Merge staging-next into staging

.github/workflows/backport.yml

@@ -14,7 +14,7 @@ permissions: {}
 jobs:
   backport:
     name: Backport Pull Request
-    if: github.repository_owner == 'NixOS' && github.event.pull_request.merged == true && (github.event.action != 'labeled' || startsWith(github.event.label.name, 'backport'))
+    if: vars.NIXPKGS_CI_APP_ID && github.event.pull_request.merged == true && (github.event.action != 'labeled' || startsWith(github.event.label.name, 'backport'))
     runs-on: ubuntu-24.04-arm
     steps:
       # Use a GitHub App to create the PR so that CI gets triggered

.github/workflows/check-cherry-picks.yml

@@ -1,6 +1,9 @@
 name: "Check cherry-picks"
 
 on:
+  pull_request:
+    paths:
+      - .github/workflows/check-cherry-picks.yml
   pull_request_target:
     branches:
       - 'release-**'
@@ -13,7 +16,6 @@ jobs:
   check:
     name: cherry-pick-check
     runs-on: ubuntu-24.04-arm
-    if: github.repository_owner == 'NixOS'
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:

.github/workflows/check-format.yml

@@ -1,6 +1,9 @@
 name: Check that files are formatted
 
 on:
+  pull_request:
+    paths:
+      - .github/workflows/check-format.yml
   pull_request_target:
     types: [opened, synchronize, reopened, edited]
 

.github/workflows/check-shell.yml

@@ -1,6 +1,9 @@
 name: "Check shell"
 
 on:
+  pull_request:
+    paths:
+      - .github/workflows/check-shell.yml
   pull_request_target:
     paths:
       - 'shell.nix'

.github/workflows/codeowners-v2.yml

@@ -23,6 +23,9 @@
 name: Codeowners v2
 
 on:
+  pull_request:
+    paths:
+      - .github/workflows/codeowners-v2.yml
   pull_request_target:
     types: [opened, ready_for_review, synchronize, reopened, edited]
 
@@ -64,6 +67,7 @@ jobs:
         run: nix-build base/ci -A codeownersValidator
 
       - uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
+        if: vars.OWNER_RO_APP_ID
         id: app-token
         with:
           app-id: ${{ vars.OWNER_RO_APP_ID }}
@@ -77,6 +81,7 @@ jobs:
           path: pr
 
       - name: Validate codeowners
+        if: steps.app-token.outputs.token
         run: result/bin/codeowners-validator
         env:
           OWNERS_FILE: pr/${{ env.OWNERS_FILE }}
@@ -99,6 +104,7 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
+        if: vars.OWNER_APP_ID
         id: app-token
         with:
           app-id: ${{ vars.OWNER_APP_ID }}
@@ -111,6 +117,7 @@ jobs:
         run: nix-build ci -A requestReviews
 
       - name: Request reviews
+        if: steps.app-token.outputs.token
         run: result/bin/request-code-owner-reviews.sh ${{ github.repository }} ${{ github.event.number }} "$OWNERS_FILE"
         env:
           GH_TOKEN: ${{ steps.app-token.outputs.token }}

.github/workflows/eval-aliases.yml

@@ -1,6 +1,9 @@
 name: Eval aliases
 
 on:
+  pull_request:
+    paths:
+      - .github/workflows/eval-aliases.yml
   pull_request_target:
 
 permissions: {}
@@ -26,7 +29,7 @@ jobs:
           extra_nix_config: sandbox = true
 
       - name: Ensure flake outputs on all systems still evaluate
-        run: nix --experimental-features 'nix-command flakes' flake check --all-systems --no-build ./nixpkgs
+        run: nix flake check --all-systems --no-build ./nixpkgs
 
       - name: Query nixpkgs with aliases enabled to check for basic syntax errors
         run: |

.github/workflows/eval.yml

@@ -1,6 +1,9 @@
 name: Eval
 
 on:
+  pull_request:
+    paths:
+      - .github/workflows/eval.yml
   pull_request_target:
     types: [opened, ready_for_review, synchronize, reopened]
   push:
@@ -175,6 +178,7 @@ jobs:
       # See ./codeowners-v2.yml, reuse the same App because we need the same permissions
       # Can't use the token received from permissions above, because it can't get enough permissions
       - uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
+        if: vars.OWNER_APP_ID
         id: app-token
         with:
           app-id: ${{ vars.OWNER_APP_ID }}
@@ -205,6 +209,7 @@ jobs:
         run: nix-build base/ci -A requestReviews
 
       - name: Labelling pull request
+        if: ${{ github.event_name == 'pull_request_target' && github.repository_owner == 'NixOS' }}
         run: |
           # Get all currently set rebuild labels
           gh api \
@@ -239,7 +244,7 @@ jobs:
           NUMBER: ${{ github.event.number }}
 
       - name: Add eval summary to commit statuses
-        if: ${{ github.event_name == 'pull_request_target' }}
+        if: ${{ github.event_name == 'pull_request_target' && github.repository_owner == 'NixOS' }}
         run: |
           description=$(jq -r '
           "Package: added " + (.attrdiff.added | length | tostring) +
@@ -259,6 +264,7 @@ jobs:
           NUMBER: ${{ github.event.number }}
 
       - name: Requesting maintainer reviews
+        if: ${{ steps.app-token.outputs.token && github.repository_owner == 'NixOS' }}
         run: |
           # maintainers.json contains GitHub IDs. Look up handles to request reviews from.
           # There appears to be no API to request reviews based on GitHub IDs

.github/workflows/get-merge-commit.yml

@@ -1,6 +1,9 @@
 name: Get merge commit
 
 on:
+  pull_request:
+    paths:
+      - .github/workflows/get-merge-commit.yml
   workflow_call:
     outputs:
       mergedSha:
@@ -38,7 +41,7 @@ jobs:
             push)
               echo "mergedSha=${{ github.sha }}" >> "$GITHUB_OUTPUT"
               ;;
-            pull_request_target)
+            pull_request*)
               if commits=$(base/ci/get-merge-commit.sh ${{ github.repository }} ${{ github.event.number }}); then
                 echo -e "Checking the commits:\n$commits"
                 echo "$commits" >> "$GITHUB_OUTPUT"

.github/workflows/lib-tests.yml

@@ -1,6 +1,9 @@
 name: "Building Nixpkgs lib-tests"
 
 on:
+  pull_request:
+    paths:
+      - .github/workflows/lib-tests.yml
   pull_request_target:
     paths:
       - 'lib/**'

.github/workflows/manual-nixos-v2.yml

@@ -1,6 +1,9 @@
 name: "Build NixOS manual v2"
 
 on:
+  pull_request:
+    paths:
+      - .github/workflows/manual-nixos-v2.yml
   pull_request_target:
     branches:
       - master
@@ -38,7 +41,6 @@ jobs:
           extra_nix_config: sandbox = true
 
       - uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16
-        if: github.repository_owner == 'NixOS'
         with:
           # This cache is for the nixpkgs repo checks and should not be trusted or used elsewhere.
           name: nixpkgs-ci

.github/workflows/manual-nixpkgs-v2.yml

@@ -1,6 +1,9 @@
 name: "Build Nixpkgs manual v2"
 
 on:
+  pull_request:
+    paths:
+      - .github/workflows/manual-nixpkgs-v2.yml
   pull_request_target:
     branches:
       - master
@@ -25,7 +28,6 @@ jobs:
           extra_nix_config: sandbox = true
 
       - uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16
-        if: github.repository_owner == 'NixOS'
         with:
           # This cache is for the nixpkgs repo checks and should not be trusted or used elsewhere.
           name: nixpkgs-ci

.github/workflows/nix-parse-v2.yml

@@ -1,6 +1,9 @@
 name: "Check whether nix files are parseable v2"
 
 on:
+  pull_request:
+    paths:
+      - .github/workflows/nix-parse-v2.yml
   pull_request_target:
 
 permissions: {}

.github/workflows/nixpkgs-vet.yml

@@ -6,6 +6,9 @@
 name: Vet nixpkgs
 
 on:
+  pull_request:
+    paths:
+      - .github/workflows/nixpkgs-vet.yml
   pull_request_target:
     # This workflow depends on the base branch of the PR, but changing the base branch is not included in the default trigger events, which would be `opened`, `synchronize` or `reopened`.
     # Instead it causes an `edited` event, so we need to add it explicitly here.

.github/workflows/no-channel.yml

@@ -1,6 +1,9 @@
 name: "No channel PR"
 
 on:
+  pull_request:
+    paths:
+      - .github/workflows/no-channel.yml
   pull_request_target:
     # Re-run should be triggered when the base branch is updated, instead of silently failing
     types: [opened, synchronize, reopened, edited]

ci/pinned-nixpkgs.json

@@ -1,4 +1,4 @@
 {
-  "rev": "573c650e8a14b2faa0041645ab18aed7e60f0c9a",
-  "sha256": "0qg99zj0gb0pc6sjlkmwhk1c1xz14qxmk6gamgfmcxpsfdp5vn72"
+  "rev": "eaeed9530c76ce5f1d2d8232e08bec5e26f18ec1",
+  "sha256": "132nimgi1g88fbhddk4b8b1qk68jly494x2mnphyk3xa1d2wy9q7"
 }

lib/path/default.nix

@@ -382,7 +382,7 @@ in
               (splitRoot p).root
               (splitRoot p).subpath
 
-    - Trying to get the parent directory of `root` using [`readDir`](https://nixos.org/manual/nix/stable/language/builtins.html#builtins-readDir) returns `root` itself:
+    - Trying to get the parent directory of `root` using [`dirOf`](https://nixos.org/manual/nix/stable/language/builtins.html#builtins-dirOf) returns `root` itself:
 
           dirOf (splitRoot p).root == (splitRoot p).root
 

maintainers/maintainer-list.nix

@@ -1859,6 +1859,12 @@
     name = "Austin Lund";
     keys = [ { fingerprint = "7083 E268 4BFD 845F 2B84  9E74 B695 8918 ED23 32CE"; } ];
   };
+  appleboblin = {
+    email = "github@appleboblin.com";
+    github = "appleboblin";
+    githubId = 16847957;
+    name = "Po-Hui Lin";
+  };
   applejag = {
     email = "applejag.luminance905@passmail.com";
     github = "applejag";
@@ -11352,6 +11358,13 @@
     githubId = 19669567;
     name = "Willy";
   };
+  jennifgcrl = {
+    email = "jennifer@jezh.me";
+    github = "jennifgcrl";
+    githubId = 110419915;
+    matrix = "@fgcrl:matrix.org";
+    name = "Jennifer Zhou";
+  };
   jensbin = {
     email = "jensbin+git@pm.me";
     github = "jensbin";
@@ -12680,6 +12693,12 @@
     githubId = 37185887;
     name = "Calvin Kim";
   };
+  keegancsmith = {
+    email = "keegan.csmith@gmail.com";
+    name = "Keegan Carruthers-Smith";
+    github = "keegancsmith";
+    githubId = 187831;
+  };
   keenanweaver = {
     email = "keenanweaver@protonmail.com";
     name = "Keenan Weaver";
@@ -18503,6 +18522,12 @@
     github = "ovlach";
     githubId = 4405107;
   };
+  owickstrom = {
+    email = "oskar@wickstrom.tech";
+    name = "Oskar Wickström";
+    github = "owickstrom";
+    githubId = 1464328;
+  };
   oxalica = {
     email = "oxalicc@pm.me";
     github = "oxalica";

nixos/doc/manual/release-notes/rl-2505.section.md

@@ -68,6 +68,8 @@
 
 - [vwifi](https://github.com/Raizo62/vwifi), a Wi-Fi simulator daemon leveraging the `mac80211_hwsim` and `vhost_vsock` kernel modules for efficient simulation of multi-node Wi-Fi networks. Available as {option}`services.vwifi`.
 
+- [Oncall](https://oncall.tools), a web-based calendar tool designed for scheduling and managing on-call shifts. Available as [services.oncall](options.html#opt-services.oncall).
+
 - [Homer](https://homer-demo.netlify.app/), a very simple static homepage for your server. Available as [services.homer](options.html#opt-services.homer).
 
 - [Ghidra](https://ghidra-sre.org/), a software reverse engineering (SRE) suite of tools. Available as [programs.ghidra](options.html#opt-programs.ghidra).

nixos/modules/image/repart.nix

@@ -160,7 +160,7 @@ in
       # Generated with `uuidgen`. Random but fixed to improve reproducibility.
       default = "0867da16-f251-457d-a9e8-c31f9a3c220b";
       description = ''
-          A UUID to use as a seed. You can set this to `null` to explicitly
+        A UUID to use as a seed. You can set this to `null` to explicitly
         randomize the partition UUIDs.
       '';
     };
@@ -169,7 +169,7 @@ in
       type = lib.types.bool;
       default = false;
       description = ''
-          Enables generation of split artifacts from partitions. If enabled, for
+        Enables generation of split artifacts from partitions. If enabled, for
         each partition with SplitName= set, a separate output file containing
         just the contents of that partition is generated.
       '';
@@ -180,7 +180,7 @@ in
       default = 512;
       example = lib.literalExpression "4096";
       description = ''
-          The sector size of the disk image produced by systemd-repart. This
+        The sector size of the disk image produced by systemd-repart. This
         value must be a power of 2 between 512 and 4096.
       '';
     };
@@ -199,7 +199,7 @@ in
       type = with lib.types; attrsOf (submodule partitionOptions);
       default = { };
       example = lib.literalExpression ''
-          {
+        {
           "10-esp" = {
             contents = {
               "/EFI/BOOT/BOOTX64.EFI".source =
@@ -221,7 +221,7 @@ in
         };
       '';
       description = ''
-          Specify partitions as a set of the names of the partitions with their
+        Specify partitions as a set of the names of the partitions with their
         configuration as the key.
       '';
     };
@@ -230,12 +230,12 @@ in
       type = with lib.types; attrsOf (listOf str);
       default = { };
       example = lib.literalExpression ''
-          {
+        {
           vfat = [ "-S 512" "-c" ];
         }
       '';
       description = ''
-          Specify extra options for created file systems. The specified options
+        Specify extra options for created file systems. The specified options
         are converted to individual environment variables of the format
         `SYSTEMD_REPART_MKFS_OPTIONS_<FSTYPE>`.
 

nixos/modules/module-list.nix

@@ -1608,6 +1608,7 @@
   ./services/web-apps/nostr-rs-relay.nix
   ./services/web-apps/ocis.nix
   ./services/web-apps/olivetin.nix
+  ./services/web-apps/oncall.nix
   ./services/web-apps/onlyoffice.nix
   ./services/web-apps/open-web-calendar.nix
   ./services/web-apps/openvscode-server.nix

nixos/modules/profiles/nix-builder-vm.nix

@@ -163,7 +163,7 @@ in
 
         hostPkgs = config.virtualisation.host.pkgs;
 
-        script = hostPkgs.writeShellScriptBin "create-builder" (
+        add-keys = hostPkgs.writeShellScriptBin "add-keys" (
           ''
             set -euo pipefail
           ''
@@ -191,10 +191,22 @@ in
             if ! ${hostPkgs.diffutils}/bin/cmp "''${PUBLIC_KEY}" ${publicKey}; then
               (set -x; sudo --reset-timestamp ${installCredentials} "''${KEYS}")
             fi
-            KEYS="$(${hostPkgs.nix}/bin/nix-store --add "$KEYS")" ${lib.getExe config.system.build.vm}
           ''
         );
 
+        run-builder = hostPkgs.writeShellScriptBin "run-builder" (''
+          set -euo pipefail
+          KEYS="''${KEYS:-./keys}"
+          KEYS="$(${hostPkgs.nix}/bin/nix-store --add "$KEYS")" ${lib.getExe config.system.build.vm}
+        '');
+
+        script = hostPkgs.writeShellScriptBin "create-builder" (''
+          set -euo pipefail
+          export KEYS="''${KEYS:-./keys}"
+          ${lib.getExe add-keys}
+          ${lib.getExe run-builder}
+        '');
+
       in
       script.overrideAttrs (old: {
         pos = __curPos; # sets meta.position to point here; see script binding above for package definition
@@ -205,6 +217,8 @@ in
           # Let users in the repl inspect the config
           nixosConfig = config;
           nixosOptions = options;
+
+          inherit add-keys run-builder;
         };
       });
 

nixos/modules/services/web-apps/oncall.nix

@@ -0,0 +1,203 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+
+  cfg = config.services.oncall;
+  settingsFormat = pkgs.formats.yaml { };
+  configFile = settingsFormat.generate "oncall_extra_settings.yaml" cfg.settings;
+
+in
+{
+  options.services.oncall = {
+
+    enable = lib.mkEnableOption "Oncall web app";
+
+    package = lib.mkPackageOption pkgs "oncall" { };
+
+    database.createLocally = lib.mkEnableOption "Create the database and database user locally." // {
+      default = true;
+    };
+
+    settings = lib.mkOption {
+      type = lib.types.submodule {
+        freeformType = settingsFormat.type;
+        options = {
+          oncall_host = lib.mkOption {
+            type = lib.types.str;
+            default = "localhost";
+            description = "FQDN for the Oncall instance.";
+          };
+          db.conn = {
+            kwargs = {
+              user = lib.mkOption {
+                type = lib.types.str;
+                default = "oncall";
+                description = "Database user.";
+              };
+              host = lib.mkOption {
+                type = lib.types.str;
+                default = "localhost";
+                description = "Database host.";
+              };
+              database = lib.mkOption {
+                type = lib.types.str;
+                default = "oncall";
+                description = "Database name.";
+              };
+            };
+            str = lib.mkOption {
+              type = lib.types.str;
+              default = "%(scheme)s://%(user)s@%(host)s:%(port)s/%(database)s?charset=%(charset)s&unix_socket=/run/mysqld/mysqld.sock";
+              description = ''
+                Database connection scheme. The default specifies the
+                connection through a local socket.
+              '';
+            };
+            require_auth = lib.mkOption {
+              type = lib.types.bool;
+              default = true;
+              description = ''
+                Whether authentication is required to access the web app.
+              '';
+            };
+          };
+        };
+      };
+      default = { };
+      description = ''
+        Extra configuration options to append or override.
+        For available and default option values see
+        [upstream configuration file](https://github.com/linkedin/oncall/blob/master/configs/config.yaml)
+        and the administration part in the
+        [offical documentation](https://oncall.tools/docs/admin_guide.html).
+      '';
+    };
+
+    secretFile = lib.mkOption {
+      type = lib.types.pathWith {
+        inStore = false;
+        absolute = true;
+      };
+      example = "/run/keys/oncall-dbpassword";
+      description = ''
+        A YAML file containing secrets such as database or user passwords.
+        Some variables that can be considered secrets are:
+
+        - db.conn.kwargs.password:
+          Password used to authenticate to the database.
+
+        - session.encrypt_key:
+          Key for encrypting/signing session cookies.
+          Change to random long values in production.
+
+        - session.sign_key:
+          Key for encrypting/signing session cookies.
+          Change to random long values in production.
+      '';
+    };
+
+  };
+
+  config = lib.mkIf cfg.enable {
+
+    # Disable debug, only needed for development
+    services.oncall.settings = lib.mkMerge [
+      ({
+        debug = lib.mkDefault false;
+        auth.debug = lib.mkDefault false;
+      })
+    ];
+
+    services.uwsgi = {
+      enable = true;
+      plugins = [ "python3" ];
+      user = "oncall";
+      instance = {
+        type = "emperor";
+        vassals = {
+          oncall = {
+            type = "normal";
+            env = [
+              "PYTHONPATH=${pkgs.oncall.pythonPath}"
+              (
+                "ONCALL_EXTRA_CONFIG="
+                + (lib.concatStringsSep "," (
+                  [ configFile ] ++ lib.optional (cfg.secretFile != null) cfg.secretFile
+                ))
+              )
+              "STATIC_ROOT=/var/lib/oncall"
+            ];
+            module = "oncall.app:get_wsgi_app()";
+            socket = "${config.services.uwsgi.runDir}/oncall.sock";
+            socketGroup = "nginx";
+            immediate-gid = "nginx";
+            chmod-socket = "770";
+            pyargv = "${pkgs.oncall}/share/configs/config.yaml";
+            buffer-size = 32768;
+          };
+        };
+      };
+    };
+
+    services.nginx = {
+      enable = lib.mkDefault true;
+      virtualHosts."${cfg.settings.oncall_host}".locations = {
+        "/".extraConfig = "uwsgi_pass unix://${config.services.uwsgi.runDir}/oncall.sock;";
+      };
+    };
+
+    services.mysql = lib.mkIf cfg.database.createLocally {
+      enable = true;
+      package = lib.mkDefault pkgs.mariadb;
+      ensureDatabases = [ cfg.settings.db.conn.kwargs.database ];
+      ensureUsers = [
+        {
+          name = cfg.settings.db.conn.kwargs.user;
+          ensurePermissions = {
+            "${cfg.settings.db.conn.kwargs.database}.*" = "ALL PRIVILEGES";
+          };
+        }
+      ];
+    };
+
+    users.users.oncall = {
+      group = "nginx";
+      isSystemUser = true;
+    };
+
+    systemd = {
+      services = {
+        uwsgi.serviceConfig.StateDirectory = "oncall";
+        oncall-setup-database = lib.mkIf cfg.database.createLocally {
+          description = "Set up Oncall database";
+          serviceConfig = {
+            Type = "oneshot";
+            RemainAfterExit = true;
+          };
+          requiredBy = [ "uwsgi.service" ];
+          after = [ "mysql.service" ];
+          script =
+            let
+              mysql = "${lib.getExe' config.services.mysql.package "mysql"}";
+            in
+            ''
+              if [ ! -f /var/lib/oncall/.dbexists ]; then
+                # Load database schema provided with package
+                ${mysql} ${cfg.settings.db.conn.kwargs.database} < ${cfg.package}/share/db/schema.v0.sql
+                ${mysql} ${cfg.settings.db.conn.kwargs.database} < ${cfg.package}/share/db/schema-update.v0-1602184489.sql
+                touch /var/lib/oncall/.dbexists
+              fi
+            '';
+        };
+      };
+    };
+
+  };
+
+  meta.maintainers = with lib.maintainers; [ onny ];
+
+}

nixos/modules/system/activation/lib/test.sh

@@ -26,6 +26,7 @@ onerr() {
 }
 trap onerr ERR
 
+# shellcheck source-path=SCRIPTDIR
 source ./lib.sh
 
 (warn hi, this works >/dev/null) 2>&1 | grep -E $'.*warning:.* hi, this works' >/dev/null

nixos/tests/all-tests.nix

@@ -618,6 +618,7 @@ in
   odoo = handleTest ./odoo.nix { };
   odoo17 = handleTest ./odoo.nix { package = pkgs.odoo17; };
   odoo16 = handleTest ./odoo.nix { package = pkgs.odoo16; };
+  oncall = runTest ./web-apps/oncall.nix;
   # 9pnet_virtio used to mount /nix partition doesn't support
   # hibernation. This test happens to work on x86_64-linux but
   # not on other platforms.

nixos/tests/web-apps/oncall.nix

@@ -0,0 +1,156 @@
+{
+  lib,
+  pkgs,
+  config,
+  ...
+}:
+let
+  ldapDomain = "example.org";
+  ldapSuffix = "dc=example,dc=org";
+
+  ldapRootUser = "root";
+  ldapRootPassword = "foobar23";
+
+  testUser = "myuser";
+  testPassword = "foobar23";
+  teamName = "myteam";
+in
+{
+  name = "oncall";
+  meta.maintainers = with lib.maintainers; [ onny ];
+
+  nodes = {
+    machine = {
+      virtualisation.memorySize = 2048;
+
+      environment.etc."oncall-secrets.yml".text = ''
+        auth:
+          ldap_bind_password: "${ldapRootPassword}"
+      '';
+
+      environment.systemPackages = [ pkgs.jq ];
+
+      services.oncall = {
+        enable = true;
+        settings = {
+          auth = {
+            module = "oncall.auth.modules.ldap_import";
+            ldap_url = "ldap://localhost";
+            ldap_user_suffix = "";
+            ldap_bind_user = "cn=${ldapRootUser},${ldapSuffix}";
+            ldap_base_dn = "ou=accounts,${ldapSuffix}";
+            ldap_search_filter = "(uid=%s)";
+            import_user = true;
+            attrs = {
+              username = "uid";
+              full_name = "cn";
+              email = "mail";
+              mobile = "telephoneNumber";
+              sms = "mobile";
+            };
+          };
+        };
+        secretFile = "/etc/oncall-secrets.yml";
+      };
+
+      services.openldap = {
+        enable = true;
+        settings = {
+          children = {
+            "cn=schema".includes = [
+              "${pkgs.openldap}/etc/schema/core.ldif"
+              "${pkgs.openldap}/etc/schema/cosine.ldif"
+              "${pkgs.openldap}/etc/schema/inetorgperson.ldif"
+              "${pkgs.openldap}/etc/schema/nis.ldif"
+            ];
+            "olcDatabase={1}mdb" = {
+              attrs = {
+                objectClass = [
+                  "olcDatabaseConfig"
+                  "olcMdbConfig"
+                ];
+                olcDatabase = "{1}mdb";
+                olcDbDirectory = "/var/lib/openldap/db";
+                olcSuffix = ldapSuffix;
+                olcRootDN = "cn=${ldapRootUser},${ldapSuffix}";
+                olcRootPW = ldapRootPassword;
+              };
+            };
+          };
+        };
+        declarativeContents = {
+          ${ldapSuffix} = ''
+            dn: ${ldapSuffix}
+            objectClass: top
+            objectClass: dcObject
+            objectClass: organization
+            o: ${ldapDomain}
+
+            dn: ou=accounts,${ldapSuffix}
+            objectClass: top
+            objectClass: organizationalUnit
+
+            dn: uid=${testUser},ou=accounts,${ldapSuffix}
+            objectClass: top
+            objectClass: inetOrgPerson
+            uid: ${testUser}
+            userPassword: ${testPassword}
+            cn: Test User
+            sn: User
+            mail: test@example.org
+            telephoneNumber: 012345678910
+            mobile: 012345678910
+          '';
+        };
+      };
+    };
+  };
+
+  testScript = ''
+    start_all()
+    machine.wait_for_unit("uwsgi.service")
+    machine.wait_for_unit("nginx.service")
+    machine.wait_for_file("/run/uwsgi/oncall.sock")
+    machine.wait_for_unit("oncall-setup-database.service")
+
+    with subtest("Home screen loads"):
+        machine.succeed(
+            "curl -sSfL http://[::1]:80 | grep '<title>Oncall</title>'"
+        )
+
+    with subtest("Staticfiles can be fetched"):
+        machine.wait_until_succeeds(
+          "curl -sSfL http://[::1]:80/static/bundles/libs.js"
+        )
+
+    with subtest("Staticfiles are generated"):
+        machine.succeed(
+          "test -e /var/lib/oncall/static/bundles/libs.js"
+        )
+
+    with subtest("Create and verify team via REST API"):
+        import json
+
+        # Log in and store the session cookie
+        login_response = machine.succeed("""
+            curl -sSfL -c cookies -X POST \
+                --data-raw 'username=${testUser}&password=${testPassword}' \
+                http://[::1]:80/login
+        """)
+
+        # Parse csrf token
+        login_response_data = json.loads(login_response)
+        csrf_token = login_response_data["csrf_token"]
+
+        # Create the team
+        machine.succeed(
+          f"""curl -sSfL -b cookies -X POST -H 'Content-Type: application/json' -H 'X-CSRF-Token: {csrf_token}' -d '{{"name": "${teamName}", "email": "test@example.com", "scheduling_timezone": "Europe/Berlin", "iris_enabled": false}}' http://[::1]:80/api/v0/teams/"""
+        )
+
+        # Query the created team
+        machine.succeed("""
+            curl -sSfL -b cookies http://[::1]:80/api/v0/teams/${teamName} | jq -e '.name == "${teamName}"'
+        """)
+
+  '';
+}

pkgs/applications/editors/vim/plugins/generated.nix

@@ -1531,6 +1531,19 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  blink-cmp-npm-nvim = buildVimPlugin {
+    pname = "blink-cmp-npm.nvim";
+    version = "2025-05-12";
+    src = fetchFromGitHub {
+      owner = "alexandre-abrioux";
+      repo = "blink-cmp-npm.nvim";
+      rev = "364e6c21ec8b3423b8a7d0b50e541390e1d95a0f";
+      sha256 = "07zrw4p9svlradd9pf85p8azajs8gzp8n4hmalf4ci6bl3lj6crm";
+    };
+    meta.homepage = "https://github.com/alexandre-abrioux/blink-cmp-npm.nvim/";
+    meta.hydraPlatforms = [ ];
+  };
+
   blink-cmp-spell = buildVimPlugin {
     pname = "blink-cmp-spell";
     version = "2025-03-05";

pkgs/applications/editors/vim/plugins/non-generated/blink-cmp/default.nix

@@ -8,12 +8,12 @@
   gitMinimal,
 }:
 let
-  version = "1.2.0";
+  version = "1.3.0";
   src = fetchFromGitHub {
     owner = "Saghen";
     repo = "blink.cmp";
     tag = "v${version}";
-    hash = "sha256-bKe8SSg1HPWE7b4iRQJwiOVCrvvgttuHCOIa4U/38AY=";
+    hash = "sha256-8lyDDrsh3sY7l0i0TPyhL69Oq0l63+/QPnLaU/mhq5A=";
   };
   blink-fuzzy-lib = rustPlatform.buildRustPackage {
     inherit version src;

pkgs/applications/editors/vim/plugins/overrides.nix

@@ -296,6 +296,16 @@ in
     dependencies = [ self.plenary-nvim ];
   };
 
+  blink-cmp-npm-nvim = super.blink-cmp-npm-nvim.overrideAttrs {
+    nvimSkipModules = [
+      # Test files
+      "blink-cmp-npm.utils.compute_meta_spec"
+      "blink-cmp-npm.utils.generate_doc_spec"
+      "blink-cmp-npm.utils.ignore_version_spec"
+      "blink-cmp-npm.utils.semantic_sort_spec"
+    ];
+  };
+
   blink-emoji-nvim = super.blink-emoji-nvim.overrideAttrs {
     dependencies = [ self.blink-cmp ];
   };

pkgs/applications/editors/vim/plugins/vim-plugin-names

@@ -116,6 +116,7 @@ https://github.com/disrupted/blink-cmp-conventional-commits/,HEAD,
 https://github.com/giuxtaposition/blink-cmp-copilot/,HEAD,
 https://github.com/Kaiser-Yang/blink-cmp-dictionary/,HEAD,
 https://github.com/Kaiser-Yang/blink-cmp-git/,HEAD,
+https://github.com/alexandre-abrioux/blink-cmp-npm.nvim/,HEAD,
 https://github.com/ribru17/blink-cmp-spell/,HEAD,
 https://github.com/fang2hou/blink-copilot/,HEAD,
 https://github.com/moyiz/blink-emoji.nvim/,HEAD,

pkgs/applications/editors/vscode/extensions/visualjj.visualjj/default.nix

@@ -11,26 +11,26 @@ vscode-utils.buildVscodeMarketplaceExtension {
       sources = {
         "x86_64-linux" = {
           arch = "linux-x64";
-          hash = "sha256-rEy5DXXBgyY2/vb4jm3VLbHiBEiUpvFWPjgACBS/Iec=";
+          hash = "sha256-tnZh8WioZ4EtooQlM5RYQkvWO35PPeNTAyCbMQ4raXE=";
         };
         "x86_64-darwin" = {
           arch = "darwin-x64";
-          hash = "sha256-lBOu0acFAfOUiBcm7+UYN1XMNWOW73kj+HpVGRVQrPE=";
+          hash = "sha256-tkZRGO1W0QA/aEW2BqyPhmGt06yTvrsQ4Xp8jmbzPP0=";
         };
         "aarch64-linux" = {
           arch = "linux-arm64";
-          hash = "sha256-Z1Ml70Ylepgw00aAzmhp21P047ZsKXCmX0DfgjvZhdY=";
+          hash = "sha256-hoZf3ofcPHkqyWwfL79Hnu5pzcLKRHD5PVOBjTXq828=";
         };
         "aarch64-darwin" = {
           arch = "darwin-arm64";
-          hash = "sha256-oMK2t2rFYCPS8sVKaNOIcFFMsmXrCNddxVaydftrrtc=";
+          hash = "sha256-qZnHSdcby7FNb1+EUB4O8dK30xtZWS4m07m8je0/CHI=";
         };
       };
     in
     {
       name = "visualjj";
       publisher = "visualjj";
-      version = "0.14.7";
+      version = "0.15.0";
     }
     // sources.${stdenvNoCC.hostPlatform.system}
       or (throw "Unsupported system ${stdenvNoCC.hostPlatform.system}");

pkgs/applications/emulators/libretro/cores/dosbox-pure.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "dosbox-pure";
-  version = "0-unstable-2025-04-24";
+  version = "0-unstable-2025-05-09";
 
   src = fetchFromGitHub {
     owner = "schellingb";
     repo = "dosbox-pure";
-    rev = "d3b7313d232156a1f60ce31749fe68e498ad3bf4";
-    hash = "sha256-rU2HA0ap8O02qJHHksKigjAeRgnkV6F6z5JIusWlDZM=";
+    rev = "7c30b5266a37cee67612b7cab1a714be16f3be4e";
+    hash = "sha256-VVswTqlUqW79P9LhEV7epEGT6JknejZnArb3f+qFE40=";
   };
 
   hardeningDisable = [ "format" ];

pkgs/applications/emulators/libretro/cores/gambatte.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "gambatte";
-  version = "0-unstable-2025-04-18";
+  version = "0-unstable-2025-05-02";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "gambatte-libretro";
-    rev = "b285b0823ac867371e72c54d5275a554c7be312c";
-    hash = "sha256-/PFSMcx+iBpiMHSqAhGVjbXDkMk9En0UZPChPROaLck=";
+    rev = "a85fe7c20933dbe4680d783d32639a71a85783cb";
+    hash = "sha256-YwQQkRshDDQi9CzqNnhKkj7+A0fkvcEZEg6PySaFDRI=";
   };
 
   meta = {

pkgs/applications/emulators/mame/default.nix

@@ -37,14 +37,14 @@
 
 stdenv.mkDerivation rec {
   pname = "mame";
-  version = "0.276";
+  version = "0.277";
   srcVersion = builtins.replaceStrings [ "." ] [ "" ] version;
 
   src = fetchFromGitHub {
     owner = "mamedev";
     repo = "mame";
     rev = "mame${srcVersion}";
-    hash = "sha256-HrEQmeCTwNXcEWcpXfLkBNnZdcZag4nB6ZN+8KKf5AE=";
+    hash = "sha256-mGKTZ8/gvGQv9oXK4pgbJk580GAAXUS16hRQu4uHhdA=";
   };
 
   outputs = [

pkgs/applications/emulators/punes/default.nix

@@ -31,12 +31,20 @@ stdenv.mkDerivation (finalAttrs: {
 
   patches = [
     # Fix FTBFS with Qt 6.7.1
-    # Remove when https://github.com/punesemu/puNES/pull/403 merged & in release
+    # Remove when version > 0.111
     (fetchpatch {
       name = "0001-punes-Fix-compatibility-with-Qt-6.7.1.patch";
-      url = "https://github.com/punesemu/puNES/commit/78c72d2dfcd570e7463a78da10904cebae6127f5.patch";
+      url = "https://github.com/punesemu/puNES/commit/6e51b1a6107ad3de97edd40ae4ec2d41b32d804f.patch";
       hash = "sha256-xRalKIOb1qWgqJsFLcm7uUOblEfHDYbkukmcr4/+4Qc=";
     })
+
+    # Fix FTBFS with Qt 6.9
+    # Remove when version > 0.111
+    (fetchpatch {
+      name = "0002-punes-Updated-code-for-Qt-6.9.0-compatibility.patch";
+      url = "https://github.com/punesemu/puNES/commit/ff906e0a79eeac9a2d16783e0accf65748bb275e.patch";
+      hash = "sha256-+s7AdaUBgCseQs6Mxat/cDmQ77s6K6J0fUfyihP82jM=";
+    })
   ];
 
   nativeBuildInputs = [

pkgs/applications/misc/prusa-slicer/default.nix

@@ -35,6 +35,7 @@
   heatshrink,
   catch2,
   webkitgtk_4_1,
+  ctestCheckHook,
   withSystemd ? lib.meta.availableOn stdenv.hostPlatform systemd,
   systemd,
   wxGTK-override ? null,
@@ -194,16 +195,12 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   doCheck = true;
-
-  checkPhase = ''
-    runHook preCheck
-
-    ctest \
-      --force-new-ctest-process \
-      -E 'libslic3r_tests|sla_print_tests'
-
-    runHook postCheck
-  '';
+  nativeCheckInputs = [ ctestCheckHook ];
+  checkFlags = [
+    "--force-new-ctest-process"
+    "-E"
+    "libslic3r_tests|sla_print_tests"
+  ];
 
   meta =
     with lib;

pkgs/applications/networking/browsers/firefox/packages/firefox.nix

@@ -9,10 +9,10 @@
 
 buildMozillaMach rec {
   pname = "firefox";
-  version = "138.0.1";
+  version = "138.0.3";
   src = fetchurl {
     url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "bc5a8d658140c4c3db29d51134c97105a0225567d5ce14757f69594066bf6a44a13e0626cebde2b7a078bac128a14690ee06083d0306d7789de2a5e9d8394b23";
+    sha512 = "0f1c8ee05bec465b55429c18d788856574c5b2e31d911f15f76d31c00de84d8b8681961799c4101cd1540bd228afd201a4b59fd7c9a88918695040965b9dc0f1";
   };
 
   meta = {

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -1003,11 +1003,11 @@
     "vendorHash": null
   },
   "pagerduty": {
-    "hash": "sha256-zY5aBpr/XPuGnRIsDgh4vzug6kUVJ76iF6tLhck2uGY=",
+    "hash": "sha256-L+CyniSMCrG24+7f3rW4k5SIAuhI5FIqcGP4QX+huOY=",
     "homepage": "https://registry.terraform.io/providers/PagerDuty/pagerduty",
     "owner": "PagerDuty",
     "repo": "terraform-provider-pagerduty",
-    "rev": "v3.24.2",
+    "rev": "v3.25.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -1481,12 +1481,12 @@
     "vendorHash": "sha256-GRnVhGpVgFI83Lg34Zv1xgV5Kp8ioKTFV5uaqS80ATg="
   },
   "yandex": {
-    "hash": "sha256-x2oPz2J1b0Hp/LqLv88cUS+XWvnbHBrXILlK0emtHd0=",
+    "hash": "sha256-durYCbCkN4m8U4m9f68JfHmVoabINTulDUC2QWpiJA4=",
     "homepage": "https://registry.terraform.io/providers/yandex-cloud/yandex",
     "owner": "yandex-cloud",
     "repo": "terraform-provider-yandex",
-    "rev": "v0.140.1",
+    "rev": "v0.141.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-y8siBGsl9b5s+XWNfhue1VF6FZ2AwhFIVm1eIkqqxzo="
+    "vendorHash": "sha256-5I2vcC1sPDS/wlDJNp9RI/T2P2RwJlGz47Z+8MfUzdY="
   }
 }

pkgs/by-name/ag/age-plugin-sss/package.nix

@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "age-plugin-sss";
-  version = "0.2.5";
+  version = "0.3.0";
 
   src = fetchFromGitHub {
     owner = "olastor";
     repo = "age-plugin-sss";
     tag = "v${version}";
-    hash = "sha256-4cLQRG4Al1C3x/D385kb/aYTlQqe/5bS9oMLJmHOJ1I=";
+    hash = "sha256-ZcL1bty4qMWVl8zif9tAWFKZiTFklHxaAHESpapZ4WM=";
   };
 
-  vendorHash = "sha256-HQavX6X2k/oABnHXAnOwHNkGpCTr539zRk0xwO8zS9o=";
+  vendorHash = "sha256-Sr+6Tgbm7n8gQMqZng3kyzmpMgBZaIX1oEn6nV5c89U=";
 
   ldflags = [
     "-s"

pkgs/by-name/al/alembic/package.nix

@@ -60,11 +60,7 @@ stdenv.mkDerivation rec {
   '';
 
   doCheck = true;
-  checkPhase = ''
-    runHook preCheck
-    ctest -j 1
-    runHook postCheck
-  '';
+  enableParallelChecking = false;
 
   meta = with lib; {
     description = "Open framework for storing and sharing scene data";

pkgs/by-name/am/amp-cli/package-lock.json

@@ -0,0 +1,446 @@
+{
+  "name": "amp-cli",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "dependencies": {
+        "@sourcegraph/amp": "^0.0.1747195318-g6d7769"
+      }
+    },
+    "node_modules/@colors/colors": {
+      "version": "1.6.0",
+      "resolved": "https://registry.npmjs.org/@colors/colors/-/colors-1.6.0.tgz",
+      "integrity": "sha512-Ir+AOibqzrIsL6ajt3Rz3LskB7OiMVHqltZmspbW/TJuTVuyOMirVqAkjfY6JISiLHgyNqicAC8AyHHGzNd/dA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.1.90"
+      }
+    },
+    "node_modules/@dabh/diagnostics": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/@dabh/diagnostics/-/diagnostics-2.0.3.tgz",
+      "integrity": "sha512-hrlQOIi7hAfzsMqlGSFyVucrx38O+j6wiGOf//H2ecvIEqYN4ADBSS2iLMh5UFyDunCNniUIPk/q3riFv45xRA==",
+      "license": "MIT",
+      "dependencies": {
+        "colorspace": "1.1.x",
+        "enabled": "2.0.x",
+        "kuler": "^2.0.0"
+      }
+    },
+    "node_modules/@sourcegraph/amp": {
+      "version": "0.0.1747195318-g6d7769",
+      "resolved": "https://registry.npmjs.org/@sourcegraph/amp/-/amp-0.0.1747195318-g6d7769.tgz",
+      "integrity": "sha512-L1GqHpgYhagR9WG5XOwWcUCJJV41n1DIwuz0hCUNrl+UJMhcvjLL5PG8fnA4TiFZiNEOTR8yWztfYKYeE7+U3g==",
+      "dependencies": {
+        "@vscode/ripgrep": "1.15.11",
+        "wcwidth": "^1.0.1",
+        "winston": "^3.17.0",
+        "xdg-basedir": "^5.1.0"
+      },
+      "bin": {
+        "amp": "dist/amp.js"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@types/triple-beam": {
+      "version": "1.3.5",
+      "resolved": "https://registry.npmjs.org/@types/triple-beam/-/triple-beam-1.3.5.tgz",
+      "integrity": "sha512-6WaYesThRMCl19iryMYP7/x2OVgCtbIVflDGFpWnb9irXI3UjYE4AzmYuiUKY1AJstGijoY+MgUszMgRxIYTYw==",
+      "license": "MIT"
+    },
+    "node_modules/@vscode/ripgrep": {
+      "version": "1.15.11",
+      "resolved": "https://registry.npmjs.org/@vscode/ripgrep/-/ripgrep-1.15.11.tgz",
+      "integrity": "sha512-G/VqtA6kR50mJkIH4WA+I2Q78V5blovgPPq0VPYM0QIRp57lYMkdV+U9VrY80b3AvaC72A1z8STmyxc8ZKiTsw==",
+      "hasInstallScript": true,
+      "license": "MIT",
+      "dependencies": {
+        "https-proxy-agent": "^7.0.2",
+        "proxy-from-env": "^1.1.0",
+        "yauzl": "^2.9.2"
+      }
+    },
+    "node_modules/agent-base": {
+      "version": "7.1.3",
+      "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-7.1.3.tgz",
+      "integrity": "sha512-jRR5wdylq8CkOe6hei19GGZnxM6rBGwFl3Bg0YItGDimvjGtAvdZk4Pu6Cl4u4Igsws4a1fd1Vq3ezrhn4KmFw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 14"
+      }
+    },
+    "node_modules/async": {
+      "version": "3.2.6",
+      "resolved": "https://registry.npmjs.org/async/-/async-3.2.6.tgz",
+      "integrity": "sha512-htCUDlxyyCLMgaM3xXg0C0LW2xqfuQ6p05pCEIsXuyQ+a1koYKTuBMzRNwmybfLgvJDMd0r1LTn4+E0Ti6C2AA==",
+      "license": "MIT"
+    },
+    "node_modules/buffer-crc32": {
+      "version": "0.2.13",
+      "resolved": "https://registry.npmjs.org/buffer-crc32/-/buffer-crc32-0.2.13.tgz",
+      "integrity": "sha512-VO9Ht/+p3SN7SKWqcrgEzjGbRSJYTx+Q1pTQC0wrWqHx0vpJraQ6GtHx8tvcg1rlK1byhU5gccxgOgj7B0TDkQ==",
+      "license": "MIT",
+      "engines": {
+        "node": "*"
+      }
+    },
+    "node_modules/clone": {
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/clone/-/clone-1.0.4.tgz",
+      "integrity": "sha512-JQHZ2QMW6l3aH/j6xCqQThY/9OH4D/9ls34cgkUBiEeocRTU04tHfKPBsUK1PqZCUQM7GiA0IIXJSuXHI64Kbg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.8"
+      }
+    },
+    "node_modules/color": {
+      "version": "3.2.1",
+      "resolved": "https://registry.npmjs.org/color/-/color-3.2.1.tgz",
+      "integrity": "sha512-aBl7dZI9ENN6fUGC7mWpMTPNHmWUSNan9tuWN6ahh5ZLNk9baLJOnSMlrQkHcrfFgz2/RigjUVAjdx36VcemKA==",
+      "license": "MIT",
+      "dependencies": {
+        "color-convert": "^1.9.3",
+        "color-string": "^1.6.0"
+      }
+    },
+    "node_modules/color-convert": {
+      "version": "1.9.3",
+      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-1.9.3.tgz",
+      "integrity": "sha512-QfAUtd+vFdAtFQcC8CCyYt1fYWxSqAiK2cSD6zDB8N3cpsEBAvRxp9zOGg6G/SHHJYAT88/az/IuDGALsNVbGg==",
+      "license": "MIT",
+      "dependencies": {
+        "color-name": "1.1.3"
+      }
+    },
+    "node_modules/color-name": {
+      "version": "1.1.3",
+      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.3.tgz",
+      "integrity": "sha512-72fSenhMw2HZMTVHeCA9KCmpEIbzWiQsjN+BHcBbS9vr1mtt+vJjPdksIBNUmKAW8TFUDPJK5SUU3QhE9NEXDw==",
+      "license": "MIT"
+    },
+    "node_modules/color-string": {
+      "version": "1.9.1",
+      "resolved": "https://registry.npmjs.org/color-string/-/color-string-1.9.1.tgz",
+      "integrity": "sha512-shrVawQFojnZv6xM40anx4CkoDP+fZsw/ZerEMsW/pyzsRbElpsL/DBVW7q3ExxwusdNXI3lXpuhEZkzs8p5Eg==",
+      "license": "MIT",
+      "dependencies": {
+        "color-name": "^1.0.0",
+        "simple-swizzle": "^0.2.2"
+      }
+    },
+    "node_modules/colorspace": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/colorspace/-/colorspace-1.1.4.tgz",
+      "integrity": "sha512-BgvKJiuVu1igBUF2kEjRCZXol6wiiGbY5ipL/oVPwm0BL9sIpMIzM8IK7vwuxIIzOXMV3Ey5w+vxhm0rR/TN8w==",
+      "license": "MIT",
+      "dependencies": {
+        "color": "^3.1.3",
+        "text-hex": "1.0.x"
+      }
+    },
+    "node_modules/debug": {
+      "version": "4.4.0",
+      "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.0.tgz",
+      "integrity": "sha512-6WTZ/IxCY/T6BALoZHaE4ctp9xm+Z5kY/pzYaCHRFeyVhojxlrm+46y68HA6hr0TcwEssoxNiDEUJQjfPZ/RYA==",
+      "license": "MIT",
+      "dependencies": {
+        "ms": "^2.1.3"
+      },
+      "engines": {
+        "node": ">=6.0"
+      },
+      "peerDependenciesMeta": {
+        "supports-color": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/defaults": {
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/defaults/-/defaults-1.0.4.tgz",
+      "integrity": "sha512-eFuaLoy/Rxalv2kr+lqMlUnrDWV+3j4pljOIJgLIhI058IQfWJ7vXhyEIHu+HtC738klGALYxOKDO0bQP3tg8A==",
+      "license": "MIT",
+      "dependencies": {
+        "clone": "^1.0.2"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/enabled": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/enabled/-/enabled-2.0.0.tgz",
+      "integrity": "sha512-AKrN98kuwOzMIdAizXGI86UFBoo26CL21UM763y1h/GMSJ4/OHU9k2YlsmBpyScFo/wbLzWQJBMCW4+IO3/+OQ==",
+      "license": "MIT"
+    },
+    "node_modules/fd-slicer": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/fd-slicer/-/fd-slicer-1.1.0.tgz",
+      "integrity": "sha512-cE1qsB/VwyQozZ+q1dGxR8LBYNZeofhEdUNGSMbQD3Gw2lAzX9Zb3uIU6Ebc/Fmyjo9AWWfnn0AUCHqtevs/8g==",
+      "license": "MIT",
+      "dependencies": {
+        "pend": "~1.2.0"
+      }
+    },
+    "node_modules/fecha": {
+      "version": "4.2.3",
+      "resolved": "https://registry.npmjs.org/fecha/-/fecha-4.2.3.tgz",
+      "integrity": "sha512-OP2IUU6HeYKJi3i0z4A19kHMQoLVs4Hc+DPqqxI2h/DPZHTm/vjsfC6P0b4jCMy14XizLBqvndQ+UilD7707Jw==",
+      "license": "MIT"
+    },
+    "node_modules/fn.name": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/fn.name/-/fn.name-1.1.0.tgz",
+      "integrity": "sha512-GRnmB5gPyJpAhTQdSZTSp9uaPSvl09KoYcMQtsB9rQoOmzs9dH6ffeccH+Z+cv6P68Hu5bC6JjRh4Ah/mHSNRw==",
+      "license": "MIT"
+    },
+    "node_modules/https-proxy-agent": {
+      "version": "7.0.6",
+      "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-7.0.6.tgz",
+      "integrity": "sha512-vK9P5/iUfdl95AI+JVyUuIcVtd4ofvtrOr3HNtM2yxC9bnMbEdp3x01OhQNnjb8IJYi38VlTE3mBXwcfvywuSw==",
+      "license": "MIT",
+      "dependencies": {
+        "agent-base": "^7.1.2",
+        "debug": "4"
+      },
+      "engines": {
+        "node": ">= 14"
+      }
+    },
+    "node_modules/inherits": {
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",
+      "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==",
+      "license": "ISC"
+    },
+    "node_modules/is-arrayish": {
+      "version": "0.3.2",
+      "resolved": "https://registry.npmjs.org/is-arrayish/-/is-arrayish-0.3.2.tgz",
+      "integrity": "sha512-eVRqCvVlZbuw3GrM63ovNSNAeA1K16kaR/LRY/92w0zxQ5/1YzwblUX652i4Xs9RwAGjW9d9y6X88t8OaAJfWQ==",
+      "license": "MIT"
+    },
+    "node_modules/is-stream": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/is-stream/-/is-stream-2.0.1.tgz",
+      "integrity": "sha512-hFoiJiTl63nn+kstHGBtewWSKnQLpyb155KHheA1l39uvtO9nWIop1p3udqPcUd/xbF1VLMO4n7OI6p7RbngDg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/kuler": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/kuler/-/kuler-2.0.0.tgz",
+      "integrity": "sha512-Xq9nH7KlWZmXAtodXDDRE7vs6DU1gTU8zYDHDiWLSip45Egwq3plLHzPn27NgvzL2r1LMPC1vdqh98sQxtqj4A==",
+      "license": "MIT"
+    },
+    "node_modules/logform": {
+      "version": "2.7.0",
+      "resolved": "https://registry.npmjs.org/logform/-/logform-2.7.0.tgz",
+      "integrity": "sha512-TFYA4jnP7PVbmlBIfhlSe+WKxs9dklXMTEGcBCIvLhE/Tn3H6Gk1norupVW7m5Cnd4bLcr08AytbyV/xj7f/kQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@colors/colors": "1.6.0",
+        "@types/triple-beam": "^1.3.2",
+        "fecha": "^4.2.0",
+        "ms": "^2.1.1",
+        "safe-stable-stringify": "^2.3.1",
+        "triple-beam": "^1.3.0"
+      },
+      "engines": {
+        "node": ">= 12.0.0"
+      }
+    },
+    "node_modules/ms": {
+      "version": "2.1.3",
+      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
+      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
+      "license": "MIT"
+    },
+    "node_modules/one-time": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/one-time/-/one-time-1.0.0.tgz",
+      "integrity": "sha512-5DXOiRKwuSEcQ/l0kGCF6Q3jcADFv5tSmRaJck/OqkVFcOzutB134KRSfF0xDrL39MNnqxbHBbUUcjZIhTgb2g==",
+      "license": "MIT",
+      "dependencies": {
+        "fn.name": "1.x.x"
+      }
+    },
+    "node_modules/pend": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/pend/-/pend-1.2.0.tgz",
+      "integrity": "sha512-F3asv42UuXchdzt+xXqfW1OGlVBe+mxa2mqI0pg5yAHZPvFmY3Y6drSf/GQ1A86WgWEN9Kzh/WrgKa6iGcHXLg==",
+      "license": "MIT"
+    },
+    "node_modules/proxy-from-env": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/proxy-from-env/-/proxy-from-env-1.1.0.tgz",
+      "integrity": "sha512-D+zkORCbA9f1tdWRK0RaCR3GPv50cMxcrz4X8k5LTSUD1Dkw47mKJEZQNunItRTkWwgtaUSo1RVFRIG9ZXiFYg==",
+      "license": "MIT"
+    },
+    "node_modules/readable-stream": {
+      "version": "3.6.2",
+      "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-3.6.2.tgz",
+      "integrity": "sha512-9u/sniCrY3D5WdsERHzHE4G2YCXqoG5FTHUiCC4SIbr6XcLZBY05ya9EKjYek9O5xOAwjGq+1JdGBAS7Q9ScoA==",
+      "license": "MIT",
+      "dependencies": {
+        "inherits": "^2.0.3",
+        "string_decoder": "^1.1.1",
+        "util-deprecate": "^1.0.1"
+      },
+      "engines": {
+        "node": ">= 6"
+      }
+    },
+    "node_modules/safe-buffer": {
+      "version": "5.2.1",
+      "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.2.1.tgz",
+      "integrity": "sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT"
+    },
+    "node_modules/safe-stable-stringify": {
+      "version": "2.5.0",
+      "resolved": "https://registry.npmjs.org/safe-stable-stringify/-/safe-stable-stringify-2.5.0.tgz",
+      "integrity": "sha512-b3rppTKm9T+PsVCBEOUR46GWI7fdOs00VKZ1+9c1EWDaDMvjQc6tUwuFyIprgGgTcWoVHSKrU8H31ZHA2e0RHA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/simple-swizzle": {
+      "version": "0.2.2",
+      "resolved": "https://registry.npmjs.org/simple-swizzle/-/simple-swizzle-0.2.2.tgz",
+      "integrity": "sha512-JA//kQgZtbuY83m+xT+tXJkmJncGMTFT+C+g2h2R9uxkYIrE2yy9sgmcLhCnw57/WSD+Eh3J97FPEDFnbXnDUg==",
+      "license": "MIT",
+      "dependencies": {
+        "is-arrayish": "^0.3.1"
+      }
+    },
+    "node_modules/stack-trace": {
+      "version": "0.0.10",
+      "resolved": "https://registry.npmjs.org/stack-trace/-/stack-trace-0.0.10.tgz",
+      "integrity": "sha512-KGzahc7puUKkzyMt+IqAep+TVNbKP+k2Lmwhub39m1AsTSkaDutx56aDCo+HLDzf/D26BIHTJWNiTG1KAJiQCg==",
+      "license": "MIT",
+      "engines": {
+        "node": "*"
+      }
+    },
+    "node_modules/string_decoder": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.3.0.tgz",
+      "integrity": "sha512-hkRX8U1WjJFd8LsDJ2yQ/wWWxaopEsABU1XfkM8A+j0+85JAGppt16cr1Whg6KIbb4okU6Mql6BOj+uup/wKeA==",
+      "license": "MIT",
+      "dependencies": {
+        "safe-buffer": "~5.2.0"
+      }
+    },
+    "node_modules/text-hex": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/text-hex/-/text-hex-1.0.0.tgz",
+      "integrity": "sha512-uuVGNWzgJ4yhRaNSiubPY7OjISw4sw4E5Uv0wbjp+OzcbmVU/rsT8ujgcXJhn9ypzsgr5vlzpPqP+MBBKcGvbg==",
+      "license": "MIT"
+    },
+    "node_modules/triple-beam": {
+      "version": "1.4.1",
+      "resolved": "https://registry.npmjs.org/triple-beam/-/triple-beam-1.4.1.tgz",
+      "integrity": "sha512-aZbgViZrg1QNcG+LULa7nhZpJTZSLm/mXnHXnbAbjmN5aSa0y7V+wvv6+4WaBtpISJzThKy+PIPxc1Nq1EJ9mg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 14.0.0"
+      }
+    },
+    "node_modules/util-deprecate": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/util-deprecate/-/util-deprecate-1.0.2.tgz",
+      "integrity": "sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw==",
+      "license": "MIT"
+    },
+    "node_modules/wcwidth": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/wcwidth/-/wcwidth-1.0.1.tgz",
+      "integrity": "sha512-XHPEwS0q6TaxcvG85+8EYkbiCux2XtWG2mkc47Ng2A77BQu9+DqIOJldST4HgPkuea7dvKSj5VgX3P1d4rW8Tg==",
+      "license": "MIT",
+      "dependencies": {
+        "defaults": "^1.0.3"
+      }
+    },
+    "node_modules/winston": {
+      "version": "3.17.0",
+      "resolved": "https://registry.npmjs.org/winston/-/winston-3.17.0.tgz",
+      "integrity": "sha512-DLiFIXYC5fMPxaRg832S6F5mJYvePtmO5G9v9IgUFPhXm9/GkXarH/TUrBAVzhTCzAj9anE/+GjrgXp/54nOgw==",
+      "license": "MIT",
+      "dependencies": {
+        "@colors/colors": "^1.6.0",
+        "@dabh/diagnostics": "^2.0.2",
+        "async": "^3.2.3",
+        "is-stream": "^2.0.0",
+        "logform": "^2.7.0",
+        "one-time": "^1.0.0",
+        "readable-stream": "^3.4.0",
+        "safe-stable-stringify": "^2.3.1",
+        "stack-trace": "0.0.x",
+        "triple-beam": "^1.3.0",
+        "winston-transport": "^4.9.0"
+      },
+      "engines": {
+        "node": ">= 12.0.0"
+      }
+    },
+    "node_modules/winston-transport": {
+      "version": "4.9.0",
+      "resolved": "https://registry.npmjs.org/winston-transport/-/winston-transport-4.9.0.tgz",
+      "integrity": "sha512-8drMJ4rkgaPo1Me4zD/3WLfI/zPdA9o2IipKODunnGDcuqbHwjsbB79ylv04LCGGzU0xQ6vTznOMpQGaLhhm6A==",
+      "license": "MIT",
+      "dependencies": {
+        "logform": "^2.7.0",
+        "readable-stream": "^3.6.2",
+        "triple-beam": "^1.3.0"
+      },
+      "engines": {
+        "node": ">= 12.0.0"
+      }
+    },
+    "node_modules/xdg-basedir": {
+      "version": "5.1.0",
+      "resolved": "https://registry.npmjs.org/xdg-basedir/-/xdg-basedir-5.1.0.tgz",
+      "integrity": "sha512-GCPAHLvrIH13+c0SuacwvRYj2SxJXQ4kaVTT5xgL3kPrz56XxkF21IGhjSE1+W0aw7gpBWRGXLCPnPby6lSpmQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/yauzl": {
+      "version": "2.10.0",
+      "resolved": "https://registry.npmjs.org/yauzl/-/yauzl-2.10.0.tgz",
+      "integrity": "sha512-p4a9I6X6nu6IhoGmBqAcbJy1mlC4j27vEPZX9F4L4/vZT3Lyq1VkFHw/V/PUcB9Buo+DG3iHkT0x3Qya58zc3g==",
+      "license": "MIT",
+      "dependencies": {
+        "buffer-crc32": "~0.2.3",
+        "fd-slicer": "~1.1.0"
+      }
+    }
+  }
+}

pkgs/by-name/am/amp-cli/package.nix

@@ -0,0 +1,84 @@
+{
+  lib,
+  buildNpmPackage,
+  fetchzip,
+  ripgrep,
+  makeWrapper,
+}:
+
+buildNpmPackage rec {
+  pname = "amp-cli";
+  version = "0.0.1747195318-g6d7769";
+
+  src = fetchzip {
+    url = "https://registry.npmjs.org/@sourcegraph/amp/-/amp-${version}.tgz";
+    hash = "sha256-YoyuZX41l21eTGi9t0rYb4vEE3rSqiue2kIf0PDbaKc=";
+  };
+
+  postPatch = ''
+    cp ${./package-lock.json} package-lock.json
+
+    # Create a minimal package.json with just the dependency we need (without devDependencies)
+    cat > package.json <<EOF
+    {
+      "name": "amp-cli",
+      "version": "0.0.0",
+      "license": "UNLICENSED",
+      "dependencies": {
+        "@sourcegraph/amp": "${version}"
+      },
+      "bin": {
+        "amp": "./bin/amp-wrapper.js"
+      }
+    }
+    EOF
+
+    # Create wrapper bin directory
+    mkdir -p bin
+
+    # Create a wrapper script that will be installed by npm
+    cat > bin/amp-wrapper.js << EOF
+    #!/usr/bin/env node
+    require('@sourcegraph/amp/dist/amp.js')
+    EOF
+    chmod +x bin/amp-wrapper.js
+  '';
+
+  npmDepsHash = "sha256-NxccnQxATtDBipRKhQWJn0s3PPXPeldrz9DLVq/ftpM=";
+
+  propagatedBuildInputs = [
+    ripgrep
+  ];
+
+  nativeBuildInputs = [
+    makeWrapper
+  ];
+
+  npmFlags = [
+    "--no-audit"
+    "--no-fund"
+    "--ignore-scripts"
+  ];
+
+  # Disable build and prune steps
+  dontNpmBuild = true;
+
+  postInstall = ''
+    wrapProgram $out/bin/amp \
+      --prefix PATH : ${lib.makeBinPath [ ripgrep ]}
+  '';
+
+  passthru.updateScript = ./update.sh;
+
+  meta = {
+    description = "Amp is an AI coding agent, in research preview from Sourcegraph. This is the CLI for Amp.";
+    homepage = "https://github.com/sourcegraph/amp";
+    downloadPage = "https://www.npmjs.com/package/@sourcegraph/amp";
+    license = lib.licenses.unfree;
+    maintainers = with lib.maintainers; [
+      keegancsmith
+      owickstrom
+    ];
+    mainProgram = "amp";
+  };
+}

pkgs/by-name/am/amp-cli/update.sh

@@ -0,0 +1,15 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p nodePackages.npm nix-update
+
+set -euo pipefail
+
+version=$(npm view @sourcegraph/amp version)
+
+# Generate updated lock file
+cd "$(dirname "${BASH_SOURCE[0]}")"
+npm i --package-lock-only @sourcegraph/amp@"$version"
+rm -f package.json # package.json is not used by buildNpmPackage
+
+# Update version and hashes
+cd -
+nix-update amp-cli --version "$version"

pkgs/by-name/an/angular-language-server/package.nix

@@ -16,11 +16,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "angular-language-server";
-  version = "19.2.4";
+  version = "20.0.0";
   src = fetchurl {
     name = "angular-language-server-${finalAttrs.version}.zip";
     url = "https://github.com/angular/vscode-ng-language-service/releases/download/v${finalAttrs.version}/ng-template.vsix";
-    hash = "sha256-LJpv7ZVnJrPb4Ty0H250WcliCoJS4lXc878BTYHfJ+8=";
+    hash = "sha256-87SImzcGbwvf9xtdbD3etqaWe6fMVeCKc+f8qTyFnUA=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/at/atlas/package.nix

@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "atlas";
-  version = "0.32.1";
+  version = "0.33.0";
 
   src = fetchFromGitHub {
     owner = "ariga";
     repo = "atlas";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-1uPOS5r13nGNAPxCCphrmWyvxg+OoopMP0U/VhR+gDQ=";
+    hash = "sha256-uMINAdoHYRVaZ7QdxZ0G03cOTRe6ObnIuxo3ic+tMnE=";
   };
 
   modRoot = "cmd/atlas";

pkgs/by-name/av/avbroot/package.nix

@@ -10,17 +10,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "avbroot";
-  version = "3.15.0";
+  version = "3.16.0";
 
   src = fetchFromGitHub {
     owner = "chenxiaolong";
     repo = "avbroot";
     tag = "v${version}";
-    hash = "sha256-OICx08MiiiocqVB61fMiUSmG7QOpsrLfPkLuDktTXt0=";
+    hash = "sha256-9tHDkKzqEynHsdzKGL0Ten2FccsqLOsKFBxqeisGGAU=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-iZUGFzg+x4aPL8AoPYVugjrB5ZSrmaCRWMcEovlcPx4=";
+  cargoHash = "sha256-GGqrxnFkmzFtoi9Tl5QcbZJwa7ZWYexF205nrxZ+57Q=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/by-name/bo/bootdev-cli/package.nix

@@ -11,13 +11,13 @@
 
 buildGoModule rec {
   pname = "bootdev-cli";
-  version = "1.19.0";
+  version = "1.19.1";
 
   src = fetchFromGitHub {
     owner = "bootdotdev";
     repo = "bootdev";
     tag = "v${version}";
-    hash = "sha256-5S4XjqajX1Y9XKxfWFDeFVC2d14/C9fo6zytbwXuW7E=";
+    hash = "sha256-cAVCTA4SZdD3QVgbSbha860fExq1swWnJjpWKpfHP2Q=";
   };
 
   vendorHash = "sha256-jhRoPXgfntDauInD+F7koCaJlX4XDj+jQSe/uEEYIMM=";

pkgs/by-name/ca/calibre/package.nix

@@ -17,6 +17,7 @@
   libuchardet,
   libusb1,
   libwebp,
+  nix-update-script,
   optipng,
   piper-tts,
   pkg-config,
@@ -35,11 +36,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "calibre";
-  version = "8.2.100";
+  version = "8.4.0";
 
   src = fetchurl {
     url = "https://download.calibre-ebook.com/${finalAttrs.version}/calibre-${finalAttrs.version}.tar.xz";
-    hash = "sha256-lUHnaorIUwoac1YgYimxF8KTJOPSUiJg5BKC+hFy0lc=";
+    hash = "sha256-5uexcItbBgO2Tv52clS0N+IhplqpKwq43p2yqSxANek=";
   };
 
   patches = [
@@ -228,6 +229,10 @@ stdenv.mkDerivation (finalAttrs: {
     runHook postInstallCheck
   '';
 
+  passthru.updateScript = nix-update-script {
+    extraArgs = [ "--url=https://github.com/kovidgoyal/calibre" ];
+  };
+
   meta = {
     homepage = "https://calibre-ebook.com";
     description = "Comprehensive e-book software";

pkgs/by-name/ca/cargo-edit/package.nix

@@ -9,17 +9,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-edit";
-  version = "0.13.3";
+  version = "0.13.4";
 
   src = fetchFromGitHub {
     owner = "killercup";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-HJ7mLN2j8ugnQFuauRvvNfticICRojXeqM1kUxu9yuU=";
+    hash = "sha256-gs7+OuW0av7p45+wgXVVS17YKTwIqDFQWc3kKE7y/Yw=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-HVEoUA5jvKDCiCeCA2gdKm78zAL/qoNlXsY4qLHTmrY=";
+  cargoHash = "sha256-JafagbF+JCp3ATtGjlExLDUehYqO9DhI39uD4fLafsQ=";
 
   nativeBuildInputs = [ pkg-config ];
 

pkgs/by-name/ca/cato-client/package.nix

@@ -9,11 +9,11 @@
 }:
 stdenv.mkDerivation rec {
   pname = "cato-client";
-  version = "5.2.1.1";
+  version = "5.4.0.1006";
 
   src = fetchurl {
     url = "https://clients.catonetworks.com/linux/${version}/cato-client-install.deb";
-    sha256 = "sha256-0hUchaxaiKJth2ByQMFfjsCLi/4kl+SrNSQ33Y6r3WA=";
+    sha256 = "sha256-3RyiDgfWL4vA/pUyOigmuK+SV1Q96Y65HVERPeadWWY=";
   };
 
   passthru.updateScript = writeScript "update-cato-client" ''

pkgs/by-name/cc/ccache/package.nix

@@ -15,6 +15,8 @@
   doctest,
   xcodebuild,
   makeWrapper,
+  ctestCheckHook,
+  writableTmpDirAsHomeHook,
   nix-update-script,
 }:
 
@@ -82,31 +84,24 @@ stdenv.mkDerivation (finalAttrs: {
     # test/run requires the compgen function which is available in
     # bashInteractive, but not bash.
     bashInteractive
+    ctestCheckHook
+    writableTmpDirAsHomeHook
   ] ++ lib.optional stdenv.hostPlatform.isDarwin xcodebuild;
 
   checkInputs = [
     doctest
   ];
 
-  checkPhase =
-    let
-      badTests =
-        [
-          "test.trim_dir" # flaky on hydra (possibly filesystem-specific?)
-        ]
-        ++ lib.optionals stdenv.hostPlatform.isDarwin [
-          "test.basedir"
-          "test.fileclone" # flaky on hydra (possibly filesystem-specific?)
-          "test.multi_arch"
-          "test.nocpp2"
-        ];
-    in
-    ''
-      runHook preCheck
-      export HOME=$(mktemp -d)
-      ctest --output-on-failure -E '^(${lib.concatStringsSep "|" badTests})$'
-      runHook postCheck
-    '';
+  disabledTests =
+    [
+      "test.trim_dir" # flaky on hydra (possibly filesystem-specific?)
+      "test.fileclone" # flaky on hydra, also seems to fail on zfs
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      "test.basedir"
+      "test.multi_arch"
+      "test.nocpp2"
+    ];
 
   passthru = {
     # A derivation that provides gcc and g++ commands, but that

pkgs/by-name/cl/claude-code/package-lock.json

@@ -5,13 +5,13 @@
   "packages": {
     "": {
       "dependencies": {
-        "@anthropic-ai/claude-code": "^0.2.107"
+        "@anthropic-ai/claude-code": "^0.2.109"
       }
     },
     "node_modules/@anthropic-ai/claude-code": {
-      "version": "0.2.107",
-      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-0.2.107.tgz",
-      "integrity": "sha512-Z5UzGWfK3ohvuVBG0NZfPFP2S8PXZk37c6hmoWI7vtPNa7rCtKNyexqCs1kjN4oW8Ou9eIooeQd+FOXdKTTJFw==",
+      "version": "0.2.109",
+      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-0.2.109.tgz",
+      "integrity": "sha512-dxOUgATehMCBZHzC47H3i6CCAf2YlXQMcTxrfzl0XEkwqEhbT8EzwWVbqDVc7n/eLykY2SK7xf5hD1iK8kr/dw==",
       "hasInstallScript": true,
       "license": "SEE LICENSE IN README.md",
       "dependencies": {

pkgs/by-name/cl/claude-code/package.nix

@@ -7,16 +7,16 @@
 
 buildNpmPackage rec {
   pname = "claude-code";
-  version = "0.2.107";
+  version = "0.2.109";
 
   nodejs = nodejs_20; # required for sandboxed Nix builds on Darwin
 
   src = fetchzip {
     url = "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-${version}.tgz";
-    hash = "sha256-R4+TKYhYp4Fyoq02VYSlu7n2XqO3gLtrhUalrkPyBk8=";
+    hash = "sha256-XANo3GKiD5n66GZrB+gZ15o2zTAOKkjcFNbGE3TT1NA=";
   };
 
-  npmDepsHash = "sha256-b88YBKHym1AlsUkIcSQ+wGyGC3Fv1U51zM/tkHRVYck=";
+  npmDepsHash = "sha256-u5AZXNlN/NAag+35uz3rzLh6ItbKAdV8RSSjzCGk6uA=";
 
   postPatch = ''
     cp ${./package-lock.json} package-lock.json

pkgs/by-name/cl/cloudfoundry-cli/package.nix

@@ -8,15 +8,15 @@
 
 buildGoModule rec {
   pname = "cloudfoundry-cli";
-  version = "8.13.0";
+  version = "8.14.0";
 
   src = fetchFromGitHub {
     owner = "cloudfoundry";
     repo = "cli";
     rev = "v${version}";
-    sha256 = "sha256-WljZBnDRC606/w7qIUwvkOhF9EaMYmWZE1Wax20IqEE=";
+    sha256 = "sha256-vlDq7Wme8undaZ6HNd84QsWW8Vz0Tev+9nSTbn+NLic=";
   };
-  vendorHash = "sha256-qOZABuHQlk7UnuxvFUPbRMv8TNnw2CHyRiWtXxD58Eo=";
+  vendorHash = "sha256-TWVnUdqVIqTRn5tgO+DgCY421riyYkrQS8AkTVYszZ4=";
 
   subPackages = [ "." ];
 

pkgs/by-name/co/codebook/package.nix

@@ -2,34 +2,22 @@
   lib,
   fetchFromGitHub,
   nix-update-script,
-  openssl,
-  pkg-config,
   rustPlatform,
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "codebook";
-  version = "0.2.12";
+  version = "0.2.13";
 
   src = fetchFromGitHub {
     owner = "blopker";
     repo = "codebook";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-MGyyN7lq0CpR4F0Ew+ve+KS8OnVFh8sUHQmXTIjh+Ok=";
+    hash = "sha256-8cbXdK0QbUVtqWvKSDRk3ejJrWo2lgykJG3O57e1ik8=";
   };
 
   buildAndTestSubdir = "crates/codebook-lsp";
-  cargoHash = "sha256-ry0cHP0NUa9vi7dYuJlgg75ktUeZp3dr9KHQIt8OOK0=";
-
-  nativeBuildInputs = [
-    pkg-config
-  ];
-
-  buildInputs = [
-    openssl
-  ];
-
-  env.OPENSSL_NO_VENDOR = 1;
+  cargoHash = "sha256-NsPdNjqVFa3bbDu/VZk++lsh5NW01+eVOGe1BlgHDiQ=";
 
   # Integration tests require internet access for dictionaries
   doCheck = false;

pkgs/by-name/co/containerlab/package.nix

@@ -3,6 +3,7 @@
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
+  versionCheckHook,
 }:
 
 buildGoModule rec {
@@ -23,9 +24,9 @@ buildGoModule rec {
   ldflags = [
     "-s"
     "-w"
-    "-X github.com/srl-labs/containerlab/cmd.version=${version}"
-    "-X github.com/srl-labs/containerlab/cmd.commit=${src.rev}"
-    "-X github.com/srl-labs/containerlab/cmd.date=1970-01-01T00:00:00Z"
+    "-X github.com/srl-labs/containerlab/cmd/version.Version=${version}"
+    "-X github.com/srl-labs/containerlab/cmd/version.commit=${src.rev}"
+    "-X github.com/srl-labs/containerlab/cmd/version.date=1970-01-01T00:00:00Z"
   ];
 
   preCheck = ''
@@ -41,6 +42,12 @@ buildGoModule rec {
       --zsh <($out/bin/containerlab completion zsh)
   '';
 
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  doInstallCheck = true;
+  versionCheckProgramArg = "version";
+
   meta = {
     description = "Container-based networking lab";
     homepage = "https://containerlab.dev/";

pkgs/by-name/cp/cpu_features/package.nix

@@ -8,7 +8,7 @@
 
 stdenv.mkDerivation rec {
   pname = "cpu_features";
-  version = "0.10.0";
+  version = "0.10.1";
 
   outputs = [
     "out"
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
     owner = "google";
     repo = "cpu_features";
     rev = "v${version}";
-    hash = "sha256-YnNcNzlFVTHKCxfmhTDhOxluxK2VCBuEi7VZGgUB4VU=";
+    hash = "sha256-IBJc1sHHh4G3oTzQm1RAHHahsEECC+BDl14DHJ8M1Ys=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/by-name/cy/cyclonedx-python/package.nix

@@ -6,14 +6,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "cyclonedx-python";
-  version = "6.0.0";
+  version = "6.1.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "CycloneDX";
     repo = "cyclonedx-python";
     tag = "v${version}";
-    hash = "sha256-58btE2eMX4oucgg9gbiouKZvX8TVct69YpOP2Bp2Ez8=";
+    hash = "sha256-faR7sC4ymS0g5+r++QrgX01E8CbDKCmChPFMW8jgWBg=";
   };
 
   build-system = with python3Packages; [ poetry-core ];

pkgs/by-name/dm/dm-mono/package.nix

@@ -0,0 +1,32 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchFromGitHub,
+}:
+stdenvNoCC.mkDerivation {
+  pname = "dm-mono";
+  version = "1.0-unstable-2020-04-15";
+
+  src = fetchFromGitHub {
+    owner = "googlefonts";
+    repo = "dm-mono";
+    rev = "57fadabfb200a77de2812540026c249dc3013077";
+    hash = "sha256-Xj6UmvH7tqW6xdobBxuafqc7TB1nrTFwHWv4DaZmwx8=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    install -m644 --target $out/share/fonts/truetype -D exports/*.ttf
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Monospace typeface";
+    homepage = "https://github.com/googlefonts/dm-mono";
+    changelog = "https://github.com/googlefonts/dm-mono/blob/main/CHANGELOG.md";
+    license = lib.licenses.ofl;
+    maintainers = with lib.maintainers; [ jennifgcrl ];
+  };
+}

pkgs/by-name/dn/dnscontrol/package.nix

@@ -9,16 +9,16 @@
 
 buildGoModule rec {
   pname = "dnscontrol";
-  version = "4.19.0";
+  version = "4.20.0";
 
   src = fetchFromGitHub {
     owner = "StackExchange";
     repo = "dnscontrol";
     tag = "v${version}";
-    hash = "sha256-wRkUcMBGKPKGgA7ogQpq/aFkysVFDiNSKZ2sJ3Wkm1M=";
+    hash = "sha256-GiwmSAcExafo5fJcdNsMF8BuvHdUaNoCLpl5y1pautw=";
   };
 
-  vendorHash = "sha256-Edf7ka/Qh+InjA4VXrvA0sI9QYr1nRwiLCtubZ/n5Pk=";
+  vendorHash = "sha256-8KSqPDEI5gmxzcgFsaCzeXzYN6tO9Fjq7rnQN/vSThw=";
 
   nativeBuildInputs = [ installShellFiles ];
 
@@ -51,7 +51,7 @@ buildGoModule rec {
   meta = with lib; {
     description = "Synchronize your DNS to multiple providers from a simple DSL";
     homepage = "https://dnscontrol.org/";
-    changelog = "https://github.com/StackExchange/dnscontrol/releases/tag/${src.rev}";
+    changelog = "https://github.com/StackExchange/dnscontrol/releases/tag/v${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ SuperSandro2000 ];
     mainProgram = "dnscontrol";

pkgs/by-name/do/dosbox-x/package.nix

@@ -27,13 +27,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "dosbox-x";
-  version = "2025.02.01";
+  version = "2025.05.03";
 
   src = fetchFromGitHub {
     owner = "joncampbell123";
     repo = "dosbox-x";
     rev = "dosbox-x-v${finalAttrs.version}";
-    hash = "sha256-X+deR8khmCWnIyqhao122CaPGXuWEoayKTcTaYfLATY=";
+    hash = "sha256-VYJn1ddDkSHpWVsE7NunwRvuAVRqbvCNw/TzkWe8TLQ=";
   };
 
   # sips is unavailable in sandbox, replacing with imagemagick breaks build due to wrong Foundation propagation(?) so don't generate resolution variants

pkgs/by-name/du/dumphfdl/package.nix

@@ -0,0 +1,68 @@
+{
+  stdenv,
+  lib,
+  fetchFromGitHub,
+  nix-update-script,
+  versionCheckHook,
+  cmake,
+  pkg-config,
+  libconfig,
+  liquid-dsp,
+  fftwSinglePrec,
+  glib,
+  soapysdr-with-plugins,
+  sqlite,
+  zeromq,
+  gperftools,
+  libacars,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "dumphfdl";
+  version = "1.6.1";
+
+  src = fetchFromGitHub {
+    owner = "szpajder";
+    repo = "dumphfdl";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-M4WjcGA15Kp+Hpp+I2Ndcx+oBqaGxEeQLTPcSlugLwQ=";
+  };
+
+  buildInputs = [
+    fftwSinglePrec
+    liquid-dsp
+    glib
+    libconfig
+    soapysdr-with-plugins
+    sqlite
+    zeromq
+    gperftools
+    libacars
+  ];
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+  ];
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    homepage = "https://github.com/szpajder/dumphfdl";
+    changelog = "https://github.com/szpajder/dumphfdl/releases/tag/v${finalAttrs.version}";
+    description = "Decoder for Multichannel HFDL aircraft communication";
+    longDescription = ''
+      HFDL (High Frequency Data Link) is a protocol used for radio communications
+      between aircraft and ground stations. It is used to carry ACARS and AOC messages as well as
+      CPDLC (Controller-Pilot Data Link Communications) and ADS-C.
+    '';
+    license = lib.licenses.gpl3Plus;
+    mainProgram = "dumphfdl";
+    maintainers = [ lib.maintainers.mafo ];
+    platforms = with lib.platforms; linux ++ darwin;
+    badPlatforms = lib.platforms.darwin;
+  };
+})

pkgs/by-name/ez/eztrace/package.nix

@@ -9,6 +9,7 @@
   libbfd,
   libopcodes,
   otf2,
+  ctestCheckHook,
   versionCheckHook,
 }:
 
@@ -54,8 +55,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   cmakeFlags = [
     (lib.cmakeBool "EZTRACE_ENABLE_MEMORY" true)
-    # This test is somewhat flaky and fails once per several rebuilds.
-    (lib.cmakeFeature "CMAKE_CTEST_ARGUMENTS" "--exclude-regex;memory_tests")
   ];
 
   nativeBuildInputs = [
@@ -72,8 +71,13 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   doCheck = true;
+  disabledTests = [
+    # This test is somewhat flaky and fails once per several rebuilds.
+    "memory_tests"
+  ];
   nativeCheckInputs = [
     otf2 # `otf2-print` needed by compiler_instrumentation_tests,pthread_tests,posixio_tests
+    ctestCheckHook
   ];
 
   postInstall = ''

pkgs/by-name/f3/f3d/package.nix

@@ -97,8 +97,5 @@ stdenv.mkDerivation rec {
     ];
     platforms = with platforms; unix;
     mainProgram = "f3d";
-    # error: use of undeclared identifier 'NSMenuItem'
-    # adding AppKit does not solve it
-    broken = with stdenv.hostPlatform; isDarwin && isx86_64;
   };
 }

pkgs/by-name/fl/fluxctl/package.nix

@@ -1,50 +0,0 @@
-{
-  lib,
-  buildGoModule,
-  fetchFromGitHub,
-  installShellFiles,
-}:
-
-buildGoModule rec {
-  pname = "fluxctl";
-  version = "1.25.4";
-
-  src = fetchFromGitHub {
-    owner = "weaveworks";
-    repo = "flux";
-    rev = version;
-    sha256 = "sha256-rKZ0fI9UN4oq6gfDMNR2+kCazlDexE1+UVzQ3xgkSA8=";
-  };
-
-  vendorHash = "sha256-6Trk49Vo3oMjSaHRDm2v+elPDHwdn2D3Z6i4UYcx0IQ=";
-
-  nativeBuildInputs = [ installShellFiles ];
-
-  doCheck = false;
-
-  subPackages = [ "cmd/fluxctl" ];
-
-  ldflags = [
-    "-s"
-    "-w"
-    "-X main.version=${version}"
-  ];
-
-  postInstall = ''
-    for shell in bash fish zsh; do
-      $out/bin/fluxctl completion $shell > fluxctl.$shell
-      installShellCompletion fluxctl.$shell
-    done
-  '';
-
-  meta = with lib; {
-    description = "CLI client for Flux, the GitOps Kubernetes operator";
-    mainProgram = "fluxctl";
-    homepage = "https://github.com/fluxcd/flux";
-    license = licenses.asl20;
-    maintainers = with maintainers; [
-      Gonzih
-      Br1ght0ne
-    ];
-  };
-}

pkgs/by-name/fz/fzf-make/package.nix

@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "fzf-make";
-  version = "0.56.0";
+  version = "0.59.0";
 
   src = fetchFromGitHub {
     owner = "kyu08";
     repo = "fzf-make";
     rev = "v${version}";
-    hash = "sha256-OioPl2uJVepMsR1PYHpASj3yQ10bCaGFxI1wQR61EsA=";
+    hash = "sha256-KH2tcQngc3LVgybdmw/obhbMiLoj3GZVnyWaDXXBJNs=";
   };
 
-  cargoHash = "sha256-Y1kFbJi+AB4uROieZERafU82RWm2AGQseDUuVzJn3NA=";
+  cargoHash = "sha256-GCnzqfTBvckWtgXCz0Yd0SHh82bC3bS7uLOAdY37z+s=";
 
   useFetchCargoVendor = true;
 

pkgs/by-name/gd/gdal/package.nix

@@ -286,6 +286,9 @@ stdenv.mkDerivation (finalAttrs: {
       "test_vsioss_6"
       # flaky?
       "test_tiledb_read_arbitrary_array"
+      # tests for magic numbers, seem to change with different poppler versions,
+      # and architectures
+      "test_pdf_extra_rasters"
     ]
     ++ lib.optionals (!stdenv.hostPlatform.isx86_64) [
       # likely precision-related expecting x87 behaviour

pkgs/by-name/ge/geant4/package.nix

@@ -141,7 +141,6 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
-    broken = (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64);
     description = "Toolkit for the simulation of the passage of particles through matter";
     longDescription = ''
       Geant4 is a toolkit for the simulation of the passage of particles through matter.

pkgs/by-name/gi/git-town/package.nix

@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -64,14 +65,16 @@ buildGoModule rec {
     in
     [ "-skip=^${builtins.concatStringsSep "$|^" skippedTests}$" ];
 
-  postInstall = ''
-    installShellCompletion --cmd git-town \
-      --bash <($out/bin/git-town completions bash) \
-      --fish <($out/bin/git-town completions fish) \
-      --zsh <($out/bin/git-town completions zsh)
-
-    wrapProgram $out/bin/git-town --prefix PATH : ${lib.makeBinPath [ git ]}
-  '';
+  postInstall =
+    lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+      installShellCompletion --cmd git-town \
+        --bash <($out/bin/git-town completions bash) \
+        --fish <($out/bin/git-town completions fish) \
+        --zsh <($out/bin/git-town completions zsh)
+    ''
+    + ''
+      wrapProgram $out/bin/git-town --prefix PATH : ${lib.makeBinPath [ git ]}
+    '';
 
   passthru.tests.version = testers.testVersion {
     package = git-town;

pkgs/by-name/gi/gitea/package.nix

@@ -35,18 +35,18 @@ let
 in
 buildGoModule rec {
   pname = "gitea";
-  version = "1.23.7";
+  version = "1.23.8";
 
   src = fetchFromGitHub {
     owner = "go-gitea";
     repo = "gitea";
     tag = "v${gitea.version}";
-    hash = "sha256-pdmRujcLnQBIQXc26MPpoLbbV00KMaVHPY4xTsitaCA=";
+    hash = "sha256-79GSHJozNlzBkddeyKX36D/w73loEN28fNSbcMVhgxQ=";
   };
 
   proxyVendor = true;
 
-  vendorHash = "sha256-h9RnHv4weGfHwpmuEhQbsYDd5fKc439m0gF/BgDVIdA=";
+  vendorHash = "sha256-wdrFa+6E1qTW9PBXr7ROgBQn3nfgxZF7Z47yk61Iqvs=";
 
   outputs = [
     "out"

pkgs/by-name/gl/glrnvim/package.nix

@@ -6,17 +6,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "glrnvim";
-  version = "1.4.0";
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     owner = "beeender";
     repo = "glrnvim";
     rev = "v${version}";
-    hash = "sha256-n3t3s3fzmBGXRDydYxNJ13itKul8dyLNW6HP8Di4hY0=";
+    hash = "sha256-fyJ3k1CBrxL6It8x9jNumzCuhXug6eB/fuvPUQYEc4A=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-oE1HXmJbKHegubqhsovat1ce/4rjdKGGTnmDdbRBo/k=";
+  cargoHash = "sha256-xDa2aMWx09dEbRDops2HwYSl/KMA7CeFqS2bnxX/8w8=";
 
   postInstall = ''
     install -Dm644 glrnvim.desktop -t $out/share/applications

pkgs/by-name/go/goperf/package.nix

@@ -9,15 +9,15 @@
 
 buildGoModule rec {
   pname = "goperf";
-  version = "0-unstable-2025-04-07";
+  version = "0-unstable-2025-05-05";
 
   src = fetchgit {
     url = "https://go.googlesource.com/perf";
-    rev = "71ba5bc8ccce8a755de82e9bad6ca4e4d7b590d2";
-    hash = "sha256-xY9Z502YUUePqoocBWWPxD/TLFQtYq3TLyj3Izp8n9A=";
+    rev = "a54a20dddd9743f7ac60d2d506e561eaeafd4831";
+    hash = "sha256-+d8s9kEzBJ/21U2x8ZuiGdQrspFIJEmrjxmzNahC/V0=";
   };
 
-  vendorHash = "sha256-BYfn9ip8QCS+spYR51eS6SysYlZtBZf7GhuFZVh3Kb8=";
+  vendorHash = "sha256-nqK6xMKYe4uMXvcqopTAV66qklWUq1TzsP8V67TGJJU=";
 
   passthru.updateScript = writeShellScript "update-goperf" ''
     export UPDATE_NIX_ATTR_PATH=goperf

pkgs/by-name/go/gotraceui/package.nix

@@ -10,6 +10,7 @@
   libxkbcommon,
   vulkan-headers,
   wayland,
+  fetchpatch,
 }:
 
 buildGoModule rec {
@@ -19,11 +20,19 @@ buildGoModule rec {
   src = fetchFromGitHub {
     owner = "dominikh";
     repo = "gotraceui";
-    rev = "v${version}";
+    tag = "v${version}";
     sha256 = "sha256-Rforuh9YlTv/mTpQm0+BaY+Ssc4DAiDCzVkIerP5Uz0=";
   };
 
-  vendorHash = "sha256-dNV5u6BG+2Nzci6dX/4/4WAeM/zXE5+Ix0HqIsNnm0E=";
+  patches = [
+    (fetchpatch {
+      name = "switch-to-gio-fork.patch";
+      url = "https://github.com/dominikh/gotraceui/commit/00289f5f4c1da3e13babd2389e533b069cd18e3c.diff";
+      hash = "sha256-dxsVMjyKkRG4Q6mONlJAohWJ8YTu8KN7ynPVycJhcs8=";
+    })
+  ];
+
+  vendorHash = "sha256-9rzcSxlOuQC5bt1kZuRX7CTQaDHKrtGRpMNLrOHTjJk=";
   subPackages = [ "cmd/gotraceui" ];
 
   nativeBuildInputs = [ pkg-config ];

pkgs/by-name/gq/gqlgen/package.nix

@@ -6,7 +6,7 @@
 }:
 
 let
-  version = "0.17.71";
+  version = "0.17.73";
 in
 buildGoModule {
   pname = "gqlgen";
@@ -16,10 +16,10 @@ buildGoModule {
     owner = "99designs";
     repo = "gqlgen";
     tag = "v${version}";
-    hash = "sha256-AkLs7nDnygbnq4DYZ72+JChutKj+2cJHlNiTa761aIs=";
+    hash = "sha256-s6D9ohFdUhch2LhpmHYBgpBrO/5WEM1TX/+DIfwxSPc=";
   };
 
-  vendorHash = "sha256-Q9voEyziSlq9Ele4fz/obQS4ufapa4zK3cTd493XJgU=";
+  vendorHash = "sha256-QN3ebVC6cJBnpm9Kyhg16EcXoT2rI1fR6QEf6i74WHg=";
 
   subPackages = [ "." ];
 

pkgs/by-name/ha/haguichi/package.nix

@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "haguichi";
-  version = "1.5.1";
+  version = "1.5.2";
 
   src = fetchFromGitHub {
     owner = "ztefn";
     repo = "haguichi";
     tag = finalAttrs.version;
-    hash = "sha256-hSQsKG86QUzv/dfqz2amSXyAaA1ZAk9dTvel9KVgeFs=";
+    hash = "sha256-IEcBCiPU9NPrAbTCnONraeVb/Nlq/u4fsEZX+Vd1DiY=";
   };
 
   postPatch = ''

pkgs/by-name/he/hexpatch/package.nix

@@ -10,17 +10,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "hexpatch";
-  version = "1.11.1";
+  version = "1.11.2";
 
   src = fetchFromGitHub {
     owner = "Etto48";
     repo = "HexPatch";
     tag = "v${version}";
-    hash = "sha256-/wPRCqHvRiH8snD6D9qyk7YdbchOi0BUz/kI5EitOls=";
+    hash = "sha256-xeHOViakCRMXQqmuUCeekL0tyYyh61OnU0zDk767NPU=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-bJaL2ni0ei9LeeMdt5Zo68ECbzrBtvAZULjHOLcnacY=";
+  cargoHash = "sha256-3eaEgzGVSz6MjNqRGjzP8GoOZ/3eYOkI4Gd6+n+6vDg=";
 
   nativeBuildInputs = [
     cmake

pkgs/by-name/ho/hobbes/package.nix

@@ -3,7 +3,6 @@
   stdenv,
   llvmPackages,
   fetchFromGitHub,
-  fetchpatch,
   cmake,
   llvm_12,
   ncurses,
@@ -14,34 +13,20 @@
 }:
 llvmPackages.stdenv.mkDerivation {
   pname = "hobbes";
-  version = "0-unstable-2023-06-03";
+  version = "0-unstable-2025-04-23";
 
   src = fetchFromGitHub {
     owner = "morganstanley";
     repo = "hobbes";
-    rev = "88a712b85bc896a4c87e60c12321445f1cdcfd00";
-    hash = "sha256-2v0yk35/cLKTjX0Qbc8cjc7Y6bamRSa9GpPvGoxL2Cw=";
+    rev = "0829030be03d47f91075cbebd0c9565f44bf9911";
+    hash = "sha256-GZ26XL4++2MWQED2tVWeJ8HFcFQUXnXZ3+JCgdlAXNo=";
   };
 
-  patches = [
-    # fix build for LLVM-12+
-    # https://github.com/morganstanley/hobbes/pull/452
-    (fetchpatch {
-      name = "include-cstdint.patch";
-      url = "https://github.com/morganstanley/hobbes/commit/924b71fca06c61e606792cc8db8521fb499d4237.patch";
-      hash = "sha256-/VsWtTYc3LBOnm4Obgx/MOqaaWZhUc8yzmkygtNz+mY=";
-    })
+  CXXFLAGS = [
+    "-Wno-error=missing-template-arg-list-after-template-kw"
+    "-Wno-error=deprecated-copy"
   ];
 
-  # only one warning generated. try to remove on next update
-  env.CXXFLAGS = "-Wno-error=deprecated-copy";
-
-  # TODO: re-enable Python tests once they work on Python 3
-  # currently failing with "I don't know how to decode the primitive type: b'bool'"
-  postPatch = ''
-    rm test/Python.C
-  '';
-
   nativeBuildInputs = [
     cmake
   ];

pkgs/by-name/jb/jbrowse/package.nix

@@ -6,11 +6,11 @@
 
 let
   pname = "jbrowse";
-  version = "3.3.0";
+  version = "3.4.0";
 
   src = fetchurl {
     url = "https://github.com/GMOD/jbrowse-components/releases/download/v${version}/jbrowse-desktop-v${version}-linux.AppImage";
-    sha256 = "sha256-v4irH+U1w/XYTqT2z60Ce4hhA9Ej9pRCHuov9bViEy8=";
+    sha256 = "sha256-u7ZVHn1/HUyV27yGx0HZeWgdm4NuVK8ZH0UogrmbxOo=";
   };
 
   appimageContents = appimageTools.extractType2 {

pkgs/by-name/ji/jimtcl/package.nix

@@ -78,6 +78,7 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "http://jim.tcl.tk/";
     license = lib.licenses.bsd2;
     platforms = lib.platforms.all;
+    broken = stdenv.hostPlatform.isDarwin;
     maintainers = with lib.maintainers; [
       dbohdan
       fgaz

pkgs/by-name/li/libmediainfo/package.nix

@@ -14,11 +14,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libmediainfo";
-  version = "25.03";
+  version = "25.04";
 
   src = fetchurl {
     url = "https://mediaarea.net/download/source/libmediainfo/${version}/libmediainfo_${version}.tar.xz";
-    hash = "sha256-NfH9q4EjnKNVxt41ioT73gR3/tjrNQ5d/valmBRcUgc=";
+    hash = "sha256-rUXtfJ23gHqoA4RcqIutlSaqjaiDpYEn5TkKqi2Bu7E=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/li/libtommath/package.nix

@@ -14,15 +14,17 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-KWJy2TQ1mRMI63NgdgDANLVYgHoH6CnnURQuZcz6nQg=";
   };
 
-  nativeBuildInputs = [ libtool ];
-
   postPatch = ''
-    substituteInPlace makefile.shared --replace glibtool libtool
-    substituteInPlace makefile_include.mk --replace "shell arch" "shell uname -m"
+    substituteInPlace makefile.shared \
+      --replace-fail glibtool libtool \
+      --replace-fail libtool "${lib.getExe (libtool.override { stdenv = stdenv; })}"
+    substituteInPlace makefile_include.mk \
+      --replace-fail "gcc" "${stdenv.cc.targetPrefix}cc"
   '';
 
   preBuild = ''
     makeFlagsArray=(PREFIX=$out \
+      CC=${stdenv.cc.targetPrefix}cc \
       INSTALL_GROUP=$(id -g) \
       INSTALL_USER=$(id -u))
   '';

pkgs/by-name/lo/lokalise2-cli/package.nix

@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "lokalise2-cli";
-  version = "3.1.3";
+  version = "3.1.4";
 
   src = fetchFromGitHub {
     owner = "lokalise";
     repo = "lokalise-cli-2-go";
     rev = "v${version}";
-    sha256 = "sha256-9d5rlVyGPLNzlKzGq/XJleiKvLtkE0AttIiH6NYUwFo=";
+    sha256 = "sha256-weqYHKxu6HvdrFduzKtHtCVnJ0GVRGIPABLrsW4f0VA=";
   };
 
   vendorHash = "sha256-thD8NtG9uVI4KwNQiNsVCUdyUcgAmnr+szsUQ2Ika1c=";

pkgs/by-name/ma/ma/package.nix

@@ -10,10 +10,14 @@ stdenv.mkDerivation {
   version = "11";
 
   src = fetchurl {
-    url = "http://call-with-current-continuation.org/ma/ma.tar.gz";
+    url = "https://web.archive.org/web/20250511210225/http://call-with-current-continuation.org/ma/ma.tar.gz";
     hash = "sha256-1UVxXbN2jSNm13BjyoN3jbKtkO3DUEEHaDOC2Ibbxf4=";
   };
 
+  postPatch = ''
+    substituteInPlace ./build --replace-fail gcc ${lib.getExe stdenv.cc}
+  '';
+
   buildInputs = [
     tclPackages.tk
   ];
@@ -40,7 +44,9 @@ stdenv.mkDerivation {
     homepage = "http://call-with-current-continuation.org/ma/ma.html";
     mainProgram = "ma";
     maintainers = with lib.maintainers; [ ehmry ];
-    license = lib.licenses.free;
+    # Per the README:
+    # > All of MA's source code is hereby placed in the public domain
+    license = lib.licenses.publicDomain;
     inherit (tclPackages.tk.meta) platforms;
   };
 }

pkgs/by-name/ma/maltego/package.nix

@@ -13,11 +13,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "maltego";
-  version = "4.9.2";
+  version = "4.9.3";
 
   src = fetchzip {
     url = "https://downloads.maltego.com/maltego-v4/linux/Maltego.v${finalAttrs.version}.linux.zip";
-    hash = "sha256-+jPfIqvaVLo+s/yNHc5fHtnEMClcHtLVsVzFi4LZnK0=";
+    hash = "sha256-h0cTA6/i7cpYvGQli3UA6WZnaMOProN4f0TTdeIczcY=";
   };
 
   postPatch = ''

pkgs/by-name/me/mediainfo/package.nix

@@ -11,11 +11,11 @@
 
 stdenv.mkDerivation rec {
   pname = "mediainfo";
-  version = "25.03";
+  version = "25.04";
 
   src = fetchurl {
     url = "https://mediaarea.net/download/source/mediainfo/${version}/mediainfo_${version}.tar.xz";
-    hash = "sha256-wpO7MPIx3FMQuYDv2E/n0za4MQto6DJlzxZtf3/Dhsk=";
+    hash = "sha256-SyVT/pEEMy07rKX+Yba4evTUkxCMW4Y4Ac2wpIJqM64=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/mi/microfetch/package.nix

@@ -7,17 +7,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "microfetch";
-  version = "0.4.7";
+  version = "0.4.8";
 
   src = fetchFromGitHub {
     owner = "NotAShelf";
     repo = "microfetch";
     tag = "v${version}";
-    hash = "sha256-iNx1/My72i+Ni/WVqF2HFgLjqH6W6WPupdOkH6UQH9E=";
+    hash = "sha256-WGr2qqxcbh7hotqPj8ZQbSB3E4qG5U2LEmqXx/aEc18=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-UguHTRHdcogxg/8DmRWSE7XwmaF36MTGHzF5CpMBc3Y=";
+  cargoHash = "sha256-/siuEdZeIk23aIagbjrd5cYvb5/xEdAq84PoSVLWz60=";
 
   passthru.updateScript = nix-update-script { };
 

pkgs/by-name/mo/mold/package.nix

@@ -26,13 +26,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mold";
-  version = "2.39.0";
+  version = "2.39.1";
 
   src = fetchFromGitHub {
     owner = "rui314";
     repo = "mold";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-DT8xU1JN3zeJe7o7YQFrnpyN0LtcsclUsIX5jFeVYvA=";
+    hash = "sha256-uC6oakFfF0tpSiBeps5IO41Khk7VyCMSZhVh2Gmwlyc=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/mo/molly-guard/package.nix

@@ -7,22 +7,26 @@
   systemd,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "molly-guard";
-  version = "0.7.2";
+  version = "0.8.5";
 
   src = fetchurl {
-    url = "https://launchpad.net/ubuntu/+archive/primary/+files/molly-guard_${version}_all.deb";
-    sha256 = "1k6b1hn8lc4rj9n036imsl7s9lqj6ny3acdhnbnamsdkkndmxrw7";
+    url = "https://launchpad.net/ubuntu/+archive/primary/+files/molly-guard_${finalAttrs.version}_all.deb";
+    hash = "sha256-9CQNU+5OPmCPTN3rotyJPLcvI8eo5WJQqx0OaI7Wox4=";
   };
 
   nativeBuildInputs = [ dpkg ];
 
   installPhase = ''
-    sed -i "s|/lib/molly-guard|${systemd}/sbin|g" lib/molly-guard/molly-guard
-    sed -i "s|run-parts|${busybox}/bin/run-parts|g" lib/molly-guard/molly-guard
-    sed -i "s|/etc/molly-guard/|$out/etc/molly-guard/|g" lib/molly-guard/molly-guard
-    cp -r ./ $out/
+    runHook preInstall
+
+    sed -i "s|/lib/molly-guard|${systemd}/sbin|g" usr/lib/molly-guard/molly-guard
+    sed -i "s|run-parts|${busybox}/bin/run-parts|g" usr/lib/molly-guard/molly-guard
+    sed -i "s|/etc/molly-guard/|$out/etc/molly-guard/|g" usr/lib/molly-guard/molly-guard
+    cp -r usr $out
+
+    runHook postInstall
   '';
 
   postFixup = ''
@@ -31,12 +35,12 @@ stdenv.mkDerivation rec {
     done;
   '';
 
-  meta = with lib; {
+  meta = {
     description = "Attempts to prevent you from accidentally shutting down or rebooting machines";
     homepage = "https://salsa.debian.org/debian/molly-guard";
-    license = licenses.artistic2;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ DerTim1 ];
+    license = lib.licenses.artistic2;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ DerTim1 ];
     priority = -10;
   };
-}
+})

pkgs/by-name/mo/monkeysAudio/package.nix

@@ -6,12 +6,12 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  version = "11.09";
+  version = "11.10";
   pname = "monkeys-audio";
 
   src = fetchzip {
     url = "https://monkeysaudio.com/files/MAC_${builtins.concatStringsSep "" (lib.strings.splitString "." finalAttrs.version)}_SDK.zip";
-    hash = "sha256-kGlrCeyozEQbiccqL5Xf9Iqwo5xkcunhNw4oMZZDZo0=";
+    hash = "sha256-OYOeBB3ykpiBnwLctnn/Pv3F30TrSKJJOeYrBaann7s=";
     stripRoot = false;
   };
 

pkgs/by-name/ne/netease-cloud-music-gtk/package.nix

@@ -15,23 +15,38 @@
   libadwaita,
   glib-networking,
   gst_all_1,
+  libxml2,
 }:
 
+let
+  libadwaita' = libadwaita.overrideAttrs (oldAttrs: {
+    version = "1.6.2-unstable-2025-01-02";
+    src = oldAttrs.src.override {
+      tag = null;
+      rev = "f5f0e7ce69405846a8f8bdad11cef2e2a7e99010";
+      hash = "sha256-n5RbGHtt2g627T/Tg8m3PjYIl9wfYTIcrplq1pdKAXk=";
+    };
+
+    # `test-application-window` is flaky on aarch64-linux
+    doCheck = false;
+  });
+in
+
 stdenv.mkDerivation (finalAttrs: {
   pname = "netease-cloud-music-gtk";
-  version = "2.5.0";
+  version = "2.5.2";
 
   src = fetchFromGitHub {
     owner = "gmg137";
     repo = "netease-cloud-music-gtk";
     tag = finalAttrs.version;
-    hash = "sha256-QRgGQDYrqOpZErz+OHZF1GPshxnZRPTIJSNkFWqQeHM=";
+    hash = "sha256-3vAEk4HwS7EiMv0DAYOvZ9dOlO0yMEUcaO2qCCWlpLs=";
   };
 
   cargoDeps = rustPlatform.importCargoLock {
     lockFile = ./Cargo.lock;
     outputHashes = {
-      "netease-cloud-music-api-1.5.0" = "sha256-3CBWYUJ+5/KRQ6/EPt84rBxXQRjhvazrasRzbpkRwPU=";
+      "netease-cloud-music-api-1.5.1" = "sha256-PFzXm7jgNsEJiluBaNuhSF0kg/licDdbItMDWmfIBDk=";
     };
   };
 
@@ -48,13 +63,14 @@ stdenv.mkDerivation (finalAttrs: {
     rustPlatform.cargoSetupHook
     cargo
     rustc
+    libxml2
   ];
 
   buildInputs =
     [
       openssl
       dbus
-      libadwaita
+      libadwaita'
       glib-networking
     ]
     ++ (with gst_all_1; [

pkgs/by-name/ne/netgen/package.nix

@@ -3,7 +3,10 @@
   stdenv,
   fetchFromGitHub,
   fetchpatch2,
-  makeWrapper,
+  libicns,
+  imagemagick,
+  makeDesktopItem,
+  copyDesktopItems,
   cmake,
   python3Packages,
   mpi,
@@ -66,28 +69,38 @@ stdenv.mkDerivation (finalAttrs: {
       url = "${patchSource}/include_stdlib.patch";
       hash = "sha256-W+NgGBuy/UmzVbPTSqR8FRUlyN/9dl9l9e9rxKklmIc=";
     })
-    (fetchpatch2 {
-      url = "${patchSource}/fix-version.patch";
-      hash = "sha256-CT98Wq3UufB81z/jYLiH9nXvt+QzoZ7210OeuFXCfmc=";
-    })
   ];
 
   # when generating python stub file utilizing system python pybind11_stubgen module
   # cmake need to inherit pythonpath
-  postPatch = ''
-    substituteInPlace python/CMakeLists.txt \
-      --replace-fail ''\'''${CMAKE_INSTALL_PREFIX}/''${NG_INSTALL_DIR_PYTHON}' \
-                     ''\'''${CMAKE_INSTALL_PREFIX}/''${NG_INSTALL_DIR_PYTHON}:$ENV{PYTHONPATH}'
+  postPatch =
+    ''
+      sed -i '/-DBDIR=''\'''${CMAKE_CURRENT_BINARY_DIR}/a\
+      -DNETGEN_VERSION_GIT=''\'''${NETGEN_VERSION_GIT}
+      ' CMakeLists.txt
 
-    substituteInPlace ng/ng.tcl ng/onetcl.cpp \
-      --replace-fail "libnggui" "$out/lib/libnggui"
-  '';
+      substituteInPlace python/CMakeLists.txt \
+        --replace-fail ''\'''${CMAKE_INSTALL_PREFIX}/''${NG_INSTALL_DIR_PYTHON}' \
+                       ''\'''${CMAKE_INSTALL_PREFIX}/''${NG_INSTALL_DIR_PYTHON}:$ENV{PYTHONPATH}'
+
+      substituteInPlace ng/ng.tcl ng/onetcl.cpp \
+        --replace-fail "libnggui" "$out/lib/libnggui"
+
+      substituteInPlace ng/Togl2.1/CMakeLists.txt \
+        --replace-fail "/usr/bin/gcc" "$CC"
+    ''
+    + lib.optionalString (!stdenv.hostPlatform.isx86_64) ''
+      # mesh generation differs on x86_64 and aarch64 platform
+      # test_tutorials will fail on aarch64 platform
+      rm tests/pytest/test_tutorials.py
+    '';
 
   nativeBuildInputs = [
+    libicns
+    imagemagick
     cmake
-    makeWrapper
     python3Packages.pybind11-stubgen
-  ];
+  ] ++ lib.optional stdenv.hostPlatform.isLinux copyDesktopItems;
 
   buildInputs = [
     metis
@@ -111,6 +124,12 @@ stdenv.mkDerivation (finalAttrs: {
 
   cmakeFlags = [
     (lib.cmakeFeature "NETGEN_VERSION_GIT" "v${finalAttrs.version}-0")
+    (lib.cmakeFeature "NG_INSTALL_DIR_BIN" "bin")
+    (lib.cmakeFeature "NG_INSTALL_DIR_LIB" "lib")
+    (lib.cmakeFeature "NG_INSTALL_DIR_CMAKE" "lib/cmake/${finalAttrs.pname}")
+    (lib.cmakeFeature "NG_INSTALL_DIR_PYTHON" python3Packages.python.sitePackages)
+    (lib.cmakeFeature "NG_INSTALL_DIR_RES" "share")
+    (lib.cmakeFeature "NG_INSTALL_DIR_INCLUDE" "include")
     (lib.cmakeFeature "CMAKE_CXX_FLAGS" archFlags)
     (lib.cmakeBool "USE_MPI" true)
     (lib.cmakeBool "USE_MPI4PY" true)
@@ -124,9 +143,45 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.cmakeBool "ENABLE_UNIT_TESTS" finalAttrs.finalPackage.doInstallCheck)
   ];
 
-  # mesh generation differs on x86_64 and aarch64 platform
-  # tests will fail on aarch64 platform
-  doInstallCheck = stdenv.hostPlatform.isx86_64;
+  __darwinAllowLocalNetworking = true;
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "netgen";
+      exec = "netgen";
+      comment = finalAttrs.meta.description;
+      desktopName = "Netgen Mesh Generator";
+      genericName = "3D Mesh Generator";
+      categories = [ "Science" ];
+      icon = "netgen";
+    })
+  ];
+
+  postInstall =
+    lib.optionalString stdenv.hostPlatform.isDarwin ''
+      rm $out/bin/{Netgen1,startup.sh}
+      mkdir -p $out/Applications/${finalAttrs.pname}.app/Contents/{MacOS,Resouces}
+      substituteInPlace $out/Info.plist --replace-fail "Netgen1" "netgen"
+      mv $out/Info.plist $out/Applications/${finalAttrs.pname}.app/Contents
+      mv $out/Netgen.icns $out/Applications/${finalAttrs.pname}.app/Contents/Resouces
+      ln -s $out/bin/netgen $out/Applications/${finalAttrs.pname}.app/Contents/MacOS/netgen
+    ''
+    + lib.optionalString stdenv.hostPlatform.isLinux ''
+      # Extract pngs from the Apple icon image and create
+      # the missing ones from the 512x512 image.
+      icns2png --extract ../netgen.icns
+      for size in 16 24 32 48 64 128 256 512; do
+        mkdir -pv $out/share/icons/hicolor/"$size"x"$size"/apps
+        if [ -e netgen_"$size"x"$size"x32.png ]
+        then
+          mv netgen_"$size"x"$size"x32.png $out/share/icons/hicolor/"$size"x"$size"/apps/netgen.png
+        else
+          convert -resize "$size"x"$size" netgen_512x512x32.png $out/share/icons/hicolor/"$size"x"$size"/apps/netgen.png
+        fi
+      done;
+    '';
+
+  doInstallCheck = true;
 
   preInstallCheck = ''
     export PYTHONPATH=$out/${python3Packages.python.sitePackages}:$PYTHONPATH
@@ -139,15 +194,19 @@ stdenv.mkDerivation (finalAttrs: {
     python3Packages.pytest
     python3Packages.pytest-check
     python3Packages.pytest-mpi
+    python3Packages.pythonImportsCheckHook
     mpiCheckPhaseHook
   ];
 
+  pythonImportsCheck = [ "netgen" ];
+
   passthru = {
     inherit avxSupport avx2Support avx512Support;
   };
 
   meta = {
     homepage = "https://ngsolve.org";
+    downloadPage = "https://github.com/NGSolve/netgen";
     description = "Atomatic 3d tetrahedral mesh generator";
     license = with lib.licenses; [
       lgpl2Plus
@@ -157,10 +216,7 @@ stdenv.mkDerivation (finalAttrs: {
       boost
       publicDomain
     ];
-    platforms = [
-      "x86_64-linux"
-      "aarch64-linux"
-    ];
+    platforms = lib.platforms.unix;
     mainProgram = "netgen";
     maintainers = with lib.maintainers; [ qbisi ];
   };

pkgs/by-name/ne/nezha/package.nix

@@ -14,7 +14,7 @@
 
 let
   pname = "nezha";
-  version = "1.12.0";
+  version = "1.12.4";
 
   frontendName = lib.removePrefix "nezha-theme-";
 
@@ -58,7 +58,7 @@ buildGo124Module {
     owner = "nezhahq";
     repo = "nezha";
     tag = "v${version}";
-    hash = "sha256-ajjAsoR+1HRHfIjyqlJFHtn1nzDAdbP5TzKOqnHlAXw=";
+    hash = "sha256-f9zP9koWjP8PPtQhbYx56J1mW8+xKuZCfxgOLw6XGc0=";
   };
 
   proxyVendor = true;
@@ -97,7 +97,7 @@ buildGo124Module {
     GOROOT=''${GOROOT-$(go env GOROOT)} swag init --pd -d . -g ./cmd/dashboard/main.go -o ./cmd/dashboard/docs --parseGoList=false
   '';
 
-  vendorHash = "sha256-8pOeMUiBEUbB7D3MnlpOTdanktR8XdXm3YB53XMCDWQ=";
+  vendorHash = "sha256-Pj5HfrwIuWt3Uwt2Y9Tz96B2kL7Svq5rzU1hKf/RZ4s=";
 
   ldflags = [
     "-s"

pkgs/by-name/no/nomacs/package.nix

@@ -18,8 +18,8 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "nomacs";
-  version = "3.19.1";
-  hash = "sha256-NRwZ/ShJaLCMFv7QdfRoJY5zQFo18cAVWGRpS3ap3Rw=";
+  version = "3.21.1";
+  hash = "sha256-RRa19vj7iTtGzdssdtHVOsDzS4X+p1HeiZKy8EIWxq8=";
 
   src = fetchFromGitHub {
     owner = "nomacs";
@@ -32,8 +32,8 @@ stdenv.mkDerivation (finalAttrs: {
   plugins = fetchFromGitHub {
     owner = "novomesk";
     repo = "nomacs-plugins";
-    rev = "40d0f7089b7f108077dac5dede52e8a303b243b3";
-    hash = "sha256-7+JMmHaTvWjVTkLwXGtQHnoaC/3vK7haCzNvVIZ9F/g=";
+    rev = "20101da282f13d3184ece873388e1c234a79b5e7";
+    hash = "sha256-gcRc4KoWJQ5BirhLuk+c+5HwBeyQtlJ3iyX492DXeVk=";
   };
 
   outputs =

pkgs/by-name/oc/ocenaudio/package.nix

@@ -1,10 +1,10 @@
 {
-  stdenv,
   lib,
+  stdenv,
   fetchurl,
   autoPatchelfHook,
   dpkg,
-  qt5,
+  qt6,
   libjack2,
   alsa-lib,
   bzip2,
@@ -12,54 +12,55 @@
   xz,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "ocenaudio";
-  version = "3.13.8";
+  version = "3.14.11";
 
   src = fetchurl {
-    url = "https://www.ocenaudio.com/downloads/index.php/ocenaudio_debian9_64.deb?version=v${version}";
-    hash = "sha256-GKNho2xV6Lc4U5Ys4j+ZiGxE8irolcrTttN3PG1S2Ug=";
+    name = "ocenaudio.deb";
+    url = "https://www.ocenaudio.com/downloads/index.php/ocenaudio_debian12.deb?version=v${finalAttrs.version}";
+    hash = "sha256-+UQ4veSoqwNC6ENQVWmOFebiI6RQlV7rBL7n238xxyc=";
   };
 
   nativeBuildInputs = [
-    alsa-lib
     autoPatchelfHook
-    bzip2
-    libjack2
-    libpulseaudio
-    qt5.qtbase
-    qt5.wrapQtAppsHook
-    xz
+    qt6.wrapQtAppsHook
+    dpkg
   ];
 
-  buildInputs = [ dpkg ];
+  buildInputs = [
+    xz
+    qt6.qtbase
+    bzip2
+    libjack2
+    alsa-lib
+    libpulseaudio
+  ];
 
-  dontUnpack = true;
   dontBuild = true;
   dontStrip = true;
 
   installPhase = ''
-    mkdir -p $out
-    dpkg -x $src $out
-    cp -av $out/opt/ocenaudio/* $out
-    rm -rf $out/opt
-    mv $out/usr/share $out/share
-    rm -rf $out/usr
+    runHook preInstall
+
+    cp -r opt/ocenaudio $out
+    cp -r usr/share $out/share
     substituteInPlace $out/share/applications/ocenaudio.desktop \
       --replace-fail "/opt/ocenaudio/bin/ocenaudio" "ocenaudio"
     mkdir -p $out/share/licenses/ocenaudio
     mv $out/bin/ocenaudio_license.txt $out/share/licenses/ocenaudio/LICENSE
-
     # Create symlink bzip2 library
     ln -s ${bzip2.out}/lib/libbz2.so.1 $out/lib/libbz2.so.1.0
+
+    runHook postInstall
   '';
 
-  meta = with lib; {
+  meta = {
     description = "Cross-platform, easy to use, fast and functional audio editor";
     homepage = "https://www.ocenaudio.com";
-    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
-    license = licenses.unfree;
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+    license = lib.licenses.unfree;
     platforms = [ "x86_64-linux" ];
-    maintainers = with maintainers; [ onny ];
+    maintainers = with lib.maintainers; [ onny ];
   };
-}
+})

pkgs/by-name/om/omnictl/package.nix

@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "omnictl";
-  version = "0.48.4";
+  version = "0.49.1";
 
   src = fetchFromGitHub {
     owner = "siderolabs";
     repo = "omni";
     rev = "v${version}";
-    hash = "sha256-Gq3XkSTpvJ22aUxCGrPkb/m+8x+Uuiwi9+dLVUdpTJ0=";
+    hash = "sha256-0SLeR91KVwpAKLLVVZ3pEKI2Vy0QaysezX2M3X5aZdQ=";
   };
 
-  vendorHash = "sha256-LMDIpgtMbwr/cpVoAAnr56c/G81ocuOQCJDI+S0z1XU=";
+  vendorHash = "sha256-dT0sniTYli+zRYN/uLETS3SrM5cfDY5ZYYAthaiQ93U=";
 
   ldflags = [
     "-s"

pkgs/by-name/on/oncall/package.nix

@@ -0,0 +1,128 @@
+{
+  lib,
+  python3,
+  fetchFromGitHub,
+  fetchPypi,
+  oncall,
+  nixosTests,
+
+  # Override Python packages using
+  # self: super: { pkg = super.pkg.overridePythonAttrs (oldAttrs: { ... }); }
+  # Applied after defaultOverrides
+  packageOverrides ? self: super: { },
+}:
+let
+  defaultOverrides = [
+    # Override the version of some packages pinned in Oncall's setup.py
+    (self: super: {
+      # Support for Falcon 4.X missing
+      # https://github.com/linkedin/oncall/issues/430
+      falcon = super.falcon.overridePythonAttrs (oldAttrs: rec {
+        version = "3.1.3";
+        src = fetchFromGitHub {
+          owner = "falconry";
+          repo = "falcon";
+          tag = version;
+          hash = "sha256-7719gOM8WQVjODwOSo7HpH3HMFFeCGQQYBKktBAevig=";
+        };
+      });
+    })
+  ];
+
+  python = python3.override {
+    self = python;
+    packageOverrides = lib.composeManyExtensions (defaultOverrides ++ [ packageOverrides ]);
+  };
+in
+python.pkgs.buildPythonApplication rec {
+  pname = "oncall";
+  version = "2.1.7";
+  format = "setuptools";
+
+  src = fetchFromGitHub {
+    owner = "linkedin";
+    repo = pname;
+    tag = "v${version}";
+    hash = "sha256-oqzU4UTpmAcZhqRilquxWQVyHv8bqq0AGraiSqwauiI=";
+  };
+
+  patches = [
+    # Add support for loading extra settings file
+    ./support_extra_config.patch
+
+    # Support storing assets in custom state dir
+    ./support_custom_state_dir.patch
+
+    # Log Python errors to uwsgi
+    ./verbose_logging.patch
+  ];
+
+  dependencies = with python.pkgs; [
+    beaker
+    falcon
+    falcon-cors
+    gevent
+    gunicorn
+    icalendar
+    irisclient
+    jinja2
+    phonenumbers
+    pymysql
+    python-ldap
+    pytz
+    pyyaml
+    ujson
+    webassets
+  ];
+
+  postInstall = ''
+    mkdir "$out/share"
+    cp -r configs db "$out/share/"
+  '';
+
+  checkInputs = with python.pkgs; [
+    pytestCheckHook
+    pytest-mock
+  ];
+
+  disabledTestPaths = [
+    # Tests require running web server
+    "e2e/test_audit.py"
+    "e2e/test_events.py"
+    "e2e/test_ical.py"
+    "e2e/test_login.py"
+    "e2e/test_notification.py"
+    "e2e/test_override.py"
+    "e2e/test_pin.py"
+    "e2e/test_populate.py"
+    "e2e/test_roles.py"
+    "e2e/test_roster_suggest.py"
+    "e2e/test_rosters.py"
+    "e2e/test_schedules.py"
+    "e2e/test_services.py"
+    "e2e/test_subscription.py"
+    "e2e/test_teams.py"
+    "e2e/test_users.py"
+  ];
+
+  pythonImportsCheck = [
+    "oncall"
+  ];
+
+  passthru = {
+    tests = {
+      inherit (nixosTests) oncall;
+    };
+    inherit python;
+    pythonPath = "${python.pkgs.makePythonPath dependencies}:${oncall}/${python.sitePackages}";
+  };
+
+  meta = {
+    description = "A calendar web-app designed for scheduling and managing on-call shifts";
+    homepage = "http://oncall.tools";
+    changelog = "https://github.com/linkedin/oncall/blob/${src.tag}/CHANGELOG.md";
+    license = lib.licenses.bsd2;
+    maintainers = with lib.maintainers; [ onny ];
+    mainProgram = "oncall";
+  };
+}

pkgs/by-name/on/oncall/support_custom_state_dir.patch

@@ -0,0 +1,56 @@
+diff --git a/src/oncall/ui/__init__.py b/src/oncall/ui/__init__.py
+index a94fb17..364404a 100644
+--- a/src/oncall/ui/__init__.py
++++ b/src/oncall/ui/__init__.py
+@@ -18,8 +18,12 @@ from webassets.ext.jinja2 import AssetsExtension
+ from webassets.script import CommandLineEnvironment
+ 
+ STATIC_ROOT = environ.get('STATIC_ROOT', path.abspath(path.dirname(__file__)))
++SOURCE_ROOT = path.abspath(path.dirname(__file__))
+ assets_env = AssetsEnvironment(path.join(STATIC_ROOT, 'static'),
+                                url='/static')
++assets_env.cache = False
++assets_env.manifest = False
++assets_env.load_path = [ path.join(SOURCE_ROOT, 'static') ]
+ 
+ assets_env.register('libs', Bundle(
+     'js/jquery-3.3.1.min.js', 'js/handlebars-4.0.12.min.js', 'js/bootstrap.min.js',
+@@ -45,7 +49,7 @@ logger = logging.getLogger('webassets')
+ logger.addHandler(logging.StreamHandler())
+ 
+ jinja2_env = Jinja2Environment(extensions=[AssetsExtension], autoescape=True)
+-jinja2_env.loader = FileSystemLoader(path.join(STATIC_ROOT, 'templates'))
++jinja2_env.loader = FileSystemLoader(path.join(SOURCE_ROOT, 'templates'))
+ jinja2_env.assets_environment = assets_env
+ 
+ _filename_ascii_strip_re = re.compile(r'[^A-Za-z0-9_.-]')
+@@ -113,14 +117,15 @@ def secure_filename(filename):
+ class StaticResource(object):
+     allow_no_auth = True
+ 
+-    def __init__(self, path):
++    def __init__(self, path, root):
+         self.path = path.lstrip('/')
++        self.root = root
+ 
+     def on_get(self, req, resp, filename):
+         suffix = path.splitext(req.path)[1]
+         resp.content_type = mimes.get(suffix, 'application/octet-stream')
+ 
+-        filepath = path.join(STATIC_ROOT, self.path, secure_filename(filename))
++        filepath = path.join(self.root, self.path, secure_filename(filename))
+         try:
+             resp.stream = open(filepath, 'rb')
+             resp.content_length = path.getsize(filepath)
+@@ -153,8 +158,8 @@ def init(application, config):
+ 
+     application.add_sink(index, '/')
+     application.add_route('/static/bundles/{filename}',
+-                          StaticResource('/static/bundles'))
++                          StaticResource('/static/bundles', STATIC_ROOT))
+     application.add_route('/static/images/{filename}',
+-                          StaticResource('/static/images'))
++                          StaticResource('/static/images', SOURCE_ROOT))
+     application.add_route('/static/fonts/{filename}',
+-                          StaticResource('/static/fonts'))
++                          StaticResource('/static/fonts', SOURCE_ROOT))

pkgs/by-name/on/oncall/support_extra_config.patch

@@ -0,0 +1,120 @@
+diff --git a/src/oncall/bin/notifier.py b/src/oncall/bin/notifier.py
+index 25142b8..cbc92aa 100644
+--- a/src/oncall/bin/notifier.py
++++ b/src/oncall/bin/notifier.py
+@@ -32,11 +32,29 @@ send_queue = queue.Queue()
+ 
+ default_timezone = None
+ 
++def merge_dict(extend_me, extend_by):
++    if isinstance(extend_by, dict):
++        for k, v in extend_by.items():
++            if isinstance(v, dict) and isinstance(extend_me.get(k), dict):
++                merge_dict(extend_me[k], v)
++            else:
++                extend_me[k] = v
++    return extend_me
+ 
+ def load_config_file(config_path):
+     with open(config_path, 'r', encoding='utf-8') as h:
+         config = yaml.safe_load(h)
+ 
++    # Check for extra config files from environment variable
++    extra_config_paths = os.getenv('ONCALL_EXTRA_CONFIG')
++    if extra_config_paths:
++        for extra_path in extra_config_paths.split(','):
++            extra_path = extra_path.strip()
++            if os.path.isfile(extra_path):
++                with open(extra_path, 'r') as f:
++                    extra_config = yaml.safe_load(f) or {}
++                config = merge_dict(config, extra_config)
++
+     if 'init_config_hook' in config:
+         try:
+             module = config['init_config_hook']
+diff --git a/src/oncall/user_sync/ldap_sync.py b/src/oncall/user_sync/ldap_sync.py
+index ef9a8ec..c5f027d 100644
+--- a/src/oncall/user_sync/ldap_sync.py
++++ b/src/oncall/user_sync/ldap_sync.py
+@@ -6,6 +6,7 @@ import time
+ import yaml
+ import logging
+ import ldap
++import os
+ 
+ from oncall import metrics
+ from ldap.controls import SimplePagedResultsControl
+@@ -447,9 +448,28 @@ def main(config):
+         logger.info('Sleeping for %s seconds' % sleep_time)
+         sleep(sleep_time)
+ 
++def merge_dict(extend_me, extend_by):
++    if isinstance(extend_by, dict):
++        for k, v in extend_by.items():
++            if isinstance(v, dict) and isinstance(extend_me.get(k), dict):
++                merge_dict(extend_me[k], v)
++            else:
++                extend_me[k] = v
++    return extend_me
+ 
+ if __name__ == '__main__':
+     config_path = sys.argv[1]
+     with open(config_path, 'r', encoding='utf-8') as config_file:
+         config = yaml.safe_load(config_file)
++
++    # Check for extra config files from environment variable
++    extra_config_paths = os.getenv('ONCALL_EXTRA_CONFIG')
++    if extra_config_paths:
++        for extra_path in extra_config_paths.split(','):
++            extra_path = extra_path.strip()
++            if os.path.isfile(extra_path):
++                with open(extra_path, 'r') as f:
++                    extra_config = yaml.safe_load(f) or {}
++                config = merge_dict(config, extra_config)
++
+     main(config)
+diff --git a/src/oncall/utils.py b/src/oncall/utils.py
+index a0b695c..278ca1d 100644
+--- a/src/oncall/utils.py
++++ b/src/oncall/utils.py
+@@ -13,6 +13,7 @@ from pytz import timezone
+ from .constants import ONCALL_REMINDER
+ from . import constants
+ import re
++import os
+ 
+ invalid_char_reg = re.compile(r'[!"#%-,\.\/;->@\[-\^`\{-~]+')
+ DAY = 86400
+@@ -27,10 +28,31 @@ def insert_notification(x, y):
+ def update_notification(x, y):
+     pass
+ 
++def merge_dict(extend_me, extend_by):
++    if isinstance(extend_by, dict):
++        for k, v in extend_by.items():
++            if isinstance(v, dict) and isinstance(extend_me.get(k), dict):
++                merge_dict(extend_me[k], v)
++            else:
++                extend_me[k] = v
++    return extend_me
+ 
+ def read_config(config_path):
++
+     with open(config_path, 'r', encoding='utf8') as config_file:
+-        return yaml.safe_load(config_file)
++        config = yaml.safe_load(config_file)
++
++    # Check for extra config files from environment variable
++    extra_config_paths = os.getenv('ONCALL_EXTRA_CONFIG')
++    if extra_config_paths:
++        for extra_path in extra_config_paths.split(','):
++            extra_path = extra_path.strip()
++            if os.path.isfile(extra_path):
++                with open(extra_path, 'r') as f:
++                    extra_config = yaml.safe_load(f) or {}
++                config = merge_dict(config, extra_config)
++
++    return config
+ 
+ 
+ def create_notification(context, team_id, role_ids, type_name, users_involved, cursor, **kwargs):

pkgs/by-name/on/oncall/verbose_logging.patch

@@ -0,0 +1,33 @@
+diff --git a/src/oncall/app.py b/src/oncall/app.py
+index 370fcf4..59f014e 100644
+--- a/src/oncall/app.py
++++ b/src/oncall/app.py
+@@ -62,9 +62,19 @@ class AuthMiddleware(object):
+ 
+ application = None
+ 
++def handle_uncaught_exception(req, resp, ex, params):
++    logging.exception('Unhandled error')
++    raise falcon.HTTPInternalServerError(title='App error')
++
++
++def handle_http_error(req, resp, ex, params):
++    logging.exception('HTTP error')
++    raise ex
++
+ 
+ def init_falcon_api(config):
+     global application
++
+     cors = CORS(allow_origins_list=config.get('allow_origins_list', []))
+     middlewares = [
+         SecurityHeaderMiddleware(),
+@@ -74,6 +84,8 @@ def init_falcon_api(config):
+     if config.get('require_auth'):
+         middlewares.append(AuthMiddleware())
+     application = falcon.App(middleware=middlewares)
++    application.add_error_handler(falcon.HTTPError, handle_http_error)
++    application.add_error_handler(Exception, handle_uncaught_exception)
+     application.req_options.auto_parse_form_urlencoded = False
+     application.set_error_serializer(json_error_serializer)
+     application.req_options.strip_url_path_trailing_slash = True