Merge e7c3209de1 into haskell-updates

2026-02-03 00:29:14 +00:00
parent f5501e699e e7c3209de1
commit c223df8214
570 changed files with 5103 additions and 11387 deletions
@@ -79,6 +79,10 @@ The [bundle type](https://tauri.app/v1/guides/building/) to build.

 Disables using `tauriBuildHook`.

+#### `dontTauriFixup` {#dont-tauri-fixup}
+
+Disables the `tauriFixupHook` pre fixup phase.
+
 #### `dontTauriInstall` {#dont-tauri-install}

 Disables using `tauriInstallPostBuildHook` and `tauriInstallHook`.
@@ -36,6 +36,8 @@ coq.withPackages (
 )
 ```

+If you install the `vsrocq-language-server` or `rocq-lsp` server, make sure to list them as part of the above `coq.withPackages` expression instead of installing them separately if you want them to find your Coq/Rocq packages.
+
 ## Rocq packages attribute sets: `rocqPackages` {#rocq-packages-attribute-sets-rocqpackages}

 The recommended way of defining a derivation for a Rocq library, is to use the `rocqPackages.mkRocqDerivation` function, which is essentially a specialization of `mkDerivation` taking into account most of the specifics of Rocq libraries. The following attributes are supported:
@@ -2671,6 +2671,9 @@
  "dont-tauri-build": [
    "index.html#dont-tauri-build"
  ],
+  "dont-tauri-fixup": [
+    "index.html#dont-tauri-fixup"
+  ],
  "dont-tauri-install": [
    "index.html#dont-tauri-install"
  ],
@@ -59,6 +59,8 @@

 - `corepack_latest` has been removed, as Corepack is no longer distributed with Node.js.

+- `nodePackages.browser-sync` has been removed, as it was unmaintained within nixpkgs.
+
 - `spoof` has been removed, as there are many issues upstream with it working on modern OS versions, and it appears to be unmaintained.

 - `nodePackages.wavedrom-cli` has been removed, as it was unmaintained within nixpkgs.
@@ -74,6 +76,8 @@

 - `lima` has been updated from `1.x` to `2.x`. This major update includes several breaking changes, such as `/tmp/lima` no longer being mounted by default.

+- `minio_legacy_fs` has been removed. If you used that package, migrate your data to be compatible with the newest minio and use the package `minio`.
+
 - `mercure` has been update to `0.21.4` (or later). Version [0.21.0](https://github.com/dunglas/mercure/releases/v0.21.0) and [0.21.2](https://github.com/dunglas/mercure/releases/tag/v0.21.2) introduce breaking changes to the package.

 - `n8n` has been updated to version 2. You can find the breaking changes here: https://docs.n8n.io/2-0-breaking-changes/.
@@ -111,6 +115,8 @@
  retained for packages that have not completed migration. `asio_1_10` has been removed as no packages depend on it anymore.
  `asio` also no longer propagates `boost` as it is used independent from `boost` in most cases.

+- `stalwart-mail` has been renamed to `stalwart`
+
 - Ethercalc and its associated module have been removed, as the package is unmaintained and cannot be installed from source with npm now.

 - `coreth` has been removed, as upstream has moved it into `avalanchego`.
@@ -1049,12 +1049,6 @@
    github = "ALameLlama";
    githubId = 55490546;
  };
-  alanpearce = {
-    email = "alan@alanpearce.eu";
-    github = "alanpearce";
-    githubId = 850317;
-    name = "Alan Pearce";
-  };
  alapshin = {
    email = "alapshin@fastmail.com";
    github = "alapshin";
@@ -1338,6 +1332,12 @@
      }
    ];
  };
+  alinnow = {
+    name = "Alin";
+    email = "alin@alin.ovh";
+    github = "alinnow";
+    githubId = 850317;
+  };
  alirezameskin = {
    email = "alireza.meskin@gmail.com";
    github = "alirezameskin";
@@ -4767,6 +4767,13 @@
    githubId = 803961;
    name = "Hurshal Patel";
  };
+  chordtoll = {
+    email = "nix@chordtoll.com";
+    name = "chordtoll";
+    github = "chordtoll";
+    githubId = 542193;
+    keys = [ { fingerprint = "A58D E7C6 C8DA F1F8 922E  4D2A 6F33 950B 4475 5770"; } ];
+  };
  chpatrick = {
    email = "chpatrick@gmail.com";
    github = "chpatrick";
@@ -6140,6 +6147,11 @@
    githubId = 1279939;
    name = "Daniel Beckwith";
  };
+  dbeley = {
+    github = "dbeley";
+    githubId = 6568955;
+    name = "David Beley";
+  };
  dbirks = {
    email = "david@birks.dev";
    github = "dbirks";
@@ -11035,6 +11047,11 @@
    githubId = 207392575;
    name = "Isaac Kabel";
  };
+  ikci = {
+    github = "ikcii";
+    githubId = 48479629;
+    name = "ikci";
+  };
  ikervagyok = {
    email = "ikervagyok@gmail.com";
    github = "ikervagyok";
@@ -24476,6 +24493,12 @@
    github = "Sinjin2300";
    githubId = 35543336;
  };
+  sinrohit-desco = {
+    email = "rohit1.singh@deshaw.com";
+    github = "sinrohit-desco";
+    githubId = 207977821;
+    name = "Rohit Singh";
+  };
  sioodmy = {
    name = "Antoni Sokołowski";
    github = "sioodmy";
@@ -27754,7 +27777,7 @@
    name = "Thibaut Smith";
  };
  vieta = {
-    email = "xyzVieta@gmail.com";
+    email = "vieta@4d2.org";
    github = "yVieta";
    githubId = 94648307;
    name = "Thanh Viet Nguyen";
@@ -141,6 +141,16 @@ with lib.maintainers;
    enableFeatureFreezePing = true;
  };

+  cockpit = {
+    members = [
+      alexandru0-dev
+      andre4ik3
+      lucasew
+    ];
+    scope = "Maintain Cockpit and official plugins by the Cockpit project.";
+    shortName = "Cockpit";
+  };
+
  coq = {
    members = [
      cohencyril
@@ -983,8 +983,7 @@ Make sure to also check the many updates in the [Nixpkgs library](#sec-release-2
  [services.sitespeed-io](#opt-services.sitespeed-io.enable).

 - [stalwart-mail](https://stalw.art), an all-in-one email server (SMTP, IMAP,
-  JMAP). Available as
-  [services.stalwart-mail](#opt-services.stalwart-mail.enable).
+  JMAP). Available as `services.stalwart-mail`.


 - [tang](https://github.com/latchset/tang), a server for binding data to
@@ -741,7 +741,7 @@ Use `services.pipewire.extraConfig` or `services.pipewire.configPackages` for Pi

 - `services.soju` now has a wrapper for the `sojuctl` command, pointed at the service config file. It also has the new option `adminSocket.enable`, which creates a unix admin socket at `/run/soju/admin`.

- `services.stalwart-mail` uses the legacy version 0.6.X as default because newer `stalwart-mail` versions require a [manual upgrade process](https://github.com/stalwartlabs/mail-server/blob/main/UPGRADING.md). Change [`services.stalwart-mail.package`](#opt-services.stalwart-mail.package) to `pkgs.stalwart-mail` if you wish to switch to the new version.
+- `services.stalwart-mail` uses the legacy version 0.6.X as default because newer `stalwart-mail` versions require a [manual upgrade process](https://github.com/stalwartlabs/mail-server/blob/main/UPGRADING.md). Change `services.stalwart-mail.package` to `pkgs.stalwart-mail` if you wish to switch to the new version.

 - `services.teeworlds` module now has a wealth of configuration options, including a new `package` option.

@@ -508,8 +508,7 @@

 - Legacy package `stalwart-mail_0_6` was dropped, please note the
  [manual upgrade process](https://github.com/stalwartlabs/mail-server/blob/main/UPGRADING.md)
-  before changing the package to `pkgs.stalwart-mail` in
-  [`services.stalwart-mail.package`](#opt-services.stalwart-mail.package).
+  before changing the package to `pkgs.stalwart-mail` in `services.stalwart-mail.package`.

 - `nomad_1_5` and `nomad_1_6` were dropped, as [they have reached end-of-life upstream](https://support.hashicorp.com/hc/en-us/articles/360021185113-Support-Period-and-End-of-Life-EOL-Policy). Evaluating them will throw an error.

@@ -77,6 +77,11 @@ of pulling the upstream container image from Docker Hub. If you want the old beh
 }
 ```

+- `services.stalwart-mail` has been renamed to `services.stalwart` to align with upstream re-brand as an e-mail and collaboration server. Other notable breaking changes to module:
+
+  - `systemd.services.stalwart` owned by `stalwart:stalwart`. The `user` and `group` are configurable via `services.stalwart.user` and `services.stalwart.group`, respectively. By default, if `stateVersion` is older than `26.05`, will fallback to legacy value of `stalwart-mail` for both `user` and `group`.
+  - Default value for `services.stalwart.dataDir` has changed to `/var/lib/stalwart`. If `stateVersion` is older than `26.05`, will fallback to legacy value of `/var/lib/stalwart-mail`.
+
 - Ethercalc and its associated module have been removed, as the package is unmaintained and cannot be installed from source with npm now.

 - `services.cgit` before always had the git-http-backend and its "export all" setting enabled, which sidestepped any access control configured in cgit's settings. Now you have to make a decision and either enable or disable `services.cgit.gitHttpBackend.checkExportOkFiles` (or disable the git-http-backend).
@@ -91,7 +91,7 @@ in
          broadcom-bt-firmware
          b43Firmware_5_1_138
          b43Firmware_6_30_163_46
-          xow_dongle-firmware
+          xone-dongle-firmware
        ]
        ++ lib.optionals pkgs.stdenv.hostPlatform.isx86 [
          facetimehd-calibration
@@ -20,7 +20,7 @@ in
      ];
      extraModulePackages = with config.boot.kernelPackages; [ xone ];
    };
-    hardware.firmware = [ pkgs.xow_dongle-firmware ];
+    hardware.firmware = [ pkgs.xone-dongle-firmware ];
    hardware.xpad-noone.enable = lib.mkDefault true;
  };

@@ -56,6 +56,15 @@ in
        example = lib.literalExpression ''"''${pkgs.kdePackages.plasma-desktop}/libexec/kimpanel-ibus-panel"'';
        description = "Replace the IBus panel with another panel.";
      };
+      waylandFrontend = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = ''
+          Use the Wayland input method frontend.
+          This doesn't set `GTK_IM_MODULE` and `QT_IM_MODULE` environment variables.
+          See [Using Fcitx 5 on Wayland](https://fcitx-im.org/wiki/Using_Fcitx_5_on_Wayland#GTK_IM_MODULE).
+        '';
+      };
    };
  };

@@ -76,9 +85,11 @@ in
    ];

    environment.variables = {
+      XMODIFIERS = "@im=ibus";
+    }
+    // lib.optionalAttrs (!cfg.waylandFrontend) {
      GTK_IM_MODULE = "ibus";
      QT_IM_MODULE = "ibus";
-      XMODIFIERS = "@im=ibus";
    };

    xdg.portal.extraPortals = lib.mkIf config.xdg.portal.enable [
@@ -779,7 +779,7 @@
  ./services/mail/rss2email.nix
  ./services/mail/schleuder.nix
  ./services/mail/spamassassin.nix
-  ./services/mail/stalwart-mail.nix
+  ./services/mail/stalwart.nix
  ./services/mail/sympa.nix
  ./services/mail/tlsrpt.nix
  ./services/mail/zeyple.nix
@@ -151,6 +151,17 @@
    };

  config = lib.mkMerge [
+    (lib.mkIf (config.virtualisation.docker.enableNvidia || config.virtualisation.podman.enableNvidia) {
+      hardware.nvidia-container-toolkit.enable = lib.mkDefault true;
+
+      warnings = lib.mkIf (!config.hardware.nvidia-container-toolkit.enable) [
+        ''
+          `virtualisation.docker.enableNvidia` or `virtualisation.podman.enableNvidia` is enabled,
+          but `hardware.nvidia-container-toolkit.enable` is disabled. The nvidia-container-toolkit
+          module is required for GPU support in containers.
+        ''
+      ];
+    })
    (lib.mkIf config.virtualisation.docker.enableNvidia {
      environment.etc."nvidia-container-runtime/config.toml".text = ''
        disable-require = true
@@ -162,7 +173,7 @@
        no-cgroups = false
        path = "${lib.getExe' pkgs.libnvidia-container "nvidia-container-cli"}"
        [nvidia-container-runtime]
-        mode = "auto"
+        mode = "cdi"
        runtimes = ["docker-runc", "runc", "crun"]
        [nvidia-container-runtime-hook]
        path = "${lib.getOutput "tools" config.hardware.nvidia-container-toolkit.package}/bin/nvidia-container-runtime-hook"
@@ -5,10 +5,12 @@
  ...
 }:
 let
-  cfg = config.services.stalwart-mail;
+  cfg = config.services.stalwart;
  configFormat = pkgs.formats.toml { };
-  configFile = configFormat.generate "stalwart-mail.toml" cfg.settings;
+  configFile = configFormat.generate "stalwart.toml" cfg.settings;
  useLegacyStorage = lib.versionOlder config.system.stateVersion "24.11";
+  useLegacyDefault = lib.versionOlder config.system.stateVersion "26.05";
+  default = if useLegacyDefault then "stalwart-mail" else "stalwart";

  parsePorts =
    listeners:
@@ -21,17 +23,22 @@ let

 in
 {
-  options.services.stalwart-mail = {
-    enable = lib.mkEnableOption "the Stalwart all-in-one email server";
+  imports = [
+    # since 0.12.0 (2025-05-26) release, upstream re-branded project to 'stalwart' due to inclusion of collaboration features (CalDAV, CardDAV, and WebDAV)
+    #  https://github.com/stalwartlabs/stalwart/releases/tag/v0.12.0
+    (lib.mkRenamedOptionModule [ "services" "stalwart-mail" ] [ "services" "stalwart" ])
+  ];
+  options.services.stalwart = {
+    enable = lib.mkEnableOption "the all-in-one collaboration and mail server, Stalwart";

-    package = lib.mkPackageOption pkgs "stalwart-mail" { };
+    package = lib.mkPackageOption pkgs "stalwart" { };

    openFirewall = lib.mkOption {
      type = lib.types.bool;
      default = false;
      description = ''
        Whether to open TCP firewall ports, which are specified in
-        {option}`services.stalwart-mail.settings.server.listener` on all interfaces.
+        {option}`services.stalwart.settings.server.listener` on all interfaces.
      '';
    };

@@ -39,7 +46,7 @@ in
      inherit (configFormat) type;
      default = { };
      description = ''
-        Configuration options for the Stalwart email server.
+        Configuration options for the Stalwart server.
        See <https://stalw.art/docs/category/configuration> for available options.

        By default, the module is configured to store everything locally.
@@ -48,18 +55,34 @@ in

    dataDir = lib.mkOption {
      type = lib.types.path;
-      default = "/var/lib/stalwart-mail";
+      default = if useLegacyDefault then "/var/lib/stalwart-mail" else "/var/lib/stalwart";
      description = ''
        Data directory for stalwart
      '';
    };

+    user = lib.mkOption {
+      type = lib.types.str;
+      inherit default;
+      description = ''
+        User ownership of service
+      '';
+    };
+
+    group = lib.mkOption {
+      type = lib.types.str;
+      inherit default;
+      description = ''
+        Group ownership of service
+      '';
+    };
+
    credentials = lib.mkOption {
      description = ''
-        Credentials envs used to configure Stalwart-Mail secrets.
+        Credentials envs used to configure Stalwart secrets.
        These secrets can be accessed in configuration values with
        the macros such as
-        `%{file:/run/credentials/stalwart-mail.service/VAR_NAME}%`.
+        `%{file:/run/credentials/stalwart.service/VAR_NAME}%`.
      '';
      type = lib.types.attrsOf lib.types.str;
      default = { };
@@ -90,7 +113,7 @@ in
    ];

    # Default config: all local
-    services.stalwart-mail.settings = {
+    services.stalwart.settings = {
      tracer.stdout = {
        type = lib.mkDefault "stdout";
        level = lib.mkDefault "info";
@@ -132,7 +155,7 @@ in
          );
        in
        {
-          path = "/var/cache/stalwart-mail";
+          path = "/var/cache/${default}";
          resource = lib.mkIf hasHttpListener (lib.mkDefault "file://${cfg.package.webadmin}/webadmin.zip");
        };
    };
@@ -142,20 +165,24 @@ in
    # service is restarted on a potentially large number of files.
    # That would cause unnecessary and unwanted delays.
    users = {
-      groups.stalwart-mail = { };
-      users.stalwart-mail = {
-        isSystemUser = true;
-        group = "stalwart-mail";
+      groups = lib.mkIf (cfg.group == default) {
+        ${cfg.group} = { };
+      };
+      users = lib.mkIf (cfg.user == default) {
+        ${cfg.user} = {
+          isSystemUser = true;
+          inherit (cfg) group;
+        };
      };
    };

    systemd.tmpfiles.rules = [
-      "d '${cfg.dataDir}' - stalwart-mail stalwart-mail - -"
+      "d '${cfg.dataDir}' - '${cfg.user}' '${cfg.group}' - -"
    ];

    systemd = {
-      services.stalwart-mail = {
-        description = "Stalwart Mail Server";
+      services.stalwart = {
+        description = "Stalwart Server";
        wantedBy = [ "multi-user.target" ];
        after = [
          "local-fs.target"
@@ -170,7 +197,7 @@ in
          KillSignal = "SIGINT";
          Restart = "on-failure";
          RestartSec = 5;
-          SyslogIdentifier = "stalwart-mail";
+          SyslogIdentifier = default;

          ExecStartPre =
            if useLegacyStorage then
@@ -190,12 +217,12 @@ in
          ReadWritePaths = [
            cfg.dataDir
          ];
-          CacheDirectory = "stalwart-mail";
-          StateDirectory = "stalwart-mail";
+          CacheDirectory = default;
+          StateDirectory = default;

          # Upstream uses "stalwart" as the username since 0.12.0
-          User = "stalwart-mail";
-          Group = "stalwart-mail";
+          User = cfg.user;
+          Group = cfg.group;

          # Bind standard privileged ports
          AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
@@ -55,8 +55,6 @@ in
      '';
    };

-    jrePackage = lib.mkPackageOption pkgs "jre" { };
-
    jvmOptions = lib.mkOption {
      description = ''
        Extra command line options for the JVM running languagetool.
@@ -70,8 +68,15 @@ in
    };
  };

-  config = lib.mkIf cfg.enable {
+  imports = [
+    (lib.mkRemovedOptionModule [
+      "services"
+      "languagetool"
+      "jrePackage"
+    ] "The jre is now always taken from the package's jre attribute.")
+  ];

+  config = lib.mkIf cfg.enable {
    systemd.services.languagetool = {
      description = "LanguageTool HTTP server";
      wantedBy = [ "multi-user.target" ];
@@ -89,7 +94,7 @@ in
        ProtectHome = "yes";
        Restart = "on-failure";
        ExecStart = ''
-          ${cfg.jrePackage}/bin/java \
+          ${lib.getExe cfg.package.jre} \
            -cp ${cfg.package}/share/languagetool-server.jar \
            ${toString cfg.jvmOptions} \
            org.languagetool.server.HTTPServer \
@@ -17,7 +17,12 @@ in
      dataDir = lib.mkOption {
        type = lib.types.str;
        default = "/var/lib/sonarr/.config/NzbDrone";
-        description = "The directory where Sonarr stores its data files.";
+        description = ''
+          The Sonarr home directory used to store all data. If left as the default value
+          this directory will automatically be created before the Sonarr server starts, otherwise
+          you are responsible for ensuring the directory exists with appropriate ownership
+          and permissions.
+        '';
      };

      openFirewall = lib.mkOption {
@@ -35,13 +40,29 @@ in
      user = lib.mkOption {
        type = lib.types.str;
        default = "sonarr";
-        description = "User account under which Sonaar runs.";
+        description = ''
+          User account under which Sonarr runs.";
+
+          ::: {.note}
+          If left as the default value this user will automatically be created
+          on system activation, otherwise you are responsible for
+          ensuring the user exists before the Sonarr service starts.
+          :::
+        '';
      };

      group = lib.mkOption {
        type = lib.types.str;
        default = "sonarr";
-        description = "Group under which Sonaar runs.";
+        description = ''
+          Group account under which Sonarr runs.
+
+          ::: {.note}
+          If left as the default value this group will automatically be created
+          on system activation, otherwise you are responsible for
+          ensuring the group exists before the Sonarr service starts.
+          :::
+        '';
      };

      package = lib.mkPackageOption pkgs "sonarr" { };
@@ -49,10 +70,6 @@ in
  };

  config = lib.mkIf cfg.enable {
-    systemd.tmpfiles.rules = [
-      "d '${cfg.dataDir}' 0700 ${cfg.user} ${cfg.group} - -"
-    ];
-
    systemd.services.sonarr = {
      description = "Sonarr";
      after = [ "network.target" ];
@@ -69,6 +86,9 @@ in
          "-data=${cfg.dataDir}"
        ];
        Restart = "on-failure";
+      }
+      // lib.optionalAttrs (cfg.dataDir == "/var/lib/sonarr/.config/NzbDrone") {
+        StateDirectory = "sonarr";
      };
    };

@@ -15,6 +15,33 @@ let
    mkPackageOption
    ;
  settingsFormat = pkgs.formats.ini { };
+
+  pathPkgs = [ cfg.package ] ++ cfg.plugins;
+
+  resourcesEnv = pkgs.buildEnv {
+    name = "cockpit-plugins";
+    paths = pathPkgs;
+    pathsToLink = [ "/share/cockpit" ];
+  };
+
+  depsEnv = pkgs.buildEnv {
+    name = "cockpit-plugins-env";
+    paths = lib.concatMap (p: p.passthru.cockpitPath or [ ]) pathPkgs;
+    pathsToLink = [
+      "/bin"
+      "/share"
+      "/lib"
+    ];
+  };
+
+  share = pkgs.buildEnv {
+    name = "cockpit-share";
+    paths = [
+      resourcesEnv
+      depsEnv
+    ];
+    pathsToLink = [ "/share" ];
+  };
 in
 {
  options = {
@@ -100,22 +127,11 @@ in
      };

      # Add plugins in discoverable folder
-      "cockpit/share/cockpit".source = "${
-        pkgs.buildEnv {
-          name = "cockpit-plugins";
-          paths = cfg.plugins ++ [ cfg.package ];
-          pathsToLink = [ "/share/cockpit" ];
-        }
-      }/share/cockpit";
+      "cockpit/share".source = "${share}/share";

      # Add plugins dependencies
-      "cockpit/bin".source = "${
-        pkgs.buildEnv {
-          name = "cockpit-path";
-          paths = lib.concatMap (p: p.passthru.cockpitPath or [ ]) cfg.plugins;
-          pathsToLink = [ "/bin" ];
-        }
-      }/bin";
+      "cockpit/bin".source = "${depsEnv}/bin";
+      "cockpit/lib".source = "${depsEnv}/lib";
    };

    security.pam.services.cockpit = {
@@ -101,6 +101,7 @@ let
        "node-cert"
        "nut"
        "nvidia-gpu"
+        "opnsense"
        "pgbouncer"
        "php-fpm"
        "pihole"
@@ -0,0 +1,117 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.prometheus.exporters.opnsense;
+  inherit (lib)
+    mkOption
+    types
+    optionalString
+    concatStringsSep
+    concatMapStringsSep
+    ;
+in
+{
+  port = 9144;
+  extraOpts = {
+    opnsenseServerAddress = mkOption {
+      type = types.str;
+      default = "192.168.1.1";
+      example = "192.168.100.254";
+      description = ''
+        Opnsense IP address of the opnsense appliance.
+        Defaults to 192.168.1.1
+      '';
+    };
+    opnsenseServerProtocol = mkOption {
+      type = types.enum [
+        "http"
+        "https"
+      ];
+      default = "https";
+      example = "http";
+      description = ''
+        Opnsense metrics scraper protocol to use.
+        Defaults to https.
+      '';
+    };
+    apiKeyFile = mkOption {
+      type = types.nullOr types.path;
+      description = ''
+        File containing the api key.
+      '';
+    };
+    apiSecretFile = mkOption {
+      type = types.nullOr types.path;
+      description = ''
+        File containing the api secret.
+      '';
+    };
+    user = mkOption {
+      type = types.str;
+      default = "opnsense";
+      description = ''
+        User name under which the opensense exporter shall be run.
+      '';
+    };
+    group = mkOption {
+      type = types.str;
+      default = "opnsense";
+      description = ''
+        Group under which the opnsense exporter shall be run.
+      '';
+    };
+    enabledExporter = mkOption {
+      type = types.listOf types.str;
+      default = [ ];
+      example = [ "disable-openvpn" ];
+      description = ''
+        Collectors to enable or disable.
+        All collectors are enabled by default.
+      '';
+    };
+    disabledExporter = mkOption {
+      type = types.listOf types.str;
+      default = [ ];
+      example = [ "disable-openvpn" ];
+      description = ''
+        Collectors to enable or disable.
+        All collectors are enabled by default.
+      '';
+    };
+  };
+  serviceOpts = {
+    serviceConfig = {
+      AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
+      CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
+      LoadCredential = [
+        "${optionalString (cfg.apiKeyFile != null) "opnsense.api-key=${cfg.apiKeyFile}"}"
+        "${optionalString (cfg.apiSecretFile != null) "opnsense.api-secret=${cfg.apiSecretFile}"}"
+      ];
+      MemoryDenyWriteExecute = true;
+      NoNewPrivileges = true;
+      ProtectClock = true;
+      ProtectSystem = "strict";
+      Restart = "on-failure";
+      RestrictAddressFamilies = [
+        "AF_INET"
+        "AF_INET6"
+        "AF_UNIX"
+      ];
+      RestrictNamespaces = true;
+      RestrictRealtime = true;
+      ExecStart = ''
+        ${lib.getExe pkgs.prometheus-opnsense-exporter} \
+          ${concatMapStringsSep " " (x: "--exporter." + x) cfg.enabledExporter} \
+          ${concatMapStringsSep " " (x: "--no-exporter." + x) cfg.disabledExporter} \
+          --opnsense.address ${cfg.opnsenseServerAddress} \
+          --opnsense.protocol ${cfg.opnsenseServerProtocol} \
+          --web.listen-address ${cfg.listenAddress}:${toString cfg.port} \
+          ${concatStringsSep " " cfg.extraFlags}
+      '';
+    };
+  };
+}
@@ -16,6 +16,10 @@ in

    package = lib.mkPackageOption pkgs "blocky" { };

+    enableConfigCheck = lib.mkEnableOption "checking the config during build time" // {
+      default = true;
+    };
+
    settings = lib.mkOption {
      type = format.type;
      default = { };
@@ -80,6 +84,14 @@ in
        ];
      };
    };
+    system.checks = lib.mkIf cfg.enableConfigCheck [
+      (pkgs.runCommand "check-blocky-config" { } ''
+        ${lib.getExe cfg.package} --config ${configFile} validate && touch $out
+      '')
+    ];
  };
-  meta.maintainers = with lib.maintainers; [ paepcke ];
+  meta.maintainers = with lib.maintainers; [
+    paepcke
+    kuflierl
+  ];
 }
@@ -350,31 +350,33 @@ in
              };

              extra_records = lib.mkOption {
-                type = lib.types.listOf (
-                  lib.types.submodule {
-                    options = {
-                      name = lib.mkOption {
-                        type = lib.types.str;
-                        description = "DNS record name.";
-                        example = "grafana.tailnet.example.com";
+                type = lib.types.nullOr (
+                  lib.types.listOf (
+                    lib.types.submodule {
+                      options = {
+                        name = lib.mkOption {
+                          type = lib.types.str;
+                          description = "DNS record name.";
+                          example = "grafana.tailnet.example.com";
+                        };
+                        type = lib.mkOption {
+                          type = lib.types.enum [
+                            "A"
+                            "AAAA"
+                          ];
+                          description = "DNS record type.";
+                          example = "A";
+                        };
+                        value = lib.mkOption {
+                          type = lib.types.str;
+                          description = "DNS record value (IP address).";
+                          example = "100.64.0.3";
+                        };
                      };
-                      type = lib.mkOption {
-                        type = lib.types.enum [
-                          "A"
-                          "AAAA"
-                        ];
-                        description = "DNS record type.";
-                        example = "A";
-                      };
-                      value = lib.mkOption {
-                        type = lib.types.str;
-                        description = "DNS record value (IP address).";
-                        example = "100.64.0.3";
-                      };
-                    };
-                  }
+                    }
+                  )
                );
-                default = [ ];
+                default = null;
                description = ''
                  Extra DNS records to expose to clients.
                '';
@@ -847,7 +847,7 @@ in
      system.checks = [
        (pkgs.runCommand "check-sshd-config"
          {
-            nativeBuildInputs = [ validationPackage ];
+            nativeBuildInputs = [ validationPackage.out ];
          }
          ''
            ${lib.concatMapStringsSep "\n" (
@@ -38,6 +38,13 @@ in
        Type = "simple";
        Restart = "always";
        RestartSec = 1;
+        ExecStartPre = [
+          (pkgs.writeShellScript "e-imzo-check-port-availability" ''
+            until [ -z "$(${pkgs.iproute2}/bin/ss -tuln | grep -E ':(64646|64443)\>')" ]; do
+              sleep 1
+            done
+          '')
+        ];
        ExecStart = lib.getExe cfg.package;

        NoNewPrivileges = true;
@@ -57,13 +57,16 @@ in
      automatic-timezoned = {
        description = "Automatically update system timezone based on location";
        requires = [ "automatic-timezoned-geoclue-agent.service" ];
-        after = [ "automatic-timezoned-geoclue-agent.service" ];
+        after = [
+          "automatic-timezoned-geoclue-agent.service"
+          "multi-user.target"
+        ];
        serviceConfig = {
          Type = "exec";
          User = "automatic-timezoned";
          ExecStart = "${cfg.package}/bin/automatic-timezoned";
        };
-        wantedBy = [ "default.target" ];
+        wantedBy = [ "multi-user.target" ];
      };

      automatic-timezoned-geoclue-agent = {
@@ -77,7 +80,6 @@ in
          Restart = "on-failure";
          PrivateTmp = true;
        };
-        wantedBy = [ "default.target" ];
      };

    };
@@ -115,7 +115,7 @@ let
  pkg =
    hostName: cfg:
    cfg.package.combine {
-      inherit (cfg) plugins templates;
+      inherit (cfg) plugins templates extraConfigs;

      pname = p: "${p.pname}-${hostName}";

@@ -252,7 +252,7 @@ let
            else
              null;
          description = ''
-            Location of the dokuwiki acl rules. Mutually exclusive with services.dokuwiki.acl
+            Location of the dokuwiki acl rules.
            Mutually exclusive with services.dokuwiki.acl which is preferred.
            Consult documentation <https://www.dokuwiki.org/acl> for further instructions.
            Example: <https://github.com/splitbrain/dokuwiki/blob/master/conf/acl.auth.php.dist>
@@ -294,7 +294,7 @@ let
          type = types.listOf types.path;
          default = [ ];
          description = ''
-            List of path(s) to respective plugin(s) which are copied from the 'plugin' directory.
+            List of path(s) to respective plugin(s) which are copied into the 'plugin' directory.

            ::: {.note}
            These plugins need to be packaged before use, see example.
@@ -312,7 +312,7 @@ let
                };
                installPhase = "mkdir -p $out; cp -R * $out/";
              };
-            # And then pass this theme to the plugin list like this:
+            # And then pass this plugin to the plugin list like this:
            in [ plugin-icalevents ]
          '';
        };
@@ -321,7 +321,7 @@ let
          type = types.listOf types.path;
          default = [ ];
          description = ''
-            List of path(s) to respective template(s) which are copied from the 'tpl' directory.
+            List of path(s) to respective template(s) which are copied into the 'tpl' directory.

            ::: {.note}
            These templates need to be packaged before use, see example.
@@ -345,6 +345,22 @@ let
          '';
        };

+        extraConfigs = mkOption {
+          type = types.attrsOf types.path;
+          default = { };
+          description = ''
+            Path(s) to additional configuration files that are then linked to the 'conf' directory.
+          '';
+          example = literalExpression ''
+            {
+              "acronyms.local.conf" = pkgs.writeText "acronyms.local.conf" '''
+                r13y  reproducibility
+              ''';
+              "entities.local.conf" = ./dokuwiki-entities;
+            }
+          '';
+        };
+
        poolConfig = mkOption {
          type =
            with types;
@@ -53,6 +53,7 @@ in
      description = "Improved file manager, a single-file web based filemanager";

      after = [ "network-online.target" ];
+      wants = [ "network-online.target" ];
      wantedBy = [ "multi-user.target" ];

      environment = {
@@ -110,25 +110,20 @@ let
  }
  ++ cfg.extraModules;

-  loggingConf = (
-    if cfg.logFormat != "none" then
-      ''
-        ErrorLog ${cfg.logDir}/error.log
+  loggingConf = ''
+    ErrorLog ${if cfg.logFormat != "none" then "${cfg.logDir}/error.log" else "/dev/null"}
+    ${optionalString (cfg.logLevel != null) "LogLevel ${cfg.logLevel}"}

-        LogLevel notice
+    LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
+    LogFormat "%h %l %u %t \"%r\" %>s %b" common
+    LogFormat "%{Referer}i -> %U" referer
+    LogFormat "%{User-agent}i" agent
+    ${optionalString (
+      cfg.logFormat == "custom"
+    ) "LogFormat ${lib.strings.escapeNixString cfg.customLogFormat} custom"}

-        LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
-        LogFormat "%h %l %u %t \"%r\" %>s %b" common
-        LogFormat "%{Referer}i -> %U" referer
-        LogFormat "%{User-agent}i" agent
-
-        CustomLog ${cfg.logDir}/access.log ${cfg.logFormat}
-      ''
-    else
-      ''
-        ErrorLog /dev/null
-      ''
-  );
+    CustomLog ${cfg.logDir}/access.log ${cfg.logFormat}
+  '';

  browserHacks = ''
    <IfModule mod_setenvif.c>
@@ -582,12 +577,67 @@ in
      };

      logFormat = mkOption {
-        type = types.str;
+        type = types.enum [
+          "combined"
+          "common"
+          "referer"
+          "agent"
+          "custom"
+          "none"
+        ];
        default = "common";
-        example = "combined";
+        example = "custom";
        description = ''
-          Log format for log files. Possible values are: combined, common, referer, agent, none.
-          See <https://httpd.apache.org/docs/2.4/logs.html> for more details.
+          Selects the access log format written to log files.
+
+          The values `combined`, `common`, `referer`, and `agent` correspond to predefined Apache HTTPD log formats.
+          Setting the value to `custom` enables the use of a user-defined format string specified via `customLogFormat`.
+          The value `none` disables access logging entirely.
+
+          Further details on Apache log formats are available at <https://httpd.apache.org/docs/2.4/logs.html>.
+        '';
+      };
+
+      customLogFormat = mkOption {
+        type = types.str;
+        default = null;
+        example = ''%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b'';
+        description = ''
+          Defines a custom Apache HTTPD access log format string.
+
+          This option is only consulted when `logFormat` is set to `custom`.
+          The value must be a valid Apache `LogFormat` specification and will be registered under the symbolic name `custom`.
+
+          See <https://httpd.apache.org/docs/2.4/logs.html#formats> for the formal definition of log format directives.
+        '';
+      };
+
+      logLevel = mkOption {
+        type =
+          with types;
+          nullOr (enum [
+            "emerg"
+            "alert"
+            "crit"
+            "error"
+            "warn"
+            "notice"
+            "info"
+            "debug"
+            "trace1"
+            "trace2"
+            "trace3"
+            "trace4"
+            "trace5"
+            "trace6"
+            "trace7"
+            "trace8"
+          ]);
+        default = "notice";
+        example = "crit";
+        description = ''
+          Controls the verbosity of the ErrorLog.
+          See <https://httpd.apache.org/docs/2.4/mod/core.html#loglevel> for more details.
        '';
      };

@@ -832,7 +832,7 @@ in
    # FIXME: somehow check for unknown driver names.
    services.xserver.drivers = flip concatMap cfg.videoDrivers (
      name:
-      lib.optional (videoDrivers ? name) (
+      lib.optional (videoDrivers ? ${name}) (
        {
          inherit name;
          modules = [ ];
@@ -1478,7 +1478,7 @@ in
  sslh = handleTest ./sslh.nix { };
  sssd-ldap = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./sssd-ldap.nix { };
  sssd-legacy-config = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./sssd-legacy-config.nix { };
-  stalwart-mail = runTest ./stalwart/stalwart-mail.nix;
+  stalwart = runTest ./stalwart/stalwart.nix;
  stargazer = runTest ./web-servers/stargazer.nix;
  starship = runTest ./starship.nix;
  startx = import ./startx.nix { inherit pkgs runTest; };
@@ -15,15 +15,17 @@
                "printer.lan" = "192.168.178.3,2001:0db8:85a3:08d3:1319:8a2e:0370:7344";
              };
            };
-            upstream = {
+            upstreams.groups = {
              default = [
                "8.8.8.8"
                "1.1.1.1"
              ];
            };
-            port = 53;
-            httpPort = 5000;
-            logLevel = "info";
+            ports = {
+              dns = 53;
+              http = 5000;
+            };
+            log.level = "info";
          };
        };
      };
@@ -30,12 +30,6 @@ let
    r13y  reproducibility
  '';

-  dwWithAcronyms = pkgs.dokuwiki.overrideAttrs (prev: {
-    installPhase = prev.installPhase or "" + ''
-      ln -sf ${acronymsFile} $out/share/dokuwiki/conf/acronyms.local.conf
-    '';
-  });
-
  mkNode =
    webserver:
    { ... }:
@@ -53,9 +47,11 @@ let
            };
          };
          "site2.local" = {
-            package = dwWithAcronyms;
            usersFile = "/var/lib/dokuwiki/site2.local/users.auth.php";
            plugins = [ plugin-icalevents ];
+            extraConfigs = {
+              "acronyms.local.conf" = acronymsFile;
+            };
            settings = {
              useacl = true;
              superuser = "admin";
@@ -11,6 +11,13 @@
      imports = [
        ./common/x11.nix
      ];
+
+      boot.kernelModules = [ "snd-dummy" ];
+      services.pulseaudio = {
+        enable = true;
+        systemWide = true;
+      };
+      services.pipewire.enable = false;
      environment.systemPackages = [ pkgs.ft2-clone ];
    };

@@ -18,8 +25,6 @@

  testScript = ''
    machine.wait_for_x()
-    # Add a dummy sound card, or the program won't start
-    machine.execute("modprobe snd-dummy")

    machine.execute("ft2-clone >&2 &")

@@ -7,30 +7,42 @@
  };

  nodes = {
-    server = rec {
-      services.ifm = {
-        enable = true;
-        port = 9001;
-        dataDir = "/data";
-      };
+    server =
+      { config, ... }:
+      {
+        services.ifm = {
+          enable = true;
+          port = 9001;
+          dataDir = "/data";
+        };

-      system.activationScripts.ifm-setup-dir = ''
-        mkdir -p ${services.ifm.dataDir}
-        chmod u+w,g+w,o+w ${services.ifm.dataDir}
-      '';
-    };
+        systemd.tmpfiles.settings = {
+          ifm-data-dir = {
+            ${config.services.ifm.dataDir}.d = {
+              mode = "0777";
+              user = "root";
+              group = "root";
+            };
+          };
+        };
+      };
  };

-  testScript = ''
-    start_all()
-    server.wait_for_unit("ifm.service")
-    server.wait_for_open_port(9001)
-    server.succeed("curl --fail http://localhost:9001")
+  testScript =
+    # python
+    ''
+      start_all()
+      server.wait_for_unit("ifm.service")
+      server.wait_for_open_port(9001)
+      server.succeed("curl --fail http://localhost:9001")

-    server.succeed("echo \"testfile\" > testfile && shasum testfile >> checksums")
-    server.succeed("curl --fail http://localhost:9001 -X POST -F \"api=upload\" -F \"dir=\" -F \"file=@testfile\" | grep \"OK\"");
-    server.succeed("rm testfile")
-    server.succeed("curl --fail http://localhost:9001 -X POST -F \"api=download\" -F \"filename=testfile\" -F \"dir=\" --output testfile");
-    server.succeed("shasum testfile >> checksums && shasum --check checksums")
-  '';
+      server.succeed('echo "testfile" > testfile')
+      server.succeed("shasum testfile | tee checksums")
+
+      server.succeed('curl --fail http://localhost:9001 -X POST -F "api=upload" -F "dir=" -F "file=@testfile" | grep "OK"');
+      server.succeed("rm testfile")
+
+      server.succeed('curl --fail http://localhost:9001 -X POST -F "api=download" -F "filename=testfile" -F "dir=" --output testfile');
+      server.succeed("shasum --check checksums")
+    '';
 }
@@ -12,7 +12,12 @@
        ./common/x11.nix
      ];

-      services.xserver.enable = true;
+      boot.kernelModules = [ "snd-dummy" ];
+      services.pulseaudio = {
+        enable = true;
+        systemWide = true;
+      };
+      services.pipewire.enable = false;
      environment.systemPackages = [ pkgs.pt2-clone ];
    };

@@ -20,16 +25,13 @@

  testScript = ''
    machine.wait_for_x()
-    # Add a dummy sound card, or the program won't start
-    machine.execute("modprobe snd-dummy")

    machine.execute("pt2-clone >&2 &")

    machine.wait_for_window(r"ProTracker")
    machine.sleep(5)
    # One of the few words that actually get recognized
-    if "LENGTH" not in machine.get_screen_text():
-        raise Exception("Program did not start successfully")
+    machine.wait_for_text("LENGTH")
    machine.screenshot("screen")
  '';
 }
@@ -5,7 +5,7 @@
    maintainers = [ fgaz ];
  };

-  machine =
+  nodes.machine =
    { config, pkgs, ... }:
    {
      imports = [
@@ -13,6 +13,12 @@
      ];

      services.xserver.enable = true;
+      boot.kernelModules = [ "snd-dummy" ];
+      services.pulseaudio = {
+        enable = true;
+        systemWide = true;
+      };
+      services.pipewire.enable = false;
      environment.systemPackages = [ pkgs.sfxr-qt ];
    };

@@ -7,7 +7,7 @@ in
 {
  security.pki.certificateFiles = [ certs.ca.cert ];

-  services.stalwart-mail = {
+  services.stalwart = {
    enable = true;
    settings = {
      server.hostname = domain;
@@ -54,7 +54,7 @@ in

      store."rocksdb" = {
        type = "rocksdb";
-        path = "/var/lib/stalwart-mail/data";
+        path = "/var/lib/stalwart/data";
        compression = "lz4";
      };

@@ -1,4 +1,4 @@
-# Rudimentary test checking that the Stalwart email server can:
+# Rudimentary test checking that the Stalwart server can:
 # - receive some message through SMTP submission, then
 # - serve this message through IMAP.

@@ -8,13 +8,13 @@ let
 in
 { lib, ... }:
 {
-  name = "stalwart-mail";
+  name = "stalwart";

  nodes.main =
    { pkgs, ... }:
    {
      imports = [
-        ./stalwart-mail-config.nix
+        ./stalwart-config.nix
      ];

      environment.systemPackages = [
@@ -57,7 +57,7 @@ in

  testScript = # python
    ''
-      main.wait_for_unit("stalwart-mail.service")
+      main.wait_for_unit("stalwart.service")
      main.wait_for_open_port(587)
      main.wait_for_open_port(143)
      main.wait_for_open_port(80)
@@ -65,14 +65,14 @@ in
      main.succeed("test-smtp-submission")

      # restart stalwart to test rocksdb compaction of existing database
-      main.succeed("systemctl restart stalwart-mail.service")
+      main.succeed("systemctl restart stalwart.service")
      main.wait_for_open_port(587)
      main.wait_for_open_port(143)
      main.wait_for_open_port(80)

      main.succeed("test-imap-read")

-      main.succeed("test -d /var/cache/stalwart-mail/STALWART_WEBADMIN")
+      main.succeed("test -d /var/cache/stalwart-mail/STALWART_WEBADMIN || test -d /var/cache/stalwart/STALWART_WEBADMIN")
      main.succeed("curl --fail http://localhost")
    '';

@@ -6,7 +6,8 @@
 }:

 symlinkJoin {
-  name = "deadbeef-with-plugins-${deadbeef.version}";
+  pname = "deadbeef-with-plugins";
+  inherit (deadbeef) version;

  paths = [ deadbeef ] ++ plugins;

@@ -16,14 +16,14 @@

 buildPythonApplication rec {
  pname = "rednotebook";
-  version = "2.41";
+  version = "2.42";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "jendrikseipp";
    repo = "rednotebook";
    tag = "v${version}";
-    sha256 = "sha256-sWfazIeROc3Pf4pUaUdcF00A5AV7bxzwI3R6eoSQkto=";
+    sha256 = "sha256-4e3LvBVrhqzNja9kOZ5xJVYvwjGkKNvIuXou4YfD6w4=";
  };

  # We have not packaged tests.
@@ -10,13 +10,13 @@
 }:
 vimUtils.buildVimPlugin rec {
  pname = "codediff.nvim";
-  version = "2.13.1";
+  version = "2.16.3";

  src = fetchFromGitHub {
    owner = "esmuellert";
    repo = "codediff.nvim";
    tag = "v${version}";
-    hash = "sha256-9pzEO5RzDTX0BVg06XA0AiD9gCmpp1eEqH3Adqptrrs=";
+    hash = "sha256-nIDjE5hf5kt3diEFgUEBz4dCxHatCYtdHY5Zc4YlHFg=";
  };

  dependencies = [ vimPlugins.nui-nvim ];
@@ -320,8 +320,8 @@ let
        mktplcRef = {
          name = "vscode-apollo";
          publisher = "apollographql";
-          version = "2.6.4";
-          hash = "sha256-rqNdblzQ9N6kFcwYqdNAA8ziDMFCuduhXZt3lmd/q7Y=";
+          version = "2.6.5";
+          hash = "sha256-WOt0bY/hi9tLJEo0bTAPLQhgM+2A7JPp0pypX4EcYNo=";
        };
        meta = {
          changelog = "https://marketplace.visualstudio.com/items/apollographql.vscode-apollo/changelog";
@@ -1186,8 +1186,8 @@ let
        mktplcRef = {
          name = "dart-code";
          publisher = "dart-code";
-          version = "3.120.0";
-          hash = "sha256-YXQhdn9bOpVGeG0mKPazMvsZecx4sd1ZpSdHfH3eNOY=";
+          version = "3.126.0";
+          hash = "sha256-qkdLF6SIZjNJBQMhG/IDEaMpSVWWnd7DJmDgIT1gjVY=";
        };

        meta.license = lib.licenses.mit;
@@ -1208,8 +1208,8 @@ let
        mktplcRef = {
          name = "databricks";
          publisher = "databricks";
-          version = "2.10.4";
-          hash = "sha256-/nH7y9w3sKKJXJfIyuXHbAVl0BWRafuhF/WIvBnrIXM=";
+          version = "2.10.5";
+          hash = "sha256-BOJP4yJXaVwojFlk12/eitqCdzeqghAzSdxJQZSr6yg=";
        };
        meta = {
          changelog = "https://marketplace.visualstudio.com/items/databricks.databricks/changelog";
@@ -1997,8 +1997,8 @@ let
        mktplcRef = {
          name = "Go";
          publisher = "golang";
-          version = "0.52.1";
-          hash = "sha256-y3IaNkdyWnZCwQ9Zgryn6D2cUT+eyJ4/yXgGSTRGpWw=";
+          version = "0.52.2";
+          hash = "sha256-8g+r4Mv06Bx1W3yAXWVbtz1B/gXPcRdmaV0tPkTP6Gk=";
        };
        meta = {
          changelog = "https://marketplace.visualstudio.com/items/golang.Go/changelog";
@@ -4336,8 +4336,8 @@ let
        mktplcRef = {
          publisher = "sonarsource";
          name = "sonarlint-vscode";
-          version = "4.32.0";
-          hash = "sha256-faFX58fYzJ94tkKxHkTHpyt9zBc2nxmPd6xOgO59qPc=";
+          version = "4.40.0";
+          hash = "sha256-Jzb+ywEGINN4eRVRMUnBloXWT2wubrU91NEBoySx0NQ=";
        };
        meta.license = lib.licenses.lgpl3Only;
      };
@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
  mktplcRef = {
    publisher = "sourcegraph";
    name = "amp";
-    version = "0.0.1769378769";
-    hash = "sha256-IZINJWzQ9/3YWprSYaH4IAksZtNFiTPC9+YDAOde3LU=";
+    version = "0.0.1769991964";
+    hash = "sha256-RlACEEbRZjeM1JUgAxfMlwFIo8CmrJxr1DVq1XxRdoM=";
  };

  meta = {
@@ -8,13 +8,13 @@
 }:
 mkLibretroCore {
  core = "mednafen-psx" + lib.optionalString withHw "-hw";
-  version = "0-unstable-2026-01-23";
+  version = "0-unstable-2026-01-30";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "beetle-psx-libretro";
-    rev = "3a1184d1e1c7ed15752e9fe4a0594e68b4a41e11";
-    hash = "sha256-AfqhZJT+AF814udA7K1Kja1fLSh07cHpRl+Mu8wphv0=";
+    rev = "d5e2d68065e644a5e807c14419411039c78731df";
+    hash = "sha256-MDTpYTOD1Zf1Smv+JQZARaeldYiTv2vA/buFC709ZpE=";
  };

  extraBuildInputs = lib.optionals withHw [
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "gpsp";
-  version = "0-unstable-2025-11-23";
+  version = "0-unstable-2026-01-27";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "gpsp";
-    rev = "6250979f01db3f9ee5ebca179316e1319f017b48";
-    hash = "sha256-PSQiRh/8enFGCYs2AE5SwvZZzJfjMDarw3XW/x0A9qQ=";
+    rev = "602512d7c687acb84cd56265cbcf2d7b7c75fb37";
+    hash = "sha256-YloLG2anJJ1hcVltN+d8XsshgZoDBrFRgRoQA7mfhN8=";
  };

  makefile = "Makefile";
@@ -13,13 +13,13 @@
 }:
 mkLibretroCore {
  core = "ppsspp";
-  version = "0-unstable-2026-01-24";
+  version = "0-unstable-2026-01-31";

  src = fetchFromGitHub {
    owner = "hrydgard";
    repo = "ppsspp";
-    rev = "bab01f1b162ed76dde584b9a1f9f327fecbf5cb5";
-    hash = "sha256-SXI6EmvpQ80nkzxswBrvCZTVi8qW6R5097D4aZTSie4=";
+    rev = "abed0cb0f79e5cec6204869dab989d575d809744";
+    hash = "sha256-K2v0WJIbK7qBGhRu+kgnvkmjtAbiazl4kVW0xk8Fb5I=";
    fetchSubmodules = true;
  };

@@ -19,14 +19,14 @@

 stdenv.mkDerivation rec {
  pname = "qcad";
-  version = "3.32.3.4";
+  version = "3.32.5.0";

  src = fetchFromGitHub {
    name = "qcad-${version}-src";
    owner = "qcad";
    repo = "qcad";
    rev = "v${version}";
-    hash = "sha256-6incOmg4AilVfoPu+crbvm/SFek3yptxrfHn7RGFF4o=";
+    hash = "sha256-sg9Vrekh57JAQb1o8AWDkDuOs3ovELJ2WTTXPa+e3JU=";
  };

  patches = [
@@ -1,96 +0,0 @@
-{
-  stdenv,
-  lib,
-  fetchFromGitHub,
-  fetchpatch,
-  cmake,
-  wrapQtAppsHook,
-  procps,
-  qtbase,
-  qtwebengine,
-  qtwebkit,
-  syncthing,
-  preferQWebView ? false,
-  preferNative ? true,
-}:
-
-stdenv.mkDerivation rec {
-  version = "0.5.8";
-  pname = "qsyncthingtray";
-
-  src = fetchFromGitHub {
-    owner = "sieren";
-    repo = "QSyncthingTray";
-    rev = version;
-    sha256 = "1n9g4j7qznvg9zl6x163pi9f7wsc3x6q76i33psnm7x2v1i22x5w";
-  };
-
-  nativeBuildInputs = [
-    cmake
-    wrapQtAppsHook
-  ];
-
-  buildInputs = [
-    qtbase
-    qtwebengine
-  ]
-  ++ lib.optional preferQWebView qtwebkit;
-
-  cmakeFlags =
-    [ ]
-    ++ lib.optional preferQWebView "-DQST_BUILD_WEBKIT=1"
-    ++ lib.optional preferNative "-DQST_BUILD_NATIVEBROWSER=1";
-
-  patches = [
-    (fetchpatch {
-      name = "support_native_browser.patch";
-      url = "https://patch-diff.githubusercontent.com/raw/sieren/QSyncthingTray/pull/225.patch";
-      sha256 = "0w665xdlsbjxs977pdpzaclxpswf7xys1q3rxriz181lhk2y66yy";
-    })
-  ]
-  ++ lib.optional (!preferQWebView && !preferNative) ./qsyncthingtray-0.5.8-qt-5.6.3.patch;
-
-  postPatch = ''
-    ${lib.optionalString stdenv.hostPlatform.isLinux ''
-      substituteInPlace includes/platforms/linux/posixUtils.hpp \
-        --replace '"/usr/local/bin/syncthing"'         '"${syncthing}/bin/syncthing"' \
-        --replace '"pgrep -x'                          '"${procps}/bin/pgrep -x'
-    ''}
-
-    ${lib.optionalString stdenv.hostPlatform.isDarwin ''
-      substituteInPlace includes/platforms/darwin/macUtils.hpp \
-        --replace '"/usr/local/bin/syncthing"'         '"${syncthing}/bin/syncthing"'
-    ''}
-  '';
-
-  installPhase =
-    let
-      qst = "qsyncthingtray";
-    in
-    ''
-      runHook preInstall
-
-      mkdir -p $out/bin
-      install -m755 QSyncthingTray $out/bin/${qst}
-      ln -s $out/bin/${qst} $out/bin/QSyncthingTray
-
-      runHook postInstall
-    '';
-
-  meta = {
-    homepage = "https://github.com/sieren/QSyncthingTray/";
-    description = "Traybar Application for Syncthing written in C++";
-    longDescription = ''
-      A cross-platform status bar for Syncthing.
-      Currently supports macOS, Windows and Linux.
-      Written in C++ with Qt.
-    '';
-    license = lib.licenses.lgpl3;
-    maintainers = with lib.maintainers; [
-      zraexy
-      peterhoeg
-    ];
-    platforms = lib.platforms.all;
-    broken = !preferNative || stdenv.hostPlatform.isDarwin;
-  };
-}
@@ -1,13 +0,0 @@
-diff --git a/CMakeLists.txt b/CMakeLists.txt
-index b778d09..247b606 100644
--- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -12,7 +12,7 @@ set(CMAKE_AUTOMOC ON)
- 
- set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -std=c++11")
- 
-find_package(Qt5 5.6 COMPONENTS Widgets Network PrintSupport)
-+find_package(Qt5 5.6 COMPONENTS Widgets Network PrintSupport WebEngineWidgets)
- if (NOT Qt5_FOUND)
-   message(FATAL_ERROR
-     "Some components of Qt5 not found (see above messages for details. "
@@ -497,14 +497,9 @@ let
      # Started failing to apply with M142, but this is no longer needed anyway.
      ./patches/chromium-126-llvm-17.patch
    ]
-    ++ lib.optionals (!chromiumVersionAtLeast "140") [
+    ++ lib.optionals (versionRange "140" "141") [
      # Partial revert of https://github.com/chromium/chromium/commit/3687976b0c6d36cf4157419a24a39f6770098d61
      # allowing us to use our rustc and our clang.
-      ./patches/chromium-129-rust.patch
-    ]
-    ++ lib.optionals (versionRange "140" "141") [
-      # Rebased variant of the patch above due to
-      # https://chromium-review.googlesource.com/c/chromium/src/+/6665907
      ./patches/chromium-140-rust.patch
    ]
    ++ lib.optionals (chromiumVersionAtLeast "141") [
@@ -535,7 +530,7 @@ let
      # exact version or even running a newer version.
      ./patches/chromium-136-nodejs-assert-minimal-version-instead-of-exact-match.patch
    ]
-    ++ lib.optionals (chromiumVersionAtLeast "138") [
+    ++ [
      (fetchpatch {
        # Unbreak building with Rust 1.89+ which introduced
        # a new mismatched_lifetime_syntaxes lint.
@@ -548,33 +543,6 @@ let
        hash = "sha256-xf1Jq5v3InXkiVH0uT7+h1HPwZse5MDcHKuJNjSLR6k=";
      })
    ]
-    ++ lib.optionals (!chromiumVersionAtLeast "138") [
-      # Rebased variant of the patch above for
-      # electron 35 (M134) and 36 (M136)
-      ./patches/chromium-134-rust-1.86-mismatched_lifetime_syntaxes.patch
-    ]
-    ++ lib.optionals (versionRange "141" "142") [
-      (fetchpatch {
-        # Fix "invalid application of 'sizeof' to an incomplete type 'blink::CSSStyleSheet'"
-        # by reverting https://chromium-review.googlesource.com/c/chromium/src/+/6892157
-        name = "chromium-141-Revert-Remove-unnecessary-include-in-tree_scope.h.patch";
-        url = "https://chromium.googlesource.com/chromium/src/+/0fc0e71aa1ca0419fae6d14255025543980d2cba^!?format=TEXT";
-        decode = "base64 -d";
-        revert = true;
-        hash = "sha256-pnEus2NHpNWZ6ZSXLgdTn+it7oy1MPZPbD8SOAKLWbw=";
-      })
-    ]
-    ++ lib.optionals (chromiumVersionAtLeast "142" && lib.versionOlder rustcVersion "1.90") [
-      (fetchpatch {
-        # Fix "ld.lld: error: undefined symbol: __rustc::__rust_alloc_error_handler_should_panic'"
-        # with Rust < 1.90 by reverting https://chromium-review.googlesource.com/c/chromium/src/+/6935385
-        name = "chromium-142-Revert-rust-Remove-the-old-__rust_alloc_error_handler_should_panic-symbol.patch";
-        url = "https://chromium.googlesource.com/chromium/src/+/e33287758f2234d6aabfc5d4e011c4e81e3a47cf^!?format=TEXT";
-        decode = "base64 -d";
-        revert = true;
-        hash = "sha256-0vRDz7wwGCsqm38fVvkLLzOOtEtd8CnqyjDLgGofh/o=";
-      })
-    ]
    ++ lib.optionals (versionRange "142" "143") [
      (fetchpatch {
        # Fix https://issues.chromium.org/issues/450752866 by backporting
@@ -585,28 +553,6 @@ let
        hash = "sha256-0ueOCHYheSFHRFzEat3TDhnU3Avf0TcNBBBpTkz+saw=";
      })
    ]
-    ++ lib.optionals (chromiumVersionAtLeast "142" && lib.versionOlder rustcVersion "1.91") [
-      # Fix the following error when compiling CrabbyAvif with Rust < 1.91 due to
-      # https://github.com/rust-lang/rust/pull/142681 by reverting
-      # https://github.com/webmproject/CrabbyAvif/pull/663 and
-      # https://github.com/webmproject/CrabbyAvif/pull/654 and
-      # https://chromium-review.googlesource.com/c/chromium/src/+/6960510
-      #
-      #  error: cannot find attribute `sanitize` in this scope
-      #    --> ../../third_party/crabbyavif/src/src/capi/io.rs:210:41
-      #      |
-      #  210 |     #[cfg_attr(feature = "disable_cfi", sanitize(cfi = "off"))]
-      #      |                                         ^^^^^^^^
-      #
-      ./patches/chromium-142-crabbyavif-rust-no_sanitize.patch
-      (fetchpatch {
-        name = "chromium-142-crabbyavif-Revert-Enable-disable_cfi-feature.patch";
-        url = "https://chromium.googlesource.com/chromium/src/+/9415f40bc6f853547f791e633be638c71368ce56^!?format=TEXT";
-        decode = "base64 -d";
-        revert = true;
-        hash = "sha256-bYcJqPMbE7hMvhZVnzqHok1crUAdqrzqxr+4IHNzAtg=";
-      })
-    ]
    ++ lib.optionals (chromiumVersionAtLeast "144") [
      # Patch rustc_nightly_capability to eval to false instead of true.
      # https://chromium-review.googlesource.com/c/chromium/src/+/7022369
@@ -640,9 +586,7 @@ let
        /* Generated by lastchange.py, do not edit.*/
        #ifndef SKIA_EXT_SKIA_COMMIT_HASH_H_
        #define SKIA_EXT_SKIA_COMMIT_HASH_H_
-        #define SKIA_COMMIT_HASH "${upstream-info.DEPS."src/third_party/skia".rev}${
-          lib.optionalString (!chromiumVersionAtLeast "142") "-"
-        }"
+        #define SKIA_COMMIT_HASH "${upstream-info.DEPS."src/third_party/skia".rev}"
        #endif  // SKIA_EXT_SKIA_COMMIT_HASH_H_
        EOF

@@ -650,7 +594,7 @@ let

        mkdir -p third_party/jdk/current/bin
      ''
-      + lib.optionalString (!isElectron && chromiumVersionAtLeast "142") ''
+      + lib.optionalString (!isElectron) ''
        cat << EOF > gpu/webgpu/dawn_commit_hash.h
        /* Generated by lastchange.py, do not edit.*/
        #ifndef GPU_WEBGPU_DAWN_COMMIT_HASH_H_
@@ -815,11 +759,6 @@ let
        use_gio = true;
        use_cups = cupsSupport;
      }
-      // lib.optionalAttrs (!chromiumVersionAtLeast "139") {
-        # Feature overrides:
-        # Native Client support was deprecated in 2020 and support will end in June 2021:
-        enable_nacl = false;
-      }
      // lib.optionalAttrs (packageName == "chromium") {
        # Enabling the Widevine here doesn't affect whether we can redistribute the chromium package.
        # Widevine in this drv is a bit more complex than just that. See Widevine patch somewhere above.
@@ -1,21 +0,0 @@
-diff --git a/build/config/compiler/BUILD.gn b/build/config/compiler/BUILD.gn
-index 45086d6838cac..81132ad8ecb31 100644
--- a/build/config/compiler/BUILD.gn
-+++ b/build/config/compiler/BUILD.gn
-@@ -1727,16 +1727,6 @@ config("runtime_library") {
-     configs += [ "//build/config/c++:runtime_library" ]
-   }
- 
-  # Rust and C++ both provide intrinsics for LLVM to call for math operations. We
-  # want to use the C++ intrinsics, not the ones in the Rust compiler_builtins
-  # library. The Rust symbols are marked as weak, so that they can be replaced by
-  # the C++ symbols. This config ensures the C++ symbols exist and are strong in
-  # order to cause that replacement to occur by explicitly linking in clang's
-  # compiler-rt library.
-  if (is_clang && !is_nacl && !is_cronet_build) {
-    configs += [ "//build/config/clang:compiler_builtins" ]
-  }
-
-   # TODO(crbug.com/40570904): Come up with a better name for is POSIX + Fuchsia
-   # configuration.
-   if (is_posix || is_fuchsia) {
@@ -1,48 +0,0 @@
-diff --git a/third_party/crabbyavif/src/src/capi/io.rs b/third_party/crabbyavif/src/src/capi/io.rs
-index e7994ce3129c4d7f46553f527bf8f10376ff9ed8..60a3c13b788a560e9669db013e3b8e88e5f9947b 100644
--- a/third_party/crabbyavif/src/src/capi/io.rs
-+++ b/third_party/crabbyavif/src/src/capi/io.rs
-@@ -207,7 +207,7 @@ impl Drop for avifIOWrapper {
- }
- 
- impl crate::decoder::IO for avifIOWrapper {
-    #[cfg_attr(feature = "disable_cfi", sanitize(cfi = "off"))]
-+    #[cfg_attr(feature = "disable_cfi", no_sanitize(cfi))]
-     fn read(&mut self, offset: u64, size: usize) -> AvifResult<&[u8]> {
-         // SAFETY: Calling into a C function.
-         let res = unsafe {
-diff --git a/third_party/crabbyavif/src/src/lib.rs b/third_party/crabbyavif/src/src/lib.rs
-index 90fa41188905a8aaf7b74594937b3a335ceed18d..a05f0a5e8b6cbffbf6e1a0f5fefc8a1e1480273f 100644
--- a/third_party/crabbyavif/src/src/lib.rs
-+++ b/third_party/crabbyavif/src/src/lib.rs
-@@ -13,7 +13,7 @@
- // limitations under the License.
- 
- #![deny(unsafe_op_in_unsafe_fn)]
-#![cfg_attr(feature = "disable_cfi", feature(sanitize))]
-+#![cfg_attr(feature = "disable_cfi", feature(no_sanitize))]
- 
- #[macro_use]
- mod internal_utils;
-diff --git a/third_party/crabbyavif/src/src/reformat/libyuv.rs b/third_party/crabbyavif/src/src/reformat/libyuv.rs
-index 9df874ccf7b6a943c6dcebe495ce15b7a7e9cd66..3f68c16f2b2e8e22b3edfd0dcedbb95fe34887f9 100644
--- a/third_party/crabbyavif/src/src/reformat/libyuv.rs
-+++ b/third_party/crabbyavif/src/src/reformat/libyuv.rs
-@@ -372,7 +372,7 @@ fn find_conversion_function(
- // Returns Ok(Some(false)) if only YUV was converted and alpha
- // needs to be imported separately.
- // Returns Ok(None) if the conversion is not implemented.
-#[cfg_attr(feature = "disable_cfi", sanitize(cfi = "off"))]
-+#[cfg_attr(feature = "disable_cfi", no_sanitize(cfi))]
- pub(crate) fn yuv_to_rgb(image: &image::Image, rgb: &mut rgb::Image) -> AvifResult<Option<bool>> {
-     if (rgb.depth != 8 && rgb.depth != 10) || !image.depth_valid() {
-         return Ok(None); // Not implemented.
-@@ -833,7 +833,7 @@ fn rgb_to_yuv_conversion_function(
-     }
- }
- 
-#[cfg_attr(feature = "disable_cfi", sanitize(cfi = "off"))]
-+#[cfg_attr(feature = "disable_cfi", no_sanitize(cfi))]
- pub(crate) fn rgb_to_yuv(rgb: &rgb::Image, image: &mut image::Image) -> AvifResult<Option<()>> {
-     let conversion_function = match rgb_to_yuv_conversion_function(rgb, image) {
-         Some(conversion_function) => conversion_function,
@@ -1,42 +0,0 @@
-{
-  lib,
-  buildGoModule,
-  minikube,
-}:
-
-buildGoModule rec {
-  inherit (minikube)
-    version
-    src
-    nativeBuildInputs
-    buildInputs
-    vendorHash
-    doCheck
-    ;
-
-  pname = "docker-machine-kvm2";
-
-  postPatch = minikube.postPatch + ''
-    sed -i '/GOARCH=$*/d' Makefile
-  '';
-
-  buildPhase = ''
-    make docker-machine-driver-kvm2 COMMIT=${src.rev}
-  '';
-
-  installPhase = ''
-    install out/docker-machine-driver-kvm2 -Dt $out/bin
-  '';
-
-  meta = {
-    homepage = "https://minikube.sigs.k8s.io/docs/drivers/kvm2";
-    description = "KVM2 driver for docker-machine";
-    mainProgram = "docker-machine-driver-kvm2";
-    license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [
-      tadfisher
-      atkinschang
-    ];
-    platforms = lib.platforms.linux;
-  };
-}
@@ -346,11 +346,11 @@
    "vendorHash": null
  },
  "dopplerhq_doppler": {
-    "hash": "sha256-8HE9Y4enoUpl5qarmuBHE0pAbK1UF0fPkmBhHj4T1As=",
+    "hash": "sha256-ZqlakWqu9gOMxVLAFUzmho3hl+wbwPA5AXX8Z7XRsCc=",
    "homepage": "https://registry.terraform.io/providers/DopplerHQ/doppler",
    "owner": "DopplerHQ",
    "repo": "terraform-provider-doppler",
-    "rev": "v1.21.0",
+    "rev": "v1.21.1",
    "spdx": "Apache-2.0",
    "vendorHash": "sha256-B8mYLd4VdADWoQLWiCM85VQrBfDdlYQ0wkCp9eUBQ4U="
  },
@@ -553,13 +553,13 @@
    "vendorHash": "sha256-HQXioE9mbc+0Qf6MGiXKXSfmbUUtkUafA01GEXbLQfE="
  },
  "hashicorp_dns": {
-    "hash": "sha256-+M4i5tvGrjGRBwB9bFp6YYhbz3qGRcg9W6PhD59Rfbk=",
+    "hash": "sha256-ErvlkaFiIHEXUZYDJZmqEgGpZ75mnLRhhsULRvTm7Rc=",
    "homepage": "https://registry.terraform.io/providers/hashicorp/dns",
    "owner": "hashicorp",
    "repo": "terraform-provider-dns",
-    "rev": "v3.4.3",
+    "rev": "v3.5.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-xu5t7VaLvbwo/Q7Xb4mkNt7UjU+hzfk7NgfFlxwbIhU="
+    "vendorHash": "sha256-P4018IUQ4MfdPHP20rHvuzeFSxLHBcoJuLHS/TNAHLk="
  },
  "hashicorp_external": {
    "hash": "sha256-rHMmGzYvsE5GT0E71UUIXjDG9+v52LI69/gdP2xuI7w=",
@@ -571,13 +571,13 @@
    "vendorHash": "sha256-xIagZvWtlNpz5SQfxbA7r9ojAeS3CW2pwV337ObKOwU="
  },
  "hashicorp_google": {
-    "hash": "sha256-xqj0bA+tKpxJ0Wq0bGzBmpoCyALdgBrPUaw7A5zAxxA=",
+    "hash": "sha256-VJ9RGR7wmX8CkNvntxlbhGuIyrCALMVH+E7zRRbD1bY=",
    "homepage": "https://registry.terraform.io/providers/hashicorp/google",
    "owner": "hashicorp",
    "repo": "terraform-provider-google",
-    "rev": "v7.16.0",
+    "rev": "v7.17.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-6re5ARUiWmpkND7hfjSDm2aOX5vlESp7UrcPJDNIJ+s="
+    "vendorHash": "sha256-u85rqTYpYFeTLGElOVojpsqUMZsopjpmsKwijsyLlz8="
  },
  "hashicorp_google-beta": {
    "hash": "sha256-orMcxMY6btX5qejY+X21JSuoLp9M0JjUiDjrQ2LQjDA=",
@@ -1049,11 +1049,11 @@
    "vendorHash": null
  },
  "oracle_oci": {
-    "hash": "sha256-zcYB7DEwffVzPm4OXots9Z7Gzu6k/Pcaa4ell0gT33Q=",
+    "hash": "sha256-gzjvdAuT3HDMRULa+b2u75zqei4x1ylj3NGyHh4qa+U=",
    "homepage": "https://registry.terraform.io/providers/oracle/oci",
    "owner": "oracle",
    "repo": "terraform-provider-oci",
-    "rev": "v7.31.0",
+    "rev": "v7.32.0",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
@@ -1391,11 +1391,11 @@
    "vendorHash": "sha256-ozAYLFkilSK0Nygdglhz3VNtRVKoLDGRnrVvg4nWyH4="
  },
  "turbot_turbot": {
-    "hash": "sha256-hUiILS5OVpa5MurChW2U9DQElQxzXo8yQfHRjWcd8cc=",
+    "hash": "sha256-zh809E1qII8EJm7QFHEORju2WF//+A2uk7olrCNdBkU=",
    "homepage": "https://registry.terraform.io/providers/turbot/turbot",
    "owner": "turbot",
    "repo": "terraform-provider-turbot",
-    "rev": "v1.13.0",
+    "rev": "v1.13.1",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
@@ -1481,11 +1481,11 @@
    "vendorHash": "sha256-rUYHapEVqRupLOPVbcAH8YP0cuXclMmYTQUkqeOwCN0="
  },
  "vultr_vultr": {
-    "hash": "sha256-ezTWMaM06z1LLBgNqRYlT/SIyw3Vv3x8NFXkY4j5D3Q=",
+    "hash": "sha256-u6f4DQ5P2lOaxmGeHSloxRtBF+pF7nHWOSlSEIKxG9c=",
    "homepage": "https://registry.terraform.io/providers/vultr/vultr",
    "owner": "vultr",
    "repo": "terraform-provider-vultr",
-    "rev": "v2.28.0",
+    "rev": "v2.28.1",
    "spdx": "MPL-2.0",
    "vendorHash": "sha256-8vYTNSjEwalDsS77UUVw7u2K3bbK4HM3yiUR3Ppi79I="
  },
@@ -29,6 +29,11 @@ let
        # The file to be patched is different from firefox's `no-buildconfig-ffx90.patch`.
        (if lib.versionOlder version "140" then ./no-buildconfig.patch else ./no-buildconfig-tb140.patch)
      ];
+      # FIXME: let's hope that upstream will fix this soon and we can drop this hack again.
+      # https://bugzilla.mozilla.org/show_bug.cgi?id=2006630
+      extraPostPatch = lib.optionalString (lib.versionAtLeast version "147") ''
+        find . -name .cargo-checksum.json | xargs sed 's/"[^"]*\.gitmodules":"[a-z0-9]*",//g' -i
+      '';

      meta = {
        changelog = "https://www.thunderbird.net/en-US/thunderbird/${version}/releasenotes/";
@@ -60,8 +65,8 @@ rec {
  thunderbird = thunderbird-latest;

  thunderbird-latest = common {
-    version = "146.0.1";
-    sha512 = "8a3b2de246c7c597574fce596836c7ef7b24bd21573feb15c308003f34b82335ad865aa0f81b24d1669c8023c0448c0e273a63019aab13356b023c2e8adc2c47";
+    version = "147.0.1";
+    sha512 = "bae9adbcb1d45a7644e4d699215a3da85b612b9d99516bdf12f84482f1a6f89153ec4d5ab6dd8bcf69dc512cb50080db4630a5bb52525f22213c7af92b4b77d7";

    updateScript = callPackage ./update.nix {
      attrPath = "thunderbirdPackages.thunderbird-latest";
@@ -99,13 +99,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "obs-studio";
-  version = "32.0.1";
+  version = "32.0.4";

  src = fetchFromGitHub {
    owner = "obsproject";
    repo = "obs-studio";
    rev = finalAttrs.version;
-    hash = "sha256-99VAVV3hEMDI2R30OrX/in/9KtesUxMGOPg6yT5e4oM=";
+    hash = "sha256-OiLlYnHaW+ehHtz4N20ctkfL4WmCzI45+VUG5hHOga4=";
    fetchSubmodules = true;
  };

@@ -8,13 +8,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "obs-source-clone";
-  version = "0.2.0";
+  version = "0.2.1";

  src = fetchFromGitHub {
    owner = "exeldro";
    repo = "obs-source-clone";
    tag = finalAttrs.version;
-    hash = "sha256-LvxeADojLM33N3CmdwEHQ2FuORMlbKq961do5J7891M=";
+    hash = "sha256-It/TF7vAVzuANcNUG9whK9ZDLXpRHzwpGvV5I/YTVdo=";
  };

  nativeBuildInputs = [ cmake ];
@@ -394,7 +394,7 @@ let
 in
 {
  # Get revisions from
-  # https://github.com/moby/moby/tree/${version}/hack/dockerfile/install/*
+  # https://github.com/moby/moby/tree/${mobyRev}/Dockerfile
  docker_25 =
    let
      version = "25.0.13";
@@ -435,18 +435,18 @@ in

  docker_29 =
    let
-      version = "29.1.5";
+      version = "29.2.0";
    in
    callPackage dockerGen {
      inherit version;
      cliRev = "v${version}";
-      cliHash = "sha256-fg18lmJsMoy7lpL4hGkIhM0LKnhEY5nl5f0YuW8yg0A=";
+      cliHash = "sha256-GbXPe8DlhV4WnwJO8OVAdbXZ18IOUlXszenMGvPvSMQ=";
      mobyRev = "docker-v${version}";
-      mobyHash = "sha256-iUoqJT0lIiVh5WaHzlw71QXxc3sEsSpQpADb0KveXNQ=";
+      mobyHash = "sha256-Uilc5cxKuctSkjVxY3R5aezlmGHhLhHY4opVkTYRVIY=";
      runcRev = "v1.3.4";
      runcHash = "sha256-1IfY08sBoDpbLrwz1AKBRSTuCZyOgQzYPHTDUI6fOZ8=";
-      containerdRev = "v2.2.0";
-      containerdHash = "sha256-LXBGA03FTrrbxlH+DxPBFtp3/AYQf096YE2rpe6A+WM=";
+      containerdRev = "v2.2.1";
+      containerdHash = "sha256-fDOfN0XESrBTDW7Nxj9niqU93BQ5/JaGLwAR3u6Xaik=";
      tiniRev = "369448a167e8b3da4ca5bca0b3307500c3371828";
      tiniHash = "sha256-jCBNfoJAjmcTJBx08kHs+FmbaU82CbQcf0IVjd56Nuw=";
    };
@@ -29,6 +29,11 @@ stdenv.mkDerivation {

  installFlags = [ "install-completion" ];

+  outputs = [
+    "out"
+    "man"
+  ];
+
  patches = [
    # https://github.com/martanne/abduco/pull/22
    (fetchpatch {
@@ -1,21 +1,21 @@
 {
-  "version": "1.3.11-stable",
+  "version": "1.3.13-stable",
  "sources": {
    "aarch64-darwin": {
-      "url": "https://acli.atlassian.com/darwin/1.3.11-stable/acli_1.3.11-stable_darwin_arm64.tar.gz",
-      "sha256": "39f80d387324923f0093b455ee4d3d4bd2af44ffd52be33c1d69e8418376d0e4"
+      "url": "https://acli.atlassian.com/darwin/1.3.13-stable/acli_1.3.13-stable_darwin_arm64.tar.gz",
+      "sha256": "043c5422327610e82fd83ac79ca3ddf0c917611386f7527564db4c8bc99388b1"
    },
    "aarch64-linux": {
-      "url": "https://acli.atlassian.com/linux/1.3.11-stable/acli_1.3.11-stable_linux_arm64.tar.gz",
-      "sha256": "43cc72aca128605f0580fc404f14efef6659bb754c9bd3343fb5f43d1f2bbf4b"
+      "url": "https://acli.atlassian.com/linux/1.3.13-stable/acli_1.3.13-stable_linux_arm64.tar.gz",
+      "sha256": "522da066d9a4bc357eaf8fcca763a0be3048fd0e5595aa433d6904065472dd56"
    },
    "x86_64-darwin": {
-      "url": "https://acli.atlassian.com/darwin/1.3.11-stable/acli_1.3.11-stable_darwin_amd64.tar.gz",
-      "sha256": "84a56f7197bcdc5358a035c79bb706dbd80405255fc90f260973a268831ffe18"
+      "url": "https://acli.atlassian.com/darwin/1.3.13-stable/acli_1.3.13-stable_darwin_amd64.tar.gz",
+      "sha256": "8cd7231e951222c0b75728359844a9c76238dcad31542d66226f08498b1da9aa"
    },
    "x86_64-linux": {
-      "url": "https://acli.atlassian.com/linux/1.3.11-stable/acli_1.3.11-stable_linux_amd64.tar.gz",
-      "sha256": "50bb48e965e48531e008923be763a7b1f74fe9e2e33cc02cd2aaf5e2f00c6dc4"
+      "url": "https://acli.atlassian.com/linux/1.3.13-stable/acli_1.3.13-stable_linux_amd64.tar.gz",
+      "sha256": "1873a8b53123aec8a9c015707c89a49f7dbd8ac995113146841f29ea06259f9a"
    }
  }
 }
@@ -4,20 +4,19 @@
  buildGoModule,
  fetchFromGitHub,
  nixosTests,
-  swtpm,
  openssl,
  age,
  versionCheckHook,
 }:

-buildGoModule rec {
+buildGoModule (finalAttrs: {
  pname = "age-plugin-tpm";
  version = "1.0.1";

  src = fetchFromGitHub {
    owner = "Foxboron";
    repo = "age-plugin-tpm";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
    hash = "sha256-1BHVQY8ZexwdjchQiG8aQMEPukq/3ez+QYY1X67DgPc=";
  };

@@ -27,9 +26,9 @@ buildGoModule rec {

  nativeCheckInputs = [
    age
-    swtpm
  ];
  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;

  buildInputs = [
    openssl
@@ -38,7 +37,7 @@ buildGoModule rec {
  ldflags = [
    "-s"
    "-w"
-    "-X main.version=${version}"
+    "-X main.version=${finalAttrs.version}"
  ];

  passthru.tests = {
@@ -50,10 +49,11 @@ buildGoModule rec {
    description = "TPM 2.0 plugin for age (This software is experimental, use it at your own risk)";
    mainProgram = "age-plugin-tpm";
    homepage = "https://github.com/Foxboron/age-plugin-tpm";
+    changelog = "https://github.com/Foxboron/age-plugin-tpm/releases/tag/${finalAttrs.src.tag}";
    license = lib.licenses.mit;
    platforms = lib.platforms.all;
    maintainers = with lib.maintainers; [
      sgo
    ];
  };
-}
+})
@@ -6,19 +6,19 @@

 rustPlatform.buildRustPackage rec {
  pname = "alioth";
-  version = "0.10.0";
+  version = "0.11.0";

  src = fetchFromGitHub {
    owner = "google";
    repo = "alioth";
    tag = "v${version}";
-    hash = "sha256-lR3TrGCjOp+NprAXUttLWSEi2LDGCOpW9Bg5TH7reys=";
+    hash = "sha256-VkyR9NOxv5PVuW172Sw2ign6sApDnKTnH2BBlVl6GFk=";
  };

  # Checks use `debug_assert_eq!`
  checkType = "debug";

-  cargoHash = "sha256-lZam3/GuKIoGdWFhOc8E54yHVr0ah39HGiMVmNwCDlI=";
+  cargoHash = "sha256-NUbu2AL5gD7OOskNGO0pitJaTlgCYxAr6GYyv8nuytI=";

  separateDebugInfo = true;

@@ -8,17 +8,17 @@

 buildGoModule rec {
  pname = "aliyun-cli";
-  version = "3.2.2";
+  version = "3.2.9";

  src = fetchFromGitHub {
    owner = "aliyun";
    repo = "aliyun-cli";
    tag = "v${version}";
-    hash = "sha256-MIVhESm/5UJxUyN4ZnFLmVKX+2VCBjT33dIbsae3yVA=";
+    hash = "sha256-6zGNPw/nVV60qkUOJZXGe1CJu2I/dMVctk5EGhvkcE0=";
    fetchSubmodules = true;
  };

-  vendorHash = "sha256-lmlCPBEqopmoNjkihVOh8zKSKsS4HmaDQ+QAEJ/pEvA=";
+  vendorHash = "sha256-hDgwZiXRjcuQOo7ezjtGS1DawtOffllW64gsGKnTFQM=";

  subPackages = [ "main" ];

@@ -5,7 +5,7 @@
  "packages": {
    "": {
      "dependencies": {
-        "@sourcegraph/amp": "^0.0.1769346334-gc7e300"
+        "@sourcegraph/amp": "^0.0.1769573834-gf25e1e"
      }
    },
    "node_modules/@napi-rs/keyring": {
@@ -228,9 +228,9 @@
      }
    },
    "node_modules/@sourcegraph/amp": {
-      "version": "0.0.1769346334-gc7e300",
-      "resolved": "https://registry.npmjs.org/@sourcegraph/amp/-/amp-0.0.1769346334-gc7e300.tgz",
-      "integrity": "sha512-inYgc+ARJbXEXrDMQsG2kwQI9/tRHD/TPubNGv6XnQSd0MxCq9hr4KxiSryFnw5qIASWYn85RdSy6LM9dRFa7Q==",
+      "version": "0.0.1769573834-gf25e1e",
+      "resolved": "https://registry.npmjs.org/@sourcegraph/amp/-/amp-0.0.1769573834-gf25e1e.tgz",
+      "integrity": "sha512-CIUXmicZvkuekyDn5F9K7IozSG/FjnYM9gRS1KIWkeFBeQONRsnxuMaLswlNR4MIDd9nzco8wielehe6q6rnoA==",
      "license": "Amp Commercial License",
      "dependencies": {
        "@napi-rs/keyring": "1.1.9"
@@ -9,11 +9,11 @@

 buildNpmPackage (finalAttrs: {
  pname = "amp-cli";
-  version = "0.0.1769346334-gc7e300";
+  version = "0.0.1769573834-gf25e1e";

  src = fetchzip {
    url = "https://registry.npmjs.org/@sourcegraph/amp/-/amp-${finalAttrs.version}.tgz";
-    hash = "sha256-Y0ySMlYP/mvD+ydkGhqt03zYkFj6BmZpe2zLnAV5rDk=";
+    hash = "sha256-6iieN2hDbwUh9gU5oD53e/gpYTwV0uQ70KPQ1hgr1J0=";
  };

  postPatch = ''
@@ -45,7 +45,7 @@ buildNpmPackage (finalAttrs: {
    chmod +x bin/amp-wrapper.js
  '';

-  npmDepsHash = "sha256-2e0kJJqmIB3kAaSzATSaNojLvsCIq5MwTGK0y0OxfO4=";
+  npmDepsHash = "sha256-p2MzhZHblYFygEVmY3DkyeukLODRChOA802DowCugv0=";

  propagatedBuildInputs = [
    ripgrep
@@ -9,13 +9,13 @@

 crystal.buildCrystalPackage rec {
  pname = "amqpcat";
-  version = "1.0.0";
+  version = "1.0.2";

  src = fetchFromGitHub {
    owner = "cloudamqp";
    repo = "amqpcat";
    tag = "v${version}";
-    hash = "sha256-QLVFAcymj7dERbUiRcseiDuuKgrQ8n4LbkdhUyXPcWw=";
+    hash = "sha256-fdDdMjeAlJ0H05LNVdRxwq6RK41d6rXLFQMw6RSlXZM=";
  };

  format = "shards";
@@ -19,13 +19,13 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "angryoxide";
-  version = "0.8.32";
+  version = "0.9.2";

  src = fetchFromGitHub {
    owner = "Ragnt";
    repo = "AngryOxide";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Sla5lvyqZho9JE4QVS9r0fx5+DVlU90c8OSfO4/f0B4=";
+    hash = "sha256-OMNpAp+SmwFlNFlsL3DVgUYja+4o26B7AbR8JMz/4JA=";
  };

  postPatch = ''
@@ -33,7 +33,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    ln -s ${libwifi} libs/libwifi
  '';

-  cargoHash = "sha256-mry4l0a7DZOWkrChU40OVRCBjKwI39cyZtvEBA5tro0=";
+  cargoHash = "sha256-dktJEcX4IbhwDyfptA6PZaAcvF6RRC+jWTspnHaof4s=";

  nativeBuildInputs = [
    pkg-config
@@ -5,23 +5,33 @@
  cmake,
 }:

-clangStdenv.mkDerivation rec {
+clangStdenv.mkDerivation (finalAttrs: {
  pname = "armips";
  version = "0.11.0";

  src = fetchFromGitHub {
    owner = "Kingcom";
    repo = "armips";
-    rev = "v${version}";
-    sha256 = "sha256-L+Uxww/WtvDJn1xZqoqA6Pkzq/98sy1qTxZbv6eEjbA=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-L+Uxww/WtvDJn1xZqoqA6Pkzq/98sy1qTxZbv6eEjbA=";
  };

  postPatch = ''
    substituteInPlace CMakeLists.txt \
-      --replace-fail c++11 c++17 \
-      --replace-fail "cmake_minimum_required(VERSION 2.8)" "cmake_minimum_required(VERSION 3.13)" # done by https://github.com/Kingcom/armips/commit/e1ed5bf0f4565250b98b0ddfb9112f15dc8e8e3b upstream, patch not directly compatible
+      --replace-fail c++11 c++17
+  ''
+  # done by https://github.com/Kingcom/armips/commit/e1ed5bf0f4565250b98b0ddfb9112f15dc8e8e3b upstream, patch not directly compatible
+  + ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail \
+        "cmake_minimum_required(VERSION 2.8)" \
+        "cmake_minimum_required(VERSION 3.13)"
  '';

+  # Fix GCC 15 compatibility
+  # error: unknown type name 'uint32_t'
+  env.CXXFLAGS = "-include cstdint";
+
  nativeBuildInputs = [ cmake ];

  installPhase = ''
@@ -48,4 +58,4 @@ clangStdenv.mkDerivation rec {
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ marius851000 ];
  };
-}
+})
@@ -9,12 +9,11 @@
  enableStandardFeatures ? false,
  sourceHighlight,
  highlight,
-  pygments,
  graphviz,
  texliveMinimal,
  dblatexFull,
  libxslt,
-  w3m,
+  w3m-batch,
  lynx,
  imagemagick,
  lilypond,
@@ -45,11 +44,7 @@
  enableQrcodeFilter ? false,
  qrencode,
  enableMatplotlibFilter ? false,
-  matplotlib,
-  numpy,
  enableAafigureFilter ? false,
-  aafigure,
-  recursive-pth-loader,
  # backends
  enableDeckjsBackend ? false,
  enableOdfBackend ? false,
@@ -61,6 +56,13 @@
 }:

 let
+  inherit (python3.pkgs)
+    pygments
+    matplotlib
+    numpy
+    aafigure
+    recursive-pth-loader
+    ;

  _enableDitaaFilter = (enableExtraPlugins && enableJava) || enableDitaaFilter;
  _enableMscgenFilter = enableExtraPlugins || enableMscgenFilter;
@@ -268,7 +270,7 @@ python3.pkgs.buildPythonApplication rec {
            -e "s|^XSLTPROC =.*|XSLTPROC = '${libxslt.bin}/bin/xsltproc'|" \
            -e "s|^DBLATEX =.*|DBLATEX = '${dblatexFull}/bin/dblatex'|" \
            ${lib.optionalString enableJava ''-e "s|^FOP =.*|FOP = '${fop}/bin/fop'|"''} \
-            -e "s|^W3M =.*|W3M = '${w3m}/bin/w3m'|" \
+            -e "s|^W3M =.*|W3M = '${w3m-batch}/bin/w3m'|" \
            -e "s|^LYNX =.*|LYNX = '${lynx}/bin/lynx'|" \
            -e "s|^XMLLINT =.*|XMLLINT = '${libxml2.bin}/bin/xmllint'|" \
            -e "s|^EPUBCHECK =.*|EPUBCHECK = '${epubcheck}/bin/epubcheck'|" \
@@ -8,23 +8,23 @@
  ps,
 }:

-buildGoModule rec {
+buildGoModule (finalAttrs: {
  pname = "assh";
-  version = "2.16.0";
+  version = "2.17.0";

  src = fetchFromGitHub {
    repo = "advanced-ssh-config";
    owner = "moul";
-    tag = "v${version}";
-    hash = "sha256-rvJJZqVSBdaJ154NV6RaxbymsSsHbKnlJDeR6KHQE7M=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-X5UWQe4c+QudmXKjFKafivO/OvdBNzyutrL+CUK0olg=";
  };

-  vendorHash = "sha256-L2Uo/jsMtxQClF1UDa7NIUbOm7BflvncNsjqGnCsPKo=";
+  vendorHash = "sha256-EA39KqAN9SHPU362j6/j6okvT+eZb2R4unMA0bB+bVg=";

  ldflags = [
    "-s"
    "-w"
-    "-X moul.io/assh/v2/pkg/version.Version=${version}"
+    "-X=moul.io/assh/v2/pkg/version.Version=${finalAttrs.version}"
  ];

  nativeBuildInputs = [ makeWrapper ];
@@ -44,9 +44,9 @@ buildGoModule rec {
  meta = {
    description = "Advanced SSH config - Regex, aliases, gateways, includes and dynamic hosts";
    homepage = "https://github.com/moul/assh";
-    changelog = "https://github.com/moul/assh/releases/tag/v${version}";
+    changelog = "https://github.com/moul/assh/releases/tag/${finalAttrs.src.tag}";
    license = lib.licenses.mit;
    maintainers = [ ];
    platforms = with lib.platforms; linux ++ darwin;
  };
-}
+})
@@ -31,7 +31,7 @@
  libid3tag,
  libopus,
  libuuid,
-  ffmpeg,
+  ffmpeg_7,
  soundtouch,
  portaudio, # given up fighting their portaudio.patch?
  portmidi,
@@ -58,6 +58,9 @@
 # TODO
 # 1. detach sbsms

+let
+  ffmpeg = ffmpeg_7;
+in
 stdenv.mkDerivation (finalAttrs: {
  pname = "audacity";
  version = "3.7.7";
@@ -0,0 +1,80 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  fetchurl,
+  makeWrapper,
+  installShellFiles,
+  python3,
+  android-tools,
+  pulseaudio,
+  coreutils,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "audiosource";
+  version = "1.4";
+
+  src = fetchFromGitHub {
+    owner = "gdzx";
+    repo = "audiosource";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-SlX8gjs7X5jfoeU6pyk4n8f6oMJgneGVt0pmFs48+mQ=";
+  };
+
+  patches = [
+    # Removes build-related logic from the script that is unused in the package and fixes a small bug with adb args on new Android versions
+    ./unused-logic-removal-and-args-fix.patch
+  ];
+
+  postPatch = ''
+    substituteInPlace audiosource \
+      --replace-fail "@apkPath@" "$out/share/audiosource/audiosource.apk"
+  '';
+
+  nativeBuildInputs = [
+    makeWrapper
+    installShellFiles
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin $out/share/audiosource
+    cp ${finalAttrs.passthru.apk} $out/share/audiosource/audiosource.apk
+
+    installBin audiosource
+
+    runHook postInstall
+  '';
+
+  postFixup = ''
+    wrapProgram $out/bin/audiosource \
+      --prefix PATH : ${
+        lib.makeBinPath [
+          python3
+          android-tools
+          pulseaudio
+          coreutils
+        ]
+      }
+  '';
+
+  passthru.apk = fetchurl {
+    url = "https://github.com/gdzx/audiosource/releases/download/v${finalAttrs.version}/audiosource.apk";
+    hash = "sha256-vDIF+NZ3JgTT67Dem4qeajWsA5m/MFt2nRDpWUqC9aU=";
+  };
+
+  meta = {
+    description = "Use an Android device as a USB microphone";
+    homepage = "https://github.com/gdzx/audiosource";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ ikci ];
+    mainProgram = "audiosource";
+    platforms = lib.platforms.linux;
+    sourceProvenance = with lib.sourceTypes; [
+      fromSource
+      binaryBytecode
+    ];
+  };
+})
@@ -0,0 +1,82 @@
+diff --git a/audiosource b/audiosource
+index b06127a..0bccddf 100755
+--- a/audiosource
+++ b/audiosource
+@@ -2,15 +2,7 @@
+ 
+ set -eu
+ 
+-AUDIOSOURCE_PROFILE=${AUDIOSOURCE_PROFILE:-debug}
+-
+-if [ "$AUDIOSOURCE_PROFILE" = 'release' ]; then
+-	AUDIOSOURCE_DEFAULT_APK=app/build/outputs/apk/release/app-release.apk
+-else
+-	AUDIOSOURCE_DEFAULT_APK=app/build/outputs/apk/debug/app-debug.apk
+-fi
+-
+-AUDIOSOURCE_APK=${AUDIOSOURCE_APK:-"$AUDIOSOURCE_DEFAULT_APK"}
+AUDIOSOURCE_APK=${AUDIOSOURCE_APK:-"@apkPath@"}
+ ANDROID_SERIAL=${ANDROID_SERIAL:-}
+ 
+ PYSOCAT="$(cat <<EOF
+@@ -81,22 +73,12 @@ install() {
+ 
+ 	echo '[+] Installing Audio Source'
+ 
+-	adb install -rtg "$AUDIOSOURCE_APK" || {
+	adb install -r -t -g "$AUDIOSOURCE_APK" || {
+ 		adb uninstall fr.dzx.audiosource
+-		adb install -tg "$AUDIOSOURCE_APK"
+		adb install -t -g "$AUDIOSOURCE_APK"
+ 	}
+ }
+ 
+-_release() {
+-	AUDIOSOURCE_PROFILE=release
+-	AUDIOSOURCE_APK=app/build/outputs/apk/release/app-release.apk
+-
+-	build
+-
+-	cp -a "$AUDIOSOURCE_APK" audiosource.apk
+-	sha256sum audiosource.apk > audiosource.apk.sha256
+-}
+-
+ _unload() {
+ 	for id in `pactl list modules short | sed -n "/module-pipe-source\tsource_name=$AUDIOSOURCE_NAME/p" | cut -f1`; do
+ 		pactl unload-module "$id"
+@@ -146,7 +128,7 @@ volume() {
+ 
+ main_help() {
+ 	cat <<-EOF
+-		Usage: ./audiosource [-s SERIAL] COMMAND [ARGS...]
+		Usage: audiosource [-s SERIAL] COMMAND [ARGS...]
+ 
+ 		Options:
+ 
+@@ -154,15 +136,13 @@ main_help() {
+ 
+ 		Commands:
+ 
+-		   build         Build Audio Source APK (default: debug)
+-		   install       Install Audio Source to Android device (default: debug)
+		   install       Install Audio Source to Android device
+ 		   run           Run Audio Source and start forwarding
+ 		   volume LEVEL  Set volume to LEVEL (for example, 250%)
+ 
+ 		Environment:
+ 
+-		   AUDIOSOURCE_APK      APK path (default: app/build/outputs/apk/\$profile/app-\$profile.apk)
+-		   AUDIOSOURCE_PROFILE  Build profile (debug or release, default: build)
+		   AUDIOSOURCE_APK      APK path (default: @apkPath@)
+ 		   AUDIOSOURCE_NAME     Name of the PulseAudio source (default: android-<serial-hash>)
+ 		   ANDROID_SERIAL       Device serial number to connect to (default: unset)
+ 	EOF
+@@ -200,7 +180,7 @@ main() {
+ 	shift
+ 
+ 	case "$cmd" in
+-		build|install|run|volume|_release)
+		install|run|volume)
+ 			"$cmd" "$@"
+ 			;;
+ 		*)
@@ -340,19 +340,19 @@ let
            --replace-fail 'web/' '${webui}/'
        '';

-        nativeBuildInputs = [
-          prev.hatchling
-          prev.pythonRelaxDepsHook
+        build-system = [
+          final.hatchling
        ];

        pythonRemoveDeps = [ "dumb-init" ];

        pythonRelaxDeps = true;

-        propagatedBuildInputs =
+        dependencies =
          with final;
          [
            argon2-cffi
+            cachetools
            channels
            cryptography
            dacite
@@ -10,17 +10,17 @@
 }:
 buildGoModule rec {
  pname = "aws-vault";
-  version = "7.9.0";
+  version = "7.9.3";

  src = fetchFromGitHub {
    owner = "ByteNess";
    repo = "aws-vault";
    rev = "v${version}";
-    hash = "sha256-G80hDf6rpWzgkS1VESBGUpTcShvnuCH1OAiMboOz37k=";
+    hash = "sha256-oQI1VjK4nQAErXgtUumdTwVB0maCfEv4WRF+buaHnKM=";
  };

  proxyVendor = true;
-  vendorHash = "sha256-7ONAv0EooaseR5kpca8y2OX8yOKMID2xgkYC4rm4CcQ=";
+  vendorHash = "sha256-KXJSggr0kOTduv3yhDJbDNdSrfXS+d2UOFFn9UK519M=";

  nativeBuildInputs = [
    installShellFiles
@@ -9,13 +9,13 @@

 stdenvNoCC.mkDerivation rec {
  pname = "bbin";
-  version = "0.2.4";
+  version = "0.2.5";

  src = fetchFromGitHub {
    owner = "babashka";
    repo = "bbin";
    rev = "v${version}";
-    sha256 = "sha256-26uZqHSLi+qnilyPWt/2mCr1wyu1flxNd+jq9zbumrg=";
+    sha256 = "sha256-kkW95GKQIoWTlAhZ+MKQMmZ1MfYgYbp6gn9RHSrIpYs=";
  };

  nativeBuildInputs = [ makeWrapper ];
@@ -28,18 +28,18 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "bcachefs-tools";
-  version = "1.35.2";
+  version = "1.36.0";

  src = fetchFromGitHub {
    owner = "koverstreet";
    repo = "bcachefs-tools";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-YreeoI9ct3Gt0za3bW4cFP8mA3mrgpVnHVUzfX1m5CI=";
+    hash = "sha256-VSx8M8W3j47xC0tPdKtEHeMcFJMpBBMHjf7ZiDiE79I=";
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
    inherit (finalAttrs) src;
-    hash = "sha256-1TxACD4xXZ3BfVdoQUCzWe5Ovv0tKw6ALBw0+tRLOaQ=";
+    hash = "sha256-o0UofdKgEe/R683TmZJlsd1QD1Iy1oMBVBSN6u2uvDM=";
  };

  postPatch = ''
@@ -6,16 +6,16 @@
 }:
 rustPlatform.buildRustPackage rec {
  pname = "binsider";
-  version = "0.3.1";
+  version = "0.3.2";

  src = fetchFromGitHub {
    owner = "orhun";
    repo = "binsider";
    rev = "v${version}";
-    hash = "sha256-ZfLFZXLnH5nBg/5ufOfwMG8c8n+BDex3j7da+Hvh1fw=";
+    hash = "sha256-Un3pKb0+5rwK0tKRp+HVl3vynPt5V8YxhPiLgshL3L0=";
  };

-  cargoHash = "sha256-HnJBeqZhzDT0XfZ5UDg+lWMaX8tP7Q4iXrAz84XM3QE=";
+  cargoHash = "sha256-Lcnc2fVyzip+g/mZvbMarQHkjBTNhKB5kZVTHFsR+Xo=";

  buildNoDefaultFeatures = !stdenv.hostPlatform.isLinux;

@@ -2,7 +2,6 @@
  lib,
  stdenv,
  fetchFromGitLab,
-  mesa,
  wayland,
  libglvnd,
  libbsd,
@@ -35,7 +34,6 @@ stdenv.mkDerivation (finalAttrs: {
    libelf
    libglvnd
    libunwind
-    mesa
    wayland
  ];

@@ -6,13 +6,13 @@
 }:
 buildGoModule rec {
  pname = "bitrise";
-  version = "2.36.5";
+  version = "2.37.0";

  src = fetchFromGitHub {
    owner = "bitrise-io";
    repo = "bitrise";
    rev = "v${version}";
-    hash = "sha256-cVWlqVtukRD/ojjcRM6F/4wnhrlTTqQEJqc9NoW7gFw=";
+    hash = "sha256-CxWFqrgj/oYsD3yBjR4fdh7FSAaGZnbC6OB9H1VH+m0=";
  };

  # many tests rely on writable $HOME/.bitrise and require network access
@@ -9,19 +9,19 @@
 }:

 let
-  version = "2.5.0";
+  version = "2.5.2";
  src = fetchFromGitHub {
    owner = "Azure";
    repo = "azure-storage-fuse";
    rev = "blobfuse2-${version}";
-    sha256 = "sha256-BRLORwEY8PeD9hFkpm3Gup+eXzdFkW1Rkr73ncyKrso=";
+    sha256 = "sha256-iTzVKb8z7lQh40iMZiwjeufColiwU2YrihBLNLjS6JI=";
  };
 in
 buildGoModule {
  pname = "blobfuse";
  inherit version src;

-  vendorHash = "sha256-L1ix9pRal5Ssfwf+kl9SFC9bbveuKeiuzrBwapvbFZY=";
+  vendorHash = "sha256-9sT+8o+esVYdqYqAfkvyggqPiIIkG78krv+uID9+UBw=";

  buildInputs = [ fuse3 ];

@@ -5,14 +5,14 @@
  nixosTests,
 }:

-buildGoModule rec {
+buildGoModule (finalAttrs: {
  pname = "blocky";
  version = "0.28.2";

  src = fetchFromGitHub {
    owner = "0xERR0R";
    repo = "blocky";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
    hash = "sha256-GLVyPb2Qyn1jnRz+e74dFzL/AMloKqSe1BUUAGTquWA=";
  };

@@ -25,7 +25,7 @@ buildGoModule rec {
  ldflags = [
    "-s"
    "-w"
-    "-X github.com/0xERR0R/blocky/util.Version=${version}"
+    "-X github.com/0xERR0R/blocky/util.Version=${finalAttrs.version}"
  ];

  passthru.tests = { inherit (nixosTests) blocky; };
@@ -35,7 +35,10 @@ buildGoModule rec {
    homepage = "https://0xerr0r.github.io/blocky";
    changelog = "https://github.com/0xERR0R/blocky/releases";
    license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ ratsclub ];
+    maintainers = with lib.maintainers; [
+      ratsclub
+      kuflierl
+    ];
    mainProgram = "blocky";
  };
-}
+})
@@ -1,7 +1,7 @@
 {
  lib,
  stdenv,
-  fetchFromGitHub,
+  fetchFromGitea,
  makeWrapper,
  cmake,
  ninja,
@@ -29,27 +29,28 @@
 }:
 let
  cef = cef-binary.override {
-    version = "126.2.18";
-    gitRevision = "3647d39";
-    chromiumVersion = "126.0.6478.183";
+    version = "141.0.7";
+    gitRevision = "a5714cc";
+    chromiumVersion = "141.0.7390.108";

    srcHashes = {
-      aarch64-linux = "sha256-Ni5aEbI+WuMnbT8gPWMONN5NkTySw7xJvnM6U44Njao=";
-      x86_64-linux = "sha256-YwND4zsndvmygJxwmrCvaFuxjJO704b6aDVSJqpEOKc=";
+      aarch64-linux = "sha256-2A0hVzUVMBemhjnFE/CrKs4CU96Qkxy8S/SieaEJjwE=";
+      x86_64-linux = "sha256-tZzUxeXxbYP8YfIQLbiSyihPcjZM9cd2Ad8gGCSvdGk=";
    };
  };
 in
 let
  bolt = stdenv.mkDerivation (finalAttrs: {
    pname = "bolt-launcher";
-    version = "0.20.0";
+    version = "0.21.0";

-    src = fetchFromGitHub {
+    src = fetchFromGitea {
+      domain = "codeberg.org";
      owner = "AdamCake";
-      repo = "bolt";
+      repo = "Bolt";
      tag = finalAttrs.version;
      fetchSubmodules = true;
-      hash = "sha256-Gh1xaYAysZshEGzljnEYJuK8Mv4cwSWH1W4rEu2F/0s=";
+      hash = "sha256-QQJKUCxeff56ghwP00uF4GI35vSAPWM+JphTEUfWOUo=";
    };

    nativeBuildInputs = [
@@ -8,16 +8,16 @@

 php83.buildComposerProject2 (finalAttrs: {
  pname = "bookstack";
-  version = "25.12.1";
+  version = "25.12.3";

  src = fetchFromGitHub {
    owner = "bookstackapp";
    repo = "bookstack";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-lp2qC2K2RnWgI0g/67WNPtatbLCTUau37PcLqG6dQlw=";
+    hash = "sha256-IP1IffCDPPudtgwIv3gqPud9p7WjGbXrLlnoAZ56Gu8=";
  };

-  vendorHash = "sha256-kbyFPDg9ev0IjvqtFoTiiYyza2oriAhMLbAU7Js9Dyc=";
+  vendorHash = "sha256-Q7Qz/LwycyKjDuD6vBQY6z7CcT4H/i+9KaC13CgS6Fc=";

  passthru = {
    phpPackage = php83;
@@ -32,13 +32,13 @@

 python3Packages.buildPythonApplication rec {
  pname = "bottles-unwrapped";
-  version = "60.1";
+  version = "61.1";

  src = fetchFromGitHub {
    owner = "bottlesdevs";
    repo = "bottles";
    tag = version;
-    hash = "sha256-d9nRT6AvFxnhI/theJtPg79EdmA+9UFS4OWDlkV03sA=";
+    hash = "sha256-LW+os+5DtdUBZWONu2YX4FYMtAYg4BDlKbnVF64T2xI=";
  };

  patches = [
@@ -96,6 +96,7 @@ python3Packages.buildPythonApplication rec {
      urllib3
      certifi
      pefile
+      yara-python
    ]
    ++ [
      cabextract
@@ -16,10 +16,10 @@ index 6ff7c011..c26ea0b9 100644
   '__init__.py',
   'main.py',
 diff --git a/bottles/frontend/views/bottle_details.py b/bottles/frontend/views/bottle_details.py
-index 65667ea9..7ae1eb19 100644
+index f897953c..393572ed 100644
 --- a/bottles/frontend/views/bottle_details.py
 +++ b/bottles/frontend/views/bottle_details.py
-@@ -436,20 +436,19 @@ class BottleView(Adw.PreferencesPage):
+@@ -824,20 +824,17 @@ class BottleView(Adw.PreferencesPage):
             dialog.connect("response", execute)
             dialog.show()
 
@@ -33,7 +33,7 @@ index 65667ea9..7ae1eb19 100644
 -                    ),
 -                )
 -                dialog.add_response("dismiss", _("_Dismiss"))
-                dialog.connect("response", show_chooser)
+-                dialog.connect("response", lambda *args: show_chooser())
 -                dialog.present()
 -            else:
 -                show_chooser()
@@ -48,16 +48,14 @@ index 65667ea9..7ae1eb19 100644
 +            dialog.add_response("dismiss", _("_Dismiss"))
 +            dialog.connect("response", show_chooser)
 +            dialog.present()
-+        else:
-+            show_chooser()
+         else:
+             show_chooser()
 
-     def __backup(self, widget, backup_type):
-         """
 diff --git a/bottles/frontend/views/bottle_preferences.py b/bottles/frontend/views/bottle_preferences.py
-index 288e693b..b8b57618 100644
+index 1e0090f8..983097f2 100644
 --- a/bottles/frontend/views/bottle_preferences.py
 +++ b/bottles/frontend/views/bottle_preferences.py
-@@ -139,7 +139,7 @@ class PreferencesView(Adw.PreferencesPage):
+@@ -148,7 +148,7 @@ class PreferencesView(Adw.PreferencesPage):
         self.queue = details.queue
         self.details = details
 
@@ -67,7 +65,7 @@ index 288e693b..b8b57618 100644
 
         _not_available = _("This feature is unavailable on your system.")
 diff --git a/bottles/frontend/views/list.py b/bottles/frontend/views/list.py
-index 43ab9c22..a283b178 100644
+index 6bd8fc81..0f96ab70 100644
 --- a/bottles/frontend/views/list.py
 +++ b/bottles/frontend/views/list.py
@@ -82,8 +82,6 @@ class BottlesBottleRow(Adw.ActionRow):
@@ -80,10 +78,10 @@ index 43ab9c22..a283b178 100644
         def set_path(_dialog, response):
             if response != Gtk.ResponseType.ACCEPT:
 diff --git a/bottles/frontend/views/new_bottle_dialog.py b/bottles/frontend/views/new_bottle_dialog.py
-index a8b007d4..c6f0a156 100644
+index 9c386862..3ed98f7c 100644
 --- a/bottles/frontend/views/new_bottle_dialog.py
 +++ b/bottles/frontend/views/new_bottle_dialog.py
-@@ -80,7 +80,7 @@ class BottlesNewBottleDialog(Adw.Dialog):
+@@ -86,7 +86,7 @@ class BottlesNewBottleDialog(Adw.Dialog):
         super().__init__(**kwargs)
         # common variables and references
         self.window = GtkUtils.get_parent_window()
@@ -1,12 +1,28 @@
 diff --git a/bottles/backend/utils/terminal.py b/bottles/backend/utils/terminal.py
-index 1f28e093..cca8018a 100644
+index 943cface..1f67822e 100644
 --- a/bottles/backend/utils/terminal.py
 +++ b/bottles/backend/utils/terminal.py
-@@ -138,7 +138,7 @@ class TerminalUtils:
-                 full_cmd = f"{template} {cmd_for_shell}"
-
-         elif term_bin in ["kitty", "foot", "konsole", "gnome-terminal"]:
+@@ -132,21 +132,21 @@ class TerminalUtils:
+                 full_cmd = f"{template} {palette} {cmd_for_shell}"
+ 
+         elif term_bin == "xfce4-terminal":
 -            cmd_for_shell = shlex.quote(f"sh -c {command}")
+            cmd_for_shell = f"sh -c {command}"
+             try:
+                 full_cmd = template % cmd_for_shell
+             except Exception:
+                 full_cmd = f"{template} {cmd_for_shell}"
+ 
+         elif term_bin in ["kitty", "foot", "konsole", "gnome-terminal", "wezterm"]:
+-            cmd_for_shell = shlex.quote(f"sh -c {command}")
+            cmd_for_shell = f"sh -c {command}"
+             try:
+                 full_cmd = template % cmd_for_shell
+             except Exception:
+                 full_cmd = f"{template} {cmd_for_shell}"
+ 
+         else:
+-            cmd_for_shell = shlex.quote(f"bash -c {command}")
 +            cmd_for_shell = f"sh -c {command}"
             try:
                 full_cmd = template % cmd_for_shell
@@ -9,20 +9,20 @@
 }:

 let
-  version = "2026.1";
+  version = "2026.1.2";

  product =
    if proEdition then
      {
        productName = "pro";
        productDesktop = "Burp Suite Professional Edition";
-        hash = "sha256-4GvB1K4UZnZMor0jBWXvzgy0qfh234TZmtu6eSR4/jk=";
+        hash = "sha256-KF6VOXO3IKsysA3SBJJzL+G2yQEVpCQKL6IMYQhYFMc=";
      }
    else
      {
        productName = "community";
        productDesktop = "Burp Suite Community Edition";
-        hash = "sha256-q0vKBEIzO18mNX7bn1vhnstnGr1pwjMnHXq6HdtpJy0=";
+        hash = "sha256-5LNzF68VhGdWttzZCkw/Ign4x6V4EhU/EHMddeSVirk=";
      };

  src = fetchurl {
@@ -1,18 +1,18 @@
 {
  lib,
-  gccStdenv,
+  stdenv,
  dos2unix,
  fetchurl,
  unzip,
 }:

-gccStdenv.mkDerivation (finalAttrs: {
+stdenv.mkDerivation (finalAttrs: {
  pname = "bwbasic";
-  version = "3.30";
+  version = "3.40";

  src = fetchurl {
    url = "mirror://sourceforge/project/bwbasic/bwbasic/version%20${finalAttrs.version}/bwbasic-${finalAttrs.version}.zip";
-    hash = "sha256-Cab8/DvYjw6K8c46ZTJImISa0vJt5UeFDB+ZTSVfkGQ=";
+    hash = "sha256-tWiUIqCdBarhFDSX0iV55VxOEh7iuAbnOLSDuMAAog8=";
  };

  nativeBuildInputs = [
@@ -20,16 +20,18 @@ gccStdenv.mkDerivation (finalAttrs: {
    unzip
  ];

-  unpackPhase = ''
-    unzip $src
-  '';
+  sourceRoot = ".";

  postPatch = ''
    dos2unix configure
    patchShebangs configure
    chmod +x configure
+    substituteInPlace bwbasic.h \
+      --replace-fail "extern int putenv (const char *buffer)" "extern int putenv (char *buffer)"
  '';

+  env.NIX_CFLAGS_COMPILE = "-std=c89";
+
  hardeningDisable = [ "format" ];

  preInstall = ''
@@ -8,16 +8,16 @@

 buildGoModule (finalAttrs: {
  pname = "cagent";
-  version = "1.19.0";
+  version = "1.20.0";

  src = fetchFromGitHub {
    owner = "docker";
    repo = "cagent";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-J7IRlSsjXRDvbUKwnV2rrWnEmvqciJw3mN8NerQBtl4=";
+    hash = "sha256-HOQibgT9R7Ic1tGtgjSB+nSWKID6TD1Yt6tr37Voa7w=";
  };

-  vendorHash = "sha256-q7mP9JWJEdDbUO/3MHsJwiySNvN2SbhnhEbJArnCW3M=";
+  vendorHash = "sha256-8NXiIxaq+03+LrHFBaxZ4YFb0sqYikajgk5gYXTn3Rs=";

  # Disable tests: Networked model providers and writable cache directories are required.
  doCheck = false;
@@ -8,16 +8,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "cargo-bazel";
-  version = "0.8.0";
+  version = "0.17.0";

  src = fetchCrate {
    inherit pname version;
-    hash = "sha256-FS1WFlK0YNq1QCi3S3f5tMN+Bdcfx2dxhDKRLXLcios=";
+    hash = "sha256-KWcxZxzDbiBfBpr37M6HoqHMCYXq6sTVxU9KR3PIiJc=";
  };

  buildInputs = lib.optional stdenv.hostPlatform.isDarwin libz;

-  cargoHash = "sha256-E/yF42Vx9tv8Ik1j23El3+fI19ZGzq6nikVMATY7m3E=";
+  cargoHash = "sha256-wNsGggyKL6CyldPsNADwGKm3HGfxQwjCCOdgzWcAx4g=";

  # `test_data` is explicitly excluded from the package published to crates.io, so tests cannot be run
  doCheck = false;
@@ -93,6 +93,8 @@ tauriInstallHook() {
 }

 tauriFixupHook() {
+  echo "Executing tauriFixupHook"
+
  # NOTE: This runs as a preFixupPhase and does not replace the original hook.
  @fixupScript@
 }
@@ -1,13 +1,10 @@
 {
  lib,
-  buildPythonApplication,
+  python3Packages,
  fetchFromGitea,
-  six,
-  sphinxHook,
-  sphinx-rtd-theme,
 }:

-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
  pname = "cdist";
  version = "7.0.0";
  format = "setuptools";
@@ -25,7 +22,7 @@ buildPythonApplication rec {
    hash = "sha256-lIx0RtGQJdY2e00azI9yS6TV+5pCegpKOOD0dQmgMqA=";
  };

-  nativeBuildInputs = [
+  nativeBuildInputs = with python3Packages; [
    six
    sphinxHook
    sphinx-rtd-theme
@@ -88,7 +88,6 @@ buildFHSEnv {
      kdePackages.wayland
      libxkbcommon
      libgcc
-      mesa
      libdrm
      expat
      alsa-lib
@@ -21,14 +21,14 @@ in

 stdenv.mkDerivation (finalAttrs: {
  pname = "chameleon-cli";
-  version = "2.1.0-unstable-2025-09-12";
+  version = "2.1.0-unstable-2025-10-13";

  src = fetchFromGitHub {
    owner = "RfidResearchGroup";
    repo = "ChameleonUltra";
-    rev = "8998621a47011008df23be9a56b1fc9ce1a64ac3";
+    rev = "97dfe5b9a41a6ea5535c6842afbe420098c4844b";
    sparseCheckout = [ "software" ];
-    hash = "sha256-I+sWxwFdZ5nozxv8Z1TsEHpMbcMHGhKAw3xI7DzyjIA=";
+    hash = "sha256-zFExh0vhzNcf02izgO4P4cWq3LoQpEHb4ZW7hsHZqNA=";
  };

  sourceRoot = "${finalAttrs.src.name}/software";
@@ -11,16 +11,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "chess-tui";
-  version = "2.3.0";
+  version = "2.4.0";

  src = fetchFromGitHub {
    owner = "thomas-mauran";
    repo = "chess-tui";
    tag = finalAttrs.version;
-    hash = "sha256-g+rKib+ZoBa2ssYKgS0tg0xngurY1z3DbBZZEn/LJU4=";
+    hash = "sha256-Vv+sO4XeCqv0Fq698ep4wj4A1ajjxqSST3RyKwr/im4=";
  };

-  cargoHash = "sha256-Brj+9AS0ZR/b188jkJa84WRHk0HtiKpMlyMUSLmzBfA=";
+  cargoHash = "sha256-IpGrImZbdckWgUVBpYpEt0XaM7LJxSOMo792mw8AA8A=";

  checkFlags = [
    # assertion failed: result.is_ok()
@@ -11,14 +11,14 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "chipsec";
-  version = "1.13.19";
+  version = "1.13.20";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "chipsec";
    repo = "chipsec";
    tag = version;
-    hash = "sha256-QJDoUnmZhKimgVnKCarc70b1OZAF3uIKqefuXjD7dOg=";
+    hash = "sha256-TSw/1NdPGefWXRMleXTeLWDgRw/m+luIQ0lF8UlgfLs=";
  };

  patches = [
@@ -11,14 +11,14 @@

 python3Packages.buildPythonApplication {
  pname = "chirp";
-  version = "0.4.0-unstable-2026-01-22";
+  version = "0.4.0-unstable-2026-02-01";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "kk7ds";
    repo = "chirp";
-    rev = "77a0299172e271fe62393f870d61f2033f201ca2";
-    hash = "sha256-4V7nFW4KhfxOFvjQllcE6YHNuUDiYDFvBrlZk5r5tUQ=";
+    rev = "52a3a4be4035fac1bec56ee6f20ae50ea15f8c31";
+    hash = "sha256-HrLOo9duWDOxoranH2fo9KVs3OIV0oHDvzEcWdwthTs=";
  };

  nativeBuildInputs = [
@@ -9,16 +9,16 @@
 }:
 rustPlatform.buildRustPackage rec {
  pname = "chirpstack-mqtt-forwarder";
-  version = "4.4.1";
+  version = "4.5.1";

  src = fetchFromGitHub {
    owner = "chirpstack";
    repo = "chirpstack-mqtt-forwarder";
    rev = "v${version}";
-    hash = "sha256-qkktkydg5Xe6q5IFalkxtGjO2zK9mZVMnKOBassiEtk=";
+    hash = "sha256-AFyvXLXGs1jeOJM8tSKBNbTVYr5SRUscqnUlSvU9iuA=";
  };

-  cargoHash = "sha256-rQPmFmra9Gd8XDP9HuTZZru780RmmqWEKX2iuuRkZQw=";
+  cargoHash = "sha256-mRmvKOqfzqUvPexRbd9TRS2lunpne7+wO57bsYZ3dXw=";

  nativeBuildInputs = [ protobuf ];

--- a/Show More
+++ b/Show More