Merge staging-next into staging

2026-05-28 18:54:19 +00:00
parent 94520475ea ec819f00ba
commit f50dc660d4
118 changed files with 2181 additions and 1847 deletions
@@ -575,6 +575,13 @@ lib.mapAttrs mkLicense (
      free = false;
    };

+    enpl = {
+      fullName = "Emmi AI Non-Production License";
+      url = "https://github.com/Emmi-AI/noether/blob/main/LICENSE.txt";
+      free = false;
+      redistributable = true;
+    };
+
    epl10 = {
      spdxId = "EPL-1.0";
      fullName = "Eclipse Public License 1.0";
@@ -1158,8 +1158,10 @@ let
      value = if opt ? apply then opt.apply res.mergedValue else res.mergedValue;

      warnDeprecation =
-        warnIf (opt.type.deprecationMessage != null)
-          "The type `types.${opt.type.name}' of option `${showOption loc}' defined in ${showFiles opt.declarations} is deprecated. ${opt.type.deprecationMessage}";
+        if (opt.type.deprecationMessage != null) then
+          warn "The type `types.${opt.type.name}' of option `${showOption loc}' defined in ${showFiles opt.declarations} is deprecated. ${opt.type.deprecationMessage}"
+        else
+          x: x;

    in
    warnDeprecation opt
@@ -25663,12 +25663,6 @@
    githubId = 216167;
    name = "Steve Jones";
  };
-  sjmackenzie = {
-    email = "setori88@gmail.com";
-    github = "sjmackenzie";
-    githubId = 158321;
-    name = "Stewart Mackenzie";
-  };
  skaphi = {
    name = "Oskar Philipsson";
    email = "oskar.philipsson@gmail.com";
@@ -93,6 +93,7 @@ in
    systemd.services.bird = {
      description = "BIRD Internet Routing Daemon";
      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" ];
      reloadTriggers = lib.optional cfg.autoReload config.environment.etc."bird/bird.conf".source;
      serviceConfig = {
        Type = "forking";
@@ -166,7 +166,6 @@ in
        SystemCallErrorNumber = "EPERM";
        ProtectProc = "invisible";
        ProtectHostname = true;
-        ProcSubset = "pid";
        WorkingDirectory = "/tmp";
      };
    };
@@ -3,7 +3,6 @@
  stdenv,
  fetchFromGitHub,
  fetchNpmDeps,
-  nodejs,
  nodejs-slim,
  npmHooks,
  pkg-config,
@@ -38,7 +37,8 @@ let
      libsecret
    ];
    nativeBuildInputs = [
-      nodejs
+      nodejs-slim
+      nodejs-slim.npm
      nodejs-slim.python
      npmHooks.npmConfigHook
    ]
@@ -4,7 +4,6 @@
  fetchFromGitHub,
  fetchNpmDeps,
  libsecret,
-  nodejs,
  nodejs-slim,
  npmHooks,
  pkg-config,
@@ -37,7 +36,8 @@ let
    ];

    nativeBuildInputs = [
-      nodejs
+      nodejs-slim
+      nodejs-slim.npm
      nodejs-slim.python
      npmHooks.npmConfigHook
    ]
@@ -151,9 +151,9 @@ rec {

  unstable = fetchurl rec {
    # NOTE: Don't forget to change the hash for staging as well.
-    version = "11.8";
+    version = "11.9";
    url = "https://dl.winehq.org/wine/source/11.x/wine-${version}.tar.xz";
-    hash = "sha256-U6qFmV1Ll/ARahxWuKahQXcw71mid4GdLT0xNk6lVrA=";
+    hash = "sha256-45zBjbKHNYokNvivSYvtx+RE1V65nvVFtg53i7TqD28=";

    patches = [
      # Also look for root certificates at $NIX_SSL_CERT_FILE
@@ -163,7 +163,7 @@ rec {
    # see https://gitlab.winehq.org/wine/wine-staging
    staging = fetchFromGitLab {
      inherit version;
-      hash = "sha256-lW5dfCfsB+z84mlLpfmkR7QDxmhL+RcBufSftUutHto=";
+      hash = "sha256-IQSu/Nr3JynVv95/jaZCZrCQWKE8/pp9JGEwfmDdI9s=";
      domain = "gitlab.winehq.org";
      owner = "wine";
      repo = "wine-staging";
@@ -186,9 +186,9 @@ rec {

    ## see http://wiki.winehq.org/Mono
    mono = fetchurl rec {
-      version = "11.0.0";
+      version = "11.1.0";
      url = "https://dl.winehq.org/wine/wine-mono/${version}/wine-mono-${version}-x86.msi";
-      hash = "sha256-1+/t4Lm9z1ITT4zWztWdn+zpdvcLEaQAvbR7hkVpzSc=";
+      hash = "sha256-3rA0FDH4Jgsgn/9rx53cxUFLl/jpI2q5+9ykzlngqbk=";
    };

    updateScript = writeShellScript "update-wine-unstable" ''
@@ -367,6 +367,7 @@ stdenv.mkDerivation (finalAttrs: {
  meta = {
    description = "GNU Image Manipulation Program";
    homepage = "https://www.gimp.org/";
+    donationPage = "https://www.gimp.org/donating/";
    maintainers = with lib.maintainers; [ jtojnar ];
    license = lib.licenses.gpl3Plus;
    platforms = lib.platforms.linux;
@@ -1,10 +1,10 @@
 {
  "chromium": {
-    "version": "148.0.7778.178",
+    "version": "148.0.7778.215",
    "chromedriver": {
-      "version": "148.0.7778.179",
-      "hash_darwin": "sha256-jDw+ON0X8rePW1HLBZ5FVKMibImBuW/Tp0EDZ/UjJlw=",
-      "hash_darwin_aarch64": "sha256-hNaaKMVy8sKNU444Uf78YI3ayUATrTBAr6/7Z3jewv0="
+      "version": "148.0.7778.216",
+      "hash_darwin": "sha256-gsK7Q3rwfQQ0iE5e/st/3gGtU+D8dGsTycffpEejmhw=",
+      "hash_darwin_aarch64": "sha256-zHASbRPnYf2q1qq8FsKnYrLwPjzoGk0tzLxB9SdTXFw="
    },
    "deps": {
      "depot_tools": {
@@ -21,8 +21,8 @@
    "DEPS": {
      "src": {
        "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "d096af1c9e98c45c3596e59620622b1a049bfecb",
-        "hash": "sha256-XRalekzeALnDh9KiGqhYdhXvkGkjO3TOIZeqwpPLO+U=",
+        "rev": "7c855c70efe3f6ade6663c1520913fa7f63a0b2b",
+        "hash": "sha256-uDVYgSjxQ+xw8DHVd5UNkqnUrJ6P5ZWxL2tZToBhgQg=",
        "recompress": true
      },
      "src/third_party/clang-format/script": {
@@ -92,8 +92,8 @@
      },
      "src/third_party/angle": {
        "url": "https://chromium.googlesource.com/angle/angle.git",
-        "rev": "50fd896fb21cca91f325812d01d1e971593efc73",
-        "hash": "sha256-HcfKm7UQmg3wMDOytmaYzm7Z7gRdOrRoqAKaE0ZdI4E="
+        "rev": "a101e2d1db6da927325273566fe8f5404fa3a9bd",
+        "hash": "sha256-uIqodvHxEY9xNse2IHNns2Mz9zLAUZSSIN7pAXB8cPs="
      },
      "src/third_party/angle/third_party/glmark2/src": {
        "url": "https://chromium.googlesource.com/external/github.com/glmark2/glmark2",
@@ -132,8 +132,8 @@
      },
      "src/third_party/dawn": {
        "url": "https://dawn.googlesource.com/dawn.git",
-        "rev": "19696dd088b8ed5804e2f02a8f83f5afdb3e99e3",
-        "hash": "sha256-ihnVPCk9412UzCmoABWVUhiGaIdIYxiYMkk43KDqpg8="
+        "rev": "78a9030d63048d832c4b822839bffe38ad4f20e5",
+        "hash": "sha256-ZknkLN64TYAN5j9WsgtKlRBrAc3iCM084zpc8Zui8Ts="
      },
      "src/third_party/dawn/third_party/glfw3/src": {
        "url": "https://chromium.googlesource.com/external/github.com/glfw/glfw",
@@ -267,8 +267,8 @@
      },
      "src/third_party/devtools-frontend/src": {
        "url": "https://chromium.googlesource.com/devtools/devtools-frontend",
-        "rev": "6efd6eb1d85fd67fdcc2385c54fa56c524bec3f7",
-        "hash": "sha256-1pr3+RK519m+wtcacJB3PcDTL+qSHlOn1ctxpoLzTf8="
+        "rev": "1fb83ff123c44ab59a480056c8c1ba3d33c2caf0",
+        "hash": "sha256-S6agM7HMZ2g2W6e9tYdLSXr0Lc6zeQF9hAYLIeImAYQ="
      },
      "src/third_party/dom_distiller_js/dist": {
        "url": "https://chromium.googlesource.com/chromium/dom-distiller/dist.git",
@@ -332,8 +332,8 @@
      },
      "src/third_party/freetype/src": {
        "url": "https://chromium.googlesource.com/chromium/src/third_party/freetype2.git",
-        "rev": "99b479dc34728936b006679a31e12b8cf432fc55",
-        "hash": "sha256-H5RzBFYWIp/QYKyeBM2wfuX7FvXHPbhCAp7qne5Zvhw="
+        "rev": "6d9fc45fc4bca8aef0b8f65592520673638c3334",
+        "hash": "sha256-A21ONLz8HxoBkOL/jHfs5YwePmOnFyNdlNYSJa9wers="
      },
      "src/third_party/fxdiv/src": {
        "url": "https://chromium.googlesource.com/external/github.com/Maratyszcza/FXdiv.git",
@@ -342,8 +342,8 @@
      },
      "src/third_party/harfbuzz/src": {
        "url": "https://chromium.googlesource.com/external/github.com/harfbuzz/harfbuzz.git",
-        "rev": "f027b8e9039f73bf803eae684fee2eb2d30e4180",
-        "hash": "sha256-HWb3QbPl+RE2oI/Jwv5BjKwv9UnJ8VcJvk+uGy9cAqM="
+        "rev": "67bb413f586f36ba44d740319cb7a28b3d283ea6",
+        "hash": "sha256-WCPEkbiiU8dENM+ik0KokW9Uxmz0xlsRFVVPPOEOZXw="
      },
      "src/third_party/ink/src": {
        "url": "https://chromium.googlesource.com/external/github.com/google/ink.git",
@@ -432,8 +432,8 @@
      },
      "src/third_party/libaom/source/libaom": {
        "url": "https://aomedia.googlesource.com/aom.git",
-        "rev": "b63f30b6d30028a3d7d9c5223def8f3ad97dcc4c",
-        "hash": "sha256-LaBEcVcSB8WB9ZNRgPSiGaKdQL5f3wll2sPb9OhN5SE="
+        "rev": "343cee0a952f8c7d329e59ff3ac2c8bdbe70ec6a",
+        "hash": "sha256-H8Eu3BiUIiZcyReGDyFq9UvjdMJOX00ERjru8+I0zL8="
      },
      "src/third_party/crabbyavif/src": {
        "url": "https://chromium.googlesource.com/external/github.com/webmproject/CrabbyAvif.git",
@@ -612,8 +612,8 @@
      },
      "src/third_party/pdfium": {
        "url": "https://pdfium.googlesource.com/pdfium.git",
-        "rev": "a78c62d93a8f514ea2cd98a70bd1d21226be9d93",
-        "hash": "sha256-qd3Oa/JFzoI5hKDY2/OQAzdr2z9srUj0H6oKz0R516U="
+        "rev": "72ea487e4399c44c3a53a48b104f9612ca772008",
+        "hash": "sha256-0VgmDPyF5k81nBXdo88CcIIbz6XRhaiADnG8gwDGZZk="
      },
      "src/third_party/perfetto": {
        "url": "https://chromium.googlesource.com/external/github.com/google/perfetto.git",
@@ -662,8 +662,8 @@
      },
      "src/third_party/skia": {
        "url": "https://skia.googlesource.com/skia.git",
-        "rev": "a2888b27a98e4ff30085d4d2dba8a1a99baf6dfb",
-        "hash": "sha256-eOjFuMmXr9YtZ0e4yDB8JMjTrNWEg5OlTkAMGuHZIWE="
+        "rev": "03c3234e64f9fbbbcf6a7b9c79e94059df49dbfe",
+        "hash": "sha256-e0MSCbqv4u4995nowzipKorkn6mPpO7tf8+ygj3/nFY="
      },
      "src/third_party/smhasher/src": {
        "url": "https://chromium.googlesource.com/external/smhasher.git",
@@ -797,8 +797,8 @@
      },
      "src/third_party/webrtc": {
        "url": "https://webrtc.googlesource.com/src.git",
-        "rev": "9a7f650bcd14f241d20f88f4e1ea3b7300de72ac",
-        "hash": "sha256-k5cHE4XURJQrPURmXk4MMNV5k8+ryKfjmsVTzARRro4="
+        "rev": "e3ee86921c57b9f8921045e77f098604803cb66c",
+        "hash": "sha256-n39HENOXmatsZLF6jdYRsb+wl2cM0i6ngT4Zbyu5ayE="
      },
      "src/third_party/wuffs/src": {
        "url": "https://skia.googlesource.com/external/github.com/google/wuffs-mirror-release-c.git",
@@ -822,8 +822,8 @@
      },
      "src/v8": {
        "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "ad6e4525c418a92147c8247ef9d144ce4c242a38",
-        "hash": "sha256-+cQdsWTgIohd3yOCsNCprSr4Ctes77fWGdmPxN2tQlM="
+        "rev": "5e24a1fd6ffb840b93ee90a800897fcb4d60eeab",
+        "hash": "sha256-JcBGaXhqNRIA4NPPV4eANVM93wsQ9QxSLO/Ecz3wklU="
      }
    }
  },
@@ -10,8 +10,8 @@ runCommandLocal "bitlbee-plugins"
    inherit plugins;
    buildInputs = [
      bitlbee
-      plugins
-    ];
+    ]
+    ++ plugins;
  }
  ''
    mkdir -p $out/lib/bitlbee
@@ -39,9 +39,9 @@ rec {
      src,
      ...
    }:
-    assert lib.assertMsg (
+    assert
      name == null
-    ) "The `name` argument is deprecated. Use `pname` and `version` instead to construct the name.";
+      || throw "The `name` argument is deprecated. Use `pname` and `version` instead to construct the name.";
    pkgs.runCommand "${pname}-${version}-extracted"
      {
        nativeBuildInputs = [ appimage-exec ];
@@ -64,9 +64,7 @@ let
    let
      matches = (builtins.length (builtins.split "\\{}" prog) - 1) / 2;
    in
-    lib.assertMsg (
-      matches == 1
-    ) "compressor ${ext} needs to have exactly one '{}', found ${toString matches}";
+    matches == 1 || throw "compressor ${ext} needs to have exactly one '{}', found ${toString matches}";
  mkCmd =
    ext: prog:
    assert validProg ext prog;
@@ -71,8 +71,7 @@ lib.extendMkDerivation {
        if autoPubspecLock == null then
          throw "The pubspecLock argument is required. If import-from-derivation is allowed (it isn't in Nixpkgs), you can set autoPubspecLock to the path to a pubspec.lock instead."
        else
-          assert lib.assertMsg (builtins.pathExists autoPubspecLock)
-            "The pubspec.lock file could not be found!";
+          assert builtins.pathExists autoPubspecLock || throw "The pubspec.lock file could not be found!";
          lib.importJSON (
            runCommand "${lib.getName args}-pubspec-lock-json" {
              nativeBuildInputs = [ yq ];
@@ -94,8 +94,9 @@ let

  mkPathDependencySource =
    name: details:
-    assert lib.assertMsg details.description.relative
-      "Only relative paths are supported - ${name} has an absolue path!";
+    assert
+      details.description.relative
+      || throw "Only relative paths are supported - ${name} has an absolue path!";
    (
      if lib.isDerivation src then
        src
@@ -655,9 +655,12 @@ rec {
      checked =
        lib.warnIf (contents != null)
          "in docker image ${name}: The contents parameter is deprecated. Change to copyToRoot if the contents are designed to be copied to the root filesystem, such as when you use `buildEnv` or similar between contents and your packages. Use copyToRoot = buildEnv { ... }; or similar if you intend to add packages to /bin."
-          lib.throwIf
-          (contents != null && copyToRoot != null)
-          "in docker image ${name}: You can not specify both contents and copyToRoot.";
+          (
+            if (contents != null && copyToRoot != null) then
+              throw "in docker image ${name}: You can not specify both contents and copyToRoot."
+            else
+              x: x
+          );

      rootContents = if copyToRoot == null then contents else copyToRoot;

@@ -1030,11 +1033,12 @@ rec {
      debug ? false,
    }:
    assert (
-      lib.assertMsg (layeringPipeline == null -> maxLayers > 1)
-        "the maxLayers argument of dockerTools.buildLayeredImage function must be greather than 1 (current value: ${toString maxLayers})"
+      (layeringPipeline == null -> maxLayers > 1)
+      || throw "the maxLayers argument of dockerTools.buildLayeredImage function must be greather than 1 (current value: ${toString maxLayers})"
    );
    assert (
-      lib.assertMsg (enableFakechroot -> !stdenv.hostPlatform.isDarwin) ''
+      (enableFakechroot -> !stdenv.hostPlatform.isDarwin)
+      || throw ''
        cannot use `enableFakechroot` because `proot` is not portable to Darwin. Workarounds:
              - use `fakeRootCommands` with the restricted `fakeroot` environment
              - cross-compile your packages
@@ -1271,11 +1275,11 @@ rec {
      command ? null,
      run ? null,
    }:
-    assert lib.assertMsg (!(drv.drvAttrs.__structuredAttrs or false))
-      "streamNixShellImage: Does not work with the derivation ${drv.name} because it uses __structuredAttrs";
-    assert lib.assertMsg (
-      command == null || run == null
-    ) "streamNixShellImage: Can't specify both command and run";
+    assert
+      !(drv.drvAttrs.__structuredAttrs or false)
+      || throw "streamNixShellImage: Does not work with the derivation ${drv.name} because it uses __structuredAttrs";
+    assert
+      command == null || run == null || throw "streamNixShellImage: Can't specify both command and run";
    let

      # A binary that calls the command to build the derivation
@@ -24,9 +24,8 @@ lib.makeOverridable (
  }@args:

  assert (
-    lib.assertMsg (lib.xor (tag == null) (
-      rev == null
-    )) "fetchFromBitbucket requires one of either `rev` or `tag` to be provided (not both)."
+    lib.xor (tag == null) (rev == null)
+    || throw "fetchFromBitbucket requires one of either `rev` or `tag` to be provided (not both)."
  );

  let
@@ -177,7 +177,8 @@ lib.makeOverridable (
          sparseCheckoutText =
            # Changed to throw on 2023-06-04
            assert (
-              lib.assertMsg (lib.isList finalAttrs.sparseCheckout) "Please provide directories/patterns for sparse checkout as a list of strings. Passing a (multi-line) string is not supported any more."
+              lib.isList finalAttrs.sparseCheckout
+              || throw "Please provide directories/patterns for sparse checkout as a list of strings. Passing a (multi-line) string is not supported any more."
            );
            assert finalAttrs.nonConeMode -> (finalAttrs.sparseCheckout != [ ]);
            # git-sparse-checkout(1) says:
@@ -59,9 +59,8 @@ decorate (
  }@args:

  assert (
-    lib.assertMsg (lib.xor (tag == null) (
-      rev == null
-    )) "fetchFromGitHub requires one of either `rev` or `tag` to be provided (not both)."
+    lib.xor (tag == null) (rev == null)
+    || throw "fetchFromGitHub requires one of either `rev` or `tag` to be provided (not both)."
  );

  let
@@ -14,9 +14,8 @@ lib.makeOverridable (
  }@args:

  assert (
-    lib.assertMsg (lib.xor (tag == null) (
-      rev == null
-    )) "fetchFromGitiles requires one of either `rev` or `tag` to be provided (not both)."
+    lib.xor (tag == null) (rev == null)
+    || throw "fetchFromGitiles requires one of either `rev` or `tag` to be provided (not both)."
  );

  let
@@ -27,9 +27,8 @@ lib.makeOverridable (
  }@args:

  assert (
-    lib.assertMsg (lib.xor (tag == null) (
-      rev == null
-    )) "fetchFromGitLab requires one of either `rev` or `tag` to be provided (not both)."
+    lib.xor (tag == null) (rev == null)
+    || throw "fetchFromGitLab requires one of either `rev` or `tag` to be provided (not both)."
  );

  let
@@ -65,43 +64,46 @@ lib.makeOverridable (
    fetcher = if useFetchGit then fetchgit else fetchzip;

    privateAttrs = lib.optionalAttrs private (
-      lib.throwIfNot (protocol == "https") "private token login is only supported for https" {
-        netrcPhase = ''
-          if [ -z "''$${varBase}USERNAME" -o -z "''$${varBase}PASSWORD" ]; then
-            echo "Error: Private fetchFromGitLab requires the nix building process (nix-daemon in multi user mode) to have the ${varBase}USERNAME and ${varBase}PASSWORD env vars set." >&2
-            exit 1
-          fi
-        ''
-        + (
-          if useFetchGit then
-            # GitLab supports HTTP Basic Authentication only when Git is used:
-            # https://docs.gitlab.com/ee/user/project/settings/project_access_tokens.html#project-access-tokens
-            ''
-              cat > netrc <<EOF
-              machine ${domain}
-                      login ''$${varBase}USERNAME
-                      password ''$${varBase}PASSWORD
-              EOF
-            ''
-          else
-            # Access via the GitLab API requires a custom header and does not work
-            # with HTTP Basic Authentication:
-            # https://docs.gitlab.com/ee/api/#personalprojectgroup-access-tokens
-            ''
-              # needed because fetchurl always sets --netrc-file if a netrcPhase is present
-              touch netrc
+      if protocol != "https" then
+        throw "private token login is only supported for https"
+      else
+        {
+          netrcPhase = ''
+            if [ -z "''$${varBase}USERNAME" -o -z "''$${varBase}PASSWORD" ]; then
+              echo "Error: Private fetchFromGitLab requires the nix building process (nix-daemon in multi user mode) to have the ${varBase}USERNAME and ${varBase}PASSWORD env vars set." >&2
+              exit 1
+            fi
+          ''
+          + (
+            if useFetchGit then
+              # GitLab supports HTTP Basic Authentication only when Git is used:
+              # https://docs.gitlab.com/ee/user/project/settings/project_access_tokens.html#project-access-tokens
+              ''
+                cat > netrc <<EOF
+                machine ${domain}
+                        login ''$${varBase}USERNAME
+                        password ''$${varBase}PASSWORD
+                EOF
+              ''
+            else
+              # Access via the GitLab API requires a custom header and does not work
+              # with HTTP Basic Authentication:
+              # https://docs.gitlab.com/ee/api/#personalprojectgroup-access-tokens
+              ''
+                # needed because fetchurl always sets --netrc-file if a netrcPhase is present
+                touch netrc

-              cat > private-token <<EOF
-              PRIVATE-TOKEN: ''$${varBase}PASSWORD
-              EOF
-              curlOpts="$curlOpts --header @./private-token"
-            ''
-        );
-        netrcImpureEnvVars = [
-          "${varBase}USERNAME"
-          "${varBase}PASSWORD"
-        ];
-      }
+                cat > private-token <<EOF
+                PRIVATE-TOKEN: ''$${varBase}PASSWORD
+                EOF
+                curlOpts="$curlOpts --header @./private-token"
+              ''
+          );
+          netrcImpureEnvVars = [
+            "${varBase}USERNAME"
+            "${varBase}PASSWORD"
+          ];
+        }
    );

    gitRepoUrl = "${protocol}://${domain}/${slug}.git";
@@ -30,14 +30,18 @@ lib.extendMkDerivation {

      outputHashAlgo = if finalAttrs.hash != null && finalAttrs.hash != "" then null else "sha256";
      outputHashMode = "recursive";
-      outputHash = lib.throwIf (hash != null && sha256 != null) "Only one of sha256 or hash can be set" (
-        if finalAttrs.hash != null then
-          finalAttrs.hash
-        else if sha256 != null then
-          sha256
+      outputHash =
+        if (hash != null && sha256 != null) then
+          throw "Only one of sha256 or hash can be set"
        else
-          ""
-      );
+          (
+            if finalAttrs.hash != null then
+              finalAttrs.hash
+            else if sha256 != null then
+              sha256
+            else
+              ""
+          );

      inherit url rev hash;
      inherit preferLocalBuild;
@@ -38,10 +38,10 @@ in
 let
  inherit (args') stripLen extraPrefix;
 in
-lib.throwIfNot (excludes == [ ] || includes == [ ])
-  "fetchpatch: cannot use excludes and includes simultaneously"
-  fetchurl
-  (
+if excludes != [ ] && includes != [ ] then
+  throw "fetchpatch: cannot use excludes and includes simultaneously"
+else
+  fetchurl (
    {
      nativeBuildInputs = [ patchutils ] ++ nativeBuildInputs;
      postFetch = ''
@@ -10,9 +10,9 @@ lib.makeOverridable (
    ...
  }@args:

-  assert lib.assertMsg (lib.xor (tag != null) (
-    rev != null
-  )) "fetchFromRadicle requires one of either `rev` or `tag` to be provided (not both).";
+  assert
+    lib.xor (tag != null) (rev != null)
+    || throw "fetchFromRadicle requires one of either `rev` or `tag` to be provided (not both).";

  let
    namespacePrefix = lib.optionalString (node != null) "refs/namespaces/${node}/";
@@ -12,9 +12,8 @@ lib.makeOverridable (
    ...
  }@args:

-  assert lib.assertMsg (
-    !args ? rev && !args ? tag
-  ) "fetchRadiclePatch does not accept `rev` or `tag` arguments.";
+  assert
+    (!args ? rev && !args ? tag) || throw "fetchRadiclePatch does not accept `rev` or `tag` arguments.";

  fetchFromRadicle (
    {
@@ -28,9 +28,8 @@ makeOverridable (
  }@args:

  assert (
-    lib.assertMsg (lib.xor (tag == null) (
-      rev == null
-    )) "fetchFromSourcehut requires one of either `rev` or `tag` to be provided (not both)."
+    lib.xor (tag == null) (rev == null)
+    || throw "fetchFromSourcehut requires one of either `rev` or `tag` to be provided (not both)."
  );

  assert (
@@ -83,12 +83,16 @@ let
    else
      [ ];
 in
-assert lib.assertMsg (config != { } -> backend == "transmission") ''
-  json config for configuring fetchtorrent only works with the transmission backend
-'';
-assert lib.assertMsg (backend == "transmission" -> flatten') ''
-  `flatten = false` is only supported by the rqbit backend for fetchtorrent
-'';
+assert
+  (config != { } -> backend == "transmission")
+  || throw ''
+    json config for configuring fetchtorrent only works with the transmission backend
+  '';
+assert
+  (backend == "transmission" -> flatten')
+  || throw ''
+    `flatten = false` is only supported by the rqbit backend for fetchtorrent
+  '';
 runCommand name
  {
    inherit meta;
@@ -327,23 +327,27 @@ lib.extendMkDerivation {

      outputHashMode = if (recursiveHash || executable) then "recursive" else "flat";

-      curlOpts = lib.warnIf (lib.isList curlOpts) (
-        let
-          url = toString (builtins.head urls_);
-          curlOptsRepresentation = lib.generators.toPretty { multiline = false; } curlOpts;
-          curlOptsAsStringRepresentation = lib.strings.escapeNixString (toString curlOpts);
-          curlOptsListElementsRepresentation =
-            lib.concatMapStringsSep " " lib.strings.escapeNixString
-              curlOpts;
-        in
-        ''
-          fetchurl for ${url}: curlOpts is a list (${curlOptsRepresentation}), which is not supported anymore.
-          - If you wish to get the same effect as before, for elements with spaces (even if escaped) to expand to multiple curl arguments, use a string argument instead:
-            curlOpts = ${curlOptsAsStringRepresentation};
-          - If you wish for each list element to be passed as a separate curl argument, allowing arguments to contain spaces, use curlOptsList instead:
-            curlOptsList = [ ${curlOptsListElementsRepresentation} ];
-        ''
-      ) curlOpts;
+      curlOpts =
+        if lib.isList curlOpts then
+          lib.warn (
+            let
+              url = toString (builtins.head urls_);
+              curlOptsRepresentation = lib.generators.toPretty { multiline = false; } curlOpts;
+              curlOptsAsStringRepresentation = lib.strings.escapeNixString (toString curlOpts);
+              curlOptsListElementsRepresentation =
+                lib.concatMapStringsSep " " lib.strings.escapeNixString
+                  curlOpts;
+            in
+            ''
+              fetchurl for ${url}: curlOpts is a list (${curlOptsRepresentation}), which is not supported anymore.
+              - If you wish to get the same effect as before, for elements with spaces (even if escaped) to expand to multiple curl arguments, use a string argument instead:
+                curlOpts = ${curlOptsAsStringRepresentation};
+              - If you wish for each list element to be passed as a separate curl argument, allowing arguments to contain spaces, use curlOptsList instead:
+                curlOptsList = [ ${curlOptsListElementsRepresentation} ];
+            ''
+          ) curlOpts
+        else
+          curlOpts;

      inherit
        curlOptsList
@@ -106,9 +106,11 @@ lib.extendMkDerivation {
      )
      + ''
        ${postFetch}
-        ${lib.warnIf (extraPostFetch != "")
-          "use 'postFetch' instead of 'extraPostFetch' with 'fetchzip' and 'fetchFromGitHub' or 'fetchFromGitLab'."
-          extraPostFetch
+        ${
+          if extraPostFetch != "" then
+            lib.warn "use 'postFetch' instead of 'extraPostFetch' with 'fetchzip' and 'fetchFromGitHub' or 'fetchFromGitLab'." extraPostFetch
+          else
+            extraPostFetch
        }
        chmod 755 "$out"
      '';
@@ -34,7 +34,8 @@ let

  keywordsSection =
    let
-      mustBeAList = attr: attrName: lib.throwIfNot (lib.isList attr) "'${attrName}' must be a list" attr;
+      mustBeAList =
+        attr: attrName: if !(lib.isList attr) then throw "'${attrName}' must be a list" else attr;
    in
    {
      "Name" = name;
@@ -4,7 +4,6 @@
  fetchNpmDeps,
  buildPackages,
  nodejs,
-  nodejs-slim,
  cctools,
 }@topLevelArgs:

@@ -102,7 +101,7 @@ lib.extendMkDerivation {
          (if npmConfigHook != null then npmConfigHook else npmHooks.npmConfigHook)
          (if npmBuildHook != null then npmBuildHook else npmHooks.npmBuildHook)
          (if npmInstallHook != null then npmInstallHook else npmHooks.npmInstallHook)
-          nodejs-slim.python
+          nodejs.python
        ]
        ++ lib.optionals stdenv.hostPlatform.isDarwin [ cctools ];
      buildInputs = buildInputs ++ [ nodejs ];
@@ -60,17 +60,17 @@ in
          pnpm-fixup-state-db;
    in
    # pnpmWorkspace was deprecated, so throw if it's used.
-    assert (lib.throwIf (args ? pnpmWorkspace)
-      "fetchPnpmDeps: `pnpmWorkspace` is no longer supported, please migrate to `pnpmWorkspaces`."
-    ) true;
+    assert
+      !args ? pnpmWorkspace
+      || throw "fetchPnpmDeps: `pnpmWorkspace` is no longer supported, please migrate to `pnpmWorkspaces`.";

-    assert (lib.throwIf (fetcherVersion == null)
-      "fetchPnpmDeps: `fetcherVersion` is not set, see https://nixos.org/manual/nixpkgs/stable/#javascript-pnpm-fetcherVersion."
-    ) true;
+    assert
+      fetcherVersion != null
+      || throw "fetchPnpmDeps: `fetcherVersion` is not set, see https://nixos.org/manual/nixpkgs/stable/#javascript-pnpm-fetcherVersion.";

-    assert (lib.throwIf (!(builtins.elem fetcherVersion supportedFetcherVersions))
-      "fetchPnpmDeps `fetcherVersion` is not set to a supported value (${lib.concatStringsSep ", " (map toString supportedFetcherVersions)}), see https://nixos.org/manual/nixpkgs/stable/#javascript-pnpm-fetcherVersion."
-    ) true;
+    assert
+      builtins.elem fetcherVersion supportedFetcherVersions
+      || throw "fetchPnpmDeps `fetcherVersion` is not set to a supported value (${lib.concatStringsSep ", " (map toString supportedFetcherVersions)}), see https://nixos.org/manual/nixpkgs/stable/#javascript-pnpm-fetcherVersion.";

    lib.warnIf (fetcherVersion < 3)
      "fetchPnpmDeps: `fetcherVersion = ${toString fetcherVersion}` is deprecated and scheduled for removal in the 26.11 release. Please migrate `${pname}` to `fetcherVersion = 3` and regenerate the hash. See https://nixos.org/manual/nixpkgs/stable/#javascript-pnpm-fetcherVersion."
@@ -9,7 +9,6 @@
  nix-prefetch-git,
  fetchurl,
  jq,
-  nodejs,
  nodejs-slim,
  prefetch-yarn-deps,
  fixup-yarn-lock,
@@ -19,11 +19,10 @@
  ...
 }@args:

-lib.throwIf (args ? minimalOCamlVersion && lib.versionOlder ocaml.version args.minimalOCamlVersion)
-  "${pname}-${version} is not available for OCaml ${ocaml.version}"
-
-  stdenv.mkDerivation
-  (
+if (args ? minimalOCamlVersion && lib.versionOlder ocaml.version args.minimalOCamlVersion) then
+  throw "${pname}-${version} is not available for OCaml ${ocaml.version}"
+else
+  stdenv.mkDerivation (
    {

      dontAddStaticConfigureFlags = true;
@@ -24,24 +24,20 @@ let
      phpDrv = finalAttrs.php or php;
      composer = finalAttrs.composer or phpDrv.packages.composer-local-repo-plugin;
    in
-    assert (lib.assertMsg (previousAttrs ? src) "mkComposerRepository expects src argument.");
+    assert previousAttrs ? src || throw "mkComposerRepository expects src argument.";
+    assert previousAttrs ? vendorHash || throw "mkComposerRepository expects vendorHash argument.";
+    assert previousAttrs ? version || throw "mkComposerRepository expects version argument.";
+    assert previousAttrs ? pname || throw "mkComposerRepository expects pname argument.";
    assert (
-      lib.assertMsg (previousAttrs ? vendorHash) "mkComposerRepository expects vendorHash argument."
-    );
-    assert (lib.assertMsg (previousAttrs ? version) "mkComposerRepository expects version argument.");
-    assert (lib.assertMsg (previousAttrs ? pname) "mkComposerRepository expects pname argument.");
-    assert (
-      lib.assertMsg (previousAttrs ? composerNoDev) "mkComposerRepository expects composerNoDev argument."
+      previousAttrs ? composerNoDev || throw "mkComposerRepository expects composerNoDev argument."
    );
    assert (
-      lib.assertMsg (
-        previousAttrs ? composerNoPlugins
-      ) "mkComposerRepository expects composerNoPlugins argument."
+      previousAttrs ? composerNoPlugins
+      || throw "mkComposerRepository expects composerNoPlugins argument."
    );
    assert (
-      lib.assertMsg (
-        previousAttrs ? composerNoScripts
-      ) "mkComposerRepository expects composerNoScripts argument."
+      previousAttrs ? composerNoScripts
+      || throw "mkComposerRepository expects composerNoScripts argument."
    );
    {
      composerNoDev = previousAttrs.composerNoDev or true;
@@ -25,9 +25,9 @@ let
      dontCheckForBrokenSymlinks ? true,
      ...
    }@args:
-    assert (lib.assertMsg (args ? pname) "mkComposerVendor expects pname argument.");
-    assert (lib.assertMsg (args ? version) "mkComposerVendor expects version argument.");
-    assert (lib.assertMsg (args ? src) "mkComposerVendor expects src argument.");
+    assert args ? pname || throw "mkComposerVendor expects pname argument.";
+    assert args ? version || throw "mkComposerVendor expects version argument.";
+    assert args ? src || throw "mkComposerVendor expects src argument.";
    {
      name = "${args.pname}-composer-vendor-${args.version}";

@@ -87,9 +87,9 @@ let
    };
 in

-assert lib.assertMsg (lib.all (
-  u: lib.hasPrefix pname u.name
-) units) "Unit names must be prefixed with the service name";
+assert
+  lib.all (u: lib.hasPrefix pname u.name) units
+  || throw "Unit names must be prefixed with the service name";

 stdenv.mkDerivation {
  pname = "${pname}-img";
@@ -4669,7 +4669,7 @@ rec {
                  # Not rate-limited, CDN URL.
                  url = "https://static.crates.io/crates/${crateConfig.crateName}/${crateConfig.crateName}-${crateConfig.version}.crate";
                  sha256 =
-                    assert (lib.assertMsg (crateConfig ? sha256) "Missing sha256 for ${name}");
+                    assert crateConfig ? sha256 || throw "Missing sha256 for ${name}";
                    crateConfig.sha256;
                });
              extraRustcOpts =
@@ -78,8 +78,9 @@ lib.extendMkDerivation {
      ...
    }@args:

-    assert lib.assertMsg useFetchCargoVendor
-      "buildRustPackage: `useFetchCargoVendor` is non‐optional and enabled by default as of 25.05, remove it";
+    assert
+      useFetchCargoVendor
+      || throw "buildRustPackage: `useFetchCargoVendor` is non‐optional and enabled by default as of 25.05, remove it";

    assert lib.warnIf (args ? useFetchCargoVendor)
      "buildRustPackage: `useFetchCargoVendor` is non‐optional and enabled by default as of 25.05, remove it"
@@ -120,9 +120,11 @@ let
      checksum =
        pkg.checksum or parsedLockFile.metadata."checksum ${pkg.name} ${pkg.version} (${pkg.source})";
    in
-    assert lib.assertMsg (checksum != null) ''
-      Package ${pkg.name} does not have a checksum.
-    '';
+    assert
+      checksum != null
+      || throw ''
+        Package ${pkg.name} does not have a checksum.
+      '';
    fetchurl {
      name = "crate-${pkg.name}-${pkg.version}.tar.gz";
      url = "${downloadUrl}/${pkg.name}/${pkg.version}/download";
@@ -30,7 +30,7 @@ makeSetupHook {
  # depsTargetTargetPropagated will essentially be buildInputs when wrapGAppsHook3 is placed into nativeBuildInputs
  # the librsvg and gtk3 above should be removed but kept to not break anything that implicitly depended on its binaries
  depsTargetTargetPropagated =
-    assert (lib.assertMsg (!targetPackages ? raw) "wrapGAppsHook3 must be in nativeBuildInputs");
+    assert (!targetPackages ? raw || throw "wrapGAppsHook3 must be in nativeBuildInputs");
    lib.optionals isGraphical [
      # librsvg provides a module for gdk-pixbuf to allow rendering
      # SVG icons. Most icon themes are SVG-based and so are some
@@ -54,8 +54,9 @@ optionalDeprecationWarning stdenvNoCC.mkDerivation (
  // args
  // lib.optionalAttrs (args ? substitutions) {
    substitutions =
-      assert lib.assertMsg (lib.isList args.substitutions)
-        ''pkgs.substitute: For "${name}", `substitutions` is passed, which is expected to be a list, but it's a ${builtins.typeOf args.substitutions} instead.'';
+      assert
+        lib.isList args.substitutions
+        || throw ''pkgs.substitute: For "${name}", `substitutions` is passed, which is expected to be a list, but it's a ${builtins.typeOf args.substitutions} instead.'';
      lib.escapeShellArgs args.substitutions;
  }
 )
@@ -131,12 +131,14 @@ rec {
          preferLocalBuild
          ;
        destination =
-          assert lib.assertMsg (destination != "" -> (lib.hasPrefix "/" destination && destination != "/")) ''
-            destination must be an absolute path, relative to the derivation's out path,
-            got '${destination}' instead.
+          assert
+            (destination != "" -> (lib.hasPrefix "/" destination && destination != "/"))
+            || throw ''
+              destination must be an absolute path, relative to the derivation's out path,
+              got '${destination}' instead.

-            Ensure that the path starts with a / and specifies at least the filename.
-          '';
+              Ensure that the path starts with a / and specifies at least the filename.
+            '';
          destination;
        passAsFile = [ "text" ] ++ derivationArgs.passAsFile or [ ];

@@ -184,8 +186,9 @@ rec {
  writeText =
    name: text:
    # TODO: To fully deprecate, replace the assertion with `lib.isString` and remove the warning
-    assert lib.assertMsg (lib.strings.isConvertibleWithToString text)
-      "pkgs.writeText ${lib.strings.escapeNixString name}: The second argument should be a string, but it's a ${builtins.typeOf text} instead.";
+    assert
+      lib.strings.isConvertibleWithToString text
+      || throw "pkgs.writeText ${lib.strings.escapeNixString name}: The second argument should be a string, but it's a ${builtins.typeOf text} instead.";
    lib.warnIf (!lib.isString text)
      "pkgs.writeText ${lib.strings.escapeNixString name}: The second argument should be a string, but it's a ${builtins.typeOf text} instead, which is deprecated. Use `toString` to convert the value to a string first."
      writeTextFile
@@ -534,9 +537,9 @@ rec {
      finalAttrs:
      args@{
        name ?
-          assert lib.assertMsg (
-            finalAttrs ? pname && finalAttrs ? version
-          ) "symlinkJoin requires either a `name` OR `pname` and `version`";
+          assert
+            (finalAttrs ? pname && finalAttrs ? version)
+            || throw "symlinkJoin requires either a `name` OR `pname` and `version`";
          "${finalAttrs.pname}-${finalAttrs.version}",
        paths,
        stripPrefix ? "",
@@ -546,11 +549,13 @@ rec {
        failOnMissing ? stripPrefix == "",
        ...
      }:
-      assert lib.assertMsg (stripPrefix != "" -> (hasPrefix "/" stripPrefix && stripPrefix != "/")) ''
-        stripPrefix must be either an empty string (disable stripping behavior), or relative path prefixed with /.
+      assert
+        (stripPrefix != "" -> (hasPrefix "/" stripPrefix && stripPrefix != "/"))
+        || throw ''
+          stripPrefix must be either an empty string (disable stripping behavior), or relative path prefixed with /.

-        Ensure that the path starts with / and specifies path to the subdirectory.
-      '';
+          Ensure that the path starts with / and specifies path to the subdirectory.
+        '';
      let
        mapPaths =
          f:
@@ -1012,12 +1017,9 @@ rec {
        src,
        ...
      }@args:
-      assert lib.assertMsg (
-        !args ? meta
-      ) "applyPatches will not merge 'meta', change it in 'src' instead";
-      assert lib.assertMsg (
-        !args ? passthru
-      ) "applyPatches will not merge 'passthru', change it in 'src' instead";
+      assert !args ? meta || throw "applyPatches will not merge 'meta', change it in 'src' instead";
+      assert
+        !args ? passthru || throw "applyPatches will not merge 'passthru', change it in 'src' instead";
      let
        keepAttrs = names: lib.filterAttrs (name: val: lib.elem name names);
        # enables tools like nix-update to determine what src attributes to replace
@@ -11,16 +11,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "anda";
-  version = "0.5.4";
+  version = "0.6.0";

  src = fetchFromGitHub {
    owner = "FyraLabs";
    repo = "anda";
    tag = finalAttrs.version;
-    hash = "sha256-z+oYerTP0xJ4QuHtB7uH2nTVEqFsGb2FTpk2wNpMZKU=";
+    hash = "sha256-9LGFOLlv1F6tTs/Tqe+3D2M+o/5dq3zJ4X0CH7HHzBc=";
  };

-  cargoHash = "sha256-uoDAfsHIAJsgcMljDqCHwaHvfVZYok2GsuG8y7N0NAg=";
+  cargoHash = "sha256-ErBPkTeeDJDcUMDMyOtfHnLpW6Xtsfukv6GqBSFX2DQ=";

  __structuredAttrs = true;

@@ -3,7 +3,12 @@
  lib,
  fetchFromGitHub,
  bash,
+  bc,
+  gitMinimal,
+  gnugrep,
+  jq,
  which,
+  writableTmpDirAsHomeHook,
  versionCheckHook,
  coreutils,
  makeBinaryWrapper,
@@ -12,13 +17,13 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "bashunit";
-  version = "0.26.0";
+  version = "0.36.0";

  src = fetchFromGitHub {
    owner = "TypedDevs";
    repo = "bashunit";
    tag = finalAttrs.version;
-    hash = "sha256-cZ2fcm4OxA3Ly8QRkOQSjaSZW80/Pu2z10+iN4pDFOs=";
+    hash = "sha256-alhqJ7coRk5O4dYGx8m6u8/j7KMfr2m9Jeb5pn0wwiU=";
    forceFetchGit = true; # needed to include the tests directory for the check phase
  };

@@ -43,9 +48,21 @@ stdenvNoCC.mkDerivation (finalAttrs: {
  '';

  doCheck = true;
-  nativeCheckInputs = [ which ];
+  nativeCheckInputs = [
+    bc
+    gitMinimal
+    jq
+    which
+  ];
  checkPhase = ''
    runHook preCheck
+    patchShebangs bin/bashunit
+  ''
+  # Disabling a failing test on Darwin platforms only
+  + lib.optionalString stdenvNoCC.hostPlatform.isDarwin ''
+    rm tests/unit/console_results_test.sh
+  ''
+  + ''
    make test
    runHook postCheck
  '';
@@ -54,14 +71,21 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    wrapProgram $out/bin/bashunit \
      --prefix PATH : "${
        lib.makeBinPath [
-          coreutils
+          coreutils # cat, mktemp
+          gnugrep # grep
          which
        ]
      }"
  '';

-  nativeInstallCheckInputs = [ versionCheckHook ];
+  nativeInstallCheckInputs = [
+    versionCheckHook
+    writableTmpDirAsHomeHook
+  ];
  doInstallCheck = true;
+  versionCheckKeepEnvironment = [
+    "HOME"
+  ];

  passthru.updateScript = nix-update-script { };

@@ -452,6 +452,7 @@ stdenv'.mkDerivation (finalAttrs: {
    # say: "We've decided to cancel the BL offering for an indefinite period."
    # OptiX, enabled with cudaSupport, is non-free.
    license = with lib.licenses; [ gpl2Plus ] ++ lib.optional cudaSupport nvidiaCudaRedist;
+    donationPage = "https://fund.blender.org/";

    platforms = [
      "aarch64-linux"
@@ -277,6 +277,7 @@ stdenv.mkDerivation (finalAttrs: {
    changelog = "https://curl.se/ch/${finalAttrs.version}.html";
    description = "Command line tool for transferring files with URL syntax";
    homepage = "https://curl.se/";
+    donationPage = "https://curl.se/donation.html";
    license = lib.licenses.curl;
    maintainers = with lib.maintainers; [
      Scrumplex
@@ -2,6 +2,7 @@
  lib,
  stdenv,
  fetchzip,
+  bash,
  fontconfig,
  libx11,
  libxinerama,
@@ -20,12 +21,16 @@ stdenv.mkDerivation (finalAttrs: {
  pname = "dmenu";
  version = "5.4";

+  strictDeps = true;
+  __structuredAttrs = true;
+
  src = fetchzip {
    url = "https://dl.suckless.org/tools/dmenu-${finalAttrs.version}.tar.gz";
    hash = "sha256-6bFq3Pj3cuZqLR0pkoJyfx3CDWmmSqkDoEVptMfej7g=";
  };

  buildInputs = [
+    bash
    fontconfig
    libx11
    libxinerama
@@ -18,13 +18,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "dynarmic";
-  version = "6.7.0-unstable-2026-01-04";
+  version = "6.7.0-unstable-2026-05-19";

  src = fetchFromGitHub {
    owner = "azahar-emu";
    repo = "dynarmic";
-    rev = "526227eebe1efff3fb14dbf494b9c5b44c2e9c1f";
-    hash = "sha256-WG9mUFUnhEEF0+qsQzslTAj1nox3jaz6rVKs245EtV4=";
+    rev = "c5f5b0d7fca772b7d2d4d8ba0975ce8653f4b055";
+    hash = "sha256-ecEVqQHP2pwyqAl1s1HKBxaqSLmfOdcQP2rKbla+RLM=";
  };

  patches = [
@@ -1,13 +0,0 @@
-diff --git a/src/common/settings.cpp b/src/common/settings.cpp
-index 2c88356888..96198006b7 100644
--- a/src/common/settings.cpp
-+++ b/src/common/settings.cpp
-@@ -176,7 +176,7 @@ bool IsFastmemEnabled() {
-     if (values.cpu_accuracy.GetValue() == CpuAccuracy::Unsafe) {
-         return bool(values.cpuopt_unsafe_host_mmu);
-     }
-#if !defined(__APPLE__) && !defined(__linux__) && !defined(__ANDROID__) && !defined(_WIN32)
-+#if !defined(__APPLE__) && !defined(__linux__) && !defined(__ANDROID__) && !defined(_WIN32) || (defined(__linux__) && defined(__aarch64__))
-     return false;
- #else
-     return true;
@@ -0,0 +1,54 @@
+{
+  stdenv,
+  lib,
+  fetchFromGitea,
+  cmake,
+  ninja,
+  tzdata,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "tzdb_to_nx";
+  version = "230326";
+
+  src = fetchFromGitea {
+    domain = "git.eden-emu.dev";
+    owner = "eden-emu";
+    repo = "tzdb_to_nx";
+    tag = finalAttrs.version;
+    hash = "sha256-koz7C63oHVfrhrf9lfdUqw6idJWi21XRKQnb5PdoEb4=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    ninja
+  ];
+
+  cmakeFlags = [
+    (lib.cmakeFeature "TZDB2NX_ZONEINFO_DIR" "${tzdata}/share/zoneinfo")
+    (lib.cmakeFeature "TZDB2NX_VERSION" tzdata.version)
+  ];
+
+  ninjaFlags = [ "x80e" ];
+
+  installPhase = ''
+    runHook preInstall
+
+    cp -r src/tzdb/nx $out
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "RFC 8536 time zone data converted to the Nintendo Switch format";
+    homepage = "https://git.crueter.xyz/misc/tzdb_to_nx";
+    maintainers = with lib.maintainers; [ marcin-serwin ];
+    license = with lib.licenses; [
+      # Converter
+      mit
+
+      # Data
+      publicDomain
+    ];
+    platforms = lib.platforms.all;
+  };
+})
@@ -10,6 +10,7 @@
  cubeb,
  enet,
  fetchFromGitea,
+  fetchpatch,
  fetchurl,
  ffmpeg-headless,
  fmt,
@@ -21,9 +22,6 @@
  libopus,
  libusb1,
  lz4,
-  mcl-cpp-utility-lib,
-  mbedtls,
-  nix-update-script,
  nlohmann_json,
  oaknut,
  openssl,
@@ -34,7 +32,6 @@
  simpleini,
  sirit,
  spirv-headers,
-  spirv-tools,
  stb,
  unordered_dense,
  vulkan-headers,
@@ -44,7 +41,8 @@
  xbyak,
  zlib,
  zstd,
-  tzdata,
+  writeScript,
+  callPackage,
 }:

 let
@@ -54,52 +52,35 @@ let
    hash = "sha256-OC22KdawYK9yKiffqc1rtgrBanVExYMi9jqhvkwMD6w=";
  };

-  nx_tzdb = stdenv.mkDerivation (finalAttrs: {
-    name = "tzdb_to_nx";
-    version = "120226";
-
-    src = fetchFromGitea {
-      domain = "git.crueter.xyz";
-      owner = "misc";
-      repo = "tzdb_to_nx";
-      tag = finalAttrs.version;
-      hash = "sha256-egPu8UVbj73RQ0Z5JMTjd5HVdy47WTfkUMlQaS0wUTg=";
-    };
-
-    nativeBuildInputs = [
-      cmake
-      ninja
-    ];
-
-    cmakeFlags = [
-      (lib.cmakeFeature "TZDB2NX_ZONEINFO_DIR" "${tzdata}/share/zoneinfo")
-      (lib.cmakeFeature "TZDB2NX_VERSION" tzdata.version)
-    ];
-
-    ninjaFlags = [ "x80e" ];
-
-    installPhase = ''
-      runHook preInstall
-
-      cp -r src/tzdb/nx $out
-
-      runHook postInstall
-    '';
-  });
+  nx_tzdb = callPackage ./nx_tzdb.nix { };
 in

 stdenv.mkDerivation (finalAttrs: {
  pname = "eden";
-  version = "0.1.1";
+  version = "0.2.0";

  src = fetchFromGitea {
    domain = "git.eden-emu.dev";
    owner = "eden-emu";
    repo = "eden";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-tkro7ZHgn2809Utf/Li5+OiseywyQKH15eqphxlJZQQ=";
+    hash = "sha256-Q/tJP6AHAtW9AXn9G+8dF4oTlKDfNHN4cuTKXtYq0T8=";
  };

+  patches = [
+    (fetchpatch {
+      # httplib uses `SameMinorVersion` compatibility for its CMake files which
+      # makes it reject the nixpkgs version which is newer
+      name = "revert-httplib-version-specification.patch";
+      url = "https://git.eden-emu.dev/eden-emu/eden/commit/9c13c71da8dcc37d03fc53bc3bc16978a65fd8f2.patch";
+      hash = "sha256-g7q40BDb9TKE8eudBS7Smajq5EYCzxSemZgsl2ialJo=";
+      revert = true;
+    })
+  ];
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
  nativeBuildInputs = [
    cmake
    ninja
@@ -125,23 +106,21 @@ stdenv.mkDerivation (finalAttrs: {
    libusb1
    # intentionally omitted: LLVM - heavy, only used for stack traces in the debugger
    lz4
-    mcl-cpp-utility-lib
    nlohmann_json
    openssl
    qt6.qtbase
    qt6.qtmultimedia
    qt6.qtwayland
    qt6.qtwebengine
+    qt6.qtcharts
    # intentionally omitted: renderdoc - heavy, developer only
    SDL2
    stb
    simpleini
-    spirv-tools
    spirv-headers
    vulkan-headers
    vulkan-memory-allocator
    vulkan-utility-libraries
-    mbedtls
    sirit
    unordered_dense
    zlib
@@ -154,11 +133,6 @@ stdenv.mkDerivation (finalAttrs: {
    oaknut
  ];

-  patches = [
-    # https://git.eden-emu.dev/eden-emu/eden/issues/3484
-    ./aarch64-disable-fastmem.patch
-  ];
-
  doCheck = true;

  checkInputs = [
@@ -166,21 +140,19 @@ stdenv.mkDerivation (finalAttrs: {
    oaknut
  ];

-  __structuredAttrs = true;
  cmakeFlags = [
    (lib.cmakeBool "BUILD_TESTING" finalAttrs.finalPackage.doCheck)
    (lib.cmakeBool "YUZU_TESTS" false) # some timer tests are flaky

    # use system libraries
    (lib.cmakeBool "CPMUTIL_FORCE_SYSTEM" true)
-    (lib.cmakeBool "YUZU_USE_EXTERNAL_SDL2" false)
-    (lib.cmakeBool "YUZU_USE_BUNDLED_FFMPEG" false)
    (lib.cmakeFeature "YUZU_TZDB_PATH" "${nx_tzdb}")

    # enable some optional features
    (lib.cmakeBool "YUZU_USE_QT_WEB_ENGINE" true)
    (lib.cmakeBool "YUZU_USE_QT_MULTIMEDIA" true)
    (lib.cmakeBool "ENABLE_QT_TRANSLATION" true)
+    (lib.cmakeBool "ENABLE_LTO" true)

    # We dont want to bother upstream with potentially outdated compat reports
    (lib.cmakeBool "YUZU_ENABLE_COMPATIBILITY_REPORTING" false)
@@ -209,7 +181,15 @@ stdenv.mkDerivation (finalAttrs: {
  passthru = {
    inherit nx_tzdb compat-list;

-    updateScript = nix-update-script { };
+    updateScript = writeScript "update-eden" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p nix-update
+
+      set -eu -o pipefail
+
+      nix-update eden
+      nix-update eden.nx_tzdb
+    '';
  };

  meta = {
@@ -233,9 +213,6 @@ stdenv.mkDerivation (finalAttrs: {
      cc-by-sa-30
      cc0

-      # Timezone data
-      publicDomain
-
      # Vendored/incorporated libs
      apsl20
      llvm-exception
@@ -11,16 +11,16 @@

 buildGoModule (finalAttrs: {
  pname = "entire";
-  version = "0.6.2";
+  version = "0.6.3";

  src = fetchFromGitHub {
    owner = "entireio";
    repo = "cli";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-cSFDRZzLHUT86coxA/1fYzPSq79jNkeZMu7EYrmfeSY=";
+    hash = "sha256-yGutKLwdTuGamZMdkqHlhBypZFuY9jM0w/1VW6ACppg=";
  };

-  vendorHash = "sha256-fuHMMQsd9FrxqjKb0M1aV+ya5yofGpH7/I10ZkBdlI4=";
+  vendorHash = "sha256-pIIrrbp3x15iiY3CuA+wU7315bHUSjvJWBa4Q58OorU=";

  subPackages = [ "cmd/entire" ];

@@ -40,7 +40,6 @@ stdenv.mkDerivation (finalAttrs: {
    homepage = "http://wryun.github.io/es-shell/";
    license = lib.licenses.publicDomain;
    maintainers = with lib.maintainers; [
-      sjmackenzie
      ttuegel
    ];
    platforms = lib.platforms.all;
@@ -31,13 +31,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "flaresolverr";
-  version = "3.4.6";
+  version = "3.5.0";

  src = fetchFromGitHub {
    owner = "FlareSolverr";
    repo = "FlareSolverr";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-DeFp76VwMGBAWOsI3S3jm1qNbPw554zJZfE7hotUedY=";
+    hash = "sha256-gOrfxFGNlxZWScfYEw7zfy7oVWhYEygYgP7mkO4cs/w=";
  };

  nativeBuildInputs = [ makeWrapper ];
@@ -7,13 +7,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "functionalplus";
-  version = "0.2.27";
+  version = "0.2.28";

  src = fetchFromGitHub {
    owner = "Dobiasd";
    repo = "FunctionalPlus";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-LlWdzxfFkbfkb9wAmpb86Ah97pWlW3w7DdW6JPu1xdc=";
+    hash = "sha256-cXZGiiuxrsYic3PMLj4F7fTPfTsWugChrFqrzI6cLt4=";
  };

  nativeBuildInputs = [ cmake ];
@@ -7,7 +7,7 @@
 }:

 let
-  version = "18.11.3";
+  version = "18.11.4";
  package_version = "v${lib.versions.major version}";
  gitaly_package = "gitlab.com/gitlab-org/gitaly/${package_version}";

@@ -21,10 +21,10 @@ let
      owner = "gitlab-org";
      repo = "gitaly";
      rev = "v${version}";
-      hash = "sha256-oFQevVXbxu9G4LF3BrC0EUUviypSwB4cKRjipdiO3jU=";
+      hash = "sha256-YQpNsSCjcMC1tpwLVN0fCB9T3vBFxp0TyrvxzJfTnFg=";
    };

-    vendorHash = "sha256-123WUtoUaPIyDywcTKEhiZP2SYYHxAQoOPyCebsHYRI=";
+    vendorHash = "sha256-/RJnCcmUoqGy08MSGEVM/taV1qZK65kiZw19n6S3ZQ0=";

    ldflags = [
      "-X ${gitaly_package}/internal/version.version=${version}"
@@ -11,17 +11,17 @@ let
 in
 buildGoModule (finalAttrs: {
  pname = "gitlab-elasticsearch-indexer";
-  version = "5.14.1";
+  version = "5.14.7";

  # nixpkgs-update: no auto update
  src = fetchFromGitLab {
    owner = "gitlab-org";
    repo = "gitlab-elasticsearch-indexer";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-yYl2cSPY5hn1GSda5ioMD3rEectNMtYGstVpz73pi3Y=";
+    hash = "sha256-1fVBCem23X8u1NQ6ph37EiXRvMpzF/8Yac+VefAe9Yg=";
  };

-  vendorHash = "sha256-yeVEQEXHGAkdkfcnjok8iOvVRxucObVAxhuACmyFDJw=";
+  vendorHash = "sha256-cUHXrUd+pSMiS6iSwKKA+o1B6ZHbaQYHYPeVk1Y6wYM=";

  buildInputs = [ icu ];
  nativeBuildInputs = [ pkg-config ];
@@ -6,14 +6,14 @@

 buildGoModule (finalAttrs: {
  pname = "gitlab-pages";
-  version = "18.11.3";
+  version = "18.11.4";

  # nixpkgs-update: no auto update
  src = fetchFromGitLab {
    owner = "gitlab-org";
    repo = "gitlab-pages";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-ozkrU3QF/LK0uqfF52dnm2MCga+vRD8dGsLNnze6E+Y=";
+    hash = "sha256-tE2PHWk12S482TjNhI0u7Afm0mPAgJWqcJiU5dgqN60=";
  };

  vendorHash = "sha256-PUW4cgAiM1GTtvja894OZ4pe0SWChf5JsL4/fkns2kI=";
@@ -8,14 +8,14 @@

 buildGoModule (finalAttrs: {
  pname = "gitlab-shell";
-  version = "14.49.0";
+  version = "14.50.0";

  # nixpkgs-update: no auto update
  src = fetchFromGitLab {
    owner = "gitlab-org";
    repo = "gitlab-shell";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-8PnFRwP5vctnOh6t45crxkoVF6Z03bfYry24KfFHCww=";
+    hash = "sha256-a9s+TCm5yKPjNh+BD9fm6iVA4H9KJiMyWNulY+7BKZo=";
  };

  buildInputs = [
@@ -27,7 +27,7 @@ buildGoModule (finalAttrs: {
    ./remove-hardcoded-locations.patch
  ];

-  vendorHash = "sha256-JBKU134/Yyz49HWfU9Dw/EC4bI/o3Hs56Ou7wtzp5qM=";
+  vendorHash = "sha256-ceSnQQTtGdLb0QGR9fDbGC0NtRPGqkyXJ6b0TRXkjQM=";

  subPackages = [
    "cmd/gitlab-shell"
@@ -1,17 +1,17 @@
 {
-  "version": "18.11.3",
-  "repo_hash": "sha256-QxaLdWErE+b4SpwHtxnCa2tqheWUfEixRcQwYD/A9s8=",
+  "version": "18.11.4",
+  "repo_hash": "sha256-ThtRXdUreorOIea5Izd+zKb88cC4nhitkzqT+Yf5UtU=",
  "yarn_hash": "sha256-k8JHi0f/XfSV4kICyPW01Erk3YnKw33yeUWYrOaPdTM=",
  "frontend_islands_yarn_hash": "sha256-EvGQin+5DqqIgM36jlVkVI49WcJzVvceYnkSS9ybfcY=",
  "owner": "gitlab-org",
  "repo": "gitlab",
-  "rev": "v18.11.3-ee",
+  "rev": "v18.11.4-ee",
  "passthru": {
-    "GITALY_SERVER_VERSION": "18.11.3",
-    "GITLAB_KAS_VERSION": "18.11.3",
-    "GITLAB_PAGES_VERSION": "18.11.3",
-    "GITLAB_SHELL_VERSION": "14.49.0",
-    "GITLAB_ELASTICSEARCH_INDEXER_VERSION": "5.14.1",
-    "GITLAB_WORKHORSE_VERSION": "18.11.3"
+    "GITALY_SERVER_VERSION": "18.11.4",
+    "GITLAB_KAS_VERSION": "18.11.4",
+    "GITLAB_PAGES_VERSION": "18.11.4",
+    "GITLAB_SHELL_VERSION": "14.50.0",
+    "GITLAB_ELASTICSEARCH_INDEXER_VERSION": "5.14.7",
+    "GITLAB_WORKHORSE_VERSION": "18.11.4"
  }
 }
@@ -10,7 +10,7 @@ in
 buildGoModule (finalAttrs: {
  pname = "gitlab-workhorse";

-  version = "18.11.3";
+  version = "18.11.4";

  # nixpkgs-update: no auto update
  src = fetchFromGitLab {
@@ -765,3 +765,6 @@ gem "gitlab-cloud-connector", "~> 1.45", require: 'gitlab/cloud_connector', feat
 gem "gvltools", "~> 0.4.0", feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839

 gem 'gitlab_query_language', '~> 0.26.0', feature_category: :integrations
+
+# standard Gem, version increase to resolve vulnerabilities
+gem "zlib", "~> 3.2", ">= 3.2.3", feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/work_items/596593
@@ -2174,6 +2174,7 @@ GEM
    yard-solargraph (0.1.0)
      yard (~> 0.9)
    zeitwerk (2.6.18)
+    zlib (3.2.3)

 PLATFORMS
  ruby
@@ -2553,6 +2554,7 @@ DEPENDENCIES
  yajl-ruby (~> 1.4.3)
  yard (~> 0.9)
  zeitwerk (= 2.6.18)
+  zlib (~> 3.2, >= 3.2.3)

 BUNDLED WITH
   2.7.1
@@ -10473,4 +10473,14 @@ src: {
    };
    version = "2.6.18";
  };
+  zlib = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "084w64p55s3l2rmbs6x84qbclhi451n8n2limdj1mwrjidlidlsv";
+      type = "gem";
+    };
+    version = "3.2.3";
+  };
 }
@@ -45,6 +45,6 @@ stdenv.mkDerivation (finalAttrs: {
    homepage = "https://greatscottgadgets.com/hackrf/";
    license = lib.licenses.gpl2;
    platforms = lib.platforms.all;
-    maintainers = with lib.maintainers; [ sjmackenzie ];
+    maintainers = [ ];
  };
 })
@@ -8,13 +8,13 @@

 buildGoModule (finalAttrs: {
  pname = "honeycomb-refinery";
-  version = "3.2.1";
+  version = "3.2.2";

  src = fetchFromGitHub {
    owner = "honeycombio";
    repo = "refinery";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-2avpxXlphqCNLeuTwskZKML/Dp5igm/qexq44lk8ne8=";
+    hash = "sha256-slINvCsw4s5I9s9LaTXuR/5Rvv1K1qzqNiatwr6p4FM=";
  };

  env.NO_REDIS_TEST = true;
@@ -37,7 +37,7 @@ buildGoModule (finalAttrs: {
    "-X main.BuildID=${finalAttrs.version}"
  ];

-  vendorHash = "sha256-PBNL6oL3X+zaom2vbPJ0WuH9syZqWw4WXWbUqu/mtH0=";
+  vendorHash = "sha256-DxqVKGox3NbRwvkGrW29MbsE4KKK0/Og8uH5hgtgPMo=";

  doCheck = true;

@@ -81,7 +81,7 @@ let
 in
 effectiveStdenv.mkDerivation (finalAttrs: {
  pname = "llama-cpp";
-  version = "9190";
+  version = "9309";

  outputs = [
    "out"
@@ -92,7 +92,7 @@ effectiveStdenv.mkDerivation (finalAttrs: {
    owner = "ggml-org";
    repo = "llama.cpp";
    tag = "b${finalAttrs.version}";
-    hash = "sha256-zajArFzrLUUVsfG1xBttwzwaT9QNlKzDbvSxvof+FMQ=";
+    hash = "sha256-RzxQjVRn6G8M+6N9ulWKIfkfFkD1gTee0L/JWTcOXY0=";
    leaveDotGit = true;
    postFetch = ''
      git -C "$out" rev-parse --short HEAD > $out/COMMIT
@@ -125,7 +125,7 @@ effectiveStdenv.mkDerivation (finalAttrs: {
    ++ [ openssl ];

  npmRoot = "tools/ui";
-  npmDepsHash = "sha256-WaEePrEZ7O/7deP2KJhe0AwiSKYA8HOqETmMHUkmBe0=";
+  npmDepsHash = "sha256-Iyg8FpcTKf2UYHuK7mA3cTAqVaLcQPcS0YCa5Qf01Gc=";
  npmDeps = fetchNpmDeps {
    name = "${finalAttrs.pname}-${finalAttrs.version}-npm-deps";
    inherit (finalAttrs) src patches;
@@ -14,7 +14,6 @@
  darwin,
  makeDesktopItem,
  makeWrapper,
-  nodejs,
  nodejs-slim,
  removeReferencesTo,
  yarnBuildHook,
@@ -151,7 +150,8 @@ stdenv.mkDerivation (finalAttrs: {
      copyDesktopItems
      fakeGit
      makeWrapper
-      nodejs
+      nodejs-slim
+      nodejs-slim.npm
      (nodejs-slim.python.withPackages (ps: [ ps.setuptools ]))
      removeReferencesTo
      yarnBuildHook
@@ -200,7 +200,7 @@ stdenv.mkDerivation (finalAttrs: {

    yarn --offline --cwd tldraw postinstall

-    export npm_config_nodedir=${nodejs}
+    export npm_config_nodedir=${nodejs-slim}
    pushd packages/amplify
    npm rebuild --verbose
    popd
@@ -247,7 +247,7 @@ stdenv.mkDerivation (finalAttrs: {
    runHook preInstall

    # remove references to nodejs
-    find static/out/*/resources/app/node_modules -type f -executable -exec remove-references-to -t ${nodejs} '{}' \;
+    find static/out/*/resources/app/node_modules -type f -executable -exec remove-references-to -t ${nodejs-slim} '{}' \;
  ''
  + lib.optionalString stdenv.hostPlatform.isLinux ''
    install -Dm644 static/icons/logseq.png "$out/share/icons/hicolor/512x512/apps/logseq.png"
@@ -25,11 +25,11 @@ let
    nodejs = nodejs_20;
  };
  yarnConfigHook' = yarnConfigHook.override {
-    nodejs = nodejs_20;
+    nodejs-slim = nodejs_20;
    yarn = yarn';
  };
  yarnBuildHook' = yarnBuildHook.override {
-    nodejs = nodejs_20;
+    nodejs-slim = nodejs_20;
    yarn = yarn';
  };
  matrix-sdk-crypto-nodejs' = matrix-sdk-crypto-nodejs.override {
@@ -8,7 +8,7 @@
  catch2_3,
 }:
 stdenv.mkDerivation (finalAttrs: {
-  pname = "mcl";
+  pname = "mcl-cpp-utility-lib";
  version = "0.1.14";

  src = fetchFromGitHub {
@@ -8,18 +8,18 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "meilisearch";
-  version = "1.43.1";
+  version = "1.45.1";

  src = fetchFromGitHub {
    owner = "meilisearch";
    repo = "meilisearch";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-f8iz8qSIj5dJMPstUm0CbYOkPpZ2IIpIYbkVm+4F8V8=";
+    hash = "sha256-OB3KrWAZbyxBLRpwcsE/ibf2U3H2/V+2WyULeTf7M90=";
  };

  cargoBuildFlags = [ "--package=meilisearch" ];

-  cargoHash = "sha256-NB25eziZQCzVgtD+uCqJM3wTVrPGnhm58R0S2zfqqAE=";
+  cargoHash = "sha256-6zNKfy6KVxS9WZ3i9cgLPWXl2MKgpB6QQ7QdN7XyuUQ=";

  # Default features include mini dashboard which downloads something from the internet.
  buildNoDefaultFeatures = true;
@@ -6,7 +6,6 @@
  pkg-config,
  boost186,
  libsodium,
-  miniupnpc,
  openssl,
  python3,
  randomx,
@@ -39,13 +38,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "monero-cli";
-  version = "0.18.4.6";
+  version = "0.18.5.0";

  src = fetchFromGitHub {
    owner = "monero-project";
    repo = "monero";
    rev = "v${version}";
-    hash = "sha256-A7EqamADbTyK6l26foSXfZLH94OUUMsgi7jdsKRubXU=";
+    hash = "sha256-clw+7mZenWp58iA7fuEp4BPFH3KUwL53cC4IChIVh7w=";
  };

  patches = [
@@ -69,7 +68,6 @@ stdenv.mkDerivation rec {
  buildInputs = [
    boost186 # uses boost/asio/io_service.hpp
    libsodium
-    miniupnpc
    openssl
    randomx
    rapidjson
@@ -1,79 +1,11 @@
 diff --git a/external/CMakeLists.txt b/external/CMakeLists.txt
-index 538e4d215..cc4b0a346 100644
+index 5bdd5d9b4..3af6c5f5a 100644
 --- a/external/CMakeLists.txt
 +++ b/external/CMakeLists.txt
-@@ -35,26 +35,14 @@
- # ...except for FreeBSD, because FreeBSD is a special case that doesn't play well with
- # others.
- 
-find_package(Miniupnpc REQUIRED)
-
-message(STATUS "Using in-tree miniupnpc")
-set(UPNPC_NO_INSTALL TRUE CACHE BOOL "Disable miniupnp installation" FORCE)
-set(UPNPC_BUILD_SHARED OFF CACHE BOOL "Disable building shared library" FORCE)
-add_subdirectory(miniupnp/miniupnpc)
-set_property(TARGET libminiupnpc-static PROPERTY FOLDER "external")
-set_property(TARGET libminiupnpc-static PROPERTY POSITION_INDEPENDENT_CODE ON)
-if(MSVC)
-  set_property(TARGET libminiupnpc-static APPEND_STRING PROPERTY COMPILE_FLAGS " -wd4244 -wd4267")
-elseif(NOT MSVC)
-  set_property(TARGET libminiupnpc-static APPEND_STRING PROPERTY COMPILE_FLAGS " -Wno-undef -Wno-unused-result -Wno-unused-value")
-endif()
-if(CMAKE_SYSTEM_NAME MATCHES "NetBSD")
-	set_property(TARGET libminiupnpc-static APPEND_STRING PROPERTY COMPILE_FLAGS " -D_NETBSD_SOURCE")
-endif()
-
-set(UPNP_LIBRARIES "libminiupnpc-static" PARENT_SCOPE)
-+find_package(PkgConfig REQUIRED)
-+pkg_check_modules(MINIUPNPC REQUIRED miniupnpc)
-+link_libraries(${MINIUPNPC_LIBRARIES})
-+include_directories(${MINIUPNPC_INCLUDE_DIRS})
- 
-+find_package(RapidJSON)
- find_package(Unbound)
-+find_library(RANDOMX_LIBRARY randomx)
- 
- if(NOT UNBOUND_INCLUDE_DIR)
-   die("Could not find libunbound")
-@@ -70,4 +58,3 @@ endif()
+@@ -44,4 +44,5 @@ endif()
 add_subdirectory(db_drivers)
 add_subdirectory(easylogging++)
 add_subdirectory(qrcodegen)
 -add_subdirectory(randomx EXCLUDE_FROM_ALL)
-diff --git a/src/p2p/net_node.inl b/src/p2p/net_node.inl
-index 884a7b5fc..24c10334e 100644
--- a/src/p2p/net_node.inl
-+++ b/src/p2p/net_node.inl
-@@ -60,9 +60,9 @@
- #include "cryptonote_core/cryptonote_core.h"
- #include "net/parse.h"
- 
-#include <miniupnp/miniupnpc/miniupnpc.h>
-#include <miniupnp/miniupnpc/upnpcommands.h>
-#include <miniupnp/miniupnpc/upnperrors.h>
-+#include <miniupnpc/miniupnpc.h>
-+#include <miniupnpc/upnpcommands.h>
-+#include <miniupnpc/upnperrors.h>
- 
- #undef MONERO_DEFAULT_LOG_CATEGORY
- #define MONERO_DEFAULT_LOG_CATEGORY "net.p2p"
-@@ -2989,7 +2989,8 @@ namespace nodetool
-     UPNPUrls urls;
-     IGDdatas igdData;
-     char lanAddress[64];
-    result = UPNP_GetValidIGD(deviceList, &urls, &igdData, lanAddress, sizeof lanAddress);
-+    char wanAddress[64];
-+    result = UPNP_GetValidIGD(deviceList, &urls, &igdData, lanAddress, sizeof lanAddress, wanAddress, sizeof wanAddress);
-     freeUPNPDevlist(deviceList);
-     if (result > 0) {
-       if (result == 1) {
-@@ -3057,7 +3058,8 @@ namespace nodetool
-     UPNPUrls urls;
-     IGDdatas igdData;
-     char lanAddress[64];
-    result = UPNP_GetValidIGD(deviceList, &urls, &igdData, lanAddress, sizeof lanAddress);
-+    char wanAddress[64];
-+    result = UPNP_GetValidIGD(deviceList, &urls, &igdData, lanAddress, sizeof lanAddress, wanAddress, sizeof wanAddress);
-     freeUPNPDevlist(deviceList);
-     if (result > 0) {
-       if (result == 1) {
+find_library(RANDOMX_LIBRARY randomx)
+find_package(RapidJSON)
@@ -7,7 +7,6 @@
  libgcrypt,
  libgpg-error,
  libsodium,
-  miniupnpc,
  monero-cli,
  pkg-config,
  qt5,
@@ -28,13 +27,13 @@

 stdenv.mkDerivation rec {
  pname = "monero-gui";
-  version = "0.18.4.7";
+  version = "0.18.5.0";

  src = fetchFromGitHub {
    owner = "monero-project";
    repo = "monero-gui";
    rev = "v${version}";
-    hash = "sha256-22v4KwtmjIkeQXfMdxCQr6TUdAEih6xwtNPbuzpQDZk=";
+    hash = "sha256-uBZMBQ6Co1+H8DsyeL1vbjtVlKyIkJopKxHxr24BZv0=";
  };

  nativeBuildInputs = [
@@ -49,7 +48,6 @@ stdenv.mkDerivation rec {
    libgcrypt
    libgpg-error
    libsodium
-    miniupnpc
    qt5.qtbase
    qt5.qtdeclarative
    qt5.qtgraphicaleffects
@@ -79,7 +79,6 @@ stdenv.mkDerivation (finalAttrs: {
    license = lib.licenses.lgpl3;
    platforms = lib.platforms.unix;
    maintainers = with lib.maintainers; [
-      sjmackenzie
      bertof
    ];
  };
@@ -70,14 +70,9 @@ buildDotnetModule rec {
  fixupPhase = ''
    runHook preFixup

-    # Disabling error reporting.
-    # https://github.com/ppy/osu/commit/48434dd683d095c42c01def8ff7cb95ce0a85ce4
-    # Unhandled exception. System.ArgumentException: Invalid DSN: No public key provided.
-
    wrapProgram $out/bin/osu! \
      ${lib.optionalString nativeWayland "--set SDL_VIDEODRIVER wayland"} \
-      --set OSU_EXTERNAL_UPDATE_PROVIDER 1 \
-      --set OSU_DISABLE_ERROR_REPORTING 1
+      --set OSU_EXTERNAL_UPDATE_PROVIDER 1

    for i in 16 32 48 64 96 128 256 512 1024; do
      install -D ./assets/lazer.png $out/share/icons/hicolor/''${i}x$i/apps/osu.png
@@ -25,13 +25,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "reframe";
-  version = "1.15.1";
+  version = "1.15.2";

  src = fetchFromGitHub {
    owner = "AlynxZhou";
    repo = "reframe";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-3ZCLnmu5Idn4RsypJr+JNqIhT13/pq1Xi4wTidUgCqQ=";
+    hash = "sha256-R0l/sXRT+B3mb1SMoX9DLUbFP4lcTK2dVJox8OWwY6Y=";
    fetchSubmodules = true;
  };

@@ -1,30 +0,0 @@
-diff --git a/launcher/game/gui7/code.py b/launcher/game/gui7/code.py
-index 5c1b89f23c..c8ad04b6dd 100644
--- a/launcher/game/gui7/code.py
-+++ b/launcher/game/gui7/code.py
-@@ -243,9 +243,7 @@ def quote(s):
- 
-         self.update_defines(replacements)
- 
-    def write_target(self, filename):
-
-        target = os.path.join(self.p.prefix, filename)
-+    def write_target(self, target):
- 
-         if os.path.exists(target):
- 
-@@ -421,7 +419,7 @@ def generate_gui(self, fn, defines=False):
-             self.translate_comments()
-             self.add_code(fn)
- 
-        self.write_target(fn)
-+        self.write_target(os.path.join(self.p.prefix, fn))
- 
-     def generate_code(self, fn):
- 
-@@ -439,4 +437,4 @@ def generate_code(self, fn):
- 
-         self.add_code(fn)
- 
-        self.write_target(fn)
-+        self.write_target(target)
@@ -70,6 +70,7 @@ let
      sphinx
      sphinx-rtd-theme
      sphinx-rtd-dark-mode
+      sphinx-tabs
    ]
  );
  pythonRunTime = python312.withPackages (
@@ -85,14 +86,14 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "renpy";
-  # unstable version drops dependency on insecure package ecdsa
-  version = "8.5.2.26010301-unstable-2026-03-27";
+  # 8.5.3 tag is on fix branch, but we need new dependency lookup behavior (currently only on master branch)
+  version = "8.5.3.26051504-unstable-2026-05-17";

  src = fetchFromGitHub {
    owner = "renpy";
    repo = "renpy";
-    rev = "09eb6986ea9e5dbe64c9096ed48a638e593ea0ef";
-    hash = "sha256-w7tQbZCH7F0Npu8rD2UADxe/KzsTUdtIhJY6GH4YFAs=";
+    rev = "cb1a79e8d2e02936baaf9d3c6ec9ac28d68b9014";
+    hash = "sha256-gm+E5/fEgNFl+UU382QZpBAcOmUDhFbxj3XW/e21vxQ=";
  };

  __structuredAttrs = true;
@@ -128,14 +129,6 @@ stdenv.mkDerivation (finalAttrs: {
    # do not try to compile renpy files installed in nix store because we already compiled them at build phase
    ./dont-compile-system.patch

-    # catch error instead of crashing when trying to write steam_appid.txt to nix store
-    # https://github.com/renpy/renpy/pull/6976
-    ./steam-preinit-catch.patch
-
-    # fix write_target looking for wrong file locations when launcher creates new project
-    # https://github.com/renpy/renpy/pull/6978
-    ./new-project-prefix.patch
-
    # the distributed libs are not compatible with renpy built from source,
    # so patch the launcher to look for renpy files in renpy-dist (where bin distribution from upstream is copied to) instead of renpy
    ./distribute.patch
@@ -156,7 +149,7 @@ stdenv.mkDerivation (finalAttrs: {
    official = False
    nightly = False
    # Look at https://renpy.org/latest.html for what to put.
-    version_name = "In Good Health"
+    version_name = "We Can Go to the Moon"
    EOF
  '';

@@ -261,12 +254,12 @@ stdenv.mkDerivation (finalAttrs: {

    binSrc = fetchzip {
      url = "https://www.renpy.org/dl/${finalAttrs.passthru.semver}/renpy-${finalAttrs.passthru.semver}-sdk.tar.bz2";
-      hash = "sha256-wF6Z/lA8CyaCEZg1IqpZ4mG8CF8JgNHBf5KjKIOoKVI=";
+      hash = "sha256-l91zD0n/c5E80YfgZ/m5AbIj/RKL5OFosfwz7RHu7aQ=";
    };

    binSrcArm = fetchzip {
      url = "https://www.renpy.org/dl/${finalAttrs.passthru.semver}/renpy-${finalAttrs.passthru.semver}-sdkarm.tar.bz2";
-      hash = "sha256-DKXghs1XIRrtAGTifMx+7XAbxiqH7qYQiaKhBaO7PBA=";
+      hash = "sha256-51+swtUfDK0on9wVVXOyzJKxHtV6m4u9X1wvpp85stI=";
    };

    distributedRenpy =
@@ -1,18 +0,0 @@
-diff --git a/renpy/common/00steam.rpy b/renpy/common/00steam.rpy
-index 00581d850..ef00deee7 100644
--- a/renpy/common/00steam.rpy
-+++ b/renpy/common/00steam.rpy
-@@ -972,8 +972,11 @@ init -1499 python in achievement:
-         steam_appid_fn = os.path.join(os.path.dirname(sys.executable), "steam_appid.txt")
- 
-         if config.steam_appid is not None:
-            with open(steam_appid_fn, "w") as f:
-                f.write(str(config.steam_appid) + "\n")
-+            try:
-+                with open(steam_appid_fn, "w") as f:
-+                    f.write(str(config.steam_appid) + "\n")
-+            except Exception as e:
-+                renpy.write_log("Failed to write steam_appid.txt: %r", e)
-         else:
-             try:
-                 os.unlink(steam_appid_fn)
@@ -1,13 +1,13 @@
 diff --git a/renpy/exports/__init__.py b/renpy/exports/__init__.py
-index 7265f1b32..dc0d0acc1 100644
+index f95c8d0ad..e312c99c5 100644
 --- a/renpy/exports/__init__.py
 +++ b/renpy/exports/__init__.py
-@@ -573,6 +573,7 @@ from renpy.exports.scriptexports import (
-     load_language,
-     load_module,
-     load_string,
-+    loaded_modules,
-     munged_filename,
+@@ -578,6 +578,7 @@ from renpy.exports.scriptexports import (
+     load_language as load_language,
+     load_module as load_module,
+     load_string as load_string,
+    loaded_modules as loaded_modules,
+     munged_filename as munged_filename,
 )
 
 diff --git a/renpy/main.py b/renpy/main.py
@@ -3,6 +3,11 @@

 set -euo pipefail

+# so that update bot doesn't try to update renpyMinimal
+if [[ -n "${UPDATE_NIX_ATTR_PATH:-}" ]] && [[ "${UPDATE_NIX_ATTR_PATH:-}" != renpy ]];
+  exit
+fi
+
 attr() {
  nix-instantiate --eval -A renpy.$1 | tr -d '"'
 }
@@ -191,10 +191,6 @@ stdenv.mkDerivation (finalAttrs: {

  doCheck = true;

-  preCheck = lib.optionalString stdenv.hostPlatform.isDarwin ''
-    export DYLD_FALLBACK_LIBRARY_PATH=${lib.getLib onnxruntime}/lib
-  '';
-
  # Use ctest directly because the default `make check` target includes clang-tidy.
  checkPhase = ''
    runHook preCheck
@@ -206,10 +202,6 @@ stdenv.mkDerivation (finalAttrs: {
    mkdir -p $python
    cp -r ../sherpa-onnx/python/sherpa_onnx $python/
    rm $out/lib/_sherpa_onnx*.so
-    ${lib.optionalString stdenv.hostPlatform.isDarwin ''
-      install_name_tool -add_rpath ${lib.getLib onnxruntime}/lib \
-        $python/sherpa_onnx/lib/_sherpa_onnx*.so
-    ''}
  '';

  passthru = {
@@ -4,8 +4,8 @@
  nixosTests,
  openssl,
  stdenv,
-  systemd,
-  systemdSupport ? lib.meta.availableOn stdenv.hostPlatform systemd,
+  systemdLibs,
+  systemdSupport ? lib.meta.availableOn stdenv.hostPlatform systemdLibs,
  mimalloc,
  mimallocSupport ? false,
 }:
@@ -33,7 +33,7 @@ stdenv.mkDerivation (finalAttrs: {
    openssl
  ]
  ++ lib.optionals systemdSupport [
-    systemd
+    systemdLibs
  ]
  ++ lib.optionals mimallocSupport [
    mimalloc
@@ -14,13 +14,13 @@ let
 in
 buildNpmPackage (finalAttrs: {
  pname = "sub-store-frontend";
-  version = "2.17.8";
+  version = "2.17.19";

  src = fetchFromGitHub {
    owner = "sub-store-org";
    repo = "Sub-Store-Front-End";
    tag = finalAttrs.version;
-    hash = "sha256-gHAs24K3RvNrggrnnAhbRnebwSPTtY8l4vuNHsh/ptg=";
+    hash = "sha256-fhJy/bErS9DHjjX5R+6KjqDNYyPOQaYPr54CS1vd3zc=";
  };

  nativeBuildInputs = [
@@ -0,0 +1,32 @@
+{
+  fetchFromGitHub,
+  lib,
+  rustPlatform,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "swpui";
+  version = "0.8.0";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "beeb";
+    repo = "swpui";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-w9JQPSIMQUAUu6wkOH7wZH9ZV8eGSieXHlrppovicjY=";
+  };
+
+  cargoHash = "sha256-JWeUv98zcgVQl1qXqD9wmpu4Dk0Qan0F9ypvcFpRxRM=";
+
+  meta = {
+    description = "TUI utility to search and replace with a focus on ergonomics, speed and case-awareness";
+    homepage = "https://github.com/beeb/swpui";
+    changelog = "https://github.com/beeb/swpui/blob/v${finalAttrs.version}/CHANGELOG.md";
+    license = with lib.licenses; [
+      mit
+      asl20
+    ];
+    maintainers = with lib.maintainers; [ beeb ];
+    mainProgram = "swp";
+  };
+})
@@ -14,13 +14,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "syshud";
-  version = "0-unstable-2026-05-11";
+  version = "0-unstable-2026-05-28";

  src = fetchFromGitHub {
    owner = "System64fumo";
    repo = "syshud";
-    rev = "5781eb0feb081a5fe8f1f364c4f29b9b403f89d4";
-    hash = "sha256-fpJmxz4+Gk1x4KWT5Fc/g3ypu6i0LZEqBrMpJ8GIgKs=";
+    rev = "4d0c4775fe38a14bd68fc654f8cc4ad624eed92a";
+    hash = "sha256-3DqBg3RUaEJCG5o/pt2B/+m/8X+Ifu9uHLJpjzLo9t8=";
  };

  postPatch = ''
@@ -24,7 +24,7 @@

 buildGoModule (finalAttrs: {
  pname = "tailscale";
-  version = "1.98.2";
+  version = "1.98.3";

  outputs = [
    "out"
@@ -35,7 +35,7 @@ buildGoModule (finalAttrs: {
    owner = "tailscale";
    repo = "tailscale";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-y3JdVYnvfqrAlubnjrM2FD+PRXlNEzOM3yggSczb+rA=";
+    hash = "sha256-p+NEJVLLcwUNf3ZCXZEXAnTA5Pd6FlneMBZ0BcDYgXk=";
  };

  vendorHash = "sha256-mbxLXR2TBgiwyVGfLmMR5xWk+0f66mPDas95Wla70Lk=";
@@ -6,7 +6,7 @@
  nix-update-script,
 }:
 let
-  version = "2.17.3";
+  version = "2.17.4";
 in
 buildGoLatestModule {
  pname = "wakapi";
@@ -16,10 +16,10 @@ buildGoLatestModule {
    owner = "muety";
    repo = "wakapi";
    tag = version;
-    hash = "sha256-kbh9YoD5Z4YoYsRCKxL7meHtjsfAKRXXKYvdVCrym/k=";
+    hash = "sha256-pcKHDZH8CvRpKPaLyWPsHx7/U50xEq8JzbnEQG/9uYI=";
  };

-  vendorHash = "sha256-jD8A28dgJs9CLB4Md8y8D9m1/BobzjIa4VoetYqU+y4=";
+  vendorHash = "sha256-bXIbHSclJ61D3u1+nXEIRhzw611uosnnXWqT9boDMP0=";

  # Not a go module required by the project, contains development utilities
  excludedPackages = [ "scripts" ];
@@ -8,13 +8,13 @@

 buildGoModule (finalAttrs: {
  pname = "woodpecker-plugin-git";
-  version = "2.9.1";
+  version = "2.9.2";

  src = fetchFromGitHub {
    owner = "woodpecker-ci";
    repo = "plugin-git";
    tag = finalAttrs.version;
-    hash = "sha256-Au+eaJzcjARQsWThIK3N1SNkBl39mb3xx0d8D3VyXOU=";
+    hash = "sha256-vfHYEZpOAdf88Wqf6/PtbVsymKmQhBr0y2UOGmTGdjY=";
  };

  vendorHash = "sha256-zCcYAWO0hn6iLxTxOsjn2bS0+sHuzpq3K24N9jd+qPY=";
@@ -14,16 +14,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "wpaperd";
-  version = "1.2.2";
+  version = "1.3.0";

  src = fetchFromGitHub {
    owner = "danyspin97";
    repo = "wpaperd";
    tag = finalAttrs.version;
-    hash = "sha256-6XVpjTdo/wI65Lzd02fjqir7a28EEBBp3794zLgxayY=";
+    hash = "sha256-gKO2GDR21LPx+09YUnV/wMs1uVBRDHkbY6GonTmTPPA=";
  };

-  cargoHash = "sha256-d8jzoNCn9J36SE4tQZ1orgOfFGbhVtHaaO940b3JxmQ=";
+  cargoHash = "sha256-dfmezhRdnKx53y9ETx2nJrILz/zgu07RuqqmGdRyhdY=";

  nativeBuildInputs = [
    pkg-config
@@ -11,16 +11,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "yara-x";
-  version = "1.16.0";
+  version = "1.17.0";

  src = fetchFromGitHub {
    owner = "VirusTotal";
    repo = "yara-x";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-n/AhEKlQmjbTtPncal6NDn7BcXb4HfnkuJctvDjW2V0=";
+    hash = "sha256-8P3fNLENfoGD+FMeCXX8UwoMzI92JkjV/f3G7d+Li3Y=";
  };

-  cargoHash = "sha256-MbMjrrPN1ctlYoE6R5p8g354OOmu4NplcGwSm3IcHRI=";
+  cargoHash = "sha256-ifXe0LKEYMzCo0FIg2E5mCQRUCOlu3nvK2XN/3GM9bk=";

  env = {
    CARGO_PROFILE_RELEASE_LTO = "fat";
@@ -144,7 +144,6 @@ stdenv.mkDerivation {
    homepage = "https://www.zerotier.com";
    license = if enableUnfree then lib.licenses.unfree else lib.licenses.mpl20;
    maintainers = with lib.maintainers; [
-      sjmackenzie
      zimbatm
      obadz
      danielfullmer
@@ -851,6 +851,7 @@ stdenv.mkDerivation (finalAttrs: {
        "https://docs.python.org/release/${version}/whatsnew/changelog.html"
      else
        "https://docs.python.org/${majorMinor}/whatsnew/changelog.html#python-${dashedVersion}";
+    donationPage = "https://www.python.org/psf/donations/";
    description = "High-level dynamically-typed programming language";
    longDescription = ''
      Python is a remarkably powerful dynamic programming language that
@@ -391,6 +391,7 @@ let
      meta = {
        homepage = "https://www.openssl.org/";
        changelog = "https://github.com/openssl/openssl/blob/openssl-${version}/CHANGES.md";
+        donationPage = "https://openssl.foundation/donate/ways-to-give";
        description = "Cryptographic library that implements the SSL and TLS protocols";
        license = lib.licenses.openssl;
        mainProgram = "openssl";
@@ -8,6 +8,7 @@
  ethernet,
  ipaddr,
  logs,
+  lru,
  lwt,
  macaddr,
  mirage-sleep,
@@ -18,21 +19,20 @@

 buildDunePackage (finalAttrs: {
  pname = "arp";
-  version = "4.0.0";
+  version = "4.1.0";

  src = fetchurl {
    url = "https://github.com/mirage/arp/releases/download/v${finalAttrs.version}/arp-${finalAttrs.version}.tbz";
-    hash = "sha256-C2Bh/2NwZqCJEidCnkhwRMoW3AsbQtvwdFh9IiJkDaU=";
+    hash = "sha256-AvjxveUgSRBNhZQvCp1oa+JfEXSIronECk4nNos8hl0=";
  };

-  minimalOCamlVersion = "4.08";
-
  propagatedBuildInputs = [
    cstruct
    duration
    ethernet
    ipaddr
    logs
+    lru
    lwt
    macaddr
    mirage-sleep
@@ -1,7 +1,6 @@
 {
  lib,
  buildDunePackage,
-  fetchpatch,
  rpclib,
  alcotest,
  ppxlib,
@@ -14,13 +13,6 @@ buildDunePackage {

  inherit (rpclib) version src;

-  minimalOCamlVersion = "4.08";
-
-  patches = lib.optional (lib.versionAtLeast ppxlib.version "0.36") (fetchpatch {
-    url = "https://github.com/mirage/ocaml-rpc/commit/678b7c0e59f6add174f2a732861be21c3e9583d0.patch";
-    hash = "sha256-6Vl4/C02NQ/nPn+h9I/eT86R7GLZ/C8nSqBs4Ywzhwc=";
-  });
-
  propagatedBuildInputs = [
    ppxlib
    rpclib
--- a/Show More
+++ b/Show More