Merge master into staging-nixos

2025-10-21 18:07:48 +00:00
parent 3c7a7f5405 cce16dbcfb
commit ca78b8cbe7
104 changed files with 1527 additions and 1028 deletions
@@ -2331,7 +2331,7 @@
    email = "assistant.moetron@gmail.com";
    github = "Assistant";
    githubId = 2748721;
-    matrix = "@assistant:pygmalion.chat";
+    matrix = "@self:assistant.moe";
    name = "Assistant Moetron";
  };
  astavie = {
@@ -993,7 +993,10 @@ with lib.maintainers;
  };

  ocaml = {
-    members = [ alizter ];
+    members = [
+      alizter
+      redianthus
+    ];
    github = "ocaml";
    scope = "Maintain the OCaml compiler and package set.";
    shortName = "OCaml";
@@ -435,3 +435,5 @@
 - The `open-webui` package's postgres support have been moved to optional dependencies to comply with upstream changes in 0.6.26.

 - `prl-tools` has been moved out of `linuxPackages` because Parallels Guest Tools become driverless since 26.1.0.
+
+- `services.opentelemetry-collector` has a new option `validateConfigFile` option that checks the configuration file during build. It is enabled by default if the configuration file is in the Nix store.
@@ -187,9 +187,7 @@
            };

            package = lib.mkPackageOption pkgs "github-runner" { } // {
-              apply =
-                # Support old github-runner versions which don't have the `nodeRuntimes` arg yet.
-                pkg: pkg.override (old: lib.optionalAttrs (old ? nodeRuntimes) { inherit (config) nodeRuntimes; });
+              apply = pkg: pkg.override { inherit (config) nodeRuntimes; };
            };

            ephemeral = lib.mkOption {
@@ -13,12 +13,27 @@ let
    mkOption
    types
    getExe
+    isStorePath
+    literalMD
    ;

  cfg = config.services.opentelemetry-collector;
  opentelemetry-collector = cfg.package;

  settingsFormat = pkgs.formats.yaml { };
+  generatedConf =
+    if cfg.configFile == null then
+      settingsFormat.generate "config.yaml" cfg.settings
+    else
+      cfg.configFile;
+  conf =
+    if cfg.validateConfigFile then
+      pkgs.runCommandLocal "config.yaml" { inherit generatedConf; } ''
+        cp $generatedConf $out
+        ${getExe opentelemetry-collector} validate --config=file:$out
+      ''
+    else
+      generatedConf;
 in
 {
  options.services.opentelemetry-collector = {
@@ -43,6 +58,11 @@ in
        Specify a path to a configuration file that Opentelemetry Collector should use.
      '';
    };
+
+    validateConfigFile = lib.mkEnableOption "Validate configuration file" // {
+      defaultText = literalMD "`true` if `configFile` is a store path";
+      default = isStorePath cfg.configFile;
+    };
  };

  config = mkIf cfg.enable {
@@ -61,28 +81,20 @@ in
      description = "Opentelemetry Collector Service Daemon";
      wantedBy = [ "multi-user.target" ];

-      serviceConfig =
-        let
-          conf =
-            if cfg.configFile == null then
-              settingsFormat.generate "config.yaml" cfg.settings
-            else
-              cfg.configFile;
-        in
-        {
-          ExecStart = "${getExe opentelemetry-collector} --config=file:${conf}";
-          DynamicUser = true;
-          Restart = "always";
-          ProtectSystem = "full";
-          DevicePolicy = "closed";
-          NoNewPrivileges = true;
-          WorkingDirectory = "%S/opentelemetry-collector";
-          StateDirectory = "opentelemetry-collector";
-          SupplementaryGroups = [
-            # allow to read the systemd journal for opentelemetry-collector
-            "systemd-journal"
-          ];
-        };
+      serviceConfig = {
+        ExecStart = "${getExe opentelemetry-collector} --config=file:${conf}";
+        DynamicUser = true;
+        Restart = "always";
+        ProtectSystem = "full";
+        DevicePolicy = "closed";
+        NoNewPrivileges = true;
+        WorkingDirectory = "%S/opentelemetry-collector";
+        StateDirectory = "opentelemetry-collector";
+        SupplementaryGroups = [
+          # allow to read the systemd journal for opentelemetry-collector
+          "systemd-journal"
+        ];
+      };
    };
  };
 }
@@ -390,7 +390,7 @@ in

        serviceConfig = rec {
          WorkingDirectory = cfg.dir;
-          ExecReload = "kill -HUP $MAINPID";
+          ExecReload = "${lib.getExe' pkgs.coreutils "kill"} -HUP $MAINPID";
          Restart = "always";
          User = cfg.user;
          StandardOutput = mkIf (cfg.logFile != null) "append:${cfg.logFile}";
@@ -117,6 +117,7 @@ let
            override = cfg.overrideFolders;
            conf = folders;
            baseAddress = curlAddressArgs "/rest/config/folders";
+            ignoreAddress = curlAddressArgs "/rest/db/ignores";
          };
        }
        [
@@ -142,7 +143,8 @@ let
                let
                  jsonPreSecretsFile = pkgs.writeTextFile {
                    name = "${conf_type}-${new_cfg.id}-conf-pre-secrets.json";
-                    text = builtins.toJSON new_cfg;
+                    # Remove the ignorePatterns attribute, it is handled separately
+                    text = builtins.toJSON (builtins.removeAttrs new_cfg [ "ignorePatterns" ]);
                  };
                  injectSecretsJqCmd =
                    {
@@ -209,6 +211,13 @@ let
                ''
                  ${injectSecretsJqCmd} ${jsonPreSecretsFile} | curl --json @- -X POST ${s.baseAddress}
                ''
+                /*
+                  Check if we are configuring a folder which has ignore patterns.
+                  If it does, write the ignore patterns to the rest API.
+                */
+                + lib.optionalString ((conf_type == "dirs") && (new_cfg.ignorePatterns != null)) ''
+                  curl -d '{"ignore": ${builtins.toJSON new_cfg.ignorePatterns}}' -X POST ${s.ignoreAddress}?folder=${new_cfg.id}
+                ''
              ))
              (lib.concatStringsSep "\n")
            ]
@@ -649,6 +658,26 @@ in
                          Requires running Syncthing as a privileged user, or granting it additional capabilities (e.g. CAP_CHOWN on Linux).
                        '';
                      };
+
+                      ignorePatterns = mkOption {
+                        type = types.nullOr (types.listOf types.str);
+                        default = null;
+                        description = ''
+                          Syncthing can be configured to ignore certain files in a folder using ignore patterns.
+                          Enter them as a list of strings, one string per line.
+                          See the Syncthing documentation for syntax: <https://docs.syncthing.net/users/ignoring.html>
+                          Patterns set using the WebUI will be overridden if you define this option.
+                          If you want to override the ignore patterns to be empty, use `ignorePatterns = []`.
+                          Deleting the `ignorePatterns` option will not remove the patterns from Syncthing automatically
+                          because patterns are only handled by the module if this option is defined. Either use
+                          `ignorePatterns = []` before deleting the option or remove the patterns afterwards using the WebUI.
+                        '';
+                        example = [
+                          "// This is a comment"
+                          "*.part // Firefox downloads and other things"
+                          "*.crdownload // Chrom(ium|e) downloads"
+                        ];
+                      };
                    };
                  }
                )
@@ -7,16 +7,19 @@
 }:
 let
  cfg = config.services.invidious;
-  # To allow injecting secrets with jq, json (instead of yaml) is used
-  settingsFormat = pkgs.formats.json { };
+
  inherit (lib) types;

+  # This need to be JSON to reduce number of
+  # breaking changes, for backwards
+  # compatibility with pre-25.11
+  settingsFormat = pkgs.formats.json { };
  settingsFile = settingsFormat.generate "invidious-settings" cfg.settings;

  generatedHmacKeyFile = "/var/lib/invidious/hmac_key";
  generateHmac = cfg.hmacKeyFile == null;

-  commonInvidousServiceConfig = {
+  commonInvidiousServiceConfig = {
    description = "Invidious (An alternative YouTube front-end)";
    wants = [ "network-online.target" ];
    after = [ "network-online.target" ] ++ lib.optional cfg.database.createLocally "postgresql.target";
@@ -59,9 +62,51 @@ let
      RuntimeRandomizedExtraSec = lib.mkDefault "5min";
    };
  };
+
+  configScript =
+    scaleIndex:
+    ''
+      configParts=()
+    ''
+    # autogenerated hmac_key
+    + lib.optionalString generateHmac ''
+      configParts+=("$(${pkgs.jq}/bin/jq -R '{"hmac_key":.}' <"${generatedHmacKeyFile}")")
+    ''
+    # generated settings file
+    + ''
+      configParts+=("$(< ${settingsFile})")
+    ''
+    # optional database password file
+    + lib.optionalString (cfg.database.host != null) ''
+      configParts+=("$(${pkgs.jq}/bin/jq -R '{"db":{"password":.}}' ${cfg.database.passwordFile})")
+    ''
+    # optional extra settings file
+    + lib.optionalString (cfg.extraSettingsFile != null) ''
+      configParts+=("$(< ${lib.escapeShellArg cfg.extraSettingsFile})")
+    ''
+    # explicitly specified hmac key file
+    + lib.optionalString (cfg.hmacKeyFile != null) ''
+      configParts+=("$(< ${lib.escapeShellArg cfg.hmacKeyFile})")
+    ''
+    # configure threads for secondary instances
+    + lib.optionalString (scaleIndex > 0) ''
+      configParts+=('{"channel_threads":0, "feed_threads":0}')
+    ''
+    # configure different ports for the instances
+    + ''
+      configParts+=('{"port":${toString (cfg.port + scaleIndex)}}')
+    ''
+    # merge all parts into a single configuration with later elements overriding previous elements
+    + ''
+      mergedConfig="$(${pkgs.jq}/bin/jq -s 'reduce .[] as $item ({}; . * $item)' <<<"''${configParts[*]}")"
+      export INVIDIOUS_CONFIG=$(echo "$mergedConfig" | ${pkgs.yq-go}/bin/yq -P)
+
+      exec ${cfg.package}/bin/invidious
+    '';
+
  mkInvidiousService =
    scaleIndex:
-    lib.foldl' lib.recursiveUpdate commonInvidousServiceConfig [
+    lib.foldl' lib.recursiveUpdate commonInvidiousServiceConfig [
      # only generate the hmac file in the first service
      (lib.optionalAttrs (scaleIndex == 0) {
        preStart = lib.optionalString generateHmac ''
@@ -73,47 +118,10 @@ let
      })
      # configure the secondary services to run after the first service
      (lib.optionalAttrs (scaleIndex > 0) {
-        after = commonInvidousServiceConfig.after ++ [ "invidious.service" ];
-        wants = commonInvidousServiceConfig.wants ++ [ "invidious.service" ];
+        after = commonInvidiousServiceConfig.after ++ [ "invidious.service" ];
+        wants = commonInvidiousServiceConfig.wants ++ [ "invidious.service" ];
      })
-      {
-        script = ''
-          configParts=()
-        ''
-        # autogenerated hmac_key
-        + lib.optionalString generateHmac ''
-          configParts+=("$(${pkgs.jq}/bin/jq -R '{"hmac_key":.}' <"${generatedHmacKeyFile}")")
-        ''
-        # generated settings file
-        + ''
-          configParts+=("$(< ${lib.escapeShellArg settingsFile})")
-        ''
-        # optional database password file
-        + lib.optionalString (cfg.database.host != null) ''
-          configParts+=("$(${pkgs.jq}/bin/jq -R '{"db":{"password":.}}' ${lib.escapeShellArg cfg.database.passwordFile})")
-        ''
-        # optional extra settings file
-        + lib.optionalString (cfg.extraSettingsFile != null) ''
-          configParts+=("$(< ${lib.escapeShellArg cfg.extraSettingsFile})")
-        ''
-        # explicitly specified hmac key file
-        + lib.optionalString (cfg.hmacKeyFile != null) ''
-          configParts+=("$(< ${lib.escapeShellArg cfg.hmacKeyFile})")
-        ''
-        # configure threads for secondary instances
-        + lib.optionalString (scaleIndex > 0) ''
-          configParts+=('{"channel_threads":0, "feed_threads":0}')
-        ''
-        # configure different ports for the instances
-        + ''
-          configParts+=('{"port":${toString (cfg.port + scaleIndex)}}')
-        ''
-        # merge all parts into a single configuration with later elements overriding previous elements
-        + ''
-          export INVIDIOUS_CONFIG="$(${pkgs.jq}/bin/jq -s 'reduce .[] as $item ({}; . * $item)' <<<"''${configParts[*]}")"
-          exec ${cfg.package}/bin/invidious
-        '';
-      }
+      { script = configScript scaleIndex; }
    ];

  serviceConfig = {
@@ -130,7 +130,7 @@ in
            open_web_calendar.app:app
        '';
        EnvironmentFile = settingsFormat.generate "open-web-calendar.env" cfg.settings;
-        ExecReload = "kill -s HUP $MAINPID";
+        ExecReload = "${lib.getExe' pkgs.coreutils "kill"} -s HUP $MAINPID";
        KillMode = "mixed";
        PrivateTmp = true;
        RuntimeDirectory = "open-web-calendar";
@@ -374,7 +374,7 @@ in
              --bind='unix:///run/weblate.socket' \
              weblate.wsgi
          '';
-        ExecReload = "kill -s HUP $MAINPID";
+        ExecReload = "${lib.getExe' pkgs.coreutils "kill"} -s HUP $MAINPID";
        KillMode = "mixed";
        PrivateTmp = true;
        WorkingDirectory = dataDir;
@@ -166,7 +166,7 @@ in
      serviceConfig = {
        Type = "notify";
        ExecStart = "${cfg.package}/bin/crio";
-        ExecReload = "/bin/kill -s HUP $MAINPID";
+        ExecReload = "${lib.getExe' pkgs.coreutils "kill"} -s HUP $MAINPID";
        TasksMax = "infinity";
        LimitNOFILE = "1048576";
        LimitNPROC = "1048576";
@@ -10,11 +10,13 @@ let
  json = pkgs.formats.json { };

  inherit (lib) mkOption types;
+  inherit (pkgs) stdenv;

  # Provides a fake "docker" binary mapping to podman
  dockerCompat =
    pkgs.runCommand "${cfg.package.pname}-docker-compat-${cfg.package.version}"
      {
+        nativeBuildInputs = [ pkgs.installShellFiles ];
        outputs = [
          "out"
          "man"
@@ -31,7 +33,14 @@ let
          basename=$(basename $f | sed s/podman/docker/g)
          ln -s $f $man/share/man/man1/$basename
        done
-      '';
+      ''
+    + lib.optionalString (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+      export HOME=$(mktemp -d) # work around `docker <cmd>`
+      installShellCompletion --cmd docker \
+        --bash <($out/bin/docker completion bash) \
+        --zsh <($out/bin/docker completion zsh) \
+        --fish <($out/bin/docker completion fish)
+    '';

 in
 {
@@ -1,21 +0,0 @@
-#include <stdio.h>
-#include <stdlib.h>
-#include <mpi.h>
-
-int
-main (int argc, char *argv[])
-{
-  int rank, size, length;
-  char name[BUFSIZ];
-
-  MPI_Init (&argc, &argv);
-  MPI_Comm_rank (MPI_COMM_WORLD, &rank);
-  MPI_Comm_size (MPI_COMM_WORLD, &size);
-  MPI_Get_processor_name (name, &length);
-
-  printf ("%s: hello world from process %d of %d\n", name, rank, size);
-
-  MPI_Finalize ();
-
-  return EXIT_SUCCESS;
-}
@@ -42,6 +42,14 @@ in
                }
              ];
            };
+            folders.baz = {
+              path = "/var/lib/syncthing/baz";
+              devices = [
+                "b"
+                "c"
+              ];
+              ignorePatterns = [ ];
+            };
          };
        };
      };
@@ -70,6 +78,16 @@ in
                }
              ];
            };
+            folders.baz = {
+              path = "/var/lib/syncthing/baz";
+              devices = [
+                "a"
+                "c"
+              ];
+              ignorePatterns = [
+                "notB"
+              ];
+            };
          };
        };
      };
@@ -90,6 +108,16 @@ in
            ];
            type = "receiveencrypted";
          };
+          folders.baz = {
+            path = "/var/lib/syncthing/baz";
+            devices = [
+              "a"
+              "b"
+            ];
+            ignorePatterns = [
+              "notC"
+            ];
+          };
        };
      };
    };
@@ -131,5 +159,29 @@ in

    # Bar on C is untrusted, check that content is not in cleartext
    c.fail("grep -R plaincontent /var/lib/syncthing/bar")
+
+    # Test baz
+
+    a.wait_for_file("/var/lib/syncthing/baz")
+    b.wait_for_file("/var/lib/syncthing/baz")
+    c.wait_for_file("/var/lib/syncthing/baz")
+
+    # A creates the file notB, C should get it, B should ignore it
+    a.succeed("echo notB > /var/lib/syncthing/baz/notB")
+    a.succeed("echo controlA > /var/lib/syncthing/baz/controlA")
+    c.wait_for_file("/var/lib/syncthing/baz/notB")
+    c.wait_for_file("/var/lib/syncthing/baz/controlA")
+    b.wait_for_file("/var/lib/syncthing/baz/controlA")
+
+    # B creates the file notC, A should get it, C should ignore it
+    b.succeed("echo notC > /var/lib/syncthing/baz/notC")
+    b.succeed("echo controlB > /var/lib/syncthing/baz/controlB")
+    a.wait_for_file("/var/lib/syncthing/baz/notC")
+    a.wait_for_file("/var/lib/syncthing/baz/controlB")
+    c.wait_for_file("/var/lib/syncthing/baz/controlB")
+
+    # Check that files have been correctly ignored
+    b.fail("cat /var/lib/syncthing/baz/notB")
+    c.fail("cat /var/lib/syncthing/baz/notC")
  '';
 }
@@ -58,7 +58,7 @@ Because entries in the Nix store are inert and do nothing by themselves, package
  For example:
  * Any package which does not follow upstream security policies should be considered vulnerable.
    In particular, packages that vendor or fork web engines like Blink, Gecko or Webkit need to keep up with the frequent updates of those projects.
-  * Any security-critical fast-moving package such as Chrome or Firefox (or their forks) must have at least one active committer among the maintainers.
+  * Any security-critical fast-moving package such as Chrome or Firefox (or their forks) must have at least one committer among the maintainers, who actively reviews, merges and backports updates.
    This ensures no critical fixes are delayed unnecessarily, endangering unsuspecting users.
  * Services which typically work on web traffic are working on untrusted input.
  * Data (such as archives or rich documents) commonly shared over untrusted channels (e.g. email) is untrusted.
@@ -11,8 +11,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
  mktplcRef = {
    name = "calva";
    publisher = "betterthantomorrow";
-    version = "2.0.536";
-    hash = "sha256-Q6T8Ab8kwOjdFM63SjTNEOgd+a6fL1PRGRredHzwg7U=";
+    version = "2.0.538";
+    hash = "sha256-lJ9AnTNN9TkPDh9u2KV1BLn/fgZOWSOXNOTAdV+r6s4=";
  };

  nativeBuildInputs = [
@@ -13,19 +13,19 @@ let
  vsix = stdenvNoCC.mkDerivation (finalAttrs: {
    name = "gitlens-${finalAttrs.version}.zip";
    pname = "gitlens-vsix";
-    version = "17.6.1";
+    version = "17.6.2";

    src = fetchFromGitHub {
      owner = "gitkraken";
      repo = "vscode-gitlens";
      tag = "v${finalAttrs.version}";
-      hash = "sha256-D0huUzjvyJTLxGgtTl1ZUQVwJx2uwO/uWGvcGfT8MyA=";
+      hash = "sha256-RN5PH8OvMUSqvVqt00VhfYQyazBBU5YLxzUEXaVB0+A=";
    };

    pnpmDeps = pnpm.fetchDeps {
      inherit (finalAttrs) pname version src;
      fetcherVersion = 2;
-      hash = "sha256-ZJAXjG1OF3Ey0LKJ4zadoRmbJg+qX2wAZCV4Ozrbyyg=";
+      hash = "sha256-R8E25vkc9kLjAEQ8UqxFhfvVbW5qMCWQUt3iWqJoSPE=";
    };

    postPatch = ''
@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
  mktplcRef = {
    name = "debugpy";
    publisher = "ms-python";
-    version = "2025.10.0";
-    hash = "sha256-NDCNiKLCU7/2VH43eTyOMBTZ3oxzA7JwCBit9+JHfmY=";
+    version = "2025.14.1";
+    hash = "sha256-zmIv93uKBxgyI1cYh9WeF2g8ujm0Z++eoLN01aXaDF8=";
  };

  meta = {
@@ -48,11 +48,14 @@ stdenv.mkDerivation rec {

  postPatch = ''
    substituteInPlace src/gui/src/SslCertificate.cpp \
-      --replace 'kUnixOpenSslCommand[] = "openssl";' 'kUnixOpenSslCommand[] = "${openssl}/bin/openssl";'
+      --replace-fail 'kUnixOpenSslCommand[] = "openssl";' 'kUnixOpenSslCommand[] = "${openssl}/bin/openssl";'
+
+    substituteInPlace CMakeLists.txt cmake/Version.cmake src/gui/CMakeLists.txt \
+    --replace-fail "cmake_minimum_required (VERSION 3.4)" "cmake_minimum_required(VERSION 3.10)"
  ''
  + lib.optionalString stdenv.hostPlatform.isLinux ''
    substituteInPlace src/lib/synergy/unix/AppUtilUnix.cpp \
-      --replace "/usr/share/X11/xkb/rules/evdev.xml" "${xkeyboardconfig}/share/X11/xkb/rules/evdev.xml"
+      --replace-fail "/usr/share/X11/xkb/rules/evdev.xml" "${xkeyboardconfig}/share/X11/xkb/rules/evdev.xml"
  '';

  nativeBuildInputs = [
@@ -42,6 +42,11 @@ stdenv.mkDerivation {
  ]
  ++ lib.optionals stdenv.hostPlatform.isDarwin [ "-DLIBNOVA_LIBRARY=${libnova}/lib/libnova.dylib" ];

+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "cmake_minimum_required (VERSION 3.1.0)" "cmake_minimum_required(VERSION 3.10)"
+  '';
+
  postInstall =
    if stdenv.hostPlatform.isDarwin then
      ''
@@ -203,8 +203,9 @@ let

    # Let killall expect "containerd-shim" in the Nix store
    substituteInPlace install.sh \
+      --replace-fail '"''${K3S_DATA_DIR}"' "" \
      --replace-fail '/data/[^/]*/bin/containerd-shim' \
-        '/nix/store/.*k3s-containerd.*/bin/containerd-shim'
+        '/nix/store/[^/]*k3s-containerd[^/]*/bin/containerd-shim'

    remove_matching_line() {
      line_to_delete=$(grep -n "$1" install.sh | cut -d : -f 1 || true)
@@ -11,11 +11,11 @@

 stdenv.mkDerivation rec {
  pname = "armadillo";
-  version = "15.0.3";
+  version = "15.2.0";

  src = fetchurl {
    url = "mirror://sourceforge/arma/armadillo-${version}.tar.xz";
-    hash = "sha256-n1XsEPCpH7ZHmrTtKzelJEWu6RdwaiONFwtSIMAi/kM=";
+    hash = "sha256-L3HAZh/EpG4t1Wt2Uc87tZKLSZpLEN8x78GkJB7fAEM=";
  };

  nativeBuildInputs = [ cmake ];
@@ -6,18 +6,18 @@

 buildGoModule rec {
  pname = "cnspec";
-  version = "12.5.1";
+  version = "12.6.0";

  src = fetchFromGitHub {
    owner = "mondoohq";
    repo = "cnspec";
    tag = "v${version}";
-    hash = "sha256-F85GYOOheQ1Gx4NAWErfRwUjmjjRIv6EbXrlUPt9TX4=";
+    hash = "sha256-wV3LzrATUlNdPuqh/uB+EPeAPqbfWXEEhtctOIxJrWs=";
  };

  proxyVendor = true;

-  vendorHash = "sha256-ayv4qwiOHbZkLWIA8RIJ2GiS2QZlDeJnnbDXIHP7BCE=";
+  vendorHash = "sha256-NDwPDij1dFpBjgePyQ7y2f4BIMl92ugDAYNOZJk+6bs=";

  subPackages = [ "apps/cnspec" ];

@@ -16,20 +16,20 @@ let

  sources = {
    x86_64-linux = fetchurl {
-      url = "https://downloads.cursor.com/production/fe5d1728063e86edeeda5bebd2c8e14bf4d0f96a/linux/x64/Cursor-1.7.38-x86_64.AppImage";
-      hash = "sha256-52QJVbXO3CYeL4vVZ249xabS7AoYFDOxKCQ6m3vB+vE=";
+      url = "https://downloads.cursor.com/production/9675251a06b1314d50ff34b0cbe5109b78f848cd/linux/x64/Cursor-1.7.52-x86_64.AppImage";
+      hash = "sha256-nhDDdXE5/m9uASiQUJ4GHfApkzkf9ju5b8s0h6BhpjQ=";
    };
    aarch64-linux = fetchurl {
-      url = "https://downloads.cursor.com/production/fe5d1728063e86edeeda5bebd2c8e14bf4d0f96a/linux/arm64/Cursor-1.7.38-aarch64.AppImage";
-      hash = "sha256-4yUjLAiC7wZYYmAnVNUbRuvLBrpAfC/Kb9y/nONtwkM=";
+      url = "https://downloads.cursor.com/production/9675251a06b1314d50ff34b0cbe5109b78f848cd/linux/arm64/Cursor-1.7.52-aarch64.AppImage";
+      hash = "sha256-96zL0pmcrEyDEy8oW2qWk6RM8XGE4Gd2Aa3Hhq0qvk0=";
    };
    x86_64-darwin = fetchurl {
-      url = "https://downloads.cursor.com/production/fe5d1728063e86edeeda5bebd2c8e14bf4d0f96a/darwin/x64/Cursor-darwin-x64.dmg";
-      hash = "sha256-x56I8XaOvFK7GDlfyAHD18DdUwZrKf7hlXAROplqKU0=";
+      url = "https://downloads.cursor.com/production/9675251a06b1314d50ff34b0cbe5109b78f848cd/darwin/x64/Cursor-darwin-x64.dmg";
+      hash = "sha256-0//Sv57iEgRm/exnUnKVpdyk6fwxAnx0PDg2mVaB9J8=";
    };
    aarch64-darwin = fetchurl {
-      url = "https://downloads.cursor.com/production/fe5d1728063e86edeeda5bebd2c8e14bf4d0f96a/darwin/arm64/Cursor-darwin-arm64.dmg";
-      hash = "sha256-14H1jvVmSsywkFm6M3BFLAwUzorehrbVvo9OJo6cEdk=";
+      url = "https://downloads.cursor.com/production/9675251a06b1314d50ff34b0cbe5109b78f848cd/darwin/arm64/Cursor-darwin-arm64.dmg";
+      hash = "sha256-g8Fk9+MDwzLTNitxJMApypfiLWEjze0PR2OIPC774j8=";
    };
  };

@@ -39,7 +39,7 @@ in
  inherit useVSCodeRipgrep;
  commandLineArgs = finalCommandLineArgs;

-  version = "1.7.38";
+  version = "1.7.52";
  pname = "cursor";

  # You can find the current VSCode version in the About dialog:
@@ -7,13 +7,13 @@
 }:
 buildGoModule (finalAttrs: {
  pname = "dns-collector";
-  version = "1.11.0";
+  version = "1.12.0";

  src = fetchFromGitHub {
    owner = "dmachard";
    repo = "dns-collector";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-2NHJs2KdSDw36ePG8s/YSU4wlWG+14NQ6oWJYqMv2Wk=";
+    hash = "sha256-LQJxK2MZtFeFm5keNoNSDHXmxS8z9/fsCV02BGsph74=";
  };
  subPackages = [ "." ];

@@ -27,7 +27,7 @@ buildGoModule (finalAttrs: {
    "-X github.com/prometheus/common/version.Version=${finalAttrs.version}"
  ];

-  vendorHash = "sha256-N0gaDyOlRvFR1Buj/SKoOjwkVMRxd8Uj7iT/cDBfM9A=";
+  vendorHash = "sha256-nZheY/CbzDR/GB4Nu3xiWXsxrrvu/AKZE0gquBrfXXM=";

  passthru.updateScript = nix-update-script { };

@@ -9,13 +9,13 @@

 buildGoModule (finalAttrs: {
  pname = "dockerfmt";
-  version = "0.3.7";
+  version = "0.3.9";

  src = fetchFromGitHub {
    owner = "reteps";
    repo = "dockerfmt";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-cNxPe0LOZyUxyw43fmTQeoxvXcT9K+not/3SvChBSx4=";
+    hash = "sha256-eTsYL2UAVW2M1aQGc5X1gT5cXpXKgshLmN+U5Qro/Qw=";
  };

  vendorHash = "sha256-fLGgvAxSAiVSrsnF7r7EpPKCOOD9jzUsXxVQNWjYq80=";
@@ -6,17 +6,16 @@
  installShellFiles,
  nix-update-script,
  testers,
-  eget,
 }:

-buildGoModule rec {
+buildGoModule (finalAttrs: {
  pname = "eget";
  version = "1.3.4";

  src = fetchFromGitHub {
    owner = "zyedidia";
    repo = "eget";
-    rev = "v${version}";
+    tag = "v${finalAttrs.version}";
    sha256 = "sha256-jhVUYyp6t5LleVotQQme07IJVdVnIOVFFtKEmzt8e2k=";
  };

@@ -25,7 +24,7 @@ buildGoModule rec {
  ldflags = [
    "-s"
    "-w"
-    "-X main.Version=v${version}"
+    "-X main.Version=v${finalAttrs.version}"
  ];

  nativeBuildInputs = [
@@ -34,6 +33,7 @@ buildGoModule rec {
  ];

  postInstall = ''
+    rm $out/bin/{test,tools}
    pandoc man/eget.md -s -t man -o eget.1
    installManPage eget.1
  '';
@@ -41,16 +41,16 @@ buildGoModule rec {
  passthru = {
    updateScript = nix-update-script { };
    tests.version = testers.testVersion {
-      package = eget;
+      package = finalAttrs.finalPackage;
      command = "eget -v";
-      version = "v${version}";
+      version = "v${finalAttrs.version}";
    };
  };

-  meta = with lib; {
+  meta = {
    description = "Easily install prebuilt binaries from GitHub";
    homepage = "https://github.com/zyedidia/eget";
-    license = licenses.mit;
-    maintainers = with maintainers; [ zendo ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ zendo ];
  };
-}
+})
@@ -0,0 +1,47 @@
+diff --git i/CMakeLists.txt w/CMakeLists.txt
+index bb12a7cf5..932187427 100644
+--- i/CMakeLists.txt
+++ w/CMakeLists.txt
+@@ -1,5 +1,5 @@
+ project(Eigen)
+-cmake_minimum_required(VERSION 2.6.2)
+cmake_minimum_required(VERSION 3.10)
+ 
+ set(INCLUDE_INSTALL_DIR
+     "${CMAKE_INSTALL_PREFIX}/include/eigen2"
+diff --git i/doc/examples/CMakeLists.txt w/doc/examples/CMakeLists.txt
+index 9db5b1f58..b535ae80e 100644
+--- i/doc/examples/CMakeLists.txt
+++ w/doc/examples/CMakeLists.txt
+@@ -8,12 +8,10 @@ ADD_EXECUTABLE(${example} ${example_src})
+ if(EIGEN_STANDARD_LIBRARIES_TO_LINK_TO)
+   target_link_libraries(${example} ${EIGEN_STANDARD_LIBRARIES_TO_LINK_TO})
+ endif()
+-GET_TARGET_PROPERTY(example_executable
+-                    ${example} LOCATION)
+ ADD_CUSTOM_COMMAND(
+   TARGET ${example}
+   POST_BUILD
+-  COMMAND ${example_executable}
+  COMMAND ${example}
+   ARGS >${CMAKE_CURRENT_BINARY_DIR}/${example}.out
+ )
+ ADD_DEPENDENCIES(all_examples ${example})
+diff --git i/doc/snippets/CMakeLists.txt w/doc/snippets/CMakeLists.txt
+index 7458830b0..153dbfc68 100644
+--- i/doc/snippets/CMakeLists.txt
+++ w/doc/snippets/CMakeLists.txt
+@@ -14,12 +14,10 @@ ADD_EXECUTABLE(${compile_snippet_target}
+ if(EIGEN_STANDARD_LIBRARIES_TO_LINK_TO)
+   target_link_libraries(${compile_snippet_target} ${EIGEN_STANDARD_LIBRARIES_TO_LINK_TO})
+ endif()
+-GET_TARGET_PROPERTY(compile_snippet_executable
+-                    ${compile_snippet_target} LOCATION)
+ ADD_CUSTOM_COMMAND(
+   TARGET ${compile_snippet_target}
+   POST_BUILD
+-  COMMAND ${compile_snippet_executable}
+  COMMAND ${compile_snippet_target}
+   ARGS >${CMAKE_CURRENT_BINARY_DIR}/${snippet}.out
+ )
+ ADD_DEPENDENCIES(all_snippets ${compile_snippet_target})
@@ -18,6 +18,10 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [ cmake ];

+  # CMake 2.6.2 is deprecated and is no longer supported by CMake > 4
+  # https://github.com/NixOS/nixpkgs/issues/445447
+  patches = [ ./cmake-4-build.patch ];
+
  meta = with lib; {
    homepage = "https://eigen.tuxfamily.org";
    description = "C++ template library for linear algebra: vectors, matrices, and related algorithms";
@@ -45,13 +45,17 @@ stdenv.mkDerivation rec {
    # Fix build with lv2 1.18: https://sourceforge.net/p/eq10q/bugs/23/
    find . -type f -exec fgrep -q LV2UI_Descriptor {} \; \
      -exec sed -i {} -e 's/const _\?LV2UI_Descriptor/const LV2UI_Descriptor/' \;
+
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "cmake_minimum_required(VERSION 2.8)" "cmake_minimum_required(VERSION 3.10)"
  '';

  installFlags = [ "DESTDIR=$(out)" ];

  fixupPhase = ''
-    cp -r $out/var/empty/local/lib $out
-    rm -R $out/var
+    mkdir -p $out/lib
+    mv $out/usr/local/lib/* $out/lib/
+    rm -R $out/usr
  '';

  meta = {
@@ -10,16 +10,16 @@

 buildNpmPackage rec {
  pname = "firebase-tools";
-  version = "14.18.0";
+  version = "14.20.0";

  src = fetchFromGitHub {
    owner = "firebase";
    repo = "firebase-tools";
    tag = "v${version}";
-    hash = "sha256-1yTcMzyznr0b/ObVEECdJuBUi03aiTAwgcTdJ1QFcWY=";
+    hash = "sha256-CX/2luy78Du6gsGG3ex0Q5amu93MqebTUF9of7D6H4M=";
  };

-  npmDepsHash = "sha256-VJquJ7mDBHeclgd/jsAPyRLEFOQp27tUXGAQJX3bXyQ=";
+  npmDepsHash = "sha256-laYq6NNGsJ2YGhg6i0iFCVk+qyRqYdZPSSWzVHailcc=";

  nativeBuildInputs = [
    python3
@@ -2,7 +2,6 @@
  lib,
  stdenv,
  fetchFromGitLab,
-  wrapQtAppsHook,
  callPackage,
  libglut,
  freealut,
@@ -28,9 +27,7 @@
  udev,
  fltk13,
  apr,
-  qtbase,
-  qtquickcontrols2,
-  qtdeclarative,
+  qt5,
  glew,
  curl,
 }:
@@ -71,7 +68,7 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [
    cmake
-    wrapQtAppsHook
+    qt5.wrapQtAppsHook
  ];
  buildInputs = [
    libglut
@@ -98,21 +95,24 @@ stdenv.mkDerivation rec {
    udev
    fltk13
    apr
-    qtbase
-    qtquickcontrols2
+    qt5.qtbase
+    qt5.qtquickcontrols2
    glew
-    qtdeclarative
+    qt5.qtdeclarative
    curl
  ];

  qtWrapperArgs = [ "--set FG_ROOT ${data}/share/FlightGear" ];

-  meta = with lib; {
+  meta = {
    description = "Flight simulator";
-    maintainers = with maintainers; [ raskin ];
-    platforms = platforms.linux;
+    maintainers = with lib.maintainers; [
+      raskin
+      iedame
+    ];
+    platforms = lib.platforms.linux;
    hydraPlatforms = [ ]; # disabled from hydra because it's so big
-    license = licenses.gpl2Plus;
+    license = lib.licenses.gpl2Plus;
    mainProgram = "fgfs";
  };
 }
@@ -33,6 +33,7 @@ let
    "TestCloneIfRequired"
    "TestActionCache"
    "TestRunContext_GetGitHubContext"
+    "TestSetJobResult_SkipsBannerInChildReusableWorkflow"

    # These tests rely on outbound IP address
    "TestHandler"
@@ -41,17 +42,17 @@ let
 in
 buildGoModule rec {
  pname = "forgejo-runner";
-  version = "11.1.2";
+  version = "11.2.0";

  src = fetchFromGitea {
    domain = "code.forgejo.org";
    owner = "forgejo";
    repo = "runner";
    rev = "v${version}";
-    hash = "sha256-/rkBrG8hRn52M1ybjbWtSDFYsJ4fHzw9qAoc5325g9A=";
+    hash = "sha256-hjrn36Fm2kIKqn16DOPcrMF38dhsGOZVHCTrhkS99QQ=";
  };

-  vendorHash = "sha256-eVOmUozNLHRiNwIhbf7ebVNdRiMAtLMdYI7pnALvl8U=";
+  vendorHash = "sha256-QokVTTfMGAJG4Jqfs7mfGXrC4QSZfOXesfF2OeN0L9M=";

  # See upstream Makefile
  # https://code.forgejo.org/forgejo/runner/src/branch/main/Makefile
@@ -25,6 +25,18 @@
 }:

 let
+  ebur128Src = fetchFromGitHub {
+    owner = "jiixyj";
+    repo = "libebur128";
+    rev = "v1.2.6";
+    hash = "sha256-UKO2k+kKH/dwt2xfaYMrH/GXjEkIrnxh1kGG/3P5d3Y=";
+  };
+  mimallocSrc = fetchFromGitHub {
+    owner = "microsoft";
+    repo = "mimalloc";
+    tag = "v2.2.4";
+    hash = "sha256-+8xZT+mVEqlqabQc+1buVH/X6FZxvCd0rWMyjPu9i4o=";
+  };
  radaeSrc = fetchFromGitHub {
    owner = "drowe67";
    repo = "radae";
@@ -34,13 +46,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "freedv";
-  version = "2.0.1";
+  version = "2.0.2";

  src = fetchFromGitHub {
    owner = "drowe67";
    repo = "freedv-gui";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-+hVh5GgSz8MWib10dVV6gx9EvocvLAJm2Eid/4y//2E=";
+    hash = "sha256-awWeq0ueKAK+4mAM0Nv3SsSv/mIFQ+/TqCPw9wjed1w=";
  };

  patches = [
@@ -48,11 +60,20 @@ stdenv.mkDerivation (finalAttrs: {
  ];

  postPatch = ''
+    cp -R ${ebur128Src} ebur128
+    cp -R ${mimallocSrc} mimalloc
    cp -R ${radaeSrc} radae
-    chmod -R u+w radae
+    chmod -R u+w ebur128 mimalloc radae
    substituteInPlace radae/cmake/BuildOpus.cmake \
      --replace-fail "https://gitlab.xiph.org/xiph/opus/-/archive/main/opus-main.tar.gz" "${libopus.src}" \
      --replace-fail "./autogen.sh && " ""
+    substituteInPlace cmake/BuildEbur128.cmake \
+      --replace-fail "GIT_REPOSITORY https://github.com/jiixyj/libebur128.git" "URL $(realpath ebur128)" \
+      --replace-fail 'GIT_TAG "v''${EBUR128_VERSION}"' "" \
+      --replace-fail "git apply" "patch -p1 <"
+    substituteInPlace cmake/BuildMimalloc.cmake \
+      --replace-fail "GIT_REPOSITORY https://github.com/microsoft/mimalloc.git" "URL $(realpath mimalloc)" \
+      --replace-fail "GIT_TAG        v2.2.4" ""
    substituteInPlace cmake/BuildRADE.cmake \
      --replace-fail "GIT_REPOSITORY https://github.com/drowe67/radae.git" "URL $(realpath radae)" \
      --replace-fail "GIT_TAG main" ""
@@ -7,7 +7,7 @@ project(
        'werror=true'
    ],
    license: 'Apache-2.0',
-    version: '20210223'
+    version: '1.7'
 )

 library(
@@ -6,16 +6,15 @@
  ninja,
 }:

-stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
  pname = "frozen";
-  # pin to a newer release if frozen releases again, see cesanta/frozen#72
-  version = "unstable-2021-02-23";
+  version = "1.7";

  src = fetchFromGitHub {
    owner = "cesanta";
    repo = "frozen";
-    rev = "21f051e3abc2240d9a25b2add6629b38e963e102";
-    hash = "sha256-BpuYK9fbWSpeF8iPT8ImrV3CKKaA5RQ2W0ZQ03TciR0=";
+    tag = finalAttrs.version;
+    hash = "sha256-dOQb6wVufkqOSVZa2o8A1DLad0zvo2xQzmu09J2ZT7E=";
  };

  nativeBuildInputs = [
@@ -41,4 +40,4 @@ stdenv.mkDerivation {
    maintainers = with lib.maintainers; [ thillux ];
    platforms = lib.platforms.unix;
  };
-}
+})
@@ -13,13 +13,13 @@

 buildGoModule rec {
  pname = "git-town";
-  version = "22.0.0";
+  version = "22.1.0";

  src = fetchFromGitHub {
    owner = "git-town";
    repo = "git-town";
    tag = "v${version}";
-    hash = "sha256-yLDzMKyg9t5VNFXRS+FDD6W0Z80eNNywfZAMOhxNSZU=";
+    hash = "sha256-hM6aEH4xiMgRWvIzja9QQUZvwdufG1FYooeUO1qJpbU=";
  };

  vendorHash = null;
@@ -6,14 +6,14 @@
 }:

 stdenv.mkDerivation rec {
-  version = "1.0.1";
+  version = "1.0.2";
  pname = "glm";

  src = fetchFromGitHub {
    owner = "g-truc";
    repo = "glm";
    rev = version;
-    sha256 = "sha256-GnGyzNRpzuguc3yYbEFtYLvG+KiCtRAktiN+NvbOICE=";
+    sha256 = "sha256-2xKv1nO+OdwA0r+I9OZ+OCL9dJFg/LJsQfIvIF76vc0=";
  };

  outputs = [
@@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "go2rtc";
-  version = "1.9.10";
+  version = "1.9.11";

  src = fetchFromGitHub {
    owner = "AlexxIT";
    repo = "go2rtc";
    tag = "v${version}";
-    hash = "sha256-SWFVcfOfSCKuNJlahsZRY21n17vL1VjtDRiSZ5o3VGc=";
+    hash = "sha256-MJb88RwASZnURnqb8nmCKvf8G3VW+Vd1JlNtbh7i/Ps=";
  };

-  vendorHash = "sha256-k01+xngNA4SMCJa9Vhg+MxDgf973sUcrVXppwAz4MBs=";
+  vendorHash = "sha256-iOMIbeNh2+tNSMc5BR2h29a7uAru9ER/tPBI59PeeDY=";

  env.CGO_ENABLED = 0;

@@ -91,7 +91,7 @@ stdenv.mkDerivation (finalAttrs: {
      --set-default HOMEPAGE_CONFIG_DIR /var/lib/homepage-dashboard \
      --set-default NIXPKGS_HOMEPAGE_CACHE_DIR /var/cache/homepage-dashboard \
      --add-flags "$out/share/homepage/server.js" \
-      --set PATH "${lib.makeBinPath [ unixtools.ping ]}"
+      --prefix PATH : "${lib.makeBinPath [ unixtools.ping ]}"

    ${if enableLocalIcons then installLocalIcons else ""}

@@ -56,16 +56,16 @@ assert (extraParameters != null) -> set != null;

 buildNpmPackage rec {
  pname = "Iosevka${toString set}";
-  version = "33.3.1";
+  version = "33.3.2";

  src = fetchFromGitHub {
    owner = "be5invis";
    repo = "iosevka";
    rev = "v${version}";
-    hash = "sha256-qbC1FVhnkVlsT+lOSeM6wDbKV2c5iTHgBxZENGEBnUI=";
+    hash = "sha256-qJfywH5rwfgTy8k7Db3vC09Lx+UP50iWSsXnTIQWJQo=";
  };

-  npmDepsHash = "sha256-/HxMh5v3CfCpPCF8cf8Z2NXDBovJFvMaQfYFZvuyNX0=";
+  npmDepsHash = "sha256-MzeUHVJXmtLWNh2iNA0RiXw1fi5Cf/sWeCQG2YCMxvU=";

  nativeBuildInputs = [
    remarshal
@@ -3,9 +3,13 @@
  stdenv,
  fetchurl,
  cmake,
-  boost,
+  boost186,
 }:

+let
+  boost = boost186;
+in
+
 stdenv.mkDerivation rec {
  pname = "ispike";
  version = "2.1.1";
@@ -17,6 +21,11 @@ stdenv.mkDerivation rec {

  postPatch = ''
    sed -i "1i #include <map>" include/iSpike/YarpConnection.hpp
+
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "CMAKE_MINIMUM_REQUIRED (VERSION 2.6.2)" "cmake_minimum_required(VERSION 3.10)"
+    substituteInPlace src/CMakeLists.txt \
+      --replace-fail "cmake_minimum_required(VERSION 2.8)" "cmake_minimum_required(VERSION 3.10)"
  '';

  nativeBuildInputs = [ cmake ];
@@ -0,0 +1,31 @@
+From 61f2d2f7e308c42cce652db4a172cfa4b0ff6bf1 Mon Sep 17 00:00:00 2001
+From: OPNA2608 <opna2608@protonmail.com>
+Date: Sat, 18 Oct 2025 22:45:37 +0200
+Subject: [PATCH] tests/testhash.c: Properly request shutdown of test2 threads
+
+So they can be destroyed properly. Fixes sometimes-occuring SIGSEGVs.
+---
+ tests/testhash.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/tests/testhash.c b/tests/testhash.c
+index 0769aa6..cb6ed24 100644
+--- a/tests/testhash.c
+++ b/tests/testhash.c
+@@ -134,7 +134,12 @@ int test2(void)
+ 	}
+ 
+ 	for (i = 0; i < ttl; i++) {
+-		ks_thread_destroy(&threads[i]);
+		ks_thread_request_stop(threads[i]);
+	}
+
+	for (i = 0; i < ttl; i++) {
+		ks_thread_join(threads[i]);
+		if (ks_thread_destroy(&threads[i]) != KS_STATUS_SUCCESS) return 0;
+ 	}
+ 
+ 
+-- 
+2.51.0
+
@@ -4,6 +4,7 @@
  fetchFromGitHub,
  fetchpatch,
  cmake,
+  ctestCheckHook,
  pkg-config,
  libuuid,
  openssl,
@@ -28,6 +29,9 @@ stdenv.mkDerivation rec {
      url = "https://raw.githubusercontent.com/openwrt/telephony/5ced7ea4fc9bd746273d564bf3c102f253d2182e/libs/libks/patches/01-find-libm.patch";
      sha256 = "1hyrsdxg69d08qzvf3mbrx2363lw52jcybw8i3ynzqcl228gcg8a";
    })
+
+    # Remove when https://github.com/signalwire/libks/pull/246 merged & in release
+    ./1001-tests-testhash.c-Properly-request-shutdown-of-test2-threads.patch
  ];

  dontUseCmakeBuildDir = true;
@@ -43,6 +47,25 @@ stdenv.mkDerivation rec {
  ++ lib.optional stdenv.hostPlatform.isLinux libuuid
  ++ lib.optional stdenv.hostPlatform.isDarwin libossp_uuid;

+  nativeCheckInputs = [
+    ctestCheckHook
+  ];
+
+  doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
+
+  disabledTests = [
+    # Runs into certificate error on aarch64
+    # [ERROR] [...] testhttp.c:95    init_ssl [...] SSL ERR: CERT CHAIN FILE ERROR
+    "testhttp"
+
+    # Runs into what seems like an overflow / memory corruption in the testing framework on the community runner.
+    # Doesn't happen on local ARM hardware, maybe due to unexpectedly high core count?
+    "testthreadmutex"
+  ];
+
+  # Something seems to go wrong with testwebsock2 when using parallelism
+  enableParallelChecking = false;
+
  passthru = {
    tests.freeswitch = freeswitch;
    updateScript = nix-update-script { };
@@ -53,6 +76,7 @@ stdenv.mkDerivation rec {
    description = "Foundational support for signalwire C products";
    homepage = "https://github.com/signalwire/libks";
    maintainers = with lib.maintainers; [ misuzu ];
+    teams = [ lib.teams.ngi ];
    platforms = platforms.unix;
    license = licenses.mit;
  };
@@ -0,0 +1,13 @@
+--- a/meson.build
+++ b/meson.build
+@@ -72,10 +72,6 @@
+ 	libui_macosx_version_min = '-mmacosx-version-min=10.8'
+ 	add_global_arguments(libui_macosx_version_min, language: libui_darwin_langs)
+ 	add_global_link_arguments(libui_macosx_version_min, language: libui_darwin_langs)
+-
+-	libui_arch = ['-arch', 'x86_64', '-arch', 'arm64']
+-	add_global_arguments(libui_arch, language: libui_darwin_langs)
+-	add_global_link_arguments(libui_arch, language: libui_darwin_langs)
+ endif
+ 
+ if libui_MSVC
@@ -21,9 +21,9 @@ stdenv.mkDerivation {
    hash = "sha256-pnfrSPDIvG0tFYQoeMBONATkNRNjY/tJGp9n2I4cN/U=";
  };

-  postPatch = lib.optionalString (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64) ''
-    substituteInPlace meson.build --replace "'-arch', 'arm64'" ""
-  '';
+  patches = [
+    ./darwin-no-universal.patch
+  ];

  nativeBuildInputs = [
    cmocka
@@ -9,16 +9,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "live-server";
-  version = "0.10.1";
+  version = "0.11.0";

  src = fetchFromGitHub {
    owner = "lomirus";
    repo = "live-server";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-0IP7F8+Vdl/h4+zcghRqowvzz6zjQYDTjMSZPuGOOj4=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-FKX1rbRKWkWsxzJZDicVAUqrHBwEe2o7EXIouK74UMA=";
  };

-  cargoHash = "sha256-MMeeUoj3vYd1lv15N3+qjHbn991IVMhIUCMd0isCNhk=";
+  cargoHash = "sha256-gaBYnhljcMqSEPViaOPMtuHjoDP8iY64UizlfK+fcQA=";

  nativeBuildInputs = [ pkg-config ];

@@ -30,10 +30,13 @@ rustPlatform.buildRustPackage (finalAttrs: {
    description = "Local network server with live reload feature for static pages";
    downloadPage = "https://github.com/lomirus/live-server/releases";
    homepage = "https://github.com/lomirus/live-server";
-    changelog = "https://github.com/lomirus/live-server/releases/tag/v${finalAttrs.version}";
+    changelog = "https://github.com/lomirus/live-server/releases/tag/${finalAttrs.src.tag}";
    license = lib.licenses.mit;
    mainProgram = "live-server";
-    maintainers = [ lib.maintainers.philiptaron ];
+    maintainers = with lib.maintainers; [
+      philiptaron
+      doronbehar
+    ];
    platforms = lib.platforms.unix;
  };
 })
@@ -68,16 +68,16 @@ let
 in
 buildGoModule (finalAttrs: {
  pname = "netbird-${componentName}";
-  version = "0.59.5";
+  version = "0.59.7";

  src = fetchFromGitHub {
    owner = "netbirdio";
    repo = "netbird";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-raJXFBApLb17jiDdia60gchqayDVDbgC+hztXjz0Ofs=";
+    hash = "sha256-qOb4viLMZme6sJzWxJuYkubQ3D67j5gkkLTRkcL2QKI=";
  };

-  vendorHash = "sha256-hg9vzosB6yVS0e0McekIuchWaByYS02kbbtilKjCo7s=";
+  vendorHash = "sha256-JMynPCH5Zvzz8nYI7DPu9TzU+rWJemPwyDdlPkFiqds=";

  nativeBuildInputs = [ installShellFiles ] ++ lib.optional (componentName == "ui") pkg-config;

@@ -19,14 +19,14 @@
 }:

 stdenv.mkDerivation rec {
-  version = "2025-09-27";
+  version = "2025-10-15";
  pname = "oh-my-zsh";

  src = fetchFromGitHub {
    owner = "ohmyzsh";
    repo = "ohmyzsh";
-    rev = "242e2faa51675494cbfa78a81f3ff47d81039863";
-    sha256 = "sha256-xYwo5/ONf5nRgfVSnEadPUkPDaOsJhk7doqRs4zp39E=";
+    rev = "d1c04d8a33f9127d03b69617c5367db5ceebc8a7";
+    sha256 = "sha256-Nt/7UZJl+7Kw7trMByuyhjE7RnccgAzW1oNwKsIx3Jw=";
  };

  strictDeps = true;
@@ -22,12 +22,12 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "opencode";
-  version = "0.15.8";
+  version = "0.15.10";
  src = fetchFromGitHub {
    owner = "sst";
    repo = "opencode";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-6brfh6yTFGnhUo9kZ5VAcC1whhMPJYYwVIT7j6g+wkw=";
+    hash = "sha256-aP0CLHfuF21GXIvBTgs8RWpcCXOwy1oPW2P8jEU/4u4=";
  };

  tui = buildGoModule {
@@ -111,10 +111,10 @@ stdenvNoCC.mkDerivation (finalAttrs: {

    outputHash =
      {
-        x86_64-linux = "sha256-EfH8fBgP0zsKVu26BxFq1NCwWLG6vlOhDD/WQ7152hA=";
-        aarch64-linux = "sha256-Bwwe9PTYwEJvTLhB2+6yzC4pB2/1J/JGI8S1TSrdOuM=";
-        x86_64-darwin = "sha256-TBSBpuPE+V7oanEMW6F8PvCZSLqIokibsyO1NtbLQnM=";
-        aarch64-darwin = "sha256-+wUulok3OdJ0YewuyOkv5zbiC+3QzhokfT3aCdL5akk=";
+        x86_64-linux = "sha256-iJbflfKwDwKrJQgy5jxrEhkyCie2hsEMmiLf2btE60E=";
+        aarch64-linux = "sha256-wQ+ToXRi+l24WM24PHGCw6acD9cvLDldOv9WvOzHYGU=";
+        x86_64-darwin = "sha256-DyvteSN+mEFZojH8mY4LNQE2C6lCWwrIVbJUFn4lAh0=";
+        aarch64-darwin = "sha256-oICPefgikykFWNDlxCXH4tILdjv4NytgQdejdQBeQ+A=";
      }
      .${stdenv.hostPlatform.system};
    outputHashAlgo = "sha256";
@@ -9,11 +9,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "proton-ge-bin";
-  version = "GE-Proton10-20";
+  version = "GE-Proton10-21";

  src = fetchzip {
    url = "https://github.com/GloriousEggroll/proton-ge-custom/releases/download/${finalAttrs.version}/${finalAttrs.version}.tar.gz";
-    hash = "sha256-sJkaDEnfAuEqcLDBtAfU6Rny3P3lOCnG1DusWfvv2Fg=";
+    hash = "sha256-Oa9+DjEeZZiJEr9H7wnUtGb6v/JXHk0qt0GAGcp3JFQ=";
  };

  dontUnpack = true;
@@ -4,35 +4,27 @@
  fetchurl,
  autoPatchelfHook,
  installShellFiles,
+  perl,
 }:

 let
-  version = "7.01";
+  version = "7.12";
  downloadVersion = lib.replaceStrings [ "." ] [ "" ] version;
  # Use `./update.sh` to generate the entries below
  srcs = {
-    i686-linux = {
-      url = "https://www.rarlab.com/rar/rarlinux-x32-${downloadVersion}.tar.gz";
-      hash = "sha256-1CSbxM7arGpn4Yj5fHEFKcDURFPrC2+XptLoaDH8LDs=";
-    };
    x86_64-linux = {
      url = "https://www.rarlab.com/rar/rarlinux-x64-${downloadVersion}.tar.gz";
-      hash = "sha256-34iWajylsSmIOuAT6kV7c2537qWFHc+gT+JT/trWrw8=";
+      hash = "sha256-Yw2andExNnJzZnvuB5rRA/Rp8bfNvJtCpPKDzCmTurI=";
    };
    aarch64-darwin = {
      url = "https://www.rarlab.com/rar/rarmacos-arm-${downloadVersion}.tar.gz";
-      hash = "sha256-BjEJFzKyRpN4XL6KYW7ykQcSxqF4tYr2dCFf50JHH38=";
+      hash = "sha256-lQeOD1n/0F6+ZlpVfp1NHAcxVqJ3fZFn9sQg7kSKg8U=";
    };
    x86_64-darwin = {
      url = "https://www.rarlab.com/rar/rarmacos-x64-${downloadVersion}.tar.gz";
-      hash = "sha256-1ExnVDre49wWwB/BKP/L9xdYOMx8qkeZfmObJ7xm4dY=";
+      hash = "sha256-Wzp5Izpc4usNldBEb3OZCeNyByTTJegoxbDD8HNnCPo=";
    };
  };
-  manSrc = fetchurl {
-    url = "https://aur.archlinux.org/cgit/aur.git/plain/rar.1?h=rar&id=8e39a12e88d8a3b168c496c44c18d443c876dd10";
-    name = "rar.1";
-    hash = "sha256-93cSr9oAsi+xHUtMsUvICyHJe66vAImS2tLie7nt8Uw=";
-  };
 in
 stdenv.mkDerivation {
  pname = "rar";
@@ -48,9 +40,17 @@ stdenv.mkDerivation {

  nativeBuildInputs = [
    installShellFiles
+    perl
  ]
  ++ lib.optionals stdenv.hostPlatform.isLinux [ autoPatchelfHook ];

+  postPatch = ''
+    perl -0777 -i -pe 's/ ([\w .-]+\n) ~+\n/=head1 \U$1/g' rar.txt
+    perl -0777 -i -pe 's/ (Copyrights)/=head1 \U$1/g;' rar.txt
+    mv rar.txt rar.1.pod
+    pod2man -c "RAR User's Manual" -n "RAR" -r "rar ${version}" -s 1 rar.1.pod > rar.1
+  '';
+
  installPhase = ''
    runHook preInstall

@@ -58,14 +58,11 @@ stdenv.mkDerivation {
    install -Dm755 default.sfx -t "$out/lib"
    install -Dm644 {acknow.txt,license.txt} -t "$out/share/doc/rar"
    install -Dm644 rarfiles.lst -t "$out/etc"
+    installManPage rar.1

    runHook postInstall
  '';

-  postInstall = ''
-    installManPage ${manSrc}
-  '';
-
  passthru.updateScript = ./update.sh;

  meta = with lib; {
@@ -42,12 +42,12 @@ updateHash() {
    hash=$(nix store prefetch-file --json "$url" | jq -r .hash)
    currentHash=$(cd "$DIRNAME" && nix "${NIX_FLAGS[@]}" eval --raw "$NIXPKGS_ROOT#legacyPackages.$nix_arch.rar.src.outputHash")

-    sed -i "s|$currentHash|$hash|g" "$DIRNAME/default.nix"
+    sed -i "s|$currentHash|$hash|g" "$DIRNAME/package.nix"
 }

 updateVersion() {
    local -r version="$1"
-    sed -i "s|version = \"[0-9.]*\";|version = \"$version\";|g" "$DIRNAME/default.nix"
+    sed -i "s|version = \"[0-9.]*\";|version = \"$version\";|g" "$DIRNAME/package.nix"
 }

 latestVersion="${1:-}"
@@ -70,7 +70,6 @@ if [[ "$currentVersion" == "$latestVersion" ]]; then
    exit 0
 fi

-updateHash "$latestVersion" x32 linux i686-linux
 updateHash "$latestVersion" x64 linux x86_64-linux
 updateHash "$latestVersion" arm macos aarch64-darwin
 updateHash "$latestVersion" x64 macos x86_64-darwin
@@ -34,6 +34,11 @@ stdenv.mkDerivation rec {
    inherit parallelSupport;
  };

+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "cmake_minimum_required(VERSION 2.6.2 FATAL_ERROR)" "cmake_minimum_required(VERSION 3.10)"
+  '';
+
  meta = with lib; {
    description = "Implementation of the C++ standard template library STL for external memory (out-of-core) computations";
    homepage = "https://github.com/stxxl/stxxl";
@@ -7,16 +7,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "systemd-lsp";
-  version = "2025.07.14";
+  version = "2025.10.16";

  src = fetchFromGitHub {
    owner = "JFryy";
    repo = "systemd-lsp";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-JjrPgpQ94C01nZ3E1NE88TBzI03YFs+x37edtYStlnc=";
+    hash = "sha256-xhk1jUAA81Rkq9Nmcw+XyWrSbq3ygRvS615Z56j0WBM=";
  };

-  cargoHash = "sha256-G1cQWOgtx+Bmi05ji9Z4TBj5pnhglNcfLRoq2zSmyK0=";
+  cargoHash = "sha256-6hePUny2iBjslkIk8wVXHnuAHzG3WpBdcj8D5FM9Bc4=";

  passthru.updateScript = nix-update-script { };

@@ -46,6 +46,11 @@ stdenv.mkDerivation (finalAttrs: {
    "-DENABLE_HELP=OFF"
  ];

+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "cmake_minimum_required(VERSION 2.6)" "cmake_minimum_required(VERSION 3.10)"
+  '';
+
  meta = {
    description = "Table Editor And Planner, Or: Teapot";
    longDescription = ''
@@ -1,60 +1,99 @@
 {
  lib,
+  stdenv,
  rustPlatform,
  fetchFromGitHub,
-  makeWrapper,
-  testers,
-  television,
+  callPackage,
+  installShellFiles,
  nix-update-script,
-  extraPackages ? [ ],
+  testers,
+  targetPackages,
+  extraPackages ? null,
 }:
-rustPlatform.buildRustPackage (finalAttrs: {
-  pname = "television";
-  version = "0.13.5";

-  src = fetchFromGitHub {
-    owner = "alexpasmantier";
-    repo = "television";
-    tag = finalAttrs.version;
-    hash = "sha256-IlFOYnZ9xPQaRheielKqAckyVlSVQMhnO4wCtVixlNQ=";
-  };
+assert
+  (extraPackages == null)
+  || lib.warn "Overriding television with the 'extraPackages' attribute is deprecated. Please use `television.withPackages (p: [ p.fd ...])` instead.";

-  cargoHash = "sha256-QKUspbC1bmSeZP0n/O5roEqQkrja+fVKLhAvgzqNS9E=";
+let
+  television = rustPlatform.buildRustPackage (finalAttrs: {
+    pname = "television";

-  nativeBuildInputs = [ makeWrapper ];
+    version = "0.13.5";

-  postInstall = lib.optionalString (extraPackages != [ ]) ''
-    wrapProgram $out/bin/tv \
-      --prefix PATH : ${lib.makeBinPath extraPackages}
-  '';
-
-  # TODO(@getchoo): Investigate selectively disabling some tests, or fixing them
-  # https://github.com/NixOS/nixpkgs/pull/423662#issuecomment-3156362941
-  doCheck = false;
-
-  passthru = {
-    tests.version = testers.testVersion {
-      package = television;
-      command = "XDG_DATA_HOME=$TMPDIR tv --version";
+    src = fetchFromGitHub {
+      owner = "alexpasmantier";
+      repo = "television";
+      tag = finalAttrs.version;
+      hash = "sha256-IlFOYnZ9xPQaRheielKqAckyVlSVQMhnO4wCtVixlNQ=";
    };
-    updateScript = nix-update-script { };
-  };

-  meta = {
-    description = "Blazingly fast general purpose fuzzy finder TUI";
-    longDescription = ''
-      Television is a fast and versatile fuzzy finder TUI.
-      It lets you quickly search through any kind of data source (files, git
-      repositories, environment variables, docker images, you name it) using a
-      fuzzy matching algorithm and is designed to be easily extensible.
-    '';
-    homepage = "https://github.com/alexpasmantier/television";
-    changelog = "https://github.com/alexpasmantier/television/releases/tag/${finalAttrs.version}";
-    license = lib.licenses.mit;
-    mainProgram = "tv";
-    maintainers = with lib.maintainers; [
-      louis-thevenet
-      getchoo
+    cargoHash = "sha256-QKUspbC1bmSeZP0n/O5roEqQkrja+fVKLhAvgzqNS9E=";
+
+    strictDeps = true;
+    nativeBuildInputs = [
+      installShellFiles
    ];
-  };
-})
+
+    # TODO(@getchoo): Investigate selectively disabling some tests, or fixing them
+    # https://github.com/NixOS/nixpkgs/pull/423662#issuecomment-3156362941
+    doCheck = false;
+
+    postInstall = ''
+      installManPage target/${stdenv.hostPlatform.rust.cargoShortTarget}/assets/tv.1
+
+      installShellCompletion --cmd tv \
+        television/utils/shell/completion.bash \
+        television/utils/shell/completion.fish \
+        television/utils/shell/completion.nu \
+        television/utils/shell/completion.zsh
+    '';
+
+    passthru = {
+      updateScript = nix-update-script { };
+
+      withPackages =
+        f:
+        callPackage ./wrapper.nix {
+          television = finalAttrs.finalPackage;
+          extraPackages = f targetPackages;
+        };
+
+      tests = {
+        version = testers.testVersion {
+          package = finalAttrs.finalPackage;
+          command = "XDG_DATA_HOME=$TMPDIR tv --version";
+        };
+        wrapper = testers.testVersion {
+          package = finalAttrs.finalPackage.withPackages (pkgs: [
+            pkgs.fd
+            pkgs.git
+          ]);
+
+          command = "XDG_DATA_HOME=$TMPDIR tv --version";
+        };
+      };
+    };
+
+    meta = {
+      description = "Blazingly fast general purpose fuzzy finder TUI";
+      longDescription = ''
+        Television is a fast and versatile fuzzy finder TUI.
+        It lets you quickly search through any kind of data source (files, git
+        repositories, environment variables, docker images, you name it) using a
+        fuzzy matching algorithm and is designed to be easily extensible.
+      '';
+      homepage = "https://github.com/alexpasmantier/television";
+      changelog = "https://github.com/alexpasmantier/television/releases/tag/${finalAttrs.version}";
+      license = lib.licenses.mit;
+      mainProgram = "tv";
+      maintainers = with lib.maintainers; [
+        louis-thevenet
+        getchoo
+        RossSmyth
+      ];
+    };
+  });
+in
+
+if extraPackages == null then television else television.withPackages (lib.const extraPackages)
@@ -0,0 +1,33 @@
+{
+  lib,
+  symlinkJoin,
+  television,
+  makeBinaryWrapper,
+  extraPackages,
+}:
+
+symlinkJoin {
+  inherit (television) version;
+  pname = "${television.pname}-with-pkgs";
+
+  paths = [ television ];
+
+  nativeBuildInputs = [ makeBinaryWrapper ];
+
+  postBuild = ''
+    wrapProgram $out/bin/tv \
+      --prefix PATH : "${lib.makeBinPath extraPackages}"
+  '';
+
+  meta = {
+    inherit (television.meta)
+      description
+      longDescription
+      homepage
+      changelog
+      license
+      mainProgram
+      maintainers
+      ;
+  };
+}
@@ -17,8 +17,8 @@

 stdenv.mkDerivation rec {
  pname = "termius";
-  version = "9.28.0";
-  revision = "234";
+  version = "9.32.2";
+  revision = "240";

  src = fetchurl {
    # find the latest version with
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
    # and the sha512 with
    # curl -H 'X-Ubuntu-Series: 16' https://api.snapcraft.io/api/v1/snaps/details/termius-app | jq '.download_sha512' -r
    url = "https://api.snapcraft.io/api/v1/snaps/download/WkTBXwoX81rBe3s3OTt3EiiLKBx2QhuS_${revision}.snap";
-    hash = "sha512-2zGt4nL8E99s4J9vmzKoOGgEI3XnEx3m7JwFkWuT5wYv/JWoJWnh9dNWlHzRHPpLU8/lAZUG2F4AVYCmPGa96A==";
+    hash = "sha512-TPfQ413zbnuKAhflLZPvLeVdrqdUEi+I/inWAs8SJ1j8rYW1TrHDyMB8S/HpWboRWXmUhPHulNXfGpHKUu453Q==";
  };

  desktopItem = makeDesktopItem {
@@ -27,6 +27,11 @@ stdenv.mkDerivation rec {
    runHook postInstall
  '';

+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "cmake_minimum_required(VERSION 2.6)" "cmake_minimum_required(VERSION 3.10)"
+  '';
+
  meta = {
    description = "Quality Tetrahedral Mesh Generator and 3D Delaunay Triangulator";
    mainProgram = "tetgen";
@@ -28,6 +28,11 @@ stdenv.mkDerivation {
    "-Wno-error=sign-compare"
  ];

+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "cmake_minimum_required(VERSION 3.1)" "cmake_minimum_required(VERSION 3.10)"
+  '';
+
  meta = with lib; {
    homepage = "https://github.com/tinyalsa/tinyalsa";
    description = "Tiny library to interface with ALSA in the Linux kernel";
@@ -41,6 +41,14 @@ stdenv.mkDerivation rec {
    "-DBUILD_SHARED_LIBS=ON"
  ];

+  # CMake 2.8 is deprecated and is no longer supported by CMake > 4
+  # https://github.com/NixOS/nixpkgs/issues/445447
+  postPatch = ''
+    substituteInPlace CMakeLists.txt --replace-fail \
+      "cmake_minimum_required(VERSION 2.8)" \
+      "cmake_minimum_required(VERSION 3.10)"
+  '';
+
  postBuild = "make doc";

  postInstall = ''
@@ -1,26 +1,26 @@
 {
-  lib,
-  stdenv,
+  btrfs-progs,
  buildGoModule,
  fetchFromGitHub,
-  btrfs-progs,
-  writableTmpDirAsHomeHook,
  installShellFiles,
+  lib,
+  stdenv,
  versionCheckHook,
+  writableTmpDirAsHomeHook,
 }:
 buildGoModule (finalAttrs: {
  pname = "werf";
-  version = "2.49.0";
+  version = "2.51.0";

  src = fetchFromGitHub {
    owner = "werf";
    repo = "werf";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-K999EgTbyQeLO1xm94WeOAQ5Ld3stOuAI4LGs4fSU5g=";
+    hash = "sha256-ZvEX834FLSQ5va5hbWxDibx0D6r9RZ8y4S6kNhVUEpM=";
  };

  proxyVendor = true;
-  vendorHash = "sha256-Vjce/pmFRusBOJEQjgrlhS4LPlOy4nOWwCm7o5BB+OQ=";
+  vendorHash = "sha256-qy0eDvDSvudNRSmYwl3YUOpZJ/I0GQ6ITUVQCZCG4eU=";

  subPackages = [ "cmd/werf" ];

@@ -16,13 +16,13 @@ assert (!blas.isILP64) && (!lapack.isILP64);

 stdenv.mkDerivation (finalAttrs: {
  pname = "xnec2c";
-  version = "4.4.16";
+  version = "4.4.17";

  src = fetchFromGitHub {
    owner = "KJ7LNW";
    repo = "xnec2c";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-W8JwbCSXt5cjgncOzV1wltPnJxwWC6B29eaT8emIU9Y=";
+    hash = "sha256-ZxKpClB5IBfcpIOJsGVSiZU8WGu/8Yzeru96uCKkCGQ=";
  };

  nativeBuildInputs = [
@@ -51,6 +51,11 @@ stdenv.mkDerivation {
    openssl
  ];

+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "cmake_minimum_required(VERSION 2.6)" "cmake_minimum_required(VERSION 3.10)"
+  '';
+
  meta = with lib; {
    broken = stdenv.hostPlatform.isDarwin;
    homepage = "http://planetbeing.lighthouseapp.com/projects/15246-xpwn";
@@ -5,13 +5,13 @@
 }:
 mkYaziPlugin {
  pname = "mount.yazi";
-  version = "25.5.31-unstable-2025-08-11";
+  version = "25.5.31-unstable-2025-10-13";

  src = fetchFromGitHub {
    owner = "yazi-rs";
    repo = "plugins";
-    rev = "e95c7b384e7b0a9793fe1471f0f8f7810ef2a7ed";
-    hash = "sha256-TUS+yXxBOt6tL/zz10k4ezot8IgVg0/2BbS8wPs9KcE=";
+    rev = "9a52857eac61ede58d11c06ca813c3fa63fe3609";
+    hash = "sha256-YM53SsE10wtMqI1JGa4CqZbAgr7h62MZ5skEdAavOVA=";
  };

  meta = {
@@ -28,6 +28,14 @@ stdenv.mkDerivation {
    inherit lua;
  };

+  # CMake 2.8.3 is deprecated and is no longer supported by CMake > 4
+  # https://github.com/NixOS/nixpkgs/issues/445447
+  postPatch = ''
+    substituteInPlace CMakeLists.txt --replace-fail \
+      "cmake_minimum_required(VERSION 2.8.3)" \
+      "cmake_minimum_required(VERSION 3.10)"
+  '';
+
  patches = [ ./0.9.1-discover-luajit.patch ];

  meta = {
@@ -29,6 +29,13 @@ stdenv.mkDerivation rec {

  setupHook = ./cmake-setup-hook.sh;

+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "cmake_minimum_required(VERSION 2.8.7)" "cmake_minimum_required(VERSION 3.10)"
+    substituteInPlace webOS/webOS.cmake \
+      --replace-fail "cmake_minimum_required(VERSION 2.8.7)" "cmake_minimum_required(VERSION 3.10)"
+  '';
+
  meta = with lib; {
    description = "CMake modules needed to build Open WebOS components";
    license = licenses.asl20;
@@ -24,6 +24,11 @@ stdenv.mkDerivation rec {
    webos.cmake-modules
  ];

+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "cmake_minimum_required(VERSION 2.8.7)" "cmake_minimum_required(VERSION 3.10)"
+  '';
+
  postInstall = ''
    install -Dm755 -t $out/bin ../scripts/novaterm
    substituteInPlace $out/bin/novaterm --replace "exec novacom" "exec $out/bin/novacom"
@@ -49,6 +49,11 @@ stdenv.mkDerivation rec {

  passthru.tests = { inherit (nixosTests) novacomd; };

+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "cmake_minimum_required(VERSION 2.8.7)" "cmake_minimum_required(VERSION 3.10)"
+  '';
+
  meta = with lib; {
    description = "Daemon for communicating with WebOS devices";
    mainProgram = "novacomd";
@@ -0,0 +1,25 @@
+{
+  buildDunePackage,
+  dolmen,
+  dolmen_loop,
+  farith,
+  ppx_deriving,
+  zarith,
+}:
+
+buildDunePackage {
+  pname = "dolmen_model";
+  inherit (dolmen) src version;
+
+  propagatedBuildInputs = [
+    dolmen
+    dolmen_loop
+    farith
+    ppx_deriving
+    zarith
+  ];
+
+  meta = dolmen.meta // {
+    description = "Dolmen library for verifying models generated by automated theorem provers and SMT solvers";
+  };
+}
@@ -1217,18 +1217,30 @@ with self;
    ];
  };

-  ppx_derive_at_runtime = janePackage {
-    pname = "ppx_derive_at_runtime";
-    hash = "sha256-Y/z4BKFRt3z1lUGdc7SznIv/ys//dZHoPSnsouj1GtI=";
-    meta.description = "Define a new ppx deriver by naming a runtime module";
-    propagatedBuildInputs = [
-      base
-      expect_test_helpers_core
-      ppx_jane
-      ppxlib
-    ];
-    meta.broken = lib.versionAtLeast ppxlib.version "0.36";
-  };
+  ppx_derive_at_runtime = janePackage (
+    {
+      pname = "ppx_derive_at_runtime";
+      meta.description = "Define a new ppx deriver by naming a runtime module";
+      propagatedBuildInputs = [
+        base
+        expect_test_helpers_core
+        ppx_jane
+        ppxlib
+      ];
+    }
+    // (
+      if lib.versionAtLeast ppxlib.version "0.36" then
+        {
+          version = "0.17.1";
+          hash = "sha256-bbUV2t8MhqDCHDJp7fqJTnRrfZdYO8DLnygqQF0+ouY=";
+        }
+      else
+        {
+          version = "0.17.0";
+          hash = "sha256-Y/z4BKFRt3z1lUGdc7SznIv/ys//dZHoPSnsouj1GtI=";
+        }
+    )
+  );

  ppx_diff = janePackage (
    {
@@ -1425,18 +1437,30 @@ with self;
    ];
  };

-  ppx_jsonaf_conv = janePackage {
-    pname = "ppx_jsonaf_conv";
-    hash = "sha256-v7CYOJ1g4LkqIv5De5tQjjkBWXqKHbvqfSr0X5jBUuM=";
-    meta.description = "[@@deriving] plugin to generate Jsonaf conversion functions";
-    propagatedBuildInputs = [
-      base
-      jsonaf
-      ppx_jane
-      ppxlib
-    ];
-    meta.broken = lib.versionAtLeast ppxlib.version "0.36";
-  };
+  ppx_jsonaf_conv = janePackage (
+    {
+      pname = "ppx_jsonaf_conv";
+      meta.description = "[@@deriving] plugin to generate Jsonaf conversion functions";
+      propagatedBuildInputs = [
+        base
+        jsonaf
+        ppx_jane
+        ppxlib
+      ];
+    }
+    // (
+      if lib.versionAtLeast ppxlib.version "0.36" then
+        {
+          version = "0.17.1";
+          hash = "sha256-BnkYY+Td9zV++PuPs/gm5U58rCZjew1OJQ2k8KE+dfA=";
+        }
+      else
+        {
+          version = "0.17.0";
+          hash = "sha256-v7CYOJ1g4LkqIv5De5tQjjkBWXqKHbvqfSr0X5jBUuM=";
+        }
+    )
+  );

  ppx_js_style = janePackage (
    {
@@ -1543,13 +1567,25 @@ with self;
    ];
  };

-  ppx_pattern_bind = janePackage {
-    pname = "ppx_pattern_bind";
-    hash = "sha256-IVDvFU9ERB2YFJOgP/glYcO4KhEH5VdQ7wCCfreboqA=";
-    meta.description = "PPX for writing fast incremental bind nodes in a pattern match";
-    propagatedBuildInputs = [ ppx_let ];
-    meta.broken = lib.versionAtLeast ppxlib.version "0.36";
-  };
+  ppx_pattern_bind = janePackage (
+    {
+      pname = "ppx_pattern_bind";
+      meta.description = "PPX for writing fast incremental bind nodes in a pattern match";
+      propagatedBuildInputs = [ ppx_let ];
+    }
+    // (
+      if lib.versionAtLeast ppxlib.version "0.36" then
+        {
+          version = "0.17.1";
+          hash = "sha256-O3FtpXrFoyMI3iPL3BUwquREy+8TygOlyaTUGBUPk4Q=$";
+        }
+      else
+        {
+          version = "0.17.0";
+          hash = "sha256-IVDvFU9ERB2YFJOgP/glYcO4KhEH5VdQ7wCCfreboqA=";
+        }
+    )
+  );

  ppx_pipebang = janePackage {
    pname = "ppx_pipebang";
@@ -1570,26 +1606,38 @@ with self;
    doCheck = false; # test rules broken
  };

-  ppx_quick_test = janePackage {
-    pname = "ppx_quick_test";
-    hash = "sha256-Kxb0IJcosC4eYlUjEfZE9FhY8o1/gDHHLWD5Cby5hXY=";
-    meta.description = "Spiritual equivalent of let%expect_test, but for property based tests";
-    propagatedBuildInputs = [
-      async
-      async_kernel
-      base
-      base_quickcheck
-      core
-      core_kernel
-      expect_test_helpers_core
-      ppx_expect
-      ppx_here
-      ppx_jane
-      ppx_sexp_conv
-      ppx_sexp_message
-    ];
-    meta.broken = lib.versionAtLeast ppxlib.version "0.36";
-  };
+  ppx_quick_test = janePackage (
+    {
+      pname = "ppx_quick_test";
+      meta.description = "Spiritual equivalent of let%expect_test, but for property based tests";
+      propagatedBuildInputs = [
+        async
+        async_kernel
+        base
+        base_quickcheck
+        core
+        core_kernel
+        expect_test_helpers_core
+        ppx_expect
+        ppx_here
+        ppx_jane
+        ppx_sexp_conv
+        ppx_sexp_message
+      ];
+    }
+    // (
+      if lib.versionAtLeast ppxlib.version "0.36" then
+        {
+          version = "0.17.1";
+          hash = "sha256-nSgi0MAmOWhk53x6U5Wmv/5zTxBiErWQqoT6ATBOv3w=";
+        }
+      else
+        {
+          version = "0.17.0";
+          hash = "sha256-Kxb0IJcosC4eYlUjEfZE9FhY8o1/gDHHLWD5Cby5hXY=";
+        }
+    )
+  );

  ppx_sexp_conv = janePackage (
    {
@@ -1711,17 +1759,29 @@ with self;
    )
  );

-  ppx_typed_fields = janePackage {
-    pname = "ppx_typed_fields";
-    hash = "sha256-aTPEBBc1zniZkEmzubGkU064bwGnefBOjVDqTdPm2w8=";
-    meta.description = "GADT-based field accessors and utilities";
-    propagatedBuildInputs = [
-      core
-      ppx_jane
-      ppxlib
-    ];
-    meta.broken = lib.versionAtLeast ppxlib.version "0.36";
-  };
+  ppx_typed_fields = janePackage (
+    {
+      pname = "ppx_typed_fields";
+      meta.description = "GADT-based field accessors and utilities";
+      propagatedBuildInputs = [
+        core
+        ppx_jane
+        ppxlib
+      ];
+    }
+    // (
+      if lib.versionAtLeast ppxlib.version "0.36" then
+        {
+          version = "0.17.1";
+          hash = "sha256-M+UhZst98gRg6pVg828UZn8AEFK2a/KAzGkuUkWoBaI=";
+        }
+      else
+        {
+          version = "0.17.0";
+          hash = "sha256-aTPEBBc1zniZkEmzubGkU064bwGnefBOjVDqTdPm2w8=";
+        }
+    )
+  );

  ppx_typerep_conv = janePackage (
    {
@@ -2040,21 +2100,33 @@ with self;
    ];
  };

-  streamable = janePackage {
-    pname = "streamable";
-    hash = "sha256-FtrAX4nsacCO5HTVxwLgwwT8R2sASJ05qu4gT2ZVSDg=";
-    meta.description = "Collection of types suitable for incremental serialization";
-    propagatedBuildInputs = [
-      async_kernel
-      async_rpc_kernel
-      base
-      core
-      core_kernel
-      ppx_jane
-      ppxlib
-    ];
-    meta.broken = lib.versionAtLeast ppxlib.version "0.36";
-  };
+  streamable = janePackage (
+    {
+      pname = "streamable";
+      meta.description = "Collection of types suitable for incremental serialization";
+      propagatedBuildInputs = [
+        async_kernel
+        async_rpc_kernel
+        base
+        core
+        core_kernel
+        ppx_jane
+        ppxlib
+      ];
+    }
+    // (
+      if lib.versionAtLeast ppxlib.version "0.36" then
+        {
+          version = "0.17.1";
+          hash = "sha256-3d7tByQCOfA44wSBKbHXDvyomenWVaEDMHujlK++n8Y=";
+        }
+      else
+        {
+          version = "0.17.0";
+          hash = "sha256-FtrAX4nsacCO5HTVxwLgwwT8R2sASJ05qu4gT2ZVSDg=";
+        }
+    )
+  );

  textutils = janePackage {
    pname = "textutils";
@@ -4,27 +4,36 @@
  fetchpatch,
  applyPatches,
  buildDunePackage,
+  ocaml,
  cppo,
  gettext,
  fileutils,
  ounit2,
 }:

-buildDunePackage rec {
+buildDunePackage (finalAttrs: {
  pname = "gettext";
  version = "0.5.0";

  src = applyPatches {
    src = fetchurl {
-      url = "https://github.com/gildor478/ocaml-gettext/releases/download/v${version}/gettext-${version}.tbz";
+      url = "https://github.com/gildor478/ocaml-gettext/releases/download/v${finalAttrs.version}/gettext-${finalAttrs.version}.tbz";
      hash = "sha256-CN2d9Vsq8YOOIxK+S+lCtDddvBjCrtDKGSRIh1DjT10=";
    };
-    # Disable dune sites
-    # See https://github.com/gildor478/ocaml-gettext/pull/37
-    patches = fetchpatch {
-      url = "https://github.com/gildor478/ocaml-gettext/commit/5462396bee53cb13d8d6fde4c6d430412a17b64d.patch";
-      hash = "sha256-tOR+xgZTadvNeQpZnFTJEvZglK8P+ySvYnE3c1VWvKQ=";
-    };
+    patches = [
+      # Disable dune sites
+      # See https://github.com/gildor478/ocaml-gettext/pull/37
+      (fetchpatch {
+        url = "https://github.com/gildor478/ocaml-gettext/commit/5462396bee53cb13d8d6fde4c6d430412a17b64d.patch";
+        hash = "sha256-tOR+xgZTadvNeQpZnFTJEvZglK8P+ySvYnE3c1VWvKQ=";
+      })
+    ]
+    # Compatibility with OCaml ≥ 5.4
+    # See https://github.com/gildor478/ocaml-gettext/pull/41
+    ++ lib.optional (lib.versionAtLeast ocaml.version "5.4") (fetchpatch {
+      url = "https://github.com/gildor478/ocaml-gettext/commit/5d521981e39dcaeada6bbe7b15c5432d6de5d33c.patch";
+      hash = "sha256-82ajmpyXSd2RdVq/ND4lS8PIugRSkKe5oL8BL9CsLo4=";
+    });
  };

  nativeBuildInputs = [ cppo ];
@@ -46,4 +55,4 @@ buildDunePackage rec {
    maintainers = [ ];
    mainProgram = "ocaml-gettext";
  };
-}
+})
@@ -7,10 +7,12 @@
  menhir,
  bos,
  cmdliner,
+  dolmen_model,
  dolmen_type,
  fpath,
  hc,
  menhirLib,
+  mtime,
  # fix eval on legacy ocaml versions
  ocaml_intrinsics ? null,
  patricia-tree,
@@ -23,15 +25,15 @@
  ounit2,
 }:

-buildDunePackage rec {
+buildDunePackage (finalAttrs: {
  pname = "smtml";
-  version = "0.10.0";
+  version = "0.12.0";

  src = fetchFromGitHub {
    owner = "formalsec";
    repo = "smtml";
-    tag = "v${version}";
-    hash = "sha256-WXGYk/zJnW6QzHKCHl0lkmYb/pG90/sAOK40wYzK35U=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-WETSvhy5OfztOTqJimym0OaZLo053nl8pcoQlyyP8I0=";
  };

  nativeBuildInputs = [
@@ -41,10 +43,12 @@ buildDunePackage rec {
  propagatedBuildInputs = [
    bos
    cmdliner
+    dolmen_model
    dolmen_type
    fpath
    hc
    menhirLib
+    mtime
    ocaml_intrinsics
    patricia-tree
    prelude
@@ -63,14 +67,19 @@ buildDunePackage rec {
    mdx.bin
  ];

-  doCheck = !(lib.versions.majorMinor ocaml.version == "5.0" || stdenv.hostPlatform.isDarwin);
+  doCheck =
+    !(
+      lib.versions.majorMinor ocaml.version == "5.0"
+      || lib.versions.majorMinor ocaml.version == "5.4"
+      || stdenv.hostPlatform.isDarwin
+    );

  meta = {
    description = "SMT solver frontend for OCaml";
    homepage = "https://formalsec.github.io/smtml/smtml/";
    downloadPage = "https://github.com/formalsec/smtml";
-    changelog = "https://github.com/formalsec/smtml/releases/tag/v${version}";
+    changelog = "https://github.com/formalsec/smtml/releases/tag/v${finalAttrs.version}";
    license = lib.licenses.mit;
    maintainers = [ lib.maintainers.ethancedwards8 ];
  };
-}
+})
@@ -11,13 +11,13 @@

 buildPecl rec {
  pname = "memcached";
-  version = "3.3.0";
+  version = "3.4.0";

  src = fetchFromGitHub {
    owner = "php-memcached-dev";
    repo = "php-memcached";
    rev = "v${version}";
-    sha256 = "sha256-V4d6bY0m1nuEfjZjt3qio4/HOBcSlD9+XMEl1GPfbhs=";
+    sha256 = "sha256-sweEM4TVId+6ySffulmebZpz390dZXb+G3zFZvc45L8=";
  };

  internalDeps = [ php.extensions.session ];
@@ -7,16 +7,16 @@

 php.buildComposerProject2 (finalAttrs: {
  pname = "phpstan";
-  version = "2.1.29";
+  version = "2.1.31";

  src = fetchFromGitHub {
    owner = "phpstan";
    repo = "phpstan-src";
    tag = finalAttrs.version;
-    hash = "sha256-8HPMXJ64qkV6fXfdr6fZTp2m1EhcWiq0cE51VQHuyro=";
+    hash = "sha256-vQTZ59qEqZYLoh8eAX+wqBvLTHKTvMIOkFDfuEG9k9M=";
  };

-  vendorHash = "sha256-mSlxWkqhniphYUOjE0zucOqN9gKe3Th0GEikB7DyYVY=";
+  vendorHash = "sha256-ysGcIpsYpZSuysG5Fw5IVSyO/GSnAkF79GnPF8Dttpk=";
  composerStrictValidation = false;

  doInstallCheck = true;
@@ -15,36 +15,36 @@
 }:

 let
-  version = "0.12.0";
+  version = "0.12.1";
  hashes = {
    "aarch64-darwin" = {
      platform = "darwin-arm64";
      hash = {
-        "8.1" = "sha256-AH8FzXjIPojCxTQqDChuZPUTDnVPeOeS5a0wNXjlyEk=";
-        "8.2" = "sha256-SdivilTHbr28fHaYxK7o1QIT+sWZGHQDjWC2EgtkBbM=";
-        "8.3" = "RUnmwI5q4jXHkiRuR/PwqnztEX/7y59DA/L7BelreVk=";
-        "8.4" = "sha256-y76rICDyrA/ogRxK+4C3JvJ4ch1fNLBrY01zMmcldnw=";
-        "8.5" = "W7BwODGEcRc6E7jpX1nojak7jDV5X+0tjgk32F82wvQ=";
+        "8.1" = "sha256-a9FLBAYX3hSHcR0AqScKNlpIK36V3FXK3w8Oq3m+VSQ=";
+        "8.2" = "sha256-1pJI38OKV4ER4m6bGfMjQIXfSjwBgz6+YsBfVlGE3g8=";
+        "8.3" = "G82BIJ5ha5hBq/zlZfxwC2HVgBuih+wvSUe2e3fUqcg=";
+        "8.4" = "sha256-MDn49LuXMR66TjTLdKYodPSya37m7LEZSAJRi6h+fTQ=";
+        "8.5" = "4BihkHnZIJ+lExoYzE/LcMTQp/IQOexzVsUQQkczYOQ=";
      };
    };
    "aarch64-linux" = {
      platform = "debian-aarch64+libssl3";
      hash = {
-        "8.1" = "sha256-Zg1DdzJKfovGwA+cTR5hDQ1Or8oPRrtsyBu3Zt+/6yg=";
-        "8.2" = "sha256-tV7aoi9aiUrpOufmN4pQKi0Q0Ad6wrajq9SnaeZGlKg=";
-        "8.3" = "sha256-zJN+RSzFXjOB3Uajk1Adrphbz7NAbWMcuB88RRK7SlY=";
-        "8.4" = "qvXUg3GqqN3UUtDPQz1H2BiG/b8SomGLyIPR1NIkFUA=";
-        "8.5" = "GZZa4a+MfoQPlpIA6zOEnD4UdErh/9fLhMp20rOmGIE=";
+        "8.1" = "sha256-zYOckcqgarf3a/dbnv6dj3fq8l2eKO08DnkjAqoGUAE=";
+        "8.2" = "sha256-TrObjYHv0n5XjR7y1VnL5ROTZYKd9WKM4Sb0ToMk+qc=";
+        "8.3" = "sha256-m5wJcskJSDn1C+6X2D7wv5qyiq4MDMZgNo6l/w56hUw=";
+        "8.4" = "3dFTZUm9g+kzIcQtbILa+ETnNCEmg/03O7gcIPBpils=";
+        "8.5" = "PFhnzciKFD62y48BY2wOP9aOMQL6JC69qPqZNQpEVDY=";
      };
    };
    "x86_64-linux" = {
      platform = "debian-x86-64+libssl3";
      hash = {
-        "8.1" = "sha256-NTCRrTuiPDbKBauY+9nQm4oJn9TwHQvNfynSKk/bZ7w=";
-        "8.2" = "sha256-9GwMHf0GIErr0vZieCH5D5tvJiekpOdBo/u1P30L9lc=";
-        "8.3" = "sha256-180n5Naz6dQRCQCj7r0CJhRqfmEHjM7jgkmWRAvyFaY=";
-        "8.4" = "nGgvhtuita+rTtns+33xDDEaIXcd3aYiCAClizWtE1E=";
-        "8.5" = "wvxZ7jUrqXImzH1LEUmvxpxKL4NE0tAtu9M25P82d0w=";
+        "8.1" = "sha256-qJcMtjoQ4iej70SjqnSPF2sNbhMDdTQ6ThX/J4bgZuo=";
+        "8.2" = "sha256-/lIDyQue7Azgx12A4nx3baFbOjHV+ubX6u0wELPhPyI=";
+        "8.3" = "sha256-Jh17Gg1r7/yjX7aJxKSRQdptH6Nf1p3rPlIzqhpp7tQ=";
+        "8.4" = "y+KBe+6gCJ9bdkCIgUDeQLsBE/AsydHULBwjEhjdDAk=";
+        "8.5" = "+wTZw3w55viegnGGQWw55gRx2Hv/XsIDlkVVemklpro=";
      };
    };
  };
@@ -6,7 +6,7 @@
 }:

 let
-  version = "0.4.21";
+  version = "0.4.22";
 in
 buildPecl {
  inherit version;
@@ -16,7 +16,7 @@ buildPecl {
    owner = "NoiseByNorthwest";
    repo = "php-spx";
    rev = "v${version}";
-    hash = "sha256-3rVnKUZZXLxoKCW717pCiPOVWDudQpoN8lC1jQzpwuw=";
+    hash = "sha256-P53g/o4i+QETWdErZaGA3AREvnr8kL9h0B1BMQlKdFA=";
  };

  configureFlags = [
@@ -0,0 +1,51 @@
+{
+  lib,
+  stdenv,
+  buildPythonPackage,
+  fetchPypi,
+  setuptools,
+  numpy,
+  imageio,
+  docutils,
+  ddt,
+  matplotlib,
+}:
+let
+  pname = "color-matcher";
+  version = "0.6.0";
+in
+buildPythonPackage {
+  inherit pname version;
+  pyproject = true;
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-e6igB4LD5eWTHdp7H7nFcqzoLeDGyXZUQyt8/gqnSEM=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    numpy
+    imageio
+    docutils
+    ddt
+    matplotlib
+  ];
+
+  postPatch = ''
+    ln -s */requires.txt requirements.txt
+  '';
+
+  # Some tests are broken and many require internet access
+  doCheck = false;
+
+  meta = {
+    description = "Package enabling color transfer across images";
+    homepage = "https://github.com/hahnec/color-matcher";
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ blenderfreaky ];
+    # requires py2app which is not packaged for darwin
+    broken = stdenv.hostPlatform.isDarwin;
+  };
+}
@@ -9,21 +9,18 @@
  protobuf,
  pytest-asyncio,
  pytestCheckHook,
-  pythonOlder,
  setuptools,
 }:

 buildPythonPackage rec {
  pname = "google-cloud-vpc-access";
-  version = "1.13.2";
+  version = "1.14.0";
  pyproject = true;

-  disabled = pythonOlder "3.8";
-
  src = fetchPypi {
    pname = "google_cloud_vpc_access";
    inherit version;
-    hash = "sha256-bfTho0kyaAQRWjAZJWFd/NFJ+EY7ZEtdOGcbb3MnJ6s=";
+    hash = "sha256-N1CpDs/TgSCjJOnNwOJCaS7MWur95uoztvl+R5DjYC0=";
  };

  build-system = [ setuptools ];
@@ -2,20 +2,17 @@
  lib,
  buildPythonPackage,
  fetchPypi,
-  pythonOlder,
  setuptools,
 }:

 buildPythonPackage rec {
  pname = "mailchecker";
-  version = "6.0.18";
+  version = "6.0.19";
  pyproject = true;

-  disabled = pythonOlder "3.7";
-
  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-xX6Vr7hEi4o1OQjKUUrVEKZIOppbA+4hlN1XrV1vEnk=";
+    hash = "sha256-MuLQdGiFZbhd/1Zc+VnTo3UW3EAyISzz/c1F3D0F2UE=";
  };

  build-system = [ setuptools ];
@@ -15,14 +15,14 @@

 buildPythonPackage rec {
  pname = "mcstatus";
-  version = "12.0.5";
+  version = "12.0.6";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "py-mine";
    repo = "mcstatus";
    tag = "v${version}";
-    hash = "sha256-gtLWUIxG40MsmavA4KrHJ3btCR/zKdstwiUiZGsoNcw=";
+    hash = "sha256-lo96dZ7YaqZz/fmhuo8XWm5tSsB6ixtdxkZ3Hd6mq78=";
  };

  build-system = [
@@ -8,14 +8,14 @@

 buildPythonPackage rec {
  pname = "openstep-parser";
-  version = "2.0.1";
+  version = "2.0.3";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "kronenthaler";
    repo = "openstep-parser";
    tag = version;
-    hash = "sha256-gvfzBLLaal0Vad3C4m4wIKwJpmlhewsK4A5yeN8l6qU=";
+    hash = "sha256-ivPvkvVWXw5ftaGvwBR+JxBIlisI0p6k3i/8V2HlaqQ=";
  };

  build-system = [ setuptools ];
@@ -10,19 +10,19 @@

 buildPythonPackage rec {
  pname = "pcodec";
-  version = "0.4.6";
+  version = "0.4.7";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "pcodec";
    repo = "pcodec";
    tag = "v${version}";
-    hash = "sha256-5NB+PoCS6yGT8N+MD4mdMRRMKCmlQcqdFPTW924UVgU=";
+    hash = "sha256-B96kMozVXLoLv0xP2o5IkI+d+4j0wIy4G4VruFS9b6M=";
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
    inherit pname version src;
-    hash = "sha256-vHADxRV9DOYhUg3IOm1HNk3RHB0/WKluD2PH3Hg8k7s=";
+    hash = "sha256-N1KOCZKpz+7yzCefv8AUk1kEmpct//mVCp7a8EW02oA=";
  };

  buildAndTestSubdir = "pco_python";
@@ -44,14 +44,14 @@

 buildPythonPackage rec {
  pname = "scanpy";
-  version = "1.11.4";
+  version = "1.11.5";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "scverse";
    repo = "scanpy";
    tag = version;
-    hash = "sha256-EvNelorfLOpYLGGZ1RSq4+jk6emuCWCKBdUop24iLf4=";
+    hash = "sha256-GnZ1qJ4SaTLDzfLAH6IHrYeuMBo8PglKUlj4f3ljeR0=";
  };

  build-system = [
@@ -21,6 +21,10 @@ buildPythonPackage rec {
    hash = "sha256-0CIekVxChvH912vFnBF2FR1YyIpxi3SD7KhBlh7yFGA=";
  };

+  # Define _POSIX_C_SOURCE to enable POSIX signal handling for ARM capability detection
+  # See: https://github.com/ashvardanian/StringZilla/pull/263
+  env.NIX_CFLAGS_COMPILE = "-D_POSIX_C_SOURCE=200809L";
+
  postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
    # error: unsupported option '-mfloat-abi=' for target 'aarch64-apple-darwin'
    substituteInPlace setup.py \
@@ -46,6 +50,9 @@ buildPythonPackage rec {
    description = "SIMD-accelerated string search, sort, hashes, fingerprints, & edit distances";
    homepage = "https://github.com/ashvardanian/stringzilla";
    license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ dotlambda ];
+    maintainers = with lib.maintainers; [
+      aciceri
+      dotlambda
+    ];
  };
 }
@@ -19,7 +19,7 @@

 buildPythonPackage rec {
  pname = "tree-sitter-language-pack";
-  version = "0.9.1";
+  version = "0.10.0";
  pyproject = true;

  # Using the GitHub sources necessitates fetching the treesitter grammar parsers by using a vendored script.
@@ -28,7 +28,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    pname = "tree_sitter_language_pack";
    inherit version;
-    hash = "sha256-LaU5dR7MULnmu/yji1dQGjxV5nGGqTnVvxSdnLciCXQ=";
+    hash = "sha256-oWGLKYKLZEIu1rKhEYdZnFUheBNI/t2EIPAfb1A5ofw=";
  };

  # Upstream bumped dependencies aggressively, but we can still use older
@@ -12,19 +12,19 @@

 buildPythonPackage rec {
  pname = "tree-sitter-yaml";
-  version = "0.7.1";
+  version = "0.7.2";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "tree-sitter-grammars";
    repo = "tree-sitter-yaml";
    tag = "v${version}";
-    hash = "sha256-Z2L/aQWIyZ8cSqbfjm/i10fJP++yZ2tZgho0U3asA0g=";
+    hash = "sha256-BX6TOfAZLW+0h2TNsgsLC9K2lfirraCWlBN2vCKiXQ4=";
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
    inherit src;
-    hash = "sha256-QvqvyjnCgSuSiiY4SB5nB9S7LnGP1F+tySxue359SWY=";
+    hash = "sha256-mrLuGmauboKHHk0zADPXpwgZfc83syXk0jmD93Y9Jq4=";
  };

  build-system = [
@@ -10,14 +10,14 @@

 buildPythonPackage rec {
  pname = "wslink";
-  version = "2.4.0";
+  version = "2.5.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "kitware";
    repo = "wslink";
    tag = "v${version}";
-    hash = "sha256-IFXxMN+OXJ/J2BSegxOBjE4iSA27pLyCpyyx4hmo9NU=";
+    hash = "sha256-g1I8qCuqfv+pA3IP7b57PZ7vCsykpfJNG97NgJ+N5lE=";
  };

  sourceRoot = "${src.name}/python";
@@ -231,21 +231,15 @@ let
      );
      mpi = self.openmpi;

-      ## Meta ##
-      # Emulate common ROCm meta layout
-      # These are mainly for users. I strongly suggest NOT using these in nixpkgs derivations
-      # Don't put these into `propagatedBuildInputs` unless you want PATH/PYTHONPATH issues!
-      # See: https://rocm.docs.amd.com/en/docs-5.7.1/_images/image.004.png
-      # See: https://rocm.docs.amd.com/en/docs-5.7.1/deploy/linux/os-native/package_manager_integration.html
-      meta = with self; rec {
+      meta = {
        # eval all pkgsRocm release attrs with
        # nix-eval-jobs --force-recurse pkgs/top-level/release.nix -I . --select "p: p.pkgsRocm" --no-instantiate
-        release-attrPaths = (builtins.fromJSON (builtins.readFile ./release-attrPaths.json)).attrPaths;
        release-packagePlatforms =
          let
            platforms = [
              "x86_64-linux"
            ];
+            attrPaths = (builtins.fromJSON (builtins.readFile ./release-attrPaths.json)).attrPaths;
          in
          lib.foldl' (
            acc: path:
@@ -253,162 +247,7 @@ let
              lib.recursiveUpdate acc (lib.setAttrByPath (lib.splitString "." path) platforms)
            else
              acc
-          ) { } self.meta.release-attrPaths;
-
-        rocm-developer-tools = symlinkJoin {
-          name = "rocm-developer-tools-meta";
-          paths = [
-            aqlprofile
-            rocm-core
-            rocr-debug-agent
-            roctracer
-            rocdbgapi
-            rocprofiler
-            rocgdb
-            rocm-language-runtime
-          ];
-        };
-        rocm-ml-sdk = symlinkJoin {
-          name = "rocm-ml-sdk-meta";
-          paths = [
-            rocm-core
-            miopen-hip
-            rocm-hip-sdk
-            rocm-ml-libraries
-          ];
-        };
-        rocm-ml-libraries = symlinkJoin {
-          name = "rocm-ml-libraries-meta";
-          paths = [
-            llvm.clang
-            llvm.openmp
-            rocm-core
-            miopen-hip
-            rocm-hip-libraries
-          ];
-        };
-        rocm-hip-sdk = symlinkJoin {
-          name = "rocm-hip-sdk-meta";
-          paths = [
-            rocprim
-            rocalution
-            hipfft
-            hiprt
-            rocm-core
-            hipcub
-            hipblas
-            hipblaslt
-            rocrand
-            rocfft
-            rocsparse
-            rccl
-            rocthrust
-            rocblas
-            hipsparse
-            hipfort
-            rocwmma
-            hipsolver
-            rocsolver
-            rocm-hip-libraries
-            rocm-hip-runtime-devel
-          ];
-        };
-        rocm-hip-libraries = symlinkJoin {
-          name = "rocm-hip-libraries-meta";
-          paths = [
-            rocblas
-            hipfort
-            rocm-core
-            rocsolver
-            rocalution
-            rocrand
-            hipblas
-            hipblaslt
-            rocfft
-            hipfft
-            hiprt
-            rccl
-            rocsparse
-            hipsparse
-            hipsolver
-            rocm-hip-runtime
-          ];
-        };
-        rocm-openmp-sdk = symlinkJoin {
-          name = "rocm-openmp-sdk-meta";
-          paths = [
-            rocm-core
-            llvm.clang
-            llvm.openmp # openmp-extras-devel (https://github.com/ROCm/aomp)
-            rocm-language-runtime
-          ];
-        };
-        rocm-opencl-sdk = symlinkJoin {
-          name = "rocm-opencl-sdk-meta";
-          paths = [
-            rocm-core
-            rocm-runtime
-            clr
-            clr.icd
-            rocm-opencl-runtime
-          ];
-        };
-        rocm-opencl-runtime = symlinkJoin {
-          name = "rocm-opencl-runtime-meta";
-          paths = [
-            rocm-core
-            clr
-            clr.icd
-            rocm-language-runtime
-          ];
-        };
-        rocm-hip-runtime-devel = symlinkJoin {
-          name = "rocm-hip-runtime-devel-meta";
-          paths = [
-            clr
-            rocm-core
-            hipify
-            rocm-cmake
-            llvm.clang
-            llvm.openmp
-            rocm-runtime
-            rocm-hip-runtime
-          ];
-        };
-        rocm-hip-runtime = symlinkJoin {
-          name = "rocm-hip-runtime-meta";
-          paths = [
-            rocm-core
-            rocminfo
-            clr
-            rocm-language-runtime
-          ];
-        };
-        rocm-language-runtime = symlinkJoin {
-          name = "rocm-language-runtime-meta";
-          paths = [
-            rocm-runtime
-            rocm-core
-            rocm-comgr
-            llvm.openmp # openmp-extras-runtime (https://github.com/ROCm/aomp)
-          ];
-        };
-        rocm-all = symlinkJoin {
-          name = "rocm-all-meta";
-          paths = [
-            rocm-developer-tools
-            rocm-ml-sdk
-            rocm-ml-libraries
-            rocm-hip-sdk
-            rocm-hip-libraries
-            rocm-openmp-sdk
-            rocm-opencl-sdk
-            rocm-opencl-runtime
-            rocm-hip-runtime-devel
-            rocm-hip-runtime
-            rocm-language-runtime
-          ];
-        };
+          ) { } attrPaths;
      };

      rocm-bandwidth-test = self.callPackage ./rocm-bandwidth-test {
@@ -1,4 +1,6 @@
 {
+  lib,
+  linkFarm,
  clr,
  ollama,
  python3Packages,
@@ -8,6 +10,22 @@
  stdenv,
 }:
 # This package exists purely to have a bunch of passthru.tests attrs
+let
+  availableRocmDrvs = lib.pipe rocmPackages [
+    (lib.mapAttrsToList (
+      name: value: {
+        inherit name;
+        evaluated = builtins.tryEval value;
+      }
+    ))
+    (builtins.filter (x: x.evaluated.success))
+    (map (x: {
+      inherit (x) name;
+      value = x.evaluated.value;
+    }))
+    (builtins.filter (x: lib.isDerivation x.value && (x.value.meta.available or true)))
+  ];
+in
 stdenv.mkDerivation {
  name = "rocm-tests";
  nativeBuildInputs = [
@@ -20,6 +38,12 @@ stdenv.mkDerivation {
      inherit rocmPackages;
      acceleration = "rocm";
    };
+    rocmPackagesDerivations = linkFarm "rocmPackagesDerivations" (
+      map (x: {
+        name = x.name;
+        path = x.value;
+      }) availableRocmDrvs
+    );
    torch = python3Packages.torch.override {
      inherit rocmPackages;
      rocmSupport = true;
@@ -15,8 +15,8 @@ let
      hash = "sha256-z4anrXZEBjldQoam0J1zBxFyCsxtk+nc6ax6xNxKKKc=";
    };
    "10" = {
-      version = "10.18.3";
-      hash = "sha256-eX0AWbxfwzVtecaBYVoTfHs15O/AOkRJqKGr/LzEvcc=";
+      version = "10.19.0";
+      hash = "sha256-HF9e5ZJn5OLhv9M19DKhjcSPmplECU1dJkl1fnJa03Y=";
    };
  };

@@ -0,0 +1,60 @@
+diff --git i/CMakeLists.txt w/CMakeLists.txt
+index 1298088..73a5c2d 100644
+--- i/CMakeLists.txt
+++ w/CMakeLists.txt
+@@ -1,11 +1,11 @@
+ #CMake script for Spheres of Influence
+ #Run 'cmake <source_directory>' to generate a makefile
+-cmake_minimum_required(VERSION 2.6)
+cmake_minimum_required(VERSION 3.10)
+ 
+ #definitions
+ set(PROJECT_NAME "Spheres\ of\ Influence")
+ set(APP_NAME soi)
+-set(PROJECT_VERSION 0 1 2)
+set(PROJECT_VERSION "0.1.2")
+ set(DESCRIPTION "A physics-based 3D puzzle game")
+ set(README README.txt)
+ set(LICENSE ${README})
+@@ -52,7 +52,7 @@ set(CMAKE_MODULE_PATH ${CMAKE_MODULE_PATH}
+     "${CMAKE_SOURCE_DIR}/${EXTRA_MODULES_IN}")
+ 
+ #declare the project
+-project(${PROJECT_NAME})
+project(${PROJECT_NAME} VERSION ${PROJECT_VERSION})
+ 
+ #grab source files
+ file(GLOB_RECURSE HEADERS ${CMAKE_SOURCE_DIR}/src/*.h)
+@@ -105,18 +105,13 @@ endif()
+ #declare the target program
+ add_executable(${APP_NAME} ${SOURCES} ${EXTRA_SOURCES} ${HEADERS})
+ 
+-#extract the proper versioning breakdown
+-list(GET PROJECT_VERSION 0 VERSION_MAJOR )
+-list(GET PROJECT_VERSION 1 VERSION_MINOR )
+-list(GET PROJECT_VERSION 2 VERSION_PATCH )
+-
+ #add some useful preprocessor defines
+ set_property(
+     TARGET ${APP_NAME} PROPERTY COMPILE_DEFINITIONS
+     ${COMPILEDEFS}
+ #     PROJECT_NAME="${PROJECT_NAME}"
+ #     AUTHOR_NAMES="${AUTHORS}"
+-#     PROJECT_VERSION="${VERSION_MAJOR}.${VERSION_MINOR}.${VERSION_PATCH}"
+#     PROJECT_VERSION="${PROJECT_VERSION_MAJOR}.${PROJECT_VERSION_MINOR}.${PROJECT_VERSION_PATCH}"
+ )
+ 
+ #pass on the flags
+@@ -168,9 +163,9 @@ set(CPACK_PACKAGE_INSTALL_DIRECTORY ${PROJECT_NAME})
+ set(CPACK_PACKAGE_DESCRIPTION_FILE ${README})
+ set(CPACK_PACKAGE_DESCRIPTION_SUMMARY ${DESCRIPTION})
+ set(CPACK_PACKAGE_DESCRIPTION ${DESCRIPTION})
+-set(CPACK_PACKAGE_VERSION_MAJOR ${VERSION_MAJOR})
+-set(CPACK_PACKAGE_VERSION_MINOR ${VERSION_MINOR})
+-set(CPACK_PACKAGE_VERSION_PATCH ${VERSION_PATCH})
+set(CPACK_PACKAGE_PROJECT_VERSION_MAJOR ${PROJECT_VERSION_MAJOR})
+set(CPACK_PACKAGE_PROJECT_VERSION_MINOR ${PROJECT_VERSION_MINOR})
+set(CPACK_PACKAGE_PROJECT_VERSION_PATCH ${PROJECT_VERSION_PATCH})
+ #set(CPACK_PACKAGE_EXECUTABLES "${APP_NAME}";${PROJECT_NAME})
+ set(CPACK_RESOURCE_FILE_README ${README})
+ set(CPACK_RESOURCE_FILE_LICENSE ${CMAKE_SOURCE_DIR}/${LICENSE})
@@ -37,6 +37,10 @@ stdenv.mkDerivation rec {
    "-DLUABIND_LIBRARY=${luabind}/lib/libluabind09.a"
  ];

+  # CMake 2.6 is deprecated and is no longer supported by CMake > 4
+  # https://github.com/NixOS/nixpkgs/issues/445447
+  patches = [ ./cmake-4-build.patch ];
+
  meta = with lib; {
    description = "Physics-based puzzle game";
    mainProgram = "soi";
@@ -47,32 +47,52 @@ let
          inherit hash;
        };

-        structuredExtraConfig = with lib.kernel; {
-          # CPUFreq governor Performance
-          CPU_FREQ_DEFAULT_GOV_PERFORMANCE = lib.mkOverride 60 yes;
-          CPU_FREQ_DEFAULT_GOV_SCHEDUTIL = lib.mkOverride 60 no;
+        structuredExtraConfig =
+          with lib.kernel;
+          {
+            # CPUFreq governor Performance
+            CPU_FREQ_DEFAULT_GOV_PERFORMANCE = lib.mkOverride 60 yes;
+            CPU_FREQ_DEFAULT_GOV_SCHEDUTIL = lib.mkOverride 60 no;

-          # Full preemption
-          PREEMPT = lib.mkOverride 60 yes;
-          PREEMPT_VOLUNTARY = lib.mkOverride 60 no;
+            # Preemption
+            PREEMPT = lib.mkOverride 60 yes;
+            PREEMPT_VOLUNTARY = lib.mkOverride 60 no;

-          # Google's BBRv3 TCP congestion Control
-          TCP_CONG_BBR = yes;
-          DEFAULT_BBR = yes;
+            # Google's BBRv3 TCP congestion Control
+            TCP_CONG_BBR = yes;
+            DEFAULT_BBR = yes;

-          # Preemptive Full Tickless Kernel at 250Hz
-          HZ = freeform "250";
-          HZ_250 = yes;
-          HZ_1000 = no;
+            # Preemptive tickless idle kernel
+            HZ = freeform "250";
+            HZ_250 = yes;
+            NO_HZ = no;
+            NO_HZ_FULL = lib.mkOverride 60 no;
+            NO_HZ_IDLE = yes;

-          # RCU_BOOST and RCU_EXP_KTHREAD
-          RCU_EXPERT = yes;
-          RCU_FANOUT = freeform "64";
-          RCU_FANOUT_LEAF = freeform "16";
-          RCU_BOOST = yes;
-          RCU_BOOST_DELAY = freeform "0";
-          RCU_EXP_KTHREAD = yes;
-        };
+            # CPU idle governors favored
+            CPU_IDLE_GOV_HALTPOLL = yes; # Already enabled
+            CPU_IDLE_GOV_LADDER = yes;
+            CPU_IDLE_GOV_TEO = yes;
+
+            # RCU_BOOST and RCU_EXP_KTHREAD
+            RCU_EXPERT = yes;
+            RCU_FANOUT = freeform "64";
+            RCU_FANOUT_LEAF = freeform "16";
+            RCU_BOOST = yes;
+            RCU_BOOST_DELAY = freeform "0";
+            RCU_EXP_KTHREAD = yes;
+            RCU_NOCB_CPU = yes;
+            RCU_DOUBLE_CHECK_CB_TIME = yes;
+
+            # x86 features
+            X86_FRED = yes;
+            X86_POSTED_MSI = yes;
+          }
+          // lib.optionalAttrs (lib.versionAtLeast (lib.versions.majorMinor version) "6.13") {
+            # Lazy preemption
+            PREEMPT = lib.mkOverride 70 no;
+            PREEMPT_LAZY = yes;
+          };

        extraPassthru.updateScript = {
          command = [
@@ -12,13 +12,13 @@ let
 in
 stdenv.mkDerivation {
  pname = "rtw88";
-  version = "0-unstable-2025-09-05";
+  version = "0-unstable-2025-10-20";

  src = fetchFromGitHub {
    owner = "lwfinger";
    repo = "rtw88";
-    rev = "bb0ed9d5709afd30e928d2d11f7b650e03c8c72b";
-    hash = "sha256-ySIj9ZSIwdsn3WDFZ48xUGTFLA1BMU+hjvpDwifq4k4=";
+    rev = "9bc8fecb61d4ad59e46b4dbd003d60ef2d8437a8";
+    hash = "sha256-/nA0U1Ry+xt4F4GC9ymMDFhkiHAqeodv7uUXAaALmdg=";
  };

  nativeBuildInputs = kernel.moduleBuildDependencies;
@@ -57,7 +57,7 @@ in
  };

  jetty_12 = common {
-    version = "12.1.2";
-    hash = "sha256-GtaEIXqOSutgrSJJ/+oFuGSe7y8omVX7sBgcG3GJzvs=";
+    version = "12.1.3";
+    hash = "sha256-+DCfP0tFBouTZqOEzCFaQ4dl78xPFudUzS9hAzUkc7Y=";
  };
 }
@@ -2,8 +2,8 @@

 grafanaPlugin {
  pname = "frser-sqlite-datasource";
-  version = "3.8.0";
-  zipHash = "sha256-wk0zEGQjDdz8bIc7e5aiaqg7AaTS6u8zp+WJy5YlWlQ=";
+  version = "3.8.2";
+  zipHash = "sha256-TJMKHB1loDiBrTWKpIUNfcMTBXhorxqvLrdBEuUspto=";
  meta = with lib; {
    description = "Use a SQLite database as a data source in Grafana";
    license = licenses.asl20;
--- a/Show More
+++ b/Show More