Merge staging-next into staging

2025-07-20 12:11:51 +00:00
parent cf7ee04ef6 e4d6ad84c1
commit d67dba32f8
76 changed files with 819 additions and 441 deletions
@@ -31,6 +31,8 @@

 - `conftest` since `0.60.0` has moved to use rego `v1` as default. To continue using `v0` use `--rego-version v0`. For more information about upgrading to Rego v1 syntax, see the [upstream docs](https://www.openpolicyagent.org/docs/latest/v0-upgrade/).

+- The `archipelago-minecraft` package was removed, as upstream no longer provides support for the Minecraft APWorld.
+
 - `tooling-language-server` has been renamed to `deputy` (both the package and binary), following the rename of the upstream project.

 - `lima` package now only includes the guest agent for the host's architecture by default. If your guest VM's architecture differs from your Lima host's, you'll need to enable the `lima-additional-guestagents` package by setting `withAdditionalGuestAgents = true` when overriding lima with this input.
@@ -7048,6 +7048,13 @@
    githubId = 757125;
    name = "Dzmitry Lahoda";
  };
+  e-v-o-l-v-e = {
+    name = "Ivanoe Megnin-Preiss";
+    email = "megninpreiss.ivanoe@gmail.com";
+    github = "e-v-o-l-v-e";
+    githubId = 84813895;
+    matrix = "@evolve:matrix.imp-network.com";
+  };
  e1mo = {
    email = "nixpkgs@e1mo.de";
    matrix = "@e1mo:chaos.jetzt";
@@ -888,9 +888,7 @@
    "index.html#module-services-meilisearch-quickstart-search"
  ],
  "module-services-meilisearch-defaults": [
-    "index.html#module-services-meilisearch-defaults"
-  ],
-  "module-services-meilisearch-missing": [
+    "index.html#module-services-meilisearch-defaults",
    "index.html#module-services-meilisearch-missing"
  ],
  "module-services-networking-yggdrasil": [
@@ -32,10 +32,12 @@ you first need to add documents to an index before you can search for documents.

 - The default nixos package doesn't come with the [dashboard](https://docs.meilisearch.com/learn/getting_started/quick_start.html#search), since the dashboard features makes some assets downloads at compile time.

- Anonymized Analytics sent to meilisearch are disabled by default.
+- `no_analytics` is set to true by default.

- Default deployment is development mode. It doesn't require a secret master key. All routes are not protected and accessible.
+- `http_addr` is derived from {option}`services.meilisearch.listenAddress` and {option}`services.meilisearch.listenPort`. The two sub-fields are separate because this makes it easier to consume in certain other modules.

-## Missing {#module-services-meilisearch-missing}
+- `db_path` is set to `/var/lib/meilisearch` by default. Upstream, the default value is equivalent to `/var/lib/meilisearch/data.ms`.

- the snapshot feature is not yet configurable from the module, it's just a matter of adding the relevant environment variables.
+- `dump_dir` and `snapshot_dir` are set to `/var/lib/meilisearch/dumps` and `/var/lib/meilisearch/snapshots`, respectively. This is equivalent to the upstream defaults.
+
+- All other options inherit their upstream defaults. In particular, the default configuration uses `env = "development"`, which doesn't require a master key, in which case all routes are unprotected.
@@ -7,19 +7,91 @@
 let
  cfg = config.services.meilisearch;

+  settingsFormat = pkgs.formats.toml { };
+
+  # These secrets are used in the config file and can be set to paths.
+  secrets-with-path =
+    builtins.map
+      (
+        { environment, name }:
+        {
+          inherit name environment;
+          setting = cfg.settings.${name};
+        }
+      )
+      [
+        {
+          environment = "MEILI_SSL_CERT_PATH";
+          name = "ssl_cert_path";
+        }
+        {
+          environment = "MEILI_SSL_KEY_PATH";
+          name = "ssl_key_path";
+        }
+        {
+          environment = "MEILI_SSL_AUTH_PATH";
+          name = "ssl_auth_path";
+        }
+        {
+          environment = "MEILI_SSL_OCSP_PATH";
+          name = "ssl_ocsp_path";
+        }
+      ];
+
+  # We also handle `master_key` separately.
+  # It cannot be set to a path, so we template it.
+  master-key-placeholder = "@MASTER_KEY@";
+
+  configFile = settingsFormat.generate "config.toml" (
+    builtins.removeAttrs (
+      if cfg.masterKeyFile != null then
+        cfg.settings // { master_key = master-key-placeholder; }
+      else
+        builtins.removeAttrs cfg.settings [ "master_key" ]
+    ) (map (secret: secret.name) secrets-with-path)
+  );
+
 in
 {
-
  meta.maintainers = with lib.maintainers; [
    Br1ght0ne
    happysalada
  ];
  meta.doc = ./meilisearch.md;

-  ###### interface
+  imports = [
+    (lib.mkRenamedOptionModule
+      [ "services" "meilisearch" "environment" ]
+      [ "services" "meilisearch" "settings" "env" ]
+    )
+    (lib.mkRenamedOptionModule
+      [ "services" "meilisearch" "logLevel" ]
+      [ "services" "meilisearch" "settings" "log_level" ]
+    )
+    (lib.mkRenamedOptionModule
+      [ "services" "meilisearch" "noAnalytics" ]
+      [ "services" "meilisearch" "settings" "no_analytics" ]
+    )
+    (lib.mkRenamedOptionModule
+      [ "services" "meilisearch" "maxIndexSize" ]
+      [ "services" "meilisearch" "settings" "max_index_size" ]
+    )
+    (lib.mkRenamedOptionModule
+      [ "services" "meilisearch" "payloadSizeLimit" ]
+      [ "services" "meilisearch" "settings" "http_payload_size_limit" ]
+    )
+    (lib.mkRenamedOptionModule
+      [ "services" "meilisearch" "dumplessUpgrade" ]
+      [ "services" "meilisearch" "settings" "experimental_dumpless_upgrade" ]
+    )
+    (lib.mkRemovedOptionModule [ "services" "meilisearch" "masterKeyEnvironmentFile" ] ''
+      Use `services.meilisearch.masterKeyFile` instead. It does not require you to prefix the file with "MEILI_MASTER_KEY=".
+      If you were abusing this option to set other options, you can now configure them with `services.meilisearch.settings`.
+    '')
+  ];

  options.services.meilisearch = {
-    enable = lib.mkEnableOption "MeiliSearch - a RESTful search API";
+    enable = lib.mkEnableOption "Meilisearch - a RESTful search API";

    package = lib.mkPackageOption pkgs "meilisearch" {
      extraDescription = ''
@@ -28,106 +100,87 @@ in
    };

    listenAddress = lib.mkOption {
-      description = "MeiliSearch listen address.";
-      default = "127.0.0.1";
+      default = "localhost";
      type = lib.types.str;
+      description = ''
+        The IP address that Meilisearch will listen on.
+
+        It can also be a hostname like "localhost". If it resolves to an IPv4 and IPv6 address, Meilisearch will listen on both.
+      '';
    };

    listenPort = lib.mkOption {
-      description = "MeiliSearch port to listen on.";
      default = 7700;
      type = lib.types.port;
+      description = ''
+        The port that Meilisearch will listen on.
+      '';
    };

-    environment = lib.mkOption {
-      description = "Defines the running environment of MeiliSearch.";
-      default = "development";
-      type = lib.types.enum [
-        "development"
-        "production"
-      ];
-    };
-
-    # TODO change this to LoadCredentials once possible
-    masterKeyEnvironmentFile = lib.mkOption {
+    masterKeyFile = lib.mkOption {
      description = ''
        Path to file which contains the master key.
        By doing so, all routes will be protected and will require a key to be accessed.
        If no master key is provided, all routes can be accessed without requiring any key.
-        The format is the following:
-        MEILI_MASTER_KEY=my_secret_key
      '';
      default = null;
-      type = with lib.types; nullOr path;
+      type = lib.types.nullOr lib.types.path;
    };

-    noAnalytics = lib.mkOption {
+    settings = lib.mkOption {
      description = ''
-        Deactivates analytics.
-        Analytics allow MeiliSearch to know how many users are using MeiliSearch,
-        which versions and which platforms are used.
-        This process is entirely anonymous.
+        Configuration settings for Meilisearch.
+        Look at the documentation for available options:
+        https://github.com/meilisearch/meilisearch/blob/main/config.toml
+        https://www.meilisearch.com/docs/learn/self_hosted/configure_meilisearch_at_launch#all-instance-options
      '';
-      default = true;
-      type = lib.types.bool;
+
+      default = { };
+
+      type = lib.types.submodule {
+        freeformType = settingsFormat.type;
+
+        imports = builtins.map (secret: {
+          # give them proper types, just so they're easier to consume from this file
+          options.${secret.name} = lib.mkOption {
+            # but they should not show up in documentation as special in any way.
+            visible = false;
+
+            type = lib.types.nullOr lib.types.path;
+            default = null;
+          };
+        }) secrets-with-path;
+      };
    };
-
-    logLevel = lib.mkOption {
-      description = ''
-        Defines how much detail should be present in MeiliSearch's logs.
-        MeiliSearch currently supports four log levels, listed in order of increasing verbosity:
-        - 'ERROR': only log unexpected events indicating MeiliSearch is not functioning as expected
-        - 'WARN:' log all unexpected events, regardless of their severity
-        - 'INFO:' log all events. This is the default value
-        - 'DEBUG': log all events and including detailed information on MeiliSearch's internal processes.
-          Useful when diagnosing issues and debugging
-      '';
-      default = "INFO";
-      type = lib.types.str;
-    };
-
-    maxIndexSize = lib.mkOption {
-      description = ''
-        Sets the maximum size of the index.
-        Value must be given in bytes or explicitly stating a base unit.
-        For example, the default value can be written as 107374182400, '107.7Gb', or '107374 Mb'.
-        Default is 100 GiB
-      '';
-      default = "107374182400";
-      type = lib.types.str;
-    };
-
-    payloadSizeLimit = lib.mkOption {
-      description = ''
-        Sets the maximum size of accepted JSON payloads.
-        Value must be given in bytes or explicitly stating a base unit.
-        For example, the default value can be written as 107374182400, '107.7Gb', or '107374 Mb'.
-        Default is ~ 100 MB
-      '';
-      default = "104857600";
-      type = lib.types.str;
-    };
-
-    # TODO: turn on by default when it stops being experimental
-    dumplessUpgrade = lib.mkOption {
-      default = false;
-      example = true;
-      description = ''
-        Whether to enable (experimental) dumpless upgrade.
-
-        Allows upgrading from Meilisearch >=v1.12 to Meilisearch >=v1.13 without manually
-        dumping and importing the database.
-
-        More information at https://www.meilisearch.com/docs/learn/update_and_migration/updating#dumpless-upgrade
-      '';
-      type = lib.types.bool;
-    };
-
  };

-  ###### implementation
-
  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = !cfg.settings ? master_key;
+        message = ''
+          Do not set `services.meilisearch.settings.master_key` in your configuration.
+          Use `services.meilisearch.masterKeyFile` instead.
+        '';
+      }
+    ];
+
+    services.meilisearch.settings = {
+      # we use `listenAddress` and `listenPort` to derive the `http_addr` setting.
+      # this is the only setting we treat like this.
+      # we do this because some dependent services like Misskey/Sharkey need separate host,port for no good reason.
+      http_addr = "${cfg.listenAddress}:${toString cfg.listenPort}";
+
+      # upstream's default for `db_path` is `/var/lib/meilisearch/data.ms/`, but ours is different for no reason.
+      db_path = lib.mkDefault "/var/lib/meilisearch";
+      # these are equivalent to the upstream defaults, because we set a working directory.
+      # they are only set here for consistency with `db_path`.
+      dump_dir = lib.mkDefault "/var/lib/meilisearch/dumps";
+      snapshot_dir = lib.mkDefault "/var/lib/meilisearch/snapshots";
+
+      # this is intentionally different from upstream's default.
+      no_analytics = lib.mkDefault true;
+    };

    warnings = lib.optional (lib.versionOlder cfg.package.version "1.12") ''
      Meilisearch 1.11 will be removed in NixOS 25.11. As it was the last
@@ -149,24 +202,41 @@ in
    environment.systemPackages = [ cfg.package ];

    systemd.services.meilisearch = {
-      description = "MeiliSearch daemon";
+      description = "Meilisearch daemon";
      wantedBy = [ "multi-user.target" ];
      after = [ "network.target" ];
-      environment = {
-        MEILI_DB_PATH = "/var/lib/meilisearch";
-        MEILI_HTTP_ADDR = "${cfg.listenAddress}:${toString cfg.listenPort}";
-        MEILI_NO_ANALYTICS = lib.boolToString cfg.noAnalytics;
-        MEILI_ENV = cfg.environment;
-        MEILI_DUMP_DIR = "/var/lib/meilisearch/dumps";
-        MEILI_LOG_LEVEL = cfg.logLevel;
-        MEILI_MAX_INDEX_SIZE = cfg.maxIndexSize;
-        MEILI_EXPERIMENTAL_DUMPLESS_UPGRADE = lib.boolToString cfg.dumplessUpgrade;
-      };
+
+      preStart = lib.mkMerge [
+        ''
+          install -m 700 '${configFile}' "$RUNTIME_DIRECTORY/config.toml"
+        ''
+        (lib.mkIf (cfg.masterKeyFile != null) ''
+          ${lib.getExe pkgs.replace-secret} '${master-key-placeholder}' "$CREDENTIALS_DIRECTORY/master_key" "$RUNTIME_DIRECTORY/config.toml"
+        '')
+      ];
+
+      environment = builtins.listToAttrs (
+        builtins.map (secret: {
+          name = secret.environment;
+          value = lib.mkIf (secret.setting != null) "%d/${secret.name}";
+        }) secrets-with-path
+      );
+
      serviceConfig = {
-        ExecStart = "${cfg.package}/bin/meilisearch";
+        LoadCredential = lib.mkMerge (
+          [
+            (lib.mkIf (cfg.masterKeyFile != null) [ "master_key:${cfg.masterKeyFile}" ])
+          ]
+          ++ builtins.map (
+            secret: lib.mkIf (secret.setting != null) [ "${secret.name}:${secret.setting}" ]
+          ) secrets-with-path
+        );
+        ExecStart = "${lib.getExe cfg.package} --config-file-path \${RUNTIME_DIRECTORY}/config.toml";
        DynamicUser = true;
        StateDirectory = "meilisearch";
-        EnvironmentFile = lib.mkIf (cfg.masterKeyEnvironmentFile != null) cfg.masterKeyEnvironmentFile;
+        WorkingDirectory = "%S/meilisearch";
+        RuntimeDirectory = "meilisearch";
+        RuntimeDirectoryMode = "0700";
      };
    };
  };
@@ -54,7 +54,7 @@ in
        description = ''
          Whether to automatically set up a local Meilisearch instance and configure Sharkey to use it.

-          You need to ensure `services.meilisearch.masterKeyEnvironmentFile` is correctly configured for a working
+          You need to ensure `services.meilisearch.masterKeyFile` is correctly configured for a working
          Meilisearch setup. You also need to configure Sharkey to use an API key obtained from Meilisearch with the
          `MK_CONFIG_MEILISEARCH_APIKEY` environment variable, and set `services.sharkey.settings.meilisearch.index` to
          the created index. See https://docs.joinsharkey.org/docs/customisation/search/meilisearch/ for how to create
@@ -240,7 +240,7 @@ in
      (mkIf cfg.setupMeilisearch {
        services.meilisearch = {
          enable = mkDefault true;
-          environment = mkDefault "production";
+          settings.env = mkDefault "production";
        };

        services.sharkey.settings = {
@@ -35,27 +35,26 @@ in
    machine.wait_for_unit("meilisearch")
    machine.wait_for_open_port(7700)

+    def wait_task(cmd):
+        response = json.loads(machine.succeed(cmd))
+        task_uid = response["taskUid"]
+        machine.wait_until_succeeds(
+            f"curl ${apiUrl}/tasks/{task_uid} | jq -e '.status | IN(\"succeeded\", \"failed\", \"canceled\")'"
+        )
+        machine.succeed(f"curl ${apiUrl}/tasks/{task_uid} | jq -e '.status == \"succeeded\"'")
+        return response
+
    with subtest("check version"):
        version = json.loads(machine.succeed("curl ${apiUrl}/version"))
        assert version["pkgVersion"] == "${pkgs.meilisearch.version}"

    with subtest("create index"):
-        machine.succeed(
-            "curl -X POST -H 'Content-Type: application/json' ${apiUrl}/indexes --data @${indexJSON}"
-        )
+        wait_task("curl -X POST -H 'Content-Type: application/json' ${apiUrl}/indexes --data @${indexJSON}")
        indexes = json.loads(machine.succeed("curl ${apiUrl}/indexes"))
        assert indexes["total"] == 1, "index wasn't created"

    with subtest("add documents"):
-        response = json.loads(
-            machine.succeed(
-                "curl -X POST -H 'Content-Type: application/json' ${apiUrl}/indexes/${uid}/documents --data-binary @${moviesJSON}"
-            )
-        )
-        task_uid = response["taskUid"]
-        machine.wait_until_succeeds(
-            f"curl ${apiUrl}/tasks/{task_uid} | jq -e '.status == \"succeeded\"'"
-        )
+        wait_task("curl -X POST -H 'Content-Type: application/json' ${apiUrl}/indexes/${uid}/documents --data-binary @${moviesJSON}")

    with subtest("search"):
        response = json.loads(
@@ -19,9 +19,7 @@ in
        };
      };

-      services.meilisearch.masterKeyEnvironmentFile = pkgs.writeText "meilisearch-key" ''
-        MEILI_MASTER_KEY=${meilisearchKey}
-      '';
+      services.meilisearch.masterKeyFile = pkgs.writeText "meilisearch-key" meilisearchKey;
    };

  testScript =
@@ -89,8 +89,8 @@ let
        mktplcRef = {
          publisher = "42Crunch";
          name = "vscode-openapi";
-          version = "4.35.0";
-          hash = "sha256-wpWPT8BW2GPo2SCzM+l1HTpiXMTnbDOc9Oj9wDT/o/8=";
+          version = "4.37.2";
+          hash = "sha256-XUD5lXybUdUavbiqCqv561NAPAbZ0Q9oLsQkrSRUmsU=";
        };
        meta = {
          changelog = "https://marketplace.visualstudio.com/items/42Crunch.vscode-openapi/changelog";
@@ -1591,8 +1591,8 @@ let
          # semver scheme, contrary to preview versions which are listed on
          # the VSCode Marketplace and use a calver scheme. We should avoid
          # using preview versions, because they expire after two weeks.
-          version = "17.2.1";
-          hash = "sha256-1p4DDZEFFOIFHV6bkduXmrUGhjMDwrqf5/U2tO00iD0=";
+          version = "17.3.1";
+          hash = "sha256-qZBctE3R39WeU3Fc3pajrUSS6ncni7O+/oAOyZK2EnY=";
        };
        meta = {
          changelog = "https://marketplace.visualstudio.com/items/eamodio.gitlens/changelog";
@@ -2455,8 +2455,8 @@ let
        mktplcRef = {
          name = "vscode-vibrancy-continued";
          publisher = "illixion";
-          version = "1.1.57";
-          hash = "sha256-UJn+RFBlQXmPqKkFIBiD4AblnX4s0O2IK747fG+UC/0=";
+          version = "1.1.58";
+          hash = "sha256-oBm2j7fZBYALkstk1WMgC+o1sq2HY7tX+zLfo5PBMiM=";
        };
        meta = {
          downloadPage = "https://marketplace.visualstudio.com/items?itemName=illixion.vscode-vibrancy-continued";
@@ -2980,6 +2980,8 @@ let

      llvm-org.lldb-vscode = llvmPackages.lldb;

+      llvm-vs-code-extensions.lldb-dap = callPackage ./llvm-vs-code-extensions.lldb-dap { };
+
      llvm-vs-code-extensions.vscode-clangd = buildVscodeMarketplaceExtension {
        mktplcRef = {
          publisher = "llvm-vs-code-extensions";
@@ -0,0 +1,18 @@
+{ lib, vscode-utils }:
+
+vscode-utils.buildVscodeMarketplaceExtension {
+  mktplcRef = {
+    name = "lldb-dap";
+    publisher = "llvm-vs-code-extensions";
+    version = "0.2.15";
+    hash = "sha256-Xr/TUpte9JqdvQ8eoD0l8ztg0tR8qwX/Ju1eVU6Xc0s=";
+  };
+
+  meta = {
+    description = "Debugging with LLDB in Visual Studio Code";
+    downloadPage = "hhttps://marketplace.visualstudio.com/items?itemName=llvm-vs-code-extensions.lldb-dap";
+    homepage = "https://github.com/llvm/llvm-project";
+    license = lib.licenses.asl20;
+    maintainers = [ lib.maintainers.m0nsterrr ];
+  };
+}
@@ -33,13 +33,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "organicmaps";
-  version = "2025.06.26-3";
+  version = "2025.07.13-9";

  src = fetchFromGitHub {
    owner = "organicmaps";
    repo = "organicmaps";
    tag = "${finalAttrs.version}-android";
-    hash = "sha256-IXpSY1ZGKAPqFT3B4C8Y+FHUuFQJPVptSKKhXZCYSfo=";
+    hash = "sha256-cEQmghS5qg5HTyWfDIB4G/Arh9BpM3iz1tToRWY8KrE=";
    fetchSubmodules = true;
  };

@@ -10,7 +10,7 @@ let
    if stdenv.hostPlatform.isLinux then
      {
        stable = "0.0.101";
-        ptb = "0.0.151";
+        ptb = "0.0.152";
        canary = "0.0.716";
        development = "0.0.83";
      }
@@ -30,7 +30,7 @@ let
      };
      ptb = fetchurl {
        url = "https://ptb.dl2.discordapp.net/apps/linux/${version}/discord-ptb-${version}.tar.gz";
-        hash = "sha256-7fQFCPUj59c/OfuNa4RDxGexAKZXLL7M+7n36WE5qDg=";
+        hash = "sha256-GbLEAu6gchwkkupU6k6i7bpdMVnCqB74HDYxyTt3J/w=";
      };
      canary = fetchurl {
        url = "https://canary.dl2.discordapp.net/apps/linux/${version}/discord-canary-${version}.tar.gz";
@@ -8,66 +8,67 @@
  licenseAccepted ? config.sc2-headless.accept_license or false,
 }:

-if !licenseAccepted then
-  throw ''
-    You must accept the Blizzard® Starcraft® II AI and Machine Learning License at
-    https://blzdistsc2-a.akamaihd.net/AI_AND_MACHINE_LEARNING_LICENSE.html
-    by setting nixpkgs config option 'sc2-headless.accept_license = true;'
-  ''
-else
-  assert licenseAccepted;
-  let
-    maps = callPackage ./maps.nix { };
-  in
-  stdenv.mkDerivation rec {
-    version = "4.7.1";
-    pname = "sc2-headless";
+let
+  maps = callPackage ./maps.nix { inherit licenseAccepted; };
+in
+stdenv.mkDerivation rec {
+  version = "4.7.1";
+  pname = "sc2-headless";

-    src = fetchurl {
-      url = "https://blzdistsc2-a.akamaihd.net/Linux/SC2.${version}.zip";
-      sha256 = "0q1ry9bd3dm8y4hvh57yfq7s05hl2k2sxi2wsl6h0r3w690v1kdd";
+  src = fetchurl {
+    url = "https://blzdistsc2-a.akamaihd.net/Linux/SC2.${version}.zip";
+    sha256 = "0q1ry9bd3dm8y4hvh57yfq7s05hl2k2sxi2wsl6h0r3w690v1kdd";
+  };
+
+  unpackCmd =
+    if !licenseAccepted then
+      throw ''
+        You must accept the Blizzard® Starcraft® II AI and Machine Learning License at
+        https://blzdistsc2-a.akamaihd.net/AI_AND_MACHINE_LEARNING_LICENSE.html
+        by setting nixpkgs config option 'sc2-headless.accept_license = true;'
+      ''
+    else
+      assert licenseAccepted;
+      ''
+        unzip -P 'iagreetotheeula' $curSrc
+      '';
+
+  nativeBuildInputs = [ unzip ];
+
+  installPhase = ''
+    mkdir -p $out
+    cp -r . "$out"
+    rm -r $out/Libs
+
+    cp -ur "${maps.minigames}"/* "${maps.melee}"/* "${maps.ladder2017season1}"/* "${maps.ladder2017season2}"/* "${maps.ladder2017season3}"/* \
+      "${maps.ladder2017season4}"/* "${maps.ladder2018season1}"/* "${maps.ladder2018season2}"/* \
+      "${maps.ladder2018season3}"/*  "${maps.ladder2018season4}"/* "${maps.ladder2019season1}"/* "$out"/Maps/
+  '';
+
+  preFixup = ''
+    find $out -type f -print0 | while IFS=''' read -d ''' -r file; do
+      isELF "$file" || continue
+      patchelf \
+        --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+        --set-rpath ${
+          lib.makeLibraryPath [
+            stdenv.cc.cc
+            stdenv.cc.libc
+          ]
+        } \
+        "$file"
+    done
+  '';
+
+  meta = {
+    platforms = lib.platforms.linux;
+    description = "Starcraft II headless linux client for machine learning research";
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+    license = {
+      fullName = "BLIZZARD® STARCRAFT® II AI AND MACHINE LEARNING LICENSE";
+      url = "https://blzdistsc2-a.akamaihd.net/AI_AND_MACHINE_LEARNING_LICENSE.html";
+      free = false;
    };
-
-    unpackCmd = ''
-      unzip -P 'iagreetotheeula' $curSrc
-    '';
-
-    nativeBuildInputs = [ unzip ];
-
-    installPhase = ''
-      mkdir -p $out
-      cp -r . "$out"
-      rm -r $out/Libs
-
-      cp -ur "${maps.minigames}"/* "${maps.melee}"/* "${maps.ladder2017season1}"/* "${maps.ladder2017season2}"/* "${maps.ladder2017season3}"/* \
-        "${maps.ladder2017season4}"/* "${maps.ladder2018season1}"/* "${maps.ladder2018season2}"/* \
-        "${maps.ladder2018season3}"/*  "${maps.ladder2018season4}"/* "${maps.ladder2019season1}"/* "$out"/Maps/
-    '';
-
-    preFixup = ''
-      find $out -type f -print0 | while IFS=''' read -d ''' -r file; do
-        isELF "$file" || continue
-        patchelf \
-          --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
-          --set-rpath ${
-            lib.makeLibraryPath [
-              stdenv.cc.cc
-              stdenv.cc.libc
-            ]
-          } \
-          "$file"
-      done
-    '';
-
-    meta = {
-      platforms = lib.platforms.linux;
-      description = "Starcraft II headless linux client for machine learning research";
-      sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
-      license = {
-        fullName = "BLIZZARD® STARCRAFT® II AI AND MACHINE LEARNING LICENSE";
-        url = "https://blzdistsc2-a.akamaihd.net/AI_AND_MACHINE_LEARNING_LICENSE.html";
-        free = false;
-      };
-      maintainers = [ ];
-    };
-  }
+    maintainers = [ ];
+  };
+}
@@ -1,12 +1,21 @@
 {
  fetchzip,
+  licenseAccepted,
 }:
 let
  fetchzip' =
-    args:
-    (fetchzip args).overrideAttrs (old: {
-      UNZIP = "-j -P iagreetotheeula";
-    });
+    if !licenseAccepted then
+      throw ''
+        You must accept the Blizzard® Starcraft® II AI and Machine Learning License at
+        https://blzdistsc2-a.akamaihd.net/AI_AND_MACHINE_LEARNING_LICENSE.html
+        by setting nixpkgs config option 'sc2-headless.accept_license = true;'
+      ''
+    else
+      assert licenseAccepted;
+      args:
+      (fetchzip args).overrideAttrs (old: {
+        UNZIP = "-j -P iagreetotheeula";
+      });
 in
 {
  minigames = fetchzip {
@@ -17,21 +17,17 @@ python3.pkgs.buildPythonApplication rec {
    hash = "sha256-ffZVFmfDAJ+Qn3hbeHY/CvYgpDLxB+jaYOiYyZqZ7mo=";
  };

-  nativeBuildInputs = with python3.pkgs; [
-    poetry-core
-  ];
+  build-system = with python3.pkgs; [ poetry-core ];

-  propagatedBuildInputs = with python3.pkgs; [
+  dependencies = with python3.pkgs; [
    attrs
    click
    colorama
    flask
    funcy
-    future
    psutil
    pyserial
    pydot
-    six
    tornado
  ];

@@ -42,27 +38,21 @@ python3.pkgs.buildPythonApplication rec {
    pytestCheckHook
  ];

-  disabledTests =
-    [
-      "TestNetworkMonitor"
-      "TestNoResponseFailure"
-      "TestProcessMonitor"
-      "TestSocketConnection"
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      "test_time_repeater"
-    ];
+  disabledTests = [
+    "TestNetworkMonitor"
+    "TestNoResponseFailure"
+    "TestProcessMonitor"
+    "TestSocketConnection"
+  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ "test_time_repeater" ];

-  pythonImportsCheck = [
-    "boofuzz"
-  ];
+  pythonImportsCheck = [ "boofuzz" ];

  meta = {
    description = "Network protocol fuzzing tool";
-    mainProgram = "boo";
    homepage = "https://github.com/jtpereyda/boofuzz";
-    changelog = "https://github.com/jtpereyda/boofuzz/blob/v${version}/CHANGELOG.rst";
-    license = with lib.licenses; [ gpl2Plus ];
+    changelog = "https://github.com/jtpereyda/boofuzz/blob/${src.tag}/CHANGELOG.rst";
+    license = lib.licenses.gpl2Plus;
    maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "boo";
  };
 }
@@ -6,13 +6,13 @@
  "packages": {
    "": {
      "dependencies": {
-        "@anthropic-ai/claude-code": "^1.0.55"
+        "@anthropic-ai/claude-code": "^1.0.56"
      }
    },
    "node_modules/@anthropic-ai/claude-code": {
-      "version": "1.0.55",
-      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-1.0.55.tgz",
-      "integrity": "sha512-gCYXKwnU84zhmbNIZaduUY5HtGHBP/SMOxT4i8FmiEGSOeL/nY78mNOawXkRny1Je87WRjWVCBdhRnaxLP5c0w==",
+      "version": "1.0.56",
+      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-1.0.56.tgz",
+      "integrity": "sha512-LYOlv9uXtLrJcJqSLvQlhy7shhC6MHEXuSGZ/+BazM4LY36ng3cmKjTCDny0kZQxa+u/+MYOXUrkmkJm2qR75Q==",
      "license": "SEE LICENSE IN README.md",
      "bin": {
        "claude": "cli.js"
@@ -7,16 +7,16 @@

 buildNpmPackage rec {
  pname = "claude-code";
-  version = "1.0.55";
+  version = "1.0.56";

  nodejs = nodejs_20; # required for sandboxed Nix builds on Darwin

  src = fetchzip {
    url = "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-${version}.tgz";
-    hash = "sha256-xx7Nksfa0IN18i6MoU60olnY/BioS+W+OQmyETQYDHI=";
+    hash = "sha256-q/17LfP5MWeKpt8akPXwMvkZ6Qhc+9IGpM6N34JuExY=";
  };

-  npmDepsHash = "sha256-v7a3DQD2Syhr3ITX7yHyEtQMCnrXwaf7IXXtl7JS07Q=";
+  npmDepsHash = "sha256-0hr5Tu2/0ETEgNb2s4BQGZXjsHrFzK+iD2ZtZNTlyoI=";

  postPatch = ''
    cp ${./package-lock.json} package-lock.json
@@ -2,11 +2,11 @@
 { fetchLibrustyV8 }:

 fetchLibrustyV8 {
-  version = "137.1.0";
+  version = "137.2.1";
  shas = {
-    x86_64-linux = "sha256-Tiscfy2bzYGR3s0T+SC1IB3xWvTVpVcSEdjq3MCRoRw=";
-    aarch64-linux = "sha256-2GYc+fgZLGUMQCXXSiyYUNKxZM4Mb788by+cWPdA9+4=";
-    x86_64-darwin = "sha256-yOJWfwIdl+uF7z7K6RzTcwnlgkDE8NM+e1tbWshx8+k=";
-    aarch64-darwin = "sha256-QQaC74Itb3D9EaN6PTxrjAGd/F9d6HY6PiLp+8jHK24=";
+    x86_64-linux = "sha256-1mV+UjvJsIyLFpBGVDrGxr/rqUgKzRRFwgnMyYTb/pM=";
+    aarch64-linux = "sha256-Rp7chA+GjsozCkMQrDnOoi4VhVJdrFZd1BuLfcRhGjw=";
+    x86_64-darwin = "sha256-tDMk+F6D/h4osYlzT2qAhqfHYUSDk3nL4RxEKjhBhD0=";
+    aarch64-darwin = "sha256-1eBUjKFalb/CIPfHYP8SvqIaxRep8vU6u9QFShOMUsQ=";
  };
 }
@@ -29,18 +29,18 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "deno";
-  version = "2.4.0";
+  version = "2.4.2";

  src = fetchFromGitHub {
    owner = "denoland";
    repo = "deno";
    tag = "v${finalAttrs.version}";
    fetchSubmodules = true; # required for tests
-    hash = "sha256-YEiqp5KwkzRB/b6HhAtxXJNxHsPMTf3LnNxkP6GgYKw=";
+    hash = "sha256-7VHw+jjQ/N2b2AIBrGBcnLJ/k3MRkPnKRHD134A7mmw=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-WQle7a2OjZ5kNg/eCQo0USPZssMaifiXGhlnKJDEtsQ=";
+  cargoHash = "sha256-ZEWSnath9v04wU1VyFDAx3LANnVhfE5s93jX4QW3XlI=";

  patches = [
    ./tests-replace-hardcoded-paths.patch
@@ -20,16 +20,17 @@
 }:
 python3Packages.buildPythonApplication rec {
  pname = "devtoolbox";
-  version = "1.2.5";
+  version = "1.3.0";
  pyproject = false; # uses meson

  src = fetchFromGitHub {
    owner = "aleiepure";
    repo = "devtoolbox";
    tag = "v${version}";
-    hash = "sha256-CgpSZvpwBKo2gzp2QbBPFBK0tPhqKFC/DxXdmTWVAwc=";
+    hash = "sha256-ReF70pNMrMweEB4WAGQT++9TxTN4gV1olln7Y6YWCis=";
  };

+  # test after update
  postPatch = ''
    substituteInPlace src/views/reverse_cron.py \
      --replace-fail '"\D"' 'r"\D"'
@@ -80,6 +81,8 @@ python3Packages.buildPythonApplication rec {
    python-dateutil
    rcssmin
    rjsmin
+    cryptography
+    color-parser-py
  ];

  dontWrapGApps = true;
@@ -1,5 +1,5 @@
 {
-  "version": "1.2.2",
-  "rev": "7c039464e452ddc3330e2691d3fa6d305521d09b",
-  "hash": "sha256-cHQcEA9Gpza/edEVyXUYiINC/Q2b3bf+zEQbl/Otfr4="
+  "version": "1.3.2",
+  "rev": "0b83e5d2f68bc02dfefde74b846bd039f078affa",
+  "hash": "sha256-6NMQ893g+nOiH8dnb63oa+fZMNXs8N6tJv+Er4x547U="
 }
@@ -7,20 +7,20 @@

 buildGoModule rec {
  pname = "newt";
-  version = "1.3.0";
+  version = "1.3.2";

  src = fetchFromGitHub {
    owner = "fosrl";
    repo = "newt";
    tag = version;
-    hash = "sha256-8wE0ut+pej1rGve4jyT6/Km2yIcubeAlZL+4yEyuNww=";
+    hash = "sha256-6+Cc2ZyFEs9dVBWPQNBlUoFiFZuwlk/qBQULqGguhO8=";
  };

-  vendorHash = "sha256-rLyGju1UfKlzOSH2/NIKvZ8hpVE9+yJdcy4CK/NyoNc=";
+  vendorHash = "sha256-Y/f7GCO7Kf1iQiDR32DIEIGJdcN+PKS0OrhBvXiHvwo=";

  postPatch = ''
    substituteInPlace main.go \
-      --replace-fail "replaceme" "${version}"
+      --replace-fail "version_replaceme" "${version}"
  '';

  nativeInstallCheckInputs = [ versionCheckHook ];
@@ -7,16 +7,16 @@

 buildGoModule rec {
  pname = "gcsfuse";
-  version = "3.0.0";
+  version = "3.1.0";

  src = fetchFromGitHub {
    owner = "googlecloudplatform";
    repo = "gcsfuse";
    rev = "v${version}";
-    hash = "sha256-9qm3GmNzjIUdOa3w0cp+UpgTI3VX44qNKHPjoaPL1wc=";
+    hash = "sha256-xTICtyx6YPBe3hfme29M9pX/fX/w+/0pZWUMCbA6ajs=";
  };

-  vendorHash = "sha256-7aJ9Nqz4kg1oFCh+VlYPTWFZxACH9uACdhzAwGbAjbc=";
+  vendorHash = "sha256-eTtKjGDJwRJzIb0qLp/HHLc8cYdd3HdWuivVUZOYEBU=";

  subPackages = [
    "."
@@ -23,18 +23,11 @@ let

    sourceRoot = "${src.name}/svg-flatten";

-    postPatch = ''
-      substituteInPlace Makefile \
-        --replace "$(INSTALL) $(BUILDDIR)/$(BINARY) $(PREFIX)/bin" \
-        "$(INSTALL) $(BUILDDIR)/$(BINARY) $(PREFIX)/bin/svg-flatten" \
+    preInstall = ''
+      mkdir -p $out/bin
    '';

-    installPhase = ''
-      runHook preInstall
-      mkdir -p $out/bin
-      PREFIX=$out make install
-      runHook postInstall
-    '';
+    installFlags = [ "PREFIX=$(out)" ];

    meta = with lib; {
      description = "svg-flatten SVG downconverter";
@@ -49,35 +42,34 @@ in
 python3Packages.buildPythonApplication rec {
  inherit version src;
  pname = "gerbolyze";
+  pyproject = true;

-  format = "setuptools";
+  build-system = with python3Packages; [ setuptools ];

-  nativeBuildInputs = [
-    python3Packages.setuptools
+  pythonRemoveDeps = [
+    # we already provide svg-flatten through a binary on the PATH
+    "svg-flatten-wasi"
  ];

-  propagatedBuildInputs = [
-    python3Packages.beautifulsoup4
-    python3Packages.click
-    python3Packages.numpy
-    python3Packages.scipy
-    python3Packages.python-slugify
-    python3Packages.lxml
-    python3Packages.gerbonara
-    resvg
-    svg-flatten
+  dependencies = with python3Packages; [
+    beautifulsoup4
+    click
+    numpy
+    python-slugify
+    lxml
+    gerbonara
  ];

  preConfigure = ''
    # setup.py tries to execute a call to git in a subprocess, this avoids it.
    substituteInPlace setup.py \
-      --replace "version = get_version()," \
-                "version = '${version}'," \
+      --replace-fail "version = get_version()," \
+                     "version = '${version}'," \

    # setup.py tries to execute a call to git in a subprocess, this avoids it.
    substituteInPlace setup.py \
-      --replace "long_description=format_readme_for_pypi()," \
-                "long_description='\n'.join(Path('README.rst').read_text().splitlines()),"
+      --replace-fail "long_description=format_readme_for_pypi()," \
+                     "long_description='\n'.join(Path('README.rst').read_text().splitlines()),"
  '';

  pythonImportsCheck = [ "gerbolyze" ];
@@ -88,6 +80,15 @@ python3Packages.buildPythonApplication rec {
    svg-flatten
  ];

+  makeWrapperArgs = [
+    "--prefix PATH: ${
+      lib.makeBinPath [
+        resvg
+        svg-flatten
+      ]
+    }"
+  ];
+
  passthru.updateScript = gitUpdater {
    rev-prefix = "v";
  };
@@ -17,17 +17,17 @@

 buildGoModule rec {
  pname = "grafana-alloy";
-  version = "1.9.2";
+  version = "1.10.0";

  src = fetchFromGitHub {
    owner = "grafana";
    repo = "alloy";
    tag = "v${version}";
-    hash = "sha256-ciM5DbP5OTvAPUNgBTuwb+hbVtKGgQzafLLOjDftPZQ=";
+    hash = "sha256-wy4dopRuZthYcc6kWsnE1N6MFbJ2UhechoCJpgg2pWE=";
  };

  proxyVendor = true;
-  vendorHash = "sha256-zmNrnCaUrsYJ0S5MQrj07sV+ZCnXbGQmH8Z0pMpJZk4=";
+  vendorHash = "sha256-Mo++n6zat1OQ8ihA8FFP4i/ypdw22VG7BBFoVpvfgqI=";

  nativeBuildInputs = [
    fixup-yarn-lock
@@ -7,16 +7,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "just-lsp";
-  version = "0.2.3";
+  version = "0.2.4";

  src = fetchFromGitHub {
    owner = "terror";
    repo = "just-lsp";
    tag = finalAttrs.version;
-    hash = "sha256-1XxC09Q9UGKRzMb51mUjmTJd7vEp0FFqtUD/9cQZvC0=";
+    hash = "sha256-0bt/kovzOgqAaIKArrh0G9ncuD1J7K3OINg9Dpa7fXs=";
  };

-  cargoHash = "sha256-mc1kYXfEF+oZO/GEBtCnKwt17LhvGDQK8RcOSsXKFjc=";
+  cargoHash = "sha256-DU8E3r9pjLYYxCEq+6dT2hrV2gDyGbtWD/N0aQFVyZI=";

  passthru = {
    updateScript = nix-update-script { };
@@ -0,0 +1,31 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "local-content-share";
+  version = "31";
+
+  src = fetchFromGitHub {
+    owner = "Tanq16";
+    repo = "local-content-share";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-BVO804Ndjbg4uEE1bufZcGZxEVdraV29LJ6yBWXTakA=";
+  };
+
+  vendorHash = null;
+
+  # no test file in upstream
+  doCheck = false;
+
+  meta = {
+    description = "Storing/sharing text/files in your local network with no setup on client devices";
+    homepage = "https://github.com/Tanq16/local-content-share";
+    license = lib.licenses.mit;
+    mainProgram = "local-content-share";
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [ e-v-o-l-v-e ];
+  };
+})
@@ -6,12 +6,12 @@
 }:

 let
-  version = "2.1.2";
+  version = "2.1.3";
  pname = "lunatask";

  src = fetchurl {
    url = "https://github.com/lunatask/lunatask/releases/download/v${version}/Lunatask-${version}.AppImage";
-    hash = "sha256-MjzqoLPtTspLowDO3MV0joGoYuxjybuExC1h03AayB0=";
+    hash = "sha256-kVNuCtUyY8UkalXlIpfenjB4JApDZVabawLOhFxToyY=";
  };

  appimageContents = appimageTools.extract {
@@ -3,10 +3,10 @@
  stdenv,
  fetchFromGitHub,
  fetchpatch,
-  python3,
+  python312,
 }:

-python3.pkgs.buildPythonApplication rec {
+python312.pkgs.buildPythonApplication rec {
  pname = "maigret";
  version = "0.4.4";
  pyproject = true;
@@ -27,9 +27,9 @@ python3.pkgs.buildPythonApplication rec {
    })
  ];

-  build-system = with python3.pkgs; [ setuptools ];
+  build-system = with python312.pkgs; [ setuptools ];

-  dependencies = with python3.pkgs; [
+  dependencies = with python312.pkgs; [
    aiodns
    aiohttp
    aiohttp-socks
@@ -70,7 +70,7 @@ python3.pkgs.buildPythonApplication rec {
    yarl
  ];

-  nativeCheckInputs = with python3.pkgs; [
+  nativeCheckInputs = with python312.pkgs; [
    pytest-httpserver
    pytest-asyncio
    pytestCheckHook
@@ -103,11 +103,14 @@ python3.pkgs.buildPythonApplication rec {

  pythonImportsCheck = [ "maigret" ];

-  meta = with lib; {
+  meta = {
    description = "Tool to collect details about an username";
    homepage = "https://maigret.readthedocs.io";
-    license = licenses.mit;
-    maintainers = with maintainers; [ fab ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [
+      fab
+      thtrf
+    ];
    broken = stdenv.hostPlatform.isDarwin;
  };
 }
@@ -7,13 +7,13 @@

 buildGoModule rec {
  pname = "minio-client";
-  version = "2025-05-21T01-59-54Z";
+  version = "2025-07-16T15-35-03Z";

  src = fetchFromGitHub {
    owner = "minio";
    repo = "mc";
    rev = "RELEASE.${version}";
-    sha256 = "sha256-ss/GqOJz9FNrQzYABb8ePCMcmNVTYVji/Id1WOuu24M=";
+    sha256 = "sha256-U5bKSew/qqbBs/VR0mSserH/0jdzZsztDJiJ02BHFIY=";
  };

  vendorHash = "sha256-MpLQZFrf2sBAweXtYeFi5j6p6GaXuN99x+r4UK8D9xM=";
@@ -12,10 +12,10 @@

 let
  opencode-node-modules-hash = {
-    "aarch64-darwin" = "sha256-W/kIKKRt2rBbnb+42NaZ1PsHZPGJbtjB8kV/aP1iZKc=";
-    "aarch64-linux" = "sha256-xDUT61afD8wk3z35NXtQGvZQpxQkN/CPWctVObYQECE=";
-    "x86_64-darwin" = "sha256-Kumy9PeeCO3TQGDdS0Zw9/HlIIQT5O4wrBPGGyl73Og=";
-    "x86_64-linux" = "sha256-VB7bikVFy8w82M6AkYXjsHx34CNHAGMgY69KISOokE4=";
+    "aarch64-darwin" = "sha256-TAeFDsHGFJnUyp20ec+Rxp4t1FrWKfbtnxsE8PnLS0o=";
+    "aarch64-linux" = "sha256-F056MWf2dNAO21ezEvWg689WUibtz4Q4mcSuDuSY5EM=";
+    "x86_64-darwin" = "sha256-AN1Ha/les1ByJGfVkLDibfxjPouC0tAZ//EN3vDi1Hc=";
+    "x86_64-linux" = "sha256-XIRV1QrgRHnpJyrgK9ITxH61dve7nWfVoCPs3Tc8nuU=";
  };
  bun-target = {
    "aarch64-darwin" = "bun-darwin-arm64";
@@ -26,12 +26,12 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "opencode";
-  version = "0.3.22";
+  version = "0.3.43";
  src = fetchFromGitHub {
    owner = "sst";
    repo = "opencode";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-yT6uaTEKYb/+A1WhP6AQW0hWMnmS9vlfLn1E57cnzn0=";
+    hash = "sha256-EM44FkMPPkRChuLcNEEK3n4dLc5uqnX7dHROsZXyr58=";
  };

  tui = buildGoModule {
@@ -39,7 +39,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    inherit (finalAttrs) version;
    src = "${finalAttrs.src}/packages/tui";

-    vendorHash = "sha256-G1vM8wxTTPpB1Oaxz2YI8AkirwG54A9i6Uq5e92ucyY=";
+    vendorHash = "sha256-/YxvM+HZM4aRqcjUiSX0D1DhhMJkmLdh7G4+fPqtnic=";

    subPackages = [ "cmd/opencode" ];

@@ -20,13 +20,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "openmm";
-  version = "8.3.0";
+  version = "8.3.1";

  src = fetchFromGitHub {
    owner = "openmm";
    repo = "openmm";
    rev = finalAttrs.version;
-    hash = "sha256-wXk5s6OascFWjHs4WpxGU9TcX0gSiOZ3BRusIH1NjpI=";
+    hash = "sha256-3e0+8f2V+UCrPJA1wQUZKPvjpmWU9FfOAt9Ako0Lnl0=";
  };

  # "This test is stochastic and may occasionally fail". It does.
@@ -3,8 +3,6 @@
  stdenv,
  python3Packages,
  fetchFromGitHub,
-  julia,
-  julia-bin,

  # tests
  cabal-install,
@@ -25,7 +23,6 @@

 let
  i686Linux = stdenv.buildPlatform.system == "i686-linux";
-  julia' = if lib.meta.availableOn stdenv.hostPlatform julia then julia else julia-bin;
 in
 python3Packages.buildPythonApplication rec {
  pname = "pre-commit";
@@ -64,7 +61,6 @@ python3Packages.buildPythonApplication rec {
      cargo
      gitMinimal
      go
-      julia'
      perl
      versionCheckHook
      writableTmpDirAsHomeHook
@@ -13,13 +13,13 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "proksi";
-  version = "0.6.0";
+  version = "0.6.1";

  src = fetchFromGitHub {
    owner = "luizfonseca";
    repo = "proksi";
    tag = "proksi-v${finalAttrs.version}";
-    hash = "sha256-5IXtMtyKbx7re6CA61AnQ85k/SMdkjZo/ySnNoD2DDo=";
+    hash = "sha256-AVNQBrFxkFPgnVbh3Y0CQ3RajMmh/M6ee/QkumdLDs4=";
  };

  postPatch = ''
@@ -27,7 +27,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
  '';

  useFetchCargoVendor = true;
-  cargoHash = "sha256-yjbtP+FlDaJXPhCu1UyaDolpzy+BUejU8nVVSVsKCzE=";
+  cargoHash = "sha256-MYyPYZFmbQZszYViaGZdbUZWM739MN14J1ckyR8hXZc=";

  nativeBuildInputs = [
    pkg-config
@@ -0,0 +1,38 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  nix-update-script,
+}:
+buildGoModule (finalAttrs: {
+  pname = "prometheus-opnsense-exporter";
+  version = "0.0.10";
+
+  src = fetchFromGitHub {
+    owner = "athennamind";
+    repo = "opnsense-exporter";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-U/F301HkRfmzB8czwHP9u5UajR9CvxhSZwrJSIwcRd4=";
+  };
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X=github.com/prometheus/common/version.BuildDate=1970-01-01T00:00:00Z"
+    "-X github.com/prometheus/common/version.BuildUser=nix@nixpkgs"
+    "-X github.com/prometheus/common/version.Branch=master"
+    "-X github.com/prometheus/common/version.Revision=${finalAttrs.src.rev}"
+    "-X github.com/prometheus/common/version.Version=${finalAttrs.version}"
+  ];
+  vendorHash = null;
+  passthru.updateScript = nix-update-script { };
+  doInstallCheck = true;
+  meta = {
+    changelog = "https://github.com/AthennaMind/opnsense-exporter/releases/tag/v${finalAttrs.version}";
+    homepage = "https://githbub.com/AthennaMind/opnsense-exporter";
+    description = "Prometheus exporter for opnsense firewall appliances";
+    license = lib.licenses.mit;
+    mainProgram = "opnsense-exporter";
+    maintainers = with lib.maintainers; [ paepcke ];
+  };
+})
@@ -12,19 +12,19 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "raycast";
-  version = "1.100.3";
+  version = "1.101.1";

  src =
    {
      aarch64-darwin = fetchurl {
        name = "Raycast.dmg";
        url = "https://releases.raycast.com/releases/${finalAttrs.version}/download?build=arm";
-        hash = "sha256-2X+vv1OMXKmoXH+WGzHF49HWTCMA9a77BTJqKfkMg0E=";
+        hash = "sha256-/G9cYTecssfmWWnl6fSnIuJgiHNu5ggvyE3xeFfNx2o=";
      };
      x86_64-darwin = fetchurl {
        name = "Raycast.dmg";
        url = "https://releases.raycast.com/releases/${finalAttrs.version}/download?build=x86_64";
-        hash = "sha256-Ug9starsQ759+9WvGbIvxMf+Hvs+1lj3pViEvcfrc6k=";
+        hash = "sha256-xkUvCig24kGlw9/LQhY7aId7tuccdw8CFSJ9c2lvrsE=";
      };
    }
    .${stdenvNoCC.system} or (throw "raycast: ${stdenvNoCC.system} is unsupported.");
@@ -79,8 +79,10 @@ lib.checkListOfEnum "${pname}: platform"
      meta = {
        description = "Simple and easy-to-use library to enjoy videogames programming";
        homepage = "https://www.raylib.com/";
+        downloadPage = "https://github.com/raysan5/raylib";
        license = lib.licenses.zlib;
        maintainers = [ lib.maintainers.diniamo ];
+        teams = [ lib.teams.ngi ];
        platforms = lib.platforms.all;
        changelog = "https://github.com/raysan5/raylib/blob/${finalAttrs.version}/CHANGELOG";
      };
@@ -18,16 +18,16 @@ in

 buildGoModule rec {
  pname = "regclient";
-  version = "0.8.3";
+  version = "0.9.0";
  tag = "v${version}";

  src = fetchFromGitHub {
    owner = "regclient";
    repo = "regclient";
    rev = tag;
-    sha256 = "sha256-vuZPd51nzCasV3WWulbKCQnqVkupMu5jQhQypvTKGvk=";
+    sha256 = "sha256-FVXTEP1CNlKmuorNxRE2SeiA90u2rz8sXELBtfRm9z0=";
  };
-  vendorHash = "sha256-ad7IPiOMG4G80BdAZz7IN0hBPJgUIVdO9oFlM7IDmp8=";
+  vendorHash = "sha256-MP/drjUbST5s3NKQ6omVOLSvl4rdPSfVaM0zlF/9Cq0=";

  outputs = [ "out" ] ++ bins;

@@ -4,9 +4,12 @@
  python3,
 }:

-python3.pkgs.buildPythonApplication rec {
-  pname = "routersploit";
+let
  version = "3.4.7";
+in
+python3.pkgs.buildPythonApplication {
+  pname = "routersploit";
+  inherit version;
  pyproject = true;

  src = fetchFromGitHub {
@@ -48,11 +51,14 @@ python3.pkgs.buildPythonApplication rec {
    "tests/test_module_info.py"
  ];

-  meta = with lib; {
+  meta = {
    description = "Exploitation Framework for Embedded Devices";
    homepage = "https://github.com/threat9/routersploit";
-    license = licenses.bsd3;
-    maintainers = with maintainers; [ fab ];
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [
+      fab
+      thtrf
+    ];
    mainProgram = "rsf";
  };
 }
@@ -2,6 +2,7 @@
  lib,
  stdenv,
  fetchFromGitHub,
+  fetchpatch2,

  # nativeBuildInputs
  cmake,
@@ -12,7 +13,6 @@
  glew,
  libjpeg,
  libvorbis,
-  openal,
  udev,
  libXi,
  libX11,
@@ -20,19 +20,33 @@
  libXrandr,
  libXrender,
  xcbutilimage,
+
+  # miniaudio
+  alsa-lib,
+  libjack2,
+  libpulseaudio,
+  sndio,
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "sfml";
-  version = "3.0.0";
+  version = "3.0.1";

  src = fetchFromGitHub {
    owner = "SFML";
    repo = "SFML";
    tag = finalAttrs.version;
-    hash = "sha256-e6x/L2D3eT6F/DBLQDZ+j0XD5NL9RalWZA8kcm9lZ3g=";
+    hash = "sha256-yTNoDHcBRzk270QHjSFVpjFKm2+uVvmVLg6XlAppwYk=";
  };

+  patches = [
+    (fetchpatch2 {
+      name = "Fix-pkg-config-when-SFML_PKGCONFIG_INSTALL_DIR-is-unset.patch";
+      url = "https://github.com/SFML/SFML/commit/a87763becbc4672b38f1021418ed94caa0f6540a.patch?full_index=1";
+      hash = "sha256-tJmXTdhwtWq6XfUPBzw47yTrc6EzwmSiVj9n6jQwHig=";
+    })
+  ];
+
  nativeBuildInputs = [ cmake ];
  buildInputs =
    [
@@ -41,7 +55,6 @@ stdenv.mkDerivation (finalAttrs: {
      glew
      libjpeg
      libvorbis
-      openal
    ]
    ++ lib.optional stdenv.hostPlatform.isLinux udev
    ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [
@@ -53,11 +66,25 @@ stdenv.mkDerivation (finalAttrs: {
      xcbutilimage
    ];

+  # We rely on RUNPATH
+  dontPatchELF = true;
+
  cmakeFlags = [
+    (lib.cmakeBool "BUILD_SHARED_LIBS" (!stdenv.hostPlatform.isStatic))
    (lib.cmakeBool "SFML_INSTALL_PKGCONFIG_FILES" true)
    (lib.cmakeFeature "SFML_MISC_INSTALL_PREFIX" "share/SFML")
    (lib.cmakeBool "SFML_BUILD_FRAMEWORKS" false)
    (lib.cmakeBool "SFML_USE_SYSTEM_DEPS" true)
+
+    # FIXME: Unvendor miniaudio and move these deps there
+    (lib.cmakeFeature "CMAKE_INSTALL_RPATH" (
+      lib.makeLibraryPath [
+        alsa-lib
+        libjack2
+        libpulseaudio
+        sndio
+      ]
+    ))
  ];

  meta = {
@@ -24,32 +24,30 @@
  nix-update-script,
  p11-kit,
  pkg-config,
-  qtbase,
-  qttools,
+  qt6,
  sqlite,
  stdenv,
  taglib,
  util-linux,
-  wrapQtAppsHook,
  sparsehash,
  rapidjson,
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "strawberry";
  version = "1.2.11";

  src = fetchFromGitHub {
    owner = "jonaski";
-    repo = pname;
-    rev = version;
+    repo = "strawberry";
+    rev = finalAttrs.finalPackage.version;
    hash = "sha256-AhNx2CdfE7ff3+L47X6lYPD8GA7imkDIJD5ESndn/cc=";
  };

  # the big strawberry shown in the context menu is *very* much in your face, so use the grey version instead
  postPatch = ''
    substituteInPlace src/context/contextalbum.cpp \
-      --replace pictures/strawberry.png pictures/strawberry-grey.png
+      --replace-fail pictures/strawberry.png pictures/strawberry-grey.png
  '';

  buildInputs =
@@ -67,7 +65,7 @@ stdenv.mkDerivation rec {
      libmtp
      libpthreadstubs
      libtasn1
-      qtbase
+      qt6.qtbase
      sqlite
      taglib
      sparsehash
@@ -94,8 +92,8 @@ stdenv.mkDerivation rec {
      cmake
      ninja
      pkg-config
-      qttools
-      wrapQtAppsHook
+      qt6.qttools
+      qt6.wrapQtAppsHook
    ]
    ++ lib.optionals stdenv.hostPlatform.isLinux [
      util-linux
@@ -115,11 +113,11 @@ stdenv.mkDerivation rec {
  meta = {
    description = "Music player and music collection organizer";
    homepage = "https://www.strawberrymusicplayer.org/";
-    changelog = "https://raw.githubusercontent.com/jonaski/strawberry/${version}/Changelog";
+    changelog = "https://raw.githubusercontent.com/jonaski/strawberry/${finalAttrs.finalPackage.version}/Changelog";
    license = lib.licenses.gpl3Only;
    maintainers = with lib.maintainers; [ peterhoeg ];
    # upstream says darwin should work but they lack maintainers as of 0.6.6
    platforms = lib.platforms.linux;
    mainProgram = "strawberry";
  };
-}
+})
@@ -10,14 +10,14 @@ let
  platform =
    if stdenvNoCC.hostPlatform.isDarwin then "universal-macos" else stdenvNoCC.hostPlatform.system;
  hash = builtins.getAttr platform {
-    "universal-macos" = "sha256-fN/TiIT3x78uyh78jzj9NtJ80W6cTlB6wWa+SztpqDw=";
-    "x86_64-linux" = "sha256-aNDtIHP9KX2KKsN0YgISqzoT+TMea4pppXJaiZEMXLA=";
-    "aarch64-linux" = "sha256-VB0hqlFAJle+J7kwyGb+eFMVlExT7uoJpgqGaP53V/I=";
+    "universal-macos" = "sha256-DLFAjkAkRemVOo9ZbKimKBpvVy/n/qzD+/dgWN3AfDg=";
+    "x86_64-linux" = "sha256-d+Y5OEHvS1wLDVkddX3r7y8iSLNCCXkzrn/T0lyMxNM=";
+    "aarch64-linux" = "sha256-sLvmm1liXOczLqUIlypu/nClPnQSmf4WkkxNem5vdkw=";
  };
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "tigerbeetle";
-  version = "0.16.49";
+  version = "0.16.50";

  src = fetchzip {
    url = "https://github.com/tigerbeetle/tigerbeetle/releases/download/${finalAttrs.version}/tigerbeetle-${platform}.zip";
@@ -21,6 +21,9 @@ stdenv.mkDerivation (finalAttrs: {
    patchShebangs scripts
  '';

+  # https://salsa.debian.org/debian/trinity/-/merge_requests/2
+  env.NIX_CFLAGS_COMPILE = "-fomit-frame-pointer";
+
  enableParallelBuilding = true;

  installFlags = [ "DESTDIR=$(out)" ];
@@ -8,17 +8,17 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "typstyle";
-  version = "0.13.14";
+  version = "0.13.16";

  src = fetchFromGitHub {
    owner = "typstyle-rs";
    repo = "typstyle";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-rIbLYV4f+XaEkyIFkJL1Biwg+TnjHi7e9kvIlroiNNA=";
+    hash = "sha256-dfw1jyPNZ0LDEZ+pbJt9DWKa4aBlFCAZIgKrZK+AmJw=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-YRsCuGvfSAUz0qsETIUcTKIchdkvleP3xJy0Hz+2BM0=";
+  cargoHash = "sha256-Eg8i+vsBp0BuxxBWXZisVKiGge25UKfxoK/3Knk+LsU=";

  # Disabling tests requiring network access
  checkFlags = [
@@ -10,17 +10,17 @@
 }:
 buildGoModule (finalAttrs: {
  pname = "werf";
-  version = "2.39.1";
+  version = "2.41.3";

  src = fetchFromGitHub {
    owner = "werf";
    repo = "werf";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-xQ1nh9YL198/ih9rw52rItR3t5Nq901MpDlFVht6kAc=";
+    hash = "sha256-0ttukgb698ipdW2JTS9xbja+3R/VjXQVoXLJYs2lYTs=";
  };

  proxyVendor = true;
-  vendorHash = "sha256-CLe5UuHwAXLk9c+6baOpfFqrE/pl4889PhlajBRV+UU=";
+  vendorHash = "sha256-eXZQYT65tHhMSTulXJ9UBN+9HggQL7Oo3sVFVfJDnGg=";

  subPackages = [ "cmd/werf" ];

@@ -10,11 +10,11 @@
 }:
 stdenv.mkDerivation rec {
  pname = "worldpainter";
-  version = "2.24.4";
+  version = "2.25.1";

  src = fetchurl {
    url = "https://www.worldpainter.net/files/${pname}_${version}.tar.gz";
-    hash = "sha256-j2b/V8MxaMRqGajMy5oYPlGSLVWN4/hdRji2zh8L1cg=";
+    hash = "sha256-AfqMerBvDfMw1WTeQVcPPt1nvBv7+66TolFCX4lFNVY=";
  };

  nativeBuildInputs = [
@@ -117,6 +117,8 @@ stdenv.mkDerivation {
    do
      substituteInPlace $i --replace '/etc/x2go' '/var/lib/x2go/conf'
    done
+    substituteInPlace x2goserver/Makefile \
+      --replace-fail "\$(DESTDIR)/etc" "\$(DESTDIR)/\$(ETCDIR)"
    substituteInPlace x2goserver/sbin/x2gocleansessions \
      --replace '/var/run/x2goserver.pid' '/var/run/x2go/x2goserver.pid'
    substituteInPlace x2goserver/sbin/x2godbadmin --replace 'user="x2gouser"' 'user="x2go"'
@@ -126,16 +128,16 @@ stdenv.mkDerivation {
  '';

  makeFlags = [
-    "PREFIX=/"
-    "NXLIBDIR=${nx-libs}/lib/nx"
+    "PREFIX=${placeholder "out"}"
+    "ETCDIR=${placeholder "out"}/etc/x2go"
+    "NXLIBDIR=${placeholder "out"}"
  ];

-  installFlags = [ "DESTDIR=$(out)" ];
-
  postInstall = ''
    mv $out/etc/x2go/x2goserver.conf{,.example}
    mv $out/etc/x2go/x2goagent.options{,.example}
    ln -sf ${nx-libs}/bin/nxagent $out/bin/x2goagent
+    ln -sf ${nx-libs}/share/nx/VERSION.nxagent $out/share/x2go/versions/VERSION.x2goserver-x2goagent
    for i in $out/sbin/x2go* $(find $out/bin -type f) \
      $(ls $out/lib/x2go/x2go* | grep -v x2gocheckport)
    do
@@ -2,6 +2,7 @@
  lib,
  mkXfceDerivation,
  clutter,
+  gettext,
  libXcomposite,
  libXinerama,
  libXdamage,
@@ -19,10 +20,16 @@
 mkXfceDerivation {
  category = "apps";
  pname = "xfdashboard";
-  version = "1.0.0";
+  version = "1.0.0-unstable-2025-07-18";
+  # Fix build with gettext 0.25
+  rev = "93255940950ef5bc89cab729c8b977a706f98e0c";
  rev-prefix = "";

-  sha256 = "sha256-iC41I0u9id9irUNyjuvRRzSldF3dzRYkaxb/fgptnq4=";
+  sha256 = "sha256-Qv0ASuJF0FzPoeLx2D6/kXkxnOJV7mdAFD6PCk+CMac=";
+
+  nativeBuildInputs = [
+    gettext
+  ];

  buildInputs = [
    clutter
@@ -2,6 +2,7 @@
  lib,
  stdenv,
  fetchFromGitHub,
+  gettext,
  pkg-config,
  intltool,
  gtk3,
@@ -24,6 +25,7 @@ stdenv.mkDerivation rec {
  };

  nativeBuildInputs = [
+    gettext
    pkg-config
    intltool
    xfce4-dev-tools
@@ -37,6 +39,13 @@ stdenv.mkDerivation rec {
    i3ipc-glib
  ];

+  patches = [
+    # Fix build with gettext 0.25
+    # https://hydra.nixos.org/build/302762031/nixlog/2
+    # FIXME: remove when gettext is fixed
+    ./gettext-0.25.patch
+  ];
+
  enableParallelBuilding = true;

  meta = with lib; {
@@ -0,0 +1,21 @@
+diff --git a/configure.ac.in b/configure.ac.in
+index 7932c16..1778d38 100644
+--- a/configure.ac.in
+++ b/configure.ac.in
+@@ -24,6 +24,7 @@ AC_COPYRIGHT([Copyright (C) 2014
+ AC_INIT([xfce4-i3-workspaces-plugin], [plugin_version], [https://github.com/denesb/xfce4-i3-workspaces-plugin/issues], [xfce4-i3-workspaces-plugin])
+ AC_PREREQ([2.50])
+ AC_REVISION([xfce4_panel_version_build])
+AC_CONFIG_MACRO_DIRS([m4])
+ 
+ dnl ***************************
+ dnl *** Initialize automake ***
+@@ -31,6 +32,8 @@ dnl ***************************
+ AM_INIT_AUTOMAKE([1.8 no-dist-gzip dist-bzip2 tar-ustar])
+ AM_CONFIG_HEADER([config.h])
+ AM_MAINTAINER_MODE()
+AM_GNU_GETTEXT_VERSION([0.21])
+AM_GNU_GETTEXT([external])
+ m4_ifdef([AM_SILENT_RULES], [AM_SILENT_RULES([yes])])
+ 
+ dnl **************************
@@ -83,6 +83,11 @@ let
          "--disable-libatomic" # requires libc
          "--disable-decimal-float" # requires libc
          "--disable-libmpx" # requires libc
+          "--disable-hosted-libstdcxx" # requires libc
+          "--disable-libstdcxx-backtrace"
+          "--disable-linux-futex"
+          "--disable-libvtv"
+          "--disable-libitm"
        ]
        ++ lib.optionals crossMingw [
          "--with-headers=${lib.getDev libcCross}/include"
@@ -39,7 +39,7 @@
  name ? "gcc",
  libcCross ? null,
  threadsCross ? { }, # for MinGW
-  withoutTargetLibc ? false,
+  withoutTargetLibc ? stdenv.targetPlatform.libc == null,
  flex,
  gnused ? null,
  buildPackages,
@@ -9,11 +9,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "kotlin";
-  version = "2.1.21";
+  version = "2.2.0";

  src = fetchurl {
    url = "https://github.com/JetBrains/kotlin/releases/download/v${finalAttrs.version}/kotlin-compiler-${finalAttrs.version}.zip";
-    sha256 = "sha256-G6CKi0XamTOaBgETTMA3tUz4XpvA7b523L0nwtaEqXc=";
+    sha256 = "sha256-GttvGlhFugqlpZ5BLkTI5AUja5V94aloNhnx3KOxaTI=";
  };

  propagatedBuildInputs = [ jre ];
@@ -631,32 +631,32 @@ lib.recurseIntoAttrs rec {
  # This derivation deploys the tools package and symlinks all the desired
  # plugins that we want to use. If the license isn't accepted, prints all the licenses
  # requested and throws.
-  androidsdk =
-    if !licenseAccepted then
-      throw ''
-        ${builtins.concatStringsSep "\n\n" (mkLicenseTexts licenseNames)}
+  androidsdk = callPackage ./cmdline-tools.nix {
+    inherit
+      deployAndroidPackage
+      os
+      arch
+      meta
+      ;

-        You must accept the following licenses:
-        ${lib.concatMapStringsSep "\n" (str: "  - ${str}") licenseNames}
+    package = cmdline-tools-package;

-        a)
-          by setting nixpkgs config option 'android_sdk.accept_license = true;'.
-        b)
-          by an environment variable for a single invocation of the nix tools.
-            $ export NIXPKGS_ACCEPT_ANDROID_SDK_LICENSE=1
-      ''
-    else
-      callPackage ./cmdline-tools.nix {
-        inherit
-          deployAndroidPackage
-          os
-          arch
-          meta
-          ;
+    postInstall =
+      if !licenseAccepted then
+        throw ''
+          ${builtins.concatStringsSep "\n\n" (mkLicenseTexts licenseNames)}

-        package = cmdline-tools-package;
+          You must accept the following licenses:
+          ${lib.concatMapStringsSep "\n" (str: "  - ${str}") licenseNames}

-        postInstall = ''
+          a)
+            by setting nixpkgs config option 'android_sdk.accept_license = true;'.
+          b)
+            by an environment variable for a single invocation of the nix tools.
+              $ export NIXPKGS_ACCEPT_ANDROID_SDK_LICENSE=1
+        ''
+      else
+        ''
          # Symlink all requested plugins
          ${linkPlugin {
            name = "platform-tools";
@@ -769,5 +769,5 @@ lib.recurseIntoAttrs rec {
            ''
          ) licenseNames}
        '';
-      };
+  };
 }
@@ -1,7 +1,13 @@
 {
  lib,
  ocaml,
-  version ? if lib.versionAtLeast ocaml.version "5.1" then "1.2" else "0.12",
+  version ?
+    if lib.versionAtLeast ocaml.version "5.2" then
+      "1.3"
+    else if lib.versionAtLeast ocaml.version "5.1" then
+      "1.2"
+    else
+      "0.12",
  buildDunePackage,
  bigstringaf,
  cstruct,
@@ -29,6 +35,10 @@ let
        minimalOCamlVersion = "5.1";
        hash = "sha256-N5LpEr2NSUuy449zCBgl5NISsZcM8sHxspZsqp/WvEA=";
      };
+      "1.3" = {
+        minimalOCamlVersion = "5.2";
+        hash = "sha256-jtXBPmaJ8xyF3KXxJ2LYS4zABCp7B9PkZN9utLcrPfw=";
+      };
    }
    ."${version}";
 in
@@ -11,7 +11,7 @@

 buildPythonPackage rec {
  pname = "azure-mgmt-storage";
-  version = "23.0.0";
+  version = "23.0.1";
  pyproject = true;

  disabled = pythonOlder "3.8";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    pname = "azure_mgmt_storage";
    inherit version;
-    hash = "sha256-HFlU1Zvdy5edBbxJ5DFxam4rL3VpCblrp8QyYQcq/L8=";
+    hash = "sha256-w6sqyTUtHAHYW1bWcW3M4eRoD5ILFIoktDabuRuSI7Q=";
  };

  build-system = [ setuptools ];
@@ -0,0 +1,44 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  rustPlatform,
+  pytestCheckHook,
+}:
+
+buildPythonPackage rec {
+  pname = "color-parser-py";
+  version = "0.1.6";
+  pyproject = true;
+
+  # PyPI has Cargo.lock
+  src = fetchPypi {
+    pname = "color_parser_py";
+    inherit version;
+    hash = "sha256-m1qhVAwQNtCwz+DLSAdfKhzkohMLMjvPHxynKhlJfN8=";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit pname version src;
+    hash = "sha256-tKXA6sd5gLCJUaqxzFcZ3lePK41Wk2TbLp0HXBacOyo=";
+  };
+
+  nativeBuildInputs = [
+    rustPlatform.cargoSetupHook
+    rustPlatform.maturinBuildHook
+  ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  pythonImportsCheck = [ "color_parser_py" ];
+
+  # Support newer python versions
+  env.PYO3_USE_ABI3_FORWARD_COMPATIBILITY = true;
+
+  meta = {
+    description = "Python bindings for color parsing and conversion";
+    homepage = "https://github.com/rusiaaman/color-parser-py";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ aleksana ];
+  };
+}
@@ -2,8 +2,11 @@
  lib,
  buildPythonPackage,
  fetchFromGitHub,
+
+  # build-system
  setuptools,
-  pythonAtLeast,
+
+  # depedencies
  numpy,
  scipy,
  pyqt5,
@@ -14,11 +17,6 @@ buildPythonPackage {
  pname = "curvefitgui";
  version = "0-unstable-2021-08-25";
  pyproject = true;
-  # For some reason, importing the main module makes the whole python
-  # interpreter crash! This needs further investigation, possibly the problem
-  # is with one of the dependencies.. See upstream report:
-  # https://github.com/moosepy/curvefitgui/issues/2
-  disabled = pythonAtLeast "3.12";

  src = fetchFromGitHub {
    owner = "moosepy";
@@ -27,9 +25,11 @@ buildPythonPackage {
    hash = "sha256-oK0ROKxh/91OrHhuufG6pvc2EMBeMP8R5O+ED2thyW8=";
  };

-  nativeBuildInputs = [ setuptools ];
+  build-system = [
+    setuptools
+  ];

-  propagatedBuildInputs = [
+  dependencies = [
    numpy
    scipy
    pyqt5
@@ -14,14 +14,14 @@

 buildPythonPackage rec {
  pname = "django-import-export";
-  version = "4.3.7";
+  version = "4.3.8";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "django-import-export";
    repo = "django-import-export";
    tag = version;
-    hash = "sha256-hHLFrcCw9PXGh7JbHo76SUZ09ZCK9u72BjiaL5HuVMc=";
+    hash = "sha256-4QZvVFhnXqdeKvADZOIADbRlRllce7WbVOfVJUHndvg=";
  };

  pythonRelaxDeps = [ "tablib" ];
@@ -11,6 +11,7 @@
  psutil,
  pybind11,
  setuptools-scm,
+  pytest-reraise,
  pytestCheckHook,
 }:

@@ -24,32 +25,33 @@ buildPythonPackage rec {
    ;
  pyproject = true;

-  postPatch =
-    (duckdb.postPatch or "")
-    + ''
-      # we can't use sourceRoot otherwise patches don't apply, because the patches apply to the C++ library
-      cd tools/pythonpkg
+  postPatch = (duckdb.postPatch or "") + ''
+    # we can't use sourceRoot otherwise patches don't apply, because the patches apply to the C++ library
+    cd tools/pythonpkg

-      # 1. let nix control build cores
-      # 2. default to extension autoload & autoinstall disabled
-      substituteInPlace setup.py \
-        --replace-fail "ParallelCompile()" 'ParallelCompile("NIX_BUILD_CORES")' \
-        --replace-fail "define_macros.extend([('DUCKDB_EXTENSION_AUTOLOAD_DEFAULT', '1'), ('DUCKDB_EXTENSION_AUTOINSTALL_DEFAULT', '1')])" "pass"
-    '';
+    # 1. let nix control build cores
+    # 2. default to extension autoload & autoinstall disabled
+    substituteInPlace setup.py \
+      --replace-fail "ParallelCompile()" 'ParallelCompile("NIX_BUILD_CORES")' \
+      --replace-fail "define_macros.extend([('DUCKDB_EXTENSION_AUTOLOAD_DEFAULT', '1'), ('DUCKDB_EXTENSION_AUTOINSTALL_DEFAULT', '1')])" "pass"
+
+    substituteInPlace pyproject.toml \
+      --replace-fail 'setuptools_scm>=6.4,<8.0' 'setuptools_scm'
+  '';

  env = {
    DUCKDB_BUILD_UNITY = 1;
    OVERRIDE_GIT_DESCRIBE = "v${version}-0-g${rev}";
  };

-  nativeBuildInputs = [
+  build-system = [
    pybind11
    setuptools-scm
  ];

  buildInputs = [ openssl ];

-  propagatedBuildInputs = [
+  dependencies = [
    numpy
    pandas
  ];
@@ -58,12 +60,14 @@ buildPythonPackage rec {
    fsspec
    google-cloud-storage
    psutil
+    pytest-reraise
    pytestCheckHook
  ];

  pytestFlags = [ "--verbose" ];

  # test flags from .github/workflows/Python.yml
+  pytestFlagsArray = [ "--verbose" ];
  enabledTestPaths = if stdenv.hostPlatform.isDarwin then [ "tests/fast" ] else [ "tests" ];

  disabledTestPaths = [
@@ -12,12 +12,12 @@

 buildPythonPackage rec {
  pname = "gerbonara";
-  version = "1.4.0";
+  version = "1.5.0";
  src = fetchFromGitHub {
    owner = "jaseg";
    repo = "gerbonara";
    rev = "v${version}";
-    hash = "sha256-SwXoCA9ru5VgH4geKUDgdcPrgEYgNoVwNb5YUBAcXlo=";
+    hash = "sha256-yxSZuBw93wqIAw1wke80Vy/dtBcQwpQ2tQ1nwXdWi4k=";
  };

  format = "setuptools";
@@ -19,6 +19,7 @@
  ujson,
  distutils,
  huggingface-hub,
+  nix-update-script,
 }:

 let
@@ -50,14 +51,14 @@ let
 in
 buildPythonPackage rec {
  pname = "paddlex";
-  version = "3.1.1";
+  version = "3.1.3";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "PaddlePaddle";
    repo = "PaddleX";
    tag = "v${version}";
-    hash = "sha256-vmb1A7AifQmWv31b847hP1lHeBe+ZDEGR3raIGykRoo=";
+    hash = "sha256-sNnaTB7wJFXVXnc7I1XufAWdTXHr1is3JdXdh6Ssc+s=";
  };

  build-system = [ setuptools ];
@@ -86,6 +87,8 @@ buildPythonPackage rec {
    huggingface-hub
  ];

+  passthru.updateScript = nix-update-script { };
+
  meta = {
    homepage = "https://github.com/PaddlePaddle/PaddleX";
    license = lib.licenses.asl20;
@@ -14,6 +14,7 @@
  pandas,
  pydantic,
  typeguard,
+  typing-extensions,
  typing-inspect,

  # optional-dependencies
@@ -22,6 +23,7 @@
  fastapi,
  geopandas,
  hypothesis,
+  ibis-framework,
  pandas-stubs,
  polars,
  pyyaml,
@@ -29,8 +31,10 @@
  shapely,

  # tests
+  duckdb,
  joblib,
  pyarrow,
+  pyarrow-hotfix,
  pytestCheckHook,
  pytest-asyncio,
  pythonAtLeast,
@@ -38,14 +42,14 @@

 buildPythonPackage rec {
  pname = "pandera";
-  version = "0.24.0";
+  version = "0.25.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "unionai-oss";
    repo = "pandera";
    tag = "v${version}";
-    hash = "sha256-S5y717M3rGGO39TOh1X5yePvdcF6ct1Jk51/bbM6X6M=";
+    hash = "sha256-0YeLeGpunjHRWFvSvz0r2BokM4/eJKXuBajgcGquca4=";
  };

  build-system = [
@@ -56,11 +60,10 @@ buildPythonPackage rec {
  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;

  dependencies = [
-    numpy
    packaging
-    pandas
    pydantic
    typeguard
+    typing-extensions
    typing-inspect
  ];

@@ -96,6 +99,14 @@ buildPythonPackage rec {
          geopandas
          shapely
        ];
+        ibis = [
+          ibis-framework
+          duckdb
+        ];
+        pandas = [
+          numpy
+          pandas
+        ];
        polars = [ polars ];
      };
    in
@@ -106,6 +117,7 @@ buildPythonPackage rec {
    pytest-asyncio
    joblib
    pyarrow
+    pyarrow-hotfix
  ] ++ optional-dependencies.all;

  disabledTestPaths = [
@@ -143,7 +155,7 @@ buildPythonPackage rec {
  meta = {
    description = "Light-weight, flexible, and expressive statistical data testing library";
    homepage = "https://pandera.readthedocs.io";
-    changelog = "https://github.com/unionai-oss/pandera/releases/tag/v${version}";
+    changelog = "https://github.com/unionai-oss/pandera/releases/tag/${src.tag}";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ bcdarwin ];
  };
@@ -9,14 +9,14 @@

 buildPythonPackage rec {
  pname = "petl";
-  version = "1.7.16";
+  version = "1.7.17";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "petl-developers";
    repo = "petl";
    tag = "v${version}";
-    hash = "sha256-rew/+GXQq2l1LlsR4yqHJZ/iY21HJ2Lf86KS55L8jsQ=";
+    hash = "sha256-zYR/9WdaVCmdaCzOFfHirVE4Gg+CVLvWu1RpWXdqLSc=";
  };

  build-system = [
@@ -2,6 +2,7 @@
  lib,
  buildPythonPackage,
  fetchFromGitHub,
+  fetchpatch,

  # build-system
  setuptools,
@@ -35,7 +36,7 @@

 buildPythonPackage rec {
  pname = "plopp";
-  version = "25.06.0";
+  version = "25.07.0";
  pyproject = true;

  src = fetchFromGitHub {
@@ -44,6 +45,13 @@ buildPythonPackage rec {
    tag = version;
    hash = "sha256-SwF0bUU/DAAJ5+0WvZgwqEw6IoaqdbKj0GkCgffGclA=";
  };
+  patches = [
+    # https://github.com/scipp/plopp/issues/472
+    (fetchpatch {
+      url = "https://github.com/scipp/plopp/commit/7af8cbee85796005f2fea79171ae44aba9a8cfc7.patch";
+      hash = "sha256-uyCV/2tSvcnnw+ak6fT99ru+UrTZXsS3b4YGeXVykAY=";
+    })
+  ];

  build-system = [
    setuptools
@@ -32,14 +32,14 @@

 buildPythonPackage rec {
  pname = "plotpy";
-  version = "2.7.4";
+  version = "2.7.5";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "PlotPyStack";
    repo = "PlotPy";
    tag = "v${version}";
-    hash = "sha256-FmSFcCAJZyzD9qRE+L2oxWtyh2spJSLRq+xtx4e1Rhg=";
+    hash = "sha256-g26CWUQTaky7h1wHd9CAB4AEvk24frN7f6wqs1fefJw=";
  };

  build-system = [
@@ -12,7 +12,7 @@

 buildPythonPackage rec {
  pname = "pyschlage";
-  version = "2025.4.0";
+  version = "2025.7.0";
  pyproject = true;

  disabled = pythonOlder "3.7";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
    owner = "dknowles2";
    repo = "pyschlage";
    tag = version;
-    hash = "sha256-RgPobb9RhM+eFX3Y+wSKlDQ6SddnGKlNTG1nIeEVDFs=";
+    hash = "sha256-XfYoui3xo8l3wi8nqvyzfYhsHsY8T1t/iYS4ZHNjGUE=";
  };

  build-system = [
@@ -41,7 +41,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "Library for interacting with Schlage Encode WiFi locks";
    homepage = "https://github.com/dknowles2/pyschlage";
-    changelog = "https://github.com/dknowles2/pyschlage/releases/tag/${version}";
+    changelog = "https://github.com/dknowles2/pyschlage/releases/tag/${src.tag}";
    license = licenses.asl20;
    maintainers = with maintainers; [ fab ];
  };
@@ -0,0 +1,46 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  pytest,
+  pytestCheckHook,
+  poetry-core,
+}:
+
+buildPythonPackage rec {
+  pname = "pytest-reraise";
+  version = "2.1.2";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "bjoluc";
+    repo = pname;
+    tag = "v${version}";
+    hash = "sha256-mgNKoZ+2sinArTZhSwhLxzBTb4QfiT1LWBs7w5MHXWA=";
+  };
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail 'poetry>=0.12' 'poetry-core>=1.0.0' \
+      --replace-fail 'poetry.masonry' 'poetry.core.masonry'
+  '';
+
+  build-system = [ poetry-core ];
+
+  dependencies = [ pytest ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  pythonImportsCheck = [ "pytest_reraise" ];
+
+  meta = {
+    description = "Make multi-threaded pytest test cases fail when they should";
+    longDescription = ''
+      Make multi-threaded pytest test cases fail when they should
+    '';
+    homepage = "https://github.com/bjoluc/pytest-reraise";
+    changelog = "https://github.com/bjoluc/pytest-reraise/releases/tag/${src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ cpcloud ];
+  };
+}
@@ -4,6 +4,7 @@
  fetchPypi,
  numpy,
  scipy,
+  setuptools,
  protobuf,
  onnx,
  scikit-learn,
@@ -15,14 +16,16 @@

 buildPythonPackage rec {
  pname = "skl2onnx";
-  version = "1.18.0";
-  format = "setuptools";
+  version = "1.19.1";
+  pyproject = true;

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-OepK4wxcGCNVoYJEZwExWCFERODOCxjzMzi9gn1PsA8=";
+    hash = "sha256-DBBfKjuHpiTdIY0fuY/dGc8b9iFxkNJc5+FUhBJ9Dl0=";
  };

+  build-system = [ setuptools ];
+
  propagatedBuildInputs = [
    numpy
    scipy
@@ -1,10 +1,10 @@
 {
-  "url": "https://github.com/cstrahan/tree-sitter-nix",
-  "rev": "cfc53fd287d23ab7281440a8526c73542984669b",
-  "date": "2025-03-10T21:49:48Z",
-  "path": "/nix/store/aqzm346ck43x74b409jiikbbxqchgyr1-tree-sitter-nix",
-  "sha256": "0bmalpgvfcz1zd72wq43r5qvhj3dqqp7zn9kfb6bs0valrxagaks",
-  "hash": "sha256-eqqneqZqA73McjPZfy7GbUi4ccmDYC5O++Ezt9+lqi4=",
+  "url": "https://github.com/nix-community/tree-sitter-nix",
+  "rev": "ea1d87f7996be1329ef6555dcacfa63a69bd55c6",
+  "date": "2025-07-18T19:46:47+02:00",
+  "path": "/nix/store/mvq8m0v2cr2xns4807cby54h3wc7xjxr-tree-sitter-nix",
+  "sha256": "1aaq5yv1s8qq3abm0jm884hi4k6n2w0nzd1j3wizv1x1xk6qzlsl",
+  "hash": "sha256-VNOPzeyhh/0jHzK0bwEX1kwSIUGoSlCXGhgjHbYvWKk=",
  "fetchLFS": false,
  "fetchSubmodules": false,
  "deepClone": false,
@@ -144,7 +144,7 @@ let
      repo = "tree-sitter-just";
    };
    "tree-sitter-nix" = {
-      orga = "cstrahan";
+      orga = "nix-community";
      repo = "tree-sitter-nix";
    };
    "tree-sitter-latex" = {
@@ -1,5 +1,5 @@
 {
-  gcc13Stdenv,
+  stdenv,
  lib,
  fetchzip,
  autoconf,
@@ -17,7 +17,7 @@
  file included in the tarball
 */

-gcc13Stdenv.mkDerivation {
+stdenv.mkDerivation {
  pname = "cnijfilter";

  /*
@@ -51,6 +51,8 @@ gcc13Stdenv.mkDerivation {
    ghostscript
  ];

+  env.NIX_CFLAGS_COMPILE = " -std=gnu90";
+
  patches = [
    ./patches/missing-include.patch
    ./patches/libpng15.patch
@@ -8,8 +8,6 @@
  optgamsFile ? null,
 }:

-assert licenseFile != null;
-
 stdenv.mkDerivation rec {
  version = "25.0.2";
  pname = "gams";
@@ -23,6 +21,7 @@ stdenv.mkDerivation rec {
  dontBuild = true;

  installPhase =
+    assert licenseFile != null;
    ''
      mkdir -p "$out/bin" "$out/share/gams"
      cp -a * "$out/share/gams"
@@ -301,6 +301,7 @@ mapAliases {
  appthreat-depscan = dep-scan; # Added 2024-04-10
  arb = throw "'arb' has been removed as it has been merged into 'flint3'"; # Added 2025-03-28
  arcanist = throw "arcanist was removed as phabricator is not supported and does not accept fixes"; # Added 2024-06-07
+  archipelago-minecraft = throw "archipelago-minecraft has been removed, as upstream no longer ships minecraft as a default APWorld."; # Added 2025-07-15
  argo = argo-workflows; # Added 2025-02-01
  aria = aria2; # Added 2024-03-26
  armcord = throw "ArmCord was renamed to legcord by the upstream developers. Action is required to migrate configurations between the two applications. Please see this PR for more details: https://github.com/NixOS/nixpkgs/pull/347971"; # Added 2024-10-11
@@ -1897,7 +1898,8 @@ mapAliases {
  steam-small = steam; # Added 2024-09-12
  steam-run-native = steam-run; # added 2022-02-21
  StormLib = stormlib; # Added 2024-01-21
-  strawberry-qt5 = throw "strawberry-qt5 has been replaced by strawberry-qt6"; # Added 2024-11-22
+  strawberry-qt5 = throw "strawberry-qt5 has been replaced by strawberry"; # Added 2024-11-22 and updated 2025-07-19
+  strawberry-qt6 = throw "strawberry-qt6 has been replaced by strawberry"; # Added 2025-07-19
  strelka = throw "strelka depends on Python 2.6+, and does not support Python 3."; # Added 2025-03-17
  subberthehut = throw "'subberthehut' has been removed as it was unmaintained upstream"; # Added 2025-05-17
  substituteAll = throw "`substituteAll` has been removed. Use `replaceVars` instead."; # Added 2025-05-23
@@ -288,10 +288,6 @@ with pkgs;
  # many more scenarios than just opengl now.
  aocd = with python3Packages; toPythonApplication aocd;

-  archipelago-minecraft = callPackage ../by-name/ar/archipelago/package.nix {
-    extraPackages = [ jdk17 ];
-  };
-
  cve = with python3Packages; toPythonApplication cvelib;

  basalt-monado = callPackage ../by-name/ba/basalt-monado/package.nix {
@@ -2818,10 +2814,6 @@ with pkgs;

  sonobuoy = callPackage ../applications/networking/cluster/sonobuoy { };

-  strawberry-qt6 = qt6Packages.callPackage ../applications/audio/strawberry { };
-
-  strawberry = strawberry-qt6;
-
  schleuder = callPackage ../tools/security/schleuder { };

  schleuder-cli = callPackage ../tools/security/schleuder/cli { };
@@ -8155,7 +8147,7 @@ with pkgs;
      wasilibc
    else if libc == "relibc" then
      relibc
-    else if name == "llvm" then
+    else if libc == "llvm" then
      llvmPackages_20.libc
    else
      throw "Unknown libc ${libc}";
@@ -11375,6 +11367,7 @@ with pkgs;
  usbrelayd = callPackage ../os-specific/linux/usbrelay/daemon.nix { };

  util-linuxMinimal = util-linux.override {
+    fetchurl = stdenv.fetchurlBoot;
    cryptsetupSupport = false;
    nlsSupport = false;
    ncursesSupport = false;
@@ -2763,6 +2763,8 @@ self: super: with self; {

  color-operations = callPackage ../development/python-modules/color-operations { };

+  color-parser-py = callPackage ../development/python-modules/color-parser-py { };
+
  colorama = callPackage ../development/python-modules/colorama { };

  colorcet = callPackage ../development/python-modules/colorcet { };
@@ -14268,6 +14270,8 @@ self: super: with self; {

  pytest-repeat = callPackage ../development/python-modules/pytest-repeat { };

+  pytest-reraise = callPackage ../development/python-modules/pytest-reraise { };
+
  pytest-rerunfailures = callPackage ../development/python-modules/pytest-rerunfailures { };

  pytest-resource-path = callPackage ../development/python-modules/pytest-resource-path { };