Merge staging-next into staging

2025-02-04 12:06:36 +00:00
parent a3e8b3ee1c 7e259cee4d
commit c91a43b5e5
94 changed files with 1548 additions and 850 deletions
@@ -25076,6 +25076,12 @@
    githubId = 6162814;
    keys = [ { fingerprint = "21E1 6B8D 2EE8 7530 6A6C  9968 D830 77B9 9F8C 6643"; } ];
  };
+  wrvsrx = {
+    name = "wrvsrx";
+    email = "wrvsrx@outlook.com";
+    github = "wrvsrx";
+    githubId = 42770726;
+  };
  wscott = {
    email = "wsc9tt@gmail.com";
    github = "wscott";
@@ -430,6 +430,8 @@

 - `services.avahi.ipv6` now defaults to true.

+- The Home Assistant module has new options {option}`services.home-assistant.blueprints.automation`, `services.home-assistant.blueprints.script`, and {option}`services.home-assistant.blueprints.template` that allow for the declarative installation of [blueprints](https://www.home-assistant.io/docs/blueprint/) into the appropriate configuration directories.
+
 - For matrix homeserver Synapse we are now following the upstream recommendation to enable jemalloc as the memory allocator by default.

 - `services.kmonad` now creates a determinate symlink (in `/dev/input/by-id/`) to each of KMonad virtual devices.
@@ -12,114 +12,126 @@
  pkgs,
  ...
 }:
-
-with lib;
-
+let
+  inherit (lib)
+    mkDefault
+    mkOverride
+    mkEnableOption
+    mkIf
+    maintainers
+    ;
+in
 {
-  meta = {
-    maintainers = [
-      maintainers.joachifm
-      maintainers.emily
-    ];
+  options.profiles.hardened = mkEnableOption "hardened" // {
+    default = true;
+    example = false;
  };
+  config = mkIf config.profiles.hardened {
+    meta = {
+      maintainers = [
+        maintainers.joachifm
+        maintainers.emily
+      ];
+    };

-  boot.kernelPackages = mkDefault pkgs.linuxPackages_hardened;
+    boot.kernelPackages = mkDefault pkgs.linuxPackages_hardened;

-  nix.settings.allowed-users = mkDefault [ "@users" ];
+    nix.settings.allowed-users = mkDefault [ "@users" ];

-  environment.memoryAllocator.provider = mkDefault "scudo";
-  environment.variables.SCUDO_OPTIONS = mkDefault "ZeroContents=1";
+    environment.memoryAllocator.provider = mkDefault "scudo";
+    environment.variables.SCUDO_OPTIONS = mkDefault "ZeroContents=1";

-  security.lockKernelModules = mkDefault true;
+    security.lockKernelModules = mkDefault true;

-  security.protectKernelImage = mkDefault true;
+    security.protectKernelImage = mkDefault true;

-  security.allowSimultaneousMultithreading = mkDefault false;
+    security.allowSimultaneousMultithreading = mkDefault false;

-  security.forcePageTableIsolation = mkDefault true;
+    security.forcePageTableIsolation = mkDefault true;

-  # This is required by podman to run containers in rootless mode.
-  security.unprivilegedUsernsClone = mkDefault config.virtualisation.containers.enable;
+    # This is required by podman to run containers in rootless mode.
+    security.unprivilegedUsernsClone = mkDefault config.virtualisation.containers.enable;

-  security.virtualisation.flushL1DataCache = mkDefault "always";
+    security.virtualisation.flushL1DataCache = mkDefault "always";

-  security.apparmor.enable = mkDefault true;
-  security.apparmor.killUnconfinedConfinables = mkDefault true;
+    security.apparmor.enable = mkDefault true;
+    security.apparmor.killUnconfinedConfinables = mkDefault true;

-  boot.kernelParams = [
-    # Don't merge slabs
-    "slab_nomerge"
+    boot.kernelParams = [
+      # Don't merge slabs
+      "slab_nomerge"

-    # Overwrite free'd pages
-    "page_poison=1"
+      # Overwrite free'd pages
+      "page_poison=1"

-    # Enable page allocator randomization
-    "page_alloc.shuffle=1"
+      # Enable page allocator randomization
+      "page_alloc.shuffle=1"

-    # Disable debugfs
-    "debugfs=off"
-  ];
+      # Disable debugfs
+      "debugfs=off"
+    ];

-  boot.blacklistedKernelModules = [
-    # Obscure network protocols
-    "ax25"
-    "netrom"
-    "rose"
+    boot.blacklistedKernelModules = [
+      # Obscure network protocols
+      "ax25"
+      "netrom"
+      "rose"

-    # Old or rare or insufficiently audited filesystems
-    "adfs"
-    "affs"
-    "bfs"
-    "befs"
-    "cramfs"
-    "efs"
-    "erofs"
-    "exofs"
-    "freevxfs"
-    "f2fs"
-    "hfs"
-    "hpfs"
-    "jfs"
-    "minix"
-    "nilfs2"
-    "ntfs"
-    "omfs"
-    "qnx4"
-    "qnx6"
-    "sysv"
-    "ufs"
-  ];
+      # Old or rare or insufficiently audited filesystems
+      "adfs"
+      "affs"
+      "bfs"
+      "befs"
+      "cramfs"
+      "efs"
+      "erofs"
+      "exofs"
+      "freevxfs"
+      "f2fs"
+      "hfs"
+      "hpfs"
+      "jfs"
+      "minix"
+      "nilfs2"
+      "ntfs"
+      "omfs"
+      "qnx4"
+      "qnx6"
+      "sysv"
+      "ufs"
+    ];

-  # Hide kptrs even for processes with CAP_SYSLOG
-  boot.kernel.sysctl."kernel.kptr_restrict" = mkOverride 500 2;
+    # Hide kptrs even for processes with CAP_SYSLOG
+    boot.kernel.sysctl."kernel.kptr_restrict" = mkOverride 500 2;

-  # Disable bpf() JIT (to eliminate spray attacks)
-  boot.kernel.sysctl."net.core.bpf_jit_enable" = mkDefault false;
+    # Disable bpf() JIT (to eliminate spray attacks)
+    boot.kernel.sysctl."net.core.bpf_jit_enable" = mkDefault false;

-  # Disable ftrace debugging
-  boot.kernel.sysctl."kernel.ftrace_enabled" = mkDefault false;
+    # Disable ftrace debugging
+    boot.kernel.sysctl."kernel.ftrace_enabled" = mkDefault false;

-  # Enable strict reverse path filtering (that is, do not attempt to route
-  # packets that "obviously" do not belong to the iface's network; dropped
-  # packets are logged as martians).
-  boot.kernel.sysctl."net.ipv4.conf.all.log_martians" = mkDefault true;
-  boot.kernel.sysctl."net.ipv4.conf.all.rp_filter" = mkDefault "1";
-  boot.kernel.sysctl."net.ipv4.conf.default.log_martians" = mkDefault true;
-  boot.kernel.sysctl."net.ipv4.conf.default.rp_filter" = mkDefault "1";
+    # Enable strict reverse path filtering (that is, do not attempt to route
+    # packets that "obviously" do not belong to the iface's network; dropped
+    # packets are logged as martians).
+    boot.kernel.sysctl."net.ipv4.conf.all.log_martians" = mkDefault true;
+    boot.kernel.sysctl."net.ipv4.conf.all.rp_filter" = mkDefault "1";
+    boot.kernel.sysctl."net.ipv4.conf.default.log_martians" = mkDefault true;
+    boot.kernel.sysctl."net.ipv4.conf.default.rp_filter" = mkDefault "1";

-  # Ignore broadcast ICMP (mitigate SMURF)
-  boot.kernel.sysctl."net.ipv4.icmp_echo_ignore_broadcasts" = mkDefault true;
+    # Ignore broadcast ICMP (mitigate SMURF)
+    boot.kernel.sysctl."net.ipv4.icmp_echo_ignore_broadcasts" = mkDefault true;

-  # Ignore incoming ICMP redirects (note: default is needed to ensure that the
-  # setting is applied to interfaces added after the sysctls are set)
-  boot.kernel.sysctl."net.ipv4.conf.all.accept_redirects" = mkDefault false;
-  boot.kernel.sysctl."net.ipv4.conf.all.secure_redirects" = mkDefault false;
-  boot.kernel.sysctl."net.ipv4.conf.default.accept_redirects" = mkDefault false;
-  boot.kernel.sysctl."net.ipv4.conf.default.secure_redirects" = mkDefault false;
-  boot.kernel.sysctl."net.ipv6.conf.all.accept_redirects" = mkDefault false;
-  boot.kernel.sysctl."net.ipv6.conf.default.accept_redirects" = mkDefault false;
+    # Ignore incoming ICMP redirects (note: default is needed to ensure that the
+    # setting is applied to interfaces added after the sysctls are set)
+    boot.kernel.sysctl."net.ipv4.conf.all.accept_redirects" = mkDefault false;
+    boot.kernel.sysctl."net.ipv4.conf.all.secure_redirects" = mkDefault false;
+    boot.kernel.sysctl."net.ipv4.conf.default.accept_redirects" = mkDefault false;
+    boot.kernel.sysctl."net.ipv4.conf.default.secure_redirects" = mkDefault false;
+    boot.kernel.sysctl."net.ipv6.conf.all.accept_redirects" = mkDefault false;
+    boot.kernel.sysctl."net.ipv6.conf.default.accept_redirects" = mkDefault false;

-  # Ignore outgoing ICMP redirects (this is ipv4 only)
-  boot.kernel.sysctl."net.ipv4.conf.all.send_redirects" = mkDefault false;
-  boot.kernel.sysctl."net.ipv4.conf.default.send_redirects" = mkDefault false;
+    # Ignore outgoing ICMP redirects (this is ipv4 only)
+    boot.kernel.sysctl."net.ipv4.conf.all.send_redirects" = mkDefault false;
+    boot.kernel.sysctl."net.ipv4.conf.default.send_redirects" = mkDefault false;
+  };
 }
@@ -6,17 +6,22 @@ let
    attrByPath
    attrValues
    concatMap
+    concatStrings
    converge
    elem
    escapeShellArg
    escapeShellArgs
    filter
    filterAttrsRecursive
+    flatten
    hasAttrByPath
    isAttrs
    isDerivation
    isList
+    isStorePath
    literalExpression
+    mapAttrsToList
+    mergeAttrsList
    mkEnableOption
    mkIf
    mkMerge
@@ -28,6 +33,7 @@ let
    recursiveUpdate
    singleton
    splitString
+    substring
    types
    unique
  ;
@@ -502,6 +508,41 @@ in {
      type = types.bool;
      description = "Whether to open the firewall for the specified port.";
    };
+
+    blueprints = mergeAttrsList (
+      map
+        (domain: {
+          ${domain} = mkOption {
+            default = [ ];
+            description = ''
+              List of ${domain}
+              [blueprints](https://www.home-assistant.io/docs/blueprint/) to
+              install into {file}`''${configDir}/blueprints/${domain}`.
+            '';
+            example =
+              if domain == "automation" then
+                literalExpression ''
+                  [
+                    (pkgs.fetchurl {
+                      url = "https://github.com/home-assistant/core/raw/2025.1.4/homeassistant/components/automation/blueprints/motion_light.yaml";
+                      hash = "sha256-4HrDX65ycBMfEY2nZ7A25/d3ZnIHdpHZ+80Cblp+P5w=";
+                    })
+                  ]
+                ''
+              else if domain == "template" then
+                literalExpression "[ \"\${pkgs.home-assistant.src}/homeassistant/components/template/blueprints/inverted_binary_sensor.yaml\" ]"
+              else
+                literalExpression "[ ./blueprint.yaml ]";
+            type = types.listOf (types.coercedTo types.path (x: "${x}") types.pathInStore);
+          };
+        })
+        # https://www.home-assistant.io/docs/blueprint/schema/#domain
+        [
+          "automation"
+          "script"
+          "template"
+        ]
+    );
  };

  config = mkIf cfg.enable {
@@ -576,11 +617,36 @@ in {
            ln -fns "''${paths[@]}" "${cfg.configDir}/custom_components/"
          done
        '';
+        removeBlueprints = ''
+          # remove blueprints symlinked in from below the /nix/store
+          readarray -d "" blueprints < <(find "${cfg.configDir}/blueprints" -maxdepth 2 -type l -print0)
+          for blueprint in "''${blueprints[@]}"; do
+            if [[ "$(readlink "$blueprint")" =~ ^${escapeShellArg builtins.storeDir} ]]; then
+              rm "$blueprint"
+            fi
+          done
+        '';
+        copyBlueprint =
+          domain: blueprint:
+          let
+            filename =
+              if isStorePath blueprint then substring 33 (-1) (baseNameOf blueprint) else baseNameOf blueprint;
+            path = "${cfg.configDir}/blueprints/${domain}";
+          in
+          ''
+            mkdir -p ${escapeShellArg path}
+            ln -s ${escapeShellArg blueprint} ${escapeShellArg "${path}/${filename}"}
+          '';
+        copyBlueprints = concatStrings (
+          flatten (mapAttrsToList (domain: map (copyBlueprint domain)) cfg.blueprints)
+        );
      in
        (optionalString (cfg.config != null) copyConfig) +
        (optionalString (cfg.lovelaceConfig != null) copyLovelaceConfig) +
        copyCustomLovelaceModules +
-        copyCustomComponents
+        copyCustomComponents +
+        removeBlueprints +
+        copyBlueprints
      ;
      environment.PYTHONPATH = package.pythonPath;
      serviceConfig = let
@@ -140,6 +140,7 @@ in
        ${concatStringsSep " \\\n  " cfg.extraFlags}
    '';
    serviceConfig = {
+      CacheDirectory = "restic-exporter";
      EnvironmentFile = mkIf (cfg.environmentFile != null) cfg.environmentFile;
      LoadCredential = [
        "RESTIC_PASSWORD_FILE:${cfg.passwordFile}"
@@ -156,6 +157,7 @@ in
        LISTEN_ADDRESS = cfg.listenAddress;
        LISTEN_PORT = toString cfg.port;
        REFRESH_INTERVAL = toString cfg.refreshInterval;
+        RESTIC_CACHE_DIR = "$CACHE_DIRECTORY";
      }
      // (mapAttrs' (
        name: value: nameValuePair (rcloneAttrToOpt name) (toRcloneVal value)
@@ -129,6 +129,16 @@ in
          ];
        };
        lovelaceConfigWritable = true;
+
+        blueprints.automation = [
+          (pkgs.fetchurl {
+            url = "https://github.com/home-assistant/core/raw/2025.1.4/homeassistant/components/automation/blueprints/motion_light.yaml";
+            hash = "sha256-4HrDX65ycBMfEY2nZ7A25/d3ZnIHdpHZ+80Cblp+P5w=";
+          })
+        ];
+        blueprints.template = [
+          "${pkgs.home-assistant.src}/homeassistant/components/template/blueprints/inverted_binary_sensor.yaml"
+        ];
      };

      # Cause a configuration change inside `configuration.yml` and verify that the process is being reloaded.
@@ -148,6 +158,8 @@ in
        configuration.services.home-assistant = {
          customComponents = lib.mkForce [ ];
          customLovelaceModules = lib.mkForce [ ];
+          blueprints.automation = lib.mkForce [ ];
+          blueprints.template = lib.mkForce [ ];
        };
      };
    };
@@ -226,6 +238,10 @@ in
      with subtest("Check extra components are considered in systemd unit hardening"):
          hass.succeed("systemctl show -p DeviceAllow home-assistant.service | grep -q char-ttyUSB")

+      with subtest("Check that blueprints are installed"):
+          hass.succeed("test -L '${configDir}/blueprints/automation/motion_light.yaml'")
+          hass.succeed("test -L '${configDir}/blueprints/template/inverted_binary_sensor.yaml'")
+
      with subtest("Check service restart from SIGHUP"):
          pid = hass.succeed("systemctl show --property=MainPID home-assistant.service")
          cursor = get_journal_cursor()
@@ -247,12 +263,14 @@ in
          for domain in ["prometheus"]:
              assert f"Setup of domain {domain} took" in journal, f"{domain} setup missing"

-      with subtest("Check custom components and custom lovelace modules get removed"):
+      with subtest("Check custom components, custom lovelace modules, and blueprints get removed"):
          cursor = get_journal_cursor()
          hass.succeed("${system}/specialisation/removeCustomThings/bin/switch-to-configuration test")
          hass.fail("grep -q 'mini-graph-card-bundle.js' '${configDir}/ui-lovelace.yaml'")
          for integration in ("prometheus_sensor", "spook", "spook_inverse"):
              hass.fail(f"test -f ${configDir}/custom_components/{integration}/manifest.json")
+          hass.fail("test -e '${configDir}/blueprints/automation/motion_light.yaml'")
+          hass.fail("test -e '${configDir}/blueprints/template/inverted_binary_sensor.yaml'")
          wait_for_homeassistant(cursor)

      with subtest("Check that no errors were logged"):
@@ -5,15 +5,15 @@ let
 in
 {
  sublime4 = common {
-    buildVersion = "4189";
-    x64sha256 = "0vEG2FfLK+93UtpYV9iWl187iN79Tozm38Vh6lbzW7A=";
-    aarch64sha256 = "ZyLnbvpyxvJfyfu663ED0Yn5M37As+jy6TREZMgSHgI=";
+    buildVersion = "4192";
+    x64sha256 = "3CMorzQj+JFPTXp6PPhX6Mlcz/kJb2FM2iwUsvrhy+s=";
+    aarch64sha256 = "gVhDBac3kyDU1qIiXoN7Xf5Jvbdnif2QGuFUy2C34Mo=";
  } { };

  sublime4-dev = common {
-    buildVersion = "4188";
+    buildVersion = "4191";
    dev = true;
-    x64sha256 = "b7JyJ9cPxb/Yjy9fvcz/m6OLETxMd8rwkmrEyMGAjjc=";
-    aarch64sha256 = "oGL0UtQge21oH6p6BNsRkxqgvdi9PkT/uwZTYygu+ng=";
+    x64sha256 = "fJy0BNToM8beMv5jYdFiecyjudzTG+r0mEpi9erZs4A=";
+    aarch64sha256 = "KgqZ9+rEGM9wcgqk+CenFInmDc3jPMdnRBpTREHBpjE=";
  } { };
 }
@@ -1302,6 +1302,18 @@ final: prev:
    meta.homepage = "https://github.com/giuxtaposition/blink-cmp-copilot/";
  };

+  blink-cmp-dictionary = buildVimPlugin {
+    pname = "blink-cmp-dictionary";
+    version = "2025-01-12";
+    src = fetchFromGitHub {
+      owner = "Kaiser-Yang";
+      repo = "blink-cmp-dictionary";
+      rev = "07cc2e49bb52ebff4e8b83d1801ad6441edf90a2";
+      sha256 = "17c41flnjp25c5gry4lq8ik8mk3pbh1qwj86rby57jr4f4wvfykk";
+    };
+    meta.homepage = "https://github.com/Kaiser-Yang/blink-cmp-dictionary/";
+  };
+
  blink-cmp-spell = buildVimPlugin {
    pname = "blink-cmp-spell";
    version = "2025-02-01";
@@ -7424,6 +7436,18 @@ final: prev:
    meta.homepage = "https://github.com/wfxr/minimap.vim/";
  };

+  minuet-ai-nvim = buildVimPlugin {
+    pname = "minuet-ai.nvim";
+    version = "2025-02-03";
+    src = fetchFromGitHub {
+      owner = "milanglacier";
+      repo = "minuet-ai.nvim";
+      rev = "9a264284573b837dc0202049166a0564a70deaed";
+      sha256 = "06d7s9949aylda4vq36h4s9hnnp3lycwm2nrjid5vxb98gy3d3xn";
+    };
+    meta.homepage = "https://github.com/milanglacier/minuet-ai.nvim/";
+  };
+
  mkdir-nvim = buildVimPlugin {
    pname = "mkdir.nvim";
    version = "2022-07-23";
@@ -292,6 +292,10 @@ in
    dependencies = [ self.copilot-lua ];
  };

+  blink-cmp-dictionary = super.blink-cmp-dictionary.overrideAttrs {
+    dependencies = [ self.plenary-nvim ];
+  };
+
  blink-emoji-nvim = super.blink-emoji-nvim.overrideAttrs {
    dependencies = [ self.blink-cmp ];
  };
@@ -1809,6 +1813,24 @@ in
    meta.homepage = "https://github.com/jose-elias-alvarez/minsnip.nvim/";
  };

+  minuet-ai-nvim = super.minuet-ai-nvim.overrideAttrs {
+    checkInputs = [
+      # optional cmp integration
+      self.nvim-cmp
+    ];
+    dependencies = with self; [ plenary-nvim ];
+    nvimSkipModule = [
+      # Backends require configuration
+      "minuet.backends.claude"
+      "minuet.backends.codestral"
+      "minuet.backends.gemini"
+      "minuet.backends.huggingface"
+      "minuet.backends.openai"
+      "minuet.backends.openai_compatible"
+      "minuet.backends.openai_fim_compatible"
+    ];
+  };
+
  mkdnflow-nvim = super.mkdnflow-nvim.overrideAttrs {
    dependencies = [ self.plenary-nvim ];
    # Requires setup call and has optional nvim-cmp dependency
@@ -106,6 +106,7 @@ https://github.com/max397574/better-escape.nvim/,,
 https://github.com/LunarVim/bigfile.nvim/,,
 https://github.com/APZelos/blamer.nvim/,HEAD,
 https://github.com/giuxtaposition/blink-cmp-copilot/,HEAD,
+https://github.com/Kaiser-Yang/blink-cmp-dictionary/,HEAD,
 https://github.com/Kaiser-Yang/blink-cmp-git/,HEAD,
 https://github.com/ribru17/blink-cmp-spell/,HEAD,
 https://github.com/fang2hou/blink-copilot/,HEAD,
@@ -615,6 +616,7 @@ https://github.com/echasnovski/mini.test/,HEAD,
 https://github.com/echasnovski/mini.trailspace/,HEAD,
 https://github.com/echasnovski/mini.visits/,HEAD,
 https://github.com/wfxr/minimap.vim/,,
+https://github.com/milanglacier/minuet-ai.nvim/,HEAD,
 https://github.com/jghauser/mkdir.nvim/,main,
 https://github.com/jakewvincent/mkdnflow.nvim/,HEAD,
 https://github.com/SidOfc/mkdx/,,
@@ -6,13 +6,13 @@
 }:
 mkLibretroCore {
  core = "vice-${type}";
-  version = "0-unstable-2025-01-11";
+  version = "0-unstable-2025-01-28";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "vice-libretro";
-    rev = "5afa33f347306f168ff0b4c54a7825895dd07b50";
-    hash = "sha256-D0DSKgqZV8EluRry2qSm7qnWnvwwDWz91G66W4nF2Kk=";
+    rev = "cdef1f9f8d5cbe4ba3e9b9106e117bdd35f599b9";
+    hash = "sha256-02ZH5ax49uWnvYe+hpL7a94Bf8knja1YADxyI2irYms=";
  };

  makefile = "Makefile";
@@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "helm-s3";
-  version = "0.16.2";
+  version = "0.16.3";

  src = fetchFromGitHub {
    owner = "hypnoglow";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-hQuZd0VI+JspIjR7Dax/LXUZ9Rqflc6RQG9X80BkfeY=";
+    hash = "sha256-WiK2kZWik81HYZVVmzdqdqIE+jnAcYyu536NbdYWYxk=";
  };

-  vendorHash = "sha256-CXlZazpsHasjHPNHzXIsrbtWgQs/lVRqGsoqRvl2MHw=";
+  vendorHash = "sha256-AXr+2+iv3oNTHEckK7DXEA5PMgFgT5iAGRttvGoCpQQ=";

  # NOTE: Remove the install and upgrade hooks.
  postPatch = ''
@@ -90,13 +90,13 @@
    "vendorHash": "sha256-V2CublY/9xSosrgxMYwHpnHtTucjiSuyzm+W4AY3pz0="
  },
  "auth0": {
-    "hash": "sha256-4ZHTy4mBQ+ZgiUOZQEku8n+AfMmA9azioyAPeWUUae0=",
+    "hash": "sha256-hfmJWtfHwDKtc9nsKZUbibf6VIQb02a/fXWkhqDgiFQ=",
    "homepage": "https://registry.terraform.io/providers/auth0/auth0",
    "owner": "auth0",
    "repo": "terraform-provider-auth0",
-    "rev": "v1.10.0",
+    "rev": "v1.11.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-mvudiybfS6eLemCTXUJSIV4mD+GzR7Ed2H+lfA0de8E="
+    "vendorHash": "sha256-NynPovzkVRNU0EGxbIcvO4AOxnmG10mWfk8520arU5c="
  },
  "avi": {
    "hash": "sha256-ErZE6MA8Pn8KDDZLX2/yoeqck78vDAcFYdMhYMbcYuI=",
@@ -225,13 +225,13 @@
    "vendorHash": "sha256-OqbnkuEy9w6F1DxmlYhRNYhBaYhWV0FtMK4wdwSybh8="
  },
  "checkly": {
-    "hash": "sha256-4J7pwtlAa920RXF6ZoSoi03qA15NBzUlXQCZRErI2Co=",
+    "hash": "sha256-1V6EybAmIWEcd0gMc9vNLJVIZOHHW6AtYNmPshhkqN4=",
    "homepage": "https://registry.terraform.io/providers/checkly/checkly",
    "owner": "checkly",
    "repo": "terraform-provider-checkly",
-    "rev": "v1.8.2",
+    "rev": "v1.9.1",
    "spdx": null,
-    "vendorHash": "sha256-DcRe3nBzKn8fC0Q8Dx/p0PXuUccX+4kmOMdZa3HuXNI="
+    "vendorHash": "sha256-JN+vZQGrpdVExHVMxCiBNavKxbIo1qjBU59AJbphlv4="
  },
  "ciscoasa": {
    "hash": "sha256-xzc44FEy2MPo51Faq/VFwg411JK9e0kQucpt0vdN8yg=",
@@ -444,11 +444,11 @@
    "vendorHash": "sha256-xlcOCdgRTQbJCsL39hs3dUVjssGpyNij0ickjSn8EX0="
  },
  "fastly": {
-    "hash": "sha256-PtmJISWgOXM2og0LaxLqBq9gB0AVegNaIFGbdckDcKc=",
+    "hash": "sha256-C5kdhSfOUCinfFd6SwWQwsbnwAhNWBF50fj2fGIohZc=",
    "homepage": "https://registry.terraform.io/providers/fastly/fastly",
    "owner": "fastly",
    "repo": "terraform-provider-fastly",
-    "rev": "v5.15.0",
+    "rev": "v5.16.0",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
@@ -543,20 +543,20 @@
    "vendorHash": "sha256-s2Ee9wB0smWx4mDPf/mUkCrmWfBrRzYlriWKB/I9Ax8="
  },
  "gridscale": {
-    "hash": "sha256-kgpEPbQLqiu8X0lOs6dCUqWpYTDxQX8fMgWoP0wWtBw=",
+    "hash": "sha256-uI05BO/c00RNr52rbvY7SZwcn64NRfBpR44/xXWmjqw=",
    "homepage": "https://registry.terraform.io/providers/gridscale/gridscale",
    "owner": "gridscale",
    "repo": "terraform-provider-gridscale",
-    "rev": "v2.0.2",
+    "rev": "v2.0.3",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
  "harbor": {
-    "hash": "sha256-NDOFrW7VeunxAJPkcJ4DFrjrt0fL5B5+gT9H19L1Cos=",
+    "hash": "sha256-FSuJ8upRnDny9Rjf+hS+Kd6e3YcuqYRMfwMwseHNlfo=",
    "homepage": "https://registry.terraform.io/providers/goharbor/harbor",
    "owner": "goharbor",
    "repo": "terraform-provider-harbor",
-    "rev": "v3.10.17",
+    "rev": "v3.10.18",
    "spdx": "MIT",
    "vendorHash": "sha256-YkTXwx3RjIbzJnagfcYgb5IRnF0sHEDBDzdHf+GS8xI="
  },
@@ -669,11 +669,11 @@
    "vendorHash": "sha256-xr54yCVGOJbj0612wiljUkx1wEOSuXB1qrGbF/vCwN8="
  },
  "infoblox": {
-    "hash": "sha256-r++9Fagi5hULK0IDEUjHzYS2cNpyB5gvaUwmoPOnExQ=",
+    "hash": "sha256-iz/Khne3wggjkZFWZOK9DVZsB8HW6nsNBCfEbsBdhzk=",
    "homepage": "https://registry.terraform.io/providers/infobloxopen/infoblox",
    "owner": "infobloxopen",
    "repo": "terraform-provider-infoblox",
-    "rev": "v2.8.0",
+    "rev": "v2.9.0",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
@@ -696,20 +696,20 @@
    "vendorHash": "sha256-DnE9tA8VYgtzJWN8j3IOsQs1SiA3NX1mDQzp/Fpqh/U="
  },
  "kafka-connect": {
-    "hash": "sha256-3EUTte3txaDRz3jh0h23+Bf1tdLeCvPN9x8mYWY5VjI=",
+    "hash": "sha256-XMGpK22Ww8swvfrnbClxjErVmkBKX3dxdlkjgNJHlCE=",
    "homepage": "https://registry.terraform.io/providers/Mongey/kafka-connect",
    "owner": "Mongey",
    "repo": "terraform-provider-kafka-connect",
-    "rev": "v0.4.1",
+    "rev": "v0.4.3",
    "spdx": "MIT",
-    "vendorHash": "sha256-rGujp6FsQnkznRfjrSSB+4lLC3wAv6yvL/jAoWOiST0="
+    "vendorHash": "sha256-5cqj1O57snU+NoVqmWc/KIGnowQNMww+rJxYfIPvHWU="
  },
  "keycloak": {
-    "hash": "sha256-hdTZ+UEpmv4T8Kxk8cf1QACUKyOoRbD1X3OxwhmrRiI=",
+    "hash": "sha256-mlPq3sOaGN/fFAxMmK9ahcupwWd/4gYdNTLGRqDjPLc=",
    "homepage": "https://registry.terraform.io/providers/keycloak/keycloak",
    "owner": "keycloak",
    "repo": "terraform-provider-keycloak",
-    "rev": "v5.0.0",
+    "rev": "v5.1.1",
    "spdx": "Apache-2.0",
    "vendorHash": "sha256-51sFU6P4Ynyu9NpQxlbSV7EoB/Lk1da4O0bOuoeMujI="
  },
@@ -732,13 +732,13 @@
    "vendorHash": "sha256-PfvIzUugDsnMKW7mSM2GyJZpXi3wJsEhYLKzlKq1U6A="
  },
  "launchdarkly": {
-    "hash": "sha256-ONASsswVYyugvSpACCmWIcuhnbueW++/s8F7c91PkeQ=",
+    "hash": "sha256-nneVn/q6p1FbFSZDjL5aEmp1U1xtjGox/mf48e140Qs=",
    "homepage": "https://registry.terraform.io/providers/launchdarkly/launchdarkly",
    "owner": "launchdarkly",
    "repo": "terraform-provider-launchdarkly",
-    "rev": "v2.21.2",
+    "rev": "v2.21.5",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-v9N7lj7bEgR5HZm1SO0+DSCmQFVnsRvHPMycYMfpYwo="
+    "vendorHash": "sha256-mdVTcbfJ06o8LTfFMnpmoYSbLVSjZxxhpFFsL54tbUA="
  },
  "libvirt": {
    "hash": "sha256-B99pSnnI+GoMX4uleDqBoAKPe15l/+C5mIUGp6KsE54=",
@@ -750,13 +750,13 @@
    "vendorHash": "sha256-Q9LdhokZol1jhSfQVIRvPe1XrE8nVvc22aWHt7wkcHY="
  },
  "linode": {
-    "hash": "sha256-qyHRGkhwq9YS/mYLFMXEkEdNtH3yfCrXIP4q/QdOzcY=",
+    "hash": "sha256-dJkyhLAYwmohDqLwfmp9ScgfXGpix21md6Aqf+mQeFI=",
    "homepage": "https://registry.terraform.io/providers/linode/linode",
    "owner": "linode",
    "repo": "terraform-provider-linode",
-    "rev": "v2.32.0",
+    "rev": "v2.33.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-1wwePyqy6ZLc3ZN0M2zZ6sxhVGZl7gWATv1xvcHBqB4="
+    "vendorHash": "sha256-J2qbC4I8hd99VVyH8tGDBz53MDPNMM1IMA2Gc1oUwvQ="
  },
  "linuxbox": {
    "hash": "sha256-svQRz1/PdVLpHoxOam1sfRTwHqgqs4ohJQs3IPMMAM4=",
@@ -813,20 +813,20 @@
    "vendorHash": "sha256-QxbZv6YMa5/I4bTeQBNdmG3EKtLEmstnH7HMiZzFJrI="
  },
  "migadu": {
-    "hash": "sha256-ZKlxt/qTccHlNSTwTFKroK/JmKLTcQ8MIeCKx+iRJm0=",
+    "hash": "sha256-27NVXEPBaSGMP8zbnXG/0KEbvXMybvJq4XmudRbvrjg=",
    "homepage": "https://registry.terraform.io/providers/metio/migadu",
    "owner": "metio",
    "repo": "terraform-provider-migadu",
-    "rev": "2025.1.16",
+    "rev": "2025.1.23",
    "spdx": "0BSD",
-    "vendorHash": "sha256-03pGB+biwTfJdGADhBSJn1BNhuowTrO8nwQm2eCCpaI="
+    "vendorHash": "sha256-6jl3KEJsoyGH7lhMBJpkxkE1ZkkAdF3puSoo39PKR2s="
  },
  "minio": {
-    "hash": "sha256-GJU70N/8EocLNxTG/psIsRYVHkg5fALhA9/ewErNML0=",
+    "hash": "sha256-Y34cCOQqJslDU4LcCou1QxIFfyUP2PRt3ExoCUNl8so=",
    "homepage": "https://registry.terraform.io/providers/aminueza/minio",
    "owner": "aminueza",
    "repo": "terraform-provider-minio",
-    "rev": "v3.2.2",
+    "rev": "v3.2.3",
    "spdx": "AGPL-3.0",
    "vendorHash": "sha256-a9v1nVG3NiuyHwJGhIKKKXFDp4/Cb533EJxrfqK9h/A="
  },
@@ -858,13 +858,13 @@
    "vendorHash": null
  },
  "newrelic": {
-    "hash": "sha256-kyfNlLVzrNMLKGCahpbzeyqvFYPug6RyPPxCnxwP/W4=",
+    "hash": "sha256-P3T+9Ma5OzNdEXs3EbkyiJBkaEYeBUpIyduQTOt9TXY=",
    "homepage": "https://registry.terraform.io/providers/newrelic/newrelic",
    "owner": "newrelic",
    "repo": "terraform-provider-newrelic",
-    "rev": "v3.54.0",
+    "rev": "v3.54.1",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-hxDLJrv7a8JZ6etYS7u+kiIcudJJeB47PKQTE3NzCvI="
+    "vendorHash": "sha256-RI0ukPxV+At0dNGPuKc5jkI2k/JL6LnxHH07dl3LMVE="
  },
  "nomad": {
    "hash": "sha256-k61iQ9FQG3nscBp5CE/fFCbHpeLawbUAtGPM+IZtfVc=",
@@ -976,20 +976,20 @@
    "vendorHash": null
  },
  "ovh": {
-    "hash": "sha256-qF2Wfgse2hcQ6TCbwfk+taUNwEKnNWZh2929VlgCrb4=",
+    "hash": "sha256-aGg3zvGWBVU8dv852nG1u3gRKD6I9ra77D2foDmjUEE=",
    "homepage": "https://registry.terraform.io/providers/ovh/ovh",
    "owner": "ovh",
    "repo": "terraform-provider-ovh",
-    "rev": "v1.4.0",
+    "rev": "v1.5.0",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
  "pagerduty": {
-    "hash": "sha256-r0F+WSEY7j2AesQ0sDixOe9uKD0hOIdSzDYEhC8yEDA=",
+    "hash": "sha256-6n+FPTuoK5eoaNxa+E8NAWglMBMH/1eJAu6BmiaKhAs=",
    "homepage": "https://registry.terraform.io/providers/PagerDuty/pagerduty",
    "owner": "PagerDuty",
    "repo": "terraform-provider-pagerduty",
-    "rev": "v3.19.2",
+    "rev": "v3.19.4",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
@@ -1111,11 +1111,11 @@
    "vendorHash": null
  },
  "selectel": {
-    "hash": "sha256-bXPH/1fEuGehOOSTXsR/yi0BiR8zneIc2KUqOEoG5Qw=",
+    "hash": "sha256-CVGMFepwfNKlqlAoFY2Uc8w3ZC6RbD9hOhsYnTFNmJM=",
    "homepage": "https://registry.terraform.io/providers/selectel/selectel",
    "owner": "selectel",
    "repo": "terraform-provider-selectel",
-    "rev": "v6.1.0",
+    "rev": "v6.1.1",
    "spdx": "MPL-2.0",
    "vendorHash": "sha256-LRs2zI5L5qdWiM8VexQPkP8SjrO/sVEj/MOX+n4NKSc="
  },
@@ -1138,13 +1138,13 @@
    "vendorHash": "sha256-MIO0VHofPtKPtynbvjvEukMNr5NXHgk7BqwIhbc9+u0="
  },
  "signalfx": {
-    "hash": "sha256-C8LyILuqT15NqqzBrj09N+Nx9KMhE/oBPfXtc8gPfns=",
+    "hash": "sha256-m+dclQs0oGwXci/SDfaNSwuzTCV3hDskyiD0VbTmryQ=",
    "homepage": "https://registry.terraform.io/providers/splunk-terraform/signalfx",
    "owner": "splunk-terraform",
    "repo": "terraform-provider-signalfx",
-    "rev": "v9.6.1",
+    "rev": "v9.7.1",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-ijq03YXHiSKOgjG9gbyNHPUsYlYHi9nY4pmhMxM5CrI="
+    "vendorHash": "sha256-Eh/8EDdnxKBbq0E3KXFtO4liJ6ruytfyCyM5DVwk9jo="
  },
  "skytap": {
    "hash": "sha256-JII4czazo6Di2sad1uFHMKDO2gWgZlQE8l/+IRYHQHU=",
@@ -1264,13 +1264,13 @@
    "vendorHash": "sha256-iEi3zkr4kIZ1FTAft/Fy//v7xtlX/8uSrnbuxgFTDyA="
  },
  "temporalcloud": {
-    "hash": "sha256-nAOHdok/nK33zyEYmyB2nA+y2/mpkigZk4WTyl2F7XA=",
+    "hash": "sha256-cHhrNEHzOWp1wrbWZkoAjFyyhmHfvFZtM8g/u9RI+F0=",
    "homepage": "https://registry.terraform.io/providers/temporalio/temporalcloud",
    "owner": "temporalio",
    "repo": "terraform-provider-temporalcloud",
-    "rev": "v0.5.0",
+    "rev": "v0.6.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-VMEL2dQ1+kMRWjJP6Obc3N1OytpAkRVW/9596WhwkE4="
+    "vendorHash": "sha256-Cqo7aq0uBISrnpQPrmJBNACSt2mAt12I4xpf8yDd0AU="
  },
  "tencentcloud": {
    "hash": "sha256-g4UQs7GdU5GFkrC9eeFLMYGLR2Wt2UbSSX5yP1CExT0=",
@@ -8,11 +8,11 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "aldente";
-  version = "1.29";
+  version = "1.30";

  src = fetchurl {
    url = "https://github.com/davidwernhart/aldente-charge-limiter/releases/download/${finalAttrs.version}/AlDente.dmg";
-    hash = "sha256-F19DZnjnlZ7ydgNhPNUa7FqPp5/MzDcQRtksIkXgIis=";
+    hash = "sha256-O3t8Vm1y/OcPzz9MgKA5TcaK43HhPrURvPeWeXvjsjo=";
  };

  dontBuild = true;
@@ -8,11 +8,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "allure";
-  version = "2.32.0";
+  version = "2.32.1";

  src = fetchurl {
    url = "https://github.com/allure-framework/allure2/releases/download/${finalAttrs.version}/allure-${finalAttrs.version}.tgz";
-    hash = "sha256-zfqXiz6rnPn1JInqkoTkMdiw0thZvNVqeRwyDoA85lw=";
+    hash = "sha256-EpTcdF1v6Os7FL/stqRR6OtZoPGuWp8qoC6U7NtBtaY=";
  };

  dontConfigure = true;
@@ -16,19 +16,19 @@

 rustPlatform.buildRustPackage rec {
  pname = "amdgpu_top";
-  version = "0.10.1";
+  version = "0.10.2";

  src = fetchFromGitHub {
    owner = "Umio-Yasuno";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-1OPaQcjrUaYTvMrOPcTemGs8DPn3NuuIbaIObxLiCt0=";
+    hash = "sha256-sXVUtqPnVYSJ+/RF4/FuXEZOA3DgHMv5Yd8ew/tJJeY=";
  };

  cargoLock = {
    lockFile = ./Cargo.lock;
    outputHashes = {
-      "libdrm_amdgpu_sys-0.7.7" = "sha256-gPK3BrW2oTCQDRvHJGY28EFmkKrVexY2bGXG2QwHZL0=";
+      "libdrm_amdgpu_sys-0.8.3" = "sha256-unjsJqQ6e9Xo522ETTpy6bxXYW/NzNOnVV+w1ord87U=";
    };
  };

@@ -13,7 +13,7 @@
  perl,
  cryptopp,
  libupnp,
-  boost, # Not using boost leads to crashes with gtk3
+  boost186, # Not using boost leads to crashes with gtk3
  gettext,
  libpng,
  pkg-config,
@@ -60,7 +60,7 @@ stdenv.mkDerivation rec {
      perl
      cryptopp.dev
      libupnp
-      boost
+      boost186
    ]
    ++ lib.optional httpServer libpng
    ++ lib.optional client libX11;
@@ -9,17 +9,17 @@
 }:
 rustPlatform.buildRustPackage rec {
  pname = "argon";
-  version = "2.0.21";
+  version = "2.0.22";

  src = fetchFromGitHub {
    owner = "argon-rbx";
    repo = "argon";
    tag = version;
-    hash = "sha256-msKrPLB+38PU7LEw92xEqFy6JxwMjttBaobIOhU7eWw=";
+    hash = "sha256-Nno6uZIlD4tA3opzhzO4ylPPGq3RDDrhAIQnt/rTXdA=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-HOgwN/LwnHq+BxiniTFbBwCw0Qc6kxcH8GrAy/JggXo=";
+  cargoHash = "sha256-W3Z/WVGP+RBbnqgcgIcrfkmgfmdKdH8kG/LBfvtArqo=";

  nativeBuildInputs = [ pkg-config ];

@@ -64,24 +64,25 @@ let
 in
 py.pkgs.buildPythonApplication rec {
  pname = "awscli2";
-  version = "2.23.5"; # N.B: if you change this, check if overrides are still up-to-date
+  version = "2.23.11"; # N.B: if you change this, check if overrides are still up-to-date
  pyproject = true;

  src = fetchFromGitHub {
    owner = "aws";
    repo = "aws-cli";
    tag = version;
-    hash = "sha256-uDKiTw1UCcbfitoJzSPzVT1qM4Gm4bQaryRz7VTeEzg=";
+    hash = "sha256-ID0hQiR0qOTJMOvRAgEJLheblkY77yIgu1Ofa/6r7nk=";
  };

  postPatch = ''
    substituteInPlace pyproject.toml \
      --replace-fail 'flit_core>=3.7.1,<3.9.1' 'flit_core>=3.7.1' \
-      --replace-fail 'awscrt==0.23.4' 'awscrt>=0.23.4' \
+      --replace-fail 'awscrt==0.23.8' 'awscrt>=0.23.6' \
      --replace-fail 'cryptography>=40.0.0,<43.0.2' 'cryptography>=43.0.0' \
      --replace-fail 'distro>=1.5.0,<1.9.0' 'distro>=1.5.0' \
      --replace-fail 'docutils>=0.10,<0.20' 'docutils>=0.10' \
-      --replace-fail 'prompt-toolkit>=3.0.24,<3.0.39' 'prompt-toolkit>=3.0.24'
+      --replace-fail 'prompt-toolkit>=3.0.24,<3.0.39' 'prompt-toolkit>=3.0.24' \
+      --replace-fail 'zipp<3.21.0' 'zipp>=3.21.0'

    substituteInPlace requirements-base.txt \
      --replace-fail "wheel==0.43.0" "wheel>=0.43.0"
@@ -7,13 +7,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "cgreen";
-  version = "1.6.3";
+  version = "1.6.4";

  src = fetchFromGitHub {
    owner = "cgreen-devs";
    repo = "cgreen";
    rev = finalAttrs.version;
-    sha256 = "sha256-qcOj+NlgbHCYuNsM6ngNI2fNhkCwLL6mIVkNSv9hRE8=";
+    sha256 = "sha256-W4MdB3acZcxavjRupJa4eXAv9g4QgYXFAQWOLoHrQZ8=";
  };

  postPatch = ''
@@ -9,13 +9,13 @@

 buildGoModule rec {
  pname = "cilium-cli";
-  version = "0.16.23";
+  version = "0.16.24";

  src = fetchFromGitHub {
    owner = "cilium";
    repo = "cilium-cli";
    tag = "v${version}";
-    hash = "sha256-8GD3VjYInPaxOFoPeJGWIDfOIUQ7+g3GgfVq/IS18Bw=";
+    hash = "sha256-sUPyMAyLrQn4lLtoE9aVtOYvpjOg3I/QXD+x4Rs/2/s=";
  };

  nativeBuildInputs = [ installShellFiles ];
@@ -5,93 +5,143 @@
  appimageTools,
  makeWrapper,
  writeScript,
+  undmg,
 }:
 let
  pname = "cursor";
-  version = "0.44.11";
+  version = "0.45.8";
+
+  inherit (stdenvNoCC) hostPlatform;

  sources = {
    x86_64-linux = fetchurl {
-      url = "https://download.todesktop.com/230313mzl4w4u92/cursor-0.44.11-build-250103fqxdt5u9z-x86_64.AppImage";
-      hash = "sha256-eOZuofnpED9F6wic0S9m933Tb7Gq7cb/v0kRDltvFVg=";
+      url = "https://download.todesktop.com/230313mzl4w4u92/cursor-0.45.8-build-250201b44xw1x2k-x86_64.AppImage";
+      hash = "sha256-H+9cisa1LWJleqzwaB0WIzJpioYZyfLghelcZthCOvg=";
    };
    aarch64-linux = fetchurl {
-      url = "https://download.todesktop.com/230313mzl4w4u92/cursor-0.44.11-build-250103fqxdt5u9z-arm64.AppImage";
-      hash = "sha256-mxq7tQJfDccE0QsZDZbaFUKO0Xc141N00ntX3oEYRcc=";
+      url = "https://download.todesktop.com/230313mzl4w4u92/cursor-0.45.8-build-250201b44xw1x2k-arm64.AppImage";
+      hash = "sha256-GgPt9SvuCA9Hxm7nxm7mz0AvPKaLWCkYXO225taXnLA=";
+    };
+    x86_64-darwin = fetchurl {
+      url = "https://download.todesktop.com/230313mzl4w4u92/Cursor%200.45.8%20-%20Build%20250201b44xw1x2k-x64.dmg";
+      hash = "sha256-UqwzgxBSZR0itCknKzBClEX3w9aFKFhGIiVUQNYDVEM=";
+    };
+    aarch64-darwin = fetchurl {
+      url = "https://download.todesktop.com/230313mzl4w4u92/Cursor%200.45.8%20-%20Build%20250201b44xw1x2k-arm64.dmg";
+      hash = "sha256-AUW19xJFsrDGSUNE/bwkC2aN2QyaS+JKCjuxx//kbiI=";
    };
  };

-  supportedPlatforms = [
-    "x86_64-linux"
-    "aarch64-linux"
-  ];
-
-  src = sources.${stdenvNoCC.hostPlatform.system};
+  source = sources.${hostPlatform.system};

+  # Linux -- build from AppImage
  appimageContents = appimageTools.extractType2 {
-    inherit version pname src;
+    inherit version pname;
+    src = source;
  };

-  wrappedAppImage = appimageTools.wrapType2 { inherit version pname src; };
-
-  appimageInstall = ''
-    runHook preInstall
-
-    mkdir -p $out/
-    cp -r bin $out/bin
-
-    mkdir -p $out/share/cursor
-    cp -a ${appimageContents}/locales $out/share/cursor
-    cp -a ${appimageContents}/resources $out/share/cursor
-    cp -a ${appimageContents}/usr/share/icons $out/share/
-    install -Dm 644 ${appimageContents}/cursor.desktop -t $out/share/applications/
-
-    substituteInPlace $out/share/applications/cursor.desktop --replace-fail "AppRun" "cursor"
-
-    wrapProgram $out/bin/cursor \
-      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime=true}} --no-update"
-
-    runHook postInstall
-  '';
+  wrappedAppimage = appimageTools.wrapType2 {
+    inherit version pname;
+    src = source;
+  };

 in
 stdenvNoCC.mkDerivation {
  inherit pname version;

-  src = wrappedAppImage;
+  src = if hostPlatform.isLinux then wrappedAppimage else source;

-  nativeBuildInputs = [ makeWrapper ];
+  nativeBuildInputs =
+    lib.optionals hostPlatform.isLinux [ makeWrapper ]
+    ++ lib.optionals hostPlatform.isDarwin [ undmg ];

-  installPhase = appimageInstall;
+  sourceRoot = lib.optionalString hostPlatform.isDarwin ".";
+
+  # Don't break code signing
+  dontUpdateAutotoolsGnuConfigScripts = hostPlatform.isDarwin;
+  dontConfigure = hostPlatform.isDarwin;
+  dontFixup = hostPlatform.isDarwin;
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/
+
+    ${lib.optionalString hostPlatform.isLinux ''
+      cp -r bin $out/bin
+      mkdir -p $out/share/cursor
+      cp -a ${appimageContents}/locales $out/share/cursor
+      cp -a ${appimageContents}/resources $out/share/cursor
+      cp -a ${appimageContents}/usr/share/icons $out/share/
+      install -Dm 644 ${appimageContents}/cursor.desktop -t $out/share/applications/
+
+      substituteInPlace $out/share/applications/cursor.desktop --replace-fail "AppRun" "cursor"
+
+      wrapProgram $out/bin/cursor \
+        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime=true}} --no-update"
+    ''}
+
+    ${lib.optionalString hostPlatform.isDarwin ''
+      APP_DIR="$out/Applications"
+      CURSOR_APP="$APP_DIR/Cursor.app"
+      mkdir -p "$APP_DIR"
+      cp -Rp Cursor.app "$APP_DIR"
+      mkdir -p "$out/bin"
+      cat << EOF > "$out/bin/cursor"
+      #!${stdenvNoCC.shell}
+      open -na "$CURSOR_APP" --args "\$@"
+      EOF
+      chmod +x "$out/bin/cursor"
+    ''}
+
+    runHook postInstall
+  '';

  passthru = {
    inherit sources;
    updateScript = writeScript "update.sh" ''
      #!/usr/bin/env nix-shell
-      #!nix-shell -i bash -p curl yq coreutils gnused common-updater-scripts
+      #!nix-shell -i bash -p curl yq coreutils gnused trurl common-updater-scripts
      set -eu -o pipefail
+
      baseUrl="https://download.todesktop.com/230313mzl4w4u92"
      latestLinux="$(curl -s $baseUrl/latest-linux.yml)"
-      version="$(echo "$latestLinux" | yq -r .version)"
-      filename="$(echo "$latestLinux" | yq -r '.files[] | .url | select(. | endswith(".AppImage"))')"
-      linuxStem="$(echo "$filename" | sed -E s/^\(cursor-.+-build-.*\)-.+$/\\1/)"
+      latestDarwin="$(curl -s $baseUrl/latest-mac.yml)"
+      linuxVersion="$(echo "$latestLinux" | yq -r .version)"

      currentVersion=$(nix-instantiate --eval -E "with import ./. {}; code-cursor.version or (lib.getVersion code-cursor)" | tr -d '"')

-      if [[ "$version" != "$currentVersion" ]]; then
-        for platform in ${lib.escapeShellArgs supportedPlatforms}; do
-          if [ $platform = "x86_64-linux" ]; then
-            url="$baseUrl/$linuxStem-x86_64.AppImage"
-          elif [ $platform = "aarch64-linux" ]; then
-            url="$baseUrl/$linuxStem-arm64.AppImage"
-          else
-            echo "Unsupported platform: $platform"
-            exit 1
+      if [[ "$linuxVersion" != "$currentVersion" ]]; then
+          darwinVersion="$(echo "$latestDarwin" | yq -r .version)"
+          if [ "$linuxVersion" != "$darwinVersion" ]; then
+              echo "Linux version ($linuxVersion) and Darwin version ($darwinVersion) do not match"
+              exit 1
          fi
+          version="$linuxVersion"

-          hash=$(nix-hash --to-sri --type sha256 "$(nix-prefetch-url "$url")")
-          update-source-version code-cursor $version $hash $url --system=$platform --ignore-same-version --source-key="sources.$platform"
-        done
+          linuxFilename="$(echo "$latestLinux" | yq -r '.files[] | .url | select(. | endswith(".AppImage"))' | head -n 1)"
+          linuxStem="$(echo "$linuxFilename" | sed -E s/^\(.+build.+\)-[^-]+AppImage$/\\1/)"
+
+          darwinFilename="$(echo "$latestDarwin" | yq -r '.files[] | .url | select(. | endswith(".dmg"))' | head -n 1)"
+          darwinStem="$(echo "$darwinFilename" | sed -E s/^\(.+Build[^-]+\)-.+dmg$/\\1/)"
+
+          for platform in  "x86_64-linux" "aarch64-linux" "x86_64-darwin" "aarch64-darwin"; do
+              if [ $platform = "x86_64-linux" ]; then
+                  url="$baseUrl/$linuxStem-x86_64.AppImage"
+              elif [ $platform = "aarch64-linux" ]; then
+                  url="$baseUrl/$linuxStem-arm64.AppImage"
+              elif [ $platform = "x86_64-darwin" ]; then
+                  url="$baseUrl/$darwinStem-x64.dmg"
+              elif [ $platform = "aarch64-darwin" ]; then
+                  url="$baseUrl/$darwinStem-arm64.dmg"
+              else
+                  echo "Unsupported platform: $platform"
+                  exit 1
+              fi
+
+              url=$(trurl --accept-space "$url")
+              hash=$(nix-hash --to-sri --type sha256 "$(nix-prefetch-url "$url" --name "cursor-$version")")
+              update-source-version code-cursor $version $hash $url --system=$platform --ignore-same-version --source-key="sources.$platform"
+          done
      fi
    '';
  };
@@ -102,8 +152,11 @@ stdenvNoCC.mkDerivation {
    changelog = "https://cursor.com/changelog";
    license = lib.licenses.unfree;
    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
-    maintainers = with lib.maintainers; [ sarahec ];
-    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [
+      sarahec
+      aspauldingcode
+    ];
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
    mainProgram = "cursor";
  };
 }
@@ -8,16 +8,16 @@

 buildNpmPackage rec {
  pname = "dotenvx";
-  version = "1.33.0";
+  version = "1.34.0";

  src = fetchFromGitHub {
    owner = "dotenvx";
    repo = "dotenvx";
    tag = "v${version}";
-    hash = "sha256-/0bxY4D3jq6shXEHf13CkGdEGRS8cVQOSaLiIaehq5g=";
+    hash = "sha256-zRdE79UzbiyFKCu+5yAI+JHlt+sxF0C0XaaZRNqciCM=";
  };

-  npmDepsHash = "sha256-JtoOXDS44fG4ctzN1ZSi+WOXye2p5mjKczSXbvGPIEw=";
+  npmDepsHash = "sha256-Rtb9/hwUVQAmDleSg7iIEgVznREqx5VNqufSxiWa1Zw=";

  dontNpmBuild = true;

@@ -7,16 +7,16 @@

 buildGoModule rec {
  pname = "eksctl";
-  version = "0.201.0";
+  version = "0.203.0";

  src = fetchFromGitHub {
    owner = "weaveworks";
    repo = pname;
    rev = version;
-    hash = "sha256-mvIidkr3fUs8TbD8voqE8NAA14XPPuXC9u/2pc2ShK4=";
+    hash = "sha256-hBHWj1Brn4qbtOLZjxlr6tBuipItCFwbL9bm2wlfL80=";
  };

-  vendorHash = "sha256-qOV6mAKwLrF5+/q/PS2qVJcQx84CjNinv/e8KG+lxfI=";
+  vendorHash = "sha256-IFi9FhsiWWg9joPAGnEnZfq4PzBjR6bJ5MWvFIPyfJo=";

  doCheck = false;

@@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "fission";
-  version = "1.20.5";
+  version = "1.21.0";

  src = fetchFromGitHub {
    owner = "fission";
    repo = "fission";
    rev = "v${version}";
-    hash = "sha256-JYe5CWHcqQwbldimX2/pkF+gUvCplIuNg/kTvyT2I0c=";
+    hash = "sha256-Tl7aKibVbNAKOa1tycKtEzdJ8rJHBMa8PTUm0i7DKA4=";
  };

-  vendorHash = "sha256-3Wuvi7st9y+Pyv12HyxcSoaUjYA3xooYH+zHZ+xbngo=";
+  vendorHash = "sha256-PhB6zR/dXnOCHJiJ/EjVOD26SubaAITRm61XOvULerU=";

  ldflags = [ "-s" "-w" "-X info.Version=${version}" ];

@@ -2,6 +2,7 @@
  lib,
  buildGoModule,
  fetchFromGitLab,
+  fetchpatch,
 }:

 buildGoModule rec {
@@ -19,14 +20,35 @@ buildGoModule rec {

  vendorHash = "sha256-aKE/yr2Sh+4yw4TmpaVF84rJOI6cjs0DKY326+aXO1o=";

+  env = {
+    # required for multiple azure tests
+    # https://gitlab.com/gitlab-org/container-registry/-/issues/1494
+    AZURE_DRIVER_VERSION = "azure_v2";
+  };
+
+  patches = [
+    # remove with >= 4.15.3
+    (fetchpatch {
+      url = "https://gitlab.com/gitlab-org/container-registry/-/commit/268689a2f30880b7d122469a4260ca46cbc55ccd.patch";
+      hash = "sha256-RslK4qvcqCaG7ju2LgN/tI9cImrTj3Nry+mCv3zoWiA=";
+    })
+  ];
+
  postPatch = ''
    # Disable flaky inmemory storage driver test
    rm registry/storage/driver/inmemory/driver_test.go

    substituteInPlace health/checks/checks_test.go \
-      --replace \
+      --replace-fail \
        'func TestHTTPChecker(t *testing.T) {' \
        'func TestHTTPChecker(t *testing.T) { t.Skip("Test requires network connection")'
+
+    # Add workaround for failing test due to function type mismatch (args vs return) by upstream
+    # https://gitlab.com/gitlab-org/container-registry/-/issues/1495
+    substituteInPlace registry/storage/driver/base/regulator_test.go \
+      --replace-fail \
+        'require.Equal(t, limit, r.available, "r.available")' \
+        'require.Equal(t, limit, int(r.available), "r.available")'
  '';

  meta = with lib; {
@@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "go-mockery";
-  version = "2.51.1";
+  version = "2.52.1";

  src = fetchFromGitHub {
    owner = "vektra";
    repo = "mockery";
    rev = "v${version}";
-    sha256 = "sha256-+KbO2Ch0SB+TP7/So2bCsHOS7ousAl5mD/w2EXj4jzg=";
+    sha256 = "sha256-algCErKmB43r/t7wo8BJSM0MHRxvxVWZ2u0n1xuLLdw=";
  };

  preCheck = ''
@@ -24,7 +24,7 @@ buildGoModule rec {
  env.CGO_ENABLED = false;

  proxyVendor = true;
-  vendorHash = "sha256-z1ceS+LO6d7T264pw2BLadw804aGRISyrKW/dr4fZHA=";
+  vendorHash = "sha256-nL6dDGifhtmDHfz1ae+wnmVPPQDLrRgI7v8c5cQzo8Q=";

  subPackages = [ "." ];

@@ -11,12 +11,12 @@

 stdenv.mkDerivation rec {
  pname = "grpc_cli";
-  version = "1.70.0";
+  version = "1.70.1";
  src = fetchFromGitHub {
    owner = "grpc";
    repo = "grpc";
    rev = "v${version}";
-    hash = "sha256-kJhGAhqu25Q2g6BWkVGp6nGYrWdBnMhoMu6e7ifNbgk=";
+    hash = "sha256-/Mg999SA/19iypjacXrEnX1B08hajyq7sC7yab+eTCk=";
    fetchSubmodules = true;
  };
  nativeBuildInputs = [
@@ -6,13 +6,13 @@

 buildGoModule rec {
  pname = "hishtory";
-  version = "0.327";
+  version = "0.328";

  src = fetchFromGitHub {
    owner = "ddworken";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-bt+k3JWkuxpY2ZSHFvKxOyUwcBtQrsTH/uf1Lw0r+uo=";
+    hash = "sha256-XEhhRs0yt6VvE9Lw4ikY3nb2frCWm15fxcvRDAWfifY=";
  };

  vendorHash = "sha256-A975ensuezz75I4KrFcl8wi9HjZqlfEHeJVAyA69V9k=";
@@ -7,17 +7,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "httm";
-  version = "0.45.0";
+  version = "0.45.6";

  src = fetchFromGitHub {
    owner = "kimono-koans";
    repo = pname;
    rev = version;
-    hash = "sha256-g+UUiFgOTuSNymg3OcIsoTqWA/OOZzwFCUQ7YxW1AzE=";
+    hash = "sha256-dNiF1MbDhQKETQf3O+5joFR82cQsQezSayEwY2YJeNs=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-IUcuVeyoCsaQHg/08CTqEySmIh7v2fr7LDJCiYiq+FQ=";
+  cargoHash = "sha256-YnJoJ3npiURcmV36kgyhAcXla/tBTK7Hkqxrq6D/XRk=";

  nativeBuildInputs = [ installShellFiles ];

@@ -27,6 +27,9 @@ stdenvNoCC.mkDerivation rec {

  dontDropIconThemeCache = true;

+  # Upstream ships a bunch of those, and is very dead
+  dontCheckForBrokenSymlinks = true;
+
  installPhase = ''
    runHook preInstall

@@ -23,7 +23,7 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "komikku";
-  version = "1.68.0";
+  version = "1.69.0";
  pyproject = false;

  src = fetchFromGitea {
@@ -31,7 +31,7 @@ python3.pkgs.buildPythonApplication rec {
    owner = "valos";
    repo = "Komikku";
    rev = "v${version}";
-    hash = "sha256-pfhGMeXVSgsQApFXXhQA6pzOqhiuDuNzmarOtO0Gm90=";
+    hash = "sha256-YrqoUU2BYM6AMD5s6FJn8GV+UmyeKV2mFQyfJjLI8HA=";
  };

  nativeBuildInputs = [
@@ -10,16 +10,16 @@

 buildGoModule rec {
  pname = "kubelogin";
-  version = "0.1.6";
+  version = "0.1.7";

  src = fetchFromGitHub {
    owner = "Azure";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-VmCJoyr42tbQhe8o54D/t9+Gfz40Oe6NzqqJWknNP70=";
+    sha256 = "sha256-yU9RDzUjN8Ona5Xa7+90qDmc4HFbec3tEzumaPmG6es=";
  };

-  vendorHash = "sha256-8L5OzEJvHBOHPkZyIitIW8hBzmOytTDUUTGlAmY5zBg=";
+  vendorHash = "sha256-pAhBUREzancX0cbLm5rgZwJn8N0fLX57wONNypADQLE=";

  ldflags = [
    "-X main.gitTag=v${version}"
@@ -9,13 +9,13 @@

 buildGoModule rec {
  pname = "kubescape";
-  version = "3.0.24";
+  version = "3.0.25";

  src = fetchFromGitHub {
    owner = "kubescape";
    repo = "kubescape";
    tag = "v${version}";
-    hash = "sha256-gzwdDUYOHZnd9mMHmuW9q1xhxWjpk5u/yoxdJkSNrVA=";
+    hash = "sha256-1KwFa0FixlzgRd2hSUj/ODf0SJKxZ496/xg374uV4fI=";
    fetchSubmodules = true;
  };

@@ -112,6 +112,9 @@ stdenv.mkDerivation rec {
    "localstatedir=$TMPDIR"
  ];

+  # Upstream ships broken symlinks in docs
+  dontCheckForBrokenSymlinks = true;
+
  meta = with lib; {
    description = "Allows to receive and send infrared signals";
    homepage = "https://www.lirc.org/";
@@ -5,16 +5,16 @@

 buildNpmPackage rec {
  pname = "npm-check-updates";
-  version = "17.1.11";
+  version = "17.1.14";

  src = fetchFromGitHub {
    owner = "raineorshine";
    repo = "npm-check-updates";
    rev = "refs/tags/v${version}";
-    hash = "sha256-l23+Gmv6395QSWdGOVgHH2mvQND02/PQyBvwvEeawCI=";
+    hash = "sha256-PIaT5Wg+jEd4NPlLVQKnJ429489ZSQPagCc/+h2EFrI=";
  };

-  npmDepsHash = "sha256-/J38+j4f5G54ejfzZIqQ9JL7BCD8UTa5dkwYgIu2Xo0=";
+  npmDepsHash = "sha256-k/TBMdOyTjVBir5wIujMPHa+2FRvzORX7dXpLrMhTqY=";

  postPatch = ''
    sed -i '/"prepare"/d' package.json
@@ -10,11 +10,11 @@
 }:
 stdenv.mkDerivation rec {
  pname = "nzbhydra2";
-  version = "7.12.1";
+  version = "7.12.3";

  src = fetchzip {
    url = "https://github.com/theotherp/nzbhydra2/releases/download/v${version}/nzbhydra2-${version}-generic.zip";
-    hash = "sha256-QCMsAFRU6THmKiIFvnfUHzmv91gcC1pAztNYg9RymzU=";
+    hash = "sha256-uTtkMusIhDbD+CojOSJ59Kqo6iSuIqWLqd6T5tYuX4k=";
    stripRoot = false;
  };

@@ -25,7 +25,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "opengamepadui";
-  version = "0.35.7";
+  version = "0.35.8";

  buildType = if withDebug then "debug" else "release";

@@ -33,7 +33,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "ShadowBlip";
    repo = "OpenGamepadUI";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-yOFxtDDYdxCtN8L8RtXgxebjRwK1Blsp/RG1E+UfUEI=";
+    hash = "sha256-vMb08Wqjt5j6IgMnXuZr6MGNk1CprVn2GTNDdOxnFG0=";
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
@@ -6,14 +6,14 @@

 python3Packages.buildPythonApplication rec {
  pname = "pipenv-poetry-migrate";
-  version = "0.6.0";
+  version = "0.6.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "yhino";
    repo = "pipenv-poetry-migrate";
    tag = "v${version}";
-    hash = "sha256-M31bOvKGUlkzfZRQAxTkxhX8m9cCzEvsNZdyIyipwGI=";
+    hash = "sha256-B13/QHHruZGkks1AKHLUw8h5FJkqaVjPHjiKH8vkV/8=";
  };

  build-system = [ python3Packages.poetry-core ];
@@ -103,6 +103,7 @@ python.pkgs.buildPythonApplication rec {
    "django-csp"
    "django-filter"
    "django-hierarkey"
+    "django-i18nfield"
    "djangorestframework"
    "markdown"
    "pillow"
@@ -11,13 +11,13 @@

 buildGoModule rec {
  pname = "pulsarctl";
-  version = "4.0.1.2";
+  version = "4.0.1.3";

  src = fetchFromGitHub {
    owner = "streamnative";
    repo = "pulsarctl";
    rev = "v${version}";
-    hash = "sha256-3VONhrKViblh0LXy/hMVgzCN54JkDYw3v/YrqXuk6l8=";
+    hash = "sha256-wjLF8yaVRJeh7xMCmNAI/xW7CU5noFPgHkZRtixADv8=";
  };

  vendorHash = "sha256-wNUTJn7Ar+GlePEhdr6xeolAiltJdAoIs5o5uDo8Ibs=";
@@ -1,11 +1,20 @@
 {
-  stdenv,
  lib,
+  stdenv,
  fetchurl,
-  makeWrapper,
  jre_headless,
+  linkFarm,
+  makeWrapper,
+  plugins ? [ ],
 }:
-
+let
+  pluginsDir = linkFarm "reposilite-plugins" (
+    builtins.map (p: {
+      name = (builtins.parseDrvName p.name).name + ".jar";
+      path = p.outPath or p;
+    }) plugins
+  );
+in
 stdenv.mkDerivation (finalAttrs: {
  pname = "Reposilite";
  version = "3.5.20";
@@ -25,7 +34,9 @@ stdenv.mkDerivation (finalAttrs: {
    mkdir -p $out/lib
    cp $src $out/lib/reposilite
    makeWrapper ${jre_headless}/bin/java $out/bin/reposilite \
-      --add-flags "-Xmx40m -jar $out/lib/reposilite"
+      --add-flags "-Xmx40m -jar $out/lib/reposilite ${
+        lib.optionalString (plugins != [ ]) "--plugin-directory ${pluginsDir}"
+      }"

    runHook postInstall
  '';
@@ -35,7 +46,10 @@ stdenv.mkDerivation (finalAttrs: {
    homepage = "https://github.com/dzikoysk/reposilite";
    sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
    license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ jamalam ];
+    maintainers = with lib.maintainers; [
+      jamalam
+      uku3lig
+    ];
    inherit (jre_headless.meta) platforms;
    mainProgram = "reposilite";
  };
@@ -7,13 +7,13 @@

 stdenvNoCC.mkDerivation {
  pname = "retroarch-assets";
-  version = "1.19.0-unstable-2024-12-31";
+  version = "1.20.0-unstable-2025-01-30";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "retroarch-assets";
-    rev = "c4f1ec8bddba15e1b1a00a7e56c50cf0eca8b5c9";
-    hash = "sha256-iyLw7LhZIjPRQJaa6bS+HUctYDoVzD1sU8SUFtBnwnE=";
+    rev = "9afd2b8a9d16fc25c5a046122bc0d2b3c965980e";
+    hash = "sha256-PWwq9aNj0u+Dc9Q7lSRivER1Fd42H6u2auU/XLlg61k=";
  };

  makeFlags = [
@@ -53,17 +53,17 @@ let
 in
 rustPlatform.buildRustPackage rec {
  pname = "rio";
-  version = "0.2.4";
+  version = "0.2.5";

  src = fetchFromGitHub {
    owner = "raphamorim";
    repo = "rio";
    rev = "v${version}";
-    hash = "sha256-dH/r6Bumis8WOM/c/FAvFD2QYuMeHWOMQuU6zLWrlaM=";
+    hash = "sha256-GyHwYvhqRX2ENaytLB/NrJv2wFbpPrZpQd5OW53ZgRw=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-zE99cP6m6gWViAfiF9nlnSn2iLxBNoMyl5fWdmc1r7s=";
+  cargoHash = "sha256-TB3Nl3ePIJE7UQ89cJI5MPG4XpsPQgG5tM409GGm+qg=";

  nativeBuildInputs =
    [
@@ -0,0 +1,20 @@
+diff --git a/rutabaga_gfx/build.rs b/rutabaga_gfx/build.rs
+index bd5a9be96..d2244c4c6 100644
+--- a/rutabaga_gfx/build.rs
+++ b/rutabaga_gfx/build.rs
+@@ -194,9 +194,14 @@ fn gfxstream() -> Result<()> {
+             pkg_config::Config::new().probe("libdrm")?;
+         }
+ 
+        let mut use_clang = target_os.contains("macos");
+        if std::env::var("USE_CLANG").is_ok() {
+            use_clang = true;
+        }
+
+         // Need to link against libc++ or libstdc++.  Apple is clang-only, while by default other
+         // Unix platforms use libstdc++.
+-        if target_os.contains("macos") {
+        if use_clang {
+             println!("cargo:rustc-link-lib=dylib=c++");
+         } else if target_os.contains("linux") || target_os.contains("nto") {
+             println!("cargo:rustc-link-lib=dylib=stdc++");
@@ -40,8 +40,15 @@ stdenv.mkDerivation (finalAttrs: {
    })
    # Install the dylib on Darwin.
    ./darwin-install.patch
+    # Patch for libc++, drop in next update
+    # https://chromium.googlesource.com/crosvm/crosvm/+/8ae3c23b2e3899de33b973fc636909f1eb3dc98c
+    ./link-cxx.patch
  ];

+  env = lib.optionalAttrs stdenv.hostPlatform.useLLVM {
+    USE_CLANG = true;
+  };
+
  nativeBuildInputs = [
    cargo
    pkg-config
@@ -53,7 +53,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "sdl3";
-  version = "3.2.0";
+  version = "3.2.2";

  outputs = [
    "lib"
@@ -65,7 +65,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "libsdl-org";
    repo = "SDL";
    tag = "release-${finalAttrs.version}";
-    hash = "sha256-gVLZPuXtMdFhylxh3+LC/SJCaQiOwZpbVcBGctyGGYY=";
+    hash = "sha256-AbEwpIxgYl3g4calnWca8Vz/Tw1DnYfZrD1Vl5cSMpk=";
  };

  postPatch =
@@ -13,13 +13,13 @@

 stdenv.mkDerivation rec {
  pname = "signalbackup-tools";
-  version = "20250127-1";
+  version = "20250202";

  src = fetchFromGitHub {
    owner = "bepaald";
    repo = "signalbackup-tools";
    rev = version;
-    hash = "sha256-6JHHiT1OwLPKxA0rbGiwhwF4PiuS5yguoNtB7dpTJPI=";
+    hash = "sha256-RYklp/jrp/bdS6tuIBHSgF1GJYnYydj4fcwsgcuZPeY=";
  };

  nativeBuildInputs = [
@@ -6,13 +6,13 @@

 buildGoModule rec {
  pname = "simple64-netplay-server";
-  version = "2025.01.1";
+  version = "2025.01.3";

  src = fetchFromGitHub {
    owner = "simple64";
    repo = "simple64-netplay-server";
    tag = "v${version}";
-    hash = "sha256-mE6cm1/xxQvcQykKDfO9dDK3J6TOE3POaDuYB0tNRPk=";
+    hash = "sha256-6+apLOy/hlLkvQjVxi4qpIVhfImdevyCFGAo6rBCc6k=";
  };

  vendorHash = "sha256-lcKOAPCyWKNg+l1YjziaMTn4DjLB0P+dz3FqyAy0sFk=";
@@ -8,14 +8,14 @@
 }:
 buildGoModule rec {
  pname = "snips-sh";
-  version = "0.4.1";
-  vendorHash = "sha256-weqlhnhUG2gn9SFS63q1LYmPa7liGYYcJN5qorj6x2E=";
+  version = "0.4.2";
+  vendorHash = "sha256-Lp3yousaDkTCruOP0ytfY84vPmfLMgBoTwf+7Q7Q0Lc=";

  src = fetchFromGitHub {
    owner = "robherley";
    repo = "snips.sh";
    rev = "v${version}";
-    hash = "sha256-FEo2/TPwes8/Iwfp7OIo1HbLWF9xmVS9ZMC9HysyK/k=";
+    hash = "sha256-IjGXGY75k9VeeHek0V8SrIElmiQ+Q2P5gEDIp7pmQd8=";
  };

  tags = (lib.optional (!withTensorflow) "noguesser");
@@ -6,11 +6,11 @@

 stdenvNoCC.mkDerivation rec {
  pname = "sof-firmware";
-  version = "2024.09.2";
+  version = "2025.01";

  src = fetchurl {
    url = "https://github.com/thesofproject/sof-bin/releases/download/v${version}/sof-bin-${version}.tar.gz";
-    sha256 = "sha256-huaEGlXx1tHJFQOoSCwbR128rezbYVG/oKwAldHYpSo=";
+    sha256 = "sha256-NNVl23V6MkUBBjF8xR84v2eWLg/It/fHLm45/YnpkmM=";
  };

  dontFixup = true; # binaries must not be stripped or patchelfed
@@ -5,16 +5,16 @@
 }:
 buildGoModule rec {
  pname = "tdl";
-  version = "0.18.4";
+  version = "0.18.5";

  src = fetchFromGitHub {
    owner = "iyear";
    repo = "tdl";
    rev = "v${version}";
-    hash = "sha256-30OClBZUjoLvZ0ZhSZx+AaS7fhjo8X392t4FQpxoG9Q=";
+    hash = "sha256-PVd9aYo4ALgzovNOfAUQkAaAbWNLeqF+UEPlL9iGhAs=";
  };

-  vendorHash = "sha256-QBqUa/PnT/Xma3SHq6YRGtVNKstTax1GVRsCDU12ETA=";
+  vendorHash = "sha256-IJPGkQxUGk7v+8J37vLTbLSGxYOcfgNDywnGzTxbk3w=";

  ldflags = [
    "-s"
@@ -16,8 +16,8 @@

 stdenv.mkDerivation rec {
  pname = "termius";
-  version = "9.12.0";
-  revision = "212";
+  version = "9.13.1";
+  revision = "213";

  src = fetchurl {
    # find the latest version with
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
    # and the sha512 with
    # curl -H 'X-Ubuntu-Series: 16' https://api.snapcraft.io/api/v1/snaps/details/termius-app | jq '.download_sha512' -r
    url = "https://api.snapcraft.io/api/v1/snaps/download/WkTBXwoX81rBe3s3OTt3EiiLKBx2QhuS_${revision}.snap";
-    hash = "sha512-w2dp/iwwYsR7LVk7O4FtktctX39lMNufrtTSaRjWq59bIalvPM2mC3DDs1zhsEq1EmKsY+uVsAgsDPMG7bCRUw==";
+    hash = "sha512-GF5ZC4t3f54Rwqet9g4McB0h+sBg/+VpZ57IKVKC25T442gAEkdhTwQdqf2kJ+V74PsqdpZJk61rh21EusOi5w==";
  };

  desktopItem = makeDesktopItem {
@@ -15,18 +15,18 @@
 }:
 rustPlatform.buildRustPackage rec {
  pname = "tsukimi";
-  version = "0.18.3";
+  version = "0.19.0";

  src = fetchFromGitHub {
    owner = "tsukinaha";
    repo = "tsukimi";
    tag = "v${version}";
-    hash = "sha256-MbGWPvCq4nzrp8ArXud9A+6uPcnbxs42M2QwjZxUn5w=";
+    hash = "sha256-5hOOIkH0VhZwlsNKAyOI714ueGcSMagoLGi5ECfqXk4=";
    fetchSubmodules = true;
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-59JakfFFM4Tpi1J3ja0aDhC5oty/0QKNLcU58nRewTg=";
+  cargoHash = "sha256-rgTrPJydS4685BlSEwNvmEajZEksqQicscOq/Uu9JJ4=";

  nativeBuildInputs = [
    pkg-config
@@ -56,7 +56,7 @@ rustPlatform.buildRustPackage rec {
    substituteInPlace build.rs \
      --replace-fail 'i18n/locale' "$out/share/locale"

-    substituteInPlace src/main.rs \
+    substituteInPlace src/lib.rs \
      --replace-fail '/usr/share/locale' "$out/share/locale"
  '';

@@ -81,8 +81,5 @@ rustPlatform.buildRustPackage rec {
    ];
    mainProgram = "tsukimi";
    platforms = lib.platforms.linux;
-    # libmpv2 crate fail to compile
-    # expected raw pointer `*const u8` found raw pointer `*const i8`
-    broken = stdenv.hostPlatform.isAarch64;
  };
 }
@@ -0,0 +1,33 @@
+{
+  lib,
+  stdenv,
+  fetchgit,
+}:
+
+stdenv.mkDerivation {
+  pname = "tt-rss-plugin-data-migration";
+  version = "0-unstable-2023-11-01";
+
+  src = fetchgit {
+    url = "https://git.tt-rss.org/fox/ttrss-data-migration.git";
+    rev = "e13d5f97b4887ce7b57b3d76228d838dec15963d";
+    hash = "sha256-xnbR5IQ0h7ilxchNj55ROZdq1L7MIAwv3/00k09WTTs=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    install -D init.php $out/data_migration/init.php
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Plugin for TT-RSS to exports and imports *all* articles of a specific user via neutral format (JSON files in a ZIP archive)";
+    # this plugin doesn't have a license file
+    license = lib.licenses.unfree;
+    homepage = "https://git.tt-rss.org/fox/ttrss-data-migration.git/";
+    maintainers = with lib.maintainers; [ wrvsrx ];
+    platforms = lib.platforms.all;
+  };
+}
@@ -21,13 +21,13 @@
 }:
 stdenv.mkDerivation rec {
  pname = "ustreamer";
-  version = "6.22";
+  version = "6.27";

  src = fetchFromGitHub {
    owner = "pikvm";
    repo = "ustreamer";
    rev = "v${version}";
-    hash = "sha256-6qVDxci2uFV2Z93vqbpwxZ3yAVZ5NHGOPDOYRr2b1l8=";
+    hash = "sha256-/lNRw73w/1L12R1hVIopUvqwKVgl055zn5xL6LL9TLI=";
  };

  buildInputs =
@@ -24,7 +24,7 @@

 let
  pname = "vector";
-  version = "0.43.1";
+  version = "0.44.0";
 in
 rustPlatform.buildRustPackage {
  inherit pname version;
@@ -33,11 +33,11 @@ rustPlatform.buildRustPackage {
    owner = "vectordotdev";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-BFVRaHNd9LMJQnkHHfNtvGKkv8q7GjnT+FzNwSc8GZw=";
+    hash = "sha256-dYjZRTJ0/jb/GsADMy7CkTpFrevSAZz5IMj1mLm22Es=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-1xxEu4/IxUe10Wngz1RUT6Iu982pueRteiOwg6BZ1/E=";
+  cargoHash = "sha256-easBpuypi9wCtfMaeMQg8EVlHhBBWUof3eDRkv0THPM=";

  nativeBuildInputs =
    [
@@ -5,7 +5,7 @@
 }:
 let
  pname = "wait4x";
-  version = "2.14.2";
+  version = "2.14.3";
 in
 buildGoModule {
  inherit pname version;
@@ -14,10 +14,10 @@ buildGoModule {
    owner = "atkrad";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-fNPZ/qgAn4odd5iWnDK1RWPxeBhS/l4ffHLFB27SAoM=";
+    hash = "sha256-tqUqiq+U+C+1KCsCw9h1uufL1ognUyvLwJfRU8aiAWI=";
  };

-  vendorHash = "sha256-Eio6CoYaChG59rHL4tfl7dNWliD7ksRyhoCPxMvMmrQ=";
+  vendorHash = "sha256-KtEOLLsbTfgaXy/0aj5zT5qbgW6qBFMuU3EnnXRu+Ig=";

  # Tests make network access
  doCheck = false;
@@ -10,16 +10,16 @@

 buildGoModule rec {
  pname = "werf";
-  version = "2.22.0";
+  version = "2.24.0";

  src = fetchFromGitHub {
    owner = "werf";
    repo = "werf";
    rev = "v${version}";
-    hash = "sha256-43ZN2bMzVBpliXjDDJrVZqdiWBS3rT5mYEd0440wp4s=";
+    hash = "sha256-IU9gVEG4MsUkdX4aJYKtd11WQLODU1IYAUyiuK+la40=";
  };

-  vendorHash = "sha256-Qy5Tjg/QETeN8leTaWZXSUauK2LkPUUZbpztC79v6Jo=";
+  vendorHash = "sha256-1HK90RqVvpuzkhbsLh0R6/CcdO/RrXRuOr3MBN0dcLU=";

  proxyVendor = true;

@@ -9,20 +9,21 @@
 }:
 let
  pname = "workout-tracker";
-  version = "1.18.1";
+  version = "2.0.3";

  src = fetchFromGitHub {
    owner = "jovandeginste";
    repo = "workout-tracker";
    tag = "v${version}";
-    hash = "sha256-Sn6SOHrsp1ZgsPntc2+cmlAEPVBUrYv1vKLKAQvT9m4=";
+    hash = "sha256-DJOYjKujb6mmqJcYhzPLv1uYgAIWW4hdH/gILlqkJXQ=";
  };

  assets = buildNpmPackage {
    pname = "${pname}-assets";
    inherit version src;
-    npmDepsHash = "sha256-jHpvCMgjGvaAOfbslaIKfIRiPafScpn3WLnYamm+lbs=";
+    npmDepsHash = "sha256-/OBIRiLwUtXVmmg44FYqV0BptxQTg8bDuNMTj8IYwG0=";
    dontNpmBuild = true;
+    makeCacheWritable = true;
    postPatch = ''
      rm Makefile
    '';
@@ -33,7 +34,7 @@ let
    '';
  };
 in
-buildGoModule rec {
+buildGoModule {
  inherit pname version src;

  vendorHash = null;
@@ -43,6 +44,15 @@ buildGoModule rec {
    make build-dist
  '';

+  ldflags = [
+    "-s"
+    "-w"
+    "-X main.buildTime=1970-01-01T00:00:00Z"
+    "-X main.gitCommit=v${version}"
+    "-X main.gitRef=v${version}"
+    "-X main.gitRefName=v${version}"
+  ];
+
  passthru.updateScript = nix-update-script { };

  passthru.tests = {
@@ -55,6 +65,9 @@ buildGoModule rec {
    homepage = "https://github.com/jovandeginste/workout-tracker";
    license = lib.licenses.mit;
    mainProgram = "workout-tracker";
-    maintainers = with lib.maintainers; [ bhankas ];
+    maintainers = with lib.maintainers; [
+      bhankas
+      sikmir
+    ];
  };
 }
@@ -39,7 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
  };

  patches = [
-    # Update prisma to match the version in nixpkgs exactly (currently 6.0.1). To create this patch, change the
+    # Update prisma to match the version in nixpkgs exactly (currently 6.3.0). To create this patch, change the
    # versions in `package.json`, then run `nix run nixpkgs#yarn-berry -- install --mode update-lockfile`
    # to update `yarn.lock`.
    ./prisma6.patch
@@ -70,7 +70,7 @@ stdenv.mkDerivation (finalAttrs: {
      yarn install --immutable --mode skip-build
    '';

-    outputHash = "sha256-kWE6YVhyH5Lk/SO0h624Zq9/6ztoUE3FNzHB0dyl5aI=";
+    outputHash = "sha256-c7U/PMlulbjzWx0w4jstgfjeDYPkmfcXIRCDEQxhirA=";
    outputHashMode = "recursive";
  };

@@ -175,7 +175,7 @@ stdenv.mkDerivation rec {

  postInstall = lib.optionalString useP11kit ''
    # Replace built-in trust with p11-kit connection
-    ln -sf ${p11-kit}/lib/pkcs11/p11-kit-trust.so $out/lib/libnssckbi.so
+    ln -sf ${p11-kit}/lib/pkcs11/p11-kit-trust${stdenv.hostPlatform.extensions.sharedLibrary} $out/lib/libnssckbi${stdenv.hostPlatform.extensions.sharedLibrary}
  '';

  postFixup =
@@ -13,9 +13,13 @@
  enableCuda ? config.cudaSupport,
  cudaPackages,
  openmp ? null,
-}:
+}@inputs:

-stdenv.mkDerivation rec {
+let
+  stdenv = throw "Use effectiveStdenv instead";
+  effectiveStdenv = if enableCuda then cudaPackages.backendStdenv else inputs.stdenv;
+in
+effectiveStdenv.mkDerivation rec {
  pname = "suitesparse";
  version = "5.13.0";

@@ -35,7 +39,7 @@ stdenv.mkDerivation rec {
  nativeBuildInputs =
    [
    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    ++ lib.optionals effectiveStdenv.hostPlatform.isDarwin [
      fixDarwinDylibNames
    ]
    ++ lib.optionals enableCuda [
@@ -53,7 +57,7 @@ stdenv.mkDerivation rec {
      gmp
      mpfr
    ]
-    ++ lib.optionals stdenv.cc.isClang [
+    ++ lib.optionals effectiveStdenv.cc.isClang [
      openmp
    ]
    ++ lib.optionals enableCuda [
@@ -82,14 +86,14 @@ stdenv.mkDerivation rec {
      "CUDART_LIB=${lib.getLib cudaPackages.cuda_cudart}/lib/libcudart.so"
      "CUBLAS_LIB=${lib.getLib cudaPackages.libcublas}/lib/libcublas.so"
    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    ++ lib.optionals effectiveStdenv.hostPlatform.isDarwin [
      # Unless these are set, the build will attempt to use `Accelerate` on darwin, see:
      # https://github.com/DrTimothyAldenDavis/SuiteSparse/blob/v5.13.0/SuiteSparse_config/SuiteSparse_config.mk#L368
      "BLAS=-lblas"
      "LAPACK=-llapack"
    ];

-  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
+  env = lib.optionalAttrs effectiveStdenv.hostPlatform.isDarwin {
    # Ensure that there is enough space for the `fixDarwinDylibNames` hook to
    # update the install names of the output dylibs.
    NIX_LDFLAGS = "-headerpad_max_install_names";
@@ -12,14 +12,14 @@

 buildPythonPackage rec {
  pname = "awscrt";
-  version = "0.23.6";
+  version = "0.23.9";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-FMT4E0TseXccmqk4AFlClu5+qknbD7n9FatmKiH634o=";
+    hash = "sha256-eknHs2t4Yl76gcAvRSVWjobTxI9gavCAhd6oYpdF9jQ=";
  };

  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
@@ -4,28 +4,42 @@
  buildPythonPackage,
  pythonOlder,
  pytestCheckHook,
+
+  # dependencies
  beancount-black,
  beancount-parser,
  beanhub-forms,
  beanhub-import,
  click,
  fastapi,
-  httpx,
  jinja2,
  poetry-core,
-  pydantic,
-  pydantic-core,
  pydantic-settings,
-  pytz,
+  pydantic,
  pyyaml,
  rich,
  starlette-wtf,
  uvicorn,
+
+  # optional-dependencies
+  attrs,
+  cryptography,
+  httpx,
+  pynacl,
+  python-dateutil,
+  tomli-w,
+  tomli,
+
+  # tests
+  pytest,
+  pytest-asyncio,
+  pytest-httpx,
+  pytest-mock,
 }:

 buildPythonPackage rec {
  pname = "beanhub-cli";
-  version = "2.1.0";
+  version = "2.1.1";
  pyproject = true;

  disabled = pythonOlder "3.10";
@@ -34,7 +48,7 @@ buildPythonPackage rec {
    owner = "LaunchPlatform";
    repo = "beanhub-cli";
    tag = version;
-    hash = "sha256-PRhodc0Pjcgx2xjYlBI47JsQ0oLX6hrVLyE58LHoxSw=";
+    hash = "sha256-mGLg6Kgur2LAcujFzO/rkSPAC2t3wR5CO2AeOO0+bFI=";
  };

  build-system = [ poetry-core ];
@@ -48,19 +62,38 @@ buildPythonPackage rec {
    fastapi
    jinja2
    pydantic
-    pydantic-core
    pydantic-settings
-    pytz
    pyyaml
    rich
    starlette-wtf
    uvicorn
-  ];
+  ] ++ lib.flatten (lib.attrValues optional-dependencies);
+
+  optional-dependencies = rec {
+    login = [
+      attrs
+      httpx
+      python-dateutil
+      tomli
+      tomli-w
+    ];
+    connect = [
+      attrs
+      cryptography
+      httpx
+      pynacl
+      python-dateutil
+      tomli
+      tomli-w
+    ];
+  };

  nativeCheckInputs = [
+    pytest-asyncio
+    pytest-httpx
+    pytest-mock
    pytestCheckHook
-    httpx
-  ];
+  ] ++ lib.flatten (lib.attrValues optional-dependencies);

  pythonImportsCheck = [ "beanhub_cli" ];

@@ -12,7 +12,7 @@

 buildPythonPackage rec {
  pname = "beanhub-extract";
-  version = "0.1.3";
+  version = "0.1.5";
  pyproject = true;

  disabled = pythonOlder "3.9";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
    owner = "LaunchPlatform";
    repo = "beanhub-extract";
    tag = version;
-    hash = "sha256-Uw9bSVOpiIALkgA77OrqAcDWcEafVSnp4iILa4Jkykc=";
+    hash = "sha256-L3TM3scBJGlOXXxeJAkiqMkpBmhJZB6b+IQT2DGIfO0=";
  };

  build-system = [ poetry-core ];
@@ -0,0 +1,38 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  astor,
+  dill,
+  filelock,
+}:
+
+buildPythonPackage rec {
+  pname = "depyf";
+  version = "0.18.0";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-uZ8MODvpSa5F1dYG/kRMcfN1tVpXuNayDnhWZw1SEw0=";
+  };
+
+  # don't try to read git commit
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace-fail 'commit_id = get_git_commit_id()' 'commit_id = None'
+  '';
+
+  propagatedBuildInputs = [
+    astor
+    dill
+    filelock
+  ];
+
+  pythonImportCheck = [ "depyf" ];
+
+  meta = with lib; {
+    description = "Decompile python functions, from bytecode to source code";
+    homepage = "https://github.com/thuml/depyf";
+    license = licenses.mit;
+  };
+}
@@ -61,14 +61,14 @@ let
 in
 buildPythonPackage rec {
  pname = "gftools";
-  version = "0.9.76";
+  version = "0.9.77";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "googlefonts";
    repo = "gftools";
    tag = "v${version}";
-    hash = "sha256-UQcQiPStkXKYAy6yK7K8sjkQiABVuqcGllOYyxUjxfA=";
+    hash = "sha256-j3UeycBq04jy6uKd7HY+wLlmYAbjYbot630qRy/vG60=";
  };

  postPatch = ''
@@ -0,0 +1,34 @@
+{
+  buildPythonPackage,
+  fetchFromGitHub,
+  lib,
+  setuptools,
+}:
+
+buildPythonPackage rec {
+  pname = "lightify";
+  version = "1.0.7.3";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "tfriedel";
+    repo = "python-lightify";
+    tag = "v${version}";
+    hash = "sha256-zgDB1Tq4RYIeABZCjCcoB8NGt+ZhQFnFu655OghgpH0=";
+  };
+
+  build-system = [ setuptools ];
+
+  pythonImportsCheck = [ "lightify" ];
+
+  # tests access the network
+  doCheck = false;
+
+  meta = {
+    changelog = "https://github.com/tfriedel/python-lightify/releases/tag/${src.tag}";
+    description = "Library to work with OSRAM Lightify";
+    homepage = "https://github.com/tfriedel/python-lightify";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ dotlambda ];
+  };
+}
@@ -22,7 +22,7 @@
 let
  llm = buildPythonPackage rec {
    pname = "llm";
-    version = "0.20";
+    version = "0.21";
    pyproject = true;

    build-system = [ setuptools ];
@@ -33,7 +33,7 @@ let
      owner = "simonw";
      repo = "llm";
      tag = version;
-      hash = "sha256-nNwhsdix65i19f7JHvSLydDufP7nAUjV1YYQspsHT8s=";
+      hash = "sha256-gxmhdczgbcvbWJQTy+gek499C/3jm9WL5vKZmaGVWgU=";
    };

    patches = [ ./001-disable-install-uninstall-commands.patch ];
@@ -35,7 +35,7 @@
 }:
 buildPythonPackage rec {
  pname = "manim-slides";
-  version = "5.4.0";
+  version = "5.4.2";
  pyproject = true;

  disabled = pythonOlder "3.9";
@@ -44,7 +44,7 @@ buildPythonPackage rec {
    owner = "jeertmans";
    repo = "manim-slides";
    tag = "v${version}";
-    hash = "sha256-9BPBjTepb1CdCEk1j471NhndLG5Ai1P81VUV6msQPus=";
+    hash = "sha256-LUnHv6Yr4le7B0OjA9m8s7tCd2OvUsjX0YR+5dv+Bjg=";
  };

  build-system = [
@@ -2,39 +2,59 @@
  lib,
  buildPythonPackage,
  fetchFromGitHub,
-  appdirs,
  argcomplete,
  colorama,
  halo,
+  platformdirs,
  spinners,
  types-colorama,
-  nose2,
+  typing-extensions,
+  setuptools,
+  pytestCheckHook,
  semver,
 }:

 buildPythonPackage rec {
  pname = "milc";
-  version = "1.8.0";
-  format = "setuptools";
+  version = "1.9.1";
+  pyproject = true;

  src = fetchFromGitHub {
    owner = "clueboard";
    repo = "milc";
-    rev = version;
-    hash = "sha256-DUA79R/pf/arG4diJKaJTSLNdB4E0XnS4NULlqP4h/M=";
+    tag = version;
+    hash = "sha256-byj2mcDxLl7rZEFjAt/g1kHllnVxiTIQaTMG24GeSVc=";
  };

-  propagatedBuildInputs = [
-    appdirs
+  postPatch = ''
+    # Needed for tests
+    patchShebangs --build \
+      example \
+      custom_logger \
+      questions \
+      sparkline \
+      hello \
+      passwd_confirm \
+      passwd_complexity \
+      config_source
+  '';
+
+  dependencies = [
    argcomplete
    colorama
    halo
+    platformdirs
    spinners
    types-colorama
+    typing-extensions
+  ];
+
+  build-system = [
+    setuptools
  ];

  nativeCheckInputs = [
-    nose2
+    pytestCheckHook
    semver
  ];

@@ -17,7 +17,7 @@

 buildPythonPackage rec {
  pname = "msgraph-sdk";
-  version = "1.17.0";
+  version = "1.18.0";
  pyproject = true;

  disabled = pythonOlder "3.8";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
    owner = "microsoftgraph";
    repo = "msgraph-sdk-python";
    tag = "v${version}";
-    hash = "sha256-R6HCZBdpHR58d4leS77MIqLX6LOGFppTcFbidrJSrI8=";
+    hash = "sha256-qYlBRXYsZ71B33iwdwgjx/NFBRUF4I/0XCnNZePo/+M=";
  };

  build-system = [ flit-core ];
@@ -0,0 +1,55 @@
+{
+  aiohttp,
+  aioresponses,
+  buildPythonPackage,
+  fetchFromGitHub,
+  lib,
+  mashumaro,
+  orjson,
+  poetry-core,
+  pytest-asyncio,
+  pytest-cov-stub,
+  pytestCheckHook,
+  syrupy,
+  yarl,
+}:
+
+buildPythonPackage rec {
+  pname = "nyt-games";
+  version = "0.4.4";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "joostlek";
+    repo = "python-nyt-games";
+    tag = "v${version}";
+    hash = "sha256-eMJ96E4sGmekr6mOR30UIZBclH/0xc8AWv3zL1ItKjo=";
+  };
+
+  build-system = [ poetry-core ];
+
+  dependencies = [
+    aiohttp
+    mashumaro
+    orjson
+    yarl
+  ];
+
+  pythonImportsCheck = [ "nyt_games" ];
+
+  nativeCheckInputs = [
+    aioresponses
+    pytest-asyncio
+    pytest-cov-stub
+    pytestCheckHook
+    syrupy
+  ];
+
+  meta = {
+    changelog = "https://github.com/joostlek/python-nyt-games/releases/tag/${src.tag}";
+    description = "Asynchronous Python client for NYT games";
+    homepage = "https://github.com/joostlek/python-nyt-games";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ dotlambda ];
+  };
+}
@@ -0,0 +1,41 @@
+{
+  aiohttp,
+  beautifulsoup4,
+  buildPythonPackage,
+  fetchFromGitHub,
+  lib,
+  setuptools,
+}:
+
+buildPythonPackage rec {
+  pname = "ourgroceries";
+  version = "1.5.4";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "ljmerza";
+    repo = "py-our-groceries";
+    tag = version;
+    hash = "sha256-tlgctQvbR2YzM6Q1A/P1i40LSt4/2hsetlDeO07RBPE=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    aiohttp
+    beautifulsoup4
+  ];
+
+  pythonImportsCheck = [ "ourgroceries" ];
+
+  # tests require credentials
+  doCheck = false;
+
+  meta = {
+    changelog = "https://github.com/ljmerza/py-our-groceries/releases/tag/${src.tag}";
+    description = "Unofficial Python Wrapper for Our Groceries";
+    homepage = "https://github.com/ljmerza/py-our-groceries";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ dotlambda ];
+  };
+}
@@ -11,14 +11,14 @@

 buildPythonPackage rec {
  pname = "publicsuffixlist";
-  version = "1.0.2.20250127";
+  version = "1.0.2.20250202";
  pyproject = true;

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-a2G64r752rlLiUjJQsdLut2CqaLZZB4A5HJlAp6gi5g=";
+    hash = "sha256-zYOlYyR/tJvY9EouLHyVjaK8ELwRBf8cowhsfd6pilI=";
  };

  build-system = [ setuptools ];
@@ -11,7 +11,7 @@

 buildPythonPackage rec {
  pname = "pynrrd";
-  version = "1.1.1";
+  version = "1.1.3";
  pyproject = true;

  disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
    owner = "mhe";
    repo = pname;
    tag = "v${version}";
-    hash = "sha256-B/G46/9Xf1LRu02p0X4/UeW1RYotSXKXRO9VZDPhkNU=";
+    hash = "sha256-qu3s3XswJCUchqYfYMuqIzI4sfeXrttvXSEW9/GSENA=";
  };

  build-system = [ setuptools ];
@@ -0,0 +1,56 @@
+{
+  aiohttp,
+  buildPythonPackage,
+  fetchFromGitHub,
+  lib,
+  mashumaro,
+  poetry-core,
+  pytest-asyncio,
+  pytestCheckHook,
+}:
+
+buildPythonPackage rec {
+  pname = "pyrail";
+  version = "0.4.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "tjorim";
+    repo = "pyrail";
+    tag = "v${version}";
+    hash = "sha256-6CE8FrBCVcO88kGwqAMBx9dp5b27oeCm/w1PrEf6a0E=";
+  };
+
+  build-system = [ poetry-core ];
+
+  dependencies = [
+    aiohttp
+    mashumaro
+  ] ++ mashumaro.optional-dependencies.orjson;
+
+  pythonImportsCheck = [ "pyrail" ];
+
+  nativeCheckInputs = [
+    pytest-asyncio
+    pytestCheckHook
+  ];
+
+  disabledTests = [
+    # tests connect to the internet
+    "test_get_composition"
+    "test_get_connections"
+    "test_get_disturbances"
+    "test_get_liveboard"
+    "test_get_stations"
+    "test_get_vehicle"
+    "test_liveboard_with_date_time"
+  ];
+
+  meta = {
+    changelog = "https://github.com/tjorim/pyrail/releases/tag/${src.tag}";
+    description = "Async Python wrapper for the iRail API";
+    homepage = "https://github.com/tjorim/pyrail";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ dotlambda ];
+  };
+}
@@ -13,7 +13,7 @@

 buildPythonPackage rec {
  pname = "python-gitlab";
-  version = "5.3.1";
+  version = "5.6.0";
  pyproject = true;

  disabled = pythonOlder "3.8";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    pname = "python_gitlab";
    inherit version;
-    hash = "sha256-yqvLUAIQ9PWe+fj+7E+Z6CHWUqVccuyfW/gg9F/Bcpg=";
+    hash = "sha256-vFMei6PlZBtgQJRF1JGazmiiwYyw7G1I+87WYWuVQWY=";
  };

  build-system = [ setuptools ];
@@ -23,7 +23,6 @@
  libxml2,
  sqlite,
  pytestCheckHook,
-  darwin,
  sparsehash,
 }:

@@ -115,6 +114,7 @@ buildPythonPackage rec {
      "test_passing_pycairo_context_pdf"
      "test_pdf_printing"
      "test_render_with_scale_factor"
+      "test_raster_warping"
    ]
    ++ lib.optionals stdenv.hostPlatform.isDarwin [
      "test_passing_pycairo_context_png"
@@ -129,11 +129,10 @@ buildPythonPackage rec {

  pythonImportsCheck = [ "mapnik" ];

-  meta = with lib; {
+  meta = {
    description = "Python bindings for Mapnik";
-    maintainers = [ ];
    homepage = "https://mapnik.org";
-    license = licenses.lgpl21Plus;
-    broken = true; # At 2024-11-13, test_raster_warping fails.
+    license = lib.licenses.lgpl21Plus;
+    maintainers = lib.teams.geospatial.members;
  };
 }
@@ -19,7 +19,7 @@

 buildPythonPackage rec {
  pname = "sqlfmt";
-  version = "0.24.0";
+  version = "0.26.0";
  pyproject = true;

  disabled = pythonOlder "3.9";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
    owner = "tconbeer";
    repo = "sqlfmt";
    tag = "v${version}";
-    hash = "sha256-8TPuFxcZ6ENiPyzSDJPneqvOkPkuFlTYHvbuM842j30=";
+    hash = "sha256-q0pkwuQY0iLzK+Lef6k62UxMKJy592RsJnSZnVYdMa8=";
  };

  pythonRelaxDeps = [ "platformdirs" ];
@@ -10,14 +10,14 @@

 buildPythonPackage rec {
  pname = "stripe";
-  version = "11.4.1";
+  version = "11.5.0";
  pyproject = true;

  disabled = pythonOlder "3.8";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-fd0lG2ItSQ/lfXhIeFXcn02VsbsRNgfoH9N3A3oTPVo=";
+    hash = "sha256-vD4DWP/CPV7PqKr+wfpPBI7oEHwyN7ywAAPmjIyW+gI=";
  };

  build-system = [ setuptools ];
@@ -13,9 +13,8 @@ buildPythonPackage {
  src = py;
  format = "other";

-  disabled = isPyPy;
-
-  installPhase =
+  # tkinter is included in PyPy, making this package a no-op.
+  installPhase = lib.optionalString (!isPyPy) (
    ''
      # Move the tkinter module
      mkdir -p $out/${py.sitePackages}
@@ -26,7 +25,8 @@ buildPythonPackage {
      old_rpath=$(patchelf --print-rpath $out/${py.sitePackages}/_tkinter*)
      new_rpath=$(sed "s#${py}#${python}#g" <<< "$old_rpath" )
      patchelf --set-rpath $new_rpath $out/${py.sitePackages}/_tkinter*
-    '';
+    ''
+  );

  meta = py.meta // {
    # Based on first sentence from https://docs.python.org/3/library/tkinter.html
@@ -10,14 +10,14 @@

 buildPythonPackage rec {
  pname = "yoto-api";
-  version = "1.24.4";
+  version = "1.24.5";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "cdnninja";
    repo = "yoto_api";
    tag = "v${version}";
-    hash = "sha256-CZz1zfNoxrySo0cUobk0Sjzk4QjuZxpUczK+FhMKXMU=";
+    hash = "sha256-zgyZpya67cmJb2tz7Ht8G4y78UejVF00kssasZ8F+58=";
  };

  build-system = [ setuptools ];
@@ -16,8 +16,8 @@ let
      hash = "sha256-hHIWjD4f0L/yh+aUsFP8y78gV5o/+VJrYzO+q432Wo0=";
    };
    "10" = {
-      version = "10.1.0";
-      hash = "sha256-PuU+kUAR7H8abjqwxYuaAkoFK/4YKVsjtoVn1qal680=";
+      version = "10.2.0";
+      hash = "sha256-cvFjCBIQfIcj61vkUXcl8+E/Cc/Y9xVxzynyPOMYvbc=";
    };
  };

@@ -3823,7 +3823,8 @@
      ];
    "nmbs" =
      ps: with ps; [
-      ]; # missing inputs: pyrail
+        pyrail
+      ];
    "no_ip" =
      ps: with ps; [
      ];
@@ -3894,7 +3895,8 @@
      ];
    "nyt_games" =
      ps: with ps; [
-      ]; # missing inputs: nyt_games
+        nyt-games
+      ];
    "nzbget" =
      ps: with ps; [
      ]; # missing inputs: pynzbgetapi
@@ -4082,7 +4084,8 @@
      ]; # missing inputs: pyosoenergyapi
    "osramlightify" =
      ps: with ps; [
-      ]; # missing inputs: lightify
+        lightify
+      ];
    "otbr" =
      ps: with ps; [
        aiohasupervisor
@@ -4103,7 +4106,8 @@
      ];
    "ourgroceries" =
      ps: with ps; [
-      ]; # missing inputs: ourgroceries
+        ourgroceries
+      ];
    "overkiz" =
      ps: with ps; [
        pyoverkiz
@@ -7037,6 +7041,7 @@
    "nut"
    "nws"
    "nx584"
+    "nyt_games"
    "obihai"
    "octoprint"
    "ohme"
@@ -7065,6 +7070,7 @@
    "oralb"
    "otbr"
    "otp"
+    "ourgroceries"
    "overkiz"
    "ovo_energy"
    "owntracks"
@@ -8,13 +8,13 @@
 buildHomeAssistantComponent rec {
  owner = "cdnninja";
  domain = "yoto";
-  version = "1.22.4";
+  version = "1.22.6";

  src = fetchFromGitHub {
    owner = "cdnninja";
    repo = "yoto_ha";
    tag = "v${version}";
-    hash = "sha256-4OKiXwluatm/WRO77tK/VE+fnRn7Cvvh4et3SjANJWE=";
+    hash = "sha256-6igIcDGPYUOz5dWZr9TKFmoYoUCsZOpfpESTxYRR67w=";
  };

  dependencies = [
@@ -19,6 +19,7 @@
  nasm,
  pkg-config,
  which,
+  openssl,

  # Tests
  nixosTests,
@@ -259,6 +260,9 @@ let
          propagatedBuildInputs = old.propagatedBuildInputs or [ ] ++ [
            self.flaky
          ];
+          # hack: avoid building docs due to incompatibility with current sphinx
+          nativeBuildInputs = [ openssl ]; # old.nativeBuildInputs but without sphinx*
+          outputs = lib.filter (o: o != "doc") old.outputs;
        });

        # This is the most recent version of `trustme` that's still compatible with `cryptography` 40.
@@ -9,17 +9,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "shadowenv";
-  version = "3.0.1";
+  version = "3.0.3";

  src = fetchFromGitHub {
    owner = "Shopify";
    repo = pname;
    rev = version;
-    hash = "sha256-9K04g2DCADkRwjo55rDwVwkvmypqujdN1fqOmHmC09E=";
+    hash = "sha256-ZipFcwTpKKFnQWOPxXg07V71jitG0NSLpGLEzUSsUFA=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-IHg36zgBF7o/O9kL6t54fV6dBJDZLYausM1u8pLR+Mk=";
+  cargoHash = "sha256-KNCucBmYVmIQ/XY+UNV667iWLyiEJDnP/8gAmUHGY+0=";

  nativeBuildInputs = [ installShellFiles ];

@@ -1,27 +1,32 @@
-{ lib, stdenv, fetchFromGitHub, rustPlatform, pkg-config, openssl, Security, CoreServices }:
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  rustPlatform,
+  pkg-config,
+  openssl,
+}:

 rustPlatform.buildRustPackage rec {
  pname = "shadowsocks-rust";
-  version = "1.21.2";
+  version = "1.22.0";

  src = fetchFromGitHub {
-    rev = "v${version}";
    owner = "shadowsocks";
-    repo = pname;
-    hash = "sha256-bvYp25EPKtkuZzplVYK4Cwd0mm4UuyN1LMiDAkgMIAc=";
+    repo = "shadowsocks-rust";
+    tag = "v${version}";
+    hash = "sha256-rufOrNwUp8h0LoBKPyDV63WAYTLJbctWrq5Ghj6ODB4=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-TwUIyUEBe+qMKxfPxEGXcNYJmJSNfdcrOBnUbb0N6cs=";
+  cargoHash = "sha256-hdHCpER4qs8W6rMmwys2KhaGDiTWcnntAL3ZeTBgt84=";

  nativeBuildInputs = lib.optionals stdenv.hostPlatform.isLinux [ pkg-config ];

-  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [ openssl ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [ Security CoreServices ];
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [ openssl ];

  buildFeatures = [
    "trust-dns"
-    "local-http-native-tls"
    "local-tunnel"
    "local-socks4"
    "local-redir"
@@ -48,11 +53,11 @@ rustPlatform.buildRustPackage rec {
  # timeouts in sandbox
  doCheck = false;

-  meta = with lib; {
+  meta = {
    description = "Rust port of Shadowsocks";
    homepage = "https://github.com/shadowsocks/shadowsocks-rust";
    changelog = "https://github.com/shadowsocks/shadowsocks-rust/raw/v${version}/debian/changelog";
-    license = licenses.mit;
+    license = lib.licenses.mit;
    maintainers = [ ];
  };
 }
@@ -4971,9 +4971,7 @@ with pkgs;

  seqdiag = with python3Packages; toPythonApplication seqdiag;

-  shadowsocks-rust = callPackage ../tools/networking/shadowsocks-rust {
-    inherit (darwin.apple_sdk.frameworks) Security CoreServices;
-  };
+  shadowsocks-rust = callPackage ../tools/networking/shadowsocks-rust { };

  shellify = haskellPackages.shellify.bin;

@@ -3220,6 +3220,8 @@ self: super: with self; {

  deprecation-alias = callPackage ../development/python-modules/deprecation-alias { };

+  depyf = callPackage ../development/python-modules/depyf { };
+
  derpconf = callPackage ../development/python-modules/derpconf { };

  desktop-entry-lib = callPackage ../development/python-modules/desktop-entry-lib { };
@@ -7515,6 +7517,8 @@ self: super: with self; {

  lightgbm = callPackage ../development/python-modules/lightgbm { };

+  lightify = callPackage ../development/python-modules/lightify { };
+
  lightning-utilities  = callPackage ../development/python-modules/lightning-utilities { };

  lightparam = callPackage ../development/python-modules/lightparam { };
@@ -9517,6 +9521,8 @@ self: super: with self; {

  nxt-python = callPackage ../development/python-modules/nxt-python { };

+  nyt-games = callPackage ../development/python-modules/nyt-games { };
+
  plugp100 = callPackage ../development/python-modules/plugp100 {};

  python-bugzilla = callPackage ../development/python-modules/python-bugzilla { };
@@ -9980,6 +9986,8 @@ self: super: with self; {

  ots-python = callPackage ../development/python-modules/ots-python { };

+  ourgroceries = callPackage ../development/python-modules/ourgroceries { };
+
  outcome = callPackage ../development/python-modules/outcome { };

  outdated = callPackage ../development/python-modules/outdated { };
@@ -10757,6 +10765,8 @@ self: super: with self; {

  pypoolstation = callPackage ../development/python-modules/pypoolstation { };

+  pyrail = callPackage ../development/python-modules/pyrail { };
+
  pyrdfa3 = callPackage ../development/python-modules/pyrdfa3 { };

  pyre-extensions = callPackage ../development/python-modules/pyre-extensions { };