Merge remote-tracking branch 'origin/master' into staging-next

2025-04-09 15:31:47 +03:00
parent c245ddff1e 289533171b
commit c41ad742f6
69 changed files with 2364 additions and 826 deletions
@@ -16465,6 +16465,12 @@
    githubId = 220262;
    name = "Ion Mudreac";
  };
+  MulliganSecurity = {
+    email = "mulligansecurity@riseup.net";
+    github = "MulliganSecurity";
+    githubId = 196982523;
+    name = "MulliganSecurity";
+  };
  multisn8 = {
    email = "all-things-nix@multisamplednight.com";
    github = "MultisampledNight";
@@ -16692,6 +16698,13 @@
    githubId = 17240342;
    name = "Nano Twerpus";
  };
+  nanoyaki = {
+    name = "Hana Kretzer";
+    email = "hanakretzer@gmail.com";
+    github = "nanoyaki";
+    githubId = 144328493;
+    keys = [ { fingerprint = "D89F 440C 6CD7 4753 090F  EC7A 4682 C5CB 4D9D EA3C"; } ];
+  };
  naphta = {
    github = "naphta";
    githubId = 6709831;
@@ -173,6 +173,8 @@

 - [nvidia-gpu](https://github.com/utkuozdemir/nvidia_gpu_exporter), a Prometheus exporter that scrapes `nvidia-smi` for GPU metrics. Available as [services.prometheus.exporters.nvidia-gpu](#opt-services.prometheus.exporters.nvidia-gpu.enable).

+- [Lavalink](https://github.com/lavalink-devs/Lavalink), a standalone audio sending node based on Lavaplayer and Koe. Availble as [services.lavalink](#opt-services.lavalink.enable).
+
 - [OpenGamepadUI](https://github.com/ShadowBlip/OpenGamepadUI/), an open source gamepad-native game launcher and overlay for Linux. Available as [programs.opengamepadui](#opt-programs.opengamepadui.enable).

 - [InputPlumber](https://github.com/ShadowBlip/InputPlumber/), an open source input router and remapper daemon for Linux. Available as [services.inputplumber](#opt-services.inputplumber.enable).
@@ -408,6 +408,7 @@
  ./services/audio/icecast.nix
  ./services/audio/jack.nix
  ./services/audio/jmusicbot.nix
+  ./services/audio/lavalink.nix
  ./services/audio/liquidsoap.nix
  ./services/audio/marytts.nix
  ./services/audio/mopidy.nix
@@ -0,0 +1,335 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+
+let
+  inherit (lib)
+    mkOption
+    mkEnableOption
+    mkIf
+    types
+    ;
+
+  cfg = config.services.lavalink;
+
+  format = pkgs.formats.yaml { };
+in
+
+{
+  options.services.lavalink = {
+    enable = mkEnableOption "Lavalink";
+
+    package = lib.mkPackageOption pkgs "lavalink" { };
+
+    password = mkOption {
+      type = types.nullOr types.str;
+      default = null;
+      example = "s3cRe!p4SsW0rD";
+      description = ''
+        The password for Lavalink's authentication in plain text.
+      '';
+    };
+
+    port = mkOption {
+      type = types.port;
+      default = 2333;
+      example = 4567;
+      description = ''
+        The port that Lavalink will use.
+      '';
+    };
+
+    address = mkOption {
+      type = types.str;
+      default = "0.0.0.0";
+      example = "127.0.0.1";
+      description = ''
+        The network address to bind to.
+      '';
+    };
+
+    openFirewall = mkOption {
+      type = types.bool;
+      default = false;
+      example = true;
+      description = ''
+        Whether to expose the port to the network.
+      '';
+    };
+
+    user = mkOption {
+      type = types.str;
+      default = "lavalink";
+      example = "root";
+      description = ''
+        The user of the service.
+      '';
+    };
+
+    group = mkOption {
+      type = types.str;
+      default = "lavalink";
+      example = "medias";
+      description = ''
+        The group of the service.
+      '';
+    };
+
+    home = mkOption {
+      type = types.str;
+      default = "/var/lib/lavalink";
+      example = "/home/lavalink";
+      description = ''
+        The home directory for lavalink.
+      '';
+    };
+
+    enableHttp2 = mkEnableOption "HTTP/2 support";
+
+    jvmArgs = mkOption {
+      type = types.str;
+      default = "-Xmx4G";
+      example = "-Djava.io.tmpdir=/var/lib/lavalink/tmp -Xmx6G";
+      description = ''
+        Set custom JVM arguments.
+      '';
+    };
+
+    environmentFile = mkOption {
+      type = types.nullOr types.str;
+      default = null;
+      example = "/run/secrets/lavalink/passwordEnvFile";
+      description = ''
+        Add custom environment variables from a file.
+        See <https://lavalink.dev/configuration/index.html#example-environment-variables> for the full documentation.
+      '';
+    };
+
+    plugins = mkOption {
+      type = types.listOf (
+        types.submodule {
+          options = {
+            dependency = mkOption {
+              type = types.str;
+              example = "dev.lavalink.youtube:youtube-plugin:1.8.0";
+              description = ''
+                The coordinates of the plugin.
+              '';
+            };
+
+            repository = mkOption {
+              type = types.str;
+              example = "https://maven.example.com/releases";
+              default = "https://maven.lavalink.dev/releases";
+              description = ''
+                The plugin repository. Defaults to the lavalink releases repository.
+
+                To use the snapshots repository, use <https://maven.lavalink.dev/snapshots> instead
+              '';
+            };
+
+            hash = mkOption {
+              type = types.str;
+              example = lib.fakeHash;
+              description = ''
+                The hash of the plugin.
+              '';
+            };
+
+            configName = mkOption {
+              type = types.nullOr types.str;
+              example = "youtube";
+              default = null;
+              description = ''
+                The name of the plugin to use as the key for the plugin configuration.
+              '';
+            };
+
+            extraConfig = mkOption {
+              type = types.submodule { freeformType = format.type; };
+              default = { };
+              description = ''
+                The configuration for the plugin.
+
+                The {option}`services.lavalink.plugins.*.configName` option must be set.
+              '';
+            };
+          };
+        }
+      );
+      default = [ ];
+
+      example = lib.literalExpression ''
+        [
+          {
+            dependency = "dev.lavalink.youtube:youtube-plugin:1.8.0";
+            repository = "https://maven.lavalink.dev/snapshots";
+            hash = lib.fakeHash;
+            configName = "youtube";
+            extraConfig = {
+              enabled = true;
+              allowSearch = true;
+              allowDirectVideoIds = true;
+              allowDirectPlaylistIds = true;
+            };
+          }
+        ]
+      '';
+
+      description = ''
+        A list of plugins for lavalink.
+      '';
+    };
+
+    extraConfig = mkOption {
+      type = types.submodule { freeformType = format.type; };
+
+      description = ''
+        Configuration to write to {file}`application.yml`.
+        See <https://lavalink.dev/configuration/#example-applicationyml> for the full documentation.
+
+        Individual configuration parameters can be overwritten using environment variables.
+        See <https://lavalink.dev/configuration/#example-environment-variables> for more information.
+      '';
+
+      default = { };
+
+      example = lib.literalExpression ''
+        {
+          lavalink.server = {
+            sources.twitch = true;
+
+            filters.volume = true;
+          };
+
+          logging.file.path = "./logs/";
+        }
+      '';
+    };
+  };
+
+  config =
+    let
+      pluginSymlinks = lib.concatStringsSep "\n" (
+        map (
+          pluginCfg:
+          let
+            pluginParts = lib.match ''^(.*?:(.*?):)([0-9]+\.[0-9]+\.[0-9]+)$'' pluginCfg.dependency;
+
+            pluginWebPath = lib.replaceStrings [ "." ":" ] [ "/" "/" ] (lib.elemAt pluginParts 0);
+
+            pluginFileName = lib.elemAt pluginParts 1;
+            pluginVersion = lib.elemAt pluginParts 2;
+
+            pluginFile = "${pluginFileName}-${pluginVersion}.jar";
+            pluginUrl = "${pluginCfg.repository}/${pluginWebPath}${pluginVersion}/${pluginFile}";
+
+            plugin = pkgs.fetchurl {
+              url = pluginUrl;
+              inherit (pluginCfg) hash;
+            };
+          in
+          "ln -sf ${plugin} ${cfg.home}/plugins/${pluginFile}"
+        ) cfg.plugins
+      );
+
+      pluginExtraConfigs = builtins.listToAttrs (
+        builtins.map (
+          pluginConfig: lib.attrsets.nameValuePair pluginConfig.configName pluginConfig.extraConfig
+        ) (lib.lists.filter (pluginCfg: pluginCfg.configName != null) cfg.plugins)
+      );
+
+      config = lib.attrsets.recursiveUpdate cfg.extraConfig {
+        server = {
+          inherit (cfg) port address;
+          http2.enabled = cfg.enableHttp2;
+        };
+
+        plugins = pluginExtraConfigs;
+        lavalink.plugins = (
+          builtins.map (
+            pluginConfig:
+            builtins.removeAttrs pluginConfig [
+              "name"
+              "extraConfig"
+              "hash"
+            ]
+          ) cfg.plugins
+        );
+      };
+
+      configWithPassword = lib.attrsets.recursiveUpdate config (
+        lib.attrsets.optionalAttrs (cfg.password != null) { lavalink.server.password = cfg.password; }
+      );
+
+      configFile = format.generate "application.yml" configWithPassword;
+    in
+    mkIf cfg.enable {
+      assertions = [
+        {
+          assertion =
+            !(lib.lists.any (
+              pluginCfg: pluginCfg.extraConfig != { } && pluginCfg.configName == null
+            ) cfg.plugins);
+          message = "Plugins with extra configuration need to have the `configName` attribute defined";
+        }
+      ];
+
+      networking.firewall.allowedTCPPorts = mkIf cfg.openFirewall [ cfg.port ];
+
+      users.groups = mkIf (cfg.group == "lavalink") { lavalink = { }; };
+      users.users = mkIf (cfg.user == "lavalink") {
+        lavalink = {
+          inherit (cfg) home;
+          group = "lavalink";
+          description = "The user for the Lavalink server";
+          isSystemUser = true;
+        };
+      };
+
+      systemd.tmpfiles.settings."10-lavalink" =
+        let
+          dirConfig = {
+            inherit (cfg) user group;
+            mode = "0700";
+          };
+        in
+        {
+          "${cfg.home}/plugins".d = mkIf (cfg.plugins != [ ]) dirConfig;
+          ${cfg.home}.d = dirConfig;
+        };
+
+      systemd.services.lavalink = {
+        description = "Lavalink Service";
+
+        wantedBy = [ "multi-user.target" ];
+        after = [
+          "syslog.target"
+          "network.target"
+        ];
+
+        script = ''
+          ${pluginSymlinks}
+
+          ln -sf ${configFile} ${cfg.home}/application.yml
+          export _JAVA_OPTIONS="${cfg.jvmArgs}"
+
+          ${lib.getExe cfg.package}
+        '';
+
+        serviceConfig = {
+          User = cfg.user;
+          Group = cfg.group;
+
+          Type = "simple";
+          Restart = "on-failure";
+
+          EnvironmentFile = cfg.environmentFile;
+          WorkingDirectory = cfg.home;
+        };
+      };
+    };
+}
@@ -339,7 +339,7 @@ let
            map (
              listen:
              {
-                port = cfg.defaultSSLListenPort;
+                port = if (hasPrefix "unix:" listen.addr) then null else cfg.defaultSSLListenPort;
                ssl = true;
              }
              // listen
@@ -351,7 +351,7 @@ let
            map (
              listen:
              {
-                port = cfg.defaultHTTPListenPort;
+                port = if (hasPrefix "unix:" listen.addr) then null else cfg.defaultHTTPListenPort;
                ssl = false;
              }
              // listen
@@ -56,6 +56,33 @@ in
        GZIP compression level of the resulting disk image (1-9).
      '';
    };
+
+    virtualisation.googleComputeImage.contents = mkOption {
+      type = with types; listOf attrs;
+      default = [ ];
+      description = ''
+        The files and directories to be placed in the image.
+        This is a list of attribute sets {source, target, mode, user, group} where
+        `source' is the file system object (regular file or directory) to be
+        grafted in the file system at path `target', `mode' is a string containing
+        the permissions that will be set (ex. "755"), `user' and `group' are the
+        user and group name that will be set as owner of the files.
+        `mode', `user', and `group' are optional.
+        When setting one of `user' or `group', the other needs to be set too.
+      '';
+      example = literalExpression ''
+        [
+          {
+            source = ./default.nix;
+            target = "/etc/nixos/default.nix";
+            mode = "0644";
+            user = "root";
+            group = "root";
+          }
+        ];
+      '';
+    };
+
    virtualisation.googleComputeImage.efi = mkEnableOption "EFI booting";
  };

@@ -99,6 +126,7 @@ in
      '';
      format = "raw";
      configFile = if cfg.configFile == null then defaultConfigFile else cfg.configFile;
+      inherit (cfg) contents;
      partitionTableType = if cfg.efi then "efi" else "legacy";
      inherit (config.virtualisation) diskSize;
      inherit config lib pkgs;
@@ -713,6 +713,7 @@ in
  languagetool = handleTest ./languagetool.nix { };
  lanraragi = handleTest ./lanraragi.nix { };
  latestKernel.login = handleTest ./login.nix { latestKernel = true; };
+  lavalink = runTest ./lavalink.nix;
  leaps = handleTest ./leaps.nix { };
  lemmy = handleTest ./lemmy.nix { };
  libinput = handleTest ./libinput.nix { };
@@ -0,0 +1,43 @@
+{ lib, ... }:
+
+let
+  password = "s3cRe!p4SsW0rD";
+in
+
+{
+  name = "lavalink";
+  meta.maintainers = with lib.maintainers; [ nanoyaki ];
+
+  nodes = {
+    machine = {
+      services.lavalink = {
+        enable = true;
+        port = 1234;
+        inherit password;
+      };
+    };
+    machine2 =
+      { pkgs, ... }:
+      {
+        services.lavalink = {
+          enable = true;
+          port = 1235;
+          environmentFile = "${pkgs.writeText "passwordEnvFile" ''
+            LAVALINK_SERVER_PASSWORD=${password}
+          ''}";
+        };
+      };
+  };
+
+  testScript = ''
+    start_all()
+
+    machine.wait_for_unit("lavalink.service")
+    machine.wait_for_open_port(1234)
+    machine.succeed("curl --header \"User-Id: 1204475253028429844\" --header \"Client-Name: shoukaku/4.1.1\" --header \"Authorization: ${password}\" http://localhost:1234/v4/info --fail -v")
+
+    machine2.wait_for_unit("lavalink.service")
+    machine2.wait_for_open_port(1235)
+    machine2.succeed("curl --header \"User-Id: 1204475253028429844\" --header \"Client-Name: shoukaku/4.1.1\" --header \"Authorization: ${password}\" http://localhost:1235/v4/info --fail -v")
+  '';
+}
@@ -1,5 +1,6 @@
 { ... }:
 let
+  defaultNginxSocketPath = "/var/run/nginx/default-test.sock";
  nginxSocketPath = "/var/run/nginx/test.sock";
 in
 {
@@ -11,6 +12,13 @@ in
      {
        services.nginx = {
          enable = true;
+
+          defaultListen = [ { addr = "unix:${defaultNginxSocketPath}"; } ];
+          virtualHosts.defaultLocalhost = {
+            serverName = "defaultLocalhost";
+            locations."/default".return = "200 'bar'";
+          };
+
          virtualHosts.localhost = {
            serverName = "localhost";
            listen = [ { addr = "unix:${nginxSocketPath}"; } ];
@@ -22,8 +30,10 @@ in

  testScript = ''
    webserver.wait_for_unit("nginx")
-    webserver.wait_for_open_unix_socket("${nginxSocketPath}")
+    webserver.wait_for_open_unix_socket("${defaultNginxSocketPath}", timeout=1)
+    webserver.wait_for_open_unix_socket("${nginxSocketPath}", timeout=1)

+    webserver.succeed("curl --fail --silent --unix-socket '${defaultNginxSocketPath}' http://defaultLocalhost/default | grep '^bar$'")
    webserver.succeed("curl --fail --silent --unix-socket '${nginxSocketPath}' http://localhost/test | grep '^foo$'")
  '';
 }
@@ -2127,8 +2127,8 @@ let
          publisher = "github";
          name = "copilot-chat";
          # Verify which version is available with nix run nixpkgs#vsce -- show github.copilot-chat --json
-          version = "0.26.2025030506"; # latest compatible with vscode ^1.98
-          hash = "sha256-mCmZs5xGxcqHyo8NyMjk2mu9LmxFlMb2NGUwjXg27JA=";
+          version = "0.26.2025040204"; # latest compatible with vscode ^1.98
+          hash = "sha256-grG/pn+R4paCqkSx6DGzKjyjQVZ2FINRxdpXynGF35g=";
        };
        meta = {
          description = "GitHub Copilot Chat is a companion extension to GitHub Copilot that houses experimental chat features";
@@ -286,8 +286,8 @@ stdenv.mkDerivation (

    passthru = {
      inherit pkgArches;
-      inherit (src) updateScript;
      tests = { inherit (nixosTests) wine; };
+      updateScript = src.updateScript or null;
    };
    meta = {
      inherit version;
@@ -301,9 +301,10 @@ stdenv.mkDerivation (
      inherit badPlatforms platforms;
      maintainers = with lib.maintainers; [
        avnik
-        raskin
        bendlas
        jmc-figueira
+        kira-bruneau
+        raskin
        reckenrode
      ];
      inherit mainProgram;
@@ -90,10 +90,18 @@ let
      }
    );

+  baseRelease =
+    {
+      staging = "unstable";
+      yabridge = "yabridge";
+    }
+    .${wineRelease} or null;
 in
-if wineRelease == "staging" then
+if baseRelease != null then
  callPackage ./staging.nix {
-    wineUnstable = wine-build wineBuild "unstable";
+    wineUnstable = (wine-build wineBuild baseRelease).override {
+      inherit wineRelease;
+    };
  }
 else
  wine-build wineBuild wineRelease
@@ -120,6 +120,18 @@ rec {
    hash = "sha256-wDbsHvR2dHdKX5lFgwIuni62j+j8GLOox55oWzvsibw=";
    inherit (stable) patches;

+    # see https://gitlab.winehq.org/wine/wine-staging
+    staging = fetchFromGitLab {
+      inherit version;
+      hash = "sha256-rXA/55rwQSJR247E4H7cQdTtXRmjomRbls7THV3jfcE=";
+      domain = "gitlab.winehq.org";
+      owner = "wine";
+      repo = "wine-staging";
+      rev = "v${version}";
+
+      disabledPatchsets = [ ];
+    };
+
    ## see http://wiki.winehq.org/Gecko
    gecko32 = fetchurl rec {
      version = "2.47.4";
@@ -147,8 +159,8 @@ rec {
      latest_mono=$(get_latest_lib_version wine-mono)

      update_staging() {
-          staging_url=$(get_source_attr staging.url)
-          set_source_attr staging hash "\"$(to_sri "$(nix-prefetch-url --unpack "''${staging_url//$1/$2}")")\""
+          staging_url=$(get_source_attr unstable.staging.url)
+          set_source_attr unstable.staging hash "\"$(to_sri "$(nix-prefetch-url --unpack "''${staging_url//$1/$2}")")\""
      }

      autobump unstable "$latest_unstable" "" update_staging
@@ -160,16 +172,43 @@ rec {
    '';
  };

-  staging = fetchFromGitLab rec {
-    # https://gitlab.winehq.org/wine/wine-staging
-    inherit (unstable) version;
-    hash = "sha256-rXA/55rwQSJR247E4H7cQdTtXRmjomRbls7THV3jfcE=";
-    domain = "gitlab.winehq.org";
-    owner = "wine";
-    repo = "wine-staging";
-    rev = "v${version}";
+  yabridge = fetchurl rec {
+    # NOTE: This is a pinned version with staging patches; don't forget to update them as well
+    version = "9.21";
+    url = "https://dl.winehq.org/wine/source/9.x/wine-${version}.tar.xz";
+    hash = "sha256-REK0f/2bLqRXEA427V/U5vTYKdnbeaJeYFF1qYjKL/8=";
+    inherit (stable) patches;

-    disabledPatchsets = [ ];
+    # see https://gitlab.winehq.org/wine/wine-staging
+    staging = fetchFromGitLab {
+      inherit version;
+      hash = "sha256-FDNszRUvM1ewE9Ij4EkuihaX0Hf0eTb5r7KQHMdCX3U=";
+      domain = "gitlab.winehq.org";
+      owner = "wine";
+      repo = "wine-staging";
+      rev = "v${version}";
+
+      disabledPatchsets = [ ];
+    };
+
+    ## see http://wiki.winehq.org/Gecko
+    gecko32 = fetchurl rec {
+      version = "2.47.4";
+      url = "https://dl.winehq.org/wine/wine-gecko/${version}/wine-gecko-${version}-x86.msi";
+      hash = "sha256-Js7MR3BrCRkI9/gUvdsHTGG+uAYzGOnvxaf3iYV3k9Y=";
+    };
+    gecko64 = fetchurl rec {
+      version = "2.47.4";
+      url = "https://dl.winehq.org/wine/wine-gecko/${version}/wine-gecko-${version}-x86_64.msi";
+      hash = "sha256-5ZC32YijLWqkzx2Ko6o9M3Zv3Uz0yJwtzCCV7LKNBm8=";
+    };
+
+    ## see http://wiki.winehq.org/Mono
+    mono = fetchurl rec {
+      version = "9.3.0";
+      url = "https://dl.winehq.org/wine/wine-mono/${version}/wine-mono-${version}-x86.msi";
+      hash = "sha256-bKLArtCW/57CD69et2xrfX3oLZqIdax92fB5O/nD/TA=";
+    };
  };

  wayland = pkgs.lib.warnOnInstantiate "building wine with `wineRelease = \"wayland\"` is deprecated. Wine now builds with the wayland driver by default." stable; # added 2025-01-23
@@ -13,12 +13,12 @@
 with callPackage ./util.nix { };

 let
-  patch = (callPackage ./sources.nix { }).staging;
+  patch = wineUnstable.src.staging;
  build-inputs = pkgNames: extra: (mkBuildInputs wineUnstable.pkgArches pkgNames) ++ extra;
 in
 assert lib.versions.majorMinor wineUnstable.version == lib.versions.majorMinor patch.version;

-(wineUnstable.override { wineRelease = "staging"; }).overrideAttrs (self: {
+wineUnstable.overrideAttrs (self: {
  buildInputs = build-inputs (
    [
      "perl"
@@ -9,10 +9,10 @@

 buildMozillaMach rec {
  pname = "firefox";
-  version = "137.0";
+  version = "137.0.1";
  src = fetchurl {
    url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "81a2c0cc14ffc2e49e49379e6c2ab56cfb6e13b66666a64f3abff44a43bb2e7dc17274d325d1c20af062d40bff8063d788d4b2f931a7a646db8b07204ca6b481";
+    sha512 = "cc2cbe3dd65696849c1b197b908887c111083fa8b5089aa4eae6f33ee404db29c566619c48b77fb495ad7f9dc94a2d9d910e5b2aaf8644db1d00368091f9dcb6";
  };

  meta = {
@@ -14,13 +14,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "albert";
-  version = "0.27.5";
+  version = "0.27.8";

  src = fetchFromGitHub {
    owner = "albertlauncher";
    repo = "albert";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-rdBNh9TICeOpglaJ5OJbE/f4W/UPqCkhp8H/H2OBTRM=";
+    hash = "sha256-UZJS61YeieA68PUNgudpjn1iWHCTvhXpt3uXJAkJtCg=";
    fetchSubmodules = true;
  };

@@ -30,7 +30,7 @@ let
    homepage = "https://goauthentik.io/";
    license = licenses.mit;
    platforms = platforms.linux;
-    broken = stdenvNoCC.hostPlatform.isAarch64;
+    broken = stdenvNoCC.buildPlatform != stdenvNoCC.hostPlatform;
    maintainers = with maintainers; [
      jvanbruegge
      risson
@@ -44,7 +44,7 @@ let

    sourceRoot = "source/website";

-    outputHash = "sha256-GIFz1ku0bS/GaWehOp2z9Te9qpWt61DQrw0LA+z/XCk=";
+    outputHash = "sha256-lPpphGi8l2X/fR9YoJv37piAe82oqSLAKHze8oTrGNc=";
    outputHashMode = "recursive";

    nativeBuildInputs = [
@@ -54,7 +54,7 @@ let

    buildPhase = ''
      npm ci --cache ./cache
-      rm -r ./cache
+      rm -r ./cache node_modules/@parcel/watcher-linux-* node_modules/.package-lock.json
    '';

    installPhase = ''
@@ -28,13 +28,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "bcachefs-tools";
-  version = "1.20.0";
+  version = "1.25.1";

  src = fetchFromGitHub {
    owner = "koverstreet";
    repo = "bcachefs-tools";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-WZmT8qYLQBp0lftm4T6BU92xffGmhniQNP7TI5pl4Y8=";
+    hash = "sha256-P6h0n90akgGoFL292UpYTspq1QjcnBDjwvSGyO91xQg=";
  };

  nativeBuildInputs = [
@@ -63,7 +63,7 @@ stdenv.mkDerivation (finalAttrs: {

  cargoDeps = rustPlatform.fetchCargoVendor {
    src = finalAttrs.src;
-    hash = "sha256-xP3V3Cqb+F33I1fVhp7ru/qBl22ww4oZDUCb1OHBiag=";
+    hash = "sha256-juXRmI3tz2BXQsRaRRGyBaGqeLk2QHfJb2sKPmWur8s=";
  };

  makeFlags = [
@@ -8,15 +8,15 @@

 rustPlatform.buildRustPackage rec {
  pname = "cargo-tally";
-  version = "1.0.61";
+  version = "1.0.62";

  src = fetchCrate {
    inherit pname version;
-    hash = "sha256-54Hu7n5KD41aywL8IqhO0k7aR0N7yi3QNNTX1sqvGvE=";
+    hash = "sha256-EZvwjxIw6ixaSvHod7l9178D7MRTk4MrWHPxy+UCgf4=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-1Grjj2uaEjr2YKvkd8cxJfUpR8OYqmtuSvIW4tSdIyM=";
+  cargoHash = "sha256-aSOEaHlUeP8D0GDdI6iLnuRHFasTt1nM6EGzYxhIPvo=";

  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin (
    with darwin.apple_sdk_11_0.frameworks;
@@ -8,17 +8,17 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "clorinde";
-  version = "0.14.2";
+  version = "0.14.3";

  src = fetchFromGitHub {
    owner = "halcyonnouveau";
    repo = "clorinde";
    tag = "clorinde-v${finalAttrs.version}";
-    hash = "sha256-zl4LSDxbvzmfigMCTvaoF1vGbWj/Obce4aHpM0rPqxM=";
+    hash = "sha256-dMTYYvxqy3ev6TSOyOer23twmtT7g7ZOh2vFD67wy9c=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-05sN5MkwBhpdmVcz0OUwx7h2ZJBjZefj8B9dLvkPZLw=";
+  cargoHash = "sha256-lJqg20NVZHTOsQplg6vsB4pa2ltsFBFBs//YkOkfBm4=";

  cargoBuildFlags = [ "--package=clorinde" ];

@@ -0,0 +1,78 @@
+diff --git a/tests/integration/CMakeLists.txt b/tests/integration/CMakeLists.txt
+index 623102952bfa..c193d6e405fa 100644
+--- a/tests/integration/CMakeLists.txt
+++ b/tests/integration/CMakeLists.txt
+@@ -74,11 +74,6 @@ if(TARGET dart-utils)
+ endif()
+ 
+ if(TARGET dart-utils-urdf)
+-  if(NOT MSVC)
+-    dart_add_test("integration" test_DartLoader)
+-    target_link_libraries(test_DartLoader dart-utils-urdf)
+-  endif()
+-
+   dart_add_library(SharedLibraryWamIkFast SharedLibraryWamIkFast.hpp SharedLibraryWamIkFast.cpp)
+   target_link_libraries(SharedLibraryWamIkFast PUBLIC dart)
+   target_compile_definitions(SharedLibraryWamIkFast PUBLIC IKFAST_NO_MAIN IKFAST_CLIBRARY)
+@@ -88,12 +83,6 @@ if(TARGET dart-utils-urdf)
+   target_link_libraries(GeneratedWamIkFast PUBLIC dart)
+   target_compile_definitions(GeneratedWamIkFast PUBLIC IKFAST_NO_MAIN IKFAST_CLIBRARY)
+   target_compile_options(GeneratedWamIkFast PRIVATE -w)
+-
+-  if(BUILD_SHARED_LIBS)
+-    dart_add_test("integration" test_IkFast)
+-    target_link_libraries(test_IkFast dart-utils-urdf)
+-    add_dependencies(test_IkFast GeneratedWamIkFast SharedLibraryWamIkFast)
+-  endif()
+ endif()
+ 
+ dart_format_add(
+@@ -117,24 +106,8 @@ if(TARGET dart-collision-bullet)
+   target_link_libraries(test_Raycast dart-collision-bullet)
+ endif()
+ 
+-if(TARGET dart-collision-ode)
+-  # This test doesn't work with FCL because it converts simple shapes to meshes, which makes
+-  # it difficult to come up with correct test expectations.
+-  dart_add_test("integration" test_ForceDependentSlip)
+-  target_link_libraries(test_ForceDependentSlip dart-collision-ode)
+-endif()
+-
+ if(TARGET dart-utils)
+ 
+-  dart_add_test("integration" test_Collision)
+-  target_link_libraries(test_Collision dart-utils)
+-  if(TARGET dart-collision-bullet)
+-    target_link_libraries(test_Collision dart-collision-bullet)
+-  endif()
+-  if(TARGET dart-collision-ode)
+-    target_link_libraries(test_Collision dart-collision-ode)
+-  endif()
+-
+   dart_add_test("integration" test_Dynamics)
+   target_link_libraries(test_Dynamics dart-utils)
+ 
+@@ -159,9 +132,4 @@ if(TARGET dart-utils)
+     target_link_libraries(test_World dart-collision-bullet)
+   endif()
+ 
+-  if(TARGET dart-utils-urdf)
+-    dart_add_test("integration" test_ForwardKinematics)
+-    target_link_libraries(test_ForwardKinematics dart-utils-urdf)
+-  endif()
+-
+ endif()
+diff --git a/tests/regression/CMakeLists.txt b/tests/regression/CMakeLists.txt
+index e0dd73c6a461..fa3f7c61c7b0 100644
+--- a/tests/regression/CMakeLists.txt
+++ b/tests/regression/CMakeLists.txt
+@@ -12,9 +12,6 @@ endif()
+ 
+ if(TARGET dart-utils-urdf)
+ 
+-  dart_add_test("regression" test_Issue838)
+-  target_link_libraries(test_Issue838 dart-utils-urdf)
+-
+   dart_add_test("regression" test_Issue892)
+ 
+   dart_add_test("regression" test_Issue895)
@@ -0,0 +1,154 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+
+  pythonSupport ? false,
+  python3Packages,
+
+  # nativeBuildInputs
+  cmake,
+  pkg-config,
+
+  # propagatedBuildInputs
+  assimp,
+  blas,
+  boost,
+  bullet,
+  eigen,
+  fcl,
+  fmt,
+  libglut,
+  nlopt,
+  imgui,
+  ipopt,
+  lapack,
+  libGL,
+  libGLU,
+  ode,
+  openscenegraph,
+  pagmo2,
+  tinyxml-2,
+  urdfdom,
+
+  # checkInputs
+  gbenchmark,
+  gtest,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "dartsim";
+  version = "6.15.0";
+
+  src = fetchFromGitHub {
+    owner = "dartsim";
+    repo = "dart";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-ik6FwrN5Ta1LinrXpZZc7AmzdFPoLjG07/zo1IZdmgI=";
+  };
+
+  # disable failing tests. CMAKE_CTEST_ARGUMENTS does not work.
+  patches = [ ./disable-failing-tests.patch ];
+
+  postPatch = ''
+    # https://github.com/dartsim/dart/pull/1904, merged upstream
+    substituteInPlace tests/benchmark/CMakeLists.txt \
+      --replace-fail \
+        "FetchContent_MakeAvailable(benchmark)" \
+        "find_package(benchmark REQUIRED)"
+
+    # https://github.com/dartsim/dart/pull/1907, merged upstream
+    substituteInPlace python/CMakeLists.txt \
+      --replace-fail \
+        "FetchContent_MakeAvailable(pybind11)" \
+        "find_package(pybind11 CONFIG REQUIRED)"
+
+    # fix use of absolute CMake paths in .pc
+    substituteInPlace CMakeLists.txt \
+      --replace-fail \
+        "$""{CMAKE_INSTALL_PREFIX}/$""{CMAKE_INSTALL_LIBDIR}" \
+        "$""{CMAKE_INSTALL_LIBDIR}"
+    substituteInPlace cmake/dart.pc.in \
+      --replace-fail \
+        "libdir=$""{prefix}/" \
+        "libdir=" \
+      --replace-fail \
+        "includedir=$""{prefix}/" \
+        "includedir="
+
+    # install python bindings
+    substituteInPlace python/dartpy/CMakeLists.txt \
+      --replace-fail \
+        "EXCLUDE_FROM_ALL" \
+        ""
+    echo "install(TARGETS $""{pybind_module} DESTINATION ${python3Packages.python.sitePackages})" \
+      >> python/dartpy/CMakeLists.txt
+  '';
+
+  nativeBuildInputs =
+    [
+      cmake
+      pkg-config
+    ]
+    ++ lib.optionals pythonSupport [
+      python3Packages.python
+      python3Packages.pybind11
+    ];
+
+  propagatedBuildInputs =
+    [
+      blas
+      boost
+      assimp
+      bullet
+      eigen
+      fcl
+      fmt
+      libglut
+      gbenchmark
+      nlopt
+      # requires imgui_impl_opengl2.h
+      (imgui.override { IMGUI_BUILD_OPENGL2_BINDING = true; })
+      ipopt
+      lapack
+      libGL
+      libGLU
+      ode
+      openscenegraph
+      pagmo2
+      tinyxml-2
+      urdfdom
+    ]
+    ++ lib.optionals pythonSupport [
+      python3Packages.numpy
+    ];
+
+  checkInputs = [
+    gbenchmark
+    gtest
+  ];
+  nativeCheckInputs = lib.optionals pythonSupport [
+    python3Packages.pytest
+    python3Packages.pythonImportsCheckHook
+  ];
+  doCheck = true;
+  # build unit tests
+  preCheck = "make tests";
+  pythonImportsCheck = [ "dartpy" ];
+
+  cmakeFlags = [
+    (lib.cmakeBool "DART_BUILD_DARTPY" pythonSupport)
+    (lib.cmakeBool "DART_USE_SYSTEM_IMGUI" true)
+    (lib.cmakeBool "DART_USE_SYSTEM_GOOGLEBENCHMARK" true)
+    (lib.cmakeBool "DART_USE_SYSTEM_GOOGLETEST" true)
+  ];
+
+  meta = {
+    description = "DART: Dynamic Animation and Robotics Toolkit";
+    homepage = "https://github.com/dartsim/dart";
+    changelog = "https://github.com/dartsim/dart/blob/v${finalAttrs.version}/CHANGELOG.md";
+    license = lib.licenses.bsd2;
+    maintainers = with lib.maintainers; [ nim65s ];
+    platforms = lib.platforms.unix ++ lib.platforms.windows;
+  };
+})
@@ -44,7 +44,7 @@ stdenv.mkDerivation {
    [
      graphene
      gtk3
-      libxml2
+      (libxml2.override { zlibSupport = true; })
      python3
      poppler
    ]
@@ -9,13 +9,13 @@

 buildGoModule rec {
  pname = "distribution";
-  version = "3.0.0-rc.4";
+  version = "3.0.0";

  src = fetchFromGitHub {
    owner = "distribution";
    repo = "distribution";
    tag = "v${version}";
-    hash = "sha256-aDvcwsA1J1S7haNGvb2PikN51PpDqM93NJQKRH/acwM=";
+    hash = "sha256-myezQTEdH7kkpCoAeZMf5OBxT4Bz8Qx6vCnwim230RY=";
  };

  vendorHash = null;
@@ -22,13 +22,13 @@

 buildGoModule rec {
  pname = "ecapture";
-  version = "1.0.0";
+  version = "1.0.1";

  src = fetchFromGitHub {
    owner = "gojue";
    repo = "ecapture";
    tag = "v${version}";
-    hash = "sha256-z2cl3yUNUQhLT9bPWApABUIRNdbYqG/7QDwRTvCWvjY=";
+    hash = "sha256-ZBuilCZKKc2jCLvpvESgJ2vC6awJiImoqTjospoxJdw=";
    fetchSubmodules = true;
  };

@@ -0,0 +1,51 @@
+{
+  lib,
+  fetchFromGitHub,
+  buildGoModule,
+  versionCheckHook,
+  nix-update-script,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "emcee";
+  version = "0.4.5";
+
+  src = fetchFromGitHub {
+    owner = "loopwork-ai";
+    repo = "emcee";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-qiH9Om1ChuMpU3CFQkOdJj1uITSI7hojRtXkRF9GSC0=";
+  };
+
+  vendorHash = "sha256-TU6Z06b+ZkiaK2ArNKIhHMwBludThpSo4RLZO/sirK4=";
+
+  ldflags = [
+    "-X main.version=${finalAttrs.version}"
+  ];
+
+  __darwinAllowLocalNetworking = true;
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+
+  versionCheckProgramArg = [ "--version" ];
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Connect agents to APIs";
+    longDescription = ''
+      emcee is a tool that provides a Model Context Protocol (MCP) server
+      for any web application with an OpenAPI specification.
+      You can use emcee to connect Claude Desktop
+      and other apps to external tools and data services, similar to ChatGPT plugins.
+    '';
+    homepage = "https://github.com/loopwork-ai/emcee";
+    changelog = "https://github.com/loopwork-ai/emcee/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ genga898 ];
+    mainProgram = "emcee";
+  };
+})
@@ -119,6 +119,7 @@ stdenv.mkDerivation (finalAttrs: {
      openssl
      pam
      pcre2
+      protobufc
      python3
      readline
      rtrlib
@@ -107,7 +107,7 @@ class Repo:
        )

    def flatten_repr(self) -> dict:
-        return {"fetcher": self.fetcher, "attrs": {**({"hash": self.hash} if hasattr(self, "hash") else {}), **self.args}}
+        return {"fetcher": self.fetcher, "args": {**({"hash": self.hash} if hasattr(self, "hash") else {}), **self.args}}

    def flatten(self, path: str) -> dict:
        out = {path: self.flatten_repr()}
@@ -171,11 +171,11 @@ let

  linux = stdenv.mkDerivation (finalAttrs: {
    inherit pname meta passthru;
-    version = "135.0.7049.52";
+    version = "135.0.7049.84";

    src = fetchurl {
      url = "https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-stable/google-chrome-stable_${finalAttrs.version}-1_amd64.deb";
-      hash = "sha256-SLRwm6XKgnM1xUhs8nVyUCSFhq3yH3fHoN2h8d2gpto=";
+      hash = "sha256-ZygM2YuML23KPJQ8Kl5f2YqI+0vbXnC3fYk8l8R/nXk=";
    };

    # With strictDeps on, some shebangs were not being patched correctly
@@ -274,11 +274,11 @@ let

  darwin = stdenvNoCC.mkDerivation (finalAttrs: {
    inherit pname meta passthru;
-    version = "135.0.7049.42";
+    version = "135.0.7049.85";

    src = fetchurl {
-      url = "http://dl.google.com/release2/chrome/acq3myotpqwugwaz3epmxxnjty3q_135.0.7049.42/GoogleChrome-135.0.7049.42.dmg";
-      hash = "sha256-/m05H4iD32Ro89J9NslEfGh8LMjQYAL989SenKxFNMM=";
+      url = "http://dl.google.com/release2/chrome/adtorua7m5iaphuubpwxkpgb7qwa_135.0.7049.85/GoogleChrome-135.0.7049.85.dmg";
+      hash = "sha256-NvCVflxCbMyx4wnbg+3IlO01xZuvzKAVPgg/S629Xls=";
    };

    dontPatch = true;
@@ -1,10 +1,8 @@
 {
  lib,
-  stdenv,
  fetchFromGitHub,
  rustPlatform,
  pkg-config,
-  Security,
  openssl,
 }:

@@ -26,19 +24,15 @@ rustPlatform.buildRustPackage rec {
    pkg-config
  ];

-  buildInputs =
-    [
-      openssl
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Security
-    ];
+  buildInputs = [
+    openssl
+  ];

-  meta = with lib; {
+  meta = {
    description = "Tool to convert Hikvision camera events to MQTT";
    homepage = "https://github.com/CornerBit/HikSink";
-    license = with licenses; [ mit ];
-    maintainers = with maintainers; [ fab ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fab ];
    mainProgram = "hik_sink";
  };
 }
@@ -0,0 +1,50 @@
+{
+  lib,
+  stdenv,
+  boost,
+  fetchFromGitHub,
+  openssl,
+  zlib,
+}:
+
+stdenv.mkDerivation {
+  pname = "i2pd-tools";
+  version = "2.56.0";
+
+  #tries to access the network during the tests, which fails
+
+  src = fetchFromGitHub {
+    owner = "PurpleI2P";
+    repo = "i2pd-tools";
+    rev = "33fce4b087d92ee90653460bbe7a07cdc0c7b121";
+    hash = "sha256-mmCs8AHHKhx1/rDp/Vc1p2W3pufoTa4FcJyJwD919zw=";
+    fetchSubmodules = true;
+  };
+
+  buildInputs = [
+    zlib
+    openssl
+    boost
+  ];
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+    for bin in \
+        routerinfo keygen vain keyinfo regaddr \
+        regaddr_3ld regaddralias x25519 famtool autoconf;
+    do
+      install -Dm755 $bin -t $out/bin
+    done
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Toolsuite to work with keys and eepsites";
+    homepage = "https://github.com/PurpleI2P/i2pd-tools";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ MulliganSecurity ];
+    mainProgram = "i2pd-tools";
+  };
+}
@@ -8,13 +8,13 @@

 buildGoModule rec {
  pname = "keep-sorted";
-  version = "0.6.0";
+  version = "0.6.1";

  src = fetchFromGitHub {
    owner = "google";
    repo = "keep-sorted";
    tag = "v${version}";
-    hash = "sha256-ROvj7w8YMq6+ntx0SWi+HfN4sO6d7RjKWwlb/9gfz8w=";
+    hash = "sha256-N/fJ0qj7/kQ9Q7ULpQpyhWAWFlnLkTjyNNKg8VhLvi0=";
  };

  vendorHash = "sha256-HTE9vfjRmi5GpMue7lUfd0jmssPgSOljbfPbya4uGsc=";
@@ -0,0 +1,52 @@
+{
+  lib,
+  stdenv,
+  makeWrapper,
+  jdk21,
+  jdk ? jdk21,
+  fetchurl,
+  nixosTests,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "lavalink";
+  version = "4.0.8";
+
+  src = fetchurl {
+    url = "https://github.com/lavalink-devs/Lavalink/releases/download/${finalAttrs.version}/Lavalink.jar";
+    hash = "sha256-G4a9ltPq/L0vcazTQjStTlOOtwrBi37bYUNQHy5CV9Y=";
+  };
+
+  nativeBuildInputs = [
+    makeWrapper
+  ];
+
+  dontUnpack = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    makeWrapper ${lib.getExe jdk} $out/bin/lavalink \
+      --add-flags "-jar $src"
+
+    runHook postInstall
+  '';
+
+  passthru.tests = { inherit (nixosTests) lavalink; };
+
+  meta = {
+    description = "Standalone audio sending node based on Lavaplayer and Koe";
+    longDescription = ''
+      A standalone audio sending node based on Lavaplayer and Koe. Allows for sending audio without it ever reaching any of your shards.
+
+      Being used in production by FredBoat, Dyno, LewdBot, and more.
+    '';
+    homepage = "https://lavalink.dev/";
+    changelog = "https://github.com/lavalink-devs/Lavalink/releases/tag/${finalAttrs.version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ nanoyaki ];
+    sourceProvenance = [ lib.sourceTypes.binaryBytecode ];
+    mainProgram = "lavalink";
+    inherit (jdk.meta) platforms;
+  };
+})
@@ -6,12 +6,12 @@

 python3.pkgs.buildPythonPackage rec {
  pname = "ledfx";
-  version = "2.0.105";
+  version = "2.0.108";
  pyproject = true;

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-S/ZlEFgcFiLr0V7g0X0bjWU0YNVzA0JctFaJTK/QkpI=";
+    hash = "sha256-wfp6u2YIliufjkaLBlLVFw2/dqpHYFAfcow4iyOB2ME=";
  };

  pythonRelaxDeps = true;
@@ -23,7 +23,7 @@ python3.pkgs.buildPythonPackage rec {

  build-system = with python3.pkgs; [
    cython
-    poetry-core
+    pdm-backend
  ];

  dependencies = with python3.pkgs; [
@@ -20,6 +20,7 @@
  rustPlatform,
  rustc,
  libunistring,
+  prqlSupport ? stdenv.hostPlatform == stdenv.buildPlatform,
 }:

 stdenv.mkDerivation (finalAttrs: {
@@ -41,16 +42,19 @@ stdenv.mkDerivation (finalAttrs: {

  depsBuildBuild = [ buildPackages.stdenv.cc ];

-  nativeBuildInputs = [
-    autoconf
-    automake
-    zlib
-    curl.dev
-    re2c
-    cargo
-    rustPlatform.cargoSetupHook
-    rustc
-  ];
+  nativeBuildInputs =
+    [
+      autoconf
+      automake
+      zlib
+      curl.dev
+      re2c
+    ]
+    ++ lib.optionals prqlSupport [
+      cargo
+      rustPlatform.cargoSetupHook
+      rustc
+    ];

  buildInputs =
    [
@@ -7,11 +7,11 @@

 stdenv.mkDerivation rec {
  pname = "mlxbf-bootimages";
-  version = "4.8.0-13249";
+  version = "4.10.0-13520";

  src = fetchurl {
    url = "https://linux.mellanox.com/public/repo/bluefield/${version}/bootimages/prod/${pname}-signed_${version}_arm64.deb";
-    hash = "sha256-VwbngA2UpHtvhCmL21qrebVSNG6/4PbkhnVAmERpek0=";
+    hash = "sha256-lPclxhKmn1hvGXWI1A+Q1yXK7FZzKUcOtBoXG6KRsCA=";
  };

  nativeBuildInputs = [
@@ -8,13 +8,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "open62541pp";
-  version = "0.17.0";
+  version = "0.18.0";

  src = fetchFromGitHub {
    owner = "open62541pp";
    repo = "open62541pp";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-593UaEEqWaheqEBUl13ijuC25sNnuPe9a6gbBo7Zo+E=";
+    hash = "sha256-xFiL+biDETGNwWzbTcfAi3GF1Dj9vvXEj2wJ+GoFz1Q=";
  };

  cmakeFlags = [
@@ -8,13 +8,13 @@
  stdenv,
 }:
 let
-  version = "0.22.0";
+  version = "0.23.1";

  parca-src = fetchFromGitHub {
    owner = "parca-dev";
    repo = "parca";
    tag = "v${version}";
-    hash = "sha256-iuTlKUmugRum0qZRhuw0FR13iE2qrQegTgwpAvgJSXk=";
+    hash = "sha256-UCYBT+KegoXpMRMoA3iuX8WiXhkX43JVOmhHksH5Pwk=";
  };

  ui = stdenv.mkDerivation (finalAttrs: {
@@ -24,7 +24,7 @@ let

    pnpmDeps = pnpm_9.fetchDeps {
      inherit (finalAttrs) pname src version;
-      hash = "sha256-MVNO24Oksy/qRUmEUoWoviQEo6Eimb18ZnDj5Z1vJkY=";
+      hash = "sha256-MByoIJtynv38TFNVDdZWjkJJpABCjJU2wBrChxM2rdE=";
    };

    nativeBuildInputs = [
@@ -56,7 +56,7 @@ buildGoModule rec {
  pname = "parca";
  src = parca-src;

-  vendorHash = "sha256-fErrbi3iSJlkguqzL6nH+fzmjxhoYVl1qH7tqRR1F1A=";
+  vendorHash = "sha256-O7dzdMGZ1l+cmVA3svbh/Ig1SbXXiMwJ7TXmrT2IM+g=";

  ldflags = [
    "-X=main.version=${version}"
@@ -7,13 +7,13 @@

 stdenvNoCC.mkDerivation {
  pname = "roddhjav-apparmor-rules";
-  version = "0-unstable-2025-03-28";
+  version = "0-unstable-2025-04-07";

  src = fetchFromGitHub {
    owner = "roddhjav";
    repo = "apparmor.d";
-    rev = "fbb71fb47b39095365ebba057342a4b0330ac477";
-    hash = "sha256-h1AuaR1MTgRhk4K+dbq2GAtVch8kehFDRFHknQzK3fg=";
+    rev = "305c2e344fe3ed14d4166211e0d21728702d83bf";
+    hash = "sha256-KLyjjHahEbM3lOTPLqgT75mhyVWEXJSugraH7kzQDV8=";
  };

  dontConfigure = true;
@@ -72,14 +72,14 @@ let
  ];
 in
 stdenv.mkDerivation rec {
-  version = "4.4.1";
+  version = "4.5.0";
  pname = "sabnzbd";

  src = fetchFromGitHub {
    owner = "sabnzbd";
    repo = "sabnzbd";
    rev = version;
-    hash = "sha256-7CR2hn+mXd6eKoFjrapZuB+Fpfi1UWzTQK5DnP2303k=";
+    hash = "sha256-X/ovfhP6QZOmYEfX2YchGWjkLBYZXNFuefXQyzKIW5s=";
  };

  nativeBuildInputs = [ makeWrapper ];
@@ -62,13 +62,13 @@ in

 rustPlatform.buildRustPackage {
  pname = "servo";
-  version = "0-unstable-2025-03-29";
+  version = "0-unstable-2025-04-08";

  src = fetchFromGitHub {
    owner = "servo";
    repo = "servo";
-    rev = "5d1c64dba9cf3e65f770370eb17f00ad4114edce";
-    hash = "sha256-0DuS2WfgWgnxh5qDc/XNL28XxXKnYPQW7F2m4OlANck=";
+    rev = "4d4f94936f8859f039497df370083fd7ea35fb00";
+    hash = "sha256-SI3HnKuh6zD07D7SUswfehwXEFkuaZQkqipH0Rlj9Gg=";
    # Breaks reproducibility depending on whether the picked commit
    # has other ref-names or not, which may change over time, i.e. with
    # "ref-names: HEAD -> main" as long this commit is the branch HEAD
@@ -79,7 +79,7 @@ rustPlatform.buildRustPackage {
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-m6lsXHf7SIgbIt8RyhUkJpd1/nJQMSNRS9uTJ6th9ng=";
+  cargoHash = "sha256-toVo1QpeMeK8SoQaYU5d+VAd3s22iwRI4caJIpxPP6I=";

  # set `HOME` to a temp dir for write access
  # Fix invalid option errors during linking (https://github.com/mozilla/nixpkgs-mozilla/commit/c72ff151a3e25f14182569679ed4cd22ef352328)
@@ -5,11 +5,11 @@
 }:
 python3.pkgs.buildPythonApplication rec {
  pname = "seventeenlands";
-  version = "0.1.42";
+  version = "0.1.43";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-P/imV4vvyd6wgjqXzgfIAURFtFhLwX1eS8eiPl79oZk=";
+    hash = "sha256-oTF4dtMKhx2YR80goKTcyq2P0mxAKLE2Ze5HbMNvyGg=";
  };

  # No tests
@@ -22,6 +22,23 @@ let
  pnpm = pnpm_10;
  electron = electron_35;

+  nodeOS =
+    {
+      "linux" = "linux";
+      "darwin" = "darwin";
+    }
+    .${stdenv.hostPlatform.parsed.kernel.name}
+      or (throw "unsupported platform ${stdenv.hostPlatform.parsed.kernel.name}");
+
+  nodeArch =
+    {
+      # https://nodejs.org/api/os.html#osarch
+      "x86_64" = "x64";
+      "aarch64" = "arm64";
+    }
+    .${stdenv.hostPlatform.parsed.cpu.name}
+      or (throw "unsupported platform ${stdenv.hostPlatform.parsed.cpu.name}");
+
  electron-headers = runCommand "electron-headers" { } ''
    mkdir -p $out
    tar -C $out --strip-components=1 -xvf ${electron.headers}
@@ -29,7 +46,8 @@ let

  libsignal-node = callPackage ./libsignal-node.nix { inherit nodejs; };

-  ringrtc-bin = callPackage ./ringrtc-bin.nix { };
+  webrtc = callPackage ./webrtc.nix { };
+  ringrtc = callPackage ./ringrtc.nix { inherit webrtc; };

  # Noto Color Emoji PNG files for emoji replacement; see below.
  noto-fonts-color-emoji-png = noto-fonts-color-emoji.overrideAttrs (prevAttrs: {
@@ -145,12 +163,14 @@ stdenv.mkDerivation (finalAttrs: {
      die "libsignal-client version mismatch"
    fi

-    if [ "`jq -r '.dependencies."@signalapp/ringrtc"' < package.json`" != "${ringrtc-bin.version}" ]
+    if [ "`jq -r '.dependencies."@signalapp/ringrtc"' < package.json`" != "${ringrtc.version}" ]
    then
      die "ringrtc version mismatch"
    fi

-    cp -r ${ringrtc-bin} node_modules/@signalapp/ringrtc/build
+    mkdir -p node_modules/@signalapp/ringrtc/build
+    install -D ${ringrtc}/lib/libringrtc${stdenv.hostPlatform.extensions.library} \
+      node_modules/@signalapp/ringrtc/build/${nodeOS}/libringrtc-${nodeArch}.node

    rm -fr node_modules/@signalapp/libsignal-client/prebuilds
    cp -r ${libsignal-node}/lib node_modules/@signalapp/libsignal-client/prebuilds
@@ -218,7 +238,8 @@ stdenv.mkDerivation (finalAttrs: {
  passthru = {
    inherit
      libsignal-node
-      ringrtc-bin
+      ringrtc
+      webrtc
      sticker-creator
      ;
    tests.application-launch = nixosTests.signal-desktop;
@@ -1,27 +0,0 @@
-{
-  stdenv,
-  lib,
-  fetchzip,
-  autoPatchelfHook,
-  libpulseaudio,
-}:
-stdenv.mkDerivation (finalAttrs: {
-  pname = "ringrtc-bin";
-  version = "2.50.3";
-  src = fetchzip {
-    url = "https://build-artifacts.signal.org/libraries/ringrtc-desktop-build-v${finalAttrs.version}.tar.gz";
-    hash = "sha256-UJqH/UiT9j36r6fr673CP/Z4lGaSPXIzAkf72YZfExo=";
-  };
-
-  installPhase = ''
-    cp -r . $out
-  '';
-
-  nativeBuildInputs = [ autoPatchelfHook ];
-  buildInputs = [ libpulseaudio ];
-  meta = {
-    homepage = "https://github.com/signalapp/ringrtc";
-    license = lib.licenses.agpl3Only;
-    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
-  };
-})
@@ -0,0 +1,45 @@
+{
+  rustPlatform,
+  lib,
+  fetchFromGitHub,
+  cmake,
+  protobuf,
+  webrtc,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "ringrtc";
+  version = "2.50.3";
+
+  src = fetchFromGitHub {
+    owner = "signalapp";
+    repo = "ringrtc";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-EuryWZMMTkrDPheVv0wBsH+zL3LylxSSPS+nNnn3cmM=";
+  };
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-/c+tpTh5X05HLqAHsA/YvWxqy7TSUy49g6OtIQg+rMs=";
+
+  cargoBuildFlags = [
+    "-p"
+    "ringrtc"
+    "--features"
+    "electron"
+  ];
+  doCheck = false;
+
+  nativeBuildInputs = [
+    protobuf
+    cmake
+  ];
+  buildInputs = [
+    webrtc
+  ];
+
+  meta = {
+    homepage = "https://github.com/signalapp/ringrtc";
+    description = "RingRTC library used by Signal";
+    license = lib.licenses.agpl3Only;
+    platforms = lib.platforms.unix;
+  };
+})
@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p bash nix-update common-updater-scripts curl coreutils jq
+#!nix-shell -i bash -p bash nix-update common-updater-scripts curl coreutils jq gclient2nix

 set -ex

@@ -19,10 +19,12 @@ releaseEpoch=`date -d $releaseDate +%s`
 packageJson="`curl_github "https://raw.githubusercontent.com/signalapp/Signal-Desktop/refs/tags/$releaseTag/package.json"`"

 latestVersion="`jq -r '.version' <<< $packageJson`"
-nodeVersion="`jq -r '.engines.node' <<< $packageJson | head -c2`"
-electronVersion="`jq -r '.devDependencies.electron' <<< $packageJson | head -c2`"
+nodeVersion="`jq -r '.engines.node' <<< $packageJson | cut -d. -f1`"
+electronVersion="`jq -r '.devDependencies.electron' <<< $packageJson | cut -d. -f1`"
 libsignalClientVersion=`jq -r '.dependencies."@signalapp/libsignal-client"' <<< $packageJson`
 ringrtcVersion=`jq -r '.dependencies."@signalapp/ringrtc"' <<< $packageJson`
+ringrtcVersionProperties="`curl_github "https://raw.githubusercontent.com/signalapp/ringrtc/refs/tags/v$ringrtcVersion/config/version.properties"`"
+webrtcVersion="`grep --only-matching "^webrtc.version=.*$" <<< $ringrtcVersionProperties | sed "s/webrtc.version=//g"`"

 sed -E -i "s/(nodejs_)../\1$nodeVersion/" $SCRIPT_DIR/package.nix
 sed -E -i "s/(electron_)../\1$electronVersion/" $SCRIPT_DIR/package.nix
@@ -44,4 +46,9 @@ update-source-version signal-desktop-source.libsignal-node \
  --ignore-same-version \
  --source-key=npmDeps

-update-source-version signal-desktop-source.ringrtc-bin "$ringrtcVersion"
+update-source-version signal-desktop-source.ringrtc "$ringrtcVersion"
+update-source-version signal-desktop-source.ringrtc \
+  --ignore-same-version \
+  --source-key=cargoDeps.vendorStaging
+
+gclient2nix generate "https://github.com/signalapp/webrtc@$webrtcVersion" > $SCRIPT_DIR/webrtc-sources.json
@@ -0,0 +1,364 @@
+{
+    "src": {
+        "args": {
+            "hash": "sha256-xKv606lqGgC27sf5WVPxkVRI5wixmRxQvOs1+pgORxc=",
+            "owner": "signalapp",
+            "repo": "webrtc",
+            "rev": "6834g"
+        },
+        "fetcher": "fetchFromGitHub"
+    },
+    "src/base": {
+        "args": {
+            "hash": "sha256-1e9jieGg8q0jrVkxN5chnslHTVkuul6ZAkaNrphF75s=",
+            "rev": "69f3676cdbd05660c136a6cc3b23383cbabe53d8",
+            "url": "https://chromium.googlesource.com/chromium/src/base"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/build": {
+        "args": {
+            "hash": "sha256-Si7wgZ895XWALVdMLiKoACB8w6H5IUvpKIOdtasfbCs=",
+            "rev": "05874e6c9429039f1747034af61de1fe2ea1ed06",
+            "url": "https://chromium.googlesource.com/chromium/src/build"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/buildtools": {
+        "args": {
+            "hash": "sha256-XbY2NHW5twzMpACa689F0n3Pie2RJOFeu2JNOM1yERM=",
+            "rev": "db0eae9640184fb132061f248f6108771a6ea2d4",
+            "url": "https://chromium.googlesource.com/chromium/src/buildtools"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/ringrtc/opus/src": {
+        "args": {
+            "hash": "sha256-Vztq+Z388Welj2cfChumimfEXtVn4zCcrGBedZFoTmM=",
+            "owner": "xiph",
+            "repo": "opus",
+            "rev": "0e30966b198ad28943799eaf5b3b08100b6f70c3"
+        },
+        "fetcher": "fetchFromGitHub"
+    },
+    "src/testing": {
+        "args": {
+            "hash": "sha256-P8zXemUOv6dpElAW7zmiy6L26nPeQk7R08zqz3Iatls=",
+            "rev": "eac4c18f749488d7232af275405e0e1b67d84cb3",
+            "url": "https://chromium.googlesource.com/chromium/src/testing"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party": {
+        "args": {
+            "hash": "sha256-6Hhx+aLqZgs8/Ykn5YilzsRlqbh48Uj5W5rY5CBMwf8=",
+            "rev": "9d80a193fbfe8e2f2a29be2efeee93de9a826dcb",
+            "url": "https://chromium.googlesource.com/chromium/src/third_party"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/boringssl/src": {
+        "args": {
+            "hash": "sha256-glHy/C18/oHy77IUC9uHaMA9IhbcaO0X/Ek+RoFwZFg=",
+            "rev": "0fa9014d861f024e28fb491ed7b1cfd44103dee7",
+            "url": "https://boringssl.googlesource.com/boringssl.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/breakpad/breakpad": {
+        "args": {
+            "hash": "sha256-kTkwRfaqw5ZCHEvu2YPZ+1vCfekHkY5pY3m9snDN64g=",
+            "rev": "6b0c5b7ee1988a14a4af94564e8ae8bba8a94374",
+            "url": "https://chromium.googlesource.com/breakpad/breakpad.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/catapult": {
+        "args": {
+            "hash": "sha256-SkF+RIIlU8Vl3AmN6kARkLuVz/X5vygNOtGN2K3Sr+M=",
+            "rev": "44791916611acec1cd74c492c7453e46d9b0dbd2",
+            "url": "https://chromium.googlesource.com/catapult.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/ced/src": {
+        "args": {
+            "hash": "sha256-ySG74Rj2i2c/PltEgHVEDq+N8yd9gZmxNktc56zIUiY=",
+            "rev": "ba412eaaacd3186085babcd901679a48863c7dd5",
+            "url": "https://chromium.googlesource.com/external/github.com/google/compact_enc_det.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/clang-format/script": {
+        "args": {
+            "hash": "sha256-whD8isX2ZhLrFzdxHhFP1S/sZDRgyrzLFaVd7OEFqYo=",
+            "rev": "3c0acd2d4e73dd911309d9e970ba09d58bf23a62",
+            "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/clang/tools/clang-format.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/colorama/src": {
+        "args": {
+            "hash": "sha256-6ZTdPYSHdQOLYMSnE+Tp7PgsVTs3U2awGu9Qb4Rg/tk=",
+            "rev": "3de9f013df4b470069d03d250224062e8cf15c49",
+            "url": "https://chromium.googlesource.com/external/colorama.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/crc32c/src": {
+        "args": {
+            "hash": "sha256-KBraGaO5LmmPP+p8RuDogGldbTWdNDK+WzF4Q09keuE=",
+            "rev": "d3d60ac6e0f16780bcfcc825385e1d338801a558",
+            "url": "https://chromium.googlesource.com/external/github.com/google/crc32c.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/dav1d/libdav1d": {
+        "args": {
+            "hash": "sha256-FK3tOLq5NcKQuStY5o8Lv2CXpjYHJm7n+NnyLFMOCxo=",
+            "rev": "389450f61ea0b2057fc9ea393d3065859c4ba7f2",
+            "url": "https://chromium.googlesource.com/external/github.com/videolan/dav1d.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/depot_tools": {
+        "args": {
+            "hash": "sha256-vlBENaVTtbwDJtSswuszcUlx+icZYJeP6ew6MO1cAv0=",
+            "rev": "20b9bdcace7ed561d6a75728c85373503473cb6b",
+            "url": "https://chromium.googlesource.com/chromium/tools/depot_tools.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/ffmpeg": {
+        "args": {
+            "hash": "sha256-j5mpWn4j+U4rRlXbq8okUUXrRKycZkiV+UntiS90ChM=",
+            "rev": "686d6944501a6ee9c849581e3fe343273d4af3f6",
+            "url": "https://chromium.googlesource.com/chromium/third_party/ffmpeg.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/flatbuffers/src": {
+        "args": {
+            "hash": "sha256-tbc45o0MbMvK5XqRUJt5Eg8BU6+TJqlmwFgQhHq6wRM=",
+            "rev": "8db59321d9f02cdffa30126654059c7d02f70c32",
+            "url": "https://chromium.googlesource.com/external/github.com/google/flatbuffers.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/fontconfig/src": {
+        "args": {
+            "hash": "sha256-W5WIgC6A52kY4fNkbsDEa0o+dfd97Rl5NKfgnIRpI00=",
+            "rev": "14d466b30a8ab4a9d789977ed94f2c30e7209267",
+            "url": "https://chromium.googlesource.com/external/fontconfig.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/freetype/src": {
+        "args": {
+            "hash": "sha256-Lc2hbmZnnXQa0vzlJCizNBQ5WCOI5sJglTTe5gWVYUA=",
+            "rev": "f02bffad0fd57f3acfa835c3f2899c5b71ff8be0",
+            "url": "https://chromium.googlesource.com/chromium/src/third_party/freetype2.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/fuzztest/src": {
+        "args": {
+            "hash": "sha256-UYmzjOX8k+CWL+xOIF3NiEL3TRUjS8JflortB2RUT4o=",
+            "rev": "0021f30508bc7f73fa5270962d022acb480d242f",
+            "url": "https://chromium.googlesource.com/external/github.com/google/fuzztest.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/google_benchmark/src": {
+        "args": {
+            "hash": "sha256-gztnxui9Fe/FTieMjdvfJjWHjkImtlsHn6fM1FruyME=",
+            "rev": "344117638c8ff7e239044fd0fa7085839fc03021",
+            "url": "https://chromium.googlesource.com/external/github.com/google/benchmark.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/googletest/src": {
+        "args": {
+            "hash": "sha256-Iv/7r79cKC1pFkxPPHK/IHv/HFx18XZ4YVr+C2CX8+M=",
+            "rev": "62df7bdbc10887e094661e07ec2595b7920376fd",
+            "url": "https://chromium.googlesource.com/external/github.com/google/googletest.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/grpc/src": {
+        "args": {
+            "hash": "sha256-64JEVCx/PCM0dvv7kAQvSjLc0QbRAZVBDzwD/FAV6T8=",
+            "rev": "822dab21d9995c5cf942476b35ca12a1aa9d2737",
+            "url": "https://chromium.googlesource.com/external/github.com/grpc/grpc.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/gtest-parallel": {
+        "args": {
+            "hash": "sha256-VUuk5tBTh+aU2dxVWUF1FePWlKUJaWSiGSXk/J5zgHw=",
+            "rev": "96f4f904922f9bf66689e749c40f314845baaac8",
+            "url": "https://chromium.googlesource.com/external/github.com/google/gtest-parallel"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/harfbuzz-ng/src": {
+        "args": {
+            "hash": "sha256-iR49rfGDKxPObCff1/30hYHpP5FpZ28ROgMZhNk9eFY=",
+            "rev": "1da053e87f0487382404656edca98b85fe51f2fd",
+            "url": "https://chromium.googlesource.com/external/github.com/harfbuzz/harfbuzz.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/icu": {
+        "args": {
+            "hash": "sha256-7568UHNDOzyTCLy3TAwxZLUrKfB6A1yKA0wVZQJjKoI=",
+            "rev": "4239b1559d11d4fa66c100543eda4161e060311e",
+            "url": "https://chromium.googlesource.com/chromium/deps/icu.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/instrumented_libs": {
+        "args": {
+            "hash": "sha256-kHKGADAgzlaeckXFbpU1GhJK+zkiRd9XvdtPF6qrQFY=",
+            "rev": "bb6dbcf2df7a9beb34c3773ef4df161800e3aed9",
+            "url": "https://chromium.googlesource.com/chromium/third_party/instrumented_libraries.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/jsoncpp/source": {
+        "args": {
+            "hash": "sha256-bSLNcoYBz3QCt5VuTR056V9mU2PmBuYBa0W6hFg2m8Q=",
+            "rev": "42e892d96e47b1f6e29844cc705e148ec4856448",
+            "url": "https://chromium.googlesource.com/external/github.com/open-source-parsers/jsoncpp.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/libaom/source/libaom": {
+        "args": {
+            "hash": "sha256-2XHqNAmv2L3TEFXu4Q6rnASLmuE93QplSVKNqyhlKUk=",
+            "rev": "840f8797871cc587f7113ea9d2483a1156d57c0e",
+            "url": "https://aomedia.googlesource.com/aom.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/libc++/src": {
+        "args": {
+            "hash": "sha256-7skqaen0XqbRvAGXQ0/3kea3vRInktdP3DOBeIBiGlQ=",
+            "rev": "6a68fd412b9aecd515a20a7cf84d11b598bfaf96",
+            "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxx.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/libc++abi/src": {
+        "args": {
+            "hash": "sha256-zPm+Rif9fITazDvvm6SvLq8gwcPzPbuaXlRbyYqv7JA=",
+            "rev": "9a1d90c3b412d5ebeb97a6e33d98e1d0dd923221",
+            "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxxabi.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/libjpeg_turbo": {
+        "args": {
+            "hash": "sha256-qgHXAjCDFxQ+QqJ8pSmI1NUvHvKKTi4MkIe1I/+hUAI=",
+            "rev": "927aabfcd26897abb9776ecf2a6c38ea5bb52ab6",
+            "url": "https://chromium.googlesource.com/chromium/deps/libjpeg_turbo.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/libsrtp": {
+        "args": {
+            "hash": "sha256-4qEZ9MD97MoqCUlZtbEhIKy+fDO1iIWqyrBsKwkjXTg=",
+            "rev": "000edd791434c8738455f10e0dd6b268a4852c0b",
+            "url": "https://chromium.googlesource.com/chromium/deps/libsrtp.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/libunwind/src": {
+        "args": {
+            "hash": "sha256-0OBelaxkKdajYXrGgz08nyPZhxqpsnFXiF3m8DGQkDo=",
+            "rev": "efc3baa2d1ece3630fcfa72bef93ed831bcaec4c",
+            "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libunwind.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/libvpx/source/libvpx": {
+        "args": {
+            "hash": "sha256-7GInV/uHuK6bUa1dSBuxJn6adyjfoOqSqfmfTvQbAoc=",
+            "rev": "906334ac1de2b0afa666472dce5545b82c1251fb",
+            "url": "https://chromium.googlesource.com/webm/libvpx.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/libyuv": {
+        "args": {
+            "hash": "sha256-gTNmhYuYmt/JmWSAVbcE4PqG3kW/JaL7XEWXbiNVfMM=",
+            "rev": "a8e59d207483f75b87dd5fc670e937672cdf5776",
+            "url": "https://chromium.googlesource.com/libyuv/libyuv.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/llvm-libc/src": {
+        "args": {
+            "hash": "sha256-Q0Y/jvAOovOGYTgdDivVQD0CJciuEAt91DCBNNQHwnE=",
+            "rev": "98ed09318387deb45282ca1c92a384499860b76a",
+            "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libc.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/lss": {
+        "args": {
+            "hash": "sha256-hE8uZf9Fst66qJkoVYChiB8G41ie+k9M4X0W+5JUSdw=",
+            "rev": "ce877209e11aa69dcfffbd53ef90ea1d07136521",
+            "url": "https://chromium.googlesource.com/linux-syscall-support.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/nasm": {
+        "args": {
+            "hash": "sha256-SiRXHsUlWXtH6dbDjDjqNAm105ibEB3jOfNtQAM4CaY=",
+            "rev": "f477acb1049f5e043904b87b825c5915084a9a29",
+            "url": "https://chromium.googlesource.com/chromium/deps/nasm.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/openh264/src": {
+        "args": {
+            "hash": "sha256-S7dS2IZwt4p4ZrF6K7E5HnwKuI3owU2I7vwtu95uTkE=",
+            "rev": "478e5ab3eca30e600006d5a0a08b176fd34d3bd1",
+            "url": "https://chromium.googlesource.com/external/github.com/cisco/openh264"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/perfetto": {
+        "args": {
+            "hash": "sha256-WXBjGcWZQWrfSQRVv7NfxVv483cf04rNfmXzqyuy9bk=",
+            "rev": "e57316a6ae4e85e9bc8ba82a6c6a93eb5d9a72aa",
+            "url": "https://android.googlesource.com/platform/external/perfetto.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/protobuf-javascript/src": {
+        "args": {
+            "hash": "sha256-TmP6xftUVTD7yML7UEM/DB8bcsL5RFlKPyCpcboD86U=",
+            "rev": "e34549db516f8712f678fcd4bc411613b5cc5295",
+            "url": "https://chromium.googlesource.com/external/github.com/protocolbuffers/protobuf-javascript"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/re2/src": {
+        "args": {
+            "hash": "sha256-IeANwJlJl45yf8iu/AZNDoiyIvTCZIeK1b74sdCfAIc=",
+            "rev": "6dcd83d60f7944926bfd308cc13979fc53dd69ca",
+            "url": "https://chromium.googlesource.com/external/github.com/google/re2.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/tools": {
+        "args": {
+            "hash": "sha256-o4Q+uDF+TUDlu/bcjBEn3o3UuF5q9h1Vf/gx16bnlYs=",
+            "rev": "c809c4133185094fbd75508202221ff14fc92f7c",
+            "url": "https://chromium.googlesource.com/chromium/src/tools"
+        },
+        "fetcher": "fetchFromGitiles"
+    }
+}
@@ -0,0 +1,79 @@
+{
+  stdenv,
+  lib,
+  ninja,
+  gn,
+  python3,
+  pkg-config,
+  glib,
+  alsa-lib,
+  pulseaudio,
+  writeShellScriptBin,
+  gclient2nix,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "signal-webrtc";
+  version = finalAttrs.gclientDeps."src".path.rev;
+
+  gclientDeps = gclient2nix.importGclientDeps ./webrtc-sources.json;
+  sourceRoot = "src";
+
+  preConfigure = ''
+    echo "$SOURCE_DATE_EPOCH" > build/util/LASTCHANGE.committime
+    echo "generate_location_tags = true" >> build/config/gclient_args.gni
+    substituteInPlace build/toolchain/linux/BUILD.gn \
+      --replace-fail 'toolprefix = "aarch64-linux-gnu-"' 'toolprefix = ""'
+    patchShebangs build/mac/should_use_hermetic_xcode.py
+  '';
+
+  nativeBuildInputs = [
+    gn
+    ninja
+    (writeShellScriptBin "vpython3" ''
+      exec python3 "$@"
+    '')
+    python3
+    pkg-config
+    gclient2nix.gclientUnpackHook
+  ];
+
+  buildInputs = [
+    glib
+    alsa-lib
+    pulseaudio
+  ];
+
+  gnFlags = [
+    ''target_os="linux"''
+    "use_sysroot=false"
+    "is_clang=false"
+    "treat_warnings_as_errors=false"
+
+    # https://github.com/signalapp/ringrtc/blob/main/bin/build-electron
+    "rtc_build_examples=false"
+    "rtc_build_tools=false"
+    "rtc_use_x11=false"
+    "rtc_enable_sctp=false"
+    "rtc_libvpx_build_vp9=true"
+    "rtc_disable_metrics=true"
+    "rtc_disable_trace_events=true"
+    "is_debug=false"
+    "symbol_level=1"
+    "rtc_include_tests=false"
+    "rtc_enable_protobuf=false"
+  ];
+  ninjaFlags = [ "webrtc" ];
+
+  installPhase = ''
+    install -D obj/libwebrtc${stdenv.hostPlatform.extensions.staticLibrary} $out/lib/libwebrtc${stdenv.hostPlatform.extensions.staticLibrary}
+  '';
+
+  meta = {
+    description = "WebRTC library used by Signal";
+    homepage = "https://github.com/SignalApp/webrtc";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ ];
+    platforms = lib.platforms.linux;
+  };
+})
@@ -7,13 +7,13 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "signal-export";
-  version = "3.4.1";
+  version = "3.5.1";
  pyproject = true;

  src = fetchPypi {
    inherit version;
    pname = "signal_export";
-    hash = "sha256-EDRPaxan/41srlD7wxKqkeWgqwHXY8p5PHJ7xD2GiuU=";
+    hash = "sha256-UhLWSYdJEDhZ1zI3nxhJoqeH8JfR4s9Hdp6fJ4UNROQ=";
  };

  build-system = with python3.pkgs; [
@@ -0,0 +1,85 @@
+{
+  lib,
+  stdenv,
+
+  fetchFromGitHub,
+  fetchpatch,
+
+  # propagatedNativeBuildInputs
+  cmake,
+  qt6Packages,
+
+  # propagatedBuildInputs
+  boost,
+  cxxopts,
+  eigen,
+  glew,
+  gtest,
+  libGL,
+  metis,
+  tinyxml-2,
+  zlib,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "sofa";
+  version = "24.12.00";
+
+  src = fetchFromGitHub {
+    owner = "sofa-framework";
+    repo = "sofa";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-LeFIM1RJjA2ynimjE8XngOQ8gR7BgqqTZBbDp0KXxs0=";
+  };
+
+  patches = [
+    # Include missing header for setw / setfill.
+    # ref. https://github.com/sofa-framework/sofa/pull/5279
+    # This was merged upstream and can be removed in next version
+    (fetchpatch {
+      url = "https://github.com/sofa-framework/sofa/commit/700b6cdd94fe24a51b2a7014fb0fc83e6abe1fbc.patch";
+      hash = "sha256-czc1u03USQt18d7cMPmXYguBhSb5JOJLplPvoixp+3w=";
+    })
+  ];
+
+  propagatedNativeBuildInputs = [
+    cmake
+    qt6Packages.wrapQtAppsHook
+  ];
+  propagatedBuildInputs = [
+    boost
+    cxxopts
+    eigen
+    glew
+    gtest
+    qt6Packages.libqglviewer
+    qt6Packages.qtbase
+    libGL
+    metis
+    tinyxml-2
+    zlib
+  ];
+
+  cmakeFlags = [
+    (lib.cmakeBool "SOFA_ALLOW_FETCH_DEPENDENCIES" false)
+  ];
+
+  doCheck = true;
+
+  postFixup = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    install_name_tool -change \
+      $out/lib/libSceneChecking.${finalAttrs.version}.dylib \
+      $out/plugins/SceneChecking/lib/libSceneChecking.${finalAttrs.version}.dylib \
+      $out/bin/.runSofa-${finalAttrs.version}-wrapped
+  '';
+
+  meta = {
+    description = "Real-time multi-physics simulation with an emphasis on medical simulation";
+    homepage = "https://github.com/sofa-framework/sofa/";
+    changelog = "https://github.com/sofa-framework/sofa/blob/v${finalAttrs.version}/CHANGELOG.md";
+    license = lib.licenses.lgpl21Only;
+    maintainers = with lib.maintainers; [ nim65s ];
+    mainProgram = "runSofa";
+    platforms = lib.platforms.unix ++ lib.platforms.windows;
+  };
+})
@@ -9,13 +9,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "yarn-berry";
-  version = "4.8.0";
+  version = "4.8.1";

  src = fetchFromGitHub {
    owner = "yarnpkg";
    repo = "berry";
    tag = "@yarnpkg/cli/${finalAttrs.version}";
-    hash = "sha256-cNgR0t780/LJA+IIwycro/7AQjWa1tn00bh4ucPjVEc=";
+    hash = "sha256-JRQVUO5KsaGMmoC99cloW+hbFjgaFLNT3tqA29TVu34=";
  };

  buildInputs = [
@@ -28,13 +28,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "ctranslate2";
-  version = "4.5.0";
+  version = "4.6.0";

  src = fetchFromGitHub {
    owner = "OpenNMT";
    repo = "CTranslate2";
    rev = "v${version}";
-    hash = "sha256-2Znrt+TiQf/9YI1HYAikDfqbekAghOvxKoC05S18scQ=";
+    hash = "sha256-EM2kunqtxo0BTIzrEomfaRsdav7sx6QEOhjDtjjSoYY=";
    fetchSubmodules = true;
  };

@@ -22,6 +22,8 @@
    ),
  icuSupport ? false,
  icu,
+  zlibSupport ? false,
+  zlib,
  enableShared ? !stdenv.hostPlatform.isMinGW && !stdenv.hostPlatform.isStatic,
  enableStatic ? !enableShared,
  gnome,
@@ -68,6 +70,9 @@ stdenv.mkDerivation (finalAttrs: {
    ]
    ++ lib.optionals (stdenv.hostPlatform.isDarwin && pythonSupport && python ? isPy2 && python.isPy2) [
      libintl
+    ]
+    ++ lib.optionals zlibSupport [
+      zlib
    ];

  propagatedBuildInputs =
@@ -81,14 +86,18 @@ stdenv.mkDerivation (finalAttrs: {
      icu
    ];

-  configureFlags = [
-    "--exec-prefix=${placeholder "dev"}"
-    (lib.enableFeature enableStatic "static")
-    (lib.enableFeature enableShared "shared")
-    (lib.withFeature icuSupport "icu")
-    (lib.withFeature pythonSupport "python")
-    (lib.optionalString pythonSupport "PYTHON=${python.pythonOnBuildForHost.interpreter}")
-  ] ++ lib.optional enableHttp "--with-http";
+  configureFlags =
+    [
+      "--exec-prefix=${placeholder "dev"}"
+      (lib.enableFeature enableStatic "static")
+      (lib.enableFeature enableShared "shared")
+      (lib.withFeature icuSupport "icu")
+      (lib.withFeature pythonSupport "python")
+      (lib.optionalString pythonSupport "PYTHON=${python.pythonOnBuildForHost.interpreter}")
+    ]
+    # avoid rebuilds, can be merged into list in version bumps
+    ++ lib.optional enableHttp "--with-http"
+    ++ lib.optional zlibSupport "--with-zlib";

  installFlags = lib.optionals pythonSupport [
    "pythondir=\"${placeholder "py"}/${python.sitePackages}\""
@@ -0,0 +1,32 @@
+{
+  lib,
+  buildDunePackage,
+  fetchurl,
+  zarith,
+}:
+
+let
+  version = "0.6.1";
+in
+
+buildDunePackage {
+  pname = "bitwuzla-cxx";
+  inherit version;
+
+  minimalOCamlVersion = "4.12";
+
+  src = fetchurl {
+    url = "https://github.com/bitwuzla/ocaml-bitwuzla/releases/download/${version}/bitwuzla-cxx-${version}.tbz";
+    hash = "sha256-QgZy0a4QPVkgiB+lhEw40pE9TeuOOeMowtUb0F+BN6c=";
+  };
+
+  propagatedBuildInputs = [ zarith ];
+
+  meta = {
+    description = "OCaml binding for the SMT solver Bitwuzla C++ API";
+    homepage = "https://bitwuzla.github.io/";
+    changelog = "https://raw.githubusercontent.com/bitwuzla/ocaml-bitwuzla/refs/tags/${version}/CHANGES.md";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.vbgl ];
+  };
+}
@@ -20,19 +20,19 @@

 buildPythonPackage rec {
  inherit (ctranslate2-cpp) pname version src;
-  format = "setuptools";
+  pyproject = true;

  # https://github.com/OpenNMT/CTranslate2/tree/master/python
  sourceRoot = "${src.name}/python";

-  nativeBuildInputs = [
+  build-system = [
    pybind11
    setuptools
  ];

  buildInputs = [ ctranslate2-cpp ];

-  propagatedBuildInputs = [
+  dependencies = [
    numpy
    pyyaml
  ];
@@ -59,21 +59,6 @@ buildPythonPackage rec {
    export HOME=$TMPDIR
  '';

-  disabledTests = [
-    # AssertionError: assert 'int8' in {'float32'}
-    "test_get_supported_compute_types"
-    # Tensorflow (tf) not available in Python 3.12 yet
-    # To remove when https://github.com/NixOS/nixpkgs/pull/325224 is fixed
-    "test_opennmt_tf_model_conversion"
-    "test_opennmt_tf_model_quantization"
-    "test_opennmt_tf_model_conversion_invalid_vocab"
-    "test_opennmt_tf_model_conversion_invalid_dir"
-    "test_opennmt_tf_shared_embeddings_conversion"
-    "test_opennmt_tf_postnorm_transformer_conversion"
-    "test_opennmt_tf_gpt_conversion"
-    "test_opennmt_tf_multi_features"
-  ];
-
  disabledTestPaths = [
    # TODO: ModuleNotFoundError: No module named 'opennmt'
    "tests/test_opennmt_tf.py"
@@ -0,0 +1,48 @@
+{
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  pythonOlder,
+  unittestCheckHook,
+  pandoc,
+  lib,
+}:
+let
+  version = "0.7.0";
+in
+buildPythonPackage {
+  pname = "emojis";
+  inherit version;
+  pyproject = true;
+
+  build-system = [ setuptools ];
+
+  disabled = pythonOlder "3.4";
+
+  src = fetchFromGitHub {
+    owner = "alexandrevicenzi";
+    repo = "emojis";
+    tag = "v${version}";
+    hash = "sha256-rr/BM39U1j8EL8b/YojclI4h0NnOCdoMlecR/1f9ISg=";
+  };
+
+  nativeBuildInputs = [
+    pandoc
+  ];
+
+  preBuild = ''
+    make pandoc
+  '';
+
+  pythonImportsCheck = [ "emojis" ];
+
+  nativeCheckInputs = [ unittestCheckHook ];
+
+  meta = {
+    description = "Convert emoji names to emoji characters";
+    homepage = "https://github.com/alexandrevicenzi/emojis";
+    changelog = "https://github.com/alexandrevicenzi/emojis/releases/tag/v${version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ amadaluzia ];
+  };
+}
@@ -19,19 +19,19 @@

 buildPythonPackage rec {
  pname = "granian";
-  version = "2.2.0";
+  version = "2.2.2";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "emmett-framework";
    repo = "granian";
    tag = "v${version}";
-    hash = "sha256-YQ9+PcKXtSc+wdvhgDfSAfcv/y53oqcrPCEI9dDKFa0=";
+    hash = "sha256-LIJhhekulLQje6/8g9BIraH8aToPVWoTnWnmgtwLnHA=";
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
    inherit pname version src;
-    hash = "sha256-XJ61+u5aGQis6YkfASD+WJHEKDBL+2ImqCAuQmm3A/g=";
+    hash = "sha256-GSPGDVn4WlTJY9CiToI6myuiLcV1j2+LYD9IusDtgUg=";
  };

  nativeBuildInputs = with rustPlatform; [
@@ -39,14 +39,14 @@

 buildPythonPackage rec {
  pname = "huggingface-hub";
-  version = "0.30.1";
+  version = "0.30.2";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "huggingface";
    repo = "huggingface_hub";
    tag = "v${version}";
-    hash = "sha256-jL38Pyih5msrk4uEVbYkBCJyABMYMfIrqZqpMB4GMno=";
+    hash = "sha256-6nE6iKIC6ymI+NMOw/xQT4l5nshDyPdGI0YhqK7tQRE=";
  };

  build-system = [ setuptools ];
@@ -93,7 +93,7 @@ buildPythonPackage rec {
      keras
    ];
    hf_xet = [
-      # hf-xet
+      # hf-xet (unpackaged)
    ];
  };

@@ -21,7 +21,7 @@

 buildPythonPackage rec {
  pname = "pymodbus";
-  version = "3.8.6";
+  version = "3.9.0";
  pyproject = true;

  disabled = pythonOlder "3.9";
@@ -30,7 +30,7 @@ buildPythonPackage rec {
    owner = "pymodbus-dev";
    repo = "pymodbus";
    tag = "v${version}";
-    hash = "sha256-AnFPrjY6ukONAeCyHIzhtULm0vNjJugIxtuwACClzOo=";
+    hash = "sha256-8v48+wnxVBIXJhCn7/oHyoxPN8smWWNY/i5LMHhKUVk=";
  };

  build-system = [ setuptools ];
@@ -58,14 +58,14 @@

 buildPythonPackage rec {
  pname = "transformers";
-  version = "4.50.3";
+  version = "4.51.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "huggingface";
    repo = "transformers";
    tag = "v${version}";
-    hash = "sha256-Qou5q7FZJJXO87lgMC5Qttfi5KJWCwuzG5icCEfgs0M=";
+    hash = "sha256-02HT0GAfEyGgqPvly7EPZX0loSeS2mJQNI87E8WbEGY=";
  };

  build-system = [ setuptools ];
@@ -134,6 +134,9 @@ buildPythonPackage rec {
        flax
        optax
      ];
+      hf_xet = [
+        # hf-xet (unpackaged)
+      ];
      tokenizers = [ tokenizers ];
      ftfy = [ ftfy ];
      onnxruntime = [
@@ -1,6 +1,7 @@
 {
  lib,
  callPackage,
+  config,
  fetchFromGitHub,
  python3Packages,
  fetchpatch,
@@ -40,36 +41,40 @@ let
    })
  ];
 in
-lib.makeExtensible (self: {
-  beets = self.beets-stable;
+lib.makeExtensible (
+  self:
+  {
+    beets = self.beets-stable;

-  beets-stable = callPackage ./common.nix rec {
-    inherit python3Packages extraPatches;
-    version = "2.2.0";
-    src = fetchFromGitHub {
-      owner = "beetbox";
-      repo = "beets";
-      tag = "v${version}";
-      hash = "sha256-jhwXRgUUQJgQ/PLwvY1UfHCJ9UC8DcdBpE/janao0RM=";
+    beets-stable = callPackage ./common.nix rec {
+      inherit python3Packages extraPatches;
+      version = "2.2.0";
+      src = fetchFromGitHub {
+        owner = "beetbox";
+        repo = "beets";
+        tag = "v${version}";
+        hash = "sha256-jhwXRgUUQJgQ/PLwvY1UfHCJ9UC8DcdBpE/janao0RM=";
+      };
    };
-  };

-  beets-minimal = self.beets.override { disableAllPlugins = true; };
+    beets-minimal = self.beets.override { disableAllPlugins = true; };

-  beets-unstable = callPackage ./common.nix {
-    inherit python3Packages;
-    version = "2.2.0-unstable-2025-03-12";
-    src = fetchFromGitHub {
-      owner = "beetbox";
-      repo = "beets";
-      rev = "670a3bcd17a46883c71cf07dd313fcd0dff4be9d";
-      hash = "sha256-hSY7FhpPL4poOY1/gqk7oLNgQ7KA/MJqx50xOLIP0QA=";
+    beets-unstable = callPackage ./common.nix {
+      inherit python3Packages;
+      version = "2.2.0-unstable-2025-03-12";
+      src = fetchFromGitHub {
+        owner = "beetbox";
+        repo = "beets";
+        rev = "670a3bcd17a46883c71cf07dd313fcd0dff4be9d";
+        hash = "sha256-hSY7FhpPL4poOY1/gqk7oLNgQ7KA/MJqx50xOLIP0QA=";
+      };
    };
-  };

-  alternatives = callPackage ./plugins/alternatives.nix { beets = self.beets-minimal; };
-  audible = callPackage ./plugins/audible.nix { beets = self.beets-minimal; };
-  copyartifacts = callPackage ./plugins/copyartifacts.nix { beets = self.beets-minimal; };
-
-  extrafiles = throw "extrafiles is unmaintained since 2020 and broken since beets 2.0.0";
-})
+    alternatives = callPackage ./plugins/alternatives.nix { beets = self.beets-minimal; };
+    audible = callPackage ./plugins/audible.nix { beets = self.beets-minimal; };
+    copyartifacts = callPackage ./plugins/copyartifacts.nix { beets = self.beets-minimal; };
+  }
+  // lib.optionalAttrs config.allowAliases {
+    extrafiles = throw "extrafiles is unmaintained since 2020 and broken since beets 2.0.0";
+  }
+)
@@ -199,6 +199,7 @@ stdenv.mkDerivation (finalAttrs: {

  mesonFlags =
    [
+      (lib.mesonBool "unit-tests" (stdenv.buildPlatform.canExecute stdenv.hostPlatform))
      (lib.mesonBool "bindings" false)
      (lib.mesonOption "libstore:store-dir" storeDir)
      (lib.mesonOption "libstore:localstatedir" stateDir)
@@ -178,8 +178,8 @@ lib.makeExtensible (

      nix_2_26 = commonMeson {
        version = "2.26.3";
-        hash = "sha256-R+HAPvD+AjiyRHZP/elkvka33G499EKT8ntyF/EPPRI=";
-        self_attribute_name = "nix_2_28";
+        hash = "sha256-5ZV8YqU8mfFmoAMiUEuBqNwk0T3vUR//x1D12BiYCeY=";
+        self_attribute_name = "nix_2_26";
      };

      nix_2_28 = commonMeson {
@@ -1248,11 +1248,11 @@ with pkgs;
  };

  yabridge = callPackage ../tools/audio/yabridge {
-    wine = wineWowPackages.staging;
+    wine = wineWowPackages.yabridge;
  };

  yabridgectl = callPackage ../tools/audio/yabridgectl {
-    wine = wineWowPackages.staging;
+    wine = wineWowPackages.yabridge;
  };

  yafetch = callPackage ../tools/misc/yafetch {
@@ -2494,10 +2494,6 @@ with pkgs;
    buildGoModule = buildGo123Module;
  };

-  hiksink = callPackage ../tools/misc/hiksink {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
-
  hocr-tools = with python3Packages; toPythonApplication hocr-tools;

  hopper = qt5.callPackage ../development/tools/analysis/hopper { };
@@ -19284,6 +19280,7 @@ with pkgs;
          stagingFull
          wayland
          waylandFull
+          yabridge
          fonts
          ;
      }
@@ -116,6 +116,8 @@ let

        bitv = callPackage ../development/ocaml-modules/bitv { };

+        bitwuzla-cxx = callPackage ../development/ocaml-modules/bitwuzla-cxx { };
+
        bjack = callPackage ../development/ocaml-modules/bjack {
          inherit (pkgs.darwin.apple_sdk.frameworks) Accelerate CoreAudio;
        };
@@ -3096,6 +3096,13 @@ self: super: with self; {

  darkdetect = callPackage ../development/python-modules/darkdetect { };

+  dartsim = toPythonModule (
+    pkgs.dartsim.override {
+      pythonSupport = true;
+      python3Packages = self;
+    }
+  );
+
  dasbus = callPackage ../development/python-modules/dasbus { };

  dash = callPackage ../development/python-modules/dash { };
@@ -4382,6 +4389,8 @@ self: super: with self; {

  emoji = callPackage ../development/python-modules/emoji { };

+  emojis = callPackage ../development/python-modules/emojis { };
+
  empty-files = callPackage ../development/python-modules/empty-files { };

  empy = callPackage ../development/python-modules/empy { };
@@ -119,6 +119,7 @@ let
      rtabmap = linux;
      saga = linux;
      suitesparse = linux;
+      sunshine = linux;
      truecrack-cuda = linux;
      tts = linux;
      ueberzugpp = linux; # Failed in https://github.com/NixOS/nixpkgs/pull/233581
@@ -1,4 +1,5 @@
 {
+  lib,
  stdenv,
  config,
  callPackage,
@@ -63,4 +64,10 @@ rec {
  waylandFull = full.override {
    x11Support = false;
  };
+
+  yabridge =
+    let
+      yabridge = base.override { wineRelease = "yabridge"; };
+    in
+    if wineBuild == "wineWow" then yabridge else lib.dontDistribute yabridge;
 }