Merge staging-next into staging

.git-blame-ignore-revs

@@ -235,3 +235,6 @@ ef85e0daa092c9eae0d32c7ce16b889728a5fbc0
 d89ad6c70e0e89aaae75e9f886878ea4e103965a
 e0fe216f4912dd88a021d12a44155fd2cfeb31c8
 80d5b411f6397d5c3e755a0635d95742f76f3c75
+
+# nixos/movim: format with nixfmt-rfc-style
+43c1654cae47cbf987cb63758c06245fa95c1e3b

nixos/doc/manual/release-notes/rl-2505.section.md

@@ -310,6 +310,8 @@
 
 - `hardware.pulseaudio` has been renamed to `services.pulseaudio`.  The deprecated option names will continue to work, but causes a warning.
 
+- `services.nextcloud` now uses systemd's credential mechanism to read in secret files. The `nextcloud-occ` wrapper script implements this using `systemd-run`, as such it now also requires root privileges or `$CREDENTIALS_DIRECTORY` set where running it as user `nextcloud` was enough previously.
+
 - `minetest` has been renamed to `luanti` to match the upstream name change but aliases have been added. The new name hasn't resulted in many changes as of yet but older references to minetest should be sunset. See the [new name announcement](https://blog.minetest.net/2024/10/13/Introducing-Our-New-Name/) for more details.
 
 - `poac` has been renamed to `cabinpkg` to match the upstream name change but an alias has been added. See the [new name announcement](https://github.com/orgs/cabinpkg/discussions/1052) for more details.

nixos/modules/services/home-automation/evcc.nix

@@ -1,10 +1,19 @@
 {
+  config,
   lib,
   pkgs,
-  config,
+  utils,
   ...
 }:
 let
+  inherit (lib)
+    getExe
+    mkEnableOption
+    mkIf
+    mkOption
+    mkPackageOption
+    ;
+
   cfg = config.services.evcc;
 
   format = pkgs.formats.yaml { };
@@ -17,27 +26,40 @@ in
   meta.maintainers = with lib.maintainers; [ hexa ];
 
   options.services.evcc = with lib.types; {
-    enable = lib.mkEnableOption "EVCC, the extensible EV Charge Controller with PV integration";
+    enable = mkEnableOption "EVCC, the extensible EV Charge Controller and Home Energy Management System";
 
-    extraArgs = lib.mkOption {
+    package = mkPackageOption pkgs "evcc" { };
+
+    extraArgs = mkOption {
       type = listOf str;
       default = [ ];
       description = ''
-        Extra arguments to pass to the evcc executable.
+        Extra arguments to pass to the `evcc` executable.
       '';
     };
 
-    settings = lib.mkOption {
+    environmentFile = mkOption {
+      type = nullOr path;
+      default = null;
+      example = /run/keys/evcc;
+      description = ''
+        File with environment variables to pass into the runtime environment.
+
+        Useful to pass secrets into the configuration, that get applied using `envsubst`.
+      '';
+    };
+
+    settings = mkOption {
       type = format.type;
       description = ''
-        evcc configuration as a Nix attribute set.
+        evcc configuration as a Nix attribute set. Supports substitution of secrets using `envsubst` from the `environmentFile`.
 
         Check for possible options in the sample [evcc.dist.yaml](https://github.com/andig/evcc/blob/${package.version}/evcc.dist.yaml).
       '';
     };
   };
 
-  config = lib.mkIf cfg.enable {
+  config = mkIf cfg.enable {
     systemd.services.evcc = {
       wants = [ "network-online.target" ];
       after = [
@@ -52,7 +74,21 @@ in
         getent
       ];
       serviceConfig = {
-        ExecStart = "${package}/bin/evcc --config ${configFile} ${lib.escapeShellArgs cfg.extraArgs}";
+        EnvironmentFile = lib.optionals (cfg.environmentFile != null) [ cfg.environmentFile ];
+        ExecStartPre = utils.escapeSystemdExecArgs [
+          (getExe pkgs.envsubst)
+          "-i"
+          configFile
+          "-o"
+          "/run/evcc/config.yaml"
+        ];
+        ExecStart = utils.escapeSystemdExecArgs (
+          [
+            (getExe cfg.package)
+            "--config=/run/evcc/config.yaml"
+          ]
+          ++ cfg.extraArgs
+        );
         CapabilityBoundingSet = [ "" ];
         DeviceAllow = [
           "char-ttyUSB"
@@ -61,14 +97,6 @@ in
         DynamicUser = true;
         LockPersonality = true;
         MemoryDenyWriteExecute = true;
-        Restart = "on-failure";
-        RestrictAddressFamilies = [
-          "AF_INET"
-          "AF_INET6"
-          "AF_UNIX"
-        ];
-        RestrictNamespaces = true;
-        RestrictRealtime = true;
         PrivateTmp = true;
         PrivateUsers = true;
         ProcSubset = "pid";
@@ -80,6 +108,15 @@ in
         ProtectKernelModules = true;
         ProtectKernelTunables = true;
         ProtectProc = "invisible";
+        Restart = "on-failure";
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+          "AF_UNIX"
+        ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RuntimeDirectory = "evcc";
         StateDirectory = "evcc";
         SystemCallArchitectures = "native";
         SystemCallFilter = [

nixos/modules/services/web-apps/movim.nix

@@ -1,4 +1,9 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 
 let
   inherit (lib)
@@ -28,97 +33,123 @@ let
     "opcache.fast_shutdown" = 1;
   };
 
-  phpCfg = generators.toKeyValue
-    { mkKeyValue = generators.mkKeyValueDefault { } " = "; }
-    (defaultPHPCfg // cfg.phpCfg);
+  phpCfg = generators.toKeyValue { mkKeyValue = generators.mkKeyValueDefault { } " = "; } (
+    defaultPHPCfg // cfg.phpCfg
+  );
 
   podConfigFlags =
     let
       bevalue = a: lib.escapeShellArg (generators.mkValueStringDefault { } a);
     in
-    lib.concatStringsSep " "
-      (lib.attrsets.foldlAttrs
-        (acc: k: v: acc ++ lib.optional (v != null) "--${k}=${bevalue v}")
-        [ ]
-        cfg.podConfig);
+    lib.concatStringsSep " " (
+      lib.attrsets.foldlAttrs (
+        acc: k: v:
+        acc ++ lib.optional (v != null) "--${k}=${bevalue v}"
+      ) [ ] cfg.podConfig
+    );
 
   package =
     let
-      p = cfg.package.override
-        ({
+      p = cfg.package.override (
+        {
           inherit phpCfg;
           withPgsql = cfg.database.type == "pgsql";
           withMysql = cfg.database.type == "mysql";
           inherit (cfg) minifyStaticFiles;
-        } // lib.optionalAttrs (lib.isAttrs cfg.minifyStaticFiles) (with cfg.minifyStaticFiles; {
-          esbuild = esbuild.package;
-          lightningcss = lightningcss.package;
-          scour = scour.package;
-        }));
+        }
+        // lib.optionalAttrs (lib.isAttrs cfg.minifyStaticFiles) (
+          with cfg.minifyStaticFiles;
+          {
+            esbuild = esbuild.package;
+            lightningcss = lightningcss.package;
+            scour = scour.package;
+          }
+        )
+      );
     in
-    p.overrideAttrs (finalAttrs: prevAttrs:
+    p.overrideAttrs (
+      finalAttrs: prevAttrs:
       let
         appDir = "$out/share/php/${finalAttrs.pname}";
 
-        stateDirectories = /* sh */ ''
-          # Symlinking in our state directories
-          rm -rf $out/{.env,cache} ${appDir}/{log,public/cache}
-          ln -s ${cfg.dataDir}/.env ${appDir}/.env
-          ln -s ${cfg.dataDir}/public/cache ${appDir}/public/cache
-          ln -s ${cfg.logDir} ${appDir}/log
-          ln -s ${cfg.runtimeDir}/cache ${appDir}/cache
-        '';
+        stateDirectories = # sh
+          ''
+            # Symlinking in our state directories
+            rm -rf $out/{.env,cache} ${appDir}/{log,public/cache}
+            ln -s ${cfg.dataDir}/.env ${appDir}/.env
+            ln -s ${cfg.dataDir}/public/cache ${appDir}/public/cache
+            ln -s ${cfg.logDir} ${appDir}/log
+            ln -s ${cfg.runtimeDir}/cache ${appDir}/cache
+          '';
 
-        exposeComposer = /* sh */ ''
-          # Expose PHP Composer for scripts
-          mkdir -p $out/bin
-          echo "#!${lib.getExe pkgs.dash}" > $out/bin/movim-composer
-          echo "${finalAttrs.php.packages.composer}/bin/composer --working-dir="${appDir}" \"\$@\"" >> $out/bin/movim-composer
-          chmod +x $out/bin/movim-composer
-        '';
+        exposeComposer = # sh
+          ''
+            # Expose PHP Composer for scripts
+            mkdir -p $out/bin
+            echo "#!${lib.getExe pkgs.dash}" > $out/bin/movim-composer
+            echo "${finalAttrs.php.packages.composer}/bin/composer --working-dir="${appDir}" \"\$@\"" >> $out/bin/movim-composer
+            chmod +x $out/bin/movim-composer
+          '';
 
-        podConfigInputDisableReplace = lib.optionalString (podConfigFlags != "")
-          (lib.concatStringsSep "\n"
-            (lib.attrsets.foldlAttrs
-              (acc: k: v:
-                acc ++ lib.optional (v != null)
+        podConfigInputDisableReplace = lib.optionalString (podConfigFlags != "") (
+          lib.concatStringsSep "\n" (
+            lib.attrsets.foldlAttrs (
+              acc: k: v:
+              acc
+              ++
+                lib.optional (v != null)
                   # Disable all Admin panel options that were set in the
                   # `cfg.podConfig` to prevent confusing situtions where the
                   # values are rewritten on server reboot
-                  /* sh */ ''
-                  substituteInPlace ${appDir}/app/Widgets/AdminMain/adminmain.tpl \
-                    --replace-warn 'name="${k}"' 'name="${k}" readonly'
-                '')
-              [ ]
-              cfg.podConfig));
+                  # sh
+                  ''
+                    substituteInPlace ${appDir}/app/Widgets/AdminMain/adminmain.tpl \
+                      --replace-warn 'name="${k}"' 'name="${k}" readonly'
+                  ''
+            ) [ ] cfg.podConfig
+          )
+        );
 
         precompressStaticFilesJobs =
           let
             inherit (cfg.precompressStaticFiles) brotli gzip;
 
-            findTextFileNames = lib.concatStringsSep " -o "
-              (builtins.map (n: ''-iname "*.${n}"'')
-                [ "css" "ini" "js" "json" "manifest" "mjs" "svg" "webmanifest" ]);
+            findTextFileNames = lib.concatStringsSep " -o " (
+              builtins.map (n: ''-iname "*.${n}"'') [
+                "css"
+                "ini"
+                "js"
+                "json"
+                "manifest"
+                "mjs"
+                "svg"
+                "webmanifest"
+              ]
+            );
           in
           lib.concatStringsSep "\n" [
-            (lib.optionalString brotli.enable /* sh */ ''
-              echo -n "Precompressing static files with Brotli …"
-              find ${appDir}/public -type f ${findTextFileNames} -print0 \
-                | xargs -0 -n 1 -P $NIX_BUILD_CORES ${pkgs.writeShellScript "movim_precompress_broti" ''
+            (lib.optionalString brotli.enable # sh
+              ''
+                echo -n "Precompressing static files with Brotli …"
+                find ${appDir}/public -type f ${findTextFileNames} -print0 \
+                  | xargs -0 -n 1 -P $NIX_BUILD_CORES ${pkgs.writeShellScript "movim_precompress_broti" ''
                     file="$1"
                     ${lib.getExe brotli.package} --keep --quality=${builtins.toString brotli.compressionLevel} --output=$file.br $file
                   ''}
-              echo " done."
-            '')
-            (lib.optionalString gzip.enable /* sh */ ''
-              echo -n "Precompressing static files with Gzip …"
-              find ${appDir}/public -type f ${findTextFileNames} -print0 \
-                | xargs -0 -n 1 -P $NIX_BUILD_CORES ${pkgs.writeShellScript "movim_precompress_gzip" ''
+                echo " done."
+              ''
+            )
+            (lib.optionalString gzip.enable # sh
+              ''
+                echo -n "Precompressing static files with Gzip …"
+                find ${appDir}/public -type f ${findTextFileNames} -print0 \
+                  | xargs -0 -n 1 -P $NIX_BUILD_CORES ${pkgs.writeShellScript "movim_precompress_gzip" ''
                     file="$1"
                     ${lib.getExe gzip.package} -c -${builtins.toString gzip.compressionLevel} $file > $file.gz
                   ''}
-              echo " done."
-            '')
+                echo " done."
+              ''
+            )
           ];
       in
       {
@@ -129,7 +160,8 @@ let
           podConfigInputDisableReplace
           precompressStaticFilesJobs
         ];
-      });
+      }
+    );
 
   configFile = pipe cfg.settings [
     (filterAttrsRecursive (_: v: v != null))
@@ -141,10 +173,12 @@ let
   fpm = config.services.phpfpm.pools.${pool};
   phpExecutionUnit = "phpfpm-${pool}";
 
-  dbService = {
-    "postgresql" = "postgresql.service";
-    "mysql" = "mysql.service";
-  }.${cfg.database.type};
+  dbService =
+    {
+      "postgresql" = "postgresql.service";
+      "mysql" = "mysql.service";
+    }
+    .${cfg.database.type};
 in
 {
   options.services = {
@@ -154,7 +188,13 @@ in
       phpPackage = mkPackageOption pkgs "php" { };
 
       phpCfg = mkOption {
-        type = with types; attrsOf (oneOf [ int str bool ]);
+        type =
+          with types;
+          attrsOf (oneOf [
+            int
+            str
+            bool
+          ]);
         defaultText = literalExpression (generators.toPretty { } defaultPHPCfg);
         default = { };
         description = "Extra PHP INI options such as `memory_limit`, `max_execution_time`, etc.";
@@ -214,69 +254,73 @@ in
       };
 
       minifyStaticFiles = mkOption {
-        type = with types; either bool (submodule {
-          options = {
-            script = mkOption {
-              type = types.submodule {
-                options = {
-                  enable = mkEnableOption "Script minification";
-                  package = mkPackageOption pkgs "esbuild" { };
-                  target = mkOption {
-                    type = with types; nullOr nonEmptyStr;
-                    default = null;
+        type =
+          with types;
+          either bool (submodule {
+            options = {
+              script = mkOption {
+                type = types.submodule {
+                  options = {
+                    enable = mkEnableOption "Script minification";
+                    package = mkPackageOption pkgs "esbuild" { };
+                    target = mkOption {
+                      type = with types; nullOr nonEmptyStr;
+                      default = null;
+                    };
+                  };
+                };
+              };
+              style = mkOption {
+                type = types.submodule {
+                  options = {
+                    enable = mkEnableOption "Script minification";
+                    package = mkPackageOption pkgs "lightningcss" { };
+                    target = mkOption {
+                      type = with types; nullOr nonEmptyStr;
+                      default = null;
+                    };
+                  };
+                };
+              };
+              svg = mkOption {
+                type = types.submodule {
+                  options = {
+                    enable = mkEnableOption "SVG minification";
+                    package = mkPackageOption pkgs "scour" { };
                   };
                 };
               };
             };
-            style = mkOption {
-              type = types.submodule {
-                options = {
-                  enable = mkEnableOption "Script minification";
-                  package = mkPackageOption pkgs "lightningcss" { };
-                  target = mkOption {
-                    type = with types; nullOr nonEmptyStr;
-                    default = null;
-                  };
-                };
-              };
-            };
-            svg = mkOption {
-              type = types.submodule {
-                options = {
-                  enable = mkEnableOption "SVG minification";
-                  package = mkPackageOption pkgs "scour" { };
-                };
-              };
-            };
-          };
-        });
+          });
         default = true;
         description = "Do minification on public static files";
       };
 
       precompressStaticFiles = mkOption {
-        type = with types; submodule {
-          options = {
-            brotli = {
-              enable = mkEnableOption "Brotli precompression";
-              package = mkPackageOption pkgs "brotli" { };
-              compressionLevel = mkOption {
-                type = types.ints.between 0 11;
-                default = 11;
-                description = "Brotli compression level";
+        type =
+          with types;
+          submodule {
+            options = {
+              brotli = {
+                enable = mkEnableOption "Brotli precompression";
+                package = mkPackageOption pkgs "brotli" { };
+                compressionLevel = mkOption {
+                  type = types.ints.between 0 11;
+                  default = 11;
+                  description = "Brotli compression level";
+                };
               };
-            };
-            gzip = {
-              enable = mkEnableOption "Gzip precompression";
-              package = mkPackageOption pkgs "gzip" { };
-              compressionLevel = mkOption {
-                type = types.ints.between 1 9;
-                default = 9;
-                description = "Gzip compression level";
+              gzip = {
+                enable = mkEnableOption "Gzip precompression";
+                package = mkPackageOption pkgs "gzip" { };
+                compressionLevel = mkOption {
+                  type = types.ints.between 1 9;
+                  default = 9;
+                  description = "Gzip compression level";
+                };
               };
             };
           };
-        };
         default = {
           brotli.enable = true;
           gzip.enable = false;
@@ -362,7 +406,15 @@ in
       };
 
       settings = mkOption {
-        type = with types; attrsOf (nullOr (oneOf [ int str bool ]));
+        type =
+          with types;
+          attrsOf (
+            nullOr (oneOf [
+              int
+              str
+              bool
+            ])
+          );
         default = { };
         description = ".env settings for Movim. Secrets should use `secretFile` option instead. `null`s will be culled.";
       };
@@ -375,7 +427,10 @@ in
 
       database = {
         type = mkOption {
-          type = types.enum [ "mysql" "postgresql" ];
+          type = types.enum [
+            "mysql"
+            "postgresql"
+          ];
           example = "mysql";
           default = "postgresql";
           description = "Database engine to use.";
@@ -401,20 +456,27 @@ in
       };
 
       nginx = mkOption {
-        type = with types; nullOr (submodule
-          (import ../web-servers/nginx/vhost-options.nix {
-            inherit config lib;
-          }));
+        type =
+          with types;
+          nullOr (
+            submodule (
+              import ../web-servers/nginx/vhost-options.nix {
+                inherit config lib;
+              }
+            )
+          );
         default = null;
-        example = lib.literalExpression /* nginx */ ''
-          {
-            serverAliases = [
-              "pics.''${config.networking.domain}"
-            ];
-            enableACME = true;
-            forceHttps = true;
-          }
-        '';
+        example =
+          lib.literalExpression # nginx
+            ''
+              {
+                serverAliases = [
+                  "pics.''${config.networking.domain}"
+                ];
+                enableACME = true;
+                forceHttps = true;
+              }
+            '';
         description = ''
           With this option, you can customize an nginx virtual host which already has sensible defaults for Movim.
           Set to `{ }` if you do not need any customization to the virtual host.
@@ -424,7 +486,13 @@ in
       };
 
       poolConfig = mkOption {
-        type = with types; attrsOf (oneOf [ int str bool ]);
+        type =
+          with types;
+          attrsOf (oneOf [
+            int
+            str
+            bool
+          ]);
         default = { };
         description = "Options for Movim’s PHP-FPM pool.";
       };
@@ -435,14 +503,16 @@ in
     environment.systemPackages = [ cfg.package ];
 
     users = {
-      users = {
-        movim = mkIf (cfg.user == "movim") {
-          isSystemUser = true;
-          group = cfg.group;
+      users =
+        {
+          movim = mkIf (cfg.user == "movim") {
+            isSystemUser = true;
+            group = cfg.group;
+          };
+        }
+        // lib.optionalAttrs (cfg.nginx != null) {
+          "${config.services.nginx.user}".extraGroups = [ cfg.group ];
         };
-      } // lib.optionalAttrs (cfg.nginx != null) {
-        "${config.services.nginx.user}".extraGroups = [ cfg.group ];
-      };
       groups = {
         ${cfg.group} = { };
       };
@@ -459,10 +529,12 @@ in
             DAEMON_VERBOSE = cfg.verbose;
           }
           (mkIf cfg.database.createLocally {
-            DB_DRIVER = {
-              "postgresql" = "pgsql";
-              "mysql" = "mysql";
-            }.${cfg.database.type};
+            DB_DRIVER =
+              {
+                "postgresql" = "pgsql";
+                "mysql" = "mysql";
+              }
+              .${cfg.database.type};
             DB_HOST = "localhost";
             DB_PORT = config.services.${cfg.database.type}.settings.port;
             DB_DATABASE = cfg.database.name;
@@ -484,16 +556,17 @@ in
         };
       };
 
-      nginx = mkIf (cfg.nginx != null)
-        {
+      nginx =
+        mkIf (cfg.nginx != null) {
           enable = true;
           recommendedOptimisation = mkDefault true;
           recommendedProxySettings = true;
           # TODO: recommended cache options already in Nginx⁇
-          appendHttpConfig = /* nginx */ ''
-            fastcgi_cache_path /tmp/nginx_cache levels=1:2 keys_zone=nginx_cache:100m inactive=60m;
-            fastcgi_cache_key "$scheme$request_method$host$request_uri";
-          '';
+          appendHttpConfig = # nginx
+            ''
+              fastcgi_cache_path /tmp/nginx_cache levels=1:2 keys_zone=nginx_cache:100m inactive=60m;
+              fastcgi_cache_key "$scheme$request_method$host$request_uri";
+            '';
           virtualHosts."${cfg.domain}" = mkMerge [
             cfg.nginx
             {
@@ -501,94 +574,110 @@ in
               locations = {
                 "/favicon.ico" = {
                   priority = 100;
-                  extraConfig = /* nginx */ ''
-                    access_log off;
-                    log_not_found off;
-                  '';
+                  extraConfig = # nginx
+                    ''
+                      access_log off;
+                      log_not_found off;
+                    '';
                 };
                 "/robots.txt" = {
                   priority = 100;
-                  extraConfig = /* nginx */ ''
-                    access_log off;
-                    log_not_found off;
-                  '';
+                  extraConfig = # nginx
+                    ''
+                      access_log off;
+                      log_not_found off;
+                    '';
                 };
                 "~ /\\.(?!well-known).*" = {
                   priority = 210;
-                  extraConfig = /* nginx */ ''
-                    deny all;
-                  '';
+                  extraConfig = # nginx
+                    ''
+                      deny all;
+                    '';
                 };
                 # Ask nginx to cache every URL starting with "/picture"
                 "/picture" = {
                   priority = 400;
                   tryFiles = "$uri $uri/ /index.php$is_args$args";
-                  extraConfig = /* nginx */ ''
-                    set $no_cache 0; # Enable cache only there
-                  '';
+                  extraConfig = # nginx
+                    ''
+                      set $no_cache 0; # Enable cache only there
+                    '';
                 };
                 "/" = {
                   priority = 490;
                   tryFiles = "$uri $uri/ /index.php$is_args$args";
-                  extraConfig = /* nginx */ ''
-                    # https://github.com/movim/movim/issues/314
-                    add_header Content-Security-Policy "default-src 'self'; img-src 'self' aesgcm: https:; media-src 'self' aesgcm: https:; script-src 'self' 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline';";
-                    set $no_cache 1;
-                  '';
+                  extraConfig = # nginx
+                    ''
+                      # https://github.com/movim/movim/issues/314
+                      add_header Content-Security-Policy "default-src 'self'; img-src 'self' aesgcm: https:; media-src 'self' aesgcm: https:; script-src 'self' 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline';";
+                      set $no_cache 1;
+                    '';
                 };
                 "~ \\.php$" = {
                   priority = 500;
                   tryFiles = "$uri =404";
-                  extraConfig = /* nginx */ ''
-                    include ${config.services.nginx.package}/conf/fastcgi.conf;
-                    add_header X-Cache $upstream_cache_status;
-                    fastcgi_ignore_headers "Cache-Control" "Expires" "Set-Cookie";
-                    fastcgi_cache nginx_cache;
-                    fastcgi_cache_valid any 7d;
-                    fastcgi_cache_bypass $no_cache;
-                    fastcgi_no_cache $no_cache;
-                    fastcgi_split_path_info ^(.+\.php)(/.+)$;
-                    fastcgi_index index.php;
-                    fastcgi_pass unix:${fpm.socket};
-                  '';
+                  extraConfig = # nginx
+                    ''
+                      include ${config.services.nginx.package}/conf/fastcgi.conf;
+                      add_header X-Cache $upstream_cache_status;
+                      fastcgi_ignore_headers "Cache-Control" "Expires" "Set-Cookie";
+                      fastcgi_cache nginx_cache;
+                      fastcgi_cache_valid any 7d;
+                      fastcgi_cache_bypass $no_cache;
+                      fastcgi_no_cache $no_cache;
+                      fastcgi_split_path_info ^(.+\.php)(/.+)$;
+                      fastcgi_index index.php;
+                      fastcgi_pass unix:${fpm.socket};
+                    '';
                 };
                 "/ws/" = {
                   priority = 900;
                   proxyPass = "http://${cfg.settings.DAEMON_INTERFACE}:${builtins.toString cfg.port}/";
                   proxyWebsockets = true;
                   recommendedProxySettings = true;
-                  extraConfig = /* nginx */ ''
-                    proxy_set_header X-Forwarded-Proto $scheme;
-                    proxy_redirect off;
-                  '';
+                  extraConfig = # nginx
+                    ''
+                      proxy_set_header X-Forwarded-Proto $scheme;
+                      proxy_redirect off;
+                    '';
                 };
               };
-              extraConfig = /* ngnix */ ''
-                index index.php;
-              '';
+              extraConfig = # ngnix
+                ''
+                  index index.php;
+                '';
             }
           ];
         }
-      // lib.optionalAttrs (cfg.precompressStaticFiles.gzip.enable) { recommendedGzipSettings = mkDefault true; }
-      // lib.optionalAttrs (cfg.precompressStaticFiles.brotli.enable) { recommendedBrotliSettings = mkDefault true; };
+        // lib.optionalAttrs (cfg.precompressStaticFiles.gzip.enable) {
+          recommendedGzipSettings = mkDefault true;
+        }
+        // lib.optionalAttrs (cfg.precompressStaticFiles.brotli.enable) {
+          recommendedBrotliSettings = mkDefault true;
+        };
 
       mysql = mkIf (cfg.database.createLocally && cfg.database.type == "mysql") {
         enable = mkDefault true;
         package = mkDefault pkgs.mariadb;
         ensureDatabases = [ cfg.database.name ];
-        ensureUsers = [{
-          name = cfg.database.user;
-          ensureDBOwnership = true;
-        }];
+        ensureUsers = [
+          {
+            name = cfg.database.user;
+            ensureDBOwnership = true;
+          }
+        ];
       };
 
       postgresql = mkIf (cfg.database.createLocally && cfg.database.type == "postgresql") {
         enable = mkDefault true;
         ensureDatabases = [ cfg.database.name ];
-        ensureUsers = [{
-          name = cfg.database.user;
-          ensureDBOwnership = true;
-        }];
+        ensureUsers = [
+          {
+            name = cfg.database.user;
+            ensureDBOwnership = true;
+          }
+        ];
         authentication = ''
           host ${cfg.database.name} ${cfg.database.user} localhost trust
         '';
@@ -596,10 +685,7 @@ in
 
       phpfpm.pools.${pool} =
         let
-          socketOwner =
-            if (cfg.nginx != null)
-            then config.services.nginx.user
-            else cfg.user;
+          socketOwner = if (cfg.nginx != null) then config.services.nginx.user else cfg.user;
         in
         {
           phpPackage = package.php;
@@ -629,56 +715,59 @@ in
         after = lib.optional cfg.database.createLocally dbService;
         requires = lib.optional cfg.database.createLocally dbService;
 
-        serviceConfig = {
-          Type = "oneshot";
-          User = cfg.user;
-          Group = cfg.group;
-          UMask = "077";
-        } // lib.optionalAttrs (cfg.secretFile != null) {
-          LoadCredential = "env-secrets:${cfg.secretFile}";
-        };
+        serviceConfig =
+          {
+            Type = "oneshot";
+            User = cfg.user;
+            Group = cfg.group;
+            UMask = "077";
+          }
+          // lib.optionalAttrs (cfg.secretFile != null) {
+            LoadCredential = "env-secrets:${cfg.secretFile}";
+          };
 
-        script = /* sh */ ''
-          # Env vars
-          rm -f ${cfg.dataDir}/.env
-          cp --no-preserve=all ${configFile} ${cfg.dataDir}/.env
-          echo -e '\n' >> ${cfg.dataDir}/.env
-          if [[ -f "$CREDENTIALS_DIRECTORY/env-secrets"  ]]; then
-            cat "$CREDENTIALS_DIRECTORY/env-secrets" >> ${cfg.dataDir}/.env
+        script = # sh
+          ''
+            # Env vars
+            rm -f ${cfg.dataDir}/.env
+            cp --no-preserve=all ${configFile} ${cfg.dataDir}/.env
             echo -e '\n' >> ${cfg.dataDir}/.env
-          fi
+            if [[ -f "$CREDENTIALS_DIRECTORY/env-secrets"  ]]; then
+              cat "$CREDENTIALS_DIRECTORY/env-secrets" >> ${cfg.dataDir}/.env
+              echo -e '\n' >> ${cfg.dataDir}/.env
+            fi
 
-          # Caches, logs
-          mkdir -p ${cfg.dataDir}/public/cache ${cfg.logDir} ${cfg.runtimeDir}/cache
-          chmod -R ug+rw ${cfg.dataDir}/public/cache
-          chmod -R ug+rw ${cfg.logDir}
-          chmod -R ug+rwx ${cfg.runtimeDir}/cache
+            # Caches, logs
+            mkdir -p ${cfg.dataDir}/public/cache ${cfg.logDir} ${cfg.runtimeDir}/cache
+            chmod -R ug+rw ${cfg.dataDir}/public/cache
+            chmod -R ug+rw ${cfg.logDir}
+            chmod -R ug+rwx ${cfg.runtimeDir}/cache
 
-          # Migrations
-          MOVIM_VERSION="${package.version}"
-          if [[ ! -f "${cfg.dataDir}/.migration-version" ]] || [[ "$MOVIM_VERSION" != "$(<${cfg.dataDir}/.migration-version)" ]]; then
-            ${package}/bin/movim-composer movim:migrate && echo $MOVIM_VERSION > ${cfg.dataDir}/.migration-version
-          fi
-        ''
-        + lib.optionalString (podConfigFlags != "") (
-          let
-            flags = lib.concatStringsSep " "
-              ([ "--no-interaction" ]
+            # Migrations
+            MOVIM_VERSION="${package.version}"
+            if [[ ! -f "${cfg.dataDir}/.migration-version" ]] || [[ "$MOVIM_VERSION" != "$(<${cfg.dataDir}/.migration-version)" ]]; then
+              ${package}/bin/movim-composer movim:migrate && echo $MOVIM_VERSION > ${cfg.dataDir}/.migration-version
+            fi
+          ''
+          + lib.optionalString (podConfigFlags != "") (
+            let
+              flags = lib.concatStringsSep " " (
+                [ "--no-interaction" ]
                 ++ lib.optional cfg.debug "-vvv"
-                ++ lib.optional (!cfg.debug && cfg.verbose) "-v");
-          in
-          ''
-            ${lib.getExe package} config ${podConfigFlags}
-          ''
-        );
+                ++ lib.optional (!cfg.debug && cfg.verbose) "-v"
+              );
+            in
+            ''
+              ${lib.getExe package} config ${podConfigFlags}
+            ''
+          );
       };
 
       services.movim = {
         description = "Movim daemon";
         wantedBy = [ "multi-user.target" ];
         after = [ "movim-data-setup.service" ];
-        requires = [ "movim-data-setup.service" ]
-          ++ lib.optional cfg.database.createLocally dbService;
+        requires = [ "movim-data-setup.service" ] ++ lib.optional cfg.database.createLocally dbService;
         environment = {
           PUBLIC_URL = "//${cfg.domain}";
           WS_PORT = builtins.toString cfg.port;
@@ -694,17 +783,34 @@ in
 
       services.${phpExecutionUnit} = {
         after = [ "movim-data-setup.service" ];
-        requires = [ "movim-data-setup.service" ]
-          ++ lib.optional cfg.database.createLocally dbService;
+        requires = [ "movim-data-setup.service" ] ++ lib.optional cfg.database.createLocally dbService;
       };
 
       tmpfiles.settings."10-movim" = with cfg; {
-        "${dataDir}".d = { inherit user group; mode = "0710"; };
-        "${dataDir}/public".d = { inherit user group; mode = "0750"; };
-        "${dataDir}/public/cache".d = { inherit user group; mode = "0750"; };
-        "${runtimeDir}".d = { inherit user group; mode = "0700"; };
-        "${runtimeDir}/cache".d = { inherit user group; mode = "0700"; };
-        "${logDir}".d = { inherit user group; mode = "0700"; };
+        "${dataDir}".d = {
+          inherit user group;
+          mode = "0710";
+        };
+        "${dataDir}/public".d = {
+          inherit user group;
+          mode = "0750";
+        };
+        "${dataDir}/public/cache".d = {
+          inherit user group;
+          mode = "0750";
+        };
+        "${runtimeDir}".d = {
+          inherit user group;
+          mode = "0700";
+        };
+        "${runtimeDir}/cache".d = {
+          inherit user group;
+          mode = "0700";
+        };
+        "${logDir}".d = {
+          inherit user group;
+          mode = "0700";
+        };
       };
     };
   };

nixos/modules/services/web-apps/nextcloud-notify_push.nix

@@ -78,60 +78,75 @@ in
     );
 
   config = lib.mkIf cfg.enable {
-    systemd.services.nextcloud-notify_push = {
-      description = "Push daemon for Nextcloud clients";
-      documentation = [ "https://github.com/nextcloud/notify_push" ];
-      after = [
-        "phpfpm-nextcloud.service"
-        "redis-nextcloud.service"
-      ];
-      wantedBy = [ "multi-user.target" ];
-      environment = {
-        NEXTCLOUD_URL = cfg.nextcloudUrl;
-        SOCKET_PATH = cfg.socketPath;
-        DATABASE_PREFIX = cfg.dbtableprefix;
-        LOG = cfg.logLevel;
+    systemd.services = {
+      nextcloud-notify_push = {
+        description = "Push daemon for Nextcloud clients";
+        documentation = [ "https://github.com/nextcloud/notify_push" ];
+        after = [
+          "phpfpm-nextcloud.service"
+          "redis-nextcloud.service"
+        ];
+        wantedBy = [ "multi-user.target" ];
+        environment = {
+          NEXTCLOUD_URL = cfg.nextcloudUrl;
+          SOCKET_PATH = cfg.socketPath;
+          DATABASE_PREFIX = cfg.dbtableprefix;
+          LOG = cfg.logLevel;
+        };
+        script =
+          let
+            dbType = if cfg.dbtype == "pgsql" then "postgresql" else cfg.dbtype;
+            dbUser = lib.optionalString (cfg.dbuser != null) cfg.dbuser;
+            dbPass = lib.optionalString (cfg.dbpassFile != null) ":$DATABASE_PASSWORD";
+            dbHostHasPrefix = prefix: lib.hasPrefix prefix (toString cfg.dbhost);
+            isPostgresql = dbType == "postgresql";
+            isMysql = dbType == "mysql";
+            isSocket = (isPostgresql && dbHostHasPrefix "/") || (isMysql && dbHostHasPrefix "localhost:/");
+            dbHost = lib.optionalString (cfg.dbhost != null) (
+              if isSocket then lib.optionalString isMysql "@localhost" else "@${cfg.dbhost}"
+            );
+            dbOpts = lib.optionalString (cfg.dbhost != null && isSocket) (
+              if isPostgresql then
+                "?host=${cfg.dbhost}"
+              else if isMysql then
+                "?socket=${lib.removePrefix "localhost:" cfg.dbhost}"
+              else
+                throw "unsupported dbtype"
+            );
+            dbName = lib.optionalString (cfg.dbname != null) "/${cfg.dbname}";
+            dbUrl = "${dbType}://${dbUser}${dbPass}${dbHost}${dbName}${dbOpts}";
+          in
+          lib.optionalString (cfg.dbpassFile != null) ''
+            export DATABASE_PASSWORD="$(<"$CREDENTIALS_DIRECTORY/dbpass")"
+          ''
+          + ''
+            export DATABASE_URL="${dbUrl}"
+            exec ${cfg.package}/bin/notify_push '${cfgN.datadir}/config/config.php'
+          '';
+        serviceConfig = {
+          User = "nextcloud";
+          Group = "nextcloud";
+          RuntimeDirectory = [ "nextcloud-notify_push" ];
+          Restart = "on-failure";
+          RestartSec = "5s";
+          Type = "notify";
+          LoadCredential = lib.optional (cfg.dbpassFile != null) "dbpass:${cfg.dbpassFile}";
+        };
       };
-      postStart = ''
-        ${cfgN.occ}/bin/nextcloud-occ notify_push:setup ${cfg.nextcloudUrl}/push
-      '';
-      script =
-        let
-          dbType = if cfg.dbtype == "pgsql" then "postgresql" else cfg.dbtype;
-          dbUser = lib.optionalString (cfg.dbuser != null) cfg.dbuser;
-          dbPass = lib.optionalString (cfg.dbpassFile != null) ":$DATABASE_PASSWORD";
-          dbHostHasPrefix = prefix: lib.hasPrefix prefix (toString cfg.dbhost);
-          isPostgresql = dbType == "postgresql";
-          isMysql = dbType == "mysql";
-          isSocket = (isPostgresql && dbHostHasPrefix "/") || (isMysql && dbHostHasPrefix "localhost:/");
-          dbHost = lib.optionalString (cfg.dbhost != null) (
-            if isSocket then lib.optionalString isMysql "@localhost" else "@${cfg.dbhost}"
-          );
-          dbOpts = lib.optionalString (cfg.dbhost != null && isSocket) (
-            if isPostgresql then
-              "?host=${cfg.dbhost}"
-            else if isMysql then
-              "?socket=${lib.removePrefix "localhost:" cfg.dbhost}"
-            else
-              throw "unsupported dbtype"
-          );
-          dbName = lib.optionalString (cfg.dbname != null) "/${cfg.dbname}";
-          dbUrl = "${dbType}://${dbUser}${dbPass}${dbHost}${dbName}${dbOpts}";
-        in
-        lib.optionalString (dbPass != "") ''
-          export DATABASE_PASSWORD="$(<"${cfg.dbpassFile}")"
-        ''
-        + ''
-          export DATABASE_URL="${dbUrl}"
-          exec ${cfg.package}/bin/notify_push '${cfgN.datadir}/config/config.php'
-        '';
-      serviceConfig = {
-        User = "nextcloud";
-        Group = "nextcloud";
-        RuntimeDirectory = [ "nextcloud-notify_push" ];
-        Restart = "on-failure";
-        RestartSec = "5s";
-        Type = "notify";
+
+      nextcloud-notify_push_setup = {
+        wantedBy = [ "multi-user.target" ];
+        requiredBy = [ "nextcloud-notify_push.service" ];
+        after = [ "nextcloud-notify_push.service" ];
+        serviceConfig = {
+          Type = "oneshot";
+          User = "nextcloud";
+          Group = "nextcloud";
+          ExecStart = "${lib.getExe cfgN.occ} notify_push:setup ${cfg.nextcloudUrl}/push";
+          LoadCredential = config.systemd.services.nextcloud-cron.serviceConfig.LoadCredential;
+          RestartMode = "direct";
+          Restart = "on-failure";
+        };
       };
     };
 

nixos/modules/services/web-apps/nextcloud.nix

@@ -85,18 +85,60 @@ let
     "-dmemory_limit=${cfg.cli.memoryLimit}"
   ]);
 
-  occ = pkgs.writeScriptBin "nextcloud-occ" ''
-    #! ${pkgs.runtimeShell}
-    cd ${webroot}
-    sudo=exec
-    if [[ "$USER" != nextcloud ]]; then
-      sudo='exec /run/wrappers/bin/sudo -u nextcloud'
-    fi
-    $sudo ${pkgs.coreutils}/bin/env \
-      NEXTCLOUD_CONFIG_DIR="${datadir}/config" \
-      ${phpCli} \
-      occ "$@"
-  '';
+  # NOTE: The credentials required by all services at runtime, not including things like the
+  #       admin password which is only needed by the setup service.
+  runtimeSystemdCredentials = []
+    ++ (lib.optional (cfg.config.dbpassFile != null) "dbpass:${cfg.config.dbpassFile}")
+    ++ (lib.optional (cfg.config.objectstore.s3.enable) "s3_secret:${cfg.config.objectstore.s3.secretFile}")
+    ++ (lib.optional (cfg.config.objectstore.s3.sseCKeyFile != null) "s3_sse_c_key:${cfg.config.objectstore.s3.sseCKeyFile}");
+
+  requiresRuntimeSystemdCredentials = (lib.length runtimeSystemdCredentials) != 0;
+
+  occ = pkgs.writeShellApplication {
+    name = "nextcloud-occ";
+
+    text = let
+      command = ''
+        ${lib.getExe' pkgs.coreutils "env"} \
+          NEXTCLOUD_CONFIG_DIR="${datadir}/config" \
+          ${phpCli} \
+          occ "$@"
+      '';
+    in ''
+      cd ${webroot}
+
+      # NOTE: This is templated at eval time
+      requiresRuntimeSystemdCredentials=${lib.boolToString requiresRuntimeSystemdCredentials}
+
+      # NOTE: This wrapper is both used in the internal nextcloud service units
+      #       and by users outside a service context for administration. As such,
+      #       when there's an existing CREDENTIALS_DIRECTORY, we inherit it for use
+      #       in the nix_read_secret() php function.
+      #       When there's no CREDENTIALS_DIRECTORY we try to use systemd-run to
+      #       load the credentials just as in a service unit.
+      # NOTE: If there are no credentials that are required at runtime then there's no need
+      #       to load any credentials.
+      if [[ $requiresRuntimeSystemdCredentials == true && -z "''${CREDENTIALS_DIRECTORY:-}" ]]; then
+        exec ${lib.getExe' config.systemd.package "systemd-run"} \
+          ${lib.escapeShellArgs (map (credential: "--property=LoadCredential=${credential}") runtimeSystemdCredentials)} \
+          --uid=nextcloud \
+          --same-dir \
+          --pty \
+          --wait \
+          --collect \
+          --service-type=exec \
+          --quiet \
+          ${command}
+      elif [[ "$USER" != nextcloud ]]; then
+        exec /run/wrappers/bin/sudo \
+          --preserve-env=CREDENTIALS_DIRECTORY \
+          --user=nextcloud \
+          ${command}
+      else
+        exec ${command}
+      fi
+    '';
+  };
 
   inherit (config.system) stateVersion;
 
@@ -120,13 +162,13 @@ let
           'bucket' => '${s3.bucket}',
           'autocreate' => ${boolToString s3.autocreate},
           'key' => '${s3.key}',
-          'secret' => nix_read_secret('${s3.secretFile}'),
+          'secret' => nix_read_secret('s3_secret'),
           ${optionalString (s3.hostname != null) "'hostname' => '${s3.hostname}',"}
           ${optionalString (s3.port != null) "'port' => ${toString s3.port},"}
           'use_ssl' => ${boolToString s3.useSsl},
           ${optionalString (s3.region != null) "'region' => '${s3.region}',"}
           'use_path_style' => ${boolToString s3.usePathStyle},
-          ${optionalString (s3.sseCKeyFile != null) "'sse_c_key' => nix_read_secret('${s3.sseCKeyFile}'),"}
+          ${optionalString (s3.sseCKeyFile != null) "'sse_c_key' => nix_read_secret('s3_sse_c_key'),"}
         ],
       ]
     '';
@@ -143,16 +185,26 @@ let
   in pkgs.writeText "nextcloud-config.php" ''
     <?php
     ${optionalString requiresReadSecretFunction ''
-      function nix_read_secret($file) {
-        if (!file_exists($file)) {
-          throw new \RuntimeException(sprintf(
-            "Cannot start Nextcloud, secret file %s set by NixOS doesn't seem to "
-            . "exist! Please make sure that the file exists and has appropriate "
-            . "permissions for user & group 'nextcloud'!",
-            $file
+      function nix_read_secret($credential_name) {
+        $credentials_directory = getenv("CREDENTIALS_DIRECTORY");
+        if (!$credentials_directory) {
+          error_log(sprintf(
+            "Cannot read credential '%s' passed by NixOS, \$CREDENTIALS_DIRECTORY is not set!",
+            $credential_name
           ));
+          exit(1);
         }
-        return trim(file_get_contents($file));
+
+        $credential_path = $credentials_directory . "/" . $credential_name;
+        if (!is_readable($credential_path)) {
+          error_log(sprintf(
+            "Cannot read credential '%s' passed by NixOS, it does not exist or is not readable!",
+            $credential_path,
+          ));
+          exit(1);
+        }
+
+        return trim(file_get_contents($credential_path));
       }''}
     function nix_decode_json_file($file, $error) {
       if (!file_exists($file)) {
@@ -176,12 +228,7 @@ let
       ${optionalString (c.dbhost != null) "'dbhost' => '${c.dbhost}',"}
       ${optionalString (c.dbuser != null) "'dbuser' => '${c.dbuser}',"}
       ${optionalString (c.dbtableprefix != null) "'dbtableprefix' => '${toString c.dbtableprefix}',"}
-      ${optionalString (c.dbpassFile != null) ''
-          'dbpassword' => nix_read_secret(
-            "${c.dbpassFile}"
-          ),
-        ''
-      }
+      ${optionalString (c.dbpassFile != null) "'dbpassword' => nix_read_secret('dbpass'),"}
       'dbtype' => '${c.dbtype}',
       ${objectstoreConfig}
     ];
@@ -490,9 +537,8 @@ in {
       adminpassFile = mkOption {
         type = types.str;
         description = ''
-          The full path to a file that contains the admin's password. Must be
-          readable by user `nextcloud`. The password is set only in the initial
-          setup of Nextcloud by the systemd service `nextcloud-setup.service`.
+          The full path to a file that contains the admin's password. The password is
+          set only in the initial setup of Nextcloud by the systemd service `nextcloud-setup.service`.
         '';
       };
       objectstore = {
@@ -530,8 +576,7 @@ in {
             type = types.str;
             example = "/var/nextcloud-objectstore-s3-secret";
             description = ''
-              The full path to a file that contains the access secret. Must be
-              readable by user `nextcloud`.
+              The full path to a file that contains the access secret.
             '';
           };
           hostname = mkOption {
@@ -592,8 +637,6 @@ in {
               openssl rand 32 | base64
               ```
 
-              Must be readable by user `nextcloud`.
-
               [1]: https://docs.aws.amazon.com/AmazonS3/latest/userguide/ServerSideEncryptionCustomerKeys.html
             '';
           };
@@ -944,11 +987,6 @@ in {
       services.nextcloud.finalPackage = webroot;
 
       systemd.services = {
-        # When upgrading the Nextcloud package, Nextcloud can report errors such as
-        # "The files of the app [all apps in /var/lib/nextcloud/apps] were not replaced correctly"
-        # Restarting phpfpm on Nextcloud package update fixes these issues (but this is a workaround).
-        phpfpm-nextcloud.restartTriggers = [ webroot overrideConfig ];
-
         nextcloud-setup = let
           c = cfg.config;
           occInstallCmd = let
@@ -959,12 +997,12 @@ in {
             dbpass = {
               arg = "DBPASS";
               value = if c.dbpassFile != null
-                then ''"$(<"${toString c.dbpassFile}")"''
+                then ''"$(<"$CREDENTIALS_DIRECTORY/dbpass")"''
                 else ''""'';
             };
             adminpass = {
               arg = "ADMINPASS";
-              value = ''"$(<"${toString c.adminpassFile}")"'';
+              value = ''"$(<"$CREDENTIALS_DIRECTORY/adminpass")"'';
             };
             installFlags = concatStringsSep " \\\n    "
               (mapAttrsToList (k: v: "${k} ${toString v}") {
@@ -983,12 +1021,12 @@ in {
           in ''
             ${mkExport dbpass}
             ${mkExport adminpass}
-            ${occ}/bin/nextcloud-occ maintenance:install \
+            ${lib.getExe occ} maintenance:install \
                 ${installFlags}
           '';
           occSetTrustedDomainsCmd = concatStringsSep "\n" (imap0
             (i: v: ''
-              ${occ}/bin/nextcloud-occ config:system:set trusted_domains \
+              ${lib.getExe occ} config:system:set trusted_domains \
                 ${toString i} --value="${toString v}"
             '') ([ cfg.hostName ] ++ cfg.settings.trusted_domains));
 
@@ -1002,20 +1040,12 @@ in {
           restartTriggers = [ overrideConfig ];
           script = ''
             ${optionalString (c.dbpassFile != null) ''
-              if [ ! -r "${c.dbpassFile}" ]; then
-                echo "dbpassFile ${c.dbpassFile} is not readable by nextcloud:nextcloud! Aborting..."
-                exit 1
-              fi
-              if [ -z "$(<${c.dbpassFile})" ]; then
+              if [ -z "$(<$CREDENTIALS_DIRECTORY/dbpass)" ]; then
                 echo "dbpassFile ${c.dbpassFile} is empty!"
                 exit 1
               fi
             ''}
-            if [ ! -r "${c.adminpassFile}" ]; then
-              echo "adminpassFile ${c.adminpassFile} is not readable by nextcloud:nextcloud! Aborting..."
-              exit 1
-            fi
-            if [ -z "$(<${c.adminpassFile})" ]; then
+            if [ -z "$(<$CREDENTIALS_DIRECTORY/adminpass)" ]; then
               echo "adminpassFile ${c.adminpassFile} is empty!"
               exit 1
             fi
@@ -1032,57 +1062,102 @@ in {
               ${occInstallCmd}
             fi
 
-            ${occ}/bin/nextcloud-occ upgrade
+            ${lib.getExe occ} upgrade
 
-            ${occ}/bin/nextcloud-occ config:system:delete trusted_domains
+            ${lib.getExe occ} config:system:delete trusted_domains
 
             ${optionalString (cfg.extraAppsEnable && cfg.extraApps != { }) ''
                 # Try to enable apps
-                ${occ}/bin/nextcloud-occ app:enable ${concatStringsSep " " (attrNames cfg.extraApps)}
+                ${lib.getExe occ} app:enable ${concatStringsSep " " (attrNames cfg.extraApps)}
             ''}
 
             ${occSetTrustedDomainsCmd}
           '';
           serviceConfig.Type = "oneshot";
           serviceConfig.User = "nextcloud";
+          serviceConfig.LoadCredential = [ "adminpass:${cfg.config.adminpassFile}" ] ++ runtimeSystemdCredentials;
           # On Nextcloud ≥ 26, it is not necessary to patch the database files to prevent
           # an automatic creation of the database user.
           environment.NC_setup_create_db_user = lib.mkIf (nextcloudGreaterOrEqualThan "26") "false";
         };
         nextcloud-cron = {
           after = [ "nextcloud-setup.service" ];
+          # NOTE: In contrast to the occ wrapper script running phpCli directly will not
+          #       set NEXTCLOUD_CONFIG_DIR by itself currently.
           environment.NEXTCLOUD_CONFIG_DIR = "${datadir}/config";
+          script = ''
+            # NOTE: This early returns the script when nextcloud is in maintenance mode
+            #       or needs `occ upgrade`. Using ExecCondition= is not possible here
+            #       because it doesn't work with systemd credentials.
+            if [[ $(${lib.getExe occ} status --output=json | ${lib.getExe pkgs.jq} '. | if .maintenance or .needsDbUpgrade then "skip" else "" end' --raw-output) == "skip" ]]; then
+              echo "Nextcloud is in maintenance mode or needs DB upgrade, exiting."
+              exit 0
+            fi
+
+            ${phpCli} -f ${webroot}/cron.php
+          '';
           serviceConfig = {
             Type = "exec";
             User = "nextcloud";
-            ExecCondition = "${phpCli} -f ${webroot}/occ status -e";
-            ExecStart = "${phpCli} -f ${webroot}/cron.php";
             KillMode = "process";
+            LoadCredential = runtimeSystemdCredentials;
           };
         };
         nextcloud-update-plugins = mkIf cfg.autoUpdateApps.enable {
           after = [ "nextcloud-setup.service" ];
           serviceConfig = {
             Type = "oneshot";
-            ExecStart = "${occ}/bin/nextcloud-occ app:update --all";
+            ExecStart = "${lib.getExe occ} app:update --all";
             User = "nextcloud";
+            LoadCredential = runtimeSystemdCredentials;
           };
           startAt = cfg.autoUpdateApps.startAt;
         };
         nextcloud-update-db = {
           after = [ "nextcloud-setup.service" ];
-          environment.NEXTCLOUD_CONFIG_DIR = "${datadir}/config";
           script = ''
-            ${occ}/bin/nextcloud-occ db:add-missing-columns
-            ${occ}/bin/nextcloud-occ db:add-missing-indices
-            ${occ}/bin/nextcloud-occ db:add-missing-primary-keys
+            # NOTE: This early returns the script when nextcloud is in maintenance mode
+            #       or needs `occ upgrade`. Using ExecCondition= is not possible here
+            #       because it doesn't work with systemd credentials.
+            if [[ $(${lib.getExe occ} status --output=json | ${lib.getExe pkgs.jq} '. | if .maintenance or .needsDbUpgrade then "skip" else "" end' --raw-output) == "skip" ]]; then
+              echo "Nextcloud is in maintenance mode or needs DB upgrade, exiting."
+              exit 0
+            fi
+
+            ${lib.getExe occ} db:add-missing-columns
+            ${lib.getExe occ} db:add-missing-indices
+            ${lib.getExe occ} db:add-missing-primary-keys
           '';
           serviceConfig = {
             Type = "exec";
             User = "nextcloud";
-            ExecCondition = "${phpCli} -f ${webroot}/occ status -e";
+            LoadCredential = runtimeSystemdCredentials;
           };
         };
+
+        phpfpm-nextcloud = {
+          # When upgrading the Nextcloud package, Nextcloud can report errors such as
+          # "The files of the app [all apps in /var/lib/nextcloud/apps] were not replaced correctly"
+          # Restarting phpfpm on Nextcloud package update fixes these issues (but this is a workaround).
+          restartTriggers = [ webroot overrideConfig ];
+        } // lib.optionalAttrs requiresRuntimeSystemdCredentials {
+          serviceConfig.LoadCredential = runtimeSystemdCredentials;
+
+          # FIXME: We use a hack to make the credential files readable by the nextcloud
+          #        user by copying them somewhere else and overriding CREDENTIALS_DIRECTORY
+          #        for php. This is currently necessary as the unit runs as root.
+          serviceConfig.RuntimeDirectory = lib.mkForce "phpfpm phpfpm-nextcloud";
+          preStart = ''
+            umask 0077
+
+            # NOTE: Runtime directories for this service are currently preserved
+            #       between restarts.
+            rm -rf /run/phpfpm-nextcloud/credentials/
+            mkdir -p /run/phpfpm-nextcloud/credentials/
+            cp "$CREDENTIALS_DIRECTORY"/* /run/phpfpm-nextcloud/credentials/
+            chown -R nextcloud:nextcloud /run/phpfpm-nextcloud/credentials/
+          '';
+        };
       };
 
       services.phpfpm = {
@@ -1091,6 +1166,7 @@ in {
           group = "nextcloud";
           phpPackage = phpPackage;
           phpEnv = {
+            CREDENTIALS_DIRECTORY = "/run/phpfpm-nextcloud/credentials/";
             NEXTCLOUD_CONFIG_DIR = "${datadir}/config";
             PATH = "/run/wrappers/bin:/nix/var/nix/profiles/default/bin:/run/current-system/sw/bin:/usr/bin:/bin";
           };

nixos/tests/evcc.nix

@@ -1,5 +1,8 @@
 { pkgs, lib, ... }:
 
+let
+  port = "1234";
+in
 {
   name = "evcc";
   meta.maintainers = with lib.maintainers; [ hexa ];
@@ -8,11 +11,15 @@
     machine = {
       services.evcc = {
         enable = true;
+        # This is NOT a safe way to deal with secrets in production
+        environmentFile = pkgs.writeText "evcc-secrets" ''
+          PORT=${toString port}
+        '';
         settings = {
           network = {
             schema = "http";
             host = "localhost";
-            port = 7070;
+            port = "$PORT";
           };
 
           log = "info";
@@ -82,14 +89,14 @@
     start_all()
 
     machine.wait_for_unit("evcc.service")
-    machine.wait_for_open_port(7070)
+    machine.wait_for_open_port(${port})
 
     with subtest("Check package version propagates into frontend"):
         machine.fail(
-            "curl --fail http://localhost:7070 | grep '0.0.1-alpha'"
+            "curl --fail http://localhost:${port} | grep '0.0.1-alpha'"
         )
         machine.succeed(
-            "curl --fail http://localhost:7070 | grep '${pkgs.evcc.version}'"
+            "curl --fail http://localhost:${port} | grep '${pkgs.evcc.version}'"
         )
 
     with subtest("Check journal for errors"):

nixos/tests/nextcloud/basic.nix

@@ -8,10 +8,10 @@
 
 with import ../../lib/testing-python.nix { inherit system pkgs; };
 runTest (
-  { config, ... }:
+  { config, lib, ... }:
   {
     inherit name;
-    meta = with pkgs.lib.maintainers; {
+    meta = with lib.maintainers; {
       maintainers = [
         globin
         eqyiel

nixos/tests/nextcloud/with-declarative-redis-and-secrets.nix

@@ -8,13 +8,13 @@
 
 with import ../../lib/testing-python.nix { inherit system pkgs; };
 runTest (
-  { config, ... }:
+  { config, lib, ... }:
   let
     inherit (config) adminuser;
   in
   {
     inherit name;
-    meta = with pkgs.lib.maintainers; {
+    meta = with lib.maintainers; {
       maintainers = [
         eqyiel
         ma27
@@ -34,6 +34,13 @@ runTest (
               redis = true;
               memcached = false;
             };
+            notify_push = {
+              enable = true;
+              bendDomainToLocalhost = true;
+              logLevel = "debug";
+            };
+            extraAppsEnable = true;
+            extraApps.notify_push = config.services.nextcloud.package.packages.apps.notify_push;
             # This test also validates that we can use an "external" database
             database.createLocally = false;
             config = {
@@ -70,7 +77,7 @@ runTest (
           services.postgresql = {
             enable = true;
           };
-          systemd.services.postgresql.postStart = pkgs.lib.mkAfter ''
+          systemd.services.postgresql.postStart = lib.mkAfter ''
             password=$(cat ${config.services.nextcloud.config.dbpassFile})
             ${config.services.postgresql.package}/bin/psql <<EOF
               CREATE ROLE ${adminuser} WITH LOGIN PASSWORD '$password' CREATEDB;
@@ -95,7 +102,13 @@ runTest (
     test-helpers.extraTests = ''
       with subtest("non-empty redis cache"):
           # redis cache should not be empty
-          nextcloud.fail('test 0 -lt "$(redis-cli --pass secret --json KEYS "*" | jq "len")"')
+          assert nextcloud.succeed('redis-cli --pass secret --json KEYS "*" | jq length').strip() != "0", """
+            redis-cli for keys * returned 0 entries
+          """
+
+      with subtest("notify-push"):
+          client.execute("${lib.getExe pkgs.nextcloud-notify_push.passthru.test_client} http://nextcloud ${config.adminuser} ${config.adminpass} >&2 &")
+          nextcloud.wait_until_succeeds("journalctl -u nextcloud-notify_push | grep -q \"Sending ping to ${config.adminuser}\"")
     '';
   }
 )

nixos/tests/nextcloud/with-mysql-and-memcached.nix

@@ -8,10 +8,10 @@
 
 with import ../../lib/testing-python.nix { inherit system pkgs; };
 runTest (
-  { config, ... }:
+  { config, lib, ... }:
   {
     inherit name;
-    meta = with pkgs.lib.maintainers; {
+    meta = with lib.maintainers; {
       maintainers = [ eqyiel ];
     };
 

nixos/tests/nextcloud/with-objectstore.nix

@@ -20,7 +20,7 @@ runTest (
   in
   {
     inherit name;
-    meta = with pkgs.lib.maintainers; {
+    meta = with lib.maintainers; {
       maintainers = [
         onny
         ma27

nixos/tests/nextcloud/with-postgresql-and-redis.nix

@@ -8,10 +8,10 @@
 
 with import ../../lib/testing-python.nix { inherit system pkgs; };
 runTest (
-  { config, ... }:
+  { config, lib, ... }:
   {
     inherit name;
-    meta = with pkgs.lib.maintainers; {
+    meta = with lib.maintainers; {
       maintainers = [
         eqyiel
         ma27
@@ -29,6 +29,7 @@ runTest (
           ...
         }:
         {
+          environment.systemPackages = [ pkgs.jq ];
           services.nextcloud = {
             caching = {
               apcu = false;
@@ -68,12 +69,14 @@ runTest (
 
     test-helpers.extraTests = ''
       with subtest("notify-push"):
-          client.execute("${pkgs.lib.getExe pkgs.nextcloud-notify_push.passthru.test_client} http://nextcloud ${config.adminuser} ${config.adminpass} >&2 &")
+          client.execute("${lib.getExe pkgs.nextcloud-notify_push.passthru.test_client} http://nextcloud ${config.adminuser} ${config.adminpass} >&2 &")
           nextcloud.wait_until_succeeds("journalctl -u nextcloud-notify_push | grep -q \"Sending ping to ${config.adminuser}\"")
 
       with subtest("Redis is used for caching"):
           # redis cache should not be empty
-          nextcloud.fail('test "[]" = "$(redis-cli --json KEYS "*")"')
+          assert nextcloud.succeed('redis-cli --json KEYS "*" | jq length').strip() != "0", """
+            redis-cli for keys * returned 0 entries
+          """
 
       with subtest("No code is returned when requesting PHP files (regression test)"):
           nextcloud.fail("curl -f http://nextcloud/nix-apps/notes/lib/AppInfo/Application.php")

pkgs/applications/editors/emacs/sources.nix

@@ -155,6 +155,11 @@ in
         name = "inhibit-lexical-cookie-warning-67916.patch";
         path = ./inhibit-lexical-cookie-warning-67916-30.patch;
       })
+      (fetchpatch {
+        # bug#63288 and bug#76523
+        url = "https://git.savannah.gnu.org/cgit/emacs.git/patch/?id=53a5dada413662389a17c551a00d215e51f5049f";
+        hash = "sha256-AEvsQfpdR18z6VroJkWoC3sBoApIYQQgeF/P2DprPQ8=";
+      })
     ];
   });
 

pkgs/applications/editors/jetbrains/bin/versions.json

@@ -11,26 +11,26 @@
     "clion": {
       "update-channel": "CLion RELEASE",
       "url-template": "https://download.jetbrains.com/cpp/CLion-{version}.tar.gz",
-      "version": "2024.3.3",
-      "sha256": "a221d8c602452775df6ff09adad39f2b057a367f7616b7c739df33204b103a4a",
-      "url": "https://download.jetbrains.com/cpp/CLion-2024.3.3.tar.gz",
-      "build_number": "243.24978.55"
+      "version": "2024.3.4",
+      "sha256": "c23b9aeb1fdd9f88ab977186e9e4558cdb9bdb5e498b7716f4255a845f8880fd",
+      "url": "https://download.jetbrains.com/cpp/CLion-2024.3.4.tar.gz",
+      "build_number": "243.25659.42"
     },
     "datagrip": {
       "update-channel": "DataGrip RELEASE",
       "url-template": "https://download.jetbrains.com/datagrip/datagrip-{version}.tar.gz",
-      "version": "2024.3.4",
-      "sha256": "34f20d0aba3b0ecbad39cf2c8fdf326ff8d4abb6202d9cff60a2622cf8b241a2",
-      "url": "https://download.jetbrains.com/datagrip/datagrip-2024.3.4.tar.gz",
-      "build_number": "243.23654.183"
+      "version": "2024.3.5",
+      "sha256": "aafe50930e565e4b94dc6af43140d7bb68b937b8f1dc3d3235d2054071397b0f",
+      "url": "https://download.jetbrains.com/datagrip/datagrip-2024.3.5.tar.gz",
+      "build_number": "243.24978.79"
     },
     "dataspell": {
       "update-channel": "DataSpell RELEASE",
       "url-template": "https://download.jetbrains.com/python/dataspell-{version}.tar.gz",
-      "version": "2024.3.1.1",
-      "sha256": "37e0985cd3bac79cc74962edba726ccdde61101fc4e8876ed060396584332aa3",
-      "url": "https://download.jetbrains.com/python/dataspell-2024.3.1.1.tar.gz",
-      "build_number": "243.22562.236"
+      "version": "2024.3.2",
+      "sha256": "2a59cb71f21f43ff05b385352e51c3670a13dcf2f287034185d4af101880c68f",
+      "url": "https://download.jetbrains.com/python/dataspell-2024.3.2.tar.gz",
+      "build_number": "243.25659.44"
     },
     "gateway": {
       "update-channel": "Gateway RELEASE",
@@ -43,91 +43,91 @@
     "goland": {
       "update-channel": "GoLand RELEASE",
       "url-template": "https://download.jetbrains.com/go/goland-{version}.tar.gz",
-      "version": "2024.3.3",
-      "sha256": "fb0908ce2b4e43222758cc5c9b7498677f924271ca5d9a790e794e8ade28177d",
-      "url": "https://download.jetbrains.com/go/goland-2024.3.3.tar.gz",
-      "build_number": "243.24978.59"
+      "version": "2024.3.4",
+      "sha256": "f474f1f19fb04f7de73596c51b49f2675b3fc11df6a7aaba325c3ad98477d1df",
+      "url": "https://download.jetbrains.com/go/goland-2024.3.4.tar.gz",
+      "build_number": "243.25659.52"
     },
     "idea-community": {
       "update-channel": "IntelliJ IDEA RELEASE",
       "url-template": "https://download.jetbrains.com/idea/ideaIC-{version}.tar.gz",
-      "version": "2024.3.3",
-      "sha256": "ae3c45fe515fef672f52ce5c4701bc40a5f82cb94f21fed2c6e66c22e3dc91db",
-      "url": "https://download.jetbrains.com/idea/ideaIC-2024.3.3.tar.gz",
-      "build_number": "243.24978.46"
+      "version": "2024.3.4",
+      "sha256": "c6cf5f591854d29e4005549188b04a8174ce07a922b4d54150182f813bbaadf5",
+      "url": "https://download.jetbrains.com/idea/ideaIC-2024.3.4.tar.gz",
+      "build_number": "243.25659.39"
     },
     "idea-ultimate": {
       "update-channel": "IntelliJ IDEA RELEASE",
       "url-template": "https://download.jetbrains.com/idea/ideaIU-{version}.tar.gz",
-      "version": "2024.3.3",
-      "sha256": "9860a8d2a15c1033a8fcac9ffdabd797403318b516b63fdee474fa82ff0d738d",
-      "url": "https://download.jetbrains.com/idea/ideaIU-2024.3.3.tar.gz",
-      "build_number": "243.24978.46"
+      "version": "2024.3.4",
+      "sha256": "3765f4619f7ab8c28a6d523f741a4492d31d7d7d9ac8f5e7d8212dd2a71fdf9c",
+      "url": "https://download.jetbrains.com/idea/ideaIU-2024.3.4.tar.gz",
+      "build_number": "243.25659.39"
     },
     "mps": {
       "update-channel": "MPS RELEASE",
       "url-template": "https://download.jetbrains.com/mps/{versionMajorMinor}/MPS-{version}.tar.gz",
-      "version": "2024.3",
-      "sha256": "449048a9cdb944d4c3addf8156545c363be237ceb2b6f8516d72cb53eb00a37c",
-      "url": "https://download.jetbrains.com/mps/2024.3/MPS-2024.3.tar.gz",
-      "build_number": "243.21565.447"
+      "version": "2024.3.1",
+      "sha256": "b0e1f7bbc56ddf706510a420783418bc61e80bc4ea3c23ae60fb09cee846f01b",
+      "url": "https://download.jetbrains.com/mps/2024.3/MPS-2024.3.1.tar.gz",
+      "build_number": "243.24978.546"
     },
     "phpstorm": {
       "update-channel": "PhpStorm RELEASE",
       "url-template": "https://download.jetbrains.com/webide/PhpStorm-{version}.tar.gz",
-      "version": "2024.3.3",
-      "sha256": "274001fc0e628ed9b5496f24da11d3e97f07b0fe3f45303235c37d124121a14a",
-      "url": "https://download.jetbrains.com/webide/PhpStorm-2024.3.3.tar.gz",
-      "build_number": "243.24978.50",
+      "version": "2024.3.4",
+      "sha256": "9344d68dda2c0062d9f6f03e27e959346f2f2bba2bce9f1c108653090d2dfb85",
+      "url": "https://download.jetbrains.com/webide/PhpStorm-2024.3.4.tar.gz",
+      "build_number": "243.25659.45",
       "version-major-minor": "2022.3"
     },
     "pycharm-community": {
       "update-channel": "PyCharm RELEASE",
       "url-template": "https://download.jetbrains.com/python/pycharm-community-{version}.tar.gz",
-      "version": "2024.3.3",
-      "sha256": "fbcbb8c5a23f5eabb1ab4b8e66ffb3b00988eab39df0b547c41ffbb1fc13968e",
-      "url": "https://download.jetbrains.com/python/pycharm-community-2024.3.3.tar.gz",
-      "build_number": "243.24978.54"
+      "version": "2024.3.4",
+      "sha256": "c61dd7aa1b5f9c6f7a0943aeec79c56d0aa0f5ed29591b7eb3007169e2545621",
+      "url": "https://download.jetbrains.com/python/pycharm-community-2024.3.4.tar.gz",
+      "build_number": "243.25659.43"
     },
     "pycharm-professional": {
       "update-channel": "PyCharm RELEASE",
       "url-template": "https://download.jetbrains.com/python/pycharm-professional-{version}.tar.gz",
-      "version": "2024.3.3",
-      "sha256": "044029b647711a8b9d3e377e97ee4df8502c1894951981719c9ee0a19d81dbdb",
-      "url": "https://download.jetbrains.com/python/pycharm-professional-2024.3.3.tar.gz",
-      "build_number": "243.24978.54"
+      "version": "2024.3.4",
+      "sha256": "793bfdcbe38251678bc2fe07a026a594efa5af459137fb70dd786edb340c6430",
+      "url": "https://download.jetbrains.com/python/pycharm-professional-2024.3.4.tar.gz",
+      "build_number": "243.25659.43"
     },
     "rider": {
       "update-channel": "Rider RELEASE",
       "url-template": "https://download.jetbrains.com/rider/JetBrains.Rider-{version}.tar.gz",
-      "version": "2024.3.5",
-      "sha256": "f2a78ee6d23eb580bc73f6005f9a069f2785786e0b39c88108d882ab9c9b925f",
-      "url": "https://download.jetbrains.com/rider/JetBrains.Rider-2024.3.5.tar.gz",
-      "build_number": "243.24978.27"
+      "version": "2024.3.6",
+      "sha256": "1f9db9f3f90c71fe476e3e17ac78be9fcc982e3f017c598f631b5cd600e6da43",
+      "url": "https://download.jetbrains.com/rider/JetBrains.Rider-2024.3.6.tar.gz",
+      "build_number": "243.25659.34"
     },
     "ruby-mine": {
       "update-channel": "RubyMine RELEASE",
       "url-template": "https://download.jetbrains.com/ruby/RubyMine-{version}.tar.gz",
-      "version": "2024.3.2.1",
-      "sha256": "94c68e534f420648316867470271d9a3111f3c2afa7fcde6a4e3986058b2cdd2",
-      "url": "https://download.jetbrains.com/ruby/RubyMine-2024.3.2.1.tar.gz",
-      "build_number": "243.23654.167"
+      "version": "2024.3.4",
+      "sha256": "9454aaf0877516b2047bc21517b5459860bdb4cbc797d66612760a336c011ee3",
+      "url": "https://download.jetbrains.com/ruby/RubyMine-2024.3.4.tar.gz",
+      "build_number": "243.25659.41"
     },
     "rust-rover": {
       "update-channel": "RustRover RELEASE",
       "url-template": "https://download.jetbrains.com/rustrover/RustRover-{version}.tar.gz",
-      "version": "2024.3.4",
-      "sha256": "1e7347b37a26715f5afdf101208342e6088d0d8421c9ee1661f48efb38cac8b4",
-      "url": "https://download.jetbrains.com/rustrover/RustRover-2024.3.4.tar.gz",
-      "build_number": "243.23654.180"
+      "version": "2024.3.5",
+      "sha256": "2815a48b28387dea4e3a0eb48a4fd3d903c403e0e8c6e938dee75fccf686e59c",
+      "url": "https://download.jetbrains.com/rustrover/RustRover-2024.3.5.tar.gz",
+      "build_number": "243.24978.86"
     },
     "webstorm": {
       "update-channel": "WebStorm RELEASE",
       "url-template": "https://download.jetbrains.com/webstorm/WebStorm-{version}.tar.gz",
-      "version": "2024.3.2.1",
-      "sha256": "9857bdcd2c05eb215e3974b4df2a5a9b0fc8c1df929d31c9c9dae4c87496de60",
-      "url": "https://download.jetbrains.com/webstorm/WebStorm-2024.3.2.1.tar.gz",
-      "build_number": "243.23654.157"
+      "version": "2024.3.4",
+      "sha256": "206a5e6b6fd3e603d62a7bbb26b0bf3b7ff7939b3e0cd136d360cdb80ec455f8",
+      "url": "https://download.jetbrains.com/webstorm/WebStorm-2024.3.4.tar.gz",
+      "build_number": "243.25659.40"
     },
     "writerside": {
       "update-channel": "Writerside EAP",
@@ -150,26 +150,26 @@
     "clion": {
       "update-channel": "CLion RELEASE",
       "url-template": "https://download.jetbrains.com/cpp/CLion-{version}-aarch64.tar.gz",
-      "version": "2024.3.3",
-      "sha256": "c30c7d94c65d093d65099ce5a4e99358972710875d266759263e1f6cb39bb80a",
-      "url": "https://download.jetbrains.com/cpp/CLion-2024.3.3-aarch64.tar.gz",
-      "build_number": "243.24978.55"
+      "version": "2024.3.4",
+      "sha256": "336d19b695392e9a7bf426ae2d93b864ade48216e8df8f96ecfc9b2e9b9afa4f",
+      "url": "https://download.jetbrains.com/cpp/CLion-2024.3.4-aarch64.tar.gz",
+      "build_number": "243.25659.42"
     },
     "datagrip": {
       "update-channel": "DataGrip RELEASE",
       "url-template": "https://download.jetbrains.com/datagrip/datagrip-{version}-aarch64.tar.gz",
-      "version": "2024.3.4",
-      "sha256": "d5ec9d34302baf51efc2450d23efd5ed2384bf9c649900fca56746d89ecf5038",
-      "url": "https://download.jetbrains.com/datagrip/datagrip-2024.3.4-aarch64.tar.gz",
-      "build_number": "243.23654.183"
+      "version": "2024.3.5",
+      "sha256": "20bae6b26f1aa6c88db1779103c8cceacb690caa776d10ef155ef1c17f25f37c",
+      "url": "https://download.jetbrains.com/datagrip/datagrip-2024.3.5-aarch64.tar.gz",
+      "build_number": "243.24978.79"
     },
     "dataspell": {
       "update-channel": "DataSpell RELEASE",
       "url-template": "https://download.jetbrains.com/python/dataspell-{version}-aarch64.tar.gz",
-      "version": "2024.3.1.1",
-      "sha256": "31a564e58285a84b226017f18e658684720aa0a615f068447edbe817e6337f76",
-      "url": "https://download.jetbrains.com/python/dataspell-2024.3.1.1-aarch64.tar.gz",
-      "build_number": "243.22562.236"
+      "version": "2024.3.2",
+      "sha256": "708e2037711b6bcb6e155ce24082d4347c07295250feabb9715366c7da4d45ba",
+      "url": "https://download.jetbrains.com/python/dataspell-2024.3.2-aarch64.tar.gz",
+      "build_number": "243.25659.44"
     },
     "gateway": {
       "update-channel": "Gateway RELEASE",
@@ -182,91 +182,91 @@
     "goland": {
       "update-channel": "GoLand RELEASE",
       "url-template": "https://download.jetbrains.com/go/goland-{version}-aarch64.tar.gz",
-      "version": "2024.3.3",
-      "sha256": "5235a1dfeb4df21f42baa77c2ba47f9c3e2ef2c744bbb3612baa7bc7a33feee0",
-      "url": "https://download.jetbrains.com/go/goland-2024.3.3-aarch64.tar.gz",
-      "build_number": "243.24978.59"
+      "version": "2024.3.4",
+      "sha256": "9e1a8921c92e3cd396d81f9a8011ed279d303565fe69b8c2322dedf9a6164643",
+      "url": "https://download.jetbrains.com/go/goland-2024.3.4-aarch64.tar.gz",
+      "build_number": "243.25659.52"
     },
     "idea-community": {
       "update-channel": "IntelliJ IDEA RELEASE",
       "url-template": "https://download.jetbrains.com/idea/ideaIC-{version}-aarch64.tar.gz",
-      "version": "2024.3.3",
-      "sha256": "9ce7e15135e97e92601654f456a6211127c165b35f62784886c4ec3b466af8f9",
-      "url": "https://download.jetbrains.com/idea/ideaIC-2024.3.3-aarch64.tar.gz",
-      "build_number": "243.24978.46"
+      "version": "2024.3.4",
+      "sha256": "b5b7227d785832bff65243fe9e2517e3645e6d67c8e7640b6b012d05dafddbc9",
+      "url": "https://download.jetbrains.com/idea/ideaIC-2024.3.4-aarch64.tar.gz",
+      "build_number": "243.25659.39"
     },
     "idea-ultimate": {
       "update-channel": "IntelliJ IDEA RELEASE",
       "url-template": "https://download.jetbrains.com/idea/ideaIU-{version}-aarch64.tar.gz",
-      "version": "2024.3.3",
-      "sha256": "e730c61185146c8afc181d058873932dd1ea7ef528d3dc3eaba2d3c4337b6b3b",
-      "url": "https://download.jetbrains.com/idea/ideaIU-2024.3.3-aarch64.tar.gz",
-      "build_number": "243.24978.46"
+      "version": "2024.3.4",
+      "sha256": "6928108d6481f1c827a6a5c994cd225229b9131b53f0c8dc03854aa585006648",
+      "url": "https://download.jetbrains.com/idea/ideaIU-2024.3.4-aarch64.tar.gz",
+      "build_number": "243.25659.39"
     },
     "mps": {
       "update-channel": "MPS RELEASE",
       "url-template": "https://download.jetbrains.com/mps/{versionMajorMinor}/MPS-{version}.tar.gz",
-      "version": "2024.3",
-      "sha256": "449048a9cdb944d4c3addf8156545c363be237ceb2b6f8516d72cb53eb00a37c",
-      "url": "https://download.jetbrains.com/mps/2024.3/MPS-2024.3.tar.gz",
-      "build_number": "243.21565.447"
+      "version": "2024.3.1",
+      "sha256": "b0e1f7bbc56ddf706510a420783418bc61e80bc4ea3c23ae60fb09cee846f01b",
+      "url": "https://download.jetbrains.com/mps/2024.3/MPS-2024.3.1.tar.gz",
+      "build_number": "243.24978.546"
     },
     "phpstorm": {
       "update-channel": "PhpStorm RELEASE",
       "url-template": "https://download.jetbrains.com/webide/PhpStorm-{version}-aarch64.tar.gz",
-      "version": "2024.3.3",
-      "sha256": "933472aab8dbf1f27ad04c32d2f5857f14f252a1bd75a4cbeb9d0a6864ee58e8",
-      "url": "https://download.jetbrains.com/webide/PhpStorm-2024.3.3-aarch64.tar.gz",
-      "build_number": "243.24978.50",
+      "version": "2024.3.4",
+      "sha256": "061dcd7f2972d4d9efc74cce29950929e1fdd02531e1f6365551649c8a254b1a",
+      "url": "https://download.jetbrains.com/webide/PhpStorm-2024.3.4-aarch64.tar.gz",
+      "build_number": "243.25659.45",
       "version-major-minor": "2022.3"
     },
     "pycharm-community": {
       "update-channel": "PyCharm RELEASE",
       "url-template": "https://download.jetbrains.com/python/pycharm-community-{version}-aarch64.tar.gz",
-      "version": "2024.3.3",
-      "sha256": "8a2c6064ac71769164f896ab4a6a72fffcadd6350875d43dbcf45ff853b6e5ce",
-      "url": "https://download.jetbrains.com/python/pycharm-community-2024.3.3-aarch64.tar.gz",
-      "build_number": "243.24978.54"
+      "version": "2024.3.4",
+      "sha256": "6cd540a586692f8784e0889ad83ce497eaf3052a3a319b9d53fa9594572409ee",
+      "url": "https://download.jetbrains.com/python/pycharm-community-2024.3.4-aarch64.tar.gz",
+      "build_number": "243.25659.43"
     },
     "pycharm-professional": {
       "update-channel": "PyCharm RELEASE",
       "url-template": "https://download.jetbrains.com/python/pycharm-professional-{version}-aarch64.tar.gz",
-      "version": "2024.3.3",
-      "sha256": "96108ca87d9def71143f88bf72033811cfe32812e0755f5778b4335a47353038",
-      "url": "https://download.jetbrains.com/python/pycharm-professional-2024.3.3-aarch64.tar.gz",
-      "build_number": "243.24978.54"
+      "version": "2024.3.4",
+      "sha256": "d4755118db79ff68be149619a2e0b8d480dd56694de131228a7d5ebbd0f82240",
+      "url": "https://download.jetbrains.com/python/pycharm-professional-2024.3.4-aarch64.tar.gz",
+      "build_number": "243.25659.43"
     },
     "rider": {
       "update-channel": "Rider RELEASE",
       "url-template": "https://download.jetbrains.com/rider/JetBrains.Rider-{version}-aarch64.tar.gz",
-      "version": "2024.3.5",
-      "sha256": "572be78c88f925d35ec4521f1459780774c523c59a6257db2be4a465abb4088e",
-      "url": "https://download.jetbrains.com/rider/JetBrains.Rider-2024.3.5-aarch64.tar.gz",
-      "build_number": "243.24978.27"
+      "version": "2024.3.6",
+      "sha256": "f8c459c77327e97812507ba4724e6e9911e918425f5a187707cb66efafa47c45",
+      "url": "https://download.jetbrains.com/rider/JetBrains.Rider-2024.3.6-aarch64.tar.gz",
+      "build_number": "243.25659.34"
     },
     "ruby-mine": {
       "update-channel": "RubyMine RELEASE",
       "url-template": "https://download.jetbrains.com/ruby/RubyMine-{version}-aarch64.tar.gz",
-      "version": "2024.3.2.1",
-      "sha256": "eacd0a8b9c8e5445bc52bac7094667b6d9f1973d951ae47878ced4af97c95a0b",
-      "url": "https://download.jetbrains.com/ruby/RubyMine-2024.3.2.1-aarch64.tar.gz",
-      "build_number": "243.23654.167"
+      "version": "2024.3.4",
+      "sha256": "c63ca3230cecd887e9810500f466c51ee9d7430193f4feda315a6fdfc60c0447",
+      "url": "https://download.jetbrains.com/ruby/RubyMine-2024.3.4-aarch64.tar.gz",
+      "build_number": "243.25659.41"
     },
     "rust-rover": {
       "update-channel": "RustRover RELEASE",
       "url-template": "https://download.jetbrains.com/rustrover/RustRover-{version}-aarch64.tar.gz",
-      "version": "2024.3.4",
-      "sha256": "a1b3626907930d32f256d14598e1013ce6999fae28a61f71013be2a7e7c52a1d",
-      "url": "https://download.jetbrains.com/rustrover/RustRover-2024.3.4-aarch64.tar.gz",
-      "build_number": "243.23654.180"
+      "version": "2024.3.5",
+      "sha256": "00b097ca83268d06dbccffec7fdbaee788cdd683c65b4f0b5fd80aa01e22e92d",
+      "url": "https://download.jetbrains.com/rustrover/RustRover-2024.3.5-aarch64.tar.gz",
+      "build_number": "243.24978.86"
     },
     "webstorm": {
       "update-channel": "WebStorm RELEASE",
       "url-template": "https://download.jetbrains.com/webstorm/WebStorm-{version}-aarch64.tar.gz",
-      "version": "2024.3.2.1",
-      "sha256": "82ba3c43848e8a16ce2b9c4df4d8b3e8717e42b46328cebdcf09a51545b6a24e",
-      "url": "https://download.jetbrains.com/webstorm/WebStorm-2024.3.2.1-aarch64.tar.gz",
-      "build_number": "243.23654.157"
+      "version": "2024.3.4",
+      "sha256": "498efb5b3e79a0f71dc7f44f54a2155a17b5d53d8b7a71ae6aaef87abc59bfce",
+      "url": "https://download.jetbrains.com/webstorm/WebStorm-2024.3.4-aarch64.tar.gz",
+      "build_number": "243.25659.40"
     },
     "writerside": {
       "update-channel": "Writerside EAP",
@@ -289,26 +289,26 @@
     "clion": {
       "update-channel": "CLion RELEASE",
       "url-template": "https://download.jetbrains.com/cpp/CLion-{version}.dmg",
-      "version": "2024.3.3",
-      "sha256": "a5c50b3d615e93ee3461a420bb151b1af31a1f21356333522f4211f7c34bdc3e",
-      "url": "https://download.jetbrains.com/cpp/CLion-2024.3.3.dmg",
-      "build_number": "243.24978.55"
+      "version": "2024.3.4",
+      "sha256": "e92dc5ba5a2c59d09e3751de60ed31b0af012210f8381ffd1c5c3e254cc11718",
+      "url": "https://download.jetbrains.com/cpp/CLion-2024.3.4.dmg",
+      "build_number": "243.25659.42"
     },
     "datagrip": {
       "update-channel": "DataGrip RELEASE",
       "url-template": "https://download.jetbrains.com/datagrip/datagrip-{version}.dmg",
-      "version": "2024.3.4",
-      "sha256": "d56e34743ceaa76ee1fb5fa7a9da383dee83789dbab356c6267c912983b57029",
-      "url": "https://download.jetbrains.com/datagrip/datagrip-2024.3.4.dmg",
-      "build_number": "243.23654.183"
+      "version": "2024.3.5",
+      "sha256": "224a58410ef3e067b0c848607d34f5ac180e76ef95ebd1a9f7a34202d36ea278",
+      "url": "https://download.jetbrains.com/datagrip/datagrip-2024.3.5.dmg",
+      "build_number": "243.24978.79"
     },
     "dataspell": {
       "update-channel": "DataSpell RELEASE",
       "url-template": "https://download.jetbrains.com/python/dataspell-{version}.dmg",
-      "version": "2024.3.1.1",
-      "sha256": "eb5fd54f193f2c94de46c91957a4d36eedce8009cd272c5d8e4fc4763d9dafe3",
-      "url": "https://download.jetbrains.com/python/dataspell-2024.3.1.1.dmg",
-      "build_number": "243.22562.236"
+      "version": "2024.3.2",
+      "sha256": "474c8a04a699cd1538b9c1c882d0215a79932ed45baf8f0f3ec3be09e8ec9a1f",
+      "url": "https://download.jetbrains.com/python/dataspell-2024.3.2.dmg",
+      "build_number": "243.25659.44"
     },
     "gateway": {
       "update-channel": "Gateway RELEASE",
@@ -321,91 +321,91 @@
     "goland": {
       "update-channel": "GoLand RELEASE",
       "url-template": "https://download.jetbrains.com/go/goland-{version}.dmg",
-      "version": "2024.3.3",
-      "sha256": "a31af21ba0c08465e815e79c37bf90910af085bdf5f362ebc77e8879b5d18e8d",
-      "url": "https://download.jetbrains.com/go/goland-2024.3.3.dmg",
-      "build_number": "243.24978.59"
+      "version": "2024.3.4",
+      "sha256": "d621d2130f2f4b602c69a1d62c68112fcea189405ce1d7f6cbd75c7584ccf96c",
+      "url": "https://download.jetbrains.com/go/goland-2024.3.4.dmg",
+      "build_number": "243.25659.52"
     },
     "idea-community": {
       "update-channel": "IntelliJ IDEA RELEASE",
       "url-template": "https://download.jetbrains.com/idea/ideaIC-{version}.dmg",
-      "version": "2024.3.3",
-      "sha256": "f5c94cc249e231464e0ad9497e2638d758ed16c6d260bac838cef771d244ea58",
-      "url": "https://download.jetbrains.com/idea/ideaIC-2024.3.3.dmg",
-      "build_number": "243.24978.46"
+      "version": "2024.3.4",
+      "sha256": "bc8944def81cc68b3920fbdfd8a880307c255fb0241b61c8816ec065f3657241",
+      "url": "https://download.jetbrains.com/idea/ideaIC-2024.3.4.dmg",
+      "build_number": "243.25659.39"
     },
     "idea-ultimate": {
       "update-channel": "IntelliJ IDEA RELEASE",
       "url-template": "https://download.jetbrains.com/idea/ideaIU-{version}.dmg",
-      "version": "2024.3.3",
-      "sha256": "c48b52537f23c3fe9647406beee4e2c7af2fcd39008d69beef0627b7d4b63c38",
-      "url": "https://download.jetbrains.com/idea/ideaIU-2024.3.3.dmg",
-      "build_number": "243.24978.46"
+      "version": "2024.3.4",
+      "sha256": "2b4a62df4b4735c3a8d5ea0baba390f89d6a2342b561658d94310a767b17ba8b",
+      "url": "https://download.jetbrains.com/idea/ideaIU-2024.3.4.dmg",
+      "build_number": "243.25659.39"
     },
     "mps": {
       "update-channel": "MPS RELEASE",
       "url-template": "https://download.jetbrains.com/mps/{versionMajorMinor}/MPS-{version}-macos.dmg",
-      "version": "2024.3",
-      "sha256": "a5476c8aa604f3c37c192a5301eebf1c33d2ae733be018f485f3bf48d2a52366",
-      "url": "https://download.jetbrains.com/mps/2024.3/MPS-2024.3-macos.dmg",
-      "build_number": "243.21565.447"
+      "version": "2024.3.1",
+      "sha256": "a36d46d6a29f5f86991b1d1e8272bbc27bf00a2c5e562fe7fb3f95075badc85c",
+      "url": "https://download.jetbrains.com/mps/2024.3/MPS-2024.3.1-macos.dmg",
+      "build_number": "243.24978.546"
     },
     "phpstorm": {
       "update-channel": "PhpStorm RELEASE",
       "url-template": "https://download.jetbrains.com/webide/PhpStorm-{version}.dmg",
-      "version": "2024.3.3",
-      "sha256": "358f3a161ef31279bd7bc44325266864d57f79a00e5b5139a9cd52caa76e66da",
-      "url": "https://download.jetbrains.com/webide/PhpStorm-2024.3.3.dmg",
-      "build_number": "243.24978.50",
+      "version": "2024.3.4",
+      "sha256": "32c0e7faaeb6c90c25192688d9f03c888f7bb957c91796713783b41805c65956",
+      "url": "https://download.jetbrains.com/webide/PhpStorm-2024.3.4.dmg",
+      "build_number": "243.25659.45",
       "version-major-minor": "2022.3"
     },
     "pycharm-community": {
       "update-channel": "PyCharm RELEASE",
       "url-template": "https://download.jetbrains.com/python/pycharm-community-{version}.dmg",
-      "version": "2024.3.3",
-      "sha256": "b32d12edbc56c4bfb071bc13a657499db1294d727a020017874b4da60f9b0e9a",
-      "url": "https://download.jetbrains.com/python/pycharm-community-2024.3.3.dmg",
-      "build_number": "243.24978.54"
+      "version": "2024.3.4",
+      "sha256": "468914b3f03f8df651a9ac48df163b1fdee2b7f33ab64a71bed899da5427feab",
+      "url": "https://download.jetbrains.com/python/pycharm-community-2024.3.4.dmg",
+      "build_number": "243.25659.43"
     },
     "pycharm-professional": {
       "update-channel": "PyCharm RELEASE",
       "url-template": "https://download.jetbrains.com/python/pycharm-professional-{version}.dmg",
-      "version": "2024.3.3",
-      "sha256": "b31ed5d07c435146df5a48b5c77caf5b635396ebb023c8acd7ebbd76b8901cde",
-      "url": "https://download.jetbrains.com/python/pycharm-professional-2024.3.3.dmg",
-      "build_number": "243.24978.54"
+      "version": "2024.3.4",
+      "sha256": "7441c8878953c6e46177d9a99d09b328f7c2d493b4f1967ea67276f2f8f9f025",
+      "url": "https://download.jetbrains.com/python/pycharm-professional-2024.3.4.dmg",
+      "build_number": "243.25659.43"
     },
     "rider": {
       "update-channel": "Rider RELEASE",
       "url-template": "https://download.jetbrains.com/rider/JetBrains.Rider-{version}.dmg",
-      "version": "2024.3.5",
-      "sha256": "1ae18866cb007a1133aba937f1c46a98de7e3f881a23da3b6ad736a38e3500f7",
-      "url": "https://download.jetbrains.com/rider/JetBrains.Rider-2024.3.5.dmg",
-      "build_number": "243.24978.27"
+      "version": "2024.3.6",
+      "sha256": "1677f8b1274149407799ba025f6a9316749a7b8d86ba142f77c807b52874f9fa",
+      "url": "https://download.jetbrains.com/rider/JetBrains.Rider-2024.3.6.dmg",
+      "build_number": "243.25659.34"
     },
     "ruby-mine": {
       "update-channel": "RubyMine RELEASE",
       "url-template": "https://download.jetbrains.com/ruby/RubyMine-{version}.dmg",
-      "version": "2024.3.2.1",
-      "sha256": "93b58637964adbb7b8be9f69f64546cdf66420c3f4b9ef8548a0a3cf6c80b9c7",
-      "url": "https://download.jetbrains.com/ruby/RubyMine-2024.3.2.1.dmg",
-      "build_number": "243.23654.167"
+      "version": "2024.3.4",
+      "sha256": "8cb255a6b66f77c5233cb2dd4c47cd4c8564c48cee3b1bb40128677a93cc39c8",
+      "url": "https://download.jetbrains.com/ruby/RubyMine-2024.3.4.dmg",
+      "build_number": "243.25659.41"
     },
     "rust-rover": {
       "update-channel": "RustRover RELEASE",
       "url-template": "https://download.jetbrains.com/rustrover/RustRover-{version}.dmg",
-      "version": "2024.3.4",
-      "sha256": "8a883cc59218904bdc21facf08719e4afb5f8d4c160742bf242d6dba1a35ae57",
-      "url": "https://download.jetbrains.com/rustrover/RustRover-2024.3.4.dmg",
-      "build_number": "243.23654.180"
+      "version": "2024.3.5",
+      "sha256": "eeaf1a2f88ffd5404d699dd0ea1dc9c6037649db797f0b333ea5f2b66875db5b",
+      "url": "https://download.jetbrains.com/rustrover/RustRover-2024.3.5.dmg",
+      "build_number": "243.24978.86"
     },
     "webstorm": {
       "update-channel": "WebStorm RELEASE",
       "url-template": "https://download.jetbrains.com/webstorm/WebStorm-{version}.dmg",
-      "version": "2024.3.2.1",
-      "sha256": "89a4fc730cdba15d09146d15e9f7fededef2f9ef10a748a386aaddaeb56cbe27",
-      "url": "https://download.jetbrains.com/webstorm/WebStorm-2024.3.2.1.dmg",
-      "build_number": "243.23654.157"
+      "version": "2024.3.4",
+      "sha256": "337f80f0a5a9179b64ac4552a89ffc93a1e3f1b5c8a1b94a04a9cad9d0d18808",
+      "url": "https://download.jetbrains.com/webstorm/WebStorm-2024.3.4.dmg",
+      "build_number": "243.25659.40"
     },
     "writerside": {
       "update-channel": "Writerside EAP",
@@ -428,26 +428,26 @@
     "clion": {
       "update-channel": "CLion RELEASE",
       "url-template": "https://download.jetbrains.com/cpp/CLion-{version}-aarch64.dmg",
-      "version": "2024.3.3",
-      "sha256": "6784b68f9c827a5cacd9247376b17229a8ce6514a6142caa96ceb9df2f47fd0d",
-      "url": "https://download.jetbrains.com/cpp/CLion-2024.3.3-aarch64.dmg",
-      "build_number": "243.24978.55"
+      "version": "2024.3.4",
+      "sha256": "e9d601aaed26d8efa82137649acb24c24fdc8d555c42afa9226ed08d3a19fe4d",
+      "url": "https://download.jetbrains.com/cpp/CLion-2024.3.4-aarch64.dmg",
+      "build_number": "243.25659.42"
     },
     "datagrip": {
       "update-channel": "DataGrip RELEASE",
       "url-template": "https://download.jetbrains.com/datagrip/datagrip-{version}-aarch64.dmg",
-      "version": "2024.3.4",
-      "sha256": "d968a1fcb1f34b59ce06103e05b20a582346e5cc81c3cf3f799dfc8940e7d79b",
-      "url": "https://download.jetbrains.com/datagrip/datagrip-2024.3.4-aarch64.dmg",
-      "build_number": "243.23654.183"
+      "version": "2024.3.5",
+      "sha256": "1ba33de8b5595a7ab3ab683ed21200c6c884c7c9299a9dfe4414ae29b219dc09",
+      "url": "https://download.jetbrains.com/datagrip/datagrip-2024.3.5-aarch64.dmg",
+      "build_number": "243.24978.79"
     },
     "dataspell": {
       "update-channel": "DataSpell RELEASE",
       "url-template": "https://download.jetbrains.com/python/dataspell-{version}-aarch64.dmg",
-      "version": "2024.3.1.1",
-      "sha256": "cd2d146b54036d657b68343efb9c5f7cf234353f5ffdc9af85e05f63dbf7777c",
-      "url": "https://download.jetbrains.com/python/dataspell-2024.3.1.1-aarch64.dmg",
-      "build_number": "243.22562.236"
+      "version": "2024.3.2",
+      "sha256": "172a8641249784afe4f73359adb1419c2eb8b00bddfa4182bf691e44b3c4baa4",
+      "url": "https://download.jetbrains.com/python/dataspell-2024.3.2-aarch64.dmg",
+      "build_number": "243.25659.44"
     },
     "gateway": {
       "update-channel": "Gateway RELEASE",
@@ -460,91 +460,91 @@
     "goland": {
       "update-channel": "GoLand RELEASE",
       "url-template": "https://download.jetbrains.com/go/goland-{version}-aarch64.dmg",
-      "version": "2024.3.3",
-      "sha256": "a66df6461724bcd1b2d4ada74ae4fafced3cfb6f9e2206554d786655cb067cc3",
-      "url": "https://download.jetbrains.com/go/goland-2024.3.3-aarch64.dmg",
-      "build_number": "243.24978.59"
+      "version": "2024.3.4",
+      "sha256": "4c5e5f50b9209f673ed165c4c1fcb1bc88f4fd3ab2f4ad9740bc8855bb6f4e22",
+      "url": "https://download.jetbrains.com/go/goland-2024.3.4-aarch64.dmg",
+      "build_number": "243.25659.52"
     },
     "idea-community": {
       "update-channel": "IntelliJ IDEA RELEASE",
       "url-template": "https://download.jetbrains.com/idea/ideaIC-{version}-aarch64.dmg",
-      "version": "2024.3.3",
-      "sha256": "02c436d5cbccee9ac9f2aa50f8254d9352b971296322a3b8efbcb990298b98d0",
-      "url": "https://download.jetbrains.com/idea/ideaIC-2024.3.3-aarch64.dmg",
-      "build_number": "243.24978.46"
+      "version": "2024.3.4",
+      "sha256": "bb5b4dc13f4a7ae5fc1416a54ad65ed7e682ea478aee68b1f7c3d3c70426e136",
+      "url": "https://download.jetbrains.com/idea/ideaIC-2024.3.4-aarch64.dmg",
+      "build_number": "243.25659.39"
     },
     "idea-ultimate": {
       "update-channel": "IntelliJ IDEA RELEASE",
       "url-template": "https://download.jetbrains.com/idea/ideaIU-{version}-aarch64.dmg",
-      "version": "2024.3.3",
-      "sha256": "d20b880918218b5dd75812a34817d4016f1109a23977f1de8aaf1fbad89ad06e",
-      "url": "https://download.jetbrains.com/idea/ideaIU-2024.3.3-aarch64.dmg",
-      "build_number": "243.24978.46"
+      "version": "2024.3.4",
+      "sha256": "2ce20f6414baf15283d745aea06bcd44213e5b3e0940f8485d1b92e446ca9262",
+      "url": "https://download.jetbrains.com/idea/ideaIU-2024.3.4-aarch64.dmg",
+      "build_number": "243.25659.39"
     },
     "mps": {
       "update-channel": "MPS RELEASE",
       "url-template": "https://download.jetbrains.com/mps/{versionMajorMinor}/MPS-{version}-macos-aarch64.dmg",
-      "version": "2024.3",
-      "url": "https://download.jetbrains.com/mps/2024.3/MPS-2024.3-macos-aarch64.dmg",
-      "sha256": "9c7118db757ba4fa7b6725efa5b006f4e6db47ca2b2948a92e43c435329c9c79",
-      "build_number": "243.21565.447"
+      "version": "2024.3.1",
+      "url": "https://download.jetbrains.com/mps/2024.3/MPS-2024.3.1-macos-aarch64.dmg",
+      "sha256": "d5000f7309d36ce65929bcdc85b36f543cadb2a5cc2f0675b35edb69489bde8e",
+      "build_number": "243.24978.546"
     },
     "phpstorm": {
       "update-channel": "PhpStorm RELEASE",
       "url-template": "https://download.jetbrains.com/webide/PhpStorm-{version}-aarch64.dmg",
-      "version": "2024.3.3",
-      "sha256": "48bee7b2dd008ab5fe81052336da2030ac45f6a2de9e2650005f3f3edddb0204",
-      "url": "https://download.jetbrains.com/webide/PhpStorm-2024.3.3-aarch64.dmg",
-      "build_number": "243.24978.50",
+      "version": "2024.3.4",
+      "sha256": "9f5586b202165002f8ecbb6b6ffa332d6116c605eb487e49d50ba4d6b68b8785",
+      "url": "https://download.jetbrains.com/webide/PhpStorm-2024.3.4-aarch64.dmg",
+      "build_number": "243.25659.45",
       "version-major-minor": "2022.3"
     },
     "pycharm-community": {
       "update-channel": "PyCharm RELEASE",
       "url-template": "https://download.jetbrains.com/python/pycharm-community-{version}-aarch64.dmg",
-      "version": "2024.3.3",
-      "sha256": "4737c340527ebe7b434010d21aac57b3e23625739a06130d7b1058773a2306a9",
-      "url": "https://download.jetbrains.com/python/pycharm-community-2024.3.3-aarch64.dmg",
-      "build_number": "243.24978.54"
+      "version": "2024.3.4",
+      "sha256": "b8f585ff95cfa31a97db3ba98ff84843455b0a89790ea4abbcc8da05c6fa6f4d",
+      "url": "https://download.jetbrains.com/python/pycharm-community-2024.3.4-aarch64.dmg",
+      "build_number": "243.25659.43"
     },
     "pycharm-professional": {
       "update-channel": "PyCharm RELEASE",
       "url-template": "https://download.jetbrains.com/python/pycharm-professional-{version}-aarch64.dmg",
-      "version": "2024.3.3",
-      "sha256": "9ae7ed7aac293c86db6b7210ff8a53099b4a76d017fc76c24a8b5f73109cacbb",
-      "url": "https://download.jetbrains.com/python/pycharm-professional-2024.3.3-aarch64.dmg",
-      "build_number": "243.24978.54"
+      "version": "2024.3.4",
+      "sha256": "243d94467cfaeccbfcb21976d2bcf262beb31a9d52bb2cf8c6ab998987e4e49c",
+      "url": "https://download.jetbrains.com/python/pycharm-professional-2024.3.4-aarch64.dmg",
+      "build_number": "243.25659.43"
     },
     "rider": {
       "update-channel": "Rider RELEASE",
       "url-template": "https://download.jetbrains.com/rider/JetBrains.Rider-{version}-aarch64.dmg",
-      "version": "2024.3.5",
-      "sha256": "e0b1a2b44c9943b2fa00536ee9f311c5738d711dad60bba6b779dc75fb3d8113",
-      "url": "https://download.jetbrains.com/rider/JetBrains.Rider-2024.3.5-aarch64.dmg",
-      "build_number": "243.24978.27"
+      "version": "2024.3.6",
+      "sha256": "bf3f08040194b1280a857886ac40c6518f83b40f60a6ee990d348a7e14b2c023",
+      "url": "https://download.jetbrains.com/rider/JetBrains.Rider-2024.3.6-aarch64.dmg",
+      "build_number": "243.25659.34"
     },
     "ruby-mine": {
       "update-channel": "RubyMine RELEASE",
       "url-template": "https://download.jetbrains.com/ruby/RubyMine-{version}-aarch64.dmg",
-      "version": "2024.3.2.1",
-      "sha256": "68235be97430c0e2e18b7bdc997604b63c092fa9f0e6529f11d488c44167fb51",
-      "url": "https://download.jetbrains.com/ruby/RubyMine-2024.3.2.1-aarch64.dmg",
-      "build_number": "243.23654.167"
+      "version": "2024.3.4",
+      "sha256": "7d93ff5df263a1526c0cb901e6df2abee547f9e9116f355cfc13a93a20b8ea4a",
+      "url": "https://download.jetbrains.com/ruby/RubyMine-2024.3.4-aarch64.dmg",
+      "build_number": "243.25659.41"
     },
     "rust-rover": {
       "update-channel": "RustRover RELEASE",
       "url-template": "https://download.jetbrains.com/rustrover/RustRover-{version}-aarch64.dmg",
-      "version": "2024.3.4",
-      "sha256": "32687e28d478ec052444578c4625d441265896e3e297c46b5474d2050663ad37",
-      "url": "https://download.jetbrains.com/rustrover/RustRover-2024.3.4-aarch64.dmg",
-      "build_number": "243.23654.180"
+      "version": "2024.3.5",
+      "sha256": "0f1c0470eaf046daeb1f1a3a1fa23a90dad94b8b3479d377600e38e4bae14e10",
+      "url": "https://download.jetbrains.com/rustrover/RustRover-2024.3.5-aarch64.dmg",
+      "build_number": "243.24978.86"
     },
     "webstorm": {
       "update-channel": "WebStorm RELEASE",
       "url-template": "https://download.jetbrains.com/webstorm/WebStorm-{version}-aarch64.dmg",
-      "version": "2024.3.2.1",
-      "sha256": "cc69e6ec0ecf8ecfae47afd17240637a89da8a51a3f77698bd08c611b8d1a9e8",
-      "url": "https://download.jetbrains.com/webstorm/WebStorm-2024.3.2.1-aarch64.dmg",
-      "build_number": "243.23654.157"
+      "version": "2024.3.4",
+      "sha256": "7e7745429e3541bd6cfaffda84aba4bcfe252db5cf93c7b2e2c75205217af57a",
+      "url": "https://download.jetbrains.com/webstorm/WebStorm-2024.3.4-aarch64.dmg",
+      "build_number": "243.25659.40"
     },
     "writerside": {
       "update-channel": "Writerside EAP",

pkgs/applications/editors/jetbrains/default.nix

@@ -403,8 +403,6 @@ rec {
               xargs patchelf \
                 --replace-needed libssl.so.10 libssl.so \
                 --replace-needed libcrypto.so.10 libcrypto.so
-
-              chmod +x $PWD/plugins/intellij-rust/bin/linux/*/intellij-rust-native-helper
             )
           '';
       });

pkgs/applications/editors/vscode/extensions/default.nix

@@ -391,8 +391,8 @@ let
         mktplcRef = {
           name = "astro-vscode";
           publisher = "astro-build";
-          version = "2.10.2";
-          hash = "sha256-lmqbZnCpkNN+i877hURRkPuRtuxRKD29bDppGBAEMGs=";
+          version = "2.15.4";
+          hash = "sha256-gpDbEasdrpY9Djd6g9lUYXcMFZRBMn7P4wW0/iU+qz8=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/astro-build.astro-vscode/changelog";
@@ -1085,26 +1085,26 @@ let
             sources = {
               "x86_64-linux" = {
                 arch = "linux-x64";
-                hash = "sha256-+/0ZQkRS6AD8u5+t2hiPwQxzwhEc+n2F0GVk1s0n74U=";
+                hash = "sha256-0NSmyu+whQOSqaYQIt2C651k5CW1D9zmdn+0aLJF+CQ=";
               };
               "x86_64-darwin" = {
                 arch = "darwin-x64";
-                hash = "sha256-FZbTBPn12pv9bQWqfWwPapFLTpp5nclp0RH/WZc6/r4=";
+                hash = "sha256-Ek5WswTcrHHC3E3zABYz1afC3oic7msq5ddSBLT2+dY=";
               };
               "aarch64-linux" = {
                 arch = "linux-arm64";
-                hash = "sha256-e6zfflFgxVuikWwQuU6ImEuVk8xgi2HyY8uZwBoQiLU=";
+                hash = "sha256-e/vVKvOdt+mHp9gs+Kse13aFWX6DELeUtPdYLeuh9hE=";
               };
               "aarch64-darwin" = {
                 arch = "darwin-arm64";
-                hash = "sha256-SfA9wkvYT2Vb3GpJRjWE6lzZAXdFCnEKoKl0hjT0Llw=";
+                hash = "sha256-1oJ41WBlVUm7AUIwsIOyoucx9EtkReG8pxpYqgdZx5w=";
               };
             };
           in
           {
             name = "continue";
             publisher = "Continue";
-            version = "0.8.54";
+            version = "0.8.68";
           }
           // sources.${stdenv.system};
         nativeBuildInputs = lib.optionals stdenv.hostPlatform.isLinux [ autoPatchelfHook ];
@@ -1272,8 +1272,8 @@ let
         mktplcRef = {
           name = "vscode-markdownlint";
           publisher = "DavidAnson";
-          version = "0.56.0";
-          hash = "sha256-ITSpPe032XcGIlfRQtJSR0iNTizs85qwfRaTtKwNn50=";
+          version = "0.58.2";
+          hash = "sha256-YAlh5aZN4wqmlyfV+HSOYwmLrrC8SRe8AnYwtSqbtlE=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/DavidAnson.vscode-markdownlint/changelog";
@@ -1651,8 +1651,8 @@ let
         mktplcRef = {
           name = "EditorConfig";
           publisher = "EditorConfig";
-          version = "0.16.4";
-          sha256 = "0fa4h9hk1xq6j3zfxvf483sbb4bd17fjl5cdm3rll7z9kaigdqwg";
+          version = "0.17.0";
+          hash = "sha256-/NW/0KYVF0sCgat21aR/5nbVyoTHpDoqCPz+6zc0HHs=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/EditorConfig.EditorConfig/changelog";
@@ -2105,8 +2105,8 @@ let
           publisher = "github";
           name = "copilot";
           # Verify which version is available with nix run nixpkgs#vsce -- show github.copilot --json
-          version = "1.275.0"; # compatible with vscode ^1.97
-          hash = "sha256-pxH8hHRN36/ggqfMWOUYxANrblJ6S5GfslN15ZttumQ=";
+          version = "1.279.1416"; # compatible with vscode ^1.97
+          hash = "sha256-t6d+YkOElpeggwZ86VDftVz2bjDx5Rl/yOn5L5+1R/g=";
         };
 
         meta = {
@@ -2123,8 +2123,8 @@ let
           publisher = "github";
           name = "copilot-chat";
           # Verify which version is available with nix run nixpkgs#vsce -- show github.copilot-chat --json
-          version = "0.24.2025021302"; # latest compatible with vscode ^1.97
-          hash = "sha256-+lb+fo5PvEvWrQlyMi72SJ8bVwd8zTU2tDK+jJJSkPA=";
+          version = "0.26.2025030506"; # latest compatible with vscode ^1.98
+          hash = "sha256-mCmZs5xGxcqHyo8NyMjk2mu9LmxFlMb2NGUwjXg27JA=";
         };
         meta = {
           description = "GitHub Copilot Chat is a companion extension to GitHub Copilot that houses experimental chat features";
@@ -2810,6 +2810,8 @@ let
         };
       };
 
+      johnpapa.winteriscoming = callPackage ./johnpapa.winteriscoming { };
+
       jgclark.vscode-todo-highlight = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "vscode-todo-highlight";
@@ -4105,7 +4107,11 @@ let
           hash = "sha256-3cuonI98gVFE/GwPA7QCA1LfSC8oXqgtV4i6iOngwhk=";
         };
         meta = {
+          description = "YAML Language Support by Red Hat, with built-in Kubernetes syntax support";
+          downloadPage = "https://marketplace.visualstudio.com/items?itemName=redhat.vscode-yaml";
+          homepage = "https://github.com/redhat-developer/vscode-yaml";
           license = lib.licenses.mit;
+          maintainers = [ lib.maintainers.raroh73 ];
         };
       };
 

pkgs/applications/editors/vscode/extensions/johnpapa.winteriscoming/default.nix

@@ -0,0 +1,17 @@
+{ lib, vscode-utils }:
+
+vscode-utils.buildVscodeMarketplaceExtension {
+  mktplcRef = {
+    name = "winteriscoming";
+    publisher = "johnpapa";
+    version = "1.4.4";
+    hash = "sha256-47zCB7VDj+gYXUeblbNsWnGMJt4U4UMyqU1NYTmz2Jc=";
+  };
+  meta = {
+    description = "Preferred dark/light themes by John Papa";
+    downloadPage = "https://marketplace.visualstudio.com/items?itemName=johnpapa.winteriscoming";
+    homepage = "https://github.com/johnpapa/vscode-winteriscoming";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.therobot2105 ];
+  };
+}

pkgs/applications/misc/meerk40t/default.nix

@@ -9,14 +9,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "MeerK40t";
-  version = "0.9.7010";
+  version = "0.9.7020";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "meerk40t";
     repo = pname;
     tag = version;
-    hash = "sha256-pH1sVY8YVpg4gHU8/K87QcR7bGKgblRp2HpgKkb3+NQ=";
+    hash = "sha256-mdl/zW53OM3MtyFoWbTI1yGY2yW72mglO5djHqKx4Fw=";
   };
 
   nativeBuildInputs =

pkgs/applications/networking/browsers/chromium/common.nix

@@ -479,18 +479,11 @@ let
         # Rebased variant of patch to build M126+ with LLVM 17.
         # staging-next will bump LLVM to 18, so we will be able to drop this soon.
         ./patches/chromium-126-llvm-17.patch
-      ]
-      ++ lib.optionals (versionRange "126" "129") [
         # Partial revert of https://github.com/chromium/chromium/commit/3687976b0c6d36cf4157419a24a39f6770098d61
         # allowing us to use our rustc and our clang.
-        # Rebased variant of patch right above to build M126+ with our rust and our clang.
-        ./patches/chromium-126-rust.patch
-      ]
-      ++ lib.optionals (chromiumVersionAtLeast "129") [
-        # Rebased variant of patch right above to build M129+ with our rust and our clang.
         ./patches/chromium-129-rust.patch
       ]
-      ++ lib.optionals (chromiumVersionAtLeast "130" && !ungoogled) [
+      ++ lib.optionals (!ungoogled) [
         # Our rustc.llvmPackages is too old for std::hardware_destructive_interference_size
         # and std::hardware_constructive_interference_size.
         # So let's revert the change for now and hope that our rustc.llvmPackages and

pkgs/applications/networking/browsers/chromium/default.nix

@@ -77,27 +77,23 @@ let
         pulseSupport
         ungoogled
         ;
-      gnChromium = buildPackages.gn.overrideAttrs (
-        oldAttrs:
-        {
-          version = if (upstream-info.deps.gn ? "version") then upstream-info.deps.gn.version else "0";
-          src = fetchgit {
-            url = "https://gn.googlesource.com/gn";
-            inherit (upstream-info.deps.gn) rev hash;
-          };
+      gnChromium = buildPackages.gn.overrideAttrs (oldAttrs: {
+        version = if (upstream-info.deps.gn ? "version") then upstream-info.deps.gn.version else "0";
+        src = fetchgit {
+          url = "https://gn.googlesource.com/gn";
+          inherit (upstream-info.deps.gn) rev hash;
+        };
 
-          # Relax hardening as otherwise gn unstable 2024-06-06 and later fail with:
-          # cc1plus: error: '-Wformat-security' ignored without '-Wformat' [-Werror=format-security]
-          hardeningDisable = [ "format" ];
-        }
-        // lib.optionalAttrs (chromiumVersionAtLeast "130") {
-          # At the time of writing, gn is at v2024-05-13 and has a backported patch.
-          # This patch appears to be already present in v2024-09-09 (from M130), which
-          # results in the patch not applying and thus failing the build.
-          # As a work around until gn is updated again, we filter specifically that patch out.
-          patches = lib.filter (e: lib.getName e != "LFS64.patch") oldAttrs.patches;
-        }
-      );
+        # Relax hardening as otherwise gn unstable 2024-06-06 and later fail with:
+        # cc1plus: error: '-Wformat-security' ignored without '-Wformat' [-Werror=format-security]
+        hardeningDisable = [ "format" ];
+
+        # At the time of writing, gn is at v2024-05-13 and has a backported patch.
+        # This patch appears to be already present in v2024-09-09 (from M130), which
+        # results in the patch not applying and thus failing the build.
+        # As a work around until gn is updated again, we filter specifically that patch out.
+        patches = lib.filter (e: lib.getName e != "LFS64.patch") oldAttrs.patches;
+      });
     });
 
     browser = callPackage ./browser.nix {

pkgs/applications/networking/browsers/chromium/patches/chromium-126-rust.patch

@@ -1,21 +0,0 @@
-diff --git a/build/config/compiler/BUILD.gn b/build/config/compiler/BUILD.gn
-index 6efe967eb0a1c..2ddae4efacbfa 100644
---- a/build/config/compiler/BUILD.gn
-+++ b/build/config/compiler/BUILD.gn
-@@ -1653,16 +1653,6 @@ config("runtime_library") {
-     configs += [ "//build/config/c++:runtime_library" ]
-   }
- 
--  # Rust and C++ both provide intrinsics for LLVM to call for math operations. We
--  # want to use the C++ intrinsics, not the ones in the Rust compiler_builtins
--  # library. The Rust symbols are marked as weak, so that they can be replaced by
--  # the C++ symbols. This config ensures the C++ symbols exist and are strong in
--  # order to cause that replacement to occur by explicitly linking in clang's
--  # compiler-rt library.
--  if (is_clang && toolchain_has_rust) {
--    configs += [ "//build/config/clang:compiler_builtins" ]
--  }
--
-   # TODO(crbug.com/40570904): Come up with a better name for is POSIX + Fuchsia
-   # configuration.
-   if (is_posix || is_fuchsia) {

pkgs/by-name/aa/aapt/package.nix

@@ -52,6 +52,10 @@ stdenvNoCC.mkDerivation rec {
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ linsui ];
     platforms = lib.platforms.unix;
+    badPlatforms = [
+      # The linux executable only supports x86_64
+      "aarch64-linux"
+    ];
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
   };
 }

pkgs/by-name/ab/above/package.nix

@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "above";
-  version = "2.7";
+  version = "2.8";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "casterbyte";
     repo = "Above";
     tag = "v${version}";
-    hash = "sha256-tOSAci9aIALNCL3nLui96EdvqjNxnnuj2/dMdWLY9yI=";
+    hash = "sha256-kG+eaTT72jmeC9R9IKwfd/+9oLAzHLJoKfFJhJDJzDM=";
   };
 
   build-system = with python3.pkgs; [ setuptools ];
@@ -33,7 +33,7 @@ python3.pkgs.buildPythonApplication rec {
   meta = {
     description = "Invisible network protocol sniffer";
     homepage = "https://github.com/casterbyte/Above";
-    changelog = "https://github.com/casterbyte/Above/releases/tag/v${version}";
+    changelog = "https://github.com/casterbyte/Above/releases/tag/${src.tag}";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ fab ];
     mainProgram = "above";

pkgs/by-name/ai/aider-chat/package.nix

@@ -1,3 +1,9 @@
-{ python3Packages }:
+{
+  python3Packages,
+  withPlaywright ? false,
+}:
 
-python3Packages.toPythonApplication python3Packages.aider-chat
+if withPlaywright then
+  python3Packages.toPythonApplication python3Packages.aider-chat.passthru.withPlaywright
+else
+  python3Packages.toPythonApplication python3Packages.aider-chat

pkgs/by-name/al/alire/package.nix

@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "alire";
-  version = "2.0.2";
+  version = "2.1.0";
 
   src = fetchFromGitHub {
     owner = "alire-project";
     repo = "alire";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-m4EPiqh7KCeNgq4G727jrW5ABb+uecvvpmZyskqtml4=";
+    hash = "sha256-DfzCQu9xOe9JgX6RTrYOGTIS6EcPimLnd5pfXMtfRss=";
 
     fetchSubmodules = true;
   };

pkgs/by-name/ca/cartridges/package.nix

@@ -19,14 +19,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "cartridges";
-  version = "2.11";
+  version = "2.11.1";
   pyproject = false;
 
   src = fetchFromGitHub {
     owner = "kra-mo";
     repo = "cartridges";
     tag = "v${version}";
-    hash = "sha256-6v/R83eYq993epcAkcf9jyNakKuGmSsGXrQYQMro6nI=";
+    hash = "sha256-2w7qHTEaRnVDRa0e39Dg9H7pjhgM2UATe8pGYncYILE=";
   };
 
   strictDeps = true;

pkgs/by-name/ca/castero/package.nix

@@ -17,6 +17,7 @@ python3.pkgs.buildPythonApplication rec {
   };
 
   build-system = with python3.pkgs; [
+    setuptools
     wheel
   ];
 
@@ -48,6 +49,11 @@ python3.pkgs.buildPythonApplication rec {
     "test_datafile_download"
     "test_display_get_input_str"
     "test_display_get_y_n"
+    # > assert mymenu.metadata == episode1.metadata
+    # E AssertionError: assert '' == <MagicMock name='mock.metadata' id='140737279137104'>
+    # E  +  where '' = <castero.menus.episodemenu.EpisodeMenu object at 0x7ffff3acd0d0>.metadata
+    # E  +  and   <MagicMock name='mock.metadata' id='140737279137104'> = episode1.metadata
+    "test_menu_episode_metadata"
   ];
 
   pythonImportsCheck = [

pkgs/by-name/cl/clever-tools/package.nix

@@ -11,7 +11,7 @@
 buildNpmPackage rec {
   pname = "clever-tools";
 
-  version = "3.11.0";
+  version = "3.12.0";
 
   nodejs = nodejs_18;
 
@@ -19,10 +19,10 @@ buildNpmPackage rec {
     owner = "CleverCloud";
     repo = "clever-tools";
     rev = version;
-    hash = "sha256-3u96bPdXGArvNZPs12uF48zR/15AQNNHXyUWnMgxMmI=";
+    hash = "sha256-n4rmgOeooLPGLkgBjSBKkevbDPujAORc2i63LiINpcU=";
   };
 
-  npmDepsHash = "sha256-zmhGpsRoMHgsq/XKOMGNIgxxsiMju9bG//Qd72HrMSE=";
+  npmDepsHash = "sha256-M7sHNszz2uiD4PVVFRBhaUmKde0s7Cnbr8XQBVlnpLo=";
 
   nativeBuildInputs = [
     installShellFiles

pkgs/by-name/ev/evcc/package.nix

@@ -17,13 +17,13 @@
 }:
 
 let
-  version = "0.200.6";
+  version = "0.200.7";
 
   src = fetchFromGitHub {
     owner = "evcc-io";
     repo = "evcc";
     tag = version;
-    hash = "sha256-IXfEqFqm/vzm3zA1j3QajpcXTn3v0/HlXkHHb9Vwki8=";
+    hash = "sha256-+bCFAZZPcQx3aj+YnNQN0hgAJdntjD5/eKLedW1GxYw=";
   };
 
   vendorHash = "sha256-zWHysXjBNAAZfrVGzn39pdDqQrLUc1uYVLO/U7q0g04=";
@@ -117,5 +117,6 @@ buildGo124Module rec {
     description = "EV Charge Controller";
     homepage = "https://evcc.io";
     changelog = "https://github.com/evcc-io/evcc/releases/tag/${version}";
+    mainProgram = "evcc";
   };
 }

pkgs/by-name/gg/gg/package.nix

@@ -1,43 +0,0 @@
-{
-  lib,
-  buildGoModule,
-  fetchFromGitHub,
-  installShellFiles,
-}:
-buildGoModule rec {
-  pname = "gg";
-  version = "0.2.19";
-
-  src = fetchFromGitHub {
-    owner = "mzz2017";
-    repo = "gg";
-    rev = "v${version}";
-    hash = "sha256-DXW0NtFYvcCX4CgMs5/5HPaO9f9eFtw401wmJdCbHPU=";
-  };
-
-  vendorHash = "sha256-fnM4ycqDyruCdCA1Cr4Ki48xeQiTG4l5dLVuAafEm14=";
-
-  ldflags = [
-    "-s"
-    "-w"
-  ];
-
-  nativeBuildInputs = [ installShellFiles ];
-
-  postInstall = ''
-    installShellCompletion --cmd gg \
-    --bash completion/bash/gg \
-    --fish completion/fish/gg.fish \
-    --zsh completion/zsh/_gg
-  '';
-
-  meta = with lib; {
-    homepage = "https://github.com/mzz2017/gg";
-    changelog = "https://github.com/mzz2017/gg/releases/tag/${src.rev}";
-    description = "Command-line tool for one-click proxy in your research and development";
-    license = licenses.agpl3Only;
-    mainProgram = "gg";
-    maintainers = with maintainers; [ oluceps ];
-    platforms = platforms.linux;
-  };
-}

pkgs/by-name/gn/gnome-commander/package.nix

@@ -7,10 +7,7 @@
   pkg-config,
   flex,
   itstool,
-  rustPlatform,
-  rustc,
-  cargo,
-  wrapGAppsHook4,
+  wrapGAppsHook3,
   desktop-file-utils,
   exiv2,
   libgsf,
@@ -22,14 +19,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gnome-commander";
-  version = "1.18.1-unstable-2024-10-18";
+  version = "1.18.2";
 
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "GNOME";
     repo = "gnome-commander";
-    rev = "28dadb1ef9342bb1a5f9a65b1a5bf3bd80e3d30a";
-    hash = "sha256-DxsZJht+PD3vY5vc1vzpRD8FHBPKcjK4qfke5nhvHS0=";
+    tag = finalAttrs.version;
+    hash = "sha256-dNZDlpvpN5hh/3YccZPJDEFkBLv9I8YOdFT/COp7+Uw=";
   };
 
   # hard-coded schema paths
@@ -40,21 +37,13 @@ stdenv.mkDerivation (finalAttrs: {
         '/share/gsettings-schemas/${finalAttrs.finalPackage.name}/glib-2.0/schemas'
   '';
 
-  cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit (finalAttrs) pname version src;
-    hash = "sha256-dOd/4n8G/zEsF0ClqhI2QBLosEz3uyzC9q5sHDVWAx4=";
-  };
-
   nativeBuildInputs = [
     meson
     ninja
     pkg-config
     flex
     itstool
-    rustPlatform.cargoSetupHook
-    rustc
-    cargo
-    wrapGAppsHook4
+    wrapGAppsHook3
     desktop-file-utils
   ];
 

pkgs/by-name/go/go-graft/package.nix

@@ -1,4 +1,9 @@
-{ lib, fetchFromGitHub, buildGoModule }:
+{
+  lib,
+  fetchFromGitHub,
+  buildGoModule,
+  installShellFiles,
+}:
 
 buildGoModule rec {
   pname = "go-graft";
@@ -8,20 +13,37 @@ buildGoModule rec {
     owner = "mzz2017";
     repo = "gg";
     rev = "v${version}";
-    sha256 = "sha256-DXW0NtFYvcCX4CgMs5/5HPaO9f9eFtw401wmJdCbHPU=";
+    hash = "sha256-DXW0NtFYvcCX4CgMs5/5HPaO9f9eFtw401wmJdCbHPU=";
   };
 
   env.CGO_ENABLED = 0;
 
-  ldflags = [ "-X github.com/mzz2017/gg/cmd.Version=${version}" "-s" "-w" ];
+  ldflags = [
+    "-X github.com/mzz2017/gg/cmd.Version=${version}"
+    "-s"
+    "-w"
+  ];
+
   vendorHash = "sha256-fnM4ycqDyruCdCA1Cr4Ki48xeQiTG4l5dLVuAafEm14=";
-  subPackages = [ "." ];
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  postInstall = ''
+    installShellCompletion --cmd gg \
+    --bash completion/bash/gg \
+    --fish completion/fish/gg.fish \
+    --zsh completion/zsh/_gg
+  '';
 
   meta = with lib; {
     description = "Command-line tool for one-click proxy in your research and development without installing v2ray or anything else";
+    changelog = "https://github.com/mzz2017/gg/releases/tag/${src.rev}";
     homepage = "https://github.com/mzz2017/gg";
-    license = licenses.agpl3Plus;
-    maintainers = with maintainers; [ xyenon ];
+    license = licenses.agpl3Only;
+    maintainers = with maintainers; [
+      xyenon
+      oluceps
+    ];
     mainProgram = "gg";
     platforms = platforms.linux;
   };

pkgs/by-name/ke/kermit/package.nix

@@ -39,6 +39,8 @@ stdenv.mkDerivation {
     make -f makefile install
   '';
 
+  env.NIX_CFLAGS_COMPILE = "-Wno-implicit-function-declaration -Wno-implicit-int";
+
   meta = with lib; {
     homepage = "https://www.kermitproject.org/ck90.html";
     description = "Portable Scriptable Network and Serial Communication Software";

pkgs/by-name/me/memray/package.nix

@@ -10,14 +10,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "memray";
-  version = "1.15.0";
+  version = "1.16.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "bloomberg";
     repo = "memray";
     tag = "v${version}";
-    hash = "sha256-SgkJm+vtIid8RR1Qy98PkpvIQX4LxyAPlS+4UlYlZws=";
+    hash = "sha256-1Vwf4lCe/srIvR47mCIN2pXrRE3mZJpTGdbOwrW2BpU=";
   };
 
   build-system = with python3Packages; [
@@ -68,7 +68,7 @@ python3Packages.buildPythonApplication rec {
   meta = with lib; {
     description = "Memory profiler for Python";
     homepage = "https://bloomberg.github.io/memray/";
-    changelog = "https://github.com/bloomberg/memray/releases/tag/v${version}";
+    changelog = "https://github.com/bloomberg/memray/releases/tag/${src.tag}";
     license = licenses.asl20;
     maintainers = with maintainers; [ fab ];
     platforms = platforms.linux;

pkgs/by-name/mo/mold/package.nix

@@ -23,13 +23,13 @@
 
 stdenv.mkDerivation rec {
   pname = "mold";
-  version = "2.36.0";
+  version = "2.37.0";
 
   src = fetchFromGitHub {
     owner = "rui314";
     repo = "mold";
     rev = "v${version}";
-    hash = "sha256-lJEQG2JPOwWMnYaOYBisusRNYKPLHtxtVtaRPhNl+fQ=";
+    hash = "sha256-Be5czR6ODN4NnJ0f3NYP2shLbawJHU/EU2aHqTBRKzE=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/op/opensbi/package.nix

@@ -8,15 +8,15 @@
   withFDT ? null,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "opensbi";
-  version = "1.5.1";
+  version = "1.6";
 
   src = fetchFromGitHub {
     owner = "riscv-software-src";
     repo = "opensbi";
-    rev = "v${version}";
-    hash = "sha256-qb3orbmZJtesIBj9F2OX+BhrlctymZA1ZIbV/GVa0lU=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-X3j+4hdNDq36O/vFdlnd/QvDVIkXtvFbheFaZwf4GQY=";
   };
 
   postPatch = ''
@@ -45,11 +45,11 @@ stdenv.mkDerivation rec {
   dontStrip = true;
   dontPatchELF = true;
 
-  meta = with lib; {
+  meta = {
     description = "RISC-V Open Source Supervisor Binary Interface";
     homepage = "https://github.com/riscv-software-src/opensbi";
-    license = licenses.bsd2;
-    maintainers = with maintainers; [
+    license = lib.licenses.bsd2;
+    maintainers = with lib.maintainers; [
       ius
       nickcao
       zhaofengli
@@ -59,4 +59,4 @@ stdenv.mkDerivation rec {
       "riscv32-linux"
     ];
   };
-}
+})

pkgs/by-name/pa/papeer/package.nix

@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "papeer";
-  version = "0.8.3";
+  version = "0.8.4";
 
   src = fetchFromGitHub {
     owner = "lapwat";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-S94hdtrdaABcOHTHMVTLcl/5IV45MFmWhFZdXQl6wZc=";
+    hash = "sha256-dkOLlWeG6ixbqLJU/1x2R1meKpcXb63C8EXH5FlD38k=";
   };
 
   vendorHash = "sha256-3QRSdkx9p0H+zPB//bpWCBKKjKjrx0lHMk5lFm+U7pA=";

pkgs/by-name/pr/protoc-gen-connect-es/package.nix

@@ -1,39 +0,0 @@
-{
-  lib,
-  buildNpmPackage,
-  fetchFromGitHub,
-  npm-lockfile-fix,
-}:
-
-buildNpmPackage rec {
-  pname = "protoc-gen-connect-es";
-  version = "1.6.1";
-
-  src = fetchFromGitHub {
-    owner = "connectrpc";
-    repo = "connect-es";
-    tag = "v${version}";
-    hash = "sha256-cB1OTolnwHOqeXrj8wL5FbFnjok6s03z1jC58ABTW3o=";
-
-    postFetch = ''
-      ${lib.getExe npm-lockfile-fix} $out/package-lock.json
-    '';
-  };
-
-  npmDepsHash = "sha256-VkvWHKERJwG7MVZ5Pb7ufRCBBWkcoMCoabtMETcPvrU=";
-
-  npmWorkspace = "packages/protoc-gen-connect-es";
-
-  passthru.updateScript = ./update.sh;
-
-  meta = with lib; {
-    description = "Protobuf plugin for generating Connect-ecompatiblenabled ECMAScript code";
-    homepage = "https://github.com/connectrpc/connect-es";
-    changelog = "https://github.com/connectrpc/connect-es/releases/tag/v${version}";
-    license = licenses.asl20;
-    maintainers = with maintainers; [
-      felschr
-      jtszalay
-    ];
-  };
-}

pkgs/by-name/pr/protoc-gen-connect-es/update.sh

@@ -1,30 +0,0 @@
-#! /usr/bin/env -S nix shell nixpkgs#gnugrep nixpkgs#gnused nixpkgs#coreutils nixpkgs#curl nixpkgs#wget nixpkgs#jq nixpkgs#nix-update nixpkgs#prefetch-npm-deps nixpkgs#npm-lockfile-fix nixpkgs#nodejs --command bash
-
-set -euo pipefail
-
-version="$(
-  curl ${GITHUB_TOKEN:+" -u \":$GITHUB_TOKEN\""} -s "https://api.github.com/repos/connectrpc/connect-es/releases" |
-    jq -r 'map(select(.prerelease == false)) | .[0].tag_name' |
-    grep -oP "^v\K.*"
-)"
-url="https://raw.githubusercontent.com/connectrpc/connect-es/v$version/"
-
-if [[ "$UPDATE_NIX_OLD_VERSION" == "$version" ]]; then
-  echo "Already up to date!"
-  exit 0
-fi
-
-tmp="$(mktemp -d)"
-trap 'rm -rf -- "$tmp"' EXIT
-
-pushd -- "$tmp"
-wget "$url/package-lock.json"
-npm-lockfile-fix package-lock.json
-npm_hash=$(prefetch-npm-deps package-lock.json)
-popd
-
-pushd "$(dirname "${BASH_SOURCE[0]}")"
-sed -i 's#npmDepsHash = "[^"]*"#npmDepsHash = "'"$npm_hash"'"#' package.nix
-popd
-
-nix-update protoc-gen-connect-es --version "$version"

pkgs/by-name/pr/protoc-gen-swift/package.nix

@@ -11,13 +11,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "protoc-gen-swift";
-  version = "1.28.2";
+  version = "1.29.0";
 
   src = fetchFromGitHub {
     owner = "apple";
     repo = "swift-protobuf";
     rev = "${finalAttrs.version}";
-    hash = "sha256-YOEr73xDjNrc4TTkIBY8AdAUX2MBtF9ED1UF2IjTu44=";
+    hash = "sha256-UPYwu8SiBUHofqHdUT6uxdeY2WUXYqbkLj+h4chSCa4=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ra/rabbit/package.nix

@@ -18,6 +18,10 @@ python3.pkgs.buildPythonApplication rec {
 
   pythonRelaxDeps = [
     "numpy"
+    "scikit-learn"
+    "scipy"
+    "tqdm"
+    "urllib3"
   ];
 
   build-system = with python3.pkgs; [

pkgs/by-name/re/restinio/package.nix

@@ -21,13 +21,13 @@ assert !with_boost_asio -> asio != null;
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "restinio";
-  version = "0.7.3";
+  version = "0.7.4";
 
   src = fetchFromGitHub {
     owner = "Stiffstream";
     repo = "restinio";
     rev = "v.${finalAttrs.version}";
-    hash = "sha256-heVdo0MtsWi/r9yse+/FZ55lhiunyEdwB3UkOOY5Vj0=";
+    hash = "sha256-AwAynNLSr0oBDhrKFguYG3O2aL1fnJ6g/kgAFxqYDqI=";
   };
 
   # https://www.github.com/Stiffstream/restinio/issues/230

pkgs/by-name/sd/SDL2_mixer_2_0/package.nix

@@ -1,9 +1,7 @@
-# SDL2_mixer_2_0 pinned for lzwolf
 {
   SDL2_mixer,
   fetchFromGitHub,
   fetchpatch,
-  lzwolf,
   timidity,
 }:
 
@@ -34,8 +32,6 @@ let
       substituteInPlace timidity/options.h \
         --replace "/usr/share/timidity" "${timidity}/share/timidity"
     '';
-
-    passthru.tests.lzwolf = lzwolf;
   };
 in
 SDL2_mixer.overrideAttrs (_: attrset)

pkgs/by-name/sv/svtplay-dl/package.nix

@@ -21,7 +21,7 @@ let
     requests-mock
     ;
 
-  version = "4.101";
+  version = "4.103";
 
 in
 
@@ -34,7 +34,7 @@ buildPythonApplication {
     owner = "spaam";
     repo = "svtplay-dl";
     rev = version;
-    hash = "sha256-bHUrpkGBguI8oZB1h1ToFkFsGiMeyV7TyDtgJ8+2TzI=";
+    hash = "sha256-pSTYrDgHmx4V+Y9iGRj3fCHiyoBP9FUf/XIRJyoUvMY=";
   };
 
   build-system = [ setuptools ];

pkgs/by-name/sw/swayosd/package.nix

@@ -3,11 +3,12 @@
   rustPlatform,
   fetchFromGitHub,
   pkg-config,
-  wrapGAppsHook3,
+  wrapGAppsHook4,
   brightnessctl,
   cargo,
   coreutils,
-  gtk-layer-shell,
+  dbus,
+  gtk4-layer-shell,
   libevdev,
   libinput,
   libpulseaudio,
@@ -20,22 +21,22 @@
 }:
 stdenv.mkDerivation rec {
   pname = "swayosd";
-  version = "0.1.0";
+  version = "0.2.0";
 
   src = fetchFromGitHub {
     owner = "ErikReider";
     repo = "SwayOSD";
     rev = "v${version}";
-    hash = "sha256-GyvRWEzTxQxTAk+xCLFsHdd1SttBliOgJ6eZqAxQMME=";
+    hash = "sha256-V3V18BoBRJU8mtvwWXvdYPbKBDIHdu5LzVSkDkGJjFU=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit pname version src;
-    hash = "sha256-oeLhJwlOITp8YHJdZQY7oo8Z31WUT4Y70dHd3tDDsk8=";
+    hash = "sha256-b5Ei6k9p/KiyiSSl5zxDXrTgGAq24O5ll0BvyJ/41F8=";
   };
 
   nativeBuildInputs = [
-    wrapGAppsHook3
+    wrapGAppsHook4
     pkg-config
     meson
     rustc
@@ -45,10 +46,11 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    gtk-layer-shell
+    gtk4-layer-shell
     libevdev
     libinput
     libpulseaudio
+    dbus
     udev
     sassc
   ];

pkgs/by-name/tr/tracelinks/package.nix

@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "tracelinks";
-  version = "1.0.1";
+  version = "1.0.2";
 
   src = fetchFromGitHub {
     owner = "flox";
     repo = "tracelinks";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-GftF2s2eRrkfzw2NpzTZ6Uhehcg2tMSOcsjHJssQJzU=";
+    hash = "sha256-sGC1TdcugitMgafnCZGpwYPqWioX+fRl2ZqDZE9levY=";
   };
 
   makeFlags = [

pkgs/by-name/tr/tracexec/package.nix

@@ -12,22 +12,30 @@
   zlib,
   clang,
 }:
-let
+
+rustPlatform.buildRustPackage rec {
   pname = "tracexec";
-  version = "0.8.2";
-in
-rustPlatform.buildRustPackage {
-  inherit pname version;
+  version = "0.10.0";
 
   src = fetchFromGitHub {
     owner = "kxxt";
     repo = "tracexec";
     tag = "v${version}";
-    hash = "sha256-qLvox7ef9eU1Vvg4gZGCKkic4+mcOIz9BZWTi/Q2grk=";
+    hash = "sha256-cqDGntubHbv6TJ0CSouTyCcDGpheLazbavYglHQRd10=";
   };
 
+  # remove if updating to rust 1.85
+  postPatch = ''
+    substituteInPlace Cargo.toml \
+      --replace-fail "[package]" ''$'cargo-features = ["edition2024"]\n[package]' \
+      --replace-fail 'rust-version = "1.85"' ""
+  '';
+
+  # remove if updating to rust 1.85
+  env.RUSTC_BOOTSTRAP = 1;
+
   useFetchCargoVendor = true;
-  cargoHash = "sha256-uFuMuSDcNKrlf2kpk/7+jaM7079Il63d/TtRiRIQZD4=";
+  cargoHash = "sha256-EY44uwf1b61UlulNwtN8JIG2CaEjxSnfuqE29/zdxBM=";
 
   hardeningDisable = [ "zerocallusedregs" ];
 
@@ -36,6 +44,7 @@ rustPlatform.buildRustPackage {
     pkg-config
     clang
   ];
+
   buildInputs = [
     libbpf
     elfutils

pkgs/by-name/ve/vencord/package.nix

@@ -7,32 +7,45 @@
   lib,
   nix-update,
   nodejs,
-  pnpm_9,
+  pnpm,
+  fetchurl,
   stdenv,
   writeShellScript,
   buildWebExtension ? false,
 }:
+let
+  # Credit to: @ScarsTRF (https://github.com/ScarsTRF/nixcord/blob/652dc8067b8004517ea43ebcc8d93a64f95d4327/vencord.nix#L28-L37)
+  # Due to pnpm package 10.5.2 there is a issue when building.
+  # Substituting pnpm with version 10.4.1 fixes this issue.
+  # This should be fixed in a newer version of pnpm.
+  pnpm_10-4 = pnpm.overrideAttrs (oldAttrs: {
+    version = "10.4.1";
+    src = fetchurl {
+      url = "https://registry.npmjs.org/pnpm/-/pnpm-10.4.1.tgz";
+      sha256 = "sha256-S3Aoh5hplZM9QwCDawTW0CpDvHK1Lk9+k6TKYIuVkZc=";
+    };
+  });
+in
 stdenv.mkDerivation (finalAttrs: {
   pname = "vencord";
-  version = "1.11.5";
+  version = "1.11.6";
 
   src = fetchFromGitHub {
     owner = "Vendicated";
     repo = "Vencord";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-hdlFL95DFVeUs08/wg6EA5CfV6KeUGaS9kcLGRMyNgY=";
+    hash = "sha256-8KAt7yFGT/DBlg2VJ7ejsOJ67Sp5cuuaKEWK3+VpL4E=";
   };
 
-  pnpmDeps = pnpm_9.fetchDeps {
+  pnpmDeps = pnpm_10-4.fetchDeps {
     inherit (finalAttrs) pname src;
-
-    hash = "sha256-0afgeJkK0OQWoqF0b8pHPMsiTKox84YmwBhtNWGyVAg=";
+    hash = "sha256-g9BSVUKpn74D9eIDj/lS1Y6w/+AnhCw++st4s4REn+A=";
   };
 
   nativeBuildInputs = [
     git
     nodejs
-    pnpm_9.configHook
+    pnpm_10-4.configHook
   ];
 
   env = {
@@ -89,15 +102,15 @@ stdenv.mkDerivation (finalAttrs: {
     exec nix-update --version "$latestTag" "$@"
   '';
 
-  meta = with lib; {
+  meta = {
     description = "Vencord web extension";
     homepage = "https://github.com/Vendicated/Vencord";
-    license = licenses.gpl3Only;
-    maintainers = with maintainers; [
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [
+      donteatoreo
       FlafyDev
       NotAShelf
       Scrumplex
-      donteatoreo
     ];
   };
 })

pkgs/by-name/vi/vimix-cursor-theme/package.nix

@@ -1,34 +0,0 @@
-{
-  stdenvNoCC,
-  fetchFromGitHub,
-  lib,
-}:
-
-stdenvNoCC.mkDerivation rec {
-  pname = "vimix-cursor-theme";
-  version = "2020-02-24";
-
-  src = fetchFromGitHub {
-    owner = "vinceliuice";
-    repo = "Vimix-cursors";
-    rev = version;
-    hash = "sha256-TfcDer85+UOtDMJVZJQr81dDy4ekjYgEvH1RE1IHMi4=";
-  };
-
-  installPhase = ''
-    sed -i 's/Vimix Cursors$/Vimix-Cursors/g' dist{,-white}/index.theme
-
-    install -dm 755 $out/share/icons/Vimix-Cursors{,-White}
-
-    cp -dr --no-preserve='ownership' dist/*        $out/share/icons/Vimix-Cursors
-    cp -dr --no-preserve='ownership' dist-white/*  $out/share/icons/Vimix-Cursors-White
-  '';
-
-  meta = with lib; {
-    description = "X-cursor theme inspired by Materia design and based on capitaine-cursors";
-    homepage = "https://github.com/vinceliuice/Vimix-cursors";
-    license = licenses.gpl3Only;
-    platforms = platforms.all;
-    maintainers = with maintainers; [ redxtech ];
-  };
-}

pkgs/by-name/wi/windmill/download.py.config.proto.patch

@@ -0,0 +1,37 @@
+diff --git a/windmill-worker/nsjail/download.py.config.proto b/windmill-worker/nsjail/download.py.config.proto
+index 5c2989417..7896bde7a 100644
+--- a/windmill-worker/nsjail/download.py.config.proto
++++ b/windmill-worker/nsjail/download.py.config.proto
+@@ -22,17 +22,24 @@ keep_caps: true
+ keep_env: true
+ mount_proc: true
+ 
++mount {
++    src: "/nix/store"
++    dst: "/nix/store"
++	is_bind: true
++}
+ 
+ mount {
+     src: "/bin"
+     dst: "/bin"
+ 	is_bind: true
++    mandatory: false
+ }
+ 
+ mount {
+     src: "/lib"
+     dst: "/lib"
+ 	is_bind: true
++    mandatory: false
+ }
+ 
+ mount {
+@@ -46,6 +53,7 @@ mount {
+     src: "/usr"
+     dst: "/usr"
+ 	is_bind: true
++    mandatory: false
+ }
+ 
+ mount {

pkgs/by-name/wi/windmill/fetchers.nix

@@ -0,0 +1,20 @@
+# not a stable interface, do not reference outside the windmill package but make a copy if you need
+{
+  lib,
+  stdenv,
+  fetchurl,
+}:
+
+{
+  fetchLibrustyV8 =
+    args:
+    fetchurl {
+      name = "librusty_v8-${args.version}";
+      url = "https://github.com/denoland/rusty_v8/releases/download/v${args.version}/librusty_v8_release_${stdenv.hostPlatform.rust.rustcTarget}.a.gz";
+      sha256 = args.shas.${stdenv.hostPlatform.system};
+      meta = {
+        inherit (args) version;
+        sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+      };
+    };
+}

pkgs/by-name/wi/windmill/librusty_v8.nix

@@ -0,0 +1,11 @@
+# auto-generated file -- DO NOT EDIT!
+{ fetchLibrustyV8 }:
+
+fetchLibrustyV8 {
+  version = "130.0.7";
+  shas = {
+    # NOTE; Follows supported platforms of package (see meta.platforms attribute)!
+    x86_64-linux = "0pdp6h7vbjvq5l9lh25qilmp6xrxg7mj8m263h44f0lv9swnqix6";
+    aarch64-linux = "0nli54vqcrfh9nkz7ma7230k0xmhcrk0jmfbyxcp3rxybarygvxy";
+  };
+}

pkgs/by-name/wi/windmill/package.nix

@@ -1,5 +1,6 @@
 {
   lib,
+  callPackage,
   rustPlatform,
   fetchFromGitHub,
   buildNpmPackage,
@@ -21,34 +22,183 @@
   rustfmt,
   stdenv,
   swagger-cli,
+  perl,
+  _experimental-update-script-combinators,
+  nix-update-script,
+  writeScript,
+  librusty_v8 ? (
+    callPackage ./librusty_v8.nix {
+      inherit (callPackage ./fetchers.nix { }) fetchLibrustyV8;
+    }
+  ),
+  libxml2,
+  xmlsec,
+  libxslt,
+  flock,
+  powershell,
+  uv,
+  bun,
+  dotnet-sdk_9,
+  php,
+  procps,
+  cargo,
+  coreutils,
+  withEnterpriseFeatures ? false,
 }:
 
 let
   pname = "windmill";
-  version = "1.410.3";
+  version = "1.474.0";
 
   src = fetchFromGitHub {
     owner = "windmill-labs";
     repo = "windmill";
     rev = "v${version}";
-    hash = "sha256-QPabzgSs+zxgI2dHcMY9ki4jEwm5jQbzwSMaIfBbFG8=";
+    hash = "sha256-9BtItmqyW4NbG4istssAYn4CWlfYAv33CE1enL+5LtE=";
+  };
+in
+rustPlatform.buildRustPackage (finalAttrs: {
+  inherit pname version src;
+  sourceRoot = "${src.name}/backend";
+
+  env = {
+    SQLX_OFFLINE = "true";
+    FRONTEND_BUILD_DIR = "${finalAttrs.passthru.web-ui}/share/windmill-frontend";
+    RUSTY_V8_ARCHIVE = librusty_v8;
   };
 
-  pythonEnv = python3.withPackages (ps: [ ps.pip-tools ]);
+  cargoLock = {
+    lockFile = ./Cargo.lock;
+    outputHashes = {
+      "php-parser-rs-0.1.3" = "sha256-ZeI3KgUPmtjlRfq6eAYveqt8Ay35gwj6B9iOQRjQa9A=";
+      "postgres-native-tls-0.5.0" = "sha256-hhvZkdc2KnU6IkgeTHY4M2dp9//NL8DQjOIcAh3sSRM=";
+      "progenitor-0.3.0" = "sha256-F6XRZFVIN6/HfcM8yI/PyNke45FL7jbcznIiqj22eIQ=";
+      "tinyvector-0.1.0" = "sha256-NYGhofU4rh+2IAM+zwe04YQdXY8Aa4gTmn2V2HtzRfI=";
+    };
+  };
 
-  frontend-build = buildNpmPackage {
+  buildFeatures =
+    [
+      "embedding"
+      "parquet"
+      "prometheus"
+      "openidconnect"
+      "cloud"
+      "jemalloc"
+      "deno_core"
+      "license"
+      "http_trigger"
+      "zip"
+      "oauth2"
+      "kafka"
+      "otel"
+      "dind"
+      "php"
+      "mysql"
+      "mssql"
+      "bigquery"
+      "websocket"
+      "python"
+      "smtp"
+      "csharp"
+      "static_frontend"
+      # "rust" # compiler environment is incomplete
+    ]
+    ++ (lib.optionals withEnterpriseFeatures [
+      "enterprise"
+      "enterprise_saml"
+      "tantivy"
+      "stripe"
+    ]);
+
+  patches = [
+    ./download.py.config.proto.patch
+    ./python_executor.patch
+    ./run.ansible.config.proto.patch
+    ./run.bash.config.proto.patch
+    ./run.bun.config.proto.patch
+    ./run.csharp.config.proto.patch
+    ./run.go.config.proto.patch
+    ./run.php.config.proto.patch
+    ./run.powershell.config.proto.patch
+    ./run.python3.config.proto.patch
+    ./run.rust.config.proto.patch
+    ./rust_executor.patch
+    ./swagger-cli.patch
+  ];
+
+  postPatch = ''
+    substituteInPlace windmill-common/src/utils.rs \
+      --replace-fail 'unknown-version' 'v${version}'
+
+    substituteInPlace windmill-worker/src/python_executor.rs \
+      --replace-fail 'unknown_system_python_version' '${python3.version}'
+  '';
+
+  buildInputs = [
+    openssl
+    rustfmt
+    lld
+    (lib.getLib stdenv.cc.cc)
+    libxml2
+    xmlsec
+    libxslt
+  ];
+
+  nativeBuildInputs = [
+    pkg-config
+    makeWrapper
+    cmake # for libz-ng-sys crate
+    perl
+  ];
+
+  # needs a postgres database running
+  doCheck = false;
+
+  # TODO; Check if the rpath is still required
+  # patchelf --set-rpath ${lib.makeLibraryPath [ openssl ]} $out/bin/windmill
+  postFixup = ''
+    wrapProgram "$out/bin/windmill" \
+      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ stdenv.cc.cc ]} \
+      --prefix PATH : ${
+        lib.makeBinPath [
+          python3 # uv searches PATH for system python
+          procps # bash_executor
+          coreutils # bash_executor
+        ]
+      } \
+      --set PYTHON_PATH "${python3}/bin/python3" \
+      --set GO_PATH "${go}/bin/go" \
+      --set DENO_PATH "${deno}/bin/deno" \
+      --set NSJAIL_PATH "${nsjail}/bin/nsjail" \
+      --set FLOCK_PATH "${flock}/bin/flock" \
+      --set BASH_PATH "${bash}/bin/bash" \
+      --set POWERSHELL_PATH "${powershell}/bin/pwsh" \
+      --set BUN_PATH "${bun}/bin/bun" \
+      --set UV_PATH "${uv}/bin/uv" \
+      --set DOTNET_PATH "${dotnet-sdk_9}/bin/dotnet" \
+      --set DOTNET_ROOT "${dotnet-sdk_9}/share/dotnet" \
+      --set PHP_PATH "${php}/bin/php" \
+      --set CARGO_PATH "${cargo}/bin/cargo"
+  '';
+
+  passthru.web-ui = buildNpmPackage {
     inherit version src;
 
     pname = "windmill-ui";
 
     sourceRoot = "${src.name}/frontend";
 
-    npmDepsHash = "sha256-3AeDGd/4dGHm8kGKEH3sqNOuQ1LPjP5n4qOEaqVMm0w=";
+    npmDepsHash = "sha256-liWoAgAIgU8+J1x2mR7bGl9MOpCuGIf0Qa1nEouFnBU=";
 
     # without these you get a
     # FATAL ERROR: Ineffective mark-compacts near heap limit Allocation failed - JavaScript heap out of memory
     env.NODE_OPTIONS = "--max-old-space-size=8192";
 
+    postUnpack = ''
+      cp ${src}/openflow.openapi.yaml .
+    '';
+
     preBuild = ''
       npm run generate-backend-client
     '';
@@ -57,10 +207,8 @@ let
       pixman
       cairo
       pango
-      giflib
     ];
     nativeBuildInputs = [
-      python3
       pkg-config
     ];
 
@@ -69,114 +217,17 @@ let
       mv build $out/share/windmill-frontend
     '';
   };
-in
-rustPlatform.buildRustPackage {
-  inherit pname version;
-  src = "${src}/backend";
 
-  env = {
-    SQLX_OFFLINE = "true";
-    RUSTY_V8_ARCHIVE =
-      let
-        fetch_librusty_v8 =
-          args:
-          fetchurl {
-            name = "librusty_v8-${args.version}";
-            url = "https://github.com/denoland/rusty_v8/releases/download/v${args.version}/librusty_v8_release_${stdenv.hostPlatform.rust.rustcTarget}.a";
-            sha256 =
-              args.shas.${stdenv.hostPlatform.system}
-                or (throw "Unsupported platform ${stdenv.hostPlatform.system}");
-            meta = {
-              inherit (args) version;
-              sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
-            };
-          };
-      in
-      fetch_librusty_v8 {
-        version = "0.83.2";
-        shas = {
-          x86_64-linux = "sha256-RJNdy5jRZK3dTgrHsWuZZAHUyy1EogyNNuBekZ3Arrk=";
-          aarch64-linux = "sha256-mpOmuqtd7ob6xvrgH4P/6GLa/hXTS/ok0WOYo7+7ZhI=";
-          x86_64-darwin = "sha256-2o8CvJ3r5+4PLNGTySqPPDTqbU0piX4D1UtZMscMdHU=";
-          aarch64-darwin = "sha256-WHeITWSHjZxfQJndxcjsp4yIERKrKXSHFZ0UBc43p8o=";
-        };
-      };
-  };
-
-  cargoLock = {
-    lockFile = ./Cargo.lock;
-    outputHashes = {
-      "php-parser-rs-0.1.3" = "sha256-ZeI3KgUPmtjlRfq6eAYveqt8Ay35gwj6B9iOQRjQa9A=";
-      "progenitor-0.3.0" = "sha256-F6XRZFVIN6/HfcM8yI/PyNke45FL7jbcznIiqj22eIQ=";
-      "rustpython-ast-0.3.1" = "sha256-q9N+z3F6YICQuUMp3a10OS792tCq0GiSSlkcaLxi3Gs=";
-      "tiberius-0.12.2" = "sha256-s/S0K3hE+JNCrNVxoSCSs4myLHvukBYTwk2A5vZ7Ae8=";
-      "tinyvector-0.1.0" = "sha256-NYGhofU4rh+2IAM+zwe04YQdXY8Aa4gTmn2V2HtzRfI=";
-    };
-  };
-
-  patches = [
-    ./swagger-cli.patch
-    ./run.go.config.proto.patch
-    ./run.python3.config.proto.patch
-    ./run.bash.config.proto.patch
+  passthru.updateScript = _experimental-update-script-combinators.sequence [
+    (nix-update-script {
+      extraArgs = [
+        "--subpackage"
+        "web-ui"
+      ];
+    })
+    (./update-librusty.sh)
   ];
 
-  postPatch = ''
-    substituteInPlace windmill-worker/src/bash_executor.rs \
-      --replace '"/bin/bash"' '"${bash}/bin/bash"'
-
-    substituteInPlace windmill-api/src/lib.rs \
-      --replace 'unknown-version' 'v${version}'
-
-    substituteInPlace src/main.rs \
-      --replace 'unknown-version' 'v${version}'
-
-    pushd ..
-
-    mkdir -p frontend/build
-    cp -R ${frontend-build}/share/windmill-frontend/* frontend/build
-    cp ${src}/openflow.openapi.yaml .
-
-    popd
-  '';
-
-  buildInputs = [
-    openssl
-    rustfmt
-    lld
-    (lib.getLib stdenv.cc.cc)
-  ];
-
-  nativeBuildInputs = [
-    pkg-config
-    makeWrapper
-    swagger-cli
-    cmake # for libz-ng-sys crate
-  ];
-
-  # needs a postgres database running
-  doCheck = false;
-
-  postFixup = ''
-    patchelf --set-rpath ${lib.makeLibraryPath [ openssl ]} $out/bin/windmill
-
-    wrapProgram "$out/bin/windmill" \
-      --prefix PATH : ${
-        lib.makeBinPath [
-          go
-          pythonEnv
-          deno
-          nsjail
-          bash
-        ]
-      } \
-      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ stdenv.cc.cc ]} \
-      --set PYTHON_PATH "${pythonEnv}/bin/python3" \
-      --set GO_PATH "${go}/bin/go" \
-      --set DENO_PATH "${deno}/bin/deno" \
-      --set NSJAIL_PATH "${nsjail}/bin/nsjail"
-  '';
-
   meta = {
     changelog = "https://github.com/windmill-labs/windmill/blob/${src.rev}/CHANGELOG.md";
     description = "Open-source developer platform to turn scripts into workflows and UIs";
@@ -194,4 +245,4 @@ rustPlatform.buildRustPackage {
       "aarch64-linux"
     ];
   };
-}
+})

pkgs/by-name/wi/windmill/python_executor.patch

@@ -0,0 +1,100 @@
+diff --git a/windmill-worker/src/python_executor.rs b/windmill-worker/src/python_executor.rs
+index 1180652d3..7b4ccf6cf 100644
+--- a/windmill-worker/src/python_executor.rs
++++ b/windmill-worker/src/python_executor.rs
+@@ -290,70 +290,8 @@ impl PyVersion {
+         occupancy_metrics: &mut Option<&mut OccupancyMetrics>,
+     ) -> error::Result<()> {
+         let v = self.to_string_with_dot();
+-        append_logs(job_id, w_id, format!("\nINSTALLING PYTHON ({})", v), db).await;
+-        // Create dirs for newly installed python
+-        // If we dont do this, NSJAIL will not be able to mount cache
+-        // For the default version directory created during startup (main.rs)
+-        DirBuilder::new()
+-            .recursive(true)
+-            .create(self.to_cache_dir())
+-            .await
+-            .expect("could not create initial worker dir");
+-
+-        let logs = String::new();
+-
+-        #[cfg(windows)]
+-        let uv_cmd = "uv";
+-
+-        #[cfg(unix)]
+-        let uv_cmd = UV_PATH.as_str();
+-
+-        let mut child_cmd = Command::new(uv_cmd);
+-        child_cmd
+-            .env_clear()
+-            .env("HOME", HOME_ENV.to_string())
+-            .env("PATH", PATH_ENV.to_string())
+-            .envs(PROXY_ENVS.clone())
+-            .args(["python", "install", v, "--python-preference=only-managed"])
+-            // TODO: Do we need these?
+-            .envs([("UV_PYTHON_INSTALL_DIR", PY_INSTALL_DIR)])
+-            .stdout(Stdio::piped())
+-            .stderr(Stdio::piped());
+-
+-        #[cfg(windows)]
+-        {
+-            child_cmd
+-                .env("SystemRoot", SYSTEM_ROOT.as_str())
+-                .env("USERPROFILE", crate::USERPROFILE_ENV.as_str())
+-                .env(
+-                    "TMP",
+-                    std::env::var("TMP").unwrap_or_else(|_| String::from("/tmp")),
+-                )
+-                .env(
+-                    "LOCALAPPDATA",
+-                    std::env::var("LOCALAPPDATA")
+-                        .unwrap_or_else(|_| format!("{}\\AppData\\Local", HOME_ENV.as_str())),
+-                );
+-        }
+-
+-        let child_process = start_child_process(child_cmd, "uv").await?;
+-
+-        append_logs(&job_id, &w_id, logs, db).await;
+-        handle_child(
+-            job_id,
+-            db,
+-            mem_peak,
+-            &mut None,
+-            child_process,
+-            false,
+-            worker_name,
+-            &w_id,
+-            "uv",
+-            None,
+-            false,
+-            occupancy_metrics,
+-        )
+-        .await
++        append_logs(job_id, w_id, format!("\nREQUESTED PYTHON INSTALL IGNORED ({})", v), db).await;
++        Err(error::Error::BadConfig(format!("Python is managed through the NixOS system configuration. Change the Windmill instance setting to version 'unknown_system_python_version'")))
+     }
+     async fn find_python(self) -> error::Result<Option<String>> {
+         #[cfg(windows)]
+@@ -391,11 +329,11 @@ impl PyVersion {
+                 "find",
+                 self.to_string_with_dot(),
+                 "--system",
+-                "--python-preference=only-managed",
++                "--python-preference=only-system",
+             ])
+             .envs([
+                 ("UV_PYTHON_INSTALL_DIR", PY_INSTALL_DIR),
+-                ("UV_PYTHON_PREFERENCE", "only-managed"),
++                ("UV_PYTHON_PREFERENCE", "only-system"),
+             ])
+             // .stdout(Stdio::piped())
+             .stderr(Stdio::piped())
+@@ -561,7 +499,7 @@ pub async fn uv_pip_compile(
+             "-p",
+             &py_version.to_string_with_dot(),
+             "--python-preference",
+-            "only-managed",
++            "only-system",
+         ]);
+ 
+         if no_cache {

pkgs/by-name/wi/windmill/run.ansible.config.proto.patch

@@ -0,0 +1,44 @@
+diff --git a/windmill-worker/nsjail/run.ansible.config.proto b/windmill-worker/nsjail/run.ansible.config.proto
+index 65a8ea700..d4c8c2afc 100644
+--- a/windmill-worker/nsjail/run.ansible.config.proto
++++ b/windmill-worker/nsjail/run.ansible.config.proto
+@@ -18,16 +18,24 @@ keep_caps: false
+ keep_env: true
+ mount_proc: true
+ 
++mount {
++    src: "/nix/store"
++    dst: "/nix/store"
++    is_bind: true
++}
++
+ mount {
+     src: "/bin"
+     dst: "/bin"
+     is_bind: true
++    mandatory: false
+ }
+ 
+ mount {
+     src: "/lib"
+     dst: "/lib"
+     is_bind: true
++    mandatory: false
+ }
+ 
+ 
+@@ -42,12 +50,14 @@ mount {
+     src: "/root/.local/share/uv/tools/ansible"
+     dst: "/root/.local/share/uv/tools/ansible"
+     is_bind: true
++    mandatory: false
+ }
+ 
+ mount {
+     src: "/usr"
+     dst: "/usr"
+     is_bind: true
++    mandatory: false
+ }
+ 
+ mount {

pkgs/by-name/wi/windmill/run.bash.config.proto.patch

@@ -1,41 +1,46 @@
-diff --git a/windmill-worker/nsjail/run.bash.config.proto b/backend/windmill-worker/nsjail/run.bash.config.proto
-index e93e6b45..bbedb165 100644
+diff --git a/windmill-worker/nsjail/run.bash.config.proto b/windmill-worker/nsjail/run.bash.config.proto
+index 63018f765..d8bb0c0a7 100644
 --- a/windmill-worker/nsjail/run.bash.config.proto
 +++ b/windmill-worker/nsjail/run.bash.config.proto
-@@ -18,6 +18,12 @@ clone_newuser: {CLONE_NEWUSER}
- keep_caps: false
+@@ -15,10 +15,17 @@ keep_caps: false
  keep_env: true
+ mount_proc: true
  
 +mount {
-+	src: "/nix/store"
-+	dst: "/nix/store"
++    src: "/nix/store"
++    dst: "/nix/store"
 +	is_bind: true
 +}
 +
  mount {
      src: "/bin"
      dst: "/bin"
-@@ -25,6 +31,7 @@ mount {
+ 	is_bind: true
++    mandatory: false
  }
  
  mount {
+@@ -32,6 +39,7 @@ mount {
+     src: "/bin"
+     dst: "/bin"
+ 	is_bind: true
 +    mandatory: false
+ }
+ 
+ mount {
+@@ -45,6 +53,7 @@ mount {
      src: "/lib"
      dst: "/lib"
  	is_bind: true
-@@ -32,6 +39,7 @@ mount {
- 
- 
- mount {
 +    mandatory: false
-     src: "/lib64"
-     dst: "/lib64"
- 	is_bind: true
-@@ -39,6 +47,7 @@ mount {
+ }
  
  
- mount {
-+    mandatory: false
+@@ -60,6 +69,7 @@ mount {
      src: "/usr"
      dst: "/usr"
  	is_bind: true
++    mandatory: false
+ }
+ 
+ mount {

pkgs/by-name/wi/windmill/run.bun.config.proto.patch

@@ -0,0 +1,37 @@
+diff --git a/windmill-worker/nsjail/run.bun.config.proto b/windmill-worker/nsjail/run.bun.config.proto
+index 527d49cf7..b5e64beec 100644
+--- a/windmill-worker/nsjail/run.bun.config.proto
++++ b/windmill-worker/nsjail/run.bun.config.proto
+@@ -17,16 +17,24 @@ clone_newcgroup: false
+ keep_caps: false
+ keep_env: true
+ 
++mount {
++    src: "/nix/store"
++    dst: "/nix/store"
++	is_bind: true
++}
++
+ mount {
+     src: "/bin"
+     dst: "/bin"
+ 	is_bind: true
++    mandatory: false
+ }
+ 
+ mount {
+     src: "/lib"
+     dst: "/lib"
+ 	is_bind: true
++    mandatory: false
+ }
+ 
+ mount {
+@@ -47,6 +55,7 @@ mount {
+     src: "/usr"
+     dst: "/usr"
+ 	is_bind: true
++    mandatory: false
+ }
+ 
+ mount {

pkgs/by-name/wi/windmill/run.csharp.config.proto.patch

@@ -0,0 +1,37 @@
+diff --git a/windmill-worker/nsjail/run.csharp.config.proto b/windmill-worker/nsjail/run.csharp.config.proto
+index 389448eff..ee51c1bfb 100644
+--- a/windmill-worker/nsjail/run.csharp.config.proto
++++ b/windmill-worker/nsjail/run.csharp.config.proto
+@@ -15,16 +15,24 @@ keep_caps: false
+ keep_env: true
+ mount_proc: true
+ 
++mount {
++    src: "/nix/store"
++    dst: "/nix/store"
++    is_bind: true
++}
++
+ mount {
+     src: "/bin"
+     dst: "/bin"
+     is_bind: true
++    mandatory: false
+ }
+ 
+ mount {
+     src: "/lib"
+     dst: "/lib"
+     is_bind: true
++    mandatory: false
+ }
+ 
+ 
+@@ -40,6 +48,7 @@ mount {
+     src: "/usr"
+     dst: "/usr"
+     is_bind: true
++    mandatory: false
+ }
+ 
+ mount {

pkgs/by-name/wi/windmill/run.go.config.proto.patch

@@ -1,34 +1,37 @@
 diff --git a/windmill-worker/nsjail/run.go.config.proto b/windmill-worker/nsjail/run.go.config.proto
-index 3af548d1..39ff4da7 100644
+index 1ba6f52d5..21614fabb 100644
 --- a/windmill-worker/nsjail/run.go.config.proto
 +++ b/windmill-worker/nsjail/run.go.config.proto
-@@ -25,6 +25,13 @@ mount {
- }
+@@ -14,16 +14,24 @@ clone_newuser: {CLONE_NEWUSER}
+ keep_caps: false
+ keep_env: true
  
- mount {
-+	src: "/nix/store"
-+	dst: "/nix/store"
++mount {
++    src: "/nix/store"
++    dst: "/nix/store"
 +	is_bind: true
 +}
 +
-+mount {
+ mount {
+     src: "/bin"
+     dst: "/bin"
+ 	is_bind: true
 +    mandatory: false
+ }
+ 
+ mount {
      src: "/lib"
      dst: "/lib"
  	is_bind: true
-@@ -32,6 +39,7 @@ mount {
- 
- 
- mount {
 +    mandatory: false
-     src: "/lib64"
-     dst: "/lib64"
- 	is_bind: true
+ }
+ 
+ 
 @@ -39,6 +47,7 @@ mount {
- 
- 
- mount {
-+    mandatory: false
      src: "/usr"
      dst: "/usr"
  	is_bind: true
++    mandatory: false
+ }
+ 
+ mount {

pkgs/by-name/wi/windmill/run.php.config.proto.patch

@@ -0,0 +1,37 @@
+diff --git a/windmill-worker/nsjail/run.php.config.proto b/windmill-worker/nsjail/run.php.config.proto
+index d3752d33b..9e4b19793 100644
+--- a/windmill-worker/nsjail/run.php.config.proto
++++ b/windmill-worker/nsjail/run.php.config.proto
+@@ -15,16 +15,24 @@ keep_caps: false
+ keep_env: true
+ mount_proc: true
+ 
++mount {
++    src: "/nix/store"
++    dst: "/nix/store"
++	is_bind: true
++}
++
+ mount {
+     src: "/bin"
+     dst: "/bin"
+ 	is_bind: true
++    mandatory: false
+ }
+ 
+ mount {
+     src: "/lib"
+     dst: "/lib"
+ 	is_bind: true
++    mandatory: false
+ }
+ 
+ 
+@@ -40,6 +48,7 @@ mount {
+     src: "/usr"
+     dst: "/usr"
+ 	is_bind: true
++    mandatory: false
+ }
+ 
+ mount {

pkgs/by-name/wi/windmill/run.powershell.config.proto.patch

@@ -0,0 +1,38 @@
+diff --git a/windmill-worker/nsjail/run.powershell.config.proto b/windmill-worker/nsjail/run.powershell.config.proto
+index 93a48d4fe..97dc236e5 100644
+--- a/windmill-worker/nsjail/run.powershell.config.proto
++++ b/windmill-worker/nsjail/run.powershell.config.proto
+@@ -15,10 +15,17 @@ keep_caps: false
+ keep_env: true
+ mount_proc: true
+ 
++mount {
++    src: "/nix/store"
++    dst: "/nix/store"
++	is_bind: true
++}
++
+ mount {
+     src: "/bin"
+     dst: "/bin"
+ 	is_bind: true
++    mandatory: false
+ }
+ 
+ mount {
+@@ -38,6 +45,7 @@ mount {
+     src: "/lib"
+     dst: "/lib"
+ 	is_bind: true
++    mandatory: false
+ }
+ 
+ 
+@@ -53,6 +61,7 @@ mount {
+     src: "/usr"
+     dst: "/usr"
+ 	is_bind: true
++    mandatory: false
+ }
+ 
+ mount {

pkgs/by-name/wi/windmill/run.python3.config.proto.patch

@@ -1,34 +1,37 @@
 diff --git a/windmill-worker/nsjail/run.python3.config.proto b/windmill-worker/nsjail/run.python3.config.proto
-index 9f106c23..9da2d2a8 100644
+index b49b9cfbf..35241bbd0 100644
 --- a/windmill-worker/nsjail/run.python3.config.proto
 +++ b/windmill-worker/nsjail/run.python3.config.proto
-@@ -27,6 +27,13 @@ mount {
- }
+@@ -18,16 +18,24 @@ keep_caps: false
+ keep_env: true
+ mount_proc: true
  
- mount {
-+	src: "/nix/store"
-+	dst: "/nix/store"
++mount {
++    src: "/nix/store"
++    dst: "/nix/store"
 +	is_bind: true
 +}
 +
-+mount {
+ mount {
+     src: "/bin"
+     dst: "/bin"
+ 	is_bind: true
 +    mandatory: false
+ }
+ 
+ mount {
      src: "/lib"
      dst: "/lib"
  	is_bind: true
-@@ -34,6 +35,7 @@ mount {
- 
- 
- mount {
 +    mandatory: false
-     src: "/lib64"
-     dst: "/lib64"
- 	is_bind: true
-@@ -41,6 +43,7 @@ mount {
+ }
  
  
- mount {
-+    mandatory: false
+@@ -43,6 +51,7 @@ mount {
      src: "/usr"
      dst: "/usr"
  	is_bind: true
++    mandatory: false
+ }
+ 
+ mount {

pkgs/by-name/wi/windmill/run.rust.config.proto.patch

@@ -0,0 +1,37 @@
+diff --git a/windmill-worker/nsjail/run.rust.config.proto b/windmill-worker/nsjail/run.rust.config.proto
+index 3357cd88a..c0a1e9534 100644
+--- a/windmill-worker/nsjail/run.rust.config.proto
++++ b/windmill-worker/nsjail/run.rust.config.proto
+@@ -14,16 +14,24 @@ clone_newuser: {CLONE_NEWUSER}
+ keep_caps: false
+ keep_env: true
+ 
++mount {
++    src: "/nix/store"
++    dst: "/nix/store"
++	is_bind: true
++}
++
+ mount {
+     src: "/bin"
+     dst: "/bin"
+ 	is_bind: true
++    mandatory: false
+ }
+ 
+ mount {
+     src: "/lib"
+     dst: "/lib"
+ 	is_bind: true
++    mandatory: false
+ }
+ 
+ 
+@@ -39,6 +47,7 @@ mount {
+     src: "/usr"
+     dst: "/usr"
+ 	is_bind: true
++    mandatory: false
+ }
+ 
+ mount {

pkgs/by-name/wi/windmill/rust_executor.patch

@@ -0,0 +1,13 @@
+diff --git a/windmill-worker/src/rust_executor.rs b/windmill-worker/src/rust_executor.rs
+index 95fd82210..ed7b298e1 100644
+--- a/windmill-worker/src/rust_executor.rs
++++ b/windmill-worker/src/rust_executor.rs
+@@ -29,7 +29,7 @@ use crate::SYSTEM_ROOT;
+ const NSJAIL_CONFIG_RUN_RUST_CONTENT: &str = include_str!("../nsjail/run.rust.config.proto");
+ 
+ lazy_static::lazy_static! {
+-    static ref HOME_DIR: String = std::env::var("HOME").expect("Could not find the HOME environment variable");
++    static ref HOME_DIR: String = std::env::var("HOME").unwrap_or_else(|_| format!("{}/cargo", windmill_common::worker::ROOT_CACHE_DIR));
+     static ref CARGO_HOME: String = std::env::var("CARGO_HOME").unwrap_or_else(|_| { CARGO_HOME_DEFAULT.clone() });
+     static ref RUSTUP_HOME: String = std::env::var("RUSTUP_HOME").unwrap_or_else(|_| { RUSTUP_HOME_DEFAULT.clone() });
+     static ref CARGO_PATH: String = std::env::var("CARGO_PATH").unwrap_or_else(|_| format!("{}/bin/cargo", CARGO_HOME.as_str()));

pkgs/by-name/wi/windmill/update-librusty.sh

@@ -0,0 +1,38 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p gnugrep gnused nix
+# shellcheck shell=bash
+
+set -eu -o pipefail
+
+# ASSUMES; The Cargo.lock file inside this directory holds the correct librusty version
+
+PACKAGE_DIR=$(dirname "$(readlink --canonicalize-existing "${BASH_SOURCE[0]}")")
+OUTPUT_FILE="$PACKAGE_DIR/librusty_v8.nix"
+NEW_VERSION="$(grep --after-context 5 'name = "v8"' "$PACKAGE_DIR/Cargo.lock" | grep 'version =' | sed -E 's/version = "//;s/"//')"
+
+CURRENT_VERSION=""
+if [ -f "$OUTPUT_FILE" ]; then
+    CURRENT_VERSION="$(grep 'version ='  "$OUTPUT_FILE" | sed -E 's/version = "//;s/"//')"
+fi
+
+if [ "$CURRENT_VERSION" == "$NEW_VERSION" ]; then
+    echo "No update needed, $CURRENT_VERSION is already latest"
+    exit 0
+fi
+
+TEMP_FILE="$OUTPUT_FILE.tmp"
+cat > "$TEMP_FILE" <<EOF
+# auto-generated file -- DO NOT EDIT!
+{ fetchLibrustyV8 }:
+
+fetchLibrustyV8 {
+  version = "$NEW_VERSION";
+  shas = {
+    # NOTE; Follows supported platforms of package (see meta.platforms attribute)!
+    x86_64-linux = "$(nix-prefetch-url --type sha256 https://github.com/denoland/rusty_v8/releases/download/v"$NEW_VERSION"/librusty_v8_release_x86_64-unknown-linux-gnu.a.gz)";
+    aarch64-linux = "$(nix-prefetch-url --type sha256 https://github.com/denoland/rusty_v8/releases/download/v"$NEW_VERSION"/librusty_v8_release_aarch64-unknown-linux-gnu.a.gz)";
+  };
+}
+EOF
+
+mv "$TEMP_FILE" "$OUTPUT_FILE"

pkgs/by-name/xa/xan/package.nix

@@ -5,16 +5,16 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "xan";
-  version = "0.45.0";
+  version = "0.46.2";
 
   src = fetchFromGitHub {
     owner = "medialab";
     repo = "xan";
     tag = version;
-    hash = "sha256-doNAj+keQ/c0P43SEShfJtZWZzEPBrgyB9CF9XKw/6U=";
+    hash = "sha256-scLpmKlMIqBScvtMcrNnU0UPEJ8ufOefksk/kVQzZhE=";
   };
 
-  cargoHash = "sha256-fReHI5pi71+CK2IGOIlK2SLR0A6LDjMHtU80BdU8ABM=";
+  cargoHash = "sha256-aTDT3kMSEjOzbjEez5i13D8HsnP1ZYBt6GkorR1EZiM=";
   useFetchCargoVendor = true;
 
   # FIXME: tests fail and I do not have the time to investigate. Temporarily disable

pkgs/by-name/xd/xdg-desktop-portal-gtk/package.nix

@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "xdg-desktop-portal-gtk";
-  version = "1.15.1";
+  version = "1.15.2";
 
   src = fetchFromGitHub {
     owner = "flatpak";
     repo = "xdg-desktop-portal-gtk";
     rev = finalAttrs.version;
-    sha256 = "sha256-uXVjKsqoIjqJilJq8ERRzEqGKbkzc+Zl6y+37CAcYro=";
+    sha256 = "sha256-L9kt3HAoEezYARH5JekyXhxf9Xkbzy1U2srXD7Yg/a8=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ze/zed-editor/package.nix

@@ -27,7 +27,6 @@
   gitUpdater,
   cargo-about,
   versionCheckHook,
-  zed-editor,
   buildFHSEnv,
   cargo-bundle,
   git,
@@ -59,6 +58,7 @@ let
   # extension tooling without significant pain.
   fhs =
     {
+      zed-editor,
       additionalPkgs ? pkgs: [ ],
     }:
     buildFHSEnv {
@@ -98,7 +98,7 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "zed-editor";
-  version = "0.176.2";
+  version = "0.176.3";
 
   outputs =
     [ "out" ]
@@ -110,7 +110,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "zed-industries";
     repo = "zed";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-uTq9/skBMz8n2NjGBQKOIOMp/rTDL+azEUzV4jTUJvE=";
+    hash = "sha256-5bn70R5phHZmAf/71IK8o2laHcCo92cCiaKQ7xo0Uag=";
   };
 
   patches = [
@@ -136,7 +136,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   '';
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-b4YTVrz2nOwQnVU42E+LD1YjsUAWN7+fCr2z8IVwH6o=";
+  cargoHash = "sha256-IaAY1u5xLomvUtb4FjE4uE0w01rMmyR/DH0QD9cOK5Y=";
 
   nativeBuildInputs =
     [
@@ -309,17 +309,22 @@ rustPlatform.buildRustPackage (finalAttrs: {
       rev-prefix = "v";
       ignoredVersions = "(*-pre|0.999999.0|0.9999-temporary)";
     };
-    fhs = fhs { };
-    fhsWithPackages = f: fhs { additionalPkgs = f; };
+    fhs = fhs { zed-editor = finalAttrs.finalPackage; };
+    fhsWithPackages =
+      f:
+      fhs {
+        zed-editor = finalAttrs.finalPackage;
+        additionalPkgs = f;
+      };
     tests =
       {
         remoteServerVersion = testers.testVersion {
-          package = zed-editor.remote_server;
+          package = finalAttrs.finalPackage.remote_server;
           command = "zed-remote-server-stable-${finalAttrs.version} version";
         };
       }
       // lib.optionalAttrs stdenv.hostPlatform.isLinux {
-        withGles = zed-editor.override { withGLES = true; };
+        withGles = finalAttrs.finalPackage.override { withGLES = true; };
       };
   };
 

pkgs/development/libraries/SDL2/default.nix

@@ -3,6 +3,7 @@
   stdenv,
   config,
   fetchFromGitHub,
+  fetchpatch,
   nix-update-script,
   pkg-config,
   mesa,
@@ -91,6 +92,11 @@ stdenv.mkDerivation (finalAttrs: {
     # but on NixOS they're spread across different paths.
     # This patch + the setup-hook will ensure that `sdl2-config --cflags` works correctly.
     ./find-headers.patch
+    # https://github.com/libsdl-org/SDL/issues/12224
+    (fetchpatch {
+      url = "https://github.com/libsdl-org/SDL/commit/9e079fe9c7931738ed63d257b1d7fb8a07b66824.diff";
+      hash = "sha256-G8gAivCtw5zuPVI9wvEq2oIo/NxFdnPqyLwrmHG1EJ4=";
+    })
   ];
 
   postPatch = ''

pkgs/development/libraries/qtstyleplugin-kvantum/default.nix

@@ -23,13 +23,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "qtstyleplugin-kvantum${lib.optionalString isQt5 "5"}";
-  version = "1.1.3";
+  version = "1.1.4";
 
   src = fetchFromGitHub {
     owner = "tsujan";
     repo = "Kvantum";
     rev = "V${finalAttrs.version}";
-    hash = "sha256-x2XsJ26y9y6IF9aY0fmAcvO4zmwLjvE2Lfvzw+GqchM=";
+    hash = "sha256-49QnPwGQo4gOxO7EUJnn0JoQl6LgrEOW3cks3IT3fnU=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/acquire/default.nix

@@ -54,6 +54,13 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [ pytestCheckHook ] ++ optional-dependencies.full;
 
+  disabledTests = [
+    "test_collector_collect_path_with_dir"
+    "test_collector_collect_glob"
+    "test_misc_osx"
+    "test_misc_unix"
+  ];
+
   pythonImportsCheck = [ "acquire" ];
 
   meta = with lib; {

pkgs/development/python-modules/aider-chat/default.nix

@@ -13,7 +13,7 @@ let
     self = python3;
     packageOverrides = _: super: { tree-sitter = super.tree-sitter_0_21; };
   };
-  version = "0.75.1";
+  version = "0.75.2";
   aider-chat = python3.pkgs.buildPythonPackage {
     pname = "aider-chat";
     inherit version;
@@ -23,7 +23,7 @@ let
       owner = "Aider-AI";
       repo = "aider";
       tag = "v${version}";
-      hash = "sha256-TQDYrkSW58E1/lIBuJsgpXst8OAbaTyNX1SM8mdFgzU";
+      hash = "sha256-+XpvAnxsv6TbsJwTAgNdJtZxxoPXQ9cxRVUaFZCnS8w=";
     };
 
     pythonRelaxDeps = true;

pkgs/development/python-modules/anybadge/default.nix

@@ -2,34 +2,45 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  setuptools,
   packaging,
   pytestCheckHook,
   pythonOlder,
   requests,
+  sh,
 }:
 
 buildPythonPackage rec {
   pname = "anybadge";
   version = "1.16.0";
-  format = "setuptools";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "jongracecox";
-    repo = pname;
+    repo = "anybadge";
     tag = "v${version}";
     hash = "sha256-9qGmiIGzVdWHMyurMqTqEz+NKYlc/5zt6HPsssCH4Pk=";
   };
 
-  # setup.py reads its version from the TRAVIS_TAG environment variable
-  TRAVIS_TAG = "v${version}";
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace-fail '=get_version(),' "='$version',"
+  '';
 
-  propagatedBuildInputs = [ packaging ];
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
+    packaging
+  ];
 
   nativeCheckInputs = [
     pytestCheckHook
     requests
+    sh
   ];
 
   disabledTests = [
@@ -44,11 +55,11 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "anybadge" ];
 
-  meta = with lib; {
+  meta = {
     description = "Python tool for generating badges for your projects";
     homepage = "https://github.com/jongracecox/anybadge";
     changelog = "https://github.com/jongracecox/anybadge/releases/tag/${src.tag}";
-    license = licenses.mit;
-    maintainers = with maintainers; [ fabiangd ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fabiangd ];
   };
 }

pkgs/development/python-modules/coiled/default.nix

@@ -39,12 +39,12 @@
 
 buildPythonPackage rec {
   pname = "coiled";
-  version = "1.79.2";
+  version = "1.82.0";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-PRBmM0YN2MPHRMzDmV9nYhP+Jr0tOxkXgHDnW8pN9ug=";
+    hash = "sha256-GNWiSv+1V++Jj8w5vLr2Ph3sSg7sHtX0kFsxEcEG9hE=";
   };
 
   build-system = [

pkgs/development/python-modules/datafusion/default.nix

@@ -69,7 +69,8 @@ buildPythonPackage rec {
 
   dependencies = [
     pyarrow
-  ] ++ lib.optionals (pythonOlder "3.13") [ typing-extensions ];
+    typing-extensions
+  ];
 
   nativeCheckInputs = [
     pytestCheckHook

pkgs/development/python-modules/dissect-fve/default.nix

@@ -0,0 +1,58 @@
+{
+  lib,
+  argon2-cffi,
+  buildPythonPackage,
+  dissect-cstruct,
+  dissect-util,
+  dissect-target,
+  fetchFromGitHub,
+  pycryptodome,
+  pythonOlder,
+  rich,
+  setuptools-scm,
+  setuptools,
+}:
+
+buildPythonPackage rec {
+  pname = "dissect-fve";
+  version = "4.0";
+  pyproject = true;
+
+  disabled = pythonOlder "3.9";
+
+  src = fetchFromGitHub {
+    owner = "fox-it";
+    repo = "dissect.fve";
+    tag = version;
+    hash = "sha256-R6ZrUofycEgJlwLE4/CXFZ2gTg+ETBPlBBC8+s5YN6M=";
+  };
+
+  build-system = [
+    setuptools
+    setuptools-scm
+  ];
+
+  dependencies = [
+    argon2-cffi
+    dissect-cstruct
+    dissect-util
+    pycryptodome
+  ];
+
+  optional-dependencies = {
+    full = [
+      dissect-target
+      rich
+    ];
+  };
+
+  pythonImportsCheck = [ "dissect.fve" ];
+
+  meta = with lib; {
+    description = "Dissect module implementing parsers for full volume encryption implementations";
+    homepage = "https://github.com/fox-it/dissect.fve";
+    changelog = "https://github.com/fox-it/dissect.fve/releases/tag/${version}";
+    license = licenses.agpl3Only;
+    maintainers = with maintainers; [ fab ];
+  };
+}

pkgs/development/python-modules/dissect-target/default.nix

@@ -24,6 +24,7 @@
   dissect-util,
   dissect-volume,
   dissect-xfs,
+  docutils,
   fetchFromGitHub,
   flow-record,
   fusepy,
@@ -107,13 +108,21 @@ buildPythonPackage rec {
     mqtt = [ paho-mqtt ] ++ optional-dependencies.full;
   };
 
-  nativeCheckInputs = [ pytestCheckHook ] ++ optional-dependencies.full;
+  nativeCheckInputs = [
+    docutils
+    pytestCheckHook
+  ] ++ optional-dependencies.full;
 
   pythonImportsCheck = [ "dissect.target" ];
 
   disabledTests =
     [
       "test_cpio"
+      "test_env_parser"
+      "test_cp_directory"
+      "test_cp_subdirectories"
+      "test_shell_cli"
+      "test_shell_cmd"
       # Test requires rdump
       "test_exec_target_command"
       # Issue with tar file
@@ -136,9 +145,7 @@ buildPythonPackage rec {
       "test_reg_output"
       "test_regflex"
       "test_systemd_basic_syntax"
-      "test_target_cli_unicode_argparse"
-      "test_target_query"
-      "test_target_info"
+      "test_target"
       "test_yara"
     ]
     ++
@@ -151,8 +158,10 @@ buildPythonPackage rec {
     # ValueError: Invalid Locate file magic. Expected /x00LOCATE02/x00
     "tests/plugins/os/unix/locate/"
     # Missing plugin support
+    "tests/plugins/child/"
     "tests/tools/test_dump.py"
     "tests/plugins/os/"
+    "tests/test_container.py"
     "tests/plugins/filesystem/"
     "tests/test_registration.py"
     "tests/filesystems/"

pkgs/development/python-modules/dissect-volume/default.nix

@@ -48,6 +48,7 @@ buildPythonPackage rec {
     "test_lvm"
     "test_md_raid0_zones"
     "test_md_read"
+    "test_vinum"
   ];
 
   meta = with lib; {

pkgs/development/python-modules/dissect/default.nix

@@ -14,6 +14,7 @@
   dissect-extfs,
   dissect-fat,
   dissect-ffs,
+  dissect-fve,
   dissect-hypervisor,
   dissect-jffs,
   dissect-ntfs,
@@ -68,6 +69,7 @@ buildPythonPackage rec {
     dissect-extfs
     dissect-fat
     dissect-ffs
+    dissect-fve
     dissect-hypervisor
     dissect-jffs
     dissect-ntfs

pkgs/development/python-modules/iterfzf/default.nix

@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "iterfzf";
-  version = "1.4.0.60.2";
+  version = "1.5.0.60.2";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "dahlia";
     repo = "iterfzf";
     tag = version;
-    hash = "sha256-/9nEux//IaTFjiOqHBDXxURT/fyDS7ksdVPhsvUijpU=";
+    hash = "sha256-9WN49tY9wWBVQGXCpvNQlRaRCZWSfV4xrZPoIOVjK9g=";
   };
 
   postPatch = ''

pkgs/development/python-modules/lida/default.nix

@@ -0,0 +1,108 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  setuptools,
+  setuptools-scm,
+  altair,
+  fastapi,
+  geopandas,
+  kaleido,
+  llmx,
+  matplotlib,
+  matplotlib-venn,
+  networkx,
+  numpy,
+  pandas,
+  plotly,
+  plotnine,
+  pydantic,
+  python-multipart,
+  scipy,
+  seaborn,
+  statsmodels,
+  typer,
+  uvicorn,
+  wordcloud,
+  peacasso,
+  basemap,
+  basemap-data-hires,
+  geopy,
+}:
+
+buildPythonPackage rec {
+  pname = "lida";
+  version = "0.0.14";
+  pyproject = true;
+
+  # No releases or tags are available in https://github.com/microsoft/lida
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-/az6hS8rNPxb8cDiz9SOyUBi/X48r9prJNFUnx1wPHM=";
+  };
+
+  patches = [
+    # The upstream places the data path under the py file's own directory.
+    # However, since `/nix/store` is read-only, we patch it to the user's home directory.
+    ./rw_data.patch
+  ];
+
+  build-system = [
+    setuptools
+    setuptools-scm
+  ];
+
+  dependencies = [
+    altair
+    fastapi
+    geopandas
+    kaleido
+    llmx
+    matplotlib
+    matplotlib-venn
+    networkx
+    numpy
+    pandas
+    plotly
+    plotnine
+    pydantic
+    python-multipart
+    scipy
+    seaborn
+    statsmodels
+    typer
+    uvicorn
+    wordcloud
+  ];
+
+  optional-dependencies = {
+    infographics = [
+      peacasso
+    ];
+    tools = [
+      basemap
+      basemap-data-hires
+      geopy
+    ];
+    transformers = [
+      llmx
+    ];
+    web = [
+      fastapi
+      uvicorn
+    ];
+  };
+
+  # require network
+  doCheck = false;
+
+  pythonImportsCheck = [ "lida" ];
+
+  meta = {
+    description = "Automatic Generation of Visualizations and Infographics using Large Language Models";
+    homepage = "https://github.com/microsoft/lida";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ moraxyc ];
+    mainProgram = "lida";
+  };
+}

pkgs/development/python-modules/lida/rw_data.patch

@@ -0,0 +1,16 @@
+diff --git a/lida/web/app.py b/lida/web/app.py
+index 32046a3..599ae07 100644
+--- a/lida/web/app.py
++++ b/lida/web/app.py
+@@ -34,8 +34,9 @@ app.mount("/api", api)
+ 
+ root_file_path = os.path.dirname(os.path.abspath(__file__))
+ static_folder_root = os.path.join(root_file_path, "ui")
+-files_static_root = os.path.join(root_file_path, "files/")
+-data_folder = os.path.join(root_file_path, "files/data")
++home_dir = os.path.expanduser("~")
++files_static_root = os.path.join(home_dir, ".lida/files")
++data_folder = os.path.join(files_static_root, "data")
+ os.makedirs(data_folder, exist_ok=True)
+ os.makedirs(files_static_root, exist_ok=True)
+ os.makedirs(static_folder_root, exist_ok=True)

pkgs/development/python-modules/mandown/default.nix

@@ -19,14 +19,14 @@
 
 buildPythonPackage rec {
   pname = "mandown";
-  version = "1.11.1";
+  version = "1.11.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "potatoeggy";
     repo = "mandown";
     tag = "v${version}";
-    hash = "sha256-xoRUGtZMM1l3gCtF1wFHBo3vTEGJcNxqkO/yeTuEke8=";
+    hash = "sha256-dKo/sFCdk5nRQ5OrUjTCl5cswfVgEPb/nTnloCeuIRA=";
   };
 
   build-system = [

pkgs/development/python-modules/mrsqm/default.nix

@@ -11,11 +11,12 @@
   pip,
   setuptools,
   pytestCheckHook,
+  nix-update-script,
 }:
 
 buildPythonPackage rec {
   pname = "mrsqm";
-  version = "4";
+  version = "0.0.7";
   pyproject = true;
 
   build-system = [
@@ -27,8 +28,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "mlgig";
     repo = "mrsqm";
-    tag = "r${version}";
-    hash = "sha256-59f18zItV3K6tXcg1v1q2Z8HYrQB8T0ntaaqjxeAEbM=";
+    tag = "v.${version}";
+    hash = "sha256-5K6vCU0HExnmYNThZNDCbEtII9bUGauxDtKkJXe/85Q=";
   };
 
   buildInputs = [ fftw ];
@@ -44,7 +45,7 @@ buildPythonPackage rec {
 
   postPatch = ''
     substituteInPlace setup.py \
-      --replace-fail "'pytest-runner'" ""
+      --replace-fail "setup_requires=['pytest-runner']," ""
     substituteInPlace pyproject.toml \
       --replace-fail "numpy==" "numpy>="
   '';
@@ -63,6 +64,13 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "mrsqm" ];
 
+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--version-regex"
+      "v\\.(.*)"
+    ];
+  };
+
   meta = {
     description = "MrSQM (Multiple Representations Sequence Miner) is a time series classifier";
     homepage = "https://pypi.org/project/mrsqm";

pkgs/development/python-modules/sopel/default.nix

@@ -52,7 +52,10 @@ buildPythonPackage rec {
 
   pythonRemoveDeps = [ "sopel-help" ];
 
-  pythonRelaxDeps = [ "sqlalchemy" ];
+  pythonRelaxDeps = [
+    "sqlalchemy"
+    "xmltodict"
+  ];
 
   nativeCheckInputs = [ pytestCheckHook ];
 

pkgs/development/python-modules/trimesh/default.nix

@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "trimesh";
-  version = "4.6.3";
+  version = "4.6.4";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "mikedh";
     repo = "trimesh";
     tag = version;
-    hash = "sha256-QKV0qb36BfJWbmbqTXzPFY2X6SD+B3FxWSoDltDP8fM=";
+    hash = "sha256-kkIGAeWFrgOIbvBnZFRQue7Fh7REKF/CHgJLBEZliLM=";
   };
 
   build-system = [ setuptools ];

pkgs/development/tools/electron/binary/generic.nix

@@ -56,7 +56,7 @@ let
     ];
     sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     # https://www.electronjs.org/docs/latest/tutorial/electron-timelines
-    knownVulnerabilities = optional (versionOlder version "32.0.0") "Electron version ${version} is EOL";
+    knownVulnerabilities = optional (versionOlder version "33.0.0") "Electron version ${version} is EOL";
   };
 
   fetcher =

pkgs/development/tools/electron/binary/info.json

@@ -1,14 +1,14 @@
 {
     "32": {
         "hashes": {
-            "aarch64-darwin": "f644ac51590a5d2e16318aca9a2ad70f9b5c45cc2edf2524b33d15dd0add4193",
-            "aarch64-linux": "5223d8bb21aac0a55dd09587773d93b0ca4c8c4161ac56158d93199973c8200c",
-            "armv7l-linux": "153a37e43175064539c63550fee2104fc21b95279daaf8fc38dd617dbfcd2c52",
-            "headers": "1sdvj3a05yrvy3b8bgzn8b2diz2ivlh4jsvhcffid0wbb17in2xj",
-            "x86_64-darwin": "e85b8ca35d0710087c2915f5dab07828733b2a1aaad04ae4907f0754346a09c6",
-            "x86_64-linux": "6afd83962ecbfbad19fe06d101ae00ee0662f4612c70620deb61cf6fac5b8118"
+            "aarch64-darwin": "67e5f8ce2c395b6b5a4c896ee1f2558b0003d0a54a7f4aef3b7760409ffc5825",
+            "aarch64-linux": "6b18f435855284852be2b2c1b49e58df380a56784d78b358a13ea77bbace4a8a",
+            "armv7l-linux": "a067329d55cc6648e9f783fd8b01b93da45ac21892b8096d758b30a87505c1a7",
+            "headers": "0pb06wlx5zz0asrh05c90q0np14c4swkvhzrcqmcyfz7ihczqh5a",
+            "x86_64-darwin": "0499216feffc2ba56438d8c4ac89cf40117baee6335099f5b12457d339f465a6",
+            "x86_64-linux": "0e1f1540492e48e3b8805f87c5096c3b99995c4c1b581ee57e9c836538bae813"
         },
-        "version": "32.3.2"
+        "version": "32.3.3"
     },
     "33": {
         "hashes": {

pkgs/development/tools/electron/chromedriver/info.json

@@ -1,14 +1,14 @@
 {
     "32": {
         "hashes": {
-            "aarch64-darwin": "50ffb73f7ac2705dc1500977dfe391f21895eefdb1eac642786ff9e3904f667e",
-            "aarch64-linux": "780c79bd0f96498c8934262c56b105c53ced1fe7a6b442d1c32bcf2737bc8782",
-            "armv7l-linux": "11aefc9f15b62c7102824927aa34ce07c479de9102212d00e96ff2f5ac268d89",
-            "headers": "1sdvj3a05yrvy3b8bgzn8b2diz2ivlh4jsvhcffid0wbb17in2xj",
-            "x86_64-darwin": "305ed9ef27305e8ee7a851e6ca169de360ee607497b5577174c67cfe4836f9ad",
-            "x86_64-linux": "27d0c689b9a8564220adae3aea2a6f42411c986795f779a729fe90aed93fee61"
+            "aarch64-darwin": "a5fd8e33f01833f567655900e9685ca7141be4a83ed05bbcb2f5b4e6af1c7c91",
+            "aarch64-linux": "2535230e99cf356285c19af32586940e3416c22546bea0b38d71e6dd2579fa8f",
+            "armv7l-linux": "bda58c490006c5df0e5a87038e38943ec2e8e222496bfb1ac590f4732e5ffcf6",
+            "headers": "0pb06wlx5zz0asrh05c90q0np14c4swkvhzrcqmcyfz7ihczqh5a",
+            "x86_64-darwin": "9fa0bb73f1c9d1c011f35c664beb3cdd06def063d4a72a581663776e5808579b",
+            "x86_64-linux": "adfb974ccb29edc2365b244e3c4d06dae6a0bd4f5cf280ff62271959a8aad10e"
         },
-        "version": "32.3.2"
+        "version": "32.3.3"
     },
     "33": {
         "hashes": {

pkgs/development/tools/electron/common.nix

@@ -163,21 +163,6 @@ in
     ''
     + base.postPatch;
 
-  env =
-    base.env
-    // lib.optionalAttrs (lib.versionOlder info.version "33") {
-      # Hydra fails to build electron_32.aarch64-linux as of 2025-01-05 due to
-      # clang spamming deprecation warnings mid-build, causing the build log to
-      # grow beyond the limit of 64mb and then getting killed by Hydra. This
-      # renders our clang both too old for the latest chromium without the use
-      # of -Wno-unknown-warning-option and also too new for electron_32 (M128).
-      # For some reason, the log size limit appears to only be enforced on
-      # aarch64-linux. x86_64-linux happily succeeds to build with ~180mb. To
-      # unbreak the build on h.n.o, we simply disable those warnings for now.
-      # https://hydra.nixos.org/build/283952243
-      NIX_CFLAGS_COMPILE = base.env.NIX_CFLAGS_COMPILE + " -Wno-deprecated";
-    };
-
   preConfigure =
     ''
       (
@@ -187,51 +172,46 @@ in
     ''
     + (base.preConfigure or "");
 
-  gnFlags =
-    rec {
-      # build/args/release.gn
-      is_component_build = false;
-      is_official_build = true;
-      rtc_use_h264 = proprietary_codecs;
-      is_component_ffmpeg = true;
+  gnFlags = rec {
+    # build/args/release.gn
+    is_component_build = false;
+    is_official_build = true;
+    rtc_use_h264 = proprietary_codecs;
+    is_component_ffmpeg = true;
 
-      # build/args/all.gn
-      is_electron_build = true;
-      root_extra_deps = [ "//electron" ];
-      node_module_version = info.modules;
-      v8_promise_internal_field_count = 1;
-      v8_embedder_string = "-electron.0";
-      v8_enable_snapshot_native_code_counters = false;
-      v8_enable_javascript_promise_hooks = true;
-      enable_cdm_host_verification = false;
-      proprietary_codecs = true;
-      ffmpeg_branding = "Chrome";
-      enable_printing = true;
-      angle_enable_vulkan_validation_layers = false;
-      dawn_enable_vulkan_validation_layers = false;
-      enable_pseudolocales = false;
-      allow_runtime_configurable_key_storage = true;
-      enable_cet_shadow_stack = false;
-      is_cfi = false;
-      use_qt = false;
-      v8_builtins_profiling_log_file = "";
-      enable_dangling_raw_ptr_checks = false;
-      dawn_use_built_dxc = false;
-      v8_enable_private_mapping_fork_optimization = true;
-      v8_expose_public_symbols = true;
-      enable_dangling_raw_ptr_feature_flag = false;
-      clang_unsafe_buffers_paths = "";
-      enterprise_cloud_content_analysis = false;
-    }
-    // lib.optionalAttrs (lib.versionAtLeast info.version "33") {
-      content_enable_legacy_ipc = true;
-    }
-    // {
+    # build/args/all.gn
+    is_electron_build = true;
+    root_extra_deps = [ "//electron" ];
+    node_module_version = info.modules;
+    v8_promise_internal_field_count = 1;
+    v8_embedder_string = "-electron.0";
+    v8_enable_snapshot_native_code_counters = false;
+    v8_enable_javascript_promise_hooks = true;
+    enable_cdm_host_verification = false;
+    proprietary_codecs = true;
+    ffmpeg_branding = "Chrome";
+    enable_printing = true;
+    angle_enable_vulkan_validation_layers = false;
+    dawn_enable_vulkan_validation_layers = false;
+    enable_pseudolocales = false;
+    allow_runtime_configurable_key_storage = true;
+    enable_cet_shadow_stack = false;
+    is_cfi = false;
+    use_qt = false;
+    v8_builtins_profiling_log_file = "";
+    enable_dangling_raw_ptr_checks = false;
+    dawn_use_built_dxc = false;
+    v8_enable_private_mapping_fork_optimization = true;
+    v8_expose_public_symbols = true;
+    enable_dangling_raw_ptr_feature_flag = false;
+    clang_unsafe_buffers_paths = "";
+    enterprise_cloud_content_analysis = false;
+    content_enable_legacy_ipc = true;
 
-      # other
-      enable_widevine = false;
-      override_electron_version = info.version;
-    };
+    # other
+    enable_widevine = false;
+    override_electron_version = info.version;
+  };
 
   installPhase = ''
     runHook preInstall

pkgs/development/tools/electron/info.json

@@ -1,945 +1,4 @@
 {
-    "32": {
-        "chrome": "128.0.6613.186",
-        "chromium": {
-            "deps": {
-                "gn": {
-                    "hash": "sha256-BiMGbML5aNUt4JzzVqSszBj+8BMlEc92csNugo5qjUk=",
-                    "rev": "b2afae122eeb6ce09c52d63f67dc53fc517dbdc8",
-                    "url": "https://gn.googlesource.com/gn",
-                    "version": "2024-06-11"
-                }
-            },
-            "version": "128.0.6613.186"
-        },
-        "chromium_npm_hash": "sha256-OBUYgjfoEZly8JLTtprfU+hlKNFSnHLheaVWhrirGJk=",
-        "deps": {
-            "src": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-6Rtd3eu9z7yvzmMaSGjvTCXt29f9cAXFc1IVT0otQ2I=",
-                "postFetch": "rm -r $out/third_party/blink/web_tests; rm -r $out/third_party/hunspell/tests; rm -r $out/content/test/data; rm -rf $out/courgette/testdata; rm -r $out/extensions/test/data; rm -r $out/media/test/data; ",
-                "rev": "128.0.6613.186",
-                "url": "https://chromium.googlesource.com/chromium/src.git"
-            },
-            "src/chrome/test/data/perf/canvas_bench": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-svOuyBGKloBLM11xLlWCDsB4PpRjdKTBdW2UEW4JQjM=",
-                "rev": "a7b40ea5ae0239517d78845a5fc9b12976bfc732",
-                "url": "https://chromium.googlesource.com/chromium/canvas_bench.git"
-            },
-            "src/chrome/test/data/perf/frame_rate/content": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-t4kcuvH0rkPBkcdiMsoNQaRwU09eU+oSvyHDiAHrKXo=",
-                "rev": "c10272c88463efeef6bb19c9ec07c42bc8fe22b9",
-                "url": "https://chromium.googlesource.com/chromium/frame_rate/content.git"
-            },
-            "src/chrome/test/data/xr/webvr_info": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-BsAPwc4oEWri0TlqhyxqFNqKdfgVSrB0vQyISmYY4eg=",
-                "rev": "c58ae99b9ff9e2aa4c524633519570bf33536248",
-                "url": "https://chromium.googlesource.com/external/github.com/toji/webvr.info.git"
-            },
-            "src/docs/website": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-6pM0P5zXJQXNSQ7MaXSKEHfb7KmtztfhlNlS+i8ugD4=",
-                "rev": "82c1d3e5b812b35df1cb6a031f59616dc594d4f7",
-                "url": "https://chromium.googlesource.com/website.git"
-            },
-            "src/electron": {
-                "fetcher": "fetchFromGitHub",
-                "hash": "sha256-UpLk6Kjd50UHcUV53Gz7KnnXk8T2nd4Oc2FW7CFdL04=",
-                "owner": "electron",
-                "repo": "electron",
-                "rev": "v32.3.2"
-            },
-            "src/media/cdm/api": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-6J6aSYW0or99VAgMNJJOdJqMJspoG7w1HxDN50MV5bw=",
-                "rev": "fef0b5aa1bd31efb88dfab804bdbe614f3d54f28",
-                "url": "https://chromium.googlesource.com/chromium/cdm.git"
-            },
-            "src/net/third_party/quiche/src": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-bFe79wg+PHRphP6I5q2wRheGTUARKx0zjyn3LxCie0s=",
-                "rev": "aecfea159d58ef53bd690688e4aca512fc4a3d35",
-                "url": "https://quiche.googlesource.com/quiche.git"
-            },
-            "src/testing/libfuzzer/fuzzers/wasm_corpus": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-qWsGQNUptbz0jYvUuxP7woNf5QQrfn9k3uvr82Yk0QM=",
-                "rev": "f650ff816f2ef227f61ea2e9f222aa69708ab367",
-                "url": "https://chromium.googlesource.com/v8/fuzzer_wasm_corpus.git"
-            },
-            "src/third_party/accessibility_test_framework/src": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-mzVgoxxBWebesG6okyMxxmO6oH+TITA4o9ucHHMMzkQ=",
-                "rev": "4a764c690353ea136c82f1a696a70bf38d1ef5fe",
-                "url": "https://chromium.googlesource.com/external/github.com/google/Accessibility-Test-Framework-for-Android.git"
-            },
-            "src/third_party/angle": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-YV7RIbGq3zcnl4ZXJndjqbaPPDxCOzPJ87aH672mNq0=",
-                "rev": "713102774487cf1a8b3f433529eb8181cbcec31a",
-                "url": "https://chromium.googlesource.com/angle/angle.git"
-            },
-            "src/third_party/angle/third_party/VK-GL-CTS/src": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-haO6KT+VbG/d2FljtsoJT7xghPTeEY5GPJdh2s9faVs=",
-                "rev": "5b2dfe7c775aa7b7909432944ba3535abcd25fc9",
-                "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/VK-GL-CTS"
-            },
-            "src/third_party/angle/third_party/glmark2/src": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-L7+zWM0qn8WFhmON7DGvarTsN1YHt1sn5+hazTOZrrk=",
-                "rev": "ca8de51fedb70bace5351c6b002eb952c747e889",
-                "url": "https://chromium.googlesource.com/external/github.com/glmark2/glmark2"
-            },
-            "src/third_party/angle/third_party/rapidjson/src": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-btUl1a/B0sXwf/+hyvCvVJjWqIkXfVYCpHm3TeBuOxk=",
-                "rev": "781a4e667d84aeedbeb8184b7b62425ea66ec59f",
-                "url": "https://chromium.googlesource.com/external/github.com/Tencent/rapidjson"
-            },
-            "src/third_party/anonymous_tokens/src": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-o/9lOnPR6vT0pkqWgenfyh9nI5Qoxyd030MNTfcoRSc=",
-                "rev": "76bfcccb6418239183df55111f2f24782d9f3680",
-                "url": "https://chromium.googlesource.com/external/github.com/google/anonymous-tokens.git"
-            },
-            "src/third_party/beto-core/src": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-E2oaN2nbqG21qFhUtatsbXwC8KhoQadvU6BmYxF2lgs=",
-                "rev": "08537fdd2b0990270ea0214a61dfd318f293bc15",
-                "url": "https://beto-core.googlesource.com/beto-core.git"
-            },
-            "src/third_party/boringssl/src": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-jZ9T5/6t1ImeCDBAMzW0aSmT/NcLxbESYv/F+cBjIFY=",
-                "rev": "f01108e4761e1d4189cb134322c3cb01dc71ef87",
-                "url": "https://boringssl.googlesource.com/boringssl.git"
-            },
-            "src/third_party/breakpad/breakpad": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-QuMzYywRDzbwZHJrz/Gm/W6kclvBImRZCnGq8AbTxUY=",
-                "rev": "81819541a78c49e9109d2267462775e801f89ce6",
-                "url": "https://chromium.googlesource.com/breakpad/breakpad.git"
-            },
-            "src/third_party/cast_core/public/src": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-AalRQhJmornCqmvE2+36J/3LubaA0jr6P1PXy32lX4I=",
-                "rev": "71f51fd6fa45fac73848f65421081edd723297cd",
-                "url": "https://chromium.googlesource.com/cast_core/public"
-            },
-            "src/third_party/catapult": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-LIPOcMBxugyuYJ7IE1VszqLAWBBR58Ozy9VCRqVL208=",
-                "rev": "523ebded2f72a446544e2d9271ef39857f4e6ae7",
-                "url": "https://chromium.googlesource.com/catapult.git"
-            },
-            "src/third_party/ced/src": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-ySG74Rj2i2c/PltEgHVEDq+N8yd9gZmxNktc56zIUiY=",
-                "rev": "ba412eaaacd3186085babcd901679a48863c7dd5",
-                "url": "https://chromium.googlesource.com/external/github.com/google/compact_enc_det.git"
-            },
-            "src/third_party/chromium-variations": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-E6deeWYQt2BxT+9Zb2VSXvZWCQI64Kf1dzUYAZJVA2s=",
-                "rev": "c134de595151ae72a112767e22da4448eb50e57f",
-                "url": "https://chromium.googlesource.com/chromium-variations.git"
-            },
-            "src/third_party/clang-format/script": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-whD8isX2ZhLrFzdxHhFP1S/sZDRgyrzLFaVd7OEFqYo=",
-                "rev": "3c0acd2d4e73dd911309d9e970ba09d58bf23a62",
-                "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/clang/tools/clang-format.git"
-            },
-            "src/third_party/cld_3/src": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-C3MOMBUy9jgkT9BAi/Fgm2UH4cxRuwSBEcRl3hzM2Ss=",
-                "rev": "b48dc46512566f5a2d41118c8c1116c4f96dc661",
-                "url": "https://chromium.googlesource.com/external/github.com/google/cld_3.git"
-            },
-            "src/third_party/colorama/src": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-6ZTdPYSHdQOLYMSnE+Tp7PgsVTs3U2awGu9Qb4Rg/tk=",
-                "rev": "3de9f013df4b470069d03d250224062e8cf15c49",
-                "url": "https://chromium.googlesource.com/external/colorama.git"
-            },
-            "src/third_party/content_analysis_sdk/src": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-f5Jmk1MiGjaRdLun+v/GKVl8Yv9hOZMTQUSxgiJalcY=",
-                "rev": "9a408736204513e0e95dd2ab3c08de0d95963efc",
-                "url": "https://chromium.googlesource.com/external/github.com/chromium/content_analysis_sdk.git"
-            },
-            "src/third_party/cpu_features/src": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-E8LoVzhe+TAmARWZTSuINlsVhzpUJMxPPCGe/dHZcyA=",
-                "rev": "936b9ab5515dead115606559502e3864958f7f6e",
-                "url": "https://chromium.googlesource.com/external/github.com/google/cpu_features.git"
-            },
-            "src/third_party/cpuinfo/src": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-UKy9TIiO/UJ5w+qLRlMd085CX2qtdVH2W3rtxB5r6MY=",
-                "rev": "ca678952a9a8eaa6de112d154e8e104b22f9ab3f",
-                "url": "https://chromium.googlesource.com/external/github.com/pytorch/cpuinfo.git"
-            },
-            "src/third_party/crabbyavif/src": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-vnFxeAu6NMY6TOb2+LvGbCyOLbVD9R+utl/nnnCWVks=",
-                "rev": "716408df5cb6d43ebe31cb24194979b81a83b03c",
-                "url": "https://chromium.googlesource.com/external/github.com/webmproject/CrabbyAvif.git"
-            },
-            "src/third_party/crc32c/src": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-urg0bmnfMfHagLPELp4WrNCz1gBZ6DFOWpDue1KsMtc=",
-                "rev": "fa5ade41ee480003d9c5af6f43567ba22e4e17e6",
-                "url": "https://chromium.googlesource.com/external/github.com/google/crc32c.git"
-            },
-            "src/third_party/cros-components/src": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-6XVrzfpQ8Rh99bCGbUkGd/zmFNgt4ZyRsyNvUkIfEyE=",
-                "rev": "39e57dd0d30ed019d6fb07c24b350f5fe78a1625",
-                "url": "https://chromium.googlesource.com/external/google3/cros_components.git"
-            },
-            "src/third_party/cros_system_api": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-Wq6XYQYAWzy3AurVkLGofFF4avntKIPmx6L7vPW2c2Q=",
-                "rev": "86bdf11581c80f776bfdf54db7f39f930fd6abaf",
-                "url": "https://chromium.googlesource.com/chromiumos/platform2/system_api.git"
-            },
-            "src/third_party/crossbench": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-ICE5UkP91LHBT0vCpwKmdR+3ePnYcwnFroPUpJMKDvU=",
-                "rev": "b03a515f9e56280ecabfb254b188349d1a049827",
-                "url": "https://chromium.googlesource.com/crossbench.git"
-            },
-            "src/third_party/dav1d/libdav1d": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-SlHTLgqaVST4pRstuzSBZmMx87I9TJ1c0qhClvU2sjI=",
-                "rev": "2355eeb8f254a1c34dbb0241be5c70cdf6ed46d1",
-                "url": "https://chromium.googlesource.com/external/github.com/videolan/dav1d.git"
-            },
-            "src/third_party/dawn": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-UTtU0GIlkOtXA3vJy0MA99wLARHl7WMM7IBNmXxE6d4=",
-                "rev": "a79093138c06b0ca942f99ddc39b225dafa4776d",
-                "url": "https://dawn.googlesource.com/dawn.git"
-            },
-            "src/third_party/dawn/third_party/dxc": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-p4DZNVQ8C4YB52BfBKEFXCqenQk0ONkzkctM9vyz4aw=",
-                "rev": "ee5422d3f33c0bfd8643ce7782eb3a216cf15dea",
-                "url": "https://chromium.googlesource.com/external/github.com/microsoft/DirectXShaderCompiler"
-            },
-            "src/third_party/dawn/third_party/dxheaders": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-0Miw1Cy/jmOo7bLFBOHuTRDV04cSeyvUEyPkpVsX9DA=",
-                "rev": "980971e835876dc0cde415e8f9bc646e64667bf7",
-                "url": "https://chromium.googlesource.com/external/github.com/microsoft/DirectX-Headers"
-            },
-            "src/third_party/dawn/third_party/glfw": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-E1zXIDiw87badrLOZTvV+Wh9NZHu51nb70ZK9vlAlqE=",
-                "rev": "b35641f4a3c62aa86a0b3c983d163bc0fe36026d",
-                "url": "https://chromium.googlesource.com/external/github.com/glfw/glfw"
-            },
-            "src/third_party/dawn/third_party/khronos/EGL-Registry": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-Z6DwLfgQ1wsJXz0KKJyVieOatnDmx3cs0qJ6IEgSq1A=",
-                "rev": "7dea2ed79187cd13f76183c4b9100159b9e3e071",
-                "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/EGL-Registry"
-            },
-            "src/third_party/dawn/third_party/khronos/OpenGL-Registry": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-K3PcRIiD3AmnbiSm5TwaLs4Gu9hxaN8Y91WMKK8pOXE=",
-                "rev": "5bae8738b23d06968e7c3a41308568120943ae77",
-                "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/OpenGL-Registry"
-            },
-            "src/third_party/dawn/third_party/webgpu-cts": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-jDjxhMN+cXrf2+sCdp5GqhXuoO2EkoEijSx3PcYahpg=",
-                "rev": "5167b71635dfbfa5d4558de0da01923d446a5cd4",
-                "url": "https://chromium.googlesource.com/external/github.com/gpuweb/cts"
-            },
-            "src/third_party/dawn/third_party/webgpu-headers": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-J3PcwYoO79HqrACFgk77BZLTCi7oi5k2J6v3wlcFVD4=",
-                "rev": "8049c324dc7b3c09dc96ea04cb02860f272c8686",
-                "url": "https://chromium.googlesource.com/external/github.com/webgpu-native/webgpu-headers"
-            },
-            "src/third_party/depot_tools": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-Tc3x10zkgOvOqMap0xwsFd7W2l8ZyA923C0RRgw+jp0=",
-                "rev": "31e21628c3a558d4f2189712e25849d608b3ff8c",
-                "url": "https://chromium.googlesource.com/chromium/tools/depot_tools.git"
-            },
-            "src/third_party/devtools-frontend/src": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-agqi21oQNixRF+foVECaf4MiDVQdA308sLIgLGKiwYI=",
-                "rev": "47f04a536265028feb1254a3663853e0ce526455",
-                "url": "https://chromium.googlesource.com/devtools/devtools-frontend"
-            },
-            "src/third_party/dom_distiller_js/dist": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-yuEBD2XQlV3FGI/i7lTmJbCqzeBiuG1Qow8wvsppGJw=",
-                "rev": "199de96b345ada7c6e7e6ba3d2fa7a6911b8767d",
-                "url": "https://chromium.googlesource.com/chromium/dom-distiller/dist.git"
-            },
-            "src/third_party/eigen3/src": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-qmFsmFEQCDH+TRFc8+5BsYAG1ybL08fWhn8NpM6H6xY=",
-                "rev": "33d0937c6bdf5ec999939fb17f2a553183d14a74",
-                "url": "https://chromium.googlesource.com/external/gitlab.com/libeigen/eigen.git"
-            },
-            "src/third_party/electron_node": {
-                "fetcher": "fetchFromGitHub",
-                "hash": "sha256-sUbqRJTFMuGhNHNwGZmAqNfw0t6ms8WpAeCSGjNX7Cw=",
-                "owner": "nodejs",
-                "repo": "node",
-                "rev": "v20.18.1"
-            },
-            "src/third_party/emoji-segmenter/src": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-oT9mAKoKnrsFsBAeTRfPOXM76HRQQabFAlPpfKUGFhs=",
-                "rev": "9ba6d25d0d9313569665d4a9d2b34f0f39f9a50e",
-                "url": "https://chromium.googlesource.com/external/github.com/google/emoji-segmenter.git"
-            },
-            "src/third_party/engflow-reclient-configs": {
-                "fetcher": "fetchFromGitHub",
-                "hash": "sha256-aZXYPj9KYBiZnljqOLlWJWS396Fg3EhjiQLZmkwCBsY=",
-                "owner": "EngFlow",
-                "repo": "reclient-configs",
-                "rev": "955335c30a752e9ef7bff375baab5e0819b6c00d"
-            },
-            "src/third_party/expat/src": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-fr18LL/xX23t9TIn3q8jWdV9Y6coepbGsO3vJVdDW6k=",
-                "rev": "a59c3edffa54a77b8d7b268ef527da541076ca6a",
-                "url": "https://chromium.googlesource.com/external/github.com/libexpat/libexpat.git"
-            },
-            "src/third_party/farmhash/src": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-5n58VEUxa/K//jAfZqG4cXyfxrp50ogWDNYcgiXVHdc=",
-                "rev": "816a4ae622e964763ca0862d9dbd19324a1eaf45",
-                "url": "https://chromium.googlesource.com/external/github.com/google/farmhash.git"
-            },
-            "src/third_party/ffmpeg": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-HVsENaBsYThsScvLwwuBT9dhjq5Acf3eskMIH+09mu0=",
-                "rev": "d941d9677bb4802f01750fd908ec284fb72c84df",
-                "url": "https://chromium.googlesource.com/chromium/third_party/ffmpeg.git"
-            },
-            "src/third_party/flac": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-gvTFPNOlBfozptaH7lTb9iD/09AmpdT3kCl9ClszjEs=",
-                "rev": "689da3a7ed50af7448c3f1961d1791c7c1d9c85c",
-                "url": "https://chromium.googlesource.com/chromium/deps/flac.git"
-            },
-            "src/third_party/flatbuffers/src": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-sdcZAL3ZHIHO9c1ko0xCfyii4jibwA+25RQkDa9XqTo=",
-                "rev": "fb9afbafc7dfe226b9db54d4923bfb8839635274",
-                "url": "https://chromium.googlesource.com/external/github.com/google/flatbuffers.git"
-            },
-            "src/third_party/fontconfig/src": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-W5WIgC6A52kY4fNkbsDEa0o+dfd97Rl5NKfgnIRpI00=",
-                "rev": "14d466b30a8ab4a9d789977ed94f2c30e7209267",
-                "url": "https://chromium.googlesource.com/external/fontconfig.git"
-            },
-            "src/third_party/fp16/src": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-m2d9bqZoGWzuUPGkd29MsrdscnJRtuIkLIMp3fMmtRY=",
-                "rev": "0a92994d729ff76a58f692d3028ca1b64b145d91",
-                "url": "https://chromium.googlesource.com/external/github.com/Maratyszcza/FP16.git"
-            },
-            "src/third_party/freetype-testing/src": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-2aHPchIK5Oce5+XxdXVCC+8EM6i0XT0rFbjSIVa2L1A=",
-                "rev": "7a69b1a2b028476f840ab7d4a2ffdfe4eb2c389f",
-                "url": "https://chromium.googlesource.com/external/github.com/freetype/freetype2-testing.git"
-            },
-            "src/third_party/freetype/src": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-4WPGveEx3PoBpMlh1PyCJ3w5hdpXztzrXcTZfQ+7DtA=",
-                "rev": "37cefe33b284d0bad4ec52bcccc1a8c2d8704340",
-                "url": "https://chromium.googlesource.com/chromium/src/third_party/freetype2.git"
-            },
-            "src/third_party/fuzztest/src": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-Go2Mrehkvk5fz2SlFrChMBnZJ3H8luhJU+M1TtqG7vg=",
-                "rev": "32eb84a95951fa3a0148fb3e6a1a02f830ded136",
-                "url": "https://chromium.googlesource.com/external/github.com/google/fuzztest.git"
-            },
-            "src/third_party/fxdiv/src": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-LjX5kivfHbqCIA5pF9qUvswG1gjOFo3CMpX0VR+Cn38=",
-                "rev": "63058eff77e11aa15bf531df5dd34395ec3017c8",
-                "url": "https://chromium.googlesource.com/external/github.com/Maratyszcza/FXdiv.git"
-            },
-            "src/third_party/gemmlowp/src": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-O5wD8wxgis0qYMaY+xZ21GBDVQFphMRvInCOswS6inA=",
-                "rev": "13d57703abca3005d97b19df1f2db731607a7dc2",
-                "url": "https://chromium.googlesource.com/external/github.com/google/gemmlowp.git"
-            },
-            "src/third_party/glslang/src": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-FhuQ4i8Xhy8FsEdAqJntffpo1vJRPsYdR5GFWXDtQD0=",
-                "rev": "dc9f6f61adaec755a09e1943cf7014c688443bcb",
-                "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/glslang"
-            },
-            "src/third_party/google_benchmark/src": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-gztnxui9Fe/FTieMjdvfJjWHjkImtlsHn6fM1FruyME=",
-                "rev": "344117638c8ff7e239044fd0fa7085839fc03021",
-                "url": "https://chromium.googlesource.com/external/github.com/google/benchmark.git"
-            },
-            "src/third_party/googletest/src": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-iBR2otKeTc864DvCw0n7hpcn/4fHP+CIu2kLmBWym9M=",
-                "rev": "cee1ba1f24fb12b9ae8f31e70dca3f73dbb12cc2",
-                "url": "https://chromium.googlesource.com/external/github.com/google/googletest.git"
-            },
-            "src/third_party/grpc/src": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-64JEVCx/PCM0dvv7kAQvSjLc0QbRAZVBDzwD/FAV6T8=",
-                "rev": "822dab21d9995c5cf942476b35ca12a1aa9d2737",
-                "url": "https://chromium.googlesource.com/external/github.com/grpc/grpc.git"
-            },
-            "src/third_party/harfbuzz-ng/src": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-iR49rfGDKxPObCff1/30hYHpP5FpZ28ROgMZhNk9eFY=",
-                "rev": "1da053e87f0487382404656edca98b85fe51f2fd",
-                "url": "https://chromium.googlesource.com/external/github.com/harfbuzz/harfbuzz.git"
-            },
-            "src/third_party/highway/src": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-PXsXIqWB4NNiFhanRjMIFSWYuW/IRuQo8mMPUBEentY=",
-                "rev": "8295336dd70f1201d42c22ab5b0861de38cf8fbf",
-                "url": "https://chromium.googlesource.com/external/github.com/google/highway.git"
-            },
-            "src/third_party/hunspell_dictionaries": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-67mvpJRFFa9eMfyqFMURlbxOaTJBICnk+gl0b0mEHl8=",
-                "rev": "41cdffd71c9948f63c7ad36e1fb0ff519aa7a37e",
-                "url": "https://chromium.googlesource.com/chromium/deps/hunspell_dictionaries.git"
-            },
-            "src/third_party/icu": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-YlX+PaPhvYh9JzHT9WtS1beUK+cQrHGVUl+IBbv7GeQ=",
-                "rev": "9408c6fd4a39e6fef0e1c4077602e1c83b15f3fb",
-                "url": "https://chromium.googlesource.com/chromium/deps/icu.git"
-            },
-            "src/third_party/instrumented_libs": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-kHKGADAgzlaeckXFbpU1GhJK+zkiRd9XvdtPF6qrQFY=",
-                "rev": "bb6dbcf2df7a9beb34c3773ef4df161800e3aed9",
-                "url": "https://chromium.googlesource.com/chromium/third_party/instrumented_libraries.git"
-            },
-            "src/third_party/jsoncpp/source": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-bSLNcoYBz3QCt5VuTR056V9mU2PmBuYBa0W6hFg2m8Q=",
-                "rev": "42e892d96e47b1f6e29844cc705e148ec4856448",
-                "url": "https://chromium.googlesource.com/external/github.com/open-source-parsers/jsoncpp.git"
-            },
-            "src/third_party/leveldatabase/src": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-TTX2FrmcWsgqrh4uzqMyGnnnG51cVC2ILfdLxD65MLY=",
-                "rev": "068d5ee1a3ac40dabd00d211d5013af44be55bea",
-                "url": "https://chromium.googlesource.com/external/leveldb.git"
-            },
-            "src/third_party/libFuzzer/src": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-T0dO+1A0r6kLFoleMkY8heu80biPntCpvA6YfqA7b+E=",
-                "rev": "758bd21f103a501b362b1ca46fa8fcb692eaa303",
-                "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/compiler-rt/lib/fuzzer.git"
-            },
-            "src/third_party/libaddressinput/src": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-xvUUQSPrvqUp5DI9AqlRTWurwDW087c6v4RvI+4sfOQ=",
-                "rev": "e8712e415627f22d0b00ebee8db99547077f39bd",
-                "url": "https://chromium.googlesource.com/external/libaddressinput.git"
-            },
-            "src/third_party/libaom/source/libaom": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-igHNDa/Jch0hiwDczrDOdrnGL4nMZMRevwX3AsYiUQ0=",
-                "rev": "93b8eee4f428675195c5c76e8da719ff50c2a01c",
-                "url": "https://aomedia.googlesource.com/aom.git"
-            },
-            "src/third_party/libavif/src": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-aol16YtRFF1xQYXNRIZf4QMf5+ba09aDMEBx4lcAbWI=",
-                "rev": "03acd65314fe29e6627cf4eab752819f6ee15d74",
-                "url": "https://chromium.googlesource.com/external/github.com/AOMediaCodec/libavif.git"
-            },
-            "src/third_party/libavifinfo/src": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-61OPjdMCIbHvWncmBzNw6sqlHcuc1kyqm9k1j4UTcZ0=",
-                "rev": "8d8b58a3f517ef8d1794baa28ca6ae7d19f65514",
-                "url": "https://aomedia.googlesource.com/libavifinfo.git"
-            },
-            "src/third_party/libc++/src": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-vRRQW+ekjNpstfUI+OOA6rxwJp/OjRhfStmGEb/fOFg=",
-                "rev": "6bb75caa139ee1e686d2205910454cf6ea212e58",
-                "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxx.git"
-            },
-            "src/third_party/libc++abi/src": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-tSIbtraD/pbqq4lCzgOakepXrSimCyry0WgcGAnkbwM=",
-                "rev": "a3c7d3e2f3e1e724b4651891b1a71257cbd88acc",
-                "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxxabi.git"
-            },
-            "src/third_party/libdrm/src": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-NUxS2rBJ0nFblvHRQUfKT933+DAws5RUTDb+RLxRF4M=",
-                "rev": "98e1db501173303e58ef6a1def94ab7a2d84afc1",
-                "url": "https://chromium.googlesource.com/chromiumos/third_party/libdrm.git"
-            },
-            "src/third_party/libgav1/src": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-+ss9S5t+yoHzqbtX68+5OyyUbJVecYLwp+C3EXfAziE=",
-                "rev": "a2f139e9123bdb5edf7707ac6f1b73b3aa5038dd",
-                "url": "https://chromium.googlesource.com/codecs/libgav1.git"
-            },
-            "src/third_party/libipp/libipp": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-gxU92lHLd6uxO8T3QWhZIK0hGy97cki705DV0VimCPY=",
-                "rev": "2209bb84a8e122dab7c02fe66cc61a7b42873d7f",
-                "url": "https://chromium.googlesource.com/chromiumos/platform2/libipp.git"
-            },
-            "src/third_party/libjpeg_turbo": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-UhDKDfAgcCS92R2EvxKpoiJMvakUDQgyHu2k/xeE7do=",
-                "rev": "ccfbe1c82a3b6dbe8647ceb36a3f9ee711fba3cf",
-                "url": "https://chromium.googlesource.com/chromium/deps/libjpeg_turbo.git"
-            },
-            "src/third_party/liblouis/src": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-EI/uaHXe0NlqdEw764q0SjerThYEVLRogUlmrsZwXnY=",
-                "rev": "9700847afb92cb35969bdfcbbfbbb74b9c7b3376",
-                "url": "https://chromium.googlesource.com/external/liblouis-github.git"
-            },
-            "src/third_party/libphonenumber/dist": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-3hSnTFTD3KAdbyxfKg12qbIYTmw6YlTCH64gMP/HUJo=",
-                "rev": "140dfeb81b753388e8a672900fb7a971e9a0d362",
-                "url": "https://chromium.googlesource.com/external/libphonenumber.git"
-            },
-            "src/third_party/libprotobuf-mutator/src": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-ZyPweW+V5foxFQwjjMLkaRUo+FNV+kEDGIH/4oRV614=",
-                "rev": "a304ec48dcf15d942607032151f7e9ee504b5dcf",
-                "url": "https://chromium.googlesource.com/external/github.com/google/libprotobuf-mutator.git"
-            },
-            "src/third_party/libsrtp": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-XOPiDAOHpWyCiXI+fi1CAie0Zaj4v14m9Kc8+jbzpUY=",
-                "rev": "7a7e64c8b5a632f55929cb3bb7d3e6fb48c3205a",
-                "url": "https://chromium.googlesource.com/chromium/deps/libsrtp.git"
-            },
-            "src/third_party/libsync/src": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-Mkl6C1LxF3RYLwYbxiSfoQPt8QKFwQWj/Ati2sNJ32E=",
-                "rev": "f4f4387b6bf2387efbcfd1453af4892e8982faf6",
-                "url": "https://chromium.googlesource.com/aosp/platform/system/core/libsync.git"
-            },
-            "src/third_party/libunwind/src": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-uUiAqW0OoB+ZWnTFpk2PJqI7kO9WgYLHiHkz8jikSKA=",
-                "rev": "d09db732ff68f40fd3581306c650b17ea1955b4e",
-                "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libunwind.git"
-            },
-            "src/third_party/libvpx/source/libvpx": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-uG9dnz4l28RB8R1AZBR97Fz7RN/ZYknP0/RffR1FJ1g=",
-                "rev": "057e53d759ac05417bbc7880b1d2e2ac7f08fc67",
-                "url": "https://chromium.googlesource.com/webm/libvpx.git"
-            },
-            "src/third_party/libwebm/source": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-u/5nkJed0DzdhR5OLL2kIhZhOnrbyzL1Kx37vV/jcEo=",
-                "rev": "e4fbea0c9751ae8aa86629b197a28d8276a2b0da",
-                "url": "https://chromium.googlesource.com/webm/libwebm.git"
-            },
-            "src/third_party/libwebp/src": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-xuRpEwOnaLGZmrPvfUn3DSoJANd94CG+JXcN7Mdmk5I=",
-                "rev": "845d5476a866141ba35ac133f856fa62f0b7445f",
-                "url": "https://chromium.googlesource.com/webm/libwebp.git"
-            },
-            "src/third_party/libyuv": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-hD5B9fPNwf8M98iS/PYeUJgJxtBvvf2BrrlnBNYXSg0=",
-                "rev": "a6a2ec654b1be1166b376476a7555c89eca0c275",
-                "url": "https://chromium.googlesource.com/libyuv/libyuv.git"
-            },
-            "src/third_party/lss": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-hE8uZf9Fst66qJkoVYChiB8G41ie+k9M4X0W+5JUSdw=",
-                "rev": "ce877209e11aa69dcfffbd53ef90ea1d07136521",
-                "url": "https://chromium.googlesource.com/linux-syscall-support.git"
-            },
-            "src/third_party/material_color_utilities/src": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-Y85XU+z9W6tvmDNHJ/dXQnUKXvvDkO3nH/kUJRLqbc4=",
-                "rev": "13434b50dcb64a482cc91191f8cf6151d90f5465",
-                "url": "https://chromium.googlesource.com/external/github.com/material-foundation/material-color-utilities.git"
-            },
-            "src/third_party/minigbm/src": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-9HwvjTETerbQ7YKXH9kUB2eWa8PxGWMAJfx1jAluhrs=",
-                "rev": "3018207f4d89395cc271278fb9a6558b660885f5",
-                "url": "https://chromium.googlesource.com/chromiumos/platform/minigbm.git"
-            },
-            "src/third_party/nan": {
-                "fetcher": "fetchFromGitHub",
-                "hash": "sha256-cwti+BWmF/l/dqa/cN0C587EK4WwRWcWy6gjFVkaMTg=",
-                "owner": "nodejs",
-                "repo": "nan",
-                "rev": "e14bdcd1f72d62bca1d541b66da43130384ec213"
-            },
-            "src/third_party/nasm": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-SiRXHsUlWXtH6dbDjDjqNAm105ibEB3jOfNtQAM4CaY=",
-                "rev": "f477acb1049f5e043904b87b825c5915084a9a29",
-                "url": "https://chromium.googlesource.com/chromium/deps/nasm.git"
-            },
-            "src/third_party/nearby/src": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-1cj+yG9B9hEvPiGW0jGJhiFG882l56PvgEUXyCBFsSk=",
-                "rev": "76651429b8f96fc6c80949ba8f4e18c4b738e216",
-                "url": "https://chromium.googlesource.com/external/github.com/google/nearby-connections.git"
-            },
-            "src/third_party/neon_2_sse/src": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-299ZptvdTmCnIuVVBkrpf5ZTxKPwgcGUob81tEI91F0=",
-                "rev": "a15b489e1222b2087007546b4912e21293ea86ff",
-                "url": "https://chromium.googlesource.com/external/github.com/intel/ARM_NEON_2_x86_SSE.git"
-            },
-            "src/third_party/openh264/src": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-J7Eqe2QevZh1xfap19W8AVCcwfRu7ztknnbKFJUAH1c=",
-                "rev": "09a4f3ec842a8932341b195c5b01e141c8a16eb7",
-                "url": "https://chromium.googlesource.com/external/github.com/cisco/openh264"
-            },
-            "src/third_party/openscreen/src": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-x/SiWPBPeU2Rg7WqrwZcFvDk2J8ILTXyMEGix8r+7Js=",
-                "rev": "4f7c05781bc43e93706b0330eb830e2bc33fcb6c",
-                "url": "https://chromium.googlesource.com/openscreen"
-            },
-            "src/third_party/openscreen/src/buildtools": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-suuxUL//BfAMmG8os8ChI7ic9EjGTi7y5kjxiAyrEQc=",
-                "rev": "4e0e9c73a0f26735f034f09a9cab2a5c0178536b",
-                "url": "https://chromium.googlesource.com/chromium/src/buildtools"
-            },
-            "src/third_party/openscreen/src/third_party/tinycbor/src": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-fMKBFUSKmODQyg4hKIa1hwnEKIV6WBbY1Gb8DOSnaHA=",
-                "rev": "d393c16f3eb30d0c47e6f9d92db62272f0ec4dc7",
-                "url": "https://chromium.googlesource.com/external/github.com/intel/tinycbor.git"
-            },
-            "src/third_party/ots/src": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-kiUXrXsaGOzPkKh0dVmU1I13WHt0Stzj7QLMqHN9FbU=",
-                "rev": "46bea9879127d0ff1c6601b078e2ce98e83fcd33",
-                "url": "https://chromium.googlesource.com/external/github.com/khaledhosny/ots.git"
-            },
-            "src/third_party/pdfium": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-GRihOFfswz+cNDxU/6LHZLp6rVSuHhz+5apRXQapOnQ=",
-                "rev": "66c80ddf43e3c3181d404607dcdc0cf37fdf7675",
-                "url": "https://pdfium.googlesource.com/pdfium.git"
-            },
-            "src/third_party/perfetto": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-zs3PFwBmIxSfAk4HZpKsezkyE9kqaFNTbFQ7MSCl20Y=",
-                "rev": "077d742d9f9738a0453e408560a283a7514c9e8e",
-                "url": "https://android.googlesource.com/platform/external/perfetto.git"
-            },
-            "src/third_party/protobuf-javascript/src": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-TmP6xftUVTD7yML7UEM/DB8bcsL5RFlKPyCpcboD86U=",
-                "rev": "e34549db516f8712f678fcd4bc411613b5cc5295",
-                "url": "https://chromium.googlesource.com/external/github.com/protocolbuffers/protobuf-javascript"
-            },
-            "src/third_party/pthreadpool/src": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-R4YmNzWEELSkAws/ejmNVxqXDTJwcqjLU/o/HvgRn2E=",
-                "rev": "4fe0e1e183925bf8cfa6aae24237e724a96479b8",
-                "url": "https://chromium.googlesource.com/external/github.com/Maratyszcza/pthreadpool.git"
-            },
-            "src/third_party/pyelftools": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-I/7p3IEvfP/gkes4kx18PvWwhAKilQKb67GXoW4zFB4=",
-                "rev": "19b3e610c86fcadb837d252c794cb5e8008826ae",
-                "url": "https://chromium.googlesource.com/chromiumos/third_party/pyelftools.git"
-            },
-            "src/third_party/pywebsocket3/src": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-WEqqu2/7fLqcf/2/IcD7/FewRSZ6jTgVlVBvnihthYQ=",
-                "rev": "50602a14f1b6da17e0b619833a13addc6ea78bc2",
-                "url": "https://chromium.googlesource.com/external/github.com/GoogleChromeLabs/pywebsocket3.git"
-            },
-            "src/third_party/quic_trace/src": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-Nf9ZDLcE1JunhbpEMHhrY2ROnbgrvVZoRkPwWq1DU0g=",
-                "rev": "caa0a6eaba816ecb737f9a70782b7c80b8ac8dbc",
-                "url": "https://chromium.googlesource.com/external/github.com/google/quic-trace.git"
-            },
-            "src/third_party/re2/src": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-IeANwJlJl45yf8iu/AZNDoiyIvTCZIeK1b74sdCfAIc=",
-                "rev": "6dcd83d60f7944926bfd308cc13979fc53dd69ca",
-                "url": "https://chromium.googlesource.com/external/github.com/google/re2.git"
-            },
-            "src/third_party/ruy/src": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-4NVvqUZn2BdwTxJINTHwPeRqbGXZrWdcd7jv1Y+eoKY=",
-                "rev": "c08ec529fc91722bde519628d9449258082eb847",
-                "url": "https://chromium.googlesource.com/external/github.com/google/ruy.git"
-            },
-            "src/third_party/securemessage/src": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-GS4ccnuiqxMs/LVYAtvSlVAYFp4a5GoZsxcriTX3k78=",
-                "rev": "fa07beb12babc3b25e0c5b1f38c16aa8cb6b8f84",
-                "url": "https://chromium.googlesource.com/external/github.com/google/securemessage.git"
-            },
-            "src/third_party/skia": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-vclLETDkiiBinfvse++0CF9/1+qZeG5vcukTTmqPYiU=",
-                "rev": "cd98397d0c2c3eb1d5a8d76aade3c87c2e0d28ac",
-                "url": "https://skia.googlesource.com/skia.git"
-            },
-            "src/third_party/smhasher/src": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-RyC//me08hwGXRrWcK8GZ1uhIkBq4FByA7fHCVDsniw=",
-                "rev": "e87738e57558e0ec472b2fc3a643b838e5b6e88f",
-                "url": "https://chromium.googlesource.com/external/smhasher.git"
-            },
-            "src/third_party/snappy/src": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-5fV6NfO8vmqK+iCwpLtE2YjYOzjsshctauyjNIOxrH0=",
-                "rev": "c9f9edf6d75bb065fa47468bf035e051a57bec7c",
-                "url": "https://chromium.googlesource.com/external/github.com/google/snappy.git"
-            },
-            "src/third_party/speedometer/v3.0": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-qMQ4naX+4uUu3vtzzinjkhxX9/dNoTwj6vWCu4FdQmU=",
-                "rev": "8d67f28d0281ac4330f283495b7f48286654ad7d",
-                "url": "https://chromium.googlesource.com/external/github.com/WebKit/Speedometer.git"
-            },
-            "src/third_party/spirv-cross/src": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-H43M9DXfEuyKuvo6rjb5k0KEbYOSFodbPJh8ZKY4PQg=",
-                "rev": "b8fcf307f1f347089e3c46eb4451d27f32ebc8d3",
-                "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/SPIRV-Cross"
-            },
-            "src/third_party/spirv-headers/src": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-5lRPxsfXGWimJ7jNtM6kJembcAz357ER8PwFXnh6o4E=",
-                "rev": "db5a00f8cebe81146cafabf89019674a3c4bf03d",
-                "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/SPIRV-Headers"
-            },
-            "src/third_party/spirv-tools/src": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-Uld5cLV+oD0wm8TxK0V15yiwrdiUbWGqPQEbtMW9Apg=",
-                "rev": "a0817526b8e391732632e6a887134be256a20a18",
-                "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/SPIRV-Tools"
-            },
-            "src/third_party/sqlite/src": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-ZDByCZjc0coy19a0/BkVAU8y/Fkt7FKgWtCwI5K0Tdo=",
-                "rev": "9e45bccab2b8de8140c1732b0ec490db0362f730",
-                "url": "https://chromium.googlesource.com/chromium/deps/sqlite.git"
-            },
-            "src/third_party/squirrel.mac": {
-                "fetcher": "fetchFromGitHub",
-                "hash": "sha256-4GfKQg0u3c9GI+jl3ixESNqWXQJKRMi+00QT0s2Shqw=",
-                "owner": "Squirrel",
-                "repo": "Squirrel.Mac",
-                "rev": "0e5d146ba13101a1302d59ea6e6e0b3cace4ae38"
-            },
-            "src/third_party/squirrel.mac/vendor/Mantle": {
-                "fetcher": "fetchFromGitHub",
-                "hash": "sha256-ogFkMJybf2Ue606ojXJu6Gy5aXSi1bSKm60qcTAIaPk=",
-                "owner": "Mantle",
-                "repo": "Mantle",
-                "rev": "78d3966b3c331292ea29ec38661b25df0a245948"
-            },
-            "src/third_party/squirrel.mac/vendor/ReactiveObjC": {
-                "fetcher": "fetchFromGitHub",
-                "hash": "sha256-/MCqC1oFe3N9TsmfVLgl+deR6qHU6ZFQQjudb9zB5Mo=",
-                "owner": "ReactiveCocoa",
-                "repo": "ReactiveObjC",
-                "rev": "74ab5baccc6f7202c8ac69a8d1e152c29dc1ea76"
-            },
-            "src/third_party/swiftshader": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-YGVv/wDle+VyO/Ue7wR004dl8nvO5GjmDeWsoC30+kc=",
-                "rev": "c4dfa69de7deecf52c6b53badbc8bb7be1a05e8c",
-                "url": "https://swiftshader.googlesource.com/SwiftShader.git"
-            },
-            "src/third_party/text-fragments-polyfill/src": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-4rW2u1cQAF4iPWHAt1FvVXIpz2pmI901rEPks/w/iFA=",
-                "rev": "c036420683f672d685e27415de0a5f5e85bdc23f",
-                "url": "https://chromium.googlesource.com/external/github.com/GoogleChromeLabs/text-fragments-polyfill.git"
-            },
-            "src/third_party/tflite/src": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-2iYz04vqZI1nbvtnMjjy6aE9PMzvpLhttNbTrEvhC4M=",
-                "rev": "f9122e774969459927e9d956674c0aac06eb3b68",
-                "url": "https://chromium.googlesource.com/external/github.com/tensorflow/tensorflow.git"
-            },
-            "src/third_party/ukey2/src": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-aaLs6ZS+CdBlCJ6ZhsmdAPFxiBIij6oufsDcNeRSV1E=",
-                "rev": "0275885d8e6038c39b8a8ca55e75d1d4d1727f47",
-                "url": "https://chromium.googlesource.com/external/github.com/google/ukey2.git"
-            },
-            "src/third_party/vulkan-deps": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-88nATFDj0QqE57ZH7effuNXByjYwGI58SYiAdvyjrt8=",
-                "rev": "d8095b45a0b2dcc2a85327ff4cc306c618dfa39a",
-                "url": "https://chromium.googlesource.com/vulkan-deps"
-            },
-            "src/third_party/vulkan-headers/src": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-5gslQRGEeHu7lshmlM6SON+P6cKTGOYrmwkBRmu9NIw=",
-                "rev": "fabe9e2672334fdb9a622d42a2e8f94578952082",
-                "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Headers"
-            },
-            "src/third_party/vulkan-loader/src": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-CwBKsSCvrhp8gw9zm5lw+aJ/lzYksXd5zGZw0abw2JY=",
-                "rev": "5892ebe2d7505c2238a643288d9a5b2e68784a36",
-                "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Loader"
-            },
-            "src/third_party/vulkan-tools/src": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-BraOoeYPOaLw7LfqnG+bZHQiJtWByYjnUU8Gw5ee29k=",
-                "rev": "2cee0d5b1d8c34e26fd6d9992d3d428ac4c5139d",
-                "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Tools"
-            },
-            "src/third_party/vulkan-utility-libraries/src": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-0p4CEh0BzMXRDxOh72QIPUjhYFB+9cna2bRtJXEGE/M=",
-                "rev": "67522b34edde86dbb97e164280291f387ade55fc",
-                "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Utility-Libraries"
-            },
-            "src/third_party/vulkan-validation-layers/src": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-ompMbxRxa0acD/+a830N0VL88s1GepOO0e8Rkg5Nmjk=",
-                "rev": "919599474e6e6639527e7c3775ed1064665412d3",
-                "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-ValidationLayers"
-            },
-            "src/third_party/vulkan_memory_allocator": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-YzxHZagz/M8Y54UnI4h1wu5jSTuaOgv0ifC9d3fJZlQ=",
-                "rev": "56300b29fbfcc693ee6609ddad3fdd5b7a449a21",
-                "url": "https://chromium.googlesource.com/external/github.com/GPUOpen-LibrariesAndSDKs/VulkanMemoryAllocator.git"
-            },
-            "src/third_party/wayland-protocols/gtk": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-75XNnLkF5Lt1LMRGT+T61k0/mLa3kkynfN+QWvZ0LiQ=",
-                "rev": "40ebed3a03aef096addc0af09fec4ec529d882a0",
-                "url": "https://chromium.googlesource.com/external/github.com/GNOME/gtk.git"
-            },
-            "src/third_party/wayland-protocols/kde": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-Dmcp/2ms/k7NxPPmPkp0YNfM9z2Es1ZO0uX10bc7N2Y=",
-                "rev": "0b07950714b3a36c9b9f71fc025fc7783e82926e",
-                "url": "https://chromium.googlesource.com/external/github.com/KDE/plasma-wayland-protocols.git"
-            },
-            "src/third_party/wayland-protocols/src": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-5gWBte8oiuXM01StvyXFAsxFwuQZHjZT/LZ6l0mvrwI=",
-                "rev": "c7e9c4f5d396cda4051e49b15d7d0e4f91e4efac",
-                "url": "https://chromium.googlesource.com/external/anongit.freedesktop.org/git/wayland/wayland-protocols.git"
-            },
-            "src/third_party/wayland/src": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-Cxu9+Kzw2t1BDfuGzNobaraT4eJcSPO7jvnHpuUANoo=",
-                "rev": "31577177454b89db37ceabd94e1640d398adbc87",
-                "url": "https://chromium.googlesource.com/external/anongit.freedesktop.org/git/wayland/wayland.git"
-            },
-            "src/third_party/webdriver/pylib": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-WIqWXIKVgElgg8P8laLAlUrgwodGdeVcwohZxnPKedw=",
-                "rev": "fc5e7e70c098bfb189a9a74746809ad3c5c34e04",
-                "url": "https://chromium.googlesource.com/external/github.com/SeleniumHQ/selenium/py.git"
-            },
-            "src/third_party/webgl/src": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-Yn0e1bpvtD4mGdZaRiBytc+upLulYVyHJqXJiTWEfmA=",
-                "rev": "1b6371436a0a60e6b9a4ae2a40a8eba198e3af02",
-                "url": "https://chromium.googlesource.com/external/khronosgroup/webgl.git"
-            },
-            "src/third_party/webgpu-cts/src": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-4ZDhNhd4kh2lT47PV9zBISNmZDqxZO8WY+pTtxajEfw=",
-                "rev": "198d1770062c1a8aba86e7d6e001bb47bea028ee",
-                "url": "https://chromium.googlesource.com/external/github.com/gpuweb/cts.git"
-            },
-            "src/third_party/webrtc": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-ZHkIEiazTp9MBDUufupLGeV97UEfjTwXxG87OUeHcog=",
-                "rev": "f237dc146debcfde3d70038c2b66f71bfea8d24b",
-                "url": "https://webrtc.googlesource.com/src.git"
-            },
-            "src/third_party/weston/src": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-y2srFaPUOoB2umzpo4+hFfhNlqXM2AoMGOpUy/ZSacg=",
-                "rev": "ccf29cb237c3ed09c5f370f35239c93d07abfdd7",
-                "url": "https://chromium.googlesource.com/external/anongit.freedesktop.org/git/wayland/weston.git"
-            },
-            "src/third_party/wuffs/src": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-373d2F/STcgCHEq+PO+SCHrKVOo6uO1rqqwRN5eeBCw=",
-                "rev": "e3f919ccfe3ef542cfc983a82146070258fb57f8",
-                "url": "https://skia.googlesource.com/external/github.com/google/wuffs-mirror-release-c.git"
-            },
-            "src/third_party/xdg-utils": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-WuQ9uDq+QD17Y20ACFGres4nbkeOiTE2y+tY1avAT5U=",
-                "rev": "cb54d9db2e535ee4ef13cc91b65a1e2741a94a44",
-                "url": "https://chromium.googlesource.com/chromium/deps/xdg-utils.git"
-            },
-            "src/third_party/xnnpack/src": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-JO49N/vJz2nske13dcNFxC9hO7oO/1X6AsNnRCW/RqI=",
-                "rev": "8df2e765487685757ab5dabd12516cd0a24e3e25",
-                "url": "https://chromium.googlesource.com/external/github.com/google/XNNPACK.git"
-            },
-            "src/third_party/zstd/src": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-sy6cs+c3t/XlwwJOMKCuBmoyrOiYHYeqsr/uOMVOdlI=",
-                "rev": "0ff651dd876823b99fa5c5f53292be28381aee9b",
-                "url": "https://chromium.googlesource.com/external/github.com/facebook/zstd.git"
-            },
-            "src/tools/page_cycler/acid3": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-s/49EaYQRsyxuLejXc1zGDYTD7uO0ddaQIJBP50Bvw0=",
-                "rev": "a926d0a32e02c4c03ae95bb798e6c780e0e184ba",
-                "url": "https://chromium.googlesource.com/chromium/deps/acid3.git"
-            },
-            "src/v8": {
-                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-VwRVnondH9YM8pYRQo0l0jM0Zb531kpQTo6ngvEPOBg=",
-                "rev": "d213b3bbc0ecf17ccd2849fdef3bccb1946b01b3",
-                "url": "https://chromium.googlesource.com/v8/v8.git"
-            }
-        },
-        "electron_yarn_hash": "122y1vnizwg0rwz8qf37mvpa0i78141y98wn4h11l6b9gyshrs65",
-        "modules": "128",
-        "node": "20.18.1",
-        "version": "32.3.2"
-    },
     "33": {
         "chrome": "130.0.6723.191",
         "chromium": {

pkgs/games/lzwolf/default.nix

@@ -1,92 +0,0 @@
-{
-  stdenv,
-  lib,
-  fetchFromBitbucket,
-  fetchpatch,
-  p7zip,
-  cmake,
-  SDL2,
-  bzip2,
-  zlib,
-  libjpeg,
-  libsndfile,
-  mpg123,
-  pkg-config,
-  SDL2_net,
-  SDL2_mixer,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "lzwolf";
-  # Fix-Me: Remember to remove SDL2_mixer pin (at top-level) on next lzwolf upgrade.
-  version = "unstable-2022-12-26";
-
-  src = fetchFromBitbucket {
-    owner = "linuxwolf6";
-    repo = "lzwolf";
-    rev = "a24190604296e16941c601b57afe4350462fc659";
-    hash = "sha256-CtBdvk6LXb/ll92Fxig/M4t4QNj8dNFJYd8F99b47kQ=";
-  };
-
-  patches = [
-    # Pull fix pending upstream inclusion for `gcc-13` support:
-    #   https://bitbucket.org/linuxwolf6/lzwolf/pull-requests/5
-    (fetchpatch {
-      name = "gcc-13.patch";
-      url = "https://bitbucket.org/soturi/lzwolf/commits/41f212026dff4f089d1c0921cb49ab1a2b81e0d6/raw";
-      hash = "sha256-EgSdDaZovD7DyZ0BkuX8ZdsrX7J7v8/D6y5P1NWGJew=";
-    })
-    # Fixes build with gcc >= 14. Picked patch from the original ecwolf repo.
-    (fetchpatch {
-      name = "tmemory.h-const-correctness.patch";
-      url = "https://bitbucket.org/ecwolf/ecwolf/commits/400aaf96a36a14ab8eab18a670ba6439046f3bb0/raw";
-      hash = "sha256-2YwHEctBPyprs0DVsazimGEgmiCba24zh2dFfw9tOnU=";
-    })
-  ];
-
-  postPatch = ''
-    # SDL2_net-2.2.0 changed CMake component name slightly.
-    substituteInPlace src/CMakeLists.txt \
-      --replace 'SDL2::SDL2_net' 'SDL2_net::SDL2_net'
-  '';
-
-  nativeBuildInputs = [
-    p7zip
-    pkg-config
-    cmake
-  ];
-  buildInputs = [
-    SDL2
-    bzip2
-    zlib
-    libjpeg
-    SDL2_mixer
-    SDL2_net
-    libsndfile
-    mpg123
-  ];
-
-  cmakeFlags = [
-    "-DGPL=ON"
-  ];
-
-  doCheck = true;
-
-  installPhase = ''
-    install -Dm755 lzwolf "$out/lib/lzwolf/lzwolf"
-    for i in *.pk3; do
-      install -Dm644 "$i" "$out/lib/lzwolf/$i"
-    done
-    mkdir -p $out/bin
-    ln -s $out/lib/lzwolf/lzwolf $out/bin/lzwolf
-  '';
-
-  meta = with lib; {
-    homepage = "https://bitbucket.org/linuxwolf6/lzwolf";
-    description = "Enhanced fork of ECWolf, a Wolfenstein 3D source port";
-    mainProgram = "lzwolf";
-    license = licenses.gpl2Plus;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ ];
-  };
-}

pkgs/os-specific/linux/decklink/default.nix

@@ -3,6 +3,7 @@
   lib,
   blackmagic-desktop-video,
   kernel,
+  fetchpatch,
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "decklink";
@@ -12,6 +13,15 @@ stdenv.mkDerivation (finalAttrs: {
   # See pkgs/by-name/bl/blackmagic-desktop-video/package.nix for more.
   inherit (blackmagic-desktop-video) src version;
 
+  patches = lib.optionals (lib.versionAtLeast kernel.modDirVersion "6.13") [
+    # needed for version 14.4.x to build for kernel 6.13
+    (fetchpatch {
+      name = "01-update-makefiles";
+      url = "https://aur.archlinux.org/cgit/aur.git/plain/01-update-makefiles.patch?h=decklink";
+      hash = "sha256-l3iu0fG/QJMdGI/WSlNn+qjF4nK25JxoiwhPrMGTqE4=";
+    })
+  ];
+
   KERNELDIR = "${kernel.dev}/lib/modules/${kernel.modDirVersion}/build";
   INSTALL_MOD_PATH = placeholder "out";
 

pkgs/tools/networking/networkmanager/default.nix

@@ -60,11 +60,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "networkmanager";
-  version = "1.50.2";
+  version = "1.52.0";
 
   src = fetchurl {
     url = "https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/releases/${finalAttrs.version}/downloads/NetworkManager-${finalAttrs.version}.tar.xz";
-    hash = "sha256-EEc76dOrifiiemi3v1vJVXhRpRg7dLYkHl4PpcaSH+8=";
+    hash = "sha256-NW8hoV2lHkIY/U0P14zqYeBnsRFqJc3e5K+d8FBi6S0=";
   };
 
   outputs = [ "out" "dev" "devdoc" "man" "doc" ];
@@ -106,7 +106,6 @@ stdenv.mkDerivation (finalAttrs: {
 
     # DHCP clients
     "-Ddhcpcd=${dhcpcd}/bin/dhcpcd"
-    "-Ddhcpcanon=no"
 
     # Miscellaneous
     # almost cross-compiles, however fails with

pkgs/tools/package-management/libdnf/default.nix

@@ -25,7 +25,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libdnf";
-  version = "0.73.4";
+  version = "0.74.0";
 
   outputs = [
     "out"
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
     owner = "rpm-software-management";
     repo = pname;
     tag = version;
-    hash = "sha256-O8pN2WFHWxZpr2JEPsQOmkc+7qnMVnptmGJCVxMmSLo=";
+    hash = "sha256-NAnE8VPz2j7h/gB1A4FDwG/x7ki7QEmBjcfvOb6/+VY=";
   };
 
   nativeBuildInputs = [

pkgs/top-level/aliases.nix

@@ -529,6 +529,7 @@ mapAliases {
   gfortran49 = throw "'gfortran49' has been removed from nixpkgs"; # Added 2024-09-11
   gfortran7 = throw "gfortran7 has been removed from Nixpkgs, as it is unmaintained and obsolete"; # Added 2024-11-20
   gfortran8 = throw "gfortran8 has been removed from Nixpkgs, as it is unmaintained and obsolete"; # Added 2024-11-20
+  gg = go-graft; # Added 2025-03-07
   ghostwriter = makePlasma5Throw "ghostwriter"; # Added 2023-03-18
   git-codeowners = throw "'git-codeowners' has been removed due to lack of upstream maintenance"; # Added 2025-01-25
   gmp5 = throw "'gmp5' has been removed as it is unmaintained. Consider using 'gmp' instead"; # Added 2024-10-28
@@ -907,7 +908,7 @@ mapAliases {
   lxd = lib.warnOnInstantiate "lxd has been renamed to lxd-lts" lxd-lts; # Added 2024-04-01
   lxd-unwrapped = lib.warnOnInstantiate "lxd-unwrapped has been renamed to lxd-unwrapped-lts" lxd-unwrapped-lts; # Added 2024-04-01
   lzma = throw "'lzma' has been renamed to/replaced by 'xz'"; # Converted to throw 2024-10-17
-
+  lzwolf = throw "'lzwolf' has been removed because it's no longer maintained upstream. Consider using 'ecwolf'"; # Added 2025-03-02
   ### M ###
 
   ma1sd = throw "ma1sd was dropped as it is unmaintained"; # Added 2024-07-10
@@ -1236,6 +1237,7 @@ mapAliases {
   protobuf3_24 = protobuf_24;
   protobuf3_23 = protobuf_23;
   protobuf3_21 = protobuf_21;
+  protoc-gen-connect-es = throw "'protoc-gen-connect-es' has been removed because it is deprecated upstream. Functionality has been integrated into 'protoc-gen-es' v2."; # Added 2025-02-18
   protonup = protonup-ng; # Added 2022-11-06
   protonvpn-gui_legacy = throw "protonvpn-gui_legacy source code was removed from upstream. Use protonvpn-gui instead."; # Added 2024-10-12
   proxmark3-rrg = proxmark3; # Added 2023-07-25
@@ -1567,6 +1569,7 @@ mapAliases {
   vim_configurable = vim-full; # Added 2022-12-04
   vinagre = throw "'vinagre' has been removed as it has been archived upstream. Consider using 'gnome-connections' or 'remmina' instead"; # Added 2024-09-14
   libviperfx = throw "'libviperfx' was removed as it is broken and not maintained upstream"; # Added 2024-12-16
+  vimix-cursor-theme = throw "'vimix-cursor-theme' has been superseded by 'vimix-cursors'"; # Added 2025-03-04
   viper4linux-gui = throw "'viper4linux-gui' was removed as it is broken and not maintained upstream"; # Added 2024-12-16
   viper4linux = throw "'viper4linux' was removed as it is broken and not maintained upstream"; # Added 2024-12-16
   virtscreen = throw "'virtscreen' has been removed, as it was broken and unmaintained"; # Added 2024-10-17

pkgs/top-level/all-packages.nix

@@ -4133,8 +4133,6 @@ with pkgs;
 
   xz = callPackage ../tools/compression/xz { };
 
-  lzwolf = callPackage ../games/lzwolf { SDL2_mixer = SDL2_mixer_2_0; };
-
   madlang = haskell.lib.compose.justStaticExecutables haskellPackages.madlang;
 
   mailnag = callPackage ../applications/networking/mailreaders/mailnag {
@@ -7485,7 +7483,7 @@ with pkgs;
     electron-chromedriver_34
     ;
 
-  electron_32 = if lib.meta.availableOn stdenv.hostPlatform electron-source.electron_32 then electron-source.electron_32 else electron_32-bin;
+  electron_32 = electron_32-bin;
   electron_33 = if lib.meta.availableOn stdenv.hostPlatform electron-source.electron_33 then electron-source.electron_33 else electron_33-bin;
   electron_34 = electron_34-bin;
   electron = electron_34;
@@ -8504,7 +8502,11 @@ with pkgs;
   inherit (callPackages ../development/libraries/c-blosc { })
     c-blosc c-blosc2;
 
-  cachix = lib.getBin haskellPackages.cachix;
+  cachix = (lib.getBin haskellPackages.cachix).overrideAttrs (old: {
+    meta = (old.meta or {}) // {
+      mainProgram = old.meta.mainProgram or "cachix";
+    };
+  });
 
   cubeb = callPackage ../development/libraries/audio/cubeb {
     inherit (darwin.apple_sdk.frameworks) AudioUnit CoreAudio CoreServices;
@@ -15752,6 +15754,8 @@ with pkgs;
     autoconf = buildPackages.autoconf269;
   };
 
+  zed-editor-fhs = zed-editor.fhs;
+
   zgv = callPackage ../applications/graphics/zgv {
     # Enable the below line for terminal display. Note
     # that it requires sixel graphics compatible terminals like mlterm