Merge 0242d91e5d into haskell-updates

2026-03-20 00:29:02 +00:00
parent 196a4db5b5 0242d91e5d
commit e1dd933dfb
201 changed files with 4917 additions and 950 deletions
@@ -8402,6 +8402,12 @@
    githubId = 55919390;
    name = "Vincent VILLIAUMEY";
  };
+  eyenx = {
+    email = "eye@eyenx.ch";
+    github = "eyenx";
+    githubId = 1947882;
+    name = "Toni Tauro";
+  };
  eyjhb = {
    email = "eyjhbb@gmail.com";
    matrix = "@eyjhb:eyjhb.dk";
@@ -8476,12 +8482,6 @@
    githubId = 116184;
    keys = [ { fingerprint = "2F6C 930F D3C4 7E38 6AFA  4EB4 E23C D2DD 36A4 397F"; } ];
  };
-  fabiangd = {
-    email = "fabian.g.droege@gmail.com";
-    name = "Fabian G. Dröge";
-    github = "FabianGD";
-    githubId = 40316600;
-  };
  fabianhauser = {
    email = "fabian.nixos@fh2.ch";
    github = "fabianhauser";
@@ -14255,9 +14255,9 @@
    name = "Kira";
  };
  koi = {
-    name = "koi";
+    name = "june";
    email = "me@koi.rip";
-    matrix = "@koi:system72.dev";
+    matrix = "@koi:nelliel.cv";
    github = "koibtw";
    githubId = 75480869;
    keys = [
@@ -28746,6 +28746,12 @@
    githubId = 988849;
    name = "Vasiliy Yorkin";
  };
+  VZstless = {
+    name = "VZstless";
+    email = "i@vzstless.moe";
+    github = "atlarator";
+    githubId = 233668878;
+  };
  w-lfchen = {
    email = "w-lfchen@posteo.net";
    github = "w-lfchen";
@@ -48,6 +48,7 @@ lrexlib-oniguruma,,,,,,junestepp
 lrexlib-pcre,,,,,,
 lrexlib-posix,,,,,,
 lsp-progress.nvim,,,,,5.1,gepbird
+lsqlite3,,,,,,
 lua-cjson,,,,,,
 lua-cmsgpack,,,,,,
 lua-curl,,,,,,
@@ -113,6 +114,7 @@ lzextras,,,,,,birdee
 lzn-auto-require,,,,,,mrcjkb
 magick,,,,,5.1,donovanglover
 markdown,,,,,,
+md5,,,,,,
 mediator_lua,,,,,,
 middleclass,,,,,,
 mimetypes,,,,,,
@@ -158,6 +160,7 @@ toml-edit,,,,,5.1,mrcjkb
 tree-sitter-http,,,,0.0.33-1,,
 tree-sitter-norg,,,,,5.1,mrcjkb
 tree-sitter-orgmode,,,,,5.1,
+utf8,,,,,,
 vstruct,,,,,,
 vusted,,,,,,
 xml2lua,,,,,,teto
@@ -14,6 +14,8 @@
  designed to run on affordable, low-power devices. Available as [services.meshtasticd]
  (#opt-services.meshtasticd.enable).

+- [Goupile](https://goupile.org/en), an open-source design tool for secure forms including Clinical Report Forms (eCRF). Available as [services.goupile](#opt-services.goupile.enable).
+
 - [knot-resolver](https://www.knot-resolver.cz/) in version 6. Available as `services.knot-resolver`. A module for knot-resolver 5 was already available as `services.kresd`.

 - [ImmichFrame](https://immichframe.dev/), display your photos from Immich as a digital photo frame. Available as `services.immichframe`.
@@ -1651,6 +1651,7 @@
  ./services/web-apps/goatcounter.nix
  ./services/web-apps/gotify-server.nix
  ./services/web-apps/gotosocial.nix
+  ./services/web-apps/goupile.nix
  ./services/web-apps/grav.nix
  ./services/web-apps/grocy.nix
  ./services/web-apps/guacamole-client.nix
@@ -298,7 +298,6 @@ in
        let
          enabledTables = lib.filterAttrs (_: table: table.enable) cfg.tables;
          deletionsScript = pkgs.writeScript "nftables-deletions" ''
-            #! ${pkgs.nftables}/bin/nft -f
            ${
              if cfg.flushRuleset then
                "flush ruleset"
@@ -313,9 +312,9 @@ in
            ${cfg.extraDeletions}
          '';
          deletionsScriptVar = "/var/lib/nftables/deletions.nft";
+          makeDeletions = "${pkgs.nftables}/bin/nft -f ${deletionsScriptVar}";
          ensureDeletions = pkgs.writeShellScript "nftables-ensure-deletions" ''
            touch ${deletionsScriptVar}
-            chmod +x ${deletionsScriptVar}
          '';
          saveDeletionsScript = pkgs.writeShellScript "nftables-save-deletions" ''
            cp ${deletionsScript} ${deletionsScriptVar}
@@ -380,7 +379,7 @@ in
            saveDeletionsScript
          ];
          ExecStop = [
-            deletionsScriptVar
+            makeDeletions
            cleanupDeletionsScript
          ];
          StateDirectory = "nftables";
@@ -37,31 +37,7 @@ in
    };

    scheduler = lib.mkOption {
-      type = lib.types.enum [
-        "scx_beerland"
-        "scx_bpfland"
-        "scx_chaos"
-        "scx_cosmos"
-        "scx_central"
-        "scx_flash"
-        "scx_flatcg"
-        "scx_lavd"
-        "scx_layered"
-        "scx_mitosis"
-        "scx_nest"
-        "scx_p2dq"
-        "scx_pair"
-        "scx_prev"
-        "scx_qmap"
-        "scx_rlfifo"
-        "scx_rustland"
-        "scx_rusty"
-        "scx_sdt"
-        "scx_simple"
-        "scx_tickless"
-        "scx_userland"
-        "scx_wd40"
-      ];
+      type = lib.types.enum cfg.package.schedulers;
      default = "scx_rustland";
      example = "scx_bpfland";
      description = ''
@@ -126,5 +102,6 @@ in

  meta = {
    inherit (pkgs.scx.full.meta) maintainers;
+    buildDocsInSandbox = false;
  };
 }
@@ -27,6 +27,8 @@ in

      package = lib.mkPackageOption pkgs "calibre-web" { };

+      calibrePackage = lib.mkPackageOption pkgs "calibre" { };
+
      listen = {
        ip = mkOption {
          type = types.str;
@@ -149,8 +151,8 @@ in
            cfg.options.calibreLibrary != null
          ) "config_calibre_dir = '${cfg.options.calibreLibrary}'"
          ++ optionals cfg.options.enableBookConversion [
-            "config_converterpath = '${pkgs.calibre}/bin/ebook-convert'"
-            "config_binariesdir = '${pkgs.calibre}/bin/'"
+            "config_converterpath = '${cfg.calibrePackage}/bin/ebook-convert'"
+            "config_binariesdir = '${cfg.calibrePackage}/bin/'"
          ]
          ++ optional cfg.options.enableKepubify "config_kepubifypath = '${pkgs.kepubify}/bin/kepubify'"
        );
@@ -0,0 +1,147 @@
+{
+  lib,
+  pkgs,
+  config,
+  ...
+}:
+let
+  cfg = config.services.goupile;
+  settingsFormat = pkgs.formats.ini { };
+in
+{
+  options.services.goupile = {
+    enable = lib.mkEnableOption "Goupile server";
+    package = lib.mkPackageOption pkgs "goupile" { };
+
+    enableSandbox = lib.mkOption {
+      type = lib.types.bool;
+      default = true;
+      description = "Enable the sandbox option.";
+    };
+
+    settings = lib.mkOption {
+      type = lib.types.submodule {
+        freeformType = settingsFormat.type;
+        options = {
+          HTTP.Port = lib.mkOption {
+            type = lib.types.port;
+            default = 8889;
+            description = "The port goupile runs on";
+          };
+          Data.RootDirectory = lib.mkOption {
+            type = lib.types.str;
+            default = "/var/lib/goupile";
+            description = "Goupile's data directory.";
+          };
+        };
+      };
+      default = { }; # default will be lost for submodules if overriden
+      example = lib.literalExpression ''
+        {
+          HTTP.Port = 8888;
+        }
+      '';
+      description = ''
+        The options for `systemd.services.goupile` in ini format.
+
+        The configuration options available can be found here
+        https://github.com/Koromix/rygel/blob/goupile/3.11.1/src/goupile/server/admin.cc#L41
+      '';
+    };
+
+    configFile = lib.mkOption {
+      type = lib.types.path;
+      description = ''
+        The configuration file to be passed to goupile server.
+
+        By default the configuration file is created from `services.goupile.settings`.
+      '';
+    };
+
+    hostName = lib.mkOption {
+      type = lib.types.str;
+      default = "goupile";
+      description = "Nginx service name for goupile service.";
+    };
+  };
+  config = lib.mkIf cfg.enable (
+    lib.mkMerge [
+      {
+        services.nginx = {
+          enable = lib.mkDefault true;
+          virtualHosts.${cfg.hostName} = {
+            locations."/".proxyPass = "http://${cfg.hostName}:${builtins.toString cfg.settings.HTTP.Port}";
+          };
+        };
+      }
+      {
+        services.goupile.configFile = settingsFormat.generate "goupile.ini" cfg.settings;
+      }
+      {
+        systemd.services.goupile = {
+          wants = [ "network-online.target" ];
+          after = [ "network-online.target" ];
+          wantedBy = [ "multi-user.target" ];
+
+          documentation = [ "https://goupile.org/en" ];
+          description = "Goupile eCRF";
+
+          serviceConfig = {
+            ExecStart = ''
+              ${lib.getExe cfg.package} \
+                ${lib.optionalString cfg.enableSandbox "--sandbox"} \
+                -C ${cfg.configFile}
+            '';
+
+            DynamicUser = true;
+
+            RuntimeDirectory = "goupile";
+            RuntimeDirectoryPreserve = "yes";
+            StateDirectory = "goupile";
+            UMask = 0077;
+            WorkingDirectory = "%S/goupile";
+
+            SystemCallArchitectures = "native";
+            SystemCallFilter = [
+              "~@privileged"
+              "~@resources"
+              "~@obsolete"
+              "~@mount"
+              "@system-service"
+              "@file-system"
+              "@basic-io"
+              "@clock"
+            ];
+
+            ProtectHome = true;
+            PrivateUsers = true;
+            PrivateDevices = true;
+            ProtectKernelLogs = true;
+            ProtectControlGroups = true;
+            ProtectKernelModules = true;
+
+            CapabilityBoundingSet = [
+              "CAP_SYS_PTRACE"
+              "CAP_CHOWN"
+              "CAP_DAC_OVERRIDE"
+              "CAP_FOWNER"
+              "CAP_KILL" # Required for child process management
+              "CAP_NET_BIND_SERVICE"
+              "CAP_SETGID"
+              "CAP_SETUID"
+              "CAP_SYS_CHROOT"
+              "CAP_SYS_RESOURCE"
+            ];
+
+            Restart = "always";
+            RestartSec = 20;
+            TimeoutStopSec = 30;
+            LimitNOFILE = 4096;
+          };
+        };
+      }
+    ]
+  );
+
+  meta.maintainers = lib.teams.ngi.members;
+}
@@ -102,6 +102,7 @@ let

  finalSystemdBootBuilder = pkgs.writeScript "install-systemd-boot.sh" ''
    #!${pkgs.runtimeShell}
+    set -euo pipefail
    ${systemdBootBuilder}/bin/systemd-boot "$@"
    ${cfg.extraInstallCommands}
  '';
@@ -689,6 +689,7 @@ in
  gotenberg = runTest ./gotenberg.nix;
  gotify-server = runTest ./gotify-server.nix;
  gotosocial = runTest ./web-apps/gotosocial.nix;
+  goupile = runTest ./web-apps/goupile;
  grafana = handleTest ./grafana { };
  graphite = runTest ./graphite.nix;
  grav = runTest ./web-apps/grav.nix;
@@ -21,12 +21,7 @@
    # simple BEGIN probe (user probe on bpftrace itself)
    print(machine.succeed("bpftrace -e 'BEGIN { print(\"ok\\n\"); exit(); }'"))
    # tracepoint
-    # workaround: this needs more than the default of 1k FD to attach ~350 probes, bump fd limit
-    # see https://github.com/bpftrace/bpftrace/issues/2110
-    print(machine.succeed("""
-        ulimit -n 2048
-        bpftrace -e 'tracepoint:syscalls:sys_enter_* { print(probe); exit() }'
-    """))
+    print(machine.succeed("bpftrace -e 'tracepoint:syscalls:sys_enter_* { print(probe); exit() }'"))
    # kprobe
    print(machine.succeed("bpftrace -e 'kprobe:schedule { print(probe); exit() }'"))
    # BTF
@@ -34,12 +29,11 @@
        "    printf(\"tgid: %d\\n\", ((struct task_struct*) curtask)->tgid); exit() "
        "}'"))
    # module BTF (bpftrace >= 0.17)
-    # test is currently disabled on aarch64 as kfunc does not work there yet
-    # https://github.com/iovisor/bpftrace/issues/2496
-    print(machine.succeed("uname -m | grep aarch64 || "
-        "bpftrace -e 'kfunc:nft_trans_alloc_gfp { "
+    print(machine.succeed(
+        "bpftrace -e 'fentry:nft_delchain { "
        "    printf(\"portid: %d\\n\", args->ctx->portid); "
-        "} BEGIN { exit() }'"))
+        "} BEGIN { exit() }'"
+    ))
    # glibc includes
    print(machine.succeed("bpftrace -e '#include <errno.h>\n"
        "BEGIN { printf(\"ok %d\\n\", EINVAL); exit(); }'"))
@@ -84,7 +84,6 @@ let
      linux_rt_5_15
      linux_rt_6_1
      linux_rt_6_6
-      linux_libre

      linux_testing
      ;
@@ -188,7 +188,7 @@ in
        )
      with subtest("bob can sync bob's repository from the seed"):
        bob.succeed(
-          "cd /tmp/repo && rad sync --fetch --seed ${seed-nid}",
+          "cd /tmp/repo && rad sync --seed ${seed-nid}",
          "cd /tmp/repo && git pull"
        )
        assert bob.succeed("cat /tmp/repo/testfile") == "hello bob\n"
@@ -46,27 +46,25 @@ in

    with subtest("create systemd-homed user on first boot prompt"):
      machine.wait_for_unit("systemd-homed.service")
-      machine.wait_until_tty_matches("1", "-- Press any key to proceed --")
-      machine.send_chars(" ")
-      machine.wait_until_tty_matches("1", "Please enter user name")
+      machine.wait_until_tty_matches("1", "Please enter user name to create")
      machine.send_chars("${username}\n")
-      machine.wait_until_tty_matches("1", "Please enter an auxiliary group")
-      machine.send_chars("wheel\n")
-      machine.wait_until_tty_matches("1", "Please enter an auxiliary group")
-      machine.send_chars("\n")
-      machine.wait_until_tty_matches("1", "Please enter the shell to use")
-      machine.send_chars("/bin/sh\n")
-      machine.wait_until_tty_matches("1", "Please enter new password")
+      machine.wait_until_tty_matches("1", "Please enter new password for user ${username}:")
      machine.send_chars("${initialPassword}\n")
      machine.wait_until_tty_matches("1", "(repeat)")
      machine.send_chars("${initialPassword}\n")
+      machine.wait_for_unit("systemd-homed-firstboot.service")
+
+    # The firstboot wizard doesn't prompt for groups; add wheel here so the
+    # later sudo subtest works. Leaving the shell unset also exercises the
+    # NixOS default-user-shell meson option.
+    machine.succeed("homectl update ${username} --offline -G wheel")

    with subtest("login as homed user"):
      machine.wait_until_tty_matches("1", "login: ")
      machine.send_chars("${username}\n")
      machine.wait_until_tty_matches("1", "Password: ")
      machine.send_chars("${initialPassword}\n")
-      machine.wait_until_succeeds("pgrep -u ${username} -t tty1 sh")
+      machine.wait_until_succeeds("pgrep -u ${username} -t tty1 bash")
      machine.send_chars("whoami > /tmp/2\n")
      machine.wait_for_file("/tmp/2")
      assert "${username}" in machine.succeed("cat /tmp/2")
@@ -122,11 +120,11 @@ in
      sshClient.send_chars("ssh -o StrictHostKeyChecking=no -i /tmp/id_ed25519 ${username}@machine\n")
      sshClient.wait_until_tty_matches("1", "Please enter password for user")
      sshClient.send_chars("${newPassword}\n")
-      machine.wait_until_succeeds("pgrep -u ${username} sh")
+      machine.wait_until_succeeds("pgrep -u ${username} bash")
      sshClient.send_chars("whoami > /tmp/5\n")
      machine.wait_for_file("/tmp/5")
      assert "${username}" in machine.succeed("cat /tmp/5")
      sshClient.send_chars("exit\n") # ssh
-      sshClient.send_chars("exit\n") # sh
+      sshClient.send_chars("exit\n") # bash
  '';
 }
@@ -0,0 +1,178 @@
+import os
+import openpyxl
+import tempfile
+from playwright.sync_api import sync_playwright
+
+BASE_URL = "http://localhost:8889"
+
+# NOTE: these are the passwords
+ADMIN_PASSWD = "car-shop-in-the-mall"
+ALICE_PASSWD = "user-goes-to-the-car-shop"
+
+
+def run_test():
+    is_headful = os.getenv("HEADFUL") == "1"
+
+    with sync_playwright() as p:
+        browser = p.chromium.launch(headless=not is_headful)
+        context = browser.new_context(
+            accept_downloads=True, record_video_dir="/tmp/videos/"
+        )
+        # more default timeout for slow nixos test vms
+        context.set_default_timeout(90 * 1000)
+        page = context.new_page()
+
+        page.goto(f"{BASE_URL}/admin")
+
+        # admin and doman setup
+        page.get_by_role("textbox", name="Domain name *").fill("domain")
+        page.get_by_role("textbox", name="Domain title *").fill("domain")
+        page.get_by_role("textbox", name="Password *").fill(ADMIN_PASSWD)
+        page.get_by_role("textbox", name="Confirmation").fill(ADMIN_PASSWD)
+        page.get_by_role("textbox", name="Decryption key *").click()
+        page.get_by_role("button", name="Installer").click()
+
+        # login to admin dashboard as admin
+        page.get_by_role("textbox", name="Username *").fill("admin")
+        page.get_by_role("textbox", name="Password *").fill(ADMIN_PASSWD)
+        page.get_by_role("button", name="Login").click()
+
+        # create a sample project, it will switch the view to project's configure page
+        page.get_by_text("Create new project").click()
+        page.get_by_role("textbox", name="Name *").fill("proj1")
+        page.get_by_role("button", name="Create").click()
+
+        # create a test non-root user, alice
+        page.get_by_text("Create new user").click()
+        page.get_by_role("textbox", name="Username *").fill("alice")
+        page.get_by_role("button", name="No", exact=True).click()
+        page.get_by_role("textbox", name="Password *").fill(ALICE_PASSWD)
+        page.get_by_role("textbox", name="Confirmation").fill(ALICE_PASSWD)
+        page.get_by_role("button", name="Create").click()
+
+        # give alice, permissions to access the project
+        page.get_by_role("button", name="Assign").nth(1).click()
+        page.get_by_text("Read", exact=True).click()
+        page.get_by_text("Save", exact=True).click()
+        page.get_by_text("Export", exact=True).click()
+        page.get_by_text("Download", exact=True).click()
+
+        # Open the project in new page
+        page.locator("form").get_by_role("button", name="Edit").click()
+        with page.expect_popup() as page1_info:
+            page.get_by_role("link", name="access").click()
+        page1 = page1_info.value
+        page1.set_default_timeout(120 * 1000)
+
+        # fill entries as admin (enter 1 for everything)
+        page1.get_by_role("button", name="Create new record").click()
+
+        page1.locator("#ins_tiles").get_by_text("Introduction").click()
+        page1.get_by_role("textbox", name="Inclusion date *").fill("2000-01-01")
+        page1.get_by_role("spinbutton", name="Age *").click()
+        page1.get_by_role("spinbutton", name="Age *").fill("1")
+        page1.get_by_role("button", name="Save").click()
+        page1.wait_for_timeout(1000)
+
+        page1.get_by_role("button", name="Advanced").click()
+        page1.get_by_role("spinbutton", name="Age *").click()
+        page1.get_by_role("spinbutton", name="Age *").fill("1")
+        page1.get_by_role("button", name="Save").click()
+        page1.wait_for_timeout(1000)
+
+        page1.get_by_role("button", name="Page layout").click()
+        page1.get_by_role("spinbutton", name="Variable A1").fill("1")
+        page1.get_by_role("button", name="Save").click()
+        page1.wait_for_timeout(1000)
+
+        # create export #1
+        page1.get_by_role("button", name="Data").click()
+        page1.wait_for_timeout(1000)
+
+        page1.get_by_role("button", name="Data exports").click()
+        with page1.expect_download() as download_info:
+            page1.get_by_role("button", name="Create export").click()
+
+        # logout as admin
+        page.get_by_role("button", name="admin", exact=True).click()
+        with page.expect_popup() as page2_info:
+            page.get_by_role("link", name="access").click()
+        page2 = page2_info.value
+        page2.set_default_timeout(120 * 1000)
+
+        page2.get_by_role("button", name="admin").click()
+        page2.get_by_role("button", name="Logout").click()
+
+        # login as alice
+        page2.get_by_role("textbox", name="Username *").fill("alice")
+        page2.get_by_role("textbox", name="Password *").fill(ALICE_PASSWD)
+        page2.get_by_role("button", name="Login").click()
+
+        # create entry as alice (fill `2` for everything)
+        page2.get_by_role("button", name="Create new record").click()
+
+        page2.get_by_text("1 Introduction").click()
+        page2.get_by_role("textbox", name="Inclusion date *").fill("2000-01-01")
+        page2.get_by_role("spinbutton", name="Age *").click()
+        page2.get_by_role("spinbutton", name="Age *").fill("2")
+        page2.get_by_role("button", name="Save").click()
+        page2.wait_for_timeout(1000)
+
+        page2.get_by_role("button", name="Advanced").click()
+        page2.get_by_role("spinbutton", name="Age *").click()
+        page2.get_by_role("spinbutton", name="Age *").fill("2")
+        page2.get_by_role("button", name="Save").click()
+        page2.wait_for_timeout(1000)
+
+        page2.get_by_role("button", name="Page layout").click()
+        page2.get_by_role("spinbutton", name="Variable A1").click()
+        page2.get_by_role("spinbutton", name="Variable A1").fill("2")
+        page2.get_by_role("button", name="Save").click()
+        page2.wait_for_timeout(1000)
+
+        # create export #2
+        page2.get_by_role("button", name="Data").click()
+        page2.wait_for_timeout(1000)
+
+        page2.get_by_role("button", name="Data exports").click()
+        page2.get_by_role("button", name="Previous exports").click()
+
+        with page2.expect_download() as download1_info:
+            page2.locator("a").filter(has_text="Download").click()
+
+        download1 = download1_info.value
+        save_path1 = os.path.join(tempfile.gettempdir(), download1.suggested_filename)
+        download1.save_as(save_path1)
+
+        print(f"exported all records to {save_path1}")
+
+        page2.get_by_role("button", name="Data exports").click()
+        with page2.expect_download() as download2_info:
+            page2.get_by_role("button", name="Create export").click()
+
+        download2 = download2_info.value
+        save_path2 = os.path.join(tempfile.gettempdir(), download2.suggested_filename)
+        download2.save_as(save_path2)
+
+        print(f"exported all records to {save_path2}")
+
+        context.close()
+        browser.close()
+
+    # check that exported files have correct entries
+
+    wb1 = openpyxl.load_workbook(save_path1)
+    for sheet, cell in zip(["intro", "advanced", "layout"], ["D2", "D2", "C2"]):
+        val = wb1[sheet][cell].value
+        assert val == 1, f"Sheet {sheet}, Cell {cell}: Expected 1 (admin), got {val}"
+
+    wb2 = openpyxl.load_workbook(save_path2)
+    for sheet, cell in zip(["intro", "advanced", "layout"], ["D3", "D3", "C3"]):
+        val = wb2[sheet][cell].value
+        assert val == 2, f"Sheet {sheet}, Cell {cell}: Expected 2 (alice), got {val}"
+
+    print("Test passed successfully!")
+
+
+if __name__ == "__main__":
+    run_test()
@@ -0,0 +1,153 @@
+{
+  lib,
+  pkgs,
+  ...
+}:
+let
+  python = pkgs.python3.withPackages (
+    ps: with ps; [
+      requests
+      playwright
+      openpyxl
+    ]
+  );
+
+  runScript = "${lib.getExe python} ${./basic_interaction_test.py}";
+
+  run-goupile-test = pkgs.writeShellScriptBin "run-goupile-test" ''
+    set -euo pipefail
+
+    export PLAYWRIGHT_BROWSERS_PATH=${pkgs.playwright-driver.browsers}
+    export PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1
+
+    # check if attached to a terminal
+    if [ -t 1 ]; then
+      # interactive testing
+      export HEADFUL=''${HEADFUL:-1}
+      export PWDEBUG=''${PWDEBUG:-0}
+      export DISPLAY=''${DISPLAY:-:0}
+      if [ "$(id -u)" = "0" ] && [ -d "/home/alice" ]; then
+        runuser -u alice \
+          -w DISPLAY,HEADFUL,PWDEBUG,PLAYWRIGHT_BROWSERS_PATH,PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD \
+          -- ${runScript}
+      else
+        ${runScript}
+      fi
+    else
+      # non-interactive nixos test
+
+      # Print instructions to the nix logs
+      cat <<'EOF' | tee >(systemd-cat -t goupile-e2e)
+    ================================================================================
+    NOTE: The goupile e2e test can be run interactively either inside the vm or on the host
+      - First, run `nix-build -A nixosTests.goupile.driverInteractive` and `./result/bin/nixos-test-driver`
+      - Run `start_all()` inside the repl
+      - Then `$(nix-build -A nixosTests.goupile.interactive-script)/bin/run-goupile-test` to run the full test interactively
+      - Or `env PWDEBUG=1 $(nix-build -A nixosTests.goupile.interactive-script)/bin/run-goupile-test` to show the playwright inspector to debug
+    ================================================================================
+    EOF
+
+      echo "Starting smoke test..." | systemd-cat -t goupile-e2e
+      ${runScript} 2>&1 | tee >(systemd-cat -t goupile-e2e)
+    fi
+  '';
+in
+{
+  name = "goupile";
+
+  passthru.interactive-script = run-goupile-test;
+
+  nodes.machine =
+    {
+      lib,
+      pkgs,
+      config,
+      ...
+    }:
+    {
+      services.goupile = {
+        enable = true;
+        enableSandbox = true;
+        settings.HTTP.Port = 8889;
+      };
+      #systemd.services.goupile.environment.DEFAULT_SECCOMP_ACTION = "Log"; # Block|Log|Kill
+      networking = {
+        firewall.allowedTCPPorts = [ config.services.nginx.defaultHTTPListenPort ];
+        hostName = "goupile";
+        domain = "local";
+      };
+
+      # goupile tries to resolve it at runtime, resolve it instead of patching it out
+      # as the dns resolution step serves a purpose, to force glibc to load NSS libraries
+      # see server/goupile.cc and search for getaddrinfo or www.example.com
+      networking.extraHosts = ''
+        127.0.0.1 www.example.com
+      '';
+
+      environment.systemPackages = [
+        python
+        run-goupile-test
+      ];
+
+      # more cores and memory to improve chromium performance
+      virtualisation.memorySize = lib.mkForce 8192;
+      virtualisation.cores = 4;
+    };
+
+  testScript =
+    { nodes, ... }:
+    let
+      port = builtins.toString nodes.machine.services.goupile.settings.HTTP.Port;
+    in
+    # py
+    ''
+      import os
+      start_all()
+
+      machine.wait_for_unit("goupile.service")
+      machine.wait_for_open_port(${port})
+
+      machine.succeed("curl -q http://localhost:${port}")
+      machine.succeed("curl -q http://goupile.local")
+      machine.succeed("curl -q http://localhost")
+
+      machine.succeed("run-goupile-test")
+      out_dir = os.environ.get("out", os.getcwd())
+      machine.copy_from_vm("/tmp/videos", out_dir)
+    '';
+
+  # Debug interactively with:
+  # - nix-build -A nixosTests.goupile.driverInteractive
+  # - ./result/bin/nixos-test-driver
+  # - run_tests()
+  # ssh -o User=root vsock%3 (can also do vsock/3, but % works with scp etc.)
+  interactive.sshBackdoor.enable = true;
+
+  interactive.nodes.machine =
+    { config, ... }:
+    let
+      port = config.services.goupile.settings.HTTP.Port;
+    in
+    {
+      imports = [
+        # enable graphical session + users (alice, bob)
+        ../../common/x11.nix
+        ../../common/user-account.nix
+      ];
+      services.xserver.enable = true;
+      test-support.displayManager.auto.user = "alice";
+
+      virtualisation.forwardPorts = [
+        {
+          from = "host";
+          host.port = port;
+          guest.port = port;
+        }
+      ];
+
+      # forwarded ports need to be accessible
+      networking.firewall.allowedTCPPorts = [ port ];
+    };
+
+  meta.maintainers = lib.teams.ngi.members;
+}
@@ -1,90 +1,90 @@
 {
  "platform_major": "4",
-  "platform_minor": "38",
-  "version": "4.38",
-  "year": "2025",
-  "month": "12",
-  "buildmonth": "12",
-  "dayHourMinute": "010920",
+  "platform_minor": "39",
+  "version": "4.39",
+  "year": "2026",
+  "month": "03",
+  "buildmonth": "02",
+  "dayHourMinute": "260420",
  "eclipses": {
    "cpp": {
      "description": "Eclipse IDE for C/C++ Developers",
      "dropUrl": false,
      "hashes": {
-        "x86_64": "sha256-wlYGwfxKnF26qMSrUl0fsTDbECgXIL+ZIAr1BzwnK1Y=",
-        "aarch64": "sha256-xuTi++OZzj+jh7edNi3WQN0ie0HJB0Zrg023MT3px/c="
+        "x86_64": "sha256-2Mnh73FgzNjR4EU6KMG6MvGDeIIYXMj3mZFYR31pqfY=",
+        "aarch64": "sha256-kq94vQYN2CEHodme8V6V0EZ33Pf96fmj/zMD/vkJbp8="
      }
    },
    "dsl": {
      "description": "Eclipse IDE for Java and DSL Developers",
      "dropUrl": false,
      "hashes": {
-        "x86_64": "sha256-I6AcXthzv/uLlO5+Y27ZsbeftA3zzvUlApISsquS0sY=",
-        "aarch64": "sha256-j0gj5Tcfbyj3sQ6gHEexee6d4SNbOYMODTeZDbKbUBo="
+        "x86_64": "sha256-dOvQSOk4tPiLiNFHn4+a+gA69BhXjp9IbEZMJET7BfU=",
+        "aarch64": "sha256-EPLQccE19bYITjaWnZjcB9/c7M95/7gbfJVPHkrXAWM="
      }
    },
    "embedcpp": {
      "description": "Eclipse IDE for Embedded C/C++ Developers",
      "dropUrl": false,
      "hashes": {
-        "x86_64": "sha256-sPyqRadyBQ24oO38bEy4VP4dTj6V+FwMVjxyniyTn5o=",
-        "aarch64": "sha256-CahsB9yBC8bLzwdfOOaidsP1VXXiELoot+DN8Zz2QqU="
+        "x86_64": "sha256-zX0MMRGMANowMxWxCxpz2oQAXFEF8HRXQ0q76B4NnEY=",
+        "aarch64": "sha256-XRfs2dJL/mXMWF7akXBw1Plh8jabSvhULOrC7dWGg7Q="
      }
    },
    "modeling": {
      "description": "Eclipse Modeling Tools",
      "dropUrl": false,
      "hashes": {
-        "x86_64": "sha256-jw1Ij7HG8J9usWT6cKXeZbZDxQTWp2pBZtG2BdU2Guw=",
-        "aarch64": "sha256-e4ieVltHzhBLGEh3NNKrKcfOyUQd0avIrhUB1CYbQls="
+        "x86_64": "sha256-5yI90w7vJGCnUvYxTnQ19NzZYJpPPmKtjS/rXmowOTE=",
+        "aarch64": "sha256-SZE4f2CR/FuG1B08Zf0eKrMBKRy7d2CWISGKWVpwhDw="
      }
    },
    "platform": {
      "description": "Eclipse Platform ${year}-${month}",
      "dropUrl": true,
      "hashes": {
-        "x86_64": "sha256-gicPSSoWyisPTUQXu3ndWrcNiCTgIaCnVCZbTFWp6Cc=",
-        "aarch64": "sha256-WSs9Y7iwhd+Wd4RQ/DMFGqIR4RjlceJgPCE2BSa55so="
+        "x86_64": "sha256-VpV40IdWwUdePo1NqOrgnzta1x7jXDLkF+pZ4LWatew=",
+        "aarch64": "sha256-Q//rkfpyY319BW4w/sK3Bd7Qb4Oi88hnr0aGULquV3g="
      }
    },
    "SDK": {
      "description": "Eclipse ${year}-${month} Classic",
      "dropUrl": true,
      "hashes": {
-        "x86_64": "sha256-Vx8mnR81KpikZZikNwaHCz+KEfWd3Jvkzf9A6Chc0TE=",
-        "aarch64": "sha256-VMcPmucV+hZ88nnhdsklXqrrUFG5lrZLeYmC1XC5Wo4="
+        "x86_64": "sha256-ifXUPmZSvJP/LMCHFmX+01+qF75jVEGFmGxfElBz1K8=",
+        "aarch64": "sha256-grzJNEFvXhgrJM+hSiS29n0ardlmhM6kIffeWPh/vMs="
      }
    },
    "java": {
      "description": "Eclipse IDE for Java Developers",
      "dropUrl": false,
      "hashes": {
-        "x86_64": "sha256-Us5HNoQOt9OaTVAhVlFPMqAXD8hZkLs0IGppSpj2UuY=",
-        "aarch64": "sha256-SHgHlicA30Q7W6yNTGUgaovMYXIHohbhksbJKIRSFGk="
+        "x86_64": "sha256-DtRK/x4u7YQpjcKYh/9PdAeppjaxTEBTdL/AQhPFIlU=",
+        "aarch64": "sha256-Gu5d8qMig6cCc9JVnNDMsj+xsYfkbHrTl1MvlSIfmhE="
      }
    },
    "jee": {
      "description": "Eclipse IDE for Enterprise Java and Web Developers",
      "dropUrl": false,
      "hashes": {
-        "x86_64": "sha256-z0nj/7dmlqjEE+PQEjJngf3GmTIc6O8F8TJm7yBFrQE=",
-        "aarch64": "sha256-MDBT9OJWBRd0twY5XoBukQaBTG1IP3xKE0g9kc86a/8="
+        "x86_64": "sha256-86Qi1nZElwyo9gumtLUlsnOxsF2TE4DpXGmPS+C2l2M=",
+        "aarch64": "sha256-iAtto9kxFjbXo6KQmOlnY6TRskHkx20VJUeW7FO3lZI="
      }
    },
    "committers": {
      "description": "Eclipse IDE for Eclipse Committers and Eclipse Platform Plugin Developers",
      "dropUrl": false,
      "hashes": {
-        "x86_64": "sha256-meelcKp5AgfVCi13scA0TbPgkK9XsPvtS8HkyAYcUZs=",
-        "aarch64": "sha256-c/FxP0Snx70bkhZ+owkg/DFXu3AWdJtrPCKyqIqKfPs="
+        "x86_64": "sha256-fq5dfqqqyxO1fZRMd5aygDWKN116Mx3VqglVsRiTAAE=",
+        "aarch64": "sha256-/6+0zMMVeARHldxOenRN16sxSkUP97g7ERmePdwxi78="
      }
    },
    "rcp": {
      "description": "Eclipse IDE for RCP and RAP Developers",
      "dropUrl": false,
      "hashes": {
-        "x86_64": "sha256-0OgiJ11wMGeR1UjoLd3yoApDMhy3oZ1y4P2OxSJyRQA=",
-        "aarch64": "sha256-IywPOyQlZXTrJdjiRDVAKwlxMZ1+FvN/uxYYoJ++ez8="
+        "x86_64": "sha256-VQTCGRqb6Fn7DdhM0S1gJX17Rv/H8Ych2rZmBYRiaq4=",
+        "aarch64": "sha256-o+Rd5vuhvSjs0oLkLnAgHpyq1EuYLZAJY5GTwBEmPog="
      }
    }
  }
@@ -262,8 +262,8 @@ let
        mktplcRef = {
          name = "ng-template";
          publisher = "Angular";
-          version = "21.2.2";
-          hash = "sha256-rpll3EsTGEuynrw7EsP3GeltG/vtYqgO8mvTCVyU1ao=";
+          version = "21.2.3";
+          hash = "sha256-Gdxw1WvMQ/t4XUfDkekIvwOsWYjmDIjGE7scsImohNc=";
        };
        meta = {
          changelog = "https://marketplace.visualstudio.com/items/Angular.ng-template/changelog";
@@ -3008,8 +3008,8 @@ let
        mktplcRef = {
          publisher = "mesonbuild";
          name = "mesonbuild";
-          version = "1.28.1";
-          hash = "sha256-Cu2sBg8wTjGLOMF4bCOG8noXZXZB2j5wSXZS2VxxNoA=";
+          version = "1.28.2";
+          hash = "sha256-Wb3cfATe8pc+LftmKyFj3q6kmdTHUMtoIHlChKKeEoU=";
        };
        meta = {
          changelog = "https://marketplace.visualstudio.com/items/mesonbuild.mesonbuild/changelog";
@@ -4458,8 +4458,8 @@ let
        mktplcRef = {
          name = "vscode-stylelint";
          publisher = "stylelint";
-          version = "2.0.2";
-          hash = "sha256-nJYy7HFycKXTQCHgaLP46CGl0hlgaexL1QZ8icGpeVo=";
+          version = "2.1.0";
+          hash = "sha256-cL86Gv2HAtvqNd+2vJPuKAgKVrp5pg6IECFm1Di8Eqk=";
        };
        meta = {
          description = "Official Stylelint extension for Visual Studio Code";
@@ -15,13 +15,13 @@ let
  vsix = stdenv.mkDerivation (finalAttrs: {
    name = "gitlens-${finalAttrs.version}.vsix";
    pname = "gitlens-vsix";
-    version = "17.11.0";
+    version = "17.11.1";

    src = fetchFromGitHub {
      owner = "gitkraken";
      repo = "vscode-gitlens";
      tag = "v${finalAttrs.version}";
-      hash = "sha256-MMUfl8Vc6mAjs0ZPWV0lHQdqRkKKY0FEx7mbz/yrk9k=";
+      hash = "sha256-BN6qgPYhZ+FuYnwmV0S3y2vOR4ZLC+VGWuEEPqfOqi4=";
    };

    pnpmDeps = fetchPnpmDeps {
@@ -7,6 +7,7 @@
  ninja,
  pkg-config,
  babl,
+  bash-completion,
  cfitsio,
  gegl,
  gtk3,
@@ -41,6 +42,7 @@
  python3,
  libexif,
  gettext,
+  glibcLocales,
  wrapGAppsHook3,
  libxslt,
  gobject-introspection,
@@ -57,6 +59,7 @@
  llvmPackages,
  gexiv2,
  harfbuzz,
+  makeFontsConf,
  mypaint-brushes1,
  libwebp,
  libheif,
@@ -81,7 +84,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "gimp";
-  version = "3.0.6";
+  version = "3.0.8";

  outputs = [
    "out"
@@ -92,17 +95,10 @@ stdenv.mkDerivation (finalAttrs: {

  src = fetchurl {
    url = "https://download.gimp.org/gimp/v${lib.versions.majorMinor finalAttrs.version}/gimp-${finalAttrs.version}.tar.xz";
-    hash = "sha256-JGwiU4PHLvnw3HcDt9cHCEu/F3vSkA6UzkZqYoYuKWs=";
+    hash = "sha256-/rSYrMAbJoJ8/x/5Wqj7gs3Wpg16v3c8/NGavq/KM4Y=";
  };

  patches = [
-    # https://gitlab.gnome.org/GNOME/gimp/-/issues/15257
-    (fetchpatch {
-      name = "fix-gegl-bevel-test.patch";
-      url = "https://gitlab.gnome.org/GNOME/gimp/-/commit/2fd12847496a9a242ca8edc448d400d3660b8009.patch";
-      hash = "sha256-pjOjyzZxxl+zRqThXBwCBfYHdGhgaMI/IMKaL3XGAMs=";
-    })
-
    # to remove compiler from the runtime closure, reference was retained via
    # gimp --version --verbose output
    (replaceVars ./remove-cc-reference.patch {
@@ -122,6 +118,31 @@ stdenv.mkDerivation (finalAttrs: {
    (replaceVars ./tests-dbus-conf.patch {
      session_conf = "${dbus.out}/share/dbus-1/session.conf";
    })
+
+    # Allow calling tests from other directories.
+    # Required for the next patch.
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/gimp/-/commit/fd58ab3bee7a79cb0a7870c6858f3b64c84a7917.patch";
+      hash = "sha256-fpysKWwt5rilqp7ukdWx7kutkDquL/6YhYjR1zQfu/Q=";
+    })
+
+    # Do not go through ui for save-and-export test.
+    # https://gitlab.gnome.org/GNOME/gimp/-/issues/15763
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/gimp/-/commit/608ad0a528b5b31101c021d96aeb95558d207497.patch";
+      hash = "sha256-0oA5u+uAT0l3WT90fy0RGOR8xy/fGIHevBb69oUzfGs=";
+      excludes = [
+        # Other changes would prevent deletion, removing it from build is sufficient.
+        "app/tests/test-save-and-export.c"
+      ];
+    })
+
+    # Disable broken UI tests.
+    # https://gitlab.gnome.org/GNOME/gimp/-/issues/15763
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/gimp/-/commit/c34fe3e94f1019eafcb38edf1c07bff12a57431e.patch";
+      hash = "sha256-yVauEpoGEOIfCXnGnWMGWjXbIDizDhJ3hipeCy3XSBM=";
+    })
  ];

  nativeBuildInputs = [
@@ -129,6 +150,7 @@ stdenv.mkDerivation (finalAttrs: {
    ninja
    pkg-config
    gettext
+    glibcLocales
    wrapGAppsHook3
    libxslt # for xsltproc
    gobject-introspection
@@ -152,6 +174,7 @@ stdenv.mkDerivation (finalAttrs: {
  buildInputs = [
    appstream # for library
    babl
+    bash-completion
    cfitsio
    gegl
    gtk3
@@ -250,6 +273,11 @@ stdenv.mkDerivation (finalAttrs: {

    # Check if librsvg was built with --disable-pixbuf-loader.
    PKG_CONFIG_GDK_PIXBUF_2_0_GDK_PIXBUF_MODULEDIR = "${librsvg}/${gdk-pixbuf.moduleDir}";
+
+    # Silence fontconfig warnings about missing config during tests
+    FONTCONFIG_FILE = makeFontsConf {
+      fontDirectories = [ ];
+    };
  };

  postPatch = ''
@@ -260,6 +288,16 @@ stdenv.mkDerivation (finalAttrs: {
    chmod +x plug-ins/python/{colorxhtml,file-openraster,foggify,gradients-save-as-css,histogram-export,palette-offset,palette-sort,palette-to-gradient,python-eval,spyro-plus}.py
    patchShebangs \
      plug-ins/python/{colorxhtml,file-openraster,foggify,gradients-save-as-css,histogram-export,palette-offset,palette-sort,palette-to-gradient,python-eval,spyro-plus}.py
+
+    # Use Python from environment not from Meson.
+    # https://gitlab.gnome.org/GNOME/gimp/-/merge_requests/2607
+    substituteInPlace meson.build \
+      --replace-fail "import('python').find_installation()" "import('python').find_installation('python3')"
+
+    # Broken test
+    # https://github.com/NixOS/nixpkgs/pull/484971#issuecomment-3846759517
+    substituteInPlace app/tests/meson.build \
+      --replace-fail "{${"\n"}    'name': 'save-and-export',${"\n"}  }${"\n"}" ""
  '';

  preBuild =
@@ -823,7 +823,7 @@
    }
  },
  "ungoogled-chromium": {
-    "version": "146.0.7680.80",
+    "version": "146.0.7680.153",
    "deps": {
      "depot_tools": {
        "rev": "42786f6e46c25c30dd58f69283ab6fcd0c959f58",
@@ -835,16 +835,16 @@
        "hash": "sha256-wFCuu4GR0N7QZCwT8UAhqH5moicYQjZ4ZLI58AM4pJ0="
      },
      "ungoogled-patches": {
-        "rev": "146.0.7680.80-1",
-        "hash": "sha256-/vM1Rw5YgGxTu+/y4bK15bzW6deeREPL/m+1kx+O5Do="
+        "rev": "146.0.7680.153-1",
+        "hash": "sha256-EkvxX+pTnnscrIFEKMJBYy5Sn6d/Hw3PuOQaOPiSi5Y="
      },
      "npmHash": "sha256-ByB1Ea5tduIJZXyydeBWsoS8OPABOgwHe+dNXRssdvc="
    },
    "DEPS": {
      "src": {
        "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "f08938029c887ea624da7a1717059788ed95034d",
-        "hash": "sha256-PCQeTdc6Fl74TLyvxjli4scIUIm0GgZ3e9wbC18Tclw=",
+        "rev": "85fd829a1b2049479ead5ed578f5ed105a094fe4",
+        "hash": "sha256-PshNuKAZBXohix711YGjE4X24ixVW29wxgeePNE9Xzs=",
        "recompress": true
      },
      "src/third_party/clang-format/script": {
@@ -914,8 +914,8 @@
      },
      "src/third_party/angle": {
        "url": "https://chromium.googlesource.com/angle/angle.git",
-        "rev": "1d3190bf5633327395d694d621258978d989dffd",
-        "hash": "sha256-QVtTxBBox8fiqTj0gjqvYx6HoBSlvuWIe5ki4iCQl08="
+        "rev": "e05753c6d05b17b23d514038957469c70b75475c",
+        "hash": "sha256-SMym7PN2acfw84Z95xWSbN/QV5UIDIOztWxFeTCfBsk="
      },
      "src/third_party/angle/third_party/glmark2/src": {
        "url": "https://chromium.googlesource.com/external/github.com/glmark2/glmark2",
@@ -954,8 +954,8 @@
      },
      "src/third_party/dawn": {
        "url": "https://dawn.googlesource.com/dawn.git",
-        "rev": "c46c81b25577c40de6e7e510743ae0454e0c8351",
-        "hash": "sha256-Duv3kNulPtVxCLPa3bFIev64O9Y4ObJP/IZz31oPJ0E="
+        "rev": "3d52cfc8dd0bc2cdbbecd9803cc08102de7e4597",
+        "hash": "sha256-lyAG9tKBWQ2yy/morStUd0ZKDPT58t8516NDCQG/jZs="
      },
      "src/third_party/dawn/third_party/glfw": {
        "url": "https://chromium.googlesource.com/external/github.com/glfw/glfw",
@@ -1244,8 +1244,8 @@
      },
      "src/third_party/libaom/source/libaom": {
        "url": "https://aomedia.googlesource.com/aom.git",
-        "rev": "4018d3b63456eb657475e66c352bfa86f321e0f5",
-        "hash": "sha256-RuCmzPIR6hW8znjQH4kQqSJmIIJWtMkUQjYEVn3B9AE="
+        "rev": "446588f90da2e3372a9352d3b2ba8ab3f342c8ce",
+        "hash": "sha256-hLddZzWBQZ/MEF5fcCiju5ibNPSb+zhahlxdLaczdsE="
      },
      "src/third_party/crabbyavif/src": {
        "url": "https://chromium.googlesource.com/external/github.com/webmproject/CrabbyAvif.git",
@@ -1424,8 +1424,8 @@
      },
      "src/third_party/pdfium": {
        "url": "https://pdfium.googlesource.com/pdfium.git",
-        "rev": "67cf48602b0c8aaa9807cd185212ee078eb30b21",
-        "hash": "sha256-jMoYwf63C0IHx/QcOT+LKCCYN3dJVUhC5COukkhwqx0="
+        "rev": "bccc616f83aaed08f65d4a707dfe00e24133772b",
+        "hash": "sha256-yfjXNWczeGwPlnAVB161OsFXiHms2IRstqKmoZ/AWFU="
      },
      "src/third_party/perfetto": {
        "url": "https://chromium.googlesource.com/external/github.com/google/perfetto.git",
@@ -1474,8 +1474,8 @@
      },
      "src/third_party/skia": {
        "url": "https://skia.googlesource.com/skia.git",
-        "rev": "248acd90d9a35ac46b2ec30201ae50f301b8a173",
-        "hash": "sha256-zOL5j9X72ZvYmS8MzQ+pqSkT8AWBz2IwmaH7I3LN1IE="
+        "rev": "3c7c530c115124b415c1f4e0e35694fbaefd2177",
+        "hash": "sha256-ObLypxiOKH/YoLw6uUA4MmHM44vA8iPhNCEfFcwip0Q="
      },
      "src/third_party/smhasher/src": {
        "url": "https://chromium.googlesource.com/external/smhasher.git",
@@ -1609,8 +1609,8 @@
      },
      "src/third_party/webrtc": {
        "url": "https://webrtc.googlesource.com/src.git",
-        "rev": "d1972add2a63b2a528a6471d447f82e0010b5215",
-        "hash": "sha256-evtOzxwWgKUaJl9zwpQDqPp1wM7w3DzjRcLg29z9ELQ="
+        "rev": "b2a90ac0037ee7187102ce2c40e5007216ca9a58",
+        "hash": "sha256-rX6NEN0RbfHPRqJqkGhypwWt/NcREvPaanL+CDxwhA8="
      },
      "src/third_party/wuffs/src": {
        "url": "https://skia.googlesource.com/external/github.com/google/wuffs-mirror-release-c.git",
@@ -1639,8 +1639,8 @@
      },
      "src/v8": {
        "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "70253f966a7c3936f5a5ff57c6a4a4face1f16ad",
-        "hash": "sha256-8tA9nWXsiQ2Qt7pbALrhsnNFHOFLw/wlcz5OrFjYEI8="
+        "rev": "abb5d7b829d60a5dae46fbcee0e9d0d554d3a946",
+        "hash": "sha256-hnwiRarq+69BECxJ9FQD0XGqqA/OF66RxZUPWTzDaFE="
      }
    }
  }
@@ -472,13 +472,13 @@
    "vendorHash": "sha256-mzDFyk2oImRXt72kFV5Ln++ScgoecpJEJtzUKjvCaws="
  },
  "grafana_grafana": {
-    "hash": "sha256-ifE5W6sUo/BTxO+noss+nqw+LDPlkxdpySlJ08n7Kd4=",
+    "hash": "sha256-XXnmPZstCrZ2NDMx/azDpvXknuEwqJ+GW0hiaH3+bDQ=",
    "homepage": "https://registry.terraform.io/providers/grafana/grafana",
    "owner": "grafana",
    "repo": "terraform-provider-grafana",
-    "rev": "v4.27.1",
+    "rev": "v4.28.1",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-OCdknvuL/+khhFdopVLKEYKBwLbyPnziKamHDUEX+Zk="
+    "vendorHash": "sha256-OMrFGY8rIf32E6/TKSmR/AQPj+GS1e9V5UyPxzhXaNE="
  },
  "gridscale_gridscale": {
    "hash": "sha256-FAKvQ/MEod5Ck0PG4ffQ+gQp6zZ0JDRXPOrOiDpWMls=",
@@ -959,13 +959,13 @@
    "vendorHash": "sha256-OAd8SeTqTrH0kMoM2LsK3vM2PI23b3gl57FaJYM9hM0="
  },
  "newrelic_newrelic": {
-    "hash": "sha256-N/ytL2WQougrVl45Jq34HBP11VcnACl+wKFWeFPmsX8=",
+    "hash": "sha256-nMQOxgGqdydq2BdlfIJa7kOuRDN4ctr5jREgMLtg6lA=",
    "homepage": "https://registry.terraform.io/providers/newrelic/newrelic",
    "owner": "newrelic",
    "repo": "terraform-provider-newrelic",
-    "rev": "v3.80.2",
+    "rev": "v3.81.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-y+VDIQQ91SyCIhObripBUdi75zhO7vSQvV9WjuJYDK4="
+    "vendorHash": "sha256-ToIawhtxS0EIew0PE9cc1W7Dge3LOrnuGbZo9kbdYJs="
  },
  "ns1-terraform_ns1": {
    "hash": "sha256-MX/Wd9Lztjn7uwDzJjs4bsSSp0PFzUgsu4jXke9jHL8=",
@@ -1031,13 +1031,13 @@
    "vendorHash": "sha256-ofzbDmivXgH1i1Gjhpyp0bk3FDs5SnxwoRuNAWyMqyI="
  },
  "opentelekomcloud_opentelekomcloud": {
-    "hash": "sha256-EVHAWkNScPJCwHvmW1Lt/9qVwYjxDxtTTa3SC1dLSXw=",
+    "hash": "sha256-+kEqzgcEHlGq85U55AzJBHSIHif6ClVk7Y159YfbqpQ=",
    "homepage": "https://registry.terraform.io/providers/opentelekomcloud/opentelekomcloud",
    "owner": "opentelekomcloud",
    "repo": "terraform-provider-opentelekomcloud",
-    "rev": "v1.36.60",
+    "rev": "v1.36.61",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-WPVk+wlAK6O2xXjyXekYu9svpEg0AFz9EnDGGTS9I3c="
+    "vendorHash": "sha256-mZT6DdYvsQiowLZf1U4xW2FNTzYPvxjcIZ6ZWuTUZMs="
  },
  "opsgenie_opsgenie": {
    "hash": "sha256-Y67kcg/ovvZc22l1CBz0Mqu7DAIit5F0jQNfQrl2EGI=",
@@ -128,18 +128,15 @@ let
    exec ${yarn}/bin/yarn "$@"
  '';

-  uvWheels = runCommand "uv-wheels" {
-    # otherwise, it's too long of a string
-    passAsFile = [ "installCommand" ];
-    installCommand = ''
-      #!${stdenv.shell}
+  uvWheels = runCommand "uv-wheels" { } (
+    ''
      mkdir -p $out
    ''
-    + (lib.strings.concatStringsSep "\n" (map (dep: "ln -vsf ${dep.dist}/*.whl $out") pythonDeps));
-  } "bash $installCommandPath";
+    + (lib.strings.concatMapStringsSep "\n" (dep: "ln -vsf ${dep.dist}/*.whl $out") pythonDeps)
+  );
 in

-python3Packages.buildPythonApplication rec {
+python3Packages.buildPythonApplication (finalAttrs: {
  pyproject = false;
  inherit pname version;

@@ -164,8 +161,8 @@ python3Packages.buildPythonApplication rec {

  missingHashes = ./missing-hashes.json;
  yarnOfflineCache = yarn-berry.fetchYarnBerryDeps {
-    inherit missingHashes;
-    yarnLock = "${src}/yarn.lock";
+    inherit (finalAttrs) missingHashes;
+    yarnLock = "${finalAttrs.src}/yarn.lock";
    hash = yarnHash;
  };

@@ -363,4 +360,4 @@ python3Packages.buildPythonApplication rec {
      oxij
    ];
  };
-}
+})
@@ -26,7 +26,7 @@ buildGoModule (finalAttrs: {

  # Use only versions specified in anytype-ts middleware.version file:
  #  https://github.com/anyproto/anytype-ts/blob/v<anytype-ts-version>/middleware.version
-  version = "0.48.4";
+  version = "0.48.5";

  # Update only together with 'anytype' package.
  # nixpkgs-update: no auto update
@@ -34,10 +34,10 @@ buildGoModule (finalAttrs: {
    owner = "anyproto";
    repo = "anytype-heart";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-EUv/kJcAftqGqerrDhdnAl9YXPt5wWwviZD/uQ5pWmI=";
+    hash = "sha256-h7oXx/twHXWb97xHr5hoviYY5lRLKUnT+uMIiLlD5pw=";
  };

-  vendorHash = "sha256-4DiIU1ztmBCgI6axNKSeLSGQ5BuRLpSXl8RJAm1r2Eg=";
+  vendorHash = "sha256-vmOEt3cpkq8JJ3s6+VUOOwr+DyF8W1pavW1P+XnrBw8=";

  subPackages = [ "cmd/grpcserver" ];
  tags = [
@@ -17,23 +17,23 @@

 buildNpmPackage (finalAttrs: {
  pname = "anytype";
-  version = "0.54.5";
+  version = "0.54.9";

  src = fetchFromGitHub {
    owner = "anyproto";
    repo = "anytype-ts";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-TLmmItt5ASlfQA/e1RtcGF/Gf9AU97pf4tpv3B7J9kE=";
+    hash = "sha256-Ciah+JSy4j4u0FvHugZTYJAf8a0kv9jmgWnNSqdzKhw=";
  };

  locales = fetchFromGitHub {
    owner = "anyproto";
    repo = "l10n-anytype-ts";
-    rev = "d744bf573b72c6e8d11e093c8f6702acec263009";
-    hash = "sha256-UnqHXqtBTRmDR/qvS7bktMzDzk9gq+onvvLJgdzqJ7A=";
+    rev = "d22d8b4175dfca766c00cca6e575da19f0390bd4";
+    hash = "sha256-LEKdZPs/TkDeT1glUNUBhWBly63P4Im4fHeuEvzLYUI=";
  };

-  npmDepsHash = "sha256-vvnUzzryW5nbAv9OEU+6xwP7lf8+K/mS0mcDswNRTxU=";
+  npmDepsHash = "sha256-GIGqaB7GeLDtxr8rV19o/nBqIlkjlLF/pR/mwGSogQE=";

  # npm dependency install fails with nodejs_24: https://github.com/NixOS/nixpkgs/issues/474535
  nodejs = nodejs_22;
@@ -11,6 +11,15 @@
  keybinder3,
  libnotify,
  gst_all_1,
+  libva,
+  libvdpau,
+  lcms2,
+  libarchive,
+  alsa-lib,
+  libpulseaudio,
+  libgbm,
+  libxscrnsaver,
+  libxv,
 }:

 let
@@ -18,11 +27,11 @@ let
    rec {
      x86_64-linux = {
        urlSuffix = "linux-x86_64.tar.gz";
-        hash = "sha256-87mauW50ccOaPyK04O4I7+0bsvxVrdFxhi/Muc53wDY=";
+        hash = "sha256-A2XPADCc63OqskfPpkMwL8jCp9k7QsPyN2/FL+eCpfI=";
      };
      x86_64-darwin = {
        urlSuffix = "macos-universal.zip";
-        hash = "sha256-a1WhOQ8NU3/aGAdaw8o3y7ckRdBsNgLZZ2nOrMsQdOA=";
+        hash = "sha256-YanQYRaGCqq5bOLeSFqUYbq0EtVun80gxGdFJtyZdoI=";
      };
      aarch64-darwin = x86_64-darwin;
    }
@@ -31,7 +40,7 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "appflowy";
-  version = "0.10.6";
+  version = "0.11.4";

  src = fetchzip {
    url = "https://github.com/AppFlowy-IO/appflowy/releases/download/${finalAttrs.version}/AppFlowy-${finalAttrs.version}-${dist.urlSuffix}";
@@ -45,12 +54,21 @@ stdenvNoCC.mkDerivation (finalAttrs: {
  ]
  ++ lib.optionals stdenvNoCC.hostPlatform.isLinux [ autoPatchelfHook ];

-  buildInputs = [
+  buildInputs = lib.optionals stdenvNoCC.hostPlatform.isLinux [
    gtk3
    keybinder3
    libnotify
    gst_all_1.gstreamer
    gst_all_1.gst-plugins-base
+    libva
+    libvdpau
+    lcms2
+    libarchive
+    alsa-lib
+    libpulseaudio
+    libgbm
+    libxscrnsaver
+    libxv
  ];

  dontBuild = true;
@@ -18,18 +18,18 @@

 stdenv.mkDerivation rec {
  pname = "audio-mirroring";
-  version = "0.1.1";
+  version = "0.1.3";

  src = fetchFromGitHub {
    owner = "mkg20001";
    repo = "audio-mirroring";
    tag = "v${version}";
-    hash = "sha256-f4V5ZJvXhdwqS4kx99Lr2Eb8r08PRd3T4mbRoAyyIqE=";
+    hash = "sha256-Idu15ZfY8JYVZhub0LRXYtWdiVCMVRyC3MVTX4JcbzY=";
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
    inherit pname version src;
-    hash = "sha256-+mAdxaaQOO7AIn/o/J13FbHIvtepk8/okGxO6p6aGzI=";
+    hash = "sha256-kiDGCl3De5dhDwwCf1F38gnGtfNpAVot0G0+Gxmyyp0=";
  };

  nativeBuildInputs = [
@@ -13,11 +13,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "awakened-poe-trade";
-  version = "3.28.102";
+  version = "3.28.103";

  src = fetchurl {
    url = "https://github.com/SnosMe/awakened-poe-trade/releases/download/v${finalAttrs.version}/Awakened-PoE-Trade-${finalAttrs.version}.AppImage";
-    hash = "sha256-tej1rjkrpAXmQ8ZzvlAuxHkMGAuRpPqg1TlBoWhorIE=";
+    hash = "sha256-p/XDWnE9lm/LwT3r/lhQWtEJ3YoaGRFd4Rv7RbdDIeg=";
  };

  passthru = {
@@ -13,7 +13,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "babl";
-  version = "0.1.122";
+  version = "0.1.124";

  outputs = [
    "out"
@@ -23,7 +23,7 @@ stdenv.mkDerivation (finalAttrs: {

  src = fetchurl {
    url = "https://download.gimp.org/pub/babl/${lib.versions.majorMinor finalAttrs.version}/babl-${finalAttrs.version}.tar.xz";
-    hash = "sha256-aFH3Bc2jjy3wikuoYYJ5zjDQpG+Vf+aqMlt7feKXvtI=";
+    hash = "sha256-Gw1USrb0CfKxtfZ3ImJy0ejG03Py9FPuhwv8fl3U8bE=";
  };

  patches = [
@@ -66,6 +66,13 @@ stdenv.mkDerivation (finalAttrs: {
    libsecret
  ];

+  # bazaar needs bazaar-dl-worker in path
+  preFixup = ''
+    gappsWrapperArgs+=(
+      --prefix PATH : $out/bin
+    )
+  '';
+
  passthru = {
    updateScript = nix-update-script { };
  };
@@ -22,14 +22,14 @@ let
 in
 python.pkgs.buildPythonApplication (finalAttrs: {
  pname = "borgbackup";
-  version = "1.4.3";
+  version = "1.4.4";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "borgbackup";
    repo = "borg";
    tag = finalAttrs.version;
-    hash = "sha256-v42Mv2wz34w2VYu2mPT/K7VtGSYsUDr+NUM99AzpSB0=";
+    hash = "sha256-pMZr9cVr84b948b5Iuevpy6AtMeYo/Ma8uFLuagAYy4=";
  };

  postPatch = ''
@@ -23,13 +23,13 @@

 stdenv.mkDerivation rec {
  pname = "bpftrace";
-  version = "0.24.2";
+  version = "0.25.0";

  src = fetchFromGitHub {
    owner = "bpftrace";
    repo = "bpftrace";
    rev = "v${version}";
-    hash = "sha256-LkiHwmKU+TOtn6mDvlqIKvSOQaU320aVQOkcElzB7gM=";
+    hash = "sha256-N3XrfFfcw5j9EbX0fSz8GrD2+DjBxa89+c1yUYOwmwQ=";
  };

  buildInputs = with llvmPackages; [
@@ -8,13 +8,13 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cargo-nextest";
-  version = "0.9.130";
+  version = "0.9.131";

  src = fetchFromGitHub {
    owner = "nextest-rs";
    repo = "nextest";
    tag = "cargo-nextest-${finalAttrs.version}";
-    hash = "sha256-/akjZB3LF96T2R94lUUP0JP85Z3cGBucJ6YzPBwUTS0=";
+    hash = "sha256-nZfvxpBT8Uo+41Jpoff1gRGWVJJK7KbeCwD3DMQR8RM=";
  };

  # FIXME: we don't support dtrace probe generation on macOS until we have a dtrace build: https://github.com/NixOS/nixpkgs/pull/392918
@@ -22,7 +22,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    ./no-dtrace-macos.patch
  ];

-  cargoHash = "sha256-1EGzsdynaNRxtASuBkxJLha+03OhVSJbVCu7BuccIkY=";
+  cargoHash = "sha256-lS1+BhznJVjMm4BYyM/NqgAB+B6758PeRU0aVtatqIM=";

  cargoBuildFlags = [
    "-p"
@@ -10,13 +10,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "cgl";
-  version = "0.60.9";
+  version = "0.60.10";

  src = fetchFromGitHub {
    owner = "coin-or";
    repo = "Cgl";
    rev = "releases/${finalAttrs.version}";
-    hash = "sha256-E84yCrgpRMjt7owPLPk1ATW+aeHNw8V24DHgkb6boIE=";
+    hash = "sha256-zkq8pdn4m56sGd3I6xID3M+u7BxVp0S5naKBjqAdeyE=";
  };

  nativeBuildInputs = [
@@ -11,7 +11,7 @@
 buildNpmPackage rec {
  pname = "clever-tools";

-  version = "4.7.0";
+  version = "4.7.1";

  nodejs = nodejs_22;

@@ -19,10 +19,10 @@ buildNpmPackage rec {
    owner = "CleverCloud";
    repo = "clever-tools";
    rev = version;
-    hash = "sha256-W7SE6ZdoFArKmnKiHNDRTuIMvchG/QTFahacUKkzYTI=";
+    hash = "sha256-FUhqvUN4ml3uCKnU6YJLp96rX27/+LL+mrUul+LV4Vs=";
  };

-  npmDepsHash = "sha256-pZ8MYQ+QAPDk/1XI3lCgc+wstcwDHo+k59jWcc9/hgs=";
+  npmDepsHash = "sha256-sT3rNYPli6hy7fv3v++JQ9Pex6y5h1tyCWAU1TekqLw=";

  nativeBuildInputs = [
    installShellFiles
@@ -6,18 +6,18 @@

 buildGoModule (finalAttrs: {
  pname = "cnspec";
-  version = "13.0.0";
+  version = "13.1.1";

  src = fetchFromGitHub {
    owner = "mondoohq";
    repo = "cnspec";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-qA48TBt1S4M6xyvfBELxbJd0R7PwY34naZctb4XRnwo=";
+    hash = "sha256-579zSogioTKdsqOwTptJUqN1IEWnPzEmWrSjllqIYOY=";
  };

  proxyVendor = true;

-  vendorHash = "sha256-CwR0/L+ptBKjBLLZ7I96+jxJyCAgM7V0etXz+H0vlhI=";
+  vendorHash = "sha256-ZPJGtI5HTetjSDfkXmF2elyXPO7AmQn1zmXzEjNIIXc=";

  subPackages = [ "apps/cnspec" ];

@@ -1,22 +1,22 @@
 {
-  "version": "2.6.19",
+  "version": "2.6.20",
  "vscodeVersion": "1.105.1",
  "sources": {
    "x86_64-linux": {
-      "url": "https://downloads.cursor.com/production/224838f96445be37e3db643a163a817c15b3606c/linux/x64/Cursor-2.6.19-x86_64.AppImage",
-      "hash": "sha256-KPHcY7KhcWTpiFPvHUXmP57ePOW1ouANYVtFMaSzN3Y="
+      "url": "https://downloads.cursor.com/production/b29eb4ee5f9f6d1cb2afbc09070198d3ea6ad76f/linux/x64/Cursor-2.6.20-x86_64.AppImage",
+      "hash": "sha256-fEvDNnFdJ2WhFam6tw1rnDbNQEZmxsoraIuvrHuKy+w="
    },
    "aarch64-linux": {
-      "url": "https://downloads.cursor.com/production/224838f96445be37e3db643a163a817c15b3606c/linux/arm64/Cursor-2.6.19-aarch64.AppImage",
-      "hash": "sha256-oyWGiuMkfEgwVd5c28CWfPjZHK3agtfrWZ54/Bk4c6E="
+      "url": "https://downloads.cursor.com/production/b29eb4ee5f9f6d1cb2afbc09070198d3ea6ad76f/linux/arm64/Cursor-2.6.20-aarch64.AppImage",
+      "hash": "sha256-SEiPNP1wZrLN+fW6q3ldniZYA7ndFf4p7OarPOvCxig="
    },
    "x86_64-darwin": {
-      "url": "https://downloads.cursor.com/production/224838f96445be37e3db643a163a817c15b3606c/darwin/x64/Cursor-darwin-x64.dmg",
-      "hash": "sha256-vHIQTWpYouXll7T661/IlsWzw6nEl09OoxfUZhpFLVs="
+      "url": "https://downloads.cursor.com/production/b29eb4ee5f9f6d1cb2afbc09070198d3ea6ad76f/darwin/x64/Cursor-darwin-x64.dmg",
+      "hash": "sha256-PWgoiEFLXJr3AIcPN485BUUuGeCxXr0yk3ROmOILOh4="
    },
    "aarch64-darwin": {
-      "url": "https://downloads.cursor.com/production/224838f96445be37e3db643a163a817c15b3606c/darwin/arm64/Cursor-darwin-arm64.dmg",
-      "hash": "sha256-qDaqhZqUu7WQieSvLHnMk3rghWGhg/rA8tFBuRnh/nk="
+      "url": "https://downloads.cursor.com/production/b29eb4ee5f9f6d1cb2afbc09070198d3ea6ad76f/darwin/arm64/Cursor-darwin-arm64.dmg",
+      "hash": "sha256-WxJUezRquZglmjRzjFkBcqLeByAwGTuYSJFWCccuKXc="
    }
  }
 }
@@ -8,17 +8,17 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "codebook";
-  version = "0.3.32";
+  version = "0.3.34";

  src = fetchFromGitHub {
    owner = "blopker";
    repo = "codebook";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-UkE1ND1ditGIlplHG6EslK2uDvRWz7jmn2UmUhlYbdE=";
+    hash = "sha256-BMPwYw7BHywyDJLgHzJt6HsrI23Y+Ng+vcUdFNJH68M=";
  };

  buildAndTestSubdir = "crates/codebook-lsp";
-  cargoHash = "sha256-27+9vjTHBxJ3WM2e3xmTO2CmJvsmqN4nhqD0Sf0YtEw=";
+  cargoHash = "sha256-q6oEHXGxItR9GW2vqpj2i6AN0hH8ybMQ+vkX4aljt/I=";

  env = {
    CARGO_PROFILE_RELEASE_LTO = "fat";
@@ -20,13 +20,13 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "codex";
-  version = "0.114.0";
+  version = "0.115.0";

  src = fetchFromGitHub {
    owner = "openai";
    repo = "codex";
    tag = "rust-v${finalAttrs.version}";
-    hash = "sha256-7t+mVwP4+YrG1ciI+OLqsK7TUM9SrDbPsJNrt26iy9c=";
+    hash = "sha256-8l5OZQS6L1uhVpqZZGx2O3Xt6qTaTAYDR5XWOydTVuQ=";
  };

  sourceRoot = "${finalAttrs.src.name}/codex-rs";
@@ -43,7 +43,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    '';
  };

-  cargoHash = "sha256-Ig3VMNN1oeC9DyjjVPTiXw4JXCuO01eRYJClcIXu8vQ=";
+  cargoHash = "sha256-7lp6QslpGPXtDXVvlg/+m6LrLV/Ygd1FcjtlMviE3oM=";

  nativeBuildInputs = [
    clang
@@ -103,6 +103,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
  passthru = {
    updateScript = nix-update-script {
      extraArgs = [
+        "--use-github-releases"
        "--version-regex"
        "^rust-v(\\d+\\.\\d+\\.\\d+)$"
      ];
@@ -13,11 +13,11 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "copybara";
-  version = "20260309";
+  version = "20260316";

  src = fetchurl {
    url = "https://github.com/google/copybara/releases/download/v${finalAttrs.version}/copybara_deploy.jar";
-    hash = "sha256-rqOIHssDndLdjyCjEjInBIBeYZm0Uvkne/qVRTHhJBg=";
+    hash = "sha256-A2Srm+qguUrJhCNLeNj++MOIHAKv8L24bxANJx4+gpQ=";
  };

  nativeBuildInputs = [
@@ -2,6 +2,7 @@
  lib,
  fetchFromGitHub,
  buildPythonPackage,
+  versionCheckHook,

  # build-system
  setuptools,
@@ -15,6 +16,7 @@
  httpx,
  itsdangerous,
  packaging,
+  packaging-legacy,
  passlib,
  platformdirs,
  pluggy,
@@ -27,7 +29,6 @@
  # tests
  beautifulsoup4,
  nginx,
-  packaging-legacy,
  pytest-asyncio,
  pytestCheckHook,
  webtest,
@@ -41,14 +42,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "devpi-server";
-  version = "6.19.1";
+  version = "6.19.2";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "devpi";
    repo = "devpi";
    tag = "server-${finalAttrs.version}";
-    hash = "sha256-YFY2iLnORzFxnfGYU2kCpJL8CZi+lALIkL1bRpfd4NE=";
+    hash = "sha256-rAku3oHcmzFNA/MP/64382gCTgqopwjjy4S4HTEFZiY=";
  };

  postPatch = ''
@@ -71,6 +72,7 @@ buildPythonPackage (finalAttrs: {
    httpx
    itsdangerous
    packaging
+    packaging-legacy
    passlib
    platformdirs
    pluggy
@@ -83,10 +85,11 @@ buildPythonPackage (finalAttrs: {
  ]
  ++ passlib.optional-dependencies.argon2;

+  nativeInstallCheckInputs = [ versionCheckHook ];
+
  nativeCheckInputs = [
    beautifulsoup4
    nginx
-    packaging-legacy
    pytest-asyncio
    pytestCheckHook
    webtest
@@ -141,5 +144,6 @@ buildPythonPackage (finalAttrs: {
      confus
      makefu
    ];
+    mainProgram = "devpi-server";
  };
 })
@@ -17,13 +17,13 @@

 python3.pkgs.buildPythonApplication (finalAttrs: {
  pname = "diffuse";
-  version = "0.10.0";
+  version = "0.11.0";

  src = fetchFromGitHub {
    owner = "MightyCreak";
    repo = "diffuse";
    rev = "v${finalAttrs.version}";
-    sha256 = "Svt+llBwJKGXRJZ96dzzdzpL/5jrzXXM/FPZwA7Es8s=";
+    sha256 = "vQVtvQrs8oPevvrC75T2YcdYuT5XYDiAFDTduTkICBk=";
  };

  pyproject = false;
@@ -6,13 +6,13 @@

 buildGoModule (finalAttrs: {
  pname = "dnsproxy";
-  version = "0.80.0";
+  version = "0.81.0";

  src = fetchFromGitHub {
    owner = "AdguardTeam";
    repo = "dnsproxy";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-acgNACztAOudrtzh1MeSzJza+lH9V8s5AmHkyETpy0E=";
+    hash = "sha256-O3ZwH//NpYEg3BS5Yk4MpkIb6PrsIzINs/Kyt5uKspg=";
  };

  vendorHash = "sha256-NS7MsK7QXg8tcAytYd9FGvaYZcReYkO5ESPpLbzL0IQ=";
@@ -1,7 +1,7 @@
 { mkDprintPlugin }:
 mkDprintPlugin {
  description = "Biome (JS/TS/JSON) wrapper plugin";
-  hash = "sha256-t58jDcUp60fbRJmE1B5hJnKdl2N5qU9dLC7Juo5IqtI=";
+  hash = "sha256-UXpqyifwSnkenmhO8tLmc0+KPtz8yZd/tST/LUEZkwo=";
  initConfig = {
    configExcludes = [ "**/node_modules" ];
    configKey = "biome";
@@ -17,6 +17,6 @@ mkDprintPlugin {
  };
  pname = "dprint-plugin-biome";
  updateUrl = "https://plugins.dprint.dev/dprint/biome/latest.json";
-  url = "https://plugins.dprint.dev/biome-0.12.2.wasm";
-  version = "0.12.2";
+  url = "https://plugins.dprint.dev/biome-0.12.4.wasm";
+  version = "0.12.4";
 }
@@ -16,7 +16,10 @@ stdenv.mkDerivation (finalAttrs: {
    hash = "sha256-wPseLfbRffX0Pr4TxJh59cmuY1OEfSDTvM2KrORafKs=";
  };

-  CFLAGS = "-Ofast -DSTRIP_DEBUG";
+  env.CFLAGS = toString [
+    "-Ofast"
+    "-DSTRIP_DEBUG"
+  ];

  installPhase = ''
    install -Dm755 libfakedir.dylib $out/lib/libfakedir.dylib
@@ -15,13 +15,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "fcitx5-mcbopomofo";
-  version = "2.9.5";
+  version = "3.0";

  src = fetchFromGitHub {
    owner = "openvanilla";
    repo = "fcitx5-mcbopomofo";
    rev = finalAttrs.version;
-    hash = "sha256-efpVvWchJywKyGu7I6pNRVKJhIv01iKAXFCJ+7kcMwc=";
+    hash = "sha256-yeqNiRiV/RXyFAlEfvsTLcw+AD/qZNvPLr34Cvqe360=";
  };

  nativeBuildInputs = [
@@ -6,10 +6,10 @@

 let
  pname = "fflogs";
-  version = "8.20.113";
+  version = "9.0.24";
  src = fetchurl {
    url = "https://github.com/RPGLogs/Uploaders-fflogs/releases/download/v${version}/fflogs-v${version}.AppImage";
-    hash = "sha256-mwbATBhkbeZ2f4KAytOgp8XbCL4dY7S7OPHj//4kqGQ=";
+    hash = "sha256-9L9eNpK2MI3P+mhUDCAzfi3YDdWpHGjiUS5LjksUjqo=";
  };
  extracted = appimageTools.extractType2 { inherit pname version src; };
 in
@@ -11,17 +11,17 @@

 buildNpmPackage rec {
  pname = "firebase-tools";
-  version = "15.9.1";
+  version = "15.11.0";
  nodejs = nodejs_22;

  src = fetchFromGitHub {
    owner = "firebase";
    repo = "firebase-tools";
    tag = "v${version}";
-    hash = "sha256-FSgDzxd0C8DmDfcRmo3i8G1xkOYvyeQEaWxMYVdUOr4=";
+    hash = "sha256-QjY76mikVl0P0YY0YsvUFDsN8DAway175mm9orWrNLc=";
  };

-  npmDepsHash = "sha256-uMSNrXHg9FWaYDok/BxKkpy2cF+Go7YbgjFJZbnktoo=";
+  npmDepsHash = "sha256-dM+IiU360JvO2UN1EKuMvDedEnPLfc/B4mwHNPNFxbE=";

  # No more package-lock.json in upstream src
  postPatch = ''
@@ -10,16 +10,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "flake-edit";
-  version = "0.3.3";
+  version = "0.3.4";

  src = fetchFromGitHub {
    owner = "a-kenji";
    repo = "flake-edit";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-CDz7iDOPearlxsqLuAuG+cmKneFavxJmdCbnWwEIvcU=";
+    hash = "sha256-nQ4CW4oY5a1ukX/FNqFyCXwat0baFYSj75iHT5Fcx3s=";
  };

-  cargoHash = "sha256-IvBrJBSAMLfqefyUnS3Ex+JvHJAWJtVtkBVp2kFvA4s=";
+  cargoHash = "sha256-teey4OjNyiDE2ZBZnBkU84gnWTykjlktMZzJ2ll2A+w=";

  nativeBuildInputs = [
    installShellFiles
@@ -6,16 +6,16 @@

 buildGoModule (finalAttrs: {
  pname = "olm";
-  version = "1.4.2";
+  version = "1.4.3";

  src = fetchFromGitHub {
    owner = "fosrl";
    repo = "olm";
    tag = finalAttrs.version;
-    hash = "sha256-Tily8Srpr5GpKTYl3Ivm1b/VN2yEzbbHHABeoJvo3wo=";
+    hash = "sha256-4dzbSW9AoFitypVOD/N4/mnUJwh0USgOwVqcopLkcYs=";
  };

-  vendorHash = "sha256-lqH/pMWeDsTJa39uJwHntCAUs0BwJiB0aMyFaI++5ms=";
+  vendorHash = "sha256-D93SPwXAeoTLCbScjyH8AB9TJIF2b/UbLNMIQYi+B+c=";

  ldflags = [
    "-s"
@@ -33,6 +33,6 @@ python3Packages.buildPythonApplication (finalAttrs: {
    mainProgram = "fprettify";
    homepage = "https://pypi.org/project/fprettify/";
    license = with lib.licenses; [ gpl3Only ];
-    maintainers = with lib.maintainers; [ fabiangd ];
+    maintainers = [ ];
  };
 })
@@ -11,13 +11,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "ft2-clone";
-  version = "2.11";
+  version = "2.12";

  src = fetchFromGitHub {
    owner = "8bitbubsy";
    repo = "ft2-clone";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-thOQcsnFkDJh0P2Yu/1rCmt/M3Ikr88ffFHUDrgFNyk=";
+    hash = "sha256-Ca4vp2uEF7rZJ+0lAmVqC/6F+2CgbDLK2GkbG5Tn//0=";
  };

  nativeBuildInputs = [ cmake ];
@@ -37,7 +37,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "gegl";
-  version = "0.4.64";
+  version = "0.4.68";

  outputs = [
    "out"
@@ -48,7 +48,7 @@ stdenv.mkDerivation (finalAttrs: {

  src = fetchurl {
    url = "https://download.gimp.org/pub/gegl/${lib.versions.majorMinor finalAttrs.version}/gegl-${finalAttrs.version}.tar.xz";
-    hash = "sha256-DeHJ3SLBYNXkvfw4jSkvA0R8ymJYVBuaEv7Xg9DPfGA=";
+    hash = "sha256-UAIwm5pwEmBljos6YVQP1Wc4h875mDOOGZJSSjOyOuM=";
  };

  nativeBuildInputs = [
@@ -104,6 +104,8 @@ stdenv.mkDerivation (finalAttrs: {
    # Disabled due to multiple vulnerabilities, see
    # https://github.com/NixOS/nixpkgs/pull/73586
    "-Djasper=disabled"
+    # Selecting platform default is broken by -Dauto_features.
+    "-Drelocatable=disabled"
  ]
  ++ lib.optionals (!withLuaJIT) [
    "-Dlua=disabled"
@@ -8,12 +8,12 @@
 }:

 let
-  version = "3.1.9";
+  version = "3.2.0";
  src = fetchFromGitHub {
    owner = "jaseg";
    repo = "gerbolyze";
    tag = "v${version}";
-    hash = "sha256-bisLln3Y239HuJt0MkrCU+6vLLbEDxfTjEJMkcbE/wE=";
+    hash = "sha256-T3e0qoVD98u2lgCmQvof2SOqV8WkBkZrhnccURlJqsA=";
    fetchSubmodules = true;
  };

@@ -39,15 +39,16 @@ let
    };
  };
 in
-python3Packages.buildPythonApplication rec {
+python3Packages.buildPythonApplication {
  inherit version src;
  pname = "gerbolyze";
  pyproject = true;

-  build-system = with python3Packages; [ setuptools ];
+  build-system = with python3Packages; [ uv-build ];

  pythonRemoveDeps = [
    # we already provide svg-flatten through a binary on the PATH
+    "resvg-wasi"
    "svg-flatten-wasi"
  ];

@@ -58,20 +59,9 @@ python3Packages.buildPythonApplication rec {
    python-slugify
    lxml
    gerbonara
+    resvg
  ];

-  preConfigure = ''
-    # setup.py tries to execute a call to git in a subprocess, this avoids it.
-    substituteInPlace setup.py \
-      --replace-fail "version = get_version()," \
-                     "version = '${version}'," \
-
-    # setup.py tries to execute a call to git in a subprocess, this avoids it.
-    substituteInPlace setup.py \
-      --replace-fail "long_description=format_readme_for_pypi()," \
-                     "long_description='\n'.join(Path('README.rst').read_text().splitlines()),"
-  '';
-
  pythonImportsCheck = [ "gerbolyze" ];

  nativeCheckInputs = [
@@ -89,6 +79,11 @@ python3Packages.buildPythonApplication rec {
    }"
  ];

+  preCheck = ''
+    substituteInPlace tests/test_integration.py \
+      --replace-fail "'gerbolyze'" "'${placeholder "out"}/bin/gerbolyze'"
+  '';
+
  passthru.updateScript = gitUpdater {
    rev-prefix = "v";
  };
@@ -1,7 +1,7 @@
 {
  lib,
  stdenv,
-  buildGoModule,
+  buildGo126Module,
  fetchFromGitHub,
  installShellFiles,
  testers,
@@ -9,18 +9,18 @@
  ghq,
 }:

-buildGoModule (finalAttrs: {
+buildGo126Module (finalAttrs: {
  pname = "ghq";
-  version = "1.8.1";
+  version = "1.9.4";

  src = fetchFromGitHub {
    owner = "x-motemen";
    repo = "ghq";
    tag = "v${finalAttrs.version}";
-    sha256 = "sha256-Iw8hu2QtnRgRbSTqtIPDmKbx5FcE2j68VfzP4egbZgY=";
+    sha256 = "sha256-z7tLCSThR4EFLk8GnyrB8H6d/9t5AKegVEdzlleCS94=";
  };

-  vendorHash = "sha256-RRxRwYTkveOZvvxAwpG9ie4+ZdUDDkZZfX5cNn0DAhA=";
+  vendorHash = "sha256-/uk1hf5eXpNULKm7UeVgQ7Lc7YOU+eV9Yd/4lYorz/8=";

  doCheck = false;

@@ -6,20 +6,21 @@
  fetchFromGitLab,
  nix-update-script,
  versionCheckHook,
+  writableTmpDirAsHomeHook,
 }:

 buildGoModule (finalAttrs: {
  pname = "gitlab-runner";
-  version = "18.8.0";
+  version = "18.9.0";

  src = fetchFromGitLab {
    owner = "gitlab-org";
    repo = "gitlab-runner";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-rS7+BUdec+Z4G/dd5D/NHe3gbELWicg0Nmgx4zJAIX4=";
+    hash = "sha256-U13SouwEfCVy5M8fv6rkCX0F+ecVYdsocvAdt3yxPJA=";
  };

-  vendorHash = "sha256-Br9TW+sg7PDOE2d8lVQ9Xv9+UD7JHzitdTOcyodHr+s=";
+  vendorHash = "sha256-Ak1Q8FnTD8LKcN9xRc1gpcnUiambGC3CJP84cwQqTtM=";

  # For patchShebangs
  buildInputs = [ bash ];
@@ -85,6 +86,8 @@ buildGoModule (finalAttrs: {
      "-X ${ldflagsPackageVariablePrefix}.REVISION=v${finalAttrs.version}"
    ];

+  nativeCheckInputs = [ writableTmpDirAsHomeHook ];
+
  preCheck = ''
    # Make the tests pass outside of GitLab CI
    export CI=0
@@ -1,5 +1,5 @@
 diff --git a/shells/bash_test.go b/shells/bash_test.go
-index 9ed9e65ff..02b6e6d5f 100644
+index bbbe949f4..955992d3f 100644
 --- a/shells/bash_test.go
 +++ b/shells/bash_test.go
@@ -4,11 +4,9 @@ package shells
@@ -11,10 +11,10 @@ index 9ed9e65ff..02b6e6d5f 100644
 
 	"github.com/stretchr/testify/assert"
 -	"github.com/stretchr/testify/require"
- 	"gitlab.com/gitlab-org/gitlab-runner/common"
- )
 
-@@ -90,65 +88,6 @@ func TestBash_CheckForErrors(t *testing.T) {
+ 	"gitlab.com/gitlab-org/gitlab-runner/common"
+ 	"gitlab.com/gitlab-org/gitlab-runner/common/spec"
+@@ -78,65 +76,6 @@ func TestBash_CheckForErrors(t *testing.T) {
 	}
 }
 
@@ -16,16 +16,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "gleam";
-  version = "1.15.1";
+  version = "1.15.2";

  src = fetchFromGitHub {
    owner = "gleam-lang";
    repo = "gleam";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-5wnHS9366qqfmJyatmElIwzCVazdNf3xH8Ydh2cPX2E=";
+    hash = "sha256-A5rss4+hTLiE0mylzTT1sw18MmDdYBIyu6xLTvMJ1YY=";
  };

-  cargoHash = "sha256-Z8fEhj0b6K3KHmmC1CPaMXBdMn9fHu2Jc9ukDGFtSb4=";
+  cargoHash = "sha256-VyVcBAqwrgwiyUXkKPbfP4qTKtFOMCUD0Tho79xJxC8=";

  nativeBuildInputs = [
    pkg-config
@@ -43,19 +43,15 @@ stdenv.mkDerivation rec {
      sha256 = "0017xg5agj3dy0hx71ijdcrxb72bjqv7x6aq7c9zxzyyw0mkxj0k";
    })
    (fetchpatch {
-      url = "https://sources.debian.org/data/main/g/glob2/0.9.4.4-6/debian/patches/10_pthread_underlinkage.patch";
+      url = "https://sources.debian.org/data/main/g/glob2/0.9.4.4-11/debian/patches/10_pthread_underlinkage.patch";
      sha256 = "sha256-L9POADlkgQbUQEUmx4s3dxXG9tS0w2IefpRGuQNRMI0=";
    })
    (fetchpatch {
-      url = "https://sources.debian.org/data/main/g/glob2/0.9.4.4-6/debian/patches/link-boost-system.patch";
-      sha256 = "sha256-ne6F2ZowB+TUmg3ePuUoPNxXI0ZJC6HEol3oQQHJTy4=";
+      url = "https://sources.debian.org/data/main/g/glob2/0.9.4.4-11/debian/patches/scons.patch";
+      sha256 = "sha256-kHuFQCmkCkogqK6vfHKGYeZrMvsdQ7h8B3CcCtjLr50=";
    })
    (fetchpatch {
-      url = "https://sources.debian.org/data/main/g/glob2/0.9.4.4-6/debian/patches/scons.patch";
-      sha256 = "sha256-Gah7SoVcd/Aljs0Nqo3YF0lZImUWtrGM4HbbQ4yrhHU=";
-    })
-    (fetchpatch {
-      url = "https://sources.debian.org/data/main/g/glob2/0.9.4.4-6/debian/patches/boost-1.69.patch";
+      url = "https://sources.debian.org/data/main/g/glob2/0.9.4.4-11/debian/patches/boost-1.69.patch";
      sha256 = "sha256-D7agFR4uyIHxQz690Q8EHPF+rTEoiGUpgkm7r5cL5SI=";
    })
  ];
@@ -77,6 +73,7 @@ stdenv.mkDerivation rec {
    scons
    bsdiff # bspatch
  ];
+
  buildInputs = [
    libGLU
    libGL
@@ -98,8 +95,6 @@ stdenv.mkDerivation rec {
    "DATADIR=${placeholder "out"}/share/globulation2/glob2"
  ];

-  env.NIX_LDFLAGS = "-lboost_system";
-
  meta = {
    description = "RTS without micromanagement";
    mainProgram = "glob2";
@@ -8,13 +8,13 @@
 }:
 buildGoModule (finalAttrs: {
  pname = "golazo";
-  version = "0.21.0";
+  version = "0.22.0";

  src = fetchFromGitHub {
    owner = "0xjuanma";
    repo = "golazo";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-TWpaW8MTkYEOp+7dd3LiDs05tCB3riUPmFRzhMiAeZI=";
+    hash = "sha256-t8jzZcOVJaeQ4SGb8WO9lqzVgllz2mX8mUwk+JsNWzI=";
  };

  vendorHash = "sha256-M2gfqU5rOfuiVSZnH/Dr8OVmDhyU2jYkgW7RuIUTd+E=";
@@ -6,16 +6,16 @@

 buildGoModule (finalAttrs: {
  pname = "gosec";
-  version = "2.24.7";
+  version = "2.25.0";

  src = fetchFromGitHub {
    owner = "securego";
    repo = "gosec";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-a350HsTvcXEmJC6mWF4kF2RuZ3LwS0buFMwpFi+nCSQ=";
+    hash = "sha256-ssRSI8RPwC+VSW6tPRLr4q5BE0hixWf4O92Fgu0P1aE=";
  };

-  vendorHash = "sha256-anuAY4Z9rEOlkdNEcCCySW3ci79OdhiuhH+/uXX/6sU=";
+  vendorHash = "sha256-wXR5EMI7bvPFudAtw2/z4O//Zkbop71XAS3uyXx3iQs=";

  subPackages = [
    "cmd/gosec"
@@ -0,0 +1,77 @@
+{
+  lib,
+  fetchFromGitHub,
+  versionCheckHook,
+  installShellFiles,
+
+  stdenv,
+  clangStdenv,
+  llvmPackages,
+  nixosTests,
+
+  # https://goupile.org/en/build recommends a Paranoid build
+  # which is not bit by bit reproducible, whereas others are
+  profile ? "Paranoid",
+}:
+
+assert lib.assertOneOf "profile" profile [
+  "Fast"
+  "Debug"
+  "Paranoid"
+];
+
+let
+  stdenv' = if (profile == "Paranoid") then clangStdenv else stdenv;
+in
+stdenv'.mkDerivation (finalAttrs: {
+  pname = "goupile";
+  version = "3.12.1";
+
+  # https://github.com/Koromix/rygel/tags
+  src = fetchFromGitHub {
+    owner = "Koromix";
+    repo = "rygel";
+    tag = "goupile/${finalAttrs.version}";
+    hash = "sha256-Pn/0tjezVKJedAtqj69avxeIK2l3l9FGioYSyEao12E=";
+  };
+
+  nativeBuildInputs = [
+    installShellFiles
+  ]
+  ++ lib.optionals (profile == "Paranoid") [
+    llvmPackages.bintools
+  ];
+
+  # pipe2() is only exposed with _GNU_SOURCE
+  NIX_CFLAGS_COMPILE = [ "-D_GNU_SOURCE" ];
+
+  buildPhase = ''
+    runHook preBuild
+    ./bootstrap.sh
+    echo "goupile = ${finalAttrs.version}" >FelixVersions.ini
+    ./felix -s -p${profile} goupile
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    installBin bin/${profile}/goupile
+    runHook postInstall
+  '';
+
+  doInstallCheck = true;
+  versionCheckProgramArg = "--version";
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  passthru.tests = { inherit (nixosTests) goupile; };
+
+  meta = {
+    changelog = "https://github.com/Koromix/rygel/blob/${finalAttrs.src.rev}/src/goupile/CHANGELOG.md";
+    description = "Free design tool for secure forms including Clinical Report Forms (eCRF)";
+    homepage = "https://goupile.org/en";
+    license = lib.licenses.gpl3Plus; # sdpx headers
+    platforms = lib.platforms.linux; # https://goupile.org/en/build
+    mainProgram = "goupile";
+    teams = with lib.teams; [ ngi ];
+  };
+})
@@ -6,105 +6,106 @@
  buildGoModule,
  buildNpmPackage,
  systemd,
-  grafana-alloy,
+  installShellFiles,
+  versionCheckHook,
  nixosTests,
  nix-update-script,
-  installShellFiles,
-  testers,
  lld,
  useLLD ? stdenv.hostPlatform.isArmv7,
 }:
-
 buildGoModule (finalAttrs: {
  pname = "grafana-alloy";
-  version = "1.12.2";
+  version = "1.14.1";
+
  src = fetchFromGitHub {
    owner = "grafana";
    repo = "alloy";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-C/yqsUjEwKnGRkxMOQkKfGdeERbvO/e7D7c3CyJ+cVY=";
+    hash = "sha256-zgbbbuq+sb+nU1vgzaxEHGY77k+TXFrlvcvs/NSqQAM=";
  };

  npmDeps = fetchNpmDeps {
    src = "${finalAttrs.src}/internal/web/ui";
-    hash = "sha256-3J1Slka5bi+72NUaHBmDTtG1faJWRkOlkClKnUyiUsk=";
+    hash = "sha256-GT0yisPn+3FCtWL3he0i5zPMlaWNparQDefU69G4Yis=";
  };

  frontend = buildNpmPackage {
    pname = "alloy-frontend";
    inherit (finalAttrs) version src;

-    inherit (finalAttrs) npmDeps;
    sourceRoot = "${finalAttrs.src.name}/internal/web/ui";

+    inherit (finalAttrs) npmDeps;
+
    installPhase = ''
      runHook preInstall

-      mkdir $out
+      mkdir -p $out
      cp -av dist $out/share

      runHook postInstall
    '';
  };

-  proxyVendor = true;
-  vendorHash = "sha256-Bq/6ld2LldSDhksNqGMHXZAeNHh74D07o2ETpQqMcP4=";
+  patchPhase = ''
+    cp -av ${finalAttrs.frontend}/share internal/web/ui/dist
+  '';

-  nativeBuildInputs = [
-    installShellFiles
+  modRoot = "collector";
+
+  proxyVendor = true;
+  vendorHash = "sha256-A1mbMmpUxg5T7//X5PL1CPGB1OMPhertFvz4sPFTgOg=";
+
+  subPackages = [ "." ];
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/grafana/alloy/internal/build.Version=${finalAttrs.version}"
+    "-X github.com/grafana/alloy/internal/build.Branch=v${finalAttrs.version}"
+    "-X github.com/grafana/alloy/internal/build.Revision=v${finalAttrs.version}"
+    "-X github.com/grafana/alloy/internal/build.BuildUser=nix@nixpkgs"
+    "-X github.com/grafana/alloy/internal/build.BuildDate=1970-01-01T00:00:00Z"
+  ];
+
+  tags = [
+    "embedalloyui"
+    "netgo"
  ]
-  ++ lib.optionals useLLD [ lld ];
+  ++ lib.optionals stdenv.hostPlatform.isLinux [
+    "promtail_journal_enabled"
+  ];

  env =
    lib.optionalAttrs useLLD {
      NIX_CFLAGS_LINK = "-fuse-ld=lld";
    }
    // lib.optionalAttrs (stdenv.hostPlatform.isLinux) {
-      # uses go-systemd, which uses libsystemd headers
+      # Uses go-systemd, which uses libsystemd headers.
      # https://github.com/coreos/go-systemd/issues/351
      NIX_CFLAGS_COMPILE = "-I${lib.getDev systemd}/include";
    };

-  ldflags =
-    let
-      prefix = "github.com/grafana/alloy/internal/build";
-    in
-    [
-      "-s"
-      "-w"
-      # https://github.com/grafana/alloy/blob/3201389252d2c011bee15ace0c9f4cdbcb978f9f/Makefile#L110
-      "-X ${prefix}.Branch=v${finalAttrs.version}"
-      "-X ${prefix}.Version=${finalAttrs.version}"
-      "-X ${prefix}.Revision=v${finalAttrs.version}"
-      "-X ${prefix}.BuildUser=nix"
-      "-X ${prefix}.BuildDate=1970-01-01T00:00:00Z"
-    ];
+  nativeBuildInputs = [
+    installShellFiles
+  ]
+  ++ lib.optionals useLLD [ lld ];

-  tags = [
-    "netgo"
-    "builtinassets"
-    "promtail_journal_enabled"
-  ];
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    mv -v $out/bin/otel_engine $out/bin/alloy

-  patchPhase = ''
-    # Copy frontend build in
-    cp -va "${finalAttrs.frontend}/share" "internal/web/ui/dist"
+    installShellCompletion --cmd alloy \
+      --bash <($out/bin/alloy completion bash) \
+      --fish <($out/bin/alloy completion fish) \
+      --zsh <($out/bin/alloy completion zsh)
  '';

-  subPackages = [
-    "."
-  ];
-
-  checkFlags = [
-    "-tags"
-    "nonetwork" # disable network tests
-    "-tags"
-    "nodocker" # disable docker tests
-  ];
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "-v";

  # go-systemd uses libsystemd under the hood, which does dlopen(libsystemd) at
-  # runtime.
-  # Add to RUNPATH so it can be found.
+  # runtime. Add to RPATH so it can be found.
  postFixup = lib.optionalString stdenv.hostPlatform.isLinux ''
    patchelf \
      --set-rpath "${
@@ -113,20 +114,9 @@ buildGoModule (finalAttrs: {
      $out/bin/alloy
  '';

-  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
-    installShellCompletion --cmd alloy \
-      --bash <($out/bin/alloy completion bash) \
-      --fish <($out/bin/alloy completion fish) \
-      --zsh <($out/bin/alloy completion zsh)
-  '';
-
  passthru = {
    tests = {
      inherit (nixosTests) alloy;
-      version = testers.testVersion {
-        version = "v${finalAttrs.version}";
-        package = grafana-alloy;
-      };
    };
    updateScript = nix-update-script {
      extraArgs = [
@@ -134,21 +124,26 @@ buildGoModule (finalAttrs: {
        "v(.+)"
      ];
    };
-    # for nix-update to be able to find and update the hash
+    # For nix-update to be able to find and update the hash.
    inherit (finalAttrs) npmDeps;
  };

  meta = {
-    description = "Open source OpenTelemetry Collector distribution with built-in Prometheus pipelines and support for metrics, logs, traces, and profiles";
-    mainProgram = "alloy";
-    license = lib.licenses.asl20;
+    description = "OpenTelemetry Collector distribution with programmable pipelines";
+    longDescription = ''
+      Grafana Alloy is an open source OpenTelemetry Collector distribution with
+      built-in Prometheus pipelines and support for metrics, logs, traces, and
+      profiles.
+    '';
    homepage = "https://grafana.com/oss/alloy";
    changelog = "https://github.com/grafana/alloy/blob/${finalAttrs.src.rev}/CHANGELOG.md";
+    license = lib.licenses.asl20;
+    platforms = lib.platforms.unix;
    maintainers = with lib.maintainers; [
      azahi
      flokli
      hbjydev
    ];
-    platforms = lib.platforms.unix;
+    mainProgram = "alloy";
  };
 })
@@ -7,13 +7,13 @@

 buildGoModule (finalAttrs: {
  pname = "grpc-health-probe";
-  version = "0.4.46";
+  version = "0.4.47";

  src = fetchFromGitHub {
    owner = "grpc-ecosystem";
    repo = "grpc-health-probe";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-+HLYlC0B97iI0Z0bJ1bLTVGi/VtynKmmLBnlS3KcpXY=";
+    hash = "sha256-CKZLJENcXL/d0PD6tB2pmjcbHgrHtys3tsrB93WNcJc=";
  };

  tags = [
@@ -25,7 +25,7 @@ buildGoModule (finalAttrs: {
    "-X main.versionTag=${finalAttrs.version}"
  ];

-  vendorHash = "sha256-4JvUAA1yt9s3pSEGtP7TY96rco64yaNnGC9ZlyzKM5g=";
+  vendorHash = "sha256-1rjyjF531gBoy2SpJKywx3rd3vmxYt719otWQRIRHb8=";

  nativeInstallCheckInputs = [
    versionCheckHook
@@ -8,16 +8,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "hath-rust";
-  version = "1.14.1";
+  version = "1.14.2";

  src = fetchFromGitHub {
    owner = "james58899";
    repo = "hath-rust";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-bo9MXMk/Dfa8cXjeWn14MF6rmVcWYes0WeVn1oC2y0k=";
+    hash = "sha256-aGdQ0nBrLOSs1xgbgn/e1e9QPMDlmpNJvmMtwvAOeVQ=";
  };

-  cargoHash = "sha256-4xty4nUs81nq2Ax7koFplHlscpG1Pdbd5zwd/lQwbmg=";
+  cargoHash = "sha256-1DibBXpg1x04wE+URSqemxqpuR9wgVJqWIIosZwAZ2k=";

  nativeInstallCheckInputs = [ versionCheckHook ];
  doInstallCheck = true;
@@ -6,13 +6,13 @@

 buildGoModule (finalAttrs: {
  pname = "hermit";
-  version = "0.50.0";
+  version = "0.50.1";

  src = fetchFromGitHub {
    rev = "v${finalAttrs.version}";
    owner = "cashapp";
    repo = "hermit";
-    hash = "sha256-2deJGcMZgZIA55Da/7W4y9ib73elQs+2Df/jf62N0EE=";
+    hash = "sha256-XxFeRcit8RcEjbLAT3SsWZrir8/AiDJIz9bzm9E5lUU=";
  };

  vendorHash = "sha256-2sNtok5J1kBvJZ0I1FOq1ZP54TsZbzqu/M3v1nA12m8=";
@@ -112,7 +112,6 @@ stdenv.mkDerivation rec {
    homepage = "https://hyper.is/";
    maintainers = with lib.maintainers; [
      puffnfresh
-      fabiangd
    ];
    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
    license = lib.licenses.mit;
@@ -7,20 +7,20 @@
 }:
 let
  pname = "immersed";
-  version = "10.9.0";
+  version = "11.0.0";

  sources = lib.mapAttrs (_: fetchurl) rec {
    x86_64-linux = {
-      url = "https://web.archive.org/web/20250725134919if_/https://static.immersed.com/dl/Immersed-x86_64.AppImage";
-      hash = "sha256-plGcvZRpV+nhQ4FoYiIuLmyOg/SHJ8ZjT4Fh6UyH9W0=";
+      url = "https://web.archive.org/web/20260306043741/https://static.immersed.com/dl/Immersed-x86_64.AppImage";
+      hash = "sha256-GbckZ/WK+7/PFQvTfUwwePtufPKVwIwSPh+Bo/cG7ko=";
    };
    aarch64-linux = {
-      url = "https://web.archive.org/web/20250725135029if_/https://static.immersed.com/dl/Immersed-aarch64.AppImage";
+      url = "https://web.archive.org/web/20260306043741/https://static.immersed.com/dl/Immersed-aarch64.AppImage";
      hash = "sha256-3BokV30y6QRjE94K7JQ6iIuQw1t+h3BKZY+nEFGTVHI=";
    };
    x86_64-darwin = {
-      url = "https://web.archive.org/web/20250725135025if_/https://static.immersed.com/dl/Immersed.dmg";
-      hash = "sha256-lmSkatB75Bztm19aCC50qrd/NV+HQX9nBMOTxIguaqI=";
+      url = "https://web.archive.org/web/20260306043741/https://static.immersed.com/dl/Immersed.dmg";
+      hash = "sha256-L5nrkchXD1NIQCknYHVhBWbVJVkkHvKaDjuk9qiY340=";
    };
    aarch64-darwin = x86_64-darwin;
  };
@@ -31,7 +31,10 @@ let
    description = "VR coworking platform";
    homepage = "https://immersed.com";
    license = lib.licenses.unfree;
-    maintainers = with lib.maintainers; [ pandapip1 ];
+    maintainers = with lib.maintainers; [
+      pandapip1
+      crertel
+    ];
    platforms = builtins.attrNames sources;
    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
  };
@@ -115,20 +115,20 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "immich";
-  version = "2.5.6";
+  version = "2.6.1";

  src = fetchFromGitHub {
    owner = "immich-app";
    repo = "immich";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-F6lF0wQ2acq0MEoFNnKU68LH5cq1WwRKvsCJB+pEirE=";
+    hash = "sha256-SfvX4QTo/rXXQouwIAGrUdVbaVC4q2Ba3BRaZzjAgig=";
  };

  pnpmDeps = fetchPnpmDeps {
    inherit (finalAttrs) pname version src;
    inherit pnpm;
    fetcherVersion = 3;
-    hash = "sha256-VzlcVHCJCD1Ree0Sy2PFKZSjHBowLoIRqpUKdF2Ph+c=";
+    hash = "sha256-KH2uqAow8oEm6LB3+CVhlCmOjISuW4E0YAdbdrwjiuU=";
  };

  postPatch = ''
@@ -19,7 +19,7 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "intel-graphics-compiler";
-  version = "2.28.4";
+  version = "2.30.1";

  # See the repository for expected versions:
  # <https://github.com/intel/intel-graphics-compiler/blob/v2.16.0/documentation/build_ubuntu.md#revision-table>
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
      owner = "intel";
      repo = "intel-graphics-compiler";
      tag = "v${version}";
-      hash = "sha256-bct1ntvjK738QkoumqwsMJdV+ikpLVtW061637m4vIg=";
+      hash = "sha256-S579+kK+bj0cI0BA2ccBPLMWuqZ1yIHcWiYEDPy0gxw=";
    })
    (fetchFromGitHub {
      name = "llvm-project";
@@ -42,8 +42,8 @@ stdenv.mkDerivation rec {
      name = "vc-intrinsics";
      owner = "intel";
      repo = "vc-intrinsics";
-      tag = "v0.24.3";
-      hash = "sha256-VRws9wzBvNph1sTFjhmigM8ZDI6VMp8ZUJR4cZaK5uA=";
+      tag = "v0.25.0";
+      hash = "sha256-ozc1w3V5RqWHwqNHuefZJMN8RAYxrJxH9bd1BEqxfiQ=";
    })
    (fetchFromGitHub {
      name = "opencl-clang";
@@ -8,16 +8,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "intermodal";
-  version = "0.1.15";
+  version = "0.1.16";

  src = fetchFromGitHub {
    owner = "casey";
    repo = "intermodal";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-dNDJHLxKsuAwQifNHTjr4qhPx+GGY0KUAeWz1qthqOo=";
+    hash = "sha256-Ny/BOgLe2fWC9LQp2g2DvYAArdEujl6Rf1bvrAkSt2A=";
  };

-  cargoHash = "sha256-QYovc4oSnQgEwjPDjyKyoAdYy0XkRLa1K6aFn9yrX4o=";
+  cargoHash = "sha256-WfiN0b6F4TcOHOu/deh86jIClnNKi+xhytjapqLwpaU=";

  # include_hidden test tries to use `chflags` on darwin
  checkFlags = lib.optionals stdenv.hostPlatform.isDarwin [
@@ -17,6 +17,11 @@ python3Packages.buildPythonApplication (finalAttrs: {
    hash = "sha256-b5bSMPnqHqpeFDl501gSun7G38OlhV/IMNMYXQT+j/4=";
  };

+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail "uv_build>=0.9.2,<0.10.0" "uv_build>=0.9.2"
+  '';
+
  build-system = with python3Packages; [
    uv-build
  ];
@@ -17,7 +17,7 @@
  withDocumentation ? stdenv.buildPlatform.canExecute stdenv.hostPlatform,
 }:
 let
-  version = "1.46.0";
+  version = "1.47.1";
 in
 rustPlatform.buildRustPackage {
  inherit version;
@@ -34,10 +34,10 @@ rustPlatform.buildRustPackage {
    owner = "casey";
    repo = "just";
    tag = version;
-    hash = "sha256-NE54LKS2bYBfQL+yLJPaG4iF7EiJfDqBfnsrlPo1+OE=";
+    hash = "sha256-HGrUiPe4vVYNISovTb9PZt8s6xCUg+OWkrp8dPm9tWg=";
  };

-  cargoHash = "sha256-yyaJAWp6luizA/aQuUGhdxRX2Ofri4CeLIO3/ndSCzc=";
+  cargoHash = "sha256-ZRcYVvodaQmQtBGnkTIOI3PXC6YQ1kqycm6Xh/MwIqA=";

  nativeBuildInputs =
    lib.optionals (installShellCompletions || installManPages) [ installShellFiles ]
@@ -24,6 +24,11 @@ stdenv.mkDerivation {
    hash = "sha256-IaERXT648v2nTW89V6gpf7Dt95GJd92QmC50de+Knq8=";
  };

+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "cmake_minimum_required(VERSION 3.1.0)" "cmake_minimum_required(VERSION 3.10)"
+  '';
+
  cmakeFlags = [
    "-DSUBVERSION_INSTALL_PATH=${lib.getDev subversion}"
  ];
@@ -24,11 +24,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "keycloak";
-  version = "26.5.5";
+  version = "26.5.6";

  src = fetchzip {
    url = "https://github.com/keycloak/keycloak/releases/download/${finalAttrs.version}/keycloak-${finalAttrs.version}.zip";
-    hash = "sha256-k6keuENMQ1S+4YN67E6vc48W8x4Le0Bw9E1+UBLyxh0=";
+    hash = "sha256-lkBSzM0kPYe3301EJkY/NShaKpBz+7NuAK/MPNLwMX4=";
  };

  nativeBuildInputs = [
@@ -332,7 +332,10 @@ stdenv.mkDerivation rec {
      The Programs handle Schematic Capture, and PCB Layout with Gerber output.
    '';
    license = lib.licenses.gpl3Plus;
-    maintainers = with lib.maintainers; [ korken89 ];
+    maintainers = with lib.maintainers; [
+      korken89
+      ryand56
+    ];
    platforms = lib.platforms.all;
    broken = stdenv.hostPlatform.isDarwin;
    mainProgram = "kicad";
@@ -25,23 +25,23 @@
  };
  "kicad-testing" = {
    kicadVersion = {
-      version = "9.0-2026-02-25";
+      version = "9.0-2026-03-19";
      src = {
-        rev = "8eb9b52c005f1d01c9d7473925d6fcee057e1d47";
-        sha256 = "0vjw31syny0mda1xnv1as45zd96n1xm3lvx0q8mav32xvc0zyn78";
+        rev = "ca86c82f9b4787c37626225f0b847be5ad3b4763";
+        sha256 = "10bsfnyspvgnffvy3yfm6f3bsd34lm0bk17bwkdm1bnjg2bndv1s";
      };
    };
    libVersion = {
-      version = "9.0-2026-02-25";
+      version = "9.0-2026-03-19";
      libSources = {
-        symbols.rev = "65d897cc92950ff2af888eb67e527ba7a2b99fe8";
+        symbols.rev = "83b87ce54ef7c17da4cefe45ad99a5f8d375abe6";
        symbols.sha256 = "08qb4rqxsyhrcvj1k200m2c06jjy7jwjmf9n1qkcm0biqqc5dba4";
-        templates.rev = "cdf507d0373b5bfd8161b45f6fb86a49b56c4694";
+        templates.rev = "319c71222af4205673e0cab9d772a02bbb34c597";
        templates.sha256 = "0zs29zn8qjgxv0w1vyr8yxmj02m8752zagn4vcraqgik46dwg2id";
-        footprints.rev = "084757e0326f98c10943b8ffe5be284fe912a160";
+        footprints.rev = "384ecd066fcaef6aacdd099ca0bb7c47499a9a4b";
        footprints.sha256 = "1w7dkb93s84ymi1syxpzacbmkxlnlh0k4z1c62nabspb901nn524";
-        packages3d.rev = "123ddef066ce40e20443e678c5baf6a7d4a04399";
-        packages3d.sha256 = "1bv1k8i01x7gyayrlkzl3d2nsf7mcdmzx8gjwx1i2va9557rgli9";
+        packages3d.rev = "6b3a47da075011b33b6de17aa499690f8c5be4a7";
+        packages3d.sha256 = "1j26dmgz7xfixlqrzclb1wpc6zkd10n1fq7rmdrgwwx083p3c7a8";
      };
    };
  };
@@ -51,21 +51,21 @@
 with python3Packages;
 buildPythonApplication rec {
  pname = "kitty";
-  version = "0.46.0";
+  version = "0.46.1";
  pyproject = false;

  src = fetchFromGitHub {
    owner = "kovidgoyal";
    repo = "kitty";
    tag = "v${version}";
-    hash = "sha256-YkJtiJQd7V/OhR45rE1qNgu1RmhAwFmgu3YVpCLrGa4=";
+    hash = "sha256-cGMmzddP+YsyEl9IDt4rtChYZeh9n/7RfWJ87Evv6Tc=";
  };

  goModules =
    (buildGo126Module {
      pname = "kitty-go-modules";
      inherit src version;
-      vendorHash = "sha256-DEaMBblHpfcrySuMqM6SGFPyEyVd8SiXYiftHQBnYdE=";
+      vendorHash = "sha256-FaSWBeQJlvw9vXcHJ/OaFd48K8d7X86X8w7wpG84Ltw=";
    }).goModules;

  buildInputs = [
@@ -6,13 +6,13 @@

 buildGoModule (finalAttrs: {
  pname = "kubectl-images";
-  version = "0.6.3";
+  version = "0.6.5";

  src = fetchFromGitHub {
    owner = "chenjiandongx";
    repo = "kubectl-images";
    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-FHfj2qRypqQA0Vj9Hq7wuYd0xmpD+IZj3MkwKljQio0=";
+    sha256 = "sha256-WExe0RNLHd9W7Xmzsw8CHJAgjgWpO5Guobg5OxOzQqo=";
  };

  vendorHash = "sha256-8zV2iZ10H5X6fkRqElfc7lOf3FhmDzR2lb3Jgyhjyio=";
@@ -167,16 +167,16 @@
        },
        {
            "name": "illuminate/collections",
-            "version": "v12.53.0",
+            "version": "v12.54.1",
            "source": {
                "type": "git",
                "url": "https://github.com/illuminate/collections.git",
-                "reference": "f35c084f0d9bc57895515cb4d0665797c66285fd"
+                "reference": "86f874536cbda5f35c23a9908ee7f176caa4496e"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/illuminate/collections/zipball/f35c084f0d9bc57895515cb4d0665797c66285fd",
-                "reference": "f35c084f0d9bc57895515cb4d0665797c66285fd",
+                "url": "https://api.github.com/repos/illuminate/collections/zipball/86f874536cbda5f35c23a9908ee7f176caa4496e",
+                "reference": "86f874536cbda5f35c23a9908ee7f176caa4496e",
                "shasum": ""
            },
            "require": {
@@ -223,11 +223,11 @@
                "issues": "https://github.com/laravel/framework/issues",
                "source": "https://github.com/laravel/framework"
            },
-            "time": "2026-02-16T14:10:38+00:00"
+            "time": "2026-02-25T15:25:18+00:00"
        },
        {
            "name": "illuminate/conditionable",
-            "version": "v12.53.0",
+            "version": "v12.54.1",
            "source": {
                "type": "git",
                "url": "https://github.com/illuminate/conditionable.git",
@@ -273,7 +273,7 @@
        },
        {
            "name": "illuminate/contracts",
-            "version": "v12.53.0",
+            "version": "v12.54.1",
            "source": {
                "type": "git",
                "url": "https://github.com/illuminate/contracts.git",
@@ -321,16 +321,16 @@
        },
        {
            "name": "illuminate/filesystem",
-            "version": "v12.53.0",
+            "version": "v12.54.1",
            "source": {
                "type": "git",
                "url": "https://github.com/illuminate/filesystem.git",
-                "reference": "c4c3f8612f218afcf09f3c7f5c7dc9e282626800"
+                "reference": "b91eede30e1bde98cb51fb4c4f28269a8dea593e"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/illuminate/filesystem/zipball/c4c3f8612f218afcf09f3c7f5c7dc9e282626800",
-                "reference": "c4c3f8612f218afcf09f3c7f5c7dc9e282626800",
+                "url": "https://api.github.com/repos/illuminate/filesystem/zipball/b91eede30e1bde98cb51fb4c4f28269a8dea593e",
+                "reference": "b91eede30e1bde98cb51fb4c4f28269a8dea593e",
                "shasum": ""
            },
            "require": {
@@ -384,11 +384,11 @@
                "issues": "https://github.com/laravel/framework/issues",
                "source": "https://github.com/laravel/framework"
            },
-            "time": "2026-02-13T20:26:32+00:00"
+            "time": "2026-03-09T14:26:54+00:00"
        },
        {
            "name": "illuminate/macroable",
-            "version": "v12.53.0",
+            "version": "v12.54.1",
            "source": {
                "type": "git",
                "url": "https://github.com/illuminate/macroable.git",
@@ -434,16 +434,16 @@
        },
        {
            "name": "illuminate/reflection",
-            "version": "v12.53.0",
+            "version": "v12.54.1",
            "source": {
                "type": "git",
                "url": "https://github.com/illuminate/reflection.git",
-                "reference": "6188e97a587371b9951c2a7e337cd760308c17d7"
+                "reference": "348cf5da9de89b596d7723be6425fb048e2bf4bb"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/illuminate/reflection/zipball/6188e97a587371b9951c2a7e337cd760308c17d7",
-                "reference": "6188e97a587371b9951c2a7e337cd760308c17d7",
+                "url": "https://api.github.com/repos/illuminate/reflection/zipball/348cf5da9de89b596d7723be6425fb048e2bf4bb",
+                "reference": "348cf5da9de89b596d7723be6425fb048e2bf4bb",
                "shasum": ""
            },
            "require": {
@@ -481,20 +481,20 @@
                "issues": "https://github.com/laravel/framework/issues",
                "source": "https://github.com/laravel/framework"
            },
-            "time": "2026-02-04T15:21:22+00:00"
+            "time": "2026-02-25T15:25:18+00:00"
        },
        {
            "name": "illuminate/support",
-            "version": "v12.53.0",
+            "version": "v12.54.1",
            "source": {
                "type": "git",
                "url": "https://github.com/illuminate/support.git",
-                "reference": "18d7d75366ddb9eded3b7f05173f791da47faf34"
+                "reference": "e54208c0b5693becd8d3bec02f07e8db9aa4f512"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/illuminate/support/zipball/18d7d75366ddb9eded3b7f05173f791da47faf34",
-                "reference": "18d7d75366ddb9eded3b7f05173f791da47faf34",
+                "url": "https://api.github.com/repos/illuminate/support/zipball/e54208c0b5693becd8d3bec02f07e8db9aa4f512",
+                "reference": "e54208c0b5693becd8d3bec02f07e8db9aa4f512",
                "shasum": ""
            },
            "require": {
@@ -561,20 +561,20 @@
                "issues": "https://github.com/laravel/framework/issues",
                "source": "https://github.com/laravel/framework"
            },
-            "time": "2026-02-23T15:44:06+00:00"
+            "time": "2026-03-06T15:24:01+00:00"
        },
        {
            "name": "laravel/prompts",
-            "version": "v0.3.13",
+            "version": "v0.3.14",
            "source": {
                "type": "git",
                "url": "https://github.com/laravel/prompts.git",
-                "reference": "ed8c466571b37e977532fb2fd3c272c784d7050d"
+                "reference": "9f0e371244eedfe2ebeaa72c79c54bb5df6e0176"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/laravel/prompts/zipball/ed8c466571b37e977532fb2fd3c272c784d7050d",
-                "reference": "ed8c466571b37e977532fb2fd3c272c784d7050d",
+                "url": "https://api.github.com/repos/laravel/prompts/zipball/9f0e371244eedfe2ebeaa72c79c54bb5df6e0176",
+                "reference": "9f0e371244eedfe2ebeaa72c79c54bb5df6e0176",
                "shasum": ""
            },
            "require": {
@@ -618,22 +618,22 @@
            "description": "Add beautiful and user-friendly forms to your command-line applications.",
            "support": {
                "issues": "https://github.com/laravel/prompts/issues",
-                "source": "https://github.com/laravel/prompts/tree/v0.3.13"
+                "source": "https://github.com/laravel/prompts/tree/v0.3.14"
            },
-            "time": "2026-02-06T12:17:10+00:00"
+            "time": "2026-03-01T09:02:38+00:00"
        },
        {
            "name": "nesbot/carbon",
-            "version": "3.11.1",
+            "version": "3.11.3",
            "source": {
                "type": "git",
                "url": "https://github.com/CarbonPHP/carbon.git",
-                "reference": "f438fcc98f92babee98381d399c65336f3a3827f"
+                "reference": "6a7e652845bb018c668220c2a545aded8594fbbf"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/CarbonPHP/carbon/zipball/f438fcc98f92babee98381d399c65336f3a3827f",
-                "reference": "f438fcc98f92babee98381d399c65336f3a3827f",
+                "url": "https://api.github.com/repos/CarbonPHP/carbon/zipball/6a7e652845bb018c668220c2a545aded8594fbbf",
+                "reference": "6a7e652845bb018c668220c2a545aded8594fbbf",
                "shasum": ""
            },
            "require": {
@@ -725,7 +725,7 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2026-01-29T09:26:29+00:00"
+            "time": "2026-03-11T17:23:39+00:00"
        },
        {
            "name": "psr/clock",
@@ -958,16 +958,16 @@
        },
        {
            "name": "symfony/console",
-            "version": "v7.4.6",
+            "version": "v7.4.7",
            "source": {
                "type": "git",
                "url": "https://github.com/symfony/console.git",
-                "reference": "6d643a93b47398599124022eb24d97c153c12f27"
+                "reference": "e1e6770440fb9c9b0cf725f81d1361ad1835329d"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/symfony/console/zipball/6d643a93b47398599124022eb24d97c153c12f27",
-                "reference": "6d643a93b47398599124022eb24d97c153c12f27",
+                "url": "https://api.github.com/repos/symfony/console/zipball/e1e6770440fb9c9b0cf725f81d1361ad1835329d",
+                "reference": "e1e6770440fb9c9b0cf725f81d1361ad1835329d",
                "shasum": ""
            },
            "require": {
@@ -1032,7 +1032,7 @@
                "terminal"
            ],
            "support": {
-                "source": "https://github.com/symfony/console/tree/v7.4.6"
+                "source": "https://github.com/symfony/console/tree/v7.4.7"
            },
            "funding": [
                {
@@ -1052,7 +1052,7 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2026-02-25T17:02:47+00:00"
+            "time": "2026-03-06T14:06:20+00:00"
        },
        {
            "name": "symfony/deprecation-contracts",
@@ -2495,11 +2495,11 @@
        },
        {
            "name": "phpstan/phpstan",
-            "version": "2.1.40",
+            "version": "2.1.41",
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/phpstan/phpstan/zipball/9b2c7aeb83a75d8680ea5e7c9b7fca88052b766b",
-                "reference": "9b2c7aeb83a75d8680ea5e7c9b7fca88052b766b",
+                "url": "https://api.github.com/repos/phpstan/phpstan/zipball/a2eae8f20856b3afe74bf1f9726ce8c11438e300",
+                "reference": "a2eae8f20856b3afe74bf1f9726ce8c11438e300",
                "shasum": ""
            },
            "require": {
@@ -2544,7 +2544,7 @@
                    "type": "github"
                }
            ],
-            "time": "2026-02-23T15:04:35+00:00"
+            "time": "2026-03-16T18:24:10+00:00"
        },
        {
            "name": "phpunit/php-code-coverage",
@@ -7,19 +7,19 @@
 }:
 php.buildComposerProject2 (finalAttrs: {
  pname = "laravel";
-  version = "5.24.7";
+  version = "5.24.9";

  src = fetchFromGitHub {
    owner = "laravel";
    repo = "installer";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-szyoqX4wgJpQZO9H/WVq70A5n/3qV1SdBCKQc9vm4WY=";
+    hash = "sha256-RlY6is5rRks2mXdE2/EXuSWX2CxJuK+q8yfsDcZMFBo=";
  };

  nativeBuildInputs = [ makeWrapper ];

  composerLock = ./composer.lock;
-  vendorHash = "sha256-yX6EmbopVUpbbVBfep1Rk84wUK5sxjrlzvii+s39SqA=";
+  vendorHash = "sha256-o7YryCZjTm/O4ts21NjODqacdXnjWZUH8Dmr8fPnDEg=";

  # Adding npm (nodejs) and php composer to path
  postInstall = ''
@@ -6,11 +6,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "launchnext";
-  version = "2.3.0";
+  version = "2.4.0";

  src = fetchzip {
    url = "https://github.com/RoversX/LaunchNext/releases/download/${finalAttrs.version}/LaunchNext${finalAttrs.version}.zip";
-    hash = "sha256-gdfSkBWLXd1N17ruVlRs77q3VMX2nfmAYitPOVnDe3k=";
+    hash = "sha256-o52vYFr2j3AtFOpTyZ4jBnPhpfRGjyBXp5ZM4hlXqvU=";
    stripRoot = false;
  };

@@ -8,11 +8,11 @@

 let
  pname = "ledger-live-desktop";
-  version = "2.143.0";
+  version = "2.145.0";

  src = fetchurl {
    url = "https://download.live.ledger.com/${pname}-${version}-linux-x86_64.AppImage";
-    hash = "sha256-SFIiXr83XV+FRSgbzOQ0/4rLUMu+FTlo3QxagmVXuJ4=";
+    hash = "sha256-BGd/NRw6befb2+cEgJjAaQnJzwUxywgltO7oSsaiukc=";
  };

  appimageContents = appimageTools.extractType2 {
@@ -1,40 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  libtool,
-  autoconf,
-  automake,
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "libmkv";
-  version = "0.6.5.1";
-
-  src = fetchFromGitHub {
-    owner = "saintdev";
-    repo = "libmkv";
-    tag = finalAttrs.version;
-    sha256 = "0pr9q7yprndl8d15ir7i7cznvmf1yqpvnsyivv763n6wryssq6dl";
-  };
-
-  nativeBuildInputs = [
-    libtool
-    autoconf
-    automake
-  ];
-
-  preConfigure = "sh bootstrap.sh";
-
-  meta = {
-    description = "Abandoned library. Alternative lightweight Matroska muxer written for HandBrake";
-    longDescription = ''
-      Library was meant to be an alternative to the official libmatroska library.
-      It is written in plain C, and intended to be very portable.
-    '';
-    homepage = "https://github.com/saintdev/libmkv";
-    license = lib.licenses.gpl2;
-    maintainers = [ lib.maintainers.wmertens ];
-    platforms = lib.platforms.unix;
-  };
-})
@@ -7,13 +7,13 @@

 stdenvNoCC.mkDerivation {
  pname = "libretro-shaders-slang";
-  version = "0-unstable-2026-03-01";
+  version = "0-unstable-2026-03-16";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "slang-shaders";
-    rev = "e574b50f6ebb97ea5f49a55ad2312e1fe4ef0952";
-    hash = "sha256-lH9WKD9Rox9DNrDCxilqA5zh60i0MdHsuGBoHHiITLg=";
+    rev = "875bc1da241f4d174e6443c754e7dd4926f76f8c";
+    hash = "sha256-N/JZ8qTJtg/RlWnQXJ9SJruz7zr5yHJdWL+XnxxMM84=";
  };

  dontConfigure = true;
@@ -8,13 +8,13 @@

 buildGoModule (finalAttrs: {
  pname = "matrix-alertmanager-receiver";
-  version = "2026.3.11";
+  version = "2026.3.18";

  src = fetchFromGitHub {
    owner = "metio";
    repo = "matrix-alertmanager-receiver";
    tag = finalAttrs.version;
-    hash = "sha256-+M787JuFSGuc9PJEDycIs5VVvTV9u3wdn4w1Y2oZdEY=";
+    hash = "sha256-Yp7NcvbvXDaLHCj2dZDHXd8x9oQ/wwUbMx+sTxtEzlY=";
  };

  vendorHash = "sha256-szUkKri3Rx1i3681r85xrOLqXV5u7s9DUemQHeh+qJw=";
@@ -14,13 +14,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "moonlight";
-  version = "2026.3.1";
+  version = "2026.3.2";

  src = fetchFromGitHub {
    owner = "moonlight-mod";
    repo = "moonlight";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-v4GAFP5cN9UXzqG+JVGlqnTQBKyXB2/cUXiOvleuFDE=";
+    hash = "sha256-VcYHwjm5RUfvkABts5ZP+qqqxBHyiF6JwTcBBG+xABA=";
  };

  nativeBuildInputs = [
@@ -24,13 +24,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "mozillavpn";
-  version = "2.33.1";
+  version = "2.34.1";
  src = fetchFromGitHub {
    owner = "mozilla-mobile";
    repo = "mozilla-vpn-client";
    tag = "v${finalAttrs.version}";
    fetchSubmodules = true;
-    hash = "sha256-DsartzFmJFmG++seImaZXnCKZurFXtxTGmSX7DeK3M8=";
+    hash = "sha256-ot+yN5PzMS4BP4G0XMsG2ZYWTjEfZrQ6glcmoRUUzDY=";
  };
  patches = [
  ];
@@ -48,7 +48,7 @@ stdenv.mkDerivation (finalAttrs: {

  cargoDeps = rustPlatform.fetchCargoVendor {
    inherit (finalAttrs) src patches;
-    hash = "sha256-yEZBW1Jc4GUx4eZ3CVlNVKF+MNUtR6qvcOJZz2TgTO4=";
+    hash = "sha256-ZcLbrLtaGOPSi9AUtiaFYefdlGMq5ygZF6KOgSQehAE=";
  };

  buildInputs = [
@@ -6,6 +6,7 @@
  gitMinimal,
  fetchFromGitLab,
  glfw,
+  libGL,
  glm,
  spdlog,
  cereal,
@@ -109,6 +110,11 @@ stdenv.mkDerivation (finalAttrs: {
    glfw
  ];

+  propagatedBuildInputs = [
+    # consuming MuJoCo through cmake find_package requires libGL
+    libGL
+  ];
+
  cmakeFlags = [
    (lib.cmakeBool "MUJOCO_SIMULATE_USE_SYSTEM_GLFW" true)
    (lib.cmakeBool "MUJOCO_SAMPLES_USE_SYSTEM_GLFW" true)
@@ -31,15 +31,15 @@
  writeScript,
 }:
 let
-  id = "354596705";
+  id = "373278730";
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "multiviewer-for-f1";
-  version = "2.5.1";
+  version = "2.7.1";

  src = fetchurl {
-    url = "https://releases.multiviewer.dev/download/${id}/multiviewer_${finalAttrs.version}_amd64.deb";
-    hash = "sha256-9ts5CZD14CzJHiC3YoKWIEKiFpOrcUX1tRUhE4it5Mo=";
+    url = "https://releases.multiviewer.app/download/${id}/multiviewer_${finalAttrs.version}_amd64.deb";
+    hash = "sha256-BKXw8a4fUT+B7KBc6p/Heo+sAtWAG5b/D2iohuNOotY=";
  };

  nativeBuildInputs = [
@@ -11,11 +11,11 @@
 stdenv.mkDerivation (finalAttrs: {

  pname = "nf-test";
-  version = "0.9.4";
+  version = "0.9.5";

  src = fetchurl {
    url = "https://github.com/askimed/nf-test/releases/download/v${finalAttrs.version}/nf-test-${finalAttrs.version}.tar.gz";
-    hash = "sha256-A9k8HVIPqbfHZKqSY2wqOhgvZ9aSb3K4SdoLOypB2j8=";
+    hash = "sha256-t2eeuQzclkK/qJ6WNNsCzm5pneU6017w4vSEdjT8FkE=";
  };
  sourceRoot = ".";

@@ -9,13 +9,13 @@

 buildGoModule (finalAttrs: {
  pname = "nfpm";
-  version = "2.45.1";
+  version = "2.45.2";

  src = fetchFromGitHub {
    owner = "goreleaser";
    repo = "nfpm";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-ThoCDsuz52odVLVJuT4F96sjtqOOzjqq7JIE5Idzl1k=";
+    hash = "sha256-MzxN4oQFmhnuR8T5wa5AGKjL+LhlTSBd2tGVf9WsCBc=";
  };

  vendorHash = "sha256-cq0pcbC0T3klh3D9l0e0u5JPYv1kWYlpeNYyGczGX+A=";
@@ -14,13 +14,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "nixbit";
-  version = "0.7.2";
+  version = "0.8.0";

  src = fetchFromGitHub {
    owner = "pbek";
    repo = "nixbit";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-fKDNoDrJvbRl81N3fAvUugorsL6HspOSgopxBATcBBo=";
+    hash = "sha256-f+2ULyHkTV1ACJbp6Evu6hGtQd4wRmmUa38D0YERvuY=";
  };

  nativeBuildInputs = [
@@ -0,0 +1,23 @@
+diff --git a/src/core/generation.cpp b/src/core/generation.cpp
+index c68af71..4967562 100644
+--- a/src/core/generation.cpp
+++ b/src/core/generation.cpp
+@@ -172,12 +172,18 @@ void EngineGeneration::setWatchingFiles(bool watching) {
+ 		if (this->watcher == nullptr) {
+ 			this->watcher = new QFileSystemWatcher();
+ 
+			// note: not using canonicalFilePath() here on purpose,
+			//       since the path could be a link to the nix store
+			//       and the link might change
+
+ 			for (auto& file: this->scanner.scannedFiles) {
+				if (file.startsWith("/nix/store/")) continue;
+ 				this->watcher->addPath(file);
+ 				this->watcher->addPath(QFileInfo(file).dir().absolutePath());
+ 			}
+ 
+ 			for (auto& file: this->extraWatchedFiles) {
+				if (file.startsWith("/nix/store/")) continue;
+ 				this->watcher->addPath(file);
+ 				this->watcher->addPath(QFileInfo(file).dir().absolutePath());
+ 			}
@@ -0,0 +1,93 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  nix-update-script,
+
+  pkg-config,
+  cmake,
+  ninja,
+  spirv-tools,
+  qt6,
+  breakpad,
+  jemalloc,
+  cli11,
+  wayland,
+  wayland-protocols,
+  wayland-scanner,
+  libxcb,
+  libdrm,
+  libgbm ? null,
+  vulkan-headers,
+  pipewire,
+  pam,
+  polkit,
+  glib,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "noctalia-qs";
+  version = "0.0.9";
+
+  src = fetchFromGitHub {
+    owner = "noctalia-dev";
+    repo = "noctalia-qs";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-oRqz+5AbNKfUWWwN5c83CsSOsUWVGITh0HZg+wX5Q/8=";
+  };
+
+  patches = [
+    ./0001-fix-unneccessary-reloads.patch
+  ];
+
+  nativeBuildInputs = [
+    cmake
+    ninja
+    spirv-tools
+    pkg-config
+    qt6.qtwayland
+    qt6.wrapQtAppsHook
+    wayland-scanner
+  ];
+
+  buildInputs = [
+    qt6.qtbase
+    qt6.qtdeclarative
+    qt6.qtwayland
+    qt6.qtsvg
+    cli11
+    wayland
+    wayland-protocols
+    libdrm
+    libgbm
+    vulkan-headers
+    breakpad
+    jemalloc
+    libxcb
+    pam
+    pipewire
+    polkit
+    glib
+  ];
+
+  cmakeFlags = [
+    (lib.cmakeFeature "DISTRIBUTOR" "Nixpkgs")
+    (lib.cmakeBool "DISTRIBUTOR_DEBUGINFO_AVAILABLE" true)
+    (lib.cmakeFeature "INSTALL_QML_PREFIX" qt6.qtbase.qtQmlPrefix)
+    (lib.cmakeFeature "GIT_REVISION" "tag-v${finalAttrs.version}")
+  ];
+
+  cmakeBuildType = "RelWithDebInfo";
+  separateDebugInfo = true;
+  dontStrip = false;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    homepage = "https://github.com/noctalia-dev/noctalia-qs";
+    description = "Flexbile QtQuick based desktop shell toolkit";
+    license = lib.licenses.lgpl3Only;
+    platforms = lib.platforms.linux;
+    mainProgram = "quickshell";
+    maintainers = with lib.maintainers; [ iynaix ];
+  };
+})
@@ -6,7 +6,7 @@

  # build
  qt6,
-  quickshell,
+  noctalia-qs,

  # runtime deps
  bluez,
@@ -16,6 +16,7 @@
  ddcutil,
  wlsunset,
  wl-clipboard,
+  wlr-randr,
  imagemagick,
  wget,
  gpu-screen-recorder,
@@ -37,6 +38,7 @@
  ddcutilSupport ? true,
  wlsunsetSupport ? true,
  wl-clipboardSupport ? true,
+  wlr-randrSupport ? true,
  imagemagickSupport ? true,
  calendarSupport ? false,
  # gpu-screen-recorder support was moved to an optional plugin in v4.0.0
@@ -54,6 +56,7 @@ let
  ++ lib.optional ddcutilSupport ddcutil
  ++ lib.optional wlsunsetSupport wlsunset
  ++ lib.optional wl-clipboardSupport wl-clipboard
+  ++ lib.optional wlr-randrSupport wlr-randr
  ++ lib.optional imagemagickSupport imagemagick
  ++ lib.optional gpuScreenRecorderSupport gpu-screen-recorder;

@@ -68,13 +71,13 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "noctalia-shell";
-  version = "4.5.0";
+  version = "4.6.7";

  src = fetchFromGitHub {
    owner = "noctalia-dev";
    repo = "noctalia-shell";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Y5P0RYO9NKxa4UZBoGmmxtz3mEwJrBOfvdLJRGjV2Os=";
+    hash = "sha256-6fuxf185uga/AaeFgN6VUygGE8bUEkzZSA1UQ1FFes4=";
  };

  nativeBuildInputs = [
@@ -90,7 +93,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    runHook preInstall

    mkdir -p $out/share/noctalia-shell $out/bin
-    ln -s ${quickshell}/bin/qs $out/bin/noctalia-shell
+    ln -s ${noctalia-qs}/bin/qs $out/bin/noctalia-shell

    cp -R \
      Assets Commons CREDITS.md Helpers Modules Services Shaders Scripts Widgets shell.qml \
@@ -119,6 +122,6 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    license = lib.licenses.mit;
    mainProgram = "noctalia-shell";
    maintainers = with lib.maintainers; [ spacedentist ];
-    platforms = quickshell.meta.platforms;
+    platforms = noctalia-qs.meta.platforms;
  };
 })
@@ -6,14 +6,14 @@
 }:
 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "nodezator";
-  version = "1.5.4";
+  version = "1.5.5";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "IndieSmiths";
    repo = "nodezator";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-kdkOAJB7cVaayJOzof7dV9EBczEoEKXzCM7TcY8Ex5g=";
+    hash = "sha256-9lEizhTwihv909xDgmcel9eCL7VfVDrWDtWghdjSH90=";
  };

  build-system = with python3Packages; [ setuptools ];
@@ -7,13 +7,13 @@
 }:
 buildGoModule (finalAttrs: {
  pname = "nom";
-  version = "3.2.5";
+  version = "3.3.0";

  src = fetchFromGitHub {
    owner = "guyfedwards";
    repo = "nom";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-l3p5eY6PbywD+ZSbMr4k3SfFKXQq16zdx5XsgB81dT8=";
+    hash = "sha256-q2vnReYAxU8UcTPIy1dIVO9jQwC+9dYfO9cDls0Voyo=";
  };

  vendorHash = "sha256-pPd7wpZ55thW0Xq2c/0qSAlGQ71tE8GptsEBJD839Bg=";
@@ -35,13 +35,13 @@ let
 in
 maven.buildMavenPackage rec {
  pname = "nzbhydra2";
-  version = "8.5.1";
+  version = "8.5.2";

  src = fetchFromGitHub {
    owner = "theotherp";
    repo = "nzbhydra2";
    tag = "v${version}";
-    hash = "sha256-idLki0UB8uqtRUvxzwvJuJJyG3+EUUJ5D4Ui41YbMPw=";
+    hash = "sha256-d+0HUYCUWWhpnOjZY3aRQo2B/vuK5T9r0vQSYYefUD0=";
  };

  mvnHash = "sha256-dodZT40zNqfaPd8VxfNYY10VrFNlL4xESDdTrgcFaaY=";
@@ -7,12 +7,12 @@

 buildGoModule rec {
  pname = "oauth2-proxy";
-  version = "7.14.3";
+  version = "7.15.0";

  src = fetchFromGitHub {
    repo = "oauth2-proxy";
    owner = "oauth2-proxy";
-    sha256 = "sha256-IJfA2wAdVp9v70a6P2cnjJcWqQoHkT2JtOvtRzwMn/A=";
+    sha256 = "sha256-s+m5S/8mQjk16UL/yaAjWgSJuir/vvzYUvladeK0bkk=";
    rev = "v${version}";
  };

--- a/Show More
+++ b/Show More