Merge 8158addeae into haskell-updates

2025-05-25 00:25:29 +00:00
parent 4a5acc987b 8158addeae
commit fa0b194f3c
271 changed files with 20412 additions and 15042 deletions
@@ -34,9 +34,9 @@ body:
        > If you are using an older version, please update to the latest stable version and check if the issue persists before continuing this bug report.
      options:
        - "Please select a version."
-        - "- Unstable (25.05)"
-        - "- Stable (24.11)"
-        - "- Previous Stable (24.05)"
+        - "- Unstable (25.11)"
+        - "- Stable (25.05)"
+        - "- Previous Stable (24.11)"
      default: 0
    validations:
      required: true
@@ -34,9 +34,9 @@ body:
        > If you are using an older version, please update to the latest stable version and check if the issue persists before continuing this bug report.
      options:
        - "Please select a version."
-        - "- Unstable (25.05)"
-        - "- Stable (24.11)"
-        - "- Previous Stable (24.05)"
+        - "- Unstable (25.11)"
+        - "- Stable (25.05)"
+        - "- Previous Stable (24.11)"
      default: 0
    validations:
      required: true
@@ -34,9 +34,9 @@ body:
        > If you are using an older version, please [update to the latest stable version](https://nixos.org/download) and check if the issue persists before continuing this bug report.
      options:
        - "Please select a version."
-        - "- Unstable (25.05)"
-        - "- Stable (24.11)"
-        - "- Previous Stable (24.05)"
+        - "- Unstable (25.11)"
+        - "- Stable (25.05)"
+        - "- Previous Stable (24.11)"
      default: 0
    validations:
      required: true
@@ -35,9 +35,9 @@ body:
        > If you are purposefully trying to build an ancient version of a package in an older Nixpkgs, please coordinate with the [NixOS Archivists](https://matrix.to/#/#archivists:nixos.org).
      options:
        - "Please select a version."
-        - "- Unstable (25.05)"
-        - "- Stable (24.11)"
-        - "- Previous Stable (24.05)"
+        - "- Unstable (25.11)"
+        - "- Stable (25.05)"
+        - "- Previous Stable (24.11)"
      default: 0
    validations:
      required: true
@@ -35,9 +35,9 @@ body:
        > If the package has been updated in unstable, but you believe the update should be backported to the stable release of Nixpkgs, please file the '**Request: backport to stable**' form instead.
      options:
        - "Please select a version."
-        - "- Unstable (25.05)"
-        - "- Stable (24.11)"
-        - "- Previous Stable (24.05)"
+        - "- Unstable (25.11)"
+        - "- Stable (25.05)"
+        - "- Previous Stable (24.11)"
      default: 0
    validations:
      required: true
@@ -34,9 +34,9 @@ body:
        > If you are using an older or stable version, please update to the latest **unstable** version and check if the module still does not exist before continuing this request.
      options:
        - "Please select a version."
-        - "- Unstable (25.05)"
-        - "- Stable (24.11)"
-        - "- Previous Stable (24.05)"
+        - "- Unstable (25.11)"
+        - "- Stable (25.05)"
+        - "- Previous Stable (24.11)"
      default: 0
    validations:
      required: true
@@ -0,0 +1,66 @@
+name: Get merge commit
+
+description: 'Checks whether the Pull Request is mergeable and returns two commit hashes: The result of a temporary merge of the head branch into the target branch ("merged"), and the parent of that commit on the target branch ("target"). Handles push events and merge conflicts gracefully.'
+
+outputs:
+  mergedSha:
+    description: "The merge commit SHA"
+    value: ${{ fromJSON(steps.merged.outputs.result).mergedSha }}
+  targetSha:
+    description: "The target commit SHA"
+    value: ${{ fromJSON(steps.merged.outputs.result).targetSha }}
+
+runs:
+  using: composite
+  steps:
+    - id: merged
+      uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+      with:
+        script: |
+          if (context.eventName == 'push') return { mergedSha: context.sha }
+
+          for (const retryInterval of [5, 10, 20, 40, 80]) {
+            console.log("Checking whether the pull request can be merged...")
+            const prInfo = (await github.rest.pulls.get({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              pull_number: context.payload.pull_request.number
+            })).data
+
+            if (prInfo.state != 'open') throw new Error ("PR is not open anymore.")
+
+            if (prInfo.mergeable == null) {
+              console.log(`GitHub is still computing whether this PR can be merged, waiting ${retryInterval} seconds before trying again...`)
+              await new Promise(resolve => setTimeout(resolve, retryInterval * 1000))
+              continue
+            }
+
+            if (prInfo.mergeable) {
+              console.log("The PR can be merged.")
+
+              const mergedSha = prInfo.merge_commit_sha
+              const targetSha = (await github.rest.repos.getCommit({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                ref: prInfo.merge_commit_sha
+              })).data.parents[0].sha
+
+              console.log(`Checking the commits:\nmerged:${mergedSha}\ntarget:${targetSha}`)
+
+              return { mergedSha, targetSha }
+            } else {
+              console.log("The PR has a merge conflict.")
+
+              const mergedSha = prInfo.head.sha
+              const targetSha = (await github.rest.repos.compareCommitsWithBasehead({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                basehead: `${prInfo.base.sha}...${prInfo.head.sha}`
+              })).data.merge_base_commit.sha
+
+              console.log(`Checking the commits:\nmerged:${mergedSha}\ntarget:${targetSha}`)
+
+              return { mergedSha, targetSha }
+            }
+          }
+          throw new Error("Not retrying anymore. It's likely that GitHub is having internal issues: check https://www.githubstatus.com.")
@@ -9,7 +9,9 @@ on:
  pull_request_target:
    types: [closed, labeled]

-permissions: {}
+permissions:
+  contents: read
+  pull-requests: write

 jobs:
  backport:
@@ -48,7 +50,8 @@ jobs:
      - name: "Add 'has: port to stable' label"
        if: steps.backport.outputs.created_pull_numbers != ''
        env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          # Not the app on purpose to avoid triggering another workflow run after adding this label
+          GH_TOKEN: ${{ github.token }}
          REPOSITORY: ${{ github.repository }}
          NUMBER: ${{ github.event.number }}
        run: |
@@ -9,18 +9,20 @@ on:
 permissions: {}

 jobs:
-  get-merge-commit:
-    uses: ./.github/workflows/get-merge-commit.yml
-
  nixos:
    name: fmt-check
    runs-on: ubuntu-24.04-arm
-    needs: get-merge-commit
-    if: needs.get-merge-commit.outputs.mergedSha
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
-          ref: ${{ needs.get-merge-commit.outputs.mergedSha }}
+          sparse-checkout: .github/actions
+      - name: Check if the PR can be merged and get the test merge commit
+        uses: ./.github/actions/get-merge-commit
+        id: get-merge-commit
+
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          ref: ${{ steps.get-merge-commit.outputs.mergedSha }}

      - uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31
        with:
@@ -32,7 +32,14 @@ jobs:
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
-          ref: refs/pull/${{ github.event.pull_request.number }}/merge
+          sparse-checkout: .github/actions
+      - name: Check if the PR can be merged and get the test merge commit
+        uses: ./.github/actions/get-merge-commit
+        id: get-merge-commit
+
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          ref: ${{ steps.get-merge-commit.outputs.mergedSha }}

      - uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31

@@ -37,17 +37,19 @@ env:
  DRY_MODE: ${{ github.event.pull_request.draft && '1' || '' }}

 jobs:
-  get-merge-commit:
-    if: github.repository_owner == 'NixOS'
-    uses: ./.github/workflows/get-merge-commit.yml
-
  # Check that code owners is valid
  check:
    name: Check
    runs-on: ubuntu-24.04-arm
-    needs: get-merge-commit
-    if: github.repository_owner == 'NixOS' && needs.get-merge-commit.outputs.mergedSha
+    if: github.repository_owner == 'NixOS'
    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          sparse-checkout: .github/actions
+      - name: Check if the PR can be merged and get the test merge commit
+        uses: ./.github/actions/get-merge-commit
+        id: get-merge-commit
+
      - uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31

      - uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16
@@ -77,12 +79,11 @@ jobs:

      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
-          ref: ${{ needs.get-merge-commit.outputs.mergedSha }}
+          ref: ${{ steps.get-merge-commit.outputs.mergedSha }}
          path: pr

      - name: Validate codeowners
        if: steps.app-token.outputs.token
-        run: result/bin/codeowners-validator
        env:
          OWNERS_FILE: pr/${{ env.OWNERS_FILE }}
          GITHUB_ACCESS_TOKEN: ${{ steps.app-token.outputs.token }}
@@ -90,6 +91,7 @@ jobs:
          OWNER_CHECKER_REPOSITORY: ${{ github.repository }}
          # Set this to "notowned,avoid-shadowing" to check that all files are owned by somebody
          EXPERIMENTAL_CHECKS: "avoid-shadowing"
+        run: result/bin/codeowners-validator

  # Request reviews from code owners
  request:
@@ -118,6 +120,6 @@ jobs:

      - name: Request reviews
        if: steps.app-token.outputs.token
-        run: result/bin/request-code-owner-reviews.sh ${{ github.repository }} ${{ github.event.number }} "$OWNERS_FILE"
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+        run: result/bin/request-code-owner-reviews.sh ${{ github.repository }} ${{ github.event.number }} "$OWNERS_FILE"
@@ -9,18 +9,21 @@ on:
 permissions: {}

 jobs:
-  get-merge-commit:
-    uses: ./.github/workflows/get-merge-commit.yml
-
  eval-aliases:
    name: Eval nixpkgs with aliases enabled
    runs-on: ubuntu-24.04-arm
-    needs: [ get-merge-commit ]
    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          sparse-checkout: .github/actions
+      - name: Check if the PR can be merged and get the test merge commit
+        uses: ./.github/actions/get-merge-commit
+        id: get-merge-commit
+
      - name: Check out the PR at the test merge commit
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
-          ref: ${{ needs.get-merge-commit.outputs.mergedSha }}
+          ref: ${{ steps.get-merge-commit.outputs.mergedSha }}
          path: nixpkgs

      - name: Install Nix
@@ -19,17 +19,36 @@ on:
 permissions: {}

 jobs:
-  get-merge-commit:
-    uses: ./.github/workflows/get-merge-commit.yml
+  prepare:
+    name: Prepare
+    runs-on: ubuntu-24.04-arm
+    outputs:
+      mergedSha: ${{ steps.get-merge-commit.outputs.mergedSha }}
+      targetSha: ${{ steps.get-merge-commit.outputs.targetSha }}
+      systems: ${{ steps.systems.outputs.systems }}
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          sparse-checkout: |
+            .github/actions
+            ci/supportedSystems.json
+      - name: Check if the PR can be merged and get the test merge commit
+        uses: ./.github/actions/get-merge-commit
+        id: get-merge-commit
+
+      - name: Load supported systems
+        id: systems
+        run: |
+          echo "systems=$(jq -c <ci/supportedSystems.json)" >> "$GITHUB_OUTPUT"

  outpaths:
    name: Outpaths
    runs-on: ubuntu-24.04-arm
-    needs: [ get-merge-commit ]
+    needs: [ prepare ]
    strategy:
      fail-fast: false
      matrix:
-        system: ${{ fromJSON(needs.get-merge-commit.outputs.systems) }}
+        system: ${{ fromJSON(needs.prepare.outputs.systems) }}
    steps:
      - name: Enable swap
        run: |
@@ -41,7 +60,7 @@ jobs:
      - name: Check out the PR at the test merge commit
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
-          ref: ${{ needs.get-merge-commit.outputs.mergedSha }}
+          ref: ${{ needs.prepare.outputs.mergedSha }}
          path: nixpkgs

      - name: Install Nix
@@ -67,7 +86,7 @@ jobs:
  process:
    name: Process
    runs-on: ubuntu-24.04-arm
-    needs: [ outpaths, get-merge-commit ]
+    needs: [ prepare, outpaths ]
    outputs:
      targetRunId: ${{ steps.targetRunId.outputs.targetRunId }}
    steps:
@@ -76,11 +95,12 @@ jobs:
        with:
          pattern: intermediate-*
          path: intermediate
+          merge-multiple: true

      - name: Check out the PR at the test merge commit
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
-          ref: ${{ needs.get-merge-commit.outputs.mergedSha }}
+          ref: ${{ needs.prepare.outputs.mergedSha }}
          fetch-depth: 2
          path: nixpkgs

@@ -102,8 +122,12 @@ jobs:
          path: prResult/*

      - name: Get target run id
-        if: needs.get-merge-commit.outputs.targetSha
+        if: needs.prepare.outputs.targetSha
        id: targetRunId
+        env:
+          REPOSITORY: ${{ github.repository }}
+          TARGET_SHA: ${{ needs.prepare.outputs.targetSha }}
+          GH_TOKEN: ${{ github.token }}
        run: |
          # Get the latest eval.yml workflow run for the PR's target commit
          if ! run=$(gh api --method GET /repos/"$REPOSITORY"/actions/workflows/eval.yml/runs \
@@ -129,24 +153,23 @@ jobs:
          fi

          echo "targetRunId=$runId" >> "$GITHUB_OUTPUT"
-        env:
-          REPOSITORY: ${{ github.repository }}
-          TARGET_SHA: ${{ needs.get-merge-commit.outputs.targetSha }}
-          GH_TOKEN: ${{ github.token }}

      - uses: actions/download-artifact@v4
        if: steps.targetRunId.outputs.targetRunId
        with:
          name: result
          path: targetResult
+          merge-multiple: true
          github-token: ${{ github.token }}
          run-id: ${{ steps.targetRunId.outputs.targetRunId }}

      - name: Compare against the target branch
        if: steps.targetRunId.outputs.targetRunId
+        env:
+          AUTHOR_ID: ${{ github.event.pull_request.user.id }}
        run: |
-          git -C nixpkgs worktree add ../target ${{ needs.get-merge-commit.outputs.targetSha }}
-          git -C nixpkgs diff --name-only ${{ needs.get-merge-commit.outputs.targetSha }} \
+          git -C nixpkgs worktree add ../target ${{ needs.prepare.outputs.targetSha }}
+          git -C nixpkgs diff --name-only ${{ needs.prepare.outputs.targetSha }} \
            | jq --raw-input --slurp 'split("\n")[:-1]' > touched-files.json

          # Use the target branch to get accurate maintainer info
@@ -158,8 +181,6 @@ jobs:
            -o comparison

          cat comparison/step-summary.md >> "$GITHUB_STEP_SUMMARY"
-        env:
-          AUTHOR_ID: ${{ github.event.pull_request.user.id }}

      - name: Upload the combined results
        if: steps.targetRunId.outputs.targetRunId
@@ -172,7 +193,7 @@ jobs:
  tag:
    name: Tag
    runs-on: ubuntu-24.04-arm
-    needs: [ get-merge-commit, process ]
+    needs: [ prepare, process ]
    if: needs.process.outputs.targetRunId
    permissions:
      pull-requests: write
@@ -204,7 +225,7 @@ jobs:
      - name: Check out Nixpkgs at the base commit
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
-          ref: ${{ needs.get-merge-commit.outputs.targetSha }}
+          ref: ${{ needs.prepare.outputs.targetSha }}
          path: base
          sparse-checkout: ci

@@ -213,6 +234,10 @@ jobs:

      - name: Labelling pull request
        if: ${{ github.event_name == 'pull_request_target' && github.repository_owner == 'NixOS' }}
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPOSITORY: ${{ github.repository }}
+          NUMBER: ${{ github.event.number }}
        run: |
          # Get all currently set labels that we manage
          gh api \
@@ -241,13 +266,12 @@ jobs:
              -f "labels[]=$toAdd"
          done < <(comm -13 before after)

-        env:
-          GH_TOKEN: ${{ github.token }}
-          REPOSITORY: ${{ github.repository }}
-          NUMBER: ${{ github.event.number }}
-
      - name: Add eval summary to commit statuses
        if: ${{ github.event_name == 'pull_request_target' && github.repository_owner == 'NixOS' }}
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+          NUMBER: ${{ github.event.number }}
        run: |
          description=$(jq -r '
          "Package: added " + (.attrdiff.added | length | tostring) +
@@ -261,20 +285,9 @@ jobs:
            -H "Accept: application/vnd.github+json" -H "X-GitHub-Api-Version: 2022-11-28" \
            "/repos/$GITHUB_REPOSITORY/statuses/$PR_HEAD_SHA" \
            -f "context=Eval / Summary" -f "state=success" -f "description=$description" -f "target_url=$target_url"
-        env:
-          GH_TOKEN: ${{ github.token }}
-          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
-          NUMBER: ${{ github.event.number }}

      - name: Requesting maintainer reviews
        if: ${{ steps.app-token.outputs.token && github.repository_owner == 'NixOS' }}
-        run: |
-          # maintainers.json contains GitHub IDs. Look up handles to request reviews from.
-          # There appears to be no API to request reviews based on GitHub IDs
-          jq -r 'keys[]' comparison/maintainers.json \
-            | while read -r id; do gh api /user/"$id" --jq .login; done \
-            | GH_TOKEN=${{ steps.app-token.outputs.token }} result/bin/request-reviewers.sh "$REPOSITORY" "$NUMBER" "$AUTHOR"
-
        env:
          GH_TOKEN: ${{ github.token }}
          REPOSITORY: ${{ github.repository }}
@@ -282,3 +295,9 @@ jobs:
          AUTHOR: ${{ github.event.pull_request.user.login }}
          # Don't request reviewers on draft PRs
          DRY_MODE: ${{ github.event.pull_request.draft && '1' || '' }}
+        run: |
+          # maintainers.json contains GitHub IDs. Look up handles to request reviews from.
+          # There appears to be no API to request reviews based on GitHub IDs
+          jq -r 'keys[]' comparison/maintainers.json \
+            | while read -r id; do gh api /user/"$id" --jq .login; done \
+            | GH_TOKEN=${{ steps.app-token.outputs.token }} result/bin/request-reviewers.sh "$REPOSITORY" "$NUMBER" "$AUTHOR"
@@ -1,58 +0,0 @@
-name: Get merge commit
-
-on:
-  pull_request:
-    paths:
-      - .github/workflows/get-merge-commit.yml
-  workflow_call:
-    outputs:
-      mergedSha:
-        description: "The merge commit SHA"
-        value: ${{ jobs.resolve-merge-commit.outputs.mergedSha }}
-      targetSha:
-        description: "The target commit SHA"
-        value: ${{ jobs.resolve-merge-commit.outputs.targetSha }}
-      systems:
-        description: "The supported systems"
-        value: ${{ jobs.resolve-merge-commit.outputs.systems }}
-
-permissions: {}
-
-jobs:
-  resolve-merge-commit:
-    runs-on: ubuntu-24.04-arm
-    outputs:
-      mergedSha: ${{ steps.merged.outputs.mergedSha }}
-      targetSha: ${{ steps.merged.outputs.targetSha }}
-      systems: ${{ steps.systems.outputs.systems }}
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          path: base
-          sparse-checkout: ci
-
-      - name: Check if the PR can be merged and get the test merge commit
-        id: merged
-        env:
-          GH_TOKEN: ${{ github.token }}
-          GH_EVENT: ${{ github.event_name }}
-        run: |
-          case "$GH_EVENT" in
-            push)
-              echo "mergedSha=${{ github.sha }}" >> "$GITHUB_OUTPUT"
-              ;;
-            pull_request*)
-              if commits=$(base/ci/get-merge-commit.sh ${{ github.repository }} ${{ github.event.number }}); then
-                echo -e "Checking the commits:\n$commits"
-                echo "$commits" >> "$GITHUB_OUTPUT"
-              else
-                # Skipping so that no notifications are sent
-                echo "Skipping the rest..."
-              fi
-              ;;
-          esac
-
-      - name: Load supported systems
-        id: systems
-        run: |
-          echo "systems=$(jq -c <base/ci/supportedSystems.json)" >> "$GITHUB_OUTPUT"
@@ -12,18 +12,20 @@ on:
 permissions: {}

 jobs:
-  get-merge-commit:
-    uses: ./.github/workflows/get-merge-commit.yml
-
  nixpkgs-lib-tests:
    name: nixpkgs-lib-tests
    runs-on: ubuntu-24.04
-    needs: get-merge-commit
-    if: needs.get-merge-commit.outputs.mergedSha
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
-          ref: ${{ needs.get-merge-commit.outputs.mergedSha }}
+          sparse-checkout: .github/actions
+      - name: Check if the PR can be merged and get the test merge commit
+        uses: ./.github/actions/get-merge-commit
+        id: get-merge-commit
+
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          ref: ${{ steps.get-merge-commit.outputs.mergedSha }}

      - uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31
        with:
@@ -34,7 +34,14 @@ jobs:
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
-          ref: refs/pull/${{ github.event.pull_request.number }}/merge
+          sparse-checkout: .github/actions
+      - name: Check if the PR can be merged and get the test merge commit
+        uses: ./.github/actions/get-merge-commit
+        id: get-merge-commit
+
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          ref: ${{ steps.get-merge-commit.outputs.mergedSha }}

      - uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31
        with:
@@ -21,7 +21,14 @@ jobs:
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
-          ref: refs/pull/${{ github.event.pull_request.number }}/merge
+          sparse-checkout: .github/actions
+      - name: Check if the PR can be merged and get the test merge commit
+        uses: ./.github/actions/get-merge-commit
+        id: get-merge-commit
+
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          ref: ${{ steps.get-merge-commit.outputs.mergedSha }}

      - uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31
        with:
@@ -9,18 +9,21 @@ on:
 permissions: {}

 jobs:
-  get-merge-commit:
-    uses: ./.github/workflows/get-merge-commit.yml
-
  tests:
    name: nix-files-parseable-check
    runs-on: ubuntu-24.04-arm
-    needs: get-merge-commit
-    if: "needs.get-merge-commit.outputs.mergedSha && !contains(github.event.pull_request.title, '[skip treewide]')"
+    if: "!contains(github.event.pull_request.title, '[skip treewide]')"
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
-          ref: ${{ needs.get-merge-commit.outputs.mergedSha }}
+          sparse-checkout: .github/actions
+      - name: Check if the PR can be merged and get the test merge commit
+        uses: ./.github/actions/get-merge-commit
+        id: get-merge-commit
+
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          ref: ${{ steps.get-merge-commit.outputs.mergedSha }}

      - uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31
        with:
@@ -17,21 +17,23 @@ permissions: {}
 # There is a feature request for suppressing notifications on concurrency-canceled runs: https://github.com/orgs/community/discussions/13015

 jobs:
-  get-merge-commit:
-    uses: ./.github/workflows/get-merge-commit.yml
-
  check:
    name: nixpkgs-vet
    # This needs to be x86_64-linux, because we depend on the tooling being pre-built in the GitHub releases.
    runs-on: ubuntu-24.04
    # This should take 1 minute at most, but let's be generous. The default of 6 hours is definitely too long.
    timeout-minutes: 10
-    needs: get-merge-commit
-    if: needs.get-merge-commit.outputs.mergedSha
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
-          ref: ${{ needs.get-merge-commit.outputs.mergedSha }}
+          sparse-checkout: .github/actions
+      - name: Check if the PR can be merged and get the test merge commit
+        uses: ./.github/actions/get-merge-commit
+        id: get-merge-commit
+
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          ref: ${{ steps.get-merge-commit.outputs.mergedSha }}
          # Fetches the merge commit and its parents
          fetch-depth: 2

@@ -1,9 +1,9 @@
 <p align="center">
  <a href="https://nixos.org">
    <picture>
-      <source media="(prefers-color-scheme: light)" srcset="https://nixos.org/logo/nixos-hires.png">
+      <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/NixOS/nixos-artwork/master/logo/nixos.svg">
      <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/NixOS/nixos-artwork/master/logo/nixos-white.png">
-      <img src="https://nixos.org/logo/nixos-hires.png" width="500px" alt="NixOS logo">
+      <img src="https://raw.githubusercontent.com/NixOS/nixos-artwork/master/logo/nixos.svg" width="500px" alt="NixOS logo">
    </picture>
  </a>
 </p>
@@ -15,6 +15,7 @@

 # CI
 /.github/*_TEMPLATE*                    @SigmaSquadron
+/.github/actions                        @NixOS/Security @Mic92 @zowoq @infinisil @azuwis @wolfgangwalther
 /.github/workflows                      @NixOS/Security @Mic92 @zowoq @infinisil @azuwis @wolfgangwalther
 /.github/workflows/check-format.yml     @infinisil @wolfgangwalther
 /.github/workflows/codeowners-v2.yml    @infinisil @wolfgangwalther
@@ -242,7 +243,7 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
 /pkgs/applications/editors/jetbrains @edwtjo @leona-ya @theCapypara

 # Licenses
-/lib/licenses.nix @alyssais
+/lib/licenses.nix @alyssais @emilazy

 # Qt
 /pkgs/development/libraries/qt-5 @K900 @NickCao @SuperSandro2000 @ttuegel
@@ -40,46 +40,3 @@ Why not just build the tooling right from the PRs Nixpkgs version?
 - Because it makes the CI check very fast, since no Nix builds need to be done, even for mass rebuilds.
 - Because it improves security, since we don't have to build potentially untrusted code from PRs.
  The tool only needs a very minimal Nix evaluation at runtime, which can work with [readonly-mode](https://nixos.org/manual/nix/stable/command-ref/opt-common.html#opt-readonly-mode) and [restrict-eval](https://nixos.org/manual/nix/stable/command-ref/conf-file.html#conf-restrict-eval).
-
-## `get-merge-commit.sh GITHUB_REPO PR_NUMBER`
-
-Check whether a PR is mergeable and return the test merge commit as
-[computed by GitHub](https://docs.github.com/en/rest/guides/using-the-rest-api-to-interact-with-your-git-database?apiVersion=2022-11-28#checking-mergeability-of-pull-requests) and its parent.
-
-Arguments:
- `GITHUB_REPO`: The repository of the PR, e.g. `NixOS/nixpkgs`
- `PR_NUMBER`: The PR number, e.g. `1234`
-
-Exit codes:
- 0: The PR can be merged, the hashes of the test merge commit and the target commit are returned on stdout
- 1: The PR cannot be merged because it's not open anymore
- 2: The PR cannot be merged because it has a merge conflict
- 3: The merge commit isn't being computed, GitHub is likely having internal issues, unknown if the PR is mergeable
-
-### Usage
-
-This script is implemented as a reusable GitHub Actions workflow, and can be used as follows:
-
-```yaml
-on: pull_request_target
-
-# We need a token to query the API, but it doesn't need any special permissions
-permissions: {}
-
-jobs:
-  get-merge-commit:
-    # use the relative path of the get-merge-commit workflow yaml here
-    uses: ./.github/workflows/get-merge-commit.yml
-
-  build:
-    name: Build
-    runs-on: ubuntu-24.04
-    needs: get-merge-commit
-    steps:
-      - uses: actions/checkout@<VERSION>
-        # Add this to _all_ subsequent steps to skip them
-        if: needs.get-merge-commit.outputs.mergedSha
-        with:
-          ref: ${{ needs.get-merge-commit.outputs.mergedSha }}
-      - ...
-```
@@ -1,10 +1,10 @@
 {
+  callPackage,
  lib,
  jq,
  runCommand,
  writeText,
  python3,
-  ...
 }:
 {
  beforeResultDir,
@@ -127,7 +127,7 @@ let
      }
    );

-  maintainers = import ./maintainers.nix {
+  maintainers = callPackage ./maintainers.nix { } {
    changedattrs = lib.attrNames (lib.groupBy (a: a.name) rebuildsPackagePlatformAttrs);
    changedpathsjson = touchedFilesJson;
    inherit byName;
@@ -1,3 +1,6 @@
+{
+  lib,
+}:
 # Almost directly vendored from https://github.com/NixOS/ofborg/blob/5a4e743f192fb151915fcbe8789922fa401ecf48/ofborg/src/maintainers.nix
 {
  changedattrs,
@@ -10,7 +13,6 @@ let
    config = { };
    overlays = [ ];
  };
-  inherit (pkgs) lib;

  changedpaths = builtins.fromJSON (builtins.readFile changedpathsjson);

@@ -1,9 +1,10 @@
 {
+  callPackage,
  lib,
  runCommand,
  writeShellScript,
  writeText,
-  linkFarm,
+  symlinkJoin,
  time,
  procps,
  nixVersions,
@@ -95,7 +96,7 @@ let
          --option restrict-eval true \
          --option allow-import-from-derivation false \
          --query --available \
-          --no-name --attr-path --out-path \
+          --out-path --json \
          --show-trace \
          --arg chunkSize "$chunkSize" \
          --arg myChunk "$myChunk" \
@@ -147,7 +148,7 @@ let
        chunkCount=$(( (attrCount - 1) / chunkSize + 1 ))
        echo "Chunk count: $chunkCount"

-        mkdir $out
+        mkdir -p $out/${evalSystem}

        # Record and print stats on free memory and swap in the background
        (
@@ -156,11 +157,11 @@ let
            freeSwap=$(free -b | grep Swap | awk '{print $4}')
            echo "Available memory: $(( availMemory / 1024 / 1024 )) MiB, free swap: $(( freeSwap / 1024 / 1024 )) MiB"

-            if [[ ! -f "$out/min-avail-memory" ]] || (( availMemory < $(<$out/min-avail-memory) )); then
-              echo "$availMemory" > $out/min-avail-memory
+            if [[ ! -f "$out/${evalSystem}/min-avail-memory" ]] || (( availMemory < $(<$out/${evalSystem}/min-avail-memory) )); then
+              echo "$availMemory" > $out/${evalSystem}/min-avail-memory
            fi
-            if [[ ! -f $out/min-free-swap ]] || (( availMemory < $(<$out/min-free-swap) )); then
-              echo "$freeSwap" > $out/min-free-swap
+            if [[ ! -f $out/${evalSystem}/min-free-swap ]] || (( availMemory < $(<$out/${evalSystem}/min-free-swap) )); then
+              echo "$freeSwap" > $out/${evalSystem}/min-free-swap
            fi
            sleep 4
          done
@@ -176,18 +177,18 @@ let
        mkdir "$chunkOutputDir"/{result,stats,timestats,stderr}

        seq -w 0 "$seq_end" |
-          command time -f "%e" -o "$out/total-time" \
+          command time -f "%e" -o "$out/${evalSystem}/total-time" \
          xargs -I{} -P"$cores" \
          ${singleChunk} "$chunkSize" {} "$evalSystem" "$chunkOutputDir"

-        cp -r "$chunkOutputDir"/stats $out/stats-by-chunk
+        cp -r "$chunkOutputDir"/stats $out/${evalSystem}/stats-by-chunk

        if (( chunkSize * chunkCount != attrCount )); then
          # A final incomplete chunk would mess up the stats, don't include it
          rm "$chunkOutputDir"/stats/"$seq_end"
        fi

-        cat "$chunkOutputDir"/result/* > $out/paths
+        cat "$chunkOutputDir"/result/* | jq -s 'add | map_values(.outputs)' > $out/${evalSystem}/paths.json
      '';

  combine =
@@ -203,22 +204,8 @@ let
      ''
        mkdir -p $out

-        # Transform output paths to JSON
-        cat ${resultsDir}/*/paths |
-          jq --sort-keys --raw-input --slurp '
-            split("\n") |
-            map(select(. != "") | split(" ") | map(select(. != ""))) |
-            map(
-              {
-                key: .[0],
-                value: .[1] | split(";") | map(split("=") |
-                  if length == 1 then
-                    { key: "out", value: .[0] }
-                  else
-                    { key: .[0], value: .[1] }
-                  end) | from_entries}
-            ) | from_entries
-          ' > $out/outpaths.json
+        # Combine output paths from all systems
+        cat ${resultsDir}/*/paths.json | jq -s add > $out/outpaths.json

        mkdir -p $out/stats

@@ -227,16 +214,7 @@ let
        done
      '';

-  compare = import ./compare {
-    inherit
-      lib
-      jq
-      runCommand
-      writeText
-      supportedSystems
-      python3
-      ;
-  };
+  compare = callPackage ./compare { };

  full =
    {
@@ -247,14 +225,15 @@ let
      quickTest ? false,
    }:
    let
-      results = linkFarm "results" (
-        map (evalSystem: {
-          name = evalSystem;
-          path = singleSystem {
+      results = symlinkJoin {
+        name = "results";
+        paths = map (
+          evalSystem:
+          singleSystem {
            inherit quickTest evalSystem chunkSize;
-          };
-        }) evalSystems
-      );
+          }
+        ) evalSystems;
+      };
    in
    combine {
      resultsDir = results;
@@ -1,65 +0,0 @@
-#!/usr/bin/env bash
-# See ./README.md for docs
-
-set -euo pipefail
-
-log() {
-    echo "$@" >&2
-}
-
-if (( $# < 2 )); then
-    log "Usage: $0 GITHUB_REPO PR_NUMBER"
-    exit 99
-fi
-repo=$1
-prNumber=$2
-
-# Retry the API query this many times
-retryCount=5
-# Start with 5 seconds, but double every retry
-retryInterval=5
-
-while true; do
-    log "Checking whether the pull request can be merged"
-    prInfo=$(gh api \
-        -H "Accept: application/vnd.github+json" \
-        -H "X-GitHub-Api-Version: 2022-11-28" \
-        "/repos/$repo/pulls/$prNumber")
-
-    # Non-open PRs won't have their mergeability computed no matter what
-    state=$(jq -r .state <<< "$prInfo")
-    if [[ "$state" != open ]]; then
-        log "PR is not open anymore"
-        exit 1
-    fi
-
-    mergeable=$(jq -r .mergeable <<< "$prInfo")
-    if [[ "$mergeable" == "null" ]]; then
-        if (( retryCount == 0 )); then
-            log "Not retrying anymore. It's likely that GitHub is having internal issues: check https://www.githubstatus.com/"
-            exit 3
-        else
-            (( retryCount -= 1 )) || true
-
-            # null indicates that GitHub is still computing whether it's mergeable
-            # Wait a couple seconds before trying again
-            log "GitHub is still computing whether this PR can be merged, waiting $retryInterval seconds before trying again ($retryCount retries left)"
-            sleep "$retryInterval"
-
-            (( retryInterval *= 2 )) || true
-        fi
-    else
-        break
-    fi
-done
-
-if [[ "$mergeable" == "true" ]]; then
-    log "The PR can be merged"
-    mergedSha="$(jq -r .merge_commit_sha <<< "$prInfo")"
-    echo "mergedSha=$mergedSha"
-    targetSha="$(gh api "/repos/$repo/commits/$mergedSha" --jq '.parents[0].sha')"
-    echo "targetSha=$targetSha"
-else
-    log "The PR has a merge conflict"
-    exit 2
-fi
@@ -37,7 +37,7 @@ let
  helloCheckpoint = prepareCheckpointBuild pkgs.hello;
  changedHello = pkgs.hello.overrideAttrs (_: {
    doCheck = false;
-    patchPhase = ''
+    postPatch = ''
      sed -i 's/Hello, world!/Hello, Nix!/g' src/hello.c
    '';
  });
@@ -102,6 +102,8 @@ stdenvNoCC.mkDerivation {
  ];

  installPhase = ''
+    runHook preInstall
+
    cd ..

    export NIX_STATE_DIR=$(mktemp -d)
@@ -143,5 +145,7 @@ stdenvNoCC.mkDerivation {
    ) libsets}

    echo '```' >> "$out/index.md"
+
+    runHook postInstall
  '';
 }
@@ -118,7 +118,13 @@ pkgs.stdenv.mkDerivation {
    runHook postBuild
  '';

-  installPhase = "mv gulpdist $out";
+  installPhase = ''
+    runHook preInstall
+
+    mv gulpdist $out
+
+    runHook postInstall
+  '';
 }
 ```

@@ -192,6 +192,7 @@ pkgs.buildEmscriptenPackage {
    cp *.json $out/share
    cp *.rng $out/share
    cp README.md $doc/share/${name}
+
    runHook postInstall
  '';

@@ -69,9 +69,13 @@ script to run it using a JRE. You can use `makeWrapper` for this:
  nativeBuildInputs = [ makeWrapper ];

  installPhase = ''
+    runHook preInstall
+
    mkdir -p $out/bin
    makeWrapper ${jre}/bin/java $out/bin/foo \
      --add-flags "-cp $out/share/java/foo.jar org.foo.Main"
+
+    runHook postInstall
  '';
 }
 ```
@@ -690,7 +690,11 @@ The configure phase can sometimes fail because it makes many assumptions which m
 ```nix
 {
  configurePhase = ''
+    runHook preConfigure
+
    ln -s $node_modules node_modules
+
+    runHook postConfigure
  '';
 }
 ```
@@ -700,8 +704,12 @@ or if you need a writeable node_modules directory:
 ```nix
 {
  configurePhase = ''
+    runHook preConfigure
+
    cp -r $node_modules node_modules
    chmod +w node_modules
+
+    runHook postConfigure
  '';
 }
 ```
@@ -59,7 +59,11 @@ Such a Lisp can be now used e.g. to compile your sources:
 ```nix
 {
  buildPhase = ''
+    runHook preBuild
+
    ${sbcl'}/bin/sbcl --load my-build-file.lisp
+
+    runHook postBuild
  '';
 }
 ```
@@ -103,7 +103,13 @@ stdenv.mkDerivation (finalAttrs: {

  # The helper provides a configure snippet that will prepare all dependencies
  # in the correct place, where SwiftPM expects them.
-  configurePhase = generated.configure;
+  configurePhase = ''
+    runHook preConfigure
+
+    ${generated.configure}
+
+    runHook postConfigure
+  '';

  installPhase = ''
    runHook preInstall
@@ -168,11 +174,17 @@ with a writable copy:

 ```nix
 {
-  configurePhase = generated.configure ++ ''
+  configurePhase = ''
+    runHook preConfigure
+
+    ${generated.configure}
+
    # Replace the dependency symlink with a writable copy.
    swiftpmMakeMutable swift-crypto
    # Now apply a patch.
    patch -p1 -d .build/checkouts/swift-crypto -i ${./some-fix.patch}
+
+    runHook postConfigure
  '';
 }
 ```
@@ -113,9 +113,13 @@ stdenv.mkDerivation {
    "bar.lua"
  ];
  installPhase = ''
+    runHook preInstall
+
    mkdir $out/share
    cp foo.py $out/share
    cp bar.lua $out/share
+
+    runHook postInstall
  '';
 }
 ```
@@ -437,6 +437,10 @@
  There is also a breaking change in the handling of CUDA. Instead of using a CUDA compatible jaxlib
  as before, you can use plugins like `python3Packages.jax-cuda12-plugin`.

+- Added `allowVariants` to gate availability of package sets like `pkgsLLVM`, `pkgsMusl`, `pkgsZig`, etc. This was done in an effort to
+  decrease evaluation times by limiting the number of instances of nixpkgs to evaluate. The option will be removed in the future as a
+  new mechanism is in the works for handling cross compilation.
+
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->

 ## Other Notable Changes {#sec-nixpkgs-release-25.05-notable-changes}
@@ -3,8 +3,6 @@
 ## Highlights {#sec-nixpkgs-release-25.11-highlights}
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->

- Added `allowVariants` to gate availability of package sets like `pkgsLLVM`, `pkgsMusl`, `pkgsZig`, etc. This option will be removed in a future release.
-
 - The initial work to support native compilation on LoongArch64 has completed, with further changes currently
  in preparation. In accordance with the [Software Development and Build Convention for LoongArch Architectures](https://github.com/loongson/la-softdev-convention),
  this release sets the default march level to `la64v1.0`, covering the desktop and server processors of 3X5000
@@ -261,7 +261,7 @@ stdenv.mkDerivation (finalAttrs: {
    util-linux
    qemu
  ];
-  checkPhase = ''[elided]'';
+  # `checkPhase` elided
 })
 ```

@@ -3059,6 +3059,12 @@
    github = "benhiemer";
    githubId = 16649926;
  };
+  benjajaja = {
+    name = "Benjamin Große";
+    email = "ste3ls@gmail.com";
+    github = "benjajaja";
+    githubId = 310215;
+  };
  benjaminedwardwebb = {
    name = "Ben Webb";
    email = "benjaminedwardwebb@gmail.com";
@@ -4000,6 +4006,18 @@
    githubId = 141733;
    name = "Andrew Bruce";
  };
+  Cameo007 = {
+    name = "Pascal Dietrich";
+    email = "pascal.1.dietrich@hotmail.com";
+    matrix = "@cameo007:mintux.de";
+    github = "Cameo007";
+    githubId = 80521473;
+    keys = [
+      {
+        fingerprint = "2D62 24B9 1250 86AF E318 12A0 F1D1 5228 0511 FB91";
+      }
+    ];
+  };
  camerondugan = {
    email = "cameron.dugan@protonmail.com";
    github = "camerondugan";
@@ -10101,6 +10119,12 @@
    githubId = 130903;
    name = "Ana Hobden";
  };
+  hpfr = {
+    email = "liam@hpfr.net";
+    github = "hpfr";
+    githubId = 44043764;
+    name = "Liam Hupfer";
+  };
  hqurve = {
    email = "hqurve@outlook.com";
    github = "hqurve";
@@ -18699,6 +18723,12 @@
    name = "Philipp Rintz";
    matrix = "@philipp:srv.icu";
  };
+  p0lyw0lf = {
+    email = "p0lyw0lf@protonmail.com";
+    name = "PolyWolf";
+    github = "p0lyw0lf";
+    githubId = 31190026;
+  };
  p3psi = {
    name = "Elliot Boo";
    email = "p3psi.boo@gmail.com";
@@ -12,6 +12,8 @@

 - [gtklock](https://github.com/jovanlanik/gtklock), a GTK-based lockscreen for Wayland. Available as [programs.gtklock](#opt-programs.gtklock.enable).

+- [SuiteNumérique Docs](https://github.com/suitenumerique/docs), a collaborative note taking, wiki and documentation web platform and alternative to Notion or Outline. Available as [services.lasuite-docs](#opt-services.lasuite-docs.enable).
+
 ## Backward Incompatibilities {#sec-release-25.11-incompatibilities}

 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
@@ -1580,6 +1580,7 @@
  ./services/web-apps/kimai.nix
  ./services/web-apps/komga.nix
  ./services/web-apps/lanraragi.nix
+  ./services/web-apps/lasuite-docs.nix
  ./services/web-apps/lemmy.nix
  ./services/web-apps/limesurvey.nix
  ./services/web-apps/mainsail.nix
@@ -7,9 +7,6 @@

 {
  imports = [
-    (lib.mkRemovedOptionModule [ "programs" "clash-verge" "tunMode" ] ''
-      The tunMode will work with service mode which is enabled by default.
-    '')
  ];
  options.programs.clash-verge = {
    enable = lib.mkEnableOption "Clash Verge";
@@ -23,6 +20,8 @@
      default = pkgs.clash-verge-rev;
      defaultText = lib.literalExpression "pkgs.clash-verge-rev";
    };
+    serviceMode = lib.mkEnableOption "Service Mode";
+    tunMode = lib.mkEnableOption "Setcap for TUN Mode. DNS settings won't work on this way";
    autoStart = lib.mkEnableOption "Clash Verge auto launch";
  };

@@ -42,12 +41,47 @@
        ))
      ];

-      systemd.services.clash-verge = {
+      security.wrappers.clash-verge = lib.mkIf cfg.tunMode {
+        owner = "root";
+        group = "root";
+        capabilities = "cap_net_bind_service,cap_net_raw,cap_net_admin=+ep";
+        source = "${lib.getExe cfg.package}";
+      };
+
+      systemd.services.clash-verge = lib.mkIf cfg.serviceMode {
        enable = true;
        description = "Clash Verge Service Mode";
        serviceConfig = {
          ExecStart = "${cfg.package}/bin/clash-verge-service";
          Restart = "on-failure";
+          ProtectSystem = "strict";
+          NoNewPrivileges = true;
+          ProtectHostname = true;
+          ProtectProc = "invisible";
+          ProcSubset = "pid";
+          SystemCallArchitectures = "native";
+          PrivateTmp = true;
+          PrivateMounts = true;
+          ProtectKernelTunables = true;
+          ProtectKernelModules = true;
+          ProtectKernelLogs = true;
+          ProtectControlGroups = true;
+          LockPersonality = true;
+          RestrictRealtime = true;
+          ProtectClock = true;
+          MemoryDenyWriteExecute = true;
+          RestrictSUIDSGID = true;
+          RestrictNamespaces = [ "~user cgroup ipc mnt uts" ];
+          RestrictAddressFamilies = [
+            "AF_INET AF_INET6 AF_NETLINK AF_PACKET AF_RAW"
+          ];
+          CapabilityBoundingSet = [
+            "CAP_NET_ADMIN CAP_NET_RAW CAP_SYS_ADMIN CAP_DAC_OVERRIDE CAP_SETUID CAP_SETGID CAP_CHOWN CAP_MKNOD"
+          ];
+          SystemCallFilter = [
+            "~@aio @chown @clock @cpu-emulation @debug @keyring @memlock @module @mount @obsolete @pkey @privileged @raw-io @reboot @sandbox @setuid @swap @timer"
+          ];
+          SystemCallErrorNumber = "EPERM";
        };
        wantedBy = [ "multi-user.target" ];
      };
@@ -5,7 +5,7 @@ in
 {
  options = {
    security.lsm = lib.mkOption {
-      type = lib.types.uniq (lib.types.listOf lib.types.str);
+      type = lib.types.listOf lib.types.str;
      default = [ ];
      description = ''
        A list of the LSMs to initialize in order.
@@ -13,16 +13,26 @@ in
    };
  };

-  config = lib.mkIf (lib.lists.length cfg.lsm > 0) {
-    assertions = [
-      {
-        assertion = builtins.length (lib.filter (lib.hasPrefix "security=") config.boot.kernelParams) == 0;
-        message = "security parameter in boot.kernelParams cannot be used when security.lsm is used";
-      }
-    ];
+  config = lib.mkMerge [
+    {
+      # We set the default LSM's here due to them not being present if set when enabling AppArmor.
+      security.lsm = [
+        "landlock"
+        "yama"
+        "bpf"
+      ];
+    }
+    (lib.mkIf (lib.lists.length cfg.lsm > 0) {
+      assertions = [
+        {
+          assertion = builtins.length (lib.filter (lib.hasPrefix "security=") config.boot.kernelParams) == 0;
+          message = "security parameter in boot.kernelParams cannot be used when security.lsm is used";
+        }
+      ];

-    boot.kernelParams = [
-      "lsm=${lib.concatStringsSep "," cfg.lsm}"
-    ];
-  };
+      boot.kernelParams = [
+        "lsm=${lib.concatStringsSep "," cfg.lsm}"
+      ];
+    })
+  ];
 }
@@ -93,7 +93,12 @@ in
    systemd.services.atuin = {
      description = "atuin server";
      requires = lib.optionals cfg.database.createLocally [ "postgresql.service" ];
-      after = [ "network.target" ] ++ lib.optionals cfg.database.createLocally [ "postgresql.service" ];
+      after = [
+        "network-online.target"
+      ] ++ lib.optionals cfg.database.createLocally [ "postgresql.service" ];
+      wants = [
+        "network-online.target"
+      ] ++ lib.optionals cfg.database.createLocally [ "postgresql.service" ];
      wantedBy = [ "multi-user.target" ];

      serviceConfig = {
@@ -139,18 +144,14 @@ in
        UMask = "0077";
      };

-      environment =
-        {
-          ATUIN_HOST = cfg.host;
-          ATUIN_PORT = toString cfg.port;
-          ATUIN_MAX_HISTORY_LENGTH = toString cfg.maxHistoryLength;
-          ATUIN_OPEN_REGISTRATION = lib.boolToString cfg.openRegistration;
-          ATUIN_PATH = cfg.path;
-          ATUIN_CONFIG_DIR = "/run/atuin"; # required to start, but not used as configuration is via environment variables
-        }
-        // lib.optionalAttrs (cfg.database.uri != null) {
-          ATUIN_DB_URI = cfg.database.uri;
-        };
+      environment = {
+        ATUIN_HOST = cfg.host;
+        ATUIN_PORT = toString cfg.port;
+        ATUIN_MAX_HISTORY_LENGTH = toString cfg.maxHistoryLength;
+        ATUIN_OPEN_REGISTRATION = lib.boolToString cfg.openRegistration;
+        ATUIN_PATH = cfg.path;
+        ATUIN_CONFIG_DIR = "/run/atuin"; # required to start, but not used as configuration is via environment variables
+      } // lib.optionalAttrs (cfg.database.uri != null) { ATUIN_DB_URI = cfg.database.uri; };
    };

    networking.firewall.allowedTCPPorts = mkIf cfg.openFirewall [ cfg.port ];
@@ -68,7 +68,7 @@ in

      package = mkPackageOption pkgs "gerrit" { };

-      jvmPackage = mkPackageOption pkgs "jre_headless" { };
+      jvmPackage = mkPackageOption pkgs "jdk21_headless" { };

      jvmOpts = mkOption {
        type = types.listOf types.str;
@@ -0,0 +1,514 @@
+{
+  config,
+  lib,
+  pkgs,
+  utils,
+  ...
+}:
+let
+  inherit (lib)
+    getExe
+    mapAttrs
+    mkEnableOption
+    mkIf
+    mkPackageOption
+    mkOption
+    types
+    optional
+    optionalString
+    ;
+
+  cfg = config.services.lasuite-docs;
+
+  pythonEnvironment = mapAttrs (
+    _: value:
+    if value == null then
+      "None"
+    else if value == true then
+      "True"
+    else if value == false then
+      "False"
+    else
+      toString value
+  ) cfg.settings;
+
+  commonServiceConfig = {
+    RuntimeDirectory = "lasuite-docs";
+    StateDirectory = "lasuite-docs";
+    WorkingDirectory = "/var/lib/lasuite-docs";
+
+    User = "lasuite-docs";
+    DynamicUser = true;
+    SupplementaryGroups = mkIf cfg.redis.createLocally [
+      config.services.redis.servers.lasuite-docs.group
+    ];
+    # hardening
+    AmbientCapabilities = "";
+    CapabilityBoundingSet = [ "" ];
+    DevicePolicy = "closed";
+    LockPersonality = true;
+    NoNewPrivileges = true;
+    PrivateDevices = true;
+    PrivateTmp = true;
+    PrivateUsers = true;
+    ProcSubset = "pid";
+    ProtectClock = true;
+    ProtectControlGroups = true;
+    ProtectHome = true;
+    ProtectHostname = true;
+    ProtectKernelLogs = true;
+    ProtectKernelModules = true;
+    ProtectKernelTunables = true;
+    ProtectProc = "invisible";
+    ProtectSystem = "strict";
+    RemoveIPC = true;
+    RestrictAddressFamilies = [
+      "AF_INET"
+      "AF_INET6"
+      "AF_UNIX"
+    ];
+    RestrictNamespaces = true;
+    RestrictRealtime = true;
+    RestrictSUIDSGID = true;
+    SystemCallArchitectures = "native";
+    UMask = "0077";
+  };
+in
+{
+  options.services.lasuite-docs = {
+    enable = mkEnableOption "SuiteNumérique Docs";
+
+    backendPackage = mkPackageOption pkgs "lasuite-docs" { };
+
+    frontendPackage = mkPackageOption pkgs "lasuite-docs-frontend" { };
+
+    bind = mkOption {
+      type = types.str;
+      default = "unix:/run/lasuite-docs/gunicorn.sock";
+      example = "127.0.0.1:8000";
+      description = ''
+        The path, host/port or file descriptior to bind the gunicorn socket to.
+
+        See  <https://docs.gunicorn.org/en/stable/settings.html#bind> for possible options.
+      '';
+    };
+
+    enableNginx = mkEnableOption "enable and configure Nginx for reverse proxying" // {
+      default = true;
+    };
+
+    secretKeyPath = mkOption {
+      type = types.nullOr types.path;
+      default = null;
+      description = ''
+        Path to the Django secret key.
+
+        The key can be generated using:
+        ```
+        python3 -c 'import secrets; print(secrets.token_hex())'
+        ```
+
+        If not set, the secret key will be automatically generated.
+      '';
+    };
+
+    s3Url = mkOption {
+      type = types.str;
+      description = ''
+        URL of the S3 bucket.
+      '';
+    };
+
+    postgresql = {
+      createLocally = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Configure local PostgreSQL database server for docs.
+        '';
+      };
+    };
+
+    redis = {
+      createLocally = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Configure local Redis cache server for docs.
+        '';
+      };
+    };
+
+    collaborationServer = {
+      package = mkPackageOption pkgs "lasuite-docs-collaboration-server" { };
+
+      port = mkOption {
+        type = types.port;
+        default = 4444;
+        description = ''
+          Port used by the collaboration server to listen.
+        '';
+      };
+
+      settings = mkOption {
+        type = types.submodule {
+          freeformType = types.attrsOf (
+            types.oneOf [
+              types.str
+              types.bool
+            ]
+          );
+
+          options = {
+            PORT = mkOption {
+              type = types.str;
+              default = toString cfg.collaborationServer.port;
+              readOnly = true;
+              description = "Port used by collaboration server to listen to";
+            };
+
+            COLLABORATION_BACKEND_BASE_URL = mkOption {
+              type = types.str;
+              default = "https://${cfg.domain}";
+              defaultText = lib.literalExpression "https://\${cfg.domain}";
+              description = "URL to the backend server base";
+            };
+          };
+        };
+        default = { };
+        example = ''
+          {
+            COLLABORATION_LOGGING = true;
+          }
+        '';
+        description = ''
+          Configuration options of collaboration server.
+
+          See https://github.com/suitenumerique/docs/blob/v${cfg.collaborationServer.package.version}/docs/env.md
+        '';
+      };
+    };
+
+    gunicorn = {
+      extraArgs = mkOption {
+        type = types.listOf types.str;
+        default = [
+          "--name=impress"
+          "--workers=3"
+        ];
+        description = ''
+          Extra arguments to pass to the gunicorn process.
+        '';
+      };
+    };
+
+    celery = {
+      extraArgs = mkOption {
+        type = types.listOf types.str;
+        default = [ ];
+        description = ''
+          Extra arguments to pass to the celery process.
+        '';
+      };
+    };
+
+    domain = mkOption {
+      type = types.str;
+      description = ''
+        Domain name of the docs instance.
+      '';
+    };
+
+    settings = mkOption {
+      type = types.submodule {
+        freeformType = types.attrsOf (
+          types.nullOr (
+            types.oneOf [
+              types.str
+              types.bool
+              types.path
+              types.int
+            ]
+          )
+        );
+
+        options = {
+          DJANGO_CONFIGURATION = mkOption {
+            type = types.str;
+            internal = true;
+            default = "Production";
+            description = "The configuration that Django will use";
+          };
+
+          DJANGO_SETTINGS_MODULE = mkOption {
+            type = types.str;
+            internal = true;
+            default = "impress.settings";
+            description = "The configuration module that Django will use";
+          };
+
+          DJANGO_SECRET_KEY_FILE = mkOption {
+            type = types.path;
+            default =
+              if cfg.secretKeyPath == null then "/var/lib/lasuite-docs/django_secret_key" else cfg.secretKeyPath;
+            description = "The path to the file containing Django's secret key";
+          };
+
+          DATA_DIR = mkOption {
+            type = types.path;
+            default = "/var/lib/lasuite-docs";
+            description = "Path to the data directory";
+          };
+
+          DJANGO_ALLOWED_HOSTS = mkOption {
+            type = types.str;
+            default = if cfg.enableNginx then "localhost,127.0.0.1,${cfg.domain}" else "";
+            defaultText = lib.literalExpression ''
+              if cfg.enableNginx then "localhost,127.0.0.1,$${cfg.domain}" else ""
+            '';
+            description = "Comma-separated list of hosts that are able to connect to the server";
+          };
+
+          DB_NAME = mkOption {
+            type = types.str;
+            default = "lasuite-docs";
+            description = "Name of the database";
+          };
+
+          DB_USER = mkOption {
+            type = types.str;
+            default = "lasuite-docs";
+            description = "User of the database";
+          };
+
+          DB_HOST = mkOption {
+            type = types.nullOr types.str;
+            default = if cfg.postgresql.createLocally then "/run/postgresql" else null;
+            description = "Host of the database";
+          };
+
+          REDIS_URL = mkOption {
+            type = types.nullOr types.str;
+            default =
+              if cfg.redis.createLocally then
+                "unix://${config.services.redis.servers.lasuite-docs.unixSocket}?db=0"
+              else
+                null;
+            description = "URL of the redis backend";
+          };
+
+          CELERY_BROKER_URL = mkOption {
+            type = types.nullOr types.str;
+            default =
+              if cfg.redis.createLocally then
+                "redis+socket://${config.services.redis.servers.lasuite-docs.unixSocket}?db=1"
+              else
+                null;
+            description = "URL of the redis backend for celery";
+          };
+        };
+      };
+      default = { };
+      example = ''
+        {
+          DJANGO_ALLOWED_HOSTS = "*";
+        }
+      '';
+      description = ''
+        Configuration options of docs.
+
+        See https://github.com/suitenumerique/docs/blob/v${cfg.backendPackage.version}/docs/env.md
+
+        `REDIS_URL` and `CELERY_BROKER_URL` are set if `services.lasuite-docs.redis.createLocally` is true.
+        `DB_HOST` is set if `services.lasuite-docs.postgresql.createLocally` is true.
+      '';
+    };
+
+    environmentFile = mkOption {
+      type = types.nullOr types.path;
+      default = null;
+      description = ''
+        Path to environment file.
+
+        This can be useful to pass secrets to docs via tools like `agenix` or `sops`.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.services.lasuite-docs = {
+      description = "Docs from SuiteNumérique";
+      after =
+        [ "network.target" ]
+        ++ (optional cfg.postgresql.createLocally "postgresql.service")
+        ++ (optional cfg.redis.createLocally "redis-lasuite-docs.service");
+      wants =
+        (optional cfg.postgresql.createLocally "postgresql.service")
+        ++ (optional cfg.redis.createLocally "redis-lasuite-docs.service");
+      wantedBy = [ "multi-user.target" ];
+
+      preStart = ''
+        ln -sfT ${cfg.backendPackage}/share/static /var/lib/lasuite-docs/static
+
+        if [ ! -f .version ]; then
+          touch .version
+        fi
+
+        if [ "${cfg.backendPackage.version}" != "$(cat .version)" ]; then
+          ${getExe cfg.backendPackage} migrate
+          echo -n "${cfg.backendPackage.version}" > .version
+        fi
+        ${optionalString (cfg.secretKeyPath == null) ''
+          if [[ ! -f /var/lib/lasuite-docs/django_secret_key ]]; then
+            (
+              umask 0377
+              tr -dc A-Za-z0-9 < /dev/urandom | head -c64 | ${pkgs.moreutils}/bin/sponge /var/lib/lasuite-docs/django_secret_key
+            )
+          fi
+        ''}
+      '';
+
+      environment = pythonEnvironment;
+
+      serviceConfig = {
+        ExecStart = utils.escapeSystemdExecArgs (
+          [
+            (lib.getExe' cfg.backendPackage "gunicorn")
+            "--bind=${cfg.bind}"
+          ]
+          ++ cfg.gunicorn.extraArgs
+          ++ [ "impress.wsgi:application" ]
+        );
+        EnvironmentFile = optional (cfg.environmentFile != null) cfg.environmentFile;
+        MemoryDenyWriteExecute = true;
+      } // commonServiceConfig;
+    };
+
+    systemd.services.lasuite-docs-celery = {
+      description = "Docs Celery broker from SuiteNumérique";
+      after =
+        [ "network.target" ]
+        ++ (optional cfg.postgresql.createLocally "postgresql.service")
+        ++ (optional cfg.redis.createLocally "redis-lasuite-docs.service");
+      wants =
+        (optional cfg.postgresql.createLocally "postgresql.service")
+        ++ (optional cfg.redis.createLocally "redis-lasuite-docs.service");
+      wantedBy = [ "multi-user.target" ];
+
+      environment = pythonEnvironment;
+
+      serviceConfig = {
+        ExecStart = utils.escapeSystemdExecArgs (
+          [
+            (lib.getExe' cfg.backendPackage "celery")
+          ]
+          ++ cfg.celery.extraArgs
+          ++ [
+            "--app=impress.celery_app"
+            "worker"
+          ]
+        );
+        EnvironmentFile = optional (cfg.environmentFile != null) cfg.environmentFile;
+        MemoryDenyWriteExecute = true;
+      } // commonServiceConfig;
+    };
+
+    systemd.services.lasuite-docs-collaboration-server = {
+      description = "Docs Collaboration Server from SuiteNumérique";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+
+      environment = cfg.collaborationServer.settings;
+
+      serviceConfig = {
+        ExecStart = getExe cfg.collaborationServer.package;
+      } // commonServiceConfig;
+    };
+
+    services.postgresql = mkIf cfg.postgresql.createLocally {
+      enable = true;
+      ensureDatabases = [ "lasuite-docs" ];
+      ensureUsers = [
+        {
+          name = "lasuite-docs";
+          ensureDBOwnership = true;
+        }
+      ];
+    };
+
+    services.redis.servers.lasuite-docs = mkIf cfg.redis.createLocally { enable = true; };
+
+    services.nginx = mkIf cfg.enableNginx {
+      enable = true;
+
+      virtualHosts.${cfg.domain} = {
+        extraConfig = ''
+          error_page 401 /401;
+          error_page 403 /403;
+          error_page 404 /404;
+        '';
+
+        root = cfg.frontendPackage;
+
+        locations."~ '^/docs/[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}/?$'" = {
+          tryFiles = "$uri /docs/[id]/index.html";
+        };
+
+        locations."/api" = {
+          proxyPass = "http://${cfg.bind}";
+          recommendedProxySettings = true;
+        };
+
+        locations."/admin" = {
+          proxyPass = "http://${cfg.bind}";
+          recommendedProxySettings = true;
+        };
+
+        locations."/collaboration/ws/" = {
+          proxyPass = "http://localhost:${toString cfg.collaborationServer.port}";
+          recommendedProxySettings = true;
+          proxyWebsockets = true;
+        };
+
+        locations."/collaboration/api/" = {
+          proxyPass = "http://localhost:${toString cfg.collaborationServer.port}";
+          recommendedProxySettings = true;
+        };
+
+        locations."/media-auth" = {
+          proxyPass = "http://${cfg.bind}";
+          recommendedProxySettings = true;
+          extraConfig = ''
+            rewrite $/(.*)^ /api/v1.0/documents/$1 break;
+            proxy_set_header X-Original-URL $request_uri;
+            proxy_pass_request_body off;
+            proxy_set_header Content-Length "";
+            proxy_set_header X-Original-Method $request_method;
+          '';
+        };
+
+        locations."/media/" = {
+          proxyPass = cfg.s3Url;
+          recommendedProxySettings = true;
+          extraConfig = ''
+            auth_request /media-auth;
+            auth_request_set $authHeader $upstream_http_authorization;
+            auth_request_set $authDate $upstream_http_x_amz_date;
+            auth_request_set $authContentSha256 $upstream_http_x_amz_content_sha256;
+
+            proxy_set_header Authorization $authHeader;
+            proxy_set_header X-Amz-Date $authDate;
+            proxy_set_header X-Amz-Content-SHA256 $authContentSha256;
+
+            add_header Content-Security-Policy "default-src 'none'" always;
+          '';
+        };
+      };
+    };
+  };
+
+  meta = {
+    buildDocsInSandbox = false;
+    maintainers = [ lib.maintainers.soyouzpanda ];
+  };
+}
@@ -76,7 +76,7 @@ in
        API_PORT = toString cfg.port;
        BASE_URL = "http://localhost:${toString cfg.port}";
        DATA_DIR = "/var/lib/mealie";
-        NLTK_DATA = pkgs.nltk-data.averaged_perceptron_tagger_eng;
+        NLTK_DATA = pkgs.nltk-data.averaged-perceptron-tagger-eng;
      } // (builtins.mapAttrs (_: val: toString val) cfg.settings);

      serviceConfig = {
@@ -711,6 +711,7 @@ in
  languagetool = handleTest ./languagetool.nix { };
  lanraragi = handleTest ./lanraragi.nix { };
  latestKernel.login = handleTest ./login.nix { latestKernel = true; };
+  lasuite-docs = runTest ./web-apps/lasuite-docs.nix;
  lavalink = runTest ./lavalink.nix;
  leaps = handleTest ./leaps.nix { };
  lemmy = handleTest ./lemmy.nix { };
@@ -34,11 +34,21 @@
    machine.wait_for_x()

    with subtest("lomiri calculator launches"):
-        machine.execute("lomiri-calculator-app >&2 &")
+        machine.succeed("lomiri-calculator-app >&2 &")
+        machine.wait_for_console_text("Database upgraded to") # only on first run
+        machine.sleep(10)
+        machine.send_key("alt-f10")
+        machine.sleep(5)
        machine.wait_for_text("Calculator")
        machine.screenshot("lomiri-calculator")

    with subtest("lomiri calculator works"):
+        # Seems like on slower hardware, we might be using the app too quickly after its startup, with the math library
+        # not being set up properly yet:
+        # qml: [LOG]: Unable to calculate formula : "22*16", math.js: TypeError: Cannot call method 'evaluate' of null
+        # OfBorg aarch64 CI is *incredibly slow*, hence the long duration.
+        machine.sleep(60)
+
        machine.send_key("tab") # Fix focus

        machine.send_chars("22*16\n")
@@ -48,7 +58,11 @@
    machine.succeed("pkill -f lomiri-calculator-app")

    with subtest("lomiri calculator localisation works"):
-        machine.execute("env LANG=de_DE.UTF-8 lomiri-calculator-app >&2 &")
+        machine.succeed("env LANG=de_DE.UTF-8 lomiri-calculator-app >&2 &")
+        machine.wait_for_console_text("using main qml file from") # less precise, but the app doesn't exactly log a whole lot
+        machine.sleep(10)
+        machine.send_key("alt-f10")
+        machine.sleep(5)
        machine.wait_for_text("Rechner")
        machine.screenshot("lomiri-calculator_localised")

@@ -61,11 +61,13 @@ import ../make-test-python.nix (
      peer1.wait_for_unit("mycelium.service")
      peer2.wait_for_unit("mycelium.service")

+      # Give mycelium some time to discover the other peer
+      peer1.wait_until_succeeds("ping -c1 ${peer2-ip}", timeout=10)
+      peer2.succeed("ping -c1 ${peer1-ip}")
+
      peer1.succeed("mycelium peers list | grep 192.168.1.12")
      peer2.succeed("mycelium peers list | grep 192.168.1.11")

-      peer1.succeed("ping -c5 ${peer2-ip}")
-      peer2.succeed("ping -c5 ${peer1-ip}")
    '';
  }
 )
@@ -0,0 +1,168 @@
+{ lib, ... }:
+let
+  domain = "docs.local";
+  oidcDomain = "127.0.0.1:8080";
+  s3Domain = "127.0.0.1:9000";
+
+  minioAccessKey = "a8dff633d164068418a5";
+  minioSecretKey = "d546ea5f9c9bfdcf83755a7c09f2f7fb";
+in
+
+{
+  name = "lasuite-docs";
+  meta.maintainers = with lib.maintainers; [
+    soyouzpanda
+  ];
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      virtualisation.diskSize = 4 * 1024;
+      virtualisation.memorySize = 4 * 1024;
+
+      networking.hosts."127.0.0.1" = [ domain ];
+
+      environment.systemPackages = with pkgs; [
+        jq
+        minio-client
+      ];
+
+      services.lasuite-docs = {
+        enable = true;
+        enableNginx = true;
+        redis.createLocally = true;
+        postgresql.createLocally = true;
+
+        inherit domain;
+        s3Url = "http://${s3Domain}/lasuite-docs";
+
+        settings = {
+          DJANGO_SECRET_KEY_FILE = pkgs.writeText "django-secret-file" ''
+            8540db59c03943d48c3ed1a0f96ce3b560e0f45274f120f7ee4dace3cc366a6b
+          '';
+
+          OIDC_OP_JWKS_ENDPOINT = "http://${oidcDomain}/dex/keys";
+          OIDC_OP_AUTHORIZATION_ENDPOINT = "http://${oidcDomain}/dex/auth/mock";
+          OIDC_OP_TOKEN_ENDPOINT = "http://${oidcDomain}/dex/token";
+          OIDC_OP_USER_ENDPOINT = "http://${oidcDomain}/dex/userinfo";
+          OIDC_RP_CLIENT_ID = "lasuite-docs";
+          OIDC_RP_SIGN_ALGO = "RS256";
+          OIDC_RP_SCOPES = "openid email";
+          OIDC_RP_CLIENT_SECRET = "lasuitedocsclientsecret";
+
+          LOGIN_REDIRECT_URL = "http://${domain}";
+          LOGIN_REDIRECT_URL_FAILURE = "http://${domain}";
+          LOGOUT_REDIRECT_URL = "http://${domain}";
+
+          AWS_S3_ENDPOINT_URL = "http://${s3Domain}";
+          AWS_S3_ACCESS_KEY_ID = minioAccessKey;
+          AWS_S3_SECRET_ACCESS_KEY = minioSecretKey;
+          AWS_STORAGE_BUCKET_NAME = "lasuite-docs";
+          MEDIA_BASE_URL = "http://${domain}";
+
+          # Disable HTTPS feature in tests because we're running on a HTTP connection
+          DJANGO_SECURE_PROXY_SSL_HEADER = "";
+          DJANGO_SECURE_SSL_REDIRECT = false;
+          DJANGO_CSRF_COOKIE_SECURE = false;
+          DJANGO_SESSION_COOKIE_SECURE = false;
+          DJANGO_CSRF_TRUSTED_ORIGINS = "http://*";
+        };
+      };
+
+      services.dex = {
+        enable = true;
+        settings = {
+          issuer = "http://${oidcDomain}/dex";
+          storage = {
+            type = "postgres";
+            config.host = "/var/run/postgresql";
+          };
+          web.http = "127.0.0.1:8080";
+          oauth2.skipApprovalScreen = true;
+          staticClients = [
+            {
+              id = "lasuite-docs";
+              name = "Docs";
+              redirectURIs = [ "http://${domain}/api/v1.0/callback/" ];
+              secretFile = "/etc/dex/lasuite-docs";
+            }
+          ];
+          connectors = [
+            {
+              type = "mockPassword";
+              id = "mock";
+              name = "Example";
+              config = {
+                username = "admin";
+                password = "password";
+              };
+            }
+          ];
+        };
+      };
+
+      services.minio = {
+        enable = true;
+        rootCredentialsFile = "/etc/minio/minio-root-credentials";
+      };
+
+      environment.etc."dex/lasuite-docs" = {
+        mode = "0400";
+        user = "dex";
+        text = "lasuitedocsclientsecret";
+      };
+
+      environment.etc."minio/minio-root-credentials" = {
+        mode = "0400";
+        text = ''
+          MINIO_ROOT_USER=${minioAccessKey}
+          MINIO_ROOT_PASSWORD=${minioSecretKey}
+        '';
+      };
+
+      services.postgresql = {
+        enable = true;
+        ensureDatabases = [ "dex" ];
+        ensureUsers = [
+          {
+            name = "dex";
+            ensureDBOwnership = true;
+          }
+        ];
+      };
+    };
+
+  testScript = ''
+    with subtest("Wait for units to start"):
+      machine.wait_for_unit("dex.service")
+      machine.wait_for_unit("minio.service")
+      machine.wait_for_unit("lasuite-docs.service")
+      machine.wait_for_unit("lasuite-docs-celery.service")
+      machine.wait_for_unit("lasuite-docs-collaboration-server.service")
+
+    with subtest("Create S3 bucket"):
+      machine.succeed("mc config host add minio http://${s3Domain} ${minioAccessKey} ${minioSecretKey} --api s3v4")
+      machine.succeed("mc mb lasuite-docs")
+
+    with subtest("Wait for web servers to start"):
+      machine.wait_until_succeeds("curl -fs 'http://${domain}/api/v1.0/authenticate/'", timeout=120)
+      machine.wait_until_succeeds("curl -fs '${oidcDomain}/dex/auth/mock?client_id=lasuite-docs&response_type=code&redirect_uri=http://${domain}/api/v1.0/callback/&scope=openid'", timeout=120)
+
+    with subtest("Login"):
+      state, nonce = machine.succeed("curl -fs -c cjar 'http://${domain}/api/v1.0/authenticate/' -w '%{redirect_url}' | sed -n 's/.*state=\\(.*\\)&nonce=\\(.*\\)/\\1 \\2/p'").strip().split(' ')
+
+      oidc_state = machine.succeed(f"curl -fs '${oidcDomain}/dex/auth/mock?client_id=lasuite-docs&response_type=code&redirect_uri=http://${domain}/api/v1.0/callback/&scope=openid+email&state={state}&nonce={nonce}' | sed -n 's/.*state=\\(.*\\)\">.*/\\1/p'").strip()
+
+      code = machine.succeed(f"curl -fs '${oidcDomain}/dex/auth/mock/login?back=&state={oidc_state}' -d 'login=admin&password=password' -w '%{{redirect_url}}' | sed -n 's/.*code=\\(.*\\)&.*/\\1/p'").strip()
+      print(f"Got approval code {code}")
+
+      machine.succeed(f"curl -fs -c cjar -b cjar 'http://${domain}/api/v1.0/callback/?code={code}&state={state}'")
+
+    with subtest("Create a document"):
+      csrf_token = machine.succeed("grep csrftoken cjar | cut -f 7 | tr -d '\n'")
+
+      document_id = machine.succeed(f"curl -fs -c cjar -b cjar 'http://${domain}/api/v1.0/documents/' -X POST -H 'X-CSRFToken: {csrf_token}' -H 'Referer: http://${domain}' | jq .id -r").strip()
+
+      print(f"Created document with id {document_id}")
+  '';
+}
@@ -1,6 +1,8 @@
 {
  lib,
+  stdenv,
  fetchurl,
+  cmake,
  pkg-config,
  libjack2,
  alsa-lib,
@@ -9,18 +11,23 @@
  lv2,
  qt5,
  fftwFloat,
-  mkDerivation,
 }:

-mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "padthv1";
-  version = "0.9.23";
+  version = "1.3.2";

  src = fetchurl {
-    url = "mirror://sourceforge/padthv1/${pname}-${version}.tar.gz";
-    sha256 = "sha256-9yFfvlskOYnGraou2S3Qffl8RoYJqE0wnDlOP8mxQgg=";
+    url = "mirror://sourceforge/padthv1/padthv1-${finalAttrs.version}.tar.gz";
+    hash = "sha256-sXpJjD79+rLrWHwpAxACjR+8KVGbQss8qKGMTN7nb9M=";
  };

+  nativeBuildInputs = [
+    pkg-config
+    cmake
+    qt5.wrapQtAppsHook
+  ];
+
  buildInputs = [
    libjack2
    alsa-lib
@@ -32,14 +39,12 @@ mkDerivation rec {
    fftwFloat
  ];

-  nativeBuildInputs = [ pkg-config ];
-
-  meta = with lib; {
+  meta = {
    description = "polyphonic additive synthesizer";
    mainProgram = "padthv1_jack";
    homepage = "http://padthv1.sourceforge.net/";
-    license = licenses.gpl2Plus;
-    platforms = platforms.linux;
-    maintainers = [ maintainers.magnetophon ];
+    license = lib.licenses.gpl2Plus;
+    platforms = lib.platforms.linux;
+    maintainers = [ lib.maintainers.magnetophon ];
  };
-}
+})
@@ -38,17 +38,17 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "reaper";
-  version = "7.38";
+  version = "7.39";

  src = fetchurl {
    url = url_for_platform version stdenv.hostPlatform.qemuArch;
    hash =
      if stdenv.hostPlatform.isDarwin then
-        "sha256-2DmwbOQ1sNVL3krlG27KOdhuwalZRjafuWzWFYiWpng="
+        "sha256-Xfalo8fjNOdOBrvAHnZ7NqukDHKDNAYKxFwQSk2xRAo="
      else
        {
-          x86_64-linux = "sha256-GiN20Dj+kBNbOI1CASCDJFIUbOYfBc5K/bwf42Pc3Zk=";
-          aarch64-linux = "sha256-CziepFXytiMJ7eMtCziaYphYgYQJywQ9JtrLHzBU5Cw=";
+          x86_64-linux = "sha256-Aee8gzS0gwB9IU1H5GpaL7oJ4iKyQLdpFMvQjfgBYEA=";
+          aarch64-linux = "sha256-B+VWtGQ5pBE434pHccubHZPkNqT5nkNsuvhxKLa1Imc=";
        }
        .${stdenv.hostPlatform.system};
  };
@@ -15,7 +15,7 @@
  plugins ? [ ],
  buildNumber,
  ...
-}:
+}@args:

 let
  loname = lib.toLower productShort;
@@ -29,6 +29,7 @@ stdenvNoCC.mkDerivation {
    ;
  passthru.buildNumber = buildNumber;
  passthru.product = product;
+  passthru.tests = args.passthru.tests;
  meta = meta // {
    mainProgram = loname;
  };
@@ -35,6 +35,7 @@
  extraLdPath ? [ ],
  extraWrapperArgs ? [ ],
  extraBuildInputs ? [ ],
+  ...
 }@args:

 let
@@ -48,6 +49,7 @@ lib.makeOverridable mkDerivation (
  rec {
    inherit pname version src;
    passthru.buildNumber = buildNumber;
+    passthru.tests = args.passthru.tests;
    meta = args.meta // {
      mainProgram = pname;
    };
@@ -77,6 +77,7 @@ let
      extraWrapperArgs ? [ ],
      extraLdPath ? [ ],
      extraBuildInputs ? [ ],
+      extraTests ? { },
    }:
    mkJetBrainsProductCore {
      inherit
@@ -100,6 +101,9 @@ let
      inherit (ideInfo."${pname}") wmClass product;
      productShort = ideInfo."${pname}".productShort or ideInfo."${pname}".product;
      meta = mkMeta ideInfo."${pname}".meta fromSource;
+      passthru.tests = extraTests // {
+        plugins = callPackage ./plugins/tests.nix { ideName = pname; };
+      };
      libdbm =
        if ideInfo."${pname}".meta.isOpenSource then
          communitySources."${pname}".libdbm
@@ -1,36 +1,135 @@
-{ jetbrains, writeText }:
+{
+  jetbrains,
+  symlinkJoin,
+  lib,
+  runCommand,
+  # If not set, all IDEs are tested.
+  ideName ? null,
+}:

+let
+
+  # Known broken plugins, PLEASE remove entries here whenever possible.
+  broken-plugins = [
+    "github-copilot" # GitHub Copilot: https://github.com/NixOS/nixpkgs/issues/400317
+  ];
+
+  ides =
+    if ideName == null then
+      with jetbrains;
+      [
+        aqua
+        clion
+        datagrip
+        dataspell
+        gateway
+        goland
+        idea-community-src
+        idea-community-bin
+        idea-ultimate
+        mps
+        phpstorm
+        pycharm-community-src
+        pycharm-community-bin
+        pycharm-professional
+        rider
+        ruby-mine
+        rust-rover
+        webstorm
+        writerside
+      ]
+    else
+      [ (jetbrains.${ideName}) ];
+in
 {
  # Check to see if the process for adding plugins is breaking anything, instead of the plugins themselves
-  default =
+  empty =
    let
      modify-ide = ide: jetbrains.plugins.addPlugins ide [ ];
-      ides =
-        with jetbrains;
-        map modify-ide [
-          clion
-          datagrip
-          dataspell
-          goland
-          idea-community
-          idea-ultimate
-          mps
-          phpstorm
-          pycharm-community
-          pycharm-professional
-          rider
-          ruby-mine
-          rust-rover
-          webstorm
-        ];
-      paths = builtins.concatStringsSep " " ides;
    in
-    writeText "jb-ides" paths;
+    symlinkJoin {
+      name = "jetbrains-test-plugins-empty";
+      paths = (map modify-ide ides);
+    };

-  idea-ce-with-plugins = jetbrains.plugins.addPlugins jetbrains.idea-community [
-    "ideavim"
-    "nixidea"
-    # test JAR plugins
-    "wakatime"
-  ];
+  # Test all plugins. This will only build plugins compatible with the IDE and version. It will fail if the plugin is marked
+  # as compatible, but the build version is somehow not in the "builds" map (as that would indicate that something with update_plugins.py went wrong).
+  all =
+    let
+      plugins-json = builtins.fromJSON (builtins.readFile ./plugins.json);
+      plugins-for =
+        with lib.asserts;
+        ide:
+        builtins.map (plugin: plugin.name) (
+          builtins.filter (
+            plugin:
+            (
+              # Plugin has to not be broken
+              (!builtins.elem plugin.name broken-plugins)
+              # IDE has to be compatible
+              && (builtins.elem ide.pname plugin.compatible)
+              # Assert: The build number needs to be included (if marked compatible)
+              && (assertMsg (builtins.elem ide.buildNumber (builtins.attrNames plugin.builds)) "For plugin ${plugin.name} no entry for IDE build ${ide.buildNumber} is defined, even though ${ide.pname} is on that build.")
+              # The plugin has to exist for the build
+              && (plugin.builds.${ide.buildNumber} != null)
+            )
+          ) (builtins.attrValues plugins-json.plugins)
+        );
+      modify-ide = ide: jetbrains.plugins.addPlugins ide (plugins-for ide);
+    in
+    symlinkJoin {
+      name = "jetbrains-test-plugins-all";
+      paths = (map modify-ide ides);
+    };
+
+  # This test builds the IDEs with some plugins and checks that they can be discovered by the IDE.
+  # Test always succeeds on IDEs that the tested plugins don't support.
+  stored-correctly =
+    let
+      plugins-json = builtins.fromJSON (builtins.readFile ./plugins.json);
+      plugin-ids = [
+        # This is a "normal plugin", it's output must be linked into /${pname}/plugins.
+        "8607" # nixidea
+        # This is a plugin where the output contains a single JAR file. This JAR file needs to be linked directly in /${pname}/plugins.
+        "7425" # wakatime
+      ];
+      check-if-supported =
+        ide:
+        builtins.all (
+          plugin:
+          (builtins.elem ide.pname plugins-json.plugins.${plugin}.compatible)
+          && (plugins-json.plugins.${plugin}.builds.${ide.buildNumber} != null)
+        ) plugin-ids;
+      modify-ide = ide: jetbrains.plugins.addPlugins ide plugin-ids;
+    in
+    runCommand "test-jetbrains-plugins-stored-correctly"
+      {
+        idePaths = (map modify-ide (builtins.filter check-if-supported ides));
+      }
+      # TODO: instead of globbing using $ide/*/plugins we could probably somehow get the package name here properly.
+      ''
+        set -e
+        exec &> >(tee -a "$out")
+
+        IFS=' ' read -ra ideArray <<< "$idePaths"
+        for ide in "''${ideArray[@]}"; do
+          echo "processing $ide"
+
+          echo "> ensure normal plugin is available"
+          (
+            set -x
+            find -L $ide/*/plugins -type f -iname 'NixIDEA-*.jar' | grep .
+          )
+
+          echo "> ensure single JAR file plugin is available"
+          (
+            set -x
+            PATH_TO_LINK=$(find $ide/*/plugins -maxdepth 1 -type l -iname '*wakatime.jar' | grep .)
+            test -f $(readlink $PATH_TO_LINK)
+          )
+          echo ""
+        done
+
+        echo "test done! ok!"
+      '';
 }
@@ -1,12 +1,19 @@
 This directory contains the build expressions needed to build any of the jetbrains IDEs.
 The jdk is in `pkgs/development/compilers/jetbrains-jdk`.
-To test the build process of every IDE (as well as the process for adding plugins), build `jetbrains.plugins.tests.default`.
+
+## Tests:
+- To test the build process of every IDE (as well as the process for adding plugins), build `jetbrains.plugins.tests.empty`.
+- To test the build process with all plugins\* supported by all IDEs, build `jetbrains.plugins.tests.all`.
+- To test only plugins for a specific IDE\*, build `jetbrains.ide-name.tests.plugins.all`.
+- To test that plugins are correctly stored in the plugins directory, build `jetbrains.plugins.tests.stored-correctly`.
+
+\*: Plugins marked as broken in nixpkgs are skipped: When updating/fixing plugins, please check the `broken-plugins` in `plugins/tests.nix` and update it if needed.

 ## How to use plugins:
 - Get the ide you want and call `jetbrains.plugins.addPlugins` with a list of plugins you want to add.
 - The list of plugins can be a list of ids or names (as in `plugins/plugins.json`)
 - Example: `jetbrains.plugins.addPlugins jetbrains.pycharm-professional [ "nixidea" ]`
- - The list can also contain a drv giving a `.jar` or `.zip` (this is how you use a plugin not added to nixpkgs)
+ - The list can also contain drvs giving the directory contents of the plugin (this is how you use a plugin not added to nixpkgs) or a single `.jar` (executable). For an example, look at the implementation of `fetchPluginSrc` in `plugins/default.nix`.

 ### How to add a new plugin to nixpkgs
 - Find the page for the plugin on https://plugins.jetbrains.com
@@ -163,7 +163,7 @@ stdenv.mkDerivation rec {
  postPatch = ''
    # fix .desktop Exec field
    substituteInPlace src/node/desktop/resources/freedesktop/rstudio.desktop.in \
-      --replace-fail "''${CMAKE_INSTALL_PREFIX}/rstudio" "rstudio"
+      --replace-fail "\''${CMAKE_INSTALL_PREFIX}/rstudio" "rstudio"

    # set install path of freedesktop files
    substituteInPlace src/node/desktop/CMakeLists.txt \
@@ -5,15 +5,15 @@ let
 in
 {
  sublime4 = common {
-    buildVersion = "4192";
-    x64sha256 = "3CMorzQj+JFPTXp6PPhX6Mlcz/kJb2FM2iwUsvrhy+s=";
-    aarch64sha256 = "gVhDBac3kyDU1qIiXoN7Xf5Jvbdnif2QGuFUy2C34Mo=";
+    buildVersion = "4200";
+    x64sha256 = "NvacVRrRjuRgAr5NnFI/5UXZO2f+pnvupzHnJARLRp8=";
+    aarch64sha256 = "z0tqp06ioqqwLhRFmc+eSkI8u5VDwiH32hCVqVSVVmo=";
  } { };

  sublime4-dev = common {
-    buildVersion = "4196";
+    buildVersion = "4199";
    dev = true;
-    x64sha256 = "lsvPDqN9YkhDl/4LjLoHkV+Po9lTJpS498awzMMCh3c=";
-    aarch64sha256 = "Bwy69jCKkj8AT8WeMXJ3C+yUk+PArHETyp1ZvMXjR5A=";
+    x64sha256 = "Nrhwv+ox/SW21c8wZtuX9mzHQ+o9ghsI50dU2kDvCX0=";
+    aarch64sha256 = "3vCXj53f2Qlt/Ab3hNNng+Y4Ch85Dp0G8srTVBtd6zU=";
  } { };
 }
@@ -3000,6 +3000,19 @@ final: prev: {
    meta.hydraPlatforms = [ ];
  };

+  colorful-winsep-nvim = buildVimPlugin {
+    pname = "colorful-winsep.nvim";
+    version = "2025-04-11";
+    src = fetchFromGitHub {
+      owner = "nvim-zh";
+      repo = "colorful-winsep.nvim";
+      rev = "7bbe4e1353c0fe37c98bad2758aafc410280f6b3";
+      sha256 = "0nm3cr5wzfyanx01nw998cddq1vxww0xn6v8a7db3a2r8fjxp5fx";
+    };
+    meta.homepage = "https://github.com/nvim-zh/colorful-winsep.nvim/";
+    meta.hydraPlatforms = [ ];
+  };
+
  colorizer = buildVimPlugin {
    pname = "colorizer";
    version = "2022-01-03";
@@ -3248,6 +3261,19 @@ final: prev: {
    meta.hydraPlatforms = [ ];
  };

+  contextfiles-nvim = buildVimPlugin {
+    pname = "contextfiles.nvim";
+    version = "2025-05-07";
+    src = fetchFromGitHub {
+      owner = "banjo";
+      repo = "contextfiles.nvim";
+      rev = "d9541105d60c708e2ec6641109f5f2a6179c2a80";
+      sha256 = "1n8nkpy53mqr0hn26lqzcxmp8l6r2873yrsqxrj5cpis0f52qc45";
+    };
+    meta.homepage = "https://github.com/banjo/contextfiles.nvim/";
+    meta.hydraPlatforms = [ ];
+  };
+
  copilot-cmp = buildVimPlugin {
    pname = "copilot-cmp";
    version = "2024-12-11";
@@ -229,6 +229,7 @@ https://github.com/gorbit99/codewindow.nvim/,HEAD,
 https://github.com/metakirby5/codi.vim/,,
 https://github.com/tjdevries/colorbuddy.nvim/,,
 https://github.com/xzbdmw/colorful-menu.nvim/,HEAD,
+https://github.com/nvim-zh/colorful-winsep.nvim/,HEAD,
 https://github.com/lilydjwg/colorizer/,,
 https://github.com/Domeee/com.cloudedmountain.ide.neovim/,HEAD,
 https://github.com/wincent/command-t/,,
@@ -248,6 +249,7 @@ https://github.com/stevearc/conform.nvim/,HEAD,
 https://github.com/Olical/conjure/,,
 https://github.com/wellle/context.vim/,,
 https://github.com/Shougo/context_filetype.vim/,,
+https://github.com/banjo/contextfiles.nvim/,HEAD,
 https://github.com/zbirenbaum/copilot-cmp/,HEAD,
 https://github.com/copilotlsp-nvim/copilot-lsp/,HEAD,
 https://github.com/AndreM222/copilot-lualine/,HEAD,
@@ -4287,8 +4287,8 @@ let
        mktplcRef = {
          name = "metals";
          publisher = "scalameta";
-          version = "1.50.0";
-          hash = "sha256-vMO1u8w4uQc0mvgB3az4G+QnwRwsz5d1+LpDGEShyDw=";
+          version = "1.51.0";
+          hash = "sha256-yLSOLVxulSH4b6EitMyws3FvKub/KXZHuIBGfri9thw=";
        };
        meta = {
          license = lib.licenses.asl20;
@@ -13,7 +13,7 @@ let
  buildVscodeLanguagePack =
    {
      language,
-      version ? "1.99.2025041609",
+      version ? "1.100.2025051409",
      hash,
    }:
    buildVscodeMarketplaceExtension {
@@ -41,71 +41,71 @@ in
  # French
  vscode-language-pack-fr = buildVscodeLanguagePack {
    language = "fr";
-    hash = "sha256-c4p/wVQ9GIxEkF/82ZZpRKxem7IVMK3AzCI/YfZKF4U=";
+    hash = "sha256-W0yM1vg+g7JbCoPmyzx3xSDvq1RoQq2lc6BkDtOkF3M=";
  };
  # Italian
  vscode-language-pack-it = buildVscodeLanguagePack {
    language = "it";
-    hash = "sha256-ftAYkS5WRSqc+rB901J7X8IRE+XuqtIdRiBJfEKumQ8=";
+    hash = "sha256-Lg6XS3VOzfIYTVCfE7wxzhXLFLug5hcTMrxp8BBKzk4=";
  };
  # German
  vscode-language-pack-de = buildVscodeLanguagePack {
    language = "de";
-    hash = "sha256-37pDfoFi4QPOBP9vYPw/+zOXDOluuEojI6ZSYsiwv64=";
+    hash = "sha256-rgAKQd5gztaVQnqAHOY9BjPhM6CZ1NKkqI+oveJRo0E=";
  };
  # Spanish
  vscode-language-pack-es = buildVscodeLanguagePack {
    language = "es";
-    hash = "sha256-IASRtQag6wuNmKtes7L6i0coLluo6ryRW4lUEgQAiz4=";
+    hash = "sha256-5XEqcAxBlKGSmet12M1EAa7TiEzN5XyAaa9Tc/3smUM=";
  };
  # Russian
  vscode-language-pack-ru = buildVscodeLanguagePack {
    language = "ru";
-    hash = "sha256-H8UxMc1FKkfWOcITdwYrI6giD11Sk4YN2er+wnnFvBs=";
+    hash = "sha256-EnzMlQoW9zqJHXwpCcYUu/vN+SHIoluVpij8lF44RJg=";
  };
  # Chinese (Simplified)
  vscode-language-pack-zh-hans = buildVscodeLanguagePack {
    language = "zh-hans";
-    hash = "sha256-3yvzcJXdTIYbBNBaiuW92UYADSUeYPm3clSpSM3k71w=";
+    hash = "sha256-2oKthoWgXGsWsVco2bjkOyOEE5A4Tzhr+8n525Vkujk=";
  };
  # Chinese (Traditional)
  vscode-language-pack-zh-hant = buildVscodeLanguagePack {
    language = "zh-hant";
-    hash = "sha256-AiZYIoE2wdiRXdJVpOTnj0vFJH5UsYh8k5tf/0lNqVY=";
+    hash = "sha256-oh3EuyFzWNf+JfALlIqauUIpuDEbU9Gr2Q+/0fkCguw=";
  };
  # Japanese
  vscode-language-pack-ja = buildVscodeLanguagePack {
    language = "ja";
-    hash = "sha256-96bavTK4JNYk6tfDxnzujHA5V3a1/AL7PTnrNZsyiXU=";
+    hash = "sha256-KRDS9q8jF9pHd8WiUxXUY6LLRUD95uVNWc78RA9rHo4=";
  };
  # Korean
  vscode-language-pack-ko = buildVscodeLanguagePack {
    language = "ko";
-    hash = "sha256-NEkFv+I0TmK9wvfQ9Wc34Q0EnzrHuccQypIAVVYoofY=";
+    hash = "sha256-eF4M59rQG+8sz5h4zL766D/rgbcXSep/C3GdJwwRx10=";
  };
  # Czech
  vscode-language-pack-cs = buildVscodeLanguagePack {
    language = "cs";
-    hash = "sha256-U1loNdDlYC8ahsy2xdeE/zBs/EhAo/DvoUI0rFFCA88=";
+    hash = "sha256-dDWWlEkU4pX9AdBOnCI/VPACXI1xq7EjeUjn7zgr8vU=";
  };
  # Portuguese (Brazil)
  vscode-language-pack-pt-br = buildVscodeLanguagePack {
    language = "pt-BR";
-    hash = "sha256-M02Q5HNCkT1Se+AuJXDNz3YfT9+kyuUTvosqor4bZ4k=";
+    hash = "sha256-PZR9SOHXHmyiqbaTBETDUTZkjuk2XvF5MiH/laNMCLs=";
  };
  # Turkish
  vscode-language-pack-tr = buildVscodeLanguagePack {
    language = "tr";
-    hash = "sha256-ieYvmzK+5QmcwKSXK4X+NQQfd4OCf6IAKuepYByq4b8=";
+    hash = "sha256-AKO04+S9wHap7yhvCyWMT6QT7zC0Rb8XRZvrg9ROjV4=";
  };
  # Polish
  vscode-language-pack-pl = buildVscodeLanguagePack {
    language = "pl";
-    hash = "sha256-DhhlFKICXWjC+c0POuO9upCD0DSzEJ6shkQoK/oTeM4=";
+    hash = "sha256-VR7WrI4lnr3hN2GoS/ZxAZ3kEHdd+S0ZmLfOhHHkYWM=";
  };
  # Pseudo Language
  vscode-language-pack-qps-ploc = buildVscodeLanguagePack {
    language = "qps-ploc";
-    hash = "sha256-mpKx+rluYIuKmpvJVJH6uBPTk6OHBzCIpE7KpOskuEE=";
+    hash = "sha256-nWqw3Og0VMyDM7YgUX4xrd4dgXBDXUdk4AWqaapu3EA=";
  };
 }
@@ -36,22 +36,22 @@ let

  sha256 =
    {
-      x86_64-linux = "07q8vym10qz91wxn8g7ysksqraj6dr2csyxiclc514k2ifvjh7rx";
-      x86_64-darwin = "068ylhrx4sf7ypynmd17kxrgnjiza7qp5bz63m75vz61vqy655f7";
-      aarch64-linux = "1pl30h3vxsms1xdqvcgsqcl7isc5fz4sxvdy3iml45mg78809hj5";
-      aarch64-darwin = "05das18ks3m4kjq612vwn50sl7sb1mgfjdvzshh662z2spqs6ncb";
-      armv7l-linux = "1xbhkak6gipras6mngsyxnq7k6702dccmqp8az5nig45l54rxfm9";
+      x86_64-linux = "1h55vjyv6vy4vyzi6lypnh4jrng8dgb7i6l9rq6k94lbl3mbnb2w";
+      x86_64-darwin = "02c79ii2gpffc552aq0slpxfdp4ajf1cp7djhn7bap22wym53x8v";
+      aarch64-linux = "1ixx31ar2hb25387520509p8lqi9a5if7c992hizvjwdvwfsvwx5";
+      aarch64-darwin = "1ic6z47ci0wqq7sak0x9x0ywa0m7mgls2fm6m9fvd4xh1asa25ms";
+      armv7l-linux = "1xn1nl7s88jsxwavm3m9w35518qn4886mqh6zfiwzj5dn3ib8425";
    }
    .${system} or throwSystem;
 in
 callPackage ./generic.nix rec {
  # Please backport all compatible updates to the stable release.
  # This is important for the extension ecosystem.
-  version = "1.100.1";
+  version = "1.100.2";
  pname = "vscode" + lib.optionalString isInsiders "-insiders";

  # This is used for VS Code - Remote SSH test
-  rev = "91fa95bccb027ece6a968589bb1d662fa9c8e170";
+  rev = "848b80aeb52026648a8ff9f7c45a9b0a80641e2e";

  executableName = "code" + lib.optionalString isInsiders "-insiders";
  longName = "Visual Studio Code" + lib.optionalString isInsiders " - Insiders";
@@ -75,7 +75,7 @@ callPackage ./generic.nix rec {
    src = fetchurl {
      name = "vscode-server-${rev}.tar.gz";
      url = "https://update.code.visualstudio.com/commit:${rev}/server-linux-x64/stable";
-      sha256 = "1jwy61nypha77iq8mwp2c8jmfxic61m9rkq3p3sjh2i442n0lnwq";
+      sha256 = "0d5hbhk4f551yxrq28xyg3yj5xh72d9c1kd1cc9r9fq94l93pdvm";
    };
    stdenv = stdenvNoCC;
  };
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "dosbox-pure";
-  version = "0-unstable-2025-05-09";
+  version = "0-unstable-2025-05-24";

  src = fetchFromGitHub {
    owner = "schellingb";
    repo = "dosbox-pure";
-    rev = "7c30b5266a37cee67612b7cab1a714be16f3be4e";
-    hash = "sha256-VVswTqlUqW79P9LhEV7epEGT6JknejZnArb3f+qFE40=";
+    rev = "773f775cb8bd4a79e505413cbe7172ec5de948c1";
+    hash = "sha256-SQjwQhy+/RI0159QMCk04G6AFtBKBushjNWtOXfohps=";
  };

  hardeningDisable = [ "format" ];
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "gambatte";
-  version = "0-unstable-2025-05-02";
+  version = "0-unstable-2025-05-16";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "gambatte-libretro";
-    rev = "a85fe7c20933dbe4680d783d32639a71a85783cb";
-    hash = "sha256-YwQQkRshDDQi9CzqNnhKkj7+A0fkvcEZEg6PySaFDRI=";
+    rev = "0b95f252ba9cdb366b4d87e6236b0a63f4305cba";
+    hash = "sha256-EcTd5ihZcdQ2LJNy8jcD4g6+PhR1Jialjd3xa6tZMew=";
  };

  meta = {
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "genesis-plus-gx";
-  version = "0-unstable-2025-05-02";
+  version = "0-unstable-2025-05-23";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "Genesis-Plus-GX";
-    rev = "f64e0a1e04a67a5edf79026c07dc5094f8df74bc";
-    hash = "sha256-eG0lzdo/AWVAl+V71X8YNGK1Dk1oLW3jvGY3IS0ekNw=";
+    rev = "d2a3d8a03ac76c01543da22c20d3654de890ee97";
+    hash = "sha256-d8YqkzeMc7Q07YTDUH1bxzscDY/1CGf3V0BIuFdqV+A=";
  };

  meta = {
@@ -14,13 +14,13 @@
 }:
 mkLibretroCore {
  core = "play";
-  version = "0-unstable-2025-05-09";
+  version = "0-unstable-2025-05-23";

  src = fetchFromGitHub {
    owner = "jpd002";
    repo = "Play-";
-    rev = "96d27505b8332bac1bac7b8f02c049b1cc0ca800";
-    hash = "sha256-dX8aH5zGcrCJc/hG/4Yfzv/O2jy8h+HB8pVwI3qPXEY=";
+    rev = "0bd77c19fbbdb83e98988fc5b7944dbeee9eee3e";
+    hash = "sha256-L99pyfhuMf40MXMAFz/aGmp+i7LjosubQXQZd4XzkHY=";
    fetchSubmodules = true;
  };

@@ -71,7 +71,7 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "vivaldi";
-  version = "7.3.3635.12";
+  version = "7.4.3684.38";

  suffix =
    {
@@ -84,8 +84,8 @@ stdenv.mkDerivation rec {
    url = "https://downloads.vivaldi.com/${branch}/vivaldi-${branch}_${version}-1_${suffix}.deb";
    hash =
      {
-        aarch64-linux = "sha256-Gplg0QD7DcibaOv1Q8RUnefACZdNnM8yKYYiP1dpY58=";
-        x86_64-linux = "sha256-qcV4n9/nAbb0Gw8azorDSjpjy4cXe2XlR94WwuwUEyc=";
+        aarch64-linux = "sha256-SmmmEFSzAGgm9eKeTKpUFuW/UVNyXw8x8c1uRp69fbw=";
+        x86_64-linux = "sha256-h/ZcJq51gsb03V5KFlPOE9H0NonYxJNeWVg2UCQEBPs=";
      }
      .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
  };
@@ -22,13 +22,13 @@

 buildGoModule (finalAttrs: {
  pname = "kubernetes";
-  version = "1.33.0";
+  version = "1.33.1";

  src = fetchFromGitHub {
    owner = "kubernetes";
    repo = "kubernetes";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-5MlMBsYf8V7BvV6xaeRMVSRaE+TpG8xJkMwVGm/fVdo=";
+    hash = "sha256-fPKLe1P2jsu6pOTqofFrk1048kPOx/mmXYm7/tBzM84=";
  };

  vendorHash = null;
@@ -9,7 +9,7 @@ let
  versions =
    if stdenv.hostPlatform.isLinux then
      {
-        stable = "0.0.94";
+        stable = "0.0.95";
        ptb = "0.0.143";
        canary = "0.0.678";
        development = "0.0.75";
@@ -26,7 +26,7 @@ let
    x86_64-linux = {
      stable = fetchurl {
        url = "https://stable.dl2.discordapp.net/apps/linux/${version}/discord-${version}.tar.gz";
-        hash = "sha256-035nfbEyvdsNxZh6fkXh2JhY7EXQtwUnS4sUKr74MRQ=";
+        hash = "sha256-8NpHTG3ojEr8LCRBE/urgH6xdAHLUhqz+A95obB75y4=";
      };
      ptb = fetchurl {
        url = "https://ptb.dl2.discordapp.net/apps/linux/${version}/discord-ptb-${version}.tar.gz";
@@ -47,7 +47,7 @@ assert (!blas.isILP64) && (!lapack.isILP64);

 stdenv.mkDerivation (finalAttrs: {
  pname = "R";
-  version = "4.4.3";
+  version = "4.5.0";

  src =
    let
@@ -55,7 +55,7 @@ stdenv.mkDerivation (finalAttrs: {
    in
    fetchurl {
      url = "https://cran.r-project.org/src/base/R-${lib.versions.major version}/${pname}-${version}.tar.gz";
-      sha256 = "sha256-DZPSJEQt6iU8KwhvCI220NPP2bWSzVSW6MshQ+kPyeg=";
+      sha256 = "sha256-OzPqET4NHdyXk4dNWUnOwsc4b2bkq/sc75rsIoRsPOE=";
    };

  outputs = [
@@ -1,33 +0,0 @@
-{ lib, stdenv }:
-
-args:
-
-# TODO(@wolfgangwalther): Remove substituteAllFiles after 25.05 branch-off.
-lib.warn
-  "substituteAllFiles is deprecated and will be removed in 25.11. Use replaceVars for each file instead."
-  (
-    stdenv.mkDerivation (
-      {
-        name = if args ? name then args.name else baseNameOf (toString args.src);
-        builder = builtins.toFile "builder.sh" ''
-          set -o pipefail
-
-          eval "$preInstall"
-
-          args=
-
-          pushd "$src"
-          echo -ne "${lib.concatStringsSep "\\0" args.files}" | xargs -0 -n1 -I {} -- find {} -type f -print0 | while read -d "" line; do
-            mkdir -p "$out/$(dirname "$line")"
-            substituteAll "$line" "$out/$line"
-          done
-          popd
-
-          eval "$postInstall"
-        '';
-        preferLocalBuild = true;
-        allowSubstitutes = false;
-      }
-      // args
-    )
-  )
@@ -1,29 +0,0 @@
-{ lib, stdenvNoCC }:
-# see the substituteAll in the nixpkgs documentation for usage and constraints
-args:
-let
-  # keep this in sync with substituteAll
-  isInvalidArgName = x: builtins.match "^[a-z][a-zA-Z0-9_]*$" x == null;
-  invalidArgs = builtins.filter isInvalidArgName (builtins.attrNames args);
-in
-# TODO(@wolfgangwalther): Remove substituteAll, the nix function, after 25.05 branch-off.
-lib.warn "substituteAll is deprecated and will be removed in 25.11. Use replaceVars instead." (
-  if invalidArgs == [ ] then
-    stdenvNoCC.mkDerivation (
-      {
-        name = if args ? name then args.name else baseNameOf (toString args.src);
-        builder = ./substitute-all.sh;
-        inherit (args) src;
-        preferLocalBuild = true;
-        allowSubstitutes = false;
-      }
-      // args
-    )
-  else
-    throw ''
-      Argument names for `pkgs.substituteAll` must:
-        - start with a lower case ASCII letter
-        - only contain ASCII letters, digits and underscores
-      Found invalid argument names: ${lib.concatStringsSep ", " invalidArgs}.
-    ''
-)
@@ -4,17 +4,19 @@
  lib,
  python3,
  nix-update-script,
+  cmake,
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "ac-library";
-  version = "1.5.1";
+  version = "1.6";

  src = fetchFromGitHub {
    owner = "atcoder";
    repo = "ac-library";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-AIqG98c1tcxxhYcX+NSf6Rw3onw61T5NTZtqQzT9jls=";
+    fetchSubmodules = true;
+    hash = "sha256-1wwzN/JPS6daj1vDFuEN5z20tMdLfMvEKti0sxCVlHA=";
  };

  outputs = [
@@ -26,6 +28,41 @@ stdenv.mkDerivation (finalAttrs: {
    python3
  ];

+  nativeInstallCheckInputs = [
+    python3.pkgs.pytest
+    cmake
+  ];
+
+  dontUseCmakeConfigure = true;
+
+  doInstallCheck = true;
+  installCheckPhase = ''
+    runHook preInstallCheck
+
+    substituteInPlace test/test_expander.py \
+      --replace-fail "g++" "$CXX"
+    python -m pytest --ignore-glob='test/unittest/googletest/*'
+
+    pushd test/unittest
+    mkdir build
+    cd build
+    cmake .. -DCMAKE_BUILD_TYPE=Debug -DCMAKE_CXX_STANDARD=$STDCXX
+    make
+    ctest -VV
+    popd
+
+    runHook postInstallCheck
+  '';
+
+  # We don't need -fno-strict-overflow because it will break UBSanitize's overflow check especially when the operation number is static definded.
+  hardeningDisable = [ "strictoverflow" ];
+
+  env = {
+    NIX_CFLAGS_COMPILE = toString [
+      "-Wno-error=array-bounds"
+    ];
+  };
+
  installPhase = ''
    runHook preInstall

@@ -0,0 +1,39 @@
+{
+  lib,
+  fetchFromGitHub,
+  buildGoModule,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "andcli";
+  version = "2.1.3";
+
+  subPackages = [ "cmd/andcli" ];
+
+  src = fetchFromGitHub {
+    owner = "tjblackheart";
+    repo = "andcli";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-MfhChaowSkCggeyubYdlcmU3+dd+yXlVrgdr85xjlI8=";
+  };
+
+  vendorHash = "sha256-C5XW3nxTUjcH6YaFYSxuKdtMF5SvrbOjErWIQXNwSJA=";
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/tjblackheart/andcli/v2/internal/buildinfo.Commit=${finalAttrs.src.tag}"
+    "-X github.com/tjblackheart/andcli/v2/internal/buildinfo.AppVersion=${finalAttrs.src.tag}"
+  ];
+
+  # As stated in #404465 the versionCheckHook does not work so it is not used here
+
+  meta = {
+    homepage = "https://github.com/tjblackheart/andcli";
+    description = "2FA TUI for your shell";
+    changelog = "https://github.com/tjblackheart/andcli/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ Cameo007 ];
+    mainProgram = "andcli";
+  };
+})
@@ -8,13 +8,13 @@

 buildGoModule (finalAttrs: {
  pname = "atlas";
-  version = "0.33.0";
+  version = "0.33.1";

  src = fetchFromGitHub {
    owner = "ariga";
    repo = "atlas";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-uMINAdoHYRVaZ7QdxZ0G03cOTRe6ObnIuxo3ic+tMnE=";
+    hash = "sha256-Io7FnPxvr3XIj+Tbf1yVxjTnqoRzQZnaVlImcwBjwXE=";
  };

  modRoot = "cmd/atlas";
@@ -2,7 +2,6 @@
  lib,
  python3Packages,
  fetchFromGitHub,
-  fetchpatch,
  replaceVars,
  gobject-introspection,
  wrapGAppsHook3,
@@ -12,14 +11,14 @@
 }:
 python3Packages.buildPythonPackage rec {
  pname = "auto-cpufreq";
-  version = "2.5.0";
+  version = "2.6.0";
  format = "pyproject";

  src = fetchFromGitHub {
    owner = "AdnanHodzic";
    repo = "auto-cpufreq";
    tag = "v${version}";
-    hash = "sha256-iDvgL5dQerQnu2ERKAWGvWppG7cQ/0uKEfVY93ItvO4=";
+    hash = "sha256-DEs6jbWYJFJgpaPtF5NT3DQs3erjzdm2brLNHpjrEPA=";
  };

  nativeBuildInputs = [
@@ -42,6 +41,9 @@ python3Packages.buildPythonPackage rec {
      poetry-dynamic-versioning
      setuptools
      pyinotify
+      urwid
+      pyasyncore
+      requests
    ]
    ++ [ getent ];

@@ -58,13 +60,6 @@ python3Packages.buildPythonPackage rec {
    ./prevent-install-and-copy.patch
    # patch to prevent update
    ./prevent-update.patch
-
-    # ps-util python package bounds are too strict for version 2.5.0
-    (fetchpatch {
-      name = "auto-cpufreq-2.5.0-ps-util-relax-constraints.patch";
-      url = "https://github.com/AdnanHodzic/auto-cpufreq/commit/8f026ac6497050c0e07c55b751c4b80401e932ec.patch";
-      sha256 = "sha256-hcEcuy7oW4fZgfOLSap3pnWk7H1Q757tgfl7HIUyWiM=";
-    })
  ];

  postPatch = ''
@@ -111,25 +111,3 @@ index b51d55d..99eeed8 100755
 
 def new_update(custom_dir):
     os.chdir(custom_dir)
-diff --git c/poetry.lock i/poetry.lock
-index 0e6da84..b4936fe 100644
--- c/poetry.lock
-+++ i/poetry.lock
-@@ -1306,4 +1306,4 @@ test = ["big-O", "jaraco.functools", "jaraco.itertools", "jaraco.test", "more-it
- [metadata]
- lock-version = "2.0"
- python-versions = "^3.8"
-content-hash = "cad3783d04e35b66b241352e76631d0a83c8df3d286b113979ba34a65847f06c"
-+content-hash = "b21af52156d2d624602fe6941cf001abd7f8cf5b70b22ebfd7b7ad0dece1e39f"
-diff --git c/pyproject.toml i/pyproject.toml
-index 562a94b..cc44d8d 100644
--- c/pyproject.toml
-+++ i/pyproject.toml
-@@ -25,7 +25,6 @@ python = "^3.8"
- psutil = "^6.0.0"
- click = "^8.1.0"
- distro = "^1.8.0"
-requests = "^2.32.3"
- PyGObject = "^3.46.0"
- pyinotify = {git = "https://github.com/shadeyg56/pyinotify-3.12"}
- 
@@ -12,17 +12,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "brush";
-  version = "0.2.17";
+  version = "0.2.18";

  src = fetchFromGitHub {
    owner = "reubeno";
    repo = "brush";
    tag = "brush-shell-v${version}";
-    hash = "sha256-64xj9yu6OCNTnuymEd5ihdE0s8RWfrSMfTz9TlMQ6Sg=";
+    hash = "sha256-lX8e2gqbZMbsdMD1ZUK0l5xlCq+NkzBDeZSMzrPX+zI=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-AIEgSUl3YFCa6FOgoZYpPc1qc2EOfpm1lZEQYlBgkGg=";
+  cargoHash = "sha256-qHbKbWzuOpoRVySZd/yeGnDNbFGb2fQmgz0ETcNLoVE=";

  nativeInstallCheckInputs = [
    versionCheckHook
@@ -6,20 +6,20 @@
  pkg-config,
  python3,
  boost,
-  fuse,
+  fuse3,
  libtorrent-rasterbar,
  curl,
 }:

 stdenv.mkDerivation rec {
  pname = "btfs";
-  version = "2.24";
+  version = "3.1";

  src = fetchFromGitHub {
    owner = "johang";
    repo = "btfs";
    rev = "v${version}";
-    sha256 = "sha256-fkS0U/MqFRQNi+n7NE4e1cnNICvfST2IQ9FMoJUyj6w=";
+    sha256 = "sha256-JuofC4TpbZ56qiUrHeoK607YHVbwqwLGMIdUpsTm9Ic=";
  };

  nativeBuildInputs = [
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
  ];
  buildInputs = [
    boost
-    fuse
+    fuse3
    libtorrent-rasterbar
    curl
    python3
@@ -14,13 +14,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "budgie-analogue-clock-applet";
-  version = "2.1";
+  version = "2.2";

  src = fetchFromGitHub {
    owner = "samlane-ma";
    repo = "analogue-clock-applet";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-NvXX5paRrjeJFqnOeJS9yNp+7cRohsN3+eocLqvcVj8=";
+    hash = "sha256-8kqDEzcUqg/TvwpazYQt1oQDVC00fOxFLVsKYMDuV9I=";
  };

  nativeBuildInputs = [
@@ -12,36 +12,36 @@ let
  # svm-rs's source code.
  solc-versions = {
    x86_64-linux = fetchurl {
-      url = "https://raw.githubusercontent.com/ethereum/solc-bin/60de887187e5670c715931a82fdff6677b31f0cb/linux-amd64/list.json";
-      hash = "sha256-zm1cdqSP4Y9UQcq9OV8sXxnzr3+TWdc7mdg+Do8Y7WY=";
+      url = "https://raw.githubusercontent.com/ethereum/solc-bin/bdd7dd3fda6e4a00c0697d891a1a7ae9f2b3a5fd/linux-amd64/list.json";
+      hash = "sha256-H6D6XbIw5sDZlbc2c51vIMRmOqs2nDIcaNzCaOvnLsw=";
    };
    x86_64-darwin = fetchurl {
-      url = "https://raw.githubusercontent.com/ethereum/solc-bin/60de887187e5670c715931a82fdff6677b31f0cb/macosx-amd64/list.json";
-      hash = "sha256-uUdd5gCG7SHQgAW2DQXemTujb8bUJM27J02WjLkQgek=";
+      url = "https://raw.githubusercontent.com/ethereum/solc-bin/bdd7dd3fda6e4a00c0697d891a1a7ae9f2b3a5fd/macosx-amd64/list.json";
+      hash = "sha256-A3A6gtNb129tD5KC0tCXvlzQ11t5SrNrX8tQeq73+mY=";
    };
    aarch64-linux = fetchurl {
-      url = "https://raw.githubusercontent.com/nikitastupin/solc/923ab4b852fadc00ffe87bb76fff21d0613bd280/linux/aarch64/list.json";
-      hash = "sha256-mJaEN63mR3XdK2FmEF+VhLR6JaCCtYkIRq00wYH6Xx8=";
+      url = "https://raw.githubusercontent.com/nikitastupin/solc/99b5867237b37952d372e0dab400d6788feda315/linux/aarch64/list.json";
+      hash = "sha256-u6WRAcnR9mN9ERfFdLOxxSc9ASQIQvmS8uG+Z4H6OAU=";
    };
    aarch64-darwin = fetchurl {
-      url = "https://raw.githubusercontent.com/alloy-rs/solc-builds/260964c1fcae2502c0139070bdc5c83eb7036a68/macosx/aarch64/list.json";
-      hash = "sha256-xrtb3deMDAuDIjzN1pxm5NyW5NW5OyoOHTFsYyWJCYY=";
+      url = "https://raw.githubusercontent.com/alloy-rs/solc-builds/e4b80d33bc4d015b2fc3583e217fbf248b2014e1/macosx/aarch64/list.json";
+      hash = "sha256-h0B1g7x80jU9iCFCMYw+HlmdKQt1wfhIkV5W742kw6w=";
    };
  };
 in
 rustPlatform.buildRustPackage rec {
  pname = "bulloak";
-  version = "0.8.0";
+  version = "0.8.1";

  src = fetchFromGitHub {
    owner = "alexfertel";
    repo = "bulloak";
    rev = "v${version}";
-    hash = "sha256-OAjy8SXaD+2/C5jLNIezv/KdrPHlwJC5L1LwGhqBWQs=";
+    hash = "sha256-8Qp8ceafAkw7Tush/dvBl27q5oNDzbOqyvSLXhjf4fo=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-sdnpnKWKCJeBbooM0Qe/wccF1b3LLiTfZe4RdxbJYcs=";
+  cargoHash = "sha256-yaRaB3U8Wxhp7SK5E44CF8AudhG7ar7L5ey+CRVfYqc=";

  # tests run in CI on the source repo
  doCheck = false;
@@ -1,22 +1,25 @@
 GEM
  remote: https://rubygems.org/
  specs:
-    aws-eventstream (1.3.0)
-    aws-partitions (1.1001.0)
-    aws-sdk-core (3.211.0)
+    aws-eventstream (1.3.2)
+    aws-partitions (1.1106.0)
+    aws-sdk-core (3.224.0)
      aws-eventstream (~> 1, >= 1.3.0)
      aws-partitions (~> 1, >= 1.992.0)
      aws-sigv4 (~> 1.9)
+      base64
      jmespath (~> 1, >= 1.6.1)
-    aws-sdk-kms (1.95.0)
-      aws-sdk-core (~> 3, >= 3.210.0)
+      logger
+    aws-sdk-kms (1.101.0)
+      aws-sdk-core (~> 3, >= 3.216.0)
      aws-sigv4 (~> 1.5)
-    aws-sdk-s3 (1.169.0)
-      aws-sdk-core (~> 3, >= 3.210.0)
+    aws-sdk-s3 (1.186.1)
+      aws-sdk-core (~> 3, >= 3.216.0)
      aws-sdk-kms (~> 1)
      aws-sigv4 (~> 1.5)
-    aws-sigv4 (1.10.1)
+    aws-sigv4 (1.11.0)
      aws-eventstream (~> 1, >= 1.0.2)
+    base64 (0.2.0)
    cfn-model (0.6.6)
      kwalify (= 0.7.2)
      psych (~> 3)
@@ -32,17 +35,18 @@ GEM
    kwalify (0.7.2)
    lightly (0.3.3)
    little-plugger (1.1.4)
-    logger (1.6.1)
+    logger (1.7.0)
    logging (2.2.2)
      little-plugger (~> 1.1)
      multi_json (~> 1.10)
    multi_json (1.15.0)
    netaddr (2.0.6)
    optimist (3.0.1)
-    ostruct (0.6.0)
+    ostruct (0.6.1)
    psych (3.3.4)
-    rexml (3.3.9)
-    syslog (0.1.2)
+    rexml (3.4.1)
+    syslog (0.3.0)
+      logger

 PLATFORMS
  ruby
@@ -54,4 +58,4 @@ DEPENDENCIES
  syslog

 BUNDLED WITH
-   2.3.27
+   2.6.6
@@ -4,36 +4,38 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0gvdg4yx4p9av2glmp7vsxhs0n8fj1ga9kq2xdb8f95j7b04qhzi";
+      sha256 = "1mvjjn8vh1c3nhibmjj9qcwxagj6m9yy961wblfqdmvhr9aklb3y";
      type = "gem";
    };
-    version = "1.3.0";
+    version = "1.3.2";
  };
  aws-partitions = {
    groups = [ "default" ];
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "01w3b84d129q9b6bg2cm8p4cn8pl74l343sxsc47ax9sglqz6y99";
+      sha256 = "12svi07s5hss8wq9xpaxwy1ibl64bd00hsn12v810wvz19fw823l";
      type = "gem";
    };
-    version = "1.1001.0";
+    version = "1.1106.0";
  };
  aws-sdk-core = {
    dependencies = [
      "aws-eventstream"
      "aws-partitions"
      "aws-sigv4"
+      "base64"
      "jmespath"
+      "logger"
    ];
    groups = [ "default" ];
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "16mvscjhxdyhlvk2rpbxdzqmyikcf64xavb35grk4dkh0pg390rk";
+      sha256 = "1b0pi1iibp644dn78g53s7hs7gcxghfa7h8rz3lvz8ivykisl5y6";
      type = "gem";
    };
-    version = "3.211.0";
+    version = "3.224.0";
  };
  aws-sdk-kms = {
    dependencies = [
@@ -44,10 +46,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0ppxhw2qyj69achpmksp1sh2y6k0x44928ln2am9pifx8b30ir9a";
+      sha256 = "1mv8jc8sbvim2m3y3zxm8z4i5sh4x9ds7y9h5z04qfg7kjvbbn24";
      type = "gem";
    };
-    version = "1.95.0";
+    version = "1.101.0";
  };
  aws-sdk-s3 = {
    dependencies = [
@@ -59,10 +61,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1jnf9k9d91ki3yvy12q4kph5wvd8l3ziwwh0qsmar5xhyb7zbwrz";
+      sha256 = "00sq22mfibxq3rjy9c4vj1s8yjszv8988di7z7rs8v62my53nw2v";
      type = "gem";
    };
-    version = "1.169.0";
+    version = "1.186.1";
  };
  aws-sigv4 = {
    dependencies = [ "aws-eventstream" ];
@@ -70,10 +72,20 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1fq3lbvkgm1vk5wa8l7vdnq3vjnlmsnyf4bbd0jq3qadyd9hf54a";
+      sha256 = "1nx1il781qg58nwjkkdn9fw741cjjnixfsh389234qm8j5lpka2h";
      type = "gem";
    };
-    version = "1.10.1";
+    version = "1.11.0";
+  };
+  base64 = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "01qml0yilb9basf7is2614skjp8384h2pycfx86cr8023arfj98g";
+      type = "gem";
+    };
+    version = "0.2.0";
  };
  cfn-model = {
    dependencies = [
@@ -153,10 +165,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0lwncq2rf8gm79g2rcnnyzs26ma1f4wnfjm6gs4zf2wlsdz5in9s";
+      sha256 = "00q2zznygpbls8asz5knjvvj2brr3ghmqxgr83xnrdj4rk3xwvhr";
      type = "gem";
    };
-    version = "1.6.1";
+    version = "1.7.0";
  };
  logging = {
    dependencies = [
@@ -207,10 +219,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "11dsv71gfbhy92yzj3xkckjzdai2bsz5a4fydgimv62dkz4kc5rv";
+      sha256 = "05xqijcf80sza5pnlp1c8whdaay8x5dc13214ngh790zrizgp8q9";
      type = "gem";
    };
-    version = "0.6.0";
+    version = "0.6.1";
  };
  psych = {
    groups = [ "default" ];
@@ -227,19 +239,20 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1j9p66pmfgxnzp76ksssyfyqqrg7281dyi3xyknl3wwraaw7a66p";
+      sha256 = "1jmbf6lf7pcyacpb939xjjpn1f84c3nw83dy3p1lwjx0l2ljfif7";
      type = "gem";
    };
-    version = "3.3.9";
+    version = "3.4.1";
  };
  syslog = {
+    dependencies = [ "logger" ];
    groups = [ "default" ];
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "12xqgjrnjpc1c7shajyz2h96bw2nlgb4lkaypj58dp6rch7s36sr";
+      sha256 = "023lbh48fcn72gwyh1x52ycs1wx1bnhdajmv0qvkidmdsmxnxzjd";
      type = "gem";
    };
-    version = "0.1.2";
+    version = "0.3.0";
  };
 }
@@ -5,14 +5,14 @@
  ruby,
 }:

-bundlerEnv {
+bundlerEnv rec {
  pname = "cfn-nag";
  version = "0.8.10";

  inherit ruby;
  gemdir = ./.;

-  passthru.updateScript = bundlerUpdateScript "cfn-nag";
+  passthru.updateScript = bundlerUpdateScript pname;

  meta = {
    description = "Linting tool for CloudFormation templates";
@@ -43,7 +43,7 @@
 # $ conda-shell
 # $ conda install spyder
 let
-  version = "25.1.1-2";
+  version = "25.3.1-1";

  src =
    let
@@ -57,10 +57,10 @@ let
      };
    in
    fetchurl {
-      url = "https://repo.anaconda.com/miniconda/Miniconda3-py312_${version}-Linux-${arch}.sh";
+      url = "https://repo.anaconda.com/miniconda/Miniconda3-py313_${version}-Linux-${arch}.sh";
      hash = selectSystem {
-        x86_64-linux = "sha256-R2bYW199I1ziUOmY67WoqCEMvU8rD+pNIXez7Z6oeIQ=";
-        aarch64-linux = "sha256-bQW5+bfzJ7kHl6TPVtaMgVeLqy9jJXo+eotyyw8OS10=";
+        x86_64-linux = "sha256-U6hhCUY8/XC6esqzltQW5iMBKRTu4ARynh7Nb+lOjGk=";
+        aarch64-linux = "sha256-TKoMJmq3JrRAzK1Ap0d0FnSU4AHaXeKBt08tVnPkrOk=";
      };
    };

@@ -8,7 +8,7 @@

 buildGoModule rec {
  pname = "consul";
-  version = "1.21.0";
+  version = "1.21.1";

  # Note: Currently only release tags are supported, because they have the Consul UI
  # vendored. See
@@ -22,7 +22,7 @@ buildGoModule rec {
    owner = "hashicorp";
    repo = pname;
    tag = "v${version}";
-    hash = "sha256-KNBsOKd+GzxhmvM2aItnoYpob8cZ7Wzjp1fi7IRlLnk=";
+    hash = "sha256-bkBjKvSJapkiqCKENR+mG3sWYTBUZf9klw2UHqgccdc=";
  };

  # This corresponds to paths with package main - normally unneeded but consul
@@ -32,7 +32,7 @@ buildGoModule rec {
    "connect/certgen"
  ];

-  vendorHash = "sha256-l0fhZVsaoQnKVN2/3ioS/T7YSNTarOy84PxZ9Xx40t4=";
+  vendorHash = "sha256-06tLz04hFZ2HqpetKMRfFY2JJI4TgedzKYpwcVbemfU=";

  doCheck = false;

@@ -10,6 +10,11 @@
  sndio,
  speexdsp,
  lazyLoad ? !stdenv.hostPlatform.isDarwin,
+  alsaSupport ? !stdenv.hostPlatform.isDarwin,
+  pulseSupport ? !stdenv.hostPlatform.isDarwin,
+  jackSupport ? !stdenv.hostPlatform.isDarwin,
+  sndioSupport ? !stdenv.hostPlatform.isDarwin,
+  buildSharedLibs ? true,
 }:

 assert lib.assertMsg (
@@ -17,12 +22,11 @@ assert lib.assertMsg (
 ) "cubeb: lazyLoad is inert on Darwin";

 let
-  backendLibs = [
-    alsa-lib
-    jack2
-    libpulseaudio
-    sndio
-  ];
+  backendLibs =
+    lib.optional alsaSupport alsa-lib
+    ++ lib.optional jackSupport jack2
+    ++ lib.optional pulseSupport libpulseaudio
+    ++ lib.optional sndioSupport sndio;

 in
 stdenv.mkDerivation {
@@ -44,7 +48,7 @@ stdenv.mkDerivation {
  buildInputs = [ speexdsp ] ++ lib.optionals (!stdenv.hostPlatform.isDarwin) backendLibs;

  cmakeFlags = [
-    "-DBUILD_SHARED_LIBS=ON"
+    (lib.cmakeBool "BUILD_SHARED_LIBS" buildSharedLibs)
    "-DBUILD_TESTS=OFF" # tests require an audio server
    "-DBUNDLE_SPEEX=OFF"
    "-DUSE_SANITIZERS=OFF"
@@ -58,12 +62,27 @@ stdenv.mkDerivation {
    backendLibs = lib.optionals lazyLoad backendLibs;
  };

+  postInstall = ''
+    # TODO: remove after https://github.com/mozilla/cubeb/pull/813 is merged
+    mkdir -p $out/lib/pkgconfig/
+    echo > $out/lib/pkgconfig/libcubeb.pc \
+    "Name: libcubeb
+    Description: Cross platform audio library
+    Version: 0.0.0
+    Requires.private: libpulse
+    Libs: -L"$out/lib" -lcubeb
+    Libs.private: -lstdc++"
+  '';
+
  meta = with lib; {
    description = "Cross platform audio library";
    mainProgram = "cubeb-test";
    homepage = "https://github.com/mozilla/cubeb";
    license = licenses.isc;
    platforms = platforms.linux ++ platforms.darwin;
-    maintainers = with maintainers; [ zhaofengli ];
+    maintainers = with maintainers; [
+      zhaofengli
+      marcin-serwin
+    ];
  };
 }
@@ -5,22 +5,21 @@
  stdenv,
  installShellFiles,
  testers,
-  cue,
  callPackage,
 }:

-buildGoModule rec {
+buildGoModule (finalAttrs: {
  pname = "cue";
-  version = "0.12.1";
+  version = "0.13.0";

  src = fetchFromGitHub {
    owner = "cue-lang";
    repo = "cue";
-    tag = "v${version}";
-    hash = "sha256-nCwmW3nHcgUDG+dmcRd5+nqArUmBE3+ZZDZTDZSySQ0=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-RvdjZ3wSc3IhQvYJL989x33qOtVZ4paoQTLFzWF9xj0=";
  };

-  vendorHash = "sha256-vkfXT8mAomQml/kQRb2VIi+D+jpc0qgE2AsJ8jK6LRQ=";
+  vendorHash = "sha256-J9Ox9Yt64PmL2AE+GRdWDHlBtpfmDtxgUbEPaka5JSo=";

  subPackages = [ "cmd/*" ];

@@ -29,7 +28,7 @@ buildGoModule rec {
  ldflags = [
    "-s"
    "-w"
-    "-X cuelang.org/go/cmd/cue/cmd.version=v${version}"
+    "-X cuelang.org/go/cmd/cue/cmd.version=v${finalAttrs.version}"
  ];

  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
@@ -44,9 +43,9 @@ buildGoModule rec {
    tests = {
      test-001-all-good = callPackage ./tests/001-all-good.nix { };
      version = testers.testVersion {
-        package = cue;
+        package = finalAttrs.finalPackage;
        command = "cue version";
-        version = "v${version}";
+        version = "v${finalAttrs.version}";
      };
    };
  };
@@ -58,4 +57,4 @@ buildGoModule rec {
    maintainers = with lib.maintainers; [ aaronjheng ];
    mainProgram = "cue";
  };
-}
+})
@@ -23,13 +23,13 @@ let
 in
 stdenv.mkDerivation {
  pname = "drawterm";
-  version = "0-unstable-2025-03-18";
+  version = "0-unstable-2025-05-18";

  src = fetchFrom9Front {
    owner = "plan9front";
    repo = "drawterm";
-    rev = "0b43ac046ca81d78e9eca535ab1e92971d30405a";
-    hash = "sha256-L0a81zwzIKwnRK/Mu/kW1oHoJCroa+VDNGj7CI90WMQ=";
+    rev = "a6c1ce4e0244ca70403dc4e795a9cee548159560";
+    hash = "sha256-W9IsFnJE4Bpdc2K9DcRq+zRPMU9Wd4xpM0lHkh5SirQ=";
  };

  enableParallelBuilding = true;
@@ -3,9 +3,11 @@
  fetchFromGitHub,
  rustPlatform,
  installShellFiles,
+  versionCheckHook,
+  nix-update-script,
 }:

-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
  # Originally, this package was under the attribute `du-dust`, since `dust` was taken.
  # Since then, `dust` has been freed up, allowing this package to take that attribute.
  # However in order for tools like `nix-env` to detect package updates, keep `du-dust` for pname.
@@ -15,7 +17,7 @@ rustPlatform.buildRustPackage rec {
  src = fetchFromGitHub {
    owner = "bootandy";
    repo = "dust";
-    rev = "v${version}";
+    tag = "v${finalAttrs.version}";
    hash = "sha256-MmlCTF7tZBBOCnyhUjTatDjajFMGd+Nk2kYyxjzZc04=";
    # Remove unicode file names which leads to different checksums on HFS+
    # vs. other filesystems because of unicode normalisation.
@@ -29,18 +31,38 @@ rustPlatform.buildRustPackage rec {

  nativeBuildInputs = [ installShellFiles ];

-  doCheck = false;
+  checkFlags = [
+    # disable tests that depend on the unicode files we removed above
+    "--skip=test_show_files_by_type"
+  ];
+
+  preCheck = ''
+    # These tests depend on the disk format of the build host.
+    rm tests/test_exact_output.rs
+    rm tests/tests_symlinks.rs
+  '';

  postInstall = ''
    installManPage man-page/dust.1
    installShellCompletion completions/dust.{bash,fish} --zsh completions/_dust
  '';

+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgram = "${placeholder "out"}/bin/dust";
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { };
+
  meta = {
    description = "du + rust = dust. Like du but more intuitive";
    homepage = "https://github.com/bootandy/dust";
+    changelog = "https://github.com/bootandy/dust/releases/tag/v${finalAttrs.version}";
    license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ aaronjheng ];
+    maintainers = with lib.maintainers; [
+      aaronjheng
+      defelo
+    ];
    mainProgram = "dust";
  };
-}
+})
@@ -18,13 +18,13 @@

 stdenv.mkDerivation {
  pname = "dwlb";
-  version = "0-unstable-2025-05-05";
+  version = "0-unstable-2025-05-20";

  src = fetchFromGitHub {
    owner = "kolunmi";
    repo = "dwlb";
-    rev = "efaef82d5ee390e478fba57b6300953f838803cd";
-    hash = "sha256-rkvJZKf5mB8Xxvab+i1jKUeNtuaA8wTd/pkL9lMhGi8=";
+    rev = "48dbe00bdb98a1ae6a0e60558ce14503616aa759";
+    hash = "sha256-S0jkoELkF+oEmXqiWZ8KJYtWAHEXR/Y93jl5yHgUuSM=";
  };

  nativeBuildInputs = [
@@ -10,18 +10,18 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "eas-cli";
-  version = "14.7.1";
+  version = "16.4.0";

  src = fetchFromGitHub {
    owner = "expo";
    repo = "eas-cli";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-h7LohShs4j9Z7Mbe6MSMqfszrEPBcGeTpB+ma3iBXyM=";
+    hash = "sha256-cHayMBhqiLY//t/ljjwJm4qMuVn531z7x2cqJE4z6hQ=";
  };

  yarnOfflineCache = fetchYarnDeps {
    yarnLock = finalAttrs.src + "/yarn.lock"; # Point to the root lockfile
-    hash = "sha256-pnp9MI2S5v4a7KftxYC3Sgc487vooX8+7lmYkmRTWWs=";
+    hash = "sha256-qDUwAdShpKjIUyYvtA6/hgGdO1z1xLqdsJkL3oqkMSw=";
  };

  nativeBuildInputs = [
@@ -49,6 +49,16 @@
   "jar": "sha256-88oPjWPEDiOlbVQQHGDV7e4Ta0LYS/uFvHljCTEJz4s=",
   "pom": "sha256-Y9lpQetE35yQ0q2yrYw/aZwuBl5wcEXF2vcT/KUrz8o="
  },
+  "gradle/plugin/net/rdrei/android/buildtimetracker#build-time-tracker-plugin/0.11.0": {
+   "jar": "sha256-a9QQVOJuuuiLDaWNxj7BEKcO+tXxLYcESTRwx8VJcZA=",
+   "pom": "sha256-uFQ5wq04pYG40n+nWy+zC3HN4dT8A8ZE4yMvhN8kWqE="
+  },
+  "io/freefair/jsass-java#io.freefair.jsass-java.gradle.plugin/6.5.0.2": {
+   "pom": "sha256-hoEYwHzaHj3q/o0bF3HzOgyN0lEIEAu/pjFl3hzTvmg="
+  },
+  "io/freefair/lombok#io.freefair.lombok.gradle.plugin/8.13.1": {
+   "pom": "sha256-6vi5gMxqRCuZxs++X2Cq5pyQIDFEJxDqQD1T5TjRQfU="
+  },
  "jakarta/platform#jakarta.jakartaee-bom/9.1.0": {
   "pom": "sha256-35jgJmIZ/buCVigm15o6IHdqi6Aqp4fw8HZaU4ZUyKQ="
  },
@@ -71,6 +81,9 @@
  "net/jsign#jsign-parent/7.1": {
   "pom": "sha256-IZZHpKDOVcG4bMrbQRLPsaEkteDcISP0ohsCUqcQMMI="
  },
+  "net/rdrei/android/buildtimetracker#net.rdrei.android.buildtimetracker.gradle.plugin/0.11.0": {
+   "pom": "sha256-SbQtvX9N5DU8ntUmpcpTtrTdDhla7rQR7L213fZ6kG8="
+  },
  "org/apache#apache/16": {
   "pom": "sha256-n4X/L9fWyzCXqkf7QZ7n8OvoaRCfmKup9Oyj9J50pA4="
  },
@@ -140,6 +153,9 @@
   "module": "sha256-SbchA0l5YXx6x1VVyjjSeL1ZKwLIPY6DAAJHfc7Zzz8=",
   "pom": "sha256-gpCklq0NVdcv9gBvCrO3NBSX1CBvlRs/+c/cFkKVKJs="
  },
+  "org/beryx/jlink#org.beryx.jlink.gradle.plugin/3.1.1": {
+   "pom": "sha256-P1LgbRsiWC9Ple5L37nM4oFQ5llfnKpmSKZoWYhw5FU="
+  },
  "org/bouncycastle#bcpkix-lts8on/2.73.7": {
   "jar": "sha256-WHRYb7Se7ryZuH8SNShnm8Wlw4j+pL+E0semmQguKK0=",
   "pom": "sha256-D3mEND0EU+Y5uoyNTXwNGFLfA8ye4UkoQgi/5KPnH44="
@@ -162,10 +178,13 @@
  "org/eclipse/ee4j#project/1.0.7": {
   "pom": "sha256-IFwDmkLLrjVW776wSkg+s6PPlVC9db+EJg3I8oIY8QU="
  },
-  "org/gradlex#extra-java-module-info/1.11": {
-   "jar": "sha256-Z3+h2llhAw5z7rmNUoxF/rX69fXLH1ts3297I7L3YCk=",
-   "module": "sha256-HupoMVnjhje5y70/1RGeDKP1R5vGPfKoItJ+Cv4Yxu4=",
-   "pom": "sha256-JmY0IO3vtV1IsgYLN6K8DH0UociY2vZ0v1YuM/8LYnE="
+  "org/gradlex#extra-java-module-info/1.12": {
+   "jar": "sha256-ybk/zohPZLCYhCw52Ms4e8n4QARboRZ+7fQROB/OXNc=",
+   "module": "sha256-QK7HMDoSAYnizvSrfwfX9emFNndUTj43tbEl6H5MYzU=",
+   "pom": "sha256-fStam3XBvtrwHj8ieDV9Bpbrl5snNC8FZhHPTM44OtQ="
+  },
+  "org/jsonschema2pojo#org.jsonschema2pojo.gradle.plugin/1.2.2": {
+   "pom": "sha256-OS098xRtN26kokx+XtNhLennIcfT6+T3vzq5oiSVhds="
  },
  "org/junit#junit-bom/5.10.3": {
   "module": "sha256-qnlAydaDEuOdiaZShaqa9F8U2PQ02FDujZPbalbRZ7s=",
@@ -189,9 +208,9 @@
  "org/ow2#ow2/1.5.1": {
   "pom": "sha256-Mh3bt+5v5PU96mtM1tt0FU1r+kI5HB92OzYbn0hazwU="
  },
-  "org/ow2/asm#asm/9.7.1": {
-   "jar": "sha256-jK3UOsXrbQneBfrsyji5F6BAu5E5x+3rTMgcdAtxMoE=",
-   "pom": "sha256-cimwOzCnPukQCActnkVppR2FR/roxQ9SeEGu9MGwuqg="
+  "org/ow2/asm#asm/9.8": {
+   "jar": "sha256-h26raoPa7K1cpn65/KuwY8l7WuuM8fynqYns3hdSIFE=",
+   "pom": "sha256-wTZ8O7OD12Gef3l+ON91E4hfLu8ErntZCPaCImV7W6o="
  },
  "org/sonatype/oss#oss-parent/7": {
   "pom": "sha256-tR+IZ8kranIkmVV/w6H96ne9+e9XRyL+kM5DailVlFQ="
@@ -202,16 +221,16 @@
  }
 },
 "https://repo.maven.apache.org/maven2": {
-  "ch/qos/logback#logback-classic/1.5.17": {
-   "jar": "sha256-5700LZHlChXx4W+ApSbOff/EGNr3PNIJTbT4AsAgSIA=",
-   "pom": "sha256-qV4brkazX89CLuy93poeCCBhDtWb6r2D7uIZIYG8rL8="
+  "ch/qos/logback#logback-classic/1.5.18": {
+   "jar": "sha256-PhUz0DIfiBXu9GdQruARG0FVT5pGRMPE0tQEdEsJ9g8=",
+   "pom": "sha256-1VfNKrI95KR+zocGQhYqn5Rzn80LHDE+J4MlFO4gODM="
  },
-  "ch/qos/logback#logback-core/1.5.17": {
-   "jar": "sha256-L71fAnKxo1RuV0CliOc14HGs0M0CJuBI9xGUajDqwzc=",
-   "pom": "sha256-cWqhFMrn3xr+FcvuqN35EtWtdg82p6ir04+whl9F2G4="
+  "ch/qos/logback#logback-core/1.5.18": {
+   "jar": "sha256-hROee1e0ZPjl42Mm3YExdki+0ZnMxPmM1CWF+NdXECc=",
+   "pom": "sha256-x3JHKX1dm7ngTpLUyC51xujqviRUNokvkRQzW4t5DIM="
  },
-  "ch/qos/logback#logback-parent/1.5.17": {
-   "pom": "sha256-mnyL+zxKF2l86OrTojo8ysvccjphQkF98KrrqMHtBno="
+  "ch/qos/logback#logback-parent/1.5.18": {
+   "pom": "sha256-U8PiGxI7vTijAbQNDYFAlOrUehAj0h1hPMdI1w57nGk="
  },
  "com/fasterxml#oss-parent/30": {
   "pom": "sha256-0OJUZlIJgf9X7K29yUA00dFpA7kulQvp+dQkQcWU+fA="
@@ -219,20 +238,20 @@
  "com/fasterxml#oss-parent/58": {
   "pom": "sha256-VnDmrBxN3MnUE8+HmXpdou+qTSq+Q5Njr57xAqCgnkA="
  },
-  "com/fasterxml#oss-parent/61": {
-   "pom": "sha256-NklRPPWX6RhtoIVZhqjFQ+Er29gF7e75wSTbVt0DZUQ="
+  "com/fasterxml#oss-parent/65": {
+   "pom": "sha256-2wuaUmqeMDxjuptYSWicYfs4kkf6cjEFS5DgvwC0MR4="
  },
  "com/fasterxml/jackson#jackson-base/2.17.2": {
   "pom": "sha256-fPnFn70UyQVnRxN7kNcKleh3YN/huCRWufAjF9W1b68="
  },
-  "com/fasterxml/jackson#jackson-base/2.18.3": {
-   "pom": "sha256-1bv9PIRFIw5Ji2CS3oCa/WXPUE0BOTLat7Pf1unzpP0="
+  "com/fasterxml/jackson#jackson-base/2.19.0": {
+   "pom": "sha256-Noz4ykJkRni737F6sUfJC8QyWaWZUJfD8cT7au9Mdcg="
  },
  "com/fasterxml/jackson#jackson-bom/2.17.2": {
   "pom": "sha256-H0crC8IATVz0IaxIhxQX+EGJ5481wElxg4f9i0T7nzI="
  },
-  "com/fasterxml/jackson#jackson-bom/2.18.3": {
-   "pom": "sha256-8dTGrrMhGGUMgF/pu8XulA+o8s19DwT6Q2BVHponspA="
+  "com/fasterxml/jackson#jackson-bom/2.19.0": {
+   "pom": "sha256-sR/LPvM6wH5oDObYXxfELWoz2waG+6z68OQ0j8Y5cbI="
  },
  "com/fasterxml/jackson#jackson-bom/2.9.4": {
   "pom": "sha256-ez/Ek1+/U/x5ypo75e1NLIL8pMU/hF0+EzgpMTic4CE="
@@ -240,8 +259,8 @@
  "com/fasterxml/jackson#jackson-parent/2.17": {
   "pom": "sha256-rubeSpcoOwQOQ/Ta1XXnt0eWzZhNiSdvfsdWc4DIop0="
  },
-  "com/fasterxml/jackson#jackson-parent/2.18.1": {
-   "pom": "sha256-0IIvrBoCJoRLitRFySDEmk9hkWnQmxAQp9/u0ZkQmYw="
+  "com/fasterxml/jackson#jackson-parent/2.19": {
+   "pom": "sha256-bNk0tNFdfz7hONl7I8y4Biqd5CJX7YelVs7k1NvvWxo="
  },
  "com/fasterxml/jackson#jackson-parent/2.9.1": {
   "pom": "sha256-fATwKdKA+7gnTnUCHckPObLGIv40mdrwf8NQgcLZ2f8="
@@ -251,30 +270,30 @@
   "module": "sha256-KMxD6Y54gYA+HoKFIeOKt67S+XejbCVR3ReQ9DDz688=",
   "pom": "sha256-Q3gYTWCK3Nu7BKd4vGRmhj8HpFUqcgREZckQQD+ewLs="
  },
-  "com/fasterxml/jackson/core#jackson-annotations/2.18.3": {
-   "jar": "sha256-iqV0DYC1pQJVCLQbutuqH7N3ImfGKLLjBoGk9F+LiTE=",
-   "module": "sha256-RkWF2yH0irFZ6O9XnNfo5tMHoEdhGZZRw+zBf05ydF0=",
-   "pom": "sha256-ucmLqeKephtpPUyMgBlo/qriILKyACNkp7zsUkmYOEs="
+  "com/fasterxml/jackson/core#jackson-annotations/2.19.0": {
+   "jar": "sha256-6tYOnKwOQrVwkrni0If/Q1NulHfUSGujkwN6jMFWzac=",
+   "module": "sha256-HzHOjWv4Trf0q6Hl/gGn7mshk+mw8rv4zENMRUXVGh8=",
+   "pom": "sha256-MnlOx3WinmcwPfut370Jq/3nKaRPWuJ7Wew8g65vOuA="
  },
  "com/fasterxml/jackson/core#jackson-core/2.17.2": {
   "jar": "sha256-choYkkHasFJdnoWOXLYE0+zA7eCB4t531vNPpXeaW0Y=",
   "module": "sha256-OCgvt1xzPSOV3TTcC1nsy7Q6p8wxohomFrqqivy38jY=",
   "pom": "sha256-F4IeGYjoMnB6tHGvGjBvSl7lATTyLY0nF7WNqFnrNbs="
  },
-  "com/fasterxml/jackson/core#jackson-core/2.18.3": {
-   "jar": "sha256-BWvE0+XlPOghRQ+pez+eD43eElz22miENTux8JWC4dk=",
-   "module": "sha256-mDbVp/Iba8VNfybeh8izBd3g5PGEsqyJUOmhsd9Hw0A=",
-   "pom": "sha256-N9xrj2ORpHCawhXKmPojQcbdZWE8InfZak/YKi9Q48k="
+  "com/fasterxml/jackson/core#jackson-core/2.19.0": {
+   "jar": "sha256-2o6Fm6yUh0UoEWol8gxoVg5Ch6y/J2KHEbik+WsChDA=",
+   "module": "sha256-WT2jX9rflNEYYvfErCjcq52J1bzd2y2jOe7WFXxVbYk=",
+   "pom": "sha256-zOajQFk4YjqBCJX/b94vBMnDuTegVihx4aY0lr4Pr6s="
  },
  "com/fasterxml/jackson/core#jackson-databind/2.17.2": {
   "jar": "sha256-wEmT8zwPhFNCZTeE8U84Nz0AUoDmNZ21+AhwHPrnPAw=",
   "module": "sha256-9HC96JRNV9axUMqov1O7mCqZ6x1lkecxr8uXKrPddx8=",
   "pom": "sha256-0kUGmLrpC+M48rmfrtppTNRQrbUhJCE+elO0Ehm1QGI="
  },
-  "com/fasterxml/jackson/core#jackson-databind/2.18.3": {
-   "jar": "sha256-UQvdp1p6YYbFvzO4USOUiKFFCQauV1cSHy4cxIp+EI8=",
-   "module": "sha256-ZCqggPhbIAV3ifrPKsaibhR4NbUDPidSDstpe8RD/Lo=",
-   "pom": "sha256-5Y9IrBTk29SFldaeILrTUBnsEoFRTvfvFV4YByraYX8="
+  "com/fasterxml/jackson/core#jackson-databind/2.19.0": {
+   "jar": "sha256-ztoxH0dsOxjh0rJAyU4ty5yNROcPivqfrKuIusTdwDo=",
+   "module": "sha256-Z2HeLgXl0m7GK5R/p1AJEZDz/JnM8iaM3suTz/bfbSo=",
+   "pom": "sha256-f0zGn9XZuwIW0ULD2Cv/2v64bUelU8KBRbjOcOfreHY="
  },
  "com/fasterxml/jackson/dataformat#jackson-dataformat-yaml/2.17.2": {
   "jar": "sha256-lBvNixOBuzsNcm+rQWJPqOzg7nts8oYK2V6BV85nM3Y=",
@@ -284,18 +303,18 @@
  "com/fasterxml/jackson/dataformat#jackson-dataformats-text/2.17.2": {
   "pom": "sha256-5pgyMzCpqCySDlqJtlsPciXI5zPBIqGPeWoEpuMfpcs="
  },
-  "com/fasterxml/jackson/datatype#jackson-datatype-jdk8/2.18.3": {
-   "jar": "sha256-H1F6+RrOVBUFJc2zCgEvyhmlNhlFZHVvWAwhrPx+BKA=",
-   "module": "sha256-7QX+6N/FAwRMH4PwROBtcYwzYEK8FzqloevfdzQXyG8=",
-   "pom": "sha256-/14lbEPjXWUtZhVeVmqYYqWbuzCM3GNvSIi96PVq9Tw="
+  "com/fasterxml/jackson/datatype#jackson-datatype-jdk8/2.19.0": {
+   "jar": "sha256-BPGj+dqBVZld0ACY1oR825t69n9KMCjJQDHv8BfI4+U=",
+   "module": "sha256-vJbHnq+xPoyC2JK23TVkBOKwKwf22Pu8MZ9h+cT+P58=",
+   "pom": "sha256-5LmCFF3HPT37bcRBOZlwHA8I/4KAJQDkYI05vyFZoKI="
  },
-  "com/fasterxml/jackson/datatype#jackson-datatype-jsr310/2.18.3": {
-   "jar": "sha256-Lh3y/rk2g9N5lpzq94t2oKwRXGfQRnGVj9307tbmQB0=",
-   "module": "sha256-Kt37kDio5g8OlWOZLC3sdYpQxDvH8ECVnYXbbp1o04w=",
-   "pom": "sha256-LIA9pFO2CM4OQ6FscvAaWf5Dg++oV6jxszQhc2bqJk0="
+  "com/fasterxml/jackson/datatype#jackson-datatype-jsr310/2.19.0": {
+   "jar": "sha256-Dul78yk2NJ1qTPbYQoUzv0pLWz5+Vf2aTxlQjOBip3U=",
+   "module": "sha256-cg5M2qz3VPSlMw9EWBBhKPSGf4D7jTB1tavgx6Auam4=",
+   "pom": "sha256-6exZhNwLuy2kMH/TugiAergZ8GsGDNyne6OmWwHjKF0="
  },
-  "com/fasterxml/jackson/module#jackson-modules-java8/2.18.3": {
-   "pom": "sha256-rehezbxjw22XyQcnNfQfeUGO+K0EA755gtr/9BxfruM="
+  "com/fasterxml/jackson/module#jackson-modules-java8/2.19.0": {
+   "pom": "sha256-th9zuCA8++8rHkGf9wDM/arlMgbcx20VBUqPg00roDI="
  },
  "com/github/jai-imageio#jai-imageio-core/1.4.0": {
   "jar": "sha256-itPGjp7/+xCsh/+LxYmt9ksEpynFGUwHnv0GQ2B/1yo=",
@@ -349,20 +368,23 @@
  "com/google/errorprone#error_prone_parent/2.36.0": {
   "pom": "sha256-Okz8imvtYetI6Wl5b8MeoNJwtj5nBZmUamGIOttwlNw="
  },
-  "com/google/guava#failureaccess/1.0.2": {
-   "jar": "sha256-io+Bz5s1nj9t+mkaHndphcBh7y8iPJssgHU+G0WOgGQ=",
-   "pom": "sha256-GevG9L207bs9B7bumU+Ea1TvKVWCqbVjRxn/qfMdA7I="
+  "com/google/guava#failureaccess/1.0.3": {
+   "jar": "sha256-y/w5BrGbj1XdfP1t/gqkUy6DQlDX8IC9jSEaPiRrWcs=",
+   "pom": "sha256-xUvv839tQtQ+FHItVKUiya1R75f8W3knfmKj6/iC87s="
  },
  "com/google/guava#guava-parent/26.0-android": {
   "pom": "sha256-+GmKtGypls6InBr8jKTyXrisawNNyJjUWDdCNgAWzAQ="
  },
-  "com/google/guava#guava-parent/33.4.0-jre": {
-   "pom": "sha256-Okme00oNnuDxvMOSMAIaHNTi990EJqtoRPWFRl1B3Nc="
+  "com/google/guava#guava-parent/33.4.0-android": {
+   "pom": "sha256-ciDt5hAmWW+8cg7kuTJG+i0U8ygFhTK1nvBT3jl8fYM="
  },
-  "com/google/guava#guava/33.4.0-jre": {
-   "jar": "sha256-uRjJin5E2+lOvZ/j5Azdqttak+anjrYAi0LfI3JB5Tg=",
-   "module": "sha256-gg6BfobEk6p6/9bLuZHuYJJbbIt0VB90LLIgcPbyBFk=",
-   "pom": "sha256-+pTbQAIt38d1r57PsTDM5RW5b3QNr4LyCvhG2VBUE0s="
+  "com/google/guava#guava-parent/33.4.8-jre": {
+   "pom": "sha256-oDxRmaG+FEQ99/1AuoZzscaq4E3u9miM59Vz6kieOiA="
+  },
+  "com/google/guava#guava/33.4.8-jre": {
+   "jar": "sha256-89f1f2f9Yi9NRo391pKzpeOQkkbCgBesMmNAXw/mF+0=",
+   "module": "sha256-WKM1cwMGmiGTDnuf6bhk3ov7i9RgdDPb5IJjRZYgz/w=",
+   "pom": "sha256-BDZdS27yLIz5NJ/mKAafw+gaLIODUUAu9OlfnnV77rw="
  },
  "com/google/guava#listenablefuture/9999.0-empty-to-avoid-conflict-with-guava": {
   "jar": "sha256-s3KgN9QjCqV/vv/e8w/WEj+cDC24XQrO0AyRuXTzP5k=",
@@ -388,16 +410,19 @@
   "pom": "sha256-EY1n40Uymhjf9OvRVX+V8MCrS0y51nh0nWZvkjAAF2g="
  },
  "commons-codec#commons-codec/1.17.1": {
-   "jar": "sha256-+fbLED8t3DyZqdgK2irnvwaFER/Wv/zLcgM9HaTm/yM=",
   "pom": "sha256-f6DbTYFQ2vkylYuK6onuJKu00Y4jFqXeU1J4/BMVEqA="
  },
+  "commons-codec#commons-codec/1.18.0": {
+   "jar": "sha256-ugBfMEzvkqPe3iSjitWsm4r8zw2PdYOdbBM4Y0z39uQ=",
+   "pom": "sha256-dLkW2ksDhMYZ5t1MGN7+iqQ4f3lSBSU8+0u7L0WM3c4="
+  },
  "commons-io#commons-io/2.17.0": {
   "jar": "sha256-SqTKSPPf0wt4Igt4gdjLk+rECT7JQ2G2vvqUh5mKVQs=",
   "pom": "sha256-SEqTn/9TELjLXGuQKcLc8VXT+TuLjWKF8/VrsroJ/Ek="
  },
-  "commons-io#commons-io/2.18.0": {
-   "jar": "sha256-88oPjWPEDiOlbVQQHGDV7e4Ta0LYS/uFvHljCTEJz4s=",
-   "pom": "sha256-Y9lpQetE35yQ0q2yrYw/aZwuBl5wcEXF2vcT/KUrz8o="
+  "commons-io#commons-io/2.19.0": {
+   "jar": "sha256-gkJokZtLYvn0DwjFQ4HeWZOwePWGZ+My0XNIrgGdcrk=",
+   "pom": "sha256-VCt6UC7WGVDRuDEStRsWF9NAfjpN9atWqY12Dg+MWVA="
  },
  "commons-io#commons-io/2.4": {
   "pom": "sha256-srXdRs+Zj6Ym62+KHBFPYWfI05JpQWTmJTPliY6bMfI="
@@ -421,10 +446,25 @@
   "jar": "sha256-Yl5U0tQDYG0hdD/PbYsHJD7yhEQ9pNwvpBKUQX34Glw=",
   "pom": "sha256-YT1F0/kGPP++cdD0u1U1yHa+JOOkeWTXEFWqCDRBJI4="
  },
-  "io/freefair/gradle#lombok-plugin/8.13": {
-   "jar": "sha256-fflln33kA74dOIdl++dhqewWdlHaajzQbouDynEYmaU=",
-   "module": "sha256-mXEiI3+Zn2jUIX6psNFzZUrrbU/c4k8Hn4+FE0RrT18=",
-   "pom": "sha256-L0O8PILyGGcy2G82s+P+rW5Sw1Ckflr1bQ1dFOjRmGo="
+  "io/bit3#jsass/5.10.4": {
+   "jar": "sha256-RB4LWMMGUaSpc2/SCQ8vtWvg4TpH2Ew0YJ39fEkoFOA=",
+   "pom": "sha256-3FFUP9H1LCvFVj+SOnwE1RYuIVb/4OOnPCUA+5k2Btw="
+  },
+  "io/freefair/gradle#jsass-plugin/6.5.0.2": {
+   "jar": "sha256-60P1yUo9pgmJNc7Nd749ge8u/xTVpQS7bhhU9OYoX2o=",
+   "module": "sha256-iNmRuo7VjChtey18CPn2Mg/5novWYXPDaDkhAEb8f2I=",
+   "pom": "sha256-oYHFieNi4sRp6IRc/PIKFaiQ9ISUoPny4T9ZSglq0Kk="
+  },
+  "io/freefair/gradle#lombok-plugin/8.13.1": {
+   "jar": "sha256-lbMasJqIL7BUfdXHs0XSJ23DLP39IvjFfYqCTOppuNc=",
+   "module": "sha256-pm7A/w8m1PY/teSSCsCND+O9t2Z2xD+utOleomuEaHM=",
+   "pom": "sha256-X0xZH+9n8S029WW9IVZZJl0kKM4V6jzV0mj5/8FBtR4="
+  },
+  "io/freefair/jsass-java#io.freefair.jsass-java.gradle.plugin/6.5.0.2": {
+   "pom": "sha256-1C1ePfUKHTe6qhRrpb0ai7I5YZksPt9Fw6M5zqCTLd8="
+  },
+  "io/freefair/lombok#io.freefair.lombok.gradle.plugin/8.13.1": {
+   "pom": "sha256-8BqPAZWa7jyQ4IvOvTK4PIEJe+pkP5S1U5uYXGgxOMc="
  },
  "io/github/classgraph#classgraph/4.8.179": {
   "jar": "sha256-FlWDV/I0BSNwEJEnpF1pqb1thkaSVZR5JjRIbcSLFZ0=",
@@ -453,10 +493,10 @@
   "module": "sha256-rwV/vBEyR6Pp/cYOWU+dh2xPW8oZy4sb2myBGP9ixpU=",
   "pom": "sha256-EeldzI+ywwumAH/f9GxW+HF2/lwwLFGEQThZEk1Tq60="
  },
-  "io/sentry#sentry/8.4.0": {
-   "jar": "sha256-TFc6haFIX5k+Uuy0uXI/T/QVqueFWH1RCI+n56jZw98=",
-   "module": "sha256-5yIJjgS/2HbMLx9pBPG8aH8bWfebrQdkHB+OogYVcdQ=",
-   "pom": "sha256-wuHcDpGz4k39fPrdOMEiSRYg1tlJ4rdi7adB1F3Z3BE="
+  "io/sentry#sentry/8.11.1": {
+   "jar": "sha256-0EmSqkQXOQazcYAmpRyUMXDc663czsRTtszYAdGuZkg=",
+   "module": "sha256-x4i43VQ1Avv5hy7X11gvLfBPZwEzEoWb0fgun5sqgRM=",
+   "pom": "sha256-Fcd/SfMLh3uTBDq5O05T5KlFDlXxgWz+++/2fd47X2c="
  },
  "jakarta/json/bind#jakarta.json.bind-api/2.0.0": {
   "jar": "sha256-peYGtYiLQStIkHrWiLNN/k4wroGJxvJ8wEkbjzwDYoc=",
@@ -491,6 +531,10 @@
  "joda-time#joda-time/2.4": {
   "pom": "sha256-hvCkCbZaMW7tZ5shz1hLkhe1WzqJLCz8UIZlNOdvXiQ="
  },
+  "junit#junit/4.12": {
+   "jar": "sha256-WXIfCAXiI9hLkGd4h9n/Vn3FNNfFAsqQPAwrF/BcEWo=",
+   "pom": "sha256-kPFj944/+28cetl96efrpO6iWAcUG4XW0SvmfKJUScQ="
+  },
  "junit#junit/4.13.2": {
   "jar": "sha256-jklbY0Rp1k+4rPo0laBly6zIoP/1XOHjEAe+TBbcV9M=",
   "pom": "sha256-Vptpd+5GA8llwcRsMFj6bpaSkbAWDraWTdCSzYnq3ZQ="
@@ -618,8 +662,11 @@
  "org/apache/commons#commons-parent/74": {
   "pom": "sha256-gOthsMh/3YJqBpMTsotnLaPxiFgy2kR7Uebophl+fss="
  },
-  "org/apache/commons#commons-parent/78": {
-   "pom": "sha256-Ai0gLmVe3QTyoQ7L5FPZKXeSTTg4Ckyow1nxgXqAMg4="
+  "org/apache/commons#commons-parent/79": {
+   "pom": "sha256-Yo3zAUis08SRz8trc8euS1mJ5VJqsTovQo3qXUrRDXo="
+  },
+  "org/apache/commons#commons-parent/81": {
+   "pom": "sha256-NI1OfBMb5hFMhUpxnOekQwenw5vTZghJd7JP0prQ7bQ="
  },
  "org/apache/commons#commons-text/1.12.0": {
   "jar": "sha256-3gIyV/8WYESla9GqkSToQ80F2sWAbMcFqTEfNVbVoV8=",
@@ -674,17 +721,17 @@
   "jar": "sha256-tG67QUA4S0WjnpHiO1lc6dzYujqe6RTxX0CkKp+AU3M=",
   "pom": "sha256-KNkHvwQvNchyx5J0uBE1zIs9EE0p38twug3vly8oVyg="
  },
-  "org/apache/poi#poi-ooxml-lite/5.4.0": {
-   "jar": "sha256-u1qKbIMyec7VGvtgQqoVrl1coxLuaC5XDiORe1IrB54=",
-   "pom": "sha256-YQpkM3ly/xl/ozbmjHfmOVWxFYa8Htsfxnk55FUvF+I="
+  "org/apache/poi#poi-ooxml-lite/5.4.1": {
+   "jar": "sha256-3FkEYe/fzU8n4qiSc3l5q14wtBMqet/HyeVkR7caRbA=",
+   "pom": "sha256-dhDGeGbqRFzj2pQLJM1feGRebEJu5r5W7TY8yaEUGTc="
  },
-  "org/apache/poi#poi-ooxml/5.4.0": {
-   "jar": "sha256-mGk0Qu19RHkd5KV5YrbIIK5njg66nPhUaBti/2LJYR0=",
-   "pom": "sha256-WI8k6TVvKMHQmJw0q15ia/NIq8Aie4rIy0ZmpPgICnY="
+  "org/apache/poi#poi-ooxml/5.4.1": {
+   "jar": "sha256-/SAMnm901wQWCpfp1SBBmV7YdDlFRTAAHt2SBojxn1M=",
+   "pom": "sha256-rnbyDM2VTeAUqta1RUvNSbFgPhr+BsfuTh3BcdEbczM="
  },
-  "org/apache/poi#poi/5.4.0": {
-   "jar": "sha256-rOceeYcwWeJzA2Z0VgtQw9a5RbfKFosNSWKtdlCuHuw=",
-   "pom": "sha256-rK0VkHGQpeZ7hZfM+wEx795ZbC+gXYrZ9LnGHaMfNkU="
+  "org/apache/poi#poi/5.4.1": {
+   "jar": "sha256-2lq/QtpGBMWnvKOJVq9unW8ZbZttTLfqvuT0gLWA1QU=",
+   "pom": "sha256-qoJN6gLaJ4G7a4PhqIChchDewAtdHCWSBuKIFKEJnog="
  },
  "org/apache/xmlbeans#xmlbeans/5.3.0": {
   "jar": "sha256-bMado7TTW4PF5HfNTauiBORBCYM+NK8rmoosh4gomRc=",
@@ -699,14 +746,9 @@
   "jar": "sha256-W4omIF9tXqYK2c5lzkpAoq/kxIq+7GG9B0CgiMJOifU=",
   "pom": "sha256-jrN+QWt4B+e/833QN8QMBrlWk6dgWcX7m+uFSaTO19w="
  },
-  "org/checkerframework#checker-qual/3.43.0": {
-   "jar": "sha256-P7wumPBYVMPfFt+auqlVuRsVs+ysM2IyCO1kJGQO8PY=",
-   "module": "sha256-+BYzJyRauGJVMpSMcqkwVIzZfzTWw/6GD6auxaNNebQ=",
-   "pom": "sha256-kxO/U7Pv2KrKJm7qi5bjB5drZcCxZRDMbwIxn7rr7UM="
-  },
-  "org/controlsfx#controlsfx/11.2.1": {
-   "jar": "sha256-63VY0JTDa4Yw6oqab40k+K9F0ak6N14R4gbXbAgiFDA=",
-   "pom": "sha256-veC6xL8EPqp19uTOEbpXfHneak+5Mfd1e93Y36MwKTc="
+  "org/controlsfx#controlsfx/11.2.2": {
+   "jar": "sha256-BDwGYtUmljR9r4T8aQJ0xhIuD4CjFXo1St086oPA3qk=",
+   "pom": "sha256-1GOhe255/Ti7CtmVmgCcXAdK7BjMncSdqRWsVfxNMXE="
  },
  "org/eclipse/ee4j#project/1.0.6": {
   "pom": "sha256-Tn2DKdjafc8wd52CQkG+FF8nEIky9aWiTrkHZ3vI1y0="
@@ -766,6 +808,11 @@
  "org/jsonschema2pojo#jsonschema2pojo/1.2.2": {
   "pom": "sha256-PEgC9gguyH1+igs206MyaDTRj9c8E5EM8pFrhQvNrDM="
  },
+  "org/jspecify#jspecify/1.0.0": {
+   "jar": "sha256-H61ua+dVd4Hk0zcp1Jrhzcj92m/kd7sMxozjUer9+6s=",
+   "module": "sha256-0wfKd6VOGKwe8artTlu+AUvS9J8p4dL4E+R8J4KDGVs=",
+   "pom": "sha256-zauSmjuVIR9D0gkMXi0N/oRllg43i8MrNYQdqzJEM6Y="
+  },
  "org/junit#junit-bom/5.10.2": {
   "module": "sha256-3iOxFLPkEZqP5usXvtWjhSgWaYus5nBxV51tkn67CAo=",
   "pom": "sha256-Fp3ZBKSw9lIM/+ZYzGIpK/6fPBSpifqSEgckzeQ6mWg="
@@ -782,63 +829,63 @@
   "module": "sha256-hkd6vPSQ1soFmqmXPLEI0ipQb0nRpVabsyzGy/Q8LM4=",
   "pom": "sha256-Sj/8Sk7c/sLLXWGZInBqlAcWF5hXGTn4VN/ac+ThfMg="
  },
-  "org/junit#junit-bom/5.11.2": {
-   "module": "sha256-iDoFuJLxGFnzg23nm3IH4kfhQSVYPMuKO+9Ni8D1jyw=",
-   "pom": "sha256-9I6IU4qsFF6zrgNFqevQVbKPMpo13OjR6SgTJcqbDqI="
+  "org/junit#junit-bom/5.11.4": {
+   "module": "sha256-qaTye+lOmbnVcBYtJGqA9obSd9XTGutUgQR89R2vRuQ=",
+   "pom": "sha256-GdS3R7IEgFMltjNFUylvmGViJ3pKwcteWTpeTE9eQRU="
  },
-  "org/junit#junit-bom/5.12.1": {
-   "module": "sha256-TdKqnplFecYwRX35lbkZsDVFYzZGNy6q3R0WXQv1jBo=",
-   "pom": "sha256-fIJrxyvt3IF9rZJjAn+QEqD1Wjd9ON+JxCkyolAcK/A="
+  "org/junit#junit-bom/5.12.2": {
+   "module": "sha256-3nCsXZGlJlbYiQptI7ngTZm5mxoEAlMN7K1xvzGyc14=",
+   "pom": "sha256-zvgP7IZFT2gGv7DfJGabXG8y4styhTnqhZ9H39ybvBc="
  },
-  "org/junit/jupiter#junit-jupiter-api/5.12.1": {
-   "jar": "sha256-pAHgtgNz7fffCWLCXrMhPkUaR3h5LTOnaHbDuKW7IJs=",
-   "module": "sha256-iv9r5FYIFhBl7mO4QDyfKTE6HdnzkfP5eIVlpiMxGXY=",
-   "pom": "sha256-zqRvFdpTNT8vtSYZyvbcAH7CqE8O2vQMwSV/jjzvd9w="
+  "org/junit/jupiter#junit-jupiter-api/5.12.2": {
+   "jar": "sha256-C5ynKOS82a3FfyneuVVv+e1eCLTohDuHWrpOTj4E8JI=",
+   "module": "sha256-VFfyRO3hjRFzbwfrnF8wklrrCW5Cw1m2oEqaDgOyKes=",
+   "pom": "sha256-VmKCFmSJvUCxLDUHuZXkj44CXgmgXn0W3SuY3GQs994="
  },
-  "org/junit/jupiter#junit-jupiter-engine/5.12.1": {
-   "jar": "sha256-Dn8tvrkb+usNTLM6SHNRuvDlpu1ykGFU2P2ZddMpxZI=",
-   "module": "sha256-tvSQZ/FmJdFN7gmT8weKTGYeF8kOV0yf0SoWRur98tA=",
-   "pom": "sha256-GCeXDlNI10sY6757guDLGdxOj5np1NmEyyZJTVcTPao="
+  "org/junit/jupiter#junit-jupiter-engine/5.12.2": {
+   "jar": "sha256-9XbAa4rM3pmFBjuLyAUmy5gO7CTe4LciH8jd16zmWAA=",
+   "module": "sha256-0W0wjmqiWjCz75JNnf5PiJqb/ybqvXLvMO6oH864SBU=",
+   "pom": "sha256-PHGRdFCb6dsfqBesY7eLIfH2fQaL5HHaPQR4G9RAKqM="
  },
-  "org/junit/jupiter#junit-jupiter-params/5.12.1": {
-   "jar": "sha256-WVFwaZnjWVHU3w7KbgkdNhn2WanBCFjy9aPOGRy1dnM=",
-   "module": "sha256-KYwQtU+G3dtCeclfSYnRW+DV5QDEU+yTXv1Wd8v6Guk=",
-   "pom": "sha256-dHNtHnFnHQDeQFyxnD2GhOHFl9BwfeJmH7gHGyeEJ8M="
+  "org/junit/jupiter#junit-jupiter-params/5.12.2": {
+   "jar": "sha256-shn/qUm5CnGqO2wrYGRWuCvKCyCJt0Wcj/RhFW/1mw8=",
+   "module": "sha256-x3KP8z0SJgBzLq09DW+K3XRd4+lEFRmHE5WuiZymFHQ=",
+   "pom": "sha256-pcfvF8refV90q2IHK7xrxxy9AWgGJGvOQl/LvBEISTw="
  },
-  "org/junit/jupiter#junit-jupiter/5.12.1": {
-   "jar": "sha256-IoqUye50PVW/6gm1djBoHqeyCmYaR3RH9cH2DcEtnjo=",
-   "module": "sha256-OY71Q1eCyqfceKDRVRBpP6Xt7w/HP5PFVOZ3FxtCIj4=",
-   "pom": "sha256-m42YgPjFl2/JUEKEnzsSwRWdom5UUkMSY3edCx54yKQ="
+  "org/junit/jupiter#junit-jupiter/5.12.2": {
+   "jar": "sha256-OFSzrUNJBrgn/sR0qg2NqLVunlbV/H8uIPw/EuxL6JQ=",
+   "module": "sha256-ioIpqKD4Se/BzD/9XPlN4W6sgAYcX5M5eoXAk8nX6nA=",
+   "pom": "sha256-ka2OSkvzBCMslByQFKyRNnvroTHx21jVv+SZx5DUbxc="
  },
-  "org/junit/platform#junit-platform-commons/1.12.1": {
-   "jar": "sha256-wxYWNYGqpWSSgBIrEuo2/k6cICoaImd1P+p8nh3wVes=",
-   "module": "sha256-ypN54aC/xbLOQ8dOh0SxT7fEkhPiISv1pH7QIv3bMM4=",
-   "pom": "sha256-tzKBEektR47QlWxjCgwkZm52gbUTgWj6FchbUJRqcAM="
+  "org/junit/platform#junit-platform-commons/1.12.2": {
+   "jar": "sha256-5oOgHoXfq+pSDAVqxgFaYWJ1bmAuxlPA2oXiM/CvvBg=",
+   "module": "sha256-ZMeQwnpztFz8b4TMtotI92SQNIZ+Fo1iJ1TUlmkrwic=",
+   "pom": "sha256-TyuKkGXJCcaJLYYi1VO2qwpwMhYkSZ47acEon1nswHc="
  },
-  "org/junit/platform#junit-platform-engine/1.12.1": {
-   "jar": "sha256-f+3/k/2SrsfSn8YNwB+gJyRrNrgIhCOl78SUnl9q/6Q=",
-   "module": "sha256-Vb3CX4rhKh3yQQisSArgiAKMiOMV+ou01HbU4RXyrGE=",
-   "pom": "sha256-TANohTegh/d9NLNNjczZO5NhcWu5u/S0ucbYMXkBS5w="
+  "org/junit/platform#junit-platform-engine/1.12.2": {
+   "jar": "sha256-zvDvy1vS4F4rgI04urXGVQicDDABUnN250y2BqeRHsg=",
+   "module": "sha256-+Xsxk2wRnAgtTQOM3resDmVvRR2eXX6Jg9IqJONvoQM=",
+   "pom": "sha256-lICxinlldp0Ag8LLcRBUI/UwKo8Ea7IEfm2/8J84NJA="
  },
-  "org/junit/platform#junit-platform-launcher/1.12.1": {
-   "jar": "sha256-67sU57KfYHMOrt6GLtadfeDVgeoMA4+mogKVXHVB9SU=",
-   "module": "sha256-e+5FMgZp1sP8SKnaJV9Xn7zlgA+mY8QgT6NL1XgkUfQ=",
-   "pom": "sha256-nd9DNXV223LpTvM8ipY09gOrQEb+Cubl4ZJMq2aIjtk="
+  "org/junit/platform#junit-platform-launcher/1.12.2": {
+   "jar": "sha256-3M8sH6Cpd8U60JSthZv93dUk2XWUt2MHrXh95xmFdX8=",
+   "module": "sha256-UKBqBDdOMA57hhWIxdwNAhQh4Z8ToL2ymwYX/y/ehdE=",
+   "pom": "sha256-YZFFzSFdMiJTcr5iW7ooaD10FC/uGl39scZLUv6cC1E="
  },
-  "org/junit/platform#junit-platform-runner/1.12.1": {
-   "jar": "sha256-8CRNhGbpUwHWD8ApxTmnIoisMyjQbj85i17ExH+g6HA=",
-   "module": "sha256-5//N1KRB6el0+dplvHFeGWxq7cUCb0xAs+25Z5ujIzA=",
-   "pom": "sha256-M5dYHbZeZOijCNkGv+E1d/qLgkKxDvGiIfVYuCxHjHA="
+  "org/junit/platform#junit-platform-runner/1.12.2": {
+   "jar": "sha256-MTM/XBn/0sM7/P1I8T0BEMpjmlUIJrGBe+8fQZq2WfE=",
+   "module": "sha256-yMQTmQhdQQPDd6llmXlAFwZ8noiqTM2LsXlZ653n7l0=",
+   "pom": "sha256-Gk/1TUcVfTfbi2KNCkTAscxJ6aFgl7vYvTB1Dwe2NRY="
  },
-  "org/junit/platform#junit-platform-suite-api/1.12.1": {
-   "jar": "sha256-s0gUUihPfFDV4KeXsTrRwuNp2QCxfQpOhQBampjT8Ss=",
-   "module": "sha256-ghsnFZa3qC3Onrjj/DVF+KenIkvU02HgOjFSv6LnZwY=",
-   "pom": "sha256-gqr1cn4YGh2dKvvUM5xdAUPOIIbJ/0HY6b52LZo2w8A="
+  "org/junit/platform#junit-platform-suite-api/1.12.2": {
+   "jar": "sha256-4XsgBikN4R9kRKT5i21xu719b8z8QP2F20EyEMssvI0=",
+   "module": "sha256-p4KMRJrH3eT31dZBTu6KNmSyGFFRnf+tDDYQ5e0Ljv4=",
+   "pom": "sha256-fH/9bHyEzSjxSHEDEI/FvkTi0x3RYO10RGQAQ8A3TFM="
  },
-  "org/junit/platform#junit-platform-suite-commons/1.12.1": {
-   "jar": "sha256-C0oBRu0aKysb94NhNDn0sdFHvM+0PlGokbgEXs9PFd4=",
-   "module": "sha256-+LP4UlNiXd4TqWypShqH74pqJeF7fJpXbFrNQyPAan0=",
-   "pom": "sha256-C1cZJGVJXHjj5px8Ko2oVs6xHV+tlO/1pw8aYtepW3M="
+  "org/junit/platform#junit-platform-suite-commons/1.12.2": {
+   "jar": "sha256-6eQ+/chcjYOmEu/SmMgWRHoR3ADEbOtyDGOsOGoGUJQ=",
+   "module": "sha256-FRnxoAUNvbgdXmkFxhjv0Jq26rFJJtRFEPpiC/XwexM=",
+   "pom": "sha256-O66C06IPNjstyYWsC1JlI84F5R0Patbxf1x1JntrEVA="
  },
  "org/leadpony/justify#justify-parent/3.1.0": {
   "pom": "sha256-ckfhOlVhg4gPqnP7EeWQJ7R+fG1Ghx0sUIg3WwDbJY0="
@@ -850,17 +897,17 @@
  "org/mockito#mockito-bom/4.11.0": {
   "pom": "sha256-2FMadGyYj39o7V8YjN6pRQBq6pk+xd+eUk4NJ9YUkdo="
  },
-  "org/mockito#mockito-core/5.16.1": {
-   "jar": "sha256-1yv30j7BnQUTxoC8fruszvDGQ68iyCxez9mZshCfx5c=",
-   "pom": "sha256-5p0IpMRp7l0fa3BXYsKKZWEUOSDSfHbrSnrFYGPurnw="
+  "org/mockito#mockito-core/5.17.0": {
+   "jar": "sha256-3/Wa2MYbAm74bMET+U8jAesGyq+B3sMMeKlqGmVZXF4=",
+   "pom": "sha256-0BzBTnZhxjBHlApC9Qc9Sg7L4qDqXS6jQgS0zAgeFqU="
  },
  "org/mockito#mockito-inline/5.2.0": {
   "jar": "sha256-7lLhwpmmMhhPuidKk3CZPgkUBCn15RbmxVcP1ldLKX8=",
   "pom": "sha256-cG00cOVtMaO1YwaY0Qeb79uYMUWwGE5LorhNo4eo9oQ="
  },
-  "org/mockito#mockito-junit-jupiter/5.16.1": {
-   "jar": "sha256-fd+TxJfcsHv09pR2aj2NXupvom8CwYywoeWYpTR+c/A=",
-   "pom": "sha256-XTWQpYRiDj/p8nCrppdmeBs0aUB0JoMLT71pYYDu8kc="
+  "org/mockito#mockito-junit-jupiter/5.17.0": {
+   "jar": "sha256-XFRC+KqqjwPfA+SGKg1pIF0bQfXtv31ap6JIamHeSbc=",
+   "pom": "sha256-AaXP6bnbkv1GSZ3oA2e7JtreMj/DH4cMyT8ArLwWRs0="
  },
  "org/objenesis#objenesis-parent/3.3": {
   "pom": "sha256-MFw4SqLx4cf+U6ltpBw+w1JDuX1CjSSo93mBjMEL5P8="
@@ -886,6 +933,9 @@
  "org/openjfx#javafx-base/23.0.1/linux": {
   "jar": "sha256-7sBxSvCRmRxVt9v23ePYWSsf6LoEbagc2IUDuAvpi2M="
  },
+  "org/openjfx#javafx-base/23.0.1/linux-aarch64": {
+   "jar": "sha256-KZWXC6g6nyca0+O8IC+odlIbiIlJBBPhdr9Jek/k2w4="
+  },
  "org/openjfx#javafx-controls/23.0.1": {
   "jar": "sha256-3XcaHc2LdE4WcgNao8YoM+Y0ZfpgZrOgwuon8XfL1O8=",
   "pom": "sha256-zUsIKtIxRfbipieHQ3FsCu3fit8vO/iu1ihYCFWk46g="
@@ -893,12 +943,18 @@
  "org/openjfx#javafx-controls/23.0.1/linux": {
   "jar": "sha256-LQyxs8l1c4lHywYBT+IkCrNrS29oxG6SbQiWCYJbqdw="
  },
+  "org/openjfx#javafx-controls/23.0.1/linux-aarch64": {
+   "jar": "sha256-cHKyNufjePXWijbVrQCWjTBDo4i3QgvfZ9k7t5dKYXE="
+  },
  "org/openjfx#javafx-fxml/23.0.1": {
   "pom": "sha256-h45/OrAgdht3KLq0VkfIU7z+Qnc4MCqlLdOrzHXsDuo="
  },
  "org/openjfx#javafx-fxml/23.0.1/linux": {
   "jar": "sha256-+zQCUfl7tvMxg/oBzlqXaBbjFqmI3EBIGj57VQgtmJo="
  },
+  "org/openjfx#javafx-fxml/23.0.1/linux-aarch64": {
+   "jar": "sha256-W7WQrA9/wuzSa2DoZiOFVDVzDQoTZcM/MeNwitoN0YU="
+  },
  "org/openjfx#javafx-graphics/23.0.1": {
   "jar": "sha256-kJCrtogUiOdLj4fkWoI47DMk7ETsxg/B+3tQMtgJURE=",
   "pom": "sha256-st72CewOe6tjk5EdDP7xnZZo0NPcsvAB/luMWaiU24g="
@@ -906,12 +962,18 @@
  "org/openjfx#javafx-graphics/23.0.1/linux": {
   "jar": "sha256-NVPB6tM9naWVgGkCKlBr/X4FxX7m9nR5spFz8taBZEw="
  },
+  "org/openjfx#javafx-graphics/23.0.1/linux-aarch64": {
+   "jar": "sha256-neEdZDhvCC5tdPabZZyDlDW5kUHR7Y3Rk1Ux4OBgVMo="
+  },
  "org/openjfx#javafx-media/23.0.1": {
   "pom": "sha256-tfRj6GKtVPWcSsQbkRA/4PqvPe6WOL4AczNi7p6cWko="
  },
  "org/openjfx#javafx-media/23.0.1/linux": {
   "jar": "sha256-OP/Uy68DzVJMKslEStdK5ZNGuJpgmM15G1zSvzzUU6I="
  },
+  "org/openjfx#javafx-media/23.0.1/linux-aarch64": {
+   "jar": "sha256-QjtamkDW3UNXSxGMgbKd0790hH7ZgmYkFTa90uzFUM4="
+  },
  "org/openjfx#javafx-swing/23.0.1": {
   "jar": "sha256-nNkwvgpUAQhXNRTE+aSL/yln3Kg/XjGR7//vQH7ade0=",
   "pom": "sha256-uht/UEeiXgkbdKJpJKQ2St+eoWqKLESnEbvledqikyw="
@@ -919,6 +981,9 @@
  "org/openjfx#javafx-swing/23.0.1/linux": {
   "jar": "sha256-+FtFmvQtjKJ18NiRocwcjUuMudSPMuXhYau9Rt6YaqY="
  },
+  "org/openjfx#javafx-swing/23.0.1/linux-aarch64": {
+   "jar": "sha256-KEDeqgCwBi5zmLT+6cuSPRmNk+UwFj/OphbZT9/5HVo="
+  },
  "org/openjfx#javafx/23.0.1": {
   "pom": "sha256-S7WEqBPU9lbMNxf+dQpLLI/2mj1W+6E53MHms4FV2F4="
  },
@@ -927,13 +992,6 @@
   "module": "sha256-SL8dbItdyU90ZSvReQD2VN63FDUCSM9ej8onuQkMjg0=",
   "pom": "sha256-m/fP/EEPPoNywlIleN+cpW2dQ72TfjCUhwbCMqlDs1U="
  },
-  "org/ow2#ow2/1.5.1": {
-   "pom": "sha256-Mh3bt+5v5PU96mtM1tt0FU1r+kI5HB92OzYbn0hazwU="
-  },
-  "org/ow2/asm#asm/9.7.1": {
-   "jar": "sha256-jK3UOsXrbQneBfrsyji5F6BAu5E5x+3rTMgcdAtxMoE=",
-   "pom": "sha256-cimwOzCnPukQCActnkVppR2FR/roxQ9SeEGu9MGwuqg="
-  },
  "org/projectlombok#lombok/1.18.36": {
   "jar": "sha256-c7awW2otNltwC6sI0w+U3p0zZJC8Cszlthgf70jL8Y4=",
   "pom": "sha256-iaIdJYdshWLBShDxsh77/M6dU7BYaGuChf6iJ2xTKQ4="
@@ -946,6 +1004,14 @@
   "jar": "sha256-91yll3ibPaxY9hhXuawuEDSmj6Zy2zUFWo+0UJ4yXyg=",
   "pom": "sha256-VLoj2HotQ4VAyZ74eUoIVvxXOiVrSYZ4KDw8Z+8Yrag="
  },
+  "org/sharegov#mjson/1.4.1": {
+   "jar": "sha256-clKt9sKQkWMEZzcqwk4cYqiix2M4sVFCW/tmkOj2ahY=",
+   "pom": "sha256-m+3tOK7iDx2L+AkM2MkrnwSSkV04fRzbWM9rycoYN6o="
+  },
+  "org/slf4j#slf4j-api/1.7.28": {
+   "jar": "sha256-+25PZ6KkaJ4+cTWE2xel0QkMHr5u7DDp4DSabuEYFB4=",
+   "pom": "sha256-YfEP6sV2ZltoyqYXDNQj6PsABV8frXrZ194hUOXxXKo="
+  },
  "org/slf4j#slf4j-api/2.0.17": {
   "jar": "sha256-e3UdlSBhlU1av+1xgcH2RdM2CRtnmJFZHWMynGIuuDI=",
   "pom": "sha256-FQxAKH987NwhuTgMqsmOkoxPM8Aj22s0jfHFrJdwJr8="
@@ -953,6 +1019,9 @@
  "org/slf4j#slf4j-bom/2.0.17": {
   "pom": "sha256-940ntkK0uIbrg5/BArXNn+fzDzdZn/5oGFvk4WCQMek="
  },
+  "org/slf4j#slf4j-parent/1.7.28": {
+   "pom": "sha256-kZtfQt3jOs4DaGXR4rKS2YoGJ0F/91bgKH9KVq0+VE4="
+  },
  "org/slf4j#slf4j-parent/2.0.17": {
   "pom": "sha256-lc1x6FLf2ykSbli3uTnVfsKy5gJDkYUuC1Rd7ggrvzs="
  },
@@ -12,17 +12,17 @@
  glib,
  copyDesktopItems,
  makeDesktopItem,
-  nix-update-script,
+  writeScript,
 }:
 stdenv.mkDerivation rec {
  pname = "ed-odyssey-materials-helper";
-  version = "2.156";
+  version = "2.173";

  src = fetchFromGitHub {
    owner = "jixxed";
    repo = "ed-odyssey-materials-helper";
    tag = version;
-    hash = "sha256-T7Mh9QZRQbDJmW976bOg5YNQoFxJ2SUFl6qBjos8LSo=";
+    hash = "sha256-PW5AnplciFenupASEqXA7NqQrH14Wfz1SSm1c/LWA7A=";
  };

  nativeBuildInputs = [
@@ -45,6 +45,10 @@ stdenv.mkDerivation rec {
      --replace-fail '"com.github.wille:oslib:master-SNAPSHOT"' '"com.github.wille:oslib:d6ee6549bb"'
    substituteInPlace application/src/main/java/module-info.java \
      --replace-fail 'requires oslib.master.SNAPSHOT;' 'requires oslib.d6ee6549bb;'
+
+    # remove "new version available" popup
+    substituteInPlace application/src/main/java/nl/jixxed/eliteodysseymaterials/FXApplication.java \
+      --replace-fail 'versionPopup();' ""
  '';

  mitmCache = gradle.fetchDeps {
@@ -55,7 +59,6 @@ stdenv.mkDerivation rec {
  gradleFlags = [ "-Dorg.gradle.java.home=${jdk23}" ];

  gradleBuildTask = "application:jpackage";
-  gradleUpdateTask = "application:nixDownloadDeps";

  installPhase = ''
    runHook preInstall
@@ -98,7 +101,20 @@ stdenv.mkDerivation rec {
    })
  ];

-  passthru.updateScript = nix-update-script { };
+  gradleUpdateScript = ''
+    runHook preBuild
+
+    gradle application:nixDownloadDeps -Dos.family=linux -Dos.arch=amd64
+    gradle application:nixDownloadDeps -Dos.family=linux -Dos.arch=aarch64
+  '';
+
+  passthru.updateScript = writeScript "update-ed-odyssey-materials-helper" ''
+    #!/usr/bin/env nix-shell
+    #!nix-shell -i bash -p nix-update
+
+    nix-update ed-odyssey-materials-helper # update version and hash
+    `nix-build --no-out-link -A ed-odyssey-materials-helper.mitmCache.updateScript` # update deps.json
+  '';

  meta = {
    description = "Helper for managing materials in Elite Dangerous Odyssey";
@@ -115,6 +131,9 @@ stdenv.mkDerivation rec {
      toasteruwu
    ];
    mainProgram = "ed-odyssey-materials-helper";
-    platforms = lib.platforms.linux;
+    platforms = [
+      "x86_64-linux"
+      "aarch64-linux"
+    ];
  };
 }
@@ -1,8 +1,8 @@
 diff --git a/application/src/main/java/nl/jixxed/eliteodysseymaterials/FXApplication.java b/application/src/main/java/nl/jixxed/eliteodysseymaterials/FXApplication.java
-index a38ae02d..1c164911 100644
+index 0a3b0dc6..d4bd57d9 100644
 --- a/application/src/main/java/nl/jixxed/eliteodysseymaterials/FXApplication.java
 +++ b/application/src/main/java/nl/jixxed/eliteodysseymaterials/FXApplication.java
-@@ -112,7 +112,6 @@ public class FXApplication extends Application {
+@@ -125,7 +125,6 @@ public class FXApplication extends Application {
             }
             PreferencesService.setPreference(PreferenceConstants.APP_SETTINGS_VERSION, System.getProperty("app.version"));
             whatsnewPopup();
@@ -28,15 +28,14 @@ index 6ac788ea..a5281983 100644
 
 
 diff --git a/application/src/main/java/nl/jixxed/eliteodysseymaterials/templates/settings/sections/General.java b/application/src/main/java/nl/jixxed/eliteodysseymaterials/templates/settings/sections/General.java
-index 3b00de60..78d6afd7 100644
+index 5fa546bb..839eed44 100644
 --- a/application/src/main/java/nl/jixxed/eliteodysseymaterials/templates/settings/sections/General.java
 +++ b/application/src/main/java/nl/jixxed/eliteodysseymaterials/templates/settings/sections/General.java
-@@ -99,7 +99,7 @@ public class General extends VBox implements Template {
-         final HBox supportPackageSetting = createSupportPackageSetting();
-         final HBox wipSetting = createWIPSetting();
-         this.getStyleClass().addAll("settingsblock", SETTINGS_SPACING_10_CLASS);
-        this.getChildren().addAll(generalLabel, langSetting, fontSetting, customJournalFolderSetting, pollSetting, urlSchemeLinkingSetting, exportInventory, blueprintExpandedSetting, importFromClipboardSetting,importSlefFromClipboardSetting,supportPackageSetting);
-+        this.getChildren().addAll(generalLabel, langSetting, fontSetting, customJournalFolderSetting, pollSetting, exportInventory, blueprintExpandedSetting, importFromClipboardSetting,importSlefFromClipboardSetting,supportPackageSetting);
-     }
- 
-     @Override
+@@ -83,7 +83,6 @@ public class General extends DestroyableVBox implements DestroyableEventTemplate
+                 fontSetting,
+                 customJournalFolderSetting,
+                 pollSetting,
+-                urlSchemeLinkingSetting,
+                 exportInventory,
+                 blueprintExpandedSetting,
+                 importFromClipboardSetting,
@@ -15,17 +15,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "eww";
-  version = "0.6.0-unstable-2025-05-13";
+  version = "0.6.0-unstable-2025-05-18";

  src = fetchFromGitHub {
    owner = "elkowar";
    repo = "eww";
-    rev = "15315a05ece87aa36fd6b0ff54f6484823e40cda";
-    hash = "sha256-0AEYrizfnhhFmxADBEjnXL4VHvzdTvpmZ0Gjk2IQr9g=";
+    rev = "98c220126d912b935987766f56650b55f3e226eb";
+    hash = "sha256-zi+5G05aakh8GBdfHL1qcNo/15VEm5mXtHGgKMAyp1U=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-GjYeto/As8fM0xqTHfyKQ5YWAciBW9tvXM9ra3V86Eo=";
+  cargoHash = "sha256-SEdr9nW5nBm1g6fjC5fZhqPbHQ7H6Kk0RL1V6OEQRdA=";

  nativeBuildInputs = [
    installShellFiles
@@ -59,13 +59,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "fastfetch";
-  version = "2.43.0";
+  version = "2.44.0";

  src = fetchFromGitHub {
    owner = "fastfetch-cli";
    repo = "fastfetch";
    tag = finalAttrs.version;
-    hash = "sha256-gUqNiiPipoxLKwGVsi42PyOnmPbfvUs7UwfqOdmFn/E=";
+    hash = "sha256-cLN1G/Rp1Euc6pp0V/Xd4qmo3x0b+rnNU8PDP5j/PTE=";
  };

  outputs = [
--- a/Show More
+++ b/Show More