info.get("description")
+        if not isinstance(desc, dict):
+            continue
+        url = desc.get("url")
+        rev = desc.get("resolved-ref")
+        if not (isinstance(url, str) and isinstance(rev, str)):
+            continue
+        try:
+            package_hash = fetch_git_hash(url, rev)
+        except subprocess.CalledProcessError:
+            continue
+        output[name] = package_hash
+    GIT_HASHES.write_text(json.dumps(output, indent=2) + "\n")
+
+
+if __name__ == "__main__":
+    main()
@@ -0,0 +1,26 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p nix-update gnugrep gnused curl
+
+set -eu -o pipefail
+
+mainfile="$(nix-instantiate --eval -E "with import ./. {}; (builtins.unsafeGetAttrPos \"version\" sideswap).file" | tr -d '"')"
+libfile="$(dirname -- "$mainfile")/libsideswap-client.nix"
+
+mainversion="$(nix-instantiate --eval -E "with import ./. {}; sideswap.version" | tr -d '"')"
+
+# Update the comment in libsideswap-client.nix.
+sed -i "s@sideswapclient/blob/v[^\/]+/deploy@sideswapclient/blob/v${mainversion}/deploy@" $libfile
+
+# Find libsideswap_client commit used in sideswap/deploy/build_linux.sh.
+libversion=$(curl --show-error --silent ${GITHUB_TOKEN:+-u ":${GITHUB_TOKEN}"} "https://raw.githubusercontent.com/sideswap-io/sideswapclient/refs/tags/v${mainversion}/deploy/build_linux.sh" | grep -A 1 'pushd sideswap_rust' | grep 'git checkout' | sed 's/git checkout //')
+
+# Update revision of the lib.
+sed -i "/rev =/s/[0-9a-f]\{40\}/${libversion}/" $libfile
+
+# Find the date of the commit to use as 0-unstable-YYYY-MM-DD version of the lib.
+libdate=$(curl --show-error --silent "https://github.com/sideswap-io/sideswap_rust/commit/${libversion}.patch" | grep '^Date: ' | head -1)
+libunstableversion=$(date -d "${libdate#Date: }" +"%Y-%m-%d")
+sed -i "/version =/s/0-unstable-....-..-../0-unstable-${libunstableversion}/" $libfile
+
+# Update hash and cargoHash of the lib. Send output to /dev/null not to break "update.nix" which expects JSON here.
+nix-update sideswap.lib --version=skip > /dev/null
@@ -40,6 +40,12 @@ stdenv.mkDerivation (finalAttrs: {
      url = "https://github.com/sofa-framework/sofa/commit/700b6cdd94fe24a51b2a7014fb0fc83e6abe1fbc.patch";
      hash = "sha256-czc1u03USQt18d7cMPmXYguBhSb5JOJLplPvoixp+3w=";
    })
+    (fetchpatch {
+      # Compat with metis > 5.1
+      name = "sofamatrix-allow-newer-metis-versions.patch";
+      url = "https://github.com/sofa-framework/sofa/commit/f1a45da7c77776ea9559b1958576b0187a8b9958.patch";
+      hash = "sha256-YPMBKG1Ju5XON14CmSYNqljpqEbFRvI5SgKwOnxs7+I=";
+    })
  ];

  propagatedNativeBuildInputs = [
@@ -9,16 +9,16 @@

 buildGoModule rec {
  pname = "spacectl";
-  version = "1.15.1";
+  version = "1.15.2";

  src = fetchFromGitHub {
    owner = "spacelift-io";
    repo = "spacectl";
    rev = "v${version}";
-    hash = "sha256-2cEYo2wWEvKvYyegov7ruaJImCV38xHz/KOrTzDqywQ=";
+    hash = "sha256-RC2ReS8XI0WHIXP1XhnBcsOxHQ3NhpQf4wByk8mfm8g=";
  };

-  vendorHash = "sha256-jLUqGQJbYAfsCUJ6amnyAuOsjcslSJzD6Barapzzm9Q=";
+  vendorHash = "sha256-t81t+Fx9cMfOSSzuCaqnyXvGOJ07JYk9mqPbR4HaHUk=";

  nativeBuildInputs = [ installShellFiles ];

@@ -10,11 +10,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "stretchly";
-  version = "1.17.2";
+  version = "1.18.0";

  src = fetchurl {
    url = "https://github.com/hovancik/stretchly/releases/download/v${finalAttrs.version}/stretchly-${finalAttrs.version}.tar.xz";
-    hash = "sha256-IsVmdsmLfNkZ7B9i8TjTHMymsmYLJY5AJleAoEwnUKk=";
+    hash = "sha256-xmGiGzA4Ol3bteYKrdbmRzh+pwpOOeKmGC70fV1f9Yw=";
  };

  icon = fetchurl {
@@ -7,13 +7,13 @@

 buildGoModule rec {
  pname = "syft";
-  version = "1.32.0";
+  version = "1.33.0";

  src = fetchFromGitHub {
    owner = "anchore";
    repo = "syft";
    tag = "v${version}";
-    hash = "sha256-M165U881x56DDI4V8aOAdT7XAOiWKcQ2aWtqj9ivIQY=";
+    hash = "sha256-S7PvaLjrd6W7AyCgi8yAC0kjFwVxpf/FlzyOq3yvayE=";
    # populate values that require us to use git. By doing this in postFetch we
    # can delete .git afterwards and maintain better reproducibility of the src.
    leaveDotGit = true;
@@ -28,7 +28,7 @@ buildGoModule rec {
  # hash mismatch with darwin
  proxyVendor = true;

-  vendorHash = "sha256-x1wN7+Ei7PT30Q9PUaPf5egpfIZVnfym8w7bXcmpCOg=";
+  vendorHash = "sha256-JppXYoge4hK5hw2O2KSRL1n/UX/bc2LmGEzwQW6xD44=";

  nativeBuildInputs = [ installShellFiles ];

@@ -7,11 +7,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "syncthing-macos";
-  version = "1.29.2-2";
+  version = "1.30.0-1";

  src = fetchurl {
    url = "https://github.com/syncthing/syncthing-macos/releases/download/v${finalAttrs.version}/Syncthing-${finalAttrs.version}.dmg";
-    hash = "sha256-KbUpc2gymxkhkpSvIpy2fF3xAKsDqHHwlfUB8BF8+Sc=";
+    hash = "sha256-9kerr89PZ90fQwxPfqrSlujuLYY9THv6Ne/cUErt3YU=";
  };

  nativeBuildInputs = [ undmg ];
@@ -62,7 +62,7 @@ let
    stdenv.cc.cc
    stdenv.cc.libc
  ];
-  version = "1.0.43";
+  version = "1.0.44";
 in
 stdenv.mkDerivation {
  pname = "tana";
@@ -70,7 +70,7 @@ stdenv.mkDerivation {

  src = fetchurl {
    url = "https://github.com/tanainc/tana-desktop-releases/releases/download/v${version}/tana_${version}_amd64.deb";
-    hash = "sha256-jYidVJgVqm2O/WZT03NseO557R8eT1/js+PwqzDucKw=";
+    hash = "sha256-HtubHH0ENiC+8s8VlpiaNekmzRUtnfmd+CZl5UjJo1U=";
  };

  nativeBuildInputs = [
@@ -18,16 +18,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "tangara-companion";
-  version = "0.4.3";
+  version = "0.5.0";

  src = fetchFromGitHub {
    owner = "haileys";
    repo = "tangara-companion";
    tag = "v${version}";
-    hash = "sha256-pTE+xlXWIOOt1oiKosnbXTCLYoAqP3CfXA283a//Ds0=";
+    hash = "sha256-7uTcTAQy5ozIeXfSZ2SbeepFnZJtWBsWIfnezTnUgtM=";
  };

-  cargoHash = "sha256-C7Q3Oo/aBBH6pW1zSFQ2nD07+wu8uXfRSwNif2pVlW0=";
+  cargoHash = "sha256-lvd9M81j69qFWWD8BZyAU7pisnw8EnU3pTvugoRAqnY=";

  nativeBuildInputs = [
    copyDesktopItems
@@ -11,16 +11,16 @@

 buildGoModule rec {
  pname = "terraform-plugin-docs";
-  version = "0.22.0";
+  version = "0.23.0";

  src = fetchFromGitHub {
    owner = "hashicorp";
    repo = "terraform-plugin-docs";
    tag = "v${version}";
-    hash = "sha256-ktYADQEUD3bb6JRUy/g4l2J3XBzCVbt/knLqsd/MnF8=";
+    hash = "sha256-SIPGdY8wvM7Lfn0PAqbmk12fhJpq4CA/GYQppTYE8HY=";
  };

-  vendorHash = "sha256-FKIBkg2fXO89GDTkHQeK4v2YWe870GAKgNiu12k3iS0=";
+  vendorHash = "sha256-Dqc3B3wfAwX0M6T8TmQU7kjjECHVaK+YmW8H7ZTK+ao=";

  nativeBuildInputs = [ makeWrapper ];

@@ -8,11 +8,11 @@ let
    https://github.com/Mastermindzh/tidal-hifi/blob/master/build/electron-builder.base.yml
     for the expected version
  */
-  version = "35.1.1";
+  version = "37.2.5";
 in
 (fetchzip {
  url = "https://github.com/castlabs/electron-releases/releases/download/v${version}+wvcus/electron-v${version}+wvcus-linux-x64.zip";
-  hash = "sha256-AkPKeG7MrCBlk41qXZxFPRukUPRcIUanq6fJPx5d3RU=";
+  hash = "sha256-mRbweXYfsWxu7I+pqtBjgA0n+ad2iFawVbDUBT5+LZo=";
  stripRoot = false;

 }).overrideAttrs
@@ -47,7 +47,7 @@
 }:

 let
-  version = "5.20.0";
+  version = "5.20.1";

  electronLibPath = lib.makeLibraryPath [
    alsa-lib
@@ -95,7 +95,7 @@ buildNpmPackage (self: {
    owner = "Mastermindzh";
    repo = "tidal-hifi";
    tag = version;
-    hash = "sha256-PENNkmCiCFcaHNCBfwVitYfqKN0ZR0QHwE3WQHp0tGI=";
+    hash = "sha256-uiRvbxUztLwNSB1BHa9rGrPl2akt21VqxEV4pBgNwPo=";
  };

  nativeBuildInputs = [
@@ -104,7 +104,7 @@ buildNpmPackage (self: {
    copyDesktopItems
  ];

-  npmDepsHash = "sha256-4J5wGq/zpEK+xKtVg2zf7lIDHo9d4KW5fDY05siaFC4=";
+  npmDepsHash = "sha256-BsHlATxdZ/5QFr2HAGSeKo+aR7udfD6X8h/qyJnBrr0=";
  forceGitDeps = true;
  makeCacheWritable = true;

@@ -6,13 +6,13 @@

 buildGoModule rec {
  pname = "topicctl";
-  version = "1.20.2";
+  version = "1.21.0";

  src = fetchFromGitHub {
    owner = "segmentio";
    repo = "topicctl";
    rev = "v${version}";
-    sha256 = "sha256-OrHQVgN4wwRBdYvCdn4GCzMIhMaav7wmmHemZbQMRCc=";
+    sha256 = "sha256-+Khy7WL57oHCb1a4HIJPq9UdMuYXlkf8/GikoRvUT1Y=";
  };

  vendorHash = "sha256-M/lNhGD9zNmwkzTAjp0lbAeliNpLOCVJbOG16N76QL4=";
@@ -14,13 +14,13 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "typespec";
-  version = "1.3.0";
+  version = "1.4.0";

  src = fetchFromGitHub {
    owner = "microsoft";
    repo = "typespec";
    tag = "typespec-stable@${finalAttrs.version}";
-    hash = "sha256-yf9Iz9chRzaRS9Mkw+Djr4zSbub5GIn9vlQI97nymyE=";
+    hash = "sha256-huyEQA+XhlGVxnxUzQH1aIZUE4EbCN6HakitzuDyR18=";
  };

  nativeBuildInputs = [
@@ -39,7 +39,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
      postPatch
      ;
    fetcherVersion = 1;
-    hash = "sha256-f0Amp6xS77cdD0+nQquEPnOpTPWyLza7T4FmGHOfTOo=";
+    hash = "sha256-/Y7KhdNeyUV2CQQWjhYBDDT24oE6UdBO6HTweUUaNqc=";
  };

  postPatch = ''
@@ -6,16 +6,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "viceroy";
-  version = "0.14.2";
+  version = "0.14.3";

  src = fetchFromGitHub {
    owner = "fastly";
    repo = "viceroy";
    rev = "v${version}";
-    hash = "sha256-tfIUmyQjoWflAjA4aOIJ7xhUgVG5Njf54W36h8a1vQ8=";
+    hash = "sha256-djUBSplEHIGEk1ofaHtfzXJ1HCztrXtZoS30goY1w5A=";
  };

-  cargoHash = "sha256-0xrT1Eum0ttApkN09U4MEo/vM6y6t6+e7iVcuih2b5U=";
+  cargoHash = "sha256-D6VSmQOwdKWUSsxPr/6hq0SjE1LYusn9HZsNi07cGSk=";

  cargoTestFlags = [
    "--package viceroy-lib"
@@ -6,14 +6,14 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "wafw00f";
-  version = "2.3.1";
+  version = "2.3.2";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "EnableSecurity";
    repo = "wafw00f";
    tag = "v${version}";
-    hash = "sha256-47lzFPMyAJTtreGGazFWUYiu9e9Q1D3QYsrQbwyaQME=";
+    hash = "sha256-nJNJAmSjEYKgqVYcNDIL8O6AQzK6DrIN8P4U0s/PWQM=";
  };

  build-system = with python3.pkgs; [ setuptools ];
@@ -18,13 +18,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "wealthfolio";
-  version = "1.2.2";
+  version = "1.2.3";

  src = fetchFromGitHub {
    owner = "afadil";
    repo = "wealthfolio";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-5gzi7yhEI3mq4BKrw+CpyM9TZXZj7JCYNnxR0NTL8VY=";
+    hash = "sha256-bp8BxJp/Ga9Frqyvl76Fh9AfSEKv3W+P1ND9zqeMXhg=";
  };

  pnpmDeps = pnpm_9.fetchDeps {
@@ -43,7 +43,7 @@ stdenv.mkDerivation (finalAttrs: {
      src
      cargoRoot
      ;
-    hash = "sha256-OkEMo4j5WmDzU+YhgnOPjplniDJr/taVzji478tgNT8=";
+    hash = "sha256-CiEtxZn+kqYqS0sx9SLPvIkOTq2La48gQp+xx9z5BJs=";
  };

  nativeBuildInputs = [
@@ -8,18 +8,18 @@
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "zuban";

-  version = "0.0.21";
+  version = "0.0.23";

  src = fetchFromGitHub {
    owner = "zubanls";
    repo = "zuban";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-llAJwqJmOtauA7pi7dYZhVH0yFBNN65q2y8ecc9hAJY=";
+    hash = "sha256-EPF1HW/oqUKHLTorkO3C+X+ziq6i1lCxGY5y1ioKg6A=";
  };

  buildAndTestSubdir = "crates/zuban";

-  cargoHash = "sha256-sZFc+kjerR7a6JzVb0zQXCfYuJVNnoYUihgLd3qrDLM=";
+  cargoHash = "sha256-TAFdS4NmXchmhqVRcsckz6GhZG35IE2fukDlZiRF8Ms=";

  nativeInstallCheckInputs = [
    versionCheckHook
@@ -230,8 +230,8 @@ let
        }

        ${
-          # --static is only available in Linux
-          lib.optionalString (stdenv.hostPlatform.isLinux && useMusl) ''
+          # --static is only available in x86_64 Linux
+          lib.optionalString (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isx86_64 && useMusl) ''
            echo "Ahead-Of-Time compilation with --static and --libc=musl"
            $out/bin/native-image $extraNativeImageArgs -march=compatibility --libc=musl --static HelloWorld
            ./helloworld | fgrep 'Hello World'
@@ -1,22 +1,22 @@
 # Generated by update.sh script
 {
-  "version" = "24.0.2";
+  "version" = "25.0.0";
  "hashes" = {
    "aarch64-linux" = {
-      sha256 = "1xfncszlnxmjxfj79b3z5isc8a3gjk0cn3i7b0yli4c7hld9akf5";
-      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/jdk-24.0.2/graalvm-community-jdk-24.0.2_linux-aarch64_bin.tar.gz";
+      sha256 = "08c9x9pcnkq853p984nzlivswjzvribx7xww9lbmsv002xv8ng3c";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/jdk-25.0.0/graalvm-community-jdk-25.0.0_linux-aarch64_bin.tar.gz";
    };
    "x86_64-linux" = {
-      sha256 = "080774x1chpa0n8bpmw575g5myi63ikffwgcvq3r7nvdh9n88qkd";
-      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/jdk-24.0.2/graalvm-community-jdk-24.0.2_linux-x64_bin.tar.gz";
+      sha256 = "1pfki55vjzfq22ycphsp4kyzldmg3fr2qlacmqy30yiqjz7g4qhq";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/jdk-25.0.0/graalvm-community-jdk-25.0.0_linux-x64_bin.tar.gz";
    };
    "x86_64-darwin" = {
-      sha256 = "1lvn38dd7kl086344237jq20a1l4cqj2wcdjain1bawds5bdi7n5";
-      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/jdk-24.0.2/graalvm-community-jdk-24.0.2_macos-x64_bin.tar.gz";
+      sha256 = "13bp0rwvb1sbs0sqmkmdfbmngsphjdvp5mqxqyfy4h6hczw8q9q4";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/jdk-25.0.0/graalvm-community-jdk-25.0.0_macos-x64_bin.tar.gz";
    };
    "aarch64-darwin" = {
-      sha256 = "11ymqs0knhx70n8mvanfnqaq3d8x5a9955hqccllgzj6fz86hl0z";
-      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/jdk-24.0.2/graalvm-community-jdk-24.0.2_macos-aarch64_bin.tar.gz";
+      sha256 = "0n3isdwkkkr7kpqqkpq7l02j39zvx6cx4ja0q6j611m9xnmdain4";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/jdk-25.0.0/graalvm-community-jdk-25.0.0_macos-aarch64_bin.tar.gz";
    };
  };
 }
@@ -7,24 +7,7 @@ let
 in
 {
  vtk_9_5 = mkVtk {
-    version = "9.5.0";
-    sourceSha256 = "sha256-BK6GJGuVV8a2GvvFNKbfCZJE+8jzk3+C5rwFcJU6+H0=";
-    patches = [
-      # https://gitlab.kitware.com/vtk/vtk/-/issues/19699
-      (fetchpatch2 {
-        url = "https://gitlab.kitware.com/vtk/vtk/-/commit/6b4f7b853675c63e4831c366ca8f78e320c1bfb5.diff";
-        hash = "sha256-hWJc5RxW6iK+W/rTxp2GUWKcm/2+oxbP5nVZ0EUSKHE=";
-      })
-      # https://gitlab.kitware.com/vtk/vtk/-/issues/19705
-      (fetchpatch2 {
-        url = "https://gitlab.kitware.com/vtk/vtk/-/commit/ce10dfe82ffa19c8108885625a6f8b3f980bed3b.diff";
-        hash = "sha256-kyPM0whL4WeaV27sNM1fbbs5kwMYn+9E561HtvnwHRc=";
-      })
-      # https://gitlab.kitware.com/vtk/vtk/-/merge_requests/12262
-      (fetchpatch2 {
-        url = "https://gitlab.kitware.com/vtk/vtk/-/commit/c0e0f793e6adf740f5b1c91ac330afdbc2a03b72.diff";
-        hash = "sha256-BinSv8sPqpAEcgkn8trnCPv2snR9MGcA8rkVflAhc5w=";
-      })
-    ];
+    version = "9.5.1";
+    sourceSha256 = "sha256-FEQ2YcewldBbTjdvs/QGE/Fz40/J1GWCNOnsHWJKYY8=";
  };
 }
@@ -82,11 +82,10 @@
  libXcursor,
  gl2ps,
  libGL,
-  qt5,
  qt6,

  # custom options
-  qtVersion ? null,
+  withQt6 ? false,
  # To avoid conflicts between the propagated vtkPackages.hdf5
  # and the input hdf5 used by most downstream packages,
  # we set mpiSupport to false by default.
@@ -97,15 +96,6 @@
  testers,
 }:
 let
-  qtPackages =
-    if (isNull qtVersion) then
-      null
-    else if (qtVersion == "6") then
-      qt6
-    else if (qtVersion == "5") then
-      qt5
-    else
-      throw ''qtVersion must be "5", "6" or null'';
  vtkPackages = lib.makeScope newScope (self: {
    inherit
      mpi
@@ -173,7 +163,7 @@ stdenv.mkDerivation (finalAttrs: {
    libXrender
    libXcursor
  ]
-  ++ lib.optional (!(isNull qtPackages)) qtPackages.qttools
+  ++ lib.optional withQt6 qt6.qttools
  ++ lib.optional mpiSupport mpi
  ++ lib.optional pythonSupport tk;

@@ -234,12 +224,6 @@ stdenv.mkDerivation (finalAttrs: {
    })
  ];

-  # wrapper script calls qmlplugindump, crashes due to lack of minimal platform plugin
-  # Could not find the Qt platform plugin "minimal" in ""
-  preConfigure = lib.optionalString (qtVersion == "5") ''
-    export QT_PLUGIN_PATH=${lib.getBin qt5.qtbase}/${qt5.qtbase.qtPluginPrefix}
-  '';
-
  env = {
    CMAKE_PREFIX_PATH = "${lib.getDev openvdb}/lib/cmake/OpenVDB";
    NIX_LDFLAGS = "-L${lib.getLib libmysqlclient}/lib/mariadb";
@@ -275,8 +259,8 @@ stdenv.mkDerivation (finalAttrs: {
    (vtkBool "VTK_MODULE_ENABLE_VTK_RenderingOpenVR" false) # openvr
    (vtkBool "VTK_MODULE_ENABLE_VTK_RenderingAnari" false) # anari

-    # qtSupport
-    (vtkBool "VTK_GROUP_ENABLE_Qt" (!(isNull qtPackages)))
+    # withQt6
+    (vtkBool "VTK_GROUP_ENABLE_Qt" withQt6)
    (lib.cmakeFeature "VTK_QT_VERSION" "Auto") # will search for Qt6 first

    # pythonSupport
@@ -324,9 +308,9 @@ stdenv.mkDerivation (finalAttrs: {

        package = finalAttrs.finalPackage;

-        nativeBuildInputs = lib.optionals (!(isNull qtPackages)) [
-          qtPackages.qttools
-          qtPackages.wrapQtAppsHook
+        nativeBuildInputs = lib.optionals withQt6 [
+          qt6.qttools
+          qt6.wrapQtAppsHook
        ];
      };
    };
@@ -359,7 +359,7 @@

 buildPythonPackage rec {
  pname = "boto3-stubs";
-  version = "1.40.30";
+  version = "1.40.34";
  pyproject = true;

  disabled = pythonOlder "3.7";
@@ -367,7 +367,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    pname = "boto3_stubs";
    inherit version;
-    hash = "sha256-uwjryREPAyx9wZmMiPyIbBXRbv5dDWmtx0v9ZHsYx8g=";
+    hash = "sha256-IhNCSgcfDXK7bwHHSqvAxidCKIltySPhhWifTUcAFYk=";
  };

  build-system = [ setuptools ];
@@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "botocore-stubs";
-  version = "1.40.31";
+  version = "1.40.33";
  pyproject = true;

  disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    pname = "botocore_stubs";
    inherit version;
-    hash = "sha256-AXvOpZGSQrZ+gOaicRSdZ8rR0GvXraxatY4yKZ26g9w=";
+    hash = "sha256-icUa4LKNnXn96MSXz5CN34cs4CfSc31NS6Rz/enNqoI=";
  };

  nativeBuildInputs = [ setuptools ];
@@ -17,7 +17,7 @@

 buildPythonPackage rec {
  pname = "clickhouse-driver";
-  version = "0.2.7";
+  version = "0.2.9";
  format = "setuptools";

  # pypi source doesn't contain tests
@@ -25,7 +25,7 @@ buildPythonPackage rec {
    owner = "mymarilyn";
    repo = "clickhouse-driver";
    rev = version;
-    hash = "sha256-l0YHWY25PMHgZG/sAZjtGhwmcxWdA8k96zlm9hbKcek=";
+    hash = "sha256-PixzW9NJ87xAG/Rm/MedKS7CZTWw3wIQMiG/G65IvhY=";
  };

  nativeBuildInputs = [
@@ -9,14 +9,14 @@

 buildPythonPackage rec {
  pname = "deltachat2";
-  version = "0.7.0";
+  version = "0.8.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "adbenitez";
    repo = "deltachat2";
    tag = version;
-    hash = "sha256-n40LyF73FxXXIJnNwVG9B6ibUYaHbx6t9MRPdMjSInw=";
+    hash = "sha256-RVEohIFILAaCGuOwq6VmK7qLOKKP4cTuTMX+9DBO+Ns=";
  };

  patches = [
@@ -15,7 +15,7 @@

 buildPythonPackage rec {
  pname = "google-cloud-network-connectivity";
-  version = "2.9.0";
+  version = "2.10.0";
  pyproject = true;

  disabled = pythonOlder "3.7";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    inherit version;
    pname = "google_cloud_network_connectivity";
-    hash = "sha256-oIB9RPDCs90QBuujdkbM6QIi9NEj6ray6Nkp5MyDHrU=";
+    hash = "sha256-wbznAUjwh57xuvuLWOrk1eXvxuDE+wWh6Cx3oQI8dqE=";
  };

  build-system = [ setuptools ];
@@ -44,7 +44,7 @@
  time-machine,
  typing-extensions,
  uvicorn,
-  valkey,
+  # valkey,

  # tests
  httpx-sse,
@@ -122,7 +122,7 @@ buildPythonPackage rec {
    redis = [ redis ] ++ redis.optional-dependencies.hiredis;
    # sqlalchemy = [ advanced-alchemy ];
    structlog = [ structlog ];
-    valkey = [ valkey ] ++ valkey.optional-dependencies.libvalkey;
+    # valkey = [ valkey ] ++ valkey.optional-dependencies.libvalkey;
    yaml = [ pyyaml ];
  };

@@ -17,14 +17,14 @@

 buildPythonPackage rec {
  pname = "llama-cloud-services";
-  version = "0.6.64";
+  version = "0.6.66";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "run-llama";
    repo = "llama_cloud_services";
    tag = "v${version}";
-    hash = "sha256-LIRrMIOwSPo150seWbufRyzaCIJ2lNvbn5N/kFu9hDA=";
+    hash = "sha256-6UskoqlnmfoDFeWem8gjKJPE9vg5DtOrzVHQ1Q0eEA4=";
  };

  sourceRoot = "${src.name}/py";
@@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "llama-index-embeddings-google";
-  version = "0.4.0";
+  version = "0.4.1";
  pyproject = true;

  disabled = pythonOlder "3.8";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    pname = "llama_index_embeddings_google";
    inherit version;
-    hash = "sha256-wVtJ+BAX49/Ijga9cUXB6xcOrK+IkOzjj+Wgd0cRRb0=";
+    hash = "sha256-bVVg+oHf8KPb04F/HE/2XVkn4NY/Bb+PPj3fypkJ/zE=";
  };

  pythonRelaxDeps = [ "google-generativeai" ];
@@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "llama-index-embeddings-huggingface";
-  version = "0.6.0";
+  version = "0.6.1";
  pyproject = true;

  disabled = pythonOlder "3.8";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    pname = "llama_index_embeddings_huggingface";
    inherit version;
-    hash = "sha256-Ps59jFtoPSBV/t7KRFfeoT91yBptf7lNd+h4zXPZDZc=";
+    hash = "sha256-OyH/7aIvgiHtVXeLs9rtcWZKsHs0Hx3S9AiWO9IDVbk=";
  };

  build-system = [ hatchling ];
@@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "llama-index-graph-stores-neptune";
-  version = "0.4.0";
+  version = "0.4.1";
  pyproject = true;

  disabled = pythonOlder "3.8";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    pname = "llama_index_graph_stores_neptune";
    inherit version;
-    hash = "sha256-kSAfIh683fwahMjSgp0dYHmNR+NGBr71Q/OFxGtkUTc=";
+    hash = "sha256-plwDD8NBcYqedEoCeYqEZn1kDQZjDpg94jRZJBPjdU8=";
  };

  build-system = [ hatchling ];
@@ -11,7 +11,7 @@

 buildPythonPackage rec {
  pname = "llama-index-readers-s3";
-  version = "0.5.0";
+  version = "0.5.1";
  pyproject = true;

  disabled = pythonOlder "3.8";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    pname = "llama_index_readers_s3";
    inherit version;
-    hash = "sha256-3wzxfKkwhC4YfUYPBa/XKqIZQ6zLgB9SSHR+vPhwzOA=";
+    hash = "sha256-Ye+B4lcwdeaAisaIZH98X2n7FA7n9/gkVVNRN1uihys=";
  };

  build-system = [ hatchling ];
@@ -11,13 +11,13 @@

 buildPythonPackage rec {
  pname = "llama-index-vector-stores-postgres";
-  version = "0.6.5";
+  version = "0.6.8";
  pyproject = true;

  src = fetchPypi {
    pname = "llama_index_vector_stores_postgres";
    inherit version;
-    hash = "sha256-mRViARNZeVVMS8VzVBFz9d+FjsX+1M/bwnQeA1QR8mI=";
+    hash = "sha256-AwbZxv4ClJYNgeX4UydcOZcAb+8UUc34u/BNHUGSeiI=";
  };

  pythonRemoveDeps = [ "psycopg2-binary" ];
@@ -178,8 +178,8 @@ rec {
      "sha256-IUf8vnKJRqa5BeEIKEfAc09ixEIvVRfKBi6nEP1KjZU=";

  mypy-boto3-budgets =
-    buildMypyBoto3Package "budgets" "1.40.4"
-      "sha256-6kCRDur13G+GTZK8R7gknc1J3L/E3YA4/xi+9qQhVp0=";
+    buildMypyBoto3Package "budgets" "1.40.34"
+      "sha256-UzM2sg9jxU/kU6kmMizVJwYLqq+nrZi+D6GLHYPdmJQ=";

  mypy-boto3-ce =
    buildMypyBoto3Package "ce" "1.40.31"
@@ -202,8 +202,8 @@ rec {
      "sha256-gTxOeRYnpZDUi207vzeDL1FFVFhwTZjtLdLPAyHV+8M=";

  mypy-boto3-chime-sdk-messaging =
-    buildMypyBoto3Package "chime-sdk-messaging" "1.40.17"
-      "sha256-TfpYINO0LCU2IMQwDaMJkjWq2Fsrqv7w7w1KhCKWIyU=";
+    buildMypyBoto3Package "chime-sdk-messaging" "1.40.34"
+      "sha256-knAtab953lppnI8SioY6V3nMN6pt/l5p4XEsE3CpDGc=";

  mypy-boto3-chime-sdk-voice =
    buildMypyBoto3Package "chime-sdk-voice" "1.40.19"
@@ -446,8 +446,8 @@ rec {
      "sha256-jtkx0kbI7SB74U5uWyGdVhKMlsy/T82lz3P89k8LMPA=";

  mypy-boto3-ec2 =
-    buildMypyBoto3Package "ec2" "1.40.24"
-      "sha256-aCUBD3OHew/OStwEJTJyXZSSJfwPCA6db86wWdv1obc=";
+    buildMypyBoto3Package "ec2" "1.40.34"
+      "sha256-TA9tus7Ue+rqXXYsk2rogEQQAa2Y+VWml6RscNx6Fgk=";

  mypy-boto3-ec2-instance-connect =
    buildMypyBoto3Package "ec2-instance-connect" "1.40.20"
@@ -701,8 +701,8 @@ rec {
      "sha256-vZM9rXxrSiJ4l2lJ+hcLtYUws+AczRyxncAKv3vIMMo=";

  mypy-boto3-ivs-realtime =
-    buildMypyBoto3Package "ivs-realtime" "1.40.0"
-      "sha256-iMzhrZa6xtJWy46V0tBgukqPJiT/cF9BHQmNBtjpjWg=";
+    buildMypyBoto3Package "ivs-realtime" "1.40.32"
+      "sha256-HkhDjUOPS4Hm7Zvw6SyyadDBbmKf13Yi8g+VF1X/snM=";

  mypy-boto3-ivschat =
    buildMypyBoto3Package "ivschat" "1.40.0"
@@ -809,8 +809,8 @@ rec {
      "sha256-hAUULqVRGPw0Ir0XUyhREqT8C8A99lJEGYn4nAxnW7A=";

  mypy-boto3-logs =
-    buildMypyBoto3Package "logs" "1.40.0"
-      "sha256-eAZIggxP6MJFOjmoBERDQ1tJafaeo5zlOLpbIiXP1RM=";
+    buildMypyBoto3Package "logs" "1.40.32"
+      "sha256-udjRe+Pb6Yvbh6OHYs32VCTddkrAo/y1Se32A+FM1/M=";

  mypy-boto3-lookoutequipment =
    buildMypyBoto3Package "lookoutequipment" "1.40.17"
@@ -949,8 +949,8 @@ rec {
      "sha256-5aD/9ACgD/76bPpbZlqHXn0biTxr9wyiLpTyIdxMKYs=";

  mypy-boto3-network-firewall =
-    buildMypyBoto3Package "network-firewall" "1.40.0"
-      "sha256-Y+OkCSSh9V4ftggspSrgfgwaRs0bsS0QFTuOH5euxFw=";
+    buildMypyBoto3Package "network-firewall" "1.40.33"
+      "sha256-iHNj8l1/51HN4/B7T9Be68dXpR2ljWYhU9SfKOea8XY=";

  mypy-boto3-networkmanager =
    buildMypyBoto3Package "networkmanager" "1.40.0"
@@ -989,8 +989,8 @@ rec {
      "sha256-LdBoeGucR8RzewzflvN1dtCtr8+asp3ggmtV6HuUQm8=";

  mypy-boto3-osis =
-    buildMypyBoto3Package "osis" "1.40.20"
-      "sha256-NOiEjF4AS454fwut4kEKgiIY3gaDa1tPprtAAOpOqRI=";
+    buildMypyBoto3Package "osis" "1.40.32"
+      "sha256-XS7wWZReJC9tVuVCZg91tDj1iWCuUfKUup8Jf4oxS8g=";

  mypy-boto3-outposts =
    buildMypyBoto3Package "outposts" "1.40.0"
@@ -40,14 +40,14 @@

 buildPythonPackage rec {
  pname = "niworkflows";
-  version = "1.14.0";
+  version = "1.14.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "nipreps";
    repo = "niworkflows";
    tag = version;
-    hash = "sha256-QmIsbuw+W7lPpoxz0aEB1N4HZFHIPPewrIcyMB5DPJw=";
+    hash = "sha256-NvUIVH6CFv2DMr6bV4bV/VXM/fOqiatFp9YOL0/UEdw=";
  };

  pythonRelaxDeps = [ "traits" ];
@@ -18,14 +18,14 @@

 buildPythonPackage rec {
  pname = "pythonqwt";
-  version = "0.14.5";
+  version = "0.14.6";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "PlotPyStack";
    repo = "PythonQwt";
    tag = "v${version}";
-    hash = "sha256-VNeW5LOL/CM/RUrC5TUj6FnVlhmXaPRYjGPz8b01Tew=";
+    hash = "sha256-D7iZ/737x+f63clnH41S8DtmBXDMf01A04UBKsHTJwA=";
  };

  build-system = [
@@ -21,14 +21,14 @@

 buildPythonPackage rec {
  pname = "rigour";
-  version = "1.3.2";
+  version = "1.3.6";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "opensanctions";
    repo = "rigour";
    tag = "v${version}";
-    hash = "sha256-SvRcqkaTioYBclKZHimo6wbDg9y0vCgmLqCStdjCvKg=";
+    hash = "sha256-GIgIG8roy93XBo5AuUGvDHODSrF4DaBy83Ey5seYbME=";
  };

  build-system = [
@@ -9,14 +9,14 @@

 buildPythonPackage rec {
  pname = "tree-sitter-markdown";
-  version = "0.5.0";
+  version = "0.5.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "tree-sitter-grammars";
    repo = "tree-sitter-markdown";
    tag = "v${version}";
-    hash = "sha256-I9KDE1yZce8KIGPLG5tmv5r/NCWwN95R6fIyvGdx+So=";
+    hash = "sha256-IYqh6JT74deu1UU4Nyls9Eg88BvQeYEta2UXZAbuZek=";
  };

  build-system = [
@@ -16,14 +16,14 @@

 buildPythonPackage rec {
  pname = "univers";
-  version = "31.0.0";
+  version = "31.1.0";
  pyproject = true;

  disabled = pythonOlder "3.8";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-BqP5seUOhkZQBdi7ClaUDasr7h8A7YRidgISpQHVR1E=";
+    hash = "sha256-XGF+3QNlfwLdqoTbC2ahETSqYE/gSwbnyChIPwicnaY=";
  };

  build-system = [
@@ -133,12 +133,14 @@
    propagatedBuildInputs = [ python3Packages.mpd2 ];
    testPaths = [ ];
  };
+  musicbrainz = { };
  parentwork = { };
  permissions = { };
  play = { };
  playlist.propagatedBuildInputs = [ python3Packages.requests ];
  plexupdate = { };
  random = { };
+  replace = { };
  replaygain.wrapperBins = [
    aacgain
    ffmpeg
@@ -176,6 +176,8 @@ python3Packages.buildPythonApplication {
  disabledTests = disabledTests ++ [
    # https://github.com/beetbox/beets/issues/5880
    "test_reject_different_art"
+    # touches network
+    "test_merge_duplicate_album"
  ];

  # Perform extra "sanity checks", before running pytest tests.
@@ -31,12 +31,12 @@ lib.makeExtensible (

    beets-stable = callPackage ./common.nix rec {
      inherit python3Packages extraPatches;
-      version = "2.3.1";
+      version = "2.4.0";
      src = fetchFromGitHub {
        owner = "beetbox";
        repo = "beets";
        tag = "v${version}";
-        hash = "sha256-INxL2XDn8kwRYYcZATv/NdLmAtfQvxVDWKB1OYo8dxY=";
+        hash = "sha256-BM4NW8iukw9+zLD2cfAETmFYNAiNPUn9cLrkVlCE+jM=";
      };
    };

@@ -166,14 +166,14 @@ lib.makeExtensible (
      nix_2_30 = addTests "nix_2_30" self.nixComponents_2_30.nix-everything;

      nixComponents_2_31 = nixDependencies.callPackage ./modular/packages.nix rec {
-        version = "2.31.1";
+        version = "2.31.2";
        inherit (self.nix_2_30.meta) maintainers teams;
        otherSplices = generateSplicesForNixComponents "nixComponents_2_31";
        src = fetchFromGitHub {
          owner = "NixOS";
          repo = "nix";
          tag = version;
-          hash = "sha256-p7GXuu9OyQ1etTYl5egWIk2Ck7CdpXj80CqkhfE4H0c=";
+          hash = "sha256-NLGXPLjENLeKVOg3OZgHXZ+1x6sPIKq9FHH8pxbCrDI=";
        };
      };

@@ -2599,7 +2599,8 @@ mapAliases {
  voxelands = throw "'voxelands' has been removed due to lack of upstream maintenance"; # Added 2025-08-30
  vtk_9 = lib.warnOnInstantiate "'vtk_9' has been renamed to 'vtk_9_5'" vtk_9_5; # Added 2025-07-18
  vtk_9_egl = lib.warnOnInstantiate "'vtk_9_5' now build with egl support by default, so `vtk_9_egl` is deprecated, consider using 'vtk_9_5' instead." vtk_9_5; # Added 2025-07-18
-  vtk_9_withQt5 = throw "'vtk_9_withQt5' has been removed, Consider using 'vtkWithQt5' instead."; # Added 2025-07-18
+  vtk_9_withQt5 = throw "'vtk_9_withQt5' has been removed, Consider using 'vtkWithQt6' instead."; # Added 2025-07-18
+  vtkWithQt5 = throw "'vtkWithQt5' has been removed. Consider using 'vtkWithQt6' instead."; # Added 2025-09-06
  vuze = throw "'vuze' was removed because it is unmaintained upstream and insecure (CVE-2018-13417). BiglyBT is a maintained fork."; # Added 2024-11-22
  vwm = throw "'vwm' was removed as it is broken and not maintained upstream"; # Added 2025-05-17

@@ -9024,14 +9024,12 @@ with pkgs;
  vtk = vtk_9_5;

  vtk-full = vtk.override {
-    qtVersion = "6";
+    withQt6 = true;
    mpiSupport = true;
    pythonSupport = true;
  };

-  vtkWithQt5 = vtk.override { qtVersion = "5"; };
-
-  vtkWithQt6 = vtk.override { qtVersion = "6"; };
+  vtkWithQt6 = vtk.override { withQt6 = true; };

  vulkan-caps-viewer = libsForQt5.callPackage ../tools/graphics/vulkan-caps-viewer { };

--- a/Show More
+++ b/Show More