Merge 7296c7ff9a into haskell-updates

2025-03-19 00:18:57 +00:00
parent 8875f67ac1 7296c7ff9a
commit c4b59f2f01
336 changed files with 9496 additions and 13053 deletions
@@ -238,3 +238,6 @@ e0fe216f4912dd88a021d12a44155fd2cfeb31c8

 # nixos/movim: format with nixfmt-rfc-style
 43c1654cae47cbf987cb63758c06245fa95c1e3b
+
+# nixos/iso-image.nix: nixfmt
+da9a092c34cef6947d7aee2b134f61df45171631
@@ -10,6 +10,9 @@ on:
      # the release notes and some css and js files from there.
      # See nixos/doc/manual/default.nix
      - "doc/**"
+      # Build when something in lib changes
+      # Since the lib functions are used to 'massage' the options before producing the manual
+      - "lib/**"

 permissions: {}

@@ -0,0 +1,152 @@
+# COSMIC {#sec-language-cosmic}
+
+## Packaging COSMIC applications {#ssec-cosmic-packaging}
+
+COSMIC (Computer Operating System Main Interface Components) is a desktop environment developed by
+System76, primarily for the Pop!_OS Linux distribution. Applications in the COSMIC ecosystem are
+written in Rust and use libcosmic, which builds on the Iced GUI framework. This section explains
+how to properly package and integrate COSMIC applications within Nix.
+
+### libcosmicAppHook {#ssec-cosmic-libcosmic-app-hook}
+
+The `libcosmicAppHook` is a setup hook that helps with this by automatically configuring
+and wrapping applications based on libcosmic. It handles many common requirements like:
+
+- Setting up proper linking for libraries that may be dlopen'd by libcosmic/iced apps
+- Configuring XDG paths for settings schemas, icons, and other resources
+- Managing Vergen environment variables for build-time information
+- Setting up Rust linker flags for specific libraries
+
+To use the hook, simply add it to your package's `nativeBuildInputs`:
+
+```nix
+{
+  lib,
+  rustPlatform,
+  libcosmicAppHook,
+}:
+rustPlatform.buildRustPackage {
+  # ...
+  nativeBuildInputs = [ libcosmicAppHook ];
+  # ...
+}
+```
+
+### Settings fallback {#ssec-cosmic-settings-fallback}
+
+COSMIC applications use libcosmic's UI components, which may need access to theme settings. The
+`cosmic-settings` package provides default theme settings as a fallback in its `share` directory.
+By default, `libcosmicAppHook` includes this fallback path in `XDG_DATA_DIRS`, ensuring that COSMIC
+applications will have access to theme settings even if they aren't available elsewhere in the
+system.
+
+This fallback behavior can be disabled by setting `includeSettings = false` when including the hook:
+
+```nix
+{
+  lib,
+  rustPlatform,
+  libcosmicAppHook,
+}:
+let
+  # Get build-time version of libcosmicAppHook
+  libcosmicAppHook' = (libcosmicAppHook.__spliced.buildHost or libcosmicAppHook).override {
+    includeSettings = false;
+  };
+in
+rustPlatform.buildRustPackage {
+  # ...
+  nativeBuildInputs = [ libcosmicAppHook' ];
+  # ...
+}
+```
+
+Note that `cosmic-settings` is a separate application and not a part of the libcosmic settings
+system itself. It's included by default in `libcosmicAppHook` only to provide these fallback theme
+settings.
+
+### Icons {#ssec-cosmic-icons}
+
+COSMIC applications can use icons from the COSMIC icon theme. While COSMIC applications can build
+and run without these icons, they would be missing visual elements. The `libcosmicAppHook`
+automatically includes `cosmic-icons` in the wrapped application's `XDG_DATA_DIRS` as a fallback,
+ensuring that the application has access to its required icons even if the system doesn't have the
+COSMIC icon theme installed globally.
+
+Unlike the `cosmic-settings` fallback, the `cosmic-icons` fallback cannot be removed or disabled, as
+it is essential for COSMIC applications to have access to these icons for proper visual rendering.
+
+### Runtime Libraries {#ssec-cosmic-runtime-libraries}
+
+COSMIC applications built on libcosmic and Iced require several runtime libraries that are dlopen'd
+rather than linked directly. The `libcosmicAppHook` ensures that these libraries are correctly
+linked by setting appropriate Rust linker flags. The libraries handled include:
+
+- Graphics libraries (EGL, Vulkan)
+- Input libraries (xkbcommon)
+- Display server protocols (Wayland, X11)
+
+This ensures that the applications will work correctly at runtime, even though they use dynamic
+loading for these dependencies.
+
+### Adding custom wrapper arguments {#ssec-cosmic-custom-wrapper-args}
+
+You can pass additional arguments to the wrapper using `libcosmicAppWrapperArgs` in the `preFixup` hook:
+
+```nix
+{
+  lib,
+  rustPlatform,
+  libcosmicAppHook,
+}:
+rustPlatform.buildRustPackage {
+  # ...
+  preFixup = ''
+    libcosmicAppWrapperArgs+=(--set-default ENVIRONMENT_VARIABLE VALUE)
+  '';
+  # ...
+}
+```
+
+## Frequently encountered issues {#ssec-cosmic-common-issues}
+
+### Setting up Vergen environment variables {#ssec-cosmic-common-issues-vergen}
+
+Many COSMIC applications use the Vergen Rust crate for build-time information. The `libcosmicAppHook`
+automatically sets up the `VERGEN_GIT_COMMIT_DATE` environment variable based on `SOURCE_DATE_EPOCH`
+to ensure reproducible builds.
+
+However, some applications may explicitly require additional Vergen environment variables.
+Without these properly set, you may encounter build failures with errors like:
+
+```
+>   cargo:rerun-if-env-changed=VERGEN_GIT_COMMIT_DATE
+>   cargo:rerun-if-env-changed=VERGEN_GIT_SHA
+>
+>   --- stderr
+>   Error: no suitable 'git' command found!
+> warning: build failed, waiting for other jobs to finish...
+```
+
+While `libcosmicAppHook` handles `VERGEN_GIT_COMMIT_DATE`, you may need to explicitly set other
+variables. For applications that require these variables, you should set them directly in the
+package definition:
+
+```nix
+{
+  lib,
+  rustPlatform,
+  libcosmicAppHook,
+}:
+rustPlatform.buildRustPackage {
+  # ...
+  env = {
+    VERGEN_GIT_COMMIT_DATE = "2025-01-01";
+    VERGEN_GIT_SHA = "0000000000000000000000000000000000000000"; # SHA-1 hash of the commit
+  };
+  # ...
+}
+```
+
+Not all COSMIC applications require these variables, but for those that do, setting them explicitly
+will prevent build failures.
@@ -58,6 +58,7 @@ beam.section.md
 bower.section.md
 chicken.section.md
 coq.section.md
+cosmic.section.md
 crystal.section.md
 cuda.section.md
 cuelang.section.md
@@ -62,6 +62,9 @@
  "sec-build-helper-extendMkDerivation": [
    "index.html#sec-build-helper-extendMkDerivation"
  ],
+  "sec-language-cosmic": [
+    "index.html#sec-language-cosmic"
+  ],
  "sec-modify-via-packageOverrides": [
    "index.html#sec-modify-via-packageOverrides"
  ],
@@ -317,6 +320,30 @@
  "sec-tools-of-stdenv": [
    "index.html#sec-tools-of-stdenv"
  ],
+  "ssec-cosmic-common-issues": [
+    "index.html#ssec-cosmic-common-issues"
+  ],
+  "ssec-cosmic-common-issues-vergen": [
+    "index.html#ssec-cosmic-common-issues-vergen"
+  ],
+  "ssec-cosmic-custom-wrapper-args": [
+    "index.html#ssec-cosmic-custom-wrapper-args"
+  ],
+  "ssec-cosmic-icons": [
+    "index.html#ssec-cosmic-icons"
+  ],
+  "ssec-cosmic-libcosmic-app-hook": [
+    "index.html#ssec-cosmic-libcosmic-app-hook"
+  ],
+  "ssec-cosmic-packaging": [
+    "index.html#ssec-cosmic-packaging"
+  ],
+  "ssec-cosmic-runtime-libraries": [
+    "index.html#ssec-cosmic-runtime-libraries"
+  ],
+  "ssec-cosmic-settings-fallback": [
+    "index.html#ssec-cosmic-settings-fallback"
+  ],
  "ssec-stdenv-dependencies": [
    "index.html#ssec-stdenv-dependencies"
  ],
@@ -48,7 +48,7 @@

 ### NexusMods.App upgraded {#sec-nixpkgs-release-25.05-incompatibilities-nexusmods-app-upgraded}

- `nexusmods-app` has been upgraded from version 0.6.3 to 0.7.3.
+- `nexusmods-app` has been upgraded from version 0.6.3 to 0.8.2.

  - Before upgrading, you **must reset all app state** (mods, games, settings, etc). NexusMods.App will crash if any state from a version older than 0.7.0 is still present.

@@ -4129,6 +4129,12 @@
    name = "ChaosAttractor";
    keys = [ { fingerprint = "A137 4415 DB7C 6439 10EA  5BF1 0FEE 4E47 5940 E125"; } ];
  };
+  charain = {
+    email = "charain_li@outlook.com";
+    github = "chai-yuan";
+    githubId = 42235952;
+    name = "charain";
+  };
  charB66 = {
    email = "nix.disparate221@passinbox.com";
    github = "charB66";
@@ -4383,6 +4389,12 @@
    github = "ciferkey";
    githubId = 101422;
  };
+  ciflire = {
+    name = "Léo Vesse";
+    email = "leovesse@gmail.com";
+    github = "Ciflire";
+    githubId = 39668077;
+  };
  cig0 = {
    name = "Martín Cigorraga";
    email = "cig0.github@gmail.com";
@@ -11326,6 +11338,12 @@
      { fingerprint = "816D 23F5 E672 EC58 7674  4A73 197F 9A63 2D13 9E30"; }
    ];
  };
+  j-mendez = {
+    email = "jeff@a11ywatch.com";
+    github = "j-mendez";
+    githubId = 8095978;
+    name = "j-mendez";
+  };
  jmendyk = {
    email = "jakub@ndyk.me";
    github = "JMendyk";
@@ -5,13 +5,12 @@ configuration of your machine. Whenever you've [changed
 something](#ch-configuration) in that file, you should do

 ```ShellSession
-$ nixos-rebuild switch --use-remote-sudo
+# nixos-rebuild switch
 ```

-to build the new configuration as your current user, and as the root user,
-make it the default configuration for booting. `switch` will also try to
-realise the configuration in the running system (e.g., by restarting system
-services).
+to build the new configuration, make it the default configuration for
+booting, and try to realise the configuration in the running system
+(e.g., by restarting system services).

 ::: {.warning}
 This command doesn't start/stop [user services](#opt-systemd.user.services)
@@ -20,23 +19,14 @@ user services.
 :::

 ::: {.warning}
-Applying a configuration is an action that must be done by the root user, so the
-`switch`, `boot` and `test` commands should be ran with the `--use-remote-sudo`
-flag. Despite its odd name, this flag runs the activation script with elevated
-permissions, regardless of whether or not the target system is remote, without
-affecting the other stages of the `nixos-rebuild` call. This allows unprivileged
-users to rebuild the system and only elevate their permissions when necessary.
-
-Alternatively, one can run the whole command as root while preserving user
-environment variables by prefixing the command with `sudo -E`. However, this
-method may create root-owned files in `$HOME/.cache` if Nix decides to use the
-cache during evaluation.
+These commands must be executed as root, so you should either run them
+from a root shell or by prefixing them with `sudo -i`.
 :::

 You can also do

 ```ShellSession
-$ nixos-rebuild test --use-remote-sudo
+# nixos-rebuild test
 ```

 to build the configuration and switch the running system to it, but
@@ -47,7 +37,7 @@ configuration.
 There is also

 ```ShellSession
-$ nixos-rebuild boot --use-remote-sudo
+# nixos-rebuild boot
 ```

 to build the configuration and make it the boot default, but not switch
@@ -57,7 +47,7 @@ You can make your configuration show up in a different submenu of the
 GRUB 2 boot screen by giving it a different *profile name*, e.g.

 ```ShellSession
-$ nixos-rebuild switch -p test --use-remote-sudo
+# nixos-rebuild switch -p test
 ```

 which causes the new configuration (and previous ones created using
@@ -68,7 +58,7 @@ configurations.
 A repl, or read-eval-print loop, is also available. You can inspect your configuration and use the Nix language with

 ```ShellSession
-$ nixos-rebuild repl
+# nixos-rebuild repl
 ```

 Your configuration is loaded into the `config` variable. Use tab for autocompletion, use the `:r` command to reload the configuration files. See `:?` or [`nix repl` in the Nix manual](https://nixos.org/manual/nix/stable/command-ref/new-cli/nix3-repl.html) to learn more.
@@ -201,6 +201,8 @@

 - [Orthanc](https://orthanc.uclouvain.be/) a lightweight, RESTful DICOM server for healthcare and medical research. Available as [services.orthanc](#opt-services.orthanc.enable).

+- [Pareto Security](https://paretosecurity.com/) is an alternative to corporate compliance solutions for companies that care about security but know it doesn't have to be invasive. Available as [services.paretosecurity](#opt-services.paretosecurity.enable)
+
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->

 ## Backward Incompatibilities {#sec-release-25.05-incompatibilities}
@@ -393,6 +395,10 @@
  [v1.8.0](https://github.com/jtroo/kanata/releases/tag/v1.8.0)
  for more information.

+- `authelia` version 4.39.0 has made changes on the default claims for ID Tokens, to mirror the standard claims from the specification.
+  This change may affect some clients in unexpected ways, so manual intervention may be required.
+  Read the [release notes](https://www.authelia.com/blog/4.39-release-notes/), along with [the guide](https://www.authelia.com/integration/openid-connect/openid-connect-1.0-claims/#restore-functionality-prior-to-claims-parameter) to work around issues that may be encountered.
+
 - `ags` was updated to v2, which is just a CLI for Astal now. Components are available as a different package set `astal.*`.
  If you want to use v1, it is available as `ags_1` package.

@@ -640,6 +646,10 @@
  [is removed](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c01f664e4ca210823b7594b50669bbd9b0a3c3b0)
  in Linux 6.13.

+- `authelia` version 4.39.0 has made some changes which deprecate older configurations.
+  They are still expected to be working until future version 5.0.0, but will generate warnings in logs.
+  Read the [release notes](https://www.authelia.com/blog/4.39-release-notes/) for human readable summaries of the changes.
+
 - `programs.fzf.keybindings` now supports the fish shell.

 - `gerbera` now has wavpack support.
@@ -1,11 +1,11 @@
 # This module defines a NixOS installation CD that contains GNOME.

-{ pkgs, ... }:
+{ lib, pkgs, ... }:

 {
  imports = [ ./installation-cd-graphical-calamares.nix ];

-  isoImage.edition = "gnome";
+  isoImage.edition = lib.mkDefault "gnome";

  services.xserver.desktopManager.gnome = {
    # Add Firefox and other tools useful for installation to the launcher
@@ -1,12 +1,12 @@
 # This module defines a NixOS installation CD that contains X11 and
 # Plasma 5.

-{ pkgs, ... }:
+{ lib, pkgs, ... }:

 {
  imports = [ ./installation-cd-graphical-calamares.nix ];

-  isoImage.edition = "plasma5";
+  isoImage.edition = lib.mkDefault "plasma5";

  services.xserver.desktopManager.plasma5 = {
    enable = true;
@@ -1,11 +1,11 @@
 # This module defines a NixOS installation CD that contains Plasma 6.

-{ pkgs, ... }:
+{ lib, pkgs, ... }:

 {
  imports = [ ./installation-cd-graphical-calamares.nix ];

-  isoImage.edition = "plasma6";
+  isoImage.edition = lib.mkDefault "plasma6";

  services.desktopManager.plasma6.enable = true;

@@ -0,0 +1,52 @@
+# This configuration uses a specialisation for each desired boot
+# configuration, and a common parent configuration for all of them
+# that's hidden. This allows users to import this module alongside
+# their own and get the full array of specialisations inheriting the
+# users' settings.
+
+{ lib, ... }:
+{
+  imports = [ ./installation-cd-base.nix ];
+  isoImage.edition = "graphical";
+  isoImage.showConfiguration = lib.mkDefault false;
+
+  specialisation = {
+    gnome.configuration =
+      { config, ... }:
+      {
+        imports = [ ./installation-cd-graphical-calamares-gnome.nix ];
+        isoImage.showConfiguration = true;
+        isoImage.configurationName = "GNOME (Linux LTS)";
+      };
+
+    gnome_latest_kernel.configuration =
+      { config, ... }:
+      {
+        imports = [
+          ./installation-cd-graphical-calamares-gnome.nix
+          ./latest-kernel.nix
+        ];
+        isoImage.showConfiguration = true;
+        isoImage.configurationName = "GNOME (Linux ${config.boot.kernelPackages.kernel.version})";
+      };
+
+    plasma.configuration =
+      { config, ... }:
+      {
+        imports = [ ./installation-cd-graphical-calamares-plasma6.nix ];
+        isoImage.showConfiguration = true;
+        isoImage.configurationName = "Plasma (Linux LTS)";
+      };
+
+    plasma_latest_kernel.configuration =
+      { config, ... }:
+      {
+        imports = [
+          ./installation-cd-graphical-calamares-plasma6.nix
+          ./latest-kernel.nix
+        ];
+        isoImage.showConfiguration = true;
+        isoImage.configurationName = "Plasma (Linux ${config.boot.kernelPackages.kernel.version})";
+      };
+  };
+}
@@ -1,11 +1,11 @@
 # This module defines a NixOS installation CD that contains GNOME.

-{ ... }:
+{ lib, ... }:

 {
  imports = [ ./installation-cd-graphical-base.nix ];

-  isoImage.edition = "gnome";
+  isoImage.edition = lib.mkDefault "gnome";

  services.xserver.desktopManager.gnome = {
    # Add Firefox and other tools useful for installation to the launcher
@@ -1,12 +1,12 @@
 # This module defines a NixOS installation CD that contains X11 and
 # Plasma 5.

-{ pkgs, ... }:
+{ lib, pkgs, ... }:

 {
  imports = [ ./installation-cd-graphical-base.nix ];

-  isoImage.edition = "plasma5";
+  isoImage.edition = lib.mkDefault "plasma5";

  services.xserver.desktopManager.plasma5 = {
    enable = true;
@@ -0,0 +1,14 @@
+{ lib, ... }:
+
+{
+  imports = [ ./installation-cd-minimal.nix ];
+
+  isoImage.configurationName = lib.mkDefault "(Linux LTS)";
+
+  specialisation.latest_kernel.configuration =
+    { config, ... }:
+    {
+      imports = [ ./latest-kernel.nix ];
+      isoImage.configurationName = "(Linux ${config.boot.kernelPackages.kernel.version})";
+    };
+}
@@ -0,0 +1,9 @@
+{ lib, pkgs, ... }:
+{
+  boot.kernelPackages = pkgs.linuxPackages_latest;
+  boot.supportedFilesystems.zfs = false;
+  environment.etc."nixos-generate-config.conf".text = ''
+    [Defaults]
+    Kernel=latest
+  '';
+}
@@ -13,6 +13,7 @@
 .Op Fl -root Ar root
 .Op Fl -dir Ar dir
 .Op Fl -flake
+.Op Fl -kernel Ar <lts|latest>
 .
 .
 .
@@ -66,6 +67,9 @@ instead of
 .Pa /etc/nixos Ns
 \&.
 .
+.It Fl -kernel Ar <lts|latest>
+Set the kernel in the generated configuration file.
+.
 .It Fl -force
 Overwrite
 .Pa /etc/nixos/configuration.nix
@@ -7,6 +7,7 @@ use File::Path;
 use File::Basename;
 use File::Slurp;
 use File::stat;
+use Config::IniFiles;

 umask(0022);

@@ -37,6 +38,18 @@ my $force = 0;
 my $noFilesystems = 0;
 my $flake = 0;
 my $showHardwareConfig = 0;
+my $kernel = "lts";
+
+if (-e "/etc/nixos-generate-config.conf") {
+    my $cfg = new Config::IniFiles -file => "/etc/nixos-generate-config.conf";
+    $outDir = $cfg->val("Defaults", "Directory") // $outDir;
+    if (defined $cfg->val("Defaults", "RootDirectory")) {
+        $rootDir = $cfg->val("Defaults", "RootDirectory");
+        $rootDir =~ s/\/*$//; # remove trailing slashes
+        $rootDir = File::Spec->rel2abs($rootDir); # resolve absolute path
+    }
+    $kernel = $cfg->val("Defaults", "Kernel") // $kernel;
+}

 for (my $n = 0; $n < scalar @ARGV; $n++) {
    my $arg = $ARGV[$n];
@@ -68,11 +81,17 @@ for (my $n = 0; $n < scalar @ARGV; $n++) {
    elsif ($arg eq "--flake") {
        $flake = 1;
    }
+    elsif ($arg eq "--kernel") {
+        $n++;
+        $kernel = $ARGV[$n];
+        die "$0: ‘--kernel’ requires an argument\n" unless defined $kernel;
+    }
    else {
        die "$0: unrecognized argument ‘$arg’\n";
    }
 }

+die "$0: invalid kernel: '$kernel'" unless $kernel eq "lts" || $kernel eq "latest";

 my @attrs = ();
 my @kernelModules = ();
@@ -709,6 +728,14 @@ EOF
 EOF
        }

+        if ($kernel eq "latest") {
+            $bootLoaderConfig .= <<EOF;
+
+  # Use latest kernel.
+  boot.kernelPackages = pkgs.linuxPackages_latest;
+EOF
+        }
+
        my $networkingDhcpConfig = generateNetworkingDhcpConfig();

        my $xserverConfig = generateXserverConfig();
@@ -1,25 +1,41 @@
 # This module generates nixos-install, nixos-rebuild,
 # nixos-generate-config, etc.

-{ config, lib, pkgs, options, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  options,
+  ...
+}:

 let
-  makeProg = args: pkgs.replaceVarsWith (args // {
-    dir = "bin";
-    isExecutable = true;
-    nativeBuildInputs = [
-      pkgs.installShellFiles
-    ];
-    postInstall = ''
-      installManPage ${args.manPage}
-    '';
-  });
+  makeProg =
+    args:
+    pkgs.replaceVarsWith (
+      args
+      // {
+        dir = "bin";
+        isExecutable = true;
+        nativeBuildInputs = [
+          pkgs.installShellFiles
+        ];
+        postInstall = ''
+          installManPage ${args.manPage}
+        '';
+      }
+    );

  nixos-generate-config = makeProg {
    name = "nixos-generate-config";
    src = ./nixos-generate-config.pl;
    replacements = {
-      perl = "${pkgs.perl.withPackages (p: [ p.FileSlurp ])}/bin/perl";
+      perl = "${
+        pkgs.perl.withPackages (p: [
+          p.FileSlurp
+          p.ConfigIniFiles
+        ])
+      }/bin/perl";
      hostPlatformSystem = pkgs.stdenv.hostPlatform.system;
      detectvirt = "${config.systemd.package}/bin/systemd-detect-virt";
      btrfs = "${pkgs.btrfs-progs}/bin/btrfs";
@@ -36,13 +52,17 @@ let
      inherit (pkgs) runtimeShell;
      inherit (config.system.nixos) version codeName revision;
      inherit (config.system) configurationRevision;
-      json = builtins.toJSON ({
-        nixosVersion = config.system.nixos.version;
-      } // lib.optionalAttrs (config.system.nixos.revision != null) {
-        nixpkgsRevision = config.system.nixos.revision;
-      } // lib.optionalAttrs (config.system.configurationRevision != null) {
-        configurationRevision = config.system.configurationRevision;
-      });
+      json = builtins.toJSON (
+        {
+          nixosVersion = config.system.nixos.version;
+        }
+        // lib.optionalAttrs (config.system.nixos.revision != null) {
+          nixpkgsRevision = config.system.nixos.revision;
+        }
+        // lib.optionalAttrs (config.system.configurationRevision != null) {
+          configurationRevision = config.system.configurationRevision;
+        }
+      );
    };
    manPage = ./manpages/nixos-version.8;
  };
@@ -266,26 +286,46 @@ in
    '';
  };

-  imports = let
-    mkToolModule = { name, package ? pkgs.${name} }: { config, ... }: {
-      options.system.tools.${name}.enable = lib.mkEnableOption "${name} script" // {
-        default = config.nix.enable && ! config.system.disableInstallerTools;
-        defaultText = "config.nix.enable && !config.system.disableInstallerTools";
-      };
+  imports =
+    let
+      mkToolModule =
+        {
+          name,
+          package ? pkgs.${name},
+        }:
+        { config, ... }:
+        {
+          options.system.tools.${name}.enable = lib.mkEnableOption "${name} script" // {
+            default = config.nix.enable && !config.system.disableInstallerTools;
+            defaultText = "config.nix.enable && !config.system.disableInstallerTools";
+          };

-      config = lib.mkIf config.system.tools.${name}.enable {
-        environment.systemPackages = [ package ];
-      };
-    };
-  in [
-    (mkToolModule { name = "nixos-build-vms"; })
-    (mkToolModule { name = "nixos-enter"; })
-    (mkToolModule { name = "nixos-generate-config"; package = config.system.build.nixos-generate-config; })
-    (mkToolModule { name = "nixos-install"; package = config.system.build.nixos-install; })
-    (mkToolModule { name = "nixos-option"; })
-    (mkToolModule { name = "nixos-rebuild"; package = config.system.build.nixos-rebuild; })
-    (mkToolModule { name = "nixos-version"; package = nixos-version; })
-  ];
+          config = lib.mkIf config.system.tools.${name}.enable {
+            environment.systemPackages = [ package ];
+          };
+        };
+    in
+    [
+      (mkToolModule { name = "nixos-build-vms"; })
+      (mkToolModule { name = "nixos-enter"; })
+      (mkToolModule {
+        name = "nixos-generate-config";
+        package = config.system.build.nixos-generate-config;
+      })
+      (mkToolModule {
+        name = "nixos-install";
+        package = config.system.build.nixos-install;
+      })
+      (mkToolModule { name = "nixos-option"; })
+      (mkToolModule {
+        name = "nixos-rebuild";
+        package = config.system.build.nixos-rebuild;
+      })
+      (mkToolModule {
+        name = "nixos-version";
+        package = nixos-version;
+      })
+    ];

  config = {
    documentation.man.man-db.skipPackages = [ nixos-version ];
@@ -293,10 +333,7 @@ in
    # These may be used in auxiliary scripts (ie not part of toplevel), so they are defined unconditionally.
    system.build = {
      inherit nixos-generate-config nixos-install;
-      nixos-rebuild =
-        if config.system.rebuild.enableNg
-          then nixos-rebuild-ng
-          else nixos-rebuild;
+      nixos-rebuild = if config.system.rebuild.enableNg then nixos-rebuild-ng else nixos-rebuild;
      nixos-option = lib.warn "Accessing nixos-option through `config.system.build` is deprecated, use `pkgs.nixos-option` instead." pkgs.nixos-option;
      nixos-enter = lib.warn "Accessing nixos-enter through `config.system.build` is deprecated, use `pkgs.nixos-enter` instead." pkgs.nixos-enter;
    };
@@ -1401,6 +1401,7 @@
  ./services/security/oauth2-proxy.nix
  ./services/security/oauth2-proxy-nginx.nix
  ./services/security/opensnitch.nix
+  ./services/security/paretosecurity.nix
  ./services/security/pass-secret-service.nix
  ./services/security/physlock.nix
  ./services/security/shibboleth-sp.nix
@@ -1,7 +1,12 @@
 # This module defines the software packages included in the "minimal"
 # installation CD. It might be useful elsewhere.

-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:

 {
  # Include some utilities that are useful for installing or repairing
@@ -43,9 +48,19 @@
  ];

  # Include support for various filesystems and tools to create / manipulate them.
-  boot.supportedFilesystems =
-    [ "btrfs" "cifs" "f2fs" "ntfs" "vfat" "xfs" ] ++
-    lib.optional (lib.meta.availableOn pkgs.stdenv.hostPlatform config.boot.zfs.package) "zfs";
+  boot.supportedFilesystems = lib.mkMerge [
+    [
+      "btrfs"
+      "cifs"
+      "f2fs"
+      "ntfs"
+      "vfat"
+      "xfs"
+    ]
+    (lib.mkIf (lib.meta.availableOn pkgs.stdenv.hostPlatform config.boot.zfs.package) {
+      zfs = lib.mkDefault true;
+    })
+  ];

  # Configure host id for ZFS to work
  networking.hostId = lib.mkDefault "8425e349";
@@ -6,7 +6,7 @@ export PATH=@coreutils@/bin
 if test "$1" = "start"; then
 	if ! @procps@/bin/pgrep ircd; then
 	if @ipv6Enabled@; then 
-		while ! @iproute@/sbin/ip addr | 
+		while ! @iproute2@/sbin/ip addr | 
 			@gnugrep@/bin/grep inet6 | 
 			@gnugrep@/bin/grep global; do
 			sleep 1;
@@ -62,7 +62,7 @@ let
                >"$RUNTIME_DIRECTORY/api_key"
        do sleep 1; done
        (printf "X-API-Key: "; cat "$RUNTIME_DIRECTORY/api_key") >"$RUNTIME_DIRECTORY/headers"
-        ${pkgs.curl}/bin/curl -sSLk -H "@$RUNTIME_DIRECTORY/headers" \
+        ${pkgs.curl}/bin/curl --fail -sSLk -H "@$RUNTIME_DIRECTORY/headers" \
            --retry 1000 --retry-delay 1 --retry-all-errors \
            "$@"
    }
@@ -121,6 +121,7 @@ let
          '[.[].${s.GET_IdAttrName}] - $new_ids | .[]'
        )"
        for id in ''${stale_${conf_type}_ids}; do
+          >&2 echo "Deleting stale device: $id"
          curl -X DELETE ${s.baseAddress}/$id
        done
      ''
@@ -0,0 +1,43 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+{
+
+  options.services.paretosecurity = {
+    enable = lib.mkEnableOption "[ParetoSecurity](https://paretosecurity.com) [agent](https://github.com/ParetoSecurity/agent) and its root helper";
+    package = lib.mkPackageOption pkgs "paretosecurity" { };
+  };
+
+  config = lib.mkIf config.services.paretosecurity.enable {
+    environment.systemPackages = [ config.services.paretosecurity.package ];
+
+    systemd.sockets."paretosecurity" = {
+      wantedBy = [ "sockets.target" ];
+      socketConfig = {
+        ListenStream = "/var/run/paretosecurity.sock";
+        SocketMode = "0666";
+      };
+    };
+
+    systemd.services."paretosecurity" = {
+      serviceConfig = {
+        ExecStart = "${config.services.paretosecurity.package}/bin/paretosecurity helper";
+        User = "root";
+        Group = "root";
+        StandardInput = "socket";
+        Type = "oneshot";
+        RemainAfterExit = "no";
+        StartLimitInterval = "1s";
+        StartLimitBurst = 100;
+        ProtectSystem = "full";
+        ProtectHome = true;
+        StandardOutput = "journal";
+        StandardError = "journal";
+      };
+    };
+
+  };
+}
@@ -734,8 +734,9 @@ in
        wantedBy = [ "multi-user.target" ];
        requiredBy = [ "${phpExecutionUnit}.service" ];
        before = [ "${phpExecutionUnit}.service" ];
-        after = lib.optional cfg.database.createLocally dbService;
+        wants = [ "local-fs.target" ];
        requires = lib.optional cfg.database.createLocally dbService;
+        after = lib.optional cfg.database.createLocally dbService;

        serviceConfig =
          {
@@ -785,11 +786,36 @@ in
          );
      };

+      services.${phpExecutionUnit} = {
+        wantedBy = lib.optional (cfg.nginx != null) "nginx.service";
+        requiredBy = [ "movim.service" ];
+        before = [ "movim.service" ] ++ lib.optional (cfg.nginx != null) "nginx.service";
+        wants = [ "network.target" ];
+        requires = [ "movim-data-setup.service" ] ++ lib.optional cfg.database.createLocally dbService;
+        after = [ "movim-data-setup.service" ] ++ lib.optional cfg.database.createLocally dbService;
+      };
+
      services.movim = {
        description = "Movim daemon";
        wantedBy = [ "multi-user.target" ];
-        after = [ "movim-data-setup.service" ];
-        requires = [ "movim-data-setup.service" ] ++ lib.optional cfg.database.createLocally dbService;
+        wants = [
+          "network.target"
+          "local-fs.target"
+        ];
+        requires =
+          [
+            "movim-data-setup.service"
+            "${phpExecutionUnit}.service"
+          ]
+          ++ lib.optional cfg.database.createLocally dbService
+          ++ lib.optional (cfg.nginx != null) "nginx.service";
+        after =
+          [
+            "movim-data-setup.service"
+            "${phpExecutionUnit}.service"
+          ]
+          ++ lib.optional cfg.database.createLocally dbService
+          ++ lib.optional (cfg.nginx != null) "nginx.service";
        environment = {
          PUBLIC_URL = "//${cfg.domain}";
          WS_PORT = builtins.toString cfg.port;
@@ -803,11 +829,6 @@ in
        };
      };

-      services.${phpExecutionUnit} = {
-        after = [ "movim-data-setup.service" ];
-        requires = [ "movim-data-setup.service" ] ++ lib.optional cfg.database.createLocally dbService;
-      };
-
      tmpfiles.settings."10-movim" = with cfg; {
        "${dataDir}".d = {
          inherit user group;
@@ -71,8 +71,7 @@ rec {
        (onFullSupported "nixos.dummy")
        (onAllSupported "nixos.iso_minimal")
        (onSystems [ "x86_64-linux" "aarch64-linux" ] "nixos.amazonImage")
-        (onFullSupported "nixos.iso_plasma6")
-        (onFullSupported "nixos.iso_gnome")
+        (onFullSupported "nixos.iso_graphical")
        (onFullSupported "nixos.manual")
        (onSystems [ "aarch64-linux" ] "nixos.sd_image")
        (onFullSupported "nixos.tests.acme.http01-builtin")
@@ -164,42 +164,14 @@ in rec {
  });

  iso_minimal = forAllSystems (system: makeIso {
-    module = ./modules/installer/cd-dvd/installation-cd-minimal.nix;
+    module = ./modules/installer/cd-dvd/installation-cd-minimal-combined.nix;
    type = "minimal";
    inherit system;
  });

-  iso_plasma5 = forMatchingSystems supportedSystems (system: makeIso {
-    module = ./modules/installer/cd-dvd/installation-cd-graphical-calamares-plasma5.nix;
-    type = "plasma5";
-    inherit system;
-  });
-
-  iso_plasma6 = forMatchingSystems supportedSystems (system: makeIso {
-    module = ./modules/installer/cd-dvd/installation-cd-graphical-calamares-plasma6.nix;
-    type = "plasma6";
-    inherit system;
-  });
-
-  iso_gnome = forMatchingSystems supportedSystems (system: makeIso {
-    module = ./modules/installer/cd-dvd/installation-cd-graphical-calamares-gnome.nix;
-    type = "gnome";
-    inherit system;
-  });
-
-  # A variant with a more recent (but possibly less stable) kernel that might support more hardware.
-  # This variant keeps zfs support enabled, hoping it will build and work.
-  iso_minimal_new_kernel = forMatchingSystems [ "x86_64-linux" "aarch64-linux" ] (system: makeIso {
-    module = ./modules/installer/cd-dvd/installation-cd-minimal-new-kernel.nix;
-    type = "minimal-new-kernel";
-    inherit system;
-  });
-
-  # A variant with a more recent (but possibly less stable) kernel that might support more hardware.
-  # ZFS support disabled since it is unlikely to support the latest kernel.
-  iso_minimal_new_kernel_no_zfs = forMatchingSystems [ "x86_64-linux" "aarch64-linux" ] (system: makeIso {
-    module = ./modules/installer/cd-dvd/installation-cd-minimal-new-kernel-no-zfs.nix;
-    type = "minimal-new-kernel-no-zfs";
+  iso_graphical = forAllSystems (system: makeIso {
+    module = ./modules/installer/cd-dvd/installation-cd-graphical-combined.nix;
+    type = "graphical";
    inherit system;
  });

@@ -895,6 +895,7 @@ in {
  pam-u2f = handleTest ./pam/pam-u2f.nix {};
  pam-ussh = handleTest ./pam/pam-ussh.nix {};
  pam-zfs-key = handleTest ./pam/zfs-key.nix {};
+  paretosecurity = runTest ./paretosecurity.nix;
  pass-secret-service = handleTest ./pass-secret-service.nix {};
  patroni = handleTestOn ["x86_64-linux"] ./patroni.nix {};
  pantalaimon = handleTest ./matrix/pantalaimon.nix {};
@@ -0,0 +1,16 @@
+{ lib, ... }:
+{
+  name = "paretosecurity";
+  meta.maintainers = [ lib.maintainers.zupo ];
+
+  nodes.machine =
+    { config, pkgs, ... }:
+    {
+      services.paretosecurity.enable = true;
+    };
+
+  # very basic test for now, need to add output asserts
+  testScript = ''
+    machine.wait_until_succeeds("paretosecurity check")
+  '';
+}
@@ -7969,10 +7969,10 @@
    elpaBuild {
      pname = "shell-quasiquote";
      ename = "shell-quasiquote";
-      version = "0.0.20221221.82030";
+      version = "0.0.20250316.162215";
      src = fetchurl {
-        url = "https://elpa.gnu.org/devel/shell-quasiquote-0.0.20221221.82030.tar";
-        sha256 = "0g2yq64yyim35lvxify65kq3y49qrvgri7jyl9rgz8999gb3h8dj";
+        url = "https://elpa.gnu.org/devel/shell-quasiquote-0.0.20250316.162215.tar";
+        sha256 = "1f19k60y30vnp3dw62fn2wi94bkgdfx6nl8i50yx5nnw0cjp9f7l";
      };
      packageRequires = [ ];
      meta = {
@@ -2,19 +2,18 @@
  lib,
  rustPlatform,
  fetchFromGitHub,
-  fetchpatch,
  stdenv,
  vimUtils,
  nix-update-script,
  git,
 }:
 let
-  version = "0.13.1";
+  version = "0.14.0";
  src = fetchFromGitHub {
    owner = "Saghen";
    repo = "blink.cmp";
    tag = "v${version}";
-    hash = "sha256-eOlTkWMzQTZPPKPKUxg8Q2PwkOhfaQdrMZkg9Ew8t/g=";
+    hash = "sha256-aY+bBP3DOdr+yA0HKKUBR/87g096NXH9h4EUrIJY92Y=";
  };
  blink-fuzzy-lib = rustPlatform.buildRustPackage {
    inherit version src;
@@ -41,18 +40,8 @@ vimUtils.buildVimPlugin {
    ''
      mkdir -p target/release
      ln -s ${blink-fuzzy-lib}/lib/libblink_cmp_fuzzy${ext} target/release/libblink_cmp_fuzzy${ext}
-      echo -n "nix" > target/release/version
    '';

-  # TODO: Remove this patch when updating to next version
-  patches = [
-    (fetchpatch {
-      name = "blink-add-bypass-for-nix.patch";
-      url = "https://github.com/Saghen/blink.cmp/commit/6c83ef1ae34abd7ef9a32bfcd9595ac77b61037c.diff?full_index=1";
-      hash = "sha256-304F1gDDKVI1nXRvvQ0T1xBN+kHr3jdmwMMp8CNl+GU=";
-    })
-  ];
-
  passthru = {
    updateScript = nix-update-script {
      attrPath = "vimPlugins.blink-cmp.blink-fuzzy-lib";
@@ -0,0 +1,61 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  pkg-config,
+  vimUtils,
+  stdenv,
+  nix-update-script,
+}:
+let
+  version = "0.2.0";
+
+  src = fetchFromGitHub {
+    owner = "Saghen";
+    repo = "blink.pairs";
+    tag = "v${version}";
+    hash = "sha256-fOOo+UnrbQJFWyqjpiFwhytlPoPRnUlGswQdZb3/ws0=";
+  };
+
+  blink-pairs-lib = rustPlatform.buildRustPackage {
+    pname = "blink-pairs";
+    inherit version src;
+
+    useFetchCargoVendor = true;
+    cargoHash = "sha256-vkybRuym1yibaw943Gs9luYLdYEp4tgvA8e4maATiTY=";
+
+    nativeBuildInputs = [
+      pkg-config
+    ];
+  };
+in
+vimUtils.buildVimPlugin {
+  pname = "blink.pairs";
+  inherit version src;
+
+  preInstall =
+    let
+      ext = stdenv.hostPlatform.extensions.sharedLibrary;
+    in
+    ''
+      mkdir -p target/release
+      ln -s ${blink-pairs-lib}/lib/libblink_pairs${ext} target/release/
+    '';
+
+  passthru = {
+    updateScript = nix-update-script {
+      attrPath = "vimPlugins.blink-pairs.blink-pairs-lib";
+    };
+
+    # needed for the update script
+    inherit blink-pairs-lib;
+  };
+
+  meta = {
+    description = "Rainbow highlighting and intelligent auto-pairs for Neovim";
+    homepage = "https://github.com/Saghen/blink.pairs";
+    changelog = "https://github.com/Saghen/blink.pairs/blob/${src.tag}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ isabelroses ];
+  };
+}
@@ -308,6 +308,8 @@ in
    dependencies = [ self.plenary-nvim ];
  };

+  blink-pairs = callPackage ./non-generated/blink-pairs { };
+
  bluloco-nvim = super.bluloco-nvim.overrideAttrs {
    dependencies = [ self.lush-nvim ];
  };
@@ -4178,6 +4178,8 @@ let
        };
      };

+      rooveterinaryinc.roo-cline = callPackage ./rooveterinaryinc.roo-cline { };
+
      RoweWilsonFrederiskHolme.wikitext = buildVscodeMarketplaceExtension {
        mktplcRef = {
          name = "wikitext";
@@ -0,0 +1,21 @@
+{
+  lib,
+  vscode-utils,
+}:
+
+vscode-utils.buildVscodeMarketplaceExtension {
+  mktplcRef = {
+    publisher = "RooVeterinaryInc";
+    name = "roo-cline";
+    version = "3.8.6";
+    hash = "sha256-t3QUqe0qYizrJQcsEmYYmNYS/cpYiHQXJHtzHk9MGS8=";
+  };
+
+  meta = {
+    description = "AI-powered autonomous coding agent that lives in your editor";
+    downloadPage = "https://marketplace.visualstudio.com/items?itemName=RooVeterinaryInc.roo-cline";
+    homepage = "https://github.com/RooVetGit/Roo-Code";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ emaryn ];
+  };
+}
@@ -13,19 +13,19 @@ let
    {
      x86_64-linux = {
        arch = "linux-x64";
-        hash = "sha256-NdVSQQ5OeBPGSLbynUArNbfm+a2HCc/gwJMKfEDgzDM=";
+        hash = "sha256-M3m3fFsz/LPSmghyKVuLVcMgxtUf3iNvHDLjOptfs6I=";
      };
      aarch64-linux = {
        arch = "linux-arm64";
-        hash = "sha256-4FjA3mUz+DVBiMUJAlGkUbpDtZuDYuUHPWA4QUiqd5w=";
+        hash = "sha256-S3mMOtXYdVp5P8aKlzWyehVKCz7EjcNjYJqgSsNIS3g=";
      };
      x86_64-darwin = {
        arch = "darwin-x64";
-        hash = "sha256-aexe9hrUxb3ZnrgJrvEXu2PZPmxOGdkk9exrfDaXA7s=";
+        hash = "sha256-lIUM5W+lKL7OgcJVWJTJYsZNqpZ3MhSk7YnKsfWDX4U=";
      };
      aarch64-darwin = {
        arch = "darwin-arm64";
-        hash = "sha256-ijmKU+eU3R3mxeFxFr5AtVwGYVBuYWecD8W+0gHzP5w=";
+        hash = "sha256-Lc2W1SNdn1rcxeKgv1YzKRr+DPN39C1J6O1KZBeELWc=";
      };
    }
    .${system} or (throw "Unsupported system: ${system}");
@@ -37,7 +37,7 @@ vscode-utils.buildVscodeMarketplaceExtension {
    # Please update the corresponding binary (typos-lsp)
    # when updating this extension.
    # See pkgs/by-name/ty/typos-lsp/package.nix
-    version = "0.1.26";
+    version = "0.1.35";
    inherit (extInfo) hash arch;
  };

@@ -9,38 +9,36 @@
  jq,
 }:
 let
-  buildVscodeExtension =
-    a@{
-      pname ? null, # Only optional for backward compatibility.
-      src,
-      # Same as "Unique Identifier" on the extension's web page.
-      # For the moment, only serve as unique extension dir.
-      vscodeExtPublisher,
-      vscodeExtName,
-      vscodeExtUniqueId,
-      configurePhase ? ''
-        runHook preConfigure
-        runHook postConfigure
-      '',
-      buildPhase ? ''
-        runHook preBuild
-        runHook postBuild
-      '',
-      dontPatchELF ? true,
-      dontStrip ? true,
-      nativeBuildInputs ? [ ],
-      passthru ? { },
-      ...
-    }:
-    stdenv.mkDerivation (
-      (removeAttrs a [
-        "vscodeExtUniqueId"
-        "pname"
-      ])
-      // (lib.optionalAttrs (pname != null) {
+  buildVscodeExtension = lib.extendMkDerivation {
+    constructDrv = stdenv.mkDerivation;
+    excludeDrvArgNames = [
+      "vscodeExtUniqueId"
+    ];
+    extendDrvArgs =
+      finalAttrs:
+      {
+        pname ? null, # Only optional for backward compatibility.
+        # Same as "Unique Identifier" on the extension's web page.
+        # For the moment, only serve as unique extension dir.
+        vscodeExtPublisher,
+        vscodeExtName,
+        vscodeExtUniqueId,
+        configurePhase ? ''
+          runHook preConfigure
+          runHook postConfigure
+        '',
+        buildPhase ? ''
+          runHook preBuild
+          runHook postBuild
+        '',
+        dontPatchELF ? true,
+        dontStrip ? true,
+        nativeBuildInputs ? [ ],
+        passthru ? { },
+        ...
+      }:
+      {
        pname = "vscode-extension-${pname}";
-      })
-      // {

        passthru = passthru // {
          inherit vscodeExtPublisher vscodeExtName vscodeExtUniqueId;
@@ -57,12 +55,12 @@ let
        # If other directories are present but `sourceRoot` is unset, the unpacker phase fails.
        sourceRoot = "extension";

+        # This cannot be removed, it is used by some extensions.
        installPrefix = "share/vscode/extensions/${vscodeExtUniqueId}";

        nativeBuildInputs = [ unzip ] ++ nativeBuildInputs;

        installPhase = ''
-
          runHook preInstall

          mkdir -p "$out/$installPrefix"
@@ -70,36 +68,38 @@ let

          runHook postInstall
        '';
-      }
-    );
+      };
+  };

  fetchVsixFromVscodeMarketplace =
    mktplcExtRef: fetchurl (import ./mktplcExtRefToFetchArgs.nix mktplcExtRef);

-  buildVscodeMarketplaceExtension =
-    a@{
-      name ? "",
-      src ? null,
-      vsix ? null,
-      mktplcRef,
-      ...
-    }:
-    assert "" == name;
-    assert null == src;
-    buildVscodeExtension (
-      (removeAttrs a [
-        "mktplcRef"
-        "vsix"
-      ])
-      // {
+  buildVscodeMarketplaceExtension = lib.extendMkDerivation {
+    constructDrv = buildVscodeExtension;
+    excludeDrvArgNames = [
+      "mktplcRef"
+      "vsix"
+    ];
+    extendDrvArgs =
+      finalAttrs:
+      {
+        name ? "",
+        src ? null,
+        vsix ? null,
+        mktplcRef,
+        ...
+      }:
+      assert "" == name;
+      assert null == src;
+      {
+        inherit (mktplcRef) version;
        pname = "${mktplcRef.publisher}-${mktplcRef.name}";
-        version = mktplcRef.version;
        src = if (vsix != null) then vsix else fetchVsixFromVscodeMarketplace mktplcRef;
        vscodeExtPublisher = mktplcRef.publisher;
        vscodeExtName = mktplcRef.name;
        vscodeExtUniqueId = "${mktplcRef.publisher}.${mktplcRef.name}";
-      }
-    );
+      };
+  };

  mktplcRefAttrList = [
    "name"
@@ -26,11 +26,11 @@ let

  hash =
    {
-      x86_64-linux = "sha256-+RHzGJ5Y6j93ojnqg9hSe+Zs0sewcSSfWu8qlxJEoWQ=";
-      x86_64-darwin = "sha256-Yaxb7cB/JADJ4i2PScYb9ovTKiClwd7TdQXbzg9ViSs=";
-      aarch64-linux = "sha256-CK4geEBeLc1M5z4wuRS3rrqsL9nG1ra5+e3PGEOrYHA=";
-      aarch64-darwin = "sha256-S1XYikl1FzHvGBcudSD2xyuOH4gfsrYyEfwzL/csfSE=";
-      armv7l-linux = "sha256-aAgCL6clX/lXWdBmCSin/60krW5Sbn2KZZovmS16CfI=";
+      x86_64-linux = "sha256-vzLyLOC/4SDlIrsbVKDXu42nx7QLgK7TWkzKC1/tSQo=";
+      x86_64-darwin = "sha256-dLCepFyTht6hzdm1jZbhFKt6yNIbCZWlpxAkSfE9Fww=";
+      aarch64-linux = "sha256-Hiqrw6f7SWzdPQCV0s1d+cWwQ2u4PVDY8saL1Q+mZQg=";
+      aarch64-darwin = "sha256-zy+oI6MEHpxF8vOnE9EdjVm3LBAfgMas593hAJsWNz4=";
+      armv7l-linux = "sha256-Z0qnKm+axJTAHq8E69wYWpZOF9FuFRkdJmap4rFhbTY=";
    }
    .${system} or throwSystem;

@@ -41,7 +41,7 @@ callPackage ./generic.nix rec {

  # Please backport all compatible updates to the stable release.
  # This is important for the extension ecosystem.
-  version = "1.98.1.25070";
+  version = "1.98.2.25072";
  pname = "vscodium";

  executableName = "codium";
@@ -9,10 +9,10 @@

 buildMozillaMach rec {
  pname = "firefox";
-  version = "136.0.1";
+  version = "136.0.2";
  src = fetchurl {
    url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "e5833ccf97796c15b5156357427621d1f2d1d7ee55b53262f3935eadb98229c74a355bbe2f72a4168ec4e29dd3f83f4eaca99c5215d61bd087475331d3522abd";
+    sha512 = "50dfbedb6bd513a3c6cf90558d7c6993cc78558cccc69fcc882f8e54eb8e8bec9779dce6fb7211c1a0234ac4a189438c5fa55ee9d0d06fcbae5cf44778af2ef1";
  };

  meta = {
@@ -24,7 +24,7 @@ let
  vivaldiName = if isSnapshot then "vivaldi-snapshot" else "vivaldi";
 in stdenv.mkDerivation rec {
  pname = "vivaldi";
-  version = "7.1.3570.58";
+  version = "7.1.3570.60";

  suffix = {
    aarch64-linux = "arm64";
@@ -34,8 +34,8 @@ in stdenv.mkDerivation rec {
  src = fetchurl {
    url = "https://downloads.vivaldi.com/${branch}/vivaldi-${branch}_${version}-1_${suffix}.deb";
    hash = {
-      aarch64-linux = "sha256-t5dC6FZVU3mCoEwMMYAuTJ8VksCfjxYnxCVXdxDSqbI=";
-      x86_64-linux = "sha256-5qr9K57fFxnsDD7uy7qUIFWxH+UevGpLN2Z2td4h9RA=";
+      aarch64-linux = "sha256-x7CjbOrEb0+/1eqRoYTxA1RDxQeLJFmziuFcBapYaOU=";
+      x86_64-linux = "sha256-G0y49vUsFJTzxKRw1ZsXQvep7/MtGaO0FAF2nAinysw=";
    }.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
  };

@@ -207,13 +207,13 @@
    "vendorHash": "sha256-qFOfE4yWJfdPtGiGbk+oWzA06QvW0WCd6iUqEMTxBBk="
  },
  "buildkite": {
-    "hash": "sha256-ihP2q0sCKd4myqANLhKrBfIX+macLvJkQ+/3hMzVM3A=",
+    "hash": "sha256-Zlc82lncNf+jeYBck8QBJKuX4pmQmkkb4vYR+T8DoXU=",
    "homepage": "https://registry.terraform.io/providers/buildkite/buildkite",
    "owner": "buildkite",
    "repo": "terraform-provider-buildkite",
-    "rev": "v1.16.2",
+    "rev": "v1.16.3",
    "spdx": "MIT",
-    "vendorHash": "sha256-zl9RRAqDmNigtJIYMti2PgRSSg7KRys0H5BVAm6RW1k="
+    "vendorHash": "sha256-/d1oml8nUOBx6sOe1k43EhbAyfbObJJuoJCEaHQuIZs="
  },
  "ccloud": {
    "hash": "sha256-Dpx0eugcHCJV8GNPqjxx4P9ohgJgB10DTnHr+CeN/iQ=",
@@ -426,11 +426,11 @@
    "vendorHash": "sha256-aTQreRL0UTMYWLs25qsdwdN+PaJcOHwLRA8CjIAsYi0="
  },
  "exoscale": {
-    "hash": "sha256-r5wQQVbonGqZrzsr/gdbhrrbXC8ej/sMGvB1xk3pvUA=",
+    "hash": "sha256-fD2PQ/WNmifAlY27V0y47wDWEfhCXql0b1y8J5uSkNk=",
    "homepage": "https://registry.terraform.io/providers/exoscale/exoscale",
    "owner": "exoscale",
    "repo": "terraform-provider-exoscale",
-    "rev": "v0.62.3",
+    "rev": "v0.63.0",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
@@ -507,13 +507,13 @@
    "vendorHash": "sha256-VPJ0ekrGEzhIZ6ExrU5sLb2meFHT9cak53BO7z6BCC4="
  },
  "google": {
-    "hash": "sha256-qpqpb1uXREMMtd/3TyXIdn3e2TjLSTSP5if+g/e4XhU=",
+    "hash": "sha256-9xieQT5yY1h52/tksEmX9iYXtDjYxkSL/pvC2XPXN/4=",
    "homepage": "https://registry.terraform.io/providers/hashicorp/google",
    "owner": "hashicorp",
    "repo": "terraform-provider-google",
-    "rev": "v6.24.0",
+    "rev": "v6.25.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-UzoyVVBSrpxQnTfTJvGHIGR0wSFx8cSVVuTpo9tio2A="
+    "vendorHash": "sha256-kzugr8EaPROHy/3IVOsGkitpTixuiOw8R6kYedIrIuw="
  },
  "google-beta": {
    "hash": "sha256-1lrov28rU1K4QEiTuRqzaTLMzL+sZVsOLfgj3KNNJsw=",
@@ -642,11 +642,11 @@
    "vendorHash": null
  },
  "ibm": {
-    "hash": "sha256-VMiTOItbL8GV3gUlUu68WCzWgGLTh6Lk6S/fUkuMI68=",
+    "hash": "sha256-enisQ1DOrA4HBi0Sr+6ZNIKnbUoH3LCXBN11J03hPhc=",
    "homepage": "https://registry.terraform.io/providers/IBM-Cloud/ibm",
    "owner": "IBM-Cloud",
    "repo": "terraform-provider-ibm",
-    "rev": "v1.76.0",
+    "rev": "v1.76.1",
    "spdx": "MPL-2.0",
    "vendorHash": "sha256-YUCyq1GiFnXSmx9VvhYc3MGnrMXdnOuAVx9BKp1R2N8="
  },
@@ -913,11 +913,11 @@
    "vendorHash": null
  },
  "okta": {
-    "hash": "sha256-QvJ7yQmyOxhBltfckFC5Nkv7DXdpH79JRVF4BRAx+zs=",
+    "hash": "sha256-Yfs+yd5AgHL8Wl9/Zq922WJwJUOjoTshOa9RyI/AGZc=",
    "homepage": "https://registry.terraform.io/providers/okta/okta",
    "owner": "okta",
    "repo": "terraform-provider-okta",
-    "rev": "v4.14.1",
+    "rev": "v4.15.0",
    "spdx": "MPL-2.0",
    "vendorHash": "sha256-pykDVH44iZoOihiRr9rA9rEsCc9N6TD+UMbHelab6Nw="
  },
@@ -1120,13 +1120,13 @@
    "vendorHash": "sha256-Ry791h5AuYP03nex9nM8X5Mk6PeL7hNDbFyVRvVPJNE="
  },
  "scaleway": {
-    "hash": "sha256-ZMY69sfWN0281l+QEN6jUpVevYN7Z1CRDey+AqVDq8o=",
+    "hash": "sha256-5sLi0W5SKgaY8y85aFcVE/TE87SxpkGfhwYRF9fPf94=",
    "homepage": "https://registry.terraform.io/providers/scaleway/scaleway",
    "owner": "scaleway",
    "repo": "terraform-provider-scaleway",
-    "rev": "v2.50.0",
+    "rev": "v2.51.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-TbA6GlRSdyzkc64SU9Tn6o+DAvAN9RqR5M6DH83Tjng="
+    "vendorHash": "sha256-qIBSCRvKSfSjxM+PtcS815g0WOKHZzSK9yikXbYUWaw="
  },
  "secret": {
    "hash": "sha256-MmAnA/4SAPqLY/gYcJSTnEttQTsDd2kEdkQjQj6Bb+A=",
@@ -1373,13 +1373,13 @@
    "vendorHash": null
  },
  "utils": {
-    "hash": "sha256-rCTY06SEsppImhBZmx5AX58sOsI2NPJ5oK3+o64MIy8=",
+    "hash": "sha256-BnC5ihbOnua4ddTzM8mvWbKz5L13R2NT9c68teVLWo0=",
    "homepage": "https://registry.terraform.io/providers/cloudposse/utils",
    "owner": "cloudposse",
    "repo": "terraform-provider-utils",
-    "rev": "v1.28.0",
+    "rev": "v1.29.0",
    "spdx": "Apache-2.0",
-    "vendorHash": "sha256-Dxd/2TjxPoa+JcHlmmcoPx2wegZJzhbI1abNmF4wDik="
+    "vendorHash": "sha256-rHJabyfgu3wU79h3DHHYQauFmcR/SDuikauBF+CybZA="
  },
  "vault": {
    "hash": "sha256-GlRaV9CYm8IuIzeN/KRJWLCHIhc7Fdb5DL4fTA/dzV0=",
@@ -40,11 +40,11 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "gajim";
-  version = "2.0.2";
+  version = "2.0.3";

  src = fetchurl {
    url = "https://gajim.org/downloads/${lib.versions.majorMinor version}/gajim-${version}.tar.gz";
-    hash = "sha256-Qml1ggqjsTXGnGHntApwoa0ySlxUIi2S0IOY+lfxHeU=";
+    hash = "sha256-DbM80fyJ+jwB9Yc9vfoiDqW7Sx7MDR0OEkHdOC6nRG4=";
  };

  format = "pyproject";
@@ -8,13 +8,13 @@

 let
  pname = "mendeley";
-  version = "2.130.2";
+  version = "2.131.0";

  executableName = "${pname}-reference-manager";

  src = fetchurl {
    url = "https://static.mendeley.com/bin/desktop/mendeley-reference-manager-${version}-x86_64.AppImage";
-    hash = "sha256-HLUUoW+j0W9iEGu0Irbd/y7Vgj2rCGT7tDGMzmMh3qI=";
+    hash = "sha256-pVykRTs0yI9UArgxuE3RUKI8onv27hjyG1Dy4PXztuQ=";
  };

  appimageContents = appimageTools.extractType2 {
@@ -25,14 +25,14 @@ let
  };
 in
 stdenv.mkDerivation rec {
-  version = "16.3.9";
+  version = "16.3.11";
  pname = "jmol";

  src = let
    baseVersion = "${lib.versions.major version}.${lib.versions.minor version}";
  in fetchurl {
    url = "mirror://sourceforge/jmol/Jmol/Version%20${baseVersion}/Jmol%20${version}/Jmol-${version}-binary.tar.gz";
-    hash = "sha256-+Eh5484tW/U/YJb7sMf6W/QrsBz5j/aTrW4vnJobwiY=";
+    hash = "sha256-sa2wYzLtk3rSghNxk/kJfaOIDPEJLfwKRRIXMRNBEuI=";
  };

  patchPhase = ''
@@ -8,6 +8,20 @@

 let
  versions = [
+    {
+      version = "14.2.0";
+      lang = "en";
+      language = "English";
+      sha256 = "sha256-wIuyWufKuchPl7phCxVM9vIIkjUHfRxIECfDyGJliqs=";
+      installer = "Wolfram_14.2.0_LIN.sh";
+    }
+    {
+      version = "14.2.0";
+      lang = "en";
+      language = "English";
+      sha256 = "sha256-wY6acGoUc7y22enSi7RrcRFLvvPGaeYTta4yWExlXho=";
+      installer = "Wolfram_14.2.0_LIN_Bndl.sh";
+    }
    {
      version = "14.1.0";
      lang = "en";
@@ -17,13 +17,13 @@

 buildGoModule rec {
  pname = "cri-o";
-  version = "1.32.0";
+  version = "1.32.2";

  src = fetchFromGitHub {
    owner = "cri-o";
    repo = "cri-o";
    rev = "v${version}";
-    hash = "sha256-bjZjmgIYFroyUdBeUbrRz7dD0yQOqc9TDsGxvle1PnE=";
+    hash = "sha256-oB3X59+v4VosY5Db0BUfKt/WTMCWhhJX+mWwp/6ifVI=";
  };
  vendorHash = null;

@@ -1,15 +1,42 @@
-# This derivation builds two files containing information about the
-# closure of 'rootPaths': $out/store-paths contains the paths in the
-# closure, and $out/registration contains a file suitable for use with
-# "nix-store --load-db" and "nix-store --register-validity
-# --hash-given".
-
 {
  stdenvNoCC,
  coreutils,
  jq,
 }:

+/**
+  Produces metadata about the closure of the given root paths.
+
+  1. Total NAR size in `$out/total-nar-size`.
+  2. Registration, suitable for `nix-store --load-db`, in `$out/registration`.
+     Can also be used with `nix-store --register-validity --hash-given`.
+  3. All store paths for the closure in `$out/store-paths`.
+
+  # Inputs
+
+  `rootPaths` ([Path])
+
+  : List of root paths to include in the closure information.
+
+  # Type
+
+  ```
+  closureInfo :: { rootPaths :: [Path]; } -> Derivation
+  ```
+
+  # Examples
+  :::{.example}
+  ## `pkgs.closureInfo` usage example
+  ```
+  pkgs.closureInfo {
+    rootPaths = [ pkgs.hello pkgs.bc pkgs.dwarf2json ];
+  }
+  =>
+  «derivation /nix/store/...-closure-info.drv»
+  ```
+
+  :::
+*/
 { rootPaths }:

 assert builtins.langVersion >= 5;
@@ -2,21 +2,20 @@
  lib,
  stdenv,
  fetchFromGitLab,
-  dune_3,
  ocamlPackages,
 }:

 stdenv.mkDerivation {

  pname = "acgtk";
-  version = "2.0.0";
+  version = "2.1.0";

  src = fetchFromGitLab {
    domain = "gitlab.inria.fr";
    owner = "acg";
    repo = "dev/acgtk";
-    rev = "release-2.0.0-20231009";
-    hash = "sha256-ZymSQkBMBePPw7pJkfLkmqbIkQyIqB+7Pyrih2WAO50=";
+    tag = "release-2.1.0";
+    hash = "sha256-XuPcubt1lvnQio+km6MhmDu41NXNVXKKpzGd/Y1XzLo=";
  };

  strictDeps = true;
@@ -12,7 +12,7 @@ rustPlatform.buildRustPackage rec {
    owner = "joshrotenberg";
    repo = "adrs";
    rev = "v${version}";
-    hash = "sha256-BnbI5QsrnyEQFpTWqOPrbZnVa7J3vaByO9fnKd5t64o=";
+    hash = "sha256-C9Kg7xY3Q0xsd2DlUcc3OM+/hyzmwz55oi6Ul3K7zkM=";
  };

  useFetchCargoVendor = true;
@@ -8,17 +8,17 @@

 buildGoModule rec {
  pname = "aliyun-cli";
-  version = "3.0.256";
+  version = "3.0.259";

  src = fetchFromGitHub {
    owner = "aliyun";
    repo = "aliyun-cli";
    tag = "v${version}";
-    hash = "sha256-yB6y7A9MuZMBUqKfeJW8n8G9x7fIK8m9kcN2lV3Lknc=";
+    hash = "sha256-HF8vGEIIHIlHET4buHPTijPeomv0YNwX0bOSQrnyITw=";
    fetchSubmodules = true;
  };

-  vendorHash = "sha256-xPy9rVqityLWgVv9e/NbsWLoX2T20vMuqhoHLRYEkRk=";
+  vendorHash = "sha256-XpsMnt3AYHMn/js1E88RBxegKrTeaZYpRhHEuq4HDjM=";

  subPackages = [ "main" ];

@@ -16,17 +16,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "amdgpu_top";
-  version = "0.10.3";
+  version = "0.10.4";

  src = fetchFromGitHub {
    owner = "Umio-Yasuno";
    repo = "amdgpu_top";
    rev = "v${version}";
-    hash = "sha256-9PHMPyL2yg36vG+wax0Lb/LFT7CQWnBnZ+t38hr01PE=";
+    hash = "sha256-OvxrcVjngIW/fVIPX1XhbGImAeDifoLzlaZpXUYS9FA=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-W20jtH3w8LVqKwdf2ifwXKO2xgF3e/DuZ8vWqHOAGy0=";
+  cargoHash = "sha256-na6pghbJ7Ek+rdbX4qJt2kv7C3AAqpgU/nYHaT9CQdo=";

  buildInputs = [
    libdrm
@@ -11,6 +11,7 @@
  common-updater-scripts,
  jq,
  unzip,
+  typescript,
 }:

 stdenvNoCC.mkDerivation (finalAttrs: {
@@ -31,9 +32,12 @@ stdenvNoCC.mkDerivation (finalAttrs: {

  installPhase = ''
    runHook preInstall
-    install -Dm755 server/bin/ngserver $out/lib/bin/ngserver
-    install -Dm755 server/index.js $out/lib/index.js
-    cp -r node_modules $out/lib/node_modules
+    install -Dm555 server/bin/ngserver $out/lib/bin/ngserver
+    install -Dm444 server/index.js $out/lib/index.js
+    mkdir -p $out/lib/node_modules
+    cp -r node_modules/* $out/lib/node_modules
+    # do not use vendored typescript
+    rm -rf $out/lib/node_modules/typescript
    runHook postInstall
  '';

@@ -41,7 +45,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    patchShebangs $out/lib/bin/ngserver $out/lib/index.js $out/lib/node_modules
    makeWrapper $out/lib/bin/ngserver $out/bin/ngserver \
      --prefix PATH : ${lib.makeBinPath [ nodejs ]} \
-      --add-flags "--tsProbeLocations $out/lib/node_modules --ngProbeLocations $out/lib/node_modules"
+      --add-flags "--tsProbeLocations ${typescript}/lib/node_modules/typescript --ngProbeLocations $out/lib/node_modules"
  '';

  passthru = {
@@ -9,14 +9,14 @@

 stdenv.mkDerivation rec {
  pname = "apktool";
-  version = "2.11.0";
+  version = "2.11.1";

  src = fetchurl {
    urls = [
      "https://bitbucket.org/iBotPeaches/apktool/downloads/apktool_${version}.jar"
      "https://github.com/iBotPeaches/Apktool/releases/download/v${version}/apktool_${version}.jar"
    ];
-    hash = "sha256-j9wXxv4ubYDXG4cY6ypdA3nxzHE5rnd/akmc45eyb1Q=";
+    hash = "sha256-VtWcUk/HZCY7qNNFdU2Nr1WxiHgYsVzTtZT1VdJJ4ts=";
  };

  dontUnpack = true;
@@ -12,13 +12,13 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "ast-grep";
-  version = "0.35.0";
+  version = "0.36.1";

  src = fetchFromGitHub {
    owner = "ast-grep";
    repo = "ast-grep";
    tag = finalAttrs.version;
-    hash = "sha256-uiQYqVcSSQT32Vu8iE5ATIHFGDiyuxaQvg8hkBtB4DU=";
+    hash = "sha256-u2eRdOreThaTAe3Uo4C6K3u3qtfW+sow9w+Q3uqtPGs=";
  };

  # error: linker `aarch64-linux-gnu-gcc` not found
@@ -27,7 +27,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
  '';

  useFetchCargoVendor = true;
-  cargoHash = "sha256-B/egtLMBrlLobB1m04L1NlNmZ6+DdQIV9Ae0LVPmO2Y=";
+  cargoHash = "sha256-Nmmka1AxWhY3InOSmxiL9gg6sznrP8yQuC0EgAywATA=";

  nativeBuildInputs = [ installShellFiles ];

@@ -1,9 +1,9 @@
 {
  "owner": "advplyr",
  "repo": "audiobookshelf",
-  "rev": "c7d8021a16012a5493ae53a1310d2000887204a5",
-  "hash": "sha256-z0AUl2BbS1Ts6M1rz3V9ZZ7SLmfyJ1KEdmE4/bWRYFk=",
-  "version": "2.19.5",
-  "depsHash": "sha256-YAxq277klfCw+tW/vcUFdwV9ucleg7WCBsDYHh5pjMo=",
-  "clientDepsHash": "sha256-6+IxIHZdI/Fm/yqxpB+qX5jI4/Ne3EgRArIRfSG/sR8="
+  "rev": "38f05a857ff3cec50bafb594b5d0ab49d6c585ae",
+  "hash": "sha256-FFZPhQRqmL6pp5aS6qg1Dhf80PAFE2O9oDJB5kSHL50=",
+  "version": "2.20.0",
+  "depsHash": "sha256-mB57omyxV338K4LpNMfIThLc2Mz71NqEyFTjWrfAo10=",
+  "clientDepsHash": "sha256-Wnmue1aGWN9rwP3xYp5q+POP85tHY5gbYBQMKXu9H3Q="
 }
@@ -64,14 +64,14 @@ let
 in
 py.pkgs.buildPythonApplication rec {
  pname = "awscli2";
-  version = "2.24.22"; # N.B: if you change this, check if overrides are still up-to-date
+  version = "2.24.24"; # N.B: if you change this, check if overrides are still up-to-date
  pyproject = true;

  src = fetchFromGitHub {
    owner = "aws";
    repo = "aws-cli";
    tag = version;
-    hash = "sha256-cqDBUwc9E9TPN5E4CaCxc5sAZgCXalgl2ejGftyzV1k=";
+    hash = "sha256-v2SdbWE+pxDFEtbwDd3sdVvLWGyeNm+9pKlTzqbgJFU=";
  };

  postPatch = ''
@@ -13,13 +13,13 @@ telegram-desktop.override {
  unwrapped = telegram-desktop.unwrapped.overrideAttrs (
    finalAttrs: previousAttrs: {
      pname = "ayugram-desktop-unwrapped";
-      version = "5.11.1";
+      version = "5.12.3";

      src = fetchFromGitHub {
        owner = "AyuGram";
        repo = "AyuGramDesktop";
        tag = "v${finalAttrs.version}";
-        hash = "sha256-AiMPbcEvbyhGd1V9mg95Q+mLrBH0DqTEFpC3D9ziCy8=";
+        hash = "sha256-Zjik+9J0YtabVW1VEkJr/Bl3SIakVQ8EiTLYm28rEIk=";
        fetchSubmodules = true;
      };

@@ -0,0 +1,94 @@
+{
+  autoPatchelfHook,
+  copyDesktopItems,
+  dbus,
+  fetchurl,
+  fontconfig,
+  freetype,
+  lib,
+  libGLU,
+  libxkbcommon,
+  makeDesktopItem,
+  stdenv,
+  unzip,
+  wayland,
+  xcbutilimage,
+  xcbutilkeysyms,
+  xcbutilrenderutil,
+  xcbutilwm,
+}:
+stdenv.mkDerivation rec {
+  pname = "binaryninja-free";
+  version = "4.2.6455";
+
+  src = fetchurl {
+    url = "https://web.archive.org/web/20241209150225/https://cdn.binary.ninja/installers/binaryninja_free_linux.zip";
+    hash = "sha256-NOVuLmko8iYcJ/0fr0DNw7xPEC8EhT/SzcFWtNmjlYI=";
+  };
+
+  icon = fetchurl {
+    url = "https://raw.githubusercontent.com/Vector35/binaryninja-api/448f40be71dffa86a6581c3696627ccc1bdf74f2/docs/img/logo.png";
+    hash = "sha256-TzGAAefTknnOBj70IHe64D6VwRKqIDpL4+o9kTw0Mn4=";
+  };
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "com.vector35.binaryninja";
+      desktopName = "Binary Ninja Free";
+      comment = "A Reverse Engineering Platform";
+      exec = "binaryninja";
+      icon = "binaryninja";
+      mimeTypes = [
+        "application/x-binaryninja"
+        "x-scheme-handler/binaryninja"
+      ];
+      categories = [ "Utility" ];
+    })
+  ];
+
+  nativeBuildInputs = [
+    unzip
+    autoPatchelfHook
+    copyDesktopItems
+  ];
+
+  buildInputs = [
+    dbus
+    fontconfig
+    freetype
+    libGLU
+    libxkbcommon
+    stdenv.cc.cc.lib
+    wayland
+    xcbutilimage
+    xcbutilkeysyms
+    xcbutilrenderutil
+    xcbutilwm
+  ];
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/
+    cp -R . $out/
+
+    mkdir $out/bin
+    ln -s $out/binaryninja $out/bin/binaryninja
+
+    install -Dm644 ${icon} $out/share/icons/hicolor/256x256/apps/binaryninja.png
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Interactive decompiler, disassembler, debugger";
+    homepage = "https://binary.ninja/";
+    license = {
+      fullName = "Binary Ninja Free Software License";
+      url = "https://docs.binary.ninja/about/license.html#free-license";
+      free = false;
+    };
+    mainProgram = "binaryninja";
+    maintainers = with lib.maintainers; [ scoder12 ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
@@ -6,13 +6,13 @@
 }:
 buildGoModule rec {
  pname = "bitrise";
-  version = "2.30.4";
+  version = "2.30.5";

  src = fetchFromGitHub {
    owner = "bitrise-io";
    repo = "bitrise";
    rev = "v${version}";
-    hash = "sha256-wQIoNekr4zXjhAp9XnyJ92hJ4usuWBBT1koUguGIIiU=";
+    hash = "sha256-j7Gbr+j/5RnM7S6eRZZkmlXgY+vBgfTJ5ZaLz8o7pww=";
  };

  # many tests rely on writable $HOME/.bitrise and require network access
@@ -15,15 +15,15 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "buffybox";
-  version = "3.2.0-unstable-2025-02-27";
+  version = "3.2.0-unstable-2025-03-12";

  src = fetchFromGitLab {
    domain = "gitlab.postmarketos.org";
    owner = "postmarketOS";
    repo = "buffybox";
    fetchSubmodules = true; # to use its vendored lvgl
-    rev = "6bf7a8406f3a3fa79831d2d151e519b703b9e135";
-    hash = "sha256-q3TNYRv5Cim+WklXw2ZTW6Ico1h8Xxs9MhTFhHZUMW0=";
+    rev = "3196e47d519c78b56a8d4b75ad7a280c92c91d23";
+    hash = "sha256-Zl/QmOJbY/lxoCYD6SpUHiiTTDOStUSn3+6xOuiGGBo=";
  };

  depsBuildBuild = [
@@ -6,6 +6,7 @@
  testers,
  bundler,
  versionCheckHook,
+  nix-update-script,
 }:

 buildRubyGem rec {
@@ -28,20 +29,7 @@ buildRubyGem rec {
  doInstallCheck = true;

  passthru = {
-    updateScript = writeScript "gem-update-script" ''
-      #!/usr/bin/env nix-shell
-      #!nix-shell -i bash -p curl common-updater-scripts jq
-
-      set -eu -o pipefail
-
-      latest_version=$(curl -s https://rubygems.org/api/v1/gems/${gemName}.json | jq --raw-output .version)
-      update-source-version ${gemName} "$latest_version"
-    '';
-    tests.version = testers.testVersion {
-      package = bundler;
-      command = "bundler -v";
-      version = version;
-    };
+    updateScript = nix-update-script { };
  };

  meta = {
@@ -20,7 +20,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "ccache";
-  version = "4.11";
+  version = "4.11.1";

  src = fetchFromGitHub {
    owner = "ccache";
@@ -39,7 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
        exit 1
      fi
    '';
-    hash = "sha256-hMQ+4/5kk+QRHtMEbIk4TIWaSyYXVdXrOMKCkglNe6g=";
+    hash = "sha256-oYuvcM1BkOh+fj6FmZ8GiiyMyNCAHNp+zQdYvoAb/lU=";
  };

  outputs = [
@@ -5,15 +5,15 @@
 }:
 rustPlatform.buildRustPackage rec {
  pname = "cfonts";
-  version = "1.1.3";
+  version = "1.2.0";

  src = fetchCrate {
    inherit pname version;
-    hash = "sha256-ixxDlHjx5Bi6Wl/kzJ/R7d+jgTDCAti25TV1RlXRPus=";
+    hash = "sha256-W5hN+b4R50tNfYb3WrM0z5Etm6ixa11pZWnzGC9bjSs=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-eJM3CS3I++p6Pk/K8vkD/H/RAmD+eQJ+//It/Jn5dX4=";
+  cargoHash = "sha256-MXUUvk7R1JdjNlZ7h3ymUAPOT/A0I8TOW3saBB4C94o=";

  meta = with lib; {
    homepage = "https://github.com/dominikwilkowski/cfonts";
@@ -11,14 +11,14 @@

 python3Packages.buildPythonApplication {
  pname = "chirp";
-  version = "0.4.0-unstable-2025-03-07";
+  version = "0.4.0-unstable-2025-03-17";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "kk7ds";
    repo = "chirp";
-    rev = "7ba82c4faca496cf1370554a3485c1573b6a38a0";
-    hash = "sha256-UhQF6yfykraz5DblyW8cSP/XY+j/uxJtUVDpgdWlHZU=";
+    rev = "7d0a609a24efa7861a9cedd0abe057a250857d97";
+    hash = "sha256-BL5+z3CFInCEXgwyx4sHaHbUXLWwe/JWevD1ZDxQStQ=";
  };

  nativeBuildInputs = [
@@ -6,17 +6,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "circom";
-  version = "2.2.1";
+  version = "2.2.2";

  src = fetchFromGitHub {
    owner = "iden3";
    repo = "circom";
    rev = "v${version}";
-    hash = "sha256-Vwu2DAWIqzqgo6oXcQxvhn7ssGojQkRRw9sKk7qjREk=";
+    hash = "sha256-BSInX4owuamRWnlKL1yJJOyzRIiE55TIzCk2TdX7aOQ=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-64mKd3M5EpqWASTPz7cqNbDyh4be7xR4fudjcx029u8=";
+  cargoHash = "sha256-dkgLp6BKuublS97iRXYzbT4ztbWBD5IDMz9rDY9XgcA=";
  doCheck = false;

  meta = with lib; {
@@ -5,13 +5,13 @@
  "packages": {
    "": {
      "dependencies": {
-        "@anthropic-ai/claude-code": "^0.2.41"
+        "@anthropic-ai/claude-code": "^0.2.48"
      }
    },
    "node_modules/@anthropic-ai/claude-code": {
-      "version": "0.2.41",
-      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-0.2.41.tgz",
-      "integrity": "sha512-tbzmDPsD+WQ/KnA92kKpxb3/PEYk1FDbpIMvbzXFuXDONXW66o4seTl4JcpBVtb9zk5wv6srTlB7M9Nn7Tel1A==",
+      "version": "0.2.48",
+      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-0.2.48.tgz",
+      "integrity": "sha512-Av9EC7oBGSgNzJ8IFyYQnzCURtzmUZb1fRL+4vKJunCF33nCkTW82DEOKsfcj+Z268/Pf8WhXuI/vLbwpMdymw==",
      "hasInstallScript": true,
      "license": "SEE LICENSE IN README.md",
      "bin": {
@@ -6,14 +6,14 @@

 buildNpmPackage rec {
  pname = "claude-code";
-  version = "0.2.41";
+  version = "0.2.48";

  src = fetchzip {
    url = "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-${version}.tgz";
-    hash = "sha256-HxPdULdggaFeNkRnrqIU2Y7HC6F8UdqRLTl8QiLV8wg=";
+    hash = "sha256-zocgUMHWAPhA9ebqfeVCMHuJ1QBX3q8Y/dDjsxKhPv4=";
  };

-  npmDepsHash = "sha256-VcB39pBEVF0PFOPDZVS6FH2UpSrIATjGueoZAxb33DA=";
+  npmDepsHash = "sha256-kwq08sKDZDH0eM5gAj+HllQkadDqgyNxMd2xmiTZvq8=";

  postPatch = ''
    cp ${./package-lock.json} package-lock.json
@@ -7,17 +7,17 @@

 buildGoModule rec {
  pname = "codeberg-pages";
-  version = "6.2";
+  version = "6.2.1";

  src = fetchFromGitea {
    domain = "codeberg.org";
    owner = "Codeberg";
    repo = "pages-server";
    rev = "v${version}";
-    hash = "sha256-VZIrg6Hzn9yP9zdOPGx6HOK64XHeX5xc52hZXwmuMKA=";
+    hash = "sha256-kWEwKdm/GAUtsc4ZyCn7VJm9vVWDBOHJRer2FP1L/g0=";
  };

-  vendorHash = "sha256-pBCVkuCuyUxla6+uZM3SWXApBpMv0rFORP4tffXkuF4=";
+  vendorHash = "sha256-qGjcMZhwflYdwOrGS9EApkwVLLSolQBBIeU8AU/fT/I=";

  postPatch = ''
    # disable httptest
@@ -0,0 +1,65 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  openmpi,
+
+  # passthru
+  conduit,
+  nix-update-script,
+
+  mpiSupport ? false,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "conduit";
+  version = "0.9.3";
+
+  src = fetchFromGitHub {
+    owner = "LLNL";
+    repo = "conduit";
+    tag = "v${finalAttrs.version}";
+    fetchSubmodules = true;
+    hash = "sha256-R7DiMwaMG9VfqDJiO3kFPb76j6P2GZl/6qLxDfVex8A=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+  ];
+
+  cmakeDir = "../src";
+
+  buildInputs = lib.optionals mpiSupport [
+    openmpi
+  ];
+
+  cmakeFlags = [
+    (lib.cmakeBool "ENABLE_MPI" mpiSupport)
+  ];
+
+  installCheckPhase = ''
+    runHook preInstallCheck
+
+    make test
+
+    runHook postInstallCheck
+  '';
+  doInstallCheck = true;
+
+  passthru = {
+    tests = {
+      withMpi = conduit.override { mpiSupport = true; };
+    };
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "Simplified Data Exchange for HPC Simulations";
+    homepage = "https://github.com/LLNL/conduit";
+    changelog = "https://github.com/LLNL/conduit/blob/v${finalAttrs.version}/CHANGELOG.md";
+    license = lib.licenses.bsd3Lbnl;
+    maintainers = with lib.maintainers; [ GaetanLepage ];
+    platforms = lib.platforms.all;
+  };
+})
@@ -1,82 +1,108 @@
 {
  lib,
  stdenv,
+  stdenvAdapters,
  fetchFromGitHub,
  rustPlatform,
  cmake,
-  makeBinaryWrapper,
-  cosmic-icons,
-  cosmic-randr,
  just,
+  libcosmicAppHook,
  pkg-config,
-  libxkbcommon,
+  expat,
  libinput,
  fontconfig,
  freetype,
-  wayland,
-  expat,
+  pipewire,
+  pulseaudio,
  udev,
  util-linux,
+  cosmic-randr,
+  xkeyboard_config,
+  nix-update-script,
+
+  withMoldLinker ? stdenv.targetPlatform.isLinux,
 }:
-
-rustPlatform.buildRustPackage rec {
-  pname = "cosmic-settings";
-  version = "1.0.0-alpha.1";
-
-  src = fetchFromGitHub {
-    owner = "pop-os";
-    repo = "cosmic-settings";
-    rev = "epoch-${version}";
-    hash = "sha256-gTzZvhj7oBuL23dtedqfxUCT413eMoDc0rlNeqCeZ6E=";
+let
+  libcosmicAppHook' = (libcosmicAppHook.__spliced.buildHost or libcosmicAppHook).override {
+    includeSettings = false;
  };
+in
+rustPlatform.buildRustPackage.override
+  { stdenv = if withMoldLinker then stdenvAdapters.useMoldLinker stdenv else stdenv; }
+  (finalAttrs: {
+    pname = "cosmic-settings";
+    version = "1.0.0-alpha.6";

-  useFetchCargoVendor = true;
-  cargoHash = "sha256-zMHJc6ytbOoi9E47Zsg6zhbQKObsaOtVHuPnLAu36I4=";
+    src = fetchFromGitHub {
+      owner = "pop-os";
+      repo = "cosmic-settings";
+      tag = "epoch-${finalAttrs.version}";
+      hash = "sha256-UKg3TIpyaqtynk6wLFFPpv69F74hmqfMVPra2+iFbvE=";
+    };

-  postPatch = ''
-    substituteInPlace justfile --replace '#!/usr/bin/env' "#!$(command -v env)"
-  '';
+    useFetchCargoVendor = true;
+    cargoHash = "sha256-mf/Cw3/RLrCYgsk7JKCU2+oPn1VPbD+4JzkUmbd47m8=";

-  nativeBuildInputs = [
-    cmake
-    just
-    pkg-config
-    makeBinaryWrapper
-  ];
-  buildInputs = [
-    libxkbcommon
-    libinput
-    fontconfig
-    freetype
-    wayland
-    expat
-    udev
-    util-linux
-  ];
+    nativeBuildInputs = [
+      cmake
+      just
+      libcosmicAppHook'
+      pkg-config
+      rustPlatform.bindgenHook
+      util-linux
+    ];

-  dontUseJustBuild = true;
+    buildInputs = [
+      expat
+      fontconfig
+      freetype
+      libinput
+      pipewire
+      pulseaudio
+      udev
+    ];

-  justFlags = [
-    "--set"
-    "prefix"
-    (placeholder "out")
-    "--set"
-    "bin-src"
-    "target/${stdenv.hostPlatform.rust.cargoShortTarget}/release/cosmic-settings"
-  ];
+    dontUseJustBuild = true;
+    dontUseJustCheck = true;

-  postInstall = ''
-    wrapProgram "$out/bin/cosmic-settings" \
-      --prefix PATH : ${lib.makeBinPath [ cosmic-randr ]} \
-      --suffix XDG_DATA_DIRS : "$out/share:${cosmic-icons}/share"
-  '';
+    justFlags = [
+      "--set"
+      "prefix"
+      (placeholder "out")
+      "--set"
+      "bin-src"
+      "target/${stdenv.hostPlatform.rust.cargoShortTarget}/release/cosmic-settings"
+    ];

-  meta = with lib; {
-    homepage = "https://github.com/pop-os/cosmic-settings";
-    description = "Settings for the COSMIC Desktop Environment";
-    license = licenses.gpl3Only;
-    maintainers = with maintainers; [ nyabinary ];
-    platforms = platforms.linux;
-    mainProgram = "cosmic-settings";
-  };
-}
+    env."CARGO_TARGET_${stdenv.hostPlatform.rust.cargoEnvVarTarget}_RUSTFLAGS" =
+      lib.optionalString withMoldLinker "-C link-arg=-fuse-ld=mold";
+
+    preFixup = ''
+      libcosmicAppWrapperArgs+=(
+        --prefix PATH : ${lib.makeBinPath [ cosmic-randr ]}
+        --set-default X11_BASE_RULES_XML ${xkeyboard_config}/share/X11/xkb/rules/base.xml
+        --set-default X11_BASE_EXTRA_RULES_XML ${xkeyboard_config}/share/X11/xkb/rules/extra.xml
+      )
+    '';
+
+    passthru.updateScript = nix-update-script {
+      extraArgs = [
+        "--version"
+        "unstable"
+        "--version-regex"
+        "epoch-(.*)"
+      ];
+    };
+
+    meta = {
+      description = "Settings for the COSMIC Desktop Environment";
+      homepage = "https://github.com/pop-os/cosmic-settings";
+      license = lib.licenses.gpl3Only;
+      mainProgram = "cosmic-settings";
+      maintainers = with lib.maintainers; [
+        nyabinary
+        HeitorAugustoLN
+      ];
+      platforms = lib.platforms.linux;
+    };
+  })
@@ -22,13 +22,13 @@

 stdenv.mkDerivation rec {
  pname = "createrepo_c";
-  version = "1.2.0";
+  version = "1.2.1";

  src = fetchFromGitHub {
    owner = "rpm-software-management";
    repo = "createrepo_c";
    tag = version;
-    hash = "sha256-IWn1in1AMN4brekerj+zu1OjTl+PE7fthU5+gcBzVU0=";
+    hash = "sha256-2mvU2F9rvG4FtDgq+M9VXWg+c+AsW/+tDPaEj7zVmQ0=";
  };

  postPatch = ''
@@ -83,11 +83,14 @@ stdenv.mkDerivation rec {
    pkg-config
  ];

-  meta = with lib; {
+  meta = {
    description = "Music notation and composition software used with lilypond";
    homepage = "http://denemo.org";
-    license = licenses.gpl3;
-    platforms = platforms.linux;
-    maintainers = [ maintainers.olynch ];
+    license = lib.licenses.gpl3;
+    platforms = lib.platforms.linux;
+    maintainers = [ lib.maintainers.olynch ];
+    # sffile.c:38:10: error: implicit declaration of function 'isprint' [-Wimplicit-function-declaration]
+    # sffile.c:54:10: error: type defaults to 'int' in declaration of 'initialized' [-Wimplicit-int]
+    broken = true;
  };
 }
@@ -8,7 +8,7 @@

 let
  themeName = "Dracula";
-  version = "4.0.0-unstable-2025-03-04";
+  version = "4.0.0-unstable-2025-03-13";
 in
 stdenvNoCC.mkDerivation {
  pname = "dracula-theme";
@@ -17,8 +17,8 @@ stdenvNoCC.mkDerivation {
  src = fetchFromGitHub {
    owner = "dracula";
    repo = "gtk";
-    rev = "285ff8f10084b5fdae045a8e8d09352be9af4452";
-    hash = "sha256-DGUEHKlQqJ3yt6Anm+LIhSgaUjE+CvdIQZyrrPGV8HQ=";
+    rev = "fc59294cf67110f6487f5fd06d3c845ffffdf1a9";
+    hash = "sha256-hFiYb1KqYvH66OIhmIUP3DfkSkuYgE78ihjkEaAY7LM=";
  };

  propagatedUserEnvPkgs = [
@@ -22,13 +22,13 @@
 let
  self = python3.pkgs.buildPythonApplication rec {
    pname = "duplicity";
-    version = "3.0.3.2";
+    version = "3.0.4";

    src = fetchFromGitLab {
      owner = "duplicity";
      repo = "duplicity";
      rev = "rel.${version}";
-      hash = "sha256-aP2+MIV9EgwGb9detibHzW2AJdbnP+9ur9Y/Irw26qM=";
+      hash = "sha256-FoaKuB0mo2RFksMHnIUx984+h/U0tdvk+bvsuYt3r5g=";
    };

    patches = [
@@ -51,9 +51,11 @@ let
          --replace-fail /usr/bin /dev
      '';

-    disabledTests = lib.optionals stdenv.hostPlatform.isDarwin [
-      # uses /tmp/
-      "testing/unit/test_cli_main.py::CommandlineTest::test_intermixed_args"
+    disabledTests = [
+      # fails on some unsupported backends, e.g.
+      # ************* Module duplicity.backends.swiftbackend
+      # duplicity/backends/swiftbackend.py:176: [E0401(import-error), SwiftBackend._put] Unable to import 'swiftclient.service'
+      "test_pylint"
    ];

    nativeBuildInputs = [
@@ -62,6 +64,9 @@ let
      python3.pkgs.wrapPython
      wrapGAppsNoGuiHook
      python3.pkgs.setuptools-scm
+      python3.pkgs.pycodestyle
+      python3.pkgs.black
+      python3.pkgs.pylint
    ];

    buildInputs = [
@@ -7,16 +7,16 @@

 buildGoModule rec {
  pname = "dyff";
-  version = "1.10.0";
+  version = "1.10.1";

  src = fetchFromGitHub {
    owner = "homeport";
    repo = "dyff";
    rev = "v${version}";
-    sha256 = "sha256-MVqj/RgUwN7andCPMo7Tp4zBhEaSNM0loWnQ/E5U1S8=";
+    sha256 = "sha256-dioahL3dWK+rNAcThv2vYyoGaIIFhcd5li9gtwjtGzM=";
  };

-  vendorHash = "sha256-PH3huLNc0jFBvo3/Z/BNCeL0HxTUc5OaNysa54wKthY=";
+  vendorHash = "sha256-5uAe6bnYhncr2A+Y/HEjv9agvKp+1D2JH66zIDIeDro=";

  subPackages = [
    "cmd/dyff"
@@ -8,13 +8,13 @@

 stdenv.mkDerivation rec {
  pname = "eigenmath";
-  version = "337-unstable-2025-03-05";
+  version = "337-unstable-2025-03-16";

  src = fetchFromGitHub {
    owner = "georgeweigt";
    repo = pname;
-    rev = "8fc8573000f40a8322f7fc140f384cf79e8c4a7f";
-    hash = "sha256-MQnQmxafJhwxVJ+iAwAm48nFCE9QVel56xWgX8egmOk=";
+    rev = "622740aa22d11d08016d0ac962aa920f5e38f223";
+    hash = "sha256-sFiCYvp+SC8CnkMfoUXpAPFySd5nxiqLRVGiWsZ4FcY=";
  };

  checkPhase =
@@ -1,15 +1,21 @@
-{ lib, stdenv, fetchFromGitHub, python3Packages, wrapQtAppsHook
-, secp256k1, qtwayland }:
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  python3Packages,
+  qt5,
+  secp256k1,
+}:

 python3Packages.buildPythonApplication rec {
  pname = "electron-cash";
-  version = "4.3.1";
+  version = "4.4.2";

  src = fetchFromGitHub {
    owner = "Electron-Cash";
    repo = "Electron-Cash";
    tag = version;
-    sha256 = "sha256-xOyj5XerOwgfvI0qj7+7oshDvd18h5IeZvcJTis8nWo=";
+    sha256 = "sha256-hqaPxetS6JONvlRMjNonXUGFpdmnuadD00gcPzY07x0=";
  };

  build-system = with python3Packages; [
@@ -38,6 +44,7 @@ python3Packages.buildPythonApplication rec {
    psutil
    pycryptodomex
    cryptography
+    zxing-cpp

    # requirements-hw
    trezor
@@ -49,36 +56,42 @@ python3Packages.buildPythonApplication rec {
    pysatochip
  ];

-  nativeBuildInputs = [ wrapQtAppsHook ];
+  nativeBuildInputs = [ qt5.wrapQtAppsHook ];

-  buildInputs = [ ] ++ lib.optional stdenv.hostPlatform.isLinux qtwayland;
-
-  postPatch = ''
-    substituteInPlace contrib/requirements/requirements.txt \
-      --replace "qdarkstyle==2.6.8" "qdarkstyle<3"
-
-    substituteInPlace setup.py \
-      --replace "(share_dir" "(\"share\""
-  '';
+  buildInputs = [ ] ++ lib.optional stdenv.hostPlatform.isLinux qt5.qtwayland;

  # If secp256k1 wasn't added to the library path, the following warning is given:
  #
  #   Electron Cash was unable to find the secp256k1 library on this system.
  #   Elliptic curve cryptography operations will be performed in slow
  #   Python-only mode.
+  #
+  # Upstream hardcoded `libsecp256k1.so.0` where we provides
+  # `libsecp256k1.so.5`. The only breaking change is the removal of two
+  # functions which seem not used by electron-cash.
+  # See: <https://github.com/Electron-Cash/Electron-Cash/issues/3009>
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace-fail "(share_dir" '("share"'
+    substituteInPlace electroncash/secp256k1.py \
+      --replace-fail "libsecp256k1.so.0" "${secp256k1}/lib/libsecp256k1.so.5"
+  '';
+
  preFixup = ''
    makeWrapperArgs+=("''${qtWrapperArgs[@]}")
-    makeWrapperArgs+=(
-      "--prefix" "LD_LIBRARY_PATH" ":" "${secp256k1}/lib"
-    )
  '';

  doInstallCheck = true;
  installCheckPhase = ''
-    $out/bin/electron-cash help >/dev/null
+    output="$($out/bin/electron-cash help 2>&1)"
+    if [[ "$output" == *"failed to load"* ]]; then
+      echo "$output"
+      echo "Forbidden text detected: failed to load"
+      exit 1
+    fi
  '';

-  meta = with lib; {
+  meta = {
    description = "Bitcoin Cash SPV Wallet";
    mainProgram = "electron-cash";
    longDescription = ''
@@ -88,8 +101,12 @@ python3Packages.buildPythonApplication rec {
      of the blockchain.
    '';
    homepage = "https://www.electroncash.org/";
-    platforms = platforms.unix;
-    maintainers = with maintainers; [ lassulus nyanloutre oxalica ];
-    license = licenses.mit;
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [
+      lassulus
+      nyanloutre
+      oxalica
+    ];
+    license = lib.licenses.mit;
  };
 }
@@ -6,17 +6,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "evtx";
-  version = "0.8.5";
+  version = "0.9.0";

  src = fetchFromGitHub {
    owner = "omerbenamram";
    repo = "evtx";
    tag = "v${version}";
-    hash = "sha256-qDJc8QL1nlbV9iIXZYh38N1giz6uEZtt/hjaZWE6JbE=";
+    hash = "sha256-fgOuhNE77zVjL16oiUifnKZ+X4CQnZuD8tY+h0JTOYU=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-aHc4u2sW2TIK2P/P9MdR0lgTKbY1ruevCRxghW/dii0=";
+  cargoHash = "sha256-E9BoqpnKhVNwOiEvZROF3xj9Ge8r2CNaBiwHdkdV5aw=";

  postPatch = ''
    # CLI tests will fail in the sandbox
@@ -49,13 +49,21 @@ let
  };

  expressvpndFHS = buildFHSEnv {
-    inherit pname version;
+    inherit version;
+    pname = "expressvpnd";

    # When connected, it directly creates/deletes resolv.conf to change the DNS entries.
    # Since it's running in an FHS environment, it has no effect on actual resolv.conf.
    # Hence, place a watcher that updates host resolv.conf when FHS resolv.conf changes.
+
+    # Mount the host's resolv.conf to the container's /etc/resolv.conf
    runScript = writeScript "${pname}-wrapper" ''
-      cp /host/etc/resolv.conf /etc/resolv.conf;
+      mkdir -p /host/etc
+      [ -e /host/etc/resolv.conf ] || touch /host/etc/resolv.conf
+      mount --bind /etc/resolv.conf /host/etc/resolv.conf
+      mount -o remount,rw /host/etc/resolv.conf
+      trap "umount /host/etc/resolv.conf" EXIT
+
      while inotifywait /etc 2>/dev/null;
      do
        cp /etc/resolv.conf /host/etc/resolv.conf;
@@ -11,13 +11,13 @@
 }:
 let
  pname = "feishin";
-  version = "0.12.2";
+  version = "0.12.3";

  src = fetchFromGitHub {
    owner = "jeffvli";
    repo = "feishin";
    rev = "v${version}";
-    hash = "sha256-2kWeUlOTAd1Usw/cLOARyLqxEzZRk27RuHjLwupnq80=";
+    hash = "sha256-Tjh68b+41YrMNB14AZ3jXqBXDOmaaOYQKXJOyTUF474=";
  };

  electron = electron_33;
@@ -11,17 +11,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "findomain";
-  version = "9.0.3";
+  version = "9.0.4";

  src = fetchFromGitHub {
    owner = "findomain";
    repo = "findomain";
    tag = version;
-    hash = "sha256-M6i62JI4HjaM0C2rSK8P5O19JeugFP5xIy1E6vE8KP4=";
+    hash = "sha256-5jbKDMULig6j3D5KEQQrHWtsc59x0Tj6n/7kwK/8IME=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-2CB7xmZFqej+vOx90kOPcI4FNpj1z4wnW90n7yEFpNA=";
+  cargoHash = "sha256-4+nRQ8HL4dQMCgeSOrgkaRj0E4HPAC3Nm82AEr1KWJo=";

  nativeBuildInputs = [
    installShellFiles
@@ -21,6 +21,11 @@ stdenv.mkDerivation {
    sha256 = "0xv364a00zwxhd9kg1z9sch5y0cxnrhk546asspyb9bh58sdzfy7";
  };

+  postPatch = ''
+    substituteInPlace Makefile \
+      --replace-fail 'pkg-config' '${stdenv.cc.targetPrefix}pkg-config'
+  '';
+
  # Workaround build failure on -fno-common toolchains:
  #   ld: postscript.o:postscript.h:29: multiple definition of
  #     `postscript_params'; fped.o:postscript.h:29: first defined here
@@ -43,6 +48,7 @@ stdenv.mkDerivation {
  ];

  buildInputs = [
+    flex
    gtk2
  ];

@@ -7,16 +7,19 @@

 python3Packages.buildPythonApplication rec {
  pname = "git-delete-merged-branches";
-  version = "7.4.2";
+  version = "7.5.0";
+  pyproject = true;

  src = fetchFromGitHub {
    owner = "hartwork";
    repo = pname;
    tag = version;
-    sha256 = "sha256-l+R4gINZJ8bJdhcK+U9jOuIoAm2/bd5P+w9AbwPZMrk=";
+    sha256 = "sha256-2MSdUpToOiurtiL0Ws2dLEWqd6wj4nQ2RsEepBytgAk=";
  };

-  propagatedBuildInputs = with python3Packages; [
+  build-system = with python3Packages; [ setuptools ];
+
+  dependencies = with python3Packages; [
    colorama
    prompt-toolkit
  ];
@@ -25,7 +28,7 @@ python3Packages.buildPythonApplication rec {

  meta = with lib; {
    description = "Command-line tool to delete merged Git branches";
-    homepage = "https://pypi.org/project/git-delete-merged-branches/";
+    homepage = "https://github.com/hartwork/git-delete-merged-branches/";
    license = licenses.gpl3Plus;
    maintainers = with maintainers; [ SuperSandro2000 ];
  };
@@ -9,16 +9,16 @@

 buildNpmPackage rec {
  pname = "gitlab-ci-local";
-  version = "4.57.0";
+  version = "4.58.0";

  src = fetchFromGitHub {
    owner = "firecow";
    repo = "gitlab-ci-local";
    rev = version;
-    hash = "sha256-xr8loGmua8NiXA+YMzuVPUupnjqNsOxcWdyhxTZ7GhE=";
+    hash = "sha256-4Hn/I0PJ5w+Wb3tI8szy4I/vHso85GTFyT2Ek+WbYxs=";
  };

-  npmDepsHash = "sha256-M/kRs8yaOypbSr3MhUr2UJ5G+lz5OMdBCIs4yyrLX6I=";
+  npmDepsHash = "sha256-fndSJd15sZ/sIFvh+MzNw25kuP9D9+Qc0mDqgnvjnPo=";

  postPatch = ''
    # remove cleanup which runs git commands
@@ -6,6 +6,7 @@
  bubblewrap,
  cairo,
  cargo,
+  gettext,
  git,
  gnome,
  gtk4,
@@ -40,6 +41,7 @@ stdenv.mkDerivation (finalAttrs: {

  nativeBuildInputs = [
    cargo
+    gettext # for msgfmt
    git
    meson
    ninja
@@ -64,6 +66,8 @@ stdenv.mkDerivation (finalAttrs: {
    "-Dvapi=false"
  ];

+  strictDeps = true;
+
  passthru = {
    updateScript = gnome.updateScript {
      attrPath = "glycin-loaders";
@@ -41,7 +41,6 @@ stdenv.mkDerivation (finalAttrs: {
  passthru.tests = {
    inherit
      fwupd-efi
-      ipxe
      syslinux
      ;
  };
@@ -1,69 +1,89 @@
-{ lib, buildGoModule, fetchFromGitHub, go-mockery, runCommand, go }:
+{
+  lib,
+  buildGoModule, # sync with go below, update to latest release
+  fetchFromGitHub,
+
+  # passthru test
+  go-mockery,
+  runCommand,
+  go,
+}:

 buildGoModule rec {
  pname = "go-mockery";
-  version = "2.52.1";
+  version = "2.53.2";

  src = fetchFromGitHub {
    owner = "vektra";
    repo = "mockery";
    rev = "v${version}";
-    sha256 = "sha256-algCErKmB43r/t7wo8BJSM0MHRxvxVWZ2u0n1xuLLdw=";
+    sha256 = "sha256-8J9sx9rPBZXZQKmuDSAuuktONyNM2U32W8CM9jts4Hw=";
  };

-  preCheck = ''
-    substituteInPlace ./pkg/generator_test.go --replace-fail 0.0.0-dev ${version}
-    substituteInPlace ./pkg/logging/logging_test.go --replace-fail v0.0 v${lib.versions.majorMinor version}
-  '';
-
  ldflags = [
-    "-s" "-w"
-    "-X" "github.com/vektra/mockery/v2/pkg/logging.SemVer=v${version}"
+    "-s"
+    "-w"
+    "-X"
+    "github.com/vektra/mockery/v${lib.versions.major version}/pkg/logging.SemVer=v${version}"
  ];

  env.CGO_ENABLED = false;

  proxyVendor = true;
-  vendorHash = "sha256-nL6dDGifhtmDHfz1ae+wnmVPPQDLrRgI7v8c5cQzo8Q=";
+  vendorHash = "sha256-4dZnffxyxTex5wvdWP4rRslW+I8/XC1RhhrljgI630I=";

  subPackages = [ "." ];

+  preCheck = ''
+    # check all paths
+    unset subPackages
+
+    substituteInPlace ./pkg/generator_test.go --replace-fail 0.0.0-dev ${version}
+    substituteInPlace ./pkg/logging/logging_test.go --replace-fail v0.0 v${lib.versions.majorMinor version}
+  '';
+
  passthru.tests = {
-    generateMock = runCommand "${pname}-test" {
-      nativeBuildInputs = [ go-mockery ];
-      buildInputs = [ go ];
-    } ''
-      if [[ $(mockery --version) != *"${version}"* ]]; then
-        echo "Error: program version does not match package version"
-        exit 1
-      fi
+    generateMock =
+      runCommand "${pname}-test"
+        {
+          nativeBuildInputs = [ go-mockery ];
+          buildInputs = [ go ];
+        }
+        ''
+          if [[ $(${meta.mainProgram} --version) != *"${version}"* ]]; then
+            echo "Error: program version does not match package version"
+            exit 1
+          fi

-      export HOME=$TMPDIR
+          export HOME=$TMPDIR

-      cat <<EOF > foo.go
-      package main
+          cat <<EOF > foo.go
+          package main

-      type Foo interface {
-        Bark() string
-      }
-      EOF
+          type Foo interface {
+            Bark() string
+          }
+          EOF

-      mockery --name Foo --dir .
+          ${meta.mainProgram} --name Foo --dir .

-      if [[ ! -f "mocks/Foo.go" ]]; then
-        echo "Error: mocks/Foo.go was not generated by ${pname}"
-        exit 1
-      fi
+          if [[ ! -f "mocks/Foo.go" ]]; then
+            echo "Error: mocks/Foo.go was not generated by ${pname}"
+            exit 1
+          fi

-      touch $out
-    '';
+          touch $out
+        '';
  };

-  meta = with lib; {
+  meta = {
    homepage = "https://github.com/vektra/mockery";
    description = "Mock code autogenerator for Golang";
-    maintainers = with maintainers; [ fbrs ];
+    maintainers = with lib.maintainers; [
+      fbrs
+      jk
+    ];
    mainProgram = "mockery";
-    license = licenses.bsd3;
+    license = lib.licenses.bsd3;
  };
 }
@@ -0,0 +1,42 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  autoreconfHook,
+  guile,
+  pkg-config,
+  nix-update-script,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "guile-redis";
+  version = "2.2.0";
+
+  src = fetchFromGitHub {
+    owner = "aconchillo";
+    repo = "guile-redis";
+    tag = finalAttrs.version;
+    hash = "sha256-0lObXRBn4yZi2S+MeesT1Z/vJWb907BHknA4hOQOYzE=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    autoreconfHook
+    guile
+    pkg-config
+  ];
+
+  buildInputs = [ guile ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Redis module for Guile";
+    homepage = "https://github.com/aconchillo/guile-redis";
+    changelog = "https://github.com/aconchillo/guile-redis/releases/tag/${finalAttrs.version}";
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ ethancedwards8 ];
+    platforms = guile.meta.platforms;
+  };
+})
@@ -0,0 +1,96 @@
+{
+  fetchFromGitHub,
+  lib,
+  makeWrapper,
+  ruby,
+  stdenv,
+  versionCheckHook,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "haiti";
+  version = "3.0.0";
+
+  src = fetchFromGitHub {
+    owner = "noraj";
+    repo = "haiti";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-1PGGlnbw8zg2sNEc85Un7no7elS5aPSfjzfmqovmiHk=";
+  };
+
+  nativeBuildInputs = [
+    makeWrapper
+    ruby
+  ];
+
+  paintSrc = fetchFromGitHub {
+    owner = "janlelis";
+    repo = "paint";
+    rev = "7076784c5d57f178690d19e4f8644441ff73f518";
+    hash = "sha256-uITUfcZjOACeCGsozpUxAYd98Y9oFTgyXems2Q3aYRU=";
+  };
+
+  docoptSrc = fetchFromGitHub {
+    owner = "docopt";
+    repo = "docopt.rb";
+    rev = "794c47d7cb62ca71d65086623a55881449bc2f9e";
+    hash = "sha256-9DbKTPsZRRAqDkN2wMzBtbbtyKDcVSGmVDcekf4WBnw=";
+  };
+
+  buildPhase = ''
+    runHook preBuild
+
+    paintBuild=$(mktemp -d)
+    cp -r ${finalAttrs.paintSrc}/* $paintBuild
+    pushd $paintBuild
+      sed -i '/.github/d' paint.gemspec
+      sed -i '/.rspec/d' paint.gemspec
+      gem build -V paint.gemspec
+    popd
+    paintGem=$paintBuild/paint-2.3.0.gem
+
+    docoptBuild=$(mktemp -d)
+    cp -r ${finalAttrs.docoptSrc}/* $docoptBuild
+    pushd $docoptBuild
+      gem build -V docopt.gemspec
+    popd
+    docoptGem=$docoptBuild/docopt-0.6.1.gem
+
+    gem build -V haiti.gemspec
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    gem install -V $paintGem $docoptGem haiti-hash-${finalAttrs.version}.gem \
+    --install-dir=$out/lib \
+    --ignore-dependencies
+
+    for i in $out/lib/bin/*;
+    do
+      filename=$(basename $i)
+      makeWrapper ${lib.getExe ruby} $out/bin/$filename \
+      --set GEM_PATH $out/lib \
+      --add-flags $out/lib/bin/$filename
+    done
+
+    rm -rf $out/lib/{build_info,cache,doc,extensions,plugins}
+
+    runHook postInstall
+  '';
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  meta = {
+    changelog = "https://github.com/noraj/haiti/releases/tag/v${finalAttrs.version}";
+    description = "CLI tool to identify hash types";
+    homepage = "https://github.com/noraj/haiti";
+    license = lib.licenses.mit;
+    mainProgram = "haiti";
+    maintainers = with lib.maintainers; [ KSJ2000 ];
+    platforms = lib.platforms.unix;
+  };
+})
@@ -0,0 +1,41 @@
+{
+  lib,
+  stdenvNoCC,
+  pname,
+  version,
+  meta,
+  fetchurl,
+  _7zz,
+  undmg,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  inherit pname version;
+
+  src =
+    if stdenvNoCC.hostPlatform.isAarch64 then
+      (fetchurl {
+        url = "https://hamrs-releases.s3.us-east-2.amazonaws.com/${finalAttrs.version}/HAMRS-${finalAttrs.version}.dmg";
+        hash = "sha256-IQ7r2OLwJW4auiNDddzZ99jXxrtPw3uYoGIUEHU1gtc=";
+      })
+    else
+      (fetchurl {
+        url = "https://hamrs-releases.s3.us-east-2.amazonaws.com/${finalAttrs.version}/HAMRS-${finalAttrs.version}-intel.dmg";
+        hash = "sha256-bgWeIARE3gO5FA9MqidfXo1Wdn5wDUa/RNzZBxSKloM=";
+      });
+
+  nativeBuildInputs = if stdenvNoCC.hostPlatform.isAarch64 then [ _7zz ] else [ undmg ];
+
+  sourceRoot = ".";
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/Applications
+    cp -r *.app $out/Applications
+
+    runHook postInstall
+  '';
+
+  inherit meta;
+})
@@ -0,0 +1,48 @@
+{
+  lib,
+  stdenvNoCC,
+  appimageTools,
+  fetchurl,
+  pname,
+  version,
+  meta,
+}:
+
+let
+  suffix =
+    {
+      aarch64-linux = "linux-armv7l";
+      x86_64-linux = "linux-x86_64";
+      i686-linux = "linux-i386";
+    }
+    .${stdenvNoCC.hostPlatform.system}
+      or (throw "Unsupported system: ${stdenvNoCC.hostPlatform.system}");
+in
+appimageTools.wrapType2 rec {
+  inherit pname version;
+
+  src = fetchurl {
+    url = "https://hamrs-releases.s3.us-east-2.amazonaws.com/${version}/hamrs-${version}-${suffix}.AppImage";
+    hash =
+      {
+        aarch64-linux = "sha256-nBW8q7LVWQz93LkTc+c36H+2ymLLwLKfxePUwEm3D2E=";
+        x86_64-linux = "sha256-tplp7TADvbxkk5qBb4c4zm4mrzrVtW/WVUjiolBBJHc=";
+        i686-linux = "sha256-PllxLMBsPCedKU7OUN0nqi4qtQ57l2Z+huLfkfaBfT4=";
+      }
+      .${stdenvNoCC.hostPlatform.system}
+        or (throw "Unsupported system: ${stdenvNoCC.hostPlatform.system}");
+  };
+
+  extraInstallCommands =
+    let
+      contents = appimageTools.extract { inherit pname version src; };
+    in
+    ''
+      install -m 444 -D ${contents}/${pname}.desktop -t $out/share/applications
+      substituteInPlace $out/share/applications/${pname}.desktop \
+        --replace-fail 'Exec=AppRun' 'Exec=${pname}'
+      cp -r ${contents}/usr/share/icons $out/share
+    '';
+
+  inherit meta;
+}
@@ -1,56 +1,33 @@
 {
-  appimageTools,
  lib,
-  fetchurl,
-  stdenv,
+  stdenvNoCC,
+  callPackage,
 }:

 let
-  suffix =
-    {
-      aarch64-linux = "linux-armv7l";
-      x86_64-linux = "linux-x86_64";
-      i686-linux = "linux-i386";
-    }
-    .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
-in
-appimageTools.wrapType2 rec {
  pname = "hamrs";
  version = "1.0.7";

-  src = fetchurl {
-    url = "https://hamrs-releases.s3.us-east-2.amazonaws.com/${version}/hamrs-${version}-${suffix}.AppImage";
-    hash =
-      {
-        aarch64-linux = "sha256-nBW8q7LVWQz93LkTc+c36H+2ymLLwLKfxePUwEm3D2E=";
-        x86_64-linux = "sha256-tplp7TADvbxkk5qBb4c4zm4mrzrVtW/WVUjiolBBJHc=";
-        i686-linux = "sha256-PllxLMBsPCedKU7OUN0nqi4qtQ57l2Z+huLfkfaBfT4=";
-      }
-      .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
-  };
-
-  extraInstallCommands =
-    let
-      contents = appimageTools.extract { inherit pname version src; };
-    in
-    ''
-      install -m 444 -D ${contents}/${pname}.desktop -t $out/share/applications
-      substituteInPlace $out/share/applications/${pname}.desktop \
-        --replace-fail 'Exec=AppRun' 'Exec=${pname}'
-      cp -r ${contents}/usr/share/icons $out/share
-    '';
-
-  meta = with lib; {
-    description = "A simple, portable logger tailored for activities like Parks on the Air, Field Day, and more.";
+  meta = {
+    description = "Simple, portable logger tailored for activities like Parks on the Air, Field Day, and more.";
    homepage = "https://hamrs.app/";
-    license = licenses.unfree;
-    maintainers = [ maintainers.jhollowe ];
+    license = lib.licenses.unfree;
+    maintainers = with lib.maintainers; [
+      ethancedwards8
+      jhollowe
+    ];
    platforms = [
      "aarch64-linux"
      "x86_64-linux"
      "i686-linux"
+      "aarch64-darwin"
+      "x86_64-darwin"
    ];
    mainProgram = "hamrs";
-    sourceProvenance = [ sourceTypes.binaryNativeCode ];
+    sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
  };
-}
+in
+if stdenvNoCC.hostPlatform.isDarwin then
+  callPackage ./darwin.nix { inherit pname version meta; }
+else
+  callPackage ./linux.nix { inherit pname version meta; }
@@ -1,18 +1,19 @@
 {
  lib,
  fetchFromGitHub,
+  nix-update-script,
  python3,
 }:

 python3.pkgs.buildPythonApplication rec {
  pname = "heisenbridge";
-  version = "1.15.0";
+  version = "1.15.2";

  src = fetchFromGitHub {
    owner = "hifi";
    repo = pname;
    tag = "v${version}";
-    sha256 = "sha256-4K6Sffu/yKHkcoNENbgpci2dbJVAH3vVkogcw/IYpnw=";
+    sha256 = "sha256-7zOpjIRYm+F8my+Gk/SXFIpzXMublPuzo93GpD8SxvU=";
  };

  postPatch = ''
@@ -30,6 +31,8 @@ python3.pkgs.buildPythonApplication rec {
    pytestCheckHook
  ];

+  passthru.updateScript = nix-update-script { };
+
  meta = with lib; {
    description = "Bouncer-style Matrix-IRC bridge";
    homepage = "https://github.com/hifi/heisenbridge";
@@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "hermit";
-  version = "0.44.1";
+  version = "0.44.3";

  src = fetchFromGitHub {
    rev = "v${version}";
    owner = "cashapp";
    repo = "hermit";
-    hash = "sha256-u5NklyTtrTfqC+p3UnUv7LJ2Dm7GuQnuAAyplm1M7rE=";
+    hash = "sha256-7u1xPpM3y8+hm732ssdA/XJtmSGyiRpMHBmzOCDSTRM=";
  };

-  vendorHash = "sha256-GPIJ3IvTM2da962M1FLHKn8OitHDPZ9zp8nSLaeRq10=";
+  vendorHash = "sha256-Nmvgsso9WU4Tuc0vFUutcApgX6KXRZMl3CiWO5FaROU=";

  subPackages = [ "cmd/hermit" ];

@@ -8,13 +8,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "httplib";
-  version = "0.18.5";
+  version = "0.19.0";

  src = fetchFromGitHub {
    owner = "yhirose";
    repo = "cpp-httplib";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-d5b6WsqR9oTiWq9wED+7Ts0kjURutxAJVXbm1okNg8k=";
+    hash = "sha256-OLwD7mpwqG7BUugUca+CJpPMaabJzUMC0zYzJK9PBCg=";
  };

  nativeBuildInputs = [ cmake ];
@@ -9,16 +9,16 @@

 buildGoModule rec {
  pname = "ignite-cli";
-  version = "28.8.1";
+  version = "28.8.2";

  src = fetchFromGitHub {
    repo = "cli";
    owner = "ignite";
    rev = "v${version}";
-    hash = "sha256-tecoeYQ+rWH36AwkcvO5W7mqVxc9fGHcUiQ+dZvUQP0=";
+    hash = "sha256-d7+T0VlmKQgmAJ8eyDg8JDL9HHJbU+nOTvJP0GTuIRY=";
  };

-  vendorHash = "sha256-4Ab3xgP1fK2QA+qL3DyNESkOl6MeQlhhjpaWO6oRFlg=";
+  vendorHash = "sha256-EaOs3m5AN0EYMO8j3mkKPOQwapi0WRaTIUJKTjDpmCo=";

  nativeBuildInputs = [ makeWrapper ];

--- a/Show More
+++ b/Show More