Merge master into staging-next

2025-12-23 00:18:10 +00:00
parent 7be1b8f52c f645b5d050
commit fb7bf4701b
85 changed files with 1169 additions and 960 deletions
@@ -26,6 +26,8 @@

 - `python3Packages.gradio` has been updated to version 6. See upstream's migration guide at https://www.gradio.app/main/guides/gradio-6-migration-guide.

+- `vicinae` has been updated to v0.17. Version 0.17 contains a complete overhaul of the configuration system. For update instructions, see the [release notes for v0.17.0](https://github.com/vicinaehq/vicinae/releases/tag/v0.17.0) and the [upstream configuration documentation](https://docs.vicinae.com/config).
+
 - All Log4Shell vulnerability scanners were removed, as they were all unmaintained upstream and are no longer relevant given that the vulnerability has been fixed upstream for several years.

 - `asio` (standalone version of `boost::asio`) has been updated from 1.24.0 to 1.36.0. Some breaking changes were introduced between these
@@ -153,11 +153,12 @@
    "id": 5704451,
    "maintainers": {
      "ConnorBaker": 3880346,
+      "GaetanLepage": 33058747,
      "SomeoneSerge": 9720532,
+      "YorikSar": 428074,
      "samuela": 226872
    },
    "members": {
-      "GaetanLepage": 33058747,
      "prusnak": 42201
    },
    "name": "cuda-maintainers"
@@ -6897,6 +6897,12 @@
    githubId = 53937537;
    keys = [ { fingerprint = "BBC4 C071 516B A147 8D07  F9DC D2FD E6EC 2E8C 2BF4"; } ];
  };
+  doprz = {
+    name = "Diego Perez";
+    github = "doprz";
+    githubId = 52579214;
+    keys = [ { fingerprint = "B423 DDC0 5EAC 14B4 67A6  F826 0323 AA44 BA23 6DF7"; } ];
+  };
  doronbehar = {
    email = "me@doronbehar.com";
    github = "doronbehar";
@@ -0,0 +1,81 @@
+{
+  lib,
+  pkgs,
+  config,
+  extendModules,
+  ...
+}:
+{
+
+  options = {
+
+    system.build = {
+      noFacter = lib.mkOption {
+        type = lib.types.unspecified;
+        description = "A version of the system closure with facter disabled";
+      };
+    };
+
+    hardware.facter.debug = {
+      nvd = lib.mkOption {
+        type = lib.types.package;
+        description = ''
+          A shell application which will produce an nvd diff of the system closure with and without facter enabled.
+        '';
+      };
+      nix-diff = lib.mkOption {
+        type = lib.types.package;
+        description = ''
+          A shell application which will produce a nix-diff of the system closure with and without facter enabled.
+        '';
+      };
+    };
+
+  };
+
+  config.system.build = {
+    noFacter = extendModules {
+      modules = [
+        {
+          # we 'disable' facter by overriding the report and setting it to empty with one caveat: hostPlatform
+          config.hardware.facter.report = lib.mkForce {
+            system = config.nixpkgs.hostPlatform;
+          };
+        }
+      ];
+    };
+  };
+
+  config.hardware.facter.debug = {
+
+    nvd = pkgs.writeShellApplication {
+      name = "facter-nvd-diff";
+      runtimeInputs = [
+        config.nix.package
+        pkgs.nvd
+      ];
+      text = ''
+        nvd diff \
+          ${config.system.build.noFacter.config.system.build.toplevel} \
+          ${config.system.build.toplevel} \
+          "$@"
+      '';
+    };
+
+    nix-diff = pkgs.writeShellApplication {
+      name = "facter-nix-diff";
+      runtimeInputs = [
+        config.nix.package
+        pkgs.nix-diff
+      ];
+      text = ''
+        nix-diff \
+          ${config.system.build.noFacter.config.system.build.toplevel} \
+          ${config.system.build.toplevel} \
+          "$@"
+      '';
+    };
+
+  };
+
+}
@@ -7,6 +7,7 @@
  imports = [
    ./bluetooth.nix
    ./camera
+    ./debug.nix
    ./disk.nix
    ./fingerprint
    ./firmware.nix
@@ -7,6 +7,8 @@
    browser =
      { config, pkgs, ... }:
      {
+        virtualisation.memorySize = 1024 * 2;
+
        environment.systemPackages =
          let
            prometheusSeleniumScript =
@@ -18,20 +20,87 @@
                  from selenium import webdriver
                  from selenium.webdriver.common.by import By
                  from selenium.webdriver.firefox.options import Options
+                  from selenium.webdriver.support.relative_locator import locate_with
                  from selenium.webdriver.support.ui import WebDriverWait

                  options = Options()
                  options.add_argument("--headless")
-                  service = webdriver.FirefoxService(executable_path="${lib.getExe pkgs.geckodriver}")  # noqa: E501
+                  service = webdriver.FirefoxService(
+                    executable_path="${lib.getExe pkgs.geckodriver}")  # noqa: E501

                  driver = webdriver.Firefox(options=options, service=service)
                  driver.implicitly_wait(10)
-                  driver.get("http://prometheus:9090/")

+                  driver.get("http://prometheus:9090/")
                  wait = WebDriverWait(driver, 60)

-                  assert len(driver.find_elements(By.CLASS_NAME, "mantine-AppShell-header")) > 0  # noqa: E501
-                  assert len(driver.find_elements(By.CLASS_NAME, "mantine-AppShell-main")) > 0  # noqa: E501
+                  # There should have been a redirect
+                  url = driver.current_url
+                  assert url == "http://prometheus:9090/query"
+
+                  assert len(driver.find_elements(
+                    By.CLASS_NAME, "mantine-AppShell-header")) > 0
+                  assert len(driver.find_elements(
+                    By.CLASS_NAME, "mantine-AppShell-main")) > 0
+
+                  # Do a Prometheus query
+                  query_box = driver.find_element(
+                    By.XPATH, "//div[@role='textbox']")
+                  query_box.click()
+                  query_box.send_keys("up")
+
+                  # Run query with execute button
+                  driver.find_element(
+                    By.XPATH, "//span[contains(text(),'Execute')]").click()
+
+                  # Find query result table
+                  table_tr_elements = driver.find_elements(
+                    By.CLASS_NAME, "mantine-Table-tr")
+                  assert len(table_tr_elements) == 1
+
+                  # Navigate to target health page
+                  driver.find_element(
+                    By.XPATH, "//span[text()='Status']").click()
+
+                  driver.find_element(
+                    By.LINK_TEXT, "Target health").click()
+
+                  url = driver.current_url
+                  assert url == "http://prometheus:9090/targets"
+
+                  # Click on the prometheus job dropdown button
+                  prometheus_job_dropdown = driver.find_element(
+                    By.CLASS_NAME, "mantine-Accordion-chevron").click()
+
+                  targets_healthy = len(driver.find_elements(
+                    By.CSS_SELECTOR, "div[class^='_healthOk']"))
+                  assert targets_healthy == 1
+
+                  targets_errored = len(driver.find_elements(
+                    By.CSS_SELECTOR, "div[class^='_healthErr']"))
+                  assert targets_errored == 0
+
+                  # Go back to homepage
+                  driver.find_element(
+                    By.XPATH, "//span[text()='Query']").click()
+
+                  # Navigate to build info section and verify correct version
+                  # number shown
+                  driver.find_element(
+                    By.XPATH, "//span[text()='Status']").click()
+
+                  driver.find_element(
+                    By.LINK_TEXT, "Runtime & build information").click()
+
+                  url = driver.current_url
+                  assert url == "http://prometheus:9090/status"
+
+                  # Find table
+                  version_th_element = driver.find_element(
+                    By.XPATH, "//th[text()='version']")
+                  version_td_element = driver.find_element(
+                    locate_with(By.TAG_NAME, "td").near(version_th_element))
+                  assert version_td_element.text == "${pkgs.prometheus.version}"

                  driver.close()
                '';
@@ -59,8 +128,7 @@
              static_configs = [
                {
                  targets = [
-                    "prometheus1:${toString config.services.prometheus.port}"
-                    "prometheus2:${toString config.services.prometheus.port}"
+                    "prometheus:${toString config.services.prometheus.port}"
                  ];
                }
              ];
@@ -1225,8 +1225,8 @@ let
        mktplcRef = {
          name = "vscode-markdownlint";
          publisher = "DavidAnson";
-          version = "0.60.0";
-          hash = "sha256-Buwa63HahT96qhhuvARW7p1u9kbkoEyA9usoh60m3KE=";
+          version = "0.61.1";
+          hash = "sha256-3O4ii6RUuw35pv95zJwJhgnI/8ryAnSKfnHC01l3FDw=";
        };
        meta = {
          changelog = "https://marketplace.visualstudio.com/items/DavidAnson.vscode-markdownlint/changelog";
@@ -4,8 +4,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
  mktplcRef = {
    name = "lldb-dap";
    publisher = "llvm-vs-code-extensions";
-    version = "0.2.18";
-    hash = "sha256-H2CSy+Zow6inLUgSW5VNHZBEmag1acslX3bkw3XYcKA=";
+    version = "0.4.1";
+    hash = "sha256-7eMVniepE4lDLAYsMpE5bKYvkfskGaOapxYUJy58mJA=";
  };

  meta = {
@@ -14,19 +14,19 @@ let
  vsix = stdenvNoCC.mkDerivation (finalAttrs: {
    name = "roo-code-${finalAttrs.version}.vsix";
    pname = "roo-code-vsix";
-    version = "3.36.2";
+    version = "3.36.6";

    src = fetchFromGitHub {
      owner = "RooCodeInc";
      repo = "Roo-Code";
      tag = "v${finalAttrs.version}";
-      hash = "sha256-YO3TxKcCDoIJeBoMGFFrHUp6lne1e84Tf1I2vHF6w1c=";
+      hash = "sha256-bb6IXi88TPqXnC5eCXj7G0y7xO4yOJWSp1frHkLRwH0=";
    };

    pnpmDeps = fetchPnpmDeps {
      inherit (finalAttrs) pname version src;
      fetcherVersion = 2;
-      hash = "sha256-k6Bw6MlFDNPNPdaKJ7tW8wje2j9LJvREtlAWyySnOC0=";
+      hash = "sha256-YfDWspdDBiEWiGuitqZLChntVHFly4O2HE/eKVL/ZGY=";
    };

    nativeBuildInputs = [
@@ -6,13 +6,13 @@
 }:
 mkLibretroCore {
  core = "yabause";
-  version = "0-unstable-2024-10-21";
+  version = "0-unstable-2025-12-20";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "yabause";
-    rev = "c35712c5ed33e18d77097f2059a036e19d1d66f2";
-    hash = "sha256-4/gxWNPkGKBf4ti7ZF4GXgng6ZPyM9prrvK0S5tZ6V8=";
+    rev = "65af22e96beb6d9b0b9a50a81a39c86a6d604c1c";
+    hash = "sha256-LafC48f1m6pRWhXmfN+D+5r9qCNm1v9uLJVq5Wa5naE=";
  };

  makefile = "Makefile";
@@ -45,13 +45,13 @@
    "vendorHash": "sha256-weHY7ZV3HaFBYlDNhwAYN9vDItkI+wtk9UNlM0uuwfY="
  },
  "aliyun_alicloud": {
-    "hash": "sha256-pDbTdKYTpRBN/o5bWg5VRfD+AJNhpqIWmGpzMAaHfAg=",
+    "hash": "sha256-i53+JvEr5K4/RCsk5Kfa1Nbox1/KfsgXjX5wCa4zd7o=",
    "homepage": "https://registry.terraform.io/providers/aliyun/alicloud",
    "owner": "aliyun",
    "repo": "terraform-provider-alicloud",
-    "rev": "v1.265.0",
+    "rev": "v1.266.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-LSvX63g4GWcr2Uo6H50dOWG0XWUhmbhUw9EYsQqs+HU="
+    "vendorHash": "sha256-xRoj0X06lhoVXFLfrV8ganqsyzc4PFk+6R2Jx67VIpE="
  },
  "aminueza_minio": {
    "hash": "sha256-G6eQeoxIeuUJK7LF8gByOrNP27i3p0OccZNxL2DxDw0=",
@@ -44,7 +44,7 @@ rustPlatform.buildRustPackage rec {
    install -Dm644 icons/app_icon.png $out/share/icons/hicolor/1024x1024/apps/airgorah.png
  '';

-  dessktopItems = [
+  desktopItems = [
    (makeDesktopItem {
      name = "airgorah";
      comment = "A WiFi auditing software that can perform deauth attacks and passwords cracking";
@@ -75,8 +75,31 @@
  writeShellScript,
  nix-update,
  libxml2,
+  boost,
+  thrift,
+  libGL,
+  libX11,
+  libXdamage,
+  nss,
+  nspr,
 }:
+let
+  thrift20 = thrift.overrideAttrs (old: {
+    version = "0.20.0";

+    src = fetchFromGitHub {
+      owner = "apache";
+      repo = "thrift";
+      tag = "v0.20.0";
+      hash = "sha256-cwFTcaNHq8/JJcQxWSelwAGOLvZHoMmjGV3HBumgcWo=";
+    };
+
+    cmakeFlags = (old.cmakeFlags or [ ]) ++ [
+      "-DCMAKE_POLICY_VERSION_MINIMUM=3.10"
+    ];
+  });
+
+in
 stdenv.mkDerivation (finalAttrs: {
  pname = "animeko";
  version = "5.2.0";
@@ -191,6 +214,13 @@ stdenv.mkDerivation (finalAttrs: {
    libdvdnav
    flac
    libxml2
+    boost
+    thrift20
+    nss
+    nspr
+    libGL
+    libX11
+    libXdamage
  ];

  dontWrapQtApps = true;
@@ -1,10 +1,9 @@
 {
  stdenv,
  lib,
-  fetchurl,
+  maven,
  fetchzip,
-  openjdk,
-  openjfx,
+  jre,
  writeScript,
  runCommandLocal,
  bash,
@@ -26,39 +25,38 @@ let
    stripRoot = false;
  };

-  # ÁNYK needs JavaFX for the Ügyfélkapu login webview.
-  jdkWithFX = openjdk.override {
-    enableJavaFX = true;
-    openjfx_jdk = openjfx.override { withWebKit = true; };
+  # ÁNYK uses some SOAP stuff that's not shipped with OpenJDK any more.
+  # We don't really want to use openjdk8 because it's unusable on HiDPI
+  # and people are more likely to have a modern OpenJDK installed.
+  # We use Maven to resolve these unbundled dependencies.
+  # jdk_headless is just overriden so we don't have to fetch another OpenJDK for no reason.
+  soapDeps = (maven.override { jdk_headless = jre; }).buildMavenPackage {
+    pname = "anyk-soap-deps";
+    version = "1.0.0";
+
+    src = lib.sources.sourceFilesBySuffices ./. [ "pom.xml" ];
+
+    mvnHash = "sha256-4keHPzS8pbIIwODmBUMofJt27n5WqYh+IGqE6d9od7k=";
+
+    installPhase = ''
+      mkdir -p $out/share/java
+      cp target/lib/*.jar $out/share/java/
+    '';
  };

-  extraClasspath = [
-    # ÁNYK uses some SOAP stuff that's not shipped with OpenJDK any more.
-    # We don't really want to use openjdk8 because it's unusable on HiDPI
-    # and people are more likely to have a modern OpenJDK installed.
-    (fetchurl {
-      url = "mirror://maven/org/glassfish/metro/webservices-rt/2.4.10/webservices-rt-2.4.10.jar";
-      hash = "sha256-lHclIZn3HR2B2lMttmmQGIV67qJi5KhL5jT2WNUQpPI=";
-    })
-
-    (fetchurl {
-      url = "mirror://maven/org/glassfish/metro/webservices-api/2.4.10/webservices-api-2.4.10.jar";
-      hash = "sha256-1jiabjPkRnh+l/fmTt8aKE5hpeLreYOiLH9sVIcLUQE=";
-    })
-
-    (fetchurl {
-      url = "mirror://maven/com/sun/activation/jakarta.activation/2.0.1/jakarta.activation-2.0.1.jar";
-      hash = "sha256-ueJLfdbgdJVWLqllMb4xMMltuk144d/Yitu96/QzKHE=";
-    })
-
-    # Patch one of the ÁNYK classes so it works with the packages above by removing .internal. from the package names.
-    (runCommandLocal "anyk-patch" { } ''
-      mkdir $out
-      cd $out
-      ${unzip}/bin/unzip ${src}/application/abevjava.jar hu/piller/enykp/niszws/ClientStubBuilder.class
-      ${python3}/bin/python ${./patch_paths.py} hu/piller/enykp/niszws/ClientStubBuilder.class
-    '')
-  ];
+  # Binary patch ÁNYK so it works with the JARs we fetch above (removing .internal. from some package names).
+  anykSoapPatch =
+    runCommandLocal "anyk-patch"
+      {
+        nativeBuildInputs = [ unzip ];
+      }
+      ''
+        mkdir $out
+        cd $out
+        unzip ${src}/application/abevjava.jar \
+          hu/piller/enykp/niszws/ClientStubBuilder.class
+        shopt -s globstar; ${python3}/bin/python ${./patch_paths.py} **/*.class
+      '';

  # This script can be used to run template installation jars (or use the Szervíz -> Telepítés menu)
  anyk-java = writeScript "anyk-java" ''
@@ -91,7 +89,7 @@ let
      SCALING_PROP="-Dsun.java2d.uiScale=''${WINDOW_SCALING_FACTOR}"
    fi
    # ÁNYK crashes with NullPointerException with the GTK look and feel so use the cross-platform one.
-    exec ${jdkWithFX}/bin/java -Dswing.systemlaf=javax.swing.plaf.metal.MetalLookAndFeel $SCALING_PROP "$@"
+    exec ${jre}/bin/java -Dswing.systemlaf=javax.swing.plaf.metal.MetalLookAndFeel $SCALING_PROP "$@"
  '';
 in
 stdenv.mkDerivation {
@@ -124,8 +122,8 @@ stdenv.mkDerivation {
    substituteAll ${anyk-java} $out/bin/anyk-java
    chmod +x $out/bin/anyk-java

-    # ÁNYK has some old school dependencies that are no longer bundled with Java, put them on the classpath.
-    makeWrapper $out/bin/anyk-java $out/bin/anyk --add-flags "-cp ${lib.concatStringsSep ":" extraClasspath}:$out/opt/abevjava.jar hu.piller.enykp.gui.framework.MainFrame"
+    # ÁNYK has some old school dependencies that are no longer bundled with Java, put them on the classpath. The * is resolved by Java at runtime.
+    makeWrapper $out/bin/anyk-java $out/bin/anyk --add-flags "-cp '${soapDeps}/share/java/*:${anykSoapPatch}:$out/opt/abevjava.jar' hu.piller.enykp.gui.framework.MainFrame"

    mkdir -p $out/share/applications $out/share/pixmaps $out/share/icons

@@ -145,7 +143,7 @@ stdenv.mkDerivation {
    homepage = "https://nav.gov.hu/nyomtatvanyok/letoltesek/nyomtatvanykitolto_programok/nyomtatvany_apeh/keretprogramok/javakitolto";
    license = lib.licenses.unfree;
    maintainers = with lib.maintainers; [ chpatrick ];
-    platforms = openjdk.meta.platforms;
+    platforms = jre.meta.platforms;
    sourceProvenance = [ lib.sourceTypes.binaryBytecode ];
    mainProgram = "anyk";
  };
@@ -1,35 +1,41 @@
 from pathlib import Path
 from struct import pack
 import sys
+import argparse

 def to_java_string(string) -> bytes:
  string_bytes = string.encode("utf-8")
  # Java constant pool string entries are prefixed by 0x01 and 16-bit big-endian string length.
  return pack(">BH", 1, len(string_bytes)) + string_bytes

-class_file = Path(sys.argv[1])
+parser = argparse.ArgumentParser()

-clazz = class_file.read_bytes()
+parser.add_argument("class_files", nargs="+", type=Path)

-# We want to fix these package names so they work with the open-source Java EE releases instead of OpenJDK 8.
-patches = [
-  ( "com/sun/xml/internal/ws/developer/WSBindingProvider", "com/sun/xml/ws/developer/WSBindingProvider" ),
-  ( "com/sun/xml/internal/ws/api/message/Header", "com/sun/xml/ws/api/message/Header" ),
-  ( "com.sun.xml.internal.ws.transport.http.client.streaming.chunk.size", "com.sun.xml.ws.transport.http.client.streaming.chunk.size" ),
-  ( "com/sun/xml/internal/ws/api/message/Headers", "com/sun/xml/ws/api/message/Headers" ),
-  ( "(Lorg/w3c/dom/Element;)Lcom/sun/xml/internal/ws/api/message/Header;", "(Lorg/w3c/dom/Element;)Lcom/sun/xml/ws/api/message/Header;" ),
-  ( "([Lcom/sun/xml/internal/ws/api/message/Header;)V", "([Lcom/sun/xml/ws/api/message/Header;)V" ),
-]
+args = parser.parse_args()

-for old, new in patches:
-  old_java = to_java_string(old)
-  new_java = to_java_string(new)
-  assert old_java in clazz
-  clazz = clazz.replace(old_java, new_java)
-  assert old_java not in clazz
-  assert new_java in clazz
+for class_file in args.class_files:
+  clazz = class_file.read_bytes()

-assert b".internal." not in clazz
+  # We want to fix these package names so they work with the open-source Java EE releases instead of OpenJDK 8.
+  patches = [
+    ( "com/sun/xml/internal/ws/developer/WSBindingProvider", "com/sun/xml/ws/developer/WSBindingProvider" ),
+    ( "com/sun/xml/internal/ws/api/message/Header", "com/sun/xml/ws/api/message/Header" ),
+    ( "com.sun.xml.internal.ws.transport.http.client.streaming.chunk.size", "com.sun.xml.ws.transport.http.client.streaming.chunk.size" ),
+    ( "com/sun/xml/internal/ws/api/message/Headers", "com/sun/xml/ws/api/message/Headers" ),
+    ( "(Lorg/w3c/dom/Element;)Lcom/sun/xml/internal/ws/api/message/Header;", "(Lorg/w3c/dom/Element;)Lcom/sun/xml/ws/api/message/Header;" ),
+    ( "([Lcom/sun/xml/internal/ws/api/message/Header;)V", "([Lcom/sun/xml/ws/api/message/Header;)V" ),
+  ]

-class_file.write_bytes(clazz)
+  for old, new in patches:
+    old_java = to_java_string(old)
+    new_java = to_java_string(new)
+    assert old_java in clazz
+    clazz = clazz.replace(old_java, new_java)
+    assert new_java in clazz
+    assert old_java not in clazz
+
+  assert b".internal." not in clazz
+
+  class_file.write_bytes(clazz)

@@ -0,0 +1,43 @@
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <modelVersion>4.0.0</modelVersion>
+
+    <groupId>nix.deps</groupId>
+    <artifactId>dependency-fetcher</artifactId>
+    <version>1.0.0</version>
+
+    <dependencies>
+        <dependency>
+            <groupId>com.sun.xml.ws</groupId>
+            <artifactId>jaxws-rt</artifactId>
+            <version>2.3.7</version> </dependency>
+
+        <dependency>
+            <groupId>org.glassfish.jaxb</groupId>
+            <artifactId>jaxb-runtime</artifactId>
+            <version>2.3.9</version>
+        </dependency>
+
+    </dependencies>
+
+    <build>
+        <plugins>
+            <plugin>
+                <artifactId>maven-dependency-plugin</artifactId>
+                <version>3.6.0</version>
+                <executions>
+                    <execution>
+                        <phase>package</phase>
+                        <goals>
+                            <goal>copy-dependencies</goal>
+                        </goals>
+                        <configuration>
+                            <outputDirectory>${project.build.directory}/lib</outputDirectory>
+                        </configuration>
+                    </execution>
+                </executions>
+            </plugin>
+        </plugins>
+    </build>
+</project>
@@ -1,5 +1,5 @@
 {
-  "url": "https://web.archive.org/web/20250801205917/https://nav.gov.hu/pfile/programFile?path=%252Fnyomtatvanyok%252Fletoltesek%252Fnyomtatvanykitolto_programok%252Fnyomtatvany_apeh%252Fkeretprogramok%252FAbevJava",
-  "sha256": "0b0b197ifqwsnnw375gvnhdsvmgqwmw5fkfcfw0wmh0f6xjdapam",
-  "version": "3.44.0"
+  "url": "https://web.archive.org/web/20251201151010/https://nav.gov.hu/pfile/programFile?path=%252Fnyomtatvanyok%252Fletoltesek%252Fnyomtatvanykitolto_programok%252Fnyomtatvany_apeh%252Fkeretprogramok%252FAbevJava",
+  "sha256": "12l1ghjcaxqi80bpxqwvsy3krz7qkdcg3zcvvif3g3hvqz5wc31s",
+  "version": "3.45.0"
 }
@@ -9,10 +9,10 @@
 }:
 let
  pname = "beeper";
-  version = "4.2.330";
+  version = "4.2.367";
  src = fetchurl {
    url = "https://beeper-desktop.download.beeper.com/builds/Beeper-${version}-x86_64.AppImage";
-    hash = "sha256-7Jf/dKShD7UBiv2CHj+cYaojqlpfshG1D09beX79g4o=";
+    hash = "sha256-t2knYAy6G/Xd/dOAvqA+wiTa6K//maHiwjY7Apshjhk=";
  };
  appimageContents = appimageTools.extract {
    inherit pname version src;
@@ -11,11 +11,11 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "container";
-  version = "0.6.0";
+  version = "0.7.1";

  src = fetchurl {
-    url = "https://github.com/apple/container/releases/download/${finalAttrs.version}/container-${finalAttrs.version}-installer-signed.pkg";
-    hash = "sha256-RGL6a8EY+rOC5Er9zHfbMrYHQY4LyApOUPcFP1haOGY=";
+    url = "https://github.com/apple/container/releases/download/${finalAttrs.version}/container-installer-signed.pkg";
+    hash = "sha256-2rfh8OD0H5BQkJsnST886U2dyf4aedJvCQziJ9YTxnE=";
  };

  nativeBuildInputs = [
@@ -27,19 +27,19 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "deadlock-mod-manager";
-  version = "0.11.1";
+  version = "0.13.0";

  src = fetchFromGitHub {
    owner = "deadlock-mod-manager";
    repo = "deadlock-mod-manager";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-0T2/8mfSxfJXWTbLfXaRrrVeBrf0PvpIr41BrnuSwOU=";
+    hash = "sha256-ja7B48UVpwj1gCZfrFWZjtTTaUh1QLTAE88oXwDt18Y=";
  };

  cargoRoot = "apps/desktop";
  buildAndTestSubdir = finalAttrs.cargoRoot;

-  cargoHash = "sha256-tzF1mFzFCdnB6h43TiVKEKWWQgWlrEm9Xh3HKKnNXZ0=";
+  cargoHash = "sha256-PeY59bvL/JGl8KyE0X+nPY3XC4TNa15lGcG2i///bCI=";

  nativeBuildInputs = [
    rustPlatform.cargoSetupHook
@@ -79,7 +79,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    pnpm = pnpm_9;
    fetcherVersion = 2;
    sourceRoot = "source";
-    hash = "sha256-MCzRZt+l2wHETOxzSatPnz5G48HjjGrOj3BVP+S7/Ss=";
+    hash = "sha256-dS9s5oy8GtRek7OwiGDwv7280zZuyjxIhiA6BqH8C1w=";
  };

  patches = [
@@ -1,44 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  scsh,
-  feh,
-  xorg,
-  xdg-user-dirs,
-}:
-
-stdenv.mkDerivation {
-  pname = "deco";
-  version = "0-unstable-2025-07-07";
-
-  src = fetchFromGitHub {
-    owner = "vedatechnologiesinc";
-    repo = "deco";
-    rev = "2fd28241ed28c07b9d641061d4e1bf3cacfcc7a0";
-    hash = "sha256-kjXEvgYO1p/dX9nXQ3HHcXmJdtxDM6xzKqDQu3yM4Tw=";
-  };
-
-  installPhase = ''
-    mkdir -p $out/bin
-    cp deco $out/bin
-    chmod +x $out/bin/deco
-  '';
-
-  postFixup = ''
-    substituteInPlace $out/bin/deco --replace-fail "/usr/bin/env scsh" "${scsh}/bin/scsh"
-    substituteInPlace $out/bin/deco --replace-fail "feh" "${feh}/bin/feh"
-    substituteInPlace $out/bin/deco --replace-fail "xdpyinfo" "${xorg.xdpyinfo}/bin/xdpyinfo"
-    substituteInPlace $out/bin/deco --replace-fail "xdg-user-dir" "${xdg-user-dirs}/bin/xdg-user-dir"
-  '';
-
-  meta = {
-    homepage = "https://github.com/vedatechnologiesinc/deco";
-    description = "Simple root image setter";
-    license = lib.licenses.bsd3;
-    platforms = lib.platforms.unix;
-    mainProgram = "deco";
-  };
-
-  dontBuild = true;
-}
@@ -6,16 +6,16 @@

 rustPlatform.buildRustPackage {
  pname = "dipc";
-  version = "1.0.0";
+  version = "1.1.0";

  src = fetchFromGitHub {
    owner = "doprz";
    repo = "dipc";
-    rev = "bf578bd9474084b7099ef665138667e486dce671";
-    hash = "sha256-RXEC8bwdnUOaDmYIb7ci/JD+vi16tBn55FRsUmwaRzk=";
+    rev = "b111b8cb997e3337974f861f44a73b557fb3c294";
+    hash = "sha256-qP7LRwNIM92p5xQeuvQ03kwBM/HnRH+BniiKeYoihKw=";
  };

-  cargoHash = "sha256-1vjVuAawuquPqem1as6xIv/ZJCzjgC4k0uyPSlrvpeg=";
+  cargoHash = "sha256-F6EYnkquvTsw4C7rl28Y1h9i9ChGccwZGkYSVrsEhVk=";

  meta = {
    description = "Convert your favorite images and wallpapers with your favorite color palettes/themes";
@@ -24,7 +24,10 @@ rustPlatform.buildRustPackage {
      mit
      asl20
    ];
-    maintainers = with lib.maintainers; [ ByteSudoer ];
+    maintainers = with lib.maintainers; [
+      doprz
+      ByteSudoer
+    ];
    mainProgram = "dipc";
  };
 }
@@ -1,44 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchurl,
-  jdk,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "emem";
-  version = "0.2.50";
-
-  inherit jdk;
-
-  src = fetchurl {
-    url = "https://github.com/ebzzry/${pname}/releases/download/v${version}/${pname}.jar";
-    sha256 = "18x3s3jrph8k3pc75jgwkfqazygpsx93zjxx68zms58my17cybh1";
-  };
-
-  dontUnpack = true;
-
-  buildPhase = ''
-    mkdir -p $out/bin $out/share/java
-  '';
-
-  installPhase = ''
-        cp $src $out/share/java/${pname}.jar
-
-        cat > $out/bin/${pname} << EOF
-    #! $SHELL
-    $jdk/bin/java -jar $out/share/java/${pname}.jar "\$@"
-    EOF
-
-        chmod +x $out/bin/${pname}
-  '';
-
-  meta = {
-    homepage = "https://github.com/ebzzry/emem";
-    description = "Trivial Markdown to HTML converter";
-    sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
-    license = lib.licenses.epl10;
-    platforms = lib.platforms.unix;
-    mainProgram = "emem";
-  };
-}
@@ -12,13 +12,13 @@

 buildGoModule rec {
  pname = "go-ios";
-  version = "1.0.189";
+  version = "1.0.192";

  src = fetchFromGitHub {
    owner = "danielpaulus";
    repo = "go-ios";
    rev = "v${version}";
-    sha256 = "sha256-gvC3s9cMRhhdzG/PWt8Nhgh/6I/g76ULCiscCaErfHE=";
+    sha256 = "sha256-2M53jcAZXzUjV53YdENjLpK9o26Xr/gFniuS0T2NZ0E=";
  };

  proxyVendor = true;
@@ -1,21 +1,18 @@
 {
  lib,
  buildGoModule,
-  fetchFromGitea,
+  fetchgit,
 }:

 buildGoModule rec {
  pname = "ios-safari-remote-debug";
  version = "unstable-2024-09-09";

-  src = fetchFromGitea {
-    domain = "git.gay";
-    owner = "besties";
-    repo = "ios-safari-remote-debug";
+  src = fetchgit {
+    url = "https://git.gay/besties/ios-safari-remote-debug.git";
    rev = "b3c69873997c08fce83c48a5ab42f5a2354efdf2";
    hash = "sha256-Hh/CeH0ba4uPMlEo+OZ3w36pTpsW6OLtYIE5v6dkUjo=";
  };
-
  vendorHash = "sha256-O8Dr4UAISZmCUGao0cBnAx4dUJm6+u4Swiw0H5NVeeA=";

  patches = [ ./add-permissions-to-the-output-directory.patch ];
@@ -9,11 +9,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "libbfio";
-  version = "20221025";
+  version = "20240414";

  src = fetchzip {
    url = "https://github.com/libyal/libbfio/releases/download/${finalAttrs.version}/libbfio-alpha-${finalAttrs.version}.tar.gz";
-    hash = "sha256-SwKQlmifyUo49yvo8RV+0nfvScPY5u+UrwjRZK2+qAg=";
+    hash = "sha256-xxMHOSVpGyw5rGXhU1tIOTKwt9yVw0KrPdYby0AEdv8=";
  };

  nativeBuildInputs = [ pkg-config ];
@@ -8,13 +8,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "libpqxx";
-  version = "7.10.1";
+  version = "7.10.4";

  src = fetchFromGitHub {
    owner = "jtv";
    repo = "libpqxx";
    rev = finalAttrs.version;
-    hash = "sha256-BVmIyJA5gDibwtmDvw7b300D0KdWv7c3Ytye6fiLAXU=";
+    hash = "sha256-0/gkfoJg+Zt9LLLQ/TVkUhBZ3NYIzg+uIClU89ORr+4=";
  };

  outputs = [
@@ -7,11 +7,11 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "maccy";
-  version = "2.5.1";
+  version = "2.6.1";

  src = fetchurl {
    url = "https://github.com/p0deje/Maccy/releases/download/${finalAttrs.version}/Maccy.app.zip";
-    hash = "sha256-pwMiCAS+1uEtEQv2e1UflxYuuh/qqYJbMcp2ZVvZBTA=";
+    hash = "sha256-hLlbrxlhvfMARRiMhVI3+QwUJqyPEjtK6PdBkfnzhoI=";
  };

  dontUnpack = true;
@@ -26,7 +26,8 @@ stdenvNoCC.mkDerivation rec {
            hash = "sha256-8zaZOPOCyLHOFmHhviJXIy5SB5trqQM/MFHhB9ygilQ=";
          };
        }
-        .${stdenvNoCC.hostPlatform.system};
+        .${stdenvNoCC.hostPlatform.system}
+          or (throw "Unsupported system: ${stdenvNoCC.hostPlatform.system}");
    in
    fetchurl {
      url = "https://github.com/mas-cli/mas/releases/download/v${version}/mas-${version}-${sources.arch}.pkg";
@@ -9,13 +9,13 @@

 stdenv.mkDerivation rec {
  pname = "microsoft-gsl";
-  version = "4.2.0";
+  version = "4.2.1";

  src = fetchFromGitHub {
    owner = "Microsoft";
    repo = "GSL";
    rev = "v${version}";
-    hash = "sha256-NrnYfCCeQ50oHYFbn9vh5Z4mfyxc0kAM3qnzQdq9gyM=";
+    hash = "sha256-rfSfgyjU1U6gaWzlx2CeaCSb784L29vHDAC/PQl+s6E=";
  };

  nativeBuildInputs = [
@@ -5,7 +5,6 @@
  desktop-file-utils,
  dotnetCorePackages,
  fetchFromGitHub,
-  fetchurl,
  imagemagick,
  lib,
  xdg-utils,
@@ -35,12 +34,6 @@ buildDotnetModule (finalAttrs: {

  gameHashes = callPackage ./game-hashes { };

-  gamesJson = fetchurl {
-    name = "games.json";
-    url = "https://web.archive.org/web/20251221212501id_/https://data.nexusmods.com/file/nexus-data/games.json";
-    hash = "sha256-OVy6b/n6n2/TdzfHCWDOTw2yai87ieki21fEp1IGamY=";
-  };
-
  enableParallelBuilding = false;

  # If the whole solution is published, there seems to be a race condition where
@@ -73,9 +66,9 @@ buildDotnetModule (finalAttrs: {
    substituteInPlace src/NexusMods.Games.FileHashes/NexusMods.Games.FileHashes.csproj \
      --replace-fail '$(BaseIntermediateOutputPath)games_hashes_db.zip' "$gameHashes"

-    # Use a pinned version of the nexus API's games.json data
+    # Use a vendored version of the nexus API's games.json data
    substituteInPlace src/NexusMods.Networking.NexusWebApi/NexusMods.Networking.NexusWebApi.csproj \
-      --replace-fail '$(BaseIntermediateOutputPath)games.json' "$gamesJson"
+      --replace-fail '$(BaseIntermediateOutputPath)games.json' ${./vendored/games.json}

    ${lib.optionalString finalAttrs.doCheck ''
      # For some reason these tests fail (intermittently?) with a zero timestamp
@@ -1,78 +0,0 @@
-#!/usr/bin/env nix-shell
-#! nix-shell -i bash -p bash curl common-updater-scripts
-
-set -eu -o pipefail
-
-# Set a default attrpath to allow running this update script directly
-export UPDATE_NIX_ATTR_PATH="${UPDATE_NIX_ATTR_PATH:-"nexusmods-app"}"
-
-save_url=https://web.archive.org/save
-json_url=https://data.nexusmods.com/file/nexus-data/games.json
-self=$(realpath "$0")
-dir=$(dirname "$self")
-curl_args=(
-  "$save_url/$json_url"
-
-  --silent
-  --fail
-  --location # follow redirects
-  --head # we only need headers
-  --output /dev/null # discard body
-  --write-out '%{url_effective}'
-
-  # Format --data-urlencode as GET query params
-  --get
-  # Instruct IA not to crawl linked content
-  --data-urlencode capture_all=0
-  # Only create a snapshot if older than 1 day
-  --data-urlencode if_not_archived_within=86400
-)
-cd "$dir"/../../../../
-
-# Ask the Internet Archive to save a snapshot of `games.json`
-# We capture its 'HTTP 302 Found' redirect location
-echo "Fetching games.json Internet Archive URL" >&2
-url=$(curl "${curl_args[@]}")
-
-# Use raw replay mode to avoid rewritten links in the JSON content
-url=$(
-  sed -E 's|^https://web\.archive\.org/web/([0-9]+)/|https://web.archive.org/web/\1id_/|' \
-    <<<"$url"
-)
-
-# The query parameters are only used in the snapshot request,
-# but remain in the redirected URL. Strip them:
-url="${url%%\?*}"
-
-current_url=$(
-  nix-instantiate --eval --raw \
-    --attr "$UPDATE_NIX_ATTR_PATH.gamesJson.url"
-)
-if [ "$current_url" = "$url" ]; then
-  echo "games.json has no changes" >&2
-  exit
-fi
-
-echo "Downloading and hashing games.json" >&2
-hash=$(
-  nix --extra-experimental-features nix-command \
-    hash convert --hash-algo sha256 --to sri \
-    "$(nix-prefetch-url "$url" --type sha256)"
-)
-
-# `update-source-version` needs the package version,
-# even though we're updating the games.json source
-package_version=$(
-  nix-instantiate --eval --raw \
-    --attr "$UPDATE_NIX_ATTR_PATH.version"
-)
-
-echo "Updating games.json source" >&2
-update-source-version \
-  "$UPDATE_NIX_ATTR_PATH" \
-  "$package_version" \
-  "$hash" \
-  "$url" \
-  --ignore-same-version \
-  --source-key=gamesJson \
-  --file="$dir"/package.nix
@@ -10,28 +10,15 @@ self=$(realpath "$0")
 dir=$(dirname "$self")
 cd "$dir"/../../../../

-current_version=$(
-  nix-instantiate --eval --raw \
-    --attr "$UPDATE_NIX_ATTR_PATH.version"
-)
+# Update vendored files
+"$dir"/vendored/update.sh
+
+# Update game_hashes_db
+UPDATE_NIX_ATTR_PATH="$UPDATE_NIX_ATTR_PATH.gameHashes" \
+  "$dir"/game-hashes/update.sh

 url=$(
  nix-instantiate --eval --raw \
    --attr "$UPDATE_NIX_ATTR_PATH.meta.homepage"
 )
-
 nix-update --url "$url"
-
-new_version=$(
-  nix-instantiate --eval --raw \
-    --attr "$UPDATE_NIX_ATTR_PATH.version"
-)
-
-if [ "$current_version" != "$new_version" ]; then
-  # Update games.json
-  "$dir"/update-games-json.sh
-
-  # Update game_hashes_db
-  UPDATE_NIX_ATTR_PATH="$UPDATE_NIX_ATTR_PATH.gameHashes" \
-    "$dir"/game-hashes/update.sh
-fi
@@ -0,0 +1,31 @@
+This directory contains a vendored copy of `games.json`, along with tooling to generate it.
+
+## Purpose
+
+The games data is fetched at runtime by NexusMods.App, however it is also included at build time for two reasons:
+
+1. It allows tests to run against real data.
+2. It is used as cached data, speeding up the app's initial run.
+
+It is not vital for the file to contain all games, however ideally it should contain all games _supported_ by this version of NexusMods.App.
+That way the initial run's cached data is more useful.
+
+If this file grows too large, because we are including too many games, we can patch the `csproj` build spec so that `games.json` is not used at build time.
+We would also need to patch or disable any tests that rely on it.
+
+## Generating
+
+`games.json` is generated automatically by `update.sh`, using data from [nexusmods' API][url] and the games listed in `game-ids.nix`.
+
+To add a new game to `games.json`:
+- Inspect the [nexusmods endpoint][url] to find the game's name and ID
+- Add the name and ID to `game-ids.nix`
+- Run `update.sh`
+- Commit the result
+
+> [!Note]
+> Running `update.sh` may also update the existing games, so you may wish to create two separate commits using `git add --patch`.
+> One for updating the existing data and another for adding the new game.
+
+[url]: https://data.nexusmods.com/file/nexus-data/games.json
+
@@ -0,0 +1,12 @@
+# This file lists games to be included in the vendored games.json file.
+# It is not critical to include all games, other than those referenced by the test suite.
+# Ideally, all games supported by the app will be included, as this can improve first-run performance.
+{
+  # keep-sorted start case=no numeric=yes
+  "Baldur's Gate 3" = 3474;
+  "Cyberpunk 2077" = 3333;
+  "Mount & Blade II: Bannerlord" = 3174;
+  "Skyrim Special Edition" = 1704;
+  "Stardew Valley" = 1303;
+  # keep-sorted end
+}
@@ -0,0 +1,72 @@
+[
+  {
+    "id": 1303,
+    "name": "Stardew Valley",
+    "name_lower": "stardew valley",
+    "forum_url": "https://forums.nexusmods.com/games/19-stardew-valley/",
+    "nexusmods_url": "https://www.nexusmods.com/stardewvalley",
+    "genre": "Simulation",
+    "file_count": 145440,
+    "downloads": 642501970,
+    "domain_name": "stardewvalley",
+    "approved_date": 1457432329,
+    "mods": 26417,
+    "collections": 1958
+  },
+  {
+    "id": 1704,
+    "name": "Skyrim Special Edition",
+    "name_lower": "skyrim special edition",
+    "forum_url": "https://forums.nexusmods.com/games/6-skyrim/",
+    "nexusmods_url": "https://www.nexusmods.com/skyrimspecialedition",
+    "genre": "RPG",
+    "file_count": 671705,
+    "downloads": 9497429062,
+    "domain_name": "skyrimspecialedition",
+    "approved_date": 1477480498,
+    "mods": 120722,
+    "collections": 4886
+  },
+  {
+    "id": 3174,
+    "name": "Mount & Blade II: Bannerlord",
+    "name_lower": "mount & blade ii: bannerlord",
+    "forum_url": "https://forums.nexusmods.com/games/9-mount-blade-ii-bannerlord/",
+    "nexusmods_url": "https://www.nexusmods.com/mountandblade2bannerlord",
+    "genre": "Strategy",
+    "file_count": 51310,
+    "downloads": 118459993,
+    "domain_name": "mountandblade2bannerlord",
+    "approved_date": 1582898627,
+    "mods": 6455,
+    "collections": 294
+  },
+  {
+    "id": 3333,
+    "name": "Cyberpunk 2077",
+    "name_lower": "cyberpunk 2077",
+    "forum_url": "https://forums.nexusmods.com/games/1-cyberpunk-2077/",
+    "nexusmods_url": "https://www.nexusmods.com/cyberpunk2077",
+    "genre": "Action",
+    "file_count": 127687,
+    "downloads": 981788054,
+    "domain_name": "cyberpunk2077",
+    "approved_date": 1607433331,
+    "mods": 18464,
+    "collections": 1613
+  },
+  {
+    "id": 3474,
+    "name": "Baldur's Gate 3",
+    "name_lower": "baldur's gate 3",
+    "forum_url": "https://forums.nexusmods.com/games/2-baldurs-gate-3/",
+    "nexusmods_url": "https://www.nexusmods.com/baldursgate3",
+    "genre": "RPG",
+    "file_count": 107598,
+    "downloads": 366648874,
+    "domain_name": "baldursgate3",
+    "approved_date": 1602863114,
+    "mods": 15345,
+    "collections": 1725
+  }
+]
@@ -0,0 +1,53 @@
+#!/usr/bin/env nix-shell
+#! nix-shell -i bash -p bash curl jq
+
+set -eu -o pipefail
+
+url='https://data.nexusmods.com/file/nexus-data/games.json'
+self=$(realpath "$0")
+dir=$(dirname "$self")
+tmp=$(mktemp)
+
+cd "$dir"/../../../../../
+
+ids=$(
+  nix-instantiate --eval --json \
+    --argstr file "$dir"/game-ids.nix \
+    --expr '{file}: builtins.attrValues (import file)'
+)
+
+echo "Fetching games data" >&2
+curl "$url" \
+  --silent \
+  --show-error \
+  --location |
+  jq --argjson ids "$ids" \
+    'map(select( .id | IN($ids[]) )) | sort_by(.id)' \
+    >"$tmp"
+
+echo "Validating result" >&2
+nix-instantiate --eval --strict \
+  --argstr idsNix "$dir"/game-ids.nix \
+  --argstr gamesJson "$tmp" \
+  --expr '
+    {
+      idsNix,
+      gamesJson,
+      lib ? import <nixpkgs/lib>,
+    }:
+    let
+      ids = import idsNix;
+      games = lib.importJSON gamesJson;
+    in
+    lib.forEach games (
+      { id, name, ... }:
+      lib.throwIfNot
+        (id == ids.${name})
+        "${name}: id ${toString id} does not match ${toString ids.${name}}"
+        null
+    )
+  ' \
+  >/dev/null
+
+echo "Installing games.json to $dir" >&2
+mv --force "$tmp" "$dir"/games.json
@@ -1,6 +1,7 @@
 {
  lib,
  buildGoModule,
+  callPackage,
  fetchFromGitHub,
  hwinfo,
  libusb1,
@@ -64,6 +65,8 @@ buildGoModule rec {

  passthru.tests = {
    inherit (nixosTests) facter;
+    debug-nvd = callPackage ./test-debug-nvd.nix { };
+    debug-nix-diff = nixosTests.facter.nodes.machine.hardware.facter.debug.nix-diff;
  };

  meta = {
@@ -0,0 +1,52 @@
+{
+  runCommand,
+  jq,
+  nix,
+  nixosTests,
+}:
+let
+  facterDebug = nixosTests.facter.nodes.machine.hardware.facter.debug;
+  withFacter = nixosTests.facter.nodes.machine.system.build.toplevel;
+  noFacter = nixosTests.facter.nodes.machine.system.build.noFacter.config.system.build.toplevel;
+in
+runCommand "facter-debug-nvd-test"
+  {
+    nativeBuildInputs = [
+      facterDebug.nvd
+      jq
+      nix
+    ];
+    __structuredAttrs = true;
+    unsafeDiscardReferences.out = true;
+    exportReferencesGraph.withFacter = [ withFacter ];
+    exportReferencesGraph.noFacter = [ noFacter ];
+  }
+  ''
+    # Set up nix environment with read-only store but writable state
+    mkdir -p "$TMPDIR/nix"/{var/nix,var/log/nix,etc}
+
+    export NIX_REMOTE=""
+    export NIX_STATE_DIR="$TMPDIR/nix/var/nix"
+    export NIX_LOG_DIR="$TMPDIR/nix/var/log/nix"
+    export NIX_CONF_DIR="$TMPDIR/nix/etc"
+    cat > "$TMPDIR/nix/etc/nix.conf" <<EOF
+    substituters =
+    sandbox = false
+    EOF
+
+    # Initialize store database and register paths from exportReferencesGraph
+    nix-store --init
+
+    # Convert exportReferencesGraph JSON to nix-store --load-db format
+    jq -r '(.withFacter + .noFacter)[] | "\(.path)\n\(.narHash)\n\(.narSize)\n\n\(.references | length)\(if .references | length > 0 then "\n" + (.references | join("\n")) else "" end)"' \
+      < "$NIX_ATTRS_JSON_FILE" | nix-store --load-db
+
+    # Run nvd and verify it produces output
+    facter-nvd-diff > nvd-output.txt
+    if [ ! -s nvd-output.txt ]; then
+      echo "facter-nvd-diff produced no output"
+      exit 1
+    fi
+    cat nvd-output.txt
+    echo "nvd debug utility works correctly" > $out
+  ''
@@ -11,18 +11,18 @@
 }:

 let
-  ocamlPackages = ocaml-ng.ocamlPackages_5_2;
+  ocamlPackages = ocaml-ng.ocamlPackages_5_3;
 in
 ocamlPackages.buildDunePackage {
  pname = "owi";
-  version = "0.2-unstable-2025-12-13";
+  version = "0.2-unstable-2025-12-22";

  src = fetchFromGitHub {
    owner = "ocamlpro";
    repo = "owi";
-    rev = "0ce0a3136bfeaca01bbf9c596d79c093282cff3f";
+    rev = "014840cd9d87c912577822b171407bf7453373f0";
    fetchSubmodules = true;
-    hash = "sha256-2WrUbrwi3dSXf/eEdZCK1SnYzo52aJeTfqtN65bjW60=";
+    hash = "sha256-Mjd2XyPmAsonCcV98L8p9S0yYlJV8OEg2TPjZhzVBj8=";
  };

  nativeBuildInputs = with ocamlPackages; [
@@ -42,15 +42,11 @@ ocamlPackages.buildDunePackage {
    bos
    cmdliner
    digestif
-    dolmen_type
    dune-build-info
    dune-site
-    hc
-    integers
    menhirLib
    ocaml_intrinsics
    ocamlgraph
-    patricia-tree
    prelude
    processor
    scfg
@@ -61,7 +57,6 @@ ocamlPackages.buildDunePackage {
    xmlm
    yojson
    z3
-    zarith
  ];

  postInstall = ''
@@ -88,7 +83,10 @@ ocamlPackages.buildDunePackage {
    homepage = "https://ocamlpro.github.io/owi/";
    downloadPage = "https://github.com/OCamlPro/owi";
    license = lib.licenses.agpl3Plus;
-    maintainers = [ lib.maintainers.ethancedwards8 ];
+    maintainers = with lib.maintainers; [
+      ethancedwards8
+      redianthus
+    ];
    teams = with lib.teams; [ ngi ];
    mainProgram = "owi";
    badPlatforms = lib.platforms.darwin;
@@ -1,47 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  scsh,
-  sox,
-  libnotify,
-}:
-
-stdenv.mkDerivation {
-  pname = "pell";
-  version = "0.0.4";
-
-  src = fetchFromGitHub {
-    owner = "ebzzry";
-    repo = "pell";
-    rev = "3b8a9a59c4a8671705805edb7be7c35b1654971f";
-    sha256 = "0k8m1lv2kyrs8fylxmbgxg3jn65g57frf2bndc82gkr5svwb554a";
-  };
-
-  installPhase = ''
-    mkdir -p $out/bin
-    mkdir -p $out/share
-    cp pell $out/bin
-    cp resources/online.mp3 $out/share
-    cp resources/offline.mp3 $out/share
-    chmod +x $out/bin/pell
-  '';
-
-  postFixup = ''
-    substituteInPlace $out/bin/pell --replace "/usr/bin/env scsh" "${scsh}/bin/scsh"
-    substituteInPlace $out/bin/pell --replace "(play " "(${sox}/bin/play "
-    substituteInPlace $out/bin/pell --replace "(notify-send " "(${libnotify}/bin/notify-send "
-    substituteInPlace $out/bin/pell --replace "/usr/share/pell/online.mp3" "$out/share/online.mp3"
-    substituteInPlace $out/bin/pell --replace "/usr/share/pell/offline.mp3" "$out/share/offline.mp3"
-  '';
-
-  meta = {
-    homepage = "https://github.com/ebzzry/pell";
-    description = "Simple host availability monitor";
-    license = lib.licenses.mit;
-    platforms = lib.platforms.unix;
-    mainProgram = "pell";
-  };
-
-  dontBuild = true;
-}
@@ -48,7 +48,7 @@ stdenv.mkDerivation rec {

  # fetching a .deb because there's no easy way to package this Electron app
  src = fetchurl {
-    url = "https://github.com/burtonator/polar-bookshelf/releases/download/v${version}/polar-desktop-app-${version}-amd64.deb";
+    url = "mirror://sourceforge/polar-bookshelf.mirror/v${version}/polar-desktop-app-${version}-amd64.deb";
    hash = "sha256-jcq0hW698bAhVM3fLQQeKAnld33XLkHsGjS3QwUpciQ=";
  };

@@ -42,11 +42,11 @@

 stdenv.mkDerivation rec {
  pname = "polar-bookshelf1";
-  version = "1.100.14";
+  version = "1.100.13";

  src = fetchurl {
-    url = "https://github.com/burtonator/polar-bookshelf/releases/download/v${version}/polar-bookshelf-${version}-amd64.deb";
-    hash = "sha256-5xa+Nwu0p1x5DLn1GNI0HDt7GtBGoFQ/9qGTeq9uBgU=";
+    url = "mirror://sourceforge/polar-bookshelf.mirror/v${version}/polar-bookshelf-${version}-amd64.deb";
+    hash = "sha256-TeegAq3x8LZ01KEPIlP4lTGC0a9ilnf1xX/Dqci1wEQ=";
  };

  buildInputs = [
@@ -1,22 +1,22 @@
 {
-  fetchFromGitHub,
  bashInteractive,
  jq,
  makeWrapper,
  p7zip,
  lib,
  stdenv,
+  fetchzip,
 }:

 stdenv.mkDerivation rec {
  pname = "r2mod_cli";
-  version = "1.3.3.1";
+  version = "1.3.3";

-  src = fetchFromGitHub {
-    owner = "Foldex";
-    repo = "r2mod_cli";
-    rev = "v${version}";
-    sha256 = "sha256-Y9ZffztxfGYiUSphqwhe3rTbnJ/vmGGi1pLml+1tLP8=";
+  src = fetchzip {
+    url = "https://thunderstore.io/package/download/Foldex/r2mod_cli/${version}/";
+    hash = "sha256-J7ybNZa44/H+AjQ7L949I3iClXoDwinl/ITMK/QsTR0=";
+    extension = "zip";
+    stripRoot = false;
  };

  buildInputs = [ bashInteractive ];
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {

  meta = {
    description = "Risk of Rain 2 Mod Manager in Bash";
-    homepage = "https://github.com/foldex/r2mod_cli";
+    homepage = "https://thunderstore.io/package/Foldex/r2mod_cli";
    license = lib.licenses.gpl3Only;
    maintainers = [ lib.maintainers.reedrw ];
    mainProgram = "r2mod";
@@ -20,13 +20,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "rpi-imager";
-  version = "2.0.0";
+  version = "2.0.2";

  src = fetchFromGitHub {
    owner = "raspberrypi";
    repo = "rpi-imager";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-33txlTRRzA1XxuKgWgz1lNIfzIMrPny6wGFHaecy7FY=";
+    hash = "sha256-dfzWVmRthoLzI//jfeY6P1W/sfT0cNjhp5EiNQQy8zA=";
  };

  patches = [ ./remove-vendoring.patch ];
@@ -3,6 +3,9 @@
  lib,
  makeWrapper,
  writeTextFile,
+  copyDesktopItems,
+  makeDesktopItem,
+  imagemagick,

  curl,
  hexdump,
@@ -48,7 +51,11 @@ stdenv.mkDerivation (finalAttrs: {

  patches = [ ./no-update-check.patch ];

-  nativeBuildInputs = [ makeWrapper ];
+  nativeBuildInputs = [
+    makeWrapper
+    copyDesktopItems
+    imagemagick
+  ];

  buildInputs = [
    curl
@@ -60,6 +67,17 @@ stdenv.mkDerivation (finalAttrs: {
    libGL
  ];

+  icon = "${finalAttrs.src}/res/icon.ico";
+  desktopItems = [
+    (makeDesktopItem {
+      name = finalAttrs.pname;
+      desktopName = "Super Mario 64 Coop Deluxe";
+      exec = "sm64coopdx";
+      icon = finalAttrs.pname;
+      categories = [ "Game" ];
+    })
+  ];
+
  enableParallelBuilding = true;

  makeFlags = [
@@ -92,6 +110,12 @@ stdenv.mkDerivation (finalAttrs: {
      cp $built/libdiscord_game_sdk* $share
    ''}

+    magick ${finalAttrs.icon} icon.png
+    for size in 16 24 32 48 64 128 256 512; do
+      mkdir -p $out/share/icons/hicolor/"$size"x"$size"/apps
+      magick icon-0.png -resize "$size"x"$size" $out/share/icons/hicolor/"$size"x"$size"/apps/${finalAttrs.pname}.png
+    done
+
    # coopdx always tries to load resources from the binary's directory, with no obvious way to change. Thus this small wrapper script to always run from the /share directory that has all the resources
    mkdir -p $out/bin
    makeWrapper $share/sm64coopdx $out/bin/sm64coopdx \
@@ -38,13 +38,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "strawberry";
-  version = "1.2.13";
+  version = "1.2.16";

  src = fetchFromGitHub {
    owner = "jonaski";
    repo = "strawberry";
    rev = finalAttrs.finalPackage.version;
-    hash = "sha256-0peM1d8ks4yYwK9+3bUf713MjEzI25TSexyFIP/r3b0=";
+    hash = "sha256-4V/geww/M0FD3McBuz8MgkwdXA7j+d71SJn5Q4AZrvU=";
  };

  # the big strawberry shown in the context menu is *very* much in your face, so use the grey version instead
@@ -9,13 +9,13 @@
 }:
 stdenv.mkDerivation (self: {
  pname = "strobealign";
-  version = "0.16.1";
+  version = "0.17.0";

  src = fetchFromGitHub {
    owner = "ksahlin";
    repo = "strobealign";
    tag = "v${self.version}";
-    hash = "sha256-RZxIT6iwanRuPk2sWv/QRkUaPMdterOKCo30FPZHC8o=";
+    hash = "sha256-ah21ptyfZbgdJrtCCftYhGh1hfcJ9JpXNsXUp8pZDJw=";
  };

  nativeBuildInputs = [
@@ -8,16 +8,16 @@

 buildGoModule rec {
  pname = "trufflehog";
-  version = "3.92.3";
+  version = "3.92.4";

  src = fetchFromGitHub {
    owner = "trufflesecurity";
    repo = "trufflehog";
    tag = "v${version}";
-    hash = "sha256-vSJncJzHxiZqDG0BQrLUjU7mFvZ6PnoE2FkITRvKmes=";
+    hash = "sha256-fV1PO8e4ezU4Nzhfqc1vCLH9ex0eEaQyQkrwGpRK4vc=";
  };

-  vendorHash = "sha256-Qz0tKqqT3PlZFCiYxLBmHeICIx2ogOUW7rfXHadcVPg=";
+  vendorHash = "sha256-98yTB5Wu2W2xesg9NMPv+Yij/stutRSP98MeTf807Jo=";

  nativeBuildInputs = [ makeWrapper ];

@@ -30,19 +30,19 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "typesetter";
-  version = "0.8.2";
+  version = "0.8.3";

  src = fetchFromGitea {
    domain = "codeberg.org";
    owner = "haydn";
    repo = "typesetter";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-ialZTGhzLGLybOSP+cBsV4GzftVzEMYZEoRlAbBQRvY=";
+    hash = "sha256-IJK5ZqrQ7I85d5ULJ9TW61gQ5G0E4XRwPn93i6Sk+OU=";
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
    inherit (finalAttrs) pname version src;
-    hash = "sha256-ohcJds29nDZ/OYb3L7n7QVkXuX32P8ExbtwEvgVoLag=";
+    hash = "sha256-rqcJuDyuw/kpXp4MIboKLWmHvV7AtdH/Qrv9Phcvhjs=";
  };

  strictDeps = true;
@@ -1,40 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  scsh,
-  rsync,
-  unison,
-}:
-
-stdenv.mkDerivation {
-  pname = "usync";
-  version = "0.0.3";
-
-  src = fetchFromGitHub {
-    owner = "ebzzry";
-    repo = "usync";
-    rev = "99f11b0c196a81843f55ca3456abcb85149b6d51";
-    sha256 = "16i1q8f0jmfd43rb8d70l2b383vr5ib4kh7iq3yd345q7xjz9c2j";
-  };
-
-  installPhase = ''
-    install -m 555 -Dt $out/bin $pname
-  '';
-
-  postFixup = ''
-    substituteInPlace $out/bin/$pname --replace "/usr/bin/env scsh" "${scsh}/bin/scsh"
-    substituteInPlace $out/bin/$pname --replace "(rsync " "(${rsync}/bin/rsync "
-    substituteInPlace $out/bin/$pname --replace "(unison " "(${unison}/bin/unison "
-  '';
-
-  meta = {
-    homepage = "https://github.com/ebzzry/usync";
-    description = "Simple site-to-site synchronization tool";
-    license = lib.licenses.mit;
-    platforms = lib.platforms.unix;
-    mainProgram = "usync";
-  };
-
-  dontBuild = true;
-}
@@ -5,6 +5,7 @@
  coreutils,
  fetchFromGitHub,
  fetchNpmDeps,
+  glaze,
  kdePackages,
  lib,
  libqalculate,
@@ -21,13 +22,13 @@
 }:
 gcc15Stdenv.mkDerivation (finalAttrs: {
  pname = "vicinae";
-  version = "0.16.14";
+  version = "0.17.1";

  src = fetchFromGitHub {
    owner = "vicinaehq";
    repo = "vicinae";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-G9zuw0IuzOxCeAcLE+IXcsdp0vAGMXBBdlfjBISnL90=";
+    hash = "sha256-xKEfWYf3gJ5wEYd8krT5w70rr0QYEu+7rqJ/IZmCHeQ=";
  };

  apiDeps = fetchNpmDeps {
@@ -44,6 +45,7 @@ gcc15Stdenv.mkDerivation (finalAttrs: {
    "VICINAE_GIT_TAG" = "v${finalAttrs.version}";
    "VICINAE_PROVENANCE" = "nix";
    "INSTALL_NODE_MODULES" = "OFF";
+    "USE_SYSTEM_GLAZE" = "ON";
    "CMAKE_INSTALL_PREFIX" = placeholder "out";
    "CMAKE_INSTALL_DATAROOTDIR" = "share";
    "CMAKE_INSTALL_BINDIR" = "bin";
@@ -64,6 +66,7 @@ gcc15Stdenv.mkDerivation (finalAttrs: {
  buildInputs = [
    abseil-cpp
    cmark-gfm
+    glaze
    kdePackages.layer-shell-qt
    kdePackages.qtkeychain
    libqalculate
@@ -8,16 +8,16 @@

 buildGoModule (finalAttrs: {
  pname = "wazero";
-  version = "1.10.1";
+  version = "1.11.0";

  src = fetchFromGitHub {
    owner = "tetratelabs";
    repo = "wazero";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-VCbXPD34QXpcIdGL/vxD9d/+vmZXkZ5fCePktWZy6fM=";
+    hash = "sha256-FYaWh1zfNcgtQ5S0flk0y6ehP4ZzCwIA+SZgLnha95U=";
  };

-  vendorHash = null;
+  vendorHash = "sha256-5jAwOu4F3DLVKhnEfEs/IvKwfan7hv65d8OY7gcawNo=";

  subPackages = [
    "cmd/wazero"
@@ -17,7 +17,7 @@
 }:

 let
-  rev = "1.2.1";
+  rev = "1.3.0";
 in
 buildDotnetModule rec {
  pname = "XIVLauncher";
@@ -27,7 +27,7 @@ buildDotnetModule rec {
    owner = "goatcorp";
    repo = "XIVLauncher.Core";
    inherit rev;
-    hash = "sha256-bGHUDPUrohcc/lLE647cicaEIYo9t1/anc2VeMJlsGc=";
+    hash = "sha256-tPziHwHK4B+LJ8xNWEBmpFStkczZF3G5jhjxYYG59m0=";
    fetchSubmodules = true;
  };

@@ -49,8 +49,8 @@ buildDotnetModule rec {
  nugetDeps = ./deps.json; # File generated with `nix-build -A xivlauncher.passthru.fetch-deps`

  # please do not unpin these even if they match the defaults, xivlauncher is sensitive to .NET versions
-  dotnet-sdk = dotnetCorePackages.sdk_8_0;
-  dotnet-runtime = dotnetCorePackages.runtime_8_0;
+  dotnet-sdk = dotnetCorePackages.sdk_9_0;
+  dotnet-runtime = dotnetCorePackages.runtime_9_0;

  dotnetFlags = [
    "-p:BuildHash=${rev}"
@@ -0,0 +1,4 @@
+import ./common-hadrian.nix {
+  version = "9.14.1";
+  sha256 = "2a83779c9af86554a3289f2787a38d6aa83d00d136aa9f920361dd693c101e77";
+}
@@ -87,7 +87,7 @@ openjdk17.overrideAttrs (oldAttrs: rec {
        -i jb/project/tools/linux/scripts/mkimages_${arch}.sh

    patchShebangs .
-    ./jb/project/tools/linux/scripts/mkimages_${arch}.sh ${build} ${
+    ./jb/project/tools/linux/scripts/mkimages_${arch}.sh -w ${build} ${
      if debugBuild then "fd" else (if withJcef then "jcef" else "nomod")
    }

@@ -1,4 +1,5 @@
 {
+  autoPatchelfHook,
  fetchFromGitHub,
  fetchurl,
  fetchpatch,
@@ -18,6 +19,7 @@

  nss,
  nspr,
+  libGL,
  libX11,
  libXdamage,
  boost,
@@ -89,11 +91,11 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "jcef-jetbrains";
-  rev = "bb9fb310ed7f3abf858faf248c53bbb707be21f7";
+  rev = "6f9ab690b28a1262f82e6f869c310bdf1d0697ac";
  # This is the commit number
  # Currently from the branch: https://github.com/JetBrains/jcef/tree/251
  # Run `git rev-list --count HEAD`
-  version = "1083";
+  version = "1086";

  nativeBuildInputs = [
    cmake
@@ -105,9 +107,11 @@ stdenv.mkDerivation rec {
    ninja
    strip-nondeterminism
    stripJavaArchivesHook
+    autoPatchelfHook
  ];
  buildInputs = [
    boost
+    libGL
    libX11
    libXdamage
    nss
@@ -119,7 +123,7 @@ stdenv.mkDerivation rec {
    owner = "jetbrains";
    repo = "jcef";
    inherit rev;
-    hash = "sha256-BHmGEhfkrUWDfrUFR8d5AgIq8qkAr+blX9n7ZVg8mtc=";
+    hash = "sha256-w5t1M66KW5cUbNTpAc4ksGd+414EJsXwbq1UP1COFsw=";
  };

  # Find the hash in tools/buildtools/linux64/clang-format.sha1
@@ -164,7 +168,6 @@ stdenv.mkDerivation rec {

  outputs = [
    "out"
-    "unpacked"
  ];

  postBuild = ''
@@ -172,14 +175,12 @@ stdenv.mkDerivation rec {
    ../tools/compile.sh ${platform} Release
  '';

-  # N.B. For new versions, manually synchronize the following
-  # definitions with jb/tools/common/create_modules.sh to include
-  # newly added modules
  installPhase = ''
    runHook preInstall

    export JCEF_ROOT_DIR=$(realpath ..)
    export OUT_NATIVE_DIR=$JCEF_ROOT_DIR/jcef_build/native/${buildType}
+    export OUT_REMOTE_DIR=$JCEF_ROOT_DIR/jcef_build/remote/${buildType}
    export JB_TOOLS_DIR=$(realpath ../jb/tools)
    export JB_TOOLS_OS_DIR=$JB_TOOLS_DIR/linux
    export OUT_CLS_DIR=$(realpath ../out/${platform})
@@ -187,80 +188,21 @@ stdenv.mkDerivation rec {
    export OS=linux
    export JOGAMP_DIR="$JCEF_ROOT_DIR"/third_party/jogamp/jar

-    mkdir -p $unpacked/{jogl,gluegen,jcef}
+    bash "$JB_TOOLS_DIR"/common/create_modules.sh

-    function extract_jar {
-      __jar=$1
-      __dst_dir=$2
-      __content_dir="''${3:-.}"
-      __tmp=.tmp_extract_jar
-      rm -rf "$__tmp" && mkdir "$__tmp"
-      (
-        cd "$__tmp" || exit 1
-        jar -xf "$__jar"
-      )
-      rm -rf "$__tmp/META-INF"
-      rm -rf "$__dst_dir" && mkdir "$__dst_dir"
-      if [ -z "$__content_dir" ]
-      then
-          cp -R "$__tmp"/* "$__dst_dir"
-      else
-          cp -R "$__tmp"/"$__content_dir"/* "$__dst_dir"
-      fi
-      rm -rf $__tmp
-    }
-
-    cd $unpacked/gluegen
-    cp "$JOGAMP_DIR"/gluegen-rt.jar .
-    cp "$JB_TOOLS_DIR"/common/gluegen-module-info.java module-info.java
-    javac --patch-module gluegen.rt=gluegen-rt.jar module-info.java
-    jar uf gluegen-rt.jar module-info.class
-    rm module-info.class module-info.java
-    mkdir lib
-  ''
-  # see https://github.com/JetBrains/jcef/commit/f3b787e3326c1915d663abded7f055c0866f32ec
-  + lib.optionalString (platform != "linuxarm64") ''
-    extract_jar "$JOGAMP_DIR"/gluegen-rt-natives-"$OS"-"$DEPS_ARCH".jar lib natives/"$OS"-"$DEPS_ARCH"
-  ''
-  + ''
-
-    cd ../jogl
-    cp "$JOGAMP_DIR"/gluegen-rt.jar .
-    cp "$JOGAMP_DIR"/jogl-all.jar .
-    cp "$JB_TOOLS_OS_DIR"/jogl-module-info.java module-info.java
-    javac --module-path . --patch-module jogl.all=jogl-all.jar module-info.java
-    jar uf jogl-all.jar module-info.class
-    rm module-info.class module-info.java
-    mkdir lib
-  ''
-  # see https://github.com/JetBrains/jcef/commit/f3b787e3326c1915d663abded7f055c0866f32ec
-  + lib.optionalString (platform != "linuxarm64") ''
-    extract_jar "$JOGAMP_DIR"/jogl-all-natives-"$OS"-"$DEPS_ARCH".jar lib natives/"$OS"-"$DEPS_ARCH"
-  ''
-  + ''
-
-    cd ../jcef
-    cp "$OUT_CLS_DIR"/jcef.jar .
-    mkdir lib
-    cp -R "$OUT_NATIVE_DIR"/* lib
-
-    mkdir -p $out/jmods
+    mkdir -p $out

    bash "$JB_TOOLS_DIR"/common/create_version_file.sh $out

+    cp -r $JCEF_ROOT_DIR/jmods/ $out
+    cp -r $JCEF_ROOT_DIR/cef_server/ $out
+
    runHook postInstall
  '';

  dontStrip = debugBuild;

  postFixup = ''
-    cd $unpacked/gluegen
-    jmod create --class-path gluegen-rt.jar --libs lib $out/jmods/gluegen.rt.jmod
-    cd ../jogl
-    jmod create --module-path . --class-path jogl-all.jar --libs lib $out/jmods/jogl.all.jmod
-    cd ../jcef
-    jmod create --module-path . --class-path jcef.jar --libs lib $out/jmods/jcef.jmod
-
    # stripJavaArchivesHook gets rid of jar file timestamps, but not of jmod file timestamps
    # We have to manually call strip-nondeterminism to do this for jmod files too
    find $out -name "*.jmod" -exec strip-nondeterminism --type jmod {} +
@@ -274,5 +216,8 @@ stdenv.mkDerivation rec {
      "aarch64-linux"
      "x86_64-linux"
    ];
+    maintainers = with lib.maintainers; [
+      aoli-al
+    ];
  };
 }
@@ -0,0 +1,90 @@
+{ pkgs, haskellLib }:
+
+self: super:
+
+let
+  inherit (pkgs) lib;
+
+  warnAfterVersion =
+    ver: pkg:
+    lib.warnIf (lib.versionOlder ver
+      super.${pkg.pname}.version
+    ) "override for haskell.packages.ghc912.${pkg.pname} may no longer be needed" pkg;
+
+in
+
+with haskellLib;
+
+{
+  # Disable GHC core libraries
+  array = null;
+  base = null;
+  binary = null;
+  bytestring = null;
+  Cabal = null;
+  Cabal-syntax = null;
+  containers = null;
+  deepseq = null;
+  directory = null;
+  exceptions = null;
+  file-io = null;
+  filepath = null;
+  ghc-bignum = null;
+  ghc-boot = null;
+  ghc-boot-th = null;
+  ghc-compact = null;
+  ghc-experimental = null;
+  ghc-heap = null;
+  ghc-internal = null;
+  ghc-platform = null;
+  ghc-prim = null;
+  ghc-toolchain = null;
+  ghci = null;
+  haddock-api = null;
+  haddock-library = null;
+  haskeline = null;
+  hpc = null;
+  integer-gmp = null;
+  mtl = null;
+  os-string = null;
+  parsec = null;
+  pretty = null;
+  process = null;
+  rts = null;
+  semaphore-compat = null;
+  stm = null;
+  system-cxx-std-lib = null;
+  template-haskell = null;
+  template-haskell-lift = null;
+  template-haskell-quasiquoter = null;
+  # GHC only builds terminfo if it is a native compiler
+  terminfo =
+    if pkgs.stdenv.hostPlatform == pkgs.stdenv.buildPlatform then
+      null
+    else
+      haskellLib.doDistribute self.terminfo_0_4_1_7;
+  text = null;
+  time = null;
+  transformers = null;
+  unix = null;
+  xhtml = null;
+  Win32 = null;
+
+  #
+  # Version upgrades
+  #
+
+  #
+  # Jailbreaks
+  #
+
+  primitive = doJailbreak (dontCheck super.primitive); # base <4.22 and a lot of dependencies on packages not yet working.
+  splitmix = doJailbreak super.splitmix; # base <4.22
+
+  # https://github.com/sjakobi/newtype-generics/pull/28/files
+  newtype-generics = warnAfterVersion "0.6.2" (doJailbreak super.newtype-generics);
+
+  #
+  # Test suite issues
+  #
+}
@@ -409,9 +409,9 @@ in
    cargoHash = "sha256-5Tp8Kth0yO89/LIcU8K01z6DdZRr8MAA0DPKqDEjIt0=";
  };

-  ruby_3_5 = generic {
-    version = rubyVersion "3" "5" "0" "preview1";
-    hash = "sha256-7PCcfrkC6Rza+cxVPNAMypuEiz/A4UKXhQ+asIzdRvA=";
+  ruby_4_0 = generic {
+    version = rubyVersion "4" "0" "0" "preview3";
+    hash = "sha256-Q9CSbndvvVWZrcx7zLTMyAThCfQCogaGB6KoZWLCzcA=";
    cargoHash = "sha256-z7NwWc4TaR042hNx0xgRkh/BQEpEJtE53cfrN0qNiE0=";
  };

@@ -17,13 +17,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "qodeassist-plugin";
-  version = "0.9.4";
+  version = "0.9.7";

  src = fetchFromGitHub {
    owner = "Palm1r";
    repo = "QodeAssist";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-n+MDFJbFl/miVt8qm90PNOQE2QWc0kGgRfaQMu9MPA4=";
+    hash = "sha256-aS2ZA5rFSxIpc4RfVIyWbae/nQa2lBkQQJacGQdC8kI=";
  };

  dontWrapQtApps = true;
@@ -16,7 +16,6 @@
  mtime,
  # fix eval on legacy ocaml versions
  ocaml_intrinsics ? null,
-  patricia-tree,
  prelude,
  scfg,
  yojson,
@@ -28,13 +27,13 @@

 buildDunePackage (finalAttrs: {
  pname = "smtml";
-  version = "0.15.0";
+  version = "0.17.0";

  src = fetchFromGitHub {
    owner = "formalsec";
    repo = "smtml";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-z3DDdzU39tg2F3+pAFPILiKY3pQxOpehdoxwckyhZBI=";
+    hash = "sha256-IFjaZcwBiM/xA39W+FuJ87OSEvAhvhEsZ1cF2KrxrhY=";
  };

  nativeBuildInputs = [
@@ -52,7 +51,6 @@ buildDunePackage (finalAttrs: {
    menhirLib
    mtime
    ocaml_intrinsics
-    patricia-tree
    prelude
    scfg
    yojson
@@ -82,6 +80,9 @@ buildDunePackage (finalAttrs: {
    downloadPage = "https://github.com/formalsec/smtml";
    changelog = "https://github.com/formalsec/smtml/releases/tag/v${finalAttrs.version}";
    license = lib.licenses.mit;
-    maintainers = [ lib.maintainers.ethancedwards8 ];
+    maintainers = with lib.maintainers; [
+      ethancedwards8
+      redianthus
+    ];
  };
 })
@@ -3,30 +3,35 @@
  fetchFromGitHub,
  buildDunePackage,
  prelude,
+  alcotest,
 }:

-buildDunePackage rec {
+buildDunePackage (finalAttrs: {
  pname = "synchronizer";
-  version = "0.1";
+  version = "0.2";

  minimalOCamlVersion = "5.1";

  src = fetchFromGitHub {
    owner = "OCamlPro";
    repo = "synchronizer";
-    tag = version;
-    hash = "sha256-VlKqORXTXafT88GXHIYkz+A1VkEL3jP9SMqDdMyEdrw=";
+    tag = "${finalAttrs.version}";
+    hash = "sha256-0XtPHpDlyH1h8W2ZlRvJbZjCN9WP5mzk2N01WFd8eLQ=";
  };

  propagatedBuildInputs = [
    prelude
  ];

+  checkInputs = [
+    alcotest
+  ];
+
  meta = {
    homepage = "https://github.com/OCamlPro/synchronizer";
    description = "Synchronizer to make datastructures thread-safe";
-    changelog = "https://raw.githubusercontent.com/OCamlPro/synchronizer/${src.rev}/CHANGES.md";
+    changelog = "https://raw.githubusercontent.com/OCamlPro/synchronizer/${finalAttrs.src.rev}/CHANGES.md";
    license = lib.licenses.agpl3Plus;
    maintainers = with lib.maintainers; [ redianthus ];
  };
-}
+})
@@ -18,7 +18,7 @@ let
    owner = "percona";
    repo = "percona-toolkit";
    rev = "v${version}";
-    sha256 = "sha256-fJGeL9XZHTFmpns5CE7It35HRnF3JiC6muOpOS1zboI=";
+    sha256 = "sha256-NpLUHIdGnuNJmSYBYErU7yzFkxKRFQVWJHJqJ2q4U5E=";

    # needed for build script
    leaveDotGit = true;
@@ -24,13 +24,13 @@

 buildPythonPackage rec {
  pname = "bilibili-api-python";
-  version = "17.4.0";
+  version = "17.4.1";
  pyproject = true;

  src = fetchPypi {
    pname = "bilibili_api_python";
    inherit version;
-    hash = "sha256-OWMQwYIP2TGkahDGEVIzviUOjbMVombupgjA9iXN8e8=";
+    hash = "sha256-Ww8WRoz7s+6AHH18yXD5CCJS9nWMbYxIxdjaxCI1y2I=";
  };

  # The upstream uses requirements.txt, which overly strict version constraints.
@@ -28,7 +28,7 @@
 buildPythonPackage rec {
  __structuredAttrs = true;
  pname = "conda";
-  version = "25.7.0";
+  version = "25.11.1";
  pyproject = true;

  src = fetchFromGitHub {
@@ -36,7 +36,7 @@ buildPythonPackage rec {
    owner = "conda";
    repo = "conda";
    tag = version;
-    hash = "sha256-lvqR1ksYE23enSf4pxFpb/Z8yPoU9bVb4Hi2ZrhI0XA=";
+    hash = "sha256-Jp7C7rwgzVGjNBRwViyDIBom67VevYG5e46/wpAWJX4=";
  };

  build-system = [
@@ -8,14 +8,14 @@

 buildPythonPackage rec {
  pname = "dbt-protos";
-  version = "1.0.380";
+  version = "1.0.412";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "dbt-labs";
    repo = "proto-python-public";
    tag = "v${version}";
-    hash = "sha256-gXaIIcxIKnUe4Pz5CidfWtM3iofUizJ+lXWNcTzL2pY=";
+    hash = "sha256-Q9Pki95OaQKpBJn423/2DBLXHUWjpgOqTpJX3ASeXKs=";
  };

  build-system = [
@@ -1,18 +1,23 @@
 {
  lib,
  buildPythonPackage,
+  fetchFromGitHub,
+
+  # build-system
+  setuptools,
+
+  # dependencies
  celery,
  cron-descriptor,
  django-timezone-field,
+  python-crontab,
+  tzdata,
+
+  # tests
  ephem,
-  fetchFromGitHub,
  pytest-django,
  pytest-timeout,
  pytestCheckHook,
-  python-crontab,
-  pythonOlder,
-  setuptools,
-  tzdata,
 }:

 buildPythonPackage rec {
@@ -20,8 +25,6 @@ buildPythonPackage rec {
  version = "2.8.1";
  pyproject = true;

-  disabled = pythonOlder "3.8";
-
  src = fetchFromGitHub {
    owner = "celery";
    repo = "django-celery-beat";
@@ -34,17 +37,17 @@ buildPythonPackage rec {
  build-system = [ setuptools ];

  dependencies = [
-    cron-descriptor
-    python-crontab
    celery
+    cron-descriptor
    django-timezone-field
+    python-crontab
    tzdata
  ];

  nativeCheckInputs = [
    ephem
-    pytest-timeout
    pytest-django
+    pytest-timeout
    pytestCheckHook
  ];

@@ -53,6 +56,11 @@ buildPythonPackage rec {
    "t/unit/test_schedulers.py"
  ];

+  disabledTests = [
+    # AssertionError: 'At 02:00, only on Monday UTC' != 'At 02:00 AM, only on Monday UTC'
+    "test_long_name"
+  ];
+
  pythonImportsCheck = [ "django_celery_beat" ];

  meta = {
@@ -18,7 +18,8 @@ buildPythonPackage rec {

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-r0SCigkUpOiba4MDf80+dLjOjjruVNILh/raWfvjXA0=";
+    extension = "zip";
+    hash = "sha256-+IN+0P4SljUWxF01Ln9PgeFVA/+qGKFVoKMGluAuYDw=";
  };

  nativeBuildInputs = [ setuptools ];
@@ -9,14 +9,14 @@

 buildPythonPackage rec {
  pname = "intbitset";
-  version = "4.0.0";
+  version = "4.1.0";
  pyproject = true;

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-wUHtqhwXuRwph1N+Jp2VWra9w5Zq89624eDSDtvQndI=";
+    hash = "sha256-cxRf8F5CJ8dlhf+FUGOLagg80TABC3gQRdga9Y97aSA=";
  };

  build-system = [ setuptools ];
@@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "medvol";
-  version = "0.0.16";
+  version = "0.0.17";
  pyproject = true;

  disabled = pythonOlder "3.8";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
    owner = "MIC-DKFZ";
    repo = "medvol";
    rev = "v${version}";
-    hash = "sha256-MMYBPyXXS6hTehyWUcvQso9HBLhWMGWzRDGSTtT1iZc=";
+    hash = "sha256-AuVTJvKalRXf/ObxXFk0aBVkqRffo4Ph5/LJ2vDK1nU=";
  };

  build-system = [ setuptools ];
@@ -13,14 +13,14 @@

 buildPythonPackage rec {
  pname = "nuclear";
-  version = "2.6.1";
+  version = "2.7.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "igrek51";
    repo = "nuclear";
    rev = version;
-    hash = "sha256-63BYwfLWUDN18AOAUjDPG/QLM1RBqsBs54oTDq1lKrk=";
+    hash = "sha256-xKsYS+v/7xm9LRdpFKMsbrPggw4VfVMWst/3olj2n3E=";
  };

  build-system = [ setuptools ];
@@ -56,7 +56,9 @@ buildPythonPackage rec {
    python-dateutil
    tzdata
  ]
-  ++ lib.optional (!isPyPy) [ time-machine ]
+  ++ lib.optionals (!isPyPy) [
+    time-machine
+  ]
  ++ lib.optionals (pythonOlder "3.9") [
    importlib-resources
  ];
@@ -11,12 +11,12 @@

 buildPythonPackage rec {
  pname = "publicsuffixlist";
-  version = "1.0.2.20251217";
+  version = "1.0.2.20251222";
  pyproject = true;

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-9ejbvyQMukwcXUJv79coU2L7YEe8fA393cyBC6S2QCo=";
+    hash = "sha256-AH9okvxG0VBeh6tM1BStIKyWhd1OjfiNmVlX8s8sykU=";
  };

  postPatch = ''
@@ -1,7 +1,7 @@
 {
  lib,
  buildPythonPackage,
-  fetchFromBitbucket,
+  fetchFromGitHub,
  h5py,
  termcolor,
  pexpect,
@@ -15,7 +15,7 @@ buildPythonPackage {
  version = "0.5.3";
  format = "setuptools";

-  src = fetchFromBitbucket {
+  src = fetchFromGitHub {
    owner = "dtrypogeorgos";
    repo = "pylion";
    # Version is set in setup.cfg, but not in a git tag / bitbucket release
@@ -49,7 +49,7 @@ buildPythonPackage {

  meta = {
    description = "LAMMPS wrapper for molecular dynamics simulations of trapped ions";
-    homepage = "https://bitbucket.org/dtrypogeorgos/pylion";
+    homepage = "https://github.com/dtrypogeorgos/pylion";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ doronbehar ];
  };
@@ -7,7 +7,7 @@
  pythonOlder,
 }:

-buildPythonPackage {
+buildPythonPackage rec {
  pname = "pyls-flake8";
  version = "0.4.0";
  format = "setuptools";
@@ -16,7 +16,7 @@ buildPythonPackage {
  src = fetchFromGitHub {
    owner = "emanspeaks";
    repo = "pyls-flake8";
-    rev = "v{version}";
+    rev = "v${version}";
    sha256 = "14wkmwh8mqr826vdzxhvhdwrnx2akzmnbv3ar391qs4imwqfjx3l";
  };

@@ -74,7 +74,7 @@

 let
  pname = "ray";
-  version = "2.52.1";
+  version = "2.53.0";
 in
 buildPythonPackage rec {
  inherit pname version;
@@ -94,22 +94,22 @@ buildPythonPackage rec {
      # Results are in ./ray-hashes.nix
      hashes = {
        x86_64-linux = {
-          cp310 = "sha256-s/nmG3mfs8yP1wd6PS62dt3+99tkT2tqK2V8XDIUzxk=";
-          cp311 = "sha256-paPCaNRQYMUM0CmXnsxfHqrsBAsZ+ojdT+npJ9Gf8T4=";
-          cp312 = "sha256-hDwBCK1yu3/Gwjoi4p5gmVRqXqrTrWdceKFG2QgPbsY=";
-          cp313 = "sha256-u+SSx4CjmmS9PQdmytENVM8SIi34jSh+wtjy1S3jfHk=";
+          cp310 = "sha256-TbtfzhNkdj8pdBBV9Qq+M89yY5cUH5zA6EXdPMlj5FU=";
+          cp311 = "sha256-6wAMF/cwEHH90VxExM06wPeVO7THwifmFxn+cEgZW80=";
+          cp312 = "sha256-FPRjY+m0zwwci02GI+wzfFvUCDd4MbXltQBnkwE3u8o=";
+          cp313 = "sha256-c9u6p5Yqf144qoz5SD4OmBcgXpiao9yFnHOMKvGuAd8=";
        };
        aarch64-linux = {
-          cp310 = "sha256-Zb9GH9/k/6ZnxG+UVfh0CyrWwfpHG0YdX1z2t7rxd7U=";
-          cp311 = "sha256-K1fvJyoqCg265tGNcKpUHqtiC0/jtE1QRm06UzwW+dk=";
-          cp312 = "sha256-COuPX9VSkrpr7jY6MkkRNqXlSvVOAH+B4GA5hvvqQaQ=";
-          cp313 = "sha256-44Jq605Dmd4MaIW9i+fOL2KfoAEPABPxGD4HJrPSXkA=";
+          cp310 = "sha256-QQgoDYocuQ19aOXJVMNeY7i7mkuhX4jF59oOICVkdxI=";
+          cp311 = "sha256-oLu5iwsPJaPuB1yhAXHhJg5wtrxpDNUJ7NfOEiivhU0=";
+          cp312 = "sha256-ZeLOWNPca6o89Fgk2InBlo695WXuVN/YCpivjzGvjko=";
+          cp313 = "sha256-cZblNY38yCEb6GT0Xm3+SCcgLfKUrzx6dv+PvAgOBSI=";
        };
        aarch64-darwin = {
-          cp310 = "sha256-mTGUqL5wVA4PgZhiAxu/GaZEAfvmwxtCBl/TE7pGbTQ=";
-          cp311 = "sha256-9Z47LRoUZqwHePLG+snMtfMBB9d+Pd3R1gFnJI0mhHQ=";
-          cp312 = "sha256-aDFZL+3woSIBb12rS2fYX6PU2zsh9YjRiDS1wDE5bRw=";
-          cp313 = "sha256-tbwpVIq7Cgp66eb/OwzMooJO2vARpDNuFaMnk9V0+/0=";
+          cp310 = "sha256-TbkUoKbdYI+knAZpKaEoJ0Wi29c8ruZ9e4D+aEymW90=";
+          cp311 = "sha256-vT7Ew0J3bdrCOuKxCMZPWTn0F8zEh1kA1YbHyXhGMmk=";
+          cp312 = "sha256-2LldBH2UdJOAP7hBeuoxIl3KzasVr9x1uKI4kBlJ1Fc=";
+          cp313 = "sha256-hbRyq2+48RifjO+BkT/ZGyTdabP6fcyn4USCe9kk9sA=";
        };
      };
    in
@@ -119,7 +119,9 @@ buildPythonPackage rec {
      python = pyShortVersion;
      abi = pyShortVersion;
      platform = platforms.${stdenv.hostPlatform.system} or { };
-      sha256 = hashes.${stdenv.hostPlatform.system}.${pyShortVersion} or { };
+      sha256 =
+        hashes.${stdenv.hostPlatform.system}.${pyShortVersion}
+          or (throw "No hash specified for '${stdenv.hostPlatform.system}.${pyShortVersion}'");
    };

  nativeBuildInputs = lib.optionals stdenv.hostPlatform.isLinux [
@@ -21,14 +21,14 @@

 buildPythonPackage rec {
  pname = "rigour";
-  version = "1.5.0";
+  version = "1.6.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "opensanctions";
    repo = "rigour";
    tag = "v${version}";
-    hash = "sha256-0uqKcjGxI22jNt7lLP0LvhIyQO2yxV5tS6fW9QiQ814=";
+    hash = "sha256-meeM/ylRJkZ1/Oh16oX572AkqxtU6gf8QtMIe8cCf8Y=";
  };

  build-system = [
@@ -421,9 +421,9 @@
  };

  nickel = {
-    version = "0.3.0";
-    url = "github:nickel-lang/tree-sitter-nickel?ref=0.3";
-    hash = "sha256-jL054OJj+1eXksNYOTTTFzZjwPqTFp06syC3TInN8rc=";
+    version = "0.5.0";
+    url = "github:nickel-lang/tree-sitter-nickel";
+    hash = "sha256-2la/9XxL2dN+rzTotgDXQFz9ktDXQ3Og9svX5Din2zo=";
  };

  nix = {
@@ -647,9 +647,9 @@
  };

  sql = {
-    version = "0.3.9";
+    version = "0.3.11";
    url = "github:derekstride/tree-sitter-sql";
-    hash = "sha256-DC7cZs8ePQmj5t/6GgnmgT5ubuOBaaS3Xch/f76/ZWM=";
+    hash = "sha256-efeDAUgCwV9UBXbLyZ1a4Rwcvr/+wke8IzkxRUQnddM=";
    generate = true;
  };

@@ -16,9 +16,9 @@ let
  variants = {
    # ./update-zen.py zen
    zen = {
-      version = "6.18.1"; # zen
-      suffix = "zen1"; # zen
-      sha256 = "1y3xp1zf6d1vxqb6crnpp1wn6j4xfcpjd11k05h85ggsq3ry10z5"; # zen
+      version = "6.18.2"; # zen
+      suffix = "zen2"; # zen
+      sha256 = "1jagav0yp2s09461wrn7vjmhvb92qnhlqdhx6pdza21zbzbscpvj"; # zen
      isLqx = false;
    };
    # ./update-zen.py lqx
@@ -16,18 +16,22 @@
  iniparser,
  libmemcached,
  mapnik,
+  ps,
+  jq,
+  memcached,
+  iana-etc,
  nix-update-script,
 }:

 stdenv.mkDerivation rec {
  pname = "mod_tile";
-  version = "0.7.2";
+  version = "0.8.1";

  src = fetchFromGitHub {
    owner = "openstreetmap";
    repo = "mod_tile";
    tag = "v${version}";
-    hash = "sha256-JC275LKsCeEo5DcIX0X7kcLoijQJqfJvBvw8xi2gwpk=";
+    hash = "sha256-zDe+pFzK16K+8I0v1Z7p83PIgQlVDbjcnD4vzwdB1Oo=";
  };

  nativeBuildInputs = [
@@ -68,6 +72,15 @@ stdenv.mkDerivation rec {
  # Do not run tests in parallel
  enableParallelChecking = false;

+  nativeCheckInputs = [
+    iana-etc
+    ps
+  ]
+  ++ lib.filter (pkg: !pkg.meta.broken) [
+    jq
+    memcached
+  ];
+
  passthru.updateScript = nix-update-script { };

  meta = {
@@ -5,15 +5,15 @@
  nixosTests,
 }:

-buildGoModule rec {
+buildGoModule {
  pname = "shelly_exporter";
-  version = "1.0.0";
+  version = "0-unstable-2025-03-19";

  src = fetchFromGitHub {
    owner = "aexel90";
-    repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-L0TuBDq5eEahQvzqd1WuvmXuQbbblCM+Nvj15IybnVo=";
+    repo = "shelly_exporter";
+    rev = "2e82fb01ec9337f6e2c68267e6d43c0f1677c481";
+    hash = "sha256-FYz0hmZiVWL6/bBccOBzFVpjN8HqbG+7+uODC2LwxZk=";
  };

  vendorHash = "sha256-BCrge2xLT4b4wpYA+zcsH64a/nfV8+HeZF7L49p2gEw=";
@@ -509,6 +509,7 @@ mapAliases {
  dbus-sharp-glib-2_0 = throw "'dbus-sharp-glib-2_0' has been removed as it was unmaintained and had no dependents"; # Added 2025-08-25
  dclib = throw "'dclib' has been removed as it is unmaintained for 16 years and broken"; # Added 2025-05-25
  deadpixi-sam = throw "'deadpixi-sam' has been renamed to/replaced by 'deadpixi-sam-unstable'"; # Converted to throw 2025-10-27
+  deco = throw "'deco' has been removed as it is unused"; # Added 2025-12-18
  deepin = throw "the Deepin desktop environment and associated tools have been removed from nixpkgs due to lack of maintenance"; # Added 2025-08-21
  deepsea = throw "deepsea has been removed because it has been marked as broken since at least November 2024."; # Added 2025-09-28
  degit-rs = throw "'degit-rs' has been removed because it is unmaintained upstream and has vulnerable dependencies."; # Added 2025-07-11
@@ -556,6 +557,7 @@ mapAliases {
  emacsNativeComp = throw "'emacsNativeComp' has been renamed to/replaced by 'emacs'"; # Converted to throw 2025-10-27
  emanote = throw "'emanote' has been removed due to lack of a Nixpkgs maintainer"; # Added 2025-09-18
  embree2 = throw "embree2 has been removed, as it is unmaintained upstream and depended on tbb_2020"; # Added 2025-09-14
+  emem = throw "'emem' has been removed as it is unused"; # Added 2025-12-18
  emojione = throw "emojione has beem removed, as it has been archived upstream."; # Added 2025-11-06
  EmptyEpsilon = throw "'EmptyEpsilon' has been renamed to/replaced by 'empty-epsilon'"; # Converted to throw 2025-10-27
  emulationstation = throw "emulationstation was removed due to numerous vulnerabilities in freeimage"; # Added 2025-10-23
@@ -1269,6 +1271,7 @@ mapAliases {
  pds = warnAlias "'pds' has been renamed to 'bluesky-pds'" bluesky-pds; # Added 2025-08-20
  pdsadmin = warnAlias "'pdsadmin' has been renamed to 'bluesky-pdsadmin'" bluesky-pdsadmin; # Added 2025-08-20
  peach = throw "'peach' has been renamed to/replaced by 'asouldocs'"; # Converted to throw 2025-10-27
+  pell = throw "'pell' has been removed as it is unused and unmaintained upstream"; # Added 2025-12-18
  pentablet-driver = throw "'pentablet-driver' has been renamed to/replaced by 'xp-pen-g430-driver'"; # Converted to throw 2025-10-27
  perceptual-diff = throw "perceptual-diff was removed due to numerous vulnerabilities in freeimage"; # Added 2025-10-23
  percona-server_innovation = throw "'percona-server_innovation' has been renamed to/replaced by 'percona-server'"; # Converted to throw 2025-10-27
@@ -1442,8 +1445,10 @@ mapAliases {
  ruby-zoom = throw "'ruby-zoom' has been removed due to lack of maintaince and had not been updated since 2020"; # Added 2025-08-24
  ruby_3_1 = throw "ruby_3_1 has been removed, as it is has reached end‐of‐life upstream"; # Added 2025-10-12
  ruby_3_2 = throw "ruby_3_2 has been removed, as it will reach end‐of‐life upstream during Nixpkgs 25.11’s support cycle"; # Added 2025-10-12
+  ruby_3_5 = ruby_4_0; # Added 2025-12-22
  rubyPackages_3_1 = throw "rubyPackages_3_1 has been removed, as it is has reached end‐of‐life upstream"; # Added 2025-10-12
-  rubyPackages_3_2 = throw "rubyPackages_3_2 has been removed, as it will reach end‐of‐life upstream during Nixpkgs 25.11’s support cycle"; # Added 2025-10-12
+  rubyPackages_3_2 = throw "rubyPackages_3_2 has been removed, as it will reach end‐of‐life upstream during Nixpkgs 25.11's support cycle"; # Added 2025-10-12
+  rubyPackages_3_5 = rubyPackages_4_0; # Added 2025-12-22
  rucksack = throw "rucksack was removed due to numerous vulnerabilities in freeimage"; # Added 2025-10-23
  runCommandNoCC = warnAlias "'runCommandNoCC' has been renamed to/replaced by 'runCommand'" runCommand; # Converted to warning 2025-10-28
  runCommandNoCCLocal = warnAlias "'runCommandNoCCLocal' has been renamed to/replaced by 'runCommandLocal'" runCommandLocal; # Converted to warning 2025-10-28
@@ -1655,6 +1660,7 @@ mapAliases {
  unicap = throw "'unicap' has been removed because it is unmaintained"; # Added 2025-05-17
  unifi-poller = throw "'unifi-poller' has been renamed to/replaced by 'unpoller'"; # Converted to throw 2025-10-27
  unzoo = throw "'unzoo' has been removed since it is unmaintained upstream and doesn't compile with newer versions of GCC anymore"; # Removed 2025-05-24
+  usync = throw "'usync' has been removed as it is unused and unmaintained upstream"; # Added 2025-12-18
  util-linuxCurses = throw "'util-linuxCurses' has been renamed to/replaced by 'util-linux'"; # Converted to throw 2025-10-27
  utillinux = warnAlias "'utillinux' has been renamed to/replaced by 'util-linux'" util-linux; # Converted to warning 2025-10-28
  vaapiIntel = throw "'vaapiIntel' has been renamed to/replaced by 'intel-vaapi-driver'"; # Converted to throw 2025-10-27
@@ -5733,7 +5733,7 @@ with pkgs;
    mkRuby
    ruby_3_3
    ruby_3_4
-    ruby_3_5
+    ruby_4_0
    ;

  ruby = ruby_3_3;
@@ -5741,7 +5741,7 @@ with pkgs;

  rubyPackages_3_3 = recurseIntoAttrs ruby_3_3.gems;
  rubyPackages_3_4 = recurseIntoAttrs ruby_3_4.gems;
-  rubyPackages_3_5 = recurseIntoAttrs ruby_3_5.gems;
+  rubyPackages_4_0 = recurseIntoAttrs ruby_4_0.gems;

  inherit (callPackages ../applications/networking/cluster/spark { })
    spark_4_0
@@ -134,6 +134,15 @@ in
        inherit buildTargetLlvmPackages llvmPackages;
      };
      ghc912 = compiler.ghc9122;
+      ghc9141 = callPackage ../development/compilers/ghc/9.14.1.nix {
+        bootPkgs =
+          # No suitable bindist packaged yet
+          bb.packages.ghc9103;
+        inherit (buildPackages.python3Packages) sphinx;
+        inherit (buildPackages.darwin) xattr autoSignDarwinBinariesHook;
+        inherit buildTargetLlvmPackages llvmPackages;
+      };
+      ghc914 = compiler.ghc9141;
      ghcHEAD = callPackage ../development/compilers/ghc/head.nix {
        bootPkgs = bb.packages.ghc984Binary;
        inherit (buildPackages.python3Packages) sphinx;
@@ -221,6 +230,12 @@ in
        compilerConfig = callPackage ../development/haskell-modules/configuration-ghc-9.12.x.nix { };
      };
      ghc912 = packages.ghc9122;
+      ghc9141 = callPackage ../development/haskell-modules {
+        buildHaskellPackages = bh.packages.ghc9141;
+        ghc = bh.compiler.ghc9141;
+        compilerConfig = callPackage ../development/haskell-modules/configuration-ghc-9.14.x.nix { };
+      };
+      ghc914 = packages.ghc9141;
      ghcHEAD = callPackage ../development/haskell-modules {
        buildHaskellPackages = bh.packages.ghcHEAD;
        ghc = bh.compiler.ghcHEAD;