Merge branch 'master' into ak/upgrade-aider-chat

.github/ISSUE_TEMPLATE/05_package_request.yml

@@ -1,108 +0,0 @@
-name: "Request: new package"
-description: "Create a package request for software that is not yet included in Nixpkgs."
-title: "Package request: PACKAGENAME"
-labels: ["0.kind: enhancement", "0.kind: packaging request", "9.needs: package (new)"]
-body:
-  - type: "markdown"
-    attributes:
-      value: |
-        <p align="center">
-          <a href="https://nixos.org">
-            <picture>
-              <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/NixOS/nixos-homepage/main/public/logo/nixos-hires.png">
-              <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/NixOS/nixos-artwork/master/logo/nixos-white.png">
-              <img src="https://raw.githubusercontent.com/NixOS/nixos-homepage/main/public/logo/nixos-hires.png" width="400px" alt="NixOS logo">
-            </picture>
-          </a>
-        </p>
-
-        Welcome to Nixpkgs. Please replace the **`Package request: PACKAGENAME`** template above with the correct package name (As seen in the [NixOS Package Search](https://search.nixos.org/packages)).
-
-        > [!TIP]
-        > For instance, if you were filing a request against the missing `hello` package, your title would be as follows:
-        > `Package request: hello`
-
-        ---
-  - type: "textarea"
-    id: "description"
-    attributes:
-      label: "Describe the package"
-      description: "Please include a clear and concise description of what the package is."
-    validations:
-      required: true
-  - type: "input"
-    id: "homepage"
-    attributes:
-      label: "Upstream homepage"
-      description: "Please copy and paste a link to the package's homepage."
-    validations:
-      required: true
-  - type: "input"
-    id: "source"
-    attributes:
-      label: "Source URL"
-      description: "Please copy and paste a link to the package's source code or binary download page."
-    validations:
-      required: true
-  - type: "input"
-    id: "license"
-    attributes:
-      label: "License"
-      description: "Please indicate the package's license. If the package has no license, or the source code is not public, please indicate the package is `unfree`."
-    validations:
-      required: true
-  - type: "dropdown"
-    id: "platforms"
-    attributes:
-      label: "Platforms"
-      description: "Please indicate the platforms this package compiles for. `darwin` refers to macOS. `Exotic` refers to uncommon platforms like RISC-V or 32-bit ARM; please mention in the 'Additional Context' section below if this package is supposed to compile for such exotic platforms."
-      multiple: true
-      options:
-        - "x86_64-linux"
-        - "aarch64-linux"
-        - "x86_64-darwin"
-        - "aarch64-darwin"
-        - "Exotic"
-  - type: "textarea"
-    id: "additional-context"
-    attributes:
-      label: "Additional context"
-      description: "Add any other context about the proposed module here."
-    validations:
-      required: false
-  - type: "checkboxes"
-    id: "sanity-check"
-    attributes:
-      label: "I assert that this issue is relevant for Nixpkgs"
-      options:
-        - label: "I assert that this package does not yet exist in an [open pull request](https://github.com/NixOS/nixpkgs/pulls?q=is%3Aopen+is%3Apr+label%3A%228.has%3A+package+%28new%29%22) or in [Nixpkgs Unstable](https://search.nixos.org/packages?channel=unstable)."
-          required: true
-        - label: "I assert that this is not a [duplicate of any known issue](https://github.com/NixOS/nixpkgs/issues?q=is%3Aissue+is%3Aopen+label%3A%220.kind%3A+packaging+request%22)."
-          required: true
-        - label: "I assert that I have read the [NixOS Code of Conduct](https://github.com/NixOS/.github/blob/master/CODE_OF_CONDUCT.md) and agree to abide by it."
-          required: true
-  - type: "markdown"
-    attributes:
-      value: |
-        # Thank you for helping improve Nixpkgs!
-
-        ---
-  - type: "textarea"
-    id: "prioritisation"
-    attributes:
-      label: "For this package's maintainers:"
-      description: |
-        **Please do not modify this text area!**
-
-        This template helps Nixpkgs developers know which issues should be prioritised by allowing users to vote with a :+1: reaction and also reminds them to tag this issue in their pull requests.
-        This is not a guarantee that highly-requested issues will be fixed first, but it helps us to figure out what's important to users. Please react on other users' issues if you find them important.
-      value: |
-
-        Please tag this issue in your pull request description. (i.e. `Resolves #ISSUE`.)
-
-        ---
-
-        Add a :+1: [reaction] to [issues you find important].
-
-        [reaction]: https://github.blog/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/
-        [issues you find important]: https://github.com/NixOS/nixpkgs/issues?q=is%3Aissue+is%3Aopen+sort%3Areactions-%2B1-desc

.github/workflows/eval.yml

@@ -75,6 +75,9 @@ jobs:
         with:
           extra_nix_config: sandbox = true
 
+      - name: Ensure flake outputs on all systems still evaluate
+        run: nix --experimental-features 'nix-command flakes' flake check --all-systems --no-build ./nixpkgs
+
       - name: Query nixpkgs with aliases enabled to check for basic syntax errors
         run: |
           time nix-env -I ./nixpkgs -f ./nixpkgs -qa '*' --option restrict-eval true --option allow-import-from-derivation false >/dev/null

flake.nix

@@ -98,15 +98,26 @@
 
       checks = forAllSystems (
         system:
-        {
-          tarball = jobs.${system}.tarball;
-        }
+        { }
+        //
+          lib.optionalAttrs
+            (
+              # Exclude x86_64-freebsd because "Failed to evaluate rustc-wrapper-1.85.0: «broken»: is marked as broken"
+              system != "x86_64-freebsd"
+            )
+            {
+              tarball = jobs.${system}.tarball;
+            }
         //
           lib.optionalAttrs
             (
               self.legacyPackages.${system}.stdenv.hostPlatform.isLinux
               # Exclude power64 due to "libressl is not available on the requested hostPlatform" with hostPlatform being power64
               && !self.legacyPackages.${system}.targetPlatform.isPower64
+              # Exclude armv6l-linux because "cannot bootstrap GHC on this platform ('armv6l-linux' with libc 'defaultLibc')"
+              && system != "armv6l-linux"
+              # Exclude riscv64-linux because "cannot bootstrap GHC on this platform ('riscv64-linux' with libc 'defaultLibc')"
+              && system != "riscv64-linux"
             )
             {
               # Test that ensures that the nixosSystem function can accept a lib argument
@@ -156,8 +167,8 @@
               system != "armv6l-linux"
               # Exclude riscv64-linux because "Package ‘ghc-9.6.6’ in .../pkgs/development/compilers/ghc/common-hadrian.nix:579 is not available on the requested hostPlatform"
               && system != "riscv64-linux"
-              # Exclude FreeBSD because "Package ‘ghc-9.6.6’ in .../pkgs/development/compilers/ghc/common-hadrian.nix:579 is not available on the requested hostPlatform"
-              && !self.legacyPackages.${system}.stdenv.hostPlatform.isFreeBSD
+              # Exclude x86_64-freebsd because "Package ‘ghc-9.6.6’ in .../pkgs/development/compilers/ghc/common-hadrian.nix:579 is not available on the requested hostPlatform"
+              && system != "x86_64-freebsd"
             )
             {
               /**
@@ -167,7 +178,15 @@
             }
       );
 
-      formatter = forAllSystems (system: (import ./ci { inherit system; }).fmt.pkg);
+      formatter = lib.filterAttrs (
+        system: _:
+        # Exclude armv6l-linux because "cannot bootstrap GHC on this platform ('armv6l-linux' with libc 'defaultLibc')"
+        system != "armv6l-linux"
+        # Exclude riscv64-linux because "cannot bootstrap GHC on this platform ('riscv64-linux' with libc 'defaultLibc')"
+        && system != "riscv64-linux"
+        # Exclude x86_64-freebsd because "Package ‘go-1.22.12-freebsd-amd64-bootstrap’ in /nix/store/0yw40qnrar3lvc5hax5n49abl57apjbn-source/pkgs/development/compilers/go/binary.nix:50 is not available on the requested hostPlatform"
+        && system != "x86_64-freebsd"
+      ) (forAllSystems (system: (import ./ci { inherit system; }).fmt.pkg));
 
       /**
         A nested structure of [packages](https://nix.dev/manual/nix/latest/glossary#package-attribute-set) and other values.

maintainers/maintainer-list.nix

@@ -6267,12 +6267,6 @@
     githubId = 875324;
     name = "David Johnson";
   };
-  dmrauh = {
-    email = "dmrauh@posteo.de";
-    github = "dmrauh";
-    githubId = 37698547;
-    name = "Dominik Michael Rauh";
-  };
   dmvianna = {
     email = "dmlvianna@gmail.com";
     github = "dmvianna";
@@ -24957,10 +24951,11 @@
     name = "Mason Mackaman";
   };
   usertam = {
-    email = "nix@usertam.dev";
+    name = "Samuel Tam";
+    email = "code@usertam.dev";
     github = "usertam";
     githubId = 22500027;
-    name = "Samuel Tam";
+    keys = [ { fingerprint = "EC4E E490 3C82 3698 2CAB  D206 2D87 60B0 229E 2560"; } ];
   };
   uskudnik = {
     email = "urban.skudnik@gmail.com";

nixos/doc/manual/release-notes/rl-2505.section.md

@@ -166,6 +166,8 @@
 
 - [mqtt-exporter](https://github.com/kpetremann/mqtt-exporter/), a Prometheus exporter for exposing messages from MQTT. Available as [services.prometheus.exporters.mqtt](#opt-services.prometheus.exporters.mqtt.enable).
 
+- [pocket-id](https://pocket-id.org/), an OIDC provider with passkeys support. Available as [services.pocket-id](#opt-services.pocket-id.enable).
+
 - [nvidia-gpu](https://github.com/utkuozdemir/nvidia_gpu_exporter), a Prometheus exporter that scrapes `nvidia-smi` for GPU metrics. Available as [services.prometheus.exporters.nvidia-gpu](#opt-services.prometheus.exporters.nvidia-gpu.enable).
 
 - [OpenGamepadUI](https://github.com/ShadowBlip/OpenGamepadUI/), an open source gamepad-native game launcher and overlay for Linux. Available as [programs.opengamepadui](#opt-programs.opengamepadui.enable).

nixos/modules/module-list.nix

@@ -1419,6 +1419,7 @@
   ./services/security/paretosecurity.nix
   ./services/security/pass-secret-service.nix
   ./services/security/physlock.nix
+  ./services/security/pocket-id.nix
   ./services/security/shibboleth-sp.nix
   ./services/security/sks.nix
   ./services/security/sshguard.nix

nixos/modules/services/display-managers/cosmic-greeter.nix

@@ -12,6 +12,7 @@
 
 let
   cfg = config.services.displayManager.cosmic-greeter;
+  cfgAutoLogin = config.services.displayManager.autoLogin;
 in
 
 {
@@ -35,6 +36,10 @@ in
           user = "cosmic-greeter";
           command = ''${lib.getExe' pkgs.coreutils "env"} XCURSOR_THEME="''${XCURSOR_THEME:-Pop}" systemd-cat -t cosmic-greeter ${lib.getExe pkgs.cosmic-comp} ${lib.getExe cfg.package}'';
         };
+        initial_session = lib.mkIf (cfgAutoLogin.enable && (cfgAutoLogin.user != null)) {
+          user = cfgAutoLogin.user;
+          command = ''${lib.getExe' pkgs.coreutils "env"} XCURSOR_THEME="''${XCURSOR_THEME:-Pop}" systemd-cat -t cosmic-session ${lib.getExe pkgs.cosmic-session}'';
+        };
       };
     };
 

nixos/modules/services/misc/paperless.nix

@@ -421,8 +421,7 @@ in
           };
           environment = env;
 
-          preStart =
-            ''
+          preStart = ''
               # remove old papaerless-manage symlink
               # TODO: drop with NixOS 25.11
               [[ -L '${cfg.dataDir}/paperless-manage' ]] && rm '${cfg.dataDir}/paperless-manage'
@@ -448,13 +447,15 @@ in
                   ${cfg.package}/bin/paperless-ngx document_index reindex
                 fi
 
-                echo ${cfg.package.version} > "$versionFile"
-              fi
-            ''
-            + lib.optionalString (cfg.passwordFile != null) ''
+              echo ${cfg.package.version} > "$versionFile"
+            fi
+
+            if ${lib.boolToString (cfg.passwordFile != null)} || [[ -n $PAPERLESS_ADMIN_PASSWORD ]]; then
               export PAPERLESS_ADMIN_USER="''${PAPERLESS_ADMIN_USER:-admin}"
-              PAPERLESS_ADMIN_PASSWORD=$(cat "$CREDENTIALS_DIRECTORY/PAPERLESS_ADMIN_PASSWORD")
-              export PAPERLESS_ADMIN_PASSWORD
+              if [[ -e $CREDENTIALS_DIRECTORY/PAPERLESS_ADMIN_PASSWORD ]]; then
+                PAPERLESS_ADMIN_PASSWORD=$(cat "$CREDENTIALS_DIRECTORY/PAPERLESS_ADMIN_PASSWORD")
+                export PAPERLESS_ADMIN_PASSWORD
+              fi
               superuserState="$PAPERLESS_ADMIN_USER:$PAPERLESS_ADMIN_PASSWORD"
               superuserStateFile="${cfg.dataDir}/superuser-state"
 
@@ -462,7 +463,8 @@ in
                 ${cfg.package}/bin/paperless-ngx manage_superuser
                 echo "$superuserState" > "$superuserStateFile"
               fi
-            '';
+            fi
+          '';
           requires = lib.optional cfg.database.createLocally "postgresql.service";
           after =
             lib.optional enableRedis "redis-paperless.service"

nixos/modules/services/monitoring/prometheus/exporters.nix

@@ -56,6 +56,7 @@ let
         "blackbox"
         "borgmatic"
         "buildkite-agent"
+        "ecoflow"
         "chrony"
         "collectd"
         "deluge"
@@ -122,6 +123,7 @@ let
         "statsd"
         "surfboard"
         "systemd"
+        "tibber"
         "unbound"
         "unpoller"
         "v2ray"

nixos/modules/services/monitoring/prometheus/exporters/ecoflow.nix

@@ -0,0 +1,151 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.prometheus.exporters.ecoflow;
+  inherit (lib) mkOption types;
+in
+{
+  port = 2112;
+  extraOpts = {
+    exporterType = mkOption {
+      type = types.enum [
+        "rest"
+        "mqtt"
+      ];
+      default = "rest";
+      example = "mqtt";
+      description = ''
+        The type of exporter you'd like to use.
+        Possible values: "rest" and "mqtt". Default value is "rest".
+        Choose "rest" for the ecoflow online cloud api use "rest" and define: accessKey, secretKey.
+        Choose "mqtt" for the lan realtime integration use "mqtt" and define: email, password, devices.
+      '';
+    };
+    ecoflowAccessKeyFile = mkOption {
+      type = types.path;
+      default = /etc/ecoflow-access-key;
+      description = ''
+        Path to the file with your personal api access string from the Ecoflow development website https://developer-eu.ecoflow.com.
+        Do to share or commit your plaintext scecrets to a public repo use: agenix or soaps.
+      '';
+    };
+    ecoflowSecretKeyFile = mkOption {
+      type = types.path;
+      default = /etc/ecoflow-secret-key;
+      description = ''
+        Path to the file with your personal api secret string from the Ecoflow development website https://developer-eu.ecoflow.com.
+        Do to share or commit your plaintext scecrets to a public repo use: agenix or soaps.
+      '';
+    };
+    ecoflowEmailFile = mkOption {
+      type = types.path;
+      default = /etc/ecoflow-email;
+      description = ''
+        Path to the file with your personal ecoflow app login email address.
+        Do to share or commit your plaintext scecrets to a public repo use: agenix or soaps.
+      '';
+    };
+    ecoflowPasswordFile = mkOption {
+      type = types.path;
+      default = /etc/ecoflow-password;
+      description = ''
+        Path to the file with your personal ecoflow app login email password.
+        Do to share or commit your plaintext passwords to a public repo use: agenix or soaps here!
+      '';
+    };
+    ecoflowDevicesFile = mkOption {
+      type = types.path;
+      default = /etc/ecoflow-devices;
+      description = ''
+        File must contain one line, example: R3300000,R3400000,NC430000,....
+        The list of devices serial numbers separated by comma. For instance: SN1,SN2,SN3.
+        Instead of "devicesFile" you can specify "devicesPrettynamesFile" which will also work. You can specify both.
+        Do to share or commit your plaintext serial numbers to a public repo use: agenix or soaps.
+      '';
+    };
+    ecoflowDevicesPrettyNamesFile = mkOption {
+      type = types.path;
+      default = /etc/ecoflow-devices-pretty-names;
+      description = ''
+        File must contain one line, example: {"R3300000":"Delta 2","R3400000":"Delta Pro",...}
+        The key/value map of custom names for your devices. Key is a serial number, value is a device name you want
+        to see in Grafana Dashboard. It's helpful to see a meaningful name in Grafana dashboard instead of a serialnumber.
+        Do to share or commit your plaintext serial numbers to a public repo use: agenix or soaps.
+      '';
+    };
+    debug = mkOption {
+      type = types.str;
+      default = "0";
+      example = "1";
+      description = ''
+        Enable debug log messages. Disabled by default. Set to "1" to enable.
+      '';
+    };
+    prefix = mkOption {
+      type = types.str;
+      default = "ecoflow";
+      example = "ecoflow_privateSite";
+      description = ''
+        The prefix that will be added to all metrics. Default value is ecoflow.
+        For instance metric bms_bmsStatus.minCellTemp will be exported to prometheus as ecoflow.bms_bmsStatus.minCellTemp.
+        With default value "ecoflow" you can use Grafana Dashboard with ID 17812 without any changes.
+      '';
+    };
+    scrapingInterval = mkOption {
+      type = types.ints.positive;
+      default = 30;
+      example = 120;
+      description = ''
+        Scrapping interval in seconds. How often should the exporter execute requests to Ecoflow Rest API in order to get the data.
+        Default value is 30 seconds. Align this value with your prometheus scraper interval settings.
+      '';
+    };
+    mqttDeviceOfflineThreshold = mkOption {
+      type = types.ints.positive;
+      default = 60;
+      example = 120;
+      description = ''
+        The threshold in seconds which indicates how long we should wait for a metric message from MQTT broker.
+        Default value: 60 seconds. If we don't receive message within 60 seconds we consider that device is offline.
+        If we don't receive messages within the threshold for all devices, we'll try to reconnect to the MQTT broker.
+        There is a strange behavior that MQTT stop sends messages if you open Ecoflow mobile app and then close it).
+      '';
+    };
+  };
+  serviceOpts = {
+    environment = {
+      PROMETHEUS_ENABLED = "1";
+      EXPORTER_TYPE = cfg.exporterType;
+      DEBUG_ENABLED = cfg.debug;
+      METRIC_PREFIX = cfg.prefix;
+      SCRAPING_INTERVAL = toString cfg.scrapingInterval;
+      MQTT_DEVICE_OFFLINE_THRESHOLD_SECONDS = toString cfg.mqttDeviceOfflineThreshold;
+    };
+    script = ''
+      export ECOFLOW_ACCESS_KEY="$(cat ${toString cfg.ecoflowAccessKeyFile})"
+      export ECOFLOW_SECRET_KEY="$(cat ${toString cfg.ecoflowSecretKeyFile})"
+      export ECOFLOW_EMAIL="$(cat ${toString cfg.ecoflowEmailFile})"
+      export ECOFLOW_PASSWORD="$(cat ${toString cfg.ecoflowPasswordFile})"
+      export ECOFLOW_DEVICES="$(cat ${toString cfg.ecoflowDevicesFile})"
+      export ECOFLOW_DEVICES_PRETTY_NAMES="$(cat ${toString cfg.ecoflowDevicesPrettyNamesFile})"
+      exec ${lib.getExe pkgs.go-ecoflow-exporter}'';
+    serviceConfig = {
+      AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
+      CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
+      MemoryDenyWriteExecute = true;
+      NoNewPrivileges = true;
+      ProtectSystem = "strict";
+      Restart = "on-failure";
+      RestrictAddressFamilies = [
+        "AF_INET"
+        "AF_INET6"
+      ];
+      RestrictNamespaces = true;
+      User = "prometheus"; # context needed to runtime access encrypted token and secrets
+    };
+  };
+}

nixos/modules/services/monitoring/prometheus/exporters/tibber.nix

@@ -0,0 +1,44 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.prometheus.exporters.tibber;
+  inherit (lib) mkOption types concatStringsSep;
+in
+{
+  port = 9489;
+  extraOpts = {
+    apiTokenPath = mkOption {
+      type = types.path;
+      default = null;
+      description = ''
+        Add here the path to your personal Tibber API Token ('Bearer Token') File.
+        Get your personal Tibber API Token here: https://developer.tibber.com
+        Do not share your personal plaintext Tibber API Token via github. (see: ryantm/agenix, mic92/sops)
+      '';
+    };
+  };
+  serviceOpts = {
+    script = ''
+      export TIBBER_TOKEN="$(cat ${toString cfg.apiTokenPath})"
+      exec ${pkgs.prometheus-tibber-exporter}/bin/tibber-exporter --listen-address ${cfg.listenAddress}:${toString cfg.port} ${concatStringsSep " \\\n  " cfg.extraFlags}
+    '';
+    serviceConfig = {
+      AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
+      CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
+      MemoryDenyWriteExecute = true;
+      NoNewPrivileges = true;
+      ProtectSystem = "strict";
+      Restart = "on-failure";
+      RestrictAddressFamilies = [
+        "AF_INET"
+        "AF_INET6"
+      ];
+      RestrictNamespaces = true;
+      User = "prometheus"; # context needed to runtime access encrypted token and secrets
+    };
+  };
+}

nixos/modules/services/security/paretosecurity.nix

@@ -24,6 +24,17 @@
     # dependencies here. This creates the necessary symlinks in the proper locations.
     systemd.sockets.paretosecurity.wantedBy = [ "sockets.target" ];
 
+    # In NixOS, systemd services are configured with minimal PATH. However,
+    # paretosecurity helper looks for installed software to do its job, so
+    # it needs the full system PATH. For example, it runs `iptables` to see if
+    # firewall is configured. And it looks for various password managers to see
+    # if one is installed.
+    # The `paretosecurity-user` timer service that is configured lower has
+    # the same need.
+    systemd.services.paretosecurity.serviceConfig.Environment = [
+      "PATH=${config.system.path}/bin:${config.system.path}/sbin"
+    ];
+
     # Enable the tray icon and timer services if the trayIcon option is enabled
     systemd.user = lib.mkIf config.services.paretosecurity.trayIcon {
       services.paretosecurity-trayicon = {
@@ -31,6 +42,9 @@
       };
       services.paretosecurity-user = {
         wantedBy = [ "graphical-session.target" ];
+        serviceConfig.Environment = [
+          "PATH=${config.system.path}/bin:${config.system.path}/sbin"
+        ];
       };
       timers.paretosecurity-user = {
         wantedBy = [ "timers.target" ];

nixos/modules/services/security/pocket-id.nix

@@ -0,0 +1,278 @@
+{
+  lib,
+  pkgs,
+  config,
+  ...
+}:
+
+let
+  inherit (lib)
+    mkEnableOption
+    mkIf
+    mkOption
+    optionalAttrs
+    optional
+    mkPackageOption
+    ;
+  inherit (lib.types)
+    bool
+    path
+    str
+    submodule
+    ;
+
+  cfg = config.services.pocket-id;
+
+  format = pkgs.formats.keyValue { };
+  settingsFile = format.generate "pocket-id-env-vars" cfg.settings;
+in
+{
+  meta.maintainers = with lib.maintainers; [
+    gepbird
+    ymstnt
+  ];
+
+  options.services.pocket-id = {
+    enable = mkEnableOption "Pocket ID server";
+
+    package = mkPackageOption pkgs "pocket-id" { };
+
+    environmentFile = mkOption {
+      type = path;
+      description = ''
+        Path to an environment file loaded for the Pocket ID service.
+
+        This can be used to securely store tokens and secrets outside of the world-readable Nix store.
+
+        Example contents of the file:
+        MAXMIND_LICENSE_KEY=your-license-key
+      '';
+      default = "/dev/null";
+      example = "/var/lib/secrets/pocket-id";
+    };
+
+    settings = mkOption {
+      type = submodule {
+        freeformType = format.type;
+
+        options = {
+          PUBLIC_APP_URL = mkOption {
+            type = str;
+            description = ''
+              The URL where you will access the app.
+            '';
+            default = "http://localhost";
+          };
+
+          TRUST_PROXY = mkOption {
+            type = bool;
+            description = ''
+              Whether the app is behind a reverse proxy.
+            '';
+            default = false;
+          };
+        };
+      };
+
+      default = { };
+
+      description = ''
+        Environment variables that will be passed to Pocket ID, see
+        [configuration options](https://pocket-id.org/docs/configuration/environment-variables)
+        for supported values.
+      '';
+    };
+
+    dataDir = mkOption {
+      type = path;
+      default = "/var/lib/pocket-id";
+      description = ''
+        The directory where Pocket ID will store its data, such as the database.
+      '';
+    };
+
+    user = mkOption {
+      type = str;
+      default = "pocket-id";
+      description = "User account under which Pocket ID runs.";
+    };
+
+    group = mkOption {
+      type = str;
+      default = "pocket-id";
+      description = "Group account under which Pocket ID runs.";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    warnings = (
+      optional (cfg.settings ? MAXMIND_LICENSE_KEY)
+        "config.services.pocket-id.settings.MAXMIND_LICENSE_KEY will be stored as plaintext in the Nix store. Use config.services.pocket-id.environmentFile instead."
+    );
+
+    systemd.tmpfiles.rules = [
+      "d ${cfg.dataDir} 0755 ${cfg.user} ${cfg.group}"
+    ];
+
+    systemd.services = {
+      pocket-id-backend = {
+        description = "Pocket ID backend";
+        after = [ "network.target" ];
+        wantedBy = [ "multi-user.target" ];
+        restartTriggers = [
+          cfg.package
+          cfg.environmentFile
+          settingsFile
+        ];
+
+        serviceConfig = {
+          Type = "simple";
+          User = cfg.user;
+          Group = cfg.group;
+          WorkingDirectory = cfg.dataDir;
+          ExecStart = "${cfg.package}/bin/pocket-id-backend";
+          Restart = "always";
+          EnvironmentFile = [
+            cfg.environmentFile
+            settingsFile
+          ];
+
+          # Hardening
+          AmbientCapabilities = "";
+          CapabilityBoundingSet = "";
+          DeviceAllow = "";
+          DevicePolicy = "closed";
+          #IPAddressDeny = "any"; # communicates with the frontend
+          LockPersonality = true;
+          MemoryDenyWriteExecute = true;
+          NoNewPrivileges = true;
+          PrivateDevices = true;
+          PrivateNetwork = false; # communicates with the frontend
+          PrivateTmp = true;
+          PrivateUsers = true;
+          ProcSubset = "pid";
+          ProtectClock = true;
+          ProtectControlGroups = true;
+          ProtectHome = true;
+          ProtectHostname = true;
+          ProtectKernelLogs = true;
+          ProtectKernelModules = true;
+          ProtectKernelTunables = true;
+          ProtectProc = "invisible";
+          ProtectSystem = "full"; # needs to write in cfg.dataDir
+          RemoveIPC = true;
+          RestrictAddressFamilies = [
+            "AF_INET"
+            "AF_INET6"
+          ];
+          RestrictNamespaces = true;
+          RestrictRealtime = true;
+          RestrictSUIDSGID = true;
+          SystemCallArchitectures = "native";
+          SystemCallFilter = lib.concatStringsSep " " [
+            "~"
+            "@clock"
+            "@cpu-emulation"
+            "@debug"
+            "@module"
+            "@mount"
+            "@obsolete"
+            "@privileged"
+            "@raw-io"
+            "@reboot"
+            #"@resources" # vm test segfaults
+            "@swap"
+          ];
+          UMask = "0077";
+        };
+      };
+
+      pocket-id-frontend = {
+        description = "Pocket ID frontend";
+        after = [
+          "network.target"
+          "pocket-id-backend.service"
+        ];
+        wantedBy = [ "multi-user.target" ];
+        restartTriggers = [
+          cfg.package
+          cfg.environmentFile
+          settingsFile
+        ];
+
+        serviceConfig = {
+          Type = "simple";
+          User = cfg.user;
+          Group = cfg.group;
+          ExecStart = "${cfg.package}/bin/pocket-id-frontend";
+          Restart = "always";
+          EnvironmentFile = [
+            cfg.environmentFile
+            settingsFile
+          ];
+
+          # Hardening
+          AmbientCapabilities = "";
+          CapabilityBoundingSet = "";
+          DeviceAllow = "";
+          DevicePolicy = "closed";
+          #IPAddressDeny = "any"; # communicates with the backend and client
+          LockPersonality = true;
+          MemoryDenyWriteExecute = false; # V8_Fatal segfault
+          NoNewPrivileges = true;
+          PrivateDevices = true;
+          PrivateNetwork = false; # communicates with the backend and client
+          PrivateTmp = true;
+          PrivateUsers = true;
+          ProcSubset = "pid";
+          ProtectClock = true;
+          ProtectControlGroups = true;
+          ProtectHome = true;
+          ProtectHostname = true;
+          ProtectKernelLogs = true;
+          ProtectKernelModules = true;
+          ProtectKernelTunables = true;
+          ProtectProc = "invisible";
+          ProtectSystem = "strict";
+          RemoveIPC = true;
+          RestrictAddressFamilies = [
+            "AF_INET"
+            "AF_INET6"
+          ];
+          RestrictNamespaces = true;
+          RestrictRealtime = true;
+          RestrictSUIDSGID = true;
+          SystemCallArchitectures = "native";
+          SystemCallFilter = lib.concatStringsSep " " [
+            "~"
+            "@clock"
+            "@cpu-emulation"
+            "@debug"
+            "@module"
+            "@mount"
+            "@obsolete"
+            "@privileged"
+            "@raw-io"
+            "@reboot"
+            "@resources"
+            "@swap"
+          ];
+          UMask = "0077";
+        };
+      };
+    };
+
+    users.users = optionalAttrs (cfg.user == "pocket-id") {
+      pocket-id = {
+        isSystemUser = true;
+        group = cfg.group;
+        description = "Pocket ID backend user";
+        home = cfg.dataDir;
+      };
+    };
+
+    users.groups = optionalAttrs (cfg.group == "pocket-id") {
+      pocket-id = { };
+    };
+  };
+}

nixos/modules/services/security/vaultwarden/default.nix

@@ -65,6 +65,7 @@ let
 
   vaultwarden = cfg.package.override { inherit (cfg) dbBackend; };
 
+  useSendmail = configEnv.USE_SENDMAIL or null == "true";
 in
 {
   imports = [
@@ -236,10 +237,10 @@ in
         DevicePolicy = "closed";
         LockPersonality = true;
         MemoryDenyWriteExecute = true;
-        NoNewPrivileges = true;
-        PrivateDevices = true;
+        NoNewPrivileges = !useSendmail;
+        PrivateDevices = !useSendmail;
         PrivateTmp = true;
-        PrivateUsers = true;
+        PrivateUsers = !useSendmail;
         ProcSubset = "pid";
         ProtectClock = true;
         ProtectControlGroups = true;
@@ -262,10 +263,13 @@ in
         inherit StateDirectory;
         StateDirectoryMode = "0700";
         SystemCallArchitectures = "native";
-        SystemCallFilter = [
-          "@system-service"
-          "~@privileged"
-        ];
+        SystemCallFilter =
+          [
+            "@system-service"
+          ]
+          ++ lib.optionals (!useSendmail) [
+            "~@privileged"
+          ];
         Restart = "always";
         UMask = "0077";
       };

nixos/modules/services/web-apps/archtika.nix

@@ -17,7 +17,7 @@ let
 in
 {
   options.services.archtika = {
-    enable = mkEnableOption "Whether to enable the archtika service";
+    enable = mkEnableOption "the archtika CMS";
 
     package = mkPackageOption pkgs "archtika" { };
 

nixos/modules/services/web-apps/glance.nix

@@ -125,7 +125,7 @@ in
         ProtectKernelModules = true;
         ProtectKernelTunables = true;
         ProtectControlGroups = true;
-        ProcSubset = "pid";
+        ProcSubset = "all";
         RestrictNamespaces = true;
         RestrictRealtime = true;
         SystemCallArchitectures = "native";

nixos/modules/services/web-apps/onlyoffice.nix

@@ -114,7 +114,7 @@ in
               proxy_pass http://onlyoffice-docservice/$2$3;
             '';
             # /etc/nginx/includes/ds-docservice.conf
-            #disable caching for api.js
+            # disable caching for api.js
             "~ ^(\\/[\\d]+\\.[\\d]+\\.[\\d]+[\\.|-][\\w]+)?\\/(web-apps\\/apps\\/api\\/documents\\/api\\.js)$".extraConfig =
               ''
                 expires -1;
@@ -124,26 +124,23 @@ in
             "~ ^(\\/[\\d]+\\.[\\d]+\\.[\\d]+[\\.|-][\\w]+)?\\/(document_editor_service_worker\\.js)$".extraConfig =
               ''
                 expires 365d;
-                # gzip_static on;
-                alias  ${cfg.package}/var/www/onlyoffice/documentserver/sdkjs/common/serviceworker/$2;
+                alias ${cfg.package}/var/www/onlyoffice/documentserver/sdkjs/common/serviceworker/$2;
               '';
-            #suppress logging the unsupported locale error in web-apps
+            # suppress logging the unsupported locale error in web-apps
             "~ ^(\\/[\\d]+\\.[\\d]+\\.[\\d]+[\\.|-][\\w]+)?\\/(web-apps)(\\/.*\\.json)$".extraConfig = ''
               expires 365d;
               error_log /dev/null crit;
               alias ${cfg.package}/var/www/onlyoffice/documentserver/$2$3;
             '';
-            #suppress logging the unsupported locale error in plugins
+            # suppress logging the unsupported locale error in plugins
             "~ ^(\\/[\\d]+\\.[\\d]+\\.[\\d]+[\\.|-][\\w]+)?\\/(sdkjs-plugins)(\\/.*\\.json)$".extraConfig = ''
               expires 365d;
               error_log /dev/null crit;
-              # gzip_static on;
               alias ${cfg.package}/var/www/onlyoffice/documentserver/$2$3;
             '';
             "~ ^(\\/[\\d]+\\.[\\d]+\\.[\\d]+[\\.|-][\\w]+)?\\/(web-apps|sdkjs|sdkjs-plugins|fonts|dictionaries)(\\/.*)$".extraConfig =
               ''
                 expires 365d;
-                # gzip_static on;
                 alias ${cfg.package}/var/www/onlyoffice/documentserver/$2$3;
               '';
             "~* ^(\\/cache\\/files.*)(\\/.*)".extraConfig = ''
@@ -302,9 +299,8 @@ in
               ' /run/onlyoffice/config/default.json | sponge /run/onlyoffice/config/default.json
 
             chmod u+w /run/onlyoffice/config/production-linux.json
-            jq '
-              .FileConverter.converter.x2tPath = "${cfg.x2t}/bin/x2t"
-              ' /run/onlyoffice/config/production-linux.json | sponge /run/onlyoffice/config/production-linux.json
+            jq '.FileConverter.converter.x2tPath = "${cfg.x2t}/bin/x2t"' \
+              /run/onlyoffice/config/production-linux.json | sponge /run/onlyoffice/config/production-linux.json
 
             if psql -d onlyoffice -c "SELECT 'task_result'::regclass;" >/dev/null; then
               psql -f ${cfg.package}/var/www/onlyoffice/documentserver/server/schema/postgresql/removetbl.sql

nixos/modules/virtualisation/incus.nix

@@ -129,6 +129,7 @@ let
 
   environment = lib.mkMerge [
     {
+      INCUS_DOCUMENTATION = "${cfg.package.doc}/html";
       INCUS_EDK2_PATH = ovmf;
       INCUS_LXC_HOOK = "${cfg.lxcPackage}/share/lxc/hooks";
       INCUS_LXC_TEMPLATE_CONFIG = "${pkgs.lxcfs}/share/lxc/config";

nixos/tests/all-tests.nix

@@ -243,7 +243,7 @@ in
     imports = [ ./binary-cache.nix ];
     _module.args.compression = "xz";
   };
-  bind = handleTest ./bind.nix { };
+  bind = runTest ./bind.nix;
   bird = handleTest ./bird.nix { };
   birdwatcher = handleTest ./birdwatcher.nix { };
   bitbox-bridge = runTest ./bitbox-bridge.nix;
@@ -294,7 +294,7 @@ in
   ] ./ceph-single-node-bluestore-dmcrypt.nix { };
   certmgr = handleTest ./certmgr.nix { };
   cfssl = handleTestOn [ "aarch64-linux" "x86_64-linux" ] ./cfssl.nix { };
-  cgit = handleTest ./cgit.nix { };
+  cgit = runTest ./cgit.nix;
   charliecloud = handleTest ./charliecloud.nix { };
   chromadb = runTest ./chromadb.nix;
   chromium = (handleTestOn [ "aarch64-linux" "x86_64-linux" ] ./chromium.nix { }).stable or { };
@@ -584,7 +584,7 @@ in
   herbstluftwm = handleTest ./herbstluftwm.nix { };
   homebox = handleTest ./homebox.nix { };
   homer = handleTest ./homer { };
-  homepage-dashboard = handleTest ./homepage-dashboard.nix { };
+  homepage-dashboard = runTest ./homepage-dashboard.nix;
   honk = runTest ./honk.nix;
   installed-tests = pkgs.recurseIntoAttrs (handleTest ./installed-tests { });
   invidious = handleTest ./invidious.nix { };
@@ -691,7 +691,7 @@ in
   leaps = handleTest ./leaps.nix { };
   lemmy = handleTest ./lemmy.nix { };
   libinput = handleTest ./libinput.nix { };
-  librenms = handleTest ./librenms.nix { };
+  librenms = runTest ./librenms.nix;
   libresprite = handleTest ./libresprite.nix { };
   libreswan = runTest ./libreswan.nix;
   libreswan-nat = runTest ./libreswan-nat.nix;
@@ -703,7 +703,7 @@ in
   libvirtd = handleTest ./libvirtd.nix { };
   lidarr = handleTest ./lidarr.nix { };
   lightdm = handleTest ./lightdm.nix { };
-  lighttpd = handleTest ./lighttpd.nix { };
+  lighttpd = runTest ./lighttpd.nix;
   limesurvey = handleTest ./limesurvey.nix { };
   limine = import ./limine { inherit runTest; };
   listmonk = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./listmonk.nix { };
@@ -795,7 +795,7 @@ in
       defaults.services.mongodb.package = config.node.pkgs.mongodb-ce;
     }
   );
-  moodle = handleTest ./moodle.nix { };
+  moodle = runTest ./moodle.nix;
   moonraker = handleTest ./moonraker.nix { };
   mopidy = handleTest ./mopidy.nix { };
   morph-browser = runTest ./morph-browser.nix;
@@ -1039,6 +1039,7 @@ in
   pleroma = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./pleroma.nix { };
   plikd = handleTest ./plikd.nix { };
   plotinus = handleTest ./plotinus.nix { };
+  pocket-id = handleTest ./pocket-id.nix { };
   podgrab = handleTest ./podgrab.nix { };
   podman = handleTestOn [ "aarch64-linux" "x86_64-linux" ] ./podman/default.nix { };
   podman-tls-ghostunnel = handleTestOn [
@@ -1202,7 +1203,7 @@ in
   sssd-ldap = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./sssd-ldap.nix { };
   stalwart-mail = handleTest ./stalwart-mail.nix { };
   stargazer = runTest ./web-servers/stargazer.nix;
-  starship = handleTest ./starship.nix { };
+  starship = runTest ./starship.nix;
   stash = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./stash.nix { };
   static-web-server = handleTest ./web-servers/static-web-server.nix { };
   step-ca = handleTestOn [ "x86_64-linux" ] ./step-ca.nix { };
@@ -1350,7 +1351,7 @@ in
   tuptime = handleTest ./tuptime.nix { };
   turbovnc-headless-server = handleTest ./turbovnc-headless-server.nix { };
   turn-rs = handleTest ./turn-rs.nix { };
-  tuxguitar = handleTest ./tuxguitar.nix { };
+  tuxguitar = runTest ./tuxguitar.nix;
   twingate = runTest ./twingate.nix;
   typesense = handleTest ./typesense.nix { };
   ucarp = handleTest ./ucarp.nix { };

nixos/tests/bind.nix

@@ -1,4 +1,5 @@
-import ./make-test-python.nix {
+{ ... }:
+{
   name = "bind";
 
   nodes.machine =

nixos/tests/cgit.nix

@@ -1,113 +1,111 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  let
-    robotsTxt = pkgs.writeText "cgit-robots.txt" ''
-      User-agent: *
-      Disallow: /
-    '';
-  in
-  {
-    name = "cgit";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ schnusch ];
-    };
+{ pkgs, ... }:
+let
+  robotsTxt = pkgs.writeText "cgit-robots.txt" ''
+    User-agent: *
+    Disallow: /
+  '';
+in
+{
+  name = "cgit";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ schnusch ];
+  };
 
-    nodes = {
-      server =
-        { ... }:
-        {
-          services.cgit."localhost" = {
-            enable = true;
-            package = pkgs.cgit.overrideAttrs (
-              { postInstall, ... }:
-              {
-                postInstall = ''
-                  ${postInstall}
-                  cp ${robotsTxt} "$out/cgit/robots.txt"
-                '';
-              }
-            );
-            nginx.location = "/(c)git/";
-            repos = {
-              some-repo = {
-                path = "/tmp/git/some-repo";
-                desc = "some-repo description";
-              };
-            };
-            settings = {
-              readme = [
-                ":README.md"
-                ":date.txt"
-              ];
+  nodes = {
+    server =
+      { ... }:
+      {
+        services.cgit."localhost" = {
+          enable = true;
+          package = pkgs.cgit.overrideAttrs (
+            { postInstall, ... }:
+            {
+              postInstall = ''
+                ${postInstall}
+                cp ${robotsTxt} "$out/cgit/robots.txt"
+              '';
+            }
+          );
+          nginx.location = "/(c)git/";
+          repos = {
+            some-repo = {
+              path = "/tmp/git/some-repo";
+              desc = "some-repo description";
             };
           };
-
-          environment.systemPackages = [ pkgs.git ];
+          settings = {
+            readme = [
+              ":README.md"
+              ":date.txt"
+            ];
+          };
         };
-    };
 
-    testScript =
-      { nodes, ... }:
-      ''
-        start_all()
+        environment.systemPackages = [ pkgs.git ];
+      };
+  };
 
-        server.wait_for_unit("nginx.service")
-        server.wait_for_unit("network.target")
-        server.wait_for_open_port(80)
+  testScript =
+    { nodes, ... }:
+    ''
+      start_all()
 
-        server.succeed("curl -fsS http://localhost/%28c%29git/cgit.css")
+      server.wait_for_unit("nginx.service")
+      server.wait_for_unit("network.target")
+      server.wait_for_open_port(80)
 
-        server.succeed("curl -fsS http://localhost/%28c%29git/robots.txt | diff -u - ${robotsTxt}")
+      server.succeed("curl -fsS http://localhost/%28c%29git/cgit.css")
 
-        server.succeed(
-            "curl -fsS http://localhost/%28c%29git/ | grep -F 'some-repo description'"
-        )
+      server.succeed("curl -fsS http://localhost/%28c%29git/robots.txt | diff -u - ${robotsTxt}")
 
-        server.fail("curl -fsS http://localhost/robots.txt")
+      server.succeed(
+          "curl -fsS http://localhost/%28c%29git/ | grep -F 'some-repo description'"
+      )
 
-        server.succeed("sudo -u cgit ${pkgs.writeShellScript "setup-cgit-test-repo" ''
-          set -e
-          git init --bare -b master /tmp/git/some-repo
-          git init -b master reference
-          cd reference
-          git remote add origin /tmp/git/some-repo
-          { echo -n "cgit NixOS Test at "; date; } > date.txt
-          git add date.txt
-          git -c user.name=test -c user.email=test@localhost commit -m 'add date'
-          git push -u origin master
-        ''}")
+      server.fail("curl -fsS http://localhost/robots.txt")
 
-        # test web download
-        server.succeed(
-            "curl -fsS 'http://localhost/%28c%29git/some-repo/plain/date.txt?id=master' | diff -u reference/date.txt -"
-        )
+      server.succeed("sudo -u cgit ${pkgs.writeShellScript "setup-cgit-test-repo" ''
+        set -e
+        git init --bare -b master /tmp/git/some-repo
+        git init -b master reference
+        cd reference
+        git remote add origin /tmp/git/some-repo
+        { echo -n "cgit NixOS Test at "; date; } > date.txt
+        git add date.txt
+        git -c user.name=test -c user.email=test@localhost commit -m 'add date'
+        git push -u origin master
+      ''}")
 
-        # test http clone
-        server.succeed(
-           "git clone http://localhost/%28c%29git/some-repo && diff -u reference/date.txt some-repo/date.txt"
-        )
+      # test web download
+      server.succeed(
+          "curl -fsS 'http://localhost/%28c%29git/some-repo/plain/date.txt?id=master' | diff -u reference/date.txt -"
+      )
 
-        # test list settings by greping for the fallback readme
-        server.succeed(
-            "curl -fsS 'http://localhost/%28c%29git/some-repo/about/' | grep -F 'cgit NixOS Test at'"
-        )
+      # test http clone
+      server.succeed(
+         "git clone http://localhost/%28c%29git/some-repo && diff -u reference/date.txt some-repo/date.txt"
+      )
 
-        # add real readme
-        server.succeed("sudo -u cgit ${pkgs.writeShellScript "cgit-commit-readme" ''
-          set -e
-          echo '# cgit NixOS test README' > reference/README.md
-          git -C reference add README.md
-          git -C reference -c user.name=test -c user.email=test@localhost commit -m 'add readme'
-          git -C reference push
-        ''}")
+      # test list settings by greping for the fallback readme
+      server.succeed(
+          "curl -fsS 'http://localhost/%28c%29git/some-repo/about/' | grep -F 'cgit NixOS Test at'"
+      )
 
-        # test list settings by greping for the real readme
-        server.succeed(
-            "curl -fsS 'http://localhost/%28c%29git/some-repo/about/' | grep -F '# cgit NixOS test README'"
-        )
-        server.fail(
-            "curl -fsS 'http://localhost/%28c%29git/some-repo/about/' | grep -F 'cgit NixOS Test at'"
-        )
-      '';
-  }
-)
+      # add real readme
+      server.succeed("sudo -u cgit ${pkgs.writeShellScript "cgit-commit-readme" ''
+        set -e
+        echo '# cgit NixOS test README' > reference/README.md
+        git -C reference add README.md
+        git -C reference -c user.name=test -c user.email=test@localhost commit -m 'add readme'
+        git -C reference push
+      ''}")
+
+      # test list settings by greping for the real readme
+      server.succeed(
+          "curl -fsS 'http://localhost/%28c%29git/some-repo/about/' | grep -F '# cgit NixOS test README'"
+      )
+      server.fail(
+          "curl -fsS 'http://localhost/%28c%29git/some-repo/about/' | grep -F 'cgit NixOS Test at'"
+      )
+    '';
+}

nixos/tests/homepage-dashboard.nix

@@ -1,28 +1,26 @@
-import ./make-test-python.nix (
-  { lib, ... }:
-  {
-    name = "homepage-dashboard";
-    meta.maintainers = with lib.maintainers; [ jnsgruk ];
+{ lib, ... }:
+{
+  name = "homepage-dashboard";
+  meta.maintainers = with lib.maintainers; [ jnsgruk ];
 
-    nodes.machine = _: {
-      services.homepage-dashboard = {
-        enable = true;
-        settings.title = "test title rodUsEagid"; # something random/unique
-      };
+  nodes.machine = _: {
+    services.homepage-dashboard = {
+      enable = true;
+      settings.title = "test title rodUsEagid"; # something random/unique
     };
+  };
 
-    testScript = ''
-      # Ensure the services are started on managed machine
-      machine.wait_for_unit("homepage-dashboard.service")
-      machine.wait_for_open_port(8082)
-      machine.succeed("curl --fail http://localhost:8082/")
+  testScript = ''
+    # Ensure the services are started on managed machine
+    machine.wait_for_unit("homepage-dashboard.service")
+    machine.wait_for_open_port(8082)
+    machine.succeed("curl --fail http://localhost:8082/")
 
-      # Ensure /etc/homepage-dashboard is created.
-      machine.succeed("test -d /etc/homepage-dashboard")
+    # Ensure /etc/homepage-dashboard is created.
+    machine.succeed("test -d /etc/homepage-dashboard")
 
-      # Ensure that we see the custom title *only in the managed config*
-      page = machine.succeed("curl --fail http://localhost:8082/")
-      assert "test title rodUsEagid" in page, "Custom title not found"
-    '';
-  }
-)
+    # Ensure that we see the custom title *only in the managed config*
+    page = machine.succeed("curl --fail http://localhost:8082/")
+    assert "test title rodUsEagid" in page, "Custom title not found"
+  '';
+}

nixos/tests/incus/ui.nix

@@ -66,6 +66,7 @@ import ../make-test-python.nix (
 
     testScript = ''
       machine.wait_for_unit("incus.service")
+      machine.wait_for_unit("incus-preseed.service")
 
       # Check that the INCUS_UI environment variable is populated in the systemd unit
       machine.succeed("systemctl cat incus.service | grep 'INCUS_UI'")
@@ -73,6 +74,9 @@ import ../make-test-python.nix (
       # Ensure the endpoint returns an HTML page with 'Incus UI' in the title
       machine.succeed("curl -kLs https://localhost:8443/ui | grep '<title>Incus UI</title>'")
 
+      # Ensure the documentation is rendering correctly
+      machine.succeed("curl -kLs https://localhost:8443/documentation/ | grep '<title>Incus documentation</title>'")
+
       # Ensure the application is actually rendered by the Javascript
       machine.succeed("PYTHONUNBUFFERED=1 selenium-script")
     '';

nixos/tests/installer.nix

@@ -638,6 +638,7 @@ let
       clevisTest ? false,
       clevisFallbackTest ? false,
       disableFileSystems ? false,
+      selectNixPackage ? pkgs: pkgs.nixStable,
     }:
     let
       isEfi = bootLoader == "systemd-boot" || (bootLoader == "grub" && grubUseEfi);
@@ -701,6 +702,7 @@ let
             virtualisation.rootDevice = "/dev/vdb";
 
             hardware.enableAllFirmware = mkForce false;
+            nix.package = selectNixPackage pkgs;
 
             # The test cannot access the network, so any packages we
             # need must be included in the VM.
@@ -1101,6 +1103,9 @@ in
   # The (almost) simplest partitioning scheme: a swap partition and
   # one big filesystem partition.
   simple = makeInstallerTest "simple" simple-test-config;
+  lix-simple = makeInstallerTest "simple" simple-test-config // {
+    selectNixPackage = pkgs: pkgs.lix;
+  };
 
   switchToFlake = makeInstallerTest "switch-to-flake" simple-test-config-flake;
 

nixos/tests/librenms.nix

@@ -1,106 +1,104 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
+{ pkgs, lib, ... }:
 
-  let
-    api_token = "f87f42114e44b63ad1b9e3c3d33d6fbe"; # random md5 hash
-    wrong_api_token = "e68ba041fcf1eab923a7a6de3af5f726"; # another random md5 hash
-  in
-  {
-    name = "librenms";
-    meta.maintainers = lib.teams.wdz.members;
+let
+  api_token = "f87f42114e44b63ad1b9e3c3d33d6fbe"; # random md5 hash
+  wrong_api_token = "e68ba041fcf1eab923a7a6de3af5f726"; # another random md5 hash
+in
+{
+  name = "librenms";
+  meta.maintainers = lib.teams.wdz.members;
 
-    nodes.librenms = {
-      time.timeZone = "Europe/Berlin";
+  nodes.librenms = {
+    time.timeZone = "Europe/Berlin";
 
-      environment.systemPackages = with pkgs; [
-        curl
-        jq
-      ];
+    environment.systemPackages = with pkgs; [
+      curl
+      jq
+    ];
 
-      services.librenms = {
-        enable = true;
-        hostname = "librenms";
-        database = {
-          createLocally = true;
-          host = "localhost";
-          database = "librenms";
-          username = "librenms";
-          passwordFile = pkgs.writeText "librenms-db-pass" "librenmsdbpass";
-        };
-        nginx = {
-          default = true;
-        };
-        enableOneMinutePolling = true;
-        settings = {
-          enable_billing = true;
-        };
+    services.librenms = {
+      enable = true;
+      hostname = "librenms";
+      database = {
+        createLocally = true;
+        host = "localhost";
+        database = "librenms";
+        username = "librenms";
+        passwordFile = pkgs.writeText "librenms-db-pass" "librenmsdbpass";
       };
-
-      # systemd oneshot to create a dummy admin user and a API token for testing
-      systemd.services.lnms-api-init = {
-        description = "LibreNMS API init";
-        after = [ "librenms-setup.service" ];
-        wantedBy = [ "multi-user.target" ];
-        serviceConfig = {
-          Type = "oneshot";
-          RemainAfterExit = true;
-          User = "root";
-          Group = "root";
-        };
-        script = ''
-          API_USER_NAME=api
-          API_TOKEN=${api_token} # random md5 hash
-
-          # seeding database to get the admin roles
-          ${pkgs.librenms}/artisan db:seed --force --no-interaction
-
-          # we don't need to know the password, it just has to exist
-          API_USER_PASS=$(${pkgs.pwgen}/bin/pwgen -s 64 1)
-          ${pkgs.librenms}/artisan user:add $API_USER_NAME -r admin -p $API_USER_PASS
-          API_USER_ID=$(${pkgs.mariadb}/bin/mysql -D librenms -N -B -e "SELECT user_id FROM users WHERE username = '$API_USER_NAME';")
-
-          ${pkgs.mariadb}/bin/mysql -D librenms -e "INSERT INTO api_tokens (user_id, token_hash, description) VALUES ($API_USER_ID, '$API_TOKEN', 'API User')"
-        '';
+      nginx = {
+        default = true;
+      };
+      enableOneMinutePolling = true;
+      settings = {
+        enable_billing = true;
       };
     };
 
-    nodes.snmphost = {
-
-      services.snmpd = {
-        enable = true;
-        openFirewall = true;
-
-        configText = ''
-          com2sec readonly default public
-
-          group MyROGroup v2c        readonly
-          view all    included  .1                               80
-          access MyROGroup ""      any       noauth    exact  all    none   none
-
-          syslocation Testcity, Testcountry
-          syscontact Testi mc Test <test@example.com>
-        '';
-
+    # systemd oneshot to create a dummy admin user and a API token for testing
+    systemd.services.lnms-api-init = {
+      description = "LibreNMS API init";
+      after = [ "librenms-setup.service" ];
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        Type = "oneshot";
+        RemainAfterExit = true;
+        User = "root";
+        Group = "root";
       };
+      script = ''
+        API_USER_NAME=api
+        API_TOKEN=${api_token} # random md5 hash
+
+        # seeding database to get the admin roles
+        ${pkgs.librenms}/artisan db:seed --force --no-interaction
+
+        # we don't need to know the password, it just has to exist
+        API_USER_PASS=$(${pkgs.pwgen}/bin/pwgen -s 64 1)
+        ${pkgs.librenms}/artisan user:add $API_USER_NAME -r admin -p $API_USER_PASS
+        API_USER_ID=$(${pkgs.mariadb}/bin/mysql -D librenms -N -B -e "SELECT user_id FROM users WHERE username = '$API_USER_NAME';")
+
+        ${pkgs.mariadb}/bin/mysql -D librenms -e "INSERT INTO api_tokens (user_id, token_hash, description) VALUES ($API_USER_ID, '$API_TOKEN', 'API User')"
+      '';
     };
+  };
 
-    testScript = ''
-      start_all()
+  nodes.snmphost = {
 
-      snmphost.wait_for_unit("snmpd.service")
+    services.snmpd = {
+      enable = true;
+      openFirewall = true;
 
-      librenms.wait_for_unit("lnms-api-init.service")
-      librenms.wait_for_open_port(80)
+      configText = ''
+        com2sec readonly default public
 
-      # Test that we can authenticate against the API
-      librenms.succeed("curl --fail -H 'X-Auth-Token: ${api_token}' http://localhost/api/v0")
-      librenms.fail("curl --fail -H 'X-Auth-Token: ${wrong_api_token}' http://localhost/api/v0")
+        group MyROGroup v2c        readonly
+        view all    included  .1                               80
+        access MyROGroup ""      any       noauth    exact  all    none   none
 
-      # add snmphost as a device
-      librenms.succeed("curl --fail -X POST -d '{\"hostname\":\"snmphost\",\"version\":\"v2c\",\"community\":\"public\"}' -H 'X-Auth-Token: ${api_token}' http://localhost/api/v0/devices")
+        syslocation Testcity, Testcountry
+        syscontact Testi mc Test <test@example.com>
+      '';
 
-      # wait until snmphost gets polled
-      librenms.wait_until_succeeds("test $(curl -H 'X-Auth-Token: ${api_token}' http://localhost/api/v0/devices/snmphost | jq -Mr .devices[0].last_polled) != 'null'")
-    '';
-  }
-)
+    };
+  };
+
+  testScript = ''
+    start_all()
+
+    snmphost.wait_for_unit("snmpd.service")
+
+    librenms.wait_for_unit("lnms-api-init.service")
+    librenms.wait_for_open_port(80)
+
+    # Test that we can authenticate against the API
+    librenms.succeed("curl --fail -H 'X-Auth-Token: ${api_token}' http://localhost/api/v0")
+    librenms.fail("curl --fail -H 'X-Auth-Token: ${wrong_api_token}' http://localhost/api/v0")
+
+    # add snmphost as a device
+    librenms.succeed("curl --fail -X POST -d '{\"hostname\":\"snmphost\",\"version\":\"v2c\",\"community\":\"public\"}' -H 'X-Auth-Token: ${api_token}' http://localhost/api/v0/devices")
+
+    # wait until snmphost gets polled
+    librenms.wait_until_succeeds("test $(curl -H 'X-Auth-Token: ${api_token}' http://localhost/api/v0/devices/snmphost | jq -Mr .devices[0].last_polled) != 'null'")
+  '';
+}

nixos/tests/lighttpd.nix

@@ -1,25 +1,23 @@
-import ./make-test-python.nix (
-  { lib, pkgs, ... }:
-  {
-    name = "lighttpd";
-    meta.maintainers = with lib.maintainers; [ bjornfor ];
+{ lib, pkgs, ... }:
+{
+  name = "lighttpd";
+  meta.maintainers = with lib.maintainers; [ bjornfor ];
 
-    nodes = {
-      server = {
-        services.lighttpd.enable = true;
-        services.lighttpd.document-root = pkgs.runCommand "document-root" { } ''
-          mkdir -p "$out"
-          echo "hello nixos test" > "$out/file.txt"
-        '';
-      };
+  nodes = {
+    server = {
+      services.lighttpd.enable = true;
+      services.lighttpd.document-root = pkgs.runCommand "document-root" { } ''
+        mkdir -p "$out"
+        echo "hello nixos test" > "$out/file.txt"
+      '';
     };
+  };
 
-    testScript = ''
-      start_all()
-      server.wait_for_unit("lighttpd.service")
-      res = server.succeed("curl --fail http://localhost/file.txt")
-      assert "hello nixos test" in res, f"bad server response: '{res}'"
-      server.succeed("systemctl reload lighttpd")
-    '';
-  }
-)
+  testScript = ''
+    start_all()
+    server.wait_for_unit("lighttpd.service")
+    res = server.succeed("curl --fail http://localhost/file.txt")
+    assert "hello nixos test" in res, f"bad server response: '{res}'"
+    server.succeed("systemctl reload lighttpd")
+  '';
+}

nixos/tests/moodle.nix

@@ -1,26 +1,24 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "moodle";
-    meta.maintainers = [ lib.maintainers.aanderse ];
+{ lib, ... }:
+{
+  name = "moodle";
+  meta.maintainers = [ lib.maintainers.aanderse ];
 
-    nodes.machine =
-      { ... }:
-      {
-        services.moodle.enable = true;
-        services.moodle.virtualHost.hostName = "localhost";
-        services.moodle.virtualHost.adminAddr = "root@example.com";
-        services.moodle.initialPassword = "correcthorsebatterystaple";
+  nodes.machine =
+    { ... }:
+    {
+      services.moodle.enable = true;
+      services.moodle.virtualHost.hostName = "localhost";
+      services.moodle.virtualHost.adminAddr = "root@example.com";
+      services.moodle.initialPassword = "correcthorsebatterystaple";
 
-        # Ensure the virtual machine has enough memory to avoid errors like:
-        # Fatal error: Out of memory (allocated 152047616) (tried to allocate 33554440 bytes)
-        virtualisation.memorySize = 2000;
-      };
+      # Ensure the virtual machine has enough memory to avoid errors like:
+      # Fatal error: Out of memory (allocated 152047616) (tried to allocate 33554440 bytes)
+      virtualisation.memorySize = 2000;
+    };
 
-    testScript = ''
-      start_all()
-      machine.wait_for_unit("phpfpm-moodle.service", timeout=1800)
-      machine.wait_until_succeeds("curl http://localhost/ | grep 'You are not logged in'")
-    '';
-  }
-)
+  testScript = ''
+    start_all()
+    machine.wait_for_unit("phpfpm-moodle.service", timeout=1800)
+    machine.wait_until_succeeds("curl http://localhost/ | grep 'You are not logged in'")
+  '';
+}

nixos/tests/paretosecurity.nix

@@ -29,6 +29,8 @@
         package = patchedPareto;
       };
 
+      networking.firewall.enable = true;
+
     };
 
   nodes.dashboard =
@@ -64,6 +66,12 @@
       services.displayManager.autoLogin = {
         enable = true;
         user = "alice";
+
+      };
+
+      virtualisation.resolution = {
+        x = 640;
+        y = 480;
       };
 
       environment.systemPackages = [ pkgs.xdotool ];
@@ -94,7 +102,6 @@
       + " --skip 21830a4e-84f1-48fe-9c5b-beab436b2cdb"  # Disk encryption
       + " --skip 44e4754a-0b42-4964-9cc2-b88b2023cb1e"  # Pareto Security is up to date
       + " --skip f962c423-fdf5-428a-a57a-827abc9b253e"  # Password manager installed
-      + " --skip 2e46c89a-5461-4865-a92e-3b799c12034a"  # Firewall is enabled
       + "'"
     )
 
@@ -117,7 +124,7 @@
     ]:
         status, out = xfce.systemctl("is-enabled " + unit, "alice")
         assert status == 0, f"Unit {unit} is not enabled (status: {status}): {out}"
-    xfce.succeed("xdotool mousemove 850 10")
+    xfce.succeed("xdotool mousemove 460 10")
     xfce.wait_for_text("Pareto Security")
     xfce.succeed("xdotool click 1")
     xfce.wait_for_text("Run Checks")

nixos/tests/pocket-id.nix

@@ -0,0 +1,47 @@
+import ./make-test-python.nix (
+  { lib, ... }:
+
+  {
+    name = "pocket-id";
+    meta.maintainers = with lib.maintainers; [
+      gepbird
+      ymstnt
+    ];
+
+    nodes = {
+      machine =
+        { ... }:
+        {
+          services.pocket-id = {
+            enable = true;
+            settings = {
+              PORT = 10001;
+              INTERNAL_BACKEND_URL = "http://localhost:10002";
+              BACKEND_PORT = 10002;
+            };
+          };
+        };
+    };
+
+    testScript =
+      { nodes, ... }:
+      let
+        inherit (nodes.machine.services.pocket-id) settings;
+        inherit (builtins) toString;
+      in
+      ''
+        machine.wait_for_unit("pocket-id-backend.service")
+        machine.wait_for_open_port(${toString settings.BACKEND_PORT})
+        machine.wait_for_unit("pocket-id-frontend.service")
+        machine.wait_for_open_port(${toString settings.PORT})
+
+        backend_status = machine.succeed("curl -L -o /tmp/backend-output -w '%{http_code}' http://localhost:${toString settings.BACKEND_PORT}/api/users/me")
+        assert backend_status == "401"
+        machine.succeed("grep 'You are not signed in' /tmp/backend-output")
+
+        frontend_status = machine.succeed("curl -L -o /tmp/frontend-output -w '%{http_code}' http://localhost:${toString settings.PORT}")
+        assert frontend_status == "200"
+        machine.succeed("grep 'Sign in to Pocket ID' /tmp/frontend-output")
+      '';
+  }
+)

nixos/tests/starship.nix

@@ -1,53 +1,51 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "starship";
-    meta.maintainers = pkgs.starship.meta.maintainers;
+{ pkgs, ... }:
+{
+  name = "starship";
+  meta.maintainers = pkgs.starship.meta.maintainers;
 
-    nodes.machine = {
-      programs = {
-        fish.enable = true;
-        zsh.enable = true;
+  nodes.machine = {
+    programs = {
+      fish.enable = true;
+      zsh.enable = true;
 
-        starship = {
-          enable = true;
-          settings.format = "<starship>";
-        };
+      starship = {
+        enable = true;
+        settings.format = "<starship>";
       };
-
-      environment.systemPackages =
-        map
-          (
-            shell:
-            pkgs.writeScriptBin "expect-${shell}" ''
-              #!${pkgs.expect}/bin/expect -f
-
-              spawn env TERM=xterm ${shell} -i
-
-              expect "<starship>" {
-                send "exit\n"
-              } timeout {
-                send_user "\n${shell} failed to display Starship\n"
-                exit 1
-              }
-
-              expect eof
-            ''
-          )
-          [
-            "bash"
-            "fish"
-            "zsh"
-          ];
     };
 
-    testScript = ''
-      start_all()
-      machine.wait_for_unit("default.target")
+    environment.systemPackages =
+      map
+        (
+          shell:
+          pkgs.writeScriptBin "expect-${shell}" ''
+            #!${pkgs.expect}/bin/expect -f
 
-      machine.succeed("expect-bash")
-      machine.succeed("expect-fish")
-      machine.succeed("expect-zsh")
-    '';
-  }
-)
+            spawn env TERM=xterm ${shell} -i
+
+            expect "<starship>" {
+              send "exit\n"
+            } timeout {
+              send_user "\n${shell} failed to display Starship\n"
+              exit 1
+            }
+
+            expect eof
+          ''
+        )
+        [
+          "bash"
+          "fish"
+          "zsh"
+        ];
+  };
+
+  testScript = ''
+    start_all()
+    machine.wait_for_unit("default.target")
+
+    machine.succeed("expect-bash")
+    machine.succeed("expect-fish")
+    machine.succeed("expect-zsh")
+  '';
+}

nixos/tests/tuxguitar.nix

@@ -1,29 +1,25 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "tuxguitar";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ ];
+{ ... }:
+{
+  name = "tuxguitar";
+  meta.maintainers = [ ];
+
+  nodes.machine =
+    { config, pkgs, ... }:
+    {
+      imports = [
+        ./common/x11.nix
+      ];
+
+      services.xserver.enable = true;
+
+      environment.systemPackages = [ pkgs.tuxguitar ];
     };
 
-    nodes.machine =
-      { config, pkgs, ... }:
-      {
-        imports = [
-          ./common/x11.nix
-        ];
-
-        services.xserver.enable = true;
-
-        environment.systemPackages = [ pkgs.tuxguitar ];
-      };
-
-    testScript = ''
-      machine.wait_for_x()
-      machine.succeed("tuxguitar >&2 &")
-      machine.wait_for_window("TuxGuitar - Untitled.tg")
-      machine.sleep(1)
-      machine.screenshot("tuxguitar")
-    '';
-  }
-)
+  testScript = ''
+    machine.wait_for_x()
+    machine.succeed("tuxguitar >&2 &")
+    machine.wait_for_window("TuxGuitar - Untitled.tg")
+    machine.sleep(1)
+    machine.screenshot("tuxguitar")
+  '';
+}

pkgs/applications/audio/munt/libmt32emu.nix

@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libmt32emu";
-  version = "2.7.1";
+  version = "2.7.2";
 
   src = fetchFromGitHub {
     owner = "munt";
     repo = "munt";
     rev = "${pname}_${lib.replaceStrings [ "." ] [ "_" ] version}";
-    sha256 = "sha256-zY1AFcm8uvFkrKUZHsqtKY2CYTY4bWmkTJ7bZPqXoxk=";
+    sha256 = "sha256-wXIvdGoup/AOQggkeXvtbi3pXhyKUKWmyt/ZbGzufds=";
   };
 
   outputs = [

pkgs/applications/editors/emacs/elisp-packages/elpa-generated.nix

@@ -1462,10 +1462,10 @@
     elpaBuild {
       pname = "compat";
       ename = "compat";
-      version = "30.0.2.0";
+      version = "30.1.0.0";
       src = fetchurl {
-        url = "https://elpa.gnu.org/packages/compat-30.0.2.0.tar";
-        sha256 = "0pizq8vwfqls04in95rpnfwv4xc1r2qjpf41g6bjy826i53cfdx0";
+        url = "https://elpa.gnu.org/packages/compat-30.1.0.0.tar";
+        sha256 = "1wmq4sj3kkb4shvsi8djrk9znjxj20lm4v389jyn18q55gqigq6b";
       };
       packageRequires = [ seq ];
       meta = {
@@ -1526,10 +1526,10 @@
     elpaBuild {
       pname = "consult";
       ename = "consult";
-      version = "2.1";
+      version = "2.2";
       src = fetchurl {
-        url = "https://elpa.gnu.org/packages/consult-2.1.tar";
-        sha256 = "0w88gpgkqjmllypckrkc54gm42yjsfjp4mj9q9pii8qir49sh8ls";
+        url = "https://elpa.gnu.org/packages/consult-2.2.tar";
+        sha256 = "082n0a27jpdz4z8g46m0c35s6xhca5s042wbzvrvh9hhd3mz64b7";
       };
       packageRequires = [ compat ];
       meta = {
@@ -1639,10 +1639,10 @@
     elpaBuild {
       pname = "corfu";
       ename = "corfu";
-      version = "1.7";
+      version = "2.0";
       src = fetchurl {
-        url = "https://elpa.gnu.org/packages/corfu-1.7.tar";
-        sha256 = "1jd6vrbsr5h1j8lsvdkhb1z3nrh1m11fi1hcvhh6nbhqnidwsrii";
+        url = "https://elpa.gnu.org/packages/corfu-2.0.tar";
+        sha256 = "0qih9km4l7i6isaskap9knqhqnjc85qlr2wrrik5cc8yl6yrc36g";
       };
       packageRequires = [ compat ];
       meta = {
@@ -1684,10 +1684,10 @@
     elpaBuild {
       pname = "counsel";
       ename = "counsel";
-      version = "0.15.0";
+      version = "0.15.1";
       src = fetchurl {
-        url = "https://elpa.gnu.org/packages/counsel-0.15.0.tar";
-        sha256 = "1mw13iw7ygnigjarcfg7lazrdwk7l17clxs2igf75kdkk4l4jgb4";
+        url = "https://elpa.gnu.org/packages/counsel-0.15.1.tar";
+        sha256 = "1sgaph2wb4mkxlfq6448i1kymaxhs7h37nrn7vzbp9fhik634rhc";
       };
       packageRequires = [
         ivy
@@ -2045,6 +2045,50 @@
       };
     }
   ) { };
+  denote-journal = callPackage (
+    {
+      denote,
+      elpaBuild,
+      fetchurl,
+      lib,
+    }:
+    elpaBuild {
+      pname = "denote-journal";
+      ename = "denote-journal";
+      version = "0.0.0.1";
+      src = fetchurl {
+        url = "https://elpa.gnu.org/packages/denote-journal-0.0.0.1.tar";
+        sha256 = "07xb58jqkh0nwzc8l8k1cvqdlkm7iyb3ajjndkz6kvg7vhxiaaqi";
+      };
+      packageRequires = [ denote ];
+      meta = {
+        homepage = "https://elpa.gnu.org/packages/denote-journal.html";
+        license = lib.licenses.free;
+      };
+    }
+  ) { };
+  denote-markdown = callPackage (
+    {
+      denote,
+      elpaBuild,
+      fetchurl,
+      lib,
+    }:
+    elpaBuild {
+      pname = "denote-markdown";
+      ename = "denote-markdown";
+      version = "0.0.0.1";
+      src = fetchurl {
+        url = "https://elpa.gnu.org/packages/denote-markdown-0.0.0.1.tar";
+        sha256 = "1sn3h6jjclqwda5hch8c23s485w9sra2m3lqz9qcsjdcmb85cxk1";
+      };
+      packageRequires = [ denote ];
+      meta = {
+        homepage = "https://elpa.gnu.org/packages/denote-markdown.html";
+        license = lib.licenses.free;
+      };
+    }
+  ) { };
   denote-menu = callPackage (
     {
       denote,
@@ -2055,10 +2099,10 @@
     elpaBuild {
       pname = "denote-menu";
       ename = "denote-menu";
-      version = "1.3.0";
+      version = "1.4.0";
       src = fetchurl {
-        url = "https://elpa.gnu.org/packages/denote-menu-1.3.0.tar";
-        sha256 = "0flkb3f1zpp3sbjx6h7qb6fnjgg44s53zkv3q3fj6cl7c0f11n02";
+        url = "https://elpa.gnu.org/packages/denote-menu-1.4.0.tar";
+        sha256 = "1lw8fyf749wmkrcn8ixvrias1a84wcgy9snlmlk0w2h02dqapazi";
       };
       packageRequires = [ denote ];
       meta = {
@@ -2067,6 +2111,28 @@
       };
     }
   ) { };
+  denote-org = callPackage (
+    {
+      denote,
+      elpaBuild,
+      fetchurl,
+      lib,
+    }:
+    elpaBuild {
+      pname = "denote-org";
+      ename = "denote-org";
+      version = "0.0.0.1";
+      src = fetchurl {
+        url = "https://elpa.gnu.org/packages/denote-org-0.0.0.1.tar";
+        sha256 = "0mipl5b728qwxwskc28jrvxjf1n5x25gggsrfx8qmdz5z4p0dglr";
+      };
+      packageRequires = [ denote ];
+      meta = {
+        homepage = "https://elpa.gnu.org/packages/denote-org.html";
+        license = lib.licenses.free;
+      };
+    }
+  ) { };
   denote-search = callPackage (
     {
       denote,
@@ -2089,6 +2155,50 @@
       };
     }
   ) { };
+  denote-sequence = callPackage (
+    {
+      denote,
+      elpaBuild,
+      fetchurl,
+      lib,
+    }:
+    elpaBuild {
+      pname = "denote-sequence";
+      ename = "denote-sequence";
+      version = "0.0.0.1";
+      src = fetchurl {
+        url = "https://elpa.gnu.org/packages/denote-sequence-0.0.0.1.tar";
+        sha256 = "0z947wk5n2ign2d36b1ahdldr99ir7cmvdhmq4i5dv2kwj36ga1n";
+      };
+      packageRequires = [ denote ];
+      meta = {
+        homepage = "https://elpa.gnu.org/packages/denote-sequence.html";
+        license = lib.licenses.free;
+      };
+    }
+  ) { };
+  denote-silo = callPackage (
+    {
+      denote,
+      elpaBuild,
+      fetchurl,
+      lib,
+    }:
+    elpaBuild {
+      pname = "denote-silo";
+      ename = "denote-silo";
+      version = "0.0.0.1";
+      src = fetchurl {
+        url = "https://elpa.gnu.org/packages/denote-silo-0.0.0.1.tar";
+        sha256 = "011l6nd7wqjy2zwg0pifi1zqr1diay4i170binl78wv4bxd5z0ln";
+      };
+      packageRequires = [ denote ];
+      meta = {
+        homepage = "https://elpa.gnu.org/packages/denote-silo.html";
+        license = lib.licenses.free;
+      };
+    }
+  ) { };
   detached = callPackage (
     {
       elpaBuild,
@@ -2741,6 +2851,27 @@
       };
     }
   ) { };
+  el-job = callPackage (
+    {
+      elpaBuild,
+      fetchurl,
+      lib,
+    }:
+    elpaBuild {
+      pname = "el-job";
+      ename = "el-job";
+      version = "2.4.3";
+      src = fetchurl {
+        url = "https://elpa.gnu.org/packages/el-job-2.4.3.tar";
+        sha256 = "1iqbs2f71a0mmrmfr2l6dwr6l5h1399z14jv8zfl5zh8h75sm9pm";
+      };
+      packageRequires = [ ];
+      meta = {
+        homepage = "https://elpa.gnu.org/packages/el-job.html";
+        license = lib.licenses.free;
+      };
+    }
+  ) { };
   el-search = callPackage (
     {
       cl-print ? null,
@@ -2873,10 +3004,10 @@
     elpaBuild {
       pname = "ellama";
       ename = "ellama";
-      version = "1.5.4";
+      version = "1.8.1";
       src = fetchurl {
-        url = "https://elpa.gnu.org/packages/ellama-1.5.4.tar";
-        sha256 = "0kf25znwzc9mdy2adhramzcr30y9f8qa1q9s0swbsa4ilja7ks7w";
+        url = "https://elpa.gnu.org/packages/ellama-1.8.1.tar";
+        sha256 = "19n8zcgls4jiz7hacj564gb9y0sxdli2yl4j4d35c44pq52g2y6v";
       };
       packageRequires = [
         compat
@@ -3009,10 +3140,10 @@
     elpaBuild {
       pname = "emms";
       ename = "emms";
-      version = "21";
+      version = "22";
       src = fetchurl {
-        url = "https://elpa.gnu.org/packages/emms-21.tar";
-        sha256 = "188rij39qqaya7hk0p05ygcw5vlha7qd6pm4ws6nfw7g0nv1rbcc";
+        url = "https://elpa.gnu.org/packages/emms-22.tar";
+        sha256 = "0jn8si9m8pxd7ni543p8z697297i9dva319dw141zwpbxqhmyvpi";
       };
       packageRequires = [
         cl-lib
@@ -3433,6 +3564,27 @@
       };
     }
   ) { };
+  flymake-clippy = callPackage (
+    {
+      elpaBuild,
+      fetchurl,
+      lib,
+    }:
+    elpaBuild {
+      pname = "flymake-clippy";
+      ename = "flymake-clippy";
+      version = "1.1.0";
+      src = fetchurl {
+        url = "https://elpa.gnu.org/packages/flymake-clippy-1.1.0.tar";
+        sha256 = "1sij8qn7q9jvjnnnqqm152hnvkw079m66pwjyhvsqdqivqjvlnrd";
+      };
+      packageRequires = [ ];
+      meta = {
+        homepage = "https://elpa.gnu.org/packages/flymake-clippy.html";
+        license = lib.licenses.free;
+      };
+    }
+  ) { };
   flymake-codespell = callPackage (
     {
       compat,
@@ -3725,10 +3877,10 @@
     elpaBuild {
       pname = "gnome-dark-style";
       ename = "gnome-dark-style";
-      version = "0.2.2";
+      version = "0.2.3";
       src = fetchurl {
-        url = "https://elpa.gnu.org/packages/gnome-dark-style-0.2.2.tar";
-        sha256 = "1vf0ka0xg8mvaq3s3b8rgsdv77q7qd73k9mqfvyk7ywhxj7zdb9i";
+        url = "https://elpa.gnu.org/packages/gnome-dark-style-0.2.3.tar";
+        sha256 = "04cp31252svf5pkkkmx9b6nlcv3v4xffn739bna77jjyrw98mhv5";
       };
       packageRequires = [ ];
       meta = {
@@ -4164,6 +4316,28 @@
       };
     }
   ) { };
+  hugoista = callPackage (
+    {
+      elpaBuild,
+      fetchurl,
+      lib,
+      seq,
+    }:
+    elpaBuild {
+      pname = "hugoista";
+      ename = "hugoista";
+      version = "0.2.1";
+      src = fetchurl {
+        url = "https://elpa.gnu.org/packages/hugoista-0.2.1.tar";
+        sha256 = "02rv1r2xr6dhkfqwgbrrsdajxv6inbny5biimkb0qcf3i8b43dih";
+      };
+      packageRequires = [ seq ];
+      meta = {
+        homepage = "https://elpa.gnu.org/packages/hugoista.html";
+        license = lib.licenses.free;
+      };
+    }
+  ) { };
   hydra = callPackage (
     {
       cl-lib ? null,
@@ -4369,10 +4543,10 @@
     elpaBuild {
       pname = "ivy";
       ename = "ivy";
-      version = "0.15.0";
+      version = "0.15.1";
       src = fetchurl {
-        url = "https://elpa.gnu.org/packages/ivy-0.15.0.tar";
-        sha256 = "13kikgvrhi2b6dg0py4n51kc881dv7bll71iaxq1bjlzdwvsn20h";
+        url = "https://elpa.gnu.org/packages/ivy-0.15.1.tar";
+        sha256 = "12ni3n8h7316hv4nrx4kbjah58n8zdxkf1v8fi0w39da1aqn3r0p";
       };
       packageRequires = [ ];
       meta = {
@@ -4392,10 +4566,10 @@
     elpaBuild {
       pname = "ivy-avy";
       ename = "ivy-avy";
-      version = "0.15.0";
+      version = "0.15.1";
       src = fetchurl {
-        url = "https://elpa.gnu.org/packages/ivy-avy-0.15.0.tar";
-        sha256 = "0xqykxvsm7q81744qj4w7ma83v6s9a4wx4flywqch4dn7liaiqwj";
+        url = "https://elpa.gnu.org/packages/ivy-avy-0.15.1.tar";
+        sha256 = "0csysx22sf3bbfh000c2m48rzfn274km0zxbfbcx2871haskwva1";
       };
       packageRequires = [
         avy
@@ -4440,10 +4614,10 @@
     elpaBuild {
       pname = "ivy-hydra";
       ename = "ivy-hydra";
-      version = "0.15.0";
+      version = "0.15.1";
       src = fetchurl {
-        url = "https://elpa.gnu.org/packages/ivy-hydra-0.15.0.tar";
-        sha256 = "1crznifig71l6h4zjsr39d2w02blw7vla1vafv0yhhj6ryd4030g";
+        url = "https://elpa.gnu.org/packages/ivy-hydra-0.15.1.tar";
+        sha256 = "16z3ic50zbx9iaw0w6fv04cxpl6qz81424jdian1br1942pz3kdy";
       };
       packageRequires = [
         hydra
@@ -5027,10 +5201,10 @@
     elpaBuild {
       pname = "llm";
       ename = "llm";
-      version = "0.24.1";
+      version = "0.24.2";
       src = fetchurl {
-        url = "https://elpa.gnu.org/packages/llm-0.24.1.tar";
-        sha256 = "1vy62pg8hdakw0zbyl1fb8bvbhl2w36z683gbhjb71ikl3bqnav8";
+        url = "https://elpa.gnu.org/packages/llm-0.24.2.tar";
+        sha256 = "16d3758k1xc1w8am9yjzmgri2ijw4gpyaxqvsc1db08ravzqnc21";
       };
       packageRequires = [
         plz
@@ -5264,10 +5438,10 @@
     elpaBuild {
       pname = "marginalia";
       ename = "marginalia";
-      version = "1.8";
+      version = "2.0";
       src = fetchurl {
-        url = "https://elpa.gnu.org/packages/marginalia-1.8.tar";
-        sha256 = "0q8mflfsl4vj2r2m47jgm5hrg3a4k5pildb53vlgm5k9wb4sd7md";
+        url = "https://elpa.gnu.org/packages/marginalia-2.0.tar";
+        sha256 = "1qklwzz0swd96vdqymbm91y6h53id6ch1lr1dpdwmz6qknwamrlc";
       };
       packageRequires = [ compat ];
       meta = {
@@ -5530,6 +5704,32 @@
       };
     }
   ) { };
+  minuet = callPackage (
+    {
+      dash,
+      elpaBuild,
+      fetchurl,
+      lib,
+      plz,
+    }:
+    elpaBuild {
+      pname = "minuet";
+      ename = "minuet";
+      version = "0.4.4";
+      src = fetchurl {
+        url = "https://elpa.gnu.org/packages/minuet-0.4.4.tar";
+        sha256 = "0ci47awqky1c28zk3azd4id9wcpd3n9nj5jw5s8ji613kqc1nqs2";
+      };
+      packageRequires = [
+        dash
+        plz
+      ];
+      meta = {
+        homepage = "https://elpa.gnu.org/packages/minuet.html";
+        license = lib.licenses.free;
+      };
+    }
+  ) { };
   mmm-mode = callPackage (
     {
       cl-lib ? null,
@@ -5582,10 +5782,10 @@
     elpaBuild {
       pname = "mpdired";
       ename = "mpdired";
-      version = "2";
+      version = "3";
       src = fetchurl {
-        url = "https://elpa.gnu.org/packages/mpdired-2.tar";
-        sha256 = "0synpanyqka8nyz9mma69na307vm5pjvn21znbdvz56gka2mbg23";
+        url = "https://elpa.gnu.org/packages/mpdired-3.tar";
+        sha256 = "19qkg7cjh037l4cw3q0b52hpp3fwmly6alc7z683baiz5fklcjc8";
       };
       packageRequires = [ ];
       meta = {
@@ -6118,10 +6318,10 @@
     elpaBuild {
       pname = "orderless";
       ename = "orderless";
-      version = "1.3";
+      version = "1.4";
       src = fetchurl {
-        url = "https://elpa.gnu.org/packages/orderless-1.3.tar";
-        sha256 = "1gh2xw34adk5q6v9sz42j5mwyjjp1yix70jvjylnapwsjjsjm5qk";
+        url = "https://elpa.gnu.org/packages/orderless-1.4.tar";
+        sha256 = "151df7azrhyxaa768bp6mxmc44mmc4h1x180s2a9ns4b3lsfczrv";
       };
       packageRequires = [ compat ];
       meta = {
@@ -6139,10 +6339,10 @@
     elpaBuild {
       pname = "org";
       ename = "org";
-      version = "9.7.25";
+      version = "9.7.27";
       src = fetchurl {
-        url = "https://elpa.gnu.org/packages/org-9.7.25.tar";
-        sha256 = "0isa5mqsmnyw874kh980kal4r45h6qdzizg186lvczmhdqir85bm";
+        url = "https://elpa.gnu.org/packages/org-9.7.27.tar";
+        sha256 = "0y2x94qxi6wa7mrcdppyynylv9j5sszik25bmjwsfriiwqwk5gp6";
       };
       packageRequires = [ ];
       meta = {
@@ -8503,10 +8703,10 @@
     elpaBuild {
       pname = "swiper";
       ename = "swiper";
-      version = "0.15.0";
+      version = "0.15.1";
       src = fetchurl {
-        url = "https://elpa.gnu.org/packages/swiper-0.15.0.tar";
-        sha256 = "16vznhb8zqzqvg3i2pkwfani2h19dm08aj7qv334mlyj97rv1ppn";
+        url = "https://elpa.gnu.org/packages/swiper-0.15.1.tar";
+        sha256 = "0m70jgcdsbrj6i5b1srrdgzkwavzi098532fv6vi2051nl42snvz";
       };
       packageRequires = [ ivy ];
       meta = {
@@ -8701,10 +8901,10 @@
     elpaBuild {
       pname = "tempel";
       ename = "tempel";
-      version = "1.3";
+      version = "1.4";
       src = fetchurl {
-        url = "https://elpa.gnu.org/packages/tempel-1.3.tar";
-        sha256 = "0fivsldisk17a1vbzx91kmvsd85vl0dnih77pqnzriyqs8dl1wdm";
+        url = "https://elpa.gnu.org/packages/tempel-1.4.tar";
+        sha256 = "0gh573np15wdy7vd0zj92ivslaga7kalmnkdjlfiw5pamyy5xsl4";
       };
       packageRequires = [ compat ];
       meta = {
@@ -8765,10 +8965,10 @@
     elpaBuild {
       pname = "tex-parens";
       ename = "tex-parens";
-      version = "0.6";
+      version = "0.7";
       src = fetchurl {
-        url = "https://elpa.gnu.org/packages/tex-parens-0.6.tar";
-        sha256 = "0pgzs0fw2ijns2xqbyq7whlhjjrhp0axja0381q9v75c7fxrp6ba";
+        url = "https://elpa.gnu.org/packages/tex-parens-0.7.tar";
+        sha256 = "1h3l4kn154mmzxgz6s7y2qrkpqk4ava3j1iwx07gsgnr5pcpgvfr";
       };
       packageRequires = [ ];
       meta = {
@@ -9026,10 +9226,10 @@
     elpaBuild {
       pname = "transient";
       ename = "transient";
-      version = "0.8.5";
+      version = "0.8.7";
       src = fetchurl {
-        url = "https://elpa.gnu.org/packages/transient-0.8.5.tar";
-        sha256 = "0ydxddlf9aniindgi135rj3c1d1ar5qi5kwh1qkdff9124d6f0kh";
+        url = "https://elpa.gnu.org/packages/transient-0.8.7.tar";
+        sha256 = "0j4n8zqnc2l2p6hy3k9b7zahzqxwk8d239whnn0yjp91z11i945c";
       };
       packageRequires = [
         compat
@@ -9692,10 +9892,10 @@
     elpaBuild {
       pname = "vundo";
       ename = "vundo";
-      version = "2.3.0";
+      version = "2.4.0";
       src = fetchurl {
-        url = "https://elpa.gnu.org/packages/vundo-2.3.0.tar";
-        sha256 = "165y277fi0vp9301hy3pqgfnf160k29n8vri0zyq8a3vz3f8lqrl";
+        url = "https://elpa.gnu.org/packages/vundo-2.4.0.tar";
+        sha256 = "1aj2l6iivgv6mh3rvrj8w8jhznx7cywn5f2b2ivl4hmrxlfbgsjr";
       };
       packageRequires = [ ];
       meta = {

pkgs/applications/editors/emacs/elisp-packages/melpa-packages.nix

@@ -1045,6 +1045,8 @@ let
           # depends on distel which is not on any ELPA https://github.com/massemanet/distel/issues/21
           company-distel = ignoreCompilationError super.company-distel;
 
+          company-forge = buildWithGit super.company-forge;
+
           # qmltypes-table.el causing native-compiler-error-empty-byte
           company-qml = ignoreCompilationError super.company-qml;
 
@@ -1248,6 +1250,8 @@ let
 
           fold-dwim-org = ignoreCompilationError super.fold-dwim-org; # elisp error
 
+          forge-llm = buildWithGit super.forge-llm;
+
           frontside-javascript = super.frontside-javascript.overrideAttrs (
             finalAttrs: previousAttrs: {
               # https://github.com/melpa/melpa/pull/9182

pkgs/applications/editors/emacs/elisp-packages/nongnu-devel-generated.nix

@@ -42,6 +42,32 @@
       };
     }
   ) { };
+  aidermacs = callPackage (
+    {
+      compat,
+      elpaBuild,
+      fetchurl,
+      lib,
+      transient,
+    }:
+    elpaBuild {
+      pname = "aidermacs";
+      ename = "aidermacs";
+      version = "1.1.0.20250401.165709";
+      src = fetchurl {
+        url = "https://elpa.nongnu.org/nongnu-devel/aidermacs-1.1.0.20250401.165709.tar";
+        sha256 = "1jk832psy61ss04dr7h0563np2v6j57qxbf78b5kpzfsc0x1m946";
+      };
+      packageRequires = [
+        compat
+        transient
+      ];
+      meta = {
+        homepage = "https://elpa.nongnu.org/nongnu-devel/aidermacs.html";
+        license = lib.licenses.free;
+      };
+    }
+  ) { };
   alect-themes = callPackage (
     {
       elpaBuild,
@@ -93,10 +119,10 @@
     elpaBuild {
       pname = "annotate";
       ename = "annotate";
-      version = "2.3.0.0.20250306.133745";
+      version = "2.3.1.0.20250320.130448";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/annotate-2.3.0.0.20250306.133745.tar";
-        sha256 = "14p1yaxzns3zmi0d799fn76pca3d0ayl5v73bdssr0fq6rq04q5a";
+        url = "https://elpa.nongnu.org/nongnu-devel/annotate-2.3.1.0.20250320.130448.tar";
+        sha256 = "16djnp8mknq8rdk4sa4szsmbbg879677dx736pqg621gdy0p2p8m";
       };
       packageRequires = [ ];
       meta = {
@@ -263,10 +289,10 @@
     elpaBuild {
       pname = "base32";
       ename = "base32";
-      version = "1.0.0.20250312.191912";
+      version = "1.0.0.20250312.200047";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/base32-1.0.0.20250312.191912.tar";
-        sha256 = "1aglwd9mm2c53nqm7j6hrh02mag9gg5x5yc25jmaajqy9qrbh54n";
+        url = "https://elpa.nongnu.org/nongnu-devel/base32-1.0.0.20250312.200047.tar";
+        sha256 = "0l6mshnk25iadh1wymdxzfx4g5pvlh4q1hr1x9xfg5xbimiwfkki";
       };
       packageRequires = [ ];
       meta = {
@@ -544,10 +570,10 @@
     elpaBuild {
       pname = "cider";
       ename = "cider";
-      version = "1.18.0snapshot0.20250305.132250";
+      version = "1.18.0snapshot0.20250401.193622";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/cider-1.18.0snapshot0.20250305.132250.tar";
-        sha256 = "09a7kin91dmhhbyzvlalijiyjnzal2mqjcqbmrzq6nm1lswdrzvx";
+        url = "https://elpa.nongnu.org/nongnu-devel/cider-1.18.0snapshot0.20250401.193622.tar";
+        sha256 = "08grbaz79nlylmjkza6qw6rh1kzqp0v7ydx6867wfi5xg15xvik2";
       };
       packageRequires = [
         clojure-mode
@@ -594,10 +620,10 @@
     elpaBuild {
       pname = "clojure-ts-mode";
       ename = "clojure-ts-mode";
-      version = "0.2.4snapshot0.20250310.123844";
+      version = "0.2.4snapshot0.20250326.192250";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/clojure-ts-mode-0.2.4snapshot0.20250310.123844.tar";
-        sha256 = "0nnw6bwcca9nxwhg3a1m25c8n2s4x6frkmi1j7x0dlxiy5hj8ddb";
+        url = "https://elpa.nongnu.org/nongnu-devel/clojure-ts-mode-0.2.4snapshot0.20250326.192250.tar";
+        sha256 = "1s32fz618kiglhspdy51p8pa7rmyr0djg4f5kpii3xvcn7lhfa77";
       };
       packageRequires = [ ];
       meta = {
@@ -916,6 +942,7 @@
   ) { };
   dirvish = callPackage (
     {
+      compat,
       elpaBuild,
       fetchurl,
       lib,
@@ -923,12 +950,12 @@
     elpaBuild {
       pname = "dirvish";
       ename = "dirvish";
-      version = "2.2.7.0.20250312.165153";
+      version = "2.2.7.0.20250402.153806";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/dirvish-2.2.7.0.20250312.165153.tar";
-        sha256 = "1k6y9simcqfszyq5s0vb41s6pjmr9pd3djbnjdk5vvqhqyphig21";
+        url = "https://elpa.nongnu.org/nongnu-devel/dirvish-2.2.7.0.20250402.153806.tar";
+        sha256 = "0zqyvcqmvxjrbnj8s47phmmx3fxdgj6613i27w8mjjd8p3l6ggn7";
       };
-      packageRequires = [ ];
+      packageRequires = [ compat ];
       meta = {
         homepage = "https://elpa.nongnu.org/nongnu-devel/dirvish.html";
         license = lib.licenses.free;
@@ -965,10 +992,10 @@
     elpaBuild {
       pname = "dockerfile-mode";
       ename = "dockerfile-mode";
-      version = "1.9.0.20250225.102722";
+      version = "1.9.0.20250315.102635";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/dockerfile-mode-1.9.0.20250225.102722.tar";
-        sha256 = "1mmylgvlmx7cdppfsi28hnf2s3v6qnpk5ii2r2qjbyj7vnbnk97g";
+        url = "https://elpa.nongnu.org/nongnu-devel/dockerfile-mode-1.9.0.20250315.102635.tar";
+        sha256 = "057drkn59pq5m68900lxy2nzsf3qnqhc6vglx8zl4yc32vhqa2w4";
       };
       packageRequires = [ ];
       meta = {
@@ -986,10 +1013,10 @@
     elpaBuild {
       pname = "dracula-theme";
       ename = "dracula-theme";
-      version = "1.8.2.0.20241217.214522";
+      version = "1.8.2.0.20250325.124646";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/dracula-theme-1.8.2.0.20241217.214522.tar";
-        sha256 = "0dizqwzgygkim66lxkxpwcidhhi7ppwazi57nqkahyd3n03ka2f9";
+        url = "https://elpa.nongnu.org/nongnu-devel/dracula-theme-1.8.2.0.20250325.124646.tar";
+        sha256 = "13jry36wqjqdljk0lq2zm6gcs2hr33aj30l69jkhk6y4yiicjm9j";
       };
       packageRequires = [ ];
       meta = {
@@ -1114,10 +1141,10 @@
     elpaBuild {
       pname = "eglot-inactive-regions";
       ename = "eglot-inactive-regions";
-      version = "0.6.3.0.20250313.74527";
+      version = "0.6.5.0.20250326.53650";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/eglot-inactive-regions-0.6.3.0.20250313.74527.tar";
-        sha256 = "1vrrngpbfi9gbkx9bn2fqznr8wg8m9msdj438nsysl8175ai0c1d";
+        url = "https://elpa.nongnu.org/nongnu-devel/eglot-inactive-regions-0.6.5.0.20250326.53650.tar";
+        sha256 = "0xj16f49mjm1i3zdd6cpd9sjir6dwvh3s3lqs6fpp0sknpj0i5in";
       };
       packageRequires = [ ];
       meta = {
@@ -1198,10 +1225,10 @@
     elpaBuild {
       pname = "emacsql";
       ename = "emacsql";
-      version = "4.2.0.0.20250301.163737";
+      version = "4.3.0.0.20250401.150013";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/emacsql-4.2.0.0.20250301.163737.tar";
-        sha256 = "1rzxgfykrckxw6sbgw71dd99s8rnz0jjjpddsf8rsy7ialjzw4w4";
+        url = "https://elpa.nongnu.org/nongnu-devel/emacsql-4.3.0.0.20250401.150013.tar";
+        sha256 = "1bx0mg3i45m6qa3a7iar0kjmapqf5xqpxvfskqrvxgc5ac3kvxs1";
       };
       packageRequires = [ ];
       meta = {
@@ -1243,10 +1270,10 @@
     elpaBuild {
       pname = "evil";
       ename = "evil";
-      version = "1.15.0.0.20250302.65539";
+      version = "1.15.0.0.20250318.181600";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/evil-1.15.0.0.20250302.65539.tar";
-        sha256 = "0xvdcvqimz2vk6hibip8cgn6jxgibxial6awl46vxq4b8g6bbply";
+        url = "https://elpa.nongnu.org/nongnu-devel/evil-1.15.0.0.20250318.181600.tar";
+        sha256 = "0qbz4gpiychd57370kpj73zcqdjl1gap80zjs4896smyj1pbr9c4";
       };
       packageRequires = [
         cl-lib
@@ -1270,10 +1297,10 @@
     elpaBuild {
       pname = "evil-anzu";
       ename = "evil-anzu";
-      version = "0.2.0.20220911.193944";
+      version = "0.2.0.20250316.121704";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/evil-anzu-0.2.0.20220911.193944.tar";
-        sha256 = "0ap13nrpcjm9q7pia8jy544sc08gc44bgyqi7yvkh2yk8cw96g8m";
+        url = "https://elpa.nongnu.org/nongnu-devel/evil-anzu-0.2.0.20250316.121704.tar";
+        sha256 = "0wr47dx4axy2xvnn1y354scvwka2mh8z9kgdclgnfvnhhdqzi2h0";
       };
       packageRequires = [
         anzu
@@ -2348,10 +2375,10 @@
     elpaBuild {
       pname = "gptel";
       ename = "gptel";
-      version = "0.9.7.0.20250312.185844";
+      version = "0.9.8.0.20250402.114541";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/gptel-0.9.7.0.20250312.185844.tar";
-        sha256 = "16jrv9aw5h40vfwhv2wmlgngbzgbi68pianx6flfx6fzmlsdxpww";
+        url = "https://elpa.nongnu.org/nongnu-devel/gptel-0.9.8.0.20250402.114541.tar";
+        sha256 = "0nc9dxhva2wrdsan84vxjhc9pavzrnsjs4zm916rg46bmm8z01j1";
       };
       packageRequires = [
         compat
@@ -2479,10 +2506,10 @@
     elpaBuild {
       pname = "haskell-mode";
       ename = "haskell-mode";
-      version = "17.5.0.20250305.134904";
+      version = "17.5.0.20250401.174200";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/haskell-mode-17.5.0.20250305.134904.tar";
-        sha256 = "10pn6b4hml8wzzliynlag1fr7lnc526gzbfqbhs3kzh6qx5rf8zn";
+        url = "https://elpa.nongnu.org/nongnu-devel/haskell-mode-17.5.0.20250401.174200.tar";
+        sha256 = "1dxfwd4yhwzy59d55hnz0z23dg5vh1fzkrpicdaz93m9yvfzy1aa";
       };
       packageRequires = [ ];
       meta = {
@@ -2522,10 +2549,10 @@
     elpaBuild {
       pname = "haskell-ts-mode";
       ename = "haskell-ts-mode";
-      version = "1.0.20250202.61612";
+      version = "1.0.20250315.43516";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/haskell-ts-mode-1.0.20250202.61612.tar";
-        sha256 = "1i3is0js2sjr61bd7w1jz05a9gl4aj5b0ivar5iq1l0kmnhq7w54";
+        url = "https://elpa.nongnu.org/nongnu-devel/haskell-ts-mode-1.0.20250315.43516.tar";
+        sha256 = "1a6jdmx8h9w9naqhj80v1vq7ms1a9sr58zqnq634xnj35jygzlib";
       };
       packageRequires = [ ];
       meta = {
@@ -2545,10 +2572,10 @@
     elpaBuild {
       pname = "helm";
       ename = "helm";
-      version = "4.0.2.0.20250228.64018";
+      version = "4.0.2.0.20250401.65011";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/helm-4.0.2.0.20250228.64018.tar";
-        sha256 = "1mjgc22vp68wk1klq7f5i74pqr5wmwb53cc81n04zi6jynv2rimm";
+        url = "https://elpa.nongnu.org/nongnu-devel/helm-4.0.2.0.20250401.65011.tar";
+        sha256 = "09fs2fd7vdywg2z7gwy7z6vbi7ya65nz4sscd34v41pqhzqnc9bw";
       };
       packageRequires = [
         helm-core
@@ -2570,10 +2597,10 @@
     elpaBuild {
       pname = "helm-core";
       ename = "helm-core";
-      version = "4.0.2.0.20250228.64018";
+      version = "4.0.2.0.20250401.65011";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/helm-core-4.0.2.0.20250228.64018.tar";
-        sha256 = "1i7f8n4gk7fppxdlylm1hwp8ab2dqpg9h30ppv46nzp6bp0fywyw";
+        url = "https://elpa.nongnu.org/nongnu-devel/helm-core-4.0.2.0.20250401.65011.tar";
+        sha256 = "0zlv04s1l487hszx0zs08awn5lcx1ngkiw6pkmndgxy1dhwqc4j9";
       };
       packageRequires = [ async ];
       meta = {
@@ -2703,10 +2730,10 @@
     elpaBuild {
       pname = "hyperdrive";
       ename = "hyperdrive";
-      version = "0.6pre0.20241222.235250";
+      version = "0.6pre0.20250330.212748";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/hyperdrive-0.6pre0.20241222.235250.tar";
-        sha256 = "0a9z9kbnlzbv21w62zyw3mpbvjfnl5vhjmlpq65w7cc4d1qd2jp5";
+        url = "https://elpa.nongnu.org/nongnu-devel/hyperdrive-0.6pre0.20250330.212748.tar";
+        sha256 = "01lz4aak0ccqfffp61d8gfwpscbhdy9132bwbxpsrfiasxvkbfl8";
       };
       packageRequires = [
         compat
@@ -3044,10 +3071,10 @@
     elpaBuild {
       pname = "llama";
       ename = "llama";
-      version = "0.6.1.0.20250312.142844";
+      version = "0.6.2.0.20250314.200910";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/llama-0.6.1.0.20250312.142844.tar";
-        sha256 = "099m6knzf6rh4r9x6f285mimg8i7znrays1bsi1y22hvik5mmgl2";
+        url = "https://elpa.nongnu.org/nongnu-devel/llama-0.6.2.0.20250314.200910.tar";
+        sha256 = "0x39lvrjdqdyfdy5v88s9mpsgvdjvk1q3v2556sjdrw1q571d5wf";
       };
       packageRequires = [ compat ];
       meta = {
@@ -3068,10 +3095,10 @@
     elpaBuild {
       pname = "logview";
       ename = "logview";
-      version = "0.19.3snapshot0.20250306.133154";
+      version = "0.19.3snapshot0.20250401.172309";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/logview-0.19.3snapshot0.20250306.133154.tar";
-        sha256 = "0lkjp8y7f3npvbd63c2n7jfplp63qschbpq0ngqjs7q6254yfk9i";
+        url = "https://elpa.nongnu.org/nongnu-devel/logview-0.19.3snapshot0.20250401.172309.tar";
+        sha256 = "0vr34ixpidz1lp6y87axlvi0pac11lfkm5g0d310wphihnjmyssr";
       };
       packageRequires = [
         compat
@@ -3223,10 +3250,10 @@
     elpaBuild {
       pname = "magit";
       ename = "magit";
-      version = "4.3.1.0.20250312.143226";
+      version = "4.3.2.0.20250401.175331";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/magit-4.3.1.0.20250312.143226.tar";
-        sha256 = "0mba1qf1z6dsbhrzl7d4rz8f6xbqqlwrxa16dbi9gl5ibaf4kx0p";
+        url = "https://elpa.nongnu.org/nongnu-devel/magit-4.3.2.0.20250401.175331.tar";
+        sha256 = "1way4hifyj0p5ly2p84as1amivv67qr22ph292rgwizrj0d5j60y";
       };
       packageRequires = [
         compat
@@ -3254,10 +3281,10 @@
     elpaBuild {
       pname = "magit-section";
       ename = "magit-section";
-      version = "4.3.1.0.20250312.143226";
+      version = "4.3.2.0.20250401.175331";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/magit-section-4.3.1.0.20250312.143226.tar";
-        sha256 = "1s9dz5bayf852bdmd656zdzsch5w2jj687hnbpbmb2zbj050r45g";
+        url = "https://elpa.nongnu.org/nongnu-devel/magit-section-4.3.2.0.20250401.175331.tar";
+        sha256 = "1wif3d5vb04f39g38w2nbamqcbb89ivh2w5b0w362k3pk0vq2a70";
       };
       packageRequires = [
         compat
@@ -3279,10 +3306,10 @@
     elpaBuild {
       pname = "markdown-mode";
       ename = "markdown-mode";
-      version = "2.8alpha0.20250310.105434";
+      version = "2.8alpha0.20250402.45223";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/markdown-mode-2.8alpha0.20250310.105434.tar";
-        sha256 = "1hs8kaw22r9fskh6pwchv1343k3phcfk1a1zdk41wvvc622pl11m";
+        url = "https://elpa.nongnu.org/nongnu-devel/markdown-mode-2.8alpha0.20250402.45223.tar";
+        sha256 = "1j8axf1p9ijx4kgyr8qnhhy2rs9y52kammqq8zpqp25zh0a8ydjr";
       };
       packageRequires = [ ];
       meta = {
@@ -3297,20 +3324,18 @@
       fetchurl,
       lib,
       persist,
-      request,
       tp,
     }:
     elpaBuild {
       pname = "mastodon";
       ename = "mastodon";
-      version = "1.1.12.0.20250305.210452";
+      version = "2.0.0.0.20250330.151927";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/mastodon-1.1.12.0.20250305.210452.tar";
-        sha256 = "1dnii6hwxjbprm9cskah40vk41hgnbnvxnjykf8hssf2d5g1qsg3";
+        url = "https://elpa.nongnu.org/nongnu-devel/mastodon-2.0.0.0.20250330.151927.tar";
+        sha256 = "16xfvaacilfd075nln38hijzmx1wr30gmibrksn6zhfl6mj0lhnk";
       };
       packageRequires = [
         persist
-        request
         tp
       ];
       meta = {
@@ -3379,10 +3404,10 @@
     elpaBuild {
       pname = "meow";
       ename = "meow";
-      version = "1.5.0.0.20250216.181716";
+      version = "1.5.0.0.20250317.230021";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/meow-1.5.0.0.20250216.181716.tar";
-        sha256 = "0cmn4v9xzw42k98i17mbzh0vd2llw4cf79di2camgkc8gf07g01r";
+        url = "https://elpa.nongnu.org/nongnu-devel/meow-1.5.0.0.20250317.230021.tar";
+        sha256 = "1m7nf329y7jq4543mganpwl5sy6ci854ln468qbb3ik3lf8c8bq0";
       };
       packageRequires = [ ];
       meta = {
@@ -3506,10 +3531,10 @@
     elpaBuild {
       pname = "nasm-mode";
       ename = "nasm-mode";
-      version = "1.1.1.0.20240610.150504";
+      version = "1.1.1.0.20250320.164627";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/nasm-mode-1.1.1.0.20240610.150504.tar";
-        sha256 = "1kkv7r6j02472d6c91xsrg9qlfvl70iyi538w2mh3s2adfkh7ps9";
+        url = "https://elpa.nongnu.org/nongnu-devel/nasm-mode-1.1.1.0.20250320.164627.tar";
+        sha256 = "0dm1zg15q18v9y4mx2p8hdqvql4dikw8chkj3i3jb1jp9d0v2rf3";
       };
       packageRequires = [ ];
       meta = {
@@ -3710,10 +3735,10 @@
     elpaBuild {
       pname = "org-mime";
       ename = "org-mime";
-      version = "0.3.4.0.20241001.42820";
+      version = "0.3.4.0.20250318.215555";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/org-mime-0.3.4.0.20241001.42820.tar";
-        sha256 = "1xcdk15z18s073q3hlg7dck8p5ssgap35a6m0f6cbmd5dbd3r05f";
+        url = "https://elpa.nongnu.org/nongnu-devel/org-mime-0.3.4.0.20250318.215555.tar";
+        sha256 = "0plqmcyszpc1x35v691zlgxmnbga80yxxcjyb5mvxdri45z4458d";
       };
       packageRequires = [ ];
       meta = {
@@ -3825,10 +3850,10 @@
     elpaBuild {
       pname = "orgit";
       ename = "orgit";
-      version = "2.0.1.0.20250301.233925";
+      version = "2.0.2.0.20250401.181022";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/orgit-2.0.1.0.20250301.233925.tar";
-        sha256 = "0adppm61dn3cfkgdyc5ik42z0byvyc2dkwhjdzvw66nnl3fjb3ch";
+        url = "https://elpa.nongnu.org/nongnu-devel/orgit-2.0.2.0.20250401.181022.tar";
+        sha256 = "1imiy9h0yrr995x5swy7mlrzn7zmgscr11a1g4b53dxcinywndcj";
       };
       packageRequires = [
         compat
@@ -3872,10 +3897,10 @@
     elpaBuild {
       pname = "package-lint";
       ename = "package-lint";
-      version = "0.25.0.20250307.91203";
+      version = "0.25.0.20250324.192216";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/package-lint-0.25.0.20250307.91203.tar";
-        sha256 = "11yx2k7bsyi4ql8jhyz36s0pcxr0d6ssnnv7w128qfy9k0bklnr7";
+        url = "https://elpa.nongnu.org/nongnu-devel/package-lint-0.25.0.20250324.192216.tar";
+        sha256 = "0m1a5bs4kiplxqva0fmsznpxbq3jhpprgji3dpf0jq226cjm45d9";
       };
       packageRequires = [ let-alist ];
       meta = {
@@ -4072,10 +4097,10 @@
     elpaBuild {
       pname = "php-mode";
       ename = "php-mode";
-      version = "1.26.1.0.20250224.145951";
+      version = "1.26.1.0.20250331.173641";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/php-mode-1.26.1.0.20250224.145951.tar";
-        sha256 = "0fcfm286x9q8cgqagw4d1n512g2g0bcllwyn2b591fam9nfzx800";
+        url = "https://elpa.nongnu.org/nongnu-devel/php-mode-1.26.1.0.20250331.173641.tar";
+        sha256 = "16glbb3rinpqpqb3vd9j9h3ldgsjc18ics324rfajx3kilwp00gv";
       };
       packageRequires = [ ];
       meta = {
@@ -4135,10 +4160,10 @@
     elpaBuild {
       pname = "projectile";
       ename = "projectile";
-      version = "2.9.1.0.20250312.165928";
+      version = "2.9.1.0.20250402.71553";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/projectile-2.9.1.0.20250312.165928.tar";
-        sha256 = "0wqgzph6vkgq55h5669l0rxqjxz7chbzrrjxb16r6pisxnw4b2dd";
+        url = "https://elpa.nongnu.org/nongnu-devel/projectile-2.9.1.0.20250402.71553.tar";
+        sha256 = "0cnidaysnma7bvzzw5vbkggy3z9zq51zlg4k2kd5b1f8dagjlzv7";
       };
       packageRequires = [ ];
       meta = {
@@ -4156,10 +4181,10 @@
     elpaBuild {
       pname = "proof-general";
       ename = "proof-general";
-      version = "4.6snapshot0.20250129.125602";
+      version = "4.6snapshot0.20250402.90650";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/proof-general-4.6snapshot0.20250129.125602.tar";
-        sha256 = "1w7s5sdxa05m80nicykqagk5y50q76gmr86ivwl09sibmwb6c9kh";
+        url = "https://elpa.nongnu.org/nongnu-devel/proof-general-4.6snapshot0.20250402.90650.tar";
+        sha256 = "0ay9r63scg3zray4cx0vp7qrl74sfz9vl7kj2bw31jf891sal4s1";
       };
       packageRequires = [ ];
       meta = {
@@ -4199,10 +4224,10 @@
     elpaBuild {
       pname = "racket-mode";
       ename = "racket-mode";
-      version = "1.0.20250212.102351";
+      version = "1.0.20250324.74422";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/racket-mode-1.0.20250212.102351.tar";
-        sha256 = "1byfpwv7nk4ncqd1cx3qphs37xllmw8mx9gdxd86l66qr1hyp22j";
+        url = "https://elpa.nongnu.org/nongnu-devel/racket-mode-1.0.20250324.74422.tar";
+        sha256 = "0pwn822nyzbysq1h2gvyrwcxbrg7dbsn7rxv02sg7bl4nsmqzjjk";
       };
       packageRequires = [ ];
       meta = {
@@ -4304,10 +4329,10 @@
     elpaBuild {
       pname = "reformatter";
       ename = "reformatter";
-      version = "0.8.0.20241204.105138";
+      version = "0.8.0.20250324.192239";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/reformatter-0.8.0.20241204.105138.tar";
-        sha256 = "1j78naw4jikh7nby67gdbx9banchmf1q5fysal1328gxnyqknmzi";
+        url = "https://elpa.nongnu.org/nongnu-devel/reformatter-0.8.0.20250324.192239.tar";
+        sha256 = "0kg01an6pf9laaqqdh4h09y508k94l85xjqb038dg9whv2bf0h3a";
       };
       packageRequires = [ ];
       meta = {
@@ -4358,6 +4383,27 @@
       };
     }
   ) { };
+  rpm-spec-mode = callPackage (
+    {
+      elpaBuild,
+      fetchurl,
+      lib,
+    }:
+    elpaBuild {
+      pname = "rpm-spec-mode";
+      ename = "rpm-spec-mode";
+      version = "0.16.0.20250329.13938";
+      src = fetchurl {
+        url = "https://elpa.nongnu.org/nongnu-devel/rpm-spec-mode-0.16.0.20250329.13938.tar";
+        sha256 = "1gmqnv1ckypns7aiz4w5kb3l8m66bfxlw8z19i3ag5im8rlpc9lp";
+      };
+      packageRequires = [ ];
+      meta = {
+        homepage = "https://elpa.nongnu.org/nongnu-devel/rpm-spec-mode.html";
+        license = lib.licenses.free;
+      };
+    }
+  ) { };
   rubocop = callPackage (
     {
       elpaBuild,
@@ -4563,10 +4609,10 @@
     elpaBuild {
       pname = "slime";
       ename = "slime";
-      version = "2.31snapshot0.20250310.203219";
+      version = "2.31snapshot0.20250330.174001";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/slime-2.31snapshot0.20250310.203219.tar";
-        sha256 = "0f9j1phl36xnjh4g1263nkfqnjc79jrk1c0yqawykhljal87xyka";
+        url = "https://elpa.nongnu.org/nongnu-devel/slime-2.31snapshot0.20250330.174001.tar";
+        sha256 = "03hmilx1w1jf4gcz2bmlidpfd99znhpjrs540qgy6grrrnhqny3s";
       };
       packageRequires = [ macrostep ];
       meta = {
@@ -5144,10 +5190,10 @@
     elpaBuild {
       pname = "typst-ts-mode";
       ename = "typst-ts-mode";
-      version = "0.11.0.0.20250221.91757";
+      version = "0.11.0.0.20250318.13735";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/typst-ts-mode-0.11.0.0.20250221.91757.tar";
-        sha256 = "0829ah70ib1q0va6f18xlbh13laa1cn196i8xa3jji4ljmcxkfyj";
+        url = "https://elpa.nongnu.org/nongnu-devel/typst-ts-mode-0.11.0.0.20250318.13735.tar";
+        sha256 = "1b710ynajshrdjqga5hdkkcsxq4avckh9qzjajg72jxdwpv02f6h";
       };
       packageRequires = [ ];
       meta = {
@@ -5270,10 +5316,10 @@
     elpaBuild {
       pname = "visual-fill-column";
       ename = "visual-fill-column";
-      version = "2.6.3.0.20250204.233635";
+      version = "2.6.3.0.20250323.152945";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/visual-fill-column-2.6.3.0.20250204.233635.tar";
-        sha256 = "0516ccjk21bkfdv24mp59xb9pdzc4hwnz4cfyfg0xnrd1kiihggq";
+        url = "https://elpa.nongnu.org/nongnu-devel/visual-fill-column-2.6.3.0.20250323.152945.tar";
+        sha256 = "0rcn0wxdylcb0ci0cjipbjc5hrrvigrj5in2qh3fpj742pqda6mm";
       };
       packageRequires = [ ];
       meta = {
@@ -5538,10 +5584,10 @@
     elpaBuild {
       pname = "xah-fly-keys";
       ename = "xah-fly-keys";
-      version = "26.10.20250308091402.0.20250308.122854";
+      version = "26.11.20250325184849.0.20250325.185005";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/xah-fly-keys-26.10.20250308091402.0.20250308.122854.tar";
-        sha256 = "0c0afwkjp8p445qs2rfg7n9gs842bq46di95q10ab9s8qcg4j7d8";
+        url = "https://elpa.nongnu.org/nongnu-devel/xah-fly-keys-26.11.20250325184849.0.20250325.185005.tar";
+        sha256 = "1ihvslx530i6q1iwz58wailwjqk1qmq07s2c8kpnynrpbi53jr3h";
       };
       packageRequires = [ ];
       meta = {

pkgs/applications/editors/emacs/elisp-packages/nongnu-generated.nix

@@ -42,6 +42,32 @@
       };
     }
   ) { };
+  aidermacs = callPackage (
+    {
+      compat,
+      elpaBuild,
+      fetchurl,
+      lib,
+      transient,
+    }:
+    elpaBuild {
+      pname = "aidermacs";
+      ename = "aidermacs";
+      version = "1.1";
+      src = fetchurl {
+        url = "https://elpa.nongnu.org/nongnu/aidermacs-1.1.tar";
+        sha256 = "1g1p5prz9b2giy01hja04zqf90s53yckjxfwkrznpqvpar25l1nz";
+      };
+      packageRequires = [
+        compat
+        transient
+      ];
+      meta = {
+        homepage = "https://elpa.nongnu.org/nongnu/aidermacs.html";
+        license = lib.licenses.free;
+      };
+    }
+  ) { };
   alect-themes = callPackage (
     {
       elpaBuild,
@@ -93,10 +119,10 @@
     elpaBuild {
       pname = "annotate";
       ename = "annotate";
-      version = "2.3.0";
+      version = "2.3.1";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu/annotate-2.3.0.tar";
-        sha256 = "0l5pw9z4i1mlf346dg7brha37jmlrq6pyvjdj2mxhdfs6nzddaba";
+        url = "https://elpa.nongnu.org/nongnu/annotate-2.3.1.tar";
+        sha256 = "1s5v3zxr7fvwm0xz176vl3y50rl7mvn748jgn19b8x7zn4zsnf42";
       };
       packageRequires = [ ];
       meta = {
@@ -1138,10 +1164,10 @@
     elpaBuild {
       pname = "eglot-inactive-regions";
       ename = "eglot-inactive-regions";
-      version = "0.6.3";
+      version = "0.6.5";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu/eglot-inactive-regions-0.6.3.tar";
-        sha256 = "03958dgr48zqak06qjqdz6qgfxn5rs60425qcvb7wdv2jb4400hc";
+        url = "https://elpa.nongnu.org/nongnu/eglot-inactive-regions-0.6.5.tar";
+        sha256 = "133wbmmzxfhzkjlm3sjllg3wl5r2dyprs2rmwi8r7nq3p831ak0n";
       };
       packageRequires = [ ];
       meta = {
@@ -1222,10 +1248,10 @@
     elpaBuild {
       pname = "emacsql";
       ename = "emacsql";
-      version = "4.2.0";
+      version = "4.3.0";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu/emacsql-4.2.0.tar";
-        sha256 = "03nxfdbha7apar6qhjg57pa4cawjjwswlkci2wm9044wps87734c";
+        url = "https://elpa.nongnu.org/nongnu/emacsql-4.3.0.tar";
+        sha256 = "18nr7fvrdhny59lmr7x3z48y7kjsmrrdwi659dsqjnnlxz0xcl11";
       };
       packageRequires = [ ];
       meta = {
@@ -2365,10 +2391,10 @@
     elpaBuild {
       pname = "gptel";
       ename = "gptel";
-      version = "0.9.7";
+      version = "0.9.8";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu/gptel-0.9.7.tar";
-        sha256 = "0sh8q80q620d6yr4437ddrjrzygd15iwkc9jvwh3pw9sncv2laqn";
+        url = "https://elpa.nongnu.org/nongnu/gptel-0.9.8.tar";
+        sha256 = "1rym3y1fcwfw9dh51nhw7v8rbap8ixysjlrv39v4hksfwv17gvbr";
       };
       packageRequires = [
         compat
@@ -3060,10 +3086,10 @@
     elpaBuild {
       pname = "llama";
       ename = "llama";
-      version = "0.6.1";
+      version = "0.6.2";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu/llama-0.6.1.tar";
-        sha256 = "0ri0pql710v6yrsnl5hv7xqax6ap1whk4xip9xx732a59fws60cg";
+        url = "https://elpa.nongnu.org/nongnu/llama-0.6.2.tar";
+        sha256 = "1adafy7klbx2h0pjrbl989czh7yf2m8gmk5s87c26ih01sjiwwwz";
       };
       packageRequires = [ compat ];
       meta = {
@@ -3239,10 +3265,10 @@
     elpaBuild {
       pname = "magit";
       ename = "magit";
-      version = "4.3.1";
+      version = "4.3.2";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu/magit-4.3.1.tar";
-        sha256 = "1wac8k466pmq79qvh70k7hfr1c5pyh2ignjsh4df46n08y2c67ys";
+        url = "https://elpa.nongnu.org/nongnu/magit-4.3.2.tar";
+        sha256 = "1pi69z1h5h6qlwmvwl2i2n5gcv9anp9zpgv9knqwrq8j2d5ialgr";
       };
       packageRequires = [
         compat
@@ -3270,10 +3296,10 @@
     elpaBuild {
       pname = "magit-section";
       ename = "magit-section";
-      version = "4.3.1";
+      version = "4.3.2";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu/magit-section-4.3.1.tar";
-        sha256 = "0rkr6lw1m4mc695k4pqpsfc5fnbp94pgl7j6y6c5f96d4dzvcx24";
+        url = "https://elpa.nongnu.org/nongnu/magit-section-4.3.2.tar";
+        sha256 = "0dnmwciz26wrsmp48h9axmj6qjgzhz9i7g3bvlpsq3i8y32xwdf6";
       };
       packageRequires = [
         compat
@@ -3313,20 +3339,18 @@
       fetchurl,
       lib,
       persist,
-      request,
       tp,
     }:
     elpaBuild {
       pname = "mastodon";
       ename = "mastodon";
-      version = "1.1.12";
+      version = "2.0.0";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu/mastodon-1.1.12.tar";
-        sha256 = "1yad0f5qbz3q0h3g4ckmzjha6y1ql954h0p19ibi8rl1kqb6f574";
+        url = "https://elpa.nongnu.org/nongnu/mastodon-2.0.0.tar";
+        sha256 = "0zn1hr36bm1hqsa78q78c5qqwlwg4l23sqsds4gi8nmkcq7yrjlz";
       };
       packageRequires = [
         persist
-        request
         tp
       ];
       meta = {
@@ -3848,10 +3872,10 @@
     elpaBuild {
       pname = "orgit";
       ename = "orgit";
-      version = "2.0.1";
+      version = "2.0.2";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu/orgit-2.0.1.tar";
-        sha256 = "0fisk3gkqlkndkv185xffxn75msd26wsv77m0m0a25fr6xlvn2hn";
+        url = "https://elpa.nongnu.org/nongnu/orgit-2.0.2.tar";
+        sha256 = "1sad3vhmlld60c9lx8hv102d61ihq2ydzb8app97hbk4cs8m3q8j";
       };
       packageRequires = [
         compat
@@ -4222,10 +4246,10 @@
     elpaBuild {
       pname = "racket-mode";
       ename = "racket-mode";
-      version = "1.0.20250212.102351";
+      version = "1.0.20250324.74422";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu/racket-mode-1.0.20250212.102351.tar";
-        sha256 = "14c7y8n562x7dy03078db4xxvyvvxb5kkw9vgg1296xrcpj7mls2";
+        url = "https://elpa.nongnu.org/nongnu/racket-mode-1.0.20250324.74422.tar";
+        sha256 = "0iwcm689jhqv4wzj7awfljmczmn2hzsjaj2yc2zkf9yzlzzbrkxf";
       };
       packageRequires = [ ];
       meta = {
@@ -4381,6 +4405,27 @@
       };
     }
   ) { };
+  rpm-spec-mode = callPackage (
+    {
+      elpaBuild,
+      fetchurl,
+      lib,
+    }:
+    elpaBuild {
+      pname = "rpm-spec-mode";
+      ename = "rpm-spec-mode";
+      version = "0.16";
+      src = fetchurl {
+        url = "https://elpa.nongnu.org/nongnu/rpm-spec-mode-0.16.tar";
+        sha256 = "0gc50kn1wmvz6k9afra7zcnsk7z76cc50vkvw3q8i7p911z55rfj";
+      };
+      packageRequires = [ ];
+      meta = {
+        homepage = "https://elpa.nongnu.org/nongnu/rpm-spec-mode.html";
+        license = lib.licenses.free;
+      };
+    }
+  ) { };
   rubocop = callPackage (
     {
       elpaBuild,
@@ -5552,10 +5597,10 @@
     elpaBuild {
       pname = "xah-fly-keys";
       ename = "xah-fly-keys";
-      version = "26.10.20250308091402";
+      version = "26.11.20250325184849";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu/xah-fly-keys-26.10.20250308091402.tar";
-        sha256 = "1rni5rjz7m4lxjcxhn2h4cds4d67hbd6c8hf731n6ygygarhjp9p";
+        url = "https://elpa.nongnu.org/nongnu/xah-fly-keys-26.11.20250325184849.tar";
+        sha256 = "0j5a89pq304bzyg8qb6y8yysw5z6p4436fyy7lk61kbavc5srqvs";
       };
       packageRequires = [ ];
       meta = {

pkgs/applications/editors/vscode/extensions/default.nix

@@ -5038,8 +5038,8 @@ let
         mktplcRef = {
           name = "uiua-vscode";
           publisher = "uiua-lang";
-          version = "0.0.61";
-          hash = "sha256-cKiIva4nzROp+bbwkMxBvguLMXVe/9uGcdhVhLxmae0=";
+          version = "0.0.62";
+          hash = "sha256-Fq3NmCL17QVAmOmFWSkxc0qRwCRDsRbkeRzwyP02Nq4=";
         };
         meta = {
           description = "VSCode language extension for Uiua";

pkgs/applications/editors/vscode/extensions/mongodb.mongodb-vscode/default.nix

@@ -4,8 +4,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "mongodb-vscode";
     publisher = "mongodb";
-    version = "1.12.1";
-    hash = "sha256-jbR6NGYgDYArCHqMHKPXuht7UViw0Ii3Uc8IqTGTe8k=";
+    version = "1.13.0";
+    hash = "sha256-xOwffd2//P7wS+uuUmuIU0ITOH1pj35h53F1HhvGNMo=";
   };
 
   meta = {

pkgs/applications/editors/vscode/extensions/ms-python.isort/default.nix

@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     publisher = "ms-python";
     name = "isort";
-    version = "2023.13.13171013";
-    hash = "sha256-UBV9i3LPVv60+toy+kJvESAuJHRmH/uEIwjTidYUXLc=";
+    version = "2025.0.0";
+    hash = "sha256-nwt9Pv084jt9nWvxSXLIWu7981UGSbCgVRTrFfJA6q4=";
   };
   meta = with lib; {
     description = "Import sorting extension for Visual Studio Code using isort";

pkgs/applications/gis/qgis/unwrapped-ltr.nix

@@ -82,14 +82,14 @@ let
   ];
 in
 mkDerivation rec {
-  version = "3.40.4";
+  version = "3.40.5";
   pname = "qgis-ltr-unwrapped";
 
   src = fetchFromGitHub {
     owner = "qgis";
     repo = "QGIS";
     rev = "final-${lib.replaceStrings [ "." ] [ "_" ] version}";
-    hash = "sha256-R2/ycRPQVKqleSt+9D/YCpBlqKgJdhLc0BvYT7qFJo8=";
+    hash = "sha256-YVHNB4vdLw8RZir4UydTijztzx58aXBLJk+lA0K9y+4=";
   };
 
   passthru = {

pkgs/applications/graphics/drawpile/default.nix

@@ -19,6 +19,7 @@
   qtsvg,
   qttools,
   libsecret,
+  libwebp,
 
   # optional client deps
   giflib,
@@ -51,6 +52,7 @@ let
     qtsvg
     qttools
     libsecret
+    libwebp
     # optional:
     giflib # gif animation export support
     kdnssd # local server discovery with Zeroconf
@@ -67,18 +69,18 @@ let
 in
 mkDerivation rec {
   pname = "drawpile";
-  version = "2.2.1";
+  version = "2.2.2";
 
   src = fetchFromGitHub {
     owner = "drawpile";
     repo = "drawpile";
     rev = version;
-    sha256 = "sha256-NS1aQlWpn3f+SW0oUjlYwHtOS9ZgbjFTrE9grjK5REM=";
+    sha256 = "sha256-xcutcSpbFt+pb7QP1E/RG6iNnZwpfhIZTxr+1usLKHc=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit src;
-    hash = "sha256-rY4zWSCBfVXvl6p9GvtDg/PFZfLkWTl8FTYdlKTzWYM=";
+    hash = "sha256-VUX6J7TfxWpa07HPFZ8JzpltIwJUYAl5TABIpBmGYYo=";
   };
 
   nativeBuildInputs = [

pkgs/applications/networking/browsers/chromium/info.json

@@ -787,27 +787,27 @@
     }
   },
   "ungoogled-chromium": {
-    "version": "134.0.6998.165",
+    "version": "135.0.7049.52",
     "deps": {
       "depot_tools": {
-        "rev": "e42fac3e9c1726ab14a61a25e6291d9ccc49e688",
-        "hash": "sha256-BvEkk15Rm4nSoV/uWiwmQW/+gg2vpLQ187TbBAHl9Rk="
+        "rev": "85ec2718b5a29990c7eb67778348c9f76a00f392",
+        "hash": "sha256-eWlHnSRfLFcd3OoyCTIFewDf0eC9KQowScQOnphgfg8="
       },
       "gn": {
-        "rev": "ed1abc107815210dc66ec439542bee2f6cbabc00",
-        "hash": "sha256-EqbwCLkseND1v3UqM+49N7GuoXJ3PlJjWOes4OijQ3U="
+        "rev": "4a8016dc391553fa1644c0740cc04eaac844121e",
+        "hash": "sha256-8NynNvLNCHxy8EYmsnPovKhXu9DcDcYBhg4A6d2QIfY="
       },
       "ungoogled-patches": {
-        "rev": "134.0.6998.165-1",
-        "hash": "sha256-Uia8tI3ZpryD+YVV9duH6sAmB/gKvsFg9RZVKYo/HX0="
+        "rev": "135.0.7049.52-1",
+        "hash": "sha256-i7fSJsbuXgzDvh/4RJwHvVEalS134SoRzvcJZbYsIIo="
       },
-      "npmHash": "sha256-oVoTruhxTymYiGkELd2Oa1wOfjGLtChQZozP4GzOO1A="
+      "npmHash": "sha256-wNrZaugdKJCyV1WchkKXzr/I1OW1AtjiC2p7qTZZOqU="
     },
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "fd886e2cb29dd984c13deec032832dee68d8abe3",
-        "hash": "sha256-xD06hGSrccTGB6fUGw0b7RrGNBQjNmdGKPaRqhXVVOY=",
+        "rev": "9ba7e609d28c509a8ce9265c2247065d8d251173",
+        "hash": "sha256-PjvfckdlaMq9HWefGxFppgBumlqh7xoCoxYFwk/r630=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {
@@ -817,23 +817,23 @@
       },
       "src/third_party/libc++/src": {
         "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxx.git",
-        "rev": "2e25154d49c29fa9aa42c30ad4a027bd30123434",
-        "hash": "sha256-QxEbtsEKCs2Xgulq7nVWtAeOGkIYFOy/L1ROfXa5u8U="
+        "rev": "7f8b68f91ca8b192375f5e71cd81fb3ed9650ef3",
+        "hash": "sha256-1P+p5MPXm0WkeYgzIxG2SBKZVPWplUlEo7xYI//Y0uw="
       },
       "src/third_party/libc++abi/src": {
         "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxxabi.git",
-        "rev": "634228a732a1d9ae1a6d459556e8fc58707cf961",
-        "hash": "sha256-ln/DCNYJXVksbwdDBnxCfc4VwtjQlJXF7ktl/NxLupg="
+        "rev": "94c5d7a8edc09f0680aee57548c0b5d400c2840d",
+        "hash": "sha256-wMMfj3E2AQJxovoSEIuT2uTyrcGBurS1HrHZOmP36+g="
       },
       "src/third_party/libunwind/src": {
         "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libunwind.git",
-        "rev": "e55d8cf51c6db1fdd4bb56c158945ec59772c8ee",
-        "hash": "sha256-JazjgI+ch9RgnsDgu6p4cT4UmCBor4x4sRi1ClLISAY="
+        "rev": "62e217a12ee1133833d9890b2f7adde900e4efbd",
+        "hash": "sha256-FBMrvCCVwm0mmaQHDvKXljxxLwthpsFqhPE8yqBx5Aw="
       },
       "src/third_party/llvm-libc/src": {
         "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libc.git",
-        "rev": "6d0c8ee02e2fd44e69ac30e721e13be463035ee5",
-        "hash": "sha256-bF4hV9fY0GLYAHUnxSXkCxdZLMKR3wYWaqYJaM9aQiE="
+        "rev": "a02de4d0d992b110c8b180fdec91258e7b60265f",
+        "hash": "sha256-LtxaimMmnman7BKLKpSR8rJtbEvHsmGVeHvzEukB4EY="
       },
       "src/chrome/test/data/perf/canvas_bench": {
         "url": "https://chromium.googlesource.com/chromium/canvas_bench.git",
@@ -852,8 +852,8 @@
       },
       "src/docs/website": {
         "url": "https://chromium.googlesource.com/website.git",
-        "rev": "600fc3a0b121d5007b4bb97b001e756625e6d418",
-        "hash": "sha256-f3Tdz0ykxQ2FHbNweJwPdAZHA8eVpjPuxqRpxwhYtRM="
+        "rev": "441c86221443f48e818335d51f84cf1880c35aa4",
+        "hash": "sha256-nMLn2wTAr+3U1VpqWWq93zJHrlT+f1Yky8ONKk0kWjg="
       },
       "src/media/cdm/api": {
         "url": "https://chromium.googlesource.com/chromium/cdm.git",
@@ -862,8 +862,8 @@
       },
       "src/net/third_party/quiche/src": {
         "url": "https://quiche.googlesource.com/quiche.git",
-        "rev": "e7d001c82ee5bead5140481671828d5e156a525a",
-        "hash": "sha256-5YFqWgkyQ/PUKTkk1j3mAFD8JMbI+E4XRdSq34HFMWA="
+        "rev": "25a56e315359eaebb2ff4213771016a4978a346d",
+        "hash": "sha256-ZkrAaNgCqG09CufQN35wFi09TVxvbf/U4jGNNMRLY0M="
       },
       "src/testing/libfuzzer/fuzzers/wasm_corpus": {
         "url": "https://chromium.googlesource.com/v8/fuzzer_wasm_corpus.git",
@@ -877,13 +877,13 @@
       },
       "src/third_party/angle": {
         "url": "https://chromium.googlesource.com/angle/angle.git",
-        "rev": "914c97c116e09ef01a99fbbbe9cd28cda56552c7",
-        "hash": "sha256-Y4eX8YHwVXiXW4U8KGbFd4fTU/v/EAUpfwv6lB127Y4="
+        "rev": "079266db445215380befce453b1ab3bbdfeaf73d",
+        "hash": "sha256-Bcm9wxlLqp/ANg+cPvsuwAlaxVmef6g+12L5ZE4uCGA="
       },
       "src/third_party/angle/third_party/glmark2/src": {
         "url": "https://chromium.googlesource.com/external/github.com/glmark2/glmark2",
-        "rev": "cb550a25c75a99ae0def91a02e16ae29d73e6d1e",
-        "hash": "sha256-kqBpWHCxUl1ekmrbdPn6cL2y75nK4FxECJ5mo83Zgf4="
+        "rev": "6edcf02205fd1e8979dc3f3964257a81959b80c8",
+        "hash": "sha256-VebUALLFKwEa4+oE+jF8mBSzhJd6aflphPmcK1Em8bw="
       },
       "src/third_party/angle/third_party/rapidjson/src": {
         "url": "https://chromium.googlesource.com/external/github.com/Tencent/rapidjson",
@@ -892,8 +892,8 @@
       },
       "src/third_party/angle/third_party/VK-GL-CTS/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/VK-GL-CTS",
-        "rev": "48e7f3020f52ef9adc31aa0f5db01dc42cc487cd",
-        "hash": "sha256-g59uC7feByGR1Ema8LqUCr5XWKpDMeXXvlS2thOo5Ks="
+        "rev": "ba86fb95004331f2cf571dd9adefe2458290ee11",
+        "hash": "sha256-wl/T/WxVNctM4m4VSFFqqtJ0xkEBiuILYywAylqa0Oo="
       },
       "src/third_party/anonymous_tokens/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/anonymous-tokens.git",
@@ -907,13 +907,13 @@
       },
       "src/third_party/dav1d/libdav1d": {
         "url": "https://chromium.googlesource.com/external/github.com/videolan/dav1d.git",
-        "rev": "42b2b24fb8819f1ed3643aa9cf2a62f03868e3aa",
-        "hash": "sha256-qcs9QoZ/uWEQ8l1ChZ8nYctZnnWJ0VvCw1q2rEktC9g="
+        "rev": "7d4b789f55389dad1820d6caf6a650038dad06e2",
+        "hash": "sha256-O6WOm6qTSgRmDR+yY2wH6t+7ob+TtZIA5Gax1ysEZh0="
       },
       "src/third_party/dawn": {
         "url": "https://dawn.googlesource.com/dawn.git",
-        "rev": "7056f50fdefc6bc46aa442e720d0336e2855b570",
-        "hash": "sha256-aYlcplXSGjFov9dqql6d+a1PxJWtZJNQaaezof0u9QQ="
+        "rev": "bdc68b25b620d7302a955e2c38c548ebfe74ef31",
+        "hash": "sha256-R9SQiKUjLkLmPJwuWpw7fcibrWxSlXWkDsCra7Ci0UQ="
       },
       "src/third_party/dawn/third_party/glfw": {
         "url": "https://chromium.googlesource.com/external/github.com/glfw/glfw",
@@ -922,8 +922,8 @@
       },
       "src/third_party/dawn/third_party/dxc": {
         "url": "https://chromium.googlesource.com/external/github.com/microsoft/DirectXShaderCompiler",
-        "rev": "c2ed9ad4ee775f3de903ce757c994aecc59a5306",
-        "hash": "sha256-jecGwARtdSr2OEC68749mpFUAHuYP/IzYUZyj23CwJE="
+        "rev": "0a1143572d107c8b6980df092b84a79190ec1fbd",
+        "hash": "sha256-sUSQTOi0EuIHX9h27RXb5HnbcdfkG/U1K6EbBdjSto8="
       },
       "src/third_party/dawn/third_party/dxheaders": {
         "url": "https://chromium.googlesource.com/external/github.com/microsoft/DirectX-Headers",
@@ -942,8 +942,8 @@
       },
       "src/third_party/dawn/third_party/webgpu-cts": {
         "url": "https://chromium.googlesource.com/external/github.com/gpuweb/cts",
-        "rev": "24d5dfa7725d6ece31941c3f3343ba6362986d6b",
-        "hash": "sha256-AEGYE2rSsPcRzJSm97DGsrPVbhCH+lyVI61Z4qavKc8="
+        "rev": "ce91fc1d085136f9c7ddca684d1764689d49b337",
+        "hash": "sha256-SsxohjLb+uoN5cMXU5DJDrtF1QVk8EWK/qvTLxCleUI="
       },
       "src/third_party/highway/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/highway.git",
@@ -957,8 +957,8 @@
       },
       "src/third_party/boringssl/src": {
         "url": "https://boringssl.googlesource.com/boringssl.git",
-        "rev": "ea42fe28775844ec8fe0444fc421398be42d51fe",
-        "hash": "sha256-g9i5v11uZy/3Smn8zSCFmC27Gdp5VP2b0ROrj+VmP1k="
+        "rev": "673e61fc215b178a90c0e67858bbf162c8158993",
+        "hash": "sha256-8Dl6Aol33o2FYID3oIw9grB0jY9VJnnnhmiNdyycTlU="
       },
       "src/third_party/breakpad/breakpad": {
         "url": "https://chromium.googlesource.com/breakpad/breakpad.git",
@@ -967,13 +967,13 @@
       },
       "src/third_party/cast_core/public/src": {
         "url": "https://chromium.googlesource.com/cast_core/public",
-        "rev": "fbc5e98031e1271a0a566fcd4d9092b2d3275d05",
-        "hash": "sha256-o5/Lbhh6HHSWCVCEyDwDCgs+PLm67si981w0HuIWY7c="
+        "rev": "dcb3d2e87cebe20b6dda06d8b29abb9af27ca422",
+        "hash": "sha256-e8+rQhEU5+FfwjyEE1TM6emO0cUntuS4GN7y/BuC/U8="
       },
       "src/third_party/catapult": {
         "url": "https://chromium.googlesource.com/catapult.git",
-        "rev": "d5166861902b565df446e15181eba270fe168275",
-        "hash": "sha256-xkvz743+w0xsI0w4reAo2rfC4J7opl1biA3eNYuRn+o="
+        "rev": "93e56257a5089dc49f1dfd1240c527f5fe1b237f",
+        "hash": "sha256-K5sOlXx72YmXlm7cc7jWf3lKmHcMdVHTwVueJo5CoHY="
       },
       "src/third_party/ced/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/compact_enc_det.git",
@@ -982,8 +982,8 @@
       },
       "src/third_party/chromium-variations": {
         "url": "https://chromium.googlesource.com/chromium-variations.git",
-        "rev": "84c18c7a0205fbd0a27b0214b16ded7fc44dc062",
-        "hash": "sha256-zXAmoKyj104BaIe4Rug18WbVKkyAsyWPCTPPEerinVo="
+        "rev": "270a25f8795caf0a798ebf5a7d69284e3d830d19",
+        "hash": "sha256-ZkETD+Pka5vItN70nhlGQelycFAEnb1Qfv9k2aDXZSE="
       },
       "src/third_party/cld_3/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/cld_3.git",
@@ -1002,8 +1002,8 @@
       },
       "src/third_party/cpuinfo/src": {
         "url": "https://chromium.googlesource.com/external/github.com/pytorch/cpuinfo.git",
-        "rev": "8a1772a0c5c447df2d18edf33ec4603a8c9c04a6",
-        "hash": "sha256-dKmZ5YXLhvVdxaJ4PefR+SWlh+MTFHNxOMeM6Vj7Gvo="
+        "rev": "aaac07ee499895770c89163ce0920ef8bb41ed23",
+        "hash": "sha256-A86nAbKs7trVwwa1HFUNbV//6O1minvlHTpZR3vabrU="
       },
       "src/third_party/crc32c/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/crc32c.git",
@@ -1012,23 +1012,23 @@
       },
       "src/third_party/cros_system_api": {
         "url": "https://chromium.googlesource.com/chromiumos/platform2/system_api.git",
-        "rev": "ea21b22629965105426f3df5e58190513e95a17e",
-        "hash": "sha256-xUaGf4MaEXg2RHgrGS1Uuz97vq5Vbt4HFV/AXYB4lCA="
+        "rev": "b8d797a61689892adb182c9bec457c9bd24b26d2",
+        "hash": "sha256-44bD1nG7CRrvBcd9NbU4yksn7Ly9WYsWETXat/L3f0I="
       },
       "src/third_party/crossbench": {
         "url": "https://chromium.googlesource.com/crossbench.git",
-        "rev": "0391f0d11cbf3cf3c5bcf82e19e9d9839b1936ed",
-        "hash": "sha256-EL+lOTe1Vzg4JW2q7t3UoXzHHiEmLjf7khH9fXdplbo="
+        "rev": "bf8d1d3aaf469343576db89f81df26aeb16bd62b",
+        "hash": "sha256-XscXxoCUSVGsBCB8xymEsaLc4WgzZPXu6zkRbv8ZQZw="
       },
       "src/third_party/depot_tools": {
         "url": "https://chromium.googlesource.com/chromium/tools/depot_tools.git",
-        "rev": "e42fac3e9c1726ab14a61a25e6291d9ccc49e688",
-        "hash": "sha256-BvEkk15Rm4nSoV/uWiwmQW/+gg2vpLQ187TbBAHl9Rk="
+        "rev": "85ec2718b5a29990c7eb67778348c9f76a00f392",
+        "hash": "sha256-eWlHnSRfLFcd3OoyCTIFewDf0eC9KQowScQOnphgfg8="
       },
       "src/third_party/devtools-frontend/src": {
         "url": "https://chromium.googlesource.com/devtools/devtools-frontend",
-        "rev": "65b3f414b81ffe4df49202af6fc75bc26a3cb109",
-        "hash": "sha256-rdBpJWdQ5VtFnIfbr/Vq1q1euSvkbY8iIqyuTMAS2KM="
+        "rev": "ad4e2fc82183b1463ac870818c28680bbc3de889",
+        "hash": "sha256-HS5O+r0GFe3Dfh+86JQlsEC+5Gcs1xmUkDyZ7qixqXw="
       },
       "src/third_party/dom_distiller_js/dist": {
         "url": "https://chromium.googlesource.com/chromium/dom-distiller/dist.git",
@@ -1037,8 +1037,8 @@
       },
       "src/third_party/eigen3/src": {
         "url": "https://chromium.googlesource.com/external/gitlab.com/libeigen/eigen.git",
-        "rev": "2a35a917be47766a895be610bedd66006980b7e6",
-        "hash": "sha256-WG7uiduuMnXrvEpXJNGksrYkBsim+l7eiu5N+mx0Yr0="
+        "rev": "4c38131a16803130b66266a912029504f2cf23cd",
+        "hash": "sha256-dOq8RJ/V8kulSMK0OUWzHruiwJSP3f/86ih5gk2MMWQ="
       },
       "src/third_party/farmhash/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/farmhash.git",
@@ -1052,8 +1052,8 @@
       },
       "src/third_party/ffmpeg": {
         "url": "https://chromium.googlesource.com/chromium/third_party/ffmpeg.git",
-        "rev": "d10a0f8bf5ddcce572df95105152bc74041cae0c",
-        "hash": "sha256-OXumpRb9XB38dOCJmL3jDcabiJ08wAvydVlJwMgpCoQ="
+        "rev": "fbce2a76c00cd2e5aeffe3c2e71d44c284ec52d6",
+        "hash": "sha256-bGa0BCvzNxEKu9VZEwJ1NLt+b2KKWUxshpKSN2FHNEM="
       },
       "src/third_party/flac": {
         "url": "https://chromium.googlesource.com/chromium/deps/flac.git",
@@ -1080,15 +1080,10 @@
         "rev": "13d57703abca3005d97b19df1f2db731607a7dc2",
         "hash": "sha256-O5wD8wxgis0qYMaY+xZ21GBDVQFphMRvInCOswS6inA="
       },
-      "src/third_party/grpc/src": {
-        "url": "https://chromium.googlesource.com/external/github.com/grpc/grpc.git",
-        "rev": "a363b6c001139b9c8ffb7cd63f60a72f15349c3b",
-        "hash": "sha256-RKGZWtH2JmP2mXN+4ln/nCJvOyzynrYcfrxSY8k1vVg="
-      },
       "src/third_party/freetype/src": {
         "url": "https://chromium.googlesource.com/chromium/src/third_party/freetype2.git",
-        "rev": "b1f47850878d232eea372ab167e760ccac4c4e32",
-        "hash": "sha256-YxWz3O9see1dktqZnC551V12yU5jcOERTB1Hn1lwUNM="
+        "rev": "5d4e649f740c675426fbe4cdaffc53ee2a4cb954",
+        "hash": "sha256-DxLHuzIvw7WIKKMCRBz4ne97j9DufoohXQZV6yZ5zfY="
       },
       "src/third_party/freetype-testing/src": {
         "url": "https://chromium.googlesource.com/external/github.com/freetype/freetype2-testing.git",
@@ -1102,8 +1097,8 @@
       },
       "src/third_party/harfbuzz-ng/src": {
         "url": "https://chromium.googlesource.com/external/github.com/harfbuzz/harfbuzz.git",
-        "rev": "6d8035a99c279e32183ad063f0de201ef1b2f05c",
-        "hash": "sha256-isQvwaVdL4cM465A8Gs06VioAu8RvZFrwXDsXhfOoFo="
+        "rev": "8efd2d85c78fbba6ca09a3e454f77525f3b296ce",
+        "hash": "sha256-/WNGrvyvJ+FGqoIoHapaux1iu63zjID0yR30HYPpxaw="
       },
       "src/third_party/ink/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/ink.git",
@@ -1137,8 +1132,8 @@
       },
       "src/third_party/googletest/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/googletest.git",
-        "rev": "e235eb34c6c4fed790ccdad4b16394301360dcd4",
-        "hash": "sha256-jpXIcz5Uy6fDEvxTq8rTFx/M+0+SQ6TCDaqnp7nMtng="
+        "rev": "24a9e940d481f992ba852599c78bb2217362847b",
+        "hash": "sha256-oLknxClUh7l72ZAx7sxNDM6dUhMT0vUE2IdDjRLDKtk="
       },
       "src/third_party/hunspell_dictionaries": {
         "url": "https://chromium.googlesource.com/chromium/deps/hunspell_dictionaries.git",
@@ -1167,8 +1162,8 @@
       },
       "src/third_party/fuzztest/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/fuzztest.git",
-        "rev": "44ac6c2594a880edbb9cb1e4e197c2b53d078130",
-        "hash": "sha256-AKXKxXqOMUb3APf5r15NmIMyhJ4ZmW5+t7y5XdgdZkw="
+        "rev": "a32ca113e3b050693e4bb379525dfae519ebd0d9",
+        "hash": "sha256-eoV+g/QVzcI7PqDmAic5Ra9K/ba4IV1wXE4RFecuMuk="
       },
       "src/third_party/domato/src": {
         "url": "https://chromium.googlesource.com/external/github.com/googleprojectzero/domato.git",
@@ -1182,18 +1177,18 @@
       },
       "src/third_party/libaom/source/libaom": {
         "url": "https://aomedia.googlesource.com/aom.git",
-        "rev": "3990233fc06a35944d6d33797e63931802122a95",
-        "hash": "sha256-4NOQug0MlWZ18527V3IDuGcxGEJ4b+mZZbdzugWoBgQ="
+        "rev": "99fcd816eeaa7da46688bc4b9f4f9e71be13c2e8",
+        "hash": "sha256-SOIvGkR3k7TAs9KFA3mFbBSq5h4eJghKo38IVioOK3U="
       },
       "src/third_party/crabbyavif/src": {
         "url": "https://chromium.googlesource.com/external/github.com/webmproject/CrabbyAvif.git",
-        "rev": "c5938b119ef52f9ff628436c1e66c9a5322ece83",
-        "hash": "sha256-+6339vcd0KJj5V11dvJvs0YpQpTxsLmDuBoYVzyn9Ec="
+        "rev": "a75457c637a365910508f3c2c2b986a701b03a2e",
+        "hash": "sha256-v3+Rj3jS/lCYZNjjAXB6zohdvM45PKayB43jX37ntsU="
       },
       "src/third_party/nearby/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/nearby-connections.git",
-        "rev": "97690c6996f683a6f3e07d75fc4557958c55ac7b",
-        "hash": "sha256-d1D9/6d7a1+27nD8VijhzRMglE2PqvAMK8+GbMeesSQ="
+        "rev": "45d6317a64aad3d5060b800db267f7cea3f27198",
+        "hash": "sha256-SmU+c9YveQ4N13bteuhtmo0uvySeCnmZYpC5NYiMJuo="
       },
       "src/third_party/beto-core/src": {
         "url": "https://beto-core.googlesource.com/beto-core.git",
@@ -1210,21 +1205,26 @@
         "rev": "d6b5ffea959ad31e231c203d7446bf8b39e987ce",
         "hash": "sha256-lCwGk4Q+OXwO8vOlOQrkgygYqLrwpku/PkR03oEdX3Y="
       },
+      "src/third_party/speedometer/v3.1": {
+        "url": "https://chromium.googlesource.com/external/github.com/WebKit/Speedometer.git",
+        "rev": "cc9ee085ae18f05961ff3dfa1ee1a90d67b7f8ee",
+        "hash": "sha256-28vGPZLaD9xSwursTRRK1xndedeBUZ5TF/4hdy0RjFc="
+      },
       "src/third_party/speedometer/v3.0": {
         "url": "https://chromium.googlesource.com/external/github.com/WebKit/Speedometer.git",
         "rev": "8d67f28d0281ac4330f283495b7f48286654ad7d",
         "hash": "sha256-qMQ4naX+4uUu3vtzzinjkhxX9/dNoTwj6vWCu4FdQmU="
       },
-      "src/third_party/speedometer/v2.0": {
-        "url": "https://chromium.googlesource.com/external/github.com/WebKit/Speedometer.git",
-        "rev": "732af0dfe867f8815e662ac637357e55f285dbbb",
-        "hash": "sha256-p7WUS8gZUaS+LOm7pNmRkwgxjx+V8R6yy7bbaEHaIs4="
-      },
       "src/third_party/speedometer/v2.1": {
         "url": "https://chromium.googlesource.com/external/github.com/WebKit/Speedometer.git",
         "rev": "8bf7946e39e47c875c00767177197aea5727e84a",
         "hash": "sha256-0z5tZlz32fYh9I1ALqfLm2WWO8HiRBwt0hcmgKQhaeM="
       },
+      "src/third_party/speedometer/v2.0": {
+        "url": "https://chromium.googlesource.com/external/github.com/WebKit/Speedometer.git",
+        "rev": "732af0dfe867f8815e662ac637357e55f285dbbb",
+        "hash": "sha256-p7WUS8gZUaS+LOm7pNmRkwgxjx+V8R6yy7bbaEHaIs4="
+      },
       "src/third_party/ukey2/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/ukey2.git",
         "rev": "0275885d8e6038c39b8a8ca55e75d1d4d1727f47",
@@ -1232,8 +1232,8 @@
       },
       "src/third_party/cros-components/src": {
         "url": "https://chromium.googlesource.com/external/google3/cros_components.git",
-        "rev": "1f1c782f06956a2deb5d33f09c466e4852099c71",
-        "hash": "sha256-80WqSMP5Vlc4OY+gfpU3SRGavs7fJbTQVW1AIhq6jmE="
+        "rev": "97dc8c7a1df880206cc54d9913a7e9d73677072a",
+        "hash": "sha256-CT9c4LqTwhldsxoEny8MesULwQC4k95F4tfCtRZErGM="
       },
       "src/third_party/libdrm/src": {
         "url": "https://chromium.googlesource.com/chromiumos/third_party/libdrm.git",
@@ -1267,8 +1267,8 @@
       },
       "src/third_party/libprotobuf-mutator/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/libprotobuf-mutator.git",
-        "rev": "a304ec48dcf15d942607032151f7e9ee504b5dcf",
-        "hash": "sha256-ZyPweW+V5foxFQwjjMLkaRUo+FNV+kEDGIH/4oRV614="
+        "rev": "7bf98f78a30b067e22420ff699348f084f802e12",
+        "hash": "sha256-EaEC6R7SzqLw4QjEcWXFXhZc84lNBp6RSa9izjGnWKE="
       },
       "src/third_party/libsrtp": {
         "url": "https://chromium.googlesource.com/chromium/deps/libsrtp.git",
@@ -1287,8 +1287,8 @@
       },
       "src/third_party/libvpx/source/libvpx": {
         "url": "https://chromium.googlesource.com/webm/libvpx.git",
-        "rev": "7b3fa8114cf8ef23cbf91e50c368c1ca768d95d5",
-        "hash": "sha256-2FgBb0HzgMihGsWbEtQqyN2EXZs/y5+ToWL1ZXG35W0="
+        "rev": "2bfb9f9e0a9cca18cd5a0045e931b49dac390c79",
+        "hash": "sha256-BWid6iU7CDEElh8j13a+S767vwnO8qQg26Vp5nQGEHc="
       },
       "src/third_party/libwebm/source": {
         "url": "https://chromium.googlesource.com/webm/libwebm.git",
@@ -1302,8 +1302,8 @@
       },
       "src/third_party/libyuv": {
         "url": "https://chromium.googlesource.com/libyuv/libyuv.git",
-        "rev": "5a9a6ea936085310f3b9fbd4a774868e6a984ec4",
-        "hash": "sha256-E5ePVHrEXMM8mS1qaUwPTqYO0BdP7TYuUhfX+BCiq/0="
+        "rev": "ccdf870348764e4b77fa3b56accb2a896a901bad",
+        "hash": "sha256-8sH11psWPXLMy3Q0tAizCZ/woUWvTCCUf44jcr2C4Xs="
       },
       "src/third_party/lss": {
         "url": "https://chromium.googlesource.com/linux-syscall-support.git",
@@ -1332,18 +1332,18 @@
       },
       "src/third_party/openh264/src": {
         "url": "https://chromium.googlesource.com/external/github.com/cisco/openh264",
-        "rev": "33f7f48613258446decb33b3575fc0a3c9ed14e3",
-        "hash": "sha256-lZlZjX8GCJOc77VJ9i1fSWn63pfVOEcwwlzh0UpIgy4="
+        "rev": "652bdb7719f30b52b08e506645a7322ff1b2cc6f",
+        "hash": "sha256-tf0lnxATCkoq+xRti6gK6J47HwioAYWnpEsLGSA5Xdg="
       },
       "src/third_party/openscreen/src": {
         "url": "https://chromium.googlesource.com/openscreen",
-        "rev": "38d1445b41d1eb597fcd100688dbaff98aa072ed",
-        "hash": "sha256-KGVFyGp7ItKeapub3Bd+htXH/gMaaBd+k8iC7hLtvl0="
+        "rev": "b756f3c04ba53983a94cd12eb29b7f22e472fd58",
+        "hash": "sha256-P6vAoVF1/geM6MjihcEBQtbf8CxE8sPSKTRLz8/c2yE="
       },
       "src/third_party/openscreen/src/buildtools": {
         "url": "https://chromium.googlesource.com/chromium/src/buildtools",
-        "rev": "56013b77b6c0a650d00bde40e750e7c3b7c6bc3d",
-        "hash": "sha256-Dz7wMYQHVR7sjCGaQe2nxIxZsAxsK6GGDNpDvypPefo="
+        "rev": "00459762409cb29cecf398a23cdb0cae918b7515",
+        "hash": "sha256-QXGJRGyyuN0EPDAF7CAzcTSbjHkz8FRjhqd1JEFF/1o="
       },
       "src/third_party/openscreen/src/third_party/tinycbor/src": {
         "url": "https://chromium.googlesource.com/external/github.com/intel/tinycbor.git",
@@ -1352,23 +1352,23 @@
       },
       "src/third_party/pdfium": {
         "url": "https://pdfium.googlesource.com/pdfium.git",
-        "rev": "12f7715a6390050c5cffb7e4c9b2be1c2f2956d0",
-        "hash": "sha256-/u+HYjmxSIX2GlriEWYZQJ8TDFNfzSufATGq1j9zx9w="
+        "rev": "9afffebfa895ea6cdcc05516908c50bd7fe72797",
+        "hash": "sha256-89rJdhwUJtJCMO7FvVoTYO80swFRkoWUB/ZYs1tOLzE="
       },
       "src/third_party/perfetto": {
         "url": "https://android.googlesource.com/platform/external/perfetto.git",
-        "rev": "0d78d85c2bfb993ab8dd9a85b6fee6caa6a0f357",
-        "hash": "sha256-bjgSwq4LPz9qN9rVqIJUTHetRguCx67Uq5oe1ksPqGE="
+        "rev": "aa4d8267bafad6782a1f2c8d979104f2aaa622a0",
+        "hash": "sha256-smVQykQVZdhybEUz7BlRLc+FVNH0UyGh+0eSxP8Jzrc="
       },
       "src/third_party/protobuf-javascript/src": {
         "url": "https://chromium.googlesource.com/external/github.com/protocolbuffers/protobuf-javascript",
-        "rev": "e34549db516f8712f678fcd4bc411613b5cc5295",
-        "hash": "sha256-TmP6xftUVTD7yML7UEM/DB8bcsL5RFlKPyCpcboD86U="
+        "rev": "426b2e025aa59c23a1b6e19fbacd6b4a11bfad16",
+        "hash": "sha256-5uieIE6ygM4Ooz9xbu1NVKCHHsPn6Ekz6OzqfWiA7/M="
       },
       "src/third_party/pthreadpool/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/pthreadpool.git",
-        "rev": "e1469417238e13eebaa001779fa031ed25c59def",
-        "hash": "sha256-cFRELaRtWspZaqtmdKmVPqM7HVskHlFMAny+Zv/Zflw="
+        "rev": "f94ab76fe99754960035d520dce28e15b647e8cf",
+        "hash": "sha256-NdKKMnXZ6rYOC2wA6a1bPNStxpemzGckN6PPWom6mFA="
       },
       "src/third_party/pyelftools": {
         "url": "https://chromium.googlesource.com/chromiumos/third_party/pyelftools.git",
@@ -1387,8 +1387,8 @@
       },
       "src/third_party/re2/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/re2.git",
-        "rev": "6dcd83d60f7944926bfd308cc13979fc53dd69ca",
-        "hash": "sha256-IeANwJlJl45yf8iu/AZNDoiyIvTCZIeK1b74sdCfAIc="
+        "rev": "c84a140c93352cdabbfb547c531be34515b12228",
+        "hash": "sha256-f/k2rloV2Nwb0KuJGUX4SijFxAx69EXcsXOG4vo+Kis="
       },
       "src/third_party/ruy/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/ruy.git",
@@ -1397,13 +1397,13 @@
       },
       "src/third_party/search_engines_data/resources": {
         "url": "https://chromium.googlesource.com/external/search_engines_data.git",
-        "rev": "6dc3b54b420e6e03a34ee7259fcd2b1978fac5f3",
-        "hash": "sha256-8RY3AU2V4iZKEmVwT7Z1Q3QlcTXDIdeyYwnQoyJcAUY="
+        "rev": "48ba13bfb5488755a5d72aa60ff4a47069be498f",
+        "hash": "sha256-//z0HlMOkGTcp1IjbS0m+0dmgVYsG7EkfCiK2vvG2wU="
       },
       "src/third_party/skia": {
         "url": "https://skia.googlesource.com/skia.git",
-        "rev": "aefbd9403c1b3032ad4cd0281ef312ed262c7125",
-        "hash": "sha256-tP6DnMeOoVqfTSn6bYXMLiCb4wg5f9uB28KzYMAeBUw="
+        "rev": "b99f146a03d3c98049768fd91c2bbe6594b02b2c",
+        "hash": "sha256-tl1GDmcStkuKMmzzsYuRG6Nrk4xDqgYYBoa1VsQNOwY="
       },
       "src/third_party/smhasher/src": {
         "url": "https://chromium.googlesource.com/external/smhasher.git",
@@ -1422,8 +1422,8 @@
       },
       "src/third_party/swiftshader": {
         "url": "https://swiftshader.googlesource.com/SwiftShader.git",
-        "rev": "86cf34f50cbe5a9f35da7eedad0f4d4127fb8342",
-        "hash": "sha256-PSkIU8zC+4AVcYu0vaYo6I1SSykrHgcgGVMBJanux8o="
+        "rev": "c12c13839d689f411911326b1f72e96eb525686c",
+        "hash": "sha256-C8y5ShwMffNZpFuILYNw3WOMVJp/jPen/wNbFl1vqBY="
       },
       "src/third_party/text-fragments-polyfill/src": {
         "url": "https://chromium.googlesource.com/external/github.com/GoogleChromeLabs/text-fragments-polyfill.git",
@@ -1432,18 +1432,18 @@
       },
       "src/third_party/tflite/src": {
         "url": "https://chromium.googlesource.com/external/github.com/tensorflow/tensorflow.git",
-        "rev": "51c6eed226abcfeeb46864e837d01563cc5b907b",
-        "hash": "sha256-qXHENS/6NwHAr1/16eb079XzmwAnpLtVZuva8uGCf+8="
+        "rev": "d120e39920c0e61cc1227bc1abe50fd6ecd3ce66",
+        "hash": "sha256-9p0/tR3bPvCJn+6eofmQXKbyfzxfbeVexdvuHpn50wk="
       },
       "src/third_party/vulkan-deps": {
         "url": "https://chromium.googlesource.com/vulkan-deps",
-        "rev": "2e4b45a53a0e2e66bcb6540ae384c53a517218d0",
-        "hash": "sha256-9ebWETg/fsS4MYZg74XHs/Nz3nX6BXBNVRN2PmyWXWM="
+        "rev": "c1c31f4d17a9e4b2af40d85c89d573eb43187e0d",
+        "hash": "sha256-uEsy4PBhO3EBJF6YdWj32GmMabgKWQJUeW3cWInAinE="
       },
       "src/third_party/glslang/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/glslang",
-        "rev": "0549c7127c2fbab2904892c9d6ff491fa1e93751",
-        "hash": "sha256-LwspMo771iaV5YeEJWgdb8xi37KMa0rsSdvO3uqMOAI="
+        "rev": "8b822ee8ac2c3e52926820f46ad858532a895951",
+        "hash": "sha256-hPd5roeHOgMiz2VUx13bUsKKDSvgQAXRdk7wfdi6e48="
       },
       "src/third_party/spirv-cross/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/SPIRV-Cross",
@@ -1452,38 +1452,38 @@
       },
       "src/third_party/spirv-headers/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/SPIRV-Headers",
-        "rev": "e7294a8ebed84f8c5bd3686c68dbe12a4e65b644",
-        "hash": "sha256-/p7kBW7mwpG/Uz0goMM7L3zjpOMBzGiuN+0ZBEOpORo="
+        "rev": "54a521dd130ae1b2f38fef79b09515702d135bdd",
+        "hash": "sha256-PScDq8HhQPFUs78N75QyL9oEykmjZmAhdxCAqQ0LJds="
       },
       "src/third_party/spirv-tools/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/SPIRV-Tools",
-        "rev": "ce37fd67f83cd1e8793b988d2e4126bbf72b19dd",
-        "hash": "sha256-SJcxmKdzOjg6lOJk/3m8qo7puvtci1YEU6dXKjthx0Q="
+        "rev": "f289d047f49fb60488301ec62bafab85573668cc",
+        "hash": "sha256-2Wv0dxVQ8NvuDRTcsXkH1GKmuA6lsIuwTl0j6kbTefo="
       },
       "src/third_party/vulkan-headers/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Headers",
-        "rev": "39f924b810e561fd86b2558b6711ca68d4363f68",
-        "hash": "sha256-twJJVBfnZbH/8Wn273h45K3BOnlAicqL2zJl6OfLm2E="
+        "rev": "952f776f6573aafbb62ea717d871cd1d6816c387",
+        "hash": "sha256-LfJ7um+rzc4HdkJerHWkuPWeEc7ZFSBafbP+svAjklk="
       },
       "src/third_party/vulkan-loader/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Loader",
-        "rev": "0508dee4ff864f5034ae6b7f68d34cb2822b827d",
-        "hash": "sha256-QqFC3Iyhw9Pq6TwBHxa0Ss7SW0bHo0Uz5N18oxl2ROg="
+        "rev": "809941a4ca137df69dc9c6e8eb456bd70309197c",
+        "hash": "sha256-FPXAofnMfgUkwwRGh8rqtXrmLjouP5A8umXV1pHm1ck="
       },
       "src/third_party/vulkan-tools/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Tools",
-        "rev": "c52931f012cb7b48e42bbf2050a7fb2183b76406",
-        "hash": "sha256-nIzrishMMxWzOuD3aX8B6Iuq2kPsUF0Uuvz7GijTulY="
+        "rev": "fb8f5a5d69f4590ff1f5ecacb5e3957b6d11daee",
+        "hash": "sha256-fO6fkWOMYbf/um7gKFyjtrFE21g1kYx3lLvPv4gY7qw="
       },
       "src/third_party/vulkan-utility-libraries/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Utility-Libraries",
-        "rev": "fe7a09b13899c5c77d956fa310286f7a7eb2c4ed",
-        "hash": "sha256-zI3y5aoP4QcYp677Oxj5Ef7lJyJwOMdGsaRBe+X9vpI="
+        "rev": "2d8f273ebd4b843c402d9ee881616895b854e42f",
+        "hash": "sha256-nD/WTBTwCnfZdwdNKldDVpcuirSghCIeJRBeX+uQXBk="
       },
       "src/third_party/vulkan-validation-layers/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-ValidationLayers",
-        "rev": "a30aa23cfaff4f28f039c025c159128a6c336a7e",
-        "hash": "sha256-foa5hzqf1hPwOj3k57CloCe/j0qXW3zCQ4mwCT4epF4="
+        "rev": "4e7b0c905b1a0401e24333800937cc8792efa037",
+        "hash": "sha256-CCpfWpyGki9klgHInjs6gAhw5shPXlzmFgccCHNfGQY="
       },
       "src/third_party/vulkan_memory_allocator": {
         "url": "https://chromium.googlesource.com/external/github.com/GPUOpen-LibrariesAndSDKs/VulkanMemoryAllocator.git",
@@ -1492,8 +1492,8 @@
       },
       "src/third_party/wasm_tts_engine/src": {
         "url": "https://chromium.googlesource.com/chromium/wasm-tts-engine",
-        "rev": "7a91dbfddd93afa096a69fb7d292e22d4afecad2",
-        "hash": "sha256-bV+1YFEtCyTeZujsZtZiexT/aUTN3MaVerR2UdkUPBY="
+        "rev": "6ab3e63276a2d66ba3e7db4f87c5b7cb00e22130",
+        "hash": "sha256-ZcnKKnHsN1UyztAXClc2EUwfeX3yuLtMM2Zjwpnh62U="
       },
       "src/third_party/wayland/src": {
         "url": "https://chromium.googlesource.com/external/anongit.freedesktop.org/git/wayland/wayland.git",
@@ -1527,8 +1527,8 @@
       },
       "src/third_party/webgpu-cts/src": {
         "url": "https://chromium.googlesource.com/external/github.com/gpuweb/cts.git",
-        "rev": "fb2b951ac3c23e453335edf35c9b3bad431d9009",
-        "hash": "sha256-tjY5ADd5tMFsYHk6xT+TXwsDYV5eI2oOywmyTjjAxYc="
+        "rev": "dcfb0d153f1e19905b0af26e640470c9ec5578e7",
+        "hash": "sha256-726p6OfKAzHtnjz/8WtMcsRxuq4wqyJv3+DHOHDTeYY="
       },
       "src/third_party/webpagereplay": {
         "url": "https://chromium.googlesource.com/webpagereplay.git",
@@ -1537,8 +1537,8 @@
       },
       "src/third_party/webrtc": {
         "url": "https://webrtc.googlesource.com/src.git",
-        "rev": "8d78f5de6c27b2c793039989ea381f1428fb0100",
-        "hash": "sha256-IsjTrEnxIqINYYjWJmDp7rlubl5dJ2YMpJf/DrG/mRM="
+        "rev": "04413d62f754a7b1a3a2d8c3df23bcde040112b2",
+        "hash": "sha256-sFoBgpPeMJQNSjNp8dDEUlB/7lJUpIXTpu0eRq94cGk="
       },
       "src/third_party/wuffs/src": {
         "url": "https://skia.googlesource.com/external/github.com/google/wuffs-mirror-release-c.git",
@@ -1557,18 +1557,18 @@
       },
       "src/third_party/xnnpack/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/XNNPACK.git",
-        "rev": "0824e2965f6edc2297e55c8dff5a8ac4cb12aaad",
-        "hash": "sha256-eb9B9lXPB2GiC4qehB/HOU36W1e9RZ0N2oEbIifyrHE="
+        "rev": "7702e723fa25102db8b633ead4e3c221a5121487",
+        "hash": "sha256-n3FxY4HESzNyccQLENbuisU29v79c2x+7fYOsUrQnFg="
       },
       "src/third_party/zstd/src": {
         "url": "https://chromium.googlesource.com/external/github.com/facebook/zstd.git",
-        "rev": "ea0aa030cdf31f7897c5bfc153f0d36e92768095",
-        "hash": "sha256-UJsuaSzR4V8alLdtxzpla1v9WYHPKPp13YrgA4Y6/yA="
+        "rev": "ef2bf5781112a4cd6b62ac1817f7842bbdc7ea8f",
+        "hash": "sha256-hDDNrUXGxG/o1oZnypAnuLyIeM16Hy6x1KacGu9Hhmw="
       },
       "src/v8": {
         "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "4f282ae4acae85cdcc8c167cbc296a86d24c1cf6",
-        "hash": "sha256-wpz9W/ZurpCT/dGIHGpmdkI3dsXbP8TPNeee2w9zBU8="
+        "rev": "e2591684c45463aa1e46ebefc3fd35deee63f37c",
+        "hash": "sha256-tbGzFdqmkoSiVGk1WMRroWC3NR5GaHRuMwGzPhVodxk="
       }
     }
   }

pkgs/applications/networking/browsers/firefox/wrapper.nix

@@ -405,10 +405,12 @@ let
         + lib.optionalString isDarwin ''
           cd "${appPath}"
 
-          # These files have to be copied and not symlinked, otherwise tabs crash.
+          # The omni.ja files have to be copied and not symlinked, otherwise tabs crash.
           # Maybe related to how omni.ja file is mmapped into memory. See:
           # https://github.com/mozilla/gecko-dev/blob/b1662b447f306e6554647914090d4b73ac8e1664/modules/libjar/nsZipArchive.cpp#L204
-          for file in $(find . -type l -name "omni.ja"); do
+          #
+          # The *.dylib files are copied, otherwise some basic functionality, e.g. Crypto API, is broken.
+          for file in $(find . -name "omni.ja" -o -name "*.dylib"); do
             rm "$file"
             cp "${browser}/${appPath}/$file" "$file"
           done

pkgs/applications/networking/instant-messengers/profanity/default.nix

@@ -37,15 +37,15 @@
   gtk3,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "profanity";
-  version = "0.14.0";
+  version = "0.15.0";
 
   src = fetchFromGitHub {
     owner = "profanity-im";
     repo = "profanity";
-    rev = version;
-    hash = "sha256-u/mp+vtMj602LfrulA+nhLNH8K6sqKIOuPJzhZusVmE=";
+    rev = finalAttrs.version;
+    hash = "sha256-3TmnbTnL8SPSd3seThavOOJVELi8kWLSlZlAub24KZ4=";
   };
 
   patches = [
@@ -106,10 +106,6 @@ stdenv.mkDerivation rec {
     ++ lib.optionals pythonPluginSupport [ "--enable-python-plugins" ]
     ++ lib.optionals omemoSupport [ "--enable-omemo" ];
 
-  preAutoreconf = ''
-    mkdir m4
-  '';
-
   doCheck = true;
 
   LC_ALL = "en_US.utf8";
@@ -126,4 +122,4 @@ stdenv.mkDerivation rec {
     maintainers = [ maintainers.devhell ];
     platforms = platforms.unix;
   };
-}
+})

pkgs/applications/video/obs-studio/plugins/obs-move-transition.nix

@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "obs-move-transition";
-  version = "3.1.1";
+  version = "3.1.2";
 
   src = fetchFromGitHub {
     owner = "exeldro";
     repo = "obs-move-transition";
     rev = version;
-    sha256 = "sha256-kCiRgfpcFdxoK6e8jtrtzkBD4w5B/ilO1YyBHCG13gg=";
+    sha256 = "sha256-BCivYK18T4b+lRo6Qf9qFwmjAyjCPZDekQVi03QBLHc=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/applications/virtualization/docker/default.nix

@@ -360,15 +360,17 @@ rec {
   # Get revisions from
   # https://github.com/moby/moby/tree/${version}/hack/dockerfile/install/*
   docker_25 = callPackage dockerGen rec {
-    version = "25.0.6";
-    cliRev = "v${version}";
-    cliHash = "sha256-7ZKjlONL5RXEJZrvssrL1PQMNANP0qTw4myGKdtd19U=";
+    version = "25.0.8";
+    # Upstream forgot to tag release
+    # https://github.com/docker/cli/issues/5789
+    cliRev = "43987fca488a535d810c429f75743d8c7b63bf4f";
+    cliHash = "sha256-OwufdfuUPbPtgqfPeiKrQVkOOacU2g4ommHb770gV40=";
     mobyRev = "v${version}";
-    mobyHash = "sha256-+zkhUMeVD3HNq8WrWQmLskq+HykvD5kzSACmf67YbJE=";
-    runcRev = "v1.1.12";
-    runcHash = "sha256-N77CU5XiGYIdwQNPFyluXjseTeaYuNJ//OsEUS0g/v0=";
-    containerdRev = "v1.7.20";
-    containerdHash = "sha256-Q9lTzz+G5PSoChy8MZtbOpO81AyNWXC+CgGkdOg14uY=";
+    mobyHash = "sha256-n7GdjQEceqyC7E2sPXQWyxpRThtH35eM/J20yLa5NSs=";
+    runcRev = "v1.2.4";
+    runcHash = "sha256-LdYCMxdqDP7rKo6Ek/B1DE6QvUFrltbSJVggkVkXQZo=";
+    containerdRev = "v1.7.25";
+    containerdHash = "sha256-T0F5bwxSCqa4Czs/W01NaAlJJFvgrzkBC1y/r+muivA=";
     tiniRev = "v0.19.0";
     tiniHash = "sha256-ZDKu/8yE5G0RYFJdhgmCdN3obJNyRWv6K/Gd17zc1sI=";
   };
@@ -393,10 +395,24 @@ rec {
     cliHash = "sha256-7laxRfssh2aGfJeZI0PsJ/MCiy2npigSmCa1SUlWY4s=";
     mobyRev = "v${version}";
     mobyHash = "sha256-q+VCJZ93jvPJQE0xn89prH/6spsarVY3VUEmgwyMxU4=";
-    runcRev = "v1.2.3";
-    runcHash = "sha256-SdeCmPttMXQdIn3kGWsIM3dfhQCx1C5bMyAM889VVUc=";
-    containerdRev = "v1.7.24";
-    containerdHash = "sha256-03vJs61AnTuFAdImZjBfn1izFcoalVJdVs9DZeDcABI=";
+    runcRev = "v1.2.4";
+    runcHash = "sha256-LdYCMxdqDP7rKo6Ek/B1DE6QvUFrltbSJVggkVkXQZo=";
+    containerdRev = "v1.7.25";
+    containerdHash = "sha256-T0F5bwxSCqa4Czs/W01NaAlJJFvgrzkBC1y/r+muivA=";
+    tiniRev = "v0.19.0";
+    tiniHash = "sha256-ZDKu/8yE5G0RYFJdhgmCdN3obJNyRWv6K/Gd17zc1sI=";
+  };
+
+  docker_28 = callPackage dockerGen rec {
+    version = "28.0.4";
+    cliRev = "v${version}";
+    cliHash = "sha256-DLUcmxbCxJs3EA96SGaesA+GzvHq6DC2vrGe5PvA0dE=";
+    mobyRev = "v${version}";
+    mobyHash = "sha256-yvz8MUOU61OuphPaIDu6+1wsbCXkIxJYQKK0fhcVwp0=";
+    runcRev = "v1.2.6";
+    runcHash = "sha256-XMN+YKdQOQeOLLwvdrC6Si2iAIyyHD5RgZbrOHrQE/g=";
+    containerdRev = "v1.7.27";
+    containerdHash = "sha256-H94EHnfW2Z59KcHcbfJn+BipyZiNUvHe50G5EXbrIps=";
     tiniRev = "v0.19.0";
     tiniHash = "sha256-ZDKu/8yE5G0RYFJdhgmCdN3obJNyRWv6K/Gd17zc1sI=";
   };

pkgs/applications/window-managers/hyprwm/hyprland-plugins/hyprsplit.nix

@@ -9,13 +9,13 @@
 }:
 mkHyprlandPlugin hyprland rec {
   pluginName = "hyprsplit";
-  version = "0.48.0";
+  version = "0.48.1";
 
   src = fetchFromGitHub {
     owner = "shezdy";
     repo = "hyprsplit";
     rev = "refs/tags/v${version}";
-    hash = "sha256-FTp5mkrrgo/plCFHuFnx+EtDnQQoChq0mdKpb2a4LrQ=";
+    hash = "sha256-MN7eipww5r/I4tlEPTN6U+RZAkXPyf1YYx/YSCqVmoU=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ab/ab-av1/package.nix

@@ -8,17 +8,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "ab-av1";
-  version = "0.9.3";
+  version = "0.9.4";
 
   src = fetchFromGitHub {
     owner = "alexheretic";
     repo = "ab-av1";
     rev = "v${version}";
-    hash = "sha256-rj02Opkwi4M249Ya4uBl4u1l8Mx+FBcRcxDgD6ng9kg=";
+    hash = "sha256-dDD0hnKov5cgNoc1m/0rG/cx2ZaB7TmLfcXdm8myRUQ=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-Vi38eNn+SnhQx7Gp1T2RPIBeu3bUAZ74dr0mMG5Mha0=";
+  cargoHash = "sha256-01tH5uvfrPIKRv+iYJWm/5QyQZtz1d/nEtN/tmGXD14=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/al/all-the-package-names/package.nix

@@ -7,16 +7,16 @@
 
 buildNpmPackage rec {
   pname = "all-the-package-names";
-  version = "2.0.2117";
+  version = "2.0.2128";
 
   src = fetchFromGitHub {
     owner = "nice-registry";
     repo = "all-the-package-names";
     tag = "v${version}";
-    hash = "sha256-jcExEGUtBMeKesdYVkkJSlJ59HhHZUAqhVvXkJVZp8g=";
+    hash = "sha256-x//g+TetH8wT6RP3W4f+exPOpiTBMTfEIJr2SgxyrmE=";
   };
 
-  npmDepsHash = "sha256-2SrPy3OybchYATCs0bmU1dZGBCKGhto1M1fPk68V/h8=";
+  npmDepsHash = "sha256-MUDeXJk+WqKGEuUlEqb3SUdh3P/gQMWgF78SboksJ2M=";
 
   passthru.updateScript = nix-update-script { };
 

pkgs/by-name/ar/archtika/package.nix

@@ -9,19 +9,19 @@
 }:
 
 let
-  version = "1.2.0";
+  version = "1.2.1";
 
   src = fetchFromGitHub {
     owner = "archtika";
     repo = "archtika";
     tag = "v${version}";
-    hash = "sha256-ba9da7LqCE/e2lhRVHD7GOhwOj1fNTBbN/pARPMzIg4=";
+    hash = "sha256-GffYAtLs12v2Lt1WoKJOG5dZsmzDcySZKFBQwCT9nnY=";
   };
 
   web = buildNpmPackage {
     name = "web-app";
     src = "${src}/web-app";
-    npmDepsHash = "sha256-RTyo7K/Hr1hBGtcBKynrziUInl91JqZl84NkJg16ufA=";
+    npmDepsHash = "sha256-2udi8vLLvdoZxIyRKLOCfEpEMsooxsIrM1wiua1QPAI=";
     npmFlags = [ "--legacy-peer-deps" ];
     installPhase = ''
       mkdir -p $out/web-app
@@ -50,7 +50,10 @@ symlinkJoin {
     api
   ];
 
-  passthru.updateScript = nix-update-script { };
+  passthru = {
+    inherit src web;
+    updateScript = nix-update-script { };
+  };
 
   meta = {
     description = "Modern, performant and lightweight CMS";

pkgs/by-name/ar/arkade/package.nix

@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "arkade";
-  version = "0.11.37";
+  version = "0.11.38";
 
   src = fetchFromGitHub {
     owner = "alexellis";
     repo = "arkade";
     rev = version;
-    hash = "sha256-eo2Kh9b+zQMS/MEiM8cZE0QYUub4zEKFtwBMJnva+Dk=";
+    hash = "sha256-V6ms3Av0/g2S7Q2NLltz7CnnvE1m+cemmwoHKL1e0tM=";
   };
 
   env.CGO_ENABLED = 0;

pkgs/by-name/as/ashell/package.nix

@@ -9,20 +9,22 @@
   pipewire,
   libpulseaudio,
   wayland,
+  udev,
+  vulkan-loader,
 }:
 rustPlatform.buildRustPackage rec {
   pname = "ashell";
-  version = "0.4.0";
+  version = "0.4.1";
 
   src = fetchFromGitHub {
     owner = "MalpenZibo";
     repo = "ashell";
     tag = version;
-    hash = "sha256-a0yvmAq/4TDe+W1FLeLPSLppX81G6fdAOhzDmDJg3II=";
+    hash = "sha256-J97MRYYkNx8Ze4vcxZTDVOSQLCANyIBcDtqZEsEZ80w=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-Vh/+4iApi+03ZmMIDSXc9Mn408v3wC+WlNJsXNcva+Q=";
+  cargoHash = "sha256-XDcCCKq/NOzaKTDwVu0GCeGV70IlJ2TvD0w8ib+lEhg=";
 
   nativeBuildInputs = [
     pkg-config
@@ -33,12 +35,14 @@ rustPlatform.buildRustPackage rec {
   runtimeDependencies = [
     wayland
     libGL
+    vulkan-loader
   ];
 
   buildInputs = [
     libpulseaudio
     libxkbcommon
     pipewire
+    udev
   ] ++ runtimeDependencies;
 
   meta = {

pkgs/by-name/au/autobrr/package.nix

@@ -13,12 +13,12 @@
 
 let
   pname = "autobrr";
-  version = "1.59.0";
+  version = "1.60.0";
   src = fetchFromGitHub {
     owner = "autobrr";
     repo = "autobrr";
     tag = "v${version}";
-    hash = "sha256-etVhOgE8H8bWuraBepwDSZZzo9Xl819w2sT+UwpUVjM=";
+    hash = "sha256-HaNaVxOtlzquKvWmUzUELtv0ZQZ+C/G5ni9/QbOlAh4=";
   };
 
   autobrr-web = stdenvNoCC.mkDerivation {

pkgs/by-name/az/azure-cli/package.nix

@@ -26,14 +26,14 @@
 }:
 
 let
-  version = "2.70.0";
+  version = "2.71.0";
 
   src = fetchFromGitHub {
     name = "azure-cli-${version}-src";
     owner = "Azure";
     repo = "azure-cli";
     rev = "azure-cli-${version}";
-    hash = "sha256-vvX/LkG8qA53AxVlvq7FSTqbVblvE5xbDq4V0SINCAk=";
+    hash = "sha256-vtuDgj3UJCmKxYg0OgG59ezQh7HlscNywz61BHDzJF8=";
   };
 
   # put packages that needs to be overridden in the py package scope

pkgs/by-name/az/azurehound/package.nix

@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "azurehound";
-  version = "2.3.0";
+  version = "2.3.1";
 
   src = fetchFromGitHub {
     owner = "SpecterOps";
     repo = "AzureHound";
     tag = "v${version}";
-    hash = "sha256-BbwQ3u1SD4AjNjHzT6QB0x7QJAZ59m1DtvhjZapLIx4=";
+    hash = "sha256-12ae0y3hjeNPwB33J+XP26h+JfFN5M8+bF8CSon1jp4=";
   };
 
   vendorHash = "sha256-FG3207OTzkMEoSvQsTH7Ky9T3ur7glG7k0ERfd12SO0=";

pkgs/by-name/ba/bashunit/package.nix

@@ -0,0 +1,78 @@
+{
+  stdenvNoCC,
+  lib,
+  fetchFromGitHub,
+  bash,
+  which,
+  versionCheckHook,
+  coreutils,
+  makeBinaryWrapper,
+  nix-update-script,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "bashunit";
+  version = "0.19.0";
+  src = fetchFromGitHub {
+    owner = "TypedDevs";
+    repo = "bashunit";
+    tag = finalAttrs.version;
+    hash = "sha256-EoCCqESzmCW12AuAqA3qh2VcE8gyUPIGJEoCcZhMA/Y=";
+    forceFetchGit = true; # needed to include the tests directory for the check phase
+  };
+
+  nativeBuildInputs = [ makeBinaryWrapper ];
+
+  postConfigure = ''
+    patchShebangs src tests build.sh bashunit
+    substituteInPlace Makefile \
+      --replace-fail "SHELL=/bin/bash" "SHELL=${lib.getExe bash}"
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+    ./build.sh
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    install -m755 -D bin/bashunit $out/bin/bashunit
+    runHook postInstall
+  '';
+
+  # some tests are currently broken on linux and it is not easy to disable them
+  # reenable them after https://github.com/TypedDevs/bashunit/pull/397 has been merged
+  doCheck = false;
+  nativeCheckInputs = [ which ];
+  checkPhase = ''
+    runHook preCheck
+    make test
+    runHook postCheck
+  '';
+
+  postFixup = ''
+    wrapProgram $out/bin/bashunit \
+      --prefix PATH : "${
+        lib.makeBinPath [
+          coreutils
+          which
+        ]
+      }"
+  '';
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+  versionCheckProgramArg = "--version";
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Simple testing framework for bash scripts";
+    homepage = "https://bashunit.typeddevs.com";
+    changelog = "https://github.com/TypedDevs/bashunit/releases/tag/${finalAttrs.version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ tricktron ];
+    mainProgram = "bashunit";
+  };
+})

pkgs/by-name/bi/bird3/package.nix

@@ -11,11 +11,11 @@
 
 stdenv.mkDerivation rec {
   pname = "bird";
-  version = "3.0.1";
+  version = "3.1.0";
 
   src = fetchurl {
     url = "https://bird.network.cz/download/bird-${version}.tar.gz";
-    hash = "sha256-iGhAPKqE4lVLtuYK2+fGV+e7fErEGRDjmPNeI2upD6E=";
+    hash = "sha256-xxY49Xb0MWcEN++dkL6lZZK8VjcB3nhpg/RCJk7Hdiw=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/bl/bluespec/package.nix

@@ -22,7 +22,7 @@
   asciidoctor,
   texliveFull,
   which,
-  makeWrapper,
+  makeBinaryWrapper,
   cctools,
   targetPackages,
   # install -m 644 lib/libstp.dylib /private/tmp/nix-build-bluespec-2024.07.drv-5/source/inst/lib/SAT
@@ -160,15 +160,17 @@ stdenv.mkDerivation rec {
     [
       automake
       autoconf
-      asciidoctor
       bison
       flex
       ghcWithPackages
       perl
       pkg-config
-      texliveFull
       tcl
-      makeWrapper
+      makeBinaryWrapper
+    ]
+    ++ lib.optionals withDocs [
+      texliveFull
+      asciidoctor
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       # https://github.com/B-Lang-org/bsc/blob/main/src/comp/bsc.hs#L1838
@@ -212,12 +214,16 @@ stdenv.mkDerivation rec {
 
   postFixup = ''
     # https://github.com/B-Lang-org/bsc/blob/65e3a87a17f6b9cf38cbb7b6ad7a4473f025c098/src/comp/bsc.hs#L1839
-    wrapProgram $out/bin/bsc --prefix PATH : ${
-      lib.makeBinPath (if stdenv.hostPlatform.isDarwin then [ cctools ] else [ targetPackages.stdenv.cc ])
-    }
+    # `/bin/bsc` is a bash script which the script name to call the binary in the `/bin/core` directory
+    # thus wrapping `/bin/bsc` messes up the scriptname detection in it.
+    wrapProgram $out/bin/core/bsc \
+      --prefix PATH : ${
+        lib.makeBinPath (if stdenv.hostPlatform.isDarwin then [ cctools ] else [ targetPackages.stdenv.cc ])
+      }
   '';
 
   doCheck = true;
+  doInstallCheck = true;
 
   # TODO To fix check-suite:
   # On darwin
@@ -276,6 +282,13 @@ stdenv.mkDerivation rec {
     )
   '';
 
+  installCheckPhase = ''
+    output="$($out/bin/bsc 2>&1 || true)"
+    echo "bsc output:"
+    echo "$output"
+    echo "$output" | grep -q "to get help"
+  '';
+
   meta = {
     description = "Toolchain for the Bluespec Hardware Definition Language";
     homepage = "https://github.com/B-Lang-org/bsc";

pkgs/by-name/ca/cariddi/package.nix

@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "cariddi";
-  version = "1.3.5";
+  version = "1.3.6";
 
   src = fetchFromGitHub {
     owner = "edoardottt";
     repo = "cariddi";
     tag = "v${version}";
-    hash = "sha256-mRrUTRknax3b4hs3frQMzg0GyB3WjMDZJk0RQSAC88U=";
+    hash = "sha256-ixjHPO0FXKbWOfjMVz1YD+wWpL8wcn2CCO46KF1zb0U=";
   };
 
-  vendorHash = "sha256-ML1aLbrYhs2IxnN2ywKFOpvAV6yuYb8GI+dtoxwJl4A=";
+  vendorHash = "sha256-7v92+iDAYG0snJjVCX35rLKV/ZEzaVX2au4HOwa/ILU=";
 
   ldflags = [
     "-w"

pkgs/by-name/cl/claude-code/package-lock.json

@@ -5,13 +5,13 @@
   "packages": {
     "": {
       "dependencies": {
-        "@anthropic-ai/claude-code": "^0.2.59"
+        "@anthropic-ai/claude-code": "^0.2.62"
       }
     },
     "node_modules/@anthropic-ai/claude-code": {
-      "version": "0.2.59",
-      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-0.2.59.tgz",
-      "integrity": "sha512-hcUHEiPUmkgU00J4/1dlLgWvf5ZkWOjMpUrXhMq2o143LOElKuTGxPGt2RtmFHKk6DesFZcV/gabZYkcTqraBw==",
+      "version": "0.2.62",
+      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-0.2.62.tgz",
+      "integrity": "sha512-Mod9/kbqKy344lm5YmDJLn8dR3HYlA2zGCQy4exU7hmECNqg3KlTAz8u4O4YdiRMxXeUJ3Izi9YSJUT7oZOKdg==",
       "hasInstallScript": true,
       "license": "SEE LICENSE IN README.md",
       "bin": {

pkgs/by-name/cl/claude-code/package.nix

@@ -6,14 +6,14 @@
 
 buildNpmPackage rec {
   pname = "claude-code";
-  version = "0.2.59";
+  version = "0.2.62";
 
   src = fetchzip {
     url = "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-${version}.tgz";
-    hash = "sha256-XHHWmDw9qBM4fQ975wSk12hJnr4+1H4AhlNc+IBV3qs=";
+    hash = "sha256-O6jkpx3OxEh/npZjyJb+osoeJrG+HZ6NRB9T4EMkdf8=";
   };
 
-  npmDepsHash = "sha256-KorQlEB90EDE+NIxyUh1apqCDzgrCpwcaOy2mt2mz1s=";
+  npmDepsHash = "sha256-tVA4VbPaPc+KwZzUK0QI9In3QSXXoELaNM2U65wxGGA=";
 
   postPatch = ''
     cp ${./package-lock.json} package-lock.json

pkgs/by-name/co/cobalt/package.nix

@@ -9,17 +9,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cobalt";
-  version = "0.19.8";
+  version = "0.19.9";
 
   src = fetchFromGitHub {
     owner = "cobalt-org";
     repo = "cobalt.rs";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-neOJ3UqRisCcyarRIXfHyl9nAe2Wl9IXVDNwIYEQYys=";
+    hash = "sha256-T88XyrMVCLfhsz3RWD85ErHxAmuTXprOAiS5B8GkH9s=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-j2xmEoMV7lVhqj4lKWA3QdEDEGUpRlZc4ikZoDQJlB8=";
+  cargoHash = "sha256-0BJAbxBbw6wfnDcZkOic13iuWTBEslJ2mQ9nfq+/RXc=";
 
   nativeInstallCheckInputs = [ versionCheckHook ];
   versionCheckProgramArg = "--version";

pkgs/by-name/co/concessio/package.nix

@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "concessio";
-  version = "0.1.9";
+  version = "0.1.10";
 
   src = fetchFromGitHub {
     owner = "ronniedroid";
     repo = "concessio";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-XH+4oEZSKa6lAS0zXxdlCsVJcGDglKSgaD+zoRM6Pws=";
+    hash = "sha256-GDiwpErxz6GiYajcRBOnX0RO1jeaSmpLLxqEsB3nJLA=";
   };
 
   strictDeps = true;

pkgs/by-name/co/copilot-language-server/package.nix

@@ -1,6 +1,7 @@
 {
   lib,
   stdenvNoCC,
+  buildFHSEnv,
   fetchzip,
   nix-update-script,
 }:
@@ -24,8 +25,24 @@ let
     }
     ."${stdenvNoCC.hostPlatform.system}"
       or (throw "Unsupported system: ${stdenvNoCC.hostPlatform.system}");
-in
 
+  executableName = "copilot-language-server";
+  fhs =
+    { package }:
+    buildFHSEnv {
+      name = package.meta.mainProgram;
+      version = package.version;
+      targetPkgs = pkgs: [ pkgs.stdenv.cc.cc.lib ];
+      runScript = lib.getExe package;
+
+      meta = package.meta // {
+        description =
+          package.meta.description
+          + " (FHS-wrapped, expand package details for further information when to use it)";
+        longDescription = "Use this version if you encounter an error like `Could not start dynamically linked executable` or `SyntaxError: Invalid or unexpected token` (see nixpkgs issue [391730](https://github.com/NixOS/nixpkgs/issues/391730)).";
+      };
+    };
+in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "copilot-language-server";
   version = "1.294.0";
@@ -36,18 +53,20 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     stripRoot = false;
   };
 
-  npmDepsHash = "sha256-PLX/mN7xu8gMh2BkkyTncP3+rJ3nBmX+pHxl0ONXbe4=";
   installPhase = ''
     runHook preInstall
 
-    install -Dt "$out"/bin "${os}-${arch}"/copilot-language-server
+    install "${os}-${arch}/${executableName}" -Dm755 -t "$out"/bin
 
     runHook postInstall
   '';
 
   dontStrip = true;
 
-  passthru.updateScript = nix-update-script { };
+  passthru = {
+    updateScript = nix-update-script { };
+    fhs = fhs { package = finalAttrs.finalPackage; };
+  };
 
   meta = {
     description = "Use GitHub Copilot with any editor or IDE via the Language Server Protocol";
@@ -60,7 +79,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
       shortName = "GitHub Copilot License";
       url = "https://github.com/customer-terms/github-copilot-product-specific-terms";
     };
-    mainProgram = "copilot-language-server";
+    mainProgram = executableName;
     platforms = [
       "x86_64-linux"
       "aarch64-linux"

pkgs/by-name/co/cozette/package.nix

@@ -6,13 +6,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "cozette";
-  version = "1.27.0";
+  version = "1.28.0";
 
   src = fetchzip {
     url = "https://github.com/slavfox/Cozette/releases/download/v.${version}/CozetteFonts-v-${
       builtins.replaceStrings [ "." ] [ "-" ] version
     }.zip";
-    hash = "sha256-L/C1fohaLSVbrxAr4v3R83x1/Yt8fI3Lo+c84cZvEHY=";
+    hash = "sha256-KxlChsydFtm26CFugbWqeJi5DQP0BxONSz5mOcyiE28=";
   };
 
   installPhase = ''

pkgs/by-name/cp/cpp-utilities/package.nix

@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "cpp-utilities";
-  version = "5.27.3";
+  version = "5.28.0";
 
   src = fetchFromGitHub {
     owner = "Martchus";
     repo = "cpp-utilities";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-/602rIjPZ6b9bMTpfjKz+XWpAlKoTHyCKUyGIA9qpto=";
+    sha256 = "sha256-EdqM7RsvJzMQWtwqnohbC5JJRVZJYgpTLJW1rPmTB4s=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/by-name/de/descent3-unwrapped/package.nix

@@ -20,11 +20,11 @@ stdenv.mkDerivation rec {
   # the wrapped version of Descent 3. Once there’s a stable version of Descent
   # 3 that supports the -additionaldir command-line option, we can stop using
   # an unstable version of Descent 3.
-  version = "1.5.0-beta-unstable-2025-03-22";
+  version = "1.5.0-beta-unstable-2025-03-25";
   src = fetchFromGitHub {
     owner = "DescentDevelopers";
     repo = "Descent3";
-    rev = "55827d453f835df944b7071ed336ba6a5c30a976";
+    rev = "67244d953588c8c63baa17c150076153c526258b";
     leaveDotGit = true;
     # Descent 3 is supposed to display its Git commit hash in the bottom right
     # corner of the main menu. That feature only works if either the .git
@@ -50,7 +50,7 @@ stdenv.mkDerivation rec {
       git rev-parse --verify HEAD | tr --delete '\n' > git-hash.txt
       rm -r .git
     '';
-    hash = "sha256-RZCkApFwbBtAnBWimupsaTcItwAWNJCntIu6S0UOcyU=";
+    hash = "sha256-lRTzy5GQJ5J9ban7Q6pBmHHXgHNpgemlYYlzmUnvFW0=";
   };
 
   hardeningDisable = [ "format" ];

pkgs/by-name/dp/dprint/plugins/dprint-plugin-json.nix

@@ -1,7 +1,7 @@
 { mkDprintPlugin }:
 mkDprintPlugin {
   description = "JSON/JSONC code formatter.";
-  hash = "sha256-Sw+HkUb4K2wrLuQRZibr8gOCR3Rz36IeId4Vd4LijmY=";
+  hash = "sha256-uFcFLi9aYsBrAqkhFmg9GI+LKiV19LxdNjxQ85EH9To=";
   initConfig = {
     configExcludes = [ "**/*-lock.json" ];
     configKey = "json";
@@ -9,6 +9,6 @@ mkDprintPlugin {
   };
   pname = "dprint-plugin-json";
   updateUrl = "https://plugins.dprint.dev/dprint/json/latest.json";
-  url = "https://plugins.dprint.dev/json-0.19.4.wasm";
-  version = "0.19.4";
+  url = "https://plugins.dprint.dev/json-0.20.0.wasm";
+  version = "0.20.0";
 }

pkgs/by-name/dp/dprint/plugins/dprint-plugin-jupyter.nix

@@ -1,7 +1,7 @@
 { mkDprintPlugin }:
 mkDprintPlugin {
   description = "Jupyter notebook code block formatter.";
-  hash = "sha256-877CEZbMlj9cHkFtl16XCnan37SeEGUL3BHaUKUv8S4=";
+  hash = "sha256-IlGwt2TnKeH9NwmUmU1keaTInXgYQVLIPNnr30A9lsM=";
   initConfig = {
     configExcludes = [ ];
     configKey = "jupyter";
@@ -9,6 +9,6 @@ mkDprintPlugin {
   };
   pname = "dprint-plugin-jupyter";
   updateUrl = "https://plugins.dprint.dev/dprint/jupyter/latest.json";
-  url = "https://plugins.dprint.dev/jupyter-0.1.5.wasm";
-  version = "0.1.5";
+  url = "https://plugins.dprint.dev/jupyter-0.2.0.wasm";
+  version = "0.2.0";
 }

pkgs/by-name/dp/dprint/plugins/dprint-plugin-markdown.nix

@@ -1,7 +1,7 @@
 { mkDprintPlugin }:
 mkDprintPlugin {
   description = "Markdown code formatter.";
-  hash = "sha256-PIEN9UnYC8doJpdzS7M6QEHQNQtj7WwXAgvewPsTjqs=";
+  hash = "sha256-fBy+G+DkJqhrCyyaMjmXRe1VeSeCYO+XmJ8ogwAoptA=";
   initConfig = {
     configExcludes = [ ];
     configKey = "markdown";
@@ -9,6 +9,6 @@ mkDprintPlugin {
   };
   pname = "dprint-plugin-markdown";
   updateUrl = "https://plugins.dprint.dev/dprint/markdown/latest.json";
-  url = "https://plugins.dprint.dev/markdown-0.17.8.wasm";
-  version = "0.17.8";
+  url = "https://plugins.dprint.dev/markdown-0.18.0.wasm";
+  version = "0.18.0";
 }

pkgs/by-name/dp/dprint/plugins/dprint-plugin-toml.nix

@@ -1,7 +1,7 @@
 { mkDprintPlugin }:
 mkDprintPlugin {
   description = "TOML code formatter.";
-  hash = "sha256-4g/nu8Wo7oF+8OAyXOzs9MuGpt2RFGvD58Bafnrr3ZQ=";
+  hash = "sha256-ASbIESaRVC0wtSpjkHbsyD4Hus6HdjjO58aRX9Nrhik=";
   initConfig = {
     configExcludes = [ ];
     configKey = "toml";
@@ -9,6 +9,6 @@ mkDprintPlugin {
   };
   pname = "dprint-plugin-toml";
   updateUrl = "https://plugins.dprint.dev/dprint/toml/latest.json";
-  url = "https://plugins.dprint.dev/toml-0.6.4.wasm";
-  version = "0.6.4";
+  url = "https://plugins.dprint.dev/toml-0.7.0.wasm";
+  version = "0.7.0";
 }

pkgs/by-name/dp/dprint/plugins/dprint-plugin-typescript.nix

@@ -1,7 +1,7 @@
 { mkDprintPlugin }:
 mkDprintPlugin {
   description = "TypeScript/JavaScript code formatter.";
-  hash = "sha256-urgKQOjgkoDJCH/K7DWLJCkD0iH0Ok+rvrNDI0i4uS0=";
+  hash = "sha256-/N6TH5hYsTHJcBWwpz874EDRxBv+SRhyPO8IyN5dzDU=";
   initConfig = {
     configExcludes = [ "**/node_modules" ];
     configKey = "typescript";
@@ -16,6 +16,6 @@ mkDprintPlugin {
   };
   pname = "dprint-plugin-typescript";
   updateUrl = "https://plugins.dprint.dev/dprint/typescript/latest.json";
-  url = "https://plugins.dprint.dev/typescript-0.93.3.wasm";
-  version = "0.93.3";
+  url = "https://plugins.dprint.dev/typescript-0.94.0.wasm";
+  version = "0.94.0";
 }

pkgs/by-name/dp/dprint/plugins/g-plane-malva.nix

@@ -1,7 +1,7 @@
 { mkDprintPlugin }:
 mkDprintPlugin {
   description = "CSS, SCSS, Sass and Less formatter.";
-  hash = "sha256-zt7F1tgPhPAn+gtps6+JB5RtvjIZw2n/G85Bv6kazgU=";
+  hash = "sha256-mFlhfqtglKtKNls96PO/2AWLL1fNC5msQCd9EgdKauE=";
   initConfig = {
     configExcludes = [ "**/node_modules" ];
     configKey = "malva";
@@ -14,6 +14,6 @@ mkDprintPlugin {
   };
   pname = "g-plane-malva";
   updateUrl = "https://plugins.dprint.dev/g-plane/malva/latest.json";
-  url = "https://plugins.dprint.dev/g-plane/malva-v0.11.1.wasm";
-  version = "0.11.1";
+  url = "https://plugins.dprint.dev/g-plane/malva-v0.11.2.wasm";
+  version = "0.11.2";
 }

pkgs/by-name/dp/dprint/plugins/g-plane-markup_fmt.nix

@@ -1,7 +1,7 @@
 { mkDprintPlugin }:
 mkDprintPlugin {
   description = "HTML, Vue, Svelte, Astro, Angular, Jinja, Twig, Nunjucks, and Vento formatter.";
-  hash = "sha256-G8UnJbc+oZ60V3oi8W2SS6H06zEYfY3wpmSUp+1GF8k=";
+  hash = "sha256-fCvurr8f79io/jIjwCfwr/WGjvcKZtptRrx9GFfytSI=";
   initConfig = {
     configExcludes = [ ];
     configKey = "markup";
@@ -19,6 +19,6 @@ mkDprintPlugin {
   };
   pname = "g-plane-markup_fmt";
   updateUrl = "https://plugins.dprint.dev/g-plane/markup_fmt/latest.json";
-  url = "https://plugins.dprint.dev/g-plane/markup_fmt-v0.18.0.wasm";
-  version = "0.18.0";
+  url = "https://plugins.dprint.dev/g-plane/markup_fmt-v0.19.0.wasm";
+  version = "0.19.0";
 }

pkgs/by-name/er/erlang-language-platform/package.nix

@@ -14,14 +14,14 @@ let
 
   hashes = {
     linux-aarch64-unknown-linux-gnu = "sha256-i6XsOK8csrJ/9TDzltA7mGjdutLZONFiYGV5tqSCy8o=";
-    linux-x86_64-unknown-linux-gnu = "sha256-gBIzG0LaP9qxivkr47JpBu1z9km7o/1Wppk/6k2WslE=";
+    linux-x86_64-unknown-linux-gnu = "sha256-XK3DPWIdPDoIL10EATa8p1bnlpZaOzOdU0LnuKbj++E=";
     macos-aarch64-apple-darwin = "sha256-8e5duQYDVFyZejMjuZPuWhg1on3CBku9eBuilG5p1BY=";
     macos-x86_64-apple-darwin = "sha256-dnouUBUUAkMr1h+IJWYamxmk8IC7JdeIUS9/YI0GzOU=";
   };
 in
 stdenv.mkDerivation rec {
   pname = "erlang-language-platform";
-  version = "2025-02-13";
+  version = "2025-04-02";
 
   src = fetchurl {
     url = "https://github.com/WhatsApp/erlang-language-platform/releases/download/${version}/elp-${release}-otp-26.2.tar.gz";

pkgs/by-name/fa/fabric-installer/package.nix

@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation rec {
   pname = "fabric-installer";
-  version = "1.0.1";
+  version = "1.0.3";
 
   src = fetchurl {
     url = "https://maven.fabricmc.net/net/fabricmc/fabric-installer/${version}/fabric-installer-${version}.jar";
-    sha256 = "sha256-Yu3xcL3MQe3qhdM6zz64VHQlhpmz1B+UGNKGyDbLCI0=";
+    sha256 = "sha256-OKqCqx74KbeqPyFD/Mk7unBqjhiDW+cx0P3yMdJ0sH8=";
   };
 
   dontUnpack = true;

pkgs/by-name/fa/fangfrisch/package.nix

@@ -4,7 +4,7 @@
   fetchFromGitHub,
 }:
 let
-  version = "1.9.0";
+  version = "1.9.2";
 in
 python3.pkgs.buildPythonApplication {
   pname = "fangfrisch";
@@ -15,7 +15,7 @@ python3.pkgs.buildPythonApplication {
     owner = "rseichter";
     repo = "fangfrisch";
     tag = version;
-    hash = "sha256-B2fVXVYzrtWMh/WjgFBOqrq8Jt+jqudbtpY/w4rJG08=";
+    hash = "sha256-8upIh9Z+ismvuKcuEe+gJ4W9NLw/Wq15zjFpy8X9yVo=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/fl/fly/package.nix

@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "fly";
-  version = "7.12.1";
+  version = "7.13.0";
 
   src = fetchFromGitHub {
     owner = "concourse";
     repo = "concourse";
     rev = "v${version}";
-    hash = "sha256-3RsFtU2C3XxBddyW5liAwia9I7Fc8f2+TsziiJy6rHg=";
+    hash = "sha256-myvYACdTqnEb8aBpBeCA1qvcnF0lwYbSo6kMgSz7iiA=";
   };
 
-  vendorHash = "sha256-up77TV/A/C39LjgQ+1uQExWfMlbruLhY3H6820cRnt0=";
+  vendorHash = "sha256-WC4uzTgvW15IumwmsWXXeiF5qagbeb5XWRaSjd1XLvA=";
 
   subPackages = [ "fly" ];
 

pkgs/by-name/ge/geant4/package.nix

@@ -38,12 +38,12 @@ let
 in
 
 stdenv.mkDerivation rec {
-  version = "11.3.0";
+  version = "11.3.1";
   pname = "geant4";
 
   src = fetchurl {
     url = "https://cern.ch/geant4-data/releases/geant4-v${version}.tar.gz";
-    hash = "sha256-HaQxiz+W+H9NR1WKMtqyabjz/JVnCAOMKOcqGAsO+6Y=";
+    hash = "sha256-yTyplvbzWqQ/lI/8q6lgNGjfAd7rYvYcM7p2kifDGf4=";
   };
 
   # Fix broken paths in a .pc

pkgs/by-name/gi/giza/package.nix

@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "giza";
-  version = "1.4.4";
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     owner = "danieljprice";
     repo = "giza";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-FlD+emPrdXYmalHqQ6jKmkZudyLtlbeHtUOjT/D6UOA=";
+    hash = "sha256-tNz0Lh6bzQPxsd/Vz3jh8u0JiRXT0O43hyfgbGTJUeE=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/go/go-judge/package.nix

@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "go-judge";
-  version = "1.9.2";
+  version = "1.9.3";
 
   src = fetchFromGitHub {
     owner = "criyle";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-4KBMDqHw8EJGSDK9+jCZvaxkQymhw4RRGByrFngiIug=";
+    hash = "sha256-AmbhfCKUpvZt/me73EhBQqw8yDnItn1zKiemf/JRz24=";
   };
 
-  vendorHash = "sha256-FnX3u6DLB9qPE4+Hy/+00mD4U/6Pa+CsZoEroi7cNO0=";
+  vendorHash = "sha256-eUtkelLucf11ANT6vkWuBOaL5bgb+9D8YsVsZTMMjmg=";
 
   tags = [
     "nomsgpack"

pkgs/by-name/go/gojq/package.nix

@@ -4,6 +4,7 @@
   fetchFromGitHub,
   testers,
   gojq,
+  installShellFiles,
 }:
 
 buildGoModule rec {
@@ -24,6 +25,12 @@ buildGoModule rec {
     "-w"
   ];
 
+  nativeBuildInputs = [ installShellFiles ];
+
+  postInstall = ''
+    installShellCompletion --cmd gojq --zsh _gojq
+  '';
+
   passthru.tests.version = testers.testVersion {
     package = gojq;
   };

pkgs/by-name/go/gosec/package.nix

@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "gosec";
-  version = "2.22.2";
+  version = "2.22.3";
 
   src = fetchFromGitHub {
     owner = "securego";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-j9MRMtINGPn4Hn9Z3+19/Q+Weu277WVONXKtJf9x5Cc=";
+    hash = "sha256-MQ/dDK2t9H7bSsr5MMtlKySLAJIDimRbpATHyOYxrBo=";
   };
 
-  vendorHash = "sha256-lZFTmf4/J3NDdawfp2WpPoaVxepbyazIyC8ahOwPcZo=";
+  vendorHash = "sha256-R1w+dHx3Aond6DmwCHRVZXmUABWfpsbLgcDW67Ukz0E=";
 
   subPackages = [
     "cmd/gosec"

pkgs/by-name/gp/gpupad/glslang-use-combined-lib.patch

@@ -0,0 +1,15 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index a05c447..20a5c98 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -276,8 +276,8 @@ endif()
+ 
+ # link glslang
+ find_package(glslang CONFIG REQUIRED)
+-target_link_libraries(${PROJECT_NAME} PRIVATE glslang::OSDependent glslang::glslang 
+-    glslang::MachineIndependent glslang::GenericCodeGen glslang::glslang-default-resource-limits 
++target_link_libraries(${PROJECT_NAME} PRIVATE glslang::glslang 
++    glslang::glslang-default-resource-limits 
+     glslang::SPVRemapper glslang::SPIRV)
+ 
+ # link SPIRV-Cross

pkgs/by-name/gp/gpupad/package.nix

@@ -0,0 +1,63 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+
+  glslang,
+  imath,
+  ktx-tools,
+  openimageio,
+  qt6Packages,
+  spdlog,
+  spirv-cross,
+  vulkan-memory-allocator,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "gpupad";
+  version = "2.4.0";
+
+  src = fetchFromGitHub {
+    owner = "houmain";
+    repo = "gpupad";
+    tag = finalAttrs.version;
+    hash = "sha256-yCoLvocfqYOwbsGn2r3+2iThDZCkRAUrNI71fIH7XXU=";
+    fetchSubmodules = true;
+  };
+
+  patches = [
+    # the current version of glslang no longer separates its libs into sublibs
+    ./glslang-use-combined-lib.patch
+  ];
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    cmake
+    qt6Packages.wrapQtAppsHook
+  ];
+
+  buildInputs = [
+    glslang
+    imath # needed for openimageio
+    ktx-tools
+    openimageio
+    qt6Packages.qtbase
+    qt6Packages.qtdeclarative
+    qt6Packages.qtmultimedia
+    spdlog
+    spirv-cross
+    vulkan-memory-allocator
+  ];
+
+  meta = {
+    description = "Flexible GLSL and HLSL shader editor and IDE";
+    homepage = "https://github.com/houmain/gpupad";
+    changelog = "https://github.com/houmain/gpupad/blob/${finalAttrs.src.rev}/CHANGELOG.md";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ tomasajt ];
+    mainProgram = "gpupad";
+    platforms = lib.platforms.linux;
+  };
+})

pkgs/by-name/gr/grafana-loki/package.nix

@@ -12,14 +12,14 @@
 }:
 
 buildGoModule rec {
-  version = "3.4.2";
+  version = "3.4.3";
   pname = "grafana-loki";
 
   src = fetchFromGitHub {
     owner = "grafana";
     repo = "loki";
     rev = "v${version}";
-    hash = "sha256-GE92NlFCOk6qFtrgeBvLDI0OkmWaJ1j07Q14+jgi9+w=";
+    hash = "sha256-1tI9X2eIKuWEWJBbN4UAw8yeRrjgfqcenJyTNMk5rqU=";
   };
 
   vendorHash = null;

pkgs/by-name/gr/gretl/package.nix

@@ -62,7 +62,7 @@ stdenv.mkDerivation (finalAttrs: {
       gretl is a cross-platform software package for econometric analysis,
       written in the C programming language.
     '';
-    maintainers = with lib.maintainers; [ dmrauh ];
+    maintainers = with lib.maintainers; [ ];
     platforms = lib.platforms.all;
   };
 })

pkgs/by-name/hy/hyprprop/package.nix

@@ -14,13 +14,13 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "hyprprop";
-  version = "0.1-unstable-2025-03-17";
+  version = "0.1-unstable-2025-03-31";
 
   src = fetchFromGitHub {
     owner = "hyprwm";
     repo = "contrib";
-    rev = "bd81329944be53b0ffb99e05864804b95f1d7c65";
-    hash = "sha256-I8JVdQRu8eWvY5W8XWYZkdd5pojDHkxeqQV7mMIsbhs=";
+    rev = "bc2ad24e0b2e66c3e164994c4897cd94a933fd10";
+    hash = "sha256-YItzk1pj8Kz+b7VlC9zN1pSZ6CuX35asYy3HuMQ3lBQ=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/hyprprop";

pkgs/by-name/in/incus/docs.patch

@@ -0,0 +1,26 @@
+diff --git i/doc/conf.py w/doc/conf.py
+index 8d042818b..b4f0572bd 100644
+--- i/doc/conf.py
++++ w/doc/conf.py
+@@ -8,10 +8,6 @@ import yaml
+ from git import Repo
+ import filecmp
+ 
+-# Download and link swagger-ui files
+-if not os.path.isdir('.sphinx/deps/swagger-ui'):
+-    Repo.clone_from('https://github.com/swagger-api/swagger-ui', '.sphinx/deps/swagger-ui', depth=1)
+-
+ os.makedirs('.sphinx/_static/swagger-ui/', exist_ok=True)
+ 
+ if not os.path.islink('.sphinx/_static/swagger-ui/swagger-ui-bundle.js'):
+@@ -151,10 +147,6 @@ if os.path.exists("./related_topics.yaml"):
+     with open("./related_topics.yaml", "r") as fd:
+         myst_substitutions.update(yaml.safe_load(fd.read()))
+ 
+-intersphinx_mapping = {
+-    'cloud-init': ('https://cloudinit.readthedocs.io/en/latest/', None)
+-}
+-
+ if ("LOCAL_SPHINX_BUILD" in os.environ) and (os.environ["LOCAL_SPHINX_BUILD"] == "True"):
+     swagger_url_scheme = "/api/#{{path}}"
+ else:

pkgs/by-name/in/incus/generic.nix

@@ -13,6 +13,7 @@
   buildGoModule,
   fetchFromGitHub,
   acl,
+  buildPackages,
   cowsql,
   incus-ui-canonical,
   libcap,
@@ -27,11 +28,30 @@
 
 let
   pname = "incus${lib.optionalString lts "-lts"}";
+  docsPython = buildPackages.python3.withPackages (
+    py: with py; [
+      furo
+      gitpython
+      linkify-it-py
+      canonical-sphinx-extensions
+      myst-parser
+      pyspelling
+      sphinx
+      sphinx-autobuild
+      sphinx-copybutton
+      sphinx-design
+      sphinx-notfound-page
+      sphinx-remove-toctrees
+      sphinx-reredirects
+      sphinx-tabs
+      sphinxcontrib-jquery
+      sphinxext-opengraph
+    ]
+  );
 in
 
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   inherit
-    patches
     pname
     vendorHash
     version
@@ -40,15 +60,18 @@ buildGoModule rec {
   outputs = [
     "out"
     "agent_loader"
+    "doc"
   ];
 
   src = fetchFromGitHub {
     owner = "lxc";
     repo = "incus";
-    rev = "refs/tags/v${version}";
+    tag = "v${version}";
     inherit hash;
   };
 
+  patches = [ ./docs.patch ] ++ patches;
+
   excludedPackages = [
     # statically compile these
     "cmd/incus-agent"
@@ -61,6 +84,7 @@ buildGoModule rec {
   nativeBuildInputs = [
     installShellFiles
     pkg-config
+    docsPython
   ];
 
   buildInputs = [
@@ -82,6 +106,13 @@ buildGoModule rec {
   CGO_LDFLAGS_ALLOW = "(-Wl,-wrap,pthread_create)|(-Wl,-z,now)";
 
   postBuild = ''
+    # build docs
+    mkdir -p .sphinx/deps
+    ln -s ${buildPackages.python3.pkgs.swagger-ui-bundle.src} .sphinx/deps/swagger-ui
+    substituteInPlace Makefile --replace-fail '. $(SPHINXENV) ; ' ""
+    make doc-incremental
+
+    # build some static executables
     make incus-agent incus-migrate
   '';
 
@@ -111,18 +142,20 @@ buildGoModule rec {
     cp internal/server/instance/drivers/agent-loader/systemd/incus-agent.service $agent_loader/etc/systemd/system/
     cp internal/server/instance/drivers/agent-loader/systemd/incus-agent.rules $agent_loader/lib/udev/rules.d/99-incus-agent.rules
     substituteInPlace $agent_loader/etc/systemd/system/incus-agent.service --replace-fail 'TARGET/systemd' "$agent_loader/bin"
+
+    mkdir $doc
+    cp -R doc/html $doc/
   '';
 
   passthru = {
     client = callPackage ./client.nix {
       inherit
         lts
-        meta
         patches
-        src
         vendorHash
         version
         ;
+      inherit (finalAttrs) meta src;
     };
 
     tests = if lts then nixosTests.incus-lts.all else nixosTests.incus.all;
@@ -143,4 +176,4 @@ buildGoModule rec {
     platforms = lib.platforms.linux;
     mainProgram = "incus";
   };
-}
+})

pkgs/by-name/jn/jnv/package.nix

@@ -2,39 +2,38 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
-  stdenv,
-  darwin,
+  versionCheckHook,
+  nix-update-script,
 }:
-rustPlatform.buildRustPackage rec {
+
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "jnv";
   version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "ynqa";
     repo = "jnv";
-    rev = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-HKZ+hF5Y7vTA4EODSAd9xYJHaipv5YukTl470ejPLtM=";
   };
 
   useFetchCargoVendor = true;
   cargoHash = "sha256-VLVoURqmUhhekNZ0a75bwjvSiLfaQ79IlltbmWVyBrI=";
 
-  buildInputs = lib.optional stdenv.hostPlatform.isDarwin (
-    with darwin.apple_sdk.frameworks;
-    [
-      CoreGraphics
-      AppKit
-    ]
-  );
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
 
-  meta = with lib; {
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
     description = "Interactive JSON filter using jq";
     mainProgram = "jnv";
     homepage = "https://github.com/ynqa/jnv";
-    license = with licenses; [ mit ];
-    maintainers = with maintainers; [
+    license = with lib.licenses; [ mit ];
+    maintainers = with lib.maintainers; [
       nealfennimore
       nshalman
     ];
   };
-}
+})