Merge staging-next into staging

2025-05-15 18:06:50 +00:00
parent 82d049a698 cea5312ead
commit ca8177283c
123 changed files with 2078 additions and 5001 deletions
@@ -1,5 +1,16 @@
 { lib }:

+let
+  inherit (lib.strings)
+    concatStringsSep
+    ;
+  inherit (lib.lists)
+    filter
+    ;
+  inherit (lib.trivial)
+    showWarnings
+    ;
+in
 rec {

  /**
@@ -131,4 +142,61 @@ rec {
      "each element in ${name} must be one of ${lib.generators.toPretty { } xs}, but is: ${
        lib.generators.toPretty { } vals
      }";
+
+  /**
+    Wrap a value with logic that throws an error when assertions
+    fail and emits any warnings.
+
+    # Inputs
+
+    `assertions`
+
+    : A list of assertions. If any of their `assertion` attrs is `false`, their `message` attrs will be emitted in a `throw`.
+
+    `warnings`
+
+    : A list of strings to emit as warnings. This function does no filtering on this list.
+
+    `val`
+
+    : A value to return, wrapped in `warn`, if a `throw` is not necessary.
+
+    # Type
+
+    ```
+    checkAssertWarn :: [ { assertion :: Bool; message :: String } ] -> [ String ] -> Any -> Any
+    ```
+
+    # Examples
+    :::{.example}
+    ## `lib.asserts.checkAssertWarn` usage example
+    ```nix
+    checkAssertWarn
+      [ { assertion = false; message = "Will fail"; } ]
+      [ ]
+      null
+    stderr>        error:
+    stderr>        Failed assertions:
+    stderr>        - Will fail
+
+    checkAssertWarn
+      [ { assertion = true; message = "Will not fail"; } ]
+      [ "Will warn" ]
+      null
+    stderr> evaluation warning: Will warn
+    null
+    ```
+
+    :::
+  */
+  checkAssertWarn =
+    assertions: warnings: val:
+    let
+      failedAssertions = map (x: x.message) (filter (x: !x.assertion) assertions);
+    in
+    if failedAssertions != [ ] then
+      throw "\nFailed assertions:\n${concatStringsSep "\n" (map (x: "- ${x}") failedAssertions)}"
+    else
+      showWarnings warnings val;
+
 }
@@ -651,6 +651,11 @@ lib.mapAttrs mkLicense (
      url = "https://fedoraproject.org/wiki/Licensing/GPL_Classpath_Exception";
    };

+    gpl2UBDLPlus = {
+      fullName = "GNU General Public License v3.0 or later (with UBDL exception)";
+      url = "https://spdx.org/licenses/UBDL-exception.html";
+    };
+
    gpl2Oss = {
      fullName = "GNU General Public License version 2 only (with OSI approved licenses linking exception)";
      url = "https://www.mysql.com/about/legal/licensing/foss-exception";
@@ -146,6 +146,10 @@ rec {
  riscv64 = riscv "64";
  riscv32 = riscv "32";

+  riscv64-musl = {
+    config = "riscv64-unknown-linux-musl";
+  };
+
  riscv64-embedded = {
    config = "riscv64-none-elf";
    libc = "newlib";
@@ -11409,6 +11409,17 @@
    githubId = 10786794;
    name = "Markus Hihn";
  };
+  jess = {
+    name = "Jessica";
+    email = "jess+nix@jessie.cafe";
+    github = "ttrssreal";
+    githubId = 43591752;
+    keys = [
+      {
+        fingerprint = "8092 3BD1 ECD0 E436 671D  C8E9 BA33 5068 6C91 8606";
+      }
+    ];
+  };
  jessemoore = {
    email = "jesse@jessemoore.dev";
    github = "jesseDMoore1994";
@@ -562,7 +562,7 @@

 - All services that require a root certificate bundle now use the value of a new read-only option, `security.pki.caBundle`.

- hddfancontrol has been updated to major release 2. See the [migration guide](https://github.com/desbma/hddfancontrol/tree/master?tab=readme-ov-file#migrating-from-v1x), as there are breaking changes.
+- hddfancontrol has been updated to major release 2. See the [migration guide](https://github.com/desbma/hddfancontrol/tree/master?tab=readme-ov-file#migrating-from-v1x), as there are breaking changes. The settings options have been modified to use an attrset, enabling configurations with multiple instances of the daemon running at once, eg, for two separate drive bays.

 - `nextcloud-news-updater` is unmaintained and was removed from nixpkgs.

@@ -3,6 +3,7 @@

 {
  config,
+  options,
  pkgs,
  lib,
  utils,
@@ -258,50 +259,29 @@ in
      '';
    };

+    assertions = lib.mkOption {
+      type = options.assertions.type;
+      default = [ ];
+      internal = true;
+      visible = false;
+      description = ''
+        Assertions only evaluated by the repart image, not by the system toplevel.
+      '';
+    };
+
+    warnings = lib.mkOption {
+      type = options.warnings.type;
+      default = [ ];
+      internal = true;
+      visible = false;
+      description = ''
+        Warnings only evaluated by the repart image, not by the system toplevel.
+      '';
+    };
+
  };

  config = {
-    assertions = lib.mapAttrsToList (
-      fileName: partitionConfig:
-      let
-        inherit (partitionConfig) repartConfig;
-        labelLength = builtins.stringLength repartConfig.Label;
-      in
-      {
-        assertion = repartConfig ? Label -> GPTMaxLabelLength >= labelLength;
-        message = ''
-          The partition label '${repartConfig.Label}'
-          defined for '${fileName}' is ${toString labelLength} characters long,
-          but the maximum label length supported by UEFI is ${toString GPTMaxLabelLength}.
-        '';
-      }
-    ) cfg.partitions;
-
-    warnings = lib.filter (v: v != null) (
-      lib.mapAttrsToList (
-        fileName: partitionConfig:
-        let
-          inherit (partitionConfig) repartConfig;
-          suggestedMaxLabelLength = GPTMaxLabelLength - 2;
-          labelLength = builtins.stringLength repartConfig.Label;
-        in
-        if (repartConfig ? Label && labelLength >= suggestedMaxLabelLength) then
-          ''
-            The partition label '${repartConfig.Label}'
-            defined for '${fileName}' is ${toString labelLength} characters long.
-            The suggested maximum label length is ${toString suggestedMaxLabelLength}.
-
-            If you use sytemd-sysupdate style A/B updates, this might
-            not leave enough space to increment the version number included in
-            the label in a future release. For example, if your label is
-            ${toString GPTMaxLabelLength} characters long (the maximum enforced by UEFI) and
-            you're at version 9, you cannot increment this to 10.
-          ''
-        else
-          null
-      ) cfg.partitions
-    );
-
    image.baseName =
      let
        version = config.image.repart.version;
@@ -352,6 +332,47 @@ in
        };

        finalPartitions = lib.mapAttrs addClosure cfg.partitions;
+
+        assertions = lib.mapAttrsToList (
+          fileName: partitionConfig:
+          let
+            inherit (partitionConfig) repartConfig;
+            labelLength = builtins.stringLength repartConfig.Label;
+          in
+          {
+            assertion = repartConfig ? Label -> GPTMaxLabelLength >= labelLength;
+            message = ''
+              The partition label '${repartConfig.Label}'
+              defined for '${fileName}' is ${toString labelLength} characters long,
+              but the maximum label length supported by UEFI is ${toString GPTMaxLabelLength}.
+            '';
+          }
+        ) cfg.partitions;
+
+        warnings = lib.filter (v: v != null) (
+          lib.mapAttrsToList (
+            fileName: partitionConfig:
+            let
+              inherit (partitionConfig) repartConfig;
+              suggestedMaxLabelLength = GPTMaxLabelLength - 2;
+              labelLength = builtins.stringLength repartConfig.Label;
+            in
+            if (repartConfig ? Label && labelLength >= suggestedMaxLabelLength) then
+              ''
+                The partition label '${repartConfig.Label}'
+                defined for '${fileName}' is ${toString labelLength} characters long.
+                The suggested maximum label length is ${toString suggestedMaxLabelLength}.
+
+                If you use sytemd-sysupdate style A/B updates, this might
+                not leave enough space to increment the version number included in
+                the label in a future release. For example, if your label is
+                ${toString GPTMaxLabelLength} characters long (the maximum enforced by UEFI) and
+                you're at version 9, you cannot increment this to 10.
+              ''
+            else
+              null
+          ) cfg.partitions
+        );
      };

    system.build.image =
@@ -367,21 +388,22 @@ in
        );

        mkfsEnv = mkfsOptionsToEnv cfg.mkfsOptions;
+        val = pkgs.callPackage ./repart-image.nix {
+          systemd = cfg.package;
+          imageFileBasename = config.image.baseName;
+          inherit (cfg)
+            name
+            version
+            compression
+            split
+            seed
+            sectorSize
+            finalPartitions
+            ;
+          inherit fileSystems definitionsDirectory mkfsEnv;
+        };
      in
-      pkgs.callPackage ./repart-image.nix {
-        systemd = cfg.package;
-        imageFileBasename = config.image.baseName;
-        inherit (cfg)
-          name
-          version
-          compression
-          split
-          seed
-          sectorSize
-          finalPartitions
-          ;
-        inherit fileSystems definitionsDirectory mkfsEnv;
-      };
+      lib.asserts.checkAssertWarn cfg.assertions cfg.warnings val;
  };

  meta.maintainers = with lib.maintainers; [
@@ -18,64 +18,162 @@ in
      "hddfancontrol"
      "smartctl"
    ] "Smartctl is now automatically used when necessary, which makes this option redundant")
+    (lib.mkRemovedOptionModule [
+      "services"
+      "hddfancontrol"
+      "disks"
+    ] "Disks should now be specified per hddfancontrol instance in its attrset")
+    (lib.mkRemovedOptionModule [
+      "services"
+      "hddfancontrol"
+      "pwmPaths"
+    ] "Pwm Paths should now be specified per hddfancontrol instance in its attrset")
+    (lib.mkRemovedOptionModule [
+      "services"
+      "hddfancontrol"
+      "logVerbosity"
+    ] "Log Verbosity should now be specified per hddfancontrol instance in its attrset")
+    (lib.mkRemovedOptionModule [
+      "services"
+      "hddfancontrol"
+      "extraArgs"
+    ] "Extra Args should now be specified per hddfancontrol instance in its attrset")
  ];

  options = {
    services.hddfancontrol.enable = lib.mkEnableOption "hddfancontrol daemon";

-    services.hddfancontrol.disks = lib.mkOption {
-      type = lib.types.listOf lib.types.path;
-      default = [ ];
-      description = ''
-        Drive(s) to get temperature from
-      '';
-      example = [ "/dev/sda" ];
-    };
+    services.hddfancontrol.settings = lib.mkOption {
+      type = lib.types.attrsWith {
+        placeholder = "drive-bay-name";
+        elemType = (
+          lib.types.submodule (
+            { ... }:
+            {
+              options = {
+                disks = lib.mkOption {
+                  type = lib.types.listOf lib.types.path;
+                  default = [ ];
+                  description = ''
+                    Drive(s) to get temperature from
+                  '';
+                  example = [ "/dev/sda" ];
+                };

-    services.hddfancontrol.pwmPaths = lib.mkOption {
-      type = lib.types.listOf lib.types.path;
-      default = [ ];
-      description = ''
-        PWM filepath(s) to control fan speed (under /sys), followed by initial and fan-stop PWM values
-      '';
-      example = [ "/sys/class/hwmon/hwmon2/pwm1:30:10" ];
-    };
+                pwmPaths = lib.mkOption {
+                  type = lib.types.listOf lib.types.path;
+                  default = [ ];
+                  description = ''
+                    PWM filepath(s) to control fan speed (under /sys), followed by initial and fan-stop PWM values
+                  '';
+                  example = [ "/sys/class/hwmon/hwmon2/pwm1:30:10" ];
+                };

-    services.hddfancontrol.logVerbosity = lib.mkOption {
-      type = lib.types.enum [
-        "TRACE"
-        "DEBUG"
-        "INFO"
-        "WARN"
-        "ERROR"
-      ];
-      default = "INFO";
-      description = ''
-        Verbosity of the log level
-      '';
-    };
+                logVerbosity = lib.mkOption {
+                  type = lib.types.enum [
+                    "TRACE"
+                    "DEBUG"
+                    "INFO"
+                    "WARN"
+                    "ERROR"
+                  ];
+                  default = "INFO";
+                  description = ''
+                    Verbosity of the log level
+                  '';
+                };

-    services.hddfancontrol.extraArgs = lib.mkOption {
-      type = lib.types.listOf lib.types.str;
-      default = [ ];
+                extraArgs = lib.mkOption {
+                  type = lib.types.listOf lib.types.str;
+                  default = [ ];
+                  description = ''
+                    Extra commandline arguments for hddfancontrol
+                  '';
+                  example = [
+                    "--min-fan-speed-prct=10"
+                    "--interval=1min"
+                  ];
+                };
+              };
+            }
+          )
+        );
+      };
+      default = { };
      description = ''
-        Extra commandline arguments for hddfancontrol
+        Parameter-sets for each instance of hddfancontrol.
+      '';
+      example = lib.literalExpression ''
+        {
+          harddrives = {
+            disks = [
+              "/dev/sda"
+              "/dev/sdb"
+              "/dev/sdc"
+            ];
+            pwmPaths = [
+              "/sys/class/hwmon/hwmon1/pwm1:25:10"
+            ];
+            logVerbosity = "DEBUG";
+          };
+          ssddrives = {
+            disks = [
+              "/dev/sdd"
+              "/dev/sde"
+              "/dev/sdf"
+            ];
+            pwmPaths = [
+              "/sys/class/hwmon/hwmon1/pwm2:25:10"
+            ];
+            extraArgs = [
+              "--interval=30s"
+            ];
+          };
+        }
      '';
-      example = [
-        "--min-fan-speed-prct=10"
-        "--interval=1min"
-      ];
    };
  };

  config = lib.mkIf cfg.enable (
    let
-      args = lib.concatLists [
-        [ "-d" ]
-        cfg.disks
-        [ "-p" ]
-        cfg.pwmPaths
-        cfg.extraArgs
+      args =
+        cnf:
+        lib.concatLists [
+          [ "-d" ]
+          cnf.disks
+          [ "-p" ]
+          cnf.pwmPaths
+          cnf.extraArgs
+        ];
+
+      createService = cnf: {
+        description = "HDD fan control";
+        documentation = [ "man:hddfancontrol(1)" ];
+        after = [ "hddtemp.service" ];
+        wants = [ "hddtemp.service" ];
+        serviceConfig = {
+          ExecStart = "${lib.getExe pkgs.hddfancontrol} -v ${cnf.logVerbosity} daemon ${lib.escapeShellArgs (args cnf)}";
+
+          CPUSchedulingPolicy = "rr";
+          CPUSchedulingPriority = 49;
+
+          ProtectSystem = "strict";
+          PrivateTmp = true;
+          ProtectHome = true;
+          SystemCallArchitectures = "native";
+          MemoryDenyWriteExecute = true;
+          NoNewPrivileges = true;
+        };
+        wantedBy = [ "multi-user.target" ];
+      };
+
+      services = lib.attrsets.mergeAttrsList [
+        (lib.attrsets.mapAttrs' (
+          name: cnf: lib.nameValuePair "hddfancontrol-${name}" (createService cnf)
+        ) cfg.settings)
+        {
+          "hddfancontrol".enable = false;
+        }
      ];
    in
    {
@@ -83,16 +181,10 @@ in

      hardware.sensor.hddtemp = {
        enable = true;
-        drives = cfg.disks;
+        drives = lib.lists.flatten (lib.attrsets.catAttrs "disks" (lib.attrsets.attrValues cfg.settings));
      };

-      systemd.services.hddfancontrol = {
-        wantedBy = [ "multi-user.target" ];
-        environment = {
-          HDDFANCONTROL_LOG_LEVEL = cfg.logVerbosity;
-          HDDFANCONTROL_DAEMON_ARGS = lib.escapeShellArgs args;
-        };
-      };
+      systemd.services = services;
    }
  );
 }
@@ -596,7 +596,9 @@ in
          ${pkgs.envsubst}/bin/envsubst -i ${configJson} -o ${cfg.dataDir}/config.json
          export PHPRC=${phpIni}

+          INIT=false
          if [[ ! -s ${cfg.dataDir}/.env ]]; then
+            INIT=true
            # init .env file
            echo "APP_KEY=" > ${cfg.dataDir}/.env
            ${artisanWrapper}/bin/librenms-artisan key:generate --ansi
@@ -655,6 +657,10 @@ in
            echo "${package.version}" > ${cfg.dataDir}/version
          fi

+          if [[ $INIT == "true" ]]; then
+            ${artisanWrapper}/bin/librenms-artisan db:seed --force --no-interaction
+          fi
+
          # regenerate cache if package has changed
          if [[ $OLD_PACKAGE != "${package}" ]]; then
            ${artisanWrapper}/bin/librenms-artisan view:clear
@@ -369,7 +369,7 @@ in
          RuntimeDirectoryMode = "0400";
          LoadCredential = [
            "credentials.json:${tunnel.credentialsFile}"
-          ] ++ (lib.optional (certFile != null) "cert.pem:certFile");
+          ] ++ (lib.optional (certFile != null) "cert.pem:${certFile}");

          ExecStart = "${cfg.package}/bin/cloudflared tunnel --config=${mkConfigFile} --no-autoupdate run";
          Restart = "on-failure";
@@ -55,10 +55,19 @@ let
          were removed. Please use, respectively, {rescanIntervalS,fsWatcherEnabled,fsWatcherDelayS} instead.
        ''
        {
-          devices = map (
-            device:
-            if builtins.isString device then { deviceId = cfg.settings.devices.${device}.id; } else device
-          ) folder.devices;
+          devices =
+            let
+              folderDevices = folder.devices;
+            in
+            map (
+              device:
+              if builtins.isString device then
+                { deviceId = cfg.settings.devices.${device}.id; }
+              else if builtins.isAttrs device then
+                { deviceId = cfg.settings.devices.${device.name}.id; } // device
+              else
+                throw "Invalid type for devices in folder '${folderName}'; expected list or attrset."
+            ) folderDevices;
        }
  ) (filterAttrs (_: folder: folder.enable) cfg.settings.folders);

@@ -128,9 +137,79 @@ let
              # don't exist in the array given. That's why we use here `POST`, and
              # only if s.override == true then we DELETE the relevant folders
              # afterwards.
-              (map (new_cfg: ''
-                curl -d ${lib.escapeShellArg (builtins.toJSON new_cfg)} -X POST ${s.baseAddress}
-              ''))
+              (map (
+                new_cfg:
+                let
+                  jsonPreSecretsFile = pkgs.writeTextFile {
+                    name = "${conf_type}-${new_cfg.id}-conf-pre-secrets.json";
+                    text = builtins.toJSON new_cfg;
+                  };
+                  injectSecretsJqCmd =
+                    {
+                      # There are no secrets in `devs`, so no massaging needed.
+                      "devs" = "${jq} .";
+                      "dirs" =
+                        let
+                          folder = new_cfg;
+                          devicesWithSecrets = lib.pipe folder.devices [
+                            (lib.filter (device: (builtins.isAttrs device) && device ? encryptionPasswordFile))
+                            (map (device: {
+                              deviceId = device.deviceId;
+                              variableName = "secret_${builtins.hashString "sha256" device.encryptionPasswordFile}";
+                              secretPath = device.encryptionPasswordFile;
+                            }))
+                          ];
+                          # At this point, `jsonPreSecretsFile` looks something like this:
+                          #
+                          #   {
+                          #     ...,
+                          #     "devices": [
+                          #       {
+                          #         "deviceId": "id1",
+                          #         "encryptionPasswordFile": "/etc/bar-encryption-password",
+                          #         "name": "..."
+                          #       }
+                          #     ],
+                          #   }
+                          #
+                          # We now generate a `jq` command that can replace those
+                          # `encryptionPasswordFile`s with `encryptionPassword`.
+                          # The `jq` command ends up looking like this:
+                          #
+                          #   jq --rawfile secret_DEADBEEF /etc/bar-encryption-password '
+                          #     .devices[] |= (
+                          #       if .deviceId == "id1" then
+                          #         del(.encryptionPasswordFile) |
+                          #         .encryptionPassword = $secret_DEADBEEF
+                          #       else
+                          #         .
+                          #       end
+                          #     )
+                          #   '
+                          jqUpdates = map (device: ''
+                            .devices[] |= (
+                              if .deviceId == "${device.deviceId}" then
+                                del(.encryptionPasswordFile) |
+                                .encryptionPassword = ''$${device.variableName}
+                              else
+                                .
+                              end
+                            )
+                          '') devicesWithSecrets;
+                          jqRawFiles = map (
+                            device: "--rawfile ${device.variableName} ${lib.escapeShellArg device.secretPath}"
+                          ) devicesWithSecrets;
+                        in
+                        "${jq} ${lib.concatStringsSep " " jqRawFiles} ${
+                          lib.escapeShellArg (lib.concatStringsSep "|" ([ "." ] ++ jqUpdates))
+                        }";
+                    }
+                    .${conf_type};
+                in
+                ''
+                  ${injectSecretsJqCmd} ${jsonPreSecretsFile} | curl --json @- -X POST ${s.baseAddress}
+                ''
+              ))
              (lib.concatStringsSep "\n")
            ]
            /*
@@ -438,11 +517,48 @@ in
                      };

                      devices = mkOption {
-                        type = types.listOf types.str;
+                        type = types.listOf (
+                          types.oneOf [
+                            types.str
+                            (types.submodule (
+                              { ... }:
+                              {
+                                freeformType = settingsFormat.type;
+                                options = {
+                                  name = mkOption {
+                                    type = types.str;
+                                    default = null;
+                                    description = ''
+                                      The name of a device defined in the
+                                      [devices](#opt-services.syncthing.settings.devices)
+                                      option.
+                                    '';
+                                  };
+                                  encryptionPasswordFile = mkOption {
+                                    type = types.nullOr (
+                                      types.pathWith {
+                                        inStore = false;
+                                        absolute = true;
+                                      }
+                                    );
+                                    default = null;
+                                    description = ''
+                                      Path to encryption password. If set, the file will be read during
+                                      service activation, without being embedded in derivation.
+                                    '';
+                                  };
+                                };
+                              }
+                            ))
+                          ]
+                        );
                        default = [ ];
                        description = ''
                          The devices this folder should be shared with. Each device must
                          be defined in the [devices](#opt-services.syncthing.settings.devices) option.
+
+                          A list of either strings or attribute sets, where values
+                          are device names or device configurations.
                        '';
                      };

@@ -9,6 +9,11 @@ with lib;

 let
  cfg = config.services.nextcloud;
+
+  overridePackage = cfg.package.override {
+    inherit (config.security.pki) caBundle;
+  };
+
  fpm = config.services.phpfpm.pools.nextcloud;

  jsonFormat = pkgs.formats.json { };
@@ -51,13 +56,13 @@ let
  };

  webroot =
-    pkgs.runCommand "${cfg.package.name or "nextcloud"}-with-apps"
+    pkgs.runCommand "${overridePackage.name or "nextcloud"}-with-apps"
      {
        preferLocalBuild = true;
      }
      ''
        mkdir $out
-        ln -sfv "${cfg.package}"/* "$out"
+        ln -sfv "${overridePackage}"/* "$out"
        ${concatStrings (
          mapAttrsToList (
            name: store:
@@ -185,8 +190,8 @@ let
  mysqlLocal = cfg.database.createLocally && cfg.config.dbtype == "mysql";
  pgsqlLocal = cfg.database.createLocally && cfg.config.dbtype == "pgsql";

-  nextcloudGreaterOrEqualThan = versionAtLeast cfg.package.version;
-  nextcloudOlderThan = versionOlder cfg.package.version;
+  nextcloudGreaterOrEqualThan = versionAtLeast overridePackage.version;
+  nextcloudOlderThan = versionOlder overridePackage.version;

  # https://github.com/nextcloud/documentation/pull/11179
  ocmProviderIsNotAStaticDirAnymore =
@@ -1028,12 +1033,12 @@ in
          If you have an existing installation with a custom table prefix, make sure it is
          set correctly in `config.php` and remove the option from your NixOS config.
        '')
-        ++ (optional (versionOlder cfg.package.version "26") (upgradeWarning 25 "23.05"))
-        ++ (optional (versionOlder cfg.package.version "27") (upgradeWarning 26 "23.11"))
-        ++ (optional (versionOlder cfg.package.version "28") (upgradeWarning 27 "24.05"))
-        ++ (optional (versionOlder cfg.package.version "29") (upgradeWarning 28 "24.11"))
-        ++ (optional (versionOlder cfg.package.version "30") (upgradeWarning 29 "24.11"))
-        ++ (optional (versionOlder cfg.package.version "31") (upgradeWarning 30 "25.05"));
+        ++ (optional (versionOlder overridePackage.version "26") (upgradeWarning 25 "23.05"))
+        ++ (optional (versionOlder overridePackage.version "27") (upgradeWarning 26 "23.11"))
+        ++ (optional (versionOlder overridePackage.version "28") (upgradeWarning 27 "24.05"))
+        ++ (optional (versionOlder overridePackage.version "29") (upgradeWarning 28 "24.11"))
+        ++ (optional (versionOlder overridePackage.version "30") (upgradeWarning 29 "24.11"))
+        ++ (optional (versionOlder overridePackage.version "31") (upgradeWarning 30 "25.05"));

      services.nextcloud.package =
        with pkgs;
@@ -1386,6 +1391,8 @@ in
            datadirectory = lib.mkDefault "${datadir}/data";
            trusted_domains = [ cfg.hostName ];
            "upgrade.disable-web" = true;
+            # NixOS already provides its own integrity check and the nix store is read-only, therefore Nextcloud does not need to do its own integrity checks.
+            "integrity.check.disabled" = true;
          })
          (lib.mkIf cfg.configureRedis {
            "memcache.distributed" = ''\OC\Memcache\Redis'';
@@ -77,14 +77,7 @@ let
  );

  # Handle assertions and warnings
-
-  failedAssertions = map (x: x.message) (filter (x: !x.assertion) config.assertions);
-
-  baseSystemAssertWarn =
-    if failedAssertions != [ ] then
-      throw "\nFailed assertions:\n${concatStringsSep "\n" (map (x: "- ${x}") failedAssertions)}"
-    else
-      showWarnings config.warnings baseSystem;
+  baseSystemAssertWarn = lib.asserts.checkAssertWarn config.assertions config.warnings baseSystem;

  # Replace runtime dependencies
  system =
@@ -1273,6 +1273,7 @@ in
  syncthing-no-settings = handleTest ./syncthing-no-settings.nix { };
  syncthing-init = handleTest ./syncthing-init.nix { };
  syncthing-many-devices = handleTest ./syncthing-many-devices.nix { };
+  syncthing-folders = runTest ./syncthing-folders.nix;
  syncthing-relay = handleTest ./syncthing-relay.nix { };
  sysinit-reactivation = runTest ./sysinit-reactivation.nix;
  systemd = handleTest ./systemd.nix { };
@@ -50,9 +50,6 @@ in
        API_USER_NAME=api
        API_TOKEN=${api_token} # random md5 hash

-        # seeding database to get the admin roles
-        ${pkgs.librenms}/artisan db:seed --force --no-interaction
-
        # we don't need to know the password, it just has to exist
        API_USER_PASS=$(${pkgs.pwgen}/bin/pwgen -s 64 1)
        ${pkgs.librenms}/artisan user:add $API_USER_NAME -r admin -p $API_USER_PASS
@@ -26,11 +26,13 @@ runTest (

    nodes = {
      nextcloud =
-        { config, pkgs, ... }:
        {
-          networking.firewall.allowedTCPPorts = [ 9000 ];
-          environment.systemPackages = [ pkgs.minio-client ];
-
+          config,
+          pkgs,
+          nodes,
+          ...
+        }:
+        {
          services.nextcloud.config.dbtype = "sqlite";

          services.nextcloud.config.objectstore.s3 = {
@@ -39,13 +41,66 @@ runTest (
            autocreate = true;
            key = accessKey;
            secretFile = "${pkgs.writeText "secretKey" secretKey}";
-            hostname = "nextcloud";
-            useSsl = false;
-            port = 9000;
+            hostname = "acme.test";
+            useSsl = true;
+            port = 443;
            usePathStyle = true;
            region = "us-east-1";
          };

+          security.pki.certificates = [
+            (builtins.readFile ../common/acme/server/ca.cert.pem)
+          ];
+
+          environment.systemPackages = [ pkgs.minio-client ];
+
+          # The dummy certs are for acme.test, so we pretend that's the FQDN
+          # of the minio VM.
+          networking.extraHosts = ''
+            ${nodes.minio.networking.primaryIPAddress} acme.test
+          '';
+        };
+
+      client =
+        { nodes, ... }:
+        {
+          security.pki.certificates = [
+            (builtins.readFile ../common/acme/server/ca.cert.pem)
+          ];
+          networking.extraHosts = ''
+            ${nodes.minio.networking.primaryIPAddress} acme.test
+          '';
+        };
+
+      minio =
+        { ... }:
+        {
+          security.pki.certificates = [
+            (builtins.readFile ../common/acme/server/ca.cert.pem)
+          ];
+
+          services.nginx = {
+            enable = true;
+            recommendedProxySettings = true;
+
+            virtualHosts."acme.test" = {
+              onlySSL = true;
+              sslCertificate = ../common/acme/server/acme.test.cert.pem;
+              sslCertificateKey = ../common/acme/server/acme.test.key.pem;
+              locations."/".proxyPass = "http://127.0.0.1:9000";
+            };
+          };
+
+          networking.extraHosts = ''
+            127.0.0.1 acme.test
+          '';
+
+          networking.firewall.allowedTCPPorts = [
+            9000
+            80
+            443
+          ];
+
          services.minio = {
            enable = true;
            listenAddress = "0.0.0.0:9000";
@@ -56,18 +111,22 @@ runTest (
    };

    test-helpers.init = ''
-      nextcloud.wait_for_open_port(9000)
+      minio.start()
+      minio.wait_for_open_port(9000)
+      minio.wait_for_unit("nginx.service")
+      minio.wait_for_open_port(443)
    '';

    test-helpers.extraTests =
      { nodes, ... }:
      ''
+
        with subtest("File is not on the filesystem"):
            nextcloud.succeed("test ! -e ${nodes.nextcloud.services.nextcloud.home}/data/root/files/test-shared-file")

        with subtest("Check if file is in S3"):
            nextcloud.succeed(
-                "mc config host add minio http://localhost:9000 ${accessKey} ${secretKey} --api s3v4"
+                "mc config host add minio https://acme.test ${accessKey} ${secretKey} --api s3v4"
            )
            files = nextcloud.succeed('mc ls minio/nextcloud|sort').strip().split('\n')

@@ -100,8 +159,8 @@ runTest (
        with subtest("Test download from S3"):
            client.succeed(
                "env AWS_ACCESS_KEY_ID=${accessKey} AWS_SECRET_ACCESS_KEY=${secretKey} "
-                + f"${lib.getExe pkgs.awscli2} s3 cp s3://nextcloud/{file} test --endpoint-url http://nextcloud:9000 "
-                + "--region us-east-1"
+                + f"${lib.getExe pkgs.awscli2} s3 cp s3://nextcloud/{file} test --endpoint-url https://acme.test "
+                + "--region us-east-1 --ca-bundle /etc/ssl/certs/ca-bundle.crt"
            )

            client.succeed("test hi = $(cat test)")
@@ -0,0 +1,135 @@
+{ lib, pkgs, ... }:
+let
+  genNodeId =
+    name:
+    pkgs.runCommand "syncthing-test-certs-${name}" { } ''
+      mkdir -p $out
+      ${pkgs.syncthing}/bin/syncthing generate --config=$out
+      ${pkgs.libxml2}/bin/xmllint --xpath 'string(configuration/device/@id)' $out/config.xml > $out/id
+    '';
+  idA = genNodeId "a";
+  idB = genNodeId "b";
+  idC = genNodeId "c";
+  testPassword = "it's a secret";
+in
+{
+  name = "syncthing";
+  meta.maintainers = with pkgs.lib.maintainers; [ zarelit ];
+
+  nodes = {
+    a =
+      { config, ... }:
+      {
+        environment.etc.bar-encryption-password.text = testPassword;
+        services.syncthing = {
+          enable = true;
+          openDefaultPorts = true;
+          cert = "${idA}/cert.pem";
+          key = "${idA}/key.pem";
+          settings = {
+            devices.b.id = lib.fileContents "${idB}/id";
+            devices.c.id = lib.fileContents "${idC}/id";
+            folders.foo = {
+              path = "/var/lib/syncthing/foo";
+              devices = [ "b" ];
+            };
+            folders.bar = {
+              path = "/var/lib/syncthing/bar";
+              devices = [
+                {
+                  name = "c";
+                  encryptionPasswordFile = "/etc/${config.environment.etc.bar-encryption-password.target}";
+                }
+              ];
+            };
+          };
+        };
+      };
+    b =
+      { config, ... }:
+      {
+        environment.etc.bar-encryption-password.text = testPassword;
+        services.syncthing = {
+          enable = true;
+          openDefaultPorts = true;
+          cert = "${idB}/cert.pem";
+          key = "${idB}/key.pem";
+          settings = {
+            devices.a.id = lib.fileContents "${idA}/id";
+            devices.c.id = lib.fileContents "${idC}/id";
+            folders.foo = {
+              path = "/var/lib/syncthing/foo";
+              devices = [ "a" ];
+            };
+            folders.bar = {
+              path = "/var/lib/syncthing/bar";
+              devices = [
+                {
+                  name = "c";
+                  encryptionPasswordFile = "/etc/${config.environment.etc.bar-encryption-password.target}";
+                }
+              ];
+            };
+          };
+        };
+      };
+    c = {
+      services.syncthing = {
+        enable = true;
+        openDefaultPorts = true;
+        cert = "${idC}/cert.pem";
+        key = "${idC}/key.pem";
+        settings = {
+          devices.a.id = lib.fileContents "${idA}/id";
+          devices.b.id = lib.fileContents "${idB}/id";
+          folders.bar = {
+            path = "/var/lib/syncthing/bar";
+            devices = [
+              "a"
+              "b"
+            ];
+            type = "receiveencrypted";
+          };
+        };
+      };
+    };
+  };
+
+  testScript = ''
+    start_all()
+
+    a.wait_for_unit("syncthing.service")
+    b.wait_for_unit("syncthing.service")
+    c.wait_for_unit("syncthing.service")
+    a.wait_for_open_port(22000)
+    b.wait_for_open_port(22000)
+    c.wait_for_open_port(22000)
+
+    # Test foo
+
+    a.wait_for_file("/var/lib/syncthing/foo")
+    b.wait_for_file("/var/lib/syncthing/foo")
+
+    a.succeed("echo a2b > /var/lib/syncthing/foo/a2b")
+    b.succeed("echo b2a > /var/lib/syncthing/foo/b2a")
+
+    a.wait_for_file("/var/lib/syncthing/foo/b2a")
+    b.wait_for_file("/var/lib/syncthing/foo/a2b")
+
+    # Test bar
+
+    a.wait_for_file("/var/lib/syncthing/bar")
+    b.wait_for_file("/var/lib/syncthing/bar")
+    c.wait_for_file("/var/lib/syncthing/bar")
+
+    a.succeed("echo plaincontent > /var/lib/syncthing/bar/plainname")
+
+    # B should be able to decrypt, check that content of file matches
+    b.wait_for_file("/var/lib/syncthing/bar/plainname")
+    file_contents = b.succeed("cat /var/lib/syncthing/bar/plainname")
+    assert "plaincontent\n" == file_contents, f"Unexpected file contents: {file_contents=}"
+
+    # Bar on C is untrusted, check that content is not in cleartext
+    c.fail("grep -R plaincontent /var/lib/syncthing/bar")
+  '';
+}
@@ -11,13 +11,13 @@
 }:
 stdenv.mkDerivation rec {
  pname = "VoiceOfFaust";
-  version = "1.1.5";
+  version = "1.1.7";

  src = fetchFromGitHub {
    owner = "magnetophon";
    repo = "VoiceOfFaust";
-    rev = version;
-    sha256 = "sha256-vB8+ymvNuuovFXwOJ3BTIj5mGzCGa1+yhYs4nWMYIxU=";
+    tag = "V${version}";
+    sha256 = "sha256-wsc4yzytK2hPVBQwMhdhjnH1pDtpkNCFJnItyzszEs0=";
  };

  plugins = [
@@ -45,15 +45,17 @@ stdenv.mkDerivation rec {
  ];

  patchPhase = ''
-    sed -i "s@pd -nodac@${pitchTracker}/bin/pd -nodac@g" launchers/synthWrapper
    sed -i "s@jack_connect@${jack-example-tools}/bin/jack_connect@g" launchers/synthWrapper
+    sed -i "s@pd -nodac@${pitchTracker}/bin/pd -nodac@g" launchers/pitchTracker
    sed -i "s@../PureData/OscSendVoc.pd@$out/bin/PureData/OscSendVoc.pd@g" launchers/pitchTracker
+    sed -i "s@pd -nodac@${pitchTracker}/bin/pd -nodac@g" launchers/pitchTrackerGUI
+    sed -i "s@../PureData/OscSendVoc.pd@$out/bin/PureData/OscSendVoc.pd@g" launchers/pitchTrackerGUI
  '';

  meta = {
    description = "Turn your voice into a synthesizer";
    homepage = "https://github.com/magnetophon/VoiceOfFaust";
-    license = lib.licenses.gpl3;
+    license = lib.licenses.agpl3Only;
    maintainers = [ lib.maintainers.magnetophon ];
  };
 }
@@ -2909,6 +2909,19 @@ final: prev: {
    meta.hydraPlatforms = [ ];
  };

+  codecompanion-history-nvim = buildVimPlugin {
+    pname = "codecompanion-history.nvim";
+    version = "2025-05-15";
+    src = fetchFromGitHub {
+      owner = "ravitemer";
+      repo = "codecompanion-history.nvim";
+      rev = "f787607922be1189b58e2c61bdd0e4bae3a38c00";
+      sha256 = "16bivgra12wyhiwcci89sa7fcj0y8q4a61xzlf2gsm84bv295jms";
+    };
+    meta.homepage = "https://github.com/ravitemer/codecompanion-history.nvim/";
+    meta.hydraPlatforms = [ ];
+  };
+
  codecompanion-nvim = buildVimPlugin {
    pname = "codecompanion.nvim";
    version = "2025-05-01";
@@ -631,6 +631,15 @@ in
    ];
  };

+  codecompanion-history-nvim = super.codecompanion-history-nvim.overrideAttrs {
+    dependencies = with self; [
+      # transitive dependency for codecompanion-nvim
+      plenary-nvim
+
+      codecompanion-nvim
+    ];
+  };
+
  windsurf-nvim =
    let
      # Update according to https://github.com/Exafunction/codeium.nvim/blob/main/lua/codeium/versions.json
@@ -222,6 +222,7 @@ https://github.com/coc-extensions/coc-svelte/,,
 https://github.com/iamcco/coc-tailwindcss/,,
 https://github.com/neoclide/coc.nvim/,release,
 https://github.com/manicmaniac/coconut.vim/,HEAD,
+https://github.com/ravitemer/codecompanion-history.nvim/,HEAD,
 https://github.com/olimorris/codecompanion.nvim/,HEAD,
 https://github.com/gorbit99/codewindow.nvim/,HEAD,
 https://github.com/metakirby5/codi.vim/,,
@@ -7,8 +7,8 @@ buildVscodeMarketplaceExtension {
  mktplcRef = {
    name = "vscode-wakatime";
    publisher = "WakaTime";
-    version = "25.0.1";
-    hash = "sha256-4Q/38zO8G39oeZh4N9hOSFBeB0rI7ouH5vlBmV78EnQ=";
+    version = "25.0.3";
+    hash = "sha256-rD2Uzzt8xfkfgM+Y0NLe7lthfxinv1Zatpr56OjfABM=";
  };

  meta = {
@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension (finalAttrs: {
  mktplcRef = {
    name = "amazon-q-vscode";
    publisher = "AmazonWebServices";
-    version = "1.66.0";
-    hash = "sha256-EnNwlSmJWBcSfFCayxJS94qVUqgQlbX0RLCB4jJsn+4=";
+    version = "1.67.0";
+    hash = "sha256-1GShGk0ulYlpJpcdai7T2n0p2v1qicLE4X2d7Pqx4Zc=";
  };

  meta = {
@@ -0,0 +1,37 @@
+{
+  jq,
+  lib,
+  moreutils,
+  vscode-utils,
+  eslint,
+}:
+
+vscode-utils.buildVscodeMarketplaceExtension {
+  mktplcRef = {
+    name = "vscode-eslint";
+    publisher = "dbaeumer";
+    version = "3.0.13";
+    hash = "sha256-l5VvhQPxPaQsPhXUbFW2yGJjaqnNvijn4QkXPjf1WXo=";
+  };
+
+  nativeBuildInputs = [
+    jq
+    moreutils
+  ];
+
+  buildInputs = [ eslint ];
+
+  postInstall = ''
+    cd "$out/$installPrefix"
+    jq '.contributes.configuration.properties."eslint.nodePath".default = "${eslint}/lib/node_modules"' package.json | sponge package.json
+  '';
+
+  meta = {
+    changelog = "https://marketplace.visualstudio.com/items/dbaeumer.vscode-eslint/changelog";
+    description = "Integrates ESLint JavaScript into VS Code";
+    downloadPage = "https://marketplace.visualstudio.com/items?itemName=dbaeumer.vscode-eslint";
+    homepage = "https://github.com/Microsoft/vscode-eslint";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.datafoo ];
+  };
+}
@@ -43,8 +43,8 @@ let
        mktplcRef = {
          publisher = "1Password";
          name = "op-vscode";
-          version = "1.0.4";
-          hash = "sha256-s6acue8kgFLf5fs4A7l+IYfhibdY76cLcIwHl+54WVk=";
+          version = "1.0.5";
+          hash = "sha256-J7vAK2t6fSjm5i6y3+88aO84ipFwekQkJMD7W3EIWrc=";
        };
        meta = {
          changelog = "https://github.com/1Password/op-vscode/releases";
@@ -493,8 +493,8 @@ let
        mktplcRef = {
          publisher = "banacorn";
          name = "agda-mode";
-          version = "0.5.6";
-          hash = "sha256-FKcPJzdhK0QbaG3wBkdGOkiDkZ4qVJh3RBTnD4wLIh8=";
+          version = "0.5.7";
+          hash = "sha256-Lif7fvR2fozQDko0G74/+UhTnlbFjGAQj5eb2IIH61I=";
        };
        meta = {
          changelog = "https://marketplace.visualstudio.com/items/banacorn.agda-mode/changelog";
@@ -1195,8 +1195,8 @@ let
        mktplcRef = {
          publisher = "DanielGavin";
          name = "ols";
-          version = "0.1.34";
-          hash = "sha256-Xec6UHMe/6ChA4SHCPzMuUAJZejKpGo3YHy9paashmY=";
+          version = "0.1.35";
+          hash = "sha256-Kem8o0gM1+cYohmua17kIlAH1RURgqoc0sPuIFDVU8Q=";
        };
        meta = {
          description = "Visual Studio Code extension for Odin language";
@@ -1308,22 +1308,7 @@ let
        };
      };

-      dbaeumer.vscode-eslint = buildVscodeMarketplaceExtension {
-        mktplcRef = {
-          name = "vscode-eslint";
-          publisher = "dbaeumer";
-          version = "3.0.13";
-          hash = "sha256-l5VvhQPxPaQsPhXUbFW2yGJjaqnNvijn4QkXPjf1WXo=";
-        };
-        meta = {
-          changelog = "https://marketplace.visualstudio.com/items/dbaeumer.vscode-eslint/changelog";
-          description = "Integrates ESLint JavaScript into VS Code";
-          downloadPage = "https://marketplace.visualstudio.com/items?itemName=dbaeumer.vscode-eslint";
-          homepage = "https://github.com/Microsoft/vscode-eslint";
-          license = lib.licenses.mit;
-          maintainers = [ lib.maintainers.datafoo ];
-        };
-      };
+      dbaeumer.vscode-eslint = callPackage ./dbaeumer.vscode-eslint { };

      dendron.adjust-heading-level = callPackage ./dendron.adjust-heading-level { };

@@ -1789,22 +1774,7 @@ let
        };
      };

-      esbenp.prettier-vscode = buildVscodeMarketplaceExtension {
-        mktplcRef = {
-          name = "prettier-vscode";
-          publisher = "esbenp";
-          version = "11.0.0";
-          hash = "sha256-pNjkJhof19cuK0PsXJ/Q/Zb2H7eoIkfXJMLZJ4lDn7k=";
-        };
-        meta = {
-          changelog = "https://marketplace.visualstudio.com/items/esbenp.prettier-vscode/changelog";
-          description = "Code formatter using prettier";
-          downloadPage = "https://marketplace.visualstudio.com/items?itemName=esbenp.prettier-vscode";
-          homepage = "https://github.com/prettier/prettier-vscode";
-          license = lib.licenses.mit;
-          maintainers = [ lib.maintainers.datafoo ];
-        };
-      };
+      esbenp.prettier-vscode = callPackage ./esbenp.prettier-vscode { };

      ethansk.restore-terminals = buildVscodeMarketplaceExtension {
        mktplcRef = {
@@ -2527,7 +2497,7 @@ let
        mktplcRef = {
          publisher = "influxdata";
          name = "flux";
-          version = "1.0.4";
+          version = "1.0.5";
          hash = "sha256-KIKROyfkosBS1Resgl+s3VENVg4ibaeIgKjermXESoA=";
        };
        meta = {
@@ -0,0 +1,37 @@
+{
+  jq,
+  lib,
+  moreutils,
+  vscode-utils,
+  nodePackages,
+}:
+
+vscode-utils.buildVscodeMarketplaceExtension {
+  mktplcRef = {
+    name = "prettier-vscode";
+    publisher = "esbenp";
+    version = "11.0.0";
+    hash = "sha256-pNjkJhof19cuK0PsXJ/Q/Zb2H7eoIkfXJMLZJ4lDn7k=";
+  };
+
+  nativeBuildInputs = [
+    jq
+    moreutils
+  ];
+
+  buildInputs = [ nodePackages.prettier ];
+
+  postInstall = ''
+    cd "$out/$installPrefix"
+    jq '.contributes.configuration.properties."prettier.prettierPath".default = "${nodePackages.prettier}/lib/node_modules/prettier"' package.json | sponge package.json
+  '';
+
+  meta = {
+    changelog = "https://marketplace.visualstudio.com/items/esbenp.prettier-vscode/changelog";
+    description = "Code formatter using prettier";
+    downloadPage = "https://marketplace.visualstudio.com/items?itemName=esbenp.prettier-vscode";
+    homepage = "https://github.com/prettier/prettier-vscode";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.datafoo ];
+  };
+}
@@ -29,20 +29,20 @@

 clangStdenv.mkDerivation rec {
  pname = "gnome-decoder";
-  version = "0.6.1";
+  version = "0.7.1";

  src = fetchFromGitLab {
    domain = "gitlab.gnome.org";
    owner = "World";
    repo = "decoder";
    rev = version;
-    hash = "sha256-qSPuEVW+FwC9OJa+dseIy4/2bhVdTryJSJNSpes9tpY=";
+    hash = "sha256-lLZ8tll/R9cwk3t/MULmrR1KWZ1e+zneXL93035epPE=";
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
    inherit src;
    name = "${pname}-${version}";
-    hash = "sha256-xQlzSsvwDNK3Z8xnUQgCU6Q8+ls0Urks778pYwN2X1Y=";
+    hash = "sha256-USfC7HSL1TtjP1SmBRTKkPyKE4DkSn6xeH4mzfIBQWg=";
  };

  preFixup = ''
@@ -30,13 +30,13 @@

 stdenv.mkDerivation rec {
  pname = "xournalpp";
-  version = "1.2.6";
+  version = "1.2.7";

  src = fetchFromGitHub {
    owner = "xournalpp";
    repo = "xournalpp";
    rev = "v${version}";
-    hash = "sha256-VS5f+9daEQpPu5vam8DWhRqU0AWMmJab8KaRzTnRU/M=";
+    hash = "sha256-Jum9DEbwTtiT0mlrBCBJ0XHhH+DnhXf/AnthZ+qKSZg=";
  };

  postPatch = ''
@@ -98,6 +98,7 @@ stdenv.mkDerivation rec {
  nativeBuildInputs = [
    patchelf
    makeWrapper
+    qt5.wrapQtAppsHook
  ];

  dontWrapQtApps = true;
@@ -137,6 +138,7 @@ stdenv.mkDerivation rec {
      systemd
      libva
      qt5.qtbase
+      qt5.qtwayland
      freetype
      fontconfig
      libXrender
@@ -219,6 +221,7 @@ stdenv.mkDerivation rec {
        --set-default FONTCONFIG_PATH "${fontconfig.out}/etc/fonts" \
        --suffix XDG_DATA_DIRS : ${gtk3}/share/gsettings-schemas/${gtk3.name}/ \
        --prefix PATH : ${coreutils}/bin \
+        ''${qtWrapperArgs[@]} \
        ${lib.optionalString enableWidevine "--suffix LD_LIBRARY_PATH : ${libPath}"}
    ''
    + lib.optionalString enableWidevine ''
@@ -33,7 +33,7 @@ Note here we are pointing the nvidia runtime to "/run/current-system/sw/bin/nvid

 Now apply the following runtime class to k3s cluster:

-```
+```yaml
 apiVersion: node.k8s.io/v1
 handler: nvidia
 kind: RuntimeClass
@@ -43,9 +43,12 @@ metadata:
  name: nvidia
 ```

-Following [k8s-device-plugin](https://github.com/NVIDIA/k8s-device-plugin#deployment-via-helm) install the helm chart with `runtimeClassName: nvidia` set. In order to passthrough the nvidia card into the container, your deployments spec must contain - runtimeClassName: nvidia - env:
+Following [k8s-device-plugin](https://github.com/NVIDIA/k8s-device-plugin#deployment-via-helm) install the helm chart with `runtimeClassName: nvidia` set. In order to passthrough the nvidia card into the container, your deployments spec must contain

-```
+```yaml
+runtimeClassName: nvidia
+# for each container
+  env:
   - name: NVIDIA_VISIBLE_DEVICES
     value: all
   - name: NVIDIA_DRIVER_CAPABILITIES
@@ -16,7 +16,7 @@

  # Enabling JACK requires a JACK server at runtime, no fallback mechanism
  withJack ? false,
-  jack,
+  libjack2,

  type ? "ADL",
 }:
@@ -34,7 +34,7 @@ let
    .${type};
  mainProgram = "${type}plug";
 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
  pname = "${lib.strings.toLower type}plug";
  version = "unstable-2021-12-17";

@@ -47,9 +47,9 @@ stdenv.mkDerivation rec {
  };

  cmakeFlags = [
-    "-DADLplug_CHIP=${chip}"
-    "-DADLplug_USE_SYSTEM_FMT=ON"
-    "-DADLplug_Jack=${if withJack then "ON" else "OFF"}"
+    (lib.cmakeFeature "ADLplug_CHIP" chip)
+    (lib.cmakeBool "ADLplug_USE_SYSTEM_FMT" true)
+    (lib.cmakeBool "ADLplug_Jack" withJack)
  ];

  NIX_LDFLAGS = toString (
@@ -88,7 +88,7 @@ stdenv.mkDerivation rec {
      libXext
      libXcursor
    ]
-    ++ lib.optional withJack jack;
+    ++ lib.optionals withJack [ libjack2 ];

  postInstall = lib.optionalString stdenv.hostPlatform.isDarwin ''
    mkdir -p $out/{Applications,Library/Audio/Plug-Ins/{VST,Components}}
@@ -100,12 +100,12 @@ stdenv.mkDerivation rec {
    mv au/${mainProgram}.component $out/Library/Audio/Plug-Ins/Components/
  '';

-  meta = with lib; {
+  meta = {
    inherit mainProgram;
    description = "${chip} FM Chip Synthesizer";
-    homepage = src.meta.homepage;
-    license = licenses.boost;
-    platforms = platforms.all;
-    maintainers = with maintainers; [ OPNA2608 ];
+    homepage = "https://github.com/jpcima/ADLplug";
+    license = lib.licenses.boost;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ OPNA2608 ];
  };
 }
@@ -27,16 +27,14 @@ rustPlatform.buildRustPackage rec {
    fetchSubmodules = true;
  };

-  prePatch = ''
-    chmod +w .. # make sure that /build/source is writeable
-  '';
-
  npmDeps = fetchNpmDeps {
    inherit src;
-    sourceRoot = "${src.name}";
    hash = "sha256-6r9bEY7e1Eef/0/CJ26ITpFJcCVUEKLrFx+TNEomLPE=";
  };

+  cargoRoot = "src-tauri";
+  buildAndTestSubdir = "src-tauri";
+
  useFetchCargoVendor = true;
  cargoHash = "sha256-VX/G4dF9DhlGfifp4xf9xkXli7BHFtKY2+HaMHqqPiA=";

@@ -61,12 +59,6 @@ rustPlatform.buildRustPackage rec {
    libappindicator-gtk3
  ];

-  npmRoot = "..";
-
-  sourceRoot = "${src.name}/src-tauri";
-
-  buildAndTestDir = ".";
-
  meta = {
    homepage = "https://github.com/btpf/Alexandria";
    changelog = "https://github.com/btpf/Alexandria/releases/tag/v${version}";
@@ -17,7 +17,7 @@
 }:

 stdenvNoCC.mkDerivation rec {
-  version = "1.2.12";
+  version = "1.2.13";
  pname = "bun";

  src =
@@ -86,19 +86,19 @@ stdenvNoCC.mkDerivation rec {
    sources = {
      "aarch64-darwin" = fetchurl {
        url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-darwin-aarch64.zip";
-        hash = "sha256-ibU/bbdU0yTNaJz95dA1zBJMkDREI8XWvAf48AlPx6k=";
+        hash = "sha256-gVQ2dSTYwpjtsmm40N9h1GnsQZTTYcB+S40sZfu8Lvs=";
      };
      "aarch64-linux" = fetchurl {
        url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-linux-aarch64.zip";
-        hash = "sha256-yJiiBX+Rm3AL8onYQ9rknuEUyPYlx8H+0EN5D1RpRQk=";
+        hash = "sha256-tqJVN7wtEevkSkeN1iqOAdvJ9OHEt9LXMLSn6dNYDMk=";
      };
      "x86_64-darwin" = fetchurl {
        url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-darwin-x64-baseline.zip";
-        hash = "sha256-Ye0Or7vDQGRAp4t0A6t8B4jgkmrR2Y7CjDMjMvW7bu4=";
+        hash = "sha256-BTh6RkWJFTig33Ql6JEuwWt0JRFs1BZ2aqUsowE/jGQ=";
      };
      "x86_64-linux" = fetchurl {
        url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-linux-x64.zip";
-        hash = "sha256-MzeWT6ox2LzhmfkXCBMHEO8ucLmP80o09ZCxdFiApjM=";
+        hash = "sha256-i7LkxH6uGD8kc8Vbm853mMSig21kbCWHp5h6PRBi4QA=";
      };
    };
    updateScript = writeShellScript "update-bun" ''
@@ -62,6 +62,7 @@ stdenv.mkDerivation (finalAttrs: {
      payloads to compatible requests.
    '';
    homepage = "https://cartero.danirod.es";
+    changelog = "https://github.com/danirod/cartero/releases";
    license = lib.licenses.gpl3Plus;
    mainProgram = "cartero";
    maintainers = with lib.maintainers; [
@@ -30,6 +30,7 @@ python3.pkgs.buildPythonApplication rec {
      dnspython
      elementpath
      eventlet
+      extruct
      feedgen
      flask
      flask-compress
@@ -7,15 +7,15 @@
 }:
 rustPlatform.buildRustPackage rec {
  pname = "clang-tidy-sarif";
-  version = "0.7.0";
+  version = "0.8.0";

  src = fetchCrate {
    inherit pname version;
-    hash = "sha256-DFen1QYQxArNfc0CXNtP0nZEvbCxqTH5KS3q3FcfDPs=";
+    hash = "sha256-ALwEsF1n6WYqITfYTn8mIyn3sxTbDux17FxKIorKkFc=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-AfkiK91vXaw4oWvfYlV3C0M/cGf4ZThALB/cANcZmFQ=";
+  cargoHash = "sha256-cTBXStAA+oCRze2Bh/trultdqtBNOOpXQltJ6R34nF8=";

  nativeInstallCheckInputs = [ versionCheckHook ];
  doInstallCheck = true;
@@ -6,13 +6,13 @@

 stdenvNoCC.mkDerivation rec {
  pname = "cozette";
-  version = "1.28.0";
+  version = "1.29.0";

  src = fetchzip {
    url = "https://github.com/slavfox/Cozette/releases/download/v.${version}/CozetteFonts-v-${
      builtins.replaceStrings [ "." ] [ "-" ] version
    }.zip";
-    hash = "sha256-KxlChsydFtm26CFugbWqeJi5DQP0BxONSz5mOcyiE28=";
+    hash = "sha256-DHUnCzp6c3d57cfkO2kH+czXRiqRWn6DBTo9NVTghQ0=";
  };

  installPhase = ''
@@ -10,13 +10,13 @@

 buildGoModule rec {
  pname = "ddev";
-  version = "1.24.4";
+  version = "1.24.5";

  src = fetchFromGitHub {
    owner = "ddev";
    repo = "ddev";
    rev = "v${version}";
-    hash = "sha256-sd8Ux3zkKd9L2phv0dovWHSIpLS/OXCNwxTGGcvBQ3c=";
+    hash = "sha256-CyYGmxYJ5ef+H1qt0CiFcGOslBwkeHqdDQcmuqu4g9M=";
  };

  nativeBuildInputs = [
@@ -9,25 +9,15 @@
 stdenv.mkDerivation rec {
  pname = "debase";
  # NOTE: When updating version, also update commit hash in prePatch.
-  version = "2";
+  version = "3";

-  src =
-    (fetchFromGitHub {
-      owner = "toasterllc";
-      repo = "debase";
-      tag = "v${version}";
-      hash = "sha256-6AavH8Ag+879ntcxJDbVgsg8V6U4cxwPQYPKvq2PpoQ=";
-      fetchSubmodules = true;
-    }).overrideAttrs
-      {
-        # Workaround to fetch git@github.com submodules.
-        # See https://github.com/NixOS/nixpkgs/issues/195117
-        #
-        # Already fixed in latest upstream, so delete at next version bump.
-        GIT_CONFIG_COUNT = 1;
-        GIT_CONFIG_KEY_0 = "url.https://github.com/.insteadOf";
-        GIT_CONFIG_VALUE_0 = "git@github.com:";
-      };
+  src = fetchFromGitHub {
+    owner = "toasterllc";
+    repo = "debase";
+    tag = "v${version}";
+    hash = "sha256-IOh5TlFHFhIaP5bpQHYzY4wwmQUdwKePmSzEM2qx8oE=";
+    fetchSubmodules = true;
+  };

  prePatch = ''
    # xcrun is not available in the Darwin stdenv, but we don't need it anyway.
@@ -36,18 +26,13 @@ stdenv.mkDerivation rec {

    # NOTE: Update this when updating version.
    substituteInPlace Makefile \
-      --replace-fail 'git rev-parse HEAD' 'echo bbe9f1737ab229dd370640a4b5d5e742a051c13b' \
+      --replace-fail 'git rev-parse HEAD' 'echo aa083074d67938d50336bd3737c960b038d91134' \
      --replace-fail '$(GITHASHHEADER): .git/HEAD .git/index' '$(GITHASHHEADER):'
  '';

  patches = [
    # Ignore debase's vendored copy of libgit2 in favor of the nixpkgs version.
    ./ignore-vendored-libgit2.patch
-    # Already fixed in latest upstream, so delete at next version bump.
-    (fetchpatch {
-      url = "https://github.com/toasterllc/debase/commit/d483c5ac016ac2ef3600e93ae4022cd9d7781c83.patch";
-      hash = "sha256-vVQMOEiLTd46+UknZm8Y197sjyK/kTK/M+9sRX9AssY=";
-    })
  ];

  buildInputs = [
@@ -78,8 +63,6 @@ stdenv.mkDerivation rec {
  meta = {
    description = "TUI for drag-and-drop manipulation of git commits";
    homepage = "https://toaster.llc/debase";
-    # The author has not yet specified a license.
-    # See https://github.com/toasterllc/debase/pull/4
    license = lib.licenses.publicDomain;
    mainProgram = "debase";
    maintainers = with lib.maintainers; [
@@ -20,11 +20,11 @@ stdenv.mkDerivation rec {
  # the wrapped version of Descent 3. Once there’s a stable version of Descent
  # 3 that supports the -additionaldir command-line option, we can stop using
  # an unstable version of Descent 3.
-  version = "1.5.0-beta-unstable-2025-03-25";
+  version = "1.5.0-beta-unstable-2025-05-08";
  src = fetchFromGitHub {
    owner = "DescentDevelopers";
    repo = "Descent3";
-    rev = "67244d953588c8c63baa17c150076153c526258b";
+    rev = "72cca136162ccff6d738693d109e29568de90ebb";
    leaveDotGit = true;
    # Descent 3 is supposed to display its Git commit hash in the bottom right
    # corner of the main menu. That feature only works if either the .git
@@ -50,7 +50,7 @@ stdenv.mkDerivation rec {
      git rev-parse --verify HEAD | tr --delete '\n' > git-hash.txt
      rm -r .git
    '';
-    hash = "sha256-lRTzy5GQJ5J9ban7Q6pBmHHXgHNpgemlYYlzmUnvFW0=";
+    hash = "sha256-IcOSYIBqkk1e8NlPc4srr9glxWA4p0FY0QDAWb1Hb6I=";
  };

  hardeningDisable = [ "format" ];
@@ -1,21 +1,243 @@
-diff --git a/dim/Cargo.toml b/dim/Cargo.toml
-index b7c8106493...38518ba29d 100644
--- a/dim/Cargo.toml
-+++ b/dim/Cargo.toml
-@@ -15,7 +15,7 @@
- fdlimit = "0.2.1"
+diff --git a/Cargo.lock b/Cargo.lock
+index adb78aa..5634132 100644
+--- a/Cargo.lock
+++ b/Cargo.lock
+@@ -1,6 +1,6 @@
+ # This file is automatically @generated by Cargo.
+ # It is not intended for manual editing.
+-version = 3
+version = 4
 
- # git dependencies
-nightfall = { git = "https://github.com/Dusk-Labs/nightfall", tag = "0.3.12-rc4", default-features = false, features = [
-+nightfall = { git = "https://github.com/Dusk-Labs/nightfall", rev = "878f07edd5d2c71261c5ae02fe3a6db7cda18be7", default-features = false, features = [
-     "cuda",
-     "ssa_transmux",
- ] }
+ [[package]]
+ name = "addr2line"
+@@ -58,7 +58,7 @@ version = "0.7.7"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "5a824f2aa7e75a0c98c5a504fceb80649e9c35265d44525b5f94de4771a395cd"
+ dependencies = [
+- "getrandom",
+ "getrandom 0.2.11",
+  "once_cell",
+  "version_check",
+ ]
+@@ -979,7 +979,7 @@ dependencies = [
+  "tracing-appender",
+  "tracing-subscriber",
+  "url",
+- "uuid 1.5.0",
+ "uuid 1.16.0",
+  "xmlwriter",
+  "xtra",
+  "zip",
+@@ -1079,7 +1079,7 @@ dependencies = [
+  "tracing",
+  "tracing-appender",
+  "tracing-subscriber",
+- "uuid 1.5.0",
+ "uuid 1.16.0",
+ ]
+ 
+ [[package]]
+@@ -1411,6 +1411,18 @@ dependencies = [
+  "wasi 0.11.0+wasi-snapshot-preview1",
+ ]
+ 
+[[package]]
+name = "getrandom"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "26145e563e54f2cadc477553f1ec5ee650b00862f0a58bcd12cbdc5f0ea2d2f4"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi",
+ "wasi 0.14.2+wasi-0.2.4",
+]
+
+ [[package]]
+ name = "ghash"
+ version = "0.4.4"
+@@ -1874,9 +1886,9 @@ checksum = "03087c2bad5e1034e8cace5926dec053fb3790248370865f5117a7d0213354c8"
+ 
+ [[package]]
+ name = "libc"
+-version = "0.2.150"
+version = "0.2.172"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "89d92a4743f9a61002fae18374ed11e7973f530cb3a3255fb354818118b2203c"
+checksum = "d750af042f7ef4f724306de029d18836c26c1765a54a6a3f094cbd23a7267ffa"
+ 
+ [[package]]
+ name = "libsqlite3-sys"
+@@ -2049,14 +2061,14 @@ dependencies = [
+ [[package]]
+ name = "nightfall"
+ version = "0.3.12-rc4"
+-source = "git+https://github.com/Dusk-Labs/nightfall?tag=0.3.12-rc4#147ea96146b4cae6f666741020cef0622a90d46c"
+source = "git+https://github.com/Dusk-Labs/nightfall?rev=878f07edd5d2c71261c5ae02fe3a6db7cda18be7#878f07edd5d2c71261c5ae02fe3a6db7cda18be7"
+ dependencies = [
+  "async-trait",
+  "cfg-if",
+  "err-derive",
+  "lazy_static",
+  "mp4",
+- "nix 0.20.0",
+ "nix 0.27.1",
+  "ntapi",
+  "once_cell",
+  "psutil",
+@@ -2067,7 +2079,7 @@ dependencies = [
+  "tokio",
+  "tokio-stream",
+  "tracing",
+- "uuid 0.8.2",
+ "uuid 1.16.0",
+  "winapi",
+  "xtra",
+  "xtra_proc",
+@@ -2075,27 +2087,26 @@ dependencies = [
+ 
+ [[package]]
+ name = "nix"
+-version = "0.20.0"
+version = "0.23.2"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "fa9b4819da1bc61c0ea48b63b7bc8604064dd43013e7cc325df098d49cd7c18a"
+checksum = "8f3790c00a0150112de0f4cd161e3d7fc4b2d8a5542ffc35f099a2562aecb35c"
+ dependencies = [
+  "bitflags 1.3.2",
+  "cc",
+  "cfg-if",
+  "libc",
+ "memoffset 0.6.5",
+ ]
+ 
+ [[package]]
+ name = "nix"
+-version = "0.23.2"
+version = "0.27.1"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "8f3790c00a0150112de0f4cd161e3d7fc4b2d8a5542ffc35f099a2562aecb35c"
+checksum = "2eb04e9c688eff1c89d72b407f168cf79bb9e867a9d3323ed6c01519eb9cc053"
+ dependencies = [
+- "bitflags 1.3.2",
+- "cc",
+ "bitflags 2.4.1",
+  "cfg-if",
+  "libc",
+- "memoffset 0.6.5",
+ ]
+ 
+ [[package]]
+@@ -2140,9 +2151,9 @@ dependencies = [
+ 
+ [[package]]
+ name = "ntapi"
+-version = "0.3.7"
+version = "0.4.1"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "c28774a7fd2fbb4f0babd8237ce554b73af68021b5f695a3cebd6c59bac0980f"
+checksum = "e8a3895c6391c39d7fe7ebc444a87eb2991b2a0bc718fdabd071eec617fc68e4"
+ dependencies = [
+  "winapi",
+ ]
+@@ -2481,6 +2492,12 @@ dependencies = [
+  "proc-macro2",
+ ]
+ 
+[[package]]
+name = "r-efi"
+version = "5.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "74765f6d916ee2faa39bc8e68e4f3ed8949b48cccdac59983d287a7cb71ce9c5"
+
+ [[package]]
+ name = "rand"
+ version = "0.8.5"
+@@ -2508,7 +2525,7 @@ version = "0.6.4"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
+ dependencies = [
+- "getrandom",
+ "getrandom 0.2.11",
+ ]
+ 
+ [[package]]
+@@ -2689,7 +2706,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "fb0205304757e5d899b9c2e448b867ffd03ae7f988002e47cd24954391394d0b"
+ dependencies = [
+  "cc",
+- "getrandom",
+ "getrandom 0.2.11",
+  "libc",
+  "spin 0.9.8",
+  "untrusted 0.9.0",
+@@ -3505,7 +3522,7 @@ dependencies = [
+  "tower-layer",
+  "tower-service",
+  "tracing",
+- "uuid 1.5.0",
+ "uuid 1.16.0",
+ ]
+ 
+ [[package]]
+@@ -3742,16 +3759,16 @@ version = "0.8.2"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "bc5cf98d8186244414c848017f0e2676b3fcb46807f6668a97dfe67359a3c4b7"
+ dependencies = [
+- "getrandom",
+ "getrandom 0.2.11",
+ ]
+ 
+ [[package]]
+ name = "uuid"
+-version = "1.5.0"
+version = "1.16.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "88ad59a7560b41a70d191093a945f0b87bc1deeda46fb237479708a1d6b6cdfc"
+checksum = "458f7a779bf54acc9f347480ac654f68407d3aab21269a6e3c9f922acd9e2da9"
+ dependencies = [
+- "getrandom",
+ "getrandom 0.3.3",
+ ]
+ 
+ [[package]]
+@@ -3803,6 +3820,15 @@ version = "0.11.0+wasi-snapshot-preview1"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
+ 
+[[package]]
+name = "wasi"
+version = "0.14.2+wasi-0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9683f9a5a998d873c0d21fcbe3c083009670149a8fab228644b8bd36b2c48cb3"
+dependencies = [
+ "wit-bindgen-rt",
+]
+
+ [[package]]
+ name = "wasm-bindgen"
+ version = "0.2.88"
+@@ -4092,6 +4118,15 @@ dependencies = [
+  "windows-sys 0.48.0",
+ ]
+ 
+[[package]]
+name = "wit-bindgen-rt"
+version = "0.39.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6f42320e61fe2cfd34354ecb597f86f413484a798ba44a8ca1165c58d42da6c1"
+dependencies = [
+ "bitflags 2.4.1",
+]
+
+ [[package]]
+ name = "xmlwriter"
+ version = "0.1.0"
 diff --git a/dim-core/Cargo.toml b/dim-core/Cargo.toml
-index b311b7c7af...ffc5d85dbb 100644
+index b311b7c..ffc5d85 100644
 --- a/dim-core/Cargo.toml
 +++ b/dim-core/Cargo.toml
-@@ -11,7 +11,7 @@
+@@ -11,7 +11,7 @@ vaapi = ["nightfall/vaapi"]
 
 [dependencies]
 # git dependencies
@@ -24,7 +246,7 @@ index b311b7c7af...ffc5d85dbb 100644
     "cuda",
     "ssa_transmux",
 ] }
-@@ -72,7 +72,7 @@
+@@ -72,7 +72,7 @@ tracing-subscriber = { version = "^0.3.10", features = [
     "json",
 ] }
 url = "2.2.2"
@@ -34,10 +256,10 @@ index b311b7c7af...ffc5d85dbb 100644
 xtra = { version = "0.5.1", features = ["tokio", "with-tokio-1"] }
 
 diff --git a/dim-web/Cargo.toml b/dim-web/Cargo.toml
-index 2da5764d50...4c7574c0b4 100644
+index 2da5764..4c7574c 100644
 --- a/dim-web/Cargo.toml
 +++ b/dim-web/Cargo.toml
-@@ -14,7 +14,7 @@
+@@ -14,7 +14,7 @@ dim-utils = { path = "../dim-utils" }
 dim-events = { path = "../dim-events" }
 dim-core = { path = "../dim-core" }
 
@@ -46,3 +268,16 @@ index 2da5764d50...4c7574c0b4 100644
     "cuda",
     "ssa_transmux",
 ] }
+diff --git a/dim/Cargo.toml b/dim/Cargo.toml
+index b7c8106..38518ba 100644
+--- a/dim/Cargo.toml
+++ b/dim/Cargo.toml
+@@ -15,7 +15,7 @@ xtra = { version = "0.5.1", features = ["tokio", "with-tokio-1"] }
+ fdlimit = "0.2.1"
+ 
+ # git dependencies
+-nightfall = { git = "https://github.com/Dusk-Labs/nightfall", tag = "0.3.12-rc4", default-features = false, features = [
+nightfall = { git = "https://github.com/Dusk-Labs/nightfall", rev = "878f07edd5d2c71261c5ae02fe3a6db7cda18be7", default-features = false, features = [
+     "cuda",
+     "ssa_transmux",
+ ] }
@@ -0,0 +1,74 @@
+From af60408709d51a002944a3deb92cb4d2b242add5 Mon Sep 17 00:00:00 2001
+From: Gabriel Fontes <hi@m7.rs>
+Date: Thu, 8 Aug 2024 10:40:44 -0300
+Subject: [PATCH] fix build failure with rust 1.80
+
+---
+ Cargo.lock | 20 ++++++++++++++------
+ 1 file changed, 14 insertions(+), 6 deletions(-)
+
+diff --git a/Cargo.lock b/Cargo.lock
+index adb78aa7..7c057bad 100644
+--- a/Cargo.lock
+++ b/Cargo.lock
+@@ -643,7 +643,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "3cd91cf61412820176e137621345ee43b3f4423e589e7ae4e50d601d93e35ef8"
+ dependencies = [
+  "percent-encoding",
+- "time 0.3.30",
+ "time 0.3.36",
+  "version_check",
+ ]
+ 
+@@ -2157,6 +2157,12 @@ dependencies = [
+  "winapi",
+ ]
+ 
+[[package]]
+name = "num-conv"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "51d515d32fb182ee37cda2ccdcb92950d6a3c2893aa280e540671c2cd0f3b1d9"
+
+ [[package]]
+ name = "num-integer"
+ version = "0.1.45"
+@@ -3301,12 +3307,13 @@ dependencies = [
+ 
+ [[package]]
+ name = "time"
+-version = "0.3.30"
+version = "0.3.36"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "c4a34ab300f2dee6e562c10a046fc05e358b29f9bf92277f30c3c8d82275f6f5"
+checksum = "5dfd88e563464686c916c7e46e623e520ddc6d79fa6641390f2e3fa86e83e885"
+ dependencies = [
+  "deranged",
+  "itoa",
+ "num-conv",
+  "powerfmt",
+  "serde",
+  "time-core",
+@@ -3321,10 +3328,11 @@ checksum = "ef927ca75afb808a4d64dd374f00a2adf8d0fcff8e7b184af886c3c87ec4a3f3"
+ 
+ [[package]]
+ name = "time-macros"
+-version = "0.2.15"
+version = "0.2.18"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "4ad70d68dba9e1f8aceda7aa6711965dfec1cac869f311a51bd08b3a2ccbce20"
+checksum = "3f252a68540fde3a3877aeea552b832b40ab9a69e318efd078774a01ddee1ccf"
+ dependencies = [
+ "num-conv",
+  "time-core",
+ ]
+ 
+@@ -3539,7 +3547,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "09d48f71a791638519505cefafe162606f706c25592e4bde4d97600c0195312e"
+ dependencies = [
+  "crossbeam-channel",
+- "time 0.3.30",
+ "time 0.3.36",
+  "tracing-subscriber",
+ ]
+ 
@@ -45,7 +45,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    '';
  };

-  patches = [
+  cargoPatches = [
    # Upstream uses a 'ffpath' function to look for config directory and
    # (ffmpeg) binaries in the same directory as the binary. Patch it to use
    # the working dir and PATH instead.
@@ -55,6 +55,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
    # revision for FFmpeg >= 6 support.
    ./bump-nightfall.patch

+    # Bump the time dependency to fix build failure with rust 1.80+
+    # https://github.com/Dusk-Labs/dim/pull/614
+    ./bump-time.patch
+
    # Upstream has some unused imports that prevent things from compiling...
    # Remove for next release.
    (fetchpatch {
@@ -64,6 +68,9 @@ rustPlatform.buildRustPackage (finalAttrs: {
    })
  ];

+  useFetchCargoVendor = true;
+  cargoHash = "sha256-T0v7pajg3UfRnVOx3ie6rOf+vJSW2l7yoCsJrtxIwcg=";
+
  postPatch = ''
    substituteInPlace dim-core/src/lib.rs \
      --replace-fail "#![deny(warnings)]" "#![warn(warnings)]"
@@ -71,7 +78,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
      --replace-fail "#![deny(warnings)]" "#![warn(warnings)]"
    substituteInPlace dim-database/src/lib.rs \
      --replace-fail "#![deny(warnings)]" "#![warn(warnings)]"
-    ln -sf ${./Cargo.lock} Cargo.lock
  '';

  postConfigure = ''
@@ -88,14 +94,6 @@ rustPlatform.buildRustPackage (finalAttrs: {

  buildFeatures = lib.optional libvaSupport "vaapi";

-  cargoLock = {
-    lockFile = ./Cargo.lock;
-    outputHashes = {
-      "mp4-0.8.2" = "sha256-OtVRtOTU/yoxxoRukpUghpfiEgkKoJZNflMQ3L26Cno=";
-      "nightfall-0.3.12-rc4" = "sha256-AbSuLe3ySOla3NB+mlfHRHqHuMqQbrThAaUZ747GErE=";
-    };
-  };
-
  checkFlags = [
    # Requires network
    "--skip=tmdb::tests::johhny_test_seasons"
@@ -17,13 +17,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "dosage";
-  version = "1.9.4";
+  version = "1.9.9";

  src = fetchFromGitHub {
    owner = "diegopvlk";
    repo = "Dosage";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-EFcfkj0NOmQrWgLJpWHdIX7iitqfZwgTmkMvueJPS/c=";
+    hash = "sha256-UVcbZgPk35VsYvyzIJrR79vAhSByJjn8kh+y0KQcwpM=";
  };

  # https://github.com/NixOS/nixpkgs/issues/318830
@@ -2,6 +2,9 @@
  lib,
  stdenv,
  fetchFromGitHub,
+  installShellFiles,
+  meson,
+  ninja,
  pkg-config,
  dbus,
  hidapi,
@@ -12,20 +15,21 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "dualsensectl";
-  version = "0.6";
+  version = "0.7";

  src = fetchFromGitHub {
    owner = "nowrep";
    repo = "dualsensectl";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-Wu3TcnHoMZELC7I2PlE8z00+CycgpNd6SiZd5MjYD+I=";
+    hash = "sha256-/EPFZWpa7U4fmcdX2ycFkPgaqlKEA2cD84LBkcvVVhc=";
  };

-  postPatch = ''
-    substituteInPlace Makefile --replace "/usr/" "/"
-  '';
-
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [
+    installShellFiles
+    meson
+    ninja
+    pkg-config
+  ];

  buildInputs = [
    dbus
@@ -33,7 +37,11 @@ stdenv.mkDerivation (finalAttrs: {
    udev
  ];

-  makeFlags = [ "DESTDIR=$(out)" ];
+  postInstall = ''
+    installShellCompletion --cmd dualsensectl \
+      --bash ../completion/dualsensectl \
+      --zsh ../completion/_dualsensectl
+  '';

  passthru = {
    tests.version = testers.testVersion { package = finalAttrs.finalPackage; };
@@ -123,7 +123,10 @@ stdenv.mkDerivation (
        "Chat"
      ];
      startupWMClass = "Element";
-      mimeTypes = [ "x-scheme-handler/element" ];
+      mimeTypes = [
+        "x-scheme-handler/element"
+        "x-scheme-handler/io.element.desktop"
+      ];
    };

    postFixup = lib.optionalString stdenv.hostPlatform.isDarwin ''
@@ -18,7 +18,7 @@

 stdenv.mkDerivation rec {
  pname = "emblem";
-  version = "1.4.0";
+  version = "1.5.0";

  src = fetchFromGitLab {
    domain = "gitlab.gnome.org";
@@ -26,13 +26,13 @@ stdenv.mkDerivation rec {
    owner = "design";
    repo = "emblem";
    rev = version;
-    sha256 = "sha256-pW+2kQANZ9M1f0jMoBqCxMjLCu0xAnuEE2EdzDq4ZCE=";
+    sha256 = "sha256-knq8OKoc8Xv7lOr0ub9+2JfeQE84UlTHR1q4SFFF8Ug=";
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
    inherit src;
    name = "${pname}-${version}";
-    hash = "sha256-j9PrnXt0GyyfCKmcq1zYmDNlrvogtK5n316MIC+z+w0=";
+    hash = "sha256-CsISaVlRGtVVEna1jyGZo/IdWcJdwHJv6LXcXYha2UE=";
  };

  nativeBuildInputs = [
@@ -18,21 +18,20 @@
  nix-update-script,
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "eyedropper";
-  version = "2.0.1";
+  version = "2.1.0";

  src = fetchFromGitHub {
    owner = "FineFindus";
    repo = "eyedropper";
-    rev = "v${version}";
-    hash = "sha256-FyGj0180Wn8iIDTdDqnNEvFYegwdWCsCq+hmyTTUIo4=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-t/OFA4oDXtnMmyFptG7zsGW5ubaSNrSnaDR1l9nVbLQ=";
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit src;
-    name = "${pname}-${version}";
-    hash = "sha256-nYmH7Nu43TDJKvwfSaBKSihD0acLPmIUQpQM6kV4CAk=";
+    inherit (finalAttrs) pname src version;
+    hash = "sha256-39BWpyGhX6fYzxwrodiK1A3ASuRiI7tOA+pSKu8Bx5Q=";
  };

  nativeBuildInputs = [
@@ -61,10 +60,11 @@ stdenv.mkDerivation rec {
  meta = {
    description = "Pick and format colors";
    homepage = "https://github.com/FineFindus/eyedropper";
+    changelog = "https://github.com/FineFindus/eyedropper/releases/tag/v${finalAttrs.version}";
    mainProgram = "eyedropper";
    license = lib.licenses.gpl3Plus;
    platforms = lib.platforms.linux;
    maintainers = with lib.maintainers; [ zendo ];
    teams = [ lib.teams.gnome-circle ];
  };
-}
+})
@@ -21,8 +21,6 @@
  fetchpatch,
 }:

-with lib.strings;
-
 let

  version = "2.79.3";
@@ -170,7 +168,7 @@ let
        runHook preInstall

        mkdir -p "$out/bin"
-        for script in ${concatStringsSep " " scripts}; do
+        for script in ${lib.concatStringsSep " " scripts}; do
          cp "${dir}/$script" "$out/bin/"
        done

@@ -267,7 +265,7 @@ let

    let

-      runtimePath = concatStringsSep ":" (map (p: "${p}/bin") ([ faust ] ++ runtimeInputs));
+      runtimePath = lib.concatStringsSep ":" (map (p: "${p}/bin") ([ faust ] ++ runtimeInputs));

    in
    stdenv.mkDerivation (
@@ -1,7 +1,7 @@
 {
  faust,
  alsa-lib,
-  qtbase,
+  qt5,
  writeText,
  buildPackages,
 }:
@@ -14,7 +14,7 @@ let
      cd -- "$(dirname "$p")"
      binary=$(basename --suffix=.dsp "$p")
      rm -f .$binary-wrapped
-      wrapProgram $binary --set QT_PLUGIN_PATH "${qtbase}/${qtbase.qtPluginPrefix}"
+      wrapProgram $binary --set QT_PLUGIN_PATH "${qt5.qtbase}/${qt5.qtbase.qtPluginPrefix}"
      sed -i $binary -e 's@exec@cd "$(dirname "$(readlink -f "''${BASH_SOURCE[0]}")")" \&\& exec@g'
      cd $workpath
    done
@@ -26,7 +26,7 @@ faust.wrapWithBuildEnv {

  propagatedBuildInputs = [
    alsa-lib
-    qtbase
+    qt5.qtbase
  ];

  dontWrapQtApps = true;
@@ -36,7 +36,7 @@ faust.wrapWithBuildEnv {
      # append the wrapping code to the compilation script
      cat ${wrapBinary} >> $script
      # prevent the qmake error when running the script
-      sed -i "/QMAKE=/c\ QMAKE="${qtbase.dev}/bin/qmake"" $script
+      sed -i "/QMAKE=/c\ QMAKE="${qt5.qtbase.dev}/bin/qmake"" $script
    done
  '';
 }
@@ -2,7 +2,7 @@
  bash,
  faust,
  jack2,
-  qtbase,
+  qt5,
  libsndfile,
  alsa-lib,
  writeText,
@@ -18,7 +18,7 @@ let
      cd -- "$(dirname "$p")"
      binary=$(basename --suffix=.dsp "$p")
      rm -f .$binary-wrapped
-      wrapProgram $binary --set QT_PLUGIN_PATH "${qtbase}/${qtbase.qtPluginPrefix}"
+      wrapProgram $binary --set QT_PLUGIN_PATH "${qt5.qtbase}/${qt5.qtbase.qtPluginPrefix}"
      sed -i $binary -e 's@exec@cd "$(dirname "$(readlink -f "''${BASH_SOURCE[0]}")")" \&\& exec@g'
      cd $workpath
    done
@@ -39,7 +39,7 @@ faust.wrapWithBuildEnv {

  propagatedBuildInputs = [
    jack2
-    qtbase
+    qt5.qtbase
    libsndfile
    alsa-lib
    which
@@ -52,7 +52,7 @@ faust.wrapWithBuildEnv {
      # append the wrapping code to the compilation script
      cat ${wrapBinary} >> $script
      # prevent the qmake error when running the script
-      sed -i "/QMAKE=/c\ QMAKE="${qtbase.dev}/bin/qmake"" $script
+      sed -i "/QMAKE=/c\ QMAKE="${qt5.qtbase.dev}/bin/qmake"" $script
    done
  '';
 }
@@ -3,7 +3,7 @@
  boost,
  faust,
  lv2,
-  qtbase,
+  qt5,
 }:

 faust.wrapWithBuildEnv {
@@ -17,12 +17,12 @@ faust.wrapWithBuildEnv {
  propagatedBuildInputs = [
    boost
    lv2
-    qtbase
+    qt5.qtbase
  ];

  dontWrapQtApps = true;

  preFixup = ''
-    sed -i "/QMAKE=/c\ QMAKE="${qtbase.dev}/bin/qmake"" "$out"/bin/faust2lv2;
+    sed -i "/QMAKE=/c\ QMAKE="${qt5.qtbase.dev}/bin/qmake"" "$out"/bin/faust2lv2;
  '';
 }
@@ -2,9 +2,12 @@
  lib,
  stdenv,
  fetchFromGitHub,
-  gtk3,
  libdivsufsort,
  pkg-config,
+
+  withGTK3 ? !stdenv.hostPlatform.isDarwin,
+  gtk3,
+  llvmPackages,
  wrapGAppsHook3,
 }:

@@ -21,24 +24,34 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [
    pkg-config
-    wrapGAppsHook3
-  ];
+  ] ++ lib.optional withGTK3 wrapGAppsHook3;

-  buildInputs = [
-    gtk3
-    libdivsufsort
-  ];
+  buildInputs =
+    [
+      libdivsufsort
+    ]
+    ++ lib.optional withGTK3 gtk3
+    ++ lib.optional (withGTK3 && stdenv.hostPlatform.isDarwin) llvmPackages.openmp;

  patches = [ ./use-system-libdivsufsort.patch ];

-  makeFlags = [ "PREFIX=${placeholder "out"}" ];
+  makeFlags = [
+    "PREFIX=${placeholder "out"}"
+    "TARGET=${if withGTK3 then "gtk" else "cli"}"
+  ];
+
+  installPhase = lib.optionalString (!withGTK3) ''
+    runHook preInstall
+    install -Dm755 flips -t $out/bin
+    runHook postInstall
+  '';

  meta = {
    description = "Patcher for IPS and BPS files";
    homepage = "https://github.com/Alcaro/Flips";
    license = lib.licenses.gpl3Plus;
    maintainers = with lib.maintainers; [ aleksana ];
-    platforms = lib.platforms.linux;
+    platforms = lib.platforms.unix;
    mainProgram = "flips";
  };
 }
@@ -8,17 +8,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "framework-tool";
-  version = "0.4.0";
+  version = "0.4.2";

  src = fetchFromGitHub {
    owner = "FrameworkComputer";
    repo = "framework-system";
    tag = "v${version}";
-    hash = "sha256-JPIpaAfXraqU6YM31bLImeJUCD3/O+PLcaZBxUjDqlM=";
+    hash = "sha256-eH6EUpdITFX3FDV0LbeOnqvDmbriDT5R02jhM2DVqtA=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-Kf3DXEDpCbbixUjeyBi1xkR32sW2uuasxqeWeq/X2Xk=";
+  cargoHash = "sha256-qS65k/cqP9t71TxuqP1/0xIPkhe56WEEbzDzV6JfKrs=";

  nativeBuildInputs = [ pkg-config ];
  buildInputs = [ udev ];
@@ -19,19 +19,19 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "fretboard";
-  version = "8.0";
+  version = "9.1";

  src = fetchFromGitHub {
    owner = "bragefuglseth";
    repo = "fretboard";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-8xINlVhWgg73DrRi8S5rhNc1sbG4DbWOsiEBjU8NSXo=";
+    hash = "sha256-LTUZPOecX1OiLcfdiY/P2ffq91QcnFjW6knM9H/Z+Lc=";
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
    src = finalAttrs.src;
    name = "${finalAttrs.pname}-${finalAttrs.version}";
-    hash = "sha256-wYDlJ5n878Apv+ywnHnDy1Rgn+WJtcuePsGYEWSNvs4=";
+    hash = "sha256-Gl78z9FR/sB14uFDLKgnfN4B5yOi6A6MH64gDXcLiWA=";
  };

  nativeBuildInputs = [
@@ -7,18 +7,18 @@

 buildGoModule rec {
  pname = "fx";
-  version = "35.0.0";
+  version = "36.0.0";

  src = fetchFromGitHub {
    owner = "antonmedv";
    repo = pname;
    rev = version;
-    hash = "sha256-EirlA/gcW77UP9I4pVCjjG3pSYnCPw+idX9YS1izEpY=";
+    hash = "sha256-wUiyMczToGqfHZ/FMUhCO4ud6h/bNHhVt4eWoZJckbU=";
  };

  nativeBuildInputs = [ installShellFiles ];

-  vendorHash = "sha256-h9BUL7b8rNmhVxmXL3CBF39WSkX+8eS2M9NDJhbPI0o=";
+  vendorHash = "sha256-8KiCj2khO0zxsZDG1YD0EjsoZSY4q+IXC+NLeeXgVj4=";

  postInstall = ''
    installShellCompletion --cmd fx \
@@ -4,6 +4,10 @@
  fetchurl,
  ncurses5,
  libxcrypt-legacy,
+  xz,
+  zstd,
+  makeBinaryWrapper,
+  darwin,
 }:

 stdenv.mkDerivation rec {
@@ -38,6 +42,11 @@ stdenv.mkDerivation rec {
    ./info-fix.patch
  ];

+  nativeBuildInputs = lib.optionals (stdenv.isDarwin && stdenv.isx86_64) [
+    makeBinaryWrapper
+    darwin.sigtool
+  ];
+
  dontConfigure = true;
  dontBuild = true;
  dontPatchELF = true;
@@ -50,20 +59,32 @@ stdenv.mkDerivation rec {
    rm $out/bin/{arm-none-eabi-gdb-py,arm-none-eabi-gdb-add-index-py} || :
  '';

-  preFixup = lib.optionalString stdenv.isLinux ''
-    find $out -type f | while read f; do
-      patchelf "$f" > /dev/null 2>&1 || continue
-      patchelf --set-interpreter $(cat ${stdenv.cc}/nix-support/dynamic-linker) "$f" || true
-      patchelf --set-rpath ${
-        lib.makeLibraryPath [
-          "$out"
-          stdenv.cc.cc
-          ncurses5
-          libxcrypt-legacy
-        ]
-      } "$f" || true
-    done
-  '';
+  preFixup =
+    lib.optionalString stdenv.isLinux ''
+      find $out -type f | while read f; do
+        patchelf "$f" > /dev/null 2>&1 || continue
+        patchelf --set-interpreter $(cat ${stdenv.cc}/nix-support/dynamic-linker) "$f" || true
+        patchelf --set-rpath ${
+          lib.makeLibraryPath [
+            "$out"
+            stdenv.cc.cc
+            ncurses5
+            libxcrypt-legacy
+          ]
+        } "$f" || true
+      done
+    ''
+    + lib.optionalString (stdenv.isDarwin && stdenv.isx86_64) ''
+      find "$out" -executable -type f | while read executable; do
+        ( \
+          install_name_tool \
+            -change "/usr/local/opt/zstd/lib/libzstd.1.dylib" "${lib.getLib zstd}/lib/libzstd.1.dylib" \
+            -change "/usr/local/opt/xz/lib/liblzma.5.dylib" "${lib.getLib xz}/lib/liblzma.5.dylib" \
+            "$executable" \
+          && codesign -f -s - "$executable" \
+        ) || true
+      done
+    '';

  meta = with lib; {
    description = "Pre-built GNU toolchain from ARM Cortex-M & Cortex-R processors";
@@ -6,6 +6,8 @@
  libxcrypt-legacy,
  xz,
  zstd,
+  makeBinaryWrapper,
+  darwin,
 }:

 stdenv.mkDerivation rec {
@@ -34,6 +36,11 @@ stdenv.mkDerivation rec {
      .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
  };

+  nativeBuildInputs = lib.optionals (stdenv.isDarwin && stdenv.isx86_64) [
+    makeBinaryWrapper
+    darwin.sigtool
+  ];
+
  patches = [
    # fix double entry in share/info/porting.info
    # https://github.com/NixOS/nixpkgs/issues/363902
@@ -52,22 +59,34 @@ stdenv.mkDerivation rec {
    rm $out/bin/{arm-none-eabi-gdb-py,arm-none-eabi-gdb-add-index-py} || :
  '';

-  preFixup = lib.optionalString stdenv.isLinux ''
-    find $out -type f | while read f; do
-      patchelf "$f" > /dev/null 2>&1 || continue
-      patchelf --set-interpreter $(cat ${stdenv.cc}/nix-support/dynamic-linker) "$f" || true
-      patchelf --set-rpath ${
-        lib.makeLibraryPath [
-          "$out"
-          stdenv.cc.cc
-          ncurses6
-          libxcrypt-legacy
-          xz
-          zstd
-        ]
-      } "$f" || true
-    done
-  '';
+  preFixup =
+    lib.optionalString stdenv.isLinux ''
+      find $out -type f | while read f; do
+        patchelf "$f" > /dev/null 2>&1 || continue
+        patchelf --set-interpreter $(cat ${stdenv.cc}/nix-support/dynamic-linker) "$f" || true
+        patchelf --set-rpath ${
+          lib.makeLibraryPath [
+            "$out"
+            stdenv.cc.cc
+            ncurses6
+            libxcrypt-legacy
+            xz
+            zstd
+          ]
+        } "$f" || true
+      done
+    ''
+    + lib.optionalString (stdenv.isDarwin && stdenv.isx86_64) ''
+      find "$out" -executable -type f | while read executable; do
+        ( \
+          install_name_tool \
+            -change "/usr/local/opt/zstd/lib/libzstd.1.dylib" "${lib.getLib zstd}/lib/libzstd.1.dylib" \
+            -change "/usr/local/opt/xz/lib/liblzma.5.dylib" "${lib.getLib xz}/lib/liblzma.5.dylib" \
+            "$executable" \
+          && codesign -f -s - "$executable" \
+        ) || true
+      done
+    '';

  meta = with lib; {
    description = "Pre-built GNU toolchain from ARM Cortex-M & Cortex-R processors";
@@ -23,14 +23,14 @@

 python3Packages.buildPythonApplication rec {
  pname = "gearlever";
-  version = "3.2.2";
+  version = "3.2.4";
  pyproject = false; # Built with meson

  src = fetchFromGitHub {
    owner = "mijorus";
    repo = "gearlever";
    tag = version;
-    hash = "sha256-8gvulVq3RQZ/v7DCJ1Azrs23WMEznJCaalyjqD6iCU8=";
+    hash = "sha256-i7Yqe89b9kAR+ygHL2dlYvdPizBZG6MRMlPFvbHsIdQ=";
  };

  postPatch =
@@ -31,7 +31,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "gmic";
-  version = "3.5.3";
+  version = "3.5.4";

  outputs = [
    "out"
@@ -44,7 +44,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "GreycLab";
    repo = "gmic";
    rev = "v.${finalAttrs.version}";
-    hash = "sha256-DO9BtU0TW1HzCgrwx4Hocxlhl+tO0IztifqBloqmmtM=";
+    hash = "sha256-WhhEBhwv2bBwsWPPMDIA2jhUzqcD6yJhHg1Eunu8y14=";
  };

  # TODO: build this from source
@@ -54,7 +54,7 @@ stdenv.mkDerivation (finalAttrs: {
    url = "https://gmic.eu/gmic_stdlib_community${
      lib.replaceStrings [ "." ] [ "" ] finalAttrs.version
    }.h";
-    hash = "sha256-LWAzg72MZ4kOTAS+2xwR3iVY8vPch3NAjx/uXX2Y0W4=";
+    hash = "sha256-JO8ijrOgrOq7lB8NaxnlsQhDXSMgAGQlOG3lT9NfuMw=";
  };

  nativeBuildInputs = [
@@ -74,6 +74,7 @@ stdenv.mkDerivation rec {
  meta = with lib; {
    homepage = "https://apps.gnome.org/Calculator/";
    description = "Application that solves mathematical equations and is suitable as a default application in a Desktop environment";
+    mainProgram = "gnome-calculator";
    teams = [ teams.gnome ];
    license = licenses.gpl3Plus;
    platforms = platforms.unix;
@@ -24,19 +24,19 @@ let
    meta.license = lib.licenses.mit;
  };
 in
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
  pname = "goose-cli";
-  version = "1.0.17";
+  version = "1.0.23";

  src = fetchFromGitHub {
    owner = "block";
    repo = "goose";
-    tag = "v${version}";
-    hash = "sha256-l/lcwTNUq2xJHh0MKhnDZjRJ/5cANbdar/Vusf38esQ=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-jdoopa4pbW3MSgbNmNSp47iiXZF8H2GEgyhpkV1cB4A=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-1xKWzgptnM1ZP0nQXILBoaKVwL2FyXpldTUIa1ITQO0=";
+  cargoHash = "sha256-We2v/U9pK4O7JVXyVDvHwyrujPLp9jL1m4SKcMg/Hvc=";

  nativeBuildInputs = [ pkg-config ];

@@ -59,14 +59,22 @@ rustPlatform.buildRustPackage rec {
      # need dbus-daemon
      "--skip=config::base::tests::test_multiple_secrets"
      "--skip=config::base::tests::test_secret_management"
+      "--skip=config::base::tests::test_concurrent_extension_writes"
      # Observer should be Some with both init project keys set
      "--skip=tracing::langfuse_layer::tests::test_create_langfuse_observer"
      "--skip=providers::gcpauth::tests::test_token_refresh_race_condition"
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
      # Lazy instance has previously been poisoned
      "--skip=jetbrains::tests::test_capabilities"
      "--skip=jetbrains::tests::test_router_creation"
+      "--skip=logging::tests::test_log_file_name::with_session_name_without_error_capture"
+      "--skip=logging::tests::test_log_file_name::without_session_name"
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      "--skip=providers::gcpauth::tests::test_load_from_metadata_server"
+      "--skip=providers::oauth::tests::test_get_workspace_endpoints"
+      "--skip=tracing::langfuse_layer::tests::test_batch_manager_spawn_sender"
+      "--skip=tracing::langfuse_layer::tests::test_batch_send_partial_failure"
+      "--skip=tracing::langfuse_layer::tests::test_batch_send_success"
    ];

  passthru.updateScript = nix-update-script { };
@@ -76,7 +84,10 @@ rustPlatform.buildRustPackage rec {
    homepage = "https://github.com/block/goose";
    mainProgram = "goose";
    license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ cloudripper ];
+    maintainers = with lib.maintainers; [
+      cloudripper
+      thardin
+    ];
    platforms = lib.platforms.linux ++ lib.platforms.darwin;
  };
-}
+})
@@ -7,13 +7,13 @@

 buildNpmPackage (finalAttrs: {
  pname = "hyperswarm";
-  version = "4.11.5";
+  version = "4.11.7";

  src = fetchFromGitHub {
    owner = "holepunchto";
    repo = "hyperswarm";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-jyEwIb8nAnk6Fiw3lMgURoSOqz3lka085c58qq4Vxwc=";
+    hash = "sha256-Z/FNBDJbiyR5AY40RDtiuQmjNUZ+BSGv8aewBnhSNZw=";
  };

  npmDepsHash = "sha256-4ysUYFIFlzr57J7MdZit1yX3Dgpb2eY0rdYnwyppwK0=";
@@ -26,19 +26,19 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "identity";
-  version = "0.7.0";
+  version = "25.03";

  src = fetchFromGitLab {
    domain = "gitlab.gnome.org";
    owner = "YaLTeR";
    repo = "identity";
-    rev = "refs/tags/v${finalAttrs.version}";
-    hash = "sha256-h8/mWGuosBiQRpoW8rINJht/7UBVEnUnTKY5HBCAyw4=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-JZyhT220ARZ2rX0CZYeFkHx8i9ops7TcfGje0NKebnU=";
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
    inherit (finalAttrs) pname version src;
-    hash = "sha256-YkbhZQUpe8ffBpHcYl7wjFgs3krAXlvHgcBdP/6uvek=";
+    hash = "sha256-RCSTxtHXkLsH8smGp2XzQeV9SSpLx5llrFg3cgIsWKY=";
  };

  strictDeps = true;
@@ -8,17 +8,17 @@
 }:
 buildNpmPackage rec {
  pname = "immich-public-proxy";
-  version = "1.10.0";
+  version = "1.11.1";
  src = fetchFromGitHub {
    owner = "alangrainger";
    repo = "immich-public-proxy";
    tag = "v${version}";
-    hash = "sha256-KTA2nOifVksKfHNwayHBqsTypWw3PB7nDEN6j7UjCCI=";
+    hash = "sha256-tuF2ienJPQgPSugJQMZsqgPEB+b/zW013Hx9OUTvV6E=";
  };

  sourceRoot = "${src.name}/app";

-  npmDepsHash = "sha256-KN8RuS6yQLG+PWVKfVFii38+xM0aUGvIV38RGYPAIUk=";
+  npmDepsHash = "sha256-fl2oboifADrWIOKfdKtckuG4jiOSGT8oMRRXeXpJ8E0=";

  # patch in absolute nix store paths so the process doesn't need to cwd in $out
  postPatch = ''
@@ -142,7 +142,15 @@ stdenv.mkDerivation (finalAttrs: {
  meta = {
    description = "Network boot firmware";
    homepage = "https://ipxe.org/";
-    license = lib.licenses.gpl2Only;
+    license = with lib.licenses; [
+      bsd2
+      bsd3
+      gpl2Only
+      gpl2UBDLPlus
+      isc
+      mit
+      mpl11
+    ];
    platforms = lib.platforms.linux;
    maintainers = with lib.maintainers; [ sigmasquadron ];
  };
@@ -21,12 +21,16 @@
  mupdf,
  enableDJVU ? true,
  djvulibre,
-  enableGOCR ? false,
-  gocr, # Disabled by default due to crashes
-  enableTesseract ? true,
-  leptonica,
+  enableGOCR ? false, # Disabled by default due to crashes
+  gocr,
+  # Tesseract support is currently broken
+  # See: https://github.com/NixOS/nixpkgs/issues/368349
+  enableTesseract ? false,
  tesseract5,
+  enableLeptonica ? true,
+  leptonica,
  opencl-headers,
+  fetchDebianPatch,
 }:

 # k2pdfopt is a pain to package. It requires modified versions of mupdf,
@@ -88,6 +92,20 @@ stdenv.mkDerivation rec {

  patches = [
    ./0001-Fix-CMakeLists.patch
+    (fetchDebianPatch {
+      inherit pname;
+      version = "${version}+ds";
+      debianRevision = "3.1";
+      patch = "0007-k2pdfoptlib-k2ocr.c-conditionally-enable-tesseract-r.patch";
+      hash = "sha256-uJ9Gpyq64n/HKqo0hkQ2dnkSLCKNN4DedItPGzHfqR8=";
+    })
+    (fetchDebianPatch {
+      inherit pname;
+      version = "${version}+ds";
+      debianRevision = "3.1";
+      patch = "0009-willuslib-CMakeLists.txt-conditionally-add-source-fi.patch";
+      hash = "sha256-cBSlcuhsw4YgAJtBJkKLW6u8tK5gFwWw7pZEJzVMJDE=";
+    })
  ];

  postPatch = ''
@@ -239,10 +257,8 @@ stdenv.mkDerivation rec {
    ++ lib.optional enableMuPDF mupdf_modded
    ++ lib.optional enableDJVU djvulibre
    ++ lib.optional enableGOCR gocr
-    ++ lib.optionals enableTesseract [
-      leptonica_modded
-      tesseract_modded
-    ];
+    ++ lib.optional enableTesseract tesseract_modded
+    ++ lib.optional (enableLeptonica || enableTesseract) leptonica_modded;

  dontUseCmakeBuildDir = true;

@@ -9,11 +9,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "kdiff3";
-  version = "1.12.2";
+  version = "1.12.3";

  src = fetchurl {
    url = "mirror://kde/stable/kdiff3/kdiff3-${finalAttrs.version}.tar.xz";
-    hash = "sha256-MaN8vPnUIHintIRdQqwaAzp9cjKlq66qAo9kJbufpDk=";
+    hash = "sha256-4iZUxFeIF5mAgwVSnGtZbAydw4taLswULsdtRvaHP0w=";
  };

  nativeBuildInputs = [
@@ -19,18 +19,18 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "keypunch";
-  version = "5.1";
+  version = "6.3";

  src = fetchFromGitHub {
    owner = "bragefuglseth";
    repo = "keypunch";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-C0WD8vBPlKvCJHVJHSfEbMIxNARoRrCn7PNebJ0rkoI=";
+    hash = "sha256-NjPC7WbzOk0tDjM8la+TKGy+U2NNT2kwcrSkaG7TylQ=";
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
    inherit (finalAttrs) pname version src;
-    hash = "sha256-SQ1BI9BuUfUvafsBnC1P5YQ8qVAaer6ywuRQkfS/V1w=";
+    hash = "sha256-gQg6CCb5OzK2fLWMtkRTv1hK642IezRN+5qLMGVV6s8=";
  };

  strictDeps = true;
@@ -61,6 +61,7 @@ stdenv.mkDerivation (finalAttrs: {
  meta = {
    description = "Practice your typing skills";
    homepage = "https://github.com/bragefuglseth/keypunch";
+    changelog = "https://github.com/bragefuglseth/keypunch/releases/tag/v${finalAttrs.version}";
    license = lib.licenses.gpl3Plus;
    mainProgram = "keypunch";
    maintainers = with lib.maintainers; [
@@ -23,15 +23,15 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "komikku";
-  version = "1.72.0";
+  version = "1.76.1";
  pyproject = false;

  src = fetchFromGitea {
    domain = "codeberg.org";
    owner = "valos";
    repo = "Komikku";
-    rev = "v${version}";
-    hash = "sha256-Kdt4nEWdxfZB7rmPbCegbj4abfv1nMSvAAC6mmUcv44=";
+    tag = "v${version}";
+    hash = "sha256-js9mywNlv13ZDmvoBt9yuXJePaSuKOimek3uNlVIeHM=";
  };

  nativeBuildInputs = [
@@ -54,14 +54,14 @@ python3.pkgs.buildPythonApplication rec {
    webkitgtk_6_0
  ];

-  propagatedBuildInputs = with python3.pkgs; [
+  dependencies = with python3.pkgs; [
    beautifulsoup4
    brotli
-    colorthief
    dateparser
    emoji
    keyring
    lxml
+    modern-colorthief
    natsort
    piexif
    pillow
@@ -92,12 +92,7 @@ python3.pkgs.buildPythonApplication rec {

  # Prevent double wrapping.
  dontWrapGApps = true;
-
-  preFixup = ''
-    makeWrapperArgs+=(
-      "''${gappsWrapperArgs[@]}"
-    )
-  '';
+  makeWrapperArgs = [ "\${gappsWrapperArgs[@]}" ];

  passthru = {
    updateScript = nix-update-script { };
@@ -20,13 +20,13 @@

 stdenv.mkDerivation rec {
  pname = "libdeltachat";
-  version = "1.159.4";
+  version = "1.159.5";

  src = fetchFromGitHub {
    owner = "chatmail";
    repo = "core";
    tag = "v${version}";
-    hash = "sha256-OLE3BoQNgpOHYuMUFBmk+raXimJGOsXySkfP+UTDk/8=";
+    hash = "sha256-qooN7XRWFqR/bVPAQ8e7KOYNnBD9E70uAesaLUUeXXs=";
  };

  patches = [
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
  cargoDeps = rustPlatform.fetchCargoVendor {
    pname = "deltachat-core-rust";
    inherit version src;
-    hash = "sha256-+h93tSiKxnnNXPGk7elMQrcIuw3G/j2/gugqSbqOrDw=";
+    hash = "sha256-TmizhgXMYX0hn4GnsL1QiSyMdahebh0QFbk/cOA48jg=";
  };

  nativeBuildInputs =
@@ -1,26 +1,27 @@
 {
-  stdenv,
  lib,
+  stdenv,
  fetchgit,
  pkg-config,
  meson,
  ninja,
-  wrapGAppsHook3,
+  wrapGAppsHook4,
  enchant,
-  gtkmm3,
+  gtkmm4,
  libchamplain,
  libgcrypt,
  shared-mime-info,
+  libshumate,
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "lifeograph";
-  version = "2.0.3";
+  version = "3.0.1";

  src = fetchgit {
    url = "https://git.launchpad.net/lifeograph";
-    rev = "v${version}";
-    hash = "sha256-RotbTdTtpwXmo+UKOyp93IAC6CCstv++KtnX2doN+nM=";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-tcq1A1P8sJ57Tr2MLxsFIru+VJdORuvPBq6fMgBmuY0=";
  };

  nativeBuildInputs = [
@@ -28,27 +29,28 @@ stdenv.mkDerivation rec {
    ninja
    pkg-config
    shared-mime-info # for update-mime-database
-    wrapGAppsHook3
+    wrapGAppsHook4
  ];

  buildInputs = [
    libgcrypt
    enchant
-    gtkmm3
+    gtkmm4
    libchamplain
+    libshumate
  ];

  postInstall = ''
    substituteInPlace $out/share/applications/net.sourceforge.Lifeograph.desktop \
-      --replace "Exec=" "Exec=$out/bin/"
+      --replace-fail "Exec=" "Exec=$out/bin/"
  '';

-  meta = with lib; {
-    homepage = "https://lifeograph.sourceforge.net/wiki/Main_Page";
-    description = "Lifeograph is an off-line and private journal and note taking application";
-    license = licenses.gpl3Only;
-    maintainers = [ ];
+  meta = {
+    homepage = "https://lifeograph.sourceforge.net/doku.php?id=start";
+    description = "Off-line and private journal and note taking application";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ emaryn ];
    mainProgram = "lifeograph";
-    platforms = platforms.linux;
+    platforms = lib.platforms.linux;
  };
-}
+})
@@ -0,0 +1,45 @@
+diff --git a/src/parsing.c b/src/parsing.c
+index 8d97a7e..786a536 100644
+--- a/src/parsing.c
+++ b/src/parsing.c
+@@ -348,8 +348,8 @@ void io_getLevels(level** ls, char* fn){
+   memset(io_cs, 0, sizeof(color) * CHAR_MAX);
+   *ls = salloc(sizeof(level) * CHAR_MAX);
+   memset(*ls, 0, sizeof(level *) * CHAR_MAX);
+-  char c;
+-  char name = '\0';
+  int c;
+  int name = '\0';
+   while((c = fgetc(f)) != EOF){
+     if (c == 'C' || c == 'O' || c == 'L') {
+       name = fgetc(f);
+diff --git a/src/parsing.h b/src/parsing.h
+index d4be0a0..ae485ae 100644
+--- a/src/parsing.h
+++ b/src/parsing.h
+@@ -16,9 +16,9 @@ int io_getFont(bool**, char*);
+ 
+ void io_getColor(FILE*, color*);
+ 
+-void io_getLevel(FILE*, level*, obj[127]);
+void io_getLevel(FILE*, level*, obj[CHAR_MAX]);
+ 
+-void io_getObj(FILE*, obj*, char, color[127]);
+void io_getObj(FILE*, obj*, char, color[CHAR_MAX]);
+ 
+ // TODO: this is named terribly. There should be another function io_readLevels that's exposed. this should be private and take in FILE*
+ void io_getLevels(level**, char*);
+diff --git a/src/visual_sounds.c b/src/visual_sounds.c
+index 067e2e3..5e5cdc4 100644
+--- a/src/visual_sounds.c
+++ b/src/visual_sounds.c
+@@ -921,6 +921,9 @@ void vs_mainPlay(int snd) {
+ }
+ 
+ void vs_mainStop() {
+  if (vs_mainVisual == SND_none) {
+    return;
+  }
+   vs_sounds[vs_mainVisual].cur = NULL;
+   vs_mainVisual = SND_none;
+ }
@@ -49,6 +49,8 @@ stdenv.mkDerivation (finalAttrs: {
      url = "https://github.com/Radvendii/MAR1D/commit/baf3269e90eca69f154a43c4c1ef14677a6300fd.patch";
      hash = "sha256-ybdLA2sO8e0J7w4roSdMWn72OkttD3y+cJ3ScuGiHCI=";
    })
+    # https://github.com/Radvendii/MAR1D/pull/5
+    ./fix-aarch64.patch
  ];

  meta = {
@@ -10,11 +10,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "matomo";
-  version = "5.3.1";
+  version = "5.3.2";

  src = fetchurl {
    url = "https://builds.matomo.org/matomo-${finalAttrs.version}.tar.gz";
-    hash = "sha256-ynG5M21YQzGhII19kmJv0y5L3HIoEdf30dZA+nScuYA=";
+    hash = "sha256-rn5Lr2BSrGitI16MLlP91znSPm2Asd6j0qI8N+1c+Lo=";
  };

  nativeBuildInputs = [ makeWrapper ];
@@ -95,6 +95,8 @@ stdenv.mkDerivation (finalAttrs: {
      extraArgs = [
        "--url"
        "https://github.com/matomo-org/matomo"
+        "--version-regex"
+        "^(\\d+\\.\\d+\\.\\d+)$"
      ];
    };
    tests = lib.optionalAttrs stdenv.hostPlatform.isLinux {
@@ -9,7 +9,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "metals";
-  version = "1.5.2";
+  version = "1.5.3";

  deps = stdenv.mkDerivation {
    name = "metals-deps-${finalAttrs.version}";
@@ -23,7 +23,7 @@ stdenv.mkDerivation (finalAttrs: {
    '';
    outputHashMode = "recursive";
    outputHashAlgo = "sha256";
-    outputHash = "sha256-Qh8T0/nLVpfdJiWqdi1mpvUom5B9Xr8jsNGqzEx8OLs=";
+    outputHash = "sha256-jxrAtlD+s3yjcDWYLoN7mr8RozutItCv8dt28/UoVjk=";
  };

  nativeBuildInputs = [
@@ -89,6 +89,9 @@ rustPlatform.buildRustPackage rec {
      --bash ./completions/mise.bash \
      --fish ./completions/mise.fish \
      --zsh ./completions/_mise
+
+    mkdir -p $out/lib/mise
+    touch $out/lib/mise/.disable-self-update
  '';

  passthru = {
@@ -1,6 +1,6 @@
 {
  lib,
-  flutter327,
+  flutter329,
  fetchFromGitHub,
  mpv-unwrapped,
  libass,
@@ -12,15 +12,15 @@
  gitUpdater,
 }:

-flutter327.buildFlutterApplication rec {
+flutter329.buildFlutterApplication rec {
  pname = "musicpod";
-  version = "2.9.0";
+  version = "2.11.4";

  src = fetchFromGitHub {
    owner = "ubuntu-flutter-community";
    repo = "musicpod";
    tag = "v${version}";
-    hash = "sha256-jq133GdeuEENPb2igNWkjeFTpI5qqxF2RuCu78y6L8o=";
+    hash = "sha256-bZAVkYSQ8NFW4wAXjfEZYt/Z/gSYn51MPLY+hENWQac=";
  };

  postPatch = ''
@@ -30,14 +30,18 @@ flutter327.buildFlutterApplication rec {

  pubspecLock = lib.importJSON ./pubspec.lock.json;

-  gitHashes = {
-    audio_service_mpris = "sha256-QRZ4a3w4MZP8/A4yXzP4P9FPwEVNXlntmBwE8I+s2Kk=";
-    media_kit = "sha256-uRQmrV1jAxsWXFm5SimAY/VYMHBB9fPSnRXvUCvEI8g=";
-    media_kit_libs_video = "sha256-uRQmrV1jAxsWXFm5SimAY/VYMHBB9fPSnRXvUCvEI8g=";
-    media_kit_video = "sha256-uRQmrV1jAxsWXFm5SimAY/VYMHBB9fPSnRXvUCvEI8g=";
-    phoenix_theme = "sha256-HGMRQ5wdhoqYNkrjLTfz6mE/dh45IRyuQ79/E4oo+9w=";
-    yaru = "sha256-lwyl5aRf5HzWHk7aXYXFj6a9QiFpDN9piHYXzVccYWY=";
-  };
+  gitHashes =
+    let
+      media_kit-hash = "sha256-uSVSLh4E/iUJaxA1JxKRYmDFyMpuoTWTyEwsbJuPldU=";
+    in
+    {
+      audio_service_mpris = "sha256-QRZ4a3w4MZP8/A4yXzP4P9FPwEVNXlntmBwE8I+s2Kk=";
+      media_kit = media_kit-hash;
+      media_kit_libs_video = media_kit-hash;
+      media_kit_video = media_kit-hash;
+      phoenix_theme = "sha256-HGMRQ5wdhoqYNkrjLTfz6mE/dh45IRyuQ79/E4oo+9w=";
+      yaru = "sha256-8TgDrI1vWIi8V1e/DrKVb4PS+KLCguG0bB15/XFFnX4=";
+    };

  buildInputs = [
    mpv-unwrapped
@@ -166,13 +166,13 @@
  },
  {
    "pname": "NBitcoin",
-    "version": "8.0.4",
-    "hash": "sha256-9GxJVcByg3zHl9uR01KpTkFkwKuFyr2hm0uZWWlDGeE="
+    "version": "8.0.12",
+    "hash": "sha256-OBJu6fQd0MBKSVHERI7EBtSQQvAL9T8Gr0e7Kx2q9/I="
  },
  {
    "pname": "NBitcoin.Altcoins",
-    "version": "4.0.4",
-    "hash": "sha256-fHG/dlTbEu9DjFnHpEVI6/LbVz0BSJdqkPOo6tQW0fg="
+    "version": "4.0.7",
+    "hash": "sha256-WN9uLRlIW+WGUSS4NE7ZE8kftQEaVDh7AnT1+P8g2gg="
  },
  {
    "pname": "NETStandard.Library",
@@ -7,13 +7,13 @@

 buildDotnetModule rec {
  pname = "nbxplorer";
-  version = "2.5.25";
+  version = "2.5.26";

  src = fetchFromGitHub {
    owner = "dgarage";
    repo = "NBXplorer";
    tag = "v${version}";
-    hash = "sha256-RTkKyckdAv6+wJSlDlR+Q8fw0aZEbi4AwB+OPHI7TR4=";
+    hash = "sha256-gXLzUgFZxrDNbDjpPmVDIj2xi6I+IfkNwXBYvelRYPU=";
  };

  projectFile = "NBXplorer/NBXplorer.csproj";
@@ -0,0 +1,40 @@
+{
+  lib,
+  fetchFromGitHub,
+  buildGoModule,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "opencode";
+  version = "0.0.34";
+
+  src = fetchFromGitHub {
+    owner = "opencode-ai";
+    repo = "opencode";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-EaspkL0TEBJEUU3f75EhZ4BOIvbneUKnTNeNGhJdjYE=";
+  };
+
+  vendorHash = "sha256-cFzkMunPkGQDFhQ4NQZixc5z7JCGNI7eXBn826rWEvk=";
+
+  checkFlags =
+    let
+      skippedTests = [
+        # permission denied
+        "TestBashTool_Run"
+        "TestSourcegraphTool_Run"
+        "TestLsTool_Run"
+      ];
+    in
+    [ "-skip=^${lib.concatStringsSep "$|^" skippedTests}$" ];
+
+  meta = {
+    description = "Powerful terminal-based AI assistant providing intelligent coding assistance";
+    homepage = "https://github.com/opencode-ai/opencode";
+    mainProgram = "opencode";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [
+      zestsystem
+    ];
+  };
+})
@@ -0,0 +1,47 @@
+{
+  lib,
+  buildNpmPackage,
+  fetchFromGitHub,
+  udev,
+  nix-update-script,
+}:
+
+buildNpmPackage (finalAttrs: {
+  pname = "particle-cli";
+  version = "3.35.8";
+
+  src = fetchFromGitHub {
+    owner = "particle-iot";
+    repo = "particle-cli";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-t4alWb6W6AHBAsyRGLBTmjB0JpfzKBQ+yt2LESuU7YE=";
+  };
+
+  npmDepsHash = "sha256-FEpj9u0KqQ+yLtwFgahun6AUSolbEiWjWstglD9yyQ8=";
+
+  buildInputs = [
+    udev
+  ];
+
+  dontNpmBuild = true;
+  dontNpmPrune = true;
+
+  postPatch = ''
+    ln -s npm-shrinkwrap.json package-lock.json
+  '';
+
+  postInstall = ''
+    install -D -t $out/etc/udev/rules.d \
+      $out/lib/node_modules/particle-cli/assets/50-particle.rules
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Command Line Interface for Particle Cloud and devices";
+    homepage = "https://github.com/particle-iot/particle-cli";
+    maintainers = with lib.maintainers; [ jess ];
+    mainProgram = "particle";
+    license = lib.licenses.asl20;
+  };
+})
@@ -14,13 +14,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "pdf4qt";
-  version = "1.5.0.0";
+  version = "1.5.1.0";

  src = fetchFromGitHub {
    owner = "JakubMelka";
    repo = "PDF4QT";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-ELdmnOEKFGCtuf240R/0M6r8aPwRQiXurAxrqcCZvOI=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Ysrz/uCSTFK5wGNdTXhpq6QVf7Ju1xWisNVUtBtdEjc=";
  };

  patches = [
@@ -30,19 +30,6 @@ stdenv.mkDerivation (finalAttrs: {
    ./find_lcms2_path.patch
  ];

-  # make calls to QString::arg compatible with Qt 6.9
-  # see https://doc-snapshots.qt.io/qt6-6.9/whatsnew69.html#new-features-in-qt-6-9
-  postPatch = ''
-    substituteInPlace Pdf4QtLibCore/sources/pdf{documentsanitizer,optimizer}.cpp \
-      --replace-fail \
-        '.arg(counter)' \
-        '.arg<PDFInteger>(counter)'
-    substituteInPlace Pdf4QtLibCore/sources/pdfoptimizer.cpp \
-      --replace-fail \
-        '.arg(bytesSaved)' \
-        '.arg<PDFInteger>(bytesSaved)'
-  '';
-
  nativeBuildInputs = [
    cmake
    pkg-config
@@ -83,8 +70,9 @@ stdenv.mkDerivation (finalAttrs: {
      functionality based on PDF Reference 2.0.
    '';
    homepage = "https://jakubmelka.github.io";
-    license = lib.licenses.lgpl3Only;
-    mainProgram = "Pdf4QtViewerLite";
+    changelog = "https://github.com/JakubMelka/PDF4QT/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.mit;
+    mainProgram = "Pdf4QtViewer";
    maintainers = with lib.maintainers; [ aleksana ];
    platforms = lib.platforms.linux;
  };
@@ -3,20 +3,12 @@
  stdenv,
  fetchFromGitLab,
  gradle_8,
-  jre_headless,
-  jre_minimal,
+  jre,
  runtimeShell,
 }:
 let
  # "Deprecated Gradle features were used in this build, making it incompatible with Gradle 9.0."
  gradle = gradle_8;
-
-  jre = jre_minimal.override {
-    modules = [
-      "java.base"
-    ];
-    jdk = jre_headless;
-  };
 in
 stdenv.mkDerivation rec {
  pname = "pdftk";
@@ -34,8 +34,6 @@ stdenv.mkDerivation (finalAttrs: {
    hash = "sha256-0Q1hf1AGAZv6jt05tV3F6++lzLpddvjhiykIhV40cPs=";
  };

-  sourceRoot = "${finalAttrs.src.name}/src-tauri";
-
  postPatch = ''
    substituteInPlace $cargoDepsCopy/libappindicator-sys-*/src/lib.rs \
      --replace-fail "libayatana-appindicator3.so.1" "${libayatana-appindicator}/lib/libayatana-appindicator3.so.1"
@@ -46,11 +44,16 @@ stdenv.mkDerivation (finalAttrs: {
    hash = "sha256-iYQNGRWqXYBU+WIH/Xm8qndgOQ6RKYCtAyi93kb7xrQ=";
  };

-  pnpmRoot = "..";
+  cargoRoot = "src-tauri";
+  buildAndTestSubdir = "src-tauri";

  cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit (finalAttrs) src;
-    sourceRoot = "${finalAttrs.src.name}/src-tauri";
+    inherit (finalAttrs)
+      pname
+      version
+      src
+      cargoRoot
+      ;
    hash = "sha256-dyXINRttgsqCfmgtZNXxr/Rl8Yn0F2AVm8v2Ao+OBsw=";
  };

@@ -93,12 +96,6 @@ stdenv.mkDerivation (finalAttrs: {
    }
  )}";

-  preConfigure = ''
-    # pnpm.configHook has to write to .., as our sourceRoot is set to src-tauri
-    # TODO: move frontend into its own drv
-    chmod +w ..
-  '';
-
  meta = {
    description = "Cross-platform translation software";
    mainProgram = "pot";
@@ -20,13 +20,13 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "readest";
-  version = "0.9.40";
+  version = "0.9.41";

  src = fetchFromGitHub {
    owner = "readest";
    repo = "readest";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-GpdlxDwjWveFvkGP2pju5cMlXPbjOOxEIdmpxz6RNTw=";
+    hash = "sha256-sX/Er2G4V2jmIp5DAXR158nmAXqkVvEb9bMqP44z7P4=";
    fetchSubmodules = true;
  };

@@ -39,14 +39,14 @@ rustPlatform.buildRustPackage (finalAttrs: {

  pnpmDeps = pnpm_9.fetchDeps {
    inherit (finalAttrs) pname version src;
-    hash = "sha256-+fJbQmoa89WSfA4dteUSRoEfgEN38tsHZiuWyOvuvhw=";
+    hash = "sha256-ozRDNXWqg0CZ1IgU33C6yJu4e05010jsHeTdIVhB72M=";
  };

  pnpmRoot = "../..";

  useFetchCargoVendor = true;

-  cargoHash = "sha256-5mWnKjV9FBgO3trYZyOe+rWFMnJkp17NEbBz7gLg6tw=";
+  cargoHash = "sha256-5DIagAKSq427kwZTH/QKY3vbb+TmFscKSANoSkEJMGg=";

  cargoRoot = "../..";

@@ -9,13 +9,13 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "rime-wanxiang";
-  version = "6.7.8";
+  version = "6.7.9";

  src = fetchFromGitHub {
    owner = "amzxyz";
    repo = "rime_wanxiang";
    tag = "v" + finalAttrs.version;
-    hash = "sha256-U5aM8LMBh0ncGPIllhioJCS1/5SncWYg8e+C5tXDST0=";
+    hash = "sha256-cOHwgy0rjqce7MedL0hK59royKlAPmZRGcVHRx0FrRU=";
  };

  nativeBuildInputs = [
@@ -13,6 +13,13 @@
 stdenv.mkDerivation rec {
  pname = "rnnoise-plugin";
  version = "1.10";
+  outputs = [
+    "out"
+    "ladspa"
+    "lv2"
+    "lxvst"
+    "vst3"
+  ];

  src = fetchFromGitHub {
    owner = "werman";
@@ -43,6 +50,15 @@ stdenv.mkDerivation rec {
      webkitgtk_4_1
    ];

+  # Move each plugin into a dedicated output, leaving a symlink in $out for backwards compatibility
+  postInstall = ''
+    for plugin in ladspa lv2 lxvst vst3; do
+      mkdir -p ''${!plugin}/lib
+      mv $out/lib/$plugin ''${!plugin}/lib/$plugin
+      ln -s ''${!plugin}/lib/$plugin $out/lib/$plugin
+    done
+  '';
+
  meta = with lib; {
    description = "Real-time noise suppression plugin for voice based on Xiph's RNNoise";
    homepage = "https://github.com/werman/noise-suppression-for-voice";
@@ -61,13 +61,13 @@ in

 rustPlatform.buildRustPackage {
  pname = "servo";
-  version = "0-unstable-2025-05-13";
+  version = "0-unstable-2025-05-15";

  src = fetchFromGitHub {
    owner = "servo";
    repo = "servo";
-    rev = "a572bf1191f8807e63d6bec4734ecae2b50439c3";
-    hash = "sha256-iMB2dJA0TVV6l14WqZt8KJehHRoGozycjjCHPXPjMsI=";
+    rev = "103cbed928b0b9ecd7084b5e9dcab135eca19327";
+    hash = "sha256-TMrtD7f0bay6NtodM3SZfi8tLCQp6dE5iBicyGXZAco=";
    # Breaks reproducibility depending on whether the picked commit
    # has other ref-names or not, which may change over time, i.e. with
    # "ref-names: HEAD -> main" as long this commit is the branch HEAD
@@ -78,7 +78,7 @@ rustPlatform.buildRustPackage {
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-HtyRHaYBadqqpJ8dSBOMp5xOwzRfBYjeuj4Kb/xx5ds=";
+  cargoHash = "sha256-7PTrE2FA2cvOKU35qTYBr7cop65gWY+zSOVlDZiJdow=";

  # set `HOME` to a temp dir for write access
  # Fix invalid option errors during linking (https://github.com/mozilla/nixpkgs-mozilla/commit/c72ff151a3e25f14182569679ed4cd22ef352328)
@@ -1,15 +1,11 @@
 {
  lib,
-  buildPythonPackage,
+  python3Packages,
  fetchFromGitHub,
  gettext,
-  packaging,
-  pexpect,
-  pyyaml,
-  setuptools,
 }:

-buildPythonPackage rec {
+python3Packages.buildPythonPackage rec {
  pname = "sosreport";
  version = "4.9.1";
  pyproject = true;
@@ -21,13 +17,13 @@ buildPythonPackage rec {
    hash = "sha256-97S8b4PfjUN8uzvp01PGCLs4J3CbwpJsgBKtY8kI0HE=";
  };

-  build-system = [ setuptools ];
+  build-system = [ python3Packages.setuptools ];

  nativeBuildInputs = [
    gettext
  ];

-  dependencies = [
+  dependencies = with python3Packages; [
    packaging
    pexpect
    pyyaml
@@ -9,17 +9,17 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "spacetimedb";
-  version = "1.1.1";
+  version = "1.1.2";

  src = fetchFromGitHub {
    owner = "clockworklabs";
    repo = "spacetimedb";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Ay9nJ4b+lRBbZU/LmpG8agLcjp3jyDFyJdESeNoGsLQ=";
+    hash = "sha256-eBbRdkJafkMXOEsnh1yoht8WJAwZToPobWnhjTWhnA4=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-O74clwtMQ1roSy9Jg0l4vzBKuG3DXHDx4yRH/pbT8E0=";
+  cargoHash = "sha256-gs1A/gtjA941TWZw+wxMR+9TCayRa1k49/G8XnzW2ek=";

  nativeBuildInputs = [
    pkg-config
--- a/Show More
+++ b/Show More