Merge staging-next into staging

2024-12-09 18:05:31 +00:00
parent 8714dd3f7a ceb62729d2
commit c12e4e275a
159 changed files with 2991 additions and 13164 deletions
@@ -881,7 +881,7 @@ dockerTools.pullImage {
  imageDigest = "sha256:b8ea88f763f33dfda2317b55eeda3b1a4006692ee29e60ee54ccf6d07348c598";
  finalImageName = "nix";
  finalImageTag = "2.19.3";
-  sha256 = "zRwlQs1FiKrvHPaf8vWOR/Tlp1C5eLn1d9pE4BZg3oA=";
+  hash = "sha256-zRwlQs1FiKrvHPaf8vWOR/Tlp1C5eLn1d9pE4BZg3oA=";
 }
 ```
 :::
@@ -898,7 +898,7 @@ dockerTools.pullImage {
  imageDigest = "sha256:24a23053f29266fb2731ebea27f915bb0fb2ae1ea87d42d890fe4e44f2e27c5d";
  finalImageName = "etcd";
  finalImageTag = "v3.5.11";
-  sha256 = "Myw+85f2/EVRyMB3axECdmQ5eh9p1q77FWYKy8YpRWU=";
+  hash = "sha256-Myw+85f2/EVRyMB3axECdmQ5eh9p1q77FWYKy8YpRWU=";
 }
 ```
 :::
@@ -922,7 +922,7 @@ Writing manifest to image destination
 {
  imageName = "nixos/nix";
  imageDigest = "sha256:498fa2d7f2b5cb3891a4edf20f3a8f8496e70865099ba72540494cd3e2942634";
-  sha256 = "1q6cf2pdrasa34zz0jw7pbs6lvv52rq2aibgxccbwcagwkg2qj1q";
+  hash = "sha256-OEgs3uRPMb4Y629FJXAWZW9q9LqHS/A/GUqr3K5wzOA=";
  finalImageName = "nixos/nix";
  finalImageTag = "latest";
 }
@@ -420,20 +420,17 @@ rec {
     Placeholders will not be quoted as they are not actual values:
       (showOption ["foo" "*" "bar"]) == "foo.*.bar"
       (showOption ["foo" "<name>" "bar"]) == "foo.<name>.bar"
+       (showOption ["foo" "<myPlaceholder>" "bar"]) == "foo.<myPlaceholder>.bar"
  */
  showOption = parts: let
+    # If the part is a named placeholder of the form "<...>" don't escape it.
+    # It may cause misleading escaping if somebody uses literally "<...>" in their option names.
+    # This is the trade-off to allow for placeholders in option names.
+    isNamedPlaceholder = builtins.match "\<(.*)\>";
    escapeOptionPart = part:
-      let
-        # We assume that these are "special values" and not real configuration data.
-        # If it is real configuration data, it is rendered incorrectly.
-        specialIdentifiers = [
-          "<name>"          # attrsOf (submodule {})
-          "*"               # listOf (submodule {})
-          "<function body>" # functionTo
-        ];
-      in if builtins.elem part specialIdentifiers
-         then part
-         else lib.strings.escapeNixIdentifier part;
+      if part == "*" || isNamedPlaceholder part != null
+        then part
+        else lib.strings.escapeNixIdentifier part;
    in (concatStringsSep ".") (map escapeOptionPart parts);
  showFiles = files: concatStringsSep " and " (map (f: "`${f}'") files);

@@ -1877,6 +1877,44 @@ runTests {
    expected = [ [ "_module" "args" ] [ "foo" ] [ "foo" "<name>" "bar" ] [ "foo" "bar" ] ];
  };

+  testAttrsWithName = {
+    expr = let
+      eval =  evalModules {
+        modules = [
+          {
+            options = {
+              foo = lib.mkOption {
+                type = lib.types.attrsWith {
+                  placeholder = "MyCustomPlaceholder";
+                  elemType = lib.types.submodule {
+                    options.bar = lib.mkOption {
+                      type = lib.types.int;
+                      default = 42;
+                    };
+                  };
+                };
+              };
+            };
+          }
+        ];
+      };
+      opt = eval.options.foo;
+    in
+      (opt.type.getSubOptions opt.loc).bar.loc;
+    expected = [
+      "foo"
+      "<MyCustomPlaceholder>"
+      "bar"
+    ];
+  };
+
+  testShowOptionWithPlaceholder = {
+    # <name>, *, should not be escaped. It is used as a placeholder by convention.
+    # Other symbols should be escaped. `{}`
+    expr = lib.showOption ["<name>" "<myName>" "*" "{foo}"];
+    expected = "<name>.<myName>.*.\"{foo}\"";
+  };
+
  testCartesianProductOfEmptySet = {
    expr = cartesianProduct {};
    expected = [ {} ];
@@ -190,6 +190,9 @@ checkConfigOutput '^420$' config.bare-submodule.deep ./declare-bare-submodule.ni
 checkConfigOutput '^2$' config.bare-submodule.deep ./declare-bare-submodule.nix ./declare-bare-submodule-deep-option.nix ./define-shorthandOnlyDefinesConfig-true.nix
 checkConfigError 'The option .bare-submodule.deep. in .*/declare-bare-submodule-deep-option.nix. is already declared in .*/declare-bare-submodule-deep-option-duplicate.nix' config.bare-submodule.deep ./declare-bare-submodule.nix ./declare-bare-submodule-deep-option.nix  ./declare-bare-submodule-deep-option-duplicate.nix

+# Check that strMatching can be merged
+checkConfigOutput '^"strMatching.*"$' options.sm.type.name ./strMatching-merge.nix
+
 # Check integer types.
 # unsigned
 checkConfigOutput '^42$' config.value ./declare-int-unsigned-value.nix ./define-value-int-positive.nix
@@ -391,6 +394,10 @@ checkConfigError 'The option `mergedLazyNonLazy'\'' in `.*'\'' is already declar
 checkConfigOutput '^11$' config.lazyResult ./lazy-attrsWith.nix
 checkConfigError 'infinite recursion encountered' config.nonLazyResult ./lazy-attrsWith.nix

+# AttrsWith placeholder tests
+checkConfigOutput '^"mergedName.<id>.nested"$' config.result ./name-merge-attrsWith-1.nix
+checkConfigError 'The option .mergedName. in .*\.nix. is already declared in .*\.nix' config.mergedName ./name-merge-attrsWith-2.nix
+
 # Even with multiple assignments, a type error should be thrown if any of them aren't valid
 checkConfigError 'A definition for option .* is not of type .*' \
  config.value ./declare-int-unsigned-value.nix ./define-value-list.nix ./define-value-int-positive.nix
@@ -0,0 +1,51 @@
+{ lib, ... }:
+let
+  inherit (lib) types mkOption;
+in
+{
+  imports = [
+    # Module A
+    (
+      { ... }:
+      {
+        options.mergedName = mkOption {
+          default = { };
+          type = types.attrsWith {
+            placeholder = "id"; # <- This is beeing tested
+            elemType = types.submodule {
+              options.nested = mkOption {
+                type = types.int;
+                default = 1;
+              };
+            };
+          };
+        };
+      }
+    )
+    # Module B
+    (
+      { ... }:
+      {
+        # defines the default placeholder "name"
+        # type merging should resolve to "id"
+        options.mergedName = mkOption {
+          type = types.attrsOf (types.submodule { });
+        };
+      }
+    )
+
+    # Output
+    (
+      {
+        options,
+        ...
+      }:
+      {
+        options.result = mkOption {
+          default = lib.concatStringsSep "." (options.mergedName.type.getSubOptions options.mergedName.loc)
+          .nested.loc;
+        };
+      }
+    )
+  ];
+}
@@ -0,0 +1,38 @@
+{ lib, ... }:
+let
+  inherit (lib) types mkOption;
+in
+{
+  imports = [
+    # Module A
+    (
+      { ... }:
+      {
+        options.mergedName = mkOption {
+          default = { };
+          type = types.attrsWith {
+            placeholder = "id"; # <- this is beeing tested
+            elemType = types.submodule {
+              options.nested = mkOption {
+                type = types.int;
+                default = 1;
+              };
+            };
+          };
+        };
+      }
+    )
+    # Module B
+    (
+      { ... }:
+      {
+        options.mergedName = mkOption {
+          type = types.attrsWith {
+            placeholder = "other"; # <- define placeholder = "other" (conflict)
+            elemType = types.submodule { };
+          };
+        };
+      }
+    )
+  ];
+}
@@ -0,0 +1,15 @@
+{ lib, ... }:
+{
+  imports = [
+    {
+      options.sm = lib.mkOption {
+        type = lib.types.strMatching "\(.*\)";
+      };
+    }
+    {
+      options.sm = lib.mkOption {
+        type = lib.types.strMatching "\(.*\)";
+      };
+    }
+  ];
+}
@@ -461,6 +461,11 @@ rec {
      descriptionClass = "noun";
      check = x: str.check x && builtins.match pattern x != null;
      inherit (str) merge;
+      functor = defaultFunctor "strMatching" // {
+        type = payload: strMatching payload.pattern;
+        payload = { inherit pattern; };
+        binOp = lhs: rhs: if lhs == rhs then lhs else null;
+      };
    };

    # Merge multiple definitions by concatenating them (with the given
@@ -475,9 +480,10 @@ rec {
      check = isString;
      merge = loc: defs: concatStringsSep sep (getValues defs);
      functor = (defaultFunctor name) // {
-        payload = sep;
-        binOp = sepLhs: sepRhs:
-          if sepLhs == sepRhs then sepLhs
+        payload = { inherit sep; };
+        type = payload: types.separatedString payload.sep;
+        binOp = lhs: rhs:
+          if lhs.sep == rhs.sep then { inherit (lhs) sep; }
          else null;
      };
    };
@@ -608,17 +614,27 @@ rec {
              lhs.lazy
            else
              null;
+          placeholder =
+            if lhs.placeholder == rhs.placeholder then
+              lhs.placeholder
+            else if lhs.placeholder == "name" then
+              rhs.placeholder
+            else if rhs.placeholder == "name" then
+              lhs.placeholder
+            else
+              null;
        in
-        if elemType == null || lazy == null then
+        if elemType == null || lazy == null || placeholder == null then
          null
        else
          {
-            inherit elemType lazy;
+            inherit elemType lazy placeholder;
          };
    in
    {
      elemType,
      lazy ? false,
+      placeholder ? "name",
    }:
    mkOptionType {
      name = if lazy then "lazyAttrsOf" else "attrsOf";
@@ -645,16 +661,16 @@ rec {
          (pushPositions defs)))
      );
      emptyValue = { value = {}; };
-      getSubOptions = prefix: elemType.getSubOptions (prefix ++ ["<name>"]);
+      getSubOptions = prefix: elemType.getSubOptions (prefix ++ ["<${placeholder}>"]);
      getSubModules = elemType.getSubModules;
-      substSubModules = m: attrsWith { elemType = elemType.substSubModules m; inherit lazy; };
+      substSubModules = m: attrsWith { elemType = elemType.substSubModules m; inherit lazy placeholder; };
      functor = defaultFunctor "attrsWith" // {
        wrappedDeprecationMessage = { loc }: lib.warn ''
          The deprecated `type.functor.wrapped` attribute of the option `${showOption loc}` is accessed, use `type.nestedTypes.elemType` instead.
        '' elemType;
        payload = {
          # Important!: Add new function attributes here in case of future changes
-          inherit elemType lazy;
+          inherit elemType lazy placeholder;
        };
        inherit binOp;
      };
@@ -1014,7 +1030,11 @@ rec {
          else "conjunction";
        check = flip elem values;
        merge = mergeEqualOption;
-        functor = (defaultFunctor name) // { payload = values; binOp = a: b: unique (a ++ b); };
+        functor = (defaultFunctor name) // {
+          payload = { inherit values; };
+          type = payload: types.enum payload.values;
+          binOp = a: b: { values = unique (a.values ++ b.values); };
+        };
      };

    # Either value of type `t1` or `t2`.
@@ -7335,6 +7335,17 @@
    githubId = 1633361;
    name = "Iztok Fister Jr.";
  };
+  FirelightFlagboy = {
+    email = "firelight.flagboy+nixpkgs@gmail.com";
+    github = "FirelightFlagboy";
+    githubId = 30697622;
+    name = "Firelight Flagboy";
+    keys = [
+      {
+        fingerprint = "D6E2 4BD5 680C 609D D146  99B4 4304 CE0B A5E8 67D1";
+      }
+    ];
+  };
  FireyFly = {
    email = "nix@firefly.nu";
    github = "FireyFly";
@@ -10263,7 +10274,7 @@
    name = "jdev082";
  };
  jdreaver = {
-    email = "johndreaver@gmail.com";
+    email = "me@davidreaver.com";
    github = "jdreaver";
    githubId = 1253071;
    name = "David Reaver";
@@ -17916,7 +17927,10 @@
    github = "JarvisCraft";
    githubId = 7693005;
    name = "Petr Portnov";
-    keys = [ { fingerprint = "884B 08D2 8DFF 6209 1857  C1C7 7E8F C8F7 D1BB 84A3"; } ];
+    keys = [
+      { fingerprint = "884B 08D2 8DFF 6209 1857  C1C7 7E8F C8F7 D1BB 84A3"; }
+      { fingerprint = "AA96 35AA F392 52BF 0E60  825E 1192 2217 F828 8484"; }
+    ];
  };
  progval = {
    email = "progval+nix@progval.net";
@@ -399,7 +399,7 @@ Composed types are types that take a type as parameter. `listOf
    returned instead for the same `mkIf false` definition.
    :::

-`types.attrsWith` { *`elemType`*, *`lazy`* ? false }
+`types.attrsWith` { *`elemType`*, *`lazy`* ? false, *`placeholder`* ? "name" }

 :   An attribute set of where all the values are of *`elemType`* type.

@@ -411,10 +411,18 @@ Composed types are types that take a type as parameter. `listOf
    `lazy`
    : Determines whether the attribute set is lazily evaluated. See: `types.lazyAttrsOf`

+    `placeholder` (`String`, default: `name` )
+    : Placeholder string in documentation for the attribute names.
+      The default value `name` results in the placeholder `<name>`
+
    **Behavior**

    - `attrsWith { elemType = t; }` is equivalent to `attrsOf t`
    - `attrsWith { lazy = true; elemType = t; }` is equivalent to `lazyAttrsOf t`
+    - `attrsWith { placeholder = "id"; elemType = t; }`
+
+      Displays the option as `foo.<id>` in the manual.
+

 `types.uniq` *`t`*

@@ -1844,6 +1844,12 @@
  "sec-release-25.05-notable-changes": [
    "release-notes.html#sec-release-25.05-notable-changes"
  ],
+  "sec-release-25.05-lib": [
+    "release-notes.html#sec-release-25.05-lib"
+  ],
+  "sec-release-25.05-lib-breaking": [
+    "release-notes.html#sec-release-25.05-lib-breaking"
+  ],
  "sec-release-24.11": [
    "release-notes.html#sec-release-24.11"
  ],
@@ -129,3 +129,11 @@
 - `bind.cacheNetworks` now only controls access for recursive queries, where it previously controlled access for all queries.

 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
+
+## Nixpkgs Library {#sec-release-25.05-lib}
+
+### Breaking changes {#sec-release-25.05-lib-breaking}
+
+- Structure of the `functor` of some types has changed. `functor` is an implementation detail and should not be relied upon. If you did rely on it let us know in this [PR](https://github.com/NixOS/nixpkgs/pull/363565).
+  - [`lib.types.enum`](https://nixos.org/manual/nixos/unstable/#sec-option-types-basic): Previously the `functor.payload` was the list of enum values directly. Now it is an attribute set containing the values in the `values` attribute.
+  - [`lib.types.separatedString`](https://nixos.org/manual/nixos/unstable/#sec-option-types-string): Previously the `functor.payload` was the seperator directly. Now it is an attribute set containing the seperator in the `sep` attribute.
@@ -372,7 +372,7 @@ in
          (pkgs.dockerTools.pullImage {
            imageName = "docker.io/bitnami/keycloak";
            imageDigest = "sha256:714dfadc66a8e3adea6609bda350345bd3711657b7ef3cf2e8015b526bac2d6b";
-            sha256 = "0imblp0kw9vkcr7sp962jmj20fpmb3hvd3hmf4cs4x04klnq3k90";
+            hash = "sha256-IM2BLZ0EdKIZcRWOtuFY9TogZJXCpKtPZnMnPsGlq0Y=";
            finalImageTag = "21.1.2-debian-11-r0";
          })

@@ -14,6 +14,7 @@ let
    log_errors = on
    post_max_size = 100M
    upload_max_filesize = 100M
+    memory_limit = ${toString cfg.settings.php_memory_limit}M
    date.timezone = "${config.time.timeZone}"
  '';
  phpIni = pkgs.runCommand "php.ini"
@@ -101,11 +102,21 @@ in
      '';
    };

+    enableLocalBilling = mkOption {
+      type = types.bool;
+      default = true;
+      description = ''
+        Enable billing Cron-Jobs on the local instance. Enabled by default, but you may disable it
+        on some nodes within a distributed poller setup. See [the docs](https://docs.librenms.org/Extensions/Distributed-Poller/#discovery)
+        for more informations about billing with distributed pollers.
+      '';
+    };
+
    useDistributedPollers = mkOption {
      type = types.bool;
      default = false;
      description = ''
-        Enables (distributed pollers)[https://docs.librenms.org/Extensions/Distributed-Poller/]
+        Enables [distributed pollers](https://docs.librenms.org/Extensions/Distributed-Poller/)
        for this LibreNMS instance. This will enable a local `rrdcached` and `memcached` server.

        To use this feature, make sure to configure your firewall that the distributed pollers
@@ -118,7 +129,7 @@ in
        type = types.bool;
        default = false;
        description = ''
-          Configure this LibreNMS instance as a (distributed poller)[https://docs.librenms.org/Extensions/Distributed-Poller/].
+          Configure this LibreNMS instance as a [distributed poller](https://docs.librenms.org/Extensions/Distributed-Poller/).
          This will disable all web features and just configure the poller features.
          Use the `mysql` database of your main LibreNMS instance in the database settings.
        '';
@@ -146,6 +157,10 @@ in
        default = false;
        description = ''
          Enable distributed billing on this poller.
+
+          Note: according to [the docs](https://docs.librenms.org/Extensions/Distributed-Poller/#discovery),
+          billing should only be calculated on a single node per poller group. You can disable billing on
+          some nodes with the `services.librenms.enableLocalBilling` option.
        '';
      };

@@ -376,6 +391,9 @@ in
      # enable fast ping by default
      "ping_rrd_step" = 60;

+      # set default memory limit to 1G
+      "php_memory_limit" = lib.mkDefault 1024;
+
      # one minute polling
      "rrd.step" = if cfg.enableOneMinutePolling then 60 else 300;
      "rrd.heartbeat" = if cfg.enableOneMinutePolling then 120 else 600;
@@ -609,8 +627,6 @@ in
          "${if cfg.enableOneMinutePolling then "*" else "*/5"} * * * * ${cfg.user} ${env} ${package}/cronic ${package}/poller-wrapper.py ${toString cfg.pollerThreads}"
          "* * * * * ${cfg.user} ${env} ${package}/alerts.php >> /dev/null 2>&1"

-          "*/5 * * * * ${cfg.user} ${env} ${package}/poll-billing.php >> /dev/null 2>&1"
-          "01 * * * * ${cfg.user} ${env} ${package}/billing-calculate.php >> /dev/null 2>&1"
          "*/5 * * * * ${cfg.user} ${env} ${package}/check-services.php >> /dev/null 2>&1"

          # extra: fast ping
@@ -621,6 +637,9 @@ in
          "19 0 * * * ${cfg.user} ${env} ${package}/daily.sh notifications >> /dev/null 2>&1"
          "19 0 * * * ${cfg.user} ${env} ${package}/daily.sh peeringdb >> /dev/null 2>&1"
          "19 0 * * * ${cfg.user} ${env} ${package}/daily.sh mac_oui >> /dev/null 2>&1"
+        ] ++ lib.optionals cfg.enableLocalBilling [
+          "*/5 * * * * ${cfg.user} ${env} ${package}/poll-billing.php >> /dev/null 2>&1"
+          "01 * * * * ${cfg.user} ${env} ${package}/billing-calculate.php >> /dev/null 2>&1"
        ];
    };

@@ -659,5 +678,5 @@ in

  };

-  meta.maintainers = lib.teams.wdz.members;
+  meta.maintainers = with lib.maintainers; [ netali ] ++ lib.teams.wdz.members;
 }
@@ -214,7 +214,6 @@ in
  );

  meta.maintainers = with lib.maintainers; [
-    voronind
    nishimara
  ];
 }
@@ -1305,8 +1305,7 @@ in
        # System Call Filtering
        SystemCallArchitectures = "native";
        SystemCallFilter = [ "~@cpu-emulation @debug @keyring @mount @obsolete @privileged @setuid" ]
-          ++ optional cfg.enableQuicBPF [ "bpf" ]
-          ++ optionals ((cfg.package != pkgs.tengine) && (cfg.package != pkgs.openresty) && (!lib.any (mod: (mod.disableIPC or false)) cfg.package.modules)) [ "~@ipc" ];
+          ++ optional cfg.enableQuicBPF [ "bpf" ];
      };
    };

@@ -237,7 +237,7 @@ let
            preStop = ''
              state="/run/nixos/network/routes/${i.name}"
              if [ -e "$state" ]; then
-                while read cidr; do
+                while read -r cidr; do
                  echo -n "deleting route $cidr... "
                  ip route del "$cidr" dev "${i.name}" >/dev/null 2>&1 && echo "done" || echo "failed"
                done < "$state"
@@ -246,7 +246,7 @@ let

              state="/run/nixos/network/addresses/${i.name}"
              if [ -e "$state" ]; then
-                while read cidr; do
+                while read -r cidr; do
                  echo -n "deleting address $cidr... "
                  ip addr del "$cidr" dev "${i.name}" >/dev/null 2>&1 && echo "done" || echo "failed"
                done < "$state"
@@ -2,7 +2,7 @@ import ./make-test-python.nix ({ lib, ... }:

 {
  name = "prowlarr";
-  meta.maintainers = with lib.maintainers; [ jdreaver ];
+  meta.maintainers = with lib.maintainers; [ ];

  nodes.machine =
    { pkgs, ... }:
@@ -9,8 +9,8 @@ let
    inherit tiling_wm;
  };
  stableVersion = {
-    version = "2024.2.1.9"; # "Android Studio Ladybug | 2024.2.1"
-    sha256Hash = "sha256-18ppVeAvxx6kNBOjSKcZjbEMNt8khKmohMq3JErX7pY=";
+    version = "2024.2.1.12"; # "Android Studio Ladybug | 2024.2.1 Patch 3"
+    sha256Hash = "sha256-TfUax9c+RSAzg0GKU3yVYsWL72q4DUB0zZiss4flyqY=";
  };
  betaVersion = {
    version = "2024.2.1.8"; # "Android Studio Ladybug | 2024.2.1 RC 1"
@@ -9163,12 +9163,12 @@ final: prev:

  nvim-lspconfig = buildVimPlugin {
    pname = "nvim-lspconfig";
-    version = "2024-12-02";
+    version = "2024-12-08";
    src = fetchFromGitHub {
      owner = "neovim";
      repo = "nvim-lspconfig";
-      rev = "1aa9f36b6d542dafc0b4a38c48969d036003b00a";
-      sha256 = "1nhvsi0y4fb514ji3zw5d04qwidalajsv51j7748fsr023nnvfzs";
+      rev = "fc16fd4f9c5d72b45db0f45ee275db3a9a30481a";
+      sha256 = "1jriaindyc1mk2vqxn5wsds0zsqjsmsr302qb72262z0jg1ix5aa";
    };
    meta.homepage = "https://github.com/neovim/nvim-lspconfig/";
  };
@@ -15,13 +15,13 @@ assert withDynarec -> stdenv.hostPlatform.isAarch32;

 stdenv.mkDerivation (finalAttrs: {
  pname = "box86";
-  version = "0.3.6";
+  version = "0.3.8";

  src = fetchFromGitHub {
    owner = "ptitSeb";
    repo = "box86";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-Ywsf+q7tWcAbrwbE/KvM6AJFNMJvqHKWD6tuANxrUt8=";
+    hash = "sha256-/xeyb4NK5ZzPevlAjjSnc6JAmsmqnx3slaMfPLL9dYI=";
  };

  nativeBuildInputs = [
@@ -90,8 +90,17 @@ in
      })
    ];

+    postPatch = ''
+      substituteInPlace Makefile \
+        --replace-fail "gcc" "${stdenv.cc.targetPrefix}cc"
+    '';
+
    nativeBuildInputs = with pkgs; [ which ];

+    env.NIX_CFLAGS_COMPILE = toString (lib.optionals stdenv.cc.isClang [
+      "-Wno-error=incompatible-function-pointer-types"
+    ]);
+
    installFlags = [
      "SYSTEM_INSTALL_DIR=${placeholder "out"}/${gimp.targetPluginDir}/bimp"
    ];
@@ -138,7 +147,11 @@ in
      ffmpegSrc=$(realpath extern_libs/ffmpeg)
    '';

-    configureFlags = ["--with-ffmpegsrcdir=${placeholder "ffmpegSrc"}"];
+    configureFlags = [
+      "--with-ffmpegsrcdir=${placeholder "ffmpegSrc"}"
+    ] ++ lib.optionals (!stdenv.hostPlatform.isx86) [
+      "--disable-libavformat"
+    ];

    hardeningDisable = [ "format" ];

@@ -152,6 +165,8 @@ in
      # The main code is given in GPLv3, but it has ffmpeg in it, and I think ffmpeg license
      # falls inside "free".
      license = with licenses; [ gpl3 free ];
+      # Depends on linux/soundcard.h
+      platforms = platforms.linux;
    };
  };

@@ -91,7 +91,8 @@ stdenv.mkDerivation (finalAttrs: {
  };

  # required for GCC 14
-  postPatch = ''
+  # (not applicable to super-slicer fork)
+  postPatch = lib.optionalString (finalAttrs.pname == "prusa-slicer") ''
    substituteInPlace src/libslic3r/Arrange/Core/DataStoreTraits.hpp \
      --replace-fail \
      "WritableDataStoreTraits<ArrItem>::template set" \
@@ -1,19 +0,0 @@
-diff --git a/src/libslic3r/MeshBoolean.cpp b/src/libslic3r/MeshBoolean.cpp
-index 31fdc35..32acbf8 100644
--- a/src/libslic3r/MeshBoolean.cpp
-+++ b/src/libslic3r/MeshBoolean.cpp
-@@ -147,12 +147,12 @@ template<class _Mesh> TriangleMesh cgal_to_triangle_mesh(const _Mesh &cgalmesh)
-     const auto &vertices = cgalmesh.vertices();
-     int vsize = int(vertices.size());
- 
-    for (auto &vi : vertices) {
-+    for (const auto &vi : vertices) {
-         auto &v = cgalmesh.point(vi); // Don't ask...
-         its.vertices.emplace_back(to_vec3f(v));
-     }
- 
-    for (auto &face : faces) {
-+    for (const auto &face : faces) {
-         auto vtc = cgalmesh.vertices_around_face(cgalmesh.halfedge(face));
- 
-         int i = 0;
@@ -16,7 +16,6 @@ let
      ];
      hash = "sha256-v0q2MhySayij7+qBTE5q01IOq/DyUcWnjpbzB/AV34c=";
    })
-    ./meshboolean-const.patch
    # Drop if this fix gets merged upstream
    (fetchpatch {
      url = "https://github.com/supermerill/SuperSlicer/commit/fa7c545efa5d1880cf24af32083094fc872d3692.patch";
@@ -55,13 +54,18 @@ let

    # - wxScintilla is not used on macOS
    # - Partially applied upstream changes cause a bug when trying to link against a nonexistent libexpat
-    prePatch = super.prePatch + ''
+    postPatch = super.postPatch + ''
      substituteInPlace src/CMakeLists.txt \
        --replace "scintilla" "" \
        --replace "list(APPEND wxWidgets_LIBRARIES libexpat)" "list(APPEND wxWidgets_LIBRARIES EXPAT::EXPAT)"

      substituteInPlace src/libslic3r/CMakeLists.txt \
        --replace "libexpat" "EXPAT::EXPAT"
+
+      # fixes GCC 14 error
+      substituteInPlace src/libslic3r/MeshBoolean.cpp \
+        --replace-fail 'auto &face' 'auto face' \
+        --replace-fail 'auto &vi' 'auto vi'
    '';

    # We don't need PS overrides anymore, and gcode-viewer is embedded in the binary.
@@ -90,13 +90,13 @@
    "vendorHash": "sha256-RtBEXTkmPPccNmbPLNAnF1L8kinL46uBLZVMqO3887I="
  },
  "auth0": {
-    "hash": "sha256-1Dvqvv/hWZtavEJgBQrvaAgAF3yxruPo26jPVNk2BBE=",
+    "hash": "sha256-x4fi3huCQ82MBdy75+je6x4bj4yxyoaJM1GyQ29R1GA=",
    "homepage": "https://registry.terraform.io/providers/auth0/auth0",
    "owner": "auth0",
    "repo": "terraform-provider-auth0",
-    "rev": "v1.7.3",
+    "rev": "v1.8.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-Qjaw43kMlTL2eceQwlZpgaA42YDuxq59F/m2qLqvl8s="
+    "vendorHash": "sha256-TK9JPkwcrBAjC4D96Lsjldt7OegHZ/l9UjP7YG7BPhA="
  },
  "avi": {
    "hash": "sha256-OKUxIJO5WR8ZVkhst1xIgxKsAy+9PNHOmG2NsaRUxFY=",
@@ -723,11 +723,11 @@
    "vendorHash": "sha256-MfXuVZC7aroO83CJTNCh5YfbmMlUG1CiPeGgxhUFjN0="
  },
  "launchdarkly": {
-    "hash": "sha256-ca8eXj+eOTNoR00c4nBLoghoPsO2PJ3dYOMOv5cXzO4=",
+    "hash": "sha256-ONASsswVYyugvSpACCmWIcuhnbueW++/s8F7c91PkeQ=",
    "homepage": "https://registry.terraform.io/providers/launchdarkly/launchdarkly",
    "owner": "launchdarkly",
    "repo": "terraform-provider-launchdarkly",
-    "rev": "v2.21.0",
+    "rev": "v2.21.2",
    "spdx": "MPL-2.0",
    "vendorHash": "sha256-v9N7lj7bEgR5HZm1SO0+DSCmQFVnsRvHPMycYMfpYwo="
  },
@@ -777,11 +777,11 @@
    "vendorHash": "sha256-JIFYDh3EzsCNwY8Hg8aVnUIuhP+MJpygbmwTyRryM0w="
  },
  "mailgun": {
-    "hash": "sha256-Sj6iejtaSdAPg2tI5f0b88Lni431cervHxlQWwGl8Bo=",
+    "hash": "sha256-fuJnzloJa0S1r3/22Wecbq1oF8oRQP2nrrmwCONHITA=",
    "homepage": "https://registry.terraform.io/providers/wgebis/mailgun",
    "owner": "wgebis",
    "repo": "terraform-provider-mailgun",
-    "rev": "v0.7.6",
+    "rev": "v0.7.7",
    "spdx": "MPL-2.0",
    "vendorHash": "sha256-Y6zsbhLNehO3i/BRjKggVhcM15Qesbd6HbARFH/arM8="
  },
@@ -967,11 +967,11 @@
    "vendorHash": null
  },
  "ovh": {
-    "hash": "sha256-GabcX9KyUzwXke7h8hDYeDkA69D8S2IxwIK7LQynBlU=",
+    "hash": "sha256-zLTtr1S7A3ULi+sPBO3LYVhHx6OElRVJcvjK5cfrFLI=",
    "homepage": "https://registry.terraform.io/providers/ovh/ovh",
    "owner": "ovh",
    "repo": "terraform-provider-ovh",
-    "rev": "v1.0.0",
+    "rev": "v1.1.0",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
@@ -1337,13 +1337,13 @@
    "vendorHash": "sha256-zJtVKDaqOMQqyAzq4VtVv5MgXS999BwxeWhXQI6McC4="
  },
  "vault": {
-    "hash": "sha256-EiCLz5Z0ztwWrn8yHG9JnuIizicpi3WtvDSGyBtzgSY=",
+    "hash": "sha256-vMt7FyNY+Tv7C+YT4h6BOn4EDU5ypOHQvtW0VtQiifg=",
    "homepage": "https://registry.terraform.io/providers/hashicorp/vault",
    "owner": "hashicorp",
    "repo": "terraform-provider-vault",
-    "rev": "v4.4.0",
+    "rev": "v4.5.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-z9qg6NVKYIU2OQTW8g72t6B69aTL/BeLCUFeoII75cE="
+    "vendorHash": "sha256-tg1LBq8K8loMkPUXPMEi9Y4Epg0ZfpaYADfWLaZ2k3U="
  },
  "vcd": {
    "hash": "sha256-lWpJb2Dsx2wljQEignrbudFP/K2X8IfkY0IHLnO/Gtw=",
@@ -13,26 +13,23 @@

 rustPlatform.buildRustPackage rec {
  pname = "git-workspace";
-  version = "1.7.0";
+  version = "1.8.0";

  src = fetchFromGitHub {
    owner = "orf";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-cAAEbeA7+lnFH5vr+cfOlkhRjZJnIWX7AoKnow68k3I=";
+    sha256 = "sha256-sS452PCX2G49Q5tnScG+ySkUAhFctGsGZrMvQXL7WkY=";
  };

-  cargoHash = "sha256-xLsN9yiAo7HP2HpixZ5SUu0Wnv07nL9D8t+JPT6uKb0=";
+  cargoHash = "sha256-OrAZ4SGhqP+cGYB2gUIh6rON67hBRmgnq1nn9cEUAU0=";

  nativeBuildInputs = [ pkg-config ];

  buildInputs = [ openssl ]
    ++ lib.optionals stdenv.hostPlatform.isDarwin [ libiconv Security ];

-  passthru = {
-    updateScript = nix-update-script { };
-    tests.version = testers.testVersion { package = git-workspace; };
-  };
+  passthru.updateScript = nix-update-script { };

  meta = with lib; {
    description = "Sync personal and work git repositories from multiple providers";
@@ -7,13 +7,13 @@

 stdenv.mkDerivation rec {
  pname = "obs-3d-effect";
-  version = "0.1.1";
+  version = "0.1.2";

  src = fetchFromGitHub {
    owner = "exeldro";
    repo = "obs-3d-effect";
    rev = version;
-    sha256 = "sha256-eHX5GH7Jmx+Q8ji5Flwajk2Ak37aaVO4mnEHGICOicY=";
+    sha256 = "sha256-BJumEIxJTXZgPxXhxfT6zdZctCHFXb26EdnsYtA8ztE=";
  };

  nativeBuildInputs = [ cmake ];
@@ -128,50 +128,53 @@ rec {
    let
      fixName = name: builtins.replaceStrings [ "/" ":" ] [ "-" "-" ] name;
    in
-    { imageName
-      # To find the digest of an image, you can use skopeo:
-      # see doc/functions.xml
-    , imageDigest
-    , sha256
-    , os ? "linux"
-    , # Image architecture, defaults to the architecture of the `hostPlatform` when unset
-      arch ? defaultArchitecture
-      # This is used to set name to the pulled image
-    , finalImageName ? imageName
-      # This used to set a tag to the pulled image
-    , finalImageTag ? "latest"
-      # This is used to disable TLS certificate verification, allowing access to http registries on (hopefully) trusted networks
-    , tlsVerify ? true
+    lib.fetchers.withNormalizedHash { } (
+      { imageName
+        # To find the digest of an image, you can use skopeo:
+        # see doc/functions.xml
+      , imageDigest
+      , outputHash
+      , outputHashAlgo
+      , os ? "linux"
+      , # Image architecture, defaults to the architecture of the `hostPlatform` when unset
+        arch ? defaultArchitecture
+        # This is used to set name to the pulled image
+      , finalImageName ? imageName
+        # This used to set a tag to the pulled image
+      , finalImageTag ? "latest"
+        # This is used to disable TLS certificate verification, allowing access to http registries on (hopefully) trusted networks
+      , tlsVerify ? true

-    , name ? fixName "docker-image-${finalImageName}-${finalImageTag}.tar"
-    }:
+      , name ? fixName "docker-image-${finalImageName}-${finalImageTag}.tar"
+      }:

-    runCommand name
-      {
-        inherit imageDigest;
-        imageName = finalImageName;
-        imageTag = finalImageTag;
-        impureEnvVars = lib.fetchers.proxyImpureEnvVars;
-        outputHashMode = "flat";
-        outputHashAlgo = "sha256";
-        outputHash = sha256;
+      runCommand name
+        {
+          inherit imageDigest;
+          imageName = finalImageName;
+          imageTag = finalImageTag;
+          impureEnvVars = lib.fetchers.proxyImpureEnvVars;

-        nativeBuildInputs = [ skopeo ];
-        SSL_CERT_FILE = "${cacert.out}/etc/ssl/certs/ca-bundle.crt";
+          inherit outputHash outputHashAlgo;
+          outputHashMode = "flat";

-        sourceURL = "docker://${imageName}@${imageDigest}";
-        destNameTag = "${finalImageName}:${finalImageTag}";
-      } ''
-      skopeo \
-        --insecure-policy \
-        --tmpdir=$TMPDIR \
-        --override-os ${os} \
-        --override-arch ${arch} \
-        copy \
-        --src-tls-verify=${lib.boolToString tlsVerify} \
-        "$sourceURL" "docker-archive://$out:$destNameTag" \
-        | cat  # pipe through cat to force-disable progress bar
-    '';
+          nativeBuildInputs = [ skopeo ];
+          SSL_CERT_FILE = "${cacert.out}/etc/ssl/certs/ca-bundle.crt";
+
+          sourceURL = "docker://${imageName}@${imageDigest}";
+          destNameTag = "${finalImageName}:${finalImageTag}";
+        } ''
+        skopeo \
+          --insecure-policy \
+          --tmpdir=$TMPDIR \
+          --override-os ${os} \
+          --override-arch ${arch} \
+          copy \
+          --src-tls-verify=${lib.boolToString tlsVerify} \
+          "$sourceURL" "docker-archive://$out:$destNameTag" \
+          | cat  # pipe through cat to force-disable progress bar
+      ''
+    );

  # We need to sum layer.tar, not a directory, hence tarsum instead of nix-hash.
  # And we cannot untar it, because then we cannot preserve permissions etc.
@@ -115,7 +115,7 @@ rec {
  nixFromDockerHub = pullImage {
    imageName = "nixos/nix";
    imageDigest = "sha256:85299d86263a3059cf19f419f9d286cc9f06d3c13146a8ebbb21b3437f598357";
-    sha256 = "19fw0n3wmddahzr20mhdqv6jkjn1kanh6n2mrr08ai53dr8ph5n7";
+    hash = "sha256-xxZ4UW6jRIVAzlVYA62awcopzcYNViDyh6q1yocF3KU=";
    finalImageTag = "2.2.1";
    finalImageName = "nix";
  };
@@ -124,7 +124,7 @@ rec {
  testNixFromDockerHub = pkgs.testers.invalidateFetcherByDrvHash pullImage {
    imageName = "nixos/nix";
    imageDigest = "sha256:85299d86263a3059cf19f419f9d286cc9f06d3c13146a8ebbb21b3437f598357";
-    sha256 = "19fw0n3wmddahzr20mhdqv6jkjn1kanh6n2mrr08ai53dr8ph5n7";
+    hash = "sha256-xxZ4UW6jRIVAzlVYA62awcopzcYNViDyh6q1yocF3KU=";
    finalImageTag = "2.2.1";
    finalImageName = "nix";
  };
@@ -133,7 +133,7 @@ else
 fi

 # Compute the hash.
-imageHash=$(nix-hash --flat --type $hashType --base32 "$tmpFile")
+imageHash=$(nix-hash --flat --type $hashType --sri "$tmpFile")

 # Add the downloaded file to Nix store.
 finalPath=$(nix-store --add-fixed "$hashType" "$tmpFile")
@@ -152,7 +152,7 @@ cat <<EOF
 {
  imageName = "$imageName";
  imageDigest = "$imageDigest";
-  sha256 = "$imageHash";
+  hash = "$imageHash";
  finalImageName = "$finalImageName";
  finalImageTag = "$finalImageTag";
 }
@@ -164,7 +164,7 @@ cat <<EOF
 {
  "imageName": "$imageName",
  "imageDigest": "$imageDigest",
-  "sha256": "$imageHash",
+  "hash": "$imageHash",
  "finalImageName": "$finalImageName",
  "finalImageTag": "$finalImageTag"
 }
@@ -11,7 +11,7 @@

 rustPlatform.buildRustPackage rec {
  pname = "arti";
-  version = "1.3.0";
+  version = "1.3.1";

  src = fetchFromGitLab {
    domain = "gitlab.torproject.org";
@@ -19,10 +19,10 @@ rustPlatform.buildRustPackage rec {
    owner = "core";
    repo = "arti";
    rev = "arti-v${version}";
-    hash = "sha256-zGaNA6LdW2jZ6NyySklFCsLm2b5xk44E8ecJDV393c4=";
+    hash = "sha256-Nb1lZszq09yW16/Kr5SuxW767iYGPsUhNN7p7bTpBzs=";
  };

-  cargoHash = "sha256-9BvIQdhY/7i0X8w6XJZZeWzxEfqJlquO/qOWvvhCWaA=";
+  cargoHash = "sha256-ESZKUOPzax+RVI4G3ioZE08sqB7wtPmrFUkQ7qZOg/o=";

  nativeBuildInputs = lib.optionals stdenv.hostPlatform.isLinux [ pkg-config ];

@@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "butane";
-  version = "0.22.0";
+  version = "0.23.0";

  src = fetchFromGitHub {
    owner = "coreos";
    repo = "butane";
    rev = "v${version}";
-    hash = "sha256-ELCERcgw01RcSMQjM0PL8CyTKrdfEPV9U8/RSf7YxCs=";
+    hash = "sha256-UJRHqvfCeKxbE+SRQZEm797WqwGpwjlqol8z36l3nS4=";
  };

  vendorHash = null;
@@ -0,0 +1,35 @@
+{
+  lib,
+  rustPlatform,
+  fetchCrate,
+  testers,
+  nix-update-script,
+  cargo-aoc,
+}:
+rustPlatform.buildRustPackage rec {
+  pname = "cargo-aoc";
+  version = "0.3.8";
+
+  src = fetchCrate {
+    inherit pname version;
+    hash = "sha256-5CjY91515GeLzmLJiGjfbBfIMPr32EA65X/rriKPWRY=";
+  };
+
+  cargoHash = "sha256-LhPsiO0Fnx9Tf+itaaVaO1XgqM00m+UQMlUJYY8isXY=";
+
+  passthru = {
+    tests.version = testers.testVersion { package = cargo-aoc; };
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "Simple CLI tool that aims to be a helper for Advent of Code";
+    homepage = "https://github.com/gobanos/cargo-aoc";
+    license = with lib.licenses; [
+      mit
+      asl20
+    ];
+    maintainers = with lib.maintainers; [ defelo ];
+    mainProgram = "cargo-aoc";
+  };
+}
@@ -9,16 +9,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "cargo-deny";
-  version = "0.16.2";
+  version = "0.16.3";

  src = fetchFromGitHub {
    owner = "EmbarkStudios";
    repo = "cargo-deny";
    rev = version;
-    hash = "sha256-xZ88TaodLVZ4p0PU2ocwt8isj/WTVxcmwBUrKCQG5GE=";
+    hash = "sha256-vU1MUmMzyKcCi1HR0089+MTtpy0Y+zzK5XC5/jIEhok=";
  };

-  cargoHash = "sha256-cU9idGvbn2KcvI7G7Az3CYFGlIxPXrs5Bq0su4FTOvg=";
+  cargoHash = "sha256-jNNmTMeNgUq7uBp2eGrSl5afcKrTUXG2Wr8peEcmG7s=";

  nativeBuildInputs = [
    pkg-config
@@ -0,0 +1,36 @@
+{
+  lib,
+  cedar,
+  testers,
+  rustPlatform,
+  fetchFromGitHub,
+  nix-update-script,
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "cedar";
+  version = "4.2.2";
+
+  src = fetchFromGitHub {
+    owner = "cedar-policy";
+    repo = "cedar";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-p8idQx3HGO/ikL0pDTPXx5+rD2sRpXANqs/g51BL554=";
+  };
+
+  cargoHash = "sha256-GuXifjQkH8jV9mT3UYU6rUZB1qO5Xl9tvYJW7MjcW0U=";
+
+  passthru = {
+    tests.version = testers.testVersion { package = cedar; };
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "Implementation of the Cedar Policy Language";
+    homepage = "https://github.com/cedar-policy/cedar";
+    changelog = "https://github.com/cedar-policy/cedar/releases/tag/v${version}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ meain ];
+    mainProgram = "cedar";
+  };
+}
@@ -9,13 +9,13 @@

 buildGoModule rec {
  pname = "cilium-cli";
-  version = "0.16.20";
+  version = "0.16.21";

  src = fetchFromGitHub {
    owner = "cilium";
    repo = "cilium-cli";
    rev = "refs/tags/v${version}";
-    hash = "sha256-aTCMYVvbVKhM2Nm1mYw8beEIb3sdDwjcigFvEum86s8=";
+    hash = "sha256-CduyQeUIh+FK1yS/3uLjBKDWkVF5f6FSlRG9+A+EI/I=";
  };

  nativeBuildInputs = [ installShellFiles ];
@@ -25,8 +25,9 @@ buildGoModule rec {
  subPackages = [ "cmd/cilium" ];

  ldflags = [
-    "-s" "-w"
-    "-X=github.com/cilium/cilium-cli/defaults.CLIVersion=${version}"
+    "-s"
+    "-w"
+    "-X=github.com/cilium/cilium/cilium-cli/defaults.CLIVersion=${version}"
  ];

  # Required to workaround install check error:
@@ -51,7 +52,11 @@ buildGoModule rec {
    homepage = "https://www.cilium.io/";
    changelog = "https://github.com/cilium/cilium-cli/releases/tag/v${version}";
    license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ bryanasdev000 humancalico qjoly ];
+    maintainers = with lib.maintainers; [
+      bryanasdev000
+      humancalico
+      qjoly
+    ];
    mainProgram = "cilium";
  };
 }
@@ -24,11 +24,11 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "clightning";
-  version = "24.08.2";
+  version = "24.11";

  src = fetchurl {
    url = "https://github.com/ElementsProject/lightning/releases/download/v${version}/clightning-v${version}.zip";
-    hash = "sha256-U54HNOreulhvCYeULyBbl/WHQ7F9WQnSCSMGg5WUAdg=";
+    hash = "sha256-MWTzUn5kCBMr6u5k3qD7bVZjd7d+C+Z6I1noDcvXup4=";
  };

  # when building on darwin we need cctools to provide the correct libtool
@@ -1,20 +1,32 @@
-{ lib
-, stdenv
-, fetchurl
-, runCommand
-, makeWrapper
-, buildFHSEnv
-, libselinux
-, libarchive
-, libGL
-, xorg
-, zlib
-# Conda installs its packages and environments under this directory
-, installationPath ? "~/.conda"
-# Conda manages most pkgs itself, but expects a few to be on the system.
-, condaDeps ? [ stdenv.cc xorg.libSM xorg.libICE xorg.libX11 xorg.libXau xorg.libXi xorg.libXrender libselinux libGL zlib]
-# Any extra nixpkgs you'd like available in the FHS env for Conda to use
-, extraPkgs ? [ ]
+{
+  lib,
+  stdenv,
+  fetchurl,
+  runCommand,
+  makeWrapper,
+  buildFHSEnv,
+  libselinux,
+  libarchive,
+  libGL,
+  xorg,
+  zlib,
+  # Conda installs its packages and environments under this directory
+  installationPath ? "~/.conda",
+  # Conda manages most pkgs itself, but expects a few to be on the system.
+  condaDeps ? [
+    stdenv.cc
+    xorg.libSM
+    xorg.libICE
+    xorg.libX11
+    xorg.libXau
+    xorg.libXi
+    xorg.libXrender
+    libselinux
+    libGL
+    zlib
+  ],
+  # Any extra nixpkgs you'd like available in the FHS env for Conda to use
+  extraPkgs ? [ ],
 }:

 # How to use this package?
@@ -31,10 +43,10 @@
 # $ conda-shell
 # $ conda install spyder
 let
-  version = "4.11.0";
+  version = "24.9.2";
  src = fetchurl {
-      url = "https://repo.continuum.io/miniconda/Miniconda3-py39_${version}-Linux-x86_64.sh";
-      sha256 = "sha256-TunDqlMynNemO0mHfAurtJsZt+WvKYB7eTp2vbHTYrQ=";
+    url = "https://repo.anaconda.com/miniconda/Miniconda3-py312_${version}-0-Linux-x86_64.sh";
+    hash = "sha256-jZNrpgAwDgjso9h03uiMYcbzkwNZeytmuu5Ur097QSI=";
  };
  conda = (
    let
@@ -42,57 +54,68 @@ let
        zlib # libz.so.1
      ];
    in
-      runCommand "conda-install" { nativeBuildInputs = [ makeWrapper ]; buildInputs = [ zlib]; }
-        # on line 10, we have 'unset LD_LIBRARY_PATH'
-        # we have to comment it out however in a way that the number of bytes in the
-        # file does not change. So we replace the 'u' in the line with a '#'
-        # The reason is that the binary payload is encoded as number
-        # of bytes from the top of the installer script
-        # and unsetting the library path prevents the zlib library from being discovered
-        ''
-          mkdir -p $out/bin
+    runCommand "conda-install"
+      {
+        nativeBuildInputs = [ makeWrapper ];
+        buildInputs = [ zlib ];
+      }
+      # on line 10, we have 'unset LD_LIBRARY_PATH'
+      # we have to comment it out however in a way that the number of bytes in the
+      # file does not change. So we replace the 'u' in the line with a '#'
+      # The reason is that the binary payload is encoded as number
+      # of bytes from the top of the installer script
+      # and unsetting the library path prevents the zlib library from being discovered
+      ''
+        mkdir -p $out/bin

-          sed 's/unset LD_LIBRARY_PATH/#nset LD_LIBRARY_PATH/' ${src} > $out/bin/miniconda-installer.sh
-          chmod +x $out/bin/miniconda-installer.sh
+        sed 's/unset LD_LIBRARY_PATH/#nset LD_LIBRARY_PATH/' ${src} > $out/bin/miniconda-installer.sh
+        chmod +x $out/bin/miniconda-installer.sh

-          makeWrapper                            \
-            $out/bin/miniconda-installer.sh      \
-            $out/bin/conda-install               \
-            --add-flags "-p ${installationPath}" \
-            --add-flags "-b"                     \
-            --prefix "LD_LIBRARY_PATH" : "${libPath}"
-        '');
+        makeWrapper                            \
+          $out/bin/miniconda-installer.sh      \
+          $out/bin/conda-install               \
+          --add-flags "-p ${installationPath}" \
+          --add-flags "-b"                     \
+          --prefix "LD_LIBRARY_PATH" : "${libPath}"
+      ''
+  );
 in
-  buildFHSEnv {
-    pname = "conda-shell";
-    inherit version;
-    targetPkgs = pkgs: (builtins.concatLists [ [ conda ] condaDeps extraPkgs]);
-    profile = ''
-      # Add conda to PATH
-      export PATH=${installationPath}/bin:$PATH
-      # Paths for gcc if compiling some C sources with pip
-      export NIX_CFLAGS_COMPILE="-I${installationPath}/include"
-      export NIX_CFLAGS_LINK="-L${installationPath}lib"
-      # Some other required environment variables
-      export FONTCONFIG_FILE=/etc/fonts/fonts.conf
-      export QTCOMPOSE=${xorg.libX11}/share/X11/locale
-      export LIBARCHIVE=${libarchive.lib}/lib/libarchive.so
-      # Allows `conda activate` to work properly
-      condaSh=${installationPath}/etc/profile.d/conda.sh
-      if [ ! -f $condaSh ]; then
-        conda-install
-      fi
-      source $condaSh
-    '';
+buildFHSEnv {
+  pname = "conda-shell";
+  inherit version;
+  targetPkgs =
+    pkgs:
+    (builtins.concatLists [
+      [ conda ]
+      condaDeps
+      extraPkgs
+    ]);
+  profile = ''
+    # Add conda to PATH
+    export PATH=${installationPath}/bin:$PATH
+    # Paths for gcc if compiling some C sources with pip
+    export NIX_CFLAGS_COMPILE="-I${installationPath}/include"
+    export NIX_CFLAGS_LINK="-L${installationPath}lib"
+    # Some other required environment variables
+    export FONTCONFIG_FILE=/etc/fonts/fonts.conf
+    export QTCOMPOSE=${xorg.libX11}/share/X11/locale
+    export LIBARCHIVE=${libarchive.lib}/lib/libarchive.so
+    # Allows `conda activate` to work properly
+    condaSh=${installationPath}/etc/profile.d/conda.sh
+    if [ ! -f $condaSh ]; then
+      conda-install
+    fi
+    source $condaSh
+  '';

-    runScript = "bash -l";
+  runScript = "bash -l";

-    meta = {
-      description = "Conda is a package manager for Python";
-      mainProgram = "conda-shell";
-      homepage = "https://conda.io/";
-      platforms = lib.platforms.linux;
-      license = lib.licenses.bsd3;
-      maintainers = with lib.maintainers; [ jluttine bhipple ];
-    };
-  }
+  meta = {
+    description = "Conda is a package manager for Python";
+    mainProgram = "conda-shell";
+    homepage = "https://conda.io/";
+    platforms = lib.platforms.linux;
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ jluttine ];
+  };
+}
@@ -7,20 +7,20 @@

 rustPlatform.buildRustPackage rec {
  pname = "csvlens";
-  version = "0.10.1";
+  version = "0.11.0";

  src = fetchFromGitHub {
    owner = "YS-L";
    repo = "csvlens";
    rev = "refs/tags/v${version}";
-    hash = "sha256-q4d3BE11LVAwA16+VEWLbZW/+pkbQ5/rp+pIAiuFTyg=";
+    hash = "sha256-JlyDw+VL/vpKTvvBlDIwVIovhKJX2pV4UTY47cLR1IE=";
  };

  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
    darwin.apple_sdk.frameworks.AppKit
  ];

-  cargoHash = "sha256-eKREGxIBjzI3viieOnRRUAf+4zqKLi24Hn1aOFns8IQ=";
+  cargoHash = "sha256-PhAEVTlrTF5tj08x8B2vvfEtJadqWtC9rZT8qr0UXB4=";

  meta = with lib; {
    description = "Command line csv viewer";
@@ -19,16 +19,16 @@ let
 in
 rustPlatform.buildRustPackage rec {
  pname = "deno";
-  version = "2.1.2";
+  version = "2.1.3";

  src = fetchFromGitHub {
    owner = "denoland";
    repo = "deno";
    rev = "refs/tags/v${version}";
-    hash = "sha256-jbIJmJV1ez+K+48LZPOqgd1d8UABZBK6/6AVc9wdTe4=";
+    hash = "sha256-q4cBkmNekJnFVirD1r5LVFq94ZXOk8wnWoxw0+9LdNQ=";
  };

-  cargoHash = "sha256-adAj4l0LEedsdOUgOFzmdIPvXukAhsjxc75srvN1RRU=";
+  cargoHash = "sha256-/HKXRQjQ1ToA80jouWXL0lDY19fnqDCjRifjpce9tTw=";

  postPatch = ''
    # upstream uses lld on aarch64-darwin for faster builds
@@ -12,14 +12,14 @@ let
 in
 python3.pkgs.buildPythonApplication rec {
  pname = "dooit";
-  version = "3.0.4";
+  version = "3.1.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "dooit-org";
    repo = "dooit";
    rev = "refs/tags/v${version}";
-    hash = "sha256-gWpmjpgAn37hfNv4aCCb+7pW/39Ngo8/Za9AdU4YCKA=";
+    hash = "sha256-tqSWDW3nj+nMt7t5vgSqWvtx7YA3y2GV29gI1MYFMhc=";
  };

  build-system = with python3.pkgs; [ poetry-core ];
@@ -1,28 +1,52 @@
-{ lib, stdenv, fetchFromGitHub
-, libdrm, json_c, pciutils
-, meson, ninja, pkg-config
+{
+  lib,
+  stdenv,
+  fetchFromGitLab,
+  libdrm,
+  json_c,
+  pciutils,
+  meson,
+  ninja,
+  pkg-config,
+  scdoc,
+  nix-update-script,
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "drm_info";
-  version = "2.3.0";
+  version = "2.7.0";

-  src = fetchFromGitHub {
-    owner = "ascent12";
+  src = fetchFromGitLab {
+    domain = "gitlab.freedesktop.org";
+    owner = "emersion";
    repo = "drm_info";
-    rev = "v${version}";
-    sha256 = "sha256-UTDYLe3QezPCyG9CIp+O+KX716JDTL9mn+OEjjyTwlg=";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-pgYhZtmyhuhxBiiTRdrEp/YsuwrD6KK/ahfO2L3mfM8=";
  };

-  nativeBuildInputs = [ meson ninja pkg-config ];
-  buildInputs = [ libdrm json_c pciutils ];
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+    scdoc
+  ];
+
+  buildInputs = [
+    libdrm
+    json_c
+    pciutils
+  ];
+
+  passthru = {
+    updateScript = nix-update-script { };
+  };

  meta = with lib; {
    description = "Small utility to dump info about DRM devices";
    mainProgram = "drm_info";
-    homepage = "https://github.com/ascent12/drm_info";
-    license = licenses.mit;
-    maintainers = [ ];
+    homepage = "https://gitlab.freedesktop.org/emersion/drm_info";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ kiskae ];
    platforms = platforms.linux;
  };
-}
+})
@@ -14,13 +14,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "fluent-bit";
-  version = "3.1.10";
+  version = "3.2.2";

  src = fetchFromGitHub {
    owner = "fluent";
    repo = "fluent-bit";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-/YKXWYaDqkJ8fWgcYktXWJPcjDJTupgRTSQVp0cWruY=";
+    hash = "sha256-BnrULjcWVBAOHfxlmd1RTQ8gfwlfZcwrUyLU27/9Z3M=";
  };

  # optional only to avoid linux rebuild
@@ -1,46 +1,62 @@
-{ lib, stdenv
-, fetchzip
-, fetchFromGitHub
-, cmake
-, fftw
-, fftwFloat
-, enablePython ? false
-, pythonPackages ? null
-, llvmPackages
+{
+  lib,
+  stdenv,
+  fetchzip,
+  fetchFromGitHub,
+  cmake,
+  fftw,
+  fftwFloat,
+  enablePython ? false,
+  pythonPackages ? null,
+  llvmPackages,
 }:
+
 let
  # CMake recipes are needed to build galario
  # Build process would usually download them
  great-cmake-cookoff = fetchzip {
    url = "https://github.com/UCL/GreatCMakeCookOff/archive/v2.1.9.tar.gz";
-    sha256 = "1yd53b5gx38g6f44jmjk4lc4igs3p25z6616hfb7aq79ly01q0w2";
+    hash = "sha256-ggMcgKfpYHWWgyYY84u4Q79IGCVTVkmIMw+N/soapfk=";
  };
 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs:{
  pname = "galario";
  version = "1.2.2";

  src = fetchFromGitHub {
    owner = "mtazzari";
-    repo = pname;
-    rev = "v${version}";
-    sha256 = "0dw88ga50x3jwyfgcarn4azlhiarggvdg262hilm7rbrvlpyvha0";
+    repo = "galario";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-QMHtL9155VNphMKI1/Z7WUVIvyI2K/ac53J0UNRDiDc=";
  };

  nativeBuildInputs = [ cmake ];

-  buildInputs = [ fftw fftwFloat ]
-  ++ lib.optional enablePython pythonPackages.python
-  ++ lib.optional stdenv.hostPlatform.isDarwin llvmPackages.openmp
-  ;
+  buildInputs =
+    [
+      fftw
+      fftwFloat
+    ]
+    ++ lib.optional enablePython pythonPackages.python
+    ++ lib.optional stdenv.hostPlatform.isDarwin llvmPackages.openmp;

  propagatedBuildInputs = lib.optionals enablePython [
    pythonPackages.numpy
-    pythonPackages.cython
+    pythonPackages.cython_0
+    pythonPackages.distutils
    pythonPackages.pytest
  ];

-  nativeCheckInputs = lib.optionals enablePython [ pythonPackages.scipy pythonPackages.pytest-cov ];
+  postPatch = ''
+    substituteInPlace python/utils.py \
+      --replace-fail "trapz" "trapezoid" \
+      --replace-fail "np.int" "int"
+  '';
+
+  nativeCheckInputs = lib.optionals enablePython [
+    pythonPackages.scipy
+    pythonPackages.pytest-cov
+  ];

  preConfigure = ''
    mkdir -p build/external/src
@@ -49,7 +65,12 @@ stdenv.mkDerivation rec {
  '';

  preCheck = ''
-    ${if stdenv.hostPlatform.isDarwin then "export DYLD_LIBRARY_PATH=$(pwd)/src/" else "export LD_LIBRARY_PATH=$(pwd)/src/"}
+    ${
+      if stdenv.hostPlatform.isDarwin then
+        "export DYLD_LIBRARY_PATH=$(pwd)/src/"
+      else
+        "export LD_LIBRARY_PATH=$(pwd)/src/"
+    }
    ${lib.optionalString enablePython "sed -i -e 's|^#!.*|#!${stdenv.shell}|' python/py.test.sh"}
  '';

@@ -65,7 +86,7 @@ stdenv.mkDerivation rec {
    install_name_tool -change libgalario_single.dylib $out/lib/libgalario_single.dylib $out/lib/python*/site-packages/galario/single/libcommon.so
  '';

-  meta = with lib; {
+  meta = {
    description = "GPU Accelerated Library for Analysing Radio Interferometer Observations";
    longDescription = ''
      Galario is a library that exploits the computing power of modern
@@ -76,8 +97,8 @@ stdenv.mkDerivation rec {
      comparison to the observations.
    '';
    homepage = "https://mtazzari.github.io/galario/";
-    license = licenses.lgpl3;
-    maintainers = [ maintainers.smaret ];
-    platforms = platforms.all;
+    license = lib.licenses.lgpl3;
+    maintainers = [ lib.maintainers.smaret ];
+    platforms = lib.platforms.all;
  };
-}
+})
@@ -0,0 +1,36 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}:
+
+buildGoModule rec {
+  pname = "gama-tui";
+  version = "1.1.4";
+
+  src = fetchFromGitHub {
+    owner = "termkit";
+    repo = "gama";
+    tag = "v${version}";
+    hash = "sha256-laE3lW2MX3vYxsF5iHl0sLKCAPRAIZGQs72+vdbX4t0=";
+  };
+
+  vendorHash = "sha256-rx18df0iiYqQToydXcA6Kqsn3lePIL1RNMSvD+a4WrI=";
+
+  ldflags = [
+    "-s"
+    "-X main.Version=v${version}"
+  ];
+
+  # requires network access
+  doCheck = false;
+
+  meta = {
+    description = "Manage your GitHub Actions from Terminal with great UI";
+    homepage = "https://github.com/termkit/gama";
+    changelog = "https://github.com/termkit/gama/releases";
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ phanirithvij ];
+    mainProgram = "gama";
+  };
+}
@@ -10,12 +10,12 @@

 stdenv.mkDerivation rec {
  pname = "gdbuspp";
-  version = "2";
+  version = "3";
  src = fetchFromGitHub {
    owner = "OpenVPN";
    repo = "gdbuspp";
    rev = "refs/tags/v${version}";
-    hash = "sha256-A0sl4zZa17zMec/jJASE8lDVNohzJzEGZbWjjsorB2Y=";
+    hash = "sha256-LwEUNBQ7BUyoTm8tBgE4hwL7AbimCY/grQus8lWSI/M=";
  };

  postPatch = ''
@@ -243,7 +243,7 @@ buildDotnetModule rec {
    + lib.optionalString stdenv.hostPlatform.isLinux ''
      substituteInPlace $out/lib/github-runner/config.sh \
        --replace 'command -v ldd' 'command -v ${glibc.bin}/bin/ldd' \
-        --replace 'ldd ./bin' '${glibc.bin}/bin/ldd ${dotnet-runtime}/shared/Microsoft.NETCore.App/${dotnet-runtime.version}/' \
+        --replace 'ldd ./bin' '${glibc.bin}/bin/ldd ${dotnet-runtime}/share/dotnet/shared/Microsoft.NETCore.App/${dotnet-runtime.version}/' \
        --replace '/sbin/ldconfig' '${glibc.bin}/bin/ldconfig'
    ''
    + ''
@@ -9,13 +9,13 @@

 buildGoModule rec {
  pname = "go-blueprint";
-  version = "0.8.2";
+  version = "0.10.1";

  src = fetchFromGitHub {
    owner = "Melkeydev";
    repo = "go-blueprint";
    rev = "v${version}";
-    hash = "sha256-4KEshM6y27CD+PiyYoz4IWKkfLWRXOTA7bMFfxVYfaI=";
+    hash = "sha256-wNS8Tv0LzAPK9F98Rm2fS+fOoZXiJYYq97wYy9KzQ0g=";
  };

  ldflags = [
@@ -0,0 +1,41 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  testers,
+  gocovsh, # self
+}:
+
+buildGoModule rec {
+  pname = "gocovsh";
+  version = "0.6.1";
+
+  src = fetchFromGitHub {
+    owner = "orlangure";
+    repo = "gocovsh";
+    tag = "v${version}";
+    hash = "sha256-VZNu1uecFVVDgF4xDLTgkCahUWbM+1XASV02PEUfmr0=";
+  };
+
+  vendorHash = "sha256-Fb7BIWojOSUIlBdjIt57CSvF1a+x33sB45Z0a86JMUg=";
+
+  ldflags = [
+    "-s"
+    "-X main.version=${version}"
+    "-X main.commit=v${version}"
+    "-X main.date=19700101T000000Z"
+  ];
+
+  passthru.tests.version = testers.testVersion { package = gocovsh; };
+
+  meta = {
+    description = "Go Coverage in your terminal: a tool for exploring Go Coverage reports from the command line";
+    homepage = "https://github.com/orlangure/gocovsh";
+    changelog = "https://github.com/orlangure/gocovsh/releases";
+    # https://github.com/orlangure/gocovsh/blob/8880bc63283c13a1d630ce3817c7165a6c210d46/.goreleaser.yaml#L33
+    license = lib.licenses.gpl3Only;
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [ phanirithvij ];
+    mainProgram = "gocovsh";
+  };
+}
@@ -0,0 +1,25 @@
+diff --git a/internal/server/info_module.go b/internal/server/info_module.go
+index d2513bd..ad2921e 100644
+--- a/internal/server/info_module.go
+++ b/internal/server/info_module.go
+@@ -8,6 +8,7 @@ import (
+ 	"io/ioutil"
+ 	"log"
+ 	"os"
+	"os/exec"
+ 	"path/filepath"
+ 	"regexp"
+ 	"strings"
+@@ -756,7 +757,11 @@ func findGoToolchainVersionFromGoRoot(goroot string) (string, error) {
+ 		versionData, err = ioutil.ReadFile(filepath.Join(goroot, "VERSION.cache"))
+ 	}
+ 	if err != nil {
+-		return "", fmt.Errorf("failed to get Go toolchain version in GOROOT (%s)", goroot)
+		cmd := exec.Command("go", "env", "GOVERSION")
+		versionData, err = cmd.Output()
+		if err != nil {
+			return "", fmt.Errorf("failed to get Go toolchain version in GOROOT (%s)", goroot)
+		}
+ 	}
+ 	matches := findGoVersionRegexp.FindSubmatch(versionData)
+ 	if len(matches) >= 1 {
@@ -0,0 +1,42 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  testers,
+  golds, # self
+}:
+
+buildGoModule rec {
+  pname = "golds";
+  version = "0.7.1";
+
+  src = fetchFromGitHub {
+    owner = "go101";
+    repo = "golds";
+    tag = "v${version}";
+    hash = "sha256-6YkyKJtSAFFYidMlZXSjNpjyIIaTlibg/QMMin/NbU0=";
+  };
+
+  # nixpkgs is not using the go distpack archive and missing a VERSION file in the source
+  # but we can use go env to get the same information
+  # https://github.com/NixOS/nixpkgs/pull/358316#discussion_r1855322027
+  patches = [ ./info_module-gover.patch ];
+
+  vendorHash = "sha256-omjHRZB/4VzPhc6RrFY11s6BRD69+Y4RRZ2XdeKbZf0=";
+
+  ldflags = [ "-s" ];
+
+  passthru.tests.version = testers.testVersion {
+    package = golds;
+    version = "v${version}";
+  };
+
+  meta = {
+    description = "Experimental Go local docs server/generator and code reader implemented with some fresh ideas";
+    homepage = "https://github.com/go101/golds";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [ phanirithvij ];
+    mainProgram = "golds";
+  };
+}
@@ -12,16 +12,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "hyprlauncher";
-  version = "0.2.7";
+  version = "0.2.8";

  src = fetchFromGitHub {
    owner = "hyprutils";
    repo = "hyprlauncher";
    rev = "refs/tags/v${version}";
-    hash = "sha256-yP3g/hWhQj0JwXNbZFMRJrg0a4upOUwDD0EkW1W8acE=";
+    hash = "sha256-+CFMGWK7W8BWIY2Xg4P7VLYQ7wQmmmjGSM5Rzq8yMSY=";
  };

-  cargoHash = "sha256-ehFkZKiMtJyH0DVBzxI08uVlMACslnYfxZX5gQ7xbPU=";
+  cargoHash = "sha256-epvUpsWkkJqWuUjsbHQaHMcBkDc06ke56I/5/QEag/g=";

  strictDeps = true;

@@ -1,22 +1,22 @@
 {
-  "version": "1.122.1",
-  "hash": "sha256-wpqmaMT2yIlwihUB3q8TKCrhhikf09pNJQJ9HsloHR4=",
+  "version": "1.122.2",
+  "hash": "sha256-A6FmveHN+Kp8SFmdaMLiwZ5SLuqQSWMwZVVpMBvfoAU=",
  "components": {
    "cli": {
-      "npmDepsHash": "sha256-a6BK3A9Qlm0ygTRXSgqwzLv/KGyKFdeDfvSraayRC2U=",
-      "version": "2.2.34"
+      "npmDepsHash": "sha256-ItF8xSvxjbRV57Q2B0c7zSTULIWilvDjndmt9mfm7sE=",
+      "version": "2.2.35"
    },
    "server": {
-      "npmDepsHash": "sha256-dTKtuMhO1K/inQZFLCGxg6VlBDPC35x+AEMFLR3kH9w=",
-      "version": "1.122.1"
+      "npmDepsHash": "sha256-LuQNK0RsmCNcxullGZw2YD92j6mbKrgiHjQB6g5Z4bo=",
+      "version": "1.122.2"
    },
    "web": {
-      "npmDepsHash": "sha256-YKEbylbrsrjnUKDBSOZLz8iZWpcKfQtyRxrKG0TR4y0=",
-      "version": "1.122.1"
+      "npmDepsHash": "sha256-G1Q3jxNrH2XnYdcu33hu4XQnhxPlxoFQYgMB0E/K6nw=",
+      "version": "1.122.2"
    },
    "open-api/typescript-sdk": {
-      "npmDepsHash": "sha256-ou/o1NNpA3rOZTBwxXDmegUelC6praXB1muiu391BzM=",
-      "version": "1.122.1"
+      "npmDepsHash": "sha256-qK6rT1W/aDU8DlIFbSZ0gqCIohr7DWsdVknmvehwpJE=",
+      "version": "1.122.2"
    }
  }
 }
@@ -5,16 +5,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "jotdown";
-  version = "0.6.0";
+  version = "0.7.0";

  src = fetchFromGitHub {
    owner = "hellux";
    repo = "jotdown";
    rev = version;
-    hash = "sha256-67foqp8i5JqvtKeq8gibFhd59V8Nf8wkaINe2gd5Huk=";
+    hash = "sha256-1s0J6TF/iDSqKUF4/sgq2irSPENjinftPFZnMgE8Dn8=";
  };

-  cargoHash = "sha256-ckcjd8ZiJxfKEkpfGvTSKv3ReWn3lIK+/fBnj/kk2F0=";
+  cargoHash = "sha256-gsrwC7X1pnr9ZQDqq0SnNxYHFdRI9VRuIQtA1s7Yz7A=";

  meta = with lib; {
    description = "Minimal Djot CLI";
@@ -1,38 +1,37 @@
-{ lib
-, stdenvNoCC
-, fetchurl
-, unzip
-, makeWrapper
+{
+  lib,
+  stdenvNoCC,
+  fetchzip,
+  makeWrapper,
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "keka";
-  version = "1.3.2";
+  version = "1.4.6";

-  src = fetchurl {
+  src = fetchzip {
    url = "https://github.com/aonez/Keka/releases/download/v${finalAttrs.version}/Keka-${finalAttrs.version}.zip";
-    sha256 = "0id8j639kba5yc0z34lgvadzgv9z9s2573nn6dx9m6gd8qpnk2x7";
+    hash = "sha256-IgPnXHVtAaSOsaAYvo0ELRqvXpF2qAnJ/1QZ+FHzqn4=";
  };
-  dontUnpack = true;

-  nativeBuildInputs = [ unzip makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];

  installPhase = ''
    runHook preInstall

    mkdir -p $out/Applications $out/bin
-    unzip -d $out/Applications $src
+    cp -r . $out/Applications/Keka.app
    makeWrapper $out/Applications/Keka.app/Contents/MacOS/Keka $out/bin/keka \
      --add-flags "--cli"

    runHook postInstall
  '';

-  meta = with lib; {
+  meta = {
    description = "macOS file archiver";
    homepage = "https://www.keka.io";
-    license = licenses.unfree;
+    license = lib.licenses.unfree;
    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
-    maintainers = with maintainers; [ emilytrau ];
-    platforms = platforms.darwin;
+    maintainers = with lib.maintainers; [ emilytrau ];
+    platforms = lib.platforms.darwin;
  };
 })
@@ -16,13 +16,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "keymapper";
-  version = "4.9.0";
+  version = "4.9.1";

  src = fetchFromGitHub {
    owner = "houmain";
    repo = "keymapper";
    rev = finalAttrs.version;
-    hash = "sha256-GckqlKpF1N7Khq/9ju1IG1+jfPBuWhFAHhYnlCMC5Cw=";
+    hash = "sha256-i/iAOj2fdC4XeC3XbQU0BPoY36Ccva5YaYIvDdrmCD8=";
  };

  # all the following must be in nativeBuildInputs
@@ -7,13 +7,13 @@

 php.buildComposerProject (finalAttrs: {
  pname = "kimai";
-  version = "2.24.0";
+  version = "2.26.0";

  src = fetchFromGitHub {
    owner = "kimai";
    repo = "kimai";
    rev = finalAttrs.version;
-    hash = "sha256-C6i263sAfZwZELUIcZh/OmXZqgCKifjPYBafnH0wMC4=";
+    hash = "sha256-594oc7vAa5BPnk7RaSbWTFreu/DDIYE1lxpPQ+aZsn0=";
  };

  php = php.buildEnv {
@@ -39,7 +39,7 @@ php.buildComposerProject (finalAttrs: {
    '';
  };

-  vendorHash = "sha256-3y3FfSUuDyBGP1dsuzDORDqFNj3jYix5ArM+2FS4gn4=";
+  vendorHash = "sha256-OIIzpdH/kU8l4X3ClYh8lQ/XGh/2/LljSFI03rUjnuI=";

  composerNoPlugins = false;
  composerNoScripts = false;
@@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "kubectl-explore";
-  version = "0.10.0";
+  version = "0.11.0";

  src = fetchFromGitHub {
    owner = "keisku";
    repo = "kubectl-explore";
    rev = "v${version}";
-    hash = "sha256-2X32OYapJsxyctRMdT6WY+eni8y+jzd/6q7JNubJ/H4=";
+    hash = "sha256-RCLOqe4Ptac2YVDjWYG5H5geUMUsmh6klQfk92XvjI4=";
  };

  vendorHash = "sha256-7KTs41zPf07FdUibsq57vJ2fkqOaVeBR6iSTJm5Fth0=";
@@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "kubeshark";
-  version = "52.3.89";
+  version = "52.3.91";

  src = fetchFromGitHub {
    owner = "kubeshark";
    repo = "kubeshark";
    rev = "v${version}";
-    hash = "sha256-v5XxvY3omO9h1xtm+VSVP/zrU8uRJXvwSdxScAujWOU=";
+    hash = "sha256-xkfEhCkG2qnoMZ7l48mK56PemtQBHK46p4jLxR9GHxc=";
  };

  vendorHash = "sha256-kzyQW4bVE7oMOlHVG7LKG1AMTRYa5GLiiEhdarIhMSo=";
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, boost, libxml2, pkg-config, docbook2x, curl, autoreconfHook, cppunit }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, boost, libxml2, pkg-config, docbook2x, curl, autoreconfHook, cppunit }:

 stdenv.mkDerivation rec {
  pname = "libcmis";
@@ -11,6 +11,14 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-HXiyQKjOlQXWABY10XrOiYxPqfpmUJC3a6xD98LIHDw=";
  };

+  patches = [
+    # Backport to fix build with boost 1.86
+    (fetchpatch {
+      url = "https://github.com/tdf/libcmis/commit/3659d32999ff7593662dcf5136bcb7ac15c13f61.patch";
+      hash = "sha256-EXmQcXCHaVnF/dwU3Z4WLtaiHjYHeeonlKdyK27UkiY=";
+    })
+  ];
+
  nativeBuildInputs = [ autoreconfHook pkg-config docbook2x ];
  buildInputs = [ boost libxml2 curl cppunit ];

@@ -69,13 +69,13 @@ let
 in
 effectiveStdenv.mkDerivation (finalAttrs: {
  pname = "llama-cpp";
-  version = "4154";
+  version = "4293";

  src = fetchFromGitHub {
    owner = "ggerganov";
    repo = "llama.cpp";
    rev = "refs/tags/b${finalAttrs.version}";
-    hash = "sha256-rttgk8mF9s3R53+TN5+PdDtkTG5cohn/9wz9Z5gRpdM=";
+    hash = "sha256-ab45VNNJvzp6t8Bk2GSuTBsP4bWcyOT4d+TvaIHs5qo=";
    leaveDotGit = true;
    postFetch = ''
      git -C "$out" rev-parse --short HEAD > $out/COMMIT
@@ -0,0 +1,45 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchurl,
+  makeBinaryWrapper,
+  jre_headless,
+}:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "ltex-ls-plus";
+  version = "18.3.0";
+
+  src = fetchurl {
+    url = "https://github.com/ltex-plus/ltex-ls-plus/releases/download/${version}/ltex-ls-plus-${version}.tar.gz";
+    sha256 = "sha256-TV8z8nYz2lFsL86yxpIWDh3hDEZn/7P0kax498oicls=";
+  };
+
+  nativeBuildInputs = [ makeBinaryWrapper ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out
+    cp -rfv bin/ lib/ $out
+    rm -fv $out/bin/.lsp-cli.json $out/bin/*.bat
+    for file in $out/bin/{ltex-ls-plus,ltex-cli-plus}; do
+      wrapProgram $file --set JAVA_HOME "${jre_headless}"
+    done
+
+    runHook postInstall
+  '';
+
+  meta =
+    let
+      inherit (lib) licenses maintainers;
+    in
+    {
+      homepage = "https://ltex-plus.github.io/ltex-plus/";
+      description = "LSP language server for LanguageTool";
+      license = licenses.mpl20;
+      mainProgram = "ltex-cli-plus";
+      maintainers = [ maintainers.FirelightFlagboy ];
+      platforms = jre_headless.meta.platforms;
+    };
+}
@@ -1,10 +1,10 @@
 {
  "stable": {
-    "version": "5.9.0",
-    "hash": "sha256-i3jpLRidpkg6+LwNFTRKXJoiWOJdd1H41e1wIFAc7Bw="
+    "version": "5.10.2",
+    "hash": "sha256-Qyhl6uZy70208j07vaWdwN5GGmX66kkOpA3Ny48PdtI="
  },
  "beta": {
-    "version": "5.9.0",
-    "hash": "sha256-i3jpLRidpkg6+LwNFTRKXJoiWOJdd1H41e1wIFAc7Bw="
+    "version": "5.11.0-beta.1",
+    "hash": "sha256-qpzbnfAd7P4f2jFgnCx7gTmZXYUUGreEHRY3/HGbZco="
  }
 }
@@ -1,11 +1,10 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, rustPlatform
-, libxcb
-, installShellFiles
-, Security
-, AppKit
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  rustPlatform,
+  libxcb,
+  installShellFiles,
 }:
 rustPlatform.buildRustPackage rec {
  pname = "magic-wormhole-rs";
@@ -20,14 +19,10 @@ rustPlatform.buildRustPackage rec {

  cargoHash = "sha256-+OcjILDwGg0eybzBgVIZeVelnQatPU6rgd/b6buvTRQ=";

-  buildInputs = [ libxcb ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [ Security AppKit ];
+  buildInputs = lib.optionals (!stdenv.hostPlatform.isDarwin) [ libxcb ];

  nativeBuildInputs = [ installShellFiles ];

-  # all tests involve networking and are bound fail
-  doCheck = false;
-
  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
    installShellCompletion --cmd wormhole-rs \
      --bash <($out/bin/wormhole-rs completion bash) \
@@ -40,7 +35,10 @@ rustPlatform.buildRustPackage rec {
    homepage = "https://github.com/magic-wormhole/magic-wormhole.rs";
    changelog = "https://github.com/magic-wormhole/magic-wormhole.rs/raw/${version}/changelog.md";
    license = licenses.eupl12;
-    maintainers = with maintainers; [ zeri piegames ];
+    maintainers = with maintainers; [
+      zeri
+      piegames
+    ];
    mainProgram = "wormhole-rs";
  };
 }
@@ -27,13 +27,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "mgba";
-  version = "0.10.3";
+  version = "0.10.4";

  src = fetchFromGitHub {
    owner = "mgba-emu";
    repo = "mgba";
    rev = finalAttrs.version;
-    hash = "sha256-wSt3kyjRxKBnDOVY10jq4cpv7uIaBUIcsZr6aU7XnMA=";
+    hash = "sha256-GATjKpY4EYgep4uquBuaxDsS13aIoxVicAYs/KAs1lE=";
  };

  outputs = [ "out" "dev" "doc" "lib" "man" ];
@@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "minio-client";
-  version = "2024-10-02T08-27-28Z";
+  version = "2024-11-17T19-35-25Z";

  src = fetchFromGitHub {
    owner = "minio";
    repo = "mc";
    rev = "RELEASE.${version}";
-    sha256 = "sha256-o+VNWrGV8LvdDbPPiiXCaGgHRZprfL+HOaATfnzDIVg=";
+    sha256 = "sha256-T99mHRRy0+Zmk+dlJVGg2h7wFnXKz5Prj21PZrkVWpI=";
  };

-  vendorHash = "sha256-MJsfYCd2VqvJDcWgiJZX1/jcbHQrFQ7TOkskDf0vuSw=";
+  vendorHash = "sha256-teG+GrzmUgJ6QhcxDSbWXP32hRuCgoCvH2BoNL8ddUc=";

  subPackages = [ "." ];

@@ -12,13 +12,13 @@ assert blas.isILP64 == lapack.isILP64;

 stdenv.mkDerivation rec {
  pname = "mopac";
-  version = "23.0.2";
+  version = "23.0.3";

  src = fetchFromGitHub {
    owner = "openmopac";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-FHJ8R8s82qSt4l6IawODkHhk2jitcxjUXCgZOU9iXDM=";
+    hash = "sha256-y9/b+ro9CgDo0ld9q+3xaCFE9J5ssZp6W9ct6WQgD/o=";
  };

  nativeBuildInputs = [ gfortran cmake ];
@@ -2,16 +2,16 @@

 buildNpmPackage rec {
  pname = "mystmd";
-  version = "1.3.17";
+  version = "1.3.18";

  src = fetchFromGitHub {
    owner = "executablebooks";
    repo = "mystmd";
    rev = "mystmd@${version}";
-    hash = "sha256-T6Yx4CU1JMCbX0YLF0WnmFPo5DfX/yFrUDUhVn37o3s=";
+    hash = "sha256-20Cxs4ib7xRn4UC9ShiQ+KnyrTCmW/vII7QN9BObY78=";
  };

-  npmDepsHash = "sha256-FMyIESq78/Uky0ko3B/mn0d0xKBxIzvwGOpxvVm5/7U=";
+  npmDepsHash = "sha256-dcjOxEYTG/EnBRu+RE7cpSEvNmG32QsDDYzItaNTpa0=";

  dontNpmInstall = true;

@@ -107,9 +107,9 @@ ruff format .
 - [ ] Port `nixos-rebuild.passthru.tests`
 - [ ] Change module system to allow easier opt-in, like
  `system.switch.enableNg` for `switch-to-configuration-ng`
- [ ] Improve documentation
+- [x] Improve documentation
 - [x] `nixos-rebuild repl`
- [ ] Generate tab completion via [`shtab`](https://docs.iterative.ai/shtab/)
+- [x] Generate tab completion via [`shtab`](https://docs.iterative.ai/shtab/)
 - [x] Reduce build closure

 ## TODON'T
@@ -0,0 +1,335 @@
+nixos-rebuild(8) ["nixpkgs"]
+; quick summary:
+; # new section
+; comments starts with ;
+; - this is a list
+; 	- sub-list
+; - *bold*: _underline_, force a line break++
+; - [tables], \[ can be used to force an actual [
+; . numbered list
+; please configure your editor to use hard tabs
+; see `man 5 scdoc` for more information about syntax
+; or https://man.archlinux.org/man/scdoc.5.en
+
+# NAME
+
+nixos-rebuild - reconfigure a NixOS machine
+
+# SYNOPSIS
+
+_nixos-rebuild_ \[--verbose] [--max-jobs MAX_JOBS] [--cores CORES] [--log-format LOG_FORMAT] [--keep-going] [--keep-failed] [--fallback] [--repair] [--option OPTION OPTION] [--builders BUILDERS]++
+	\[--include INCLUDE] [--quiet] [--print-build-logs] [--show-trace] [--accept-flake-config] [--refresh] [--impure] [--offline] [--no-net] [--recreate-lock-file]++
+	\[--no-update-lock-file] [--no-write-lock-file] [--no-registries] [--commit-lock-file] [--update-input UPDATE_INPUT] [--override-input OVERRIDE_INPUT OVERRIDE_INPUT]++
+	\[--no-build-output] [--use-substitutes] [--help] [--file FILE] [--attr ATTR] [--flake [FLAKE]] [--no-flake] [--install-bootloader] [--profile-name PROFILE_NAME]++
+	\[--specialisation SPECIALISATION] [--rollback] [--upgrade] [--upgrade-all] [--json] [--ask-sudo-password] [--sudo] [--fast]++
+	\[--build-host BUILD_HOST] [--target-host TARGET_HOST]++
+	\[{switch,boot,test,build,edit,repl,dry-build,dry-run,dry-activate,build-vm,build-vm-with-bootloader,list-generations}]
+
+# DESCRIPTION
+
+This command updates the system so that it corresponds to the configuration
+specified in /etc/nixos/configuration.nix, /etc/nixos/flake.nix or the file and
+attribute specified by the *--file* and/or *--attr* options. Thus, every
+time you modify the configuration or any other NixOS module, you must run
+*nixos-rebuild* to make the changes take effect. It builds the new system in
+/nix/store, runs its activation script, and stop and (re)starts any system
+services if needed. Please note that user services need to be started manually
+as they aren't detected by the activation script at the moment.
+
+This command has one required argument, which specifies the desired operation.
+It must be one of the following:
+
+*switch*
+	Build and activate the new configuration, and make it the boot default.
+	That is, the configuration is added to the GRUB boot menu as the
+	default menu entry, so that subsequent reboots will boot the system
+	into the new configuration. Previous configurations activated with
+	nixos-rebuild switch or nixos-rebuild boot remain available in the GRUB
+	menu.
+
+	Note that if you are using specializations, running just nixos-rebuild
+	switch will switch you back to the unspecialized, base system — in that
+	case, you might want to use this instead:
+
+		$ nixos-rebuild switch --specialisation your-specialisation-name
+
+	This command will build all specialisations and make them bootable
+	just like regular nixos-rebuild switch does — the only thing different
+	is that it will switch to given specialisation instead of the base
+	system; it can be also used to switch from the base system into a
+	specialised one, or to switch between specialisations.
+
+*boot*
+	Build the new configuration and make it the boot default (as with
+	*nixos-rebuild switch*), but do not activate it. That is, the system
+	continues to run the previous configuration until the next reboot.
+
+*test*
+	Build and activate the new configuration, but do not add it to the GRUB
+	boot menu. Thus, if you reboot the system (or if it crashes), you will
+	automatically revert to the default configuration (i.e. the
+	configuration resulting from the last call to *nixos-rebuild switch* or
+	*nixos-rebuild boot*).
+
+	Note that if you are using specialisations, running just nixos-rebuild
+	test will activate the unspecialised, base system — in that case, you
+	might want to use this instead:
+
+		$ nixos-rebuild test --specialisation your-specialisation-name
+
+	This command can be also used to switch from the base system into a
+	specialised one, or to switch between specialisations.
+
+*build*
+	Build the new configuration, but neither activate it nor add it to the
+	GRUB boot menu. It leaves a symlink named result in the current
+	directory, which points to the output of the top-level “system”
+	derivation. This is essentially the same as doing
+
+		$ nix-build /path/to/nixpkgs/nixos -A system
+
+	Note that you do not need to be root to run *nixos-rebuild build*.
+
+*dry-build*
+	Show what store paths would be built or downloaded by any of the
+	operations above, but otherwise do nothing.
+
+*dry-activate*
+	Build the new configuration, but instead of activating it, show what
+	changes would be performed by the activation (i.e. by *nixos-rebuild*
+	test). For instance, this command will print which systemd units would be
+	restarted. The list of changes is not guaranteed to be complete.
+
+*edit*
+	Opens _configuration.nix_ in the default editor.
+
+*repl*
+	Opens the configuration in *nix repl*.
+
+*build-vm*
+	Build a script that starts a NixOS virtual machine with the desired
+	configuration. It leaves a symlink _result_ in the current directory that
+	points (under ‘result/bin/run-_hostname_-vm’) at the script that starts
+	the VM. Thus, to test a NixOS configuration in a virtual machine, you
+	should do the following:
+
+		$ nixos-rebuild build-vm && ./result/bin/run-\*-vm
+
+	The VM is implemented using the ‘qemu’ package. For best performance, you
+	should load the ‘kvm-intel’ or ‘kvm-amd’ kernel modules to get hardware
+	virtualisation.
+
+	The VM mounts the Nix store of the host through the 9P file system. The
+	host Nix store is read-only, so Nix commands that modify the Nix store
+	will not work in the VM. This includes commands such as *nixos-rebuild*;
+	to change the VM’s configuration, you must halt the VM and re-run the
+	commands above.
+
+	The VM has its own ext3 root file system, which is automatically created
+	when the VM is first started, and is persistent across reboots of the VM.
+	It is stored in ‘./_hostname_.qcow2’.
+
+*build-vm-with-bootloader*
+	Like build-vm, but boots using the regular boot loader of your
+	configuration (e.g. GRUB 1 or 2), rather than booting directly into the
+	kernel and initial ramdisk of the system. This al‐ lows you to test
+	whether the boot loader works correctly. However, it does not guarantee
+	that your NixOS configuration will boot successfully on the host
+	hardware (i.e., after running *nixos-rebuild switch*), because the
+	hardware and boot loader configuration in the VM are different. The boot
+	loader is installed on an automatically generated virtual disk
+	containing a /boot partition.
+
+*list-generations [--json]*
+	List the available generations in a similar manner to the boot loader
+	menu. It shows the generation number, build date and time, NixOS
+	version, kernel version and the configuration revi‐ sion. There is also
+	a json version of output available.
+
+# OPTIONS
+
+*--upgrade, --upgrade-all*
+	Update the root user's channel named ‘nixos’ before rebuilding the
+	system.
+
+	In addition to the ‘nixos’ channel, the root user's channels which have
+	a file named ‘.update-on-nixos-rebuild’ in their base directory will
+	also be updated.
+
+	Passing *--upgrade-all* updates all of the root user's channels.
+
+*--install-bootloader*
+	Causes the boot loader to be (re)installed on the device specified by
+	the relevant configuration options.
+
+*--fast*
+	Normally, *nixos-rebuild* first finds and builds itself from the
+	_config.system.build.nixos-rebuild_ attribute from the current user
+	channel or flake and exec into it. This allows *nixos-rebuild* to run
+	with the latest bug-fixes. This option disables it, using the current
+	*nixos-rebuild* instance instead.
+
+*--rollback*
+	Instead of building a new configuration as specified by
+	_/etc/nixos/configuration.nix_, roll back to the previous configuration.
+	(The previous configuration is defined as the one before the “current”
+	generation of the Nix profile _/nix/var/nix/profiles/system_.)
+
+*--builders* _builder-spec_
+	Allow ad-hoc remote builders for building the new system. This requires
+	the user executing *nixos-rebuild* (usually root) to be configured as a
+	trusted user in the Nix daemon. This can be achieved by using the
+	_nix.settings.trusted-users_ NixOS option. Examples values for that
+	option are described in the “Remote builds” chapter in the Nix manual,
+	(i.e. ‘--builders "ssh://bigbrother x86_64-linux"‘). By specifying an
+	empty string existing builders specified in /etc/nix/machines can be
+	ignored: ‘--builders ""‘ for example when they are not reachable due to
+	network connectivity.
+
+*--profile-name* _name_, *-p* _name_
+	Instead of using the Nix profile _/nix/var/nix/profiles/system_ to keep
+	track of the current and previous system configurations, use
+	_/nix/var/nix/profiles/system-profiles/name_. When you use GRUB 2, for
+	every system profile created with this flag, NixOS will create a submenu
+	named “NixOS - Profile _name_“ in GRUB's boot menu, containing the
+	current and previous configurations of this profile.
+
+	For instance, if you want to test a configuration file named _test.nix_
+	without affecting the default system profile, you would do:
+
+		$ nixos-rebuild switch -p test -I nixos-config=./test.nix
+
+	The new configuration will appear in the GRUB 2 submenu “NixOS - Profile
+	‘test’“.
+
+*--specialisation* _name_, *-c* _name_
+	Activates given specialisation; when not specified, switching and testing
+	will activate the base, unspecialised system.
+
+*--build-host* _host_
+	Instead of building the new configuration locally, use the specified host
+	to perform the build. The host needs to be accessible with ssh, and must
+	be able to perform Nix builds. If the option *--target-host* is not set,
+	the build will be copied back to the local machine when done.
+
+	You can include a remote user name in the host name (_user@host_). You
+	can also set ssh options by defining the NIX_SSHOPTS environment
+	variable.
+
+*--target-host* _host_
+	Specifies the NixOS target host. By setting this to something other than
+	an empty string, the system activation will happen on the remote host
+	instead of the local machine. The remote host needs to be accessible
+	over *ssh*, and for the commands *switch*, *boot* and *test* you need
+	root access.
+
+	If *--build-host* is not explicitly specified or empty, building will
+	take place locally.
+
+	You can include a remote user name in the host name (_user@host_). You
+	can also set ssh options by defining the NIX_SSHOPTS environment
+	variable.
+
+	Note that *nixos-rebuild* honors the _nixpkgs.crossSystem_ setting of
+	the given configuration but disregards the true architecture of the
+	target host. Hence the _nixpkgs.crossSystem_ setting has to match the
+	target platform or else activation will fail.
+
+*--use-substitutes*
+	When set, nixos-rebuild will add *--use-substitutes* to each invocation
+	of _nix-copy-closure_/_nix copy_. This will only affect the behavior of
+	nixos-rebuild if *--target-host* or *--build-host* is also set. This is
+	useful when the target-host connection to cache.nixos.org is faster than
+	the connection between hosts.
+
+*--sudo*
+	When set, *nixos-rebuild* prefixes activation commands with sudo.
+	Setting this option allows deploying as a non-root user.
+
+*--ask-sudo-password*
+	When set, *nixos-rebuild* will ask for sudo password for remote
+	activation (i.e.: on *--target-host*) at the start of the build process.
+
+*--file* _path_, *-f* _path_
+	Enable and build the NixOS system from the specified file. The file must
+	evaluate to an attribute set, and it must contain a valid NixOS
+	configuration at attribute _attrPath_. This is useful for building a
+	NixOS system from a nix file that is not a flake or a NixOS
+	configuration module. Attribute set a with valid NixOS configuration can
+	be made using _nixos_ function in nixpkgs or importing and calling
+	nixos/lib/eval-config.nix from nixpkgs. If specified without *--attr*
+	option, builds the configuration from the top-level attribute of the
+	file.
+
+*--attr* _attrPath_, *-A* _attrPath_
+	Enable and build the NixOS system from nix file and use the specified
+	attribute path from file specified by the *--file* option. If specified
+	without *--file* option, uses _default.nix_ in current directory.
+
+*--flake* _flake-uri[#name]_
+	Build the NixOS system from the specified flake. It defaults to the
+	directory containing the target of the symlink _/etc/nixos/flake.nix_,
+	if it exists. The flake must contain an output named
+	‘nixosConfigurations.name’. If name is omitted, it default to the
+	current host name.
+
+*--no-flake*
+	Do not imply *--flake* if _/etc/nixos/flake.nix exists_. With this
+	option, it is possible to build non-flake NixOS configurations even if
+	the current NixOS systems uses flakes.
+
+In addition, *nixos-rebuild* accepts following options from nix commands that
+the tool calls:
+
+Flake-related options:
+
+*--accept-flake-config*, *--refresh*, *--impure*, *--offline*, *--no-net*
+*--recreate-lock-file*, *--no-update-lock-file*, *--no-write-lock-file*,
+*--no-registries*, *--commit-lock-file*, *--update-input* _input-path_,
+*--override-input* _input-path_ _flake-url_
+
+Builder options:
+
+*--verbose,*  *-v*,  *--quiet*,  *--log-format*,  *--no-build-output*, *-Q*,
+*--max-jobs*, *-j*, *--cores*, *--keep-going*, *-k*, *--keep-failed*, *-K*,
+*--fallback*, *--incllude*, *-I*, *--option*, *--repair*, *--builders*,
+*--print-build-logs*, *-L*, *--show-trace*
+
+See the Nix manual, *nix flake lock --help* or *nix-build --help* for details.
+
+# ENVIRONMENT
+
+NIXOS_CONFIG
+	Path to the main NixOS configuration module. Defaults to
+	_/etc/nixos/configuration.nix_.
+
+NIX_PATH
+	A colon-separated list of directories used to look up Nix expressions
+	enclosed in angle brackets (e.g. <nixpkgs>). Example:
+
+		nixpkgs=./my-nixpkgs
+
+NIX_SSHOPTS
+	Additional options to be passed to ssh on the command line.
+
+# FILES
+
+/etc/nixos/flake.nix
+	If this file exists, then *nixos-rebuild* will use it as if the
+	*--flake* option was given. This file may be a symlink to a
+	flake.nix in an actual flake; thus _/etc/nixos_ need not be a
+	flake.
+
+/run/current-system
+	A symlink to the currently active system configuration in the
+	Nix store.
+
+/nix/var/nix/profiles/system
+	The Nix profile that contains the current and previous system
+	configurations. Used to generate the GRUB boot menu.
+
+# AUTHORS
+
+Nixpkgs/NixOS contributors
+
+; vim: set noet
@@ -3,12 +3,16 @@
  installShellFiles,
  mkShell,
  nix,
-  nixos-rebuild,
  python3,
  python3Packages,
  runCommand,
+  scdoc,
  withNgSuffix ? true,
+  withShellFiles ? true,
 }:
+let
+  executable = if withNgSuffix then "nixos-rebuild-ng" else "nixos-rebuild";
+in
 python3Packages.buildPythonApplication rec {
  pname = "nixos-rebuild-ng";
  version = "0.0.0";
@@ -23,8 +27,10 @@ python3Packages.buildPythonApplication rec {
    tabulate
  ];

-  nativeBuildInputs = [
+  nativeBuildInputs = lib.optionals withShellFiles [
    installShellFiles
+    python3Packages.shtab
+    scdoc
  ];

  propagatedBuildInputs = [
@@ -39,16 +45,23 @@ python3Packages.buildPythonApplication rec {
    nix
  ];

-  postInstall =
-    ''
-      installManPage ${nixos-rebuild}/share/man/man8/nixos-rebuild.8
+  postPatch = ''
+    substituteInPlace nixos_rebuild/__init__.py \
+      --subst-var-by executable ${executable} \
+      --subst-var-by withShellFiles ${lib.boolToString withShellFiles}

-      installShellCompletion \
-        --bash ${nixos-rebuild}/share/bash-completion/completions/_nixos-rebuild
-    ''
-    + lib.optionalString withNgSuffix ''
-      mv $out/bin/nixos-rebuild $out/bin/nixos-rebuild-ng
-    '';
+    substituteInPlace pyproject.toml \
+      --replace-fail nixos-rebuild ${executable}
+  '';
+
+  postInstall = lib.optionalString withShellFiles ''
+    scdoc < ${./nixos-rebuild.8.scd} > ${executable}.8
+    installManPage ${executable}.8
+
+    installShellCompletion --cmd ${executable} \
+      --bash <(shtab --shell bash nixos_rebuild.get_main_parser) \
+      --zsh <(shtab --shell zsh nixos_rebuild.get_main_parser)
+  '';

  nativeCheckInputs = with python3Packages; [
    pytestCheckHook
@@ -98,6 +111,6 @@ python3Packages.buildPythonApplication rec {
    homepage = "https://github.com/NixOS/nixpkgs/tree/master/pkgs/by-name/ni/nixos-rebuild-ng";
    license = lib.licenses.mit;
    maintainers = [ lib.maintainers.thiagokokada ];
-    mainProgram = if withNgSuffix then "nixos-rebuild-ng" else "nixos-rebuild";
+    mainProgram = executable;
  };
 }
@@ -30,6 +30,7 @@ def get_parser() -> tuple[argparse.ArgumentParser, dict[str, argparse.ArgumentPa
    common_flags.add_argument("--option", nargs=2)

    common_build_flags = argparse.ArgumentParser(add_help=False)
+    common_build_flags.add_argument("--builders")
    common_build_flags.add_argument("--include", "-I")
    common_build_flags.add_argument("--quiet", action="store_true")
    common_build_flags.add_argument("--print-build-logs", "-L", action="store_true")
@@ -72,32 +73,103 @@ def get_parser() -> tuple[argparse.ArgumentParser, dict[str, argparse.ArgumentPa
        add_help=False,
        allow_abbrev=False,
    )
-    main_parser.add_argument("--help", "-h", action="store_true")
-    main_parser.add_argument("--file", "-f")
-    main_parser.add_argument("--attr", "-A")
-    main_parser.add_argument("--flake", nargs="?", const=True)
-    main_parser.add_argument("--no-flake", dest="flake", action="store_false")
-    main_parser.add_argument("--install-bootloader", action="store_true")
-    main_parser.add_argument("--install-grub", action="store_true")  # deprecated
-    main_parser.add_argument("--profile-name", "-p", default="system")
-    main_parser.add_argument("--specialisation", "-c")
-    main_parser.add_argument("--rollback", action="store_true")
-    main_parser.add_argument("--upgrade", action="store_true")
-    main_parser.add_argument("--upgrade-all", action="store_true")
-    main_parser.add_argument("--json", action="store_true")
-    main_parser.add_argument("--sudo", action="store_true")
-    main_parser.add_argument("--ask-sudo-password", action="store_true")
-    main_parser.add_argument("--use-remote-sudo", action="store_true")  # deprecated
-    main_parser.add_argument("--no-ssh-tty", action="store_true")  # deprecated
-    main_parser.add_argument("--fast", action="store_true")
-    main_parser.add_argument("--build-host")
-    main_parser.add_argument("--target-host")
-    main_parser.add_argument("--no-build-nix", action="store_true")  # deprecated
+    main_parser.add_argument("--help", "-h", action="store_true", help="Show manpage")
+    main_parser.add_argument(
+        "--file", "-f", help="Enable and build the NixOS system from the specified file"
+    )
+    main_parser.add_argument(
+        "--attr",
+        "-A",
+        help="Enable and build the NixOS system from nix file and use the "
+        + "specified attribute path from file specified by the --file option",
+    )
+    main_parser.add_argument(
+        "--flake",
+        nargs="?",
+        const=True,
+        help="Build the NixOS system from the specified flake",
+    )
+    main_parser.add_argument(
+        "--no-flake",
+        dest="flake",
+        action="store_false",
+        help="Do not imply --flake if /etc/nixos/flake.nix exists",
+    )
+    main_parser.add_argument(
+        "--install-bootloader",
+        action="store_true",
+        help="Causes the boot loader to be (re)installed on the device specified "
+        + "by the relevant configuration options",
+    )
+    main_parser.add_argument(
+        "--install-grub",
+        action="store_true",
+        help="Deprecated, use '--install-bootloader' instead",
+    )
+    main_parser.add_argument(
+        "--profile-name",
+        "-p",
+        default="system",
+        help="Use nix profile /nix/var/nix/profiles/system-profiles/<profile-name>",
+    )
+    main_parser.add_argument(
+        "--specialisation", "-c", help="Activates given specialisation"
+    )
+    main_parser.add_argument(
+        "--rollback",
+        action="store_true",
+        help="Roll back to the previous configuration",
+    )
+    main_parser.add_argument(
+        "--upgrade",
+        action="store_true",
+        help="Update the root user's channel named 'nixos' before rebuilding "
+        + "the system and channels which have a file named '.update-on-nixos-rebuild'",
+    )
+    main_parser.add_argument(
+        "--upgrade-all",
+        action="store_true",
+        help="Same as --upgrade, but updates all root user's channels",
+    )
+    main_parser.add_argument(
+        "--json",
+        action="store_true",
+        help="JSON output, only implemented for 'list-generations' right now",
+    )
+    main_parser.add_argument(
+        "--ask-sudo-password",
+        action="store_true",
+        help="Asks for sudo password for remote activation, implies --sudo",
+    )
+    main_parser.add_argument(
+        "--sudo", action="store_true", help="Prefixes activation commands with sudo"
+    )
+    main_parser.add_argument(
+        "--use-remote-sudo",
+        action="store_true",
+        help="Deprecated, use '--sudo' instead",
+    )
+    main_parser.add_argument("--no-ssh-tty", action="store_true", help="Deprecated")
+    main_parser.add_argument(
+        "--fast",
+        action="store_true",
+        help="Skip possibly expensive operations",
+    )
+    main_parser.add_argument("--build-host", help="Specifies host to perform the build")
+    main_parser.add_argument(
+        "--target-host", help="Specifies host to activate the configuration"
+    )
+    main_parser.add_argument("--no-build-nix", action="store_true", help="Deprecated")
    main_parser.add_argument("action", choices=Action.values(), nargs="?")

    return main_parser, sub_parsers


+# For shtab to generate completions
+def get_main_parser() -> argparse.ArgumentParser:
+    return get_parser()[0]
+
+
 def parse_args(
    argv: list[str],
 ) -> tuple[argparse.Namespace, dict[str, argparse.Namespace]]:
@@ -108,6 +180,14 @@ def parse_args(
        for group, parser in sub_parsers.items()
    }

+    if args.help or args.action is None:
+        if "@withShellFiles@" == "true":
+            r = run(["man", "8", "@executable@"], check=False)
+            parser.exit(r.returncode)
+        else:
+            parser.print_help()
+            parser.exit()
+
    def parser_warn(msg: str) -> None:
        print(f"{parser.prog}: warning: {msg}", file=sys.stderr)

@@ -122,10 +202,6 @@ def parse_args(
    if args.ask_sudo_password:
        args.sudo = True

-    if args.help or args.action is None:
-        r = run(["man", "8", "nixos-rebuild"], check=False)
-        parser.exit(r.returncode)
-
    # TODO: use deprecated=True in Python >=3.13
    if args.install_grub:
        parser_warn("--install-grub deprecated, use --install-bootloader instead")
@@ -192,7 +268,7 @@ def reexec(
        logger.warning("could not find a newer version of nixos-rebuild")

    if drv:
-        new = drv / "bin/nixos-rebuild-ng"
+        new = drv / "bin/@executable@"
        current = Path(argv[0])
        # Disable re-exec during development
        if current.name != "__main__.py" and new != current:
@@ -77,7 +77,6 @@ def remote_build(
    r = run_wrapper(
        [
            "nix-instantiate",
-            "--raw",
            build_attr.path,
            "--attr",
            build_attr.to_attr(attr),
@@ -144,7 +144,7 @@ def run_wrapper(

        return r
    except subprocess.CalledProcessError:
-        if sudo and remote:
+        if sudo and remote and remote.sudo_password is None:
            logger.error(
                "while running command with remote sudo, did you forget to use "
                + "--ask-sudo-password?"
@@ -3,14 +3,14 @@ requires = ["setuptools"]
 build-backend = "setuptools.build_meta"

 [project]
-name = "nixos-rebuild-ng"
+name = "nixos-rebuild"
 version = "0.0.0"

 [project.scripts]
 nixos-rebuild = "nixos_rebuild:main"

 [tool.setuptools.package-data]
-nixos_rebuild = ["*.template.nix"]
+nixos_rebuild = ["*.nix.template"]

 [tool.mypy]
 # `--strict` config, but explicit options to avoid breaking build when mypy is
@@ -94,7 +94,6 @@ def test_remote_build(mock_run: Any, monkeypatch: Any) -> None:
            call(
                [
                    "nix-instantiate",
-                    "--raw",
                    "<nixpkgs/nixos>",
                    "--attr",
                    "preAttr.config.system.build.toplevel",
@@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "nixpacks";
-  version = "1.29.1";
+  version = "1.30.0";

  src = fetchFromGitHub {
    owner = "railwayapp";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-n4qPr3YL2DnnnUX/HqZ/2h7I4N8Du/dZ5Q2/N31q4R4=";
+    sha256 = "sha256-UFpTDZAPFZIoI0pOWZDhx7t/GhXNY4Xy1DtwvjPzSGs=";
  };

-  cargoHash = "sha256-Qo+yapjCrtov71dYRrKuWFsrUtlbOHsvsoMPzCBTIxI=";
+  cargoHash = "sha256-ecrAaix3dsCa6nTvZ1jqAwW5N/7lF+0MclXkk7zt2zk=";

  # skip test due FHS dependency
  doCheck = false;
@@ -13,13 +13,13 @@

 rustPlatform.buildRustPackage rec {
  pname = "nym";
-  version = "2024.12-aero";
+  version = "2024.13-magura-patched";

  src = fetchFromGitHub {
    owner = "nymtech";
    repo = "nym";
-    rev = "nym-binaries-v${version}";
-    hash = "sha256-bUY0ctfE1i0pjqdT/LT43FB9rDO5OKBVaTckm5qxnms=";
+    tag = "nym-binaries-v${version}";
+    hash = "sha256-N9nnDtTIvKJX1wpiAEJ2X7Dv5Qc5V6CiTR/TjJAnv3s=";
  };

  swagger-ui = fetchurl {
@@ -27,36 +27,21 @@ rustPlatform.buildRustPackage rec {
    hash = "sha256-SBJE0IEgl7Efuu73n3HZQrFxYX+cn5UU5jrL4T5xzNw=";
  };

-  cargoLock = {
-    lockFile = ./Cargo.lock;
-    outputHashes = {
-      "bls12_381-0.8.0" = "sha256-4+X/ZQ5Z+Nax4Ot1JWWvvLxuIUaucHkfnDB2L+Ak7Ro=";
-      "cosmos-sdk-proto-0.22.0-pre" = "sha256-nRfcAbjFcvAqool+6heYK8joiU5YaSWITnO6S5MRM1E=";
-      "defguard_wireguard_rs-0.4.7" = "sha256-+5m1+XGJ6Fi8v6rgjt0jRmwIruIL+OPP7zq/+166WMw=";
-      "indexed_db_futures-0.4.2" = "sha256-vVqrD40CBdSSEtU+kQeuZUfsgpJdl8ks+os0Fct8Ung=";
-    };
-  };
+  cargoHash = "sha256-tkP65GG1E5356lePLVrZdPqx/b9k1lgJ1LoxCgQf08k=";
+  useFetchCargoVendor = true;

  env = {
    SWAGGER_UI_DOWNLOAD_URL = "file://${swagger-ui}";
+    OPENSSL_NO_VENDOR = true;
  };

  nativeBuildInputs = [
    pkg-config
  ];

-  buildInputs =
-    [
-      openssl
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin (
-      with darwin.apple_sdk.frameworks;
-      [
-        Security
-        SystemConfiguration
-        CoreServices
-      ]
-    );
+  buildInputs = [
+    openssl
+  ];

  checkType = "debug";

@@ -82,6 +67,7 @@ rustPlatform.buildRustPackage rec {
      Nym routes IP packets through other participating nodes to hide their source and destination.
      In contrast with Tor, it prevents timing attacks at the cost of latency.
    '';
+    changelog = "https://github.com/nymtech/nym/releases/tag/nym-binaries-v${version}";
    homepage = "https://nymtech.net";
    license = lib.licenses.asl20;
    platforms = lib.platforms.all;
@@ -2,13 +2,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "openjph";
-  version = "0.17.0";
+  version = "0.18.1";

  src = fetchFromGitHub {
    owner = "aous72";
    repo = "openjph";
    rev = finalAttrs.version;
-    hash = "sha256-ljvdCrvKL3slVGqX97Ui65/6Doyucf2kdUEw6NWW9og=";
+    hash = "sha256-cgJlgb4SrmVFqvmqGcG3+qMDteyVFlYzoy1IOo8BjA8=";
  };

  nativeBuildInputs = [ cmake validatePkgConfig ];
@@ -1,5 +1,5 @@
 { lib
-, gcc12Stdenv
+, stdenv
 , fetchFromGitHub
 , fetchurl
 , cudaSupport ? opencv.cudaSupport or false
@@ -27,7 +27,7 @@
 , protobuf
 , pugixml
 , snappy
-, tbb_2021_5
+, tbb_2022_0
 , cudaPackages
 }:

@@ -36,8 +36,6 @@ let
    cmakeBool
  ;

-  stdenv = gcc12Stdenv;
-
  # prevent scons from leaking in the default python version
  scons' = scons.override { inherit python3Packages; };

@@ -153,7 +151,7 @@ stdenv.mkDerivation rec {
    opencv.cxxdev
    pugixml
    snappy
-    tbb_2021_5
+    tbb_2022_0
  ] ++ lib.optionals cudaSupport [
    cudaPackages.cuda_cudart
  ];
@@ -1,46 +0,0 @@
-From 30b2528054e6627a7124ac04cb018356ef23d864 Mon Sep 17 00:00:00 2001
-From: Petr Portnov <mrjarviscraft@gmail.com>
-Date: Mon, 2 Sep 2024 22:25:33 +0300
-Subject: [PATCH 1/1] build: reduce hardcode in `asio_path`
-
-Currently, `asio_path` variable value is concatenated with `/asio/include`
-to specify the path to custom `asio` installation.
-The problem is that this is too strict as some distros (namely NixOS)
-may have the `include` directory with a differently named parent.
-Thus this change minimizes the hardcoded part of the path to make it more flexible.
-
-Signed-off-by: Petr Portnov <mrjarviscraft@gmail.com>
---
- meson.build       | 2 +-
- meson_options.txt | 2 +-
- 2 files changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/meson.build b/meson.build
-index c9e0a2d..c01eb8e 100644
--- a/meson.build
-+++ b/meson.build
-@@ -74,7 +74,7 @@ endif
- #
- #  Setup additional include header dirs
- #
-asio_inc = get_option('asio_path') / 'asio' / 'include'
-+asio_inc = get_option('asio_path') / 'include'
- message ('ASIO library: ' + asio_inc)
- 
- openvpn3_core_inc = get_option('openvpn3_core_path')
-diff --git a/meson_options.txt b/meson_options.txt
-index d9cf02e..43e301e 100644
--- a/meson_options.txt
-+++ b/meson_options.txt
-@@ -26,7 +26,7 @@ option('debug_options', type: 'boolean', value: false,
- #
- #  Build environment and related build time options
- #
-option('asio_path', type: 'string', value: './vendor/asio',
-+option('asio_path', type: 'string', value: './vendor/asio/asio',
-        description: 'Path to the ASIO header files')
- 
- option('openvpn3_core_path', type: 'string', value: './openvpn3-core',
-- 
-2.43.0
-
@@ -1,115 +0,0 @@
-From 848cc46d05c203de393d75434a3f571d78687f50 Mon Sep 17 00:00:00 2001
-From: Petr Portnov <mrjarviscraft@gmail.com>
-Date: Sun, 22 Sep 2024 13:16:02 +0300
-Subject: [PATCH] build: allow installation directories' customization
-
-This allows to configure the installation directories
-for systemd and D-Bus files.
-
-Signed-off-by: Petr Portnov <mrjarviscraft@gmail.com>
---
- distro/systemd/meson.build |  9 +++++++--
- meson.build                | 12 ++++++++++--
- meson_options.txt          | 12 ++++++++++++
- src/configmgr/meson.build  | 10 ++++++----
- 4 files changed, 35 insertions(+), 8 deletions(-)
-
-diff --git a/distro/systemd/meson.build b/distro/systemd/meson.build
-index 36d556c..9c636b6 100644
--- a/distro/systemd/meson.build
-+++ b/distro/systemd/meson.build
-@@ -15,12 +15,17 @@ systemd_cfg = configuration_data({
- 
- systemd_service_cfg = dependency('systemd')
- 
-+systemd_system_unit_dir = get_option('systemd_system_unit_dir')
-+if systemd_system_unit_dir == ''
-+  systemd_system_unit_dir = systemd_service_cfg.get_variable('systemdsystemunitdir')
-+endif
-+
- configure_file(
-     input: 'openvpn3-autoload.service.in',
-     output: 'openvpn3-autoload.service',
-     configuration: systemd_cfg,
-     install: true,
-    install_dir: systemd_service_cfg.get_variable('systemdsystemunitdir'),
-+    install_dir: systemd_system_unit_dir,
- )
- 
- configure_file(
-@@ -28,7 +33,7 @@ configure_file(
-     output: 'openvpn3-session@.service',
-     configuration: systemd_cfg,
-     install: true,
-    install_dir: systemd_service_cfg.get_variable('systemdsystemunitdir'),
-+    install_dir: systemd_system_unit_dir,
- )
- 
- custom_target('openvpn3-systemd',
-diff --git a/meson.build b/meson.build
-index 586c72a..ba41440 100644
--- a/meson.build
-+++ b/meson.build
-@@ -203,8 +203,16 @@ message('OpenVPN 3 Linux service binary directory: ' + get_option('prefix') / li
- 
- #
- #  D-Bus configuration
-dbus_policy_dir = dep_dbus.get_variable('datadir') / 'dbus-1' / 'system.d'
-dbus_service_dir = dep_dbus.get_variable('system_bus_services_dir')
-+dbus_policy_dir = get_option('dbus_policy_dir')
-+if dbus_policy_dir == ''
-+    dbus_policy_dir = dep_dbus.get_variable('datadir') / 'dbus-1' / 'system.d'
-+endif
-+
-+dbus_service_dir = get_option('dbus_system_service_dir')
-+if dbus_service_dir == ''
-+    dbus_service_dir = dep_dbus.get_variable('system_bus_services_dir')
-+endif
-+
- dbus_config = {
-     'OPENVPN_USERNAME': get_option('openvpn_username'),
-     'LIBEXEC_PATH': get_option('prefix') / libexec_dir,
-diff --git a/meson_options.txt b/meson_options.txt
-index 43e301e..04809df 100644
--- a/meson_options.txt
-+++ b/meson_options.txt
-@@ -93,6 +93,18 @@ option('use-legacy-polkit-pkla', type: 'feature', value: 'disabled',
- option('polkit_pkla_rulesdir', type: 'string', value: '',
-        description: 'Override PolicyKit PKLA rules directory')
- 
-+#
-+# Installation
-+#
-+option('dbus_policy_dir', type: 'string',
-+       description: 'D-Bus policy directory')
-+option('dbus_system_service_dir', type: 'string',
-+       description: 'D-Bus system service directory')
-+option('systemd_system_unit_dir', type: 'string',
-+       description: 'Path to systemd system unit directory')
-+option('create_statedir', type: 'feature', value: 'enabled',
-+       description: 'Create directory for OpenVPN 3 state during install phase')
-+
- #
- #  Testing tools
- #
-diff --git a/src/configmgr/meson.build b/src/configmgr/meson.build
-index 5d0a649..6f788b7 100644
--- a/src/configmgr/meson.build
-+++ b/src/configmgr/meson.build
-@@ -52,7 +52,9 @@ configure_file(
-     install_dir: dbus_service_dir,
- )
- 
-# Create the configs directory for persistent configuration profiles
-# NOTE: Can be replaced with install_emptydir() when Meson 0.60 or newer
-#       is available on all supported distros
-meson.add_install_script('sh','-c', 'mkdir -p $DESTDIR@0@'.format(openvpn3_statedir / 'configs'))
-+if get_option('create_statedir').enabled()
-+    # Create the configs directory for persistent configuration profiles
-+    # NOTE: Can be replaced with install_emptydir() when Meson 0.60 or newer
-+    #       is available on all supported distros
-+    meson.add_install_script('sh','-c', 'mkdir -p $DESTDIR@0@'.format(openvpn3_statedir / 'configs'))
-+endif
-- 
-2.45.2
-
@@ -28,25 +28,18 @@
 stdenv.mkDerivation rec {
  pname = "openvpn3";
  # also update openvpn3-core
-  version = "23";
+  version = "24";

  src = fetchFromGitHub {
    owner = "OpenVPN";
    repo = "openvpn3-linux";
    rev = "refs/tags/v${version}";
-    hash = "sha256-5gkutqyUPZDwRPzSFdUXg2G5mtQKbdhZu8xnNAdXoF0=";
+    hash = "sha256-e3NRLrznTEolTzMO+kGEh48MCrcEr8p7JG3hG889aK4=";
    # `openvpn3-core` is a submodule.
    # TODO: make it into a separate package
    fetchSubmodules = true;
  };

-  patches = [
-    # Merged in upstream, will land in v24
-    # https://github.com/OpenVPN/openvpn3-linux/commit/75abb7dc9366ba85fb1a144d88f02a1e8a62f538
-    ./0001-build-reduce-hardcode-in-asio_path.patch
-    ./0002-build-allow-installation-directories-customization.patch
-  ];
-
  postPatch = ''
    echo '#define OPENVPN_VERSION "3.git:unknown:unknown"
    #define PACKAGE_GUIVERSION "v${builtins.replaceStrings [ "_" ] [ ":" ] version}"
@@ -106,7 +99,7 @@ stdenv.mkDerivation rec {
    (lib.mesonOption "dbus_policy_dir" "${placeholder "out"}/share/dbus-1/system.d")
    (lib.mesonOption "dbus_system_service_dir" "${placeholder "out"}/share/dbus-1/system-services")
    (lib.mesonOption "systemd_system_unit_dir" "${placeholder "out"}/lib/systemd/system")
-    (lib.mesonOption "create_statedir" "disabled")
+    (lib.mesonOption "create_statedir" "false")
    (lib.mesonOption "sharedstatedir" "/etc")
  ];

@@ -5,13 +5,13 @@

 buildGoModule rec {
  pname = "picocrypt-cli";
-  version = "2.09";
+  version = "2.10";

  src = fetchFromGitHub {
    owner = "Picocrypt";
    repo = "CLI";
    rev = version;
-    hash = "sha256-DV+L3s479PqSiqi2xigZWwXVNCdkayD0wCpnlR0TljY=";
+    hash = "sha256-a9fRbI3yv+K44/TIMqZMgZXRKN/Rh2AJyeTDhJynr4M=";
  };

  sourceRoot = "${src.name}/picocrypt";
@@ -0,0 +1,34 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  nix-update-script,
+}:
+
+buildGoModule rec {
+  pname = "pkgsite";
+  version = "0-unstable-2024-12-06";
+
+  src = fetchFromGitHub {
+    owner = "golang";
+    repo = "pkgsite";
+    rev = "37884bfc1a9e2aa46989ac56e671bcbd240bb4f7";
+    hash = "sha256-RZTRfB1mEM13x/vLrxu7877C7Zh/kJxpYMP9xR2OOXw=";
+  };
+
+  vendorHash = "sha256-Ijcj1Nq4WjXcUqmoDkpO9I4rl/4/TMXFMQVAlEK11R8=";
+
+  subPackages = [ "cmd/pkgsite" ];
+
+  ldflags = [ "-s" ];
+
+  passthru.updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; };
+
+  meta = {
+    description = "Official tool to extract and generate documentation for Go projects like pkg.go.dev";
+    homepage = "https://github.com/golang/pkgsite";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ phanirithvij ];
+    mainProgram = "pkgsite";
+  };
+}
@@ -1,21 +1,22 @@
-{ lib
-, buildGoModule
-, fetchFromGitHub
-, nix-update-script
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  nix-update-script,
 }:

 buildGoModule rec {
  pname = "pocketbase";
-  version = "0.23.1";
+  version = "0.23.4";

  src = fetchFromGitHub {
    owner = "pocketbase";
    repo = "pocketbase";
    rev = "v${version}";
-    hash = "sha256-he4lvlIqbIozbtMizZEjfnBbXXd6+LfZqKD95UE8sPI=";
+    hash = "sha256-FBxMDEqq1ZsGIVCiW7FQrrCeIupVxooZ/TcVCACdQdQ=";
  };

-  vendorHash = "sha256-zMHEArUS4/r7nkZfDK8BwGMLrpkBihxhkBoO/p6auTk=";
+  vendorHash = "sha256-VRJj/NQyHECokPgrqT1piumAKCZLgorPov7AqSbEAxo=";

  # This is the released subpackage from upstream repo
  subPackages = [ "examples/base" ];
@@ -39,7 +40,10 @@ buildGoModule rec {
    description = "Open Source realtime backend in 1 file";
    homepage = "https://github.com/pocketbase/pocketbase";
    license = licenses.mit;
-    maintainers = with maintainers; [ dit7ya thilobillerbeck ];
+    maintainers = with maintainers; [
+      dit7ya
+      thilobillerbeck
+    ];
    mainProgram = "pocketbase";
  };
 }
@@ -1,46 +1,54 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, cmake
-, gbenchmark
-, gtest
-, civetweb
-, zlib
-, curl
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  pkg-config,
+  civetweb,
+  curl,
+  gbenchmark,
+  gtest,
+  zlib,
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "prometheus-cpp";
-  version = "1.1.0";
+  version = "1.3.0";

  src = fetchFromGitHub {
    owner = "jupp0r";
-    repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-qx6oBxd0YrUyFq+7ArnKBqOwrl5X8RS9nErhRDUJ7+8=";
+    repo = "prometheus-cpp";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-XQ8N+affKVqn/hrMHWg0eN+0Op6m9ZdVNNAW0GpDAng=";
  };

-  nativeBuildInputs = [ cmake ];
-  buildInputs = [ gbenchmark gtest zlib curl ];
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+  ];
+  buildInputs = [
+    curl
+    gbenchmark
+    gtest
+    zlib
+  ];
  propagatedBuildInputs = [ civetweb ];
  strictDeps = true;

  cmakeFlags = [
-    "-DUSE_THIRDPARTY_LIBRARIES=OFF"
    "-DBUILD_SHARED_LIBS=ON"
+    "-DOVERRIDE_CXX_STANDARD_FLAGS=OFF"
+    "-DUSE_THIRDPARTY_LIBRARIES=OFF"
  ];

-  outputs = [ "out" "dev" ];
-
-  postInstall = ''
-    mkdir -p $dev/lib/pkgconfig
-    substituteAll ${./prometheus-cpp.pc.in} $dev/lib/pkgconfig/prometheus-cpp.pc
-  '';
+  outputs = [
+    "out"
+    "dev"
+  ];

  meta = {
    description = "Prometheus Client Library for Modern C++";
    homepage = "https://github.com/jupp0r/prometheus-cpp";
    license = [ lib.licenses.mit ];
  };
-
-}
+})
@@ -1,10 +0,0 @@
-prefix=@out@
-includedir=${prefix}/include
-libdir=${prefix}/lib
-
-Name: prometheus-cpp
-Description: Prometheus Client Library for Modern C++
-URL: https://github.com/jupp0r/prometheus-cpp
-Version: @version@
-Cflags: -isystem${includedir}
-Libs: -Wl,-rpath,${libdir} -L${libdir} -lprometheus-cpp-core -lprometheus-cpp-pull -lprometheus-cpp-push
@@ -6,14 +6,14 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "puncia";
-  version = "0.24";
+  version = "0.25";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "ARPSyndicate";
    repo = "puncia";
-    rev = "refs/tags/v${version}";
-    hash = "sha256-4PJyAYPRsqay5Y9RxhOpUgIJvntVKokqYhE1b+hVc44=";
+    tag = "v${version}";
+    hash = "sha256-+RA7vAp2bjyZYIe0oyDeTQx89Gl3UEP4D3uSNVlF3i0=";
  };

  build-system = with python3.pkgs; [ setuptools ];
@@ -9,10 +9,10 @@
 let
  # get rid of rec
  pname = "pyspread";
-  version = "2.3";
+  version = "2.3.1";
  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-vbDZo/kYtnxmOd3JSEG9+0yD0nfM/BGcAySfBD2xogw=";
+    hash = "sha256-l6b02CIUqPnT16zqOWl6gDdAobkhiqBMFvT+R1Dvtek=";
  };
  inherit (libsForQt5)
    qtsvg
@@ -7,14 +7,14 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "quark-engine";
-  version = "24.11.1";
+  version = "24.12.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "quark-engine";
    repo = "quark-engine";
-    rev = "refs/tags/v${version}";
-    hash = "sha256-Nv4k/AN906ue13tlif+JsHLSWxdoI4maJ3EUGOZkDNI=";
+    tag = "v${version}";
+    hash = "sha256-aOhqUuTT13xhcXXnY/P8NnF1PAqFn/2+wMizSA1Jb6o=";
  };

  build-system = with python3.pkgs; [ setuptools ];
@@ -12,16 +12,16 @@ let
 in
 rustPlatform.buildRustPackage rec {
  pname = "railway";
-  version = "3.18.0";
+  version = "3.19.1";

  src = fetchFromGitHub {
    owner = "railwayapp";
    repo = "cli";
    rev = "v${version}";
-    hash = "sha256-KMmiVA6ubwX8n2MVBOTfsT+05ii89DToMSxpINuizEc=";
+    hash = "sha256-eV66O5JG5ME046/1rM9GjF3rWioXq2RspFJxMWf5l/k=";
  };

-  cargoHash = "sha256-sDDNZAUt+4H1smA+8Pynu1EQtAdP2U6nHwC7AWo5gnk=";
+  cargoHash = "sha256-p6FZCJ+Uwkf7CLTsVKn4eYGCmgmlzCDpt6tylM5FWzo=";

  nativeBuildInputs = [ pkg-config ];

@@ -19,13 +19,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "rocksdb";
-  version = "9.7.3";
+  version = "9.7.4";

  src = fetchFromGitHub {
    owner = "facebook";
    repo = "rocksdb";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-HeC7m9ZK7SIU7adkQEurzHf+MY7AiEwXZQaz9uZZncU=";
+    hash = "sha256-u5uuShM2SxHc9/zL4UU56IhCcR/ZQbzde0LgOYS44bM=";
  };

  patches = lib.optional (lib.versionAtLeast finalAttrs.version "6.29.3" && enableLiburing) ./fix-findliburing.patch;
@@ -7,13 +7,13 @@
 stdenv.mkDerivation rec {
  pname = "secp256k1";

-  version = "0.5.1";
+  version = "0.6.0";

  src = fetchFromGitHub {
    owner = "bitcoin-core";
    repo = "secp256k1";
    rev = "refs/tags/v${version}";
-    sha256 = "sha256-IYvvBob8e82EiPLX9yA8fd+KWrMri1rI5csp81rAdrg=";
+    sha256 = "sha256-pCSNUSrPyN/lLYZm7zK/b9LICkThXOr6JAyFvHZSPW0=";
  };

  nativeBuildInputs = [ autoreconfHook ];
@@ -19,13 +19,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "shotcut";
-  version = "24.10.13";
+  version = "24.11.17";

  src = fetchFromGitHub {
    owner = "mltframework";
    repo = "shotcut";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-lt8NXjh222h6l+zfGNKGntUNPya4TUjwqA74DDdWzQo=";
+    rev = "refs/tags/v${finalAttrs.version}";
+    hash = "sha256-sOBGLQYRGHcXNoKTmqbBqmheUFHe7p696BTCiwtF5JY=";
  };

  nativeBuildInputs = [
@@ -49,6 +49,7 @@ stdenv.mkDerivation (finalAttrs: {
  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ darwin.apple_sdk.frameworks.Cocoa ];

  env.NIX_CFLAGS_COMPILE = "-DSHOTCUT_NOUPGRADE";
+
  cmakeFlags = [ "-DSHOTCUT_VERSION=${finalAttrs.version}" ];

  patches = [
@@ -74,7 +75,7 @@ stdenv.mkDerivation (finalAttrs: {

  passthru.updateScript = gitUpdater { rev-prefix = "v"; };

-  meta = with lib; {
+  meta = {
    description = "Free, open source, cross-platform video editor";
    longDescription = ''
      An official binary for Shotcut, which includes all the
@@ -86,12 +87,12 @@ stdenv.mkDerivation (finalAttrs: {
      please use the official build from shotcut.org instead.
    '';
    homepage = "https://shotcut.org";
-    license = licenses.gpl3Plus;
-    maintainers = with maintainers; [
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [
      woffs
      peti
    ];
-    platforms = platforms.unix;
+    platforms = lib.platforms.unix;
    mainProgram = "shotcut";
  };
 })
@@ -6,14 +6,14 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "smbclient-ng";
-  version = "2.1.6";
+  version = "2.1.7";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "p0dalirius";
    repo = "smbclient-ng";
-    rev = "refs/tags/${version}";
-    hash = "sha256-T1OAiRL7AGMz12dFIPOESS77lVd62iaBt9vXCdzqJBQ=";
+    tag = version;
+    hash = "sha256-gZbXtgxB5GkypU6U2oe9miobBbwnz/eXs/yWkzVUCcc=";
  };

  pythonRelaxDeps = [
@@ -1,18 +1,49 @@
-{ lib, stdenv, autoPatchelfHook, makeDesktopItem, copyDesktopItems, wrapGAppsHook3, fetchurl
-, alsa-lib, at-spi2-atk, at-spi2-core, atk, cairo, cups
-, gtk3, nss, glib, nspr, gdk-pixbuf, libdrm, libgbm
-, libX11, libXScrnSaver, libXcomposite, libXcursor, libXdamage, libXext
-, libXfixes, libXi, libXrandr, libXrender, libXtst, libxcb, libxshmfence, pango
-, gcc-unwrapped, udev
+{
+  lib,
+  stdenv,
+  autoPatchelfHook,
+  makeDesktopItem,
+  copyDesktopItems,
+  wrapGAppsHook3,
+  fetchurl,
+  alsa-lib,
+  at-spi2-atk,
+  at-spi2-core,
+  atk,
+  cairo,
+  cups,
+  gtk3,
+  nss,
+  glib,
+  nspr,
+  gdk-pixbuf,
+  libdrm,
+  libgbm,
+  libX11,
+  libXScrnSaver,
+  libXcomposite,
+  libXcursor,
+  libXdamage,
+  libXext,
+  libXfixes,
+  libXi,
+  libXrandr,
+  libXrender,
+  libXtst,
+  libxcb,
+  libxshmfence,
+  pango,
+  gcc-unwrapped,
+  udev,
 }:

 stdenv.mkDerivation rec {
  pname = "snapmaker-luban";
-  version = "4.10.2";
+  version = "4.14.0";

  src = fetchurl {
    url = "https://github.com/Snapmaker/Luban/releases/download/v${version}/snapmaker-luban-${version}-linux-x64.tar.gz";
-    sha256 = "sha256-unxI0L8pcF6iWWa57GpYv/aYsApKAKfRaes3uXE7izM=";
+    hash = "sha256-/cJxVhY9zJdsg8l+BxJDr53/Lsz4JMBGMIS2HD6NXvM=";
  };

  nativeBuildInputs = [
@@ -42,10 +73,33 @@ stdenv.mkDerivation rec {
  ];

  libPath = lib.makeLibraryPath [
-    stdenv.cc.cc alsa-lib atk at-spi2-atk at-spi2-core cairo cups
-    gdk-pixbuf glib gtk3 libX11 libXcomposite libxshmfence
-    libXcursor libXdamage libXext libXfixes libXi libXrandr libXrender
-    libXtst nspr nss libxcb pango libXScrnSaver udev
+    stdenv.cc.cc
+    alsa-lib
+    atk
+    at-spi2-atk
+    at-spi2-core
+    cairo
+    cups
+    gdk-pixbuf
+    glib
+    gtk3
+    libX11
+    libXcomposite
+    libxshmfence
+    libXcursor
+    libXdamage
+    libXext
+    libXfixes
+    libXi
+    libXrandr
+    libXrender
+    libXtst
+    nspr
+    nss
+    libxcb
+    pango
+    libXScrnSaver
+    udev
  ];

  autoPatchelfIgnoreMissingDeps = [
@@ -83,16 +137,19 @@ stdenv.mkDerivation rec {
      icon = "snapmaker-luban";
      desktopName = "Snapmaker Luban";
      genericName = meta.description;
-      categories = [ "Office" "Printing" ];
+      categories = [
+        "Office"
+        "Printing"
+      ];
    })
  ];

-  meta = with lib; {
+  meta = {
    description = "Snapmaker Luban is an easy-to-use 3-in-1 software tailor-made for Snapmaker machines";
    homepage = "https://github.com/Snapmaker/Luban";
-    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
-    license = licenses.gpl3;
-    maintainers = [ maintainers.simonkampe ];
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+    license = lib.licenses.gpl3;
+    maintainers = with lib.maintainers; [ simonkampe ];
    platforms = [ "x86_64-linux" ];
    knownVulnerabilities = [ "CVE-2023-5217" ];
  };
@@ -9,16 +9,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "snpguest";
-  version = "0.7.1";
+  version = "0.8.0";

  src = fetchFromGitHub {
    owner = "virtee";
    repo = "snpguest";
    rev = "refs/tags/v${version}";
-    hash = "sha256-otsgMUdDp93J/ynquHDs6+oLh0CunyfqZwmcKXcXX0Q=";
+    hash = "sha256-NqessN2yo7H17zWsnnI1oNIRG5Z1Wxi8oTWETP9DHpk=";
  };

-  cargoHash = "sha256-n3gqw4R8NZP8l2PmHWag+cBXlLx1GQPPADBmaYRTe6Q=";
+  cargoHash = "sha256-vhHlfGl6fSe8rKRv5u3iqomIlLpVKwOVbZDwuDgsdhs=";

  nativeBuildInputs = [ pkg-config ];

--- a/Show More
+++ b/Show More