Merge master into haskell-updates

2024-12-26 00:16:26 +00:00
parent 05f26e10dd 138326d6e9
commit f29dca45c6
117 changed files with 2142 additions and 1608 deletions
@@ -9734,6 +9734,12 @@
    githubId = 36667224;
    name = "Yingchi Long";
  };
+  IncredibleLaser = {
+    github = "IncredibleLaser";
+    githubId = 45564436;
+    matrix = "@incrediblelaser:tchncs.de";
+    name = "Gereon Schomber";
+  };
  indexyz = {
    email = "indexyz@pm.me";
    github = "5aaee9";
@@ -14811,12 +14817,6 @@
    name = "Marcin Mikuła";
    keys = [ { fingerprint = "5547 2A56 AC30 69C9 15C8  B98D 997F 71FA 1D74 6E37"; } ];
  };
-  milahu = {
-    email = "milahu@gmail.com";
-    github = "milahu";
-    githubId = 12958815;
-    name = "Milan Hauth";
-  };
  milesbreslin = {
    email = "milesbreslin@gmail.com";
    github = "MilesBreslin";
@@ -18730,6 +18730,7 @@
  };
  rapiteanu = {
    email = "rapiteanu.catalin@gmail.com";
+    matrix = "@catalin:one.ems.host";
    github = "Steinhagen";
    githubId = 4029937;
    name = "Viorel-Cătălin Răpițeanu";
@@ -18,6 +18,8 @@

 - The default PHP version has been updated to 8.3.

+- The default Erlang OTP version has been updated to 27.
+
 - `nixos-rebuild-ng`, a full rewrite of `nixos-rebuild` in Python, is available for testing. You can enable it by setting [system.rebuild.enableNg](options.html#opt-system.rebuild.enableNg) in your configuration (this will replace the old `nixos-rebuild`), or by adding `nixos-rebuild-ng` to your `environment.systemPackages` (in this case, it will live side-by-side with `nixos-rebuild` as `nixos-rebuild-ng`). It is expected that the next major version of NixOS (25.11) will enable `system.rebuild.enableNg` by default.
 - A `nixos-rebuild build-image` sub-command has been added.

@@ -63,6 +65,8 @@

 - [waagent](https://github.com/Azure/WALinuxAgent), the Microsoft Azure Linux Agent (waagent) manages Linux provisioning and VM interaction with the Azure Fabric Controller. Available with [services.waagent](options.html#opt-services.waagent.enable).

+- [duckdns](https://www.duckdns.org), free dynamic DNS. Available with [services.duckdns](options.html#opt-services.duckdns.enable)
+
 - [nostr-rs-relay](https://git.sr.ht/~gheartsfield/nostr-rs-relay/), This is a nostr relay, written in Rust. Available as [services.nostr-rs-relay](options.html#opt-services.nostr-rs-relay.enable).

 - [Actual Budget](https://actualbudget.org/), a local-first personal finance app. Available as [services.actual](#opt-services.actual.enable).
@@ -121,6 +125,8 @@

 - `linuxPackages.nvidiaPackages.dc_520` has been removed since it is marked broken and there are better newer alternatives.

+- `programs.less.lessopen` is now null by default. To restore the previous behaviour, set it to `''|${lib.getExe' pkgs.lesspipe "lesspipe.sh"} %s''`.
+
 - `minetest` has been renamed to `luanti` to match the upstream name change but aliases have been added. The new name hasn't resulted in many changes as of yet but older references to minetest should be sunset. See the [new name announcement](https://blog.minetest.net/2024/10/13/Introducing-Our-New-Name/) for more details.

 - `racket_7_9` has been removed, as it is insecure. It is recommended to use Racket 8 instead.
@@ -151,6 +157,9 @@

 - `vscode-utils.buildVscodeExtension` now requires pname as an argument

+- The behavior of `services.hostapd.radios.<name>.networks.<name>.authentication.enableRecommendedPairwiseCiphers` was changed to not include `CCMP-256` anymore.
+  Since all configured pairwise ciphers have to be supported by the radio, this caused startup failures on many devices which is hard to debug in hostapd.
+
 - `nerdfonts` has been separated into individual font packages under the namespace `nerd-fonts`. The directories for font
  files have changed from `$out/share/fonts/{opentype,truetype}/NerdFonts` to
  `$out/share/fonts/{opentype,truetype}/NerdFonts/<fontDirName>`, where `<fontDirName>` can be found in the
@@ -1,11 +1,17 @@
-{ config, pkgs, lib, ... }:
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
 let
  imcfg = config.i18n.inputMethod;
  cfg = imcfg.fcitx5;
  fcitx5Package =
-    if cfg.plasma6Support
-    then pkgs.qt6Packages.fcitx5-with-addons.override { inherit (cfg) addons; }
-    else pkgs.libsForQt5.fcitx5-with-addons.override { inherit (cfg) addons; };
+    if cfg.plasma6Support then
+      pkgs.qt6Packages.fcitx5-with-addons.override { inherit (cfg) addons; }
+    else
+      pkgs.libsForQt5.fcitx5-with-addons.override { inherit (cfg) addons; };
  settingsFormat = pkgs.formats.ini { };
 in
 {
@@ -108,40 +114,48 @@ in
  config = lib.mkIf (imcfg.enable && imcfg.type == "fcitx5") {
    i18n.inputMethod.package = fcitx5Package;

-    i18n.inputMethod.fcitx5.addons = lib.optionals (cfg.quickPhrase != { }) [
-      (pkgs.writeTextDir "share/fcitx5/data/QuickPhrase.mb"
-        (lib.concatStringsSep "\n"
-          (lib.mapAttrsToList (name: value: "${name} ${value}") cfg.quickPhrase)))
-    ] ++ lib.optionals (cfg.quickPhraseFiles != { }) [
-      (pkgs.linkFarm "quickPhraseFiles" (lib.mapAttrs'
-        (name: value: lib.nameValuePair ("share/fcitx5/data/quickphrase.d/${name}.mb") value)
-        cfg.quickPhraseFiles))
-    ];
+    i18n.inputMethod.fcitx5.addons =
+      lib.optionals (cfg.quickPhrase != { }) [
+        (pkgs.writeTextDir "share/fcitx5/data/QuickPhrase.mb" (
+          lib.mapAttrsToList (
+            name: value: "${name} ${builtins.replaceStrings [ "\\" "\n" ] [ "\\\\" "\\n" ] value}"
+          ) cfg.quickPhrase
+        ))
+      ]
+      ++ lib.optionals (cfg.quickPhraseFiles != { }) [
+        (pkgs.linkFarm "quickPhraseFiles" (
+          lib.mapAttrs' (
+            name: value: lib.nameValuePair ("share/fcitx5/data/quickphrase.d/${name}.mb") value
+          ) cfg.quickPhraseFiles
+        ))
+      ];
    environment.etc =
      let
-        optionalFile = p: f: v: lib.optionalAttrs (v != { }) {
-          "xdg/fcitx5/${p}".text = f v;
-        };
+        optionalFile =
+          p: f: v:
+          lib.optionalAttrs (v != { }) {
+            "xdg/fcitx5/${p}".text = f v;
+          };
      in
      lib.attrsets.mergeAttrsList [
        (optionalFile "config" (lib.generators.toINI { }) cfg.settings.globalOptions)
        (optionalFile "profile" (lib.generators.toINI { }) cfg.settings.inputMethod)
-        (lib.concatMapAttrs
-          (name: value: optionalFile
-            "conf/${name}.conf"
-            (lib.generators.toINIWithGlobalSection { })
-            value)
-          cfg.settings.addons)
+        (lib.concatMapAttrs (
+          name: value: optionalFile "conf/${name}.conf" (lib.generators.toINIWithGlobalSection { }) value
+        ) cfg.settings.addons)
      ];

-    environment.variables = {
-      XMODIFIERS = "@im=fcitx";
-      QT_PLUGIN_PATH = [ "${fcitx5Package}/${pkgs.qt6.qtbase.qtPluginPrefix}" ];
-    } // lib.optionalAttrs (!cfg.waylandFrontend) {
-      GTK_IM_MODULE = "fcitx";
-      QT_IM_MODULE = "fcitx";
-    } // lib.optionalAttrs cfg.ignoreUserConfig {
-      SKIP_FCITX_USER_PATH = "1";
-    };
+    environment.variables =
+      {
+        XMODIFIERS = "@im=fcitx";
+        QT_PLUGIN_PATH = [ "${fcitx5Package}/${pkgs.qt6.qtbase.qtPluginPrefix}" ];
+      }
+      // lib.optionalAttrs (!cfg.waylandFrontend) {
+        GTK_IM_MODULE = "fcitx";
+        QT_IM_MODULE = "fcitx";
+      }
+      // lib.optionalAttrs cfg.ignoreUserConfig {
+        SKIP_FCITX_USER_PATH = "1";
+      };
  };
 }
@@ -763,6 +763,7 @@
  ./services/misc/disnix.nix
  ./services/misc/docker-registry.nix
  ./services/misc/domoticz.nix
+  ./services/misc/duckdns.nix
  ./services/misc/duckling.nix
  ./services/misc/dwm-status.nix
  ./services/misc/dysnomia.nix
@@ -302,7 +302,10 @@ in
    services.displayManager.sddm = {
      package = kdePackages.sddm;
      theme = mkDefault "breeze";
-      wayland.compositor = "kwin";
+      wayland = mkDefault {
+        enable = true;
+        compositor = "kwin";
+      };
      extraPackages = with kdePackages; [
        breeze-icons
        kirigami
@@ -40,6 +40,7 @@ let
    "flow"
    "fritz"
    "fritzbox"
+    "frr"
    "graphite"
    "idrac"
    "imap-mailstat"
@@ -0,0 +1,49 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.prometheus.exporters.frr;
+  inherit (lib)
+    mkOption
+    types
+    concatStringsSep
+    concatMapStringsSep
+    ;
+in
+{
+  port = 9342;
+  extraOpts = {
+    enabledCollectors = mkOption {
+      type = types.listOf types.str;
+      default = [ ];
+      example = [ "vrrp" ];
+      description = ''
+        Collectors to enable. The collectors listed here are enabled in addition to the default ones.
+      '';
+    };
+    disabledCollectors = mkOption {
+      type = types.listOf types.str;
+      default = [ ];
+      example = [ "bfd" ];
+      description = ''
+        Collectors to disable which are enabled by default.
+      '';
+    };
+  };
+  serviceOpts = {
+    serviceConfig = {
+      DynamicUser = false;
+      RuntimeDirectory = "prometheus-frr-exporter";
+      ExecStart = ''
+        ${lib.getExe pkgs.prometheus-frr-exporter} \
+          ${concatMapStringsSep " " (x: "--collector." + x) cfg.enabledCollectors} \
+          ${concatMapStringsSep " " (x: "--no-collector." + x) cfg.disabledCollectors} \
+          --web.listen-address ${cfg.listenAddress}:${toString cfg.port} ${concatStringsSep " " cfg.extraFlags}
+      '';
+    };
+  };
+}
@@ -11,7 +11,6 @@ let
    attrNames
    attrValues
    concatLists
-    concatMap
    concatMapStrings
    concatStringsSep
    count
@@ -34,11 +33,9 @@ let
    mkOption
    mkPackageOption
    mkRemovedOptionModule
-    optional
    optionalAttrs
    optionalString
    optionals
-    singleton
    stringLength
    toLower
    types
@@ -710,7 +707,7 @@ in {

                    pairwiseCiphers = mkOption {
                      default = ["CCMP"];
-                      example = ["CCMP-256" "GCMP-256"];
+                      example = ["GCMP" "GCMP-256"];
                      type = types.listOf types.str;
                      description = ''
                        Set of accepted cipher suites (encryption algorithms) for pairwise keys (unicast packets).
@@ -719,7 +716,8 @@ in {

                        Please refer to the hostapd documentation for allowed values. Generally, only
                        CCMP or GCMP modes should be considered safe options. Most devices support CCMP while
-                        GCMP is often only available with devices supporting WiFi 5 (IEEE 802.11ac) or higher.
+                        GCMP and GCMP-256 is often only available with devices supporting WiFi 5 (IEEE 802.11ac) or higher.
+                        CCMP-256 support is rare.
                      '';
                    };

@@ -906,7 +904,7 @@ in {
                  bssCfg = bssSubmod.config;
                  pairwiseCiphers =
                    concatStringsSep " " (unique (bssCfg.authentication.pairwiseCiphers
-                      ++ optionals bssCfg.authentication.enableRecommendedPairwiseCiphers ["CCMP" "CCMP-256" "GCMP" "GCMP-256"]));
+                      ++ optionals bssCfg.authentication.enableRecommendedPairwiseCiphers ["CCMP" "GCMP" "GCMP-256"]));
                in {
                  settings = {
                    ssid = bssCfg.ssid;
@@ -1,49 +1,81 @@
-{ config, pkgs, lib, ... }:
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
 let
-  inherit (lib) any boolToString concatStringsSep isBool isString mapAttrsToList mkDefault mkEnableOption mkIf mkMerge mkOption optionalAttrs types mkPackageOption;
+  inherit (lib)
+    any
+    boolToString
+    concatStringsSep
+    isBool
+    isString
+    mapAttrsToList
+    mkDefault
+    mkEnableOption
+    mkIf
+    mkMerge
+    mkOption
+    optionalAttrs
+    types
+    mkPackageOption
+    ;

  package = cfg.package.override { inherit (cfg) stateDir; };

  cfg = config.services.dolibarr;
  vhostCfg = lib.optionalAttrs (cfg.nginx != null) config.services.nginx.virtualHosts."${cfg.domain}";

-  mkConfigFile = filename: settings:
+  mkConfigFile =
+    filename: settings:
    let
      # hack in special logic for secrets so we read them from a separate file avoiding the nix store
-      secretKeys = [ "force_install_databasepass" "dolibarr_main_db_pass" "dolibarr_main_instance_unique_id" ];
+      secretKeys = [
+        "force_install_databasepass"
+        "dolibarr_main_db_pass"
+        "dolibarr_main_instance_unique_id"
+      ];

-      toStr = k: v:
-        if (any (str: k == str) secretKeys) then v
-        else if isString v then "'${v}'"
-        else if isBool v then boolToString v
-        else if v == null then "null"
-        else toString v
-      ;
+      toStr =
+        k: v:
+        if (any (str: k == str) secretKeys) then
+          v
+        else if isString v then
+          "'${v}'"
+        else if isBool v then
+          boolToString v
+        else if v == null then
+          "null"
+        else
+          toString v;
    in
-      pkgs.writeText filename ''
-        <?php
-        ${concatStringsSep "\n" (mapAttrsToList (k: v: "\$${k} = ${toStr k v};") settings)}
-      '';
+    pkgs.writeText filename ''
+      <?php
+      ${concatStringsSep "\n" (mapAttrsToList (k: v: "\$${k} = ${toStr k v};") settings)}
+    '';

  # see https://github.com/Dolibarr/dolibarr/blob/develop/htdocs/install/install.forced.sample.php for all possible values
-  install = {
-    force_install_noedit = 2;
-    force_install_main_data_root = "${cfg.stateDir}/documents";
-    force_install_nophpinfo = true;
-    force_install_lockinstall = "444";
-    force_install_distrib = "nixos";
-    force_install_type = "mysqli";
-    force_install_dbserver = cfg.database.host;
-    force_install_port = toString cfg.database.port;
-    force_install_database = cfg.database.name;
-    force_install_databaselogin = cfg.database.user;
+  install =
+    {
+      force_install_noedit = 2;
+      force_install_main_data_root = "${cfg.stateDir}/documents";
+      force_install_nophpinfo = true;
+      force_install_lockinstall = "444";
+      force_install_distrib = "nixos";
+      force_install_type = "mysqli";
+      force_install_dbserver = cfg.database.host;
+      force_install_port = toString cfg.database.port;
+      force_install_database = cfg.database.name;
+      force_install_databaselogin = cfg.database.user;

-    force_install_mainforcehttps = vhostCfg.forceSSL or false;
-    force_install_createuser = false;
-    force_install_dolibarrlogin = null;
-  } // optionalAttrs (cfg.database.passwordFile != null) {
-    force_install_databasepass = ''file_get_contents("${cfg.database.passwordFile}")'';
-  };
+      force_install_mainforcehttps = vhostCfg.forceSSL or false;
+      force_install_createuser = false;
+      force_install_dolibarrlogin = null;
+    }
+    // optionalAttrs (cfg.database.passwordFile != null) {
+      force_install_databasepass = ''file_get_contents("${cfg.database.passwordFile}")'';
+    };
 in
 {
  # interface
@@ -131,22 +163,28 @@ in
    };

    settings = mkOption {
-      type = with types; (attrsOf (oneOf [ bool int str ]));
+      type =
+        with types;
+        (attrsOf (oneOf [
+          bool
+          int
+          str
+        ]));
      default = { };
      description = "Dolibarr settings, see <https://github.com/Dolibarr/dolibarr/blob/develop/htdocs/conf/conf.php.example> for details.";
    };

    nginx = mkOption {
-      type = types.nullOr (types.submodule (
-        lib.recursiveUpdate
-          (import ../web-servers/nginx/vhost-options.nix { inherit config lib; })
-          {
+      type = types.nullOr (
+        types.submodule (
+          lib.recursiveUpdate (import ../web-servers/nginx/vhost-options.nix { inherit config lib; }) {
            # enable encryption by default,
            # as sensitive login and Dolibarr (ERP) data should not be transmitted in clear text.
            options.forceSSL.default = true;
            options.enableACME.default = true;
          }
-      ));
+        )
+      );
      default = null;
      example = lib.literalExpression ''
        {
@@ -158,17 +196,23 @@ in
        }
      '';
      description = ''
-          With this option, you can customize an nginx virtual host which already has sensible defaults for Dolibarr.
-          Set to {} if you do not need any customization to the virtual host.
-          If enabled, then by default, the {option}`serverName` is
-          `''${domain}`,
-          SSL is active, and certificates are acquired via ACME.
-          If this is set to null (the default), no nginx virtualHost will be configured.
+        With this option, you can customize an nginx virtual host which already has sensible defaults for Dolibarr.
+        Set to {} if you do not need any customization to the virtual host.
+        If enabled, then by default, the {option}`serverName` is
+        `''${domain}`,
+        SSL is active, and certificates are acquired via ACME.
+        If this is set to null (the default), no nginx virtualHost will be configured.
      '';
    };

    poolConfig = mkOption {
-      type = with types; attrsOf (oneOf [ str int bool ]);
+      type =
+        with types;
+        attrsOf (oneOf [
+          str
+          int
+          bool
+        ]);
      default = {
        "pm" = "dynamic";
        "pm.max_children" = 32;
@@ -188,138 +232,144 @@ in
  config = mkIf cfg.enable (mkMerge [
    {

-    assertions = [
-      { assertion = cfg.database.createLocally -> cfg.database.user == cfg.user;
-        message = "services.dolibarr.database.user must match services.dolibarr.user if the database is to be automatically provisioned";
-      }
-    ];
-
-    services.dolibarr.settings = {
-      dolibarr_main_url_root = "https://${cfg.domain}";
-      dolibarr_main_document_root = "${package}/htdocs";
-      dolibarr_main_url_root_alt = "/custom";
-      dolibarr_main_data_root = "${cfg.stateDir}/documents";
-
-      dolibarr_main_db_host = cfg.database.host;
-      dolibarr_main_db_port = toString cfg.database.port;
-      dolibarr_main_db_name = cfg.database.name;
-      dolibarr_main_db_prefix = "llx_";
-      dolibarr_main_db_user = cfg.database.user;
-      dolibarr_main_db_pass = mkIf (cfg.database.passwordFile != null) ''
-        file_get_contents("${cfg.database.passwordFile}")
-      '';
-      dolibarr_main_db_type = "mysqli";
-      dolibarr_main_db_character_set = mkDefault "utf8";
-      dolibarr_main_db_collation = mkDefault "utf8_unicode_ci";
-
-      # Authentication settings
-      dolibarr_main_authentication = mkDefault "dolibarr";
-
-      # Security settings
-      dolibarr_main_prod = true;
-      dolibarr_main_force_https = vhostCfg.forceSSL or false;
-      dolibarr_main_restrict_os_commands = "${pkgs.mariadb}/bin/mysqldump, ${pkgs.mariadb}/bin/mysql";
-      dolibarr_nocsrfcheck = false;
-      dolibarr_main_instance_unique_id = ''
-        file_get_contents("${cfg.stateDir}/dolibarr_main_instance_unique_id")
-      '';
-      dolibarr_mailing_limit_sendbyweb = false;
-    };
-
-    systemd.tmpfiles.rules = [
-      "d '${cfg.stateDir}' 0750 ${cfg.user} ${cfg.group}"
-      "d '${cfg.stateDir}/documents' 0750 ${cfg.user} ${cfg.group}"
-      "f '${cfg.stateDir}/conf.php' 0660 ${cfg.user} ${cfg.group}"
-      "L '${cfg.stateDir}/install.forced.php' - ${cfg.user} ${cfg.group} - ${mkConfigFile "install.forced.php" install}"
-    ];
-
-    services.mysql = mkIf cfg.database.createLocally {
-      enable = mkDefault true;
-      package = mkDefault pkgs.mariadb;
-      ensureDatabases = [ cfg.database.name ];
-      ensureUsers = [
-        { name = cfg.database.user;
-          ensurePermissions = { "${cfg.database.name}.*" = "ALL PRIVILEGES"; };
+      assertions = [
+        {
+          assertion = cfg.database.createLocally -> cfg.database.user == cfg.user;
+          message = "services.dolibarr.database.user must match services.dolibarr.user if the database is to be automatically provisioned";
        }
      ];
-    };

-    services.nginx.enable = mkIf (cfg.nginx != null) true;
-    services.nginx.virtualHosts."${cfg.domain}" = mkIf (cfg.nginx != null) (lib.mkMerge [
-      cfg.nginx
-      ({
-        root = lib.mkForce "${package}/htdocs";
-        locations."/".index = "index.php";
-        locations."~ [^/]\\.php(/|$)" = {
+      services.dolibarr.settings = {
+        dolibarr_main_url_root = "https://${cfg.domain}";
+        dolibarr_main_document_root = "${package}/htdocs";
+        dolibarr_main_url_root_alt = "/custom";
+        dolibarr_main_data_root = "${cfg.stateDir}/documents";
+
+        dolibarr_main_db_host = cfg.database.host;
+        dolibarr_main_db_port = toString cfg.database.port;
+        dolibarr_main_db_name = cfg.database.name;
+        dolibarr_main_db_prefix = "llx_";
+        dolibarr_main_db_user = cfg.database.user;
+        dolibarr_main_db_pass = mkIf (cfg.database.passwordFile != null) ''
+          file_get_contents("${cfg.database.passwordFile}")
+        '';
+        dolibarr_main_db_type = "mysqli";
+        dolibarr_main_db_character_set = mkDefault "utf8";
+        dolibarr_main_db_collation = mkDefault "utf8_unicode_ci";
+
+        # Authentication settings
+        dolibarr_main_authentication = mkDefault "dolibarr";
+
+        # Security settings
+        dolibarr_main_prod = true;
+        dolibarr_main_force_https = vhostCfg.forceSSL or false;
+        dolibarr_main_restrict_os_commands = "${pkgs.mariadb}/bin/mysqldump, ${pkgs.mariadb}/bin/mysql";
+        dolibarr_nocsrfcheck = false;
+        dolibarr_main_instance_unique_id = ''
+          file_get_contents("${cfg.stateDir}/dolibarr_main_instance_unique_id")
+        '';
+        dolibarr_mailing_limit_sendbyweb = false;
+      };
+
+      systemd.tmpfiles.rules = [
+        "d '${cfg.stateDir}' 0750 ${cfg.user} ${cfg.group}"
+        "d '${cfg.stateDir}/documents' 0750 ${cfg.user} ${cfg.group}"
+        "f '${cfg.stateDir}/conf.php' 0660 ${cfg.user} ${cfg.group}"
+        "L '${cfg.stateDir}/install.forced.php' - ${cfg.user} ${cfg.group} - ${mkConfigFile "install.forced.php" install}"
+      ];
+
+      services.mysql = mkIf cfg.database.createLocally {
+        enable = mkDefault true;
+        package = mkDefault pkgs.mariadb;
+        ensureDatabases = [ cfg.database.name ];
+        ensureUsers = [
+          {
+            name = cfg.database.user;
+            ensurePermissions = {
+              "${cfg.database.name}.*" = "ALL PRIVILEGES";
+            };
+          }
+        ];
+      };
+
+      services.nginx.enable = mkIf (cfg.nginx != null) true;
+      services.nginx.virtualHosts."${cfg.domain}" = mkIf (cfg.nginx != null) (
+        lib.mkMerge [
+          cfg.nginx
+          ({
+            root = lib.mkForce "${package}/htdocs";
+            locations."/".index = "index.php";
+            locations."~ [^/]\\.php(/|$)" = {
+              extraConfig = ''
+                fastcgi_split_path_info ^(.+?\.php)(/.*)$;
+                fastcgi_pass unix:${config.services.phpfpm.pools.dolibarr.socket};
+              '';
+            };
+          })
+        ]
+      );
+
+      systemd.services."phpfpm-dolibarr".after = mkIf cfg.database.createLocally [ "mysql.service" ];
+      services.phpfpm.pools.dolibarr = {
+        inherit (cfg) user group;
+        phpPackage = pkgs.php.buildEnv {
+          extensions = { enabled, all }: enabled ++ [ all.calendar ];
+          # recommended by dolibarr web application
          extraConfig = ''
-            fastcgi_split_path_info ^(.+?\.php)(/.*)$;
-            fastcgi_pass unix:${config.services.phpfpm.pools.dolibarr.socket};
+            session.use_strict_mode = 1
+            session.cookie_samesite = "Lax"
+            ; open_basedir = "${package}/htdocs, ${cfg.stateDir}"
+            allow_url_fopen = 0
+            disable_functions = "pcntl_alarm, pcntl_fork, pcntl_waitpid, pcntl_wait, pcntl_wifexited, pcntl_wifstopped, pcntl_wifsignaled, pcntl_wifcontinued, pcntl_wexitstatus, pcntl_wtermsig, pcntl_wstopsig, pcntl_signal, pcntl_signal_get_handler, pcntl_signal_dispatch, pcntl_get_last_error, pcntl_strerror, pcntl_sigprocmask, pcntl_sigwaitinfo, pcntl_sigtimedwait, pcntl_exec, pcntl_getpriority, pcntl_setpriority, pcntl_async_signals"
          '';
        };
-      })
-    ]);

-    systemd.services."phpfpm-dolibarr".after = mkIf cfg.database.createLocally [ "mysql.service" ];
-    services.phpfpm.pools.dolibarr = {
-      inherit (cfg) user group;
-      phpPackage = pkgs.php.buildEnv {
-        extensions = { enabled, all }: enabled ++ [ all.calendar ];
-        # recommended by dolibarr web application
-        extraConfig = ''
-          session.use_strict_mode = 1
-          session.cookie_samesite = "Lax"
-          ; open_basedir = "${package}/htdocs, ${cfg.stateDir}"
-          allow_url_fopen = 0
-          disable_functions = "pcntl_alarm, pcntl_fork, pcntl_waitpid, pcntl_wait, pcntl_wifexited, pcntl_wifstopped, pcntl_wifsignaled, pcntl_wifcontinued, pcntl_wexitstatus, pcntl_wtermsig, pcntl_wstopsig, pcntl_signal, pcntl_signal_get_handler, pcntl_signal_dispatch, pcntl_get_last_error, pcntl_strerror, pcntl_sigprocmask, pcntl_sigwaitinfo, pcntl_sigtimedwait, pcntl_exec, pcntl_getpriority, pcntl_setpriority, pcntl_async_signals"
+        settings = {
+          "listen.mode" = "0660";
+          "listen.owner" = cfg.user;
+          "listen.group" = cfg.group;
+        } // cfg.poolConfig;
+      };
+
+      # there are several challenges with dolibarr and NixOS which we can address here
+      # - the dolibarr installer cannot be entirely automated, though it can partially be by including a file called install.forced.php
+      # - the dolibarr installer requires write access to its config file during installation, though not afterwards
+      # - the dolibarr config file generally holds secrets generated by the installer, though the config file is a php file so we can read and write these secrets from an external file
+      systemd.services.dolibarr-config = {
+        description = "dolibarr configuration file management via NixOS";
+        wantedBy = [ "multi-user.target" ];
+
+        script = ''
+          # extract the 'main instance unique id' secret that the dolibarr installer generated for us, store it in a file for use by our own NixOS generated configuration file
+          ${pkgs.php}/bin/php -r "include '${cfg.stateDir}/conf.php'; file_put_contents('${cfg.stateDir}/dolibarr_main_instance_unique_id', \$dolibarr_main_instance_unique_id);"
+
+          # replace configuration file generated by installer with the NixOS generated configuration file
+          install -m 440 ${mkConfigFile "conf.php" cfg.settings} '${cfg.stateDir}/conf.php'
        '';
+
+        serviceConfig = {
+          Type = "oneshot";
+          User = cfg.user;
+          Group = cfg.group;
+          RemainAfterExit = "yes";
+        };
+
+        unitConfig = {
+          ConditionFileNotEmpty = "${cfg.stateDir}/conf.php";
+        };
      };

-      settings = {
-        "listen.mode" = "0660";
-        "listen.owner" = cfg.user;
-        "listen.group" = cfg.group;
-      } // cfg.poolConfig;
-    };
-
-    # there are several challenges with dolibarr and NixOS which we can address here
-    # - the dolibarr installer cannot be entirely automated, though it can partially be by including a file called install.forced.php
-    # - the dolibarr installer requires write access to its config file during installation, though not afterwards
-    # - the dolibarr config file generally holds secrets generated by the installer, though the config file is a php file so we can read and write these secrets from an external file
-    systemd.services.dolibarr-config = {
-      description = "dolibarr configuration file management via NixOS";
-      wantedBy = [ "multi-user.target" ];
-
-      script = ''
-        # extract the 'main instance unique id' secret that the dolibarr installer generated for us, store it in a file for use by our own NixOS generated configuration file
-        ${pkgs.php}/bin/php -r "include '${cfg.stateDir}/conf.php'; file_put_contents('${cfg.stateDir}/dolibarr_main_instance_unique_id', \$dolibarr_main_instance_unique_id);"
-
-        # replace configuration file generated by installer with the NixOS generated configuration file
-        install -m 644 ${mkConfigFile "conf.php" cfg.settings} '${cfg.stateDir}/conf.php'
-      '';
-
-      serviceConfig = {
-        Type = "oneshot";
-        User = cfg.user;
-        Group = cfg.group;
-        RemainAfterExit = "yes";
+      users.users.dolibarr = mkIf (cfg.user == "dolibarr") {
+        isSystemUser = true;
+        group = cfg.group;
      };

-      unitConfig = {
-        ConditionFileNotEmpty = "${cfg.stateDir}/conf.php";
+      users.groups = optionalAttrs (cfg.group == "dolibarr") {
+        dolibarr = { };
      };
-    };
-
-    users.users.dolibarr = mkIf (cfg.user == "dolibarr" ) {
-      isSystemUser = true;
-      group = cfg.group;
-    };
-
-    users.groups = optionalAttrs (cfg.group == "dolibarr") {
-      dolibarr = { };
-    };
-  }
-  (mkIf (cfg.nginx != null) {
-    users.users."${config.services.nginx.group}".extraGroups = mkIf (cfg.nginx != null) [ cfg.group ];
-  })
-]);
+    }
+    (mkIf (cfg.nginx != null) {
+      users.users."${config.services.nginx.group}".extraGroups = mkIf (cfg.nginx != null) [ cfg.group ];
+    })
+  ]);
 }
@@ -48,10 +48,26 @@ let
    preferLocalBuild = true;
  } ''
    mkdir -p $out/bin
-    for i in changePassword.php createAndPromote.php resetUserEmail.php userOptions.php edit.php nukePage.php update.php; do
-      makeWrapper ${php}/bin/php $out/bin/mediawiki-$(basename $i .php) \
-        --set MEDIAWIKI_CONFIG ${mediawikiConfig} \
-        --add-flags ${pkg}/share/mediawiki/maintenance/$i
+    makeWrapper ${php}/bin/php $out/bin/mediawiki-maintenance \
+      --set MEDIAWIKI_CONFIG ${mediawikiConfig} \
+      --add-flags ${pkg}/share/mediawiki/maintenance/run.php
+
+    for i in changePassword createAndPromote deleteUserEmail resetUserEmail userOptions edit nukePage update importDump run; do
+      script="$out/bin/mediawiki-$i"
+    cat <<'EOF' >"$script"
+    #!${pkgs.runtimeShell}
+    become=(exec)
+    if [[ "$(id -u)" != ${user} ]]; then
+      become=(exec /run/wrappers/bin/sudo -u ${user} --)
+    fi
+    "${"$"}{become[@]}" ${placeholder "out"}/bin/mediawiki-maintenance \
+    EOF
+      if [[ "$i" != "run" ]]; then
+        echo "  ${pkg}/share/mediawiki/maintenance/$i.php \"\$@\"" >>"$script"
+      else
+        echo "  ${pkg}/share/mediawiki/maintenance/\$1.php \"\''${@:2}\"" >>"$script"
+      fi
+      chmod +x "$script"
    done
  '';

@@ -13,7 +13,38 @@ in
 {
  ###### interface

-  options.powerManagement.powertop.enable = mkEnableOption "powertop auto tuning on startup";
+  options.powerManagement.powertop = {
+    enable = mkEnableOption "powertop auto tuning on startup";
+
+    preStart = mkOption {
+      type = types.lines;
+      default = "";
+      description = ''
+        Shell commands executed before `powertop` is started.
+      '';
+    };
+
+    postStart = mkOption {
+      type = types.lines;
+      default = "";
+      example = ''
+        ''${lib.getExe' config.systemd.package "udevadm"} trigger -c bind -s usb -a idVendor=046d -a idProduct=c08c
+      '';
+      description = ''
+        Shell commands executed after `powertop` is started.
+
+        This can be used to workaround problematic configurations. For example,
+        you can retrigger an `udev` rule to disable power saving on unsupported
+        USB devices:
+        ```
+        services.udev.extraRules = ''''
+          # disable USB auto suspend for Logitech, Inc. G PRO Gaming Mouse
+          ACTION=="bind", SUBSYSTEM=="usb", ATTR{idVendor}=="046d", ATTR{idProduct}=="c08c", TEST=="power/control", ATTR{power/control}="on"
+        '''';
+        ```
+      '';
+    };
+  };

  ###### implementation

@@ -24,6 +55,8 @@ in
        after = [ "multi-user.target" ];
        description = "Powertop tunings";
        path = [ pkgs.kmod ];
+        preStart = cfg.preStart;
+        postStart = cfg.postStart;
        serviceConfig = {
          Type = "oneshot";
          RemainAfterExit = "yes";
@@ -9,7 +9,7 @@ let
  cfg = config.virtualisation.virtualbox.guest;
  kernel = config.boot.kernelPackages;

-  mkVirtualBoxUserService = serviceArgs: {
+  mkVirtualBoxUserService = serviceArgs: verbose: {
    description = "VirtualBox Guest User Services ${serviceArgs}";

    wantedBy = [ "graphical-session.target" ];
@@ -24,12 +24,22 @@ let
    # Check if the display environment is ready, otherwise fail
    preStart = "${pkgs.bash}/bin/bash -c \"if [ -z $DISPLAY ]; then exit 1; fi\"";
    serviceConfig = {
-      ExecStart = "@${kernel.virtualboxGuestAdditions}/bin/VBoxClient --foreground ${serviceArgs}";
+      ExecStart =
+        "@${kernel.virtualboxGuestAdditions}/bin/VBoxClient"
+        + (lib.strings.optionalString verbose " --verbose")
+        + " --foreground ${serviceArgs}";
      # Wait after a failure, hoping that the display environment is ready after waiting
      RestartSec = 2;
      Restart = "always";
    };
  };
+
+  mkVirtualBoxUserX11OnlyService =
+    serviceArgs: verbose:
+    (mkVirtualBoxUserService serviceArgs verbose)
+    // {
+      unitConfig.ConditionEnvironment = "XDG_SESSION_TYPE=x11";
+    };
 in
 {
  imports = [
@@ -73,6 +83,18 @@ in
      type = lib.types.bool;
      description = "Whether to enable drag and drop support.";
    };
+
+    verbose = lib.mkOption {
+      default = false;
+      type = lib.types.bool;
+      description = "Whether to verbose logging for guest services.";
+    };
+
+    vboxsf = lib.mkOption {
+      default = true;
+      type = lib.types.bool;
+      description = "Whether to load vboxsf";
+    };
  };

  ###### implementation
@@ -91,11 +113,6 @@ in

        boot.extraModulePackages = [ kernel.virtualboxGuestAdditions ];

-        boot.supportedFilesystems = [ "vboxsf" ];
-        boot.initrd.supportedFilesystems = [ "vboxsf" ];
-
-        users.groups.vboxsf.gid = config.ids.gids.vboxsf;
-
        systemd.services.virtualbox = {
          description = "VirtualBox Guest Services";

@@ -117,16 +134,22 @@ in
          SUBSYSTEM=="misc", KERNEL=="vboxguest", TAG+="systemd"
        '';

-        systemd.user.services.virtualboxClientVmsvga = mkVirtualBoxUserService "--vmsvga-session";
+        systemd.user.services.virtualboxClientVmsvga = mkVirtualBoxUserService "--vmsvga-session" cfg.verbose;
      }
+      (lib.mkIf cfg.vboxsf {
+        boot.supportedFilesystems = [ "vboxsf" ];
+        boot.initrd.supportedFilesystems = [ "vboxsf" ];
+
+        users.groups.vboxsf.gid = config.ids.gids.vboxsf;
+      })
      (lib.mkIf cfg.clipboard {
-        systemd.user.services.virtualboxClientClipboard = mkVirtualBoxUserService "--clipboard";
+        systemd.user.services.virtualboxClientClipboard = mkVirtualBoxUserService "--clipboard" cfg.verbose;
      })
      (lib.mkIf cfg.seamless {
-        systemd.user.services.virtualboxClientSeamless = mkVirtualBoxUserService "--seamless";
+        systemd.user.services.virtualboxClientSeamless = mkVirtualBoxUserX11OnlyService "--seamless" cfg.verbose;
      })
      (lib.mkIf cfg.dragAndDrop {
-        systemd.user.services.virtualboxClientDragAndDrop = mkVirtualBoxUserService "--draganddrop";
+        systemd.user.services.virtualboxClientDragAndDrop = mkVirtualBoxUserService "--draganddrop" cfg.verbose;
      })
    ]
  );
@@ -4329,8 +4329,8 @@ let
        mktplcRef = {
          name = "sas-lsp";
          publisher = "SAS";
-          version = "1.12.0";
-          hash = "sha256-go7H9DS1uJkzKowIQ2riSPOZRC737/Q0AWxzHIcBwg4=";
+          version = "1.13.0";
+          hash = "sha256-bcj9p/hvzZ1z03D1dXxiyPmGndh3pD7seI5VYHWsvzU=";
        };
        meta = {
          changelog = "https://marketplace.visualstudio.com/items/SAS.sas-lsp/changelog";
@@ -11,7 +11,7 @@ vscode-utils.buildVscodeMarketplaceExtension {
    name = "tinymist";
    publisher = "myriad-dreamin";
    inherit (tinymist) version;
-    hash = "sha256-vkVH+CBGSEWqSIDel+Y2O+B17LvLZbOjpHzbGAvEmWg=";
+    hash = "sha256-nMuK51ktoJQTgJEfFivOjDmnMUx/lWNsIPZ7ZmreqYo=";
  };

  nativeBuildInputs = [
@@ -16,7 +16,7 @@
  libGL,
 }:
 let
-  buildNumber = "1293";
+  buildNumber = "1294";
  vaqua = fetchurl {
    name = "VAqua9.jar";
    url = "https://violetlib.org/release/vaqua/9/VAqua9.jar";
@@ -61,13 +61,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "processing";
-  version = "4.3";
+  version = "4.3.1";

  src = fetchFromGitHub {
    owner = "processing";
    repo = "processing4";
    rev = "processing-${buildNumber}-${version}";
-    sha256 = "sha256-SzQemZ6iZ9o89/doV8YMv7DmyPSDyckJl3oyxJyfrm0=";
+    sha256 = "sha256-nshhPeDXhrvk+2oQ9BPqJTZV9a+OjxeQiO31JAxQ40g=";
  };

  nativeBuildInputs = [
@@ -53,6 +53,6 @@ mkDerivation {
    mainProgram = "booth";
    homepage = "https://invent.kde.org/maui/booth";
    license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ milahu ];
+    maintainers = with maintainers; [ ];
  };
 }
@@ -24,7 +24,7 @@ let
  vivaldiName = if isSnapshot then "vivaldi-snapshot" else "vivaldi";
 in stdenv.mkDerivation rec {
  pname = "vivaldi";
-  version = "7.0.3495.23";
+  version = "7.0.3495.27";

  suffix = {
    aarch64-linux = "arm64";
@@ -34,8 +34,8 @@ in stdenv.mkDerivation rec {
  src = fetchurl {
    url = "https://downloads.vivaldi.com/${branch}/vivaldi-${branch}_${version}-1_${suffix}.deb";
    hash = {
-      aarch64-linux = "sha256-mnu76Lu4xKaA0mZYto3wOYZl65i6SDU56Lo3dH59mtM=";
-      x86_64-linux = "sha256-FtCmtwipbEyhTmt/d5tSEc7MKrrPssiSWzcC7AYy3tg=";
+      aarch64-linux = "sha256-AX6PCYPpz5z9bUZqdfoTqtW9USLQRh8YgITk7DdJkUU=";
+      x86_64-linux = "sha256-pZgmRLwx64m9SwYX2cTwYEkHLYFQgIFblW9dSiYxXv8=";
    }.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
  };

@@ -1,7 +1,6 @@
 {
  lib,
  stdenv,
-  mkDerivation,
  extra-cmake-modules,
  fetchurl,
  kconfig,
@@ -34,15 +33,15 @@
  wcslib,
  stellarsolver,
  libxisf,
+  curl,
 }:
-
 stdenv.mkDerivation (finalAttrs: {
  pname = "kstars";
-  version = "3.7.2";
+  version = "3.7.4";

  src = fetchurl {
    url = "mirror://kde/stable/kstars/${finalAttrs.version}/kstars-${finalAttrs.version}.tar.xz";
-    hash = "sha256-fEu3BGBW5cgrY38zBB3iL0/SRrobEtJVsGNWRNtT40s=";
+    hash = "sha256-WdVsPCwDQWW/NIRehuqk5f8rgtucAbGLSbmwZLMLiHM=";
  };

  nativeBuildInputs = [
@@ -80,6 +79,7 @@ stdenv.mkDerivation (finalAttrs: {
    wcslib
    stellarsolver
    libxisf
+    curl
  ];

  cmakeFlags = [
@@ -8,14 +8,12 @@
  zlib,
  patchelf,
  makeWrapper,
+  wayland,
+  libX11,
 }:
 let
  virtualBoxNixGuestAdditionsBuilder = callPackage ./builder.nix { };

-  # Forced to 1.18; vboxvideo doesn't seem to provide any newer ABI,
-  # and nixpkgs doesn't support older ABIs anymore.
-  xserverABI = "118";
-
  # Specifies how to patch binaries to make sure that libraries loaded using
  # dlopen are found. We grep binaries for specific library names and patch
  # RUNPATH in matching binaries to contain the needed library paths.
@@ -32,6 +30,18 @@ let
      name = "libXrandr.so";
      pkg = xorg.libXrandr;
    }
+    {
+      name = "libwayland-client.so";
+      pkg = wayland;
+    }
+    {
+      name = "libX11.so";
+      pkg = libX11;
+    }
+    {
+      name = "libXt.so";
+      pkg = xorg.libXt;
+    }
  ];
 in
 stdenv.mkDerivation {
@@ -1,23 +1,21 @@
 {
  lib,
-  # Required based on 'go' directive in go.mod,
-  # remove when Go in nixpkgs defaults to 1.23 or later.
-  buildGo123Module,
+  buildGoModule,
  fetchFromGitHub,
 }:

-buildGo123Module rec {
+buildGoModule rec {
  pname = "agebox";
-  version = "0.7.1";
+  version = "0.7.2";

  src = fetchFromGitHub {
    owner = "slok";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-RtFa7k+tw0hyf7bYm51aIxptaD4uOH6/3WDjeoWEEKA=";
+    hash = "sha256-QH0kkquLnB00oKuwb5j2ZoAKPnZkSHJRGaq3RXO5ggg=";
  };

-  vendorHash = "sha256-57YbYDvRYOzQATEFpAuGzQzOYNY8n5LUrcu8jhjSiNI=";
+  vendorHash = "sha256-s3LZgQpUF0t9ETNloJux4gXXSn5Kg+pcuhJSMfWWnSo=";

  ldflags = [
    "-s"
@@ -34,11 +34,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "apt";
-  version = "2.9.17";
+  version = "2.9.18";

  src = fetchurl {
    url = "mirror://debian/pool/main/a/apt/apt_${finalAttrs.version}.tar.xz";
-    hash = "sha256-MKD1u2blDmY1XqqBAJcZL5d9/rXCqle5xPWYcL57DQQ=";
+    hash = "sha256-mQO7u8ibtqRoeggKG/kLuLo2gC7BlrNUmkwf0FAtGjo=";
  };

  # cycle detection; lib can't be split
@@ -6,14 +6,14 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "commix";
-  version = "3.9";
+  version = "4.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "commixproject";
    repo = "commix";
-    rev = "refs/tags/v${version}";
-    hash = "sha256-HX+gEL9nmq9R1GFw8xQaa7kBmW7R0IepitM08bIf3vY=";
+    tag = "v${version}";
+    hash = "sha256-AikhXMacsJ7AZyKWcmu+ngs9KeiwQE60cpM2CV8ej1Y=";
  };

  postPatch = ''
@@ -2,6 +2,8 @@
  lib,
  buildDotnetGlobalTool,
  dotnetCorePackages,
+  versionCheckHook,
+  nix-update-script,
 }:
 let
  inherit (dotnetCorePackages) sdk_8_0;
@@ -9,13 +11,21 @@ in

 buildDotnetGlobalTool rec {
  pname = "csharp-ls";
-  version = "0.15.0";
+  version = "0.16.0";

-  nugetHash = "sha256-Fp1D2z4x2e85z4IO4xQentS7dbqhFT3e/BPZm0d5L5M=";
+  nugetHash = "sha256-1uj0GlnrOXIYcjJSbkr3Kugft9xrHX4RYOeqH0hf1VU=";

  dotnet-sdk = sdk_8_0;
  dotnet-runtime = sdk_8_0;

+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  versionCheckProgramArg = [ "--version" ];
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { };
+
  meta = {
    description = "Roslyn-based LSP language server for C#";
    mainProgram = "csharp-ls";
@@ -24,5 +34,11 @@ buildDotnetGlobalTool rec {
    license = lib.licenses.mit;
    platforms = lib.platforms.unix;
    maintainers = with lib.maintainers; [ GaetanLepage ];
+    badPlatforms = [
+      # Crashes immediatly at runtime
+      # terminated by signal SIGKILL (Forced quit)
+      # https://github.com/razzmatazz/csharp-language-server/issues/211
+      "aarch64-darwin"
+    ];
  };
 }
@@ -12,16 +12,16 @@
 }:
 buildGoModule rec {
  pname = "cunicu";
-  version = "0.5.72";
+  version = "0.6.5";

  src = fetchFromGitHub {
    owner = "cunicu";
    repo = "cunicu";
    rev = "v${version}";
-    hash = "sha256-W6EoFlRr8WVg5k5bk9L9RAMLLazd1uzufXmzP82WIiU=";
+    hash = "sha256-bDXZ0a9yQZMHmNrwKRQzLoPtwkthDIDRhBxDAeXN064=";
  };

-  vendorHash = "sha256-gLvTLXNJkgqmDr08kH0dg0MBVMRawBG7lJjIFy2US14=";
+  vendorHash = "sha256-g2FA5b/80yRwIbAf3Sot74Eftj/Q/bTBj8lK+tQ2UNg=";

  nativeBuildInputs = [
    installShellFiles
@@ -8,16 +8,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "darklua";
-  version = "0.14.1";
+  version = "0.15.0";

  src = fetchFromGitHub {
    owner = "seaofvoices";
    repo = "darklua";
    rev = "v${version}";
-    hash = "sha256-Q0kNt+4Nu7zVniiTRzGu7pNfWiXkxGaYkzgelaECn9U=";
+    hash = "sha256-OLx3J8E9PYXgWbQncWoezyptrbFYcw3xmXzYAn7IUFw=";
  };

-  cargoHash = "sha256-G3XvfDQjx1wbALnTQbSHOvBWc5JTKzwJFwNABtK12sM=";
+  cargoHash = "sha256-bG5bjtA5a1gSabH9nqfYg/gdt2jfddlbPY3P6HEhQ2s=";

  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
    darwin.apple_sdk.frameworks.CoreServices
@@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "dnsproxy";
-  version = "0.73.4";
+  version = "0.73.5";

  src = fetchFromGitHub {
    owner = "AdguardTeam";
    repo = "dnsproxy";
    rev = "v${version}";
-    hash = "sha256-LCo/SWfsmwbHhDZRf9PRN0FbB81js616YLUQG/Xtz2A=";
+    hash = "sha256-U3OqRfJUtH0rMdVypaoFF3Mi6oBvgt08ufnERPFVjC4=";
  };

-  vendorHash = "sha256-5NTHIeKwruVMO7mBxcO+wglUslOJVFmxS2krDfdFAgg=";
+  vendorHash = "sha256-d1WrUfE31Gvgz8tw7cVdPhWf4OHsuuyEHDSn9bETCjI=";

  ldflags = [
    "-s"
@@ -31,7 +31,11 @@ stdenv.mkDerivation rec {
    "--enable-performance"
  ] ++ lib.optional stdenv.hostPlatform.isx86_64 "--enable-sse-intrinsics";

-  LDFLAGS = "-lblas -llapack";
+  env = {
+    # Required for compilation with gcc-14
+    NIX_CFLAGS_COMPILE = "-Wno-error=implicit-function-declaration";
+    LDFLAGS = "-lblas -llapack";
+  };

  enableParallelBuilding = true;

@@ -17,17 +17,17 @@ let
 in
 buildGoModule rec {
  pname = "forgejo-runner";
-  version = "5.0.3";
+  version = "5.0.4";

  src = fetchFromGitea {
    domain = "code.forgejo.org";
    owner = "forgejo";
    repo = "runner";
    rev = "v${version}";
-    hash = "sha256-c1s2n4s2LY4KvQrPZJpAnXzJCTe6Fbc0cf1plwHZPiA=";
+    hash = "sha256-juCOIa7dX1WbGlo6mIR7XQs9v7zb7TtKPRJwXagP89Q=";
  };

-  vendorHash = "sha256-DQcVknodbVlHygJkrGSfVGPKXR9kLGeyivNjYmjtFNs=";
+  vendorHash = "sha256-hQV4j22+WkLelcwNE6T5Y2PYcoahsOwUAkBuxaDYgsA=";

  ldflags = [
    "-s"
@@ -30,6 +30,10 @@ stdenv.mkDerivation rec {
    "ac_cv_file__dev_random=true"
  ];

+  # Fix GCC 14 build.
+  # https://savannah.gnu.org/bugs/?65203
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=implicit-function-declaration";
+
  doCheck = true;

  meta = {
@@ -26,8 +26,8 @@ let
 in

 stdenv.mkDerivation rec {
-  srcVersion = "sep24a";
-  version = "20240901_a";
+  srcVersion = "dec24a";
+  version = "20241201_a";
  pname = "gildas";

  src = fetchurl {
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
      "http://www.iram.fr/~gildas/dist/gildas-src-${srcVersion}.tar.xz"
      "http://www.iram.fr/~gildas/dist/archive/gildas/gildas-src-${srcVersion}.tar.xz"
    ];
-    sha256 = "sha256-dZ03J3I1dgoSgSc9yGfO13ZvNawCSYKN3+SGvp1eyGA=";
+    sha256 = "sha256-5XKImlE5A6JjA6LLqmGc4IzaMMPoHDo8cUPmgRtnEp0=";
  };

  nativeBuildInputs = [
@@ -5,10 +5,10 @@
 }:
 let
  pname = "heptabase";
-  version = "1.48.1";
+  version = "1.49.0";
  src = fetchurl {
    url = "https://github.com/heptameta/project-meta/releases/download/v${version}/Heptabase-${version}.AppImage";
-    hash = "sha256-zscrloVYmR4NSNWINqdAP/9gHu5+GpFTRq0MF7bNE2Y=";
+    hash = "sha256-4YjhJEuDMKNvIHir6Je4MKbgZzTfPxdMeuvF/F+kYvw=";
  };

  appimageContents = appimageTools.extractType2 { inherit pname version src; };
@@ -19,14 +19,14 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "home-manager";
-  version = "0-unstable-2024-12-12";
+  version = "0-unstable-2024-12-23";

  src = fetchFromGitHub {
    name = "home-manager-source";
    owner = "nix-community";
    repo = "home-manager";
-    rev = "3066cc58f552421a2c5414e78407fa5603405b1e";
-    hash = "sha256-e9YAMReFV1fDPcZLFC2pa4k/8TloSXeX0z2VysNMAoA=";
+    rev = "f1b1786ea77739dcd181b920d430e30fb1608b8a";
+    hash = "sha256-f9UyHMTb+BwF6RDZ8eO9HOkSlKeeSPBlcYhMmV1UNIk=";
  };

  nativeBuildInputs = [
@@ -5,28 +5,36 @@
  fetchFromGitHub,
  installShellFiles,
  buildPackages,
-  testers,
+  versionCheckHook,
  nix-update-script,
  hugo,
 }:

 buildGoModule rec {
  pname = "hugo";
-  version = "0.139.3";
+  version = "0.140.1";

  src = fetchFromGitHub {
    owner = "gohugoio";
    repo = "hugo";
-    rev = "refs/tags/v${version}";
-    hash = "sha256-bUqLVM1jQ6LVsnDIP2NanmmEFe3mDUt446kH9I0aZQI=";
+    tag = "v${version}";
+    hash = "sha256-9H7hXBz/rKJZr/XvqFRmOQylf6sfJtkwik3jh/k+Vec=";
  };

-  vendorHash = "sha256-LwXrCYGlWe6dOdPTh3YKhJDUID6e+OUOfDYtYxYnx/Y=";
+  vendorHash = "sha256-swcj1JxYoRqKscu/IC0uiAATp4AXN0aANWkSq/mJsyc=";

-  checkFlags = [
-    # Workaround for "failed to load modules"
-    "-skip=TestCommands/mod"
-  ];
+  checkFlags =
+    let
+      skippedTestPrefixes = [
+        # Workaround for "failed to load modules"
+        "TestCommands/mod"
+        # Server tests are flaky, at least in x86_64-darwin. See #368072
+        # We can try testing again after updating the `httpget` helper
+        # ref: https://github.com/gohugoio/hugo/blob/v0.140.1/main_test.go#L220-L233
+        "TestCommands/server"
+      ];
+    in
+    [ "-skip=^${builtins.concatStringsSep "|^" skippedTestPrefixes}" ];

  proxyVendor = true;

@@ -58,11 +66,12 @@ buildGoModule rec {
        --zsh  <(${emulator} $out/bin/hugo completion zsh)
    '';

-  passthru.tests.version = testers.testVersion {
-    package = hugo;
-    command = "hugo version";
-    version = "v${version}";
-  };
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  doInstallCheck = true;
+  versionCheckProgram = "${placeholder "out"}/bin/${meta.mainProgram}";
+  versionCheckProgramArg = [ "version" ];

  passthru.updateScript = nix-update-script { };

@@ -76,6 +85,7 @@ buildGoModule rec {
      schneefux
      Br1ght0ne
      Frostman
+      kachick
    ];
  };
 }
@@ -12,13 +12,13 @@

 stdenv.mkDerivation rec {
  pname = "intel-compute-runtime";
-  version = "24.45.31740.9";
+  version = "24.48.31907.7";

  src = fetchFromGitHub {
    owner = "intel";
    repo = "compute-runtime";
    rev = version;
-    hash = "sha256-b7mHIet+zgbS0JfJLKvt9+xILWeuA2rvTAeXetlFz/w=";
+    hash = "sha256-1YWPCVvG4jjEIDrkAfljhnXYlW0TTiPBCp2mhInuOfY=";
  };

  nativeBuildInputs = [
@@ -10,13 +10,13 @@

 buildGoModule rec {
  pname = "kind";
-  version = "0.25.0";
+  version = "0.26.0";

  src = fetchFromGitHub {
    rev = "v${version}";
    owner = "kubernetes-sigs";
    repo = "kind";
-    hash = "sha256-6WlkZ2dLMSSSlJAEshMpD5Ai0WVo1NzXAvpjEQd3JPA=";
+    hash = "sha256-1bU4vHC9bVz8TfO7knO1RYRxJUnwsXxZrRVnit5iQz0=";
  };

  patches = [
@@ -3,31 +3,28 @@
  fetchFromGitHub,
  stdenv,
  makeWrapper,
-  gitUpdater,
  python3Packages,
  tk,
  addDriverRunpath,

  apple-sdk_12,
+  darwinMinVersionHook,

  koboldLiteSupport ? true,

  config,
  cudaPackages ? { },

-  openblasSupport ? !stdenv.hostPlatform.isDarwin,
-  openblas,
-
  cublasSupport ? config.cudaSupport,
  # You can find a full list here: https://arnon.dk/matching-sm-architectures-arch-and-gencode-for-various-nvidia-cards/
-  # For example if you're on an GTX 1080 that means you're using "Pascal" and you need to pass "sm_60"
+  # For example if you're on an RTX 3060 that means you're using "Ampere" and you need to pass "sm_86"
  cudaArches ? cudaPackages.cudaFlags.realArches or [ ],

  clblastSupport ? stdenv.hostPlatform.isLinux,
  clblast,
  ocl-icd,

-  vulkanSupport ? true,
+  vulkanSupport ? (!stdenv.hostPlatform.isDarwin),
  vulkan-loader,
  metalSupport ? stdenv.hostPlatform.isDarwin,
  nix-update-script,
@@ -44,13 +41,13 @@ let
 in
 effectiveStdenv.mkDerivation (finalAttrs: {
  pname = "koboldcpp";
-  version = "1.79.1";
+  version = "1.80.1";

  src = fetchFromGitHub {
    owner = "LostRuins";
    repo = "koboldcpp";
    rev = "refs/tags/v${finalAttrs.version}";
-    hash = "sha256-RHeEI6mJklGF7BQXxLwxSr1xD6GsI9+fio888UxKru0=";
+    hash = "sha256-CgJzYF8FnHk0zKdysGJWLnNo/MND24AbQdjRbDtv0II=";
  };

  enableParallelBuilding = true;
@@ -65,8 +62,10 @@ effectiveStdenv.mkDerivation (finalAttrs: {
  buildInputs =
    [ tk ]
    ++ finalAttrs.pythonInputs
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [ apple-sdk_12 ]
-    ++ lib.optionals openblasSupport [ openblas ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      apple-sdk_12
+      (darwinMinVersionHook "10.15")
+    ]
    ++ lib.optionals cublasSupport [
      cudaPackages.libcublas
      cudaPackages.cuda_nvcc
@@ -82,7 +81,6 @@ effectiveStdenv.mkDerivation (finalAttrs: {
  pythonPath = finalAttrs.pythonInputs;

  makeFlags = [
-    (makeBool "LLAMA_OPENBLAS" openblasSupport)
    (makeBool "LLAMA_CUBLAS" cublasSupport)
    (makeBool "LLAMA_CLBLAST" clblastSupport)
    (makeBool "LLAMA_VULKAN" vulkanSupport)
@@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "kubectl-cnpg";
-  version = "1.24.1";
+  version = "1.24.2";

  src = fetchFromGitHub {
    owner = "cloudnative-pg";
    repo = "cloudnative-pg";
    rev = "v${version}";
-    hash = "sha256-M33ngnpxR3fQNsAkef4Rs4I3wNpOu5wTxbl48gL88F8=";
+    hash = "sha256-XXlqtqn2PiBo2YHaBnwt1BpTnON+ActIuLO0EFDAxMw=";
  };

-  vendorHash = "sha256-nFWMw/FpaALp347z5dO8509fJCVISwS6z57JfQ+p3Dg=";
+  vendorHash = "sha256-FpCM2R/bQ1BScYHEK5xaO0kZ/hCUZaUDhu6XoTNPn2o=";

  subPackages = [ "cmd/kubectl-cnpg" ];

@@ -23,7 +23,7 @@ buildGoModule rec {
  doCheck = false;

  meta = {
-    description = "Run the appripriate migrations for migrating the filesystem repository of Kubo (migrations not included)";
+    description = "Run the appropriate migrations for migrating the filesystem repository of Kubo (migrations not included)";
    homepage = "https://github.com/ipfs/fs-repo-migrations";
    license = lib.licenses.mit;
    platforms = lib.platforms.unix;
@@ -21,6 +21,6 @@ buildEnv {
  '';

  meta = kubo-migrator-unwrapped.meta // {
-    description = "Run the appripriate migrations for migrating the filesystem repository of Kubo";
+    description = "Run the appropriate migrations for migrating the filesystem repository of Kubo";
  };
 }
@@ -8,13 +8,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "libspatialindex";
-  version = "2.0.0";
+  version = "2.1.0";

  src = fetchFromGitHub {
    owner = "libspatialindex";
    repo = "libspatialindex";
    rev = finalAttrs.version;
-    hash = "sha256-hZyAXz1ddRStjZeqDf4lYkV/g0JLqLy7+GrSUh75k20=";
+    hash = "sha256-a2CzRLHdQMnVhHZhwYsye4X644r8gp1m6vU2CJpSRpU=";
  };

  postPatch = ''
@@ -7,16 +7,16 @@
 }:
 rustPlatform.buildRustPackage rec {
  pname = "limbo";
-  version = "0.0.9";
+  version = "0.0.10";

  src = fetchFromGitHub {
    owner = "tursodatabase";
    repo = "limbo";
    tag = "v${version}";
-    hash = "sha256-cUGakjq6PFUKSMPKGL1CcYUjDMzdTUWUqMs0J8ZNaeQ=";
+    hash = "sha256-RTX/CRfUKvMSZhULhZD+PcYcc+a1gxANMxm+GmNyb3M=";
  };

-  cargoHash = "sha256-pXMfAMD8ThMQvYRLTYuPimPoN42OXOL8Li0LsoQ/13A=";
+  cargoHash = "sha256-BzVPaT7eGOQKRkZe2ZK4rWjHQ2WM7YVMo2siUhpGfOM=";

  cargoBuildFlags = [
    "-p"
@@ -33,7 +33,7 @@ rustPlatform.buildRustPackage rec {
  meta = {
    description = "Interactive SQL shell for Limbo";
    homepage = "https://github.com/tursodatabase/limbo";
-    changelog = "https://github.com/tursodatabase/limbo/releases/tag/${src.tag}";
+    changelog = "https://github.com/tursodatabase/limbo/blob/${src.tag}/CHANGELOG.md";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ nartsiss ];
    mainProgram = "limbo";
@@ -0,0 +1,13 @@
+diff --git a/BUILD.gn b/BUILD.gn
+index 598bbbcb72..62c6c5a187 100644
+--- a/BUILD.gn
+++ b/BUILD.gn
+@@ -138,7 +138,7 @@ config("library_impl_config") {
+ # target_defaults and direct_dependent_settings.
+ config("common_inherited_config") {
+   defines = []
+-  cflags = [ "-fvisibility=default" ]
+  cflags = [ "-fvisibility=default", "-Wno-error=c++11-narrowing-const-reference" ]
+   ldflags = [ "-lavutil", "-lavformat", "-lavcodec" ]
+ 
+   if (rtc_dlog_always_on) {
@@ -78,30 +78,34 @@ stdenv.mkDerivation {

  src = "${sources}/src";

-  patches = [
-    # Adds missing dependencies to generated LICENSE
-    (fetchpatch {
-      url = "https://raw.githubusercontent.com/livekit/rust-sdks/b41861c7b71762d5d85b3de07ae67ffcae7c3fa2/webrtc-sys/libwebrtc/patches/add_licenses.patch";
-      hash = "sha256-9A4KyRW1K3eoQxsTbPX0vOnj66TCs2Fxjpsu5wO8mGI=";
-    })
-    # Fixes the certificate chain, required for Let's Encrypt certs
-    (fetchpatch {
-      url = "https://raw.githubusercontent.com/livekit/rust-sdks/b41861c7b71762d5d85b3de07ae67ffcae7c3fa2/webrtc-sys/libwebrtc/patches/ssl_verify_callback_with_native_handle.patch";
-      hash = "sha256-/gneuCac4VGJCWCjJZlgLKFOTV+x7Lc5KVFnNIKenwM=";
-    })
-    # Adds dependencies and features required by livekit
-    (fetchpatch {
-      url = "https://raw.githubusercontent.com/livekit/rust-sdks/b41861c7b71762d5d85b3de07ae67ffcae7c3fa2/webrtc-sys/libwebrtc/patches/add_deps.patch";
-      hash = "sha256-EMNYcTcBYh51Tt96+HP43ND11qGKClfx3xIPQmIBSo0=";
-    })
-    # Fixes concurrency and localization issues
-    (fetchpatch {
-      url = "https://github.com/zed-industries/webrtc/commit/08f7a701a2eda6407670508fc2154257a3c90308.patch";
-      hash = "sha256-oWYZLwqjRSHDt92MqsxsoBSMyZKj1ubNbOXZRbPpbEw=";
-    })
-    # Required for dynamically linking to ffmpeg libraries and exposing symbols
-    ./0001-shared-libraries.patch
-  ];
+  patches =
+    [
+      # Adds missing dependencies to generated LICENSE
+      (fetchpatch {
+        url = "https://raw.githubusercontent.com/livekit/rust-sdks/b41861c7b71762d5d85b3de07ae67ffcae7c3fa2/webrtc-sys/libwebrtc/patches/add_licenses.patch";
+        hash = "sha256-9A4KyRW1K3eoQxsTbPX0vOnj66TCs2Fxjpsu5wO8mGI=";
+      })
+      # Fixes the certificate chain, required for Let's Encrypt certs
+      (fetchpatch {
+        url = "https://raw.githubusercontent.com/livekit/rust-sdks/b41861c7b71762d5d85b3de07ae67ffcae7c3fa2/webrtc-sys/libwebrtc/patches/ssl_verify_callback_with_native_handle.patch";
+        hash = "sha256-/gneuCac4VGJCWCjJZlgLKFOTV+x7Lc5KVFnNIKenwM=";
+      })
+      # Adds dependencies and features required by livekit
+      (fetchpatch {
+        url = "https://raw.githubusercontent.com/livekit/rust-sdks/b41861c7b71762d5d85b3de07ae67ffcae7c3fa2/webrtc-sys/libwebrtc/patches/add_deps.patch";
+        hash = "sha256-EMNYcTcBYh51Tt96+HP43ND11qGKClfx3xIPQmIBSo0=";
+      })
+      # Fixes concurrency and localization issues
+      (fetchpatch {
+        url = "https://github.com/zed-industries/webrtc/commit/08f7a701a2eda6407670508fc2154257a3c90308.patch";
+        hash = "sha256-oWYZLwqjRSHDt92MqsxsoBSMyZKj1ubNbOXZRbPpbEw=";
+      })
+      # Required for dynamically linking to ffmpeg libraries and exposing symbols
+      ./0001-shared-libraries.patch
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      ./0002-disable-narrowing-const-reference.patch
+    ];

  postPatch =
    ''
@@ -0,0 +1,30 @@
+{
+  lib,
+  fetchFromGitHub,
+  rustPlatform,
+  perl,
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "managarr";
+  version = "0.4.2";
+
+  src = fetchFromGitHub {
+    owner = "Dark-Alex-17";
+    repo = "managarr";
+    tag = "v${version}";
+    hash = "sha256-OxGFubtMsGnR8cWDKkeAgryY095uydA3LzE5SS0dspQ=";
+  };
+
+  cargoHash = "sha256-bws4LwpJGfq0hCA2Fq51uCMvr0arbayppq1jvDrILZI=";
+
+  nativeBuildInputs = [ perl ];
+
+  meta = {
+    description = "TUI and CLI to manage your Servarrs";
+    homepage = "https://github.com/Dark-Alex-17/managarr";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.IncredibleLaser ];
+    mainProgram = "managarr";
+  };
+}
@@ -0,0 +1,25 @@
+diff --git a/src/utils/dumplibs.cpp b/src/utils/dumplibs.cpp
+index 4215d6183..2d410f150 100644
+--- a/src/utils/dumplibs.cpp
+++ b/src/utils/dumplibs.cpp
+@@ -140,7 +140,7 @@ void dumpLibs()
+     LIBXML_TEST_VERSION
+ #endif  // LIBXML_TEST_VERSION
+ #ifdef ENABLE_LIBXML
+-    const char **xmlVersion = __xmlParserVersion();
+    const char * const *xmlVersion = __xmlParserVersion();
+     if (xmlVersion != nullptr)
+         logger->log(" libxml2: %s", *xmlVersion);
+ #endif  // ENABLE_LIBXML
+diff --git a/src/utils/xml/libxml.inc b/src/utils/xml/libxml.inc
+index c60abd095..cf4c845a9 100644
+--- a/src/utils/xml/libxml.inc
+++ b/src/utils/xml/libxml.inc
+@@ -24,6 +24,7 @@
+ 
+ #ifdef ENABLE_LIBXML
+ 
+#include <libxml/parser.h>
+ #include <libxml/xmlwriter.h>
+ 
+ __XML_XMLWRITER_H__
@@ -0,0 +1,30 @@
+diff --git a/src/progs/dyecmd/client.cpp b/src/progs/dyecmd/client.cpp
+index 6321da0d2..bb655519b 100644
+--- a/src/progs/dyecmd/client.cpp
+++ b/src/progs/dyecmd/client.cpp
+@@ -86,9 +86,7 @@ PRAGMA48(GCC diagnostic pop)
+ #include <sys/time.h>
+ #include "fs/specialfolder.h"
+ #undef ERROR
+-#endif  // WIN32
+-
+-#ifdef __clang__
+#else
+ #include <ctime>
+ #endif  // __clang__
+ 
+diff --git a/src/resources/wallpaper.cpp b/src/resources/wallpaper.cpp
+index 2df412b7d..1658e3d4a 100644
+--- a/src/resources/wallpaper.cpp
+++ b/src/resources/wallpaper.cpp
+@@ -37,9 +37,7 @@
+ 
+ #ifdef WIN32
+ #include <sys/time.h>
+-#endif  // WIN32
+-
+-#ifdef __clang__
+#else
+ #include <ctime>
+ #endif  // __clang__
+ 
@@ -0,0 +1,79 @@
+{
+  stdenv,
+  lib,
+  fetchFromGitLab,
+  SDL2,
+  SDL2_image,
+  SDL2_ttf,
+  SDL2_mixer,
+  SDL2_net,
+  SDL2_gfx,
+  zlib,
+  physfs,
+  curl,
+  libxml2,
+  libpng,
+  pkg-config,
+  libGL,
+  autoreconfHook,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "manaplus";
+  version = "2.1.3.17-unstable-2024-08-15";
+
+  src = fetchFromGitLab {
+    owner = "manaplus";
+    repo = "manaplus";
+    rev = "40ebe02e81b34f5b02ea682d2d470a20e7e63cfc";
+    sha256 = "sha256-OVmCqK8undrBKgY5bB2spezmYwWXnmrPlSpV5euortc=";
+  };
+
+  # The unstable version has this commit that fixes missing <cstdint> include:
+  # https://gitlab.com/manaplus/manaplus/-/commit/63912a8a6bfaecdb6b40d2a89191a2fb5af32906
+  patches = [
+    # https://gitlab.com/manaplus/manaplus/-/issues/33
+    ./0001-libxml2-const-ptr-and-missing-include.patch
+    # https://gitlab.com/manaplus/manaplus/-/issues/32
+    ./0002-missing-ctime-include.patch
+  ];
+
+  nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
+  ];
+
+  buildInputs = [
+    SDL2
+    SDL2_gfx
+    SDL2_image
+    SDL2_mixer
+    SDL2_net
+    SDL2_ttf
+    curl
+    libGL
+    libpng
+    libxml2
+    physfs
+    zlib
+  ];
+
+  strictDeps = true;
+
+  configureFlags = [
+    (lib.withFeature true "sdl2")
+    (lib.withFeature false "dyecmd")
+    (lib.withFeature false "internalsdlgfx")
+  ];
+
+  enableParallelBuilding = true;
+
+  meta = {
+    maintainers = [ ];
+    description = "Free OpenSource 2D MMORPG client";
+    homepage = "https://manaplus.org/";
+    license = lib.licenses.gpl2Plus;
+    platforms = lib.platforms.all;
+    badPlatforms = [ lib.systems.inspect.patterns.isDarwin ];
+  };
+})
@@ -1,6 +1,6 @@
 {
-  "version": "2.3.3",
-  "integrity": "sha512-nNVPMhaT/5HmTWGPuHfa3WWbu0lDQRyqoHP51YWZcBX4pgOWwGPXpQqEHLsKhEvzL8jdp8aemT/3/iyfvWUAhA==",
-  "filename": "mongosh-2.3.3.tgz",
-  "deps": "sha256-jL7Lf35AHZEUrsSVe4qMT60XzFr03NEBjWFWFkY3n/U="
+  "version": "2.3.7",
+  "integrity": "sha512-MahI3N2PZMjCTIquyTHq2vmX0pkfvdRqScl5os8/PzjdRannrdKVvGVs5uib3e90ybAjKH3PmHD3tpuMHvO7NA==",
+  "filename": "mongosh-2.3.7.tgz",
+  "deps": "sha256-KTmF6fOT/TS6/IkKJhr4f0JP5SKbI9LA+loUmGvZTkI="
 }
@@ -13,15 +13,15 @@

 python3Packages.buildPythonApplication rec {
  pname = "mousam";
-  version = "1.3.2";
+  version = "1.4.0";
  # built with meson, not a python format
  pyproject = false;

  src = fetchFromGitHub {
    owner = "amit9838";
    repo = "mousam";
-    rev = "refs/tags/v${version}";
-    hash = "sha256-1gFuMh5Poypmgyk2bpi9v6iK7WkO5KHLs+WsoDpJPeg=";
+    tag = "v${version}";
+    hash = "sha256-wJcexOyQqLQJLCathpt6D0SEJP1AvfLPfhAfNzhknUQ=";
  };

  nativeBuildInputs = [
@@ -7,16 +7,16 @@

 buildGoModule rec {
  pname = "nats-server";
-  version = "2.10.23";
+  version = "2.10.24";

  src = fetchFromGitHub {
    owner = "nats-io";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-XZPp8hRuweSUJaCXRgJJ2F8/cglWKMeDC/HZxxvL+V8=";
+    hash = "sha256-/iKgRnoAjZX6hiUpPOXpCjY2FsX7JMpNSSCtWgcFLWQ=";
  };

-  vendorHash = "sha256-ZpPxx7WwknlJTk1tMuH6L4oxQAFnd41y4pGky86qKR8=";
+  vendorHash = "sha256-aopqwxIfLFBdy4MFjyQCUKRUORosm4oHcScET9BW3D4=";

  doCheck = false;

@@ -17,16 +17,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "onagre";
-  version = "1.1.0";
+  version = "1.1.1";

  src = fetchFromGitHub {
    owner = "onagre-launcher";
    repo = "onagre";
-    rev = "1.1.0";
-    hash = "sha256-ASeLvgj2RyhsZQtkUTYeA7jWyhbLg8yl6HbN2A/Sl2M=";
+    rev = "1.1.1";
+    hash = "sha256-yVkK3B7/ul0sOxPE3z2qkY/CnsZPQYqTpd64Wo/GXZI=";
  };

-  cargoHash = "sha256-17Hw3jtisOXwARpp0jB0hrNax7nzMWS0kCE3ZAruBj8=";
+  cargoHash = "sha256-ZjS4g0lwWTJwwXpdKHxmEXIS/GQ6eo888nPhq0v+y9I=";

  nativeBuildInputs = [
    makeWrapper
@@ -6,14 +6,14 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "prowler";
-  version = "5.0.2";
+  version = "5.0.4";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "prowler-cloud";
    repo = "prowler";
    tag = version;
-    hash = "sha256-8sQodEh12aEcIgBMC9kvI/aBTqttCC0lcQUl+D+k+XA=";
+    hash = "sha256-aIeJp/tmVVKj65/m/qRoXZXlc2BHwbjKX1H0HUra2nA=";
  };

  pythonRelaxDeps = true;
@@ -87,6 +87,7 @@ stdenv.mkDerivation rec {

  preBuild = ''
    export LANG=C.UTF-8 # fix elixir locale warning
+    export PROJECT_VERSION="$version"
  '';

  postInstall = ''
@@ -106,6 +107,19 @@ stdenv.mkDerivation rec {
    rm $out/INSTALL
  '';

+  # Can not use versionCheckHook since that doesn't allow for setting environment variables
+  # which is necessary since Erlang needs a $HOME for the Cookie.
+  doInstallCheck = true;
+  installCheckPhase = ''
+    runHook preInstallCheck
+    out="$(env - LANG=C.utf8 HOME=/build ${placeholder "out"}/bin/rabbitmqctl version)"
+    if [[ "$out" != "$version" ]]; then
+      echo "Rabbitmq should report version $version, but thinks it's version $out" >&2
+      exit 1
+    fi
+    runHook postInstallCheck
+  '';
+
  passthru.tests = {
    vm-test = nixosTests.rabbitmq;
  };
@@ -24,15 +24,15 @@ let
    ."${stdenv.hostPlatform.system}" or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
  hash =
    {
-      x64-linux_hash = "sha256-VDA3+gZSkeWKCXIkyOZXyQp8Eh13CQPLpZuDN0+w5rE=";
-      arm64-linux_hash = "sha256-I8kEWJL9DNJCytck1FZ8hB4kpQGpDDI7urOaCErX4fI=";
-      x64-osx_hash = "sha256-dJBNLkFMGxOEgTPChYXbkUGn9Ty7FqwuTxJJqd77Lc4=";
+      x64-linux_hash = "sha256-ijBsMc/37cpw1WJ36vIUm1d0wzHjpTsBX9mZRkL91BU=";
+      arm64-linux_hash = "sha256-oTA1O6M/P7kGI/YCoWzTw6kvmMg+QGhpn/jWrOc4rug=";
+      x64-osx_hash = "sha256-ZAZ0Y5O64llljc/NjnOHynEP7wXB/U4J5T1n5Pe+2A4=";
    }
    ."${arch}-${os}_hash";
 in
 stdenv.mkDerivation rec {
  pname = "readarr";
-  version = "0.4.5.2699";
+  version = "0.4.6.2711";

  src = fetchurl {
    url = "https://github.com/Readarr/Readarr/releases/download/v${version}/Readarr.develop.${version}.${os}-core-${arch}.tar.gz";
@@ -21,13 +21,13 @@ let
 in
 stdenv'.mkDerivation (finalAttrs: {
  pname = "renovate";
-  version = "39.65.2";
+  version = "39.82.6";

  src = fetchFromGitHub {
    owner = "renovatebot";
    repo = "renovate";
    tag = finalAttrs.version;
-    hash = "sha256-SDPyhyZtAw9jPqBGlRm3n8AkL2Y70Kf0AeXqMKCokDM=";
+    hash = "sha256-RV3rOzs0dPQK0rYGU6URqTcvqGMXCrke5wSSVo/Wd5s=";
  };

  postPatch = ''
@@ -45,7 +45,7 @@ stdenv'.mkDerivation (finalAttrs: {

  pnpmDeps = pnpm_9.fetchDeps {
    inherit (finalAttrs) pname version src;
-    hash = "sha256-PwUmFy/RBptKsNSoV8rthJILVQqzPIJemnn0qO4ZQJA=";
+    hash = "sha256-c8bnNBkWyJspRvwoQTlExChM1PXi6Hw466xqT11s7Ys=";
  };

  env.COREPACK_ENABLE_STRICT = 0;
@@ -7,13 +7,13 @@

 buildGoModule rec {
  pname = "roadrunner";
-  version = "2024.3.0";
+  version = "2024.3.1";

  src = fetchFromGitHub {
    repo = "roadrunner";
    owner = "roadrunner-server";
    rev = "refs/tags/v${version}";
-    hash = "sha256-5HW2O1Eb1jivcUrDh+4FurexVkkmU6sa7weHt0UAICY=";
+    hash = "sha256-S5QDooao0PJkpu85xcHLhg/s3wyJUwhg/DSD4KITHyw=";
  };

  nativeBuildInputs = [
@@ -46,7 +46,7 @@ buildGoModule rec {
      --replace "127.0.0.1:0" "127.0.0.1:55554"
  '';

-  vendorHash = "sha256-4wIyuLjULNpYY8jkAMnmmFGOQ848z/1DOmWsLomNCa0=";
+  vendorHash = "sha256-xd2iJqONpjwHV0Zp8k6iXnDXdpaluMIE9o9E3MLFkrQ=";

  meta = {
    changelog = "https://github.com/roadrunner-server/roadrunner/blob/v${version}/CHANGELOG.md";
@@ -17,16 +17,16 @@
 rustPlatform.buildRustPackage rec {

  pname = "satty";
-  version = "0.14.0";
+  version = "0.15.0";

  src = fetchFromGitHub {
    owner = "gabm";
    repo = "Satty";
    rev = "v${version}";
-    hash = "sha256-+NIRWciQISbR8+agDJBH/aHFJ+yCkC6nNFtv+HprrRs=";
+    hash = "sha256-SfZgvCtociQ0JbUTDVlXZPLHbyG0oxSSUqNXBHMDYNU=";
  };

-  cargoHash = "sha256-1N45CNeawwcJ1jkkAViElqyCKD4VE7RZJWPQ9EnleGw=";
+  cargoHash = "sha256-OP19bIwRCqZdQUAvc6pTf0oTL7Jy+OUuVdnddrbxrys=";

  nativeBuildInputs = [
    copyDesktopItems
@@ -9,9 +9,9 @@

 buildGoModule rec {
  pname = "shiori";
-  version = "1.7.1";
+  version = "1.7.2";

-  vendorHash = "sha256-fakRqgoEcdzw9WZuubaxfGfvVrMvb8gV/IwPikMnfRQ=";
+  vendorHash = "sha256-RTnaDAl79LScbeKKAGJOI/YOiHEwwlxS2CmNhw80KL0=";

  doCheck = false;

@@ -19,7 +19,7 @@ buildGoModule rec {
    owner = "go-shiori";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-gMIpDiA5ncZ50WZ2Y57mScTEXzeObgZxP+nkWe+a8Eo=";
+    sha256 = "sha256-QNcMPeLq5L7Q+nmADWZnl4wV5oM6v+NZbAFsba2fKCk=";
  };

  ldflags = [
@@ -10,12 +10,12 @@

 buildGoModule rec {
  pname = "shopware-cli";
-  version = "0.4.61";
+  version = "0.4.62";
  src = fetchFromGitHub {
    repo = "shopware-cli";
    owner = "FriendsOfShopware";
    rev = version;
-    hash = "sha256-pvc5ZCB6RbaDJ6RigDmlurym/Rs8Jzu6gSKIod4k9PE=";
+    hash = "sha256-nFjm1z7QXuUkZ4sVRY0KdFpo0SXBTmJNA28YJpAyG2w=";
  };

  nativeBuildInputs = [
@@ -27,7 +27,7 @@ buildGoModule rec {
    dart-sass
  ];

-  vendorHash = "sha256-KFhMP8R3GnBY3GhJV57WR3zlDbCqDeLD0A5P4oR1ZMY=";
+  vendorHash = "sha256-7DVC68tKoEwaTbF6Lkv1Ib1imZojTPW3G/QS3W6N8ys=";

  postInstall = ''
    export HOME="$(mktemp -d)"
@@ -9,13 +9,13 @@

 buildGoModule rec {
  pname = "skeema";
-  version = "1.12.1";
+  version = "1.12.2";

  src = fetchFromGitHub {
    owner = "skeema";
    repo = "skeema";
    rev = "v${version}";
-    hash = "sha256-XA4Bi11XstL9tqQqv7t4toQN464n1CePM51VmaUIRaE=";
+    hash = "sha256-3oI/bedw2bCh8cNVO+V0CkpwwKiCc/nkVLwUaNWIckY=";
  };

  vendorHash = null;
@@ -11,13 +11,13 @@
 }:
 stdenv.mkDerivation rec {
  pname = "sqlitestudio";
-  version = "3.4.10";
+  version = "3.4.12";

  src = fetchFromGitHub {
    owner = "pawelsalawa";
    repo = "sqlitestudio";
    rev = version;
-    hash = "sha256-M0k+DpHXl0UA7uGRlAz3ksUk5qI2olz9dd+jmuBZuXU=";
+    hash = "sha256-KPHiJTAxRQ3ZNnkKpfj877vTHEPRKNwy7wHfseftukQ=";
  };

  nativeBuildInputs =
@@ -8,16 +8,16 @@

 buildGoModule rec {
  pname = "stackql";
-  version = "0.6.7";
+  version = "0.6.32";

  src = fetchFromGitHub {
    owner = "stackql";
    repo = "stackql";
    rev = "v${version}";
-    hash = "sha256-3L2r4U9jj6nougixlXLr+8zWiUuXtzJh8jcV7WsGNC0=";
+    hash = "sha256-7XpCbcOJ5t/ipBPgMVeP5ery/MFL90GuojMePJIczrs=";
  };

-  vendorHash = "sha256-PGd214wsEQPlglL9Znqog3cRSAaahkNRYekYcZK31C0=";
+  vendorHash = "sha256-eGpmA1MYiIn1LSbieMFvF7OYEtLBoN62X7CQMa35HT4=";

  ldflags = [
    "-s"
@@ -11,7 +11,7 @@

 stdenv.mkDerivation rec {
  pname = "structorizer";
-  version = "3.32-23";
+  version = "3.32-24";

  desktopItems = [
    (makeDesktopItem {
@@ -42,7 +42,7 @@ stdenv.mkDerivation rec {
    owner = "fesch";
    repo = "Structorizer.Desktop";
    rev = version;
-    hash = "sha256-fqvQH4DRl+R0laGOnfWgFz67JSAdUzrws4k7gmQ3S7A=";
+    hash = "sha256-bzo8lUdjCPf22AF++Q9YnvuQp89M2T1cLixuEDHWX6U=";
  };

  patches = [
@@ -115,7 +115,10 @@ stdenv.mkDerivation {
  # gcc-10. Otherwise build fails as:
  #   ld: acpi/xsdt.o:/build/syslinux-b404870/com32/gpllib/../gplinclude/memory.h:40: multiple definition of
  #     `e820_types'; memory.o:/build/syslinux-b404870/com32/gpllib/../gplinclude/memory.h:40: first defined here
-  env.NIX_CFLAGS_COMPILE = "-fcommon";
+  # and with gcc14+ also:
+  #  /build/source/com32/chain/chain.c:517:44:
+  #   error: passing argument 3 of 'loadfile' from incompatible pointer type
+  env.NIX_CFLAGS_COMPILE = "-fcommon -Wno-error=incompatible-pointer-types";

  makeFlags =
    [
@@ -15,17 +15,17 @@ rustPlatform.buildRustPackage rec {
  pname = "tinymist";
  # Please update the corresponding vscode extension when updating
  # this derivation.
-  version = "0.12.12";
+  version = "0.12.14";

  src = fetchFromGitHub {
    owner = "Myriad-Dreamin";
    repo = "tinymist";
    tag = "v${version}";
-    hash = "sha256-BpbfedfPpYRbqJQMCeZyeV8+XSuh39SXr+ZZqbZG6cc=";
+    hash = "sha256-F6nJH3JU8NxyxFevYMaQnPDTIcjcqM779CP4M1zp1rU=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-1e12A4jTjFxYN3q+4KrUcHN1pmCuK7N+bzTP0eSCoOg=";
+  cargoHash = "sha256-+Ce9qIETGFZXG4RX5GP8tpmH4fkpbPkDS1FX64NQ6/4=";

  nativeBuildInputs = [ pkg-config ];

@@ -73,7 +73,7 @@ rustPlatform.buildRustPackage rec {
  };

  meta = {
-    changelog = "https://github.com/Myriad-Dreamin/tinymist/blob/${src.tag}/CHANGELOG.md";
+    changelog = "https://github.com/Myriad-Dreamin/tinymist/blob/v${version}/CHANGELOG.md";
    description = "Tinymist is an integrated language service for Typst";
    homepage = "https://github.com/Myriad-Dreamin/tinymist";
    license = lib.licenses.asl20;
@@ -8,8 +8,8 @@ buildRubyGem rec {
  inherit ruby;
  name = "${gemName}-${version}";
  gemName = "tmuxinator";
-  version = "3.3.2";
-  source.sha256 = "sha256-q1VS4ChHVqIpHHO/fGANG5IjgwUfBT2VqT9WAkQeGh4=";
+  version = "3.3.3";
+  source.sha256 = "sha256-kT0S5I+x5qYKqMwSOQl1je1zfOPOj2KT8YvJc7jFp5A=";

  erubi = buildRubyGem rec {
    inherit ruby;
@@ -11,19 +11,19 @@

 buildGoModule rec {
  pname = "trivy";
-  version = "0.58.0";
+  version = "0.58.1";

  src = fetchFromGitHub {
    owner = "aquasecurity";
    repo = "trivy";
    rev = "refs/tags/v${version}";
-    hash = "sha256-V2xlvjja6183as4IJB8w+EZO6oQfB3qiOWP/DxlGVKg=";
+    hash = "sha256-YKeNIi6PBIfzd/Kuv5cgxeAEbqfFXWwmK9JTOBsRLsw=";
  };

  # Hash mismatch on across Linux and Darwin
  proxyVendor = true;

-  vendorHash = "sha256-U+iQiC8sr2UmSOAR5+YSEN54NR0RSWysnTmERr67wHQ=";
+  vendorHash = "sha256-e5tNyV5EHYlXS0EPvEEjHEOaH/jY8yQ8hT7vK8FOvkI=";

  subPackages = [ "cmd/trivy" ];

@@ -36,13 +36,13 @@

 stdenv.mkDerivation rec {
  pname = "tuba";
-  version = "0.9.0";
+  version = "0.9.1";

  src = fetchFromGitHub {
    owner = "GeopJr";
    repo = "Tuba";
    rev = "v${version}";
-    hash = "sha256-+Xw5mf1iLXvHMZsdpcANglsMOsebvHNOTuVRrXCqBOk=";
+    hash = "sha256-ouS/aGfjTLd88nWc5lJwYJ20ukzuXE+b7uZ4eMEsdSk=";
  };

  nativeBuildInputs = [
@@ -0,0 +1,178 @@
+{
+  fetchFromGitLab,
+  fetchpatch,
+  gitUpdater,
+  lib,
+  stdenv,
+  testers,
+  autoreconfHook,
+  dbus,
+  dbus-test-runner,
+  dpkg,
+  getopt,
+  glib,
+  gobject-introspection,
+  json-glib,
+  libgee,
+  perl,
+  pkg-config,
+  properties-cpp,
+  python3Packages,
+  vala,
+  wrapGAppsHook3,
+}:
+
+let
+  self = python3Packages.buildPythonApplication rec {
+    pname = "click";
+    version = "0.5.2";
+    format = "other";
+
+    src = fetchFromGitLab {
+      owner = "ubports";
+      repo = "development/core/click";
+      rev = version;
+      hash = "sha256-AV3n6tghvpV/6Ew6Lokf8QAGBIMbHFAnp6G4pefVn+8=";
+    };
+
+    patches = [
+      # Remove when version > 0.5.2
+      (fetchpatch {
+        name = "0001-click-fix-Wimplicit-function-declaration.patch";
+        url = "https://gitlab.com/ubports/development/core/click/-/commit/8f654978a12e6f9a0b6ff64296ec5565e3ff5cd0.patch";
+        hash = "sha256-kio+DdtuagUNYEosyQY3q3H+dJM3cLQRW9wUKUcpUTY=";
+      })
+
+      # Remove when version > 0.5.2
+      (fetchpatch {
+        name = "0002-click-Add-uid_t-and-gid_t-to-the-ctypes-_typemap.patch";
+        url = "https://gitlab.com/ubports/development/core/click/-/commit/cbcd23b08b02fa122434e1edd69c2b3dcb6a8793.patch";
+        hash = "sha256-QaWRhxO61wAzULVqPLdJrLuBCr3+NhKmQlEPuYq843I=";
+      })
+    ];
+
+    postPatch = ''
+      # These should be proper Requires, using the header needs their headers
+      substituteInPlace lib/click/click-*.pc.in \
+        --replace-fail 'Requires.private' 'Requires'
+
+      # Don't completely override PKG_CONFIG_PATH
+      substituteInPlace click_package/tests/Makefile.am \
+        --replace-fail 'PKG_CONFIG_PATH=$(top_builddir)/lib/click' 'PKG_CONFIG_PATH=$(top_builddir)/lib/click:$(PKG_CONFIG_PATH)'
+
+      patchShebangs bin/click
+    '';
+
+    strictDeps = true;
+
+    pkgsBuildBuild = [
+      pkg-config
+    ];
+
+    nativeBuildInputs = [
+      autoreconfHook
+      dbus-test-runner # Always checking for this
+      getopt
+      gobject-introspection
+      perl
+      pkg-config
+      vala
+      wrapGAppsHook3
+    ];
+
+    buildInputs = [
+      glib
+      json-glib
+      libgee
+      properties-cpp
+    ];
+
+    propagatedBuildInputs = with python3Packages; [
+      python-debian
+      pygobject3
+      setuptools
+    ];
+
+    nativeCheckInputs = [
+      dbus
+      dpkg
+      python3Packages.unittestCheckHook
+    ];
+
+    checkInputs = with python3Packages; [
+      python-apt
+      six
+    ];
+
+    preConfigure = ''
+      export click_cv_perl_vendorlib=$out/${perl.libPrefix}
+      export PYTHON_INSTALL_FLAGS="--prefix=$out"
+    '';
+
+    configureFlags = [
+      "--with-systemdsystemunitdir=${placeholder "out"}/lib/systemd/system"
+      "--with-systemduserunitdir=${placeholder "out"}/lib/systemd/user"
+    ];
+
+    enableParallelBuilding = true;
+
+    doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
+
+    disabledTestPaths = [
+      # From apt: Unable to determine a suitable packaging system type
+      "click_package/tests/integration/test_signatures.py"
+      "click_package/tests/test_build.py"
+      "click_package/tests/test_install.py"
+      "click_package/tests/test_scripts.py"
+    ];
+
+    preCheck = ''
+      export HOME=$TMP
+
+      # tests recompile some files for loaded predefines, doesn't use any optimisation level for it
+      # makes test output harder to read, so make the warning go away
+      export NIX_CFLAGS_COMPILE+=" -U_FORTIFY_SOURCE"
+
+      # Haven'tbeen able to get them excluded via disabledTest{s,Paths}, just deleting them
+      for path in $disabledTestPaths; do
+        rm -v $path
+      done
+    '';
+
+    preFixup = ''
+      makeWrapperArgs+=(
+        --prefix LD_LIBRARY_PATH : "$out/lib"
+      )
+    '';
+
+    passthru = {
+      updateScript = gitUpdater { };
+    };
+
+    meta = {
+      description = "Tool to build click packages, mainly used for Ubuntu Touch";
+      homepage = "https://gitlab.com/ubports/development/core/click";
+      changelog = "https://gitlab.com/ubports/development/core/click/-/blob/${version}/ChangeLog";
+      license = lib.licenses.gpl3Only;
+      mainProgram = "click";
+      maintainers =
+        with lib.maintainers;
+        [
+          ilyakooo0
+        ]
+        ++ lib.teams.lomiri.members;
+      platforms = lib.platforms.linux;
+      pkgConfigModules = [
+        "click-0.4"
+      ];
+    };
+  };
+in
+self
+// {
+  passthru = self.passthru // {
+    tests.pkg-config = testers.hasPkgConfigModules {
+      package = self;
+    };
+  };
+}
@@ -0,0 +1,51 @@
+{
+  lib,
+  fetchFromGitHub,
+  python3Packages,
+  waymore,
+  testers,
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "waymore";
+  version = "4.7";
+
+  src = fetchFromGitHub {
+    owner = "xnl-h4ck3r";
+    repo = "waymore";
+    tag = "v${version}";
+    hash = "sha256-oaswuXQPdAl2XExwEWnSN15roqNj9OVUr1Y1vsX461o=";
+  };
+
+  preBuild = ''
+    export HOME=$(mktemp -d)
+  '';
+
+  build-system = with python3Packages; [
+    setuptools
+  ];
+
+  dependencies = with python3Packages; [
+    requests
+    termcolor
+    pyyaml
+    psutil
+    uritools
+    tldextract
+  ];
+
+  passthru.tests.version = testers.testVersion {
+    package = waymore;
+    command = "waymore --version";
+    version = "Waymore - v${version}";
+  };
+
+  meta = {
+    description = "Find way more from the Wayback Machine";
+    homepage = "https://github.com/xnl-h4ck3r/waymore";
+    changelog = "https://github.com/xnl-h4ck3r/waymore/releases/tag/v${version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ genga898 ];
+    mainProgram = "waymore";
+  };
+}
@@ -6,14 +6,14 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "yaralyzer";
-  version = "0.9.5";
+  version = "0.9.6";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "michelcrypt4d4mus";
    repo = "yaralyzer";
    tag = "v${version}";
-    hash = "sha256-A9JFUaBG4SwOkYPo/1p1i6mA47PyKiT+ngEYlfYAAE8=";
+    hash = "sha256-P2bpwdKbMEoa40RNu8TfbDlRsksEJlYfPiAo9jrXuoE=";
  };

  pythonRelaxDeps = [
@@ -17,13 +17,13 @@ python3Packages.buildPythonApplication rec {
  # The websites yt-dlp deals with are a very moving target. That means that
  # downloads break constantly. Because of that, updates should always be backported
  # to the latest stable release.
-  version = "2024.12.13";
+  version = "2024.12.23";
  pyproject = true;

  src = fetchPypi {
    inherit version;
    pname = "yt_dlp";
-    hash = "sha256-d+Fa+51GDstylKObteOdyfTopl86N+9NtYgAuU0JVRE=";
+    hash = "sha256-rA5ytakBe6EEtCWFRiAafO3DjovSByfgxjt3yCm0Jek=";
  };

  build-system = with python3Packages; [
@@ -98,8 +98,8 @@ python3Packages.buildPythonApplication rec {
    changelog = "https://github.com/yt-dlp/yt-dlp/blob/HEAD/Changelog.md";
    license = licenses.unlicense;
    maintainers = with maintainers; [
-      mkg20001
      SuperSandro2000
+      donteatoreo
    ];
    mainProgram = "yt-dlp";
  };
@@ -18,7 +18,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "yubico-piv-tool";
-  version = "2.6.1";
+  version = "2.7.1";

  outputs = [
    "out"
@@ -30,7 +30,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "Yubico";
    repo = "yubico-piv-tool";
    rev = "refs/tags/yubico-piv-tool-${finalAttrs.version}";
-    hash = "sha256-RYT/kBlUfVkJG8RNELVQ5gyC+HDteD5xqaI479nsvKw=";
+    hash = "sha256-ow9SS7YGCZzSxds3WKsHx9/Vxloy9RqvDjpIBJUBSb0=";
  };

  postPatch = ''
@@ -16,13 +16,13 @@

 stdenv.mkDerivation rec {
  pname = "deepin-editor";
-  version = "6.5.2";
+  version = "6.5.8";

  src = fetchFromGitHub {
    owner = "linuxdeepin";
    repo = pname;
    rev = version;
-    hash = "sha256-Z3fsnjo4Pcu1e8lKvWdWBhpoOFFy0dSrI2HehRYKJ0k=";
+    hash = "sha256-QMq7DIggMhY4EseIa7/tvgxGwZn07OitOm1YjrzMFHg=";
  };

  nativeBuildInputs = [
@@ -50,11 +50,6 @@ rebar3Relx {
  releaseType = "escript";
  beamDeps = builtins.attrValues deps;

-  # https://github.com/erlang-ls/erlang_ls/issues/1429
-  postPatch = ''
-    rm apps/els_lsp/test/els_diagnostics_SUITE.erl
-  '';
-
  buildPlugins = [ rebar3-proper ];
  buildPhase = "HOME=. make";
  # based on https://github.com/erlang-ls/erlang_ls/blob/main/.github/workflows/build.yml
@@ -76,7 +71,7 @@ rebar3Relx {
  };
  passthru.updateScript = writeScript "update.sh" ''
    #!/usr/bin/env nix-shell
-    #! nix-shell -i bash -p common-updater-scripts coreutils git gnused gnutar gzip "rebar3WithPlugins { globalPlugins = [ beamPackages.rebar3-nix ]; }"
+    #! nix-shell -i bash -p common-updater-scripts coreutils git gnused gnutar gzip nixfmt-rfc-style "rebar3WithPlugins { globalPlugins = [ beamPackages.rebar3-nix ]; }"

    set -ox errexit
    latest=$(list-git-tags | sed -n '/[\d\.]\+/p' | sort -V | tail -1)
@@ -88,6 +83,7 @@ rebar3Relx {
      cp -R $(nix-build $nixpkgs --no-out-link -A erlang-ls.src)/* "$tmpdir"
      DEBUG=1
      (cd "$tmpdir" && HOME=. rebar3 as test nix lock -o "$nix_path/rebar-deps.nix")
+      nixfmt "$nix_path/rebar-deps.nix"
    else
      echo "erlang-ls is already up-to-date"
    fi
@@ -2,8 +2,8 @@

 buildHex {
  name = "pc";
-  version = "1.12.0";
-  sha256 = "1gdvixy4j560qjdiv5qjgnl5wl3rrn231dv1m4vdq4b9l4g4p27x";
+  version = "1.15.0";
+  sha256 = "sha256-TA+tT2Q3yuNT1RfaIY/ng0e4/6RLmBeIdJTKquVFlbM=";

  meta = {
    description = "Rebar3 port compiler for native code";
@@ -2,6 +2,12 @@
  lib,
  idris2Packages,
  fetchFromGitHub,
+  clang,
+  chez,
+  gmp,
+  zsh,
+  makeBinaryWrapper,
+  stdenv,
 }:
 let
  inherit (idris2Packages) idris2Api buildIdris;
@@ -42,6 +48,28 @@ let
      filepath
    ];

+    nativeBuildInputs = [ makeBinaryWrapper ];
+
+    buildInputs = [
+      gmp
+      clang
+      chez
+    ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ zsh ];
+
+    postInstall = ''
+      wrapProgram $out/bin/pack \
+        --suffix C_INCLUDE_PATH : ${lib.makeIncludePath [ gmp ]} \
+        --suffix PATH : ${
+          lib.makeBinPath (
+            [
+              clang
+              chez
+            ]
+            ++ lib.optionals stdenv.hostPlatform.isDarwin [ zsh ]
+          )
+        }
+    '';
+
    meta = {
      description = "An Idris2 Package Manager with Curated Package Collections";
      mainProgram = "pack";
@@ -74,10 +74,20 @@ stdenv.mkDerivation rec {
        --replace 'find_program( LLVM_SPIRV llvm-spirv PATHS ''${LLVM_TOOLS_BINARY_DIR} NO_DEFAULT_PATH )' \
                  'find_program( LLVM_SPIRV llvm-spirv PATHS "${spirv-llvm-translator}/bin" NO_DEFAULT_PATH )'
    ''
-    + lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) ''
-      substituteInPlace CMakeLists.txt \
-        --replace 'COMMAND prepare_builtins' 'COMMAND ${buildLlvmTools.libclc.dev}/bin/prepare_builtins'
-    '';
+    + lib.optionalString (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) (
+      if (lib.versionOlder release_version "19") then
+        ''
+          substituteInPlace CMakeLists.txt \
+            --replace 'COMMAND prepare_builtins' \
+                      'COMMAND ${buildLlvmTools.libclc.dev}/bin/prepare_builtins'
+        ''
+      else
+        ''
+          substituteInPlace CMakeLists.txt \
+            --replace-fail 'set( prepare_builtins_exe prepare_builtins )' \
+                           'set( prepare_builtins_exe ${buildLlvmTools.libclc.dev}/bin/prepare_builtins )'
+        ''
+    );

  nativeBuildInputs =
    [
@@ -1,5 +1,4 @@
 {
-  pkgs,
  lib,
  stdenv,
  fetchFromGitHub,
@@ -32,6 +31,7 @@
  coreutils,
  git,
  wrapGAppsHook3,
+  zlib,
 }:
 {
  baseName ? "erlang",
@@ -144,20 +144,12 @@ stdenv.mkDerivation (
      [
        ncurses
        opensslPackage
+        zlib
      ]
      ++ optionals wxSupport wxPackages2
      ++ optionals odbcSupport odbcPackages
      ++ optionals javacSupport javacPackages
-      ++ optional systemdSupport systemd
-      ++ optionals stdenv.hostPlatform.isDarwin (
-        with pkgs.darwin.apple_sdk.frameworks;
-        [
-          AGL
-          Carbon
-          Cocoa
-          WebKit
-        ]
-      );
+      ++ optional systemdSupport systemd;

    debugInfo = enableDebugInfo;

@@ -322,7 +322,6 @@ stdenv.mkDerivation rec {
      lgpl3Plus
    ];
    maintainers = with maintainers; [
-      milahu
      nickcao
      LunNova
    ];
@@ -66,6 +66,7 @@
  bootstrap_cmds,
  cctools,
  xcbuild,
+  fetchpatch,
 }:

 qtModule {
@@ -114,6 +115,15 @@ qtModule {

    # Override locales install path so they go to QtWebEngine's $out
    ./locales-path.patch
+
+    # Fix build of vendored xnnpack on aarch64/gcc14
+    # FIXME: remove when upstream updates
+    (fetchpatch {
+      url = "https://github.com/google/XNNPACK/commit/1b11a8b0620afe8c047304273674c4c57c289755.patch";
+      stripLen = 1;
+      extraPrefix = "src/3rdparty/chromium/third_party/xnnpack/src/";
+      hash = "sha256-GUESVNR88I1K2V5xr0e09ec4j2eselMhNN06+PCcINM=";
+    })
  ];

  postPatch =
@@ -66,7 +66,6 @@ stdenv.mkDerivation (
        lgpl3Plus
      ];
      maintainers = with maintainers; [
-        milahu
        nickcao
      ];
      platforms = platforms.unix;
@@ -9,7 +9,7 @@

 buildPythonPackage rec {
  pname = "amaranth-boards";
-  version = "0-unstable-2024-10-18";
+  version = "0-unstable-2024-12-21";
  pyproject = true;
  # from `pdm show`
  realVersion =
@@ -22,10 +22,10 @@ buildPythonPackage rec {
  src = fetchFromGitHub {
    owner = "amaranth-lang";
    repo = "amaranth-boards";
-    rev = "23c66d68045831de0a372c8c237274d74c71ef4e";
+    rev = "9d97c4816288c9c2cc304d9280c2c63178d50d2f";
    # these files change depending on git branch status
    postFetch = "rm -f $out/.git_archival.txt $out/.gitattributes";
-    hash = "sha256-cC7uvj9+6h3RPbFdu3/T1t/jhw5CuLOF8aKwDSkRE54=";
+    hash = "sha256-c+LUWNik95PO5oPM/Bjdxu8j9TD2Q8YSGtdNq1E+i4o=";
  };

  build-system = [ pdm-backend ];
@@ -22,14 +22,14 @@

 buildPythonPackage rec {
  pname = "apprise";
-  version = "1.9.0";
+  version = "1.9.1";
  pyproject = true;

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-tck6/WMxr+S2OlXRzqkHbke+y0uom1YrGBwT4luwx9Y=";
+    hash = "sha256-eezQLEHYbf/SEbs1zFwGyEbndwQavh0HAfmJmA3kRok=";
  };

  nativeBuildInputs = [ installShellFiles ];
@@ -21,7 +21,7 @@

 buildPythonPackage rec {
  pname = "appthreat-vulnerability-db";
-  version = "6.2.2";
+  version = "6.2.3";
  pyproject = true;

  disabled = pythonOlder "3.10";
@@ -30,7 +30,7 @@ buildPythonPackage rec {
    owner = "AppThreat";
    repo = "vulnerability-db";
    tag = "v${version}";
-    hash = "sha256-VeYA5zO9QWScf3/sekTzHCIObK8FLQtAoNVEgmO88gk=";
+    hash = "sha256-NCuwKRiI3BaVwjYsarwJZR/JU0wX16qvScLBb2eYypI=";
  };

  pythonRelaxDeps = [
@@ -20,7 +20,7 @@ buildPythonPackage rec {
    owner = "jsbronder";
    repo = "asyncio-dgram";
    rev = "refs/tags/v${version}";
-    hash = "sha256-Eb/9JtgPT2yOlfnn5Ox8M0kcQhSlRCuX8+Rq6amki8Q=";
+    hash = "sha256-9aO3xFmoR74uZSzxBPRVvz0QSW15TAdWEszLBX8AUR4=";
  };

  build-system = [ setuptools ];
@@ -64,6 +64,11 @@ buildPythonPackage rec {
    hash = "sha256-RGRwgrDFe+0v8NYyajMikdoi1DQf1I+B5y8KJyF+cZs=";
  };

+  patches = [
+    # https://github.com/pallets-eco/flask-security/pull/1040
+    ./fix_test_basic.patch
+  ];
+
  build-system = [ flit-core ];

  # flask-login>=0.6.2 not satisfied by version 0.7.0.dev0
@@ -0,0 +1,13 @@
+diff --git a/tests/test_basic.py b/tests/test_basic.py
+index d52be429..09dfa8e4 100644
+--- a/tests/test_basic.py
+++ b/tests/test_basic.py
+@@ -157,6 +157,8 @@ def test_authenticate_with_subdomain_next(app, client, get_message):
+ 
+ @pytest.mark.settings(subdomain="auth")
+ def test_authenticate_with_root_domain_next(app, client, get_message):
+    # As of Flask 3.1 this must be explicitly set.
+    app.subdomain_matching = True
+     app.config["SERVER_NAME"] = "lp.com"
+     app.config["SECURITY_REDIRECT_ALLOW_SUBDOMAINS"] = True
+     data = dict(email="matt@lp.com", password="password")
@@ -13,14 +13,14 @@

 buildPythonPackage rec {
  pname = "garth";
-  version = "0.5.1";
+  version = "0.5.2";
  pyproject = true;

  disabled = pythonOlder "3.10";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-cM3fYsNVs27laJuDDzLTZgaVS0NrMnB599Xc6IpUO6M=";
+    hash = "sha256-WUrK/ieYnao/+8hGDK8GOAI1nGsfQMmP/Tsh9prcbgk=";
  };

  pythonRelaxDeps = [ "requests-oauthlib" ];
@@ -15,14 +15,14 @@

 buildPythonPackage rec {
  pname = "httpx-oauth";
-  version = "0.16.0";
+  version = "0.16.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "frankie567";
    repo = "httpx-oauth";
    tag = "v${version}";
-    hash = "sha256-KM+GaBC3jOhMsTVdUixsEjm47j28qeFmFKbI7fnVSG4=";
+    hash = "sha256-/2IBAEZrK0Do7t9g+MWsKuIlcg0ANCfOoagVwTbBso8=";
  };

  build-system = [
@@ -3,31 +3,34 @@
  asyncio-dgram,
  buildPythonPackage,
  fetchFromGitHub,
-  netifaces,
+  hatchling,
+  ifaddr,
+  pytestCheckHook,
  pythonOlder,
 }:

 buildPythonPackage rec {
  pname = "keba-kecontact";
-  version = "3.0.3";
-  format = "setuptools";
+  version = "4.0.2";
+  pyproject = true;

-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.11";

  src = fetchFromGitHub {
    owner = "dannerph";
    repo = "keba-kecontact";
    rev = "refs/tags/${version}";
-    hash = "sha256-gR1ut2IjrU/JMy8/ZFv0jQTB6c3A/tZqtXMpQsapuj0=";
+    hash = "sha256-HzfoWijsrtDNElqyxWB7f07OTMIoS/fEjmdX59G+Hw0=";
  };

-  propagatedBuildInputs = [
+  build-system = [ hatchling ];
+
+  dependencies = [
    asyncio-dgram
-    netifaces
+    ifaddr
  ];

-  # Module has no tests
-  doCheck = false;
+  nativeCheckInputs = [ pytestCheckHook ];

  pythonImportsCheck = [ "keba_kecontact" ];

@@ -49,14 +49,14 @@

 buildPythonPackage rec {
  pname = "kserve";
-  version = "0.14.0";
+  version = "0.14.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "kserve";
    repo = "kserve";
-    rev = "refs/tags/v${version}";
-    hash = "sha256-N/IgiTiyBNw7WQWxcUJlXU+Q9o3UUaduD9ZBKwu0uRE=";
+    tag = "v${version}";
+    hash = "sha256-VwuUXANjshV4fN0i54Fs0zubHY81UtQcCV14JwMpXwA=";
  };

  sourceRoot = "${src.name}/python/kserve";
@@ -64,6 +64,7 @@ buildPythonPackage rec {
  pythonRelaxDeps = [
    "fastapi"
    "httpx"
+    "numpy"
    "prometheus-client"
    "protobuf"
    "uvicorn"
@@ -12,12 +12,12 @@

 buildPythonPackage rec {
  pname = "libuuu";
-  version = "1.5.182";
+  version = "1.5.182.post1";
  pyproject = true;

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-k6JwGxYeFbGNl7zcuKN6SbRq8Z4yD1dXXL3ORyGqhYE=";
+    hash = "sha256-Hf0GwhrzKQL5w+OXQ39yuG4xmbk/1HgCCdCulIORSU8=";
  };

  build-system = [
@@ -454,12 +454,12 @@ rec {
      "sha256-0Xe77fz+lA+nuUGK+PjU0EgWeQ7AJ9Smsb/4yK1tow0=";

  mypy-boto3-ecr =
-    buildMypyBoto3Package "ecr" "1.35.21"
-      "sha256-1+jCQIbOOyWeSsKicfw07U7/3pnHiZrH1kwto8/wrNc=";
+    buildMypyBoto3Package "ecr" "1.35.87"
+      "sha256-XK9Q9fz05sI6XqO1BfGaZihfQhHssXgCf0GJONOBym8=";

  mypy-boto3-ecr-public =
-    buildMypyBoto3Package "ecr-public" "1.35.0"
-      "sha256-KXtN44KAIDXjMgv3ICG8rXYfEjcZ85pQ+qdvN2Yiq3g=";
+    buildMypyBoto3Package "ecr-public" "1.35.87"
+      "sha256-MvEGV9hSLsWPC+FoBH3K2F+DXvoeTSYfwE92QDp7ufU=";

  mypy-boto3-ecs =
    buildMypyBoto3Package "ecs" "1.35.83"
@@ -470,8 +470,8 @@ rec {
      "sha256-Pf+g7g5cjPoIqAL5sJqqMtPWU0hqGDQnfzwoxNgL5OE=";

  mypy-boto3-eks =
-    buildMypyBoto3Package "eks" "1.35.86"
-      "sha256-dlAVnQiIkab9aVOQ5OO8D4XJI6+CWWJvjQpnOp88vT4=";
+    buildMypyBoto3Package "eks" "1.35.87"
+      "sha256-GhuxfL16FBXbuMoj1OY3dv+tHGAkq9aUn7rTJm9iY1g=";

  mypy-boto3-elastic-inference =
    buildMypyBoto3Package "elastic-inference" "1.35.38"
@@ -574,8 +574,8 @@ rec {
      "sha256-RJEZBr3yU/lGEainrpidLsdYBvVOPMq3cIaIpsTAziQ=";

  mypy-boto3-glue =
-    buildMypyBoto3Package "glue" "1.35.80"
-      "sha256-49t5o9j5sEKGEBoGQibQTgNl4Ab07VggRFFtg1jvAWY=";
+    buildMypyBoto3Package "glue" "1.35.87"
+      "sha256-0dXxu1xSlwRaGmUKZnLEajGePPNzCF0jA8IXncW0bX0=";

  mypy-boto3-grafana =
    buildMypyBoto3Package "grafana" "1.35.0"
@@ -11,12 +11,12 @@

 buildPythonPackage rec {
  pname = "oslo.context";
-  version = "5.6.0";
+  version = "5.7.0";
  pyproject = true;

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-UiLDJja+BwojDfnTFBoLJ6lfCjtpePTBSFvK2kekw8s=";
+    hash = "sha256-OYxGC5z3yzl+3nliIj5LiAePsvvFNmWkejThsoiQ9M4=";
  };

  postPatch = ''
@@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "pyexploitdb";
-  version = "0.2.59";
+  version = "0.2.60";
  pyproject = true;

  disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    pname = "pyExploitDb";
    inherit version;
-    hash = "sha256-E6XMXgHB3q03ZeCjxctKvSndfgfdXhTns7csqQju2BM=";
+    hash = "sha256-+EuTIt7WVlywG6JkEWMOhHMJuPcsqjpxlS7HgH8NCPU=";
  };

  build-system = [ setuptools ];
@@ -1,49 +1,44 @@
 {
-  stdenv,
  lib,
-  substituteAll,
-  fetchpatch,
-  fetchFromGitHub,
+  stdenv,
  buildPythonPackage,
-  pythonOlder,
+  fetchFromGitHub,
+  substituteAll,
+  fontconfig,
+  python,

  # build-system
  cython,
  setuptools,
+
+  # nativeBuildInputs
+  SDL2,
  pkg-config,

-  # native dependencies
-  AppKit,
-  fontconfig,
+  # buildInputs
  freetype,
  libjpeg,
  libpng,
  libX11,
  portmidi,
-  SDL2,
  SDL2_image,
  SDL2_mixer,
  SDL2_ttf,
-
-  # tests
-  python,
 }:

 buildPythonPackage rec {
  pname = "pygame";
-  version = "2.6.0";
+  version = "2.6.1";
  pyproject = true;

-  disabled = pythonOlder "3.6";
-
  src = fetchFromGitHub {
-    owner = pname;
-    repo = pname;
-    rev = "refs/tags/${version}";
+    owner = "pygame";
+    repo = "pygame";
+    tag = version;
    # Unicode file names lead to different checksums on HFS+ vs. other
    # filesystems because of unicode normalisation. The documentation
    # has such files and will be removed.
-    hash = "sha256-wNXcmH0IIuAOoomIdmhAPxe4TiEzes3Kq+Vth2r4/IA=";
+    hash = "sha256-paSDF0oPogq0g0HSDRagGu0OfsqIku6q4GGAMveGntk=";
    postFetch = "rm -rf $out/docs/reST";
  };

@@ -76,13 +71,16 @@ buildPythonPackage rec {
      --replace-fail /usr/X11/bin/fc-list ${fontconfig}/bin/fc-list
  '';

-  nativeBuildInputs = [
+  build-system = [
    cython
-    pkg-config
-    SDL2
    setuptools
  ];

+  nativeBuildInputs = [
+    SDL2
+    pkg-config
+  ];
+
  buildInputs = [
    freetype
    libjpeg
@@ -93,7 +91,7 @@ buildPythonPackage rec {
    SDL2_image
    SDL2_mixer
    SDL2_ttf
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ AppKit ];
+  ];

  preConfigure = ''
    ${python.pythonOnBuildForHost.interpreter} buildconfig/config.py
@@ -110,17 +108,20 @@ buildPythonPackage rec {
    export SDL_VIDEODRIVER=dummy
    export SDL_AUDIODRIVER=disk

-    ${python.interpreter} -m pygame.tests -v --exclude opengl,timing --time_out 300
+    ${python.interpreter} -m pygame.tests -v \
+      --exclude opengl,timing \
+      --time_out 300

    runHook postCheck
  '';
  pythonImportsCheck = [ "pygame" ];

-  meta = with lib; {
+  meta = {
    description = "Python library for games";
    homepage = "https://www.pygame.org/";
-    license = licenses.lgpl21Plus;
-    maintainers = with maintainers; [ emilytrau ];
-    platforms = platforms.unix;
+    changelog = "https://github.com/pygame/pygame/releases/tag/${src.tag}";
+    license = lib.licenses.lgpl21Plus;
+    maintainers = with lib.maintainers; [ emilytrau ];
+    platforms = lib.platforms.unix;
  };
 }
@@ -12,16 +12,16 @@

 buildPythonPackage rec {
  pname = "pypck";
-  version = "0.7.24";
+  version = "0.8.1";
  pyproject = true;

-  disabled = pythonOlder "3.9";
+  disabled = pythonOlder "3.11";

  src = fetchFromGitHub {
    owner = "alengwenus";
    repo = "pypck";
    rev = "refs/tags/${version}";
-    hash = "sha256-DWdQUnURL3WBi916vOTawtBqq+SHTu4iLViGczwAWQE=";
+    hash = "sha256-O0hRfSUJwn/xW+xJ2zD/Z8bb1G42n8UGIKHzLkl9n5M=";
  };

  postPatch = ''
@@ -48,7 +48,7 @@ buildPythonPackage rec {
    description = "LCN-PCK library written in Python";
    homepage = "https://github.com/alengwenus/pypck";
    changelog = "https://github.com/alengwenus/pypck/releases/tag/${version}";
-    license = with licenses; [ epl20 ];
+    license = licenses.epl20;
    maintainers = with maintainers; [ fab ];
  };
 }
@@ -11,7 +11,7 @@

 buildPythonPackage rec {
  pname = "pystache";
-  version = "0.6.6";
+  version = "0.6.7";
  pyproject = true;

  disabled = pythonOlder "3.8";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
    owner = "PennyDreadfulMTG";
    repo = "pystache";
    tag = "v${version}";
-    hash = "sha256-E6y7r68mfXVoNgsTBqyo561dVOjq1fL73SqSFM32oeQ=";
+    hash = "sha256-kfR3ZXbrCDrIVOh4bcOTXqg9D56YQrIyV0NthStga5U=";
  };

  build-system = [
--- a/Show More
+++ b/Show More